Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 15:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ae1da806b8f305301ca8269b48e871b0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
ae1da806b8f305301ca8269b48e871b0_NeikiAnalytics.exe
-
Size
226KB
-
MD5
ae1da806b8f305301ca8269b48e871b0
-
SHA1
18a7a11e3f5d27467c8d72cbc6f32702dcfedbd9
-
SHA256
6fd840bb332e17bd0495ebb58ffe85af5399464dde2707cc1e72c1315addb85b
-
SHA512
10d7d13da509335fe1e7a651ddc17ed659b592477dd25a9c277efb7b5ff3d3d3a7407d5e154ff1e4cbb4b338a584bdbab38ab690dfea5d1aa2cc883ec10b95a0
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x47WBQ:n3C9BRo7MlrWKo+lxQ
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/3792-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1820-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3260-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2292-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1372-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2968-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2968-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3236-50-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3236-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3592-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2700-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1652-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3196-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2040-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2528-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1344-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3384-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4576-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1156-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4648-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5112-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/844-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4668-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4144-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2828-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1820 bnttnn.exe 2292 pvdvv.exe 3260 1rxxrxx.exe 1372 tttnnn.exe 2968 lrxxrrl.exe 3236 1hnnhh.exe 3592 1rxxrxr.exe 2700 ddddv.exe 4860 xfffffr.exe 1652 bnhhhh.exe 3196 rrlllll.exe 2040 thhbhh.exe 2528 5pjdp.exe 1344 3xxrllf.exe 3384 nhtnhh.exe 4576 pjppp.exe 1512 hhhttn.exe 1156 pdvjp.exe 4648 7ffxrrl.exe 5112 7rfxxxr.exe 844 hhthnb.exe 2420 xrrrlfx.exe 3568 nnnnhb.exe 1888 5pppj.exe 4668 llxrrxr.exe 4144 9bhhbb.exe 2828 pjpjd.exe 2596 ffrxfxl.exe 3372 5tthbb.exe 4604 rrrllff.exe 2016 frlfxfx.exe 3336 tbhbnn.exe 3532 ppdpj.exe 432 1nbtbt.exe 4760 tnbhtn.exe 3588 1pdvp.exe 4432 xrxrlll.exe 2976 tnbtnn.exe 208 thttnt.exe 1996 pvvpp.exe 4592 3llffll.exe 4072 bhnhtt.exe 1784 pdvvp.exe 2696 rrrfxfx.exe 3100 fxfxrrl.exe 5100 thtttt.exe 3608 jvjdv.exe 4272 jjvdp.exe 2836 lflxrfr.exe 1672 ppdvj.exe 3324 lrfxxfx.exe 4860 rfxffrx.exe 772 hhhbhb.exe 3544 vddvj.exe 752 hbhbbh.exe 5076 hhnbtn.exe 4344 lrffrrr.exe 856 pvpdv.exe 4712 pppdv.exe 2204 xlrrllf.exe 4320 nhnhhh.exe 2936 lfxfrfx.exe 5036 tbttbb.exe 748 djjpj.exe -
