Analysis
- max time kernel
150s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 05:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2266b0bb2b83294c6f422304228a5130_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
- Target 2266b0bb2b83294c6f422304228a5130_NeikiAnalytics.exe
- Size 70KB
- Sample240612-ggprwascpm
- SHA256 ac113b1499608e6128b319e676e2f5e3394d252d7925076e1812c2da4e856547
- MD5 2266b0bb2b83294c6f422304228a5130
- SHA1 9b934ddb84c3c0915f8ca187c6dfa05a09aff54c
- SHA512 de28faca26346684ee38681be46eb283ce562111e9e6004c6a47f54f0be86d38c8932d4829e22b1ef292c0fd6752c7dbe105b1fa1fdf0eb00a7ea11f5dd1f4e3
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUwcsbYsRO:ymb3NkkiQ3mdBjF0yjcsMsRO
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/2596-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1088-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4576-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1924-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4732-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2324-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2996-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2876-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2172-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4728-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2124-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3808-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4632-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4612-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3924-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2944-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3540-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4056-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2780-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3304-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4060-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3080-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 1088 1vpdd.exe 4576 7fxlrrf.exe 1924 3bnnbb.exe 4732 hhhttb.exe 2324 jjdvp.exe 2996 xxrlxlx.exe 2876 hbthnh.exe 2172 ntnhbt.exe 4728 jvpdv.exe 3956 pdvjv.exe 2124 frlxfxl.exe 3808 ffxrffr.exe 4632 nhtnbt.exe 4612 nbnbhb.exe 3924 dvjvp.exe 3576 nbbhnb.exe 2944 bnbhhb.exe 3540 jdddp.exe 4464 pdjvd.exe 4056 frrrxrx.exe 2780 hhnbnh.exe 3304 htthtn.exe 3660 jdjdv.exe 624 7lfrxrf.exe 4060 thbnbt.exe 3248 9bnbbn.exe 3080 jvjjv.exe 4000 dpdpv.exe 3676 lfrxlxr.exe 4104 hnhnbt.exe 1672 bbtthb.exe 5016 9vpjp.exe 3544 rrlfxxr.exe 1928 htbtnh.exe 3100 pjjdv.exe 5088 1fxlfxl.exe 2820 7nttnn.exe 756 pvdvj.exe 1204 5rrflfl.exe 2460 frrfxrx.exe 1492 hnntnh.exe 432 nbbtnn.exe 4476 9hhbnn.exe 3000 pdjdd.exe 2596 ppvpd.exe 436 rlxrrrl.exe 1104 lffxrlf.exe 452 9bnnbb.exe 1616 tbhbtt.exe 964 vjdjp.exe 912 jjpjv.exe 736 7xxrfxr.exe 4648 1htnbt.exe 3792 hnbbnn.exe 2400 djpjd.exe 4728 vpvpp.exe 516 7lxlxrl.exe 1444 flrlllr.exe 4444 ttnnhh.exe 2952 bthbnh.exe 4284 3ddpj.exe 4136 vvdpj.exe 4448 flrlfff.exe 5104 xrxfxlf.exe -
resource yara_rule behavioral2/memory/2596-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1088-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4576-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2324-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2996-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2876-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2876-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2172-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4728-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2124-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3808-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4632-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4612-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3924-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2944-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3540-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4056-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2780-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3304-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4060-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3080-179-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2596 