Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17/06/2024, 03:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3f2d0069a52397b9811c8256fb2f7f30_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
3f2d0069a52397b9811c8256fb2f7f30_NeikiAnalytics.exe
-
Size
82KB
-
MD5
3f2d0069a52397b9811c8256fb2f7f30
-
SHA1
1e5f8b90cc753d419488456d3dde51f088dadaa7
-
SHA256
9dcb40c350e8b9fc5822ca635ed8acd294fe2598736613a00c65aa2d367abf83
-
SHA512
b1166a4d31e372f6eabd9b2d8084253c0c770375222e5804d8217e1ac74f9de6d5cf039d045576e1a0dbe1f78fc256cd42d22997fb8155cf279d9f5074dabf6f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAXPfgr2hKmdbcPi2vz:ymb3NkkiQ3mdBjFo6Pfgy3dbc/z
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/4560-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3240-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4000-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2864-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/436-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1204-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1396-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4352-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2284-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/412-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/228-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2352-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1272-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4012-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/680-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2984-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1600-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5000-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3240 tnhhbb.exe 4004 5ppdv.exe 4000 jdjdv.exe 2864 5ffxxxx.exe 436 9tnnnn.exe 1204 thnhbb.exe 5084 9jvpv.exe 1396 xxfrrxx.exe 3060 nhhntt.exe 2240 7dvpj.exe 4352 xllfxxr.exe 4348 ntbtnb.exe 1560 tnnhnh.exe 3224 dddjd.exe 2284 frfffrr.exe 412 nhnnbb.exe 228 tnhbtt.exe 2352 vvjjd.exe 3948 rrlllrr.exe 1272 tnttnt.exe 4012 pdpjd.exe 2248 xlrfrxr.exe 680 btbbhh.exe 2984 nhhbtt.exe 4264 jdpjp.exe 1600 jvjdv.exe 808 tntnnn.exe 5000 vvdvp.exe 1832 pjpjv.exe 4784 xrfffll.exe 1840 hbnnhh.exe 2004 nntbbh.exe 4672 vpjvp.exe 5084 pvdjj.exe 1396 1xxrffx.exe 1260 hntttt.exe 2956 nhhhbt.exe 4352 9jjjd.exe 968 dpvdv.exe 1800 fflfrxx.exe 1324 xfllfff.exe 1972 thhhhh.exe 2488 nnttbh.exe 1552 pvppj.exe 4148 jvdvd.exe 912 xrlllll.exe 4620 flrrllf.exe 1504 tntttt.exe 3852 5hnnhn.exe 3176 9bhhnt.exe 3292 9ppjj.exe 4832 pjpjp.exe 632 rlxxflf.exe 4892 9fxrllf.exe 680 btbbbb.exe 1960 tthhnn.exe 3604 hbtnnn.exe 2984 vvpjd.exe 4316 9vvvp.exe 1828 5ffrrrl.exe 4004 xxfllll.exe 4644 nthhhh.exe 4592 tnttbh.exe 4828 vvjdv.exe -