resource yara_rule behavioral2/memory/3792-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1820-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3260-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2292-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1372-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3592-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2700-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1652-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3196-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2528-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1344-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3384-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4576-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1156-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4648-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/844-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4668-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4144-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2828-185-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3792 wrote to memory of 1820 3792 ae1da806b8f305301ca8269b48e871b0_NeikiAnalytics.exe 83 PID 3792 wrote to memory of 1820 3792 ae1da806b8f305301ca8269b48e871b0_NeikiAnalytics.exe 83 PID 3792 wrote to memory of 1820 3792 ae1da806b8f305301ca8269b48e871b0_NeikiAnalytics.exe 83 PID 1820 wrote to memory of 2292 1820 bnttnn.exe 84 PID 1820 wrote to memory of 2292 1820 bnttnn.exe 84 PID 1820 wrote to memory of 2292 1820 bnttnn.exe 84 PID 2292 wrote to memory of 3260 2292 pvdvv.exe 85 PID 2292 wrote to memory of 3260 2292 pvdvv.exe 85 PID 2292 wrote to memory of 3260 2292 pvdvv.exe 85 PID 3260 wrote to memory of 1372 3260 1rxxrxx.exe 86 PID 3260 wrote to memory of 1372 3260 1rxxrxx.exe 86 PID 3260 wrote to memory of 1372 3260 1rxxrxx.exe 86 PID 1372 wrote to memory of 2968 1372 tttnnn.exe 88 PID 1372 wrote to memory of 2968 1372 tttnnn.exe 88 PID 1372 wrote to memory of 2968 1372 tttnnn.exe 88 PID 2968 wrote to memory of 3236 2968 lrxxrrl.exe 89 PID 2968 wrote to memory of 3236 2968 lrxxrrl.exe 89 PID 2968 wrote to memory of 3236 2968 lrxxrrl.exe 89 PID 3236 wrote to memory of 3592 3236 1hnnhh.exe 90 PID 3236 wrote to memory of 3592 3236 1hnnhh.exe 90 PID 3236 wrote to memory of 3592 3236 1hnnhh.exe 90 PID 3592 wrote to memory of 2700 3592 1rxxrxr.exe 92 PID 3592 wrote to memory of 2700 3592 1rxxrxr.exe 92 PID 3592 wrote to memory of 2700 3592 1rxxrxr.exe 92 PID 2700 wrote to memory of 4860 2700 ddddv.exe 93 PID 2700 wrote to memory of 4860 2700 ddddv.exe 93 PID 2700 wrote to memory of 4860 2700 ddddv.exe 93 PID 4860 wrote to memory of 1652 4860 xfffffr.exe 94 PID 4860 wrote to memory of 1652 4860 xfffffr.exe 94 PID 4860 wrote to memory of 1652 4860 xfffffr.exe 94 PID 1652 