wrote to memory of 1088 2596 2266b0bb2b83294c6f422304228a5130_NeikiAnalytics.exe 79 PID 2596 wrote to memory of 1088 2596 2266b0bb2b83294c6f422304228a5130_NeikiAnalytics.exe 79 PID 2596 wrote to memory of 1088 2596 2266b0bb2b83294c6f422304228a5130_NeikiAnalytics.exe 79 PID 1088 wrote to memory of 4576 1088 1vpdd.exe 80 PID 1088 wrote to memory of 4576 1088 1vpdd.exe 80 PID 1088 wrote to memory of 4576 1088 1vpdd.exe 80 PID 4576 wrote to memory of 1924 4576 7fxlrrf.exe 81 PID 4576 wrote to memory of 1924 4576 7fxlrrf.exe 81 PID 4576 wrote to memory of 1924 4576 7fxlrrf.exe 81 PID 1924 wrote to memory of 4732 1924 3bnnbb.exe 82 PID 1924 wrote to memory of 4732 1924 3bnnbb.exe 82 PID 1924 wrote to memory of 4732 1924 3bnnbb.exe 82 PID 4732 wrote to memory of 2324 4732 hhhttb.exe 83 PID 4732 wrote to memory of 2324 4732 hhhttb.exe 83 PID 4732 wrote to memory of 2324 4732 hhhttb.exe 83 PID 2324 wrote to memory of 2996 2324 jjdvp.exe 84 PID 2324 wrote to memory of 2996 2324 jjdvp.exe 84 PID 2324 wrote to memory of 2996 2324 jjdvp.exe 84 PID 2996 wrote to memory of 2876 2996 xxrlxlx.exe 85 PID 2996 wrote to memory of 2876 2996 xxrlxlx.exe 85 PID 2996 wrote to memory of 2876 2996 xxrlxlx.exe 85 PID 2876 wrote to memory of 2172 2876 hbthnh.exe 87 PID 2876 wrote to memory of 2172 2876 hbthnh.exe 87 PID 2876 wrote to memory of 2172 2876 hbthnh.exe 87 PID 2172 wrote to memory of 4728 2172 ntnhbt.exe 88 PID 2172 wrote to memory of 4728 2172 ntnhbt.exe 88 PID 2172 wrote to memory of 4728 2172 ntnhbt.exe 88 PID 4728 wrote to memory of 3956 4728 jvpdv.exe 89 PID 4728 wrote to memory of 3956 4728 jvpdv.exe 89 PID 4728 wrote to memory of 3956 4728 jvpdv.exe 89 PID 3956 wrote to memory of 2124 3956 pdvjv.exe 90 PID 3956 wrote to memory of 2124 3956 pdvjv.exe 90 PID 3956 wrote to memory of 2124 3956 pdvjv.exe 90 PID 2124 wrote to memory of 3808 2124 frlxfxl.exe 91 PID 2124 wrote to memory of 3808 2124 frlxfxl.exe 91 PID 2124 wrote to memory of 3808 2124 frlxfxl.exe 91 PID 3808 wrote to memory of 4632 3808 ffxrffr.exe 92 PID 3808 wrote to memory of 4632 3808 ffxrffr.exe 92 PID 3808 wrote to memory of 4632 3808 ffxrffr.exe 92 PID 4632 wrote to memory of 4612 4632 nhtnbt.exe 93 PID 4632 wrote to memory of 4612 4632 nhtnbt.exe 93 PID 4632 wrote to memory of 4612 4632 nhtnbt.exe 93 PID 4612 wrote to memory of 3924 4612 nbnbhb.exe 94 PID 4612 wrote to memory of 3924 4612 nbnbhb.exe 94 PID 4612 wrote to memory of 3924 4612 nbnbhb.exe 94 PID 3924 wrote to memory of 3576 3924 dvjvp.exe 95 PID 3924 wrote to memory of 3576 3924 dvjvp.exe 95 PID 3924 wrote to memory of 3576 3924 dvjvp.exe 95 PID 3576 wrote to memory of 2944 3576 nbbhnb.exe 96 PID 3576 wrote to memory of 2944 3576 nbbhnb.exe 96 PID 3576 wrote to memory of 2944 3576 nbbhnb.exe 96 PID 2944 wrote to memory of 3540 2944 bnbhhb.exe 98 PID 2944 wrote to memory of 3540 2944 bnbhhb.exe 98 PID 2944 wrote to memory of 3540 2944 bnbhhb.exe 98 PID 3540 wrote to memory of 4464 3540 jdddp.exe 99 PID 3540 wrote to memory of 4464 3540 jdddp.exe 99 PID 3540 wrote to memory of 4464 3540 jdddp.exe 99 PID 4464 wrote to memory of 4056 4464 pdjvd.exe 100 PID 4464 wrote to memory of 4056 4464 pdjvd.exe 100 PID 4464 wrote to memory of 4056 4464 pdjvd.exe 100 PID 4056 wrote to memory of 2780 4056 frrrxrx.exe 101 PID 4056 wrote to memory of 2780 4056 frrrxrx.exe 101 PID 4056 wrote to memory of 2780 4056 frrrxrx.exe 101 PID 2780 wrote to memory of 3304 2780 hhnbnh.