Analysis
-
max time kernel
150s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/06/2024, 05:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
86c86a52c3e11f28b78628f25f8da35ca9b5d02a0ba354aee535d7866f86453b_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
86c86a52c3e11f28b78628f25f8da35ca9b5d02a0ba354aee535d7866f86453b_NeikiAnalytics.exe
-
Size
79KB
-
MD5
a266b7e16e001f11815ffdf744cb06c0
-
SHA1
b4f1a0c2a02cb1280551be71d93739043175f294
-
SHA256
86c86a52c3e11f28b78628f25f8da35ca9b5d02a0ba354aee535d7866f86453b
-
SHA512
c6d987183b6932b4e0871fe860369a4eecf42586d0bec24746bf31a7f28d40af6e9768db390f5d4bd3b036fa151341266c9a579559ea7d01dfcfdfe82fcb1c47
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIgJb31HgxGc+gmvZQCxK:ymb3NkkiQ3mdBjFIUb31HgxL+gmvZjA
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/2328-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3976-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2624-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2272-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2940-59-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2940-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4220-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1404-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4856-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1176-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1436-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1760-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4728-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1056-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/736-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1344-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1120-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2796-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1412-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1724-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1628-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1544-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2180-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1916-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3976 btnntt.exe 4036 vdddj.exe 448 llrlxxr.exe 2624 5xfxrrl.exe 2272 hbbthh.exe 2200 xrxxrxr.exe 2940 ntnnhh.exe 3260 bbthth.exe 4220 jjppv.exe 1404 fxrxrxr.exe 4856 fllfxrl.exe 3060 bthbbt.exe 1176 pjjdv.exe 1436 fxffxff.exe 1760 nhhbbt.exe 4728 9bhbtt.exe 1056 vvdvd.exe 4164 fllfxrl.exe 736 rlxxxxx.exe 2348 bbnthh.exe 1344 dvvvp.exe 1120 xxrxrxr.exe 2796 5ttnbb.exe 1060 hbnnnn.exe 1412 vppdv.exe 1724 jpjdv.exe 1628 rrrrlll.exe 928 pdvpp.exe 1544 1vvpj.exe 2180 ffrlxlf.exe 1916 xlxrrrx.exe 3960 tnntnb.exe 4916 jvdjd.exe 4436 5jvpj.exe 4684 lfrfrrr.exe 5080 5hhhhh.exe 956 jdvpj.exe 2360 hnhhnb.exe 3068 1jvvj.exe 3972 1bbtbb.exe 4628 dpjdd.exe 2404 flrlrll.exe 4428 3lffflf.exe 4972 5nthtn.exe 4416 ddjjp.exe 4912 lllfflf.exe 4680 xlllrrr.exe 4364 7nhbbb.exe 2328 nhhbtt.exe 3192 ddpjj.exe 1660 pvvvj.exe 2584 3nnnht.exe 2492 nnnnhh.exe 5060 jdjdd.exe 1492 fllfxxr.exe 1652 fxlfxxx.exe 1704 5hnnnn.exe 3480 vdjvj.exe 4824 rlfxrrx.exe 3360 lrxrlll.exe 1700 nhthhb.exe 1400 7djjv.exe 3264 pddvp.exe 4724 xlxrffx.exe -
