Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13/05/2024, 10:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b325abdfa1e117164080f8e655da08f0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
b325abdfa1e117164080f8e655da08f0_NeikiAnalytics.exe
-
Size
433KB
-
MD5
b325abdfa1e117164080f8e655da08f0
-
SHA1
1e820c00ca5fe0bce64943064e6c586f975ea42d
-
SHA256
ed75dc04567b7ff9ffcdff130a1b244ffd01efd4f34869503f09a41a6c466517
-
SHA512
6701c82024a82b7e7c437fd304c35bdc8a6dfd02d6a8d9d9b776769204400f38d746395a4bf3775ca0e6a95c10ebe91aba5c8b4dd5c20106f9229446d311a6e9
-
SSDEEP
12288:n3C9uMPh2kkkkK4kXkkkkkkkkl888888888888888888nn:ShPh2kkkkK4kXkkkkkkkkJ
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/4592-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2744-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2744-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2744-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1788-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/228-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3268-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1412-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3292-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/468-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2220-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4632-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4200-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3068-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3252-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1800-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1844-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4196-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/376-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2932-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4332-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1856-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2744 7pdvd.exe 1788 hnhnbb.exe 228 rxrlxxf.exe 3268 vvpjd.exe 1412 jdvpj.exe 3208 3fffxxr.exe 3292 djppp.exe 4020 hbtbth.exe 468 jvjpj.exe 4200 5lfxrrl.exe 2220 vvddd.exe 4632 1llfffx.exe 3068 ttbtnt.exe 3252 7vpjp.exe 1800 dppjd.exe 1844 vpvdv.exe 2076 xrfxxff.exe 4196 nnnbbb.exe 2976 5jddv.exe 376 hthbhn.exe 2180 3pdjv.exe 2932 3ntnnt.exe 2476 3pjjp.exe 1164 tbtnnn.exe 4332 xxllrxl.exe 1856 hhnttn.exe 2540 5rxxffx.exe 5044 ppdvp.exe 388 lrxrxrx.exe 3268 vdddd.exe 3668 thnhbb.exe 2740 frxrllf.exe 1292 ddpvv.exe 4100 9xrlffr.exe 3276 5bbtnn.exe 3564 nhnhht.exe 2372 pddvp.exe 3540 5flfxfx.exe 3744 bnnntt.exe 2892 thnhbt.exe 880 vvpjd.exe 1652 rrlfrrl.exe 4848 rllfxlx.exe 1256 hbthnb.exe 1128 7vvpd.exe 1980 xxxrffx.exe 2720 xxrlxrl.exe 1080 3ttnhb.exe 3040 vvjjj.exe 1472 3jpjj.exe 376 flfrlxr.exe 2180 hbbbtn.exe 532 jddvv.exe 3816 7rrlxrx.exe 4512 rlfxlff.exe 1164 nntntt.exe 4364 jdddv.exe 2732 lrxxrrl.exe 1856 lxrlllf.exe 3508 nbbhbh.exe 3408 pvjdv.exe 2564 rflflxx.exe 4108 9ttnnn.exe 3668 jdpdv.exe -
