Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09-05-2024 15:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7ecbb366e744b9c6020991d161917e10_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
7ecbb366e744b9c6020991d161917e10_NeikiAnalytics.exe
-
Size
59KB
-
MD5
7ecbb366e744b9c6020991d161917e10
-
SHA1
9be298c7f444665c2dd68872349bdd0994420034
-
SHA256
e545e06055e75102c08633e94e72cd40b3f151622f1bef371921e850abcd5060
-
SHA512
1ee21eb4f8e713609e3d42e3af6d5056cd730b161f7852f7903ba26274cf924cc565817a53b9abc22f41343552686b97951af1d16d379757e6e4f9def9139d11
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk9UI:ymb3NkkiQ3mdBjFIvlqI
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/3948-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3644-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3644-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1760-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1316-35-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1316-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5420-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2384-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/712-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5272-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5168-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2332-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1704-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4604-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4296-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2288-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3204-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3616-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3540-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2296-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5972-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1636-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4652 dvpvv.exe 3644 rfxxrrr.exe 1760 lrllffx.exe 1316 vjjpp.exe 1148 dvpjd.exe 5420 rllfxxr.exe 2384 1rrrxfl.exe 712 httbtb.exe 5272 1tnthn.exe 5168 vdpjd.exe 448 xrrrfff.exe 2332 xxrrlfl.exe 4940 9nhnhh.exe 1704 vvjdp.exe 4604 vdjjd.exe 4296 fxrlxrl.exe 2012 hhnnhb.exe 3932 dvddd.exe 3632 ppvpj.exe 2288 xfxlflf.exe 2808 rfrlffx.exe 3204 tbtbth.exe 3616 vvjvp.exe 5768 9xrllll.exe 6136 9bbbtn.exe 3540 hbbttt.exe 2296 7jjdv.exe 5972 rrlfxxx.exe 1636 xrlxfrf.exe 4988 tntttn.exe 1444 vvpjd.exe 3140 vdppd.exe 2988 flxrrrx.exe 3124 lxfxxrl.exe 2004 htnnhh.exe 2028 pjjjj.exe 5508 fxffxff.exe 2820 lrxlrxx.exe 3068 hbbbbb.exe 4020 djdvp.exe 2100 1pppj.exe 5136 frrlxxx.exe 5092 7lxrrlf.exe 1796 hhbhnb.exe 4336 nhbbbn.exe 3012 1jdpd.exe 5336 3jpjv.exe 1372 3rlffff.exe 5180 bnttnn.exe 3516 ppjvj.exe 1064 1jvpd.exe 5624 xxrllll.exe 1256 rlrlrlr.exe 4584 thnnhn.exe 2508 vdjdd.exe 3756 dvjdv.exe 5676 9fffxxx.exe 3636 9xrrlll.exe 3848 1bttnn.exe 5020 thbhnh.exe 1808 jddvj.exe 1868 ffxxlxr.exe 3828 lrrrxfl.exe 4132 nhhhnn.exe -
