Analysis
-
max time kernel
150s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2024 21:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
057896b0f30d41dffa75ed43f6d705c0_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
057896b0f30d41dffa75ed43f6d705c0_NeikiAnalytics.exe
-
Size
97KB
-
MD5
057896b0f30d41dffa75ed43f6d705c0
-
SHA1
6112cae62d31a700cb740fd6141024a1f16dcca7
-
SHA256
a5d605a6b1a15743a8e046db4c9686dc60972d130af93c9191ebc7360345140b
-
SHA512
4f3907e8308fc9ab6cc4698b521b24e459c2858a3446ab49fc13f3765cee5f7dfd8fe51ead891e802a458d42936e327e998554099aacd58716184c7c6db3869c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDInWeNCYGyA2R7JxJAg8dta:ymb3NkkiQ3mdBjFIWeFGyAsJAg2a
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/1264-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2724-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2584-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1068-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1704-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3324-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3324-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3516-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2988-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3584-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1624-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1676-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1668-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4972-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3988-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3376-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2912-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2216-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3056-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2644-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/844-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2556-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3708-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2724 hnhbtn.exe 2584 xrlfllf.exe 1068 tbtnhh.exe 1704 nttnbb.exe 4936 jdjdv.exe 3324 xfrxlxx.exe 3516 bbhhtt.exe 2988 tnnhtn.exe 3584 dpdvv.exe 1668 jpvpd.exe 4656 ffxrxfl.exe 1624 xflfffx.exe 1676 hhnnhb.exe 4624 ppjjj.exe 5052 xrxrrrf.exe 2488 bbbttt.exe 4972 thnhnb.exe 3988 jjpdv.exe 4036 vvjpj.exe 3376 xrlfrrl.exe 1240 bnttnn.exe 2912 dvpjv.exe 2216 rfxfxrl.exe 2932 nbhhbn.exe 3056 btbttt.exe 2644 vjdvp.exe 844 xfrfxrf.exe 2556 btbttt.exe 3708 nhtnhh.exe 836 vpjdv.exe 2660 xlrrfxr.exe 2408 thhnbt.exe 1072 vvvpd.exe 1748 vdjvj.exe 424 lxfrllx.exe 3280 3lxrllf.exe 4640 htbbhb.exe 4232 nttnhb.exe 4884 5jjjv.exe 4164 jdvpd.exe 2252 frlfrrl.exe 868 tnbbtt.exe 1804 nntnhn.exe 1428 vpvvp.exe 232 pvvpp.exe 2500 ffllfxr.exe 920 llllfll.exe 3488 ttbhhh.exe 2272 hbhhbb.exe 4592 pdjjp.exe 4484 ppddv.exe 2988 lxlllff.exe 5104 lffffrr.exe 2292 rrrrlll.exe 2396 ttnhhh.exe 4656 9ppjd.exe 1064 1jppj.exe 2504 flxrflr.exe 4348 ffllllf.exe 4172 hhhhhh.exe 4100 9nnhbh.exe 4184 pjjpp.exe 4596 5vjjv.exe 812 lrffxrr.exe -
