Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
29/05/2024, 22:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
59683eb4e20a5e9cc34b5a6e73bab890_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
- Target 59683eb4e20a5e9cc34b5a6e73bab890_NeikiAnalytics.exe
- Size 443KB
- Sample240529-2x79daea47
- SHA256 ab5044ad07b931843b970a2640ecb9a8c65e1cfe16a1dfefa53c0bde34190af6
- MD5 59683eb4e20a5e9cc34b5a6e73bab890
- SHA1 44de35f12505c2a7a3a03184ae2b26cb6aa4b014
- SHA512 e7d262363d694d45a4990a61782616d514c7fafed8a332d78c7d2d56dd51282c28a8214fd2665f55c5880307ca113331f9cf044b1b3366ab5b1d58cf2f2a6432
- SSDEEP 6144:n3C9BRo7tvnJ9Fywhk/T4i37K3BoKg0p5WI09J8:n3C9ytvn8whkb4i3e3GFO6J8
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/4224-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2404-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1628-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5012-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3340-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4304-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4752-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4212-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2592-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2640-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/752-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1828-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/804-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2780-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3956-80-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3956-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1768-67-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1768-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4356-60-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4356-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2280-53-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2280-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1820-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4788-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4912-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 4912 thbbnb.exe 2404 vdpjd.exe 4348 rrxrrll.exe 1820 tnbtnb.exe 4788 bbhhhn.exe 2280 djvdp.exe 4356 xrxxrrl.exe 1768 nbnhbb.exe 3692 vpdvd.exe 3956 ppvpj.exe 4756 fffxlll.exe 2780 hhnnhh.exe 804 bhtnhh.exe 1828 5ppjj.exe 752 rlxxrxx.exe 4564 lxffxxx.exe 2640 bthhbb.exe 2592 7djjd.exe 3356 ffffflf.exe 4212 1rfxxll.exe 1932 bttttt.exe 1380 jvdvv.exe 4752 fxfxffr.exe 4304 rlrxrrl.exe 3340 nhbbhh.exe 5012 pjjjd.exe 2108 7jddd.exe 3916 fxfffff.exe 1628 hnbttn.exe 3640 pjjpv.exe 1740 jvppv.exe 4312 lxlfxxr.exe 4092 nhhtnh.exe 2896 tnttbh.exe 4712 3ppjd.exe 3472 fxfffxl.exe 1648 lxlfxxr.exe 2332 nnthbh.exe 3672 pvdvj.exe 2264 xllxrlr.exe 4968 lffxxxr.exe 3440 nbhbbt.exe 4556 jddvv.exe 4364 5vpjd.exe 1168 1xlfxxr.exe 4848 hbhbnh.exe 3112 vvddd.exe 3060 rfrrlrr.exe 2360 xxxfffl.exe 1552 bhnhhb.exe 3624 5pvpj.exe 4904 fxlfffx.exe 4920 rrrrrlr.exe 4932 bbhbbb.exe 3736 pppdj.exe 1800 lxlxlfl.exe 1560 7hnhbb.exe 2536 hbhnht.exe 4564 jdvvv.exe 2640 lffrlfx.exe 4596 ntnnnt.exe 2248 nhttnn.exe 3576 pppvp.exe 4592 3flllrx.exe -
