Analysis
- max time kernel
149s - max time network
128s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
17/05/2024, 23:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
567a1cd76cb5b4428b7ce4c074274000_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
- Target 567a1cd76cb5b4428b7ce4c074274000_NeikiAnalytics.exe
- Size 95KB
- Sample240517-3vsxcahf2w
- SHA256 af1d56a461467db6783e45b1affa03ead67936a0860f1a094205947b52f5b5e9
- MD5 567a1cd76cb5b4428b7ce4c074274000
- SHA1 c12e24e094f5789ef83c40ddde51e048dbefe696
- SHA512 2a2c2981dc8c82f622f2a265b168cb76190ab7d2c5843911649f14341f0451129fa7c947db2f9b62b157b693a539d9a230fb0e86d32bb96dc6e430ce79d7d4a1
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qP1hvZo66Ox4oq2SQwfTX:ymb3NkkiQ3mdBjFIj+qNhvZuHQYb
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/1600-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4116-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/864-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1296-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1956-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4300-48-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4300-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3164-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4624-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1292-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/464-81-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/464-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/212-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3624-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2692-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4044-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4072-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2328-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/752-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2808-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1944-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1632-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2612-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2268-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4396-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 4116 hhtntt.exe 864 vjdvv.exe 1296 lllfxxf.exe 1956 thnhnh.exe 3164 vvvvp.exe 4300 rxlxffr.exe 4624 xxxfxxr.exe 1292 jvjdj.exe 3624 jddvv.exe 464 rfrllfx.exe 212 fflflxf.exe 2692 thttnh.exe 4044 vvpjv.exe 728 9rfxrrr.exe 4072 tnhbth.exe 2328 llfffrr.exe 5108 xrrrrrr.exe 752 djvjj.exe 756 1jpjj.exe 1528 bbnbtb.exe 2808 ttbtnh.exe 1032 jdjdd.exe 1644 1ffxxrr.exe 1988 nthnbt.exe 1944 1pddp.exe 1632 rffxfxf.exe 2612 xlrlxfl.exe 2268 hhtnbt.exe 4396 pdjvp.exe 1600 rfffxrr.exe 392 hnbnnn.exe 1420 pvvpj.exe 1284 frxrrlf.exe 4292 lxfffxx.exe 1972 thntbn.exe 1880 vdvdp.exe 3360 pdpdj.exe 3456 xlxllxl.exe 1204 btttbn.exe 1352 5ppjj.exe 3224 pvjvd.exe 5036 lxrlffl.exe 4692 ntbhbb.exe 2788 bbtnhh.exe 4840 1jddd.exe 4620 djpvv.exe 3864 tnhhnn.exe 1964 vvpdp.exe 4284 pdvjd.exe 972 frxrffx.exe 1912 hhntbh.exe 3060 5jvdd.exe 3964 xlrrrrl.exe 4976 nbhhbh.exe 2808 bhhhbn.exe 336 pjvvp.exe 3236 3lllflf.exe 2504 bbnnnn.exe 384 dvdvp.exe 4856 fxlfxxf.exe 1108 3hhbtt.exe 1212 bnnhnh.exe 1432 pdpjj.exe 4824 jdjdp.exe -
