Analysis
- max time kernel
150s - max time network
114s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
05/06/2024, 07:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
49b3c88a3529cdcd1ca113372143f3d0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
- Target 49b3c88a3529cdcd1ca113372143f3d0_NeikiAnalytics.exe
- Size 54KB
- Sample240605-jn5ssaaa8v
- SHA256 7bdee45dba50d9f0f85d8c76930a4fb6398dddf2dbc6ea78d5bf5856e9b96341
- MD5 49b3c88a3529cdcd1ca113372143f3d0
- SHA1 fb739bc6ae87bcb2c8e9197d149eb1f5a819612d
- SHA512 e8629d8d98fe2656b1edf7978fb5d7367a84c93a364f31baf16f582e98f5fb9afc70d73a9d891aab017dc37601fc813efa5b413fe8811213983d36faf5e07eee
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIfo6:ymb3NkkiQ3mdBjFIQ6
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/3160-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2396-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2396-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2096-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1060-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/828-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2580-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3412-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3904-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2948-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3776-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4492-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2080-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3304-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3224-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1732-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4728-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4136-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2176-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2164-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1600-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4580-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4188-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 2096 jvddv.exe 2396 xrflrrr.exe 1060 lrffrrx.exe 828 ddjdj.exe 2580 xxrxxxx.exe 3412 nnnnnt.exe 3904 7bhbbb.exe 2948 dpddj.exe 3776 5lrrlrr.exe 3736 nnhhhh.exe 4492 1htntt.exe 2052 vpvvv.exe 2080 xxxrlrx.exe 3304 ttbbnt.exe 3224 hnnnhh.exe 4936 vpjvj.exe 1732 9rrrrxf.exe 4728 tthbbt.exe 3368 tntnhh.exe 4136 vppjd.exe 2176 ddpjv.exe 2164 ffffrrx.exe 1600 xrfffxl.exe 4580 vjpjj.exe 4544 xfffrxx.exe 2344 llfxxxr.exe 4724 tbhhbb.exe 1704 dpvvj.exe 4188 9ddjv.exe 912 fxxrffx.exe 2244 rffxrrl.exe 4804 bthhbb.exe 4944 jjvvp.exe 2392 dvjjd.exe 1724 7lrlxxl.exe 4352 xrlfxxx.exe 512 5nhhhn.exe 1552 vvvjd.exe 1532 llrxfrl.exe 4624 5frllll.exe 3160 nhnhhn.exe 2416 djppj.exe 4760 7vvvp.exe 348 rlrrlll.exe 800 xfxrlff.exe 904 1ttnhb.exe 380 hbnnnn.exe 4688 pjvpp.exe 1184 1rrlxxr.exe 540 tnnhbn.exe 3272 ttnthn.exe 3976 vpjpd.exe 2356 vjjdp.exe 4492 rllrlll.exe 1264 1bhhbb.exe 3760 nntnbb.exe 2376 pjdvj.exe 1664 jpjvj.exe 3752 fllxrlf.exe 3456 xrfxfff.exe 1164 bntnht.exe 1376 pvdjj.exe 3500 jvpjd.exe 5108 1rfxlrl.exe -
