Analysis
- max time kernel
136s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
20/05/2024, 00:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6825fec1115287d07256f184981ea910_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
- Target 6825fec1115287d07256f184981ea910_NeikiAnalytics.exe
- Size 153KB
- Sample240520-afcmlaac27
- SHA256 1062ec39a927b11741f8066d45b5dd23188683f37e05d3abb20d7b6905bfc418
- MD5 6825fec1115287d07256f184981ea910
- SHA1 6e6dbcc0fe3a1c26d369c0fc8ed111ec0f38cb23
- SHA512 20cafa99d2220fddaee330455f3089c0cc1771707e8559ffbb4ba887cdeb4256f4d7d339d1fadacc8097a612dbe4f69aaa298dacfa75325d457747a519685777
- SSDEEP 3072:ymb3NkkiQ3mdBjFIi/0RU6QeYQsm71vPmX5k2LrCimBaH8UH3030:n3C9BRIG0asYFm71mJkzpaH8m3h
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/1156-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4560-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1020-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4584-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4584-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3692-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3004-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4296-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3024-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/684-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3408-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3872-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1872-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4212-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2924-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4472-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1488-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4876-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1000-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3356-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/212-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2120-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2076-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 4560 tbhbtt.exe 1020 jvvpp.exe 4892 3xrlffx.exe 4584 tbtbbt.exe 4996 pjjdp.exe 3692 xllfxxr.exe 4652 9ntnhh.exe 3004 jjdvd.exe 3016 lflfxfx.exe 4296 bttttn.exe 3024 dvvdp.exe 684 9bbhhh.exe 3408 nhnhnb.exe 3872 3jppj.exe 1872 llxrxxf.exe 4896 bthtbn.exe 4212 9nbtbb.exe 2924 ppjjd.exe 4472 lrffxrl.exe 1488 ttthbb.exe 552 ddvvp.exe 4876 pjjdv.exe 1000 rlfrlll.exe 3936 btnnnn.exe 3356 3pppd.exe 4524 7xlfxxr.exe 212 ntnhbt.exe 2120 hbhbhh.exe 2076 djddd.exe 3928 bhhbbb.exe 264 btntnn.exe 4828 jvpjd.exe 4604 rxxxxxr.exe 4272 flllffx.exe 1896 hthhhh.exe 3260 pdjdp.exe 2216 5jpjj.exe 1676 xffxxlr.exe 796 xfffxxx.exe 3812 bbhhbt.exe 372 vjjjd.exe 5068 ddjpj.exe 4996 xlffxxr.exe 3612 3fflxrx.exe 4652 3tbttn.exe 2028 nhtnhn.exe 2908 3jdvj.exe 3524 lxrllll.exe 3332 1llfxfx.exe 1464 5tttnh.exe 4080 9vvpj.exe 684 vpddd.exe 4148 lrrxrfl.exe 3848 xfllffx.exe 1520 3ntthh.exe 2532 pvppv.exe 4984 lxfxrrr.exe 2716 1xfxffl.exe 4060 btnhtb.exe 228 9hhbnb.exe 628 djpvd.exe 4728 lrxrllx.exe 2896 lxxrrrl.exe 4064 tntnnh.exe -
