Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 06:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
95b3d551aad05f194cd52e2941428790_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
95b3d551aad05f194cd52e2941428790_NeikiAnalytics.exe
-
Size
76KB
-
MD5
95b3d551aad05f194cd52e2941428790
-
SHA1
3a16bf4cdb5cee427703013e723a24363637cbde
-
SHA256
115ed0cec16ae102d3119418ec984e0150b5a521bd14ec08dbdeef595c7d1e5b
-
SHA512
7e5b7a6cf9b97d6e9ec47de27c7e5a4c4e330539d625c0a826c3b42e75d5cc71338ddcd3f6d1c0af68abe083bdf8014603fcc35c8c7c990f6b7197f416093c25
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2wVEJG:ymb3NkkiQ3mdBjF+3TU2KEJG
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/3236-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1980-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1424-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2372-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4628-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1800-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3372-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3684-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3552-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4460-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2784-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1912-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2192-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3924-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3696-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3064-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1120-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2180-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1416-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4868-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4604-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4076-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1980 5flfxxx.exe 1424 vvpdv.exe 2372 jddvp.exe 4084 rfxrlxf.exe 4628 1bbtnt.exe 3372 pjjjv.exe 1800 dvddp.exe 3684 rflflll.exe 1240 7tbbhh.exe 3552 dppdv.exe 4460 frffflr.exe 4568 nntbnn.exe 2784 dvpvp.exe 1912 lfxrxxx.exe 4844 xxlfffx.exe 4564 nthhbb.exe 2108 ppjdv.exe 2192 flxrlxx.exe 1324 thnnnn.exe 3924 tnhbtn.exe 3504 ppvvj.exe 3752 fxxrllf.exe 3696 bbbhbb.exe 3064 frrlffx.exe 1120 pjvvj.exe 2180 rxrrrxx.exe 1416 pdvpj.exe 2080 bbhhtt.exe 4868 7xffflx.exe 4604 nhbtnh.exe 4076 vddvp.exe 4492 9ppjj.exe 1580 fxxfrff.exe 2860 9ttnhh.exe 4168 ppppd.exe 2448 pvdjj.exe 3852 xxxffff.exe 2768 llrrllx.exe 3260 hbhbbh.exe 2772 jjppp.exe 1684 pvvvp.exe 4340 frffxlf.exe 3292 3xffrxx.exe 4436 3htthn.exe 1560 vpjdj.exe 2980 rlfxlrr.exe 3744 xxrffrr.exe 2484 bbbnbh.exe 3300 nhnnhh.exe 2160 pvppj.exe 3312 xflfxxx.exe 1536 rrrrlll.exe 1668 vppjd.exe 2516 ppjdp.exe 1980 fxxrlrf.exe 3672 xrxrllf.exe 2204 bbbhbb.exe 1780 vvpjd.exe 1772 dvjdp.exe 3420 lrrlffx.exe 4628 nbhbhb.exe 3940 nhbhtt.exe 2992 dvvpj.exe 1864 vpdjd.exe -
