Analysis
- max time kernel
147s - max time network
128s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 17:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1f90e1ef7c3edcb1d265cff7bad29450_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
- Target 1f90e1ef7c3edcb1d265cff7bad29450_NeikiAnalytics.exe
- Size 361KB
- Sample240518-wabc8sfc3w
- SHA256 f4d64914326bc7951b179c515497186a6f9136e21eb4597918dcabe896b7db5d
- MD5 1f90e1ef7c3edcb1d265cff7bad29450
- SHA1 88c1a1b14fe6afd34dac05349844b42beb0f58b1
- SHA512 07cd2636d3a7107d9e6eb3c19bb3b0be76b1cea4f3557855548aeedfb1e44fb08c2259d830d3d6c9291106cec3b92d44a346be73d555d23ee5df0d9ceae49319
- SSDEEP 6144:n3C9BRIG0asYFm71m8+GdkB9yMu7N+8px7O/:n3C9uYA71kSMu08px7g
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/4476-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4500-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4472-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1888-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2332-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2332-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2116-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1172-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3392-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4932-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4240-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2924-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4192-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3760-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/60-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3948-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5040-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2300-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/412-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3904-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/540-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3616-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2672-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4032-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 4500 nnnhbh.exe 4472 lffrrll.exe 1888 nhtnnt.exe 2332 jjjjj.exe 2116 hhttnh.exe 388 rxflllf.exe 1172 ntbbtt.exe 2784 jdvpd.exe 4036 rrxrllf.exe 3392 pvppp.exe 4932 fxlffff.exe 4640 5djjd.exe 4240 hbnnnn.exe 3836 djjjv.exe 2924 bnbbbt.exe 4264 pdjjj.exe 4192 rrrllll.exe 3760 tnnnhb.exe 60 rxxffrr.exe 3948 bbbhbt.exe 3500 pvpvp.exe 5040 jjppp.exe 2300 9rffxrl.exe 412 bbnhbb.exe 3904 bhnhnn.exe 540 3tbtnn.exe 3616 5hbbtt.exe 2672 vpvjj.exe 4032 nhtbtb.exe 2356 bthbhb.exe 2024 rrxrllf.exe 2420 ttbtnn.exe 4516 fllxxxr.exe 3464 ttttnt.exe 4924 vdvpd.exe 2004 pdvpp.exe 2788 lrxxxxl.exe 1464 pjvpj.exe 1688 frlfxrr.exe 4152 nnbbhh.exe 836 nhnhbb.exe 4804 jdjdd.exe 1976 frxrllf.exe 4244 9bnhhh.exe 3936 dppjd.exe 388 xlxlfxr.exe 2904 hbhbtt.exe 1936 jpppj.exe 4916 rrrlllf.exe 5064 thnnhh.exe 2296 7djdv.exe 5096 7rrllrr.exe 3240 tnttnn.exe 4872 djpdp.exe 808 xflfrfl.exe 976 nhtnnt.exe 952 nhbhbb.exe 4016 5vdvp.exe 372 rxxlffx.exe 4688 nbnhhh.exe 1604 htbtnn.exe 5100 vjddv.exe 4100 rfllfff.exe 1968 tthhnb.exe -
