Analysis
-
max time kernel
150s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 12:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4be3b077b59ef04896f19507e594e4facce7ed4af8ec264daa746a672590edff_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4be3b077b59ef04896f19507e594e4facce7ed4af8ec264daa746a672590edff_NeikiAnalytics.exe
-
Size
56KB
-
MD5
b0a9a55fbebae79c87ac820fc23cc970
-
SHA1
0034c370f57336bd29b0afbdc9cd4d328e198a55
-
SHA256
4be3b077b59ef04896f19507e594e4facce7ed4af8ec264daa746a672590edff
-
SHA512
ab834ec8c469838fbe15955b4d807d2ef9fa6330e6db7eeddd4e7879630f51cbcbbba7aab43acb552c1a1fc9461f7b2dfac69f4427c25f3faa93af344cf103ed
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFeD:ymb3NkkiQ3mdBjFIFeD
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/5108-6-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5108-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1524-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3736-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4432-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1136-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2960-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2420-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2312-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4152-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3196-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3812-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1540-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4388-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/520-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3228-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/528-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2188-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2940-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2656-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4252-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1524 xfrxxfx.exe 4564 3ttbth.exe 3736 5htthh.exe 4432 vpvpd.exe 1136 llxfrrl.exe 2420 hhhnhn.exe 2960 nhhnnb.exe 2312 dddvp.exe 4152 xrrrlrl.exe 3648 rllrrrl.exe 3196 7hnhbb.exe 3812 jdpjd.exe 1540 fxlrrrr.exe 4388 frxlfrr.exe 2016 1thhbh.exe 924 ppvvp.exe 520 3jjdd.exe 516 fxflxfx.exe 3228 tnnnnn.exe 4868 pdjpj.exe 528 1jjjj.exe 2188 fxrrrfx.exe 2940 btbbtt.exe 4532 vppjd.exe 1316 pvddv.exe 3788 vpvpd.exe 2344 xflffff.exe 2656 5llrlxl.exe 4252 bnnhhh.exe 1832 dvvpd.exe 5052 frlxfxl.exe 2436 tttnbt.exe 1224 tnbthb.exe 3000 jdjdv.exe 1524 djppj.exe 4344 rxxrfxr.exe 2580 bnbthb.exe 4924 vppjv.exe 2112 1jppd.exe 2740 lllxxxl.exe 2760 9frrlrl.exe 2032 hnnhnh.exe 2148 btbtbb.exe 4136 5vddd.exe 2024 3vjjj.exe 64 3rxrlll.exe 1236 hhntnb.exe 4352 jdddv.exe 3124 vjpjv.exe 1872 rrrrllr.exe 4444 5nhhnn.exe 4472 bhnhbb.exe 456 jpppp.exe 2264 dvdvv.exe 452 frxxxxx.exe 100 9ffffff.exe 4648 nhnhbn.exe 3108 hbhbnt.exe 3836 dvpjj.exe 1952 dpppj.exe 2088 ddppv.exe 3612 rrxxxxx.exe 4316 xxlllrx.exe 2176 3bhhht.exe -
