Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 09:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8ddbc8099fe1edc089c729a99d6d5ea0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
8ddbc8099fe1edc089c729a99d6d5ea0_NeikiAnalytics.exe
-
Size
68KB
-
MD5
8ddbc8099fe1edc089c729a99d6d5ea0
-
SHA1
f28af04022f24346385622184ef2f476757c1b4a
-
SHA256
26dc6bf9f5c8c5c7cd19a25d0af62608d0344f8cb890ddd5e78bd38547f06d83
-
SHA512
c13c579f1042cc758978e39437a8f29bc69f19b95d04daacefff318e7971b5a69be469724d5f3da71e90ba52d14b34a98b69a1e992998ca84312cea161579383
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIfv7+afCD+QsQbuf:ymb3NkkiQ3mdBjFIfvTfCD+H/
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/2904-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-15-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2212-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4644-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4008-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2484-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4368-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/748-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/376-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1696-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/536-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3636-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3088-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2480-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4476-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1976-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2076-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1484-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2856-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4360-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4024-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/436-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2624-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2280-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-2682-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4904 vvvjv.exe 2212 rxxflff.exe 4644 7llfxfx.exe 4008 5bbbnn.exe 2484 7ttnbt.exe 4368 rlllxxr.exe 748 fxrlxxr.exe 2364 bnttnn.exe 376 5jpjp.exe 1696 pjjjd.exe 3596 flrrlff.exe 536 nhnhhb.exe 3636 3jdpj.exe 3088 5pvdp.exe 3372 fxrxxfx.exe 2480 hnbbtt.exe 4476 pjjdp.exe 5008 1xfxrxr.exe 1976 bbbbnb.exe 684 tnnbnn.exe 2076 pdvpj.exe 1484 7xxlfxr.exe 2856 tttnnn.exe 4360 dpdvj.exe 1624 lxfxrlf.exe 4024 nhtnhb.exe 436 htnhtb.exe 2344 dvvdv.exe 4392 lfffxxx.exe 2624 nbtttt.exe 2280 9ttnhh.exe 3392 vvpjv.exe 2608 3fxxrrl.exe 4272 1bbnhh.exe 3112 vjdjv.exe 556 fxxrllr.exe 4228 hnnhhb.exe 4324 tntnbb.exe 4564 vpjdd.exe 1700 vppjv.exe 4496 lxlrffx.exe 4920 hhhtnb.exe 4008 htbnhb.exe 3568 ppvjv.exe 4932 9frxrrr.exe 4368 lxffllx.exe 1740 ttbthh.exe 2900 thbtnb.exe 4260 1vjjd.exe 376 jdjdj.exe 1000 xrlrrrf.exe 3620 frffllf.exe 4376 9btnnn.exe 4016 htbthh.exe 1504 jjjpp.exe 3088 frrlxll.exe 1904 flrrrfx.exe 4540 nttbbb.exe 4500 3hhbtn.exe 3084 vpdvj.exe 5008 pjdvv.exe 1976 rxrllff.exe 4468 xfrrlff.exe 4104 hnbbbh.exe -
