Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
10/06/2024, 01:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
06709e3280f656012ba76ac524bdba60_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
- Target 06709e3280f656012ba76ac524bdba60_NeikiAnalytics.exe
- Size 60KB
- Sample240610-b79bbaah87
- SHA256 9edb58dcd7ba6fb27182de5e7f8c36528b377df06204fb5463dcc78176a34b6d
- MD5 06709e3280f656012ba76ac524bdba60
- SHA1 f6b865e84cdff8062ea8dd543a1bf9f377fea147
- SHA512 88be3f8ea2b0c421cf07bf2232294c52952013c023c9f52e9cdb5a9e89a518dfa5a0770b5dc6a72c92f2fbaf051ad86d6d2473436e730cd3c8ee9e17d4ee0dba
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L21:ymb3NkkiQ3mdBjFI9m
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/4580-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4580-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4044-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3988-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3140-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1988-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2044-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/412-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4424-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2168-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3692-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3664-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/540-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3588-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2376-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/960-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4620-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1388-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2784-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2228-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4736-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1656-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3100-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3084-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4660-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3108-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4120-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 4780 nnttbh.exe 4044 jddjd.exe 4120 fffxxll.exe 3108 7llllll.exe 3988 5hbhtb.exe 4660 nthnnb.exe 3084 9ddjd.exe 3100 fflxrxx.exe 3140 lflrrxf.exe 2944 bbhnnn.exe 1988 1nnhbb.exe 1656 jpvpj.exe 4736 dvvvp.exe 2228 fxfffff.exe 2044 rrfflrf.exe 2784 7nbttt.exe 1388 vpddd.exe 4620 vjvpp.exe 960 rlrlfff.exe 4440 rrxfflf.exe 4776 fllrllr.exe 2376 httttt.exe 4184 1bhnbn.exe 3588 pdddd.exe 1016 dvvvv.exe 540 lrxrxxx.exe 3664 rlxfxxl.exe 3692 ttbnnn.exe 2168 bbhhnh.exe 4424 5ppjd.exe 412 vvvdp.exe 4796 llxxllx.exe 2324 lllrrxf.exe 4608 5hntnt.exe 2468 nhbtnn.exe 3516 bhnhhh.exe 2328 5dppv.exe 2492 5pddd.exe 1072 rfrfxxx.exe 3892 lxfffll.exe 4528 1flllll.exe 3152 bnnnnn.exe 4920 ntbtnn.exe 2380 vvjpv.exe 4600 pjjjj.exe 4804 lxrlfrr.exe 1432 lxlrxfx.exe 2572 5hbtnh.exe 4948 hbnhnn.exe 2176 nhhthh.exe 2956 3djjd.exe 1104 vjvpv.exe 4192 rrrllrl.exe 3932 1rrrlrr.exe 4660 thhbtt.exe 1344 5bbtnn.exe 4312 7bbthh.exe 3100 jpjjd.exe 3156 pjpdv.exe 4864 xrrrlll.exe 1056 rrffrrf.exe 1208 bhnhtt.exe 3552 bnnnbt.exe 4736 jjjpj.exe -
