Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 03:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9f828df4eeb5230c249a52d0fdfe4d50_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
- Target 9f828df4eeb5230c249a52d0fdfe4d50_NeikiAnalytics.exe
- Size 56KB
- Sample240614-d9vxtaxgnn
- SHA256 cf6a9a45b04b5872edd8d272f0cfc889791efc79441bc9c880c9464598d84871
- MD5 9f828df4eeb5230c249a52d0fdfe4d50
- SHA1 f5e5b59280c5acb257dab95f24c1b56ec6499d13
- SHA512 bf2570ce13e97e762245de39b17faf1182825353a4603d220bfa86452bc54e50f71b8f264462e08b031da552d3430e443218f5076d64c7d0aaaf51be48624f86
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0chVnc:ymb3NkkiQ3mdBjF0crc
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/3980-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1168-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1816-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4760-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2504-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3536-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1516-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4292-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/404-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1692-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3864-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4176-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3784-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2292-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4092-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4752-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1804-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3472-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4980-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4360-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1060-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1816-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 1168 frlfxrf.exe 4400 hnnnhb.exe 1816 vppjd.exe 4956 xxxlxrl.exe 4760 lrrfxrr.exe 2504 nbhbnh.exe 5108 pjjpj.exe 3536 llrxlxx.exe 1516 5fffxxr.exe 4292 vjdvp.exe 404 7rrxrfx.exe 5008 7rrrxfl.exe 1692 hhbbbt.exe 3864 bttnnh.exe 4176 7pjvj.exe 3784 rfrlxrl.exe 2292 xrxrlfr.exe 1292 7hbnhb.exe 4700 7djdd.exe 4092 fflfrlf.exe 4752 7fffxrl.exe 2164 bthhhh.exe 1804 1vppd.exe 1032 xrffrxl.exe 3472 xlrlxfl.exe 4980 5htttt.exe 4928 thhbtt.exe 4360 jvvpd.exe 1060 xfffxxx.exe 1536 rllfxrf.exe 1816 httbtn.exe 640 9jdvj.exe 216 pjdvp.exe 2460 xrrlxrr.exe 2368 xrfxxrr.exe 1412 5bbthh.exe 5108 tnnhbh.exe 3536 vjjdp.exe 2828 dpjjp.exe 2700 fflfxrl.exe 4932 frlfxrl.exe 1176 fxllffr.exe 4892 htbnhh.exe 3128 btnnbb.exe 4056 pdvpd.exe 4284 pvvdp.exe 3364 ddjdp.exe 1528 7llfrll.exe 3784 7lrrllx.exe 4924 1bhbnh.exe 380 hbbbtn.exe 724 jvvpj.exe 976 1vpdv.exe 4644 frrlxrr.exe 3508 9lfxlfr.exe 4752 nnhnht.exe 2000 hhhbbb.exe 4588 pjdvd.exe 2080 1jjdv.exe 3304 djjvj.exe 3028 7flfxrl.exe 4628 7lllfxl.exe 3068 9thbnh.exe 884 9hbtbb.exe -
