Analysis
- max time kernel
150s - max time network
105s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2024, 06:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
920bd5a31fb16db574c6c96d2dc8ef10_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
- Target 920bd5a31fb16db574c6c96d2dc8ef10_NeikiAnalytics.exe
- Size 965KB
- Sample240519-hbgpraef49
- SHA256 8e2238d677a88937997e2c45d5a75a2091519bf9dad1fbb5fc020b46c8a9692b
- MD5 920bd5a31fb16db574c6c96d2dc8ef10
- SHA1 9df56953ab3ecc413b51a0ddcf207d4aa9e317d3
- SHA512 23a92169530cdc13d311f6d95c6eebaa66a042eb0090786886c3190412a37f6431cfb56fd54c884ff23a2b5cbde3920a07126eea1cd00477204a17517cb693b0
- SSDEEP 12288:n3C9ytvngQjy3C9I3YEWpYe+GalTLfOX+I3C9S3C9ytvngQj65syLr9fuWpZ:SgdnJVwLgdnJq9fuw
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/212-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/208-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2740-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4416-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/932-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3036-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4960-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/400-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/764-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1768-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3328-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1212-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/648-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/612-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1532-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4280-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2948-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1480-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2804-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2384-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1068-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2744-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/928-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4344-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 208 pjddv.exe 2740 vjppv.exe 4416 pvvpp.exe 932 hbtntt.exe 2764 nnnnhb.exe 3036 jpjdd.exe 400 tbhtnb.exe 4960 nbnhhh.exe 4996 lllrrll.exe 764 fxxxrxx.exe 1768 7bnnhh.exe 3328 jdjdd.exe 648 ddvvd.exe 1212 7fllffx.exe 612 htttnn.exe 1532 vpvpj.exe 4280 jdjjd.exe 2948 tttnnn.exe 1668 jvppp.exe 3596 nnhhhh.exe 1480 1vdvp.exe 5004 rrxxrxx.exe 3752 hhnbtb.exe 2804 9jjdv.exe 3916 9vvvp.exe 2384 jpvpp.exe 1068 tttttt.exe 2744 5rfxxxr.exe 928 rfrlfrr.exe 4508 9hhhhh.exe 4344 lrlffff.exe 3068 lflxrll.exe 2572 1dpvv.exe 8 xflxrlf.exe 3144 bnnhbt.exe 4216 pvjjd.exe 1984 xlrxrfx.exe 1872 tbbnhb.exe 3320 pddvp.exe 4640 xxffffx.exe 1876 9nnbtt.exe 4612 5vjdp.exe 3668 rrllxxf.exe 4828 httntn.exe 4976 lflllrf.exe 3328 ntbtbt.exe 648 pddpj.exe 5024 xlxrrlx.exe 960 ffrffxf.exe 3260 nbhbbt.exe 4280 lflffxf.exe 2340 hntthn.exe 2620 vddvj.exe 2460 lfxlxrl.exe 2324 7btnnh.exe 3884 1pppj.exe 1196 fxllrrx.exe 1520 jpjvj.exe 3980 ddvpd.exe 336 flxrfxr.exe 1880 1ttnnh.exe 1964 vjpdv.exe 2384 bhhhbb.exe 2336 1jpdp.exe -
