Analysis
-
max time kernel
150s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 10:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d9ecfe6c5330d772e5b5ddb790eb6830_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
d9ecfe6c5330d772e5b5ddb790eb6830_NeikiAnalytics.exe
-
Size
93KB
-
MD5
d9ecfe6c5330d772e5b5ddb790eb6830
-
SHA1
a46b6d954c69697faa3c962d56f4561e0396e716
-
SHA256
2b67942fe655460dd0779bcac6129e9d8b03e81bdba023eb3f9bad6a67c6e3a4
-
SHA512
29daa5b25b330b08b5ae1a04fa25034e922d6b54d80c1a68689f45c50f8995ffd1e4e88669894a1fb31b2303edaa7d1f718a96ee13ba22a11ecb4f0c71ed845a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDInWeNCYGyA2R7JxJAg8dtW:ymb3NkkiQ3mdBjFIWeFGyAsJAg2W
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/372-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4204-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/948-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4040-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1064-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1892-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1944-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3420-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3656-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1444-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2840-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4208-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3204-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2348-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3368-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1720-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1104-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3672-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3836-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4476-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2004-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4204 xllxrfr.exe 948 7tnhbh.exe 4040 thtbnn.exe 4508 bhnnhb.exe 1064 9vpjj.exe 1892 frfxxxf.exe 4784 5dpdj.exe 1944 7frrxff.exe 100 bhnhbb.exe 3420 lrxrllf.exe 5024 hthbtb.exe 3656 djvdd.exe 1444 bbbnhh.exe 2840 jjpjj.exe 4208 xrflxxl.exe 624 nnhtbb.exe 3204 jjdvp.exe 2348 1lrlxxf.exe 3368 nthhhh.exe 1720 dvpdv.exe 1104 rrfxrrr.exe 1952 flrrxfr.exe 3672 1hbtnn.exe 5100 1jdvp.exe 324 ffrrrxx.exe 4456 hbttnh.exe 4808 vvjjv.exe 3836 llrrrxx.exe 4476 hbhhhh.exe 4944 dppdv.exe 2004 jdpjd.exe 2708 xxfllrr.exe 1548 thtbhb.exe 3956 jjppv.exe 2856 fxrrffl.exe 4796 9llfxxr.exe 2368 ttbhnn.exe 1904 9ppdv.exe 4348 fxxrrfr.exe 3816 xrfrlff.exe 456 btttnt.exe 3300 vvjjj.exe 948 vjjdd.exe 2412 ffllxlx.exe 1036 btbnbt.exe 884 3ppjd.exe 3464 xxrlffx.exe 2748 1hnnth.exe 4032 tnttbb.exe 1028 ddvvv.exe 1008 xllfffx.exe 3920 llxfxfx.exe 1888 ttnthb.exe 1808 vdjpd.exe 4512 flrfxxr.exe 416 xfllllr.exe 4200 nbhhhn.exe 3780 pdjjj.exe 1660 rffxffx.exe 4240 nbnbtn.exe 1916 bttttt.exe 4628 jvvvp.exe 756 flflflf.exe 2624 lffxxxr.exe -
