Analysis
- max time kernel
150s - max time network
122s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 02:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
75d925408b1f605264104a454b473110_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
- Target 75d925408b1f605264104a454b473110_NeikiAnalytics.exe
- Size 78KB
- Sample240518-cs6sbafg89
- SHA256 b70394bb3ed5bee34bd388558e9cd38cca3828b03219e5cf7b4e9bef7abcd5db
- MD5 75d925408b1f605264104a454b473110
- SHA1 020c6ddac04e54c215e66b460613096ff1b850bd
- SHA512 73b011e088c23d760341575f3c015439c0e3d2ea7a24579199c4a51aea1a8bcf8794b22414b77babc209cc9ce0b841e719fe5827e8067fc1aff49af333d15de4
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAX8YieVIJclPvPJtcdcU:ymb3NkkiQ3mdBjFo68YBVIJc9JtxU
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/5064-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2236-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2820-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2980-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3160-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2448-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3528-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2152-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3024-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/736-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3492-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4680-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1356-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2532-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2588-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4928-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4456-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2000-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4268-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/988-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4604-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2384-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2920-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3168-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 2236 pvppv.exe 2820 rfrrllr.exe 2980 nhnbbb.exe 3160 ddjvd.exe 2448 bbhbbt.exe 3528 vvvdv.exe 3024 pjjdd.exe 2152 htbbtt.exe 736 nhtttb.exe 3492 rlllfxx.exe 4680 hhtntt.exe 1356 vdvvp.exe 8 jddvj.exe 2532 xffxxxr.exe 2588 tntttt.exe 4928 vddpd.exe 4456 xrxffll.exe 2740 nbbthh.exe 2000 jjppp.exe 4268 vpddv.exe 3868 xfrrrxx.exe 988 9bttnn.exe 4604 jjjpv.exe 2384 pjjdj.exe 2920 fllfxxl.exe 3992 ntthbb.exe 3168 vppdp.exe 2200 djdjd.exe 1484 ffflflf.exe 1396 bbbbtb.exe 2040 ddjvd.exe 2296 fxlfxxr.exe 3600 tthnnn.exe 4332 bhnnnt.exe 2692 vvvpp.exe 1452 rfllrfl.exe 3480 hnbhhn.exe 4944 pdddp.exe 3964 vjdvj.exe 4628 rrllllf.exe 3904 thnhtb.exe 4428 3jppp.exe 4400 vddvv.exe 3272 fxfxfxl.exe 1064 httnnh.exe 412 frllfrl.exe 2820 bhnhbn.exe 1012 vjjdj.exe 3044 xlffrrr.exe 3640 xllrrfl.exe 720 hhhhhh.exe 456 bhhbbn.exe 2212 jdjdd.exe 2656 llxxflx.exe 868 xlrxrll.exe 4876 bhbtnb.exe 980 vdppj.exe 1996 rxrrrxx.exe 4976 fxfrxxx.exe 1772 hthhtb.exe 748 jvpdd.exe 824 fxfffff.exe 1512 lfllflf.exe 4828 bnhnnn.exe -
