Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
01-06-2024 10:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
37ace104493fc601d378121297017200_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
37ace104493fc601d378121297017200_NeikiAnalytics.exe
-
Size
56KB
-
MD5
37ace104493fc601d378121297017200
-
SHA1
8f12daec013402982b6b1753abf47949dc316b43
-
SHA256
03edc67a971ca7ff5d91525980507167627342ea39009f50abdf90a3c233abc9
-
SHA512
91c9384b94c83a81205f25c53a093b77ba1de8fdac195f29c7cb7e8858da7848a24a4d033e5cec01da0c24a7902a913c5b99ccbe4d2a98127c1b900d46250907
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0chV+:ymb3NkkiQ3mdBjF0cr+
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/3916-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/212-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/212-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3828-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2892-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3692-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1844-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3104-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4640-81-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4640-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3836-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4152-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/912-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4964-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2072-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3032-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1712-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1492-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3708-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1076-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3520-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3964-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3828 lxrlffx.exe 212 frrlffx.exe 2892 9hnnhn.exe 4544 dpjdj.exe 3692 flrlfff.exe 1844 lfffflf.exe 3104 tbhtnn.exe 448 ppdvp.exe 2072 ddddd.exe 4640 rfrrlll.exe 3836 lffxxrx.exe 5020 bntnnn.exe 4152 3hnnhh.exe 912 jpjpp.exe 4088 dvvvp.exe 4964 1lffrrr.exe 5076 hnnnnb.exe 5040 ppjdd.exe 4896 jvddv.exe 3032 flrrlrr.exe 1712 tbhnth.exe 1492 pjvpv.exe 8 frrlrlf.exe 3708 hbbtnn.exe 1872 jdddp.exe 1076 rlllxxl.exe 3520 rflffxx.exe 4056 thnhnn.exe 3968 vvpdd.exe 4904 rrrrrrr.exe 3964 nhbbhn.exe 4796 7bnhhn.exe 4416 pjjdj.exe 4112 xfxfxxf.exe 4196 fffxxxx.exe 4580 nbnnhh.exe 4324 djvdv.exe 932 jjdvd.exe 5016 fxffrrx.exe 1928 lrlfrlx.exe 1484 hbthtb.exe 700 pppdv.exe 4220 pppvj.exe 4412 rrrlrxx.exe 1448 frxlfxl.exe 2388 xrrrrrf.exe 3104 tnnhhb.exe 1728 jdddv.exe 4004 3jvpp.exe 2848 pjpjd.exe 1052 xxrlrrf.exe 1040 hhhbtb.exe 1168 ppvpv.exe 3784 vjvpd.exe 4084 rfrlllr.exe 2096 hthbnh.exe 4140 htbnnn.exe 4136 ddjjd.exe 2752 3xfxlrr.exe 5004 rlrrlrr.exe 4864 ttnhth.exe 1668 jpddj.exe 816 lxrfxrl.exe 2556 rlffffx.exe -
