Analysis
- max time kernel
150s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
07/06/2024, 22:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
71c53ea29fd5d015d607276108811270_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
- Target 71c53ea29fd5d015d607276108811270_NeikiAnalytics.exe
- Size 59KB
- Sample240607-14f8ssdd4v
- SHA256 c2630a35d9e9af3f54e87eaa1282bbf0de0507fc2ebc8c28ebded750490efe8d
- MD5 71c53ea29fd5d015d607276108811270
- SHA1 8268a5da61b7c1604c838c017a15440be8754e69
- SHA512 051a259d53542159c70238a4c3de983245b0f5b3a9785fc2c12a7faccf07c6289dc1faea18df17c3bad9351cacd912c4c774c106d3d43b26f8b0bd4e388374a0
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L2b:ymb3NkkiQ3mdBjFI9+
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/116-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2120-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3128-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4284-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2716-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1508-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4104-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/424-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1236-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4920-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/772-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3696-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4640-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4656-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1800-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2216-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5032-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4192-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4072-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1824-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3716-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4000-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1216-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3084-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/808-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 3212 rfffxxx.exe 2716 bnnnnh.exe 4284 jdvvd.exe 2120 9fffrrr.exe 3128 rlrrlrl.exe 2256 nbhhbt.exe 424 tnhbtt.exe 4104 9vddp.exe 1508 ffllffx.exe 1236 5xxrrrl.exe 4920 bntnnn.exe 772 dvvvd.exe 3696 dvvvp.exe 4640 rrrllff.exe 4656 htbbbb.exe 920 pppjd.exe 1800 xrlrrfl.exe 2216 xrlfxxr.exe 5032 btbbhh.exe 4192 vjvpj.exe 4072 pjjpj.exe 3252 rxllxfx.exe 1824 7thhbh.exe 3332 9bhtnn.exe 3716 dvpvp.exe 3288 vdddv.exe 4000 llfxrrl.exe 1216 3hnnth.exe 3084 nnnnhb.exe 808 jdvvp.exe 4800 5fxrlfx.exe 4776 xrlfrrr.exe 3800 bhhnnn.exe 4380 3rlfrrl.exe 2708 xlllffx.exe 5080 tbhhbb.exe 3876 thhhbb.exe 4468 jjpjd.exe 3496 lxfxrrl.exe 1448 3lrxffl.exe 828 nhnhhb.exe 4528 ttttnn.exe 1280 dvvvp.exe 3248 vpvpv.exe 4852 rlrrrrl.exe 388 xlrxrrf.exe 4260 btbbhh.exe 4104 pddvv.exe 3324 vdddd.exe 4188 xrxxxxx.exe 4900 thttnn.exe 3168 ttbbhh.exe 4024 tnttnn.exe 3224 ddddd.exe 216 vdjjv.exe 3616 xfrlfff.exe 2860 rlllrrr.exe 2208 1nnnhh.exe 1548 nthttb.exe 1504 3vdvj.exe 1380 dvvvv.exe 2412 jjvpj.exe 4860 fxlfxfx.exe 4412 lxllxfr.exe -
