Analysis
-
max time kernel
150s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 03:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1c43acdffaceee861fc39ff61a659960_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
1c43acdffaceee861fc39ff61a659960_NeikiAnalytics.exe
-
Size
94KB
-
MD5
1c43acdffaceee861fc39ff61a659960
-
SHA1
4acfca21813bcfc7160af8d1fc7137f7898cf70f
-
SHA256
8bffe28b1fa4f4ac40b854942d9d2428513740ba1926d6c6a5dbcab6819143d1
-
SHA512
bcccd9b911fa18619c379ad1ea0a5e676b6696a3cdeae365e779e1d6d4a33ee2123a084aeae12b118fa5deee461b28ac7e971f1ecaf0b111d49d3b2a6b3f3eff
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxE6vr/mAF:ymb3NkkiQ3mdBjFo73PYP1lri3KVT+bE
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/3728-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3384-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/404-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2824-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1704-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3044-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3892-49-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/464-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3892-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2212-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3492-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4344-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4920-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1108-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2400-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2588-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4672-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1160-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4268-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3868-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/428-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3008-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3200-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4788-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/680-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3860-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1644-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3384 hbhbbb.exe 404 1jddp.exe 2824 xfffflf.exe 1704 bnttbh.exe 3044 pvdpp.exe 3892 ppjpd.exe 464 vdvvd.exe 2212 jjppp.exe 3492 pvdjd.exe 4344 hhbbtb.exe 4920 ppddv.exe 1108 5fxxrff.exe 2400 vjvvv.exe 2588 9xxxrrl.exe 4608 nbnhht.exe 2292 1vvvv.exe 4672 dvvvp.exe 1160 jjpjj.exe 4268 ffrlxrl.exe 3868 bbtbtb.exe 428 bbhbht.exe 3008 jjvvj.exe 3200 hhnnhn.exe 3984 1nntth.exe 4788 jjpjd.exe 680 xlxffff.exe 2796 nnthbb.exe 3184 vpjpv.exe 3860 ffxxlrr.exe 1644 tntbnn.exe 4912 jjpdj.exe 4464 lfxffff.exe 3480 jdvdj.exe 4656 vpvpj.exe 3964 xxllflr.exe 5028 hhbthn.exe 5052 pvddj.exe 3460 llxfxfr.exe 2924 9xxxxff.exe 4172 nhbtbt.exe 5072 nntnhn.exe 2464 5djpv.exe 1896 xxllxlx.exe 1908 bnnhbn.exe 1056 bbhbtb.exe 1112 pppjd.exe 4476 rlrllfx.exe 2304 vpdjp.exe 4580 vjddv.exe 2212 fxfxlff.exe 4188 thbtnt.exe 4084 bhhbnn.exe 756 pjdvj.exe 8 fllffxr.exe 1028 xllfrrx.exe 4792 bnhntn.exe 1916 ntttnt.exe 4700 3ddpd.exe 1176 fxlllrr.exe 4608 ffxfrff.exe 536 btbhhn.exe 4776 tttbnb.exe 1716 vppdd.exe 2536 fffxxlx.exe -
