Analysis
- max time kernel
150s - max time network
128s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
17/06/2024, 04:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4832845ac6e543a9fe61aaf71b6737b0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
- Target 4832845ac6e543a9fe61aaf71b6737b0_NeikiAnalytics.exe
- Size 102KB
- Sample240617-e13fzayblq
- SHA256 54cf3417ccf0f598728fe263e9791d77dfc82218a1f0b687c148562e1aff4920
- MD5 4832845ac6e543a9fe61aaf71b6737b0
- SHA1 988be7c894b59540061b4185a29789361d49ced6
- SHA512 77a5fd255442c9d7317c6868821803468e096cd620884a8c80d13137995cea419b701bef4b3865aa870ca1b6ce5dfcf785d0bad13adfeec09795a34be696922f
- SSDEEP 3072:ymb3NkkiQ3mdBjFo73PYP1lri3KVT+buwUGu3P3C8p:n3C9BRo7MlrWKVT+buBGu3P5
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/2052-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1168-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2592-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3252-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1652-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3208-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4364-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/468-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4848-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4228-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4360-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1552-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1572-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1720-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4876-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3636-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2908-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/964-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2032-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2256-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2564-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4312-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3088-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 1168 tbhbhh.exe 396 bhnhtt.exe 2592 xxffxfx.exe 5108 nhtntt.exe 3252 tnthbb.exe 2364 flfxrxx.exe 1652 xxxrrlf.exe 3208 5hnnnn.exe 4364 dvpjd.exe 468 jjvpp.exe 4848 llfrxrr.exe 4228 hntnhn.exe 3296 tttbtt.exe 4360 pdddj.exe 1552 llllfff.exe 1572 nnbhhn.exe 1720 vjjpp.exe 4876 lfxxfrl.exe 3636 tbtthh.exe 4272 vpvvj.exe 4788 fxxrlff.exe 2908 lfrrllf.exe 964 hthnht.exe 2032 jjjdv.exe 5080 flxlxrf.exe 2256 bttnht.exe 2524 btnnbt.exe 4756 dpjvd.exe 2564 xrfflrr.exe 4312 bhbbbb.exe 3088 1vjvp.exe 1736 rfllfxr.exe 1092 5ffxlll.exe 2904 nnhbtt.exe 1676 thntnn.exe 752 pjjjd.exe 536 vjpdd.exe 516 lllfxxr.exe 4504 ffffffl.exe 4464 bnbbtt.exe 3792 nbhbtt.exe 4348 ddvpj.exe 2108 lxfxfrf.exe 4080 flrrrll.exe 2708 tttnbh.exe 1516 pjpjj.exe 1220 dvvvp.exe 4916 xrxrxlf.exe 1680 lxxflll.exe 4508 vvvpj.exe 4208 jjdvj.exe 2308 rflfrrf.exe 3392 flxxrxx.exe 4884 bhnnhh.exe 4432 hbbhbh.exe 3964 jdjdd.exe 4272 jdjdv.exe 2168 fxrrrrr.exe 2848 xfxrrxf.exe 2908 1nnbbn.exe 3404 hnnnhh.exe 3560 jpvvp.exe 3848 jjvpj.exe 740 rxxffff.exe -
