Analysis
-
max time kernel
150s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2024, 19:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
24b5c657b97f67bd2657b967d264f250_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
24b5c657b97f67bd2657b967d264f250_NeikiAnalytics.exe
-
Size
134KB
-
MD5
24b5c657b97f67bd2657b967d264f250
-
SHA1
172f695c776441a5ae6cf1326ac6937e11706967
-
SHA256
87fd77d1a2fb4577628de9ef510edcdc0cb4ad61aad3ef13c6b68947688cfa0c
-
SHA512
e6abc7ec2992106e895835584e192cac7978a5ba4ed4804d9e1faea6481b56bb31d0ee8268d2b324d663b7f58f728b263c7e167ba1b28a6f77cdcf5ab24e8bfb
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afoHVpx+dGorp:n3C9BRW0j/1px+dGK
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/4700-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3240-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3656-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1084-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4752-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3160-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4500-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1412-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4124-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4248-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2676-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2408-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4000-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1776-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4616-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/440-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3440-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3476-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3124-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4280-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-624-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4020 ppjjd.exe 3240 djdvp.exe 3656 llllxxr.exe 5004 9djdd.exe 3212 lflfrxr.exe 4500 1lrrlrl.exe 1084 bnnhhb.exe 4752 nbbtnn.exe 2180 dvjdd.exe 4904 lllfffx.exe 3160 ttbbbb.exe 1412 3bhbtb.exe 4124 9xfffff.exe 4484 htbhnn.exe 4248 vdpjd.exe 2676 flrxxff.exe 4892 rxfxrrr.exe 2408 bthtnn.exe 4000 9flrfrf.exe 1776 hbtnhh.exe 4616 jjdvd.exe 732 pdpjd.exe 440 rfffffl.exe 3440 frfxrrl.exe 2316 hbtnnh.exe 3476 7fxxrxr.exe 3596 rfxfxrf.exe 3124 hbbbtt.exe 5044 dddpd.exe 4280 ddvvj.exe 1476 nhnhbb.exe 4204 ddpjj.exe 4896 vvdvv.exe 3608 3fllrrx.exe 2184 3rxlxfx.exe 4940 tttthh.exe 1184 dvvvp.exe 4356 jpdvp.exe 224 xrxlfff.exe 3092 lfllffx.exe 5068 hhnbht.exe 4464 vdvjd.exe 4060 3pjdv.exe 4964 lrfxrfx.exe 3192 btttbh.exe 2884 tntnhh.exe 4500 vpvpj.exe 3224 xllxrrl.exe 4728 ffllrrx.exe 4944 nnnhhh.exe 2724 vpppd.exe 688 vpdvp.exe 3516 lrxrlrl.exe 1240 rlrrlll.exe 3372 bhtntb.exe 3100 djvpj.exe 60 dvdvp.exe 1460 frrlxxr.exe 2188 flrlrrl.exe 4192 bhtnnh.exe 2624 1bbhbn.exe 4216 7pdvp.exe 2408 rlllffl.exe 4332 bhnhbt.exe -
