Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
16/06/2024, 06:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dd2fe987376375b3a8651e640e6ba120_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
dd2fe987376375b3a8651e640e6ba120_NeikiAnalytics.exe
-
Size
65KB
-
MD5
dd2fe987376375b3a8651e640e6ba120
-
SHA1
c278d7e463beb0338b304ad2defe9b08de4de80b
-
SHA256
dc8f86ad5882d53d6c8eb3a4d63e8e06af674815cfe675ace2861009e8ab7349
-
SHA512
4064337e688b7e62c33637348b20c8770f86ef0ba6605c1fa13c6501fa61da705572bce2b5f6ca184b9abcb97a3a2adae830113eb3b85223cf0e49d9b85b58d0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFdJULh12j:ymb3NkkiQ3mdBjFIFdJma
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/3880-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2088-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1144-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1144-36-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3036-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1524-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3944-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3420-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4040-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2576-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2104-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2512-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2280-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4436-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3428-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3992-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1460-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1300-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1164-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3976-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3836-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4656-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3504 7jpjd.exe 2088 rxxxffx.exe 4776 rfxffxl.exe 1144 bnnhhb.exe 3036 thttbn.exe 1524 3xfxlfl.exe 3944 nhnhbt.exe 3420 1djdj.exe 4040 rrffrrr.exe 4952 hbthbh.exe 2576 nbtnbt.exe 2104 jvvdp.exe 2512 lrlxlfr.exe 2280 tttnhb.exe 3336 bbthth.exe 4436 pjjjd.exe 3428 frrlffx.exe 4048 xxrlflf.exe 3992 7htnhh.exe 412 pddvv.exe 4944 xrrlrlr.exe 1460 hhhbnt.exe 1300 btbbtb.exe 916 jdjdp.exe 1164 5rrrlrr.exe 4920 hbhhhn.exe 3976 pjjdv.exe 2548 rflffll.exe 3836 tthhnt.exe 4656 hhhbhb.exe 3728 5pppp.exe 940 9frrfll.exe 1332 7ttnnn.exe 4604 hnnhbb.exe 2444 jjvvd.exe 3532 pjpjd.exe 2556 rfxrffr.exe 2252 lllffff.exe 4340 nhnbnb.exe 2156 ppjjv.exe 3680 9pjdp.exe 1576 rlfxllf.exe 1840 fxxxrrx.exe 3196 9bhhtt.exe 3800 tnbnhb.exe 3644 jvpdv.exe 652 lrrfrlx.exe 3840 xrllfff.exe 1348 1bbbtt.exe 4820 nnnnhh.exe 4176 dpjvd.exe 2744 3xrxlfx.exe 2120 ffxfrfl.exe 216 nhhthn.exe 700 pvppp.exe 824 ddddp.exe 2152 3xrlxxx.exe 4640 rlllffx.exe 1560 3nhnhn.exe 1592 thttht.exe 1768 djddp.exe 912 jjvjj.exe 2592 rrxrrxx.exe 3128 5lllfxl.exe -
