Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
08/06/2024, 18:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
df7d7d77856312077d32bd718a9717e0_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
- Target df7d7d77856312077d32bd718a9717e0_NeikiAnalytics.exe
- Size 200KB
- Sample240608-xe74fafd68
- SHA256 4063efdb3b7682e9d60efdfe03bf3da1b644aeee2b0a25c353596fe1265f7df2
- MD5 df7d7d77856312077d32bd718a9717e0
- SHA1 a8028e2408edaafadf6e27f3480fa5db7eac0927
- SHA512 dbbb35bed3a23d905315f2f88fb88be5bf2c66dabc7181689b6070cffb3211814e25c90872226958a781c0a5db2a5e951a535bee3251d316f873b8dcd8763b71
- SSDEEP 3072:ymb3NkkiQ3mdBjFIi/0RU6QeYQsm71vPmc51+GqekBJCvr6zJBUVv1T1:n3C9BRIG0asYFm71m8+GdkB9Cv1B
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/3940-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/696-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1136-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3368-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2984-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2868-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3208-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/700-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4932-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4064-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1168-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1920-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4056-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3076-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2452-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2964-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4316-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3404-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4476-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3104-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 388 vvjjd.exe 696 5rrlflf.exe 4348 tnnnhn.exe 2728 9lrffff.exe 1136 7dddd.exe 4520 vdddd.exe 3368 ntbbbh.exe 2984 rxfxxfl.exe 2868 bbbbbh.exe 3208 dvjjj.exe 4124 hbhtbt.exe 700 3pppp.exe 4932 bhnnhn.exe 4064 5hhttb.exe 1344 pvpjj.exe 4536 nnnnnt.exe 1168 1pddd.exe 4808 7lllffx.exe 1920 lrfrrfx.exe 4856 3ddpd.exe 3628 rlfxrff.exe 4056 nhhhnn.exe 3076 jjddv.exe 2452 7bbbtb.exe 2964 bthbtt.exe 4316 ddjjd.exe 1724 lxxrfff.exe 3404 dvvvv.exe 4476 vvjjj.exe 3296 rxlxrrr.exe 3104 ttbbbh.exe 2864 nnbtnn.exe 1536 vdddd.exe 2064 3xllffx.exe 4404 3xxffff.exe 644 tbbhhh.exe 5056 ttbbhn.exe 2260 9dvpj.exe 432 fxffffl.exe 4208 lfrrlrx.exe 1240 nhnnnt.exe 2824 bbbbhh.exe 972 pvpdj.exe 4520 ddppp.exe 4668 flrlrlf.exe 3004 rflfffx.exe 2532 tbhhhn.exe 4716 vvvvv.exe 4436 jjjjv.exe 1384 lxlxrrr.exe 2356 frxxxfx.exe 1756 bnnbbt.exe 4156 3vvvp.exe 4880 pvjvv.exe 4640 rxffrxx.exe 2472 rrxfxff.exe 3644 bnbtnt.exe 1344 btbbbb.exe 3440 jjjjj.exe 2760 9pppj.exe 1068 llrlfrl.exe 1932 3tthhh.exe 4916 thtbbb.exe 2328 vvppj.exe -