resource yara_rule behavioral2/memory/4700-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3240-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1084-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2180-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2180-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1412-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4124-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4248-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2676-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2408-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4000-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1776-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/440-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3440-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3596-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4280-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-624-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4700 wrote to memory of 4020 4700 24b5c657b97f67bd2657b967d264f250_NeikiAnalytics.exe 83 PID 4700 wrote to memory of 4020 4700 24b5c657b97f67bd2657b967d264f250_NeikiAnalytics.exe 83 PID 4700 wrote to memory of 4020 4700 24b5c657b97f67bd2657b967d264f250_NeikiAnalytics.exe 83 PID 4020 wrote to memory of 3240 4020 ppjjd.exe 84 PID 4020 wrote to memory of 3240 4020 ppjjd.exe 84 PID 4020 wrote to memory of 3240 4020 ppjjd.exe 84 PID 3240 wrote to memory of 3656 3240 djdvp.exe 85 PID 3240 wrote to memory of 3656 3240 djdvp.exe 85 PID 3240 wrote to memory of 3656 3240 djdvp.exe 85 PID 3656 wrote to memory of 5004 3656 llllxxr.exe 86 PID 3656 wrote to memory of 5004 3656 llllxxr.exe 86 PID 3656 wrote to memory of 5004 3656 llllxxr.exe 86 PID 5004 wrote to memory of 3212 5004 9djdd.exe 87 PID 5004 wrote to memory of 3212 5004 9djdd.exe 87 PID 5004 wrote to memory of 3212 5004 9djdd.exe 87 PID 3212 wrote to memory of 4500 3212 lflfrxr.exe 88 PID 3212 wrote to memory of 4500 3212 lflfrxr.exe 88 PID 3212 wrote to memory of 4500 3212 lflfrxr.exe 88 PID 4500 wrote to memory of 1084 4500 1lrrlrl.exe 89 PID 4500 wrote to memory of 1084 4500 1lrrlrl.exe 89 PID 4500 wrote to memory of 1084 4500 1lrrlrl.exe 89 PID 1084 wrote to memory of 4752 1084 bnnhhb.exe 90 PID 1084 wrote to memory of 4752 1084 bnnhhb.exe 90 PID 1084 wrote to memory of 4752 1084 bnnhhb.exe 90 PID 4752 wrote to memory of 2180 4752 nbbtnn.exe 91 PID 4752 wrote to memory of 2180 4752 nbbtnn.exe 91 PID 4752 wrote to memory of 2180 4752 nbbtnn.exe 91 PID 2180 wrote to memory of 4904 2180 dvjdd.exe 92 PID 2180 wrote to memory of 4904 2180 dvjdd.exe 92 PID 2180 wrote to memory of 4904 2180 dvjdd.exe 92 PID 4904 wrote to memory of 3160 4904 lllfffx.exe 93 PID 4904 wrote to memory of 3160 4904 lllfffx.exe 93 PID 4904 wrote to memory of 3160 4904 lllfffx.exe 93 PID 3160 wrote to memory of 1412 3160 ttbbbb.exe 94 PID 3160 