Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 00:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7491c602491565c79401d5069cd1cc70_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
7491c602491565c79401d5069cd1cc70_NeikiAnalytics.exe
-
Size
77KB
-
MD5
7491c602491565c79401d5069cd1cc70
-
SHA1
59a4d7edb20fa7151d15bae83182b0fe6018fc40
-
SHA256
42661d71b8c18c6a0ff7816cd7b3debcee0bf04e01447149f7e4cf52a6e1a0c0
-
SHA512
8859ba0cca188eeb30010ed7f9a903b8bfb7d71025d5c685440a7ff2a60da0fe99e527f9e9bef7c2bb9c0ba0966ea5aa52cdf1e548947d818880760ea248b171
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAX8YieVIJclPvPJtcdcE:ymb3NkkiQ3mdBjFo68YBVIJc9JtxE
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/4692-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2392-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4196-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/996-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3920-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1572-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4664-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4000-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2612-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2812-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3636-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3420-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1404-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4972-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2616-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4224-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2424-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3508-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1308-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1600-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3740-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3112-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2392 ddjjv.exe 4196 bnnnbn.exe 3920 pdvdd.exe 996 fxfxrrr.exe 4568 rllrlfl.exe 1572 nhhntt.exe 4664 tnnhnh.exe 5056 ntthnh.exe 5116 rflffll.exe 4000 5hhbtn.exe 2612 jjjjv.exe 2812 jjdvj.exe 3636 9lllxff.exe 1344 frxllll.exe 3420 xflrflr.exe 1404 tttbhh.exe 2868 ntthht.exe 4972 7rxxxxx.exe 2616 rrfxlll.exe 4224 vjvvv.exe 652 lxfffll.exe 116 lrrxlfr.exe 2424 bttthb.exe 4920 jpjjd.exe 3508 lrllfff.exe 1308 hhtnnn.exe 1600 pjjpj.exe 5100 xfrlrxf.exe 3708 3ppjd.exe 3740 ffrffll.exe 3112 fffllll.exe 468 httntn.exe 4236 pvjjj.exe 4888 fxllllf.exe 1360 bntttb.exe 1156 ddjjd.exe 3628 nbnhhn.exe 4128 hhhhbb.exe 1116 djjjj.exe 2160 flllffr.exe 2440 hhhtnn.exe 2196 nhnthh.exe 588 jpvdv.exe 2324 xxfffll.exe 3536 nnttnt.exe 996 1vvvv.exe 512 jdvvj.exe 856 xxfxxfx.exe 60 hhbhtn.exe 2144 dvvvp.exe 924 dpvpp.exe 5004 xfffflf.exe 3304 nhbnnt.exe 2364 dpdvp.exe 4464 vdpvv.exe 5028 rfrxxxr.exe 3288 nbtnbb.exe 4356 bbhnhh.exe 1404 ddvvp.exe 3960 rlrrfll.exe 1252 xllllrl.exe 3632 nhnnnn.exe 2996 5pppj.exe 4524 jjvvj.exe -