resource yara_rule behavioral2/memory/116-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2716-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2120-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3128-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/424-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2120-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2120-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2716-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1508-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4104-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/424-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1236-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4920-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/772-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1800-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2216-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5032-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4192-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4072-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1824-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4000-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1216-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3084-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/808-202-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 116 wrote to memory of 3212 116 71c53ea29fd5d015d607276108811270_NeikiAnalytics.exe 82 PID 116 wrote to memory of 3212 116 71c53ea29fd5d015d607276108811270_NeikiAnalytics.exe 82 PID 116 wrote to memory of 3212 116 71c53ea29fd5d015d607276108811270_NeikiAnalytics.exe 82 PID 3212 wrote to memory of 2716 3212 rfffxxx.exe 83 PID 3212 wrote to memory of 2716 3212 rfffxxx.exe 83 PID 3212 wrote to memory of 2716 3212 rfffxxx.exe 83 PID 2716 wrote to memory of 4284 2716 bnnnnh.exe 84 PID 2716 wrote to memory of 4284 2716 bnnnnh.exe 84 PID 2716 wrote to memory of 4284 2716 bnnnnh.exe 84 PID 4284 wrote to memory of 2120 4284 jdvvd.exe 85 PID 4284 wrote to memory of 2120 4284 jdvvd.exe 85 PID 4284 wrote to memory of 2120 4284 jdvvd.exe 85 PID 2120 wrote to memory of 3128 2120 9fffrrr.exe 86 PID 2120 wrote to memory of 3128 2120 9fffrrr.exe 86 PID 2120 wrote to memory of 3128 2120 9fffrrr.exe 86 PID 3128 wrote to memory of 2256 3128 rlrrlrl.exe 87 PID 3128 wrote to memory of 2256 3128 rlrrlrl.exe 87 PID 3128 wrote to memory of 2256 3128 rlrrlrl.exe 87 PID 2256 wrote to memory of 424 2256 nbhhbt.exe 88 PID 2256 wrote to memory of 424 2256 nbhhbt.exe 88 PID 2256 wrote to memory of 424 2256 nbhhbt.exe 88 PID 424 wrote to memory of 4104 424 tnhbtt.exe 89 PID 424 wrote to memory of 4104 424 tnhbtt.exe 89 PID 424 wrote to memory of 4104 424 tnhbtt.exe 89 PID 4104 wrote to memory of 1508 4104 9vddp.exe 90 PID 4104 wrote to memory of 1508 4104 9vddp.exe 90 PID 4104 wrote