resource yara_rule behavioral2/memory/3980-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1168-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1816-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4760-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4760-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4760-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2504-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3536-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1516-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1516-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1516-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1516-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4292-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/404-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1692-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3864-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4176-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3784-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2292-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4092-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1804-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3472-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4360-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1060-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1816-207-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3980 wrote to memory of 1168 3980 9f828df4eeb5230c249a52d0fdfe4d50_NeikiAnalytics.exe 89 PID 3980 wrote to memory of 1168 3980 9f828df4eeb5230c249a52d0fdfe4d50_NeikiAnalytics.exe 89 PID 3980 wrote to memory of 1168 3980 9f828df4eeb5230c249a52d0fdfe4d50_NeikiAnalytics.exe 89 PID 1168 wrote to memory of 4400 1168 frlfxrf.exe 90 PID 1168 wrote to memory of 4400 1168 frlfxrf.exe 90 PID 1168 wrote to memory of 4400 1168 frlfxrf.exe 90 PID 4400 wrote to memory of 1816 4400 hnnnhb.exe 91 PID 4400 wrote to memory of 1816 4400 hnnnhb.exe 91 PID 4400 wrote to memory of 1816 4400 hnnnhb.exe 91 PID 1816 wrote to memory of 4956 1816 vppjd.exe 92 PID 1816 wrote to memory of 4956 1816 vppjd.exe 92 PID 1816 wrote to memory of 4956 1816 vppjd.exe 92 PID 4956 wrote to memory of 4760 4956 xxxlxrl.exe 93 PID 4956 wrote to memory of 4760 4956 xxxlxrl.exe 93 PID 4956 wrote to memory of 4760 4956 xxxlxrl.exe 93 PID 4760 wrote to memory of 2504 4760 lrrfxrr.exe 94 PID 4760 wrote to memory of 2504 4760 lrrfxrr.exe 94 PID 4760 wrote to memory of 2504 4760 lrrfxrr.exe 94 PID 2504 wrote to memory of 5108 2504 nbhbnh.exe 95 PID 2504 wrote to memory of 5108 2504 nbhbnh.exe 95 PID 2504 wrote to memory of 5108 2504 nbhbnh.exe 95 PID 5108 wrote to memory of 3536 5108 pjjpj.exe 96 PID 5108 wrote to memory of 3536 5108 pjjpj.exe 96 PID 5108 wrote to memory of 3536 5108 pjjpj.exe 96 PID 3536 wrote to memory of 1516 3536 llrxlxx.exe 97 PID 3536 wrote to memory of 1516 3536 llrxlxx.exe 97 PID 3536 wrote to memory of 1516 3536 llrxlxx.exe 97 PID 1516 wrote to memory of 4292 1516 5fffxxr.exe 98 PID 1516 