Analysis
- max time kernel
150s - max time network
108s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2024, 22:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
51e5d037779f1d977e0e2141afe9b4c0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
- Target 51e5d037779f1d977e0e2141afe9b4c0_NeikiAnalytics.exe
- Size 719KB
- Sample240519-2szrfafc87
- SHA256 2628e6909b79e8b70bef455feaadae30668140d8af6b848222817a6fd8e89eb5
- MD5 51e5d037779f1d977e0e2141afe9b4c0
- SHA1 55387fe0b9c73868a07887d44e521b093a37a10a
- SHA512 4c4c8674c8d935bbdcf6fb9239010d70cf97a9c024c2c5dbdf548120d95aad5ccb37ddb4a7e92e1c5be3bd3532f56104df04bfd3ea56278bb4f08952501c6ecc
- SSDEEP 12288:n3C9yMo+S0L9xRnoq7H9xqYL5oeEF5rna9sUxg7udOxPJVSjYg8lcmJ1MZxEkTs6:SgD4bhoqLDqYLS7w4W
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/4876-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/896-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4284-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/672-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1820-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1464-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2468-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3288-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1260-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2136-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/864-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3760-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1108-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2976-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1996-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1092-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3220-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2788-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2460-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3900-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3768-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1060-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1248-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4264-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1576-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 4232 jvvpj.exe 896 rlfxffl.exe 4284 hhntth.exe 672 ddpjj.exe 2468 tnnhbt.exe 1464 lflfxrl.exe 1820 tbnhnn.exe 1260 ffxrlll.exe 3288 djpdv.exe 2136 rlfxxll.exe 864 3hbttt.exe 3760 jdpjj.exe 1108 rxxrfll.exe 2976 jdvvj.exe 1996 lflfxfx.exe 1092 pjpjd.exe 3220 vdpjp.exe 2788 bthhhn.exe 3608 dpjjv.exe 2460 jpdpp.exe 3900 ddjdv.exe 3768 1htnhh.exe 3752 rxflllf.exe 1060 btnntt.exe 1248 1nnbtt.exe 3492 1tntnn.exe 4264 hbnhnn.exe 2336 ffrlfxl.exe 1576 nhbbhh.exe 3992 rlrrlrl.exe 1808 btttnh.exe 4360 7vddd.exe 4232 vjjjj.exe 4416 1lrrrxx.exe 4156 3thbth.exe 3940 jdjjd.exe 672 xxrfxll.exe 1404 3hnhtn.exe 1492 jpvpj.exe 2528 rrfxxrf.exe 1984 bhnbtn.exe 4256 dvpdv.exe 3552 3rrrffx.exe 4292 bhhntt.exe 3960 9vvpd.exe 228 rflxxrl.exe 636 nnbnhb.exe 4492 rffxrrl.exe 2116 bthhbh.exe 3560 3vppv.exe 2676 rfxrlrf.exe 612 9nnnbh.exe 3460 vppjd.exe 2320 llxxffx.exe 1548 bntnnn.exe 5092 jvddv.exe 2340 frrllrl.exe 4808 5btttb.exe 4144 dvjvd.exe 2460 1xxrlxx.exe 3900 lffxrll.exe 3768 bhnntt.exe 3724 dpddd.exe 2080 xxllrlr.exe -
