Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 03:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8669df241e399a429e0cc3f979934650_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
- Target 8669df241e399a429e0cc3f979934650_NeikiAnalytics.exe
- Size 63KB
- Sample240518-eff28sag4x
- SHA256 77aff43e270110971af9f06e5ff81382f3b60b38ed35ac44a0ef47a6d811836f
- MD5 8669df241e399a429e0cc3f979934650
- SHA1 93db9ad82131dbcf2162506a2c456b7c869cbddd
- SHA512 cd83f25ab83b843bf9f235167deea93dabf81dbe73f9926917e4afe6c1838385f8b2f2854b3eaf16a693fcbdd123ac0b5bae632bfaad69f8f76f57d854c0849a
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFdJULh12C:ymb3NkkiQ3mdBjFIFdJmf
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/5104-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5104-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4048-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4436-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2924-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2752-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3472-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3472-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4948-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1476-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/828-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3496-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1248-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4732-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4820-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4144-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/536-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5068-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3128-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4584-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1404-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3768-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3064-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 4048 3bbbtb.exe 4436 vvvvp.exe 4444 jjjjd.exe 3612 lflfxff.exe 2924 hnthhh.exe 2752 pjjjv.exe 3472 xlllfff.exe 4948 htbbtt.exe 1476 ppjdv.exe 3504 fxrlffx.exe 828 tnttbb.exe 3496 1jpjj.exe 1248 rllffff.exe 4732 7rlxxxr.exe 4820 hhhhbb.exe 408 vpddd.exe 4144 rrrrlxr.exe 536 rfxxrfx.exe 3620 hbnnbb.exe 5068 jvjjj.exe 392 ppdvj.exe 3208 rlrlxxx.exe 5056 rrllfrr.exe 3200 thbthb.exe 3128 hhnhbb.exe 3592 9ddjd.exe 4584 llfxffx.exe 1404 1rfxfff.exe 3768 btbtnb.exe 3064 vvppj.exe 1084 lflfxxx.exe 1760 llrxrrr.exe 1432 bthhnh.exe 1588 ddppv.exe 3656 pvdjv.exe 4900 9lrllll.exe 4168 7fllfff.exe 1020 nhbtnn.exe 2380 7pvvp.exe 936 7jddv.exe 4988 lffxxll.exe 3880 1lrxxrr.exe 3836 thhtnn.exe 2188 9ppjj.exe 1856 dvvvp.exe 3260 lfflllf.exe 4028 fxxrfxf.exe 3512 btbtnn.exe 2652 hbnhhn.exe 1444 djpjd.exe 1680 5vppd.exe 2472 lffxrff.exe 1620 rrrrlll.exe 552 bnttnn.exe 3504 5bnhhh.exe 3380 jdjvd.exe 2284 lfflxff.exe 3496 xxffrlr.exe 2968 9bbnnh.exe 4196 btbttn.exe 4656 dpppd.exe 1036 lfxlrxx.exe 3412 rllxxxx.exe 4644 thhbtn.exe -
