Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17-05-2024 05:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b378a13d22be8750c033fb01e84f50c0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
b378a13d22be8750c033fb01e84f50c0_NeikiAnalytics.exe
-
Size
385KB
-
MD5
b378a13d22be8750c033fb01e84f50c0
-
SHA1
2ebe767ee584ddd7ceab99920526ebf445084342
-
SHA256
5cdf7c4d6f89c719f9fbc65de79fd75d67cb741db6feefb9531d6aee884042af
-
SHA512
4a969542af19c538c36b3f4c71b4bb9ab208bc6b36b4fb67fac23b390af7d6b6301c9f8975a17b6410ab93715908485523d867cc786844321da46f76b56c1266
-
SSDEEP
12288:n3C9uMPh2kkkkK4kXkkkkkkkkl8888888888888888882:ShPh2kkkkK4kXkkkkkkkkU
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/1576-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/992-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1668-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2608-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5040-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3932-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1104-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2644-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3100-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2968-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4752-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2836-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1776-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4472-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4616-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/232-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4500-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1500-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4188-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/928-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4388-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2416-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3284-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/560-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 992 nbthbn.exe 3576 tnnhbt.exe 1668 djpjv.exe 2608 rxlrxrf.exe 5040 7rflxrf.exe 3932 btttnn.exe 1104 htbtnn.exe 2644 jdjjp.exe 2492 nnhnht.exe 3100 5jpjd.exe 2968 frrrrlf.exe 4752 rlrllll.exe 2836 bbbthn.exe 1776 rxlfxrl.exe 4472 vppdj.exe 4796 5rrlfxr.exe 4616 vjjdv.exe 232 lrrrlxx.exe 4168 jvdpd.exe 4500 djjdv.exe 1652 bntnnh.exe 1500 jvjdv.exe 4188 xffxrll.exe 928 5dpjj.exe 4388 5dvvj.exe 4896 3nbtnt.exe 2824 jjvvv.exe 2416 vjjjp.exe 4628 frffflr.exe 3284 tnbtnn.exe 560 rrrllfx.exe 2312 pdvvv.exe 3960 xxlrxrr.exe 4084 jpvvd.exe 2696 3ddvp.exe 716 3tbtnn.exe 3964 pvjjj.exe 2980 rflffxx.exe 4588 btnnnn.exe 1616 ppjjv.exe 2612 jppjj.exe 2460 flllrrl.exe 3588 bthbbn.exe 4332 ppdvv.exe 1076 nhhntt.exe 4784 vjppp.exe 3620 ddjdj.exe 4576 fxffxff.exe 2080 bbbhbh.exe 3084 pvppp.exe 3100 ffllffr.exe 2968 btnhnn.exe 4684 ppddd.exe 2076 jjvvv.exe 3264 5lrlffl.exe 3768 nhhnht.exe 3096 djppp.exe 1720 3vddp.exe 3760 lrlrrrl.exe 3252 flrrrxx.exe 2788 hhhbtt.exe 496 ppvvv.exe 3900 xlxxfrx.exe 4080 lfxxxfl.exe -
