Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 15:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0dd5cfd56bced358eff752d77482d0c0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
0dd5cfd56bced358eff752d77482d0c0_NeikiAnalytics.exe
-
Size
65KB
-
MD5
0dd5cfd56bced358eff752d77482d0c0
-
SHA1
a21e3078aa4ad70d54086a69f91a93905f4422c5
-
SHA256
aa7d71b70f6f3c4a2e3be99394724a3a4c3a7b16cb5ce54913a1aaabb1dbc37f
-
SHA512
5c84b689389182c1bb73095e1c47e96eb76d7e01a3f8a85f0c98edd6fb86bc874ada04e7c87e5674090e858b2467eafa056facce5d3cd3c3c8fd7a24f12ab518
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8+Luvdt:ymb3NkkiQ3mdBjF0yMlu
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/600-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1208-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2608-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4588-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2848-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3460-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3564-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2948-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1796-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1680-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3452-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1756-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4648-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3264-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2620-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2788-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2152-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4732-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/828-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2068-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3164-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/364-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1208 djpvv.exe 4948 lxfxrlx.exe 4588 bhnnhn.exe 4420 3vddd.exe 2608 dvddv.exe 408 5llllrx.exe 2848 3bbbtt.exe 3460 vjpvv.exe 3564 rfllfll.exe 2948 tntbtb.exe 1796 nnbbbb.exe 5012 ppvdv.exe 1680 rllfrrl.exe 3452 nhbthb.exe 1756 pvvvp.exe 4648 1lfxxrr.exe 3264 7bhbhh.exe 2828 jjpjd.exe 2620 rlfxrrr.exe 2288 ttbthh.exe 2648 vvjjv.exe 4448 jdddv.exe 2788 nhntbh.exe 2152 3dvdj.exe 4732 llxrxfl.exe 828 hbbhht.exe 3116 jpjdj.exe 2068 nthnbt.exe 3164 ppjdv.exe 364 fxfxrrf.exe 1636 bnhthb.exe 3528 jdjjd.exe 4104 pddvp.exe 2296 lfllrlf.exe 4060 tnnhbn.exe 3340 btbttt.exe 4848 7pjpd.exe 4788 lffxrrr.exe 4972 9rxxllx.exe 2128 tbbhbb.exe 224 jvpjd.exe 4364 jdvvp.exe 3964 lxxrllf.exe 1936 5hbttt.exe 1232 vjpjd.exe 2380 1ddjv.exe 2548 lxrlfxx.exe 884 hhnnbt.exe 2876 nnhhbb.exe 2480 jvvdd.exe 2840 5rxlrrx.exe 644 ttnhhn.exe 2748 bnnhhh.exe 5032 ddddv.exe 3972 rlrllrx.exe 4700 9llllrx.exe 4596 tnbtnh.exe 2984 ppjjd.exe 3020 9xrlxrr.exe 1548 flxxrrr.exe 840 thhbbb.exe 1560 jjdvp.exe 3112 ddddd.exe 3840 tbttnn.exe -
