Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 22:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
135fc4914e879247fd8951963012db10_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
135fc4914e879247fd8951963012db10_NeikiAnalytics.exe
-
Size
65KB
-
MD5
135fc4914e879247fd8951963012db10
-
SHA1
066e34c413d54a9b4988b58957e64799c8f4d1ac
-
SHA256
b2432b844c7a40263894904a48b2675c207c57bb23f5239fbb405b1628075c9b
-
SHA512
2b0a039a3472fc82e10daf84ac6b2764557ab80e720d0a6c5a8163efd2eaf0d74fa2ab3c3ed41491e880acf4b9f31b947ff6d66383a1615433c993a871eab9a5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfQ:ymb3NkkiQ3mdBjFI4Vc
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/3704-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2264-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2440-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1208-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4296-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3380-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4640-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4644-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4656-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2248-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3780-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2836-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4492-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4552-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3580-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3872-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1500-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1252-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4960-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2380-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1392-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3092-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2264 7bhnbh.exe 2440 vjpjd.exe 1208 lxlllll.exe 4512 1nhbtt.exe 4296 pvvvp.exe 4780 dpvvp.exe 2688 lxlrlxx.exe 3380 3nhhbn.exe 4640 jjpjd.exe 4644 1hbbbb.exe 4656 3jpvj.exe 2248 xffxrll.exe 3780 ttnhth.exe 2836 dvdvv.exe 3280 xxlffll.exe 4492 hnbbhh.exe 4552 vdpjd.exe 3580 tnbbhh.exe 3872 vpddj.exe 1500 rfxxxxx.exe 1252 bnttbh.exe 4960 5vdvd.exe 3756 ppvpp.exe 2380 fxxxxxf.exe 1392 hbhbbb.exe 3092 ntnhbn.exe 1184 9fffflr.exe 1672 nbbnbh.exe 5092 ttnhhh.exe 4092 jjpjd.exe 5052 ffllrrl.exe 2956 htthhb.exe 4528 bhhhhn.exe 3788 5vjdj.exe 3344 pvjdd.exe 4464 5ntbbb.exe 1680 pppjj.exe 4840 1vdjj.exe 2732 rlrllrr.exe 4308 bnttnn.exe 3704 3ppvp.exe 3688 xflfxxx.exe 1952 ntthtt.exe 1980 pdpvp.exe 4084 5jjpd.exe 3004 3rxfxff.exe 3376 1frrrxr.exe 2600 5hhttt.exe 4780 1pppp.exe 1312 9vvpj.exe 3380 xfrrxxr.exe 1624 nhtnnn.exe 3272 ddjdv.exe 2188 ffxrllf.exe 5032 frrrrrr.exe 3860 nhnhbb.exe 1596 ddjjj.exe 3692 lrflfxf.exe 2504 xrflffr.exe 4712 hbbbtt.exe 4492 pvpvp.exe 3036 1lrfffx.exe 3216 5xxrxll.exe 4036 7hbbtt.exe -