resource yara_rule behavioral2/memory/3160-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2396-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1060-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1060-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2096-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1060-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/828-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2580-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3412-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3904-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2948-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3776-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3736-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3736-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4492-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2080-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3304-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3224-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1732-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4728-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4136-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2176-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2164-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1600-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4188-193-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3160 wrote to memory of 2096 3160 49b3c88a3529cdcd1ca113372143f3d0_NeikiAnalytics.exe 83 PID 3160 wrote to memory of 2096 3160 49b3c88a3529cdcd1ca113372143f3d0_NeikiAnalytics.exe 83 PID 3160 wrote to memory of 2096 3160 49b3c88a3529cdcd1ca113372143f3d0_NeikiAnalytics.exe 83 PID 2096 wrote to memory of 2396 2096 jvddv.exe 84 PID 2096 wrote to memory of 2396 2096 jvddv.exe 84 PID 2096 wrote to memory of 2396 2096 jvddv.exe 84 PID 2396 wrote to memory of 1060 2396 xrflrrr.exe 85 PID 2396 wrote to memory of 1060 2396 xrflrrr.exe 85 PID 2396 wrote to memory of 1060 2396 xrflrrr.exe 85 PID 1060 wrote to memory of 828 1060 lrffrrx.exe 86 PID 1060 wrote to memory of 828 1060 lrffrrx.exe 86 PID 1060 wrote to memory of 828 1060 lrffrrx.exe 86 PID 828 wrote to memory of 2580 828 ddjdj.exe 87 PID 828 wrote to memory of 2580 828 ddjdj.exe 87 PID 828 wrote to memory of 2580 828 ddjdj.exe 87 PID 2580 wrote to memory of 3412 2580 xxrxxxx.exe 88 PID 2580 wrote to memory of 3412 2580 xxrxxxx.exe 88 PID 2580 wrote to memory of 3412 2580 xxrxxxx.exe 88 PID 3412 wrote to memory of 3904 3412 nnnnnt.exe 89 PID 3412 wrote to memory of 3904 3412 nnnnnt.exe 89 PID 3412 wrote to memory of 3904 3412 nnnnnt.exe 89 PID 3904 wrote to memory of 2948 3904 7bhbbb.exe 90 PID 3904 wrote to memory of 2948 3904 7bhbbb.exe 90 PID 3904 wrote to memory of 2948 3904 7bhbbb.exe 90 PID 2948 wrote to memory of 3776 2948 dpddj.exe 91 PID 2948 wrote to memory of 3776 2948 dpddj.exe 91 PID 2948 wrote to memory