Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
31-05-2024 19:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0c86dfa8feef7c24c5b5137eae705760_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0c86dfa8feef7c24c5b5137eae705760_NeikiAnalytics.exe
-
Size
62KB
-
MD5
0c86dfa8feef7c24c5b5137eae705760
-
SHA1
4521e0c33a974b2a1e64f2ab6e7997046916c7eb
-
SHA256
f049bc9b8865d0927215c0f6052f96263ff357ef8947bb92966dadb2cf58279a
-
SHA512
0f90a04a8bb8d871ee6d46ee765d9acbed8fc031fa572d82d8c624870f3ca7298fa741c21f7374892b4e65d3e1bef59540e7c567b3b62116ebc9eb790e273ecd
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDII9ZvHKE4:ymb3NkkiQ3mdBjFII9ZvHKE4
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2340-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2352-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2280-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1696-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/380-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/868-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1556-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2304-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2060-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1028-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/776-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1904-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/924-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2340 bbntnb.exe 2088 xrxfffl.exe 2580 hbttbh.exe 2280 jjvdj.exe 2448 rlxfxlx.exe 2536 llfrfrf.exe 2496 bbhbtn.exe 3004 nnbtbb.exe 2828 ddvdd.exe 2920 xllrrlx.exe 2080 lfxlrfr.exe 1696 nnntnt.exe 2676 nhbbhn.exe 380 jjvdj.exe 868 9fxfrxr.exe 2804 9xrxlxr.exe 1556 btntht.exe 1764 jvvdd.exe 2304 xrlrflx.exe 2404 5rfxxrr.exe 2212 bbnbnh.exe 700 dvvvd.exe 1580 7xlxfrx.exe 2060 fllxxrx.exe 1028 ttnbth.exe 776 pdppd.exe 1904 1flrflr.exe 924 fxrrxll.exe 2708 ttbhbb.exe 1928 5nbnnn.exe 2352 ppvjd.exe 2068 ppvvv.exe 3060 5xxlxlf.exe 2572 nhtbtb.exe 2220 3nnhnt.exe 2732 jjddp.exe 2672 3ppdd.exe 2592 rlfllrx.exe 2428 fxrfflx.exe 1944 bththh.exe 360 7bbhhb.exe 2664 5pdvj.exe 2840 pvjpd.exe 2952 lrxllfr.exe 2412 xxllrrf.exe 2808 btbtnn.exe 2524 tthbnn.exe 2800 jdvdv.exe 676 jddjp.exe 2772 djdvd.exe 2756 rlxfxfr.exe 1616 1nhntt.exe 1920 dvjpp.exe 2044 xxrxxxf.exe 2216 fxrxrrx.exe 2016 hbthtb.exe 596 bbnthh.exe 1436 vpvvv.exe 812 pjjvd.exe 2880 5lxfrxl.exe 1148 hbhnbh.exe 3052 nnntht.exe 716 vvjpp.exe 776 ppjvd.exe -
