Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2024, 22:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4fcb74875449c416882f0917038ccda0_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
- Target 4fcb74875449c416882f0917038ccda0_NeikiAnalytics.exe
- Size 83KB
- Sample240519-2pkhcafa81
- SHA256 6eaba12aa8ebb08a3a98461924f7fd49c71dc3bc2d844b033c15d62d4478e103
- MD5 4fcb74875449c416882f0917038ccda0
- SHA1 89d6139ede8f814485a41120d386400938003187
- SHA512 e7102ea93884041413774937637d6160a79e9ec2df4fcaf9f49d7fba766dec62471c70256abc5e6f6d27bb0eb7eaf484b236f4c41c56c8540c133e172f3c365d
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAXPfgr2hKmdbcPi2v3:ymb3NkkiQ3mdBjFo6Pfgy3dbc/3
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/4992-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4152-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1520-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1320-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2876-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1888-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2148-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3104-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/856-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3200-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2952-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/692-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3240-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3296-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2640-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4256-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1300-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3620-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3108-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2716-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 640 3djjj.exe 1092 flllfxr.exe 4152 ntbtbn.exe 1520 pvvpv.exe 1320 fxrlxxr.exe 2876 hbhhbb.exe 1888 rxflffx.exe 4552 rllfflf.exe 2148 5ttbtt.exe 3104 3vjdv.exe 4048 bthttt.exe 2812 thnhhh.exe 856 dddvv.exe 3200 rlrllrr.exe 2448 nhbttt.exe 692 jddvp.exe 2952 9lxrffl.exe 3240 hnhnht.exe 3296 bnnhnn.exe 4520 ddjjj.exe 2640 hbtnbb.exe 4256 vppvj.exe 1300 jdvpp.exe 4852 tbhbnh.exe 3620 jdvvj.exe 4040 vvdpp.exe 3108 xrrlxxr.exe 5036 hhtbtb.exe 2716 9djjp.exe 4144 lrrlxxx.exe 4340 1nhhbb.exe 3628 ppjjj.exe 3404 jdpvv.exe 1832 xlrxflx.exe 3672 btbttb.exe 4868 tbhhnn.exe 924 jjjdp.exe 4548 5rrlfrr.exe 960 nhttnn.exe 380 vpvpp.exe 2916 jvjvp.exe 3204 rllxfxf.exe 3224 htnnnn.exe 1492 7djdv.exe 4488 jdjvp.exe 5020 fxllxff.exe 412 xfllffx.exe 1672 hbbbnn.exe 1836 dddvp.exe 4704 xxxrfll.exe 3788 lxllllf.exe 4100 nhnhhh.exe 392 nbtbhh.exe 4276 vvvpj.exe 3372 lxxxrrl.exe 4960 flllxxx.exe 2240 nnnntt.exe 2652 tttnhb.exe 384 djvvd.exe 948 djjjd.exe 3268 rlfxrlf.exe 5116 7btntb.exe 1212 nbhbtn.exe 4032 1vvpj.exe -