wrote to memory of 4292 1516 5fffxxr.exe 98 PID 1516 wrote to memory of 4292 1516 5fffxxr.exe 98 PID 4292 wrote to memory of 404 4292 vjdvp.exe 99 PID 4292 wrote to memory of 404 4292 vjdvp.exe 99 PID 4292 wrote to memory of 404 4292 vjdvp.exe 99 PID 404 wrote to memory of 5008 404 7rrxrfx.exe 100 PID 404 wrote to memory of 5008 404 7rrxrfx.exe 100 PID 404 wrote to memory of 5008 404 7rrxrfx.exe 100 PID 5008 wrote to memory of 1692 5008 7rrrxfl.exe 101 PID 5008 wrote to memory of 1692 5008 7rrrxfl.exe 101 PID 5008 wrote to memory of 1692 5008 7rrrxfl.exe 101 PID 1692 wrote to memory of 3864 1692 hhbbbt.exe 102 PID 1692 wrote to memory of 3864 1692 hhbbbt.exe 102 PID 1692 wrote to memory of 3864 1692 hhbbbt.exe 102 PID 3864 wrote to memory of 4176 3864 bttnnh.exe 103 PID 3864 wrote to memory of 4176 3864 bttnnh.exe 103 PID 3864 wrote to memory of 4176 3864 bttnnh.exe 103 PID 4176 wrote to memory of 3784 4176 7pjvj.exe 104 PID 4176 wrote to memory of 3784 4176 7pjvj.exe 104 PID 4176 wrote to memory of 3784 4176 7pjvj.exe 104 PID 3784 wrote to memory of 2292 3784 rfrlxrl.exe 105 PID 3784 wrote to memory of 2292 3784 rfrlxrl.exe 105 PID 3784 wrote to memory of 2292 3784 rfrlxrl.exe 105 PID 2292 wrote to memory of 1292 2292 xrxrlfr.exe 107 PID 2292 wrote to memory of 1292 2292 xrxrlfr.exe 107 PID 2292 wrote to memory of 1292 2292 xrxrlfr.exe 107 PID 1292 wrote to memory of 4700 1292 7hbnhb.exe 108 PID 1292 wrote to memory of 4700 1292 7hbnhb.exe 108 PID 1292 wrote to memory of 4700 1292 7hbnhb.exe 108 PID 4700 wrote to memory of 4092 4700 7djdd.exe 109 PID 4700 wrote to memory of 4092 4700 7djdd.exe 109 PID 4700 wrote to memory of 4092 4700 7djdd.exe 109 PID 4092 wrote to memory of 4752 4092 fflfrlf.exe 110 PID 4092 wrote to memory of 4752 4092 fflfrlf.exe 110 PID 4092 wrote to memory of 4752 4092 fflfrlf.exe 110 PID 4752 wrote to memory of 2164 4752 7fffxrl.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f828df4eeb5230c249a52d0fdfe4d50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9f828df4eeb5230c249a52d0fdfe4d50_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\frlfxrf.exec:\frlfxrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\hnnnhb.exec:\hnnnhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\vppjd.exec:\vppjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\xxxlxrl.exec:\xxxlxrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\lrrfxrr.exec:\lrrfxrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\nbhbnh.exec:\nbhbnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\pjjpj.exec:\pjjpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\llrxlxx.exec:\llrxlxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\5fffxxr.exec:\5fffxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\vjdvp.exec:\vjdvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
\??\c:\7rrxrfx.exec:\7rrxrfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\7rrrxfl.exec:\7rrrxfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\hhbbbt.exec:\hhbbbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\bttnnh.exec:\bttnnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\7pjvj.exec:\7pjvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
