Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 00:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6007507ee4e870d54002d695cf047710_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
6007507ee4e870d54002d695cf047710_NeikiAnalytics.exe
-
Size
61KB
-
MD5
6007507ee4e870d54002d695cf047710
-
SHA1
11585ef509848e568948f2a16b3f37a57db61eb3
-
SHA256
cc8e602b9e85e6a4f8648c27ca62f8e62fc68b58d9abe06acec52d7bcf72fe05
-
SHA512
5d4cf564dabea7755e3a920a5579684b965b06a2a66488145fdcf28caf5fb804354e8b3324268a8e9929f3ac53d7468e84fde0b83657e5ee389f80845394ff27
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvAEaFJL8:ymb3NkkiQ3mdBjFIvAv8
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/3016-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4012-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3484-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4576-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2540-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3080-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4900-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4736-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4684-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3724-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3648-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2008-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3996-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4228-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/556-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3132-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1524-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/468-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/864-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3876-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3696-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4012 dvddd.exe 388 ffllllx.exe 3016 nhnttt.exe 4576 vpvvj.exe 2540 xxfflfr.exe 3080 bnnnhn.exe 4900 dvppd.exe 4736 dvvpj.exe 4684 fxfxxxx.exe 3676 7ttnhb.exe 3724 5hhhtn.exe 2416 dvpdv.exe 3648 fflxrrl.exe 2008 nhnhbb.exe 640 tnhbtt.exe 728 ffrxrxl.exe 3996 httnnh.exe 4228 pdjdp.exe 5100 3pjdp.exe 4652 lrrlxxx.exe 4952 rrlfxxr.exe 556 ntbhhh.exe 3132 jpvpd.exe 1524 vvddp.exe 468 ffrlllf.exe 1044 bbhhtn.exe 3984 pdppd.exe 864 dpddv.exe 3876 lfrllll.exe 3696 nbnnhn.exe 1276 thnhnn.exe 1088 dvdvd.exe 812 xxxfffl.exe 2176 tnhhbh.exe 4640 pddjj.exe 3888 pjjdd.exe 5004 rflfrll.exe 3708 nhnnbh.exe 3416 bnbtnn.exe 1860 jpvvv.exe 1548 rrrlllf.exe 1792 7bntbb.exe 3076 hnnthh.exe 3220 vvjjd.exe 1684 dpdvj.exe 320 lffxlll.exe 3872 lfrrxrr.exe 544 7ntnbb.exe 3912 hnttnt.exe 4316 7vddd.exe 3680 rfrlxxx.exe 4684 llflllr.exe 2536 ttnnnn.exe 1232 hnthhn.exe 4696 jdjvv.exe 2416 5frrrfl.exe 1612 lflfffl.exe 2008 tnttth.exe 4540 djpdp.exe 4716 lffxrrl.exe 3272 1vvpp.exe 4708 ddvpj.exe 5100 5xllrxr.exe 2116 lflflll.exe -
