Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 17:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
31cb67ff493312e2f8a6a53a6d1a0870_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
31cb67ff493312e2f8a6a53a6d1a0870_NeikiAnalytics.exe
-
Size
59KB
-
MD5
31cb67ff493312e2f8a6a53a6d1a0870
-
SHA1
96fe81496af66214cdc8379a697ed55ac400556d
-
SHA256
022d39c59bf27f0b71ba6cc7ffb0b472c4a6306a8c5d8cdde42fb7b02a71d113
-
SHA512
b54f65a08be03c63a8830efa4843a818836f4e6f2f62f4eab6b697a92ba2651d67fdb88693f0f5763d8b52df9c71805ba764e41ea3c9fbfe7563498642656353
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzkzg:ymb3NkkiQ3mdBjFIvl0
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/2552-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4060-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2228-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2420-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1492-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2880-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4248-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3704-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1976-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1976-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3256-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4032-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3304-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3500-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3720-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1612-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4876-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1996-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1412-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/756-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4380-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1696-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4504-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4060 dpddp.exe 1492 xxllrxl.exe 2228 vvjjd.exe 2420 xrllxff.exe 2364 bbbbbb.exe 2880 nnbtnn.exe 4248 5rrrrfl.exe 3704 nnbntn.exe 1976 pvvpd.exe 3256 lrfrllf.exe 3024 lfllfxx.exe 3580 btbttn.exe 4032 ddppj.exe 4620 lxlfffx.exe 2308 hhbhbb.exe 3304 tnnnhh.exe 3528 pjjjj.exe 3500 5bhnhh.exe 3720 vpppj.exe 1612 ddjjp.exe 4876 fxllrrx.exe 1996 nntnnn.exe 3040 dpvpp.exe 1412 7dpjj.exe 756 lfrrllf.exe 4832 hhhhbh.exe 4380 vddvp.exe 1696 pjppd.exe 4424 xrllfff.exe 4504 llfrflr.exe 672 hnthbt.exe 2716 vvjvp.exe 2956 3fllrll.exe 4820 xrrrrrl.exe 4056 nnbttb.exe 4616 9bhbtt.exe 4320 vjppd.exe 2880 pdjdd.exe 2980 lfxxxxx.exe 3204 xrfflrl.exe 4744 tbhhnn.exe 3256 nbnhnt.exe 4708 jdvjd.exe 2612 flllfff.exe 3604 ffrrllr.exe 1828 jjjjj.exe 2104 frfrfrr.exe 4068 tnbttt.exe 5024 vjjjd.exe 2080 rrllfll.exe 4512 xrrfxfl.exe 1768 nnnhbb.exe 1776 vvppp.exe 1124 lrfllxx.exe 4004 lflffxx.exe 3608 vdppp.exe 1952 fllfxxx.exe 1272 xrxxrrr.exe 3912 tttbbh.exe 2900 hnnnnn.exe 4536 vvppj.exe 4832 jdppj.exe 4380 jpvvv.exe 3080 lfxrrxf.exe -
