Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/06/2024, 19:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a84001b3e407d21fa9334ecf2c360e41cadf0dfb9fca96c913b11703c467e9ed_NeikiAnalytics.exe
Resource
win7-20240611-en
5 signatures
150 seconds
General
-
Target
a84001b3e407d21fa9334ecf2c360e41cadf0dfb9fca96c913b11703c467e9ed_NeikiAnalytics.exe
-
Size
78KB
-
MD5
44fdb01ba49c8e6d31607de64921fae0
-
SHA1
c704f0a93f20e11bf368b4ebf370c3f59cebf2ff
-
SHA256
a84001b3e407d21fa9334ecf2c360e41cadf0dfb9fca96c913b11703c467e9ed
-
SHA512
67e0e17ed3a09ffef69a52e3b7fe588a723c4d80a3c62337ef5f411124ca43dede52b393bed1ecc407bd1446873a718cd9a988f8457a6f6110ef6e827486a01d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA8v:ymb3NkkiQ3mdBjFIIp9L9QrrA8v
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/4848-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/996-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3948-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4392-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3396-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1100-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4288-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4288-50-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1232-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/548-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4864-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/808-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2720-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2104-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2680-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4184-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1348-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2464-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4840-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3272-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1016-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3920-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1464-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/400-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 996 thhbnh.exe 3948 vdjjp.exe 4392 jjjvd.exe 3396 fxlflfx.exe 1100 btnhbt.exe 4288 btnhtt.exe 180 3pdvp.exe 1232 rlfxlfx.exe 548 lflflff.exe 4864 bnhtnh.exe 808 bhhthn.exe 3340 vpvpj.exe 4020 rllxlff.exe 2720 lfrllff.exe 2104 3jdvj.exe 4988 fflfrlf.exe 2680 1bhbbt.exe 4184 jdvjd.exe 1348 jpvpj.exe 4904 lxxrfxr.exe 2348 tntnnn.exe 2464 vvppj.exe 4840 bhttnh.exe 3272 1tnhnh.exe 1016 vpjdp.exe 1724 rlxrffx.exe 3920 9xrlxxr.exe 3752 hthbnh.exe 1464 bnnntt.exe 400 1lxrffr.exe 4960 hththt.exe 684 3nbhtt.exe 2988 ddvpd.exe 5064 9vpdp.exe 2984 1rrfrrl.exe 3656 hbhbbt.exe 5104 5tnhnn.exe 3144 dvpjd.exe 1584 dppvp.exe 4412 flrrffx.exe 2540 1xrlffr.exe 3296 9tnbnh.exe 2308 3tttnh.exe 724 jvvjv.exe 4824 pjpjd.exe 4264 jpjvj.exe 3704 xrxlfxx.exe 4848 rflfxrl.exe 2372 bnnhbt.exe 2248 3jjpp.exe 3032 9rlrfxl.exe 2712 tnnbtn.exe 528 bbtnnn.exe 2004 tnttnh.exe 4820 7vvpj.exe 3456 lxlfrfr.exe 3932 bntnbt.exe 3552 3dddv.exe 4888 9ddpd.exe 2268 rrrlfxr.exe 4600 1xrlxxl.exe 2696 hbbtnn.exe 4944 htnbnb.exe 3116 vdjvj.exe -
