Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
04/06/2024, 22:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0ba969ec7a2b428b3bc4ad47e3709700_NeikiAnalytics.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
0ba969ec7a2b428b3bc4ad47e3709700_NeikiAnalytics.exe
-
Size
146KB
-
MD5
0ba969ec7a2b428b3bc4ad47e3709700
-
SHA1
71a960e96a9ce7a48e49940a78719d2c1ff61511
-
SHA256
774c54e1cb3a8b7a74bf6650bf9a40dd6ea07e02dcf07703110bc45928d956b6
-
SHA512
a16e19e0c6983c699d313ce204371401cd3a8c95e452d353cb686244167cda21c1077d14f6141ad45b9d08b5d100607715d22208fb8f3634c8552b4c96aabb1f
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp9gFbctg0IyAyhZvjDUOy/nmPmT9se4:n3C9BRo7tvnJ9oH0IRgZvjDhy+Pmxse4
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/2440-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1600-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2732-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3292-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3292-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4332-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1008-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3860-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/572-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3048-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3048-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1412-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1504-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4916-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3344-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3268-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1596-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2420-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1164-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/392-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4620-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2256-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3848-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4872-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4068-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/636-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2140-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1600 httnnh.exe 2732 jvdvp.exe 3292 pvjjv.exe 1008 pdvpd.exe 4332 9lxxlfl.exe 3860 lffxfxf.exe 572 tbbnnt.exe 3048 pdvpp.exe 3540 lrlfffr.exe 1412 hbbtht.exe 1504 rfxfrlf.exe 4916 thnttt.exe 3344 lrxlfxl.exe 1596 nnbttt.exe 3268 vddpp.exe 2420 rxxrxlx.exe 1164 nnhbtb.exe 392 vvvdd.exe 3636 flfxrxf.exe 2496 9nnhhh.exe 2060 pdjdv.exe 4620 rllxrfx.exe 4608 hbttnb.exe 2256 pvdvp.exe 5108 xxfxrfl.exe 2564 9hhhnn.exe 3848 dvdvv.exe 4872 xfxrrrr.exe 4068 bnnnnt.exe 636 ppvjd.exe 2140 btbhbn.exe 3240 rxlxrrx.exe 868 hbbbtb.exe 3508 7vvvp.exe 4364 dddjd.exe 4804 xxflrfx.exe 676 xlrxxxf.exe 4480 hbtttn.exe 2440 nttttn.exe 4748 vvpjp.exe 1368 vdjvd.exe 3296 rfxfrxl.exe 1440 tbbttn.exe 4504 bnbbhh.exe 3608 ppjpj.exe 3960 pvppj.exe 4640 7ffffff.exe 4604 1rrlfxx.exe 4684 tthhhh.exe 3060 tbnhnt.exe 4536 dvvvp.exe 2320 lxlrxlr.exe 2716 xrfxxxl.exe 4984 nnnhtt.exe 3224 dpdvp.exe 3940 djddv.exe 4372 rrlrrfx.exe 1816 lllrrrr.exe 2712 tbbntb.exe 4492 vpppp.exe 4524 jjddd.exe 2420 xrfrffl.exe 3024 3lffxxx.exe 1888 3ntnbt.exe -
