Analysis
-
max time kernel
150s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 06:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8a1a02fa3e5f25bffb9793edeca68590_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
8a1a02fa3e5f25bffb9793edeca68590_NeikiAnalytics.exe
-
Size
63KB
-
MD5
8a1a02fa3e5f25bffb9793edeca68590
-
SHA1
9fe5629489b9f57289dfd6e513b30ea5c91d9156
-
SHA256
22e8f2c6a3d9de38665978da91e22490edbd9e4d6caef1e869e0d61a43bdf45d
-
SHA512
0b5a8647eec9a77d271fd784352e7ee12695ec7af8fb617fc9c3b395eae65ad8fcaf9a0f1078debe00b5b6738c06a765c5260ed842eed9222e876bf9669a12a7
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8+Luvz:ymb3NkkiQ3mdBjF0yMlE
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/4140-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4360-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1936-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3324-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2872-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3288-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2104-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1116-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2336-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2772-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1516-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4876-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2992-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2216-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2304-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3464-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3496-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4000-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4644-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4744-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2324-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2360-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4360 ntntbh.exe 3324 nhhbhh.exe 1936 3dvvp.exe 2872 pvvpj.exe 1484 frllffr.exe 3288 tthnbt.exe 2104 bbbtbb.exe 1116 7vdvj.exe 2336 fxffrxr.exe 2772 tttnhh.exe 1516 pvjjd.exe 4876 rxxrfff.exe 3696 frrrlrr.exe 2992 ttbttt.exe 2216 pdjdv.exe 4920 rllffxx.exe 2304 9hnnnb.exe 4176 bnnnht.exe 776 pjpvd.exe 3464 3rllfff.exe 3496 httnnh.exe 2736 tbhbbb.exe 564 jpppj.exe 4000 1pvpj.exe 4644 lxxrxxx.exe 4744 bnbbtn.exe 3148 bhhhtt.exe 3972 vdjpv.exe 2324 fxlfrrr.exe 2360 xlrrrrr.exe 4736 9nntnn.exe 3452 djjpp.exe 4700 ppjjd.exe 4020 rrllfxx.exe 2996 bbbbtt.exe 2652 3nhnnh.exe 3712 1jjdv.exe 4792 vvpjd.exe 4476 pvvpp.exe 332 xfxxxrr.exe 3740 9hhtnt.exe 4208 dvvpp.exe 2932 5fffxff.exe 1372 xflrrxf.exe 3284 tnttnn.exe 1236 3ttnnn.exe 3956 ddjdd.exe 2104 fxxrrrl.exe 2328 9xlrrff.exe 1984 9htttt.exe 2772 nttnhb.exe 3688 ddvdd.exe 3436 lfffxff.exe 4344 lfxlfff.exe 1488 tbbhhb.exe 2264 jdvvd.exe 4088 7ddvd.exe 4772 xxrlffx.exe 2832 xlfxlxl.exe 3932 btnhtn.exe 3108 dpdpd.exe 2700 jddpj.exe 1016 frrlxxr.exe 4216 rlrllxx.exe -
