Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 09:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cf8d7a6cd07c54dcfeb5994e9b2d83d0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
cf8d7a6cd07c54dcfeb5994e9b2d83d0_NeikiAnalytics.exe
-
Size
125KB
-
MD5
cf8d7a6cd07c54dcfeb5994e9b2d83d0
-
SHA1
4af74307ce56e4dcb226523c53da1dc18ca1f37c
-
SHA256
6a734f1f61de6c7464c0bf574ea419e6b8d09a63f8c616ebaebedf220118ead7
-
SHA512
14d3b35308fbb32fd2ede5e4f0bc384f0da0a9b5164248eb038b957a59b73173257e3fa08df125b99a0eb5d22ad0a8c60c562528c387d6ddbd43b7df1a3c072b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73oYUCD7R2F2UVbyy0NgVyFsZ2:ymb3NkkiQ3mdBjFo73HUoMsAbrxVBY
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/2932-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3020-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2000-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2508-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2508-85-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2416-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1568-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1792-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1316-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2024-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1064-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/560-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2060-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/928-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2508-670-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3020 9rllffr.exe 3052 nhbhnh.exe 2752 fxlfrxl.exe 2000 hhnhhb.exe 2780 3pjpj.exe 2168 rfrfrxf.exe 2508 hbntnn.exe 2416 vvvjd.exe 2732 llxfllx.exe 2808 hbnthh.exe 1568 9ppjd.exe 1848 ppvjd.exe 1792 rlrxlrf.exe 1316 tnthnb.exe 856 ddvjp.exe 2044 dvpvp.exe 2024 xxrxllx.exe 2516 7tthth.exe 1908 1vppd.exe 1844 ppjvj.exe 584 llxfllr.exe 1064 3nbnht.exe 560 ttntnt.exe 1140 jdvdp.exe 2060 fxlrllx.exe 928 bthnhn.exe 700 1vddp.exe 1664 lfrxxlf.exe 2796 hthbnb.exe 1724 pjdvd.exe 1868 1lfflrl.exe 2400 3fflffr.exe 1912 7nbhnt.exe 2624 9ppvj.exe 2748 xlxxlrx.exe 2632 1ffllxf.exe 2776 tnbbnn.exe 1752 pjddj.exe 2616 pdvvd.exe 2756 fxlrfxf.exe 2496 3fxfrrf.exe 1972 7bbhtt.exe 3000 dvdjp.exe 2324 xrffllx.exe 2812 bthnbh.exe 1856 tthntb.exe 1588 pjdvj.exe 348 9jdvd.exe 2188 1llllrf.exe 1360 nnhthn.exe 2944 hbtbht.exe 2464 jjvdp.exe 1224 fxlrxfl.exe 2924 xlflxxx.exe 2024 hbtbnh.exe 2096 1pjpv.exe 344 jvjjv.exe 1928 lflrflf.exe 768 ffxfrfr.exe 576 tnntbb.exe 2460 hthnbb.exe 2432 1jddv.exe 2348 xlxxrxf.exe 1140 5rlllll.exe -
