Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
12/05/2024, 13:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
14ba7ca65a45fbb0f9debfdd0e0c8010_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
14ba7ca65a45fbb0f9debfdd0e0c8010_NeikiAnalytics.exe
-
Size
145KB
-
MD5
14ba7ca65a45fbb0f9debfdd0e0c8010
-
SHA1
8c3c03abf076c11372abd0f17f3df5d92dcdcf03
-
SHA256
0a2c1a8883faa63329c8a8efd7920c17c8ce1ea6748e9925cf4209dc1e346c99
-
SHA512
d1f692c3e40db80a2cfcec5d6e6ee40717b5e7963a7d92060e8a9911efa40286031a96eafb8263463ab7897cd57d919b0dc292c88cfa8964e43b24eeca2c91ae
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp9gFbctg0IyAyhZvjDUOy/nmPmT9seU:n3C9BRo7tvnJ9oH0IRgZvjDhy+PmxseU
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/3444-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3472-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/616-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4668-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3028-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4108-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1364-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3616-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3036-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2724-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4328-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2192-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3540-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4680-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2772-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3368-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4260-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2780-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2544-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2388-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4748-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1560-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3472 lfrfrxx.exe 616 xfrfrlx.exe 4668 bhtthn.exe 3028 vpvvv.exe 4108 dpppp.exe 1364 nhttnt.exe 3616 vdvdj.exe 3036 rlrlfxf.exe 3976 tbhhnh.exe 2724 pdjvp.exe 4328 rrxrxxf.exe 2192 hthhtt.exe 4644 ppvvv.exe 4448 fxllfll.exe 3540 xxfxfxl.exe 4892 bntnnt.exe 3408 dpppp.exe 4680 fffxffr.exe 4920 hbbnnn.exe 2772 nbhhhh.exe 3368 vjpjd.exe 4260 fflrxrf.exe 3260 bthhbh.exe 2780 5jppp.exe 1832 pvjjp.exe 2388 lfxlflx.exe 2544 htnthn.exe 2664 hthhhn.exe 4748 ddvjj.exe 1560 xlrffrf.exe 3228 tthbhn.exe 3088 hbbbth.exe 1108 dvjdv.exe 1528 vpvdv.exe 3940 fllrxfx.exe 3084 bttnnn.exe 2848 djjpv.exe 4204 vpjjv.exe 3888 xrflrxl.exe 3952 nhbtnt.exe 904 nttttn.exe 1308 djjpd.exe 2936 rrllrrl.exe 3052 fxfrrff.exe 2120 nbhnnt.exe 636 ddddj.exe 3044 xrxrrrl.exe 396 3lxflrr.exe 1040 nntbnn.exe 1220 3ntnnt.exe 4832 jdjvv.exe 1224 1ffffff.exe 3068 ttttnt.exe 4452 3hhthh.exe 1488 7jvvp.exe 2288 llrfxxx.exe 4868 5xlflrx.exe 2768 hhhbbh.exe 4368 thhbtt.exe 2780 3jdvp.exe 1832 9xxlfxl.exe 3724 1lffffl.exe 2544 tthhbh.exe 4860 hbbbbb.exe -
