Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/06/2024, 22:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
05b0c83c51cc2b7a7ff53dffcac32f50_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
05b0c83c51cc2b7a7ff53dffcac32f50_NeikiAnalytics.exe
-
Size
366KB
-
MD5
05b0c83c51cc2b7a7ff53dffcac32f50
-
SHA1
579b0de65d7d9eb40fa802a4394107aedfd74bc2
-
SHA256
1bfaf5f11b399053a4dc442715ef4d110be93acf121af3089fd2b4477220f261
-
SHA512
a3e87d88b1b047dcd7d8db19553081ba69a84a25f89f7ca6d0da19c58b37e3179aa58b7788b02696b7c9828ab08b828e21dd87ca68e410fc106b81e6f3379065
-
SSDEEP
6144:n3C9BRo7tvnJ99T/KZEL3RUXownfWQkyCpxwJz9e0pQowLh3EhToK9cT085mnFha:n3C9ytvnVXFUXoSWlnwJv90aKToFqwfw
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/388-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/996-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3556-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4984-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1572-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4628-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1108-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4052-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4324-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2324-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2740-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/804-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1984-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-83-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2304-76-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2304-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4028-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4356-55-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4356-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2124-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/468-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 996 7dpjj.exe 3556 tbbttb.exe 468 dvppv.exe 4984 rllfxfx.exe 2124 lfrlxxr.exe 4356 nnnhbb.exe 4028 dvjjd.exe 4904 xxlllfx.exe 2304 ttnhhb.exe 4996 1ddvp.exe 1984 rfrfxxr.exe 804 xxxrlfl.exe 2740 hbnbbb.exe 4044 vpvvj.exe 2324 xxrfllr.exe 4324 3lllfxx.exe 1440 5thbtt.exe 3596 jdvpd.exe 4052 lxlffxr.exe 3312 lfflrll.exe 1108 hbnnnh.exe 2408 pjjdp.exe 4608 jpppp.exe 4628 bntttn.exe 5020 pvdvv.exe 2108 dvdvp.exe 4536 rxllfxl.exe 1572 tttnnn.exe 8 vvddj.exe 5108 vpvvp.exe 4220 frrllfx.exe 3984 nbnhhh.exe 2128 jdddd.exe 564 vpvvp.exe 4780 1xlffff.exe 4504 1rrrlfx.exe 224 bntnnn.exe 328 dvjdj.exe 4184 dvpjv.exe 1384 rllfffx.exe 3440 bthbhh.exe 3220 bnnhhh.exe 876 dvpvp.exe 4648 ffrxxrx.exe 3668 rfrrrxx.exe 3508 3hnttt.exe 3112 pdjjj.exe 440 7lrxrrl.exe 3796 lxfxrrr.exe 3788 bbbbbb.exe 3776 pjvpj.exe 2264 vdppp.exe 2028 xlfxxxr.exe 4756 5bnnnt.exe 4932 hhnnnn.exe 856 vdpjv.exe 2772 xfxlrll.exe 4852 xlxffff.exe 1468 tntnnh.exe 2324 5vjdv.exe 4976 jvvpj.exe 4576 xlllffr.exe 3596 hnnhhb.exe 1948 1jpvp.exe -
