Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 19:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
062fbc89edfabbe4d40646eaaa1df6f0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
062fbc89edfabbe4d40646eaaa1df6f0_NeikiAnalytics.exe
-
Size
74KB
-
MD5
062fbc89edfabbe4d40646eaaa1df6f0
-
SHA1
deb31373d58cbe019bc3df1758aee381151444e3
-
SHA256
006eca97dc6bb8d62ffd77d69cd7a8977a8b8ba321f21a9825c673a08764a80a
-
SHA512
ef116305234975e178c54d8f8d412f2c3e908e3904ebfdc4127c1f71729c6d95c71c85ad7ddb42bc01f4763eba13413ef4588deb165cb069787c63c6e4e9893f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIJSsD+cGUFzJI:ymb3NkkiQ3mdBjFIwsDhbN6
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/1752-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2280-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1764-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1084-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1508-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3524-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1668-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1448-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1108-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5040-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1252-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4056-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4624-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4088-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4168-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4500-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2220-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2292-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/712-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3408-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2644-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1200-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1256-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/772-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3276-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2280 jdpjd.exe 1764 bhnbbb.exe 1084 hnhthb.exe 1508 jjddv.exe 3524 lxlxlrx.exe 1668 nhnbnh.exe 1448 bnnhtt.exe 1108 jdjjd.exe 5052 lxlrfxr.exe 5040 lxxlfxr.exe 1252 nhtntt.exe 4056 vvjdd.exe 4624 9xrllll.exe 1496 btbttt.exe 5084 hbnhhh.exe 4088 ddddv.exe 3184 ffrxlxf.exe 4168 7hbbtb.exe 4500 ttnbtt.exe 2220 dppvd.exe 2292 rxlrrfl.exe 1080 9bhhbh.exe 712 hhbbnt.exe 3408 5ddvj.exe 2644 xffrllf.exe 3772 fxfxffr.exe 396 hnnnnn.exe 1200 vjpjd.exe 1256 xflxfrl.exe 772 hhbtbb.exe 3276 7djjd.exe 4888 vpvdv.exe 4476 llrllff.exe 4760 3xxrllf.exe 4788 tnntbb.exe 2828 3bthhh.exe 1420 7jdvp.exe 1048 3ffxffx.exe 2612 xlrxxfx.exe 2324 bbbbbb.exe 1336 btthnn.exe 2800 1xfxrrr.exe 216 fllfxrr.exe 3724 3nnhbh.exe 2980 bttthh.exe 3544 vdvvd.exe 5040 9pjvp.exe 3100 rlxxxxr.exe 4056 3rxfrrr.exe 460 httnnn.exe 2872 tbbtbb.exe 3984 vjjjd.exe 4532 rffxxrr.exe 2056 tthhnn.exe 3900 hhhbtt.exe 4168 pjjdv.exe 4084 ffrlfff.exe 2220 lrxxxxf.exe 4988 9bhhhh.exe 1080 vvjjv.exe 4960 vpvpd.exe 3940 rrlflfx.exe 4076 btbbbt.exe 2644 ththnh.exe -
