Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17-05-2024 01:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7559552f1f2536e6f8bbf7acedbcdfe0_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
7559552f1f2536e6f8bbf7acedbcdfe0_NeikiAnalytics.exe
-
Size
460KB
-
MD5
7559552f1f2536e6f8bbf7acedbcdfe0
-
SHA1
2bb40a79f2ed2139b3ec539b1519a76f6c11a914
-
SHA256
92102c167e79ba491b34894303a0668f3088c38cbeb307559e5a4d2cdfc4b79a
-
SHA512
23568b74319e6874a5f8b86fa3a9aa7ca645ebb52f2b1712f1380f7046fbe773598bf839ec41e9a26fb45defee7eefa435925ac3734564bf776a6b0950890d55
-
SSDEEP
6144:n3C9BRo7tvnJ9Fywhk/TJTaYvMmr3C9BRo7tvnJ9Fywhk/TkuX:n3C9ytvn8whkbJTaFmr3C9ytvn8whkb3
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/4564-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3008-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3464-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4948-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4012-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1612-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5016-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4616-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3232-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2460-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3368-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/952-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4092-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1032-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2700-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2620-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3852-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3320-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2932-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/680-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3236-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4912-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3008 dpvjd.exe 4948 lffrlfr.exe 3464 jvvjp.exe 8 3lfxrrl.exe 4012 nbbnhb.exe 1612 djjpd.exe 5016 xrlfrrf.exe 4616 fxrlfxr.exe 3608 7tnbnh.exe 3232 vjjvj.exe 2460 htnbnh.exe 3368 jvpdp.exe 4632 rflrfxr.exe 952 5vvpd.exe 4092 rxrfxlx.exe 1032 vjjdv.exe 2700 3llfrrf.exe 3964 bttntn.exe 2840 3djdd.exe 2620 vpvpv.exe 3852 xxxlxlx.exe 3320 hnntnb.exe 2212 rllxlfx.exe 4164 bntnnh.exe 2932 5rlfrrl.exe 412 tbhbnh.exe 680 ffxrlfr.exe 1876 jvdvp.exe 3236 tbhbnn.exe 4912 jvvpj.exe 4768 dvdvp.exe 4140 xllfxrl.exe 2660 hbbttt.exe 1840 hbbthh.exe 1588 dpdvv.exe 4404 rllfrrl.exe 2472 tnnhbb.exe 4348 dddvp.exe 4412 ffffffx.exe 3432 bnhbtt.exe 4564 vdjdv.exe 4340 llfxrlf.exe 2672 tttntt.exe 1252 ttnnbt.exe 1388 fxffxxx.exe 4168 bhtnhh.exe 3940 htbbtb.exe 1620 vjvjv.exe 4712 7llxlfr.exe 2128 hhtnnn.exe 4576 vpdvv.exe 4624 lxfxxxr.exe 2312 9rxxrrf.exe 3088 hthhnn.exe 2676 pjpjj.exe 5072 rffrrll.exe 1288 bttnbt.exe 2716 jdjdv.exe 4600 5vdvj.exe 4880 thnnhh.exe 2816 ppvvv.exe 1536 1jvpj.exe 4080 frlrfrx.exe 1356 1hhhbb.exe -
