Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
19/06/2024, 12:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bc102e2cb203dd73836f09886a0a27d0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
- Target bc102e2cb203dd73836f09886a0a27d0_NeikiAnalytics.exe
- Size 68KB
- Sample240619-pjxt9svcmp
- SHA256 4c96252675dabf958337478eae2bcc2ea3cf6a055dfc7c7dee61ab41a5f15e32
- MD5 bc102e2cb203dd73836f09886a0a27d0
- SHA1 11dd86b8dff0af2a05b94286265ec1e320de08be
- SHA512 f4c6844cfda31a4f9d74fb7e543a4847789704569a7e461986e96397570c60ed726a624c4f4dcb9f72059baf35e88fb0513e4d50d6654e147c5f7ec03a3c4a1b
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFdJUDbAIVvK:ymb3NkkiQ3mdBjFIFdJ8bE
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/912-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/744-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4272-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4164-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4164-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4912-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3476-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/976-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2656-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4116-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3848-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3232-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2032-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1036-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4388-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1052-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4080-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4152-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/380-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1128-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3268-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1236-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1380-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 744 bbbtnn.exe 4272 3pvdp.exe 4164 3fxxrrl.exe 4912 3bbttb.exe 3476 rxffxxf.exe 976 5thhbb.exe 2656 7jvpp.exe 4116 xrrrffx.exe 3848 bttbhn.exe 3232 dvvdp.exe 2016 7lrlfff.exe 2032 5nnnnn.exe 3384 btbthh.exe 3408 jdjdv.exe 1036 lffxrrr.exe 4388 nhnntt.exe 1052 hhnhhh.exe 4080 dpdvv.exe 4152 9rrrlll.exe 380 5xffrrr.exe 3344 bttnnn.exe 1560 9pdvp.exe 3972 fxfrrlx.exe 2044 vjjpj.exe 4452 vjpjd.exe 2556 lxlfflf.exe 1128 lflxrxx.exe 3268 hbnnnn.exe 1236 rrllrrx.exe 1380 hthbbb.exe 2628 ppvvp.exe 4016 bhtnhh.exe 1480 dppjv.exe 3244 lflfllr.exe 4508 ttnnnn.exe 4264 tnhhbn.exe 4876 jdvpp.exe 2488 fffxrrr.exe 4932 fxrlrrx.exe 4436 nbbbtb.exe 1696 vpppd.exe 3380 pjvdd.exe 1740 rxllxfx.exe 4576 xrrlfxr.exe 2956 3ttttt.exe 2356 hntbnt.exe 2144 9pvvp.exe 404 rlfxrrl.exe 3212 9fllfll.exe 4448 hthhhh.exe 872 ntbtnn.exe 4880 ppddv.exe 3968 9xffxll.exe 4272 ffxxrxx.exe 3672 bhtttb.exe 3596 7vddd.exe 4484 1ppdv.exe 1628 jpvvp.exe 2520 3lxxxrr.exe 4696 9tnnnn.exe 2996 hnbtnt.exe 208 vjjdd.exe 3160 jppjv.exe 4204 lxxxlrl.exe -
