Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 06:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
acb7a1ff1344f9e054136ccaa0d611b0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
acb7a1ff1344f9e054136ccaa0d611b0_NeikiAnalytics.exe
-
Size
361KB
-
MD5
acb7a1ff1344f9e054136ccaa0d611b0
-
SHA1
ab382ff1d94989d3a48a57aae0a7b4089c1a2308
-
SHA256
9213dc338b46dade4f3a6cf03fa9c72778844d508f8335d1d2d1d268c622cfc5
-
SHA512
7aeb0cfe1b383651916b9c5fc4113ff2a28173c2beb3ba3b897c14ca4f785a47cb3b381f5022365f1f4acdc0afaf83b65a59cd102ffaa566f8b92fb5979f8f76
-
SSDEEP
6144:n3C9BRIG0asYFm71m8+GdkB9yMu7N+8px71:n3C9uYA71kSMu08px71
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/4088-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4184-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4932-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1652-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1900-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4884-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3408-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3624-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3268-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1744-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2756-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2952-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4044-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1988-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/960-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1616-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3792-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4940 tnbtnn.exe 4184 vdjdv.exe 4828 vppdv.exe 4932 vppjv.exe 1652 rlrfrfl.exe 1632 hthbtt.exe 4884 3tnhbb.exe 1900 jjjvp.exe 3408 lffxrrf.exe 4480 1jvpj.exe 3172 xlxrlfx.exe 3624 vpvjd.exe 396 lxxlxxr.exe 3268 3dvpj.exe 1744 djpjp.exe 2756 htbnhh.exe 4852 pppjd.exe 4844 rfxxrrx.exe 860 7nntnt.exe 2952 nhhnnn.exe 1152 rxfxffx.exe 4044 hhbttt.exe 1988 pjdvv.exe 960 frrxrxl.exe 1616 vvvpj.exe 3344 dvdpj.exe 4504 xflxxlr.exe 2896 7pvpj.exe 4324 vpvpj.exe 4264 7lrlffr.exe 3792 nhnbtb.exe 4528 ddjdp.exe 4276 vpvpj.exe 4300 lrrrllx.exe 3316 9bhbtn.exe 3608 jjdvd.exe 3496 1xfxrrl.exe 3332 xlrlffx.exe 4828 nbnhht.exe 3720 pjjdp.exe 1168 lfxrffl.exe 908 7hbbtb.exe 3512 vvvpj.exe 1056 rlxlxxl.exe 4880 bhnhtt.exe 4836 htbnbb.exe 4728 jdpdp.exe 1272 xlrrrrl.exe 4892 fflxxxr.exe 4428 1ttnbn.exe 3224 vvjdj.exe 1316 xxrfxrl.exe 3268 ttttnn.exe 4948 nhhbhh.exe 1164 7vvpj.exe 5028 lfxlxxr.exe 4772 7nhbhh.exe 3948 djdvj.exe 4336 lflfxxr.exe 4748 bhbtbt.exe 528 pvjjp.exe 3556 5rrfffx.exe 1180 ntnhbt.exe 2220 tnhbbb.exe -
