Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/05/2024, 05:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0bf85f34e230e5ee5c18a7ad37f42440_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
0bf85f34e230e5ee5c18a7ad37f42440_NeikiAnalytics.exe
-
Size
71KB
-
MD5
0bf85f34e230e5ee5c18a7ad37f42440
-
SHA1
c9d3c8fb9e9c85dbd73dd1a68961fa813548731d
-
SHA256
1f009b5cf965ed2aa81a1a733317173d195346de000fd10e78e9bb721ad6f22e
-
SHA512
2c12d44c3d43ecef70d88322895cc20ef5f277183eca99778f6a31f5dacfd9345db73a24b6f2bd02b879c2fa75b6e2bd144522d3669d5add7515222fda09718b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb7tAHEqSCkKWSp:ymb3NkkiQ3mdBjFIynIKp
Malware Config
Signatures
-
Detect Blackmoon payload 31 IoCs
resource yara_rule behavioral2/memory/2288-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3052-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2852-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1284-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2904-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1216-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/748-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3056-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2788-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2064-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-83-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/408-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1864-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2064-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1600-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1112-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2244-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1820-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2488-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1968-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5076-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3836-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2232-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2760-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/872-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2076-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3728-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3188-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3056-1678-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3052 rffxrrx.exe 2904 rllrllf.exe 1284 nnthbh.exe 2852 7pvpj.exe 1216 dpppv.exe 748 lflrlxr.exe 3056 bbhhnn.exe 2788 pdddp.exe 2064 dpppj.exe 408 rxffffl.exe 1864 hhhhhh.exe 1600 vjjdv.exe 4020 pvvjd.exe 1112 bhttnn.exe 2244 hhtbbn.exe 1820 ppppv.exe 5044 1xllrrx.exe 2488 xrlfxxr.exe 1968 btbttt.exe 4480 9pvjd.exe 5076 pddvp.exe 3836 rlrrllf.exe 2232 vpvvv.exe 1256 lxrrxlf.exe 3964 xxffxrl.exe 2760 jpppp.exe 1344 rlxrrrr.exe 872 5rffxff.exe 2076 bthhbb.exe 3728 1dvvj.exe 3188 pddvp.exe 4552 xrxrllf.exe 1584 bbttnn.exe 2220 jvvpj.exe 4984 dvvpp.exe 3588 vvpjd.exe 3092 fxlfllr.exe 2024 hthhbh.exe 2716 nhtnnn.exe 4076 jjjdd.exe 3880 rlxrxxf.exe 4980 pjjdp.exe 2912 dvjvp.exe 4660 pdppp.exe 4404 xxllrfx.exe 1120 tbnnnn.exe 3500 1pvpv.exe 1640 5rffllr.exe 232 dpppp.exe 4796 vjdvj.exe 916 xflrlrx.exe 2852 frfxxxx.exe 1312 bhtttt.exe 3408 vjjjp.exe 4532 9pppj.exe 1404 xlllrlf.exe 3312 bntnnn.exe 736 9btnbb.exe 2964 vvvpd.exe 1260 dvdvv.exe 1984 9lrrfff.exe 3064 hbhhhh.exe 4920 tnnnhh.exe 1496 pjjpd.exe -
