Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 18:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
43f516efa3adfe881d783fd76c0db8c0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
43f516efa3adfe881d783fd76c0db8c0_NeikiAnalytics.exe
-
Size
970KB
-
MD5
43f516efa3adfe881d783fd76c0db8c0
-
SHA1
d809ed5ef09b00e4c8ce0bee501a3019cc5576e3
-
SHA256
215bb0a1c292ae3d85a2fbbc6910f231d8ed15b8af74585d3680a0fa78f2ffb2
-
SHA512
0af90f7ab3c8dbacd85db32fff7c889149428e852b60677427040057dc203d38d768a634bf659b6c2e9598f14a1236023a2edbccde2519c854ff49009eaac1d3
-
SSDEEP
12288:n3C9yMo+S0L9xRnoq7H9xqYL04iVypNKvzcMwdBS3b3aoqYveXVadBlHD+CURPO5:SgD4bhoqLDqYLagB6Wj1+Cyv
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/1004-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1136-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4684-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2156-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2848-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1076-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1068-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5076-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3112-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2232-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3736-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4804-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3100-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4316-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/452-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2532-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4848-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1652-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3964-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5096-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3080-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4236-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1136 jjvpj.exe 4684 rfrfrlf.exe 2156 pjjdd.exe 3520 ntntnn.exe 2848 lllfrlx.exe 3192 lrxflxx.exe 1076 5rllrlr.exe 4992 pdpjj.exe 1068 fffrfrf.exe 5076 llrrlrl.exe 3112 dddvv.exe 2232 hthhbb.exe 3736 hhbtnb.exe 4804 pdjjd.exe 5020 nhtnnn.exe 3100 fxrlfff.exe 1888 xrlrlrf.exe 4316 hntnhh.exe 452 vjvpj.exe 2532 lrxrxxr.exe 4848 flrfxlx.exe 1652 xxrlxfx.exe 3964 7bthnh.exe 5096 tnhbnh.exe 1196 rfffrrx.exe 3080 pdjjp.exe 2040 vpvdp.exe 5036 bntnbt.exe 5044 dvvjv.exe 4236 tnnhtt.exe 2380 dvjdv.exe 3064 rxllffx.exe 3728 nthbtt.exe 632 vdpjj.exe 4312 rxrfxxr.exe 4364 dppdv.exe 4880 rllxlfl.exe 3252 hnnbbb.exe 4888 pdjjv.exe 4684 frrlffx.exe 2344 3tbtnn.exe 5112 1pdvd.exe 3432 lxlfxxr.exe 348 hnbbtt.exe 224 dvvvp.exe 2488 7xxxxxr.exe 3232 nnbtnt.exe 4992 9jdvv.exe 3404 lxxxrrr.exe 2008 hhtnhh.exe 4132 pjvpp.exe 3680 lrxrflx.exe 1516 1nnnhb.exe 2576 7ddvp.exe 3736 fxxrllx.exe 3456 pppjd.exe 4508 rxfrlxr.exe 1440 1hnhbb.exe 1908 pdjdv.exe 1060 xlrlfxl.exe 2444 bbnhnn.exe 1912 pvjdp.exe 3856 rlxllxf.exe 5056 dddvp.exe -
