Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/05/2024, 18:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
06d70f148025e5b316ed7b27a84655c0_NeikiAnalytics.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
06d70f148025e5b316ed7b27a84655c0_NeikiAnalytics.exe
-
Size
78KB
-
MD5
06d70f148025e5b316ed7b27a84655c0
-
SHA1
870704c520381dd4e9664553634bdb46b7f776e9
-
SHA256
280663903f1b693b5761558f4df307a00592514bffe7405568b1ab0ebd4914c3
-
SHA512
120b09854711d96d0ac860c0572cc3c6edbb3804e2a73003e35c2143e9037c3218775a02d032010249a9dfaca16ef7aabfec508e08bd4326d5d99ab7aa2e5751
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAX8YieVIJclPvPJtcdctf:ymb3NkkiQ3mdBjFo68YBVIJc9Jtxtf
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/3988-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2692-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1540-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/432-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4588-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1944-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3556-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2916-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3612-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/620-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2612-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4028-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2352-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4960-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1476-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2192-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2832-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1920-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4276-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4580-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2692 vjdvp.exe 1540 ffrxlrx.exe 432 tttbnh.exe 4588 pjvvp.exe 1944 llfrrrl.exe 3556 bttttt.exe 2916 dvddd.exe 3612 5rxfxff.exe 620 bbnntb.exe 2612 ppjjd.exe 1900 ffxfrrx.exe 4028 httbbn.exe 4508 pdjjd.exe 5100 xxlfxxr.exe 2352 btnhbb.exe 4960 ddvdd.exe 1476 rrfxxrr.exe 2192 nnnnnn.exe 388 nbbhbh.exe 2832 pjdvd.exe 1920 1rffxxx.exe 408 nhnbtn.exe 4992 vpvpp.exe 3476 ffxlffl.exe 4744 hbbtnt.exe 4276 7pddd.exe 676 tnnhbt.exe 2300 hhnnnn.exe 1716 dpddp.exe 1960 7ffffrr.exe 4580 hntnhb.exe 3672 nhnnhh.exe 3624 fxxrfrr.exe 2496 tnbbhn.exe 1572 btbttt.exe 528 3djpj.exe 636 xrxxrrr.exe 2588 bhhbbh.exe 4340 dvddp.exe 5020 ppvvj.exe 4228 7rrlffx.exe 4544 xlxfffx.exe 2296 nnhbnn.exe 1688 3ppjj.exe 2620 vdjdv.exe 4860 llxxxxf.exe 4896 lflffff.exe 4892 ttttbb.exe 2916 hhbttt.exe 4436 pdppj.exe 5104 3jppd.exe 4248 llllxxx.exe 3896 lxflrrr.exe 3280 5bhhbb.exe 2288 tnttnb.exe 4092 pjvpv.exe 3340 vvvvv.exe 2200 rfrrllr.exe 4616 xlrrrrl.exe 3736 3hnttt.exe 1448 tbnhbb.exe 4540 jpddd.exe 2144 pjdvv.exe 2752 frlrfll.exe -
