Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 18:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
10b800cbd7b8cb09affa58f0ade91690_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
10b800cbd7b8cb09affa58f0ade91690_NeikiAnalytics.exe
-
Size
127KB
-
MD5
10b800cbd7b8cb09affa58f0ade91690
-
SHA1
6459a72f0444a03609fd49f2a1876c21fec3e40d
-
SHA256
30081e98507e008e31f7495a070d102f00e0543bd0b937a67be5924bca9492d6
-
SHA512
ddc9d86a39dbe3540fe16babad0d158d6a88f0bb8d84b635bf9469faf5908b2fb0e73245ecf7894cc1e1238883568f0194087a17c30eea9bd74b3893b99322fb
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afodnmm9Ao98h3dktX4/JY:n3C9BRW0j/tmm9nwytIi
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/1088-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5012-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2920-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2824-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4316-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1764-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1500-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3340-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3948-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3876-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4500-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4648-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2860-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4372-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1268-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3384-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3092-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1720-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/456-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3588-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2464-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5012 vjvjp.exe 2920 xlxflrl.exe 2824 nnthtt.exe 4316 htbbbh.exe 1764 lflfrff.exe 2368 djvjd.exe 3808 fxlrxfr.exe 1500 hbhhtt.exe 3340 3btttb.exe 3948 rxffxll.exe 3876 hhhbbt.exe 4500 jjdjv.exe 4648 1rlxrfr.exe 2860 bnbnhb.exe 4372 jjpjj.exe 2012 1rrrlfl.exe 3132 htttnn.exe 1268 1dvvv.exe 3384 fllfxxr.exe 4828 vjjpj.exe 3092 rxfxrrr.exe 1608 nttbnt.exe 1720 vpjdj.exe 456 ntbtnh.exe 3588 pjvpp.exe 2904 frxrflf.exe 1616 rlrrlff.exe 2132 tnhhhh.exe 2640 vpddv.exe 4460 hntnnb.exe 2464 tbtbtt.exe 3060 vjdpv.exe 3556 nntnbt.exe 1272 djppp.exe 3652 1jdpp.exe 4588 lrrxrrr.exe 4180 htnbnb.exe 1836 jpppd.exe 1592 xflffff.exe 1164 hbbttn.exe 1392 pjjdv.exe 2656 jdjvv.exe 4528 rllflrl.exe 3480 xlxrrlf.exe 2752 5bbtnt.exe 2636 jvvvp.exe 5048 fxrllxr.exe 2360 lxfllrr.exe 1628 ttbthn.exe 3132 jjpjj.exe 4220 rxxxflx.exe 4364 htbttt.exe 3472 hbhbtt.exe 208 3vpjp.exe 4412 dvddd.exe 1808 htbbth.exe 1532 7bhbbb.exe 4944 pjjjd.exe 3524 rlfxlfl.exe 3020 xfllfff.exe 2784 tnnnbn.exe 2812 dvjjp.exe 4004 3rfrlff.exe 2640 bthtbt.exe -
