Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-06-2024 04:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8cf49fb36ba7877d2a6507fb8d7087c0_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
8cf49fb36ba7877d2a6507fb8d7087c0_NeikiAnalytics.exe
-
Size
105KB
-
MD5
8cf49fb36ba7877d2a6507fb8d7087c0
-
SHA1
a9c7e49481ed62eac53a0db7175c91ab796a51b8
-
SHA256
b8772df95e941b06040c9fb9ab27e41c1032b0a1b0d2c78909e4c419a1d5eccf
-
SHA512
99c8fe53121bcd2c36b10b961a83c61e44373c1c905ad3c730ce1b1a9ef263ee7d82d3e97a373e9ea035b192a7e68aab07a426a1c9b237f2969d6b343ce8c006
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoTNKDeS98hPUdHV7RNzfJNI:ymb3NkkiQ3mdBjFo5KDe88g1fDI
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/4892-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3592-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1752-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1652-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1380-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2968-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3928-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2968-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2904-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3112-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2460-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2408-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2500-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2432-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2692-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3068-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4920-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2856-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1456-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/536-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4132-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2568-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2272-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3592 bhhbnb.exe 1752 djvvv.exe 1652 9btnbb.exe 1380 vvpdv.exe 3928 llfxxrr.exe 2968 nbhhbb.exe 2904 pvjdv.exe 5020 hbnnbt.exe 3112 vdppj.exe 2460 lrxfflf.exe 4756 tntbbn.exe 2408 1xlfxrl.exe 2500 fxxxxfl.exe 2432 ddpdv.exe 2692 fxfxxrr.exe 3068 bbbtth.exe 4920 jjpjp.exe 4324 vvpjj.exe 2856 3xxfrlx.exe 5116 nhnhhb.exe 1456 5vvvv.exe 4928 xfrlflx.exe 1764 3rrrrrl.exe 536 bnbbtb.exe 4132 frrxrxr.exe 696 hnthbn.exe 2016 hhbbbh.exe 2844 pjpvv.exe 3908 1xflxlx.exe 2568 btttnh.exe 2272 pvddj.exe 404 fllllxx.exe 3792 bttthh.exe 3020 vpjjp.exe 5028 pjvvp.exe 4464 xxffxff.exe 4300 btthhn.exe 4336 dddjd.exe 5024 llxxfff.exe 3108 xxlrrrx.exe 4284 ttbbhh.exe 5012 9hhbtt.exe 4852 jjpjd.exe 2008 llrfxrx.exe 3628 7nnbbn.exe 2252 tbtnnn.exe 916 xxfllxx.exe 2076 lfffxrl.exe 3672 ntnhbt.exe 3780 pdppd.exe 3192 lrrxxfx.exe 4092 bnnbbh.exe 868 nnttbt.exe 4380 dpdvp.exe 3012 lfxxxrr.exe 2432 hhtnbb.exe 512 tthbnt.exe 4948 djdvv.exe 2316 rrffxxx.exe 2676 bttbnt.exe 3056 dvpvp.exe 1468 xxrfrlf.exe 2704 7xxfrlf.exe 3748 hbnhbn.exe -
