Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 19:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7becbe337c816356dff0054739def600_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
7becbe337c816356dff0054739def600_NeikiAnalytics.exe
-
Size
179KB
-
MD5
7becbe337c816356dff0054739def600
-
SHA1
689107fa7f553698fb053099d9f6a021b71476f2
-
SHA256
93754a01d17d765e88671d1cc895c2143c1734c405adb63968f7b872825a9110
-
SHA512
878bb076e0bcb84cd2f4b82005d0ee79e88eb42e72d3349dcfb68fd1968faaf9666d64a7f1d90124bf991ba2743e309a3523c8519dd4c51298efc741b23b0d71
-
SSDEEP
3072:AhOmTsF93UYfwC6GIoutQ6M/Fpi8rY9AABa1YRMxgRP5ZXux+:Acm4FmowdHoSCddWhR/Z+Y
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4660-1-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/868-31-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2204-33-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/4720-38-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2324-43-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2180-49-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2272-22-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2636-13-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/812-59-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/3120-66-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/4608-73-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/3948-86-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/4248-85-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/1976-92-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/4868-99-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/4900-110-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/1596-112-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/5052-117-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2380-128-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2348-143-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/4980-148-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2228-155-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/732-161-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/4892-167-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/3500-183-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/3540-186-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/4092-191-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/5080-194-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/4672-202-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2600-209-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/4400-212-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2760-218-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/1384-224-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2212-233-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/3456-241-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2604-248-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/1612-258-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/4932-270-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/1160-286-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/4584-306-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2060-317-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/60-325-