Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19/05/2024, 21:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
44dd4a993028693f9c236f5fa473b3e0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
44dd4a993028693f9c236f5fa473b3e0_NeikiAnalytics.exe
-
Size
94KB
-
MD5
44dd4a993028693f9c236f5fa473b3e0
-
SHA1
c005759f054200c21cc8347c5ea81bf0a0bad2ef
-
SHA256
fe8e9c1f002320cfdd77d161f1623a8198d88611d869e3b1f557a376a21e8580
-
SHA512
bdcd83153cdc34d20162686b1f5bc6086c3e0e3f023dc8e273181c82048b9961e28e0a3e6f1e91261a60ad80ba3fc547f78b5a7cb4eb5c79414a543c32dbb3e4
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qP1hvZo66Ox4oq2SQwfTQY:ymb3NkkiQ3mdBjFIj+qNhvZuHQY0Y
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/4212-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4280-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2020-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1360-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3196-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1648-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3732-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1792-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2984-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/760-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3160-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4456-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2924-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3036-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2852-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2716-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3244-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2740-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/864-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4252-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4280 5jjjj.exe 1360 5vjdd.exe 2020 ffffflf.exe 2028 nnbbnb.exe 3196 pdvvv.exe 1648 1xlfxxr.exe 3732 bnbbbb.exe 3836 pvdjv.exe 4360 pvvvv.exe 4508 lffxfxx.exe 1792 bbtthh.exe 2984 hthnnh.exe 760 djdpj.exe 3160 rxxrxxx.exe 4456 bnhntb.exe 2924 pvjvj.exe 3036 pjvpv.exe 2364 xrrrrxr.exe 376 bbntnt.exe 2852 1pvvv.exe 2776 7vjjd.exe 3480 lxfxrrl.exe 3236 nthbbt.exe 2716 tbbtnt.exe 3244 jpppd.exe 2740 5lllxxx.exe 864 1thbhh.exe 4808 htbbtt.exe 5096 jvdvp.exe 4512 5xxfxrx.exe 4252 lflllll.exe 3592 tbhntt.exe 3652 9pjjp.exe 4924 vvddv.exe 3420 llffxxx.exe 64 9ttnhh.exe 5060 5bbbbh.exe 764 ddpjp.exe 4328 rxxrlll.exe 1512 xrxxlll.exe 3476 7hbbbb.exe 3016 nthhhn.exe 2236 thtnhh.exe 636 vjjdd.exe 392 lxfxrrr.exe 1924 5rxxxxf.exe 2928 nnnbnh.exe 2112 btbttn.exe 1508 ppvvp.exe 5024 lfrrxxx.exe 1972 xlxxxlf.exe 2792 tttttt.exe 2548 5vjdd.exe 2984 vdppp.exe 5044 fxxxllr.exe 4812 1xlffxx.exe 2024 3tbbtb.exe 800 tnbttn.exe 2304 3vvjd.exe 1944 jpdvj.exe 2088 3djdp.exe 4612 frrrllf.exe 1796 1rxfxxx.exe 1696 thnhhb.exe -