resource yara_rule behavioral2/memory/3916-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/212-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/212-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/212-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3828-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2892-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3692-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1844-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3104-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4152-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/912-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4964-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1712-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1492-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/8-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3708-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1076-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3520-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3964-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3916 wrote to memory of 3828 3916 37ace104493fc601d378121297017200_NeikiAnalytics.exe 82 PID 3916 wrote to memory of 3828 3916 37ace104493fc601d378121297017200_NeikiAnalytics.exe 82 PID 3916 wrote to memory of 3828 3916 37ace104493fc601d378121297017200_NeikiAnalytics.exe 82 PID 3828 wrote to memory of 212 3828 lxrlffx.exe 83 PID 3828 wrote to memory of 212 3828 lxrlffx.exe 83 PID 3828 wrote to memory of 212 3828 lxrlffx.exe 83 PID 212 wrote to memory of 2892 212 frrlffx.exe 84 PID 212 wrote to memory of 2892 212 frrlffx.exe 84 PID 212 wrote to memory of 2892 212 frrlffx.exe 84 PID 2892 wrote to memory of 4544 2892 9hnnhn.exe 85 PID 2892 wrote to memory of 4544 2892 9hnnhn.exe 85 PID 2892 wrote to memory of 4544 2892 9hnnhn.exe 85 PID 4544 wrote to memory of 3692 4544 dpjdj.exe 86 PID 4544 wrote to memory of 3692 4544 dpjdj.exe 86 PID 4544 wrote to memory of 3692 4544 dpjdj.exe 86 PID 3692 wrote to memory of 1844 3692 flrlfff.exe 87 PID 3692 wrote to memory of 1844 3692 flrlfff.exe 87 PID 3692 wrote to memory of 1844 3692 flrlfff.exe 87 PID 1844 wrote to memory of 3104 1844 lfffflf.exe 88 PID 1844 wrote to memory of 3104 1844 lfffflf.exe 88 PID 1844 wrote to memory of 3104 1844 lfffflf.exe 88 PID 3104 wrote to memory of 448 3104 tbhtnn.exe 89 PID 3104 wrote to memory of 448 3104 tbhtnn.exe 89 PID 3104 wrote to memory of 448 3104 tbhtnn.exe 89 PID 448 wrote to memory of 2072 448 ppdvp.exe 90 PID 448 wrote to memory of 2072 448 ppdvp.exe 90 PID 448 wrote to memory of 2072 448 ppdvp.exe 90 PID 2072 wrote to memory of 4640 2072 ddddd.exe 91 PID 2072 wrote to memory of 4640 2072 ddddd.exe 91 PID 2072 wrote to memory of 4640 2072 ddddd.exe 91 PID 4640 wrote to memory of 3836 4640 rfrrlll.exe 92 PID 4640 wrote to memory of 3836 4640 rfrrlll.exe 92 PID 4640 wrote