resource yara_rule behavioral2/memory/4848-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/996-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3948-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4392-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3396-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1100-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4288-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1232-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/548-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/808-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2720-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2680-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4184-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1348-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2464-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4840-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1464-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-196-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4848 wrote to memory of 996 4848 a84001b3e407d21fa9334ecf2c360e41cadf0dfb9fca96c913b11703c467e9ed_NeikiAnalytics.exe 82 PID 4848 wrote to memory of 996 4848 a84001b3e407d21fa9334ecf2c360e41cadf0dfb9fca96c913b11703c467e9ed_NeikiAnalytics.exe 82 PID 4848 wrote to memory of 996 4848 a84001b3e407d21fa9334ecf2c360e41cadf0dfb9fca96c913b11703c467e9ed_NeikiAnalytics.exe 82 PID 996 wrote to memory of 3948 996 thhbnh.exe 83 PID 996 wrote to memory of 3948 996 thhbnh.exe 83 PID 996 wrote to memory of 3948 996 thhbnh.exe 83 PID 3948 wrote to memory of 4392 3948 vdjjp.exe 84 PID 3948 wrote to memory of 4392 3948 vdjjp.exe 84 PID 3948 wrote to memory of 4392 3948 vdjjp.exe 84 PID 4392 wrote to memory of 3396 4392 jjjvd.exe 85 PID 4392 wrote to memory of 3396 4392 jjjvd.exe 85 PID 4392 wrote to memory of 3396 4392 jjjvd.exe 85 PID 3396 wrote to memory of 1100 3396 fxlflfx.exe 86 PID 3396 wrote to memory of 1100 3396 fxlflfx.exe 86 PID 3396 wrote to memory of 1100 3396 fxlflfx.exe 86 PID 1100 wrote to memory of 4288 1100 btnhbt.exe 87 PID 1100 wrote to memory of 4288 1100 btnhbt.exe 87 PID 1100 wrote to memory of 4288 1100 btnhbt.exe 87 PID 4288 wrote to memory of 180 4288 btnhtt.exe 88 PID 4288 wrote to memory of 180 4288 btnhtt.exe 88 PID 4288 wrote to memory of 180 4288 btnhtt.exe 88 PID 180 wrote to memory of 1232 180 3pdvp.exe 89 PID 180 wrote to memory of 1232 180 3pdvp.exe 89 PID 180 wrote to memory of 1232 180 3pdvp.exe 89 PID 1232 wrote to memory of 548 1232 rlfxlfx.exe 90 PID 1232 wrote to memory of 548 1232 rlfxlfx.exe 90 PID 1232 wrote to memory of 548 1232 rlfxlfx.exe 90 PID 548 wrote to memory of 4864 548 lflflff.exe 91 PID 548 wrote to memory of 4864 548 lflflff.exe 91 PID 548 wrote to memory of 4864 548 lflflff.exe 91 PID 4864 