Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2024, 07:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c9786c4701f8a3512f7107b3952922e0_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
c9786c4701f8a3512f7107b3952922e0_NeikiAnalytics.exe
-
Size
306KB
-
MD5
c9786c4701f8a3512f7107b3952922e0
-
SHA1
ebff2a7d9aed8fb5bba342ac2faa9af22ec773ec
-
SHA256
f66e549edadd6f2f66f2cbf23e6b6c1e198940f1460bde0721e3981de4ac3e71
-
SHA512
fe40e5745f39c20f808ff6eef674a93491d6851b183c8cefb42fc509d1c3755caa16ee6c8afb61531cb7d0d22d08d73c99378068c130146751360b0c219c0917
-
SSDEEP
6144:n3C9BRo/CH26ZAmaOXicLrnRukAPXt1UP+3OgEbXeTiDSd2vr:n3C9uUnAvtd3Ogld2vr
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/4848-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4456-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4696-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3584-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3280-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/312-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4436-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/912-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3820-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4180-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1584-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1652-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3840-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/372-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/440-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4356-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3992-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4864-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4604-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4996 xfrlxxf.exe 2368 nbnthh.exe 4456 jjjdd.exe 4696 lfxlfxr.exe 3584 tnhbbb.exe 3280 llfxrrl.exe 312 3nhnbb.exe 4436 jvddd.exe 912 bhthbt.exe 4248 ppppp.exe 3820 lxffrrr.exe 4180 ppvpp.exe 4172 lfffflr.exe 1584 5bhbtn.exe 3560 5jvpp.exe 1652 3rxrrrl.exe 3840 nhtntn.exe 2324 pvdvv.exe 408 lxfxlxx.exe 372 7bbttb.exe 3244 5pjdv.exe 440 frflrxr.exe 4356 tbhbnh.exe 3992 jjvdv.exe 4864 lrlllll.exe 4412 hnbbtb.exe 1956 9tttnn.exe 2416 dvvvv.exe 4604 xrrllll.exe 4468 1htbbh.exe 3044 1dvpd.exe 4508 rxlfxxr.exe 5052 nthhhh.exe 4296 dppdv.exe 4788 llfxxxx.exe 4808 1hhbtn.exe 2368 7vvjd.exe 5020 vdjvd.exe 3296 xfxxrxr.exe 1172 hnbnhb.exe 3496 hbbbtn.exe 3284 vjvpj.exe 2168 7xxrffr.exe 2404 3hnhhb.exe 4436 1hnbbt.exe 3200 jjdvd.exe 3444 lrlxxxf.exe 4248 bthbtt.exe 3820 jdjdj.exe 3908 lxrlffx.exe 3236 3xrlxrl.exe 3884 thhnhb.exe 3868 pdjdp.exe 2428 rrfrlxr.exe 2060 fxrlxrl.exe 3288 hhtthh.exe 3596 dpvpv.exe 2304 3lrfrlf.exe 1840 lxlffff.exe 3076 7hhbbb.exe 1460 jddpj.exe 1568 tbhbtn.exe 4928 nhbntn.exe 1720 pvpdp.exe -
