Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 22:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0995e4c3681aad27cd6160a1c972f9b0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
- Target 0995e4c3681aad27cd6160a1c972f9b0_NeikiAnalytics.exe
- Size 721KB
- Sample240611-2lv5nsvcpl
- SHA256 8f61a38aafbfe2a486d843a36ca8bc42b412ab5a8ad01bc47eb07a755ed9af0a
- MD5 0995e4c3681aad27cd6160a1c972f9b0
- SHA1 6d803cf13c18abf1c3e0564c19ba206e0894d991
- SHA512 09e237f0760105070af6756d31e92dea29d749b28e471634d21b7ac580f8fa765dbf1c5ad7d771368b1cf1c63ff9556a13da2774426e977f0867666ad15472e4
- SSDEEP 12288:n3C9yMo+S0L9xRnoq7H9xqYLzKoq73lRa2dBDZy:SgD4bhoqLDqYLzKoqTPy
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/4592-21-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4592-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3940-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4396-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1656-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3068-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/436-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4272-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4680-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1900-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5080-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4164-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1212-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1860-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3516-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1196-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1404-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4672-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3520-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2616-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/400-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2032-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2572-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/956-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3508-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 3940 pvddd.exe 4592 xxrfrxl.exe 4036 5bhbtt.exe 1656 vdjvv.exe 3720 rrffrrf.exe 3068 tnnhtb.exe 436 hbnhnt.exe 4272 bhhntt.exe 4680 jjjpp.exe 1900 vdpjj.exe 2012 xrxxxxf.exe 5080 xflfflf.exe 4164 lxflxxx.exe 4688 9rxxxll.exe 1212 rfxxfll.exe 1488 nnbhhn.exe 1916 1bnnbh.exe 1860 vvpjj.exe 4760 1jvvp.exe 3516 rrrxfrl.exe 1196 5lllxff.exe 1404 fffflrr.exe 4672 bbtbhn.exe 3520 3flfrrl.exe 2616 ntbbbb.exe 400 nnbntt.exe 2572 pdjdd.exe 2032 hhbbhn.exe 956 vvdpj.exe 3036 xrrfffx.exe 3508 ppjdd.exe 548 3dpdd.exe 3792 7nnnbh.exe 1512 pjvvp.exe 3612 rfxxxxx.exe 4796 rxlfllr.exe 3304 bbhhhh.exe 2008 1ppvv.exe 1380 rfxffff.exe 5096 btttnn.exe 1228 vpvpp.exe 640 dvdvj.exe 1188 lflrlrr.exe 3716 bntnnh.exe 8 vpvjj.exe 668 9rrrrxx.exe 2360 tntttb.exe 3436 1bnhbh.exe 4072 jjpvv.exe 1656 9hbthh.exe 2536 vvvvv.exe 4372 9ffrrff.exe 3216 ppvvp.exe 2428 flrrrxr.exe 1360 tttntt.exe 3344 pjvjd.exe 2340 rffxxxf.exe 3324 xlrlxll.exe 1344 tntttn.exe 2400 7vjjv.exe 2532 rxxrrrl.exe 2904 nhhhbt.exe 4140 dvvjd.exe 2808 xrrlfxl.exe -
