Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-05-2024 11:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dd15ef43c26b6c0e658631e4be968ab0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
dd15ef43c26b6c0e658631e4be968ab0_NeikiAnalytics.exe
-
Size
80KB
-
MD5
dd15ef43c26b6c0e658631e4be968ab0
-
SHA1
41fcd6bb63dccca9bb394f4abb56f73f00c60911
-
SHA256
4b689434af9e52fd367b995d8866290e413b9c5efb1f3ce911a01d8237393ec4
-
SHA512
fe5b0122220bb85860232fc4ed878e5c72d2bf77fe2cc54a181d1f8aa2469971f1c8f565935916c53857bc5ac2e28d997c51206b2108fe9b63f2ad3ad4c0a932
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoLU1gxm1S3PQ7CnPRKiir5Qw:ymb3NkkiQ3mdBjFoLkmx/g8ZKzQw
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/1572-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1076-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3264-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4332-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2104-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3376-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1488-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2180-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3248-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1864-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4364-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3224-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/648-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1416-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1920-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1120-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2620-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2920-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2540-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2244-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/456-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1380-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2736-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1076 dvvpd.exe 3264 rlfxxxr.exe 4332 9nttnn.exe 2104 7jdvp.exe 3376 rlrlllf.exe 4908 tnttnn.exe 1488 1jpjd.exe 2180 xllfxrl.exe 5040 htnhnn.exe 2156 rrfffrx.exe 3248 7bnthh.exe 1864 jjjvp.exe 4364 flllfxf.exe 3224 bbbntb.exe 648 lrxxllf.exe 1416 htbnnb.exe 1920 1llfxrr.exe 1120 9llrrlr.exe 2620 bntbhn.exe 4784 tnbthn.exe 968 ddpdv.exe 3140 rlllfff.exe 2920 djvpp.exe 2540 xrrfffl.exe 2244 rrrrrrx.exe 456 dvddd.exe 1380 ffrxxlr.exe 2736 nbhhbt.exe 1420 vjjjj.exe 3188 1rxrlxf.exe 4704 bttttt.exe 4612 3thbtt.exe 4836 frxrrrl.exe 3832 fflfxxx.exe 3620 nttttt.exe 844 vjppv.exe 1020 jdpjp.exe 2780 xrlxxrx.exe 1348 vpvpp.exe 2388 vjpjj.exe 4300 tbbbtt.exe 1628 5nnhhh.exe 1456 jvvvp.exe 216 3lfxrrl.exe 3316 btnntt.exe 3976 3hhbtt.exe 1556 jpvdv.exe 1484 lrfxxrl.exe 3720 hhbttt.exe 3804 ddjjj.exe 2180 pjpvp.exe 2928 lllfxxf.exe 3068 bnnnnh.exe 1044 vvvvp.exe 5032 fffxrrl.exe 2836 rxxrrrl.exe 3596 htnhbh.exe 556 dppjj.exe 1924 jdjdd.exe 2888 rrrlxxf.exe 1416 llxxxxr.exe 1372 5hbtnt.exe 2696 1jppj.exe 3696 pvpjd.exe -
