Analysis
-
max time kernel
150s -
max time network
56s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 10:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
558a2c54a457a76869adf4225a89da80c35b47698daf81a5243844b587f85d71_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
558a2c54a457a76869adf4225a89da80c35b47698daf81a5243844b587f85d71_NeikiAnalytics.exe
-
Size
92KB
-
MD5
185689da71240b38ffddf08d4f09e430
-
SHA1
c5a8fed2f22e2fbbdd4f4cfe4d561dee22ec9ce2
-
SHA256
558a2c54a457a76869adf4225a89da80c35b47698daf81a5243844b587f85d71
-
SHA512
c180f3467e23df7e1cdfed291db59f87f07ccd0a12fad357d0f33d731734f70122b581d633c9c12e34aa9373884c4a27bf97c02b711e7fe002fd419e8bbdbd79
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDodtzac0Hobv0byLufTJfJgx:ymb3NkkiQ3mdBjFodt27HobvcyLufNfy
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/464-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1448-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2924-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4436-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1164-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1116-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4504-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2196-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1376-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3952-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2636-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4120-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2624-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2560-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/748-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4296-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3216-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1688-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2416-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3296-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2308-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3304-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1424-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1448 bhnnnn.exe 1164 tnbtnt.exe 4436 jdjdv.exe 2924 pdpjd.exe 2484 xlrlfxx.exe 4504 dpjjj.exe 1116 vdjjd.exe 2196 xllfxxr.exe 1376 bnthbt.exe 3952 lffxrfx.exe 2636 nhhnhb.exe 4120 jjjjj.exe 3708 fxxrrll.exe 2624 hbhbnn.exe 2560 ppjdd.exe 748 fxflxll.exe 3536 rlrlfxr.exe 4296 htbtnn.exe 3216 rlfxrxx.exe 4012 rrxxxxr.exe 1688 vvjdv.exe 5012 lxlllff.exe 2416 vdjdv.exe 3320 frlfffr.exe 3296 ttbtnn.exe 2960 jjdvd.exe 2308 fxrlxxr.exe 3304 ntnbtn.exe 1424 rlrrllf.exe 1484 llxrllf.exe 2332 dvjjp.exe 2648 jpvpp.exe 1944 rlllllx.exe 3732 lxxrllf.exe 3852 hhbtnn.exe 3144 9vvpj.exe 3208 jvpjv.exe 1880 xlrlllf.exe 2516 hbnnnn.exe 4000 jjddv.exe 1260 jddjd.exe 4972 lxfxlll.exe 1168 lfxrllf.exe 3268 lxfffff.exe 4396 1ttnhn.exe 1344 pjdvp.exe 1072 jjppd.exe 4788 rrffllf.exe 1436 xrllfff.exe 4448 btthhh.exe 2660 nnhbbb.exe 4232 dppjj.exe 1512 9rfxflr.exe 4192 xrrlfxx.exe 740 5nnnhn.exe 1684 nttbnt.exe 1816 jjpjv.exe 836 1vvvp.exe 3808 1fxrffx.exe 4332 lfrrrrl.exe 3940 ntbbtt.exe 2424 httnhh.exe 3356 5vdvv.exe 3868 jdddv.exe -