resource yara_rule behavioral2/memory/1264-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2724-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2584-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1068-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3324-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3324-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3516-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2988-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3584-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1624-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1676-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1668-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3988-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3376-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2912-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2216-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3056-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2644-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/844-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2556-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3708-192-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1264 wrote to memory of 2724 1264 057896b0f30d41dffa75ed43f6d705c0_NeikiAnalytics.exe 82 PID 1264 wrote to memory of 2724 1264 057896b0f30d41dffa75ed43f6d705c0_NeikiAnalytics.exe 82 PID 1264 wrote to memory of 2724 1264 057896b0f30d41dffa75ed43f6d705c0_NeikiAnalytics.exe 82 PID 2724 wrote to memory of 2584 2724 hnhbtn.exe 83 PID 2724 wrote to memory of 2584 2724 hnhbtn.exe 83 PID 2724 wrote to memory of 2584 2724 hnhbtn.exe 83 PID 2584 wrote to memory of 1068 2584 xrlfllf.exe 84 PID 2584 wrote to memory of 1068 2584 xrlfllf.exe 84 PID 2584 wrote to memory of 1068 2584 xrlfllf.exe 84 PID 1068 wrote to memory of 1704 1068 tbtnhh.exe 85 PID 1068 wrote to memory of 1704 1068 tbtnhh.exe 85 PID 1068 wrote to memory of 1704 1068 tbtnhh.exe 85 PID 1704 wrote to memory of 4936 1704 nttnbb.exe 86 PID 1704 wrote to memory of 4936 1704 nttnbb.exe 86 PID 1704 wrote to memory of 4936 1704 nttnbb.exe 86 PID 4936 wrote to memory of 3324 4936 jdjdv.exe 87 PID 4936 wrote to memory of 3324 4936 jdjdv.exe 87 PID 4936 wrote to memory of 3324 4936 jdjdv.exe 87 PID 3324 wrote to memory of 3516 3324 xfrxlxx.exe 88 PID 3324 wrote to memory of 3516 3324 xfrxlxx.exe 88 PID 3324 wrote to memory of 3516 3324 xfrxlxx.exe 88 PID 3516 wrote to memory of 2988 3516 bbhhtt.exe 89 PID 3516 wrote to memory of 2988 3516 bbhhtt.exe 89 PID 3516 wrote to memory of 2988 3516 bbhhtt.exe 89 PID 2988 wrote to memory of 3584 2988 tnnhtn.exe 91 PID 2988 wrote to memory of 3584 2988 tnnhtn.exe 91 PID 2988 wrote to memory of 3584 2988 tnnhtn.exe 91 PID 3584 wrote to memory of 1668 3584 dpdvv.exe 92 PID 3584 wrote to memory of 1668 3584 dpdvv.exe 92 PID 3584 wrote to memory of 