resource yara_rule behavioral2/memory/3988-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2692-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1540-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/432-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4588-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1944-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3556-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3556-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2916-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2916-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3612-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/620-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2612-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4028-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2352-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4960-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1476-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2192-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/388-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2832-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1920-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4276-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3988 wrote to memory of 2692 3988 06d70f148025e5b316ed7b27a84655c0_NeikiAnalytics.exe 82 PID 3988 wrote to memory of 2692 3988 06d70f148025e5b316ed7b27a84655c0_NeikiAnalytics.exe 82 PID 3988 wrote to memory of 2692 3988 06d70f148025e5b316ed7b27a84655c0_NeikiAnalytics.exe 82 PID 2692 wrote to memory of 1540 2692 vjdvp.exe 83 PID 2692 wrote to memory of 1540 2692 vjdvp.exe 83 PID 2692 wrote to memory of 1540 2692 vjdvp.exe 83 PID 1540 wrote to memory of 432 1540 ffrxlrx.exe 84 PID 1540 wrote to memory of 432 1540 ffrxlrx.exe 84 PID 1540 wrote to memory of 432 1540 ffrxlrx.exe 84 PID 432 wrote to memory of 4588 432 tttbnh.exe 85 PID 432 wrote to memory of 4588 432 tttbnh.exe 85 PID 432 wrote to memory of 4588 432 tttbnh.exe 85 PID 4588 wrote to memory of 1944 4588 pjvvp.exe 86 PID 4588 wrote to memory of 1944 4588 pjvvp.exe 86 PID 4588 wrote to memory of 1944 4588 pjvvp.exe 86 PID 1944 wrote to memory of 3556 1944 llfrrrl.exe 87 PID 1944 wrote to memory of 3556 1944 llfrrrl.exe 87 PID 1944 wrote to memory of 3556 1944 llfrrrl.exe 87 PID 3556 wrote to memory of 2916 3556 bttttt.exe 88 PID 3556 wrote to memory of 2916 3556 bttttt.exe 88 PID 3556 wrote to memory of 2916 3556 bttttt.exe 88 PID 2916 wrote to memory of 3612 2916 dvddd.exe 89 PID 2916 wrote to memory of 3612 2916 dvddd.exe 89 PID 2916 wrote to memory of 3612 2916 dvddd.exe 89 PID 3612 wrote to memory of 620 3612 5rxfxff.exe 90 PID 3612 wrote to memory of 620 3612 5rxfxff.exe 90 PID 3612 wrote to memory of 620 3612 5rxfxff.exe 90 PID 620 wrote to memory of 2612 620 bbnntb.exe 91 PID 620 wrote to memory of 2612 620 bbnntb.exe 91 PID 620 wrote to memory of 2612 620 bbnntb.exe 91 PID 2612 wrote to memory of 1900 2612 ppjjd.exe 92 PID 2612 