resource yara_rule behavioral2/memory/1156-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1020-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3692-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3004-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4296-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4296-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3024-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/684-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3408-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3872-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1872-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4212-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4472-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1488-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4876-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1000-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3356-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4524-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/212-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2120-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2076-195-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1156 wrote to memory of 4560 1156 6825fec1115287d07256f184981ea910_NeikiAnalytics.exe 84 PID 1156 wrote to memory of 4560 1156 6825fec1115287d07256f184981ea910_NeikiAnalytics.exe 84 PID 1156 wrote to memory of 4560 1156 6825fec1115287d07256f184981ea910_NeikiAnalytics.exe 84 PID 4560 wrote to memory of 1020 4560 tbhbtt.exe 85 PID 4560 wrote to memory of 1020 4560 tbhbtt.exe 85 PID 4560 wrote to memory of 1020 4560 tbhbtt.exe 85 PID 1020 wrote to memory of 4892 1020 jvvpp.exe 86 PID 1020 wrote to memory of 4892 1020 jvvpp.exe 86 PID 1020 wrote to memory of 4892 1020 jvvpp.exe 86 PID 4892 wrote to memory of 4584 4892 3xrlffx.exe 87 PID 4892 wrote to memory of 4584 4892 3xrlffx.exe 87 PID 4892 wrote to memory of 4584 4892 3xrlffx.exe 87 PID 4584 wrote to memory of 4996 4584 tbtbbt.exe 88 PID 4584 wrote to memory of 4996 4584 tbtbbt.exe 88 PID 4584 wrote to memory of 4996 4584 tbtbbt.exe 88 PID 4996 wrote to memory of 3692 4996 pjjdp.exe 89 PID 4996 wrote to memory of 3692 4996 pjjdp.exe 89 PID 4996 wrote to memory of 3692 4996 pjjdp.exe 89 PID 3692 wrote to memory of 4652 3692 xllfxxr.exe 90 PID 3692 wrote to memory of 4652 3692 xllfxxr.exe 90 PID 3692 wrote to memory of 4652 3692 xllfxxr.exe 90 PID 4652 wrote to memory of 3004 4652 9ntnhh.exe 91 PID 4652 wrote to memory of 3004 4652 9ntnhh.exe 91 PID 4652 wrote to memory of 3004 4652 9ntnhh.exe 91 PID 3004 wrote to memory of 3016 3004 jjdvd.exe 92 PID 3004 wrote to memory of 3016 3004 jjdvd.exe 92 PID 3004 wrote to memory of 3016 3004 jjdvd.exe 92 PID 3016 wrote to memory of 4296 3016 lflfxfx.exe 93 PID 3016 wrote to memory of 4296 3016 lflfxfx.exe 93 PID 