Analysis
- max time kernel
150s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 01:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
54ee65514d026fa84b5e2ac4ed5c5790_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
- Target 54ee65514d026fa84b5e2ac4ed5c5790_NeikiAnalytics.exe
- Size 60KB
- Sample240613-cbmywateql
- SHA256 94174957616649bf387e6808e73c16b729a2be351a0dfec1ca735dafd690b27e
- MD5 54ee65514d026fa84b5e2ac4ed5c5790
- SHA1 576b4d95be8344f9b285378a275bddb4bb8cbbfb
- SHA512 16ce1876a5a463fb3e16f6513679260d6838a7f0e5499c7d46f97107c3d52bed1f946ba2a8b58a66e78b86ce603fd9c79bec461c0626f2f31dc66b31084d5e1b
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L2j:ymb3NkkiQ3mdBjFI9m
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/1808-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2412-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4980-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2404-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3656-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3164-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1888-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1564-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1476-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5092-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4624-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1612-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3864-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1996-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4200-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2540-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4040-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-83-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/448-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4980-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1864-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4640-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1772-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2968-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1424-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 1424 bthbtn.exe 2412 vjjdv.exe 2968 vddvd.exe 1772 rlxrllf.exe 4640 rrllffx.exe 2524 tbtnhh.exe 1864 tnntnb.exe 4980 bttnhh.exe 4952 7vjdd.exe 448 lffxrrl.exe 4040 xfxrllf.exe 2540 lxllfff.exe 4200 btttnn.exe 1996 ntbtnn.exe 5084 ppvvd.exe 3864 jdddp.exe 1612 5fllfxr.exe 4624 frffxrl.exe 4012 7ntnhn.exe 5092 htttnn.exe 4136 hbnhhh.exe 3316 jppjj.exe 1476 dvdvp.exe 3436 lflrlxr.exe 1564 1lxrlff.exe 1888 tnthhh.exe 3164 hnnbhb.exe 3656 7pvjv.exe 2404 vpppd.exe 864 pdvpp.exe 3584 rrrrflf.exe 1744 rfxxrrl.exe 3156 3bhtnb.exe 5048 tbbthb.exe 3520 7bhbnh.exe 5056 jddvj.exe 4580 dvvvp.exe 2624 rllfxfx.exe 392 fffxrrl.exe 3668 fffxrlf.exe 2544 nhbtbb.exe 1336 tnhbnn.exe 400 vjpjd.exe 672 jvvvj.exe 1984 dvpjd.exe 3688 fxrlxxr.exe 1168 lllfxxr.exe 3144 nhhbbb.exe 1500 tnnhtt.exe 4360 bbtttt.exe 1004 pjjdj.exe 3396 pdjdv.exe 2408 pvpjd.exe 1720 lrrlrrr.exe 3912 fxllfrl.exe 3448 nbbbtn.exe 1652 hbbthh.exe 4752 hbbttt.exe 2524 7vdvp.exe 4116 dvddd.exe 4288 ppvdp.exe 5052 rfrrrlr.exe 3720 rffxllf.exe 1252 hhnntn.exe -