resource yara_rule behavioral2/memory/464-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1448-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4436-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1164-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1116-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4504-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2196-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1376-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1376-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1376-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1376-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2636-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2624-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2560-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/748-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4296-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3216-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1688-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2416-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3296-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3304-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1424-196-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 464 wrote to memory of 1448 464 558a2c54a457a76869adf4225a89da80c35b47698daf81a5243844b587f85d71_NeikiAnalytics.exe 81 PID 464 wrote to memory of 1448 464 558a2c54a457a76869adf4225a89da80c35b47698daf81a5243844b587f85d71_NeikiAnalytics.exe 81 PID 464 wrote to memory of 1448 464 558a2c54a457a76869adf4225a89da80c35b47698daf81a5243844b587f85d71_NeikiAnalytics.exe 81 PID 1448 wrote to memory of 1164 1448 bhnnnn.exe 82 PID 1448 wrote to memory of 1164 1448 bhnnnn.exe 82 PID 1448 wrote to memory of 1164 1448 bhnnnn.exe 82 PID 1164 wrote to memory of 4436 1164 tnbtnt.exe 83 PID 1164 wrote to memory of 4436 1164 tnbtnt.exe 83 PID 1164 wrote to memory of 4436 1164 tnbtnt.exe 83 PID 4436 wrote to memory of 2924 4436 jdjdv.exe 84 PID 4436 wrote to memory of 2924 4436 jdjdv.exe 84 PID 4436 wrote to memory of 2924 4436 jdjdv.exe 84 PID 2924 wrote to memory of 2484 2924 pdpjd.exe 85 PID 2924 wrote to memory of 2484 2924 pdpjd.exe 85 PID 2924 wrote to memory of 2484 2924 pdpjd.exe 85 PID 2484 wrote to memory of 4504 2484 xlrlfxx.exe 86 PID 2484 wrote to memory of 4504 2484 xlrlfxx.exe 86 PID 2484 wrote to memory of 4504 2484 xlrlfxx.exe 86 PID 4504 wrote to memory of 1116 4504 dpjjj.exe 87 PID 4504 wrote to memory of 1116 4504 dpjjj.exe 87 PID 4504 wrote to memory of 1116 4504 dpjjj.exe 87 PID 1116 wrote to memory of 2196 1116 vdjjd.exe 88 PID 1116 wrote to memory of 2196 1116 vdjjd.exe 88 PID 1116 wrote to memory of 2196 1116 vdjjd.exe 88 PID 2196 wrote to memory of 1376 2196 xllfxxr.exe 89 PID 2196 wrote to memory of 1376 2196 xllfxxr.exe 89 PID 2196 wrote to memory of 1376 2196 xllfxxr.exe 89 PID 1376 wrote