Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2024, 22:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
579f6614da2fb36b029036c4d6bbeb80_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
579f6614da2fb36b029036c4d6bbeb80_NeikiAnalytics.exe
-
Size
60KB
-
MD5
579f6614da2fb36b029036c4d6bbeb80
-
SHA1
c53b158f50c9dae512034cfc3af3b35c1bbfe1b9
-
SHA256
a312e5ed2aa6186d129f6c2e09b4dea5981483aa0ab9349bc3f092912162f69f
-
SHA512
77157094b6ed8770b2eff8d0d5e44399754348e555ec2a0a07f556db43a697b1b466b36fda50362ab35dac53f9b5600a33f7db93992f28e954201840fe33314c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+p:ymb3NkkiQ3mdBjF0y7p
Malware Config
Signatures
-
Detect Blackmoon payload 30 IoCs
resource yara_rule behavioral2/memory/2108-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4760-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3492-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2324-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4080-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2220-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4296-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1164-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1536-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2548-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4380-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3136-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3056-81-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3056-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2348-75-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2348-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-67-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4688-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1244-60-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1244-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4788-47-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4788-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3340-40-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3340-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3552-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4220-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4220 jpjjp.exe 4760 rlxxrxx.exe 3552 hbhbbh.exe 3340 hbhhhn.exe 4788 vvpvj.exe 3824 vdjdd.exe 1244 lfrllrx.exe 4688 lfrrrrx.exe 2348 htnhhh.exe 3056 vvddd.exe 3136 pjppp.exe 4380 lrfllll.exe 2548 3rlrrlr.exe 1536 9nnnnt.exe 4796 bbtthn.exe 4100 pdppj.exe 4704 vvdjj.exe 4936 fxllrrr.exe 4024 frxxrrr.exe 1164 rflrrxr.exe 4608 bbnttb.exe 4296 5nhtnb.exe 3036 ddvdj.exe 408 5dpvp.exe 2220 ffflfrf.exe 4080 lrlxlfx.exe 3708 bbtbbh.exe 2324 bthnnb.exe 4768 vvvdp.exe 3492 pdjvv.exe 3576 lflrlrf.exe 1836 5fxflxx.exe 2856 rfrxxlr.exe 532 btbbbb.exe 2244 nhtbtb.exe 2876 3vppj.exe 2288 ddddp.exe 4944 fxlffll.exe 2392 xxfrrrx.exe 1380 hhhnbh.exe 2700 htbbbb.exe 2264 ddddd.exe 1628 3jjdv.exe 4652 vjpvv.exe 2084 lxxrffl.exe 2096 hhhhtn.exe 4748 dppvv.exe 224 fffrlll.exe 3196 rlxxrxf.exe 4788 nnthht.exe 3824 djjjj.exe 3604 jpvvj.exe 3156 rfxxxff.exe 4184 1rxxxrr.exe 5116 hthhnn.exe 4036 thnnnt.exe 4612 jvjvj.exe 2192 lxfrlrr.exe 2544 1frrllx.exe 4472 tnntnt.exe 1228 pjpjj.exe 5108 pdjpd.exe 1056 lrrlrfx.exe 3224 tnbntn.exe -
