Analysis
- max time kernel
150s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
02/06/2024, 21:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7127bb8fa8701fa2a7f3bf87f2fcc0a0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
- Target 7127bb8fa8701fa2a7f3bf87f2fcc0a0_NeikiAnalytics.exe
- Size 67KB
- Sample240602-1t7b8she42
- SHA256 925f5c7aeedbe67baf0c9ca7811f80a69ae61c2af2b20338c32d6fb469ca96eb
- MD5 7127bb8fa8701fa2a7f3bf87f2fcc0a0
- SHA1 bfbb37652a4d7c375da480a0321fffb9c258bf81
- SHA512 a09a7cb4e530081f38771ee7013a4854c08c960b040d2508d4de3222f73015561422f2ca3e3a75c3e5fe798df82f64b0bd98eac766b2bf01d9cb89b7fbfab5aa
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLrC:ymb3NkkiQ3mdBjFIvl358nLrC
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/1780-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2408-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4496-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4980-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2400-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1336-43-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1336-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3164-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3676-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2620-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3368-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3520-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3300-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/992-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4072-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2536-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3748-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1464-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1468-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3032-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4372-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/232-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2888-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 4496 rflffff.exe 2408 vvjjp.exe 3676 jvvpp.exe 4980 frlllff.exe 1336 ffrxfll.exe 2400 thnnbn.exe 3164 tnnhnn.exe 2620 fxxxxrr.exe 3368 btbtnn.exe 3520 pjppp.exe 3300 xrlfxxr.exe 992 pjddp.exe 4072 jdjdv.exe 3772 lxxfxfx.exe 5056 hhbttn.exe 3748 5htbtb.exe 2536 jddvv.exe 5108 7xrfxxr.exe 1464 xlrrfll.exe 4424 ppddp.exe 1468 jdjjj.exe 4948 frfxrrl.exe 3032 hthbbb.exe 4864 jdjpp.exe 2252 ppddd.exe 3364 lffxrrr.exe 4372 rlllllf.exe 384 hthtnb.exe 4448 vpppd.exe 232 jdjdp.exe 2888 rfrxrxr.exe 4684 tnnnhh.exe 2512 pdjjj.exe 1820 5xffffl.exe 2996 xlxrrrr.exe 4312 hbbtnn.exe 2436 dppjv.exe 4872 5rxrrrr.exe 4408 nbbbbn.exe 1876 nnhbbb.exe 3100 3djdv.exe 3624 dpvpp.exe 3520 fxxrrrr.exe 3300 xxfflrx.exe 3148 hbhhhh.exe 2812 pvjdj.exe 3184 lllfxxr.exe 5056 rlrrrlr.exe 396 tthhbh.exe 2884 3tbbhn.exe 3420 vjppj.exe 3192 pjjpv.exe 1232 1lrrlrx.exe 3616 ntbbtt.exe 1972 nthbtt.exe 920 vjjvp.exe 2456 rrfxrrl.exe 5028 lflfxrl.exe 3168 nbhbtt.exe 4292 thhbtt.exe 4372 jdvvp.exe 3864 fxfxrrr.exe 4672 bhhhnt.exe 2624 bhhntb.exe -
