Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27-05-2024 17:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
06b32bde5b260c24fa49ee30b9eae520_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
06b32bde5b260c24fa49ee30b9eae520_NeikiAnalytics.exe
-
Size
63KB
-
MD5
06b32bde5b260c24fa49ee30b9eae520
-
SHA1
db18fa1d3ea1dd87cca7e34e01d522580d443278
-
SHA256
bb7961612d580ad3338b2aa4739faa5782bd9c1f7929eea36efcfa7d3aab4a32
-
SHA512
ff8026089c715cb9d1bc9c161ac13a9cd0ac3bad612b2d55475b8d844970ed9134b237d47c3889b1340b616b8760bc18ab34d608b2e7ef647238a666035a1534
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIhJm/w+d:ymb3NkkiQ3mdBjFILmPd
Malware Config
Signatures
-
Detect Blackmoon payload 30 IoCs
resource yara_rule behavioral2/memory/4600-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/452-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4300-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2088-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2088-33-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/100-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4216-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3316-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3316-56-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4692-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4156-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3236-72-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3236-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2924-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3816-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2436-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4008-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1748-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2432-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1196-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1236-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4116-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1924-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2680-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3064-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2088-8254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 452 tttnnn.exe 4300 ntbbtb.exe 1496 jdpvd.exe 2088 pvppj.exe 100 ffllxff.exe 4216 bbbhhn.exe 3316 jjppj.exe 4692 xfrxrxx.exe 3236 xrxxxlx.exe 4792 ttbhtb.exe 4156 nbnhbh.exe 932 jdppp.exe 2924 frfllrr.exe 3816 xxfffll.exe 2436 bthntt.exe 3720 vvddd.exe 4008 xxlfrrr.exe 1748 rxxxllr.exe 2432 bbnttb.exe 1196 ppjjj.exe 1236 rlrrlrx.exe 4996 7tbhhb.exe 4116 thhhtn.exe 1608 pjvvp.exe 1924 rfxrllf.exe 2580 tbbhhh.exe 4636 tbtttb.exe 4488 pjpvv.exe 2680 rlrllfx.exe 3064 lfrrxxx.exe 4648 hhtbtt.exe 2256 nnhtbh.exe 2340 vpdpj.exe 872 5rllfll.exe 4072 fxrrxff.exe 1204 thhhhh.exe 2056 9pppj.exe 3736 rrlxxff.exe 2312 nhtbbt.exe 5040 vjpvv.exe 4028 pjpjd.exe 1644 lllfxff.exe 3712 nhnttb.exe 4624 nhhnhb.exe 5064 dvjdp.exe 2572 vppjd.exe 4216 lfllfll.exe 3844 nnnnnb.exe 2700 bbtbhn.exe 1584 pdjjd.exe 4792 lfrllrl.exe 3268 fflllxx.exe 4444 bbhhnt.exe 4416 ddpdd.exe 2104 ddppv.exe 4048 flxxrxx.exe 3784 rfxxxff.exe 1548 tthtbh.exe 3764 7btbhn.exe 4008 vjvvv.exe 632 frxfflr.exe 1268 llrflrf.exe 1900 nntbbh.exe 1084 hnbbbn.exe -