resource yara_rule behavioral2/memory/3940-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/388-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/696-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1136-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3368-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3368-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3368-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3368-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2984-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2868-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3208-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3208-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3208-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3208-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/700-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4932-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4064-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1168-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1920-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4056-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3076-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2452-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2964-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4316-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3404-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3104-207-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3940 wrote to memory of 388 3940 df7d7d77856312077d32bd718a9717e0_NeikiAnalytics.exe 82 PID 3940 wrote to memory of 388 3940 df7d7d77856312077d32bd718a9717e0_NeikiAnalytics.exe 82 PID 3940 wrote to memory of 388 3940 df7d7d77856312077d32bd718a9717e0_NeikiAnalytics.exe 82 PID 388 wrote to memory of 696 388 vvjjd.exe 83 PID 388 wrote to memory of 696 388 vvjjd.exe 83 PID 388 wrote to memory of 696 388 vvjjd.exe 83 PID 696 wrote to memory of 4348 696 5rrlflf.exe 84 PID 696 wrote to memory of 4348 696 5rrlflf.exe 84 PID 696 wrote to memory of 4348 696 5rrlflf.exe 84 PID 4348 wrote to memory of 2728 4348 tnnnhn.exe 85 PID 4348 wrote to memory of 2728 4348 tnnnhn.exe 85 PID 4348 wrote to memory of 2728 4348 tnnnhn.exe 85 PID 2728 wrote to memory of 1136 2728 9lrffff.exe 86 PID 2728 wrote to memory of 1136 2728 9lrffff.exe 86 PID 2728 wrote to memory of 1136 2728 9lrffff.exe 86 PID 1136 wrote to memory of 4520 1136 7dddd.exe 87 PID 1136 wrote to memory of 4520 1136 7dddd.exe 87 PID 1136 wrote to memory of 4520 1136 7dddd.exe 87 PID 4520 wrote to memory of 3368 4520 vdddd.exe 88 PID 4520 wrote to memory of 3368 4520 vdddd.exe 88 PID 4520 wrote to memory of 3368 4520 vdddd.exe 88 PID 3368 wrote to memory of 2984 3368 ntbbbh.exe 89 PID 3368 wrote to memory of 2984 3368 ntbbbh.exe 89 PID 3368 wrote to memory of 2984 3368 ntbbbh.exe 89 PID 2984 wrote to memory of 2868 2984 rxfxxfl.exe 90 PID 2984 wrote to memory of 2868 2984 rxfxxfl.exe 90 PID 2984 wrote to memory of 2868 2984 rxfxxfl.exe 90 PID 2868 wrote to memory of 3208 2868 bbbbbh.exe 92 PID 2868 