resource yara_rule behavioral2/memory/4892-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3592-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3592-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1380-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1380-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1652-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1380-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3928-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2904-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2904-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2904-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3112-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2460-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2460-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2460-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2408-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2500-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2432-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2692-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3068-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4920-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2856-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1456-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/536-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4132-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2568-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2272-213-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4892 wrote to memory of 3592 4892 8cf49fb36ba7877d2a6507fb8d7087c0_NeikiAnalytics.exe 83 PID 4892 wrote to memory of 3592 4892 8cf49fb36ba7877d2a6507fb8d7087c0_NeikiAnalytics.exe 83 PID 4892 wrote to memory of 3592 4892 8cf49fb36ba7877d2a6507fb8d7087c0_NeikiAnalytics.exe 83 PID 3592 wrote to memory of 1752 3592 bhhbnb.exe 84 PID 3592 wrote to memory of 1752 3592 bhhbnb.exe 84 PID 3592 wrote to memory of 1752 3592 bhhbnb.exe 84 PID 1752 wrote to memory of 1652 1752 djvvv.exe 85 PID 1752 wrote to memory of 1652 1752 djvvv.exe 85 PID 1752 wrote to memory of 1652 1752 djvvv.exe 85 PID 1652 wrote to memory of 1380 1652 9btnbb.exe 86 PID 1652 wrote to memory of 1380 1652 9btnbb.exe 86 PID 1652 wrote to memory of 1380 1652 9btnbb.exe 86 PID 1380 wrote to memory of 3928 1380 vvpdv.exe 87 PID 1380 wrote to memory of 3928 1380 vvpdv.exe 87 PID 1380 wrote to memory of 3928 1380 vvpdv.exe 87 PID 3928 wrote to memory of 2968 3928 llfxxrr.exe 88 PID 3928 wrote to memory of 2968 3928 llfxxrr.exe 88 PID 3928 wrote to memory of 2968 3928 llfxxrr.exe 88 PID 2968 wrote to memory of 2904 2968 nbhhbb.exe 89 PID 2968 wrote to memory of 2904 2968 nbhhbb.exe 89 PID 2968 wrote to memory of 2904 2968 nbhhbb.exe 89 PID 2904 wrote to memory of 5020 2904 pvjdv.exe 90 PID 2904 wrote to memory of 5020 2904 pvjdv.exe 90 PID 2904 wrote to memory of 5020 2904 pvjdv.exe 90 PID 5020 wrote to memory of 3112 5020 hbnnbt.exe 91 PID 5020 wrote to memory of 3112 5020 