resource yara_rule behavioral2/memory/4600-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/452-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4300-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2088-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/100-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4216-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3316-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4156-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3816-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2436-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4008-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1748-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2432-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1196-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1236-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4116-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2680-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3064-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2088-8254-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4600 wrote to memory of 452 4600 06b32bde5b260c24fa49ee30b9eae520_NeikiAnalytics.exe 83 PID 4600 wrote to memory of 452 4600 06b32bde5b260c24fa49ee30b9eae520_NeikiAnalytics.exe 83 PID 4600 wrote to memory of 452 4600 06b32bde5b260c24fa49ee30b9eae520_NeikiAnalytics.exe 83 PID 452 wrote to memory of 4300 452 tttnnn.exe 84 PID 452 wrote to memory of 4300 452 tttnnn.exe 84 PID 452 wrote to memory of 4300 452 tttnnn.exe 84 PID 4300 wrote to memory of 1496 4300 ntbbtb.exe 85 PID 4300 wrote to memory of 1496 4300 ntbbtb.exe 85 PID 4300 wrote to memory of 1496 4300 ntbbtb.exe 85 PID 1496 wrote to memory of 2088 1496 jdpvd.exe 86 PID 1496 wrote to memory of 2088 1496 jdpvd.exe 86 PID 1496 wrote to memory of 2088 1496 jdpvd.exe 86 PID 2088 wrote to memory of 100 2088 pvppj.exe 87 PID 2088 wrote to memory of 100 2088 pvppj.exe 87 PID 2088 wrote to memory of 100 2088 pvppj.exe 87 PID 100 wrote to memory of 4216 100 ffllxff.exe 88 PID 100 wrote to memory of 4216 100 ffllxff.exe 88 PID 100 wrote to memory of 4216 100 ffllxff.exe 88 PID 4216 wrote to memory of 3316 4216 bbbhhn.exe 89 PID 4216 wrote to memory of 3316 4216 bbbhhn.exe 89 PID 4216 wrote to memory of 3316 4216 bbbhhn.exe 89 PID 3316 wrote to memory of 4692 3316 jjppj.exe 90 PID 3316 wrote to memory of 4692 3316 jjppj.exe 90 PID 3316 wrote to memory of 4692 3316 jjppj.exe 90 PID 4692 wrote to memory of 3236 4692 xfrxrxx.exe 91 PID 4692 wrote to memory of 3236 4692 xfrxrxx.exe 91 PID 4692 wrote to memory of 3236 4692 xfrxrxx.exe 91 PID 3236 wrote to memory of 4792 3236 xrxxxlx.exe 92 PID 3236 wrote to memory of 4792 3236 xrxxxlx.exe 92 PID 3236 