to memory of 3952 1376 bnthbt.exe 90 PID 1376 wrote to memory of 3952 1376 bnthbt.exe 90 PID 1376 wrote to memory of 3952 1376 bnthbt.exe 90 PID 3952 wrote to memory of 2636 3952 lffxrfx.exe 91 PID 3952 wrote to memory of 2636 3952 lffxrfx.exe 91 PID 3952 wrote to memory of 2636 3952 lffxrfx.exe 91 PID 2636 wrote to memory of 4120 2636 nhhnhb.exe 92 PID 2636 wrote to memory of 4120 2636 nhhnhb.exe 92 PID 2636 wrote to memory of 4120 2636 nhhnhb.exe 92 PID 4120 wrote to memory of 3708 4120 jjjjj.exe 93 PID 4120 wrote to memory of 3708 4120 jjjjj.exe 93 PID 4120 wrote to memory of 3708 4120 jjjjj.exe 93 PID 3708 wrote to memory of 2624 3708 fxxrrll.exe 94 PID 3708 wrote to memory of 2624 3708 fxxrrll.exe 94 PID 3708 wrote to memory of 2624 3708 fxxrrll.exe 94 PID 2624 wrote to memory of 2560 2624 hbhbnn.exe 95 PID 2624 wrote to memory of 2560 2624 hbhbnn.exe 95 PID 2624 wrote to memory of 2560 2624 hbhbnn.exe 95 PID 2560 wrote to memory of 748 2560 ppjdd.exe 96 PID 2560 wrote to memory of 748 2560 ppjdd.exe 96 PID 2560 wrote to memory of 748 2560 ppjdd.exe 96 PID 748 wrote to memory of 3536 748 fxflxll.exe 97 PID 748 wrote to memory of 3536 748 fxflxll.exe 97 PID 748 wrote to memory of 3536 748 fxflxll.exe 97 PID 3536 wrote to memory of 4296 3536 rlrlfxr.exe 98 PID 3536 wrote to memory of 4296 3536 rlrlfxr.exe 98 PID 3536 wrote to memory of 4296 3536 rlrlfxr.exe 98 PID 4296 wrote to memory of 3216 4296 htbtnn.exe 99 PID 4296 wrote to memory of 3216 4296 htbtnn.exe 99 PID 4296 wrote to memory of 3216 4296 htbtnn.exe 99 PID 3216 wrote to memory of 4012 3216 rlfxrxx.exe 100 PID 3216 wrote to memory of 4012 3216 rlfxrxx.exe 100 PID 3216 wrote to memory of 4012 3216 rlfxrxx.exe 100 PID 4012 wrote to memory of 1688 4012 rrxxxxr.exe 101 PID 4012 wrote to memory of 1688 4012 rrxxxxr.exe 101 PID 4012 wrote to memory of 1688 4012 rrxxxxr.exe 101 PID 1688 wrote to memory of 5012 1688 vvjdv.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\558a2c54a457a76869adf4225a89da80c35b47698daf81a5243844b587f85d71_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\558a2c54a457a76869adf4225a89da80c35b47698daf81a5243844b587f85d71_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\bhnnnn.exec:\bhnnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\tnbtnt.exec:\tnbtnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\jdjdv.exec:\jdjdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\pdpjd.exec:\pdpjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\xlrlfxx.exec:\xlrlfxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\dpjjj.exec:\dpjjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\vdjjd.exec:\vdjjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\xllfxxr.exec:\xllfxxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\bnthbt.exec:\bnthbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\lffxrfx.exec:\lffxrfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\nhhnhb.exec:\nhhnhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\jjjjj.exec:\jjjjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\fxxrrll.exec:\fxxrrll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\hbhbnn.exec:\hbhbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\ppjdd.exec:\ppjdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\fxflxll.exec:\fxflxll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\rlrlfxr.exec:\rlrlfxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\htbtnn.exec:\htbtnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\rlfxrxx.exec:\rlfxrxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\rrxxxxr.exec:\rrxxxxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\vvjdv.exec:\vvjdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\lxlllff.exec:\lxlllff.exe23⤵
- Executes dropped EXE
PID:5012 -
\??\c:\vdjdv.exec:\vdjdv.exe24⤵
- Executes dropped EXE
PID:2416 -
\??\c:\frlfffr.exec:\frlfffr.exe25⤵
- Executes dropped EXE
PID:3320 -
\??\c:\ttbtnn.exec:\ttbtnn.exe26⤵
- Executes dropped EXE
PID:3296 -
\??\c:\jjdvd.exec:\jjdvd.exe27⤵
- Executes dropped EXE
PID:2960 -
\??\c:\fxrlxxr.exec:\fxrlxxr.exe28⤵
- Executes dropped EXE
PID:2308 -
\??\c:\ntnbtn.exec:\ntnbtn.exe29⤵
- Executes dropped EXE
PID:3304 -
\??\c:\rlrrllf.exec:\rlrrllf.exe30⤵
- Executes dropped EXE
PID:1424 -
\??\c:\llxrllf.exec:\llxrllf.exe31⤵
- Executes dropped EXE
PID:1484 -
\??\c:\dvjjp.exec:\dvjjp.exe32⤵
- Executes dropped EXE
PID:2332 -
\??\c:\jpvpp.exec:\jpvpp.exe33⤵
- Executes dropped EXE
PID:2648 -
\??\c:\rlllllx.exec:\rlllllx.exe34⤵
- Executes dropped EXE
PID:1944 -
\??\c:\lxxrllf.exec:\lxxrllf.exe35⤵
- Executes dropped EXE
PID:3732 -
\??\c:\hhbtnn.exec:\hhbtnn.exe36⤵
- Executes dropped EXE
PID:3852 -
\??\c:\9vvpj.exec:\9vvpj.exe37⤵
- Executes dropped EXE
PID:3144 -
\??\c:\jvpjv.exec:\jvpjv.exe38⤵
- Executes dropped EXE
PID:3208 -
\??\c:\xlrlllf.exec:\xlrlllf.exe39⤵
- Executes dropped EXE
PID:1880 -
\??\c:\hbnnnn.exec:\hbnnnn.exe40⤵
- Executes dropped EXE
PID:2516 -
\??\c:\jjddv.exec:\jjddv.exe41⤵
- Executes dropped EXE
PID:4000 -
\??\c:\jddjd.exec:\jddjd.exe42⤵
- Executes dropped EXE
PID:1260 -
\??\c:\lxfxlll.exec:\lxfxlll.exe43⤵
- Executes dropped EXE
PID:4972 -
\??\c:\lfxrllf.exec:\lfxrllf.exe44⤵
- Executes dropped EXE
PID:1168 -
\??\c:\lxfffff.exec:\lxfffff.exe45⤵
- Executes dropped EXE
PID:3268 -
\??\c:\1ttnhn.exec:\1ttnhn.exe46⤵
- Executes dropped EXE
PID:4396 -
\??\c:\pjdvp.exec:\pjdvp.exe47⤵
- Executes dropped EXE
PID:1344 -
\??\c:\jjppd.exec:\jjppd.exe48⤵
- Executes dropped EXE
PID:1072 -
\??\c:\rrffllf.exec:\rrffllf.exe49⤵
- Executes dropped EXE
PID:4788 -
\??\c:\xrllfff.exec:\xrllfff.exe50⤵
- Executes dropped EXE
PID:1436 -
\??\c:\btthhh.exec:\btthhh.exe51⤵
- Executes dropped EXE
PID:4448 -
\??\c:\nnhbbb.exec:\nnhbbb.exe52⤵
- Executes dropped EXE
PID:2660 -
\??\c:\dppjj.exec:\dppjj.exe53⤵
- Executes dropped EXE
PID:4232 -
\??\c:\9rfxflr.exec:\9rfxflr.exe54⤵
- Executes dropped EXE
PID:1512 -
\??\c:\xrrlfxx.exec:\xrrlfxx.exe55⤵
- Executes dropped EXE
PID:4192 -
\??\c:\5nnnhn.exec:\5nnnhn.exe56⤵
- Executes dropped EXE
PID:740 -
\??\c:\nttbnt.exec:\nttbnt.exe57⤵
- Executes dropped EXE
PID:1684 -
\??\c:\jjpjv.exec:\jjpjv.exe58⤵
- Executes dropped EXE