resource yara_rule behavioral2/memory/212-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/208-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2740-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4416-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/932-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4960-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/764-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1768-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3328-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1212-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/648-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/612-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1532-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4280-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2948-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3596-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1480-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2804-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2384-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1068-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2744-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/928-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-207-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 212 wrote to memory of 208 212 920bd5a31fb16db574c6c96d2dc8ef10_NeikiAnalytics.exe 83 PID 212 wrote to memory of 208 212 920bd5a31fb16db574c6c96d2dc8ef10_NeikiAnalytics.exe 83 PID 212 wrote to memory of 208 212 920bd5a31fb16db574c6c96d2dc8ef10_NeikiAnalytics.exe 83 PID 208 wrote to memory of 2740 208 pjddv.exe 84 PID 208 wrote to memory of 2740 208 pjddv.exe 84 PID 208 wrote to memory of 2740 208 pjddv.exe 84 PID 2740 wrote to memory of 4416 2740 vjppv.exe 85 PID 2740 wrote to memory of 4416 2740 vjppv.exe 85 PID 2740 wrote to memory of 4416 2740 vjppv.exe 85 PID 4416 wrote to memory of 932 4416 pvvpp.exe 87 PID 4416 wrote to memory of 932 4416 pvvpp.exe 87 PID 4416 wrote to memory of 932 4416 pvvpp.exe 87 PID 932 wrote to memory of 2764 932 hbtntt.exe 88 PID 932 wrote to memory of 2764 932 hbtntt.exe 88 PID 932 wrote to memory of 2764 932 hbtntt.exe 88 PID 2764 wrote to memory of 3036 2764 nnnnhb.exe 89 PID 2764 wrote to memory of 3036 2764 nnnnhb.exe 89 PID 2764 wrote to memory of 3036 2764 nnnnhb.exe 89 PID 3036 wrote to memory of 400 3036 jpjdd.exe 91 PID 3036 wrote to memory of 400 3036 jpjdd.exe 91 PID 3036 wrote to memory of 400 3036 jpjdd.exe 91 PID 400 wrote to memory of 4960 400 tbhtnb.exe 92 PID 400 wrote to memory of 4960 400 tbhtnb.exe 92 PID 400 wrote to memory of 4960 400 tbhtnb.exe 92 PID 4960 wrote to memory of 4996 4960 nbnhhh.exe 93 PID 4960 wrote to memory of 4996 4960 nbnhhh.exe 93 PID 4960 wrote to memory of 4996 4960 nbnhhh.exe 93 PID 4996 wrote to memory