Analysis
-
max time kernel
150s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 11:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c555db33eebe8c734160acfa6658d3b0_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
c555db33eebe8c734160acfa6658d3b0_NeikiAnalytics.exe
-
Size
54KB
-
MD5
c555db33eebe8c734160acfa6658d3b0
-
SHA1
6dcd5b711defe0ab143524691f1fc28bee331a85
-
SHA256
992626905ebe1fb8e1ad2fe08f044c8027b8b6221182d9b7e9435a4f965bf737
-
SHA512
f98ab3b07b5f1657e423c8bd2a97d9e7cc1d25398426f5de5e3b774b5ea8f0f8ffcc243e593813254b92c12963595fc02adaf647c228f834f3891499a69fc71a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI57Bx8:ymb3NkkiQ3mdBjFIVBx8
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/3132-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5076-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3368-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3960-61-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3960-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1880-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4408-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4120-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2764-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/972-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5072-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/820-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2292-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5040-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3840-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1644-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1912-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/460-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3884-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3036-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1336-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1688-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2040-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5080-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3368 vjpjd.exe 5076 rlfxxxl.exe 4608 3rxlllr.exe 2368 nnthnn.exe 2756 hbhhbb.exe 2504 fxlfxxx.exe 1880 flxrlrl.exe 3960 bhnhbt.exe 4408 tthbbb.exe 4756 jvvjj.exe 4120 rllxxxx.exe 2764 hbtnhh.exe 972 dvdvd.exe 896 pdjjj.exe 5072 rllfxlf.exe 820 tbttnn.exe 2292 dvdvj.exe 2012 vvvjj.exe 5040 xrxxrrf.exe 3840 7nhhhh.exe 1644 hbbttt.exe 1912 pdjvv.exe 460 dvdvv.exe 3932 rlxxlxr.exe 3884 xfllrrf.exe 3036 btthbb.exe 1336 pdvpd.exe 4252 vvdjj.exe 1688 lxxrfff.exe 2040 tnbbhh.exe 5080 tnnnhh.exe 2208 vdjdd.exe 2784 frlrfff.exe 3060 fxxlffl.exe 3452 bntttt.exe 868 9tbhnb.exe 3656 pjpjv.exe 4644 rflfrrr.exe 2068 bnttnn.exe 4492 vpvpj.exe 2176 3lllxff.exe 4844 nhnttt.exe 2976 djdvp.exe 3624 jvvpj.exe 3368 rxlfffx.exe 1824 bnnnhh.exe 3832 7jvjv.exe 2368 dvdvv.exe 2984 rrfxxxr.exe 2072 flxrrll.exe 2504 hbtthb.exe 4892 vdpjd.exe 3960 jvvpd.exe 464 fxrffrx.exe 3936 7bhbtt.exe 3648 tnthbn.exe 2408 pvdvp.exe 4888 5frlfrf.exe 536 frxrrrr.exe 2064 nhnhhh.exe 972 vvjdj.exe 4156 dvjdd.exe 4928 5lxxllf.exe 4512 hbbnhn.exe -
