Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02-06-2024 05:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3e8c3c536d1fb5ef4d506c5acc8b8420_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
3e8c3c536d1fb5ef4d506c5acc8b8420_NeikiAnalytics.exe
-
Size
95KB
-
MD5
3e8c3c536d1fb5ef4d506c5acc8b8420
-
SHA1
b347039daa84ead5787f3d4d85e5bbc33416d2ad
-
SHA256
296b1b0a81575db2b7277b23ad109a16330e30c52aeddf10c274c9ab093c6644
-
SHA512
7b0924a3c1a1b865f7bc8ff76552270b3e2077a9a212ac871dc786a12c9835c72b4afe36fa33bff5714c403efa79de3ca042adf0bc34c3e3517ccd25b6519bed
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxEPOfPrAW:ymb3NkkiQ3mdBjFo73PYP1lri3KuOnrR
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/776-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/776-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1668-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4772-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1480-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1528-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2824-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3312-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3020-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/368-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/824-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1036-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4472-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2660-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2496-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1628-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5000-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1928-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2400-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2440-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/528-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4012-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1668 rrfrrff.exe 4908 hbnntt.exe 4772 pvdvd.exe 3460 rxfxxxx.exe 1480 fflllll.exe 1528 bbhhnt.exe 3312 vjvpj.exe 384 vpdvj.exe 2824 rrrflrr.exe 3020 3xllfff.exe 368 9vvpp.exe 824 9rxrllf.exe 1036 hnttbb.exe 4472 jdddd.exe 3192 lxxrlrl.exe 2660 llrlffx.exe 3480 9nbbhh.exe 2496 7flfxxx.exe 1628 rxrrlxf.exe 5000 htbbbb.exe 4076 ddjdp.exe 1928 vpppj.exe 2400 rfrrlrf.exe 2588 nnbbtt.exe 2440 7pjdp.exe 2864 9vdvp.exe 4504 1hbtnh.exe 528 hbhnnn.exe 4012 ddpjd.exe 4808 1lrllll.exe 4580 bbnhhh.exe 4980 pdddv.exe 3624 5djvj.exe 1804 rxffxxx.exe 3856 htbtnn.exe 2584 nhhbtn.exe 4324 3vdjj.exe 4556 pjvvd.exe 4984 lfffxxx.exe 3732 tnntbh.exe 4140 bbhtnh.exe 2140 7pppj.exe 4492 rlffrrr.exe 1300 bhbbtt.exe 2020 btbbtt.exe 384 pdjdv.exe 4120 5lrrrrr.exe 1328 3bbhth.exe 4976 bbhhtt.exe 3988 pvppp.exe 4696 lflfxxx.exe 388 fxffxrl.exe 1312 5ttttt.exe 4472 hnttnn.exe 1744 vvjjj.exe 2212 rlxxrrf.exe 5024 llfxrrl.exe 2316 3ttttb.exe 2812 thtnhh.exe 5016 jppjj.exe 3544 pvvpj.exe 988 rrlfxff.exe 4076 flllfff.exe 4260 thnnhn.exe -