resource yara_rule behavioral2/memory/1004-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1136-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4684-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2156-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2848-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1076-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1068-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5076-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3112-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2232-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3736-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4804-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3100-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4316-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/452-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2532-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4848-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1652-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3964-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5096-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3080-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4236-199-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1004 wrote to memory of 1136 1004 43f516efa3adfe881d783fd76c0db8c0_NeikiAnalytics.exe 82 PID 1004 wrote to memory of 1136 1004 43f516efa3adfe881d783fd76c0db8c0_NeikiAnalytics.exe 82 PID 1004 wrote to memory of 1136 1004 43f516efa3adfe881d783fd76c0db8c0_NeikiAnalytics.exe 82 PID 1136 wrote to memory of 4684 1136 jjvpj.exe 83 PID 1136 wrote to memory of 4684 1136 jjvpj.exe 83 PID 1136 wrote to memory of 4684 1136 jjvpj.exe 83 PID 4684 wrote to memory of 2156 4684 rfrfrlf.exe 85 PID 4684 wrote to memory of 2156 4684 rfrfrlf.exe 85 PID 4684 wrote to memory of 2156 4684 rfrfrlf.exe 85 PID 2156 wrote to memory of 3520 2156 pjjdd.exe 86 PID 2156 wrote to memory of 3520 2156 pjjdd.exe 86 PID 2156 wrote to memory of 3520 2156 pjjdd.exe 86 PID 3520 wrote to memory of 2848 3520 ntntnn.exe 87 PID 3520 wrote to memory of 2848 3520 ntntnn.exe 87 PID 3520 wrote to memory of 2848 3520 ntntnn.exe 87 PID 2848 wrote to memory of 3192 2848 lllfrlx.exe 89 PID 2848 wrote to memory of 3192 2848 lllfrlx.exe 89 PID 2848 wrote to memory of 3192 2848 lllfrlx.exe 89 PID 3192 wrote to memory of 1076 3192 lrxflxx.exe 90 PID 3192 wrote to memory of 1076 3192 lrxflxx.exe 90 PID 3192 wrote to memory of 1076 3192 lrxflxx.exe 90 PID 1076 wrote to memory of 4992 1076 5rllrlr.exe 92 PID 1076 wrote to memory of 4992 1076 5rllrlr.exe 92 PID 1076 wrote to memory of 4992 1076 5rllrlr.exe 92 PID 4992 wrote to memory of 1068 4992 pdpjj.exe 93 PID 4992 wrote to memory of 1068 4992 pdpjj.exe 93 PID 4992 wrote to memory of 1068 4992 pdpjj.exe 93 PID 1068 wrote to memory of 5076 1068 fffrfrf.exe 94 PID 1068 wrote to memory of 5076 1068 fffrfrf.exe 94 PID 1068 wrote to memory of 5076 1068 fffrfrf.exe 