resource yara_rule behavioral2/memory/2328-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2624-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2272-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2272-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2940-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4220-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1404-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1176-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1436-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1760-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4728-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1056-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/736-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1344-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1120-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2796-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1412-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1724-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1628-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1544-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2180-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2328 wrote to memory of 3976 2328 86c86a52c3e11f28b78628f25f8da35ca9b5d02a0ba354aee535d7866f86453b_NeikiAnalytics.exe 81 PID 2328 wrote to memory of 3976 2328 86c86a52c3e11f28b78628f25f8da35ca9b5d02a0ba354aee535d7866f86453b_NeikiAnalytics.exe 81 PID 2328 wrote to memory of 3976 2328 86c86a52c3e11f28b78628f25f8da35ca9b5d02a0ba354aee535d7866f86453b_NeikiAnalytics.exe 81 PID 3976 wrote to memory of 4036 3976 btnntt.exe 82 PID 3976 wrote to memory of 4036 3976 btnntt.exe 82 PID 3976 wrote to memory of 4036 3976 btnntt.exe 82 PID 4036 wrote to memory of 448 4036 vdddj.exe 83 PID 4036 wrote to memory of 448 4036 vdddj.exe 83 PID 4036 wrote to memory of 448 4036 vdddj.exe 83 PID 448 wrote to memory of 2624 448 llrlxxr.exe 84 PID 448 wrote to memory of 2624 448 llrlxxr.exe 84 PID 448 wrote to memory of 2624 448 llrlxxr.exe 84 PID 2624 wrote to memory of 2272 2624 5xfxrrl.exe 85 PID 2624 wrote to memory of 2272 2624 5xfxrrl.exe 85 PID 2624 wrote to memory of 2272 2624 5xfxrrl.exe 85 PID 2272 wrote to memory of 2200 2272 hbbthh.exe 86 PID 2272 wrote to memory of 2200 2272 hbbthh.exe 86 PID 2272 wrote to memory of 2200 2272 hbbthh.exe 86 PID 2200 wrote to memory of 2940 2200 xrxxrxr.exe 87 PID 2200 wrote to memory of 2940 2200 xrxxrxr.exe 87 PID 2200 wrote to memory of 2940 2200 xrxxrxr.exe 87 PID 2940 wrote to memory of 3260 2940 ntnnhh.exe 88 PID 2940 wrote to memory of 3260 2940 ntnnhh.exe 88 PID 2940 wrote to memory of 3260 2940 ntnnhh.exe 88 PID 3260 wrote to memory of 4220 3260 bbthth.exe 89 PID 3260 wrote to memory of 4220 3260 bbthth.exe 89 PID 3260 wrote to memory of 4220 3260 bbthth.exe 89 PID 4220 wrote to memory