resource yara_rule behavioral1/memory/2340-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2352-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/380-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/868-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1028-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/776-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1904-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/924-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-274-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2340 2352 0c86dfa8feef7c24c5b5137eae705760_NeikiAnalytics.exe 29 PID 2352 wrote to memory of 2340 2352 0c86dfa8feef7c24c5b5137eae705760_NeikiAnalytics.exe 29 PID 2352 wrote to memory of 2340 2352 0c86dfa8feef7c24c5b5137eae705760_NeikiAnalytics.exe 29 PID 2352 wrote to memory of 2340 2352 0c86dfa8feef7c24c5b5137eae705760_NeikiAnalytics.exe 29 PID 2340 wrote to memory of 2088 2340 bbntnb.exe 30 PID 2340 wrote to memory of 2088 2340 bbntnb.exe 30 PID 2340 wrote to memory of 2088 2340 bbntnb.exe 30 PID 2340 wrote to memory of 2088 2340 bbntnb.exe 30 PID 2088 wrote to memory of 2580 2088 xrxfffl.exe 31 PID 2088 wrote to memory of 2580 2088 xrxfffl.exe 31 PID 2088 wrote to memory of 2580 2088 xrxfffl.exe 31 PID 2088 wrote to memory of 2580 2088 xrxfffl.exe 31 PID 2580 wrote to memory of 2280 2580 hbttbh.exe 32 PID 2580 wrote to memory of 2280 2580 hbttbh.exe 32 PID 2580 wrote to memory of 2280 2580 hbttbh.exe 32 PID 2580 wrote to memory of 2280 2580 hbttbh.exe 32 PID 2280 wrote to memory of 2448 2280 jjvdj.exe 33 PID 2280 wrote to memory of 2448 2280 jjvdj.exe 33 PID 2280 wrote to memory of 2448 2280 jjvdj.exe 33 PID 2280 wrote to memory of 2448 2280 jjvdj.exe 33 PID 2448 wrote to memory of 2536 2448 rlxfxlx.exe 34 PID 2448 wrote to memory of 2536 2448 rlxfxlx.exe 34 PID 2448 wrote to memory of 2536 2448 rlxfxlx.exe 34 PID 2448 wrote to memory of 2536 2448 rlxfxlx.exe 34 PID 2536 wrote to memory of 2496 2536 llfrfrf.exe 35 PID 2536 wrote to memory of 2496 2536 llfrfrf.exe 35 PID 2536 wrote to memory of 2496 2536 llfrfrf.exe 35 PID 2536 wrote to memory of 2496 2536 llfrfrf.exe 35 PID 2496 wrote to memory of 3004 2496 bbhbtn.exe 36 PID 2496 wrote to memory of 3004 2496 bbhbtn.exe 36 PID 2496 wrote to memory of 3004 2496 bbhbtn.exe 36 PID 2496 wrote to memory of 3004 2496 bbhbtn.exe 36 PID 3004 wrote to memory of 2828 3004 nnbtbb.exe 37 PID 3004 wrote to memory of 2828 3004 nnbtbb.exe 37 PID 3004 wrote to memory of 2828 3004 nnbtbb.exe 37 PID 3004 wrote to memory of 2828 3004 nnbtbb.exe 37 PID 2828 wrote to memory of 2920 2828 ddvdd.exe 38 PID 2828 wrote to memory of 2920 2828 ddvdd.exe 38 PID 2828 wrote to memory of 2920 2828 ddvdd.exe 38 PID 2828 wrote to memory of 2920 2828 ddvdd.exe 38 PID 2920 wrote to memory of 2080 2920 xllrrlx.exe 39 PID 2920 wrote to memory of 2080 2920 xllrrlx.exe 39 PID 2920 wrote to memory of 2080 2920 xllrrlx.exe 39 PID 2920 wrote to memory of 2080 2920 xllrrlx.exe 39 PID 