resource yara_rule behavioral2/memory/600-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1208-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2608-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4588-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2848-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3460-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3564-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2948-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1796-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1680-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3452-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1756-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4648-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3264-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2788-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2152-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/828-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2068-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3164-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/364-199-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 600 wrote to memory of 1208 600 0dd5cfd56bced358eff752d77482d0c0_NeikiAnalytics.exe 82 PID 600 wrote to memory of 1208 600 0dd5cfd56bced358eff752d77482d0c0_NeikiAnalytics.exe 82 PID 600 wrote to memory of 1208 600 0dd5cfd56bced358eff752d77482d0c0_NeikiAnalytics.exe 82 PID 1208 wrote to memory of 4948 1208 djpvv.exe 83 PID 1208 wrote to memory of 4948 1208 djpvv.exe 83 PID 1208 wrote to memory of 4948 1208 djpvv.exe 83 PID 4948 wrote to memory of 4588 4948 lxfxrlx.exe 84 PID 4948 wrote to memory of 4588 4948 lxfxrlx.exe 84 PID 4948 wrote to memory of 4588 4948 lxfxrlx.exe 84 PID 4588 wrote to memory of 4420 4588 bhnnhn.exe 85 PID 4588 wrote to memory of 4420 4588 bhnnhn.exe 85 PID 4588 wrote to memory of 4420 4588 bhnnhn.exe 85 PID 4420 wrote to memory of 2608 4420 3vddd.exe 86 PID 4420 wrote to memory of 2608 4420 3vddd.exe 86 PID 4420 wrote to memory of 2608 4420 3vddd.exe 86 PID 2608 wrote to memory of 408 2608 dvddv.exe 87 PID 2608 wrote to memory of 408 2608 dvddv.exe 87 PID 2608 wrote to memory of 408 2608 dvddv.exe 87 PID 408 wrote to memory of 2848 408 5llllrx.exe 88 PID 408 wrote to memory of 2848 408 5llllrx.exe 88 PID 408 wrote to memory of 2848 408 5llllrx.exe 88 PID 2848 wrote to memory of 3460 2848 3bbbtt.exe 89 PID 2848 wrote to memory of 3460 2848 3bbbtt.exe 89 PID 2848 wrote to memory of 3460 2848 3bbbtt.exe 89 PID 3460 wrote to memory of 3564 3460 vjpvv.exe 90 PID 3460 wrote to memory of 3564 3460 vjpvv.exe 90 PID 3460 wrote to memory of 3564 3460 vjpvv.exe 90 PID 3564 wrote to memory of 2948 3564 rfllfll.exe 91 PID 3564 wrote to memory of 2948 3564 rfllfll.exe 91 PID 3564 wrote to memory of 2948 3564 rfllfll.exe 91 PID 2948 wrote to memory of 1796 2948 tntbtb.exe 92 PID 2948 wrote to memory of 1796 2948 tntbtb.exe 92 PID 