of 1404 4220 jjppv.exe 90 PID 4220 wrote to memory of 1404 4220 jjppv.exe 90 PID 4220 wrote to memory of 1404 4220 jjppv.exe 90 PID 1404 wrote to memory of 4856 1404 fxrxrxr.exe 91 PID 1404 wrote to memory of 4856 1404 fxrxrxr.exe 91 PID 1404 wrote to memory of 4856 1404 fxrxrxr.exe 91 PID 4856 wrote to memory of 3060 4856 fllfxrl.exe 92 PID 4856 wrote to memory of 3060 4856 fllfxrl.exe 92 PID 4856 wrote to memory of 3060 4856 fllfxrl.exe 92 PID 3060 wrote to memory of 1176 3060 bthbbt.exe 93 PID 3060 wrote to memory of 1176 3060 bthbbt.exe 93 PID 3060 wrote to memory of 1176 3060 bthbbt.exe 93 PID 1176 wrote to memory of 1436 1176 pjjdv.exe 94 PID 1176 wrote to memory of 1436 1176 pjjdv.exe 94 PID 1176 wrote to memory of 1436 1176 pjjdv.exe 94 PID 1436 wrote to memory of 1760 1436 fxffxff.exe 95 PID 1436 wrote to memory of 1760 1436 fxffxff.exe 95 PID 1436 wrote to memory of 1760 1436 fxffxff.exe 95 PID 1760 wrote to memory of 4728 1760 nhhbbt.exe 96 PID 1760 wrote to memory of 4728 1760 nhhbbt.exe 96 PID 1760 wrote to memory of 4728 1760 nhhbbt.exe 96 PID 4728 wrote to memory of 1056 4728 9bhbtt.exe 97 PID 4728 wrote to memory of 1056 4728 9bhbtt.exe 97 PID 4728 wrote to memory of 1056 4728 9bhbtt.exe 97 PID 1056 wrote to memory of 4164 1056 vvdvd.exe 98 PID 1056 wrote to memory of 4164 1056 vvdvd.exe 98 PID 1056 wrote to memory of 4164 1056 vvdvd.exe 98 PID 4164 wrote to memory of 736 4164 fllfxrl.exe 99 PID 4164 wrote to memory of 736 4164 fllfxrl.exe 99 PID 4164 wrote to memory of 736 4164 fllfxrl.exe 99 PID 736 wrote to memory of 2348 736 rlxxxxx.exe 100 PID 736 wrote to memory of 2348 736 rlxxxxx.exe 100 PID 736 wrote to memory of 2348 736 rlxxxxx.exe 100 PID 2348 wrote to memory of 1344 2348 bbnthh.exe 101 PID 2348 wrote to memory of 1344 2348 bbnthh.exe 101 PID 2348 wrote to memory of 1344 2348 bbnthh.exe 101 PID 1344 wrote to memory of 1120 1344 dvvvp.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\86c86a52c3e11f28b78628f25f8da35ca9b5d02a0ba354aee535d7866f86453b_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\86c86a52c3e11f28b78628f25f8da35ca9b5d02a0ba354aee535d7866f86453b_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\btnntt.exec:\btnntt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\vdddj.exec:\vdddj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\llrlxxr.exec:\llrlxxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\5xfxrrl.exec:\5xfxrrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\hbbthh.exec:\hbbthh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\xrxxrxr.exec:\xrxxrxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\ntnnhh.exec:\ntnnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\bbthth.exec:\bbthth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\jjppv.exec:\jjppv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\fxrxrxr.exec:\fxrxrxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\fllfxrl.exec:\fllfxrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\bthbbt.exec:\bthbbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\pjjdv.exec:\pjjdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