to memory of 1508 4104 9vddp.exe 90 PID 1508 wrote to memory of 1236 1508 ffllffx.exe 91 PID 1508 wrote to memory of 1236 1508 ffllffx.exe 91 PID 1508 wrote to memory of 1236 1508 ffllffx.exe 91 PID 1236 wrote to memory of 4920 1236 5xxrrrl.exe 92 PID 1236 wrote to memory of 4920 1236 5xxrrrl.exe 92 PID 1236 wrote to memory of 4920 1236 5xxrrrl.exe 92 PID 4920 wrote to memory of 772 4920 bntnnn.exe 93 PID 4920 wrote to memory of 772 4920 bntnnn.exe 93 PID 4920 wrote to memory of 772 4920 bntnnn.exe 93 PID 772 wrote to memory of 3696 772 dvvvd.exe 94 PID 772 wrote to memory of 3696 772 dvvvd.exe 94 PID 772 wrote to memory of 3696 772 dvvvd.exe 94 PID 3696 wrote to memory of 4640 3696 dvvvp.exe 95 PID 3696 wrote to memory of 4640 3696 dvvvp.exe 95 PID 3696 wrote to memory of 4640 3696 dvvvp.exe 95 PID 4640 wrote to memory of 4656 4640 rrrllff.exe 96 PID 4640 wrote to memory of 4656 4640 rrrllff.exe 96 PID 4640 wrote to memory of 4656 4640 rrrllff.exe 96 PID 4656 wrote to memory of 920 4656 htbbbb.exe 97 PID 4656 wrote to memory of 920 4656 htbbbb.exe 97 PID 4656 wrote to memory of 920 4656 htbbbb.exe 97 PID 920 wrote to memory of 1800 920 pppjd.exe 99 PID 920 wrote to memory of 1800 920 pppjd.exe 99 PID 920 wrote to memory of 1800 920 pppjd.exe 99 PID 1800 wrote to memory of 2216 1800 xrlrrfl.exe 100 PID 1800 wrote to memory of 2216 1800 xrlrrfl.exe 100 PID 1800 wrote to memory of 2216 1800 xrlrrfl.exe 100 PID 2216 wrote to memory of 5032 2216 xrlfxxr.exe 101 PID 2216 wrote to memory of 5032 2216 xrlfxxr.exe 101 PID 2216 wrote to memory of 5032 2216 xrlfxxr.exe 101 PID 5032 wrote to memory of 4192 5032 btbbhh.exe 102 PID 5032 wrote to memory of 4192 5032 btbbhh.exe 102 PID 5032 wrote to memory of 4192 5032 btbbhh.exe 102 PID 4192 wrote to memory of 4072 4192 vjvpj.exe 103 PID 4192 wrote to memory of 4072 4192 vjvpj.exe 103 PID 4192 wrote to memory of 4072 4192 vjvpj.exe 103 PID 4072 wrote to memory of 3252 4072 pjjpj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\71c53ea29fd5d015d607276108811270_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\71c53ea29fd5d015d607276108811270_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\rfffxxx.exec:\rfffxxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\bnnnnh.exec:\bnnnnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\jdvvd.exec:\jdvvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\9fffrrr.exec:\9fffrrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\rlrrlrl.exec:\rlrrlrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\nbhhbt.exec:\nbhhbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\tnhbtt.exec:\tnhbtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:424 -