resource yara_rule behavioral2/memory/4692-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2392-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4196-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/996-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/996-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/996-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4568-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1572-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4664-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4000-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4000-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2612-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2812-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3636-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3420-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1404-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2616-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4224-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2424-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3508-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1308-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1600-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3740-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3112-208-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4692 wrote to memory of 2392 4692 7491c602491565c79401d5069cd1cc70_NeikiAnalytics.exe 82 PID 4692 wrote to memory of 2392 4692 7491c602491565c79401d5069cd1cc70_NeikiAnalytics.exe 82 PID 4692 wrote to memory of 2392 4692 7491c602491565c79401d5069cd1cc70_NeikiAnalytics.exe 82 PID 2392 wrote to memory of 4196 2392 ddjjv.exe 83 PID 2392 wrote to memory of 4196 2392 ddjjv.exe 83 PID 2392 wrote to memory of 4196 2392 ddjjv.exe 83 PID 4196 wrote to memory of 3920 4196 bnnnbn.exe 84 PID 4196 wrote to memory of 3920 4196 bnnnbn.exe 84 PID 4196 wrote to memory of 3920 4196 bnnnbn.exe 84 PID 3920 wrote to memory of 996 3920 pdvdd.exe 85 PID 3920 wrote to memory of 996 3920 pdvdd.exe 85 PID 3920 wrote to memory of 996 3920 pdvdd.exe 85 PID 996 wrote to memory of 4568 996 fxfxrrr.exe 86 PID 996 wrote to memory of 4568 996 fxfxrrr.exe 86 PID 996 wrote to memory of 4568 996 fxfxrrr.exe 86 PID 4568 wrote to memory of 1572 4568 rllrlfl.exe 87 PID 4568 wrote to memory of 1572 4568 rllrlfl.exe 87 PID 4568 wrote to memory of 1572 4568 rllrlfl.exe 87 PID 1572 wrote to memory of 4664 1572 nhhntt.exe 88 PID 1572 wrote to memory of 4664 1572 nhhntt.exe 88 PID 1572 wrote to memory of 4664 1572 nhhntt.exe 88 PID 4664 wrote to memory of 5056 4664 tnnhnh.exe 89 PID 4664 wrote to memory of 5056 4664 tnnhnh.exe 89 PID 4664 wrote to memory of 5056 4664 tnnhnh.exe 89 PID 5056 wrote to memory of 5116 5056 ntthnh.exe 90 PID 5056 wrote to memory of 5116 5056 ntthnh.exe 90 PID 5056 wrote to memory of 5116 5056 ntthnh.exe 90 PID 5116 wrote to memory of 4000 5116 rflffll.exe 91 PID 5116 wrote to memory of 4000 5116 rflffll.exe 