Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 14:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d62ba7c03d62f7fdf942d1cec53217a0_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
- Target d62ba7c03d62f7fdf942d1cec53217a0_NeikiAnalytics.exe
- Size 86KB
- Sample240518-rnqb4aff53
- SHA256 a66e59bc5698ac3b491fac5d38e09ffb688d8d5b7da70d5225d63fd397a8d9a5
- MD5 d62ba7c03d62f7fdf942d1cec53217a0
- SHA1 9011653a96c96652036e10dd087ddf2d28b50ea6
- SHA512 c4d7aec33ef7187f39c878638cf8cfcb0af12e3df66e72fe0aa68a0ed79c3a1b6107a7e75647f5635d7a396fcfa0158245c34a20f3a7a8c9fe5379245912f86f
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73t6MlYqn+jMp9jXXS:ymb3NkkiQ3mdBjFo73tvn+Yp9jnS
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/3532-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4452-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4796-21-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2312-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2496-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4796-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3692-63-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3692-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3208-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1328-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1736-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3776-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3676-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2816-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1596-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4600-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/760-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2500-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4832-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/772-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1944-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4920-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3008-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2196-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4604-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3216-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 4452 3flxrfr.exe 4796 bttntn.exe 2312 vjjvj.exe 2496 3dvjp.exe 4852 xllxlfr.exe 3208 frrlxrf.exe 1328 btnhtn.exe 3692 tnnhtt.exe 1736 jppdp.exe 3776 9tbtnh.exe 3676 pddvj.exe 2816 lxxrllf.exe 1596 1llfrrl.exe 4600 hbnhtt.exe 760 dpddv.exe 2500 pjvpj.exe 4832 rrrlfrr.exe 1808 httttt.exe 772 vdvvd.exe 1944 vddpj.exe 4880 xxrllfx.exe 372 tttnhb.exe 4920 tbhnbt.exe 768 jvvjj.exe 436 fffrlfr.exe 3008 lflffxl.exe 2196 7nnhtt.exe 4396 pvvpj.exe 1128 hbnbnh.exe 4604 pvvjv.exe 3216 ddppp.exe 2544 xllxrlf.exe 4028 bbhhbt.exe 2832 vdvjd.exe 2996 5pjdv.exe 4276 rffrfxr.exe 2612 xlrfxrl.exe 2268 thbbtn.exe 4980 djvjj.exe 4704 jdvjp.exe 4696 xrrrlxf.exe 2340 nthbtt.exe 2776 ttttbb.exe 4612 vppdp.exe 312 pvpdv.exe 3736 9ffrfxr.exe 1736 tthhnt.exe 848 ttbthh.exe 4540 dppvv.exe 4856 pvpjv.exe 4172 llxllxf.exe 2212 rxxxxrl.exe 2616 5tbnhb.exe 4404 nbbhth.exe 1424 3hbthb.exe 2060 pdddp.exe 3916 xlxrffr.exe 1808 flxrxlf.exe 2304 bbbbtn.exe 2508 7ntnhb.exe 4824 jvvpp.exe 4880 dpddd.exe 4732 dppjd.exe 4212 frrfxrl.exe -