of 3776 2948 dpddj.exe 91 PID 3776 wrote to memory of 3736 3776 5lrrlrr.exe 92 PID 3776 wrote to memory of 3736 3776 5lrrlrr.exe 92 PID 3776 wrote to memory of 3736 3776 5lrrlrr.exe 92 PID 3736 wrote to memory of 4492 3736 nnhhhh.exe 93 PID 3736 wrote to memory of 4492 3736 nnhhhh.exe 93 PID 3736 wrote to memory of 4492 3736 nnhhhh.exe 93 PID 4492 wrote to memory of 2052 4492 1htntt.exe 94 PID 4492 wrote to memory of 2052 4492 1htntt.exe 94 PID 4492 wrote to memory of 2052 4492 1htntt.exe 94 PID 2052 wrote to memory of 2080 2052 vpvvv.exe 95 PID 2052 wrote to memory of 2080 2052 vpvvv.exe 95 PID 2052 wrote to memory of 2080 2052 vpvvv.exe 95 PID 2080 wrote to memory of 3304 2080 xxxrlrx.exe 96 PID 2080 wrote to memory of 3304 2080 xxxrlrx.exe 96 PID 2080 wrote to memory of 3304 2080 xxxrlrx.exe 96 PID 3304 wrote to memory of 3224 3304 ttbbnt.exe 97 PID 3304 wrote to memory of 3224 3304 ttbbnt.exe 97 PID 3304 wrote to memory of 3224 3304 ttbbnt.exe 97 PID 3224 wrote to memory of 4936 3224 hnnnhh.exe 99 PID 3224 wrote to memory of 4936 3224 hnnnhh.exe 99 PID 3224 wrote to memory of 4936 3224 hnnnhh.exe 99 PID 4936 wrote to memory of 1732 4936 vpjvj.exe 100 PID 4936 wrote to memory of 1732 4936 vpjvj.exe 100 PID 4936 wrote to memory of 1732 4936 vpjvj.exe 100 PID 1732 wrote to memory of 4728 1732 9rrrrxf.exe 101 PID 1732 wrote to memory of 4728 1732 9rrrrxf.exe 101 PID 1732 wrote to memory of 4728 1732 9rrrrxf.exe 101 PID 4728 wrote to memory of 3368 4728 tthbbt.exe 102 PID 4728 wrote to memory of 3368 4728 tthbbt.exe 102 PID 4728 wrote to memory of 3368 4728 tthbbt.exe 102 PID 3368 wrote to memory of 4136 3368 tntnhh.exe 103 PID 3368 wrote to memory of 4136 3368 tntnhh.exe 103 PID 3368 wrote to memory of 4136 3368 tntnhh.exe 103 PID 4136 wrote to memory of 2176 4136 vppjd.exe 104 PID 4136 wrote to memory of 2176 4136 vppjd.exe 104 PID 4136 wrote to memory of 2176 4136 vppjd.exe 104 PID 2176 wrote to memory of 2164 2176 ddpjv.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\49b3c88a3529cdcd1ca113372143f3d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\49b3c88a3529cdcd1ca113372143f3d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\jvddv.exec:\jvddv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\xrflrrr.exec:\xrflrrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\lrffrrx.exec:\lrffrrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\ddjdj.exec:\ddjdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
\??\c:\xxrxxxx.exec:\xxrxxxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\nnnnnt.exec:\nnnnnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\7bhbbb.exec:\7bhbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\dpddj.exec:\dpddj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\5lrrlrr.exec:\5lrrlrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\nnhhhh.exec:\nnhhhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
