Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 06:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9f3509d1f95fbe3855e166c9e4bb2b40_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
9f3509d1f95fbe3855e166c9e4bb2b40_NeikiAnalytics.exe
-
Size
334KB
-
MD5
9f3509d1f95fbe3855e166c9e4bb2b40
-
SHA1
695e7b6ec77efafec960e6d95e9a998772cf787a
-
SHA256
e428d2df69f3e97ed80740b0c38a9ba433ea11a10eb5d928c8ae222aa83ebc49
-
SHA512
4619cedd4e3735d77128dc5dff522b208d5ff30833b927fc336aa6ff4e1f29b7969b6475d01e921e9c8a75de4d7bdfe08f89a78bda4e283ff2c47d03f7619669
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp99zm+/KZBHqnuOeHzmB600TUA6Z7zupc+Bd:n3C9BRo7tvnJ99T/KZEuOod00TG+Bd
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/2248-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2248-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4696-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3404-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1432-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2388-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1264-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/940-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/748-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2660-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4680-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/568-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4464-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3684-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/636-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3948-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3528-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3656-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5096-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1604-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4632-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4676-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2524 bbnthn.exe 940 dvppv.exe 4696 5fxxxfl.exe 1536 bthhhn.exe 3404 dpdjp.exe 1264 vpjjj.exe 2388 nttbbt.exe 1432 nhhnnn.exe 748 ddjjj.exe 4988 vvvvv.exe 2660 ppjpv.exe 4680 9lllrrr.exe 568 9xfrffr.exe 4464 jpjpd.exe 3684 ffflrfl.exe 636 ppddv.exe 3948 rrxrxxx.exe 4120 pvdjd.exe 3528 nhtnhn.exe 3656 dpjvd.exe 1604 1xrxxxl.exe 5096 hhhhtb.exe 3604 7ppjj.exe 4632 thhhnb.exe 1588 lrffffx.exe 2692 fflfffl.exe 1540 9lfrlfr.exe 4676 nnhhht.exe 3708 3rlrrxl.exe 3956 3ntnbn.exe 5108 vpddv.exe 4164 rrrllff.exe 4324 vpppj.exe 4532 rxxflfx.exe 4364 9nhttt.exe 3784 jvdpj.exe 2484 rxrxxlx.exe 2572 nhntnt.exe 2600 vdvvd.exe 2356 dpdvp.exe 1408 fffrrff.exe 2564 bnhtnt.exe 3264 djpjv.exe 4108 frrrllr.exe 4144 ttbthb.exe 4876 tbhntb.exe 4872 vjvdp.exe 2828 lxlrrll.exe 744 ntnnbb.exe 4540 hbnhbh.exe 4760 pjddv.exe 760 lffffff.exe 2140 bbnhhh.exe 2328 btnttn.exe 1660 9pvpd.exe 4464 llrrrxx.exe 4584 ffffxxx.exe 1632 bttnhh.exe 4408 pjppj.exe 3948 xffxxrr.exe 1720 rllxxrr.exe 3384 bbttnn.exe 3800 vvjdp.exe 1604 xrxxrxr.exe -