resource yara_rule behavioral2/memory/912-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/744-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/744-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4272-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4164-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4164-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4164-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4164-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/976-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/976-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/976-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2656-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2656-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2656-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4116-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4116-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4116-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3848-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3232-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2032-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1036-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4388-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1052-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4080-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4152-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/380-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1128-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3268-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1236-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1380-208-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 912 wrote to memory of 744 912 bc102e2cb203dd73836f09886a0a27d0_NeikiAnalytics.exe 80 PID 912 wrote to memory of 744 912 bc102e2cb203dd73836f09886a0a27d0_NeikiAnalytics.exe 80 PID 912 wrote to memory of 744 912 bc102e2cb203dd73836f09886a0a27d0_NeikiAnalytics.exe 80 PID 744 wrote to memory of 4272 744 bbbtnn.exe 81 PID 744 wrote to memory of 4272 744 bbbtnn.exe 81 PID 744 wrote to memory of 4272 744 bbbtnn.exe 81 PID 4272 wrote to memory of 4164 4272 3pvdp.exe 82 PID 4272 wrote to memory of 4164 4272 3pvdp.exe 82 PID 4272 wrote to memory of 4164 4272 3pvdp.exe 82 PID 4164 wrote to memory of 4912 4164 3fxxrrl.exe 83 PID 4164 wrote to memory of 4912 4164 3fxxrrl.exe 83 PID 4164 wrote to memory of 4912 4164 3fxxrrl.exe 83 PID 4912 wrote to memory of 3476 4912 3bbttb.exe 84 PID 4912 wrote to memory of 3476 4912 3bbttb.exe 84 PID 4912 wrote to memory of 3476 4912 3bbttb.exe 84 PID 3476 wrote to memory of 976 3476 rxffxxf.exe 85 PID 3476 wrote to memory of 976 3476 rxffxxf.exe 85 PID 3476 wrote to memory of 976 3476 rxffxxf.exe 85 PID 976 wrote to memory of 2656 976 5thhbb.exe 86 PID 976 wrote to memory of 2656 976 5thhbb.exe 86 PID 976 wrote to memory of 2656 976 5thhbb.exe 86 PID 2656 wrote to memory of 4116 2656 7jvpp.exe 87 PID 2656 wrote to memory of 4116 2656 7jvpp.exe 87 PID 2656 wrote to memory of 4116 2656 7jvpp.exe 87 