resource yara_rule behavioral2/memory/1780-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2408-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4496-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2400-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1336-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3164-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3676-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3368-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3520-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3520-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3520-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3300-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/992-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4072-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2536-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3748-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1464-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1468-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4372-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/232-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-207-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1780 wrote to memory of 4496 1780 7127bb8fa8701fa2a7f3bf87f2fcc0a0_NeikiAnalytics.exe 88 PID 1780 wrote to memory of 4496 1780 7127bb8fa8701fa2a7f3bf87f2fcc0a0_NeikiAnalytics.exe 88 PID 1780 wrote to memory of 4496 1780 7127bb8fa8701fa2a7f3bf87f2fcc0a0_NeikiAnalytics.exe 88 PID 4496 wrote to memory of 2408 4496 rflffff.exe 89 PID 4496 wrote to memory of 2408 4496 rflffff.exe 89 PID 4496 wrote to memory of 2408 4496 rflffff.exe 89 PID 2408 wrote to memory of 3676 2408 vvjjp.exe 90 PID 2408 wrote to memory of 3676 2408 vvjjp.exe 90 PID 2408 wrote to memory of 3676 2408 vvjjp.exe 90 PID 3676 wrote to memory of 4980 3676 jvvpp.exe 91 PID 3676 wrote to memory of 4980 3676 jvvpp.exe 91 PID 3676 wrote to memory of 4980 3676 jvvpp.exe 91 PID 4980 wrote to memory of 1336 4980 frlllff.exe 92 PID 4980 wrote to memory of 1336 4980 frlllff.exe 92 PID 4980 wrote to memory of 1336 4980 frlllff.exe 92 PID 1336 wrote to memory of 2400 1336 ffrxfll.exe 93 PID 1336 wrote to memory of 2400 1336 ffrxfll.exe 93 PID 1336 wrote to memory of 2400 1336 ffrxfll.exe 93 PID 2400 wrote to memory of 3164 2400 thnnbn.exe 94 PID 2400 wrote to memory of 3164 2400 thnnbn.exe 94 PID 2400 wrote to memory of 3164 2400 thnnbn.exe 94 PID 3164 wrote to memory of 2620 3164 tnnhnn.exe 97 PID 3164 wrote to memory of 2620 3164 tnnhnn.exe 97 PID 3164 wrote to memory of 2620 3164 tnnhnn.exe 97 PID 2620 wrote to memory of 3368 2620 fxxxxrr.exe 98 PID 2620 wrote to memory of 3368 2620 fxxxxrr.exe 98 PID 2620 wrote to memory of 3368 2620 fxxxxrr.exe 98 PID 3368 wrote to memory of 3520 3368 btbtnn.exe 99 PID 3368 wrote to memory of 3520 3368 btbtnn.exe 99 PID 3368 wrote to memory of 