Analysis
-
max time kernel
97s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17-05-2024 20:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
27b5c4b6a4437f865ee4a03f89142350_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
27b5c4b6a4437f865ee4a03f89142350_NeikiAnalytics.exe
-
Size
72KB
-
MD5
27b5c4b6a4437f865ee4a03f89142350
-
SHA1
4ca74651d0f15ee7223c6038afc64486cd5c9cb8
-
SHA256
080981783f42abbd3ff4f90bdd429fc2563b6d257807b6ad3a2a64d6ce19260a
-
SHA512
52c7983dc7e22207a3d1609e0a4145a76700b73299c4ac43682458f517fc47d7c100c9afc46a6acd268bdeedb1447e6b5c6bcc3901f26c1ca7061b91a9557a14
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIrmCeRMKwo:ymb3NkkiQ3mdBjFIjeKo
Malware Config
Signatures
-
Detect Blackmoon payload 31 IoCs
resource yara_rule behavioral2/memory/2000-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1648-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1644-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4000-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4000-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3328-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4964-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1972-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4868-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2096-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4640-66-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4640-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2536-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3708-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1492-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2436-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1964-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2464-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1196-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1288-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1456-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5092-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4312-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2908-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3424-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2576-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1908-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3464-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2416-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3608-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1648 nbhhtn.exe 1644 dpvvv.exe 4000 rrxrffx.exe 3328 tthbbt.exe 4964 xlxlfxf.exe 4868 lflfrlr.exe 1972 ffrlrxx.exe 4640 xlrlrxr.exe 2096 bnhhbh.exe 2536 xllllrx.exe 4672 nbnnnh.exe 3708 vvjjv.exe 1308 9dpjp.exe 1492 nhhbbn.exe 2436 dpvvd.exe 1964 ffxflxr.exe 2464 tthhbb.exe 1196 ddpjd.exe 640 llxxxrl.exe 1288 ppppj.exe 1456 hhtnnn.exe 2908 bnnhnn.exe 4312 dvddp.exe 5092 lfflxfl.exe 3424 fxxxxff.exe 3592 3pjjp.exe 2576 lrflrll.exe 1908 nbhtbn.exe 3464 1pdpv.exe 2416 pdpvd.exe 3608 rllfffx.exe 1652 nhbbbb.exe 2432 3vpdj.exe 4768 ffxxxxf.exe 32 1tbbtt.exe 4540 vddpp.exe 1588 5rffxlx.exe 5104 lxrllll.exe 4360 nttttt.exe 2792 dvjdj.exe 1756 xfrlxrr.exe 1644 jdjvp.exe 2844 rxxrrfx.exe 3688 frrlfff.exe 4620 1bhnhb.exe 3984 frrlfrl.exe 4568 tbbbth.exe 2044 nbbhnh.exe 2632 jddvp.exe 3012 lllfxxx.exe 4772 xxfffxx.exe 5028 bntbnh.exe 3520 jvvpj.exe 2312 jvvvj.exe 4632 xrxfxfl.exe 1400 hnhhht.exe 4796 djvvp.exe 2420 fxllflf.exe 3340 5tbbbn.exe 1900 7vjpp.exe 4420 xfrxflx.exe 2504 thhbnn.exe 1052 hbtnht.exe 984 jpppj.exe -