resource yara_rule behavioral2/memory/1088-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5012-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4316-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1500-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3340-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3948-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3876-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4648-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2860-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4372-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1268-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3384-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3092-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1720-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/456-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2464-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1088 wrote to memory of 5012 1088 10b800cbd7b8cb09affa58f0ade91690_NeikiAnalytics.exe 89 PID 1088 wrote to memory of 5012 1088 10b800cbd7b8cb09affa58f0ade91690_NeikiAnalytics.exe 89 PID 1088 wrote to memory of 5012 1088 10b800cbd7b8cb09affa58f0ade91690_NeikiAnalytics.exe 89 PID 5012 wrote to memory of 2920 5012 vjvjp.exe 90 PID 5012 wrote to memory of 2920 5012 vjvjp.exe 90 PID 5012 wrote to memory of 2920 5012 vjvjp.exe 90 PID 2920 wrote to memory of 2824 2920 xlxflrl.exe 91 PID 2920 wrote to memory of 2824 2920 xlxflrl.exe 91 PID 2920 wrote to memory of 2824 2920 xlxflrl.exe 91 PID 2824 wrote to memory of 4316 2824 nnthtt.exe 92 PID 2824 wrote to memory of 4316 2824 nnthtt.exe 92 PID 2824 wrote to memory of 4316 2824 nnthtt.exe 92 PID 4316 wrote to memory of 1764 4316 htbbbh.exe 93 PID 4316 wrote to memory of 1764 4316 htbbbh.exe 93 PID 4316 wrote to memory of 1764 4316 htbbbh.exe 93 PID 1764 wrote to memory of 2368 1764 lflfrff.exe 94 PID 1764 wrote to memory of 2368 1764 lflfrff.exe 94 PID 1764 wrote to memory of 2368 1764 lflfrff.exe 94 PID 2368 wrote to memory of 3808 2368 djvjd.exe 95 PID 2368 wrote to memory of 3808 2368 djvjd.exe 95 PID 2368 wrote to memory of 3808 2368 djvjd.exe 95 PID 3808 wrote to memory of 1500 3808 fxlrxfr.exe 96 PID 3808 wrote to memory of 1500 3808 fxlrxfr.exe 96 PID 3808 wrote to memory of 1500 3808 fxlrxfr.exe 96 PID 1500 wrote to memory of 3340 1500 hbhhtt.exe 97 PID 1500 wrote to memory of 3340 1500 hbhhtt.exe 97 PID 1500 wrote to memory of 3340 1500 hbhhtt.exe 97 PID 3340 wrote to memory of 3948 3340 3btttb.exe 98 PID 3340 wrote to memory of 3948 3340 3btttb.exe 98 PID 3340 wrote to memory of 3948 3340 3btttb.exe 98 PID 3948 wrote to memory of 3876 3948 rxffxll.exe 99 PID 3948 wrote to memory of 3876 3948 rxffxll.exe 99 PID 3948 wrote to memory of 3876 3948 rxffxll.exe 99 PID 3876 wrote to memory of 4500 3876 hhhbbt.exe 100 PID 3876 wrote to memory of 4500 3876 hhhbbt.exe 