resource yara_rule behavioral2/memory/4140-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4360-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1936-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3324-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2872-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3288-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1116-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2336-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2772-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2772-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1516-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4876-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2992-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2216-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2304-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3464-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3496-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4000-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4644-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4744-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2324-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2360-197-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4140 wrote to memory of 4360 4140 8a1a02fa3e5f25bffb9793edeca68590_NeikiAnalytics.exe 85 PID 4140 wrote to memory of 4360 4140 8a1a02fa3e5f25bffb9793edeca68590_NeikiAnalytics.exe 85 PID 4140 wrote to memory of 4360 4140 8a1a02fa3e5f25bffb9793edeca68590_NeikiAnalytics.exe 85 PID 4360 wrote to memory of 3324 4360 ntntbh.exe 86 PID 4360 wrote to memory of 3324 4360 ntntbh.exe 86 PID 4360 wrote to memory of 3324 4360 ntntbh.exe 86 PID 3324 wrote to memory of 1936 3324 nhhbhh.exe 87 PID 3324 wrote to memory of 1936 3324 nhhbhh.exe 87 PID 3324 wrote to memory of 1936 3324 nhhbhh.exe 87 PID 1936 wrote to memory of 2872 1936 3dvvp.exe 88 PID 1936 wrote to memory of 2872 1936 3dvvp.exe 88 PID 1936 wrote to memory of 2872 1936 3dvvp.exe 88 PID 2872 wrote to memory of 1484 2872 pvvpj.exe 89 PID 2872 wrote to memory of 1484 2872 pvvpj.exe 89 PID 2872 wrote to memory of 1484 2872 pvvpj.exe 89 PID 1484 wrote to memory of 3288 1484 frllffr.exe 90 PID 1484 wrote to memory of 3288 1484 frllffr.exe 90 PID 1484 wrote to memory of 3288 1484 frllffr.exe 90 PID 3288 wrote to memory of 2104 3288 tthnbt.exe 91 PID 3288 wrote to memory of 2104 3288 tthnbt.exe 91 PID 3288 wrote to memory of 2104 3288 tthnbt.exe 91 PID 2104 wrote to memory of 1116 2104 bbbtbb.exe 92 PID 2104 wrote to memory of 1116 2104 bbbtbb.exe 92 PID 2104 wrote to memory of 1116 2104 bbbtbb.exe 92 PID 1116 wrote to memory of 2336 1116 7vdvj.exe 93 PID 1116 wrote to memory of 2336 1116 7vdvj.exe 93 PID 1116 wrote to memory of 2336 1116 7vdvj.exe 93 PID 2336 wrote to memory of 2772 2336 fxffrxr.exe 94 PID 2336 wrote to memory of 2772 2336 fxffrxr.exe 94 PID 2336 wrote to memory of 2772 2336 fxffrxr.exe 