Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/05/2024, 19:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
10576250f3bca1089e6277e9e44ecb30_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
10576250f3bca1089e6277e9e44ecb30_NeikiAnalytics.exe
-
Size
66KB
-
MD5
10576250f3bca1089e6277e9e44ecb30
-
SHA1
b320daf96da6c4a165e181407028ced066016f9b
-
SHA256
f714f902b143b780e5d2a433fd664ef8e99d649f50f7a0ce5aa7427a6277e9f4
-
SHA512
b78839afc98e0f3ad2665fe233ad68e4c05d1930f6f97b2a3bc3c72f9e362e147eaaf8a77181ff0ad284c5b50dfccd2dd44389d520695353a39b2c3087f0d58a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6Mu/ePS3AyXmcz:ymb3NkkiQ3mdBjFI46TQyXmcz
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/8-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4436-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3068-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3344-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2800-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3372-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4576-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4404-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4540-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3720-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2308-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4000-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4256-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2092-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1036-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1080-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1492-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/536-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2448-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3088-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2396-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3796-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/844-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4592 5xrfrlf.exe 2308 lflrlll.exe 4436 9tnnhh.exe 3720 9ntbtt.exe 4540 djpvp.exe 3068 9lllllf.exe 3344 rfffxrl.exe 2800 tnbnht.exe 3372 hhhhnt.exe 1192 vvvpj.exe 4836 lflrrxf.exe 4576 xrffrrf.exe 4404 nbnhtt.exe 4000 jvpjd.exe 2940 7ddvj.exe 4256 7xrrffx.exe 4500 tnbtht.exe 2092 1vdvd.exe 1036 flllffx.exe 1080 ttbbbt.exe 4060 ttnbth.exe 1492 jpvvv.exe 536 fffrllf.exe 4464 fflffxf.exe 2448 tbbbnh.exe 3088 vvvpp.exe 5004 5xrlxfx.exe 2396 hbtnhh.exe 3796 vpvdd.exe 844 1xxxxff.exe 5056 hhhnnn.exe 3880 9ntttb.exe 4684 1pvdd.exe 3544 jvjjv.exe 4008 1lrrlrl.exe 3296 3hhnnn.exe 3600 7hnhtb.exe 3304 vdvpv.exe 4084 pjpvd.exe 3224 ffrlxrl.exe 2008 ffxfxxr.exe 456 1httbb.exe 860 jdddd.exe 2752 ddppp.exe 2132 xrlrfff.exe 2868 xrfxxxx.exe 3572 rfrrlrx.exe 3720 bbnthn.exe 4080 pvppd.exe 3324 pdppj.exe 4372 fflfrll.exe 1632 thhhbh.exe 4272 dvjjj.exe 1360 7xllrrf.exe 1900 1bnnnt.exe 1032 7hhhbh.exe 4640 pvjpp.exe 4000 jdppp.exe 2940 xxxrxxx.exe 4524 rxrllrl.exe 3400 ttbhhn.exe 3164 hbnnnn.exe 2504 pppdd.exe 1948 djvvv.exe -
