Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
20/05/2024, 02:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
961f058c593fad30f4e0ecb1240a1940_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
- Target 961f058c593fad30f4e0ecb1240a1940_NeikiAnalytics.exe
- Size 78KB
- Sample240520-da734agc45
- SHA256 6faee86a842da7755cf28707726e8e814c0718cc6aef46a8c682aba851872cc8
- MD5 961f058c593fad30f4e0ecb1240a1940
- SHA1 e99759f7339991c1b500a8a52cc8124357318554
- SHA512 657e2ed57f924860fad79c32101d9803b0a0a7ce2ce598a31f24f167bde9e93ae7c3e0ab20d672e2a5a16e0b1c0990c7d0821a6a19a2e49623fcd1e43e564d18
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2wVEJesf6:ymb3NkkiQ3mdBjF+3TU2KEJvy
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/2888-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1512-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1416-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1180-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4920-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2464-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4260-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4100-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3620-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4736-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4668-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3644-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1212-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2336-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1680-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3176-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1600-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2440-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1876-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3204-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 1512 pvjpp.exe 1416 llffxxr.exe 1180 hthbtt.exe 4008 vjjdp.exe 4920 jvvvp.exe 2464 1flrffx.exe 984 btnnbb.exe 3664 5vdvj.exe 5084 vpjvp.exe 4260 xffffff.exe 4100 5nhhtt.exe 3620 jdjjv.exe 4736 fllfrrf.exe 4668 7bbbnt.exe 3644 5htntt.exe 1212 pvvvp.exe 2336 llxrxxf.exe 1680 1nhbtn.exe 4420 thhnbb.exe 5036 jvdvj.exe 1596 hbhbbb.exe 3176 vvvpv.exe 220 9djdv.exe 1600 1rrrfxx.exe 2440 ntttht.exe 1956 1bhtnn.exe 5024 vppjd.exe 1876 hnhbtb.exe 3204 bhbtnn.exe 3244 3jvjj.exe 2344 rxlxlff.exe 4740 hhbbbh.exe 3520 vjdvp.exe 2280 dppjj.exe 3532 xxffflf.exe 2200 nnnnnt.exe 4908 1ntnbh.exe 1096 djvpj.exe 4684 9dpjd.exe 4040 3lxrlll.exe 2492 bhntbb.exe 4752 pppvj.exe 2148 xxxlfxr.exe 228 thnhht.exe 1012 hnnbht.exe 4768 vvvpd.exe 1268 pjjjv.exe 2196 rrffxfx.exe 2984 rffllll.exe 868 btnnnh.exe 1580 vvvjp.exe 5084 rlxrxff.exe 2092 1rlfxxx.exe 2136 nnnbbb.exe 1472 1vppj.exe 3620 lfrrlff.exe 4376 3htnhh.exe 2436 jjppj.exe 1364 rlrrffl.exe 2860 hbnnhb.exe 1016 vppdj.exe 4216 lffxrxx.exe 3824 tnbnnt.exe 5036 hbtnnn.exe -