\??\c:\fxffxff.exec:\fxffxff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\nhhbbt.exec:\nhhbbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\9bhbtt.exec:\9bhbtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\vvdvd.exec:\vvdvd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\fllfxrl.exec:\fllfxrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
\??\c:\rlxxxxx.exec:\rlxxxxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
\??\c:\bbnthh.exec:\bbnthh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\dvvvp.exec:\dvvvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\xxrxrxr.exec:\xxrxrxr.exe23⤵
- Executes dropped EXE
PID:1120 -
\??\c:\5ttnbb.exec:\5ttnbb.exe24⤵
- Executes dropped EXE
PID:2796 -
\??\c:\hbnnnn.exec:\hbnnnn.exe25⤵
- Executes dropped EXE
PID:1060 -
\??\c:\vppdv.exec:\vppdv.exe26⤵
- Executes dropped EXE
PID:1412 -
\??\c:\jpjdv.exec:\jpjdv.exe27⤵
- Executes dropped EXE
PID:1724 -
\??\c:\rrrrlll.exec:\rrrrlll.exe28⤵
- Executes dropped EXE
PID:1628 -
\??\c:\pdvpp.exec:\pdvpp.exe29⤵
- Executes dropped EXE
PID:928 -
\??\c:\1vvpj.exec:\1vvpj.exe30⤵
- Executes dropped EXE
PID:1544 -
\??\c:\ffrlxlf.exec:\ffrlxlf.exe31⤵
- Executes dropped EXE
PID:2180 -
\??\c:\xlxrrrx.exec:\xlxrrrx.exe32⤵
- Executes dropped EXE
PID:1916 -
\??\c:\tnntnb.exec:\tnntnb.exe33⤵
- Executes dropped EXE
PID:3960 -
\??\c:\jvdjd.exec:\jvdjd.exe34⤵
- Executes dropped EXE
PID:4916 -
\??\c:\5jvpj.exec:\5jvpj.exe35⤵
- Executes dropped EXE
PID:4436 -
\??\c:\lfrfrrr.exec:\lfrfrrr.exe36⤵
- Executes dropped EXE
PID:4684 -
\??\c:\5hhhhh.exec:\5hhhhh.exe37⤵
- Executes dropped EXE
PID:5080 -
\??\c:\jdvpj.exec:\jdvpj.exe38⤵
- Executes dropped EXE
PID:956 -
\??\c:\hnhhnb.exec:\hnhhnb.exe39⤵
- Executes dropped EXE
PID:2360 -
\??\c:\1jvvj.exec:\1jvvj.exe40⤵
- Executes dropped EXE
PID:3068 -
\??\c:\1bbtbb.exec:\1bbtbb.exe41⤵
- Executes dropped EXE
PID:3972 -
\??\c:\dpjdd.exec:\dpjdd.exe42⤵
- Executes dropped EXE
PID:4628 -
\??\c:\flrlrll.exec:\flrlrll.exe43⤵
- Executes dropped EXE
PID:2404 -
\??\c:\3lffflf.exec:\3lffflf.exe44⤵
- Executes dropped EXE
PID:4428 -
\??\c:\5nthtn.exec:\5nthtn.exe45⤵
- Executes dropped EXE
PID:4972 -
\??\c:\ddjjp.exec:\ddjjp.exe46⤵
- Executes dropped EXE
PID:4416 -
\??\c:\lllfflf.exec:\lllfflf.exe47⤵
- Executes dropped EXE
PID:4912 -
\??\c:\xlllrrr.exec:\xlllrrr.exe48⤵
- Executes dropped EXE
PID:4680 -
\??\c:\7nhbbb.exec:\7nhbbb.exe49⤵
- Executes dropped EXE
PID:4364 -
\??\c:\nhhbtt.exec:\nhhbtt.exe50⤵
- Executes dropped EXE
PID:2328 -
\??\c:\ddpjj.exec:\ddpjj.exe51⤵
- Executes dropped EXE
PID:3192 -
\??\c:\pvvvj.exec:\pvvvj.exe52⤵
- Executes dropped EXE
PID:1660 -
\??\c:\3nnnht.exec:\3nnnht.exe53⤵
- Executes dropped EXE
PID:2584 -
\??\c:\nnnnhh.exec:\nnnnhh.exe54⤵
- Executes dropped EXE
PID:2492 -
\??\c:\jdjdd.exec:\jdjdd.exe55⤵
- Executes dropped EXE
PID:5060 -
\??\c:\fllfxxr.exec:\fllfxxr.exe56⤵
- Executes dropped EXE
PID:1492 -
\??\c:\fxlfxxx.exec:\fxlfxxx.exe57⤵
- Executes dropped EXE
PID:1652 -
\??\c:\5hnnnn.exec:\5hnnnn.exe58⤵