resource yara_rule behavioral2/memory/3236-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1980-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1424-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4628-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4628-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4628-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1800-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3372-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3684-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3552-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3552-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4460-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4568-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2784-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1912-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2192-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3924-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3064-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1120-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2180-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1416-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4868-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4076-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3236 wrote to memory of 1980 3236 95b3d551aad05f194cd52e2941428790_NeikiAnalytics.exe 80 PID 3236 wrote to memory of 1980 3236 95b3d551aad05f194cd52e2941428790_NeikiAnalytics.exe 80 PID 3236 wrote to memory of 1980 3236 95b3d551aad05f194cd52e2941428790_NeikiAnalytics.exe 80 PID 1980 wrote to memory of 1424 1980 5flfxxx.exe 81 PID 1980 wrote to memory of 1424 1980 5flfxxx.exe 81 PID 1980 wrote to memory of 1424 1980 5flfxxx.exe 81 PID 1424 wrote to memory of 2372 1424 vvpdv.exe 82 PID 1424 wrote to memory of 2372 1424 vvpdv.exe 82 PID 1424 wrote to memory of 2372 1424 vvpdv.exe 82 PID 2372 wrote to memory of 4084 2372 jddvp.exe 83 PID 2372 wrote to memory of 4084 2372 jddvp.exe 83 PID 2372 wrote to memory of 4084 2372 jddvp.exe 83 PID 4084 wrote to memory of 4628 4084 rfxrlxf.exe 84 PID 4084 wrote to memory of 4628 4084 rfxrlxf.exe 84 PID 4084 wrote to memory of 4628 4084 rfxrlxf.exe 84 PID 4628 wrote to memory of 3372 4628 1bbtnt.exe 85 PID 4628 wrote to memory of 3372 4628 1bbtnt.exe 85 PID 4628 wrote to memory of 3372 4628 1bbtnt.exe 85 PID 3372 wrote to memory of 1800 3372 pjjjv.exe 86 PID 3372 wrote to memory of 1800 3372 pjjjv.exe 86 PID 3372 wrote to memory of 1800 3372 pjjjv.exe 86 PID 1800 wrote to memory of 3684 1800 dvddp.exe 87 PID 1800 wrote to memory of 3684 1800 dvddp.exe 87 PID 1800 wrote to memory of 3684 1800 dvddp.exe 87 PID 3684 wrote to memory of 1240 3684 rflflll.exe 88 PID 3684 wrote to memory of 1240 3684 rflflll.exe 88 PID 3684 wrote to memory of 1240 3684 rflflll.exe 88 PID 1240 wrote to memory of 3552 1240 7tbbhh.exe 89 PID 1240 wrote to memory of 3552 1240 7tbbhh.exe 89 PID 1240 wrote to memory of 3552 