Analysis
-
max time kernel
150s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 19:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2f52f1e2b796c2bae7dfe34789d23aa0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
2f52f1e2b796c2bae7dfe34789d23aa0_NeikiAnalytics.exe
-
Size
90KB
-
MD5
2f52f1e2b796c2bae7dfe34789d23aa0
-
SHA1
653bd51311812ba17c1033facc02e97c121e35fd
-
SHA256
f3692658f708f809fc12f0b79a0ed23b69a254417f3dbfc70e273966848567d4
-
SHA512
61a4a75edb257bb8d7739173584d5b9b9baae1d04222431beb62bd43088689931520dab361620d891bae4938a61d6e192496a246cbd6d2e038eef58204fa7b5d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDodtzac0Hobv0byLufTJfJVM:ymb3NkkiQ3mdBjFodt27HobvcyLufNfo
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/2876-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2876-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1420-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3608-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3856-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3512-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1148-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1412-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1612-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5040-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5228-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4948-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2332-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5432-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5260-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4460-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3492-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5184-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5648-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/632-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/6128-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2296-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/824-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3512 nhnhbh.exe 3856 djddp.exe 3608 5vvvv.exe 1420 rrxrrrx.exe 1148 btbbbh.exe 1412 hthbbb.exe 1612 vvvpj.exe 5040 frllllf.exe 2912 nbnhhh.exe 5228 9ddvv.exe 4948 pvpjd.exe 448 rlllllf.exe 2332 xrxrxxf.exe 5432 3btbtn.exe 5260 1dppv.exe 4460 rffffrf.exe 3656 xrlflfr.exe 2012 5hnnnn.exe 3492 pvjdv.exe 5184 xxlrrxx.exe 5584 tntnhb.exe 5404 thnhbb.exe 5648 pvpjd.exe 632 3vppd.exe 6128 lrrlxlr.exe 3540 9bhbbt.exe 2296 tnnhbh.exe 5308 ppvdp.exe 1880 5xlfxrl.exe 824 llrxfrr.exe 948 nnbbtn.exe 3140 jdvpd.exe 5384 5fxrlxx.exe 2572 xlffxxr.exe 2668 nbtbtt.exe 2028 hhthnn.exe 1300 rlflfff.exe 4536 xxrrlll.exe 1996 ntttnn.exe 5080 httttb.exe 3524 9dpjj.exe 4936 vdddp.exe 4796 xlflllr.exe 4124 bthtnt.exe 5600 djjdd.exe 5484 jdpjd.exe 5268 lrrrrrf.exe 5532 fxrllff.exe 5632 nbhthb.exe 4472 nhhbtt.exe 4084 pjvjd.exe 3476 9vpdd.exe 2448 7lrlrrx.exe 2396 xllfllr.exe 2888 htbttt.exe 5656 nbbbtt.exe 872 jvjdp.exe 5664 dvvpp.exe 656 ffxrllf.exe 1000 bbnbhn.exe 1492 nnnbtn.exe 796 jdjjd.exe 2156 dpppj.exe 2040 xrxxlxf.exe -