resource yara_rule behavioral1/memory/2932-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2000-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1568-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1316-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1064-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/560-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/928-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-670-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2932 wrote to memory of 3020 2932 cf8d7a6cd07c54dcfeb5994e9b2d83d0_NeikiAnalytics.exe 28 PID 2932 wrote to memory of 3020 2932 cf8d7a6cd07c54dcfeb5994e9b2d83d0_NeikiAnalytics.exe 28 PID 2932 wrote to memory of 3020 2932 cf8d7a6cd07c54dcfeb5994e9b2d83d0_NeikiAnalytics.exe 28 PID 2932 wrote to memory of 3020 2932 cf8d7a6cd07c54dcfeb5994e9b2d83d0_NeikiAnalytics.exe 28 PID 3020 wrote to memory of 3052 3020 9rllffr.exe 29 PID 3020 wrote to memory of 3052 3020 9rllffr.exe 29 PID 3020 wrote to memory of 3052 3020 9rllffr.exe 29 PID 3020 wrote to memory of 3052 3020 9rllffr.exe 29 PID 3052 wrote to memory of 2752 3052 nhbhnh.exe 30 PID 3052 wrote to memory of 2752 3052 nhbhnh.exe 30 PID 3052 wrote to memory of 2752 3052 nhbhnh.exe 30 PID 3052 wrote to memory of 2752 3052 nhbhnh.exe 30 PID 2752 wrote to memory of 2000 2752 fxlfrxl.exe 31 PID 2752 wrote to memory of 2000 2752 fxlfrxl.exe 31 PID 2752 wrote to memory of 2000 2752 fxlfrxl.exe 31 PID 2752 wrote to memory of 2000 2752 fxlfrxl.exe 31 PID 2000 wrote to memory of 2780 2000 hhnhhb.exe 32 PID 2000 wrote to memory of 2780 2000 hhnhhb.exe 32 PID 2000 wrote to memory of 2780 2000 hhnhhb.exe 32 PID 2000 wrote to memory of 2780 2000 hhnhhb.exe 32 PID 2780 wrote to memory of 2168 2780 3pjpj.exe 33 PID 2780 wrote to memory of 2168 2780 3pjpj.exe 33 PID 2780 wrote to memory of 2168 2780 3pjpj.exe 33 PID 2780 wrote to memory of 2168 2780 3pjpj.exe 33 PID 2168 wrote to memory of 2508 2168 rfrfrxf.exe 34 PID 2168 wrote to memory of 2508 2168 rfrfrxf.exe 34 PID 2168 wrote to memory of 2508 2168 rfrfrxf.exe 34 PID 2168 wrote to memory of 2508 2168 rfrfrxf.exe 34 PID 2508 wrote to memory of 2416 2508 hbntnn.exe 35 PID 2508 wrote to memory of 2416 2508 hbntnn.exe 35 PID 2508 wrote to memory of 2416 2508 hbntnn.exe 35 PID 2508 wrote to memory of 2416 2508 hbntnn.exe 35 PID 2416 wrote to memory of 2732 2416 vvvjd.exe 36 PID 2416 wrote to memory of 2732 2416 vvvjd.exe 36 PID 2416 wrote to memory of 2732 2416 vvvjd.exe 36 PID 2416 wrote to memory of 2732 2416 vvvjd.exe 36 PID 2732 wrote to memory of 2808 2732 llxfllx.exe 37 PID 2732 wrote to memory of 2808 2732 llxfllx.exe 37 PID 2732 wrote to memory of 2808 2732 llxfllx.exe 37 PID 2732 wrote to memory of 2808 2732 llxfllx.exe 37 PID 2808 wrote to memory of 1568 2808 hbnthh.exe 38 PID 2808 wrote to memory of 1568 2808 hbnthh.exe 38 PID 2808 wrote to memory of 1568 2808 hbnthh.exe 