Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/05/2024, 20:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
190a1474af89729a306e773f782feb00_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
190a1474af89729a306e773f782feb00_NeikiAnalytics.exe
-
Size
655KB
-
MD5
190a1474af89729a306e773f782feb00
-
SHA1
1a82d81c38809ada2ea36862fd503084d1494c68
-
SHA256
398c30e69449cd9ce77be84dddf3842977789d0eb06a41c4e4258f992be54bf9
-
SHA512
fbb12b630f35ba37eb70be66107df02b8aae0149e96719173fc1bc8711af00ce64ebf73df0c8108b19861c6732be5ed6060811025c202a9a6881bd7afd0533fb
-
SSDEEP
12288:n3C9yMo+S0L9xRnoq7H9xqYL5oeEF5rna9sUxg7udOxPJVSjYg8lcmJ1MZxEkTsU:SgD4bhoqLDqYLS7wv
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/4992-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/792-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1016-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4356-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3716-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3716-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2148-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3228-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4732-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4960-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3736-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1216-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3296-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/864-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3676-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3108-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3680-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4644-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3216-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4484 frrrxxx.exe 792 hntbhb.exe 1016 dpdvp.exe 4356 fllrlrr.exe 3716 ththbh.exe 2012 pvjdd.exe 3692 vdpjj.exe 2148 bhhbtb.exe 3228 lflfxxr.exe 4732 3dpjd.exe 4524 xxrlffx.exe 4960 bbhhhn.exe 3736 jdvvp.exe 1216 rlxlrll.exe 5116 pvvvp.exe 3296 lxxxxxx.exe 4416 tnnhhn.exe 864 pvvvp.exe 1036 dvvvp.exe 3676 bthhhh.exe 5056 1flllff.exe 3108 bbtthh.exe 3216 5jppj.exe 3680 lfxxfff.exe 3700 htbtbb.exe 2360 3dvpj.exe 5080 tnhbtt.exe 2224 jpppv.exe 4644 lrxlllf.exe 2008 hthhnh.exe 4736 9xxxrrr.exe 4832 ntnhbb.exe 4868 7pjjp.exe 1424 3ntnhh.exe 4332 7jjjj.exe 380 vvvpj.exe 3212 lrllxxr.exe 4484 3bhhtt.exe 792 xrffllr.exe 1016 hbbthb.exe 644 jjvjj.exe 4004 vjjpj.exe 1512 7llfxrx.exe 1664 hthtnh.exe 1304 pvjdd.exe 4704 xxfxllf.exe 1580 5ttnhb.exe 2488 ppvpv.exe 4980 xrxxfff.exe 4540 thnhhh.exe 2772 jdjjj.exe 2740 lxrxxxx.exe 3152 nnntnn.exe 4624 xlrrlxl.exe 4404 rrxxrfx.exe 4716 5jdvd.exe 2424 rrxrrlf.exe 4360 1tnnbb.exe 5032 ddppp.exe 1528 fxrlllx.exe 1960 ttbbtb.exe 5072 7pjdv.exe 1036 jddvp.exe 3612 hhbbtt.exe -