PID:1816 -
\??\c:\1vvvp.exec:\1vvvp.exe59⤵
- Executes dropped EXE
PID:836 -
\??\c:\1fxrffx.exec:\1fxrffx.exe60⤵
- Executes dropped EXE
PID:3808 -
\??\c:\lfrrrrl.exec:\lfrrrrl.exe61⤵
- Executes dropped EXE
PID:4332 -
\??\c:\ntbbtt.exec:\ntbbtt.exe62⤵
- Executes dropped EXE
PID:3940 -
\??\c:\httnhh.exec:\httnhh.exe63⤵
- Executes dropped EXE
PID:2424 -
\??\c:\5vdvv.exec:\5vdvv.exe64⤵
- Executes dropped EXE
PID:3356 -
\??\c:\jdddv.exec:\jdddv.exe65⤵
- Executes dropped EXE
PID:3868 -
\??\c:\rlrllfl.exec:\rlrllfl.exe66⤵PID:724
-
\??\c:\bnbbnn.exec:\bnbbnn.exe67⤵PID:4676
-
\??\c:\hbnnht.exec:\hbnnht.exe68⤵PID:4420
-
\??\c:\vjjjv.exec:\vjjjv.exe69⤵PID:4188
-
\??\c:\3xlfxll.exec:\3xlfxll.exe70⤵PID:5072
-
\??\c:\xxrlfff.exec:\xxrlfff.exe71⤵PID:3764
-
\??\c:\nnhbbn.exec:\nnhbbn.exe72⤵PID:1012
-
\??\c:\nnhbtb.exec:\nnhbtb.exe73⤵PID:3188
-
\??\c:\pjjdv.exec:\pjjdv.exe74⤵PID:4044
-
\??\c:\rrxxrxx.exec:\rrxxrxx.exe75⤵PID:3452
-
\??\c:\rlrfxrr.exec:\rlrfxrr.exe76⤵PID:2164
-
\??\c:\hbbtnn.exec:\hbbtnn.exe77⤵PID:3720
-
\??\c:\nbhtbb.exec:\nbhtbb.exe78⤵PID:1744
-
\??\c:\vvddp.exec:\vvddp.exe79⤵PID:3448
-
\??\c:\3xxrfxr.exec:\3xxrfxr.exe80⤵PID:4320
-
\??\c:\7lxrlrr.exec:\7lxrlrr.exe81⤵PID:4092
-
\??\c:\htbtnn.exec:\htbtnn.exe82⤵PID:3712
-
\??\c:\tnnhtb.exec:\tnnhtb.exe83⤵PID:3948
-
\??\c:\jpdjp.exec:\jpdjp.exe84⤵PID:4816
-
\??\c:\pvdjd.exec:\pvdjd.exe85⤵PID:800
-
\??\c:\frxrlll.exec:\frxrlll.exe86⤵PID:1768
-
\??\c:\tbhhbb.exec:\tbhhbb.exe87⤵PID:1212
-
\??\c:\httthh.exec:\httthh.exe88⤵PID:4276
-
\??\c:\jdvpj.exec:\jdvpj.exe89⤵PID:2088
-
\??\c:\vddvp.exec:\vddvp.exe90⤵PID:3200
-
\??\c:\rrrlxxr.exec:\rrrlxxr.exe91⤵PID:2704
-
\??\c:\xrlfxrr.exec:\xrlfxrr.exe92⤵PID:4664
-
\??\c:\bntttb.exec:\bntttb.exe93⤵PID:3148
-
\??\c:\nhnbtt.exec:\nhnbtt.exe94⤵PID:3944
-
\??\c:\ppjjd.exec:\ppjjd.exe95⤵PID:4068
-
\??\c:\xxffrrf.exec:\xxffrrf.exe96⤵PID:3652
-
\??\c:\fxfrxrx.exec:\fxfrxrx.exe97⤵PID:3224
-
\??\c:\tbnhbb.exec:\tbnhbb.exe98⤵PID:2964
-
\??\c:\7bbthh.exec:\7bbthh.exe99⤵PID:312
-
\??\c:\dvpjd.exec:\dvpjd.exe100⤵PID:1384
-
\??\c:\jdppd.exec:\jdppd.exe101⤵PID:4668
-
\??\c:\rxxrrll.exec:\rxxrrll.exe102⤵PID:1588
-
\??\c:\hhnhnh.exec:\hhnhnh.exe103⤵PID:2392
-
\??\c:\nnnhbn.exec:\nnnhbn.exe104⤵PID:464
-
\??\c:\jdddd.exec:\jdddd.exe105⤵PID:3532
-
\??\c:\dppjv.exec:\dppjv.exe106⤵PID:4416
-
\??\c:\lxxrrll.exec:\lxxrrll.exe107⤵PID:5092
-
\??\c:\9nnnhh.exec:\9nnnhh.exe108⤵PID:1164
-
\??\c:\3htnnt.exec:\3htnnt.exe109⤵PID:3904
-
\??\c:\ppvvv.exec:\ppvvv.exe110⤵PID:4976
-
\??\c:\pdddv.exec:\pdddv.exe111⤵PID:4048
-
\??\c:\xrrlrrx.exec:\xrrlrrx.exe112⤵PID:2020
-
\??\c:\btttbt.exec:\btttbt.exe113⤵PID:1444
-
\??\c:\btbbtt.exec:\btbbtt.exe114⤵PID:4200
-
\??\c:\vpdvj.exec:\vpdvj.exe115⤵PID:1600
-
\??\c:\vjpjv.exec:\vjpjv.exe116⤵PID:2196
-
\??\c:\xrrlxxr.exec:\xrrlxxr.exe117⤵PID:512
-
\??\c:\nhhtnh.exec:\nhhtnh.exe118⤵PID:1648
-
\??\c:\jvjpj.exec:\jvjpj.exe119⤵PID:4636
-
\??\c:\dvvpj.exec:\dvvpj.exe120⤵PID:624
-
\??\c:\frfxxff.exec:\frfxxff.exe121⤵PID:5008
-
\??\c:\fxxfllx.exec:\fxxfllx.exe122⤵PID:4120
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-