Analysis
-
max time kernel
149s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 05:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7d8f002c0b4f6d77e37cf219c7d86650_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
7d8f002c0b4f6d77e37cf219c7d86650_NeikiAnalytics.exe
-
Size
75KB
-
MD5
7d8f002c0b4f6d77e37cf219c7d86650
-
SHA1
6ea21d57a7cbbe01dc835329dafaa5b23bf6e3b3
-
SHA256
4077f9dc1d0f1d38d217ee522d0be68fdb648ed9fa81cec82a953989a0f2032e
-
SHA512
714fd6df89d6aa111b68dd93e14ffaa4f4a050523076e7a6cd51b2331e0c30ff9923041334059d51458eb85690def0eb0115122654edb2a4371e8f41f00eac0d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIoAh2QpUnX1Aw:ymb3NkkiQ3mdBjFIsIVbpUL
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/2900-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3444-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4068-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2500-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1412-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3208-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4100-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4700-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3048-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2040-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2136-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1652-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3056-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3176-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4676-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4424-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2060-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4704-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/636-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3076-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3884-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4332-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3188-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3444 fllfxrr.exe 4068 thhnth.exe 2500 btttnn.exe 1412 7jjdp.exe 3208 rlllfff.exe 4700 rllfffx.exe 4100 bbbttb.exe 3048 bhnnhh.exe 3504 rfffxxr.exe 2040 9rxrllf.exe 2136 hhbhbh.exe 3544 vvdvp.exe 1720 rrxrlfx.exe 3456 3hhbhh.exe 1652 vvvvj.exe 3056 5vjdv.exe 3176 xrrrlxr.exe 4676 thhhbb.exe 4424 jvvpj.exe 2060 3rfxrrl.exe 1792 3lffxxx.exe 4704 5tbbtb.exe 636 hntnhh.exe 3076 jvvvp.exe 3256 1xfxrrr.exe 1776 9ffrlrf.exe 892 nnnnnn.exe 1164 bhnhth.exe 3884 pjdpp.exe 4332 lffxxff.exe 3188 nbthtb.exe 2028 pjjjj.exe 2452 rxfxlll.exe 4192 flxrxxr.exe 1168 9tbhtt.exe 1292 3djdd.exe 4936 lxxrlll.exe 4644 5fllflr.exe 980 tbhhhn.exe 4296 bbnttt.exe 468 7jpjp.exe 3556 ddjvj.exe 2328 fxrfrlf.exe 1608 flfffxr.exe 3448 5tbtnh.exe 4520 7vjjj.exe 4092 jvvpd.exe 3456 lffxllf.exe 1624 9ntnbn.exe 4940 pjdvj.exe 2316 7flxlfx.exe 4676 xxxrlfx.exe 4300 bnhbhb.exe 2948 hhhhbb.exe 1080 dpvjj.exe 3064 fxrlflf.exe 1000 1flffxr.exe 4556 1tnhbt.exe 5016 dvpdp.exe 4908 vjddv.exe 1776 7ffllrr.exe 1344 9tnhbb.exe 860 hhbbnh.exe 4084 pppdj.exe -