resource yara_rule behavioral2/memory/1600-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4116-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/864-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1296-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1956-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4300-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3164-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4624-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1292-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/464-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/212-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3624-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4624-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2692-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4072-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/752-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2808-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1944-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1632-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2612-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2268-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4396-195-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1600 wrote to memory of 4116 1600 567a1cd76cb5b4428b7ce4c074274000_NeikiAnalytics.exe 90 PID 1600 wrote to memory of 4116 1600 567a1cd76cb5b4428b7ce4c074274000_NeikiAnalytics.exe 90 PID 1600 wrote to memory of 4116 1600 567a1cd76cb5b4428b7ce4c074274000_NeikiAnalytics.exe 90 PID 4116 wrote to memory of 864 4116 hhtntt.exe 91 PID 4116 wrote to memory of 864 4116 hhtntt.exe 91 PID 4116 wrote to memory of 864 4116 hhtntt.exe 91 PID 864 wrote to memory of 1296 864 vjdvv.exe 92 PID 864 wrote to memory of 1296 864 vjdvv.exe 92 PID 864 wrote to memory of 1296 864 vjdvv.exe 92 PID 1296 wrote to memory of 1956 1296 lllfxxf.exe 93 PID 1296 wrote to memory of 1956 1296 lllfxxf.exe 93 PID 1296 wrote to memory of 1956 1296 lllfxxf.exe 93 PID 1956 wrote to memory of 3164 1956 thnhnh.exe 94 PID 1956 wrote to memory of 3164 1956 thnhnh.exe 94 PID 1956 wrote to memory of 3164 1956 thnhnh.exe 94 PID 3164 wrote to memory of 4300 3164 vvvvp.exe 95 PID 3164 wrote to memory of 4300 3164 vvvvp.exe 95 PID 3164 wrote to memory of 4300 3164 vvvvp.exe 95 PID 4300 wrote to memory of 4624 4300 rxlxffr.exe 96 PID 4300 wrote to memory of 4624 4300 rxlxffr.exe 96 PID 4300 wrote to memory of 4624 4300 rxlxffr.exe 96 PID 4624 wrote to memory of 1292 4624 xxxfxxr.exe 97 PID 4624 wrote to memory of 1292 4624 xxxfxxr.exe 97 PID 4624 wrote to memory of 1292 4624 xxxfxxr.exe 97 PID 1292 wrote to memory of 3624 1292 jvjdj.exe 98 PID 1292 wrote to memory of 3624 1292 jvjdj.exe 98 PID 1292 wrote to memory of 3624 1292 