2948 wrote to memory of 1796 2948 tntbtb.exe 92 PID 1796 wrote to memory of 5012 1796 nnbbbb.exe 93 PID 1796 wrote to memory of 5012 1796 nnbbbb.exe 93 PID 1796 wrote to memory of 5012 1796 nnbbbb.exe 93 PID 5012 wrote to memory of 1680 5012 ppvdv.exe 94 PID 5012 wrote to memory of 1680 5012 ppvdv.exe 94 PID 5012 wrote to memory of 1680 5012 ppvdv.exe 94 PID 1680 wrote to memory of 3452 1680 rllfrrl.exe 95 PID 1680 wrote to memory of 3452 1680 rllfrrl.exe 95 PID 1680 wrote to memory of 3452 1680 rllfrrl.exe 95 PID 3452 wrote to memory of 1756 3452 nhbthb.exe 96 PID 3452 wrote to memory of 1756 3452 nhbthb.exe 96 PID 3452 wrote to memory of 1756 3452 nhbthb.exe 96 PID 1756 wrote to memory of 4648 1756 pvvvp.exe 97 PID 1756 wrote to memory of 4648 1756 pvvvp.exe 97 PID 1756 wrote to memory of 4648 1756 pvvvp.exe 97 PID 4648 wrote to memory of 3264 4648 1lfxxrr.exe 98 PID 4648 wrote to memory of 3264 4648 1lfxxrr.exe 98 PID 4648 wrote to memory of 3264 4648 1lfxxrr.exe 98 PID 3264 wrote to memory of 2828 3264 7bhbhh.exe 99 PID 3264 wrote to memory of 2828 3264 7bhbhh.exe 99 PID 3264 wrote to memory of 2828 3264 7bhbhh.exe 99 PID 2828 wrote to memory of 2620 2828 jjpjd.exe 100 PID 2828 wrote to memory of 2620 2828 jjpjd.exe 100 PID 2828 wrote to memory of 2620 2828 jjpjd.exe 100 PID 2620 wrote to memory of 2288 2620 rlfxrrr.exe 101 PID 2620 wrote to memory of 2288 2620 rlfxrrr.exe 101 PID 2620 wrote to memory of 2288 2620 rlfxrrr.exe 101 PID 2288 wrote to memory of 2648 2288 ttbthh.exe 102 PID 2288 wrote to memory of 2648 2288 ttbthh.exe 102 PID 2288 wrote to memory of 2648 2288 ttbthh.exe 102 PID 2648 wrote to memory of 4448 2648 vvjjv.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\0dd5cfd56bced358eff752d77482d0c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0dd5cfd56bced358eff752d77482d0c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:600 -
\??\c:\djpvv.exec:\djpvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\lxfxrlx.exec:\lxfxrlx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\bhnnhn.exec:\bhnnhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\3vddd.exec:\3vddd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\dvddv.exec:\dvddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\5llllrx.exec:\5llllrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\3bbbtt.exec:\3bbbtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\vjpvv.exec:\vjpvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\rfllfll.exec:\rfllfll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
\??\c:\tntbtb.exec:\tntbtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\nnbbbb.exec:\nnbbbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\ppvdv.exec:\ppvdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\rllfrrl.exec:\rllfrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\nhbthb.exec:\nhbthb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\pvvvp.exec:\pvvvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\1lfxxrr.exec:\1lfxxrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\7bhbhh.exec:\7bhbhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