\??\c:\rfrlxrl.exec:\rfrlxrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
\??\c:\xrxrlfr.exec:\xrxrlfr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\7hbnhb.exec:\7hbnhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\7djdd.exec:\7djdd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\fflfrlf.exec:\fflfrlf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\7fffxrl.exec:\7fffxrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\bthhhh.exec:\bthhhh.exe23⤵
- Executes dropped EXE
PID:2164 -
\??\c:\1vppd.exec:\1vppd.exe24⤵
- Executes dropped EXE
PID:1804 -
\??\c:\xrffrxl.exec:\xrffrxl.exe25⤵
- Executes dropped EXE
PID:1032 -
\??\c:\xlrlxfl.exec:\xlrlxfl.exe26⤵
- Executes dropped EXE
PID:3472 -
\??\c:\5htttt.exec:\5htttt.exe27⤵
- Executes dropped EXE
PID:4980 -
\??\c:\thhbtt.exec:\thhbtt.exe28⤵
- Executes dropped EXE
PID:4928 -
\??\c:\jvvpd.exec:\jvvpd.exe29⤵
- Executes dropped EXE
PID:4360 -
\??\c:\xfffxxx.exec:\xfffxxx.exe30⤵
- Executes dropped EXE
PID:1060 -
\??\c:\rllfxrf.exec:\rllfxrf.exe31⤵
- Executes dropped EXE
PID:1536 -
\??\c:\httbtn.exec:\httbtn.exe32⤵
- Executes dropped EXE
PID:1816 -
\??\c:\9jdvj.exec:\9jdvj.exe33⤵
- Executes dropped EXE
PID:640 -
\??\c:\pjdvp.exec:\pjdvp.exe34⤵
- Executes dropped EXE
PID:216 -
\??\c:\xrrlxrr.exec:\xrrlxrr.exe35⤵
- Executes dropped EXE
PID:2460 -
\??\c:\xrfxxrr.exec:\xrfxxrr.exe36⤵
- Executes dropped EXE
PID:2368 -
\??\c:\5bbthh.exec:\5bbthh.exe37⤵
- Executes dropped EXE
PID:1412 -
\??\c:\tnnhbh.exec:\tnnhbh.exe38⤵
- Executes dropped EXE
PID:5108 -
\??\c:\vjjdp.exec:\vjjdp.exe39⤵
- Executes dropped EXE
PID:3536 -
\??\c:\dpjjp.exec:\dpjjp.exe40⤵
- Executes dropped EXE
PID:2828 -
\??\c:\fflfxrl.exec:\fflfxrl.exe41⤵
- Executes dropped EXE
PID:2700 -
\??\c:\frlfxrl.exec:\frlfxrl.exe42⤵
- Executes dropped EXE
PID:4932 -
\??\c:\fxllffr.exec:\fxllffr.exe43⤵
- Executes dropped EXE
PID:1176 -
\??\c:\htbnhh.exec:\htbnhh.exe44⤵
- Executes dropped EXE
PID:4892 -
\??\c:\btnnbb.exec:\btnnbb.exe45⤵
- Executes dropped EXE
PID:3128 -
\??\c:\pdvpd.exec:\pdvpd.exe46⤵
- Executes dropped EXE
PID:4056 -
\??\c:\pvvdp.exec:\pvvdp.exe47⤵
- Executes dropped EXE
PID:4284 -
\??\c:\ddjdp.exec:\ddjdp.exe48⤵
- Executes dropped EXE
PID:3364 -
\??\c:\7llfrll.exec:\7llfrll.exe49⤵
- Executes dropped EXE
PID:1528 -
\??\c:\7lrrllx.exec:\7lrrllx.exe50⤵
- Executes dropped EXE
PID:3784 -
\??\c:\1bhbnh.exec:\1bhbnh.exe51⤵
- Executes dropped EXE
PID:4924 -
\??\c:\hbbbtn.exec:\hbbbtn.exe52⤵
- Executes dropped EXE
PID:380 -
\??\c:\jvvpj.exec:\jvvpj.exe53⤵
- Executes dropped EXE
PID:724 -
\??\c:\1vpdv.exec:\1vpdv.exe54⤵
- Executes dropped EXE
PID:976 -
\??\c:\frrlxrr.exec:\frrlxrr.exe55⤵
- Executes dropped EXE
PID:4644 -
\??\c:\9lfxlfr.exec:\9lfxlfr.exe56⤵
- Executes dropped EXE
PID:3508 -
\??\c:\nnhnht.exec:\nnhnht.exe57⤵
- Executes dropped EXE
PID:4752 -
\??\c:\hhhbbb.exec:\hhhbbb.exe58⤵
- Executes dropped EXE
PID:2000 -