100 PID 3876 wrote to memory of 4500 3876 hhhbbt.exe 100 PID 4500 wrote to memory of 4648 4500 jjdjv.exe 101 PID 4500 wrote to memory of 4648 4500 jjdjv.exe 101 PID 4500 wrote to memory of 4648 4500 jjdjv.exe 101 PID 4648 wrote to memory of 2860 4648 1rlxrfr.exe 102 PID 4648 wrote to memory of 2860 4648 1rlxrfr.exe 102 PID 4648 wrote to memory of 2860 4648 1rlxrfr.exe 102 PID 2860 wrote to memory of 4372 2860 bnbnhb.exe 103 PID 2860 wrote to memory of 4372 2860 bnbnhb.exe 103 PID 2860 wrote to memory of 4372 2860 bnbnhb.exe 103 PID 4372 wrote to memory of 2012 4372 jjpjj.exe 104 PID 4372 wrote to memory of 2012 4372 jjpjj.exe 104 PID 4372 wrote to memory of 2012 4372 jjpjj.exe 104 PID 2012 wrote to memory of 3132 2012 1rrrlfl.exe 105 PID 2012 wrote to memory of 3132 2012 1rrrlfl.exe 105 PID 2012 wrote to memory of 3132 2012 1rrrlfl.exe 105 PID 3132 wrote to memory of 1268 3132 htttnn.exe 106 PID 3132 wrote to memory of 1268 3132 htttnn.exe 106 PID 3132 wrote to memory of 1268 3132 htttnn.exe 106 PID 1268 wrote to memory of 3384 1268 1dvvv.exe 107 PID 1268 wrote to memory of 3384 1268 1dvvv.exe 107 PID 1268 wrote to memory of 3384 1268 1dvvv.exe 107 PID 3384 wrote to memory of 4828 3384 fllfxxr.exe 109 PID 3384 wrote to memory of 4828 3384 fllfxxr.exe 109 PID 3384 wrote to memory of 4828 3384 fllfxxr.exe 109 PID 4828 wrote to memory of 3092 4828 vjjpj.exe 110 PID 4828 wrote to memory of 3092 4828 vjjpj.exe 110 PID 4828 wrote to memory of 3092 4828 vjjpj.exe 110 PID 3092 wrote to memory of 1608 3092 rxfxrrr.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\10b800cbd7b8cb09affa58f0ade91690_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\10b800cbd7b8cb09affa58f0ade91690_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\vjvjp.exec:\vjvjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\xlxflrl.exec:\xlxflrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\nnthtt.exec:\nnthtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\htbbbh.exec:\htbbbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\lflfrff.exec:\lflfrff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\djvjd.exec:\djvjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\fxlrxfr.exec:\fxlrxfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\hbhhtt.exec:\hbhhtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\3btttb.exec:\3btttb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
\??\c:\rxffxll.exec:\rxffxll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\hhhbbt.exec:\hhhbbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
\??\c:\jjdjv.exec:\jjdjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\1rlxrfr.exec:\1rlxrfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\bnbnhb.exec:\bnbnhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\jjpjj.exec:\jjpjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\1rrrlfl.exec:\1rrrlfl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\htttnn.exec:\htttnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\1dvvv.exec:\1dvvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\fllfxxr.exec:\fllfxxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