wrote to memory of 3208 2868 bbbbbh.exe 92 PID 2868 wrote to memory of 3208 2868 bbbbbh.exe 92 PID 3208 wrote to memory of 4124 3208 dvjjj.exe 93 PID 3208 wrote to memory of 4124 3208 dvjjj.exe 93 PID 3208 wrote to memory of 4124 3208 dvjjj.exe 93 PID 4124 wrote to memory of 700 4124 hbhtbt.exe 94 PID 4124 wrote to memory of 700 4124 hbhtbt.exe 94 PID 4124 wrote to memory of 700 4124 hbhtbt.exe 94 PID 700 wrote to memory of 4932 700 3pppp.exe 96 PID 700 wrote to memory of 4932 700 3pppp.exe 96 PID 700 wrote to memory of 4932 700 3pppp.exe 96 PID 4932 wrote to memory of 4064 4932 bhnnhn.exe 97 PID 4932 wrote to memory of 4064 4932 bhnnhn.exe 97 PID 4932 wrote to memory of 4064 4932 bhnnhn.exe 97 PID 4064 wrote to memory of 1344 4064 5hhttb.exe 98 PID 4064 wrote to memory of 1344 4064 5hhttb.exe 98 PID 4064 wrote to memory of 1344 4064 5hhttb.exe 98 PID 1344 wrote to memory of 4536 1344 pvpjj.exe 99 PID 1344 wrote to memory of 4536 1344 pvpjj.exe 99 PID 1344 wrote to memory of 4536 1344 pvpjj.exe 99 PID 4536 wrote to memory of 1168 4536 nnnnnt.exe 100 PID 4536 wrote to memory of 1168 4536 nnnnnt.exe 100 PID 4536 wrote to memory of 1168 4536 nnnnnt.exe 100 PID 1168 wrote to memory of 4808 1168 1pddd.exe 101 PID 1168 wrote to memory of 4808 1168 1pddd.exe 101 PID 1168 wrote to memory of 4808 1168 1pddd.exe 101 PID 4808 wrote to memory of 1920 4808 7lllffx.exe 103 PID 4808 wrote to memory of 1920 4808 7lllffx.exe 103 PID 4808 wrote to memory of 1920 4808 7lllffx.exe 103 PID 1920 wrote to memory of 4856 1920 lrfrrfx.exe 104 PID 1920 wrote to memory of 4856 1920 lrfrrfx.exe 104 PID 1920 wrote to memory of 4856 1920 lrfrrfx.exe 104 PID 4856 wrote to memory of 3628 4856 3ddpd.exe 105 PID 4856 wrote to memory of 3628 4856 3ddpd.exe 105 PID 4856 wrote to memory of 3628 4856 3ddpd.exe 105 PID 3628 wrote to memory of 4056 3628 rlfxrff.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\df7d7d77856312077d32bd718a9717e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\df7d7d77856312077d32bd718a9717e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\vvjjd.exec:\vvjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\5rrlflf.exec:\5rrlflf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\tnnnhn.exec:\tnnnhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\9lrffff.exec:\9lrffff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\7dddd.exec:\7dddd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\vdddd.exec:\vdddd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\ntbbbh.exec:\ntbbbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\rxfxxfl.exec:\rxfxxfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\bbbbbh.exec:\bbbbbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\dvjjj.exec:\dvjjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
\??\c:\hbhtbt.exec:\hbhtbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\3pppp.exec:\3pppp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
