Analysis
-
max time kernel
89s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/05/2024, 13:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f126b1e8ce8b2a1298cdb3093a145b80_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
f126b1e8ce8b2a1298cdb3093a145b80_NeikiAnalytics.exe
-
Size
66KB
-
MD5
f126b1e8ce8b2a1298cdb3093a145b80
-
SHA1
398f85dcf69c3f11d871c08e3833fb6ac01499d6
-
SHA256
8e9d0b3112637052664be15d41887feeb56957273153dd5f9c3d78f945981318
-
SHA512
7cda7eb93c5dd4d48c27cc9876fa99bc6ad9a9dcd08929fd6db8a55f92ccdb4d841114bdf64a1213a4cca831d139286db88888e50cb35f26bca0b59a145d09a0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUPqrDZLi:ymb3NkkiQ3mdBjF0yUmdi
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/3084-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3272-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3016-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2824-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4304-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1376-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/512-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2576-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4560-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1296-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1108-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4556-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2500-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3416-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4440-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4296-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/728-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4200-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2492-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3904-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2604-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2860-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5092-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2824 xrrlllr.exe 3272 lxrxlll.exe 3016 jpdvv.exe 4304 httbhh.exe 1376 7fflfxl.exe 512 nbbbbt.exe 2576 jpvpp.exe 4560 htttbb.exe 1296 vvpvj.exe 4692 ttnbnn.exe 1108 tnbttn.exe 3416 vpvpp.exe 4532 pjppd.exe 4556 dvvdv.exe 2500 nhtttn.exe 4440 nhntbb.exe 4756 rfxlrlx.exe 4296 jdvpj.exe 2252 bbhtbn.exe 728 hnhhhb.exe 2192 pdpvv.exe 4200 flfrxrf.exe 2492 hbtnhb.exe 3904 flrrlxr.exe 2604 xrlrflx.exe 2232 jvvvj.exe 644 jdvpv.exe 2860 xxrllxf.exe 5092 vjvjv.exe 4496 lfflflr.exe 1708 pvdvd.exe 1816 pjpjd.exe 3996 thtnhb.exe 3548 fxllllf.exe 5068 dvjpd.exe 4468 1pvpp.exe 1560 tbhbtn.exe 3084 httbbn.exe 3120 lflfllf.exe 5004 flrxxrx.exe 3016 rxlxxxr.exe 4524 dvvvp.exe 1948 5bhtth.exe 1452 bhbnbn.exe 2768 9vdjj.exe 4396 thbtbt.exe 2576 llxxrff.exe 1748 dvjvp.exe 1992 jvvvd.exe 1100 rfllllf.exe 3664 rfrlllx.exe 2140 vpppd.exe 3216 jpvpj.exe 4628 5xfflxr.exe 3688 lrrfrff.exe 4812 fxfflxr.exe 2500 rxrxfxl.exe 1736 jpjpv.exe 2816 pvvpp.exe 4584 btbbtb.exe 3220 flxrxrx.exe 4056 dpjpd.exe 1796 bnthnh.exe 728 tbbhbh.exe -