94 PID 5076 wrote to memory of 3112 5076 llrrlrl.exe 95 PID 5076 wrote to memory of 3112 5076 llrrlrl.exe 95 PID 5076 wrote to memory of 3112 5076 llrrlrl.exe 95 PID 3112 wrote to memory of 2232 3112 dddvv.exe 96 PID 3112 wrote to memory of 2232 3112 dddvv.exe 96 PID 3112 wrote to memory of 2232 3112 dddvv.exe 96 PID 2232 wrote to memory of 3736 2232 hthhbb.exe 97 PID 2232 wrote to memory of 3736 2232 hthhbb.exe 97 PID 2232 wrote to memory of 3736 2232 hthhbb.exe 97 PID 3736 wrote to memory of 4804 3736 hhbtnb.exe 98 PID 3736 wrote to memory of 4804 3736 hhbtnb.exe 98 PID 3736 wrote to memory of 4804 3736 hhbtnb.exe 98 PID 4804 wrote to memory of 5020 4804 pdjjd.exe 99 PID 4804 wrote to memory of 5020 4804 pdjjd.exe 99 PID 4804 wrote to memory of 5020 4804 pdjjd.exe 99 PID 5020 wrote to memory of 3100 5020 nhtnnn.exe 100 PID 5020 wrote to memory of 3100 5020 nhtnnn.exe 100 PID 5020 wrote to memory of 3100 5020 nhtnnn.exe 100 PID 3100 wrote to memory of 1888 3100 fxrlfff.exe 101 PID 3100 wrote to memory of 1888 3100 fxrlfff.exe 101 PID 3100 wrote to memory of 1888 3100 fxrlfff.exe 101 PID 1888 wrote to memory of 4316 1888 xrlrlrf.exe 102 PID 1888 wrote to memory of 4316 1888 xrlrlrf.exe 102 PID 1888 wrote to memory of 4316 1888 xrlrlrf.exe 102 PID 4316 wrote to memory of 452 4316 hntnhh.exe 103 PID 4316 wrote to memory of 452 4316 hntnhh.exe 103 PID 4316 wrote to memory of 452 4316 hntnhh.exe 103 PID 452 wrote to memory of 2532 452 vjvpj.exe 104 PID 452 wrote to memory of 2532 452 vjvpj.exe 104 PID 452 wrote to memory of 2532 452 vjvpj.exe 104 PID 2532 wrote to memory of 4848 2532 lrxrxxr.exe 105 PID 2532 wrote to memory of 4848 2532 lrxrxxr.exe 105 PID 2532 wrote to memory of 4848 2532 lrxrxxr.exe 105 PID 4848 wrote to memory of 1652 4848 flrfxlx.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\43f516efa3adfe881d783fd76c0db8c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\43f516efa3adfe881d783fd76c0db8c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\jjvpj.exec:\jjvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\rfrfrlf.exec:\rfrfrlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\pjjdd.exec:\pjjdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\ntntnn.exec:\ntntnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\lllfrlx.exec:\lllfrlx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\lrxflxx.exec:\lrxflxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\5rllrlr.exec:\5rllrlr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\pdpjj.exec:\pdpjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\fffrfrf.exec:\fffrfrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\llrrlrl.exec:\llrrlrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\dddvv.exec:\dddvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\hthhbb.exec:\hthhbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\hhbtnb.exec:\hhbtnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