resource yara_rule behavioral2/memory/3880-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2088-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1144-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1524-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3944-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3944-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3420-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2576-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2512-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4436-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3428-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3992-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1460-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1300-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1164-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3880 wrote to memory of 3504 3880 dd2fe987376375b3a8651e640e6ba120_NeikiAnalytics.exe 89 PID 3880 wrote to memory of 3504 3880 dd2fe987376375b3a8651e640e6ba120_NeikiAnalytics.exe 89 PID 3880 wrote to memory of 3504 3880 dd2fe987376375b3a8651e640e6ba120_NeikiAnalytics.exe 89 PID 3504 wrote to memory of 2088 3504 7jpjd.exe 90 PID 3504 wrote to memory of 2088 3504 7jpjd.exe 90 PID 3504 wrote to memory of 2088 3504 7jpjd.exe 90 PID 2088 wrote to memory of 4776 2088 rxxxffx.exe 91 PID 2088 wrote to memory of 4776 2088 rxxxffx.exe 91 PID 2088 wrote to memory of 4776 2088 rxxxffx.exe 91 PID 4776 wrote to memory of 1144 4776 rfxffxl.exe 92 PID 4776 wrote to memory of 1144 4776 rfxffxl.exe 92 PID 4776 wrote to memory of 1144 4776 rfxffxl.exe 92 PID 1144 wrote to memory of 3036 1144 bnnhhb.exe 93 PID 1144 wrote to memory of 3036 1144 bnnhhb.exe 93 PID 1144 wrote to memory of 3036 1144 bnnhhb.exe 93 PID 3036 wrote to memory of 1524 3036 thttbn.exe 94 PID 3036 wrote to memory of 1524 3036 thttbn.exe 94 PID 3036 wrote to memory of 1524 3036 thttbn.exe 94 PID 1524 wrote to memory of 3944 1524 3xfxlfl.exe 95 PID 1524 wrote to memory of 3944 1524 3xfxlfl.exe 95 PID 1524 wrote to memory of 3944 1524 3xfxlfl.exe 95 PID 3944 wrote to memory of 3420 3944 nhnhbt.exe 96 PID 3944 wrote to memory of 3420 3944 nhnhbt.exe 96 PID 3944 wrote to memory of 3420 3944 nhnhbt.exe 96 PID 3420 wrote to memory of 4040 3420 1djdj.exe 97 PID 3420 wrote to memory of 4040 3420 1djdj.exe 97 PID 3420 wrote to memory of 4040 3420 1djdj.exe 97 PID 4040 wrote to memory of 4952 4040 rrffrrr.exe 98 PID 4040 wrote to memory of 4952 4040 rrffrrr.exe 98 PID 4040 wrote to memory of 4952 4040 rrffrrr.exe 98 PID 4952 wrote to memory of 2576 4952 hbthbh.exe 99 PID 4952 wrote to memory of 2576 4952 hbthbh.exe 99 PID 4952 wrote to memory of 2576 4952 hbthbh.exe 99 PID 2576 wrote to memory of 2104 2576 nbtnbt.exe 100 PID 2576 wrote to memory of 2104 2576 nbtnbt.exe 