Analysis
- max time kernel
150s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 01:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6f91a9ddd88c75a9853a9dc73ecf1ff0_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
- Target 6f91a9ddd88c75a9853a9dc73ecf1ff0_NeikiAnalytics.exe
- Size 95KB
- Sample240518-b882yaef52
- SHA256 e7368ac0630a7fb866f9eb77d0356c30e898e31059c24e4f9983115991dcf8df
- MD5 6f91a9ddd88c75a9853a9dc73ecf1ff0
- SHA1 4afa5cc1c37dc058b6eb01fdf8ed1d571f535a07
- SHA512 a43af2afcd8e91017ab1eaf1c46db954667dc95b44151cbcc1cee6a0d2dfb00d5cee92193d7ead191953013274050ec8f81ba9309570cdd6cd317df957b93ffb
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qP1hvZo66Ox4oq2SQwfTQ1:ymb3NkkiQ3mdBjFIj+qNhvZuHQY01
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/1140-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/372-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3504-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/372-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1472-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3856-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/628-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2616-75-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2616-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2096-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4076-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2748-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3664-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2684-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1220-53-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1220-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5112-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2988-34-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2988-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4716-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3392-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3840-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1424-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3568-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1224-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/836-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4744-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1836-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 1472 vdddv.exe 372 djpjv.exe 3504 xrlfxrl.exe 2988 bnbbbt.exe 5112 hbnhbt.exe 1220 pjdvp.exe 2684 dvvvd.exe 3856 rflfxxr.exe 628 bhbttn.exe 2616 7thbtn.exe 3664 vpjpj.exe 2096 jdpjj.exe 4076 rlffxfx.exe 2748 nhhhhh.exe 4092 pjvpj.exe 3752 pddvp.exe 4716 xxllrxr.exe 3392 hhnntn.exe 5048 jpdvj.exe 3840 lxfrxlf.exe 1424 bhtnhb.exe 3568 vpjdp.exe 2340 llrlfxr.exe 2028 hbtnhh.exe 1224 7djdp.exe 836 rxffflr.exe 4744 5nthbb.exe 3388 dddvv.exe 1836 pdjdv.exe 3056 rrrlllf.exe 1188 tttnhb.exe 1428 vvddj.exe 4916 vvpjd.exe 2436 3rrxffr.exe 4952 hnnnhh.exe 972 nnbbtb.exe 4084 pdjdv.exe 4196 rrrffxr.exe 4344 nhhbtt.exe 2424 vpvpj.exe 2152 rlfxlrl.exe 3844 rrllfff.exe 3632 jjvdv.exe 1584 lffxrrl.exe 1000 5xxrrrr.exe 2620 bnthhh.exe 1396 nnttnn.exe 2540 jvjdp.exe 2032 llrlfff.exe 876 nttnhh.exe 2628 bbhhtt.exe 2068 5lxrrll.exe 2644 llrrfff.exe 3316 nthbhb.exe 4816 ddpjv.exe 4840 vvppv.exe 3664 1rxrffx.exe 1928 rrxrrrl.exe 2588 ntthbb.exe 5080 jvvjj.exe 4704 pjdvj.exe 4092 rflllll.exe 3796 9xfxxrr.exe 1736 tnnntt.exe -