to memory of 3836 4640 rfrrlll.exe 92 PID 3836 wrote to memory of 5020 3836 lffxxrx.exe 93 PID 3836 wrote to memory of 5020 3836 lffxxrx.exe 93 PID 3836 wrote to memory of 5020 3836 lffxxrx.exe 93 PID 5020 wrote to memory of 4152 5020 bntnnn.exe 94 PID 5020 wrote to memory of 4152 5020 bntnnn.exe 94 PID 5020 wrote to memory of 4152 5020 bntnnn.exe 94 PID 4152 wrote to memory of 912 4152 3hnnhh.exe 95 PID 4152 wrote to memory of 912 4152 3hnnhh.exe 95 PID 4152 wrote to memory of 912 4152 3hnnhh.exe 95 PID 912 wrote to memory of 4088 912 jpjpp.exe 97 PID 912 wrote to memory of 4088 912 jpjpp.exe 97 PID 912 wrote to memory of 4088 912 jpjpp.exe 97 PID 4088 wrote to memory of 4964 4088 dvvvp.exe 98 PID 4088 wrote to memory of 4964 4088 dvvvp.exe 98 PID 4088 wrote to memory of 4964 4088 dvvvp.exe 98 PID 4964 wrote to memory of 5076 4964 1lffrrr.exe 100 PID 4964 wrote to memory of 5076 4964 1lffrrr.exe 100 PID 4964 wrote to memory of 5076 4964 1lffrrr.exe 100 PID 5076 wrote to memory of 5040 5076 hnnnnb.exe 101 PID 5076 wrote to memory of 5040 5076 hnnnnb.exe 101 PID 5076 wrote to memory of 5040 5076 hnnnnb.exe 101 PID 5040 wrote to memory of 4896 5040 ppjdd.exe 102 PID 5040 wrote to memory of 4896 5040 ppjdd.exe 102 PID 5040 wrote to memory of 4896 5040 ppjdd.exe 102 PID 4896 wrote to memory of 3032 4896 jvddv.exe 103 PID 4896 wrote to memory of 3032 4896 jvddv.exe 103 PID 4896 wrote to memory of 3032 4896 jvddv.exe 103 PID 3032 wrote to memory of 1712 3032 flrrlrr.exe 105 PID 3032 wrote to memory of 1712 3032 flrrlrr.exe 105 PID 3032 wrote to memory of 1712 3032 flrrlrr.exe 105 PID 1712 wrote to memory of 1492 1712 tbhnth.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\37ace104493fc601d378121297017200_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\37ace104493fc601d378121297017200_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\lxrlffx.exec:\lxrlffx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\frrlffx.exec:\frrlffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\9hnnhn.exec:\9hnnhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\dpjdj.exec:\dpjdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\flrlfff.exec:\flrlfff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\lfffflf.exec:\lfffflf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\tbhtnn.exec:\tbhtnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\ppdvp.exec:\ppdvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\ddddd.exec:\ddddd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\rfrrlll.exec:\rfrrlll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\lffxxrx.exec:\lffxxrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\bntnnn.exec:\bntnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\3hnnhh.exec:\3hnnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\jpjpp.exec:\jpjpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\dvvvp.exec:\dvvvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\1lffrrr.exec:\1lffrrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\hnnnnb.exec:\hnnnnb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\ppjdd.exec:\ppjdd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\jvddv.exec:\jvddv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\flrrlrr.exec:\flrrlrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\tbhnth.exec:\tbhnth.