resource yara_rule behavioral2/memory/4476-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4472-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1888-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2332-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2332-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2332-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2332-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/388-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1172-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3392-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4932-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4240-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4192-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3760-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/60-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3948-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5040-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2300-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/412-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3904-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/540-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2672-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-196-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4476 wrote to memory of 4500 4476 1f90e1ef7c3edcb1d265cff7bad29450_NeikiAnalytics.exe 83 PID 4476 wrote to memory of 4500 4476 1f90e1ef7c3edcb1d265cff7bad29450_NeikiAnalytics.exe 83 PID 4476 wrote to memory of 4500 4476 1f90e1ef7c3edcb1d265cff7bad29450_NeikiAnalytics.exe 83 PID 4500 wrote to memory of 4472 4500 nnnhbh.exe 84 PID 4500 wrote to memory of 4472 4500 nnnhbh.exe 84 PID 4500 wrote to memory of 4472 4500 nnnhbh.exe 84 PID 4472 wrote to memory of 1888 4472 lffrrll.exe 85 PID 4472 wrote to memory of 1888 4472 lffrrll.exe 85 PID 4472 wrote to memory of 1888 4472 lffrrll.exe 85 PID 1888 wrote to memory of 2332 1888 nhtnnt.exe 86 PID 1888 wrote to memory of 2332 1888 nhtnnt.exe 86 PID 1888 wrote to memory of 2332 1888 nhtnnt.exe 86 PID 2332 wrote to memory of 2116 2332 jjjjj.exe 87 PID 2332 wrote to memory of 2116 2332 jjjjj.exe 87 PID 2332 wrote to memory of 2116 2332 jjjjj.exe 87 PID 2116 wrote to memory of 388 2116 hhttnh.exe 88 PID 2116 wrote to memory of 388 2116 hhttnh.exe 88 PID 2116 wrote to memory of 388 2116 hhttnh.exe 88 PID 388 wrote to memory of 1172 388 rxflllf.exe 89 PID 388 wrote to memory of 1172 388 rxflllf.exe 89 PID 388 wrote to memory of 1172 388 rxflllf.exe 89 PID 1172 wrote to memory of 2784 1172 ntbbtt.exe 90 PID 1172 wrote to memory of 2784 1172 ntbbtt.exe 90 PID 1172 wrote to memory of 2784 1172 ntbbtt.exe 90 PID 2784 wrote to memory of 4036 2784 jdvpd.exe 91 PID 2784 wrote to memory of 4036 2784 jdvpd.exe 91 PID 2784 wrote to memory of 4036 2784 jdvpd.exe 91 PID 4036 wrote to memory of 3392 