\??\c:\1htntt.exec:\1htntt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\vpvvv.exec:\vpvvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\xxxrlrx.exec:\xxxrlrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\ttbbnt.exec:\ttbbnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\hnnnhh.exec:\hnnnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\vpjvj.exec:\vpjvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\9rrrrxf.exec:\9rrrrxf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\tthbbt.exec:\tthbbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\tntnhh.exec:\tntnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\vppjd.exec:\vppjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\ddpjv.exec:\ddpjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\ffffrrx.exec:\ffffrrx.exe23⤵
- Executes dropped EXE
PID:2164 -
\??\c:\xrfffxl.exec:\xrfffxl.exe24⤵
- Executes dropped EXE
PID:1600 -
\??\c:\vjpjj.exec:\vjpjj.exe25⤵
- Executes dropped EXE
PID:4580 -
\??\c:\xfffrxx.exec:\xfffrxx.exe26⤵
- Executes dropped EXE
PID:4544 -
\??\c:\llfxxxr.exec:\llfxxxr.exe27⤵
- Executes dropped EXE
PID:2344 -
\??\c:\tbhhbb.exec:\tbhhbb.exe28⤵
- Executes dropped EXE
PID:4724 -
\??\c:\dpvvj.exec:\dpvvj.exe29⤵
- Executes dropped EXE
PID:1704 -
\??\c:\9ddjv.exec:\9ddjv.exe30⤵
- Executes dropped EXE
PID:4188 -
\??\c:\fxxrffx.exec:\fxxrffx.exe31⤵
- Executes dropped EXE
PID:912 -
\??\c:\rffxrrl.exec:\rffxrrl.exe32⤵
- Executes dropped EXE
PID:2244 -
\??\c:\bthhbb.exec:\bthhbb.exe33⤵
- Executes dropped EXE
PID:4804 -
\??\c:\jjvvp.exec:\jjvvp.exe34⤵
- Executes dropped EXE
PID:4944 -
\??\c:\dvjjd.exec:\dvjjd.exe35⤵
- Executes dropped EXE
PID:2392 -
\??\c:\7lrlxxl.exec:\7lrlxxl.exe36⤵
- Executes dropped EXE
PID:1724 -
\??\c:\xrlfxxx.exec:\xrlfxxx.exe37⤵
- Executes dropped EXE
PID:4352 -
\??\c:\5nhhhn.exec:\5nhhhn.exe38⤵
- Executes dropped EXE
PID:512 -
\??\c:\vvvjd.exec:\vvvjd.exe39⤵
- Executes dropped EXE
PID:1552 -
\??\c:\llrxfrl.exec:\llrxfrl.exe40⤵
- Executes dropped EXE
PID:1532 -
\??\c:\5frllll.exec:\5frllll.exe41⤵
- Executes dropped EXE
PID:4624 -
\??\c:\nhnhhn.exec:\nhnhhn.exe42⤵
- Executes dropped EXE
PID:3160 -
\??\c:\djppj.exec:\djppj.exe43⤵
- Executes dropped EXE
PID:2416 -
\??\c:\7vvvp.exec:\7vvvp.exe44⤵
- Executes dropped EXE
PID:4760 -
\??\c:\rlrrlll.exec:\rlrrlll.exe45⤵
- Executes dropped EXE
PID:348 -
\??\c:\xfxrlff.exec:\xfxrlff.exe46⤵
- Executes dropped EXE
PID:800 -
\??\c:\1ttnhb.exec:\1ttnhb.exe47⤵
- Executes dropped EXE
PID:904 -
\??\c:\hbnnnn.exec:\hbnnnn.exe48⤵
- Executes dropped EXE
PID:380 -
\??\c:\pjvpp.exec:\pjvpp.exe49⤵
- Executes dropped EXE
PID:4688 -
\??\c:\1rrlxxr.exec:\1rrlxxr.exe50⤵
- Executes dropped EXE
PID:1184 -
\??\c:\tnnhbn.exec:\tnnhbn.exe51⤵
- Executes dropped EXE
PID:540 -
\??\c:\ttnthn.exec:\ttnthn.exe52⤵
- Executes dropped EXE
PID:3272 -
\??\c:\vpjpd.exec:\vpjpd.exe53⤵
- Executes dropped EXE
PID:3976 -
\??\c:\vjjdp.exec:\vjjdp.exe54⤵
- Executes dropped EXE
PID:2356 -
\??\c:\rllrlll.exec:\rllrlll.exe55⤵
- Executes dropped EXE
PID:4492 -
\??\c:\1bhhbb.exec:\1bhhbb.exe56⤵
- Executes dropped EXE
PID:1264 -
\??\c:\nntnbb.exec:\nntnbb.exe57⤵
- Executes dropped EXE
PID:3760 -
\??\c:\pjdvj.exec:\pjdvj.exe58⤵