resource yara_rule behavioral2/memory/8-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4436-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3068-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3344-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2800-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3372-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4576-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4404-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4540-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3720-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4000-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4256-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2092-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1036-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1080-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1492-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/536-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2448-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2396-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3796-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/844-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 8 wrote to memory of 4592 8 10576250f3bca1089e6277e9e44ecb30_NeikiAnalytics.exe 83 PID 8 wrote to memory of 4592 8 10576250f3bca1089e6277e9e44ecb30_NeikiAnalytics.exe 83 PID 8 wrote to memory of 4592 8 10576250f3bca1089e6277e9e44ecb30_NeikiAnalytics.exe 83 PID 4592 wrote to memory of 2308 4592 5xrfrlf.exe 84 PID 4592 wrote to memory of 2308 4592 5xrfrlf.exe 84 PID 4592 wrote to memory of 2308 4592 5xrfrlf.exe 84 PID 2308 wrote to memory of 4436 2308 lflrlll.exe 85 PID 2308 wrote to memory of 4436 2308 lflrlll.exe 85 PID 2308 wrote to memory of 4436 2308 lflrlll.exe 85 PID 4436 wrote to memory of 3720 4436 9tnnhh.exe 86 PID 4436 wrote to memory of 3720 4436 9tnnhh.exe 86 PID 4436 wrote to memory of 3720 4436 9tnnhh.exe 86 PID 3720 wrote to memory of 4540 3720 9ntbtt.exe 87 PID 3720 wrote to memory of 4540 3720 9ntbtt.exe 87 PID 3720 wrote to memory of 4540 3720 9ntbtt.exe 87 PID 4540 wrote to memory of 3068 4540 djpvp.exe 88 PID 4540 wrote to memory of 3068 4540 djpvp.exe 88 PID 4540 wrote to memory of 3068 4540 djpvp.exe 88 PID 3068 wrote to memory of 3344 3068 9lllllf.exe 89 PID 3068 wrote to memory of 3344 3068 9lllllf.exe 89 PID 3068 wrote to memory of 3344 3068 9lllllf.exe 89 PID 3344 wrote to memory of 2800 3344 rfffxrl.exe 90 PID 3344 wrote to memory of 2800 3344 rfffxrl.exe 90 PID 3344 wrote to memory of 2800 3344 rfffxrl.exe 90 PID 2800 wrote to memory of 3372 2800 tnbnht.exe 91 PID 2800 wrote to memory of 3372 2800 tnbnht.exe 91 PID 2800 wrote to memory of 3372 2800 tnbnht.exe 91 PID 3372 wrote to memory of 1192 3372 hhhhnt.exe 92 PID 3372 wrote to memory of 1192 3372 hhhhnt.exe 92 PID 3372 wrote to memory of 1192 3372 hhhhnt.exe 92 PID 1192 wrote to