resource yara_rule behavioral2/memory/388-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/996-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/996-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/996-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3556-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4984-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/8-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1572-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4628-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1108-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4052-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4324-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2324-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2740-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/804-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1984-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2304-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4028-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2124-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/468-27-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 388 wrote to memory of 996 388 05b0c83c51cc2b7a7ff53dffcac32f50_NeikiAnalytics.exe 82 PID 388 wrote to memory of 996 388 05b0c83c51cc2b7a7ff53dffcac32f50_NeikiAnalytics.exe 82 PID 388 wrote to memory of 996 388 05b0c83c51cc2b7a7ff53dffcac32f50_NeikiAnalytics.exe 82 PID 996 wrote to memory of 3556 996 7dpjj.exe 83 PID 996 wrote to memory of 3556 996 7dpjj.exe 83 PID 996 wrote to memory of 3556 996 7dpjj.exe 83 PID 3556 wrote to memory of 468 3556 tbbttb.exe 84 PID 3556 wrote to memory of 468 3556 tbbttb.exe 84 PID 3556 wrote to memory of 468 3556 tbbttb.exe 84 PID 468 wrote to memory of 4984 468 dvppv.exe 85 PID 468 wrote to memory of 4984 468 dvppv.exe 85 PID 468 wrote to memory of 4984 468 dvppv.exe 85 PID 4984 wrote to memory of 2124 4984 rllfxfx.exe 86 PID 4984 wrote to memory of 2124 4984 rllfxfx.exe 86 PID 4984 wrote to memory of 2124 4984 rllfxfx.exe 86 PID 2124 wrote to memory of 4356 2124 lfrlxxr.exe 87 PID 2124 wrote to memory of 4356 2124 lfrlxxr.exe 87 PID 2124 wrote to memory of 4356 2124 lfrlxxr.exe 87 PID 4356 wrote to memory of 4028 4356 nnnhbb.exe 88 PID 4356 wrote to memory of 4028 4356 nnnhbb.exe 88 PID 4356 wrote to memory of 4028 4356 nnnhbb.exe 88 PID 4028 wrote to memory of 4904 4028 dvjjd.exe 89 PID 4028 wrote to memory of 4904 4028 dvjjd.exe 89 PID 4028 wrote to memory of 4904 4028 dvjjd.exe 89 PID 4904 wrote to memory of 2304 4904 xxlllfx.exe 90 PID 4904 wrote to memory of 2304 4904 xxlllfx.exe 90 PID 4904 wrote to memory of 2304 4904 xxlllfx.exe 90 PID 2304 wrote to memory of 4996 2304 ttnhhb.exe 91 PID 2304 wrote to memory of 4996 2304 ttnhhb.exe 91 PID 2304 wrote to memory of 4996 2304 ttnhhb.exe 91 PID 4996 wrote to memory of 1984 4996 1ddvp.exe 92 PID 4996 wrote to memory of 1984 4996 1ddvp.exe 92 