resource yara_rule behavioral2/memory/2904-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2212-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4644-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4008-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2484-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/748-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/376-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1696-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1696-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3596-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/536-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3636-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2480-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1976-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2076-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1484-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2856-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4360-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4024-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/436-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2624-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-2682-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2904 wrote to memory of 4904 2904 8ddbc8099fe1edc089c729a99d6d5ea0_NeikiAnalytics.exe 83 PID 2904 wrote to memory of 4904 2904 8ddbc8099fe1edc089c729a99d6d5ea0_NeikiAnalytics.exe 83 PID 2904 wrote to memory of 4904 2904 8ddbc8099fe1edc089c729a99d6d5ea0_NeikiAnalytics.exe 83 PID 4904 wrote to memory of 2212 4904 vvvjv.exe 84 PID 4904 wrote to memory of 2212 4904 vvvjv.exe 84 PID 4904 wrote to memory of 2212 4904 vvvjv.exe 84 PID 2212 wrote to memory of 4644 2212 rxxflff.exe 85 PID 2212 wrote to memory of 4644 2212 rxxflff.exe 85 PID 2212 wrote to memory of 4644 2212 rxxflff.exe 85 PID 4644 wrote to memory of 4008 4644 7llfxfx.exe 86 PID 4644 wrote to memory of 4008 4644 7llfxfx.exe 86 PID 4644 wrote to memory of 4008 4644 7llfxfx.exe 86 PID 4008 wrote to memory of 2484 4008 5bbbnn.exe 87 PID 4008 wrote to memory of 2484 4008 5bbbnn.exe 87 PID 4008 wrote to memory of 2484 4008 5bbbnn.exe 87 PID 2484 wrote to memory of 4368 2484 7ttnbt.exe 88 PID 2484 wrote to memory of 4368 2484 7ttnbt.exe 88 PID 2484 wrote to memory of 4368 2484 7ttnbt.exe 88 PID 4368 wrote to memory of 748 4368 rlllxxr.exe 89 PID 4368 wrote to memory of 748 4368 rlllxxr.exe 89 PID 4368 wrote to memory of 748 4368 rlllxxr.exe 89 PID 748 wrote to memory of 2364 748 fxrlxxr.exe 90 PID 748 wrote to memory of 2364 748 fxrlxxr.exe 90 PID 748 wrote to memory of 2364 748 fxrlxxr.exe 90 PID 2364 wrote to memory of 376 2364 bnttnn.exe 91 PID 2364 wrote to memory of 376 2364 bnttnn.exe 91 PID 2364 wrote to memory of 376 2364 bnttnn.exe 91 PID 376 wrote to memory of 1696 376 5jpjp.exe 92 