resource yara_rule behavioral2/memory/1140-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/372-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1472-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3856-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/628-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2616-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2096-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4076-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2748-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3664-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2684-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1220-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2988-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4716-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3392-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3840-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1424-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3568-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1224-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/836-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4744-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1836-192-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1140 wrote to memory of 1472 1140 6f91a9ddd88c75a9853a9dc73ecf1ff0_NeikiAnalytics.exe 82 PID 1140 wrote to memory of 1472 1140 6f91a9ddd88c75a9853a9dc73ecf1ff0_NeikiAnalytics.exe 82 PID 1140 wrote to memory of 1472 1140 6f91a9ddd88c75a9853a9dc73ecf1ff0_NeikiAnalytics.exe 82 PID 1472 wrote to memory of 372 1472 vdddv.exe 83 PID 1472 wrote to memory of 372 1472 vdddv.exe 83 PID 1472 wrote to memory of 372 1472 vdddv.exe 83 PID 372 wrote to memory of 3504 372 djpjv.exe 84 PID 372 wrote to memory of 3504 372 djpjv.exe 84 PID 372 wrote to memory of 3504 372 djpjv.exe 84 PID 3504 wrote to memory of 2988 3504 xrlfxrl.exe 85 PID 3504 wrote to memory of 2988 3504 xrlfxrl.exe 85 PID 3504 wrote to memory of 2988 3504 xrlfxrl.exe 85 PID 2988 wrote to memory of 5112 2988 bnbbbt.exe 86 PID 2988 wrote to memory of 5112 2988 bnbbbt.exe 86 PID 2988 wrote to memory of 5112 2988 bnbbbt.exe 86 PID 5112 wrote to memory of 1220 5112 hbnhbt.exe 87 PID 5112 wrote to memory of 1220 5112 hbnhbt.exe 87 PID 5112 wrote to memory of 1220 5112 hbnhbt.exe 87 PID 1220 wrote to memory of 2684 1220 pjdvp.exe 88 PID 1220 wrote to memory of 2684 1220 pjdvp.exe 88 PID 1220 wrote to memory of 2684 1220 pjdvp.exe 88 PID 2684 wrote to memory of 3856 2684 dvvvd.exe 89 PID 2684 wrote to memory of 3856 2684 dvvvd.exe 89 PID 2684 wrote to memory of 3856 2684 dvvvd.exe 89 PID 3856 wrote to memory of 628 3856 rflfxxr.exe 90 PID 3856 