resource yara_rule behavioral2/memory/3728-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3384-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/404-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3044-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/464-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3892-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2212-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2212-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2212-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2212-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3492-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4920-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1108-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2400-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2588-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4672-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1160-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4268-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3868-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/428-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3008-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3200-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/680-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3860-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1644-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3728 wrote to memory of 3384 3728 1c43acdffaceee861fc39ff61a659960_NeikiAnalytics.exe 82 PID 3728 wrote to memory of 3384 3728 1c43acdffaceee861fc39ff61a659960_NeikiAnalytics.exe 82 PID 3728 wrote to memory of 3384 3728 1c43acdffaceee861fc39ff61a659960_NeikiAnalytics.exe 82 PID 3384 wrote to memory of 404 3384 hbhbbb.exe 83 PID 3384 wrote to memory of 404 3384 hbhbbb.exe 83 PID 3384 wrote to memory of 404 3384 hbhbbb.exe 83 PID 404 wrote to memory of 2824 404 1jddp.exe 84 PID 404 wrote to memory of 2824 404 1jddp.exe 84 PID 404 wrote to memory of 2824 404 1jddp.exe 84 PID 2824 wrote to memory of 1704 2824 xfffflf.exe 85 PID 2824 wrote to memory of 1704 2824 xfffflf.exe 85 PID 2824 wrote to memory of 1704 2824 xfffflf.exe 85 PID 1704 wrote to memory of 3044 1704 bnttbh.exe 86 PID 1704 wrote to memory of 3044 1704 bnttbh.exe 86 PID 1704 wrote to memory of 3044 1704 bnttbh.exe 86 PID 3044 wrote to memory of 3892 3044 pvdpp.exe 87 PID 3044 wrote to memory of 3892 3044 pvdpp.exe 87 PID 3044 wrote to memory of 3892 3044 pvdpp.exe 87 PID 3892 wrote to memory of 464 3892 ppjpd.exe 88 PID 3892 wrote to memory of 464 3892 ppjpd.exe 88 PID 3892 wrote to memory of 464 3892 ppjpd.exe 88 PID 464 wrote to memory of 2212 464 vdvvd.exe 89 PID 464 wrote to memory of 2212 464 vdvvd.exe 89 PID 464 wrote to memory of 2212 464 vdvvd.exe 89 PID 2212 wrote to memory of 3492 2212 