resource yara_rule behavioral2/memory/4396-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3940-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4396-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1656-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3068-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/436-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4272-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4680-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1900-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5080-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4164-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1212-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1860-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3516-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1196-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1404-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4672-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3520-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2616-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2032-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2572-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/956-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3508-204-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4396 wrote to memory of 3940 4396 0995e4c3681aad27cd6160a1c972f9b0_NeikiAnalytics.exe 82 PID 4396 wrote to memory of 3940 4396 0995e4c3681aad27cd6160a1c972f9b0_NeikiAnalytics.exe 82 PID 4396 wrote to memory of 3940 4396 0995e4c3681aad27cd6160a1c972f9b0_NeikiAnalytics.exe 82 PID 3940 wrote to memory of 4592 3940 pvddd.exe 83 PID 3940 wrote to memory of 4592 3940 pvddd.exe 83 PID 3940 wrote to memory of 4592 3940 pvddd.exe 83 PID 4592 wrote to memory of 4036 4592 xxrfrxl.exe 84 PID 4592 wrote to memory of 4036 4592 xxrfrxl.exe 84 PID 4592 wrote to memory of 4036 4592 xxrfrxl.exe 84 PID 4036 wrote to memory of 1656 4036 5bhbtt.exe 85 PID 4036 wrote to memory of 1656 4036 5bhbtt.exe 85 PID 4036 wrote to memory of 1656 4036 5bhbtt.exe 85 PID 1656 wrote to memory of 3720 1656 vdjvv.exe 86 PID 1656 wrote to memory of 3720 1656 vdjvv.exe 86 PID 1656 wrote to memory of 3720 1656 vdjvv.exe 86 PID 3720 wrote to memory of 3068 3720 rrffrrf.exe 88 PID 3720 wrote to memory of 3068 3720 rrffrrf.exe 88 PID 3720 wrote to memory of 3068 3720 rrffrrf.exe 88 PID 3068 wrote to memory of 436 3068 tnnhtb.exe 90 PID 3068 wrote to memory of 436 3068 tnnhtb.exe 90 PID 3068 wrote to memory of 436 3068 tnnhtb.exe 90 PID 436 wrote to memory of 4272 436 hbnhnt.exe 91 PID 436 wrote to memory of 4272 436 hbnhnt.exe 91 PID 436 wrote to memory of 4272 436 hbnhnt.exe 91 PID 4272 wrote to memory of 4680 4272 bhhntt.exe 92 PID 4272 wrote to memory of 4680 4272 bhhntt.exe 92 PID 4272 wrote to memory of 4680 4272 bhhntt.exe 92 PID 4680 wrote to memory of 1900 4680 