Analysis
-
max time kernel
150s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29/06/2024, 15:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b1b7c999f1949ff9be45f94301553bd8e8ffd8f56485d99c97934085b90748c6_NeikiAnalytics.exe
Resource
win7-20240611-en
5 signatures
150 seconds
General
-
Target
b1b7c999f1949ff9be45f94301553bd8e8ffd8f56485d99c97934085b90748c6_NeikiAnalytics.exe
-
Size
229KB
-
MD5
a52eebb1c6d3430458c6366141dc8e80
-
SHA1
00e3791e1aca4d3d7f307243b4c84a6672eea9bf
-
SHA256
b1b7c999f1949ff9be45f94301553bd8e8ffd8f56485d99c97934085b90748c6
-
SHA512
b69cf4b4e588df8de4c18f9591e5fc69a2565fa9a4eef3ceaea7b99e597467c85fa3ae6d48df0181e08a4aef806a9770fdab67209dbe7630d0ed5d94cdd1b6b9
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xLn/c1N4:n3C9BRo7MlrWKo+lxKk16
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/1012-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3400-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/32-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4888-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1892-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4696-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2884-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1852-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4960-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3528-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4108-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4296-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2844-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4748-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3064-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3720-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1956-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/316-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3084-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3460-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1824-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1188-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3248-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/604-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3708-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3400 hnnhbn.exe 32 9jpjv.exe 4888 7lllffx.exe 1412 dppjd.exe 1892 tnhnhh.exe 4696 dpjdp.exe 2884 rlfrlll.exe 1852 ttbtnn.exe 4960 jpppj.exe 3528 tnnhhb.exe 4160 pppdp.exe 4296 xrxxlfx.exe 4108 hhtnbt.exe 1616 1ddpj.exe 2844 7jpjv.exe 4748 bthbtt.exe 3064 xlffxxx.exe 3720 hbtnnh.exe 1368 tbhtnn.exe 1956 rlrlrff.exe 3708 flfxllx.exe 856 htthbt.exe 604 pppjv.exe 3248 jdvdd.exe 316 frrxlfx.exe 4468 3xrlffx.exe 3716 bnbhtt.exe 1188 tttnbt.exe 1824 djdvj.exe 3084 rffrfxr.exe 3460 ntnhth.exe 2432 jdppd.exe 2280 jpddv.exe 2216 9lfxrlf.exe 1772 xrxrfff.exe 5100 nnnhhb.exe 1944 nbbbtt.exe 2016 dpppj.exe 3364 vpjdp.exe 3532 lffxllf.exe 1940 lxxfxfx.exe 2220 nbtnhb.exe 3944 btthbt.exe 1908 tnttnn.exe 1532 7vjvp.exe 4984 ddvjj.exe 2320 5xxrlrr.exe 3388 ddppj.exe 4340 ppddp.exe 4492 vpvvj.exe 3424 9nhbbt.exe 4728 jvdpj.exe 3400 xrrlfxr.exe 904 fllllrr.exe 2504 btttnn.exe 2472 pddvv.exe 3768 jpvvp.exe 4796 1ffxrrr.exe 2960 tbhbbt.exe 4688 vvdjd.exe 3488 frfxxfx.exe 2752 nbhtnh.exe 5016 bnhbbb.exe 2580 nnbtnb.exe -
