Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2024, 01:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
80257122a6603984ef181ced2c319de0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
80257122a6603984ef181ced2c319de0_NeikiAnalytics.exe
-
Size
335KB
-
MD5
80257122a6603984ef181ced2c319de0
-
SHA1
4af3abb2282bf969fcb828fef1a7f53bf2e81607
-
SHA256
74e36c3d155db76f3e7c112c6d99f4dd8b5f9e96b7bd13f1853468178fb352a7
-
SHA512
39af7195744fe0aae40e64d84a5f671299e029724a29d531ec6dffc5d013566ac8becada59cf07c318ab83ee3ad1a1a9787d488ca605099cc7b828fe62ac481a
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp99zm+/KZBHqnuOeHzmB600TUA6Z7zupc+BE:n3C9BRo7tvnJ99T/KZEuOod00TG+BE
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/1440-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3480-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1684-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3872-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4216-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2576-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/612-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1700-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2260-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/392-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2984-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4008-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1748-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2432-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2320-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4492-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4120-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1132-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3480 hhbbtn.exe 4004 jvvvd.exe 3872 llrlfff.exe 1684 5tbttt.exe 612 jpvpp.exe 4216 djvdv.exe 2576 rrlfrlf.exe 5016 rrxxllr.exe 3236 xffxrrf.exe 1700 nhnbbt.exe 2260 pjpjj.exe 1736 lrfrxfr.exe 392 btbhnb.exe 4444 ppjdj.exe 4592 pvjdp.exe 4608 xrrrxrx.exe 2984 jdppv.exe 4008 hhnnnn.exe 1748 9dddj.exe 2432 fxrlfff.exe 4424 vjjvj.exe 3152 tthnnt.exe 1808 xfxxllx.exe 4868 ppdvv.exe 2320 fffllrl.exe 3136 pjppj.exe 4492 lfrllrr.exe 3304 tntnhn.exe 4120 ntnntn.exe 4756 ntnhhb.exe 1132 xrrrrxx.exe 3676 htbhbn.exe 1720 dddvj.exe 3888 jpdvp.exe 1508 rfrlfxx.exe 1160 hhhhnb.exe 4548 dvddj.exe 4392 xrrrflf.exe 388 nhbhbh.exe 4524 rlfflll.exe 888 hbnhbb.exe 1600 ddjjj.exe 4508 ntbhnn.exe 508 dvpjp.exe 4848 vpvdv.exe 1260 flxfxrf.exe 4700 bhnbbb.exe 316 3frrrxf.exe 3428 5rxrrrx.exe 4692 htttbt.exe 4268 dvppd.exe 4792 3xrllfx.exe 2692 nttbhh.exe 5116 ddddd.exe 5024 xflrrxx.exe 2540 bhbtbb.exe 3708 9xlrlxl.exe 4416 htnnbn.exe 4292 pdjjp.exe 968 bnhnbh.exe 1840 pvvdv.exe 3684 rfxffxr.exe 1844 nbbhth.exe 928 tnntbh.exe -