resource yara_rule behavioral2/memory/2288-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3052-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2852-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1284-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2904-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1216-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/748-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3056-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2788-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2064-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2064-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2064-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1864-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2064-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1600-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1112-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2244-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1820-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2488-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1968-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5076-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2232-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2760-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/872-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2076-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3728-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3188-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3056-1678-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2288 wrote to memory of 3052 2288 0bf85f34e230e5ee5c18a7ad37f42440_NeikiAnalytics.exe 82 PID 2288 wrote to memory of 3052 2288 0bf85f34e230e5ee5c18a7ad37f42440_NeikiAnalytics.exe 82 PID 2288 wrote to memory of 3052 2288 0bf85f34e230e5ee5c18a7ad37f42440_NeikiAnalytics.exe 82 PID 3052 wrote to memory of 2904 3052 rffxrrx.exe 83 PID 3052 wrote to memory of 2904 3052 rffxrrx.exe 83 PID 3052 wrote to memory of 2904 3052 rffxrrx.exe 83 PID 2904 wrote to memory of 1284 2904 rllrllf.exe 84 PID 2904 wrote to memory of 1284 2904 rllrllf.exe 84 PID 2904 wrote to memory of 1284 2904 rllrllf.exe 84 PID 1284 wrote to memory of 2852 1284 nnthbh.exe 85 PID 1284 wrote to memory of 2852 1284 nnthbh.exe 85 PID 1284 wrote to memory of 2852 1284 nnthbh.exe 85 PID 2852 wrote to memory of 1216 2852 7pvpj.exe 86 PID 2852 wrote to memory of 1216 2852 7pvpj.exe 86 PID 2852 wrote to memory of 1216 2852 7pvpj.exe 86 PID 1216 wrote to memory of 748 1216 dpppv.exe 87 PID 1216 wrote to memory of 748 1216 dpppv.exe 87 PID 1216 wrote to memory of 748 1216 dpppv.exe 87 PID 748 wrote to memory of 3056 748 lflrlxr.exe 88 PID 748 wrote to memory of 3056 748 lflrlxr.exe 88 PID 748 wrote to memory of 3056 