resource yara_rule behavioral2/memory/1012-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3400-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/32-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1412-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1892-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4696-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2884-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1852-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1852-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4960-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3528-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3528-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4108-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4296-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2844-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4748-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3064-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3720-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1956-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/316-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3084-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3460-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1824-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1188-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3248-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/604-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3708-147-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1012 wrote to memory of 3400 1012 b1b7c999f1949ff9be45f94301553bd8e8ffd8f56485d99c97934085b90748c6_NeikiAnalytics.exe 81 PID 1012 wrote to memory of 3400 1012 b1b7c999f1949ff9be45f94301553bd8e8ffd8f56485d99c97934085b90748c6_NeikiAnalytics.exe 81 PID 1012 wrote to memory of 3400 1012 b1b7c999f1949ff9be45f94301553bd8e8ffd8f56485d99c97934085b90748c6_NeikiAnalytics.exe 81 PID 3400 wrote to memory of 32 3400 hnnhbn.exe 82 PID 3400 wrote to memory of 32 3400 hnnhbn.exe 82 PID 3400 wrote to memory of 32 3400 hnnhbn.exe 82 PID 32 wrote to memory of 4888 32 9jpjv.exe 83 PID 32 wrote to memory of 4888 32 9jpjv.exe 83 PID 32 wrote to memory of 4888 32 9jpjv.exe 83 PID 4888 wrote to memory of 1412 4888 7lllffx.exe 84 PID 4888 wrote to memory of 1412 4888 7lllffx.exe 84 PID 4888 wrote to memory of 1412 4888 7lllffx.exe 84 PID 1412 wrote to memory of 1892 1412 dppjd.exe 85 PID 1412 wrote to memory of 1892 1412 dppjd.exe 85 PID 1412 wrote to memory of 1892 1412 dppjd.exe 85 PID 1892 wrote to memory of 4696 1892 tnhnhh.exe 86 PID 1892 wrote to memory of 4696 1892 tnhnhh.exe 86 PID 1892 wrote to memory of 4696 1892 tnhnhh.exe 86 PID 4696 wrote to memory of 2884 4696 dpjdp.exe 87 PID 4696 wrote to memory of 2884 4696 dpjdp.exe 87 PID 4696 wrote to memory of 2884 4696 dpjdp.exe 87 PID 2884 wrote to memory of 1852 2884 rlfrlll.exe 88 PID 2884 wrote to memory of 1852 2884 rlfrlll.exe 