resource yara_rule behavioral2/memory/1440-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3480-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1684-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3872-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4216-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2576-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/612-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1700-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2260-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/392-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2984-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4008-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1748-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2432-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2320-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4492-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1132-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1440 wrote to memory of 3480 1440 80257122a6603984ef181ced2c319de0_NeikiAnalytics.exe 83 PID 1440 wrote to memory of 3480 1440 80257122a6603984ef181ced2c319de0_NeikiAnalytics.exe 83 PID 1440 wrote to memory of 3480 1440 80257122a6603984ef181ced2c319de0_NeikiAnalytics.exe 83 PID 3480 wrote to memory of 4004 3480 hhbbtn.exe 84 PID 3480 wrote to memory of 4004 3480 hhbbtn.exe 84 PID 3480 wrote to memory of 4004 3480 hhbbtn.exe 84 PID 4004 wrote to memory of 3872 4004 jvvvd.exe 85 PID 4004 wrote to memory of 3872 4004 jvvvd.exe 85 PID 4004 wrote to memory of 3872 4004 jvvvd.exe 85 PID 3872 wrote to memory of 1684 3872 llrlfff.exe 86 PID 3872 wrote to memory of 1684 3872 llrlfff.exe 86 PID 3872 wrote to memory of 1684 3872 llrlfff.exe 86 PID 1684 wrote to memory of 612 1684 5tbttt.exe 87 PID 1684 wrote to memory of 612 1684 5tbttt.exe 87 PID 1684 wrote to memory of 612 1684 5tbttt.exe 87 PID 612 wrote to memory of 4216 612 jpvpp.exe 88 PID 612 wrote to memory of 4216 612 jpvpp.exe 88 PID 612 wrote to memory of 4216 612 jpvpp.exe 88 PID 4216 wrote to memory of 2576 4216 djvdv.exe 89 PID 4216 wrote to memory of 2576 4216 djvdv.exe 89 PID 4216 wrote to memory of 2576 4216 djvdv.exe 89 PID 2576 wrote to memory of 5016 2576 rrlfrlf.exe 90 PID 2576 wrote to memory of 5016 2576 rrlfrlf.exe 90 PID 2576 wrote to memory of 5016 2576 rrlfrlf.exe 90 PID 5016 wrote to memory of 3236 5016 rrxxllr.exe 91 PID 5016 wrote to memory of 3236 5016 rrxxllr.exe 91 PID 5016 wrote to memory of 3236 5016 rrxxllr.exe 91 PID 3236 wrote to memory of 1700 3236 xffxrrf.exe 92 PID 3236 wrote to memory of 1700 3236 xffxrrf.exe 92 PID 3236 wrote to memory of 1700 3236 xffxrrf.exe 92 PID 1700 wrote to memory of 2260 1700 nhnbbt.exe 93 PID 1700 wrote to memory of 2260 1700 nhnbbt.exe 93 PID 1700 wrote to memory of 2260 1700 nhnbbt.exe 93 PID 2260 wrote to memory of 1736 2260 pjpjj.exe 94 PID 2260 wrote to memory of 1736 2260 pjpjj.exe 94 PID 2260 wrote to memory of 1736 