Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 20:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4c9ebf971096ef51047f38e79eac9e80_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
4c9ebf971096ef51047f38e79eac9e80_NeikiAnalytics.exe
-
Size
71KB
-
MD5
4c9ebf971096ef51047f38e79eac9e80
-
SHA1
869ef826f9b6114324a3f1db6ded67666569c4ad
-
SHA256
649d7e9c06ddc4c49a4caa9d2d182387a135cb8658de9112c1b2aa6bac5f6bd4
-
SHA512
1da1131d1b6d64cb5be3453d3366416468c05af948864fe40dc20e04a362fefb1a4d2d502ffef3df4e4490b4edd64548d63c60cea4bcbfe1e8831229529c04f8
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb7GTi3ldk:ymb3NkkiQ3mdBjFIWYG
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/224-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4104-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4000-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1372-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3940-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2764-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1316-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1760-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1756-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2136-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4492-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/988-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2536-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3352-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4248-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3524-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1548-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5072-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3588-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4144-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1628-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4288-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1520-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4232 9lrlfll.exe 4104 nnnnnn.exe 5100 hhnnnn.exe 1372 9vjjj.exe 4000 rlrrrrf.exe 3940 1hbtnn.exe 2764 7vpjd.exe 1316 vpjjd.exe 2528 hbnnnt.exe 1760 vpvpj.exe 3320 1pdjd.exe 1756 7rxfxrr.exe 2136 nhhbhn.exe 864 jpdjd.exe 4492 pjjdd.exe 3212 xxrxllx.exe 988 9hnttn.exe 2536 3httbh.exe 3352 vdjjp.exe 4248 ppvpp.exe 3524 fxfffrr.exe 1548 htbhhh.exe 5072 dvddd.exe 3588 5frrrff.exe 4144 hnnnht.exe 1628 djjdd.exe 4428 1ppjj.exe 4288 xxfxxff.exe 1520 7lffrxl.exe 4448 nhhhhh.exe 1248 lflrxfl.exe 3492 5hhnnt.exe 4392 ntbbbh.exe 4324 ddvdp.exe 4528 rlrrllr.exe 2284 thbthn.exe 3964 nnbbbb.exe 548 jdjjp.exe 1808 djjjp.exe 4356 xxlrlrf.exe 232 5thtbh.exe 4880 bhbhbh.exe 4104 vdvdj.exe 5100 rrrrrxx.exe 4284 xxllrrr.exe 2448 tbnnnt.exe 1368 tttthb.exe 3932 pjpjd.exe 2524 xxfffll.exe 1416 xxfxxxx.exe 4088 hhnnnt.exe 3484 bntttt.exe 4620 dvdpp.exe 3640 5djjj.exe 3960 lfxxlff.exe 1740 hbhhnn.exe 1768 hhtttb.exe 1256 jjppj.exe 4500 rrlllrx.exe 1304 xxrxfrf.exe 988 tbttnt.exe 1432 nbttnt.exe 1736 9dpvv.exe 4468 ppvvp.exe -