resource yara_rule behavioral2/memory/2248-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2248-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4696-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3404-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1432-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1264-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/940-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/748-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2660-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4680-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/568-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3684-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/636-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3948-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3528-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5096-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1604-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4632-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4676-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2248 wrote to memory of 2524 2248 9f3509d1f95fbe3855e166c9e4bb2b40_NeikiAnalytics.exe 82 PID 2248 wrote to memory of 2524 2248 9f3509d1f95fbe3855e166c9e4bb2b40_NeikiAnalytics.exe 82 PID 2248 wrote to memory of 2524 2248 9f3509d1f95fbe3855e166c9e4bb2b40_NeikiAnalytics.exe 82 PID 2524 wrote to memory of 940 2524 bbnthn.exe 83 PID 2524 wrote to memory of 940 2524 bbnthn.exe 83 PID 2524 wrote to memory of 940 2524 bbnthn.exe 83 PID 940 wrote to memory of 4696 940 dvppv.exe 84 PID 940 wrote to memory of 4696 940 dvppv.exe 84 PID 940 wrote to memory of 4696 940 dvppv.exe 84 PID 4696 wrote to memory of 1536 4696 5fxxxfl.exe 85 PID 4696 wrote to memory of 1536 4696 5fxxxfl.exe 85 PID 4696 wrote to memory of 1536 4696 5fxxxfl.exe 85 PID 1536 wrote to memory of 3404 1536 bthhhn.exe 86 PID 1536 wrote to memory of 3404 1536 bthhhn.exe 86 PID 1536 wrote to memory of 3404 1536 bthhhn.exe 86 PID 3404 wrote to memory of 1264 3404 dpdjp.exe 87 PID 3404 wrote to memory of 1264 3404 dpdjp.exe 87 PID 3404 wrote to memory of 1264 3404 dpdjp.exe 87 PID 1264 wrote to memory of 2388 1264 vpjjj.exe 88 PID 1264 wrote to memory of 2388 1264 vpjjj.exe 88 PID 1264 wrote to memory of 2388 1264 vpjjj.exe 88 PID 2388 wrote to memory of 1432 2388 nttbbt.exe 89 PID 2388 wrote to memory of 1432 2388 nttbbt.exe 89 PID 2388 wrote to memory of 1432 2388 nttbbt.exe 89 PID 1432 wrote to memory of 748 1432 nhhnnn.exe 90 PID 1432 wrote to memory of 748 1432 nhhnnn.exe 90 PID 1432 wrote to memory of 748 1432 nhhnnn.exe 90 PID 748 wrote to memory of 4988 748 ddjjj.exe 91 PID 748 wrote to memory of 4988 748 ddjjj.exe 91 PID 748 wrote to memory of 4988 748 ddjjj.exe 91 PID 4988 wrote to memory of 2660 4988 vvvvv.exe 92 PID 4988 wrote to memory of 2660 4988 vvvvv.exe 92 