Analysis
-
max time kernel
150s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
06-06-2024 21:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1bbfd0ca0a3151322a6522498592de10_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
1bbfd0ca0a3151322a6522498592de10_NeikiAnalytics.exe
-
Size
63KB
-
MD5
1bbfd0ca0a3151322a6522498592de10
-
SHA1
095759eeaebfcacc4e81c481d89de1fc127b28c8
-
SHA256
e863add68e6d290408035c6363bef0c9a4f2070ddc6d8f93fcc41ed306528bf9
-
SHA512
b74a4b257899ca31138070d4c1d09856c6cb60a106a58975574313ea7923e5e7573d76544473397f2f017e715e6f1a78670aa00cc49b8ebd77388f297b029b58
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIug6bL6Nf:ymb3NkkiQ3mdBjFIugph
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/5092-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2536-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5092-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3740-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3348-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3508-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1996-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/896-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4648-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4024-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/872-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4760-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/520-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1784-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2732-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/688-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/880-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4964-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/476-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3104-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1124-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3372-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/460-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1204-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3492-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5092 dvdvp.exe 3740 bbhnbn.exe 3348 jvdjd.exe 4648 xfflfff.exe 896 1thhtn.exe 3508 djdpv.exe 2076 dpjpj.exe 1996 3rlxxfl.exe 4992 7lrrrrx.exe 4024 bhhbtb.exe 872 vdpjj.exe 4760 frlllll.exe 520 hnhhnt.exe 4476 vpdjd.exe 1784 pddpj.exe 2732 rxxllrf.exe 3760 1ntnhn.exe 688 3nhtbn.exe 880 jjvvv.exe 4964 3vjdj.exe 476 xrflllr.exe 3104 bnbttn.exe 1124 pvvjp.exe 3372 frxrrrx.exe 736 bbhbhh.exe 4492 vvddj.exe 440 ppppj.exe 460 3flfrrr.exe 1656 lrxxlxx.exe 1204 hbtnhh.exe 3492 dppjd.exe 5112 xxfxrrf.exe 2080 ntbtnt.exe 1052 pjppj.exe 2032 pddvd.exe 4548 3xllxxf.exe 3108 xflflrx.exe 3820 nbtbhn.exe 4912 3djdv.exe 220 ddpjd.exe 4372 fxllxrf.exe 2676 lfffrlr.exe 1752 btttnh.exe 1420 vpddv.exe 3740 vvpdj.exe 3360 lrrrrxx.exe 3408 ntbhhh.exe 400 vdjjj.exe 2964 jdvvd.exe 4256 frllxlx.exe 3044 lrxxflr.exe 548 ttbbnb.exe 3264 bhnnbh.exe 2800 vpvvp.exe 1072 3xxfrll.exe 1044 bbhhnn.exe 1368 hhttth.exe 4760 pddvv.exe 1004 vvdjp.exe 4120 frxxrrr.exe 3580 9fllxfx.exe 2052 7tbbtb.exe 3900 1ppjj.exe 2036 pdjdv.exe -