resource yara_rule behavioral2/memory/5104-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5104-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4048-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4436-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2752-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3472-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3472-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4948-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1476-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/828-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3496-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1248-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4820-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4144-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/536-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5068-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3128-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1404-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3768-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3064-199-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5104 wrote to memory of 4048 5104 8669df241e399a429e0cc3f979934650_NeikiAnalytics.exe 82 PID 5104 wrote to memory of 4048 5104 8669df241e399a429e0cc3f979934650_NeikiAnalytics.exe 82 PID 5104 wrote to memory of 4048 5104 8669df241e399a429e0cc3f979934650_NeikiAnalytics.exe 82 PID 4048 wrote to memory of 4436 4048 3bbbtb.exe 83 PID 4048 wrote to memory of 4436 4048 3bbbtb.exe 83 PID 4048 wrote to memory of 4436 4048 3bbbtb.exe 83 PID 4436 wrote to memory of 4444 4436 vvvvp.exe 84 PID 4436 wrote to memory of 4444 4436 vvvvp.exe 84 PID 4436 wrote to memory of 4444 4436 vvvvp.exe 84 PID 4444 wrote to memory of 3612 4444 jjjjd.exe 85 PID 4444 wrote to memory of 3612 4444 jjjjd.exe 85 PID 4444 wrote to memory of 3612 4444 jjjjd.exe 85 PID 3612 wrote to memory of 2924 3612 lflfxff.exe 86 PID 3612 wrote to memory of 2924 3612 lflfxff.exe 86 PID 3612 wrote to memory of 2924 3612 lflfxff.exe 86 PID 2924 wrote to memory of 2752 2924 hnthhh.exe 87 PID 2924 wrote to memory of 2752 2924 hnthhh.exe 87 PID 2924 wrote to memory of 2752 2924 hnthhh.exe 87 PID 2752 wrote to memory of 3472 2752 pjjjv.exe 88 PID 2752 wrote to memory of 3472 2752 pjjjv.exe 88 PID 2752 wrote to memory of 3472 2752 pjjjv.exe 88 PID 3472 wrote to memory of 4948 3472 xlllfff.exe 89 PID 3472 wrote to memory of 4948 3472 xlllfff.exe 89 PID 3472 wrote to memory of 4948 3472 xlllfff.exe 89 PID 4948 wrote to memory of 1476 4948 htbbtt.exe 90 PID 4948 wrote to memory of 1476 4948 htbbtt.exe 90 PID 4948 wrote to memory of 1476 4948 htbbtt.exe 90 PID 1476 wrote to memory of 3504 1476 ppjdv.exe 91 PID 1476 wrote to memory of 3504 1476 ppjdv.exe 91 PID 1476 wrote to memory of 3504 1476 ppjdv.exe 91 PID 3504 wrote