resource yara_rule behavioral2/memory/2000-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1648-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1644-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4000-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4000-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3328-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4868-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4964-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4868-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2096-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2536-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3708-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1492-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2436-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1964-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2464-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1196-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1288-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1456-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4312-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2908-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3424-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2576-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1908-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3464-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2416-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3608-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2000 wrote to memory of 1648 2000 27b5c4b6a4437f865ee4a03f89142350_NeikiAnalytics.exe 83 PID 2000 wrote to memory of 1648 2000 27b5c4b6a4437f865ee4a03f89142350_NeikiAnalytics.exe 83 PID 2000 wrote to memory of 1648 2000 27b5c4b6a4437f865ee4a03f89142350_NeikiAnalytics.exe 83 PID 1648 wrote to memory of 1644 1648 nbhhtn.exe 84 PID 1648 wrote to memory of 1644 1648 nbhhtn.exe 84 PID 1648 wrote to memory of 1644 1648 nbhhtn.exe 84 PID 1644 wrote to memory of 4000 1644 dpvvv.exe 85 PID 1644 wrote to memory of 4000 1644 dpvvv.exe 85 PID 1644 wrote to memory of 4000 1644 dpvvv.exe 85 PID 4000 wrote to memory of 3328 4000 rrxrffx.exe 86 PID 4000 wrote to memory of 3328 4000 rrxrffx.exe 86 PID 4000 wrote to memory of 3328 4000 rrxrffx.exe 86 PID 3328 wrote to memory of 4964 3328 tthbbt.exe 87 PID 3328 wrote to memory of 4964 3328 tthbbt.exe 87 PID 3328 wrote to memory of 4964 3328 tthbbt.exe 87 PID 4964 wrote to memory of 4868 4964 xlxlfxf.exe 88 PID 4964 wrote to memory of 4868 4964 xlxlfxf.exe 88 PID 4964 wrote to memory of 4868 4964 xlxlfxf.exe 88 PID 4868 wrote to memory of 1972 4868 lflfrlr.exe 89 PID 4868 wrote to memory of 1972 4868 lflfrlr.exe 89 PID 4868 wrote to