Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
17/06/2024, 23:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1007fd5dddbd78ee9bd17dc4e40d6ff0_NeikiAnalytics.exe
Resource
win7-20240611-en
4 signatures
150 seconds
General
- Target 1007fd5dddbd78ee9bd17dc4e40d6ff0_NeikiAnalytics.exe
- Size 180KB
- Sample240617-3hr5aayend
- SHA256 4ea974f090037612a33ded6d606aa046a899f689e1f240d933d05578374b1667
- MD5 1007fd5dddbd78ee9bd17dc4e40d6ff0
- SHA1 393a3a29a79ae8cc03eca26134e12604592feda6
- SHA512 01aba75b752106b3ca87ca47c12b7738f6e0d0eb5c0aed395cdee9c2cf0f4b5fa6ad74e3fe43b2c3909e93f13342e1f95b3151cb6ffcf0a7fa396caf243b942e
- SSDEEP 3072:AhOmTsF93UYfwC6GIoutQ6M/Fpi8rY9AABa1YRMxgRP5ZXuxk:Acm4FmowdHoSCddWhR/Z+i
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3392-4-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2540-10-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2596-19-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/4120-17-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2712-29-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/768-35-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/3456-37-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/4016-43-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2192-54-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/1276-67-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/1484-62-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/4360-77-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2608-84-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2012-87-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/1808-98-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/4256-103-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/3568-108-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/3164-122-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2292-127-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/1576-132-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/4960-148-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/1232-159-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/804-153-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/4452-174-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/3752-176-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/1856-185-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2128-191-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/3560-195-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/548-200-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/636-204-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/3404-210-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/1596-214-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2140-225-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2008-233-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/4600-237-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/1456-241-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/4336-245-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2596-261-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/216-274-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2736-283-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/3372-288-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