Analysis
- max time kernel
149s - max time network
116s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
20/05/2024, 02:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
96cf1073e1fdaa134d1e12fad5a493c0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
- Target 96cf1073e1fdaa134d1e12fad5a493c0_NeikiAnalytics.exe
- Size 59KB
- Sample240520-dcm6psgc99
- SHA256 fdc5b000c41842926c4339fe20edd31b86f3cbd0ac4d93ab608338801bd37c0b
- MD5 96cf1073e1fdaa134d1e12fad5a493c0
- SHA1 24fcdae0065ddc8b7c3dbc6d1cdda9f5a433e956
- SHA512 7c8f4bb6124089b062ef45ecf5b78f7fdf76e43ea0804790973724322f094a07d231f5cd6697c3f9f5b4b075214e3d887677b4bb0a023fa314f6237302690961
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9Li:ymb3NkkiQ3mdBjFI9m
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/4788-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1416-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3884-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3380-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4856-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4132-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2844-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4888-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4152-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/988-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3280-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3104-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3000-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3520-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2980-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/740-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3012-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5096-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2036-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5112-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3944-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4380-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1624-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 1416 bttnnb.exe 3884 5lrlfff.exe 3380 llxrrrr.exe 4856 hbnnhh.exe 4132 fffffll.exe 2844 btbbnn.exe 4888 tnbbnb.exe 2132 vpjpd.exe 3392 xrrrrrl.exe 4152 nbhbtt.exe 672 vjppj.exe 988 5lfxllf.exe 3280 nnnnhb.exe 4628 jdvpj.exe 4940 ffffxrr.exe 3104 rffffxx.exe 3000 tthhbh.exe 3520 pvjvj.exe 2524 fllllll.exe 2980 bnnbnb.exe 740 jvvpj.exe 952 pjvvp.exe 3012 rxxxrrl.exe 5096 btnhbb.exe 2036 5vvpj.exe 5112 xlxrllf.exe 3944 bttnbb.exe 4380 vpvvd.exe 4644 rlxxxxf.exe 1624 fxrffll.exe 2820 ntnhbn.exe 3968 pdjdv.exe 3180 rxfrlrl.exe 2348 thhtnh.exe 2312 1btnhh.exe 8 dvpjv.exe 1156 pjdjd.exe 4936 lfxrllf.exe 4328 tntnnt.exe 1168 djppj.exe 2724 flxffff.exe 3128 xflllff.exe 116 1ttnhh.exe 3456 ppppj.exe 2900 dvpvp.exe 4856 3lxrlrr.exe 3168 btbttt.exe 1404 tbhhhn.exe 4804 jpppd.exe 5100 fllfxxr.exe 2052 fflllrx.exe 5072 7bthbb.exe 3724 ppddv.exe 2604 xfxlxxx.exe 4908 lxxxllf.exe 1092 ppddd.exe 2668 5rrfxxr.exe 3448 btnhhn.exe 3644 5ntnhn.exe 3000 1hnnbb.exe 2308 7jjdp.exe 1508 dpjdv.exe 2612 ffrxlrf.exe 1524 tnhbtt.exe -