resource yara_rule behavioral2/memory/2552-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4060-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4060-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4060-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1492-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1492-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2228-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2420-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1492-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2880-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4248-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3704-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1976-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1976-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3256-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3304-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3500-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3720-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1612-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4876-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1412-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/756-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4380-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1696-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4504-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2552 wrote to memory of 4060 2552 31cb67ff493312e2f8a6a53a6d1a0870_NeikiAnalytics.exe 89 PID 2552 wrote to memory of 4060 2552 31cb67ff493312e2f8a6a53a6d1a0870_NeikiAnalytics.exe 89 PID 2552 wrote to memory of 4060 2552 31cb67ff493312e2f8a6a53a6d1a0870_NeikiAnalytics.exe 89 PID 4060 wrote to memory of 1492 4060 dpddp.exe 90 PID 4060 wrote to memory of 1492 4060 dpddp.exe 90 PID 4060 wrote to memory of 1492 4060 dpddp.exe 90 PID 1492 wrote to memory of 2228 1492 xxllrxl.exe 91 PID 1492 wrote to memory of 2228 1492 xxllrxl.exe 91 PID 1492 wrote to memory of 2228 1492 xxllrxl.exe 91 PID 2228 wrote to memory of 2420 2228 vvjjd.exe 92 PID 2228 wrote to memory of 2420 2228 vvjjd.exe 92 PID 2228 wrote to memory of 2420 2228 vvjjd.exe 92 PID 2420 wrote to memory of 2364 2420 xrllxff.exe 93 PID 2420 wrote to memory of 2364 2420 xrllxff.exe 93 PID 2420 wrote to memory of 2364 2420 xrllxff.exe 93 PID 2364 wrote to memory of 2880 2364 bbbbbb.exe 94 PID 2364 wrote to memory of 2880 2364 bbbbbb.exe 94 PID 2364 wrote to memory of 2880 2364 bbbbbb.exe 94 PID 2880 wrote to memory of 4248 2880 nnbtnn.exe 95 PID 2880 wrote to memory of 4248 2880 nnbtnn.exe 95 PID 2880 wrote to memory of 4248 2880 nnbtnn.exe 95 PID 4248 wrote to memory of 3704 4248 5rrrrfl.exe 96 PID 4248 wrote to memory of 3704 4248 5rrrrfl.exe 96 PID 4248 wrote to memory of 3704 4248 5rrrrfl.exe 96 PID 3704 wrote to memory of 1976 3704 nnbntn.exe 97 PID 3704 wrote to memory of 1976 3704 nnbntn.exe 97 PID 3704 wrote to memory of 1976 3704 nnbntn.exe 97 PID 1976 wrote to memory of 