Analysis
-
max time kernel
149s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29/06/2024, 17:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b54dda49a473910eaf8a39e808f500baadaa308bbd9408d17fcfc516bca6e40a_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
b54dda49a473910eaf8a39e808f500baadaa308bbd9408d17fcfc516bca6e40a_NeikiAnalytics.exe
-
Size
91KB
-
MD5
16ae94277796c64ad2ecd25b1d6d34c0
-
SHA1
b83e291170dcc213aff6efcbd804d53f6b687158
-
SHA256
b54dda49a473910eaf8a39e808f500baadaa308bbd9408d17fcfc516bca6e40a
-
SHA512
b7ddc55408498c0535e937a9e46c4cd0b20c3198a1d09cad232a327012cd6a2f418a7d916f5c60d3cc8022b5011d4cc1e6446b92e4dd181b35015a3d1ee28094
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIQIDyviFxx2hCtgIMLP9rBZaRBV:ymb3NkkiQ3mdBjFIVLd2hWZGreRCYBx
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/4572-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1996-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1452-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1704-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1020-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3320-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1472-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4204-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4728-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2624-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2656-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2644-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5040-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3424-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4432-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4964-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4132-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4000-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2640-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4464-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2948-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3048-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1160-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1996 jpppj.exe 1452 hbnnnt.exe 1704 thttbn.exe 1020 xxflfrl.exe 3320 thnhtt.exe 1472 vjpjj.exe 4204 7lxxxxf.exe 4844 hbnnnn.exe 4728 vdpjd.exe 2624 xxrffff.exe 1596 jdjpj.exe 2656 ffrxxll.exe 2644 xfxfrff.exe 5040 pjvpd.exe 3424 rrffxff.exe 4432 thhtth.exe 4496 pvvpp.exe 4964 frrfffx.exe 4132 xxxffxf.exe 4000 nbnbht.exe 3124 pjvvp.exe 3428 xflrlrl.exe 4588 dppjj.exe 4940 lxlxlrr.exe 2640 bntbbh.exe 4464 pdppv.exe 2340 5nnnhn.exe 2948 nnhhht.exe 3048 9ffllrr.exe 4652 vppvv.exe 1160 fllrrxr.exe 4708 llxfxrr.exe 1392 nhttbt.exe 2332 dddjv.exe 4896 ffrrrxf.exe 776 tnbhnt.exe 4648 hhnnhn.exe 3932 vvjpp.exe 408 fxffxff.exe 3544 vdddv.exe 3992 vvjjj.exe 3284 dpvdp.exe 1104 bhtbbb.exe 1656 vjpjj.exe 4712 xfffxff.exe 1700 9thnbh.exe 3328 pvddd.exe 2268 rxlffxl.exe 4376 bbnbtn.exe 1904 7dpdd.exe 3628 dddvv.exe 1452 xfllfff.exe 1072 hhthtb.exe 4716 jjjjd.exe 4136 xlllffl.exe 3688 xfffxxr.exe 2288 bnthhh.exe 2988 ddddp.exe 3364 dvjdd.exe 1192 rfrrxff.exe 3900 nbtbtb.exe 2696 hntthh.exe 1920 1djjd.exe 1256 rxrxxxx.exe -