resource yara_rule behavioral2/memory/2900-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3444-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4068-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2500-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1412-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3208-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4100-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4700-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3048-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2136-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1652-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3056-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3176-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4676-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2060-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4704-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/636-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3076-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3884-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4332-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3188-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2900 wrote to memory of 3444 2900 7d8f002c0b4f6d77e37cf219c7d86650_NeikiAnalytics.exe 90 PID 2900 wrote to memory of 3444 2900 7d8f002c0b4f6d77e37cf219c7d86650_NeikiAnalytics.exe 90 PID 2900 wrote to memory of 3444 2900 7d8f002c0b4f6d77e37cf219c7d86650_NeikiAnalytics.exe 90 PID 3444 wrote to memory of 4068 3444 fllfxrr.exe 91 PID 3444 wrote to memory of 4068 3444 fllfxrr.exe 91 PID 3444 wrote to memory of 4068 3444 fllfxrr.exe 91 PID 4068 wrote to memory of 2500 4068 thhnth.exe 92 PID 4068 wrote to memory of 2500 4068 thhnth.exe 92 PID 4068 wrote to memory of 2500 4068 thhnth.exe 92 PID 2500 wrote to memory of 1412 2500 btttnn.exe 93 PID 2500 wrote to memory of 1412 2500 btttnn.exe 93 PID 2500 wrote to memory of 1412 2500 btttnn.exe 93 PID 1412 wrote to memory of 3208 1412 7jjdp.exe 94 PID 1412 wrote to memory of 3208 1412 7jjdp.exe 94 PID 1412 wrote to memory of 3208 1412 7jjdp.exe 94 PID 3208 wrote to memory of 4700 3208 rlllfff.exe 95 PID 3208 wrote to memory of 4700 3208 rlllfff.exe 95 PID 3208 wrote to memory of 4700 3208 rlllfff.exe 95 PID 4700 wrote to memory of 4100 4700 rllfffx.exe 96 PID 4700 wrote to memory of 4100 4700 rllfffx.exe 96 PID 4700 wrote to memory of 4100 4700 rllfffx.exe 96 PID 4100 wrote to memory of 3048 4100 bbbttb.exe 97 PID 4100 wrote to memory of 3048 4100 bbbttb.exe 97 PID 4100 wrote to memory of 3048 4100 bbbttb.exe 97 PID 3048 wrote to memory of 3504 3048 bhnnhh.exe 98 PID 3048 wrote to memory of 3504 3048 bhnnhh.exe 98 PID 3048 wrote to memory of 3504 3048 bhnnhh.exe 98 PID 3504 wrote to memory of 2040 3504 rfffxxr.exe 99 PID 3504 wrote to memory of 2040 3504 rfffxxr.exe 99 PID 3504 wrote to memory of 2040 3504 rfffxxr.exe 