resource yara_rule behavioral2/memory/224-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4104-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4000-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1372-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3940-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2764-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1316-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1316-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1760-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1756-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2136-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4492-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/988-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2536-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3352-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4248-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3524-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5072-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4144-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1628-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4428-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4288-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1520-190-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 224 wrote to memory of 4232 224 4c9ebf971096ef51047f38e79eac9e80_NeikiAnalytics.exe 83 PID 224 wrote to memory of 4232 224 4c9ebf971096ef51047f38e79eac9e80_NeikiAnalytics.exe 83 PID 224 wrote to memory of 4232 224 4c9ebf971096ef51047f38e79eac9e80_NeikiAnalytics.exe 83 PID 4232 wrote to memory of 4104 4232 9lrlfll.exe 84 PID 4232 wrote to memory of 4104 4232 9lrlfll.exe 84 PID 4232 wrote to memory of 4104 4232 9lrlfll.exe 84 PID 4104 wrote to memory of 5100 4104 nnnnnn.exe 85 PID 4104 wrote to memory of 5100 4104 nnnnnn.exe 85 PID 4104 wrote to memory of 5100 4104 nnnnnn.exe 85 PID 5100 wrote to memory of 1372 5100 hhnnnn.exe 86 PID 5100 wrote to memory of 1372 5100 hhnnnn.exe 86 PID 5100 wrote to memory of 1372 5100 hhnnnn.exe 86 PID 1372 wrote to memory of 4000 1372 9vjjj.exe 87 PID 1372 wrote to memory of 4000 1372 9vjjj.exe 87 PID 1372 wrote to memory of 4000 1372 9vjjj.exe 87 PID 4000 wrote to memory of 3940 4000 rlrrrrf.exe 88 PID 4000 wrote to memory of 3940 4000 rlrrrrf.exe 88 PID 4000 wrote to memory of 3940 4000 rlrrrrf.exe 88 PID 3940 wrote to memory of 2764 3940 1hbtnn.exe 89 PID 3940 wrote to memory of 2764 3940 1hbtnn.exe 89 PID 3940 wrote to memory of 2764 3940 1hbtnn.exe 89 PID 2764 wrote to memory of 1316 2764 7vpjd.exe 90 PID 2764 wrote to memory of 1316 2764 7vpjd.exe 90 PID 2764 wrote to memory of 1316 2764 7vpjd.exe 90 PID 1316 wrote to memory of 2528 1316 vpjjd.exe 91 PID 1316 wrote to memory of 2528 1316 vpjjd.exe 91 PID 1316 wrote to memory of 2528 1316 vpjjd.exe 91 PID 2528 wrote to memory of 1760 2528 hbnnnt.exe 92 PID 2528 wrote to memory of 1760 2528 