PID 4988 wrote to memory of 2660 4988 vvvvv.exe 92 PID 2660 wrote to memory of 4680 2660 ppjpv.exe 93 PID 2660 wrote to memory of 4680 2660 ppjpv.exe 93 PID 2660 wrote to memory of 4680 2660 ppjpv.exe 93 PID 4680 wrote to memory of 568 4680 9lllrrr.exe 94 PID 4680 wrote to memory of 568 4680 9lllrrr.exe 94 PID 4680 wrote to memory of 568 4680 9lllrrr.exe 94 PID 568 wrote to memory of 4464 568 9xfrffr.exe 95 PID 568 wrote to memory of 4464 568 9xfrffr.exe 95 PID 568 wrote to memory of 4464 568 9xfrffr.exe 95 PID 4464 wrote to memory of 3684 4464 jpjpd.exe 96 PID 4464 wrote to memory of 3684 4464 jpjpd.exe 96 PID 4464 wrote to memory of 3684 4464 jpjpd.exe 96 PID 3684 wrote to memory of 636 3684 ffflrfl.exe 97 PID 3684 wrote to memory of 636 3684 ffflrfl.exe 97 PID 3684 wrote to memory of 636 3684 ffflrfl.exe 97 PID 636 wrote to memory of 3948 636 ppddv.exe 98 PID 636 wrote to memory of 3948 636 ppddv.exe 98 PID 636 wrote to memory of 3948 636 ppddv.exe 98 PID 3948 wrote to memory of 4120 3948 rrxrxxx.exe 100 PID 3948 wrote to memory of 4120 3948 rrxrxxx.exe 100 PID 3948 wrote to memory of 4120 3948 rrxrxxx.exe 100 PID 4120 wrote to memory of 3528 4120 pvdjd.exe 101 PID 4120 wrote to memory of 3528 4120 pvdjd.exe 101 PID 4120 wrote to memory of 3528 4120 pvdjd.exe 101 PID 3528 wrote to memory of 3656 3528 nhtnhn.exe 102 PID 3528 wrote to memory of 3656 3528 nhtnhn.exe 102 PID 3528 wrote to memory of 3656 3528 nhtnhn.exe 102 PID 3656 wrote to memory of 1604 3656 dpjvd.exe 103 PID 3656 wrote to memory of 1604 3656 dpjvd.exe 103 PID 3656 wrote to memory of 1604 3656 dpjvd.exe 103 PID 1604 wrote to memory of 5096 1604 1xrxxxl.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f3509d1f95fbe3855e166c9e4bb2b40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9f3509d1f95fbe3855e166c9e4bb2b40_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\bbnthn.exec:\bbnthn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\dvppv.exec:\dvppv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\5fxxxfl.exec:\5fxxxfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\bthhhn.exec:\bthhhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\dpdjp.exec:\dpdjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
\??\c:\vpjjj.exec:\vpjjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\nttbbt.exec:\nttbbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\nhhnnn.exec:\nhhnnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\ddjjj.exec:\ddjjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\vvvvv.exec:\vvvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\ppjpv.exec:\ppjpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\9lllrrr.exec:\9lllrrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\9xfrffr.exec:\9xfrffr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\jpjpd.exec:\jpjpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\ffflrfl.exec:\ffflrfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\ppddv.exec