jjppp.exe 90 PID 2212 wrote to memory of 3492 2212 jjppp.exe 90 PID 2212 wrote to memory of 3492 2212 jjppp.exe 90 PID 3492 wrote to memory of 4344 3492 pvdjd.exe 91 PID 3492 wrote to memory of 4344 3492 pvdjd.exe 91 PID 3492 wrote to memory of 4344 3492 pvdjd.exe 91 PID 4344 wrote to memory of 4920 4344 hhbbtb.exe 92 PID 4344 wrote to memory of 4920 4344 hhbbtb.exe 92 PID 4344 wrote to memory of 4920 4344 hhbbtb.exe 92 PID 4920 wrote to memory of 1108 4920 ppddv.exe 93 PID 4920 wrote to memory of 1108 4920 ppddv.exe 93 PID 4920 wrote to memory of 1108 4920 ppddv.exe 93 PID 1108 wrote to memory of 2400 1108 5fxxrff.exe 94 PID 1108 wrote to memory of 2400 1108 5fxxrff.exe 94 PID 1108 wrote to memory of 2400 1108 5fxxrff.exe 94 PID 2400 wrote to memory of 2588 2400 vjvvv.exe 95 PID 2400 wrote to memory of 2588 2400 vjvvv.exe 95 PID 2400 wrote to memory of 2588 2400 vjvvv.exe 95 PID 2588 wrote to memory of 4608 2588 9xxxrrl.exe 96 PID 2588 wrote to memory of 4608 2588 9xxxrrl.exe 96 PID 2588 wrote to memory of 4608 2588 9xxxrrl.exe 96 PID 4608 wrote to memory of 2292 4608 nbnhht.exe 97 PID 4608 wrote to memory of 2292 4608 nbnhht.exe 97 PID 4608 wrote to memory of 2292 4608 nbnhht.exe 97 PID 2292 wrote to memory of 4672 2292 1vvvv.exe 98 PID 2292 wrote to memory of 4672 2292 1vvvv.exe 98 PID 2292 wrote to memory of 4672 2292 1vvvv.exe 98 PID 4672 wrote to memory of 1160 4672 dvvvp.exe 99 PID 4672 wrote to memory of 1160 4672 dvvvp.exe 99 PID 4672 wrote to memory of 1160 4672 dvvvp.exe 99 PID 1160 wrote to memory of 4268 1160 jjpjj.exe 100 PID 1160 wrote to memory of 4268 1160 jjpjj.exe 100 PID 1160 wrote to memory of 4268 1160 jjpjj.exe 100 PID 4268 wrote to memory of 3868 4268 ffrlxrl.exe 101 PID 4268 wrote to memory of 3868 4268 ffrlxrl.exe 101 PID 4268 wrote to memory of 3868 4268 ffrlxrl.exe 101 PID 3868 wrote to memory of 428 3868 bbtbtb.exe 103 PID 3868 wrote to memory of 428 3868 bbtbtb.exe 103 PID 3868 wrote to memory of 428 3868 bbtbtb.exe 103 PID 428 wrote to memory of 3008 428 bbhbht.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c43acdffaceee861fc39ff61a659960_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1c43acdffaceee861fc39ff61a659960_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\hbhbbb.exec:\hbhbbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
\??\c:\1jddp.exec:\1jddp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\xfffflf.exec:\xfffflf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\bnttbh.exec:\bnttbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\pvdpp.exec:\pvdpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\ppjpd.exec:\ppjpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\vdvvd.exec:\vdvvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\jjppp.exec:\jjppp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\pvdjd.exec:\pvdjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\hhbbtb.exec:\hhbbtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\ppddv.exec:\ppddv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\5fxxrff.exec:\5fxxrff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