3256 1976 pvvpd.exe 98 PID 1976 wrote to memory of 3256 1976 pvvpd.exe 98 PID 1976 wrote to memory of 3256 1976 pvvpd.exe 98 PID 3256 wrote to memory of 3024 3256 lrfrllf.exe 99 PID 3256 wrote to memory of 3024 3256 lrfrllf.exe 99 PID 3256 wrote to memory of 3024 3256 lrfrllf.exe 99 PID 3024 wrote to memory of 3580 3024 lfllfxx.exe 101 PID 3024 wrote to memory of 3580 3024 lfllfxx.exe 101 PID 3024 wrote to memory of 3580 3024 lfllfxx.exe 101 PID 3580 wrote to memory of 4032 3580 btbttn.exe 102 PID 3580 wrote to memory of 4032 3580 btbttn.exe 102 PID 3580 wrote to memory of 4032 3580 btbttn.exe 102 PID 4032 wrote to memory of 4620 4032 ddppj.exe 103 PID 4032 wrote to memory of 4620 4032 ddppj.exe 103 PID 4032 wrote to memory of 4620 4032 ddppj.exe 103 PID 4620 wrote to memory of 2308 4620 lxlfffx.exe 104 PID 4620 wrote to memory of 2308 4620 lxlfffx.exe 104 PID 4620 wrote to memory of 2308 4620 lxlfffx.exe 104 PID 2308 wrote to memory of 3304 2308 hhbhbb.exe 105 PID 2308 wrote to memory of 3304 2308 hhbhbb.exe 105 PID 2308 wrote to memory of 3304 2308 hhbhbb.exe 105 PID 3304 wrote to memory of 3528 3304 tnnnhh.exe 106 PID 3304 wrote to memory of 3528 3304 tnnnhh.exe 106 PID 3304 wrote to memory of 3528 3304 tnnnhh.exe 106 PID 3528 wrote to memory of 3500 3528 pjjjj.exe 107 PID 3528 wrote to memory of 3500 3528 pjjjj.exe 107 PID 3528 wrote to memory of 3500 3528 pjjjj.exe 107 PID 3500 wrote to memory of 3720 3500 5bhnhh.exe 109 PID 3500 wrote to memory of 3720 3500 5bhnhh.exe 109 PID 3500 wrote to memory of 3720 3500 5bhnhh.exe 109 PID 3720 wrote to memory of 1612 3720 vpppj.exe 110 PID 3720 wrote to memory of 1612 3720 vpppj.exe 110 PID 3720 wrote to memory of 1612 3720 vpppj.exe 110 PID 1612 wrote to memory of 4876 1612 ddjjp.exe 111 PID 1612 wrote to memory of 4876 1612 ddjjp.exe 111 PID 1612 wrote to memory of 4876 1612 ddjjp.exe 111 PID 4876 wrote to memory of 1996 4876 fxllrrx.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\31cb67ff493312e2f8a6a53a6d1a0870_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\31cb67ff493312e2f8a6a53a6d1a0870_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\dpddp.exec:\dpddp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\xxllrxl.exec:\xxllrxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\vvjjd.exec:\vvjjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\xrllxff.exec:\xrllxff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\bbbbbb.exec:\bbbbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\nnbtnn.exec:\nnbtnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\5rrrrfl.exec:\5rrrrfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\nnbntn.exec:\nnbntn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\pvvpd.exec:\pvvpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\lrfrllf.exec:\lrfrllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\lfllfxx.exec:\lfllfxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\btbttn.exec:\btbttn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\ddppj.exec:\ddppj