wrote to memory of 1900 2612 ppjjd.exe 92 PID 2612 wrote to memory of 1900 2612 ppjjd.exe 92 PID 1900 wrote to memory of 4028 1900 ffxfrrx.exe 93 PID 1900 wrote to memory of 4028 1900 ffxfrrx.exe 93 PID 1900 wrote to memory of 4028 1900 ffxfrrx.exe 93 PID 4028 wrote to memory of 4508 4028 httbbn.exe 94 PID 4028 wrote to memory of 4508 4028 httbbn.exe 94 PID 4028 wrote to memory of 4508 4028 httbbn.exe 94 PID 4508 wrote to memory of 5100 4508 pdjjd.exe 95 PID 4508 wrote to memory of 5100 4508 pdjjd.exe 95 PID 4508 wrote to memory of 5100 4508 pdjjd.exe 95 PID 5100 wrote to memory of 2352 5100 xxlfxxr.exe 96 PID 5100 wrote to memory of 2352 5100 xxlfxxr.exe 96 PID 5100 wrote to memory of 2352 5100 xxlfxxr.exe 96 PID 2352 wrote to memory of 4960 2352 btnhbb.exe 97 PID 2352 wrote to memory of 4960 2352 btnhbb.exe 97 PID 2352 wrote to memory of 4960 2352 btnhbb.exe 97 PID 4960 wrote to memory of 1476 4960 ddvdd.exe 98 PID 4960 wrote to memory of 1476 4960 ddvdd.exe 98 PID 4960 wrote to memory of 1476 4960 ddvdd.exe 98 PID 1476 wrote to memory of 2192 1476 rrfxxrr.exe 99 PID 1476 wrote to memory of 2192 1476 rrfxxrr.exe 99 PID 1476 wrote to memory of 2192 1476 rrfxxrr.exe 99 PID 2192 wrote to memory of 388 2192 nnnnnn.exe 100 PID 2192 wrote to memory of 388 2192 nnnnnn.exe 100 PID 2192 wrote to memory of 388 2192 nnnnnn.exe 100 PID 388 wrote to memory of 2832 388 nbbhbh.exe 101 PID 388 wrote to memory of 2832 388 nbbhbh.exe 101 PID 388 wrote to memory of 2832 388 nbbhbh.exe 101 PID 2832 wrote to memory of 1920 2832 pjdvd.exe 103 PID 2832 wrote to memory of 1920 2832 pjdvd.exe 103 PID 2832 wrote to memory of 1920 2832 pjdvd.exe 103 PID 1920 wrote to memory of 408 1920 1rffxxx.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\06d70f148025e5b316ed7b27a84655c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\06d70f148025e5b316ed7b27a84655c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\vjdvp.exec:\vjdvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\ffrxlrx.exec:\ffrxlrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\tttbnh.exec:\tttbnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\pjvvp.exec:\pjvvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\llfrrrl.exec:\llfrrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\bttttt.exec:\bttttt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\dvddd.exec:\dvddd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\5rxfxff.exec:\5rxfxff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\bbnntb.exec:\bbnntb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