88 PID 2884 wrote to memory of 1852 2884 rlfrlll.exe 88 PID 1852 wrote to memory of 4960 1852 ttbtnn.exe 89 PID 1852 wrote to memory of 4960 1852 ttbtnn.exe 89 PID 1852 wrote to memory of 4960 1852 ttbtnn.exe 89 PID 4960 wrote to memory of 3528 4960 jpppj.exe 90 PID 4960 wrote to memory of 3528 4960 jpppj.exe 90 PID 4960 wrote to memory of 3528 4960 jpppj.exe 90 PID 3528 wrote to memory of 4160 3528 tnnhhb.exe 91 PID 3528 wrote to memory of 4160 3528 tnnhhb.exe 91 PID 3528 wrote to memory of 4160 3528 tnnhhb.exe 91 PID 4160 wrote to memory of 4296 4160 pppdp.exe 92 PID 4160 wrote to memory of 4296 4160 pppdp.exe 92 PID 4160 wrote to memory of 4296 4160 pppdp.exe 92 PID 4296 wrote to memory of 4108 4296 xrxxlfx.exe 93 PID 4296 wrote to memory of 4108 4296 xrxxlfx.exe 93 PID 4296 wrote to memory of 4108 4296 xrxxlfx.exe 93 PID 4108 wrote to memory of 1616 4108 hhtnbt.exe 94 PID 4108 wrote to memory of 1616 4108 hhtnbt.exe 94 PID 4108 wrote to memory of 1616 4108 hhtnbt.exe 94 PID 1616 wrote to memory of 2844 1616 1ddpj.exe 95 PID 1616 wrote to memory of 2844 1616 1ddpj.exe 95 PID 1616 wrote to memory of 2844 1616 1ddpj.exe 95 PID 2844 wrote to memory of 4748 2844 7jpjv.exe 96 PID 2844 wrote to memory of 4748 2844 7jpjv.exe 96 PID 2844 wrote to memory of 4748 2844 7jpjv.exe 96 PID 4748 wrote to memory of 3064 4748 bthbtt.exe 97 PID 4748 wrote to memory of 3064 4748 bthbtt.exe 97 PID 4748 wrote to memory of 3064 4748 bthbtt.exe 97 PID 3064 wrote to memory of 3720 3064 xlffxxx.exe 98 PID 3064 wrote to memory of 3720 3064 xlffxxx.exe 98 PID 3064 wrote to memory of 3720 3064 xlffxxx.exe 98 PID 3720 wrote to memory of 1368 3720 hbtnnh.exe 99 PID 3720 wrote to memory of 1368 3720 hbtnnh.exe 99 PID 3720 wrote to memory of 1368 3720 hbtnnh.exe 99 PID 1368 wrote to memory of 1956 1368 tbhtnn.exe 100 PID 1368 wrote to memory of 1956 1368 tbhtnn.exe 100 PID 1368 wrote to memory of 1956 1368 tbhtnn.exe 100 PID 1956 wrote to memory of 3708 1956 rlrlrff.exe 101 PID 1956 wrote to memory of 3708 1956 rlrlrff.exe 101 PID 1956 wrote to memory of 3708 1956 rlrlrff.exe 101 PID 3708 wrote to memory of 856 3708 flfxllx.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1b7c999f1949ff9be45f94301553bd8e8ffd8f56485d99c97934085b90748c6_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b1b7c999f1949ff9be45f94301553bd8e8ffd8f56485d99c97934085b90748c6_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\hnnhbn.exec:\hnnhbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
\??\c:\9jpjv.exec:\9jpjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:32 -
\??\c:\7lllffx.exec:\7lllffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\dppjd.exec:\dppjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\tnhnhh.exec:\tnhnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\dpjdp.exec:\dpjdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\rlfrlll.exec:\rlfrlll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\ttbtnn.exec:\ttbtnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\jpppj.exec:\jpppj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\tnnhhb.exec:\tnnhhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\pppdp.exec:\pppdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\xrxxlfx.exec:\xrxxlfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\hhtnbt.exec:\hhtnbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