\??\c:\vjjpj.exec:\vjjpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\rxfxrrr.exec:\rxfxrrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\nttbnt.exec:\nttbnt.exe23⤵
- Executes dropped EXE
PID:1608 -
\??\c:\vpjdj.exec:\vpjdj.exe24⤵
- Executes dropped EXE
PID:1720 -
\??\c:\ntbtnh.exec:\ntbtnh.exe25⤵
- Executes dropped EXE
PID:456 -
\??\c:\pjvpp.exec:\pjvpp.exe26⤵
- Executes dropped EXE
PID:3588 -
\??\c:\frxrflf.exec:\frxrflf.exe27⤵
- Executes dropped EXE
PID:2904 -
\??\c:\rlrrlff.exec:\rlrrlff.exe28⤵
- Executes dropped EXE
PID:1616 -
\??\c:\tnhhhh.exec:\tnhhhh.exe29⤵
- Executes dropped EXE
PID:2132 -
\??\c:\vpddv.exec:\vpddv.exe30⤵
- Executes dropped EXE
PID:2640 -
\??\c:\hntnnb.exec:\hntnnb.exe31⤵
- Executes dropped EXE
PID:4460 -
\??\c:\tbtbtt.exec:\tbtbtt.exe32⤵
- Executes dropped EXE
PID:2464 -
\??\c:\vjdpv.exec:\vjdpv.exe33⤵
- Executes dropped EXE
PID:3060 -
\??\c:\nntnbt.exec:\nntnbt.exe34⤵
- Executes dropped EXE
PID:3556 -
\??\c:\djppp.exec:\djppp.exe35⤵
- Executes dropped EXE
PID:1272 -
\??\c:\1jdpp.exec:\1jdpp.exe36⤵
- Executes dropped EXE
PID:3652 -
\??\c:\lrrxrrr.exec:\lrrxrrr.exe37⤵
- Executes dropped EXE
PID:4588 -
\??\c:\htnbnb.exec:\htnbnb.exe38⤵
- Executes dropped EXE
PID:4180 -
\??\c:\jpppd.exec:\jpppd.exe39⤵
- Executes dropped EXE
PID:1836 -
\??\c:\xflffff.exec:\xflffff.exe40⤵
- Executes dropped EXE
PID:1592 -
\??\c:\hbbttn.exec:\hbbttn.exe41⤵
- Executes dropped EXE
PID:1164 -
\??\c:\pjjdv.exec:\pjjdv.exe42⤵
- Executes dropped EXE
PID:1392 -
\??\c:\jdjvv.exec:\jdjvv.exe43⤵
- Executes dropped EXE
PID:2656 -
\??\c:\rllflrl.exec:\rllflrl.exe44⤵
- Executes dropped EXE
PID:4528 -
\??\c:\xlxrrlf.exec:\xlxrrlf.exe45⤵
- Executes dropped EXE
PID:3480 -
\??\c:\5bbtnt.exec:\5bbtnt.exe46⤵
- Executes dropped EXE
PID:2752 -
\??\c:\jvvvp.exec:\jvvvp.exe47⤵
- Executes dropped EXE
PID:2636 -
\??\c:\fxrllxr.exec:\fxrllxr.exe48⤵
- Executes dropped EXE
PID:5048 -
\??\c:\lxfllrr.exec:\lxfllrr.exe49⤵
- Executes dropped EXE
PID:2360 -
\??\c:\ttbthn.exec:\ttbthn.exe50⤵
- Executes dropped EXE
PID:1628 -
\??\c:\jjpjj.exec:\jjpjj.exe51⤵
- Executes dropped EXE
PID:3132 -
\??\c:\rxxxflx.exec:\rxxxflx.exe52⤵
- Executes dropped EXE
PID:4220 -
\??\c:\htbttt.exec:\htbttt.exe53⤵
- Executes dropped EXE
PID:4364 -
\??\c:\hbhbtt.exec:\hbhbtt.exe54⤵
- Executes dropped EXE
PID:3472 -
\??\c:\3vpjp.exec:\3vpjp.exe55⤵
- Executes dropped EXE
PID:208 -
\??\c:\dvddd.exec:\dvddd.exe56⤵
- Executes dropped EXE
PID:4412 -
\??\c:\htbbth.exec:\htbbth.exe57⤵
- Executes dropped EXE
PID:1808 -
\??\c:\7bhbbb.exec:\7bhbbb.exe58⤵
- Executes dropped EXE
PID:1532 -
\??\c:\pjjjd.exec:\pjjjd.exe59⤵
- Executes dropped EXE
PID:4944 -
\??\c:\rlfxlfl.exec:\rlfxlfl.exe60⤵
- Executes dropped EXE
