Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09-05-2024 13:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4d0b19513986ae2c19b443cb5c889e20_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4d0b19513986ae2c19b443cb5c889e20_NeikiAnalytics.exe
-
Size
94KB
-
MD5
4d0b19513986ae2c19b443cb5c889e20
-
SHA1
82b23a64d9eb327c930b2a53c4d911b862ba10ac
-
SHA256
2e62c70fad803ab3ace1d9492d3f6a18d6296ce05273549579e0e2a67fe0ab66
-
SHA512
a61668f02a754f70fa6c9d30098b0f9a65b68ad1f20d64688eadd2f923ef74bacd22fd9ac443f21f6c7e11fb820a72f69801662b7a449f12902c50d9edf98303
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDInWeNCYGyA2R7JxJAg8dtq:ymb3NkkiQ3mdBjFIWeFGyAsJAg2q
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/1288-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/60-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1408-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3620-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1588-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1928-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4144-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1132-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2908-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3096-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2432-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/772-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4620-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4364-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3672-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/728-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1136-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4052-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3404-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1408 htbttt.exe 60 dvvdj.exe 5064 llrlfxr.exe 4524 lffxfxr.exe 640 htbbtb.exe 3620 thnbbh.exe 1588 3vvpd.exe 1928 tntnnh.exe 4144 ntttnn.exe 1132 1pppj.exe 2908 rxxrrxf.exe 3096 thhbhn.exe 772 pppvj.exe 2432 xlrlxxx.exe 4924 llfffxl.exe 4620 1tntnh.exe 4880 httnhh.exe 4364 djvpp.exe 3064 xrxlrrr.exe 4484 thhttt.exe 3672 7nttnn.exe 1972 jvvvp.exe 728 pjpjv.exe 1460 xrrlflr.exe 1136 bbbttn.exe 4052 vjvjd.exe 3348 rrlfxrl.exe 3116 3hnhbt.exe 652 thnnhb.exe 3404 pvvpj.exe 4116 pvvvj.exe 4056 5rlflxr.exe 3060 nhtnhh.exe 2592 tnnhbb.exe 5048 ddjjd.exe 2764 dvvpp.exe 3020 3llffxx.exe 2148 fxxfflf.exe 3876 9ffxxrx.exe 4676 bttnnt.exe 4840 tnntnt.exe 4284 vvppj.exe 812 5pddp.exe 2424 rlxrflf.exe 1668 rrxllrx.exe 2904 hhhbtt.exe 1628 1ntbnb.exe 548 jjdvv.exe 4360 jvdvp.exe 1560 7ffxxfx.exe 4544 7rfxllf.exe 2844 nnnnht.exe 2008 ttbthh.exe 4460 jddvd.exe 3852 jpvpp.exe 3984 rlfxrrl.exe 3088 nnbtnh.exe 2908 9hnhbb.exe 1020 pjdvd.exe 3096 ddjdp.exe 2448 rfffxxl.exe 3660 9ffxllx.exe 4924 bnhbtn.exe 656 thhbtn.exe -