resource yara_rule behavioral2/memory/2876-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1420-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3608-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3856-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3512-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1148-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1412-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1612-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5040-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5228-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4948-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2332-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5432-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5260-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4460-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3492-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5184-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5648-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/632-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/6128-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2296-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/824-196-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2876 wrote to memory of 3512 2876 2f52f1e2b796c2bae7dfe34789d23aa0_NeikiAnalytics.exe 83 PID 2876 wrote to memory of 3512 2876 2f52f1e2b796c2bae7dfe34789d23aa0_NeikiAnalytics.exe 83 PID 2876 wrote to memory of 3512 2876 2f52f1e2b796c2bae7dfe34789d23aa0_NeikiAnalytics.exe 83 PID 3512 wrote to memory of 3856 3512 nhnhbh.exe 84 PID 3512 wrote to memory of 3856 3512 nhnhbh.exe 84 PID 3512 wrote to memory of 3856 3512 nhnhbh.exe 84 PID 3856 wrote to memory of 3608 3856 djddp.exe 85 PID 3856 wrote to memory of 3608 3856 djddp.exe 85 PID 3856 wrote to memory of 3608 3856 djddp.exe 85 PID 3608 wrote to memory of 1420 3608 5vvvv.exe 86 PID 3608 wrote to memory of 1420 3608 5vvvv.exe 86 PID 3608 wrote to memory of 1420 3608 5vvvv.exe 86 PID 1420 wrote to memory of 1148 1420 rrxrrrx.exe 87 PID 1420 wrote to memory of 1148 1420 rrxrrrx.exe 87 PID 1420 wrote to memory of 1148 1420 rrxrrrx.exe 87 PID 1148 wrote to memory of 1412 1148 btbbbh.exe 88 PID 1148 wrote to memory of 1412 1148 btbbbh.exe 88 PID 1148 wrote to memory of 1412 1148 btbbbh.exe 88 PID 1412 wrote to memory of 1612 1412 hthbbb.exe 89 PID 1412 wrote to memory of 1612 1412 hthbbb.exe 89 PID 1412 wrote to memory of 1612 1412 hthbbb.exe 89 PID 1612 wrote to memory of 5040 1612 vvvpj.exe 90 PID 1612 wrote to memory of 5040 1612 vvvpj.exe 90 PID 1612 wrote to memory of 5040 1612 vvvpj.exe 90 PID 5040 wrote to memory of 2912 5040 frllllf.exe 91 PID 5040 wrote to memory of 2912 5040 frllllf.exe 91 PID 5040 wrote to memory of 2912 5040 frllllf.exe 91 PID 2912 wrote to memory of 5228 2912 nbnhhh.exe 92 PID 2912 wrote to memory of 5228 2912 nbnhhh.exe 92 PID 2912 wrote