Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
03-06-2024 15:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
43e4b1e7f3c60a1d63ad81c65210cfd0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
43e4b1e7f3c60a1d63ad81c65210cfd0_NeikiAnalytics.exe
-
Size
64KB
-
MD5
43e4b1e7f3c60a1d63ad81c65210cfd0
-
SHA1
9df315a64de32e61e5c2efb9f9068840d075b4c6
-
SHA256
d5f2bd91ab8e41fee17f3bc66849168b684607b3875be32da111cbd97e1a9157
-
SHA512
19cdf939cd69bad90d736be913243e75114bbf8dbdabadc8dbe1a017f0c469cb6a5459987d0cb76a5b6045804df66f8627e3a3623f6b24a10781b967b7dc614b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIhJm/wL:ymb3NkkiQ3mdBjFILmu
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/3136-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4664-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2200-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2328-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4436-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5104-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2492-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3920-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5096-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2516-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4116-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4256-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3196-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4328-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4112-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2848-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2824-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1948-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/60-78-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/60-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4436-65-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2328-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2116-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4784 jjjjj.exe 4664 llxrxxl.exe 2116 5xxxxll.exe 2200 nbbbbb.exe 2328 nbtbbh.exe 976 dvddd.exe 4436 jjdpp.exe 3316 lllfxxx.exe 60 xxrxrxf.exe 5104 hhhhhh.exe 1948 7nttnt.exe 2824 3vvpj.exe 4692 vvdvp.exe 2848 xxrrrlr.exe 4112 nnnnhh.exe 4808 1bnhbb.exe 3504 jdppp.exe 4328 7vddj.exe 3196 9fxfxlr.exe 4256 3lfxxfl.exe 4116 tttttt.exe 2516 nhhnhh.exe 2492 vjjjd.exe 3920 dppjd.exe 4996 3lxxxxf.exe 4908 1hhttt.exe 1716 bthhhn.exe 5096 pjjdd.exe 2228 dvddv.exe 4568 llffffl.exe 4892 xflfffx.exe 4564 xrrllrl.exe 3300 tthnnh.exe 1760 ttbtbb.exe 1104 jdvvj.exe 2668 djddp.exe 2188 dvvvp.exe 1644 lxxxrrl.exe 2700 1rrrffx.exe 3176 thhhhh.exe 3532 btbbbh.exe 2156 hbtbtt.exe 5052 vvddd.exe 4624 jvpjv.exe 3452 3xxrfff.exe 3292 fflfflx.exe 1696 rxffffx.exe 5108 bhhhhn.exe 1420 5bbnht.exe 2064 5jpvp.exe 3672 vjjdd.exe 4372 vpjdd.exe 5104 xrrrxxr.exe 3880 xxxxxxx.exe 3956 rrlllll.exe 468 hhbhhh.exe 2076 3tbtnn.exe 3716 7vjdv.exe 1272 jvvvv.exe 208 fflfxff.exe 1456 xfflrxx.exe 4680 xflfxxr.exe 2544 hhhnhh.exe 4420 nhhhbb.exe -