resource yara_rule behavioral2/memory/4580-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3988-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3084-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3084-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3100-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3100-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3140-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1988-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/412-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2168-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3692-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3664-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/540-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2376-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/960-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4620-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1388-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2784-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2228-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4736-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1656-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3140-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3140-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3100-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3100-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3084-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4660-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3108-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-26-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4580 wrote to memory of 4780 4580 06709e3280f656012ba76ac524bdba60_NeikiAnalytics.exe 81 PID 4580 wrote to memory of 4780 4580 06709e3280f656012ba76ac524bdba60_NeikiAnalytics.exe 81 PID 4580 wrote to memory of 4780 4580 06709e3280f656012ba76ac524bdba60_NeikiAnalytics.exe 81 PID 4780 wrote to memory of 4044 4780 nnttbh.exe 82 PID 4780 wrote to memory of 4044 4780 nnttbh.exe 82 PID 4780 wrote to memory of 4044 4780 nnttbh.exe 82 PID 4044 wrote to memory of 4120 4044 jddjd.exe 83 PID 4044 wrote to memory of 4120 4044 jddjd.exe 83 PID 4044 wrote to memory of 4120 4044 jddjd.exe 83 PID 4120 wrote to memory of 3108 4120 fffxxll.exe 84 PID 4120 wrote to memory of 3108 4120 fffxxll.exe 84 PID 4120 wrote to memory of 3108 4120 fffxxll.exe 84 PID 3108 wrote to memory of 3988 3108 7llllll.exe 85 PID 3108 wrote to memory of 3988 3108 7llllll.exe 85 PID 3108 wrote to memory of 3988 3108 7llllll.exe 85 PID 3988 wrote to memory of 4660 3988 5hbhtb.exe 86 PID 3988 wrote to memory of 4660 3988 5hbhtb.exe 86 PID 3988 wrote to memory of 4660 3988 5hbhtb.exe 86 PID 4660 wrote to memory of 3084 4660 nthnnb.exe 87 PID 4660 wrote to memory of 3084 4660 nthnnb.exe 87 PID 4660 wrote to memory of 3084 4660 nthnnb.exe 87 PID 3084 wrote to memory of 3100 3084 