hbnnbt.exe 91 PID 5020 wrote to memory of 3112 5020 hbnnbt.exe 91 PID 3112 wrote to memory of 2460 3112 vdppj.exe 92 PID 3112 wrote to memory of 2460 3112 vdppj.exe 92 PID 3112 wrote to memory of 2460 3112 vdppj.exe 92 PID 2460 wrote to memory of 4756 2460 lrxfflf.exe 93 PID 2460 wrote to memory of 4756 2460 lrxfflf.exe 93 PID 2460 wrote to memory of 4756 2460 lrxfflf.exe 93 PID 4756 wrote to memory of 2408 4756 tntbbn.exe 94 PID 4756 wrote to memory of 2408 4756 tntbbn.exe 94 PID 4756 wrote to memory of 2408 4756 tntbbn.exe 94 PID 2408 wrote to memory of 2500 2408 1xlfxrl.exe 95 PID 2408 wrote to memory of 2500 2408 1xlfxrl.exe 95 PID 2408 wrote to memory of 2500 2408 1xlfxrl.exe 95 PID 2500 wrote to memory of 2432 2500 fxxxxfl.exe 96 PID 2500 wrote to memory of 2432 2500 fxxxxfl.exe 96 PID 2500 wrote to memory of 2432 2500 fxxxxfl.exe 96 PID 2432 wrote to memory of 2692 2432 ddpdv.exe 97 PID 2432 wrote to memory of 2692 2432 ddpdv.exe 97 PID 2432 wrote to memory of 2692 2432 ddpdv.exe 97 PID 2692 wrote to memory of 3068 2692 fxfxxrr.exe 98 PID 2692 wrote to memory of 3068 2692 fxfxxrr.exe 98 PID 2692 wrote to memory of 3068 2692 fxfxxrr.exe 98 PID 3068 wrote to memory of 4920 3068 bbbtth.exe 99 PID 3068 wrote to memory of 4920 3068 bbbtth.exe 99 PID 3068 wrote to memory of 4920 3068 bbbtth.exe 99 PID 4920 wrote to memory of 4324 4920 jjpjp.exe 100 PID 4920 wrote to memory of 4324 4920 jjpjp.exe 100 PID 4920 wrote to memory of 4324 4920 jjpjp.exe 100 PID 4324 wrote to memory of 2856 4324 vvpjj.exe 101 PID 4324 wrote to memory of 2856 4324 vvpjj.exe 101 PID 4324 wrote to memory of 2856 4324 vvpjj.exe 101 PID 2856 wrote to memory of 5116 2856 3xxfrlx.exe 102 PID 2856 wrote to memory of 5116 2856 3xxfrlx.exe 102 PID 2856 wrote to memory of 5116 2856 3xxfrlx.exe 102 PID 5116 wrote to memory of 1456 5116 nhnhhb.exe 103 PID 5116 wrote to memory of 1456 5116 nhnhhb.exe 103 PID 5116 wrote to memory of 1456 5116 nhnhhb.exe 103 PID 1456 wrote to memory of 4928 1456 5vvvv.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cf49fb36ba7877d2a6507fb8d7087c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8cf49fb36ba7877d2a6507fb8d7087c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\bhhbnb.exec:\bhhbnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\djvvv.exec:\djvvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\9btnbb.exec:\9btnbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\vvpdv.exec:\vvpdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\llfxxrr.exec:\llfxxrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
\??\c:\nbhhbb.exec:\nbhhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\pvjdv.exec:\pvjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\hbnnbt.exec:\hbnnbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\vdppj.exec:\vdppj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\lrxfflf.exec:\lrxfflf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\tntbbn.exec:\tntbbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\1xlfxrl.exec:\1xlfxrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\fxxxxfl.exec:\fxxxxfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\ddpdv.exec:\ddpdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\fxfxxrr.exec:\fxfxxrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\bbbtth.exec:\bbbtth.