resource yara_rule behavioral2/memory/4848-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4696-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3584-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3280-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/312-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/312-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/312-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4436-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/912-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3820-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4180-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1584-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1652-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3840-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/372-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/440-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3992-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4848 wrote to memory of 4996 4848 c9786c4701f8a3512f7107b3952922e0_NeikiAnalytics.exe 85 PID 4848 wrote to memory of 4996 4848 c9786c4701f8a3512f7107b3952922e0_NeikiAnalytics.exe 85 PID 4848 wrote to memory of 4996 4848 c9786c4701f8a3512f7107b3952922e0_NeikiAnalytics.exe 85 PID 4996 wrote to memory of 2368 4996 xfrlxxf.exe 86 PID 4996 wrote to memory of 2368 4996 xfrlxxf.exe 86 PID 4996 wrote to memory of 2368 4996 xfrlxxf.exe 86 PID 2368 wrote to memory of 4456 2368 nbnthh.exe 87 PID 2368 wrote to memory of 4456 2368 nbnthh.exe 87 PID 2368 wrote to memory of 4456 2368 nbnthh.exe 87 PID 4456 wrote to memory of 4696 4456 jjjdd.exe 88 PID 4456 wrote to memory of 4696 4456 jjjdd.exe 88 PID 4456 wrote to memory of 4696 4456 jjjdd.exe 88 PID 4696 wrote to memory of 3584 4696 lfxlfxr.exe 89 PID 4696 wrote to memory of 3584 4696 lfxlfxr.exe 89 PID 4696 wrote to memory of 3584 4696 lfxlfxr.exe 89 PID 3584 wrote to memory of 3280 3584 tnhbbb.exe 90 PID 3584 wrote to memory of 3280 3584 tnhbbb.exe 90 PID 3584 wrote to memory of 3280 3584 tnhbbb.exe 90 PID 3280 wrote to memory of 312 3280 llfxrrl.exe 91 PID 3280 wrote to memory of 312 3280 llfxrrl.exe 91 PID 3280 wrote to memory of 312 3280 llfxrrl.exe 91 PID 312 wrote to memory of 4436 312 3nhnbb.exe 92 PID 312 wrote to memory of 4436 312 3nhnbb.exe 92 PID 312 wrote to memory of 4436 312 3nhnbb.exe 92 PID 4436 wrote to memory of 912 4436 jvddd.exe 93 PID 4436 wrote to memory of 912 4436 jvddd.exe 93 PID 4436 wrote to memory of 912 4436 jvddd.exe 93 PID 912 wrote to memory of 4248 912 bhthbt.exe 94 PID 912 wrote to memory of 4248 912 bhthbt.exe 94 PID 912 wrote to memory of 4248 912 bhthbt.exe 94 PID 4248 wrote to memory of 3820 4248 ppppp.exe 95 PID 4248 wrote to memory of 3820 4248 ppppp.exe 95 PID 4248 wrote to memory of 3820 4248 ppppp.exe 95 PID 3820 wrote to memory of 4180 3820 lxffrrr.exe 96 PID 3820 wrote to memory of 4180 3820 lxffrrr.exe 96 PID 3820 wrote to memory of 4180 3820 