jvjdj.exe 98 PID 3624 wrote to memory of 464 3624 jddvv.exe 99 PID 3624 wrote to memory of 464 3624 jddvv.exe 99 PID 3624 wrote to memory of 464 3624 jddvv.exe 99 PID 464 wrote to memory of 212 464 rfrllfx.exe 100 PID 464 wrote to memory of 212 464 rfrllfx.exe 100 PID 464 wrote to memory of 212 464 rfrllfx.exe 100 PID 212 wrote to memory of 2692 212 fflflxf.exe 101 PID 212 wrote to memory of 2692 212 fflflxf.exe 101 PID 212 wrote to memory of 2692 212 fflflxf.exe 101 PID 2692 wrote to memory of 4044 2692 thttnh.exe 102 PID 2692 wrote to memory of 4044 2692 thttnh.exe 102 PID 2692 wrote to memory of 4044 2692 thttnh.exe 102 PID 4044 wrote to memory of 728 4044 vvpjv.exe 103 PID 4044 wrote to memory of 728 4044 vvpjv.exe 103 PID 4044 wrote to memory of 728 4044 vvpjv.exe 103 PID 728 wrote to memory of 4072 728 9rfxrrr.exe 104 PID 728 wrote to memory of 4072 728 9rfxrrr.exe 104 PID 728 wrote to memory of 4072 728 9rfxrrr.exe 104 PID 4072 wrote to memory of 2328 4072 tnhbth.exe 105 PID 4072 wrote to memory of 2328 4072 tnhbth.exe 105 PID 4072 wrote to memory of 2328 4072 tnhbth.exe 105 PID 2328 wrote to memory of 5108 2328 llfffrr.exe 106 PID 2328 wrote to memory of 5108 2328 llfffrr.exe 106 PID 2328 wrote to memory of 5108 2328 llfffrr.exe 106 PID 5108 wrote to memory of 752 5108 xrrrrrr.exe 107 PID 5108 wrote to memory of 752 5108 xrrrrrr.exe 107 PID 5108 wrote to memory of 752 5108 xrrrrrr.exe 107 PID 752 wrote to memory of 756 752 djvjj.exe 108 PID 752 wrote to memory of 756 752 djvjj.exe 108 PID 752 wrote to memory of 756 752 djvjj.exe 108 PID 756 wrote to memory of 1528 756 1jpjj.exe 109 PID 756 wrote to memory of 1528 756 1jpjj.exe 109 PID 756 wrote to memory of 1528 756 1jpjj.exe 109 PID 1528 wrote to memory of 2808 1528 bbnbtb.exe 110 PID 1528 wrote to memory of 2808 1528 bbnbtb.exe 110 PID 1528 wrote to memory of 2808 1528 bbnbtb.exe 110 PID 2808 wrote to memory of 1032 2808 ttbtnh.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\567a1cd76cb5b4428b7ce4c074274000_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\567a1cd76cb5b4428b7ce4c074274000_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\hhtntt.exec:\hhtntt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\vjdvv.exec:\vjdvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\lllfxxf.exec:\lllfxxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\thnhnh.exec:\thnhnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\vvvvp.exec:\vvvvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\rxlxffr.exec:\rxlxffr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\xxxfxxr.exec:\xxxfxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\jvjdj.exec:\jvjdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\jddvv.exec:\jddvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\rfrllfx.exec:\rfrllfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\fflflxf.exec:\fflflxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\thttnh.exec:\thttnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\vvpjv.exec:\vvpjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\9rfxrrr.exec:\9rfxrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:728 -