resource yara_rule behavioral2/memory/1572-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1076-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3264-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4332-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3376-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1488-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2180-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3248-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1864-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4364-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3224-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/648-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1416-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1920-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1120-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2540-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2244-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/456-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1380-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2736-183-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1572 wrote to memory of 1076 1572 dd15ef43c26b6c0e658631e4be968ab0_NeikiAnalytics.exe 83 PID 1572 wrote to memory of 1076 1572 dd15ef43c26b6c0e658631e4be968ab0_NeikiAnalytics.exe 83 PID 1572 wrote to memory of 1076 1572 dd15ef43c26b6c0e658631e4be968ab0_NeikiAnalytics.exe 83 PID 1076 wrote to memory of 3264 1076 dvvpd.exe 84 PID 1076 wrote to memory of 3264 1076 dvvpd.exe 84 PID 1076 wrote to memory of 3264 1076 dvvpd.exe 84 PID 3264 wrote to memory of 4332 3264 rlfxxxr.exe 85 PID 3264 wrote to memory of 4332 3264 rlfxxxr.exe 85 PID 3264 wrote to memory of 4332 3264 rlfxxxr.exe 85 PID 4332 wrote to memory of 2104 4332 9nttnn.exe 86 PID 4332 wrote to memory of 2104 4332 9nttnn.exe 86 PID 4332 wrote to memory of 2104 4332 9nttnn.exe 86 PID 2104 wrote to memory of 3376 2104 7jdvp.exe 87 PID 2104 wrote to memory of 3376 2104 7jdvp.exe 87 PID 2104 wrote to memory of 3376 2104 7jdvp.exe 87 PID 3376 wrote to memory of 4908 3376 rlrlllf.exe 88 PID 3376 wrote to memory of 4908 3376 rlrlllf.exe 88 PID 3376 wrote to memory of 4908 3376 rlrlllf.exe 88 PID 4908 wrote to memory of 1488 4908 tnttnn.exe 89 PID 4908 wrote to memory of 1488 4908 tnttnn.exe 89 PID 4908 wrote to memory of 1488 4908 tnttnn.exe 89 PID 1488 wrote to memory of 2180 1488 1jpjd.exe 90 PID 1488 wrote to memory of 2180 1488 1jpjd.exe 90 PID 1488 wrote to memory of 2180 1488 1jpjd.exe 90 PID 2180 wrote to memory of 5040 2180 xllfxrl.exe 91 PID 2180 wrote to memory of 5040 2180 xllfxrl.exe 91 PID 2180 wrote to memory of 5040 2180 xllfxrl.exe 91 PID 5040 wrote to memory of 2156 5040 htnhnn.exe 92 PID 5040 wrote to memory of 2156 5040 htnhnn.exe 92 PID 5040 wrote to memory of 2156 5040 htnhnn.exe 92 PID 2156 wrote to memory of 3248 2156 