resource yara_rule behavioral2/memory/4572-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1452-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1020-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3320-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1472-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4204-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4728-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2624-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2624-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2656-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2644-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5040-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3424-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4432-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4964-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4132-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4000-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2640-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2948-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3048-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1160-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4572 wrote to memory of 1996 4572 b54dda49a473910eaf8a39e808f500baadaa308bbd9408d17fcfc516bca6e40a_NeikiAnalytics.exe 80 PID 4572 wrote to memory of 1996 4572 b54dda49a473910eaf8a39e808f500baadaa308bbd9408d17fcfc516bca6e40a_NeikiAnalytics.exe 80 PID 4572 wrote to memory of 1996 4572 b54dda49a473910eaf8a39e808f500baadaa308bbd9408d17fcfc516bca6e40a_NeikiAnalytics.exe 80 PID 1996 wrote to memory of 1452 1996 jpppj.exe 81 PID 1996 wrote to memory of 1452 1996 jpppj.exe 81 PID 1996 wrote to memory of 1452 1996 jpppj.exe 81 PID 1452 wrote to memory of 1704 1452 hbnnnt.exe 82 PID 1452 wrote to memory of 1704 1452 hbnnnt.exe 82 PID 1452 wrote to memory of 1704 1452 hbnnnt.exe 82 PID 1704 wrote to memory of 1020 1704 thttbn.exe 83 PID 1704 wrote to memory of 1020 1704 thttbn.exe 83 PID 1704 wrote to memory of 1020 1704 thttbn.exe 83 PID 1020 wrote to memory of 3320 1020 xxflfrl.exe 84 PID 1020 wrote to memory of 3320 1020 xxflfrl.exe 84 PID 1020 wrote to memory of 3320 1020 xxflfrl.exe 84 PID 3320 wrote to memory of 1472 3320 thnhtt.exe 85 PID 3320 wrote to memory of 1472 3320 thnhtt.exe 85 PID 3320 wrote to memory of 1472 3320 thnhtt.exe 85 PID 1472 wrote to memory of 4204 1472 vjpjj.exe 86 PID 1472 wrote to memory of 4204 1472 vjpjj.exe 86 PID 1472 wrote to memory of 4204 1472 vjpjj.exe 86 PID 4204 wrote to memory of 4844 4204 7lxxxxf.exe 87 PID 4204 wrote to memory of 4844 4204 7lxxxxf.exe 87 PID 4204 wrote to memory of 4844 4204 7lxxxxf.exe 87 PID 4844 wrote to memory of 4728 4844 hbnnnn.exe 88 PID 4844 wrote to memory of 4728 4844 hbnnnn.exe 88 PID 4844 wrote to memory of 4728 4844 hbnnnn.exe 88 PID 4728 wrote to memory of 2624 4728 vdpjd.exe 89 PID 