resource yara_rule behavioral2/memory/2052-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1168-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2592-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3252-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1652-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3208-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4364-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/468-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4848-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4228-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4360-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1552-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1572-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1720-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4876-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3636-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2908-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/964-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2032-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2256-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2564-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4312-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-204-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2052 wrote to memory of 1168 2052 4832845ac6e543a9fe61aaf71b6737b0_NeikiAnalytics.exe 91 PID 2052 wrote to memory of 1168 2052 4832845ac6e543a9fe61aaf71b6737b0_NeikiAnalytics.exe 91 PID 2052 wrote to memory of 1168 2052 4832845ac6e543a9fe61aaf71b6737b0_NeikiAnalytics.exe 91 PID 1168 wrote to memory of 396 1168 tbhbhh.exe 92 PID 1168 wrote to memory of 396 1168 tbhbhh.exe 92 PID 1168 wrote to memory of 396 1168 tbhbhh.exe 92 PID 396 wrote to memory of 2592 396 bhnhtt.exe 93 PID 396 wrote to memory of 2592 396 bhnhtt.exe 93 PID 396 wrote to memory of 2592 396 bhnhtt.exe 93 PID 2592 wrote to memory of 5108 2592 xxffxfx.exe 94 PID 2592 wrote to memory of 5108 2592 xxffxfx.exe 94 PID 2592 wrote to memory of 5108 2592 xxffxfx.exe 94 PID 5108 wrote to memory of 3252 5108 nhtntt.exe 95 PID 5108 wrote to memory of 3252 5108 nhtntt.exe 95 PID 5108 wrote to memory of 3252 5108 nhtntt.exe 95 PID 3252 wrote to memory of 2364 3252 tnthbb.exe 96 PID 3252 wrote to memory of 2364 3252 tnthbb.exe 96 PID 3252 wrote to memory of 2364 3252 tnthbb.exe 96 PID 2364 wrote to memory of 1652 2364 flfxrxx.exe 97 PID 2364 wrote to memory of 1652 2364 flfxrxx.exe 97 PID 2364 wrote to memory of 1652 2364 flfxrxx.exe 97 PID 1652 wrote to memory of 3208 1652 xxxrrlf.exe 98 PID 1652 wrote to memory of 3208 1652 xxxrrlf.exe 98 PID 1652 wrote to memory of 3208 1652 xxxrrlf.exe 98 PID 3208 wrote to memory of 4364 3208 5hnnnn.exe 99 PID 3208 wrote to memory of 4364 3208 5hnnnn.exe 99 PID 3208 wrote to memory of 4364 3208 5hnnnn.exe 99 PID 4364 wrote to memory of 468 4364 dvpjd.exe 