wrote to memory of 1412 3160 ttbbbb.exe 94 PID 3160 wrote to memory of 1412 3160 ttbbbb.exe 94 PID 1412 wrote to memory of 4124 1412 3bhbtb.exe 95 PID 1412 wrote to memory of 4124 1412 3bhbtb.exe 95 PID 1412 wrote to memory of 4124 1412 3bhbtb.exe 95 PID 4124 wrote to memory of 4484 4124 9xfffff.exe 96 PID 4124 wrote to memory of 4484 4124 9xfffff.exe 96 PID 4124 wrote to memory of 4484 4124 9xfffff.exe 96 PID 4484 wrote to memory of 4248 4484 htbhnn.exe 97 PID 4484 wrote to memory of 4248 4484 htbhnn.exe 97 PID 4484 wrote to memory of 4248 4484 htbhnn.exe 97 PID 4248 wrote to memory of 2676 4248 vdpjd.exe 98 PID 4248 wrote to memory of 2676 4248 vdpjd.exe 98 PID 4248 wrote to memory of 2676 4248 vdpjd.exe 98 PID 2676 wrote to memory of 4892 2676 flrxxff.exe 99 PID 2676 wrote to memory of 4892 2676 flrxxff.exe 99 PID 2676 wrote to memory of 4892 2676 flrxxff.exe 99 PID 4892 wrote to memory of 2408 4892 rxfxrrr.exe 100 PID 4892 wrote to memory of 2408 4892 rxfxrrr.exe 100 PID 4892 wrote to memory of 2408 4892 rxfxrrr.exe 100 PID 2408 wrote to memory of 4000 2408 bthtnn.exe 102 PID 2408 wrote to memory of 4000 2408 bthtnn.exe 102 PID 2408 wrote to memory of 4000 2408 bthtnn.exe 102 PID 4000 wrote to memory of 1776 4000 9flrfrf.exe 103 PID 4000 wrote to memory of 1776 4000 9flrfrf.exe 103 PID 4000 wrote to memory of 1776 4000 9flrfrf.exe 103 PID 1776 wrote to memory of 4616 1776 hbtnhh.exe 105 PID 1776 wrote to memory of 4616 1776 hbtnhh.exe 105 PID 1776 wrote to memory of 4616 1776 hbtnhh.exe 105 PID 4616 wrote to memory of 732 4616 jjdvd.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\24b5c657b97f67bd2657b967d264f250_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\24b5c657b97f67bd2657b967d264f250_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\ppjjd.exec:\ppjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\djdvp.exec:\djdvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
\??\c:\llllxxr.exec:\llllxxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\9djdd.exec:\9djdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\lflfrxr.exec:\lflfrxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\1lrrlrl.exec:\1lrrlrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\bnnhhb.exec:\bnnhhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\nbbtnn.exec:\nbbtnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\dvjdd.exec:\dvjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\lllfffx.exec:\lllfffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\ttbbbb.exec:\ttbbbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\3bhbtb.exec:\3bhbtb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\9xfffff.exec:\9xfffff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\htbhnn.exec:\htbhnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\vdpjd.exec:\vdpjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\flrxxff.exec:\flrxxff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\rxfxrrr.exec:\rxfxrrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\bthtnn.exec:\bthtnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\9flrfrf.exec:\9flrfrf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\hbtnhh.exec:\hbtnhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\jjdvd.exec:\jjdvd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\pdpjd.exec:\pdpjd.exe23⤵