9ddjd.exe 88 PID 3084 wrote to memory of 3100 3084 9ddjd.exe 88 PID 3084 wrote to memory of 3100 3084 9ddjd.exe 88 PID 3100 wrote to memory of 3140 3100 fflxrxx.exe 89 PID 3100 wrote to memory of 3140 3100 fflxrxx.exe 89 PID 3100 wrote to memory of 3140 3100 fflxrxx.exe 89 PID 3140 wrote to memory of 2944 3140 lflrrxf.exe 90 PID 3140 wrote to memory of 2944 3140 lflrrxf.exe 90 PID 3140 wrote to memory of 2944 3140 lflrrxf.exe 90 PID 2944 wrote to memory of 1988 2944 bbhnnn.exe 91 PID 2944 wrote to memory of 1988 2944 bbhnnn.exe 91 PID 2944 wrote to memory of 1988 2944 bbhnnn.exe 91 PID 1988 wrote to memory of 1656 1988 1nnhbb.exe 92 PID 1988 wrote to memory of 1656 1988 1nnhbb.exe 92 PID 1988 wrote to memory of 1656 1988 1nnhbb.exe 92 PID 1656 wrote to memory of 4736 1656 jpvpj.exe 93 PID 1656 wrote to memory of 4736 1656 jpvpj.exe 93 PID 1656 wrote to memory of 4736 1656 jpvpj.exe 93 PID 4736 wrote to memory of 2228 4736 dvvvp.exe 94 PID 4736 wrote to memory of 2228 4736 dvvvp.exe 94 PID 4736 wrote to memory of 2228 4736 dvvvp.exe 94 PID 2228 wrote to memory of 2044 2228 fxfffff.exe 95 PID 2228 wrote to memory of 2044 2228 fxfffff.exe 95 PID 2228 wrote to memory of 2044 2228 fxfffff.exe 95 PID 2044 wrote to memory of 2784 2044 rrfflrf.exe 96 PID 2044 wrote to memory of 2784 2044 rrfflrf.exe 96 PID 2044 wrote to memory of 2784 2044 rrfflrf.exe 96 PID 2784 wrote to memory of 1388 2784 7nbttt.exe 97 PID 2784 wrote to memory of 1388 2784 7nbttt.exe 97 PID 2784 wrote to memory of 1388 2784 7nbttt.exe 97 PID 1388 wrote to memory of 4620 1388 vpddd.exe 98 PID 1388 wrote to memory of 4620 1388 vpddd.exe 98 PID 1388 wrote to memory of 4620 1388 vpddd.exe 98 PID 4620 wrote to memory of 960 4620 vjvpp.exe 99 PID 4620 wrote to memory of 960 4620 vjvpp.exe 99 PID 4620 wrote to memory of 960 4620 vjvpp.exe 99 PID 960 wrote to memory of 4440 960 rlrlfff.exe 100 PID 960 wrote to memory of 4440 960 rlrlfff.exe 100 PID 960 wrote to memory of 4440 960 rlrlfff.exe 100 PID 4440 wrote to memory of 4776 4440 rrxfflf.exe 101 PID 4440 wrote to memory of 4776 4440 rrxfflf.exe 101 PID 4440 wrote to memory of 4776 4440 rrxfflf.exe 101 PID 4776 wrote to memory of 2376 4776 fllrllr.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\06709e3280f656012ba76ac524bdba60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\06709e3280f656012ba76ac524bdba60_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\nnttbh.exec:\nnttbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\jddjd.exec:\jddjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\fffxxll.exec:\fffxxll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\7llllll.exec:\7llllll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\5hbhtb.exec:\5hbhtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\nthnnb.exec:\nthnnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\9ddjd.exec:\9ddjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\fflxrxx.exec:\fflxrxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\lflrrxf.exec:\lflrrxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\bbhnnn.exec:\bbhnnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\1nnhbb.exec:\1nnhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\jpvpj.exec:\jpvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\dvvvp.exec:\dvvvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\fxfffff.exec:\fxfffff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\rrfflrf.exec:\rrfflrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\7nbttt.exec:\7nbttt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\vpddd.exec:\vpddd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\vjvpp.exec:\vjvpp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\rlrlfff.exec:\rlrlfff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
\??\c:\rrxfflf.exec:\rrxfflf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\fllrllr.exec:\fllrllr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\httttt.exec:\httttt.exe23⤵
- Executes dropped EXE
PID:2376 -
\??\c:\1bhnbn.exec:\1bhnbn.exe24⤵
- Executes dropped EXE
PID:4184 -
\??\c:\pdddd.exec:\pdddd.exe25⤵
- Executes dropped EXE
PID:3588 -
\??\c:\dvvvv.exec:\dvvvv.exe26⤵
- Executes dropped EXE
PID:1016 -
\??\c:\lrxrxxx.exec:\lrxrxxx.exe27⤵
- Executes dropped EXE
PID:540 -
\??\c:\rlxfxxl.exec:\rlxfxxl.exe28⤵
- Executes dropped EXE
PID:3664 -
\??\c:\ttbnnn.exec:\ttbnnn.exe29⤵
- Executes dropped EXE
PID:3692 -
\??\c:\bbhhnh.exec:\bbhhnh.exe30⤵
- Executes dropped EXE
PID:2168 -
\??\c:\5ppjd.exec:\5ppjd.exe31⤵
- Executes dropped EXE
PID:4424 -
\??\c:\vvvdp.exec:\vvvdp.exe32⤵
- Executes dropped EXE
PID:412 -
\??\c:\llxxllx.exec:\llxxllx.exe33⤵
- Executes dropped EXE
PID:4796 -
\??\c:\lllrrxf.exec:\lllrrxf.exe34⤵
- Executes dropped EXE
PID:2324 -
\??\c:\5hntnt.exec:\5hntnt.exe35⤵
- Executes dropped EXE
PID:4608 -
\??\c:\nhbtnn.exec:\nhbtnn.exe36⤵
- Executes dropped EXE
PID:2468 -
\??\c:\bhnhhh.exec:\bhnhhh.exe37⤵
- Executes dropped EXE
PID:3516 -
\??\c:\5dppv.exec:\5dppv.exe38⤵
- Executes dropped EXE
PID:2328 -
\??\c:\5pddd.exec:\5pddd.exe39⤵
- Executes dropped EXE
PID:2492 -
\??\c:\rfrfxxx.exec:\rfrfxxx.exe40⤵
- Executes dropped EXE
PID:1072 -
\??\c:\lxfffll.exec:\lxfffll.exe41⤵
- Executes dropped EXE
PID:3892 -
\??\c:\1flllll.exec:\1flllll.exe42⤵
- Executes dropped EXE
PID:4528 -
\??\c:\bnnnnn.exec:\bnnnnn.exe43⤵
- Executes dropped EXE
PID:3152 -
\??\c:\ntbtnn.exec:\ntbtnn.exe44⤵
- Executes dropped EXE
PID:4920 -
\??\c:\vvjpv.exec:\vvjpv.exe45⤵
- Executes dropped EXE
PID:2380 -
\??\c:\pjjjj.exec:\pjjjj.exe46⤵
- Executes dropped EXE
PID:4600 -
\??\c:\lxrlfrr.exec:\lxrlfrr.exe47⤵
- Executes dropped EXE
PID:4804 -
\??\c:\lxlrxfx.exec:\lxlrxfx.exe48⤵
- Executes dropped EXE
PID:1432 -
\??\c:\5hbtnh.exec:\5hbtnh.exe49⤵
- Executes dropped EXE
PID:2572 -
\??\c:\hbnhnn.exec:\hbnhnn.exe50⤵
- Executes dropped EXE
PID:4948 -
\??\c:\nhhthh.exec:\nhhthh.exe51⤵
- Executes dropped EXE
PID:2176 -
\??\c:\3djjd.exec:\3djjd.exe52⤵
- Executes dropped EXE
PID:2956 -
\??\c:\vjvpv.exec:\vjvpv.exe53⤵
- Executes dropped EXE
PID:1104 -
\??\c:\rrrllrl.exec:\rrrllrl.exe54⤵
- Executes dropped EXE
PID:4192 -
\??\c:\1rrrlrr.exec:\1rrrlrr.exe55⤵
- Executes dropped EXE
PID:3932 -
\??\c:\thhbtt.exec:\thhbtt.exe56⤵
- Executes dropped EXE
PID:4660 -
\??\c:\5bbtnn.exec:\5bbtnn.exe57⤵
- Executes dropped EXE