38 PID 2808 wrote to memory of 1568 2808 hbnthh.exe 38 PID 1568 wrote to memory of 1848 1568 9ppjd.exe 39 PID 1568 wrote to memory of 1848 1568 9ppjd.exe 39 PID 1568 wrote to memory of 1848 1568 9ppjd.exe 39 PID 1568 wrote to memory of 1848 1568 9ppjd.exe 39 PID 1848 wrote to memory of 1792 1848 ppvjd.exe 40 PID 1848 wrote to memory of 1792 1848 ppvjd.exe 40 PID 1848 wrote to memory of 1792 1848 ppvjd.exe 40 PID 1848 wrote to memory of 1792 1848 ppvjd.exe 40 PID 1792 wrote to memory of 1316 1792 rlrxlrf.exe 41 PID 1792 wrote to memory of 1316 1792 rlrxlrf.exe 41 PID 1792 wrote to memory of 1316 1792 rlrxlrf.exe 41 PID 1792 wrote to memory of 1316 1792 rlrxlrf.exe 41 PID 1316 wrote to memory of 856 1316 tnthnb.exe 42 PID 1316 wrote to memory of 856 1316 tnthnb.exe 42 PID 1316 wrote to memory of 856 1316 tnthnb.exe 42 PID 1316 wrote to memory of 856 1316 tnthnb.exe 42 PID 856 wrote to memory of 2044 856 ddvjp.exe 43 PID 856 wrote to memory of 2044 856 ddvjp.exe 43 PID 856 wrote to memory of 2044 856 ddvjp.exe 43 PID 856 wrote to memory of 2044 856 ddvjp.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf8d7a6cd07c54dcfeb5994e9b2d83d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\cf8d7a6cd07c54dcfeb5994e9b2d83d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\9rllffr.exec:\9rllffr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\nhbhnh.exec:\nhbhnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\fxlfrxl.exec:\fxlfrxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\hhnhhb.exec:\hhnhhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\3pjpj.exec:\3pjpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\rfrfrxf.exec:\rfrfrxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\hbntnn.exec:\hbntnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\vvvjd.exec:\vvvjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\llxfllx.exec:\llxfllx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\hbnthh.exec:\hbnthh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\9ppjd.exec:\9ppjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\ppvjd.exec:\ppvjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\rlrxlrf.exec:\rlrxlrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\tnthnb.exec:\tnthnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\ddvjp.exec:\ddvjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\dvpvp.exec:\dvpvp.exe17⤵
- Executes dropped EXE
PID:2044 -
\??\c:\xxrxllx.exec:\xxrxllx.exe18⤵
- Executes dropped EXE
PID:2024 -
\??\c:\7tthth.exec:\7tthth.exe19⤵
- Executes dropped EXE
PID:2516 -
\??\c:\1vppd.exec:\1vppd.exe20⤵
- Executes dropped EXE
PID:1908 -
\??\c:\ppjvj.exec:\ppjvj.exe21⤵
- Executes dropped EXE
PID:1844 -
\??\c:\llxfllr.exec:\llxfllr.exe22⤵
- Executes dropped EXE