resource yara_rule behavioral2/memory/3136-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4664-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2200-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4436-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5104-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2492-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5096-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4116-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4256-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3196-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4328-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4112-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2848-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1948-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5104-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5104-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5104-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/60-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2200-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2200-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2200-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-13-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3136 wrote to memory of 4784 3136 43e4b1e7f3c60a1d63ad81c65210cfd0_NeikiAnalytics.exe 82 PID 3136 wrote to memory of 4784 3136 43e4b1e7f3c60a1d63ad81c65210cfd0_NeikiAnalytics.exe 82 PID 3136 wrote to memory of 4784 3136 43e4b1e7f3c60a1d63ad81c65210cfd0_NeikiAnalytics.exe 82 PID 4784 wrote to memory of 4664 4784 jjjjj.exe 83 PID 4784 wrote to memory of 4664 4784 jjjjj.exe 83 PID 4784 wrote to memory of 4664 4784 jjjjj.exe 83 PID 4664 wrote to memory of 2116 4664 llxrxxl.exe 84 PID 4664 wrote to memory of 2116 4664 llxrxxl.exe 84 PID 4664 wrote to memory of 2116 4664 llxrxxl.exe 84 PID 2116 wrote to memory of 2200 2116 5xxxxll.exe 85 PID 2116 wrote to memory of 2200 2116 5xxxxll.exe 85 PID 2116 wrote to memory of 2200 2116 5xxxxll.exe 85 PID 2200 wrote to memory of 2328 2200 nbbbbb.exe 86 PID 2200 wrote to memory of 2328 2200 nbbbbb.exe 86 PID 2200 wrote to memory of 2328 2200 nbbbbb.exe 86 PID 2328 wrote to memory of 976 2328 nbtbbh.exe 87 PID 2328 wrote to memory of 976 2328 nbtbbh.exe 87 PID 2328 wrote to memory of 976 2328 nbtbbh.exe 87 PID 976 wrote to memory of 4436 976 dvddd.exe 88 PID 976 wrote to memory of 4436 976 dvddd.exe 88 PID 976 wrote to memory of 4436 976 dvddd.exe 88 PID 4436 wrote to memory of 3316 4436 jjdpp.exe 90 PID 4436 wrote to memory of 3316 4436 jjdpp.exe 90 PID 4436 wrote to memory of 3316 4436 jjdpp.exe 90 PID 3316 wrote to memory of 60 3316 lllfxxx.exe 91 PID 3316 wrote to memory of 60 3316 lllfxxx.exe 91 PID 3316 wrote to memory of 60 3316 lllfxxx.exe 91 PID 60 wrote to memory of 5104 60 xxrxrxf.exe 92 PID 60 wrote to memory of 5104 60 xxrxrxf.exe 92 PID 60 wrote to memory of 5104 60 