wrote to memory of 4792 3236 xrxxxlx.exe 92 PID 4792 wrote to memory of 4156 4792 ttbhtb.exe 93 PID 4792 wrote to memory of 4156 4792 ttbhtb.exe 93 PID 4792 wrote to memory of 4156 4792 ttbhtb.exe 93 PID 4156 wrote to memory of 932 4156 nbnhbh.exe 94 PID 4156 wrote to memory of 932 4156 nbnhbh.exe 94 PID 4156 wrote to memory of 932 4156 nbnhbh.exe 94 PID 932 wrote to memory of 2924 932 jdppp.exe 95 PID 932 wrote to memory of 2924 932 jdppp.exe 95 PID 932 wrote to memory of 2924 932 jdppp.exe 95 PID 2924 wrote to memory of 3816 2924 frfllrr.exe 96 PID 2924 wrote to memory of 3816 2924 frfllrr.exe 96 PID 2924 wrote to memory of 3816 2924 frfllrr.exe 96 PID 3816 wrote to memory of 2436 3816 xxfffll.exe 97 PID 3816 wrote to memory of 2436 3816 xxfffll.exe 97 PID 3816 wrote to memory of 2436 3816 xxfffll.exe 97 PID 2436 wrote to memory of 3720 2436 bthntt.exe 98 PID 2436 wrote to memory of 3720 2436 bthntt.exe 98 PID 2436 wrote to memory of 3720 2436 bthntt.exe 98 PID 3720 wrote to memory of 4008 3720 vvddd.exe 99 PID 3720 wrote to memory of 4008 3720 vvddd.exe 99 PID 3720 wrote to memory of 4008 3720 vvddd.exe 99 PID 4008 wrote to memory of 1748 4008 xxlfrrr.exe 100 PID 4008 wrote to memory of 1748 4008 xxlfrrr.exe 100 PID 4008 wrote to memory of 1748 4008 xxlfrrr.exe 100 PID 1748 wrote to memory of 2432 1748 rxxxllr.exe 101 PID 1748 wrote to memory of 2432 1748 rxxxllr.exe 101 PID 1748 wrote to memory of 2432 1748 rxxxllr.exe 101 PID 2432 wrote to memory of 1196 2432 bbnttb.exe 102 PID 2432 wrote to memory of 1196 2432 bbnttb.exe 102 PID 2432 wrote to memory of 1196 2432 bbnttb.exe 102 PID 1196 wrote to memory of 1236 1196 ppjjj.exe 104 PID 1196 wrote to memory of 1236 1196 ppjjj.exe 104 PID 1196 wrote to memory of 1236 1196 ppjjj.exe 104 PID 1236 wrote to memory of 4996 1236 rlrrlrx.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\06b32bde5b260c24fa49ee30b9eae520_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\06b32bde5b260c24fa49ee30b9eae520_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\tttnnn.exec:\tttnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\ntbbtb.exec:\ntbbtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\jdpvd.exec:\jdpvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\pvppj.exec:\pvppj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\ffllxff.exec:\ffllxff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100 -
\??\c:\bbbhhn.exec:\bbbhhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\jjppj.exec:\jjppj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\xfrxrxx.exec:\xfrxrxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\xrxxxlx.exec:\xrxxxlx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\ttbhtb.exec:\ttbhtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\nbnhbh.exec:\nbnhbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\jdppp.exec:\jdppp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
