Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 10:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d9ba29adbd0f818ddbffc7affdecd5f0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
d9ba29adbd0f818ddbffc7affdecd5f0_NeikiAnalytics.exe
-
Size
89KB
-
MD5
d9ba29adbd0f818ddbffc7affdecd5f0
-
SHA1
cd14ad209807b07b1deba93229741ddd5ac31050
-
SHA256
5b07661597e85e52374fc5790450b6faef0a003b38305511694fc86b3ab23084
-
SHA512
dd3a606a9b62099a39b50f5b0b68f1c6218ad45e34fede393cea9ff64e7fe08fb039ce4c41b618d0e31c3c94502798f54be9372c54d29a016fdedf2c0417387a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73t6MlYqn+jMp9jb+5C/i+:ymb3NkkiQ3mdBjFo73tvn+Yp9jb+5C/5
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral2/memory/3212-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1924-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3308-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1868-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4456-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1208-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3300-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3548-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1828-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4064-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/920-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4436-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/616-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2272-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2356-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2916-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2040-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1924 vppjj.exe 3308 xlxllfx.exe 1868 hbtnbb.exe 4456 tbhbbb.exe 4952 xrlfxrl.exe 1208 rlllxxr.exe 3300 httnhb.exe 3320 xlfxlfx.exe 3548 hbtnbt.exe 1828 1nttnn.exe 2932 pdjjd.exe 4472 xxlfxxr.exe 4064 7fxrlrf.exe 3712 btttnt.exe 920 pjjvd.exe 3700 fxrlxxl.exe 1596 9ffrllf.exe 4520 3ttnhb.exe 4436 nbnhbt.exe 616 vvpjj.exe 3152 lxrlffx.exe 1520 thhtnt.exe 2272 vdpjd.exe 2976 vvvvv.exe 4940 lfxlxxx.exe 2356 1bnhnn.exe 2916 3ntntt.exe 1476 dpdjd.exe 3464 xlrrrrx.exe 2040 httttb.exe 4120 thbtnn.exe 4464 dddvv.exe 1632 rrrrllr.exe 4524 ffxxrxr.exe 4108 hbhbbt.exe 4468 nhhhbt.exe 3244 jjppj.exe 2016 jdvvp.exe 3416 rxxxrlf.exe 3136 rrlrfxf.exe 2212 hbbtbt.exe 3116 dvjvj.exe 4852 dvjpd.exe 4688 fflxrrx.exe 1792 rlrlrrx.exe 1508 ddddd.exe 4792 vjpjj.exe 2836 xrxrlll.exe 2312 5hhthn.exe 2368 jjvjj.exe 4844 flffxxr.exe 3412 5xxrlrf.exe 1668 bnttnn.exe 2260 nhhbbb.exe 2092 dpvvp.exe 1064 vvvpj.exe 4928 frlfxxr.exe 4656 9hnhtt.exe 764 ttnhtt.exe 1880 7vjdv.exe 4548 fxrffff.exe 384 3frxxxx.exe 2876 nbbbbb.exe 2936 1hhnbb.exe -