\??\c:\1ddpj.exec:\1ddpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\7jpjv.exec:\7jpjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\bthbtt.exec:\bthbtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\xlffxxx.exec:\xlffxxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\hbtnnh.exec:\hbtnnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\tbhtnn.exec:\tbhtnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\rlrlrff.exec:\rlrlrff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\flfxllx.exec:\flfxllx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\htthbt.exec:\htthbt.exe23⤵
- Executes dropped EXE
PID:856 -
\??\c:\pppjv.exec:\pppjv.exe24⤵
- Executes dropped EXE
PID:604 -
\??\c:\jdvdd.exec:\jdvdd.exe25⤵
- Executes dropped EXE
PID:3248 -
\??\c:\frrxlfx.exec:\frrxlfx.exe26⤵
- Executes dropped EXE
PID:316 -
\??\c:\3xrlffx.exec:\3xrlffx.exe27⤵
- Executes dropped EXE
PID:4468 -
\??\c:\bnbhtt.exec:\bnbhtt.exe28⤵
- Executes dropped EXE
PID:3716 -
\??\c:\tttnbt.exec:\tttnbt.exe29⤵
- Executes dropped EXE
PID:1188 -
\??\c:\djdvj.exec:\djdvj.exe30⤵
- Executes dropped EXE
PID:1824 -
\??\c:\rffrfxr.exec:\rffrfxr.exe31⤵
- Executes dropped EXE
PID:3084 -
\??\c:\ntnhth.exec:\ntnhth.exe32⤵
- Executes dropped EXE
PID:3460 -
\??\c:\jdppd.exec:\jdppd.exe33⤵
- Executes dropped EXE
PID:2432 -
\??\c:\jpddv.exec:\jpddv.exe34⤵
- Executes dropped EXE
PID:2280 -
\??\c:\9lfxrlf.exec:\9lfxrlf.exe35⤵
- Executes dropped EXE
PID:2216 -
\??\c:\xrxrfff.exec:\xrxrfff.exe36⤵
- Executes dropped EXE
PID:1772 -
\??\c:\nnnhhb.exec:\nnnhhb.exe37⤵
- Executes dropped EXE
PID:5100 -
\??\c:\nbbbtt.exec:\nbbbtt.exe38⤵
- Executes dropped EXE
PID:1944 -
\??\c:\dpppj.exec:\dpppj.exe39⤵
- Executes dropped EXE
PID:2016 -
\??\c:\vpjdp.exec:\vpjdp.exe40⤵
- Executes dropped EXE
PID:3364 -
\??\c:\lffxllf.exec:\lffxllf.exe41⤵
- Executes dropped EXE
PID:3532 -
\??\c:\lxxfxfx.exec:\lxxfxfx.exe42⤵
- Executes dropped EXE
PID:1940 -
\??\c:\nbtnhb.exec:\nbtnhb.exe43⤵
- Executes dropped EXE
PID:2220 -
\??\c:\btthbt.exec:\btthbt.exe44⤵
- Executes dropped EXE
PID:3944 -
\??\c:\tnttnn.exec:\tnttnn.exe45⤵
- Executes dropped EXE
PID:1908 -
\??\c:\7vjvp.exec:\7vjvp.exe46⤵
- Executes dropped EXE
PID:1532 -
\??\c:\ddvjj.exec:\ddvjj.exe47⤵
- Executes dropped EXE
PID:4984 -
\??\c:\5xxrlrr.exec:\5xxrlrr.exe48⤵
- Executes dropped EXE
PID:2320 -
\??\c:\ddppj.exec:\ddppj.exe49⤵
- Executes dropped EXE
PID:3388 -
\??\c:\ppddp.exec:\ppddp.exe50⤵
- Executes dropped EXE
PID:4340 -
\??\c:\vpvvj.exec:\vpvvj.exe51⤵
- Executes dropped EXE
PID:4492 -
\??\c:\9nhbbt.exec:\9nhbbt.exe52⤵
- Executes dropped EXE
PID:3424 -
\??\c:\jvdpj.exec:\jvdpj.exe53⤵
- Executes dropped EXE
PID:4728 -
\??\c:\xrrlfxr.exec:\xrrlfxr.exe54⤵
- Executes dropped EXE
PID:3400 -
\??\c:\fllllrr.exec:\fllllrr.exe55⤵
- Executes dropped EXE
PID:904 -
\??\c:\btttnn.exec:\btttnn.exe56⤵
- Executes dropped EXE
PID:2504 -
\??\c:\pddvv.exec:\pddvv.exe57⤵
