Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11-05-2024 02:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5d8b9f4e41f1eefbdf74ef83370355b0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
5d8b9f4e41f1eefbdf74ef83370355b0_NeikiAnalytics.exe
-
Size
94KB
-
MD5
5d8b9f4e41f1eefbdf74ef83370355b0
-
SHA1
635c45918590920d3b177dd7d2c3b565d3acd0c1
-
SHA256
095f88ef96f2cbf101a30fb3cdd48975ef0828377e9e9d719d85858a4de46049
-
SHA512
ec2da0116c1e1a55f9a90aa2ab3af780c774f9786d1f654ef101c65a96c34374f3c7867f0c4c7df45e3d65d033d24afb187ea7f78143d7ed06934341f797f0d6
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDInWeNCYGyA2R7JxJAg8dtZ:ymb3NkkiQ3mdBjFIWeFGyAsJAg2Z
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/472-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2024-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/324-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3608-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2680-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2116-27-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2116-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4172-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1856-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4868-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4868-63-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2876-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1408-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3656-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3176-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3556-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1804-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2040-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4152-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4556-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4200-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/616-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3932-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4092-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2100-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3068-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1244-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2024 rlxxrll.exe 324 1tbbtt.exe 2116 hbhbbb.exe 2680 7vdvp.exe 3608 pjddp.exe 4172 bhtnhh.exe 1856 vdddp.exe 4868 jvvvp.exe 2876 fflfxxf.exe 1408 btbbhh.exe 3656 vpddp.exe 5064 jpvvd.exe 3464 1lxrffr.exe 3176 htbtnn.exe 3556 vdvpj.exe 1804 xlrrfff.exe 2040 xxxrrrf.exe 4152 nhhbtn.exe 4556 jdvpp.exe 444 xrrlffx.exe 4200 tbhnnn.exe 616 1vpvp.exe 3932 5jddp.exe 4092 rxlfffl.exe 4708 btnhbn.exe 2100 3ddpj.exe 2648 1rffrff.exe 4508 ttttbb.exe 3068 hhhbtt.exe 1244 fxlfffl.exe 5008 hnthbt.exe 3356 vpvjd.exe 4704 3nbtnn.exe 1796 3tbttt.exe 896 pdpjd.exe 1496 xrxxffl.exe 4552 rxxrllf.exe 2212 nnhbtt.exe 4048 nbtthb.exe 472 jddvp.exe 4560 dddvp.exe 228 lrrlxxx.exe 232 lffxrrr.exe 3988 nhbtnn.exe 2680 ddvjd.exe 4588 vdjdv.exe 3572 lllxrrx.exe 4792 llrrrrl.exe 2520 nnbbth.exe 3284 ntnhhh.exe 1912 3bbbnn.exe 1568 vpjdv.exe 2172 vdjdd.exe 1936 7xlfrrl.exe 5048 xxrrllf.exe 3528 tnnhbb.exe 1752 thhhtn.exe 4472 xffffff.exe 3376 frfxrxr.exe 4940 nttnhh.exe 4828 7ttnnn.exe 1500 vvdvd.exe 2040 llxrrrl.exe 1148 xrxrlrl.exe -