resource yara_rule behavioral2/memory/4788-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1416-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3884-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4132-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2844-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3392-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3392-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4152-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/988-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3280-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3104-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3000-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3520-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2980-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/740-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3012-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5096-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2036-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3944-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4380-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1624-200-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4788 wrote to memory of 1416 4788 96cf1073e1fdaa134d1e12fad5a493c0_NeikiAnalytics.exe 83 PID 4788 wrote to memory of 1416 4788 96cf1073e1fdaa134d1e12fad5a493c0_NeikiAnalytics.exe 83 PID 4788 wrote to memory of 1416 4788 96cf1073e1fdaa134d1e12fad5a493c0_NeikiAnalytics.exe 83 PID 1416 wrote to memory of 3884 1416 bttnnb.exe 84 PID 1416 wrote to memory of 3884 1416 bttnnb.exe 84 PID 1416 wrote to memory of 3884 1416 bttnnb.exe 84 PID 3884 wrote to memory of 3380 3884 5lrlfff.exe 85 PID 3884 wrote to memory of 3380 3884 5lrlfff.exe 85 PID 3884 wrote to memory of 3380 3884 5lrlfff.exe 85 PID 3380 wrote to memory of 4856 3380 llxrrrr.exe 86 PID 3380 wrote to memory of 4856 3380 llxrrrr.exe 86 PID 3380 wrote to memory of 4856 3380 llxrrrr.exe 86 PID 4856 wrote to memory of 4132 4856 hbnnhh.exe 87 PID 4856 wrote to memory of 4132 4856 hbnnhh.exe 87 PID 4856 wrote to memory of 4132 4856 hbnnhh.exe 87 PID 4132 wrote to memory of 2844 4132 fffffll.exe 88 PID 4132 wrote to memory of 2844 4132 fffffll.exe 88 PID 4132 wrote to memory of 2844 4132 fffffll.exe 88 PID 2844 wrote to memory of 4888 2844 btbbnn.exe 89 PID 2844 wrote to memory of 4888 2844 btbbnn.exe 89 PID 2844 wrote to memory of 4888 2844 btbbnn.exe 89 PID 4888 wrote to memory of 2132 4888 tnbbnb.exe 90 PID 4888 wrote to memory of 2132 4888 tnbbnb.exe 90 PID 4888 wrote to memory of 2132 4888 tnbbnb.exe 90 PID 2132 wrote to memory of 3392 2132 vpjpd.exe 91 PID 2132 wrote to memory of 3392 2132 vpjpd.exe 91 PID 2132 wrote to memory of 3392 2132 vpjpd.exe 91 PID 3392 wrote to memory of 4152 3392 xrrrrrl.exe 92 PID 3392 wrote to memory of 4152 3392 xrrrrrl.exe 92 PID 