resource yara_rule behavioral2/memory/4564-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3008-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3464-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/8-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4948-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/8-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1612-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3232-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2460-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3368-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/952-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4092-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1032-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2700-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3852-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3320-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2932-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/680-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-196-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4564 wrote to memory of 3008 4564 7559552f1f2536e6f8bbf7acedbcdfe0_NeikiAnalytics.exe 82 PID 4564 wrote to memory of 3008 4564 7559552f1f2536e6f8bbf7acedbcdfe0_NeikiAnalytics.exe 82 PID 4564 wrote to memory of 3008 4564 7559552f1f2536e6f8bbf7acedbcdfe0_NeikiAnalytics.exe 82 PID 3008 wrote to memory of 4948 3008 dpvjd.exe 83 PID 3008 wrote to memory of 4948 3008 dpvjd.exe 83 PID 3008 wrote to memory of 4948 3008 dpvjd.exe 83 PID 4948 wrote to memory of 3464 4948 lffrlfr.exe 84 PID 4948 wrote to memory of 3464 4948 lffrlfr.exe 84 PID 4948 wrote to memory of 3464 4948 lffrlfr.exe 84 PID 3464 wrote to memory of 8 3464 jvvjp.exe 85 PID 3464 wrote to memory of 8 3464 jvvjp.exe 85 PID 3464 wrote to memory of 8 3464 jvvjp.exe 85 PID 8 wrote to memory of 4012 8 3lfxrrl.exe 86 PID 8 wrote to memory of 4012 8 3lfxrrl.exe 86 PID 8 wrote to memory of 4012 8 3lfxrrl.exe 86 PID 4012 wrote to memory of 1612 4012 nbbnhb.exe 88 PID 4012 wrote to memory of 1612 4012 nbbnhb.exe 88 PID 4012 wrote to memory of 1612 4012 nbbnhb.exe 88 PID 1612 wrote to memory of 5016 1612 djjpd.exe 89 PID 1612 wrote to memory of 5016 1612 djjpd.exe 89 PID 1612 wrote to memory of 5016 1612 djjpd.exe 89 PID 5016 wrote to memory of 4616 5016 xrlfrrf.exe 92 PID 5016 wrote to memory of 4616 5016 xrlfrrf.exe 92 PID 5016 wrote to memory of 4616 5016 xrlfrrf.exe 92 PID 4616 wrote to memory of 3608 4616 fxrlfxr.exe 93 PID 4616 wrote to memory of 3608 4616 fxrlfxr.exe 93 PID 4616 wrote to memory of 3608 4616 fxrlfxr.exe 93 PID 3608 wrote to memory of 3232 3608 7tnbnh.exe 94 PID 3608 wrote to memory of 3232 3608 7tnbnh.exe 94 PID 3608 wrote to memory of 3232 3608 7tnbnh.exe 94 PID 3232 wrote to memory of 2460 3232 vjjvj.exe 95 PID 3232 wrote to memory of 2460 3232 vjjvj.exe 95 PID 3232 wrote to memory