resource yara_rule behavioral2/memory/5092-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2536-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3740-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3348-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3348-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4648-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4648-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4648-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3508-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/896-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4648-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4024-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/872-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4760-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/520-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1784-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2732-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/688-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/880-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4964-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/476-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3104-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1124-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3372-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/460-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1204-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3492-208-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2536 wrote to memory of 5092 2536 1bbfd0ca0a3151322a6522498592de10_NeikiAnalytics.exe 82 PID 2536 wrote to memory of 5092 2536 1bbfd0ca0a3151322a6522498592de10_NeikiAnalytics.exe 82 PID 2536 wrote to memory of 5092 2536 1bbfd0ca0a3151322a6522498592de10_NeikiAnalytics.exe 82 PID 5092 wrote to memory of 3740 5092 dvdvp.exe 83 PID 5092 wrote to memory of 3740 5092 dvdvp.exe 83 PID 5092 wrote to memory of 3740 5092 dvdvp.exe 83 PID 3740 wrote to memory of 3348 3740 bbhnbn.exe 84 PID 3740 wrote to memory of 3348 3740 bbhnbn.exe 84 PID 3740 wrote to memory of 3348 3740 bbhnbn.exe 84 PID 3348 wrote to memory of 4648 3348 jvdjd.exe 85 PID 3348 wrote to memory of 4648 3348 jvdjd.exe 85 PID 3348 wrote to memory of 4648 3348 jvdjd.exe 85 PID 4648 wrote to memory of 896 4648 xfflfff.exe 86 PID 4648 wrote to memory of 896 4648 xfflfff.exe 86 PID 4648 wrote to memory of 896 4648 xfflfff.exe 86 PID 896 wrote to memory of 3508 896 1thhtn.exe 87 PID 896 wrote to memory of 3508 896 1thhtn.exe 87 PID 896 wrote to memory of 3508 896 1thhtn.exe 87 PID 3508 wrote to memory of 2076 3508 djdpv.exe 88 PID 3508 wrote to memory of 2076 3508 djdpv.exe 88 PID 3508 wrote to memory of 2076 3508 djdpv.exe 88 PID 2076 wrote to memory of 1996 2076 dpjpj.exe 89 PID 2076 wrote to memory of 1996 2076 dpjpj.exe 89 PID 2076 wrote to memory of 1996 2076 dpjpj.exe 89 PID 1996 wrote to memory of 4992 