rrfffrx.exe 93 PID 2156 wrote to memory of 3248 2156 rrfffrx.exe 93 PID 2156 wrote to memory of 3248 2156 rrfffrx.exe 93 PID 3248 wrote to memory of 1864 3248 7bnthh.exe 94 PID 3248 wrote to memory of 1864 3248 7bnthh.exe 94 PID 3248 wrote to memory of 1864 3248 7bnthh.exe 94 PID 1864 wrote to memory of 4364 1864 jjjvp.exe 95 PID 1864 wrote to memory of 4364 1864 jjjvp.exe 95 PID 1864 wrote to memory of 4364 1864 jjjvp.exe 95 PID 4364 wrote to memory of 3224 4364 flllfxf.exe 96 PID 4364 wrote to memory of 3224 4364 flllfxf.exe 96 PID 4364 wrote to memory of 3224 4364 flllfxf.exe 96 PID 3224 wrote to memory of 648 3224 bbbntb.exe 97 PID 3224 wrote to memory of 648 3224 bbbntb.exe 97 PID 3224 wrote to memory of 648 3224 bbbntb.exe 97 PID 648 wrote to memory of 1416 648 lrxxllf.exe 98 PID 648 wrote to memory of 1416 648 lrxxllf.exe 98 PID 648 wrote to memory of 1416 648 lrxxllf.exe 98 PID 1416 wrote to memory of 1920 1416 htbnnb.exe 99 PID 1416 wrote to memory of 1920 1416 htbnnb.exe 99 PID 1416 wrote to memory of 1920 1416 htbnnb.exe 99 PID 1920 wrote to memory of 1120 1920 1llfxrr.exe 100 PID 1920 wrote to memory of 1120 1920 1llfxrr.exe 100 PID 1920 wrote to memory of 1120 1920 1llfxrr.exe 100 PID 1120 wrote to memory of 2620 1120 9llrrlr.exe 101 PID 1120 wrote to memory of 2620 1120 9llrrlr.exe 101 PID 1120 wrote to memory of 2620 1120 9llrrlr.exe 101 PID 2620 wrote to memory of 4784 2620 bntbhn.exe 102 PID 2620 wrote to memory of 4784 2620 bntbhn.exe 102 PID 2620 wrote to memory of 4784 2620 bntbhn.exe 102 PID 4784 wrote to memory of 968 4784 tnbthn.exe 103 PID 4784 wrote to memory of 968 4784 tnbthn.exe 103 PID 4784 wrote to memory of 968 4784 tnbthn.exe 103 PID 968 wrote to memory of 3140 968 ddpdv.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd15ef43c26b6c0e658631e4be968ab0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\dd15ef43c26b6c0e658631e4be968ab0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\dvvpd.exec:\dvvpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\rlfxxxr.exec:\rlfxxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
\??\c:\9nttnn.exec:\9nttnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
\??\c:\7jdvp.exec:\7jdvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\rlrlllf.exec:\rlrlllf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
\??\c:\tnttnn.exec:\tnttnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\1jpjd.exec:\1jpjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\xllfxrl.exec:\xllfxrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\htnhnn.exec:\htnhnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\rrfffrx.exec:\rrfffrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\7bnthh.exec:\7bnthh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
\??\c:\jjjvp.exec:\jjjvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\flllfxf.exec:\flllfxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\bbbntb.exec:\bbbntb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\lrxxllf.exec:\lrxxllf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