resource yara_rule behavioral2/memory/4992-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/792-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3228-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3228-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3228-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3228-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4524-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4960-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3736-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1216-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3296-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/864-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3676-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3108-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3680-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4644-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3216-157-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4992 wrote to memory of 4484 4992 190a1474af89729a306e773f782feb00_NeikiAnalytics.exe 83 PID 4992 wrote to memory of 4484 4992 190a1474af89729a306e773f782feb00_NeikiAnalytics.exe 83 PID 4992 wrote to memory of 4484 4992 190a1474af89729a306e773f782feb00_NeikiAnalytics.exe 83 PID 4484 wrote to memory of 792 4484 frrrxxx.exe 84 PID 4484 wrote to memory of 792 4484 frrrxxx.exe 84 PID 4484 wrote to memory of 792 4484 frrrxxx.exe 84 PID 792 wrote to memory of 1016 792 hntbhb.exe 85 PID 792 wrote to memory of 1016 792 hntbhb.exe 85 PID 792 wrote to memory of 1016 792 hntbhb.exe 85 PID 1016 wrote to memory of 4356 1016 dpdvp.exe 86 PID 1016 wrote to memory of 4356 1016 dpdvp.exe 86 PID 1016 wrote to memory of 4356 1016 dpdvp.exe 86 PID 4356 wrote to memory of 3716 4356 fllrlrr.exe 87 PID 4356 wrote to memory of 3716 4356 fllrlrr.exe 87 PID 4356 wrote to memory of 3716 4356 fllrlrr.exe 87 PID 3716 wrote to memory of 2012 3716 ththbh.exe 88 PID 3716 wrote to memory of 2012 3716 ththbh.exe 88 PID 3716 wrote to memory of 2012 3716 ththbh.exe 88 PID 2012 wrote to memory of 3692 2012 pvjdd.exe 89 PID 2012 wrote to memory of 3692 2012 pvjdd.exe 89 PID 2012 wrote to memory of 3692 2012 pvjdd.exe 89 PID 3692 wrote to memory of 2148 3692 vdpjj.exe 90 PID 3692 wrote to memory of 2148 3692 vdpjj.exe 90 PID 3692 wrote to memory of 2148 3692 vdpjj.exe 90 PID 2148 wrote to memory of 3228 2148 bhhbtb.exe 91 PID 2148 wrote to memory of 3228 2148 bhhbtb.exe 91 PID 2148 wrote to memory of 3228 2148 bhhbtb.exe 91 PID 3228 wrote to memory of 4732 3228 lflfxxr.exe 93 PID 3228 wrote to memory of 4732 3228 lflfxxr.exe 93 PID 3228 wrote to memory of 4732 3228 lflfxxr.exe 93 PID 4732 wrote to memory of 4524 4732 3dpjd.exe 94 PID 4732 wrote to memory of 4524 4732 3dpjd.exe 94 PID 4732 wrote to memory of 4524 4732 3dpjd.exe 94 PID 4524 wrote to memory of 4960 4524 xxrlffx.exe 95 PID 4524 wrote to memory of 4960 4524 xxrlffx.exe 95 PID 4524 wrote to memory of 4960 4524 