PID 376 wrote to memory of 1696 376 5jpjp.exe 92 PID 376 wrote to memory of 1696 376 5jpjp.exe 92 PID 1696 wrote to memory of 3596 1696 pjjjd.exe 93 PID 1696 wrote to memory of 3596 1696 pjjjd.exe 93 PID 1696 wrote to memory of 3596 1696 pjjjd.exe 93 PID 3596 wrote to memory of 536 3596 flrrlff.exe 94 PID 3596 wrote to memory of 536 3596 flrrlff.exe 94 PID 3596 wrote to memory of 536 3596 flrrlff.exe 94 PID 536 wrote to memory of 3636 536 nhnhhb.exe 95 PID 536 wrote to memory of 3636 536 nhnhhb.exe 95 PID 536 wrote to memory of 3636 536 nhnhhb.exe 95 PID 3636 wrote to memory of 3088 3636 3jdpj.exe 96 PID 3636 wrote to memory of 3088 3636 3jdpj.exe 96 PID 3636 wrote to memory of 3088 3636 3jdpj.exe 96 PID 3088 wrote to memory of 3372 3088 5pvdp.exe 97 PID 3088 wrote to memory of 3372 3088 5pvdp.exe 97 PID 3088 wrote to memory of 3372 3088 5pvdp.exe 97 PID 3372 wrote to memory of 2480 3372 fxrxxfx.exe 98 PID 3372 wrote to memory of 2480 3372 fxrxxfx.exe 98 PID 3372 wrote to memory of 2480 3372 fxrxxfx.exe 98 PID 2480 wrote to memory of 4476 2480 hnbbtt.exe 99 PID 2480 wrote to memory of 4476 2480 hnbbtt.exe 99 PID 2480 wrote to memory of 4476 2480 hnbbtt.exe 99 PID 4476 wrote to memory of 5008 4476 pjjdp.exe 100 PID 4476 wrote to memory of 5008 4476 pjjdp.exe 100 PID 4476 wrote to memory of 5008 4476 pjjdp.exe 100 PID 5008 wrote to memory of 1976 5008 1xfxrxr.exe 102 PID 5008 wrote to memory of 1976 5008 1xfxrxr.exe 102 PID 5008 wrote to memory of 1976 5008 1xfxrxr.exe 102 PID 1976 wrote to memory of 684 1976 bbbbnb.exe 103 PID 1976 wrote to memory of 684 1976 bbbbnb.exe 103 PID 1976 wrote to memory of 684 1976 bbbbnb.exe 103 PID 684 wrote to memory of 2076 684 tnnbnn.exe 104 PID 684 wrote to memory of 2076 684 tnnbnn.exe 104 PID 684 wrote to memory of 2076 684 tnnbnn.exe 104 PID 2076 wrote to memory of 1484 2076 pdvpj.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ddbc8099fe1edc089c729a99d6d5ea0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8ddbc8099fe1edc089c729a99d6d5ea0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\vvvjv.exec:\vvvjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\rxxflff.exec:\rxxflff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\7llfxfx.exec:\7llfxfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
\??\c:\5bbbnn.exec:\5bbbnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\7ttnbt.exec:\7ttnbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\rlllxxr.exec:\rlllxxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\fxrlxxr.exec:\fxrlxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\bnttnn.exec:\bnttnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\5jpjp.exec:\5jpjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\pjjjd.exec:\pjjjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\flrrlff.exec:\flrrlff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\nhnhhb.exec:\nhnhhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\3jdpj.exec:\3jdpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\5pvdp.exec:\5pvdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\fxrxxfx.exec:\fxrxxfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\hnbbtt.exec:\hnbbtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\pjjdp.exec:\pjjdp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\1xfxrxr.exec:\1xfxrxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\bbbbnb.exec:\bbbbnb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\tnnbnn.exec:\tnnbnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\pdvpj.exec:\pdvpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\7xxlfxr.exec:\7xxlfxr.exe23⤵
- Executes dropped EXE
PID:1484 -
\??\c:\tttnnn.exec:\tttnnn.exe24⤵
- Executes dropped EXE
PID:2856 -
\??\c:\dpdvj.exec:\dpdvj.exe25⤵
- Executes dropped EXE
PID:4360 -
\??\c:\lxfxrlf.exec:\lxfxrlf.exe26⤵
- Executes dropped EXE
PID:1624 -
\??\c:\nhtnhb.exec:\nhtnhb.exe27⤵
- Executes dropped EXE
PID:4024 -
\??\c:\htnhtb.exec:\htnhtb.exe28⤵
- Executes dropped EXE
PID:436 -
\??\c:\dvvdv.exec:\dvvdv.exe29⤵
- Executes dropped EXE
PID:2344 -
\??\c:\lfffxxx.exec:\lfffxxx.exe30⤵
- Executes dropped EXE
PID:4392 -
\??\c:\nbtttt.exec:\nbtttt.exe31⤵
- Executes dropped EXE
PID:2624 -
\??\c:\9ttnhh.exec:\9ttnhh.exe32⤵
- Executes dropped EXE
PID:2280 -
\??\c:\vvpjv.exec:\vvpjv.exe33⤵
- Executes dropped EXE
PID:3392 -
\??\c:\3fxxrrl.exec:\3fxxrrl.exe34⤵
- Executes dropped EXE
PID:2608 -
\??\c:\1bbnhh.exec:\1bbnhh.exe35⤵
- Executes dropped EXE
PID:4272 -
\??\c:\vjdjv.exec:\vjdjv.exe36⤵
- Executes dropped EXE
PID:3112 -
\??\c:\fxxrllr.exec:\fxxrllr.exe37⤵
- Executes dropped EXE
PID:556 -
\??\c:\hnnhhb.exec:\hnnhhb.exe38⤵
- Executes dropped EXE
PID:4228 -
\??\c:\tntnbb.exec:\tntnbb.exe39⤵
- Executes dropped EXE
PID:4324 -
\??\c:\vpjdd.exec:\vpjdd.exe40⤵
- Executes dropped EXE
PID:4564 -
\??\c:\vppjv.exec:\vppjv.exe41⤵
- Executes dropped EXE
PID:1700 -
\??\c:\lxlrffx.exec:\lxlrffx.exe42⤵
- Executes dropped EXE
PID:4496 -
\??\c:\hhhtnb.exec:\hhhtnb.exe43⤵
- Executes dropped EXE
PID:4920 -
\??\c:\htbnhb.exec:\htbnhb.exe44⤵
- Executes dropped EXE
PID:4008 -
\??\c:\ppvjv.exec:\ppvjv.exe45⤵
- Executes dropped EXE
PID:3568 -
\??\c:\9frxrrr.exec:\9frxrrr.exe46⤵
- Executes dropped EXE
PID:4932 -
\??\c:\lxffllx.exec:\lxffllx.exe47⤵
- Executes dropped EXE
PID:4368 -
\??\c:\ttbthh.exec:\ttbthh.exe48⤵
- Executes dropped EXE
PID:1740 -
\??\c:\thbtnb.exec:\thbtnb.exe49⤵
- Executes dropped EXE
PID:2900 -
\??\c:\1vjjd.exec:\1vjjd.exe50⤵
- Executes dropped EXE
PID:4260 -
\??\c:\jdjdj.exec:\jdjdj.exe51⤵
- Executes dropped EXE
PID:376 -
\??\c:\xrlrrrf.exec:\xrlrrrf.exe52⤵
- Executes dropped EXE
PID:1000 -
\??\c:\frffllf.exec:\frffllf.exe53⤵
- Executes dropped EXE
PID:3620 -
\??\c:\9btnnn.exec:\9btnnn.exe54⤵
- Executes dropped EXE
PID:4376 -
\??\c:\htbthh.exec:\htbthh.exe55⤵
- Executes dropped EXE
PID:4016 -
\??\c:\jjjpp.exec:\jjjpp.exe56⤵
- Executes dropped EXE
PID:1504 -
\??\c:\frrlxll.exec:\frrlxll.exe57⤵
- Executes dropped EXE
PID:3088 -
\??\c:\flrrrfx.exec:\flrrrfx.exe58⤵
- Executes dropped EXE
PID:1904 -
\??\c:\nttbbb.exec:\nttbbb.exe59⤵
