Analysis
-
max time kernel
150s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2024, 00:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
668c716ee0b7aacde10c15a87e28a830_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
668c716ee0b7aacde10c15a87e28a830_NeikiAnalytics.exe
-
Size
67KB
-
MD5
668c716ee0b7aacde10c15a87e28a830
-
SHA1
d896a2eae9ff4bfc8de86bf87bbd4c4c1fb481ac
-
SHA256
04076b629cf599646aa48c9f4ec2af403369e66e902891a9e0b2dc3960dae3b9
-
SHA512
70b60dde2518372baa4c54add73342f1a4b52af3a14645facdb02253678d52c6af4fa928284341ae1852fd82d5dd2c1af340f9ed6725f3fd6c5a6f87f66df6d0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFdJUDbAIVZ:ymb3NkkiQ3mdBjFIFdJ8bf
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/4304-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3828-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3024-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2372-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3952-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3952-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1400-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1612-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1720-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1720-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1820-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2456-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/652-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2360-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1380-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3144-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1564-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4596-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3032-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4752-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2884-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4916-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3264-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2608-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4624-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3828 tbntbh.exe 3024 vppjd.exe 2372 ffrrrrf.exe 3952 ffxxxll.exe 4852 dpvpp.exe 3628 jdvpj.exe 1400 nbtnbb.exe 1612 jdpjj.exe 5116 xrfrxrx.exe 1720 bbhbbb.exe 1820 5dpjp.exe 2456 jjjjd.exe 3732 rrfxffx.exe 2360 jvjpp.exe 652 jvddd.exe 4792 frllxlf.exe 1380 5rxxrfx.exe 3144 vvjpp.exe 1564 flrrllf.exe 4596 jdppp.exe 3032 lfrfrfr.exe 1592 btbhnn.exe 4752 ddddv.exe 2884 jdvvd.exe 4916 llrxxxf.exe 3264 nbbhhb.exe 2608 djpdp.exe 2356 rffxllf.exe 1232 xrllxrf.exe 4624 btttnh.exe 1420 7httnn.exe 1260 jvjvv.exe 3912 9frxrrl.exe 1568 1tbhhn.exe 3400 bttnnh.exe 4348 dvdvp.exe 4432 fllrlll.exe 4528 1fllfll.exe 3132 7nbbtt.exe 5016 dvdvp.exe 3124 vvdvp.exe 4296 flfflrr.exe 2680 3tttnn.exe 664 httnnn.exe 1204 vvdjd.exe 4600 flrrlll.exe 1920 rllrrfx.exe 2316 7nthnn.exe 1612 vppjp.exe 5116 dpvpj.exe 1088 5fffxrl.exe 2024 lfllrlf.exe 3312 tbhhtt.exe 4428 hhhbbb.exe 4612 jjvpd.exe 3732 dvdpj.exe 2340 xllxxrr.exe 4576 nhbtnh.exe 2184 ntbbtb.exe 4996 httnbb.exe 1380 vvjdv.exe 2956 9jvpd.exe 3824 rlfxrrl.exe 1208 lffxflx.exe -