resource yara_rule behavioral2/memory/472-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2024-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/324-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3608-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2680-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4172-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1856-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4868-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2876-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1408-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3176-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3556-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1804-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4152-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4200-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/616-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3932-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4092-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2100-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3068-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1244-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 472 wrote to memory of 2024 472 5d8b9f4e41f1eefbdf74ef83370355b0_NeikiAnalytics.exe 82 PID 472 wrote to memory of 2024 472 5d8b9f4e41f1eefbdf74ef83370355b0_NeikiAnalytics.exe 82 PID 472 wrote to memory of 2024 472 5d8b9f4e41f1eefbdf74ef83370355b0_NeikiAnalytics.exe 82 PID 2024 wrote to memory of 324 2024 rlxxrll.exe 83 PID 2024 wrote to memory of 324 2024 rlxxrll.exe 83 PID 2024 wrote to memory of 324 2024 rlxxrll.exe 83 PID 324 wrote to memory of 2116 324 1tbbtt.exe 84 PID 324 wrote to memory of 2116 324 1tbbtt.exe 84 PID 324 wrote to memory of 2116 324 1tbbtt.exe 84 PID 2116 wrote to memory of 2680 2116 hbhbbb.exe 85 PID 2116 wrote to memory of 2680 2116 hbhbbb.exe 85 PID 2116 wrote to memory of 2680 2116 hbhbbb.exe 85 PID 2680 wrote to memory of 3608 2680 7vdvp.exe 86 PID 2680 wrote to memory of 3608 2680 7vdvp.exe 86 PID 2680 wrote to memory of 3608 2680 7vdvp.exe 86 PID 3608 wrote to memory of 4172 3608 pjddp.exe 89 PID 3608 wrote to memory of 4172 3608 pjddp.exe 89 PID 3608 wrote to memory of 4172 3608 pjddp.exe 89 PID 4172 wrote to memory of 1856 4172 bhtnhh.exe 90 PID 4172 wrote to memory of 1856 4172 bhtnhh.exe 90 PID 4172 wrote to memory of 1856 4172 bhtnhh.exe 90 PID 1856 wrote to memory of 4868 1856 vdddp.exe 91 PID 1856 wrote to memory of 4868 1856 vdddp.exe 91 PID 1856 wrote to memory of 4868 1856 vdddp.exe 91 PID 4868 wrote to memory of 2876 4868 jvvvp.exe 92 PID 4868 wrote to memory of 2876 4868 jvvvp.exe 92 PID 4868 wrote to memory of 2876 4868 jvvvp.exe 92 PID 2876 wrote to memory of 1408 2876 