PID 4116 wrote to memory of 3848 4116 xrrrffx.exe 88 PID 4116 wrote to memory of 3848 4116 xrrrffx.exe 88 PID 4116 wrote to memory of 3848 4116 xrrrffx.exe 88 PID 3848 wrote to memory of 3232 3848 bttbhn.exe 89 PID 3848 wrote to memory of 3232 3848 bttbhn.exe 89 PID 3848 wrote to memory of 3232 3848 bttbhn.exe 89 PID 3232 wrote to memory of 2016 3232 dvvdp.exe 90 PID 3232 wrote to memory of 2016 3232 dvvdp.exe 90 PID 3232 wrote to memory of 2016 3232 dvvdp.exe 90 PID 2016 wrote to memory of 2032 2016 7lrlfff.exe 91 PID 2016 wrote to memory of 2032 2016 7lrlfff.exe 91 PID 2016 wrote to memory of 2032 2016 7lrlfff.exe 91 PID 2032 wrote to memory of 3384 2032 5nnnnn.exe 92 PID 2032 wrote to memory of 3384 2032 5nnnnn.exe 92 PID 2032 wrote to memory of 3384 2032 5nnnnn.exe 92 PID 3384 wrote to memory of 3408 3384 btbthh.exe 93 PID 3384 wrote to memory of 3408 3384 btbthh.exe 93 PID 3384 wrote to memory of 3408 3384 btbthh.exe 93 PID 3408 wrote to memory of 1036 3408 jdjdv.exe 94 PID 3408 wrote to memory of 1036 3408 jdjdv.exe 94 PID 3408 wrote to memory of 1036 3408 jdjdv.exe 94 PID 1036 wrote to memory of 4388 1036 lffxrrr.exe 95 PID 1036 wrote to memory of 4388 1036 lffxrrr.exe 95 PID 1036 wrote to memory of 4388 1036 lffxrrr.exe 95 PID 4388 wrote to memory of 1052 4388 nhnntt.exe 96 PID 4388 wrote to memory of 1052 4388 nhnntt.exe 96 PID 4388 wrote to memory of 1052 4388 nhnntt.exe 96 PID 1052 wrote to memory of 4080 1052 hhnhhh.exe 97 PID 1052 wrote to memory of 4080 1052 hhnhhh.exe 97 PID 1052 wrote to memory of 4080 1052 hhnhhh.exe 97 PID 4080 wrote to memory of 4152 4080 dpdvv.exe 98 PID 4080 wrote to memory of 4152 4080 dpdvv.exe 98 PID 4080 wrote to memory of 4152 4080 dpdvv.exe 98 PID 4152 wrote to memory of 380 4152 9rrrlll.exe 99 PID 4152 wrote to memory of 380 4152 9rrrlll.exe 99 PID 4152 wrote to memory of 380 4152 9rrrlll.exe 99 PID 380 wrote to memory of 3344 380 5xffrrr.exe 100 PID 380 wrote to memory of 3344 380 5xffrrr.exe 100 PID 380 wrote to memory of 3344 380 5xffrrr.exe 100 PID 3344 wrote to memory of 1560 3344 bttnnn.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc102e2cb203dd73836f09886a0a27d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\bc102e2cb203dd73836f09886a0a27d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\bbbtnn.exec:\bbbtnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\3pvdp.exec:\3pvdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\3fxxrrl.exec:\3fxxrrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
\??\c:\3bbttb.exec:\3bbttb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\rxffxxf.exec:\rxffxxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\5thhbb.exec:\5thhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
\??\c:\7jvpp.exec:\7jvpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\xrrrffx.exec:\xrrrffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\bttbhn.exec:\bttbhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
\??\c:\dvvdp.exec:\dvvdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\7lrlfff.exec:\7lrlfff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\5nnnnn.exec:\5nnnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\btbthh.exec:\btbthh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