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\jjpjp.exec:\jjpjp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\vvpjj.exec:\vvpjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\3xxfrlx.exec:\3xxfrlx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\nhnhhb.exec:\nhnhhb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\5vvvv.exec:\5vvvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\xfrlflx.exec:\xfrlflx.exe23⤵
- Executes dropped EXE
PID:4928 -
\??\c:\3rrrrrl.exec:\3rrrrrl.exe24⤵
- Executes dropped EXE
PID:1764 -
\??\c:\bnbbtb.exec:\bnbbtb.exe25⤵
- Executes dropped EXE
PID:536 -
\??\c:\frrxrxr.exec:\frrxrxr.exe26⤵
- Executes dropped EXE
PID:4132 -
\??\c:\hnthbn.exec:\hnthbn.exe27⤵
- Executes dropped EXE
PID:696 -
\??\c:\hhbbbh.exec:\hhbbbh.exe28⤵
- Executes dropped EXE
PID:2016 -
\??\c:\pjpvv.exec:\pjpvv.exe29⤵
- Executes dropped EXE
PID:2844 -
\??\c:\1xflxlx.exec:\1xflxlx.exe30⤵
- Executes dropped EXE
PID:3908 -
\??\c:\btttnh.exec:\btttnh.exe31⤵
- Executes dropped EXE
PID:2568 -
\??\c:\pvddj.exec:\pvddj.exe32⤵
- Executes dropped EXE
PID:2272 -
\??\c:\fllllxx.exec:\fllllxx.exe33⤵
- Executes dropped EXE
PID:404 -
\??\c:\bttthh.exec:\bttthh.exe34⤵
- Executes dropped EXE
PID:3792 -
\??\c:\vpjjp.exec:\vpjjp.exe35⤵
- Executes dropped EXE
PID:3020 -
\??\c:\pjvvp.exec:\pjvvp.exe36⤵
- Executes dropped EXE
PID:5028 -
\??\c:\xxffxff.exec:\xxffxff.exe37⤵
- Executes dropped EXE
PID:4464 -
\??\c:\btthhn.exec:\btthhn.exe38⤵
- Executes dropped EXE
PID:4300 -
\??\c:\dddjd.exec:\dddjd.exe39⤵
- Executes dropped EXE
PID:4336 -
\??\c:\llxxfff.exec:\llxxfff.exe40⤵
- Executes dropped EXE
PID:5024 -
\??\c:\xxlrrrx.exec:\xxlrrrx.exe41⤵
- Executes dropped EXE
PID:3108 -
\??\c:\ttbbhh.exec:\ttbbhh.exe42⤵
- Executes dropped EXE
PID:4284 -
\??\c:\9hhbtt.exec:\9hhbtt.exe43⤵
- Executes dropped EXE
PID:5012 -
\??\c:\jjpjd.exec:\jjpjd.exe44⤵
- Executes dropped EXE
PID:4852 -
\??\c:\llrfxrx.exec:\llrfxrx.exe45⤵
- Executes dropped EXE
PID:2008 -
\??\c:\7nnbbn.exec:\7nnbbn.exe46⤵
- Executes dropped EXE
PID:3628 -
\??\c:\tbtnnn.exec:\tbtnnn.exe47⤵
- Executes dropped EXE
PID:2252 -
\??\c:\xxfllxx.exec:\xxfllxx.exe48⤵
- Executes dropped EXE
PID:916 -
\??\c:\lfffxrl.exec:\lfffxrl.exe49⤵
- Executes dropped EXE
PID:2076 -
\??\c:\ntnhbt.exec:\ntnhbt.exe50⤵
- Executes dropped EXE
PID:3672 -
\??\c:\pdppd.exec:\pdppd.exe51⤵
- Executes dropped EXE
PID:3780 -
\??\c:\lrrxxfx.exec:\lrrxxfx.exe52⤵
- Executes dropped EXE
PID:3192 -
\??\c:\bnnbbh.exec:\bnnbbh.exe53⤵
- Executes dropped EXE
PID:4092 -
\??\c:\nnttbt.exec:\nnttbt.exe54⤵
- Executes dropped EXE
PID:868 -
\??\c:\dpdvp.exec:\dpdvp.exe55⤵
- Executes dropped EXE
PID:4380 -
\??\c:\lfxxxrr.exec:\lfxxxrr.exe56⤵
- Executes dropped EXE
PID:3012 -
\??\c:\hhtnbb.exec:\hhtnbb.exe57⤵
- Executes dropped EXE
PID:2432 -
\??\c:\tthbnt.exec:\tthbnt.exe58⤵