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\pjvpv.exec:\pjvpv.exe23⤵
- Executes dropped EXE
PID:1492 -
\??\c:\frrlrlf.exec:\frrlrlf.exe24⤵
- Executes dropped EXE
PID:8 -
\??\c:\hbbtnn.exec:\hbbtnn.exe25⤵
- Executes dropped EXE
PID:3708 -
\??\c:\jdddp.exec:\jdddp.exe26⤵
- Executes dropped EXE
PID:1872 -
\??\c:\rlllxxl.exec:\rlllxxl.exe27⤵
- Executes dropped EXE
PID:1076 -
\??\c:\rflffxx.exec:\rflffxx.exe28⤵
- Executes dropped EXE
PID:3520 -
\??\c:\thnhnn.exec:\thnhnn.exe29⤵
- Executes dropped EXE
PID:4056 -
\??\c:\vvpdd.exec:\vvpdd.exe30⤵
- Executes dropped EXE
PID:3968 -
\??\c:\rrrrrrr.exec:\rrrrrrr.exe31⤵
- Executes dropped EXE
PID:4904 -
\??\c:\nhbbhn.exec:\nhbbhn.exe32⤵
- Executes dropped EXE
PID:3964 -
\??\c:\7bnhhn.exec:\7bnhhn.exe33⤵
- Executes dropped EXE
PID:4796 -
\??\c:\pjjdj.exec:\pjjdj.exe34⤵
- Executes dropped EXE
PID:4416 -
\??\c:\xfxfxxf.exec:\xfxfxxf.exe35⤵
- Executes dropped EXE
PID:4112 -
\??\c:\fffxxxx.exec:\fffxxxx.exe36⤵
- Executes dropped EXE
PID:4196 -
\??\c:\nbnnhh.exec:\nbnnhh.exe37⤵
- Executes dropped EXE
PID:4580 -
\??\c:\djvdv.exec:\djvdv.exe38⤵
- Executes dropped EXE
PID:4324 -
\??\c:\jjdvd.exec:\jjdvd.exe39⤵
- Executes dropped EXE
PID:932 -
\??\c:\fxffrrx.exec:\fxffrrx.exe40⤵
- Executes dropped EXE
PID:5016 -
\??\c:\lrlfrlx.exec:\lrlfrlx.exe41⤵
- Executes dropped EXE
PID:1928 -
\??\c:\hbthtb.exec:\hbthtb.exe42⤵
- Executes dropped EXE
PID:1484 -
\??\c:\pppdv.exec:\pppdv.exe43⤵
- Executes dropped EXE
PID:700 -
\??\c:\pppvj.exec:\pppvj.exe44⤵
- Executes dropped EXE
PID:4220 -
\??\c:\rrrlrxx.exec:\rrrlrxx.exe45⤵
- Executes dropped EXE
PID:4412 -
\??\c:\frxlfxl.exec:\frxlfxl.exe46⤵
- Executes dropped EXE
PID:1448 -
\??\c:\xrrrrrf.exec:\xrrrrrf.exe47⤵
- Executes dropped EXE
PID:2388 -
\??\c:\tnnhhb.exec:\tnnhhb.exe48⤵
- Executes dropped EXE
PID:3104 -
\??\c:\jdddv.exec:\jdddv.exe49⤵
- Executes dropped EXE
PID:1728 -
\??\c:\3jvpp.exec:\3jvpp.exe50⤵
- Executes dropped EXE
PID:4004 -
\??\c:\pjpjd.exec:\pjpjd.exe51⤵
- Executes dropped EXE
PID:2848 -
\??\c:\xxrlrrf.exec:\xxrlrrf.exe52⤵
- Executes dropped EXE
PID:1052 -
\??\c:\hhhbtb.exec:\hhhbtb.exe53⤵
- Executes dropped EXE
PID:1040 -
\??\c:\ppvpv.exec:\ppvpv.exe54⤵
- Executes dropped EXE
PID:1168 -
\??\c:\vjvpd.exec:\vjvpd.exe55⤵
- Executes dropped EXE
PID:3784 -
\??\c:\rfrlllr.exec:\rfrlllr.exe56⤵
- Executes dropped EXE
PID:4084 -
\??\c:\hthbnh.exec:\hthbnh.exe57⤵
- Executes dropped EXE
PID:2096 -
\??\c:\htbnnn.exec:\htbnnn.exe58⤵
- Executes dropped EXE
PID:4140 -
\??\c:\ddjjd.exec:\ddjjd.exe59⤵
- Executes dropped EXE
PID:4136 -
\??\c:\3xfxlrr.exec:\3xfxlrr.exe60⤵