resource yara_rule behavioral2/memory/3212-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3308-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1868-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3300-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1208-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3300-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3548-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1828-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4064-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/920-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4436-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/616-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2272-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2356-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2916-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-198-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3212 wrote to memory of 1924 3212 d9ba29adbd0f818ddbffc7affdecd5f0_NeikiAnalytics.exe 83 PID 3212 wrote to memory of 1924 3212 d9ba29adbd0f818ddbffc7affdecd5f0_NeikiAnalytics.exe 83 PID 3212 wrote to memory of 1924 3212 d9ba29adbd0f818ddbffc7affdecd5f0_NeikiAnalytics.exe 83 PID 1924 wrote to memory of 3308 1924 vppjj.exe 84 PID 1924 wrote to memory of 3308 1924 vppjj.exe 84 PID 1924 wrote to memory of 3308 1924 vppjj.exe 84 PID 3308 wrote to memory of 1868 3308 xlxllfx.exe 85 PID 3308 wrote to memory of 1868 3308 xlxllfx.exe 85 PID 3308 wrote to memory of 1868 3308 xlxllfx.exe 85 PID 1868 wrote to memory of 4456 1868 hbtnbb.exe 86 PID 1868 wrote to memory of 4456 1868 hbtnbb.exe 86 PID 1868 wrote to memory of 4456 1868 hbtnbb.exe 86 PID 4456 wrote to memory of 4952 4456 tbhbbb.exe 87 PID 4456 wrote to memory of 4952 4456 tbhbbb.exe 87 PID 4456 wrote to memory of 4952 4456 tbhbbb.exe 87 PID 4952 wrote to memory of 1208 4952 xrlfxrl.exe 88 PID 4952 wrote to memory of 1208 4952 xrlfxrl.exe 88 PID 4952 wrote to memory of 1208 4952 xrlfxrl.exe 88 PID 1208 wrote to memory of 3300 1208 rlllxxr.exe 89 PID 1208 wrote to memory of 3300 1208 rlllxxr.exe 89 PID 1208 wrote to memory of 3300 1208 rlllxxr.exe 89 PID 3300 wrote to memory of 3320 3300 httnhb.exe 90 PID 3300 wrote to memory of 3320 3300 httnhb.exe 90 PID 3300 wrote to memory of 3320 3300 httnhb.exe 90 PID 3320 wrote to memory of 3548 3320 xlfxlfx.exe 91 PID 3320 wrote to memory of 3548 3320 xlfxlfx.exe 91 PID 3320 wrote to memory of 3548 3320 xlfxlfx.exe 91 PID 3548 wrote to memory of 1828 3548 hbtnbt.exe 92 PID 3548 wrote to memory of 1828 3548 hbtnbt.exe 92 PID 3548 wrote to memory of 1828 3548 hbtnbt.exe 92 PID 1828 wrote to memory of 2932 1828 1nttnn.exe 93 PID 1828 wrote to memory of 2932 1828 1nttnn.exe 93 PID 1828 wrote to memory of 2932 1828 1nttnn.exe 93 PID 2932 wrote to memory of 4472 2932 pdjjd.exe 94 PID 2932 wrote to memory of 4472 2932 pdjjd.exe 94 PID 2932 wrote to memory of 4472 2932 pdjjd.exe 94 PID 4472 wrote to memory of 4064 4472 xxlfxxr.exe 95 PID 