resource yara_rule behavioral2/memory/1576-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/992-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1668-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2608-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5040-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3932-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3932-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2644-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3100-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2836-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1776-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4472-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/232-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1500-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4188-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/928-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4388-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2416-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3284-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/560-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1576 wrote to memory of 992 1576 b378a13d22be8750c033fb01e84f50c0_NeikiAnalytics.exe 82 PID 1576 wrote to memory of 992 1576 b378a13d22be8750c033fb01e84f50c0_NeikiAnalytics.exe 82 PID 1576 wrote to memory of 992 1576 b378a13d22be8750c033fb01e84f50c0_NeikiAnalytics.exe 82 PID 992 wrote to memory of 3576 992 nbthbn.exe 83 PID 992 wrote to memory of 3576 992 nbthbn.exe 83 PID 992 wrote to memory of 3576 992 nbthbn.exe 83 PID 3576 wrote to memory of 1668 3576 tnnhbt.exe 84 PID 3576 wrote to memory of 1668 3576 tnnhbt.exe 84 PID 3576 wrote to memory of 1668 3576 tnnhbt.exe 84 PID 1668 wrote to memory of 2608 1668 djpjv.exe 85 PID 1668 wrote to memory of 2608 1668 djpjv.exe 85 PID 1668 wrote to memory of 2608 1668 djpjv.exe 85 PID 2608 wrote to memory of 5040 2608 rxlrxrf.exe 86 PID 2608 wrote to memory of 5040 2608 rxlrxrf.exe 86 PID 2608 wrote to memory of 5040 2608 rxlrxrf.exe 86 PID 5040 wrote to memory of 3932 5040 7rflxrf.exe 87 PID 5040 wrote to memory of 3932 5040 7rflxrf.exe 87 PID 5040 wrote to memory of 3932 5040 7rflxrf.exe 87 PID 3932 wrote to memory of 1104 3932 btttnn.exe 89 PID 3932 wrote to memory of 1104 3932 btttnn.exe 89 PID 3932 wrote to memory of 1104 3932 btttnn.exe 89 PID 1104 wrote to memory of 2644 1104 htbtnn.exe 90 PID 1104 wrote to memory of 2644 1104 htbtnn.exe 90 PID 1104 wrote to memory of 2644 1104 htbtnn.exe 90 PID 2644 wrote to memory of 2492 2644 jdjjp.exe 92 PID 2644 wrote to memory of 2492 2644 jdjjp.exe 92 PID 2644 wrote to memory of 2492 2644 jdjjp.exe 92 PID 2492 wrote to memory of 3100 2492 nnhnht.exe 93 PID 2492 wrote to memory of 3100 2492 nnhnht.exe 93 PID 2492 wrote to memory of 3100 2492 nnhnht.exe 93 PID 