3392 wrote to memory of 4152 3392 xrrrrrl.exe 92 PID 4152 wrote to memory of 672 4152 nbhbtt.exe 93 PID 4152 wrote to memory of 672 4152 nbhbtt.exe 93 PID 4152 wrote to memory of 672 4152 nbhbtt.exe 93 PID 672 wrote to memory of 988 672 vjppj.exe 94 PID 672 wrote to memory of 988 672 vjppj.exe 94 PID 672 wrote to memory of 988 672 vjppj.exe 94 PID 988 wrote to memory of 3280 988 5lfxllf.exe 95 PID 988 wrote to memory of 3280 988 5lfxllf.exe 95 PID 988 wrote to memory of 3280 988 5lfxllf.exe 95 PID 3280 wrote to memory of 4628 3280 nnnnhb.exe 96 PID 3280 wrote to memory of 4628 3280 nnnnhb.exe 96 PID 3280 wrote to memory of 4628 3280 nnnnhb.exe 96 PID 4628 wrote to memory of 4940 4628 jdvpj.exe 97 PID 4628 wrote to memory of 4940 4628 jdvpj.exe 97 PID 4628 wrote to memory of 4940 4628 jdvpj.exe 97 PID 4940 wrote to memory of 3104 4940 ffffxrr.exe 98 PID 4940 wrote to memory of 3104 4940 ffffxrr.exe 98 PID 4940 wrote to memory of 3104 4940 ffffxrr.exe 98 PID 3104 wrote to memory of 3000 3104 rffffxx.exe 99 PID 3104 wrote to memory of 3000 3104 rffffxx.exe 99 PID 3104 wrote to memory of 3000 3104 rffffxx.exe 99 PID 3000 wrote to memory of 3520 3000 tthhbh.exe 100 PID 3000 wrote to memory of 3520 3000 tthhbh.exe 100 PID 3000 wrote to memory of 3520 3000 tthhbh.exe 100 PID 3520 wrote to memory of 2524 3520 pvjvj.exe 101 PID 3520 wrote to memory of 2524 3520 pvjvj.exe 101 PID 3520 wrote to memory of 2524 3520 pvjvj.exe 101 PID 2524 wrote to memory of 2980 2524 fllllll.exe 102 PID 2524 wrote to memory of 2980 2524 fllllll.exe 102 PID 2524 wrote to memory of 2980 2524 fllllll.exe 102 PID 2980 wrote to memory of 740 2980 bnnbnb.exe 103 PID 2980 wrote to memory of 740 2980 bnnbnb.exe 103 PID 2980 wrote to memory of 740 2980 bnnbnb.exe 103 PID 740 wrote to memory of 952 740 jvvpj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\96cf1073e1fdaa134d1e12fad5a493c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\96cf1073e1fdaa134d1e12fad5a493c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\bttnnb.exec:\bttnnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\5lrlfff.exec:\5lrlfff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
\??\c:\llxrrrr.exec:\llxrrrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\hbnnhh.exec:\hbnnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\fffffll.exec:\fffffll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\btbbnn.exec:\btbbnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\tnbbnb.exec:\tnbbnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\vpjpd.exec:\vpjpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\xrrrrrl.exec:\xrrrrrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\nbhbtt.exec:\nbhbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\vjppj.exec:\vjppj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\5lfxllf.exec:\5lfxllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