resource yara_rule behavioral2/memory/3132-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2756-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5076-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3368-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3960-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1880-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2764-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/972-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5072-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/820-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2292-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5040-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3840-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1644-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1912-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/460-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3884-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1336-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1688-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5080-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3132 wrote to memory of 3368 3132 c555db33eebe8c734160acfa6658d3b0_NeikiAnalytics.exe 81 PID 3132 wrote to memory of 3368 3132 c555db33eebe8c734160acfa6658d3b0_NeikiAnalytics.exe 81 PID 3132 wrote to memory of 3368 3132 c555db33eebe8c734160acfa6658d3b0_NeikiAnalytics.exe 81 PID 3368 wrote to memory of 5076 3368 vjpjd.exe 82 PID 3368 wrote to memory of 5076 3368 vjpjd.exe 82 PID 3368 wrote to memory of 5076 3368 vjpjd.exe 82 PID 5076 wrote to memory of 4608 5076 rlfxxxl.exe 83 PID 5076 wrote to memory of 4608 5076 rlfxxxl.exe 83 PID 5076 wrote to memory of 4608 5076 rlfxxxl.exe 83 PID 4608 wrote to memory of 2368 4608 3rxlllr.exe 84 PID 4608 wrote to memory of 2368 4608 3rxlllr.exe 84 PID 4608 wrote to memory of 2368 4608 3rxlllr.exe 84 PID 2368 wrote to memory of 2756 2368 nnthnn.exe 85 PID 2368 wrote to memory of 2756 2368 nnthnn.exe 85 PID 2368 wrote to memory of 2756 2368 nnthnn.exe 85 PID 2756 wrote to memory of 2504 2756 hbhhbb.exe 86 PID 2756 wrote to memory of 2504 2756 hbhhbb.exe 86 PID 2756 wrote to memory of 2504 2756 hbhhbb.exe 86 PID 2504 wrote to memory of 1880 2504 fxlfxxx.exe 87 PID 2504 wrote to memory of 1880 2504 fxlfxxx.exe 87 PID 2504 wrote to memory of 1880 2504 fxlfxxx.exe 87 PID 1880 wrote to memory of 3960 1880 flxrlrl.exe 89 PID 1880 wrote to memory of 3960 1880 flxrlrl.exe 89 PID 1880 wrote to memory of 3960 1880 flxrlrl.exe 89 PID 3960 wrote to memory of 4408 3960 bhnhbt.exe 90 PID 3960 wrote to memory of 4408 3960 bhnhbt.exe 90 PID 3960 wrote to memory of 4408 3960 bhnhbt.exe 90 PID 4408 wrote to memory of 4756 4408 tthbbb.exe 91 PID 4408 wrote to memory of 4756 4408 tthbbb.exe 91 PID 4408 wrote to memory of 