resource yara_rule behavioral2/memory/4592-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2744-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2744-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2744-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1788-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/228-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3268-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1412-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3292-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/468-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/468-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/468-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/468-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4200-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2220-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4632-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4200-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3068-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3252-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1800-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1844-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4196-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/376-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2932-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4332-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1856-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-188-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4592 wrote to memory of 2744 4592 b325abdfa1e117164080f8e655da08f0_NeikiAnalytics.exe 89 PID 4592 wrote to memory of 2744 4592 b325abdfa1e117164080f8e655da08f0_NeikiAnalytics.exe 89 PID 4592 wrote to memory of 2744 4592 b325abdfa1e117164080f8e655da08f0_NeikiAnalytics.exe 89 PID 2744 wrote to memory of 1788 2744 7pdvd.exe 90 PID 2744 wrote to memory of 1788 2744 7pdvd.exe 90 PID 2744 wrote to memory of 1788 2744 7pdvd.exe 90 PID 1788 wrote to memory of 228 1788 hnhnbb.exe 91 PID 1788 wrote to memory of 228 1788 hnhnbb.exe 91 PID 1788 wrote to memory of 228 1788 hnhnbb.exe 91 PID 228 wrote to memory of 3268 228 rxrlxxf.exe 92 PID 228 wrote to memory of 3268 228 rxrlxxf.exe 92 PID 228 wrote to memory of 3268 228 rxrlxxf.exe 92 PID 3268 wrote to memory of 1412 3268 vvpjd.exe 93 PID 3268 wrote to memory of 1412 3268 vvpjd.exe 93 PID 3268 wrote to memory of 1412 3268 vvpjd.exe 93 PID 1412 wrote to memory of 3208 1412 jdvpj.exe 94 PID 1412 wrote to memory of 3208 1412 jdvpj.exe 94 PID 1412 wrote to memory of 3208 1412 jdvpj.exe 94 PID 3208 wrote to memory of 3292 3208 3fffxxr.exe 96 PID 3208 wrote to memory of 3292 3208 3fffxxr.exe 96 PID 3208 wrote to memory of 3292 3208 3fffxxr.exe 96 PID 3292 wrote to memory of 4020 3292 djppp.exe 97 PID 3292 wrote to memory of 4020 3292 djppp.exe 97 PID 3292 wrote to memory of 4020 3292 djppp.exe 97 PID 4020 wrote to memory of 468 4020 hbtbth.exe 99 PID 4020 wrote to memory of 468 4020 hbtbth.exe 99 PID 4020 wrote to memory of 468 4020 hbtbth.exe 99 PID 468 