lxffrrr.exe 96 PID 4180 wrote to memory of 4172 4180 ppvpp.exe 97 PID 4180 wrote to memory of 4172 4180 ppvpp.exe 97 PID 4180 wrote to memory of 4172 4180 ppvpp.exe 97 PID 4172 wrote to memory of 1584 4172 lfffflr.exe 99 PID 4172 wrote to memory of 1584 4172 lfffflr.exe 99 PID 4172 wrote to memory of 1584 4172 lfffflr.exe 99 PID 1584 wrote to memory of 3560 1584 5bhbtn.exe 100 PID 1584 wrote to memory of 3560 1584 5bhbtn.exe 100 PID 1584 wrote to memory of 3560 1584 5bhbtn.exe 100 PID 3560 wrote to memory of 1652 3560 5jvpp.exe 101 PID 3560 wrote to memory of 1652 3560 5jvpp.exe 101 PID 3560 wrote to memory of 1652 3560 5jvpp.exe 101 PID 1652 wrote to memory of 3840 1652 3rxrrrl.exe 102 PID 1652 wrote to memory of 3840 1652 3rxrrrl.exe 102 PID 1652 wrote to memory of 3840 1652 3rxrrrl.exe 102 PID 3840 wrote to memory of 2324 3840 nhtntn.exe 103 PID 3840 wrote to memory of 2324 3840 nhtntn.exe 103 PID 3840 wrote to memory of 2324 3840 nhtntn.exe 103 PID 2324 wrote to memory of 408 2324 pvdvv.exe 104 PID 2324 wrote to memory of 408 2324 pvdvv.exe 104 PID 2324 wrote to memory of 408 2324 pvdvv.exe 104 PID 408 wrote to memory of 372 408 lxfxlxx.exe 105 PID 408 wrote to memory of 372 408 lxfxlxx.exe 105 PID 408 wrote to memory of 372 408 lxfxlxx.exe 105 PID 372 wrote to memory of 3244 372 7bbttb.exe 106 PID 372 wrote to memory of 3244 372 7bbttb.exe 106 PID 372 wrote to memory of 3244 372 7bbttb.exe 106 PID 3244 wrote to memory of 440 3244 5pjdv.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9786c4701f8a3512f7107b3952922e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\c9786c4701f8a3512f7107b3952922e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\xfrlxxf.exec:\xfrlxxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\nbnthh.exec:\nbnthh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\jjjdd.exec:\jjjdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\lfxlfxr.exec:\lfxlfxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\tnhbbb.exec:\tnhbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\llfxrrl.exec:\llfxrrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\3nhnbb.exec:\3nhnbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312 -
\??\c:\jvddd.exec:\jvddd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\bhthbt.exec:\bhthbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\ppppp.exec:\ppppp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\lxffrrr.exec:\lxffrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
\??\c:\ppvpp.exec:\ppvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\lfffflr.exec:\lfffflr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\5bhbtn.exec:\5bhbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\5jvpp.exec:\5jvpp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\3rxrrrl.exec:\3rxrrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\nhtntn.exec:\nhtntn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\pvdvv.exec:\pvdvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\lxfxlxx.exec:\lxfxlxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\7bbttb.exec:\7bbttb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\5pjdv.exec:\5pjdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\frflrxr.exec:\frflrxr.exe23⤵
