Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 08:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
073df16d266f2426e71999432c7cbf30_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
073df16d266f2426e71999432c7cbf30_NeikiAnalytics.exe
-
Size
66KB
-
MD5
073df16d266f2426e71999432c7cbf30
-
SHA1
e7c8145a4385f02844a5963612369f79b7a86069
-
SHA256
f81d7aa3d3fe48d7ea3d5b570d7cc37f068222b7f092745f5a27b95abaf5eb44
-
SHA512
5f93c45bf4d4c177e026d0cc3ffa6d2c955e79c76a2b9b450424b81ff6bba7d48c15df86c4a82fec431e0c19be9a24c356bef703300493f9b8133af1e8c48f34
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFdJUDbAI8:ymb3NkkiQ3mdBjFIFdJ8bu
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral2/memory/4920-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2592-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1648-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1972-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5092-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1780-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2976-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1676-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3684-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1820-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2268-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1884-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4868-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1856-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3968-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2592 7hhhbb.exe 4076 djpjd.exe 1648 3lxrffl.exe 2564 htnnhb.exe 1972 hhnhbh.exe 3576 vpppj.exe 1780 flfxlfr.exe 5092 3xlfxrl.exe 4400 hntnnh.exe 2276 hbtnhh.exe 2976 ddjpv.exe 1676 xrfrrrr.exe 3684 hntnhh.exe 632 jjddp.exe 3376 9xfxrff.exe 2000 9tbbtb.exe 1820 dppjd.exe 2268 dpvvp.exe 1884 rlxrlll.exe 4524 fxxxrxx.exe 2796 nnhbbb.exe 2364 jdjvd.exe 3628 7llfflf.exe 4868 thntbb.exe 2352 vpvvj.exe 3724 3flfffx.exe 1856 flrrxfl.exe 2684 ntnbnh.exe 3968 jvdvj.exe 4236 rllffff.exe 2596 fxffflf.exe 4896 nbhbbb.exe 1472 3jdvp.exe 924 7fxxrlx.exe 2492 bhnntn.exe 3272 nhnnhh.exe 3964 vjdpd.exe 388 rfrxxrl.exe 4856 xrllllr.exe 2452 hntbtn.exe 3436 vppdv.exe 2976 rlxlfxf.exe 3052 3rrlflf.exe 3792 thnnhh.exe 4536 1ttnhh.exe 3760 ppvvv.exe 5000 jvjvp.exe 3376 lflfxff.exe 2892 bhnhbt.exe 1284 bhhbtt.exe 5112 dppjd.exe 4884 rlrlrrr.exe 4848 btnbhh.exe 4252 jjjjd.exe 2588 lrfrxlx.exe 2196 hthhnb.exe 2692 vjjdd.exe 2068 1vppj.exe 1524 frxrlrr.exe 3708 nhhbbb.exe 2460 3ddvp.exe 4004 5pdjv.exe 3220 xrllllr.exe 2392 tthbbt.exe -