/5040-296-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2400-305-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/3164-345-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2160-355-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/3564-371-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/904-388-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/4160-445-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/1608-474-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2172-505-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/4904-538-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/3164-542-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/804-564-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/1456-629-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/4916-650-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/4372-658-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/436-677-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/5060-705-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2648-777-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/2132-837-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/908-886-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/4628-981-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/4148-1100-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral2/memory/4480-1198-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 2540 lffxrrl.exe 4120 djjjd.exe 2596 lrrlfxx.exe 2712 bbbtnn.exe 768 lxrlfxr.exe 3456 llrfrlr.exe 4016 3ttnhh.exe 2192 dvpdv.exe 4356 rlxxffr.exe 1484 hntthh.exe 1276 bnbttt.exe 4360 jpvpp.exe 2608 thnbbt.exe 2012 dddvp.exe 1808 rxlfrrl.exe 4144 hnhbnn.exe 4256 3dpvp.exe 3568 pdvjj.exe 2584 lfxrlrl.exe 3164 ttbttt.exe 2292 vpppj.exe 1576 rrrlffx.exe 3012 btbtnh.exe 4928 btnhbt.exe 4960 dpvdv.exe 804 7vvvd.exe 1232 9xfrrxr.exe 2616 hbnhbn.exe 4452 1ppjd.exe 3752 rlllxxr.exe 1856 xffxxxr.exe 2128 dddvd.exe 448 rlxrllf.exe 3560 tnnhbt.exe 548 vppjd.exe 636 vpvpj.exe 3404 frrlfxr.exe 1596 frffrlf.exe 1244 tbnhtt.exe 5008 pddvp.exe 2140 xfllfff.exe 4840 7lllxxr.exe 2008 3tbbtn.exe 4600 tbhbtn.exe 1456 vdvpp.exe 4336 lrffxxr.exe 4160 fxlfffr.exe 232 bbbhnh.exe 1068 ddvpj.exe 3468 dvpjd.exe 2596 xlfxrlf.exe 2360 llrrrrl.exe 3720 nhtnht.exe 3980 jjpjj.exe 216 vdjjd.exe 3324 5lxrllf.exe 1452 fxfxrll.exe 2736 nnttnn.exe 3372 bbhhnb.exe 2176 ddvpv.exe 1276 rrxrffl.exe 5040 flllffx.exe 1804 hbttnn.exe 2400 bthbbb.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3392 wrote to memory of 2540 3392 1007fd5dddbd78ee9bd17dc4e40d6ff0_NeikiAnalytics.exe 82 PID 3392 wrote to memory of 2540 3392 1007fd5dddbd78ee9bd17dc4e40d6ff0_NeikiAnalytics.exe 82 PID 3392 wrote to memory of 2540 3392 1007fd5dddbd78ee9bd17dc4e40d6ff0_NeikiAnalytics.exe 82 PID 2540 wrote to memory of 4120 2540 lffxrrl.exe 83 PID 2540 wrote to memory of 4120 2540 lffxrrl.exe 83 PID 2540 wrote to memory of 4120 2540 lffxrrl.exe 83 PID 4120 wrote to memory of 2596 4120 djjjd.exe 84 PID 4120 wrote to memory of 2596 4120 djjjd.exe 84 PID 4120 wrote to memory of 2596 4120 djjjd.exe 84 PID 2596 wrote to memory of 2712 2596 lrrlfxx.exe 85 PID 2596 wrote to memory of 2712 2596 lrrlfxx.exe 85 PID 2596 wrote to memory of 2712 2596 lrrlfxx.exe 85 PID 2712 wrote to memory of 