resource yara_rule behavioral2/memory/2108-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4760-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3492-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4768-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2324-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4080-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2220-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4296-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1164-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1536-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2548-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4380-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3136-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3056-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2348-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1244-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3340-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3552-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3552-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4220-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4220-10-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2108 wrote to memory of 4220 2108 579f6614da2fb36b029036c4d6bbeb80_NeikiAnalytics.exe 83 PID 2108 wrote to memory of 4220 2108 579f6614da2fb36b029036c4d6bbeb80_NeikiAnalytics.exe 83 PID 2108 wrote to memory of 4220 2108 579f6614da2fb36b029036c4d6bbeb80_NeikiAnalytics.exe 83 PID 4220 wrote to memory of 4760 4220 jpjjp.exe 84 PID 4220 wrote to memory of 4760 4220 jpjjp.exe 84 PID 4220 wrote to memory of 4760 4220 jpjjp.exe 84 PID 4760 wrote to memory of 3552 4760 rlxxrxx.exe 85 PID 4760 wrote to memory of 3552 4760 rlxxrxx.exe 85 PID 4760 wrote to memory of 3552 4760 rlxxrxx.exe 85 PID 3552 wrote to memory of 3340 3552 hbhbbh.exe 86 PID 3552 wrote to memory of 3340 3552 hbhbbh.exe 86 PID 3552 wrote to memory of 3340 3552 hbhbbh.exe 86 PID 3340 wrote to memory of 4788 3340 hbhhhn.exe 87 PID 3340 wrote to memory of 4788 3340 hbhhhn.exe 87 PID 3340 wrote to memory of 4788 3340 hbhhhn.exe 87 PID 4788 wrote to memory of 3824 4788 vvpvj.exe 88 PID 4788 wrote to memory of 3824 4788 vvpvj.exe 88 PID 4788 wrote to memory of 3824 4788 vvpvj.exe 88 PID 3824 wrote to memory of 1244 3824 vdjdd.exe 89 PID 3824 wrote to memory of 1244 3824 vdjdd.exe 89 PID 3824 wrote to memory of 1244 3824 vdjdd.exe 89 PID 1244 wrote to memory of 4688 1244 lfrllrx.exe 90 PID 1244 wrote to memory of 4688 1244 lfrllrx.exe 90 PID 1244 wrote to memory of 4688 1244 lfrllrx.exe 90 PID 4688 wrote to memory of 2348 4688 lfrrrrx.exe 91 PID 4688 wrote to memory of 2348 4688 lfrrrrx.exe 91 PID 4688 wrote to memory of 2348 4688 lfrrrrx.exe 91 PID 2348 wrote to memory of 3056 