to memory of 828 3504 fxrlffx.exe 92 PID 3504 wrote to memory of 828 3504 fxrlffx.exe 92 PID 3504 wrote to memory of 828 3504 fxrlffx.exe 92 PID 828 wrote to memory of 3496 828 tnttbb.exe 93 PID 828 wrote to memory of 3496 828 tnttbb.exe 93 PID 828 wrote to memory of 3496 828 tnttbb.exe 93 PID 3496 wrote to memory of 1248 3496 1jpjj.exe 94 PID 3496 wrote to memory of 1248 3496 1jpjj.exe 94 PID 3496 wrote to memory of 1248 3496 1jpjj.exe 94 PID 1248 wrote to memory of 4732 1248 rllffff.exe 95 PID 1248 wrote to memory of 4732 1248 rllffff.exe 95 PID 1248 wrote to memory of 4732 1248 rllffff.exe 95 PID 4732 wrote to memory of 4820 4732 7rlxxxr.exe 96 PID 4732 wrote to memory of 4820 4732 7rlxxxr.exe 96 PID 4732 wrote to memory of 4820 4732 7rlxxxr.exe 96 PID 4820 wrote to memory of 408 4820 hhhhbb.exe 97 PID 4820 wrote to memory of 408 4820 hhhhbb.exe 97 PID 4820 wrote to memory of 408 4820 hhhhbb.exe 97 PID 408 wrote to memory of 4144 408 vpddd.exe 98 PID 408 wrote to memory of 4144 408 vpddd.exe 98 PID 408 wrote to memory of 4144 408 vpddd.exe 98 PID 4144 wrote to memory of 536 4144 rrrrlxr.exe 99 PID 4144 wrote to memory of 536 4144 rrrrlxr.exe 99 PID 4144 wrote to memory of 536 4144 rrrrlxr.exe 99 PID 536 wrote to memory of 3620 536 rfxxrfx.exe 100 PID 536 wrote to memory of 3620 536 rfxxrfx.exe 100 PID 536 wrote to memory of 3620 536 rfxxrfx.exe 100 PID 3620 wrote to memory of 5068 3620 hbnnbb.exe 101 PID 3620 wrote to memory of 5068 3620 hbnnbb.exe 101 PID 3620 wrote to memory of 5068 3620 hbnnbb.exe 101 PID 5068 wrote to memory of 392 5068 jvjjj.exe 102 PID 5068 wrote to memory of 392 5068 jvjjj.exe 102 PID 5068 wrote to memory of 392 5068 jvjjj.exe 102 PID 392 wrote to memory of 3208 392 ppdvj.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\8669df241e399a429e0cc3f979934650_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8669df241e399a429e0cc3f979934650_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\3bbbtb.exec:\3bbbtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\vvvvp.exec:\vvvvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\jjjjd.exec:\jjjjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\lflfxff.exec:\lflfxff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\hnthhh.exec:\hnthhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\pjjjv.exec:\pjjjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\xlllfff.exec:\xlllfff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\htbbtt.exec:\htbbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\ppjdv.exec:\ppjdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\fxrlffx.exec:\fxrlffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\tnttbb.exec:\tnttbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
\??\c:\1jpjj.exec:\1jpjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\rllffff.exec:\rllffff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\7rlxxxr.exec:\7rlxxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\hhhhbb.exec:\hhhhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\vpddd.exec:\vpddd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\rrrrlxr.exec:\rrrrlxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