resource yara_rule behavioral2/memory/4212-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4280-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2020-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2020-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1360-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3196-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1648-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3732-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1792-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2984-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/760-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2852-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2716-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3244-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2740-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/864-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4252-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4212 wrote to memory of 4280 4212 44dd4a993028693f9c236f5fa473b3e0_NeikiAnalytics.exe 82 PID 4212 wrote to memory of 4280 4212 44dd4a993028693f9c236f5fa473b3e0_NeikiAnalytics.exe 82 PID 4212 wrote to memory of 4280 4212 44dd4a993028693f9c236f5fa473b3e0_NeikiAnalytics.exe 82 PID 4280 wrote to memory of 1360 4280 5jjjj.exe 83 PID 4280 wrote to memory of 1360 4280 5jjjj.exe 83 PID 4280 wrote to memory of 1360 4280 5jjjj.exe 83 PID 1360 wrote to memory of 2020 1360 5vjdd.exe 84 PID 1360 wrote to memory of 2020 1360 5vjdd.exe 84 PID 1360 wrote to memory of 2020 1360 5vjdd.exe 84 PID 2020 wrote to memory of 2028 2020 ffffflf.exe 85 PID 2020 wrote to memory of 2028 2020 ffffflf.exe 85 PID 2020 wrote to memory of 2028 2020 ffffflf.exe 85 PID 2028 wrote to memory of 3196 2028 nnbbnb.exe 86 PID 2028 wrote to memory of 3196 2028 nnbbnb.exe 86 PID 2028 wrote to memory of 3196 2028 nnbbnb.exe 86 PID 3196 wrote to memory of 1648 3196 pdvvv.exe 87 PID 3196 wrote to memory of 1648 3196 pdvvv.exe 87 PID 3196 wrote to memory of 1648 3196 pdvvv.exe 87 PID 1648 wrote to memory of 3732 1648 1xlfxxr.exe 88 PID 1648 wrote to memory of 3732 1648 1xlfxxr.exe 88 PID 1648 wrote to memory of 3732 1648 1xlfxxr.exe 88 PID 3732 wrote to memory of 3836 3732 bnbbbb.exe 89 PID 3732 wrote to memory of 3836 3732 bnbbbb.exe 89 PID 3732 wrote to memory of 3836 3732 bnbbbb.exe 89 PID 3836 wrote to memory of 4360 3836 pvdjv.exe 90 PID 3836 wrote to memory of 4360 3836 pvdjv.exe 90 PID 3836 wrote to memory of 4360 3836 pvdjv.exe 90 PID 4360 wrote to memory of 4508 4360 pvvvv.exe 91 PID 4360 wrote to memory of 4508 4360 pvvvv.exe 91 PID 4360 wrote to memory of 4508 4360 pvvvv.exe 91 PID 4508 wrote to memory of 1792 4508 lffxfxx.exe 92 PID 4508 wrote to memory of 1792 4508 lffxfxx.exe 92 PID 4508 wrote to memory of 1792 4508 lffxfxx.exe 92 PID 1792 wrote to memory of 2984 1792 bbtthh.exe 93 PID 1792 wrote to memory of 