4728 wrote to memory of 2624 4728 vdpjd.exe 89 PID 4728 wrote to memory of 2624 4728 vdpjd.exe 89 PID 2624 wrote to memory of 1596 2624 xxrffff.exe 90 PID 2624 wrote to memory of 1596 2624 xxrffff.exe 90 PID 2624 wrote to memory of 1596 2624 xxrffff.exe 90 PID 1596 wrote to memory of 2656 1596 jdjpj.exe 91 PID 1596 wrote to memory of 2656 1596 jdjpj.exe 91 PID 1596 wrote to memory of 2656 1596 jdjpj.exe 91 PID 2656 wrote to memory of 2644 2656 ffrxxll.exe 92 PID 2656 wrote to memory of 2644 2656 ffrxxll.exe 92 PID 2656 wrote to memory of 2644 2656 ffrxxll.exe 92 PID 2644 wrote to memory of 5040 2644 xfxfrff.exe 93 PID 2644 wrote to memory of 5040 2644 xfxfrff.exe 93 PID 2644 wrote to memory of 5040 2644 xfxfrff.exe 93 PID 5040 wrote to memory of 3424 5040 pjvpd.exe 94 PID 5040 wrote to memory of 3424 5040 pjvpd.exe 94 PID 5040 wrote to memory of 3424 5040 pjvpd.exe 94 PID 3424 wrote to memory of 4432 3424 rrffxff.exe 95 PID 3424 wrote to memory of 4432 3424 rrffxff.exe 95 PID 3424 wrote to memory of 4432 3424 rrffxff.exe 95 PID 4432 wrote to memory of 4496 4432 thhtth.exe 96 PID 4432 wrote to memory of 4496 4432 thhtth.exe 96 PID 4432 wrote to memory of 4496 4432 thhtth.exe 96 PID 4496 wrote to memory of 4964 4496 pvvpp.exe 97 PID 4496 wrote to memory of 4964 4496 pvvpp.exe 97 PID 4496 wrote to memory of 4964 4496 pvvpp.exe 97 PID 4964 wrote to memory of 4132 4964 frrfffx.exe 98 PID 4964 wrote to memory of 4132 4964 frrfffx.exe 98 PID 4964 wrote to memory of 4132 4964 frrfffx.exe 98 PID 4132 wrote to memory of 4000 4132 xxxffxf.exe 99 PID 4132 wrote to memory of 4000 4132 xxxffxf.exe 99 PID 4132 wrote to memory of 4000 4132 xxxffxf.exe 99 PID 4000 wrote to memory of 3124 4000 nbnbht.exe 100 PID 4000 wrote to memory of 3124 4000 nbnbht.exe 100 PID 4000 wrote to memory of 3124 4000 nbnbht.exe 100 PID 3124 wrote to memory of 3428 3124 pjvvp.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\b54dda49a473910eaf8a39e808f500baadaa308bbd9408d17fcfc516bca6e40a_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b54dda49a473910eaf8a39e808f500baadaa308bbd9408d17fcfc516bca6e40a_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\jpppj.exec:\jpppj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\hbnnnt.exec:\hbnnnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\thttbn.exec:\thttbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\xxflfrl.exec:\xxflfrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\thnhtt.exec:\thnhtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\vjpjj.exec:\vjpjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\7lxxxxf.exec:\7lxxxxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