resource yara_rule behavioral2/memory/1288-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/60-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1408-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4524-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3620-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3620-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1588-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1928-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4144-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1132-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2908-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3096-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2432-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/772-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4620-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4364-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/728-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1136-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4052-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3404-198-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1288 wrote to memory of 1408 1288 4d0b19513986ae2c19b443cb5c889e20_NeikiAnalytics.exe 81 PID 1288 wrote to memory of 1408 1288 4d0b19513986ae2c19b443cb5c889e20_NeikiAnalytics.exe 81 PID 1288 wrote to memory of 1408 1288 4d0b19513986ae2c19b443cb5c889e20_NeikiAnalytics.exe 81 PID 1408 wrote to memory of 60 1408 htbttt.exe 83 PID 1408 wrote to memory of 60 1408 htbttt.exe 83 PID 1408 wrote to memory of 60 1408 htbttt.exe 83 PID 60 wrote to memory of 5064 60 dvvdj.exe 84 PID 60 wrote to memory of 5064 60 dvvdj.exe 84 PID 60 wrote to memory of 5064 60 dvvdj.exe 84 PID 5064 wrote to memory of 4524 5064 llrlfxr.exe 85 PID 5064 wrote to memory of 4524 5064 llrlfxr.exe 85 PID 5064 wrote to memory of 4524 5064 llrlfxr.exe 85 PID 4524 wrote to memory of 640 4524 lffxfxr.exe 86 PID 4524 wrote to memory of 640 4524 lffxfxr.exe 86 PID 4524 wrote to memory of 640 4524 lffxfxr.exe 86 PID 640 wrote to memory of 3620 640 htbbtb.exe 87 PID 640 wrote to memory of 3620 640 htbbtb.exe 87 PID 640 wrote to memory of 3620 640 htbbtb.exe 87 PID 3620 wrote to memory of 1588 3620 thnbbh.exe 88 PID 3620 wrote to memory of 1588 3620 thnbbh.exe 88 PID 3620 wrote to memory of 1588 3620 thnbbh.exe 88 PID 1588 wrote to memory of 1928 1588 3vvpd.exe 90 PID 1588 wrote to memory of 1928 1588 3vvpd.exe 90 PID 1588 wrote to memory of 1928 1588 3vvpd.exe 90 PID 1928 wrote to memory of 4144 1928 tntnnh.exe 91 PID 1928 wrote to memory of 4144 1928 tntnnh.exe 91 PID 1928 wrote to memory of 4144 1928 tntnnh.exe 91 PID 4144 wrote to memory of 1132 4144 ntttnn.exe 92 PID 4144 wrote to memory of 1132 4144 ntttnn.exe 92 PID 4144 wrote to memory of 1132 4144 ntttnn.exe 92 PID 1132 wrote to memory of 2908 1132 1pppj.exe 93 PID 1132 wrote to memory of 2908 1132 1pppj.exe 93 PID 1132 wrote to memory of 2908 1132 1pppj.exe 93 PID 2908 wrote to memory of 3096 2908 