resource yara_rule behavioral2/memory/1808-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2412-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2404-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3164-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1888-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1564-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1476-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4624-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1612-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3864-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4200-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2540-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1864-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1772-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1424-11-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1808 wrote to memory of 1424 1808 54ee65514d026fa84b5e2ac4ed5c5790_NeikiAnalytics.exe 80 PID 1808 wrote to memory of 1424 1808 54ee65514d026fa84b5e2ac4ed5c5790_NeikiAnalytics.exe 80 PID 1808 wrote to memory of 1424 1808 54ee65514d026fa84b5e2ac4ed5c5790_NeikiAnalytics.exe 80 PID 1424 wrote to memory of 2412 1424 bthbtn.exe 81 PID 1424 wrote to memory of 2412 1424 bthbtn.exe 81 PID 1424 wrote to memory of 2412 1424 bthbtn.exe 81 PID 2412 wrote to memory of 2968 2412 vjjdv.exe 82 PID 2412 wrote to memory of 2968 2412 vjjdv.exe 82 PID 2412 wrote to memory of 2968 2412 vjjdv.exe 82 PID 2968 wrote to memory of 1772 2968 vddvd.exe 83 PID 2968 wrote to memory of 1772 2968 vddvd.exe 83 PID 2968 wrote to memory of 1772 2968 vddvd.exe 83 PID 1772 wrote to memory of 4640 1772 rlxrllf.exe 84 PID 1772 wrote to memory of 4640 1772 rlxrllf.exe 84 PID 1772 wrote to memory of 4640 1772 rlxrllf.exe 84 PID 4640 wrote to memory of 2524 4640 rrllffx.exe 85 PID 4640 wrote to memory of 2524 4640 rrllffx.exe 85 PID 4640 wrote to memory of 2524 4640 rrllffx.exe 85 PID 2524 wrote to memory of 1864 2524 tbtnhh.exe 86 PID 2524 wrote to memory of 1864 2524 tbtnhh.exe 86 PID 2524 wrote to memory of 1864 2524 tbtnhh.exe 86 PID 1864 wrote to memory of 4980 1864 tnntnb.exe 87 PID 1864 wrote to memory of 4980 1864 tnntnb.exe 87 PID 1864 wrote to memory of 4980 1864 tnntnb.exe 87 PID 4980 wrote to memory of 4952 4980 bttnhh.exe 88 PID 4980 wrote to memory of 4952 4980 bttnhh.exe 88 PID 4980 wrote to memory of 4952 4980 bttnhh.exe 88 PID 4952 wrote to memory of 448 4952 7vjdd.exe 89 PID 4952 wrote to memory of 448 4952 7vjdd.exe 89 PID 4952 wrote to memory of 448 4952 7vjdd.exe 89 PID 448 wrote to memory of 4040 448 lffxrrl.exe 90 PID 448 wrote to memory of 4040 448 lffxrrl.exe 90 PID 448 