resource yara_rule behavioral2/memory/3444-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3472-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/616-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4668-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3028-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4108-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1364-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2724-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4328-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2192-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3540-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4680-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2772-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3368-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4260-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2780-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2544-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4748-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1560-191-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3444 wrote to memory of 3472 3444 14ba7ca65a45fbb0f9debfdd0e0c8010_NeikiAnalytics.exe 85 PID 3444 wrote to memory of 3472 3444 14ba7ca65a45fbb0f9debfdd0e0c8010_NeikiAnalytics.exe 85 PID 3444 wrote to memory of 3472 3444 14ba7ca65a45fbb0f9debfdd0e0c8010_NeikiAnalytics.exe 85 PID 3472 wrote to memory of 616 3472 lfrfrxx.exe 86 PID 3472 wrote to memory of 616 3472 lfrfrxx.exe 86 PID 3472 wrote to memory of 616 3472 lfrfrxx.exe 86 PID 616 wrote to memory of 4668 616 xfrfrlx.exe 87 PID 616 wrote to memory of 4668 616 xfrfrlx.exe 87 PID 616 wrote to memory of 4668 616 xfrfrlx.exe 87 PID 4668 wrote to memory of 3028 4668 bhtthn.exe 88 PID 4668 wrote to memory of 3028 4668 bhtthn.exe 88 PID 4668 wrote to memory of 3028 4668 bhtthn.exe 88 PID 3028 wrote to memory of 4108 3028 vpvvv.exe 89 PID 3028 wrote to memory of 4108 3028 vpvvv.exe 89 PID 3028 wrote to memory of 4108 3028 vpvvv.exe 89 PID 4108 wrote to memory of 1364 4108 dpppp.exe 90 PID 4108 wrote to memory of 1364 4108 dpppp.exe 90 PID 4108 wrote to memory of 1364 4108 dpppp.exe 90 PID 1364 wrote to memory of 3616 1364 nhttnt.exe 91 PID 1364 wrote to memory of 3616 1364 nhttnt.exe 91 PID 1364 wrote to memory of 3616 1364 nhttnt.exe 91 PID 3616 wrote to memory of 3036 3616 vdvdj.exe 92 PID 3616 wrote to memory of 3036 3616 vdvdj.exe 92 PID 3616 wrote to memory of 3036 3616 vdvdj.exe 92 PID 3036 wrote to memory of 3976 3036 rlrlfxf.exe 93 PID 3036 wrote to memory of 3976 3036 rlrlfxf.exe 93 PID 3036 wrote to memory of 3976 3036 rlrlfxf.exe 93 PID 3976 wrote to memory of 2724 3976 tbhhnh.exe 94 PID 3976 wrote to memory of 2724 3976 tbhhnh.exe 94 PID 3976 wrote to memory of 2724 3976 tbhhnh.exe 94 PID 2724 wrote to memory of 4328 2724 pdjvp.exe 95 PID 2724 wrote to memory of 4328 2724 pdjvp.exe 95 PID 2724 wrote