resource yara_rule behavioral2/memory/1752-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1084-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1508-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3524-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1668-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1448-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1448-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1108-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5040-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1252-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4056-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4624-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4088-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4168-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2220-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2292-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/712-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3408-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2644-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1200-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1256-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/772-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3276-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1752 wrote to memory of 2280 1752 062fbc89edfabbe4d40646eaaa1df6f0_NeikiAnalytics.exe 84 PID 1752 wrote to memory of 2280 1752 062fbc89edfabbe4d40646eaaa1df6f0_NeikiAnalytics.exe 84 PID 1752 wrote to memory of 2280 1752 062fbc89edfabbe4d40646eaaa1df6f0_NeikiAnalytics.exe 84 PID 2280 wrote to memory of 1764 2280 jdpjd.exe 85 PID 2280 wrote to memory of 1764 2280 jdpjd.exe 85 PID 2280 wrote to memory of 1764 2280 jdpjd.exe 85 PID 1764 wrote to memory of 1084 1764 bhnbbb.exe 86 PID 1764 wrote to memory of 1084 1764 bhnbbb.exe 86 PID 1764 wrote to memory of 1084 1764 bhnbbb.exe 86 PID 1084 wrote to memory of 1508 1084 hnhthb.exe 87 PID 1084 wrote to memory of 1508 1084 hnhthb.exe 87 PID 1084 wrote to memory of 1508 1084 hnhthb.exe 87 PID 1508 wrote to memory of 3524 1508 jjddv.exe 88 PID 1508 wrote to memory of 3524 1508 jjddv.exe 88 PID 1508 wrote to memory of 3524 1508 jjddv.exe 88 PID 3524 wrote to memory of 1668 3524 lxlxlrx.exe 89 PID 3524 wrote to memory of 1668 3524 lxlxlrx.exe 89 PID 3524 wrote to memory of 1668 3524 lxlxlrx.exe 89 PID 1668 wrote to memory of 1448 1668 nhnbnh.exe 90 PID 1668 wrote to memory of 1448 1668 nhnbnh.exe 90 PID 1668 wrote to memory of 1448 1668 nhnbnh.exe 90 PID 1448 wrote to memory of 1108 1448 bnnhtt.exe 91 PID 1448 wrote to memory of 1108 1448 bnnhtt.exe 91 PID 1448 wrote to memory of 1108 1448 bnnhtt.exe 91 PID 1108 wrote to memory of 5052 1108 jdjjd.exe 92 PID 1108 wrote to memory of 5052 1108 jdjjd.exe 92 PID 1108 wrote to memory of 5052 1108 jdjjd.exe 92 PID 5052 wrote to memory