Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27-05-2024 21:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1ae80551df6570005b4b063d8de75df0NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
1ae80551df6570005b4b063d8de75df0NeikiAnalytics.exe
-
Size
65KB
-
MD5
1ae80551df6570005b4b063d8de75df0
-
SHA1
fbc31232b6dda1f9152c5037a9e57227b1be6c1b
-
SHA256
07ce7578dafd7e47a7eb1b62b1e9be888f02ce4e37bad463dd87ff04e57272b5
-
SHA512
826e328310feb3a40ec4a84dc66cee3a9eaf16f1ab0bef2e137aef99de20b7a17af62c30555d4560df3652b2a38640d8c7c7d6f584bab42e11699d7ad98e76d6
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfMTu:ymb3NkkiQ3mdBjFI4V4Tu
Malware Config
Signatures
-
Detect Blackmoon payload 30 IoCs
resource yara_rule behavioral2/memory/2956-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4848-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3360-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4000-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3144-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3720-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3848-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3280-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3024-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5076-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3644-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3736-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1416-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4616-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4748-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2144-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4284-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4716-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1624-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1456-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1192-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/760-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/592-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3460-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2768-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3256-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4628-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3800-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5076-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4848 nbhbtt.exe 3360 vvjdv.exe 4000 3vjjp.exe 3144 lflrrxl.exe 3720 1xffxfr.exe 3848 bhhntb.exe 3280 thnbhn.exe 3024 vppjd.exe 5076 1lxrxxr.exe 3800 xlrxlrr.exe 4628 fxfllrr.exe 3736 tbhbhh.exe 3644 dvvpj.exe 3256 pdjjd.exe 2768 xrffflr.exe 3460 bbhttb.exe 1416 hbhhtt.exe 5044 vvvpp.exe 592 7ddvv.exe 4616 lxfxrxx.exe 4748 xrrxxll.exe 1048 nbnbbn.exe 2144 tnbthn.exe 760 jpjdv.exe 1192 rffxrlf.exe 1624 3llfxfx.exe 4284 nhtnhh.exe 4716 nhnhtt.exe 1968 pppjj.exe 1456 5lrrlrr.exe 2944 nthhbb.exe 1916 tnnbnh.exe 3068 jvppj.exe 1800 lfxrllf.exe 5112 fxlxlxr.exe 4680 bntnbb.exe 2452 bnhhbt.exe 4536 jvvjj.exe 4840 rrlfxfr.exe 3184 rrxrllx.exe 848 ntthhb.exe 4668 pjddd.exe 3688 lllfrfr.exe 4740 xrffxff.exe 3272 nbntnt.exe 3316 vjvvd.exe 4784 jjpdd.exe 2964 xxxxffx.exe 208 nbhnhh.exe 1232 tbhbnt.exe 972 jdppj.exe 3700 djppj.exe 3296 rfxrrlr.exe 4112 btnntn.exe 3904 nbttht.exe 2788 vpjdd.exe 3612 jjpdj.exe 3876 rxffxxx.exe 1944 fllxrxr.exe 2252 hbhhhb.exe 1040 jdjpd.exe 2140 jpvpj.exe 3980 xfrrffr.exe 1616 5bhhbh.exe -