resource yara_rule behavioral2/memory/4088-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4184-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4932-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1652-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1900-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4884-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3408-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3408-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3624-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3268-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1744-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2756-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2952-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1988-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/960-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1616-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3792-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4088 wrote to memory of 4940 4088 acb7a1ff1344f9e054136ccaa0d611b0_NeikiAnalytics.exe 85 PID 4088 wrote to memory of 4940 4088 acb7a1ff1344f9e054136ccaa0d611b0_NeikiAnalytics.exe 85 PID 4088 wrote to memory of 4940 4088 acb7a1ff1344f9e054136ccaa0d611b0_NeikiAnalytics.exe 85 PID 4940 wrote to memory of 4184 4940 tnbtnn.exe 86 PID 4940 wrote to memory of 4184 4940 tnbtnn.exe 86 PID 4940 wrote to memory of 4184 4940 tnbtnn.exe 86 PID 4184 wrote to memory of 4828 4184 vdjdv.exe 87 PID 4184 wrote to memory of 4828 4184 vdjdv.exe 87 PID 4184 wrote to memory of 4828 4184 vdjdv.exe 87 PID 4828 wrote to memory of 4932 4828 vppdv.exe 88 PID 4828 wrote to memory of 4932 4828 vppdv.exe 88 PID 4828 wrote to memory of 4932 4828 vppdv.exe 88 PID 4932 wrote to memory of 1652 4932 vppjv.exe 89 PID 4932 wrote to memory of 1652 4932 vppjv.exe 89 PID 4932 wrote to memory of 1652 4932 vppjv.exe 89 PID 1652 wrote to memory of 1632 1652 rlrfrfl.exe 90 PID 1652 wrote to memory of 1632 1652 rlrfrfl.exe 90 PID 1652 wrote to memory of 1632 1652 rlrfrfl.exe 90 PID 1632 wrote to memory of 4884 1632 hthbtt.exe 91 PID 1632 wrote to memory of 4884 1632 hthbtt.exe 91 PID 1632 wrote to memory of 4884 1632 hthbtt.exe 91 PID 4884 wrote to memory of 1900 4884 3tnhbb.exe 92 PID 4884 wrote to memory of 1900 4884 3tnhbb.exe 92 PID 4884 wrote to memory of 1900 4884 3tnhbb.exe 92 PID 1900 wrote to memory of 3408 1900 jjjvp.exe 93 PID 1900 wrote to memory of 3408 1900 jjjvp.exe 93 PID 1900 wrote to memory of 3408 1900 jjjvp.exe 93 PID 3408 wrote to memory of 4480 3408 lffxrrf.exe 94 PID 3408 wrote to memory of 4480 3408 lffxrrf.exe 94 PID 3408 wrote to memory of 4480 3408 lffxrrf.exe 94 PID 4480 wrote to memory of 3172 4480 1jvpj.exe 95 PID 4480 wrote to memory of 3172 4480 1jvpj.exe 95 PID 4480 wrote to memory of 3172 4480 1jvpj.exe 95 PID 3172 wrote to memory of 3624 3172 xlxrlfx.exe 96 PID 3172 wrote to memory of 3624 3172 xlxrlfx.exe 96 PID 3172 wrote to memory of 3624 3172 xlxrlfx.exe 96 PID 3624 wrote to memory of 396 3624 vpvjd.exe 97 PID 