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\lxlfffx.exec:\lxlfffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\hhbhbb.exec:\hhbhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\tnnnhh.exec:\tnnnhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\pjjjj.exec:\pjjjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\5bhnhh.exec:\5bhnhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\vpppj.exec:\vpppj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\ddjjp.exec:\ddjjp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\fxllrrx.exec:\fxllrrx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\nntnnn.exec:\nntnnn.exe23⤵
- Executes dropped EXE
PID:1996 -
\??\c:\dpvpp.exec:\dpvpp.exe24⤵
- Executes dropped EXE
PID:3040 -
\??\c:\7dpjj.exec:\7dpjj.exe25⤵
- Executes dropped EXE
PID:1412 -
\??\c:\lfrrllf.exec:\lfrrllf.exe26⤵
- Executes dropped EXE
PID:756 -
\??\c:\hhhhbh.exec:\hhhhbh.exe27⤵
- Executes dropped EXE
PID:4832 -
\??\c:\vddvp.exec:\vddvp.exe28⤵
- Executes dropped EXE
PID:4380 -
\??\c:\pjppd.exec:\pjppd.exe29⤵
- Executes dropped EXE
PID:1696 -
\??\c:\xrllfff.exec:\xrllfff.exe30⤵
- Executes dropped EXE
PID:4424 -
\??\c:\llfrflr.exec:\llfrflr.exe31⤵
- Executes dropped EXE
PID:4504 -
\??\c:\hnthbt.exec:\hnthbt.exe32⤵
- Executes dropped EXE
PID:672 -
\??\c:\vvjvp.exec:\vvjvp.exe33⤵
- Executes dropped EXE
PID:2716 -
\??\c:\3fllrll.exec:\3fllrll.exe34⤵
- Executes dropped EXE
PID:2956 -
\??\c:\xrrrrrl.exec:\xrrrrrl.exe35⤵
- Executes dropped EXE
PID:4820 -
\??\c:\nnbttb.exec:\nnbttb.exe36⤵
- Executes dropped EXE
PID:4056 -
\??\c:\9bhbtt.exec:\9bhbtt.exe37⤵
- Executes dropped EXE
PID:4616 -
\??\c:\vjppd.exec:\vjppd.exe38⤵
- Executes dropped EXE
PID:4320 -
\??\c:\pdjdd.exec:\pdjdd.exe39⤵
- Executes dropped EXE
PID:2880 -
\??\c:\lfxxxxx.exec:\lfxxxxx.exe40⤵
- Executes dropped EXE
PID:2980 -
\??\c:\xrfflrl.exec:\xrfflrl.exe41⤵
- Executes dropped EXE
PID:3204 -
\??\c:\tbhhnn.exec:\tbhhnn.exe42⤵
- Executes dropped EXE
PID:4744 -
\??\c:\nbnhnt.exec:\nbnhnt.exe43⤵
- Executes dropped EXE
PID:3256 -
\??\c:\jdvjd.exec:\jdvjd.exe44⤵
- Executes dropped EXE
PID:4708 -
\??\c:\flllfff.exec:\flllfff.exe45⤵
- Executes dropped EXE
PID:2612 -
\??\c:\ffrrllr.exec:\ffrrllr.exe46⤵
- Executes dropped EXE
PID:3604 -
\??\c:\jjjjj.exec:\jjjjj.exe47⤵
- Executes dropped EXE
PID:1828 -
\??\c:\frfrfrr.exec:\frfrfrr.exe48⤵
- Executes dropped EXE
PID:2104 -
\??\c:\tnbttt.exec:\tnbttt.exe49⤵
- Executes dropped EXE
PID:4068 -
\??\c:\vjjjd.exec:\vjjjd.exe50⤵
- Executes dropped EXE
PID:5024 -
\??\c:\rrllfll.exec:\rrllfll.exe51⤵
- Executes dropped EXE
PID:2080 -
\??\c:\xrrfxfl.exec:\xrrfxfl.exe52⤵
- Executes dropped EXE
PID:4512 -
\??\c:\nnnhbb.exec:\nnnhbb.exe53⤵
- Executes dropped EXE
PID:1768 -
\??\c:\vvppp.exec:\vvppp.exe54⤵
- Executes dropped EXE
PID:1776 -
\??\c:\lrfllxx.exec:\lrfllxx.exe55⤵
- Executes dropped EXE
PID:1124 -
\??\c:\lflffxx.exec:\lflffxx.exe56⤵
- Executes dropped EXE
PID:4004 -
\??\c:\vdppp.exec:\vdppp.exe57⤵
- Executes dropped EXE
PID:3608 -
\??\c:\fllfxxx.exec:\fllfxxx.exe58⤵
- Executes dropped EXE