\??\c:\jdjdv.exec:\jdjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
\??\c:\lffxrrr.exec:\lffxrrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\nhnntt.exec:\nhnntt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\hhnhhh.exec:\hhnhhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\dpdvv.exec:\dpdvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\9rrrlll.exec:\9rrrlll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\5xffrrr.exec:\5xffrrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\bttnnn.exec:\bttnnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
\??\c:\9pdvp.exec:\9pdvp.exe23⤵
- Executes dropped EXE
PID:1560 -
\??\c:\fxfrrlx.exec:\fxfrrlx.exe24⤵
- Executes dropped EXE
PID:3972 -
\??\c:\vjjpj.exec:\vjjpj.exe25⤵
- Executes dropped EXE
PID:2044 -
\??\c:\vjpjd.exec:\vjpjd.exe26⤵
- Executes dropped EXE
PID:4452 -
\??\c:\lxlfflf.exec:\lxlfflf.exe27⤵
- Executes dropped EXE
PID:2556 -
\??\c:\lflxrxx.exec:\lflxrxx.exe28⤵
- Executes dropped EXE
PID:1128 -
\??\c:\hbnnnn.exec:\hbnnnn.exe29⤵
- Executes dropped EXE
PID:3268 -
\??\c:\rrllrrx.exec:\rrllrrx.exe30⤵
- Executes dropped EXE
PID:1236 -
\??\c:\hthbbb.exec:\hthbbb.exe31⤵
- Executes dropped EXE
PID:1380 -
\??\c:\ppvvp.exec:\ppvvp.exe32⤵
- Executes dropped EXE
PID:2628 -
\??\c:\bhtnhh.exec:\bhtnhh.exe33⤵
- Executes dropped EXE
PID:4016 -
\??\c:\dppjv.exec:\dppjv.exe34⤵
- Executes dropped EXE
PID:1480 -
\??\c:\lflfllr.exec:\lflfllr.exe35⤵
- Executes dropped EXE
PID:3244 -
\??\c:\ttnnnn.exec:\ttnnnn.exe36⤵
- Executes dropped EXE
PID:4508 -
\??\c:\tnhhbn.exec:\tnhhbn.exe37⤵
- Executes dropped EXE
PID:4264 -
\??\c:\jdvpp.exec:\jdvpp.exe38⤵
- Executes dropped EXE
PID:4876 -
\??\c:\fffxrrr.exec:\fffxrrr.exe39⤵
- Executes dropped EXE
PID:2488 -
\??\c:\fxrlrrx.exec:\fxrlrrx.exe40⤵
- Executes dropped EXE
PID:4932 -
\??\c:\nbbbtb.exec:\nbbbtb.exe41⤵
- Executes dropped EXE
PID:4436 -
\??\c:\vpppd.exec:\vpppd.exe42⤵
- Executes dropped EXE
PID:1696 -
\??\c:\pjvdd.exec:\pjvdd.exe43⤵
- Executes dropped EXE
PID:3380 -
\??\c:\rxllxfx.exec:\rxllxfx.exe44⤵
- Executes dropped EXE
PID:1740 -
\??\c:\xrrlfxr.exec:\xrrlfxr.exe45⤵
- Executes dropped EXE
PID:4576 -
\??\c:\3ttttt.exec:\3ttttt.exe46⤵
- Executes dropped EXE
PID:2956 -
\??\c:\hntbnt.exec:\hntbnt.exe47⤵
- Executes dropped EXE
PID:2356 -
\??\c:\9pvvp.exec:\9pvvp.exe48⤵
- Executes dropped EXE
PID:2144 -
\??\c:\rlfxrrl.exec:\rlfxrrl.exe49⤵
- Executes dropped EXE
PID:404 -
\??\c:\9fllfll.exec:\9fllfll.exe50⤵
- Executes dropped EXE
PID:3212 -
\??\c:\hthhhh.exec:\hthhhh.exe51⤵
- Executes dropped EXE
PID:4448 -
\??\c:\ntbtnn.exec:\ntbtnn.exe52⤵
- Executes dropped EXE
PID:872 -
\??\c:\ppddv.exec:\ppddv.exe53⤵
- Executes dropped EXE
PID:4880 -
\??\c:\9xffxll.exec:\9xffxll.exe54⤵
- Executes dropped EXE
PID:3968 -
\??\c:\ffxxrxx.exec:\ffxxrxx.exe55⤵
- Executes dropped EXE
PID:4272 -
\??\c:\bhtttb.exec:\bhtttb.exe56⤵
- Executes dropped EXE
PID:3672 -
\??\c:\7vddd.exec:\7vddd.exe57⤵
- Executes dropped EXE
PID:3596 -