PID 4996 wrote to memory of 1984 4996 1ddvp.exe 92 PID 1984 wrote to memory of 804 1984 rfrfxxr.exe 93 PID 1984 wrote to memory of 804 1984 rfrfxxr.exe 93 PID 1984 wrote to memory of 804 1984 rfrfxxr.exe 93 PID 804 wrote to memory of 2740 804 xxxrlfl.exe 94 PID 804 wrote to memory of 2740 804 xxxrlfl.exe 94 PID 804 wrote to memory of 2740 804 xxxrlfl.exe 94 PID 2740 wrote to memory of 4044 2740 hbnbbb.exe 95 PID 2740 wrote to memory of 4044 2740 hbnbbb.exe 95 PID 2740 wrote to memory of 4044 2740 hbnbbb.exe 95 PID 4044 wrote to memory of 2324 4044 vpvvj.exe 96 PID 4044 wrote to memory of 2324 4044 vpvvj.exe 96 PID 4044 wrote to memory of 2324 4044 vpvvj.exe 96 PID 2324 wrote to memory of 4324 2324 xxrfllr.exe 97 PID 2324 wrote to memory of 4324 2324 xxrfllr.exe 97 PID 2324 wrote to memory of 4324 2324 xxrfllr.exe 97 PID 4324 wrote to memory of 1440 4324 3lllfxx.exe 98 PID 4324 wrote to memory of 1440 4324 3lllfxx.exe 98 PID 4324 wrote to memory of 1440 4324 3lllfxx.exe 98 PID 1440 wrote to memory of 3596 1440 5thbtt.exe 99 PID 1440 wrote to memory of 3596 1440 5thbtt.exe 99 PID 1440 wrote to memory of 3596 1440 5thbtt.exe 99 PID 3596 wrote to memory of 4052 3596 jdvpd.exe 100 PID 3596 wrote to memory of 4052 3596 jdvpd.exe 100 PID 3596 wrote to memory of 4052 3596 jdvpd.exe 100 PID 4052 wrote to memory of 3312 4052 lxlffxr.exe 101 PID 4052 wrote to memory of 3312 4052 lxlffxr.exe 101 PID 4052 wrote to memory of 3312 4052 lxlffxr.exe 101 PID 3312 wrote to memory of 1108 3312 lfflrll.exe 102 PID 3312 wrote to memory of 1108 3312 lfflrll.exe 102 PID 3312 wrote to memory of 1108 3312 lfflrll.exe 102 PID 1108 wrote to memory of 2408 1108 hbnnnh.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\05b0c83c51cc2b7a7ff53dffcac32f50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\05b0c83c51cc2b7a7ff53dffcac32f50_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\7dpjj.exec:\7dpjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\tbbttb.exec:\tbbttb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\dvppv.exec:\dvppv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\rllfxfx.exec:\rllfxfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\lfrlxxr.exec:\lfrlxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\nnnhbb.exec:\nnnhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\dvjjd.exec:\dvjjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\xxlllfx.exec:\xxlllfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\ttnhhb.exec:\ttnhhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\1ddvp.exec:\1ddvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\rfrfxxr.exec:\rfrfxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\xxxrlfl.exec:\xxxrlfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