resource yara_rule behavioral2/memory/2440-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1600-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2732-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3292-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3292-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1600-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3292-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1008-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4332-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1008-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1008-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3860-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3860-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3860-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/572-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/572-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/572-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3048-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3048-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3048-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1412-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1504-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4916-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3344-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3268-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1596-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2420-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1164-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/392-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4620-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2256-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3848-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4872-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4068-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/636-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2140-212-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2440 wrote to memory of 1600 2440 0ba969ec7a2b428b3bc4ad47e3709700_NeikiAnalytics.exe 81 PID 2440 wrote to memory of 1600 2440 0ba969ec7a2b428b3bc4ad47e3709700_NeikiAnalytics.exe 81 PID 2440 wrote to memory of 1600 2440 0ba969ec7a2b428b3bc4ad47e3709700_NeikiAnalytics.exe 81 PID 1600 wrote to memory of 2732 1600 httnnh.exe 82 PID 1600 wrote to memory of 2732 1600 httnnh.exe 82 PID 1600 wrote to memory of 2732 1600 httnnh.exe 82 PID 2732 wrote to memory of 3292 2732 jvdvp.exe 83 PID 2732 wrote to memory of 3292 2732 jvdvp.exe 83 PID 2732 wrote to memory of 3292 2732 jvdvp.exe 83 PID 3292 wrote to memory of 1008 3292 pvjjv.exe 84 PID 3292 wrote to memory of 1008 3292 pvjjv.exe 84 PID 3292 wrote to memory of 1008 3292 pvjjv.exe 84 PID 1008 wrote to memory of 4332 1008 pdvpd.exe 85 PID 1008 wrote to memory of 4332 1008 pdvpd.exe 85 PID 1008 wrote to memory of 4332 1008 pdvpd.exe 85 PID 4332 wrote to memory of 3860 4332 9lxxlfl.exe 86 PID 4332 wrote to memory of 3860 4332 9lxxlfl.exe 