resource yara_rule behavioral2/memory/4224-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2404-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1628-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5012-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3340-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4304-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4212-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2592-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2640-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/752-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1828-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/804-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2780-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3956-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1768-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1820-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2404-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-11-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4224 wrote to memory of 4912 4224 59683eb4e20a5e9cc34b5a6e73bab890_NeikiAnalytics.exe 82 PID 4224 wrote to memory of 4912 4224 59683eb4e20a5e9cc34b5a6e73bab890_NeikiAnalytics.exe 82 PID 4224 wrote to memory of 4912 4224 59683eb4e20a5e9cc34b5a6e73bab890_NeikiAnalytics.exe 82 PID 4912 wrote to memory of 2404 4912 thbbnb.exe 83 PID 4912 wrote to memory of 2404 4912 thbbnb.exe 83 PID 4912 wrote to memory of 2404 4912 thbbnb.exe 83 PID 2404 wrote to memory of 4348 2404 vdpjd.exe 84 PID 2404 wrote to memory of 4348 2404 vdpjd.exe 84 PID 2404 wrote to memory of 4348 2404 vdpjd.exe 84 PID 4348 wrote to memory of 1820 4348 rrxrrll.exe 85 PID 4348 wrote to memory of 1820 4348 rrxrrll.exe 85 PID 4348 wrote to memory of 1820 4348 rrxrrll.exe 85 PID 1820 wrote to memory of 4788 1820 tnbtnb.exe 86 PID 1820 wrote to memory of 4788 1820 tnbtnb.exe 86 PID 1820 wrote to memory of 4788 1820 tnbtnb.exe 86 PID 4788 wrote to memory of 2280 4788 bbhhhn.exe 87 PID 4788 wrote to memory of 2280 4788 bbhhhn.exe 87 PID 4788 wrote to memory of 2280 4788 bbhhhn.exe 87 PID 2280 wrote to memory of 4356 2280 djvdp.exe 88 PID 2280 wrote to memory of 4356 2280 djvdp.exe 88 PID 2280 wrote to memory of 4356 2280 djvdp.exe 88 PID 4356 wrote to memory of 1768 4356 xrxxrrl.exe 89 PID 4356 wrote to memory of 1768 4356 xrxxrrl.exe 89 PID 4356 wrote to memory of 1768 4356 xrxxrrl.exe 89 PID 1768 wrote to memory of 3692 1768 nbnhbb.exe 90 PID 1768 wrote to memory of 3692 1768 nbnhbb.exe 90 PID 1768 wrote to memory of 3692 1768 nbnhbb.exe 90 PID 3692 wrote to memory of 3956 3692 vpdvd.exe 91 PID 3692 wrote to memory of 3956 3692 vpdvd.exe 91 PID 3692 wrote to memory of 3956 3692 vpdvd.exe 91 PID 3956 