3016 wrote to memory of 4296 3016 lflfxfx.exe 93 PID 4296 wrote to memory of 3024 4296 bttttn.exe 94 PID 4296 wrote to memory of 3024 4296 bttttn.exe 94 PID 4296 wrote to memory of 3024 4296 bttttn.exe 94 PID 3024 wrote to memory of 684 3024 dvvdp.exe 95 PID 3024 wrote to memory of 684 3024 dvvdp.exe 95 PID 3024 wrote to memory of 684 3024 dvvdp.exe 95 PID 684 wrote to memory of 3408 684 9bbhhh.exe 96 PID 684 wrote to memory of 3408 684 9bbhhh.exe 96 PID 684 wrote to memory of 3408 684 9bbhhh.exe 96 PID 3408 wrote to memory of 3872 3408 nhnhnb.exe 97 PID 3408 wrote to memory of 3872 3408 nhnhnb.exe 97 PID 3408 wrote to memory of 3872 3408 nhnhnb.exe 97 PID 3872 wrote to memory of 1872 3872 3jppj.exe 98 PID 3872 wrote to memory of 1872 3872 3jppj.exe 98 PID 3872 wrote to memory of 1872 3872 3jppj.exe 98 PID 1872 wrote to memory of 4896 1872 llxrxxf.exe 99 PID 1872 wrote to memory of 4896 1872 llxrxxf.exe 99 PID 1872 wrote to memory of 4896 1872 llxrxxf.exe 99 PID 4896 wrote to memory of 4212 4896 bthtbn.exe 100 PID 4896 wrote to memory of 4212 4896 bthtbn.exe 100 PID 4896 wrote to memory of 4212 4896 bthtbn.exe 100 PID 4212 wrote to memory of 2924 4212 9nbtbb.exe 101 PID 4212 wrote to memory of 2924 4212 9nbtbb.exe 101 PID 4212 wrote to memory of 2924 4212 9nbtbb.exe 101 PID 2924 wrote to memory of 4472 2924 ppjjd.exe 102 PID 2924 wrote to memory of 4472 2924 ppjjd.exe 102 PID 2924 wrote to memory of 4472 2924 ppjjd.exe 102 PID 4472 wrote to memory of 1488 4472 lrffxrl.exe 103 PID 4472 wrote to memory of 1488 4472 lrffxrl.exe 103 PID 4472 wrote to memory of 1488 4472 lrffxrl.exe 103 PID 1488 wrote to memory of 552 1488 ttthbb.exe 104 PID 1488 wrote to memory of 552 1488 ttthbb.exe 104 PID 1488 wrote to memory of 552 1488 ttthbb.exe 104 PID 552 wrote to memory of 4876 552 ddvvp.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\6825fec1115287d07256f184981ea910_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6825fec1115287d07256f184981ea910_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\tbhbtt.exec:\tbhbtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\jvvpp.exec:\jvvpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\3xrlffx.exec:\3xrlffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\tbtbbt.exec:\tbtbbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\pjjdp.exec:\pjjdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\xllfxxr.exec:\xllfxxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\9ntnhh.exec:\9ntnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\jjdvd.exec:\jjdvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\lflfxfx.exec:\lflfxfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\bttttn.exec:\bttttn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\dvvdp.exec:\dvvdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\9bbhhh.exec:\9bbhhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\nhnhnb.exec:\nhnhnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