resource yara_rule behavioral2/memory/4304-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3828-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3024-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1400-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1400-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1400-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1400-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1612-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1720-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1720-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1720-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1820-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2456-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/652-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2360-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1380-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1564-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4596-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2884-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4916-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3264-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2608-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4624-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4304 wrote to memory of 3828 4304 668c716ee0b7aacde10c15a87e28a830_NeikiAnalytics.exe 83 PID 4304 wrote to memory of 3828 4304 668c716ee0b7aacde10c15a87e28a830_NeikiAnalytics.exe 83 PID 4304 wrote to memory of 3828 4304 668c716ee0b7aacde10c15a87e28a830_NeikiAnalytics.exe 83 PID 3828 wrote to memory of 3024 3828 tbntbh.exe 84 PID 3828 wrote to memory of 3024 3828 tbntbh.exe 84 PID 3828 wrote to memory of 3024 3828 tbntbh.exe 84 PID 3024 wrote to memory of 2372 3024 vppjd.exe 85 PID 3024 wrote to memory of 2372 3024 vppjd.exe 85 PID 3024 wrote to memory of 2372 3024 vppjd.exe 85 PID 2372 wrote to memory of 3952 2372 ffrrrrf.exe 86 PID 2372 wrote to memory of 3952 2372 ffrrrrf.exe 86 PID 2372 wrote to memory of 3952 2372 ffrrrrf.exe 86 PID 3952 wrote to memory of 4852 3952 ffxxxll.exe 87 PID 3952 wrote to memory of 4852 3952 ffxxxll.exe 87 PID 3952 wrote to memory of 4852 3952 ffxxxll.exe 87 PID 4852 wrote to memory of 3628 4852 dpvpp.exe 88 PID 4852 wrote to memory of 3628 4852 dpvpp.exe 88 PID 4852 wrote to memory of 3628 4852 dpvpp.exe 88 PID 3628 wrote to memory of 1400 3628 jdvpj.exe 89 PID 3628 wrote to memory of 1400 3628 jdvpj.exe 89 PID 3628 wrote to memory of 1400 3628 jdvpj.exe 89 PID 1400 wrote to memory of 1612 1400 nbtnbb.exe 90 PID 1400 wrote to memory of 1612 1400 nbtnbb.exe 90 PID 1400 wrote to memory of 1612 1400 nbtnbb.exe 90 PID 1612 wrote to memory of 5116 1612 jdpjj.exe 91 PID 1612 wrote to memory of 5116 1612 jdpjj.exe 91 PID 1612 wrote to memory of 5116 1612 jdpjj.exe 91 PID 5116 wrote to