resource yara_rule behavioral2/memory/4560-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3240-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4000-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2864-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/436-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1204-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1396-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4352-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2284-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/412-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/228-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2352-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1272-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/680-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2984-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1600-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4560 wrote to memory of 3240 4560 3f2d0069a52397b9811c8256fb2f7f30_NeikiAnalytics.exe 89 PID 4560 wrote to memory of 3240 4560 3f2d0069a52397b9811c8256fb2f7f30_NeikiAnalytics.exe 89 PID 4560 wrote to memory of 3240 4560 3f2d0069a52397b9811c8256fb2f7f30_NeikiAnalytics.exe 89 PID 3240 wrote to memory of 4004 3240 tnhhbb.exe 90 PID 3240 wrote to memory of 4004 3240 tnhhbb.exe 90 PID 3240 wrote to memory of 4004 3240 tnhhbb.exe 90 PID 4004 wrote to memory of 4000 4004 5ppdv.exe 91 PID 4004 wrote to memory of 4000 4004 5ppdv.exe 91 PID 4004 wrote to memory of 4000 4004 5ppdv.exe 91 PID 4000 wrote to memory of 2864 4000 jdjdv.exe 92 PID 4000 wrote to memory of 2864 4000 jdjdv.exe 92 PID 4000 wrote to memory of 2864 4000 jdjdv.exe 92 PID 2864 wrote to memory of 436 2864 5ffxxxx.exe 93 PID 2864 wrote to memory of 436 2864 5ffxxxx.exe 93 PID 2864 wrote to memory of 436 2864 5ffxxxx.exe 93 PID 436 wrote to memory of 1204 436 9tnnnn.exe 94 PID 436 wrote to memory of 1204 436 9tnnnn.exe 94 PID 436 wrote to memory of 1204 436 9tnnnn.exe 94 PID 1204 wrote to memory of 5084 1204 thnhbb.exe 95 PID 1204 wrote to memory of 5084 1204 thnhbb.exe 95 PID 1204 wrote to memory of 5084 1204 thnhbb.exe 95 PID 5084 wrote to memory of 1396 5084 9jvpv.exe 96 PID 5084 wrote to memory of 1396 5084 9jvpv.exe 96 PID 5084 wrote to memory of 1396 5084 9jvpv.exe 96 PID 1396 wrote to memory of 3060 1396 xxfrrxx.exe 97 PID 1396 wrote to memory of 3060 1396 xxfrrxx.exe 97 PID 1396 wrote to memory of 3060 1396 xxfrrxx.exe 97 PID 3060 wrote to memory of 2240 3060 nhhntt.exe 98 PID 3060 wrote to memory of 2240 3060 nhhntt.exe 98 PID 3060 wrote to memory of 2240 3060 nhhntt.exe 98 PID 2240 wrote to memory of 4352 2240 7dvpj.exe 99 PID 2240 wrote to memory of 4352 2240 7dvpj.exe 99 PID 2240 wrote to memory of 4352 2240 7dvpj.exe 99 PID 4352 wrote to memory of 4348 4352 xllfxxr.exe 100 PID 4352 wrote to memory of 4348 4352 xllfxxr.exe 100 PID 4352 wrote to memory of 4348 4352 xllfxxr.exe 100 PID 4348 wrote to memory of 1560 4348 ntbtnb.exe 