to memory of 5228 2912 nbnhhh.exe 92 PID 5228 wrote to memory of 4948 5228 9ddvv.exe 93 PID 5228 wrote to memory of 4948 5228 9ddvv.exe 93 PID 5228 wrote to memory of 4948 5228 9ddvv.exe 93 PID 4948 wrote to memory of 448 4948 pvpjd.exe 94 PID 4948 wrote to memory of 448 4948 pvpjd.exe 94 PID 4948 wrote to memory of 448 4948 pvpjd.exe 94 PID 448 wrote to memory of 2332 448 rlllllf.exe 95 PID 448 wrote to memory of 2332 448 rlllllf.exe 95 PID 448 wrote to memory of 2332 448 rlllllf.exe 95 PID 2332 wrote to memory of 5432 2332 xrxrxxf.exe 96 PID 2332 wrote to memory of 5432 2332 xrxrxxf.exe 96 PID 2332 wrote to memory of 5432 2332 xrxrxxf.exe 96 PID 5432 wrote to memory of 5260 5432 3btbtn.exe 97 PID 5432 wrote to memory of 5260 5432 3btbtn.exe 97 PID 5432 wrote to memory of 5260 5432 3btbtn.exe 97 PID 5260 wrote to memory of 4460 5260 1dppv.exe 98 PID 5260 wrote to memory of 4460 5260 1dppv.exe 98 PID 5260 wrote to memory of 4460 5260 1dppv.exe 98 PID 4460 wrote to memory of 3656 4460 rffffrf.exe 99 PID 4460 wrote to memory of 3656 4460 rffffrf.exe 99 PID 4460 wrote to memory of 3656 4460 rffffrf.exe 99 PID 3656 wrote to memory of 2012 3656 xrlflfr.exe 100 PID 3656 wrote to memory of 2012 3656 xrlflfr.exe 100 PID 3656 wrote to memory of 2012 3656 xrlflfr.exe 100 PID 2012 wrote to memory of 3492 2012 5hnnnn.exe 101 PID 2012 wrote to memory of 3492 2012 5hnnnn.exe 101 PID 2012 wrote to memory of 3492 2012 5hnnnn.exe 101 PID 3492 wrote to memory of 5184 3492 pvjdv.exe 102 PID 3492 wrote to memory of 5184 3492 pvjdv.exe 102 PID 3492 wrote to memory of 5184 3492 pvjdv.exe 102 PID 5184 wrote to memory of 5584 5184 xxlrrxx.exe 103 PID 5184 wrote to memory of 5584 5184 xxlrrxx.exe 103 PID 5184 wrote to memory of 5584 5184 xxlrrxx.exe 103 PID 5584 wrote to memory of 5404 5584 tntnhb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f52f1e2b796c2bae7dfe34789d23aa0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2f52f1e2b796c2bae7dfe34789d23aa0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\nhnhbh.exec:\nhnhbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\djddp.exec:\djddp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
\??\c:\5vvvv.exec:\5vvvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\rrxrrrx.exec:\rrxrrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\btbbbh.exec:\btbbbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\hthbbb.exec:\hthbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\vvvpj.exec:\vvvpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\frllllf.exec:\frllllf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\nbnhhh.exec:\nbnhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\9ddvv.exec:\9ddvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5228 -
\??\c:\pvpjd.exec:\pvpjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\rlllllf.exec:\rlllllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\xrxrxxf.exec:\xrxrxxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\3btbtn.exec:\3btbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5432 -