resource yara_rule behavioral2/memory/372-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4204-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4204-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/948-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1064-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1892-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1944-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1944-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1944-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/100-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3420-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1444-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2840-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4208-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3204-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2348-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3368-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1720-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2004-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 372 wrote to memory of 4204 372 d9ecfe6c5330d772e5b5ddb790eb6830_NeikiAnalytics.exe 83 PID 372 wrote to memory of 4204 372 d9ecfe6c5330d772e5b5ddb790eb6830_NeikiAnalytics.exe 83 PID 372 wrote to memory of 4204 372 d9ecfe6c5330d772e5b5ddb790eb6830_NeikiAnalytics.exe 83 PID 4204 wrote to memory of 948 4204 xllxrfr.exe 84 PID 4204 wrote to memory of 948 4204 xllxrfr.exe 84 PID 4204 wrote to memory of 948 4204 xllxrfr.exe 84 PID 948 wrote to memory of 4040 948 7tnhbh.exe 85 PID 948 wrote to memory of 4040 948 7tnhbh.exe 85 PID 948 wrote to memory of 4040 948 7tnhbh.exe 85 PID 4040 wrote to memory of 4508 4040 thtbnn.exe 86 PID 4040 wrote to memory of 4508 4040 thtbnn.exe 86 PID 4040 wrote to memory of 4508 4040 thtbnn.exe 86 PID 4508 wrote to memory of 1064 4508 bhnnhb.exe 87 PID 4508 wrote to memory of 1064 4508 bhnnhb.exe 87 PID 4508 wrote to memory of 1064 4508 bhnnhb.exe 87 PID 1064 wrote to memory of 1892 1064 9vpjj.exe 88 PID 1064 wrote to memory of 1892 1064 9vpjj.exe 88 PID 1064 wrote to memory of 1892 1064 9vpjj.exe 88 PID 1892 wrote to memory of 4784 1892 frfxxxf.exe 89 PID 1892 wrote to memory of 4784 1892 frfxxxf.exe 89 PID 1892 wrote to memory of 4784 1892 frfxxxf.exe 89 PID 4784 wrote to memory of 1944 4784 5dpdj.exe 90 PID 4784 wrote to memory of 1944 4784 5dpdj.exe 90 PID 4784 wrote to memory of 1944 4784 5dpdj.exe 90 PID 1944 wrote to memory of 100 1944 7frrxff.exe 91 PID 1944 wrote to memory of 100 1944 7frrxff.exe 91 PID 1944 wrote to memory of 100 1944 7frrxff.exe 91 PID 100 wrote to memory of 3420 100 bhnhbb.exe 92 PID 100 wrote to memory of 3420 100 bhnhbb.exe 92 PID 100 wrote to memory of 3420 100 bhnhbb.exe 92 PID 3420 wrote to memory of 5024 3420 lrxrllf.exe 93 PID 3420 wrote to memory of 5024 3420 lrxrllf.exe 93 PID 3420 wrote to memory of 5024 