resource yara_rule behavioral2/memory/2888-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1512-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1416-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1180-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4920-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4920-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2464-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4260-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4100-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3620-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4736-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4668-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3644-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1212-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2336-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1680-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3176-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1600-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2440-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1876-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3204-189-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2888 wrote to memory of 1512 2888 961f058c593fad30f4e0ecb1240a1940_NeikiAnalytics.exe 83 PID 2888 wrote to memory of 1512 2888 961f058c593fad30f4e0ecb1240a1940_NeikiAnalytics.exe 83 PID 2888 wrote to memory of 1512 2888 961f058c593fad30f4e0ecb1240a1940_NeikiAnalytics.exe 83 PID 1512 wrote to memory of 1416 1512 pvjpp.exe 84 PID 1512 wrote to memory of 1416 1512 pvjpp.exe 84 PID 1512 wrote to memory of 1416 1512 pvjpp.exe 84 PID 1416 wrote to memory of 1180 1416 llffxxr.exe 85 PID 1416 wrote to memory of 1180 1416 llffxxr.exe 85 PID 1416 wrote to memory of 1180 1416 llffxxr.exe 85 PID 1180 wrote to memory of 4008 1180 hthbtt.exe 86 PID 1180 wrote to memory of 4008 1180 hthbtt.exe 86 PID 1180 wrote to memory of 4008 1180 hthbtt.exe 86 PID 4008 wrote to memory of 4920 4008 vjjdp.exe 87 PID 4008 wrote to memory of 4920 4008 vjjdp.exe 87 PID 4008 wrote to memory of 4920 4008 vjjdp.exe 87 PID 4920 wrote to memory of 2464 4920 jvvvp.exe 88 PID 4920 wrote to memory of 2464 4920 jvvvp.exe 88 PID 4920 wrote to memory of 2464 4920 jvvvp.exe 88 PID 2464 wrote to memory of 984 2464 1flrffx.exe 89 PID 2464 wrote to memory of 984 2464 1flrffx.exe 89 PID 2464 wrote to memory of 984 2464 1flrffx.exe 89 PID 984 wrote to memory of 3664 984 btnnbb.exe 90 PID 984 wrote to memory of 3664 984 btnnbb.exe 90 PID 984 wrote to memory of 3664 984 btnnbb.exe 90 PID 3664 wrote to memory of 5084 3664 5vdvj.exe 91 PID 3664 wrote to memory of 5084 3664 5vdvj.exe 91 PID 3664 wrote to memory of 5084 3664 5vdvj.exe 91 PID 5084 wrote to memory of 4260 5084 vpjvp.exe 92 PID 5084 wrote to memory of 4260 5084 vpjvp.exe 92 PID 5084 wrote to memory of 4260 5084 vpjvp.exe 92 PID 4260 wrote to memory of 4100 4260 xffffff.exe 93 PID 4260 wrote to memory of 4100 4260 xffffff.exe 93 PID 