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2888-344-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/3992-360-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/1068-364-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/4832-383-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/3344-388-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2832-407-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2168-414-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2808-437-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/3232-484-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2960-503-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2960-507-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/4524-521-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/456-595-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/380-639-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/1556-641-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/4544-679-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/1808-861-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/1612-866-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/680-888-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/3984-1065-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/1160-1141-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/4892-1189-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1712 fxrlxlf.exe 2636 nhhhbn.exe 2272 vjpjd.exe 2204 vppjv.exe 868 rfffrxf.exe 4720 xxrfrlx.exe 2324 bnnbnt.exe 2180 vppdv.exe 812 jjjdv.exe 3120 htbtbb.exe 4608 pjjvd.exe 860 xrxxfxl.exe 4248 nntntt.exe 3948 jvdvp.exe 1976 jddvp.exe 4868 llffxll.exe 4900 1tthbt.exe 1596 dvppj.exe 5052 5dvpj.exe 2380 xxrlxxf.exe 3840 nhhhbb.exe 2932 nbnbtt.exe 2348 fxxxfxf.exe 4980 tthbbb.exe 2228 btttbh.exe 732 vpvvv.exe 4892 bntnbb.exe 4968 7pvjd.exe 1968 xllxlfx.exe 3500 hhhbnb.exe 3540 vjdjj.exe 4092 xlxrffl.exe 5080 3fflffl.exe 4672 nhbtnn.exe 4504 ntbhtt.exe 2600 pvjdp.exe 4532 1rxlfxr.exe 2760 btbtnh.exe 1384 nhtnbb.exe 3116 5pvdp.exe 3588 xlrrlll.exe 2212 xlllflf.exe 4088 bbthbb.exe 3456 bntnhh.exe 1048 djjjd.exe 2264 1vvpp.exe 2604 7xxrffx.exe 760 nhhtnn.exe 1612 nbbtnh.exe 684 ddddp.exe 4056 9pvpj.exe 4932 xlllfll.exe 4628 httnnn.exe 436 nnhbbb.exe 4844 3jvpd.exe 3528 rrxlllr.exe 1536 llllffl.exe 1160 7ntnhb.exe 4868 3tttnn.exe 3936 pjppv.exe 1800 9dvpj.exe 3932 3ffffff.exe 1436 lxxrlff.exe 4584 tnntnn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4660 wrote to memory of 1712 4660 7becbe337c816356dff0054739def600_NeikiAnalytics.exe 82 PID 4660 wrote to memory of 1712 4660 7becbe337c816356dff0054739def600_NeikiAnalytics.exe 82 PID 4660 wrote to memory of 1712 4660 7becbe337c816356dff0054739def600_NeikiAnalytics.exe 82 PID 1712 wrote to memory of 2636 1712 fxrlxlf.exe 83 PID 1712 wrote to memory of 2636 1712 fxrlxlf.exe 83 PID 1712 wrote to memory of 2636 1712 fxrlxlf.exe 83 PID 2636 wrote to memory of 2272 2636 nhhhbn.exe 84 PID 2636 wrote to memory of 2272 2636 nhhhbn.exe 84 PID 2636 wrote to memory of 2272 2636 nhhhbn.exe 84 PID 2272 wrote to memory of 2204 2272 vjpjd.exe 85 PID 2272 wrote to memory of 2204 2272 vjpjd.exe 85 PID 2272 wrote to memory of 2204 2272 vjpjd.exe 85 PID 2204 wrote to memory of 868 2204 vppjv.exe 86 PID 2204 