\??\c:\hbnnnn.exec:\hbnnnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\vdpjd.exec:\vdpjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\xxrffff.exec:\xxrffff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\jdjpj.exec:\jdjpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\ffrxxll.exec:\ffrxxll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\xfxfrff.exec:\xfxfrff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\pjvpd.exec:\pjvpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\rrffxff.exec:\rrffxff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\thhtth.exec:\thhtth.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\pvvpp.exec:\pvvpp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\frrfffx.exec:\frrfffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\xxxffxf.exec:\xxxffxf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\nbnbht.exec:\nbnbht.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\pjvvp.exec:\pjvvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\xflrlrl.exec:\xflrlrl.exe23⤵
- Executes dropped EXE
PID:3428 -
\??\c:\dppjj.exec:\dppjj.exe24⤵
- Executes dropped EXE
PID:4588 -
\??\c:\lxlxlrr.exec:\lxlxlrr.exe25⤵
- Executes dropped EXE
PID:4940 -
\??\c:\bntbbh.exec:\bntbbh.exe26⤵
- Executes dropped EXE
PID:2640 -
\??\c:\pdppv.exec:\pdppv.exe27⤵
- Executes dropped EXE
PID:4464 -
\??\c:\5nnnhn.exec:\5nnnhn.exe28⤵
- Executes dropped EXE
PID:2340 -
\??\c:\nnhhht.exec:\nnhhht.exe29⤵
- Executes dropped EXE
PID:2948 -
\??\c:\9ffllrr.exec:\9ffllrr.exe30⤵
- Executes dropped EXE
PID:3048 -
\??\c:\vppvv.exec:\vppvv.exe31⤵
- Executes dropped EXE
PID:4652 -
\??\c:\fllrrxr.exec:\fllrrxr.exe32⤵
- Executes dropped EXE
PID:1160 -
\??\c:\llxfxrr.exec:\llxfxrr.exe33⤵
- Executes dropped EXE
PID:4708 -
\??\c:\nhttbt.exec:\nhttbt.exe34⤵
- Executes dropped EXE
PID:1392 -
\??\c:\dddjv.exec:\dddjv.exe35⤵
- Executes dropped EXE
PID:2332 -
\??\c:\ffrrrxf.exec:\ffrrrxf.exe36⤵
- Executes dropped EXE
PID:4896 -
\??\c:\tnbhnt.exec:\tnbhnt.exe37⤵
- Executes dropped EXE
PID:776 -
\??\c:\hhnnhn.exec:\hhnnhn.exe38⤵
- Executes dropped EXE
PID:4648 -
\??\c:\vvjpp.exec:\vvjpp.exe39⤵
- Executes dropped EXE
PID:3932 -
\??\c:\fxffxff.exec:\fxffxff.exe40⤵
- Executes dropped EXE
PID:408 -
\??\c:\vdddv.exec:\vdddv.exe41⤵
- Executes dropped EXE
PID:3544 -
\??\c:\vvjjj.exec:\vvjjj.exe42⤵
- Executes dropped EXE
PID:3992 -
\??\c:\dpvdp.exec:\dpvdp.exe43⤵
- Executes dropped EXE
PID:3284 -
\??\c:\bhtbbb.exec:\bhtbbb.exe44⤵
- Executes dropped EXE
PID:1104 -
\??\c:\vjpjj.exec:\vjpjj.exe45⤵
- Executes dropped EXE
PID:1656 -
\??\c:\xfffxff.exec:\xfffxff.exe46⤵
- Executes dropped EXE
PID:4712 -
\??\c:\9thnbh.exec:\9thnbh.exe47⤵
- Executes dropped EXE
PID:1700 -
\??\c:\pvddd.exec:\pvddd.exe48⤵
- Executes dropped EXE
PID:3328 -
\??\c:\rxlffxl.exec:\rxlffxl.exe49⤵
- Executes dropped EXE
PID:2268 -
\??\c:\bbnbtn.exec:\bbnbtn.exe50⤵
- Executes dropped EXE
PID:4376 -
\??\c:\7dpdd.exec:\7dpdd.exe51⤵
- Executes dropped EXE
PID:1904 -
\??\c:\dddvv.exec:\dddvv.exe52⤵
- Executes dropped EXE
PID:3628 -
\??\c:\xfllfff.exec:\xfllfff.exe53⤵
- Executes dropped EXE
PID:1452 -
\??\c:\hhthtb.exec:\hhthtb.exe54⤵
- Executes dropped EXE
PID:1072 -
\??\c:\jjjjd.exec:\jjjjd.exe55⤵
- Executes dropped EXE
PID:4716 -
\??\c:\xlllffl.exec:\xlllffl.exe56⤵
- Executes dropped EXE
PID:4136 -
\??\c:\xfffxxr.exec:\xfffxxr.exe57⤵
- Executes dropped EXE
PID:3688 -
\??\c:\bnthhh.exec:\bnthhh.exe58⤵
- Executes dropped EXE