100 PID 2576 wrote to memory of 2104 2576 nbtnbt.exe 100 PID 2104 wrote to memory of 2512 2104 jvvdp.exe 102 PID 2104 wrote to memory of 2512 2104 jvvdp.exe 102 PID 2104 wrote to memory of 2512 2104 jvvdp.exe 102 PID 2512 wrote to memory of 2280 2512 lrlxlfr.exe 103 PID 2512 wrote to memory of 2280 2512 lrlxlfr.exe 103 PID 2512 wrote to memory of 2280 2512 lrlxlfr.exe 103 PID 2280 wrote to memory of 3336 2280 tttnhb.exe 104 PID 2280 wrote to memory of 3336 2280 tttnhb.exe 104 PID 2280 wrote to memory of 3336 2280 tttnhb.exe 104 PID 3336 wrote to memory of 4436 3336 bbthth.exe 105 PID 3336 wrote to memory of 4436 3336 bbthth.exe 105 PID 3336 wrote to memory of 4436 3336 bbthth.exe 105 PID 4436 wrote to memory of 3428 4436 pjjjd.exe 106 PID 4436 wrote to memory of 3428 4436 pjjjd.exe 106 PID 4436 wrote to memory of 3428 4436 pjjjd.exe 106 PID 3428 wrote to memory of 4048 3428 frrlffx.exe 107 PID 3428 wrote to memory of 4048 3428 frrlffx.exe 107 PID 3428 wrote to memory of 4048 3428 frrlffx.exe 107 PID 4048 wrote to memory of 3992 4048 xxrlflf.exe 108 PID 4048 wrote to memory of 3992 4048 xxrlflf.exe 108 PID 4048 wrote to memory of 3992 4048 xxrlflf.exe 108 PID 3992 wrote to memory of 412 3992 7htnhh.exe 109 PID 3992 wrote to memory of 412 3992 7htnhh.exe 109 PID 3992 wrote to memory of 412 3992 7htnhh.exe 109 PID 412 wrote to memory of 4944 412 pddvv.exe 110 PID 412 wrote to memory of 4944 412 pddvv.exe 110 PID 412 wrote to memory of 4944 412 pddvv.exe 110 PID 4944 wrote to memory of 1460 4944 xrrlrlr.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd2fe987376375b3a8651e640e6ba120_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\dd2fe987376375b3a8651e640e6ba120_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\7jpjd.exec:\7jpjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\rxxxffx.exec:\rxxxffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\rfxffxl.exec:\rfxffxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\bnnhhb.exec:\bnnhhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\thttbn.exec:\thttbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\3xfxlfl.exec:\3xfxlfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\nhnhbt.exec:\nhnhbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\1djdj.exec:\1djdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
\??\c:\rrffrrr.exec:\rrffrrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\hbthbh.exec:\hbthbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\nbtnbt.exec:\nbtnbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\jvvdp.exec:\jvvdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\lrlxlfr.exec:\lrlxlfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\tttnhb.exec:\tttnhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\bbthth.exec:\bbthth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