resource yara_rule behavioral2/memory/4876-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/896-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/672-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1820-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1464-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2468-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3288-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2136-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2136-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/864-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3760-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1108-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2976-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1092-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3220-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2788-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2460-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3900-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3768-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1060-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1248-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4264-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1576-197-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4876 wrote to memory of 4232 4876 51e5d037779f1d977e0e2141afe9b4c0_NeikiAnalytics.exe 83 PID 4876 wrote to memory of 4232 4876 51e5d037779f1d977e0e2141afe9b4c0_NeikiAnalytics.exe 83 PID 4876 wrote to memory of 4232 4876 51e5d037779f1d977e0e2141afe9b4c0_NeikiAnalytics.exe 83 PID 4232 wrote to memory of 896 4232 jvvpj.exe 84 PID 4232 wrote to memory of 896 4232 jvvpj.exe 84 PID 4232 wrote to memory of 896 4232 jvvpj.exe 84 PID 896 wrote to memory of 4284 896 rlfxffl.exe 85 PID 896 wrote to memory of 4284 896 rlfxffl.exe 85 PID 896 wrote to memory of 4284 896 rlfxffl.exe 85 PID 4284 wrote to memory of 672 4284 hhntth.exe 86 PID 4284 wrote to memory of 672 4284 hhntth.exe 86 PID 4284 wrote to memory of 672 4284 hhntth.exe 86 PID 672 wrote to memory of 2468 672 ddpjj.exe 87 PID 672 wrote to memory of 2468 672 ddpjj.exe 87 PID 672 wrote to memory of 2468 672 ddpjj.exe 87 PID 2468 wrote to memory of 1464 2468 tnnhbt.exe 89 PID 2468 wrote to memory of 1464 2468 tnnhbt.exe 89 PID 2468 wrote to memory of 1464 2468 tnnhbt.exe 89 PID 1464 wrote to memory of 1820 1464 lflfxrl.exe 90 PID 1464 wrote to memory of 1820 1464 lflfxrl.exe 90 PID 1464 wrote to memory of 1820 1464 lflfxrl.exe 90 PID 1820 wrote to memory of 1260 1820 tbnhnn.exe 91 PID 1820 wrote to memory of 1260 1820 tbnhnn.exe 91 PID 1820 wrote to memory of 1260 1820 tbnhnn.exe 91 PID 1260 wrote to memory of 3288 1260 ffxrlll.exe 93 PID 1260 wrote to memory of 3288 1260 ffxrlll.exe 93 PID 1260 wrote to