Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 06:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8f57ca52680dc1dd132ac968f5abc910_NeikiAnalytics.exe
Resource
win7-20240221-en
4 signatures
150 seconds
General
-
Target
8f57ca52680dc1dd132ac968f5abc910_NeikiAnalytics.exe
-
Size
174KB
-
MD5
8f57ca52680dc1dd132ac968f5abc910
-
SHA1
1ec7ed1c6a8acf9ab7dd3325f4f1128f563cb60f
-
SHA256
94e4d96aefeed71da3cd0af1e8012bebd7ffc46a1615e4d84045205e6e6fe00a
-
SHA512
c988da547b6c46c738e9c706b39eaadc2a8c97d8d529715cc2c19b411ecaa48effe5e3669711be1a40b8fc544f71ed2dec7e84bfecf783025810d1a1dccbed69
-
SSDEEP
3072:fhOmTsF93UYfwC6GIoutXGvBZrQlmUzpi8rY9AABa1YRMxlHCM2fDL:fcm4FmowdHoSXGZEBzddWhROiM2/
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3464-6-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4412-8-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3548-13-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3892-24-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4480-19-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3196-32-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4576-42-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2260-55-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1664-50-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1008-92-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2696-87-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2800-98-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2800-103-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3732-109-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1332-115-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1676-121-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/5068-134-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2032-141-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1000-124-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4104-151-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1136-152-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3124-76-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1232-74-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2656-64-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1288-62-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/704-164-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4920-192-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/556-210-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2936-216-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3120-224-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4556-229-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4720-238-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/5020-242-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4936-249-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2584-259-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4892-275-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2792-289-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3104-302-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4396-306-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1676-310-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2436-319-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2244-323-