\??\c:\ppjjd.exec:\ppjjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\ffxfrrx.exec:\ffxfrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\httbbn.exec:\httbbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\pdjjd.exec:\pdjjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\xxlfxxr.exec:\xxlfxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\btnhbb.exec:\btnhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\ddvdd.exec:\ddvdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\rrfxxrr.exec:\rrfxxrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\nnnnnn.exec:\nnnnnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\nbbhbh.exec:\nbbhbh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\pjdvd.exec:\pjdvd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\1rffxxx.exec:\1rffxxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\nhnbtn.exec:\nhnbtn.exe23⤵
- Executes dropped EXE
PID:408 -
\??\c:\vpvpp.exec:\vpvpp.exe24⤵
- Executes dropped EXE
PID:4992 -
\??\c:\ffxlffl.exec:\ffxlffl.exe25⤵
- Executes dropped EXE
PID:3476 -
\??\c:\hbbtnt.exec:\hbbtnt.exe26⤵
- Executes dropped EXE
PID:4744 -
\??\c:\7pddd.exec:\7pddd.exe27⤵
- Executes dropped EXE
PID:4276 -
\??\c:\tnnhbt.exec:\tnnhbt.exe28⤵
- Executes dropped EXE
PID:676 -
\??\c:\hhnnnn.exec:\hhnnnn.exe29⤵
- Executes dropped EXE
PID:2300 -
\??\c:\dpddp.exec:\dpddp.exe30⤵
- Executes dropped EXE
PID:1716 -
\??\c:\7ffffrr.exec:\7ffffrr.exe31⤵
- Executes dropped EXE
PID:1960 -
\??\c:\hntnhb.exec:\hntnhb.exe32⤵
- Executes dropped EXE
PID:4580 -
\??\c:\nhnnhh.exec:\nhnnhh.exe33⤵
- Executes dropped EXE
PID:3672 -
\??\c:\fxxrfrr.exec:\fxxrfrr.exe34⤵
- Executes dropped EXE
PID:3624 -
\??\c:\tnbbhn.exec:\tnbbhn.exe35⤵
- Executes dropped EXE
PID:2496 -
\??\c:\btbttt.exec:\btbttt.exe36⤵
- Executes dropped EXE
PID:1572 -
\??\c:\3djpj.exec:\3djpj.exe37⤵
- Executes dropped EXE
PID:528 -
\??\c:\xrxxrrr.exec:\xrxxrrr.exe38⤵
- Executes dropped EXE
PID:636 -
\??\c:\bhhbbh.exec:\bhhbbh.exe39⤵
- Executes dropped EXE
PID:2588 -
\??\c:\dvddp.exec:\dvddp.exe40⤵
- Executes dropped EXE
PID:4340 -
\??\c:\ppvvj.exec:\ppvvj.exe41⤵
- Executes dropped EXE
PID:5020 -
\??\c:\7rrlffx.exec:\7rrlffx.exe42⤵
- Executes dropped EXE
PID:4228 -
\??\c:\xlxfffx.exec:\xlxfffx.exe43⤵
- Executes dropped EXE
PID:4544 -
\??\c:\nnhbnn.exec:\nnhbnn.exe44⤵
- Executes dropped EXE
PID:2296 -
\??\c:\3ppjj.exec:\3ppjj.exe45⤵
- Executes dropped EXE
PID:1688 -
\??\c:\vdjdv.exec:\vdjdv.exe46⤵
- Executes dropped EXE
PID:2620 -
\??\c:\llxxxxf.exec:\llxxxxf.exe47⤵
- Executes dropped EXE
PID:4860 -
\??\c:\lflffff.exec:\lflffff.exe48⤵
- Executes dropped EXE
PID:4896 -
\??\c:\ttttbb.exec:\ttttbb.exe49⤵
- Executes dropped EXE
PID:4892 -
\??\c:\hhbttt.exec:\hhbttt.exe50⤵
- Executes dropped EXE
PID:2916 -
\??\c:\pdppj.exec:\pdppj.exe51⤵
- Executes dropped EXE
PID:4436 -
\??\c:\3jppd.exec:\3jppd.exe52⤵
- Executes dropped EXE
PID:5104 -
\??\c:\llllxxx.exec:\llllxxx.exe53⤵
- Executes dropped EXE
PID:4248 -
\??\c:\lxflrrr.exec:\lxflrrr.exe54⤵
- Executes dropped EXE
PID:3896 -
\??\c:\5bhhbb.exec:\5bhhbb.exe55⤵
- Executes dropped EXE
PID:3280 -
\??\c:\tnttnb.exec:\tnttnb.exe56⤵
- Executes dropped EXE
PID:2288 -
\??\c:\pjvpv.exec:\pjvpv.exe57⤵
- Executes dropped EXE
PID:4092 -
\??\c:\vvvvv.exec:\vvvvv.exe58⤵
- Executes dropped EXE
PID:3340 -
\??\c:\rfrrllr.exec:\rfrrllr.exe59⤵
- Executes dropped EXE
PID:2200 -