memory of 3288 1260 ffxrlll.exe 93 PID 3288 wrote to memory of 2136 3288 djpdv.exe 94 PID 3288 wrote to memory of 2136 3288 djpdv.exe 94 PID 3288 wrote to memory of 2136 3288 djpdv.exe 94 PID 2136 wrote to memory of 864 2136 rlfxxll.exe 95 PID 2136 wrote to memory of 864 2136 rlfxxll.exe 95 PID 2136 wrote to memory of 864 2136 rlfxxll.exe 95 PID 864 wrote to memory of 3760 864 3hbttt.exe 96 PID 864 wrote to memory of 3760 864 3hbttt.exe 96 PID 864 wrote to memory of 3760 864 3hbttt.exe 96 PID 3760 wrote to memory of 1108 3760 jdpjj.exe 98 PID 3760 wrote to memory of 1108 3760 jdpjj.exe 98 PID 3760 wrote to memory of 1108 3760 jdpjj.exe 98 PID 1108 wrote to memory of 2976 1108 rxxrfll.exe 99 PID 1108 wrote to memory of 2976 1108 rxxrfll.exe 99 PID 1108 wrote to memory of 2976 1108 rxxrfll.exe 99 PID 2976 wrote to memory of 1996 2976 jdvvj.exe 100 PID 2976 wrote to memory of 1996 2976 jdvvj.exe 100 PID 2976 wrote to memory of 1996 2976 jdvvj.exe 100 PID 1996 wrote to memory of 1092 1996 lflfxfx.exe 101 PID 1996 wrote to memory of 1092 1996 lflfxfx.exe 101 PID 1996 wrote to memory of 1092 1996 lflfxfx.exe 101 PID 1092 wrote to memory of 3220 1092 pjpjd.exe 102 PID 1092 wrote to memory of 3220 1092 pjpjd.exe 102 PID 1092 wrote to memory of 3220 1092 pjpjd.exe 102 PID 3220 wrote to memory of 2788 3220 vdpjp.exe 103 PID 3220 wrote to memory of 2788 3220 vdpjp.exe 103 PID 3220 wrote to memory of 2788 3220 vdpjp.exe 103 PID 2788 wrote to memory of 3608 2788 bthhhn.exe 104 PID 2788 wrote to memory of 3608 2788 bthhhn.exe 104 PID 2788 wrote to memory of 3608 2788 bthhhn.exe 104 PID 3608 wrote to memory of 2460 3608 dpjjv.exe 105 PID 3608 wrote to memory of 2460 3608 dpjjv.exe 105 PID 3608 wrote to memory of 2460 3608 dpjjv.exe 105 PID 2460 wrote to memory of 3900 2460 jpdpp.exe 106 PID 2460 wrote to memory of 3900 2460 jpdpp.exe 106 PID 2460 wrote to memory of 3900 2460 jpdpp.exe 106 PID 3900 wrote to memory of 3768 3900 ddjdv.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\51e5d037779f1d977e0e2141afe9b4c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\51e5d037779f1d977e0e2141afe9b4c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\jvvpj.exec:\jvvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\rlfxffl.exec:\rlfxffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
\??\c:\hhntth.exec:\hhntth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\ddpjj.exec:\ddpjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\tnnhbt.exec:\tnnhbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\lflfxrl.exec:\lflfxrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\tbnhnn.exec:\tbnhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\ffxrlll.exec:\ffxrlll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\djpdv.exec:\djpdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\rlfxxll.exec:\rlfxxll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\3hbttt.exec:\3hbttt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\jdpjj.exec:\jdpjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\rxxrfll.exec:\