\??\c:\9vddp.exec:\9vddp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\ffllffx.exec:\ffllffx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\5xxrrrl.exec:\5xxrrrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\bntnnn.exec:\bntnnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\dvvvd.exec:\dvvvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\dvvvp.exec:\dvvvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\rrrllff.exec:\rrrllff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\htbbbb.exec:\htbbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\pppjd.exec:\pppjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\xrlrrfl.exec:\xrlrrfl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\xrlfxxr.exec:\xrlfxxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\btbbhh.exec:\btbbhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\vjvpj.exec:\vjvpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\pjjpj.exec:\pjjpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
\??\c:\rxllxfx.exec:\rxllxfx.exe23⤵
- Executes dropped EXE
PID:3252 -
\??\c:\7thhbh.exec:\7thhbh.exe24⤵
- Executes dropped EXE
PID:1824 -
\??\c:\9bhtnn.exec:\9bhtnn.exe25⤵
- Executes dropped EXE
PID:3332 -
\??\c:\dvpvp.exec:\dvpvp.exe26⤵
- Executes dropped EXE
PID:3716 -
\??\c:\vdddv.exec:\vdddv.exe27⤵
- Executes dropped EXE
PID:3288 -
\??\c:\llfxrrl.exec:\llfxrrl.exe28⤵
- Executes dropped EXE
PID:4000 -
\??\c:\3hnnth.exec:\3hnnth.exe29⤵
- Executes dropped EXE
PID:1216 -
\??\c:\nnnnhb.exec:\nnnnhb.exe30⤵
- Executes dropped EXE
PID:3084 -
\??\c:\jdvvp.exec:\jdvvp.exe31⤵
- Executes dropped EXE
PID:808 -
\??\c:\5fxrlfx.exec:\5fxrlfx.exe32⤵
- Executes dropped EXE
PID:4800 -
\??\c:\xrlfrrr.exec:\xrlfrrr.exe33⤵
- Executes dropped EXE
PID:4776 -
\??\c:\bhhnnn.exec:\bhhnnn.exe34⤵
- Executes dropped EXE
PID:3800 -
\??\c:\3rlfrrl.exec:\3rlfrrl.exe35⤵
- Executes dropped EXE
PID:4380 -
\??\c:\xlllffx.exec:\xlllffx.exe36⤵
- Executes dropped EXE
PID:2708 -
\??\c:\tbhhbb.exec:\tbhhbb.exe37⤵
- Executes dropped EXE
PID:5080 -
\??\c:\thhhbb.exec:\thhhbb.exe38⤵
- Executes dropped EXE
PID:3876 -
\??\c:\jjpjd.exec:\jjpjd.exe39⤵
- Executes dropped EXE
PID:4468 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe40⤵
- Executes dropped EXE
PID:3496 -
\??\c:\3lrxffl.exec:\3lrxffl.exe41⤵
- Executes dropped EXE
PID:1448 -
\??\c:\nhnhhb.exec:\nhnhhb.exe42⤵
- Executes dropped EXE
PID:828 -
\??\c:\ttttnn.exec:\ttttnn.exe43⤵
- Executes dropped EXE
PID:4528 -
\??\c:\dvvvp.exec:\dvvvp.exe44⤵
- Executes dropped EXE
PID:1280 -
\??\c:\vpvpv.exec:\vpvpv.exe45⤵
- Executes dropped EXE
PID:3248 -
\??\c:\rlrrrrl.exec:\rlrrrrl.exe46⤵
- Executes dropped EXE
PID:4852 -
\??\c:\xlrxrrf.exec:\xlrxrrf.exe47⤵
- Executes dropped EXE
PID:388 -
\??\c:\btbbhh.exec:\btbbhh.exe48⤵
- Executes dropped EXE
PID:4260 -
\??\c:\pddvv.exec:\pddvv.exe49⤵
- Executes dropped EXE
PID:4104 -
\??\c:\vdddd.exec:\vdddd.exe50⤵
- Executes dropped EXE
PID:3324 -
\??\c:\xrxxxxx.exec:\xrxxxxx.exe51⤵
- Executes dropped EXE
PID:4188 -
\??\c:\thttnn.exec:\thttnn.exe52⤵
- Executes dropped EXE
PID:4900 -
\??\c:\ttbbhh.exec:\ttbbhh.exe53⤵
- Executes dropped EXE
PID:3168 -
\??\c:\tnttnn.exec:\tnttnn.exe54⤵
- Executes dropped EXE
PID:4024 -
\??\c:\ddddd.exec:\ddddd.exe55⤵
- Executes dropped EXE
PID:3224 -
\??\c:\vdjjv.exec:\vdjjv.exe56⤵
- Executes dropped EXE
PID:216 -
\??\c:\xfrlfff.exec:\xfrlfff.exe57⤵
- Executes dropped EXE
PID:3616 -
\??\c:\rlllrrr.exec:\rlllrrr.exe58⤵