wrote to memory of 4756 3956 ppvpj.exe 92 PID 3956 wrote to memory of 4756 3956 ppvpj.exe 92 PID 3956 wrote to memory of 4756 3956 ppvpj.exe 92 PID 4756 wrote to memory of 2780 4756 fffxlll.exe 93 PID 4756 wrote to memory of 2780 4756 fffxlll.exe 93 PID 4756 wrote to memory of 2780 4756 fffxlll.exe 93 PID 2780 wrote to memory of 804 2780 hhnnhh.exe 94 PID 2780 wrote to memory of 804 2780 hhnnhh.exe 94 PID 2780 wrote to memory of 804 2780 hhnnhh.exe 94 PID 804 wrote to memory of 1828 804 bhtnhh.exe 95 PID 804 wrote to memory of 1828 804 bhtnhh.exe 95 PID 804 wrote to memory of 1828 804 bhtnhh.exe 95 PID 1828 wrote to memory of 752 1828 5ppjj.exe 96 PID 1828 wrote to memory of 752 1828 5ppjj.exe 96 PID 1828 wrote to memory of 752 1828 5ppjj.exe 96 PID 752 wrote to memory of 4564 752 rlxxrxx.exe 97 PID 752 wrote to memory of 4564 752 rlxxrxx.exe 97 PID 752 wrote to memory of 4564 752 rlxxrxx.exe 97 PID 4564 wrote to memory of 2640 4564 lxffxxx.exe 98 PID 4564 wrote to memory of 2640 4564 lxffxxx.exe 98 PID 4564 wrote to memory of 2640 4564 lxffxxx.exe 98 PID 2640 wrote to memory of 2592 2640 bthhbb.exe 99 PID 2640 wrote to memory of 2592 2640 bthhbb.exe 99 PID 2640 wrote to memory of 2592 2640 bthhbb.exe 99 PID 2592 wrote to memory of 3356 2592 7djjd.exe 100 PID 2592 wrote to memory of 3356 2592 7djjd.exe 100 PID 2592 wrote to memory of 3356 2592 7djjd.exe 100 PID 3356 wrote to memory of 4212 3356 ffffflf.exe 101 PID 3356 wrote to memory of 4212 3356 ffffflf.exe 101 PID 3356 wrote to memory of 4212 3356 ffffflf.exe 101 PID 4212 wrote to memory of 1932 4212 1rfxxll.exe 102 PID 4212 wrote to memory of 1932 4212 1rfxxll.exe 102 PID 4212 wrote to memory of 1932 4212 1rfxxll.exe 102 PID 1932 wrote to memory of 1380 1932 bttttt.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\59683eb4e20a5e9cc34b5a6e73bab890_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\59683eb4e20a5e9cc34b5a6e73bab890_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\thbbnb.exec:\thbbnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\vdpjd.exec:\vdpjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\rrxrrll.exec:\rrxrrll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\tnbtnb.exec:\tnbtnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\bbhhhn.exec:\bbhhhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\djvdp.exec:\djvdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\xrxxrrl.exec:\xrxxrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\nbnhbb.exec:\nbnhbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\vpdvd.exec:\vpdvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\ppvpj.exec:\ppvpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\fffxlll.exec:\fffxlll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\hhnnhh.exec:\hhnnhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\bhtnhh.exec:\bhtnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