\??\c:\hbnbbb.exec:\hbnbbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\vpvvj.exec:\vpvvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\xxrfllr.exec:\xxrfllr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\3lllfxx.exec:\3lllfxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\5thbtt.exec:\5thbtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\jdvpd.exec:\jdvpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\lxlffxr.exec:\lxlffxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\lfflrll.exec:\lfflrll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
\??\c:\hbnnnh.exec:\hbnnnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\pjjdp.exec:\pjjdp.exe23⤵
- Executes dropped EXE
PID:2408 -
\??\c:\jpppp.exec:\jpppp.exe24⤵
- Executes dropped EXE
PID:4608 -
\??\c:\bntttn.exec:\bntttn.exe25⤵
- Executes dropped EXE
PID:4628 -
\??\c:\pvdvv.exec:\pvdvv.exe26⤵
- Executes dropped EXE
PID:5020 -
\??\c:\dvdvp.exec:\dvdvp.exe27⤵
- Executes dropped EXE
PID:2108 -
\??\c:\rxllfxl.exec:\rxllfxl.exe28⤵
- Executes dropped EXE
PID:4536 -
\??\c:\tttnnn.exec:\tttnnn.exe29⤵
- Executes dropped EXE
PID:1572 -
\??\c:\vvddj.exec:\vvddj.exe30⤵
- Executes dropped EXE
PID:8 -
\??\c:\vpvvp.exec:\vpvvp.exe31⤵
- Executes dropped EXE
PID:5108 -
\??\c:\frrllfx.exec:\frrllfx.exe32⤵
- Executes dropped EXE
PID:4220 -
\??\c:\nbnhhh.exec:\nbnhhh.exe33⤵
- Executes dropped EXE
PID:3984 -
\??\c:\jdddd.exec:\jdddd.exe34⤵
- Executes dropped EXE
PID:2128 -
\??\c:\vpvvp.exec:\vpvvp.exe35⤵
- Executes dropped EXE
PID:564 -
\??\c:\1xlffff.exec:\1xlffff.exe36⤵
- Executes dropped EXE
PID:4780 -
\??\c:\1rrrlfx.exec:\1rrrlfx.exe37⤵
- Executes dropped EXE
PID:4504 -
\??\c:\bntnnn.exec:\bntnnn.exe38⤵
- Executes dropped EXE
PID:224 -
\??\c:\dvjdj.exec:\dvjdj.exe39⤵
- Executes dropped EXE
PID:328 -
\??\c:\dvpjv.exec:\dvpjv.exe40⤵
- Executes dropped EXE
PID:4184 -
\??\c:\rllfffx.exec:\rllfffx.exe41⤵
- Executes dropped EXE
PID:1384 -
\??\c:\bthbhh.exec:\bthbhh.exe42⤵
- Executes dropped EXE
PID:3440 -
\??\c:\bnnhhh.exec:\bnnhhh.exe43⤵
- Executes dropped EXE
PID:3220 -
\??\c:\dvpvp.exec:\dvpvp.exe44⤵
- Executes dropped EXE
PID:876 -
\??\c:\ffrxxrx.exec:\ffrxxrx.exe45⤵
- Executes dropped EXE
PID:4648 -
\??\c:\rfrrrxx.exec:\rfrrrxx.exe46⤵
- Executes dropped EXE
PID:3668 -
\??\c:\3hnttt.exec:\3hnttt.exe47⤵
- Executes dropped EXE
PID:3508 -
\??\c:\pdjjj.exec:\pdjjj.exe48⤵
- Executes dropped EXE
PID:3112 -
\??\c:\7lrxrrl.exec:\7lrxrrl.exe49⤵
- Executes dropped EXE
PID:440 -
\??\c:\lxfxrrr.exec:\lxfxrrr.exe50⤵
- Executes dropped EXE
PID:3796 -
\??\c:\bbbbbb.exec:\bbbbbb.exe51⤵
- Executes dropped EXE
PID:3788 -
\??\c:\pjvpj.exec:\pjvpj.exe52⤵
- Executes dropped EXE
PID:3776 -
\??\c:\vdppp.exec:\vdppp.exe53⤵
- Executes dropped EXE
PID:2264 -
\??\c:\xlfxxxr.exec:\xlfxxxr.exe54⤵
- Executes dropped EXE
PID:2028 -
\??\c:\5bnnnt.exec:\5bnnnt.exe55⤵
- Executes dropped EXE
PID:4756 -
\??\c:\hhnnnn.exec:\hhnnnn.exe56⤵
- Executes dropped EXE
PID:4932 -
\??\c:\vdpjv.exec:\vdpjv.exe57⤵
- Executes dropped EXE
PID:856 -
\??\c:\xfxlrll.exec:\xfxlrll.exe58⤵
- Executes dropped EXE
PID:2772 -
\??\c:\xlxffff.exec:\xlxffff.exe59⤵
- Executes dropped EXE
PID:4852 -