:\ppddv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\rrxrxxx.exec:\rrxrxxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\pvdjd.exec:\pvdjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\nhtnhn.exec:\nhtnhn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\dpjvd.exec:\dpjvd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\1xrxxxl.exec:\1xrxxxl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\hhhhtb.exec:\hhhhtb.exe23⤵
- Executes dropped EXE
PID:5096 -
\??\c:\7ppjj.exec:\7ppjj.exe24⤵
- Executes dropped EXE
PID:3604 -
\??\c:\thhhnb.exec:\thhhnb.exe25⤵
- Executes dropped EXE
PID:4632 -
\??\c:\lrffffx.exec:\lrffffx.exe26⤵
- Executes dropped EXE
PID:1588 -
\??\c:\fflfffl.exec:\fflfffl.exe27⤵
- Executes dropped EXE
PID:2692 -
\??\c:\9lfrlfr.exec:\9lfrlfr.exe28⤵
- Executes dropped EXE
PID:1540 -
\??\c:\nnhhht.exec:\nnhhht.exe29⤵
- Executes dropped EXE
PID:4676 -
\??\c:\3rlrrxl.exec:\3rlrrxl.exe30⤵
- Executes dropped EXE
PID:3708 -
\??\c:\3ntnbn.exec:\3ntnbn.exe31⤵
- Executes dropped EXE
PID:3956 -
\??\c:\vpddv.exec:\vpddv.exe32⤵
- Executes dropped EXE
PID:5108 -
\??\c:\rrrllff.exec:\rrrllff.exe33⤵
- Executes dropped EXE
PID:4164 -
\??\c:\vpppj.exec:\vpppj.exe34⤵
- Executes dropped EXE
PID:4324 -
\??\c:\rxxflfx.exec:\rxxflfx.exe35⤵
- Executes dropped EXE
PID:4532 -
\??\c:\9nhttt.exec:\9nhttt.exe36⤵
- Executes dropped EXE
PID:4364 -
\??\c:\jvdpj.exec:\jvdpj.exe37⤵
- Executes dropped EXE
PID:3784 -
\??\c:\rxrxxlx.exec:\rxrxxlx.exe38⤵
- Executes dropped EXE
PID:2484 -
\??\c:\nhntnt.exec:\nhntnt.exe39⤵
- Executes dropped EXE
PID:2572 -
\??\c:\vdvvd.exec:\vdvvd.exe40⤵
- Executes dropped EXE
PID:2600 -
\??\c:\dpdvp.exec:\dpdvp.exe41⤵
- Executes dropped EXE
PID:2356 -
\??\c:\fffrrff.exec:\fffrrff.exe42⤵
- Executes dropped EXE
PID:1408 -
\??\c:\bnhtnt.exec:\bnhtnt.exe43⤵
- Executes dropped EXE
PID:2564 -
\??\c:\djpjv.exec:\djpjv.exe44⤵
- Executes dropped EXE
PID:3264 -
\??\c:\frrrllr.exec:\frrrllr.exe45⤵
- Executes dropped EXE
PID:4108 -
\??\c:\ttbthb.exec:\ttbthb.exe46⤵
- Executes dropped EXE
PID:4144 -
\??\c:\tbhntb.exec:\tbhntb.exe47⤵
- Executes dropped EXE
PID:4876 -
\??\c:\vjvdp.exec:\vjvdp.exe48⤵
- Executes dropped EXE
PID:4872 -
\??\c:\lxlrrll.exec:\lxlrrll.exe49⤵
- Executes dropped EXE
PID:2828 -
\??\c:\ntnnbb.exec:\ntnnbb.exe50⤵
- Executes dropped EXE
PID:744 -
\??\c:\hbnhbh.exec:\hbnhbh.exe51⤵
- Executes dropped EXE
PID:4540 -
\??\c:\pjddv.exec:\pjddv.exe52⤵
- Executes dropped EXE
PID:4760 -
\??\c:\lffffff.exec:\lffffff.exe53⤵
- Executes dropped EXE
PID:760 -
\??\c:\bbnhhh.exec:\bbnhhh.exe54⤵
- Executes dropped EXE
PID:2140 -
\??\c:\btnttn.exec:\btnttn.exe55⤵
- Executes dropped EXE
PID:2328 -
\??\c:\9pvpd.exec:\9pvpd.exe56⤵
- Executes dropped EXE
PID:1660 -
\??\c:\llrrrxx.exec:\llrrrxx.exe57⤵
- Executes dropped EXE
PID:4464 -
\??\c:\ffffxxx.exec:\ffffxxx.exe58⤵
- Executes dropped EXE
PID:4584 -
\??\c:\bttnhh.exec:\bttnhh.exe59⤵
- Executes dropped EXE
PID:1632 -
\??\c:\pjppj.exec:\pjppj.exe60⤵