of 5040 5052 lxlrfxr.exe 93 PID 5052 wrote to memory of 5040 5052 lxlrfxr.exe 93 PID 5052 wrote to memory of 5040 5052 lxlrfxr.exe 93 PID 5040 wrote to memory of 1252 5040 lxxlfxr.exe 94 PID 5040 wrote to memory of 1252 5040 lxxlfxr.exe 94 PID 5040 wrote to memory of 1252 5040 lxxlfxr.exe 94 PID 1252 wrote to memory of 4056 1252 nhtntt.exe 96 PID 1252 wrote to memory of 4056 1252 nhtntt.exe 96 PID 1252 wrote to memory of 4056 1252 nhtntt.exe 96 PID 4056 wrote to memory of 4624 4056 vvjdd.exe 97 PID 4056 wrote to memory of 4624 4056 vvjdd.exe 97 PID 4056 wrote to memory of 4624 4056 vvjdd.exe 97 PID 4624 wrote to memory of 1496 4624 9xrllll.exe 98 PID 4624 wrote to memory of 1496 4624 9xrllll.exe 98 PID 4624 wrote to memory of 1496 4624 9xrllll.exe 98 PID 1496 wrote to memory of 5084 1496 btbttt.exe 99 PID 1496 wrote to memory of 5084 1496 btbttt.exe 99 PID 1496 wrote to memory of 5084 1496 btbttt.exe 99 PID 5084 wrote to memory of 4088 5084 hbnhhh.exe 100 PID 5084 wrote to memory of 4088 5084 hbnhhh.exe 100 PID 5084 wrote to memory of 4088 5084 hbnhhh.exe 100 PID 4088 wrote to memory of 3184 4088 ddddv.exe 101 PID 4088 wrote to memory of 3184 4088 ddddv.exe 101 PID 4088 wrote to memory of 3184 4088 ddddv.exe 101 PID 3184 wrote to memory of 4168 3184 ffrxlxf.exe 102 PID 3184 wrote to memory of 4168 3184 ffrxlxf.exe 102 PID 3184 wrote to memory of 4168 3184 ffrxlxf.exe 102 PID 4168 wrote to memory of 4500 4168 7hbbtb.exe 103 PID 4168 wrote to memory of 4500 4168 7hbbtb.exe 103 PID 4168 wrote to memory of 4500 4168 7hbbtb.exe 103 PID 4500 wrote to memory of 2220 4500 ttnbtt.exe 104 PID 4500 wrote to memory of 2220 4500 ttnbtt.exe 104 PID 4500 wrote to memory of 2220 4500 ttnbtt.exe 104 PID 2220 wrote to memory of 2292 2220 dppvd.exe 105 PID 2220 wrote to memory of 2292 2220 dppvd.exe 105 PID 2220 wrote to memory of 2292 2220 dppvd.exe 105 PID 2292 wrote to memory of 1080 2292 rxlrrfl.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\062fbc89edfabbe4d40646eaaa1df6f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\062fbc89edfabbe4d40646eaaa1df6f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\jdpjd.exec:\jdpjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\bhnbbb.exec:\bhnbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\hnhthb.exec:\hnhthb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\jjddv.exec:\jjddv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\lxlxlrx.exec:\lxlxlrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\nhnbnh.exec:\nhnbnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\bnnhtt.exec:\bnnhtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\jdjjd.exec:\jdjjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\lxlrfxr.exec:\lxlrfxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\lxxlfxr.exec:\lxxlfxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\nhtntt.exec:\nhtntt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\vvjdd.exec:\vvjdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\9xrllll.exec:\9xrllll