- Executes dropped EXE
PID:4540 -
\??\c:\3hhbtn.exec:\3hhbtn.exe60⤵
- Executes dropped EXE
PID:4500 -
\??\c:\vpdvj.exec:\vpdvj.exe61⤵
- Executes dropped EXE
PID:3084 -
\??\c:\pjdvv.exec:\pjdvv.exe62⤵
- Executes dropped EXE
PID:5008 -
\??\c:\rxrllff.exec:\rxrllff.exe63⤵
- Executes dropped EXE
PID:1976 -
\??\c:\xfrrlff.exec:\xfrrlff.exe64⤵
- Executes dropped EXE
PID:4468 -
\??\c:\hnbbbh.exec:\hnbbbh.exe65⤵
- Executes dropped EXE
PID:4104 -
\??\c:\bnbthh.exec:\bnbthh.exe66⤵PID:2076
-
\??\c:\vpjdp.exec:\vpjdp.exe67⤵PID:3420
-
\??\c:\vppdj.exec:\vppdj.exe68⤵PID:1004
-
\??\c:\xrrxxxx.exec:\xrrxxxx.exe69⤵PID:1104
-
\??\c:\9fllffx.exec:\9fllffx.exe70⤵PID:3848
-
\??\c:\tbhhhh.exec:\tbhhhh.exe71⤵PID:4524
-
\??\c:\7htttb.exec:\7htttb.exe72⤵PID:2716
-
\??\c:\5vpjd.exec:\5vpjd.exe73⤵PID:4760
-
\??\c:\dpjvp.exec:\dpjvp.exe74⤵PID:3292
-
\??\c:\rfrxxxx.exec:\rfrxxxx.exe75⤵PID:4012
-
\??\c:\rllffff.exec:\rllffff.exe76⤵PID:4596
-
\??\c:\tnnnnb.exec:\tnnnnb.exe77⤵PID:3968
-
\??\c:\tbbbnh.exec:\tbbbnh.exe78⤵PID:2300
-
\??\c:\3pjvp.exec:\3pjvp.exe79⤵PID:2280
-
\??\c:\vjdvj.exec:\vjdvj.exe80⤵PID:3392
-
\??\c:\xrxxrlf.exec:\xrxxrlf.exe81⤵PID:3448
-
\??\c:\1bhhhn.exec:\1bhhhn.exe82⤵PID:2608
-
\??\c:\1pdvj.exec:\1pdvj.exe83⤵PID:3808
-
\??\c:\jddpp.exec:\jddpp.exe84⤵PID:808
-
\??\c:\frxxxfx.exec:\frxxxfx.exe85⤵PID:2188
-
\??\c:\xxfxfrx.exec:\xxfxfrx.exe86⤵PID:4316
-
\??\c:\7nhhhh.exec:\7nhhhh.exe87⤵PID:836
-
\??\c:\dvvpd.exec:\dvvpd.exe88⤵PID:2148
-
\??\c:\fxrllrx.exec:\fxrllrx.exe89⤵PID:2212
-
\??\c:\nbhhhh.exec:\nbhhhh.exe90⤵PID:3040
-
\??\c:\tnhhtt.exec:\tnhhtt.exe91⤵PID:2688
-
\??\c:\pdpjp.exec:\pdpjp.exe92⤵PID:1180
-
\??\c:\lllfxlf.exec:\lllfxlf.exe93⤵PID:5092
-
\??\c:\rxrrlfx.exec:\rxrrlfx.exe94⤵PID:944
-
\??\c:\bbbbtb.exec:\bbbbtb.exe95⤵PID:4532
-
\??\c:\nhtttt.exec:\nhtttt.exe96⤵PID:4856
-
\??\c:\xrflrxf.exec:\xrflrxf.exe97⤵PID:3884
-
\??\c:\fxfffxr.exec:\fxfffxr.exe98⤵PID:3000
-
\??\c:\bhtnhb.exec:\bhtnhb.exe99⤵PID:4140
-
\??\c:\bnnbbt.exec:\bnnbbt.exe100⤵PID:1860
-
\??\c:\djjvp.exec:\djjvp.exe101⤵PID:1692
-
\??\c:\lffxlfx.exec:\lffxlfx.exe102⤵PID:4508
-
\??\c:\fxxxfxf.exec:\fxxxfxf.exe103⤵PID:2488
-
\??\c:\1flfrlf.exec:\1flfrlf.exe104⤵PID:4784
-
\??\c:\hbttnn.exec:\hbttnn.exe105⤵PID:1828
-
\??\c:\vdjdp.exec:\vdjdp.exe106⤵PID:3224
-
\??\c:\9ddvj.exec:\9ddvj.exe107⤵PID:4576
-
\??\c:\9xxfrxr.exec:\9xxfrxr.exe108⤵PID:3924
-
\??\c:\ffrlllf.exec:\ffrlllf.exe109⤵PID:4388
-
\??\c:\7ffxrlx.exec:\7ffxrlx.exe110⤵PID:3992
-
\??\c:\tbbbtb.exec:\tbbbtb.exe111⤵PID:1584
-
\??\c:\1nhbnh.exec:\1nhbnh.exe112⤵PID:1776
-
\??\c:\pddvj.exec:\pddvj.exe113⤵PID:5012
-
\??\c:\ddddv.exec:\ddddv.exe114⤵PID:1484
-
\??\c:\rfxxrxf.exec:\rfxxrxf.exe115⤵PID:756
-
\??\c:\lrrrllf.exec:\lrrrllf.exe116⤵PID:1660
-
\??\c:\5ttnnh.exec:\5ttnnh.exe117⤵PID:1368
-
\??\c:\nbbnnt.exec:\nbbnnt.exe118⤵PID:2360
-
\??\c:\vjjjd.exec:\vjjjd.exe119⤵PID:2268
-
\??\c:\7pjdp.exec:\7pjdp.exe120⤵PID:2968
-
\??\c:\lfxrffx.exec:\lfxrffx.exe121⤵PID:3660
-
\??\c:\xfxfxrx.exec:\xfxfxrx.exe122⤵PID:2724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-