3420 lrxrllf.exe 93 PID 5024 wrote to memory of 3656 5024 hthbtb.exe 94 PID 5024 wrote to memory of 3656 5024 hthbtb.exe 94 PID 5024 wrote to memory of 3656 5024 hthbtb.exe 94 PID 3656 wrote to memory of 1444 3656 djvdd.exe 95 PID 3656 wrote to memory of 1444 3656 djvdd.exe 95 PID 3656 wrote to memory of 1444 3656 djvdd.exe 95 PID 1444 wrote to memory of 2840 1444 bbbnhh.exe 96 PID 1444 wrote to memory of 2840 1444 bbbnhh.exe 96 PID 1444 wrote to memory of 2840 1444 bbbnhh.exe 96 PID 2840 wrote to memory of 4208 2840 jjpjj.exe 97 PID 2840 wrote to memory of 4208 2840 jjpjj.exe 97 PID 2840 wrote to memory of 4208 2840 jjpjj.exe 97 PID 4208 wrote to memory of 624 4208 xrflxxl.exe 98 PID 4208 wrote to memory of 624 4208 xrflxxl.exe 98 PID 4208 wrote to memory of 624 4208 xrflxxl.exe 98 PID 624 wrote to memory of 3204 624 nnhtbb.exe 99 PID 624 wrote to memory of 3204 624 nnhtbb.exe 99 PID 624 wrote to memory of 3204 624 nnhtbb.exe 99 PID 3204 wrote to memory of 2348 3204 jjdvp.exe 100 PID 3204 wrote to memory of 2348 3204 jjdvp.exe 100 PID 3204 wrote to memory of 2348 3204 jjdvp.exe 100 PID 2348 wrote to memory of 3368 2348 1lrlxxf.exe 101 PID 2348 wrote to memory of 3368 2348 1lrlxxf.exe 101 PID 2348 wrote to memory of 3368 2348 1lrlxxf.exe 101 PID 3368 wrote to memory of 1720 3368 nthhhh.exe 102 PID 3368 wrote to memory of 1720 3368 nthhhh.exe 102 PID 3368 wrote to memory of 1720 3368 nthhhh.exe 102 PID 1720 wrote to memory of 1104 1720 dvpdv.exe 103 PID 1720 wrote to memory of 1104 1720 dvpdv.exe 103 PID 1720 wrote to memory of 1104 1720 dvpdv.exe 103 PID 1104 wrote to memory of 1952 1104 rrfxrrr.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9ecfe6c5330d772e5b5ddb790eb6830_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d9ecfe6c5330d772e5b5ddb790eb6830_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\xllxrfr.exec:\xllxrfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
\??\c:\7tnhbh.exec:\7tnhbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\thtbnn.exec:\thtbnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\bhnnhb.exec:\bhnnhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\9vpjj.exec:\9vpjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\frfxxxf.exec:\frfxxxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\5dpdj.exec:\5dpdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\7frrxff.exec:\7frrxff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\bhnhbb.exec:\bhnhbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100 -
\??\c:\lrxrllf.exec:\lrxrllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
\??\c:\hthbtb.exec:\hthbtb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\djvdd.exec:\djvdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\bbbnhh.exec:\bbbnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\jjpjj.exec:\jjpjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\xrflxxl.exec:\xrflxxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\nnhtbb.exec:\nnhtbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\jjdvp.exec:\jjdvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