wrote to memory of 808 4864 bnhtnh.exe 92 PID 4864 wrote to memory of 808 4864 bnhtnh.exe 92 PID 4864 wrote to memory of 808 4864 bnhtnh.exe 92 PID 808 wrote to memory of 3340 808 bhhthn.exe 93 PID 808 wrote to memory of 3340 808 bhhthn.exe 93 PID 808 wrote to memory of 3340 808 bhhthn.exe 93 PID 3340 wrote to memory of 4020 3340 vpvpj.exe 94 PID 3340 wrote to memory of 4020 3340 vpvpj.exe 94 PID 3340 wrote to memory of 4020 3340 vpvpj.exe 94 PID 4020 wrote to memory of 2720 4020 rllxlff.exe 95 PID 4020 wrote to memory of 2720 4020 rllxlff.exe 95 PID 4020 wrote to memory of 2720 4020 rllxlff.exe 95 PID 2720 wrote to memory of 2104 2720 lfrllff.exe 96 PID 2720 wrote to memory of 2104 2720 lfrllff.exe 96 PID 2720 wrote to memory of 2104 2720 lfrllff.exe 96 PID 2104 wrote to memory of 4988 2104 3jdvj.exe 97 PID 2104 wrote to memory of 4988 2104 3jdvj.exe 97 PID 2104 wrote to memory of 4988 2104 3jdvj.exe 97 PID 4988 wrote to memory of 2680 4988 fflfrlf.exe 98 PID 4988 wrote to memory of 2680 4988 fflfrlf.exe 98 PID 4988 wrote to memory of 2680 4988 fflfrlf.exe 98 PID 2680 wrote to memory of 4184 2680 1bhbbt.exe 99 PID 2680 wrote to memory of 4184 2680 1bhbbt.exe 99 PID 2680 wrote to memory of 4184 2680 1bhbbt.exe 99 PID 4184 wrote to memory of 1348 4184 jdvjd.exe 100 PID 4184 wrote to memory of 1348 4184 jdvjd.exe 100 PID 4184 wrote to memory of 1348 4184 jdvjd.exe 100 PID 1348 wrote to memory of 4904 1348 jpvpj.exe 101 PID 1348 wrote to memory of 4904 1348 jpvpj.exe 101 PID 1348 wrote to memory of 4904 1348 jpvpj.exe 101 PID 4904 wrote to memory of 2348 4904 lxxrfxr.exe 102 PID 4904 wrote to memory of 2348 4904 lxxrfxr.exe 102 PID 4904 wrote to memory of 2348 4904 lxxrfxr.exe 102 PID 2348 wrote to memory of 2464 2348 tntnnn.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\a84001b3e407d21fa9334ecf2c360e41cadf0dfb9fca96c913b11703c467e9ed_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a84001b3e407d21fa9334ecf2c360e41cadf0dfb9fca96c913b11703c467e9ed_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\thhbnh.exec:\thhbnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\vdjjp.exec:\vdjjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\jjjvd.exec:\jjjvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
\??\c:\fxlflfx.exec:\fxlflfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
\??\c:\btnhbt.exec:\btnhbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\btnhtt.exec:\btnhtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
\??\c:\3pdvp.exec:\3pdvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:180 -
\??\c:\rlfxlfx.exec:\rlfxlfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\lflflff.exec:\lflflff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\bnhtnh.exec:\bnhtnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\bhhthn.exec:\bhhthn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\vpvpj.exec:\vpvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