3624 wrote to memory of 396 3624 vpvjd.exe 97 PID 3624 wrote to memory of 396 3624 vpvjd.exe 97 PID 396 wrote to memory of 3268 396 lxxlxxr.exe 98 PID 396 wrote to memory of 3268 396 lxxlxxr.exe 98 PID 396 wrote to memory of 3268 396 lxxlxxr.exe 98 PID 3268 wrote to memory of 1744 3268 3dvpj.exe 99 PID 3268 wrote to memory of 1744 3268 3dvpj.exe 99 PID 3268 wrote to memory of 1744 3268 3dvpj.exe 99 PID 1744 wrote to memory of 2756 1744 djpjp.exe 100 PID 1744 wrote to memory of 2756 1744 djpjp.exe 100 PID 1744 wrote to memory of 2756 1744 djpjp.exe 100 PID 2756 wrote to memory of 4852 2756 htbnhh.exe 101 PID 2756 wrote to memory of 4852 2756 htbnhh.exe 101 PID 2756 wrote to memory of 4852 2756 htbnhh.exe 101 PID 4852 wrote to memory of 4844 4852 pppjd.exe 102 PID 4852 wrote to memory of 4844 4852 pppjd.exe 102 PID 4852 wrote to memory of 4844 4852 pppjd.exe 102 PID 4844 wrote to memory of 860 4844 rfxxrrx.exe 103 PID 4844 wrote to memory of 860 4844 rfxxrrx.exe 103 PID 4844 wrote to memory of 860 4844 rfxxrrx.exe 103 PID 860 wrote to memory of 2952 860 7nntnt.exe 105 PID 860 wrote to memory of 2952 860 7nntnt.exe 105 PID 860 wrote to memory of 2952 860 7nntnt.exe 105 PID 2952 wrote to memory of 1152 2952 nhhnnn.exe 106 PID 2952 wrote to memory of 1152 2952 nhhnnn.exe 106 PID 2952 wrote to memory of 1152 2952 nhhnnn.exe 106 PID 1152 wrote to memory of 4044 1152 rxfxffx.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\acb7a1ff1344f9e054136ccaa0d611b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\acb7a1ff1344f9e054136ccaa0d611b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\tnbtnn.exec:\tnbtnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\vdjdv.exec:\vdjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\vppdv.exec:\vppdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\vppjv.exec:\vppjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\rlrfrfl.exec:\rlrfrfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\hthbtt.exec:\hthbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\3tnhbb.exec:\3tnhbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\jjjvp.exec:\jjjvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\lffxrrf.exec:\lffxrrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
\??\c:\1jvpj.exec:\1jvpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\xlxrlfx.exec:\xlxrlfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\vpvjd.exec:\vpvjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\lxxlxxr.exec:\lxxlxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\3dvpj.exec:\3dvpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\djpjp.exec:\djpjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\htbnhh.exec:\htbnhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\pppjd.exec:\pppjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\rfxxrrx.exec:\rfxxrrx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\7nntnt.exec:\7nntnt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\nhhnnn.exec:\nhhnnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\rxfxffx.exec:\rxfxffx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\hhbttt.exec:\hhbttt.exe23⤵