3100 wrote to memory of 2968 3100 5jpjd.exe 94 PID 3100 wrote to memory of 2968 3100 5jpjd.exe 94 PID 3100 wrote to memory of 2968 3100 5jpjd.exe 94 PID 2968 wrote to memory of 4752 2968 frrrrlf.exe 95 PID 2968 wrote to memory of 4752 2968 frrrrlf.exe 95 PID 2968 wrote to memory of 4752 2968 frrrrlf.exe 95 PID 4752 wrote to memory of 2836 4752 rlrllll.exe 96 PID 4752 wrote to memory of 2836 4752 rlrllll.exe 96 PID 4752 wrote to memory of 2836 4752 rlrllll.exe 96 PID 2836 wrote to memory of 1776 2836 bbbthn.exe 98 PID 2836 wrote to memory of 1776 2836 bbbthn.exe 98 PID 2836 wrote to memory of 1776 2836 bbbthn.exe 98 PID 1776 wrote to memory of 4472 1776 rxlfxrl.exe 99 PID 1776 wrote to memory of 4472 1776 rxlfxrl.exe 99 PID 1776 wrote to memory of 4472 1776 rxlfxrl.exe 99 PID 4472 wrote to memory of 4796 4472 vppdj.exe 100 PID 4472 wrote to memory of 4796 4472 vppdj.exe 100 PID 4472 wrote to memory of 4796 4472 vppdj.exe 100 PID 4796 wrote to memory of 4616 4796 5rrlfxr.exe 101 PID 4796 wrote to memory of 4616 4796 5rrlfxr.exe 101 PID 4796 wrote to memory of 4616 4796 5rrlfxr.exe 101 PID 4616 wrote to memory of 232 4616 vjjdv.exe 102 PID 4616 wrote to memory of 232 4616 vjjdv.exe 102 PID 4616 wrote to memory of 232 4616 vjjdv.exe 102 PID 232 wrote to memory of 4168 232 lrrrlxx.exe 103 PID 232 wrote to memory of 4168 232 lrrrlxx.exe 103 PID 232 wrote to memory of 4168 232 lrrrlxx.exe 103 PID 4168 wrote to memory of 4500 4168 jvdpd.exe 104 PID 4168 wrote to memory of 4500 4168 jvdpd.exe 104 PID 4168 wrote to memory of 4500 4168 jvdpd.exe 104 PID 4500 wrote to memory of 1652 4500 djjdv.exe 105 PID 4500 wrote to memory of 1652 4500 djjdv.exe 105 PID 4500 wrote to memory of 1652 4500 djjdv.exe 105 PID 1652 wrote to memory of 1500 1652 bntnnh.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\b378a13d22be8750c033fb01e84f50c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b378a13d22be8750c033fb01e84f50c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\nbthbn.exec:\nbthbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\tnnhbt.exec:\tnnhbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\djpjv.exec:\djpjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\rxlrxrf.exec:\rxlrxrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\7rflxrf.exec:\7rflxrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\btttnn.exec:\btttnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\htbtnn.exec:\htbtnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\jdjjp.exec:\jdjjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\nnhnht.exec:\nnhnht.