\??\c:\3jppj.exec:\3jppj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\llxrxxf.exec:\llxrxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\bthtbn.exec:\bthtbn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\9nbtbb.exec:\9nbtbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\ppjjd.exec:\ppjjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\lrffxrl.exec:\lrffxrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\ttthbb.exec:\ttthbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\ddvvp.exec:\ddvvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\pjjdv.exec:\pjjdv.exe23⤵
- Executes dropped EXE
PID:4876 -
\??\c:\rlfrlll.exec:\rlfrlll.exe24⤵
- Executes dropped EXE
PID:1000 -
\??\c:\btnnnn.exec:\btnnnn.exe25⤵
- Executes dropped EXE
PID:3936 -
\??\c:\3pppd.exec:\3pppd.exe26⤵
- Executes dropped EXE
PID:3356 -
\??\c:\7xlfxxr.exec:\7xlfxxr.exe27⤵
- Executes dropped EXE
PID:4524 -
\??\c:\ntnhbt.exec:\ntnhbt.exe28⤵
- Executes dropped EXE
PID:212 -
\??\c:\hbhbhh.exec:\hbhbhh.exe29⤵
- Executes dropped EXE
PID:2120 -
\??\c:\djddd.exec:\djddd.exe30⤵
- Executes dropped EXE
PID:2076 -
\??\c:\bhhbbb.exec:\bhhbbb.exe31⤵
- Executes dropped EXE
PID:3928 -
\??\c:\btntnn.exec:\btntnn.exe32⤵
- Executes dropped EXE
PID:264 -
\??\c:\jvpjd.exec:\jvpjd.exe33⤵
- Executes dropped EXE
PID:4828 -
\??\c:\rxxxxxr.exec:\rxxxxxr.exe34⤵
- Executes dropped EXE
PID:4604 -
\??\c:\flllffx.exec:\flllffx.exe35⤵
- Executes dropped EXE
PID:4272 -
\??\c:\hthhhh.exec:\hthhhh.exe36⤵
- Executes dropped EXE
PID:1896 -
\??\c:\pdjdp.exec:\pdjdp.exe37⤵
- Executes dropped EXE
PID:3260 -
\??\c:\5jpjj.exec:\5jpjj.exe38⤵
- Executes dropped EXE
PID:2216 -
\??\c:\xffxxlr.exec:\xffxxlr.exe39⤵
- Executes dropped EXE
PID:1676 -
\??\c:\xfffxxx.exec:\xfffxxx.exe40⤵
- Executes dropped EXE
PID:796 -
\??\c:\bbhhbt.exec:\bbhhbt.exe41⤵
- Executes dropped EXE
PID:3812 -
\??\c:\vjjjd.exec:\vjjjd.exe42⤵
- Executes dropped EXE
PID:372 -
\??\c:\ddjpj.exec:\ddjpj.exe43⤵
- Executes dropped EXE
PID:5068 -
\??\c:\xlffxxr.exec:\xlffxxr.exe44⤵
- Executes dropped EXE
PID:4996 -
\??\c:\3fflxrx.exec:\3fflxrx.exe45⤵
- Executes dropped EXE
PID:3612 -
\??\c:\3tbttn.exec:\3tbttn.exe46⤵
- Executes dropped EXE
PID:4652 -
\??\c:\nhtnhn.exec:\nhtnhn.exe47⤵
- Executes dropped EXE
PID:2028 -
\??\c:\3jdvj.exec:\3jdvj.exe48⤵
- Executes dropped EXE
PID:2908 -
\??\c:\lxrllll.exec:\lxrllll.exe49⤵
- Executes dropped EXE
PID:3524 -
\??\c:\1llfxfx.exec:\1llfxfx.exe50⤵
- Executes dropped EXE
PID:3332 -
\??\c:\5tttnh.exec:\5tttnh.exe51⤵
- Executes dropped EXE
PID:1464 -
\??\c:\9vvpj.exec:\9vvpj.exe52⤵
- Executes dropped EXE
PID:4080 -
\??\c:\vpddd.exec:\vpddd.exe53⤵
- Executes dropped EXE
PID:684 -
\??\c:\lrrxrfl.exec:\lrrxrfl.exe54⤵
- Executes dropped EXE
PID:4148 -
\??\c:\xfllffx.exec:\xfllffx.exe55⤵
- Executes dropped EXE
PID:3848 -
\??\c:\3ntthh.exec:\3ntthh.exe56⤵
- Executes dropped EXE
PID:1520 -
\??\c:\pvppv.exec:\pvppv.exe57⤵
- Executes dropped EXE
PID:2532 -
\??\c:\lxfxrrr.exec:\lxfxrrr.exe58⤵
- Executes dropped EXE
PID:4984 -
\??\c:\1xfxffl.exec:\1xfxffl.exe59⤵