\??\c:\frfllrr.exec:\frfllrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\xxfffll.exec:\xxfffll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\bthntt.exec:\bthntt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\vvddd.exec:\vvddd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\xxlfrrr.exec:\xxlfrrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\rxxxllr.exec:\rxxxllr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\bbnttb.exec:\bbnttb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\ppjjj.exec:\ppjjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\rlrrlrx.exec:\rlrrlrx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\7tbhhb.exec:\7tbhhb.exe23⤵
- Executes dropped EXE
PID:4996 -
\??\c:\thhhtn.exec:\thhhtn.exe24⤵
- Executes dropped EXE
PID:4116 -
\??\c:\pjvvp.exec:\pjvvp.exe25⤵
- Executes dropped EXE
PID:1608 -
\??\c:\rfxrllf.exec:\rfxrllf.exe26⤵
- Executes dropped EXE
PID:1924 -
\??\c:\tbbhhh.exec:\tbbhhh.exe27⤵
- Executes dropped EXE
PID:2580 -
\??\c:\tbtttb.exec:\tbtttb.exe28⤵
- Executes dropped EXE
PID:4636 -
\??\c:\pjpvv.exec:\pjpvv.exe29⤵
- Executes dropped EXE
PID:4488 -
\??\c:\rlrllfx.exec:\rlrllfx.exe30⤵
- Executes dropped EXE
PID:2680 -
\??\c:\lfrrxxx.exec:\lfrrxxx.exe31⤵
- Executes dropped EXE
PID:3064 -
\??\c:\hhtbtt.exec:\hhtbtt.exe32⤵
- Executes dropped EXE
PID:4648 -
\??\c:\nnhtbh.exec:\nnhtbh.exe33⤵
- Executes dropped EXE
PID:2256 -
\??\c:\vpdpj.exec:\vpdpj.exe34⤵
- Executes dropped EXE
PID:2340 -
\??\c:\5rllfll.exec:\5rllfll.exe35⤵
- Executes dropped EXE
PID:872 -
\??\c:\fxrrxff.exec:\fxrrxff.exe36⤵
- Executes dropped EXE
PID:4072 -
\??\c:\thhhhh.exec:\thhhhh.exe37⤵
- Executes dropped EXE
PID:1204 -
\??\c:\9pppj.exec:\9pppj.exe38⤵
- Executes dropped EXE
PID:2056 -
\??\c:\rrlxxff.exec:\rrlxxff.exe39⤵
- Executes dropped EXE
PID:3736 -
\??\c:\nhtbbt.exec:\nhtbbt.exe40⤵
- Executes dropped EXE
PID:2312 -
\??\c:\1bthbt.exec:\1bthbt.exe41⤵PID:4484
-
\??\c:\vjpvv.exec:\vjpvv.exe42⤵
- Executes dropped EXE
PID:5040 -
\??\c:\pjpjd.exec:\pjpjd.exe43⤵
- Executes dropped EXE
PID:4028 -
\??\c:\lllfxff.exec:\lllfxff.exe44⤵
- Executes dropped EXE
PID:1644 -
\??\c:\nhnttb.exec:\nhnttb.exe45⤵
- Executes dropped EXE
PID:3712 -
\??\c:\nhhnhb.exec:\nhhnhb.exe46⤵
- Executes dropped EXE
PID:4624 -
\??\c:\dvjdp.exec:\dvjdp.exe47⤵
- Executes dropped EXE
PID:5064 -
\??\c:\vppjd.exec:\vppjd.exe48⤵
- Executes dropped EXE
PID:2572 -
\??\c:\lfllfll.exec:\lfllfll.exe49⤵
- Executes dropped EXE
PID:4216 -
\??\c:\nnnnnb.exec:\nnnnnb.exe50⤵
- Executes dropped EXE
PID:3844 -
\??\c:\bbtbhn.exec:\bbtbhn.exe51⤵
- Executes dropped EXE
PID:2700 -
\??\c:\pdjjd.exec:\pdjjd.exe52⤵
- Executes dropped EXE
PID:1584 -
\??\c:\lfrllrl.exec:\lfrllrl.exe53⤵
- Executes dropped EXE
PID:4792 -
\??\c:\fflllxx.exec:\fflllxx.exe54⤵
- Executes dropped EXE
PID:3268 -
\??\c:\bbhhnt.exec:\bbhhnt.exe55⤵
- Executes dropped EXE
PID:4444 -
\??\c:\ddpdd.exec:\ddpdd.exe56⤵
- Executes dropped EXE
PID:4416 -
\??\c:\ddppv.exec:\ddppv.exe57⤵
- Executes dropped EXE
PID:2104 -
\??\c:\flxxrxx.exec:\flxxrxx.exe58⤵
- Executes dropped EXE
PID:4048 -
\??\c:\rfxxxff.exec:\rfxxxff.exe59⤵
- Executes dropped EXE