of 2460 3232 vjjvj.exe 95 PID 2460 wrote to memory of 3368 2460 htnbnh.exe 96 PID 2460 wrote to memory of 3368 2460 htnbnh.exe 96 PID 2460 wrote to memory of 3368 2460 htnbnh.exe 96 PID 3368 wrote to memory of 4632 3368 jvpdp.exe 97 PID 3368 wrote to memory of 4632 3368 jvpdp.exe 97 PID 3368 wrote to memory of 4632 3368 jvpdp.exe 97 PID 4632 wrote to memory of 952 4632 rflrfxr.exe 98 PID 4632 wrote to memory of 952 4632 rflrfxr.exe 98 PID 4632 wrote to memory of 952 4632 rflrfxr.exe 98 PID 952 wrote to memory of 4092 952 5vvpd.exe 99 PID 952 wrote to memory of 4092 952 5vvpd.exe 99 PID 952 wrote to memory of 4092 952 5vvpd.exe 99 PID 4092 wrote to memory of 1032 4092 rxrfxlx.exe 100 PID 4092 wrote to memory of 1032 4092 rxrfxlx.exe 100 PID 4092 wrote to memory of 1032 4092 rxrfxlx.exe 100 PID 1032 wrote to memory of 2700 1032 vjjdv.exe 101 PID 1032 wrote to memory of 2700 1032 vjjdv.exe 101 PID 1032 wrote to memory of 2700 1032 vjjdv.exe 101 PID 2700 wrote to memory of 3964 2700 3llfrrf.exe 102 PID 2700 wrote to memory of 3964 2700 3llfrrf.exe 102 PID 2700 wrote to memory of 3964 2700 3llfrrf.exe 102 PID 3964 wrote to memory of 2840 3964 bttntn.exe 103 PID 3964 wrote to memory of 2840 3964 bttntn.exe 103 PID 3964 wrote to memory of 2840 3964 bttntn.exe 103 PID 2840 wrote to memory of 2620 2840 3djdd.exe 104 PID 2840 wrote to memory of 2620 2840 3djdd.exe 104 PID 2840 wrote to memory of 2620 2840 3djdd.exe 104 PID 2620 wrote to memory of 3852 2620 vpvpv.exe 105 PID 2620 wrote to memory of 3852 2620 vpvpv.exe 105 PID 2620 wrote to memory of 3852 2620 vpvpv.exe 105 PID 3852 wrote to memory of 3320 3852 xxxlxlx.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\7559552f1f2536e6f8bbf7acedbcdfe0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7559552f1f2536e6f8bbf7acedbcdfe0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\dpvjd.exec:\dpvjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\lffrlfr.exec:\lffrlfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\jvvjp.exec:\jvvjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
\??\c:\3lfxrrl.exec:\3lfxrrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\nbbnhb.exec:\nbbnhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\djjpd.exec:\djjpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\xrlfrrf.exec:\xrlfrrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\fxrlfxr.exec:\fxrlfxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\7tnbnh.exec:\7tnbnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\vjjvj.exec:\vjjvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\htnbnh.exec:\htnbnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\jvpdp.exec:\jvpdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\rflrfxr.exec:\rflrfxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\5vvpd.exec:\5vvpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