- Executes dropped EXE
PID:2860 -
\??\c:\1nnnhh.exec:\1nnnhh.exe59⤵
- Executes dropped EXE
PID:2208 -
\??\c:\nthttb.exec:\nthttb.exe60⤵
- Executes dropped EXE
PID:1548 -
\??\c:\3vdvj.exec:\3vdvj.exe61⤵
- Executes dropped EXE
PID:1504 -
\??\c:\dvvvv.exec:\dvvvv.exe62⤵
- Executes dropped EXE
PID:1380 -
\??\c:\jjvpj.exec:\jjvpj.exe63⤵
- Executes dropped EXE
PID:2412 -
\??\c:\fxlfxfx.exec:\fxlfxfx.exe64⤵
- Executes dropped EXE
PID:4860 -
\??\c:\lxllxfr.exec:\lxllxfr.exe65⤵
- Executes dropped EXE
PID:4412 -
\??\c:\1ttbbb.exec:\1ttbbb.exe66⤵PID:4436
-
\??\c:\bttnhb.exec:\bttnhb.exe67⤵PID:1652
-
\??\c:\jpvvv.exec:\jpvvv.exe68⤵PID:4192
-
\??\c:\5vvdv.exec:\5vvdv.exe69⤵PID:4300
-
\??\c:\xfrlfff.exec:\xfrlfff.exe70⤵PID:2908
-
\??\c:\7xfffll.exec:\7xfffll.exe71⤵PID:2476
-
\??\c:\hbbtnn.exec:\hbbtnn.exe72⤵PID:2508
-
\??\c:\hbbtnn.exec:\hbbtnn.exe73⤵PID:1620
-
\??\c:\thhbtt.exec:\thhbtt.exe74⤵PID:1464
-
\??\c:\jpvvd.exec:\jpvvd.exe75⤵PID:3716
-
\??\c:\jpdvj.exec:\jpdvj.exe76⤵PID:4372
-
\??\c:\ffxrlll.exec:\ffxrlll.exe77⤵PID:2740
-
\??\c:\xrrrrxx.exec:\xrrrrxx.exe78⤵PID:2540
-
\??\c:\nhhhbb.exec:\nhhhbb.exe79⤵PID:1216
-
\??\c:\bttbbb.exec:\bttbbb.exe80⤵PID:4708
-
\??\c:\pjjdv.exec:\pjjdv.exe81⤵PID:4484
-
\??\c:\1rrrlrl.exec:\1rrrlrl.exe82⤵PID:5096
-
\??\c:\bbtttt.exec:\bbtttt.exe83⤵PID:5076
-
\??\c:\pdvvp.exec:\pdvvp.exe84⤵PID:5036
-
\??\c:\xflfxxx.exec:\xflfxxx.exe85⤵PID:4812
-
\??\c:\llrlfxx.exec:\llrlfxx.exe86⤵PID:2588
-
\??\c:\tthbtt.exec:\tthbtt.exe87⤵PID:804
-
\??\c:\tnnhhh.exec:\tnnhhh.exe88⤵PID:4788
-
\??\c:\7pdvv.exec:\7pdvv.exe89⤵PID:4144
-
\??\c:\pddpd.exec:\pddpd.exe90⤵PID:2428
-
\??\c:\lffxlrl.exec:\lffxlrl.exe91⤵PID:1924
-
\??\c:\1xrrxxl.exec:\1xrrxxl.exe92⤵PID:3196
-
\??\c:\bhbntb.exec:\bhbntb.exe93⤵PID:2016
-
\??\c:\btbnnn.exec:\btbnnn.exe94⤵PID:1468
-
\??\c:\nhhhhb.exec:\nhhhhb.exe95⤵PID:2120
-
\??\c:\1pdvv.exec:\1pdvv.exe96⤵PID:3000
-
\??\c:\xrrrlrr.exec:\xrrrlrr.exe97⤵PID:4952
-
\??\c:\flrlfxr.exec:\flrlfxr.exe98⤵PID:4560
-
\??\c:\9bbbtt.exec:\9bbbtt.exe99⤵PID:4872
-
\??\c:\tbhnhh.exec:\tbhnhh.exe100⤵PID:4048
-
\??\c:\pdjdv.exec:\pdjdv.exe101⤵PID:2836
-
\??\c:\pvpjj.exec:\pvpjj.exe102⤵PID:2260
-
\??\c:\5jjdd.exec:\5jjdd.exe103⤵PID:4900
-
\??\c:\fxffxxl.exec:\fxffxxl.exe104⤵PID:4960
-
\??\c:\frxxrlr.exec:\frxxrlr.exe105⤵PID:1668
-
\??\c:\ttbbhh.exec:\ttbbhh.exe106⤵PID:4500
-
\??\c:\nhhhbb.exec:\nhhhbb.exe107⤵PID:2832
-
\??\c:\7vjdd.exec:\7vjdd.exe108⤵PID:3616
-
\??\c:\dpvvv.exec:\dpvvv.exe109⤵PID:3712
-
\??\c:\5jvpj.exec:\5jvpj.exe110⤵PID:2208
-
\??\c:\frlfxxx.exec:\frlfxxx.exe111⤵PID:1860
-
\??\c:\frxxrlr.exec:\frxxrlr.exe112⤵PID:1192
-
\??\c:\hhbhbb.exec:\hhbhbb.exe113⤵PID:1380
-
\??\c:\bnbbtb.exec:\bnbbtb.exe114⤵PID:2412
-
\??\c:\9dvdp.exec:\9dvdp.exe115⤵PID:1884
-
\??\c:\vjjdp.exec:\vjjdp.exe116⤵PID:856
-
\??\c:\llrrxxx.exec:\llrrxxx.exe117⤵PID:324
-
\??\c:\rlrrllf.exec:\rlrrllf.exe118⤵PID:4648
-
\??\c:\tnhhbb.exec:\tnhhbb.exe119⤵PID:4376
-
\??\c:\5tttnt.exec:\5tttnt.exe120⤵PID:3584
-
\??\c:\jdjdd.exec:\jdjdd.exe121⤵PID:4084
-
\??\c:\vjpjd.exec:\vjpjd.exe122⤵PID:1616
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-