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3836-328-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4032-359-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2528-363-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3644-374-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1852-409-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4428-422-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4536-459-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/548-487-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/808-536-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2624-556-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2916-572-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4560-576-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4372-645-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4740-750-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3288-759-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2792-832-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3732-840-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1516-900-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4056-965-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4844-1024-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2428-1121-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3588-1212-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4412 lxlllff.exe 3548 lflrfff.exe 4480 hbtbtb.exe 3892 3dddv.exe 3196 vpjdp.exe 4576 3tttnn.exe 1664 dvjdv.exe 2260 pdvvp.exe 1288 thhtnn.exe 2656 hhnhhb.exe 1232 5jjdv.exe 3124 rlrllff.exe 3020 rxlffxl.exe 2696 nhhtth.exe 1008 htnttb.exe 2800 5ppjv.exe 3732 5tthbt.exe 1332 bttttt.exe 1676 vvpdj.exe 1000 fxxrrrl.exe 576 thnhtt.exe 5068 7bbtnn.exe 2032 bnbtnh.exe 4104 jjjdj.exe 1136 hbnthb.exe 704 3tthbt.exe 2020 xrrxxxl.exe 808 tbtnnh.exe 4264 jdvpj.exe 2988 lffxlfl.exe 4384 hbhbbt.exe 4920 pjdvp.exe 5052 ffxffrl.exe 380 bnbttt.exe 1504 ddjjd.exe 3344 vvvvv.exe 4024 xlrrrrl.exe 556 nhtntt.exe 2936 7pvpj.exe 4560 ppddv.exe 3120 thnhhh.exe 2324 bbtttt.exe 4556 pjvjj.exe 2208 fxfxxxl.exe 4720 7xxrrfx.exe 5020 tnnhhh.exe 3524 pdvvp.exe 4936 frrrrxr.exe 1664 fxffrlf.exe 1208 1nbtbb.exe 2584 pdvdp.exe 1392 dpddv.exe 976 xrrlfxx.exe 1288 btbtnb.exe 540 tbtntn.exe 4892 vpjjd.exe 4492 lfrrxrl.exe 4524 fxxfxxx.exe 2640 tnnhhh.exe 1348 hhbbbt.exe 2792 jpdjj.exe 3896 pvjdj.exe 4868 3xxrllf.exe 3692 3tttnh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3464 wrote to memory of 4412 3464 8f57ca52680dc1dd132ac968f5abc910_NeikiAnalytics.exe 82 PID 3464 wrote to memory of 4412 3464 8f57ca52680dc1dd132ac968f5abc910_NeikiAnalytics.exe 82 PID 3464 wrote to memory of 4412 3464 8f57ca52680dc1dd132ac968f5abc910_NeikiAnalytics.exe 82 PID 4412 wrote to memory of 3548 4412 lxlllff.exe 83 PID 4412 wrote to memory of 3548 4412 lxlllff.exe 83 PID 4412 wrote to memory of 3548 4412 lxlllff.exe 83 PID 3548 wrote to memory of 4480 3548 lflrfff.exe 84 PID 3548 wrote to memory of 4480 3548 lflrfff.exe 84 PID 3548 wrote to memory of 4480 3548 lflrfff.exe 84 PID 4480 wrote to memory of 3892 4480 hbtbtb.exe 85 PID 4480 wrote to memory of 3892 4480 hbtbtb.exe 85 PID 4480 wrote to memory of 3892 4480 hbtbtb.exe 85 PID 3892 wrote to memory of 3196 3892 3dddv.exe 86 PID 3892 wrote to memory