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\5jpjd.exec:\5jpjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\frrrrlf.exec:\frrrrlf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\rlrllll.exec:\rlrllll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\bbbthn.exec:\bbbthn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\rxlfxrl.exec:\rxlfxrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\vppdj.exec:\vppdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\5rrlfxr.exec:\5rrlfxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\vjjdv.exec:\vjjdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\lrrrlxx.exec:\lrrrlxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\jvdpd.exec:\jvdpd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\djjdv.exec:\djjdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\bntnnh.exec:\bntnnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\jvjdv.exec:\jvjdv.exe23⤵
- Executes dropped EXE
PID:1500 -
\??\c:\xffxrll.exec:\xffxrll.exe24⤵
- Executes dropped EXE
PID:4188 -
\??\c:\5dpjj.exec:\5dpjj.exe25⤵
- Executes dropped EXE
PID:928 -
\??\c:\5dvvj.exec:\5dvvj.exe26⤵
- Executes dropped EXE
PID:4388 -
\??\c:\3nbtnt.exec:\3nbtnt.exe27⤵
- Executes dropped EXE
PID:4896 -
\??\c:\jjvvv.exec:\jjvvv.exe28⤵
- Executes dropped EXE
PID:2824 -
\??\c:\vjjjp.exec:\vjjjp.exe29⤵
- Executes dropped EXE
PID:2416 -
\??\c:\frffflr.exec:\frffflr.exe30⤵
- Executes dropped EXE
PID:4628 -
\??\c:\tnbtnn.exec:\tnbtnn.exe31⤵
- Executes dropped EXE
PID:3284 -
\??\c:\rrrllfx.exec:\rrrllfx.exe32⤵
- Executes dropped EXE
PID:560 -
\??\c:\pdvvv.exec:\pdvvv.exe33⤵
- Executes dropped EXE
PID:2312 -
\??\c:\xxlrxrr.exec:\xxlrxrr.exe34⤵
- Executes dropped EXE
PID:3960 -
\??\c:\jpvvd.exec:\jpvvd.exe35⤵
- Executes dropped EXE
PID:4084 -
\??\c:\3ddvp.exec:\3ddvp.exe36⤵
- Executes dropped EXE
PID:2696 -
\??\c:\3tbtnn.exec:\3tbtnn.exe37⤵
- Executes dropped EXE
PID:716 -
\??\c:\pvjjj.exec:\pvjjj.exe38⤵
- Executes dropped EXE
PID:3964 -
\??\c:\rflffxx.exec:\rflffxx.exe39⤵
- Executes dropped EXE
PID:2980 -
\??\c:\btnnnn.exec:\btnnnn.exe40⤵
- Executes dropped EXE
PID:4588 -
\??\c:\ppjjv.exec:\ppjjv.exe41⤵
- Executes dropped EXE
PID:1616 -
\??\c:\jppjj.exec:\jppjj.exe42⤵
- Executes dropped EXE
PID:2612 -
\??\c:\flllrrl.exec:\flllrrl.exe43⤵
- Executes dropped EXE
PID:2460 -
\??\c:\bthbbn.exec:\bthbbn.exe44⤵
- Executes dropped EXE
PID:3588 -
\??\c:\ppdvv.exec:\ppdvv.exe45⤵
- Executes dropped EXE
PID:4332 -
\??\c:\nhhntt.exec:\nhhntt.exe46⤵
- Executes dropped EXE
PID:1076 -
\??\c:\vjppp.exec:\vjppp.exe47⤵
- Executes dropped EXE
PID:4784 -
\??\c:\ddjdj.exec:\ddjdj.exe48⤵
- Executes dropped EXE
PID:3620 -
\??\c:\fxffxff.exec:\fxffxff.exe49⤵
- Executes dropped EXE
PID:4576 -
\??\c:\bbbhbh.exec:\bbbhbh.exe50⤵
- Executes dropped EXE
PID:2080 -
\??\c:\pvppp.exec:\pvppp.exe51⤵
- Executes dropped EXE
PID:3084 -
\??\c:\ffllffr.exec:\ffllffr.exe52⤵
- Executes dropped EXE
PID:3100 -
\??\c:\btnhnn.exec:\btnhnn.exe53⤵
- Executes dropped EXE
PID:2968 -
\??\c:\ppddd.exec:\ppddd.exe54⤵
- Executes dropped EXE
PID:4684 -
\??\c:\jjvvv.exec:\jjvvv.exe55⤵
- Executes dropped EXE
PID:2076 -
\??\c:\5lrlffl.exec:\5lrlffl.exe56⤵
- Executes dropped EXE
PID:3264 -
\??\c:\nhhnht.exec:\nhhnht.exe57⤵
- Executes dropped EXE
PID:3768 -
\??\c:\djppp.exec:\djppp.exe58⤵
- Executes dropped EXE
PID:3096 -
\??\c:\3vddp.exec:\3vddp.exe59⤵
- Executes dropped EXE
PID:1720 -