\??\c:\pjjjd.exec:\pjjjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\frrlffx.exec:\frrlffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\xxrlflf.exec:\xxrlflf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\7htnhh.exec:\7htnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\pddvv.exec:\pddvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
\??\c:\xrrlrlr.exec:\xrrlrlr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\hhhbnt.exec:\hhhbnt.exe23⤵
- Executes dropped EXE
PID:1460 -
\??\c:\btbbtb.exec:\btbbtb.exe24⤵
- Executes dropped EXE
PID:1300 -
\??\c:\jdjdp.exec:\jdjdp.exe25⤵
- Executes dropped EXE
PID:916 -
\??\c:\5rrrlrr.exec:\5rrrlrr.exe26⤵
- Executes dropped EXE
PID:1164 -
\??\c:\hbhhhn.exec:\hbhhhn.exe27⤵
- Executes dropped EXE
PID:4920 -
\??\c:\pjjdv.exec:\pjjdv.exe28⤵
- Executes dropped EXE
PID:3976 -
\??\c:\rflffll.exec:\rflffll.exe29⤵
- Executes dropped EXE
PID:2548 -
\??\c:\tthhnt.exec:\tthhnt.exe30⤵
- Executes dropped EXE
PID:3836 -
\??\c:\hhhbhb.exec:\hhhbhb.exe31⤵
- Executes dropped EXE
PID:4656 -
\??\c:\5pppp.exec:\5pppp.exe32⤵
- Executes dropped EXE
PID:3728 -
\??\c:\9frrfll.exec:\9frrfll.exe33⤵
- Executes dropped EXE
PID:940 -
\??\c:\7ttnnn.exec:\7ttnnn.exe34⤵
- Executes dropped EXE
PID:1332 -
\??\c:\hnnhbb.exec:\hnnhbb.exe35⤵
- Executes dropped EXE
PID:4604 -
\??\c:\jjvvd.exec:\jjvvd.exe36⤵
- Executes dropped EXE
PID:2444 -
\??\c:\pjpjd.exec:\pjpjd.exe37⤵
- Executes dropped EXE
PID:3532 -
\??\c:\rfxrffr.exec:\rfxrffr.exe38⤵
- Executes dropped EXE
PID:2556 -
\??\c:\lllffff.exec:\lllffff.exe39⤵
- Executes dropped EXE
PID:2252 -
\??\c:\nhnbnb.exec:\nhnbnb.exe40⤵
- Executes dropped EXE
PID:4340 -
\??\c:\ppjjv.exec:\ppjjv.exe41⤵
- Executes dropped EXE
PID:2156 -
\??\c:\9pjdp.exec:\9pjdp.exe42⤵
- Executes dropped EXE
PID:3680 -
\??\c:\rlfxllf.exec:\rlfxllf.exe43⤵
- Executes dropped EXE
PID:1576 -
\??\c:\fxxxrrx.exec:\fxxxrrx.exe44⤵
- Executes dropped EXE
PID:1840 -
\??\c:\9bhhtt.exec:\9bhhtt.exe45⤵
- Executes dropped EXE
PID:3196 -
\??\c:\tnbnhb.exec:\tnbnhb.exe46⤵
- Executes dropped EXE
PID:3800 -
\??\c:\jvpdv.exec:\jvpdv.exe47⤵
- Executes dropped EXE
PID:3644 -
\??\c:\lrrfrlx.exec:\lrrfrlx.exe48⤵
- Executes dropped EXE
PID:652 -
\??\c:\xrllfff.exec:\xrllfff.exe49⤵
- Executes dropped EXE
PID:3840 -
\??\c:\1bbbtt.exec:\1bbbtt.exe50⤵
- Executes dropped EXE
PID:1348 -
\??\c:\nnnnhh.exec:\nnnnhh.exe51⤵
- Executes dropped EXE
PID:4820 -
\??\c:\dpjvd.exec:\dpjvd.exe52⤵
- Executes dropped EXE
PID:4176 -
\??\c:\3xrxlfx.exec:\3xrxlfx.exe53⤵
- Executes dropped EXE
PID:2744 -
\??\c:\ffxfrfl.exec:\ffxfrfl.exe54⤵
- Executes dropped EXE
PID:2120 -
\??\c:\nhhthn.exec:\nhhthn.exe55⤵
- Executes dropped EXE
PID:216 -
\??\c:\pvppp.exec:\pvppp.exe56⤵
- Executes dropped EXE
PID:700 -
\??\c:\ddddp.exec:\ddddp.exe57⤵
- Executes dropped EXE
PID:824 -
\??\c:\3xrlxxx.exec:\3xrlxxx.exe58⤵
- Executes dropped EXE
PID:2152 -
\??\c:\rlllffx.exec:\rlllffx.exe59⤵
- Executes dropped EXE
PID:4640 -
\??\c:\3nhnhn.exec:\3nhnhn.exe60⤵
- Executes dropped EXE