1668 3584 dpdvv.exe 92 PID 1668 wrote to memory of 4656 1668 jpvpd.exe 93 PID 1668 wrote to memory of 4656 1668 jpvpd.exe 93 PID 1668 wrote to memory of 4656 1668 jpvpd.exe 93 PID 4656 wrote to memory of 1624 4656 ffxrxfl.exe 94 PID 4656 wrote to memory of 1624 4656 ffxrxfl.exe 94 PID 4656 wrote to memory of 1624 4656 ffxrxfl.exe 94 PID 1624 wrote to memory of 1676 1624 xflfffx.exe 95 PID 1624 wrote to memory of 1676 1624 xflfffx.exe 95 PID 1624 wrote to memory of 1676 1624 xflfffx.exe 95 PID 1676 wrote to memory of 4624 1676 hhnnhb.exe 97 PID 1676 wrote to memory of 4624 1676 hhnnhb.exe 97 PID 1676 wrote to memory of 4624 1676 hhnnhb.exe 97 PID 4624 wrote to memory of 5052 4624 ppjjj.exe 98 PID 4624 wrote to memory of 5052 4624 ppjjj.exe 98 PID 4624 wrote to memory of 5052 4624 ppjjj.exe 98 PID 5052 wrote to memory of 2488 5052 xrxrrrf.exe 99 PID 5052 wrote to memory of 2488 5052 xrxrrrf.exe 99 PID 5052 wrote to memory of 2488 5052 xrxrrrf.exe 99 PID 2488 wrote to memory of 4972 2488 bbbttt.exe 100 PID 2488 wrote to memory of 4972 2488 bbbttt.exe 100 PID 2488 wrote to memory of 4972 2488 bbbttt.exe 100 PID 4972 wrote to memory of 3988 4972 thnhnb.exe 102 PID 4972 wrote to memory of 3988 4972 thnhnb.exe 102 PID 4972 wrote to memory of 3988 4972 thnhnb.exe 102 PID 3988 wrote to memory of 4036 3988 jjpdv.exe 103 PID 3988 wrote to memory of 4036 3988 jjpdv.exe 103 PID 3988 wrote to memory of 4036 3988 jjpdv.exe 103 PID 4036 wrote to memory of 3376 4036 vvjpj.exe 104 PID 4036 wrote to memory of 3376 4036 vvjpj.exe 104 PID 4036 wrote to memory of 3376 4036 vvjpj.exe 104 PID 3376 wrote to memory of 1240 3376 xrlfrrl.exe 105 PID 3376 wrote to memory of 1240 3376 xrlfrrl.exe 105 PID 3376 wrote to memory of 1240 3376 xrlfrrl.exe 105 PID 1240 wrote to memory of 2912 1240 bnttnn.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\057896b0f30d41dffa75ed43f6d705c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\057896b0f30d41dffa75ed43f6d705c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\hnhbtn.exec:\hnhbtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\xrlfllf.exec:\xrlfllf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\tbtnhh.exec:\tbtnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\nttnbb.exec:\nttnbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\jdjdv.exec:\jdjdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\xfrxlxx.exec:\xfrxlxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
\??\c:\bbhhtt.exec:\bbhhtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\tnnhtn.exec:\tnnhtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\dpdvv.exec:\dpdvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\jpvpd.exec:\jpvpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\ffxrxfl.exec:\ffxrxfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\xflfffx.exec:\xflfffx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\hhnnhb.exec:\hhnnhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\ppjjj.exec:\ppjjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