748 lflrlxr.exe 88 PID 3056 wrote to memory of 2788 3056 bbhhnn.exe 89 PID 3056 wrote to memory of 2788 3056 bbhhnn.exe 89 PID 3056 wrote to memory of 2788 3056 bbhhnn.exe 89 PID 2788 wrote to memory of 2064 2788 pdddp.exe 90 PID 2788 wrote to memory of 2064 2788 pdddp.exe 90 PID 2788 wrote to memory of 2064 2788 pdddp.exe 90 PID 2064 wrote to memory of 408 2064 dpppj.exe 91 PID 2064 wrote to memory of 408 2064 dpppj.exe 91 PID 2064 wrote to memory of 408 2064 dpppj.exe 91 PID 408 wrote to memory of 1864 408 rxffffl.exe 92 PID 408 wrote to memory of 1864 408 rxffffl.exe 92 PID 408 wrote to memory of 1864 408 rxffffl.exe 92 PID 1864 wrote to memory of 1600 1864 hhhhhh.exe 93 PID 1864 wrote to memory of 1600 1864 hhhhhh.exe 93 PID 1864 wrote to memory of 1600 1864 hhhhhh.exe 93 PID 1600 wrote to memory of 4020 1600 vjjdv.exe 94 PID 1600 wrote to memory of 4020 1600 vjjdv.exe 94 PID 1600 wrote to memory of 4020 1600 vjjdv.exe 94 PID 4020 wrote to memory of 1112 4020 pvvjd.exe 95 PID 4020 wrote to memory of 1112 4020 pvvjd.exe 95 PID 4020 wrote to memory of 1112 4020 pvvjd.exe 95 PID 1112 wrote to memory of 2244 1112 bhttnn.exe 96 PID 1112 wrote to memory of 2244 1112 bhttnn.exe 96 PID 1112 wrote to memory of 2244 1112 bhttnn.exe 96 PID 2244 wrote to memory of 1820 2244 hhtbbn.exe 97 PID 2244 wrote to memory of 1820 2244 hhtbbn.exe 97 PID 2244 wrote to memory of 1820 2244 hhtbbn.exe 97 PID 1820 wrote to memory of 5044 1820 ppppv.exe 98 PID 1820 wrote to memory of 5044 1820 ppppv.exe 98 PID 1820 wrote to memory of 5044 1820 ppppv.exe 98 PID 5044 wrote to memory of 2488 5044 1xllrrx.exe 99 PID 5044 wrote to memory of 2488 5044 1xllrrx.exe 99 PID 5044 wrote to memory of 2488 5044 1xllrrx.exe 99 PID 2488 wrote to memory of 1968 2488 xrlfxxr.exe 100 PID 2488 wrote to memory of 1968 2488 xrlfxxr.exe 100 PID 2488 wrote to memory of 1968 2488 xrlfxxr.exe 100 PID 1968 wrote to memory of 4480 1968 btbttt.exe 101 PID 1968 wrote to memory of 4480 1968 btbttt.exe 101 PID 1968 wrote to memory of 4480 1968 btbttt.exe 101 PID 4480 wrote to memory of 5076 4480 9pvjd.exe 102 PID 4480 wrote to memory of 5076 4480 9pvjd.exe 102 PID 4480 wrote to memory of 5076 4480 9pvjd.exe 102 PID 5076 wrote to memory of 3836 5076 pddvp.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bf85f34e230e5ee5c18a7ad37f42440_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0bf85f34e230e5ee5c18a7ad37f42440_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\rffxrrx.exec:\rffxrrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\rllrllf.exec:\rllrllf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\nnthbh.exec:\nnthbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\7pvpj.exec:\7pvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\dpppv.exec:\dpppv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\lflrlxr.exec:\lflrlxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\bbhhnn.exec:\bbhhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\pdddp.exec:\pdddp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\dpppj.exec:\dpppj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\rxffffl.exec:\rxffffl