xxrlffx.exe 95 PID 4960 wrote to memory of 3736 4960 bbhhhn.exe 97 PID 4960 wrote to memory of 3736 4960 bbhhhn.exe 97 PID 4960 wrote to memory of 3736 4960 bbhhhn.exe 97 PID 3736 wrote to memory of 1216 3736 jdvvp.exe 98 PID 3736 wrote to memory of 1216 3736 jdvvp.exe 98 PID 3736 wrote to memory of 1216 3736 jdvvp.exe 98 PID 1216 wrote to memory of 5116 1216 rlxlrll.exe 100 PID 1216 wrote to memory of 5116 1216 rlxlrll.exe 100 PID 1216 wrote to memory of 5116 1216 rlxlrll.exe 100 PID 5116 wrote to memory of 3296 5116 pvvvp.exe 101 PID 5116 wrote to memory of 3296 5116 pvvvp.exe 101 PID 5116 wrote to memory of 3296 5116 pvvvp.exe 101 PID 3296 wrote to memory of 4416 3296 lxxxxxx.exe 102 PID 3296 wrote to memory of 4416 3296 lxxxxxx.exe 102 PID 3296 wrote to memory of 4416 3296 lxxxxxx.exe 102 PID 4416 wrote to memory of 864 4416 tnnhhn.exe 103 PID 4416 wrote to memory of 864 4416 tnnhhn.exe 103 PID 4416 wrote to memory of 864 4416 tnnhhn.exe 103 PID 864 wrote to memory of 1036 864 pvvvp.exe 104 PID 864 wrote to memory of 1036 864 pvvvp.exe 104 PID 864 wrote to memory of 1036 864 pvvvp.exe 104 PID 1036 wrote to memory of 3676 1036 dvvvp.exe 105 PID 1036 wrote to memory of 3676 1036 dvvvp.exe 105 PID 1036 wrote to memory of 3676 1036 dvvvp.exe 105 PID 3676 wrote to memory of 5056 3676 bthhhh.exe 106 PID 3676 wrote to memory of 5056 3676 bthhhh.exe 106 PID 3676 wrote to memory of 5056 3676 bthhhh.exe 106 PID 5056 wrote to memory of 3108 5056 1flllff.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\190a1474af89729a306e773f782feb00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\190a1474af89729a306e773f782feb00_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\frrrxxx.exec:\frrrxxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\hntbhb.exec:\hntbhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\dpdvp.exec:\dpdvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\fllrlrr.exec:\fllrlrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\ththbh.exec:\ththbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\pvjdd.exec:\pvjdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\vdpjj.exec:\vdpjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\bhhbtb.exec:\bhhbtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\lflfxxr.exec:\lflfxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\3dpjd.exec:\3dpjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\xxrlffx.exec:\xxrlffx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\bbhhhn.exec:\bbhhhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\jdvvp.exec:\jdvvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
\??\c:\rlxlrll.exec:\rlxlrll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\pvvvp.exec:\pvvvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\lxxxxxx.exec:\lxxxxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