2348 htnhhh.exe 92 PID 2348 wrote to memory of 3056 2348 htnhhh.exe 92 PID 2348 wrote to memory of 3056 2348 htnhhh.exe 92 PID 3056 wrote to memory of 3136 3056 vvddd.exe 93 PID 3056 wrote to memory of 3136 3056 vvddd.exe 93 PID 3056 wrote to memory of 3136 3056 vvddd.exe 93 PID 3136 wrote to memory of 4380 3136 pjppp.exe 94 PID 3136 wrote to memory of 4380 3136 pjppp.exe 94 PID 3136 wrote to memory of 4380 3136 pjppp.exe 94 PID 4380 wrote to memory of 2548 4380 lrfllll.exe 95 PID 4380 wrote to memory of 2548 4380 lrfllll.exe 95 PID 4380 wrote to memory of 2548 4380 lrfllll.exe 95 PID 2548 wrote to memory of 1536 2548 3rlrrlr.exe 96 PID 2548 wrote to memory of 1536 2548 3rlrrlr.exe 96 PID 2548 wrote to memory of 1536 2548 3rlrrlr.exe 96 PID 1536 wrote to memory of 4796 1536 9nnnnt.exe 97 PID 1536 wrote to memory of 4796 1536 9nnnnt.exe 97 PID 1536 wrote to memory of 4796 1536 9nnnnt.exe 97 PID 4796 wrote to memory of 4100 4796 bbtthn.exe 98 PID 4796 wrote to memory of 4100 4796 bbtthn.exe 98 PID 4796 wrote to memory of 4100 4796 bbtthn.exe 98 PID 4100 wrote to memory of 4704 4100 pdppj.exe 99 PID 4100 wrote to memory of 4704 4100 pdppj.exe 99 PID 4100 wrote to memory of 4704 4100 pdppj.exe 99 PID 4704 wrote to memory of 4936 4704 vvdjj.exe 100 PID 4704 wrote to memory of 4936 4704 vvdjj.exe 100 PID 4704 wrote to memory of 4936 4704 vvdjj.exe 100 PID 4936 wrote to memory of 4024 4936 fxllrrr.exe 101 PID 4936 wrote to memory of 4024 4936 fxllrrr.exe 101 PID 4936 wrote to memory of 4024 4936 fxllrrr.exe 101 PID 4024 wrote to memory of 1164 4024 frxxrrr.exe 102 PID 4024 wrote to memory of 1164 4024 frxxrrr.exe 102 PID 4024 wrote to memory of 1164 4024 frxxrrr.exe 102 PID 1164 wrote to memory of 4608 1164 rflrrxr.exe 103 PID 1164 wrote to memory of 4608 1164 rflrrxr.exe 103 PID 1164 wrote to memory of 4608 1164 rflrrxr.exe 103 PID 4608 wrote to memory of 4296 4608 bbnttb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\579f6614da2fb36b029036c4d6bbeb80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\579f6614da2fb36b029036c4d6bbeb80_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\jpjjp.exec:\jpjjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\rlxxrxx.exec:\rlxxrxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\hbhbbh.exec:\hbhbbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\hbhhhn.exec:\hbhhhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
\??\c:\vvpvj.exec:\vvpvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\vdjdd.exec:\vdjdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
\??\c:\lfrllrx.exec:\lfrllrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\lfrrrrx.exec:\lfrrrrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\htnhhh.exec:\htnhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\vvddd.exec:\vvddd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\pjppp.exec:\pjppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\lrfllll.exec:\lrfllll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\3rlrrlr.exec:\3rlrrlr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\9nnnnt.exec:\9nnnnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\bbtthn.exec:\bbtthn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\pdppj.exec:\pdppj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\vvdjj.exec:\vvdjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