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\hhhhhh.exec:\hhhhhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\vjjdv.exec:\vjjdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\pvvjd.exec:\pvvjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\bhttnn.exec:\bhttnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\hhtbbn.exec:\hhtbbn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\ppppv.exec:\ppppv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\1xllrrx.exec:\1xllrrx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\xrlfxxr.exec:\xrlfxxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\btbttt.exec:\btbttt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\9pvjd.exec:\9pvjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\pddvp.exec:\pddvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\rlrrllf.exec:\rlrrllf.exe23⤵
- Executes dropped EXE
PID:3836 -
\??\c:\vpvvv.exec:\vpvvv.exe24⤵
- Executes dropped EXE
PID:2232 -
\??\c:\lxrrxlf.exec:\lxrrxlf.exe25⤵
- Executes dropped EXE
PID:1256 -
\??\c:\xxffxrl.exec:\xxffxrl.exe26⤵
- Executes dropped EXE
PID:3964 -
\??\c:\jpppp.exec:\jpppp.exe27⤵
- Executes dropped EXE
PID:2760 -
\??\c:\rlxrrrr.exec:\rlxrrrr.exe28⤵
- Executes dropped EXE
PID:1344 -
\??\c:\5rffxff.exec:\5rffxff.exe29⤵
- Executes dropped EXE
PID:872 -
\??\c:\bthhbb.exec:\bthhbb.exe30⤵
- Executes dropped EXE
PID:2076 -
\??\c:\1dvvj.exec:\1dvvj.exe31⤵
- Executes dropped EXE
PID:3728 -
\??\c:\pddvp.exec:\pddvp.exe32⤵
- Executes dropped EXE
PID:3188 -
\??\c:\xrxrllf.exec:\xrxrllf.exe33⤵
- Executes dropped EXE
PID:4552 -
\??\c:\bbttnn.exec:\bbttnn.exe34⤵
- Executes dropped EXE
PID:1584 -
\??\c:\jvvpj.exec:\jvvpj.exe35⤵
- Executes dropped EXE
PID:2220 -
\??\c:\dvvpp.exec:\dvvpp.exe36⤵
- Executes dropped EXE
PID:4984 -
\??\c:\vvpjd.exec:\vvpjd.exe37⤵
- Executes dropped EXE
PID:3588 -
\??\c:\fxlfllr.exec:\fxlfllr.exe38⤵
- Executes dropped EXE
PID:3092 -
\??\c:\hthhbh.exec:\hthhbh.exe39⤵
- Executes dropped EXE
PID:2024 -
\??\c:\nhtnnn.exec:\nhtnnn.exe40⤵
- Executes dropped EXE
PID:2716 -
\??\c:\jjjdd.exec:\jjjdd.exe41⤵
- Executes dropped EXE
PID:4076 -
\??\c:\rlxrxxf.exec:\rlxrxxf.exe42⤵
- Executes dropped EXE
PID:3880 -
\??\c:\pjjdp.exec:\pjjdp.exe43⤵
- Executes dropped EXE
PID:4980 -
\??\c:\dvjvp.exec:\dvjvp.exe44⤵
- Executes dropped EXE
PID:2912 -
\??\c:\pdppp.exec:\pdppp.exe45⤵
- Executes dropped EXE
PID:4660 -
\??\c:\xxllrfx.exec:\xxllrfx.exe46⤵
- Executes dropped EXE
PID:4404 -
\??\c:\tbnnnn.exec:\tbnnnn.exe47⤵
- Executes dropped EXE
PID:1120 -
\??\c:\1pvpv.exec:\1pvpv.exe48⤵
- Executes dropped EXE
PID:3500 -
\??\c:\5rffllr.exec:\5rffllr.exe49⤵
- Executes dropped EXE
PID:1640 -
\??\c:\dpppp.exec:\dpppp.exe50⤵
- Executes dropped EXE
PID:232 -
\??\c:\vjdvj.exec:\vjdvj.exe51⤵
- Executes dropped EXE
PID:4796 -
\??\c:\xflrlrx.exec:\xflrlrx.exe52⤵
- Executes dropped EXE
PID:916 -
\??\c:\frfxxxx.exec:\frfxxxx.exe53⤵
- Executes dropped EXE
PID:2852 -
\??\c:\bhtttt.exec:\bhtttt.exe54⤵
- Executes dropped EXE
PID:1312 -
\??\c:\vjjjp.exec:\vjjjp.exe55⤵
- Executes dropped EXE
PID:3408 -
\??\c:\9pppj.exec:\9pppj.exe56⤵
- Executes dropped EXE
PID:4532 -
\??\c:\xlllrlf.exec:\xlllrlf.exe57⤵