- Executes dropped EXE
PID:4044 -
\??\c:\pjdvv.exec:\pjdvv.exe24⤵
- Executes dropped EXE
PID:1988 -
\??\c:\frrxrxl.exec:\frrxrxl.exe25⤵
- Executes dropped EXE
PID:960 -
\??\c:\vvvpj.exec:\vvvpj.exe26⤵
- Executes dropped EXE
PID:1616 -
\??\c:\dvdpj.exec:\dvdpj.exe27⤵
- Executes dropped EXE
PID:3344 -
\??\c:\xflxxlr.exec:\xflxxlr.exe28⤵
- Executes dropped EXE
PID:4504 -
\??\c:\7pvpj.exec:\7pvpj.exe29⤵
- Executes dropped EXE
PID:2896 -
\??\c:\vpvpj.exec:\vpvpj.exe30⤵
- Executes dropped EXE
PID:4324 -
\??\c:\7lrlffr.exec:\7lrlffr.exe31⤵
- Executes dropped EXE
PID:4264 -
\??\c:\nhnbtb.exec:\nhnbtb.exe32⤵
- Executes dropped EXE
PID:3792 -
\??\c:\ddjdp.exec:\ddjdp.exe33⤵
- Executes dropped EXE
PID:4528 -
\??\c:\vpvpj.exec:\vpvpj.exe34⤵
- Executes dropped EXE
PID:4276 -
\??\c:\lrrrllx.exec:\lrrrllx.exe35⤵
- Executes dropped EXE
PID:4300 -
\??\c:\9bhbtn.exec:\9bhbtn.exe36⤵
- Executes dropped EXE
PID:3316 -
\??\c:\jjdvd.exec:\jjdvd.exe37⤵
- Executes dropped EXE
PID:3608 -
\??\c:\1xfxrrl.exec:\1xfxrrl.exe38⤵
- Executes dropped EXE
PID:3496 -
\??\c:\xlrlffx.exec:\xlrlffx.exe39⤵
- Executes dropped EXE
PID:3332 -
\??\c:\nbnhht.exec:\nbnhht.exe40⤵
- Executes dropped EXE
PID:4828 -
\??\c:\pjjdp.exec:\pjjdp.exe41⤵
- Executes dropped EXE
PID:3720 -
\??\c:\lfxrffl.exec:\lfxrffl.exe42⤵
- Executes dropped EXE
PID:1168 -
\??\c:\7hbbtb.exec:\7hbbtb.exe43⤵
- Executes dropped EXE
PID:908 -
\??\c:\vvvpj.exec:\vvvpj.exe44⤵
- Executes dropped EXE
PID:3512 -
\??\c:\rlxlxxl.exec:\rlxlxxl.exe45⤵
- Executes dropped EXE
PID:1056 -
\??\c:\bhnhtt.exec:\bhnhtt.exe46⤵
- Executes dropped EXE
PID:4880 -
\??\c:\htbnbb.exec:\htbnbb.exe47⤵
- Executes dropped EXE
PID:4836 -
\??\c:\jdpdp.exec:\jdpdp.exe48⤵
- Executes dropped EXE
PID:4728 -
\??\c:\xlrrrrl.exec:\xlrrrrl.exe49⤵
- Executes dropped EXE
PID:1272 -
\??\c:\fflxxxr.exec:\fflxxxr.exe50⤵
- Executes dropped EXE
PID:4892 -
\??\c:\1ttnbn.exec:\1ttnbn.exe51⤵
- Executes dropped EXE
PID:4428 -
\??\c:\vvjdj.exec:\vvjdj.exe52⤵
- Executes dropped EXE
PID:3224 -
\??\c:\xxrfxrl.exec:\xxrfxrl.exe53⤵
- Executes dropped EXE
PID:1316 -
\??\c:\ttttnn.exec:\ttttnn.exe54⤵
- Executes dropped EXE
PID:3268 -
\??\c:\nhhbhh.exec:\nhhbhh.exe55⤵
- Executes dropped EXE
PID:4948 -
\??\c:\7vvpj.exec:\7vvpj.exe56⤵
- Executes dropped EXE
PID:1164 -
\??\c:\lfxlxxr.exec:\lfxlxxr.exe57⤵
- Executes dropped EXE
PID:5028 -
\??\c:\7nhbhh.exec:\7nhbhh.exe58⤵
- Executes dropped EXE
PID:4772 -
\??\c:\djdvj.exec:\djdvj.exe59⤵
- Executes dropped EXE
PID:3948 -
\??\c:\lflfxxr.exec:\lflfxxr.exe60⤵
- Executes dropped EXE
PID:4336 -
\??\c:\bhbtbt.exec:\bhbtbt.exe61⤵
- Executes dropped EXE