of 3196 3892 3dddv.exe 86 PID 3892 wrote to memory of 3196 3892 3dddv.exe 86 PID 3196 wrote to memory of 4576 3196 vpjdp.exe 88 PID 3196 wrote to memory of 4576 3196 vpjdp.exe 88 PID 3196 wrote to memory of 4576 3196 vpjdp.exe 88 PID 4576 wrote to memory of 1664 4576 3tttnn.exe 89 PID 4576 wrote to memory of 1664 4576 3tttnn.exe 89 PID 4576 wrote to memory of 1664 4576 3tttnn.exe 89 PID 1664 wrote to memory of 2260 1664 dvjdv.exe 91 PID 1664 wrote to memory of 2260 1664 dvjdv.exe 91 PID 1664 wrote to memory of 2260 1664 dvjdv.exe 91 PID 2260 wrote to memory of 1288 2260 pdvvp.exe 92 PID 2260 wrote to memory of 1288 2260 pdvvp.exe 92 PID 2260 wrote to memory of 1288 2260 pdvvp.exe 92 PID 1288 wrote to memory of 2656 1288 thhtnn.exe 94 PID 1288 wrote to memory of 2656 1288 thhtnn.exe 94 PID 1288 wrote to memory of 2656 1288 thhtnn.exe 94 PID 2656 wrote to memory of 1232 2656 hhnhhb.exe 95 PID 2656 wrote to memory of 1232 2656 hhnhhb.exe 95 PID 2656 wrote to memory of 1232 2656 hhnhhb.exe 95 PID 1232 wrote to memory of 3124 1232 5jjdv.exe 96 PID 1232 wrote to memory of 3124 1232 5jjdv.exe 96 PID 1232 wrote to memory of 3124 1232 5jjdv.exe 96 PID 3124 wrote to memory of 3020 3124 rlrllff.exe 97 PID 3124 wrote to memory of 3020 3124 rlrllff.exe 97 PID 3124 wrote to memory of 3020 3124 rlrllff.exe 97 PID 3020 wrote to memory of 2696 3020 rxlffxl.exe 98 PID 3020 wrote to memory of 2696 3020 rxlffxl.exe 98 PID 3020 wrote to memory of 2696 3020 rxlffxl.exe 98 PID 2696 wrote to memory of 1008 2696 nhhtth.exe 99 PID 2696 wrote to memory of 1008 2696 nhhtth.exe 99 PID 2696 wrote to memory of 1008 2696 nhhtth.exe 99 PID 1008 wrote to memory of 2800 1008 htnttb.exe 100 PID 1008 wrote to memory of 2800 1008 htnttb.exe 100 PID 1008 wrote to memory of 2800 1008 htnttb.exe 100 PID 2800 wrote to memory of 3732 2800 5ppjv.exe 101 PID 2800 wrote to memory of 3732 2800 5ppjv.exe 101 PID 2800 wrote to memory of 3732 2800 5ppjv.exe 101 PID 3732 wrote to memory of 1332 3732 5tthbt.exe 102 PID 3732 wrote to memory of 1332 3732 5tthbt.exe 102 PID 3732 wrote to memory of 1332 3732 5tthbt.exe 102 PID 1332 wrote to memory of 1676 1332 bttttt.exe 103 PID 1332 wrote to memory of 1676 1332 bttttt.exe 103 PID 1332 wrote to memory of 1676 1332 bttttt.exe 103 PID 1676 wrote to memory of 1000 1676 vvpdj.exe 104 PID 1676 wrote to memory of 1000 1676 vvpdj.exe 104 PID 1676 wrote to memory of 1000 1676 vvpdj.exe 104 PID 1000 wrote to memory of 576 1000 fxxrrrl.exe 105 PID 1000 wrote to memory of 576 1000 fxxrrrl.exe 105 PID 1000 wrote to memory of 576 1000 fxxrrrl.exe 105 PID 576 wrote to memory of 5068 576 thnhtt.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f57ca52680dc1dd132ac968f5abc910_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8f57ca52680dc1dd132ac968f5abc910_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3464 -
\??\c:\lxlllff.exec:\lxlllff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