91 PID 5116 wrote to memory of 4000 5116 rflffll.exe 91 PID 4000 wrote to memory of 2612 4000 5hhbtn.exe 92 PID 4000 wrote to memory of 2612 4000 5hhbtn.exe 92 PID 4000 wrote to memory of 2612 4000 5hhbtn.exe 92 PID 2612 wrote to memory of 2812 2612 jjjjv.exe 93 PID 2612 wrote to memory of 2812 2612 jjjjv.exe 93 PID 2612 wrote to memory of 2812 2612 jjjjv.exe 93 PID 2812 wrote to memory of 3636 2812 jjdvj.exe 94 PID 2812 wrote to memory of 3636 2812 jjdvj.exe 94 PID 2812 wrote to memory of 3636 2812 jjdvj.exe 94 PID 3636 wrote to memory of 1344 3636 9lllxff.exe 95 PID 3636 wrote to memory of 1344 3636 9lllxff.exe 95 PID 3636 wrote to memory of 1344 3636 9lllxff.exe 95 PID 1344 wrote to memory of 3420 1344 frxllll.exe 96 PID 1344 wrote to memory of 3420 1344 frxllll.exe 96 PID 1344 wrote to memory of 3420 1344 frxllll.exe 96 PID 3420 wrote to memory of 1404 3420 xflrflr.exe 97 PID 3420 wrote to memory of 1404 3420 xflrflr.exe 97 PID 3420 wrote to memory of 1404 3420 xflrflr.exe 97 PID 1404 wrote to memory of 2868 1404 tttbhh.exe 98 PID 1404 wrote to memory of 2868 1404 tttbhh.exe 98 PID 1404 wrote to memory of 2868 1404 tttbhh.exe 98 PID 2868 wrote to memory of 4972 2868 ntthht.exe 99 PID 2868 wrote to memory of 4972 2868 ntthht.exe 99 PID 2868 wrote to memory of 4972 2868 ntthht.exe 99 PID 4972 wrote to memory of 2616 4972 7rxxxxx.exe 100 PID 4972 wrote to memory of 2616 4972 7rxxxxx.exe 100 PID 4972 wrote to memory of 2616 4972 7rxxxxx.exe 100 PID 2616 wrote to memory of 4224 2616 rrfxlll.exe 101 PID 2616 wrote to memory of 4224 2616 rrfxlll.exe 101 PID 2616 wrote to memory of 4224 2616 rrfxlll.exe 101 PID 4224 wrote to memory of 652 4224 vjvvv.exe 102 PID 4224 wrote to memory of 652 4224 vjvvv.exe 102 PID 4224 wrote to memory of 652 4224 vjvvv.exe 102 PID 652 wrote to memory of 116 652 lxfffll.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\7491c602491565c79401d5069cd1cc70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7491c602491565c79401d5069cd1cc70_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\ddjjv.exec:\ddjjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\bnnnbn.exec:\bnnnbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
\??\c:\pdvdd.exec:\pdvdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\fxfxrrr.exec:\fxfxrrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\rllrlfl.exec:\rllrlfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\nhhntt.exec:\nhhntt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\tnnhnh.exec:\tnnhnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\ntthnh.exec:\ntthnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\rflffll.exec:\rflffll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\5hhbtn.exec:\5hhbtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\jjjjv.exec:\jjjjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\jjdvj.exec:\jjdvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\9lllxff.exec:\9lllxff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\frxllll.exec:\frxllll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\xflrflr.exec:\xflrflr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