resource yara_rule behavioral2/memory/3704-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2264-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2440-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1208-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4296-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4644-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2248-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3780-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2836-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4492-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4552-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3580-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3872-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1500-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1252-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4960-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2380-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1392-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3092-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3704 wrote to memory of 2264 3704 135fc4914e879247fd8951963012db10_NeikiAnalytics.exe 83 PID 3704 wrote to memory of 2264 3704 135fc4914e879247fd8951963012db10_NeikiAnalytics.exe 83 PID 3704 wrote to memory of 2264 3704 135fc4914e879247fd8951963012db10_NeikiAnalytics.exe 83 PID 2264 wrote to memory of 2440 2264 7bhnbh.exe 84 PID 2264 wrote to memory of 2440 2264 7bhnbh.exe 84 PID 2264 wrote to memory of 2440 2264 7bhnbh.exe 84 PID 2440 wrote to memory of 1208 2440 vjpjd.exe 85 PID 2440 wrote to memory of 1208 2440 vjpjd.exe 85 PID 2440 wrote to memory of 1208 2440 vjpjd.exe 85 PID 1208 wrote to memory of 4512 1208 lxlllll.exe 86 PID 1208 wrote to memory of 4512 1208 lxlllll.exe 86 PID 1208 wrote to memory of 4512 1208 lxlllll.exe 86 PID 4512 wrote to memory of 4296 4512 1nhbtt.exe 87 PID 4512 wrote to memory of 4296 4512 1nhbtt.exe 87 PID 4512 wrote to memory of 4296 4512 1nhbtt.exe 87 PID 4296 wrote to memory of 4780 4296 pvvvp.exe 88 PID 4296 wrote to memory of 4780 4296 pvvvp.exe 88 PID 4296 wrote to memory of 4780 4296 pvvvp.exe 88 PID 4780 wrote to memory of 2688 4780 dpvvp.exe 89 PID 4780 wrote to memory of 2688 4780 dpvvp.exe 89 PID 4780 wrote to memory of 2688 4780 dpvvp.exe 89 PID 2688 wrote to memory of 3380 2688 lxlrlxx.exe 90 PID 2688 wrote to memory of 3380 2688 lxlrlxx.exe 90 PID 2688 wrote to memory of 3380 2688 lxlrlxx.exe 90 PID 3380 wrote to memory of 4640 3380 3nhhbn.exe 91 PID 3380 wrote to memory of 4640 3380 3nhhbn.exe 91 PID 3380 wrote to memory of 4640 3380 3nhhbn.exe 91 PID 4640 wrote to memory of 4644 4640 jjpjd.exe 92 PID 4640 wrote to memory of 4644 4640 jjpjd.exe 92 PID 4640 wrote to memory of 4644 4640 jjpjd.exe 92 PID 4644 wrote to memory of 4656 4644 1hbbbb.exe 93 PID 4644 wrote to memory of 4656 4644 1hbbbb.exe 93 PID 4644 wrote to