- Executes dropped EXE
PID:1704 -
\??\c:\vdjvj.exec:\vdjvj.exe59⤵
- Executes dropped EXE
PID:3480 -
\??\c:\rlfxrrx.exec:\rlfxrrx.exe60⤵
- Executes dropped EXE
PID:4824 -
\??\c:\lrxrlll.exec:\lrxrlll.exe61⤵
- Executes dropped EXE
PID:3360 -
\??\c:\nhthhb.exec:\nhthhb.exe62⤵
- Executes dropped EXE
PID:1700 -
\??\c:\7djjv.exec:\7djjv.exe63⤵
- Executes dropped EXE
PID:1400 -
\??\c:\pddvp.exec:\pddvp.exe64⤵
- Executes dropped EXE
PID:3264 -
\??\c:\xlxrffx.exec:\xlxrffx.exe65⤵
- Executes dropped EXE
PID:4724 -
\??\c:\jdvpp.exec:\jdvpp.exe66⤵PID:4544
-
\??\c:\pdpdj.exec:\pdpdj.exe67⤵PID:2820
-
\??\c:\lfrrfxx.exec:\lfrrfxx.exe68⤵PID:2060
-
\??\c:\nhbhbh.exec:\nhbhbh.exe69⤵PID:4176
-
\??\c:\3hbtnh.exec:\3hbtnh.exe70⤵PID:684
-
\??\c:\pjjjd.exec:\pjjjd.exe71⤵PID:548
-
\??\c:\llxrfff.exec:\llxrfff.exe72⤵PID:804
-
\??\c:\thnhbb.exec:\thnhbb.exe73⤵PID:4164
-
\??\c:\nbbbtt.exec:\nbbbtt.exe74⤵PID:4548
-
\??\c:\vjvpj.exec:\vjvpj.exe75⤵PID:3628
-
\??\c:\vddpj.exec:\vddpj.exe76⤵PID:4232
-
\??\c:\3lrxrxr.exec:\3lrxrxr.exe77⤵PID:5072
-
\??\c:\lxffxxr.exec:\lxffxxr.exe78⤵PID:1344
-
\??\c:\nbtttn.exec:\nbtttn.exe79⤵PID:1096
-
\??\c:\9hbbhh.exec:\9hbbhh.exe80⤵PID:4740
-
\??\c:\dvdvv.exec:\dvdvv.exe81⤵PID:5056
-
\??\c:\rrrrlxr.exec:\rrrrlxr.exe82⤵PID:2604
-
\??\c:\rfxfrlr.exec:\rfxfrlr.exe83⤵PID:440
-
\??\c:\htttnn.exec:\htttnn.exe84⤵PID:2420
-
\??\c:\3jjpp.exec:\3jjpp.exe85⤵PID:540
-
\??\c:\jjdvv.exec:\jjdvv.exe86⤵PID:2900
-
\??\c:\jjpjd.exec:\jjpjd.exe87⤵PID:4424
-
\??\c:\xrllxxr.exec:\xrllxxr.exe88⤵PID:4284
-
\??\c:\tbbtnh.exec:\tbbtnh.exe89⤵PID:2804
-
\??\c:\bnnbtt.exec:\bnnbtt.exe90⤵PID:3384
-
\??\c:\5pjdv.exec:\5pjdv.exe91⤵PID:4308
-
\??\c:\lfxrlll.exec:\lfxrlll.exe92⤵PID:3996
-
\??\c:\llxxrrl.exec:\llxxrrl.exe93⤵PID:4444
-
\??\c:\hhbbtt.exec:\hhbbtt.exe94⤵PID:2680
-
\??\c:\hhbbtt.exec:\hhbbtt.exe95⤵PID:3252
-
\??\c:\jdjdp.exec:\jdjdp.exe96⤵PID:4016
-
\??\c:\pdppv.exec:\pdppv.exe97⤵PID:1612
-
\??\c:\vvdvj.exec:\vvdvj.exe98⤵PID:4060
-
\??\c:\fxflrrx.exec:\fxflrrx.exe99⤵PID:3388
-
\??\c:\5fxrrrl.exec:\5fxrrrl.exe100⤵PID:1516
-
\??\c:\hhhhhb.exec:\hhhhhb.exe101⤵PID:2336
-
\??\c:\bntbnn.exec:\bntbnn.exe102⤵PID:4576
-
\??\c:\7pjpj.exec:\7pjpj.exe103⤵PID:3992
-
\??\c:\jppjj.exec:\jppjj.exe104⤵PID:4380
-
\??\c:\ffrlxxr.exec:\ffrlxxr.exe105⤵PID:4932
-
\??\c:\5rlllll.exec:\5rlllll.exe106⤵PID:4168
-
\??\c:\nnhbbb.exec:\nnhbbb.exe107⤵PID:3248
-
\??\c:\ttbbtt.exec:\ttbbtt.exe108⤵PID:3904
-
\??\c:\9bnnhh.exec:\9bnnhh.exe109⤵PID:968
-
\??\c:\pvvvp.exec:\pvvvp.exe110⤵PID:2272
-
\??\c:\7jdpj.exec:\7jdpj.exe111⤵PID:2976
-
\??\c:\lrxxrxx.exec:\lrxxrxx.exe112⤵PID:3284
-
\??\c:\nthhhh.exec:\nthhhh.exe113⤵PID:4104
-
\??\c:\5jjjv.exec:\5jjjv.exe114⤵PID:2676
-
\??\c:\thtnnn.exec:\thtnnn.exe115⤵PID:3360
-
\??\c:\vppjd.exec:\vppjd.exe116⤵PID:1700
-
\??\c:\ppdvp.exec:\ppdvp.exe117⤵PID:1400
-
\??\c:\lxllfff.exec:\lxllfff.exe118⤵PID:1976
-
\??\c:\3bnnbh.exec:\3bnnbh.exe119⤵PID:4724
-
\??\c:\ntbbhh.exec:\ntbbhh.exe120⤵PID:1844
-
\??\c:\dvvpv.exec:\dvvpv.exe121⤵PID:2084
-
\??\c:\ntnhbb.exec:\ntnhbb.exe122⤵PID:2060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-