resource yara_rule behavioral2/memory/2956-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4848-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4848-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3360-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4000-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3720-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3848-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3848-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3848-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3280-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3024-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5076-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3644-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3736-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1416-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4748-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2144-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4716-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1624-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1456-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1192-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/760-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/592-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3460-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3256-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4628-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3800-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5076-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3280-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3280-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3280-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3848-48-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2956 wrote to memory of 4848 2956 1ae80551df6570005b4b063d8de75df0NeikiAnalytics.exe 81 PID 2956 wrote to memory of 4848 2956 1ae80551df6570005b4b063d8de75df0NeikiAnalytics.exe 81 PID 2956 wrote to memory of 4848 2956 1ae80551df6570005b4b063d8de75df0NeikiAnalytics.exe 81 PID 4848 wrote to memory of 3360 4848 nbhbtt.exe 82 PID 4848 wrote to memory of 3360 4848 nbhbtt.exe 82 PID 4848 wrote to memory of 3360 4848 nbhbtt.exe 82 PID 3360 wrote to memory of 4000 3360 vvjdv.exe 83 PID 3360 wrote to memory of 4000 3360 vvjdv.exe 83 PID 3360 wrote to memory of 4000 3360 vvjdv.exe 83 PID 4000 wrote to memory of 3144 4000 3vjjp.exe 84 PID 4000 wrote to memory of 3144 4000 3vjjp.exe 84 PID 4000 wrote to memory of 3144 4000 3vjjp.exe 84 PID 3144 wrote to memory of 3720 3144 lflrrxl.exe 85 PID 3144 wrote to memory of 3720 3144 lflrrxl.exe 85 PID 3144 wrote to memory of 3720 3144 lflrrxl.exe 85 PID 3720 wrote to memory of 3848 3720 1xffxfr.exe 86 PID 3720 wrote to memory of 3848 3720 1xffxfr.exe 86 PID 3720 wrote to memory of 3848 3720 1xffxfr.exe 86 PID 3848 wrote to memory of 