resource yara_rule behavioral2/memory/5108-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1524-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3736-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3736-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4432-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1136-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2960-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2420-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4152-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3196-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3812-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1540-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4388-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/520-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3228-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/528-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2188-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2940-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4532-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2656-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4252-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5108 wrote to memory of 1524 5108 4be3b077b59ef04896f19507e594e4facce7ed4af8ec264daa746a672590edff_NeikiAnalytics.exe 83 PID 5108 wrote to memory of 1524 5108 4be3b077b59ef04896f19507e594e4facce7ed4af8ec264daa746a672590edff_NeikiAnalytics.exe 83 PID 5108 wrote to memory of 1524 5108 4be3b077b59ef04896f19507e594e4facce7ed4af8ec264daa746a672590edff_NeikiAnalytics.exe 83 PID 1524 wrote to memory of 4564 1524 xfrxxfx.exe 84 PID 1524 wrote to memory of 4564 1524 xfrxxfx.exe 84 PID 1524 wrote to memory of 4564 1524 xfrxxfx.exe 84 PID 4564 wrote to memory of 3736 4564 3ttbth.exe 85 PID 4564 wrote to memory of 3736 4564 3ttbth.exe 85 PID 4564 wrote to memory of 3736 4564 3ttbth.exe 85 PID 3736 wrote to memory of 4432 3736 5htthh.exe 86 PID 3736 wrote to memory of 4432 3736 5htthh.exe 86 PID 3736 wrote to memory of 4432 3736 5htthh.exe 86 PID 4432 wrote to memory of 1136 4432 vpvpd.exe 87 PID 4432 wrote to memory of 1136 4432 vpvpd.exe 87 PID 4432 wrote to memory of 1136 4432 vpvpd.exe 87 PID 1136 wrote to memory of 2420 1136 llxfrrl.exe 88 PID 1136 wrote to memory of 2420 1136 llxfrrl.exe 88 PID 1136 wrote to memory of 2420 1136 llxfrrl.exe 88 PID 2420 wrote to memory of 2960 2420 hhhnhn.exe 89 PID 2420 wrote to memory of 2960 2420 hhhnhn.exe 89 PID 2420 wrote to memory of 2960 2420 hhhnhn.exe 89 PID 2960 wrote to memory of 2312 2960 nhhnnb.exe 90 PID 2960 wrote to memory of 2312 2960 nhhnnb.exe 90 PID 2960 wrote to memory of 2312 2960 nhhnnb.exe 90 PID 2312 wrote to memory of 4152 2312 dddvp.exe 91 PID 2312 wrote to memory of 4152 2312 dddvp.exe 91 PID 2312 wrote to memory of 4152 2312 dddvp.exe 91 PID 4152 wrote to memory of 3648 4152 xrrrlrl.exe 92 PID 4152 wrote to memory of 3648 4152 xrrrlrl.exe 92 PID 4152 wrote to memory of 3648 4152 xrrrlrl.exe 