\??\c:\rfxxrfx.exec:\rfxxrfx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\hbnnbb.exec:\hbnnbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\jvjjj.exec:\jvjjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\ppdvj.exec:\ppdvj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\rlrlxxx.exec:\rlrlxxx.exe23⤵
- Executes dropped EXE
PID:3208 -
\??\c:\rrllfrr.exec:\rrllfrr.exe24⤵
- Executes dropped EXE
PID:5056 -
\??\c:\thbthb.exec:\thbthb.exe25⤵
- Executes dropped EXE
PID:3200 -
\??\c:\hhnhbb.exec:\hhnhbb.exe26⤵
- Executes dropped EXE
PID:3128 -
\??\c:\9ddjd.exec:\9ddjd.exe27⤵
- Executes dropped EXE
PID:3592 -
\??\c:\llfxffx.exec:\llfxffx.exe28⤵
- Executes dropped EXE
PID:4584 -
\??\c:\1rfxfff.exec:\1rfxfff.exe29⤵
- Executes dropped EXE
PID:1404 -
\??\c:\btbtnb.exec:\btbtnb.exe30⤵
- Executes dropped EXE
PID:3768 -
\??\c:\vvppj.exec:\vvppj.exe31⤵
- Executes dropped EXE
PID:3064 -
\??\c:\lflfxxx.exec:\lflfxxx.exe32⤵
- Executes dropped EXE
PID:1084 -
\??\c:\llrxrrr.exec:\llrxrrr.exe33⤵
- Executes dropped EXE
PID:1760 -
\??\c:\bthhnh.exec:\bthhnh.exe34⤵
- Executes dropped EXE
PID:1432 -
\??\c:\ddppv.exec:\ddppv.exe35⤵
- Executes dropped EXE
PID:1588 -
\??\c:\pvdjv.exec:\pvdjv.exe36⤵
- Executes dropped EXE
PID:3656 -
\??\c:\9lrllll.exec:\9lrllll.exe37⤵
- Executes dropped EXE
PID:4900 -
\??\c:\7fllfff.exec:\7fllfff.exe38⤵
- Executes dropped EXE
PID:4168 -
\??\c:\nhbtnn.exec:\nhbtnn.exe39⤵
- Executes dropped EXE
PID:1020 -
\??\c:\7pvvp.exec:\7pvvp.exe40⤵
- Executes dropped EXE
PID:2380 -
\??\c:\7jddv.exec:\7jddv.exe41⤵
- Executes dropped EXE
PID:936 -
\??\c:\lffxxll.exec:\lffxxll.exe42⤵
- Executes dropped EXE
PID:4988 -
\??\c:\1lrxxrr.exec:\1lrxxrr.exe43⤵
- Executes dropped EXE
PID:3880 -
\??\c:\thhtnn.exec:\thhtnn.exe44⤵
- Executes dropped EXE
PID:3836 -
\??\c:\9ppjj.exec:\9ppjj.exe45⤵
- Executes dropped EXE
PID:2188 -
\??\c:\dvvvp.exec:\dvvvp.exe46⤵
- Executes dropped EXE
PID:1856 -
\??\c:\lfflllf.exec:\lfflllf.exe47⤵
- Executes dropped EXE
PID:3260 -
\??\c:\fxxrfxf.exec:\fxxrfxf.exe48⤵
- Executes dropped EXE
PID:4028 -
\??\c:\btbtnn.exec:\btbtnn.exe49⤵
- Executes dropped EXE
PID:3512 -
\??\c:\hbnhhn.exec:\hbnhhn.exe50⤵
- Executes dropped EXE
PID:2652 -
\??\c:\djpjd.exec:\djpjd.exe51⤵
- Executes dropped EXE
PID:1444 -
\??\c:\5vppd.exec:\5vppd.exe52⤵
- Executes dropped EXE
PID:1680 -
\??\c:\lffxrff.exec:\lffxrff.exe53⤵
- Executes dropped EXE
PID:2472 -
\??\c:\rrrrlll.exec:\rrrrlll.exe54⤵
- Executes dropped EXE
PID:1620 -
\??\c:\bnttnn.exec:\bnttnn.exe55⤵
- Executes dropped EXE
PID:552 -
\??\c:\5bnhhh.exec:\5bnhhh.exe56⤵
- Executes dropped EXE
PID:3504 -
\??\c:\jdjvd.exec:\jdjvd.exe57⤵
- Executes dropped EXE
PID:3380 -
\??\c:\lfflxff.exec:\lfflxff.exe58⤵
- Executes dropped EXE
PID:2284 -
\??\c:\xxffrlr.exec:\xxffrlr.exe59⤵
- Executes dropped EXE