\??\c:\lflrfff.exec:\lflrfff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\hbtbtb.exec:\hbtbtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\3dddv.exec:\3dddv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\vpjdp.exec:\vpjdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\3tttnn.exec:\3tttnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\dvjdv.exec:\dvjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\pdvvp.exec:\pdvvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\thhtnn.exec:\thhtnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\hhnhhb.exec:\hhnhhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\5jjdv.exec:\5jjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\rlrllff.exec:\rlrllff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\rxlffxl.exec:\rxlffxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\nhhtth.exec:\nhhtth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\htnttb.exec:\htnttb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\5ppjv.exec:\5ppjv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\5tthbt.exec:\5tthbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\bttttt.exec:\bttttt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\vvpdj.exec:\vvpdj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\fxxrrrl.exec:\fxxrrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
\??\c:\thnhtt.exec:\thnhtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\7bbtnn.exec:\7bbtnn.exe23⤵
- Executes dropped EXE
PID:5068 -
\??\c:\bnbtnh.exec:\bnbtnh.exe24⤵
- Executes dropped EXE
PID:2032 -
\??\c:\jjjdj.exec:\jjjdj.exe25⤵
- Executes dropped EXE
PID:4104 -
\??\c:\hbnthb.exec:\hbnthb.exe26⤵
- Executes dropped EXE
PID:1136 -
\??\c:\3tthbt.exec:\3tthbt.exe27⤵
- Executes dropped EXE
PID:704 -
\??\c:\xrrxxxl.exec:\xrrxxxl.exe28⤵
- Executes dropped EXE
PID:2020 -
\??\c:\tbtnnh.exec:\tbtnnh.exe29⤵
- Executes dropped EXE
PID:808 -
\??\c:\jdvpj.exec:\jdvpj.exe30⤵
- Executes dropped EXE
PID:4264 -
\??\c:\lffxlfl.exec:\lffxlfl.exe31⤵
- Executes dropped EXE
PID:2988 -
\??\c:\hbhbbt.exec:\hbhbbt.exe32⤵
- Executes dropped EXE
PID:4384 -
\??\c:\pjdvp.exec:\pjdvp.exe33⤵
- Executes dropped EXE
PID:4920 -
\??\c:\ffxffrl.exec:\ffxffrl.exe34⤵
- Executes dropped EXE
PID:5052 -
\??\c:\bnbttt.exec:\bnbttt.exe35⤵
- Executes dropped EXE
PID:380 -
\??\c:\ddjjd.exec:\ddjjd.exe36⤵
- Executes dropped EXE
PID:1504 -
\??\c:\vvvvv.exec:\vvvvv.exe37⤵
- Executes dropped EXE
PID:3344 -
\??\c:\xlrrrrl.exec:\xlrrrrl.exe38⤵
- Executes dropped EXE
PID:4024 -
\??\c:\nhtntt.exec:\nhtntt.exe39⤵
- Executes dropped EXE
PID:556 -
\??\c:\7pvpj.exec:\7pvpj.exe40⤵
- Executes dropped EXE
PID:2936 -
\??\c:\ppddv.exec:\ppddv.exe41⤵
- Executes dropped EXE
PID:4560 -
\??\c:\flxxrxx.exec:\flxxrxx.exe42⤵PID:4328
-
\??\c:\thnhhh.exec:\thnhhh.exe43⤵
- Executes dropped EXE
PID:3120 -
\??\c:\bbtttt.exec:\bbtttt.exe44⤵
- Executes dropped EXE
PID:2324 -
\??\c:\pjvjj.exec:\pjvjj.exe45⤵
- Executes dropped EXE
PID:4556 -
\??\c:\fxfxxxl.exec:\fxfxxxl.exe46⤵
- Executes dropped EXE
PID:2208 -
\??\c:\7xxrrfx.exec:\7xxrrfx.exe47⤵
- Executes dropped EXE
PID:4720 -
\??\c:\tnnhhh.exec:\tnnhhh.exe48⤵
- Executes dropped EXE
PID:5020 -
\??\c:\pdvvp.exec:\pdvvp.exe49⤵
- Executes dropped EXE
PID:3524 -
\??\c:\frrrrxr.exec:\frrrrxr.exe50⤵
- Executes dropped EXE
PID:4936 -
\??\c:\fxffrlf.exec:\fxffrlf.exe51⤵
- Executes dropped EXE
PID:1664 -
\??\c:\1nbtbb.exec:\1nbtbb.exe52⤵
- Executes dropped EXE
PID:1208 -
\??\c:\pdvdp.exec:\pdvdp.exe53⤵
- Executes dropped EXE
PID:2584 -
\??\c:\dpddv.exec:\dpddv.exe54⤵
- Executes dropped EXE
PID:1392 -
\??\c:\xrrlfxx.exec:\xrrlfxx.exe55⤵
- Executes dropped EXE