fflfxxf.exe 93 PID 2876 wrote to memory of 1408 2876 fflfxxf.exe 93 PID 2876 wrote to memory of 1408 2876 fflfxxf.exe 93 PID 1408 wrote to memory of 3656 1408 btbbhh.exe 94 PID 1408 wrote to memory of 3656 1408 btbbhh.exe 94 PID 1408 wrote to memory of 3656 1408 btbbhh.exe 94 PID 3656 wrote to memory of 5064 3656 vpddp.exe 96 PID 3656 wrote to memory of 5064 3656 vpddp.exe 96 PID 3656 wrote to memory of 5064 3656 vpddp.exe 96 PID 5064 wrote to memory of 3464 5064 jpvvd.exe 97 PID 5064 wrote to memory of 3464 5064 jpvvd.exe 97 PID 5064 wrote to memory of 3464 5064 jpvvd.exe 97 PID 3464 wrote to memory of 3176 3464 1lxrffr.exe 98 PID 3464 wrote to memory of 3176 3464 1lxrffr.exe 98 PID 3464 wrote to memory of 3176 3464 1lxrffr.exe 98 PID 3176 wrote to memory of 3556 3176 htbtnn.exe 99 PID 3176 wrote to memory of 3556 3176 htbtnn.exe 99 PID 3176 wrote to memory of 3556 3176 htbtnn.exe 99 PID 3556 wrote to memory of 1804 3556 vdvpj.exe 100 PID 3556 wrote to memory of 1804 3556 vdvpj.exe 100 PID 3556 wrote to memory of 1804 3556 vdvpj.exe 100 PID 1804 wrote to memory of 2040 1804 xlrrfff.exe 101 PID 1804 wrote to memory of 2040 1804 xlrrfff.exe 101 PID 1804 wrote to memory of 2040 1804 xlrrfff.exe 101 PID 2040 wrote to memory of 4152 2040 xxxrrrf.exe 102 PID 2040 wrote to memory of 4152 2040 xxxrrrf.exe 102 PID 2040 wrote to memory of 4152 2040 xxxrrrf.exe 102 PID 4152 wrote to memory of 4556 4152 nhhbtn.exe 103 PID 4152 wrote to memory of 4556 4152 nhhbtn.exe 103 PID 4152 wrote to memory of 4556 4152 nhhbtn.exe 103 PID 4556 wrote to memory of 444 4556 jdvpp.exe 104 PID 4556 wrote to memory of 444 4556 jdvpp.exe 104 PID 4556 wrote to memory of 444 4556 jdvpp.exe 104 PID 444 wrote to memory of 4200 444 xrrlffx.exe 105 PID 444 wrote to memory of 4200 444 xrrlffx.exe 105 PID 444 wrote to memory of 4200 444 xrrlffx.exe 105 PID 4200 wrote to memory of 616 4200 tbhnnn.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d8b9f4e41f1eefbdf74ef83370355b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5d8b9f4e41f1eefbdf74ef83370355b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:472 -
\??\c:\rlxxrll.exec:\rlxxrll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\1tbbtt.exec:\1tbbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:324 -
\??\c:\hbhbbb.exec:\hbhbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\7vdvp.exec:\7vdvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\pjddp.exec:\pjddp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\bhtnhh.exec:\bhtnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\vdddp.exec:\vdddp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\jvvvp.exec:\jvvvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\fflfxxf.exec:\fflfxxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\btbbhh.exec:\btbbhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\vpddp.exec:\vpddp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\jpvvd.exec:\jpvvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\1lxrffr.exec:\1lxrffr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