- Executes dropped EXE
PID:732 -
\??\c:\rfffffl.exec:\rfffffl.exe24⤵
- Executes dropped EXE
PID:440 -
\??\c:\frfxrrl.exec:\frfxrrl.exe25⤵
- Executes dropped EXE
PID:3440 -
\??\c:\hbtnnh.exec:\hbtnnh.exe26⤵
- Executes dropped EXE
PID:2316 -
\??\c:\7fxxrxr.exec:\7fxxrxr.exe27⤵
- Executes dropped EXE
PID:3476 -
\??\c:\rfxfxrf.exec:\rfxfxrf.exe28⤵
- Executes dropped EXE
PID:3596 -
\??\c:\hbbbtt.exec:\hbbbtt.exe29⤵
- Executes dropped EXE
PID:3124 -
\??\c:\dddpd.exec:\dddpd.exe30⤵
- Executes dropped EXE
PID:5044 -
\??\c:\ddvvj.exec:\ddvvj.exe31⤵
- Executes dropped EXE
PID:4280 -
\??\c:\nhnhbb.exec:\nhnhbb.exe32⤵
- Executes dropped EXE
PID:1476 -
\??\c:\ddpjj.exec:\ddpjj.exe33⤵
- Executes dropped EXE
PID:4204 -
\??\c:\vvdvv.exec:\vvdvv.exe34⤵
- Executes dropped EXE
PID:4896 -
\??\c:\3fllrrx.exec:\3fllrrx.exe35⤵
- Executes dropped EXE
PID:3608 -
\??\c:\3rxlxfx.exec:\3rxlxfx.exe36⤵
- Executes dropped EXE
PID:2184 -
\??\c:\tttthh.exec:\tttthh.exe37⤵
- Executes dropped EXE
PID:4940 -
\??\c:\dvvvp.exec:\dvvvp.exe38⤵
- Executes dropped EXE
PID:1184 -
\??\c:\jpdvp.exec:\jpdvp.exe39⤵
- Executes dropped EXE
PID:4356 -
\??\c:\xrxlfff.exec:\xrxlfff.exe40⤵
- Executes dropped EXE
PID:224 -
\??\c:\lfllffx.exec:\lfllffx.exe41⤵
- Executes dropped EXE
PID:3092 -
\??\c:\hhnbht.exec:\hhnbht.exe42⤵
- Executes dropped EXE
PID:5068 -
\??\c:\vdvjd.exec:\vdvjd.exe43⤵
- Executes dropped EXE
PID:4464 -
\??\c:\3pjdv.exec:\3pjdv.exe44⤵
- Executes dropped EXE
PID:4060 -
\??\c:\lrfxrfx.exec:\lrfxrfx.exe45⤵
- Executes dropped EXE
PID:4964 -
\??\c:\btttbh.exec:\btttbh.exe46⤵
- Executes dropped EXE
PID:3192 -
\??\c:\tntnhh.exec:\tntnhh.exe47⤵
- Executes dropped EXE
PID:2884 -
\??\c:\vpvpj.exec:\vpvpj.exe48⤵
- Executes dropped EXE
PID:4500 -
\??\c:\xllxrrl.exec:\xllxrrl.exe49⤵
- Executes dropped EXE
PID:3224 -
\??\c:\ffllrrx.exec:\ffllrrx.exe50⤵
- Executes dropped EXE
PID:4728 -
\??\c:\nnnhhh.exec:\nnnhhh.exe51⤵
- Executes dropped EXE
PID:4944 -
\??\c:\vpppd.exec:\vpppd.exe52⤵
- Executes dropped EXE
PID:2724 -
\??\c:\vpdvp.exec:\vpdvp.exe53⤵
- Executes dropped EXE
PID:688 -
\??\c:\lrxrlrl.exec:\lrxrlrl.exe54⤵
- Executes dropped EXE
PID:3516 -
\??\c:\rlrrlll.exec:\rlrrlll.exe55⤵
- Executes dropped EXE
PID:1240 -
\??\c:\bhtntb.exec:\bhtntb.exe56⤵
- Executes dropped EXE
PID:3372 -
\??\c:\djvpj.exec:\djvpj.exe57⤵
- Executes dropped EXE
PID:3100 -
\??\c:\dvdvp.exec:\dvdvp.exe58⤵
- Executes dropped EXE
PID:60 -
\??\c:\frrlxxr.exec:\frrlxxr.exe59⤵
- Executes dropped EXE
PID:1460 -
\??\c:\flrlrrl.exec:\flrlrrl.exe60⤵
- Executes dropped EXE
PID:2188 -
