Analysis
- max time kernel
150s - max time network
128s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
19/06/2024, 11:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b898b6e70b4e4a534b800e16573ca390_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
- Target b898b6e70b4e4a534b800e16573ca390_NeikiAnalytics.exe
- Size 76KB
- Sample240619-nhvsvayhrb
- SHA256 3d564a5de8abc65240afa868b1471570ba0fdcaa8e89d12eea7e289eb8fecc4a
- MD5 b898b6e70b4e4a534b800e16573ca390
- SHA1 8e1eeb7fb542d534d9901b9d476fdf2f0eb2035b
- SHA512 cb217c009740632385f4bfc93ec6fb74aad7188ecace49b4ee4f9e2e13e6bc193d350438cca0b1596b5cbcd9079da35450a30a233e53db022715d6fb4bd6374c
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAX8gu3Gno9yvrjK2:ymb3NkkiQ3mdBjFo68t3Gno9IT
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/2836-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/892-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3428-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3056-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4488-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3348-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2100-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1564-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2184-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1240-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1196-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/516-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/464-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1616-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1572-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4196-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1440-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2032-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3548-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 3428 llrlfxf.exe 892 bththb.exe 3056 nnbhnh.exe 4724 pdvjv.exe 4488 dvpjv.exe 4652 rffrfxl.exe 3348 lffxlfx.exe 5052 hnnhth.exe 2100 3jjdv.exe 4892 xrxrxfx.exe 1564 fllfrlf.exe 3416 thbthb.exe 4956 pdvjv.exe 4592 jdvpd.exe 2184 1xrflfr.exe 4420 bbbbhb.exe 1240 vpdvj.exe 1196 xxlffxf.exe 516 xrfrlfr.exe 464 7tthhb.exe 4300 nbtnhh.exe 3140 vddjj.exe 1616 frxxlfr.exe 4424 frrlfxx.exe 3032 thhnhb.exe 1572 vjppj.exe 4196 dppdp.exe 2948 rlfrxrl.exe 1440 5hthnh.exe 2032 bnnhhh.exe 3548 1ppjp.exe 1680 lxxlxrf.exe 3396 llxrlrl.exe 3872 bnnnnh.exe 2980 jdvjd.exe 224 pjddv.exe 3592 3rrrfrr.exe 4504 9rxxrrr.exe 788 7bbtth.exe 5104 jdddp.exe 1756 fxffrrr.exe 3712 ffrrffl.exe 4564 9nthht.exe 448 tbbbtt.exe 3204 pvvdv.exe 2248 9dvvp.exe 4280 frrxrrr.exe 3088 jjpjd.exe 4420 pjjdp.exe 4872 rfrrfll.exe 1196 fxlffxr.exe 516 tthtnn.exe 2784 nhhbtn.exe 5088 pjddp.exe 860 pdjjd.exe 3496 jpvvv.exe 3492 xrfxfxx.exe 2772 fxfxlxx.exe 3032 nntttt.exe 3972 tnbbnt.exe 1372 3pvvv.exe 2416 vpjpp.exe 4336 xlrrlrl.exe 4328 xrrrlll.exe -