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\btbttt.exec:\btbttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\hbnhhh.exec:\hbnhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\ddddv.exec:\ddddv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\ffrxlxf.exec:\ffrxlxf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\7hbbtb.exec:\7hbbtb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\ttnbtt.exec:\ttnbtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\dppvd.exec:\dppvd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\rxlrrfl.exec:\rxlrrfl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\9bhhbh.exec:\9bhhbh.exe23⤵
- Executes dropped EXE
PID:1080 -
\??\c:\hhbbnt.exec:\hhbbnt.exe24⤵
- Executes dropped EXE
PID:712 -
\??\c:\5ddvj.exec:\5ddvj.exe25⤵
- Executes dropped EXE
PID:3408 -
\??\c:\xffrllf.exec:\xffrllf.exe26⤵
- Executes dropped EXE
PID:2644 -
\??\c:\fxfxffr.exec:\fxfxffr.exe27⤵
- Executes dropped EXE
PID:3772 -
\??\c:\hnnnnn.exec:\hnnnnn.exe28⤵
- Executes dropped EXE
PID:396 -
\??\c:\vjpjd.exec:\vjpjd.exe29⤵
- Executes dropped EXE
PID:1200 -
\??\c:\xflxfrl.exec:\xflxfrl.exe30⤵
- Executes dropped EXE
PID:1256 -
\??\c:\hhbtbb.exec:\hhbtbb.exe31⤵
- Executes dropped EXE
PID:772 -
\??\c:\7djjd.exec:\7djjd.exe32⤵
- Executes dropped EXE
PID:3276 -
\??\c:\vpvdv.exec:\vpvdv.exe33⤵
- Executes dropped EXE
PID:4888 -
\??\c:\llrllff.exec:\llrllff.exe34⤵
- Executes dropped EXE
PID:4476 -
\??\c:\3xxrllf.exec:\3xxrllf.exe35⤵
- Executes dropped EXE
PID:4760 -
\??\c:\tnntbb.exec:\tnntbb.exe36⤵
- Executes dropped EXE
PID:4788 -
\??\c:\3bthhh.exec:\3bthhh.exe37⤵
- Executes dropped EXE
PID:2828 -
\??\c:\7jdvp.exec:\7jdvp.exe38⤵
- Executes dropped EXE
PID:1420 -
\??\c:\3ffxffx.exec:\3ffxffx.exe39⤵
- Executes dropped EXE
PID:1048 -
\??\c:\xlrxxfx.exec:\xlrxxfx.exe40⤵
- Executes dropped EXE
PID:2612 -
\??\c:\bbbbbb.exec:\bbbbbb.exe41⤵
- Executes dropped EXE
PID:2324 -
\??\c:\btthnn.exec:\btthnn.exe42⤵
- Executes dropped EXE
PID:1336 -
\??\c:\1xfxrrr.exec:\1xfxrrr.exe43⤵
- Executes dropped EXE
PID:2800 -
\??\c:\fllfxrr.exec:\fllfxrr.exe44⤵
- Executes dropped EXE
PID:216 -
\??\c:\3nnhbh.exec:\3nnhbh.exe45⤵
- Executes dropped EXE
PID:3724 -
\??\c:\bttthh.exec:\bttthh.exe46⤵
- Executes dropped EXE
PID:2980 -
\??\c:\vdvvd.exec:\vdvvd.exe47⤵
- Executes dropped EXE
PID:3544 -
\??\c:\9pjvp.exec:\9pjvp.exe48⤵
- Executes dropped EXE
PID:5040 -
\??\c:\rlxxxxr.exec:\rlxxxxr.exe49⤵
- Executes dropped EXE
PID:3100 -
\??\c:\3rxfrrr.exec:\3rxfrrr.exe50⤵
- Executes dropped EXE
PID:4056 -
\??\c:\httnnn.exec:\httnnn.exe51⤵
- Executes dropped EXE
PID:460 -
\??\c:\tbbtbb.exec:\tbbtbb.exe52⤵
- Executes dropped EXE
PID:2872 -
\??\c:\vjjjd.exec:\vjjjd.exe53⤵
- Executes dropped EXE
PID:3984 -
\??\c:\rffxxrr.exec:\rffxxrr.exe54⤵
- Executes dropped EXE
PID:4532 -
\??\c:\tthhnn.exec:\tthhnn.exe55⤵
- Executes dropped EXE
PID:2056 -
\??\c:\hhhbtt.exec:\hhhbtt.exe56⤵
- Executes dropped EXE
PID:3900 -
\??\c:\pjjdv.exec:\pjjdv.exe57⤵
- Executes dropped EXE
PID:4168 -
\??\c:\ffrlfff.exec:\ffrlfff.exe58⤵
- Executes dropped EXE
PID:4084 -