resource yara_rule behavioral2/memory/3532-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4452-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2496-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4796-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3692-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3208-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1328-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3776-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3676-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1596-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4600-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/760-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2500-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4832-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/772-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1944-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4920-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3008-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2196-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3216-206-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3532 wrote to memory of 4452 3532 d62ba7c03d62f7fdf942d1cec53217a0_NeikiAnalytics.exe 85 PID 3532 wrote to memory of 4452 3532 d62ba7c03d62f7fdf942d1cec53217a0_NeikiAnalytics.exe 85 PID 3532 wrote to memory of 4452 3532 d62ba7c03d62f7fdf942d1cec53217a0_NeikiAnalytics.exe 85 PID 4452 wrote to memory of 4796 4452 3flxrfr.exe 86 PID 4452 wrote to memory of 4796 4452 3flxrfr.exe 86 PID 4452 wrote to memory of 4796 4452 3flxrfr.exe 86 PID 4796 wrote to memory of 2312 4796 bttntn.exe 87 PID 4796 wrote to memory of 2312 4796 bttntn.exe 87 PID 4796 wrote to memory of 2312 4796 bttntn.exe 87 PID 2312 wrote to memory of 2496 2312 vjjvj.exe 88 PID 2312 wrote to memory of 2496 2312 vjjvj.exe 88 PID 2312 wrote to memory of 2496 2312 vjjvj.exe 88 PID 2496 wrote to memory of 4852 2496 3dvjp.exe 89 PID 2496 wrote to memory of 4852 2496 3dvjp.exe 89 PID 2496 wrote to memory of 4852 2496 3dvjp.exe 89 PID 4852 wrote to memory of 3208 4852 xllxlfr.exe 90 PID 4852 wrote to memory of 3208 4852 xllxlfr.exe 90 PID 4852 wrote to memory of 3208 4852 xllxlfr.exe 90 PID 3208 wrote to memory of 1328 3208 frrlxrf.exe 91 PID 3208 wrote to memory of 1328 3208 frrlxrf.exe 91 PID 3208 wrote to memory of 1328 3208 frrlxrf.exe 91 PID 1328 wrote to memory of 3692 1328 btnhtn.exe 92 PID 1328 wrote to memory of 3692 1328 btnhtn.exe 92 PID 1328 wrote to memory of 3692 1328 btnhtn.exe 92 PID 3692 wrote to memory of 1736 3692 tnnhtt.exe 93 PID 3692 wrote to memory of 1736 3692 tnnhtt.exe 93 PID 3692 wrote to memory of 1736 3692 tnnhtt.exe 93 PID 1736 wrote to memory of 3776 1736 jppdp.exe 94 