wrote to memory of 3196 1652 bnhhhh.exe 95 PID 1652 wrote to memory of 3196 1652 bnhhhh.exe 95 PID 1652 wrote to memory of 3196 1652 bnhhhh.exe 95 PID 3196 wrote to memory of 2040 3196 rrlllll.exe 97 PID 3196 wrote to memory of 2040 3196 rrlllll.exe 97 PID 3196 wrote to memory of 2040 3196 rrlllll.exe 97 PID 2040 wrote to memory of 2528 2040 thhbhh.exe 98 PID 2040 wrote to memory of 2528 2040 thhbhh.exe 98 PID 2040 wrote to memory of 2528 2040 thhbhh.exe 98 PID 2528 wrote to memory of 1344 2528 5pjdp.exe 99 PID 2528 wrote to memory of 1344 2528 5pjdp.exe 99 PID 2528 wrote to memory of 1344 2528 5pjdp.exe 99 PID 1344 wrote to memory of 3384 1344 3xxrllf.exe 100 PID 1344 wrote to memory of 3384 1344 3xxrllf.exe 100 PID 1344 wrote to memory of 3384 1344 3xxrllf.exe 100 PID 3384 wrote to memory of 4576 3384 nhtnhh.exe 101 PID 3384 wrote to memory of 4576 3384 nhtnhh.exe 101 PID 3384 wrote to memory of 4576 3384 nhtnhh.exe 101 PID 4576 wrote to memory of 1512 4576 pjppp.exe 102 PID 4576 wrote to memory of 1512 4576 pjppp.exe 102 PID 4576 wrote to memory of 1512 4576 pjppp.exe 102 PID 1512 wrote to memory of 1156 1512 hhhttn.exe 103 PID 1512 wrote to memory of 1156 1512 hhhttn.exe 103 PID 1512 wrote to memory of 1156 1512 hhhttn.exe 103 PID 1156 wrote to memory of 4648 1156 pdvjp.exe 104 PID 1156 wrote to memory of 4648 1156 pdvjp.exe 104 PID 1156 wrote to memory of 4648 1156 pdvjp.exe 104 PID 4648 wrote to memory of 5112 4648 7ffxrrl.exe 105 PID 4648 wrote to memory of 5112 4648 7ffxrrl.exe 105 PID 4648 wrote to memory of 5112 4648 7ffxrrl.exe 105 PID 5112 wrote to memory of 844 5112 7rfxxxr.exe 106 PID 5112 wrote to memory of 844 5112 7rfxxxr.exe 106 PID 5112 wrote to memory of 844 5112 7rfxxxr.exe 106 PID 844 wrote to memory of 2420 844 hhthnb.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae1da806b8f305301ca8269b48e871b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ae1da806b8f305301ca8269b48e871b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3792 -
\??\c:\bnttnn.exec:\bnttnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\pvdvv.exec:\pvdvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\1rxxrxx.exec:\1rxxrxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\tttnnn.exec:\tttnnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\lrxxrrl.exec:\lrxxrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\1hnnhh.exec:\1hnnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\1rxxrxr.exec:\1rxxrxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\ddddv.exec:\ddddv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\xfffffr.exec:\xfffffr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\bnhhhh.exec:\bnhhhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\rrlllll.exec:\rrlllll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\thhbhh.exec:\thhbhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\5pjdp.exec:\5pjdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\3xxrllf.exec:\3xxrllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\nhtnhh.exec:\nhtnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