\xrxrrrf.exec:\xrxrrrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\bbbttt.exec:\bbbttt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\thnhnb.exec:\thnhnb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\jjpdv.exec:\jjpdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\vvjpj.exec:\vvjpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\xrlfrrl.exec:\xrlfrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
\??\c:\bnttnn.exec:\bnttnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\dvpjv.exec:\dvpjv.exe23⤵
- Executes dropped EXE
PID:2912 -
\??\c:\rfxfxrl.exec:\rfxfxrl.exe24⤵
- Executes dropped EXE
PID:2216 -
\??\c:\nbhhbn.exec:\nbhhbn.exe25⤵
- Executes dropped EXE
PID:2932 -
\??\c:\btbttt.exec:\btbttt.exe26⤵
- Executes dropped EXE
PID:3056 -
\??\c:\vjdvp.exec:\vjdvp.exe27⤵
- Executes dropped EXE
PID:2644 -
\??\c:\xfrfxrf.exec:\xfrfxrf.exe28⤵
- Executes dropped EXE
PID:844 -
\??\c:\btbttt.exec:\btbttt.exe29⤵
- Executes dropped EXE
PID:2556 -
\??\c:\nhtnhh.exec:\nhtnhh.exe30⤵
- Executes dropped EXE
PID:3708 -
\??\c:\vpjdv.exec:\vpjdv.exe31⤵
- Executes dropped EXE
PID:836 -
\??\c:\xlrrfxr.exec:\xlrrfxr.exe32⤵
- Executes dropped EXE
PID:2660 -
\??\c:\thhnbt.exec:\thhnbt.exe33⤵
- Executes dropped EXE
PID:2408 -
\??\c:\vvvpd.exec:\vvvpd.exe34⤵
- Executes dropped EXE
PID:1072 -
\??\c:\vdjvj.exec:\vdjvj.exe35⤵
- Executes dropped EXE
PID:1748 -
\??\c:\lxfrllx.exec:\lxfrllx.exe36⤵
- Executes dropped EXE
PID:424 -
\??\c:\3lxrllf.exec:\3lxrllf.exe37⤵
- Executes dropped EXE
PID:3280 -
\??\c:\htbbhb.exec:\htbbhb.exe38⤵
- Executes dropped EXE
PID:4640 -
\??\c:\nttnhb.exec:\nttnhb.exe39⤵
- Executes dropped EXE
PID:4232 -
\??\c:\5jjjv.exec:\5jjjv.exe40⤵
- Executes dropped EXE
PID:4884 -
\??\c:\jdvpd.exec:\jdvpd.exe41⤵
- Executes dropped EXE
PID:4164 -
\??\c:\frlfrrl.exec:\frlfrrl.exe42⤵
- Executes dropped EXE
PID:2252 -
\??\c:\tnbbtt.exec:\tnbbtt.exe43⤵
- Executes dropped EXE
PID:868 -
\??\c:\nntnhn.exec:\nntnhn.exe44⤵
- Executes dropped EXE
PID:1804 -
\??\c:\vpvvp.exec:\vpvvp.exe45⤵
- Executes dropped EXE
PID:1428 -
\??\c:\pvvpp.exec:\pvvpp.exe46⤵
- Executes dropped EXE
PID:232 -
\??\c:\ffllfxr.exec:\ffllfxr.exe47⤵
- Executes dropped EXE
PID:2500 -
\??\c:\llllfll.exec:\llllfll.exe48⤵
- Executes dropped EXE
PID:920 -
\??\c:\ttbhhh.exec:\ttbhhh.exe49⤵
- Executes dropped EXE
PID:3488 -
\??\c:\hbhhbb.exec:\hbhhbb.exe50⤵
- Executes dropped EXE
PID:2272 -
\??\c:\pdjjp.exec:\pdjjp.exe51⤵
- Executes dropped EXE
PID:4592 -
\??\c:\ppddv.exec:\ppddv.exe52⤵
- Executes dropped EXE
PID:4484 -
\??\c:\lxlllff.exec:\lxlllff.exe53⤵
- Executes dropped EXE
PID:2988 -
\??\c:\lffffrr.exec:\lffffrr.exe54⤵
- Executes dropped EXE
PID:5104 -
\??\c:\rrrrlll.exec:\rrrrlll.exe55⤵
- Executes dropped EXE
PID:2292 -
\??\c:\ttnhhh.exec:\ttnhhh.exe56⤵
- Executes dropped EXE
PID:2396 -
\??\c:\9ppjd.exec:\9ppjd.exe57⤵
- Executes dropped EXE
PID:4656 -
\??\c:\1jppj.exec:\1jppj.exe58⤵
- Executes dropped EXE
PID:1064 -
\??\c:\flxrflr.exec:\flxrflr.exe59⤵