to memory of 4328 2724 pdjvp.exe 95 PID 4328 wrote to memory of 2192 4328 rrxrxxf.exe 96 PID 4328 wrote to memory of 2192 4328 rrxrxxf.exe 96 PID 4328 wrote to memory of 2192 4328 rrxrxxf.exe 96 PID 2192 wrote to memory of 4644 2192 hthhtt.exe 97 PID 2192 wrote to memory of 4644 2192 hthhtt.exe 97 PID 2192 wrote to memory of 4644 2192 hthhtt.exe 97 PID 4644 wrote to memory of 4448 4644 ppvvv.exe 98 PID 4644 wrote to memory of 4448 4644 ppvvv.exe 98 PID 4644 wrote to memory of 4448 4644 ppvvv.exe 98 PID 4448 wrote to memory of 3540 4448 fxllfll.exe 99 PID 4448 wrote to memory of 3540 4448 fxllfll.exe 99 PID 4448 wrote to memory of 3540 4448 fxllfll.exe 99 PID 3540 wrote to memory of 4892 3540 xxfxfxl.exe 100 PID 3540 wrote to memory of 4892 3540 xxfxfxl.exe 100 PID 3540 wrote to memory of 4892 3540 xxfxfxl.exe 100 PID 4892 wrote to memory of 3408 4892 bntnnt.exe 101 PID 4892 wrote to memory of 3408 4892 bntnnt.exe 101 PID 4892 wrote to memory of 3408 4892 bntnnt.exe 101 PID 3408 wrote to memory of 4680 3408 dpppp.exe 102 PID 3408 wrote to memory of 4680 3408 dpppp.exe 102 PID 3408 wrote to memory of 4680 3408 dpppp.exe 102 PID 4680 wrote to memory of 4920 4680 fffxffr.exe 103 PID 4680 wrote to memory of 4920 4680 fffxffr.exe 103 PID 4680 wrote to memory of 4920 4680 fffxffr.exe 103 PID 4920 wrote to memory of 2772 4920 hbbnnn.exe 104 PID 4920 wrote to memory of 2772 4920 hbbnnn.exe 104 PID 4920 wrote to memory of 2772 4920 hbbnnn.exe 104 PID 2772 wrote to memory of 3368 2772 nbhhhh.exe 106 PID 2772 wrote to memory of 3368 2772 nbhhhh.exe 106 PID 2772 wrote to memory of 3368 2772 nbhhhh.exe 106 PID 3368 wrote to memory of 4260 3368 vjpjd.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\14ba7ca65a45fbb0f9debfdd0e0c8010_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\14ba7ca65a45fbb0f9debfdd0e0c8010_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\lfrfrxx.exec:\lfrfrxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\xfrfrlx.exec:\xfrfrlx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
\??\c:\bhtthn.exec:\bhtthn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
\??\c:\vpvvv.exec:\vpvvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\dpppp.exec:\dpppp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
\??\c:\nhttnt.exec:\nhttnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\vdvdj.exec:\vdvdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\rlrlfxf.exec:\rlrlfxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\tbhhnh.exec:\tbhhnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\pdjvp.exec:\pdjvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\rrxrxxf.exec:\rrxrxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\hthhtt.exec:\hthhtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\ppvvv.exec:\ppvvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