2260 pjpjj.exe 94 PID 1736 wrote to memory of 392 1736 lrfrxfr.exe 95 PID 1736 wrote to memory of 392 1736 lrfrxfr.exe 95 PID 1736 wrote to memory of 392 1736 lrfrxfr.exe 95 PID 392 wrote to memory of 4444 392 btbhnb.exe 96 PID 392 wrote to memory of 4444 392 btbhnb.exe 96 PID 392 wrote to memory of 4444 392 btbhnb.exe 96 PID 4444 wrote to memory of 4592 4444 ppjdj.exe 97 PID 4444 wrote to memory of 4592 4444 ppjdj.exe 97 PID 4444 wrote to memory of 4592 4444 ppjdj.exe 97 PID 4592 wrote to memory of 4608 4592 pvjdp.exe 98 PID 4592 wrote to memory of 4608 4592 pvjdp.exe 98 PID 4592 wrote to memory of 4608 4592 pvjdp.exe 98 PID 4608 wrote to memory of 2984 4608 xrrrxrx.exe 99 PID 4608 wrote to memory of 2984 4608 xrrrxrx.exe 99 PID 4608 wrote to memory of 2984 4608 xrrrxrx.exe 99 PID 2984 wrote to memory of 4008 2984 jdppv.exe 101 PID 2984 wrote to memory of 4008 2984 jdppv.exe 101 PID 2984 wrote to memory of 4008 2984 jdppv.exe 101 PID 4008 wrote to memory of 1748 4008 hhnnnn.exe 102 PID 4008 wrote to memory of 1748 4008 hhnnnn.exe 102 PID 4008 wrote to memory of 1748 4008 hhnnnn.exe 102 PID 1748 wrote to memory of 2432 1748 9dddj.exe 103 PID 1748 wrote to memory of 2432 1748 9dddj.exe 103 PID 1748 wrote to memory of 2432 1748 9dddj.exe 103 PID 2432 wrote to memory of 4424 2432 fxrlfff.exe 104 PID 2432 wrote to memory of 4424 2432 fxrlfff.exe 104 PID 2432 wrote to memory of 4424 2432 fxrlfff.exe 104 PID 4424 wrote to memory of 3152 4424 vjjvj.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\80257122a6603984ef181ced2c319de0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\80257122a6603984ef181ced2c319de0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\hhbbtn.exec:\hhbbtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\jvvvd.exec:\jvvvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\llrlfff.exec:\llrlfff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\5tbttt.exec:\5tbttt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\jpvpp.exec:\jpvpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:612 -
\??\c:\djvdv.exec:\djvdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\rrlfrlf.exec:\rrlfrlf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\rrxxllr.exec:\rrxxllr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\xffxrrf.exec:\xffxrrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\nhnbbt.exec:\nhnbbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\pjpjj.exec:\pjpjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\lrfrxfr.exec:\lrfrxfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\btbhnb.exec:\btbhnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\ppjdj.exec:\ppjdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\pvjdp.exec:\pvjdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\xrrrxrx.exec:\xrrrxrx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\jdppv.exec:\jdppv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\hhnnnn.exec:\hhnnnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\9dddj.exec:\9dddj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\fxrlfff.exec:\fxrlfff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\vjjvj.exec:\vjjvj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\tthnnt.exec:\tthnnt.exe23⤵