rxxrfll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\jdvvj.exec:\jdvvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\lflfxfx.exec:\lflfxfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\pjpjd.exec:\pjpjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\vdpjp.exec:\vdpjp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\bthhhn.exec:\bthhhn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\dpjjv.exec:\dpjjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\jpdpp.exec:\jpdpp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\ddjdv.exec:\ddjdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\1htnhh.exec:\1htnhh.exe23⤵
- Executes dropped EXE
PID:3768 -
\??\c:\rxflllf.exec:\rxflllf.exe24⤵
- Executes dropped EXE
PID:3752 -
\??\c:\btnntt.exec:\btnntt.exe25⤵
- Executes dropped EXE
PID:1060 -
\??\c:\1nnbtt.exec:\1nnbtt.exe26⤵
- Executes dropped EXE
PID:1248 -
\??\c:\1tntnn.exec:\1tntnn.exe27⤵
- Executes dropped EXE
PID:3492 -
\??\c:\hbnhnn.exec:\hbnhnn.exe28⤵
- Executes dropped EXE
PID:4264 -
\??\c:\ffrlfxl.exec:\ffrlfxl.exe29⤵
- Executes dropped EXE
PID:2336 -
\??\c:\nhbbhh.exec:\nhbbhh.exe30⤵
- Executes dropped EXE
PID:1576 -
\??\c:\rlrrlrl.exec:\rlrrlrl.exe31⤵
- Executes dropped EXE
PID:3992 -
\??\c:\btttnh.exec:\btttnh.exe32⤵
- Executes dropped EXE
PID:1808 -
\??\c:\7vddd.exec:\7vddd.exe33⤵
- Executes dropped EXE
PID:4360 -
\??\c:\vjjjj.exec:\vjjjj.exe34⤵
- Executes dropped EXE
PID:4232 -
\??\c:\1lrrrxx.exec:\1lrrrxx.exe35⤵
- Executes dropped EXE
PID:4416 -
\??\c:\3thbth.exec:\3thbth.exe36⤵
- Executes dropped EXE
PID:4156 -
\??\c:\jdjjd.exec:\jdjjd.exe37⤵
- Executes dropped EXE
PID:3940 -
\??\c:\xxrfxll.exec:\xxrfxll.exe38⤵
- Executes dropped EXE
PID:672 -
\??\c:\3hnhtn.exec:\3hnhtn.exe39⤵
- Executes dropped EXE
PID:1404 -
\??\c:\jpvpj.exec:\jpvpj.exe40⤵
- Executes dropped EXE
PID:1492 -
\??\c:\rrfxxrf.exec:\rrfxxrf.exe41⤵
- Executes dropped EXE
PID:2528 -
\??\c:\bhnbtn.exec:\bhnbtn.exe42⤵
- Executes dropped EXE
PID:1984 -
\??\c:\dvpdv.exec:\dvpdv.exe43⤵
- Executes dropped EXE
PID:4256 -
\??\c:\3rrrffx.exec:\3rrrffx.exe44⤵
- Executes dropped EXE
PID:3552 -
\??\c:\bhhntt.exec:\bhhntt.exe45⤵
- Executes dropped EXE
PID:4292 -
\??\c:\9vvpd.exec:\9vvpd.exe46⤵
- Executes dropped EXE
PID:3960 -
\??\c:\rflxxrl.exec:\rflxxrl.exe47⤵
- Executes dropped EXE
PID:228 -
\??\c:\nnbnhb.exec:\nnbnhb.exe48⤵
- Executes dropped EXE
PID:636 -
\??\c:\rffxrrl.exec:\rffxrrl.exe49⤵
- Executes dropped EXE
PID:4492 -
\??\c:\bthhbh.exec:\bthhbh.exe50⤵
- Executes dropped EXE
PID:2116 -
\??\c:\3vppv.exec:\3vppv.exe51⤵
- Executes dropped EXE
PID:3560 -
\??\c:\rfxrlrf.exec:\rfxrlrf.exe52⤵
- Executes dropped EXE
PID:2676 -
\??\c:\9nnnbh.exec:\9nnnbh.exe53⤵
- Executes dropped EXE
PID:612 -
\??\c:\vppjd.exec:\vppjd.exe54⤵
- Executes dropped EXE
PID:3460 -
\??\c:\llxxffx.exec:\llxxffx.exe55⤵
- Executes dropped EXE
PID:2320 -
\??\c:\bntnnn.exec:\bntnnn.exe56⤵
- Executes dropped EXE
PID:1548 -
\??\c:\jvddv.exec:\jvddv.exe57⤵
- Executes dropped EXE
PID:5092 -
\??\c:\frrllrl.exec:\frrllrl.exe58⤵
- Executes dropped EXE