xxrxrxf.exe 92 PID 5104 wrote to memory of 1948 5104 hhhhhh.exe 93 PID 5104 wrote to memory of 1948 5104 hhhhhh.exe 93 PID 5104 wrote to memory of 1948 5104 hhhhhh.exe 93 PID 1948 wrote to memory of 2824 1948 7nttnt.exe 94 PID 1948 wrote to memory of 2824 1948 7nttnt.exe 94 PID 1948 wrote to memory of 2824 1948 7nttnt.exe 94 PID 2824 wrote to memory of 4692 2824 3vvpj.exe 95 PID 2824 wrote to memory of 4692 2824 3vvpj.exe 95 PID 2824 wrote to memory of 4692 2824 3vvpj.exe 95 PID 4692 wrote to memory of 2848 4692 vvdvp.exe 97 PID 4692 wrote to memory of 2848 4692 vvdvp.exe 97 PID 4692 wrote to memory of 2848 4692 vvdvp.exe 97 PID 2848 wrote to memory of 4112 2848 xxrrrlr.exe 98 PID 2848 wrote to memory of 4112 2848 xxrrrlr.exe 98 PID 2848 wrote to memory of 4112 2848 xxrrrlr.exe 98 PID 4112 wrote to memory of 4808 4112 nnnnhh.exe 99 PID 4112 wrote to memory of 4808 4112 nnnnhh.exe 99 PID 4112 wrote to memory of 4808 4112 nnnnhh.exe 99 PID 4808 wrote to memory of 3504 4808 1bnhbb.exe 100 PID 4808 wrote to memory of 3504 4808 1bnhbb.exe 100 PID 4808 wrote to memory of 3504 4808 1bnhbb.exe 100 PID 3504 wrote to memory of 4328 3504 jdppp.exe 151 PID 3504 wrote to memory of 4328 3504 jdppp.exe 151 PID 3504 wrote to memory of 4328 3504 jdppp.exe 151 PID 4328 wrote to memory of 3196 4328 7vddj.exe 102 PID 4328 wrote to memory of 3196 4328 7vddj.exe 102 PID 4328 wrote to memory of 3196 4328 7vddj.exe 102 PID 3196 wrote to memory of 4256 3196 9fxfxlr.exe 104 PID 3196 wrote to memory of 4256 3196 9fxfxlr.exe 104 PID 3196 wrote to memory of 4256 3196 9fxfxlr.exe 104 PID 4256 wrote to memory of 4116 4256 3lfxxfl.exe 105 PID 4256 wrote to memory of 4116 4256 3lfxxfl.exe 105 PID 4256 wrote to memory of 4116 4256 3lfxxfl.exe 105 PID 4116 wrote to memory of 2516 4116 tttttt.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\43e4b1e7f3c60a1d63ad81c65210cfd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\43e4b1e7f3c60a1d63ad81c65210cfd0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\jjjjj.exec:\jjjjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\llxrxxl.exec:\llxrxxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\5xxxxll.exec:\5xxxxll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\nbbbbb.exec:\nbbbbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\nbtbbh.exec:\nbtbbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\dvddd.exec:\dvddd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
\??\c:\jjdpp.exec:\jjdpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\lllfxxx.exec:\lllfxxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\xxrxrxf.exec:\xxrxrxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\hhhhhh.exec:\hhhhhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\7nttnt.exec:\7nttnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\3vvpj.exec:\3vvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\vvdvp.exec:\vvdvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\xxrrrlr.exec:\xxrrrlr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