wrote to memory of 4200 468 jvjpj.exe 100 PID 468 wrote to memory of 4200 468 jvjpj.exe 100 PID 468 wrote to memory of 4200 468 jvjpj.exe 100 PID 4200 wrote to memory of 2220 4200 5lfxrrl.exe 102 PID 4200 wrote to memory of 2220 4200 5lfxrrl.exe 102 PID 4200 wrote to memory of 2220 4200 5lfxrrl.exe 102 PID 2220 wrote to memory of 4632 2220 vvddd.exe 103 PID 2220 wrote to memory of 4632 2220 vvddd.exe 103 PID 2220 wrote to memory of 4632 2220 vvddd.exe 103 PID 4632 wrote to memory of 3068 4632 1llfffx.exe 104 PID 4632 wrote to memory of 3068 4632 1llfffx.exe 104 PID 4632 wrote to memory of 3068 4632 1llfffx.exe 104 PID 3068 wrote to memory of 3252 3068 ttbtnt.exe 105 PID 3068 wrote to memory of 3252 3068 ttbtnt.exe 105 PID 3068 wrote to memory of 3252 3068 ttbtnt.exe 105 PID 3252 wrote to memory of 1800 3252 7vpjp.exe 106 PID 3252 wrote to memory of 1800 3252 7vpjp.exe 106 PID 3252 wrote to memory of 1800 3252 7vpjp.exe 106 PID 1800 wrote to memory of 1844 1800 dppjd.exe 107 PID 1800 wrote to memory of 1844 1800 dppjd.exe 107 PID 1800 wrote to memory of 1844 1800 dppjd.exe 107 PID 1844 wrote to memory of 2076 1844 vpvdv.exe 108 PID 1844 wrote to memory of 2076 1844 vpvdv.exe 108 PID 1844 wrote to memory of 2076 1844 vpvdv.exe 108 PID 2076 wrote to memory of 4196 2076 xrfxxff.exe 109 PID 2076 wrote to memory of 4196 2076 xrfxxff.exe 109 PID 2076 wrote to memory of 4196 2076 xrfxxff.exe 109 PID 4196 wrote to memory of 2976 4196 nnnbbb.exe 110 PID 4196 wrote to memory of 2976 4196 nnnbbb.exe 110 PID 4196 wrote to memory of 2976 4196 nnnbbb.exe 110 PID 2976 wrote to memory of 376 2976 5jddv.exe 111 PID 2976 wrote to memory of 376 2976 5jddv.exe 111 PID 2976 wrote to memory of 376 2976 5jddv.exe 111 PID 376 wrote to memory of 2180 376 hthbhn.exe 112 PID 376 wrote to memory of 2180 376 hthbhn.exe 112 PID 376 wrote to memory of 2180 376 hthbhn.exe 112 PID 2180 wrote to memory of 2932 2180 3pdjv.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\b325abdfa1e117164080f8e655da08f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b325abdfa1e117164080f8e655da08f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\7pdvd.exec:\7pdvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\hnhnbb.exec:\hnhnbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\rxrlxxf.exec:\rxrlxxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\vvpjd.exec:\vvpjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\jdvpj.exec:\jdvpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\3fffxxr.exec:\3fffxxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
\??\c:\djppp.exec:\djppp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\hbtbth.exec:\hbtbth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\jvjpj.exec:\jvjpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\5lfxrrl.exec:\5lfxrrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