4472 wrote to memory of 4064 4472 xxlfxxr.exe 95 PID 4472 wrote to memory of 4064 4472 xxlfxxr.exe 95 PID 4064 wrote to memory of 3712 4064 7fxrlrf.exe 96 PID 4064 wrote to memory of 3712 4064 7fxrlrf.exe 96 PID 4064 wrote to memory of 3712 4064 7fxrlrf.exe 96 PID 3712 wrote to memory of 920 3712 btttnt.exe 97 PID 3712 wrote to memory of 920 3712 btttnt.exe 97 PID 3712 wrote to memory of 920 3712 btttnt.exe 97 PID 920 wrote to memory of 3700 920 pjjvd.exe 98 PID 920 wrote to memory of 3700 920 pjjvd.exe 98 PID 920 wrote to memory of 3700 920 pjjvd.exe 98 PID 3700 wrote to memory of 1596 3700 fxrlxxl.exe 99 PID 3700 wrote to memory of 1596 3700 fxrlxxl.exe 99 PID 3700 wrote to memory of 1596 3700 fxrlxxl.exe 99 PID 1596 wrote to memory of 4520 1596 9ffrllf.exe 100 PID 1596 wrote to memory of 4520 1596 9ffrllf.exe 100 PID 1596 wrote to memory of 4520 1596 9ffrllf.exe 100 PID 4520 wrote to memory of 4436 4520 3ttnhb.exe 101 PID 4520 wrote to memory of 4436 4520 3ttnhb.exe 101 PID 4520 wrote to memory of 4436 4520 3ttnhb.exe 101 PID 4436 wrote to memory of 616 4436 nbnhbt.exe 102 PID 4436 wrote to memory of 616 4436 nbnhbt.exe 102 PID 4436 wrote to memory of 616 4436 nbnhbt.exe 102 PID 616 wrote to memory of 3152 616 vvpjj.exe 103 PID 616 wrote to memory of 3152 616 vvpjj.exe 103 PID 616 wrote to memory of 3152 616 vvpjj.exe 103 PID 3152 wrote to memory of 1520 3152 lxrlffx.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9ba29adbd0f818ddbffc7affdecd5f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d9ba29adbd0f818ddbffc7affdecd5f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\vppjj.exec:\vppjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\xlxllfx.exec:\xlxllfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\hbtnbb.exec:\hbtnbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\tbhbbb.exec:\tbhbbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\xrlfxrl.exec:\xrlfxrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\rlllxxr.exec:\rlllxxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\httnhb.exec:\httnhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
\??\c:\xlfxlfx.exec:\xlfxlfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\hbtnbt.exec:\hbtnbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\1nttnn.exec:\1nttnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\pdjjd.exec:\pdjjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\xxlfxxr.exec:\xxlfxxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\7fxrlrf.exec:\7fxrlrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\btttnt.exec:\btttnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\pjjvd.exec:\pjjvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\fxrlxxl.exec:\fxrlxxl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\9ffrllf.exec:\9ffrllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\3ttnhb.exec:\3ttnhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\nbnhbt.exec:\nbnhbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\vvpjj.exec:\vvpjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