\??\c:\1lrlxxf.exec:\1lrlxxf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\nthhhh.exec:\nthhhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\dvpdv.exec:\dvpdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\rrfxrrr.exec:\rrfxrrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\flrrxfr.exec:\flrrxfr.exe23⤵
- Executes dropped EXE
PID:1952 -
\??\c:\1hbtnn.exec:\1hbtnn.exe24⤵
- Executes dropped EXE
PID:3672 -
\??\c:\1jdvp.exec:\1jdvp.exe25⤵
- Executes dropped EXE
PID:5100 -
\??\c:\ffrrrxx.exec:\ffrrrxx.exe26⤵
- Executes dropped EXE
PID:324 -
\??\c:\hbttnh.exec:\hbttnh.exe27⤵
- Executes dropped EXE
PID:4456 -
\??\c:\vvjjv.exec:\vvjjv.exe28⤵
- Executes dropped EXE
PID:4808 -
\??\c:\llrrrxx.exec:\llrrrxx.exe29⤵
- Executes dropped EXE
PID:3836 -
\??\c:\hbhhhh.exec:\hbhhhh.exe30⤵
- Executes dropped EXE
PID:4476 -
\??\c:\dppdv.exec:\dppdv.exe31⤵
- Executes dropped EXE
PID:4944 -
\??\c:\jdpjd.exec:\jdpjd.exe32⤵
- Executes dropped EXE
PID:2004 -
\??\c:\xxfllrr.exec:\xxfllrr.exe33⤵
- Executes dropped EXE
PID:2708 -
\??\c:\thtbhb.exec:\thtbhb.exe34⤵
- Executes dropped EXE
PID:1548 -
\??\c:\jjppv.exec:\jjppv.exe35⤵
- Executes dropped EXE
PID:3956 -
\??\c:\fxrrffl.exec:\fxrrffl.exe36⤵
- Executes dropped EXE
PID:2856 -
\??\c:\9llfxxr.exec:\9llfxxr.exe37⤵
- Executes dropped EXE
PID:4796 -
\??\c:\ttbhnn.exec:\ttbhnn.exe38⤵
- Executes dropped EXE
PID:2368 -
\??\c:\9ppdv.exec:\9ppdv.exe39⤵
- Executes dropped EXE
PID:1904 -
\??\c:\fxxrrfr.exec:\fxxrrfr.exe40⤵
- Executes dropped EXE
PID:4348 -
\??\c:\xrfrlff.exec:\xrfrlff.exe41⤵
- Executes dropped EXE
PID:3816 -
\??\c:\btttnt.exec:\btttnt.exe42⤵
- Executes dropped EXE
PID:456 -
\??\c:\vvjjj.exec:\vvjjj.exe43⤵
- Executes dropped EXE
PID:3300 -
\??\c:\vjjdd.exec:\vjjdd.exe44⤵
- Executes dropped EXE
PID:948 -
\??\c:\ffllxlx.exec:\ffllxlx.exe45⤵
- Executes dropped EXE
PID:2412 -
\??\c:\btbnbt.exec:\btbnbt.exe46⤵
- Executes dropped EXE
PID:1036 -
\??\c:\3ppjd.exec:\3ppjd.exe47⤵
- Executes dropped EXE
PID:884 -
\??\c:\xxrlffx.exec:\xxrlffx.exe48⤵
- Executes dropped EXE
PID:3464 -
\??\c:\1hnnth.exec:\1hnnth.exe49⤵
- Executes dropped EXE
PID:2748 -
\??\c:\tnttbb.exec:\tnttbb.exe50⤵
- Executes dropped EXE
PID:4032 -
\??\c:\ddvvv.exec:\ddvvv.exe51⤵
- Executes dropped EXE
PID:1028 -
\??\c:\xllfffx.exec:\xllfffx.exe52⤵
- Executes dropped EXE
PID:1008 -
\??\c:\llxfxfx.exec:\llxfxfx.exe53⤵
- Executes dropped EXE
PID:3920 -
\??\c:\ttnthb.exec:\ttnthb.exe54⤵
- Executes dropped EXE
PID:1888 -
\??\c:\vdjpd.exec:\vdjpd.exe55⤵
- Executes dropped EXE
PID:1808 -
\??\c:\flrfxxr.exec:\flrfxxr.exe56⤵
- Executes dropped EXE
PID:4512 -
\??\c:\xfllllr.exec:\xfllllr.exe57⤵
- Executes dropped EXE
PID:416 -
\??\c:\nbhhhn.exec:\nbhhhn.exe58⤵
- Executes dropped EXE
PID:4200 -
\??\c:\pdjjj.exec:\pdjjj.exe59⤵
- Executes dropped EXE
PID:3780 -
\??\c:\rffxffx.exec:\rffxffx.exe60⤵