\??\c:\nnnnhb.exec:\nnnnhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\jdvpj.exec:\jdvpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\ffffxrr.exec:\ffffxrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\rffffxx.exec:\rffffxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\tthhbh.exec:\tthhbh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\pvjvj.exec:\pvjvj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\fllllll.exec:\fllllll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\bnnbnb.exec:\bnnbnb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\jvvpj.exec:\jvvpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\pjvvp.exec:\pjvvp.exe23⤵
- Executes dropped EXE
PID:952 -
\??\c:\rxxxrrl.exec:\rxxxrrl.exe24⤵
- Executes dropped EXE
PID:3012 -
\??\c:\btnhbb.exec:\btnhbb.exe25⤵
- Executes dropped EXE
PID:5096 -
\??\c:\5vvpj.exec:\5vvpj.exe26⤵
- Executes dropped EXE
PID:2036 -
\??\c:\xlxrllf.exec:\xlxrllf.exe27⤵
- Executes dropped EXE
PID:5112 -
\??\c:\bttnbb.exec:\bttnbb.exe28⤵
- Executes dropped EXE
PID:3944 -
\??\c:\vpvvd.exec:\vpvvd.exe29⤵
- Executes dropped EXE
PID:4380 -
\??\c:\rlxxxxf.exec:\rlxxxxf.exe30⤵
- Executes dropped EXE
PID:4644 -
\??\c:\fxrffll.exec:\fxrffll.exe31⤵
- Executes dropped EXE
PID:1624 -
\??\c:\ntnhbn.exec:\ntnhbn.exe32⤵
- Executes dropped EXE
PID:2820 -
\??\c:\pdjdv.exec:\pdjdv.exe33⤵
- Executes dropped EXE
PID:3968 -
\??\c:\rxfrlrl.exec:\rxfrlrl.exe34⤵
- Executes dropped EXE
PID:3180 -
\??\c:\thhtnh.exec:\thhtnh.exe35⤵
- Executes dropped EXE
PID:2348 -
\??\c:\1btnhh.exec:\1btnhh.exe36⤵
- Executes dropped EXE
PID:2312 -
\??\c:\dvpjv.exec:\dvpjv.exe37⤵
- Executes dropped EXE
PID:8 -
\??\c:\pjdjd.exec:\pjdjd.exe38⤵
- Executes dropped EXE
PID:1156 -
\??\c:\lfxrllf.exec:\lfxrllf.exe39⤵
- Executes dropped EXE
PID:4936 -
\??\c:\tntnnt.exec:\tntnnt.exe40⤵
- Executes dropped EXE
PID:4328 -
\??\c:\djppj.exec:\djppj.exe41⤵
- Executes dropped EXE
PID:1168 -
\??\c:\flxffff.exec:\flxffff.exe42⤵
- Executes dropped EXE
PID:2724 -
\??\c:\xflllff.exec:\xflllff.exe43⤵
- Executes dropped EXE
PID:3128 -
\??\c:\1ttnhh.exec:\1ttnhh.exe44⤵
- Executes dropped EXE
PID:116 -
\??\c:\ppppj.exec:\ppppj.exe45⤵
- Executes dropped EXE
PID:3456 -
\??\c:\dvpvp.exec:\dvpvp.exe46⤵
- Executes dropped EXE
PID:2900 -
\??\c:\3lxrlrr.exec:\3lxrlrr.exe47⤵
- Executes dropped EXE
PID:4856 -
\??\c:\btbttt.exec:\btbttt.exe48⤵
- Executes dropped EXE
PID:3168 -
\??\c:\tbhhhn.exec:\tbhhhn.exe49⤵
- Executes dropped EXE
PID:1404 -
\??\c:\jpppd.exec:\jpppd.exe50⤵
- Executes dropped EXE
PID:4804 -
\??\c:\fllfxxr.exec:\fllfxxr.exe51⤵
- Executes dropped EXE
PID:5100 -
\??\c:\fflllrx.exec:\fflllrx.exe52⤵
- Executes dropped EXE
PID:2052 -
\??\c:\7bthbb.exec:\7bthbb.exe53⤵
- Executes dropped EXE
PID:5072 -
\??\c:\ppddv.exec:\ppddv.exe54⤵
- Executes dropped EXE
PID:3724 -
\??\c:\xfxlxxx.exec:\xfxlxxx.exe55⤵
- Executes dropped EXE
PID:2604 -
\??\c:\lxxxllf.exec:\lxxxllf.exe56⤵
- Executes dropped EXE
PID:4908 -
\??\c:\ppddd.exec:\ppddd.exe57⤵
- Executes dropped EXE
PID:1092 -
\??\c:\5rrfxxr.exec:\5rrfxxr.exe58⤵
- Executes dropped EXE
PID:2668 -
\??\c:\btnhhn.exec:\btnhhn.exe59⤵
- Executes dropped EXE