rxxrrxf.exe 94 PID 2908 wrote to memory of 3096 2908 rxxrrxf.exe 94 PID 2908 wrote to memory of 3096 2908 rxxrrxf.exe 94 PID 3096 wrote to memory of 772 3096 thhbhn.exe 95 PID 3096 wrote to memory of 772 3096 thhbhn.exe 95 PID 3096 wrote to memory of 772 3096 thhbhn.exe 95 PID 772 wrote to memory of 2432 772 pppvj.exe 97 PID 772 wrote to memory of 2432 772 pppvj.exe 97 PID 772 wrote to memory of 2432 772 pppvj.exe 97 PID 2432 wrote to memory of 4924 2432 xlrlxxx.exe 98 PID 2432 wrote to memory of 4924 2432 xlrlxxx.exe 98 PID 2432 wrote to memory of 4924 2432 xlrlxxx.exe 98 PID 4924 wrote to memory of 4620 4924 llfffxl.exe 99 PID 4924 wrote to memory of 4620 4924 llfffxl.exe 99 PID 4924 wrote to memory of 4620 4924 llfffxl.exe 99 PID 4620 wrote to memory of 4880 4620 1tntnh.exe 100 PID 4620 wrote to memory of 4880 4620 1tntnh.exe 100 PID 4620 wrote to memory of 4880 4620 1tntnh.exe 100 PID 4880 wrote to memory of 4364 4880 httnhh.exe 101 PID 4880 wrote to memory of 4364 4880 httnhh.exe 101 PID 4880 wrote to memory of 4364 4880 httnhh.exe 101 PID 4364 wrote to memory of 3064 4364 djvpp.exe 102 PID 4364 wrote to memory of 3064 4364 djvpp.exe 102 PID 4364 wrote to memory of 3064 4364 djvpp.exe 102 PID 3064 wrote to memory of 4484 3064 xrxlrrr.exe 103 PID 3064 wrote to memory of 4484 3064 xrxlrrr.exe 103 PID 3064 wrote to memory of 4484 3064 xrxlrrr.exe 103 PID 4484 wrote to memory of 3672 4484 thhttt.exe 104 PID 4484 wrote to memory of 3672 4484 thhttt.exe 104 PID 4484 wrote to memory of 3672 4484 thhttt.exe 104 PID 3672 wrote to memory of 1972 3672 7nttnn.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d0b19513986ae2c19b443cb5c889e20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4d0b19513986ae2c19b443cb5c889e20_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\htbttt.exec:\htbttt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\dvvdj.exec:\dvvdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\llrlfxr.exec:\llrlfxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\lffxfxr.exec:\lffxfxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\htbbtb.exec:\htbbtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\thnbbh.exec:\thnbbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\3vvpd.exec:\3vvpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\tntnnh.exec:\tntnnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\ntttnn.exec:\ntttnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
\??\c:\1pppj.exec:\1pppj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\rxxrrxf.exec:\rxxrrxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\thhbhn.exec:\thhbhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\pppvj.exec:\pppvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\xlrlxxx.exec:\xlrlxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\llfffxl.exec:\llfffxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\1tntnh.exec:\1tntnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\httnhh.exec:\httnhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\djvpp.exec:\djvpp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\xrxlrrr.exec:\xrxlrrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\thhttt.exec:\thhttt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\7nttnn.exec:\7nttnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\jvvvp.exec:\jvvvp.exe23⤵