resource yara_rule behavioral2/memory/2836-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3428-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3428-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3428-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/892-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3428-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3056-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4488-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4488-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4488-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3348-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2100-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1564-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2184-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1240-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1196-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/464-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1616-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1572-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4196-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1440-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2032-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3548-207-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2836 wrote to memory of 3428 2836 b898b6e70b4e4a534b800e16573ca390_NeikiAnalytics.exe 90 PID 2836 wrote to memory of 3428 2836 b898b6e70b4e4a534b800e16573ca390_NeikiAnalytics.exe 90 PID 2836 wrote to memory of 3428 2836 b898b6e70b4e4a534b800e16573ca390_NeikiAnalytics.exe 90 PID 3428 wrote to memory of 892 3428 llrlfxf.exe 91 PID 3428 wrote to memory of 892 3428 llrlfxf.exe 91 PID 3428 wrote to memory of 892 3428 llrlfxf.exe 91 PID 892 wrote to memory of 3056 892 bththb.exe 92 PID 892 wrote to memory of 3056 892 bththb.exe 92 PID 892 wrote to memory of 3056 892 bththb.exe 92 PID 3056 wrote to memory of 4724 3056 nnbhnh.exe 93 PID 3056 wrote to memory of 4724 3056 nnbhnh.exe 93 PID 3056 wrote to memory of 4724 3056 nnbhnh.exe 93 PID 4724 wrote to memory of 4488 4724 pdvjv.exe 94 PID 4724 wrote to memory of 4488 4724 pdvjv.exe 94 PID 4724 wrote to memory of 4488 4724 pdvjv.exe 94 PID 4488 wrote to memory of 4652 4488 dvpjv.exe 95 PID 4488 wrote to memory of 4652 4488 dvpjv.exe 95 PID 4488 wrote to memory of 4652 4488 dvpjv.exe 95 PID 4652 wrote to memory of 3348 4652 rffrfxl.exe 96 PID 4652 wrote to memory of 3348 4652 rffrfxl.exe 96 PID 4652 wrote to memory of 3348 4652 rffrfxl.exe 96 PID 3348 wrote to memory of 5052 3348 lffxlfx.exe 97 PID 3348 wrote to memory of 5052 3348 lffxlfx.exe 97 PID 3348 wrote to memory of 5052 3348 lffxlfx.exe 97 PID 5052 wrote to memory of 2100 5052 hnnhth.exe 98 PID 5052 wrote to memory of 2100 5052 hnnhth.exe 98 PID 5052 wrote to memory of 2100 5052 hnnhth.exe 98 PID 2100 wrote to memory of 4892 2100 3jjdv.exe 99 PID 2100 wrote to memory of 4892 2100 3jjdv.exe 99 PID 2100 wrote to memory of 4892 2100 3jjdv.exe 99 PID 4892 wrote to memory