resource yara_rule behavioral2/memory/5064-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2820-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2820-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2820-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2980-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2448-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3528-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2152-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3024-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/736-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3492-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4680-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1356-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2532-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2588-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4268-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/988-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2384-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3168-184-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5064 wrote to memory of 2236 5064 75d925408b1f605264104a454b473110_NeikiAnalytics.exe 82 PID 5064 wrote to memory of 2236 5064 75d925408b1f605264104a454b473110_NeikiAnalytics.exe 82 PID 5064 wrote to memory of 2236 5064 75d925408b1f605264104a454b473110_NeikiAnalytics.exe 82 PID 2236 wrote to memory of 2820 2236 pvppv.exe 83 PID 2236 wrote to memory of 2820 2236 pvppv.exe 83 PID 2236 wrote to memory of 2820 2236 pvppv.exe 83 PID 2820 wrote to memory of 2980 2820 rfrrllr.exe 84 PID 2820 wrote to memory of 2980 2820 rfrrllr.exe 84 PID 2820 wrote to memory of 2980 2820 rfrrllr.exe 84 PID 2980 wrote to memory of 3160 2980 nhnbbb.exe 85 PID 2980 wrote to memory of 3160 2980 nhnbbb.exe 85 PID 2980 wrote to memory of 3160 2980 nhnbbb.exe 85 PID 3160 wrote to memory of 2448 3160 ddjvd.exe 86 PID 3160 wrote to memory of 2448 3160 ddjvd.exe 86 PID 3160 wrote to memory of 2448 3160 ddjvd.exe 86 PID 2448 wrote to memory of 3528 2448 bbhbbt.exe 87 PID 2448 wrote to memory of 3528 2448 bbhbbt.exe 87 PID 2448 wrote to memory of 3528 2448 bbhbbt.exe 87 PID 3528 wrote to memory of 3024 3528 vvvdv.exe 88 PID 3528 wrote to memory of 3024 3528 vvvdv.exe 88 PID 3528 wrote to memory of 3024 3528 vvvdv.exe 88 PID 3024 wrote to memory of 2152 3024 pjjdd.exe 89 PID 3024 wrote to memory of 2152 3024 pjjdd.exe 89 PID 3024 wrote to memory of 2152 3024 pjjdd.exe 89 PID 2152 wrote to memory of 736 2152 htbbtt.exe 90 PID 2152 wrote to memory of 736 2152 htbbtt.exe 90 PID 2152 wrote to memory of 736 2152 htbbtt.exe 90 PID 736 wrote to memory of 3492 736 nhtttb.exe 91 PID 736 wrote to memory of 3492 736 nhtttb.exe 91 PID 736 wrote to memory of 3492 736 