\vjvvv.exec:\vjvvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\9xxxrrl.exec:\9xxxrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\nbnhht.exec:\nbnhht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\1vvvv.exec:\1vvvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\dvvvp.exec:\dvvvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\jjpjj.exec:\jjpjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\ffrlxrl.exec:\ffrlxrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
\??\c:\bbtbtb.exec:\bbtbtb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
\??\c:\bbhbht.exec:\bbhbht.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
\??\c:\jjvvj.exec:\jjvvj.exe23⤵
- Executes dropped EXE
PID:3008 -
\??\c:\hhnnhn.exec:\hhnnhn.exe24⤵
- Executes dropped EXE
PID:3200 -
\??\c:\1nntth.exec:\1nntth.exe25⤵
- Executes dropped EXE
PID:3984 -
\??\c:\jjpjd.exec:\jjpjd.exe26⤵
- Executes dropped EXE
PID:4788 -
\??\c:\xlxffff.exec:\xlxffff.exe27⤵
- Executes dropped EXE
PID:680 -
\??\c:\nnthbb.exec:\nnthbb.exe28⤵
- Executes dropped EXE
PID:2796 -
\??\c:\vpjpv.exec:\vpjpv.exe29⤵
- Executes dropped EXE
PID:3184 -
\??\c:\ffxxlrr.exec:\ffxxlrr.exe30⤵
- Executes dropped EXE
PID:3860 -
\??\c:\tntbnn.exec:\tntbnn.exe31⤵
- Executes dropped EXE
PID:1644 -
\??\c:\jjpdj.exec:\jjpdj.exe32⤵
- Executes dropped EXE
PID:4912 -
\??\c:\lfxffff.exec:\lfxffff.exe33⤵
- Executes dropped EXE
PID:4464 -
\??\c:\jdvdj.exec:\jdvdj.exe34⤵
- Executes dropped EXE
PID:3480 -
\??\c:\vpvpj.exec:\vpvpj.exe35⤵
- Executes dropped EXE
PID:4656 -
\??\c:\xxllflr.exec:\xxllflr.exe36⤵
- Executes dropped EXE
PID:3964 -
\??\c:\hhbthn.exec:\hhbthn.exe37⤵
- Executes dropped EXE
PID:5028 -
\??\c:\pvddj.exec:\pvddj.exe38⤵
- Executes dropped EXE
PID:5052 -
\??\c:\llxfxfr.exec:\llxfxfr.exe39⤵
- Executes dropped EXE
PID:3460 -
\??\c:\9xxxxff.exec:\9xxxxff.exe40⤵
- Executes dropped EXE
PID:2924 -
\??\c:\nhbtbt.exec:\nhbtbt.exe41⤵
- Executes dropped EXE
PID:4172 -
\??\c:\nntnhn.exec:\nntnhn.exe42⤵
- Executes dropped EXE
PID:5072 -
\??\c:\5djpv.exec:\5djpv.exe43⤵
- Executes dropped EXE
PID:2464 -
\??\c:\xxllxlx.exec:\xxllxlx.exe44⤵
- Executes dropped EXE
PID:1896 -
\??\c:\bnnhbn.exec:\bnnhbn.exe45⤵
- Executes dropped EXE
PID:1908 -
\??\c:\bbhbtb.exec:\bbhbtb.exe46⤵
- Executes dropped EXE
PID:1056 -
\??\c:\pppjd.exec:\pppjd.exe47⤵
- Executes dropped EXE
PID:1112 -
\??\c:\rlrllfx.exec:\rlrllfx.exe48⤵
- Executes dropped EXE
PID:4476 -
\??\c:\vpdjp.exec:\vpdjp.exe49⤵
- Executes dropped EXE
PID:2304 -
\??\c:\vjddv.exec:\vjddv.exe50⤵
- Executes dropped EXE
PID:4580 -
\??\c:\fxfxlff.exec:\fxfxlff.exe51⤵
- Executes dropped EXE
PID:2212 -
\??\c:\thbtnt.exec:\thbtnt.exe52⤵
- Executes dropped EXE
PID:4188 -
\??\c:\bhhbnn.exec:\bhhbnn.exe53⤵
- Executes dropped EXE
PID:4084 -
\??\c:\pjdvj.exec:\pjdvj.exe54⤵
- Executes dropped EXE
PID:756 -
\??\c:\fllffxr.exec:\fllffxr.exe55⤵
- Executes dropped EXE
PID:8 -
\??\c:\xllfrrx.exec:\xllfrrx.exe56⤵
- Executes dropped EXE
PID:1028 -
\??\c:\bnhntn.exec:\bnhntn.exe57⤵
- Executes dropped EXE
PID:4792 -
\??\c:\ntttnt.exec:\ntttnt.exe58⤵