4036 rrxrllf.exe 92 PID 4036 wrote to memory of 3392 4036 rrxrllf.exe 92 PID 4036 wrote to memory of 3392 4036 rrxrllf.exe 92 PID 3392 wrote to memory of 4932 3392 pvppp.exe 93 PID 3392 wrote to memory of 4932 3392 pvppp.exe 93 PID 3392 wrote to memory of 4932 3392 pvppp.exe 93 PID 4932 wrote to memory of 4640 4932 fxlffff.exe 95 PID 4932 wrote to memory of 4640 4932 fxlffff.exe 95 PID 4932 wrote to memory of 4640 4932 fxlffff.exe 95 PID 4640 wrote to memory of 4240 4640 5djjd.exe 96 PID 4640 wrote to memory of 4240 4640 5djjd.exe 96 PID 4640 wrote to memory of 4240 4640 5djjd.exe 96 PID 4240 wrote to memory of 3836 4240 hbnnnn.exe 97 PID 4240 wrote to memory of 3836 4240 hbnnnn.exe 97 PID 4240 wrote to memory of 3836 4240 hbnnnn.exe 97 PID 3836 wrote to memory of 2924 3836 djjjv.exe 99 PID 3836 wrote to memory of 2924 3836 djjjv.exe 99 PID 3836 wrote to memory of 2924 3836 djjjv.exe 99 PID 2924 wrote to memory of 4264 2924 bnbbbt.exe 100 PID 2924 wrote to memory of 4264 2924 bnbbbt.exe 100 PID 2924 wrote to memory of 4264 2924 bnbbbt.exe 100 PID 4264 wrote to memory of 4192 4264 pdjjj.exe 101 PID 4264 wrote to memory of 4192 4264 pdjjj.exe 101 PID 4264 wrote to memory of 4192 4264 pdjjj.exe 101 PID 4192 wrote to memory of 3760 4192 rrrllll.exe 102 PID 4192 wrote to memory of 3760 4192 rrrllll.exe 102 PID 4192 wrote to memory of 3760 4192 rrrllll.exe 102 PID 3760 wrote to memory of 60 3760 tnnnhb.exe 104 PID 3760 wrote to memory of 60 3760 tnnnhb.exe 104 PID 3760 wrote to memory of 60 3760 tnnnhb.exe 104 PID 60 wrote to memory of 3948 60 rxxffrr.exe 105 PID 60 wrote to memory of 3948 60 rxxffrr.exe 105 PID 60 wrote to memory of 3948 60 rxxffrr.exe 105 PID 3948 wrote to memory of 3500 3948 bbbhbt.exe 106 PID 3948 wrote to memory of 3500 3948 bbbhbt.exe 106 PID 3948 wrote to memory of 3500 3948 bbbhbt.exe 106 PID 3500 wrote to memory of 5040 3500 pvpvp.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f90e1ef7c3edcb1d265cff7bad29450_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1f90e1ef7c3edcb1d265cff7bad29450_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\nnnhbh.exec:\nnnhbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\lffrrll.exec:\lffrrll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\nhtnnt.exec:\nhtnnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\jjjjj.exec:\jjjjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\hhttnh.exec:\hhttnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\rxflllf.exec:\rxflllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\ntbbtt.exec:\ntbbtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\jdvpd.exec:\jdvpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\rrxrllf.exec:\rrxrllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\pvppp.exec:\pvppp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\fxlffff.exec:\fxlffff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\5djjd.exec:\5djjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\hbnnnn.exec:\hbnnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