768 2712 bbbtnn.exe 86 PID 2712 wrote to memory of 768 2712 bbbtnn.exe 86 PID 2712 wrote to memory of 768 2712 bbbtnn.exe 86 PID 768 wrote to memory of 3456 768 lxrlfxr.exe 87 PID 768 wrote to memory of 3456 768 lxrlfxr.exe 87 PID 768 wrote to memory of 3456 768 lxrlfxr.exe 87 PID 3456 wrote to memory of 4016 3456 llrfrlr.exe 88 PID 3456 wrote to memory of 4016 3456 llrfrlr.exe 88 PID 3456 wrote to memory of 4016 3456 llrfrlr.exe 88 PID 4016 wrote to memory of 2192 4016 3ttnhh.exe 89 PID 4016 wrote to memory of 2192 4016 3ttnhh.exe 89 PID 4016 wrote to memory of 2192 4016 3ttnhh.exe 89 PID 2192 wrote to memory of 4356 2192 dvpdv.exe 90 PID 2192 wrote to memory of 4356 2192 dvpdv.exe 90 PID 2192 wrote to memory of 4356 2192 dvpdv.exe 90 PID 4356 wrote to memory of 1484 4356 rlxxffr.exe 92 PID 4356 wrote to memory of 1484 4356 rlxxffr.exe 92 PID 4356 wrote to memory of 1484 4356 rlxxffr.exe 92 PID 1484 wrote to memory of 1276 1484 hntthh.exe 93 PID 1484 wrote to memory of 1276 1484 hntthh.exe 93 PID 1484 wrote to memory of 1276 1484 hntthh.exe 93 PID 1276 wrote to memory of 4360 1276 bnbttt.exe 94 PID 1276 wrote to memory of 4360 1276 bnbttt.exe 94 PID 1276 wrote to memory of 4360 1276 bnbttt.exe 94 PID 4360 wrote to memory of 2608 4360 jpvpp.exe 95 PID 4360 wrote to memory of 2608 4360 jpvpp.exe 95 PID 4360 wrote to memory of 2608 4360 jpvpp.exe 95 PID 2608 wrote to memory of 2012 2608 thnbbt.exe 97 PID 2608 wrote to memory of 2012 2608 thnbbt.exe 97 PID 2608 wrote to memory of 2012 2608 thnbbt.exe 97 PID 2012 wrote to memory of 1808 2012 dddvp.exe 98 PID 2012 wrote to memory of 1808 2012 dddvp.exe 98 PID 2012 wrote to memory of 1808 2012 dddvp.exe 98 PID 1808 wrote to memory of 4144 1808 rxlfrrl.exe 99 PID 1808 wrote to memory of 4144 1808 rxlfrrl.exe 99 PID 1808 wrote to memory of 4144 1808 rxlfrrl.exe 99 PID 4144 wrote to memory of 4256 4144 hnhbnn.exe 100 PID 4144 wrote to memory of 4256 4144 hnhbnn.exe 100 PID 4144 wrote to memory of 4256 4144 hnhbnn.exe 100 PID 4256 wrote to memory of 3568 4256 3dpvp.exe 101 PID 4256 wrote to memory of 3568 4256 3dpvp.exe 101 PID 4256 wrote to memory of 3568 4256 3dpvp.exe 101 PID 3568 wrote to memory of 2584 3568 pdvjj.exe 102 PID 3568 wrote to memory of 2584 3568 pdvjj.exe 102 PID 3568 wrote to memory of 2584 3568 pdvjj.exe 102 PID 2584 wrote to memory of 3164 2584 lfxrlrl.exe 103 PID 2584 wrote to memory of 3164 2584 lfxrlrl.exe 103 PID 2584 wrote to memory of 3164 2584 lfxrlrl.exe 103 PID 3164 wrote to memory of 2292 3164 ttbttt.exe 104 PID 3164 wrote to memory of 2292 3164 ttbttt.exe 104 PID 3164 wrote to memory of 2292 3164 ttbttt.exe 104 PID 2292 wrote to memory of 1576 2292 vpppj.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\1007fd5dddbd78ee9bd17dc4e40d6ff0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1007fd5dddbd78ee9bd17dc4e40d6ff0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\lffxrrl.exec:\lffxrrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\djjjd.exec:\djjjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\lrrlfxx.exec:\lrrlfxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\bbbtnn.exec:\bbbtnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\lxrlfxr.exec:\lxrlfxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\llrfrlr.exec:\llrfrlr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