\??\c:\bhnnhn.exec:\bhnnhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\5hhttb.exec:\5hhttb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\pvpjj.exec:\pvpjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\nnnnnt.exec:\nnnnnt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\1pddd.exec:\1pddd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\7lllffx.exec:\7lllffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\lrfrrfx.exec:\lrfrrfx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\3ddpd.exec:\3ddpd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\rlfxrff.exec:\rlfxrff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\nhhhnn.exec:\nhhhnn.exe23⤵
- Executes dropped EXE
PID:4056 -
\??\c:\jjddv.exec:\jjddv.exe24⤵
- Executes dropped EXE
PID:3076 -
\??\c:\7bbbtb.exec:\7bbbtb.exe25⤵
- Executes dropped EXE
PID:2452 -
\??\c:\bthbtt.exec:\bthbtt.exe26⤵
- Executes dropped EXE
PID:2964 -
\??\c:\ddjjd.exec:\ddjjd.exe27⤵
- Executes dropped EXE
PID:4316 -
\??\c:\lxxrfff.exec:\lxxrfff.exe28⤵
- Executes dropped EXE
PID:1724 -
\??\c:\dvvvv.exec:\dvvvv.exe29⤵
- Executes dropped EXE
PID:3404 -
\??\c:\vvjjj.exec:\vvjjj.exe30⤵
- Executes dropped EXE
PID:4476 -
\??\c:\rxlxrrr.exec:\rxlxrrr.exe31⤵
- Executes dropped EXE
PID:3296 -
\??\c:\ttbbbh.exec:\ttbbbh.exe32⤵
- Executes dropped EXE
PID:3104 -
\??\c:\nnbtnn.exec:\nnbtnn.exe33⤵
- Executes dropped EXE
PID:2864 -
\??\c:\vdddd.exec:\vdddd.exe34⤵
- Executes dropped EXE
PID:1536 -
\??\c:\3xllffx.exec:\3xllffx.exe35⤵
- Executes dropped EXE
PID:2064 -
\??\c:\3xxffff.exec:\3xxffff.exe36⤵
- Executes dropped EXE
PID:4404 -
\??\c:\tbbhhh.exec:\tbbhhh.exe37⤵
- Executes dropped EXE
PID:644 -
\??\c:\ttbbhn.exec:\ttbbhn.exe38⤵
- Executes dropped EXE
PID:5056 -
\??\c:\9dvpj.exec:\9dvpj.exe39⤵
- Executes dropped EXE
PID:2260 -
\??\c:\fxffffl.exec:\fxffffl.exe40⤵
- Executes dropped EXE
PID:432 -
\??\c:\lfrrlrx.exec:\lfrrlrx.exe41⤵
- Executes dropped EXE
PID:4208 -
\??\c:\nhnnnt.exec:\nhnnnt.exe42⤵
- Executes dropped EXE
PID:1240 -
\??\c:\bbbbhh.exec:\bbbbhh.exe43⤵
- Executes dropped EXE
PID:2824 -
\??\c:\pvpdj.exec:\pvpdj.exe44⤵
- Executes dropped EXE
PID:972 -
\??\c:\ddppp.exec:\ddppp.exe45⤵
- Executes dropped EXE
PID:4520 -
\??\c:\flrlrlf.exec:\flrlrlf.exe46⤵
- Executes dropped EXE
PID:4668 -
\??\c:\rflfffx.exec:\rflfffx.exe47⤵
- Executes dropped EXE
PID:3004 -
\??\c:\tbhhhn.exec:\tbhhhn.exe48⤵
- Executes dropped EXE
PID:2532 -
\??\c:\vvvvv.exec:\vvvvv.exe49⤵
- Executes dropped EXE
PID:4716 -
\??\c:\jjjjv.exec:\jjjjv.exe50⤵
- Executes dropped EXE
PID:4436 -
\??\c:\lxlxrrr.exec:\lxlxrrr.exe51⤵
- Executes dropped EXE
PID:1384 -
\??\c:\frxxxfx.exec:\frxxxfx.exe52⤵
- Executes dropped EXE
PID:2356 -
\??\c:\bnnbbt.exec:\bnnbbt.exe53⤵
- Executes dropped EXE
PID:1756 -
\??\c:\3vvvp.exec:\3vvvp.exe54⤵
- Executes dropped EXE
PID:4156 -
\??\c:\pvjvv.exec:\pvjvv.exe55⤵
- Executes dropped EXE
PID:4880 -
\??\c:\rxffrxx.exec:\rxffrxx.exe56⤵
- Executes dropped EXE
PID:4640 -
\??\c:\rrxfxff.exec:\rrxfxff.exe57⤵
- Executes dropped EXE
PID:2472 -
\??\c:\bnbtnt.exec:\bnbtnt.exe58⤵
- Executes dropped EXE
PID:3644 -