memory of 4656 4644 1hbbbb.exe 93 PID 4656 wrote to memory of 2248 4656 3jpvj.exe 94 PID 4656 wrote to memory of 2248 4656 3jpvj.exe 94 PID 4656 wrote to memory of 2248 4656 3jpvj.exe 94 PID 2248 wrote to memory of 3780 2248 xffxrll.exe 95 PID 2248 wrote to memory of 3780 2248 xffxrll.exe 95 PID 2248 wrote to memory of 3780 2248 xffxrll.exe 95 PID 3780 wrote to memory of 2836 3780 ttnhth.exe 96 PID 3780 wrote to memory of 2836 3780 ttnhth.exe 96 PID 3780 wrote to memory of 2836 3780 ttnhth.exe 96 PID 2836 wrote to memory of 3280 2836 dvdvv.exe 97 PID 2836 wrote to memory of 3280 2836 dvdvv.exe 97 PID 2836 wrote to memory of 3280 2836 dvdvv.exe 97 PID 3280 wrote to memory of 4492 3280 xxlffll.exe 98 PID 3280 wrote to memory of 4492 3280 xxlffll.exe 98 PID 3280 wrote to memory of 4492 3280 xxlffll.exe 98 PID 4492 wrote to memory of 4552 4492 hnbbhh.exe 99 PID 4492 wrote to memory of 4552 4492 hnbbhh.exe 99 PID 4492 wrote to memory of 4552 4492 hnbbhh.exe 99 PID 4552 wrote to memory of 3580 4552 vdpjd.exe 100 PID 4552 wrote to memory of 3580 4552 vdpjd.exe 100 PID 4552 wrote to memory of 3580 4552 vdpjd.exe 100 PID 3580 wrote to memory of 3872 3580 tnbbhh.exe 101 PID 3580 wrote to memory of 3872 3580 tnbbhh.exe 101 PID 3580 wrote to memory of 3872 3580 tnbbhh.exe 101 PID 3872 wrote to memory of 1500 3872 vpddj.exe 102 PID 3872 wrote to memory of 1500 3872 vpddj.exe 102 PID 3872 wrote to memory of 1500 3872 vpddj.exe 102 PID 1500 wrote to memory of 1252 1500 rfxxxxx.exe 103 PID 1500 wrote to memory of 1252 1500 rfxxxxx.exe 103 PID 1500 wrote to memory of 1252 1500 rfxxxxx.exe 103 PID 1252 wrote to memory of 4960 1252 bnttbh.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\135fc4914e879247fd8951963012db10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\135fc4914e879247fd8951963012db10_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\7bhnbh.exec:\7bhnbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\vjpjd.exec:\vjpjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\lxlllll.exec:\lxlllll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\1nhbtt.exec:\1nhbtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\pvvvp.exec:\pvvvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\dpvvp.exec:\dpvvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\lxlrlxx.exec:\lxlrlxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\3nhhbn.exec:\3nhhbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\jjpjd.exec:\jjpjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\1hbbbb.exec:\1hbbbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
\??\c:\3jpvj.exec:\3jpvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\xffxrll.exec:\xffxrll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\ttnhth.exec:\ttnhth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