\??\c:\djjjv.exec:\djjjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\bnbbbt.exec:\bnbbbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\pdjjj.exec:\pdjjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
\??\c:\rrrllll.exec:\rrrllll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\tnnnhb.exec:\tnnnhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\rxxffrr.exec:\rxxffrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\bbbhbt.exec:\bbbhbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\pvpvp.exec:\pvpvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\jjppp.exec:\jjppp.exe23⤵
- Executes dropped EXE
PID:5040 -
\??\c:\9rffxrl.exec:\9rffxrl.exe24⤵
- Executes dropped EXE
PID:2300 -
\??\c:\bbnhbb.exec:\bbnhbb.exe25⤵
- Executes dropped EXE
PID:412 -
\??\c:\bhnhnn.exec:\bhnhnn.exe26⤵
- Executes dropped EXE
PID:3904 -
\??\c:\3tbtnn.exec:\3tbtnn.exe27⤵
- Executes dropped EXE
PID:540 -
\??\c:\5hbbtt.exec:\5hbbtt.exe28⤵
- Executes dropped EXE
PID:3616 -
\??\c:\vpvjj.exec:\vpvjj.exe29⤵
- Executes dropped EXE
PID:2672 -
\??\c:\nhtbtb.exec:\nhtbtb.exe30⤵
- Executes dropped EXE
PID:4032 -
\??\c:\bthbhb.exec:\bthbhb.exe31⤵
- Executes dropped EXE
PID:2356 -
\??\c:\rrxrllf.exec:\rrxrllf.exe32⤵
- Executes dropped EXE
PID:2024 -
\??\c:\ttbtnn.exec:\ttbtnn.exe33⤵
- Executes dropped EXE
PID:2420 -
\??\c:\fllxxxr.exec:\fllxxxr.exe34⤵
- Executes dropped EXE
PID:4516 -
\??\c:\ttttnt.exec:\ttttnt.exe35⤵
- Executes dropped EXE
PID:3464 -
\??\c:\vdvpd.exec:\vdvpd.exe36⤵
- Executes dropped EXE
PID:4924 -
\??\c:\pdvpp.exec:\pdvpp.exe37⤵
- Executes dropped EXE
PID:2004 -
\??\c:\lrxxxxl.exec:\lrxxxxl.exe38⤵
- Executes dropped EXE
PID:2788 -
\??\c:\pjvpj.exec:\pjvpj.exe39⤵
- Executes dropped EXE
PID:1464 -
\??\c:\frlfxrr.exec:\frlfxrr.exe40⤵
- Executes dropped EXE
PID:1688 -
\??\c:\nnbbhh.exec:\nnbbhh.exe41⤵
- Executes dropped EXE
PID:4152 -
\??\c:\nhnhbb.exec:\nhnhbb.exe42⤵
- Executes dropped EXE
PID:836 -
\??\c:\jdjdd.exec:\jdjdd.exe43⤵
- Executes dropped EXE
PID:4804 -
\??\c:\frxrllf.exec:\frxrllf.exe44⤵
- Executes dropped EXE
PID:1976 -
\??\c:\9bnhhh.exec:\9bnhhh.exe45⤵
- Executes dropped EXE
PID:4244 -
\??\c:\dppjd.exec:\dppjd.exe46⤵
- Executes dropped EXE
PID:3936 -
\??\c:\xlxlfxr.exec:\xlxlfxr.exe47⤵
- Executes dropped EXE
PID:388 -
\??\c:\hbhbtt.exec:\hbhbtt.exe48⤵
- Executes dropped EXE
PID:2904 -
\??\c:\jpppj.exec:\jpppj.exe49⤵
- Executes dropped EXE
PID:1936 -
\??\c:\rrrlllf.exec:\rrrlllf.exe50⤵
- Executes dropped EXE
PID:4916 -
\??\c:\thnnhh.exec:\thnnhh.exe51⤵
- Executes dropped EXE
PID:5064 -
\??\c:\7djdv.exec:\7djdv.exe52⤵
- Executes dropped EXE
PID:2296 -
\??\c:\7rrllrr.exec:\7rrllrr.exe53⤵
- Executes dropped EXE
PID:5096 -
\??\c:\tnttnn.exec:\tnttnn.exe54⤵
- Executes dropped EXE
PID:3240 -
\??\c:\djpdp.exec:\djpdp.exe55⤵
- Executes dropped EXE
PID:4872 -
\??\c:\xflfrfl.exec:\xflfrfl.exe56⤵
- Executes dropped EXE
PID:808 -
\??\c:\nhtnnt.exec:\nhtnnt.exe57⤵
- Executes dropped EXE
PID:976 -
\??\c:\nhbhbb.exec:\nhbhbb.exe58⤵
- Executes dropped EXE
PID:952 -
\??\c:\5vdvp.exec:\5vdvp.exe59⤵