3520 3368 btbtnn.exe 99 PID 3520 wrote to memory of 3300 3520 pjppp.exe 100 PID 3520 wrote to memory of 3300 3520 pjppp.exe 100 PID 3520 wrote to memory of 3300 3520 pjppp.exe 100 PID 3300 wrote to memory of 992 3300 xrlfxxr.exe 101 PID 3300 wrote to memory of 992 3300 xrlfxxr.exe 101 PID 3300 wrote to memory of 992 3300 xrlfxxr.exe 101 PID 992 wrote to memory of 4072 992 pjddp.exe 102 PID 992 wrote to memory of 4072 992 pjddp.exe 102 PID 992 wrote to memory of 4072 992 pjddp.exe 102 PID 4072 wrote to memory of 3772 4072 jdjdv.exe 103 PID 4072 wrote to memory of 3772 4072 jdjdv.exe 103 PID 4072 wrote to memory of 3772 4072 jdjdv.exe 103 PID 3772 wrote to memory of 5056 3772 lxxfxfx.exe 104 PID 3772 wrote to memory of 5056 3772 lxxfxfx.exe 104 PID 3772 wrote to memory of 5056 3772 lxxfxfx.exe 104 PID 5056 wrote to memory of 3748 5056 hhbttn.exe 105 PID 5056 wrote to memory of 3748 5056 hhbttn.exe 105 PID 5056 wrote to memory of 3748 5056 hhbttn.exe 105 PID 3748 wrote to memory of 2536 3748 5htbtb.exe 106 PID 3748 wrote to memory of 2536 3748 5htbtb.exe 106 PID 3748 wrote to memory of 2536 3748 5htbtb.exe 106 PID 2536 wrote to memory of 5108 2536 jddvv.exe 107 PID 2536 wrote to memory of 5108 2536 jddvv.exe 107 PID 2536 wrote to memory of 5108 2536 jddvv.exe 107 PID 5108 wrote to memory of 1464 5108 7xrfxxr.exe 108 PID 5108 wrote to memory of 1464 5108 7xrfxxr.exe 108 PID 5108 wrote to memory of 1464 5108 7xrfxxr.exe 108 PID 1464 wrote to memory of 4424 1464 xlrrfll.exe 109 PID 1464 wrote to memory of 4424 1464 xlrrfll.exe 109 PID 1464 wrote to memory of 4424 1464 xlrrfll.exe 109 PID 4424 wrote to memory of 1468 4424 ppddp.exe 110 PID 4424 wrote to memory of 1468 4424 ppddp.exe 110 PID 4424 wrote to memory of 1468 4424 ppddp.exe 110 PID 1468 wrote to memory of 4948 1468 jdjjj.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\7127bb8fa8701fa2a7f3bf87f2fcc0a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7127bb8fa8701fa2a7f3bf87f2fcc0a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\rflffff.exec:\rflffff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\vvjjp.exec:\vvjjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\jvvpp.exec:\jvvpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\frlllff.exec:\frlllff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\ffrxfll.exec:\ffrxfll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\thnnbn.exec:\thnnbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\tnnhnn.exec:\tnnhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\fxxxxrr.exec:\fxxxxrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\btbtnn.exec:\btbtnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\pjppp.exec:\pjppp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\xrlfxxr.exec:\xrlfxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
\??\c:\pjddp.exec:\pjddp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\jdjdv.exec:\jdjdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
