Analysis
-
max time kernel
150s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/06/2024, 04:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
282e4aa73ec2168ee75b4a71261b2dd0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
282e4aa73ec2168ee75b4a71261b2dd0_NeikiAnalytics.exe
-
Size
213KB
-
MD5
282e4aa73ec2168ee75b4a71261b2dd0
-
SHA1
12b5509d7feb5644fa039ac9db93cdd24172db95
-
SHA256
682c6424ab9a6f9e38b1d152a68b687cf1556f0319312c02bb2a7f2604a54999
-
SHA512
97ac75f68e61eef0f10760b85a005adf77f2961af1b61513f4d9104da15aa826e585fed18c9e523fa7cb3652e79e18d7acd59e8108ea9e48d087c279c8c3ed58
-
SSDEEP
3072:ymb3NkkiQ3mdBjFIi/0RU6QeYQsm71vPmc51+GqekBJCvr6zJBUmABvW:n3C9BRIG0asYFm71m8+GdkB9EBe
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/2232-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4684-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4412-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4932-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3720-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3924-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1776-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1736-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4584-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2196-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5080-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2596-81-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2596-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5048-74-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-67-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3524-60-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3524-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4044-57-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4044-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1112-46-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1112-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/772-39-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/772-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3708-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2156-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4656-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4656 ffrfrfr.exe 2156 hhntht.exe 3708 9ddpj.exe 772 dvdvv.exe 1112 7ffxffl.exe 4044 1tthbt.exe 3524 nhhbtt.exe 4036 dvpjd.exe 5048 9vpjv.exe 2596 7ffxffx.exe 5080 xxfrllr.exe 4568 nbtntt.exe 2196 hbhbbb.exe 4584 ppdvv.exe 1736 fflfxxr.exe 1776 xrxrlxr.exe 3924 btbnhn.exe 2400 btnbtn.exe 3720 dvpdp.exe 4932 jvjdv.exe 2284 xllfxxr.exe 748 xllfrrf.exe 2148 hntnnn.exe 4412 pdpjd.exe 2108 djpjd.exe 1244 frxrxrl.exe 3636 1llfxrl.exe 1268 btthtt.exe 4684 1bbtbb.exe 2232 pjjvj.exe 3788 jdvjj.exe 3952 lllxrlf.exe 4880 bbbnhb.exe 4988 nhtnnh.exe 3568 dvvpj.exe 4736 jvvjp.exe 4120 rlrrxfl.exe 4112 rfllffx.exe 1812 5hnbnn.exe 4116 9ntnbb.exe 924 vdjvd.exe 3828 xrlffxx.exe 4372 5lfxflf.exe 1616 bthbtt.exe 4984 nbhbnh.exe 4376 jdvpp.exe 4020 3fxlffr.exe 4432 fxxrrxr.exe 968 nhtnhh.exe 2184 9pvpv.exe 4740 rlxrrll.exe 1124 rllfxrl.exe 2484 hthbnh.exe 2868 jdpdv.exe 4480 dvvvd.exe 4380 xfrlfxx.exe 956 ttbbht.exe 2596 jdjjd.exe 4828 jjvpj.exe 3584 frrxrlf.exe 4572 7bhhnt.exe 1528 jvvvv.exe 3128 fxlffxx.exe 1964 3llfxrl.exe -
