Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
29/05/2024, 22:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5860033045ff7560883a8e1980fa5160_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
- Target 5860033045ff7560883a8e1980fa5160_NeikiAnalytics.exe
- Size 59KB
- Sample240529-2fgebsdb73
- SHA256 69d0655a555d22b411d417392808db5848667a0bf98873a389dc4235b1c28443
- MD5 5860033045ff7560883a8e1980fa5160
- SHA1 cc81e4dd7fb7b62f9f0eee02b03678bfd6a72341
- SHA512 51ace71535ffbee7821c558d9fad33c92df13ae8b85700dcf40d2a9d328639da519178f1cf93911c1f4c7276f0b41b7b72305620180d541e79c63fee7a39bbcd
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9Lu:ymb3NkkiQ3mdBjFI9C
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/2796-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3592-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2340-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1148-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3980-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3388-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1320-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1300-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1676-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3416-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1700-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1912-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4812-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2816-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2768-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1692-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2328-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 3592 7jjjd.exe 2340 flllxff.exe 1148 tntttn.exe 3980 1dppj.exe 3388 9hbttb.exe 1320 jvdvj.exe 1676 3rlfxxx.exe 1300 nhnbhb.exe 3416 hbnthh.exe 2012 3dpjp.exe 4532 xrrlffl.exe 4916 tthbbb.exe 1700 dvvvv.exe 2932 jdpdp.exe 1912 frfxfxx.exe 4572 ntbhbt.exe 4812 9vpjj.exe 2816 1rxrffx.exe 2768 fffxxxx.exe 632 7nhhtt.exe 1172 1jjpj.exe 4560 fllfxxr.exe 1692 xlrllfx.exe 4704 tnbtnh.exe 408 bbbbnn.exe 2328 ddvpj.exe 4444 xrxrllf.exe 3804 fxxfxxx.exe 336 nhhthb.exe 1840 jjjpv.exe 4508 vvdpp.exe 2632 llfxxxx.exe 3504 rxfrllf.exe 1980 hnttbh.exe 2904 dpjjd.exe 4604 jvddj.exe 1808 rlxxllr.exe 624 fxrlrrx.exe 4828 ntbbtt.exe 2924 tbtntt.exe 1420 dddvj.exe 2268 5rxrllf.exe 4296 5tnhbb.exe 3672 5vddv.exe 3080 3flfxlr.exe 4568 xfrfxrf.exe 856 nbhhhh.exe 208 ddjjv.exe 4092 jpvvj.exe 1320 rxxxrfx.exe 3544 9xxrlll.exe 2560 tnnnnt.exe 5032 dvjjj.exe 3088 vvppd.exe 2032 rllfxxx.exe 3384 7hnntt.exe 2236 hthnhn.exe 4848 1djpj.exe 4916 1flfxxr.exe 4396 xrxxxxx.exe 2848 pjjjp.exe 4152 ffrlffx.exe 3964 lrrlffx.exe 3376 hhttnn.exe -