resource yara_rule behavioral2/memory/4920-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2592-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4076-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1648-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1780-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2276-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2276-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2976-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1676-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3684-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1820-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2268-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1884-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4524-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4868-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1856-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-184-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4920 wrote to memory of 2592 4920 073df16d266f2426e71999432c7cbf30_NeikiAnalytics.exe 90 PID 4920 wrote to memory of 2592 4920 073df16d266f2426e71999432c7cbf30_NeikiAnalytics.exe 90 PID 4920 wrote to memory of 2592 4920 073df16d266f2426e71999432c7cbf30_NeikiAnalytics.exe 90 PID 2592 wrote to memory of 4076 2592 7hhhbb.exe 91 PID 2592 wrote to memory of 4076 2592 7hhhbb.exe 91 PID 2592 wrote to memory of 4076 2592 7hhhbb.exe 91 PID 4076 wrote to memory of 1648 4076 djpjd.exe 92 PID 4076 wrote to memory of 1648 4076 djpjd.exe 92 PID 4076 wrote to memory of 1648 4076 djpjd.exe 92 PID 1648 wrote to memory of 2564 1648 3lxrffl.exe 93 PID 1648 wrote to memory of 2564 1648 3lxrffl.exe 93 PID 1648 wrote to memory of 2564 1648 3lxrffl.exe 93 PID 2564 wrote to memory of 1972 2564 htnnhb.exe 94 PID 2564 wrote to memory of 1972 2564 htnnhb.exe 94 PID 2564 wrote to memory of 1972 2564 htnnhb.exe 94 PID 1972 wrote to memory of 3576 1972 hhnhbh.exe 95 PID 1972 wrote to memory of 3576 1972 hhnhbh.exe 95 PID 1972 wrote to memory of 3576 1972 hhnhbh.exe 95 PID 3576 wrote to memory of 1780 3576 vpppj.exe 96 PID 3576 wrote to memory of 1780 3576 vpppj.exe 96 PID 3576 wrote to memory of 1780 3576 vpppj.exe 96 PID 1780 wrote to memory of 5092 1780 flfxlfr.exe 97 PID 1780 wrote to memory of 5092 1780 flfxlfr.exe 97 PID 1780 wrote to memory of 5092 1780 flfxlfr.exe 97 PID 5092 wrote to memory of 4400 5092 3xlfxrl.exe 98 PID 5092 wrote to memory of 4400 5092 3xlfxrl.exe 98 PID 5092 wrote to memory of 4400 5092 3xlfxrl.exe 98 PID 4400 wrote to memory of 2276 4400 hntnnh.exe 99 PID 4400 wrote to memory of 2276 4400 hntnnh.exe 99 PID 4400 wrote to memory of 2276 4400 hntnnh.exe 99 PID 2276 wrote to memory of 2976 2276 hbtnhh.exe 100 PID 2276 wrote to memory of 2976 2276 hbtnhh.exe 100 PID 2276 wrote to memory of 2976 2276 hbtnhh.exe 100 PID 2976 wrote to memory of 1676 2976 ddjpv.exe 101 PID 2976 wrote to memory of 1676 2976 ddjpv.exe 101 PID 2976 wrote to memory of 1676 2976 ddjpv.exe 101 PID 1676 wrote to memory of 3684 1676 xrfrrrr.exe 102 PID 1676 wrote to memory of 3684 1676 xrfrrrr.exe 102 PID 