92 PID 3648 wrote to memory of 3196 3648 rllrrrl.exe 93 PID 3648 wrote to memory of 3196 3648 rllrrrl.exe 93 PID 3648 wrote to memory of 3196 3648 rllrrrl.exe 93 PID 3196 wrote to memory of 3812 3196 7hnhbb.exe 94 PID 3196 wrote to memory of 3812 3196 7hnhbb.exe 94 PID 3196 wrote to memory of 3812 3196 7hnhbb.exe 94 PID 3812 wrote to memory of 1540 3812 jdpjd.exe 95 PID 3812 wrote to memory of 1540 3812 jdpjd.exe 95 PID 3812 wrote to memory of 1540 3812 jdpjd.exe 95 PID 1540 wrote to memory of 4388 1540 fxlrrrr.exe 96 PID 1540 wrote to memory of 4388 1540 fxlrrrr.exe 96 PID 1540 wrote to memory of 4388 1540 fxlrrrr.exe 96 PID 4388 wrote to memory of 2016 4388 frxlfrr.exe 97 PID 4388 wrote to memory of 2016 4388 frxlfrr.exe 97 PID 4388 wrote to memory of 2016 4388 frxlfrr.exe 97 PID 2016 wrote to memory of 924 2016 1thhbh.exe 98 PID 2016 wrote to memory of 924 2016 1thhbh.exe 98 PID 2016 wrote to memory of 924 2016 1thhbh.exe 98 PID 924 wrote to memory of 520 924 ppvvp.exe 99 PID 924 wrote to memory of 520 924 ppvvp.exe 99 PID 924 wrote to memory of 520 924 ppvvp.exe 99 PID 520 wrote to memory of 516 520 3jjdd.exe 100 PID 520 wrote to memory of 516 520 3jjdd.exe 100 PID 520 wrote to memory of 516 520 3jjdd.exe 100 PID 516 wrote to memory of 3228 516 fxflxfx.exe 101 PID 516 wrote to memory of 3228 516 fxflxfx.exe 101 PID 516 wrote to memory of 3228 516 fxflxfx.exe 101 PID 3228 wrote to memory of 4868 3228 tnnnnn.exe 102 PID 3228 wrote to memory of 4868 3228 tnnnnn.exe 102 PID 3228 wrote to memory of 4868 3228 tnnnnn.exe 102 PID 4868 wrote to memory of 528 4868 pdjpj.exe 103 PID 4868 wrote to memory of 528 4868 pdjpj.exe 103 PID 4868 wrote to memory of 528 4868 pdjpj.exe 103 PID 528 wrote to memory of 2188 528 1jjjj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\4be3b077b59ef04896f19507e594e4facce7ed4af8ec264daa746a672590edff_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4be3b077b59ef04896f19507e594e4facce7ed4af8ec264daa746a672590edff_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\xfrxxfx.exec:\xfrxxfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\3ttbth.exec:\3ttbth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\5htthh.exec:\5htthh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
\??\c:\vpvpd.exec:\vpvpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\llxfrrl.exec:\llxfrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\hhhnhn.exec:\hhhnhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\nhhnnb.exec:\nhhnnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\dddvp.exec:\dddvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\xrrrlrl.exec:\xrrrlrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\rllrrrl.exec:\rllrrrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