100 PID 4364 wrote to memory of 468 4364 dvpjd.exe 100 PID 4364 wrote to memory of 468 4364 dvpjd.exe 100 PID 468 wrote to memory of 4848 468 jjvpp.exe 101 PID 468 wrote to memory of 4848 468 jjvpp.exe 101 PID 468 wrote to memory of 4848 468 jjvpp.exe 101 PID 4848 wrote to memory of 4228 4848 llfrxrr.exe 103 PID 4848 wrote to memory of 4228 4848 llfrxrr.exe 103 PID 4848 wrote to memory of 4228 4848 llfrxrr.exe 103 PID 4228 wrote to memory of 3296 4228 hntnhn.exe 104 PID 4228 wrote to memory of 3296 4228 hntnhn.exe 104 PID 4228 wrote to memory of 3296 4228 hntnhn.exe 104 PID 3296 wrote to memory of 4360 3296 tttbtt.exe 105 PID 3296 wrote to memory of 4360 3296 tttbtt.exe 105 PID 3296 wrote to memory of 4360 3296 tttbtt.exe 105 PID 4360 wrote to memory of 1552 4360 pdddj.exe 106 PID 4360 wrote to memory of 1552 4360 pdddj.exe 106 PID 4360 wrote to memory of 1552 4360 pdddj.exe 106 PID 1552 wrote to memory of 1572 1552 llllfff.exe 107 PID 1552 wrote to memory of 1572 1552 llllfff.exe 107 PID 1552 wrote to memory of 1572 1552 llllfff.exe 107 PID 1572 wrote to memory of 1720 1572 nnbhhn.exe 108 PID 1572 wrote to memory of 1720 1572 nnbhhn.exe 108 PID 1572 wrote to memory of 1720 1572 nnbhhn.exe 108 PID 1720 wrote to memory of 4876 1720 vjjpp.exe 109 PID 1720 wrote to memory of 4876 1720 vjjpp.exe 109 PID 1720 wrote to memory of 4876 1720 vjjpp.exe 109 PID 4876 wrote to memory of 3636 4876 lfxxfrl.exe 110 PID 4876 wrote to memory of 3636 4876 lfxxfrl.exe 110 PID 4876 wrote to memory of 3636 4876 lfxxfrl.exe 110 PID 3636 wrote to memory of 4272 3636 tbtthh.exe 111 PID 3636 wrote to memory of 4272 3636 tbtthh.exe 111 PID 3636 wrote to memory of 4272 3636 tbtthh.exe 111 PID 4272 wrote to memory of 4788 4272 vpvvj.exe 112 PID 4272 wrote to memory of 4788 4272 vpvvj.exe 112 PID 4272 wrote to memory of 4788 4272 vpvvj.exe 112 PID 4788 wrote to memory of 2908 4788 fxxrlff.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\4832845ac6e543a9fe61aaf71b6737b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4832845ac6e543a9fe61aaf71b6737b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\tbhbhh.exec:\tbhbhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\bhnhtt.exec:\bhnhtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\xxffxfx.exec:\xxffxfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\nhtntt.exec:\nhtntt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\tnthbb.exec:\tnthbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\flfxrxx.exec:\flfxrxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\xxxrrlf.exec:\xxxrrlf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\5hnnnn.exec:\5hnnnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
\??\c:\dvpjd.exec:\dvpjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\jjvpp.exec:\jjvpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\llfrxrr.exec:\llfrxrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\hntnhn.exec:\hntnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\tttbtt.exec:\tttbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