jjjpp.exe 93 PID 4680 wrote to memory of 1900 4680 jjjpp.exe 93 PID 4680 wrote to memory of 1900 4680 jjjpp.exe 93 PID 1900 wrote to memory of 2012 1900 vdpjj.exe 95 PID 1900 wrote to memory of 2012 1900 vdpjj.exe 95 PID 1900 wrote to memory of 2012 1900 vdpjj.exe 95 PID 2012 wrote to memory of 5080 2012 xrxxxxf.exe 96 PID 2012 wrote to memory of 5080 2012 xrxxxxf.exe 96 PID 2012 wrote to memory of 5080 2012 xrxxxxf.exe 96 PID 5080 wrote to memory of 4164 5080 xflfflf.exe 97 PID 5080 wrote to memory of 4164 5080 xflfflf.exe 97 PID 5080 wrote to memory of 4164 5080 xflfflf.exe 97 PID 4164 wrote to memory of 4688 4164 lxflxxx.exe 98 PID 4164 wrote to memory of 4688 4164 lxflxxx.exe 98 PID 4164 wrote to memory of 4688 4164 lxflxxx.exe 98 PID 4688 wrote to memory of 1212 4688 9rxxxll.exe 99 PID 4688 wrote to memory of 1212 4688 9rxxxll.exe 99 PID 4688 wrote to memory of 1212 4688 9rxxxll.exe 99 PID 1212 wrote to memory of 1488 1212 rfxxfll.exe 100 PID 1212 wrote to memory of 1488 1212 rfxxfll.exe 100 PID 1212 wrote to memory of 1488 1212 rfxxfll.exe 100 PID 1488 wrote to memory of 1916 1488 nnbhhn.exe 101 PID 1488 wrote to memory of 1916 1488 nnbhhn.exe 101 PID 1488 wrote to memory of 1916 1488 nnbhhn.exe 101 PID 1916 wrote to memory of 1860 1916 1bnnbh.exe 102 PID 1916 wrote to memory of 1860 1916 1bnnbh.exe 102 PID 1916 wrote to memory of 1860 1916 1bnnbh.exe 102 PID 1860 wrote to memory of 4760 1860 vvpjj.exe 103 PID 1860 wrote to memory of 4760 1860 vvpjj.exe 103 PID 1860 wrote to memory of 4760 1860 vvpjj.exe 103 PID 4760 wrote to memory of 3516 4760 1jvvp.exe 104 PID 4760 wrote to memory of 3516 4760 1jvvp.exe 104 PID 4760 wrote to memory of 3516 4760 1jvvp.exe 104 PID 3516 wrote to memory of 1196 3516 rrrxfrl.exe 105 PID 3516 wrote to memory of 1196 3516 rrrxfrl.exe 105 PID 3516 wrote to memory of 1196 3516 rrrxfrl.exe 105 PID 1196 wrote to memory of 1404 1196 5lllxff.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\0995e4c3681aad27cd6160a1c972f9b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0995e4c3681aad27cd6160a1c972f9b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\pvddd.exec:\pvddd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\xxrfrxl.exec:\xxrfrxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\5bhbtt.exec:\5bhbtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\vdjvv.exec:\vdjvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\rrffrrf.exec:\rrffrrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\tnnhtb.exec:\tnnhtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\hbnhnt.exec:\hbnhnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\bhhntt.exec:\bhhntt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\jjjpp.exec:\jjjpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\vdpjj.exec:\vdpjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\xrxxxxf.exec:\xrxxxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\xflfflf.exec:\xflfflf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\lxflxxx.exec:\lxflxxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