\??\c:\lxxfxfx.exec:\lxxfxfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\hhbttn.exec:\hhbttn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\5htbtb.exec:\5htbtb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\jddvv.exec:\jddvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\7xrfxxr.exec:\7xrfxxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\xlrrfll.exec:\xlrrfll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\ppddp.exec:\ppddp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\jdjjj.exec:\jdjjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\frfxrrl.exec:\frfxrrl.exe23⤵
- Executes dropped EXE
PID:4948 -
\??\c:\hthbbb.exec:\hthbbb.exe24⤵
- Executes dropped EXE
PID:3032 -
\??\c:\jdjpp.exec:\jdjpp.exe25⤵
- Executes dropped EXE
PID:4864 -
\??\c:\ppddd.exec:\ppddd.exe26⤵
- Executes dropped EXE
PID:2252 -
\??\c:\lffxrrr.exec:\lffxrrr.exe27⤵
- Executes dropped EXE
PID:3364 -
\??\c:\rlllllf.exec:\rlllllf.exe28⤵
- Executes dropped EXE
PID:4372 -
\??\c:\hthtnb.exec:\hthtnb.exe29⤵
- Executes dropped EXE
PID:384 -
\??\c:\vpppd.exec:\vpppd.exe30⤵
- Executes dropped EXE
PID:4448 -
\??\c:\jdjdp.exec:\jdjdp.exe31⤵
- Executes dropped EXE
PID:232 -
\??\c:\rfrxrxr.exec:\rfrxrxr.exe32⤵
- Executes dropped EXE
PID:2888 -
\??\c:\tnnnhh.exec:\tnnnhh.exe33⤵
- Executes dropped EXE
PID:4684 -
\??\c:\pdjjj.exec:\pdjjj.exe34⤵
- Executes dropped EXE
PID:2512 -
\??\c:\5xffffl.exec:\5xffffl.exe35⤵
- Executes dropped EXE
PID:1820 -
\??\c:\xlxrrrr.exec:\xlxrrrr.exe36⤵
- Executes dropped EXE
PID:2996 -
\??\c:\hbbtnn.exec:\hbbtnn.exe37⤵
- Executes dropped EXE
PID:4312 -
\??\c:\dppjv.exec:\dppjv.exe38⤵
- Executes dropped EXE
PID:2436 -
\??\c:\5rxrrrr.exec:\5rxrrrr.exe39⤵
- Executes dropped EXE
PID:4872 -
\??\c:\nbbbbn.exec:\nbbbbn.exe40⤵
- Executes dropped EXE
PID:4408 -
\??\c:\nnhbbb.exec:\nnhbbb.exe41⤵
- Executes dropped EXE
PID:1876 -
\??\c:\3djdv.exec:\3djdv.exe42⤵
- Executes dropped EXE
PID:3100 -
\??\c:\dpvpp.exec:\dpvpp.exe43⤵
- Executes dropped EXE
PID:3624 -
\??\c:\fxxrrrr.exec:\fxxrrrr.exe44⤵
- Executes dropped EXE
PID:3520 -
\??\c:\xxfflrx.exec:\xxfflrx.exe45⤵
- Executes dropped EXE
PID:3300 -
\??\c:\hbhhhh.exec:\hbhhhh.exe46⤵
- Executes dropped EXE
PID:3148 -
\??\c:\pvjdj.exec:\pvjdj.exe47⤵
- Executes dropped EXE
PID:2812 -
\??\c:\lllfxxr.exec:\lllfxxr.exe48⤵
- Executes dropped EXE
PID:3184 -
\??\c:\rlrrrlr.exec:\rlrrrlr.exe49⤵
- Executes dropped EXE
PID:5056 -
\??\c:\tthhbh.exec:\tthhbh.exe50⤵
- Executes dropped EXE
PID:396 -
\??\c:\3tbbhn.exec:\3tbbhn.exe51⤵
- Executes dropped EXE
PID:2884 -
\??\c:\vjppj.exec:\vjppj.exe52⤵
- Executes dropped EXE
PID:3420 -
\??\c:\pjjpv.exec:\pjjpv.exe53⤵
- Executes dropped EXE
PID:3192 -
\??\c:\1lrrlrx.exec:\1lrrlrx.exe54⤵
- Executes dropped EXE
PID:1232 -
\??\c:\ntbbtt.exec:\ntbbtt.exe55⤵
- Executes dropped EXE
PID:3616 -
\??\c:\nthbtt.exec:\nthbtt.exe56⤵
- Executes dropped EXE
PID:1972 -
\??\c:\vjjvp.exec:\vjjvp.exe57⤵
- Executes dropped EXE
PID:920 -
\??\c:\rrfxrrl.exec:\rrfxrrl.exe58⤵
- Executes dropped EXE
PID:2456 -
\??\c:\lflfxrl.exec:\lflfxrl.exe59⤵
- Executes dropped EXE