of 1564 4892 xrxrxfx.exe 100 PID 4892 wrote to memory of 1564 4892 xrxrxfx.exe 100 PID 4892 wrote to memory of 1564 4892 xrxrxfx.exe 100 PID 1564 wrote to memory of 3416 1564 fllfrlf.exe 101 PID 1564 wrote to memory of 3416 1564 fllfrlf.exe 101 PID 1564 wrote to memory of 3416 1564 fllfrlf.exe 101 PID 3416 wrote to memory of 4956 3416 thbthb.exe 102 PID 3416 wrote to memory of 4956 3416 thbthb.exe 102 PID 3416 wrote to memory of 4956 3416 thbthb.exe 102 PID 4956 wrote to memory of 4592 4956 pdvjv.exe 103 PID 4956 wrote to memory of 4592 4956 pdvjv.exe 103 PID 4956 wrote to memory of 4592 4956 pdvjv.exe 103 PID 4592 wrote to memory of 2184 4592 jdvpd.exe 104 PID 4592 wrote to memory of 2184 4592 jdvpd.exe 104 PID 4592 wrote to memory of 2184 4592 jdvpd.exe 104 PID 2184 wrote to memory of 4420 2184 1xrflfr.exe 105 PID 2184 wrote to memory of 4420 2184 1xrflfr.exe 105 PID 2184 wrote to memory of 4420 2184 1xrflfr.exe 105 PID 4420 wrote to memory of 1240 4420 bbbbhb.exe 106 PID 4420 wrote to memory of 1240 4420 bbbbhb.exe 106 PID 4420 wrote to memory of 1240 4420 bbbbhb.exe 106 PID 1240 wrote to memory of 1196 1240 vpdvj.exe 107 PID 1240 wrote to memory of 1196 1240 vpdvj.exe 107 PID 1240 wrote to memory of 1196 1240 vpdvj.exe 107 PID 1196 wrote to memory of 516 1196 xxlffxf.exe 108 PID 1196 wrote to memory of 516 1196 xxlffxf.exe 108 PID 1196 wrote to memory of 516 1196 xxlffxf.exe 108 PID 516 wrote to memory of 464 516 xrfrlfr.exe 109 PID 516 wrote to memory of 464 516 xrfrlfr.exe 109 PID 516 wrote to memory of 464 516 xrfrlfr.exe 109 PID 464 wrote to memory of 4300 464 7tthhb.exe 110 PID 464 wrote to memory of 4300 464 7tthhb.exe 110 PID 464 wrote to memory of 4300 464 7tthhb.exe 110 PID 4300 wrote to memory of 3140 4300 nbtnhh.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\b898b6e70b4e4a534b800e16573ca390_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b898b6e70b4e4a534b800e16573ca390_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\llrlfxf.exec:\llrlfxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\bththb.exec:\bththb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
\??\c:\nnbhnh.exec:\nnbhnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\pdvjv.exec:\pdvjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\dvpjv.exec:\dvpjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\rffrfxl.exec:\rffrfxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\lffxlfx.exec:\lffxlfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\hnnhth.exec:\hnnhth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\3jjdv.exec:\3jjdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\xrxrxfx.exec:\xrxrxfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\fllfrlf.exec:\fllfrlf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\thbthb.exec:\thbthb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