- Executes dropped EXE
PID:440 -
\??\c:\tbhbnh.exec:\tbhbnh.exe24⤵
- Executes dropped EXE
PID:4356 -
\??\c:\jjvdv.exec:\jjvdv.exe25⤵
- Executes dropped EXE
PID:3992 -
\??\c:\lrlllll.exec:\lrlllll.exe26⤵
- Executes dropped EXE
PID:4864 -
\??\c:\hnbbtb.exec:\hnbbtb.exe27⤵
- Executes dropped EXE
PID:4412 -
\??\c:\9tttnn.exec:\9tttnn.exe28⤵
- Executes dropped EXE
PID:1956 -
\??\c:\dvvvv.exec:\dvvvv.exe29⤵
- Executes dropped EXE
PID:2416 -
\??\c:\xrrllll.exec:\xrrllll.exe30⤵
- Executes dropped EXE
PID:4604 -
\??\c:\1htbbh.exec:\1htbbh.exe31⤵
- Executes dropped EXE
PID:4468 -
\??\c:\1dvpd.exec:\1dvpd.exe32⤵
- Executes dropped EXE
PID:3044 -
\??\c:\rxlfxxr.exec:\rxlfxxr.exe33⤵
- Executes dropped EXE
PID:4508 -
\??\c:\nthhhh.exec:\nthhhh.exe34⤵
- Executes dropped EXE
PID:5052 -
\??\c:\dppdv.exec:\dppdv.exe35⤵
- Executes dropped EXE
PID:4296 -
\??\c:\llfxxxx.exec:\llfxxxx.exe36⤵
- Executes dropped EXE
PID:4788 -
\??\c:\1hhbtn.exec:\1hhbtn.exe37⤵
- Executes dropped EXE
PID:4808 -
\??\c:\7vvjd.exec:\7vvjd.exe38⤵
- Executes dropped EXE
PID:2368 -
\??\c:\vdjvd.exec:\vdjvd.exe39⤵
- Executes dropped EXE
PID:5020 -
\??\c:\xfxxrxr.exec:\xfxxrxr.exe40⤵
- Executes dropped EXE
PID:3296 -
\??\c:\hnbnhb.exec:\hnbnhb.exe41⤵
- Executes dropped EXE
PID:1172 -
\??\c:\hbbbtn.exec:\hbbbtn.exe42⤵
- Executes dropped EXE
PID:3496 -
\??\c:\vjvpj.exec:\vjvpj.exe43⤵
- Executes dropped EXE
PID:3284 -
\??\c:\7xxrffr.exec:\7xxrffr.exe44⤵
- Executes dropped EXE
PID:2168 -
\??\c:\3hnhhb.exec:\3hnhhb.exe45⤵
- Executes dropped EXE
PID:2404 -
\??\c:\1hnbbt.exec:\1hnbbt.exe46⤵
- Executes dropped EXE
PID:4436 -
\??\c:\jjdvd.exec:\jjdvd.exe47⤵
- Executes dropped EXE
PID:3200 -
\??\c:\lrlxxxf.exec:\lrlxxxf.exe48⤵
- Executes dropped EXE
PID:3444 -
\??\c:\bthbtt.exec:\bthbtt.exe49⤵
- Executes dropped EXE
PID:4248 -
\??\c:\jdjdj.exec:\jdjdj.exe50⤵
- Executes dropped EXE
PID:3820 -
\??\c:\lxrlffx.exec:\lxrlffx.exe51⤵
- Executes dropped EXE
PID:3908 -
\??\c:\3xrlxrl.exec:\3xrlxrl.exe52⤵
- Executes dropped EXE
PID:3236 -
\??\c:\thhnhb.exec:\thhnhb.exe53⤵
- Executes dropped EXE
PID:3884 -
\??\c:\pdjdp.exec:\pdjdp.exe54⤵
- Executes dropped EXE
PID:3868 -
\??\c:\rrfrlxr.exec:\rrfrlxr.exe55⤵
- Executes dropped EXE
PID:2428 -
\??\c:\fxrlxrl.exec:\fxrlxrl.exe56⤵
- Executes dropped EXE
PID:2060 -
\??\c:\hhtthh.exec:\hhtthh.exe57⤵
- Executes dropped EXE
PID:3288 -
\??\c:\dpvpv.exec:\dpvpv.exe58⤵
- Executes dropped EXE
PID:3596 -
\??\c:\3lrfrlf.exec:\3lrfrlf.exe59⤵
- Executes dropped EXE
PID:2304 -
\??\c:\lxlffff.exec:\lxlffff.exe60⤵
- Executes dropped EXE
PID:1840 -
\??\c:\7hhbbb.exec:\7hhbbb.exe61⤵