\??\c:\pdddj.exec:\pdddj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\llllfff.exec:\llllfff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\nnbhhn.exec:\nnbhhn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\vjjpp.exec:\vjjpp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\lfxxfrl.exec:\lfxxfrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\tbtthh.exec:\tbtthh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\vpvvj.exec:\vpvvj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\fxxrlff.exec:\fxxrlff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\lfrrllf.exec:\lfrrllf.exe23⤵
- Executes dropped EXE
PID:2908 -
\??\c:\hthnht.exec:\hthnht.exe24⤵
- Executes dropped EXE
PID:964 -
\??\c:\jjjdv.exec:\jjjdv.exe25⤵
- Executes dropped EXE
PID:2032 -
\??\c:\flxlxrf.exec:\flxlxrf.exe26⤵
- Executes dropped EXE
PID:5080 -
\??\c:\bttnht.exec:\bttnht.exe27⤵
- Executes dropped EXE
PID:2256 -
\??\c:\btnnbt.exec:\btnnbt.exe28⤵
- Executes dropped EXE
PID:2524 -
\??\c:\dpjvd.exec:\dpjvd.exe29⤵
- Executes dropped EXE
PID:4756 -
\??\c:\xrfflrr.exec:\xrfflrr.exe30⤵
- Executes dropped EXE
PID:2564 -
\??\c:\bhbbbb.exec:\bhbbbb.exe31⤵
- Executes dropped EXE
PID:4312 -
\??\c:\1vjvp.exec:\1vjvp.exe32⤵
- Executes dropped EXE
PID:3088 -
\??\c:\rfllfxr.exec:\rfllfxr.exe33⤵
- Executes dropped EXE
PID:1736 -
\??\c:\5ffxlll.exec:\5ffxlll.exe34⤵
- Executes dropped EXE
PID:1092 -
\??\c:\nnhbtt.exec:\nnhbtt.exe35⤵
- Executes dropped EXE
PID:2904 -
\??\c:\thntnn.exec:\thntnn.exe36⤵
- Executes dropped EXE
PID:1676 -
\??\c:\pjjjd.exec:\pjjjd.exe37⤵
- Executes dropped EXE
PID:752 -
\??\c:\vjpdd.exec:\vjpdd.exe38⤵
- Executes dropped EXE
PID:536 -
\??\c:\lllfxxr.exec:\lllfxxr.exe39⤵
- Executes dropped EXE
PID:516 -
\??\c:\ffffffl.exec:\ffffffl.exe40⤵
- Executes dropped EXE
PID:4504 -
\??\c:\bnbbtt.exec:\bnbbtt.exe41⤵
- Executes dropped EXE
PID:4464 -
\??\c:\nbhbtt.exec:\nbhbtt.exe42⤵
- Executes dropped EXE
PID:3792 -
\??\c:\ddvpj.exec:\ddvpj.exe43⤵
- Executes dropped EXE
PID:4348 -
\??\c:\lxfxfrf.exec:\lxfxfrf.exe44⤵
- Executes dropped EXE
PID:2108 -
\??\c:\flrrrll.exec:\flrrrll.exe45⤵
- Executes dropped EXE
PID:4080 -
\??\c:\tttnbh.exec:\tttnbh.exe46⤵
- Executes dropped EXE
PID:2708 -
\??\c:\pjpjj.exec:\pjpjj.exe47⤵
- Executes dropped EXE
PID:1516 -
\??\c:\dvvvp.exec:\dvvvp.exe48⤵
- Executes dropped EXE
PID:1220 -
\??\c:\xrxrxlf.exec:\xrxrxlf.exe49⤵
- Executes dropped EXE
PID:4916 -
\??\c:\lxxflll.exec:\lxxflll.exe50⤵
- Executes dropped EXE
PID:1680 -
\??\c:\vvvpj.exec:\vvvpj.exe51⤵
- Executes dropped EXE
PID:4508 -
\??\c:\jjdvj.exec:\jjdvj.exe52⤵
- Executes dropped EXE
PID:4208 -
\??\c:\rflfrrf.exec:\rflfrrf.exe53⤵
- Executes dropped EXE
PID:2308 -
\??\c:\flxxrxx.exec:\flxxrxx.exe54⤵
- Executes dropped EXE
PID:3392 -
\??\c:\bhnnhh.exec:\bhnnhh.exe55⤵
- Executes dropped EXE
PID:4884 -
\??\c:\hbbhbh.exec:\hbbhbh.exe56⤵
- Executes dropped EXE
PID:4432 -
\??\c:\jdjdd.exec:\jdjdd.exe57⤵
- Executes dropped EXE
PID:3964 -
\??\c:\jdjdv.exec:\jdjdv.exe58⤵
- Executes dropped EXE
PID:4272 -