1676 wrote to memory of 3684 1676 xrfrrrr.exe 102 PID 3684 wrote to memory of 632 3684 hntnhh.exe 103 PID 3684 wrote to memory of 632 3684 hntnhh.exe 103 PID 3684 wrote to memory of 632 3684 hntnhh.exe 103 PID 632 wrote to memory of 3376 632 jjddp.exe 104 PID 632 wrote to memory of 3376 632 jjddp.exe 104 PID 632 wrote to memory of 3376 632 jjddp.exe 104 PID 3376 wrote to memory of 2000 3376 9xfxrff.exe 105 PID 3376 wrote to memory of 2000 3376 9xfxrff.exe 105 PID 3376 wrote to memory of 2000 3376 9xfxrff.exe 105 PID 2000 wrote to memory of 1820 2000 9tbbtb.exe 106 PID 2000 wrote to memory of 1820 2000 9tbbtb.exe 106 PID 2000 wrote to memory of 1820 2000 9tbbtb.exe 106 PID 1820 wrote to memory of 2268 1820 dppjd.exe 107 PID 1820 wrote to memory of 2268 1820 dppjd.exe 107 PID 1820 wrote to memory of 2268 1820 dppjd.exe 107 PID 2268 wrote to memory of 1884 2268 dpvvp.exe 108 PID 2268 wrote to memory of 1884 2268 dpvvp.exe 108 PID 2268 wrote to memory of 1884 2268 dpvvp.exe 108 PID 1884 wrote to memory of 4524 1884 rlxrlll.exe 109 PID 1884 wrote to memory of 4524 1884 rlxrlll.exe 109 PID 1884 wrote to memory of 4524 1884 rlxrlll.exe 109 PID 4524 wrote to memory of 2796 4524 fxxxrxx.exe 110 PID 4524 wrote to memory of 2796 4524 fxxxrxx.exe 110 PID 4524 wrote to memory of 2796 4524 fxxxrxx.exe 110 PID 2796 wrote to memory of 2364 2796 nnhbbb.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\073df16d266f2426e71999432c7cbf30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\073df16d266f2426e71999432c7cbf30_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\7hhhbb.exec:\7hhhbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\djpjd.exec:\djpjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\3lxrffl.exec:\3lxrffl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\htnnhb.exec:\htnnhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\hhnhbh.exec:\hhnhbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\vpppj.exec:\vpppj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\flfxlfr.exec:\flfxlfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\3xlfxrl.exec:\3xlfxrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\hntnnh.exec:\hntnnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\hbtnhh.exec:\hbtnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\ddjpv.exec:\ddjpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\xrfrrrr.exec:\xrfrrrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\hntnhh.exec:\hntnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\jjddp.exec:\jjddp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\9xfxrff.exec:\9xfxrff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