wrote to memory of 868 2204 vppjv.exe 86 PID 2204 wrote to memory of 868 2204 vppjv.exe 86 PID 868 wrote to memory of 4720 868 rfffrxf.exe 87 PID 868 wrote to memory of 4720 868 rfffrxf.exe 87 PID 868 wrote to memory of 4720 868 rfffrxf.exe 87 PID 4720 wrote to memory of 2324 4720 xxrfrlx.exe 88 PID 4720 wrote to memory of 2324 4720 xxrfrlx.exe 88 PID 4720 wrote to memory of 2324 4720 xxrfrlx.exe 88 PID 2324 wrote to memory of 2180 2324 bnnbnt.exe 89 PID 2324 wrote to memory of 2180 2324 bnnbnt.exe 89 PID 2324 wrote to memory of 2180 2324 bnnbnt.exe 89 PID 2180 wrote to memory of 812 2180 vppdv.exe 90 PID 2180 wrote to memory of 812 2180 vppdv.exe 90 PID 2180 wrote to memory of 812 2180 vppdv.exe 90 PID 812 wrote to memory of 3120 812 jjjdv.exe 91 PID 812 wrote to memory of 3120 812 jjjdv.exe 91 PID 812 wrote to memory of 3120 812 jjjdv.exe 91 PID 3120 wrote to memory of 4608 3120 htbtbb.exe 92 PID 3120 wrote to memory of 4608 3120 htbtbb.exe 92 PID 3120 wrote to memory of 4608 3120 htbtbb.exe 92 PID 4608 wrote to memory of 860 4608 pjjvd.exe 93 PID 4608 wrote to memory of 860 4608 pjjvd.exe 93 PID 4608 wrote to memory of 860 4608 pjjvd.exe 93 PID 860 wrote to memory of 4248 860 xrxxfxl.exe 94 PID 860 wrote to memory of 4248 860 xrxxfxl.exe 94 PID 860 wrote to memory of 4248 860 xrxxfxl.exe 94 PID 4248 wrote to memory of 3948 4248 nntntt.exe 95 PID 4248 wrote to memory of 3948 4248 nntntt.exe 95 PID 4248 wrote to memory of 3948 4248 nntntt.exe 95 PID 3948 wrote to memory of 1976 3948 jvdvp.exe 96 PID 3948 wrote to memory of 1976 3948 jvdvp.exe 96 PID 3948 wrote to memory of 1976 3948 jvdvp.exe 96 PID 1976 wrote to memory of 4868 1976 jddvp.exe 97 PID 1976 wrote to memory of 4868 1976 jddvp.exe 97 PID 1976 wrote to memory of 4868 1976 jddvp.exe 97 PID 4868 wrote to memory of 4900 4868 llffxll.exe 98 PID 4868 wrote to memory of 4900 4868 llffxll.exe 98 PID 4868 wrote to memory of 4900 4868 llffxll.exe 98 PID 4900 wrote to memory of 1596 4900 1tthbt.exe 99 PID 4900 wrote to memory of 1596 4900 1tthbt.exe 99 PID 4900 wrote to memory of 1596 4900 1tthbt.exe 99 PID 1596 wrote to memory of 5052 1596 dvppj.exe 100 PID 1596 wrote to memory of 5052 1596 dvppj.exe 100 PID 1596 wrote to memory of 5052 1596 dvppj.exe 100 PID 5052 wrote to memory of 2380 5052 5dvpj.exe 101 PID 5052 wrote to memory of 2380 5052 5dvpj.exe 101 PID 5052 wrote to memory of 2380 5052 5dvpj.exe 101 PID 2380 wrote to memory of 3840 2380 xxrlxxf.exe 102 PID 2380 wrote to memory of 3840 2380 xxrlxxf.exe 102 PID 2380 wrote to memory of 3840 2380 xxrlxxf.exe 102 PID 3840 wrote to memory of 2932 3840 nhhhbb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\7becbe337c816356dff0054739def600_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7becbe337c816356dff0054739def600_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\fxrlxlf.exec:\fxrlxlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\nhhhbn.exec:\nhhhbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\vjpjd.exec:\vjpjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\vppjv.exec:\vppjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\rfffrxf.exec:\rfffrxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\xxrfrlx.exec:\xxrfrlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\bnnbnt.