Analysis
-
max time kernel
143s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
14-05-2024 21:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
29557fc4e2a787e47b1b273b6c1e6cd0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
29557fc4e2a787e47b1b273b6c1e6cd0_NeikiAnalytics.exe
-
Size
75KB
-
MD5
29557fc4e2a787e47b1b273b6c1e6cd0
-
SHA1
a31348ffac3f127ad62bb8e3727a974c208297d8
-
SHA256
9019160c4635e3bfa014dc6c28d633ad02bd60db21ffa275e5c17a5123a2b625
-
SHA512
1a5fcc8219745646e264e038fc9280767da40d7195dbce988542479d3afa46f152423ff6043fe05b20d5baa76693b9133e12cf1bb0588c4d6a494b269082bc8c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5rINQ:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCuS
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/3540-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2724-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1020-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2600-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4832-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4580-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1752-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1752-56-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4368-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2908-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3992-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4144-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3728-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3880-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3920-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/728-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/516-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1704-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2212-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3900-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3468-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4640-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2596-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3700-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/752-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3540 vvdvv.exe 1020 lfrlfrf.exe 2600 rxfrlxx.exe 4832 bthhtb.exe 4580 jpvjd.exe 4020 rrrlfrr.exe 1752 9ffxrfx.exe 4368 hhhhbt.exe 3560 nbbnnn.exe 4256 1vvpj.exe 2908 lflrllr.exe 3992 nntntn.exe 1364 bbhthb.exe 4144 jpvvp.exe 2852 rlrxrrr.exe 3728 thbnhn.exe 3880 jdvvv.exe 3920 9vvpv.exe 728 1frrffr.exe 516 nhttbh.exe 3124 5bhbtn.exe 1704 jppjd.exe 752 jjjjp.exe 3700 fxrflxr.exe 2596 tnbnhn.exe 4508 bnnhtt.exe 4640 jpvvp.exe 3468 fxlxrlf.exe 2212 rrlxflf.exe 4808 bthbtt.exe 3900 9htnhb.exe 4356 ppjjp.exe 4028 5vpvj.exe 4484 xflrfxx.exe 4172 5bhbth.exe 3840 jjpjj.exe 3960 ddpvj.exe 3308 xflxrlf.exe 740 rlrlrrx.exe 4588 nbnbbb.exe 3432 btbbhh.exe 4888 vppdp.exe 3528 lxlxrlf.exe 3680 rfrfffr.exe 2760 hbbtnb.exe 4880 pvvdv.exe 4392 3rxlrrl.exe 3812 ntnbbb.exe 3584 bnnhnh.exe 1556 9djdd.exe 4360 1pddv.exe 1420 xrlxlll.exe 2864 tnbtbb.exe 3476 tbhbbn.exe 2888 jvvvj.exe 1580 vppjv.exe 2784 lxllffx.exe 1824 rffrlfx.exe 3920 nbnbtt.exe 2340 hbbbbb.exe 2816 dpdvv.exe 3124 9frlfxf.exe 2896 rlrlllf.exe 1960 lrffxxr.exe -