\??\c:\btbbbb.exec:\btbbbb.exe59⤵
- Executes dropped EXE
PID:1344 -
\??\c:\jjjjj.exec:\jjjjj.exe60⤵
- Executes dropped EXE
PID:3440 -
\??\c:\9pppj.exec:\9pppj.exe61⤵
- Executes dropped EXE
PID:2760 -
\??\c:\llrlfrl.exec:\llrlfrl.exe62⤵
- Executes dropped EXE
PID:1068 -
\??\c:\3tthhh.exec:\3tthhh.exe63⤵
- Executes dropped EXE
PID:1932 -
\??\c:\thtbbb.exec:\thtbbb.exe64⤵
- Executes dropped EXE
PID:4916 -
\??\c:\vvppj.exec:\vvppj.exe65⤵
- Executes dropped EXE
PID:2328 -
\??\c:\rrlfxxx.exec:\rrlfxxx.exe66⤵PID:1276
-
\??\c:\tbnnnn.exec:\tbnnnn.exe67⤵PID:4452
-
\??\c:\hhntbh.exec:\hhntbh.exe68⤵PID:3336
-
\??\c:\dvddv.exec:\dvddv.exe69⤵PID:4364
-
\??\c:\pdjdv.exec:\pdjdv.exe70⤵PID:3124
-
\??\c:\bbtnnn.exec:\bbtnnn.exe71⤵PID:5016
-
\??\c:\tnnhtt.exec:\tnnhtt.exe72⤵PID:4464
-
\??\c:\ppjjd.exec:\ppjjd.exe73⤵PID:2964
-
\??\c:\rrrlfll.exec:\rrrlfll.exe74⤵PID:4316
-
\??\c:\7rfxrrl.exec:\7rfxrrl.exe75⤵PID:1408
-
\??\c:\bbbnhh.exec:\bbbnhh.exe76⤵PID:4484
-
\??\c:\htttnn.exec:\htttnn.exe77⤵PID:4172
-
\??\c:\ppjjd.exec:\ppjjd.exe78⤵PID:4120
-
\??\c:\fxxlfrr.exec:\fxxlfrr.exe79⤵PID:3296
-
\??\c:\3fllrxf.exec:\3fllrxf.exe80⤵PID:3052
-
\??\c:\hnhnbh.exec:\hnhnbh.exe81⤵PID:944
-
\??\c:\btbbbb.exec:\btbbbb.exe82⤵PID:3568
-
\??\c:\vvjjj.exec:\vvjjj.exe83⤵PID:3972
-
\??\c:\xfxlxfr.exec:\xfxlxfr.exe84⤵PID:3816
-
\??\c:\xrflllr.exec:\xrflllr.exe85⤵PID:644
-
\??\c:\thnhbb.exec:\thnhbb.exe86⤵PID:3912
-
\??\c:\dpvjp.exec:\dpvjp.exe87⤵PID:2352
-
\??\c:\pjjvp.exec:\pjjvp.exe88⤵PID:2684
-
\??\c:\rxlflrf.exec:\rxlflrf.exe89⤵PID:4208
-
\??\c:\bnttbh.exec:\bnttbh.exe90⤵PID:3384
-
\??\c:\7htttb.exec:\7htttb.exe91⤵PID:3084
-
\??\c:\jpjdd.exec:\jpjdd.exe92⤵PID:4104
-
\??\c:\3vdvv.exec:\3vdvv.exe93⤵PID:2200
-
\??\c:\frxrrrr.exec:\frxrrrr.exe94⤵PID:5072
-
\??\c:\rrxxxxx.exec:\rrxxxxx.exe95⤵PID:5040
-
\??\c:\hntntb.exec:\hntntb.exe96⤵PID:3036
-
\??\c:\vpddp.exec:\vpddp.exe97⤵PID:2724
-
\??\c:\dvjjj.exec:\dvjjj.exe98⤵PID:2196
-
\??\c:\llxrrrr.exec:\llxrrrr.exe99⤵PID:1996
-
\??\c:\btbhhn.exec:\btbhhn.exe100⤵PID:1872
-
\??\c:\tnnhhb.exec:\tnnhhb.exe101⤵PID:3796
-
\??\c:\5jjjd.exec:\5jjjd.exe102⤵PID:4932
-
\??\c:\dvjdv.exec:\dvjdv.exe103⤵PID:2180
-
\??\c:\rxxxfff.exec:\rxxxfff.exe104⤵PID:548
-
\??\c:\bbtthh.exec:\bbtthh.exe105⤵PID:2120
-
\??\c:\btnntt.exec:\btnntt.exe106⤵PID:4616
-
\??\c:\vpvvp.exec:\vpvvp.exe107⤵PID:2704
-
\??\c:\3xrlffr.exec:\3xrlffr.exe108⤵PID:4460
-
\??\c:\ffffrrr.exec:\ffffrrr.exe109⤵PID:2020
-
\??\c:\hhnhbt.exec:\hhnhbt.exe110⤵PID:3452
-
\??\c:\hhhhbh.exec:\hhhhbh.exe111⤵PID:4808
-
\??\c:\vvddp.exec:\vvddp.exe112⤵PID:1196
-
\??\c:\ddjjd.exec:\ddjjd.exe113⤵PID:4216
-
\??\c:\lrflfxx.exec:\lrflfxx.exe114⤵PID:1680
-
\??\c:\bttttt.exec:\bttttt.exe115⤵PID:3628
-
\??\c:\jdvvp.exec:\jdvvp.exe116⤵PID:2256
-
\??\c:\ppddv.exec:\ppddv.exe117⤵PID:3124
-
\??\c:\1fxllfl.exec:\1fxllfl.exe118⤵PID:3764
-
\??\c:\nntbhb.exec:\nntbhb.exe119⤵PID:4892
-
\??\c:\nttnnn.exec:\nttnnn.exe120⤵PID:2152
-
\??\c:\ppddd.exec:\ppddd.exe121⤵PID:4688
-
\??\c:\pjpdv.exec:\pjpdv.exe122⤵PID:820
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-