nhtttb.exe 91 PID 3492 wrote to memory of 4680 3492 rlllfxx.exe 92 PID 3492 wrote to memory of 4680 3492 rlllfxx.exe 92 PID 3492 wrote to memory of 4680 3492 rlllfxx.exe 92 PID 4680 wrote to memory of 1356 4680 hhtntt.exe 93 PID 4680 wrote to memory of 1356 4680 hhtntt.exe 93 PID 4680 wrote to memory of 1356 4680 hhtntt.exe 93 PID 1356 wrote to memory of 8 1356 vdvvp.exe 94 PID 1356 wrote to memory of 8 1356 vdvvp.exe 94 PID 1356 wrote to memory of 8 1356 vdvvp.exe 94 PID 8 wrote to memory of 2532 8 jddvj.exe 95 PID 8 wrote to memory of 2532 8 jddvj.exe 95 PID 8 wrote to memory of 2532 8 jddvj.exe 95 PID 2532 wrote to memory of 2588 2532 xffxxxr.exe 97 PID 2532 wrote to memory of 2588 2532 xffxxxr.exe 97 PID 2532 wrote to memory of 2588 2532 xffxxxr.exe 97 PID 2588 wrote to memory of 4928 2588 tntttt.exe 98 PID 2588 wrote to memory of 4928 2588 tntttt.exe 98 PID 2588 wrote to memory of 4928 2588 tntttt.exe 98 PID 4928 wrote to memory of 4456 4928 vddpd.exe 99 PID 4928 wrote to memory of 4456 4928 vddpd.exe 99 PID 4928 wrote to memory of 4456 4928 vddpd.exe 99 PID 4456 wrote to memory of 2740 4456 xrxffll.exe 100 PID 4456 wrote to memory of 2740 4456 xrxffll.exe 100 PID 4456 wrote to memory of 2740 4456 xrxffll.exe 100 PID 2740 wrote to memory of 2000 2740 nbbthh.exe 101 PID 2740 wrote to memory of 2000 2740 nbbthh.exe 101 PID 2740 wrote to memory of 2000 2740 nbbthh.exe 101 PID 2000 wrote to memory of 4268 2000 jjppp.exe 102 PID 2000 wrote to memory of 4268 2000 jjppp.exe 102 PID 2000 wrote to memory of 4268 2000 jjppp.exe 102 PID 4268 wrote to memory of 3868 4268 vpddv.exe 103 PID 4268 wrote to memory of 3868 4268 vpddv.exe 103 PID 4268 wrote to memory of 3868 4268 vpddv.exe 103 PID 3868 wrote to memory of 988 3868 xfrrrxx.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\75d925408b1f605264104a454b473110_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\75d925408b1f605264104a454b473110_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\pvppv.exec:\pvppv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\rfrrllr.exec:\rfrrllr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\nhnbbb.exec:\nhnbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\ddjvd.exec:\ddjvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\bbhbbt.exec:\bbhbbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\vvvdv.exec:\vvvdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\pjjdd.exec:\pjjdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\htbbtt.exec:\htbbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\nhtttb.exec:\nhtttb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