PID:1560 -
\??\c:\thttht.exec:\thttht.exe61⤵
- Executes dropped EXE
PID:1592 -
\??\c:\djddp.exec:\djddp.exe62⤵
- Executes dropped EXE
PID:1768 -
\??\c:\jjvjj.exec:\jjvjj.exe63⤵
- Executes dropped EXE
PID:912 -
\??\c:\rrxrrxx.exec:\rrxrrxx.exe64⤵
- Executes dropped EXE
PID:2592 -
\??\c:\5lllfxl.exec:\5lllfxl.exe65⤵
- Executes dropped EXE
PID:3128 -
\??\c:\btbttt.exec:\btbttt.exe66⤵PID:4372
-
\??\c:\dppjd.exec:\dppjd.exe67⤵PID:5028
-
\??\c:\vpjvj.exec:\vpjvj.exe68⤵PID:2932
-
\??\c:\xllllrx.exec:\xllllrx.exe69⤵PID:3320
-
\??\c:\nnhbtt.exec:\nnhbtt.exe70⤵PID:1008
-
\??\c:\bhnnhh.exec:\bhnnhh.exe71⤵PID:3504
-
\??\c:\jdpjp.exec:\jdpjp.exe72⤵PID:1528
-
\??\c:\3jvjd.exec:\3jvjd.exe73⤵PID:4516
-
\??\c:\rfxffxr.exec:\rfxffxr.exe74⤵PID:2460
-
\??\c:\frxrllf.exec:\frxrllf.exe75⤵PID:1652
-
\??\c:\hntnnt.exec:\hntnnt.exe76⤵PID:2484
-
\??\c:\hnbthn.exec:\hnbthn.exe77⤵PID:1524
-
\??\c:\ddpjd.exec:\ddpjd.exe78⤵PID:4024
-
\??\c:\vvvjv.exec:\vvvjv.exe79⤵PID:2676
-
\??\c:\rlllxxx.exec:\rlllxxx.exe80⤵PID:820
-
\??\c:\rlfxllf.exec:\rlfxllf.exe81⤵PID:3896
-
\??\c:\thnnbt.exec:\thnnbt.exe82⤵PID:4292
-
\??\c:\1vvpv.exec:\1vvpv.exe83⤵PID:2072
-
\??\c:\dvvjj.exec:\dvvjj.exe84⤵PID:2464
-
\??\c:\lxllrfr.exec:\lxllrfr.exe85⤵PID:2512
-
\??\c:\frrllfr.exec:\frrllfr.exe86⤵PID:1104
-
\??\c:\nhbtbh.exec:\nhbtbh.exe87⤵PID:3292
-
\??\c:\hbthbt.exec:\hbthbt.exe88⤵PID:4624
-
\??\c:\vpjvj.exec:\vpjvj.exe89⤵PID:4124
-
\??\c:\xrxrffl.exec:\xrxrffl.exe90⤵PID:4436
-
\??\c:\9hhtnb.exec:\9hhtnb.exe91⤵PID:4064
-
\??\c:\bbbtbb.exec:\bbbtbb.exe92⤵PID:2716
-
\??\c:\3dvpd.exec:\3dvpd.exe93⤵PID:1600
-
\??\c:\frrlrrf.exec:\frrlrrf.exe94⤵PID:3184
-
\??\c:\rxrflrf.exec:\rxrflrf.exe95⤵PID:4760
-
\??\c:\nhbtnt.exec:\nhbtnt.exe96⤵PID:3264
-
\??\c:\7tthtn.exec:\7tthtn.exe97⤵PID:4904
-
\??\c:\jvpdd.exec:\jvpdd.exe98⤵PID:3372
-
\??\c:\lffxrlx.exec:\lffxrlx.exe99⤵PID:916
-
\??\c:\tthhbt.exec:\tthhbt.exe100⤵PID:4100
-
\??\c:\nnhthh.exec:\nnhthh.exe101⤵PID:2592
-
\??\c:\5vvdj.exec:\5vvdj.exe102⤵PID:828
-
\??\c:\xfxrxxl.exec:\xfxrxxl.exe103⤵PID:2640
-
\??\c:\rfrlxrl.exec:\rfrlxrl.exe104⤵PID:4316
-
\??\c:\htbtnb.exec:\htbtnb.exe105⤵PID:3320
-
\??\c:\hbhnhb.exec:\hbhnhb.exe106⤵PID:2256
-
\??\c:\pdjjv.exec:\pdjjv.exe107⤵PID:3220
-
\??\c:\3ppdp.exec:\3ppdp.exe108⤵PID:3332
-
\??\c:\lflxrrl.exec:\lflxrrl.exe109⤵PID:1608
-
\??\c:\pvddv.exec:\pvddv.exe110⤵PID:2460
-
\??\c:\dpjvv.exec:\dpjvv.exe111⤵PID:1652
-
\??\c:\1rffxxx.exec:\1rffxxx.exe112⤵PID:2316
-
\??\c:\7btttt.exec:\7btttt.exe113⤵PID:4340
-
\??\c:\bhtnhh.exec:\bhtnhh.exe114⤵PID:1264
-
\??\c:\jjjpv.exec:\jjjpv.exe115⤵PID:3680
-
\??\c:\dvddj.exec:\dvddj.exe116⤵PID:1888
-
\??\c:\xrxrlll.exec:\xrxrlll.exe117⤵PID:4952
-
\??\c:\bthbbn.exec:\bthbbn.exe118⤵PID:3800
-
\??\c:\dvvdp.exec:\dvvdp.exe119⤵PID:3644
-
\??\c:\xflfrrl.exec:\xflfrrl.exe120⤵PID:2464
-
\??\c:\7rrrlrl.exec:\7rrrlrl.exe121⤵PID:3840
-
\??\c:\bttthh.exec:\bttthh.exe122⤵PID:3988
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-