resource yara_rule behavioral2/memory/3948-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3644-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1760-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1316-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5420-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2384-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/712-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5272-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5168-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2332-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4296-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2288-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3204-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3540-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2296-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5972-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1636-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-196-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3948 wrote to memory of 4652 3948 7ecbb366e744b9c6020991d161917e10_NeikiAnalytics.exe 83 PID 3948 wrote to memory of 4652 3948 7ecbb366e744b9c6020991d161917e10_NeikiAnalytics.exe 83 PID 3948 wrote to memory of 4652 3948 7ecbb366e744b9c6020991d161917e10_NeikiAnalytics.exe 83 PID 4652 wrote to memory of 3644 4652 dvpvv.exe 84 PID 4652 wrote to memory of 3644 4652 dvpvv.exe 84 PID 4652 wrote to memory of 3644 4652 dvpvv.exe 84 PID 3644 wrote to memory of 1760 3644 rfxxrrr.exe 85 PID 3644 wrote to memory of 1760 3644 rfxxrrr.exe 85 PID 3644 wrote to memory of 1760 3644 rfxxrrr.exe 85 PID 1760 wrote to memory of 1316 1760 lrllffx.exe 86 PID 1760 wrote to memory of 1316 1760 lrllffx.exe 86 PID 1760 wrote to memory of 1316 1760 lrllffx.exe 86 PID 1316 wrote to memory of 1148 1316 vjjpp.exe 87 PID 1316 wrote to memory of 1148 1316 vjjpp.exe 87 PID 1316 wrote to memory of 1148 1316 vjjpp.exe 87 PID 1148 wrote to memory of 5420 1148 dvpjd.exe 88 PID 1148 wrote to memory of 5420 1148 dvpjd.exe 88 PID 1148 wrote to memory of 5420 1148 dvpjd.exe 88 PID 5420 wrote to memory of 2384 5420 rllfxxr.exe 89 PID 5420 wrote to memory of 2384 5420 rllfxxr.exe 89 PID 5420 wrote to memory of 2384 5420 rllfxxr.exe 89 PID 2384 wrote to memory of 712 2384 1rrrxfl.exe 90 PID 2384 wrote to memory of 712 2384 1rrrxfl.exe 90 PID 2384 wrote to memory of 712 2384 1rrrxfl.exe 90 PID 712 wrote to memory of 5272 712 httbtb.exe 91 PID 712 wrote to memory of 5272 712 httbtb.exe 91 PID 712 wrote to memory of 5272 712 httbtb.exe 91 PID 5272 wrote to memory of 5168 5272 1tnthn.exe 92 PID 5272 wrote to memory of 5168 5272 1tnthn.exe 92 PID 5272 wrote to memory of 5168 5272 1tnthn.exe 92 PID 5168 wrote to memory of 448 5168 vdpjd.exe 93 PID 5168 wrote to memory of 448 5168 vdpjd.exe 93 PID 5168 wrote to memory of 448 5168 vdpjd.exe 93 PID 448 wrote to