PID:1952 -
\??\c:\xrxxrrr.exec:\xrxxrrr.exe59⤵
- Executes dropped EXE
PID:1272 -
\??\c:\tttbbh.exec:\tttbbh.exe60⤵
- Executes dropped EXE
PID:3912 -
\??\c:\hnnnnn.exec:\hnnnnn.exe61⤵
- Executes dropped EXE
PID:2900 -
\??\c:\vvppj.exec:\vvppj.exe62⤵
- Executes dropped EXE
PID:4536 -
\??\c:\jdppj.exec:\jdppj.exe63⤵
- Executes dropped EXE
PID:4832 -
\??\c:\jpvvv.exec:\jpvvv.exe64⤵
- Executes dropped EXE
PID:4380 -
\??\c:\lfxrrxf.exec:\lfxrrxf.exe65⤵
- Executes dropped EXE
PID:3080 -
\??\c:\lffllll.exec:\lffllll.exe66⤵PID:4432
-
\??\c:\bbttnt.exec:\bbttnt.exe67⤵PID:2384
-
\??\c:\tbbbbh.exec:\tbbbbh.exe68⤵PID:2640
-
\??\c:\jjvpv.exec:\jjvpv.exe69⤵PID:2668
-
\??\c:\jjjdv.exec:\jjjdv.exe70⤵PID:3600
-
\??\c:\ffxxlll.exec:\ffxxlll.exe71⤵PID:4052
-
\??\c:\llllflf.exec:\llllflf.exe72⤵PID:928
-
\??\c:\lxxrrrl.exec:\lxxrrrl.exe73⤵PID:4740
-
\??\c:\bhnnhh.exec:\bhnnhh.exe74⤵PID:364
-
\??\c:\bhthhb.exec:\bhthhb.exe75⤵PID:3492
-
\??\c:\dvjvj.exec:\dvjvj.exe76⤵PID:4020
-
\??\c:\rlxxxxr.exec:\rlxxxxr.exe77⤵PID:1740
-
\??\c:\httttb.exec:\httttb.exe78⤵PID:2912
-
\??\c:\tbbhht.exec:\tbbhht.exe79⤵PID:2052
-
\??\c:\ppdpp.exec:\ppdpp.exe80⤵PID:3580
-
\??\c:\pjpjd.exec:\pjpjd.exe81⤵PID:3644
-
\??\c:\rllxrfr.exec:\rllxrfr.exe82⤵PID:3768
-
\??\c:\3xffflr.exec:\3xffflr.exe83⤵PID:3908
-
\??\c:\tbtnnt.exec:\tbtnnt.exe84⤵PID:4116
-
\??\c:\vpppp.exec:\vpppp.exe85⤵PID:2192
-
\??\c:\3ddvp.exec:\3ddvp.exe86⤵PID:1084
-
\??\c:\xxllxxl.exec:\xxllxxl.exe87⤵PID:1584
-
\??\c:\7bnntt.exec:\7bnntt.exe88⤵PID:3292
-
\??\c:\nhnbbt.exec:\nhnbbt.exe89⤵PID:4712
-
\??\c:\dvjdj.exec:\dvjdj.exe90⤵PID:4728
-
\??\c:\jpvvd.exec:\jpvvd.exe91⤵PID:1848
-
\??\c:\rxrxrrr.exec:\rxrxrrr.exe92⤵PID:880
-
\??\c:\lflfxlf.exec:\lflfxlf.exe93⤵PID:4264
-
\??\c:\bthtbt.exec:\bthtbt.exe94⤵PID:3776
-
\??\c:\bhbbhn.exec:\bhbbhn.exe95⤵PID:1324
-
\??\c:\vvjjv.exec:\vvjjv.exe96⤵PID:4664
-
\??\c:\jdddv.exec:\jdddv.exe97⤵PID:3660
-
\??\c:\jjdjd.exec:\jjdjd.exe98⤵PID:624
-
\??\c:\frffrrr.exec:\frffrrr.exe99⤵PID:3348
-
\??\c:\xlxrlfl.exec:\xlxrlfl.exe100⤵PID:3244
-
\??\c:\1thhhh.exec:\1thhhh.exe101⤵PID:4060
-
\??\c:\thbbbb.exec:\thbbbb.exe102⤵PID:1420
-
\??\c:\hnbbhh.exec:\hnbbhh.exe103⤵PID:1200
-
\??\c:\jjdpp.exec:\jjdpp.exe104⤵PID:2852
-
\??\c:\jddvp.exec:\jddvp.exe105⤵PID:3600
-
\??\c:\fxrrfff.exec:\fxrrfff.exe106⤵PID:4544
-
\??\c:\frxfflf.exec:\frxfflf.exe107⤵PID:416
-
\??\c:\tttntt.exec:\tttntt.exe108⤵PID:1256
-
\??\c:\tthbnh.exec:\tthbnh.exe109⤵PID:364
-
\??\c:\5vjdj.exec:\5vjdj.exe110⤵PID:3008
-
\??\c:\pjjpj.exec:\pjjpj.exe111⤵PID:1560
-
\??\c:\dvjjp.exec:\dvjjp.exe112⤵PID:776
-
\??\c:\xrrrffx.exec:\xrrrffx.exe113⤵PID:4580
-
\??\c:\thtttt.exec:\thtttt.exe114⤵PID:4444
-
\??\c:\djppj.exec:\djppj.exe115⤵PID:4008
-
\??\c:\jvddj.exec:\jvddj.exe116⤵PID:2644
-
\??\c:\vpvvv.exec:\vpvvv.exe117⤵PID:2308
-
\??\c:\lxxrllf.exec:\lxxrllf.exe118⤵PID:4520
-
\??\c:\frxxrxr.exec:\frxxrxr.exe119⤵PID:3136
-
\??\c:\bbtnnh.exec:\bbtnnh.exe120⤵PID:3500
-
\??\c:\tntntt.exec:\tntntt.exe121⤵PID:3272
-
\??\c:\dddjj.exec:\dddjj.exe122⤵PID:4968
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-