2984 1792 bbtthh.exe 93 PID 1792 wrote to memory of 2984 1792 bbtthh.exe 93 PID 2984 wrote to memory of 760 2984 hthnnh.exe 94 PID 2984 wrote to memory of 760 2984 hthnnh.exe 94 PID 2984 wrote to memory of 760 2984 hthnnh.exe 94 PID 760 wrote to memory of 3160 760 djdpj.exe 95 PID 760 wrote to memory of 3160 760 djdpj.exe 95 PID 760 wrote to memory of 3160 760 djdpj.exe 95 PID 3160 wrote to memory of 4456 3160 rxxrxxx.exe 96 PID 3160 wrote to memory of 4456 3160 rxxrxxx.exe 96 PID 3160 wrote to memory of 4456 3160 rxxrxxx.exe 96 PID 4456 wrote to memory of 2924 4456 bnhntb.exe 97 PID 4456 wrote to memory of 2924 4456 bnhntb.exe 97 PID 4456 wrote to memory of 2924 4456 bnhntb.exe 97 PID 2924 wrote to memory of 3036 2924 pvjvj.exe 98 PID 2924 wrote to memory of 3036 2924 pvjvj.exe 98 PID 2924 wrote to memory of 3036 2924 pvjvj.exe 98 PID 3036 wrote to memory of 2364 3036 pjvpv.exe 99 PID 3036 wrote to memory of 2364 3036 pjvpv.exe 99 PID 3036 wrote to memory of 2364 3036 pjvpv.exe 99 PID 2364 wrote to memory of 376 2364 xrrrrxr.exe 100 PID 2364 wrote to memory of 376 2364 xrrrrxr.exe 100 PID 2364 wrote to memory of 376 2364 xrrrrxr.exe 100 PID 376 wrote to memory of 2852 376 bbntnt.exe 101 PID 376 wrote to memory of 2852 376 bbntnt.exe 101 PID 376 wrote to memory of 2852 376 bbntnt.exe 101 PID 2852 wrote to memory of 2776 2852 1pvvv.exe 102 PID 2852 wrote to memory of 2776 2852 1pvvv.exe 102 PID 2852 wrote to memory of 2776 2852 1pvvv.exe 102 PID 2776 wrote to memory of 3480 2776 7vjjd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\44dd4a993028693f9c236f5fa473b3e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\44dd4a993028693f9c236f5fa473b3e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\5jjjj.exec:\5jjjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\5vjdd.exec:\5vjdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\ffffflf.exec:\ffffflf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\nnbbnb.exec:\nnbbnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\pdvvv.exec:\pdvvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\1xlfxxr.exec:\1xlfxxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\bnbbbb.exec:\bnbbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\pvdjv.exec:\pvdjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\pvvvv.exec:\pvvvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\lffxfxx.exec:\lffxfxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\bbtthh.exec:\bbtthh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\hthnnh.exec:\hthnnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\djdpj.exec:\djdpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\rxxrxxx.exec:\rxxrxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\bnhntb.exec:\bnhntb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\pvjvj.exec:\pvjvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\pjvpv.exec:\pjvpv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\xrrrrxr.exec:\xrrrrxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\bbntnt.exec:\bbntnt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\1pvvv.exec:\1pvvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\7vjjd.exec:\7vjjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe23⤵