memory of 1972 4868 lflfrlr.exe 89 PID 1972 wrote to memory of 4640 1972 ffrlrxx.exe 90 PID 1972 wrote to memory of 4640 1972 ffrlrxx.exe 90 PID 1972 wrote to memory of 4640 1972 ffrlrxx.exe 90 PID 4640 wrote to memory of 2096 4640 xlrlrxr.exe 91 PID 4640 wrote to memory of 2096 4640 xlrlrxr.exe 91 PID 4640 wrote to memory of 2096 4640 xlrlrxr.exe 91 PID 2096 wrote to memory of 2536 2096 bnhhbh.exe 92 PID 2096 wrote to memory of 2536 2096 bnhhbh.exe 92 PID 2096 wrote to memory of 2536 2096 bnhhbh.exe 92 PID 2536 wrote to memory of 4672 2536 xllllrx.exe 93 PID 2536 wrote to memory of 4672 2536 xllllrx.exe 93 PID 2536 wrote to memory of 4672 2536 xllllrx.exe 93 PID 4672 wrote to memory of 3708 4672 nbnnnh.exe 94 PID 4672 wrote to memory of 3708 4672 nbnnnh.exe 94 PID 4672 wrote to memory of 3708 4672 nbnnnh.exe 94 PID 3708 wrote to memory of 1308 3708 vvjjv.exe 95 PID 3708 wrote to memory of 1308 3708 vvjjv.exe 95 PID 3708 wrote to memory of 1308 3708 vvjjv.exe 95 PID 1308 wrote to memory of 1492 1308 9dpjp.exe 96 PID 1308 wrote to memory of 1492 1308 9dpjp.exe 96 PID 1308 wrote to memory of 1492 1308 9dpjp.exe 96 PID 1492 wrote to memory of 2436 1492 nhhbbn.exe 97 PID 1492 wrote to memory of 2436 1492 nhhbbn.exe 97 PID 1492 wrote to memory of 2436 1492 nhhbbn.exe 97 PID 2436 wrote to memory of 1964 2436 dpvvd.exe 98 PID 2436 wrote to memory of 1964 2436 dpvvd.exe 98 PID 2436 wrote to memory of 1964 2436 dpvvd.exe 98 PID 1964 wrote to memory of 2464 1964 ffxflxr.exe 99 PID 1964 wrote to memory of 2464 1964 ffxflxr.exe 99 PID 1964 wrote to memory of 2464 1964 ffxflxr.exe 99 PID 2464 wrote to memory of 1196 2464 tthhbb.exe 100 PID 2464 wrote to memory of 1196 2464 tthhbb.exe 100 PID 2464 wrote to memory of 1196 2464 tthhbb.exe 100 PID 1196 wrote to memory of 640 1196 ddpjd.exe 101 PID 1196 wrote to memory of 640 1196 ddpjd.exe 101 PID 1196 wrote to memory of 640 1196 ddpjd.exe 101 PID 640 wrote to memory of 1288 640 llxxxrl.exe 102 PID 640 wrote to memory of 1288 640 llxxxrl.exe 102 PID 640 wrote to memory of 1288 640 llxxxrl.exe 102 PID 1288 wrote to memory of 1456 1288 ppppj.exe 103 PID 1288 wrote to memory of 1456 1288 ppppj.exe 103 PID 1288 wrote to memory of 1456 1288 ppppj.exe 103 PID 1456 wrote to memory of 2908 1456 hhtnnn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\27b5c4b6a4437f865ee4a03f89142350_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\27b5c4b6a4437f865ee4a03f89142350_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\nbhhtn.exec:\nbhhtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\dpvvv.exec:\dpvvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\rrxrffx.exec:\rrxrffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\tthbbt.exec:\tthbbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\xlxlfxf.exec:\xlxlfxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\lflfrlr.exec:\lflfrlr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\ffrlrxx.exec:\ffrlrxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\xlrlrxr.exec:\xlrlrxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\bnhhbh.exec:\bnhhbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\xllllrx.exec:\xllllrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\nbnnnh.exec:\nbnnnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\vvjjv.exec:\vvjjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\9dpjp.exec:\9dpjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\nhhbbn.exec:\nhhbbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\dpvvd.exec:\dpvvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\ffxflxr.exec:\ffxflxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\tthhbb.exec:\tthhbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\ddpjd.exec:\ddpjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\llxxxrl.exec:\llxxxrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\ppppj.exec:\ppppj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\hhtnnn.exec:\hhtnnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\bnnhnn.exec:\bnnhnn.exe23⤵
- Executes dropped EXE
PID:2908 -
\??\c:\dvddp.exec:\dvddp.exe24⤵
- Executes dropped EXE
PID:4312 -
\??\c:\lfflxfl.exec:\lfflxfl.exe25⤵
- Executes dropped EXE
PID:5092 -
\??\c:\fxxxxff.exec:\fxxxxff.exe26⤵
- Executes dropped EXE
PID:3424 -
\??\c:\3pjjp.exec:\3pjjp.exe27⤵
- Executes dropped EXE
PID:3592 -
\??\c:\lrflrll.exec:\lrflrll.exe28⤵
- Executes dropped EXE
PID:2576 -
\??\c:\nbhtbn.exec:\nbhtbn.exe29⤵
- Executes dropped EXE
PID:1908 -
\??\c:\1pdpv.exec:\1pdpv.exe30⤵
- Executes dropped EXE
PID:3464 -
\??\c:\pdpvd.exec:\pdpvd.exe31⤵
- Executes dropped EXE
PID:2416 -
\??\c:\rllfffx.exec:\rllfffx.exe32⤵
- Executes dropped EXE
PID:3608 -
\??\c:\nhbbbb.exec:\nhbbbb.exe33⤵
- Executes dropped EXE
PID:1652 -
\??\c:\3vpdj.exec:\3vpdj.exe34⤵
- Executes dropped EXE
PID:2432 -
\??\c:\ffxxxxf.exec:\ffxxxxf.exe35⤵
- Executes dropped EXE
PID:4768 -
\??\c:\1tbbtt.exec:\1tbbtt.exe36⤵
- Executes dropped EXE
PID:32 -
\??\c:\vddpp.exec:\vddpp.exe37⤵
- Executes dropped EXE
PID:4540 -
\??\c:\5rffxlx.exec:\5rffxlx.exe38⤵
- Executes dropped EXE
PID:1588 -
\??\c:\lxrllll.exec:\lxrllll.exe39⤵
- Executes dropped EXE
PID:5104 -
\??\c:\nttttt.exec:\nttttt.exe40⤵
- Executes dropped EXE
PID:4360 -
\??\c:\dvjdj.exec:\dvjdj.exe41⤵
- Executes dropped EXE
PID:2792 -
\??\c:\xfrlxrr.exec:\xfrlxrr.exe42⤵
- Executes dropped EXE
PID:1756 -
\??\c:\jdjvp.exec:\jdjvp.exe43⤵
- Executes dropped EXE
PID:1644 -
\??\c:\rxxrrfx.exec:\rxxrrfx.exe44⤵
- Executes dropped EXE
PID:2844 -
\??\c:\frrlfff.exec:\frrlfff.exe45⤵
- Executes dropped EXE
PID:3688 -
\??\c:\1bhnhb.exec:\1bhnhb.exe46⤵
- Executes dropped EXE
PID:4620 -
\??\c:\frrlfrl.exec:\frrlfrl.exe47⤵
- Executes dropped EXE
PID:3984 -
\??\c:\tbbbth.exec:\tbbbth.exe48⤵
- Executes dropped EXE
PID:4568 -
\??\c:\nbbhnh.exec:\nbbhnh.exe49⤵
- Executes dropped EXE
PID:2044 -
\??\c:\jddvp.exec:\jddvp.exe50⤵
- Executes dropped EXE
PID:2632 -
\??\c:\lllfxxx.exec:\lllfxxx.exe51⤵
- Executes dropped EXE
PID:3012 -
\??\c:\xxfffxx.exec:\xxfffxx.exe52⤵
- Executes dropped EXE
PID:4772 -
\??\c:\bntbnh.exec:\bntbnh.exe53⤵
- Executes dropped EXE
PID:5028 -
\??\c:\jvvpj.exec:\jvvpj.exe54⤵
- Executes dropped EXE
PID:3520 -
\??\c:\jvvvj.exec:\jvvvj.exe55⤵
- Executes dropped EXE
PID:2312 -
\??\c:\xrxfxfl.exec:\xrxfxfl.exe56⤵
- Executes dropped EXE
PID:4632 -
\??\c:\hnhhht.exec:\hnhhht.exe57⤵