\??\c:\9tbbtb.exec:\9tbbtb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\dppjd.exec:\dppjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\dpvvp.exec:\dpvvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\rlxrlll.exec:\rlxrlll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\fxxxrxx.exec:\fxxxrxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\nnhbbb.exec:\nnhbbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\jdjvd.exec:\jdjvd.exe23⤵
- Executes dropped EXE
PID:2364 -
\??\c:\7llfflf.exec:\7llfflf.exe24⤵
- Executes dropped EXE
PID:3628 -
\??\c:\thntbb.exec:\thntbb.exe25⤵
- Executes dropped EXE
PID:4868 -
\??\c:\vpvvj.exec:\vpvvj.exe26⤵
- Executes dropped EXE
PID:2352 -
\??\c:\3flfffx.exec:\3flfffx.exe27⤵
- Executes dropped EXE
PID:3724 -
\??\c:\flrrxfl.exec:\flrrxfl.exe28⤵
- Executes dropped EXE
PID:1856 -
\??\c:\ntnbnh.exec:\ntnbnh.exe29⤵
- Executes dropped EXE
PID:2684 -
\??\c:\bttnhn.exec:\bttnhn.exe30⤵PID:4844
-
\??\c:\jvdvj.exec:\jvdvj.exe31⤵
- Executes dropped EXE
PID:3968 -
\??\c:\rllffff.exec:\rllffff.exe32⤵
- Executes dropped EXE
PID:4236 -
\??\c:\fxffflf.exec:\fxffflf.exe33⤵
- Executes dropped EXE
PID:2596 -
\??\c:\nbhbbb.exec:\nbhbbb.exe34⤵
- Executes dropped EXE
PID:4896 -
\??\c:\3jdvp.exec:\3jdvp.exe35⤵
- Executes dropped EXE
PID:1472 -
\??\c:\7fxxrlx.exec:\7fxxrlx.exe36⤵
- Executes dropped EXE
PID:924 -
\??\c:\bhnntn.exec:\bhnntn.exe37⤵
- Executes dropped EXE
PID:2492 -
\??\c:\nhnnhh.exec:\nhnnhh.exe38⤵
- Executes dropped EXE
PID:3272 -
\??\c:\vjdpd.exec:\vjdpd.exe39⤵
- Executes dropped EXE
PID:3964 -
\??\c:\rfrxxrl.exec:\rfrxxrl.exe40⤵
- Executes dropped EXE
PID:388 -
\??\c:\xrllllr.exec:\xrllllr.exe41⤵
- Executes dropped EXE
PID:4856 -
\??\c:\hntbtn.exec:\hntbtn.exe42⤵
- Executes dropped EXE
PID:2452 -
\??\c:\vppdv.exec:\vppdv.exe43⤵
- Executes dropped EXE
PID:3436 -
\??\c:\rlxlfxf.exec:\rlxlfxf.exe44⤵
- Executes dropped EXE
PID:2976 -
\??\c:\3rrlflf.exec:\3rrlflf.exe45⤵
- Executes dropped EXE
PID:3052 -
\??\c:\thnnhh.exec:\thnnhh.exe46⤵
- Executes dropped EXE
PID:3792 -
\??\c:\1ttnhh.exec:\1ttnhh.exe47⤵
- Executes dropped EXE
PID:4536 -
\??\c:\ppvvv.exec:\ppvvv.exe48⤵
- Executes dropped EXE
PID:3760 -
\??\c:\jvjvp.exec:\jvjvp.exe49⤵
- Executes dropped EXE
PID:5000 -
\??\c:\lflfxff.exec:\lflfxff.exe50⤵
- Executes dropped EXE
PID:3376 -
\??\c:\bhnhbt.exec:\bhnhbt.exe51⤵
- Executes dropped EXE
PID:2892 -
\??\c:\bhhbtt.exec:\bhhbtt.exe52⤵
- Executes dropped EXE
PID:1284 -
\??\c:\dppjd.exec:\dppjd.exe53⤵
- Executes dropped EXE
PID:5112 -
\??\c:\rlrlrrr.exec:\rlrlrrr.exe54⤵
- Executes dropped EXE
PID:4884 -
\??\c:\btnbhh.exec:\btnbhh.exe55⤵
- Executes dropped EXE
PID:4848 -
\??\c:\jjjjd.exec:\jjjjd.exe56⤵
- Executes dropped EXE
PID:4252 -
\??\c:\lrfrxlx.exec:\lrfrxlx.exe57⤵
- Executes dropped EXE
PID:2588 -
\??\c:\hthhnb.exec:\hthhnb.exe58⤵
- Executes dropped EXE
PID:2196 -
\??\c:\vjjdd.exec:\vjjdd.exe59⤵
- Executes dropped EXE
PID:2692 -
\??\c:\1vppj.exec:\1vppj.exe60⤵
- Executes dropped EXE
PID:2068 -
\??\c:\frxrlrr.exec:\frxrlrr.exe61⤵
- Executes dropped EXE
PID:1524 -