hbnnnt.exe 92 PID 2528 wrote to memory of 1760 2528 hbnnnt.exe 92 PID 1760 wrote to memory of 3320 1760 vpvpj.exe 93 PID 1760 wrote to memory of 3320 1760 vpvpj.exe 93 PID 1760 wrote to memory of 3320 1760 vpvpj.exe 93 PID 3320 wrote to memory of 1756 3320 1pdjd.exe 94 PID 3320 wrote to memory of 1756 3320 1pdjd.exe 94 PID 3320 wrote to memory of 1756 3320 1pdjd.exe 94 PID 1756 wrote to memory of 2136 1756 7rxfxrr.exe 95 PID 1756 wrote to memory of 2136 1756 7rxfxrr.exe 95 PID 1756 wrote to memory of 2136 1756 7rxfxrr.exe 95 PID 2136 wrote to memory of 864 2136 nhhbhn.exe 96 PID 2136 wrote to memory of 864 2136 nhhbhn.exe 96 PID 2136 wrote to memory of 864 2136 nhhbhn.exe 96 PID 864 wrote to memory of 4492 864 jpdjd.exe 97 PID 864 wrote to memory of 4492 864 jpdjd.exe 97 PID 864 wrote to memory of 4492 864 jpdjd.exe 97 PID 4492 wrote to memory of 3212 4492 pjjdd.exe 98 PID 4492 wrote to memory of 3212 4492 pjjdd.exe 98 PID 4492 wrote to memory of 3212 4492 pjjdd.exe 98 PID 3212 wrote to memory of 988 3212 xxrxllx.exe 99 PID 3212 wrote to memory of 988 3212 xxrxllx.exe 99 PID 3212 wrote to memory of 988 3212 xxrxllx.exe 99 PID 988 wrote to memory of 2536 988 9hnttn.exe 100 PID 988 wrote to memory of 2536 988 9hnttn.exe 100 PID 988 wrote to memory of 2536 988 9hnttn.exe 100 PID 2536 wrote to memory of 3352 2536 3httbh.exe 101 PID 2536 wrote to memory of 3352 2536 3httbh.exe 101 PID 2536 wrote to memory of 3352 2536 3httbh.exe 101 PID 3352 wrote to memory of 4248 3352 vdjjp.exe 102 PID 3352 wrote to memory of 4248 3352 vdjjp.exe 102 PID 3352 wrote to memory of 4248 3352 vdjjp.exe 102 PID 4248 wrote to memory of 3524 4248 ppvpp.exe 103 PID 4248 wrote to memory of 3524 4248 ppvpp.exe 103 PID 4248 wrote to memory of 3524 4248 ppvpp.exe 103 PID 3524 wrote to memory of 1548 3524 fxfffrr.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c9ebf971096ef51047f38e79eac9e80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4c9ebf971096ef51047f38e79eac9e80_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\9lrlfll.exec:\9lrlfll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\nnnnnn.exec:\nnnnnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\hhnnnn.exec:\hhnnnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\9vjjj.exec:\9vjjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\rlrrrrf.exec:\rlrrrrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\1hbtnn.exec:\1hbtnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\7vpjd.exec:\7vpjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\vpjjd.exec:\vpjjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\hbnnnt.exec:\hbnnnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\vpvpj.exec:\vpvpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\1pdjd.exec:\1pdjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\7rxfxrr.exec:\7rxfxrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\nhhbhn.exec:\nhhbhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\jpdjd.exec:\jpdjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\pjjdd.exec:\pjjdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\xxrxllx.exec:\xxrxllx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\9hnttn.exec:\9hnttn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