4756 4408 tthbbb.exe 91 PID 4756 wrote to memory of 4120 4756 jvvjj.exe 92 PID 4756 wrote to memory of 4120 4756 jvvjj.exe 92 PID 4756 wrote to memory of 4120 4756 jvvjj.exe 92 PID 4120 wrote to memory of 2764 4120 rllxxxx.exe 93 PID 4120 wrote to memory of 2764 4120 rllxxxx.exe 93 PID 4120 wrote to memory of 2764 4120 rllxxxx.exe 93 PID 2764 wrote to memory of 972 2764 hbtnhh.exe 94 PID 2764 wrote to memory of 972 2764 hbtnhh.exe 94 PID 2764 wrote to memory of 972 2764 hbtnhh.exe 94 PID 972 wrote to memory of 896 972 dvdvd.exe 95 PID 972 wrote to memory of 896 972 dvdvd.exe 95 PID 972 wrote to memory of 896 972 dvdvd.exe 95 PID 896 wrote to memory of 5072 896 pdjjj.exe 97 PID 896 wrote to memory of 5072 896 pdjjj.exe 97 PID 896 wrote to memory of 5072 896 pdjjj.exe 97 PID 5072 wrote to memory of 820 5072 rllfxlf.exe 98 PID 5072 wrote to memory of 820 5072 rllfxlf.exe 98 PID 5072 wrote to memory of 820 5072 rllfxlf.exe 98 PID 820 wrote to memory of 2292 820 tbttnn.exe 99 PID 820 wrote to memory of 2292 820 tbttnn.exe 99 PID 820 wrote to memory of 2292 820 tbttnn.exe 99 PID 2292 wrote to memory of 2012 2292 dvdvj.exe 100 PID 2292 wrote to memory of 2012 2292 dvdvj.exe 100 PID 2292 wrote to memory of 2012 2292 dvdvj.exe 100 PID 2012 wrote to memory of 5040 2012 vvvjj.exe 101 PID 2012 wrote to memory of 5040 2012 vvvjj.exe 101 PID 2012 wrote to memory of 5040 2012 vvvjj.exe 101 PID 5040 wrote to memory of 3840 5040 xrxxrrf.exe 102 PID 5040 wrote to memory of 3840 5040 xrxxrrf.exe 102 PID 5040 wrote to memory of 3840 5040 xrxxrrf.exe 102 PID 3840 wrote to memory of 1644 3840 7nhhhh.exe 103 PID 3840 wrote to memory of 1644 3840 7nhhhh.exe 103 PID 3840 wrote to memory of 1644 3840 7nhhhh.exe 103 PID 1644 wrote to memory of 1912 1644 hbbttt.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\c555db33eebe8c734160acfa6658d3b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\c555db33eebe8c734160acfa6658d3b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\vjpjd.exec:\vjpjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\rlfxxxl.exec:\rlfxxxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\3rxlllr.exec:\3rxlllr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\nnthnn.exec:\nnthnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\hbhhbb.exec:\hbhhbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\fxlfxxx.exec:\fxlfxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\flxrlrl.exec:\flxrlrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\bhnhbt.exec:\bhnhbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\tthbbb.exec:\tthbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\jvvjj.exec:\jvvjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\rllxxxx.exec:\rllxxxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\hbtnhh.exec:\hbtnhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\dvdvd.exec:\dvdvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\pdjjj.exec:\pdjjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