resource yara_rule behavioral2/memory/2796-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3592-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2340-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1148-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3980-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1320-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1300-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1676-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3416-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4532-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1700-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1912-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4812-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1692-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-178-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2796 wrote to memory of 3592 2796 5860033045ff7560883a8e1980fa5160_NeikiAnalytics.exe 82 PID 2796 wrote to memory of 3592 2796 5860033045ff7560883a8e1980fa5160_NeikiAnalytics.exe 82 PID 2796 wrote to memory of 3592 2796 5860033045ff7560883a8e1980fa5160_NeikiAnalytics.exe 82 PID 3592 wrote to memory of 2340 3592 7jjjd.exe 83 PID 3592 wrote to memory of 2340 3592 7jjjd.exe 83 PID 3592 wrote to memory of 2340 3592 7jjjd.exe 83 PID 2340 wrote to memory of 1148 2340 flllxff.exe 84 PID 2340 wrote to memory of 1148 2340 flllxff.exe 84 PID 2340 wrote to memory of 1148 2340 flllxff.exe 84 PID 1148 wrote to memory of 3980 1148 tntttn.exe 85 PID 1148 wrote to memory of 3980 1148 tntttn.exe 85 PID 1148 wrote to memory of 3980 1148 tntttn.exe 85 PID 3980 wrote to memory of 3388 3980 1dppj.exe 86 PID 3980 wrote to memory of 3388 3980 1dppj.exe 86 PID 3980 wrote to memory of 3388 3980 1dppj.exe 86 PID 3388 wrote to memory of 1320 3388 9hbttb.exe 87 PID 3388 wrote to memory of 1320 3388 9hbttb.exe 87 PID 3388 wrote to memory of 1320 3388 9hbttb.exe 87 PID 1320 wrote to memory of 1676 1320 jvdvj.exe 88 PID 1320 wrote to memory of 1676 1320 jvdvj.exe 88 PID 1320 wrote to memory of 1676 1320 jvdvj.exe 88 PID 1676 wrote to memory of 1300 1676 3rlfxxx.exe 89 PID 1676 wrote to memory of 1300 1676 3rlfxxx.exe 89 PID 1676 wrote to memory of 1300 1676 3rlfxxx.exe 89 PID 1300 wrote to memory of 3416 1300 nhnbhb.exe 90 PID 1300 wrote to memory of 3416 1300 nhnbhb.exe 90 PID 1300 wrote to memory of 3416 1300 nhnbhb.exe 90 PID 3416 wrote to memory of 2012 3416 hbnthh.exe 91 PID 3416 wrote to memory of 2012 3416 hbnthh.exe 91 PID 3416 wrote to memory of 2012 3416 hbnthh.exe 91 PID 2012 wrote to memory of 4532 2012 3dpjp.exe 92 PID 2012 wrote to memory of 4532 2012 3dpjp.exe 92 PID 2012 wrote to memory of 4532 2012 3dpjp.exe 92 PID 4532 wrote to memory of 4916 4532 xrrlffl.exe 93 PID 4532 wrote to memory of 4916 4532 xrrlffl.exe 93 PID 4532 wrote to memory of 4916 4532 xrrlffl.exe 93 PID 4916 wrote to memory of 1700 4916 tthbbb.exe 94 PID 4916 wrote to memory of 1700 4916 