resource yara_rule behavioral2/memory/3084-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3016-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4304-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4304-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1376-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/512-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2576-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1296-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1296-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1296-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1108-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4532-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2500-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3416-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4440-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4296-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/728-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4200-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2492-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3904-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2860-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-197-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3084 wrote to memory of 2824 3084 f126b1e8ce8b2a1298cdb3093a145b80_NeikiAnalytics.exe 83 PID 3084 wrote to memory of 2824 3084 f126b1e8ce8b2a1298cdb3093a145b80_NeikiAnalytics.exe 83 PID 3084 wrote to memory of 2824 3084 f126b1e8ce8b2a1298cdb3093a145b80_NeikiAnalytics.exe 83 PID 2824 wrote to memory of 3272 2824 xrrlllr.exe 84 PID 2824 wrote to memory of 3272 2824 xrrlllr.exe 84 PID 2824 wrote to memory of 3272 2824 xrrlllr.exe 84 PID 3272 wrote to memory of 3016 3272 lxrxlll.exe 85 PID 3272 wrote to memory of 3016 3272 lxrxlll.exe 85 PID 3272 wrote to memory of 3016 3272 lxrxlll.exe 85 PID 3016 wrote to memory of 4304 3016 jpdvv.exe 86 PID 3016 wrote to memory of 4304 3016 jpdvv.exe 86 PID 3016 wrote to memory of 4304 3016 jpdvv.exe 86 PID 4304 wrote to memory of 1376 4304 httbhh.exe 87 PID 4304 wrote to memory of 1376 4304 httbhh.exe 87 PID 4304 wrote to memory of 1376 4304 httbhh.exe 87 PID 1376 wrote to memory of 512 1376 7fflfxl.exe 88 PID 1376 wrote to memory of 512 1376 7fflfxl.exe 88 PID 1376 wrote to memory of 512 1376 7fflfxl.exe 88 PID 512 wrote to memory of 2576 512 nbbbbt.exe 132 PID 512 wrote to memory of 2576 512 nbbbbt.exe 132 PID 512 wrote to memory of 2576 512 nbbbbt.exe 132 PID 2576 wrote to memory of 4560 2576 jpvpp.exe 90 PID 2576 wrote to memory of 4560 2576 jpvpp.exe 90 PID 2576 wrote to memory of 4560 2576 jpvpp.exe 90 PID 4560 wrote to memory of 1296 4560 htttbb.exe 91 PID 4560 wrote to memory of 1296 4560 htttbb.exe 91 PID 4560 wrote to memory of 1296 4560 htttbb.exe 91 PID 1296 wrote to memory of 4692 1296 vvpvj.exe 92 PID 1296 wrote to memory of 4692 1296 vvpvj.exe 92 PID 1296 wrote