resource yara_rule behavioral2/memory/776-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/776-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1668-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4772-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1480-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1528-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1528-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3312-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/368-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/824-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1036-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4472-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2660-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2496-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1628-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1928-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2400-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2440-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/528-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-195-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 776 wrote to memory of 1668 776 3e8c3c536d1fb5ef4d506c5acc8b8420_NeikiAnalytics.exe 82 PID 776 wrote to memory of 1668 776 3e8c3c536d1fb5ef4d506c5acc8b8420_NeikiAnalytics.exe 82 PID 776 wrote to memory of 1668 776 3e8c3c536d1fb5ef4d506c5acc8b8420_NeikiAnalytics.exe 82 PID 1668 wrote to memory of 4908 1668 rrfrrff.exe 83 PID 1668 wrote to memory of 4908 1668 rrfrrff.exe 83 PID 1668 wrote to memory of 4908 1668 rrfrrff.exe 83 PID 4908 wrote to memory of 4772 4908 hbnntt.exe 84 PID 4908 wrote to memory of 4772 4908 hbnntt.exe 84 PID 4908 wrote to memory of 4772 4908 hbnntt.exe 84 PID 4772 wrote to memory of 3460 4772 pvdvd.exe 85 PID 4772 wrote to memory of 3460 4772 pvdvd.exe 85 PID 4772 wrote to memory of 3460 4772 pvdvd.exe 85 PID 3460 wrote to memory of 1480 3460 rxfxxxx.exe 86 PID 3460 wrote to memory of 1480 3460 rxfxxxx.exe 86 PID 3460 wrote to memory of 1480 3460 rxfxxxx.exe 86 PID 1480 wrote to memory of 1528 1480 fflllll.exe 87 PID 1480 wrote to memory of 1528 1480 fflllll.exe 87 PID 1480 wrote to memory of 1528 1480 fflllll.exe 87 PID 1528 wrote to memory of 3312 1528 bbhhnt.exe 88 PID 1528 wrote to memory of 3312 1528 bbhhnt.exe 88 PID 1528 wrote to memory of 3312 1528 bbhhnt.exe 88 PID 3312 wrote to memory of 384 3312 vjvpj.exe 89 PID 3312 wrote to memory of 384 3312 vjvpj.exe 89 PID 3312 wrote to memory of 384 3312 vjvpj.exe 89 PID 384 wrote to memory of 2824 384 vpdvj.exe 90 PID 384 wrote to memory of 2824 384 vpdvj.exe 90 PID 384 wrote to memory of 2824 384 vpdvj.exe 90 PID 2824 wrote to memory of 3020 2824 rrrflrr.exe 91 PID 2824 wrote to memory of 3020 2824 rrrflrr.exe 91 PID 2824 wrote to memory of 3020 2824 rrrflrr.exe 91 PID 3020 wrote to memory of 368 3020 3xllfff.exe 92 PID 3020 wrote to memory of 