- Executes dropped EXE
PID:2716 -
\??\c:\btnhtb.exec:\btnhtb.exe60⤵
- Executes dropped EXE
PID:4060 -
\??\c:\9hhbnb.exec:\9hhbnb.exe61⤵
- Executes dropped EXE
PID:228 -
\??\c:\djpvd.exec:\djpvd.exe62⤵
- Executes dropped EXE
PID:628 -
\??\c:\lrxrllx.exec:\lrxrllx.exe63⤵
- Executes dropped EXE
PID:4728 -
\??\c:\lxxrrrl.exec:\lxxrrrl.exe64⤵
- Executes dropped EXE
PID:2896 -
\??\c:\tntnnh.exec:\tntnnh.exe65⤵
- Executes dropped EXE
PID:4064 -
\??\c:\hbnhhh.exec:\hbnhhh.exe66⤵PID:408
-
\??\c:\dvjdd.exec:\dvjdd.exe67⤵PID:4364
-
\??\c:\vdpjd.exec:\vdpjd.exe68⤵PID:3460
-
\??\c:\lrffrxx.exec:\lrffrxx.exe69⤵PID:3936
-
\??\c:\xrrrffx.exec:\xrrrffx.exe70⤵PID:1920
-
\??\c:\fxlfllr.exec:\fxlfllr.exe71⤵PID:4524
-
\??\c:\1bhhbb.exec:\1bhhbb.exe72⤵PID:3224
-
\??\c:\djjdv.exec:\djjdv.exe73⤵PID:2044
-
\??\c:\3jjdp.exec:\3jjdp.exe74⤵PID:3804
-
\??\c:\lfrxrrr.exec:\lfrxrrr.exe75⤵PID:1508
-
\??\c:\rfxxrxx.exec:\rfxxrxx.exe76⤵PID:1976
-
\??\c:\hbbnhh.exec:\hbbnhh.exe77⤵PID:4528
-
\??\c:\jdjdd.exec:\jdjdd.exe78⤵PID:1960
-
\??\c:\fxrrlfx.exec:\fxrrlfx.exe79⤵PID:1716
-
\??\c:\1thhnt.exec:\1thhnt.exe80⤵PID:3732
-
\??\c:\btnhbb.exec:\btnhbb.exe81⤵PID:4220
-
\??\c:\9pjjd.exec:\9pjjd.exe82⤵PID:4076
-
\??\c:\rllfxxr.exec:\rllfxxr.exe83⤵PID:2036
-
\??\c:\lfxrrrx.exec:\lfxrrrx.exe84⤵PID:3100
-
\??\c:\ntbtnn.exec:\ntbtnn.exe85⤵PID:3084
-
\??\c:\jdjdj.exec:\jdjdj.exe86⤵PID:4656
-
\??\c:\flrlllf.exec:\flrlllf.exe87⤵PID:2936
-
\??\c:\frrrllf.exec:\frrrllf.exe88⤵PID:3876
-
\??\c:\nntbnh.exec:\nntbnh.exe89⤵PID:4996
-
\??\c:\djjdv.exec:\djjdv.exe90⤵PID:3036
-
\??\c:\ddddd.exec:\ddddd.exe91⤵PID:452
-
\??\c:\flrfxrf.exec:\flrfxrf.exe92⤵PID:3004
-
\??\c:\xflfffx.exec:\xflfffx.exe93⤵PID:2368
-
\??\c:\9nnnnn.exec:\9nnnnn.exe94⤵PID:1860
-
\??\c:\nttnhh.exec:\nttnhh.exe95⤵PID:4976
-
\??\c:\1jpjj.exec:\1jpjj.exe96⤵PID:3932
-
\??\c:\xxfxrrl.exec:\xxfxrrl.exe97⤵PID:1616
-
\??\c:\1fllfff.exec:\1fllfff.exe98⤵PID:4948
-
\??\c:\7hhbtn.exec:\7hhbtn.exe99⤵PID:3872
-
\??\c:\hhttnn.exec:\hhttnn.exe100⤵PID:3848
-
\??\c:\vpjdp.exec:\vpjdp.exe101⤵PID:1520
-
\??\c:\ppvpp.exec:\ppvpp.exe102⤵PID:2532
-
\??\c:\nnbbbh.exec:\nnbbbh.exe103⤵PID:4984
-
\??\c:\5htnhh.exec:\5htnhh.exe104⤵PID:1984
-
\??\c:\vpjvv.exec:\vpjvv.exe105⤵PID:3292
-
\??\c:\3vdvd.exec:\3vdvd.exe106⤵PID:1044
-
\??\c:\llfxlll.exec:\llfxlll.exe107⤵PID:1728
-
\??\c:\bbnnhh.exec:\bbnnhh.exe108⤵PID:552
-
\??\c:\hbhbhb.exec:\hbhbhb.exe109⤵PID:4340
-
\??\c:\5dvpd.exec:\5dvpd.exe110⤵PID:3748
-
\??\c:\vvvvp.exec:\vvvvp.exe111⤵PID:4028
-
\??\c:\bntnhh.exec:\bntnhh.exe112⤵PID:3788
-
\??\c:\nhnhbb.exec:\nhnhbb.exe113⤵PID:4368
-
\??\c:\pvvdj.exec:\pvvdj.exe114⤵PID:5064
-
\??\c:\9ffxrxf.exec:\9ffxrxf.exe115⤵PID:3488
-
\??\c:\nhhhnt.exec:\nhhhnt.exe116⤵PID:2696
-
\??\c:\vjvvj.exec:\vjvvj.exe117⤵PID:4572
-
\??\c:\1flxrrl.exec:\1flxrrl.exe118⤵PID:2076
-
\??\c:\xrrrlrr.exec:\xrrrlrr.exe119⤵PID:4508
-
\??\c:\7nttnn.exec:\7nttnn.exe120⤵PID:4872
-
\??\c:\9ttnnn.exec:\9ttnnn.exe121⤵PID:2704
-
\??\c:\pjvvv.exec:\pjvvv.exe122⤵PID:4828
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-