to memory of 4692 1296 vvpvj.exe 92 PID 4692 wrote to memory of 1108 4692 ttnbnn.exe 93 PID 4692 wrote to memory of 1108 4692 ttnbnn.exe 93 PID 4692 wrote to memory of 1108 4692 ttnbnn.exe 93 PID 1108 wrote to memory of 3416 1108 tnbttn.exe 227 PID 1108 wrote to memory of 3416 1108 tnbttn.exe 227 PID 1108 wrote to memory of 3416 1108 tnbttn.exe 227 PID 3416 wrote to memory of 4532 3416 vpvpp.exe 95 PID 3416 wrote to memory of 4532 3416 vpvpp.exe 95 PID 3416 wrote to memory of 4532 3416 vpvpp.exe 95 PID 4532 wrote to memory of 4556 4532 pjppd.exe 97 PID 4532 wrote to memory of 4556 4532 pjppd.exe 97 PID 4532 wrote to memory of 4556 4532 pjppd.exe 97 PID 4556 wrote to memory of 2500 4556 dvvdv.exe 142 PID 4556 wrote to memory of 2500 4556 dvvdv.exe 142 PID 4556 wrote to memory of 2500 4556 dvvdv.exe 142 PID 2500 wrote to memory of 4440 2500 nhtttn.exe 99 PID 2500 wrote to memory of 4440 2500 nhtttn.exe 99 PID 2500 wrote to memory of 4440 2500 nhtttn.exe 99 PID 4440 wrote to memory of 4756 4440 nhntbb.exe 100 PID 4440 wrote to memory of 4756 4440 nhntbb.exe 100 PID 4440 wrote to memory of 4756 4440 nhntbb.exe 100 PID 4756 wrote to memory of 4296 4756 rfxlrlx.exe 306 PID 4756 wrote to memory of 4296 4756 rfxlrlx.exe 306 PID 4756 wrote to memory of 4296 4756 rfxlrlx.exe 306 PID 4296 wrote to memory of 2252 4296 jdvpj.exe 102 PID 4296 wrote to memory of 2252 4296 jdvpj.exe 102 PID 4296 wrote to memory of 2252 4296 jdvpj.exe 102 PID 2252 wrote to memory of 728 2252 bbhtbn.exe 149 PID 2252 wrote to memory of 728 2252 bbhtbn.exe 149 PID 2252 wrote to memory of 728 2252 bbhtbn.exe 149 PID 728 wrote to memory of 2192 728 hnhhhb.exe 104 PID 728 wrote to memory of 2192 728 hnhhhb.exe 104 PID 728 wrote to memory of 2192 728 hnhhhb.exe 104 PID 2192 wrote to memory of 4200 2192 pdpvv.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\f126b1e8ce8b2a1298cdb3093a145b80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\f126b1e8ce8b2a1298cdb3093a145b80_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\xrrlllr.exec:\xrrlllr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\lxrxlll.exec:\lxrxlll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\jpdvv.exec:\jpdvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\httbhh.exec:\httbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
\??\c:\7fflfxl.exec:\7fflfxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\nbbbbt.exec:\nbbbbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
\??\c:\jpvpp.exec:\jpvpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\htttbb.exec:\htttbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\vvpvj.exec:\vvpvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\ttnbnn.exec:\ttnbnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\tnbttn.exec:\tnbttn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\vpvpp.exec:\vpvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