1996 3rlxxfl.exe 91 PID 1996 wrote to memory of 4992 1996 3rlxxfl.exe 91 PID 1996 wrote to memory of 4992 1996 3rlxxfl.exe 91 PID 4992 wrote to memory of 4024 4992 7lrrrrx.exe 92 PID 4992 wrote to memory of 4024 4992 7lrrrrx.exe 92 PID 4992 wrote to memory of 4024 4992 7lrrrrx.exe 92 PID 4024 wrote to memory of 872 4024 bhhbtb.exe 93 PID 4024 wrote to memory of 872 4024 bhhbtb.exe 93 PID 4024 wrote to memory of 872 4024 bhhbtb.exe 93 PID 872 wrote to memory of 4760 872 vdpjj.exe 94 PID 872 wrote to memory of 4760 872 vdpjj.exe 94 PID 872 wrote to memory of 4760 872 vdpjj.exe 94 PID 4760 wrote to memory of 520 4760 frlllll.exe 96 PID 4760 wrote to memory of 520 4760 frlllll.exe 96 PID 4760 wrote to memory of 520 4760 frlllll.exe 96 PID 520 wrote to memory of 4476 520 hnhhnt.exe 97 PID 520 wrote to memory of 4476 520 hnhhnt.exe 97 PID 520 wrote to memory of 4476 520 hnhhnt.exe 97 PID 4476 wrote to memory of 1784 4476 vpdjd.exe 98 PID 4476 wrote to memory of 1784 4476 vpdjd.exe 98 PID 4476 wrote to memory of 1784 4476 vpdjd.exe 98 PID 1784 wrote to memory of 2732 1784 pddpj.exe 99 PID 1784 wrote to memory of 2732 1784 pddpj.exe 99 PID 1784 wrote to memory of 2732 1784 pddpj.exe 99 PID 2732 wrote to memory of 3760 2732 rxxllrf.exe 100 PID 2732 wrote to memory of 3760 2732 rxxllrf.exe 100 PID 2732 wrote to memory of 3760 2732 rxxllrf.exe 100 PID 3760 wrote to memory of 688 3760 1ntnhn.exe 101 PID 3760 wrote to memory of 688 3760 1ntnhn.exe 101 PID 3760 wrote to memory of 688 3760 1ntnhn.exe 101 PID 688 wrote to memory of 880 688 3nhtbn.exe 102 PID 688 wrote to memory of 880 688 3nhtbn.exe 102 PID 688 wrote to memory of 880 688 3nhtbn.exe 102 PID 880 wrote to memory of 4964 880 jjvvv.exe 103 PID 880 wrote to memory of 4964 880 jjvvv.exe 103 PID 880 wrote to memory of 4964 880 jjvvv.exe 103 PID 4964 wrote to memory of 476 4964 3vjdj.exe 104 PID 4964 wrote to memory of 476 4964 3vjdj.exe 104 PID 4964 wrote to memory of 476 4964 3vjdj.exe 104 PID 476 wrote to memory of 3104 476 xrflllr.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bbfd0ca0a3151322a6522498592de10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1bbfd0ca0a3151322a6522498592de10_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\dvdvp.exec:\dvdvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\bbhnbn.exec:\bbhnbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\jvdjd.exec:\jvdjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\xfflfff.exec:\xfflfff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\1thhtn.exec:\1thhtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
\??\c:\djdpv.exec:\djdpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\dpjpj.exec:\dpjpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\3rlxxfl.exec:\3rlxxfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\7lrrrrx.exec:\7lrrrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\bhhbtb.exec:\bhhbtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\vdpjj.exec:\vdpjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\frlllll.exec:\frlllll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\hnhhnt.exec:\hnhhnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:520 -