\??\c:\fxllrrr.exec:\fxllrrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\frxxrrr.exec:\frxxrrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\rflrrxr.exec:\rflrrxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\bbnttb.exec:\bbnttb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\5nhtnb.exec:\5nhtnb.exe23⤵
- Executes dropped EXE
PID:4296 -
\??\c:\ddvdj.exec:\ddvdj.exe24⤵
- Executes dropped EXE
PID:3036 -
\??\c:\5dpvp.exec:\5dpvp.exe25⤵
- Executes dropped EXE
PID:408 -
\??\c:\ffflfrf.exec:\ffflfrf.exe26⤵
- Executes dropped EXE
PID:2220 -
\??\c:\lrlxlfx.exec:\lrlxlfx.exe27⤵
- Executes dropped EXE
PID:4080 -
\??\c:\bbtbbh.exec:\bbtbbh.exe28⤵
- Executes dropped EXE
PID:3708 -
\??\c:\bthnnb.exec:\bthnnb.exe29⤵
- Executes dropped EXE
PID:2324 -
\??\c:\vvvdp.exec:\vvvdp.exe30⤵
- Executes dropped EXE
PID:4768 -
\??\c:\pdjvv.exec:\pdjvv.exe31⤵
- Executes dropped EXE
PID:3492 -
\??\c:\lflrlrf.exec:\lflrlrf.exe32⤵
- Executes dropped EXE
PID:3576 -
\??\c:\5fxflxx.exec:\5fxflxx.exe33⤵
- Executes dropped EXE
PID:1836 -
\??\c:\rfrxxlr.exec:\rfrxxlr.exe34⤵
- Executes dropped EXE
PID:2856 -
\??\c:\btbbbb.exec:\btbbbb.exe35⤵
- Executes dropped EXE
PID:532 -
\??\c:\nhtbtb.exec:\nhtbtb.exe36⤵
- Executes dropped EXE
PID:2244 -
\??\c:\3vppj.exec:\3vppj.exe37⤵
- Executes dropped EXE
PID:2876 -
\??\c:\ddddp.exec:\ddddp.exe38⤵
- Executes dropped EXE
PID:2288 -
\??\c:\fxlffll.exec:\fxlffll.exe39⤵
- Executes dropped EXE
PID:4944 -
\??\c:\xxfrrrx.exec:\xxfrrrx.exe40⤵
- Executes dropped EXE
PID:2392 -
\??\c:\hhhnbh.exec:\hhhnbh.exe41⤵
- Executes dropped EXE
PID:1380 -
\??\c:\htbbbb.exec:\htbbbb.exe42⤵
- Executes dropped EXE
PID:2700 -
\??\c:\ddddd.exec:\ddddd.exe43⤵
- Executes dropped EXE
PID:2264 -
\??\c:\3jjdv.exec:\3jjdv.exe44⤵
- Executes dropped EXE
PID:1628 -
\??\c:\vjpvv.exec:\vjpvv.exe45⤵
- Executes dropped EXE
PID:4652 -
\??\c:\lxxrffl.exec:\lxxrffl.exe46⤵
- Executes dropped EXE
PID:2084 -
\??\c:\hhhhtn.exec:\hhhhtn.exe47⤵
- Executes dropped EXE
PID:2096 -
\??\c:\dppvv.exec:\dppvv.exe48⤵
- Executes dropped EXE
PID:4748 -
\??\c:\fffrlll.exec:\fffrlll.exe49⤵
- Executes dropped EXE
PID:224 -
\??\c:\rlxxrxf.exec:\rlxxrxf.exe50⤵
- Executes dropped EXE
PID:3196 -
\??\c:\nnthht.exec:\nnthht.exe51⤵
- Executes dropped EXE
PID:4788 -
\??\c:\djjjj.exec:\djjjj.exe52⤵
- Executes dropped EXE
PID:3824 -
\??\c:\jpvvj.exec:\jpvvj.exe53⤵
- Executes dropped EXE
PID:3604 -
\??\c:\rfxxxff.exec:\rfxxxff.exe54⤵
- Executes dropped EXE
PID:3156 -
\??\c:\1rxxxrr.exec:\1rxxxrr.exe55⤵
- Executes dropped EXE
PID:4184 -
\??\c:\hthhnn.exec:\hthhnn.exe56⤵
- Executes dropped EXE
PID:5116 -
\??\c:\thnnnt.exec:\thnnnt.exe57⤵
- Executes dropped EXE
PID:4036 -
\??\c:\jvjvj.exec:\jvjvj.exe58⤵
- Executes dropped EXE
PID:4612 -