\??\c:\3httbh.exec:\3httbh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\vdjjp.exec:\vdjjp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
\??\c:\ppvpp.exec:\ppvpp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\fxfffrr.exec:\fxfffrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\htbhhh.exec:\htbhhh.exe23⤵
- Executes dropped EXE
PID:1548 -
\??\c:\dvddd.exec:\dvddd.exe24⤵
- Executes dropped EXE
PID:5072 -
\??\c:\5frrrff.exec:\5frrrff.exe25⤵
- Executes dropped EXE
PID:3588 -
\??\c:\hnnnht.exec:\hnnnht.exe26⤵
- Executes dropped EXE
PID:4144 -
\??\c:\djjdd.exec:\djjdd.exe27⤵
- Executes dropped EXE
PID:1628 -
\??\c:\1ppjj.exec:\1ppjj.exe28⤵
- Executes dropped EXE
PID:4428 -
\??\c:\xxfxxff.exec:\xxfxxff.exe29⤵
- Executes dropped EXE
PID:4288 -
\??\c:\7lffrxl.exec:\7lffrxl.exe30⤵
- Executes dropped EXE
PID:1520 -
\??\c:\nhhhhh.exec:\nhhhhh.exe31⤵
- Executes dropped EXE
PID:4448 -
\??\c:\lflrxfl.exec:\lflrxfl.exe32⤵
- Executes dropped EXE
PID:1248 -
\??\c:\5hhnnt.exec:\5hhnnt.exe33⤵
- Executes dropped EXE
PID:3492 -
\??\c:\ntbbbh.exec:\ntbbbh.exe34⤵
- Executes dropped EXE
PID:4392 -
\??\c:\ddvdp.exec:\ddvdp.exe35⤵
- Executes dropped EXE
PID:4324 -
\??\c:\rlrrllr.exec:\rlrrllr.exe36⤵
- Executes dropped EXE
PID:4528 -
\??\c:\thbthn.exec:\thbthn.exe37⤵
- Executes dropped EXE
PID:2284 -
\??\c:\nnbbbb.exec:\nnbbbb.exe38⤵
- Executes dropped EXE
PID:3964 -
\??\c:\jdjjp.exec:\jdjjp.exe39⤵
- Executes dropped EXE
PID:548 -
\??\c:\djjjp.exec:\djjjp.exe40⤵
- Executes dropped EXE
PID:1808 -
\??\c:\xxlrlrf.exec:\xxlrlrf.exe41⤵
- Executes dropped EXE
PID:4356 -
\??\c:\5thtbh.exec:\5thtbh.exe42⤵
- Executes dropped EXE
PID:232 -
\??\c:\bhbhbh.exec:\bhbhbh.exe43⤵
- Executes dropped EXE
PID:4880 -
\??\c:\vdvdj.exec:\vdvdj.exe44⤵
- Executes dropped EXE
PID:4104 -
\??\c:\rrrrrxx.exec:\rrrrrxx.exe45⤵
- Executes dropped EXE
PID:5100 -
\??\c:\xxllrrr.exec:\xxllrrr.exe46⤵
- Executes dropped EXE
PID:4284 -
\??\c:\tbnnnt.exec:\tbnnnt.exe47⤵
- Executes dropped EXE
PID:2448 -
\??\c:\tttthb.exec:\tttthb.exe48⤵
- Executes dropped EXE
PID:1368 -
\??\c:\pjpjd.exec:\pjpjd.exe49⤵
- Executes dropped EXE
PID:3932 -
\??\c:\xxfffll.exec:\xxfffll.exe50⤵
- Executes dropped EXE
PID:2524 -
\??\c:\xxfxxxx.exec:\xxfxxxx.exe51⤵
- Executes dropped EXE
PID:1416 -
\??\c:\hhnnnt.exec:\hhnnnt.exe52⤵
- Executes dropped EXE
PID:4088 -
\??\c:\bntttt.exec:\bntttt.exe53⤵
- Executes dropped EXE
PID:3484 -
\??\c:\dvdpp.exec:\dvdpp.exe54⤵
- Executes dropped EXE
PID:4620 -
\??\c:\5djjj.exec:\5djjj.exe55⤵
- Executes dropped EXE
PID:3640 -
\??\c:\lfxxlff.exec:\lfxxlff.exe56⤵
- Executes dropped EXE
PID:3960 -
\??\c:\hbhhnn.exec:\hbhhnn.exe57⤵
- Executes dropped EXE
PID:1740 -
\??\c:\hhtttb.exec:\hhtttb.exe58⤵
- Executes dropped EXE
PID:1768 -
\??\c:\jjppj.exec:\jjppj.exe59⤵