\??\c:\pdvjv.exec:\pdvjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\jdvpd.exec:\jdvpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\1xrflfr.exec:\1xrflfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\bbbbhb.exec:\bbbbhb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\vpdvj.exec:\vpdvj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\xxlffxf.exec:\xxlffxf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\xrfrlfr.exec:\xrfrlfr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\7tthhb.exec:\7tthhb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\nbtnhh.exec:\nbtnhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\vddjj.exec:\vddjj.exe23⤵
- Executes dropped EXE
PID:3140 -
\??\c:\frxxlfr.exec:\frxxlfr.exe24⤵
- Executes dropped EXE
PID:1616 -
\??\c:\frrlfxx.exec:\frrlfxx.exe25⤵
- Executes dropped EXE
PID:4424 -
\??\c:\thhnhb.exec:\thhnhb.exe26⤵
- Executes dropped EXE
PID:3032 -
\??\c:\vjppj.exec:\vjppj.exe27⤵
- Executes dropped EXE
PID:1572 -
\??\c:\dppdp.exec:\dppdp.exe28⤵
- Executes dropped EXE
PID:4196 -
\??\c:\rlfrxrl.exec:\rlfrxrl.exe29⤵
- Executes dropped EXE
PID:2948 -
\??\c:\5hthnh.exec:\5hthnh.exe30⤵
- Executes dropped EXE
PID:1440 -
\??\c:\bnnhhh.exec:\bnnhhh.exe31⤵
- Executes dropped EXE
PID:2032 -
\??\c:\1ppjp.exec:\1ppjp.exe32⤵
- Executes dropped EXE
PID:3548 -
\??\c:\lxxlxrf.exec:\lxxlxrf.exe33⤵
- Executes dropped EXE
PID:1680 -
\??\c:\llxrlrl.exec:\llxrlrl.exe34⤵
- Executes dropped EXE
PID:3396 -
\??\c:\bnnnnh.exec:\bnnnnh.exe35⤵
- Executes dropped EXE
PID:3872 -
\??\c:\jdvjd.exec:\jdvjd.exe36⤵
- Executes dropped EXE
PID:2980 -
\??\c:\pjddv.exec:\pjddv.exe37⤵
- Executes dropped EXE
PID:224 -
\??\c:\3rrrfrr.exec:\3rrrfrr.exe38⤵
- Executes dropped EXE
PID:3592 -
\??\c:\9rxxrrr.exec:\9rxxrrr.exe39⤵
- Executes dropped EXE
PID:4504 -
\??\c:\7bbtth.exec:\7bbtth.exe40⤵
- Executes dropped EXE
PID:788 -
\??\c:\jdddp.exec:\jdddp.exe41⤵
- Executes dropped EXE
PID:5104 -
\??\c:\fxffrrr.exec:\fxffrrr.exe42⤵
- Executes dropped EXE
PID:1756 -
\??\c:\ffrrffl.exec:\ffrrffl.exe43⤵
- Executes dropped EXE
PID:3712 -
\??\c:\9nthht.exec:\9nthht.exe44⤵
- Executes dropped EXE
PID:4564 -
\??\c:\tbbbtt.exec:\tbbbtt.exe45⤵
- Executes dropped EXE
PID:448 -
\??\c:\pvvdv.exec:\pvvdv.exe46⤵
- Executes dropped EXE
PID:3204 -
\??\c:\9dvvp.exec:\9dvvp.exe47⤵
- Executes dropped EXE
PID:2248 -
\??\c:\frrxrrr.exec:\frrxrrr.exe48⤵
- Executes dropped EXE
PID:4280 -
\??\c:\jjpjd.exec:\jjpjd.exe49⤵
- Executes dropped EXE
PID:3088 -
\??\c:\pjjdp.exec:\pjjdp.exe50⤵
- Executes dropped EXE
PID:4420 -
\??\c:\rfrrfll.exec:\rfrrfll.exe51⤵
- Executes dropped EXE
PID:4872 -
\??\c:\fxlffxr.exec:\fxlffxr.exe52⤵
- Executes dropped EXE
PID:1196 -
\??\c:\tthtnn.exec:\tthtnn.exe53⤵
- Executes dropped EXE
PID:516 -
\??\c:\nhhbtn.exec:\nhhbtn.exe54⤵
- Executes dropped EXE
PID:2784 -
\??\c:\pjddp.exec:\pjddp.exe55⤵
- Executes dropped EXE
PID:5088 -
\??\c:\pdjjd.exec:\pdjjd.exe56⤵
- Executes dropped EXE
PID:860 -
\??\c:\jpvvv.exec:\jpvvv.exe57⤵
- Executes dropped EXE
PID:3496 -
\??\c:\xrfxfxx.exec:\xrfxfxx.exe58⤵
- Executes dropped EXE
PID:3492 -
\??\c:\fxfxlxx.exec:\fxfxlxx.exe59⤵
