Analysis
- max time kernel
150s - max time network
53s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
16/06/2024, 02:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cd37723a369b9531e2d75d7ff01ad960_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
- Target cd37723a369b9531e2d75d7ff01ad960_NeikiAnalytics.exe
- Size 71KB
- Sample240616-cwe4rswbmd
- SHA256 ee7b8197ae5dc851fcec2162a0a2d20988d866ac57fd1daa6f281155b7374b8e
- MD5 cd37723a369b9531e2d75d7ff01ad960
- SHA1 99bdaf43bc80757939b51b0933be180cb50d825b
- SHA512 8fb15b6c7ff08ad7b6ff9afa611d39595ec7aaea4f5170662e65f986ee56d3aa11545074804a2515995e12d56ab5f238777be62949ad11428c71f93489c14fd3
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIgUVyiAnfZ:ymb3NkkiQ3mdBjFIgUEBZ
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/1252-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5068-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3320-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2696-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2760-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2760-50-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5052-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3952-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3068-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2084-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1984-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4132-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1576-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5076-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2876-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4188-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4900-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/464-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1660-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3652-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3580-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 116 ttthbb.exe 5068 djpdv.exe 3596 jjvvv.exe 3320 9rlxrxx.exe 2696 7rrxrlf.exe 2760 pdjdd.exe 5052 jvjdv.exe 3952 rfxllrf.exe 3068 fflfrrr.exe 4540 ntnnhh.exe 2084 jdjpp.exe 1984 lrrlflf.exe 4132 hbbnhn.exe 1576 ppjdv.exe 4968 rrfllrl.exe 5076 9tnnhh.exe 3660 htnnhh.exe 2880 vddvp.exe 2876 xxfxlxf.exe 4188 tnhnnn.exe 4784 vppjd.exe 4900 vppjv.exe 464 lrxxrrl.exe 4160 xfxlxrl.exe 4844 nnnhnh.exe 1660 3pddj.exe 3372 3jvpj.exe 408 xlrrxxr.exe 3652 hhttbb.exe 3580 jdpvp.exe 1656 frxrffx.exe 3548 hbttbt.exe 3384 bbthht.exe 2484 ddpjv.exe 2396 3jpjj.exe 4820 fxxxrrl.exe 4532 lrffxxx.exe 872 tbhhhh.exe 2412 tntnhn.exe 3196 jjddp.exe 4252 xlrlffx.exe 1340 llxrxxx.exe 228 rffxlff.exe 2180 tbhbtt.exe 3936 nnhbbb.exe 3012 pdvdp.exe 3572 7vjdj.exe 3320 frrrfxr.exe 5108 lrxfxxr.exe 2708 hbnntn.exe 5048 hhbtnn.exe 944 dvjpv.exe 3672 7vjjd.exe 1144 xfrllff.exe 752 lxfxfxr.exe 2364 9lrlrrr.exe 2128 hhhhbb.exe 3964 hbhhnn.exe 3724 ddjpj.exe 2420 pjdvp.exe 2904 rfrlxxr.exe 3168 fxxfxxx.exe 2208 nbbnbb.exe 2476 hbtntt.exe -