\??\c:\rllxlff.exec:\rllxlff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\lfrllff.exec:\lfrllff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\3jdvj.exec:\3jdvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\fflfrlf.exec:\fflfrlf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\1bhbbt.exec:\1bhbbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\jdvjd.exec:\jdvjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\jpvpj.exec:\jpvpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\lxxrfxr.exec:\lxxrfxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\tntnnn.exec:\tntnnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\vvppj.exec:\vvppj.exe23⤵
- Executes dropped EXE
PID:2464 -
\??\c:\bhttnh.exec:\bhttnh.exe24⤵
- Executes dropped EXE
PID:4840 -
\??\c:\1tnhnh.exec:\1tnhnh.exe25⤵
- Executes dropped EXE
PID:3272 -
\??\c:\vpjdp.exec:\vpjdp.exe26⤵
- Executes dropped EXE
PID:1016 -
\??\c:\rlxrffx.exec:\rlxrffx.exe27⤵
- Executes dropped EXE
PID:1724 -
\??\c:\9xrlxxr.exec:\9xrlxxr.exe28⤵
- Executes dropped EXE
PID:3920 -
\??\c:\hthbnh.exec:\hthbnh.exe29⤵
- Executes dropped EXE
PID:3752 -
\??\c:\bnnntt.exec:\bnnntt.exe30⤵
- Executes dropped EXE
PID:1464 -
\??\c:\1lxrffr.exec:\1lxrffr.exe31⤵
- Executes dropped EXE
PID:400 -
\??\c:\hththt.exec:\hththt.exe32⤵
- Executes dropped EXE
PID:4960 -
\??\c:\3nbhtt.exec:\3nbhtt.exe33⤵
- Executes dropped EXE
PID:684 -
\??\c:\ddvpd.exec:\ddvpd.exe34⤵
- Executes dropped EXE
PID:2988 -
\??\c:\9vpdp.exec:\9vpdp.exe35⤵
- Executes dropped EXE
PID:5064 -
\??\c:\1rrfrrl.exec:\1rrfrrl.exe36⤵
- Executes dropped EXE
PID:2984 -
\??\c:\hbhbbt.exec:\hbhbbt.exe37⤵
- Executes dropped EXE
PID:3656 -
\??\c:\5tnhnn.exec:\5tnhnn.exe38⤵
- Executes dropped EXE
PID:5104 -
\??\c:\dvpjd.exec:\dvpjd.exe39⤵
- Executes dropped EXE
PID:3144 -
\??\c:\dppvp.exec:\dppvp.exe40⤵
- Executes dropped EXE
PID:1584 -
\??\c:\flrrffx.exec:\flrrffx.exe41⤵
- Executes dropped EXE
PID:4412 -
\??\c:\1xrlffr.exec:\1xrlffr.exe42⤵
- Executes dropped EXE
PID:2540 -
\??\c:\9tnbnh.exec:\9tnbnh.exe43⤵
- Executes dropped EXE
PID:3296 -
\??\c:\3tttnh.exec:\3tttnh.exe44⤵
- Executes dropped EXE
PID:2308 -
\??\c:\jvvjv.exec:\jvvjv.exe45⤵
- Executes dropped EXE
PID:724 -
\??\c:\pjpjd.exec:\pjpjd.exe46⤵
- Executes dropped EXE
PID:4824 -
\??\c:\jpjvj.exec:\jpjvj.exe47⤵
- Executes dropped EXE
PID:4264 -
\??\c:\xrxlfxx.exec:\xrxlfxx.exe48⤵
- Executes dropped EXE
PID:3704 -
\??\c:\rflfxrl.exec:\rflfxrl.exe49⤵
- Executes dropped EXE
PID:4848 -
\??\c:\bnnhbt.exec:\bnnhbt.exe50⤵
- Executes dropped EXE
PID:2372 -
\??\c:\3jjpp.exec:\3jjpp.exe51⤵
- Executes dropped EXE
PID:2248 -
\??\c:\9rlrfxl.exec:\9rlrfxl.exe52⤵
- Executes dropped EXE
PID:3032 -
\??\c:\tnnbtn.exec:\tnnbtn.exe53⤵
- Executes dropped EXE
PID:2712 -
\??\c:\bbtnnn.exec:\bbtnnn.exe54⤵
- Executes dropped EXE
PID:528 -
\??\c:\tnttnh.exec:\tnttnh.exe55⤵
- Executes dropped EXE
PID:2004 -
\??\c:\7vvpj.exec:\7vvpj.exe56⤵
- Executes dropped EXE
PID:4820 -
\??\c:\lxlfrfr.exec:\lxlfrfr.exe57⤵
- Executes dropped EXE
PID:3456 -
\??\c:\bntnbt.exec:\bntnbt.exe58⤵
- Executes dropped EXE
PID:3932 -