\??\c:\1dppv.exec:\1dppv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5260 -
\??\c:\rffffrf.exec:\rffffrf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\xrlflfr.exec:\xrlflfr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\5hnnnn.exec:\5hnnnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\pvjdv.exec:\pvjdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\xxlrrxx.exec:\xxlrrxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5184 -
\??\c:\tntnhb.exec:\tntnhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5584 -
\??\c:\thnhbb.exec:\thnhbb.exe23⤵
- Executes dropped EXE
PID:5404 -
\??\c:\pvpjd.exec:\pvpjd.exe24⤵
- Executes dropped EXE
PID:5648 -
\??\c:\3vppd.exec:\3vppd.exe25⤵
- Executes dropped EXE
PID:632 -
\??\c:\lrrlxlr.exec:\lrrlxlr.exe26⤵
- Executes dropped EXE
PID:6128 -
\??\c:\9bhbbt.exec:\9bhbbt.exe27⤵
- Executes dropped EXE
PID:3540 -
\??\c:\tnnhbh.exec:\tnnhbh.exe28⤵
- Executes dropped EXE
PID:2296 -
\??\c:\ppvdp.exec:\ppvdp.exe29⤵
- Executes dropped EXE
PID:5308 -
\??\c:\5xlfxrl.exec:\5xlfxrl.exe30⤵
- Executes dropped EXE
PID:1880 -
\??\c:\llrxfrr.exec:\llrxfrr.exe31⤵
- Executes dropped EXE
PID:824 -
\??\c:\nnbbtn.exec:\nnbbtn.exe32⤵
- Executes dropped EXE
PID:948 -
\??\c:\jdvpd.exec:\jdvpd.exe33⤵
- Executes dropped EXE
PID:3140 -
\??\c:\5fxrlxx.exec:\5fxrlxx.exe34⤵
- Executes dropped EXE
PID:5384 -
\??\c:\xlffxxr.exec:\xlffxxr.exe35⤵
- Executes dropped EXE
PID:2572 -
\??\c:\nbtbtt.exec:\nbtbtt.exe36⤵
- Executes dropped EXE
PID:2668 -
\??\c:\hhthnn.exec:\hhthnn.exe37⤵
- Executes dropped EXE
PID:2028 -
\??\c:\rlflfff.exec:\rlflfff.exe38⤵
- Executes dropped EXE
PID:1300 -
\??\c:\xxrrlll.exec:\xxrrlll.exe39⤵
- Executes dropped EXE
PID:4536 -
\??\c:\ntttnn.exec:\ntttnn.exe40⤵
- Executes dropped EXE
PID:1996 -
\??\c:\httttb.exec:\httttb.exe41⤵
- Executes dropped EXE
PID:5080 -
\??\c:\9dpjj.exec:\9dpjj.exe42⤵
- Executes dropped EXE
PID:3524 -
\??\c:\vdddp.exec:\vdddp.exe43⤵
- Executes dropped EXE
PID:4936 -
\??\c:\xlflllr.exec:\xlflllr.exe44⤵
- Executes dropped EXE
PID:4796 -
\??\c:\bthtnt.exec:\bthtnt.exe45⤵
- Executes dropped EXE
PID:4124 -
\??\c:\djjdd.exec:\djjdd.exe46⤵
- Executes dropped EXE
PID:5600 -
\??\c:\jdpjd.exec:\jdpjd.exe47⤵
- Executes dropped EXE
PID:5484 -
\??\c:\lrrrrrf.exec:\lrrrrrf.exe48⤵
- Executes dropped EXE
PID:5268 -
\??\c:\fxrllff.exec:\fxrllff.exe49⤵
- Executes dropped EXE
PID:5532 -
\??\c:\nbhthb.exec:\nbhthb.exe50⤵
- Executes dropped EXE
PID:5632 -
\??\c:\nhhbtt.exec:\nhhbtt.exe51⤵
- Executes dropped EXE
PID:4472 -
\??\c:\pjvjd.exec:\pjvjd.exe52⤵
- Executes dropped EXE
PID:4084 -
\??\c:\9vpdd.exec:\9vpdd.exe53⤵
- Executes dropped EXE
PID:3476 -
\??\c:\7lrlrrx.exec:\7lrlrrx.exe54⤵
- Executes dropped EXE
PID:2448 -
\??\c:\xllfllr.exec:\xllfllr.exe55⤵
- Executes dropped EXE
PID:2396 -
\??\c:\htbttt.exec:\htbttt.exe56⤵
- Executes dropped EXE
PID:2888 -
\??\c:\nbbbtt.exec:\nbbbtt.exe57⤵
- Executes dropped EXE
PID:5656 -
\??\c:\jvjdp.exec:\jvjdp.exe58⤵
- Executes dropped EXE
PID:872 -