resource yara_rule behavioral2/memory/3016-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/388-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3484-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4576-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2540-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3080-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4736-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4736-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4736-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4736-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4684-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4684-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3724-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2008-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3996-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4228-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/556-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3132-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1524-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/468-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/864-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3876-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-199-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3484 wrote to memory of 4012 3484 6007507ee4e870d54002d695cf047710_NeikiAnalytics.exe 82 PID 3484 wrote to memory of 4012 3484 6007507ee4e870d54002d695cf047710_NeikiAnalytics.exe 82 PID 3484 wrote to memory of 4012 3484 6007507ee4e870d54002d695cf047710_NeikiAnalytics.exe 82 PID 4012 wrote to memory of 388 4012 dvddd.exe 83 PID 4012 wrote to memory of 388 4012 dvddd.exe 83 PID 4012 wrote to memory of 388 4012 dvddd.exe 83 PID 388 wrote to memory of 3016 388 ffllllx.exe 84 PID 388 wrote to memory of 3016 388 ffllllx.exe 84 PID 388 wrote to memory of 3016 388 ffllllx.exe 84 PID 3016 wrote to memory of 4576 3016 nhnttt.exe 85 PID 3016 wrote to memory of 4576 3016 nhnttt.exe 85 PID 3016 wrote to memory of 4576 3016 nhnttt.exe 85 PID 4576 wrote to memory of 2540 4576 vpvvj.exe 86 PID 4576 wrote to memory of 2540 4576 vpvvj.exe 86 PID 4576 wrote to memory of 2540 4576 vpvvj.exe 86 PID 2540 wrote to memory of 3080 2540 xxfflfr.exe 87 PID 2540 wrote to memory of 3080 2540 xxfflfr.exe 87 PID 2540 wrote to memory of 3080 2540 xxfflfr.exe 87 PID 3080 wrote to memory of 4900 3080 bnnnhn.exe 88 PID 3080 wrote to memory of 4900 3080 bnnnhn.exe 88 PID 3080 wrote to memory of 4900 3080 bnnnhn.exe 88 PID 4900 wrote to memory of 4736 4900 dvppd.exe 89 PID 4900 wrote to memory of 4736 4900 dvppd.exe 89 PID 4900 wrote to memory of 4736 4900 dvppd.exe 89 PID 4736 wrote to memory of 4684 4736 dvvpj.exe 90 PID 4736 wrote to memory of 4684 4736 dvvpj.exe 90 PID 4736 wrote to memory of 4684 4736 dvvpj.exe 90 PID 4684 wrote to memory of 3676 4684 fxfxxxx.exe 91 PID 4684 wrote to memory of 3676 4684 fxfxxxx.exe 91 PID 4684 wrote to memory of 3676 4684 fxfxxxx.exe 91 PID 3676 wrote to memory of 