\??\c:\7hnhbb.exec:\7hnhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\jdpjd.exec:\jdpjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\fxlrrrr.exec:\fxlrrrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\frxlfrr.exec:\frxlfrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\1thhbh.exec:\1thhbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\ppvvp.exec:\ppvvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\3jjdd.exec:\3jjdd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:520 -
\??\c:\fxflxfx.exec:\fxflxfx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\tnnnnn.exec:\tnnnnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\pdjpj.exec:\pdjpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\1jjjj.exec:\1jjjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
\??\c:\fxrrrfx.exec:\fxrrrfx.exe23⤵
- Executes dropped EXE
PID:2188 -
\??\c:\btbbtt.exec:\btbbtt.exe24⤵
- Executes dropped EXE
PID:2940 -
\??\c:\vppjd.exec:\vppjd.exe25⤵
- Executes dropped EXE
PID:4532 -
\??\c:\pvddv.exec:\pvddv.exe26⤵
- Executes dropped EXE
PID:1316 -
\??\c:\vpvpd.exec:\vpvpd.exe27⤵
- Executes dropped EXE
PID:3788 -
\??\c:\xflffff.exec:\xflffff.exe28⤵
- Executes dropped EXE
PID:2344 -
\??\c:\5llrlxl.exec:\5llrlxl.exe29⤵
- Executes dropped EXE
PID:2656 -
\??\c:\bnnhhh.exec:\bnnhhh.exe30⤵
- Executes dropped EXE
PID:4252 -
\??\c:\dvvpd.exec:\dvvpd.exe31⤵
- Executes dropped EXE
PID:1832 -
\??\c:\frlxfxl.exec:\frlxfxl.exe32⤵
- Executes dropped EXE
PID:5052 -
\??\c:\tttnbt.exec:\tttnbt.exe33⤵
- Executes dropped EXE
PID:2436 -
\??\c:\tnbthb.exec:\tnbthb.exe34⤵
- Executes dropped EXE
PID:1224 -
\??\c:\jdjdv.exec:\jdjdv.exe35⤵
- Executes dropped EXE
PID:3000 -
\??\c:\djppj.exec:\djppj.exe36⤵
- Executes dropped EXE
PID:1524 -
\??\c:\rxxrfxr.exec:\rxxrfxr.exe37⤵
- Executes dropped EXE
PID:4344 -
\??\c:\bnbthb.exec:\bnbthb.exe38⤵
- Executes dropped EXE
PID:2580 -
\??\c:\vppjv.exec:\vppjv.exe39⤵
- Executes dropped EXE
PID:4924 -
\??\c:\1jppd.exec:\1jppd.exe40⤵
- Executes dropped EXE
PID:2112 -
\??\c:\lllxxxl.exec:\lllxxxl.exe41⤵
- Executes dropped EXE
PID:2740 -
\??\c:\9frrlrl.exec:\9frrlrl.exe42⤵
- Executes dropped EXE
PID:2760 -
\??\c:\hnnhnh.exec:\hnnhnh.exe43⤵
- Executes dropped EXE
PID:2032 -
\??\c:\btbtbb.exec:\btbtbb.exe44⤵
- Executes dropped EXE
PID:2148 -
\??\c:\5vddd.exec:\5vddd.exe45⤵
- Executes dropped EXE
PID:4136 -
\??\c:\3vjjj.exec:\3vjjj.exe46⤵
- Executes dropped EXE
PID:2024 -
\??\c:\3rxrlll.exec:\3rxrlll.exe47⤵
- Executes dropped EXE
PID:64 -
\??\c:\hhntnb.exec:\hhntnb.exe48⤵
- Executes dropped EXE
PID:1236 -
\??\c:\jdddv.exec:\jdddv.exe49⤵
- Executes dropped EXE
PID:4352 -
\??\c:\vjpjv.exec:\vjpjv.exe50⤵
- Executes dropped EXE
PID:3124 -
\??\c:\rrrrllr.exec:\rrrrllr.exe51⤵
- Executes dropped EXE
PID:1872 -
\??\c:\5nhhnn.exec:\5nhhnn.exe52⤵
- Executes dropped EXE
PID:4444 -
\??\c:\bhnhbb.exec:\bhnhbb.exe53⤵
- Executes dropped EXE
PID:4472 -
\??\c:\jpppp.exec:\jpppp.exe54⤵
- Executes dropped EXE
PID:456 -
\??\c:\dvdvv.exec:\dvdvv.exe55⤵
- Executes dropped EXE
PID:2264 -
\??\c:\frxxxxx.exec:\frxxxxx.exe56⤵
- Executes dropped EXE
PID:452 -
\??\c:\9ffffff.exec:\9ffffff.exe57⤵
- Executes dropped EXE
PID:100 -
\??\c:\nhnhbn.exec:\nhnhbn.exe58⤵
- Executes dropped EXE
PID:4648 -
\??\c:\hbhbnt.exec:\hbhbnt.exe59⤵