PID:2340 -
\??\c:\5btttb.exec:\5btttb.exe59⤵
- Executes dropped EXE
PID:4808 -
\??\c:\dvjvd.exec:\dvjvd.exe60⤵
- Executes dropped EXE
PID:4144 -
\??\c:\1xxrlxx.exec:\1xxrlxx.exe61⤵
- Executes dropped EXE
PID:2460 -
\??\c:\lffxrll.exec:\lffxrll.exe62⤵
- Executes dropped EXE
PID:3900 -
\??\c:\bhnntt.exec:\bhnntt.exe63⤵
- Executes dropped EXE
PID:3768 -
\??\c:\dpddd.exec:\dpddd.exe64⤵
- Executes dropped EXE
PID:3724 -
\??\c:\xxllrlr.exec:\xxllrlr.exe65⤵
- Executes dropped EXE
PID:2080 -
\??\c:\thhbnh.exec:\thhbnh.exe66⤵PID:2308
-
\??\c:\3vddp.exec:\3vddp.exe67⤵PID:4660
-
\??\c:\lfxlfxx.exec:\lfxlfxx.exe68⤵PID:4268
-
\??\c:\9bbtnt.exec:\9bbtnt.exe69⤵PID:2540
-
\??\c:\jddvp.exec:\jddvp.exe70⤵PID:1472
-
\??\c:\rrrrrrl.exec:\rrrrrrl.exe71⤵PID:2980
-
\??\c:\tnnhhh.exec:\tnnhhh.exe72⤵PID:4736
-
\??\c:\jdvpp.exec:\jdvpp.exe73⤵PID:1696
-
\??\c:\ffxfxxr.exec:\ffxfxxr.exe74⤵PID:3496
-
\??\c:\llrrrrx.exec:\llrrrrx.exe75⤵PID:4352
-
\??\c:\thtbbb.exec:\thtbbb.exe76⤵PID:2740
-
\??\c:\dpdvj.exec:\dpdvj.exe77⤵PID:4100
-
\??\c:\7lfxllf.exec:\7lfxllf.exe78⤵PID:3932
-
\??\c:\ntttnn.exec:\ntttnn.exe79⤵PID:4284
-
\??\c:\dvvpj.exec:\dvvpj.exe80⤵PID:3712
-
\??\c:\7rxrlrl.exec:\7rxrlrl.exe81⤵PID:4956
-
\??\c:\7ntnhn.exec:\7ntnhn.exe82⤵PID:208
-
\??\c:\9djjd.exec:\9djjd.exe83⤵PID:5112
-
\??\c:\5xrxrxx.exec:\5xrxrxx.exe84⤵PID:692
-
\??\c:\nnhbtn.exec:\nnhbtn.exe85⤵PID:5044
-
\??\c:\tntntt.exec:\tntntt.exe86⤵PID:2088
-
\??\c:\3dvpj.exec:\3dvpj.exe87⤵PID:1940
-
\??\c:\ttbbbh.exec:\ttbbbh.exe88⤵PID:3004
-
\??\c:\vdddv.exec:\vdddv.exe89⤵PID:3760
-
\??\c:\rffxrlf.exec:\rffxrlf.exe90⤵PID:1736
-
\??\c:\3tnhbt.exec:\3tnhbt.exe91⤵PID:4080
-
\??\c:\hbtnhh.exec:\hbtnhh.exe92⤵PID:2640
-
\??\c:\xrrlffx.exec:\xrrlffx.exe93⤵PID:4280
-
\??\c:\1nhbbh.exec:\1nhbbh.exe94⤵PID:3576
-
\??\c:\htbtnh.exec:\htbtnh.exe95⤵PID:3748
-
\??\c:\xrfxxff.exec:\xrfxxff.exe96⤵PID:3056
-
\??\c:\lllffxx.exec:\lllffxx.exe97⤵PID:2344
-
\??\c:\3bbhhn.exec:\3bbhhn.exe98⤵PID:4780
-
\??\c:\pdvjd.exec:\pdvjd.exe99⤵PID:4820
-
\??\c:\llffxfx.exec:\llffxfx.exe100⤵PID:1672
-
\??\c:\ppvdd.exec:\ppvdd.exe101⤵PID:3464
-
\??\c:\rflxfll.exec:\rflxfll.exe102⤵PID:544
-
\??\c:\btntnb.exec:\btntnb.exe103⤵PID:3244
-
\??\c:\tbbnhh.exec:\tbbnhh.exe104⤵PID:4752
-
\??\c:\jdpdv.exec:\jdpdv.exe105⤵PID:2384
-
\??\c:\3rfffll.exec:\3rfffll.exe106⤵PID:4332
-
\??\c:\nhbttt.exec:\nhbttt.exe107⤵PID:336
-
\??\c:\vvdpj.exec:\vvdpj.exe108⤵PID:3448
-
\??\c:\rxllffx.exec:\rxllffx.exe109⤵PID:892
-
\??\c:\nhnhhb.exec:\nhnhhb.exe110⤵PID:3024
-
\??\c:\vpppd.exec:\vpppd.exe111⤵PID:1564
-
\??\c:\lflfxrl.exec:\lflfxrl.exe112⤵PID:4408
-
\??\c:\nnnnht.exec:\nnnnht.exe113⤵PID:548
-
\??\c:\jdjdd.exec:\jdjdd.exe114⤵PID:1312
-
\??\c:\5pvdd.exec:\5pvdd.exe115⤵PID:3264
-
\??\c:\3ttttb.exec:\3ttttb.exe116⤵PID:896
-
\??\c:\djpdp.exec:\djpdp.exe117⤵PID:2392
-
\??\c:\5xllfrl.exec:\5xllfrl.exe118⤵PID:4156
-
\??\c:\bthnnt.exec:\bthnnt.exe119⤵PID:3504
-
\??\c:\7pvvp.exec:\7pvvp.exe120⤵PID:3600
-
\??\c:\7llrrff.exec:\7llrrff.exe121⤵PID:828
-
\??\c:\ntttbh.exec:\ntttbh.exe122⤵PID:208
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-