resource yara_rule behavioral2/memory/2232-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4684-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4412-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4932-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3720-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3924-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1776-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2196-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4568-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5080-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2596-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5048-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3524-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1112-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/772-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3708-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2156-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-6-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2344 wrote to memory of 4656 2344 282e4aa73ec2168ee75b4a71261b2dd0_NeikiAnalytics.exe 82 PID 2344 wrote to memory of 4656 2344 282e4aa73ec2168ee75b4a71261b2dd0_NeikiAnalytics.exe 82 PID 2344 wrote to memory of 4656 2344 282e4aa73ec2168ee75b4a71261b2dd0_NeikiAnalytics.exe 82 PID 4656 wrote to memory of 2156 4656 ffrfrfr.exe 83 PID 4656 wrote to memory of 2156 4656 ffrfrfr.exe 83 PID 4656 wrote to memory of 2156 4656 ffrfrfr.exe 83 PID 2156 wrote to memory of 3708 2156 hhntht.exe 84 PID 2156 wrote to memory of 3708 2156 hhntht.exe 84 PID 2156 wrote to memory of 3708 2156 hhntht.exe 84 PID 3708 wrote to memory of 772 3708 9ddpj.exe 85 PID 3708 wrote to memory of 772 3708 9ddpj.exe 85 PID 3708 wrote to memory of 772 3708 9ddpj.exe 85 PID 772 wrote to memory of 1112 772 dvdvv.exe 86 PID 772 wrote to memory of 1112 772 dvdvv.exe 86 PID 772 wrote to memory of 1112 772 dvdvv.exe 86 PID 1112 wrote to memory of 4044 1112 7ffxffl.exe 87 PID 1112 wrote to memory of 4044 1112 7ffxffl.exe 87 PID 1112 wrote to memory of 4044 1112 7ffxffl.exe 87 PID 4044 wrote to memory of 3524 4044 1tthbt.exe 88 PID 4044 wrote to memory of 3524 4044 1tthbt.exe 88 PID 4044 wrote to memory of 3524 4044 1tthbt.exe 88 PID 3524 wrote to memory of 4036 3524 nhhbtt.exe 89 PID 3524 wrote to memory of 4036 3524 nhhbtt.exe 89 PID 3524 wrote to memory of 4036 3524 nhhbtt.exe 89 PID 4036 wrote to memory of 5048 4036 dvpjd.exe 90 PID 4036 wrote to memory of 5048 4036 dvpjd.exe 90 PID 4036 wrote to memory of 5048 4036 dvpjd.exe 90 PID 5048 wrote to memory of 2596 5048 9vpjv.exe 139 PID 5048 wrote to memory of 2596 5048 9vpjv.exe 139 PID 5048 wrote to memory of 