memory of 4836 1192 vvvpj.exe 93 PID 1192 wrote to memory of 4836 1192 vvvpj.exe 93 PID 1192 wrote to memory of 4836 1192 vvvpj.exe 93 PID 4836 wrote to memory of 4576 4836 lflrrxf.exe 94 PID 4836 wrote to memory of 4576 4836 lflrrxf.exe 94 PID 4836 wrote to memory of 4576 4836 lflrrxf.exe 94 PID 4576 wrote to memory of 4404 4576 xrffrrf.exe 95 PID 4576 wrote to memory of 4404 4576 xrffrrf.exe 95 PID 4576 wrote to memory of 4404 4576 xrffrrf.exe 95 PID 4404 wrote to memory of 4000 4404 nbnhtt.exe 96 PID 4404 wrote to memory of 4000 4404 nbnhtt.exe 96 PID 4404 wrote to memory of 4000 4404 nbnhtt.exe 96 PID 4000 wrote to memory of 2940 4000 jvpjd.exe 97 PID 4000 wrote to memory of 2940 4000 jvpjd.exe 97 PID 4000 wrote to memory of 2940 4000 jvpjd.exe 97 PID 2940 wrote to memory of 4256 2940 7ddvj.exe 98 PID 2940 wrote to memory of 4256 2940 7ddvj.exe 98 PID 2940 wrote to memory of 4256 2940 7ddvj.exe 98 PID 4256 wrote to memory of 4500 4256 7xrrffx.exe 99 PID 4256 wrote to memory of 4500 4256 7xrrffx.exe 99 PID 4256 wrote to memory of 4500 4256 7xrrffx.exe 99 PID 4500 wrote to memory of 2092 4500 tnbtht.exe 100 PID 4500 wrote to memory of 2092 4500 tnbtht.exe 100 PID 4500 wrote to memory of 2092 4500 tnbtht.exe 100 PID 2092 wrote to memory of 1036 2092 1vdvd.exe 101 PID 2092 wrote to memory of 1036 2092 1vdvd.exe 101 PID 2092 wrote to memory of 1036 2092 1vdvd.exe 101 PID 1036 wrote to memory of 1080 1036 flllffx.exe 102 PID 1036 wrote to memory of 1080 1036 flllffx.exe 102 PID 1036 wrote to memory of 1080 1036 flllffx.exe 102 PID 1080 wrote to memory of 4060 1080 ttbbbt.exe 103 PID 1080 wrote to memory of 4060 1080 ttbbbt.exe 103 PID 1080 wrote to memory of 4060 1080 ttbbbt.exe 103 PID 4060 wrote to memory of 1492 4060 ttnbth.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\10576250f3bca1089e6277e9e44ecb30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\10576250f3bca1089e6277e9e44ecb30_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\5xrfrlf.exec:\5xrfrlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\lflrlll.exec:\lflrlll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\9tnnhh.exec:\9tnnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\9ntbtt.exec:\9ntbtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\djpvp.exec:\djpvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\9lllllf.exec:\9lllllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\rfffxrl.exec:\rfffxrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
\??\c:\tnbnht.exec:\tnbnht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\hhhhnt.exec:\hhhhnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\vvvpj.exec:\vvvpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\lflrrxf.exec:\lflrrxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\xrffrrf.exec:\xrffrrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\nbnhtt.exec:\nbnhtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\jvpjd.exec:\jvpjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\7ddvj.exec:\7ddvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\7xrrffx.exec:\7xrrffx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