\??\c:\tnnhhn.exec:\tnnhhn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\pvvvp.exec:\pvvvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\dvvvp.exec:\dvvvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\bthhhh.exec:\bthhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\1flllff.exec:\1flllff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\bbtthh.exec:\bbtthh.exe23⤵
- Executes dropped EXE
PID:3108 -
\??\c:\5jppj.exec:\5jppj.exe24⤵
- Executes dropped EXE
PID:3216 -
\??\c:\lfxxfff.exec:\lfxxfff.exe25⤵
- Executes dropped EXE
PID:3680 -
\??\c:\htbtbb.exec:\htbtbb.exe26⤵
- Executes dropped EXE
PID:3700 -
\??\c:\3dvpj.exec:\3dvpj.exe27⤵
- Executes dropped EXE
PID:2360 -
\??\c:\tnhbtt.exec:\tnhbtt.exe28⤵
- Executes dropped EXE
PID:5080 -
\??\c:\jpppv.exec:\jpppv.exe29⤵
- Executes dropped EXE
PID:2224 -
\??\c:\lrxlllf.exec:\lrxlllf.exe30⤵
- Executes dropped EXE
PID:4644 -
\??\c:\hthhnh.exec:\hthhnh.exe31⤵
- Executes dropped EXE
PID:2008 -
\??\c:\9xxxrrr.exec:\9xxxrrr.exe32⤵
- Executes dropped EXE
PID:4736 -
\??\c:\ntnhbb.exec:\ntnhbb.exe33⤵
- Executes dropped EXE
PID:4832 -
\??\c:\7pjjp.exec:\7pjjp.exe34⤵
- Executes dropped EXE
PID:4868 -
\??\c:\3ntnhh.exec:\3ntnhh.exe35⤵
- Executes dropped EXE
PID:1424 -
\??\c:\7jjjj.exec:\7jjjj.exe36⤵
- Executes dropped EXE
PID:4332 -
\??\c:\vvvpj.exec:\vvvpj.exe37⤵
- Executes dropped EXE
PID:380 -
\??\c:\lrllxxr.exec:\lrllxxr.exe38⤵
- Executes dropped EXE
PID:3212 -
\??\c:\3bhhtt.exec:\3bhhtt.exe39⤵
- Executes dropped EXE
PID:4484 -
\??\c:\xrffllr.exec:\xrffllr.exe40⤵
- Executes dropped EXE
PID:792 -
\??\c:\hbbthb.exec:\hbbthb.exe41⤵
- Executes dropped EXE
PID:1016 -
\??\c:\jjvjj.exec:\jjvjj.exe42⤵
- Executes dropped EXE
PID:644 -
\??\c:\vjjpj.exec:\vjjpj.exe43⤵
- Executes dropped EXE
PID:4004 -
\??\c:\7llfxrx.exec:\7llfxrx.exe44⤵
- Executes dropped EXE
PID:1512 -
\??\c:\hthtnh.exec:\hthtnh.exe45⤵
- Executes dropped EXE
PID:1664 -
\??\c:\pvjdd.exec:\pvjdd.exe46⤵
- Executes dropped EXE
PID:1304 -
\??\c:\xxfxllf.exec:\xxfxllf.exe47⤵
- Executes dropped EXE
PID:4704 -
\??\c:\5ttnhb.exec:\5ttnhb.exe48⤵
- Executes dropped EXE
PID:1580 -
\??\c:\ppvpv.exec:\ppvpv.exe49⤵
- Executes dropped EXE
PID:2488 -
\??\c:\xrxxfff.exec:\xrxxfff.exe50⤵
- Executes dropped EXE
PID:4980 -
\??\c:\thnhhh.exec:\thnhhh.exe51⤵
- Executes dropped EXE
PID:4540 -
\??\c:\jdjjj.exec:\jdjjj.exe52⤵
- Executes dropped EXE
PID:2772 -
\??\c:\lxrxxxx.exec:\lxrxxxx.exe53⤵
- Executes dropped EXE
PID:2740 -
\??\c:\nnntnn.exec:\nnntnn.exe54⤵
- Executes dropped EXE
PID:3152 -
\??\c:\xlrrlxl.exec:\xlrrlxl.exe55⤵
- Executes dropped EXE
PID:4624 -
\??\c:\rrxxrfx.exec:\rrxxrfx.exe56⤵
- Executes dropped EXE
PID:4404 -
\??\c:\5jdvd.exec:\5jdvd.exe57⤵
- Executes dropped EXE
PID:4716 -
\??\c:\rrxrrlf.exec:\rrxrrlf.exe58⤵
- Executes dropped EXE
PID:2424 -
\??\c:\1tnnbb.exec:\1tnnbb.exe59⤵
- Executes dropped EXE
PID:4360 -
\??\c:\ddppp.exec:\ddppp.exe60⤵
- Executes dropped EXE
PID:5032 -
\??\c:\fxrlllx.exec:\fxrlllx.exe61⤵