- Executes dropped EXE
PID:3480 -
\??\c:\nthbbt.exec:\nthbbt.exe24⤵
- Executes dropped EXE
PID:3236 -
\??\c:\tbbtnt.exec:\tbbtnt.exe25⤵
- Executes dropped EXE
PID:2716 -
\??\c:\jpppd.exec:\jpppd.exe26⤵
- Executes dropped EXE
PID:3244 -
\??\c:\5lllxxx.exec:\5lllxxx.exe27⤵
- Executes dropped EXE
PID:2740 -
\??\c:\1thbhh.exec:\1thbhh.exe28⤵
- Executes dropped EXE
PID:864 -
\??\c:\htbbtt.exec:\htbbtt.exe29⤵
- Executes dropped EXE
PID:4808 -
\??\c:\jvdvp.exec:\jvdvp.exe30⤵
- Executes dropped EXE
PID:5096 -
\??\c:\5xxfxrx.exec:\5xxfxrx.exe31⤵
- Executes dropped EXE
PID:4512 -
\??\c:\lflllll.exec:\lflllll.exe32⤵
- Executes dropped EXE
PID:4252 -
\??\c:\tbhntt.exec:\tbhntt.exe33⤵
- Executes dropped EXE
PID:3592 -
\??\c:\9pjjp.exec:\9pjjp.exe34⤵
- Executes dropped EXE
PID:3652 -
\??\c:\vvddv.exec:\vvddv.exe35⤵
- Executes dropped EXE
PID:4924 -
\??\c:\llffxxx.exec:\llffxxx.exe36⤵
- Executes dropped EXE
PID:3420 -
\??\c:\9ttnhh.exec:\9ttnhh.exe37⤵
- Executes dropped EXE
PID:64 -
\??\c:\5bbbbh.exec:\5bbbbh.exe38⤵
- Executes dropped EXE
PID:5060 -
\??\c:\ddpjp.exec:\ddpjp.exe39⤵
- Executes dropped EXE
PID:764 -
\??\c:\rxxrlll.exec:\rxxrlll.exe40⤵
- Executes dropped EXE
PID:4328 -
\??\c:\xrxxlll.exec:\xrxxlll.exe41⤵
- Executes dropped EXE
PID:1512 -
\??\c:\7hbbbb.exec:\7hbbbb.exe42⤵
- Executes dropped EXE
PID:3476 -
\??\c:\nthhhn.exec:\nthhhn.exe43⤵
- Executes dropped EXE
PID:3016 -
\??\c:\thtnhh.exec:\thtnhh.exe44⤵
- Executes dropped EXE
PID:2236 -
\??\c:\vjjdd.exec:\vjjdd.exe45⤵
- Executes dropped EXE
PID:636 -
\??\c:\lxfxrrr.exec:\lxfxrrr.exe46⤵
- Executes dropped EXE
PID:392 -
\??\c:\5rxxxxf.exec:\5rxxxxf.exe47⤵
- Executes dropped EXE
PID:1924 -
\??\c:\nnnbnh.exec:\nnnbnh.exe48⤵
- Executes dropped EXE
PID:2928 -
\??\c:\btbttn.exec:\btbttn.exe49⤵
- Executes dropped EXE
PID:2112 -
\??\c:\ppvvp.exec:\ppvvp.exe50⤵
- Executes dropped EXE
PID:1508 -
\??\c:\lfrrxxx.exec:\lfrrxxx.exe51⤵
- Executes dropped EXE
PID:5024 -
\??\c:\xlxxxlf.exec:\xlxxxlf.exe52⤵
- Executes dropped EXE
PID:1972 -
\??\c:\tttttt.exec:\tttttt.exe53⤵
- Executes dropped EXE
PID:2792 -
\??\c:\5vjdd.exec:\5vjdd.exe54⤵
- Executes dropped EXE
PID:2548 -
\??\c:\vdppp.exec:\vdppp.exe55⤵
- Executes dropped EXE
PID:2984 -
\??\c:\fxxxllr.exec:\fxxxllr.exe56⤵
- Executes dropped EXE
PID:5044 -
\??\c:\1xlffxx.exec:\1xlffxx.exe57⤵
- Executes dropped EXE
PID:4812 -
\??\c:\3tbbtb.exec:\3tbbtb.exe58⤵
- Executes dropped EXE
PID:2024 -
\??\c:\tnbttn.exec:\tnbttn.exe59⤵
- Executes dropped EXE
PID:800 -
\??\c:\3vvjd.exec:\3vvjd.exe60⤵
- Executes dropped EXE
PID:2304 -
\??\c:\jpdvj.exec:\jpdvj.exe61⤵
- Executes dropped EXE