\??\c:\tnhbth.exec:\tnhbth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
\??\c:\llfffrr.exec:\llfffrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\xrrrrrr.exec:\xrrrrrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\djvjj.exec:\djvjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\1jpjj.exec:\1jpjj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\bbnbtb.exec:\bbnbtb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\ttbtnh.exec:\ttbtnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\jdjdd.exec:\jdjdd.exe23⤵
- Executes dropped EXE
PID:1032 -
\??\c:\1ffxxrr.exec:\1ffxxrr.exe24⤵
- Executes dropped EXE
PID:1644 -
\??\c:\nthnbt.exec:\nthnbt.exe25⤵
- Executes dropped EXE
PID:1988 -
\??\c:\1pddp.exec:\1pddp.exe26⤵
- Executes dropped EXE
PID:1944 -
\??\c:\rffxfxf.exec:\rffxfxf.exe27⤵
- Executes dropped EXE
PID:1632 -
\??\c:\xlrlxfl.exec:\xlrlxfl.exe28⤵
- Executes dropped EXE
PID:2612 -
\??\c:\hhtnbt.exec:\hhtnbt.exe29⤵
- Executes dropped EXE
PID:2268 -
\??\c:\pdjvp.exec:\pdjvp.exe30⤵
- Executes dropped EXE
PID:4396 -
\??\c:\rfffxrr.exec:\rfffxrr.exe31⤵
- Executes dropped EXE
PID:1600 -
\??\c:\hnbnnn.exec:\hnbnnn.exe32⤵
- Executes dropped EXE
PID:392 -
\??\c:\pvvpj.exec:\pvvpj.exe33⤵
- Executes dropped EXE
PID:1420 -
\??\c:\frxrrlf.exec:\frxrrlf.exe34⤵
- Executes dropped EXE
PID:1284 -
\??\c:\lxfffxx.exec:\lxfffxx.exe35⤵
- Executes dropped EXE
PID:4292 -
\??\c:\thntbn.exec:\thntbn.exe36⤵
- Executes dropped EXE
PID:1972 -
\??\c:\vdvdp.exec:\vdvdp.exe37⤵
- Executes dropped EXE
PID:1880 -
\??\c:\pdpdj.exec:\pdpdj.exe38⤵
- Executes dropped EXE
PID:3360 -
\??\c:\xlxllxl.exec:\xlxllxl.exe39⤵
- Executes dropped EXE
PID:3456 -
\??\c:\btttbn.exec:\btttbn.exe40⤵
- Executes dropped EXE
PID:1204 -
\??\c:\5ppjj.exec:\5ppjj.exe41⤵
- Executes dropped EXE
PID:1352 -
\??\c:\pvjvd.exec:\pvjvd.exe42⤵
- Executes dropped EXE
PID:3224 -
\??\c:\lxrlffl.exec:\lxrlffl.exe43⤵
- Executes dropped EXE
PID:5036 -
\??\c:\ntbhbb.exec:\ntbhbb.exe44⤵
- Executes dropped EXE
PID:4692 -
\??\c:\bbtnhh.exec:\bbtnhh.exe45⤵
- Executes dropped EXE
PID:2788 -
\??\c:\1jddd.exec:\1jddd.exe46⤵
- Executes dropped EXE
PID:4840 -
\??\c:\djpvv.exec:\djpvv.exe47⤵
- Executes dropped EXE
PID:4620 -
\??\c:\tnhhnn.exec:\tnhhnn.exe48⤵
- Executes dropped EXE
PID:3864 -
\??\c:\vvpdp.exec:\vvpdp.exe49⤵
- Executes dropped EXE
PID:1964 -
\??\c:\pdvjd.exec:\pdvjd.exe50⤵
- Executes dropped EXE
PID:4284 -
\??\c:\frxrffx.exec:\frxrffx.exe51⤵
- Executes dropped EXE
PID:972 -
\??\c:\hhntbh.exec:\hhntbh.exe52⤵
- Executes dropped EXE
PID:1912 -
\??\c:\5jvdd.exec:\5jvdd.exe53⤵
- Executes dropped EXE
PID:3060 -
\??\c:\xlrrrrl.exec:\xlrrrrl.exe54⤵
- Executes dropped EXE
PID:3964 -
\??\c:\nbhhbh.exec:\nbhhbh.exe55⤵
- Executes dropped EXE
PID:4976 -
\??\c:\bhhhbn.exec:\bhhhbn.exe56⤵
- Executes dropped EXE
PID:2808 -
\??\c:\pjvvp.exec:\pjvvp.exe57⤵
- Executes dropped EXE
PID:336 -
\??\c:\3lllflf.exec:\3lllflf.exe58⤵
- Executes dropped EXE
PID:3236 -