\??\c:\rllfxlf.exec:\rllfxlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\tbttnn.exec:\tbttnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
\??\c:\dvdvj.exec:\dvdvj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\vvvjj.exec:\vvvjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\xrxxrrf.exec:\xrxxrrf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\7nhhhh.exec:\7nhhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\hbbttt.exec:\hbbttt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\pdjvv.exec:\pdjvv.exe23⤵
- Executes dropped EXE
PID:1912 -
\??\c:\dvdvv.exec:\dvdvv.exe24⤵
- Executes dropped EXE
PID:460 -
\??\c:\rlxxlxr.exec:\rlxxlxr.exe25⤵
- Executes dropped EXE
PID:3932 -
\??\c:\xfllrrf.exec:\xfllrrf.exe26⤵
- Executes dropped EXE
PID:3884 -
\??\c:\btthbb.exec:\btthbb.exe27⤵
- Executes dropped EXE
PID:3036 -
\??\c:\pdvpd.exec:\pdvpd.exe28⤵
- Executes dropped EXE
PID:1336 -
\??\c:\vvdjj.exec:\vvdjj.exe29⤵
- Executes dropped EXE
PID:4252 -
\??\c:\lxxrfff.exec:\lxxrfff.exe30⤵
- Executes dropped EXE
PID:1688 -
\??\c:\tnbbhh.exec:\tnbbhh.exe31⤵
- Executes dropped EXE
PID:2040 -
\??\c:\tnnnhh.exec:\tnnnhh.exe32⤵
- Executes dropped EXE
PID:5080 -
\??\c:\vdjdd.exec:\vdjdd.exe33⤵
- Executes dropped EXE
PID:2208 -
\??\c:\frlrfff.exec:\frlrfff.exe34⤵
- Executes dropped EXE
PID:2784 -
\??\c:\fxxlffl.exec:\fxxlffl.exe35⤵
- Executes dropped EXE
PID:3060 -
\??\c:\bntttt.exec:\bntttt.exe36⤵
- Executes dropped EXE
PID:3452 -
\??\c:\9tbhnb.exec:\9tbhnb.exe37⤵
- Executes dropped EXE
PID:868 -
\??\c:\pjpjv.exec:\pjpjv.exe38⤵
- Executes dropped EXE
PID:3656 -
\??\c:\rflfrrr.exec:\rflfrrr.exe39⤵
- Executes dropped EXE
PID:4644 -
\??\c:\bnttnn.exec:\bnttnn.exe40⤵
- Executes dropped EXE
PID:2068 -
\??\c:\vpvpj.exec:\vpvpj.exe41⤵
- Executes dropped EXE
PID:4492 -
\??\c:\3lllxff.exec:\3lllxff.exe42⤵
- Executes dropped EXE
PID:2176 -
\??\c:\nhnttt.exec:\nhnttt.exe43⤵
- Executes dropped EXE
PID:4844 -
\??\c:\djdvp.exec:\djdvp.exe44⤵
- Executes dropped EXE
PID:2976 -
\??\c:\jvvpj.exec:\jvvpj.exe45⤵
- Executes dropped EXE
PID:3624 -
\??\c:\rxlfffx.exec:\rxlfffx.exe46⤵
- Executes dropped EXE
PID:3368 -
\??\c:\bnnnhh.exec:\bnnnhh.exe47⤵
- Executes dropped EXE
PID:1824 -
\??\c:\7jvjv.exec:\7jvjv.exe48⤵
- Executes dropped EXE
PID:3832 -
\??\c:\dvdvv.exec:\dvdvv.exe49⤵
- Executes dropped EXE
PID:2368 -
\??\c:\rrfxxxr.exec:\rrfxxxr.exe50⤵
- Executes dropped EXE
PID:2984 -
\??\c:\flxrrll.exec:\flxrrll.exe51⤵
- Executes dropped EXE
PID:2072 -
\??\c:\hbtthb.exec:\hbtthb.exe52⤵
- Executes dropped EXE
PID:2504 -
\??\c:\vdpjd.exec:\vdpjd.exe53⤵
- Executes dropped EXE
PID:4892 -
\??\c:\jvvpd.exec:\jvvpd.exe54⤵
- Executes dropped EXE
PID:3960 -
\??\c:\fxrffrx.exec:\fxrffrx.exe55⤵
- Executes dropped EXE
PID:464 -
\??\c:\7bhbtt.exec:\7bhbtt.exe56⤵
- Executes dropped EXE
PID:3936 -
\??\c:\tnthbn.exec:\tnthbn.exe57⤵
- Executes dropped EXE
PID:3648 -
\??\c:\pvdvp.exec:\pvdvp.exe58⤵
- Executes dropped EXE
PID:2408 -
\??\c:\5frlfrf.exec:\5frlfrf.exe59⤵
- Executes dropped EXE