\??\c:\pjdvd.exec:\pjdvd.exe59⤵
- Executes dropped EXE
PID:4588 -
\??\c:\1jjdv.exec:\1jjdv.exe60⤵
- Executes dropped EXE
PID:2080 -
\??\c:\djjvj.exec:\djjvj.exe61⤵
- Executes dropped EXE
PID:3304 -
\??\c:\7flfxrl.exec:\7flfxrl.exe62⤵
- Executes dropped EXE
PID:3028 -
\??\c:\7lllfxl.exec:\7lllfxl.exe63⤵
- Executes dropped EXE
PID:4628 -
\??\c:\9thbnh.exec:\9thbnh.exe64⤵
- Executes dropped EXE
PID:3068 -
\??\c:\9hbtbb.exec:\9hbtbb.exe65⤵
- Executes dropped EXE
PID:884 -
\??\c:\pvdvv.exec:\pvdvv.exe66⤵PID:1348
-
\??\c:\jdjvd.exec:\jdjvd.exe67⤵PID:2756
-
\??\c:\7frlxrl.exec:\7frlxrl.exe68⤵PID:1568
-
\??\c:\1xxrxxx.exec:\1xxrxxx.exe69⤵PID:4256
-
\??\c:\tbbhbh.exec:\tbbhbh.exe70⤵PID:4592
-
\??\c:\hnttnn.exec:\hnttnn.exe71⤵PID:2252
-
\??\c:\pjdvp.exec:\pjdvp.exe72⤵PID:1596
-
\??\c:\dvvpd.exec:\dvvpd.exe73⤵PID:2544
-
\??\c:\lffxlfx.exec:\lffxlfx.exe74⤵PID:2460
-
\??\c:\xlfxrrr.exec:\xlfxrrr.exe75⤵PID:2368
-
\??\c:\tthbbb.exec:\tthbbb.exe76⤵PID:660
-
\??\c:\3nhbhh.exec:\3nhbhh.exe77⤵PID:2784
-
\??\c:\jvjdd.exec:\jvjdd.exe78⤵PID:2388
-
\??\c:\xrrlrlr.exec:\xrrlrlr.exe79⤵PID:4888
-
\??\c:\llxxxxx.exec:\llxxxxx.exe80⤵PID:4292
-
\??\c:\5tttbb.exec:\5tttbb.exe81⤵PID:1260
-
\??\c:\hbntnb.exec:\hbntnb.exe82⤵PID:5008
-
\??\c:\nnhbnh.exec:\nnhbnh.exe83⤵PID:4736
-
\??\c:\dddvv.exec:\dddvv.exe84⤵PID:3128
-
\??\c:\5vvpv.exec:\5vvpv.exe85⤵PID:1668
-
\??\c:\9rlfllf.exec:\9rlfllf.exe86⤵PID:5056
-
\??\c:\fxrxlfx.exec:\fxrxlfx.exe87⤵PID:3604
-
\??\c:\flrrllf.exec:\flrrllf.exe88⤵PID:4944
-
\??\c:\3hbtnh.exec:\3hbtnh.exe89⤵PID:4388
-
\??\c:\nhhnbn.exec:\nhhnbn.exe90⤵PID:2724
-
\??\c:\pdddp.exec:\pdddp.exe91⤵PID:2344
-
\??\c:\pjjdj.exec:\pjjdj.exe92⤵PID:4100
-
\??\c:\3llfxrl.exec:\3llfxrl.exe93⤵PID:4352
-
\??\c:\frlfxrx.exec:\frlfxrx.exe94⤵PID:2708
-
\??\c:\bhnbbt.exec:\bhnbbt.exe95⤵PID:4392
-
\??\c:\5hnhbt.exec:\5hnhbt.exe96⤵PID:1056
-
\??\c:\dvvpd.exec:\dvvpd.exe97⤵PID:3828
-
\??\c:\vvjpj.exec:\vvjpj.exe98⤵PID:1080
-
\??\c:\pjjvj.exec:\pjjvj.exe99⤵PID:2080
-
\??\c:\lxrfrlf.exec:\lxrfrlf.exe100⤵PID:1052
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe101⤵PID:4980
-
\??\c:\thbnhb.exec:\thbnhb.exe102⤵PID:3120
-
\??\c:\thhhbb.exec:\thhhbb.exe103⤵PID:4552
-
\??\c:\llllfff.exec:\llllfff.exe104⤵PID:924
-
\??\c:\httttt.exec:\httttt.exe105⤵PID:3292
-
\??\c:\dpvjd.exec:\dpvjd.exe106⤵PID:2756
-
\??\c:\vpjjd.exec:\vpjjd.exe107⤵PID:1568
-
\??\c:\7jjdp.exec:\7jjdp.exe108⤵PID:4256
-
\??\c:\7xlxxxf.exec:\7xlxxxf.exe109⤵PID:4592
-
\??\c:\xllxrxx.exec:\xllxrxx.exe110⤵PID:2916
-
\??\c:\tnbbbb.exec:\tnbbbb.exe111⤵PID:4896
-
\??\c:\5ttntb.exec:\5ttntb.exe112⤵PID:2336
-
\??\c:\ttnhbb.exec:\ttnhbb.exe113⤵PID:2460
-
\??\c:\pjjdv.exec:\pjjdv.exe114⤵PID:2368
-
\??\c:\dddjd.exec:\dddjd.exe115⤵PID:3768
-
\??\c:\lffrllf.exec:\lffrllf.exe116⤵PID:2784
-
\??\c:\rfrrxlr.exec:\rfrrxlr.exe117⤵PID:2388
-
\??\c:\tthnth.exec:\tthnth.exe118⤵PID:4888
-
\??\c:\btbbbb.exec:\btbbbb.exe119⤵PID:4292
-
\??\c:\3hhhnn.exec:\3hhhnn.exe120⤵PID:1260
-
\??\c:\3pppv.exec:\3pppv.exe121⤵PID:5008
-
\??\c:\jjjdv.exec:\jjjdv.exe122⤵PID:4736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-