368 3020 3xllfff.exe 92 PID 3020 wrote to memory of 368 3020 3xllfff.exe 92 PID 368 wrote to memory of 824 368 9vvpp.exe 93 PID 368 wrote to memory of 824 368 9vvpp.exe 93 PID 368 wrote to memory of 824 368 9vvpp.exe 93 PID 824 wrote to memory of 1036 824 9rxrllf.exe 94 PID 824 wrote to memory of 1036 824 9rxrllf.exe 94 PID 824 wrote to memory of 1036 824 9rxrllf.exe 94 PID 1036 wrote to memory of 4472 1036 hnttbb.exe 95 PID 1036 wrote to memory of 4472 1036 hnttbb.exe 95 PID 1036 wrote to memory of 4472 1036 hnttbb.exe 95 PID 4472 wrote to memory of 3192 4472 jdddd.exe 96 PID 4472 wrote to memory of 3192 4472 jdddd.exe 96 PID 4472 wrote to memory of 3192 4472 jdddd.exe 96 PID 3192 wrote to memory of 2660 3192 lxxrlrl.exe 97 PID 3192 wrote to memory of 2660 3192 lxxrlrl.exe 97 PID 3192 wrote to memory of 2660 3192 lxxrlrl.exe 97 PID 2660 wrote to memory of 3480 2660 llrlffx.exe 98 PID 2660 wrote to memory of 3480 2660 llrlffx.exe 98 PID 2660 wrote to memory of 3480 2660 llrlffx.exe 98 PID 3480 wrote to memory of 2496 3480 9nbbhh.exe 99 PID 3480 wrote to memory of 2496 3480 9nbbhh.exe 99 PID 3480 wrote to memory of 2496 3480 9nbbhh.exe 99 PID 2496 wrote to memory of 1628 2496 7flfxxx.exe 100 PID 2496 wrote to memory of 1628 2496 7flfxxx.exe 100 PID 2496 wrote to memory of 1628 2496 7flfxxx.exe 100 PID 1628 wrote to memory of 5000 1628 rxrrlxf.exe 101 PID 1628 wrote to memory of 5000 1628 rxrrlxf.exe 101 PID 1628 wrote to memory of 5000 1628 rxrrlxf.exe 101 PID 5000 wrote to memory of 4076 5000 htbbbb.exe 102 PID 5000 wrote to memory of 4076 5000 htbbbb.exe 102 PID 5000 wrote to memory of 4076 5000 htbbbb.exe 102 PID 4076 wrote to memory of 1928 4076 ddjdp.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e8c3c536d1fb5ef4d506c5acc8b8420_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3e8c3c536d1fb5ef4d506c5acc8b8420_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\rrfrrff.exec:\rrfrrff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\hbnntt.exec:\hbnntt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\pvdvd.exec:\pvdvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\rxfxxxx.exec:\rxfxxxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\fflllll.exec:\fflllll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\bbhhnt.exec:\bbhhnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\vjvpj.exec:\vjvpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
\??\c:\vpdvj.exec:\vpdvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\rrrflrr.exec:\rrrflrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\3xllfff.exec:\3xllfff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\9vvpp.exec:\9vvpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