PID:976 -
\??\c:\btbtnb.exec:\btbtnb.exe56⤵
- Executes dropped EXE
PID:1288 -
\??\c:\tbtntn.exec:\tbtntn.exe57⤵
- Executes dropped EXE
PID:540 -
\??\c:\vpjjd.exec:\vpjjd.exe58⤵
- Executes dropped EXE
PID:4892 -
\??\c:\lfrrxrl.exec:\lfrrxrl.exe59⤵
- Executes dropped EXE
PID:4492 -
\??\c:\fxxfxxx.exec:\fxxfxxx.exe60⤵
- Executes dropped EXE
PID:4524 -
\??\c:\tnnhhh.exec:\tnnhhh.exe61⤵
- Executes dropped EXE
PID:2640 -
\??\c:\hhbbbt.exec:\hhbbbt.exe62⤵
- Executes dropped EXE
PID:1348 -
\??\c:\jpdjj.exec:\jpdjj.exe63⤵
- Executes dropped EXE
PID:2792 -
\??\c:\pvjdj.exec:\pvjdj.exe64⤵
- Executes dropped EXE
PID:3896 -
\??\c:\3xxrllf.exec:\3xxrllf.exe65⤵
- Executes dropped EXE
PID:4868 -
\??\c:\3tttnh.exec:\3tttnh.exe66⤵
- Executes dropped EXE
PID:3692 -
\??\c:\nhhbbt.exec:\nhhbbt.exe67⤵PID:3104
-
\??\c:\vjdvp.exec:\vjdvp.exe68⤵PID:4396
-
\??\c:\vvpdj.exec:\vvpdj.exe69⤵PID:1676
-
\??\c:\xflllll.exec:\xflllll.exe70⤵PID:2480
-
\??\c:\ttnbhb.exec:\ttnbhb.exe71⤵PID:2436
-
\??\c:\9tttnb.exec:\9tttnb.exe72⤵PID:2176
-
\??\c:\rxrrlff.exec:\rxrrlff.exe73⤵PID:2244
-
\??\c:\1thnbb.exec:\1thnbb.exe74⤵PID:3836
-
\??\c:\pdjpp.exec:\pdjpp.exe75⤵PID:2768
-
\??\c:\pjjjv.exec:\pjjjv.exe76⤵PID:4108
-
\??\c:\3rflrxf.exec:\3rflrxf.exe77⤵PID:4500
-
\??\c:\httttn.exec:\httttn.exe78⤵PID:868
-
\??\c:\htnttn.exec:\htnttn.exe79⤵PID:1740
-
\??\c:\1ppvv.exec:\1ppvv.exe80⤵PID:4080
-
\??\c:\llxrlrx.exec:\llxrlrx.exe81⤵PID:1196
-
\??\c:\lrxxrrr.exec:\lrxxrrr.exe82⤵PID:2276
-
\??\c:\bnbtbb.exec:\bnbtbb.exe83⤵PID:4032
-
\??\c:\djdpp.exec:\djdpp.exe84⤵PID:2528
-
\??\c:\llrfxrf.exec:\llrfxrf.exe85⤵PID:396
-
\??\c:\lfxfxxx.exec:\lfxfxxx.exe86⤵PID:2788
-
\??\c:\5tnhbb.exec:\5tnhbb.exe87⤵PID:1844
-
\??\c:\jpdvv.exec:\jpdvv.exe88⤵PID:3644
-
\??\c:\vpjvp.exec:\vpjvp.exe89⤵PID:3312
-
\??\c:\rxxrrrl.exec:\rxxrrrl.exe90⤵PID:1504
-
\??\c:\tbhbth.exec:\tbhbth.exe91⤵PID:2476
-
\??\c:\tnnhbt.exec:\tnnhbt.exe92⤵PID:4736
-
\??\c:\vvvpp.exec:\vvvpp.exe93⤵PID:2288
-
\??\c:\5lllfff.exec:\5lllfff.exe94⤵PID:3712
-
\??\c:\rxxflrx.exec:\rxxflrx.exe95⤵PID:4344
-
\??\c:\tnthbn.exec:\tnthbn.exe96⤵PID:4816
-
\??\c:\dpppd.exec:\dpppd.exe97⤵PID:4412
-
\??\c:\xffxxrl.exec:\xffxxrl.exe98⤵PID:1852
-
\??\c:\hnbbbh.exec:\hnbbbh.exe99⤵PID:2188
-
\??\c:\vdjdj.exec:\vdjdj.exe100⤵PID:4020
-
\??\c:\pjpjv.exec:\pjpjv.exe101⤵PID:2728
-
\??\c:\rflffff.exec:\rflffff.exe102⤵PID:4428
-
\??\c:\fxfffff.exec:\fxfffff.exe103⤵PID:4432
-
\??\c:\thnnbb.exec:\thnnbb.exe104⤵PID:5004
-
\??\c:\pdpvd.exec:\pdpvd.exe105⤵PID:2328
-
\??\c:\1ffxffx.exec:\1ffxffx.exe106⤵PID:1260
-
\??\c:\9nbbhh.exec:\9nbbhh.exe107⤵PID:4260
-
\??\c:\tnnhnn.exec:\tnnhnn.exe108⤵PID:2584
-
\??\c:\3pvpj.exec:\3pvpj.exe109⤵PID:1392
-
\??\c:\vdjjv.exec:\vdjjv.exe110⤵PID:976
-
\??\c:\xrxxxff.exec:\xrxxxff.exe111⤵PID:1288
-
\??\c:\jjppj.exec:\jjppj.exe112⤵PID:540
-
\??\c:\nhttnh.exec:\nhttnh.exe113⤵PID:2852
-
\??\c:\3ppvj.exec:\3ppvj.exe114⤵PID:4536
-
\??\c:\flrlllf.exec:\flrlllf.exe115⤵PID:4964
-
\??\c:\llxrllf.exec:\llxrllf.exe116⤵PID:2696
-
\??\c:\pjvjd.exec:\pjvjd.exe117⤵PID:1936
-
\??\c:\flrfxrl.exec:\flrfxrl.exe118⤵PID:4544
-
\??\c:\bbbthb.exec:\bbbthb.exe119⤵PID:3164
-
\??\c:\thnhbt.exec:\thnhbt.exe120⤵PID:2004
-
\??\c:\dpvjj.exec:\dpvjj.exe121⤵PID:756
-
\??\c:\7lfxllf.exec:\7lfxllf.exe122⤵PID:4704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-