\??\c:\pjppd.exec:\pjppd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\dvvdv.exec:\dvvdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\nhtttn.exec:\nhtttn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\nhntbb.exec:\nhntbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\rfxlrlx.exec:\rfxlrlx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\jdvpj.exec:\jdvpj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\bbhtbn.exec:\bbhtbn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\hnhhhb.exec:\hnhhhb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:728 -
\??\c:\pdpvv.exec:\pdpvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\flfrxrf.exec:\flfrxrf.exe23⤵
- Executes dropped EXE
PID:4200 -
\??\c:\hbtnhb.exec:\hbtnhb.exe24⤵
- Executes dropped EXE
PID:2492 -
\??\c:\flrrlxr.exec:\flrrlxr.exe25⤵
- Executes dropped EXE
PID:3904 -
\??\c:\xrlrflx.exec:\xrlrflx.exe26⤵
- Executes dropped EXE
PID:2604 -
\??\c:\jvvvj.exec:\jvvvj.exe27⤵
- Executes dropped EXE
PID:2232 -
\??\c:\jdvpv.exec:\jdvpv.exe28⤵
- Executes dropped EXE
PID:644 -
\??\c:\xxrllxf.exec:\xxrllxf.exe29⤵
- Executes dropped EXE
PID:2860 -
\??\c:\vjvjv.exec:\vjvjv.exe30⤵
- Executes dropped EXE
PID:5092 -
\??\c:\lfflflr.exec:\lfflflr.exe31⤵
- Executes dropped EXE
PID:4496 -
\??\c:\pvdvd.exec:\pvdvd.exe32⤵
- Executes dropped EXE
PID:1708 -
\??\c:\pjpjd.exec:\pjpjd.exe33⤵
- Executes dropped EXE
PID:1816 -
\??\c:\thtnhb.exec:\thtnhb.exe34⤵
- Executes dropped EXE
PID:3996 -
\??\c:\fxllllf.exec:\fxllllf.exe35⤵
- Executes dropped EXE
PID:3548 -
\??\c:\dvjpd.exec:\dvjpd.exe36⤵
- Executes dropped EXE
PID:5068 -
\??\c:\1pvpp.exec:\1pvpp.exe37⤵
- Executes dropped EXE
PID:4468 -
\??\c:\tbhbtn.exec:\tbhbtn.exe38⤵
- Executes dropped EXE
PID:1560 -
\??\c:\httbbn.exec:\httbbn.exe39⤵
- Executes dropped EXE
PID:3084 -
\??\c:\lflfllf.exec:\lflfllf.exe40⤵
- Executes dropped EXE
PID:3120 -
\??\c:\flrxxrx.exec:\flrxxrx.exe41⤵
- Executes dropped EXE
PID:5004 -
\??\c:\rxlxxxr.exec:\rxlxxxr.exe42⤵
- Executes dropped EXE
PID:3016 -
\??\c:\dvvvp.exec:\dvvvp.exe43⤵
- Executes dropped EXE
PID:4524 -
\??\c:\5bhtth.exec:\5bhtth.exe44⤵
- Executes dropped EXE
PID:1948 -
\??\c:\bhbnbn.exec:\bhbnbn.exe45⤵
- Executes dropped EXE
PID:1452 -
\??\c:\9vdjj.exec:\9vdjj.exe46⤵
- Executes dropped EXE
PID:2768 -
\??\c:\thbtbt.exec:\thbtbt.exe47⤵
- Executes dropped EXE
PID:4396 -
\??\c:\llxxrff.exec:\llxxrff.exe48⤵
- Executes dropped EXE
PID:2576 -
\??\c:\dvjvp.exec:\dvjvp.exe49⤵
- Executes dropped EXE
PID:1748 -
\??\c:\jvvvd.exec:\jvvvd.exe50⤵
- Executes dropped EXE
PID:1992 -
\??\c:\rfllllf.exec:\rfllllf.exe51⤵
- Executes dropped EXE
PID:1100 -
\??\c:\rfrlllx.exec:\rfrlllx.exe52⤵
- Executes dropped EXE
PID:3664 -
\??\c:\vpppd.exec:\vpppd.exe53⤵
- Executes dropped EXE
PID:2140 -
\??\c:\jpvpj.exec:\jpvpj.exe54⤵
- Executes dropped EXE
PID:3216 -
\??\c:\5xfflxr.exec:\5xfflxr.exe55⤵
- Executes dropped EXE
PID:4628 -
\??\c:\lrrfrff.exec:\lrrfrff.exe56⤵
- Executes dropped EXE
PID:3688 -
\??\c:\fxfflxr.exec:\fxfflxr.exe57⤵
- Executes dropped EXE
PID:4812 -
\??\c:\rxrxfxl.exec:\rxrxfxl.exe58⤵
- Executes dropped EXE
PID:2500 -
\??\c:\jpjpv.exec:\jpjpv.exe59⤵