\??\c:\rlllfxx.exec:\rlllfxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\hhtntt.exec:\hhtntt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\vdvvp.exec:\vdvvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\jddvj.exec:\jddvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\xffxxxr.exec:\xffxxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\tntttt.exec:\tntttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\vddpd.exec:\vddpd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\xrxffll.exec:\xrxffll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\nbbthh.exec:\nbbthh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\jjppp.exec:\jjppp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\vpddv.exec:\vpddv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
\??\c:\xfrrrxx.exec:\xfrrrxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
\??\c:\9bttnn.exec:\9bttnn.exe23⤵
- Executes dropped EXE
PID:988 -
\??\c:\jjjpv.exec:\jjjpv.exe24⤵
- Executes dropped EXE
PID:4604 -
\??\c:\pjjdj.exec:\pjjdj.exe25⤵
- Executes dropped EXE
PID:2384 -
\??\c:\fllfxxl.exec:\fllfxxl.exe26⤵
- Executes dropped EXE
PID:2920 -
\??\c:\ntthbb.exec:\ntthbb.exe27⤵
- Executes dropped EXE
PID:3992 -
\??\c:\vppdp.exec:\vppdp.exe28⤵
- Executes dropped EXE
PID:3168 -
\??\c:\djdjd.exec:\djdjd.exe29⤵
- Executes dropped EXE
PID:2200 -
\??\c:\ffflflf.exec:\ffflflf.exe30⤵
- Executes dropped EXE
PID:1484 -
\??\c:\bbbbtb.exec:\bbbbtb.exe31⤵
- Executes dropped EXE
PID:1396 -
\??\c:\ddjvd.exec:\ddjvd.exe32⤵
- Executes dropped EXE
PID:2040 -
\??\c:\fxlfxxr.exec:\fxlfxxr.exe33⤵
- Executes dropped EXE
PID:2296 -
\??\c:\tthnnn.exec:\tthnnn.exe34⤵
- Executes dropped EXE
PID:3600 -
\??\c:\bhnnnt.exec:\bhnnnt.exe35⤵
- Executes dropped EXE
PID:4332 -
\??\c:\vvvpp.exec:\vvvpp.exe36⤵
- Executes dropped EXE
PID:2692 -
\??\c:\rfllrfl.exec:\rfllrfl.exe37⤵
- Executes dropped EXE
PID:1452 -
\??\c:\hnbhhn.exec:\hnbhhn.exe38⤵
- Executes dropped EXE
PID:3480 -
\??\c:\pdddp.exec:\pdddp.exe39⤵
- Executes dropped EXE
PID:4944 -
\??\c:\vjdvj.exec:\vjdvj.exe40⤵
- Executes dropped EXE
PID:3964 -
\??\c:\rrllllf.exec:\rrllllf.exe41⤵
- Executes dropped EXE
PID:4628 -
\??\c:\thnhtb.exec:\thnhtb.exe42⤵
- Executes dropped EXE
PID:3904 -
\??\c:\3jppp.exec:\3jppp.exe43⤵
- Executes dropped EXE
PID:4428 -
\??\c:\vddvv.exec:\vddvv.exe44⤵
- Executes dropped EXE
PID:4400 -
\??\c:\fxfxfxl.exec:\fxfxfxl.exe45⤵
- Executes dropped EXE
PID:3272 -
\??\c:\httnnh.exec:\httnnh.exe46⤵
- Executes dropped EXE
PID:1064 -
\??\c:\frllfrl.exec:\frllfrl.exe47⤵
- Executes dropped EXE
PID:412 -
\??\c:\bhnhbn.exec:\bhnhbn.exe48⤵
- Executes dropped EXE
PID:2820 -
\??\c:\vjjdj.exec:\vjjdj.exe49⤵
- Executes dropped EXE
PID:1012 -
\??\c:\xlffrrr.exec:\xlffrrr.exe50⤵
- Executes dropped EXE
PID:3044 -
\??\c:\xllrrfl.exec:\xllrrfl.exe51⤵
- Executes dropped EXE
PID:3640 -
\??\c:\hhhhhh.exec:\hhhhhh.exe52⤵
- Executes dropped EXE
PID:720 -
\??\c:\bhhbbn.exec:\bhhbbn.exe53⤵
- Executes dropped EXE
PID:456 -
\??\c:\jdjdd.exec:\jdjdd.exe54⤵
- Executes dropped EXE
PID:2212 -
\??\c:\llxxflx.exec:\llxxflx.exe55⤵
- Executes dropped EXE
PID:2656 -
\??\c:\xlrxrll.exec:\xlrxrll.exe56⤵
- Executes dropped EXE
PID:868 -
\??\c:\bhbtnb.exec:\bhbtnb.exe57⤵
- Executes dropped EXE
PID:4876 -
\??\c:\vdppj.exec:\vdppj.exe58⤵
- Executes dropped EXE
PID:980 -
\??\c:\rxrrrxx.exec:\rxrrrxx.exe59⤵
- Executes dropped EXE