3280 3848 bhhntb.exe 87 PID 3848 wrote to memory of 3280 3848 bhhntb.exe 87 PID 3848 wrote to memory of 3280 3848 bhhntb.exe 87 PID 3280 wrote to memory of 3024 3280 thnbhn.exe 88 PID 3280 wrote to memory of 3024 3280 thnbhn.exe 88 PID 3280 wrote to memory of 3024 3280 thnbhn.exe 88 PID 3024 wrote to memory of 5076 3024 vppjd.exe 89 PID 3024 wrote to memory of 5076 3024 vppjd.exe 89 PID 3024 wrote to memory of 5076 3024 vppjd.exe 89 PID 5076 wrote to memory of 3800 5076 1lxrxxr.exe 90 PID 5076 wrote to memory of 3800 5076 1lxrxxr.exe 90 PID 5076 wrote to memory of 3800 5076 1lxrxxr.exe 90 PID 3800 wrote to memory of 4628 3800 xlrxlrr.exe 91 PID 3800 wrote to memory of 4628 3800 xlrxlrr.exe 91 PID 3800 wrote to memory of 4628 3800 xlrxlrr.exe 91 PID 4628 wrote to memory of 3736 4628 fxfllrr.exe 92 PID 4628 wrote to memory of 3736 4628 fxfllrr.exe 92 PID 4628 wrote to memory of 3736 4628 fxfllrr.exe 92 PID 3736 wrote to memory of 3644 3736 tbhbhh.exe 94 PID 3736 wrote to memory of 3644 3736 tbhbhh.exe 94 PID 3736 wrote to memory of 3644 3736 tbhbhh.exe 94 PID 3644 wrote to memory of 3256 3644 dvvpj.exe 95 PID 3644 wrote to memory of 3256 3644 dvvpj.exe 95 PID 3644 wrote to memory of 3256 3644 dvvpj.exe 95 PID 3256 wrote to memory of 2768 3256 pdjjd.exe 96 PID 3256 wrote to memory of 2768 3256 pdjjd.exe 96 PID 3256 wrote to memory of 2768 3256 pdjjd.exe 96 PID 2768 wrote to memory of 3460 2768 xrffflr.exe 97 PID 2768 wrote to memory of 3460 2768 xrffflr.exe 97 PID 2768 wrote to memory of 3460 2768 xrffflr.exe 97 PID 3460 wrote to memory of 1416 3460 bbhttb.exe 99 PID 3460 wrote to memory of 1416 3460 bbhttb.exe 99 PID 3460 wrote to memory of 1416 3460 bbhttb.exe 99 PID 1416 wrote to memory of 5044 1416 hbhhtt.exe 100 PID 1416 wrote to memory of 5044 1416 hbhhtt.exe 100 PID 1416 wrote to memory of 5044 1416 hbhhtt.exe 100 PID 5044 wrote to memory of 592 5044 vvvpp.exe 101 PID 5044 wrote to memory of 592 5044 vvvpp.exe 101 PID 5044 wrote to memory of 592 5044 vvvpp.exe 101 PID 592 wrote to memory of 4616 592 7ddvv.exe 102 PID 592 wrote to memory of 4616 592 7ddvv.exe 102 PID 592 wrote to memory of 4616 592 7ddvv.exe 102 PID 4616 wrote to memory of 4748 4616 lxfxrxx.exe 103 PID 4616 wrote to memory of 4748 4616 lxfxrxx.exe 103 PID 4616 wrote to memory of 4748 4616 lxfxrxx.exe 103 PID 4748 wrote to memory of 1048 4748 xrrxxll.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ae80551df6570005b4b063d8de75df0NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1ae80551df6570005b4b063d8de75df0NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\nbhbtt.exec:\nbhbtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\vvjdv.exec:\vvjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
\??\c:\3vjjp.exec:\3vjjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\lflrrxl.exec:\lflrrxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\1xffxfr.exec:\1xffxfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\bhhntb.exec:\bhhntb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
\??\c:\thnbhn.exec:\thnbhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\vppjd.exec:\vppjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\1lxrxxr.exec:\1lxrxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\xlrxlrr.exec:\xlrxlrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