exec:\bnnbnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\vppdv.exec:\vppdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\jjjdv.exec:\jjjdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\htbtbb.exec:\htbtbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\pjjvd.exec:\pjjvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\xrxxfxl.exec:\xrxxfxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\nntntt.exec:\nntntt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\jvdvp.exec:\jvdvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\jddvp.exec:\jddvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\llffxll.exec:\llffxll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\1tthbt.exec:\1tthbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\dvppj.exec:\dvppj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\5dvpj.exec:\5dvpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\xxrlxxf.exec:\xxrlxxf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\nhhhbb.exec:\nhhhbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\nbnbtt.exec:\nbnbtt.exe23⤵
- Executes dropped EXE
PID:2932 -
\??\c:\fxxxfxf.exec:\fxxxfxf.exe24⤵
- Executes dropped EXE
PID:2348 -
\??\c:\tthbbb.exec:\tthbbb.exe25⤵
- Executes dropped EXE
PID:4980 -
\??\c:\btttbh.exec:\btttbh.exe26⤵
- Executes dropped EXE
PID:2228 -
\??\c:\vpvvv.exec:\vpvvv.exe27⤵
- Executes dropped EXE
PID:732 -
\??\c:\bntnbb.exec:\bntnbb.exe28⤵
- Executes dropped EXE
PID:4892 -
\??\c:\7pvjd.exec:\7pvjd.exe29⤵
- Executes dropped EXE
PID:4968 -
\??\c:\xllxlfx.exec:\xllxlfx.exe30⤵
- Executes dropped EXE
PID:1968 -
\??\c:\hhhbnb.exec:\hhhbnb.exe31⤵
- Executes dropped EXE
PID:3500 -
\??\c:\vjdjj.exec:\vjdjj.exe32⤵
- Executes dropped EXE
PID:3540 -
\??\c:\xlxrffl.exec:\xlxrffl.exe33⤵
- Executes dropped EXE
PID:4092 -
\??\c:\3fflffl.exec:\3fflffl.exe34⤵
- Executes dropped EXE
PID:5080 -
\??\c:\nhbtnn.exec:\nhbtnn.exe35⤵
- Executes dropped EXE
PID:4672 -
\??\c:\ntbhtt.exec:\ntbhtt.exe36⤵
- Executes dropped EXE
PID:4504 -
\??\c:\pvjdp.exec:\pvjdp.exe37⤵
- Executes dropped EXE
PID:2600 -
\??\c:\1rxlfxr.exec:\1rxlfxr.exe38⤵
- Executes dropped EXE
PID:4532 -
\??\c:\9fllfff.exec:\9fllfff.exe39⤵PID:4400
-
\??\c:\btbtnh.exec:\btbtnh.exe40⤵
- Executes dropped EXE
PID:2760 -
\??\c:\nhtnbb.exec:\nhtnbb.exe41⤵
- Executes dropped EXE
PID:1384 -
\??\c:\5pvdp.exec:\5pvdp.exe42⤵
- Executes dropped EXE
PID:3116 -
\??\c:\xlrrlll.exec:\xlrrlll.exe43⤵
- Executes dropped EXE
PID:3588 -
\??\c:\xlllflf.exec:\xlllflf.exe44⤵
- Executes dropped EXE
PID:2212 -
\??\c:\bbthbb.exec:\bbthbb.exe45⤵
- Executes dropped EXE
PID:4088 -
\??\c:\bntnhh.exec:\bntnhh.exe46⤵
- Executes dropped EXE
PID:3456 -
\??\c:\djjjd.exec:\djjjd.exe47⤵
- Executes dropped EXE
PID:1048 -
\??\c:\1vvpp.exec:\1vvpp.exe48⤵
- Executes dropped EXE
PID:2264 -
\??\c:\7xxrffx.exec:\7xxrffx.exe49⤵
- Executes dropped EXE
PID:2604 -
\??\c:\nhhtnn.exec:\nhhtnn.exe50⤵
- Executes dropped EXE
PID:760 -
\??\c:\nbbtnh.exec:\nbbtnh.exe51⤵
- Executes dropped EXE
PID:1612 -
\??\c:\ddddp.exec:\ddddp.exe52⤵
- Executes dropped EXE
PID:684 -
\??\c:\9pvpj.exec:\9pvpj.exe53⤵
- Executes dropped EXE
PID:4056 -
\??\c:\xlllfll.exec:\xlllfll.exe54⤵
- Executes dropped EXE
PID:4932 -
\??\c:\httnnn.exec:\httnnn.exe55⤵
- Executes dropped EXE
PID:4628 -