- Executes dropped EXE
PID:3108 -
\??\c:\dvpjj.exec:\dvpjj.exe60⤵
- Executes dropped EXE
PID:3836 -
\??\c:\dpppj.exec:\dpppj.exe61⤵
- Executes dropped EXE
PID:1952 -
\??\c:\ddppv.exec:\ddppv.exe62⤵
- Executes dropped EXE
PID:2088 -
\??\c:\rrxxxxx.exec:\rrxxxxx.exe63⤵
- Executes dropped EXE
PID:3612 -
\??\c:\xxlllrx.exec:\xxlllrx.exe64⤵
- Executes dropped EXE
PID:4316 -
\??\c:\3bhhht.exec:\3bhhht.exe65⤵
- Executes dropped EXE
PID:2176 -
\??\c:\hhttnn.exec:\hhttnn.exe66⤵PID:896
-
\??\c:\vvvvj.exec:\vvvvj.exe67⤵PID:4528
-
\??\c:\1jjjd.exec:\1jjjd.exe68⤵PID:2784
-
\??\c:\jdppp.exec:\jdppp.exe69⤵PID:4880
-
\??\c:\3fllfff.exec:\3fllfff.exe70⤵PID:3508
-
\??\c:\xrfxffx.exec:\xrfxffx.exe71⤵PID:4512
-
\??\c:\bbbbbb.exec:\bbbbbb.exe72⤵PID:2328
-
\??\c:\nnttnb.exec:\nnttnb.exe73⤵PID:1444
-
\??\c:\5dvvd.exec:\5dvvd.exe74⤵PID:1832
-
\??\c:\djpjd.exec:\djpjd.exe75⤵PID:5052
-
\??\c:\fxllrrr.exec:\fxllrrr.exe76⤵PID:532
-
\??\c:\1fllrrx.exec:\1fllrrx.exe77⤵PID:3516
-
\??\c:\bntbtb.exec:\bntbtb.exe78⤵PID:1752
-
\??\c:\9hhhth.exec:\9hhhth.exe79⤵PID:2152
-
\??\c:\ppppj.exec:\ppppj.exe80⤵PID:4816
-
\??\c:\jjpjv.exec:\jjpjv.exe81⤵PID:4420
-
\??\c:\fxllrrf.exec:\fxllrrf.exe82⤵PID:4884
-
\??\c:\lrxxrrl.exec:\lrxxrrl.exe83⤵PID:900
-
\??\c:\htnntb.exec:\htnntb.exe84⤵PID:5104
-
\??\c:\1ntnbb.exec:\1ntnbb.exe85⤵PID:4312
-
\??\c:\hntnhh.exec:\hntnhh.exe86⤵PID:2640
-
\??\c:\pjjjd.exec:\pjjjd.exe87⤵PID:2592
-
\??\c:\vpdvv.exec:\vpdvv.exe88⤵PID:2032
-
\??\c:\fxrxrll.exec:\fxrxrll.exe89⤵PID:3704
-
\??\c:\rrrllll.exec:\rrrllll.exe90⤵PID:2312
-
\??\c:\tnttnn.exec:\tnttnn.exe91⤵PID:2024
-
\??\c:\ttttbb.exec:\ttttbb.exe92⤵PID:3244
-
\??\c:\jjpjv.exec:\jjpjv.exe93⤵PID:3648
-
\??\c:\vpddv.exec:\vpddv.exe94⤵PID:336
-
\??\c:\fllfxlf.exec:\fllfxlf.exe95⤵PID:4888
-
\??\c:\fxxrllf.exec:\fxxrllf.exe96⤵PID:1872
-
\??\c:\bnnnnh.exec:\bnnnnh.exe97⤵PID:1560
-
\??\c:\xfxxrxx.exec:\xfxxrxx.exe98⤵PID:3564
-
\??\c:\3tbbtb.exec:\3tbbtb.exe99⤵PID:4908
-
\??\c:\dddvp.exec:\dddvp.exe100⤵PID:1388
-
\??\c:\jjpjd.exec:\jjpjd.exe101⤵PID:3540
-
\??\c:\llrflff.exec:\llrflff.exe102⤵PID:3272
-
\??\c:\3bhbhn.exec:\3bhbhn.exe103⤵PID:3060
-
\??\c:\dvvpj.exec:\dvvpj.exe104⤵PID:3144
-
\??\c:\jpvpd.exec:\jpvpd.exe105⤵PID:4448
-
\??\c:\9xlllrx.exec:\9xlllrx.exe106⤵PID:688
-
\??\c:\rlrfffx.exec:\rlrfffx.exe107⤵PID:2700
-
\??\c:\7lfflrf.exec:\7lfflrf.exe108⤵PID:3236
-
\??\c:\httbtt.exec:\httbtt.exe109⤵PID:2796
-
\??\c:\tnhnnb.exec:\tnhnnb.exe110⤵PID:5044
-
\??\c:\jppjd.exec:\jppjd.exe111⤵PID:2720
-
\??\c:\9xfxlll.exec:\9xfxlll.exe112⤵PID:2784
-
\??\c:\7rrlllr.exec:\7rrlllr.exe113⤵PID:3520
-
\??\c:\bttnhh.exec:\bttnhh.exe114⤵PID:1988
-
\??\c:\hbnnhh.exec:\hbnnhh.exe115⤵PID:4696
-
\??\c:\vpvvd.exec:\vpvvd.exe116⤵PID:3164
-
\??\c:\llfrlfl.exec:\llfrlfl.exe117⤵PID:3240
-
\??\c:\xfffffx.exec:\xfffffx.exe118⤵PID:1336
-
\??\c:\xxlfllr.exec:\xxlfllr.exe119⤵PID:1924
-
\??\c:\9bhbhn.exec:\9bhbhn.exe120⤵PID:532
-
\??\c:\jvdvv.exec:\jvdvv.exe121⤵PID:3516
-
\??\c:\1xxrllf.exec:\1xxrllf.exe122⤵PID:3000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-