3724 3676 7ttnhb.exe 92 PID 3676 wrote to memory of 3724 3676 7ttnhb.exe 92 PID 3676 wrote to memory of 3724 3676 7ttnhb.exe 92 PID 3724 wrote to memory of 2416 3724 5hhhtn.exe 93 PID 3724 wrote to memory of 2416 3724 5hhhtn.exe 93 PID 3724 wrote to memory of 2416 3724 5hhhtn.exe 93 PID 2416 wrote to memory of 3648 2416 dvpdv.exe 94 PID 2416 wrote to memory of 3648 2416 dvpdv.exe 94 PID 2416 wrote to memory of 3648 2416 dvpdv.exe 94 PID 3648 wrote to memory of 2008 3648 fflxrrl.exe 95 PID 3648 wrote to memory of 2008 3648 fflxrrl.exe 95 PID 3648 wrote to memory of 2008 3648 fflxrrl.exe 95 PID 2008 wrote to memory of 640 2008 nhnhbb.exe 96 PID 2008 wrote to memory of 640 2008 nhnhbb.exe 96 PID 2008 wrote to memory of 640 2008 nhnhbb.exe 96 PID 640 wrote to memory of 728 640 tnhbtt.exe 97 PID 640 wrote to memory of 728 640 tnhbtt.exe 97 PID 640 wrote to memory of 728 640 tnhbtt.exe 97 PID 728 wrote to memory of 3996 728 ffrxrxl.exe 98 PID 728 wrote to memory of 3996 728 ffrxrxl.exe 98 PID 728 wrote to memory of 3996 728 ffrxrxl.exe 98 PID 3996 wrote to memory of 4228 3996 httnnh.exe 99 PID 3996 wrote to memory of 4228 3996 httnnh.exe 99 PID 3996 wrote to memory of 4228 3996 httnnh.exe 99 PID 4228 wrote to memory of 5100 4228 pdjdp.exe 100 PID 4228 wrote to memory of 5100 4228 pdjdp.exe 100 PID 4228 wrote to memory of 5100 4228 pdjdp.exe 100 PID 5100 wrote to memory of 4652 5100 3pjdp.exe 101 PID 5100 wrote to memory of 4652 5100 3pjdp.exe 101 PID 5100 wrote to memory of 4652 5100 3pjdp.exe 101 PID 4652 wrote to memory of 4952 4652 lrrlxxx.exe 102 PID 4652 wrote to memory of 4952 4652 lrrlxxx.exe 102 PID 4652 wrote to memory of 4952 4652 lrrlxxx.exe 102 PID 4952 wrote to memory of 556 4952 rrlfxxr.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\6007507ee4e870d54002d695cf047710_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6007507ee4e870d54002d695cf047710_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\dvddd.exec:\dvddd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\ffllllx.exec:\ffllllx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\nhnttt.exec:\nhnttt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\vpvvj.exec:\vpvvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\xxfflfr.exec:\xxfflfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\bnnnhn.exec:\bnnnhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\dvppd.exec:\dvppd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\dvvpj.exec:\dvvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\fxfxxxx.exec:\fxfxxxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\7ttnhb.exec:\7ttnhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\5hhhtn.exec:\5hhhtn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
\??\c:\dvpdv.exec:\dvpdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\fflxrrl.exec:\fflxrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