\??\c:\lxrlffx.exec:\lxrlffx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\thhtnt.exec:\thhtnt.exe23⤵
- Executes dropped EXE
PID:1520 -
\??\c:\vdpjd.exec:\vdpjd.exe24⤵
- Executes dropped EXE
PID:2272 -
\??\c:\vvvvv.exec:\vvvvv.exe25⤵
- Executes dropped EXE
PID:2976 -
\??\c:\lfxlxxx.exec:\lfxlxxx.exe26⤵
- Executes dropped EXE
PID:4940 -
\??\c:\1bnhnn.exec:\1bnhnn.exe27⤵
- Executes dropped EXE
PID:2356 -
\??\c:\3ntntt.exec:\3ntntt.exe28⤵
- Executes dropped EXE
PID:2916 -
\??\c:\dpdjd.exec:\dpdjd.exe29⤵
- Executes dropped EXE
PID:1476 -
\??\c:\xlrrrrx.exec:\xlrrrrx.exe30⤵
- Executes dropped EXE
PID:3464 -
\??\c:\httttb.exec:\httttb.exe31⤵
- Executes dropped EXE
PID:2040 -
\??\c:\thbtnn.exec:\thbtnn.exe32⤵
- Executes dropped EXE
PID:4120 -
\??\c:\dddvv.exec:\dddvv.exe33⤵
- Executes dropped EXE
PID:4464 -
\??\c:\rrrrllr.exec:\rrrrllr.exe34⤵
- Executes dropped EXE
PID:1632 -
\??\c:\ffxxrxr.exec:\ffxxrxr.exe35⤵
- Executes dropped EXE
PID:4524 -
\??\c:\hbhbbt.exec:\hbhbbt.exe36⤵
- Executes dropped EXE
PID:4108 -
\??\c:\nhhhbt.exec:\nhhhbt.exe37⤵
- Executes dropped EXE
PID:4468 -
\??\c:\jjppj.exec:\jjppj.exe38⤵
- Executes dropped EXE
PID:3244 -
\??\c:\jdvvp.exec:\jdvvp.exe39⤵
- Executes dropped EXE
PID:2016 -
\??\c:\rxxxrlf.exec:\rxxxrlf.exe40⤵
- Executes dropped EXE
PID:3416 -
\??\c:\rrlrfxf.exec:\rrlrfxf.exe41⤵
- Executes dropped EXE
PID:3136 -
\??\c:\hbbtbt.exec:\hbbtbt.exe42⤵
- Executes dropped EXE
PID:2212 -
\??\c:\dvjvj.exec:\dvjvj.exe43⤵
- Executes dropped EXE
PID:3116 -
\??\c:\dvjpd.exec:\dvjpd.exe44⤵
- Executes dropped EXE
PID:4852 -
\??\c:\fflxrrx.exec:\fflxrrx.exe45⤵
- Executes dropped EXE
PID:4688 -
\??\c:\rlrlrrx.exec:\rlrlrrx.exe46⤵
- Executes dropped EXE
PID:1792 -
\??\c:\ddddd.exec:\ddddd.exe47⤵
- Executes dropped EXE
PID:1508 -
\??\c:\vjpjj.exec:\vjpjj.exe48⤵
- Executes dropped EXE
PID:4792 -
\??\c:\xrxrlll.exec:\xrxrlll.exe49⤵
- Executes dropped EXE
PID:2836 -
\??\c:\5hhthn.exec:\5hhthn.exe50⤵
- Executes dropped EXE
PID:2312 -
\??\c:\jjvjj.exec:\jjvjj.exe51⤵
- Executes dropped EXE
PID:2368 -
\??\c:\flffxxr.exec:\flffxxr.exe52⤵
- Executes dropped EXE
PID:4844 -
\??\c:\5xxrlrf.exec:\5xxrlrf.exe53⤵
- Executes dropped EXE
PID:3412 -
\??\c:\bnttnn.exec:\bnttnn.exe54⤵
- Executes dropped EXE
PID:1668 -
\??\c:\nhhbbb.exec:\nhhbbb.exe55⤵
- Executes dropped EXE
PID:2260 -
\??\c:\dpvvp.exec:\dpvvp.exe56⤵
- Executes dropped EXE
PID:2092 -
\??\c:\vvvpj.exec:\vvvpj.exe57⤵
- Executes dropped EXE
PID:1064 -
\??\c:\frlfxxr.exec:\frlfxxr.exe58⤵
- Executes dropped EXE
PID:4928 -
\??\c:\9hnhtt.exec:\9hnhtt.exe59⤵
- Executes dropped EXE
PID:4656 -
\??\c:\ttnhtt.exec:\ttnhtt.exe60⤵
- Executes dropped EXE
PID:764 -
\??\c:\7vjdv.exec:\7vjdv.exe61⤵