1240 7tbbhh.exe 89 PID 3552 wrote to memory of 4460 3552 dppdv.exe 90 PID 3552 wrote to memory of 4460 3552 dppdv.exe 90 PID 3552 wrote to memory of 4460 3552 dppdv.exe 90 PID 4460 wrote to memory of 4568 4460 frffflr.exe 91 PID 4460 wrote to memory of 4568 4460 frffflr.exe 91 PID 4460 wrote to memory of 4568 4460 frffflr.exe 91 PID 4568 wrote to memory of 2784 4568 nntbnn.exe 92 PID 4568 wrote to memory of 2784 4568 nntbnn.exe 92 PID 4568 wrote to memory of 2784 4568 nntbnn.exe 92 PID 2784 wrote to memory of 1912 2784 dvpvp.exe 93 PID 2784 wrote to memory of 1912 2784 dvpvp.exe 93 PID 2784 wrote to memory of 1912 2784 dvpvp.exe 93 PID 1912 wrote to memory of 4844 1912 lfxrxxx.exe 94 PID 1912 wrote to memory of 4844 1912 lfxrxxx.exe 94 PID 1912 wrote to memory of 4844 1912 lfxrxxx.exe 94 PID 4844 wrote to memory of 4564 4844 xxlfffx.exe 95 PID 4844 wrote to memory of 4564 4844 xxlfffx.exe 95 PID 4844 wrote to memory of 4564 4844 xxlfffx.exe 95 PID 4564 wrote to memory of 2108 4564 nthhbb.exe 96 PID 4564 wrote to memory of 2108 4564 nthhbb.exe 96 PID 4564 wrote to memory of 2108 4564 nthhbb.exe 96 PID 2108 wrote to memory of 2192 2108 ppjdv.exe 97 PID 2108 wrote to memory of 2192 2108 ppjdv.exe 97 PID 2108 wrote to memory of 2192 2108 ppjdv.exe 97 PID 2192 wrote to memory of 1324 2192 flxrlxx.exe 98 PID 2192 wrote to memory of 1324 2192 flxrlxx.exe 98 PID 2192 wrote to memory of 1324 2192 flxrlxx.exe 98 PID 1324 wrote to memory of 3924 1324 thnnnn.exe 99 PID 1324 wrote to memory of 3924 1324 thnnnn.exe 99 PID 1324 wrote to memory of 3924 1324 thnnnn.exe 99 PID 3924 wrote to memory of 3504 3924 tnhbtn.exe 100 PID 3924 wrote to memory of 3504 3924 tnhbtn.exe 100 PID 3924 wrote to memory of 3504 3924 tnhbtn.exe 100 PID 3504 wrote to memory of 3752 3504 ppvvj.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\95b3d551aad05f194cd52e2941428790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\95b3d551aad05f194cd52e2941428790_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\5flfxxx.exec:\5flfxxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\vvpdv.exec:\vvpdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\jddvp.exec:\jddvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\rfxrlxf.exec:\rfxrlxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\1bbtnt.exec:\1bbtnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\pjjjv.exec:\pjjjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\dvddp.exec:\dvddp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\rflflll.exec:\rflflll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\7tbbhh.exec:\7tbbhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\dppdv.exec:\dppdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\frffflr.exec:\frffflr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\nntbnn.exec:\nntbnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\dvpvp.exec:\dvpvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\lfxrxxx.exec:\lfxrxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