4260 wrote to memory of 4100 4260 xffffff.exe 93 PID 4100 wrote to memory of 3620 4100 5nhhtt.exe 94 PID 4100 wrote to memory of 3620 4100 5nhhtt.exe 94 PID 4100 wrote to memory of 3620 4100 5nhhtt.exe 94 PID 3620 wrote to memory of 4736 3620 jdjjv.exe 95 PID 3620 wrote to memory of 4736 3620 jdjjv.exe 95 PID 3620 wrote to memory of 4736 3620 jdjjv.exe 95 PID 4736 wrote to memory of 4668 4736 fllfrrf.exe 96 PID 4736 wrote to memory of 4668 4736 fllfrrf.exe 96 PID 4736 wrote to memory of 4668 4736 fllfrrf.exe 96 PID 4668 wrote to memory of 3644 4668 7bbbnt.exe 97 PID 4668 wrote to memory of 3644 4668 7bbbnt.exe 97 PID 4668 wrote to memory of 3644 4668 7bbbnt.exe 97 PID 3644 wrote to memory of 1212 3644 5htntt.exe 98 PID 3644 wrote to memory of 1212 3644 5htntt.exe 98 PID 3644 wrote to memory of 1212 3644 5htntt.exe 98 PID 1212 wrote to memory of 2336 1212 pvvvp.exe 99 PID 1212 wrote to memory of 2336 1212 pvvvp.exe 99 PID 1212 wrote to memory of 2336 1212 pvvvp.exe 99 PID 2336 wrote to memory of 1680 2336 llxrxxf.exe 100 PID 2336 wrote to memory of 1680 2336 llxrxxf.exe 100 PID 2336 wrote to memory of 1680 2336 llxrxxf.exe 100 PID 1680 wrote to memory of 4420 1680 1nhbtn.exe 101 PID 1680 wrote to memory of 4420 1680 1nhbtn.exe 101 PID 1680 wrote to memory of 4420 1680 1nhbtn.exe 101 PID 4420 wrote to memory of 5036 4420 thhnbb.exe 102 PID 4420 wrote to memory of 5036 4420 thhnbb.exe 102 PID 4420 wrote to memory of 5036 4420 thhnbb.exe 102 PID 5036 wrote to memory of 1596 5036 jvdvj.exe 103 PID 5036 wrote to memory of 1596 5036 jvdvj.exe 103 PID 5036 wrote to memory of 1596 5036 jvdvj.exe 103 PID 1596 wrote to memory of 3176 1596 hbhbbb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\961f058c593fad30f4e0ecb1240a1940_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\961f058c593fad30f4e0ecb1240a1940_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\pvjpp.exec:\pvjpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\llffxxr.exec:\llffxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\hthbtt.exec:\hthbtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\vjjdp.exec:\vjjdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\jvvvp.exec:\jvvvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\1flrffx.exec:\1flrffx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\btnnbb.exec:\btnnbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
\??\c:\5vdvj.exec:\5vdvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\vpjvp.exec:\vpjvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\xffffff.exec:\xffffff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\5nhhtt.exec:\5nhhtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\jdjjv.exec:\jdjjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\fllfrrf.exec:\fllfrrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\7bbbnt.exec:\7bbbnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