- Executes dropped EXE
PID:1528 -
\??\c:\ttbbtb.exec:\ttbbtb.exe62⤵
- Executes dropped EXE
PID:1960 -
\??\c:\7pjdv.exec:\7pjdv.exe63⤵
- Executes dropped EXE
PID:5072 -
\??\c:\jddvp.exec:\jddvp.exe64⤵
- Executes dropped EXE
PID:1036 -
\??\c:\hhbbtt.exec:\hhbbtt.exe65⤵
- Executes dropped EXE
PID:3612 -
\??\c:\jdddj.exec:\jdddj.exe66⤵PID:2576
-
\??\c:\9pjvp.exec:\9pjvp.exe67⤵PID:1968
-
\??\c:\lflfllr.exec:\lflfllr.exe68⤵PID:2896
-
\??\c:\hhnhbh.exec:\hhnhbh.exe69⤵PID:1724
-
\??\c:\dpvjv.exec:\dpvjv.exe70⤵PID:4244
-
\??\c:\5rlfxxf.exec:\5rlfxxf.exe71⤵PID:4288
-
\??\c:\hthbnt.exec:\hthbnt.exe72⤵PID:1812
-
\??\c:\ppdvv.exec:\ppdvv.exe73⤵PID:3556
-
\??\c:\9lrrlrr.exec:\9lrrlrr.exe74⤵PID:4572
-
\??\c:\nbnnhh.exec:\nbnnhh.exe75⤵PID:3260
-
\??\c:\pdpjp.exec:\pdpjp.exe76⤵PID:4596
-
\??\c:\ppvpp.exec:\ppvpp.exe77⤵PID:2052
-
\??\c:\ffxrllf.exec:\ffxrllf.exe78⤵PID:2024
-
\??\c:\hhttnn.exec:\hhttnn.exe79⤵PID:1180
-
\??\c:\jdvvv.exec:\jdvvv.exe80⤵PID:924
-
\??\c:\lxrllrx.exec:\lxrllrx.exe81⤵PID:4044
-
\??\c:\rrrlflf.exec:\rrrlflf.exe82⤵PID:4320
-
\??\c:\thtntt.exec:\thtntt.exe83⤵PID:1020
-
\??\c:\pjvvp.exec:\pjvvp.exe84⤵PID:4592
-
\??\c:\fxxlxfx.exec:\fxxlxfx.exe85⤵PID:3212
-
\??\c:\pvvpv.exec:\pvvpv.exe86⤵PID:1992
-
\??\c:\rfrrrrx.exec:\rfrrrrx.exe87⤵PID:1536
-
\??\c:\xrrlffx.exec:\xrrlffx.exe88⤵PID:1532
-
\??\c:\bbbbtn.exec:\bbbbtn.exe89⤵PID:412
-
\??\c:\pdvvv.exec:\pdvvv.exe90⤵PID:1840
-
\??\c:\xfxrfxr.exec:\xfxrfxr.exe91⤵PID:3788
-
\??\c:\3pvpp.exec:\3pvpp.exe92⤵PID:2544
-
\??\c:\xflfrrl.exec:\xflfrrl.exe93⤵PID:4056
-
\??\c:\fffllrr.exec:\fffllrr.exe94⤵PID:4276
-
\??\c:\bntnnt.exec:\bntnnt.exe95⤵PID:392
-
\??\c:\djdjd.exec:\djdjd.exe96⤵PID:2180
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe97⤵PID:4972
-
\??\c:\hnbhnt.exec:\hnbhnt.exe98⤵PID:856
-
\??\c:\vjppj.exec:\vjppj.exe99⤵PID:4020
-
\??\c:\5rxrrxx.exec:\5rxrrxx.exe100⤵PID:384
-
\??\c:\xfllfff.exec:\xfllfff.exe101⤵PID:1608
-
\??\c:\bttnhh.exec:\bttnhh.exe102⤵PID:4932
-
\??\c:\flrlfxr.exec:\flrlfxr.exe103⤵PID:1388
-
\??\c:\rxflflf.exec:\rxflflf.exe104⤵PID:1916
-
\??\c:\bthbhh.exec:\bthbhh.exe105⤵PID:3296
-
\??\c:\dvdvp.exec:\dvdvp.exe106⤵PID:1060
-
\??\c:\xxrrllf.exec:\xxrrllf.exe107⤵PID:4416
-
\??\c:\1bnhhh.exec:\1bnhhh.exe108⤵PID:4908
-
\??\c:\5jppp.exec:\5jppp.exe109⤵PID:5084
-
\??\c:\frrlllf.exec:\frrlllf.exe110⤵PID:4604
-
\??\c:\nttnnn.exec:\nttnnn.exe111⤵PID:3096
-
\??\c:\dvdvp.exec:\dvdvp.exe112⤵PID:1808
-
\??\c:\pjpvp.exec:\pjpvp.exe113⤵PID:2500
-
\??\c:\lfffllr.exec:\lfffllr.exe114⤵PID:4252
-
\??\c:\hhhhbb.exec:\hhhhbb.exe115⤵PID:4076
-
\??\c:\vpjjj.exec:\vpjjj.exe116⤵PID:3092
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe117⤵PID:2920
-
\??\c:\bbhhhh.exec:\bbhhhh.exe118⤵PID:4392
-
\??\c:\bbhbtt.exec:\bbhbtt.exe119⤵PID:5024
-
\??\c:\jdjdd.exec:\jdjdd.exe120⤵PID:2000
-
\??\c:\7rrlffx.exec:\7rrlffx.exe121⤵PID:2008
-
\??\c:\bhnbbh.exec:\bhnbbh.exe122⤵PID:3408
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-