\??\c:\htbtnn.exec:\htbtnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\vdvpj.exec:\vdvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\xlrrfff.exec:\xlrrfff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\xxxrrrf.exec:\xxxrrrf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\nhhbtn.exec:\nhhbtn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\jdvpp.exec:\jdvpp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\xrrlffx.exec:\xrrlffx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
\??\c:\tbhnnn.exec:\tbhnnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
\??\c:\1vpvp.exec:\1vpvp.exe23⤵
- Executes dropped EXE
PID:616 -
\??\c:\5jddp.exec:\5jddp.exe24⤵
- Executes dropped EXE
PID:3932 -
\??\c:\rxlfffl.exec:\rxlfffl.exe25⤵
- Executes dropped EXE
PID:4092 -
\??\c:\btnhbn.exec:\btnhbn.exe26⤵
- Executes dropped EXE
PID:4708 -
\??\c:\3ddpj.exec:\3ddpj.exe27⤵
- Executes dropped EXE
PID:2100 -
\??\c:\1rffrff.exec:\1rffrff.exe28⤵
- Executes dropped EXE
PID:2648 -
\??\c:\ttttbb.exec:\ttttbb.exe29⤵
- Executes dropped EXE
PID:4508 -
\??\c:\hhhbtt.exec:\hhhbtt.exe30⤵
- Executes dropped EXE
PID:3068 -
\??\c:\fxlfffl.exec:\fxlfffl.exe31⤵
- Executes dropped EXE
PID:1244 -
\??\c:\hnthbt.exec:\hnthbt.exe32⤵
- Executes dropped EXE
PID:5008 -
\??\c:\vpvjd.exec:\vpvjd.exe33⤵
- Executes dropped EXE
PID:3356 -
\??\c:\3nbtnn.exec:\3nbtnn.exe34⤵
- Executes dropped EXE
PID:4704 -
\??\c:\3tbttt.exec:\3tbttt.exe35⤵
- Executes dropped EXE
PID:1796 -
\??\c:\pdpjd.exec:\pdpjd.exe36⤵
- Executes dropped EXE
PID:896 -
\??\c:\xrxxffl.exec:\xrxxffl.exe37⤵
- Executes dropped EXE
PID:1496 -
\??\c:\rxxrllf.exec:\rxxrllf.exe38⤵
- Executes dropped EXE
PID:4552 -
\??\c:\nnhbtt.exec:\nnhbtt.exe39⤵
- Executes dropped EXE
PID:2212 -
\??\c:\nbtthb.exec:\nbtthb.exe40⤵
- Executes dropped EXE
PID:4048 -
\??\c:\jddvp.exec:\jddvp.exe41⤵
- Executes dropped EXE
PID:472 -
\??\c:\dddvp.exec:\dddvp.exe42⤵
- Executes dropped EXE
PID:4560 -
\??\c:\lrrlxxx.exec:\lrrlxxx.exe43⤵
- Executes dropped EXE
PID:228 -
\??\c:\lffxrrr.exec:\lffxrrr.exe44⤵
- Executes dropped EXE
PID:232 -
\??\c:\nhbtnn.exec:\nhbtnn.exe45⤵
- Executes dropped EXE
PID:3988 -
\??\c:\ddvjd.exec:\ddvjd.exe46⤵
- Executes dropped EXE
PID:2680 -
\??\c:\vdjdv.exec:\vdjdv.exe47⤵
- Executes dropped EXE
PID:4588 -
\??\c:\lllxrrx.exec:\lllxrrx.exe48⤵
- Executes dropped EXE
PID:3572 -
\??\c:\llrrrrl.exec:\llrrrrl.exe49⤵
- Executes dropped EXE
PID:4792 -
\??\c:\nnbbth.exec:\nnbbth.exe50⤵
- Executes dropped EXE
PID:2520 -
\??\c:\ntnhhh.exec:\ntnhhh.exe51⤵
- Executes dropped EXE
PID:3284 -
\??\c:\3bbbnn.exec:\3bbbnn.exe52⤵
- Executes dropped EXE
PID:1912 -
\??\c:\vpjdv.exec:\vpjdv.exe53⤵
- Executes dropped EXE
PID:1568 -
\??\c:\vdjdd.exec:\vdjdd.exe54⤵
- Executes dropped EXE
PID:2172 -
\??\c:\7xlfrrl.exec:\7xlfrrl.exe55⤵
- Executes dropped EXE
PID:1936 -
\??\c:\xxrrllf.exec:\xxrrllf.exe56⤵
- Executes dropped EXE
PID:5048 -
\??\c:\tnnhbb.exec:\tnnhbb.exe57⤵
- Executes dropped EXE
PID:3528 -
\??\c:\thhhtn.exec:\thhhtn.exe58⤵
- Executes dropped EXE
PID:1752 -