\??\c:\xlrrrrl.exec:\xlrrrrl.exe60⤵
- Executes dropped EXE
PID:4616 -
\??\c:\3hnttt.exec:\3hnttt.exe61⤵
- Executes dropped EXE
PID:3736 -
\??\c:\tbnhbb.exec:\tbnhbb.exe62⤵
- Executes dropped EXE
PID:1448 -
\??\c:\jpddd.exec:\jpddd.exe63⤵
- Executes dropped EXE
PID:4540 -
\??\c:\pjdvv.exec:\pjdvv.exe64⤵
- Executes dropped EXE
PID:2144 -
\??\c:\frlrfll.exec:\frlrfll.exe65⤵
- Executes dropped EXE
PID:2752 -
\??\c:\frfffll.exec:\frfffll.exe66⤵PID:3952
-
\??\c:\nhhnnn.exec:\nhhnnn.exe67⤵PID:4260
-
\??\c:\fffrrxl.exec:\fffrrxl.exe68⤵PID:8
-
\??\c:\rlrlfxx.exec:\rlrlfxx.exe69⤵PID:1800
-
\??\c:\tbbttt.exec:\tbbttt.exe70⤵PID:4604
-
\??\c:\bttbtt.exec:\bttbtt.exe71⤵PID:2652
-
\??\c:\9vvvp.exec:\9vvvp.exe72⤵PID:2868
-
\??\c:\xxxxxrr.exec:\xxxxxrr.exe73⤵PID:4396
-
\??\c:\xxlxllr.exec:\xxlxllr.exe74⤵PID:4412
-
\??\c:\5tnhnn.exec:\5tnhnn.exe75⤵PID:2872
-
\??\c:\jvjdv.exec:\jvjdv.exe76⤵PID:4748
-
\??\c:\xflfxlf.exec:\xflfxlf.exe77⤵PID:3308
-
\??\c:\rrfflrx.exec:\rrfflrx.exe78⤵PID:4736
-
\??\c:\httbtt.exec:\httbtt.exe79⤵PID:1960
-
\??\c:\hhnnbh.exec:\hhnnbh.exe80⤵PID:2440
-
\??\c:\fxfffxl.exec:\fxfffxl.exe81⤵PID:4980
-
\??\c:\bbttnn.exec:\bbttnn.exe82⤵PID:2964
-
\??\c:\1bhhtb.exec:\1bhhtb.exe83⤵PID:3352
-
\??\c:\pdvvp.exec:\pdvvp.exe84⤵PID:528
-
\??\c:\ddppj.exec:\ddppj.exe85⤵PID:4292
-
\??\c:\xrffffl.exec:\xrffffl.exe86⤵PID:4296
-
\??\c:\rrxfffl.exec:\rrxfffl.exe87⤵PID:2452
-
\??\c:\9tbtnh.exec:\9tbtnh.exe88⤵PID:3988
-
\??\c:\bntttn.exec:\bntttn.exe89⤵PID:2692
-
\??\c:\vjjjd.exec:\vjjjd.exe90⤵PID:1764
-
\??\c:\vpvpp.exec:\vpvpp.exe91⤵PID:524
-
\??\c:\lrlllfx.exec:\lrlllfx.exe92⤵PID:3132
-
\??\c:\btbtth.exec:\btbtth.exe93⤵PID:4164
-
\??\c:\hthbbb.exec:\hthbbb.exe94⤵PID:3628
-
\??\c:\jjddv.exec:\jjddv.exe95⤵PID:4244
-
\??\c:\dpvvv.exec:\dpvvv.exe96⤵PID:400
-
\??\c:\rxrlfff.exec:\rxrlfff.exe97⤵PID:752
-
\??\c:\bbnhht.exec:\bbnhht.exe98⤵PID:1384
-
\??\c:\3hnnnn.exec:\3hnnnn.exe99⤵PID:1220
-
\??\c:\vpdvp.exec:\vpdvp.exe100⤵PID:4880
-
\??\c:\7pvpj.exec:\7pvpj.exe101⤵PID:2612
-
\??\c:\rllflfx.exec:\rllflfx.exe102⤵PID:1900
-
\??\c:\xfffxrr.exec:\xfffxrr.exe103⤵PID:1552
-
\??\c:\hnhhnn.exec:\hnhhnn.exe104⤵PID:4972
-
\??\c:\jvpjv.exec:\jvpjv.exe105⤵PID:1904
-
\??\c:\1djjd.exec:\1djjd.exe106⤵PID:5100
-
\??\c:\rllfxfx.exec:\rllfxfx.exe107⤵PID:4868
-
\??\c:\lfllrrl.exec:\lfllrrl.exe108⤵PID:3724
-
\??\c:\5hbhht.exec:\5hbhht.exe109⤵PID:2028
-
\??\c:\hntnnn.exec:\hntnnn.exe110⤵PID:1812
-
\??\c:\jvvpp.exec:\jvvpp.exe111⤵PID:1660
-
\??\c:\vvjjj.exec:\vvjjj.exe112⤵PID:4372
-
\??\c:\3rfxrxx.exec:\3rfxrxx.exe113⤵PID:2460
-
\??\c:\lfxrrfx.exec:\lfxrrfx.exe114⤵PID:2384
-
\??\c:\htbnth.exec:\htbnth.exe115⤵PID:5040
-
\??\c:\pppjv.exec:\pppjv.exe116⤵PID:4108
-
\??\c:\rlfxrxx.exec:\rlfxrxx.exe117⤵PID:1704
-
\??\c:\nbhhhh.exec:\nbhhhh.exe118⤵PID:1008
-
\??\c:\jvjvj.exec:\jvjvj.exe119⤵PID:4688
-
\??\c:\dvvdd.exec:\dvvdd.exe120⤵PID:1596
-
\??\c:\ffxxrrr.exec:\ffxxrrr.exe121⤵PID:4276
-
\??\c:\hhttnn.exec:\hhttnn.exe122⤵PID:1328
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-