wrote to memory of 4040 448 lffxrrl.exe 90 PID 4040 wrote to memory of 2540 4040 xfxrllf.exe 91 PID 4040 wrote to memory of 2540 4040 xfxrllf.exe 91 PID 4040 wrote to memory of 2540 4040 xfxrllf.exe 91 PID 2540 wrote to memory of 4200 2540 lxllfff.exe 92 PID 2540 wrote to memory of 4200 2540 lxllfff.exe 92 PID 2540 wrote to memory of 4200 2540 lxllfff.exe 92 PID 4200 wrote to memory of 1996 4200 btttnn.exe 93 PID 4200 wrote to memory of 1996 4200 btttnn.exe 93 PID 4200 wrote to memory of 1996 4200 btttnn.exe 93 PID 1996 wrote to memory of 5084 1996 ntbtnn.exe 94 PID 1996 wrote to memory of 5084 1996 ntbtnn.exe 94 PID 1996 wrote to memory of 5084 1996 ntbtnn.exe 94 PID 5084 wrote to memory of 3864 5084 ppvvd.exe 95 PID 5084 wrote to memory of 3864 5084 ppvvd.exe 95 PID 5084 wrote to memory of 3864 5084 ppvvd.exe 95 PID 3864 wrote to memory of 1612 3864 jdddp.exe 96 PID 3864 wrote to memory of 1612 3864 jdddp.exe 96 PID 3864 wrote to memory of 1612 3864 jdddp.exe 96 PID 1612 wrote to memory of 4624 1612 5fllfxr.exe 97 PID 1612 wrote to memory of 4624 1612 5fllfxr.exe 97 PID 1612 wrote to memory of 4624 1612 5fllfxr.exe 97 PID 4624 wrote to memory of 4012 4624 frffxrl.exe 98 PID 4624 wrote to memory of 4012 4624 frffxrl.exe 98 PID 4624 wrote to memory of 4012 4624 frffxrl.exe 98 PID 4012 wrote to memory of 5092 4012 7ntnhn.exe 99 PID 4012 wrote to memory of 5092 4012 7ntnhn.exe 99 PID 4012 wrote to memory of 5092 4012 7ntnhn.exe 99 PID 5092 wrote to memory of 4136 5092 htttnn.exe 100 PID 5092 wrote to memory of 4136 5092 htttnn.exe 100 PID 5092 wrote to memory of 4136 5092 htttnn.exe 100 PID 4136 wrote to memory of 3316 4136 hbnhhh.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\54ee65514d026fa84b5e2ac4ed5c5790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\54ee65514d026fa84b5e2ac4ed5c5790_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\bthbtn.exec:\bthbtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\vjjdv.exec:\vjjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\vddvd.exec:\vddvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\rlxrllf.exec:\rlxrllf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\rrllffx.exec:\rrllffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\tbtnhh.exec:\tbtnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\tnntnb.exec:\tnntnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\bttnhh.exec:\bttnhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\7vjdd.exec:\7vjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\lffxrrl.exec:\lffxrrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\xfxrllf.exec:\xfxrllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\lxllfff.exec:\lxllfff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\btttnn.exec:\btttnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