86 PID 4332 wrote to memory of 3860 4332 9lxxlfl.exe 86 PID 3860 wrote to memory of 572 3860 lffxfxf.exe 87 PID 3860 wrote to memory of 572 3860 lffxfxf.exe 87 PID 3860 wrote to memory of 572 3860 lffxfxf.exe 87 PID 572 wrote to memory of 3048 572 tbbnnt.exe 88 PID 572 wrote to memory of 3048 572 tbbnnt.exe 88 PID 572 wrote to memory of 3048 572 tbbnnt.exe 88 PID 3048 wrote to memory of 3540 3048 pdvpp.exe 89 PID 3048 wrote to memory of 3540 3048 pdvpp.exe 89 PID 3048 wrote to memory of 3540 3048 pdvpp.exe 89 PID 3540 wrote to memory of 1412 3540 lrlfffr.exe 90 PID 3540 wrote to memory of 1412 3540 lrlfffr.exe 90 PID 3540 wrote to memory of 1412 3540 lrlfffr.exe 90 PID 1412 wrote to memory of 1504 1412 hbbtht.exe 91 PID 1412 wrote to memory of 1504 1412 hbbtht.exe 91 PID 1412 wrote to memory of 1504 1412 hbbtht.exe 91 PID 1504 wrote to memory of 4916 1504 rfxfrlf.exe 92 PID 1504 wrote to memory of 4916 1504 rfxfrlf.exe 92 PID 1504 wrote to memory of 4916 1504 rfxfrlf.exe 92 PID 4916 wrote to memory of 3344 4916 thnttt.exe 93 PID 4916 wrote to memory of 3344 4916 thnttt.exe 93 PID 4916 wrote to memory of 3344 4916 thnttt.exe 93 PID 3344 wrote to memory of 1596 3344 lrxlfxl.exe 95 PID 3344 wrote to memory of 1596 3344 lrxlfxl.exe 95 PID 3344 wrote to memory of 1596 3344 lrxlfxl.exe 95 PID 1596 wrote to memory of 3268 1596 nnbttt.exe 96 PID 1596 wrote to memory of 3268 1596 nnbttt.exe 96 PID 1596 wrote to memory of 3268 1596 nnbttt.exe 96 PID 3268 wrote to memory of 2420 3268 vddpp.exe 97 PID 3268 wrote to memory of 2420 3268 vddpp.exe 97 PID 3268 wrote to memory of 2420 3268 vddpp.exe 97 PID 2420 wrote to memory of 1164 2420 rxxrxlx.exe 98 PID 2420 wrote to memory of 1164 2420 rxxrxlx.exe 98 PID 2420 wrote to memory of 1164 2420 rxxrxlx.exe 98 PID 1164 wrote to memory of 392 1164 nnhbtb.exe 99 PID 1164 wrote to memory of 392 1164 nnhbtb.exe 99 PID 1164 wrote to memory of 392 1164 nnhbtb.exe 99 PID 392 wrote to memory of 3636 392 vvvdd.exe 100 PID 392 wrote to memory of 3636 392 vvvdd.exe 100 PID 392 wrote to memory of 3636 392 vvvdd.exe 100 PID 3636 wrote to memory of 2496 3636 flfxrxf.exe 101 PID 3636 wrote to memory of 2496 3636 flfxrxf.exe 101 PID 3636 wrote to memory of 2496 3636 flfxrxf.exe 101 PID 2496 wrote to memory of 2060 2496 9nnhhh.exe 102 PID 2496 wrote to memory of 2060 2496 9nnhhh.exe 102 PID 2496 wrote to memory of 2060 2496 9nnhhh.exe 102 PID 2060 wrote to memory of 4620 2060 pdjdv.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ba969ec7a2b428b3bc4ad47e3709700_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0ba969ec7a2b428b3bc4ad47e3709700_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\httnnh.exec:\httnnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\jvdvp.exec:\jvdvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\pvjjv.exec:\pvjjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\pdvpd.exec:\pdvpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\9lxxlfl.exec:\9lxxlfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
\??\c:\lffxfxf.exec:\lffxfxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
\??\c:\tbbnnt.exec:\tbbnnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