\??\c:\fxllfll.exec:\fxllfll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\xxfxfxl.exec:\xxfxfxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\bntnnt.exec:\bntnnt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\dpppp.exec:\dpppp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
\??\c:\fffxffr.exec:\fffxffr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\hbbnnn.exec:\hbbnnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\nbhhhh.exec:\nbhhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\vjpjd.exec:\vjpjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\fflrxrf.exec:\fflrxrf.exe23⤵
- Executes dropped EXE
PID:4260 -
\??\c:\bthhbh.exec:\bthhbh.exe24⤵
- Executes dropped EXE
PID:3260 -
\??\c:\5jppp.exec:\5jppp.exe25⤵
- Executes dropped EXE
PID:2780 -
\??\c:\pvjjp.exec:\pvjjp.exe26⤵
- Executes dropped EXE
PID:1832 -
\??\c:\lfxlflx.exec:\lfxlflx.exe27⤵
- Executes dropped EXE
PID:2388 -
\??\c:\htnthn.exec:\htnthn.exe28⤵
- Executes dropped EXE
PID:2544 -
\??\c:\hthhhn.exec:\hthhhn.exe29⤵
- Executes dropped EXE
PID:2664 -
\??\c:\ddvjj.exec:\ddvjj.exe30⤵
- Executes dropped EXE
PID:4748 -
\??\c:\xlrffrf.exec:\xlrffrf.exe31⤵
- Executes dropped EXE
PID:1560 -
\??\c:\lrfrxfr.exec:\lrfrxfr.exe32⤵PID:3500
-
\??\c:\tthbhn.exec:\tthbhn.exe33⤵
- Executes dropped EXE
PID:3228 -
\??\c:\hbbbth.exec:\hbbbth.exe34⤵
- Executes dropped EXE
PID:3088 -
\??\c:\dvjdv.exec:\dvjdv.exe35⤵
- Executes dropped EXE
PID:1108 -
\??\c:\vpvdv.exec:\vpvdv.exe36⤵
- Executes dropped EXE
PID:1528 -
\??\c:\fllrxfx.exec:\fllrxfx.exe37⤵
- Executes dropped EXE
PID:3940 -
\??\c:\bttnnn.exec:\bttnnn.exe38⤵
- Executes dropped EXE
PID:3084 -
\??\c:\djjpv.exec:\djjpv.exe39⤵
- Executes dropped EXE
PID:2848 -
\??\c:\vpjjv.exec:\vpjjv.exe40⤵
- Executes dropped EXE
PID:4204 -
\??\c:\xrflrxl.exec:\xrflrxl.exe41⤵
- Executes dropped EXE
PID:3888 -
\??\c:\nhbtnt.exec:\nhbtnt.exe42⤵
- Executes dropped EXE
PID:3952 -
\??\c:\nttttn.exec:\nttttn.exe43⤵
- Executes dropped EXE
PID:904 -
\??\c:\djjpd.exec:\djjpd.exe44⤵
- Executes dropped EXE
PID:1308 -
\??\c:\rrllrrl.exec:\rrllrrl.exe45⤵
- Executes dropped EXE
PID:2936 -
\??\c:\fxfrrff.exec:\fxfrrff.exe46⤵
- Executes dropped EXE
PID:3052 -
\??\c:\nbhnnt.exec:\nbhnnt.exe47⤵
- Executes dropped EXE
PID:2120 -
\??\c:\ddddj.exec:\ddddj.exe48⤵
- Executes dropped EXE
PID:636 -
\??\c:\xrxrrrl.exec:\xrxrrrl.exe49⤵
- Executes dropped EXE
PID:3044 -
\??\c:\3lxflrr.exec:\3lxflrr.exe50⤵
- Executes dropped EXE
PID:396 -
\??\c:\nntbnn.exec:\nntbnn.exe51⤵
- Executes dropped EXE
PID:1040 -
\??\c:\3ntnnt.exec:\3ntnnt.exe52⤵
- Executes dropped EXE
PID:1220 -
\??\c:\jdjvv.exec:\jdjvv.exe53⤵
- Executes dropped EXE
PID:4832 -
\??\c:\1ffffff.exec:\1ffffff.exe54⤵
- Executes dropped EXE
PID:1224 -
\??\c:\ttttnt.exec:\ttttnt.exe55⤵
- Executes dropped EXE
PID:3068 -
\??\c:\3hhthh.exec:\3hhthh.exe56⤵
- Executes dropped EXE
PID:4452 -
\??\c:\7jvvp.exec:\7jvvp.exe57⤵
- Executes dropped EXE
PID:1488 -
\??\c:\llrfxxx.exec:\llrfxxx.exe58⤵
- Executes dropped EXE
PID:2288 -
\??\c:\5xlflrx.exec:\5xlflrx.exe59⤵
- Executes dropped EXE
PID:4868 -
\??\c:\hhhbbh.exec:\hhhbbh.exe60⤵