\??\c:\5ppjj.exec:\5ppjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\rlxxrxx.exec:\rlxxrxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\lxffxxx.exec:\lxffxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\bthhbb.exec:\bthhbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\7djjd.exec:\7djjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\ffffflf.exec:\ffffflf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\1rfxxll.exec:\1rfxxll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\bttttt.exec:\bttttt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\jvdvv.exec:\jvdvv.exe23⤵
- Executes dropped EXE
PID:1380 -
\??\c:\fxfxffr.exec:\fxfxffr.exe24⤵
- Executes dropped EXE
PID:4752 -
\??\c:\rlrxrrl.exec:\rlrxrrl.exe25⤵
- Executes dropped EXE
PID:4304 -
\??\c:\nhbbhh.exec:\nhbbhh.exe26⤵
- Executes dropped EXE
PID:3340 -
\??\c:\pjjjd.exec:\pjjjd.exe27⤵
- Executes dropped EXE
PID:5012 -
\??\c:\7jddd.exec:\7jddd.exe28⤵
- Executes dropped EXE
PID:2108 -
\??\c:\fxfffff.exec:\fxfffff.exe29⤵
- Executes dropped EXE
PID:3916 -
\??\c:\hnbttn.exec:\hnbttn.exe30⤵
- Executes dropped EXE
PID:1628 -
\??\c:\pjjpv.exec:\pjjpv.exe31⤵
- Executes dropped EXE
PID:3640 -
\??\c:\jvppv.exec:\jvppv.exe32⤵
- Executes dropped EXE
PID:1740 -
\??\c:\lxlfxxr.exec:\lxlfxxr.exe33⤵
- Executes dropped EXE
PID:4312 -
\??\c:\nhhtnh.exec:\nhhtnh.exe34⤵
- Executes dropped EXE
PID:4092 -
\??\c:\tnttbh.exec:\tnttbh.exe35⤵
- Executes dropped EXE
PID:2896 -
\??\c:\3ppjd.exec:\3ppjd.exe36⤵
- Executes dropped EXE
PID:4712 -
\??\c:\fxfffxl.exec:\fxfffxl.exe37⤵
- Executes dropped EXE
PID:3472 -
\??\c:\lxlfxxr.exec:\lxlfxxr.exe38⤵
- Executes dropped EXE
PID:1648 -
\??\c:\nnthbh.exec:\nnthbh.exe39⤵
- Executes dropped EXE
PID:2332 -
\??\c:\pvdvj.exec:\pvdvj.exe40⤵
- Executes dropped EXE
PID:3672 -
\??\c:\xllxrlr.exec:\xllxrlr.exe41⤵
- Executes dropped EXE
PID:2264 -
\??\c:\lffxxxr.exec:\lffxxxr.exe42⤵
- Executes dropped EXE
PID:4968 -
\??\c:\nbhbbt.exec:\nbhbbt.exe43⤵
- Executes dropped EXE
PID:3440 -
\??\c:\jddvv.exec:\jddvv.exe44⤵
- Executes dropped EXE
PID:4556 -
\??\c:\5vpjd.exec:\5vpjd.exe45⤵
- Executes dropped EXE
PID:4364 -
\??\c:\1xlfxxr.exec:\1xlfxxr.exe46⤵
- Executes dropped EXE
PID:1168 -
\??\c:\hbhbnh.exec:\hbhbnh.exe47⤵
- Executes dropped EXE
PID:4848 -
\??\c:\vvddd.exec:\vvddd.exe48⤵
- Executes dropped EXE
PID:3112 -
\??\c:\rfrrlrr.exec:\rfrrlrr.exe49⤵
- Executes dropped EXE
PID:3060 -
\??\c:\xxxfffl.exec:\xxxfffl.exe50⤵
- Executes dropped EXE
PID:2360 -
\??\c:\bhnhhb.exec:\bhnhhb.exe51⤵
- Executes dropped EXE
PID:1552 -
\??\c:\5pvpj.exec:\5pvpj.exe52⤵
- Executes dropped EXE
PID:3624 -
\??\c:\fxlfffx.exec:\fxlfffx.exe53⤵
- Executes dropped EXE
PID:4904 -
\??\c:\rrrrrlr.exec:\rrrrrlr.exe54⤵
- Executes dropped EXE
PID:4920 -
\??\c:\bbhbbb.exec:\bbhbbb.exe55⤵
- Executes dropped EXE
PID:4932 -
\??\c:\pppdj.exec:\pppdj.exe56⤵
- Executes dropped EXE
PID:3736 -
\??\c:\lxlxlfl.exec:\lxlxlfl.exe57⤵
- Executes dropped EXE
PID:1800 -
\??\c:\7hnhbb.exec:\7hnhbb.exe58⤵
- Executes dropped EXE
PID:1560 -
\??\c:\hbhnht.exec:\hbhnht.exe59⤵
- Executes dropped EXE