\??\c:\tntnnh.exec:\tntnnh.exe60⤵
- Executes dropped EXE
PID:1468 -
\??\c:\5vjdv.exec:\5vjdv.exe61⤵
- Executes dropped EXE
PID:2324 -
\??\c:\jvvpj.exec:\jvvpj.exe62⤵
- Executes dropped EXE
PID:4976 -
\??\c:\xlllffr.exec:\xlllffr.exe63⤵
- Executes dropped EXE
PID:4576 -
\??\c:\hnnhhb.exec:\hnnhhb.exe64⤵
- Executes dropped EXE
PID:3596 -
\??\c:\1jpvp.exec:\1jpvp.exe65⤵
- Executes dropped EXE
PID:1948 -
\??\c:\nbttbh.exec:\nbttbh.exe66⤵PID:1932
-
\??\c:\jvdpd.exec:\jvdpd.exe67⤵PID:1380
-
\??\c:\llfrllf.exec:\llfrllf.exe68⤵PID:3200
-
\??\c:\nbbnnt.exec:\nbbnnt.exe69⤵PID:5012
-
\??\c:\pvjpv.exec:\pvjpv.exe70⤵PID:3916
-
\??\c:\rflrlrr.exec:\rflrlrr.exe71⤵PID:4500
-
\??\c:\bbtnnh.exec:\bbtnnh.exe72⤵PID:2624
-
\??\c:\dvdvv.exec:\dvdvv.exe73⤵PID:4732
-
\??\c:\xrrfxff.exec:\xrrfxff.exe74⤵PID:4624
-
\??\c:\bttnnb.exec:\bttnnb.exe75⤵PID:4160
-
\??\c:\dvvvv.exec:\dvvvv.exe76⤵PID:1356
-
\??\c:\rlxflfl.exec:\rlxflfl.exe77⤵PID:680
-
\??\c:\tbbntt.exec:\tbbntt.exe78⤵PID:2688
-
\??\c:\3tbbnn.exec:\3tbbnn.exe79⤵PID:4296
-
\??\c:\frrrrrr.exec:\frrrrrr.exe80⤵PID:376
-
\??\c:\btnnbb.exec:\btnnbb.exe81⤵PID:1732
-
\??\c:\jdpdp.exec:\jdpdp.exe82⤵PID:4712
-
\??\c:\lfrllff.exec:\lfrllff.exe83⤵PID:4492
-
\??\c:\1bhnnh.exec:\1bhnnh.exe84⤵PID:2932
-
\??\c:\dpvpj.exec:\dpvpj.exe85⤵PID:4948
-
\??\c:\pdjjj.exec:\pdjjj.exe86⤵PID:5000
-
\??\c:\rlffffl.exec:\rlffffl.exe87⤵PID:4348
-
\??\c:\7hhbtt.exec:\7hhbtt.exe88⤵PID:3376
-
\??\c:\ppvvj.exec:\ppvvj.exe89⤵PID:4788
-
\??\c:\frfflrr.exec:\frfflrr.exe90⤵PID:4952
-
\??\c:\nhhbbt.exec:\nhhbbt.exe91⤵PID:3112
-
\??\c:\vdjdd.exec:\vdjdd.exe92⤵PID:440
-
\??\c:\rxxfrxx.exec:\rxxfrxx.exe93⤵PID:3788
-
\??\c:\hbbthb.exec:\hbbthb.exe94⤵PID:3776
-
\??\c:\pvpjp.exec:\pvpjp.exe95⤵PID:4904
-
\??\c:\ffrfffx.exec:\ffrfffx.exe96⤵PID:4036
-
\??\c:\vjjdd.exec:\vjjdd.exe97⤵PID:4996
-
\??\c:\fxrllrl.exec:\fxrllrl.exe98⤵PID:4592
-
\??\c:\hntttb.exec:\hntttb.exe99⤵PID:3004
-
\??\c:\vvvpp.exec:\vvvpp.exe100⤵PID:4496
-
\??\c:\fxlffff.exec:\fxlffff.exe101⤵PID:2304
-
\??\c:\rflrllf.exec:\rflrllf.exe102⤵PID:2476
-
\??\c:\nhhbbt.exec:\nhhbbt.exe103⤵PID:2656
-
\??\c:\jjjjd.exec:\jjjjd.exe104⤵PID:2740
-
\??\c:\pppvv.exec:\pppvv.exe105⤵PID:2324
-
\??\c:\rlfxrlx.exec:\rlfxrlx.exe106⤵PID:908
-
\??\c:\ttttnt.exec:\ttttnt.exe107⤵PID:4228
-
\??\c:\vvpjv.exec:\vvpjv.exe108⤵PID:2640
-
\??\c:\dvdvp.exec:\dvdvp.exe109⤵PID:4176
-
\??\c:\3xlrlrr.exec:\3xlrlrr.exe110⤵PID:3356
-
\??\c:\5xxrrrr.exec:\5xxrrrr.exe111⤵PID:1108
-
\??\c:\nhnhbb.exec:\nhnhbb.exe112⤵PID:2836
-
\??\c:\1ddvp.exec:\1ddvp.exe113⤵PID:644
-
\??\c:\dvjdv.exec:\dvjdv.exe114⤵PID:3340
-
\??\c:\xxlllrx.exec:\xxlllrx.exe115⤵PID:1764
-
\??\c:\httnbb.exec:\httnbb.exe116⤵PID:5012
-
\??\c:\jdpjd.exec:\jdpjd.exe117⤵PID:1220
-
\??\c:\jpddd.exec:\jpddd.exe118⤵PID:2536
-
\??\c:\xrrrlff.exec:\xrrrlff.exe119⤵PID:2824
-
\??\c:\tnnttn.exec:\tnnttn.exe120⤵PID:3380
-
\??\c:\vjvpp.exec:\vjvpp.exe121⤵PID:5056
-
\??\c:\ddjjd.exec:\ddjjd.exe122⤵PID:4564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-