- Executes dropped EXE
PID:1400 -
\??\c:\djvvp.exec:\djvvp.exe58⤵
- Executes dropped EXE
PID:4796 -
\??\c:\fxllflf.exec:\fxllflf.exe59⤵
- Executes dropped EXE
PID:2420 -
\??\c:\5tbbbn.exec:\5tbbbn.exe60⤵
- Executes dropped EXE
PID:3340 -
\??\c:\7vjpp.exec:\7vjpp.exe61⤵
- Executes dropped EXE
PID:1900 -
\??\c:\xfrxflx.exec:\xfrxflx.exe62⤵
- Executes dropped EXE
PID:4420 -
\??\c:\thhbnn.exec:\thhbnn.exe63⤵
- Executes dropped EXE
PID:2504 -
\??\c:\hbtnht.exec:\hbtnht.exe64⤵
- Executes dropped EXE
PID:1052 -
\??\c:\jpppj.exec:\jpppj.exe65⤵
- Executes dropped EXE
PID:984 -
\??\c:\xrxxxll.exec:\xrxxxll.exe66⤵PID:3508
-
\??\c:\rrrlrlx.exec:\rrrlrlx.exe67⤵PID:3260
-
\??\c:\tbnbth.exec:\tbnbth.exe68⤵PID:2452
-
\??\c:\thnnnn.exec:\thnnnn.exe69⤵PID:3760
-
\??\c:\jjjjd.exec:\jjjjd.exe70⤵PID:3100
-
\??\c:\fxlllrx.exec:\fxlllrx.exe71⤵PID:1956
-
\??\c:\bntttb.exec:\bntttb.exe72⤵PID:3912
-
\??\c:\vjddv.exec:\vjddv.exe73⤵PID:2268
-
\??\c:\dpvpj.exec:\dpvpj.exe74⤵PID:636
-
\??\c:\fllfxxf.exec:\fllfxxf.exe75⤵PID:4520
-
\??\c:\1tttnn.exec:\1tttnn.exe76⤵PID:3264
-
\??\c:\jjjpj.exec:\jjjpj.exe77⤵PID:4576
-
\??\c:\flrffff.exec:\flrffff.exe78⤵PID:4128
-
\??\c:\hhnnnb.exec:\hhnnnb.exe79⤵PID:3608
-
\??\c:\jdjdv.exec:\jdjdv.exe80⤵PID:4892
-
\??\c:\rxrrrxx.exec:\rxrrrxx.exe81⤵PID:4612
-
\??\c:\llfrrfr.exec:\llfrrfr.exe82⤵PID:1080
-
\??\c:\hthbbb.exec:\hthbbb.exe83⤵PID:32
-
\??\c:\pjvjp.exec:\pjvjp.exe84⤵PID:800
-
\??\c:\7jjvp.exec:\7jjvp.exe85⤵PID:4448
-
\??\c:\7lflfrf.exec:\7lflfrf.exe86⤵PID:3564
-
\??\c:\lxfxrlf.exec:\lxfxrlf.exe87⤵PID:1088
-
\??\c:\tbnbnh.exec:\tbnbnh.exe88⤵PID:3468
-
\??\c:\frfllxl.exec:\frfllxl.exe89⤵PID:3292
-
\??\c:\7hnhhn.exec:\7hnhhn.exe90⤵PID:1044
-
\??\c:\ddvdv.exec:\ddvdv.exe91⤵PID:2332
-
\??\c:\jjppj.exec:\jjppj.exe92⤵PID:4368
-
\??\c:\fxxxxxx.exec:\fxxxxxx.exe93⤵PID:2172
-
\??\c:\ntnntt.exec:\ntnntt.exe94⤵PID:2788
-
\??\c:\vdppv.exec:\vdppv.exe95⤵PID:3248
-
\??\c:\xxrlfll.exec:\xxrlfll.exe96⤵PID:1972
-
\??\c:\ntnhtb.exec:\ntnhtb.exe97⤵PID:2096
-
\??\c:\vjjpp.exec:\vjjpp.exe98⤵PID:4468
-
\??\c:\frllxlr.exec:\frllxlr.exe99⤵PID:3476
-
\??\c:\ffrrrfl.exec:\ffrrrfl.exe100⤵PID:1844
-
\??\c:\bhbbnh.exec:\bhbbnh.exe101⤵PID:2884
-
\??\c:\jjvdp.exec:\jjvdp.exe102⤵PID:4572
-
\??\c:\fflrrrf.exec:\fflrrrf.exe103⤵PID:2040
-
\??\c:\htnbnh.exec:\htnbnh.exe104⤵PID:4356
-
\??\c:\thnhbt.exec:\thnhbt.exe105⤵PID:4856
-
\??\c:\pdjdv.exec:\pdjdv.exe106⤵PID:1516
-
\??\c:\rflllll.exec:\rflllll.exe107⤵PID:3628
-
\??\c:\nhnhnh.exec:\nhnhnh.exe108⤵PID:2360
-
\??\c:\bbnhhb.exec:\bbnhhb.exe109⤵PID:2628
-
\??\c:\ppddj.exec:\ppddj.exe110⤵PID:532
-
\??\c:\3frlffr.exec:\3frlffr.exe111⤵PID:1052
-
\??\c:\nbnhnh.exec:\nbnhnh.exe112⤵PID:4172
-
\??\c:\ntbhht.exec:\ntbhht.exe113⤵PID:2908
-
\??\c:\vjjpd.exec:\vjjpd.exe114⤵PID:4372
-
\??\c:\3jddp.exec:\3jddp.exe115⤵PID:4332
-
\??\c:\5fxrlrl.exec:\5fxrlrl.exe116⤵PID:1956
-
\??\c:\hntthn.exec:\hntthn.exe117⤵PID:2084
-
\??\c:\hhnhht.exec:\hhnhht.exe118⤵PID:2080
-
\??\c:\jvjjd.exec:\jvjjd.exe119⤵PID:4520
-
\??\c:\lxrxrff.exec:\lxrxrff.exe120⤵PID:5036
-
\??\c:\ffrllrr.exec:\ffrllrr.exe121⤵PID:2372
-
\??\c:\tnnbtn.exec:\tnnbtn.exe122⤵PID:2836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-