resource yara_rule behavioral2/memory/4992-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4152-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1520-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1320-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1320-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1320-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1320-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2876-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1888-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3104-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3104-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/856-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3200-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2952-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/692-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3240-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3296-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2640-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4256-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1300-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3620-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3108-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2716-196-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4992 wrote to memory of 640 4992 4fcb74875449c416882f0917038ccda0_NeikiAnalytics.exe 83 PID 4992 wrote to memory of 640 4992 4fcb74875449c416882f0917038ccda0_NeikiAnalytics.exe 83 PID 4992 wrote to memory of 640 4992 4fcb74875449c416882f0917038ccda0_NeikiAnalytics.exe 83 PID 640 wrote to memory of 1092 640 3djjj.exe 84 PID 640 wrote to memory of 1092 640 3djjj.exe 84 PID 640 wrote to memory of 1092 640 3djjj.exe 84 PID 1092 wrote to memory of 4152 1092 flllfxr.exe 85 PID 1092 wrote to memory of 4152 1092 flllfxr.exe 85 PID 1092 wrote to memory of 4152 1092 flllfxr.exe 85 PID 4152 wrote to memory of 1520 4152 ntbtbn.exe 86 PID 4152 wrote to memory of 1520 4152 ntbtbn.exe 86 PID 4152 wrote to memory of 1520 4152 ntbtbn.exe 86 PID 1520 wrote to memory of 1320 1520 pvvpv.exe 87 PID 1520 wrote to memory of 1320 1520 pvvpv.exe 87 PID 1520 wrote to memory of 1320 1520 pvvpv.exe 87 PID 1320 wrote to memory of 2876 1320 fxrlxxr.exe 88 PID 1320 wrote to memory of 2876 1320 fxrlxxr.exe 88 PID 1320 wrote to memory of 2876 1320 fxrlxxr.exe 88 PID 2876 wrote to memory of 1888 2876 hbhhbb.exe 89 PID 2876 wrote to memory of 1888 2876 hbhhbb.exe 89 PID 2876 wrote to memory of 1888 2876 hbhhbb.exe 89 PID 1888 wrote to memory of 4552 1888 rxflffx.exe 90 PID 1888 wrote to memory of 4552 1888 rxflffx.exe 90 PID 1888 wrote to memory of 4552 1888 rxflffx.exe 90 PID 4552 wrote to memory of 2148 4552 rllfflf.exe 91 PID 4552 wrote to memory of 2148 4552 rllfflf.exe 91 PID 4552 wrote to memory of 2148 4552 rllfflf.exe 91 PID 2148 wrote to memory of 3104 2148 5ttbtt.exe 92 PID 2148 wrote to memory of 3104 2148 5ttbtt.exe 92 PID 2148 wrote to memory of 3104 2148 5ttbtt.exe 92 PID 3104 