\??\c:\htbnnb.exec:\htbnnb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\1llfxrr.exec:\1llfxrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\9llrrlr.exec:\9llrrlr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\bntbhn.exec:\bntbhn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\tnbthn.exec:\tnbthn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\ddpdv.exec:\ddpdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\rlllfff.exec:\rlllfff.exe23⤵
- Executes dropped EXE
PID:3140 -
\??\c:\djvpp.exec:\djvpp.exe24⤵
- Executes dropped EXE
PID:2920 -
\??\c:\xrrfffl.exec:\xrrfffl.exe25⤵
- Executes dropped EXE
PID:2540 -
\??\c:\rrrrrrx.exec:\rrrrrrx.exe26⤵
- Executes dropped EXE
PID:2244 -
\??\c:\dvddd.exec:\dvddd.exe27⤵
- Executes dropped EXE
PID:456 -
\??\c:\ffrxxlr.exec:\ffrxxlr.exe28⤵
- Executes dropped EXE
PID:1380 -
\??\c:\nbhhbt.exec:\nbhhbt.exe29⤵
- Executes dropped EXE
PID:2736 -
\??\c:\vjjjj.exec:\vjjjj.exe30⤵
- Executes dropped EXE
PID:1420 -
\??\c:\1rxrlxf.exec:\1rxrlxf.exe31⤵
- Executes dropped EXE
PID:3188 -
\??\c:\bttttt.exec:\bttttt.exe32⤵
- Executes dropped EXE
PID:4704 -
\??\c:\3thbtt.exec:\3thbtt.exe33⤵
- Executes dropped EXE
PID:4612 -
\??\c:\frxrrrl.exec:\frxrrrl.exe34⤵
- Executes dropped EXE
PID:4836 -
\??\c:\fflfxxx.exec:\fflfxxx.exe35⤵
- Executes dropped EXE
PID:3832 -
\??\c:\nttttt.exec:\nttttt.exe36⤵
- Executes dropped EXE
PID:3620 -
\??\c:\vjppv.exec:\vjppv.exe37⤵
- Executes dropped EXE
PID:844 -
\??\c:\jdpjp.exec:\jdpjp.exe38⤵
- Executes dropped EXE
PID:1020 -
\??\c:\xrlxxrx.exec:\xrlxxrx.exe39⤵
- Executes dropped EXE
PID:2780 -
\??\c:\vpvpp.exec:\vpvpp.exe40⤵
- Executes dropped EXE
PID:1348 -
\??\c:\vjpjj.exec:\vjpjj.exe41⤵
- Executes dropped EXE
PID:2388 -
\??\c:\tbbbtt.exec:\tbbbtt.exe42⤵
- Executes dropped EXE
PID:4300 -
\??\c:\5nnhhh.exec:\5nnhhh.exe43⤵
- Executes dropped EXE
PID:1628 -
\??\c:\jvvvp.exec:\jvvvp.exe44⤵
- Executes dropped EXE
PID:1456 -
\??\c:\3lfxrrl.exec:\3lfxrrl.exe45⤵
- Executes dropped EXE
PID:216 -
\??\c:\btnntt.exec:\btnntt.exe46⤵
- Executes dropped EXE
PID:3316 -
\??\c:\3hhbtt.exec:\3hhbtt.exe47⤵
- Executes dropped EXE
PID:3976 -
\??\c:\jpvdv.exec:\jpvdv.exe48⤵
- Executes dropped EXE
PID:1556 -
\??\c:\lrfxxrl.exec:\lrfxxrl.exe49⤵
- Executes dropped EXE
PID:1484 -
\??\c:\hhbttt.exec:\hhbttt.exe50⤵
- Executes dropped EXE
PID:3720 -
\??\c:\ddjjj.exec:\ddjjj.exe51⤵
- Executes dropped EXE
PID:3804 -
\??\c:\pjpvp.exec:\pjpvp.exe52⤵
- Executes dropped EXE
PID:2180 -
\??\c:\lllfxxf.exec:\lllfxxf.exe53⤵
- Executes dropped EXE
PID:2928 -
\??\c:\bnnnnh.exec:\bnnnnh.exe54⤵
- Executes dropped EXE
PID:3068 -
\??\c:\vvvvp.exec:\vvvvp.exe55⤵
- Executes dropped EXE
PID:1044 -
\??\c:\fffxrrl.exec:\fffxrrl.exe56⤵
- Executes dropped EXE
PID:5032 -
\??\c:\rxxrrrl.exec:\rxxrrrl.exe57⤵
- Executes dropped EXE
PID:2836 -
\??\c:\htnhbh.exec:\htnhbh.exe58⤵
- Executes dropped EXE
PID:3596 -
\??\c:\dppjj.exec:\dppjj.exe59⤵
- Executes dropped EXE