- Executes dropped EXE
PID:3152 -
\??\c:\xfxxllx.exec:\xfxxllx.exe24⤵
- Executes dropped EXE
PID:1808 -
\??\c:\ppdvv.exec:\ppdvv.exe25⤵
- Executes dropped EXE
PID:4868 -
\??\c:\fffllrl.exec:\fffllrl.exe26⤵
- Executes dropped EXE
PID:2320 -
\??\c:\pjppj.exec:\pjppj.exe27⤵
- Executes dropped EXE
PID:3136 -
\??\c:\lfrllrr.exec:\lfrllrr.exe28⤵
- Executes dropped EXE
PID:4492 -
\??\c:\tntnhn.exec:\tntnhn.exe29⤵
- Executes dropped EXE
PID:3304 -
\??\c:\ntnntn.exec:\ntnntn.exe30⤵
- Executes dropped EXE
PID:4120 -
\??\c:\ntnhhb.exec:\ntnhhb.exe31⤵
- Executes dropped EXE
PID:4756 -
\??\c:\xrrrrxx.exec:\xrrrrxx.exe32⤵
- Executes dropped EXE
PID:1132 -
\??\c:\htbhbn.exec:\htbhbn.exe33⤵
- Executes dropped EXE
PID:3676 -
\??\c:\dddvj.exec:\dddvj.exe34⤵
- Executes dropped EXE
PID:1720 -
\??\c:\jpdvp.exec:\jpdvp.exe35⤵
- Executes dropped EXE
PID:3888 -
\??\c:\rfrlfxx.exec:\rfrlfxx.exe36⤵
- Executes dropped EXE
PID:1508 -
\??\c:\hhhhnb.exec:\hhhhnb.exe37⤵
- Executes dropped EXE
PID:1160 -
\??\c:\dvddj.exec:\dvddj.exe38⤵
- Executes dropped EXE
PID:4548 -
\??\c:\xrrrflf.exec:\xrrrflf.exe39⤵
- Executes dropped EXE
PID:4392 -
\??\c:\nhbhbh.exec:\nhbhbh.exe40⤵
- Executes dropped EXE
PID:388 -
\??\c:\rlfflll.exec:\rlfflll.exe41⤵
- Executes dropped EXE
PID:4524 -
\??\c:\hbnhbb.exec:\hbnhbb.exe42⤵
- Executes dropped EXE
PID:888 -
\??\c:\ddjjj.exec:\ddjjj.exe43⤵
- Executes dropped EXE
PID:1600 -
\??\c:\ntbhnn.exec:\ntbhnn.exe44⤵
- Executes dropped EXE
PID:4508 -
\??\c:\dvpjp.exec:\dvpjp.exe45⤵
- Executes dropped EXE
PID:508 -
\??\c:\vpvdv.exec:\vpvdv.exe46⤵
- Executes dropped EXE
PID:4848 -
\??\c:\flxfxrf.exec:\flxfxrf.exe47⤵
- Executes dropped EXE
PID:1260 -
\??\c:\bhnbbb.exec:\bhnbbb.exe48⤵
- Executes dropped EXE
PID:4700 -
\??\c:\3frrrxf.exec:\3frrrxf.exe49⤵
- Executes dropped EXE
PID:316 -
\??\c:\5rxrrrx.exec:\5rxrrrx.exe50⤵
- Executes dropped EXE
PID:3428 -
\??\c:\htttbt.exec:\htttbt.exe51⤵
- Executes dropped EXE
PID:4692 -
\??\c:\dvppd.exec:\dvppd.exe52⤵
- Executes dropped EXE
PID:4268 -
\??\c:\3xrllfx.exec:\3xrllfx.exe53⤵
- Executes dropped EXE
PID:4792 -
\??\c:\nttbhh.exec:\nttbhh.exe54⤵
- Executes dropped EXE
PID:2692 -
\??\c:\ddddd.exec:\ddddd.exe55⤵
- Executes dropped EXE
PID:5116 -
\??\c:\xflrrxx.exec:\xflrrxx.exe56⤵
- Executes dropped EXE
PID:5024 -
\??\c:\bhbtbb.exec:\bhbtbb.exe57⤵
- Executes dropped EXE
PID:2540 -
\??\c:\9xlrlxl.exec:\9xlrlxl.exe58⤵
- Executes dropped EXE
PID:3708 -
\??\c:\htnnbn.exec:\htnnbn.exe59⤵
- Executes dropped EXE
PID:4416 -
\??\c:\pdjjp.exec:\pdjjp.exe60⤵
- Executes dropped EXE