2080 wrote to memory of 1696 2080 lfxlrfr.exe 40 PID 2080 wrote to memory of 1696 2080 lfxlrfr.exe 40 PID 2080 wrote to memory of 1696 2080 lfxlrfr.exe 40 PID 2080 wrote to memory of 1696 2080 lfxlrfr.exe 40 PID 1696 wrote to memory of 2676 1696 nnntnt.exe 41 PID 1696 wrote to memory of 2676 1696 nnntnt.exe 41 PID 1696 wrote to memory of 2676 1696 nnntnt.exe 41 PID 1696 wrote to memory of 2676 1696 nnntnt.exe 41 PID 2676 wrote to memory of 380 2676 nhbbhn.exe 42 PID 2676 wrote to memory of 380 2676 nhbbhn.exe 42 PID 2676 wrote to memory of 380 2676 nhbbhn.exe 42 PID 2676 wrote to memory of 380 2676 nhbbhn.exe 42 PID 380 wrote to memory of 868 380 jjvdj.exe 43 PID 380 wrote to memory of 868 380 jjvdj.exe 43 PID 380 wrote to memory of 868 380 jjvdj.exe 43 PID 380 wrote to memory of 868 380 jjvdj.exe 43 PID 868 wrote to memory of 2804 868 9fxfrxr.exe 44 PID 868 wrote to memory of 2804 868 9fxfrxr.exe 44 PID 868 wrote to memory of 2804 868 9fxfrxr.exe 44 PID 868 wrote to memory of 2804 868 9fxfrxr.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c86dfa8feef7c24c5b5137eae705760_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0c86dfa8feef7c24c5b5137eae705760_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\bbntnb.exec:\bbntnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\xrxfffl.exec:\xrxfffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\hbttbh.exec:\hbttbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\jjvdj.exec:\jjvdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\rlxfxlx.exec:\rlxfxlx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\llfrfrf.exec:\llfrfrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\bbhbtn.exec:\bbhbtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\nnbtbb.exec:\nnbtbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\ddvdd.exec:\ddvdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\xllrrlx.exec:\xllrrlx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\lfxlrfr.exec:\lfxlrfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\nnntnt.exec:\nnntnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\nhbbhn.exec:\nhbbhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\jjvdj.exec:\jjvdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\9fxfrxr.exec:\9fxfrxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\9xrxlxr.exec:\9xrxlxr.exe17⤵
- Executes dropped EXE
PID:2804 -
\??\c:\btntht.exec:\btntht.exe18⤵
- Executes dropped EXE
PID:1556 -
\??\c:\jvvdd.exec:\jvvdd.exe19⤵
- Executes dropped EXE
PID:1764 -
\??\c:\xrlrflx.exec:\xrlrflx.exe20⤵
- Executes dropped EXE
PID:2304 -
\??\c:\5rfxxrr.exec:\5rfxxrr.exe21⤵
- Executes dropped EXE
PID:2404 -
\??\c:\bbnbnh.exec:\bbnbnh.exe22⤵
- Executes dropped EXE
PID:2212 -