wrote to memory of 4048 3104 3vjdv.exe 93 PID 3104 wrote to memory of 4048 3104 3vjdv.exe 93 PID 3104 wrote to memory of 4048 3104 3vjdv.exe 93 PID 4048 wrote to memory of 2812 4048 bthttt.exe 94 PID 4048 wrote to memory of 2812 4048 bthttt.exe 94 PID 4048 wrote to memory of 2812 4048 bthttt.exe 94 PID 2812 wrote to memory of 856 2812 thnhhh.exe 95 PID 2812 wrote to memory of 856 2812 thnhhh.exe 95 PID 2812 wrote to memory of 856 2812 thnhhh.exe 95 PID 856 wrote to memory of 3200 856 dddvv.exe 96 PID 856 wrote to memory of 3200 856 dddvv.exe 96 PID 856 wrote to memory of 3200 856 dddvv.exe 96 PID 3200 wrote to memory of 2448 3200 rlrllrr.exe 97 PID 3200 wrote to memory of 2448 3200 rlrllrr.exe 97 PID 3200 wrote to memory of 2448 3200 rlrllrr.exe 97 PID 2448 wrote to memory of 692 2448 nhbttt.exe 98 PID 2448 wrote to memory of 692 2448 nhbttt.exe 98 PID 2448 wrote to memory of 692 2448 nhbttt.exe 98 PID 692 wrote to memory of 2952 692 jddvp.exe 99 PID 692 wrote to memory of 2952 692 jddvp.exe 99 PID 692 wrote to memory of 2952 692 jddvp.exe 99 PID 2952 wrote to memory of 3240 2952 9lxrffl.exe 100 PID 2952 wrote to memory of 3240 2952 9lxrffl.exe 100 PID 2952 wrote to memory of 3240 2952 9lxrffl.exe 100 PID 3240 wrote to memory of 3296 3240 hnhnht.exe 101 PID 3240 wrote to memory of 3296 3240 hnhnht.exe 101 PID 3240 wrote to memory of 3296 3240 hnhnht.exe 101 PID 3296 wrote to memory of 4520 3296 bnnhnn.exe 102 PID 3296 wrote to memory of 4520 3296 bnnhnn.exe 102 PID 3296 wrote to memory of 4520 3296 bnnhnn.exe 102 PID 4520 wrote to memory of 2640 4520 ddjjj.exe 103 PID 4520 wrote to memory of 2640 4520 ddjjj.exe 103 PID 4520 wrote to memory of 2640 4520 ddjjj.exe 103 PID 2640 wrote to memory of 4256 2640 hbtnbb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fcb74875449c416882f0917038ccda0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4fcb74875449c416882f0917038ccda0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\3djjj.exec:\3djjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\flllfxr.exec:\flllfxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\ntbtbn.exec:\ntbtbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\pvvpv.exec:\pvvpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\fxrlxxr.exec:\fxrlxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\hbhhbb.exec:\hbhhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\rxflffx.exec:\rxflffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\rllfflf.exec:\rllfflf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\5ttbtt.exec:\5ttbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\3vjdv.exec:\3vjdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\bthttt.exec:\bthttt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\thnhhh.exec:\thnhhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\dddvv.exec:\dddvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\rlrllrr.exec:\rlrllrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\nhbttt.exec:\nhbttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\jddvp.exec:\jddvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