2596 5048 9vpjv.exe 139 PID 2596 wrote to memory of 5080 2596 7ffxffx.exe 92 PID 2596 wrote to memory of 5080 2596 7ffxffx.exe 92 PID 2596 wrote to memory of 5080 2596 7ffxffx.exe 92 PID 5080 wrote to memory of 4568 5080 xxfrllr.exe 93 PID 5080 wrote to memory of 4568 5080 xxfrllr.exe 93 PID 5080 wrote to memory of 4568 5080 xxfrllr.exe 93 PID 4568 wrote to memory of 2196 4568 nbtntt.exe 94 PID 4568 wrote to memory of 2196 4568 nbtntt.exe 94 PID 4568 wrote to memory of 2196 4568 nbtntt.exe 94 PID 2196 wrote to memory of 4584 2196 hbhbbb.exe 95 PID 2196 wrote to memory of 4584 2196 hbhbbb.exe 95 PID 2196 wrote to memory of 4584 2196 hbhbbb.exe 95 PID 4584 wrote to memory of 1736 4584 ppdvv.exe 96 PID 4584 wrote to memory of 1736 4584 ppdvv.exe 96 PID 4584 wrote to memory of 1736 4584 ppdvv.exe 96 PID 1736 wrote to memory of 1776 1736 fflfxxr.exe 97 PID 1736 wrote to memory of 1776 1736 fflfxxr.exe 97 PID 1736 wrote to memory of 1776 1736 fflfxxr.exe 97 PID 1776 wrote to memory of 3924 1776 xrxrlxr.exe 98 PID 1776 wrote to memory of 3924 1776 xrxrlxr.exe 98 PID 1776 wrote to memory of 3924 1776 xrxrlxr.exe 98 PID 3924 wrote to memory of 2400 3924 btbnhn.exe 147 PID 3924 wrote to memory of 2400 3924 btbnhn.exe 147 PID 3924 wrote to memory of 2400 3924 btbnhn.exe 147 PID 2400 wrote to memory of 3720 2400 btnbtn.exe 100 PID 2400 wrote to memory of 3720 2400 btnbtn.exe 100 PID 2400 wrote to memory of 3720 2400 btnbtn.exe 100 PID 3720 wrote to memory of 4932 3720 dvpdp.exe 149 PID 3720 wrote to memory of 4932 3720 dvpdp.exe 149 PID 3720 wrote to memory of 4932 3720 dvpdp.exe 149 PID 4932 wrote to memory of 2284 4932 jvjdv.exe 150 PID 4932 wrote to memory of 2284 4932 jvjdv.exe 150 PID 4932 wrote to memory of 2284 4932 jvjdv.exe 150 PID 2284 wrote to memory of 748 2284 xllfxxr.exe 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\282e4aa73ec2168ee75b4a71261b2dd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\282e4aa73ec2168ee75b4a71261b2dd0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\ffrfrfr.exec:\ffrfrfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\hhntht.exec:\hhntht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\9ddpj.exec:\9ddpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\dvdvv.exec:\dvdvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\7ffxffl.exec:\7ffxffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\1tthbt.exec:\1tthbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\nhhbtt.exec:\nhhbtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\dvpjd.exec:\dvpjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\9vpjv.exec:\9vpjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\7ffxffx.exec:\7ffxffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\xxfrllr.exec:\xxfrllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\nbtntt.exec:\nbtntt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\hbhbbb.exec:\hbhbbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\ppdvv.exec:\ppdvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