\??\c:\dvvvd.exec:\dvvvd.exe23⤵
- Executes dropped EXE
PID:700 -
\??\c:\7xlxfrx.exec:\7xlxfrx.exe24⤵
- Executes dropped EXE
PID:1580 -
\??\c:\fllxxrx.exec:\fllxxrx.exe25⤵
- Executes dropped EXE
PID:2060 -
\??\c:\ttnbth.exec:\ttnbth.exe26⤵
- Executes dropped EXE
PID:1028 -
\??\c:\pdppd.exec:\pdppd.exe27⤵
- Executes dropped EXE
PID:776 -
\??\c:\1flrflr.exec:\1flrflr.exe28⤵
- Executes dropped EXE
PID:1904 -
\??\c:\fxrrxll.exec:\fxrrxll.exe29⤵
- Executes dropped EXE
PID:924 -
\??\c:\ttbhbb.exec:\ttbhbb.exe30⤵
- Executes dropped EXE
PID:2708 -
\??\c:\5nbnnn.exec:\5nbnnn.exe31⤵
- Executes dropped EXE
PID:1928 -
\??\c:\ppvjd.exec:\ppvjd.exe32⤵
- Executes dropped EXE
PID:2352 -
\??\c:\ppvvv.exec:\ppvvv.exe33⤵
- Executes dropped EXE
PID:2068 -
\??\c:\5xxlxlf.exec:\5xxlxlf.exe34⤵
- Executes dropped EXE
PID:3060 -
\??\c:\nhtbtb.exec:\nhtbtb.exe35⤵
- Executes dropped EXE
PID:2572 -
\??\c:\3nnhnt.exec:\3nnhnt.exe36⤵
- Executes dropped EXE
PID:2220 -
\??\c:\jjddp.exec:\jjddp.exe37⤵
- Executes dropped EXE
PID:2732 -
\??\c:\3ppdd.exec:\3ppdd.exe38⤵
- Executes dropped EXE
PID:2672 -
\??\c:\rlfllrx.exec:\rlfllrx.exe39⤵
- Executes dropped EXE
PID:2592 -
\??\c:\fxrfflx.exec:\fxrfflx.exe40⤵
- Executes dropped EXE
PID:2428 -
\??\c:\bththh.exec:\bththh.exe41⤵
- Executes dropped EXE
PID:1944 -
\??\c:\7bbhhb.exec:\7bbhhb.exe42⤵
- Executes dropped EXE
PID:360 -
\??\c:\5pdvj.exec:\5pdvj.exe43⤵
- Executes dropped EXE
PID:2664 -
\??\c:\pvjpd.exec:\pvjpd.exe44⤵
- Executes dropped EXE
PID:2840 -
\??\c:\lrxllfr.exec:\lrxllfr.exe45⤵
- Executes dropped EXE
PID:2952 -
\??\c:\xxllrrf.exec:\xxllrrf.exe46⤵
- Executes dropped EXE
PID:2412 -
\??\c:\btbtnn.exec:\btbtnn.exe47⤵
- Executes dropped EXE
PID:2808 -
\??\c:\tthbnn.exec:\tthbnn.exe48⤵
- Executes dropped EXE
PID:2524 -
\??\c:\jdvdv.exec:\jdvdv.exe49⤵
- Executes dropped EXE
PID:2800 -
\??\c:\jddjp.exec:\jddjp.exe50⤵
- Executes dropped EXE
PID:676 -
\??\c:\djdvd.exec:\djdvd.exe51⤵
- Executes dropped EXE
PID:2772 -
\??\c:\rlxfxfr.exec:\rlxfxfr.exe52⤵
- Executes dropped EXE
PID:2756 -
\??\c:\1nhntt.exec:\1nhntt.exe53⤵
- Executes dropped EXE
PID:1616 -
\??\c:\dvjpp.exec:\dvjpp.exe54⤵
- Executes dropped EXE
PID:1920 -
\??\c:\xxrxxxf.exec:\xxrxxxf.exe55⤵
- Executes dropped EXE
PID:2044 -
\??\c:\fxrxrrx.exec:\fxrxrrx.exe56⤵
- Executes dropped EXE
PID:2216 -
\??\c:\hbthtb.exec:\hbthtb.exe57⤵
- Executes dropped EXE
PID:2016 -
\??\c:\bbnthh.exec:\bbnthh.exe58⤵
- Executes dropped EXE
PID:596 -
\??\c:\vpvvv.exec:\vpvvv.exe59⤵
- Executes dropped EXE
PID:1436 -
\??\c:\pjjvd.exec:\pjjvd.exe60⤵
- Executes dropped EXE
PID:812 -
\??\c:\5lxfrxl.exec:\5lxfrxl.exe61⤵
- Executes dropped EXE
PID:2880 -
\??\c:\hbhnbh.exec:\hbhnbh.exe62⤵
- Executes dropped EXE
PID:1148 -
\??\c:\nnntht.exec:\nnntht.exe63⤵