\??\c:\nhnhbb.exec:\nhnhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\tnhbtt.exec:\tnhbtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\ffrxrxl.exec:\ffrxrxl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:728 -
\??\c:\httnnh.exec:\httnnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\pdjdp.exec:\pdjdp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\3pjdp.exec:\3pjdp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\lrrlxxx.exec:\lrrlxxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\rrlfxxr.exec:\rrlfxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\ntbhhh.exec:\ntbhhh.exe23⤵
- Executes dropped EXE
PID:556 -
\??\c:\jpvpd.exec:\jpvpd.exe24⤵
- Executes dropped EXE
PID:3132 -
\??\c:\vvddp.exec:\vvddp.exe25⤵
- Executes dropped EXE
PID:1524 -
\??\c:\ffrlllf.exec:\ffrlllf.exe26⤵
- Executes dropped EXE
PID:468 -
\??\c:\bbhhtn.exec:\bbhhtn.exe27⤵
- Executes dropped EXE
PID:1044 -
\??\c:\pdppd.exec:\pdppd.exe28⤵
- Executes dropped EXE
PID:3984 -
\??\c:\dpddv.exec:\dpddv.exe29⤵
- Executes dropped EXE
PID:864 -
\??\c:\lfrllll.exec:\lfrllll.exe30⤵
- Executes dropped EXE
PID:3876 -
\??\c:\nbnnhn.exec:\nbnnhn.exe31⤵
- Executes dropped EXE
PID:3696 -
\??\c:\thnhnn.exec:\thnhnn.exe32⤵
- Executes dropped EXE
PID:1276 -
\??\c:\dvdvd.exec:\dvdvd.exe33⤵
- Executes dropped EXE
PID:1088 -
\??\c:\xxxfffl.exec:\xxxfffl.exe34⤵
- Executes dropped EXE
PID:812 -
\??\c:\tnhhbh.exec:\tnhhbh.exe35⤵
- Executes dropped EXE
PID:2176 -
\??\c:\pddjj.exec:\pddjj.exe36⤵
- Executes dropped EXE
PID:4640 -
\??\c:\pjjdd.exec:\pjjdd.exe37⤵
- Executes dropped EXE
PID:3888 -
\??\c:\rflfrll.exec:\rflfrll.exe38⤵
- Executes dropped EXE
PID:5004 -
\??\c:\nhnnbh.exec:\nhnnbh.exe39⤵
- Executes dropped EXE
PID:3708 -
\??\c:\bnbtnn.exec:\bnbtnn.exe40⤵
- Executes dropped EXE
PID:3416 -
\??\c:\jpvvv.exec:\jpvvv.exe41⤵
- Executes dropped EXE
PID:1860 -
\??\c:\xrxxxxl.exec:\xrxxxxl.exe42⤵PID:4496
-
\??\c:\rrrlllf.exec:\rrrlllf.exe43⤵
- Executes dropped EXE
PID:1548 -
\??\c:\7bntbb.exec:\7bntbb.exe44⤵
- Executes dropped EXE
PID:1792 -
\??\c:\hnnthh.exec:\hnnthh.exe45⤵
- Executes dropped EXE
PID:3076 -
\??\c:\vvjjd.exec:\vvjjd.exe46⤵
- Executes dropped EXE
PID:3220 -
\??\c:\dpdvj.exec:\dpdvj.exe47⤵
- Executes dropped EXE
PID:1684 -
\??\c:\lffxlll.exec:\lffxlll.exe48⤵
- Executes dropped EXE
PID:320 -
\??\c:\lfrrxrr.exec:\lfrrxrr.exe49⤵
- Executes dropped EXE
PID:3872 -
\??\c:\7ntnbb.exec:\7ntnbb.exe50⤵
- Executes dropped EXE
PID:544 -
\??\c:\hnttnt.exec:\hnttnt.exe51⤵
- Executes dropped EXE
PID:3912 -
\??\c:\7vddd.exec:\7vddd.exe52⤵
- Executes dropped EXE
PID:4316 -
\??\c:\rfrlxxx.exec:\rfrlxxx.exe53⤵
- Executes dropped EXE
PID:3680 -
\??\c:\llflllr.exec:\llflllr.exe54⤵
- Executes dropped EXE
PID:4684 -
\??\c:\ttnnnn.exec:\ttnnnn.exe55⤵
- Executes dropped EXE
PID:2536 -
\??\c:\hnthhn.exec:\hnthhn.exe56⤵
- Executes dropped EXE
PID:1232 -
\??\c:\jdjvv.exec:\jdjvv.exe57⤵
- Executes dropped EXE
PID:4696 -
\??\c:\5frrrfl.exec:\5frrrfl.exe58⤵
- Executes dropped EXE
PID:2416 -
\??\c:\lflfffl.exec:\lflfffl.exe59⤵
- Executes dropped EXE
PID:1612 -
\??\c:\tnttth.exec:\tnttth.exe60⤵