PID:2288 -
\??\c:\ddddp.exec:\ddddp.exe59⤵
- Executes dropped EXE
PID:2988 -
\??\c:\dvjdd.exec:\dvjdd.exe60⤵
- Executes dropped EXE
PID:3364 -
\??\c:\rfrrxff.exec:\rfrrxff.exe61⤵
- Executes dropped EXE
PID:1192 -
\??\c:\nbtbtb.exec:\nbtbtb.exe62⤵
- Executes dropped EXE
PID:3900 -
\??\c:\hntthh.exec:\hntthh.exe63⤵
- Executes dropped EXE
PID:2696 -
\??\c:\1djjd.exec:\1djjd.exe64⤵
- Executes dropped EXE
PID:1920 -
\??\c:\rxrxxxx.exec:\rxrxxxx.exe65⤵
- Executes dropped EXE
PID:1256 -
\??\c:\3tnnnt.exec:\3tnnnt.exe66⤵PID:4564
-
\??\c:\ttbbth.exec:\ttbbth.exe67⤵PID:2132
-
\??\c:\vjjjj.exec:\vjjjj.exe68⤵PID:2760
-
\??\c:\9xxfrfl.exec:\9xxfrfl.exe69⤵PID:2992
-
\??\c:\xxflxlr.exec:\xxflxlr.exe70⤵PID:3128
-
\??\c:\5bntnt.exec:\5bntnt.exe71⤵PID:2980
-
\??\c:\vvppv.exec:\vvppv.exe72⤵PID:4992
-
\??\c:\ddpvv.exec:\ddpvv.exe73⤵PID:1012
-
\??\c:\3lrxxfl.exec:\3lrxxfl.exe74⤵PID:5072
-
\??\c:\nhhnth.exec:\nhhnth.exe75⤵PID:4496
-
\??\c:\jdvpp.exec:\jdvpp.exe76⤵PID:2952
-
\??\c:\9pvvd.exec:\9pvvd.exe77⤵PID:2412
-
\??\c:\flxlrlr.exec:\flxlrlr.exe78⤵PID:4236
-
\??\c:\5bhnnt.exec:\5bhnnt.exe79⤵PID:4200
-
\??\c:\jvvvp.exec:\jvvvp.exe80⤵PID:3896
-
\??\c:\9jppj.exec:\9jppj.exe81⤵PID:1100
-
\??\c:\xfrlxlr.exec:\xfrlxlr.exe82⤵PID:4768
-
\??\c:\bttthn.exec:\bttthn.exe83⤵PID:4940
-
\??\c:\vjvpv.exec:\vjvpv.exe84⤵PID:2076
-
\??\c:\ffrxlrf.exec:\ffrxlrf.exe85⤵PID:4948
-
\??\c:\bthnnb.exec:\bthnnb.exe86⤵PID:1052
-
\??\c:\jpvdv.exec:\jpvdv.exe87⤵PID:3380
-
\??\c:\tntnnt.exec:\tntnnt.exe88⤵PID:2948
-
\??\c:\jvjpp.exec:\jvjpp.exe89⤵PID:808
-
\??\c:\vjppj.exec:\vjppj.exe90⤵PID:4216
-
\??\c:\lllfflr.exec:\lllfflr.exe91⤵PID:1400
-
\??\c:\bnntth.exec:\bnntth.exe92⤵PID:1752
-
\??\c:\1pppp.exec:\1pppp.exe93⤵PID:856
-
\??\c:\jvpjj.exec:\jvpjj.exe94⤵PID:3760
-
\??\c:\rxxxxff.exec:\rxxxxff.exe95⤵PID:5016
-
\??\c:\nnnbtt.exec:\nnnbtt.exe96⤵PID:3664
-
\??\c:\jvjjj.exec:\jvjjj.exe97⤵PID:1016
-
\??\c:\lffrfrf.exec:\lffrfrf.exe98⤵PID:2500
-
\??\c:\frrflxr.exec:\frrflxr.exe99⤵PID:4856
-
\??\c:\ntttbb.exec:\ntttbb.exe100⤵PID:4312
-
\??\c:\djvvv.exec:\djvvv.exe101⤵PID:3408
-
\??\c:\jjpvd.exec:\jjpvd.exe102⤵PID:1896
-
\??\c:\lxfxflf.exec:\lxfxflf.exe103⤵PID:2820
-
\??\c:\bntbtb.exec:\bntbtb.exe104⤵PID:4788
-
\??\c:\pjvvv.exec:\pjvvv.exe105⤵PID:1108
-
\??\c:\vpjjd.exec:\vpjjd.exe106⤵PID:1784
-
\??\c:\xfxrlfr.exec:\xfxrlfr.exe107⤵PID:4568
-
\??\c:\thhnnn.exec:\thhnnn.exe108⤵PID:4360
-
\??\c:\bnhhnn.exec:\bnhhnn.exe109⤵PID:2308
-
\??\c:\pvjvv.exec:\pvjvv.exe110⤵PID:3504
-
\??\c:\rrxrxrx.exec:\rrxrxrx.exe111⤵PID:2764
-
\??\c:\xxxxrrr.exec:\xxxxrrr.exe112⤵PID:1072
-
\??\c:\hhnbnh.exec:\hhnbnh.exe113⤵PID:1508
-
\??\c:\ddjdj.exec:\ddjdj.exe114⤵PID:4172
-
\??\c:\1rxxrxx.exec:\1rxxrxx.exe115⤵PID:2288
-
\??\c:\fxxxlfl.exec:\fxxxlfl.exe116⤵PID:3964
-
\??\c:\thbhbt.exec:\thbhbt.exe117⤵PID:1192
-
\??\c:\nbttnt.exec:\nbttnt.exe118⤵PID:4872
-
\??\c:\pppvv.exec:\pppvv.exe119⤵PID:3004
-
\??\c:\flfxlxr.exec:\flfxlxr.exe120⤵PID:3704
-
\??\c:\xrfxxxr.exec:\xrfxxxr.exe121⤵PID:2960
-
\??\c:\ttbbbh.exec:\ttbbbh.exe122⤵PID:3088
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-