\fflfxxr.exec:\fflfxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\xrxrlxr.exec:\xrxrlxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\btbnhn.exec:\btbnhn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\btnbtn.exec:\btnbtn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\dvpdp.exec:\dvpdp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\jvjdv.exec:\jvjdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\xllfxxr.exec:\xllfxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\xllfrrf.exec:\xllfrrf.exe23⤵
- Executes dropped EXE
PID:748 -
\??\c:\hntnnn.exec:\hntnnn.exe24⤵
- Executes dropped EXE
PID:2148 -
\??\c:\pdpjd.exec:\pdpjd.exe25⤵
- Executes dropped EXE
PID:4412 -
\??\c:\djpjd.exec:\djpjd.exe26⤵
- Executes dropped EXE
PID:2108 -
\??\c:\frxrxrl.exec:\frxrxrl.exe27⤵
- Executes dropped EXE
PID:1244 -
\??\c:\1llfxrl.exec:\1llfxrl.exe28⤵
- Executes dropped EXE
PID:3636 -
\??\c:\btthtt.exec:\btthtt.exe29⤵
- Executes dropped EXE
PID:1268 -
\??\c:\1bbtbb.exec:\1bbtbb.exe30⤵
- Executes dropped EXE
PID:4684 -
\??\c:\pjjvj.exec:\pjjvj.exe31⤵
- Executes dropped EXE
PID:2232 -
\??\c:\jdvjj.exec:\jdvjj.exe32⤵
- Executes dropped EXE
PID:3788 -
\??\c:\lllxrlf.exec:\lllxrlf.exe33⤵
- Executes dropped EXE
PID:3952 -
\??\c:\bbbnhb.exec:\bbbnhb.exe34⤵
- Executes dropped EXE
PID:4880 -
\??\c:\nhtnnh.exec:\nhtnnh.exe35⤵
- Executes dropped EXE
PID:4988 -
\??\c:\dvvpj.exec:\dvvpj.exe36⤵
- Executes dropped EXE
PID:3568 -
\??\c:\jvvjp.exec:\jvvjp.exe37⤵
- Executes dropped EXE
PID:4736 -
\??\c:\rlrrxfl.exec:\rlrrxfl.exe38⤵
- Executes dropped EXE
PID:4120 -
\??\c:\rfllffx.exec:\rfllffx.exe39⤵
- Executes dropped EXE
PID:4112 -
\??\c:\5hnbnn.exec:\5hnbnn.exe40⤵
- Executes dropped EXE
PID:1812 -
\??\c:\9ntnbb.exec:\9ntnbb.exe41⤵
- Executes dropped EXE
PID:4116 -
\??\c:\vdjvd.exec:\vdjvd.exe42⤵
- Executes dropped EXE
PID:924 -
\??\c:\xrlffxx.exec:\xrlffxx.exe43⤵
- Executes dropped EXE
PID:3828 -
\??\c:\5lfxflf.exec:\5lfxflf.exe44⤵
- Executes dropped EXE
PID:4372 -
\??\c:\bthbtt.exec:\bthbtt.exe45⤵
- Executes dropped EXE
PID:1616 -
\??\c:\nbhbnh.exec:\nbhbnh.exe46⤵
- Executes dropped EXE
PID:4984 -
\??\c:\jdvpp.exec:\jdvpp.exe47⤵
- Executes dropped EXE
PID:4376 -
\??\c:\3fxlffr.exec:\3fxlffr.exe48⤵
- Executes dropped EXE
PID:4020 -
\??\c:\fxxrrxr.exec:\fxxrrxr.exe49⤵
- Executes dropped EXE
PID:4432 -
\??\c:\nhtnhh.exec:\nhtnhh.exe50⤵
- Executes dropped EXE
PID:968 -
\??\c:\9pvpv.exec:\9pvpv.exe51⤵
- Executes dropped EXE
PID:2184 -
\??\c:\rlxrrll.exec:\rlxrrll.exe52⤵
- Executes dropped EXE
PID:4740 -
\??\c:\rllfxrl.exec:\rllfxrl.exe53⤵
- Executes dropped EXE
PID:1124 -
\??\c:\hthbnh.exec:\hthbnh.exe54⤵
- Executes dropped EXE
PID:2484 -
\??\c:\jdpdv.exec:\jdpdv.exe55⤵
- Executes dropped EXE
PID:2868 -
\??\c:\dvvvd.exec:\dvvvd.exe56⤵
- Executes dropped EXE
PID:4480 -
\??\c:\xfrlfxx.exec:\xfrlfxx.exe57⤵
- Executes dropped EXE
PID:4380 -
\??\c:\ttbbht.exec:\ttbbht.exe58⤵
- Executes dropped EXE
PID:956 -
\??\c:\jdjjd.exec:\jdjjd.exe59⤵