PID:3524 -
\??\c:\xfllfff.exec:\xfllfff.exe61⤵
- Executes dropped EXE
PID:3020 -
\??\c:\tnnnbn.exec:\tnnnbn.exe62⤵
- Executes dropped EXE
PID:2784 -
\??\c:\dvjjp.exec:\dvjjp.exe63⤵
- Executes dropped EXE
PID:2812 -
\??\c:\3rfrlff.exec:\3rfrlff.exe64⤵
- Executes dropped EXE
PID:4004 -
\??\c:\5rxxxfx.exec:\5rxxxfx.exe65⤵PID:4656
-
\??\c:\bthtbt.exec:\bthtbt.exe66⤵
- Executes dropped EXE
PID:2640 -
\??\c:\dppjd.exec:\dppjd.exe67⤵PID:3696
-
\??\c:\vdvpp.exec:\vdvpp.exe68⤵PID:2348
-
\??\c:\llrrlll.exec:\llrrlll.exe69⤵PID:1868
-
\??\c:\tnnbbh.exec:\tnnbbh.exe70⤵PID:5012
-
\??\c:\ddddd.exec:\ddddd.exe71⤵PID:1708
-
\??\c:\vjvpd.exec:\vjvpd.exe72⤵PID:3960
-
\??\c:\flffrll.exec:\flffrll.exe73⤵PID:4848
-
\??\c:\tnthhb.exec:\tnthhb.exe74⤵PID:3620
-
\??\c:\rxrlxlr.exec:\rxrlxlr.exe75⤵PID:4180
-
\??\c:\rrrrfrr.exec:\rrrrfrr.exe76⤵PID:212
-
\??\c:\nhnhhh.exec:\nhnhhh.exe77⤵PID:1592
-
\??\c:\djjjp.exec:\djjjp.exe78⤵PID:2196
-
\??\c:\rllffll.exec:\rllffll.exe79⤵PID:672
-
\??\c:\fflllrr.exec:\fflllrr.exe80⤵PID:2520
-
\??\c:\tbhtbb.exec:\tbhtbb.exe81⤵PID:5016
-
\??\c:\vpppj.exec:\vpppj.exe82⤵PID:2800
-
\??\c:\3fffxfx.exec:\3fffxfx.exe83⤵PID:4648
-
\??\c:\3fllfff.exec:\3fllfff.exe84⤵PID:2636
-
\??\c:\ppddd.exec:\ppddd.exe85⤵PID:1096
-
\??\c:\hbhbbb.exec:\hbhbbb.exe86⤵PID:3756
-
\??\c:\9dddv.exec:\9dddv.exe87⤵PID:4100
-
\??\c:\ppjjj.exec:\ppjjj.exe88⤵PID:3132
-
\??\c:\flrrrrr.exec:\flrrrrr.exe89⤵PID:4776
-
\??\c:\bbbbnn.exec:\bbbbnn.exe90⤵PID:4364
-
\??\c:\9vpjj.exec:\9vpjj.exe91⤵PID:960
-
\??\c:\1lrlfff.exec:\1lrlfff.exe92⤵PID:532
-
\??\c:\tnhhnb.exec:\tnhhnb.exe93⤵PID:3164
-
\??\c:\pppjj.exec:\pppjj.exe94⤵PID:1720
-
\??\c:\htbtbt.exec:\htbtbt.exe95⤵PID:1560
-
\??\c:\1dvjj.exec:\1dvjj.exe96⤵PID:3588
-
\??\c:\bntttn.exec:\bntttn.exe97⤵PID:4568
-
\??\c:\9vppp.exec:\9vppp.exe98⤵PID:5072
-
\??\c:\ppvdv.exec:\ppvdv.exe99⤵PID:5028
-
\??\c:\1xxfxxx.exec:\1xxfxxx.exe100⤵PID:232
-
\??\c:\nnnnhh.exec:\nnnnhh.exe101⤵PID:4328
-
\??\c:\dpvdd.exec:\dpvdd.exe102⤵PID:4808
-
\??\c:\vdddd.exec:\vdddd.exe103⤵PID:1724
-
\??\c:\lffxrrf.exec:\lffxrrf.exe104⤵PID:2652
-
\??\c:\ffrflfx.exec:\ffrflfx.exe105⤵PID:3796
-
\??\c:\ntbnhh.exec:\ntbnhh.exe106⤵PID:1008
-
\??\c:\vdppj.exec:\vdppj.exe107⤵PID:1856
-
\??\c:\dvvdv.exec:\dvvdv.exe108⤵PID:228
-
\??\c:\xrxrlrl.exec:\xrxrlrl.exe109⤵PID:2844
-
\??\c:\nhnnnh.exec:\nhnnnh.exe110⤵PID:4848
-
\??\c:\jvdvj.exec:\jvdvj.exe111⤵PID:3620
-
\??\c:\7xfxrll.exec:\7xfxrll.exe112⤵PID:4180
-
\??\c:\9rflffx.exec:\9rflffx.exe113⤵PID:212
-
\??\c:\bnnhtb.exec:\bnnhtb.exe114⤵PID:2928
-
\??\c:\jjjjd.exec:\jjjjd.exe115⤵PID:2732
-
\??\c:\xxlflll.exec:\xxlflll.exe116⤵PID:4268
-
\??\c:\lrxrrrl.exec:\lrxrrrl.exe117⤵PID:4660
-
\??\c:\3tbbtb.exec:\3tbbtb.exe118⤵PID:5036
-
\??\c:\jvjpv.exec:\jvjpv.exe119⤵PID:3600
-
\??\c:\vpvpj.exec:\vpvpj.exe120⤵PID:4556
-
\??\c:\rrlfrrx.exec:\rrlfrrx.exe121⤵PID:1524
-
\??\c:\bbbtbt.exec:\bbbtbt.exe122⤵PID:4168
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-