- Executes dropped EXE
PID:2008 -
\??\c:\djpdp.exec:\djpdp.exe61⤵
- Executes dropped EXE
PID:4540 -
\??\c:\lffxrrl.exec:\lffxrrl.exe62⤵
- Executes dropped EXE
PID:4716 -
\??\c:\1vvpp.exec:\1vvpp.exe63⤵
- Executes dropped EXE
PID:3272 -
\??\c:\ddvpj.exec:\ddvpj.exe64⤵
- Executes dropped EXE
PID:4708 -
\??\c:\5xllrxr.exec:\5xllrxr.exe65⤵
- Executes dropped EXE
PID:5100 -
\??\c:\lflflll.exec:\lflflll.exe66⤵
- Executes dropped EXE
PID:2116 -
\??\c:\hhtbnn.exec:\hhtbnn.exe67⤵PID:4160
-
\??\c:\hnbtnt.exec:\hnbtnt.exe68⤵PID:540
-
\??\c:\jjjdd.exec:\jjjdd.exe69⤵PID:4796
-
\??\c:\fxfxxfl.exec:\fxfxxfl.exe70⤵PID:5068
-
\??\c:\xlflrrx.exec:\xlflrrx.exe71⤵PID:1600
-
\??\c:\bnhhnt.exec:\bnhhnt.exe72⤵PID:3040
-
\??\c:\vpdvj.exec:\vpdvj.exe73⤵PID:3028
-
\??\c:\bttnnh.exec:\bttnnh.exe74⤵PID:1720
-
\??\c:\pvvpj.exec:\pvvpj.exe75⤵PID:2476
-
\??\c:\ppdpv.exec:\ppdpv.exe76⤵PID:1692
-
\??\c:\lrlrfff.exec:\lrlrfff.exe77⤵PID:3104
-
\??\c:\xlffxfx.exec:\xlffxfx.exe78⤵PID:3340
-
\??\c:\pjjpj.exec:\pjjpj.exe79⤵PID:2272
-
\??\c:\rflxrrr.exec:\rflxrrr.exe80⤵PID:2268
-
\??\c:\hhtnnn.exec:\hhtnnn.exe81⤵PID:3672
-
\??\c:\7fffllf.exec:\7fffllf.exe82⤵PID:2696
-
\??\c:\xxfxxll.exec:\xxfxxll.exe83⤵PID:4640
-
\??\c:\5hhbbb.exec:\5hhbbb.exe84⤵PID:3888
-
\??\c:\vppjd.exec:\vppjd.exe85⤵PID:5004
-
\??\c:\xrxrlll.exec:\xrxrlll.exe86⤵PID:2420
-
\??\c:\3xfrrrr.exec:\3xfrrrr.exe87⤵PID:5088
-
\??\c:\bhnhtb.exec:\bhnhtb.exe88⤵PID:4012
-
\??\c:\1ntthh.exec:\1ntthh.exe89⤵PID:2796
-
\??\c:\1pvvp.exec:\1pvvp.exe90⤵PID:1744
-
\??\c:\5xffxxl.exec:\5xffxxl.exe91⤵PID:4616
-
\??\c:\llrlfff.exec:\llrlfff.exe92⤵PID:4576
-
\??\c:\3nttnb.exec:\3nttnb.exe93⤵PID:1684
-
\??\c:\jjddv.exec:\jjddv.exe94⤵PID:4484
-
\??\c:\rxlxlrx.exec:\rxlxlrx.exe95⤵PID:4320
-
\??\c:\xxlxrlx.exec:\xxlxrlx.exe96⤵PID:4900
-
\??\c:\htbthn.exec:\htbthn.exe97⤵PID:2152
-
\??\c:\pvpdp.exec:\pvpdp.exe98⤵PID:1840
-
\??\c:\vpdvj.exec:\vpdvj.exe99⤵PID:748
-
\??\c:\lfflflr.exec:\lfflflr.exe100⤵PID:3428
-
\??\c:\lrrxrff.exec:\lrrxrff.exe101⤵PID:2888
-
\??\c:\htttnt.exec:\htttnt.exe102⤵PID:1688
-
\??\c:\vjvjv.exec:\vjvjv.exe103⤵PID:1964
-
\??\c:\ddpdd.exec:\ddpdd.exe104⤵PID:4856
-
\??\c:\fxfrlll.exec:\fxfrlll.exe105⤵PID:400
-
\??\c:\ffxxlrx.exec:\ffxxlrx.exe106⤵PID:4864
-
\??\c:\bhtnnn.exec:\bhtnnn.exe107⤵PID:2352
-
\??\c:\nhnnhh.exec:\nhnnhh.exe108⤵PID:4672
-
\??\c:\ppjjd.exec:\ppjjd.exe109⤵PID:1972
-
\??\c:\vjjdd.exec:\vjjdd.exe110⤵PID:4376
-
\??\c:\lfffllr.exec:\lfffllr.exe111⤵PID:4952
-
\??\c:\xlxfflr.exec:\xlxfflr.exe112⤵PID:2380
-
\??\c:\3hnthh.exec:\3hnthh.exe113⤵PID:1164
-
\??\c:\tbnnnn.exec:\tbnnnn.exe114⤵PID:4796
-
\??\c:\jjddj.exec:\jjddj.exe115⤵PID:3288
-
\??\c:\lxlrlxx.exec:\lxlrlxx.exe116⤵PID:468
-
\??\c:\xlffxff.exec:\xlffxff.exe117⤵PID:2844
-
\??\c:\ntnnbh.exec:\ntnnbh.exe118⤵PID:2476
-
\??\c:\3tbbhn.exec:\3tbbhn.exe119⤵PID:4004
-
\??\c:\jvppv.exec:\jvppv.exe120⤵PID:1280
-
\??\c:\ddjdd.exec:\ddjdd.exe121⤵PID:3368
-
\??\c:\lxflrxf.exec:\lxflrxf.exe122⤵PID:1824
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-