- Executes dropped EXE
PID:2752 -
\??\c:\rlrrlrr.exec:\rlrrlrr.exe61⤵
- Executes dropped EXE
PID:5004 -
\??\c:\ttnhth.exec:\ttnhth.exe62⤵
- Executes dropped EXE
PID:4864 -
\??\c:\jpddj.exec:\jpddj.exe63⤵
- Executes dropped EXE
PID:1668 -
\??\c:\lxrfxrl.exec:\lxrfxrl.exe64⤵
- Executes dropped EXE
PID:816 -
\??\c:\rlffffx.exec:\rlffffx.exe65⤵
- Executes dropped EXE
PID:2556 -
\??\c:\nbbbnn.exec:\nbbbnn.exe66⤵PID:452
-
\??\c:\vjdvp.exec:\vjdvp.exe67⤵PID:1772
-
\??\c:\jpvpj.exec:\jpvpj.exe68⤵PID:4588
-
\??\c:\xrrlxxf.exec:\xrrlxxf.exe69⤵PID:1780
-
\??\c:\rlxlxlx.exec:\rlxlxlx.exe70⤵PID:3936
-
\??\c:\btnnnn.exec:\btnnnn.exe71⤵PID:1856
-
\??\c:\vvppv.exec:\vvppv.exe72⤵PID:3708
-
\??\c:\jpdvp.exec:\jpdvp.exe73⤵PID:1872
-
\??\c:\ffflxrf.exec:\ffflxrf.exe74⤵PID:1980
-
\??\c:\rfllfxx.exec:\rfllfxx.exe75⤵PID:4652
-
\??\c:\tntthb.exec:\tntthb.exe76⤵PID:3164
-
\??\c:\dvpvv.exec:\dvpvv.exe77⤵PID:5092
-
\??\c:\ddvpj.exec:\ddvpj.exe78⤵PID:4552
-
\??\c:\fxlfxrr.exec:\fxlfxrr.exe79⤵PID:4904
-
\??\c:\httbtb.exec:\httbtb.exe80⤵PID:4868
-
\??\c:\5vppd.exec:\5vppd.exe81⤵PID:4852
-
\??\c:\rfxllrr.exec:\rfxllrr.exe82⤵PID:1332
-
\??\c:\bnhthh.exec:\bnhthh.exe83⤵PID:3160
-
\??\c:\1pvpd.exec:\1pvpd.exe84⤵PID:2632
-
\??\c:\5dvpp.exec:\5dvpp.exe85⤵PID:2240
-
\??\c:\llxrfrf.exec:\llxrfrf.exe86⤵PID:336
-
\??\c:\lrrrlrl.exec:\lrrrlrl.exe87⤵PID:3916
-
\??\c:\bhttht.exec:\bhttht.exe88⤵PID:3448
-
\??\c:\7bttnn.exec:\7bttnn.exe89⤵PID:220
-
\??\c:\jdjdv.exec:\jdjdv.exe90⤵PID:3368
-
\??\c:\5xlxxll.exec:\5xlxxll.exe91⤵PID:208
-
\??\c:\rrxrlll.exec:\rrxrlll.exe92⤵PID:2816
-
\??\c:\nhbhth.exec:\nhbhth.exe93⤵PID:3844
-
\??\c:\bhnhbn.exec:\bhnhbn.exe94⤵PID:3048
-
\??\c:\dvjdd.exec:\dvjdd.exe95⤵PID:1148
-
\??\c:\llrrxfx.exec:\llrrxfx.exe96⤵PID:1448
-
\??\c:\rrxxrxx.exec:\rrxxrxx.exe97⤵PID:2704
-
\??\c:\ntbttb.exec:\ntbttb.exe98⤵PID:3104
-
\??\c:\hhttbh.exec:\hhttbh.exe99⤵PID:2092
-
\??\c:\vpvvd.exec:\vpvvd.exe100⤵PID:1360
-
\??\c:\xxfllrx.exec:\xxfllrx.exe101⤵PID:1124
-
\??\c:\nbhbbb.exec:\nbhbbb.exe102⤵PID:3836
-
\??\c:\dpvpj.exec:\dpvpj.exe103⤵PID:2940
-
\??\c:\1ppjv.exec:\1ppjv.exe104⤵PID:5048
-
\??\c:\llrlxxr.exec:\llrlxxr.exe105⤵PID:924
-
\??\c:\nhhhbb.exec:\nhhhbb.exe106⤵PID:4080
-
\??\c:\5nbbbb.exec:\5nbbbb.exe107⤵PID:4168
-
\??\c:\vddvd.exec:\vddvd.exe108⤵PID:4140
-
\??\c:\vdvjd.exec:\vdvjd.exe109⤵PID:4436
-
\??\c:\fxxfllf.exec:\fxxfllf.exe110⤵PID:1588
-
\??\c:\1ffxrrr.exec:\1ffxrrr.exe111⤵PID:5076
-
\??\c:\nhnnhh.exec:\nhnnhh.exe112⤵PID:3772
-
\??\c:\jddvp.exec:\jddvp.exe113⤵PID:4420
-
\??\c:\jddjj.exec:\jddjj.exe114⤵PID:3744
-
\??\c:\7rlfxrx.exec:\7rlfxrx.exe115⤵PID:2532
-
\??\c:\nnbbnt.exec:\nnbbnt.exe116⤵PID:5012
-
\??\c:\hhtbnn.exec:\hhtbnn.exe117⤵PID:4404
-
\??\c:\vpvvd.exec:\vpvvd.exe118⤵PID:1732
-
\??\c:\ppvpv.exec:\ppvpv.exe119⤵PID:468
-
\??\c:\vdppp.exec:\vdppp.exe120⤵PID:3820
-
\??\c:\rfrrrfl.exec:\rfrrrfl.exe121⤵PID:2592
-
\??\c:\ffxxrrr.exec:\ffxxrrr.exe122⤵PID:3896
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-