\??\c:\9rxxxll.exec:\9rxxxll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\rfxxfll.exec:\rfxxfll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\nnbhhn.exec:\nnbhhn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\1bnnbh.exec:\1bnnbh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\vvpjj.exec:\vvpjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\1jvvp.exec:\1jvvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\rrrxfrl.exec:\rrrxfrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\5lllxff.exec:\5lllxff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\fffflrr.exec:\fffflrr.exe23⤵
- Executes dropped EXE
PID:1404 -
\??\c:\bbtbhn.exec:\bbtbhn.exe24⤵
- Executes dropped EXE
PID:4672 -
\??\c:\3flfrrl.exec:\3flfrrl.exe25⤵
- Executes dropped EXE
PID:3520 -
\??\c:\ntbbbb.exec:\ntbbbb.exe26⤵
- Executes dropped EXE
PID:2616 -
\??\c:\nnbntt.exec:\nnbntt.exe27⤵
- Executes dropped EXE
PID:400 -
\??\c:\pdjdd.exec:\pdjdd.exe28⤵
- Executes dropped EXE
PID:2572 -
\??\c:\hhbbhn.exec:\hhbbhn.exe29⤵
- Executes dropped EXE
PID:2032 -
\??\c:\vvdpj.exec:\vvdpj.exe30⤵
- Executes dropped EXE
PID:956 -
\??\c:\xrrfffx.exec:\xrrfffx.exe31⤵
- Executes dropped EXE
PID:3036 -
\??\c:\ppjdd.exec:\ppjdd.exe32⤵
- Executes dropped EXE
PID:3508 -
\??\c:\3dpdd.exec:\3dpdd.exe33⤵
- Executes dropped EXE
PID:548 -
\??\c:\7nnnbh.exec:\7nnnbh.exe34⤵
- Executes dropped EXE
PID:3792 -
\??\c:\pjvvp.exec:\pjvvp.exe35⤵
- Executes dropped EXE
PID:1512 -
\??\c:\rfxxxxx.exec:\rfxxxxx.exe36⤵
- Executes dropped EXE
PID:3612 -
\??\c:\rxlfllr.exec:\rxlfllr.exe37⤵
- Executes dropped EXE
PID:4796 -
\??\c:\bbhhhh.exec:\bbhhhh.exe38⤵
- Executes dropped EXE
PID:3304 -
\??\c:\1ppvv.exec:\1ppvv.exe39⤵
- Executes dropped EXE
PID:2008 -
\??\c:\rfxffff.exec:\rfxffff.exe40⤵
- Executes dropped EXE
PID:1380 -
\??\c:\btttnn.exec:\btttnn.exe41⤵
- Executes dropped EXE
PID:5096 -
\??\c:\vpvpp.exec:\vpvpp.exe42⤵
- Executes dropped EXE
PID:1228 -
\??\c:\dvdvj.exec:\dvdvj.exe43⤵
- Executes dropped EXE
PID:640 -
\??\c:\lflrlrr.exec:\lflrlrr.exe44⤵
- Executes dropped EXE
PID:1188 -
\??\c:\bntnnh.exec:\bntnnh.exe45⤵
- Executes dropped EXE
PID:3716 -
\??\c:\vpvjj.exec:\vpvjj.exe46⤵
- Executes dropped EXE
PID:8 -
\??\c:\9rrrrxx.exec:\9rrrrxx.exe47⤵
- Executes dropped EXE
PID:668 -
\??\c:\tntttb.exec:\tntttb.exe48⤵
- Executes dropped EXE
PID:2360 -
\??\c:\1bnhbh.exec:\1bnhbh.exe49⤵
- Executes dropped EXE
PID:3436 -
\??\c:\jjpvv.exec:\jjpvv.exe50⤵
- Executes dropped EXE
PID:4072 -
\??\c:\9hbthh.exec:\9hbthh.exe51⤵
- Executes dropped EXE
PID:1656 -
\??\c:\vvvvv.exec:\vvvvv.exe52⤵
- Executes dropped EXE
PID:2536 -
\??\c:\9ffrrff.exec:\9ffrrff.exe53⤵
- Executes dropped EXE
PID:4372 -
\??\c:\ppvvp.exec:\ppvvp.exe54⤵
- Executes dropped EXE
PID:3216 -
\??\c:\flrrrxr.exec:\flrrrxr.exe55⤵
- Executes dropped EXE
PID:2428 -
\??\c:\tttntt.exec:\tttntt.exe56⤵
- Executes dropped EXE
PID:1360 -
\??\c:\pjvjd.exec:\pjvjd.exe57⤵
- Executes dropped EXE
PID:3344 -
\??\c:\rffxxxf.exec:\rffxxxf.exe58⤵
- Executes dropped EXE
PID:2340 -
\??\c:\xlrlxll.exec:\xlrlxll.exe59⤵