\??\c:\rxrfxlx.exec:\rxrfxlx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\vjjdv.exec:\vjjdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\3llfrrf.exec:\3llfrrf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\bttntn.exec:\bttntn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\3djdd.exec:\3djdd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\vpvpv.exec:\vpvpv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\xxxlxlx.exec:\xxxlxlx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\hnntnb.exec:\hnntnb.exe23⤵
- Executes dropped EXE
PID:3320 -
\??\c:\rllxlfx.exec:\rllxlfx.exe24⤵
- Executes dropped EXE
PID:2212 -
\??\c:\bntnnh.exec:\bntnnh.exe25⤵
- Executes dropped EXE
PID:4164 -
\??\c:\5rlfrrl.exec:\5rlfrrl.exe26⤵
- Executes dropped EXE
PID:2932 -
\??\c:\tbhbnh.exec:\tbhbnh.exe27⤵
- Executes dropped EXE
PID:412 -
\??\c:\ffxrlfr.exec:\ffxrlfr.exe28⤵
- Executes dropped EXE
PID:680 -
\??\c:\jvdvp.exec:\jvdvp.exe29⤵
- Executes dropped EXE
PID:1876 -
\??\c:\tbhbnn.exec:\tbhbnn.exe30⤵
- Executes dropped EXE
PID:3236 -
\??\c:\jvvpj.exec:\jvvpj.exe31⤵
- Executes dropped EXE
PID:4912 -
\??\c:\dvdvp.exec:\dvdvp.exe32⤵
- Executes dropped EXE
PID:4768 -
\??\c:\xllfxrl.exec:\xllfxrl.exe33⤵
- Executes dropped EXE
PID:4140 -
\??\c:\hbbttt.exec:\hbbttt.exe34⤵
- Executes dropped EXE
PID:2660 -
\??\c:\hbbthh.exec:\hbbthh.exe35⤵
- Executes dropped EXE
PID:1840 -
\??\c:\dpdvv.exec:\dpdvv.exe36⤵
- Executes dropped EXE
PID:1588 -
\??\c:\rllfrrl.exec:\rllfrrl.exe37⤵
- Executes dropped EXE
PID:4404 -
\??\c:\tnnhbb.exec:\tnnhbb.exe38⤵
- Executes dropped EXE
PID:2472 -
\??\c:\dddvp.exec:\dddvp.exe39⤵
- Executes dropped EXE
PID:4348 -
\??\c:\ffffffx.exec:\ffffffx.exe40⤵
- Executes dropped EXE
PID:4412 -
\??\c:\bnhbtt.exec:\bnhbtt.exe41⤵
- Executes dropped EXE
PID:3432 -
\??\c:\vdjdv.exec:\vdjdv.exe42⤵
- Executes dropped EXE
PID:4564 -
\??\c:\llfxrlf.exec:\llfxrlf.exe43⤵
- Executes dropped EXE
PID:4340 -
\??\c:\tttntt.exec:\tttntt.exe44⤵
- Executes dropped EXE
PID:2672 -
\??\c:\ttnnbt.exec:\ttnnbt.exe45⤵
- Executes dropped EXE
PID:1252 -
\??\c:\fxffxxx.exec:\fxffxxx.exe46⤵
- Executes dropped EXE
PID:1388 -
\??\c:\bhtnhh.exec:\bhtnhh.exe47⤵
- Executes dropped EXE
PID:4168 -
\??\c:\htbbtb.exec:\htbbtb.exe48⤵
- Executes dropped EXE
PID:3940 -
\??\c:\vjvjv.exec:\vjvjv.exe49⤵
- Executes dropped EXE
PID:1620 -
\??\c:\7llxlfr.exec:\7llxlfr.exe50⤵
- Executes dropped EXE
PID:4712 -
\??\c:\hhtnnn.exec:\hhtnnn.exe51⤵
- Executes dropped EXE
PID:2128 -
\??\c:\vpdvv.exec:\vpdvv.exe52⤵
- Executes dropped EXE
PID:4576 -
\??\c:\lxfxxxr.exec:\lxfxxxr.exe53⤵
- Executes dropped EXE
PID:4624 -
\??\c:\9rxxrrf.exec:\9rxxrrf.exe54⤵
- Executes dropped EXE
PID:2312 -
\??\c:\hthhnn.exec:\hthhnn.exe55⤵
- Executes dropped EXE
PID:3088 -
\??\c:\pjpjj.exec:\pjpjj.exe56⤵
- Executes dropped EXE
PID:2676 -
\??\c:\rffrrll.exec:\rffrrll.exe57⤵
- Executes dropped EXE
PID:5072 -
\??\c:\bttnbt.exec:\bttnbt.exe58⤵
- Executes dropped EXE
PID:1288 -
\??\c:\jdjdv.exec:\jdjdv.exe59⤵
- Executes dropped EXE
PID:2716 -
\??\c:\5vdvj.exec:\5vdvj.exe60⤵