\??\c:\dvdvv.exec:\dvdvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\xxlffll.exec:\xxlffll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\hnbbhh.exec:\hnbbhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\vdpjd.exec:\vdpjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\tnbbhh.exec:\tnbbhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\vpddj.exec:\vpddj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\rfxxxxx.exec:\rfxxxxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\bnttbh.exec:\bnttbh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\5vdvd.exec:\5vdvd.exe23⤵
- Executes dropped EXE
PID:4960 -
\??\c:\ppvpp.exec:\ppvpp.exe24⤵
- Executes dropped EXE
PID:3756 -
\??\c:\fxxxxxf.exec:\fxxxxxf.exe25⤵
- Executes dropped EXE
PID:2380 -
\??\c:\hbhbbb.exec:\hbhbbb.exe26⤵
- Executes dropped EXE
PID:1392 -
\??\c:\ntnhbn.exec:\ntnhbn.exe27⤵
- Executes dropped EXE
PID:3092 -
\??\c:\9fffflr.exec:\9fffflr.exe28⤵
- Executes dropped EXE
PID:1184 -
\??\c:\nbbnbh.exec:\nbbnbh.exe29⤵
- Executes dropped EXE
PID:1672 -
\??\c:\ttnhhh.exec:\ttnhhh.exe30⤵
- Executes dropped EXE
PID:5092 -
\??\c:\jjpjd.exec:\jjpjd.exe31⤵
- Executes dropped EXE
PID:4092 -
\??\c:\ffllrrl.exec:\ffllrrl.exe32⤵
- Executes dropped EXE
PID:5052 -
\??\c:\htthhb.exec:\htthhb.exe33⤵
- Executes dropped EXE
PID:2956 -
\??\c:\bhhhhn.exec:\bhhhhn.exe34⤵
- Executes dropped EXE
PID:4528 -
\??\c:\5vjdj.exec:\5vjdj.exe35⤵
- Executes dropped EXE
PID:3788 -
\??\c:\pvjdd.exec:\pvjdd.exe36⤵
- Executes dropped EXE
PID:3344 -
\??\c:\5ntbbb.exec:\5ntbbb.exe37⤵
- Executes dropped EXE
PID:4464 -
\??\c:\pppjj.exec:\pppjj.exe38⤵
- Executes dropped EXE
PID:1680 -
\??\c:\1vdjj.exec:\1vdjj.exe39⤵
- Executes dropped EXE
PID:4840 -
\??\c:\rlrllrr.exec:\rlrllrr.exe40⤵
- Executes dropped EXE
PID:2732 -
\??\c:\bnttnn.exec:\bnttnn.exe41⤵
- Executes dropped EXE
PID:4308 -
\??\c:\3ppvp.exec:\3ppvp.exe42⤵
- Executes dropped EXE
PID:3704 -
\??\c:\xflfxxx.exec:\xflfxxx.exe43⤵
- Executes dropped EXE
PID:3688 -
\??\c:\ntthtt.exec:\ntthtt.exe44⤵
- Executes dropped EXE
PID:1952 -
\??\c:\pdpvp.exec:\pdpvp.exe45⤵
- Executes dropped EXE
PID:1980 -
\??\c:\5jjpd.exec:\5jjpd.exe46⤵
- Executes dropped EXE
PID:4084 -
\??\c:\3rxfxff.exec:\3rxfxff.exe47⤵
- Executes dropped EXE
PID:3004 -
\??\c:\1frrrxr.exec:\1frrrxr.exe48⤵
- Executes dropped EXE
PID:3376 -
\??\c:\5hhttt.exec:\5hhttt.exe49⤵
- Executes dropped EXE
PID:2600 -
\??\c:\1pppp.exec:\1pppp.exe50⤵
- Executes dropped EXE
PID:4780 -
\??\c:\9vvpj.exec:\9vvpj.exe51⤵
- Executes dropped EXE
PID:1312 -
\??\c:\xfrrxxr.exec:\xfrrxxr.exe52⤵
- Executes dropped EXE
PID:3380 -
\??\c:\nhtnnn.exec:\nhtnnn.exe53⤵
- Executes dropped EXE
PID:1624 -
\??\c:\ddjdv.exec:\ddjdv.exe54⤵
- Executes dropped EXE
PID:3272 -
\??\c:\ffxrllf.exec:\ffxrllf.exe55⤵
- Executes dropped EXE
PID:2188 -
\??\c:\frrrrrr.exec:\frrrrrr.exe56⤵
- Executes dropped EXE
PID:5032 -
\??\c:\nhnhbb.exec:\nhnhbb.exe57⤵
- Executes dropped EXE
PID:3860 -
\??\c:\ddjjj.exec:\ddjjj.exe58⤵
- Executes dropped EXE
PID:1596 -
\??\c:\lrflfxf.exec:\lrflfxf.exe59⤵
- Executes dropped EXE
PID:3692 -
\??\c:\xrflffr.exec:\xrflffr.exe60⤵