PID:584 -
\??\c:\3nbnht.exec:\3nbnht.exe23⤵
- Executes dropped EXE
PID:1064 -
\??\c:\ttntnt.exec:\ttntnt.exe24⤵
- Executes dropped EXE
PID:560 -
\??\c:\jdvdp.exec:\jdvdp.exe25⤵
- Executes dropped EXE
PID:1140 -
\??\c:\fxlrllx.exec:\fxlrllx.exe26⤵
- Executes dropped EXE
PID:2060 -
\??\c:\bthnhn.exec:\bthnhn.exe27⤵
- Executes dropped EXE
PID:928 -
\??\c:\1vddp.exec:\1vddp.exe28⤵
- Executes dropped EXE
PID:700 -
\??\c:\lfrxxlf.exec:\lfrxxlf.exe29⤵
- Executes dropped EXE
PID:1664 -
\??\c:\hthbnb.exec:\hthbnb.exe30⤵
- Executes dropped EXE
PID:2796 -
\??\c:\pjdvd.exec:\pjdvd.exe31⤵
- Executes dropped EXE
PID:1724 -
\??\c:\1lfflrl.exec:\1lfflrl.exe32⤵
- Executes dropped EXE
PID:1868 -
\??\c:\3fflffr.exec:\3fflffr.exe33⤵
- Executes dropped EXE
PID:2400 -
\??\c:\7nbhnt.exec:\7nbhnt.exe34⤵
- Executes dropped EXE
PID:1912 -
\??\c:\9ppvj.exec:\9ppvj.exe35⤵
- Executes dropped EXE
PID:2624 -
\??\c:\xlxxlrx.exec:\xlxxlrx.exe36⤵
- Executes dropped EXE
PID:2748 -
\??\c:\1ffllxf.exec:\1ffllxf.exe37⤵
- Executes dropped EXE
PID:2632 -
\??\c:\tnbbnn.exec:\tnbbnn.exe38⤵
- Executes dropped EXE
PID:2776 -
\??\c:\pjddj.exec:\pjddj.exe39⤵
- Executes dropped EXE
PID:1752 -
\??\c:\pdvvd.exec:\pdvvd.exe40⤵
- Executes dropped EXE
PID:2616 -
\??\c:\fxlrfxf.exec:\fxlrfxf.exe41⤵
- Executes dropped EXE
PID:2756 -
\??\c:\3fxfrrf.exec:\3fxfrrf.exe42⤵
- Executes dropped EXE
PID:2496 -
\??\c:\7bbhtt.exec:\7bbhtt.exe43⤵
- Executes dropped EXE
PID:1972 -
\??\c:\dvdjp.exec:\dvdjp.exe44⤵
- Executes dropped EXE
PID:3000 -
\??\c:\xrffllx.exec:\xrffllx.exe45⤵
- Executes dropped EXE
PID:2324 -
\??\c:\bthnbh.exec:\bthnbh.exe46⤵
- Executes dropped EXE
PID:2812 -
\??\c:\tthntb.exec:\tthntb.exe47⤵
- Executes dropped EXE
PID:1856 -
\??\c:\pjdvj.exec:\pjdvj.exe48⤵
- Executes dropped EXE
PID:1588 -
\??\c:\9jdvd.exec:\9jdvd.exe49⤵
- Executes dropped EXE
PID:348 -
\??\c:\1llllrf.exec:\1llllrf.exe50⤵
- Executes dropped EXE
PID:2188 -
\??\c:\nnhthn.exec:\nnhthn.exe51⤵
- Executes dropped EXE
PID:1360 -
\??\c:\hbtbht.exec:\hbtbht.exe52⤵
- Executes dropped EXE
PID:2944 -
\??\c:\jjvdp.exec:\jjvdp.exe53⤵
- Executes dropped EXE
PID:2464 -
\??\c:\fxlrxfl.exec:\fxlrxfl.exe54⤵
- Executes dropped EXE
PID:1224 -
\??\c:\xlflxxx.exec:\xlflxxx.exe55⤵
- Executes dropped EXE
PID:2924 -
\??\c:\hbtbnh.exec:\hbtbnh.exe56⤵
- Executes dropped EXE
PID:2024 -
\??\c:\1pjpv.exec:\1pjpv.exe57⤵
- Executes dropped EXE
PID:2096 -
\??\c:\jvjjv.exec:\jvjjv.exe58⤵
- Executes dropped EXE
PID:344 -
\??\c:\lflrflf.exec:\lflrflf.exe59⤵
- Executes dropped EXE
PID:1928 -
\??\c:\ffxfrfr.exec:\ffxfrfr.exe60⤵
- Executes dropped EXE
PID:768 -
\??\c:\tnntbb.exec:\tnntbb.exe61⤵
- Executes dropped EXE
PID:576 -
\??\c:\hthnbb.exec:\hthnbb.exe62⤵
- Executes dropped EXE
PID:2460 -
\??\c:\1jddv.exec:\1jddv.exe63⤵