PID:1344 -
\??\c:\7bbthh.exec:\7bbthh.exe58⤵
- Executes dropped EXE
PID:4312 -
\??\c:\jpjjd.exec:\jpjjd.exe59⤵
- Executes dropped EXE
PID:3100 -
\??\c:\pjpdv.exec:\pjpdv.exe60⤵
- Executes dropped EXE
PID:3156 -
\??\c:\xrrrlll.exec:\xrrrlll.exe61⤵
- Executes dropped EXE
PID:4864 -
\??\c:\rrffrrf.exec:\rrffrrf.exe62⤵
- Executes dropped EXE
PID:1056 -
\??\c:\bhnhtt.exec:\bhnhtt.exe63⤵
- Executes dropped EXE
PID:1208 -
\??\c:\bnnnbt.exec:\bnnnbt.exe64⤵
- Executes dropped EXE
PID:3552 -
\??\c:\jjjpj.exec:\jjjpj.exe65⤵
- Executes dropped EXE
PID:4736 -
\??\c:\vpjjv.exec:\vpjjv.exe66⤵PID:2228
-
\??\c:\9fllffx.exec:\9fllffx.exe67⤵PID:2504
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe68⤵PID:3428
-
\??\c:\nhbbbt.exec:\nhbbbt.exe69⤵PID:2896
-
\??\c:\ppjvd.exec:\ppjvd.exe70⤵PID:4020
-
\??\c:\vpjjv.exec:\vpjjv.exe71⤵PID:2252
-
\??\c:\7xffxrl.exec:\7xffxrl.exe72⤵PID:468
-
\??\c:\1lllfll.exec:\1lllfll.exe73⤵PID:4732
-
\??\c:\7flfxff.exec:\7flfxff.exe74⤵PID:4604
-
\??\c:\bbnnnb.exec:\bbnnnb.exe75⤵PID:1644
-
\??\c:\5bbtnn.exec:\5bbtnn.exe76⤵PID:5016
-
\??\c:\jjdjj.exec:\jjdjj.exe77⤵PID:1676
-
\??\c:\ppjjv.exec:\ppjjv.exe78⤵PID:1508
-
\??\c:\xxfxrrr.exec:\xxfxrrr.exe79⤵PID:3920
-
\??\c:\1rffxff.exec:\1rffxff.exe80⤵PID:1016
-
\??\c:\rfxxxxx.exec:\rfxxxxx.exe81⤵PID:2148
-
\??\c:\tnnnnt.exec:\tnnnnt.exe82⤵PID:4916
-
\??\c:\jjjdj.exec:\jjjdj.exe83⤵PID:4240
-
\??\c:\jjddv.exec:\jjddv.exe84⤵PID:2460
-
\??\c:\xxllxxl.exec:\xxllxxl.exe85⤵PID:2168
-
\??\c:\llfllxf.exec:\llfllxf.exe86⤵PID:3476
-
\??\c:\btnbtb.exec:\btnbtb.exe87⤵PID:3904
-
\??\c:\vdjdd.exec:\vdjdd.exe88⤵PID:1584
-
\??\c:\vpvvp.exec:\vpvvp.exe89⤵PID:2968
-
\??\c:\rflrxxr.exec:\rflrxxr.exe90⤵PID:948
-
\??\c:\1hnnnt.exec:\1hnnnt.exe91⤵PID:3584
-
\??\c:\3ntbtt.exec:\3ntbtt.exe92⤵PID:1452
-
\??\c:\vpppj.exec:\vpppj.exe93⤵PID:2184
-
\??\c:\7jjjd.exec:\7jjjd.exe94⤵PID:856
-
\??\c:\7lrrlll.exec:\7lrrlll.exe95⤵PID:2540
-
\??\c:\llxxllr.exec:\llxxllr.exe96⤵PID:2492
-
\??\c:\lrffxxx.exec:\lrffxxx.exe97⤵PID:3472
-
\??\c:\dpjjj.exec:\dpjjj.exe98⤵PID:4844
-
\??\c:\rrrrxfr.exec:\rrrrxfr.exe99⤵PID:1788
-
\??\c:\jpdpd.exec:\jpdpd.exe100⤵PID:2924
-
\??\c:\flrxxxf.exec:\flrxxxf.exe101⤵PID:3032
-
\??\c:\hntttt.exec:\hntttt.exe102⤵PID:4612
-
\??\c:\9djjj.exec:\9djjj.exe103⤵PID:4432
-
\??\c:\lrxxlrx.exec:\lrxxlrx.exe104⤵PID:4592
-
\??\c:\7bhnnt.exec:\7bhnnt.exe105⤵PID:4532
-
\??\c:\jppjd.exec:\jppjd.exe106⤵PID:4600
-
\??\c:\jvjvv.exec:\jvjvv.exe107⤵PID:4804
-
\??\c:\3ttnhh.exec:\3ttnhh.exe108⤵PID:1564
-
\??\c:\nhnnhh.exec:\nhnnhh.exe109⤵PID:2572
-
\??\c:\ppjdp.exec:\ppjdp.exe110⤵PID:4200
-
\??\c:\djvjv.exec:\djvjv.exe111⤵PID:912
-
\??\c:\djjdv.exec:\djjdv.exe112⤵PID:4740
-
\??\c:\jjpjv.exec:\jjpjv.exe113⤵PID:1920
-
\??\c:\3bhbnn.exec:\3bhbnn.exe114⤵PID:1652
-
\??\c:\httttt.exec:\httttt.exe115⤵PID:4012
-
\??\c:\xrllxfr.exec:\xrllxfr.exe116⤵PID:1344
-
\??\c:\vpjdj.exec:\vpjdj.exe117⤵PID:1168
-
\??\c:\vppdp.exec:\vppdp.exe118⤵PID:3100
-
\??\c:\lxfrxlr.exec:\lxfrxlr.exe119⤵PID:2612
-
\??\c:\pjjdj.exec:\pjjdj.exe120⤵PID:1648
-
\??\c:\nbhtnb.exec:\nbhtnb.exe121⤵PID:2412
-
\??\c:\nthhtt.exec:\nthhtt.exe122⤵PID:456
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-