\??\c:\vvddd.exec:\vvddd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\1llfffx.exec:\1llfffx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\ttbtnt.exec:\ttbtnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\7vpjp.exec:\7vpjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\dppjd.exec:\dppjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\vpvdv.exec:\vpvdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\xrfxxff.exec:\xrfxxff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\nnnbbb.exec:\nnnbbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
\??\c:\5jddv.exec:\5jddv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\hthbhn.exec:\hthbhn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\3pdjv.exec:\3pdjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\3ntnnt.exec:\3ntnnt.exe23⤵
- Executes dropped EXE
PID:2932 -
\??\c:\3pjjp.exec:\3pjjp.exe24⤵
- Executes dropped EXE
PID:2476 -
\??\c:\tbtnnn.exec:\tbtnnn.exe25⤵
- Executes dropped EXE
PID:1164 -
\??\c:\xxllrxl.exec:\xxllrxl.exe26⤵
- Executes dropped EXE
PID:4332 -
\??\c:\hhnttn.exec:\hhnttn.exe27⤵
- Executes dropped EXE
PID:1856 -
\??\c:\5rxxffx.exec:\5rxxffx.exe28⤵
- Executes dropped EXE
PID:2540 -
\??\c:\ppdvp.exec:\ppdvp.exe29⤵
- Executes dropped EXE
PID:5044 -
\??\c:\lrxrxrx.exec:\lrxrxrx.exe30⤵
- Executes dropped EXE
PID:388 -
\??\c:\vdddd.exec:\vdddd.exe31⤵
- Executes dropped EXE
PID:3268 -
\??\c:\thnhbb.exec:\thnhbb.exe32⤵
- Executes dropped EXE
PID:3668 -
\??\c:\frxrllf.exec:\frxrllf.exe33⤵
- Executes dropped EXE
PID:2740 -
\??\c:\ddpvv.exec:\ddpvv.exe34⤵
- Executes dropped EXE
PID:1292 -
\??\c:\9xrlffr.exec:\9xrlffr.exe35⤵
- Executes dropped EXE
PID:4100 -
\??\c:\5bbtnn.exec:\5bbtnn.exe36⤵
- Executes dropped EXE
PID:3276 -
\??\c:\nhnhht.exec:\nhnhht.exe37⤵
- Executes dropped EXE
PID:3564 -
\??\c:\pddvp.exec:\pddvp.exe38⤵
- Executes dropped EXE
PID:2372 -
\??\c:\5flfxfx.exec:\5flfxfx.exe39⤵
- Executes dropped EXE
PID:3540 -
\??\c:\bnnntt.exec:\bnnntt.exe40⤵
- Executes dropped EXE
PID:3744 -
\??\c:\thnhbt.exec:\thnhbt.exe41⤵
- Executes dropped EXE
PID:2892 -
\??\c:\vvpjd.exec:\vvpjd.exe42⤵
- Executes dropped EXE
PID:880 -
\??\c:\rrlfrrl.exec:\rrlfrrl.exe43⤵
- Executes dropped EXE
PID:1652 -
\??\c:\rllfxlx.exec:\rllfxlx.exe44⤵
- Executes dropped EXE
PID:4848 -
\??\c:\hbthnb.exec:\hbthnb.exe45⤵
- Executes dropped EXE
PID:1256 -
\??\c:\7vvpd.exec:\7vvpd.exe46⤵
- Executes dropped EXE
PID:1128 -
\??\c:\xxxrffx.exec:\xxxrffx.exe47⤵
- Executes dropped EXE
PID:1980 -
\??\c:\xxrlxrl.exec:\xxrlxrl.exe48⤵
- Executes dropped EXE
PID:2720 -
\??\c:\3ttnhb.exec:\3ttnhb.exe49⤵
- Executes dropped EXE
PID:1080 -
\??\c:\vvjjj.exec:\vvjjj.exe50⤵
- Executes dropped EXE
PID:3040 -
\??\c:\3jpjj.exec:\3jpjj.exe51⤵
- Executes dropped EXE
PID:1472 -
\??\c:\flfrlxr.exec:\flfrlxr.exe52⤵
- Executes dropped EXE
PID:376 -
\??\c:\hbbbtn.exec:\hbbbtn.exe53⤵
- Executes dropped EXE
PID:2180 -
\??\c:\jddvv.exec:\jddvv.exe54⤵
- Executes dropped EXE
PID:532 -
\??\c:\7rrlxrx.exec:\7rrlxrx.exe55⤵
- Executes dropped EXE
PID:3816 -
\??\c:\rlfxlff.exec:\rlfxlff.exe56⤵
- Executes dropped EXE
PID:4512 -
\??\c:\nntntt.exec:\nntntt.exe57⤵
- Executes dropped EXE
PID:1164 -
\??\c:\jdddv.exec:\jdddv.exe58⤵
- Executes dropped EXE
PID:4364 -