\??\c:\pdvpp.exec:\pdvpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\lrlfffr.exec:\lrlfffr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\hbbtht.exec:\hbbtht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\rfxfrlf.exec:\rfxfrlf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\thnttt.exec:\thnttt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\lrxlfxl.exec:\lrxlfxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
\??\c:\nnbttt.exec:\nnbttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\vddpp.exec:\vddpp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\rxxrxlx.exec:\rxxrxlx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\nnhbtb.exec:\nnhbtb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\vvvdd.exec:\vvvdd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\flfxrxf.exec:\flfxrxf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\9nnhhh.exec:\9nnhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\pdjdv.exec:\pdjdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\rllxrfx.exec:\rllxrfx.exe23⤵
- Executes dropped EXE
PID:4620 -
\??\c:\hbttnb.exec:\hbttnb.exe24⤵
- Executes dropped EXE
PID:4608 -
\??\c:\pvdvp.exec:\pvdvp.exe25⤵
- Executes dropped EXE
PID:2256 -
\??\c:\xxfxrfl.exec:\xxfxrfl.exe26⤵
- Executes dropped EXE
PID:5108 -
\??\c:\9hhhnn.exec:\9hhhnn.exe27⤵
- Executes dropped EXE
PID:2564 -
\??\c:\dvdvv.exec:\dvdvv.exe28⤵
- Executes dropped EXE
PID:3848 -
\??\c:\xfxrrrr.exec:\xfxrrrr.exe29⤵
- Executes dropped EXE
PID:4872 -
\??\c:\bnnnnt.exec:\bnnnnt.exe30⤵
- Executes dropped EXE
PID:4068 -
\??\c:\ppvjd.exec:\ppvjd.exe31⤵
- Executes dropped EXE
PID:636 -
\??\c:\btbhbn.exec:\btbhbn.exe32⤵
- Executes dropped EXE
PID:2140 -
\??\c:\rxlxrrx.exec:\rxlxrrx.exe33⤵
- Executes dropped EXE
PID:3240 -
\??\c:\hbbbtb.exec:\hbbbtb.exe34⤵
- Executes dropped EXE
PID:868 -
\??\c:\7vvvp.exec:\7vvvp.exe35⤵
- Executes dropped EXE
PID:3508 -
\??\c:\dddjd.exec:\dddjd.exe36⤵
- Executes dropped EXE
PID:4364 -
\??\c:\xxflrfx.exec:\xxflrfx.exe37⤵
- Executes dropped EXE
PID:4804 -
\??\c:\xlrxxxf.exec:\xlrxxxf.exe38⤵
- Executes dropped EXE
PID:676 -
\??\c:\hbtttn.exec:\hbtttn.exe39⤵
- Executes dropped EXE
PID:4480 -
\??\c:\nttttn.exec:\nttttn.exe40⤵
- Executes dropped EXE
PID:2440 -
\??\c:\vvpjp.exec:\vvpjp.exe41⤵
- Executes dropped EXE
PID:4748 -
\??\c:\vdjvd.exec:\vdjvd.exe42⤵
- Executes dropped EXE
PID:1368 -
\??\c:\rfxfrxl.exec:\rfxfrxl.exe43⤵
- Executes dropped EXE
PID:3296 -
\??\c:\tbbttn.exec:\tbbttn.exe44⤵
- Executes dropped EXE
PID:1440 -
\??\c:\bnbbhh.exec:\bnbbhh.exe45⤵
- Executes dropped EXE
PID:4504 -
\??\c:\ppjpj.exec:\ppjpj.exe46⤵
- Executes dropped EXE
PID:3608 -
\??\c:\pvppj.exec:\pvppj.exe47⤵
- Executes dropped EXE
PID:3960 -
\??\c:\7ffffff.exec:\7ffffff.exe48⤵
- Executes dropped EXE
PID:4640 -
\??\c:\1rrlfxx.exec:\1rrlfxx.exe49⤵
- Executes dropped EXE
PID:4604 -
\??\c:\tthhhh.exec:\tthhhh.exe50⤵
- Executes dropped EXE
PID:4684 -
\??\c:\tbnhnt.exec:\tbnhnt.exe51⤵
- Executes dropped EXE
PID:3060 -
\??\c:\dvvvp.exec:\dvvvp.exe52⤵
- Executes dropped EXE
PID:4536 -
\??\c:\lxlrxlr.exec:\lxlrxlr.exe53⤵
- Executes dropped EXE
PID:2320 -
\??\c:\xrfxxxl.exec:\xrfxxxl.exe54⤵
- Executes dropped EXE
PID:2716 -
\??\c:\nnnhtt.exec:\nnnhtt.exe55⤵
- Executes dropped EXE
PID:4984 -
\??\c:\dpdvp.exec:\dpdvp.exe56⤵