of 764 4996 lllrrll.exe 94 PID 4996 wrote to memory of 764 4996 lllrrll.exe 94 PID 4996 wrote to memory of 764 4996 lllrrll.exe 94 PID 764 wrote to memory of 1768 764 fxxxrxx.exe 95 PID 764 wrote to memory of 1768 764 fxxxrxx.exe 95 PID 764 wrote to memory of 1768 764 fxxxrxx.exe 95 PID 1768 wrote to memory of 3328 1768 7bnnhh.exe 97 PID 1768 wrote to memory of 3328 1768 7bnnhh.exe 97 PID 1768 wrote to memory of 3328 1768 7bnnhh.exe 97 PID 3328 wrote to memory of 648 3328 jdjdd.exe 98 PID 3328 wrote to memory of 648 3328 jdjdd.exe 98 PID 3328 wrote to memory of 648 3328 jdjdd.exe 98 PID 648 wrote to memory of 1212 648 ddvvd.exe 99 PID 648 wrote to memory of 1212 648 ddvvd.exe 99 PID 648 wrote to memory of 1212 648 ddvvd.exe 99 PID 1212 wrote to memory of 612 1212 7fllffx.exe 100 PID 1212 wrote to memory of 612 1212 7fllffx.exe 100 PID 1212 wrote to memory of 612 1212 7fllffx.exe 100 PID 612 wrote to memory of 1532 612 htttnn.exe 101 PID 612 wrote to memory of 1532 612 htttnn.exe 101 PID 612 wrote to memory of 1532 612 htttnn.exe 101 PID 1532 wrote to memory of 4280 1532 vpvpj.exe 102 PID 1532 wrote to memory of 4280 1532 vpvpj.exe 102 PID 1532 wrote to memory of 4280 1532 vpvpj.exe 102 PID 4280 wrote to memory of 2948 4280 jdjjd.exe 103 PID 4280 wrote to memory of 2948 4280 jdjjd.exe 103 PID 4280 wrote to memory of 2948 4280 jdjjd.exe 103 PID 2948 wrote to memory of 1668 2948 tttnnn.exe 104 PID 2948 wrote to memory of 1668 2948 tttnnn.exe 104 PID 2948 wrote to memory of 1668 2948 tttnnn.exe 104 PID 1668 wrote to memory of 3596 1668 jvppp.exe 105 PID 1668 wrote to memory of 3596 1668 jvppp.exe 105 PID 1668 wrote to memory of 3596 1668 jvppp.exe 105 PID 3596 wrote to memory of 1480 3596 nnhhhh.exe 106 PID 3596 wrote to memory of 1480 3596 nnhhhh.exe 106 PID 3596 wrote to memory of 1480 3596 nnhhhh.exe 106 PID 1480 wrote to memory of 5004 1480 1vdvp.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\920bd5a31fb16db574c6c96d2dc8ef10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\920bd5a31fb16db574c6c96d2dc8ef10_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\pjddv.exec:\pjddv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\vjppv.exec:\vjppv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\pvvpp.exec:\pvvpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\hbtntt.exec:\hbtntt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
\??\c:\nnnnhb.exec:\nnnnhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\jpjdd.exec:\jpjdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\tbhtnb.exec:\tbhtnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\nbnhhh.exec:\nbnhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\lllrrll.exec:\lllrrll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\fxxxrxx.exec:\fxxxrxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\7bnnhh.exec:\7bnnhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\jdjdd.exec:\jdjdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\ddvvd.exec:\ddvvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