- Executes dropped EXE
PID:2472 -
\??\c:\jpvvp.exec:\jpvvp.exe58⤵
- Executes dropped EXE
PID:3768 -
\??\c:\1ffxrrr.exec:\1ffxrrr.exe59⤵
- Executes dropped EXE
PID:4796 -
\??\c:\tbhbbt.exec:\tbhbbt.exe60⤵
- Executes dropped EXE
PID:2960 -
\??\c:\vvdjd.exec:\vvdjd.exe61⤵
- Executes dropped EXE
PID:4688 -
\??\c:\frfxxfx.exec:\frfxxfx.exe62⤵
- Executes dropped EXE
PID:3488 -
\??\c:\nbhtnh.exec:\nbhtnh.exe63⤵
- Executes dropped EXE
PID:2752 -
\??\c:\bnhbbb.exec:\bnhbbb.exe64⤵
- Executes dropped EXE
PID:5016 -
\??\c:\nnbtnb.exec:\nnbtnb.exe65⤵
- Executes dropped EXE
PID:2580 -
\??\c:\vvvpd.exec:\vvvpd.exe66⤵PID:4104
-
\??\c:\rxxrffx.exec:\rxxrffx.exe67⤵PID:1160
-
\??\c:\7lfxllf.exec:\7lfxllf.exe68⤵PID:3528
-
\??\c:\hhnnnh.exec:\hhnnnh.exe69⤵PID:4716
-
\??\c:\vpppv.exec:\vpppv.exe70⤵PID:4780
-
\??\c:\jvdvj.exec:\jvdvj.exe71⤵PID:4108
-
\??\c:\xfxrllx.exec:\xfxrllx.exe72⤵PID:5004
-
\??\c:\xllxlll.exec:\xllxlll.exe73⤵PID:2572
-
\??\c:\hbtnht.exec:\hbtnht.exe74⤵PID:1296
-
\??\c:\5bhntn.exec:\5bhntn.exe75⤵PID:3156
-
\??\c:\jvvpj.exec:\jvvpj.exe76⤵PID:696
-
\??\c:\rfxlfxr.exec:\rfxlfxr.exe77⤵PID:3200
-
\??\c:\bntnnh.exec:\bntnnh.exe78⤵PID:1084
-
\??\c:\ttbtnh.exec:\ttbtnh.exe79⤵PID:2444
-
\??\c:\jpvvj.exec:\jpvvj.exe80⤵PID:5076
-
\??\c:\vddvp.exec:\vddvp.exe81⤵PID:2368
-
\??\c:\xfxrlfx.exec:\xfxrlfx.exe82⤵PID:4516
-
\??\c:\fxxrrrf.exec:\fxxrrrf.exe83⤵PID:3692
-
\??\c:\hbnnnn.exec:\hbnnnn.exe84⤵PID:2476
-
\??\c:\vdjdp.exec:\vdjdp.exe85⤵PID:4628
-
\??\c:\1djdj.exec:\1djdj.exe86⤵PID:332
-
\??\c:\xrrrlfx.exec:\xrrrlfx.exe87⤵PID:4620
-
\??\c:\hhhttt.exec:\hhhttt.exe88⤵PID:964
-
\??\c:\hntnhh.exec:\hntnhh.exe89⤵PID:4260
-
\??\c:\vjpjv.exec:\vjpjv.exe90⤵PID:1824
-
\??\c:\jddpd.exec:\jddpd.exe91⤵PID:2480
-
\??\c:\xrxlfff.exec:\xrxlfff.exe92⤵PID:1268
-
\??\c:\hbbtnn.exec:\hbbtnn.exe93⤵PID:5044
-
\??\c:\dvppd.exec:\dvppd.exe94⤵PID:4292
-
\??\c:\jddvp.exec:\jddvp.exe95⤵PID:2516
-
\??\c:\rfllfff.exec:\rfllfff.exe96⤵PID:4504
-
\??\c:\rrfxxxl.exec:\rrfxxxl.exe97⤵PID:1904
-
\??\c:\bttnhh.exec:\bttnhh.exe98⤵PID:232
-
\??\c:\ddjjj.exec:\ddjjj.exe99⤵PID:2040
-
\??\c:\jvjdv.exec:\jvjdv.exe100⤵PID:3992
-
\??\c:\1fllxxl.exec:\1fllxxl.exe101⤵PID:1476
-
\??\c:\rlrrlll.exec:\rlrrlll.exe102⤵PID:2008
-
\??\c:\thhhbh.exec:\thhhbh.exe103⤵PID:2036
-
\??\c:\pppjd.exec:\pppjd.exe104⤵PID:4460
-
\??\c:\lxxxrrl.exec:\lxxxrrl.exe105⤵PID:2104
-
\??\c:\rxflfxx.exec:\rxflfxx.exe106⤵PID:3724
-
\??\c:\bttnhh.exec:\bttnhh.exe107⤵PID:1184
-
\??\c:\ttbtnh.exec:\ttbtnh.exe108⤵PID:1492
-
\??\c:\pjpdd.exec:\pjpdd.exe109⤵PID:1260
-
\??\c:\fxfxxlx.exec:\fxfxxlx.exe110⤵PID:3080
-
\??\c:\rfxrlfx.exec:\rfxrlfx.exe111⤵PID:1624
-
\??\c:\tnnbtn.exec:\tnnbtn.exe112⤵PID:4328
-
\??\c:\vpvpd.exec:\vpvpd.exe113⤵PID:1884
-
\??\c:\vppjv.exec:\vppjv.exe114⤵PID:1012
-
\??\c:\rlrlffx.exec:\rlrlffx.exe115⤵PID:4600
-
\??\c:\tnhbtt.exec:\tnhbtt.exe116⤵PID:4044
-
\??\c:\httnhb.exec:\httnhb.exe117⤵PID:2528
-
\??\c:\vvjjd.exec:\vvjjd.exe118⤵PID:4452
-
\??\c:\rlxlflr.exec:\rlxlflr.exe119⤵PID:1396
-
\??\c:\bthbhh.exec:\bthbhh.exe120⤵PID:1248
-
\??\c:\1thbtt.exec:\1thbtt.exe121⤵PID:3576
-
\??\c:\ppvpd.exec:\ppvpd.exe122⤵PID:2364
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-