- Executes dropped EXE
PID:3324 -
\??\c:\tntttn.exec:\tntttn.exe60⤵
- Executes dropped EXE
PID:1344 -
\??\c:\7vjjv.exec:\7vjjv.exe61⤵
- Executes dropped EXE
PID:2400 -
\??\c:\rxxrrrl.exec:\rxxrrrl.exe62⤵
- Executes dropped EXE
PID:2532 -
\??\c:\nhhhbt.exec:\nhhhbt.exe63⤵
- Executes dropped EXE
PID:2904 -
\??\c:\dvvjd.exec:\dvvjd.exe64⤵
- Executes dropped EXE
PID:4140 -
\??\c:\xrrlfxl.exec:\xrrlfxl.exe65⤵
- Executes dropped EXE
PID:2808 -
\??\c:\tbthbt.exec:\tbthbt.exe66⤵PID:4164
-
\??\c:\vdddv.exec:\vdddv.exe67⤵PID:4688
-
\??\c:\lffxrlx.exec:\lffxrlx.exe68⤵PID:4148
-
\??\c:\hhhbbt.exec:\hhhbbt.exe69⤵PID:1488
-
\??\c:\dvvdv.exec:\dvvdv.exe70⤵PID:1584
-
\??\c:\lrrrrrx.exec:\lrrrrrx.exe71⤵PID:952
-
\??\c:\3htnbb.exec:\3htnbb.exe72⤵PID:2020
-
\??\c:\vvjjj.exec:\vvjjj.exe73⤵PID:3012
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe74⤵PID:4928
-
\??\c:\1lllrxf.exec:\1lllrxf.exe75⤵PID:4960
-
\??\c:\htntnb.exec:\htntnb.exe76⤵PID:2304
-
\??\c:\lflfxrl.exec:\lflfxrl.exe77⤵PID:1904
-
\??\c:\nbhbnn.exec:\nbhbnn.exe78⤵PID:4676
-
\??\c:\nnnhbt.exec:\nnnhbt.exe79⤵PID:4408
-
\??\c:\fxrlffl.exec:\fxrlffl.exe80⤵PID:2124
-
\??\c:\xfllfff.exec:\xfllfff.exe81⤵PID:2692
-
\??\c:\dvdvj.exec:\dvdvj.exe82⤵PID:1856
-
\??\c:\pvddv.exec:\pvddv.exe83⤵PID:3412
-
\??\c:\xfxrllf.exec:\xfxrllf.exe84⤵PID:3320
-
\??\c:\bhnhbt.exec:\bhnhbt.exe85⤵PID:956
-
\??\c:\jpvvj.exec:\jpvvj.exe86⤵PID:1340
-
\??\c:\rrrrlrr.exec:\rrrrlrr.exe87⤵PID:628
-
\??\c:\tbbbbb.exec:\tbbbbb.exe88⤵PID:4564
-
\??\c:\jpvpp.exec:\jpvpp.exe89⤵PID:3404
-
\??\c:\xxxxfrx.exec:\xxxxfrx.exe90⤵PID:3792
-
\??\c:\tttttt.exec:\tttttt.exe91⤵PID:1512
-
\??\c:\dppdv.exec:\dppdv.exe92⤵PID:5008
-
\??\c:\llffxfx.exec:\llffxfx.exe93⤵PID:4796
-
\??\c:\tbbbbh.exec:\tbbbbh.exe94⤵PID:3076
-
\??\c:\dvvdp.exec:\dvvdp.exe95⤵PID:4228
-
\??\c:\ffllfll.exec:\ffllfll.exe96⤵PID:1380
-
\??\c:\bnbbtb.exec:\bnbbtb.exe97⤵PID:456
-
\??\c:\dvddv.exec:\dvddv.exe98⤵PID:4528
-
\??\c:\rxxrrrr.exec:\rxxrrrr.exe99⤵PID:4316
-
\??\c:\nhnnnb.exec:\nhnnnb.exe100⤵PID:4120
-
\??\c:\jjjvv.exec:\jjjvv.exe101⤵PID:3940
-
\??\c:\lllllll.exec:\lllllll.exe102⤵PID:3812
-
\??\c:\bhhbhh.exec:\bhhbhh.exe103⤵PID:2860
-
\??\c:\5jvdd.exec:\5jvdd.exe104⤵PID:1560
-
\??\c:\lxrrxff.exec:\lxrrxff.exe105⤵PID:3924
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe106⤵PID:3808
-
\??\c:\tttnnt.exec:\tttnnt.exe107⤵PID:1712
-
\??\c:\jjjdv.exec:\jjjdv.exe108⤵PID:1476
-
\??\c:\xlrrlll.exec:\xlrrlll.exe109⤵PID:4372
-
\??\c:\ttttbh.exec:\ttttbh.exe110⤵PID:3216
-
\??\c:\3jjjv.exec:\3jjjv.exe111⤵PID:2324
-
\??\c:\lllllll.exec:\lllllll.exe112⤵PID:1360
-
\??\c:\ttttnn.exec:\ttttnn.exe113⤵PID:3344
-
\??\c:\pjjdd.exec:\pjjdd.exe114⤵PID:2340
-
\??\c:\pjjvv.exec:\pjjvv.exe115⤵PID:3440
-
\??\c:\thbhhh.exec:\thbhhh.exe116⤵PID:1344
-
\??\c:\jvppd.exec:\jvppd.exe117⤵PID:2400
-
\??\c:\flrrrrl.exec:\flrrrrl.exe118⤵PID:2532
-
\??\c:\bbtttt.exec:\bbtttt.exe119⤵PID:3876
-
\??\c:\nnntnt.exec:\nnntnt.exe120⤵PID:552
-
\??\c:\jvvdv.exec:\jvvdv.exe121⤵PID:4500
-
\??\c:\llrrrrr.exec:\llrrrrr.exe122⤵PID:4164
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-