101 PID 4348 wrote to memory of 1560 4348 ntbtnb.exe 101 PID 4348 wrote to memory of 1560 4348 ntbtnb.exe 101 PID 1560 wrote to memory of 3224 1560 tnnhnh.exe 102 PID 1560 wrote to memory of 3224 1560 tnnhnh.exe 102 PID 1560 wrote to memory of 3224 1560 tnnhnh.exe 102 PID 3224 wrote to memory of 2284 3224 dddjd.exe 104 PID 3224 wrote to memory of 2284 3224 dddjd.exe 104 PID 3224 wrote to memory of 2284 3224 dddjd.exe 104 PID 2284 wrote to memory of 412 2284 frfffrr.exe 105 PID 2284 wrote to memory of 412 2284 frfffrr.exe 105 PID 2284 wrote to memory of 412 2284 frfffrr.exe 105 PID 412 wrote to memory of 228 412 nhnnbb.exe 106 PID 412 wrote to memory of 228 412 nhnnbb.exe 106 PID 412 wrote to memory of 228 412 nhnnbb.exe 106 PID 228 wrote to memory of 2352 228 tnhbtt.exe 107 PID 228 wrote to memory of 2352 228 tnhbtt.exe 107 PID 228 wrote to memory of 2352 228 tnhbtt.exe 107 PID 2352 wrote to memory of 3948 2352 vvjjd.exe 108 PID 2352 wrote to memory of 3948 2352 vvjjd.exe 108 PID 2352 wrote to memory of 3948 2352 vvjjd.exe 108 PID 3948 wrote to memory of 1272 3948 rrlllrr.exe 110 PID 3948 wrote to memory of 1272 3948 rrlllrr.exe 110 PID 3948 wrote to memory of 1272 3948 rrlllrr.exe 110 PID 1272 wrote to memory of 4012 1272 tnttnt.exe 111 PID 1272 wrote to memory of 4012 1272 tnttnt.exe 111 PID 1272 wrote to memory of 4012 1272 tnttnt.exe 111 PID 4012 wrote to memory of 2248 4012 pdpjd.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f2d0069a52397b9811c8256fb2f7f30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3f2d0069a52397b9811c8256fb2f7f30_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\tnhhbb.exec:\tnhhbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
\??\c:\5ppdv.exec:\5ppdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\jdjdv.exec:\jdjdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\5ffxxxx.exec:\5ffxxxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\9tnnnn.exec:\9tnnnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\thnhbb.exec:\thnhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\9jvpv.exec:\9jvpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\xxfrrxx.exec:\xxfrrxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\nhhntt.exec:\nhhntt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\7dvpj.exec:\7dvpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\xllfxxr.exec:\xllfxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
\??\c:\ntbtnb.exec:\ntbtnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\tnnhnh.exec:\tnnhnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\dddjd.exec:\dddjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\frfffrr.exec:\frfffrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\nhnnbb.exec:\nhnnbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