\??\c:\fxfllrr.exec:\fxfllrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\tbhbhh.exec:\tbhbhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
\??\c:\dvvpj.exec:\dvvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\pdjjd.exec:\pdjjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\xrffflr.exec:\xrffflr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\bbhttb.exec:\bbhttb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\hbhhtt.exec:\hbhhtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\vvvpp.exec:\vvvpp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\7ddvv.exec:\7ddvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\lxfxrxx.exec:\lxfxrxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\xrrxxll.exec:\xrrxxll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\nbnbbn.exec:\nbnbbn.exe23⤵
- Executes dropped EXE
PID:1048 -
\??\c:\tnbthn.exec:\tnbthn.exe24⤵
- Executes dropped EXE
PID:2144 -
\??\c:\jpjdv.exec:\jpjdv.exe25⤵
- Executes dropped EXE
PID:760 -
\??\c:\rffxrlf.exec:\rffxrlf.exe26⤵
- Executes dropped EXE
PID:1192 -
\??\c:\3llfxfx.exec:\3llfxfx.exe27⤵
- Executes dropped EXE
PID:1624 -
\??\c:\nhtnhh.exec:\nhtnhh.exe28⤵
- Executes dropped EXE
PID:4284 -
\??\c:\nhnhtt.exec:\nhnhtt.exe29⤵
- Executes dropped EXE
PID:4716 -
\??\c:\pppjj.exec:\pppjj.exe30⤵
- Executes dropped EXE
PID:1968 -
\??\c:\5lrrlrr.exec:\5lrrlrr.exe31⤵
- Executes dropped EXE
PID:1456 -
\??\c:\nthhbb.exec:\nthhbb.exe32⤵
- Executes dropped EXE
PID:2944 -
\??\c:\tnnbnh.exec:\tnnbnh.exe33⤵
- Executes dropped EXE
PID:1916 -
\??\c:\jvppj.exec:\jvppj.exe34⤵
- Executes dropped EXE
PID:3068 -
\??\c:\lfxrllf.exec:\lfxrllf.exe35⤵
- Executes dropped EXE
PID:1800 -
\??\c:\fxlxlxr.exec:\fxlxlxr.exe36⤵
- Executes dropped EXE
PID:5112 -
\??\c:\bntnbb.exec:\bntnbb.exe37⤵
- Executes dropped EXE
PID:4680 -
\??\c:\bnhhbt.exec:\bnhhbt.exe38⤵
- Executes dropped EXE
PID:2452 -
\??\c:\jvvjj.exec:\jvvjj.exe39⤵
- Executes dropped EXE
PID:4536 -
\??\c:\rrlfxfr.exec:\rrlfxfr.exe40⤵
- Executes dropped EXE
PID:4840 -
\??\c:\rrxrllx.exec:\rrxrllx.exe41⤵
- Executes dropped EXE
PID:3184 -
\??\c:\ntthhb.exec:\ntthhb.exe42⤵
- Executes dropped EXE
PID:848 -
\??\c:\pjddd.exec:\pjddd.exe43⤵
- Executes dropped EXE
PID:4668 -
\??\c:\lllfrfr.exec:\lllfrfr.exe44⤵
- Executes dropped EXE
PID:3688 -
\??\c:\xrffxff.exec:\xrffxff.exe45⤵
- Executes dropped EXE
PID:4740 -
\??\c:\nbntnt.exec:\nbntnt.exe46⤵
- Executes dropped EXE
PID:3272 -
\??\c:\vjvvd.exec:\vjvvd.exe47⤵
- Executes dropped EXE
PID:3316 -
\??\c:\jjpdd.exec:\jjpdd.exe48⤵
- Executes dropped EXE
PID:4784 -
\??\c:\xxxxffx.exec:\xxxxffx.exe49⤵
- Executes dropped EXE
PID:2964 -
\??\c:\nbhnhh.exec:\nbhnhh.exe50⤵
- Executes dropped EXE
PID:208 -
\??\c:\tbhbnt.exec:\tbhbnt.exe51⤵
- Executes dropped EXE
PID:1232 -
\??\c:\jdppj.exec:\jdppj.exe52⤵
- Executes dropped EXE
PID:972 -
\??\c:\djppj.exec:\djppj.exe53⤵
- Executes dropped EXE
PID:3700 -
\??\c:\rfxrrlr.exec:\rfxrrlr.exe54⤵
- Executes dropped EXE
PID:3296 -
\??\c:\btnntn.exec:\btnntn.exe55⤵
- Executes dropped EXE
PID:4112 -
\??\c:\nbttht.exec:\nbttht.exe56⤵
- Executes dropped EXE
PID:3904 -