\??\c:\lxfrlrr.exec:\lxfrlrr.exe59⤵
- Executes dropped EXE
PID:2192 -
\??\c:\1frrllx.exec:\1frrllx.exe60⤵
- Executes dropped EXE
PID:2544 -
\??\c:\tnntnt.exec:\tnntnt.exe61⤵
- Executes dropped EXE
PID:4472 -
\??\c:\pjpjj.exec:\pjpjj.exe62⤵
- Executes dropped EXE
PID:1228 -
\??\c:\pdjpd.exec:\pdjpd.exe63⤵
- Executes dropped EXE
PID:5108 -
\??\c:\lrrlrfx.exec:\lrrlrfx.exe64⤵
- Executes dropped EXE
PID:1056 -
\??\c:\tnbntn.exec:\tnbntn.exe65⤵
- Executes dropped EXE
PID:3224 -
\??\c:\vpvjp.exec:\vpvjp.exe66⤵PID:2220
-
\??\c:\fllfxxl.exec:\fllfxxl.exe67⤵PID:1560
-
\??\c:\bbhbbh.exec:\bbhbbh.exe68⤵PID:2984
-
\??\c:\hnhbbb.exec:\hnhbbb.exe69⤵PID:772
-
\??\c:\vjdvd.exec:\vjdvd.exe70⤵PID:1704
-
\??\c:\9rrllrl.exec:\9rrllrl.exe71⤵PID:3368
-
\??\c:\ttnnnn.exec:\ttnnnn.exe72⤵PID:3484
-
\??\c:\7tnhbb.exec:\7tnhbb.exe73⤵PID:60
-
\??\c:\djpvp.exec:\djpvp.exe74⤵PID:4084
-
\??\c:\lxfffll.exec:\lxfffll.exe75⤵PID:2172
-
\??\c:\llrrlrx.exec:\llrrlrx.exe76⤵PID:916
-
\??\c:\ttbttb.exec:\ttbttb.exe77⤵PID:1380
-
\??\c:\ntnnbb.exec:\ntnnbb.exe78⤵PID:1588
-
\??\c:\vpdvv.exec:\vpdvv.exe79⤵PID:4864
-
\??\c:\pjvjv.exec:\pjvjv.exe80⤵PID:2344
-
\??\c:\7rfrxfx.exec:\7rfrxfx.exe81⤵PID:2040
-
\??\c:\hthhhh.exec:\hthhhh.exe82⤵PID:4992
-
\??\c:\jdpjj.exec:\jdpjj.exe83⤵PID:4052
-
\??\c:\lxxxxxf.exec:\lxxxxxf.exe84⤵PID:2820
-
\??\c:\5fllrxx.exec:\5fllrxx.exe85⤵PID:1284
-
\??\c:\tbnbbn.exec:\tbnbbn.exe86⤵PID:3408
-
\??\c:\jvjjd.exec:\jvjjd.exe87⤵PID:1888
-
\??\c:\3jppj.exec:\3jppj.exe88⤵PID:3760
-
\??\c:\7rlfxxf.exec:\7rlfxxf.exe89⤵PID:512
-
\??\c:\xrflflr.exec:\xrflflr.exe90⤵PID:4072
-
\??\c:\nntnnh.exec:\nntnnh.exe91⤵PID:2708
-
\??\c:\tnbhhh.exec:\tnbhhh.exe92⤵PID:5076
-
\??\c:\bnhbnt.exec:\bnhbnt.exe93⤵PID:4656
-
\??\c:\vjvvp.exec:\vjvvp.exe94⤵PID:1376
-
\??\c:\rrxrrfr.exec:\rrxrrfr.exe95⤵PID:2992
-
\??\c:\ttbbht.exec:\ttbbht.exe96⤵PID:3592
-
\??\c:\vpddj.exec:\vpddj.exe97⤵PID:3604
-
\??\c:\fffllxx.exec:\fffllxx.exe98⤵PID:2104
-
\??\c:\hhnttn.exec:\hhnttn.exe99⤵PID:1944
-
\??\c:\tbhbbt.exec:\tbhbbt.exe100⤵PID:2772
-
\??\c:\dpvvp.exec:\dpvvp.exe101⤵PID:4924
-
\??\c:\fllxffl.exec:\fllxffl.exe102⤵PID:2348
-
\??\c:\rlflxxl.exec:\rlflxxl.exe103⤵PID:3700
-
\??\c:\3btbnt.exec:\3btbnt.exe104⤵PID:4492
-
\??\c:\dpdvd.exec:\dpdvd.exe105⤵PID:1916
-
\??\c:\1xllfrl.exec:\1xllfrl.exe106⤵PID:4704
-
\??\c:\bhnthh.exec:\bhnthh.exe107⤵PID:4820
-
\??\c:\hbhnnh.exec:\hbhnnh.exe108⤵PID:64
-
\??\c:\pdjpj.exec:\pdjpj.exe109⤵PID:3036
-
\??\c:\5rlfxxr.exec:\5rlfxxr.exe110⤵PID:2376
-
\??\c:\fxfxfxl.exec:\fxfxfxl.exe111⤵PID:4792
-
\??\c:\tthbhh.exec:\tthbhh.exe112⤵PID:3300
-
\??\c:\hnnnhh.exec:\hnnnhh.exe113⤵PID:3456
-
\??\c:\jjjdv.exec:\jjjdv.exe114⤵PID:3372
-
\??\c:\dpdjd.exec:\dpdjd.exe115⤵PID:2180
-
\??\c:\xrlxrrf.exec:\xrlxrrf.exe116⤵PID:1836
-
\??\c:\hbttbt.exec:\hbttbt.exe117⤵PID:2244
-
\??\c:\hhnnbh.exec:\hhnnbh.exe118⤵PID:4620
-
\??\c:\pdjdv.exec:\pdjdv.exe119⤵PID:3788
-
\??\c:\jpvpd.exec:\jpvpd.exe120⤵PID:4084
-
\??\c:\xrxflrr.exec:\xrxflrr.exe121⤵PID:908
-
\??\c:\5hnntb.exec:\5hnntb.exe122⤵PID:3112
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-