94 PID 2772 wrote to memory of 1516 2772 tttnhh.exe 95 PID 2772 wrote to memory of 1516 2772 tttnhh.exe 95 PID 2772 wrote to memory of 1516 2772 tttnhh.exe 95 PID 1516 wrote to memory of 4876 1516 pvjjd.exe 96 PID 1516 wrote to memory of 4876 1516 pvjjd.exe 96 PID 1516 wrote to memory of 4876 1516 pvjjd.exe 96 PID 4876 wrote to memory of 3696 4876 rxxrfff.exe 97 PID 4876 wrote to memory of 3696 4876 rxxrfff.exe 97 PID 4876 wrote to memory of 3696 4876 rxxrfff.exe 97 PID 3696 wrote to memory of 2992 3696 frrrlrr.exe 98 PID 3696 wrote to memory of 2992 3696 frrrlrr.exe 98 PID 3696 wrote to memory of 2992 3696 frrrlrr.exe 98 PID 2992 wrote to memory of 2216 2992 ttbttt.exe 99 PID 2992 wrote to memory of 2216 2992 ttbttt.exe 99 PID 2992 wrote to memory of 2216 2992 ttbttt.exe 99 PID 2216 wrote to memory of 4920 2216 pdjdv.exe 100 PID 2216 wrote to memory of 4920 2216 pdjdv.exe 100 PID 2216 wrote to memory of 4920 2216 pdjdv.exe 100 PID 4920 wrote to memory of 2304 4920 rllffxx.exe 101 PID 4920 wrote to memory of 2304 4920 rllffxx.exe 101 PID 4920 wrote to memory of 2304 4920 rllffxx.exe 101 PID 2304 wrote to memory of 4176 2304 9hnnnb.exe 102 PID 2304 wrote to memory of 4176 2304 9hnnnb.exe 102 PID 2304 wrote to memory of 4176 2304 9hnnnb.exe 102 PID 4176 wrote to memory of 776 4176 bnnnht.exe 103 PID 4176 wrote to memory of 776 4176 bnnnht.exe 103 PID 4176 wrote to memory of 776 4176 bnnnht.exe 103 PID 776 wrote to memory of 3464 776 pjpvd.exe 104 PID 776 wrote to memory of 3464 776 pjpvd.exe 104 PID 776 wrote to memory of 3464 776 pjpvd.exe 104 PID 3464 wrote to memory of 3496 3464 3rllfff.exe 105 PID 3464 wrote to memory of 3496 3464 3rllfff.exe 105 PID 3464 wrote to memory of 3496 3464 3rllfff.exe 105 PID 3496 wrote to memory of 2736 3496 httnnh.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a1a02fa3e5f25bffb9793edeca68590_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8a1a02fa3e5f25bffb9793edeca68590_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\ntntbh.exec:\ntntbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\nhhbhh.exec:\nhhbhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
\??\c:\3dvvp.exec:\3dvvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\pvvpj.exec:\pvvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\frllffr.exec:\frllffr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\tthnbt.exec:\tthnbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\bbbtbb.exec:\bbbtbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\7vdvj.exec:\7vdvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\fxffrxr.exec:\fxffrxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\tttnhh.exec:\tttnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\pvjjd.exec:\pvjjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\rxxrfff.exec:\rxxrfff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\frrrlrr.exec:\frrrlrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\ttbttt.exec:\ttbttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\pdjdv.exec:\pdjdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\rllffxx.exec:\rllffxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\9hnnnb.exec:\9hnnnb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\bnnnht.exec:\bnnnht.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