\??\c:\vpjdd.exec:\vpjdd.exe57⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jjpdj.exec:\jjpdj.exe58⤵
- Executes dropped EXE
PID:3612 -
\??\c:\rxffxxx.exec:\rxffxxx.exe59⤵
- Executes dropped EXE
PID:3876 -
\??\c:\fllxrxr.exec:\fllxrxr.exe60⤵
- Executes dropped EXE
PID:1944 -
\??\c:\hbhhhb.exec:\hbhhhb.exe61⤵
- Executes dropped EXE
PID:2252 -
\??\c:\jdjpd.exec:\jdjpd.exe62⤵
- Executes dropped EXE
PID:1040 -
\??\c:\jpvpj.exec:\jpvpj.exe63⤵
- Executes dropped EXE
PID:2140 -
\??\c:\xfrrffr.exec:\xfrrffr.exe64⤵
- Executes dropped EXE
PID:3980 -
\??\c:\5bhhbh.exec:\5bhhbh.exe65⤵
- Executes dropped EXE
PID:1616 -
\??\c:\9ttnnn.exec:\9ttnnn.exe66⤵PID:2212
-
\??\c:\tnttnn.exec:\tnttnn.exe67⤵PID:2796
-
\??\c:\vpdpp.exec:\vpdpp.exe68⤵PID:4456
-
\??\c:\pjvvj.exec:\pjvvj.exe69⤵PID:4748
-
\??\c:\rlfrlrx.exec:\rlfrlrx.exe70⤵PID:4640
-
\??\c:\xxfffff.exec:\xxfffff.exe71⤵PID:1488
-
\??\c:\bnnbbn.exec:\bnnbbn.exe72⤵PID:3680
-
\??\c:\1bhhtb.exec:\1bhhtb.exe73⤵PID:1756
-
\??\c:\vpjjd.exec:\vpjjd.exe74⤵PID:4496
-
\??\c:\lxfxrrx.exec:\lxfxrrx.exe75⤵PID:4004
-
\??\c:\fxffrrr.exec:\fxffrrr.exe76⤵PID:4328
-
\??\c:\thnnhh.exec:\thnnhh.exe77⤵PID:4304
-
\??\c:\nhnhbb.exec:\nhnhbb.exe78⤵PID:4620
-
\??\c:\hbhbbh.exec:\hbhbbh.exe79⤵PID:224
-
\??\c:\jdpjj.exec:\jdpjj.exe80⤵PID:844
-
\??\c:\pjjpp.exec:\pjjpp.exe81⤵PID:4116
-
\??\c:\llrllll.exec:\llrllll.exe82⤵PID:2944
-
\??\c:\ffflfrr.exec:\ffflfrr.exe83⤵PID:3456
-
\??\c:\5bbtnt.exec:\5bbtnt.exe84⤵PID:4700
-
\??\c:\vvvpv.exec:\vvvpv.exe85⤵PID:4020
-
\??\c:\vppvp.exec:\vppvp.exe86⤵PID:3756
-
\??\c:\xrrrlll.exec:\xrrrlll.exe87⤵PID:5112
-
\??\c:\rrrrrrr.exec:\rrrrrrr.exe88⤵PID:2684
-
\??\c:\ttbnhn.exec:\ttbnhn.exe89⤵PID:412
-
\??\c:\jvvpp.exec:\jvvpp.exe90⤵PID:4416
-
\??\c:\jdddv.exec:\jdddv.exe91⤵PID:1984
-
\??\c:\ffffxll.exec:\ffffxll.exe92⤵PID:3184
-
\??\c:\lxrrlll.exec:\lxrrlll.exe93⤵PID:316
-
\??\c:\htbbtn.exec:\htbbtn.exe94⤵PID:3172
-
\??\c:\tthhbh.exec:\tthhbh.exe95⤵PID:4836
-
\??\c:\xrxrllf.exec:\xrxrllf.exe96⤵PID:2548
-
\??\c:\rlxllfl.exec:\rlxllfl.exe97⤵PID:1612
-
\??\c:\ttttnh.exec:\ttttnh.exe98⤵PID:3316
-
\??\c:\dvvpp.exec:\dvvpp.exe99⤵PID:396
-
\??\c:\jvjdj.exec:\jvjdj.exe100⤵PID:5040
-
\??\c:\xlxxlfx.exec:\xlxxlfx.exe101⤵PID:5096
-
\??\c:\frffxrx.exec:\frffxrx.exe102⤵PID:3156
-
\??\c:\5hhhbb.exec:\5hhhbb.exe103⤵PID:2980
-
\??\c:\hhhntb.exec:\hhhntb.exe104⤵PID:2064
-
\??\c:\5ddvj.exec:\5ddvj.exe105⤵PID:1480
-
\??\c:\pdjdj.exec:\pdjdj.exe106⤵PID:3736
-
\??\c:\3frrfrr.exec:\3frrfrr.exe107⤵PID:2828
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe108⤵PID:880
-
\??\c:\3tttnt.exec:\3tttnt.exe109⤵PID:3464
-
\??\c:\nnnnhh.exec:\nnnnhh.exe110⤵PID:4872
-
\??\c:\dddjp.exec:\dddjp.exe111⤵PID:1088
-
\??\c:\djpjd.exec:\djpjd.exe112⤵PID:3320
-
\??\c:\xffxrlr.exec:\xffxrlr.exe113⤵PID:3448
-
\??\c:\3htnnn.exec:\3htnnn.exe114⤵PID:404
-
\??\c:\nhnhhn.exec:\nhnhhn.exe115⤵PID:1412
-
\??\c:\hbbnht.exec:\hbbnht.exe116⤵PID:812
-
\??\c:\vdjjj.exec:\vdjjj.exe117⤵PID:3576
-
\??\c:\pppvj.exec:\pppvj.exe118⤵PID:5036
-
\??\c:\xxrllrx.exec:\xxrllrx.exe119⤵PID:1116
-
\??\c:\fxxrllf.exec:\fxxrllf.exe120⤵PID:1208
-
\??\c:\nhbbnh.exec:\nhbbnh.exe121⤵PID:3268
-
\??\c:\9jpjd.exec:\9jpjd.exe122⤵PID:748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-