- Executes dropped EXE
PID:1972 -
\??\c:\pjpjv.exec:\pjpjv.exe24⤵
- Executes dropped EXE
PID:728 -
\??\c:\xrrlflr.exec:\xrrlflr.exe25⤵
- Executes dropped EXE
PID:1460 -
\??\c:\bbbttn.exec:\bbbttn.exe26⤵
- Executes dropped EXE
PID:1136 -
\??\c:\vjvjd.exec:\vjvjd.exe27⤵
- Executes dropped EXE
PID:4052 -
\??\c:\rrlfxrl.exec:\rrlfxrl.exe28⤵
- Executes dropped EXE
PID:3348 -
\??\c:\3hnhbt.exec:\3hnhbt.exe29⤵
- Executes dropped EXE
PID:3116 -
\??\c:\thnnhb.exec:\thnnhb.exe30⤵
- Executes dropped EXE
PID:652 -
\??\c:\pvvpj.exec:\pvvpj.exe31⤵
- Executes dropped EXE
PID:3404 -
\??\c:\pvvvj.exec:\pvvvj.exe32⤵
- Executes dropped EXE
PID:4116 -
\??\c:\5rlflxr.exec:\5rlflxr.exe33⤵
- Executes dropped EXE
PID:4056 -
\??\c:\nhtnhh.exec:\nhtnhh.exe34⤵
- Executes dropped EXE
PID:3060 -
\??\c:\tnnhbb.exec:\tnnhbb.exe35⤵
- Executes dropped EXE
PID:2592 -
\??\c:\ddjjd.exec:\ddjjd.exe36⤵
- Executes dropped EXE
PID:5048 -
\??\c:\dvvpp.exec:\dvvpp.exe37⤵
- Executes dropped EXE
PID:2764 -
\??\c:\3llffxx.exec:\3llffxx.exe38⤵
- Executes dropped EXE
PID:3020 -
\??\c:\fxxfflf.exec:\fxxfflf.exe39⤵
- Executes dropped EXE
PID:2148 -
\??\c:\9ffxxrx.exec:\9ffxxrx.exe40⤵
- Executes dropped EXE
PID:3876 -
\??\c:\bttnnt.exec:\bttnnt.exe41⤵
- Executes dropped EXE
PID:4676 -
\??\c:\tnntnt.exec:\tnntnt.exe42⤵
- Executes dropped EXE
PID:4840 -
\??\c:\vvppj.exec:\vvppj.exe43⤵
- Executes dropped EXE
PID:4284 -
\??\c:\5pddp.exec:\5pddp.exe44⤵
- Executes dropped EXE
PID:812 -
\??\c:\rlxrflf.exec:\rlxrflf.exe45⤵
- Executes dropped EXE
PID:2424 -
\??\c:\rrxllrx.exec:\rrxllrx.exe46⤵
- Executes dropped EXE
PID:1668 -
\??\c:\hhhbtt.exec:\hhhbtt.exe47⤵
- Executes dropped EXE
PID:2904 -
\??\c:\1ntbnb.exec:\1ntbnb.exe48⤵
- Executes dropped EXE
PID:1628 -
\??\c:\jjdvv.exec:\jjdvv.exe49⤵
- Executes dropped EXE
PID:548 -
\??\c:\jvdvp.exec:\jvdvp.exe50⤵
- Executes dropped EXE
PID:4360 -
\??\c:\7ffxxfx.exec:\7ffxxfx.exe51⤵
- Executes dropped EXE
PID:1560 -
\??\c:\7rfxllf.exec:\7rfxllf.exe52⤵
- Executes dropped EXE
PID:4544 -
\??\c:\nnnnht.exec:\nnnnht.exe53⤵
- Executes dropped EXE
PID:2844 -
\??\c:\ttbthh.exec:\ttbthh.exe54⤵
- Executes dropped EXE
PID:2008 -
\??\c:\jddvd.exec:\jddvd.exe55⤵
- Executes dropped EXE
PID:4460 -
\??\c:\jpvpp.exec:\jpvpp.exe56⤵
- Executes dropped EXE
PID:3852 -
\??\c:\rlfxrrl.exec:\rlfxrrl.exe57⤵
- Executes dropped EXE
PID:3984 -
\??\c:\nnbtnh.exec:\nnbtnh.exe58⤵
- Executes dropped EXE
PID:3088 -
\??\c:\9hnhbb.exec:\9hnhbb.exe59⤵
- Executes dropped EXE
PID:2908 -
\??\c:\pjdvd.exec:\pjdvd.exe60⤵
- Executes dropped EXE
PID:1020 -