\xxlfffx.exec:\xxlfffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\nthhbb.exec:\nthhbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\ppjdv.exec:\ppjdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\flxrlxx.exec:\flxrlxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\thnnnn.exec:\thnnnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\tnhbtn.exec:\tnhbtn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\ppvvj.exec:\ppvvj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\fxxrllf.exec:\fxxrllf.exe23⤵
- Executes dropped EXE
PID:3752 -
\??\c:\bbbhbb.exec:\bbbhbb.exe24⤵
- Executes dropped EXE
PID:3696 -
\??\c:\frrlffx.exec:\frrlffx.exe25⤵
- Executes dropped EXE
PID:3064 -
\??\c:\pjvvj.exec:\pjvvj.exe26⤵
- Executes dropped EXE
PID:1120 -
\??\c:\rxrrrxx.exec:\rxrrrxx.exe27⤵
- Executes dropped EXE
PID:2180 -
\??\c:\pdvpj.exec:\pdvpj.exe28⤵
- Executes dropped EXE
PID:1416 -
\??\c:\bbhhtt.exec:\bbhhtt.exe29⤵
- Executes dropped EXE
PID:2080 -
\??\c:\7xffflx.exec:\7xffflx.exe30⤵
- Executes dropped EXE
PID:4868 -
\??\c:\nhbtnh.exec:\nhbtnh.exe31⤵
- Executes dropped EXE
PID:4604 -
\??\c:\vddvp.exec:\vddvp.exe32⤵
- Executes dropped EXE
PID:4076 -
\??\c:\9ppjj.exec:\9ppjj.exe33⤵
- Executes dropped EXE
PID:4492 -
\??\c:\fxxfrff.exec:\fxxfrff.exe34⤵
- Executes dropped EXE
PID:1580 -
\??\c:\9ttnhh.exec:\9ttnhh.exe35⤵
- Executes dropped EXE
PID:2860 -
\??\c:\ppppd.exec:\ppppd.exe36⤵
- Executes dropped EXE
PID:4168 -
\??\c:\pvdjj.exec:\pvdjj.exe37⤵
- Executes dropped EXE
PID:2448 -
\??\c:\xxxffff.exec:\xxxffff.exe38⤵
- Executes dropped EXE
PID:3852 -
\??\c:\llrrllx.exec:\llrrllx.exe39⤵
- Executes dropped EXE
PID:2768 -
\??\c:\hbhbbh.exec:\hbhbbh.exe40⤵
- Executes dropped EXE
PID:3260 -
\??\c:\jjppp.exec:\jjppp.exe41⤵
- Executes dropped EXE
PID:2772 -
\??\c:\pvvvp.exec:\pvvvp.exe42⤵
- Executes dropped EXE
PID:1684 -
\??\c:\frffxlf.exec:\frffxlf.exe43⤵
- Executes dropped EXE
PID:4340 -
\??\c:\3xffrxx.exec:\3xffrxx.exe44⤵
- Executes dropped EXE
PID:3292 -
\??\c:\3htthn.exec:\3htthn.exe45⤵
- Executes dropped EXE
PID:4436 -
\??\c:\vpjdj.exec:\vpjdj.exe46⤵
- Executes dropped EXE
PID:1560 -
\??\c:\rlfxlrr.exec:\rlfxlrr.exe47⤵
- Executes dropped EXE
PID:2980 -
\??\c:\xxrffrr.exec:\xxrffrr.exe48⤵
- Executes dropped EXE
PID:3744 -
\??\c:\bbbnbh.exec:\bbbnbh.exe49⤵
- Executes dropped EXE
PID:2484 -
\??\c:\nhnnhh.exec:\nhnnhh.exe50⤵
- Executes dropped EXE
PID:3300 -
\??\c:\pvppj.exec:\pvppj.exe51⤵
- Executes dropped EXE
PID:2160 -
\??\c:\xflfxxx.exec:\xflfxxx.exe52⤵
- Executes dropped EXE
PID:3312 -
\??\c:\rrrrlll.exec:\rrrrlll.exe53⤵
- Executes dropped EXE
PID:1536 -
\??\c:\lllflfl.exec:\lllflfl.exe54⤵PID:4428
-
\??\c:\vppjd.exec:\vppjd.exe55⤵
- Executes dropped EXE
PID:1668 -
\??\c:\ppjdp.exec:\ppjdp.exe56⤵
- Executes dropped EXE
PID:2516 -
\??\c:\fxxrlrf.exec:\fxxrlrf.exe57⤵
- Executes dropped EXE
PID:1980 -
\??\c:\xrxrllf.exec:\xrxrllf.exe58⤵
- Executes dropped EXE
PID:3672 -
\??\c:\bbbhbb.exec:\bbbhbb.exe59⤵
- Executes dropped EXE
PID:2204 -