\??\c:\tnhbtt.exec:\tnhbtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\vvjjd.exec:\vvjjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\rrlllrr.exec:\rrlllrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\tnttnt.exec:\tnttnt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\pdpjd.exec:\pdpjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\xlrfrxr.exec:\xlrfrxr.exe23⤵
- Executes dropped EXE
PID:2248 -
\??\c:\btbbhh.exec:\btbbhh.exe24⤵
- Executes dropped EXE
PID:680 -
\??\c:\nhhbtt.exec:\nhhbtt.exe25⤵
- Executes dropped EXE
PID:2984 -
\??\c:\jdpjp.exec:\jdpjp.exe26⤵
- Executes dropped EXE
PID:4264 -
\??\c:\jvjdv.exec:\jvjdv.exe27⤵
- Executes dropped EXE
PID:1600 -
\??\c:\7flflfx.exec:\7flflfx.exe28⤵PID:396
-
\??\c:\tntnnn.exec:\tntnnn.exe29⤵
- Executes dropped EXE
PID:808 -
\??\c:\vvdvp.exec:\vvdvp.exe30⤵
- Executes dropped EXE
PID:5000 -
\??\c:\pjpjv.exec:\pjpjv.exe31⤵
- Executes dropped EXE
PID:1832 -
\??\c:\xrfffll.exec:\xrfffll.exe32⤵
- Executes dropped EXE
PID:4784 -
\??\c:\hbnnhh.exec:\hbnnhh.exe33⤵
- Executes dropped EXE
PID:1840 -
\??\c:\nntbbh.exec:\nntbbh.exe34⤵
- Executes dropped EXE
PID:2004 -
\??\c:\vpjvp.exec:\vpjvp.exe35⤵
- Executes dropped EXE
PID:4672 -
\??\c:\pvdjj.exec:\pvdjj.exe36⤵
- Executes dropped EXE
PID:5084 -
\??\c:\1xxrffx.exec:\1xxrffx.exe37⤵
- Executes dropped EXE
PID:1396 -
\??\c:\hntttt.exec:\hntttt.exe38⤵
- Executes dropped EXE
PID:1260 -
\??\c:\nhhhbt.exec:\nhhhbt.exe39⤵
- Executes dropped EXE
PID:2956 -
\??\c:\9jjjd.exec:\9jjjd.exe40⤵
- Executes dropped EXE
PID:4352 -
\??\c:\dpvdv.exec:\dpvdv.exe41⤵
- Executes dropped EXE
PID:968 -
\??\c:\fflfrxx.exec:\fflfrxx.exe42⤵
- Executes dropped EXE
PID:1800 -
\??\c:\xfllfff.exec:\xfllfff.exe43⤵
- Executes dropped EXE
PID:1324 -
\??\c:\thhhhh.exec:\thhhhh.exe44⤵
- Executes dropped EXE
PID:1972 -
\??\c:\nnttbh.exec:\nnttbh.exe45⤵
- Executes dropped EXE
PID:2488 -
\??\c:\pvppj.exec:\pvppj.exe46⤵
- Executes dropped EXE
PID:1552 -
\??\c:\jvdvd.exec:\jvdvd.exe47⤵
- Executes dropped EXE
PID:4148 -
\??\c:\xrlllll.exec:\xrlllll.exe48⤵
- Executes dropped EXE
PID:912 -
\??\c:\flrrllf.exec:\flrrllf.exe49⤵
- Executes dropped EXE
PID:4620 -
\??\c:\tntttt.exec:\tntttt.exe50⤵
- Executes dropped EXE
PID:1504 -
\??\c:\5hnnhn.exec:\5hnnhn.exe51⤵
- Executes dropped EXE
PID:3852 -
\??\c:\9bhhnt.exec:\9bhhnt.exe52⤵
- Executes dropped EXE
PID:3176 -
\??\c:\9ppjj.exec:\9ppjj.exe53⤵
- Executes dropped EXE
PID:3292 -
\??\c:\pjpjp.exec:\pjpjp.exe54⤵
- Executes dropped EXE
PID:4832 -
\??\c:\rlxxflf.exec:\rlxxflf.exe55⤵
- Executes dropped EXE
PID:632 -
\??\c:\9fxrllf.exec:\9fxrllf.exe56⤵
- Executes dropped EXE
PID:4892 -
\??\c:\btbbbb.exec:\btbbbb.exe57⤵
- Executes dropped EXE
PID:680 -
\??\c:\tthhnn.exec:\tthhnn.exe58⤵
- Executes dropped EXE
PID:1960 -
\??\c:\hbtnnn.exec:\hbtnnn.exe59⤵
- Executes dropped EXE
PID:3604 -
\??\c:\vvpjd.exec:\vvpjd.exe60⤵
- Executes dropped EXE
PID:2984 -
\??\c:\9vvvp.exec:\9vvvp.exe61⤵
- Executes dropped EXE
PID:4316 -