\??\c:\pjppp.exec:\pjppp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\hhhttn.exec:\hhhttn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\pdvjp.exec:\pdvjp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\7ffxrrl.exec:\7ffxrrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\7rfxxxr.exec:\7rfxxxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\hhthnb.exec:\hhthnb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\xrrrlfx.exec:\xrrrlfx.exe23⤵
- Executes dropped EXE
PID:2420 -
\??\c:\nnnnhb.exec:\nnnnhb.exe24⤵
- Executes dropped EXE
PID:3568 -
\??\c:\5pppj.exec:\5pppj.exe25⤵
- Executes dropped EXE
PID:1888 -
\??\c:\llxrrxr.exec:\llxrrxr.exe26⤵
- Executes dropped EXE
PID:4668 -
\??\c:\9bhhbb.exec:\9bhhbb.exe27⤵
- Executes dropped EXE
PID:4144 -
\??\c:\pjpjd.exec:\pjpjd.exe28⤵
- Executes dropped EXE
PID:2828 -
\??\c:\ffrxfxl.exec:\ffrxfxl.exe29⤵
- Executes dropped EXE
PID:2596 -
\??\c:\5tthbb.exec:\5tthbb.exe30⤵
- Executes dropped EXE
PID:3372 -
\??\c:\rrrllff.exec:\rrrllff.exe31⤵
- Executes dropped EXE
PID:4604 -
\??\c:\frlfxfx.exec:\frlfxfx.exe32⤵
- Executes dropped EXE
PID:2016 -
\??\c:\tbhbnn.exec:\tbhbnn.exe33⤵
- Executes dropped EXE
PID:3336 -
\??\c:\ppdpj.exec:\ppdpj.exe34⤵
- Executes dropped EXE
PID:3532 -
\??\c:\1nbtbt.exec:\1nbtbt.exe35⤵
- Executes dropped EXE
PID:432 -
\??\c:\tnbhtn.exec:\tnbhtn.exe36⤵
- Executes dropped EXE
PID:4760 -
\??\c:\1pdvp.exec:\1pdvp.exe37⤵
- Executes dropped EXE
PID:3588 -
\??\c:\xrxrlll.exec:\xrxrlll.exe38⤵
- Executes dropped EXE
PID:4432 -
\??\c:\tnbtnn.exec:\tnbtnn.exe39⤵
- Executes dropped EXE
PID:2976 -
\??\c:\thttnt.exec:\thttnt.exe40⤵
- Executes dropped EXE
PID:208 -
\??\c:\pvvpp.exec:\pvvpp.exe41⤵
- Executes dropped EXE
PID:1996 -
\??\c:\3llffll.exec:\3llffll.exe42⤵
- Executes dropped EXE
PID:4592 -
\??\c:\bhnhtt.exec:\bhnhtt.exe43⤵
- Executes dropped EXE
PID:4072 -
\??\c:\pdvvp.exec:\pdvvp.exe44⤵
- Executes dropped EXE
PID:1784 -
\??\c:\rrrfxfx.exec:\rrrfxfx.exe45⤵
- Executes dropped EXE
PID:2696 -
\??\c:\fxfxrrl.exec:\fxfxrrl.exe46⤵
- Executes dropped EXE
PID:3100 -
\??\c:\thtttt.exec:\thtttt.exe47⤵
- Executes dropped EXE
PID:5100 -
\??\c:\jvjdv.exec:\jvjdv.exe48⤵
- Executes dropped EXE
PID:3608 -
\??\c:\jjvdp.exec:\jjvdp.exe49⤵
- Executes dropped EXE
PID:4272 -
\??\c:\lflxrfr.exec:\lflxrfr.exe50⤵
- Executes dropped EXE
PID:2836 -
\??\c:\ppdvj.exec:\ppdvj.exe51⤵
- Executes dropped EXE
PID:1672 -
\??\c:\lrfxxfx.exec:\lrfxxfx.exe52⤵
- Executes dropped EXE
PID:3324 -
\??\c:\rfxffrx.exec:\rfxffrx.exe53⤵
- Executes dropped EXE
PID:4860 -
\??\c:\hhhbhb.exec:\hhhbhb.exe54⤵
- Executes dropped EXE
PID:772 -
\??\c:\vddvj.exec:\vddvj.exe55⤵
- Executes dropped EXE
PID:3544 -
\??\c:\hbhbbh.exec:\hbhbbh.exe56⤵
- Executes dropped EXE
PID:752 -
\??\c:\hhnbtn.exec:\hhnbtn.exe57⤵
- Executes dropped EXE
PID:5076 -
\??\c:\lrffrrr.exec:\lrffrrr.exe58⤵
- Executes dropped EXE
PID:4344 -
\??\c:\pvpdv.exec:\pvpdv.exe59⤵