- Executes dropped EXE
PID:2376 -
\??\c:\jpjvj.exec:\jpjvj.exe59⤵
- Executes dropped EXE
PID:1664 -
\??\c:\fllxrlf.exec:\fllxrlf.exe60⤵
- Executes dropped EXE
PID:3752 -
\??\c:\xrfxfff.exec:\xrfxfff.exe61⤵
- Executes dropped EXE
PID:3456 -
\??\c:\bntnht.exec:\bntnht.exe62⤵
- Executes dropped EXE
PID:1164 -
\??\c:\pvdjj.exec:\pvdjj.exe63⤵
- Executes dropped EXE
PID:1376 -
\??\c:\jvpjd.exec:\jvpjd.exe64⤵
- Executes dropped EXE
PID:3500 -
\??\c:\1rfxlrl.exec:\1rfxlrl.exe65⤵
- Executes dropped EXE
PID:5108 -
\??\c:\rfrrlll.exec:\rfrrlll.exe66⤵PID:2240
-
\??\c:\hthtbb.exec:\hthtbb.exe67⤵PID:2176
-
\??\c:\vpdvv.exec:\vpdvv.exe68⤵PID:4888
-
\??\c:\pjdpj.exec:\pjdpj.exe69⤵PID:1600
-
\??\c:\jppjv.exec:\jppjv.exe70⤵PID:644
-
\??\c:\fxrlllf.exec:\fxrlllf.exe71⤵PID:2340
-
\??\c:\rlllffx.exec:\rlllffx.exe72⤵PID:1176
-
\??\c:\hhnhbb.exec:\hhnhbb.exe73⤵PID:3548
-
\??\c:\nnbbnn.exec:\nnbbnn.exe74⤵PID:2100
-
\??\c:\tbnhtn.exec:\tbnhtn.exe75⤵PID:4172
-
\??\c:\pppjj.exec:\pppjj.exe76⤵PID:3352
-
\??\c:\vvvvv.exec:\vvvvv.exe77⤵PID:4596
-
\??\c:\3xfxfff.exec:\3xfxfff.exe78⤵PID:2876
-
\??\c:\rlxrrll.exec:\rlxrrll.exe79⤵PID:4800
-
\??\c:\htbbnh.exec:\htbbnh.exe80⤵PID:4504
-
\??\c:\tbtnnh.exec:\tbtnnh.exe81⤵PID:1160
-
\??\c:\vvvpj.exec:\vvvpj.exe82⤵PID:4532
-
\??\c:\pjvvp.exec:\pjvvp.exe83⤵PID:4772
-
\??\c:\dvdvd.exec:\dvdvd.exe84⤵PID:4216
-
\??\c:\5rxrrrx.exec:\5rxrrrx.exe85⤵PID:3108
-
\??\c:\1xlfxxr.exec:\1xlfxxr.exe86⤵PID:4436
-
\??\c:\bhhbtt.exec:\bhhbtt.exe87⤵PID:2252
-
\??\c:\tttbbh.exec:\tttbbh.exe88⤵PID:1620
-
\??\c:\dpppd.exec:\dpppd.exe89⤵PID:3312
-
\??\c:\9vjdj.exec:\9vjdj.exe90⤵PID:2564
-
\??\c:\1dvjv.exec:\1dvjv.exe91⤵PID:4752
-
\??\c:\rllflfr.exec:\rllflfr.exe92⤵PID:828
-
\??\c:\tnhbtt.exec:\tnhbtt.exe93⤵PID:1864
-
\??\c:\bbhbbb.exec:\bbhbbb.exe94⤵PID:3416
-
\??\c:\djpjd.exec:\djpjd.exe95⤵PID:552
-
\??\c:\vpjdv.exec:\vpjdv.exe96⤵PID:2372
-
\??\c:\3ppjv.exec:\3ppjv.exe97⤵PID:776
-
\??\c:\5rxxlrl.exec:\5rxxlrl.exe98⤵PID:540
-
\??\c:\tnnnhh.exec:\tnnnhh.exe99⤵PID:4036
-
\??\c:\hbnthh.exec:\hbnthh.exe100⤵PID:3532
-
\??\c:\9vvpj.exec:\9vvpj.exe101⤵PID:4376
-
\??\c:\5jjvp.exec:\5jjvp.exe102⤵PID:3600
-
\??\c:\rllfxrf.exec:\rllfxrf.exe103⤵PID:4072
-
\??\c:\tnbthb.exec:\tnbthb.exe104⤵PID:3028
-
\??\c:\ttnbbh.exec:\ttnbbh.exe105⤵PID:3304
-
\??\c:\tnbtnh.exec:\tnbtnh.exe106⤵PID:2376
-
\??\c:\pppjj.exec:\pppjj.exe107⤵PID:1664
-
\??\c:\5rrxxrr.exec:\5rrxxrr.exe108⤵PID:3752
-
\??\c:\hhhbtn.exec:\hhhbtn.exe109⤵PID:3924
-
\??\c:\httthh.exec:\httthh.exe110⤵PID:3172
-
\??\c:\jpvpd.exec:\jpvpd.exe111⤵PID:1820
-
\??\c:\jjjjv.exec:\jjjjv.exe112⤵PID:948
-
\??\c:\lrfxffr.exec:\lrfxffr.exe113⤵PID:4044
-
\??\c:\xxlfrrx.exec:\xxlfrrx.exe114⤵PID:5104
-
\??\c:\rxffxxl.exec:\rxffxxl.exe115⤵PID:4864
-
\??\c:\5nhttn.exec:\5nhttn.exe116⤵PID:2984
-
\??\c:\thntbb.exec:\thntbb.exe117⤵PID:4768
-
\??\c:\dpddp.exec:\dpddp.exe118⤵PID:3104
-
\??\c:\dddvj.exec:\dddvj.exe119⤵PID:4700
-
\??\c:\djjdv.exec:\djjdv.exe120⤵PID:1080
-
\??\c:\rlfxxrl.exec:\rlfxxrl.exe121⤵PID:2276
-
\??\c:\xxxrlfx.exec:\xxxrlfx.exe122⤵PID:744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-