\??\c:\5ffrrrl.exec:\5ffrrrl.exe62⤵
- Executes dropped EXE
PID:1828 -
\??\c:\xxfllll.exec:\xxfllll.exe63⤵
- Executes dropped EXE
PID:4004 -
\??\c:\nthhhh.exec:\nthhhh.exe64⤵
- Executes dropped EXE
PID:4644 -
\??\c:\tnttbh.exec:\tnttbh.exe65⤵
- Executes dropped EXE
PID:4592 -
\??\c:\vvjdv.exec:\vvjdv.exe66⤵
- Executes dropped EXE
PID:4828 -
\??\c:\ddvpp.exec:\ddvpp.exe67⤵PID:4784
-
\??\c:\dvddv.exec:\dvddv.exe68⤵PID:1840
-
\??\c:\fxxxrrx.exec:\fxxxrrx.exe69⤵PID:1404
-
\??\c:\xffxrlx.exec:\xffxrlx.exe70⤵PID:3412
-
\??\c:\nhhbbb.exec:\nhhbbb.exe71⤵PID:3416
-
\??\c:\bthhbb.exec:\bthhbb.exe72⤵PID:820
-
\??\c:\vjvpp.exec:\vjvpp.exe73⤵PID:3720
-
\??\c:\jpvpj.exec:\jpvpj.exe74⤵PID:2392
-
\??\c:\frffxxx.exec:\frffxxx.exe75⤵PID:3324
-
\??\c:\5frlxxf.exec:\5frlxxf.exe76⤵PID:4432
-
\??\c:\nbhhhn.exec:\nbhhhn.exe77⤵PID:3572
-
\??\c:\bttnnn.exec:\bttnnn.exe78⤵PID:3128
-
\??\c:\jppjd.exec:\jppjd.exe79⤵PID:5096
-
\??\c:\7vddj.exec:\7vddj.exe80⤵PID:464
-
\??\c:\rlllfrx.exec:\rlllfrx.exe81⤵PID:3568
-
\??\c:\lffxrxr.exec:\lffxrxr.exe82⤵PID:1728
-
\??\c:\ntbbtt.exec:\ntbbtt.exe83⤵PID:1916
-
\??\c:\nhnhnt.exec:\nhnhnt.exe84⤵PID:3108
-
\??\c:\vddvv.exec:\vddvv.exe85⤵PID:3520
-
\??\c:\dpvpj.exec:\dpvpj.exe86⤵PID:3948
-
\??\c:\xrrrfff.exec:\xrrrfff.exe87⤵PID:4692
-
\??\c:\fxxrllr.exec:\fxxrllr.exe88⤵PID:1084
-
\??\c:\fxlrllx.exec:\fxlrllx.exe89⤵PID:1656
-
\??\c:\nhhhhh.exec:\nhhhhh.exe90⤵PID:388
-
\??\c:\nthbtt.exec:\nthbtt.exe91⤵PID:1716
-
\??\c:\dvvpj.exec:\dvvpj.exe92⤵PID:452
-
\??\c:\vjvpj.exec:\vjvpj.exe93⤵PID:392
-
\??\c:\rffxrxr.exec:\rffxrxr.exe94⤵PID:4540
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe95⤵PID:4344
-
\??\c:\bbhhnt.exec:\bbhhnt.exe96⤵PID:4356
-
\??\c:\thhhhh.exec:\thhhhh.exe97⤵PID:1924
-
\??\c:\jdddv.exec:\jdddv.exe98⤵PID:4140
-
\??\c:\9pddj.exec:\9pddj.exe99⤵PID:4000
-
\??\c:\xfffxrr.exec:\xfffxrr.exe100⤵PID:4496
-
\??\c:\rxllllr.exec:\rxllllr.exe101⤵PID:1832
-
\??\c:\hhnnnt.exec:\hhnnnt.exe102⤵PID:3164
-
\??\c:\hbnnhh.exec:\hbnnhh.exe103⤵PID:436
-
\??\c:\bthbbh.exec:\bthbbh.exe104⤵PID:4552
-
\??\c:\dvddd.exec:\dvddd.exe105⤵PID:5016
-
\??\c:\vpvvv.exec:\vpvvv.exe106⤵PID:3592
-
\??\c:\rfllflf.exec:\rfllflf.exe107⤵PID:4144
-
\??\c:\rffllrl.exec:\rffllrl.exe108⤵PID:3844
-
\??\c:\nbhbtn.exec:\nbhbtn.exe109⤵PID:2240
-
\??\c:\jdjdd.exec:\jdjdd.exe110⤵PID:3628
-
\??\c:\vpddv.exec:\vpddv.exe111⤵PID:2904
-
\??\c:\jjvpj.exec:\jjvpj.exe112⤵PID:2776
-
\??\c:\xfrrrrx.exec:\xfrrrrx.exe113⤵PID:628
-
\??\c:\ffrxrrr.exec:\ffrxrrr.exe114⤵PID:4216
-
\??\c:\3nnntt.exec:\3nnntt.exe115⤵PID:3648
-
\??\c:\bbttnb.exec:\bbttnb.exe116⤵PID:4052
-
\??\c:\pdpjj.exec:\pdpjj.exe117⤵PID:1684
-
\??\c:\7dddv.exec:\7dddv.exe118⤵PID:912
-
\??\c:\flrlfff.exec:\flrlfff.exe119⤵PID:4620
-
\??\c:\rfxxrrr.exec:\rfxxrrr.exe120⤵PID:4160
-
\??\c:\tnnnnh.exec:\tnnnnh.exe121⤵PID:3552
-
\??\c:\bthbhh.exec:\bthbhh.exe122⤵PID:4012
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-