PID 1736 wrote to memory of 3776 1736 jppdp.exe 94 PID 1736 wrote to memory of 3776 1736 jppdp.exe 94 PID 3776 wrote to memory of 3676 3776 9tbtnh.exe 95 PID 3776 wrote to memory of 3676 3776 9tbtnh.exe 95 PID 3776 wrote to memory of 3676 3776 9tbtnh.exe 95 PID 3676 wrote to memory of 2816 3676 pddvj.exe 96 PID 3676 wrote to memory of 2816 3676 pddvj.exe 96 PID 3676 wrote to memory of 2816 3676 pddvj.exe 96 PID 2816 wrote to memory of 1596 2816 lxxrllf.exe 97 PID 2816 wrote to memory of 1596 2816 lxxrllf.exe 97 PID 2816 wrote to memory of 1596 2816 lxxrllf.exe 97 PID 1596 wrote to memory of 4600 1596 1llfrrl.exe 98 PID 1596 wrote to memory of 4600 1596 1llfrrl.exe 98 PID 1596 wrote to memory of 4600 1596 1llfrrl.exe 98 PID 4600 wrote to memory of 760 4600 hbnhtt.exe 99 PID 4600 wrote to memory of 760 4600 hbnhtt.exe 99 PID 4600 wrote to memory of 760 4600 hbnhtt.exe 99 PID 760 wrote to memory of 2500 760 dpddv.exe 100 PID 760 wrote to memory of 2500 760 dpddv.exe 100 PID 760 wrote to memory of 2500 760 dpddv.exe 100 PID 2500 wrote to memory of 4832 2500 pjvpj.exe 101 PID 2500 wrote to memory of 4832 2500 pjvpj.exe 101 PID 2500 wrote to memory of 4832 2500 pjvpj.exe 101 PID 4832 wrote to memory of 1808 4832 rrrlfrr.exe 102 PID 4832 wrote to memory of 1808 4832 rrrlfrr.exe 102 PID 4832 wrote to memory of 1808 4832 rrrlfrr.exe 102 PID 1808 wrote to memory of 772 1808 httttt.exe 103 PID 1808 wrote to memory of 772 1808 httttt.exe 103 PID 1808 wrote to memory of 772 1808 httttt.exe 103 PID 772 wrote to memory of 1944 772 vdvvd.exe 104 PID 772 wrote to memory of 1944 772 vdvvd.exe 104 PID 772 wrote to memory of 1944 772 vdvvd.exe 104 PID 1944 wrote to memory of 4880 1944 vddpj.exe 105 PID 1944 wrote to memory of 4880 1944 vddpj.exe 105 PID 1944 wrote to memory of 4880 1944 vddpj.exe 105 PID 4880 wrote to memory of 372 4880 xxrllfx.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\d62ba7c03d62f7fdf942d1cec53217a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d62ba7c03d62f7fdf942d1cec53217a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\3flxrfr.exec:\3flxrfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
\??\c:\bttntn.exec:\bttntn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\vjjvj.exec:\vjjvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\3dvjp.exec:\3dvjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\xllxlfr.exec:\xllxlfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\frrlxrf.exec:\frrlxrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
\??\c:\btnhtn.exec:\btnhtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\tnnhtt.exec:\tnnhtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\jppdp.exec:\jppdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\9tbtnh.exec:\9tbtnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\pddvj.exec:\pddvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\lxxrllf.exec:\lxxrllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\1llfrrl.exec:\1llfrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