- Executes dropped EXE
PID:3224 -
\??\c:\djddv.exec:\djddv.exe57⤵
- Executes dropped EXE
PID:3940 -
\??\c:\rrlrrfx.exec:\rrlrrfx.exe58⤵
- Executes dropped EXE
PID:4372 -
\??\c:\lllrrrr.exec:\lllrrrr.exe59⤵
- Executes dropped EXE
PID:1816 -
\??\c:\tbbntb.exec:\tbbntb.exe60⤵
- Executes dropped EXE
PID:2712 -
\??\c:\vpppp.exec:\vpppp.exe61⤵
- Executes dropped EXE
PID:4492 -
\??\c:\jjddd.exec:\jjddd.exe62⤵
- Executes dropped EXE
PID:4524 -
\??\c:\xrfrffl.exec:\xrfrffl.exe63⤵
- Executes dropped EXE
PID:2420 -
\??\c:\3lffxxx.exec:\3lffxxx.exe64⤵
- Executes dropped EXE
PID:3024 -
\??\c:\3ntnbt.exec:\3ntnbt.exe65⤵
- Executes dropped EXE
PID:1888 -
\??\c:\hnnbbb.exec:\hnnbbb.exe66⤵PID:4952
-
\??\c:\vvvpj.exec:\vvvpj.exe67⤵PID:3404
-
\??\c:\rrlflxf.exec:\rrlflxf.exe68⤵PID:2888
-
\??\c:\fxrxrlr.exec:\fxrxrlr.exe69⤵PID:2292
-
\??\c:\nnhbnn.exec:\nnhbnn.exe70⤵PID:1688
-
\??\c:\djdvj.exec:\djdvj.exe71⤵PID:4512
-
\??\c:\djjjj.exec:\djjjj.exe72⤵PID:3400
-
\??\c:\xrllllf.exec:\xrllllf.exe73⤵PID:3780
-
\??\c:\7xfxxxr.exec:\7xfxxxr.exe74⤵PID:2564
-
\??\c:\btbttb.exec:\btbttb.exe75⤵PID:2364
-
\??\c:\djvpj.exec:\djvpj.exe76⤵PID:4032
-
\??\c:\vdvjd.exec:\vdvjd.exe77⤵PID:4872
-
\??\c:\llxxxxr.exec:\llxxxxr.exe78⤵PID:3032
-
\??\c:\xllffrf.exec:\xllffrf.exe79⤵PID:4544
-
\??\c:\bthhhh.exec:\bthhhh.exe80⤵PID:800
-
\??\c:\dvvvp.exec:\dvvvp.exe81⤵PID:4560
-
\??\c:\9jjdd.exec:\9jjdd.exe82⤵PID:3236
-
\??\c:\llrrlxf.exec:\llrrlxf.exe83⤵PID:1044
-
\??\c:\5tttth.exec:\5tttth.exe84⤵PID:1928
-
\??\c:\1jjdv.exec:\1jjdv.exe85⤵PID:4196
-
\??\c:\lflfrxl.exec:\lflfrxl.exe86⤵PID:1464
-
\??\c:\3ddpj.exec:\3ddpj.exe87⤵PID:4928
-
\??\c:\flffxll.exec:\flffxll.exe88⤵PID:3016
-
\??\c:\hhnnhh.exec:\hhnnhh.exe89⤵PID:4704
-
\??\c:\dpdjp.exec:\dpdjp.exe90⤵PID:4480
-
\??\c:\rxxfxxl.exec:\rxxfxxl.exe91⤵PID:2440
-
\??\c:\frrffff.exec:\frrffff.exe92⤵PID:4288
-
\??\c:\5bbhhh.exec:\5bbhhh.exe93⤵PID:4220
-
\??\c:\jdvpp.exec:\jdvpp.exe94⤵PID:3296
-
\??\c:\rfxfllr.exec:\rfxfllr.exe95⤵PID:1008
-
\??\c:\xfrxfxx.exec:\xfrxfxx.exe96⤵PID:1712
-
\??\c:\hbhnhn.exec:\hbhnhn.exe97⤵PID:2760
-
\??\c:\btbbbb.exec:\btbbbb.exe98⤵PID:4904
-
\??\c:\dppjd.exec:\dppjd.exe99⤵PID:2308
-
\??\c:\bttbbb.exec:\bttbbb.exe100⤵PID:1256
-
\??\c:\9dvpp.exec:\9dvpp.exe101⤵PID:1084
-
\??\c:\pvpjj.exec:\pvpjj.exe102⤵PID:1948
-
\??\c:\xxxxrlf.exec:\xxxxrlf.exe103⤵PID:2388
-
\??\c:\9xrllll.exec:\9xrllll.exe104⤵PID:2908
-
\??\c:\thbttt.exec:\thbttt.exe105⤵PID:4816
-
\??\c:\dvddv.exec:\dvddv.exe106⤵PID:4588
-
\??\c:\vjjjj.exec:\vjjjj.exe107⤵PID:3592
-
\??\c:\flrlllf.exec:\flrlllf.exe108⤵PID:4708
-
\??\c:\nhntnb.exec:\nhntnb.exe109⤵PID:712
-
\??\c:\bbtnhb.exec:\bbtnhb.exe110⤵PID:1492
-
\??\c:\vjddv.exec:\vjddv.exe111⤵PID:1140
-
\??\c:\9rxxrrf.exec:\9rxxrrf.exe112⤵PID:4508
-
\??\c:\thnhtb.exec:\thnhtb.exe113⤵PID:2940
-
\??\c:\vjppj.exec:\vjppj.exe114⤵PID:2184
-
\??\c:\lrrrlxx.exec:\lrrrlxx.exe115⤵PID:1072
-
\??\c:\hbnnht.exec:\hbnnht.exe116⤵PID:1068
-
\??\c:\nhbbbb.exec:\nhbbbb.exe117⤵PID:2528
-
\??\c:\vdjdp.exec:\vdjdp.exe118⤵PID:3524
-
\??\c:\xllffrl.exec:\xllffrl.exe119⤵PID:5028
-
\??\c:\thnhtt.exec:\thnhtt.exe120⤵PID:4044
-
\??\c:\ttbbth.exec:\ttbbth.exe121⤵PID:2200
-
\??\c:\dvpjp.exec:\dvpjp.exe122⤵PID:4032
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-