\??\c:\lrxxrrl.exec:\lrxxrrl.exe59⤵
- Executes dropped EXE
PID:2732 -
\??\c:\lxrlllf.exec:\lxrlllf.exe60⤵
- Executes dropped EXE
PID:1856 -
\??\c:\nbbhbh.exec:\nbbhbh.exe61⤵
- Executes dropped EXE
PID:3508 -
\??\c:\pvjdv.exec:\pvjdv.exe62⤵
- Executes dropped EXE
PID:3408 -
\??\c:\rflflxx.exec:\rflflxx.exe63⤵
- Executes dropped EXE
PID:2564 -
\??\c:\9ttnnn.exec:\9ttnnn.exe64⤵
- Executes dropped EXE
PID:4108 -
\??\c:\jdpdv.exec:\jdpdv.exe65⤵
- Executes dropped EXE
PID:3668 -
\??\c:\1vvpj.exec:\1vvpj.exe66⤵PID:4536
-
\??\c:\xfxrlfx.exec:\xfxrlfx.exe67⤵PID:4296
-
\??\c:\btbtnn.exec:\btbtnn.exe68⤵PID:2288
-
\??\c:\pdjjd.exec:\pdjjd.exe69⤵PID:2040
-
\??\c:\flffxxr.exec:\flffxxr.exe70⤵PID:3564
-
\??\c:\httbhb.exec:\httbhb.exe71⤵PID:2372
-
\??\c:\djvjd.exec:\djvjd.exe72⤵PID:3540
-
\??\c:\lrfxrfx.exec:\lrfxrfx.exe73⤵PID:3744
-
\??\c:\5nbbtb.exec:\5nbbtb.exe74⤵PID:3456
-
\??\c:\vpppj.exec:\vpppj.exe75⤵PID:4712
-
\??\c:\lflfxxr.exec:\lflfxxr.exe76⤵PID:4676
-
\??\c:\bhbtbh.exec:\bhbtbh.exe77⤵PID:4524
-
\??\c:\hbnhnn.exec:\hbnhnn.exe78⤵PID:2692
-
\??\c:\vpvvd.exec:\vpvvd.exe79⤵PID:1844
-
\??\c:\7frfxfx.exec:\7frfxfx.exe80⤵PID:2948
-
\??\c:\hbtnbb.exec:\hbtnbb.exe81⤵PID:4976
-
\??\c:\5dddd.exec:\5dddd.exe82⤵PID:3140
-
\??\c:\xxllffl.exec:\xxllffl.exe83⤵PID:4580
-
\??\c:\9bbthh.exec:\9bbthh.exe84⤵PID:2612
-
\??\c:\9tbthh.exec:\9tbthh.exe85⤵PID:1516
-
\??\c:\vppjd.exec:\vppjd.exe86⤵PID:4608
-
\??\c:\xxrlfrf.exec:\xxrlfrf.exe87⤵PID:3228
-
\??\c:\bhhtbt.exec:\bhhtbt.exe88⤵PID:4328
-
\??\c:\bbnnhn.exec:\bbnnhn.exe89⤵PID:2080
-
\??\c:\ppjpv.exec:\ppjpv.exe90⤵PID:4056
-
\??\c:\ffffrrr.exec:\ffffrrr.exe91⤵PID:4588
-
\??\c:\frrrlrr.exec:\frrrlrr.exe92⤵PID:1788
-
\??\c:\nbhthn.exec:\nbhthn.exe93⤵PID:1856
-
\??\c:\ppdvd.exec:\ppdvd.exe94⤵PID:1716
-
\??\c:\rxxrfxr.exec:\rxxrfxr.exe95⤵PID:1760
-
\??\c:\rllxfxl.exec:\rllxfxl.exe96⤵PID:3304
-
\??\c:\bhnhbb.exec:\bhnhbb.exe97⤵PID:4928
-
\??\c:\tbhbtb.exec:\tbhbtb.exe98⤵PID:3208
-
\??\c:\jvdvp.exec:\jvdvp.exe99⤵PID:3472
-
\??\c:\frxxrrx.exec:\frxxrrx.exe100⤵PID:2800
-
\??\c:\tthbtb.exec:\tthbtb.exe101⤵PID:3276
-
\??\c:\vjdvp.exec:\vjdvp.exe102⤵PID:2288
-
\??\c:\3dpjd.exec:\3dpjd.exe103⤵PID:4944
-
\??\c:\llrxxxx.exec:\llrxxxx.exe104⤵PID:1168
-
\??\c:\ntbbnn.exec:\ntbbnn.exe105⤵PID:3744
-
\??\c:\hnbtnt.exec:\hnbtnt.exe106⤵PID:4836
-
\??\c:\jjdvp.exec:\jjdvp.exe107⤵PID:4712
-
\??\c:\lfflxfx.exec:\lfflxfx.exe108⤵PID:4676
-
\??\c:\9tnbtt.exec:\9tnbtt.exe109⤵PID:4528
-
\??\c:\bbhnbb.exec:\bbhnbb.exe110⤵PID:1848
-
\??\c:\7jvpp.exec:\7jvpp.exe111⤵PID:1844
-
\??\c:\rfrfffx.exec:\rfrfffx.exe112⤵PID:3532
-
\??\c:\1rfxffl.exec:\1rfxffl.exe113⤵PID:3676
-
\??\c:\9tnnhn.exec:\9tnnhn.exe114⤵PID:4456
-
\??\c:\jvvpp.exec:\jvvpp.exe115⤵PID:4580
-
\??\c:\frfrrlf.exec:\frfrrlf.exe116⤵PID:376
-
\??\c:\nnhnhh.exec:\nnhnhh.exe117⤵PID:2932
-
\??\c:\vppjd.exec:\vppjd.exe118⤵PID:4336
-
\??\c:\dvdvp.exec:\dvdvp.exe119⤵PID:3872
-
\??\c:\rxllrrx.exec:\rxllrrx.exe120⤵PID:4396
-
\??\c:\hnbtnt.exec:\hnbtnt.exe121⤵PID:4392
-
\??\c:\tbbntb.exec:\tbbntb.exe122⤵PID:4288
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-