PID:2536 -
\??\c:\jdvvv.exec:\jdvvv.exe60⤵
- Executes dropped EXE
PID:4564 -
\??\c:\lffrlfx.exec:\lffrlfx.exe61⤵
- Executes dropped EXE
PID:2640 -
\??\c:\ntnnnt.exec:\ntnnnt.exe62⤵
- Executes dropped EXE
PID:4596 -
\??\c:\nhttnn.exec:\nhttnn.exe63⤵
- Executes dropped EXE
PID:2248 -
\??\c:\pppvp.exec:\pppvp.exe64⤵
- Executes dropped EXE
PID:3576 -
\??\c:\3flllrx.exec:\3flllrx.exe65⤵
- Executes dropped EXE
PID:4592 -
\??\c:\3hbbhn.exec:\3hbbhn.exe66⤵PID:3788
-
\??\c:\tnhbbb.exec:\tnhbbb.exe67⤵PID:2392
-
\??\c:\jjppp.exec:\jjppp.exe68⤵PID:2192
-
\??\c:\rfrrrxr.exec:\rfrrrxr.exe69⤵PID:4796
-
\??\c:\httttb.exec:\httttb.exe70⤵PID:4656
-
\??\c:\llrlllr.exec:\llrlllr.exe71⤵PID:1628
-
\??\c:\9vddp.exec:\9vddp.exe72⤵PID:2096
-
\??\c:\jddvp.exec:\jddvp.exe73⤵PID:376
-
\??\c:\rlfrfxx.exec:\rlfrfxx.exe74⤵PID:3140
-
\??\c:\htbtnn.exec:\htbtnn.exe75⤵PID:1004
-
\??\c:\ppvpv.exec:\ppvpv.exe76⤵PID:680
-
\??\c:\llrffxf.exec:\llrffxf.exe77⤵PID:3396
-
\??\c:\ntbtnn.exec:\ntbtnn.exe78⤵PID:3056
-
\??\c:\ddddv.exec:\ddddv.exe79⤵PID:1048
-
\??\c:\flxxxxf.exec:\flxxxxf.exe80⤵PID:4160
-
\??\c:\lrxxxff.exec:\lrxxxff.exe81⤵PID:3992
-
\??\c:\nttnnn.exec:\nttnnn.exe82⤵PID:5100
-
\??\c:\pvddv.exec:\pvddv.exe83⤵PID:3600
-
\??\c:\rlfllll.exec:\rlfllll.exe84⤵PID:744
-
\??\c:\nnhhbt.exec:\nnhhbt.exe85⤵PID:4236
-
\??\c:\jpdvv.exec:\jpdvv.exe86⤵PID:3320
-
\??\c:\fxfxffl.exec:\fxfxffl.exe87⤵PID:2880
-
\??\c:\lffxrrf.exec:\lffxrrf.exe88⤵PID:1192
-
\??\c:\9ttnnt.exec:\9ttnnt.exe89⤵PID:4960
-
\??\c:\ppddd.exec:\ppddd.exe90⤵PID:2092
-
\??\c:\fxffllx.exec:\fxffllx.exe91⤵PID:2360
-
\??\c:\9pvvv.exec:\9pvvv.exe92⤵PID:3392
-
\??\c:\ddjjj.exec:\ddjjj.exe93⤵PID:1548
-
\??\c:\1xxfffl.exec:\1xxfffl.exe94⤵PID:4904
-
\??\c:\ttnhnn.exec:\ttnhnn.exe95⤵PID:4648
-
\??\c:\vjddv.exec:\vjddv.exe96⤵PID:916
-
\??\c:\rrrrrrr.exec:\rrrrrrr.exe97⤵PID:2060
-
\??\c:\hhbbhh.exec:\hhbbhh.exe98⤵PID:4128
-
\??\c:\jdddd.exec:\jdddd.exe99⤵PID:3684
-
\??\c:\vjvpj.exec:\vjvpj.exe100⤵PID:532
-
\??\c:\xflfxxr.exec:\xflfxxr.exe101⤵PID:5016
-
\??\c:\frfffff.exec:\frfffff.exe102⤵PID:4596
-
\??\c:\7bhhhh.exec:\7bhhhh.exe103⤵PID:1828
-
\??\c:\pdppp.exec:\pdppp.exe104⤵PID:856
-
\??\c:\9jjdv.exec:\9jjdv.exe105⤵PID:2272
-
\??\c:\flxxxfx.exec:\flxxxfx.exe106⤵PID:4976
-
\??\c:\bhhnhh.exec:\bhhnhh.exe107⤵PID:1116
-
\??\c:\tnnnhh.exec:\tnnnhh.exe108⤵PID:668
-
\??\c:\jdppp.exec:\jdppp.exe109⤵PID:1412
-
\??\c:\frrrxff.exec:\frrrxff.exe110⤵PID:3596
-
\??\c:\bbhbtt.exec:\bbhbtt.exe111⤵PID:2624
-
\??\c:\tbbbbb.exec:\tbbbbb.exe112⤵PID:4560
-
\??\c:\3pppp.exec:\3pppp.exe113⤵PID:4144
-
\??\c:\7jpjv.exec:\7jpjv.exe114⤵PID:448
-
\??\c:\rlrlffx.exec:\rlrlffx.exe115⤵PID:4872
-
\??\c:\nhhhbb.exec:\nhhhbb.exe116⤵PID:2280
-
\??\c:\thnhbh.exec:\thnhbh.exe117⤵PID:3996
-
\??\c:\ddddd.exec:\ddddd.exe118⤵PID:1628
-
\??\c:\fxxxrxr.exec:\fxxxrxr.exe119⤵PID:696
-
\??\c:\lrlllfr.exec:\lrlllfr.exe120⤵PID:376
-
\??\c:\hthhhb.exec:\hthhhb.exe121⤵PID:2244
-
\??\c:\ddvvv.exec:\ddvvv.exe122⤵PID:2836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-