PID:3496 -
\??\c:\9bbnnh.exec:\9bbnnh.exe60⤵
- Executes dropped EXE
PID:2968 -
\??\c:\btbttn.exec:\btbttn.exe61⤵
- Executes dropped EXE
PID:4196 -
\??\c:\dpppd.exec:\dpppd.exe62⤵
- Executes dropped EXE
PID:4656 -
\??\c:\lfxlrxx.exec:\lfxlrxx.exe63⤵
- Executes dropped EXE
PID:1036 -
\??\c:\rllxxxx.exec:\rllxxxx.exe64⤵
- Executes dropped EXE
PID:3412 -
\??\c:\thhbtn.exec:\thhbtn.exe65⤵
- Executes dropped EXE
PID:4644 -
\??\c:\tttthh.exec:\tttthh.exe66⤵PID:2140
-
\??\c:\dvjdd.exec:\dvjdd.exe67⤵PID:228
-
\??\c:\rflffxx.exec:\rflffxx.exe68⤵PID:2108
-
\??\c:\ttbbtt.exec:\ttbbtt.exe69⤵PID:2004
-
\??\c:\tntnnn.exec:\tntnnn.exe70⤵PID:3268
-
\??\c:\5jdpj.exec:\5jdpj.exe71⤵PID:856
-
\??\c:\3rfxrrl.exec:\3rfxrrl.exe72⤵PID:1484
-
\??\c:\rfflfrr.exec:\rfflfrr.exe73⤵PID:1108
-
\??\c:\btbtbt.exec:\btbtbt.exe74⤵PID:4288
-
\??\c:\3htntb.exec:\3htntb.exe75⤵PID:2084
-
\??\c:\jvjdv.exec:\jvjdv.exe76⤵PID:4628
-
\??\c:\djjjv.exec:\djjjv.exe77⤵PID:4856
-
\??\c:\1xffxrl.exec:\1xffxrl.exe78⤵PID:2756
-
\??\c:\hhnhtn.exec:\hhnhtn.exe79⤵PID:5112
-
\??\c:\pjdvv.exec:\pjdvv.exe80⤵PID:3768
-
\??\c:\jdjvd.exec:\jdjvd.exe81⤵PID:3736
-
\??\c:\tttnhh.exec:\tttnhh.exe82⤵PID:3100
-
\??\c:\5djdd.exec:\5djdd.exe83⤵PID:1276
-
\??\c:\dpdvv.exec:\dpdvv.exe84⤵PID:4504
-
\??\c:\1xfxlll.exec:\1xfxlll.exe85⤵PID:788
-
\??\c:\ffllxxx.exec:\ffllxxx.exe86⤵PID:2184
-
\??\c:\3hnttt.exec:\3hnttt.exe87⤵PID:4756
-
\??\c:\9djdp.exec:\9djdp.exe88⤵PID:4188
-
\??\c:\pjppv.exec:\pjppv.exe89⤵PID:4760
-
\??\c:\rxrlfrl.exec:\rxrlfrl.exe90⤵PID:1020
-
\??\c:\xxrrllf.exec:\xxrrllf.exe91⤵PID:1380
-
\??\c:\hbnnhh.exec:\hbnnhh.exe92⤵PID:3324
-
\??\c:\dpvpj.exec:\dpvpj.exe93⤵PID:1192
-
\??\c:\pddpj.exec:\pddpj.exe94⤵PID:2396
-
\??\c:\7lrlffx.exec:\7lrlffx.exe95⤵PID:1164
-
\??\c:\nbhbtt.exec:\nbhbtt.exe96⤵PID:896
-
\??\c:\nbnnbb.exec:\nbnnbb.exe97⤵PID:2092
-
\??\c:\jjjjv.exec:\jjjjv.exe98⤵PID:3340
-
\??\c:\1dvjd.exec:\1dvjd.exe99⤵PID:3552
-
\??\c:\frxrrrl.exec:\frxrrrl.exe100⤵PID:1236
-
\??\c:\xxxxfxx.exec:\xxxxfxx.exe101⤵PID:2012
-
\??\c:\nhnnnn.exec:\nhnnnn.exe102⤵PID:4724
-
\??\c:\dvvpp.exec:\dvvpp.exe103⤵PID:876
-
\??\c:\dppjd.exec:\dppjd.exe104⤵PID:2392
-
\??\c:\3lxlfff.exec:\3lxlfff.exe105⤵PID:4472
-
\??\c:\thnhbn.exec:\thnhbn.exe106⤵PID:4740
-
\??\c:\tbhhtb.exec:\tbhhtb.exe107⤵PID:3664
-
\??\c:\pvdpj.exec:\pvdpj.exe108⤵PID:3784
-
\??\c:\lffxlll.exec:\lffxlll.exe109⤵PID:520
-
\??\c:\lxxxfff.exec:\lxxxfff.exe110⤵PID:3532
-
\??\c:\bnhbtn.exec:\bnhbtn.exe111⤵PID:4140
-
\??\c:\tnnhhb.exec:\tnnhhb.exe112⤵PID:1988
-
\??\c:\dpdvv.exec:\dpdvv.exe113⤵PID:4708
-
\??\c:\rllffxl.exec:\rllffxl.exe114⤵PID:3584
-
\??\c:\fxxrxxf.exec:\fxxrxxf.exe115⤵PID:4608
-
\??\c:\1hnhbh.exec:\1hnhbh.exe116⤵PID:4144
-
\??\c:\tnnhtt.exec:\tnnhtt.exe117⤵PID:1316
-
\??\c:\jdjjd.exec:\jdjjd.exe118⤵PID:1748
-
\??\c:\vdjdv.exec:\vdjdv.exe119⤵PID:4540
-
\??\c:\fllfxxr.exec:\fllfxxr.exe120⤵PID:4776
-
\??\c:\3bhhhh.exec:\3bhhhh.exe121⤵PID:4204
-
\??\c:\jdddp.exec:\jdddp.exe122⤵PID:3988
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-