resource yara_rule behavioral2/memory/1252-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5068-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3320-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3320-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3596-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2696-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2760-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3068-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3068-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3068-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2084-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1984-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4132-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1576-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5076-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2876-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4188-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/464-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1660-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3580-200-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1252 wrote to memory of 116 1252 cd37723a369b9531e2d75d7ff01ad960_NeikiAnalytics.exe 83 PID 1252 wrote to memory of 116 1252 cd37723a369b9531e2d75d7ff01ad960_NeikiAnalytics.exe 83 PID 1252 wrote to memory of 116 1252 cd37723a369b9531e2d75d7ff01ad960_NeikiAnalytics.exe 83 PID 116 wrote to memory of 5068 116 ttthbb.exe 84 PID 116 wrote to memory of 5068 116 ttthbb.exe 84 PID 116 wrote to memory of 5068 116 ttthbb.exe 84 PID 5068 wrote to memory of 3596 5068 djpdv.exe 85 PID 5068 wrote to memory of 3596 5068 djpdv.exe 85 PID 5068 wrote to memory of 3596 5068 djpdv.exe 85 PID 3596 wrote to memory of 3320 3596 jjvvv.exe 86 PID 3596 wrote to memory of 3320 3596 jjvvv.exe 86 PID 3596 wrote to memory of 3320 3596 jjvvv.exe 86 PID 3320 wrote to memory of 2696 3320 9rlxrxx.exe 87 PID 3320 wrote to memory of 2696 3320 9rlxrxx.exe 87 PID 3320 wrote to memory of 2696 3320 9rlxrxx.exe 87 PID 2696 wrote to memory of 2760 2696 7rrxrlf.exe 88 PID 2696 wrote to memory of 2760 2696 7rrxrlf.exe 88 PID 2696 wrote to memory of 2760 2696 7rrxrlf.exe 88 PID 2760 wrote to memory of 5052 2760 pdjdd.exe 89 PID 2760 wrote to memory of 5052 2760 pdjdd.exe 89 PID 2760 wrote to memory of 5052 2760 pdjdd.exe 89 PID 5052 wrote to memory of 3952 5052 jvjdv.exe 90 PID 5052 wrote to memory of 3952 5052 jvjdv.exe 90 PID 5052 wrote to memory of 3952 5052 jvjdv.exe 90 PID 3952 wrote to memory of 3068 3952 rfxllrf.exe 91 PID 3952 wrote to memory of 3068 3952 rfxllrf.exe 91 PID 3952 wrote to memory of 3068 3952 rfxllrf.exe 91 PID 3068 wrote to memory of 4540 3068 fflfrrr.exe 92 PID 3068 wrote to memory of 4540 3068 fflfrrr.exe 92 PID 3068 wrote to memory of 4540 3068 fflfrrr.exe 92 PID 4540 wrote to memory of 2084 4540 ntnnhh.exe 93 