\??\c:\5htntt.exec:\5htntt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\pvvvp.exec:\pvvvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\llxrxxf.exec:\llxrxxf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\1nhbtn.exec:\1nhbtn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\thhnbb.exec:\thhnbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\jvdvj.exec:\jvdvj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\hbhbbb.exec:\hbhbbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\vvvpv.exec:\vvvpv.exe23⤵
- Executes dropped EXE
PID:3176 -
\??\c:\9djdv.exec:\9djdv.exe24⤵
- Executes dropped EXE
PID:220 -
\??\c:\1rrrfxx.exec:\1rrrfxx.exe25⤵
- Executes dropped EXE
PID:1600 -
\??\c:\ntttht.exec:\ntttht.exe26⤵
- Executes dropped EXE
PID:2440 -
\??\c:\1bhtnn.exec:\1bhtnn.exe27⤵
- Executes dropped EXE
PID:1956 -
\??\c:\vppjd.exec:\vppjd.exe28⤵
- Executes dropped EXE
PID:5024 -
\??\c:\hnhbtb.exec:\hnhbtb.exe29⤵
- Executes dropped EXE
PID:1876 -
\??\c:\bhbtnn.exec:\bhbtnn.exe30⤵
- Executes dropped EXE
PID:3204 -
\??\c:\3jvjj.exec:\3jvjj.exe31⤵
- Executes dropped EXE
PID:3244 -
\??\c:\rxlxlff.exec:\rxlxlff.exe32⤵
- Executes dropped EXE
PID:2344 -
\??\c:\hhbbbh.exec:\hhbbbh.exe33⤵
- Executes dropped EXE
PID:4740 -
\??\c:\vjdvp.exec:\vjdvp.exe34⤵
- Executes dropped EXE
PID:3520 -
\??\c:\dppjj.exec:\dppjj.exe35⤵
- Executes dropped EXE
PID:2280 -
\??\c:\xxffflf.exec:\xxffflf.exe36⤵
- Executes dropped EXE
PID:3532 -
\??\c:\nnnnnt.exec:\nnnnnt.exe37⤵
- Executes dropped EXE
PID:2200 -
\??\c:\1ntnbh.exec:\1ntnbh.exe38⤵
- Executes dropped EXE
PID:4908 -
\??\c:\djvpj.exec:\djvpj.exe39⤵
- Executes dropped EXE
PID:1096 -
\??\c:\9dpjd.exec:\9dpjd.exe40⤵
- Executes dropped EXE
PID:4684 -
\??\c:\3lxrlll.exec:\3lxrlll.exe41⤵
- Executes dropped EXE
PID:4040 -
\??\c:\bhntbb.exec:\bhntbb.exe42⤵
- Executes dropped EXE
PID:2492 -
\??\c:\pppvj.exec:\pppvj.exe43⤵
- Executes dropped EXE
PID:4752 -
\??\c:\xxxlfxr.exec:\xxxlfxr.exe44⤵
- Executes dropped EXE
PID:2148 -
\??\c:\thnhht.exec:\thnhht.exe45⤵
- Executes dropped EXE
PID:228 -
\??\c:\hnnbht.exec:\hnnbht.exe46⤵
- Executes dropped EXE
PID:1012 -
\??\c:\vvvpd.exec:\vvvpd.exe47⤵
- Executes dropped EXE
PID:4768 -
\??\c:\pjjjv.exec:\pjjjv.exe48⤵
- Executes dropped EXE
PID:1268 -
\??\c:\rrffxfx.exec:\rrffxfx.exe49⤵
- Executes dropped EXE
PID:2196 -
\??\c:\rffllll.exec:\rffllll.exe50⤵
- Executes dropped EXE
PID:2984 -
\??\c:\btnnnh.exec:\btnnnh.exe51⤵
- Executes dropped EXE
PID:868 -
\??\c:\vvvjp.exec:\vvvjp.exe52⤵
- Executes dropped EXE
PID:1580 -
\??\c:\rlxrxff.exec:\rlxrxff.exe53⤵
- Executes dropped EXE
PID:5084 -
\??\c:\1rlfxxx.exec:\1rlfxxx.exe54⤵
- Executes dropped EXE
PID:2092 -
\??\c:\nnnbbb.exec:\nnnbbb.exe55⤵
- Executes dropped EXE
PID:2136 -
\??\c:\1vppj.exec:\1vppj.exe56⤵
- Executes dropped EXE
PID:1472 -
\??\c:\lfrrlff.exec:\lfrrlff.exe57⤵
- Executes dropped EXE
PID:3620 -
\??\c:\3htnhh.exec:\3htnhh.exe58⤵
- Executes dropped EXE
PID:4376 -
\??\c:\jjppj.exec:\jjppj.exe59⤵
- Executes dropped EXE
PID:2436 -
\??\c:\rlrrffl.exec:\rlrrffl.exe60⤵