- Executes dropped EXE
PID:4016 -
\??\c:\rxxlffx.exec:\rxxlffx.exe60⤵
- Executes dropped EXE
PID:372 -
\??\c:\nbnhhh.exec:\nbnhhh.exe61⤵
- Executes dropped EXE
PID:4688 -
\??\c:\htbtnn.exec:\htbtnn.exe62⤵
- Executes dropped EXE
PID:1604 -
\??\c:\vjddv.exec:\vjddv.exe63⤵
- Executes dropped EXE
PID:5100 -
\??\c:\rfllfff.exec:\rfllfff.exe64⤵
- Executes dropped EXE
PID:4100 -
\??\c:\tthhnb.exec:\tthhnb.exe65⤵
- Executes dropped EXE
PID:1968 -
\??\c:\bnbbhb.exec:\bnbbhb.exe66⤵PID:3908
-
\??\c:\pdpjd.exec:\pdpjd.exe67⤵PID:3572
-
\??\c:\rxxrrff.exec:\rxxrrff.exe68⤵PID:2300
-
\??\c:\thtnnt.exec:\thtnnt.exe69⤵PID:632
-
\??\c:\ddddv.exec:\ddddv.exe70⤵PID:1148
-
\??\c:\xfrflll.exec:\xfrflll.exe71⤵PID:3904
-
\??\c:\lflxfxr.exec:\lflxfxr.exe72⤵PID:1096
-
\??\c:\ffxxrfl.exec:\ffxxrfl.exe73⤵PID:3828
-
\??\c:\9tnbth.exec:\9tnbth.exe74⤵PID:4944
-
\??\c:\nttntt.exec:\nttntt.exe75⤵PID:2100
-
\??\c:\dvvpp.exec:\dvvpp.exe76⤵PID:4744
-
\??\c:\3lfxxxr.exec:\3lfxxxr.exe77⤵PID:1320
-
\??\c:\thhbtn.exec:\thhbtn.exe78⤵PID:444
-
\??\c:\vpvpd.exec:\vpvpd.exe79⤵PID:1520
-
\??\c:\vddpp.exec:\vddpp.exe80⤵PID:4396
-
\??\c:\fffxrfx.exec:\fffxrfx.exe81⤵PID:3972
-
\??\c:\bhtntb.exec:\bhtntb.exe82⤵PID:4784
-
\??\c:\ppdjd.exec:\ppdjd.exe83⤵PID:5008
-
\??\c:\jpvdj.exec:\jpvdj.exe84⤵PID:2444
-
\??\c:\rlffxxr.exec:\rlffxxr.exe85⤵PID:3308
-
\??\c:\xfrrrll.exec:\xfrrrll.exe86⤵PID:900
-
\??\c:\nbhhhh.exec:\nbhhhh.exe87⤵PID:1836
-
\??\c:\pdjjd.exec:\pdjjd.exe88⤵PID:1796
-
\??\c:\pvppj.exec:\pvppj.exe89⤵PID:2020
-
\??\c:\xllrlff.exec:\xllrlff.exe90⤵PID:3936
-
\??\c:\rfxrlrl.exec:\rfxrlrl.exe91⤵PID:388
-
\??\c:\5thbbb.exec:\5thbbb.exe92⤵PID:5076
-
\??\c:\pdpjd.exec:\pdpjd.exe93⤵PID:1676
-
\??\c:\7fffxxr.exec:\7fffxxr.exe94⤵PID:4916
-
\??\c:\btttnb.exec:\btttnb.exe95⤵PID:2812
-
\??\c:\dvddv.exec:\dvddv.exe96⤵PID:5048
-
\??\c:\lffxxxr.exec:\lffxxxr.exe97⤵PID:4640
-
\??\c:\hnbtnh.exec:\hnbtnh.exe98⤵PID:4864
-
\??\c:\vppjj.exec:\vppjj.exe99⤵PID:4956
-
\??\c:\pdddd.exec:\pdddd.exe100⤵PID:3952
-
\??\c:\rxxfxlf.exec:\rxxfxlf.exe101⤵PID:1948
-
\??\c:\tttbbb.exec:\tttbbb.exe102⤵PID:2716
-
\??\c:\pjvvd.exec:\pjvvd.exe103⤵PID:4608
-
\??\c:\lffxrrr.exec:\lffxrrr.exe104⤵PID:3196
-
\??\c:\xrxrlfx.exec:\xrxrlfx.exe105⤵PID:3760
-
\??\c:\pjppj.exec:\pjppj.exe106⤵PID:2044
-
\??\c:\rlrrxxx.exec:\rlrrxxx.exe107⤵PID:4268
-
\??\c:\llfxxrl.exec:\llfxxrl.exe108⤵PID:4312
-
\??\c:\btbhhh.exec:\btbhhh.exe109⤵PID:3788
-
\??\c:\jvppp.exec:\jvppp.exe110⤵PID:3472
-
\??\c:\fxxrlff.exec:\fxxrlff.exe111⤵PID:448
-
\??\c:\dpddv.exec:\dpddv.exe112⤵PID:508
-
\??\c:\dvvvp.exec:\dvvvp.exe113⤵PID:1616
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe114⤵PID:3428
-
\??\c:\ttnhtt.exec:\ttnhtt.exe115⤵PID:4536
-
\??\c:\3pvjj.exec:\3pvjj.exe116⤵PID:1084
-
\??\c:\lffxxrr.exec:\lffxxrr.exe117⤵PID:2664
-
\??\c:\xfrfxxr.exec:\xfrfxxr.exe118⤵PID:2420
-
\??\c:\7hnhbh.exec:\7hnhbh.exe119⤵PID:4516
-
\??\c:\vppdv.exec:\vppdv.exe120⤵PID:4344
-
\??\c:\llxxrrr.exec:\llxxrrr.exe121⤵PID:2788
-
\??\c:\ffllllf.exec:\ffllllf.exe122⤵PID:3408
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-