memory of 2332 448 xrrrfff.exe 94 PID 448 wrote to memory of 2332 448 xrrrfff.exe 94 PID 448 wrote to memory of 2332 448 xrrrfff.exe 94 PID 2332 wrote to memory of 4940 2332 xxrrlfl.exe 95 PID 2332 wrote to memory of 4940 2332 xxrrlfl.exe 95 PID 2332 wrote to memory of 4940 2332 xxrrlfl.exe 95 PID 4940 wrote to memory of 1704 4940 9nhnhh.exe 96 PID 4940 wrote to memory of 1704 4940 9nhnhh.exe 96 PID 4940 wrote to memory of 1704 4940 9nhnhh.exe 96 PID 1704 wrote to memory of 4604 1704 vvjdp.exe 97 PID 1704 wrote to memory of 4604 1704 vvjdp.exe 97 PID 1704 wrote to memory of 4604 1704 vvjdp.exe 97 PID 4604 wrote to memory of 4296 4604 vdjjd.exe 98 PID 4604 wrote to memory of 4296 4604 vdjjd.exe 98 PID 4604 wrote to memory of 4296 4604 vdjjd.exe 98 PID 4296 wrote to memory of 2012 4296 fxrlxrl.exe 99 PID 4296 wrote to memory of 2012 4296 fxrlxrl.exe 99 PID 4296 wrote to memory of 2012 4296 fxrlxrl.exe 99 PID 2012 wrote to memory of 3932 2012 hhnnhb.exe 100 PID 2012 wrote to memory of 3932 2012 hhnnhb.exe 100 PID 2012 wrote to memory of 3932 2012 hhnnhb.exe 100 PID 3932 wrote to memory of 3632 3932 dvddd.exe 101 PID 3932 wrote to memory of 3632 3932 dvddd.exe 101 PID 3932 wrote to memory of 3632 3932 dvddd.exe 101 PID 3632 wrote to memory of 2288 3632 ppvpj.exe 102 PID 3632 wrote to memory of 2288 3632 ppvpj.exe 102 PID 3632 wrote to memory of 2288 3632 ppvpj.exe 102 PID 2288 wrote to memory of 2808 2288 xfxlflf.exe 103 PID 2288 wrote to memory of 2808 2288 xfxlflf.exe 103 PID 2288 wrote to memory of 2808 2288 xfxlflf.exe 103 PID 2808 wrote to memory of 3204 2808 rfrlffx.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ecbb366e744b9c6020991d161917e10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7ecbb366e744b9c6020991d161917e10_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\dvpvv.exec:\dvpvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\rfxxrrr.exec:\rfxxrrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\lrllffx.exec:\lrllffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\vjjpp.exec:\vjjpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\dvpjd.exec:\dvpjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\rllfxxr.exec:\rllfxxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5420 -
\??\c:\1rrrxfl.exec:\1rrrxfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\httbtb.exec:\httbtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
\??\c:\1tnthn.exec:\1tnthn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5272 -
\??\c:\vdpjd.exec:\vdpjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5168 -