- Executes dropped EXE
PID:1660 -
\??\c:\nbnbtn.exec:\nbnbtn.exe61⤵
- Executes dropped EXE
PID:4240 -
\??\c:\bttttt.exec:\bttttt.exe62⤵
- Executes dropped EXE
PID:1916 -
\??\c:\jvvvp.exec:\jvvvp.exe63⤵
- Executes dropped EXE
PID:4628 -
\??\c:\flflflf.exec:\flflflf.exe64⤵
- Executes dropped EXE
PID:756 -
\??\c:\lffxxxr.exec:\lffxxxr.exe65⤵
- Executes dropped EXE
PID:2624 -
\??\c:\tnbtbh.exec:\tnbtbh.exe66⤵PID:2384
-
\??\c:\dppjj.exec:\dppjj.exe67⤵PID:684
-
\??\c:\1dddp.exec:\1dddp.exe68⤵PID:3992
-
\??\c:\fxfxfxf.exec:\fxfxfxf.exe69⤵PID:3404
-
\??\c:\3rrlllf.exec:\3rrlllf.exe70⤵PID:1696
-
\??\c:\bhtthh.exec:\bhtthh.exe71⤵PID:2256
-
\??\c:\7jpjv.exec:\7jpjv.exe72⤵PID:4808
-
\??\c:\5vvvv.exec:\5vvvv.exe73⤵PID:5108
-
\??\c:\xrxrrxl.exec:\xrxrrxl.exe74⤵PID:1020
-
\??\c:\rxxxrrr.exec:\rxxxrrr.exe75⤵PID:1640
-
\??\c:\tnnnhh.exec:\tnnnhh.exe76⤵PID:4636
-
\??\c:\nhnbbn.exec:\nhnbbn.exe77⤵PID:3328
-
\??\c:\jdpdj.exec:\jdpdj.exe78⤵PID:3888
-
\??\c:\lxlxrrl.exec:\lxlxrrl.exe79⤵PID:2864
-
\??\c:\xfrrlrl.exec:\xfrrlrl.exe80⤵PID:3636
-
\??\c:\ttnnht.exec:\ttnnht.exe81⤵PID:1304
-
\??\c:\5hnnhn.exec:\5hnnhn.exe82⤵PID:4736
-
\??\c:\dvjdd.exec:\dvjdd.exe83⤵PID:2600
-
\??\c:\ddvvp.exec:\ddvvp.exe84⤵PID:4612
-
\??\c:\7flfxrx.exec:\7flfxrx.exe85⤵PID:548
-
\??\c:\xllfxlf.exec:\xllfxlf.exe86⤵PID:4716
-
\??\c:\1bhbtb.exec:\1bhbtb.exe87⤵PID:2780
-
\??\c:\djjvp.exec:\djjvp.exe88⤵PID:3028
-
\??\c:\pddvv.exec:\pddvv.exe89⤵PID:948
-
\??\c:\5flxrrl.exec:\5flxrrl.exe90⤵PID:1064
-
\??\c:\flrlffx.exec:\flrlffx.exe91⤵PID:2116
-
\??\c:\bnhbtt.exec:\bnhbtt.exe92⤵PID:564
-
\??\c:\7nhtnt.exec:\7nhtnt.exe93⤵PID:2372
-
\??\c:\5ppdv.exec:\5ppdv.exe94⤵PID:2064
-
\??\c:\xffxlxl.exec:\xffxlxl.exe95⤵PID:1028
-
\??\c:\fxxrrrr.exec:\fxxrrrr.exe96⤵PID:3420
-
\??\c:\lfxrlxx.exec:\lfxrlxx.exe97⤵PID:3960
-
\??\c:\thnnhn.exec:\thnnhn.exe98⤵PID:1888
-
\??\c:\pdjpp.exec:\pdjpp.exe99⤵PID:2388
-
\??\c:\9dvpj.exec:\9dvpj.exe100⤵PID:4512
-
\??\c:\fxxrxxr.exec:\fxxrxxr.exe101⤵PID:416
-
\??\c:\rfrrrfx.exec:\rfrrrfx.exe102⤵PID:2276
-
\??\c:\nbbbtn.exec:\nbbbtn.exe103⤵PID:624
-
\??\c:\pjjdv.exec:\pjjdv.exe104⤵PID:2568
-
\??\c:\vjpdd.exec:\vjpdd.exe105⤵PID:3204
-
\??\c:\xllffff.exec:\xllffff.exe106⤵PID:2016
-
\??\c:\3rrrrrl.exec:\3rrrrrl.exe107⤵PID:4628
-
\??\c:\9hbhhh.exec:\9hbhhh.exe108⤵PID:5040
-
\??\c:\bhbbnn.exec:\bhbbnn.exe109⤵PID:1992
-
\??\c:\pvvvv.exec:\pvvvv.exe110⤵PID:2384
-
\??\c:\vddpj.exec:\vddpj.exe111⤵PID:684
-
\??\c:\7rrlfxx.exec:\7rrlfxx.exe112⤵PID:3372
-
\??\c:\5nhbhh.exec:\5nhbhh.exe113⤵PID:4456
-
\??\c:\7hhbtb.exec:\7hhbtb.exe114⤵PID:4712
-
\??\c:\pppjp.exec:\pppjp.exe115⤵PID:4624
-
\??\c:\5vpdp.exec:\5vpdp.exe116⤵PID:4576
-
\??\c:\xrrrfxl.exec:\xrrrfxl.exe117⤵PID:3148
-
\??\c:\ttbnnh.exec:\ttbnnh.exe118⤵PID:1740
-
\??\c:\bbnhhh.exec:\bbnhhh.exe119⤵PID:1220
-
\??\c:\tnntnn.exec:\tnntnn.exe120⤵PID:2944
-
\??\c:\5vpjv.exec:\5vpjv.exe121⤵PID:224
-
\??\c:\9pvdv.exec:\9pvdv.exe122⤵PID:4372
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-