\??\c:\nnhbbb.exec:\nnhbbb.exe56⤵
- Executes dropped EXE
PID:436 -
\??\c:\3jvpd.exec:\3jvpd.exe57⤵
- Executes dropped EXE
PID:4844 -
\??\c:\rrxlllr.exec:\rrxlllr.exe58⤵
- Executes dropped EXE
PID:3528 -
\??\c:\llllffl.exec:\llllffl.exe59⤵
- Executes dropped EXE
PID:1536 -
\??\c:\7ntnhb.exec:\7ntnhb.exe60⤵
- Executes dropped EXE
PID:1160 -
\??\c:\3tttnn.exec:\3tttnn.exe61⤵
- Executes dropped EXE
PID:4868 -
\??\c:\pjppv.exec:\pjppv.exe62⤵
- Executes dropped EXE
PID:3936 -
\??\c:\9dvpj.exec:\9dvpj.exe63⤵
- Executes dropped EXE
PID:1800 -
\??\c:\3ffffff.exec:\3ffffff.exe64⤵
- Executes dropped EXE
PID:3932 -
\??\c:\lxxrlff.exec:\lxxrlff.exe65⤵
- Executes dropped EXE
PID:1436 -
\??\c:\tnntnn.exec:\tnntnn.exe66⤵
- Executes dropped EXE
PID:4584 -
\??\c:\1hbnbh.exec:\1hbnbh.exe67⤵PID:4028
-
\??\c:\jpjdd.exec:\jpjdd.exe68⤵PID:4856
-
\??\c:\rllrlrr.exec:\rllrlrr.exe69⤵PID:2060
-
\??\c:\rrxlfrr.exec:\rrxlfrr.exe70⤵PID:3448
-
\??\c:\1nntnh.exec:\1nntnh.exe71⤵PID:60
-
\??\c:\bnhhtt.exec:\bnhhtt.exe72⤵PID:432
-
\??\c:\3vddp.exec:\3vddp.exe73⤵PID:3180
-
\??\c:\ppppj.exec:\ppppj.exe74⤵PID:3524
-
\??\c:\fxxrfff.exec:\fxxrfff.exe75⤵PID:4808
-
\??\c:\bttttn.exec:\bttttn.exe76⤵PID:1304
-
\??\c:\jddpj.exec:\jddpj.exe77⤵PID:4736
-
\??\c:\pppjv.exec:\pppjv.exe78⤵PID:2888
-
\??\c:\xlfxrxr.exec:\xlfxrxr.exe79⤵PID:1348
-
\??\c:\hbbtnn.exec:\hbbtnn.exe80⤵PID:4072
-
\??\c:\tnhbtt.exec:\tnhbtt.exe81⤵PID:3132
-
\??\c:\pjpvv.exec:\pjpvv.exe82⤵PID:1404
-
\??\c:\hhbttn.exec:\hhbttn.exe83⤵PID:3992
-
\??\c:\bntnhh.exec:\bntnhh.exe84⤵PID:1068
-
\??\c:\pvjjd.exec:\pvjjd.exe85⤵PID:4752
-
\??\c:\5rxrrrx.exec:\5rxrrrx.exe86⤵PID:3256
-
\??\c:\htbbtt.exec:\htbbtt.exe87⤵PID:4504
-
\??\c:\ppddv.exec:\ppddv.exe88⤵PID:5104
-
\??\c:\vppjj.exec:\vppjj.exe89⤵PID:4532
-
\??\c:\9xrrllf.exec:\9xrrllf.exe90⤵PID:4832
-
\??\c:\bhtnhh.exec:\bhtnhh.exe91⤵PID:3344
-
\??\c:\hnbbtt.exec:\hnbbtt.exe92⤵PID:2916
-
\??\c:\pvvpj.exec:\pvvpj.exe93⤵PID:4852
-
\??\c:\jvddp.exec:\jvddp.exe94⤵PID:1460
-
\??\c:\xlrrlff.exec:\xlrrlff.exe95⤵PID:3828
-
\??\c:\fxllffx.exec:\fxllffx.exe96⤵PID:3144
-
\??\c:\hhttnn.exec:\hhttnn.exe97⤵PID:2832
-
\??\c:\nhnhbb.exec:\nhnhbb.exe98⤵PID:1680
-
\??\c:\jvppj.exec:\jvppj.exe99⤵PID:2168
-
\??\c:\vjjdp.exec:\vjjdp.exe100⤵PID:1444
-
\??\c:\xrllrrr.exec:\xrllrrr.exe101⤵PID:3644
-
\??\c:\xxlflfl.exec:\xxlflfl.exe102⤵PID:1612
-
\??\c:\nhhhhh.exec:\nhhhhh.exe103⤵PID:3424
-
\??\c:\bbbtnn.exec:\bbbtnn.exe104⤵PID:4256
-
\??\c:\jppjd.exec:\jppjd.exe105⤵PID:3124
-
\??\c:\rllfffx.exec:\rllfffx.exe106⤵PID:2808
-
\??\c:\rrfffxx.exec:\rrfffxx.exe107⤵PID:3240
-
\??\c:\5nhbtt.exec:\5nhbtt.exe108⤵PID:3236
-
\??\c:\1jvpd.exec:\1jvpd.exe109⤵PID:396
-
\??\c:\dvdvv.exec:\dvdvv.exe110⤵PID:4420
-
\??\c:\9fxxrxx.exec:\9fxxrxx.exe111⤵PID:5012
-
\??\c:\ffxxrrl.exec:\ffxxrrl.exe112⤵PID:4900
-
\??\c:\hbttnb.exec:\hbttnb.exe113⤵PID:3204
-
\??\c:\bhnnhh.exec:\bhnnhh.exe114⤵PID:4380
-
\??\c:\jdpjp.exec:\jdpjp.exe115⤵PID:1236
-
\??\c:\3djpd.exec:\3djpd.exe116⤵PID:5052
-
\??\c:\lflxffx.exec:\lflxffx.exe117⤵PID:4992
-
\??\c:\bnnhbb.exec:\bnnhbb.exe118⤵PID:1244
-
\??\c:\bbtnnh.exec:\bbtnnh.exe119⤵PID:4444
-
\??\c:\jdppd.exec:\jdppd.exe120⤵PID:1272
-
\??\c:\ddddv.exec:\ddddv.exe121⤵PID:4568
-
\??\c:\rlffflr.exec:\rlffflr.exe122⤵PID:3232
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-