- Executes dropped EXE
PID:1880 -
\??\c:\fxrffff.exec:\fxrffff.exe62⤵
- Executes dropped EXE
PID:4548 -
\??\c:\3frxxxx.exec:\3frxxxx.exe63⤵
- Executes dropped EXE
PID:384 -
\??\c:\nbbbbb.exec:\nbbbbb.exe64⤵
- Executes dropped EXE
PID:2876 -
\??\c:\1hhnbb.exec:\1hhnbb.exe65⤵
- Executes dropped EXE
PID:2936 -
\??\c:\7jvvv.exec:\7jvvv.exe66⤵PID:3132
-
\??\c:\dpdjd.exec:\dpdjd.exe67⤵PID:616
-
\??\c:\rrxrlfx.exec:\rrxrlfx.exe68⤵PID:3252
-
\??\c:\xxxfxrr.exec:\xxxfxrr.exe69⤵PID:1188
-
\??\c:\tnnnnt.exec:\tnnnnt.exe70⤵PID:3968
-
\??\c:\tthhnn.exec:\tthhnn.exe71⤵PID:2008
-
\??\c:\jdpjd.exec:\jdpjd.exe72⤵PID:2976
-
\??\c:\dvddv.exec:\dvddv.exe73⤵PID:2740
-
\??\c:\lfxfxrr.exec:\lfxfxrr.exe74⤵PID:3508
-
\??\c:\ffrrxxl.exec:\ffrrxxl.exe75⤵PID:428
-
\??\c:\tnnbtt.exec:\tnnbtt.exe76⤵PID:2452
-
\??\c:\bbtttb.exec:\bbtttb.exe77⤵PID:4484
-
\??\c:\dvjdp.exec:\dvjdp.exe78⤵PID:2404
-
\??\c:\jvvjv.exec:\jvvjv.exe79⤵PID:4776
-
\??\c:\rlllxrl.exec:\rlllxrl.exe80⤵PID:3972
-
\??\c:\5lffxxl.exec:\5lffxxl.exe81⤵PID:4716
-
\??\c:\nbhhhh.exec:\nbhhhh.exe82⤵PID:1396
-
\??\c:\djppj.exec:\djppj.exe83⤵PID:1632
-
\??\c:\jjjdv.exec:\jjjdv.exe84⤵PID:4304
-
\??\c:\9lrxrrr.exec:\9lrxrrr.exe85⤵PID:3096
-
\??\c:\ttbttt.exec:\ttbttt.exe86⤵PID:2748
-
\??\c:\tntnnn.exec:\tntnnn.exe87⤵PID:1924
-
\??\c:\dpvpj.exec:\dpvpj.exe88⤵PID:3308
-
\??\c:\jdvjd.exec:\jdvjd.exe89⤵PID:864
-
\??\c:\lffxxxx.exec:\lffxxxx.exe90⤵PID:2964
-
\??\c:\rrfrxfx.exec:\rrfrxfx.exe91⤵PID:664
-
\??\c:\btnhnn.exec:\btnhnn.exe92⤵PID:2908
-
\??\c:\nnnnhh.exec:\nnnnhh.exe93⤵PID:3228
-
\??\c:\9vpjd.exec:\9vpjd.exe94⤵PID:3084
-
\??\c:\jpppj.exec:\jpppj.exe95⤵PID:1020
-
\??\c:\3frfrlf.exec:\3frfrlf.exe96⤵PID:1460
-
\??\c:\xxfffff.exec:\xxfffff.exe97⤵PID:3300
-
\??\c:\5ntnhh.exec:\5ntnhh.exe98⤵PID:1252
-
\??\c:\tnnthb.exec:\tnnthb.exe99⤵PID:2624
-
\??\c:\dvjjp.exec:\dvjjp.exe100⤵PID:3168
-
\??\c:\dpvvj.exec:\dpvvj.exe101⤵PID:5092
-
\??\c:\frlxrxr.exec:\frlxrxr.exe102⤵PID:4960
-
\??\c:\thhbtn.exec:\thhbtn.exe103⤵PID:1972
-
\??\c:\nnbttt.exec:\nnbttt.exe104⤵PID:4516
-
\??\c:\vdpjd.exec:\vdpjd.exe105⤵PID:3128
-
\??\c:\ddppj.exec:\ddppj.exe106⤵PID:4556
-
\??\c:\frlfffx.exec:\frlfffx.exe107⤵PID:1484
-
\??\c:\xfxrfxr.exec:\xfxrfxr.exe108⤵PID:2024
-
\??\c:\bntnnn.exec:\bntnnn.exe109⤵PID:920
-
\??\c:\thnnnh.exec:\thnnnh.exe110⤵PID:1904
-
\??\c:\vpjdv.exec:\vpjdv.exe111⤵PID:5032
-
\??\c:\7pjdp.exec:\7pjdp.exe112⤵PID:4664
-
\??\c:\rffxrlf.exec:\rffxrlf.exe113⤵PID:4192
-
\??\c:\lflrxxx.exec:\lflrxxx.exe114⤵PID:3964
-
\??\c:\tthtnh.exec:\tthtnh.exe115⤵PID:2756
-
\??\c:\bbbnht.exec:\bbbnht.exe116⤵PID:1060
-
\??\c:\dppjd.exec:\dppjd.exe117⤵PID:1824
-
\??\c:\rrffxxx.exec:\rrffxxx.exe118⤵PID:1620
-
\??\c:\fxrrllx.exec:\fxrrllx.exe119⤵PID:1204
-
\??\c:\nnbtbb.exec:\nnbtbb.exe120⤵PID:4544
-
\??\c:\ppjjd.exec:\ppjjd.exe121⤵PID:3444
-
\??\c:\5lxrfxr.exec:\5lxrfxr.exe122⤵PID:3540
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-