\??\c:\jjpjd.exec:\jjpjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\rlfxrrr.exec:\rlfxrrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\ttbthh.exec:\ttbthh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\vvjjv.exec:\vvjjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\jdddv.exec:\jdddv.exe23⤵
- Executes dropped EXE
PID:4448 -
\??\c:\nhntbh.exec:\nhntbh.exe24⤵
- Executes dropped EXE
PID:2788 -
\??\c:\3dvdj.exec:\3dvdj.exe25⤵
- Executes dropped EXE
PID:2152 -
\??\c:\llxrxfl.exec:\llxrxfl.exe26⤵
- Executes dropped EXE
PID:4732 -
\??\c:\hbbhht.exec:\hbbhht.exe27⤵
- Executes dropped EXE
PID:828 -
\??\c:\jpjdj.exec:\jpjdj.exe28⤵
- Executes dropped EXE
PID:3116 -
\??\c:\nthnbt.exec:\nthnbt.exe29⤵
- Executes dropped EXE
PID:2068 -
\??\c:\ppjdv.exec:\ppjdv.exe30⤵
- Executes dropped EXE
PID:3164 -
\??\c:\fxfxrrf.exec:\fxfxrrf.exe31⤵
- Executes dropped EXE
PID:364 -
\??\c:\bnhthb.exec:\bnhthb.exe32⤵
- Executes dropped EXE
PID:1636 -
\??\c:\jdjjd.exec:\jdjjd.exe33⤵
- Executes dropped EXE
PID:3528 -
\??\c:\pddvp.exec:\pddvp.exe34⤵
- Executes dropped EXE
PID:4104 -
\??\c:\lfllrlf.exec:\lfllrlf.exe35⤵
- Executes dropped EXE
PID:2296 -
\??\c:\tnnhbn.exec:\tnnhbn.exe36⤵
- Executes dropped EXE
PID:4060 -
\??\c:\btbttt.exec:\btbttt.exe37⤵
- Executes dropped EXE
PID:3340 -
\??\c:\7pjpd.exec:\7pjpd.exe38⤵
- Executes dropped EXE
PID:4848 -
\??\c:\lffxrrr.exec:\lffxrrr.exe39⤵
- Executes dropped EXE
PID:4788 -
\??\c:\9rxxllx.exec:\9rxxllx.exe40⤵
- Executes dropped EXE
PID:4972 -
\??\c:\tbbhbb.exec:\tbbhbb.exe41⤵
- Executes dropped EXE
PID:2128 -
\??\c:\jvpjd.exec:\jvpjd.exe42⤵
- Executes dropped EXE
PID:224 -
\??\c:\jdvvp.exec:\jdvvp.exe43⤵
- Executes dropped EXE
PID:4364 -
\??\c:\lxxrllf.exec:\lxxrllf.exe44⤵
- Executes dropped EXE
PID:3964 -
\??\c:\5hbttt.exec:\5hbttt.exe45⤵
- Executes dropped EXE
PID:1936 -
\??\c:\vjpjd.exec:\vjpjd.exe46⤵
- Executes dropped EXE
PID:1232 -
\??\c:\1ddjv.exec:\1ddjv.exe47⤵
- Executes dropped EXE
PID:2380 -
\??\c:\lxrlfxx.exec:\lxrlfxx.exe48⤵
- Executes dropped EXE
PID:2548 -
\??\c:\hhnnbt.exec:\hhnnbt.exe49⤵
- Executes dropped EXE
PID:884 -
\??\c:\nnhhbb.exec:\nnhhbb.exe50⤵
- Executes dropped EXE
PID:2876 -
\??\c:\jvvdd.exec:\jvvdd.exe51⤵
- Executes dropped EXE
PID:2480 -
\??\c:\5rxlrrx.exec:\5rxlrrx.exe52⤵
- Executes dropped EXE
PID:2840 -
\??\c:\ttnhhn.exec:\ttnhhn.exe53⤵
- Executes dropped EXE
PID:644 -
\??\c:\bnnhhh.exec:\bnnhhh.exe54⤵
- Executes dropped EXE
PID:2748 -
\??\c:\ddddv.exec:\ddddv.exe55⤵
- Executes dropped EXE
PID:5032 -
\??\c:\rlrllrx.exec:\rlrllrx.exe56⤵
- Executes dropped EXE
PID:3972 -
\??\c:\9llllrx.exec:\9llllrx.exe57⤵
- Executes dropped EXE
PID:4700 -
\??\c:\tnbtnh.exec:\tnbtnh.exe58⤵
- Executes dropped EXE
PID:4596 -
\??\c:\ppjjd.exec:\ppjjd.exe59⤵
- Executes dropped EXE
PID:2984 -
\??\c:\9xrlxrr.exec:\9xrlxrr.exe60⤵