memory of 1720 5116 xrfrxrx.exe 92 PID 5116 wrote to memory of 1720 5116 xrfrxrx.exe 92 PID 5116 wrote to memory of 1720 5116 xrfrxrx.exe 92 PID 1720 wrote to memory of 1820 1720 bbhbbb.exe 93 PID 1720 wrote to memory of 1820 1720 bbhbbb.exe 93 PID 1720 wrote to memory of 1820 1720 bbhbbb.exe 93 PID 1820 wrote to memory of 2456 1820 5dpjp.exe 94 PID 1820 wrote to memory of 2456 1820 5dpjp.exe 94 PID 1820 wrote to memory of 2456 1820 5dpjp.exe 94 PID 2456 wrote to memory of 3732 2456 jjjjd.exe 95 PID 2456 wrote to memory of 3732 2456 jjjjd.exe 95 PID 2456 wrote to memory of 3732 2456 jjjjd.exe 95 PID 3732 wrote to memory of 2360 3732 rrfxffx.exe 96 PID 3732 wrote to memory of 2360 3732 rrfxffx.exe 96 PID 3732 wrote to memory of 2360 3732 rrfxffx.exe 96 PID 2360 wrote to memory of 652 2360 jvjpp.exe 98 PID 2360 wrote to memory of 652 2360 jvjpp.exe 98 PID 2360 wrote to memory of 652 2360 jvjpp.exe 98 PID 652 wrote to memory of 4792 652 jvddd.exe 99 PID 652 wrote to memory of 4792 652 jvddd.exe 99 PID 652 wrote to memory of 4792 652 jvddd.exe 99 PID 4792 wrote to memory of 1380 4792 frllxlf.exe 100 PID 4792 wrote to memory of 1380 4792 frllxlf.exe 100 PID 4792 wrote to memory of 1380 4792 frllxlf.exe 100 PID 1380 wrote to memory of 3144 1380 5rxxrfx.exe 101 PID 1380 wrote to memory of 3144 1380 5rxxrfx.exe 101 PID 1380 wrote to memory of 3144 1380 5rxxrfx.exe 101 PID 3144 wrote to memory of 1564 3144 vvjpp.exe 102 PID 3144 wrote to memory of 1564 3144 vvjpp.exe 102 PID 3144 wrote to memory of 1564 3144 vvjpp.exe 102 PID 1564 wrote to memory of 4596 1564 flrrllf.exe 104 PID 1564 wrote to memory of 4596 1564 flrrllf.exe 104 PID 1564 wrote to memory of 4596 1564 flrrllf.exe 104 PID 4596 wrote to memory of 3032 4596 jdppp.exe 105 PID 4596 wrote to memory of 3032 4596 jdppp.exe 105 PID 4596 wrote to memory of 3032 4596 jdppp.exe 105 PID 3032 wrote to memory of 1592 3032 lfrfrfr.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\668c716ee0b7aacde10c15a87e28a830_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\668c716ee0b7aacde10c15a87e28a830_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4304 -
\??\c:\tbntbh.exec:\tbntbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\vppjd.exec:\vppjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\ffrrrrf.exec:\ffrrrrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\ffxxxll.exec:\ffxxxll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\dpvpp.exec:\dpvpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\jdvpj.exec:\jdvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\nbtnbb.exec:\nbtnbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\jdpjj.exec:\jdpjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\xrfrxrx.exec:\xrfrxrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\bbhbbb.exec:\bbhbbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\5dpjp.exec:\5dpjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\jjjjd.exec:\jjjjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\rrfxffx.exec:\rrfxffx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\jvjpp.exec:\jvjpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\jvddd.exec:\jvddd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