\??\c:\3dddv.exec:\3dddv.exe59⤵
- Executes dropped EXE
PID:3552 -
\??\c:\9ddpd.exec:\9ddpd.exe60⤵
- Executes dropped EXE
PID:4888 -
\??\c:\rrrlfxr.exec:\rrrlfxr.exe61⤵
- Executes dropped EXE
PID:2268 -
\??\c:\1xrlxxl.exec:\1xrlxxl.exe62⤵
- Executes dropped EXE
PID:4600 -
\??\c:\hbbtnn.exec:\hbbtnn.exe63⤵
- Executes dropped EXE
PID:2696 -
\??\c:\htnbnb.exec:\htnbnb.exe64⤵
- Executes dropped EXE
PID:4944 -
\??\c:\vdjvj.exec:\vdjvj.exe65⤵
- Executes dropped EXE
PID:3116 -
\??\c:\dpvjv.exec:\dpvjv.exe66⤵PID:2596
-
\??\c:\rflfxxx.exec:\rflfxxx.exe67⤵PID:4364
-
\??\c:\bthbnh.exec:\bthbnh.exe68⤵PID:2168
-
\??\c:\hhtnbt.exec:\hhtnbt.exe69⤵PID:3580
-
\??\c:\5bnhhb.exec:\5bnhhb.exe70⤵PID:4492
-
\??\c:\vpdpv.exec:\vpdpv.exe71⤵PID:2680
-
\??\c:\9pjvj.exec:\9pjvj.exe72⤵PID:5068
-
\??\c:\xllxlxr.exec:\xllxlxr.exe73⤵PID:4896
-
\??\c:\3hbtbb.exec:\3hbtbb.exe74⤵PID:1800
-
\??\c:\3ntnbt.exec:\3ntnbt.exe75⤵PID:4556
-
\??\c:\pvvpj.exec:\pvvpj.exe76⤵PID:3172
-
\??\c:\pddvj.exec:\pddvj.exe77⤵PID:5084
-
\??\c:\djjvj.exec:\djjvj.exe78⤵PID:1028
-
\??\c:\1ffrllr.exec:\1ffrllr.exe79⤵PID:2108
-
\??\c:\9hhhbb.exec:\9hhhbb.exe80⤵PID:5072
-
\??\c:\3pjpp.exec:\3pjpp.exe81⤵PID:1432
-
\??\c:\xrxlfxx.exec:\xrxlfxx.exe82⤵PID:1112
-
\??\c:\lffxlfx.exec:\lffxlfx.exe83⤵PID:1724
-
\??\c:\nbhtnt.exec:\nbhtnt.exe84⤵PID:4844
-
\??\c:\bnnhnt.exec:\bnnhnt.exe85⤵PID:3752
-
\??\c:\jjvvp.exec:\jjvvp.exe86⤵PID:3064
-
\??\c:\lxrflrl.exec:\lxrflrl.exe87⤵PID:4948
-
\??\c:\fllrlfx.exec:\fllrlfx.exe88⤵PID:400
-
\??\c:\nhbnbt.exec:\nhbnbt.exe89⤵PID:2820
-
\??\c:\nbhtht.exec:\nbhtht.exe90⤵PID:444
-
\??\c:\vpvpj.exec:\vpvpj.exe91⤵PID:2176
-
\??\c:\5ddpv.exec:\5ddpv.exe92⤵PID:3824
-
\??\c:\fxlxllx.exec:\fxlxllx.exe93⤵PID:3052
-
\??\c:\9nnhtn.exec:\9nnhtn.exe94⤵PID:3620
-
\??\c:\hbbthh.exec:\hbbthh.exe95⤵PID:4476
-
\??\c:\vvvpj.exec:\vvvpj.exe96⤵PID:5112
-
\??\c:\5vjdp.exec:\5vjdp.exe97⤵PID:4616
-
\??\c:\lrlfxxr.exec:\lrlfxxr.exe98⤵PID:212
-
\??\c:\7flxrlx.exec:\7flxrlx.exe99⤵PID:2480
-
\??\c:\tntbhb.exec:\tntbhb.exe100⤵PID:4800
-
\??\c:\tnnbnh.exec:\tnnbnh.exe101⤵PID:4540
-
\??\c:\vdvpv.exec:\vdvpv.exe102⤵PID:772
-
\??\c:\lxfrfxl.exec:\lxfrfxl.exe103⤵PID:2576
-
\??\c:\rrrrllf.exec:\rrrrllf.exe104⤵PID:4824
-
\??\c:\9hbnhb.exec:\9hbnhb.exe105⤵PID:4264
-
\??\c:\9nbthh.exec:\9nbthh.exe106⤵PID:3704
-
\??\c:\7jdvj.exec:\7jdvj.exe107⤵PID:3668
-
\??\c:\jdpdd.exec:\jdpdd.exe108⤵PID:3508
-
\??\c:\5xrfrlf.exec:\5xrfrlf.exe109⤵PID:2676
-
\??\c:\llrlxrx.exec:\llrlxrx.exe110⤵PID:3396
-
\??\c:\nhtnhn.exec:\nhtnhn.exe111⤵PID:4488
-
\??\c:\jvvvp.exec:\jvvvp.exe112⤵PID:528
-
\??\c:\dddvp.exec:\dddvp.exe113⤵PID:668
-
\??\c:\lxlxlfr.exec:\lxlxlfr.exe114⤵PID:4752
-
\??\c:\tnthnh.exec:\tnthnh.exe115⤵PID:3456
-
\??\c:\1bbtht.exec:\1bbtht.exe116⤵PID:4772
-
\??\c:\5dvvj.exec:\5dvvj.exe117⤵PID:4868
-
\??\c:\ppdvp.exec:\ppdvp.exe118⤵PID:1556
-
\??\c:\lrrlxxl.exec:\lrrlxxl.exe119⤵PID:3356
-
\??\c:\3btthb.exec:\3btthb.exe120⤵PID:1140
-
\??\c:\bttthb.exec:\bttthb.exe121⤵PID:4940
-
\??\c:\dvddp.exec:\dvddp.exe122⤵PID:2000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-