- Executes dropped EXE
PID:2504 -
\??\c:\hbbbtt.exec:\hbbbtt.exe61⤵
- Executes dropped EXE
PID:4712 -
\??\c:\pvpvp.exec:\pvpvp.exe62⤵
- Executes dropped EXE
PID:4492 -
\??\c:\1lrfffx.exec:\1lrfffx.exe63⤵
- Executes dropped EXE
PID:3036 -
\??\c:\5xxrxll.exec:\5xxrxll.exe64⤵
- Executes dropped EXE
PID:3216 -
\??\c:\7hbbtt.exec:\7hbbtt.exe65⤵
- Executes dropped EXE
PID:4036 -
\??\c:\ddpjv.exec:\ddpjv.exe66⤵PID:924
-
\??\c:\vppjj.exec:\vppjj.exe67⤵PID:2160
-
\??\c:\7xfxfxl.exec:\7xfxfxl.exe68⤵PID:1824
-
\??\c:\nbnttb.exec:\nbnttb.exe69⤵PID:3972
-
\??\c:\hhhhhb.exec:\hhhhhb.exe70⤵PID:2512
-
\??\c:\jjjjj.exec:\jjjjj.exe71⤵PID:4984
-
\??\c:\rxffflx.exec:\rxffflx.exe72⤵PID:2308
-
\??\c:\llfxlfx.exec:\llfxlfx.exe73⤵PID:452
-
\??\c:\hbbbbb.exec:\hbbbbb.exe74⤵PID:4052
-
\??\c:\ddddv.exec:\ddddv.exe75⤵PID:3092
-
\??\c:\dpvvj.exec:\dpvvj.exe76⤵PID:1184
-
\??\c:\rfrlxrl.exec:\rfrlxrl.exe77⤵PID:4964
-
\??\c:\1hhhhb.exec:\1hhhhb.exe78⤵PID:1432
-
\??\c:\bthbbb.exec:\bthbbb.exe79⤵PID:4704
-
\??\c:\dvjjv.exec:\dvjjv.exe80⤵PID:1204
-
\??\c:\xrrlfff.exec:\xrrlfff.exe81⤵PID:3260
-
\??\c:\frfxrrl.exec:\frfxrrl.exe82⤵PID:3724
-
\??\c:\nhntnn.exec:\nhntnn.exe83⤵PID:3700
-
\??\c:\pjvvp.exec:\pjvvp.exe84⤵PID:880
-
\??\c:\vpjdj.exec:\vpjdj.exe85⤵PID:4440
-
\??\c:\7rfxxxx.exec:\7rfxxxx.exe86⤵PID:4208
-
\??\c:\ffxxxlf.exec:\ffxxxlf.exe87⤵PID:4464
-
\??\c:\bbnntt.exec:\bbnntt.exe88⤵PID:5116
-
\??\c:\jjpvv.exec:\jjpvv.exe89⤵PID:2584
-
\??\c:\vdjjv.exec:\vdjjv.exe90⤵PID:1628
-
\??\c:\bbhhbh.exec:\bbhhbh.exe91⤵PID:60
-
\??\c:\tnnhbb.exec:\tnnhbb.exe92⤵PID:3468
-
\??\c:\jjddj.exec:\jjddj.exe93⤵PID:2724
-
\??\c:\jddvv.exec:\jddvv.exe94⤵PID:1456
-
\??\c:\xrrlrll.exec:\xrrlrll.exe95⤵PID:4068
-
\??\c:\9fllllr.exec:\9fllllr.exe96⤵PID:2432
-
\??\c:\tttttt.exec:\tttttt.exe97⤵PID:4932
-
\??\c:\jdppj.exec:\jdppj.exe98⤵PID:3472
-
\??\c:\xrrlffx.exec:\xrrlffx.exe99⤵PID:1888
-
\??\c:\bthhhn.exec:\bthhhn.exe100⤵PID:2688
-
\??\c:\5jdjj.exec:\5jdjj.exe101⤵PID:2564
-
\??\c:\3frrllf.exec:\3frrllf.exe102⤵PID:2996
-
\??\c:\pvjvp.exec:\pvjvp.exe103⤵PID:4644
-
\??\c:\frfffxx.exec:\frfffxx.exe104⤵PID:4456
-
\??\c:\bhbtbb.exec:\bhbtbb.exe105⤵PID:1864
-
\??\c:\jvddd.exec:\jvddd.exe106⤵PID:2352
-
\??\c:\flfrfxl.exec:\flfrfxl.exe107⤵PID:3224
-
\??\c:\dvvvp.exec:\dvvvp.exe108⤵PID:2636
-
\??\c:\nthbhh.exec:\nthbhh.exe109⤵PID:2368
-
\??\c:\xrffrrf.exec:\xrffrrf.exe110⤵PID:2172
-
\??\c:\dpdvp.exec:\dpdvp.exe111⤵PID:1920
-
\??\c:\ffxxxxx.exec:\ffxxxxx.exe112⤵PID:1372
-
\??\c:\xlxxrrr.exec:\xlxxrrr.exe113⤵PID:1812
-
\??\c:\lfrrxxl.exec:\lfrrxxl.exe114⤵PID:2056
-
\??\c:\7hbtnt.exec:\7hbtnt.exe115⤵PID:840
-
\??\c:\pdppp.exec:\pdppp.exe116⤵PID:4188
-
\??\c:\lrlffll.exec:\lrlffll.exe117⤵PID:2372
-
\??\c:\5fllrrf.exec:\5fllrrf.exe118⤵PID:4460
-
\??\c:\bbbbbt.exec:\bbbbbt.exe119⤵PID:3120
-
\??\c:\vvvpj.exec:\vvvpj.exe120⤵PID:2380
-
\??\c:\ppvpp.exec:\ppvpp.exe121⤵PID:2108
-
\??\c:\xxfxxxr.exec:\xxfxxxr.exe122⤵PID:4940
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-