\??\c:\pjpvd.exec:\pjpvd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\3rllfff.exec:\3rllfff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
\??\c:\httnnh.exec:\httnnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\tbhbbb.exec:\tbhbbb.exe23⤵
- Executes dropped EXE
PID:2736 -
\??\c:\jpppj.exec:\jpppj.exe24⤵
- Executes dropped EXE
PID:564 -
\??\c:\1pvpj.exec:\1pvpj.exe25⤵
- Executes dropped EXE
PID:4000 -
\??\c:\lxxrxxx.exec:\lxxrxxx.exe26⤵
- Executes dropped EXE
PID:4644 -
\??\c:\bnbbtn.exec:\bnbbtn.exe27⤵
- Executes dropped EXE
PID:4744 -
\??\c:\bhhhtt.exec:\bhhhtt.exe28⤵
- Executes dropped EXE
PID:3148 -
\??\c:\vdjpv.exec:\vdjpv.exe29⤵
- Executes dropped EXE
PID:3972 -
\??\c:\fxlfrrr.exec:\fxlfrrr.exe30⤵
- Executes dropped EXE
PID:2324 -
\??\c:\xlrrrrr.exec:\xlrrrrr.exe31⤵
- Executes dropped EXE
PID:2360 -
\??\c:\9nntnn.exec:\9nntnn.exe32⤵
- Executes dropped EXE
PID:4736 -
\??\c:\djjpp.exec:\djjpp.exe33⤵
- Executes dropped EXE
PID:3452 -
\??\c:\ppjjd.exec:\ppjjd.exe34⤵
- Executes dropped EXE
PID:4700 -
\??\c:\rrllfxx.exec:\rrllfxx.exe35⤵
- Executes dropped EXE
PID:4020 -
\??\c:\bbbbtt.exec:\bbbbtt.exe36⤵
- Executes dropped EXE
PID:2996 -
\??\c:\3nhnnh.exec:\3nhnnh.exe37⤵
- Executes dropped EXE
PID:2652 -
\??\c:\1jjdv.exec:\1jjdv.exe38⤵
- Executes dropped EXE
PID:3712 -
\??\c:\vvpjd.exec:\vvpjd.exe39⤵
- Executes dropped EXE
PID:4792 -
\??\c:\pvvpp.exec:\pvvpp.exe40⤵
- Executes dropped EXE
PID:4476 -
\??\c:\xfxxxrr.exec:\xfxxxrr.exe41⤵
- Executes dropped EXE
PID:332 -
\??\c:\9hhtnt.exec:\9hhtnt.exe42⤵
- Executes dropped EXE
PID:3740 -
\??\c:\dvvpp.exec:\dvvpp.exe43⤵
- Executes dropped EXE
PID:4208 -
\??\c:\5fffxff.exec:\5fffxff.exe44⤵
- Executes dropped EXE
PID:2932 -
\??\c:\xflrrxf.exec:\xflrrxf.exe45⤵
- Executes dropped EXE
PID:1372 -
\??\c:\tnttnn.exec:\tnttnn.exe46⤵
- Executes dropped EXE
PID:3284 -
\??\c:\3ttnnn.exec:\3ttnnn.exe47⤵
- Executes dropped EXE
PID:1236 -
\??\c:\ddjdd.exec:\ddjdd.exe48⤵
- Executes dropped EXE
PID:3956 -
\??\c:\fxxrrrl.exec:\fxxrrrl.exe49⤵
- Executes dropped EXE
PID:2104 -
\??\c:\9xlrrff.exec:\9xlrrff.exe50⤵
- Executes dropped EXE
PID:2328 -
\??\c:\9htttt.exec:\9htttt.exe51⤵
- Executes dropped EXE
PID:1984 -
\??\c:\nttnhb.exec:\nttnhb.exe52⤵
- Executes dropped EXE
PID:2772 -
\??\c:\ddvdd.exec:\ddvdd.exe53⤵
- Executes dropped EXE
PID:3688 -
\??\c:\lfffxff.exec:\lfffxff.exe54⤵
- Executes dropped EXE
PID:3436 -
\??\c:\lfxlfff.exec:\lfxlfff.exe55⤵
- Executes dropped EXE
PID:4344 -
\??\c:\tbbhhb.exec:\tbbhhb.exe56⤵
- Executes dropped EXE
PID:1488 -
\??\c:\jdvvd.exec:\jdvvd.exe57⤵
- Executes dropped EXE
PID:2264 -
\??\c:\7ddvd.exec:\7ddvd.exe58⤵
- Executes dropped EXE
PID:4088 -
\??\c:\xxrlffx.exec:\xxrlffx.exe59⤵