tthbbb.exe 94 PID 4916 wrote to memory of 1700 4916 tthbbb.exe 94 PID 1700 wrote to memory of 2932 1700 dvvvv.exe 95 PID 1700 wrote to memory of 2932 1700 dvvvv.exe 95 PID 1700 wrote to memory of 2932 1700 dvvvv.exe 95 PID 2932 wrote to memory of 1912 2932 jdpdp.exe 96 PID 2932 wrote to memory of 1912 2932 jdpdp.exe 96 PID 2932 wrote to memory of 1912 2932 jdpdp.exe 96 PID 1912 wrote to memory of 4572 1912 frfxfxx.exe 97 PID 1912 wrote to memory of 4572 1912 frfxfxx.exe 97 PID 1912 wrote to memory of 4572 1912 frfxfxx.exe 97 PID 4572 wrote to memory of 4812 4572 ntbhbt.exe 98 PID 4572 wrote to memory of 4812 4572 ntbhbt.exe 98 PID 4572 wrote to memory of 4812 4572 ntbhbt.exe 98 PID 4812 wrote to memory of 2816 4812 9vpjj.exe 99 PID 4812 wrote to memory of 2816 4812 9vpjj.exe 99 PID 4812 wrote to memory of 2816 4812 9vpjj.exe 99 PID 2816 wrote to memory of 2768 2816 1rxrffx.exe 100 PID 2816 wrote to memory of 2768 2816 1rxrffx.exe 100 PID 2816 wrote to memory of 2768 2816 1rxrffx.exe 100 PID 2768 wrote to memory of 632 2768 fffxxxx.exe 101 PID 2768 wrote to memory of 632 2768 fffxxxx.exe 101 PID 2768 wrote to memory of 632 2768 fffxxxx.exe 101 PID 632 wrote to memory of 1172 632 7nhhtt.exe 102 PID 632 wrote to memory of 1172 632 7nhhtt.exe 102 PID 632 wrote to memory of 1172 632 7nhhtt.exe 102 PID 1172 wrote to memory of 4560 1172 1jjpj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\5860033045ff7560883a8e1980fa5160_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5860033045ff7560883a8e1980fa5160_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\7jjjd.exec:\7jjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\flllxff.exec:\flllxff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\tntttn.exec:\tntttn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\1dppj.exec:\1dppj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\9hbttb.exec:\9hbttb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\jvdvj.exec:\jvdvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\3rlfxxx.exec:\3rlfxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\nhnbhb.exec:\nhnbhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\hbnthh.exec:\hbnthh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
\??\c:\3dpjp.exec:\3dpjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\xrrlffl.exec:\xrrlffl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\tthbbb.exec:\tthbbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\dvvvv.exec:\dvvvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\jdpdp.exec:\jdpdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\frfxfxx.exec:\frfxfxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\ntbhbt.exec:\ntbhbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\9vpjj.exec:\9vpjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\1rxrffx.exec:\1rxrffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\fffxxxx.exec:\fffxxxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\7nhhtt.exec:\7nhhtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\1jjpj.exec:\1jjpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\fllfxxr.exec:\fllfxxr.exe23⤵