99 PID 2040 wrote to memory of 2136 2040 9rxrllf.exe 100 PID 2040 wrote to memory of 2136 2040 9rxrllf.exe 100 PID 2040 wrote to memory of 2136 2040 9rxrllf.exe 100 PID 2136 wrote to memory of 3544 2136 hhbhbh.exe 101 PID 2136 wrote to memory of 3544 2136 hhbhbh.exe 101 PID 2136 wrote to memory of 3544 2136 hhbhbh.exe 101 PID 3544 wrote to memory of 1720 3544 vvdvp.exe 102 PID 3544 wrote to memory of 1720 3544 vvdvp.exe 102 PID 3544 wrote to memory of 1720 3544 vvdvp.exe 102 PID 1720 wrote to memory of 3456 1720 rrxrlfx.exe 103 PID 1720 wrote to memory of 3456 1720 rrxrlfx.exe 103 PID 1720 wrote to memory of 3456 1720 rrxrlfx.exe 103 PID 3456 wrote to memory of 1652 3456 3hhbhh.exe 104 PID 3456 wrote to memory of 1652 3456 3hhbhh.exe 104 PID 3456 wrote to memory of 1652 3456 3hhbhh.exe 104 PID 1652 wrote to memory of 3056 1652 vvvvj.exe 105 PID 1652 wrote to memory of 3056 1652 vvvvj.exe 105 PID 1652 wrote to memory of 3056 1652 vvvvj.exe 105 PID 3056 wrote to memory of 3176 3056 5vjdv.exe 106 PID 3056 wrote to memory of 3176 3056 5vjdv.exe 106 PID 3056 wrote to memory of 3176 3056 5vjdv.exe 106 PID 3176 wrote to memory of 4676 3176 xrrrlxr.exe 107 PID 3176 wrote to memory of 4676 3176 xrrrlxr.exe 107 PID 3176 wrote to memory of 4676 3176 xrrrlxr.exe 107 PID 4676 wrote to memory of 4424 4676 thhhbb.exe 108 PID 4676 wrote to memory of 4424 4676 thhhbb.exe 108 PID 4676 wrote to memory of 4424 4676 thhhbb.exe 108 PID 4424 wrote to memory of 2060 4424 jvvpj.exe 109 PID 4424 wrote to memory of 2060 4424 jvvpj.exe 109 PID 4424 wrote to memory of 2060 4424 jvvpj.exe 109 PID 2060 wrote to memory of 1792 2060 3rfxrrl.exe 110 PID 2060 wrote to memory of 1792 2060 3rfxrrl.exe 110 PID 2060 wrote to memory of 1792 2060 3rfxrrl.exe 110 PID 1792 wrote to memory of 4704 1792 3lffxxx.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d8f002c0b4f6d77e37cf219c7d86650_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7d8f002c0b4f6d77e37cf219c7d86650_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\fllfxrr.exec:\fllfxrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\thhnth.exec:\thhnth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\btttnn.exec:\btttnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\7jjdp.exec:\7jjdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\rlllfff.exec:\rlllfff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
\??\c:\rllfffx.exec:\rllfffx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\bbbttb.exec:\bbbttb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\bhnnhh.exec:\bhnnhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\rfffxxr.exec:\rfffxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\9rxrllf.exec:\9rxrllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\hhbhbh.exec:\hhbhbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\vvdvp.exec:\vvdvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