PID:3784 -
\??\c:\tthtbh.exec:\tthtbh.exe60⤵
- Executes dropped EXE
PID:1548 -
\??\c:\7btbhn.exec:\7btbhn.exe61⤵
- Executes dropped EXE
PID:3764 -
\??\c:\vjvvv.exec:\vjvvv.exe62⤵
- Executes dropped EXE
PID:4008 -
\??\c:\frxfflr.exec:\frxfflr.exe63⤵
- Executes dropped EXE
PID:632 -
\??\c:\llrflrf.exec:\llrflrf.exe64⤵
- Executes dropped EXE
PID:1268 -
\??\c:\nntbbh.exec:\nntbbh.exe65⤵
- Executes dropped EXE
PID:1900 -
\??\c:\hnbbbn.exec:\hnbbbn.exe66⤵
- Executes dropped EXE
PID:1084 -
\??\c:\jpdjj.exec:\jpdjj.exe67⤵PID:3436
-
\??\c:\ddjpp.exec:\ddjpp.exe68⤵PID:1236
-
\??\c:\frlrrxf.exec:\frlrrxf.exe69⤵PID:1428
-
\??\c:\xlxffll.exec:\xlxffll.exe70⤵PID:4856
-
\??\c:\hbnttt.exec:\hbnttt.exe71⤵PID:432
-
\??\c:\tnhnhn.exec:\tnhnhn.exe72⤵PID:2016
-
\??\c:\pdpvp.exec:\pdpvp.exe73⤵PID:3224
-
\??\c:\vvjpp.exec:\vvjpp.exe74⤵PID:1136
-
\??\c:\xrlrlxf.exec:\xrlrlxf.exe75⤵PID:4176
-
\??\c:\9ffllll.exec:\9ffllll.exe76⤵PID:4252
-
\??\c:\thnntt.exec:\thnntt.exe77⤵PID:3164
-
\??\c:\hnbbht.exec:\hnbbht.exe78⤵PID:2720
-
\??\c:\vjjjd.exec:\vjjjd.exe79⤵PID:1132
-
\??\c:\jdvvv.exec:\jdvvv.exe80⤵PID:4648
-
\??\c:\xrffxxx.exec:\xrffxxx.exe81⤵PID:2928
-
\??\c:\xrrxflr.exec:\xrrxflr.exe82⤵PID:3676
-
\??\c:\nnnttb.exec:\nnnttb.exe83⤵PID:3760
-
\??\c:\9tbbtb.exec:\9tbbtb.exe84⤵PID:2364
-
\??\c:\jjdjp.exec:\jjdjp.exe85⤵PID:3572
-
\??\c:\rlrxxfl.exec:\rlrxxfl.exe86⤵PID:400
-
\??\c:\5ntbnb.exec:\5ntbnb.exe87⤵PID:4360
-
\??\c:\tbtnth.exec:\tbtnth.exe88⤵PID:4344
-
\??\c:\ddpjd.exec:\ddpjd.exe89⤵PID:4088
-
\??\c:\vdjjj.exec:\vdjjj.exe90⤵PID:452
-
\??\c:\fffrxxf.exec:\fffrxxf.exe91⤵PID:1304
-
\??\c:\rffxxrf.exec:\rffxxrf.exe92⤵PID:2816
-
\??\c:\1nbnnb.exec:\1nbnnb.exe93⤵PID:512
-
\??\c:\jvppp.exec:\jvppp.exe94⤵PID:4380
-
\??\c:\dpddd.exec:\dpddd.exe95⤵PID:2768
-
\??\c:\rrxlllf.exec:\rrxlllf.exe96⤵PID:2028
-
\??\c:\hbbbnh.exec:\hbbbnh.exe97⤵PID:5016
-
\??\c:\dppjp.exec:\dppjp.exe98⤵PID:5080
-
\??\c:\ddpvj.exec:\ddpvj.exe99⤵PID:4468
-
\??\c:\lxxxrff.exec:\lxxxrff.exe100⤵PID:2536
-
\??\c:\xrxxxxr.exec:\xrxxxxr.exe101⤵PID:3380
-
\??\c:\thbhnb.exec:\thbhnb.exe102⤵PID:4584
-
\??\c:\jpddj.exec:\jpddj.exe103⤵PID:3216
-
\??\c:\frrxrxx.exec:\frrxrxx.exe104⤵PID:4104
-
\??\c:\5lfrrxx.exec:\5lfrrxx.exe105⤵PID:2984
-
\??\c:\hhbhtt.exec:\hhbhtt.exe106⤵PID:3680
-
\??\c:\hnnnnt.exec:\hnnnnt.exe107⤵PID:1708
-
\??\c:\ttbbbb.exec:\ttbbbb.exe108⤵PID:4644
-
\??\c:\dvpjd.exec:\dvpjd.exe109⤵PID:1408
-
\??\c:\flrlffl.exec:\flrlffl.exe110⤵PID:1748
-
\??\c:\7xfffrr.exec:\7xfffrr.exe111⤵PID:3884
-
\??\c:\ffllrxx.exec:\ffllrxx.exe112⤵PID:4768
-
\??\c:\hnbhbh.exec:\hnbhbh.exe113⤵PID:4248
-
\??\c:\vjpvv.exec:\vjpvv.exe114⤵PID:3436
-
\??\c:\vpppj.exec:\vpppj.exe115⤵PID:1236
-
\??\c:\rrfrxff.exec:\rrfrxff.exe116⤵PID:2224
-
\??\c:\rflrrrr.exec:\rflrrrr.exe117⤵PID:4856
-
\??\c:\bhnntt.exec:\bhnntt.exe118⤵PID:432
-
\??\c:\bttbnt.exec:\bttbnt.exe119⤵PID:2016
-
\??\c:\1pdpv.exec:\1pdpv.exe120⤵PID:4492
-
\??\c:\ffffxfx.exec:\ffffxfx.exe121⤵PID:3304
-
\??\c:\3lrrlrl.exec:\3lrrlrl.exe122⤵PID:2988
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-