- Executes dropped EXE
PID:2432 -
\??\c:\xlxxrxf.exec:\xlxxrxf.exe64⤵
- Executes dropped EXE
PID:2348 -
\??\c:\5rlllll.exec:\5rlllll.exe65⤵
- Executes dropped EXE
PID:1140 -
\??\c:\hhthnh.exec:\hhthnh.exe66⤵PID:2060
-
\??\c:\3httbh.exec:\3httbh.exe67⤵PID:2156
-
\??\c:\vdjpd.exec:\vdjpd.exe68⤵PID:2380
-
\??\c:\pjvdd.exec:\pjvdd.exe69⤵PID:2068
-
\??\c:\1xlrxfl.exec:\1xlrxfl.exe70⤵PID:1852
-
\??\c:\rlxlllr.exec:\rlxlllr.exe71⤵PID:892
-
\??\c:\hhnbnt.exec:\hhnbnt.exe72⤵PID:1944
-
\??\c:\dvvjd.exec:\dvvjd.exe73⤵PID:1932
-
\??\c:\9jdjp.exec:\9jdjp.exe74⤵PID:3020
-
\??\c:\llfffrf.exec:\llfffrf.exe75⤵PID:3004
-
\??\c:\xrllxrx.exec:\xrllxrx.exe76⤵PID:3064
-
\??\c:\btntbb.exec:\btntbb.exe77⤵PID:2876
-
\??\c:\tnbtbb.exec:\tnbtbb.exe78⤵PID:2604
-
\??\c:\jdjjj.exec:\jdjjj.exe79⤵PID:2640
-
\??\c:\lxfxxxl.exec:\lxfxxxl.exe80⤵PID:1952
-
\??\c:\flrlfxr.exec:\flrlfxr.exe81⤵PID:2764
-
\??\c:\nhbbtb.exec:\nhbbtb.exe82⤵PID:2480
-
\??\c:\hbbbhh.exec:\hbbbhh.exe83⤵PID:2364
-
\??\c:\vpvdj.exec:\vpvdj.exe84⤵PID:2508
-
\??\c:\1ppvd.exec:\1ppvd.exe85⤵PID:1556
-
\??\c:\5xrrxfl.exec:\5xrrxfl.exe86⤵PID:2824
-
\??\c:\ttnbtb.exec:\ttnbtb.exe87⤵PID:2820
-
\??\c:\ttbhnn.exec:\ttbhnn.exe88⤵PID:1584
-
\??\c:\ddpdp.exec:\ddpdp.exe89⤵PID:1800
-
\??\c:\fllfffr.exec:\fllfffr.exe90⤵PID:2136
-
\??\c:\3fxflxx.exec:\3fxflxx.exe91⤵PID:1576
-
\??\c:\ttntnn.exec:\ttntnn.exe92⤵PID:2184
-
\??\c:\dvjpv.exec:\dvjpv.exe93⤵PID:1316
-
\??\c:\jjdpj.exec:\jjdpj.exe94⤵PID:1180
-
\??\c:\lxlrxxf.exec:\lxlrxxf.exe95⤵PID:2016
-
\??\c:\xxrxflx.exec:\xxrxflx.exe96⤵PID:2956
-
\??\c:\9htbnb.exec:\9htbnb.exe97⤵PID:2940
-
\??\c:\vppjp.exec:\vppjp.exe98⤵PID:264
-
\??\c:\pjvdj.exec:\pjvdj.exe99⤵PID:1840
-
\??\c:\7rflffr.exec:\7rflffr.exe100⤵PID:2424
-
\??\c:\3nnntt.exec:\3nnntt.exe101⤵PID:772
-
\??\c:\tnhhhb.exec:\tnhhhb.exe102⤵PID:1396
-
\??\c:\vpvpd.exec:\vpvpd.exe103⤵PID:1004
-
\??\c:\ffrrxxl.exec:\ffrrxxl.exe104⤵PID:1464
-
\??\c:\lfxxfxl.exec:\lfxxfxl.exe105⤵PID:2272
-
\??\c:\bthhbb.exec:\bthhbb.exe106⤵PID:2436
-
\??\c:\bttttt.exec:\bttttt.exe107⤵PID:884
-
\??\c:\pppdv.exec:\pppdv.exe108⤵PID:1208
-
\??\c:\rrlxrxl.exec:\rrlxrxl.exe109⤵PID:1000
-
\??\c:\rrfrxlx.exec:\rrfrxlx.exe110⤵PID:1740
-
\??\c:\tnhthn.exec:\tnhthn.exe111⤵PID:628
-
\??\c:\1nhnbb.exec:\1nhnbb.exe112⤵PID:2852
-
\??\c:\1ddjp.exec:\1ddjp.exe113⤵PID:2164
-
\??\c:\vjddp.exec:\vjddp.exe114⤵PID:1868
-
\??\c:\5lrrrrl.exec:\5lrrrrl.exe115⤵PID:1524
-
\??\c:\tbbttb.exec:\tbbttb.exe116⤵PID:3020
-
\??\c:\hbnnhn.exec:\hbnnhn.exe117⤵PID:2664
-
\??\c:\vvvjv.exec:\vvvjv.exe118⤵PID:2584
-
\??\c:\llrxlfr.exec:\llrxlfr.exe119⤵PID:2768
-
\??\c:\3tntbh.exec:\3tntbh.exe120⤵PID:2696
-
\??\c:\hbbtnt.exec:\hbbtnt.exe121⤵PID:3028
-
\??\c:\pjvdv.exec:\pjvdv.exe122⤵PID:2476
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-