\??\c:\fxrrrrr.exec:\fxrrrrr.exe59⤵
- Executes dropped EXE
PID:2168 -
\??\c:\xfxrrxf.exec:\xfxrrxf.exe60⤵
- Executes dropped EXE
PID:2848 -
\??\c:\1nnbbn.exec:\1nnbbn.exe61⤵
- Executes dropped EXE
PID:2908 -
\??\c:\hnnnhh.exec:\hnnnhh.exe62⤵
- Executes dropped EXE
PID:3404 -
\??\c:\jpvvp.exec:\jpvvp.exe63⤵
- Executes dropped EXE
PID:3560 -
\??\c:\jjvpj.exec:\jjvpj.exe64⤵
- Executes dropped EXE
PID:3848 -
\??\c:\rxxffff.exec:\rxxffff.exe65⤵
- Executes dropped EXE
PID:740 -
\??\c:\djjpp.exec:\djjpp.exe66⤵PID:8
-
\??\c:\fxfffff.exec:\fxfffff.exe67⤵PID:4044
-
\??\c:\lrrrllf.exec:\lrrrllf.exe68⤵PID:4500
-
\??\c:\hbthnb.exec:\hbthnb.exe69⤵PID:1956
-
\??\c:\jpjvd.exec:\jpjvd.exe70⤵PID:4236
-
\??\c:\rrxxllr.exec:\rrxxllr.exe71⤵PID:3232
-
\??\c:\xrfrxfl.exec:\xrfrxfl.exe72⤵PID:756
-
\??\c:\tbtttt.exec:\tbtttt.exe73⤵PID:4696
-
\??\c:\jdddd.exec:\jdddd.exe74⤵PID:2904
-
\??\c:\ppppp.exec:\ppppp.exe75⤵PID:1676
-
\??\c:\flllxxx.exec:\flllxxx.exe76⤵PID:752
-
\??\c:\bbnbbh.exec:\bbnbbh.exe77⤵PID:2360
-
\??\c:\bnhnbb.exec:\bnhnbb.exe78⤵PID:1824
-
\??\c:\pddvv.exec:\pddvv.exe79⤵PID:3208
-
\??\c:\vpjjj.exec:\vpjjj.exe80⤵PID:3372
-
\??\c:\3xxrfff.exec:\3xxrfff.exe81⤵PID:3792
-
\??\c:\xrfxxxx.exec:\xrfxxxx.exe82⤵PID:4348
-
\??\c:\hntbnt.exec:\hntbnt.exe83⤵PID:2108
-
\??\c:\dvddv.exec:\dvddv.exe84⤵PID:4080
-
\??\c:\dpjdj.exec:\dpjdj.exe85⤵PID:1912
-
\??\c:\rflxllr.exec:\rflxllr.exe86⤵PID:1516
-
\??\c:\httbhh.exec:\httbhh.exe87⤵PID:1624
-
\??\c:\nnhhhn.exec:\nnhhhn.exe88⤵PID:932
-
\??\c:\vjpjj.exec:\vjpjj.exe89⤵PID:5012
-
\??\c:\vjjdv.exec:\vjjdv.exe90⤵PID:4508
-
\??\c:\rfxrrrx.exec:\rfxrrrx.exe91⤵PID:4208
-
\??\c:\7llffff.exec:\7llffff.exe92⤵PID:4876
-
\??\c:\bbnhbb.exec:\bbnhbb.exe93⤵PID:4904
-
\??\c:\9pvjd.exec:\9pvjd.exe94⤵PID:4884
-
\??\c:\pdvvv.exec:\pdvvv.exe95⤵PID:212
-
\??\c:\xfrlxxr.exec:\xfrlxxr.exe96⤵PID:3964
-
\??\c:\bttttt.exec:\bttttt.exe97⤵PID:4272
-
\??\c:\bbbnht.exec:\bbbnht.exe98⤵PID:4568
-
\??\c:\pjvvp.exec:\pjvvp.exe99⤵PID:2732
-
\??\c:\pdjjd.exec:\pdjjd.exe100⤵PID:2908
-
\??\c:\1fxffff.exec:\1fxffff.exe101⤵PID:736
-
\??\c:\lfrfrrr.exec:\lfrfrrr.exe102⤵PID:1916
-
\??\c:\7nhhbh.exec:\7nhhbh.exe103⤵PID:2284
-
\??\c:\jddvv.exec:\jddvv.exe104⤵PID:2524
-
\??\c:\3pddd.exec:\3pddd.exe105⤵PID:1872
-
\??\c:\rllxxxx.exec:\rllxxxx.exe106⤵PID:4328
-
\??\c:\rfxflll.exec:\rfxflll.exe107⤵PID:2564
-
\??\c:\bbnbhn.exec:\bbnbhn.exe108⤵PID:3952
-
\??\c:\jdvjd.exec:\jdvjd.exe109⤵PID:4840
-
\??\c:\3vpjd.exec:\3vpjd.exe110⤵PID:4168
-
\??\c:\frffrfl.exec:\frffrfl.exe111⤵PID:4976
-
\??\c:\bnbnnn.exec:\bnbnnn.exe112⤵PID:3864
-
\??\c:\hbntnb.exec:\hbntnb.exe113⤵PID:3980
-
\??\c:\pvvpp.exec:\pvvpp.exe114⤵PID:624
-
\??\c:\xrxrllf.exec:\xrxrllf.exe115⤵PID:4452
-
\??\c:\1rxrrll.exec:\1rxrrll.exe116⤵PID:4212
-
\??\c:\rfrrlll.exec:\rfrrlll.exe117⤵PID:1616
-
\??\c:\bthhbb.exec:\bthhbb.exe118⤵PID:4804
-
\??\c:\9jvvv.exec:\9jvvv.exe119⤵PID:912
-
\??\c:\ppvjd.exec:\ppvjd.exe120⤵PID:4232
-
\??\c:\9xlfrlr.exec:\9xlfrlr.exe121⤵PID:2444
-
\??\c:\lfrrrxx.exec:\lfrrrxx.exe122⤵PID:5048
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-