\??\c:\tttbhh.exec:\tttbhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\ntthht.exec:\ntthht.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\7rxxxxx.exec:\7rxxxxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\rrfxlll.exec:\rrfxlll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\vjvvv.exec:\vjvvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\lxfffll.exec:\lxfffll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
\??\c:\lrrxlfr.exec:\lrrxlfr.exe23⤵
- Executes dropped EXE
PID:116 -
\??\c:\bttthb.exec:\bttthb.exe24⤵
- Executes dropped EXE
PID:2424 -
\??\c:\jpjjd.exec:\jpjjd.exe25⤵
- Executes dropped EXE
PID:4920 -
\??\c:\lrllfff.exec:\lrllfff.exe26⤵
- Executes dropped EXE
PID:3508 -
\??\c:\hhtnnn.exec:\hhtnnn.exe27⤵
- Executes dropped EXE
PID:1308 -
\??\c:\pjjpj.exec:\pjjpj.exe28⤵
- Executes dropped EXE
PID:1600 -
\??\c:\xfrlrxf.exec:\xfrlrxf.exe29⤵
- Executes dropped EXE
PID:5100 -
\??\c:\3ppjd.exec:\3ppjd.exe30⤵
- Executes dropped EXE
PID:3708 -
\??\c:\ffrffll.exec:\ffrffll.exe31⤵
- Executes dropped EXE
PID:3740 -
\??\c:\fffllll.exec:\fffllll.exe32⤵
- Executes dropped EXE
PID:3112 -
\??\c:\httntn.exec:\httntn.exe33⤵
- Executes dropped EXE
PID:468 -
\??\c:\pvjjj.exec:\pvjjj.exe34⤵
- Executes dropped EXE
PID:4236 -
\??\c:\fxllllf.exec:\fxllllf.exe35⤵
- Executes dropped EXE
PID:4888 -
\??\c:\bntttb.exec:\bntttb.exe36⤵
- Executes dropped EXE
PID:1360 -
\??\c:\ddjjd.exec:\ddjjd.exe37⤵
- Executes dropped EXE
PID:1156 -
\??\c:\nbnhhn.exec:\nbnhhn.exe38⤵
- Executes dropped EXE
PID:3628 -
\??\c:\hhhhbb.exec:\hhhhbb.exe39⤵
- Executes dropped EXE
PID:4128 -
\??\c:\djjjj.exec:\djjjj.exe40⤵
- Executes dropped EXE
PID:1116 -
\??\c:\flllffr.exec:\flllffr.exe41⤵
- Executes dropped EXE
PID:2160 -
\??\c:\hhhtnn.exec:\hhhtnn.exe42⤵
- Executes dropped EXE
PID:2440 -
\??\c:\nhnthh.exec:\nhnthh.exe43⤵
- Executes dropped EXE
PID:2196 -
\??\c:\jpvdv.exec:\jpvdv.exe44⤵
- Executes dropped EXE
PID:588 -
\??\c:\xxfffll.exec:\xxfffll.exe45⤵
- Executes dropped EXE
PID:2324 -
\??\c:\nnttnt.exec:\nnttnt.exe46⤵
- Executes dropped EXE
PID:3536 -
\??\c:\1vvvv.exec:\1vvvv.exe47⤵
- Executes dropped EXE
PID:996 -
\??\c:\jdvvj.exec:\jdvvj.exe48⤵
- Executes dropped EXE
PID:512 -
\??\c:\xxfxxfx.exec:\xxfxxfx.exe49⤵
- Executes dropped EXE
PID:856 -
\??\c:\hhbhtn.exec:\hhbhtn.exe50⤵
- Executes dropped EXE
PID:60 -
\??\c:\dvvvp.exec:\dvvvp.exe51⤵
- Executes dropped EXE
PID:2144 -
\??\c:\dpvpp.exec:\dpvpp.exe52⤵
- Executes dropped EXE
PID:924 -
\??\c:\xfffflf.exec:\xfffflf.exe53⤵
- Executes dropped EXE
PID:5004 -
\??\c:\nhbnnt.exec:\nhbnnt.exe54⤵
- Executes dropped EXE
PID:3304 -
\??\c:\dpdvp.exec:\dpdvp.exe55⤵
- Executes dropped EXE
PID:2364 -
\??\c:\vdpvv.exec:\vdpvv.exe56⤵
- Executes dropped EXE
PID:4464 -
\??\c:\rfrxxxr.exec:\rfrxxxr.exe57⤵
- Executes dropped EXE
PID:5028 -
\??\c:\nbtnbb.exec:\nbtnbb.exe58⤵
- Executes dropped EXE
PID:3288 -
\??\c:\bbhnhh.exec:\bbhnhh.exe59⤵