wrote to memory of 628 3856 rflfxxr.exe 90 PID 3856 wrote to memory of 628 3856 rflfxxr.exe 90 PID 628 wrote to memory of 2616 628 bhbttn.exe 91 PID 628 wrote to memory of 2616 628 bhbttn.exe 91 PID 628 wrote to memory of 2616 628 bhbttn.exe 91 PID 2616 wrote to memory of 3664 2616 7thbtn.exe 92 PID 2616 wrote to memory of 3664 2616 7thbtn.exe 92 PID 2616 wrote to memory of 3664 2616 7thbtn.exe 92 PID 3664 wrote to memory of 2096 3664 vpjpj.exe 93 PID 3664 wrote to memory of 2096 3664 vpjpj.exe 93 PID 3664 wrote to memory of 2096 3664 vpjpj.exe 93 PID 2096 wrote to memory of 4076 2096 jdpjj.exe 94 PID 2096 wrote to memory of 4076 2096 jdpjj.exe 94 PID 2096 wrote to memory of 4076 2096 jdpjj.exe 94 PID 4076 wrote to memory of 2748 4076 rlffxfx.exe 95 PID 4076 wrote to memory of 2748 4076 rlffxfx.exe 95 PID 4076 wrote to memory of 2748 4076 rlffxfx.exe 95 PID 2748 wrote to memory of 4092 2748 nhhhhh.exe 96 PID 2748 wrote to memory of 4092 2748 nhhhhh.exe 96 PID 2748 wrote to memory of 4092 2748 nhhhhh.exe 96 PID 4092 wrote to memory of 3752 4092 pjvpj.exe 97 PID 4092 wrote to memory of 3752 4092 pjvpj.exe 97 PID 4092 wrote to memory of 3752 4092 pjvpj.exe 97 PID 3752 wrote to memory of 4716 3752 pddvp.exe 98 PID 3752 wrote to memory of 4716 3752 pddvp.exe 98 PID 3752 wrote to memory of 4716 3752 pddvp.exe 98 PID 4716 wrote to memory of 3392 4716 xxllrxr.exe 99 PID 4716 wrote to memory of 3392 4716 xxllrxr.exe 99 PID 4716 wrote to memory of 3392 4716 xxllrxr.exe 99 PID 3392 wrote to memory of 5048 3392 hhnntn.exe 100 PID 3392 wrote to memory of 5048 3392 hhnntn.exe 100 PID 3392 wrote to memory of 5048 3392 hhnntn.exe 100 PID 5048 wrote to memory of 3840 5048 jpdvj.exe 101 PID 5048 wrote to memory of 3840 5048 jpdvj.exe 101 PID 5048 wrote to memory of 3840 5048 jpdvj.exe 101 PID 3840 wrote to memory of 1424 3840 lxfrxlf.exe 102 PID 3840 wrote to memory of 1424 3840 lxfrxlf.exe 102 PID 3840 wrote to memory of 1424 3840 lxfrxlf.exe 102 PID 1424 wrote to memory of 3568 1424 bhtnhb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f91a9ddd88c75a9853a9dc73ecf1ff0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6f91a9ddd88c75a9853a9dc73ecf1ff0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1140 -
\??\c:\vdddv.exec:\vdddv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\djpjv.exec:\djpjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\xrlfxrl.exec:\xrlfxrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\bnbbbt.exec:\bnbbbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\hbnhbt.exec:\hbnhbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\pjdvp.exec:\pjdvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\dvvvd.exec:\dvvvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\rflfxxr.exec:\rflfxxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
\??\c:\bhbttn.exec:\bhbttn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\7thbtn.exec:\7thbtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\vpjpj.exec:\vpjpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\jdpjj.exec:\jdpjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\rlffxfx.exec:\rlffxfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\nhhhhh.exec:\nhhhhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\pjvpj.exec:\pjvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\pddvp.exec:\pddvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\xxllrxr.exec:\xxllrxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\hhnntn.exec:\hhnntn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\jpdvj.exec:\jpdvj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\lxfrxlf.exec:\lxfrxlf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\bhtnhb.exec:\bhtnhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\vpjdp.exec:\vpjdp.exe23⤵
- Executes dropped EXE
PID:3568 -
\??\c:\llrlfxr.exec:\llrlfxr.exe24⤵
- Executes dropped EXE
PID:2340 -
\??\c:\hbtnhh.exec:\hbtnhh.exe25⤵
- Executes dropped EXE
PID:2028 -
\??\c:\7djdp.exec:\7djdp.exe26⤵
- Executes dropped EXE
PID:1224 -
\??\c:\rxffflr.exec:\rxffflr.exe27⤵
- Executes dropped EXE
PID:836 -
\??\c:\5nthbb.exec:\5nthbb.exe28⤵
- Executes dropped EXE
PID:4744 -
\??\c:\dddvv.exec:\dddvv.exe29⤵
- Executes dropped EXE
PID:3388 -
\??\c:\pdjdv.exec:\pdjdv.exe30⤵
- Executes dropped EXE
PID:1836 -
\??\c:\rrrlllf.exec:\rrrlllf.exe31⤵
- Executes dropped EXE
PID:3056 -
\??\c:\tttnhb.exec:\tttnhb.exe32⤵
- Executes dropped EXE
PID:1188 -
\??\c:\vvddj.exec:\vvddj.exe33⤵
- Executes dropped EXE
PID:1428 -
\??\c:\vvpjd.exec:\vvpjd.exe34⤵
- Executes dropped EXE
PID:4916 -
\??\c:\3rrxffr.exec:\3rrxffr.exe35⤵
- Executes dropped EXE
PID:2436 -
\??\c:\hnnnhh.exec:\hnnnhh.exe36⤵
- Executes dropped EXE
PID:4952 -
\??\c:\nnbbtb.exec:\nnbbtb.exe37⤵
- Executes dropped EXE
PID:972 -
\??\c:\pdjdv.exec:\pdjdv.exe38⤵
- Executes dropped EXE
PID:4084 -
\??\c:\rrrffxr.exec:\rrrffxr.exe39⤵
- Executes dropped EXE
PID:4196 -
\??\c:\nhhbtt.exec:\nhhbtt.exe40⤵
- Executes dropped EXE
PID:4344 -
\??\c:\vpvpj.exec:\vpvpj.exe41⤵
- Executes dropped EXE
PID:2424 -
\??\c:\rlfxlrl.exec:\rlfxlrl.exe42⤵
- Executes dropped EXE
PID:2152 -
\??\c:\rrllfff.exec:\rrllfff.exe43⤵
- Executes dropped EXE
PID:3844 -
\??\c:\tbhhhh.exec:\tbhhhh.exe44⤵PID:4520
-
\??\c:\jjvdv.exec:\jjvdv.exe45⤵
- Executes dropped EXE
PID:3632 -
\??\c:\lffxrrl.exec:\lffxrrl.exe46⤵
- Executes dropped EXE
PID:1584 -
\??\c:\5xxrrrr.exec:\5xxrrrr.exe47⤵
- Executes dropped EXE
PID:1000 -
\??\c:\bnthhh.exec:\bnthhh.exe48⤵
- Executes dropped EXE
PID:2620 -
\??\c:\nnttnn.exec:\nnttnn.exe49⤵
- Executes dropped EXE
PID:1396 -
\??\c:\jvjdp.exec:\jvjdp.exe50⤵
- Executes dropped EXE
PID:2540 -
\??\c:\llrlfff.exec:\llrlfff.exe51⤵
- Executes dropped EXE
PID:2032 -
\??\c:\nttnhh.exec:\nttnhh.exe52⤵
- Executes dropped EXE
PID:876 -
\??\c:\bbhhtt.exec:\bbhhtt.exe53⤵
- Executes dropped EXE
PID:2628 -
\??\c:\5lxrrll.exec:\5lxrrll.exe54⤵
- Executes dropped EXE
PID:2068 -
\??\c:\llrrfff.exec:\llrrfff.exe55⤵
- Executes dropped EXE
PID:2644 -
\??\c:\nthbhb.exec:\nthbhb.exe56⤵
- Executes dropped EXE
PID:3316 -
\??\c:\ddpjv.exec:\ddpjv.exe57⤵
- Executes dropped EXE
PID:4816 -
\??\c:\vvppv.exec:\vvppv.exe58⤵
- Executes dropped EXE
PID:4840 -