\??\c:\bbnnnn.exec:\bbnnnn.exe59⤵
- Executes dropped EXE
PID:2504 -
\??\c:\dvdvp.exec:\dvdvp.exe60⤵
- Executes dropped EXE
PID:384 -
\??\c:\fxlfxxf.exec:\fxlfxxf.exe61⤵
- Executes dropped EXE
PID:4856 -
\??\c:\3hhbtt.exec:\3hhbtt.exe62⤵
- Executes dropped EXE
PID:1108 -
\??\c:\bnnhnh.exec:\bnnhnh.exe63⤵
- Executes dropped EXE
PID:1212 -
\??\c:\pdpjj.exec:\pdpjj.exe64⤵
- Executes dropped EXE
PID:1432 -
\??\c:\jdjdp.exec:\jdjdp.exe65⤵
- Executes dropped EXE
PID:4824 -
\??\c:\rrrxrrr.exec:\rrrxrrr.exe66⤵PID:1872
-
\??\c:\frxrfff.exec:\frxrfff.exe67⤵PID:2184
-
\??\c:\tnthtb.exec:\tnthtb.exe68⤵PID:1444
-
\??\c:\vjpjd.exec:\vjpjd.exe69⤵PID:1736
-
\??\c:\jppjd.exec:\jppjd.exe70⤵PID:2416
-
\??\c:\xrlfxxx.exec:\xrlfxxx.exe71⤵PID:1956
-
\??\c:\thnbhb.exec:\thnbhb.exe72⤵PID:4984
-
\??\c:\3vdpd.exec:\3vdpd.exe73⤵PID:4660
-
\??\c:\rflfxfr.exec:\rflfxfr.exe74⤵PID:4580
-
\??\c:\xxffxff.exec:\xxffxff.exe75⤵PID:948
-
\??\c:\thbtnh.exec:\thbtnh.exe76⤵PID:4456
-
\??\c:\pjppp.exec:\pjppp.exe77⤵PID:5052
-
\??\c:\3pdvv.exec:\3pdvv.exe78⤵PID:3448
-
\??\c:\3flfrll.exec:\3flfrll.exe79⤵PID:4520
-
\??\c:\rrfxllr.exec:\rrfxllr.exe80⤵PID:1060
-
\??\c:\jjjdd.exec:\jjjdd.exe81⤵PID:4840
-
\??\c:\pvjdv.exec:\pvjdv.exe82⤵PID:4672
-
\??\c:\xlxrxxl.exec:\xlxrxxl.exe83⤵PID:4072
-
\??\c:\hthttb.exec:\hthttb.exe84⤵PID:3996
-
\??\c:\5htbtn.exec:\5htbtn.exe85⤵PID:2328
-
\??\c:\vvdjp.exec:\vvdjp.exe86⤵PID:2232
-
\??\c:\frlrxxr.exec:\frlrxxr.exe87⤵PID:756
-
\??\c:\frfxffl.exec:\frfxffl.exe88⤵PID:3328
-
\??\c:\thhhhh.exec:\thhhhh.exe89⤵PID:112
-
\??\c:\nthbtt.exec:\nthbtt.exe90⤵PID:3924
-
\??\c:\jdvvd.exec:\jdvvd.exe91⤵PID:4472
-
\??\c:\rlrlfrl.exec:\rlrlfrl.exe92⤵PID:4508
-
\??\c:\frlfffx.exec:\frlfffx.exe93⤵PID:1576
-
\??\c:\5nnhbb.exec:\5nnhbb.exe94⤵PID:1056
-
\??\c:\jppdv.exec:\jppdv.exe95⤵PID:384
-
\??\c:\jjdpv.exec:\jjdpv.exe96⤵PID:2612
-
\??\c:\lffxrrl.exec:\lffxrrl.exe97⤵PID:1752
-
\??\c:\fllxflr.exec:\fllxflr.exe98⤵PID:5096
-
\??\c:\3tthbb.exec:\3tthbb.exe99⤵PID:216
-
\??\c:\ddjdd.exec:\ddjdd.exe100⤵PID:4824
-
\??\c:\5vpjv.exec:\5vpjv.exe101⤵PID:1676
-
\??\c:\lffxllf.exec:\lffxllf.exe102⤵PID:1420
-
\??\c:\9bbtth.exec:\9bbtth.exe103⤵PID:1284
-
\??\c:\pdpjj.exec:\pdpjj.exe104⤵PID:4384
-
\??\c:\rlfllrl.exec:\rlfllrl.exe105⤵PID:1972
-
\??\c:\fxfrllf.exec:\fxfrllf.exe106⤵PID:1880
-
\??\c:\bttnhn.exec:\bttnhn.exe107⤵PID:3360
-
\??\c:\nnttnn.exec:\nnttnn.exe108⤵PID:2680
-
\??\c:\dvdvp.exec:\dvdvp.exe109⤵PID:2116
-
\??\c:\pjppj.exec:\pjppj.exe110⤵PID:2468
-
\??\c:\ttttnt.exec:\ttttnt.exe111⤵PID:3224
-
\??\c:\jjppp.exec:\jjppp.exe112⤵PID:1692
-
\??\c:\flxrrxr.exec:\flxrrxr.exe113⤵PID:4520
-
\??\c:\5lrrllf.exec:\5lrrllf.exe114⤵PID:3832
-
\??\c:\1nhhnn.exec:\1nhhnn.exe115⤵PID:1964
-
\??\c:\bnbbhb.exec:\bnbbhb.exe116⤵PID:3256
-
\??\c:\7jvpj.exec:\7jvpj.exe117⤵PID:1996
-
\??\c:\5vdvp.exec:\5vdvp.exe118⤵PID:1684
-
\??\c:\xrrfrrf.exec:\xrrfrrf.exe119⤵PID:1020
-
\??\c:\lllffrl.exec:\lllffrl.exe120⤵PID:2420
-
\??\c:\3nbbbb.exec:\3nbbbb.exe121⤵PID:4540
-
\??\c:\btnbnn.exec:\btnbnn.exe122⤵PID:336
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-