- Executes dropped EXE
PID:3020 -
\??\c:\flxxrrr.exec:\flxxrrr.exe61⤵
- Executes dropped EXE
PID:1548 -
\??\c:\thhbbb.exec:\thhbbb.exe62⤵
- Executes dropped EXE
PID:840 -
\??\c:\jjdvp.exec:\jjdvp.exe63⤵
- Executes dropped EXE
PID:1560 -
\??\c:\ddddd.exec:\ddddd.exe64⤵
- Executes dropped EXE
PID:3112 -
\??\c:\tbttnn.exec:\tbttnn.exe65⤵
- Executes dropped EXE
PID:3840 -
\??\c:\ntbttt.exec:\ntbttt.exe66⤵PID:4796
-
\??\c:\vpjdv.exec:\vpjdv.exe67⤵PID:3944
-
\??\c:\pppjd.exec:\pppjd.exe68⤵PID:1380
-
\??\c:\xllfffl.exec:\xllfffl.exe69⤵PID:696
-
\??\c:\hbbtnn.exec:\hbbtnn.exe70⤵PID:3516
-
\??\c:\dvdjj.exec:\dvdjj.exe71⤵PID:4748
-
\??\c:\pjjvp.exec:\pjjvp.exe72⤵PID:1148
-
\??\c:\nbhtnn.exec:\nbhtnn.exe73⤵PID:4048
-
\??\c:\9htnnh.exec:\9htnnh.exe74⤵PID:1500
-
\??\c:\9vdvv.exec:\9vdvv.exe75⤵PID:1820
-
\??\c:\jjjjp.exec:\jjjjp.exe76⤵PID:1880
-
\??\c:\xrrlflf.exec:\xrrlflf.exe77⤵PID:4728
-
\??\c:\tthhbb.exec:\tthhbb.exe78⤵PID:2564
-
\??\c:\htthtn.exec:\htthtn.exe79⤵PID:4896
-
\??\c:\jdjdv.exec:\jdjdv.exe80⤵PID:4880
-
\??\c:\9frlrrx.exec:\9frlrrx.exe81⤵PID:4248
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe82⤵PID:4292
-
\??\c:\bhbbbt.exec:\bhbbbt.exe83⤵PID:888
-
\??\c:\fxlfflr.exec:\fxlfflr.exe84⤵PID:2812
-
\??\c:\nnttbb.exec:\nnttbb.exe85⤵PID:4792
-
\??\c:\9jjdv.exec:\9jjdv.exe86⤵PID:4436
-
\??\c:\xlrlfff.exec:\xlrlfff.exe87⤵PID:3880
-
\??\c:\xrrlffx.exec:\xrrlffx.exe88⤵PID:3320
-
\??\c:\btttbb.exec:\btttbb.exe89⤵PID:1724
-
\??\c:\5vjjd.exec:\5vjjd.exe90⤵PID:224
-
\??\c:\7pjdv.exec:\7pjdv.exe91⤵PID:4364
-
\??\c:\xrxlfxf.exec:\xrxlfxf.exe92⤵PID:3448
-
\??\c:\bhbntb.exec:\bhbntb.exe93⤵PID:2612
-
\??\c:\bttthh.exec:\bttthh.exe94⤵PID:1232
-
\??\c:\jvjjv.exec:\jvjjv.exe95⤵PID:432
-
\??\c:\xxfxlrf.exec:\xxfxlrf.exe96⤵PID:5064
-
\??\c:\fxllrll.exec:\fxllrll.exe97⤵PID:884
-
\??\c:\hnbbth.exec:\hnbbth.exe98⤵PID:2396
-
\??\c:\hbtnhb.exec:\hbtnhb.exe99⤵PID:4280
-
\??\c:\jpvjd.exec:\jpvjd.exe100⤵PID:5108
-
\??\c:\xrfrfxf.exec:\xrfrfxf.exe101⤵PID:644
-
\??\c:\xfrlflf.exec:\xfrlflf.exe102⤵PID:2844
-
\??\c:\ppjdd.exec:\ppjdd.exe103⤵PID:3440
-
\??\c:\rfllflf.exec:\rfllflf.exe104⤵PID:2680
-
\??\c:\xxxxlxr.exec:\xxxxlxr.exe105⤵PID:3296
-
\??\c:\nbhhhn.exec:\nbhhhn.exe106⤵PID:4984
-
\??\c:\djjjp.exec:\djjjp.exe107⤵PID:1076
-
\??\c:\rxxrllf.exec:\rxxrllf.exe108⤵PID:2448
-
\??\c:\3llfrxl.exec:\3llfrxl.exe109⤵PID:4716
-
\??\c:\9bhbbh.exec:\9bhbbh.exe110⤵PID:4752
-
\??\c:\hbtnhn.exec:\hbtnhn.exe111⤵PID:5036
-
\??\c:\ppdjv.exec:\ppdjv.exe112⤵PID:1560
-
\??\c:\ddpvp.exec:\ddpvp.exe113⤵PID:3488
-
\??\c:\rrffxfx.exec:\rrffxfx.exe114⤵PID:5084
-
\??\c:\nhtntt.exec:\nhtntt.exe115⤵PID:4796
-
\??\c:\hbntnt.exec:\hbntnt.exe116⤵PID:1464
-
\??\c:\9tbntn.exec:\9tbntn.exe117⤵PID:1928
-
\??\c:\jjjjj.exec:\jjjjj.exe118⤵PID:1080
-
\??\c:\7xllflr.exec:\7xllflr.exe119⤵PID:5112
-
\??\c:\frxxxff.exec:\frxxxff.exe120⤵PID:4176
-
\??\c:\frfllfx.exec:\frfllfx.exe121⤵PID:2708
-
\??\c:\5hnhbn.exec:\5hnhbn.exe122⤵PID:828
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-