PID:4292 -
\??\c:\bnhnbh.exec:\bnhnbh.exe61⤵
- Executes dropped EXE
PID:968 -
\??\c:\pvvdv.exec:\pvvdv.exe62⤵
- Executes dropped EXE
PID:1840 -
\??\c:\rfxffxr.exec:\rfxffxr.exe63⤵
- Executes dropped EXE
PID:3684 -
\??\c:\nbbhth.exec:\nbbhth.exe64⤵
- Executes dropped EXE
PID:1844 -
\??\c:\tnntbh.exec:\tnntbh.exe65⤵
- Executes dropped EXE
PID:928 -
\??\c:\1vjvd.exec:\1vjvd.exe66⤵PID:1296
-
\??\c:\xfrxflr.exec:\xfrxflr.exe67⤵PID:1236
-
\??\c:\pjdvv.exec:\pjdvv.exe68⤵PID:940
-
\??\c:\lflrrfx.exec:\lflrrfx.exe69⤵PID:2028
-
\??\c:\tnbttn.exec:\tnbttn.exe70⤵PID:64
-
\??\c:\vpvvd.exec:\vpvvd.exe71⤵PID:1540
-
\??\c:\jvpvp.exec:\jvpvp.exe72⤵PID:3136
-
\??\c:\fffrlxl.exec:\fffrlxl.exe73⤵PID:4588
-
\??\c:\hththt.exec:\hththt.exe74⤵PID:4220
-
\??\c:\tbhbbb.exec:\tbhbbb.exe75⤵PID:540
-
\??\c:\pvvdv.exec:\pvvdv.exe76⤵PID:1708
-
\??\c:\lxffrxx.exec:\lxffrxx.exe77⤵PID:2404
-
\??\c:\btnnth.exec:\btnnth.exe78⤵PID:2720
-
\??\c:\vvjvd.exec:\vvjvd.exe79⤵PID:3716
-
\??\c:\fflllxx.exec:\fflllxx.exe80⤵PID:216
-
\??\c:\nnbbtt.exec:\nnbbtt.exe81⤵PID:324
-
\??\c:\ppvjp.exec:\ppvjp.exe82⤵PID:3568
-
\??\c:\xlrlfxr.exec:\xlrlfxr.exe83⤵PID:1916
-
\??\c:\tntntt.exec:\tntntt.exe84⤵PID:640
-
\??\c:\hthbtb.exec:\hthbtb.exe85⤵PID:400
-
\??\c:\pvvdv.exec:\pvvdv.exe86⤵PID:4364
-
\??\c:\flxfffx.exec:\flxfffx.exe87⤵PID:4528
-
\??\c:\bnttbb.exec:\bnttbb.exe88⤵PID:452
-
\??\c:\pvvjd.exec:\pvvjd.exe89⤵PID:2560
-
\??\c:\ffllxxf.exec:\ffllxxf.exe90⤵PID:4932
-
\??\c:\hhbtnt.exec:\hhbtnt.exe91⤵PID:4384
-
\??\c:\7dddd.exec:\7dddd.exe92⤵PID:1588
-
\??\c:\jjvpv.exec:\jjvpv.exe93⤵PID:1184
-
\??\c:\rrrrrrf.exec:\rrrrrrf.exe94⤵PID:4156
-
\??\c:\tnhbnh.exec:\tnhbnh.exe95⤵PID:4268
-
\??\c:\pdvvp.exec:\pdvvp.exe96⤵PID:3788
-
\??\c:\pdvpj.exec:\pdvpj.exe97⤵PID:1076
-
\??\c:\nntttt.exec:\nntttt.exe98⤵PID:932
-
\??\c:\dvpjj.exec:\dvpjj.exe99⤵PID:2540
-
\??\c:\rxxlrfx.exec:\rxxlrfx.exe100⤵PID:4048
-
\??\c:\jjdpp.exec:\jjdpp.exe101⤵PID:3160
-
\??\c:\fflrxfl.exec:\fflrxfl.exe102⤵PID:2652
-
\??\c:\hbhhth.exec:\hbhhth.exe103⤵PID:3656
-
\??\c:\rflxrrr.exec:\rflxrrr.exe104⤵PID:2584
-
\??\c:\djvjj.exec:\djvjj.exe105⤵PID:1900
-
\??\c:\hhtbbh.exec:\hhtbbh.exe106⤵PID:404
-
\??\c:\vpppj.exec:\vpppj.exe107⤵PID:3744
-
\??\c:\jpdvp.exec:\jpdvp.exe108⤵PID:1296
-
\??\c:\xlfrlfr.exec:\xlfrlfr.exe109⤵PID:1236
-
\??\c:\hnbhhb.exec:\hnbhhb.exe110⤵PID:3376
-
\??\c:\jjpdv.exec:\jjpdv.exe111⤵PID:1044
-
\??\c:\lrlllrx.exec:\lrlllrx.exe112⤵PID:4788
-
\??\c:\9ntttb.exec:\9ntttb.exe113⤵PID:1652
-
\??\c:\pvppp.exec:\pvppp.exe114⤵PID:376
-
\??\c:\llrxfrf.exec:\llrxfrf.exe115⤵PID:916
-
\??\c:\bttnnt.exec:\bttnnt.exe116⤵PID:4488
-
\??\c:\djvjj.exec:\djvjj.exe117⤵PID:1064
-
\??\c:\vjvpp.exec:\vjvpp.exe118⤵PID:4648
-
\??\c:\flrfxll.exec:\flrfxll.exe119⤵PID:3672
-
\??\c:\ttbthh.exec:\ttbthh.exe120⤵PID:1048
-
\??\c:\djvvv.exec:\djvvv.exe121⤵PID:632
-
\??\c:\dpppp.exec:\dpppp.exe122⤵PID:3888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-