Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12-05-2024 02:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5cb0d450d7fd92027c25253ab302a620_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
5cb0d450d7fd92027c25253ab302a620_NeikiAnalytics.exe
-
Size
81KB
-
MD5
5cb0d450d7fd92027c25253ab302a620
-
SHA1
4ad4fb3741a00afd67f522bf7b52843c068ba3e9
-
SHA256
06435a78e67131cb48c0ed5383459395b4ac498d49b45995edebe32b6c2eeb15
-
SHA512
47d9a8352453c467bebf78d28e7fa74f26c22f49e89e3c12413250f39bb8366291bba406da1837e55bffd72faa35d54394b5eaf07972300fc8e70c3a76118533
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDInWeNCYGyA2R7JkZPsvX:ymb3NkkiQ3mdBjFIWeFGyA9Pc
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/1124-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3024-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4048-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4408-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2348-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3364-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3260-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2276-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2968-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1376-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1272-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1744-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3512-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2160-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3740-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4872-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2396-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1996-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4172-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5000-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3024 7lfrfxr.exe 4048 lfxllxr.exe 4408 7jdvp.exe 2348 pdpdv.exe 3364 hbtnnb.exe 3260 7pjvj.exe 2276 1xrfrlx.exe 2968 hbbttt.exe 1376 1jpdp.exe 1272 3flfxrl.exe 5064 httnnh.exe 3500 djjvp.exe 1744 xflrllf.exe 2028 nbbbhb.exe 3512 nbhtnn.exe 8 vjjvj.exe 3540 xxrxrlf.exe 2160 7bhtnt.exe 4544 jjdvp.exe 3740 dppjj.exe 1084 llxrrrr.exe 4124 bnhtnh.exe 4880 vjjdp.exe 4872 xlrlflx.exe 2396 rflrfrf.exe 1844 ntttth.exe 1996 vddvp.exe 4172 xffrlxr.exe 3448 rffrrrr.exe 3628 ttbtnh.exe 5000 vpvvj.exe 1968 7vjdv.exe 1172 5xxrxxl.exe 4832 lfxxrlf.exe 3180 nntnhn.exe 3492 tnthhh.exe 3640 pdvvp.exe 1832 xllxrrl.exe 2024 frrfxrl.exe 748 3tthnb.exe 4356 btbnhh.exe 2344 btnhtt.exe 112 5vpjv.exe 3680 pvvpd.exe 3364 rllffxx.exe 396 hbtnbb.exe 876 bttnnh.exe 4528 pjvvd.exe 3348 jdjdd.exe 700 5llxlfx.exe 4176 xrlrflf.exe 2828 bbnhnn.exe 4732 ddjdp.exe 228 vjpjv.exe 1792 9ffffxr.exe 3500 flrlfrl.exe 2540 bnnhnh.exe 1344 tnnbnh.exe 3320 djjdd.exe 5084 jvjdd.exe 8 9fxlrrr.exe 1468 thhhtb.exe 2808 pdjdv.exe 4736 9xffllr.exe -