\??\c:\dvvpp.exec:\dvvpp.exe59⤵
- Executes dropped EXE
PID:5664 -
\??\c:\ffxrllf.exec:\ffxrllf.exe60⤵
- Executes dropped EXE
PID:656 -
\??\c:\bbnbhn.exec:\bbnbhn.exe61⤵
- Executes dropped EXE
PID:1000 -
\??\c:\nnnbtn.exec:\nnnbtn.exe62⤵
- Executes dropped EXE
PID:1492 -
\??\c:\jdjjd.exec:\jdjjd.exe63⤵
- Executes dropped EXE
PID:796 -
\??\c:\dpppj.exec:\dpppj.exe64⤵
- Executes dropped EXE
PID:2156 -
\??\c:\xrxxlxf.exec:\xrxxlxf.exe65⤵
- Executes dropped EXE
PID:2040 -
\??\c:\hnttnn.exec:\hnttnn.exe66⤵PID:4144
-
\??\c:\bbbtnh.exec:\bbbtnh.exe67⤵PID:820
-
\??\c:\vdvvd.exec:\vdvvd.exe68⤵PID:2804
-
\??\c:\dpvpp.exec:\dpvpp.exe69⤵PID:3092
-
\??\c:\vvvjd.exec:\vvvjd.exe70⤵PID:4364
-
\??\c:\fllflrx.exec:\fllflrx.exe71⤵PID:2500
-
\??\c:\xfrrrll.exec:\xfrrrll.exe72⤵PID:4064
-
\??\c:\nhttnn.exec:\nhttnn.exe73⤵PID:3148
-
\??\c:\nntnnb.exec:\nntnnb.exe74⤵PID:2832
-
\??\c:\jpjdd.exec:\jpjdd.exe75⤵PID:2440
-
\??\c:\3ddvj.exec:\3ddvj.exe76⤵PID:3788
-
\??\c:\rlllfll.exec:\rlllfll.exe77⤵PID:5708
-
\??\c:\7llfxxr.exec:\7llfxxr.exe78⤵PID:5408
-
\??\c:\bhnhhb.exec:\bhnhhb.exe79⤵PID:1612
-
\??\c:\tbnbbt.exec:\tbnbbt.exe80⤵PID:5124
-
\??\c:\bnhbht.exec:\bnhbht.exe81⤵PID:4780
-
\??\c:\dppdv.exec:\dppdv.exe82⤵PID:5788
-
\??\c:\3jdpv.exec:\3jdpv.exe83⤵PID:4112
-
\??\c:\xfflxlf.exec:\xfflxlf.exe84⤵PID:2032
-
\??\c:\3xxxrxr.exec:\3xxxrxr.exe85⤵PID:2320
-
\??\c:\1bnnnn.exec:\1bnnnn.exe86⤵PID:4248
-
\??\c:\1htttt.exec:\1htttt.exe87⤵PID:2592
-
\??\c:\5htnhh.exec:\5htnhh.exe88⤵PID:556
-
\??\c:\jjjdp.exec:\jjjdp.exe89⤵PID:3732
-
\??\c:\pppjv.exec:\pppjv.exe90⤵PID:432
-
\??\c:\rffxllf.exec:\rffxllf.exe91⤵PID:3996
-
\??\c:\rrlfxxr.exec:\rrlfxxr.exe92⤵PID:4092
-
\??\c:\nhhbnh.exec:\nhhbnh.exe93⤵PID:2012
-
\??\c:\7dvpj.exec:\7dvpj.exe94⤵PID:1576
-
\??\c:\vppjd.exec:\vppjd.exe95⤵PID:4896
-
\??\c:\jdddj.exec:\jdddj.exe96⤵PID:2760
-
\??\c:\xlrrxrr.exec:\xlrrxrr.exe97⤵PID:5648
-
\??\c:\fxxxfxx.exec:\fxxxfxx.exe98⤵PID:5324
-
\??\c:\5frllll.exec:\5frllll.exe99⤵PID:4724
-
\??\c:\bhbbtt.exec:\bhbbtt.exe100⤵PID:4184
-
\??\c:\bbttnn.exec:\bbttnn.exe101⤵PID:5332
-
\??\c:\pvvvp.exec:\pvvvp.exe102⤵PID:1208
-
\??\c:\3dpdv.exec:\3dpdv.exe103⤵PID:1636
-
\??\c:\frrrxrr.exec:\frrrxrr.exe104⤵PID:4976
-
\??\c:\xlrrxxx.exec:\xlrrxxx.exe105⤵PID:1484
-
\??\c:\3rxrrlf.exec:\3rxrrlf.exe106⤵PID:1476
-
\??\c:\3thhbb.exec:\3thhbb.exe107⤵PID:1580
-
\??\c:\bbnhtn.exec:\bbnhtn.exe108⤵PID:452
-
\??\c:\vppdp.exec:\vppdp.exe109⤵PID:1648
-
\??\c:\vjjdd.exec:\vjjdd.exe110⤵PID:2572
-
\??\c:\3lrlrlf.exec:\3lrlrlf.exe111⤵PID:2668
-
\??\c:\fllfxxr.exec:\fllfxxr.exe112⤵PID:6088
-
\??\c:\bhbbbt.exec:\bhbbbt.exe113⤵PID:1300
-
\??\c:\nhhhtt.exec:\nhhhtt.exe114⤵PID:4544
-
\??\c:\7pvvd.exec:\7pvvd.exe115⤵PID:4088
-
\??\c:\dddjv.exec:\dddjv.exe116⤵PID:3720
-
\??\c:\vdjdv.exec:\vdjdv.exe117⤵PID:3688
-
\??\c:\lxrlfxx.exec:\lxrlfxx.exe118⤵PID:1520
-
\??\c:\nbtnnh.exec:\nbtnnh.exe119⤵PID:3980
-
\??\c:\httnnh.exec:\httnnh.exe120⤵PID:4336
-
\??\c:\7btthh.exec:\7btthh.exe121⤵PID:3012
-
\??\c:\jjddj.exec:\jjddj.exe122⤵PID:5336
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-