\??\c:\9lxrffl.exec:\9lxrffl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\hnhnht.exec:\hnhnht.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
\??\c:\bnnhnn.exec:\bnnhnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
\??\c:\ddjjj.exec:\ddjjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\hbtnbb.exec:\hbtnbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\vppvj.exec:\vppvj.exe23⤵
- Executes dropped EXE
PID:4256 -
\??\c:\jdvpp.exec:\jdvpp.exe24⤵
- Executes dropped EXE
PID:1300 -
\??\c:\tbhbnh.exec:\tbhbnh.exe25⤵
- Executes dropped EXE
PID:4852 -
\??\c:\jdvvj.exec:\jdvvj.exe26⤵
- Executes dropped EXE
PID:3620 -
\??\c:\vvdpp.exec:\vvdpp.exe27⤵
- Executes dropped EXE
PID:4040 -
\??\c:\xrrlxxr.exec:\xrrlxxr.exe28⤵
- Executes dropped EXE
PID:3108 -
\??\c:\hhtbtb.exec:\hhtbtb.exe29⤵
- Executes dropped EXE
PID:5036 -
\??\c:\9djjp.exec:\9djjp.exe30⤵
- Executes dropped EXE
PID:2716 -
\??\c:\lrrlxxx.exec:\lrrlxxx.exe31⤵
- Executes dropped EXE
PID:4144 -
\??\c:\1nhhbb.exec:\1nhhbb.exe32⤵
- Executes dropped EXE
PID:4340 -
\??\c:\ppjjj.exec:\ppjjj.exe33⤵
- Executes dropped EXE
PID:3628 -
\??\c:\jdpvv.exec:\jdpvv.exe34⤵
- Executes dropped EXE
PID:3404 -
\??\c:\xlrxflx.exec:\xlrxflx.exe35⤵
- Executes dropped EXE
PID:1832 -
\??\c:\btbttb.exec:\btbttb.exe36⤵
- Executes dropped EXE
PID:3672 -
\??\c:\tbhhnn.exec:\tbhhnn.exe37⤵
- Executes dropped EXE
PID:4868 -
\??\c:\jjjdp.exec:\jjjdp.exe38⤵
- Executes dropped EXE
PID:924 -
\??\c:\5rrlfrr.exec:\5rrlfrr.exe39⤵
- Executes dropped EXE
PID:4548 -
\??\c:\nhttnn.exec:\nhttnn.exe40⤵
- Executes dropped EXE
PID:960 -
\??\c:\vpvpp.exec:\vpvpp.exe41⤵
- Executes dropped EXE
PID:380 -
\??\c:\jvjvp.exec:\jvjvp.exe42⤵
- Executes dropped EXE
PID:2916 -
\??\c:\rllxfxf.exec:\rllxfxf.exe43⤵
- Executes dropped EXE
PID:3204 -
\??\c:\htnnnn.exec:\htnnnn.exe44⤵
- Executes dropped EXE
PID:3224 -
\??\c:\7djdv.exec:\7djdv.exe45⤵
- Executes dropped EXE
PID:1492 -
\??\c:\jdjvp.exec:\jdjvp.exe46⤵
- Executes dropped EXE
PID:4488 -
\??\c:\fxllxff.exec:\fxllxff.exe47⤵
- Executes dropped EXE
PID:5020 -
\??\c:\xfllffx.exec:\xfllffx.exe48⤵
- Executes dropped EXE
PID:412 -
\??\c:\hbbbnn.exec:\hbbbnn.exe49⤵
- Executes dropped EXE
PID:1672 -
\??\c:\dddvp.exec:\dddvp.exe50⤵
- Executes dropped EXE
PID:1836 -
\??\c:\xxxrfll.exec:\xxxrfll.exe51⤵
- Executes dropped EXE
PID:4704 -
\??\c:\lxllllf.exec:\lxllllf.exe52⤵
- Executes dropped EXE
PID:3788 -
\??\c:\nhnhhh.exec:\nhnhhh.exe53⤵
- Executes dropped EXE
PID:4100 -
\??\c:\nbtbhh.exec:\nbtbhh.exe54⤵
- Executes dropped EXE
PID:392 -
\??\c:\vvvpj.exec:\vvvpj.exe55⤵
- Executes dropped EXE
PID:4276 -
\??\c:\lxxxrrl.exec:\lxxxrrl.exe56⤵
- Executes dropped EXE
PID:3372 -
\??\c:\flllxxx.exec:\flllxxx.exe57⤵
- Executes dropped EXE
PID:4960 -
\??\c:\nnnntt.exec:\nnnntt.exe58⤵
- Executes dropped EXE
PID:2240 -
\??\c:\tttnhb.exec:\tttnhb.exe59⤵
- Executes dropped EXE
PID:2652 -