\hbnhtt.exec:\hbnhtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\dpddv.exec:\dpddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\pjvpj.exec:\pjvpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\rrrlfrr.exec:\rrrlfrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\httttt.exec:\httttt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\vdvvd.exec:\vdvvd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\vddpj.exec:\vddpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\xxrllfx.exec:\xxrllfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\tttnhb.exec:\tttnhb.exe23⤵
- Executes dropped EXE
PID:372 -
\??\c:\tbhnbt.exec:\tbhnbt.exe24⤵
- Executes dropped EXE
PID:4920 -
\??\c:\jvvjj.exec:\jvvjj.exe25⤵
- Executes dropped EXE
PID:768 -
\??\c:\fffrlfr.exec:\fffrlfr.exe26⤵
- Executes dropped EXE
PID:436 -
\??\c:\lflffxl.exec:\lflffxl.exe27⤵
- Executes dropped EXE
PID:3008 -
\??\c:\7nnhtt.exec:\7nnhtt.exe28⤵
- Executes dropped EXE
PID:2196 -
\??\c:\pvvpj.exec:\pvvpj.exe29⤵
- Executes dropped EXE
PID:4396 -
\??\c:\hbnbnh.exec:\hbnbnh.exe30⤵
- Executes dropped EXE
PID:1128 -
\??\c:\pvvjv.exec:\pvvjv.exe31⤵
- Executes dropped EXE
PID:4604 -
\??\c:\ddppp.exec:\ddppp.exe32⤵
- Executes dropped EXE
PID:3216 -
\??\c:\xllxrlf.exec:\xllxrlf.exe33⤵
- Executes dropped EXE
PID:2544 -
\??\c:\bbhhbt.exec:\bbhhbt.exe34⤵
- Executes dropped EXE
PID:4028 -
\??\c:\vdvjd.exec:\vdvjd.exe35⤵
- Executes dropped EXE
PID:2832 -
\??\c:\5pjdv.exec:\5pjdv.exe36⤵
- Executes dropped EXE
PID:2996 -
\??\c:\rffrfxr.exec:\rffrfxr.exe37⤵
- Executes dropped EXE
PID:4276 -
\??\c:\xlrfxrl.exec:\xlrfxrl.exe38⤵
- Executes dropped EXE
PID:2612 -
\??\c:\thbbtn.exec:\thbbtn.exe39⤵
- Executes dropped EXE
PID:2268 -
\??\c:\djvjj.exec:\djvjj.exe40⤵
- Executes dropped EXE
PID:4980 -
\??\c:\jdvjp.exec:\jdvjp.exe41⤵
- Executes dropped EXE
PID:4704 -
\??\c:\xrrrlxf.exec:\xrrrlxf.exe42⤵
- Executes dropped EXE
PID:4696 -
\??\c:\nthbtt.exec:\nthbtt.exe43⤵
- Executes dropped EXE
PID:2340 -
\??\c:\ttttbb.exec:\ttttbb.exe44⤵
- Executes dropped EXE
PID:2776 -
\??\c:\vppdp.exec:\vppdp.exe45⤵
- Executes dropped EXE
PID:4612 -
\??\c:\pvpdv.exec:\pvpdv.exe46⤵
- Executes dropped EXE
PID:312 -
\??\c:\9ffrfxr.exec:\9ffrfxr.exe47⤵
- Executes dropped EXE
PID:3736 -
\??\c:\tthhnt.exec:\tthhnt.exe48⤵
- Executes dropped EXE
PID:1736 -
\??\c:\ttbthh.exec:\ttbthh.exe49⤵
- Executes dropped EXE
PID:848 -
\??\c:\dppvv.exec:\dppvv.exe50⤵
- Executes dropped EXE
PID:4540 -
\??\c:\pvpjv.exec:\pvpjv.exe51⤵
- Executes dropped EXE
PID:4856 -
\??\c:\llxllxf.exec:\llxllxf.exe52⤵
- Executes dropped EXE
PID:4172 -
\??\c:\rxxxxrl.exec:\rxxxxrl.exe53⤵
- Executes dropped EXE
PID:2212 -
\??\c:\5tbnhb.exec:\5tbnhb.exe54⤵
- Executes dropped EXE
PID:2616 -
\??\c:\nbbhth.exec:\nbbhth.exe55⤵
- Executes dropped EXE
PID:4404 -
\??\c:\3hbthb.exec:\3hbthb.exe56⤵
- Executes dropped EXE
PID:1424 -
\??\c:\pdddp.exec:\pdddp.exe57⤵
- Executes dropped EXE
PID:2060 -
\??\c:\xlxrffr.exec:\xlxrffr.exe58⤵
- Executes dropped EXE
PID:3916 -
\??\c:\flxrxlf.exec:\flxrxlf.exe59⤵