- Executes dropped EXE
PID:2596 -
\??\c:\jjvpj.exec:\jjvpj.exe60⤵
- Executes dropped EXE
PID:4828 -
\??\c:\frrxrlf.exec:\frrxrlf.exe61⤵
- Executes dropped EXE
PID:3584 -
\??\c:\7bhhnt.exec:\7bhhnt.exe62⤵
- Executes dropped EXE
PID:4572 -
\??\c:\jvvvv.exec:\jvvvv.exe63⤵
- Executes dropped EXE
PID:1528 -
\??\c:\fxlffxx.exec:\fxlffxx.exe64⤵
- Executes dropped EXE
PID:3128 -
\??\c:\3llfxrl.exec:\3llfxrl.exe65⤵
- Executes dropped EXE
PID:1964 -
\??\c:\hbbbbb.exec:\hbbbbb.exe66⤵PID:3192
-
\??\c:\jvdpd.exec:\jvdpd.exe67⤵PID:3228
-
\??\c:\xfxrrxx.exec:\xfxrrxx.exe68⤵PID:4932
-
\??\c:\rrrllll.exec:\rrrllll.exe69⤵PID:2284
-
\??\c:\jdpjj.exec:\jdpjj.exe70⤵PID:748
-
\??\c:\9xffrrf.exec:\9xffrrf.exe71⤵PID:2148
-
\??\c:\bnnnnh.exec:\bnnnnh.exe72⤵PID:4992
-
\??\c:\hthhtn.exec:\hthhtn.exe73⤵PID:1652
-
\??\c:\dvdvp.exec:\dvdvp.exe74⤵PID:2068
-
\??\c:\xxllflf.exec:\xxllflf.exe75⤵PID:4836
-
\??\c:\llxflrl.exec:\llxflrl.exe76⤵PID:2692
-
\??\c:\nhhbtt.exec:\nhhbtt.exe77⤵PID:1200
-
\??\c:\pjjjd.exec:\pjjjd.exe78⤵PID:3788
-
\??\c:\pjjvd.exec:\pjjvd.exe79⤵PID:2360
-
\??\c:\lrxrlfx.exec:\lrxrlfx.exe80⤵PID:1744
-
\??\c:\nbhbtb.exec:\nbhbtb.exe81⤵PID:2932
-
\??\c:\tnnhbb.exec:\tnnhbb.exe82⤵PID:3728
-
\??\c:\djdvp.exec:\djdvp.exe83⤵PID:3604
-
\??\c:\llrlffx.exec:\llrlffx.exe84⤵PID:876
-
\??\c:\3rrllrr.exec:\3rrllrr.exe85⤵PID:4312
-
\??\c:\thhbtn.exec:\thhbtn.exe86⤵PID:728
-
\??\c:\vvvvp.exec:\vvvvp.exe87⤵PID:4216
-
\??\c:\1vdpj.exec:\1vdpj.exe88⤵PID:4132
-
\??\c:\5lrrrxx.exec:\5lrrrxx.exe89⤵PID:2552
-
\??\c:\7flfxxr.exec:\7flfxxr.exe90⤵PID:3680
-
\??\c:\bhtnhh.exec:\bhtnhh.exe91⤵PID:3828
-
\??\c:\3bbtnt.exec:\3bbtnt.exe92⤵PID:2928
-
\??\c:\pppjd.exec:\pppjd.exe93⤵PID:4860
-
\??\c:\jdjdp.exec:\jdjdp.exe94⤵PID:4428
-
\??\c:\fflfrrr.exec:\fflfrrr.exe95⤵PID:2916
-
\??\c:\rlrlrrf.exec:\rlrlrrf.exe96⤵PID:764
-
\??\c:\nnbbbt.exec:\nnbbbt.exe97⤵PID:4920
-
\??\c:\vjjjd.exec:\vjjjd.exe98⤵PID:3836
-
\??\c:\jjvjd.exec:\jjvjd.exe99⤵PID:4596
-
\??\c:\fxlfxfx.exec:\fxlfxfx.exe100⤵PID:4424
-
\??\c:\rrxrxxf.exec:\rrxrxxf.exe101⤵PID:1804
-
\??\c:\bbnnht.exec:\bbnnht.exe102⤵PID:4368
-
\??\c:\nnnbnh.exec:\nnnbnh.exe103⤵PID:3648
-
\??\c:\nhtnhh.exec:\nhtnhh.exe104⤵PID:2156
-
\??\c:\dvjjj.exec:\dvjjj.exe105⤵PID:3916
-
\??\c:\vpdvd.exec:\vpdvd.exe106⤵PID:664
-
\??\c:\rlrrxxf.exec:\rlrrxxf.exe107⤵PID:364
-
\??\c:\rlfllll.exec:\rlfllll.exe108⤵PID:228
-
\??\c:\nnnhtt.exec:\nnnhtt.exe109⤵PID:4044
-
\??\c:\btnhnn.exec:\btnhnn.exe110⤵PID:4560
-
\??\c:\dvdjv.exec:\dvdjv.exe111⤵PID:2132
-
\??\c:\jpvpp.exec:\jpvpp.exe112⤵PID:2460
-
\??\c:\lrfffff.exec:\lrfffff.exe113⤵PID:3668
-
\??\c:\rlllllf.exec:\rlllllf.exe114⤵PID:1012
-
\??\c:\hhtnnn.exec:\hhtnnn.exe115⤵PID:2760
-
\??\c:\hbtnnn.exec:\hbtnnn.exe116⤵PID:2192
-
\??\c:\vjppp.exec:\vjppp.exe117⤵PID:1776
-
\??\c:\vvdvv.exec:\vvdvv.exe118⤵PID:2792
-
\??\c:\rxxfrrr.exec:\rxxfrrr.exe119⤵PID:3284
-
\??\c:\lxffffx.exec:\lxffffx.exe120⤵PID:2912
-
\??\c:\1tnnhh.exec:\1tnnhh.exe121⤵PID:436
-
\??\c:\7tbthh.exec:\7tbthh.exe122⤵PID:3920
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-