PID:556 -
\??\c:\jdjdd.exec:\jdjdd.exe60⤵
- Executes dropped EXE
PID:1924 -
\??\c:\rrrlxxf.exec:\rrrlxxf.exe61⤵
- Executes dropped EXE
PID:2888 -
\??\c:\llxxxxr.exec:\llxxxxr.exe62⤵
- Executes dropped EXE
PID:1416 -
\??\c:\5hbtnt.exec:\5hbtnt.exe63⤵
- Executes dropped EXE
PID:1372 -
\??\c:\1jppj.exec:\1jppj.exe64⤵
- Executes dropped EXE
PID:2696 -
\??\c:\pvpjd.exec:\pvpjd.exe65⤵
- Executes dropped EXE
PID:3696 -
\??\c:\rlffrxf.exec:\rlffrxf.exe66⤵PID:1812
-
\??\c:\hhbhhn.exec:\hhbhhn.exe67⤵PID:1824
-
\??\c:\5dddv.exec:\5dddv.exe68⤵PID:4956
-
\??\c:\5dddv.exec:\5dddv.exe69⤵PID:4856
-
\??\c:\rrffxxl.exec:\rrffxxl.exe70⤵PID:2512
-
\??\c:\5fllrxf.exec:\5fllrxf.exe71⤵PID:1392
-
\??\c:\bnbhnt.exec:\bnbhnt.exe72⤵PID:3092
-
\??\c:\pjjjv.exec:\pjjjv.exe73⤵PID:4440
-
\??\c:\llrrlll.exec:\llrrlll.exe74⤵PID:1188
-
\??\c:\bnnttb.exec:\bnnttb.exe75⤵PID:4972
-
\??\c:\tthhbh.exec:\tthhbh.exe76⤵PID:3940
-
\??\c:\vdjdd.exec:\vdjdd.exe77⤵PID:2300
-
\??\c:\9rxfxll.exec:\9rxfxll.exe78⤵PID:4104
-
\??\c:\ffrrlll.exec:\ffrrlll.exe79⤵PID:4352
-
\??\c:\hhbntb.exec:\hhbntb.exe80⤵PID:4604
-
\??\c:\pjpjj.exec:\pjpjj.exe81⤵PID:1388
-
\??\c:\jdjvp.exec:\jdjvp.exe82⤵PID:4528
-
\??\c:\xxffxrl.exec:\xxffxrl.exe83⤵PID:3344
-
\??\c:\hntnnn.exec:\hntnnn.exe84⤵PID:4936
-
\??\c:\ntbnnt.exec:\ntbnnt.exe85⤵PID:4436
-
\??\c:\jjppv.exec:\jjppv.exe86⤵PID:4320
-
\??\c:\rrxfxxl.exec:\rrxfxxl.exe87⤵PID:1348
-
\??\c:\tbbtnn.exec:\tbbtnn.exe88⤵PID:4556
-
\??\c:\nbtbnt.exec:\nbtbnt.exe89⤵PID:3468
-
\??\c:\ddjdd.exec:\ddjdd.exe90⤵PID:2184
-
\??\c:\lxxxrxr.exec:\lxxxrxr.exe91⤵PID:4132
-
\??\c:\5xlllrr.exec:\5xlllrr.exe92⤵PID:1536
-
\??\c:\bbnntt.exec:\bbnntt.exe93⤵PID:1208
-
\??\c:\vjppj.exec:\vjppj.exe94⤵PID:656
-
\??\c:\lflfxll.exec:\lflfxll.exe95⤵PID:4564
-
\??\c:\bnbnnn.exec:\bnbnnn.exe96⤵PID:1336
-
\??\c:\nbnbtt.exec:\nbnbtt.exe97⤵PID:1852
-
\??\c:\jdppd.exec:\jdppd.exe98⤵PID:3380
-
\??\c:\9ntnhh.exec:\9ntnhh.exe99⤵PID:712
-
\??\c:\pdjvv.exec:\pdjvv.exe100⤵PID:4216
-
\??\c:\lxxxrrl.exec:\lxxxrrl.exe101⤵PID:3032
-
\??\c:\fflfxxr.exec:\fflfxxr.exe102⤵PID:1724
-
\??\c:\bbhhtb.exec:\bbhhtb.exe103⤵PID:2304
-
\??\c:\3vvvp.exec:\3vvvp.exe104⤵PID:4976
-
\??\c:\ppppp.exec:\ppppp.exe105⤵PID:2096
-
\??\c:\lllfxfx.exec:\lllfxfx.exe106⤵PID:1924
-
\??\c:\nhhbhh.exec:\nhhbhh.exe107⤵PID:4576
-
\??\c:\3thbtb.exec:\3thbtb.exe108⤵PID:4868
-
\??\c:\pdjvj.exec:\pdjvj.exe109⤵PID:4724
-
\??\c:\3llrrxx.exec:\3llrrxx.exe110⤵PID:4188
-
\??\c:\rxfrfff.exec:\rxfrfff.exe111⤵PID:4956
-
\??\c:\bbntnn.exec:\bbntnn.exe112⤵PID:3756
-
\??\c:\btbttt.exec:\btbttt.exe113⤵PID:2920
-
\??\c:\5pdvp.exec:\5pdvp.exe114⤵PID:4852
-
\??\c:\rxxxxxx.exec:\rxxxxxx.exe115⤵PID:2244
-
\??\c:\xxrrfrl.exec:\xxrrfrl.exe116⤵PID:2736
-
\??\c:\ttbhhh.exec:\ttbhhh.exe117⤵PID:2460
-
\??\c:\djjjp.exec:\djjjp.exe118⤵PID:4092
-
\??\c:\flrfllr.exec:\flrfllr.exe119⤵PID:3480
-
\??\c:\htthhh.exec:\htthhh.exe120⤵PID:4008
-
\??\c:\djppd.exec:\djppd.exe121⤵PID:3308
-
\??\c:\pvddp.exec:\pvddp.exe122⤵PID:4352
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-