\??\c:\xrrrfff.exec:\xrrrfff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\xxrrlfl.exec:\xxrrlfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\9nhnhh.exec:\9nhnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\vvjdp.exec:\vvjdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\vdjjd.exec:\vdjjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\fxrlxrl.exec:\fxrlxrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\hhnnhb.exec:\hhnnhb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\dvddd.exec:\dvddd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\ppvpj.exec:\ppvpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\xfxlflf.exec:\xfxlflf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\rfrlffx.exec:\rfrlffx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\tbtbth.exec:\tbtbth.exe23⤵
- Executes dropped EXE
PID:3204 -
\??\c:\vvjvp.exec:\vvjvp.exe24⤵
- Executes dropped EXE
PID:3616 -
\??\c:\9xrllll.exec:\9xrllll.exe25⤵
- Executes dropped EXE
PID:5768 -
\??\c:\9bbbtn.exec:\9bbbtn.exe26⤵
- Executes dropped EXE
PID:6136 -
\??\c:\hbbttt.exec:\hbbttt.exe27⤵
- Executes dropped EXE
PID:3540 -
\??\c:\7jjdv.exec:\7jjdv.exe28⤵
- Executes dropped EXE
PID:2296 -
\??\c:\rrlfxxx.exec:\rrlfxxx.exe29⤵
- Executes dropped EXE
PID:5972 -
\??\c:\xrlxfrf.exec:\xrlxfrf.exe30⤵
- Executes dropped EXE
PID:1636 -
\??\c:\tntttn.exec:\tntttn.exe31⤵
- Executes dropped EXE
PID:4988 -
\??\c:\vvpjd.exec:\vvpjd.exe32⤵
- Executes dropped EXE
PID:1444 -
\??\c:\vdppd.exec:\vdppd.exe33⤵
- Executes dropped EXE
PID:3140 -
\??\c:\flxrrrx.exec:\flxrrrx.exe34⤵
- Executes dropped EXE
PID:2988 -
\??\c:\lxfxxrl.exec:\lxfxxrl.exe35⤵
- Executes dropped EXE
PID:3124 -
\??\c:\htnnhh.exec:\htnnhh.exe36⤵
- Executes dropped EXE
PID:2004 -
\??\c:\pjjjj.exec:\pjjjj.exe37⤵
- Executes dropped EXE
PID:2028 -
\??\c:\fxffxff.exec:\fxffxff.exe38⤵
- Executes dropped EXE
PID:5508 -
\??\c:\lrxlrxx.exec:\lrxlrxx.exe39⤵
- Executes dropped EXE
PID:2820 -
\??\c:\hbbbbb.exec:\hbbbbb.exe40⤵
- Executes dropped EXE
PID:3068 -
\??\c:\djdvp.exec:\djdvp.exe41⤵
- Executes dropped EXE
PID:4020 -
\??\c:\1pppj.exec:\1pppj.exe42⤵
- Executes dropped EXE
PID:2100 -
\??\c:\frrlxxx.exec:\frrlxxx.exe43⤵
- Executes dropped EXE
PID:5136 -
\??\c:\7lxrrlf.exec:\7lxrrlf.exe44⤵
- Executes dropped EXE
PID:5092 -
\??\c:\hhbhnb.exec:\hhbhnb.exe45⤵
- Executes dropped EXE
PID:1796 -
\??\c:\nhbbbn.exec:\nhbbbn.exe46⤵
- Executes dropped EXE
PID:4336 -
\??\c:\1jdpd.exec:\1jdpd.exe47⤵
- Executes dropped EXE
PID:3012 -
\??\c:\3jpjv.exec:\3jpjv.exe48⤵
- Executes dropped EXE
PID:5336 -
\??\c:\3rlffff.exec:\3rlffff.exe49⤵
- Executes dropped EXE
PID:1372 -
\??\c:\bnttnn.exec:\bnttnn.exe50⤵
- Executes dropped EXE
PID:5180 -
\??\c:\ppjvj.exec:\ppjvj.exe51⤵
- Executes dropped EXE
PID:3516 -
\??\c:\1jvpd.exec:\1jvpd.exe52⤵
- Executes dropped EXE
PID:1064 -
\??\c:\xxrllll.exec:\xxrllll.exe53⤵
- Executes dropped EXE
PID:5624 -
\??\c:\rlrlrlr.exec:\rlrlrlr.exe54⤵
- Executes dropped EXE
PID:1256 -
\??\c:\thnnhn.exec:\thnnhn.exe55⤵
- Executes dropped EXE
PID:4584 -
\??\c:\vdjdd.exec:\vdjdd.exe56⤵
- Executes dropped EXE
PID:2508 -
\??\c:\dvjdv.exec:\dvjdv.exe57⤵
- Executes dropped EXE
PID:3756 -
\??\c:\9fffxxx.exec:\9fffxxx.exe58⤵
- Executes dropped EXE
PID:5676 -
\??\c:\9xrrlll.exec:\9xrrlll.exe59⤵
- Executes dropped EXE
PID:3636 -
\??\c:\1bttnn.exec:\1bttnn.exe60⤵