- Executes dropped EXE
PID:4600 -
\??\c:\thnnhh.exec:\thnnhh.exe61⤵
- Executes dropped EXE
PID:4880 -
\??\c:\ppvvv.exec:\ppvvv.exe62⤵
- Executes dropped EXE
PID:2816 -
\??\c:\1jvpj.exec:\1jvpj.exe63⤵
- Executes dropped EXE
PID:1536 -
\??\c:\frlrfrx.exec:\frlrfrx.exe64⤵
- Executes dropped EXE
PID:4080 -
\??\c:\1hhhbb.exec:\1hhhbb.exe65⤵
- Executes dropped EXE
PID:1356 -
\??\c:\3tbttt.exec:\3tbttt.exe66⤵PID:3544
-
\??\c:\rlrfxlf.exec:\rlrfxlf.exe67⤵PID:1576
-
\??\c:\rrxxllf.exec:\rrxxllf.exe68⤵PID:4696
-
\??\c:\nhhbtn.exec:\nhhbtn.exe69⤵PID:632
-
\??\c:\dvvjv.exec:\dvvjv.exe70⤵PID:440
-
\??\c:\fxxrffx.exec:\fxxrffx.exe71⤵PID:4720
-
\??\c:\nntnnt.exec:\nntnnt.exe72⤵PID:4968
-
\??\c:\1nnnhh.exec:\1nnnhh.exe73⤵PID:3472
-
\??\c:\9rrlxxl.exec:\9rrlxxl.exe74⤵PID:3592
-
\??\c:\nhbtbb.exec:\nhbtbb.exe75⤵PID:3096
-
\??\c:\7vvpj.exec:\7vvpj.exe76⤵PID:4044
-
\??\c:\fxxxrlf.exec:\fxxxrlf.exe77⤵PID:4980
-
\??\c:\flrrllf.exec:\flrrllf.exe78⤵PID:4736
-
\??\c:\hnnbnn.exec:\hnnbnn.exe79⤵PID:680
-
\??\c:\3pjpp.exec:\3pjpp.exe80⤵PID:2328
-
\??\c:\9lfrfrr.exec:\9lfrfrr.exe81⤵PID:4852
-
\??\c:\httnhb.exec:\httnhb.exe82⤵PID:2400
-
\??\c:\nhhhht.exec:\nhhhht.exe83⤵PID:4892
-
\??\c:\3jjdd.exec:\3jjdd.exe84⤵PID:3244
-
\??\c:\xfllxxr.exec:\xfllxxr.exe85⤵PID:2556
-
\??\c:\nthbtn.exec:\nthbtn.exe86⤵PID:1688
-
\??\c:\3hhhbb.exec:\3hhhbb.exe87⤵PID:4704
-
\??\c:\vjpdv.exec:\vjpdv.exe88⤵PID:4064
-
\??\c:\rlxxxxf.exec:\rlxxxxf.exe89⤵PID:1744
-
\??\c:\lfrxffl.exec:\lfrxffl.exe90⤵PID:4612
-
\??\c:\bnhbbb.exec:\bnhbbb.exe91⤵PID:4400
-
\??\c:\dvdvp.exec:\dvdvp.exe92⤵PID:4136
-
\??\c:\jjjpj.exec:\jjjpj.exe93⤵PID:4960
-
\??\c:\lrfxllf.exec:\lrfxllf.exe94⤵PID:1784
-
\??\c:\7tnnnh.exec:\7tnnnh.exe95⤵PID:3536
-
\??\c:\jvdvv.exec:\jvdvv.exe96⤵PID:1852
-
\??\c:\lflfxxf.exec:\lflfxxf.exe97⤵PID:1488
-
\??\c:\nbtbnh.exec:\nbtbnh.exe98⤵PID:2452
-
\??\c:\pppjd.exec:\pppjd.exe99⤵PID:3932
-
\??\c:\xffxlxr.exec:\xffxlxr.exe100⤵PID:1504
-
\??\c:\tntnhh.exec:\tntnhh.exe101⤵PID:3772
-
\??\c:\bbbntn.exec:\bbbntn.exe102⤵PID:1772
-
\??\c:\jdjvj.exec:\jdjvj.exe103⤵PID:3000
-
\??\c:\lxlfrrl.exec:\lxlfrrl.exe104⤵PID:4424
-
\??\c:\frrxrrl.exec:\frrxrrl.exe105⤵PID:2776
-
\??\c:\3tntnb.exec:\3tntnb.exe106⤵PID:2132
-
\??\c:\vjdjv.exec:\vjdjv.exe107⤵PID:3348
-
\??\c:\xrrlxxr.exec:\xrrlxxr.exe108⤵PID:5092
-
\??\c:\xrlffxx.exec:\xrlffxx.exe109⤵PID:1516
-
\??\c:\hntnhh.exec:\hntnhh.exe110⤵PID:3896
-
\??\c:\ppjpj.exec:\ppjpj.exe111⤵PID:1040
-
\??\c:\dpvpp.exec:\dpvpp.exe112⤵PID:2816
-
\??\c:\llxrxrx.exec:\llxrxrx.exe113⤵PID:2020
-
\??\c:\tnnhbt.exec:\tnnhbt.exe114⤵PID:1032
-
\??\c:\5tttnn.exec:\5tttnn.exe115⤵PID:2420
-
\??\c:\ddjdv.exec:\ddjdv.exe116⤵PID:3964
-
\??\c:\xrrlffx.exec:\xrrlffx.exe117⤵PID:2840
-
\??\c:\rlxxfxl.exec:\rlxxfxl.exe118⤵PID:4688
-
\??\c:\bnbbnt.exec:\bnbbnt.exe119⤵PID:1456
-
\??\c:\dpvpp.exec:\dpvpp.exe120⤵PID:1528
-
\??\c:\5xfxrrl.exec:\5xfxrrl.exe121⤵PID:4968
-
\??\c:\1rxrfff.exec:\1rxrfff.exe122⤵PID:4380
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-