\??\c:\ntbtnn.exec:\ntbtnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\ppvvd.exec:\ppvvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\jdddp.exec:\jdddp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\5fllfxr.exec:\5fllfxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\frffxrl.exec:\frffxrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\7ntnhn.exec:\7ntnhn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\htttnn.exec:\htttnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\hbnhhh.exec:\hbnhhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\jppjj.exec:\jppjj.exe23⤵
- Executes dropped EXE
PID:3316 -
\??\c:\dvdvp.exec:\dvdvp.exe24⤵
- Executes dropped EXE
PID:1476 -
\??\c:\lflrlxr.exec:\lflrlxr.exe25⤵
- Executes dropped EXE
PID:3436 -
\??\c:\1lxrlff.exec:\1lxrlff.exe26⤵
- Executes dropped EXE
PID:1564 -
\??\c:\tnthhh.exec:\tnthhh.exe27⤵
- Executes dropped EXE
PID:1888 -
\??\c:\hnnbhb.exec:\hnnbhb.exe28⤵
- Executes dropped EXE
PID:3164 -
\??\c:\7pvjv.exec:\7pvjv.exe29⤵
- Executes dropped EXE
PID:3656 -
\??\c:\vpppd.exec:\vpppd.exe30⤵
- Executes dropped EXE
PID:2404 -
\??\c:\pdvpp.exec:\pdvpp.exe31⤵
- Executes dropped EXE
PID:864 -
\??\c:\rrrrflf.exec:\rrrrflf.exe32⤵
- Executes dropped EXE
PID:3584 -
\??\c:\rfxxrrl.exec:\rfxxrrl.exe33⤵
- Executes dropped EXE
PID:1744 -
\??\c:\3bhtnb.exec:\3bhtnb.exe34⤵
- Executes dropped EXE
PID:3156 -
\??\c:\tbbthb.exec:\tbbthb.exe35⤵
- Executes dropped EXE
PID:5048 -
\??\c:\7bhbnh.exec:\7bhbnh.exe36⤵
- Executes dropped EXE
PID:3520 -
\??\c:\jddvj.exec:\jddvj.exe37⤵
- Executes dropped EXE
PID:5056 -
\??\c:\dvvvp.exec:\dvvvp.exe38⤵
- Executes dropped EXE
PID:4580 -
\??\c:\rllfxfx.exec:\rllfxfx.exe39⤵
- Executes dropped EXE
PID:2624 -
\??\c:\fffxrrl.exec:\fffxrrl.exe40⤵
- Executes dropped EXE
PID:392 -
\??\c:\fffxrlf.exec:\fffxrlf.exe41⤵
- Executes dropped EXE
PID:3668 -
\??\c:\nhbtbb.exec:\nhbtbb.exe42⤵
- Executes dropped EXE
PID:2544 -
\??\c:\tnhbnn.exec:\tnhbnn.exe43⤵
- Executes dropped EXE
PID:1336 -
\??\c:\vjpjd.exec:\vjpjd.exe44⤵
- Executes dropped EXE
PID:400 -
\??\c:\jvvvj.exec:\jvvvj.exe45⤵
- Executes dropped EXE
PID:672 -
\??\c:\dvpjd.exec:\dvpjd.exe46⤵
- Executes dropped EXE
PID:1984 -
\??\c:\fxrlxxr.exec:\fxrlxxr.exe47⤵
- Executes dropped EXE
PID:3688 -
\??\c:\lllfxxr.exec:\lllfxxr.exe48⤵
- Executes dropped EXE
PID:1168 -
\??\c:\nhhbbb.exec:\nhhbbb.exe49⤵
- Executes dropped EXE
PID:3144 -
\??\c:\tnnhtt.exec:\tnnhtt.exe50⤵
- Executes dropped EXE
PID:1500 -
\??\c:\bbtttt.exec:\bbtttt.exe51⤵
- Executes dropped EXE
PID:4360 -
\??\c:\pjjdj.exec:\pjjdj.exe52⤵
- Executes dropped EXE
PID:1004 -
\??\c:\pdjdv.exec:\pdjdv.exe53⤵
- Executes dropped EXE
PID:3396 -
\??\c:\pvpjd.exec:\pvpjd.exe54⤵
- Executes dropped EXE
PID:2408 -
\??\c:\lrrlrrr.exec:\lrrlrrr.exe55⤵
- Executes dropped EXE
PID:1720 -
\??\c:\fxllfrl.exec:\fxllfrl.exe56⤵
- Executes dropped EXE
PID:3912 -
\??\c:\nbbbtn.exec:\nbbbtn.exe57⤵
- Executes dropped EXE
PID:3448 -
\??\c:\hbbthh.exec:\hbbthh.exe58⤵
- Executes dropped EXE
PID:1652 -
\??\c:\hbbttt.exec:\hbbttt.exe59⤵
- Executes dropped EXE
PID:4752 -
\??\c:\7vdvp.exec:\7vdvp.exe60⤵