\??\c:\pdjjd.exec:\pdjjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\nhtnnn.exec:\nhtnnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\fxrlfff.exec:\fxrlfff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\xrlrlrf.exec:\xrlrlrf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\hntnhh.exec:\hntnhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\vjvpj.exec:\vjvpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\lrxrxxr.exec:\lrxrxxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\flrfxlx.exec:\flrfxlx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\xxrlxfx.exec:\xxrlxfx.exe23⤵
- Executes dropped EXE
PID:1652 -
\??\c:\7bthnh.exec:\7bthnh.exe24⤵
- Executes dropped EXE
PID:3964 -
\??\c:\tnhbnh.exec:\tnhbnh.exe25⤵
- Executes dropped EXE
PID:5096 -
\??\c:\rfffrrx.exec:\rfffrrx.exe26⤵
- Executes dropped EXE
PID:1196 -
\??\c:\pdjjp.exec:\pdjjp.exe27⤵
- Executes dropped EXE
PID:3080 -
\??\c:\vpvdp.exec:\vpvdp.exe28⤵
- Executes dropped EXE
PID:2040 -
\??\c:\bntnbt.exec:\bntnbt.exe29⤵
- Executes dropped EXE
PID:5036 -
\??\c:\dvvjv.exec:\dvvjv.exe30⤵
- Executes dropped EXE
PID:5044 -
\??\c:\tnnhtt.exec:\tnnhtt.exe31⤵
- Executes dropped EXE
PID:4236 -
\??\c:\dvjdv.exec:\dvjdv.exe32⤵
- Executes dropped EXE
PID:2380 -
\??\c:\rxllffx.exec:\rxllffx.exe33⤵
- Executes dropped EXE
PID:3064 -
\??\c:\nthbtt.exec:\nthbtt.exe34⤵
- Executes dropped EXE
PID:3728 -
\??\c:\vdpjj.exec:\vdpjj.exe35⤵
- Executes dropped EXE
PID:632 -
\??\c:\rxrfxxr.exec:\rxrfxxr.exe36⤵
- Executes dropped EXE
PID:4312 -
\??\c:\dppdv.exec:\dppdv.exe37⤵
- Executes dropped EXE
PID:4364 -
\??\c:\rllxlfl.exec:\rllxlfl.exe38⤵
- Executes dropped EXE
PID:4880 -
\??\c:\hnnbbb.exec:\hnnbbb.exe39⤵
- Executes dropped EXE
PID:3252 -
\??\c:\pdjjv.exec:\pdjjv.exe40⤵
- Executes dropped EXE
PID:4888 -
\??\c:\frrlffx.exec:\frrlffx.exe41⤵
- Executes dropped EXE
PID:4684 -
\??\c:\3tbtnn.exec:\3tbtnn.exe42⤵
- Executes dropped EXE
PID:2344 -
\??\c:\1pdvd.exec:\1pdvd.exe43⤵
- Executes dropped EXE
PID:5112 -
\??\c:\lxlfxxr.exec:\lxlfxxr.exe44⤵
- Executes dropped EXE
PID:3432 -
\??\c:\hnbbtt.exec:\hnbbtt.exe45⤵
- Executes dropped EXE
PID:348 -
\??\c:\dvvvp.exec:\dvvvp.exe46⤵
- Executes dropped EXE
PID:224 -
\??\c:\7xxxxxr.exec:\7xxxxxr.exe47⤵
- Executes dropped EXE
PID:2488 -
\??\c:\nnbtnt.exec:\nnbtnt.exe48⤵
- Executes dropped EXE
PID:3232 -
\??\c:\9jdvv.exec:\9jdvv.exe49⤵
- Executes dropped EXE
PID:4992 -
\??\c:\lxxxrrr.exec:\lxxxrrr.exe50⤵
- Executes dropped EXE
PID:3404 -
\??\c:\hhtnhh.exec:\hhtnhh.exe51⤵
- Executes dropped EXE
PID:2008 -
\??\c:\pjvpp.exec:\pjvpp.exe52⤵
- Executes dropped EXE
PID:4132 -
\??\c:\lrxrflx.exec:\lrxrflx.exe53⤵
- Executes dropped EXE
PID:3680 -
\??\c:\1nnnhb.exec:\1nnnhb.exe54⤵
- Executes dropped EXE
PID:1516 -
\??\c:\7ddvp.exec:\7ddvp.exe55⤵
- Executes dropped EXE
PID:2576 -
\??\c:\fxxrllx.exec:\fxxrllx.exe56⤵
- Executes dropped EXE
PID:3736 -
\??\c:\pppjd.exec:\pppjd.exe57⤵
- Executes dropped EXE
PID:3456 -
\??\c:\rxfrlxr.exec:\rxfrlxr.exe58⤵
- Executes dropped EXE
PID:4508 -
\??\c:\1hnhbb.exec:\1hnhbb.exe59⤵