\??\c:\bhtnnh.exec:\bhtnnh.exe61⤵
- Executes dropped EXE
PID:4192 -
\??\c:\1bbhbn.exec:\1bbhbn.exe62⤵
- Executes dropped EXE
PID:2624 -
\??\c:\7pdvp.exec:\7pdvp.exe63⤵
- Executes dropped EXE
PID:4216 -
\??\c:\rlllffl.exec:\rlllffl.exe64⤵
- Executes dropped EXE
PID:2408 -
\??\c:\bhnhbt.exec:\bhnhbt.exe65⤵
- Executes dropped EXE
PID:4332 -
\??\c:\btbbbb.exec:\btbbbb.exe66⤵PID:4408
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe67⤵PID:4628
-
\??\c:\xrfxllx.exec:\xrfxllx.exe68⤵PID:2040
-
\??\c:\tbhbtt.exec:\tbhbtt.exe69⤵PID:3400
-
\??\c:\jvdpd.exec:\jvdpd.exe70⤵PID:8
-
\??\c:\dvpdp.exec:\dvpdp.exe71⤵PID:4140
-
\??\c:\hhhbbh.exec:\hhhbbh.exe72⤵PID:220
-
\??\c:\thbhhb.exec:\thbhhb.exe73⤵PID:1112
-
\??\c:\xfffxxx.exec:\xfffxxx.exe74⤵PID:4028
-
\??\c:\5rllffl.exec:\5rllffl.exe75⤵PID:1096
-
\??\c:\hbbbbb.exec:\hbbbbb.exe76⤵PID:2204
-
\??\c:\vjvdj.exec:\vjvdj.exe77⤵PID:2076
-
\??\c:\vvpjj.exec:\vvpjj.exe78⤵PID:3136
-
\??\c:\flrlfrl.exec:\flrlfrl.exe79⤵PID:1964
-
\??\c:\nhnbtn.exec:\nhnbtn.exe80⤵PID:4280
-
\??\c:\vpvpj.exec:\vpvpj.exe81⤵PID:3524
-
\??\c:\pppjd.exec:\pppjd.exe82⤵PID:3244
-
\??\c:\rlxrxxl.exec:\rlxrxxl.exe83⤵PID:4564
-
\??\c:\nbnhbh.exec:\nbnhbh.exe84⤵PID:2284
-
\??\c:\jvjdp.exec:\jvjdp.exe85⤵PID:3120
-
\??\c:\jvvvj.exec:\jvvvj.exe86⤵PID:4940
-
\??\c:\frxrfll.exec:\frxrfll.exe87⤵PID:1184
-
\??\c:\rlfxfxf.exec:\rlfxfxf.exe88⤵PID:3200
-
\??\c:\tnhbtt.exec:\tnhbtt.exe89⤵PID:224
-
\??\c:\pjjpj.exec:\pjjpj.exe90⤵PID:404
-
\??\c:\1djvv.exec:\1djvv.exe91⤵PID:4064
-
\??\c:\1xfxllx.exec:\1xfxllx.exe92⤵PID:2368
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe93⤵PID:2384
-
\??\c:\9thttt.exec:\9thttt.exe94⤵PID:3172
-
\??\c:\thtnnb.exec:\thtnnb.exe95⤵PID:1396
-
\??\c:\vpppv.exec:\vpppv.exe96⤵PID:376
-
\??\c:\fflxrlx.exec:\fflxrlx.exe97⤵PID:1232
-
\??\c:\fxrrfrr.exec:\fxrrfrr.exe98⤵PID:4264
-
\??\c:\bthbbb.exec:\bthbbb.exe99⤵PID:2724
-
\??\c:\nhbthb.exec:\nhbthb.exe100⤵PID:3572
-
\??\c:\jdjdp.exec:\jdjdp.exe101⤵PID:1324
-
\??\c:\vdddv.exec:\vdddv.exe102⤵PID:1412
-
\??\c:\lrlfffl.exec:\lrlfffl.exe103⤵PID:5116
-
\??\c:\llrxffl.exec:\llrxffl.exe104⤵PID:5096
-
\??\c:\bhhbtt.exec:\bhhbtt.exe105⤵PID:2596
-
\??\c:\hhnhbb.exec:\hhnhbb.exe106⤵PID:1460
-
\??\c:\5pvdv.exec:\5pvdv.exe107⤵PID:4692
-
\??\c:\ppvjv.exec:\ppvjv.exe108⤵PID:4892
-
\??\c:\5rxrffx.exec:\5rxrffx.exe109⤵PID:4012
-
\??\c:\fxllfxr.exec:\fxllfxr.exe110⤵PID:4756
-
\??\c:\thnthh.exec:\thnthh.exe111⤵PID:2408
-
\??\c:\bhnhtt.exec:\bhnhtt.exe112⤵PID:3472
-
\??\c:\vpvpd.exec:\vpvpd.exe113⤵PID:1860
-
\??\c:\pdpdd.exec:\pdpdd.exe114⤵PID:4616
-
\??\c:\fxflxfx.exec:\fxflxfx.exe115⤵PID:4988
-
\??\c:\dvdvv.exec:\dvdvv.exe116⤵PID:4120
-
\??\c:\xffrrrl.exec:\xffrrrl.exe117⤵PID:4276
-
\??\c:\xrrffrx.exec:\xrrffrx.exe118⤵PID:2044
-
\??\c:\thnhtn.exec:\thnhtn.exe119⤵PID:4716
-
\??\c:\thbthh.exec:\thbthh.exe120⤵PID:1112
-
\??\c:\9pdpd.exec:\9pdpd.exe121⤵PID:2288
-
\??\c:\pdjdj.exec:\pdjdj.exe122⤵PID:2204
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-