\??\c:\rrxrlfx.exec:\rrxrlfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\3hhbhh.exec:\3hhbhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\vvvvj.exec:\vvvvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\5vjdv.exec:\5vjdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\xrrrlxr.exec:\xrrrlxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\thhhbb.exec:\thhhbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\jvvpj.exec:\jvvpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\3rfxrrl.exec:\3rfxrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\3lffxxx.exec:\3lffxxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\5tbbtb.exec:\5tbbtb.exe23⤵
- Executes dropped EXE
PID:4704 -
\??\c:\hntnhh.exec:\hntnhh.exe24⤵
- Executes dropped EXE
PID:636 -
\??\c:\jvvvp.exec:\jvvvp.exe25⤵
- Executes dropped EXE
PID:3076 -
\??\c:\1xfxrrr.exec:\1xfxrrr.exe26⤵
- Executes dropped EXE
PID:3256 -
\??\c:\9ffrlrf.exec:\9ffrlrf.exe27⤵
- Executes dropped EXE
PID:1776 -
\??\c:\nnnnnn.exec:\nnnnnn.exe28⤵
- Executes dropped EXE
PID:892 -
\??\c:\bhnhth.exec:\bhnhth.exe29⤵
- Executes dropped EXE
PID:1164 -
\??\c:\pjdpp.exec:\pjdpp.exe30⤵
- Executes dropped EXE
PID:3884 -
\??\c:\lffxxff.exec:\lffxxff.exe31⤵
- Executes dropped EXE
PID:4332 -
\??\c:\nbthtb.exec:\nbthtb.exe32⤵
- Executes dropped EXE
PID:3188 -
\??\c:\pjjjj.exec:\pjjjj.exe33⤵
- Executes dropped EXE
PID:2028 -
\??\c:\rxfxlll.exec:\rxfxlll.exe34⤵
- Executes dropped EXE
PID:2452 -
\??\c:\flxrxxr.exec:\flxrxxr.exe35⤵
- Executes dropped EXE
PID:4192 -
\??\c:\9tbhtt.exec:\9tbhtt.exe36⤵
- Executes dropped EXE
PID:1168 -
\??\c:\3djdd.exec:\3djdd.exe37⤵
- Executes dropped EXE
PID:1292 -
\??\c:\lxxrlll.exec:\lxxrlll.exe38⤵
- Executes dropped EXE
PID:4936 -
\??\c:\5fllflr.exec:\5fllflr.exe39⤵
- Executes dropped EXE
PID:4644 -
\??\c:\tbhhhn.exec:\tbhhhn.exe40⤵
- Executes dropped EXE
PID:980 -
\??\c:\bbnttt.exec:\bbnttt.exe41⤵
- Executes dropped EXE
PID:4296 -
\??\c:\7jpjp.exec:\7jpjp.exe42⤵
- Executes dropped EXE
PID:468 -
\??\c:\ddjvj.exec:\ddjvj.exe43⤵
- Executes dropped EXE
PID:3556 -
\??\c:\fxrfrlf.exec:\fxrfrlf.exe44⤵
- Executes dropped EXE
PID:2328 -
\??\c:\flfffxr.exec:\flfffxr.exe45⤵
- Executes dropped EXE
PID:1608 -
\??\c:\5tbtnh.exec:\5tbtnh.exe46⤵
- Executes dropped EXE
PID:3448 -
\??\c:\7vjjj.exec:\7vjjj.exe47⤵
- Executes dropped EXE
PID:4520 -
\??\c:\jvvpd.exec:\jvvpd.exe48⤵
- Executes dropped EXE
PID:4092 -
\??\c:\lffxllf.exec:\lffxllf.exe49⤵
- Executes dropped EXE
PID:3456 -
\??\c:\9ntnbn.exec:\9ntnbn.exe50⤵
- Executes dropped EXE
PID:1624 -
\??\c:\pjdvj.exec:\pjdvj.exe51⤵
- Executes dropped EXE
PID:4940 -
\??\c:\7flxlfx.exec:\7flxlfx.exe52⤵
- Executes dropped EXE
PID:2316 -
\??\c:\xxxrlfx.exec:\xxxrlfx.exe53⤵
- Executes dropped EXE
PID:4676 -
\??\c:\bnhbhb.exec:\bnhbhb.exe54⤵
- Executes dropped EXE
PID:4300 -
\??\c:\hhhhbb.exec:\hhhhbb.exe55⤵
- Executes dropped EXE
PID:2948 -
\??\c:\dpvjj.exec:\dpvjj.exe56⤵
- Executes dropped EXE
PID:1080 -
\??\c:\fxrlflf.exec:\fxrlflf.exe57⤵
- Executes dropped EXE
PID:3064 -
\??\c:\1flffxr.exec:\1flffxr.exe58⤵
- Executes dropped EXE
PID:1000 -
\??\c:\1tnhbt.exec:\1tnhbt.exe59⤵