\??\c:\frllxlf.exec:\frllxlf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\5rxxrfx.exec:\5rxxrfx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\vvjpp.exec:\vvjpp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\flrrllf.exec:\flrrllf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\jdppp.exec:\jdppp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\lfrfrfr.exec:\lfrfrfr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\btbhnn.exec:\btbhnn.exe23⤵
- Executes dropped EXE
PID:1592 -
\??\c:\ddddv.exec:\ddddv.exe24⤵
- Executes dropped EXE
PID:4752 -
\??\c:\jdvvd.exec:\jdvvd.exe25⤵
- Executes dropped EXE
PID:2884 -
\??\c:\llrxxxf.exec:\llrxxxf.exe26⤵
- Executes dropped EXE
PID:4916 -
\??\c:\nbbhhb.exec:\nbbhhb.exe27⤵
- Executes dropped EXE
PID:3264 -
\??\c:\djpdp.exec:\djpdp.exe28⤵
- Executes dropped EXE
PID:2608 -
\??\c:\rffxllf.exec:\rffxllf.exe29⤵
- Executes dropped EXE
PID:2356 -
\??\c:\xrllxrf.exec:\xrllxrf.exe30⤵
- Executes dropped EXE
PID:1232 -
\??\c:\btttnh.exec:\btttnh.exe31⤵
- Executes dropped EXE
PID:4624 -
\??\c:\7httnn.exec:\7httnn.exe32⤵
- Executes dropped EXE
PID:1420 -
\??\c:\jvjvv.exec:\jvjvv.exe33⤵
- Executes dropped EXE
PID:1260 -
\??\c:\9frxrrl.exec:\9frxrrl.exe34⤵
- Executes dropped EXE
PID:3912 -
\??\c:\1tbhhn.exec:\1tbhhn.exe35⤵
- Executes dropped EXE
PID:1568 -
\??\c:\bttnnh.exec:\bttnnh.exe36⤵
- Executes dropped EXE
PID:3400 -
\??\c:\dvdvp.exec:\dvdvp.exe37⤵
- Executes dropped EXE
PID:4348 -
\??\c:\fllrlll.exec:\fllrlll.exe38⤵
- Executes dropped EXE
PID:4432 -
\??\c:\1fllfll.exec:\1fllfll.exe39⤵
- Executes dropped EXE
PID:4528 -
\??\c:\7nbbtt.exec:\7nbbtt.exe40⤵
- Executes dropped EXE
PID:3132 -
\??\c:\dvdvp.exec:\dvdvp.exe41⤵
- Executes dropped EXE
PID:5016 -
\??\c:\vvdvp.exec:\vvdvp.exe42⤵
- Executes dropped EXE
PID:3124 -
\??\c:\flfflrr.exec:\flfflrr.exe43⤵
- Executes dropped EXE
PID:4296 -
\??\c:\3tttnn.exec:\3tttnn.exe44⤵
- Executes dropped EXE
PID:2680 -
\??\c:\httnnn.exec:\httnnn.exe45⤵
- Executes dropped EXE
PID:664 -
\??\c:\vvdjd.exec:\vvdjd.exe46⤵
- Executes dropped EXE
PID:1204 -
\??\c:\flrrlll.exec:\flrrlll.exe47⤵
- Executes dropped EXE
PID:4600 -
\??\c:\rllrrfx.exec:\rllrrfx.exe48⤵
- Executes dropped EXE
PID:1920 -
\??\c:\7nthnn.exec:\7nthnn.exe49⤵
- Executes dropped EXE
PID:2316 -
\??\c:\vppjp.exec:\vppjp.exe50⤵
- Executes dropped EXE
PID:1612 -
\??\c:\dpvpj.exec:\dpvpj.exe51⤵
- Executes dropped EXE
PID:5116 -
\??\c:\5fffxrl.exec:\5fffxrl.exe52⤵
- Executes dropped EXE
PID:1088 -
\??\c:\lfllrlf.exec:\lfllrlf.exe53⤵
- Executes dropped EXE
PID:2024 -
\??\c:\tbhhtt.exec:\tbhhtt.exe54⤵
- Executes dropped EXE
PID:3312 -
\??\c:\hhhbbb.exec:\hhhbbb.exe55⤵
- Executes dropped EXE
PID:4428 -
\??\c:\jjvpd.exec:\jjvpd.exe56⤵
- Executes dropped EXE
PID:4612 -
\??\c:\dvdpj.exec:\dvdpj.exe57⤵
- Executes dropped EXE
PID:3732 -
\??\c:\xllxxrr.exec:\xllxxrr.exe58⤵
- Executes dropped EXE
PID:2340 -