resource yara_rule behavioral2/memory/3540-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2724-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1020-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2600-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4832-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2908-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3992-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4144-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3728-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3880-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/728-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2212-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3900-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2596-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3700-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/752-153-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2724 wrote to memory of 3540 2724 29557fc4e2a787e47b1b273b6c1e6cd0_NeikiAnalytics.exe 83 PID 2724 wrote to memory of 3540 2724 29557fc4e2a787e47b1b273b6c1e6cd0_NeikiAnalytics.exe 83 PID 2724 wrote to memory of 3540 2724 29557fc4e2a787e47b1b273b6c1e6cd0_NeikiAnalytics.exe 83 PID 3540 wrote to memory of 1020 3540 vvdvv.exe 84 PID 3540 wrote to memory of 1020 3540 vvdvv.exe 84 PID 3540 wrote to memory of 1020 3540 vvdvv.exe 84 PID 1020 wrote to memory of 2600 1020 lfrlfrf.exe 85 PID 1020 wrote to memory of 2600 1020 lfrlfrf.exe 85 PID 1020 wrote to memory of 2600 1020 lfrlfrf.exe 85 PID 2600 wrote to memory of 4832 2600 rxfrlxx.exe 86 PID 2600 wrote to memory of 4832 2600 rxfrlxx.exe 86 PID 2600 wrote to memory of 4832 2600 rxfrlxx.exe 86 PID 4832 wrote to memory of 4580 4832 bthhtb.exe 87 PID 4832 wrote to memory of 4580 4832 bthhtb.exe 87 PID 4832 wrote to memory of 4580 4832 bthhtb.exe 87 PID 4580 wrote to memory of 4020 4580 jpvjd.exe 88 PID 4580 wrote to memory of 4020 4580 jpvjd.exe 88 PID 4580 wrote to memory of 4020 4580 jpvjd.exe 88 PID 4020 wrote to memory of 1752 4020 rrrlfrr.exe 89 PID 4020 wrote to memory of 1752 4020 rrrlfrr.exe 89 PID 4020 wrote to memory of 1752 4020 rrrlfrr.exe 89 PID 1752 wrote to memory of 4368 1752 9ffxrfx.exe 90 PID 1752 wrote to memory of 4368 1752 9ffxrfx.exe 90 PID 1752 wrote to memory of 4368 1752 9ffxrfx.exe 90 PID 4368 wrote to memory of 3560 4368 hhhhbt.exe 91 PID 4368 wrote to memory of 3560 4368 hhhhbt.exe 91 PID 4368 wrote to memory of 3560 4368 hhhhbt.exe 91 PID 3560 wrote to memory of 4256 3560 nbbnnn.exe 92 PID 3560 wrote to memory of 4256 3560 nbbnnn.exe 92 PID 3560 wrote to memory of 4256 3560 nbbnnn.exe 92 PID 4256 wrote to memory of 2908 4256 1vvpj.exe 93 PID 4256 wrote to