\??\c:\7fllffx.exec:\7fllffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\htttnn.exec:\htttnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:612 -
\??\c:\vpvpj.exec:\vpvpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\jdjjd.exec:\jdjjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\tttnnn.exec:\tttnnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\jvppp.exec:\jvppp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\nnhhhh.exec:\nnhhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\1vdvp.exec:\1vdvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\rrxxrxx.exec:\rrxxrxx.exe23⤵
- Executes dropped EXE
PID:5004 -
\??\c:\hhnbtb.exec:\hhnbtb.exe24⤵
- Executes dropped EXE
PID:3752 -
\??\c:\9jjdv.exec:\9jjdv.exe25⤵
- Executes dropped EXE
PID:2804 -
\??\c:\9vvvp.exec:\9vvvp.exe26⤵
- Executes dropped EXE
PID:3916 -
\??\c:\jpvpp.exec:\jpvpp.exe27⤵
- Executes dropped EXE
PID:2384 -
\??\c:\tttttt.exec:\tttttt.exe28⤵
- Executes dropped EXE
PID:1068 -
\??\c:\5rfxxxr.exec:\5rfxxxr.exe29⤵
- Executes dropped EXE
PID:2744 -
\??\c:\rfrlfrr.exec:\rfrlfrr.exe30⤵
- Executes dropped EXE
PID:928 -
\??\c:\9hhhhh.exec:\9hhhhh.exe31⤵
- Executes dropped EXE
PID:4508 -
\??\c:\lrlffff.exec:\lrlffff.exe32⤵
- Executes dropped EXE
PID:4344 -
\??\c:\lflxrll.exec:\lflxrll.exe33⤵
- Executes dropped EXE
PID:3068 -
\??\c:\1dpvv.exec:\1dpvv.exe34⤵
- Executes dropped EXE
PID:2572 -
\??\c:\xflxrlf.exec:\xflxrlf.exe35⤵
- Executes dropped EXE
PID:8 -
\??\c:\bnnhbt.exec:\bnnhbt.exe36⤵
- Executes dropped EXE
PID:3144 -
\??\c:\pvjjd.exec:\pvjjd.exe37⤵
- Executes dropped EXE
PID:4216 -
\??\c:\xlrxrfx.exec:\xlrxrfx.exe38⤵
- Executes dropped EXE
PID:1984 -
\??\c:\tbbnhb.exec:\tbbnhb.exe39⤵
- Executes dropped EXE
PID:1872 -
\??\c:\pddvp.exec:\pddvp.exe40⤵
- Executes dropped EXE
PID:3320 -
\??\c:\xxffffx.exec:\xxffffx.exe41⤵
- Executes dropped EXE
PID:4640 -
\??\c:\9nnbtt.exec:\9nnbtt.exe42⤵
- Executes dropped EXE
PID:1876 -
\??\c:\5vjdp.exec:\5vjdp.exe43⤵
- Executes dropped EXE
PID:4612 -
\??\c:\rrllxxf.exec:\rrllxxf.exe44⤵
- Executes dropped EXE
PID:3668 -
\??\c:\httntn.exec:\httntn.exe45⤵
- Executes dropped EXE
PID:4828 -
\??\c:\lflllrf.exec:\lflllrf.exe46⤵
- Executes dropped EXE
PID:4976 -
\??\c:\ntbtbt.exec:\ntbtbt.exe47⤵
- Executes dropped EXE
PID:3328 -
\??\c:\pddpj.exec:\pddpj.exe48⤵
- Executes dropped EXE
PID:648 -
\??\c:\xlxrrlx.exec:\xlxrrlx.exe49⤵
- Executes dropped EXE
PID:5024 -
\??\c:\ffrffxf.exec:\ffrffxf.exe50⤵
- Executes dropped EXE
PID:960 -
\??\c:\nbhbbt.exec:\nbhbbt.exe51⤵
- Executes dropped EXE
PID:3260 -
\??\c:\lflffxf.exec:\lflffxf.exe52⤵
- Executes dropped EXE
PID:4280 -
\??\c:\hntthn.exec:\hntthn.exe53⤵
- Executes dropped EXE
PID:2340 -
\??\c:\vddvj.exec:\vddvj.exe54⤵
- Executes dropped EXE
PID:2620 -
\??\c:\lfxlxrl.exec:\lfxlxrl.exe55⤵
- Executes dropped EXE
PID:2460 -
\??\c:\7btnnh.exec:\7btnnh.exe56⤵
- Executes dropped EXE
PID:2324 -
\??\c:\1pppj.exec:\1pppj.exe57⤵
- Executes dropped EXE
PID:3884 -
\??\c:\fxllrrx.exec:\fxllrrx.exe58⤵
- Executes dropped EXE
PID:1196 -