\??\c:\lrxxxxf.exec:\lrxxxxf.exe59⤵
- Executes dropped EXE
PID:2220 -
\??\c:\9bhhhh.exec:\9bhhhh.exe60⤵
- Executes dropped EXE
PID:4988 -
\??\c:\vvjjv.exec:\vvjjv.exe61⤵
- Executes dropped EXE
PID:1080 -
\??\c:\vpvpd.exec:\vpvpd.exe62⤵
- Executes dropped EXE
PID:4960 -
\??\c:\rrlflfx.exec:\rrlflfx.exe63⤵
- Executes dropped EXE
PID:3940 -
\??\c:\btbbbt.exec:\btbbbt.exe64⤵
- Executes dropped EXE
PID:4076 -
\??\c:\ththnh.exec:\ththnh.exe65⤵
- Executes dropped EXE
PID:2644 -
\??\c:\3jdvd.exec:\3jdvd.exe66⤵PID:2700
-
\??\c:\ppdpd.exec:\ppdpd.exe67⤵PID:3888
-
\??\c:\rfxrlfr.exec:\rfxrlfr.exe68⤵PID:2868
-
\??\c:\5nthbt.exec:\5nthbt.exe69⤵PID:4944
-
\??\c:\vjdjj.exec:\vjdjj.exe70⤵PID:4288
-
\??\c:\pdjjv.exec:\pdjjv.exe71⤵PID:1640
-
\??\c:\llxrllf.exec:\llxrllf.exe72⤵PID:2736
-
\??\c:\bhtbht.exec:\bhtbht.exe73⤵PID:636
-
\??\c:\dvjpd.exec:\dvjpd.exe74⤵PID:4008
-
\??\c:\vjdvj.exec:\vjdvj.exe75⤵PID:3628
-
\??\c:\7pjdv.exec:\7pjdv.exe76⤵PID:4136
-
\??\c:\9rlfrlx.exec:\9rlfrlx.exe77⤵PID:4764
-
\??\c:\7nthtn.exec:\7nthtn.exe78⤵PID:2184
-
\??\c:\pvjvd.exec:\pvjvd.exe79⤵PID:3112
-
\??\c:\dvpdv.exec:\dvpdv.exe80⤵PID:4152
-
\??\c:\7llfxxr.exec:\7llfxxr.exe81⤵PID:4004
-
\??\c:\xrlxlfr.exec:\xrlxlfr.exe82⤵PID:2408
-
\??\c:\bnhbtn.exec:\bnhbtn.exe83⤵PID:1984
-
\??\c:\dpppv.exec:\dpppv.exe84⤵PID:2800
-
\??\c:\flrxxxl.exec:\flrxxxl.exe85⤵PID:216
-
\??\c:\rlllxll.exec:\rlllxll.exe86⤵PID:2908
-
\??\c:\hnnhbt.exec:\hnnhbt.exe87⤵PID:2980
-
\??\c:\3ddpj.exec:\3ddpj.exe88⤵PID:1252
-
\??\c:\7pppv.exec:\7pppv.exe89⤵PID:4792
-
\??\c:\xrlxlxr.exec:\xrlxlxr.exe90⤵PID:2228
-
\??\c:\llffflr.exec:\llffflr.exe91⤵PID:4056
-
\??\c:\bnbttn.exec:\bnbttn.exe92⤵PID:2516
-
\??\c:\1djvp.exec:\1djvp.exe93⤵PID:1116
-
\??\c:\vjppd.exec:\vjppd.exe94⤵PID:392
-
\??\c:\1xlxlfx.exec:\1xlxlfx.exe95⤵PID:1452
-
\??\c:\frfrrrr.exec:\frfrrrr.exe96⤵PID:1604
-
\??\c:\tbtnhb.exec:\tbtnhb.exe97⤵PID:1364
-
\??\c:\ntnhbt.exec:\ntnhbt.exe98⤵PID:5084
-
\??\c:\vpppv.exec:\vpppv.exe99⤵PID:2944
-
\??\c:\llxrxlr.exec:\llxrxlr.exe100⤵PID:1592
-
\??\c:\fxlfrlf.exec:\fxlfrlf.exe101⤵PID:3384
-
\??\c:\bhbthh.exec:\bhbthh.exe102⤵PID:220
-
\??\c:\nbthnh.exec:\nbthnh.exe103⤵PID:1332
-
\??\c:\jpjdd.exec:\jpjdd.exe104⤵PID:712
-
\??\c:\jddvj.exec:\jddvj.exe105⤵PID:2508
-
\??\c:\fxlxrlf.exec:\fxlxrlf.exe106⤵PID:4076
-
\??\c:\hbbhhb.exec:\hbbhhb.exe107⤵PID:2468
-
\??\c:\nnbthh.exec:\nnbthh.exe108⤵PID:3600
-
\??\c:\pppdp.exec:\pppdp.exe109⤵PID:2304
-
\??\c:\jdvvj.exec:\jdvvj.exe110⤵PID:2868
-
\??\c:\xrrllff.exec:\xrrllff.exe111⤵PID:3120
-
\??\c:\xlfxxxr.exec:\xlfxxxr.exe112⤵PID:4816
-
\??\c:\3tttnn.exec:\3tttnn.exe113⤵PID:3276
-
\??\c:\5hbthn.exec:\5hbthn.exe114⤵PID:3004
-
\??\c:\3jvjp.exec:\3jvjp.exe115⤵PID:428
-
\??\c:\ppvjp.exec:\ppvjp.exe116⤵PID:4480
-
\??\c:\frxxrfx.exec:\frxxrfx.exe117⤵PID:1172
-
\??\c:\bbbtbt.exec:\bbbtbt.exe118⤵PID:1844
-
\??\c:\nthbnh.exec:\nthbnh.exe119⤵PID:844
-
\??\c:\3jpjj.exec:\3jpjj.exe120⤵PID:2896
-
\??\c:\vpppj.exec:\vpppj.exe121⤵PID:1048
-
\??\c:\frrxxfx.exec:\frrxxfx.exe122⤵PID:4004
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-