- Executes dropped EXE
PID:512 -
\??\c:\djdvv.exec:\djdvv.exe59⤵
- Executes dropped EXE
PID:4948 -
\??\c:\rrffxxx.exec:\rrffxxx.exe60⤵
- Executes dropped EXE
PID:2316 -
\??\c:\bttbnt.exec:\bttbnt.exe61⤵
- Executes dropped EXE
PID:2676 -
\??\c:\dvpvp.exec:\dvpvp.exe62⤵
- Executes dropped EXE
PID:3056 -
\??\c:\xxrfrlf.exec:\xxrfrlf.exe63⤵
- Executes dropped EXE
PID:1468 -
\??\c:\7xxfrlf.exec:\7xxfrlf.exe64⤵
- Executes dropped EXE
PID:2704 -
\??\c:\hbnhbn.exec:\hbnhbn.exe65⤵
- Executes dropped EXE
PID:3748 -
\??\c:\dvdvv.exec:\dvdvv.exe66⤵PID:1604
-
\??\c:\xrlxrrl.exec:\xrlxrrl.exe67⤵PID:1792
-
\??\c:\fxrflrx.exec:\fxrflrx.exe68⤵PID:1232
-
\??\c:\dpvdv.exec:\dpvdv.exe69⤵PID:4468
-
\??\c:\ppddv.exec:\ppddv.exe70⤵PID:2100
-
\??\c:\9xrlxxx.exec:\9xrlxxx.exe71⤵PID:1872
-
\??\c:\bbthhh.exec:\bbthhh.exe72⤵PID:5068
-
\??\c:\7bnhhn.exec:\7bnhhn.exe73⤵PID:1600
-
\??\c:\pppdp.exec:\pppdp.exe74⤵PID:1820
-
\??\c:\djjdd.exec:\djjdd.exe75⤵PID:4536
-
\??\c:\nhhtnn.exec:\nhhtnn.exe76⤵PID:2012
-
\??\c:\nnbttb.exec:\nnbttb.exe77⤵PID:1096
-
\??\c:\jdddd.exec:\jdddd.exe78⤵PID:4912
-
\??\c:\7lfrllx.exec:\7lfrllx.exe79⤵PID:3364
-
\??\c:\tnnbth.exec:\tnnbth.exe80⤵PID:4956
-
\??\c:\pjvpv.exec:\pjvpv.exe81⤵PID:4292
-
\??\c:\vvjjj.exec:\vvjjj.exe82⤵PID:3992
-
\??\c:\fxfxfrl.exec:\fxfxfrl.exe83⤵PID:1704
-
\??\c:\hthtbt.exec:\hthtbt.exe84⤵PID:1688
-
\??\c:\vdpdd.exec:\vdpdd.exe85⤵PID:216
-
\??\c:\vvjpd.exec:\vvjpd.exe86⤵PID:3152
-
\??\c:\9rfxxfx.exec:\9rfxxfx.exe87⤵PID:4804
-
\??\c:\rlxrxxx.exec:\rlxrxxx.exe88⤵PID:3752
-
\??\c:\bbtthb.exec:\bbtthb.exe89⤵PID:3304
-
\??\c:\hhnhbb.exec:\hhnhbb.exe90⤵PID:3776
-
\??\c:\vdjdj.exec:\vdjdj.exe91⤵PID:4344
-
\??\c:\xrxxflr.exec:\xrxxflr.exe92⤵PID:3652
-
\??\c:\bbbttn.exec:\bbbttn.exe93⤵PID:1584
-
\??\c:\ttbbhn.exec:\ttbbhn.exe94⤵PID:1660
-
\??\c:\3djjp.exec:\3djjp.exe95⤵PID:4944
-
\??\c:\vdvdj.exec:\vdvdj.exe96⤵PID:3932
-
\??\c:\3xxfxfl.exec:\3xxfxfl.exe97⤵PID:4548
-
\??\c:\fxrxxxf.exec:\fxrxxxf.exe98⤵PID:1852
-
\??\c:\5thhtb.exec:\5thhtb.exe99⤵PID:532
-
\??\c:\bbtbhh.exec:\bbtbhh.exe100⤵PID:3204
-
\??\c:\pjpvd.exec:\pjpvd.exe101⤵PID:3032
-
\??\c:\tnbbtb.exec:\tnbbtb.exe102⤵PID:4768
-
\??\c:\dvppd.exec:\dvppd.exe103⤵PID:2432
-
\??\c:\jjvdd.exec:\jjvdd.exe104⤵PID:3340
-
\??\c:\rfxrlfx.exec:\rfxrlfx.exe105⤵PID:4948
-
\??\c:\bhhbnh.exec:\bhhbnh.exe106⤵PID:3860
-
\??\c:\bnbbbb.exec:\bnbbbb.exe107⤵PID:3056
-
\??\c:\ppdjp.exec:\ppdjp.exe108⤵PID:2260
-
\??\c:\lrxrlxx.exec:\lrxrlxx.exe109⤵PID:4388
-
\??\c:\xlxllfl.exec:\xlxllfl.exe110⤵PID:5080
-
\??\c:\nnhnnt.exec:\nnhnnt.exe111⤵PID:1232
-
\??\c:\thbhhh.exec:\thbhhh.exe112⤵PID:3276
-
\??\c:\vvvpp.exec:\vvvpp.exe113⤵PID:2324
-
\??\c:\ddpvd.exec:\ddpvd.exe114⤵PID:3640
-
\??\c:\llllfxx.exec:\llllfxx.exe115⤵PID:872
-
\??\c:\llrxrxl.exec:\llrxrxl.exe116⤵PID:1376
-
\??\c:\tntnnn.exec:\tntnnn.exe117⤵PID:3696
-
\??\c:\nhhhhn.exec:\nhhhhn.exe118⤵PID:3768
-
\??\c:\dvjjp.exec:\dvjjp.exe119⤵PID:4128
-
\??\c:\jvjpp.exec:\jvjpp.exe120⤵PID:3740
-
\??\c:\lfrrlrf.exec:\lfrrlrf.exe121⤵PID:812
-
\??\c:\hhbbnt.exec:\hhbbnt.exe122⤵PID:4732
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-