\??\c:\nhbtnh.exec:\nhbtnh.exe59⤵
- Executes dropped EXE
PID:4576 -
\??\c:\ntbbtb.exec:\ntbbtb.exe60⤵
- Executes dropped EXE
PID:2184 -
\??\c:\httnbb.exec:\httnbb.exe61⤵
- Executes dropped EXE
PID:4996 -
\??\c:\vvjdv.exec:\vvjdv.exe62⤵
- Executes dropped EXE
PID:1380 -
\??\c:\9jvpd.exec:\9jvpd.exe63⤵
- Executes dropped EXE
PID:2956 -
\??\c:\rlfxrrl.exec:\rlfxrrl.exe64⤵
- Executes dropped EXE
PID:3824 -
\??\c:\lffxflx.exec:\lffxflx.exe65⤵
- Executes dropped EXE
PID:1208 -
\??\c:\7nhhtt.exec:\7nhhtt.exe66⤵PID:4888
-
\??\c:\vdpjd.exec:\vdpjd.exe67⤵PID:232
-
\??\c:\pvddd.exec:\pvddd.exe68⤵PID:3032
-
\??\c:\xfrlllf.exec:\xfrlllf.exe69⤵PID:1408
-
\??\c:\nnbttn.exec:\nnbttn.exe70⤵PID:3404
-
\??\c:\bthbtt.exec:\bthbtt.exe71⤵PID:4752
-
\??\c:\3jpjd.exec:\3jpjd.exe72⤵PID:1428
-
\??\c:\rffxrlf.exec:\rffxrlf.exe73⤵PID:1156
-
\??\c:\3bhhnn.exec:\3bhhnn.exe74⤵PID:4812
-
\??\c:\7ttnhh.exec:\7ttnhh.exe75⤵PID:3320
-
\??\c:\dvvpv.exec:\dvvpv.exe76⤵PID:1044
-
\??\c:\jdjdv.exec:\jdjdv.exe77⤵PID:3776
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe78⤵PID:212
-
\??\c:\htttnh.exec:\htttnh.exe79⤵PID:4244
-
\??\c:\btbttn.exec:\btbttn.exe80⤵PID:1144
-
\??\c:\dvddj.exec:\dvddj.exe81⤵PID:2276
-
\??\c:\ppdvp.exec:\ppdvp.exe82⤵PID:2924
-
\??\c:\fflxfxx.exec:\fflxfxx.exe83⤵PID:3912
-
\??\c:\fxxxlfl.exec:\fxxxlfl.exe84⤵PID:2084
-
\??\c:\bhnbht.exec:\bhnbht.exe85⤵PID:2536
-
\??\c:\nbtbbb.exec:\nbtbbb.exe86⤵PID:4304
-
\??\c:\djjjj.exec:\djjjj.exe87⤵PID:3020
-
\??\c:\xrxlxxx.exec:\xrxlxxx.exe88⤵PID:612
-
\??\c:\rxfffll.exec:\rxfffll.exe89⤵PID:3132
-
\??\c:\thhbbt.exec:\thhbbt.exe90⤵PID:1964
-
\??\c:\nbtttb.exec:\nbtttb.exe91⤵PID:892
-
\??\c:\dppjd.exec:\dppjd.exe92⤵PID:2488
-
\??\c:\pjdvp.exec:\pjdvp.exe93⤵PID:1416
-
\??\c:\lfrrrll.exec:\lfrrrll.exe94⤵PID:908
-
\??\c:\7ttthb.exec:\7ttthb.exe95⤵PID:4400
-
\??\c:\5hbtnn.exec:\5hbtnn.exe96⤵PID:4212
-
\??\c:\jpdvv.exec:\jpdvv.exe97⤵PID:376
-
\??\c:\rllllrx.exec:\rllllrx.exe98⤵PID:4928
-
\??\c:\fxffffr.exec:\fxffffr.exe99⤵PID:4864
-
\??\c:\bbbbbb.exec:\bbbbbb.exe100⤵PID:3204
-
\??\c:\thnnnn.exec:\thnnnn.exe101⤵PID:1340
-
\??\c:\7vppj.exec:\7vppj.exe102⤵PID:2320
-
\??\c:\xrfflfx.exec:\xrfflfx.exe103⤵PID:3336
-
\??\c:\nhbbtt.exec:\nhbbtt.exe104⤵PID:808
-
\??\c:\pdddv.exec:\pdddv.exe105⤵PID:1632
-
\??\c:\5dvpj.exec:\5dvpj.exe106⤵PID:4792
-
\??\c:\7llfrrl.exec:\7llfrrl.exe107⤵PID:3108
-
\??\c:\1rllxxl.exec:\1rllxxl.exe108⤵PID:1776
-
\??\c:\tbtnnt.exec:\tbtnnt.exe109⤵PID:4840
-
\??\c:\jdddv.exec:\jdddv.exe110⤵PID:1792
-
\??\c:\pppjd.exec:\pppjd.exe111⤵PID:1564
-
\??\c:\lxlfxrr.exec:\lxlfxrr.exe112⤵PID:2980
-
\??\c:\xlxlxrl.exec:\xlxlxrl.exe113⤵PID:232
-
\??\c:\vjjdd.exec:\vjjdd.exe114⤵PID:3724
-
\??\c:\lxxxxxx.exec:\lxxxxxx.exe115⤵PID:1472
-
\??\c:\fxlffll.exec:\fxlffll.exe116⤵PID:2808
-
\??\c:\btbbtt.exec:\btbbtt.exe117⤵PID:4520
-
\??\c:\ntnhbb.exec:\ntnhbb.exe118⤵PID:2816
-
\??\c:\frfxfrl.exec:\frfxfrl.exe119⤵PID:4952
-
\??\c:\tnttbt.exec:\tnttbt.exe120⤵PID:3308
-
\??\c:\vdpjd.exec:\vdpjd.exe121⤵PID:384
-
\??\c:\7ddjd.exec:\7ddjd.exe122⤵PID:1232
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-