\??\c:\nhhbbb.exec:\nhhbbb.exe62⤵
- Executes dropped EXE
PID:3708 -
\??\c:\3ddvp.exec:\3ddvp.exe63⤵
- Executes dropped EXE
PID:2460 -
\??\c:\5pdjv.exec:\5pdjv.exe64⤵
- Executes dropped EXE
PID:4004 -
\??\c:\xrllllr.exec:\xrllllr.exe65⤵
- Executes dropped EXE
PID:3220 -
\??\c:\tthbbt.exec:\tthbbt.exe66⤵
- Executes dropped EXE
PID:2392 -
\??\c:\tnhhtt.exec:\tnhhtt.exe67⤵PID:4944
-
\??\c:\jjjdd.exec:\jjjdd.exe68⤵PID:3388
-
\??\c:\1pppj.exec:\1pppj.exe69⤵PID:3340
-
\??\c:\llfxfff.exec:\llfxfff.exe70⤵PID:3504
-
\??\c:\rffxrrl.exec:\rffxrrl.exe71⤵PID:1756
-
\??\c:\hbbbbn.exec:\hbbbbn.exe72⤵PID:2528
-
\??\c:\ddppd.exec:\ddppd.exe73⤵PID:1608
-
\??\c:\jpvvp.exec:\jpvvp.exe74⤵PID:4400
-
\??\c:\lrfxllf.exec:\lrfxllf.exe75⤵PID:1952
-
\??\c:\htnbht.exec:\htnbht.exe76⤵PID:2260
-
\??\c:\vpdjd.exec:\vpdjd.exe77⤵PID:3940
-
\??\c:\xllrlxl.exec:\xllrlxl.exe78⤵PID:4180
-
\??\c:\nhthth.exec:\nhthth.exe79⤵PID:528
-
\??\c:\dvpdp.exec:\dvpdp.exe80⤵PID:5052
-
\??\c:\vjpjd.exec:\vjpjd.exe81⤵PID:4824
-
\??\c:\3frrflx.exec:\3frrflx.exe82⤵PID:1140
-
\??\c:\xxffffx.exec:\xxffffx.exe83⤵PID:3296
-
\??\c:\nnthbt.exec:\nnthbt.exe84⤵PID:1632
-
\??\c:\1nbhbt.exec:\1nbhbt.exe85⤵PID:1284
-
\??\c:\9vvpv.exec:\9vvpv.exe86⤵PID:2640
-
\??\c:\rrxfxrl.exec:\rrxfxrl.exe87⤵PID:3492
-
\??\c:\xrfflrr.exec:\xrfflrr.exe88⤵PID:5028
-
\??\c:\thttnn.exec:\thttnn.exe89⤵PID:4252
-
\??\c:\tntbtt.exec:\tntbtt.exe90⤵PID:4868
-
\??\c:\hhbtnb.exec:\hhbtnb.exe91⤵PID:2708
-
\??\c:\dpvpj.exec:\dpvpj.exe92⤵PID:3016
-
\??\c:\rflxrrr.exec:\rflxrrr.exe93⤵PID:4216
-
\??\c:\fxfffll.exec:\fxfffll.exe94⤵PID:4344
-
\??\c:\lxfxffr.exec:\lxfxffr.exe95⤵PID:4340
-
\??\c:\5nnhtt.exec:\5nnhtt.exe96⤵PID:4356
-
\??\c:\htntbb.exec:\htntbb.exe97⤵PID:4236
-
\??\c:\pjjdj.exec:\pjjdj.exe98⤵PID:3632
-
\??\c:\jvddv.exec:\jvddv.exe99⤵PID:2380
-
\??\c:\xrxrlll.exec:\xrxrlll.exe100⤵PID:2824
-
\??\c:\xlxxrxx.exec:\xlxxrxx.exe101⤵PID:2188
-
\??\c:\thnhhb.exec:\thnhhb.exe102⤵PID:3480
-
\??\c:\bnnbbt.exec:\bnnbbt.exe103⤵PID:1780
-
\??\c:\vpppj.exec:\vpppj.exe104⤵PID:1532
-
\??\c:\vpvjj.exec:\vpvjj.exe105⤵PID:2304
-
\??\c:\5frlffx.exec:\5frlffx.exe106⤵PID:4568
-
\??\c:\nbtnhh.exec:\nbtnhh.exe107⤵PID:4400
-
\??\c:\pjppd.exec:\pjppd.exe108⤵PID:3436
-
\??\c:\9vdvp.exec:\9vdvp.exe109⤵PID:2260
-
\??\c:\xffffrr.exec:\xffffrr.exe110⤵PID:1256
-
\??\c:\lfxrrrl.exec:\lfxrrrl.exe111⤵PID:4564
-
\??\c:\btntnn.exec:\btntnn.exe112⤵PID:3804
-
\??\c:\7jvpd.exec:\7jvpd.exe113⤵PID:3144
-
\??\c:\vvvpp.exec:\vvvpp.exe114⤵PID:3760
-
\??\c:\rfrlffx.exec:\rfrlffx.exe115⤵PID:3376
-
\??\c:\fxlllff.exec:\fxlllff.exe116⤵PID:3296
-
\??\c:\bbbthh.exec:\bbbthh.exe117⤵PID:3384
-
\??\c:\vpjdv.exec:\vpjdv.exe118⤵PID:588
-
\??\c:\7jvvp.exec:\7jvvp.exe119⤵PID:2640
-
\??\c:\xlrfxrl.exec:\xlrfxrl.exe120⤵PID:1220
-
\??\c:\3fllxxf.exec:\3fllxxf.exe121⤵PID:4560
-
\??\c:\nbbtth.exec:\nbbtth.exe122⤵PID:1036
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-