memory of 2908 4256 1vvpj.exe 93 PID 4256 wrote to memory of 2908 4256 1vvpj.exe 93 PID 2908 wrote to memory of 3992 2908 lflrllr.exe 94 PID 2908 wrote to memory of 3992 2908 lflrllr.exe 94 PID 2908 wrote to memory of 3992 2908 lflrllr.exe 94 PID 3992 wrote to memory of 1364 3992 nntntn.exe 95 PID 3992 wrote to memory of 1364 3992 nntntn.exe 95 PID 3992 wrote to memory of 1364 3992 nntntn.exe 95 PID 1364 wrote to memory of 4144 1364 bbhthb.exe 96 PID 1364 wrote to memory of 4144 1364 bbhthb.exe 96 PID 1364 wrote to memory of 4144 1364 bbhthb.exe 96 PID 4144 wrote to memory of 2852 4144 jpvvp.exe 97 PID 4144 wrote to memory of 2852 4144 jpvvp.exe 97 PID 4144 wrote to memory of 2852 4144 jpvvp.exe 97 PID 2852 wrote to memory of 3728 2852 rlrxrrr.exe 98 PID 2852 wrote to memory of 3728 2852 rlrxrrr.exe 98 PID 2852 wrote to memory of 3728 2852 rlrxrrr.exe 98 PID 3728 wrote to memory of 3880 3728 thbnhn.exe 99 PID 3728 wrote to memory of 3880 3728 thbnhn.exe 99 PID 3728 wrote to memory of 3880 3728 thbnhn.exe 99 PID 3880 wrote to memory of 3920 3880 jdvvv.exe 145 PID 3880 wrote to memory of 3920 3880 jdvvv.exe 145 PID 3880 wrote to memory of 3920 3880 jdvvv.exe 145 PID 3920 wrote to memory of 728 3920 9vvpv.exe 102 PID 3920 wrote to memory of 728 3920 9vvpv.exe 102 PID 3920 wrote to memory of 728 3920 9vvpv.exe 102 PID 728 wrote to memory of 516 728 1frrffr.exe 103 PID 728 wrote to memory of 516 728 1frrffr.exe 103 PID 728 wrote to memory of 516 728 1frrffr.exe 103 PID 516 wrote to memory of 3124 516 nhttbh.exe 148 PID 516 wrote to memory of 3124 516 nhttbh.exe 148 PID 516 wrote to memory of 3124 516 nhttbh.exe 148 PID 3124 wrote to memory of 1704 3124 5bhbtn.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\29557fc4e2a787e47b1b273b6c1e6cd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\29557fc4e2a787e47b1b273b6c1e6cd0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\vvdvv.exec:\vvdvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\lfrlfrf.exec:\lfrlfrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\rxfrlxx.exec:\rxfrlxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\bthhtb.exec:\bthhtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\jpvjd.exec:\jpvjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\rrrlfrr.exec:\rrrlfrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\9ffxrfx.exec:\9ffxrfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\hhhhbt.exec:\hhhhbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\nbbnnn.exec:\nbbnnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\1vvpj.exec:\1vvpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
\??\c:\lflrllr.exec:\lflrllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\nntntn.exec:\nntntn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\bbhthb.exec:\bbhthb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\jpvvp.exec:\jpvvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