- Executes dropped EXE
PID:1736 -
\??\c:\pvvpp.exec:\pvvpp.exe60⤵
- Executes dropped EXE
PID:2816 -
\??\c:\btbbtb.exec:\btbbtb.exe61⤵
- Executes dropped EXE
PID:4584 -
\??\c:\flxrxrx.exec:\flxrxrx.exe62⤵
- Executes dropped EXE
PID:3220 -
\??\c:\dpjpd.exec:\dpjpd.exe63⤵
- Executes dropped EXE
PID:4056 -
\??\c:\bnthnh.exec:\bnthnh.exe64⤵
- Executes dropped EXE
PID:1796 -
\??\c:\tbbhbh.exec:\tbbhbh.exe65⤵
- Executes dropped EXE
PID:728 -
\??\c:\xllrlrr.exec:\xllrlrr.exe66⤵PID:4788
-
\??\c:\fxlxlxr.exec:\fxlxlxr.exe67⤵PID:4952
-
\??\c:\rflrrlr.exec:\rflrrlr.exe68⤵PID:3040
-
\??\c:\bnnnhh.exec:\bnnnhh.exe69⤵PID:4164
-
\??\c:\hhnbnb.exec:\hhnbnb.exe70⤵PID:4112
-
\??\c:\xrrxrrf.exec:\xrrxrrf.exe71⤵PID:2604
-
\??\c:\bbbbhb.exec:\bbbbhb.exe72⤵PID:2416
-
\??\c:\nnbntt.exec:\nnbntt.exe73⤵PID:2296
-
\??\c:\ntttnb.exec:\ntttnb.exe74⤵PID:4512
-
\??\c:\tnthtn.exec:\tnthtn.exe75⤵PID:2712
-
\??\c:\jpvpj.exec:\jpvpj.exe76⤵PID:2280
-
\??\c:\bnbtnn.exec:\bnbtnn.exe77⤵PID:952
-
\??\c:\ntbtnh.exec:\ntbtnh.exe78⤵PID:1672
-
\??\c:\vjvpd.exec:\vjvpd.exe79⤵PID:3516
-
\??\c:\lfrlfff.exec:\lfrlfff.exe80⤵PID:4196
-
\??\c:\rlrrlfx.exec:\rlrrlfx.exe81⤵PID:2528
-
\??\c:\9xrrfrl.exec:\9xrrfrl.exe82⤵PID:4684
-
\??\c:\jvvpv.exec:\jvvpv.exe83⤵PID:4400
-
\??\c:\fxfxllf.exec:\fxfxllf.exe84⤵PID:964
-
\??\c:\jjppd.exec:\jjppd.exe85⤵PID:4864
-
\??\c:\ddppp.exec:\ddppp.exe86⤵PID:4832
-
\??\c:\nthhhh.exec:\nthhhh.exe87⤵PID:3496
-
\??\c:\fflfxrx.exec:\fflfxrx.exe88⤵PID:4600
-
\??\c:\pjdvj.exec:\pjdvj.exe89⤵PID:344
-
\??\c:\rxlflxx.exec:\rxlflxx.exe90⤵PID:3912
-
\??\c:\1xrxlxr.exec:\1xrxlxr.exe91⤵PID:1584
-
\??\c:\vdjvd.exec:\vdjvd.exe92⤵PID:1452
-
\??\c:\jdjdd.exec:\jdjdd.exe93⤵PID:3332
-
\??\c:\hhbntb.exec:\hhbntb.exe94⤵PID:3260
-
\??\c:\vpdjj.exec:\vpdjj.exe95⤵PID:2856
-
\??\c:\nhhhnn.exec:\nhhhnn.exe96⤵PID:1028
-
\??\c:\djvpv.exec:\djvpv.exe97⤵PID:4728
-
\??\c:\nthbnh.exec:\nthbnh.exe98⤵PID:1820
-
\??\c:\tbhtnn.exec:\tbhtnn.exe99⤵PID:3840
-
\??\c:\pjddd.exec:\pjddd.exe100⤵PID:2140
-
\??\c:\nbhbbh.exec:\nbhbbh.exe101⤵PID:3204
-
\??\c:\dvvjd.exec:\dvvjd.exe102⤵PID:4176
-
\??\c:\pdppd.exec:\pdppd.exe103⤵PID:1828
-
\??\c:\nthbhh.exec:\nthbhh.exe104⤵PID:3600
-
\??\c:\lxllflf.exec:\lxllflf.exe105⤵PID:4076
-
\??\c:\vjpjj.exec:\vjpjj.exe106⤵PID:4156
-
\??\c:\hnbtnn.exec:\hnbtnn.exe107⤵PID:840
-
\??\c:\bbttbt.exec:\bbttbt.exe108⤵PID:3724
-
\??\c:\fxrrllf.exec:\fxrrllf.exe109⤵PID:1692
-
\??\c:\pvppv.exec:\pvppv.exe110⤵PID:4956
-
\??\c:\ddpdp.exec:\ddpdp.exe111⤵PID:2288
-
\??\c:\jjjjd.exec:\jjjjd.exe112⤵PID:4668
-
\??\c:\ppppp.exec:\ppppp.exe113⤵PID:3088
-
\??\c:\bntthh.exec:\bntthh.exe114⤵PID:3560
-
\??\c:\bbtnbn.exec:\bbtnbn.exe115⤵PID:3916
-
\??\c:\hbhhth.exec:\hbhhth.exe116⤵PID:3392
-
\??\c:\xlrlrxf.exec:\xlrlrxf.exe117⤵PID:640
-
\??\c:\jjjjd.exec:\jjjjd.exe118⤵PID:216
-
\??\c:\fxllxfx.exec:\fxllxfx.exe119⤵PID:1336
-
\??\c:\ttttnn.exec:\ttttnn.exe120⤵PID:392
-
\??\c:\rrxxlxx.exec:\rrxxlxx.exe121⤵PID:2248
-
\??\c:\rlrxfrf.exec:\rlrxfrf.exe122⤵PID:1160
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-