- Executes dropped EXE
PID:1440 -
\??\c:\pdjdv.exec:\pdjdv.exe60⤵
- Executes dropped EXE
PID:1908 -
\??\c:\xlrlfxl.exec:\xlrlfxl.exe61⤵
- Executes dropped EXE
PID:1060 -
\??\c:\bbnhnn.exec:\bbnhnn.exe62⤵
- Executes dropped EXE
PID:2444 -
\??\c:\pvjdp.exec:\pvjdp.exe63⤵
- Executes dropped EXE
PID:1912 -
\??\c:\rlxllxf.exec:\rlxllxf.exe64⤵
- Executes dropped EXE
PID:3856 -
\??\c:\dddvp.exec:\dddvp.exe65⤵
- Executes dropped EXE
PID:5056 -
\??\c:\rffxlfx.exec:\rffxlfx.exe66⤵PID:2532
-
\??\c:\hbbntn.exec:\hbbntn.exe67⤵PID:3732
-
\??\c:\3pjdv.exec:\3pjdv.exe68⤵PID:1924
-
\??\c:\hbbbtt.exec:\hbbbtt.exe69⤵PID:1244
-
\??\c:\9jdpd.exec:\9jdpd.exe70⤵PID:4960
-
\??\c:\rlxlrll.exec:\rlxlrll.exe71⤵PID:4896
-
\??\c:\thhbtt.exec:\thhbtt.exe72⤵PID:4692
-
\??\c:\djjjv.exec:\djjjv.exe73⤵PID:2792
-
\??\c:\lxxfffx.exec:\lxxfffx.exe74⤵PID:1836
-
\??\c:\hnttnb.exec:\hnttnb.exe75⤵PID:4336
-
\??\c:\dvvjd.exec:\dvvjd.exe76⤵PID:844
-
\??\c:\nhnnhn.exec:\nhnnhn.exe77⤵PID:4816
-
\??\c:\dppdv.exec:\dppdv.exe78⤵PID:1348
-
\??\c:\7lrlffx.exec:\7lrlffx.exe79⤵PID:4136
-
\??\c:\dvvjv.exec:\dvvjv.exe80⤵PID:1588
-
\??\c:\flfxffr.exec:\flfxffr.exe81⤵PID:5052
-
\??\c:\bnnhbb.exec:\bnnhbb.exe82⤵PID:1216
-
\??\c:\dvvvp.exec:\dvvvp.exe83⤵PID:1140
-
\??\c:\fxrlffl.exec:\fxrlffl.exe84⤵PID:1004
-
\??\c:\pddvj.exec:\pddvj.exe85⤵PID:4876
-
\??\c:\xffxlfx.exec:\xffxlfx.exe86⤵PID:4120
-
\??\c:\bnbttn.exec:\bnbttn.exe87⤵PID:4536
-
\??\c:\vpvpj.exec:\vpvpj.exe88⤵PID:4880
-
\??\c:\1xfxxxx.exec:\1xfxxxx.exe89⤵PID:944
-
\??\c:\5hnbbb.exec:\5hnbbb.exe90⤵PID:388
-
\??\c:\dddvv.exec:\dddvv.exe91⤵PID:4684
-
\??\c:\1lffxxr.exec:\1lffxxr.exe92⤵PID:3196
-
\??\c:\3vpdv.exec:\3vpdv.exe93⤵PID:4456
-
\??\c:\xrfxrrl.exec:\xrfxrrl.exe94⤵PID:884
-
\??\c:\nnnnhh.exec:\nnnnhh.exe95⤵PID:732
-
\??\c:\vdjjd.exec:\vdjjd.exe96⤵PID:3492
-
\??\c:\fllxrfl.exec:\fllxrfl.exe97⤵PID:1396
-
\??\c:\tttnhh.exec:\tttnhh.exe98⤵PID:1952
-
\??\c:\pjjdv.exec:\pjjdv.exe99⤵PID:4192
-
\??\c:\xllffxr.exec:\xllffxr.exe100⤵PID:2544
-
\??\c:\thbbtt.exec:\thbbtt.exe101⤵PID:3648
-
\??\c:\vjjjd.exec:\vjjjd.exe102⤵PID:3972
-
\??\c:\rrlfxrf.exec:\rrlfxrf.exe103⤵PID:1352
-
\??\c:\ntthtn.exec:\ntthtn.exe104⤵PID:4188
-
\??\c:\rxxfxxr.exec:\rxxfxxr.exe105⤵PID:3684
-
\??\c:\nbbthb.exec:\nbbthb.exe106⤵PID:492
-
\??\c:\dvpjj.exec:\dvpjj.exe107⤵PID:3692
-
\??\c:\ffrlrrx.exec:\ffrlrrx.exe108⤵PID:3644
-
\??\c:\1ntnhh.exec:\1ntnhh.exe109⤵PID:4568
-
\??\c:\ppddv.exec:\ppddv.exe110⤵PID:3924
-
\??\c:\frrlfxr.exec:\frrlfxr.exe111⤵PID:4772
-
\??\c:\bbnhht.exec:\bbnhht.exe112⤵PID:4840
-
\??\c:\xxxrlxr.exec:\xxxrlxr.exe113⤵PID:4496
-
\??\c:\7fxrffr.exec:\7fxrffr.exe114⤵PID:452
-
\??\c:\7bbnbt.exec:\7bbnbt.exe115⤵PID:1156
-
\??\c:\pvjdj.exec:\pvjdj.exe116⤵PID:4372
-
\??\c:\tnhbtn.exec:\tnhbtn.exe117⤵PID:3140
-
\??\c:\hbbtnh.exec:\hbbtnh.exe118⤵PID:2268
-
\??\c:\7djdv.exec:\7djdv.exe119⤵PID:1404
-
\??\c:\xflfrrf.exec:\xflfrrf.exe120⤵PID:2760
-
\??\c:\ntbtnh.exec:\ntbtnh.exe121⤵PID:4452
-
\??\c:\7djvp.exec:\7djvp.exe122⤵PID:2824
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-