- Executes dropped EXE
PID:4408 -
\??\c:\xffxxrr.exec:\xffxxrr.exe61⤵
- Executes dropped EXE
PID:3948 -
\??\c:\rllxxrr.exec:\rllxxrr.exe62⤵
- Executes dropped EXE
PID:1720 -
\??\c:\bbttnn.exec:\bbttnn.exe63⤵
- Executes dropped EXE
PID:3384 -
\??\c:\vvjdp.exec:\vvjdp.exe64⤵
- Executes dropped EXE
PID:3800 -
\??\c:\xrxxrxr.exec:\xrxxrxr.exe65⤵
- Executes dropped EXE
PID:1604 -
\??\c:\tbtntn.exec:\tbtntn.exe66⤵PID:396
-
\??\c:\rxrlxxl.exec:\rxrlxxl.exe67⤵PID:2636
-
\??\c:\ntntnb.exec:\ntntnb.exe68⤵PID:3604
-
\??\c:\jvpjd.exec:\jvpjd.exe69⤵PID:3356
-
\??\c:\fxfxllf.exec:\fxfxllf.exe70⤵PID:3296
-
\??\c:\hbhnnt.exec:\hbhnnt.exe71⤵PID:4816
-
\??\c:\pdvpj.exec:\pdvpj.exe72⤵PID:2692
-
\??\c:\fffllrf.exec:\fffllrf.exe73⤵PID:3640
-
\??\c:\jpjvp.exec:\jpjvp.exe74⤵PID:1560
-
\??\c:\frrrrrr.exec:\frrrrrr.exe75⤵PID:5048
-
\??\c:\hhnnbn.exec:\hhnnbn.exe76⤵PID:456
-
\??\c:\tthnnb.exec:\tthnnb.exe77⤵PID:1684
-
\??\c:\7jvpj.exec:\7jvpj.exe78⤵PID:2320
-
\??\c:\xflrrxf.exec:\xflrrxf.exe79⤵PID:4164
-
\??\c:\ffflffr.exec:\ffflffr.exe80⤵PID:4324
-
\??\c:\bbbhbh.exec:\bbbhbh.exe81⤵PID:4532
-
\??\c:\jdvdd.exec:\jdvdd.exe82⤵PID:1896
-
\??\c:\xxrxrlr.exec:\xxrxrlr.exe83⤵PID:4420
-
\??\c:\btttnt.exec:\btttnt.exe84⤵PID:2484
-
\??\c:\bhhhbh.exec:\bhhhbh.exe85⤵PID:4004
-
\??\c:\dvvpd.exec:\dvvpd.exe86⤵PID:4696
-
\??\c:\rlfffrr.exec:\rlfffrr.exe87⤵PID:2356
-
\??\c:\7bhhhb.exec:\7bhhhb.exe88⤵PID:1636
-
\??\c:\7djpj.exec:\7djpj.exe89⤵PID:4344
-
\??\c:\1djjd.exec:\1djjd.exe90⤵PID:3264
-
\??\c:\rflxlrx.exec:\rflxlrx.exe91⤵PID:4108
-
\??\c:\hbbttt.exec:\hbbttt.exe92⤵PID:3808
-
\??\c:\jddvp.exec:\jddvp.exe93⤵PID:1016
-
\??\c:\xrllxxl.exec:\xrllxxl.exe94⤵PID:4872
-
\??\c:\xfrxflx.exec:\xfrxflx.exe95⤵PID:2828
-
\??\c:\tttthb.exec:\tttthb.exe96⤵PID:2796
-
\??\c:\dvjdd.exec:\dvjdd.exe97⤵PID:4540
-
\??\c:\lxrxrfl.exec:\lxrxrfl.exe98⤵PID:4928
-
\??\c:\bthhnb.exec:\bthhnb.exe99⤵PID:4980
-
\??\c:\3pjjj.exec:\3pjjj.exe100⤵PID:2832
-
\??\c:\xrxrlrr.exec:\xrxrlrr.exe101⤵PID:568
-
\??\c:\nhhtbh.exec:\nhhtbh.exe102⤵PID:4584
-
\??\c:\nbtttb.exec:\nbtttb.exe103⤵PID:3360
-
\??\c:\djvpd.exec:\djvpd.exe104⤵PID:3536
-
\??\c:\xrlllxx.exec:\xrlllxx.exe105⤵PID:3448
-
\??\c:\nnbhhn.exec:\nnbhhn.exe106⤵PID:3656
-
\??\c:\bhhtbn.exec:\bhhtbn.exe107⤵PID:1548
-
\??\c:\ppdjj.exec:\ppdjj.exe108⤵PID:3180
-
\??\c:\lxxlfxl.exec:\lxxlfxl.exe109⤵PID:4632
-
\??\c:\hbnntb.exec:\hbnntb.exe110⤵PID:2404
-
\??\c:\ntnhbb.exec:\ntnhbb.exe111⤵PID:3428
-
\??\c:\ddpjv.exec:\ddpjv.exe112⤵PID:4160
-
\??\c:\fxxxrxx.exec:\fxxxrxx.exe113⤵PID:4128
-
\??\c:\btbhht.exec:\btbhht.exe114⤵PID:1560
-
\??\c:\pjdjp.exec:\pjdjp.exe115⤵PID:4228
-
\??\c:\lfrflfr.exec:\lfrflfr.exe116⤵PID:456
-
\??\c:\bnbhtn.exec:\bnbhtn.exe117⤵PID:1684
-
\??\c:\pjdjv.exec:\pjdjv.exe118⤵PID:2320
-
\??\c:\jdjjd.exec:\jdjjd.exe119⤵PID:4164
-
\??\c:\lllrrxf.exec:\lllrrxf.exe120⤵PID:4324
-
\??\c:\bhttbb.exec:\bhttbb.exe121⤵PID:4532
-
\??\c:\9jvdj.exec:\9jvdj.exe122⤵PID:4484
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-