\3ttnhh.exec:\3ttnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\dvpdv.exec:\dvpdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\rlxxffr.exec:\rlxxffr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\hntthh.exec:\hntthh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\bnbttt.exec:\bnbttt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\jpvpp.exec:\jpvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\thnbbt.exec:\thnbbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\dddvp.exec:\dddvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\rxlfrrl.exec:\rxlfrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\hnhbnn.exec:\hnhbnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
\??\c:\3dpvp.exec:\3dpvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
\??\c:\pdvjj.exec:\pdvjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
\??\c:\lfxrlrl.exec:\lfxrlrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\ttbttt.exec:\ttbttt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\vpppj.exec:\vpppj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\rrrlffx.exec:\rrrlffx.exe23⤵
- Executes dropped EXE
PID:1576 -
\??\c:\btbtnh.exec:\btbtnh.exe24⤵
- Executes dropped EXE
PID:3012 -
\??\c:\btnhbt.exec:\btnhbt.exe25⤵
- Executes dropped EXE
PID:4928 -
\??\c:\dpvdv.exec:\dpvdv.exe26⤵
- Executes dropped EXE
PID:4960 -
\??\c:\7vvvd.exec:\7vvvd.exe27⤵
- Executes dropped EXE
PID:804 -
\??\c:\9xfrrxr.exec:\9xfrrxr.exe28⤵
- Executes dropped EXE
PID:1232 -
\??\c:\hbnhbn.exec:\hbnhbn.exe29⤵
- Executes dropped EXE
PID:2616 -
\??\c:\1ppjd.exec:\1ppjd.exe30⤵
- Executes dropped EXE
PID:4452 -
\??\c:\rlllxxr.exec:\rlllxxr.exe31⤵
- Executes dropped EXE
PID:3752 -
\??\c:\xffxxxr.exec:\xffxxxr.exe32⤵
- Executes dropped EXE
PID:1856 -
\??\c:\dddvd.exec:\dddvd.exe33⤵
- Executes dropped EXE
PID:2128 -
\??\c:\rlxrllf.exec:\rlxrllf.exe34⤵
- Executes dropped EXE
PID:448 -
\??\c:\tnnhbt.exec:\tnnhbt.exe35⤵
- Executes dropped EXE
PID:3560 -
\??\c:\vppjd.exec:\vppjd.exe36⤵
- Executes dropped EXE
PID:548 -
\??\c:\vpvpj.exec:\vpvpj.exe37⤵
- Executes dropped EXE
PID:636 -
\??\c:\frrlfxr.exec:\frrlfxr.exe38⤵
- Executes dropped EXE
PID:3404 -
\??\c:\frffrlf.exec:\frffrlf.exe39⤵
- Executes dropped EXE
PID:1596 -
\??\c:\tbnhtt.exec:\tbnhtt.exe40⤵
- Executes dropped EXE
PID:1244 -
\??\c:\pddvp.exec:\pddvp.exe41⤵
- Executes dropped EXE
PID:5008 -
\??\c:\xfllfff.exec:\xfllfff.exe42⤵
- Executes dropped EXE
PID:2140 -
\??\c:\7lllxxr.exec:\7lllxxr.exe43⤵
- Executes dropped EXE
PID:4840 -
\??\c:\3tbbtn.exec:\3tbbtn.exe44⤵
- Executes dropped EXE
PID:2008 -
\??\c:\tbhbtn.exec:\tbhbtn.exe45⤵
- Executes dropped EXE
PID:4600 -
\??\c:\vdvpp.exec:\vdvpp.exe46⤵
- Executes dropped EXE
PID:1456 -
\??\c:\lrffxxr.exec:\lrffxxr.exe47⤵
- Executes dropped EXE
PID:4336 -
\??\c:\fxlfffr.exec:\fxlfffr.exe48⤵
- Executes dropped EXE
PID:4160 -
\??\c:\bbbhnh.exec:\bbbhnh.exe49⤵
- Executes dropped EXE
PID:232 -
\??\c:\ddvpj.exec:\ddvpj.exe50⤵
- Executes dropped EXE
PID:1068 -
\??\c:\dvpjd.exec:\dvpjd.exe51⤵
- Executes dropped EXE
PID:3468 -
\??\c:\xlfxrlf.exec:\xlfxrlf.exe52⤵
- Executes dropped EXE
PID:2596 -
\??\c:\llrrrrl.exec:\llrrrrl.exe53⤵
- Executes dropped EXE
PID:2360 -
\??\c:\nhtnht.exec:\nhtnht.exe54⤵
- Executes dropped EXE
PID:3720 -
\??\c:\jjpjj.exec:\jjpjj.exe55⤵