\??\c:\ddjdp.exec:\ddjdp.exe61⤵
- Executes dropped EXE
PID:3096 -
\??\c:\rfffxxl.exec:\rfffxxl.exe62⤵
- Executes dropped EXE
PID:2448 -
\??\c:\9ffxllx.exec:\9ffxllx.exe63⤵
- Executes dropped EXE
PID:3660 -
\??\c:\bnhbtn.exec:\bnhbtn.exe64⤵
- Executes dropped EXE
PID:4924 -
\??\c:\thhbtn.exec:\thhbtn.exe65⤵
- Executes dropped EXE
PID:656 -
\??\c:\dvpvj.exec:\dvpvj.exe66⤵PID:4972
-
\??\c:\3fllxxr.exec:\3fllxxr.exe67⤵PID:3656
-
\??\c:\nbbbth.exec:\nbbbth.exe68⤵PID:936
-
\??\c:\pvvpd.exec:\pvvpd.exe69⤵PID:3064
-
\??\c:\jjddj.exec:\jjddj.exe70⤵PID:1532
-
\??\c:\rfxrffx.exec:\rfxrffx.exe71⤵PID:1836
-
\??\c:\hthbtt.exec:\hthbtt.exe72⤵PID:1556
-
\??\c:\btbtbh.exec:\btbtbh.exe73⤵PID:4928
-
\??\c:\dddvd.exec:\dddvd.exe74⤵PID:3952
-
\??\c:\jddvp.exec:\jddvp.exe75⤵PID:1148
-
\??\c:\7fllxxr.exec:\7fllxxr.exe76⤵PID:452
-
\??\c:\9ffxrrl.exec:\9ffxrrl.exe77⤵PID:1700
-
\??\c:\3bhbhh.exec:\3bhbhh.exe78⤵PID:1736
-
\??\c:\tnhbbb.exec:\tnhbbb.exe79⤵PID:2732
-
\??\c:\pdjdv.exec:\pdjdv.exe80⤵PID:2596
-
\??\c:\pjjjj.exec:\pjjjj.exe81⤵PID:1164
-
\??\c:\ffrxrrl.exec:\ffrxrrl.exe82⤵PID:3896
-
\??\c:\lxlllll.exec:\lxlllll.exe83⤵PID:4600
-
\??\c:\bthbtn.exec:\bthbtn.exe84⤵PID:784
-
\??\c:\7jvpp.exec:\7jvpp.exe85⤵PID:668
-
\??\c:\dddpj.exec:\dddpj.exe86⤵PID:1312
-
\??\c:\3fxrlff.exec:\3fxrlff.exe87⤵PID:4380
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe88⤵PID:2352
-
\??\c:\bthbtt.exec:\bthbtt.exe89⤵PID:4308
-
\??\c:\dpvvp.exec:\dpvvp.exe90⤵PID:564
-
\??\c:\lfrlllr.exec:\lfrlllr.exe91⤵PID:4396
-
\??\c:\1lrlllf.exec:\1lrlllf.exe92⤵PID:4408
-
\??\c:\5bbthh.exec:\5bbthh.exe93⤵PID:4204
-
\??\c:\htbnbb.exec:\htbnbb.exe94⤵PID:4440
-
\??\c:\9jdpj.exec:\9jdpj.exe95⤵PID:984
-
\??\c:\3xfrrrr.exec:\3xfrrrr.exe96⤵PID:408
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe97⤵PID:3228
-
\??\c:\hhnhhh.exec:\hhnhhh.exe98⤵PID:3872
-
\??\c:\tbbthh.exec:\tbbthh.exe99⤵PID:2324
-
\??\c:\vppdp.exec:\vppdp.exe100⤵PID:1100
-
\??\c:\frflllf.exec:\frflllf.exe101⤵PID:3048
-
\??\c:\5bhbbb.exec:\5bhbbb.exe102⤵PID:2192
-
\??\c:\btbttn.exec:\btbttn.exe103⤵PID:3968
-
\??\c:\7hbtnn.exec:\7hbtnn.exe104⤵PID:1468
-
\??\c:\vddvp.exec:\vddvp.exe105⤵PID:4008
-
\??\c:\lxlfxrl.exec:\lxlfxrl.exe106⤵PID:3056
-
\??\c:\xxffxfx.exec:\xxffxfx.exe107⤵PID:1172
-
\??\c:\7ntnhh.exec:\7ntnhh.exe108⤵PID:456
-
\??\c:\htbhtt.exec:\htbhtt.exe109⤵PID:2908
-
\??\c:\jdjjj.exec:\jdjjj.exe110⤵PID:1672
-
\??\c:\pjjdd.exec:\pjjdd.exe111⤵PID:3100
-
\??\c:\rrffffl.exec:\rrffffl.exe112⤵PID:4512
-
\??\c:\fllfxrl.exec:\fllfxrl.exe113⤵PID:3660
-
\??\c:\bbhbth.exec:\bbhbth.exe114⤵PID:4244
-
\??\c:\3hnhtn.exec:\3hnhtn.exe115⤵PID:656
-
\??\c:\vvvdv.exec:\vvvdv.exe116⤵PID:2112
-
\??\c:\pdjjd.exec:\pdjjd.exe117⤵PID:2064
-
\??\c:\rllfxxr.exec:\rllfxxr.exe118⤵PID:936
-
\??\c:\lfflfrr.exec:\lfflfrr.exe119⤵PID:1168
-
\??\c:\bntnhh.exec:\bntnhh.exe120⤵PID:1532
-
\??\c:\5nhbnn.exec:\5nhbnn.exe121⤵PID:4956
-
\??\c:\pvdpd.exec:\pvdpd.exe122⤵PID:2372
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-