- Executes dropped EXE
PID:1808 -
\??\c:\bbbbtn.exec:\bbbbtn.exe60⤵
- Executes dropped EXE
PID:2304 -
\??\c:\7ntnhb.exec:\7ntnhb.exe61⤵
- Executes dropped EXE
PID:2508 -
\??\c:\jvvpp.exec:\jvvpp.exe62⤵
- Executes dropped EXE
PID:4824 -
\??\c:\dpddd.exec:\dpddd.exe63⤵
- Executes dropped EXE
PID:4880 -
\??\c:\dppjd.exec:\dppjd.exe64⤵
- Executes dropped EXE
PID:4732 -
\??\c:\frrfxrl.exec:\frrfxrl.exe65⤵
- Executes dropped EXE
PID:4212 -
\??\c:\xllffrf.exec:\xllffrf.exe66⤵PID:5116
-
\??\c:\btnhbb.exec:\btnhbb.exe67⤵PID:4352
-
\??\c:\tbhtnt.exec:\tbhtnt.exe68⤵PID:4860
-
\??\c:\vjjdv.exec:\vjjdv.exe69⤵PID:2524
-
\??\c:\1jjjd.exec:\1jjjd.exe70⤵PID:976
-
\??\c:\dddpj.exec:\dddpj.exe71⤵PID:1820
-
\??\c:\lffrfxl.exec:\lffrfxl.exe72⤵PID:5000
-
\??\c:\lxlfffx.exec:\lxlfffx.exe73⤵PID:1724
-
\??\c:\hnthbh.exec:\hnthbh.exe74⤵PID:2004
-
\??\c:\nbthbb.exec:\nbthbb.exe75⤵PID:4604
-
\??\c:\jpjdv.exec:\jpjdv.exe76⤵PID:3216
-
\??\c:\jpjdv.exec:\jpjdv.exe77⤵PID:3164
-
\??\c:\fxxlllf.exec:\fxxlllf.exe78⤵PID:2544
-
\??\c:\xxllxxr.exec:\xxllxxr.exe79⤵PID:3088
-
\??\c:\7rlrfxr.exec:\7rlrfxr.exe80⤵PID:4228
-
\??\c:\1thhbn.exec:\1thhbn.exe81⤵PID:4260
-
\??\c:\nbbntt.exec:\nbbntt.exe82⤵PID:3956
-
\??\c:\dpjdp.exec:\dpjdp.exe83⤵PID:3892
-
\??\c:\vddvj.exec:\vddvj.exe84⤵PID:3988
-
\??\c:\xffrfxl.exec:\xffrfxl.exe85⤵PID:2456
-
\??\c:\rlfrffr.exec:\rlfrffr.exe86⤵PID:4456
-
\??\c:\tnhbnb.exec:\tnhbnb.exe87⤵PID:812
-
\??\c:\vvvjv.exec:\vvvjv.exe88⤵PID:2188
-
\??\c:\vpvjd.exec:\vpvjd.exe89⤵PID:5080
-
\??\c:\rlrlrrr.exec:\rlrlrrr.exe90⤵PID:2384
-
\??\c:\5nnbnh.exec:\5nnbnh.exe91⤵PID:3976
-
\??\c:\bhtnhb.exec:\bhtnhb.exe92⤵PID:1784
-
\??\c:\jvvpd.exec:\jvvpd.exe93⤵PID:428
-
\??\c:\frfxrfx.exec:\frfxrfx.exe94⤵PID:3528
-
\??\c:\ttnbnh.exec:\ttnbnh.exe95⤵PID:3444
-
\??\c:\7tttht.exec:\7tttht.exe96⤵PID:4180
-
\??\c:\1vpjv.exec:\1vpjv.exe97⤵PID:3132
-
\??\c:\3djvj.exec:\3djvj.exe98⤵PID:2536
-
\??\c:\fxxrrlr.exec:\fxxrrlr.exe99⤵PID:2356
-
\??\c:\fxrlfxx.exec:\fxrlfxx.exe100⤵PID:4720
-
\??\c:\bnntht.exec:\bnntht.exe101⤵PID:4736
-
\??\c:\nhhhbb.exec:\nhhhbb.exe102⤵PID:1408
-
\??\c:\pvvvv.exec:\pvvvv.exe103⤵PID:3952
-
\??\c:\vdvpj.exec:\vdvpj.exe104⤵PID:3260
-
\??\c:\3llfrlf.exec:\3llfrlf.exe105⤵PID:4548
-
\??\c:\rffxrlf.exec:\rffxrlf.exe106⤵PID:4780
-
\??\c:\5bnhbt.exec:\5bnhbt.exe107⤵PID:748
-
\??\c:\9jpvj.exec:\9jpvj.exe108⤵PID:4552
-
\??\c:\1pvpd.exec:\1pvpd.exe109⤵PID:2000
-
\??\c:\7xrfrfr.exec:\7xrfrfr.exe110⤵PID:3244
-
\??\c:\7rrlflf.exec:\7rrlflf.exe111⤵PID:3384
-
\??\c:\nhbtbt.exec:\nhbtbt.exe112⤵PID:756
-
\??\c:\7ttnbt.exec:\7ttnbt.exe113⤵PID:4864
-
\??\c:\pvvpd.exec:\pvvpd.exe114⤵PID:4816
-
\??\c:\lxlrrxf.exec:\lxlrrxf.exe115⤵PID:4904
-
\??\c:\9fxxllf.exec:\9fxxllf.exe116⤵PID:4884
-
\??\c:\1xxlfxr.exec:\1xxlfxr.exe117⤵PID:232
-
\??\c:\hnnhbh.exec:\hnnhbh.exe118⤵PID:1836
-
\??\c:\jvvpd.exec:\jvvpd.exe119⤵PID:744
-
\??\c:\pjdvp.exec:\pjdvp.exe120⤵PID:3856
-
\??\c:\pjpdv.exec:\pjpdv.exe121⤵PID:4312
-
\??\c:\flfrlrl.exec:\flfrlrl.exe122⤵PID:4036
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-