- Executes dropped EXE
PID:3076 -
\??\c:\jddpj.exec:\jddpj.exe62⤵
- Executes dropped EXE
PID:1460 -
\??\c:\tbhbtn.exec:\tbhbtn.exe63⤵
- Executes dropped EXE
PID:1568 -
\??\c:\nhbntn.exec:\nhbntn.exe64⤵
- Executes dropped EXE
PID:4928 -
\??\c:\pvpdp.exec:\pvpdp.exe65⤵
- Executes dropped EXE
PID:1720 -
\??\c:\ffrfxrx.exec:\ffrfxrx.exe66⤵PID:4600
-
\??\c:\1nhthb.exec:\1nhthb.exe67⤵PID:4184
-
\??\c:\3nnhtt.exec:\3nnhtt.exe68⤵PID:968
-
\??\c:\jjvpj.exec:\jjvpj.exe69⤵PID:1820
-
\??\c:\fxrrffx.exec:\fxrrffx.exe70⤵PID:3184
-
\??\c:\1tbbbb.exec:\1tbbbb.exe71⤵PID:4396
-
\??\c:\vdvjv.exec:\vdvjv.exe72⤵PID:1692
-
\??\c:\dvjdj.exec:\dvjdj.exe73⤵PID:1724
-
\??\c:\rlxrffx.exec:\rlxrffx.exe74⤵PID:3524
-
\??\c:\xrrlllf.exec:\xrrlllf.exe75⤵PID:1388
-
\??\c:\thbtnn.exec:\thbtnn.exe76⤵PID:4500
-
\??\c:\vpvvp.exec:\vpvvp.exe77⤵PID:4744
-
\??\c:\dvpjd.exec:\dvpjd.exe78⤵PID:3224
-
\??\c:\rrxrfxl.exec:\rrxrfxl.exe79⤵PID:2832
-
\??\c:\btbttt.exec:\btbttt.exe80⤵PID:1512
-
\??\c:\nhnhht.exec:\nhnhht.exe81⤵PID:4836
-
\??\c:\jvdpd.exec:\jvdpd.exe82⤵PID:4796
-
\??\c:\rrfxflf.exec:\rrfxflf.exe83⤵PID:4808
-
\??\c:\lxrlxxr.exec:\lxrlxxr.exe84⤵PID:4456
-
\??\c:\ntthbb.exec:\ntthbb.exe85⤵PID:5020
-
\??\c:\ddddp.exec:\ddddp.exe86⤵PID:3296
-
\??\c:\pjjjv.exec:\pjjjv.exe87⤵PID:4820
-
\??\c:\lffxlll.exec:\lffxlll.exe88⤵PID:3496
-
\??\c:\btbttt.exec:\btbttt.exe89⤵PID:4888
-
\??\c:\nnhhnt.exec:\nnhhnt.exe90⤵PID:4552
-
\??\c:\pjjdv.exec:\pjjdv.exe91⤵PID:3624
-
\??\c:\9vdvp.exec:\9vdvp.exe92⤵PID:5060
-
\??\c:\lxxxxxx.exec:\lxxxxxx.exe93⤵PID:2080
-
\??\c:\bnbbtt.exec:\bnbbtt.exe94⤵PID:1004
-
\??\c:\hbttnt.exec:\hbttnt.exe95⤵PID:4588
-
\??\c:\dpjjd.exec:\dpjjd.exe96⤵PID:2156
-
\??\c:\jpvvv.exec:\jpvvv.exe97⤵PID:4188
-
\??\c:\rllfxxx.exec:\rllfxxx.exe98⤵PID:980
-
\??\c:\bbhbbb.exec:\bbhbbb.exe99⤵PID:2096
-
\??\c:\tttnhh.exec:\tttnhh.exe100⤵PID:3916
-
\??\c:\djddv.exec:\djddv.exe101⤵PID:2900
-
\??\c:\lffxrll.exec:\lffxrll.exe102⤵PID:2508
-
\??\c:\frxxllr.exec:\frxxllr.exe103⤵PID:1456
-
\??\c:\pvjjd.exec:\pvjjd.exe104⤵PID:4920
-
\??\c:\rrlfxxx.exec:\rrlfxxx.exe105⤵PID:372
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe106⤵PID:3308
-
\??\c:\3hhhtt.exec:\3hhhtt.exe107⤵PID:4404
-
\??\c:\dvpjd.exec:\dvpjd.exe108⤵PID:2064
-
\??\c:\ppvvv.exec:\ppvvv.exe109⤵PID:976
-
\??\c:\lxfxllf.exec:\lxfxllf.exe110⤵PID:4184
-
\??\c:\htbttt.exec:\htbttt.exe111⤵PID:968
-
\??\c:\htnhbh.exec:\htnhbh.exe112⤵PID:2020
-
\??\c:\pddvp.exec:\pddvp.exe113⤵PID:2280
-
\??\c:\dvvvp.exec:\dvvvp.exe114⤵PID:4368
-
\??\c:\xxxxrrl.exec:\xxxxrrl.exe115⤵PID:3572
-
\??\c:\rxlrxxl.exec:\rxlrxxl.exe116⤵PID:2004
-
\??\c:\tbbttt.exec:\tbbttt.exe117⤵PID:3524
-
\??\c:\vvvjp.exec:\vvvjp.exe118⤵PID:908
-
\??\c:\pjpvp.exec:\pjpvp.exe119⤵PID:724
-
\??\c:\3flrfrr.exec:\3flrfrr.exe120⤵PID:4744
-
\??\c:\lfxlfrl.exec:\lfxlfrl.exe121⤵PID:1888
-
\??\c:\7ntnhh.exec:\7ntnhh.exe122⤵PID:2832
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-