\??\c:\rlrxrrr.exec:\rlrxrrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\thbnhn.exec:\thbnhn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\jdvvv.exec:\jdvvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\9vvpv.exec:\9vvpv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\1frrffr.exec:\1frrffr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:728 -
\??\c:\nhttbh.exec:\nhttbh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\5bhbtn.exec:\5bhbtn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\jppjd.exec:\jppjd.exe23⤵
- Executes dropped EXE
PID:1704 -
\??\c:\jjjjp.exec:\jjjjp.exe24⤵
- Executes dropped EXE
PID:752 -
\??\c:\fxrflxr.exec:\fxrflxr.exe25⤵
- Executes dropped EXE
PID:3700 -
\??\c:\tnbnhn.exec:\tnbnhn.exe26⤵
- Executes dropped EXE
PID:2596 -
\??\c:\bnnhtt.exec:\bnnhtt.exe27⤵
- Executes dropped EXE
PID:4508 -
\??\c:\jpvvp.exec:\jpvvp.exe28⤵
- Executes dropped EXE
PID:4640 -
\??\c:\fxlxrlf.exec:\fxlxrlf.exe29⤵
- Executes dropped EXE
PID:3468 -
\??\c:\rrlxflf.exec:\rrlxflf.exe30⤵
- Executes dropped EXE
PID:2212 -
\??\c:\bthbtt.exec:\bthbtt.exe31⤵
- Executes dropped EXE
PID:4808 -
\??\c:\9htnhb.exec:\9htnhb.exe32⤵
- Executes dropped EXE
PID:3900 -
\??\c:\ppjjp.exec:\ppjjp.exe33⤵
- Executes dropped EXE
PID:4356 -
\??\c:\5vpvj.exec:\5vpvj.exe34⤵
- Executes dropped EXE
PID:4028 -
\??\c:\xflrfxx.exec:\xflrfxx.exe35⤵
- Executes dropped EXE
PID:4484 -
\??\c:\1tbtbb.exec:\1tbtbb.exe36⤵PID:4424
-
\??\c:\5bhbth.exec:\5bhbth.exe37⤵
- Executes dropped EXE
PID:4172 -
\??\c:\jjpjj.exec:\jjpjj.exe38⤵
- Executes dropped EXE
PID:3840 -
\??\c:\ddpvj.exec:\ddpvj.exe39⤵
- Executes dropped EXE
PID:3960 -
\??\c:\xflxrlf.exec:\xflxrlf.exe40⤵
- Executes dropped EXE
PID:3308 -
\??\c:\rlrlrrx.exec:\rlrlrrx.exe41⤵
- Executes dropped EXE
PID:740 -
\??\c:\nbnbbb.exec:\nbnbbb.exe42⤵
- Executes dropped EXE
PID:4588 -
\??\c:\btbbhh.exec:\btbbhh.exe43⤵
- Executes dropped EXE
PID:3432 -
\??\c:\vppdp.exec:\vppdp.exe44⤵
- Executes dropped EXE
PID:4888 -
\??\c:\lxlxrlf.exec:\lxlxrlf.exe45⤵
- Executes dropped EXE
PID:3528 -
\??\c:\rfrfffr.exec:\rfrfffr.exe46⤵
- Executes dropped EXE
PID:3680 -
\??\c:\hbbtnb.exec:\hbbtnb.exe47⤵
- Executes dropped EXE
PID:2760 -
\??\c:\pvvdv.exec:\pvvdv.exe48⤵
- Executes dropped EXE
PID:4880 -
\??\c:\3rxlrrl.exec:\3rxlrrl.exe49⤵
- Executes dropped EXE
PID:4392 -
\??\c:\ntnbbb.exec:\ntnbbb.exe50⤵
- Executes dropped EXE
PID:3812 -
\??\c:\bnnhnh.exec:\bnnhnh.exe51⤵
- Executes dropped EXE
PID:3584 -
\??\c:\9djdd.exec:\9djdd.exe52⤵
- Executes dropped EXE
PID:1556 -
\??\c:\1pddv.exec:\1pddv.exe53⤵
- Executes dropped EXE
PID:4360 -
\??\c:\xrlxlll.exec:\xrlxlll.exe54⤵
- Executes dropped EXE
PID:1420 -
\??\c:\tnbtbb.exec:\tnbtbb.exe55⤵
- Executes dropped EXE
PID:2864 -
\??\c:\tbhbbn.exec:\tbhbbn.exe56⤵
- Executes dropped EXE
PID:3476 -
\??\c:\jvvvj.exec:\jvvvj.exe57⤵
- Executes dropped EXE
PID:2888 -
\??\c:\vppjv.exec:\vppjv.exe58⤵
- Executes dropped EXE
PID:1580 -
\??\c:\lxllffx.exec:\lxllffx.exe59⤵
- Executes dropped EXE
PID:2784 -
\??\c:\rffrlfx.exec:\rffrlfx.exe60⤵