\??\c:\tnbtht.exec:\tnbtht.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\1vdvd.exec:\1vdvd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\flllffx.exec:\flllffx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\ttbbbt.exec:\ttbbbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\ttnbth.exec:\ttnbth.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\jpvvv.exec:\jpvvv.exe23⤵
- Executes dropped EXE
PID:1492 -
\??\c:\fffrllf.exec:\fffrllf.exe24⤵
- Executes dropped EXE
PID:536 -
\??\c:\fflffxf.exec:\fflffxf.exe25⤵
- Executes dropped EXE
PID:4464 -
\??\c:\tbbbnh.exec:\tbbbnh.exe26⤵
- Executes dropped EXE
PID:2448 -
\??\c:\vvvpp.exec:\vvvpp.exe27⤵
- Executes dropped EXE
PID:3088 -
\??\c:\5xrlxfx.exec:\5xrlxfx.exe28⤵
- Executes dropped EXE
PID:5004 -
\??\c:\hbtnhh.exec:\hbtnhh.exe29⤵
- Executes dropped EXE
PID:2396 -
\??\c:\vpvdd.exec:\vpvdd.exe30⤵
- Executes dropped EXE
PID:3796 -
\??\c:\1xxxxff.exec:\1xxxxff.exe31⤵
- Executes dropped EXE
PID:844 -
\??\c:\hhhnnn.exec:\hhhnnn.exe32⤵
- Executes dropped EXE
PID:5056 -
\??\c:\9ntttb.exec:\9ntttb.exe33⤵
- Executes dropped EXE
PID:3880 -
\??\c:\1pvdd.exec:\1pvdd.exe34⤵
- Executes dropped EXE
PID:4684 -
\??\c:\jvjjv.exec:\jvjjv.exe35⤵
- Executes dropped EXE
PID:3544 -
\??\c:\1lrrlrl.exec:\1lrrlrl.exe36⤵
- Executes dropped EXE
PID:4008 -
\??\c:\3hhnnn.exec:\3hhnnn.exe37⤵
- Executes dropped EXE
PID:3296 -
\??\c:\7hnhtb.exec:\7hnhtb.exe38⤵
- Executes dropped EXE
PID:3600 -
\??\c:\vdvpv.exec:\vdvpv.exe39⤵
- Executes dropped EXE
PID:3304 -
\??\c:\pjpvd.exec:\pjpvd.exe40⤵
- Executes dropped EXE
PID:4084 -
\??\c:\ffrlxrl.exec:\ffrlxrl.exe41⤵
- Executes dropped EXE
PID:3224 -
\??\c:\ffxfxxr.exec:\ffxfxxr.exe42⤵
- Executes dropped EXE
PID:2008 -
\??\c:\1httbb.exec:\1httbb.exe43⤵
- Executes dropped EXE
PID:456 -
\??\c:\jdddd.exec:\jdddd.exe44⤵
- Executes dropped EXE
PID:860 -
\??\c:\ddppp.exec:\ddppp.exe45⤵
- Executes dropped EXE
PID:2752 -
\??\c:\xrlrfff.exec:\xrlrfff.exe46⤵
- Executes dropped EXE
PID:2132 -
\??\c:\xrfxxxx.exec:\xrfxxxx.exe47⤵
- Executes dropped EXE
PID:2868 -
\??\c:\rfrrlrx.exec:\rfrrlrx.exe48⤵
- Executes dropped EXE
PID:3572 -
\??\c:\bbnthn.exec:\bbnthn.exe49⤵
- Executes dropped EXE
PID:3720 -
\??\c:\pvppd.exec:\pvppd.exe50⤵
- Executes dropped EXE
PID:4080 -
\??\c:\pdppj.exec:\pdppj.exe51⤵
- Executes dropped EXE
PID:3324 -
\??\c:\fflfrll.exec:\fflfrll.exe52⤵
- Executes dropped EXE
PID:4372 -
\??\c:\thhhbh.exec:\thhhbh.exe53⤵
- Executes dropped EXE
PID:1632 -
\??\c:\dvjjj.exec:\dvjjj.exe54⤵
- Executes dropped EXE
PID:4272 -
\??\c:\7xllrrf.exec:\7xllrrf.exe55⤵
- Executes dropped EXE
PID:1360 -
\??\c:\1bnnnt.exec:\1bnnnt.exe56⤵
- Executes dropped EXE
PID:1900 -
\??\c:\7hhhbh.exec:\7hhhbh.exe57⤵
- Executes dropped EXE
PID:1032 -
\??\c:\pvjpp.exec:\pvjpp.exe58⤵
- Executes dropped EXE
PID:4640 -
\??\c:\jdppp.exec:\jdppp.exe59⤵
- Executes dropped EXE