PID:3448 -
\??\c:\5ntnhn.exec:\5ntnhn.exe60⤵
- Executes dropped EXE
PID:3644 -
\??\c:\1hnnbb.exec:\1hnnbb.exe61⤵
- Executes dropped EXE
PID:3000 -
\??\c:\7jjdp.exec:\7jjdp.exe62⤵
- Executes dropped EXE
PID:2308 -
\??\c:\dpjdv.exec:\dpjdv.exe63⤵
- Executes dropped EXE
PID:1508 -
\??\c:\ffrxlrf.exec:\ffrxlrf.exe64⤵
- Executes dropped EXE
PID:2612 -
\??\c:\tnhbtt.exec:\tnhbtt.exe65⤵
- Executes dropped EXE
PID:1524 -
\??\c:\bthbtt.exec:\bthbtt.exe66⤵PID:3376
-
\??\c:\jdvvj.exec:\jdvvj.exe67⤵PID:740
-
\??\c:\dvdjj.exec:\dvdjj.exe68⤵PID:4304
-
\??\c:\xflllfr.exec:\xflllfr.exe69⤵PID:2700
-
\??\c:\rxrrrrl.exec:\rxrrrrl.exe70⤵PID:2240
-
\??\c:\5ntbbb.exec:\5ntbbb.exe71⤵PID:3664
-
\??\c:\tbhnnb.exec:\tbhnnb.exe72⤵PID:2036
-
\??\c:\vpdjp.exec:\vpdjp.exe73⤵PID:2924
-
\??\c:\pjvjd.exec:\pjvjd.exe74⤵PID:1068
-
\??\c:\flxfrrr.exec:\flxfrrr.exe75⤵PID:4072
-
\??\c:\xrrlffl.exec:\xrrlffl.exe76⤵PID:3600
-
\??\c:\htbtbb.exec:\htbtbb.exe77⤵PID:2276
-
\??\c:\bbttnn.exec:\bbttnn.exe78⤵PID:2248
-
\??\c:\pjdjd.exec:\pjdjd.exe79⤵PID:1968
-
\??\c:\vpvdd.exec:\vpvdd.exe80⤵PID:4932
-
\??\c:\lflfxff.exec:\lflfxff.exe81⤵PID:3192
-
\??\c:\7hnhbh.exec:\7hnhbh.exe82⤵PID:3180
-
\??\c:\nhhbnt.exec:\nhhbnt.exe83⤵PID:2348
-
\??\c:\pjdvv.exec:\pjdvv.exe84⤵PID:1420
-
\??\c:\dvdvp.exec:\dvdvp.exe85⤵PID:3824
-
\??\c:\lfxrllf.exec:\lfxrllf.exe86⤵PID:1484
-
\??\c:\rlxxxxx.exec:\rlxxxxx.exe87⤵PID:1240
-
\??\c:\nhhhbb.exec:\nhhhbb.exe88⤵PID:4320
-
\??\c:\ttbhth.exec:\ttbhth.exe89⤵PID:4512
-
\??\c:\jpvvv.exec:\jpvvv.exe90⤵PID:2020
-
\??\c:\jdppj.exec:\jdppj.exe91⤵PID:2000
-
\??\c:\lfxxxxx.exec:\lfxxxxx.exe92⤵PID:624
-
\??\c:\llflllr.exec:\llflllr.exe93⤵PID:1016
-
\??\c:\nhnhhh.exec:\nhnhhh.exe94⤵PID:936
-
\??\c:\bttnhn.exec:\bttnhn.exe95⤵PID:2064
-
\??\c:\vpvvv.exec:\vpvvv.exe96⤵PID:3920
-
\??\c:\frrlxxx.exec:\frrlxxx.exe97⤵PID:1444
-
\??\c:\xrrflxf.exec:\xrrflxf.exe98⤵PID:1980
-
\??\c:\nnnttt.exec:\nnnttt.exe99⤵PID:3216
-
\??\c:\5dpjj.exec:\5dpjj.exe100⤵PID:3124
-
\??\c:\ddjjj.exec:\ddjjj.exe101⤵PID:2864
-
\??\c:\frlfxxx.exec:\frlfxxx.exe102⤵PID:1692
-
\??\c:\3fllrrx.exec:\3fllrrx.exe103⤵PID:1092
-
\??\c:\lfrxrrr.exec:\lfrxrrr.exe104⤵PID:4872
-
\??\c:\bhttnn.exec:\bhttnn.exe105⤵PID:3644
-
\??\c:\thbnnn.exec:\thbnnn.exe106⤵PID:3000
-
\??\c:\vpjdv.exec:\vpjdv.exe107⤵PID:4484
-
\??\c:\dvvpp.exec:\dvvpp.exe108⤵PID:2980
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe109⤵PID:5032
-
\??\c:\nttttt.exec:\nttttt.exe110⤵PID:900
-
\??\c:\thhbbn.exec:\thhbbn.exe111⤵PID:3384
-
\??\c:\jjjvd.exec:\jjjvd.exe112⤵PID:5044
-
\??\c:\jpvjp.exec:\jpvjp.exe113⤵PID:3664
-
\??\c:\xxxllfx.exec:\xxxllfx.exe114⤵PID:4412
-
\??\c:\ffxxxxx.exec:\ffxxxxx.exe115⤵PID:1900
-
\??\c:\vdpdd.exec:\vdpdd.exe116⤵PID:2852
-
\??\c:\xrxxffr.exec:\xrxxffr.exe117⤵PID:1612
-
\??\c:\tttnhb.exec:\tttnhb.exe118⤵PID:1912
-
\??\c:\llrlxxr.exec:\llrlxxr.exe119⤵PID:2248
-
\??\c:\hbhbbt.exec:\hbhbbt.exe120⤵PID:3968
-
\??\c:\jdppv.exec:\jdppv.exe121⤵PID:2856
-
\??\c:\rxflfxf.exec:\rxflfxf.exe122⤵PID:4812
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-