PID:1996 -
\??\c:\fxfrxxx.exec:\fxfrxxx.exe60⤵
- Executes dropped EXE
PID:4976 -
\??\c:\hthhtb.exec:\hthhtb.exe61⤵
- Executes dropped EXE
PID:1772 -
\??\c:\jvpdd.exec:\jvpdd.exe62⤵
- Executes dropped EXE
PID:748 -
\??\c:\fxfffff.exec:\fxfffff.exe63⤵
- Executes dropped EXE
PID:824 -
\??\c:\lfllflf.exec:\lfllflf.exe64⤵
- Executes dropped EXE
PID:1512 -
\??\c:\bnhnnn.exec:\bnhnnn.exe65⤵
- Executes dropped EXE
PID:4828 -
\??\c:\hbnnbb.exec:\hbnnbb.exe66⤵PID:4516
-
\??\c:\vdjdj.exec:\vdjdj.exe67⤵PID:3768
-
\??\c:\xrxffrr.exec:\xrxffrr.exe68⤵PID:2000
-
\??\c:\nhhhnh.exec:\nhhhnh.exe69⤵PID:2536
-
\??\c:\vvppv.exec:\vvppv.exe70⤵PID:4048
-
\??\c:\jpjjp.exec:\jpjjp.exe71⤵PID:3868
-
\??\c:\bhnntt.exec:\bhnntt.exe72⤵PID:892
-
\??\c:\thhntt.exec:\thhntt.exe73⤵PID:1796
-
\??\c:\ddjdj.exec:\ddjdj.exe74⤵PID:1760
-
\??\c:\lllfllr.exec:\lllfllr.exe75⤵PID:1544
-
\??\c:\llrrlrr.exec:\llrrlrr.exe76⤵PID:3972
-
\??\c:\thntbb.exec:\thntbb.exe77⤵PID:3168
-
\??\c:\ttbbbh.exec:\ttbbbh.exe78⤵PID:2896
-
\??\c:\vjjvj.exec:\vjjvj.exe79⤵PID:2148
-
\??\c:\fxfffll.exec:\fxfffll.exe80⤵PID:2996
-
\??\c:\fxlfllx.exec:\fxlfllx.exe81⤵PID:3940
-
\??\c:\3nttnt.exec:\3nttnt.exe82⤵PID:4176
-
\??\c:\3htbtt.exec:\3htbtt.exe83⤵PID:684
-
\??\c:\jvjjd.exec:\jvjjd.exe84⤵PID:4600
-
\??\c:\pdppj.exec:\pdppj.exe85⤵PID:2392
-
\??\c:\llfxxff.exec:\llfxxff.exe86⤵PID:5032
-
\??\c:\ttbbbb.exec:\ttbbbb.exe87⤵PID:4916
-
\??\c:\1jvvv.exec:\1jvvv.exe88⤵PID:2508
-
\??\c:\rlfxxxx.exec:\rlfxxxx.exe89⤵PID:3680
-
\??\c:\fffxxrr.exec:\fffxxrr.exe90⤵PID:2544
-
\??\c:\5hbtbh.exec:\5hbtbh.exe91⤵PID:3904
-
\??\c:\pppvv.exec:\pppvv.exe92⤵PID:2324
-
\??\c:\dvjpj.exec:\dvjpj.exe93⤵PID:1584
-
\??\c:\xxfxxxx.exec:\xxfxxxx.exe94⤵PID:3524
-
\??\c:\xfffflr.exec:\xfffflr.exe95⤵PID:2108
-
\??\c:\nhtttb.exec:\nhtttb.exe96⤵PID:412
-
\??\c:\9hbbbh.exec:\9hbbbh.exe97⤵PID:1556
-
\??\c:\ppvjj.exec:\ppvjj.exe98⤵PID:1012
-
\??\c:\jvjdj.exec:\jvjdj.exe99⤵PID:3248
-
\??\c:\fflffff.exec:\fflffff.exe100⤵PID:1816
-
\??\c:\rxrxxlx.exec:\rxrxxlx.exe101⤵PID:3024
-
\??\c:\thtttb.exec:\thtttb.exe102⤵PID:3980
-
\??\c:\jddjd.exec:\jddjd.exe103⤵PID:3912
-
\??\c:\jvddd.exec:\jvddd.exe104⤵PID:2756
-
\??\c:\ffrrflr.exec:\ffrrflr.exe105⤵PID:4608
-
\??\c:\xxxrffl.exec:\xxxrffl.exe106⤵PID:3500
-
\??\c:\hthhbh.exec:\hthhbh.exe107⤵PID:4876
-
\??\c:\ddvpp.exec:\ddvpp.exe108⤵PID:1108
-
\??\c:\ddjjj.exec:\ddjjj.exe109⤵PID:2400
-
\??\c:\xrrlflr.exec:\xrrlflr.exe110⤵PID:2260
-
\??\c:\nhhhhn.exec:\nhhhhn.exe111⤵PID:4792
-
\??\c:\1thtnn.exec:\1thtnn.exe112⤵PID:2588
-
\??\c:\pjpvv.exec:\pjpvv.exe113⤵PID:2368
-
\??\c:\frrrrxx.exec:\frrrrxx.exe114⤵PID:1256
-
\??\c:\lfllrrr.exec:\lfllrrr.exe115⤵PID:2740
-
\??\c:\bhhhnt.exec:\bhhhnt.exe116⤵PID:3096
-
\??\c:\ttbbtn.exec:\ttbbtn.exe117⤵PID:4256
-
\??\c:\dvpjv.exec:\dvpjv.exe118⤵PID:4696
-
\??\c:\vdppd.exec:\vdppd.exe119⤵PID:4604
-
\??\c:\lxfxllf.exec:\lxfxllf.exe120⤵PID:3200
-
\??\c:\5xrlllf.exec:\5xrlllf.exe121⤵PID:4872
-
\??\c:\hbhhbh.exec:\hbhhbh.exe122⤵PID:1680
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-