- Executes dropped EXE
PID:2524 -
\??\c:\dvddd.exec:\dvddd.exe61⤵
- Executes dropped EXE
PID:4116 -
\??\c:\ppvdp.exec:\ppvdp.exe62⤵
- Executes dropped EXE
PID:4288 -
\??\c:\rfrrrlr.exec:\rfrrrlr.exe63⤵
- Executes dropped EXE
PID:5052 -
\??\c:\rffxllf.exec:\rffxllf.exe64⤵
- Executes dropped EXE
PID:3720 -
\??\c:\hhnntn.exec:\hhnntn.exe65⤵
- Executes dropped EXE
PID:1252 -
\??\c:\bbtnhh.exec:\bbtnhh.exe66⤵PID:4284
-
\??\c:\tthhth.exec:\tthhth.exe67⤵PID:4848
-
\??\c:\jjddp.exec:\jjddp.exe68⤵PID:1012
-
\??\c:\dvjpd.exec:\dvjpd.exe69⤵PID:2636
-
\??\c:\dvvpp.exec:\dvvpp.exe70⤵PID:608
-
\??\c:\rrfxxxx.exec:\rrfxxxx.exe71⤵PID:2356
-
\??\c:\xrrrllf.exec:\xrrrllf.exe72⤵PID:5084
-
\??\c:\bhnhbb.exec:\bhnhbb.exe73⤵PID:3864
-
\??\c:\hbbthb.exec:\hbbthb.exe74⤵PID:1612
-
\??\c:\htnnbb.exec:\htnnbb.exe75⤵PID:4924
-
\??\c:\ddpjd.exec:\ddpjd.exe76⤵PID:4624
-
\??\c:\vjdvj.exec:\vjdvj.exe77⤵PID:3324
-
\??\c:\vvdjd.exec:\vvdjd.exe78⤵PID:4852
-
\??\c:\lfrlllr.exec:\lfrlllr.exe79⤵PID:4484
-
\??\c:\9xrlffx.exec:\9xrlffx.exe80⤵PID:1140
-
\??\c:\fxfrllf.exec:\fxfrllf.exe81⤵PID:3932
-
\??\c:\5hnhtn.exec:\5hnhtn.exe82⤵PID:1512
-
\??\c:\nhhhth.exec:\nhhhth.exe83⤵PID:5064
-
\??\c:\nnnhbb.exec:\nnnhbb.exe84⤵PID:4424
-
\??\c:\htbnbb.exec:\htbnbb.exe85⤵PID:868
-
\??\c:\dpjjd.exec:\dpjjd.exe86⤵PID:2960
-
\??\c:\pjjdv.exec:\pjjdv.exe87⤵PID:1904
-
\??\c:\rlllffl.exec:\rlllffl.exe88⤵PID:3656
-
\??\c:\rrxxrrx.exec:\rrxxrrx.exe89⤵PID:1616
-
\??\c:\xxrxrxr.exec:\xxrxrxr.exe90⤵PID:4940
-
\??\c:\htnhhb.exec:\htnhhb.exe91⤵PID:3184
-
\??\c:\btnhnn.exec:\btnhnn.exe92⤵PID:1520
-
\??\c:\hbtnbb.exec:\hbtnbb.exe93⤵PID:2680
-
\??\c:\pppvp.exec:\pppvp.exe94⤵PID:3108
-
\??\c:\vdjdv.exec:\vdjdv.exe95⤵PID:2300
-
\??\c:\dpvpv.exec:\dpvpv.exe96⤵PID:2768
-
\??\c:\llxrxxr.exec:\llxrxxr.exe97⤵PID:1080
-
\??\c:\1flflrx.exec:\1flflrx.exe98⤵PID:1948
-
\??\c:\fxffxxf.exec:\fxffxxf.exe99⤵PID:5016
-
\??\c:\bnbbbn.exec:\bnbbbn.exe100⤵PID:1684
-
\??\c:\9btntb.exec:\9btntb.exe101⤵PID:1232
-
\??\c:\thbbnn.exec:\thbbnn.exe102⤵PID:3168
-
\??\c:\3ppjj.exec:\3ppjj.exe103⤵PID:4792
-
\??\c:\jddvj.exec:\jddvj.exe104⤵PID:1660
-
\??\c:\vppjp.exec:\vppjp.exe105⤵PID:4808
-
\??\c:\lffxffl.exec:\lffxffl.exe106⤵PID:5112
-
\??\c:\lrrlfxr.exec:\lrrlfxr.exe107⤵PID:4364
-
\??\c:\xxfrllf.exec:\xxfrllf.exe108⤵PID:4404
-
\??\c:\bttbtt.exec:\bttbtt.exe109⤵PID:3124
-
\??\c:\thnhhb.exec:\thnhhb.exe110⤵PID:3312
-
\??\c:\btbbnt.exec:\btbbnt.exe111⤵PID:2832
-
\??\c:\pdjjv.exec:\pdjjv.exe112⤵PID:5004
-
\??\c:\7dvvj.exec:\7dvvj.exe113⤵PID:1484
-
\??\c:\pdjpj.exec:\pdjpj.exe114⤵PID:2064
-
\??\c:\ffllrrx.exec:\ffllrrx.exe115⤵PID:1056
-
\??\c:\btnnhh.exec:\btnnhh.exe116⤵PID:1424
-
\??\c:\htthtn.exec:\htthtn.exe117⤵PID:1016
-
\??\c:\pddvp.exec:\pddvp.exe118⤵PID:1720
-
\??\c:\ddvvv.exec:\ddvvv.exe119⤵PID:3912
-
\??\c:\rlxrflf.exec:\rlxrflf.exe120⤵PID:3448
-
\??\c:\ntbthh.exec:\ntbthh.exe121⤵PID:4612
-
\??\c:\nbbbnt.exec:\nbbbnt.exe122⤵PID:4084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-