- Executes dropped EXE
PID:1916 -
\??\c:\3ddpd.exec:\3ddpd.exe59⤵
- Executes dropped EXE
PID:4700 -
\??\c:\fxlllrr.exec:\fxlllrr.exe60⤵
- Executes dropped EXE
PID:1176 -
\??\c:\ffxfrff.exec:\ffxfrff.exe61⤵
- Executes dropped EXE
PID:4608 -
\??\c:\btbhhn.exec:\btbhhn.exe62⤵
- Executes dropped EXE
PID:536 -
\??\c:\tttbnb.exec:\tttbnb.exe63⤵
- Executes dropped EXE
PID:4776 -
\??\c:\vppdd.exec:\vppdd.exe64⤵
- Executes dropped EXE
PID:1716 -
\??\c:\fffxxlx.exec:\fffxxlx.exe65⤵
- Executes dropped EXE
PID:2536 -
\??\c:\fffrrfx.exec:\fffrrfx.exe66⤵PID:4048
-
\??\c:\ntbhhn.exec:\ntbhhn.exe67⤵PID:3684
-
\??\c:\5dvdd.exec:\5dvdd.exe68⤵PID:612
-
\??\c:\frffllr.exec:\frffllr.exe69⤵PID:548
-
\??\c:\llflrfr.exec:\llflrfr.exe70⤵PID:3200
-
\??\c:\nbhbbn.exec:\nbhbbn.exe71⤵PID:3992
-
\??\c:\jjjpj.exec:\jjjpj.exe72⤵PID:1016
-
\??\c:\vvvpj.exec:\vvvpj.exe73⤵PID:2096
-
\??\c:\flxrlrl.exec:\flxrlrl.exe74⤵PID:1396
-
\??\c:\lffffff.exec:\lffffff.exe75⤵PID:2796
-
\??\c:\ntthtb.exec:\ntthtb.exe76⤵PID:4800
-
\??\c:\nnnhbn.exec:\nnnhbn.exe77⤵PID:3940
-
\??\c:\jvddp.exec:\jvddp.exe78⤵PID:3936
-
\??\c:\vdjdj.exec:\vdjdj.exe79⤵PID:2880
-
\??\c:\xxxxrrr.exec:\xxxxrrr.exe80⤵PID:2100
-
\??\c:\nhtntt.exec:\nhtntt.exe81⤵PID:4780
-
\??\c:\vjjvp.exec:\vjjvp.exe82⤵PID:2944
-
\??\c:\rxlrxlx.exec:\rxlrxlx.exe83⤵PID:4260
-
\??\c:\tbnnnh.exec:\tbnnnh.exe84⤵PID:4588
-
\??\c:\fxlrlxr.exec:\fxlrlxr.exe85⤵PID:5068
-
\??\c:\tthhnt.exec:\tthhnt.exe86⤵PID:3276
-
\??\c:\vvjjv.exec:\vvjjv.exe87⤵PID:4436
-
\??\c:\rrlllxr.exec:\rrlllxr.exe88⤵PID:2924
-
\??\c:\lrlrxff.exec:\lrlrxff.exe89⤵PID:3524
-
\??\c:\bhbhbt.exec:\bhbhbt.exe90⤵PID:3304
-
\??\c:\bnbhhh.exec:\bnbhhh.exe91⤵PID:892
-
\??\c:\vvdvj.exec:\vvdvj.exe92⤵PID:2464
-
\??\c:\1llllfr.exec:\1llllfr.exe93⤵PID:4980
-
\??\c:\btnnth.exec:\btnnth.exe94⤵PID:3528
-
\??\c:\pjpjj.exec:\pjpjj.exe95⤵PID:2912
-
\??\c:\ddvpp.exec:\ddvpp.exe96⤵PID:3640
-
\??\c:\9fffxfx.exec:\9fffxfx.exe97⤵PID:1776
-
\??\c:\rfffxxx.exec:\rfffxxx.exe98⤵PID:868
-
\??\c:\1bnnnb.exec:\1bnnnb.exe99⤵PID:2476
-
\??\c:\dddjj.exec:\dddjj.exe100⤵PID:4680
-
\??\c:\pvvvp.exec:\pvvvp.exe101⤵PID:4344
-
\??\c:\lrxxfff.exec:\lrxxfff.exe102⤵PID:1920
-
\??\c:\rxfffrl.exec:\rxfffrl.exe103⤵PID:5080
-
\??\c:\tbnnnn.exec:\tbnnnn.exe104⤵PID:3828
-
\??\c:\bhnttt.exec:\bhnttt.exe105⤵PID:5076
-
\??\c:\ddjjj.exec:\ddjjj.exe106⤵PID:2344
-
\??\c:\rllxllx.exec:\rllxllx.exe107⤵PID:1820
-
\??\c:\llxrxxx.exec:\llxrxxx.exe108⤵PID:3268
-
\??\c:\nbhbbh.exec:\nbhbbh.exe109⤵PID:4480
-
\??\c:\nnnhht.exec:\nnnhht.exe110⤵PID:3408
-
\??\c:\3pvdp.exec:\3pvdp.exe111⤵PID:448
-
\??\c:\pvvpj.exec:\pvvpj.exe112⤵PID:4268
-
\??\c:\1rlfxfr.exec:\1rlfxfr.exe113⤵PID:4696
-
\??\c:\flllllf.exec:\flllllf.exe114⤵PID:1620
-
\??\c:\ttnnht.exec:\ttnnht.exe115⤵PID:4568
-
\??\c:\nnbttt.exec:\nnbttt.exe116⤵PID:1004
-
\??\c:\vpppj.exec:\vpppj.exe117⤵PID:2920
-
\??\c:\9xxrllf.exec:\9xxrllf.exe118⤵PID:1544
-
\??\c:\frlxfrl.exec:\frlxfrl.exe119⤵PID:3168
-
\??\c:\tbnhhn.exec:\tbnhhn.exe120⤵PID:2200
-
\??\c:\3bttnb.exec:\3bttnb.exe121⤵PID:5056
-
\??\c:\7dddv.exec:\7dddv.exe122⤵PID:2768
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-