\??\c:\vpdjd.exec:\vpdjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\pddpj.exec:\pddpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\rxxllrf.exec:\rxxllrf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\1ntnhn.exec:\1ntnhn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\3nhtbn.exec:\3nhtbn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
\??\c:\jjvvv.exec:\jjvvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\3vjdj.exec:\3vjdj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\xrflllr.exec:\xrflllr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:476 -
\??\c:\bnbttn.exec:\bnbttn.exe23⤵
- Executes dropped EXE
PID:3104 -
\??\c:\pvvjp.exec:\pvvjp.exe24⤵
- Executes dropped EXE
PID:1124 -
\??\c:\frxrrrx.exec:\frxrrrx.exe25⤵
- Executes dropped EXE
PID:3372 -
\??\c:\bbhbhh.exec:\bbhbhh.exe26⤵
- Executes dropped EXE
PID:736 -
\??\c:\vvddj.exec:\vvddj.exe27⤵
- Executes dropped EXE
PID:4492 -
\??\c:\ppppj.exec:\ppppj.exe28⤵
- Executes dropped EXE
PID:440 -
\??\c:\3flfrrr.exec:\3flfrrr.exe29⤵
- Executes dropped EXE
PID:460 -
\??\c:\lrxxlxx.exec:\lrxxlxx.exe30⤵
- Executes dropped EXE
PID:1656 -
\??\c:\hbtnhh.exec:\hbtnhh.exe31⤵
- Executes dropped EXE
PID:1204 -
\??\c:\dppjd.exec:\dppjd.exe32⤵
- Executes dropped EXE
PID:3492 -
\??\c:\xxfxrrf.exec:\xxfxrrf.exe33⤵
- Executes dropped EXE
PID:5112 -
\??\c:\ntbtnt.exec:\ntbtnt.exe34⤵
- Executes dropped EXE
PID:2080 -
\??\c:\pjppj.exec:\pjppj.exe35⤵
- Executes dropped EXE
PID:1052 -
\??\c:\pddvd.exec:\pddvd.exe36⤵
- Executes dropped EXE
PID:2032 -
\??\c:\3xllxxf.exec:\3xllxxf.exe37⤵
- Executes dropped EXE
PID:4548 -
\??\c:\xflflrx.exec:\xflflrx.exe38⤵
- Executes dropped EXE
PID:3108 -
\??\c:\nbtbhn.exec:\nbtbhn.exe39⤵
- Executes dropped EXE
PID:3820 -
\??\c:\3djdv.exec:\3djdv.exe40⤵
- Executes dropped EXE
PID:4912 -
\??\c:\ddpjd.exec:\ddpjd.exe41⤵
- Executes dropped EXE
PID:220 -
\??\c:\fxllxrf.exec:\fxllxrf.exe42⤵
- Executes dropped EXE
PID:4372 -
\??\c:\lfffrlr.exec:\lfffrlr.exe43⤵
- Executes dropped EXE
PID:2676 -
\??\c:\btttnh.exec:\btttnh.exe44⤵
- Executes dropped EXE
PID:1752 -
\??\c:\vpddv.exec:\vpddv.exe45⤵
- Executes dropped EXE
PID:1420 -
\??\c:\vvpdj.exec:\vvpdj.exe46⤵
- Executes dropped EXE
PID:3740 -
\??\c:\lrrrrxx.exec:\lrrrrxx.exe47⤵
- Executes dropped EXE
PID:3360 -
\??\c:\ntbhhh.exec:\ntbhhh.exe48⤵
- Executes dropped EXE
PID:3408 -
\??\c:\vdjjj.exec:\vdjjj.exe49⤵
- Executes dropped EXE
PID:400 -
\??\c:\jdvvd.exec:\jdvvd.exe50⤵
- Executes dropped EXE
PID:2964 -
\??\c:\frllxlx.exec:\frllxlx.exe51⤵
- Executes dropped EXE
PID:4256 -
\??\c:\lrxxflr.exec:\lrxxflr.exe52⤵
- Executes dropped EXE
PID:3044 -
\??\c:\ttbbnb.exec:\ttbbnb.exe53⤵
- Executes dropped EXE
PID:548 -
\??\c:\bhnnbh.exec:\bhnnbh.exe54⤵
- Executes dropped EXE
PID:3264 -
\??\c:\vpvvp.exec:\vpvvp.exe55⤵
- Executes dropped EXE
PID:2800 -
\??\c:\3xxfrll.exec:\3xxfrll.exe56⤵
- Executes dropped EXE
PID:1072 -
\??\c:\bbhhnn.exec:\bbhhnn.exe57⤵
- Executes dropped EXE
PID:1044 -
\??\c:\hhttth.exec:\hhttth.exe58⤵