\nnnnhh.exec:\nnnnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\1bnhbb.exec:\1bnhbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\jdppp.exec:\jdppp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\7vddj.exec:\7vddj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\9fxfxlr.exec:\9fxfxlr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\3lfxxfl.exec:\3lfxxfl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
\??\c:\tttttt.exec:\tttttt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\nhhnhh.exec:\nhhnhh.exe23⤵
- Executes dropped EXE
PID:2516 -
\??\c:\vjjjd.exec:\vjjjd.exe24⤵
- Executes dropped EXE
PID:2492 -
\??\c:\dppjd.exec:\dppjd.exe25⤵
- Executes dropped EXE
PID:3920 -
\??\c:\3lxxxxf.exec:\3lxxxxf.exe26⤵
- Executes dropped EXE
PID:4996 -
\??\c:\1hhttt.exec:\1hhttt.exe27⤵
- Executes dropped EXE
PID:4908 -
\??\c:\bthhhn.exec:\bthhhn.exe28⤵
- Executes dropped EXE
PID:1716 -
\??\c:\pjjdd.exec:\pjjdd.exe29⤵
- Executes dropped EXE
PID:5096 -
\??\c:\dvddv.exec:\dvddv.exe30⤵
- Executes dropped EXE
PID:2228 -
\??\c:\llffffl.exec:\llffffl.exe31⤵
- Executes dropped EXE
PID:4568 -
\??\c:\xflfffx.exec:\xflfffx.exe32⤵
- Executes dropped EXE
PID:4892 -
\??\c:\xrrllrl.exec:\xrrllrl.exe33⤵
- Executes dropped EXE
PID:4564 -
\??\c:\tthnnh.exec:\tthnnh.exe34⤵
- Executes dropped EXE
PID:3300 -
\??\c:\ttbtbb.exec:\ttbtbb.exe35⤵
- Executes dropped EXE
PID:1760 -
\??\c:\jdvvj.exec:\jdvvj.exe36⤵
- Executes dropped EXE
PID:1104 -
\??\c:\djddp.exec:\djddp.exe37⤵
- Executes dropped EXE
PID:2668 -
\??\c:\dvvvp.exec:\dvvvp.exe38⤵
- Executes dropped EXE
PID:2188 -
\??\c:\lxxxrrl.exec:\lxxxrrl.exe39⤵
- Executes dropped EXE
PID:1644 -
\??\c:\1rrrffx.exec:\1rrrffx.exe40⤵
- Executes dropped EXE
PID:2700 -
\??\c:\thhhhh.exec:\thhhhh.exe41⤵
- Executes dropped EXE
PID:3176 -
\??\c:\btbbbh.exec:\btbbbh.exe42⤵
- Executes dropped EXE
PID:3532 -
\??\c:\hbtbtt.exec:\hbtbtt.exe43⤵
- Executes dropped EXE
PID:2156 -
\??\c:\vvddd.exec:\vvddd.exe44⤵
- Executes dropped EXE
PID:5052 -
\??\c:\jvpjv.exec:\jvpjv.exe45⤵
- Executes dropped EXE
PID:4624 -
\??\c:\3xxrfff.exec:\3xxrfff.exe46⤵
- Executes dropped EXE
PID:3452 -
\??\c:\fflfflx.exec:\fflfflx.exe47⤵
- Executes dropped EXE
PID:3292 -
\??\c:\rxffffx.exec:\rxffffx.exe48⤵
- Executes dropped EXE
PID:1696 -
\??\c:\bhhhhn.exec:\bhhhhn.exe49⤵
- Executes dropped EXE
PID:5108 -
\??\c:\5bbnht.exec:\5bbnht.exe50⤵
- Executes dropped EXE
PID:1420 -
\??\c:\5jpvp.exec:\5jpvp.exe51⤵
- Executes dropped EXE
PID:2064 -
\??\c:\vjjdd.exec:\vjjdd.exe52⤵
- Executes dropped EXE
PID:3672 -
\??\c:\vpjdd.exec:\vpjdd.exe53⤵
- Executes dropped EXE
PID:4372 -
\??\c:\xrrrxxr.exec:\xrrrxxr.exe54⤵
- Executes dropped EXE
PID:5104 -
\??\c:\xxxxxxx.exec:\xxxxxxx.exe55⤵
- Executes dropped EXE
PID:3880 -
\??\c:\rrlllll.exec:\rrlllll.exe56⤵
- Executes dropped EXE
PID:3956 -
\??\c:\hhbhhh.exec:\hhbhhh.exe57⤵
- Executes dropped EXE
PID:468 -
\??\c:\3tbtnn.exec:\3tbtnn.exe58⤵
- Executes dropped EXE
PID:2076 -
\??\c:\7vjdv.exec:\7vjdv.exe59⤵