- Executes dropped EXE
PID:4556 -
\??\c:\dvpdp.exec:\dvpdp.exe60⤵
- Executes dropped EXE
PID:5016 -
\??\c:\vjddv.exec:\vjddv.exe61⤵
- Executes dropped EXE
PID:4908 -
\??\c:\7ffllrr.exec:\7ffllrr.exe62⤵
- Executes dropped EXE
PID:1776 -
\??\c:\9tnhbb.exec:\9tnhbb.exe63⤵
- Executes dropped EXE
PID:1344 -
\??\c:\hhbbnh.exec:\hhbbnh.exe64⤵
- Executes dropped EXE
PID:860 -
\??\c:\pppdj.exec:\pppdj.exe65⤵
- Executes dropped EXE
PID:4084 -
\??\c:\7ddvj.exec:\7ddvj.exe66⤵PID:3444
-
\??\c:\rrrlxrr.exec:\rrrlxrr.exe67⤵PID:4392
-
\??\c:\nhtnth.exec:\nhtnth.exe68⤵PID:1760
-
\??\c:\vvdpj.exec:\vvdpj.exe69⤵PID:388
-
\??\c:\1pjjd.exec:\1pjjd.exe70⤵PID:4680
-
\??\c:\lxxfffr.exec:\lxxfffr.exe71⤵PID:1412
-
\??\c:\tbhttb.exec:\tbhttb.exe72⤵PID:4432
-
\??\c:\5ppjd.exec:\5ppjd.exe73⤵PID:3208
-
\??\c:\5lfxrlf.exec:\5lfxrlf.exe74⤵PID:3808
-
\??\c:\bthbhb.exec:\bthbhb.exe75⤵PID:980
-
\??\c:\5thbtt.exec:\5thbtt.exe76⤵PID:2800
-
\??\c:\pjjjp.exec:\pjjjp.exe77⤵PID:468
-
\??\c:\7vddp.exec:\7vddp.exe78⤵PID:928
-
\??\c:\frffrlf.exec:\frffrlf.exe79⤵PID:4968
-
\??\c:\nhnhbb.exec:\nhnhbb.exe80⤵PID:3568
-
\??\c:\vpppj.exec:\vpppj.exe81⤵PID:4360
-
\??\c:\xxrrllf.exec:\xxrrllf.exe82⤵PID:880
-
\??\c:\hntntt.exec:\hntntt.exe83⤵PID:3628
-
\??\c:\vvpdv.exec:\vvpdv.exe84⤵PID:8
-
\??\c:\pdpvp.exec:\pdpvp.exe85⤵PID:1256
-
\??\c:\lrrlrlr.exec:\lrrlrlr.exe86⤵PID:2960
-
\??\c:\7xlfllf.exec:\7xlfllf.exe87⤵PID:2720
-
\??\c:\ttttnn.exec:\ttttnn.exe88⤵PID:2060
-
\??\c:\dvdvp.exec:\dvdvp.exe89⤵PID:4472
-
\??\c:\dvpjd.exec:\dvpjd.exe90⤵PID:4264
-
\??\c:\fflxllf.exec:\fflxllf.exe91⤵PID:1268
-
\??\c:\7lrlfxf.exec:\7lrlfxf.exe92⤵PID:4580
-
\??\c:\7tbthh.exec:\7tbthh.exe93⤵PID:5112
-
\??\c:\1vvpj.exec:\1vvpj.exe94⤵PID:4804
-
\??\c:\rxxxrll.exec:\rxxxrll.exe95⤵PID:2372
-
\??\c:\lfrrfxl.exec:\lfrrfxl.exe96⤵PID:3172
-
\??\c:\ttnhbb.exec:\ttnhbb.exe97⤵PID:1164
-
\??\c:\tttthh.exec:\tttthh.exe98⤵PID:4396
-
\??\c:\vddpj.exec:\vddpj.exe99⤵PID:4084
-
\??\c:\lffxlrl.exec:\lffxlrl.exe100⤵PID:404
-
\??\c:\bttnnn.exec:\bttnnn.exe101⤵PID:2516
-
\??\c:\hhhhbn.exec:\hhhhbn.exe102⤵PID:1468
-
\??\c:\1vvpj.exec:\1vvpj.exe103⤵PID:1064
-
\??\c:\dddvv.exec:\dddvv.exe104⤵PID:888
-
\??\c:\7lrrllf.exec:\7lrrllf.exe105⤵PID:3540
-
\??\c:\1ttnnn.exec:\1ttnnn.exe106⤵PID:4036
-
\??\c:\vppdp.exec:\vppdp.exe107⤵PID:2288
-
\??\c:\7jvjv.exec:\7jvjv.exe108⤵PID:3712
-
\??\c:\lxrlxrr.exec:\lxrlxrr.exe109⤵PID:1600
-
\??\c:\hnnhbt.exec:\hnnhbt.exe110⤵PID:4668
-
\??\c:\jvvjj.exec:\jvvjj.exe111⤵PID:2860
-
\??\c:\3vvpj.exec:\3vvpj.exe112⤵PID:2564
-
\??\c:\3rrfrlf.exec:\3rrfrlf.exe113⤵PID:3972
-
\??\c:\rllfxxl.exec:\rllfxxl.exe114⤵PID:5096
-
\??\c:\nthbnh.exec:\nthbnh.exe115⤵PID:1352
-
\??\c:\3nhbnh.exec:\3nhbnh.exe116⤵PID:4532
-
\??\c:\jjjjv.exec:\jjjjv.exe117⤵PID:1800
-
\??\c:\frxxrlr.exec:\frxxrlr.exe118⤵PID:372
-
\??\c:\1rrlfxr.exec:\1rrlfxr.exe119⤵PID:2316
-
\??\c:\nhbtnn.exec:\nhbtnn.exe120⤵PID:3660
-
\??\c:\htbtnn.exec:\htbtnn.exe121⤵PID:4996
-
\??\c:\btthtn.exec:\btthtn.exe122⤵PID:4620
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-