- Executes dropped EXE
PID:1368 -
\??\c:\pddvv.exec:\pddvv.exe59⤵
- Executes dropped EXE
PID:4760 -
\??\c:\vvdjp.exec:\vvdjp.exe60⤵
- Executes dropped EXE
PID:1004 -
\??\c:\frxxrrr.exec:\frxxrrr.exe61⤵
- Executes dropped EXE
PID:4120 -
\??\c:\9fllxfx.exec:\9fllxfx.exe62⤵
- Executes dropped EXE
PID:3580 -
\??\c:\7tbbtb.exec:\7tbbtb.exe63⤵
- Executes dropped EXE
PID:2052 -
\??\c:\1ppjj.exec:\1ppjj.exe64⤵
- Executes dropped EXE
PID:3900 -
\??\c:\pdjdv.exec:\pdjdv.exe65⤵
- Executes dropped EXE
PID:2036 -
\??\c:\1fxrrfl.exec:\1fxrrfl.exe66⤵PID:4804
-
\??\c:\nhtbbn.exec:\nhtbbn.exe67⤵PID:3756
-
\??\c:\7tbbtt.exec:\7tbbtt.exe68⤵PID:696
-
\??\c:\ddvpj.exec:\ddvpj.exe69⤵PID:2592
-
\??\c:\vvppj.exec:\vvppj.exe70⤵PID:4964
-
\??\c:\rrxfflx.exec:\rrxfflx.exe71⤵PID:476
-
\??\c:\nntbtb.exec:\nntbtb.exe72⤵PID:2256
-
\??\c:\vjvpj.exec:\vjvpj.exe73⤵PID:3104
-
\??\c:\jvjjj.exec:\jvjjj.exe74⤵PID:4908
-
\??\c:\5xffxxx.exec:\5xffxxx.exe75⤵PID:4716
-
\??\c:\1tbttb.exec:\1tbttb.exe76⤵PID:472
-
\??\c:\thntnh.exec:\thntnh.exe77⤵PID:344
-
\??\c:\9jppj.exec:\9jppj.exe78⤵PID:416
-
\??\c:\nnnhbb.exec:\nnnhbb.exe79⤵PID:5008
-
\??\c:\nnhtbt.exec:\nnhtbt.exe80⤵PID:2720
-
\??\c:\pdpvd.exec:\pdpvd.exe81⤵PID:4044
-
\??\c:\fxffxxx.exec:\fxffxxx.exe82⤵PID:2440
-
\??\c:\3lxxfff.exec:\3lxxfff.exe83⤵PID:4048
-
\??\c:\ttnbtt.exec:\ttnbtt.exe84⤵PID:456
-
\??\c:\djdvv.exec:\djdvv.exe85⤵PID:3060
-
\??\c:\xlrxxff.exec:\xlrxxff.exe86⤵PID:3608
-
\??\c:\xllfxfr.exec:\xllfxfr.exe87⤵PID:4148
-
\??\c:\htnhnn.exec:\htnhnn.exe88⤵PID:3660
-
\??\c:\1vpjv.exec:\1vpjv.exe89⤵PID:4480
-
\??\c:\jjvvj.exec:\jjvvj.exe90⤵PID:2296
-
\??\c:\lllxxxr.exec:\lllxxxr.exe91⤵PID:5104
-
\??\c:\hthtnb.exec:\hthtnb.exe92⤵PID:2372
-
\??\c:\htbhnb.exec:\htbhnb.exe93⤵PID:3820
-
\??\c:\1jpjj.exec:\1jpjj.exe94⤵PID:4912
-
\??\c:\7dpjv.exec:\7dpjv.exe95⤵PID:3424
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe96⤵PID:4340
-
\??\c:\7rffxxx.exec:\7rffxxx.exe97⤵PID:5092
-
\??\c:\9bbbnn.exec:\9bbbnn.exe98⤵PID:1664
-
\??\c:\thnnbb.exec:\thnnbb.exe99⤵PID:2340
-
\??\c:\pvdvj.exec:\pvdvj.exe100⤵PID:4396
-
\??\c:\xlrlrxx.exec:\xlrlrxx.exe101⤵PID:4952
-
\??\c:\thhhbb.exec:\thhhbb.exe102⤵PID:2408
-
\??\c:\jvdpd.exec:\jvdpd.exe103⤵PID:3324
-
\??\c:\dvvpd.exec:\dvvpd.exe104⤵PID:4004
-
\??\c:\lrrlfff.exec:\lrrlfff.exe105⤵PID:4284
-
\??\c:\9rffxxr.exec:\9rffxxr.exe106⤵PID:4660
-
\??\c:\ttbbtt.exec:\ttbbtt.exe107⤵PID:648
-
\??\c:\1bntnn.exec:\1bntnn.exe108⤵PID:820
-
\??\c:\vjjjd.exec:\vjjjd.exe109⤵PID:4208
-
\??\c:\vvvpj.exec:\vvvpj.exe110⤵PID:3656
-
\??\c:\xfxrlrl.exec:\xfxrlrl.exe111⤵PID:1920
-
\??\c:\hntbnn.exec:\hntbnn.exe112⤵PID:812
-
\??\c:\hbbthh.exec:\hbbthh.exe113⤵PID:2560
-
\??\c:\vjddj.exec:\vjddj.exe114⤵PID:4536
-
\??\c:\djvpj.exec:\djvpj.exe115⤵PID:3612
-
\??\c:\ffllxxx.exec:\ffllxxx.exe116⤵PID:1220
-
\??\c:\lfffxxf.exec:\lfffxxf.exe117⤵PID:4028
-
\??\c:\btbhbt.exec:\btbhbt.exe118⤵PID:2216
-
\??\c:\7dvvp.exec:\7dvvp.exe119⤵PID:5032
-
\??\c:\jvvvv.exec:\jvvvv.exe120⤵PID:4680
-
\??\c:\rflfxxx.exec:\rflfxxx.exe121⤵PID:2284
-
\??\c:\rxfrlrl.exec:\rxfrlrl.exe122⤵PID:4916
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-