\??\c:\1rxrffx.exec:\1rxrffx.exe59⤵
- Executes dropped EXE
PID:3664 -
\??\c:\rrxrrrl.exec:\rrxrrrl.exe60⤵
- Executes dropped EXE
PID:1928 -
\??\c:\ntthbb.exec:\ntthbb.exe61⤵
- Executes dropped EXE
PID:2588 -
\??\c:\jvvjj.exec:\jvvjj.exe62⤵
- Executes dropped EXE
PID:5080 -
\??\c:\pjdvj.exec:\pjdvj.exe63⤵
- Executes dropped EXE
PID:4704 -
\??\c:\rflllll.exec:\rflllll.exe64⤵
- Executes dropped EXE
PID:4092 -
\??\c:\9xfxxrr.exec:\9xfxxrr.exe65⤵
- Executes dropped EXE
PID:3796 -
\??\c:\tnnntt.exec:\tnnntt.exe66⤵
- Executes dropped EXE
PID:1736 -
\??\c:\dvjvj.exec:\dvjvj.exe67⤵PID:4056
-
\??\c:\rlxxrrf.exec:\rlxxrrf.exe68⤵PID:1036
-
\??\c:\bhhbbb.exec:\bhhbbb.exe69⤵PID:3508
-
\??\c:\vdvdd.exec:\vdvdd.exe70⤵PID:3584
-
\??\c:\rflfxfx.exec:\rflfxfx.exe71⤵PID:2232
-
\??\c:\tbhbnh.exec:\tbhbnh.exe72⤵PID:4304
-
\??\c:\tntttb.exec:\tntttb.exe73⤵PID:2200
-
\??\c:\ppdvp.exec:\ppdvp.exe74⤵PID:3736
-
\??\c:\rlfxxrr.exec:\rlfxxrr.exe75⤵PID:836
-
\??\c:\rflffxx.exec:\rflffxx.exe76⤵PID:884
-
\??\c:\5tnhtt.exec:\5tnhtt.exe77⤵PID:4936
-
\??\c:\1vddv.exec:\1vddv.exe78⤵PID:2356
-
\??\c:\vppvj.exec:\vppvj.exe79⤵PID:516
-
\??\c:\frxxrll.exec:\frxxrll.exe80⤵PID:4176
-
\??\c:\bhnnbb.exec:\bhnnbb.exe81⤵PID:1332
-
\??\c:\1vppp.exec:\1vppp.exe82⤵PID:940
-
\??\c:\7ffrfxr.exec:\7ffrfxr.exe83⤵PID:1428
-
\??\c:\bbhbtt.exec:\bbhbtt.exe84⤵PID:3140
-
\??\c:\hbbtnn.exec:\hbbtnn.exe85⤵PID:3992
-
\??\c:\vvjdv.exec:\vvjdv.exe86⤵PID:4952
-
\??\c:\frxrflx.exec:\frxrflx.exe87⤵PID:116
-
\??\c:\9xrrlll.exec:\9xrrlll.exe88⤵PID:3612
-
\??\c:\thnnht.exec:\thnnht.exe89⤵PID:1668
-
\??\c:\pjjvv.exec:\pjjvv.exe90⤵PID:1212
-
\??\c:\xxxrrfr.exec:\xxxrrfr.exe91⤵PID:552
-
\??\c:\xrxxlfl.exec:\xrxxlfl.exe92⤵PID:4404
-
\??\c:\bhnthn.exec:\bhnthn.exe93⤵PID:3016
-
\??\c:\7vppj.exec:\7vppj.exe94⤵PID:2400
-
\??\c:\pjjjv.exec:\pjjjv.exe95⤵PID:5064
-
\??\c:\frrlfxr.exec:\frrlfxr.exe96⤵PID:2216
-
\??\c:\btthbb.exec:\btthbb.exe97⤵PID:760
-
\??\c:\bbtnhh.exec:\bbtnhh.exe98⤵PID:2936
-
\??\c:\vjpjv.exec:\vjpjv.exe99⤵PID:3180
-
\??\c:\rlrllll.exec:\rlrllll.exe100⤵PID:876
-
\??\c:\nthbbh.exec:\nthbbh.exe101⤵PID:1148
-
\??\c:\nbhttb.exec:\nbhttb.exe102⤵PID:2120
-
\??\c:\ppddv.exec:\ppddv.exe103⤵PID:3932
-
\??\c:\pdpdj.exec:\pdpdj.exe104⤵PID:3324
-
\??\c:\frffxff.exec:\frffxff.exe105⤵PID:1208
-
\??\c:\rxlrrrr.exec:\rxlrrrr.exe106⤵PID:1232
-
\??\c:\httnnn.exec:\httnnn.exe107⤵PID:2332
-
\??\c:\vvvvp.exec:\vvvvp.exe108⤵PID:2316
-
\??\c:\vpdvp.exec:\vpdvp.exe109⤵PID:4808
-
\??\c:\fxxfrxr.exec:\fxxfrxr.exe110⤵PID:1596
-
\??\c:\fllllll.exec:\fllllll.exe111⤵PID:3796
-
\??\c:\nnbhnn.exec:\nnbhnn.exe112⤵PID:1060
-
\??\c:\vdppv.exec:\vdppv.exe113⤵PID:3840
-
\??\c:\pjpjj.exec:\pjpjj.exe114⤵PID:1036
-
\??\c:\lxfxrll.exec:\lxfxrll.exe115⤵PID:3252
-
\??\c:\lxrrrrr.exec:\lxrrrrr.exe116⤵PID:3584
-
\??\c:\9bnhbt.exec:\9bnhbt.exe117⤵PID:3764
-
\??\c:\nbbbtn.exec:\nbbbtn.exe118⤵PID:5060
-
\??\c:\jvvpj.exec:\jvvpj.exe119⤵PID:888
-
\??\c:\ppjjd.exec:\ppjjd.exe120⤵PID:2576
-
\??\c:\xlxrffx.exec:\xlxrffx.exe121⤵PID:1516
-
\??\c:\frxxrll.exec:\frxxrll.exe122⤵PID:2548
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-