- Executes dropped EXE
PID:3980 -
\??\c:\vdjjd.exec:\vdjjd.exe56⤵
- Executes dropped EXE
PID:216 -
\??\c:\5lxrllf.exec:\5lxrllf.exe57⤵
- Executes dropped EXE
PID:3324 -
\??\c:\fxfxrll.exec:\fxfxrll.exe58⤵
- Executes dropped EXE
PID:1452 -
\??\c:\nnttnn.exec:\nnttnn.exe59⤵
- Executes dropped EXE
PID:2736 -
\??\c:\bbhhnb.exec:\bbhhnb.exe60⤵
- Executes dropped EXE
PID:3372 -
\??\c:\ddvpv.exec:\ddvpv.exe61⤵
- Executes dropped EXE
PID:2176 -
\??\c:\rrxrffl.exec:\rrxrffl.exe62⤵
- Executes dropped EXE
PID:1276 -
\??\c:\flllffx.exec:\flllffx.exe63⤵
- Executes dropped EXE
PID:5040 -
\??\c:\hbttnn.exec:\hbttnn.exe64⤵
- Executes dropped EXE
PID:1804 -
\??\c:\bthbbb.exec:\bthbbb.exe65⤵
- Executes dropped EXE
PID:2400 -
\??\c:\vvvpj.exec:\vvvpj.exe66⤵PID:908
-
\??\c:\xrxrrrf.exec:\xrxrrrf.exe67⤵PID:2568
-
\??\c:\hthnnn.exec:\hthnnn.exe68⤵PID:1940
-
\??\c:\hbtbbb.exec:\hbtbbb.exe69⤵PID:5092
-
\??\c:\3djjd.exec:\3djjd.exe70⤵PID:412
-
\??\c:\jpdvj.exec:\jpdvj.exe71⤵PID:620
-
\??\c:\rrrxxxr.exec:\rrrxxxr.exe72⤵PID:2152
-
\??\c:\lfxrrlf.exec:\lfxrrlf.exe73⤵PID:1264
-
\??\c:\bbbtbh.exec:\bbbtbh.exe74⤵PID:4688
-
\??\c:\jjvpd.exec:\jjvpd.exe75⤵PID:4264
-
\??\c:\xrxrxxr.exec:\xrxrxxr.exe76⤵PID:1348
-
\??\c:\lrlfxrl.exec:\lrlfxrl.exe77⤵PID:1080
-
\??\c:\ntttnh.exec:\ntttnh.exe78⤵PID:3164
-
\??\c:\nttthh.exec:\nttthh.exe79⤵PID:2292
-
\??\c:\dvvjd.exec:\dvvjd.exe80⤵PID:3608
-
\??\c:\jvvpd.exec:\jvvpd.exe81⤵PID:2160
-
\??\c:\5flffrr.exec:\5flffrr.exe82⤵PID:3916
-
\??\c:\frllrlf.exec:\frllrlf.exe83⤵PID:4464
-
\??\c:\nhbtnn.exec:\nhbtnn.exe84⤵PID:2448
-
\??\c:\5hbtnn.exec:\5hbtnn.exe85⤵PID:804
-
\??\c:\pjppj.exec:\pjppj.exe86⤵PID:1580
-
\??\c:\rlllxxx.exec:\rlllxxx.exe87⤵PID:3564
-
\??\c:\rllffff.exec:\rllffff.exe88⤵PID:3428
-
\??\c:\hnhhbn.exec:\hnhhbn.exe89⤵PID:1828
-
\??\c:\nbbttn.exec:\nbbttn.exe90⤵PID:4696
-
\??\c:\5dvvp.exec:\5dvvp.exe91⤵PID:4964
-
\??\c:\djpjj.exec:\djpjj.exe92⤵PID:904
-
\??\c:\5rxrrrr.exec:\5rxrrrr.exe93⤵PID:844
-
\??\c:\rllfffr.exec:\rllfffr.exe94⤵PID:2128
-
\??\c:\hbbbbt.exec:\hbbbbt.exe95⤵PID:4660
-
\??\c:\pvvpj.exec:\pvvpj.exe96⤵PID:1896
-
\??\c:\vdvpd.exec:\vdvpd.exe97⤵PID:3792
-
\??\c:\frllxxr.exec:\frllxxr.exe98⤵PID:1932
-
\??\c:\lflfllf.exec:\lflfllf.exe99⤵PID:1156
-
\??\c:\bhhbbt.exec:\bhhbbt.exe100⤵PID:3388
-
\??\c:\nnttnt.exec:\nnttnt.exe101⤵PID:4488
-
\??\c:\pjjdp.exec:\pjjdp.exe102⤵PID:1864
-
\??\c:\jvjdp.exec:\jvjdp.exe103⤵PID:5008
-
\??\c:\xrllrrx.exec:\xrllrrx.exe104⤵PID:4176
-
\??\c:\bbhbnn.exec:\bbhbnn.exe105⤵PID:3556
-
\??\c:\hntnnn.exec:\hntnnn.exe106⤵PID:4892
-
\??\c:\jdddv.exec:\jdddv.exe107⤵PID:4664
-
\??\c:\vjjdv.exec:\vjjdv.exe108⤵PID:3660
-
\??\c:\rflfrll.exec:\rflfrll.exe109⤵PID:4316
-
\??\c:\lffxxxx.exec:\lffxxxx.exe110⤵PID:992
-
\??\c:\hbnhbb.exec:\hbnhbb.exe111⤵PID:4160
-
\??\c:\htbttn.exec:\htbttn.exe112⤵PID:232
-
\??\c:\vpdvp.exec:\vpdvp.exe113⤵PID:2132
-
\??\c:\xrrlfff.exec:\xrrlfff.exe114⤵PID:2308
-
\??\c:\lflllxr.exec:\lflllxr.exe115⤵PID:2712
-
\??\c:\xrrlxxr.exec:\xrrlxxr.exe116⤵PID:2360
-
\??\c:\tnnhhn.exec:\tnnhhn.exe117⤵PID:3328
-
\??\c:\jdjdv.exec:\jdjdv.exe118⤵PID:2872
-
\??\c:\pjjdp.exec:\pjjdp.exe119⤵PID:4472
-
\??\c:\9rffxff.exec:\9rffxff.exe120⤵PID:1608
-
\??\c:\rlllflf.exec:\rlllflf.exe121⤵PID:2340
-
\??\c:\tbnnbt.exec:\tbnnbt.exe122⤵PID:1484
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-