PID 4540 wrote to memory of 2084 4540 ntnnhh.exe 93 PID 4540 wrote to memory of 2084 4540 ntnnhh.exe 93 PID 2084 wrote to memory of 1984 2084 jdjpp.exe 94 PID 2084 wrote to memory of 1984 2084 jdjpp.exe 94 PID 2084 wrote to memory of 1984 2084 jdjpp.exe 94 PID 1984 wrote to memory of 4132 1984 lrrlflf.exe 95 PID 1984 wrote to memory of 4132 1984 lrrlflf.exe 95 PID 1984 wrote to memory of 4132 1984 lrrlflf.exe 95 PID 4132 wrote to memory of 1576 4132 hbbnhn.exe 96 PID 4132 wrote to memory of 1576 4132 hbbnhn.exe 96 PID 4132 wrote to memory of 1576 4132 hbbnhn.exe 96 PID 1576 wrote to memory of 4968 1576 ppjdv.exe 98 PID 1576 wrote to memory of 4968 1576 ppjdv.exe 98 PID 1576 wrote to memory of 4968 1576 ppjdv.exe 98 PID 4968 wrote to memory of 5076 4968 rrfllrl.exe 99 PID 4968 wrote to memory of 5076 4968 rrfllrl.exe 99 PID 4968 wrote to memory of 5076 4968 rrfllrl.exe 99 PID 5076 wrote to memory of 3660 5076 9tnnhh.exe 100 PID 5076 wrote to memory of 3660 5076 9tnnhh.exe 100 PID 5076 wrote to memory of 3660 5076 9tnnhh.exe 100 PID 3660 wrote to memory of 2880 3660 htnnhh.exe 101 PID 3660 wrote to memory of 2880 3660 htnnhh.exe 101 PID 3660 wrote to memory of 2880 3660 htnnhh.exe 101 PID 2880 wrote to memory of 2876 2880 vddvp.exe 102 PID 2880 wrote to memory of 2876 2880 vddvp.exe 102 PID 2880 wrote to memory of 2876 2880 vddvp.exe 102 PID 2876 wrote to memory of 4188 2876 xxfxlxf.exe 103 PID 2876 wrote to memory of 4188 2876 xxfxlxf.exe 103 PID 2876 wrote to memory of 4188 2876 xxfxlxf.exe 103 PID 4188 wrote to memory of 4784 4188 tnhnnn.exe 104 PID 4188 wrote to memory of 4784 4188 tnhnnn.exe 104 PID 4188 wrote to memory of 4784 4188 tnhnnn.exe 104 PID 4784 wrote to memory of 4900 4784 vppjd.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd37723a369b9531e2d75d7ff01ad960_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\cd37723a369b9531e2d75d7ff01ad960_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\ttthbb.exec:\ttthbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\djpdv.exec:\djpdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\jjvvv.exec:\jjvvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\9rlxrxx.exec:\9rlxrxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\7rrxrlf.exec:\7rrxrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\pdjdd.exec:\pdjdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\jvjdv.exec:\jvjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\rfxllrf.exec:\rfxllrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\fflfrrr.exec:\fflfrrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\ntnnhh.exec:\ntnnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\jdjpp.exec:\jdjpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\lrrlflf.exec:\lrrlflf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\hbbnhn.exec:\hbbnhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\ppjdv.exec:\ppjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\rrfllrl.exec:\rrfllrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\9tnnhh.exec:\9tnnhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\htnnhh.exec:\htnnhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\vddvp.exec:\vddvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\xxfxlxf.exec:\xxfxlxf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\tnhnnn.exec:\tnhnnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
\??\c:\vppjd.exec:\vppjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\vppjv.exec:\vppjv.exe23⤵
- Executes dropped EXE
PID:4900 -
\??\c:\lrxxrrl.exec:\lrxxrrl.exe24⤵
- Executes dropped EXE
PID:464 -
\??\c:\xfxlxrl.exec:\xfxlxrl.exe25⤵
- Executes dropped EXE
PID:4160 -
\??\c:\nnnhnh.exec:\nnnhnh.exe26⤵
- Executes dropped EXE
PID:4844 -
\??\c:\3pddj.exec:\3pddj.exe27⤵
- Executes dropped EXE
PID:1660 -
\??\c:\3jvpj.exec:\3jvpj.exe28⤵
- Executes dropped EXE
PID:3372 -
\??\c:\xlrrxxr.exec:\xlrrxxr.exe29⤵
- Executes dropped EXE
PID:408 -
\??\c:\hhttbb.exec:\hhttbb.exe30⤵
- Executes dropped EXE
PID:3652 -
\??\c:\jdpvp.exec:\jdpvp.exe31⤵
- Executes dropped EXE
PID:3580 -
\??\c:\frxrffx.exec:\frxrffx.exe32⤵
- Executes dropped EXE
PID:1656 -
\??\c:\hbttbt.exec:\hbttbt.exe33⤵
- Executes dropped EXE
PID:3548 -
\??\c:\bbthht.exec:\bbthht.exe34⤵
- Executes dropped EXE
PID:3384 -
\??\c:\ddpjv.exec:\ddpjv.exe35⤵
- Executes dropped EXE
PID:2484 -
\??\c:\3jpjj.exec:\3jpjj.exe36⤵
- Executes dropped EXE
PID:2396 -
\??\c:\fxxxrrl.exec:\fxxxrrl.exe37⤵
- Executes dropped EXE
PID:4820 -
\??\c:\lrffxxx.exec:\lrffxxx.exe38⤵
- Executes dropped EXE
PID:4532 -
\??\c:\tbhhhh.exec:\tbhhhh.exe39⤵
- Executes dropped EXE
PID:872 -
\??\c:\tntnhn.exec:\tntnhn.exe40⤵
- Executes dropped EXE
PID:2412 -
\??\c:\jjddp.exec:\jjddp.exe41⤵
- Executes dropped EXE
PID:3196 -
\??\c:\xlrlffx.exec:\xlrlffx.exe42⤵
- Executes dropped EXE
PID:4252 -
\??\c:\llxrxxx.exec:\llxrxxx.exe43⤵
- Executes dropped EXE
PID:1340 -
\??\c:\rffxlff.exec:\rffxlff.exe44⤵
- Executes dropped EXE
PID:228 -
\??\c:\tbhbtt.exec:\tbhbtt.exe45⤵
- Executes dropped EXE
PID:2180 -
\??\c:\nnhbbb.exec:\nnhbbb.exe46⤵
- Executes dropped EXE
PID:3936 -
\??\c:\pdvdp.exec:\pdvdp.exe47⤵
- Executes dropped EXE
PID:3012 -
\??\c:\7vjdj.exec:\7vjdj.exe48⤵
- Executes dropped EXE
PID:3572 -
\??\c:\frrrfxr.exec:\frrrfxr.exe49⤵
- Executes dropped EXE
PID:3320 -
\??\c:\lrxfxxr.exec:\lrxfxxr.exe50⤵
- Executes dropped EXE
PID:5108 -
\??\c:\hbnntn.exec:\hbnntn.exe51⤵
- Executes dropped EXE
PID:2708 -
\??\c:\hhbtnn.exec:\hhbtnn.exe52⤵
- Executes dropped EXE
PID:5048 -
\??\c:\dvjpv.exec:\dvjpv.exe53⤵
- Executes dropped EXE
PID:944 -
\??\c:\7vjjd.exec:\7vjjd.exe54⤵
- Executes dropped EXE
PID:3672 -
\??\c:\xfrllff.exec:\xfrllff.exe55⤵
- Executes dropped EXE
PID:1144 -
\??\c:\lxfxfxr.exec:\lxfxfxr.exe56⤵
- Executes dropped EXE
PID:752 -
\??\c:\9lrlrrr.exec:\9lrlrrr.exe57⤵
- Executes dropped EXE
PID:2364 -
\??\c:\hhhhbb.exec:\hhhhbb.exe58⤵
- Executes dropped EXE
PID:2128 -
\??\c:\hbhhnn.exec:\hbhhnn.exe59⤵
- Executes dropped EXE