- Executes dropped EXE
PID:4560 -
\??\c:\xlrllfx.exec:\xlrllfx.exe24⤵
- Executes dropped EXE
PID:1692 -
\??\c:\tnbtnh.exec:\tnbtnh.exe25⤵
- Executes dropped EXE
PID:4704 -
\??\c:\bbbbnn.exec:\bbbbnn.exe26⤵
- Executes dropped EXE
PID:408 -
\??\c:\ddvpj.exec:\ddvpj.exe27⤵
- Executes dropped EXE
PID:2328 -
\??\c:\xrxrllf.exec:\xrxrllf.exe28⤵
- Executes dropped EXE
PID:4444 -
\??\c:\fxxfxxx.exec:\fxxfxxx.exe29⤵
- Executes dropped EXE
PID:3804 -
\??\c:\nhhthb.exec:\nhhthb.exe30⤵
- Executes dropped EXE
PID:336 -
\??\c:\jjjpv.exec:\jjjpv.exe31⤵
- Executes dropped EXE
PID:1840 -
\??\c:\vvdpp.exec:\vvdpp.exe32⤵
- Executes dropped EXE
PID:4508 -
\??\c:\llfxxxx.exec:\llfxxxx.exe33⤵
- Executes dropped EXE
PID:2632 -
\??\c:\rxfrllf.exec:\rxfrllf.exe34⤵
- Executes dropped EXE
PID:3504 -
\??\c:\hnttbh.exec:\hnttbh.exe35⤵
- Executes dropped EXE
PID:1980 -
\??\c:\dpjjd.exec:\dpjjd.exe36⤵
- Executes dropped EXE
PID:2904 -
\??\c:\jvddj.exec:\jvddj.exe37⤵
- Executes dropped EXE
PID:4604 -
\??\c:\rlxxllr.exec:\rlxxllr.exe38⤵
- Executes dropped EXE
PID:1808 -
\??\c:\fxrlrrx.exec:\fxrlrrx.exe39⤵
- Executes dropped EXE
PID:624 -
\??\c:\ntbbtt.exec:\ntbbtt.exe40⤵
- Executes dropped EXE
PID:4828 -
\??\c:\tbtntt.exec:\tbtntt.exe41⤵
- Executes dropped EXE
PID:2924 -
\??\c:\dddvj.exec:\dddvj.exe42⤵
- Executes dropped EXE
PID:1420 -
\??\c:\5rxrllf.exec:\5rxrllf.exe43⤵
- Executes dropped EXE
PID:2268 -
\??\c:\5tnhbb.exec:\5tnhbb.exe44⤵
- Executes dropped EXE
PID:4296 -
\??\c:\5vddv.exec:\5vddv.exe45⤵
- Executes dropped EXE
PID:3672 -
\??\c:\3flfxlr.exec:\3flfxlr.exe46⤵
- Executes dropped EXE
PID:3080 -
\??\c:\xfrfxrf.exec:\xfrfxrf.exe47⤵
- Executes dropped EXE
PID:4568 -
\??\c:\nbhhhh.exec:\nbhhhh.exe48⤵
- Executes dropped EXE
PID:856 -
\??\c:\ddjjv.exec:\ddjjv.exe49⤵
- Executes dropped EXE
PID:208 -
\??\c:\jpvvj.exec:\jpvvj.exe50⤵
- Executes dropped EXE
PID:4092 -
\??\c:\rxxxrfx.exec:\rxxxrfx.exe51⤵
- Executes dropped EXE
PID:1320 -
\??\c:\9xxrlll.exec:\9xxrlll.exe52⤵
- Executes dropped EXE
PID:3544 -
\??\c:\tnnnnt.exec:\tnnnnt.exe53⤵
- Executes dropped EXE
PID:2560 -
\??\c:\dvjjj.exec:\dvjjj.exe54⤵
- Executes dropped EXE
PID:5032 -
\??\c:\vvppd.exec:\vvppd.exe55⤵
- Executes dropped EXE
PID:3088 -
\??\c:\rllfxxx.exec:\rllfxxx.exe56⤵
- Executes dropped EXE
PID:2032 -
\??\c:\7hnntt.exec:\7hnntt.exe57⤵
- Executes dropped EXE
PID:3384 -
\??\c:\hthnhn.exec:\hthnhn.exe58⤵
- Executes dropped EXE
PID:2236 -
\??\c:\1djpj.exec:\1djpj.exe59⤵
- Executes dropped EXE
PID:4848 -
\??\c:\1flfxxr.exec:\1flfxxr.exe60⤵
- Executes dropped EXE
PID:4916 -
\??\c:\xrxxxxx.exec:\xrxxxxx.exe61⤵
- Executes dropped EXE