- Executes dropped EXE
PID:2504 -
\??\c:\ffllllf.exec:\ffllllf.exe60⤵
- Executes dropped EXE
PID:4348 -
\??\c:\hhhhhh.exec:\hhhhhh.exe61⤵
- Executes dropped EXE
PID:4172 -
\??\c:\9nnhbh.exec:\9nnhbh.exe62⤵
- Executes dropped EXE
PID:4100 -
\??\c:\pjjpp.exec:\pjjpp.exe63⤵
- Executes dropped EXE
PID:4184 -
\??\c:\5vjjv.exec:\5vjjv.exe64⤵
- Executes dropped EXE
PID:4596 -
\??\c:\lrffxrr.exec:\lrffxrr.exe65⤵
- Executes dropped EXE
PID:812 -
\??\c:\xfrrrxx.exec:\xfrrrxx.exe66⤵PID:2076
-
\??\c:\hthhhb.exec:\hthhhb.exe67⤵PID:1728
-
\??\c:\hnnhbb.exec:\hnnhbb.exe68⤵PID:3388
-
\??\c:\pvdvp.exec:\pvdvp.exe69⤵PID:4036
-
\??\c:\9jpvv.exec:\9jpvv.exe70⤵PID:3164
-
\??\c:\rxffxll.exec:\rxffxll.exe71⤵PID:1808
-
\??\c:\xxxfffr.exec:\xxxfffr.exe72⤵PID:3012
-
\??\c:\fflllrl.exec:\fflllrl.exe73⤵PID:524
-
\??\c:\hhhhbn.exec:\hhhhbn.exe74⤵PID:4156
-
\??\c:\hhbnnt.exec:\hhbnnt.exe75⤵PID:1556
-
\??\c:\1vppd.exec:\1vppd.exe76⤵PID:3696
-
\??\c:\jjjjp.exec:\jjjjp.exe77⤵PID:2704
-
\??\c:\9frrxxx.exec:\9frrxxx.exe78⤵PID:5004
-
\??\c:\ffxxlrl.exec:\ffxxlrl.exe79⤵PID:636
-
\??\c:\hbnnnb.exec:\hbnnnb.exe80⤵PID:3048
-
\??\c:\tntttt.exec:\tntttt.exe81⤵PID:4148
-
\??\c:\ddddj.exec:\ddddj.exe82⤵PID:3356
-
\??\c:\ppppp.exec:\ppppp.exe83⤵PID:2168
-
\??\c:\rxxrllf.exec:\rxxrllf.exe84⤵PID:3960
-
\??\c:\rrfxflr.exec:\rrfxflr.exe85⤵PID:4012
-
\??\c:\rrffxll.exec:\rrffxll.exe86⤵PID:1756
-
\??\c:\5hhbtt.exec:\5hhbtt.exe87⤵PID:4984
-
\??\c:\nnnhhh.exec:\nnnhhh.exe88⤵PID:1016
-
\??\c:\vvddj.exec:\vvddj.exe89⤵PID:2560
-
\??\c:\dvjpj.exec:\dvjpj.exe90⤵PID:1256
-
\??\c:\fxrlffr.exec:\fxrlffr.exe91⤵PID:2684
-
\??\c:\fxlrffr.exec:\fxlrffr.exe92⤵PID:3624
-
\??\c:\lxfffll.exec:\lxfffll.exe93⤵PID:1632
-
\??\c:\1bnnnn.exec:\1bnnnn.exe94⤵PID:1020
-
\??\c:\vvddd.exec:\vvddd.exe95⤵PID:1776
-
\??\c:\jpddd.exec:\jpddd.exe96⤵PID:3560
-
\??\c:\7pddj.exec:\7pddj.exe97⤵PID:552
-
\??\c:\9lllxff.exec:\9lllxff.exe98⤵PID:1228
-
\??\c:\7xlfllr.exec:\7xlfllr.exe99⤵PID:5080
-
\??\c:\3nbbtn.exec:\3nbbtn.exe100⤵PID:1176
-
\??\c:\tbhbtt.exec:\tbhbtt.exe101⤵PID:4936
-
\??\c:\vjjdd.exec:\vjjdd.exe102⤵PID:4508
-
\??\c:\pdddv.exec:\pdddv.exe103⤵PID:3608
-
\??\c:\lxxxxxx.exec:\lxxxxxx.exe104⤵PID:392
-
\??\c:\rfrxrxx.exec:\rfrxrxx.exe105⤵PID:4816
-
\??\c:\bthhth.exec:\bthhth.exe106⤵PID:2284
-
\??\c:\nbhbth.exec:\nbhbth.exe107⤵PID:1420
-
\??\c:\nnnnbh.exec:\nnnnbh.exe108⤵PID:4472
-
\??\c:\pjvdv.exec:\pjvdv.exe109⤵PID:2868
-
\??\c:\vvjjd.exec:\vvjjd.exe110⤵PID:4860
-
\??\c:\ffflfff.exec:\ffflfff.exe111⤵PID:884
-
\??\c:\xrrllrr.exec:\xrrllrr.exe112⤵PID:2208
-
\??\c:\bbbttt.exec:\bbbttt.exe113⤵PID:3184
-
\??\c:\tthtnt.exec:\tthtnt.exe114⤵PID:1972
-
\??\c:\nbhnnt.exec:\nbhnnt.exe115⤵PID:436
-
\??\c:\7vvjp.exec:\7vvjp.exe116⤵PID:1840
-
\??\c:\vjddd.exec:\vjddd.exe117⤵PID:2824
-
\??\c:\xrlrrrl.exec:\xrlrrrl.exe118⤵PID:1476
-
\??\c:\bttnhh.exec:\bttnhh.exe119⤵PID:2592
-
\??\c:\tntbbh.exec:\tntbbh.exe120⤵PID:1956
-
\??\c:\ppvvd.exec:\ppvvd.exe121⤵PID:3360
-
\??\c:\lflfxxr.exec:\lflfxxr.exe122⤵PID:4728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-