- Executes dropped EXE
PID:3716 -
\??\c:\jvvvv.exec:\jvvvv.exe60⤵
- Executes dropped EXE
PID:1272 -
\??\c:\fflfxff.exec:\fflfxff.exe61⤵
- Executes dropped EXE
PID:208 -
\??\c:\xfflrxx.exec:\xfflrxx.exe62⤵
- Executes dropped EXE
PID:1456 -
\??\c:\xflfxxr.exec:\xflfxxr.exe63⤵
- Executes dropped EXE
PID:4680 -
\??\c:\hhhnhh.exec:\hhhnhh.exe64⤵
- Executes dropped EXE
PID:2544 -
\??\c:\nhhhbb.exec:\nhhhbb.exe65⤵
- Executes dropped EXE
PID:4420 -
\??\c:\jppjj.exec:\jppjj.exe66⤵PID:1740
-
\??\c:\ppvpp.exec:\ppvpp.exe67⤵PID:876
-
\??\c:\9fxfrrr.exec:\9fxfrrr.exe68⤵PID:4328
-
\??\c:\lxfffff.exec:\lxfffff.exe69⤵PID:3424
-
\??\c:\3rxrrll.exec:\3rxrrll.exe70⤵PID:452
-
\??\c:\bbnthh.exec:\bbnthh.exe71⤵PID:2708
-
\??\c:\5nnnnn.exec:\5nnnnn.exe72⤵PID:4924
-
\??\c:\jpjjd.exec:\jpjjd.exe73⤵PID:4304
-
\??\c:\vvvdd.exec:\vvvdd.exe74⤵PID:628
-
\??\c:\pddjj.exec:\pddjj.exe75⤵PID:3920
-
\??\c:\lffllrx.exec:\lffllrx.exe76⤵PID:2256
-
\??\c:\llxrrfx.exec:\llxrrfx.exe77⤵PID:1056
-
\??\c:\hbnnnt.exec:\hbnnnt.exe78⤵PID:2844
-
\??\c:\bbbbtt.exec:\bbbbtt.exe79⤵PID:1716
-
\??\c:\1dpvd.exec:\1dpvd.exe80⤵PID:3456
-
\??\c:\jdpjp.exec:\jdpjp.exe81⤵PID:464
-
\??\c:\jjvjj.exec:\jjvjj.exe82⤵PID:4760
-
\??\c:\flxllxf.exec:\flxllxf.exe83⤵PID:908
-
\??\c:\rrlrfxx.exec:\rrlrfxx.exe84⤵PID:3096
-
\??\c:\bbbbtt.exec:\bbbbtt.exe85⤵PID:2772
-
\??\c:\1hhbhh.exec:\1hhbhh.exe86⤵PID:3300
-
\??\c:\3htntt.exec:\3htntt.exe87⤵PID:1760
-
\??\c:\jjjjd.exec:\jjjjd.exe88⤵PID:4500
-
\??\c:\xxlfffl.exec:\xxlfffl.exe89⤵PID:1324
-
\??\c:\lfffffl.exec:\lfffffl.exe90⤵PID:5020
-
\??\c:\hntbbt.exec:\hntbbt.exe91⤵PID:5092
-
\??\c:\jjppp.exec:\jjppp.exe92⤵PID:4144
-
\??\c:\vpdvj.exec:\vpdvj.exe93⤵PID:4352
-
\??\c:\dvpjv.exec:\dvpjv.exe94⤵PID:3472
-
\??\c:\9lxfxxr.exec:\9lxfxxr.exe95⤵PID:4784
-
\??\c:\nhttbh.exec:\nhttbh.exe96⤵PID:1468
-
\??\c:\hnntbh.exec:\hnntbh.exe97⤵PID:3680
-
\??\c:\jdjdv.exec:\jdjdv.exe98⤵PID:3008
-
\??\c:\9pvdv.exec:\9pvdv.exe99⤵PID:4948
-
\??\c:\frfxxff.exec:\frfxxff.exe100⤵PID:1164
-
\??\c:\nnnntt.exec:\nnnntt.exe101⤵PID:2732
-
\??\c:\ppjjv.exec:\ppjjv.exe102⤵PID:1160
-
\??\c:\xrlfxfx.exec:\xrlfxfx.exe103⤵PID:1832
-
\??\c:\7hhhbh.exec:\7hhhbh.exe104⤵PID:3892
-
\??\c:\nhttnn.exec:\nhttnn.exe105⤵PID:3356
-
\??\c:\vvdjj.exec:\vvdjj.exe106⤵PID:2140
-
\??\c:\lxlrxfl.exec:\lxlrxfl.exe107⤵PID:1948
-
\??\c:\nnnnhh.exec:\nnnnhh.exe108⤵PID:3584
-
\??\c:\bbhhhn.exec:\bbhhhn.exe109⤵PID:436
-
\??\c:\pdpjd.exec:\pdpjd.exe110⤵PID:2816
-
\??\c:\3fxfxxl.exec:\3fxfxxl.exe111⤵PID:4312
-
\??\c:\hthntb.exec:\hthntb.exe112⤵PID:4756
-
\??\c:\jdppp.exec:\jdppp.exe113⤵PID:1416
-
\??\c:\rrllllf.exec:\rrllllf.exe114⤵PID:912
-
\??\c:\tnttnn.exec:\tnttnn.exe115⤵PID:1456
-
\??\c:\tntttb.exec:\tntttb.exe116⤵PID:4276
-
\??\c:\jjjjj.exec:\jjjjj.exe117⤵PID:3172
-
\??\c:\rlxflrf.exec:\rlxflrf.exe118⤵PID:3904
-
\??\c:\lrlrllx.exec:\lrlrllx.exe119⤵PID:1484
-
\??\c:\nhnbhb.exec:\nhnbhb.exe120⤵PID:5076
-
\??\c:\1jpjj.exec:\1jpjj.exe121⤵PID:548
-
\??\c:\3rrxxff.exec:\3rrxxff.exe122⤵PID:940
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-