PID:4748 -
\??\c:\pvjjp.exec:\pvjjp.exe62⤵
- Executes dropped EXE
PID:528 -
\??\c:\5rrfffx.exec:\5rrfffx.exe63⤵
- Executes dropped EXE
PID:3556 -
\??\c:\ntnhbt.exec:\ntnhbt.exe64⤵
- Executes dropped EXE
PID:1180 -
\??\c:\tnhbbb.exec:\tnhbbb.exe65⤵
- Executes dropped EXE
PID:2220 -
\??\c:\djjdd.exec:\djjdd.exe66⤵PID:4776
-
\??\c:\flrlfff.exec:\flrlfff.exe67⤵PID:1712
-
\??\c:\hhhhht.exec:\hhhhht.exe68⤵PID:4568
-
\??\c:\9pdvp.exec:\9pdvp.exe69⤵PID:1568
-
\??\c:\lrxrrrl.exec:\lrxrrrl.exe70⤵PID:1124
-
\??\c:\tbhhtb.exec:\tbhhtb.exe71⤵PID:4268
-
\??\c:\vdpvj.exec:\vdpvj.exe72⤵PID:4048
-
\??\c:\xrffrff.exec:\xrffrff.exe73⤵PID:4264
-
\??\c:\hbttnn.exec:\hbttnn.exe74⤵PID:1992
-
\??\c:\dvvvj.exec:\dvvvj.exe75⤵PID:3792
-
\??\c:\flrlfxl.exec:\flrlfxl.exe76⤵PID:4408
-
\??\c:\1xfxlfx.exec:\1xfxlfx.exe77⤵PID:2576
-
\??\c:\bntnhb.exec:\bntnhb.exe78⤵PID:3440
-
\??\c:\pjjdv.exec:\pjjdv.exe79⤵PID:1288
-
\??\c:\rrxxrff.exec:\rrxxrff.exe80⤵PID:4184
-
\??\c:\vppjv.exec:\vppjv.exe81⤵PID:1184
-
\??\c:\fflxflx.exec:\fflxflx.exe82⤵PID:1932
-
\??\c:\xrlfrrl.exec:\xrlfrrl.exe83⤵PID:4696
-
\??\c:\ntnhtn.exec:\ntnhtn.exe84⤵PID:4460
-
\??\c:\1jdvj.exec:\1jdvj.exe85⤵PID:2536
-
\??\c:\lflxrxr.exec:\lflxrxr.exe86⤵PID:1876
-
\??\c:\tbhbbt.exec:\tbhbbt.exe87⤵PID:4076
-
\??\c:\hnnttt.exec:\hnnttt.exe88⤵PID:4456
-
\??\c:\pvjdv.exec:\pvjdv.exe89⤵PID:3240
-
\??\c:\3rxrffx.exec:\3rxrffx.exe90⤵PID:3488
-
\??\c:\hbnhhh.exec:\hbnhhh.exe91⤵PID:4428
-
\??\c:\hbhbnn.exec:\hbhbnn.exe92⤵PID:2072
-
\??\c:\ppvpj.exec:\ppvpj.exe93⤵PID:2944
-
\??\c:\rllllll.exec:\rllllll.exe94⤵PID:4136
-
\??\c:\xlrlfrr.exec:\xlrlfrr.exe95⤵PID:4036
-
\??\c:\tbhbbb.exec:\tbhbbb.exe96⤵PID:3292
-
\??\c:\5vppj.exec:\5vppj.exe97⤵PID:1904
-
\??\c:\9lrrllf.exec:\9lrrllf.exe98⤵PID:3296
-
\??\c:\btthbh.exec:\btthbh.exe99⤵PID:3504
-
\??\c:\dvvvp.exec:\dvvvp.exe100⤵PID:2212
-
\??\c:\ffxrflf.exec:\ffxrflf.exe101⤵PID:2728
-
\??\c:\nbbtnh.exec:\nbbtnh.exe102⤵PID:4560
-
\??\c:\7ffxrrr.exec:\7ffxrrr.exe103⤵PID:1712
-
\??\c:\tbtnbb.exec:\tbtnbb.exe104⤵PID:4568
-
\??\c:\ntbnnh.exec:\ntbnnh.exe105⤵PID:1568
-
\??\c:\xlxxrxx.exec:\xlxxrxx.exe106⤵PID:1124
-
\??\c:\xrlfrrx.exec:\xrlfrrx.exe107⤵PID:4268
-
\??\c:\hbnnhh.exec:\hbnnhh.exe108⤵PID:4048
-
\??\c:\pppdd.exec:\pppdd.exe109⤵PID:1008
-
\??\c:\5ttnhh.exec:\5ttnhh.exe110⤵PID:1992
-
\??\c:\nntnnt.exec:\nntnnt.exe111⤵PID:5012
-
\??\c:\pvdvj.exec:\pvdvj.exe112⤵PID:4408
-
\??\c:\lxrlrxl.exec:\lxrlrxl.exe113⤵PID:2576
-
\??\c:\5bbbth.exec:\5bbbth.exe114⤵PID:4208
-
\??\c:\pjvpp.exec:\pjvpp.exe115⤵PID:3496
-
\??\c:\7flfxff.exec:\7flfxff.exe116⤵PID:1320
-
\??\c:\lxxlxrf.exec:\lxxlxrf.exe117⤵PID:1624
-
\??\c:\nhhhbb.exec:\nhhhbb.exe118⤵PID:2296
-
\??\c:\ppppd.exec:\ppppd.exe119⤵PID:5056
-
\??\c:\lrrrlfx.exec:\lrrrlfx.exe120⤵PID:3500
-
\??\c:\bttnhh.exec:\bttnhh.exe121⤵PID:3852
-
\??\c:\vvddj.exec:\vvddj.exe122⤵PID:4592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-