- Executes dropped EXE
PID:1404 -
\??\c:\bntnnn.exec:\bntnnn.exe58⤵
- Executes dropped EXE
PID:3312 -
\??\c:\9btnbb.exec:\9btnbb.exe59⤵
- Executes dropped EXE
PID:736 -
\??\c:\vvvpd.exec:\vvvpd.exe60⤵
- Executes dropped EXE
PID:2964 -
\??\c:\dvdvv.exec:\dvdvv.exe61⤵
- Executes dropped EXE
PID:1260 -
\??\c:\9lrrfff.exec:\9lrrfff.exe62⤵
- Executes dropped EXE
PID:1984 -
\??\c:\hbhhhh.exec:\hbhhhh.exe63⤵
- Executes dropped EXE
PID:3064 -
\??\c:\tnnnhh.exec:\tnnnhh.exe64⤵
- Executes dropped EXE
PID:4920 -
\??\c:\pjjpd.exec:\pjjpd.exe65⤵
- Executes dropped EXE
PID:1496 -
\??\c:\dpvpd.exec:\dpvpd.exe66⤵PID:1060
-
\??\c:\lxrrflf.exec:\lxrrflf.exe67⤵PID:2216
-
\??\c:\rlllxxr.exec:\rlllxxr.exe68⤵PID:4168
-
\??\c:\tntttt.exec:\tntttt.exe69⤵PID:3716
-
\??\c:\bbhbbt.exec:\bbhbbt.exe70⤵PID:3508
-
\??\c:\ddddd.exec:\ddddd.exe71⤵PID:2992
-
\??\c:\vjdjv.exec:\vjdjv.exe72⤵PID:4164
-
\??\c:\xlrfxxl.exec:\xlrfxxl.exe73⤵PID:3896
-
\??\c:\fxrllfx.exec:\fxrllfx.exe74⤵PID:4988
-
\??\c:\tntbtt.exec:\tntbtt.exe75⤵PID:4608
-
\??\c:\fxffxxr.exec:\fxffxxr.exe76⤵PID:1940
-
\??\c:\bhnttt.exec:\bhnttt.exe77⤵PID:5076
-
\??\c:\nbnbnh.exec:\nbnbnh.exe78⤵PID:376
-
\??\c:\djjpj.exec:\djjpj.exe79⤵PID:3920
-
\??\c:\ddjdd.exec:\ddjdd.exe80⤵PID:4728
-
\??\c:\rrlfrrr.exec:\rrlfrrr.exe81⤵PID:2696
-
\??\c:\htttnn.exec:\htttnn.exe82⤵PID:3964
-
\??\c:\nnnnhh.exec:\nnnnhh.exe83⤵PID:2940
-
\??\c:\ddppp.exec:\ddppp.exe84⤵PID:3940
-
\??\c:\vppjj.exec:\vppjj.exe85⤵PID:4452
-
\??\c:\xrlfxrr.exec:\xrlfxrr.exe86⤵PID:2076
-
\??\c:\nhtntn.exec:\nhtntn.exe87⤵PID:5084
-
\??\c:\hhntnt.exec:\hhntnt.exe88⤵PID:3684
-
\??\c:\3pdvv.exec:\3pdvv.exe89⤵PID:4084
-
\??\c:\fxxrlfr.exec:\fxxrlfr.exe90⤵PID:4552
-
\??\c:\xxrrrlf.exec:\xxrrrlf.exe91⤵PID:1972
-
\??\c:\ttbbbb.exec:\ttbbbb.exe92⤵PID:2432
-
\??\c:\ttttnb.exec:\ttttnb.exe93⤵PID:4984
-
\??\c:\ppjvj.exec:\ppjvj.exe94⤵PID:4428
-
\??\c:\jddvp.exec:\jddvp.exe95⤵PID:3424
-
\??\c:\flrrlll.exec:\flrrlll.exe96⤵PID:4952
-
\??\c:\xlrrrrr.exec:\xlrrrrr.exe97⤵PID:5100
-
\??\c:\9tthhh.exec:\9tthhh.exe98⤵PID:2272
-
\??\c:\hhbbbh.exec:\hhbbbh.exe99⤵PID:512
-
\??\c:\7jjdp.exec:\7jjdp.exe100⤵PID:4900
-
\??\c:\rlllflf.exec:\rlllflf.exe101⤵PID:4576
-
\??\c:\rlffrfl.exec:\rlffrfl.exe102⤵PID:2804
-
\??\c:\5bnhbb.exec:\5bnhbb.exe103⤵PID:4404
-
\??\c:\vjjjj.exec:\vjjjj.exe104⤵PID:1120
-
\??\c:\5jpvv.exec:\5jpvv.exe105⤵PID:3052
-
\??\c:\xxxxlrr.exec:\xxxxlrr.exe106⤵PID:1640
-
\??\c:\fxrxrrx.exec:\fxrxrrx.exe107⤵PID:3604
-
\??\c:\hhhbbt.exec:\hhhbbt.exe108⤵PID:656
-
\??\c:\pppjj.exec:\pppjj.exe109⤵PID:1008
-
\??\c:\ppvpv.exec:\ppvpv.exe110⤵PID:3028
-
\??\c:\xxlfffr.exec:\xxlfffr.exe111⤵PID:1328
-
\??\c:\xfffxrr.exec:\xfffxrr.exe112⤵PID:1812
-
\??\c:\nhhhbb.exec:\nhhhbb.exe113⤵PID:5040
-
\??\c:\nhhbtt.exec:\nhhbtt.exe114⤵PID:1792
-
\??\c:\dvvpj.exec:\dvvpj.exe115⤵PID:3668
-
\??\c:\rffxrrl.exec:\rffxrrl.exe116⤵PID:2360
-
\??\c:\5rxrllf.exec:\5rxrllf.exe117⤵PID:2964
-
\??\c:\nhbbtb.exec:\nhbbtb.exe118⤵PID:1876
-
\??\c:\nbhbbb.exec:\nbhbbb.exe119⤵PID:1788
-
\??\c:\vdjdv.exec:\vdjdv.exe120⤵PID:3048
-
\??\c:\1jjdv.exec:\1jjdv.exe121⤵PID:3296
-
\??\c:\rlxrrrx.exec:\rlxrrrx.exe122⤵PID:1496
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-