PID:4396 -
\??\c:\pjjjp.exec:\pjjjp.exe62⤵
- Executes dropped EXE
PID:2848 -
\??\c:\ffrlffx.exec:\ffrlffx.exe63⤵
- Executes dropped EXE
PID:4152 -
\??\c:\lrrlffx.exec:\lrrlffx.exe64⤵
- Executes dropped EXE
PID:3964 -
\??\c:\hhttnn.exec:\hhttnn.exe65⤵
- Executes dropped EXE
PID:3376 -
\??\c:\3vpjd.exec:\3vpjd.exe66⤵PID:1952
-
\??\c:\9vjdv.exec:\9vjdv.exe67⤵PID:4780
-
\??\c:\xfrrrxx.exec:\xfrrrxx.exe68⤵PID:2380
-
\??\c:\tbnnhb.exec:\tbnnhb.exe69⤵PID:548
-
\??\c:\bbtnbb.exec:\bbtnbb.exe70⤵PID:2044
-
\??\c:\jdddp.exec:\jdddp.exe71⤵PID:2196
-
\??\c:\xrxllll.exec:\xrxllll.exe72⤵PID:4824
-
\??\c:\fxffffx.exec:\fxffffx.exe73⤵PID:4560
-
\??\c:\tttnnn.exec:\tttnnn.exe74⤵PID:1936
-
\??\c:\hntttb.exec:\hntttb.exe75⤵PID:4548
-
\??\c:\pjpjv.exec:\pjpjv.exe76⤵PID:1704
-
\??\c:\pvvpp.exec:\pvvpp.exe77⤵PID:2392
-
\??\c:\9rllxxx.exec:\9rllxxx.exe78⤵PID:4232
-
\??\c:\bbbtbb.exec:\bbbtbb.exe79⤵PID:4444
-
\??\c:\9vvvv.exec:\9vvvv.exe80⤵PID:1756
-
\??\c:\jddvj.exec:\jddvj.exe81⤵PID:1376
-
\??\c:\lfrllfr.exec:\lfrllfr.exe82⤵PID:1984
-
\??\c:\bhbbtt.exec:\bhbbtt.exe83⤵PID:1048
-
\??\c:\ddjdd.exec:\ddjdd.exe84⤵PID:4988
-
\??\c:\7pvpp.exec:\7pvpp.exe85⤵PID:4472
-
\??\c:\rflffff.exec:\rflffff.exe86⤵PID:3048
-
\??\c:\rrrrrrl.exec:\rrrrrrl.exe87⤵PID:4488
-
\??\c:\bbhttn.exec:\bbhttn.exe88⤵PID:1928
-
\??\c:\nbtthh.exec:\nbtthh.exe89⤵PID:1740
-
\??\c:\9ddvp.exec:\9ddvp.exe90⤵PID:3632
-
\??\c:\jpvdj.exec:\jpvdj.exe91⤵PID:828
-
\??\c:\rflrrrr.exec:\rflrrrr.exe92⤵PID:3036
-
\??\c:\tnbbhh.exec:\tnbbhh.exe93⤵PID:872
-
\??\c:\3bbtnn.exec:\3bbtnn.exe94⤵PID:4448
-
\??\c:\jdjjj.exec:\jdjjj.exe95⤵PID:1360
-
\??\c:\jdvjd.exec:\jdvjd.exe96⤵PID:4308
-
\??\c:\rrfxllf.exec:\rrfxllf.exe97⤵PID:3672
-
\??\c:\hthhhh.exec:\hthhhh.exe98⤵PID:3960
-
\??\c:\1hnhhh.exec:\1hnhhh.exe99⤵PID:964
-
\??\c:\xlrffrl.exec:\xlrffrl.exe100⤵PID:856
-
\??\c:\lffxrrf.exec:\lffxrrf.exe101⤵PID:4324
-
\??\c:\bbnhhh.exec:\bbnhhh.exe102⤵PID:4204
-
\??\c:\ppdvp.exec:\ppdvp.exe103⤵PID:4180
-
\??\c:\rflrlll.exec:\rflrlll.exe104⤵PID:3544
-
\??\c:\flrlllf.exec:\flrlllf.exe105⤵PID:3900
-
\??\c:\bnnnnn.exec:\bnnnnn.exe106⤵PID:2596
-
\??\c:\jdjvp.exec:\jdjvp.exe107⤵PID:3088
-
\??\c:\dvjpd.exec:\dvjpd.exe108⤵PID:3168
-
\??\c:\llffrrl.exec:\llffrrl.exe109⤵PID:3384
-
\??\c:\nhhhbt.exec:\nhhhbt.exe110⤵PID:2236
-
\??\c:\bthhhb.exec:\bthhhb.exe111⤵PID:3132
-
\??\c:\ffllffl.exec:\ffllffl.exe112⤵PID:4916
-
\??\c:\7rflrlf.exec:\7rflrlf.exe113⤵PID:1324
-
\??\c:\5jpjd.exec:\5jpjd.exe114⤵PID:1780
-
\??\c:\rrxllll.exec:\rrxllll.exe115⤵PID:4944
-
\??\c:\nnnbth.exec:\nnnbth.exe116⤵PID:2500
-
\??\c:\bnnhhh.exec:\bnnhhh.exe117⤵PID:3444
-
\??\c:\1vdjd.exec:\1vdjd.exe118⤵PID:2768
-
\??\c:\9vdvj.exec:\9vdvj.exe119⤵PID:548
-
\??\c:\rlrrffl.exec:\rlrrffl.exe120⤵PID:3916
-
\??\c:\llxxrrr.exec:\llxxrrr.exe121⤵PID:668
-
\??\c:\tbhhhh.exec:\tbhhhh.exe122⤵PID:4748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-