\??\c:\lrlrrrl.exec:\lrlrrrl.exe60⤵
- Executes dropped EXE
PID:3760 -
\??\c:\flrrrxx.exec:\flrrrxx.exe61⤵
- Executes dropped EXE
PID:3252 -
\??\c:\hhhbtt.exec:\hhhbtt.exe62⤵
- Executes dropped EXE
PID:2788 -
\??\c:\ppvvv.exec:\ppvvv.exe63⤵
- Executes dropped EXE
PID:496 -
\??\c:\xlxxfrx.exec:\xlxxfrx.exe64⤵
- Executes dropped EXE
PID:3900 -
\??\c:\lfxxxfl.exec:\lfxxxfl.exe65⤵
- Executes dropped EXE
PID:4080 -
\??\c:\tthhbb.exec:\tthhbb.exe66⤵PID:1820
-
\??\c:\1pppp.exec:\1pppp.exe67⤵PID:4504
-
\??\c:\vpdvp.exec:\vpdvp.exe68⤵PID:4088
-
\??\c:\llrrllf.exec:\llrrllf.exe69⤵PID:4440
-
\??\c:\3hbtnn.exec:\3hbtnn.exe70⤵PID:3376
-
\??\c:\ppvvv.exec:\ppvvv.exe71⤵PID:1472
-
\??\c:\9pvvv.exec:\9pvvv.exe72⤵PID:3828
-
\??\c:\lxlrflf.exec:\lxlrflf.exe73⤵PID:1604
-
\??\c:\btbtbh.exec:\btbtbh.exe74⤵PID:3132
-
\??\c:\rfffrlr.exec:\rfffrlr.exe75⤵PID:4740
-
\??\c:\xxflllr.exec:\xxflllr.exe76⤵PID:4788
-
\??\c:\tthhtt.exec:\tthhtt.exe77⤵PID:4528
-
\??\c:\9pppp.exec:\9pppp.exe78⤵PID:2180
-
\??\c:\ddvvj.exec:\ddvvj.exe79⤵PID:4480
-
\??\c:\xrfxfff.exec:\xrfxfff.exe80⤵PID:1576
-
\??\c:\hbbttb.exec:\hbbttb.exe81⤵PID:3696
-
\??\c:\pdjjp.exec:\pdjjp.exe82⤵PID:5064
-
\??\c:\vpvpj.exec:\vpvpj.exe83⤵PID:1616
-
\??\c:\7lrrxfl.exec:\7lrrxfl.exe84⤵PID:1920
-
\??\c:\nbhhht.exec:\nbhhht.exe85⤵PID:3588
-
\??\c:\tbtnnn.exec:\tbtnnn.exe86⤵PID:3932
-
\??\c:\jpddd.exec:\jpddd.exe87⤵PID:1104
-
\??\c:\rlxrrxr.exec:\rlxrrxr.exe88⤵PID:4908
-
\??\c:\htnnnt.exec:\htnnnt.exe89⤵PID:3812
-
\??\c:\bbtnbh.exec:\bbtnbh.exe90⤵PID:2216
-
\??\c:\vdpvj.exec:\vdpvj.exe91⤵PID:1548
-
\??\c:\fffxxxx.exec:\fffxxxx.exe92⤵PID:3968
-
\??\c:\vjjpv.exec:\vjjpv.exe93⤵PID:4648
-
\??\c:\jppjp.exec:\jppjp.exe94⤵PID:4280
-
\??\c:\xrrrlll.exec:\xrrrlll.exe95⤵PID:4304
-
\??\c:\bnbtnb.exec:\bnbtnb.exe96⤵PID:5036
-
\??\c:\9nhhhh.exec:\9nhhhh.exe97⤵PID:4692
-
\??\c:\5dpvp.exec:\5dpvp.exe98⤵PID:3768
-
\??\c:\xlflflf.exec:\xlflflf.exe99⤵PID:3096
-
\??\c:\hbhbbh.exec:\hbhbbh.exe100⤵PID:5020
-
\??\c:\vjvpv.exec:\vjvpv.exe101⤵PID:896
-
\??\c:\rrxxxxf.exec:\rrxxxxf.exe102⤵PID:804
-
\??\c:\xrrrrrl.exec:\xrrrrrl.exe103⤵PID:2152
-
\??\c:\hbnhhn.exec:\hbnhhn.exe104⤵PID:4176
-
\??\c:\vjvpp.exec:\vjvpp.exe105⤵PID:3360
-
\??\c:\7rxxlrf.exec:\7rxxlrf.exe106⤵PID:4668
-
\??\c:\bnnnnt.exec:\bnnnnt.exe107⤵PID:3948
-
\??\c:\htbbhh.exec:\htbbhh.exe108⤵PID:4284
-
\??\c:\lrlffll.exec:\lrlffll.exe109⤵PID:2488
-
\??\c:\nbtnnn.exec:\nbtnnn.exe110⤵PID:544
-
\??\c:\1htttb.exec:\1htttb.exe111⤵PID:4896
-
\??\c:\jjjjj.exec:\jjjjj.exe112⤵PID:3236
-
\??\c:\lfrflll.exec:\lfrflll.exe113⤵PID:4724
-
\??\c:\lrffxff.exec:\lrffxff.exe114⤵PID:2296
-
\??\c:\hhttnn.exec:\hhttnn.exe115⤵PID:1492
-
\??\c:\jppjj.exec:\jppjj.exe116⤵PID:264
-
\??\c:\xflllrl.exec:\xflllrl.exe117⤵PID:4788
-
\??\c:\fffffll.exec:\fffffll.exe118⤵PID:4904
-
\??\c:\nnnntt.exec:\nnnntt.exe119⤵PID:2180
-
\??\c:\ppddd.exec:\ppddd.exe120⤵PID:5032
-
\??\c:\jjjdv.exec:\jjjdv.exe121⤵PID:1576
-
\??\c:\frlllrr.exec:\frlllrr.exe122⤵PID:4588
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-