\??\c:\jpjvj.exec:\jpjvj.exe59⤵
- Executes dropped EXE
PID:1520 -
\??\c:\ddvpd.exec:\ddvpd.exe60⤵
- Executes dropped EXE
PID:3980 -
\??\c:\flxrfxr.exec:\flxrfxr.exe61⤵
- Executes dropped EXE
PID:336 -
\??\c:\1ttnnh.exec:\1ttnnh.exe62⤵
- Executes dropped EXE
PID:1880 -
\??\c:\vjpdv.exec:\vjpdv.exe63⤵
- Executes dropped EXE
PID:1964 -
\??\c:\bhhhbb.exec:\bhhhbb.exe64⤵
- Executes dropped EXE
PID:2384 -
\??\c:\1jpdp.exec:\1jpdp.exe65⤵
- Executes dropped EXE
PID:2336 -
\??\c:\9pjvj.exec:\9pjvj.exe66⤵PID:3612
-
\??\c:\5frxrfx.exec:\5frxrfx.exe67⤵PID:4108
-
\??\c:\ddppp.exec:\ddppp.exe68⤵PID:1720
-
\??\c:\rrxffff.exec:\rrxffff.exe69⤵PID:228
-
\??\c:\tnhbnh.exec:\tnhbnh.exe70⤵PID:4344
-
\??\c:\dvpvp.exec:\dvpvp.exe71⤵PID:4772
-
\??\c:\lllrlrl.exec:\lllrlrl.exe72⤵PID:3868
-
\??\c:\btnbnb.exec:\btnbnb.exe73⤵PID:1372
-
\??\c:\7rrllrl.exec:\7rrllrl.exe74⤵PID:1404
-
\??\c:\3bbthn.exec:\3bbthn.exe75⤵PID:1624
-
\??\c:\jdppj.exec:\jdppj.exe76⤵PID:5048
-
\??\c:\lxfrlrl.exec:\lxfrlrl.exe77⤵PID:3484
-
\??\c:\5tbtbb.exec:\5tbtbb.exe78⤵PID:4596
-
\??\c:\jppvd.exec:\jppvd.exe79⤵PID:4464
-
\??\c:\lfflffl.exec:\lfflffl.exe80⤵PID:3324
-
\??\c:\5ththh.exec:\5ththh.exe81⤵PID:2088
-
\??\c:\vddvv.exec:\vddvv.exe82⤵PID:4056
-
\??\c:\9jvpd.exec:\9jvpd.exe83⤵PID:1304
-
\??\c:\xxrrxrx.exec:\xxrrxrx.exe84⤵PID:4084
-
\??\c:\ttntnn.exec:\ttntnn.exe85⤵PID:2064
-
\??\c:\pjjdv.exec:\pjjdv.exe86⤵PID:2280
-
\??\c:\xrlxrrf.exec:\xrlxrrf.exe87⤵PID:1212
-
\??\c:\1pvpp.exec:\1pvpp.exe88⤵PID:2640
-
\??\c:\jdjjj.exec:\jdjjj.exe89⤵PID:4468
-
\??\c:\xxlrllf.exec:\xxlrllf.exe90⤵PID:4852
-
\??\c:\3vpdv.exec:\3vpdv.exe91⤵PID:1388
-
\??\c:\rrlflrf.exec:\rrlflrf.exe92⤵PID:5072
-
\??\c:\5thbbb.exec:\5thbbb.exe93⤵PID:4624
-
\??\c:\jjppj.exec:\jjppj.exe94⤵PID:4544
-
\??\c:\3vddv.exec:\3vddv.exe95⤵PID:2620
-
\??\c:\7xfxllr.exec:\7xfxllr.exe96⤵PID:1064
-
\??\c:\nbbhbn.exec:\nbbhbn.exe97⤵PID:3768
-
\??\c:\jpdvp.exec:\jpdvp.exe98⤵PID:4028
-
\??\c:\1xffxxr.exec:\1xffxxr.exe99⤵PID:2164
-
\??\c:\nttnhh.exec:\nttnhh.exe100⤵PID:1520
-
\??\c:\jpdvp.exec:\jpdvp.exe101⤵PID:1248
-
\??\c:\fxlrxfl.exec:\fxlrxfl.exe102⤵PID:3916
-
\??\c:\jppjj.exec:\jppjj.exe103⤵PID:4972
-
\??\c:\rllllll.exec:\rllllll.exe104⤵PID:4908
-
\??\c:\bthhbb.exec:\bthhbb.exe105⤵PID:4492
-
\??\c:\9vjdv.exec:\9vjdv.exe106⤵PID:4520
-
\??\c:\rxfflxf.exec:\rxfflxf.exe107⤵PID:1628
-
\??\c:\hthbbh.exec:\hthbbh.exe108⤵PID:3496
-
\??\c:\7dpdv.exec:\7dpdv.exe109⤵PID:1312
-
\??\c:\lxrxxff.exec:\lxrxxff.exe110⤵PID:4108
-
\??\c:\tttnnn.exec:\tttnnn.exe111⤵PID:1720
-
\??\c:\pppvv.exec:\pppvv.exe112⤵PID:228
-
\??\c:\lrrllll.exec:\lrrllll.exe113⤵PID:5100
-
\??\c:\5bntth.exec:\5bntth.exe114⤵PID:4772
-
\??\c:\pdpjj.exec:\pdpjj.exe115⤵PID:1368
-
\??\c:\xlrlfrx.exec:\xlrlfrx.exe116⤵PID:536
-
\??\c:\dvjjd.exec:\dvjjd.exe117⤵PID:3308
-
\??\c:\ppdvp.exec:\ppdvp.exe118⤵PID:3036
-
\??\c:\lllfffx.exec:\lllfffx.exe119⤵PID:1560
-
\??\c:\dvdvp.exec:\dvdvp.exe120⤵PID:4960
-
\??\c:\7rrlffl.exec:\7rrlffl.exe121⤵PID:3276
-
\??\c:\thnttt.exec:\thnttt.exe122⤵PID:1524
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-