- Executes dropped EXE
PID:856 -
\??\c:\pppdv.exec:\pppdv.exe60⤵
- Executes dropped EXE
PID:4712 -
\??\c:\xlrrllf.exec:\xlrrllf.exe61⤵
- Executes dropped EXE
PID:2204 -
\??\c:\nhnhhh.exec:\nhnhhh.exe62⤵
- Executes dropped EXE
PID:4320 -
\??\c:\lfxfrfx.exec:\lfxfrfx.exe63⤵
- Executes dropped EXE
PID:2936 -
\??\c:\tbttbb.exec:\tbttbb.exe64⤵
- Executes dropped EXE
PID:5036 -
\??\c:\djjpj.exec:\djjpj.exe65⤵
- Executes dropped EXE
PID:748 -
\??\c:\jvjpv.exec:\jvjpv.exe66⤵PID:1620
-
\??\c:\lfllffl.exec:\lfllffl.exe67⤵PID:3380
-
\??\c:\hbbbtn.exec:\hbbbtn.exe68⤵PID:3300
-
\??\c:\nhhbnn.exec:\nhhbnn.exe69⤵PID:2412
-
\??\c:\dpjpv.exec:\dpjpv.exe70⤵PID:2884
-
\??\c:\xfrlfxx.exec:\xfrlfxx.exe71⤵PID:2256
-
\??\c:\hbnhbn.exec:\hbnhbn.exe72⤵PID:1208
-
\??\c:\hntnbb.exec:\hntnbb.exe73⤵PID:2084
-
\??\c:\5pjdd.exec:\5pjdd.exe74⤵PID:3840
-
\??\c:\dvdvv.exec:\dvdvv.exe75⤵PID:4144
-
\??\c:\ffrlrrl.exec:\ffrlrrl.exe76⤵PID:2176
-
\??\c:\thnhhh.exec:\thnhhh.exe77⤵PID:3180
-
\??\c:\vdjvj.exec:\vdjvj.exe78⤵PID:2244
-
\??\c:\jpvdd.exec:\jpvdd.exe79⤵PID:4316
-
\??\c:\xxlffxf.exec:\xxlffxf.exe80⤵PID:872
-
\??\c:\hthbbb.exec:\hthbbb.exe81⤵PID:4380
-
\??\c:\vvdvd.exec:\vvdvd.exe82⤵PID:1540
-
\??\c:\xfxrlff.exec:\xfxrlff.exe83⤵PID:3980
-
\??\c:\nhhhbb.exec:\nhhhbb.exe84⤵PID:3532
-
\??\c:\3tttnt.exec:\3tttnt.exe85⤵PID:2620
-
\??\c:\ppvdv.exec:\ppvdv.exe86⤵PID:4424
-
\??\c:\pppdv.exec:\pppdv.exe87⤵PID:2416
-
\??\c:\ffrlfff.exec:\ffrlfff.exe88⤵PID:3792
-
\??\c:\hbbttb.exec:\hbbttb.exe89⤵PID:1816
-
\??\c:\hbbbtt.exec:\hbbbtt.exe90⤵PID:3040
-
\??\c:\jvvjp.exec:\jvvjp.exe91⤵PID:3084
-
\??\c:\vjppp.exec:\vjppp.exe92⤵PID:4172
-
\??\c:\lxfxrxl.exec:\lxfxrxl.exe93⤵PID:4640
-
\??\c:\hhhbtb.exec:\hhhbtb.exe94⤵PID:2516
-
\??\c:\3bnhhh.exec:\3bnhhh.exe95⤵PID:2580
-
\??\c:\vjjdv.exec:\vjjdv.exe96⤵PID:3312
-
\??\c:\dvjjd.exec:\dvjjd.exe97⤵PID:3004
-
\??\c:\lrlxrrl.exec:\lrlxrrl.exe98⤵PID:1908
-
\??\c:\7lfxrrr.exec:\7lfxrrr.exe99⤵PID:3496
-
\??\c:\hhtnhh.exec:\hhtnhh.exe100⤵PID:1504
-
\??\c:\jdjdd.exec:\jdjdd.exe101⤵PID:4524
-
\??\c:\pdvjv.exec:\pdvjv.exe102⤵PID:1728
-
\??\c:\tnbbth.exec:\tnbbth.exe103⤵PID:1296
-
\??\c:\llrlrrl.exec:\llrlrrl.exe104⤵PID:5080
-
\??\c:\1btnhn.exec:\1btnhn.exe105⤵PID:440
-
\??\c:\dpvpp.exec:\dpvpp.exe106⤵PID:1396
-
\??\c:\jdpdj.exec:\jdpdj.exe107⤵PID:2832
-
\??\c:\xrrfflf.exec:\xrrfflf.exe108⤵PID:1156
-
\??\c:\htbnhh.exec:\htbnhh.exe109⤵PID:4900
-
\??\c:\djvjp.exec:\djvjp.exe110⤵PID:1068
-
\??\c:\lffxrrl.exec:\lffxrrl.exe111⤵PID:4620
-
\??\c:\tnnhhb.exec:\tnnhhb.exe112⤵PID:4108
-
\??\c:\nbbbbb.exec:\nbbbbb.exe113⤵PID:3128
-
\??\c:\vpjjv.exec:\vpjjv.exe114⤵PID:3400
-
\??\c:\frxrllf.exec:\frxrllf.exe115⤵PID:696
-
\??\c:\xlrrllr.exec:\xlrrllr.exe116⤵PID:2256
-
\??\c:\7nbbtn.exec:\7nbbtn.exe117⤵PID:1208
-
\??\c:\vjpjd.exec:\vjpjd.exe118⤵PID:3148
-
\??\c:\9pddj.exec:\9pddj.exe119⤵PID:4624
-
\??\c:\lxlfrrl.exec:\lxlfrrl.exe120⤵PID:2972
-
\??\c:\btbtbt.exec:\btbtbt.exe121⤵PID:3376
-
\??\c:\vdjdv.exec:\vdjdv.exe122⤵PID:4324
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-