resource yara_rule behavioral2/memory/1124-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3024-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4048-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2348-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3364-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3364-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3364-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3260-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2276-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1376-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1272-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1272-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1272-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1272-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1744-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3512-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2160-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3740-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4872-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2396-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4172-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-210-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1124 wrote to memory of 3024 1124 5cb0d450d7fd92027c25253ab302a620_NeikiAnalytics.exe 82 PID 1124 wrote to memory of 3024 1124 5cb0d450d7fd92027c25253ab302a620_NeikiAnalytics.exe 82 PID 1124 wrote to memory of 3024 1124 5cb0d450d7fd92027c25253ab302a620_NeikiAnalytics.exe 82 PID 3024 wrote to memory of 4048 3024 7lfrfxr.exe 83 PID 3024 wrote to memory of 4048 3024 7lfrfxr.exe 83 PID 3024 wrote to memory of 4048 3024 7lfrfxr.exe 83 PID 4048 wrote to memory of 4408 4048 lfxllxr.exe 84 PID 4048 wrote to memory of 4408 4048 lfxllxr.exe 84 PID 4048 wrote to memory of 4408 4048 lfxllxr.exe 84 PID 4408 wrote to memory of 2348 4408 7jdvp.exe 85 PID 4408 wrote to memory of 2348 4408 7jdvp.exe 85 PID 4408 wrote to memory of 2348 4408 7jdvp.exe 85 PID 2348 wrote to memory of 3364 2348 pdpdv.exe 86 PID 2348 wrote to memory of 3364 2348 pdpdv.exe 86 PID 2348 wrote to memory of 3364 2348 pdpdv.exe 86 PID 3364 wrote to memory of 3260 3364 hbtnnb.exe 87 PID 3364 wrote to memory of 3260 3364 hbtnnb.exe 87 PID 3364 wrote to memory of 3260 3364 hbtnnb.exe 87 PID 3260 wrote to memory of 2276 3260 7pjvj.exe 89 PID 3260 wrote to memory of 2276 3260 7pjvj.exe 89 PID 3260 wrote to memory of 2276 3260 7pjvj.exe 89 PID 2276 wrote to memory of 2968 2276 1xrfrlx.exe 90 PID 2276 wrote to memory of 2968 2276 1xrfrlx.exe 90 PID 2276 wrote to memory of 2968 2276 1xrfrlx.exe 90 PID 2968 wrote to memory of 1376 2968 hbbttt.exe 91 PID 2968 wrote to memory of 1376 2968 hbbttt.exe 91 PID 2968 wrote to memory of 1376 2968 hbbttt.exe 91 PID 1376 wrote to memory of 1272 1376 1jpdp.exe 92 PID 1376 wrote to memory of 1272 1376 1jpdp.exe 92 PID 1376 wrote to memory of 1272 1376 1jpdp.exe 92 PID 1272 wrote to memory of 5064 1272 3flfxrl.exe 94 PID 1272 wrote