PID:3964 -
\??\c:\ddjpj.exec:\ddjpj.exe60⤵
- Executes dropped EXE
PID:3724 -
\??\c:\pjdvp.exec:\pjdvp.exe61⤵
- Executes dropped EXE
PID:2420 -
\??\c:\rfrlxxr.exec:\rfrlxxr.exe62⤵
- Executes dropped EXE
PID:2904 -
\??\c:\fxxfxxx.exec:\fxxfxxx.exe63⤵
- Executes dropped EXE
PID:3168 -
\??\c:\nbbnbb.exec:\nbbnbb.exe64⤵
- Executes dropped EXE
PID:2208 -
\??\c:\hbtntt.exec:\hbtntt.exe65⤵
- Executes dropped EXE
PID:2476 -
\??\c:\ddvpd.exec:\ddvpd.exe66⤵PID:1764
-
\??\c:\7pvpj.exec:\7pvpj.exe67⤵PID:2548
-
\??\c:\lrrxxxl.exec:\lrrxxxl.exe68⤵PID:2880
-
\??\c:\rlrrrlf.exec:\rlrrrlf.exe69⤵PID:4092
-
\??\c:\hntttt.exec:\hntttt.exe70⤵PID:3328
-
\??\c:\7nnhbb.exec:\7nnhbb.exe71⤵PID:568
-
\??\c:\vjdvj.exec:\vjdvj.exe72⤵PID:4940
-
\??\c:\5djdj.exec:\5djdj.exe73⤵PID:3616
-
\??\c:\1fxfxxx.exec:\1fxfxxx.exe74⤵PID:2468
-
\??\c:\lflrllf.exec:\lflrllf.exe75⤵PID:4736
-
\??\c:\bthtnn.exec:\bthtnn.exe76⤵PID:4972
-
\??\c:\bnttnn.exec:\bnttnn.exe77⤵PID:4428
-
\??\c:\dvvpv.exec:\dvvpv.exe78⤵PID:4328
-
\??\c:\jpjjj.exec:\jpjjj.exe79⤵PID:508
-
\??\c:\7ffxrlr.exec:\7ffxrlr.exe80⤵PID:4948
-
\??\c:\flllrrx.exec:\flllrrx.exe81⤵PID:4880
-
\??\c:\7hbbnn.exec:\7hbbnn.exe82⤵PID:2832
-
\??\c:\bhbttt.exec:\bhbttt.exe83⤵PID:1844
-
\??\c:\jddvj.exec:\jddvj.exe84⤵PID:2852
-
\??\c:\jdpjv.exec:\jdpjv.exe85⤵PID:4608
-
\??\c:\lrlrlfx.exec:\lrlrlfx.exe86⤵PID:5060
-
\??\c:\xllrllf.exec:\xllrllf.exe87⤵PID:960
-
\??\c:\hhhhbb.exec:\hhhhbb.exe88⤵PID:3384
-
\??\c:\nhbhbt.exec:\nhbhbt.exe89⤵PID:2056
-
\??\c:\thbbnn.exec:\thbbnn.exe90⤵PID:2396
-
\??\c:\9dvpj.exec:\9dvpj.exe91⤵PID:4820
-
\??\c:\5dpdj.exec:\5dpdj.exe92⤵PID:2216
-
\??\c:\fxfxfxr.exec:\fxfxfxr.exe93⤵PID:1452
-
\??\c:\fxffrrl.exec:\fxffrrl.exe94⤵PID:3600
-
\??\c:\hnnttn.exec:\hnnttn.exe95⤵PID:1856
-
\??\c:\5pvvv.exec:\5pvvv.exe96⤵PID:4600
-
\??\c:\rxrrflf.exec:\rxrrflf.exe97⤵PID:4480
-
\??\c:\1lrrlrl.exec:\1lrrlrl.exe98⤵PID:2720
-
\??\c:\bnhhhn.exec:\bnhhhn.exe99⤵PID:4128
-
\??\c:\thhnth.exec:\thhnth.exe100⤵PID:4828
-
\??\c:\pvvvp.exec:\pvvvp.exe101⤵PID:1356
-
\??\c:\jpdjd.exec:\jpdjd.exe102⤵PID:4764
-
\??\c:\ppjdj.exec:\ppjdj.exe103⤵PID:2976
-
\??\c:\rrxxlrl.exec:\rrxxlrl.exe104⤵PID:2728
-
\??\c:\lrfflrf.exec:\lrfflrf.exe105⤵PID:2884
-
\??\c:\hhhhhb.exec:\hhhhhb.exe106⤵PID:4756
-
\??\c:\nhnbbb.exec:\nhnbbb.exe107⤵PID:2272
-
\??\c:\5jppv.exec:\5jppv.exe108⤵PID:3492
-
\??\c:\pjjjd.exec:\pjjjd.exe109⤵PID:1040
-
\??\c:\3rflrrr.exec:\3rflrrr.exe110⤵PID:4444
-
\??\c:\lrllxlr.exec:\lrllxlr.exe111⤵PID:664
-
\??\c:\hbhttt.exec:\hbhttt.exe112⤵PID:1984
-
\??\c:\7bnnnt.exec:\7bnnnt.exe113⤵PID:4524
-
\??\c:\jjddv.exec:\jjddv.exe114⤵PID:1112
-
\??\c:\ppddp.exec:\ppddp.exe115⤵PID:4908
-
\??\c:\9vddp.exec:\9vddp.exe116⤵PID:2988
-
\??\c:\xxxxflx.exec:\xxxxflx.exe117⤵PID:4968
-
\??\c:\fllrflr.exec:\fllrflr.exe118⤵PID:5076
-
\??\c:\bhtbhn.exec:\bhtbhn.exe119⤵PID:452
-
\??\c:\jdvvp.exec:\jdvvp.exe120⤵PID:3960
-
\??\c:\jvpjd.exec:\jvpjd.exe121⤵PID:1016
-
\??\c:\ddvvj.exec:\ddvvj.exe122⤵PID:460
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-