PID:5028 -
\??\c:\nbhbtt.exec:\nbhbtt.exe60⤵
- Executes dropped EXE
PID:3168 -
\??\c:\thhbtt.exec:\thhbtt.exe61⤵
- Executes dropped EXE
PID:4292 -
\??\c:\jdvvp.exec:\jdvvp.exe62⤵
- Executes dropped EXE
PID:4372 -
\??\c:\fxfxrrr.exec:\fxfxrrr.exe63⤵
- Executes dropped EXE
PID:3864 -
\??\c:\bhhhnt.exec:\bhhhnt.exe64⤵
- Executes dropped EXE
PID:4672 -
\??\c:\bhhntb.exec:\bhhntb.exe65⤵
- Executes dropped EXE
PID:2624 -
\??\c:\jpddp.exec:\jpddp.exe66⤵PID:1308
-
\??\c:\rxffxxr.exec:\rxffxxr.exe67⤵PID:2976
-
\??\c:\7frlfxr.exec:\7frlfxr.exe68⤵PID:3680
-
\??\c:\nnnttb.exec:\nnnttb.exe69⤵PID:2032
-
\??\c:\nnnnhh.exec:\nnnnhh.exe70⤵PID:4320
-
\??\c:\jddpd.exec:\jddpd.exe71⤵PID:1032
-
\??\c:\5jpjd.exec:\5jpjd.exe72⤵PID:4392
-
\??\c:\5ffffrl.exec:\5ffffrl.exe73⤵PID:5068
-
\??\c:\ntnnnn.exec:\ntnnnn.exe74⤵PID:3368
-
\??\c:\bbnbbh.exec:\bbnbbh.exe75⤵PID:3868
-
\??\c:\dvppd.exec:\dvppd.exe76⤵PID:2532
-
\??\c:\pjpjd.exec:\pjpjd.exe77⤵PID:3188
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe78⤵PID:4876
-
\??\c:\xlxfxll.exec:\xlxfxll.exe79⤵PID:2276
-
\??\c:\bnbbhh.exec:\bnbbhh.exe80⤵PID:4336
-
\??\c:\7nnnhh.exec:\7nnnhh.exe81⤵PID:3696
-
\??\c:\lffxrrl.exec:\lffxrrl.exe82⤵PID:4452
-
\??\c:\lrxxrlr.exec:\lrxxrlr.exe83⤵PID:3748
-
\??\c:\hntnnn.exec:\hntnnn.exe84⤵PID:1804
-
\??\c:\ddjpj.exec:\ddjpj.exe85⤵PID:764
-
\??\c:\vpvvd.exec:\vpvvd.exe86⤵PID:4424
-
\??\c:\rlllfxf.exec:\rlllfxf.exe87⤵PID:2736
-
\??\c:\llxllrr.exec:\llxllrr.exe88⤵PID:2560
-
\??\c:\bhnnhh.exec:\bhnnhh.exe89⤵PID:4608
-
\??\c:\hbbtnn.exec:\hbbtnn.exe90⤵PID:1488
-
\??\c:\9vpjd.exec:\9vpjd.exe91⤵PID:352
-
\??\c:\3vvjj.exec:\3vvjj.exe92⤵PID:2616
-
\??\c:\lrrlxlx.exec:\lrrlxlx.exe93⤵PID:4400
-
\??\c:\tntthn.exec:\tntthn.exe94⤵PID:2288
-
\??\c:\nhnnnn.exec:\nhnnnn.exe95⤵PID:1084
-
\??\c:\jvjjv.exec:\jvjjv.exe96⤵PID:2116
-
\??\c:\5dvvp.exec:\5dvvp.exe97⤵PID:2700
-
\??\c:\xflflll.exec:\xflflll.exe98⤵PID:2144
-
\??\c:\fflllrl.exec:\fflllrl.exe99⤵PID:4980
-
\??\c:\nnttbb.exec:\nnttbb.exe100⤵PID:732
-
\??\c:\nhnnhn.exec:\nhnnhn.exe101⤵PID:3756
-
\??\c:\vpjjv.exec:\vpjjv.exe102⤵PID:1328
-
\??\c:\pjjjd.exec:\pjjjd.exe103⤵PID:1136
-
\??\c:\rrxxxrf.exec:\rrxxxrf.exe104⤵PID:4872
-
\??\c:\hhnhbb.exec:\hhnhbb.exe105⤵PID:2172
-
\??\c:\hthhbb.exec:\hthhbb.exe106⤵PID:3560
-
\??\c:\jvpjj.exec:\jvpjj.exe107⤵PID:2972
-
\??\c:\lfxfxxr.exec:\lfxfxxr.exe108⤵PID:1332
-
\??\c:\1xfxrrl.exec:\1xfxrrl.exe109⤵PID:5088
-
\??\c:\7nnnnt.exec:\7nnnnt.exe110⤵PID:3300
-
\??\c:\bnnnhh.exec:\bnnnhh.exe111⤵PID:1532
-
\??\c:\dpvdp.exec:\dpvdp.exe112⤵PID:2276
-
\??\c:\vjpjd.exec:\vjpjd.exe113⤵PID:4336
-
\??\c:\fxxllll.exec:\fxxllll.exe114⤵PID:3696
-
\??\c:\ffxfxxr.exec:\ffxfxxr.exe115⤵PID:4452
-
\??\c:\bnbtth.exec:\bnbtth.exe116⤵PID:4804
-
\??\c:\thnttt.exec:\thnttt.exe117⤵PID:888
-
\??\c:\vvddd.exec:\vvddd.exe118⤵PID:3664
-
\??\c:\vvdvv.exec:\vvdvv.exe119⤵PID:1232
-
\??\c:\rffxrxr.exec:\rffxrxr.exe120⤵PID:4440
-
\??\c:\nnnnnn.exec:\nnnnnn.exe121⤵PID:4992
-
\??\c:\7tttht.exec:\7tttht.exe122⤵PID:920
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-