to memory of 5064 1272 3flfxrl.exe 94 PID 1272 wrote to memory of 5064 1272 3flfxrl.exe 94 PID 5064 wrote to memory of 3500 5064 httnnh.exe 95 PID 5064 wrote to memory of 3500 5064 httnnh.exe 95 PID 5064 wrote to memory of 3500 5064 httnnh.exe 95 PID 3500 wrote to memory of 1744 3500 djjvp.exe 96 PID 3500 wrote to memory of 1744 3500 djjvp.exe 96 PID 3500 wrote to memory of 1744 3500 djjvp.exe 96 PID 1744 wrote to memory of 2028 1744 xflrllf.exe 97 PID 1744 wrote to memory of 2028 1744 xflrllf.exe 97 PID 1744 wrote to memory of 2028 1744 xflrllf.exe 97 PID 2028 wrote to memory of 3512 2028 nbbbhb.exe 98 PID 2028 wrote to memory of 3512 2028 nbbbhb.exe 98 PID 2028 wrote to memory of 3512 2028 nbbbhb.exe 98 PID 3512 wrote to memory of 8 3512 nbhtnn.exe 99 PID 3512 wrote to memory of 8 3512 nbhtnn.exe 99 PID 3512 wrote to memory of 8 3512 nbhtnn.exe 99 PID 8 wrote to memory of 3540 8 vjjvj.exe 100 PID 8 wrote to memory of 3540 8 vjjvj.exe 100 PID 8 wrote to memory of 3540 8 vjjvj.exe 100 PID 3540 wrote to memory of 2160 3540 xxrxrlf.exe 101 PID 3540 wrote to memory of 2160 3540 xxrxrlf.exe 101 PID 3540 wrote to memory of 2160 3540 xxrxrlf.exe 101 PID 2160 wrote to memory of 4544 2160 7bhtnt.exe 102 PID 2160 wrote to memory of 4544 2160 7bhtnt.exe 102 PID 2160 wrote to memory of 4544 2160 7bhtnt.exe 102 PID 4544 wrote to memory of 3740 4544 jjdvp.exe 104 PID 4544 wrote to memory of 3740 4544 jjdvp.exe 104 PID 4544 wrote to memory of 3740 4544 jjdvp.exe 104 PID 3740 wrote to memory of 1084 3740 dppjj.exe 105 PID 3740 wrote to memory of 1084 3740 dppjj.exe 105 PID 3740 wrote to memory of 1084 3740 dppjj.exe 105 PID 1084 wrote to memory of 4124 1084 llxrrrr.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\5cb0d450d7fd92027c25253ab302a620_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5cb0d450d7fd92027c25253ab302a620_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1124 -
\??\c:\7lfrfxr.exec:\7lfrfxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\lfxllxr.exec:\lfxllxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\7jdvp.exec:\7jdvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\pdpdv.exec:\pdpdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\hbtnnb.exec:\hbtnnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
\??\c:\7pjvj.exec:\7pjvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\1xrfrlx.exec:\1xrfrlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\hbbttt.exec:\hbbttt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\1jpdp.exec:\1jpdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\3flfxrl.exec:\3flfxrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\httnnh.exec:\httnnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\djjvp.exec:\djjvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\xflrllf.exec:\xflrllf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\nbbbhb.exec:\nbbbhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\nbhtnn.exec:\nbhtnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\vjjvj.exec:\vjjvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\xxrxrlf.exec:\xxrxrlf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\7bhtnt.exec:\7bhtnt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\jjdvp.exec:\jjdvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\dppjj.exec:\dppjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\llxrrrr.exec:\llxrrrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\bnhtnh.exec:\bnhtnh.exe23⤵
- Executes dropped EXE
PID:4124 -
\??\c:\vjjdp.exec:\vjjdp.exe24⤵
- Executes dropped EXE
PID:4880 -
\??\c:\xlrlflx.exec:\xlrlflx.exe25⤵
- Executes dropped EXE
PID:4872 -
\??\c:\rflrfrf.exec:\rflrfrf.exe26⤵
- Executes dropped EXE
PID:2396 -
\??\c:\ntttth.exec:\ntttth.exe27⤵
- Executes dropped EXE
PID:1844 -
\??\c:\vddvp.exec:\vddvp.exe28⤵
- Executes dropped EXE
PID:1996 -
\??\c:\xffrlxr.exec:\xffrlxr.exe29⤵
- Executes dropped EXE
PID:4172 -
\??\c:\rffrrrr.exec:\rffrrrr.exe30⤵
- Executes dropped EXE
PID:3448 -
\??\c:\ttbtnh.exec:\ttbtnh.exe31⤵
- Executes dropped EXE
PID:3628 -
\??\c:\vpvvj.exec:\vpvvj.exe32⤵
- Executes dropped EXE
PID:5000 -
\??\c:\7vjdv.exec:\7vjdv.exe33⤵
- Executes dropped EXE
PID:1968 -
\??\c:\5xxrxxl.exec:\5xxrxxl.exe34⤵
- Executes dropped EXE
PID:1172 -
\??\c:\lfxxrlf.exec:\lfxxrlf.exe35⤵
- Executes dropped EXE
PID:4832 -
\??\c:\nntnhn.exec:\nntnhn.exe36⤵
- Executes dropped EXE
PID:3180 -
\??\c:\tnthhh.exec:\tnthhh.exe37⤵
- Executes dropped EXE
PID:3492 -
\??\c:\pdvvp.exec:\pdvvp.exe38⤵
- Executes dropped EXE
PID:3640 -
\??\c:\xllxrrl.exec:\xllxrrl.exe39⤵
- Executes dropped EXE
PID:1832 -
\??\c:\frrfxrl.exec:\frrfxrl.exe40⤵
- Executes dropped EXE
PID:2024 -
\??\c:\3tthnb.exec:\3tthnb.exe41⤵
- Executes dropped EXE
PID:748 -
\??\c:\btbnhh.exec:\btbnhh.exe42⤵
- Executes dropped EXE
PID:4356 -
\??\c:\btnhtt.exec:\btnhtt.exe43⤵
- Executes dropped EXE
PID:2344 -
\??\c:\5vpjv.exec:\5vpjv.exe44⤵
- Executes dropped EXE
PID:112 -
\??\c:\pvvpd.exec:\pvvpd.exe45⤵
- Executes dropped EXE
PID:3680 -
\??\c:\rllffxx.exec:\rllffxx.exe46⤵
- Executes dropped EXE
PID:3364 -
\??\c:\hbtnbb.exec:\hbtnbb.exe47⤵
- Executes dropped EXE
PID:396 -
\??\c:\bttnnh.exec:\bttnnh.exe48⤵
- Executes dropped EXE
PID:876 -
\??\c:\pjvvd.exec:\pjvvd.exe49⤵
- Executes dropped EXE
PID:4528 -
\??\c:\jdjdd.exec:\jdjdd.exe50⤵
- Executes dropped EXE
PID:3348 -
\??\c:\5llxlfx.exec:\5llxlfx.exe51⤵
- Executes dropped EXE
PID:700 -
\??\c:\xrlrflf.exec:\xrlrflf.exe52⤵
- Executes dropped EXE
PID:4176 -
\??\c:\bbnhnn.exec:\bbnhnn.exe53⤵
- Executes dropped EXE
PID:2828 -
\??\c:\ddjdp.exec:\ddjdp.exe54⤵
- Executes dropped EXE
PID:4732 -
\??\c:\vjpjv.exec:\vjpjv.exe55⤵
- Executes dropped EXE
PID:228 -
\??\c:\9ffffxr.exec:\9ffffxr.exe56⤵
- Executes dropped EXE
PID:1792 -
\??\c:\flrlfrl.exec:\flrlfrl.exe57⤵
- Executes dropped EXE
PID:3500 -
\??\c:\bnnhnh.exec:\bnnhnh.exe58⤵
- Executes dropped EXE
PID:2540 -
\??\c:\tnnbnh.exec:\tnnbnh.exe59⤵
- Executes dropped EXE
PID:1344 -