- Executes dropped EXE
PID:1256 -
\??\c:\rrlllrx.exec:\rrlllrx.exe60⤵
- Executes dropped EXE
PID:4500 -
\??\c:\xxrxfrf.exec:\xxrxfrf.exe61⤵
- Executes dropped EXE
PID:1304 -
\??\c:\tbttnt.exec:\tbttnt.exe62⤵
- Executes dropped EXE
PID:988 -
\??\c:\nbttnt.exec:\nbttnt.exe63⤵
- Executes dropped EXE
PID:1432 -
\??\c:\9dpvv.exec:\9dpvv.exe64⤵
- Executes dropped EXE
PID:1736 -
\??\c:\ppvvp.exec:\ppvvp.exe65⤵
- Executes dropped EXE
PID:4468 -
\??\c:\xrxlfff.exec:\xrxlfff.exe66⤵PID:768
-
\??\c:\llflrxf.exec:\llflrxf.exe67⤵PID:396
-
\??\c:\nhnbhn.exec:\nhnbhn.exe68⤵PID:1272
-
\??\c:\tnttnn.exec:\tnttnn.exe69⤵PID:3748
-
\??\c:\rxfffrr.exec:\rxfffrr.exe70⤵PID:5072
-
\??\c:\5hnttb.exec:\5hnttb.exe71⤵PID:2344
-
\??\c:\djppv.exec:\djppv.exe72⤵PID:3656
-
\??\c:\dvddd.exec:\dvddd.exe73⤵PID:5060
-
\??\c:\rrrxxfl.exec:\rrrxxfl.exe74⤵PID:3768
-
\??\c:\5bnnnh.exec:\5bnnnh.exe75⤵PID:544
-
\??\c:\ddjpp.exec:\ddjpp.exe76⤵PID:4288
-
\??\c:\9pvjd.exec:\9pvjd.exe77⤵PID:3344
-
\??\c:\rlxffrf.exec:\rlxffrf.exe78⤵PID:1968
-
\??\c:\tbnbhh.exec:\tbnbhh.exe79⤵PID:5096
-
\??\c:\bbttbh.exec:\bbttbh.exe80⤵PID:3448
-
\??\c:\1jvjd.exec:\1jvjd.exe81⤵PID:1704
-
\??\c:\ppddv.exec:\ppddv.exe82⤵PID:3612
-
\??\c:\llrrrrx.exec:\llrrrrx.exe83⤵PID:4576
-
\??\c:\ffffxxx.exec:\ffffxxx.exe84⤵PID:2980
-
\??\c:\httnnn.exec:\httnnn.exe85⤵PID:3736
-
\??\c:\vvvpv.exec:\vvvpv.exe86⤵PID:2004
-
\??\c:\pddpp.exec:\pddpp.exe87⤵PID:4920
-
\??\c:\vdddj.exec:\vdddj.exe88⤵PID:4888
-
\??\c:\lrrxfxf.exec:\lrrxfxf.exe89⤵PID:4232
-
\??\c:\lflrlrr.exec:\lflrlrr.exe90⤵PID:2588
-
\??\c:\bhbnhn.exec:\bhbnhn.exe91⤵PID:3028
-
\??\c:\nhtbbh.exec:\nhtbbh.exe92⤵PID:1676
-
\??\c:\5dppj.exec:\5dppj.exe93⤵PID:2688
-
\??\c:\vpvpj.exec:\vpvpj.exe94⤵PID:4488
-
\??\c:\rrrrlrl.exec:\rrrrlrl.exe95⤵PID:2764
-
\??\c:\fflrrxf.exec:\fflrrxf.exe96⤵PID:1680
-
\??\c:\7bbbbh.exec:\7bbbbh.exe97⤵PID:1416
-
\??\c:\ttnhhn.exec:\ttnhhn.exe98⤵PID:4088
-
\??\c:\vvjvd.exec:\vvjvd.exe99⤵PID:3484
-
\??\c:\pjppv.exec:\pjppv.exe100⤵PID:1152
-
\??\c:\rlffxff.exec:\rlffxff.exe101⤵PID:3640
-
\??\c:\lxlrrxl.exec:\lxlrrxl.exe102⤵PID:3280
-
\??\c:\nthhhh.exec:\nthhhh.exe103⤵PID:3960
-
\??\c:\bbnbbb.exec:\bbnbbb.exe104⤵PID:1056
-
\??\c:\jvppp.exec:\jvppp.exe105⤵PID:2116
-
\??\c:\pvvdj.exec:\pvvdj.exe106⤵PID:4524
-
\??\c:\llllfxf.exec:\llllfxf.exe107⤵PID:2280
-
\??\c:\lrxrllf.exec:\lrxrllf.exe108⤵PID:2976
-
\??\c:\bttttt.exec:\bttttt.exe109⤵PID:1616
-
\??\c:\hhtbhh.exec:\hhtbhh.exe110⤵PID:944
-
\??\c:\bbhhbh.exec:\bbhhbh.exe111⤵PID:1440
-
\??\c:\ppvvj.exec:\ppvvj.exe112⤵PID:1148
-
\??\c:\pvjvp.exec:\pvjvp.exe113⤵PID:3220
-
\??\c:\lfrrrxx.exec:\lfrrrxx.exe114⤵PID:3524
-
\??\c:\xrfllrx.exec:\xrfllrx.exe115⤵PID:1272
-
\??\c:\nnnnnn.exec:\nnnnnn.exe116⤵PID:4252
-
\??\c:\hntbbt.exec:\hntbbt.exe117⤵PID:3056
-
\??\c:\hhntnh.exec:\hhntnh.exe118⤵PID:5000
-
\??\c:\djddv.exec:\djddv.exe119⤵PID:4780
-
\??\c:\vjdpj.exec:\vjdpj.exe120⤵PID:1196
-
\??\c:\xrrxfff.exec:\xrrxfff.exe121⤵PID:3768
-
\??\c:\btnhbh.exec:\btnhbh.exe122⤵PID:336
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-