- Executes dropped EXE
PID:2768 -
\??\c:\thhbtt.exec:\thhbtt.exe61⤵
- Executes dropped EXE
PID:4368 -
\??\c:\3jdvp.exec:\3jdvp.exe62⤵
- Executes dropped EXE
PID:2780 -
\??\c:\9xxlfxl.exec:\9xxlfxl.exe63⤵
- Executes dropped EXE
PID:1832 -
\??\c:\1lffffl.exec:\1lffffl.exe64⤵
- Executes dropped EXE
PID:3724 -
\??\c:\tthhbh.exec:\tthhbh.exe65⤵
- Executes dropped EXE
PID:2544 -
\??\c:\hbbbbb.exec:\hbbbbb.exe66⤵
- Executes dropped EXE
PID:4860 -
\??\c:\pjjvv.exec:\pjjvv.exe67⤵PID:2180
-
\??\c:\vvjdj.exec:\vvjdj.exe68⤵PID:2228
-
\??\c:\rllfxxx.exec:\rllfxxx.exe69⤵PID:4764
-
\??\c:\ttbbbb.exec:\ttbbbb.exe70⤵PID:3444
-
\??\c:\pjppv.exec:\pjppv.exe71⤵PID:3800
-
\??\c:\1dppp.exec:\1dppp.exe72⤵PID:3088
-
\??\c:\lfllfxx.exec:\lfllfxx.exe73⤵PID:4692
-
\??\c:\xxrlrrf.exec:\xxrlrrf.exe74⤵PID:2436
-
\??\c:\bbtnnn.exec:\bbtnnn.exe75⤵PID:3940
-
\??\c:\3jvpj.exec:\3jvpj.exe76⤵PID:660
-
\??\c:\ppjvv.exec:\ppjvv.exe77⤵PID:2028
-
\??\c:\xlffxxx.exec:\xlffxxx.exe78⤵PID:1232
-
\??\c:\ffxxllx.exec:\ffxxllx.exe79⤵PID:3888
-
\??\c:\hhtnnt.exec:\hhtnnt.exe80⤵PID:3960
-
\??\c:\pvvdd.exec:\pvvdd.exe81⤵PID:904
-
\??\c:\pdjdv.exec:\pdjdv.exe82⤵PID:2476
-
\??\c:\rrlflfl.exec:\rrlflfl.exe83⤵PID:4324
-
\??\c:\fxffxxx.exec:\fxffxxx.exe84⤵PID:1436
-
\??\c:\9thbhh.exec:\9thbhh.exe85⤵PID:2120
-
\??\c:\vvjpd.exec:\vvjpd.exe86⤵PID:1592
-
\??\c:\rxlfrrx.exec:\rxlfrrx.exe87⤵PID:3936
-
\??\c:\9lffxff.exec:\9lffxff.exe88⤵PID:4988
-
\??\c:\5bhhhh.exec:\5bhhhh.exe89⤵PID:1620
-
\??\c:\jdjjj.exec:\jdjjj.exe90⤵PID:2332
-
\??\c:\jdvpv.exec:\jdvpv.exe91⤵PID:4636
-
\??\c:\xxrlxrl.exec:\xxrlxrl.exe92⤵PID:900
-
\??\c:\rlxxxlf.exec:\rlxxxlf.exe93⤵PID:1192
-
\??\c:\hbhhhh.exec:\hbhhhh.exe94⤵PID:4920
-
\??\c:\hnhttb.exec:\hnhttb.exe95⤵PID:3048
-
\??\c:\3djjd.exec:\3djjd.exe96⤵PID:3816
-
\??\c:\frfxlxr.exec:\frfxlxr.exe97⤵PID:2288
-
\??\c:\tbtbnb.exec:\tbtbnb.exe98⤵PID:3300
-
\??\c:\hbbtnh.exec:\hbbtnh.exe99⤵PID:2768
-
\??\c:\dpvvd.exec:\dpvvd.exe100⤵PID:4976
-
\??\c:\9dvvj.exec:\9dvvj.exe101⤵PID:4564
-
\??\c:\lffffff.exec:\lffffff.exe102⤵PID:2840
-
\??\c:\hnthnh.exec:\hnthnh.exe103⤵PID:4292
-
\??\c:\htthtn.exec:\htthtn.exe104⤵PID:2544
-
\??\c:\dddpp.exec:\dddpp.exe105⤵PID:4404
-
\??\c:\ppddj.exec:\ppddj.exe106⤵PID:2200
-
\??\c:\xxxffll.exec:\xxxffll.exe107⤵PID:3232
-
\??\c:\bbbbhn.exec:\bbbbhn.exe108⤵PID:532
-
\??\c:\hnbtnn.exec:\hnbtnn.exe109⤵PID:3228
-
\??\c:\vvpjd.exec:\vvpjd.exe110⤵PID:4668
-
\??\c:\5lxxrrl.exec:\5lxxrrl.exe111⤵PID:4244
-
\??\c:\llfrlxx.exec:\llfrlxx.exe112⤵PID:5032
-
\??\c:\ddpdd.exec:\ddpdd.exe113⤵PID:4692
-
\??\c:\lflxflx.exec:\lflxflx.exe114⤵PID:2436
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe115⤵PID:3940
-
\??\c:\hthntt.exec:\hthntt.exe116⤵PID:3968
-
\??\c:\bbbnnt.exec:\bbbnnt.exe117⤵PID:2012
-
\??\c:\jddvp.exec:\jddvp.exe118⤵PID:5016
-
\??\c:\fxfxxrr.exec:\fxfxxrr.exe119⤵PID:4220
-
\??\c:\hbbbbb.exec:\hbbbbb.exe120⤵PID:4320
-
\??\c:\jjvpj.exec:\jjvpj.exe121⤵PID:904
-
\??\c:\lxfffrl.exec:\lxfffrl.exe122⤵PID:2684
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-