- Executes dropped EXE
PID:3052 -
\??\c:\vvjpp.exec:\vvjpp.exe64⤵
- Executes dropped EXE
PID:716 -
\??\c:\ppjvd.exec:\ppjvd.exe65⤵
- Executes dropped EXE
PID:776 -
\??\c:\lffrrfr.exec:\lffrrfr.exe66⤵PID:2928
-
\??\c:\ttbnbt.exec:\ttbnbt.exe67⤵PID:544
-
\??\c:\thntbb.exec:\thntbb.exe68⤵PID:1964
-
\??\c:\vpvpj.exec:\vpvpj.exe69⤵PID:1048
-
\??\c:\vvjjv.exec:\vvjjv.exe70⤵PID:1680
-
\??\c:\jddvj.exec:\jddvj.exe71⤵PID:2192
-
\??\c:\xrflxfr.exec:\xrflxfr.exe72⤵PID:2620
-
\??\c:\xrfrxrl.exec:\xrfrxrl.exe73⤵PID:2532
-
\??\c:\tnthbn.exec:\tnthbn.exe74⤵PID:2568
-
\??\c:\hhntnn.exec:\hhntnn.exe75⤵PID:2720
-
\??\c:\ddjvj.exec:\ddjvj.exe76⤵PID:2540
-
\??\c:\dvpvv.exec:\dvpvv.exe77⤵PID:2732
-
\??\c:\xrlxlrf.exec:\xrlxlrf.exe78⤵PID:2468
-
\??\c:\rrrxrxf.exec:\rrrxrxf.exe79⤵PID:2444
-
\??\c:\bhhnth.exec:\bhhnth.exe80⤵PID:2428
-
\??\c:\5bbhbb.exec:\5bbhbb.exe81⤵PID:1932
-
\??\c:\ppvvj.exec:\ppvvj.exe82⤵PID:2500
-
\??\c:\rfxlllr.exec:\rfxlllr.exe83⤵PID:2664
-
\??\c:\xrxfxxl.exec:\xrxfxxl.exe84⤵PID:2840
-
\??\c:\hbbhhh.exec:\hbbhhh.exe85⤵PID:2984
-
\??\c:\ntttbt.exec:\ntttbt.exe86⤵PID:1368
-
\??\c:\pppdv.exec:\pppdv.exe87⤵PID:2776
-
\??\c:\jvjdd.exec:\jvjdd.exe88⤵PID:2676
-
\??\c:\rxflfrx.exec:\rxflfrx.exe89⤵PID:2780
-
\??\c:\xxrrfrf.exec:\xxrrfrf.exe90⤵PID:852
-
\??\c:\hbbnbh.exec:\hbbnbh.exe91⤵PID:1732
-
\??\c:\thbhnb.exec:\thbhnb.exe92⤵PID:1708
-
\??\c:\pdppd.exec:\pdppd.exe93⤵PID:1476
-
\??\c:\pjjpd.exec:\pjjpd.exe94⤵PID:1764
-
\??\c:\rlfrrll.exec:\rlfrrll.exe95⤵PID:2304
-
\??\c:\bhttnn.exec:\bhttnn.exe96⤵PID:2216
-
\??\c:\7htttt.exec:\7htttt.exe97⤵PID:2884
-
\??\c:\jvvvp.exec:\jvvvp.exe98⤵PID:604
-
\??\c:\xlrllff.exec:\xlrllff.exe99⤵PID:1816
-
\??\c:\rlfxlxx.exec:\rlfxlxx.exe100⤵PID:1580
-
\??\c:\tthhnh.exec:\tthhnh.exe101⤵PID:2296
-
\??\c:\tnhtnn.exec:\tnhtnn.exe102⤵PID:1304
-
\??\c:\vdvjj.exec:\vdvjj.exe103⤵PID:1664
-
\??\c:\dvpdj.exec:\dvpdj.exe104⤵PID:3028
-
\??\c:\lffxflx.exec:\lffxflx.exe105⤵PID:776
-
\??\c:\xxfxrfl.exec:\xxfxrfl.exe106⤵PID:1052
-
\??\c:\hnbtbh.exec:\hnbtbh.exe107⤵PID:2104
-
\??\c:\3bnbbb.exec:\3bnbbb.exe108⤵PID:1444
-
\??\c:\vpvvv.exec:\vpvvv.exe109⤵PID:3064
-
\??\c:\jddpp.exec:\jddpp.exe110⤵PID:1548
-
\??\c:\jvdvv.exec:\jvdvv.exe111⤵PID:2552
-
\??\c:\fxxfrxf.exec:\fxxfrxf.exe112⤵PID:2272
-
\??\c:\fxrfxlx.exec:\fxrfxlx.exe113⤵PID:2660
-
\??\c:\tnbhbb.exec:\tnbhbb.exe114⤵PID:2860
-
\??\c:\htthht.exec:\htthht.exe115⤵PID:2740
-
\??\c:\3vjjv.exec:\3vjjv.exe116⤵PID:2596
-
\??\c:\9ddvp.exec:\9ddvp.exe117⤵PID:2588
-
\??\c:\fxrlxfr.exec:\fxrlxfr.exe118⤵PID:2440
-
\??\c:\llrxllr.exec:\llrxllr.exe119⤵PID:2444
-
\??\c:\rrrlfrf.exec:\rrrlfrf.exe120⤵PID:2964
-
\??\c:\tbnbbh.exec:\tbnbbh.exe121⤵PID:2940
-
\??\c:\bbntnt.exec:\bbntnt.exe122⤵PID:2936
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-