\??\c:\vvpjd.exec:\vvpjd.exe60⤵
- Executes dropped EXE
PID:1780 -
\??\c:\dvjdp.exec:\dvjdp.exe61⤵
- Executes dropped EXE
PID:1772 -
\??\c:\lrrlffx.exec:\lrrlffx.exe62⤵
- Executes dropped EXE
PID:3420 -
\??\c:\nbhbhb.exec:\nbhbhb.exe63⤵
- Executes dropped EXE
PID:4628 -
\??\c:\nhbhtt.exec:\nhbhtt.exe64⤵
- Executes dropped EXE
PID:3940 -
\??\c:\dvvpj.exec:\dvvpj.exe65⤵
- Executes dropped EXE
PID:2992 -
\??\c:\vpdjd.exec:\vpdjd.exe66⤵
- Executes dropped EXE
PID:1864 -
\??\c:\rlxrllr.exec:\rlxrllr.exe67⤵PID:3732
-
\??\c:\nnhhhn.exec:\nnhhhn.exe68⤵PID:3684
-
\??\c:\vpjpp.exec:\vpjpp.exe69⤵PID:1240
-
\??\c:\rrlffll.exec:\rrlffll.exe70⤵PID:4288
-
\??\c:\xxxfxxx.exec:\xxxfxxx.exe71⤵PID:4464
-
\??\c:\bnnbhb.exec:\bnnbhb.exe72⤵PID:3720
-
\??\c:\vpjjd.exec:\vpjjd.exe73⤵PID:4568
-
\??\c:\1rrfffr.exec:\1rrfffr.exe74⤵PID:4944
-
\??\c:\nnhhbt.exec:\nnhhbt.exe75⤵PID:1924
-
\??\c:\jvjdj.exec:\jvjdj.exe76⤵PID:1012
-
\??\c:\jdpjd.exec:\jdpjd.exe77⤵PID:4652
-
\??\c:\rfffflr.exec:\rfffflr.exe78⤵PID:4564
-
\??\c:\3ttttt.exec:\3ttttt.exe79⤵PID:1852
-
\??\c:\3ntntt.exec:\3ntntt.exe80⤵PID:3324
-
\??\c:\vjdvd.exec:\vjdvd.exe81⤵PID:4060
-
\??\c:\vjvpj.exec:\vjvpj.exe82⤵PID:2444
-
\??\c:\flxrrll.exec:\flxrrll.exe83⤵PID:4524
-
\??\c:\btthnb.exec:\btthnb.exe84⤵PID:3348
-
\??\c:\jdvpj.exec:\jdvpj.exe85⤵PID:1764
-
\??\c:\dpjdp.exec:\dpjdp.exe86⤵PID:4544
-
\??\c:\9xfxxfl.exec:\9xfxxfl.exe87⤵PID:2504
-
\??\c:\lrrrfrf.exec:\lrrrfrf.exe88⤵PID:1396
-
\??\c:\nhbtbt.exec:\nhbtbt.exe89⤵PID:2676
-
\??\c:\1nhbhh.exec:\1nhbhh.exe90⤵PID:1120
-
\??\c:\ddjdd.exec:\ddjdd.exe91⤵PID:1872
-
\??\c:\1lrlfrl.exec:\1lrlfrl.exe92⤵PID:4056
-
\??\c:\tthnht.exec:\tthnht.exe93⤵PID:3564
-
\??\c:\pddpj.exec:\pddpj.exe94⤵PID:1528
-
\??\c:\vdddp.exec:\vdddp.exe95⤵PID:4868
-
\??\c:\1rxxlxr.exec:\1rxxlxr.exe96⤵PID:1188
-
\??\c:\rrrlxff.exec:\rrrlxff.exe97⤵PID:3528
-
\??\c:\hhbbth.exec:\hhbbth.exe98⤵PID:1616
-
\??\c:\vjppp.exec:\vjppp.exe99⤵PID:3052
-
\??\c:\xrxrrll.exec:\xrxrrll.exe100⤵PID:4468
-
\??\c:\fxffffx.exec:\fxffffx.exe101⤵PID:4588
-
\??\c:\nbbbnn.exec:\nbbbnn.exe102⤵PID:2300
-
\??\c:\ppddp.exec:\ppddp.exe103⤵PID:4316
-
\??\c:\jdvpv.exec:\jdvpv.exe104⤵PID:2436
-
\??\c:\rxrlffx.exec:\rxrlffx.exe105⤵PID:2696
-
\??\c:\btthbb.exec:\btthbb.exe106⤵PID:1588
-
\??\c:\btbbbh.exec:\btbbbh.exe107⤵PID:3668
-
\??\c:\5dpjd.exec:\5dpjd.exe108⤵PID:728
-
\??\c:\xxxfxxr.exec:\xxxfxxr.exe109⤵PID:1600
-
\??\c:\fxllrrl.exec:\fxllrrl.exe110⤵PID:2164
-
\??\c:\btbbtn.exec:\btbbtn.exe111⤵PID:4504
-
\??\c:\vvpjj.exec:\vvpjj.exe112⤵PID:1700
-
\??\c:\pvvjd.exec:\pvvjd.exe113⤵PID:312
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe114⤵PID:4488
-
\??\c:\btbbbb.exec:\btbbbb.exe115⤵PID:1168
-
\??\c:\thtnnb.exec:\thtnnb.exe116⤵PID:2688
-
\??\c:\pjvpj.exec:\pjvpj.exe117⤵PID:4384
-
\??\c:\lflrlrx.exec:\lflrlrx.exe118⤵PID:1460
-
\??\c:\bttbbb.exec:\bttbbb.exe119⤵PID:4320
-
\??\c:\hbhhhh.exec:\hbhhhh.exe120⤵PID:1668
-
\??\c:\djjdd.exec:\djjdd.exe121⤵PID:2412
-
\??\c:\pdvvv.exec:\pdvvv.exe122⤵PID:2372
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-