\??\c:\djjdd.exec:\djjdd.exe60⤵
- Executes dropped EXE
PID:3320 -
\??\c:\jvjdd.exec:\jvjdd.exe61⤵
- Executes dropped EXE
PID:5084 -
\??\c:\9fxlrrr.exec:\9fxlrrr.exe62⤵
- Executes dropped EXE
PID:8 -
\??\c:\thhhtb.exec:\thhhtb.exe63⤵
- Executes dropped EXE
PID:1468 -
\??\c:\pdjdv.exec:\pdjdv.exe64⤵
- Executes dropped EXE
PID:2808 -
\??\c:\9xffllr.exec:\9xffllr.exe65⤵
- Executes dropped EXE
PID:4736 -
\??\c:\7lrlfff.exec:\7lrlfff.exe66⤵PID:2000
-
\??\c:\btnnhh.exec:\btnnhh.exe67⤵PID:3668
-
\??\c:\tnnnbb.exec:\tnnnbb.exe68⤵PID:2644
-
\??\c:\vpvpd.exec:\vpvpd.exe69⤵PID:1692
-
\??\c:\vddvj.exec:\vddvj.exe70⤵PID:4624
-
\??\c:\lfxrxrf.exec:\lfxrxrf.exe71⤵PID:4156
-
\??\c:\frlfxlr.exec:\frlfxlr.exe72⤵PID:2752
-
\??\c:\3nnbtt.exec:\3nnbtt.exe73⤵PID:116
-
\??\c:\thnhtn.exec:\thnhtn.exe74⤵PID:2376
-
\??\c:\ddpjv.exec:\ddpjv.exe75⤵PID:4068
-
\??\c:\7jjdd.exec:\7jjdd.exe76⤵PID:2280
-
\??\c:\xrxxlfx.exec:\xrxxlfx.exe77⤵PID:2436
-
\??\c:\5xxrllx.exec:\5xxrllx.exe78⤵PID:428
-
\??\c:\bbbhnt.exec:\bbbhnt.exe79⤵PID:2260
-
\??\c:\pjdpj.exec:\pjdpj.exe80⤵PID:4972
-
\??\c:\pddvj.exec:\pddvj.exe81⤵PID:1968
-
\??\c:\frxxlfx.exec:\frxxlfx.exe82⤵PID:2492
-
\??\c:\xflfxrr.exec:\xflfxrr.exe83⤵PID:3220
-
\??\c:\5bhbtt.exec:\5bhbtt.exe84⤵PID:1384
-
\??\c:\7ntnnt.exec:\7ntnnt.exe85⤵PID:4660
-
\??\c:\bhhbnh.exec:\bhhbnh.exe86⤵PID:5036
-
\??\c:\pvvjv.exec:\pvvjv.exe87⤵PID:1920
-
\??\c:\1ppdv.exec:\1ppdv.exe88⤵PID:752
-
\??\c:\rlxrffx.exec:\rlxrffx.exe89⤵PID:3296
-
\??\c:\fxrllff.exec:\fxrllff.exe90⤵PID:4540
-
\??\c:\1nhbtn.exec:\1nhbtn.exe91⤵PID:1228
-
\??\c:\bnnnhb.exec:\bnnnhb.exe92⤵PID:948
-
\??\c:\ppdvp.exec:\ppdvp.exe93⤵PID:1712
-
\??\c:\pddvp.exec:\pddvp.exe94⤵PID:3792
-
\??\c:\pddpj.exec:\pddpj.exe95⤵PID:4036
-
\??\c:\fxlffxr.exec:\fxlffxr.exe96⤵PID:3280
-
\??\c:\1llxrrl.exec:\1llxrrl.exe97⤵PID:3572
-
\??\c:\httnhh.exec:\httnhh.exe98⤵PID:1764
-
\??\c:\9rlrflx.exec:\9rlrflx.exe99⤵PID:2204
-
\??\c:\lflflfx.exec:\lflflfx.exe100⤵PID:892
-
\??\c:\bthbtt.exec:\bthbtt.exe101⤵PID:3724
-
\??\c:\dpvvp.exec:\dpvvp.exe102⤵PID:4864
-
\??\c:\vpppj.exec:\vpppj.exe103⤵PID:4140
-
\??\c:\7rxrllf.exec:\7rxrllf.exe104⤵PID:2104
-
\??\c:\frrfxlf.exec:\frrfxlf.exe105⤵PID:2028
-
\??\c:\nbtntn.exec:\nbtntn.exe106⤵PID:4856
-
\??\c:\hnnhbt.exec:\hnnhbt.exe107⤵PID:4708
-
\??\c:\ddvjj.exec:\ddvjj.exe108⤵PID:4132
-
\??\c:\vjdpj.exec:\vjdpj.exe109⤵PID:1392
-
\??\c:\ffrlxrl.exec:\ffrlxrl.exe110⤵PID:1568
-
\??\c:\lfxrlff.exec:\lfxrlff.exe111⤵PID:2964
-
\??\c:\httnhh.exec:\httnhh.exe112⤵PID:4736
-
\??\c:\jddvp.exec:\jddvp.exe113⤵PID:1104
-
\??\c:\7rxlllr.exec:\7rxlllr.exe114⤵PID:3812
-
\??\c:\7lllxxl.exec:\7lllxxl.exe115⤵PID:4996
-
\??\c:\3ttnnh.exec:\3ttnnh.exe116⤵PID:4656
-
\??\c:\nbtnhh.exec:\nbtnhh.exe117⤵PID:4880
-
\??\c:\7vpjp.exec:\7vpjp.exe118⤵PID:4156
-
\??\c:\dvpjv.exec:\dvpjv.exe119⤵PID:3700
-
\??\c:\9lfrfxr.exec:\9lfrfxr.exe120⤵PID:4604
-
\??\c:\xrrfxrf.exec:\xrrfxrf.exe121⤵PID:2264
-
\??\c:\5nthhh.exec:\5nthhh.exe122⤵PID:1988
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-