- Executes dropped EXE
PID:4356 -
\??\c:\ddvvp.exec:\ddvvp.exe60⤵
- Executes dropped EXE
PID:1404 -
\??\c:\rlrrfll.exec:\rlrrfll.exe61⤵
- Executes dropped EXE
PID:3960 -
\??\c:\xllllrl.exec:\xllllrl.exe62⤵
- Executes dropped EXE
PID:1252 -
\??\c:\nhnnnn.exec:\nhnnnn.exe63⤵
- Executes dropped EXE
PID:3632 -
\??\c:\5pppj.exec:\5pppj.exe64⤵
- Executes dropped EXE
PID:2996 -
\??\c:\jjvvj.exec:\jjvvj.exe65⤵
- Executes dropped EXE
PID:4524 -
\??\c:\rxfxxrr.exec:\rxfxxrr.exe66⤵PID:2132
-
\??\c:\1httbh.exec:\1httbh.exe67⤵PID:652
-
\??\c:\vvjjj.exec:\vvjjj.exe68⤵PID:872
-
\??\c:\xfrlrlr.exec:\xfrlrlr.exe69⤵PID:2568
-
\??\c:\3nnnnb.exec:\3nnnnb.exe70⤵PID:3508
-
\??\c:\jpvvd.exec:\jpvvd.exe71⤵PID:1308
-
\??\c:\7ffxrrl.exec:\7ffxrrl.exe72⤵PID:4252
-
\??\c:\rxfxxxx.exec:\rxfxxxx.exe73⤵PID:744
-
\??\c:\nhbhtt.exec:\nhbhtt.exe74⤵PID:5100
-
\??\c:\7pvpp.exec:\7pvpp.exe75⤵PID:768
-
\??\c:\vjpjj.exec:\vjpjj.exe76⤵PID:3740
-
\??\c:\frflxlr.exec:\frflxlr.exe77⤵PID:3112
-
\??\c:\nnhbtt.exec:\nnhbtt.exe78⤵PID:648
-
\??\c:\9tbnnh.exec:\9tbnnh.exe79⤵PID:2888
-
\??\c:\rrfxlrl.exec:\rrfxlrl.exe80⤵PID:4240
-
\??\c:\nhntnb.exec:\nhntnb.exe81⤵PID:1988
-
\??\c:\htnnnn.exec:\htnnnn.exe82⤵PID:1840
-
\??\c:\dvjjj.exec:\dvjjj.exe83⤵PID:2580
-
\??\c:\ddjjv.exec:\ddjjv.exe84⤵PID:4656
-
\??\c:\1rrlflr.exec:\1rrlflr.exe85⤵PID:1656
-
\??\c:\5ntttb.exec:\5ntttb.exe86⤵PID:2392
-
\??\c:\nnttbb.exec:\nnttbb.exe87⤵PID:1616
-
\??\c:\dvvvp.exec:\dvvvp.exe88⤵PID:1564
-
\??\c:\jjpjv.exec:\jjpjv.exe89⤵PID:2440
-
\??\c:\lxlxxxl.exec:\lxlxxxl.exe90⤵PID:3292
-
\??\c:\frxlrxr.exec:\frxlrxr.exe91⤵PID:3808
-
\??\c:\nthhhn.exec:\nthhhn.exe92⤵PID:2324
-
\??\c:\nthhhh.exec:\nthhhh.exe93⤵PID:2920
-
\??\c:\jjppj.exec:\jjppj.exe94⤵PID:3984
-
\??\c:\7ddvj.exec:\7ddvj.exe95⤵PID:856
-
\??\c:\lfllflr.exec:\lfllflr.exe96⤵PID:3456
-
\??\c:\llllfff.exec:\llllfff.exe97⤵PID:5116
-
\??\c:\bhbnbt.exec:\bhbnbt.exe98⤵PID:3844
-
\??\c:\hhtnnt.exec:\hhtnnt.exe99⤵PID:5012
-
\??\c:\dddjj.exec:\dddjj.exe100⤵PID:4840
-
\??\c:\pdjdd.exec:\pdjdd.exe101⤵PID:5052
-
\??\c:\fffxrrr.exec:\fffxrrr.exe102⤵PID:5028
-
\??\c:\fxflflf.exec:\fxflflf.exe103⤵PID:2756
-
\??\c:\nnbtnn.exec:\nnbtnn.exe104⤵PID:4376
-
\??\c:\9hhtnh.exec:\9hhtnh.exe105⤵PID:3584
-
\??\c:\pjdvd.exec:\pjdvd.exe106⤵PID:1528
-
\??\c:\5ffxrrl.exec:\5ffxrrl.exe107⤵PID:1532
-
\??\c:\xxrrfxx.exec:\xxrrfxx.exe108⤵PID:4384
-
\??\c:\ttnhbb.exec:\ttnhbb.exe109⤵PID:4524
-
\??\c:\hnhnnt.exec:\hnhnnt.exe110⤵PID:376
-
\??\c:\djjjp.exec:\djjjp.exe111⤵PID:4912
-
\??\c:\3jvdv.exec:\3jvdv.exe112⤵PID:4804
-
\??\c:\xxxrlll.exec:\xxxrlll.exe113⤵PID:4992
-
\??\c:\xrxrxll.exec:\xrxrxll.exe114⤵PID:1648
-
\??\c:\bnhhbb.exec:\bnhhbb.exe115⤵PID:3548
-
\??\c:\jpjjj.exec:\jpjjj.exe116⤵PID:768
-
\??\c:\ppvpj.exec:\ppvpj.exe117⤵PID:2896
-
\??\c:\rrxxxxx.exec:\rrxxxxx.exe118⤵PID:4236
-
\??\c:\tnnnhh.exec:\tnnnhh.exe119⤵PID:4532
-
\??\c:\nhnnth.exec:\nhnnth.exe120⤵PID:2248
-
\??\c:\vvjdj.exec:\vvjdj.exe121⤵PID:3824
-
\??\c:\pjpjv.exec:\pjpjv.exe122⤵PID:1796
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-