\??\c:\9rxrllf.exec:\9rxrllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\hnttbb.exec:\hnttbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\jdddd.exec:\jdddd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\lxxrlrl.exec:\lxxrlrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\llrlffx.exec:\llrlffx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\9nbbhh.exec:\9nbbhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\7flfxxx.exec:\7flfxxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\rxrrlxf.exec:\rxrrlxf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\htbbbb.exec:\htbbbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\ddjdp.exec:\ddjdp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\vpppj.exec:\vpppj.exe23⤵
- Executes dropped EXE
PID:1928 -
\??\c:\rfrrlrf.exec:\rfrrlrf.exe24⤵
- Executes dropped EXE
PID:2400 -
\??\c:\nnbbtt.exec:\nnbbtt.exe25⤵
- Executes dropped EXE
PID:2588 -
\??\c:\7pjdp.exec:\7pjdp.exe26⤵
- Executes dropped EXE
PID:2440 -
\??\c:\9vdvp.exec:\9vdvp.exe27⤵
- Executes dropped EXE
PID:2864 -
\??\c:\1hbtnh.exec:\1hbtnh.exe28⤵
- Executes dropped EXE
PID:4504 -
\??\c:\hbhnnn.exec:\hbhnnn.exe29⤵
- Executes dropped EXE
PID:528 -
\??\c:\ddpjd.exec:\ddpjd.exe30⤵
- Executes dropped EXE
PID:4012 -
\??\c:\1lrllll.exec:\1lrllll.exe31⤵
- Executes dropped EXE
PID:4808 -
\??\c:\bbnhhh.exec:\bbnhhh.exe32⤵
- Executes dropped EXE
PID:4580 -
\??\c:\pdddv.exec:\pdddv.exe33⤵
- Executes dropped EXE
PID:4980 -
\??\c:\5djvj.exec:\5djvj.exe34⤵
- Executes dropped EXE
PID:3624 -
\??\c:\rxffxxx.exec:\rxffxxx.exe35⤵
- Executes dropped EXE
PID:1804 -
\??\c:\htbtnn.exec:\htbtnn.exe36⤵
- Executes dropped EXE
PID:3856 -
\??\c:\nhhbtn.exec:\nhhbtn.exe37⤵
- Executes dropped EXE
PID:2584 -
\??\c:\3vdjj.exec:\3vdjj.exe38⤵
- Executes dropped EXE
PID:4324 -
\??\c:\pjvvd.exec:\pjvvd.exe39⤵
- Executes dropped EXE
PID:4556 -
\??\c:\lfffxxx.exec:\lfffxxx.exe40⤵
- Executes dropped EXE
PID:4984 -
\??\c:\tnntbh.exec:\tnntbh.exe41⤵
- Executes dropped EXE
PID:3732 -
\??\c:\bbhtnh.exec:\bbhtnh.exe42⤵
- Executes dropped EXE
PID:4140 -
\??\c:\7pppj.exec:\7pppj.exe43⤵
- Executes dropped EXE
PID:2140 -
\??\c:\rlffrrr.exec:\rlffrrr.exe44⤵
- Executes dropped EXE
PID:4492 -
\??\c:\bhbbtt.exec:\bhbbtt.exe45⤵
- Executes dropped EXE
PID:1300 -
\??\c:\btbbtt.exec:\btbbtt.exe46⤵
- Executes dropped EXE
PID:2020 -
\??\c:\pdjdv.exec:\pdjdv.exe47⤵
- Executes dropped EXE
PID:384 -
\??\c:\5lrrrrr.exec:\5lrrrrr.exe48⤵
- Executes dropped EXE
PID:4120 -
\??\c:\3bbhth.exec:\3bbhth.exe49⤵
- Executes dropped EXE
PID:1328 -
\??\c:\bbhhtt.exec:\bbhhtt.exe50⤵
- Executes dropped EXE
PID:4976 -
\??\c:\pvppp.exec:\pvppp.exe51⤵
- Executes dropped EXE
PID:3988 -
\??\c:\lflfxxx.exec:\lflfxxx.exe52⤵
- Executes dropped EXE
PID:4696 -
\??\c:\fxffxrl.exec:\fxffxrl.exe53⤵
- Executes dropped EXE
PID:388 -
\??\c:\5ttttt.exec:\5ttttt.exe54⤵
- Executes dropped EXE
PID:1312 -
\??\c:\hnttnn.exec:\hnttnn.exe55⤵
- Executes dropped EXE
PID:4472 -
\??\c:\vvjjj.exec:\vvjjj.exe56⤵
- Executes dropped EXE
PID:1744 -
\??\c:\rlxxrrf.exec:\rlxxrrf.exe57⤵
- Executes dropped EXE
PID:2212 -
\??\c:\llfxrrl.exec:\llfxrrl.exe58⤵
- Executes dropped EXE
PID:5024 -
\??\c:\3ttttb.exec:\3ttttb.exe59⤵
- Executes dropped EXE
PID:2316 -