PID:4000 -
\??\c:\xxxrxxx.exec:\xxxrxxx.exe60⤵
- Executes dropped EXE
PID:2940 -
\??\c:\rxrllrl.exec:\rxrllrl.exe61⤵
- Executes dropped EXE
PID:4524 -
\??\c:\ttbhhn.exec:\ttbhhn.exe62⤵
- Executes dropped EXE
PID:3400 -
\??\c:\hbnnnn.exec:\hbnnnn.exe63⤵
- Executes dropped EXE
PID:3164 -
\??\c:\pppdd.exec:\pppdd.exe64⤵
- Executes dropped EXE
PID:2504 -
\??\c:\djvvv.exec:\djvvv.exe65⤵
- Executes dropped EXE
PID:1948 -
\??\c:\xrllffr.exec:\xrllffr.exe66⤵PID:4992
-
\??\c:\lfflrxx.exec:\lfflrxx.exe67⤵PID:1956
-
\??\c:\rlxllll.exec:\rlxllll.exe68⤵PID:3116
-
\??\c:\hhhhnn.exec:\hhhhnn.exe69⤵PID:1056
-
\??\c:\nttbbh.exec:\nttbbh.exe70⤵PID:2588
-
\??\c:\vdddd.exec:\vdddd.exe71⤵PID:3520
-
\??\c:\vvvpv.exec:\vvvpv.exe72⤵PID:2448
-
\??\c:\rlrxxff.exec:\rlrxxff.exe73⤵PID:2124
-
\??\c:\fflxxxx.exec:\fflxxxx.exe74⤵PID:5068
-
\??\c:\hthhhn.exec:\hthhhn.exe75⤵PID:3060
-
\??\c:\3nttnn.exec:\3nttnn.exe76⤵PID:3320
-
\??\c:\jjppv.exec:\jjppv.exe77⤵PID:3020
-
\??\c:\pvvvv.exec:\pvvvv.exe78⤵PID:2528
-
\??\c:\fxfllll.exec:\fxfllll.exe79⤵PID:3508
-
\??\c:\fflllxx.exec:\fflllxx.exe80⤵PID:4392
-
\??\c:\bhnttt.exec:\bhnttt.exe81⤵PID:4832
-
\??\c:\bhhhbb.exec:\bhhhbb.exe82⤵PID:3404
-
\??\c:\hthbhh.exec:\hthbhh.exe83⤵PID:2432
-
\??\c:\jpvvp.exec:\jpvvp.exe84⤵PID:616
-
\??\c:\5vddv.exec:\5vddv.exe85⤵PID:4440
-
\??\c:\pdjjd.exec:\pdjjd.exe86⤵PID:5008
-
\??\c:\llrrflx.exec:\llrrflx.exe87⤵PID:2156
-
\??\c:\xxrrfff.exec:\xxrrfff.exe88⤵PID:4160
-
\??\c:\nhhnnt.exec:\nhhnnt.exe89⤵PID:2492
-
\??\c:\tbbbtb.exec:\tbbbtb.exe90⤵PID:2008
-
\??\c:\vpjjj.exec:\vpjjj.exe91⤵PID:3196
-
\??\c:\xxffrxx.exec:\xxffrxx.exe92⤵PID:860
-
\??\c:\ffrlflr.exec:\ffrlflr.exe93⤵PID:2752
-
\??\c:\7ttnnn.exec:\7ttnnn.exe94⤵PID:4036
-
\??\c:\ttttth.exec:\ttttth.exe95⤵PID:1724
-
\??\c:\ttntnt.exec:\ttntnt.exe96⤵PID:4064
-
\??\c:\vvvvp.exec:\vvvvp.exe97⤵PID:4540
-
\??\c:\lrxllxx.exec:\lrxllxx.exe98⤵PID:2872
-
\??\c:\xxrlxlx.exec:\xxrlxlx.exe99⤵PID:3324
-
\??\c:\lffrlrr.exec:\lffrlrr.exe100⤵PID:4304
-
\??\c:\7nnnnn.exec:\7nnnnn.exe101⤵PID:1908
-
\??\c:\hhnttb.exec:\hhnttb.exe102⤵PID:4272
-
\??\c:\djjdd.exec:\djjdd.exe103⤵PID:1804
-
\??\c:\jjjjd.exec:\jjjjd.exe104⤵PID:3024
-
\??\c:\ddvpj.exec:\ddvpj.exe105⤵PID:1060
-
\??\c:\9flrrxx.exec:\9flrrxx.exe106⤵PID:1900
-
\??\c:\rxfflfx.exec:\rxfflfx.exe107⤵PID:4140
-
\??\c:\bnttbb.exec:\bnttbb.exe108⤵PID:3292
-
\??\c:\nhbbbh.exec:\nhbbbh.exe109⤵PID:4256
-
\??\c:\vpppp.exec:\vpppp.exe110⤵PID:3568
-
\??\c:\ddppp.exec:\ddppp.exe111⤵PID:1488
-
\??\c:\llxrrrr.exec:\llxrrrr.exe112⤵PID:2292
-
\??\c:\rflxrrr.exec:\rflxrrr.exe113⤵PID:4904
-
\??\c:\rlrrrrf.exec:\rlrrrrf.exe114⤵PID:3312
-
\??\c:\nhnttt.exec:\nhnttt.exe115⤵PID:2020
-
\??\c:\bbtttt.exec:\bbtttt.exe116⤵PID:4060
-
\??\c:\vpdjj.exec:\vpdjj.exe117⤵PID:4108
-
\??\c:\vpjjj.exec:\vpjjj.exe118⤵PID:2640
-
\??\c:\fxllflf.exec:\fxllflf.exe119⤵PID:4464
-
\??\c:\lrflrff.exec:\lrflrff.exe120⤵PID:1364
-
\??\c:\hntbbh.exec:\hntbbh.exe121⤵PID:4180
-
\??\c:\hbhhtb.exec:\hbhhtb.exe122⤵PID:4408
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-