PID:1944 -
\??\c:\3djdp.exec:\3djdp.exe62⤵
- Executes dropped EXE
PID:2088 -
\??\c:\frrrllf.exec:\frrrllf.exe63⤵
- Executes dropped EXE
PID:4612 -
\??\c:\1rxfxxx.exec:\1rxfxxx.exe64⤵
- Executes dropped EXE
PID:1796 -
\??\c:\thnhhb.exec:\thnhhb.exe65⤵
- Executes dropped EXE
PID:1696 -
\??\c:\ppddp.exec:\ppddp.exe66⤵PID:4888
-
\??\c:\7frllrx.exec:\7frllrx.exe67⤵PID:3524
-
\??\c:\xrllllf.exec:\xrllllf.exe68⤵PID:3516
-
\??\c:\hnbttt.exec:\hnbttt.exe69⤵PID:4972
-
\??\c:\nntnnt.exec:\nntnnt.exe70⤵PID:2368
-
\??\c:\5jjdv.exec:\5jjdv.exe71⤵PID:2552
-
\??\c:\xxfllfx.exec:\xxfllfx.exe72⤵PID:956
-
\??\c:\llrlfxr.exec:\llrlfxr.exe73⤵PID:2988
-
\??\c:\tbbbbb.exec:\tbbbbb.exe74⤵PID:1752
-
\??\c:\5htnnt.exec:\5htnnt.exe75⤵PID:3292
-
\??\c:\pjjdv.exec:\pjjdv.exe76⤵PID:2168
-
\??\c:\fflfxxx.exec:\fflfxxx.exe77⤵PID:3872
-
\??\c:\xrfrffr.exec:\xrfrffr.exe78⤵PID:3096
-
\??\c:\ttbhhh.exec:\ttbhhh.exe79⤵PID:2948
-
\??\c:\5dppj.exec:\5dppj.exe80⤵PID:4452
-
\??\c:\lllrlff.exec:\lllrlff.exe81⤵PID:3800
-
\??\c:\xfxlxlx.exec:\xfxlxlx.exe82⤵PID:4552
-
\??\c:\nntttt.exec:\nntttt.exe83⤵PID:3420
-
\??\c:\vvjdp.exec:\vvjdp.exe84⤵PID:5060
-
\??\c:\llxxllx.exec:\llxxllx.exe85⤵PID:4212
-
\??\c:\3fxrxrx.exec:\3fxrxrx.exe86⤵PID:440
-
\??\c:\nhhttb.exec:\nhhttb.exe87⤵PID:1512
-
\??\c:\jjppj.exec:\jjppj.exe88⤵PID:2308
-
\??\c:\xxllfll.exec:\xxllfll.exe89⤵PID:1460
-
\??\c:\lffxxxx.exec:\lffxxxx.exe90⤵PID:2032
-
\??\c:\hnbtnh.exec:\hnbtnh.exe91⤵PID:3224
-
\??\c:\5djdv.exec:\5djdv.exe92⤵PID:3196
-
\??\c:\5rllfrf.exec:\5rllfrf.exe93⤵PID:2040
-
\??\c:\hnbnbb.exec:\hnbnbb.exe94⤵PID:1888
-
\??\c:\7bhhnn.exec:\7bhhnn.exe95⤵PID:4920
-
\??\c:\vppjj.exec:\vppjj.exe96⤵PID:2996
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe97⤵PID:2112
-
\??\c:\djvpj.exec:\djvpj.exe98⤵PID:1508
-
\??\c:\7rrrllf.exec:\7rrrllf.exe99⤵PID:2980
-
\??\c:\nntnbb.exec:\nntnbb.exe100⤵PID:3588
-
\??\c:\nhbhtt.exec:\nhbhtt.exe101⤵PID:2428
-
\??\c:\vvdvd.exec:\vvdvd.exe102⤵PID:5052
-
\??\c:\xllllll.exec:\xllllll.exe103⤵PID:1900
-
\??\c:\bbnnhh.exec:\bbnnhh.exe104⤵PID:4336
-
\??\c:\btbbhh.exec:\btbbhh.exe105⤵PID:3108
-
\??\c:\vpjdv.exec:\vpjdv.exe106⤵PID:3036
-
\??\c:\rxlxxlf.exec:\rxlxxlf.exe107⤵PID:3876
-
\??\c:\nnnnhh.exec:\nnnnhh.exe108⤵PID:2224
-
\??\c:\bttnnn.exec:\bttnnn.exe109⤵PID:376
-
\??\c:\jjppp.exec:\jjppp.exe110⤵PID:4936
-
\??\c:\xffllrl.exec:\xffllrl.exe111⤵PID:2776
-
\??\c:\lffffrr.exec:\lffffrr.exe112⤵PID:3964
-
\??\c:\tnbhbh.exec:\tnbhbh.exe113⤵PID:4940
-
\??\c:\hbbbtt.exec:\hbbbtt.exe114⤵PID:4632
-
\??\c:\pvjjv.exec:\pvjjv.exe115⤵PID:404
-
\??\c:\xxlxrlf.exec:\xxlxrlf.exe116⤵PID:4024
-
\??\c:\llxlrxx.exec:\llxlrxx.exe117⤵PID:3924
-
\??\c:\bthbtt.exec:\bthbtt.exe118⤵PID:4596
-
\??\c:\jjvvj.exec:\jjvvj.exe119⤵PID:1912
-
\??\c:\vpppj.exec:\vpppj.exe120⤵PID:3936
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe121⤵PID:632
-
\??\c:\xxxlrlr.exec:\xxxlrlr.exe122⤵PID:3908
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-