\??\c:\thtnhh.exec:\thtnhh.exe60⤵
- Executes dropped EXE
PID:2812 -
\??\c:\jppjj.exec:\jppjj.exe61⤵
- Executes dropped EXE
PID:5016 -
\??\c:\pvvpj.exec:\pvvpj.exe62⤵
- Executes dropped EXE
PID:3544 -
\??\c:\rrlfxff.exec:\rrlfxff.exe63⤵
- Executes dropped EXE
PID:988 -
\??\c:\flllfff.exec:\flllfff.exe64⤵
- Executes dropped EXE
PID:4076 -
\??\c:\thnnhn.exec:\thnnhn.exe65⤵
- Executes dropped EXE
PID:4260 -
\??\c:\hthhbb.exec:\hthhbb.exe66⤵PID:4092
-
\??\c:\vppjd.exec:\vppjd.exe67⤵PID:1844
-
\??\c:\9ppjd.exec:\9ppjd.exe68⤵PID:740
-
\??\c:\rlrrfff.exec:\rlrrfff.exe69⤵PID:4344
-
\??\c:\lfxxffl.exec:\lfxxffl.exe70⤵PID:2864
-
\??\c:\hbtthh.exec:\hbtthh.exe71⤵PID:2656
-
\??\c:\7tnnhh.exec:\7tnnhh.exe72⤵PID:4856
-
\??\c:\vjvvp.exec:\vjvvp.exe73⤵PID:1348
-
\??\c:\dpvjd.exec:\dpvjd.exe74⤵PID:4144
-
\??\c:\5llfxxx.exec:\5llfxxx.exe75⤵PID:4808
-
\??\c:\lxffffl.exec:\lxffffl.exe76⤵PID:4224
-
\??\c:\btnhbb.exec:\btnhbb.exe77⤵PID:4580
-
\??\c:\ddppv.exec:\ddppv.exe78⤵PID:2120
-
\??\c:\pdjdj.exec:\pdjdj.exe79⤵PID:216
-
\??\c:\rrflxff.exec:\rrflxff.exe80⤵PID:3012
-
\??\c:\ffxxxxl.exec:\ffxxxxl.exe81⤵PID:4356
-
\??\c:\9nnhtt.exec:\9nnhtt.exe82⤵PID:4368
-
\??\c:\jpvpd.exec:\jpvpd.exe83⤵PID:1672
-
\??\c:\5xfxrll.exec:\5xfxrll.exe84⤵PID:3000
-
\??\c:\nhhtnh.exec:\nhhtnh.exe85⤵PID:3732
-
\??\c:\9dpjd.exec:\9dpjd.exe86⤵PID:588
-
\??\c:\llxxxxl.exec:\llxxxxl.exe87⤵PID:1004
-
\??\c:\ffffxrr.exec:\ffffxrr.exe88⤵PID:4704
-
\??\c:\bnttnn.exec:\bnttnn.exe89⤵PID:4812
-
\??\c:\3jdvd.exec:\3jdvd.exe90⤵PID:2312
-
\??\c:\fffxrrr.exec:\fffxrrr.exe91⤵PID:1668
-
\??\c:\ffllfff.exec:\ffllfff.exe92⤵PID:3736
-
\??\c:\nhhhbh.exec:\nhhhbh.exe93⤵PID:4688
-
\??\c:\1ttttt.exec:\1ttttt.exe94⤵PID:3584
-
\??\c:\vjppp.exec:\vjppp.exe95⤵PID:4512
-
\??\c:\jjppj.exec:\jjppj.exe96⤵PID:1584
-
\??\c:\rfrlxxx.exec:\rfrlxxx.exe97⤵PID:2916
-
\??\c:\lrllffx.exec:\lrllffx.exe98⤵PID:552
-
\??\c:\tthhtt.exec:\tthhtt.exe99⤵PID:3372
-
\??\c:\hhnhbb.exec:\hhnhbb.exe100⤵PID:2432
-
\??\c:\7jjdv.exec:\7jjdv.exe101⤵PID:4896
-
\??\c:\pppjd.exec:\pppjd.exe102⤵PID:4440
-
\??\c:\lrxrlll.exec:\lrxrlll.exe103⤵PID:2316
-
\??\c:\rxlffff.exec:\rxlffff.exe104⤵PID:424
-
\??\c:\hbbbth.exec:\hbbbth.exe105⤵PID:5016
-
\??\c:\tntnnn.exec:\tntnnn.exe106⤵PID:3544
-
\??\c:\1djdv.exec:\1djdv.exe107⤵PID:988
-
\??\c:\dpppj.exec:\dpppj.exe108⤵PID:4636
-
\??\c:\fxffffl.exec:\fxffffl.exe109⤵PID:4260
-
\??\c:\1xfxrrl.exec:\1xfxrrl.exe110⤵PID:4092
-
\??\c:\bttbtb.exec:\bttbtb.exe111⤵PID:2440
-
\??\c:\9tbbhh.exec:\9tbbhh.exe112⤵PID:2672
-
\??\c:\dpjjd.exec:\dpjjd.exe113⤵PID:4072
-
\??\c:\jjddp.exec:\jjddp.exe114⤵PID:2864
-
\??\c:\rrfxrrl.exec:\rrfxrrl.exe115⤵PID:2656
-
\??\c:\lfrrrrl.exec:\lfrrrrl.exe116⤵PID:4856
-
\??\c:\htbhhh.exec:\htbhhh.exe117⤵PID:3912
-
\??\c:\htthtn.exec:\htthtn.exe118⤵PID:2604
-
\??\c:\jjvpp.exec:\jjvpp.exe119⤵PID:4516
-
\??\c:\vpvvv.exec:\vpvvv.exe120⤵PID:4580
-
\??\c:\xxxrffl.exec:\xxxrffl.exe121⤵PID:2120
-
\??\c:\thhhbb.exec:\thhhbb.exe122⤵PID:2844
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-