- Executes dropped EXE
PID:4772 -
\??\c:\xlfxlxl.exec:\xlfxlxl.exe60⤵
- Executes dropped EXE
PID:2832 -
\??\c:\btnhtn.exec:\btnhtn.exe61⤵
- Executes dropped EXE
PID:3932 -
\??\c:\dpdpd.exec:\dpdpd.exe62⤵
- Executes dropped EXE
PID:3108 -
\??\c:\jddpj.exec:\jddpj.exe63⤵
- Executes dropped EXE
PID:2700 -
\??\c:\frrlxxr.exec:\frrlxxr.exe64⤵
- Executes dropped EXE
PID:1016 -
\??\c:\rlrllxx.exec:\rlrllxx.exe65⤵
- Executes dropped EXE
PID:4216 -
\??\c:\hbtbtt.exec:\hbtbtt.exe66⤵PID:3648
-
\??\c:\vpjvj.exec:\vpjvj.exe67⤵PID:2076
-
\??\c:\3jvpd.exec:\3jvpd.exe68⤵PID:396
-
\??\c:\3lfrfxr.exec:\3lfrfxr.exe69⤵PID:1460
-
\??\c:\hbtnbt.exec:\hbtnbt.exe70⤵PID:3456
-
\??\c:\htntnt.exec:\htntnt.exe71⤵PID:4160
-
\??\c:\1pppd.exec:\1pppd.exe72⤵PID:5008
-
\??\c:\djjpd.exec:\djjpd.exe73⤵PID:2628
-
\??\c:\rfrlxfx.exec:\rfrlxfx.exe74⤵PID:408
-
\??\c:\xlfxrlf.exec:\xlfxrlf.exe75⤵PID:1772
-
\??\c:\tbtnbn.exec:\tbtnbn.exe76⤵PID:5048
-
\??\c:\vdvvj.exec:\vdvvj.exe77⤵PID:3420
-
\??\c:\djjvj.exec:\djjvj.exe78⤵PID:2948
-
\??\c:\rrxlxrf.exec:\rrxlxrf.exe79⤵PID:448
-
\??\c:\xfrrlfx.exec:\xfrrlfx.exe80⤵PID:4436
-
\??\c:\7tnthb.exec:\7tnthb.exe81⤵PID:2928
-
\??\c:\tbbtnn.exec:\tbbtnn.exe82⤵PID:5060
-
\??\c:\dddjp.exec:\dddjp.exe83⤵PID:4756
-
\??\c:\rfrfrfx.exec:\rfrfrfx.exe84⤵PID:4328
-
\??\c:\fffxrxr.exec:\fffxrxr.exe85⤵PID:3472
-
\??\c:\dpvpp.exec:\dpvpp.exe86⤵PID:3788
-
\??\c:\pjdvv.exec:\pjdvv.exe87⤵PID:1168
-
\??\c:\lxrlxlf.exec:\lxrlxlf.exe88⤵PID:2592
-
\??\c:\bhbtnb.exec:\bhbtnb.exe89⤵PID:3500
-
\??\c:\9nhbnh.exec:\9nhbnh.exe90⤵PID:2084
-
\??\c:\jjjvp.exec:\jjjvp.exe91⤵PID:4840
-
\??\c:\7ffrllf.exec:\7ffrllf.exe92⤵PID:2120
-
\??\c:\rfflfxx.exec:\rfflfxx.exe93⤵PID:228
-
\??\c:\tntnhh.exec:\tntnhh.exe94⤵PID:3980
-
\??\c:\btbtnn.exec:\btbtnn.exe95⤵PID:4360
-
\??\c:\pdjdd.exec:\pdjdd.exe96⤵PID:3948
-
\??\c:\frxxrrl.exec:\frxxrrl.exe97⤵PID:8
-
\??\c:\lxffxff.exec:\lxffxff.exe98⤵PID:2340
-
\??\c:\btttnn.exec:\btttnn.exe99⤵PID:4596
-
\??\c:\nnbbnb.exec:\nnbbnb.exe100⤵PID:3656
-
\??\c:\pjvpp.exec:\pjvpp.exe101⤵PID:2900
-
\??\c:\frlxlxl.exec:\frlxlxl.exe102⤵PID:4876
-
\??\c:\rxxrllf.exec:\rxxrllf.exe103⤵PID:2280
-
\??\c:\bnnhtn.exec:\bnnhtn.exe104⤵PID:1224
-
\??\c:\nhhbtt.exec:\nhhbtt.exe105⤵PID:4340
-
\??\c:\jddpj.exec:\jddpj.exe106⤵PID:1492
-
\??\c:\ppvpp.exec:\ppvpp.exe107⤵PID:2212
-
\??\c:\xxrlrrx.exec:\xxrlrrx.exe108⤵PID:4860
-
\??\c:\3thhtt.exec:\3thhtt.exe109⤵PID:3756
-
\??\c:\bhthtn.exec:\bhthtn.exe110⤵PID:3412
-
\??\c:\7ppdd.exec:\7ppdd.exe111⤵PID:3232
-
\??\c:\jpjpd.exec:\jpjpd.exe112⤵PID:2548
-
\??\c:\lffrfff.exec:\lffrfff.exe113⤵PID:1412
-
\??\c:\xxfrrlf.exec:\xxfrrlf.exe114⤵PID:984
-
\??\c:\hnhbnb.exec:\hnhbnb.exe115⤵PID:4400
-
\??\c:\jvvpd.exec:\jvvpd.exe116⤵PID:2796
-
\??\c:\5vvpj.exec:\5vvpj.exe117⤵PID:1680
-
\??\c:\9rxrrlf.exec:\9rxrrlf.exe118⤵PID:4628
-
\??\c:\7bhhnh.exec:\7bhhnh.exe119⤵PID:2196
-
\??\c:\tntnhh.exec:\tntnhh.exe120⤵PID:4160
-
\??\c:\3ddvp.exec:\3ddvp.exe121⤵PID:3148
-
\??\c:\pjppd.exec:\pjppd.exe122⤵PID:2628
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-