PID:4888 -
\??\c:\frxrrrr.exec:\frxrrrr.exe60⤵
- Executes dropped EXE
PID:536 -
\??\c:\nhnhhh.exec:\nhnhhh.exe61⤵
- Executes dropped EXE
PID:2064 -
\??\c:\vvjdj.exec:\vvjdj.exe62⤵
- Executes dropped EXE
PID:972 -
\??\c:\dvjdd.exec:\dvjdd.exe63⤵
- Executes dropped EXE
PID:4156 -
\??\c:\5lxxllf.exec:\5lxxllf.exe64⤵
- Executes dropped EXE
PID:4928 -
\??\c:\hbbnhn.exec:\hbbnhn.exe65⤵
- Executes dropped EXE
PID:4512 -
\??\c:\dvddp.exec:\dvddp.exe66⤵PID:1468
-
\??\c:\jdjjj.exec:\jdjjj.exe67⤵PID:4192
-
\??\c:\fxrlllx.exec:\fxrlllx.exe68⤵PID:796
-
\??\c:\xrlxrrl.exec:\xrlxrrl.exe69⤵PID:1236
-
\??\c:\htbtnn.exec:\htbtnn.exe70⤵PID:452
-
\??\c:\9nnhtn.exec:\9nnhtn.exe71⤵PID:5040
-
\??\c:\pjjpd.exec:\pjjpd.exe72⤵PID:1636
-
\??\c:\jvddp.exec:\jvddp.exe73⤵PID:3840
-
\??\c:\frrlrlr.exec:\frrlrlr.exe74⤵PID:3644
-
\??\c:\hbnhhh.exec:\hbnhhh.exe75⤵PID:3988
-
\??\c:\pjpdp.exec:\pjpdp.exe76⤵PID:3116
-
\??\c:\1frrrrf.exec:\1frrrrf.exe77⤵PID:3180
-
\??\c:\nbtttt.exec:\nbtttt.exe78⤵PID:3688
-
\??\c:\vvjdd.exec:\vvjdd.exe79⤵PID:4180
-
\??\c:\rlrrlrr.exec:\rlrrlrr.exe80⤵PID:3784
-
\??\c:\httnhh.exec:\httnhh.exe81⤵PID:4284
-
\??\c:\pjdvp.exec:\pjdvp.exe82⤵PID:664
-
\??\c:\xlrrffx.exec:\xlrrffx.exe83⤵PID:4956
-
\??\c:\btnbtn.exec:\btnbtn.exe84⤵PID:4184
-
\??\c:\7vppj.exec:\7vppj.exe85⤵PID:1352
-
\??\c:\xrfxxxx.exec:\xrfxxxx.exe86⤵PID:2644
-
\??\c:\xlxrlrl.exec:\xlxrlrl.exe87⤵PID:4464
-
\??\c:\hnbhtn.exec:\hnbhtn.exe88⤵PID:4328
-
\??\c:\vjvvp.exec:\vjvvp.exe89⤵PID:2708
-
\??\c:\dpvpj.exec:\dpvpj.exe90⤵PID:3548
-
\??\c:\flxrlrr.exec:\flxrlrr.exe91⤵PID:1320
-
\??\c:\hhnnhh.exec:\hhnnhh.exe92⤵PID:728
-
\??\c:\vdjdp.exec:\vdjdp.exe93⤵PID:2192
-
\??\c:\rrrrflf.exec:\rrrrflf.exe94⤵PID:4696
-
\??\c:\lfffxxx.exec:\lfffxxx.exe95⤵PID:1568
-
\??\c:\tthnnn.exec:\tthnnn.exe96⤵PID:2140
-
\??\c:\9jvvd.exec:\9jvvd.exe97⤵PID:4348
-
\??\c:\rfrlfff.exec:\rfrlfff.exe98⤵PID:3484
-
\??\c:\7nhntb.exec:\7nhntb.exe99⤵PID:1072
-
\??\c:\nntnnn.exec:\nntnnn.exe100⤵PID:1776
-
\??\c:\vvdvp.exec:\vvdvp.exe101⤵PID:2584
-
\??\c:\vdpjd.exec:\vdpjd.exe102⤵PID:1432
-
\??\c:\ffrrfff.exec:\ffrrfff.exe103⤵PID:1592
-
\??\c:\hbbbtt.exec:\hbbbtt.exe104⤵PID:1420
-
\??\c:\nbnhtt.exec:\nbnhtt.exe105⤵PID:748
-
\??\c:\dvppd.exec:\dvppd.exe106⤵PID:1416
-
\??\c:\lxfrxfx.exec:\lxfrxfx.exe107⤵PID:3376
-
\??\c:\nbhhhh.exec:\nbhhhh.exe108⤵PID:2204
-
\??\c:\btbbnn.exec:\btbbnn.exe109⤵PID:2180
-
\??\c:\pvjdv.exec:\pvjdv.exe110⤵PID:3660
-
\??\c:\jjpjj.exec:\jjpjj.exe111⤵PID:3092
-
\??\c:\3rxrllf.exec:\3rxrllf.exe112⤵PID:4960
-
\??\c:\fxllfff.exec:\fxllfff.exe113⤵PID:3912
-
\??\c:\tnhhht.exec:\tnhhht.exe114⤵PID:5060
-
\??\c:\5bttnn.exec:\5bttnn.exe115⤵PID:1988
-
\??\c:\7jvdd.exec:\7jvdd.exe116⤵PID:5004
-
\??\c:\1frxllf.exec:\1frxllf.exe117⤵PID:5032
-
\??\c:\htbttt.exec:\htbttt.exe118⤵PID:2972
-
\??\c:\3tnhbb.exec:\3tnhbb.exe119⤵PID:1792
-
\??\c:\vpvpp.exec:\vpvpp.exe120⤵PID:336
-
\??\c:\vdpjd.exec:\vdpjd.exe121⤵PID:1308
-
\??\c:\rrrrlxx.exec:\rrrrlxx.exe122⤵PID:4740
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-