\??\c:\xffffff.exec:\xffffff.exe59⤵
- Executes dropped EXE
PID:4472 -
\??\c:\frfxrxr.exec:\frfxrxr.exe60⤵
- Executes dropped EXE
PID:3376 -
\??\c:\nttnhh.exec:\nttnhh.exe61⤵
- Executes dropped EXE
PID:4940 -
\??\c:\7ttnnn.exec:\7ttnnn.exe62⤵
- Executes dropped EXE
PID:4828 -
\??\c:\vvdvd.exec:\vvdvd.exe63⤵
- Executes dropped EXE
PID:1500 -
\??\c:\llxrrrl.exec:\llxrrrl.exe64⤵
- Executes dropped EXE
PID:2040 -
\??\c:\xrxrlrl.exec:\xrxrlrl.exe65⤵
- Executes dropped EXE
PID:1148 -
\??\c:\hbhbhh.exec:\hbhbhh.exe66⤵PID:1508
-
\??\c:\5jpjp.exec:\5jpjp.exe67⤵PID:1436
-
\??\c:\dpdvp.exec:\dpdvp.exe68⤵PID:2576
-
\??\c:\xrfxxxl.exec:\xrfxxxl.exe69⤵PID:2708
-
\??\c:\xrffxrx.exec:\xrffxrx.exe70⤵PID:2328
-
\??\c:\nnhhhh.exec:\nnhhhh.exe71⤵PID:4124
-
\??\c:\bhhbnn.exec:\bhhbnn.exe72⤵PID:3824
-
\??\c:\nbhnhh.exec:\nbhnhh.exe73⤵PID:2892
-
\??\c:\vpddd.exec:\vpddd.exe74⤵PID:1124
-
\??\c:\fxlflrl.exec:\fxlflrl.exe75⤵PID:4164
-
\??\c:\nbhbtt.exec:\nbhbtt.exe76⤵PID:2936
-
\??\c:\nhhnhh.exec:\nhhnhh.exe77⤵PID:2960
-
\??\c:\ddvvp.exec:\ddvvp.exe78⤵PID:2744
-
\??\c:\9lxxffr.exec:\9lxxffr.exe79⤵PID:3204
-
\??\c:\7lfxxfx.exec:\7lfxxfx.exe80⤵PID:636
-
\??\c:\nhbbtn.exec:\nhbbtn.exe81⤵PID:3640
-
\??\c:\vddvp.exec:\vddvp.exe82⤵PID:3980
-
\??\c:\vpddd.exec:\vpddd.exe83⤵PID:3296
-
\??\c:\lffxrxx.exec:\lffxrxx.exe84⤵PID:804
-
\??\c:\rrllffx.exec:\rrllffx.exe85⤵PID:4184
-
\??\c:\nnttnn.exec:\nnttnn.exe86⤵PID:8
-
\??\c:\ttnhtt.exec:\ttnhtt.exe87⤵PID:1120
-
\??\c:\jpjpj.exec:\jpjpj.exe88⤵PID:2284
-
\??\c:\rllffxx.exec:\rllffxx.exe89⤵PID:2860
-
\??\c:\7xllffl.exec:\7xllffl.exe90⤵PID:1636
-
\??\c:\btbthh.exec:\btbthh.exe91⤵PID:2024
-
\??\c:\7tbttn.exec:\7tbttn.exe92⤵PID:4664
-
\??\c:\vpjvp.exec:\vpjvp.exe93⤵PID:2116
-
\??\c:\vvvvp.exec:\vvvvp.exe94⤵PID:5076
-
\??\c:\xxrrfff.exec:\xxrrfff.exe95⤵PID:3016
-
\??\c:\3llllrr.exec:\3llllrr.exe96⤵PID:1592
-
\??\c:\thnhbt.exec:\thnhbt.exe97⤵PID:3608
-
\??\c:\hbnnbb.exec:\hbnnbb.exe98⤵PID:2012
-
\??\c:\1vjjv.exec:\1vjjv.exe99⤵PID:3580
-
\??\c:\dvjdj.exec:\dvjdj.exe100⤵PID:2464
-
\??\c:\lffrllf.exec:\lffrllf.exe101⤵PID:4968
-
\??\c:\xxrllff.exec:\xxrllff.exe102⤵PID:3584
-
\??\c:\thhbtt.exec:\thhbtt.exe103⤵PID:2676
-
\??\c:\thbttt.exec:\thbttt.exe104⤵PID:384
-
\??\c:\3jjjv.exec:\3jjjv.exe105⤵PID:3012
-
\??\c:\dppjd.exec:\dppjd.exe106⤵PID:3872
-
\??\c:\lflfrrl.exec:\lflfrrl.exe107⤵PID:5088
-
\??\c:\xrxrlll.exec:\xrxrlll.exe108⤵PID:2408
-
\??\c:\bnnnhh.exec:\bnnnhh.exe109⤵PID:2888
-
\??\c:\hhnnhn.exec:\hhnnhn.exe110⤵PID:3760
-
\??\c:\dvppj.exec:\dvppj.exe111⤵PID:460
-
\??\c:\vvpjj.exec:\vvpjj.exe112⤵PID:3596
-
\??\c:\xfxxrrr.exec:\xfxxrrr.exe113⤵PID:64
-
\??\c:\rfrlffl.exec:\rfrlffl.exe114⤵PID:3856
-
\??\c:\tbhhbn.exec:\tbhhbn.exe115⤵PID:4520
-
\??\c:\tbbbbb.exec:\tbbbbb.exe116⤵PID:3020
-
\??\c:\thnttn.exec:\thnttn.exe117⤵PID:3764
-
\??\c:\jvvpp.exec:\jvvpp.exe118⤵PID:4264
-
\??\c:\dvvpj.exec:\dvvpj.exe119⤵PID:3932
-
\??\c:\xlrfxlf.exec:\xlrfxlf.exe120⤵PID:3808
-
\??\c:\9lfxrrl.exec:\9lfxrrl.exe121⤵PID:2384
-
\??\c:\nhhbtt.exec:\nhhbtt.exe122⤵PID:4348
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-