- Executes dropped EXE
PID:3848 -
\??\c:\thbhnh.exec:\thbhnh.exe61⤵
- Executes dropped EXE
PID:5020 -
\??\c:\jddvj.exec:\jddvj.exe62⤵
- Executes dropped EXE
PID:1808 -
\??\c:\ffxxlxr.exec:\ffxxlxr.exe63⤵
- Executes dropped EXE
PID:1868 -
\??\c:\lrrrxfl.exec:\lrrrxfl.exe64⤵
- Executes dropped EXE
PID:3828 -
\??\c:\nhhhnn.exec:\nhhhnn.exe65⤵
- Executes dropped EXE
PID:4132 -
\??\c:\thnnhn.exec:\thnnhn.exe66⤵PID:4028
-
\??\c:\vpvpv.exec:\vpvpv.exe67⤵PID:820
-
\??\c:\jjjdv.exec:\jjjdv.exe68⤵PID:4424
-
\??\c:\rffrllf.exec:\rffrllf.exe69⤵PID:3640
-
\??\c:\5fxxrrl.exec:\5fxxrrl.exe70⤵PID:2832
-
\??\c:\htbnhh.exec:\htbnhh.exe71⤵PID:3620
-
\??\c:\dpvpp.exec:\dpvpp.exe72⤵PID:3380
-
\??\c:\1vpjv.exec:\1vpjv.exe73⤵PID:540
-
\??\c:\llxfrrl.exec:\llxfrrl.exe74⤵PID:5980
-
\??\c:\xflfffx.exec:\xflfffx.exe75⤵PID:4644
-
\??\c:\hnntth.exec:\hnntth.exe76⤵PID:1252
-
\??\c:\tnntnn.exec:\tnntnn.exe77⤵PID:5672
-
\??\c:\pdjjv.exec:\pdjjv.exe78⤵PID:8
-
\??\c:\dvdpp.exec:\dvdpp.exe79⤵PID:5272
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe80⤵PID:4388
-
\??\c:\xfffxxl.exec:\xfffxxl.exe81⤵PID:4352
-
\??\c:\ttnhhh.exec:\ttnhhh.exe82⤵PID:3352
-
\??\c:\3bbnhb.exec:\3bbnhb.exe83⤵PID:4760
-
\??\c:\jdvvp.exec:\jdvvp.exe84⤵PID:2592
-
\??\c:\ddjdj.exec:\ddjdj.exe85⤵PID:4516
-
\??\c:\vpjdv.exec:\vpjdv.exe86⤵PID:4476
-
\??\c:\rlrrfff.exec:\rlrrfff.exe87⤵PID:3844
-
\??\c:\fxxrrrr.exec:\fxxrrrr.exe88⤵PID:3804
-
\??\c:\7nhhbb.exec:\7nhhbb.exe89⤵PID:4060
-
\??\c:\7htbtt.exec:\7htbtt.exe90⤵PID:436
-
\??\c:\vpvvp.exec:\vpvvp.exe91⤵PID:4672
-
\??\c:\vppjv.exec:\vppjv.exe92⤵PID:3876
-
\??\c:\5xllfff.exec:\5xllfff.exe93⤵PID:3632
-
\??\c:\xlfxrrx.exec:\xlfxrrx.exe94⤵PID:2812
-
\??\c:\frxxrxr.exec:\frxxrxr.exe95⤵PID:5416
-
\??\c:\htbhbb.exec:\htbhbb.exe96⤵PID:6140
-
\??\c:\jjjjp.exec:\jjjjp.exe97⤵PID:5360
-
\??\c:\vpddv.exec:\vpddv.exe98⤵PID:2228
-
\??\c:\7ppdp.exec:\7ppdp.exe99⤵PID:4184
-
\??\c:\lxlfrfx.exec:\lxlfrfx.exe100⤵PID:5220
-
\??\c:\9xllrxr.exec:\9xllrxr.exe101⤵PID:968
-
\??\c:\bbttnn.exec:\bbttnn.exe102⤵PID:2296
-
\??\c:\nhnhhh.exec:\nhnhhh.exe103⤵PID:4484
-
\??\c:\3pjpd.exec:\3pjpd.exe104⤵PID:1484
-
\??\c:\fllxllf.exec:\fllxllf.exe105⤵PID:3252
-
\??\c:\3xxfrrf.exec:\3xxfrrf.exe106⤵PID:1216
-
\??\c:\hbbtnh.exec:\hbbtnh.exe107⤵PID:2556
-
\??\c:\1btnhh.exec:\1btnhh.exe108⤵PID:452
-
\??\c:\pvpjv.exec:\pvpjv.exe109⤵PID:3984
-
\??\c:\7rfrffx.exec:\7rfrffx.exe110⤵PID:2572
-
\??\c:\1bbbtt.exec:\1bbbtt.exe111⤵PID:2280
-
\??\c:\dpvpp.exec:\dpvpp.exe112⤵PID:1828
-
\??\c:\jvpjv.exec:\jvpjv.exe113⤵PID:4640
-
\??\c:\xrrlxxr.exec:\xrrlxxr.exe114⤵PID:5592
-
\??\c:\hbbtnn.exec:\hbbtnn.exe115⤵PID:964
-
\??\c:\xlxllfx.exec:\xlxllfx.exe116⤵PID:2284
-
\??\c:\9fxrlrl.exec:\9fxrlrl.exe117⤵PID:3928
-
\??\c:\ttnttt.exec:\ttnttt.exe118⤵PID:4936
-
\??\c:\dvpjd.exec:\dvpjd.exe119⤵PID:5088
-
\??\c:\jjvvv.exec:\jjvvv.exe120⤵PID:2024
-
\??\c:\xrllxrf.exec:\xrllxrf.exe121⤵PID:5600
-
\??\c:\rlffxxx.exec:\rlffxxx.exe122⤵PID:5188
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-