- Executes dropped EXE
PID:2772 -
\??\c:\nntttt.exec:\nntttt.exe60⤵
- Executes dropped EXE
PID:3032 -
\??\c:\tnbbnt.exec:\tnbbnt.exe61⤵
- Executes dropped EXE
PID:3972 -
\??\c:\3pvvv.exec:\3pvvv.exe62⤵
- Executes dropped EXE
PID:1372 -
\??\c:\vpjpp.exec:\vpjpp.exe63⤵
- Executes dropped EXE
PID:2416 -
\??\c:\xlrrlrl.exec:\xlrrlrl.exe64⤵
- Executes dropped EXE
PID:4336 -
\??\c:\xrrrlll.exec:\xrrrlll.exe65⤵
- Executes dropped EXE
PID:4328 -
\??\c:\bthhtt.exec:\bthhtt.exe66⤵PID:4440
-
\??\c:\nbbbbb.exec:\nbbbbb.exe67⤵PID:1212
-
\??\c:\ddvpd.exec:\ddvpd.exe68⤵PID:2668
-
\??\c:\jddvp.exec:\jddvp.exe69⤵PID:1416
-
\??\c:\vvpjv.exec:\vvpjv.exe70⤵PID:3064
-
\??\c:\flrrllf.exec:\flrrllf.exe71⤵PID:2256
-
\??\c:\hhthtt.exec:\hhthtt.exe72⤵PID:2980
-
\??\c:\htbbnn.exec:\htbbnn.exe73⤵PID:224
-
\??\c:\jdvpp.exec:\jdvpp.exe74⤵PID:3592
-
\??\c:\dpdvv.exec:\dpdvv.exe75⤵PID:4488
-
\??\c:\dpvpv.exec:\dpvpv.exe76⤵PID:1052
-
\??\c:\7lllfff.exec:\7lllfff.exe77⤵PID:3472
-
\??\c:\rfrflfr.exec:\rfrflfr.exe78⤵PID:3060
-
\??\c:\hhnhhh.exec:\hhnhhh.exe79⤵PID:3228
-
\??\c:\pjppv.exec:\pjppv.exe80⤵PID:1832
-
\??\c:\jddpd.exec:\jddpd.exe81⤵PID:448
-
\??\c:\jpddd.exec:\jpddd.exe82⤵PID:3008
-
\??\c:\7llfffx.exec:\7llfffx.exe83⤵PID:4208
-
\??\c:\htnnth.exec:\htnnth.exe84⤵PID:1516
-
\??\c:\bbbtnn.exec:\bbbtnn.exe85⤵PID:4776
-
\??\c:\7ppjd.exec:\7ppjd.exe86⤵PID:4784
-
\??\c:\vpjdv.exec:\vpjdv.exe87⤵PID:1240
-
\??\c:\xlrrlll.exec:\xlrrlll.exe88⤵PID:4684
-
\??\c:\xllllff.exec:\xllllff.exe89⤵PID:4936
-
\??\c:\hbbbbb.exec:\hbbbbb.exe90⤵PID:1980
-
\??\c:\bttnhh.exec:\bttnhh.exe91⤵PID:4160
-
\??\c:\hbhttn.exec:\hbhttn.exe92⤵PID:2448
-
\??\c:\pdpjj.exec:\pdpjj.exe93⤵PID:376
-
\??\c:\vpvpj.exec:\vpvpj.exe94⤵PID:4496
-
\??\c:\fxrrrxf.exec:\fxrrrxf.exe95⤵PID:3952
-
\??\c:\rrfxrfx.exec:\rrfxrfx.exe96⤵PID:2772
-
\??\c:\xflfxxr.exec:\xflfxxr.exe97⤵PID:2820
-
\??\c:\btttnn.exec:\btttnn.exe98⤵PID:2028
-
\??\c:\7pjdv.exec:\7pjdv.exe99⤵PID:2620
-
\??\c:\lfrllrr.exec:\lfrllrr.exe100⤵PID:1776
-
\??\c:\xlfxxxx.exec:\xlfxxxx.exe101⤵PID:1440
-
\??\c:\rrrrxxx.exec:\rrrrxxx.exe102⤵PID:3628
-
\??\c:\tnbbnt.exec:\tnbbnt.exe103⤵PID:3364
-
\??\c:\pvvvv.exec:\pvvvv.exe104⤵PID:1408
-
\??\c:\dddvp.exec:\dddvp.exe105⤵PID:2160
-
\??\c:\pjdvv.exec:\pjdvv.exe106⤵PID:4988
-
\??\c:\frrrxxx.exec:\frrrxxx.exe107⤵PID:2452
-
\??\c:\hnttnn.exec:\hnttnn.exe108⤵PID:2584
-
\??\c:\bbbtnn.exec:\bbbtnn.exe109⤵PID:4652
-
\??\c:\1jjdv.exec:\1jjdv.exe110⤵PID:1828
-
\??\c:\dvdvp.exec:\dvdvp.exe111⤵PID:620
-
\??\c:\flrffxf.exec:\flrffxf.exe112⤵PID:5052
-
\??\c:\nnbbtt.exec:\nnbbtt.exe113⤵PID:2600
-
\??\c:\nnhbbt.exec:\nnhbbt.exe114⤵PID:2808
-
\??\c:\vvvpj.exec:\vvvpj.exe115⤵PID:2432
-
\??\c:\pjpjv.exec:\pjpjv.exe116⤵PID:1564
-
\??\c:\1rxrfff.exec:\1rxrfff.exe117⤵PID:5072
-
\??\c:\xlfxlfx.exec:\xlfxlfx.exe118⤵PID:5048
-
\??\c:\5bhhnn.exec:\5bhhnn.exe119⤵PID:784
-
\??\c:\hhtbtb.exec:\hhtbtb.exe120⤵PID:4592
-
\??\c:\djppv.exec:\djppv.exe121⤵PID:3996
-
\??\c:\rflfrrl.exec:\rflfrrl.exe122⤵PID:2304
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-