\??\c:\djvvd.exec:\djvvd.exe60⤵
- Executes dropped EXE
PID:384 -
\??\c:\djjjd.exec:\djjjd.exe61⤵
- Executes dropped EXE
PID:948 -
\??\c:\rlfxrlf.exec:\rlfxrlf.exe62⤵
- Executes dropped EXE
PID:3268 -
\??\c:\7btntb.exec:\7btntb.exe63⤵
- Executes dropped EXE
PID:5116 -
\??\c:\nbhbtn.exec:\nbhbtn.exe64⤵
- Executes dropped EXE
PID:1212 -
\??\c:\1vvpj.exec:\1vvpj.exe65⤵
- Executes dropped EXE
PID:4032 -
\??\c:\lflfxxr.exec:\lflfxxr.exe66⤵PID:5032
-
\??\c:\fxxxrrl.exec:\fxxxrrl.exe67⤵PID:4416
-
\??\c:\btnhbb.exec:\btnhbb.exe68⤵PID:1528
-
\??\c:\3ddvj.exec:\3ddvj.exe69⤵PID:4188
-
\??\c:\lffrrxx.exec:\lffrrxx.exe70⤵PID:1940
-
\??\c:\lxxfrlf.exec:\lxxfrlf.exe71⤵PID:3644
-
\??\c:\tthhhh.exec:\tthhhh.exe72⤵PID:1908
-
\??\c:\dvvvp.exec:\dvvvp.exe73⤵PID:3612
-
\??\c:\7flfrrl.exec:\7flfrrl.exe74⤵PID:1844
-
\??\c:\tbtttn.exec:\tbtttn.exe75⤵PID:2896
-
\??\c:\3pjdd.exec:\3pjdd.exe76⤵PID:4148
-
\??\c:\xlrlllf.exec:\xlrlllf.exe77⤵PID:3680
-
\??\c:\frfrfll.exec:\frfrfll.exe78⤵PID:2716
-
\??\c:\bhhtth.exec:\bhhtth.exe79⤵PID:4572
-
\??\c:\jddvv.exec:\jddvv.exe80⤵PID:3556
-
\??\c:\fflrlxl.exec:\fflrlxl.exe81⤵PID:4340
-
\??\c:\rlxfllf.exec:\rlxfllf.exe82⤵PID:4224
-
\??\c:\vdvvp.exec:\vdvvp.exe83⤵PID:3748
-
\??\c:\jpjdj.exec:\jpjdj.exe84⤵PID:3056
-
\??\c:\3lxrxrx.exec:\3lxrxrx.exe85⤵PID:1464
-
\??\c:\fllfxxx.exec:\fllfxxx.exe86⤵PID:4332
-
\??\c:\hhhnhn.exec:\hhhnhn.exe87⤵PID:1420
-
\??\c:\dpddp.exec:\dpddp.exe88⤵PID:2580
-
\??\c:\fxllflr.exec:\fxllflr.exe89⤵PID:1112
-
\??\c:\hbttbb.exec:\hbttbb.exe90⤵PID:1012
-
\??\c:\jvvpd.exec:\jvvpd.exe91⤵PID:2452
-
\??\c:\jdjjd.exec:\jdjjd.exe92⤵PID:1340
-
\??\c:\rfrxxff.exec:\rfrxxff.exe93⤵PID:3568
-
\??\c:\bthtnn.exec:\bthtnn.exe94⤵PID:2076
-
\??\c:\9bntth.exec:\9bntth.exe95⤵PID:1840
-
\??\c:\pjvvd.exec:\pjvvd.exe96⤵PID:412
-
\??\c:\xrffflr.exec:\xrffflr.exe97⤵PID:1672
-
\??\c:\rrflxxx.exec:\rrflxxx.exe98⤵PID:2104
-
\??\c:\tnttnt.exec:\tnttnt.exe99⤵PID:4704
-
\??\c:\vpppj.exec:\vpppj.exe100⤵PID:2488
-
\??\c:\rlrfrll.exec:\rlrfrll.exe101⤵PID:4020
-
\??\c:\nbthbt.exec:\nbthbt.exe102⤵PID:4568
-
\??\c:\1jvvj.exec:\1jvvj.exe103⤵PID:2596
-
\??\c:\xfrlrfl.exec:\xfrlrfl.exe104⤵PID:1620
-
\??\c:\tnnnnn.exec:\tnnnnn.exe105⤵PID:2412
-
\??\c:\dvjdv.exec:\dvjdv.exe106⤵PID:5096
-
\??\c:\7xlrlll.exec:\7xlrlll.exe107⤵PID:2184
-
\??\c:\btnnhb.exec:\btnnhb.exe108⤵PID:2448
-
\??\c:\7vjdv.exec:\7vjdv.exe109⤵PID:4716
-
\??\c:\dvvpd.exec:\dvvpd.exe110⤵PID:2964
-
\??\c:\9llfxfx.exec:\9llfxfx.exe111⤵PID:1120
-
\??\c:\rllllff.exec:\rllllff.exe112⤵PID:3240
-
\??\c:\tbbhht.exec:\tbbhht.exe113⤵PID:4924
-
\??\c:\nbnnnn.exec:\nbnnnn.exe114⤵PID:1728
-
\??\c:\pjjpj.exec:\pjjpj.exe115⤵PID:4156
-
\??\c:\pjpjd.exec:\pjpjd.exe116⤵PID:5084
-
\??\c:\fxxxxxx.exec:\fxxxxxx.exe117⤵PID:1668
-
\??\c:\1flllrl.exec:\1flllrl.exe118⤵PID:1636
-
\??\c:\btnhbb.exec:\btnhbb.exe119⤵PID:1968
-
\??\c:\7djjd.exec:\7djjd.exe120⤵PID:1964
-
\??\c:\9vddv.exec:\9vddv.exe121⤵PID:2660
-
\??\c:\xfxlfxf.exec:\xfxlfxf.exe122⤵PID:4996
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-