\??\c:\1ppdv.exec:\1ppdv.exe58⤵
- Executes dropped EXE
PID:4484 -
\??\c:\jpvvp.exec:\jpvvp.exe59⤵
- Executes dropped EXE
PID:1628 -
\??\c:\3lxxxrr.exec:\3lxxxrr.exe60⤵
- Executes dropped EXE
PID:2520 -
\??\c:\9tnnnn.exec:\9tnnnn.exe61⤵
- Executes dropped EXE
PID:4696 -
\??\c:\hnbtnt.exec:\hnbtnt.exe62⤵
- Executes dropped EXE
PID:2996 -
\??\c:\vjjdd.exec:\vjjdd.exe63⤵
- Executes dropped EXE
PID:208 -
\??\c:\jppjv.exec:\jppjv.exe64⤵
- Executes dropped EXE
PID:3160 -
\??\c:\lxxxlrl.exec:\lxxxlrl.exe65⤵
- Executes dropped EXE
PID:4204 -
\??\c:\3frrflx.exec:\3frrflx.exe66⤵PID:656
-
\??\c:\bhthbt.exec:\bhthbt.exe67⤵PID:4956
-
\??\c:\jdpvj.exec:\jdpvj.exe68⤵PID:5096
-
\??\c:\xrxrlxx.exec:\xrxrlxx.exe69⤵PID:772
-
\??\c:\frrxxxx.exec:\frrxxxx.exe70⤵PID:4984
-
\??\c:\9bbbtt.exec:\9bbbtt.exe71⤵PID:2236
-
\??\c:\bbhhhh.exec:\bbhhhh.exe72⤵PID:5016
-
\??\c:\rxrlxxx.exec:\rxrlxxx.exe73⤵PID:3740
-
\??\c:\7hnnnn.exec:\7hnnnn.exe74⤵PID:5048
-
\??\c:\ntnnbb.exec:\ntnnbb.exe75⤵PID:4816
-
\??\c:\1djjv.exec:\1djjv.exe76⤵PID:3772
-
\??\c:\rrxxrrr.exec:\rrxxrrr.exe77⤵PID:1080
-
\??\c:\1xllffx.exec:\1xllffx.exe78⤵PID:4592
-
\??\c:\bhbbtt.exec:\bhbbtt.exe79⤵PID:3000
-
\??\c:\9jdvd.exec:\9jdvd.exe80⤵PID:1228
-
\??\c:\ppvvj.exec:\ppvvj.exe81⤵PID:380
-
\??\c:\1xxxlrl.exec:\1xxxlrl.exe82⤵PID:1460
-
\??\c:\btnnnn.exec:\btnnnn.exe83⤵PID:3084
-
\??\c:\9ttttb.exec:\9ttttb.exe84⤵PID:1904
-
\??\c:\dppjv.exec:\dppjv.exe85⤵PID:1172
-
\??\c:\3jjjv.exec:\3jjjv.exe86⤵PID:4820
-
\??\c:\ffffxxx.exec:\ffffxxx.exe87⤵PID:396
-
\??\c:\hnhhbt.exec:\hnhhbt.exe88⤵PID:4704
-
\??\c:\9tnhbb.exec:\9tnhbb.exe89⤵PID:2556
-
\??\c:\djvdp.exec:\djvdp.exe90⤵PID:428
-
\??\c:\ppddd.exec:\ppddd.exe91⤵PID:1128
-
\??\c:\frfxrxf.exec:\frfxrxf.exe92⤵PID:1272
-
\??\c:\3nnntb.exec:\3nnntb.exe93⤵PID:4232
-
\??\c:\9tttnt.exec:\9tttnt.exe94⤵PID:2128
-
\??\c:\1vdvp.exec:\1vdvp.exe95⤵PID:1092
-
\??\c:\3jpvp.exec:\3jpvp.exe96⤵PID:1336
-
\??\c:\xrxxllx.exec:\xrxxllx.exe97⤵PID:4016
-
\??\c:\frxlrll.exec:\frxlrll.exe98⤵PID:4216
-
\??\c:\bttnnn.exec:\bttnnn.exe99⤵PID:2612
-
\??\c:\5nhnbh.exec:\5nhnbh.exe100⤵PID:1948
-
\??\c:\jvdvv.exec:\jvdvv.exe101⤵PID:4652
-
\??\c:\djdvp.exec:\djdvp.exe102⤵PID:4400
-
\??\c:\ffxrrxx.exec:\ffxrrxx.exe103⤵PID:4924
-
\??\c:\rrlfffx.exec:\rrlfffx.exe104⤵PID:4948
-
\??\c:\tbhhhh.exec:\tbhhhh.exe105⤵PID:2060
-
\??\c:\pjdvv.exec:\pjdvv.exe106⤵PID:4044
-
\??\c:\pvjdp.exec:\pvjdp.exe107⤵PID:3424
-
\??\c:\7ffrfff.exec:\7ffrfff.exe108⤵PID:3076
-
\??\c:\1rxxrxr.exec:\1rxxrxr.exe109⤵PID:2484
-
\??\c:\tnhhhn.exec:\tnhhhn.exe110⤵PID:1212
-
\??\c:\tnnnbh.exec:\tnnnbh.exe111⤵PID:4784
-
\??\c:\vpjjp.exec:\vpjjp.exe112⤵PID:3528
-
\??\c:\3lrrffx.exec:\3lrrffx.exe113⤵PID:3868
-
\??\c:\5hnhbb.exec:\5hnhbb.exe114⤵PID:2708
-
\??\c:\hbhbtt.exec:\hbhbtt.exe115⤵PID:1920
-
\??\c:\jpdvv.exec:\jpdvv.exe116⤵PID:212
-
\??\c:\vpddd.exec:\vpddd.exe117⤵PID:2552
-
\??\c:\9rxxxxx.exec:\9rxxxxx.exe118⤵PID:3592
-
\??\c:\tnbtbb.exec:\tnbtbb.exe119⤵PID:3560
-
\??\c:\nhnnhh.exec:\nhnnhh.exe120⤵PID:4160
-
\??\c:\1htnbb.exec:\1htnbb.exe121⤵PID:1964
-
\??\c:\dvpjd.exec:\dvpjd.exe122⤵PID:3980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-