- Executes dropped EXE
PID:1364 -
\??\c:\hbnnhb.exec:\hbnnhb.exe61⤵
- Executes dropped EXE
PID:2860 -
\??\c:\vppdj.exec:\vppdj.exe62⤵
- Executes dropped EXE
PID:1016 -
\??\c:\lffxrxx.exec:\lffxrxx.exe63⤵
- Executes dropped EXE
PID:4216 -
\??\c:\tnbnnt.exec:\tnbnnt.exe64⤵
- Executes dropped EXE
PID:3824 -
\??\c:\hbtnnn.exec:\hbtnnn.exe65⤵
- Executes dropped EXE
PID:5036 -
\??\c:\5dddv.exec:\5dddv.exe66⤵PID:2988
-
\??\c:\5ffxllf.exec:\5ffxllf.exe67⤵PID:2656
-
\??\c:\rxxfffx.exec:\rxxfffx.exe68⤵PID:1492
-
\??\c:\3htnnn.exec:\3htnnn.exe69⤵PID:4820
-
\??\c:\pjddv.exec:\pjddv.exe70⤵PID:3308
-
\??\c:\rllrfll.exec:\rllrfll.exe71⤵PID:756
-
\??\c:\rflrrrl.exec:\rflrrrl.exe72⤵PID:5040
-
\??\c:\3tbttn.exec:\3tbttn.exe73⤵PID:1104
-
\??\c:\pjvvd.exec:\pjvvd.exe74⤵PID:3312
-
\??\c:\pdvpp.exec:\pdvpp.exe75⤵PID:4416
-
\??\c:\3flffll.exec:\3flffll.exe76⤵PID:3060
-
\??\c:\1ttbtb.exec:\1ttbtb.exe77⤵PID:3148
-
\??\c:\hbtttt.exec:\hbtttt.exe78⤵PID:4012
-
\??\c:\pdddp.exec:\pdddp.exe79⤵PID:4288
-
\??\c:\djddv.exec:\djddv.exe80⤵PID:4740
-
\??\c:\9xfxrrl.exec:\9xfxrrl.exe81⤵PID:3520
-
\??\c:\xrrrrrr.exec:\xrrrrrr.exe82⤵PID:2748
-
\??\c:\bbhnnn.exec:\bbhnnn.exe83⤵PID:5032
-
\??\c:\pdjpp.exec:\pdjpp.exe84⤵PID:2200
-
\??\c:\djjdd.exec:\djjdd.exe85⤵PID:4908
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe86⤵PID:1096
-
\??\c:\hbnnbb.exec:\hbnnbb.exe87⤵PID:4684
-
\??\c:\httnbb.exec:\httnbb.exe88⤵PID:1700
-
\??\c:\dvvdv.exec:\dvvdv.exe89⤵PID:1512
-
\??\c:\llrrrxx.exec:\llrrrxx.exe90⤵PID:1416
-
\??\c:\lffflfx.exec:\lffflfx.exe91⤵PID:4020
-
\??\c:\htnhbh.exec:\htnhbh.exe92⤵PID:4488
-
\??\c:\3nhbhh.exec:\3nhbhh.exe93⤵PID:5100
-
\??\c:\3dppj.exec:\3dppj.exe94⤵PID:4768
-
\??\c:\pjjjv.exec:\pjjjv.exe95⤵PID:648
-
\??\c:\9lllxxr.exec:\9lllxxr.exe96⤵PID:4064
-
\??\c:\5bbttt.exec:\5bbttt.exe97⤵PID:1592
-
\??\c:\7ttttt.exec:\7ttttt.exe98⤵PID:1580
-
\??\c:\9vdvp.exec:\9vdvp.exe99⤵PID:4260
-
\??\c:\7djdv.exec:\7djdv.exe100⤵PID:4996
-
\??\c:\rlxxxxx.exec:\rlxxxxx.exe101⤵PID:1472
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe102⤵PID:4956
-
\??\c:\tttttt.exec:\tttttt.exe103⤵PID:2676
-
\??\c:\dvdjj.exec:\dvdjj.exe104⤵PID:2396
-
\??\c:\vvjdp.exec:\vvjdp.exe105⤵PID:4476
-
\??\c:\xxxlrrr.exec:\xxxlrrr.exe106⤵PID:1016
-
\??\c:\5bhhbb.exec:\5bhhbb.exe107⤵PID:2420
-
\??\c:\tnnnbh.exec:\tnnnbh.exe108⤵PID:3124
-
\??\c:\1jjpj.exec:\1jjpj.exe109⤵PID:1688
-
\??\c:\djdvp.exec:\djdvp.exe110⤵PID:5104
-
\??\c:\7rllxfx.exec:\7rllxfx.exe111⤵PID:1600
-
\??\c:\nthhbt.exec:\nthhbt.exe112⤵PID:3180
-
\??\c:\tntbtt.exec:\tntbtt.exe113⤵PID:2392
-
\??\c:\vpjdd.exec:\vpjdd.exe114⤵PID:1876
-
\??\c:\vdpjd.exec:\vdpjd.exe115⤵PID:3076
-
\??\c:\fxrfffx.exec:\fxrfffx.exe116⤵PID:964
-
\??\c:\hhbtnn.exec:\hhbtnn.exe117⤵PID:3244
-
\??\c:\fxrlxlx.exec:\fxrlxlx.exe118⤵PID:4520
-
\??\c:\nntntt.exec:\nntntt.exe119⤵PID:3972
-
\??\c:\jjpjv.exec:\jjpjv.exe120⤵PID:1672
-
\??\c:\vvjpd.exec:\vvjpd.exe121⤵PID:3592
-
\??\c:\xlfxrxl.exec:\xlfxrxl.exe122⤵PID:2748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-