- Executes dropped EXE
PID:1824 -
\??\c:\nbnbtt.exec:\nbnbtt.exe61⤵
- Executes dropped EXE
PID:3920 -
\??\c:\hbbbbb.exec:\hbbbbb.exe62⤵
- Executes dropped EXE
PID:2340 -
\??\c:\dpdvv.exec:\dpdvv.exe63⤵
- Executes dropped EXE
PID:2816 -
\??\c:\9frlfxf.exec:\9frlfxf.exe64⤵
- Executes dropped EXE
PID:3124 -
\??\c:\rlrlllf.exec:\rlrlllf.exe65⤵
- Executes dropped EXE
PID:2896 -
\??\c:\lrffxxr.exec:\lrffxxr.exe66⤵
- Executes dropped EXE
PID:1960 -
\??\c:\nhhnth.exec:\nhhnth.exe67⤵PID:2364
-
\??\c:\jdjdv.exec:\jdjdv.exe68⤵PID:4440
-
\??\c:\dvppv.exec:\dvppv.exe69⤵PID:676
-
\??\c:\lrlrfxl.exec:\lrlrfxl.exe70⤵PID:1664
-
\??\c:\xfffxfl.exec:\xfffxfl.exe71⤵PID:632
-
\??\c:\thnhnn.exec:\thnhnn.exe72⤵PID:4408
-
\??\c:\jdjdv.exec:\jdjdv.exe73⤵PID:3460
-
\??\c:\5jpjv.exec:\5jpjv.exe74⤵PID:2212
-
\??\c:\xrfxfff.exec:\xrfxfff.exe75⤵PID:4604
-
\??\c:\bbbhhh.exec:\bbbhhh.exe76⤵PID:2744
-
\??\c:\bhntht.exec:\bhntht.exe77⤵PID:1452
-
\??\c:\jpvdd.exec:\jpvdd.exe78⤵PID:2416
-
\??\c:\llrllrr.exec:\llrllrr.exe79⤵PID:1912
-
\??\c:\lffxrlf.exec:\lffxrlf.exe80⤵PID:5096
-
\??\c:\3tbbtt.exec:\3tbbtt.exe81⤵PID:4324
-
\??\c:\9ttbbh.exec:\9ttbbh.exe82⤵PID:640
-
\??\c:\dvvvv.exec:\dvvvv.exe83⤵PID:1252
-
\??\c:\vvddv.exec:\vvddv.exe84⤵PID:1356
-
\??\c:\lfxxffr.exec:\lfxxffr.exe85⤵PID:3960
-
\??\c:\xllrfxx.exec:\xllrfxx.exe86⤵PID:1788
-
\??\c:\tnnbnh.exec:\tnnbnh.exe87⤵PID:1628
-
\??\c:\jjvvv.exec:\jjvvv.exe88⤵PID:2060
-
\??\c:\rfffflf.exec:\rfffflf.exe89⤵PID:4020
-
\??\c:\1rxxrll.exec:\1rxxrll.exe90⤵PID:1108
-
\??\c:\1bbntn.exec:\1bbntn.exe91⤵PID:436
-
\??\c:\htnnnn.exec:\htnnnn.exe92⤵PID:3312
-
\??\c:\pjpvj.exec:\pjpvj.exe93⤵PID:4232
-
\??\c:\frrlflx.exec:\frrlflx.exe94⤵PID:4880
-
\??\c:\ffffxxx.exec:\ffffxxx.exe95⤵PID:2344
-
\??\c:\bbbbbt.exec:\bbbbbt.exe96⤵PID:3980
-
\??\c:\htnnht.exec:\htnnht.exe97⤵PID:2112
-
\??\c:\dpvpp.exec:\dpvpp.exe98⤵PID:5112
-
\??\c:\rrrrfff.exec:\rrrrfff.exe99⤵PID:2192
-
\??\c:\9llxxll.exec:\9llxxll.exe100⤵PID:3724
-
\??\c:\hhbbbb.exec:\hhbbbb.exe101⤵PID:1432
-
\??\c:\bbbtnn.exec:\bbbtnn.exe102⤵PID:1708
-
\??\c:\pdddd.exec:\pdddd.exe103⤵PID:1640
-
\??\c:\vvdvv.exec:\vvdvv.exe104⤵PID:3424
-
\??\c:\lrffrfx.exec:\lrffrfx.exe105⤵PID:2000
-
\??\c:\nbthtn.exec:\nbthtn.exe106⤵PID:5116
-
\??\c:\tnbtnn.exec:\tnbtnn.exe107⤵PID:3064
-
\??\c:\vjdvp.exec:\vjdvp.exe108⤵PID:1572
-
\??\c:\9frrfll.exec:\9frrfll.exe109⤵PID:1704
-
\??\c:\nhnhnt.exec:\nhnhnt.exe110⤵PID:4340
-
\??\c:\tnnhtn.exec:\tnnhtn.exe111⤵PID:1984
-
\??\c:\5jvvp.exec:\5jvvp.exe112⤵PID:4148
-
\??\c:\jjdvv.exec:\jjdvv.exe113⤵PID:1876
-
\??\c:\xxxfxfx.exec:\xxxfxfx.exe114⤵PID:732
-
\??\c:\nnnhbt.exec:\nnnhbt.exe115⤵PID:2156
-
\??\c:\bbhhbb.exec:\bbhhbb.exe116⤵PID:3468
-
\??\c:\vdjjd.exec:\vdjjd.exe117⤵PID:4868
-
\??\c:\ppvjj.exec:\ppvjj.exe118⤵PID:4152
-
\??\c:\rfxxrrr.exec:\rfxxrrr.exe119⤵PID:4244
-
\??\c:\3llllff.exec:\3llllff.exe120⤵PID:4904
-
\??\c:\3llrxxf.exec:\3llrxxf.exe121⤵PID:3860
-
\??\c:\bbtntb.exec:\bbtntb.exe122⤵PID:4336
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-