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2266b0bb2b83294c6f422304228a5130_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2266b0bb2b83294c6f422304228a5130_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\1vpdd.exec:\1vpdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\7fxlrrf.exec:\7fxlrrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\3bnnbb.exec:\3bnnbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\hhhttb.exec:\hhhttb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\jjdvp.exec:\jjdvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\xxrlxlx.exec:\xxrlxlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\hbthnh.exec:\hbthnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\ntnhbt.exec:\ntnhbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\jvpdv.exec:\jvpdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\pdvjv.exec:\pdvjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\frlxfxl.exec:\frlxfxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\ffxrffr.exec:\ffxrffr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\nhtnbt.exec:\nhtnbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\nbnbhb.exec:\nbnbhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\dvjvp.exec:\dvjvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\nbbhnb.exec:\nbbhnb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\bnbhhb.exec:\bnbhhb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\jdddp.exec:\jdddp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\pdjvd.exec:\pdjvd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\frrrxrx.exec:\frrrxrx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\hhnbnh.exec:\hhnbnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\htthtn.exec:\htthtn.exe23⤵
- Executes dropped EXE
PID:3304 -
\??\c:\jdjdv.exec:\jdjdv.exe24⤵
- Executes dropped EXE
PID:3660 -
\??\c:\7lfrxrf.exec:\7lfrxrf.exe25⤵
- Executes dropped EXE
PID:624 -
\??\c:\thbnbt.exec:\thbnbt.exe26⤵
- Executes dropped EXE
PID:4060 -
\??\c:\9bnbbn.exec:\9bnbbn.exe27⤵
- Executes dropped EXE
PID:3248 -
\??\c:\jvjjv.exec:\jvjjv.exe28⤵
- Executes dropped EXE
PID:3080 -
\??\c:\dpdpv.exec:\dpdpv.exe29⤵
- Executes dropped EXE
PID:4000 -
\??\c:\lfrxlxr.exec:\lfrxlxr.exe30⤵
- Executes dropped EXE
PID:3676 -
\??\c:\hnhnbt.exec:\hnhnbt.exe31⤵
- Executes dropped EXE
PID:4104 -
\??\c:\bbtthb.exec:\bbtthb.exe32⤵
- Executes dropped EXE
PID:1672 -
\??\c:\9vpjp.exec:\9vpjp.exe33⤵
- Executes dropped EXE
PID:5016 -
\??\c:\rrlfxxr.exec:\rrlfxxr.exe34⤵
- Executes dropped EXE
PID:3544 -
\??\c:\htbtnh.exec:\htbtnh.exe35⤵
- Executes dropped EXE
PID:1928 -
\??\c:\pjjdv.exec:\pjjdv.exe36⤵
- Executes dropped EXE
PID:3100 -
\??\c:\1fxlfxl.exec:\1fxlfxl.exe37⤵
- Executes dropped EXE
PID:5088 -
\??\c:\7nttnn.exec:\7nttnn.exe38⤵
- Executes dropped EXE
PID:2820 -
\??\c:\pvdvj.exec:\pvdvj.exe39⤵
- Executes dropped EXE
PID:756 -
\??\c:\5rrflfl.exec:\5rrflfl.exe40⤵
- Executes dropped EXE
PID:1204 -
\??\c:\frrfxrx.exec:\frrfxrx.exe41⤵
- Executes dropped EXE
PID:2460 -
\??\c:\hnntnh.exec:\hnntnh.exe42⤵
- Executes dropped EXE
PID:1492 -
\??\c:\nbbtnn.exec:\nbbtnn.exe43⤵
- Executes dropped EXE
PID:432 -
\??\c:\9hhbnn.exec:\9hhbnn.exe44⤵
- Executes dropped EXE
PID:4476 -
\??\c:\pdjdd.exec:\pdjdd.exe45⤵
- Executes dropped EXE
PID:3000 -
\??\c:\ppvpd.exec:\ppvpd.exe46⤵
- Executes dropped EXE
PID:2596 -
\??\c:\rlxrrrl.exec:\rlxrrrl.exe47⤵
- Executes dropped EXE
PID:436 -
\??\c:\lffxrlf.exec:\lffxrlf.exe48⤵
- Executes dropped EXE
PID:1104 -
\??\c:\9bnnbb.exec:\9bnnbb.exe49⤵
- Executes dropped EXE
PID:452 -
\??\c:\tbhbtt.exec:\tbhbtt.exe50⤵
- Executes dropped EXE
PID:1616 -
\??\c:\vjdjp.exec:\vjdjp.exe51⤵
- Executes dropped EXE
PID:964 -
\??\c:\jjpjv.exec:\jjpjv.exe52⤵
- Executes dropped EXE
PID:912 -
\??\c:\7xxrfxr.exec:\7xxrfxr.exe53⤵
- Executes dropped EXE
PID:736 -
\??\c:\1htnbt.exec:\1htnbt.exe54⤵
- Executes dropped EXE
PID:4648 -
\??\c:\hnbbnn.exec:\hnbbnn.exe55⤵
- Executes dropped EXE
PID:3792 -
\??\c:\djpjd.exec:\djpjd.exe56⤵
- Executes dropped EXE
PID:2400 -
\??\c:\vpvpp.exec:\vpvpp.exe57⤵
- Executes dropped EXE
PID:4728 -
\??\c:\7lxlxrl.exec:\7lxlxrl.exe58⤵
- Executes dropped EXE
PID:516 -
\??\c:\flrlllr.exec:\flrlllr.exe59⤵
- Executes dropped EXE
PID:1444 -
\??\c:\ttnnhh.exec:\ttnnhh.exe60⤵
- Executes dropped EXE
PID:4444 -
\??\c:\bthbnh.exec:\bthbnh.exe61⤵
- Executes dropped EXE
PID:2952 -
\??\c:\3ddpj.exec:\3ddpj.exe62⤵
- Executes dropped EXE
PID:4284 -
\??\c:\vvdpj.exec:\vvdpj.exe63⤵
- Executes dropped EXE
PID:4136 -
\??\c:\flrlfff.exec:\flrlfff.exe64⤵
- Executes dropped EXE
PID:4448 -
\??\c:\xrxfxlf.exec:\xrxfxlf.exe65⤵
- Executes dropped EXE
PID:5104 -
\??\c:\9nnhhh.exec:\9nnhhh.exe66⤵PID:3208
-
\??\c:\nhbthh.exec:\nhbthh.exe67⤵PID:4924
-
\??\c:\vdjjd.exec:\vdjjd.exe68⤵PID:4952
-
\??\c:\7jdvp.exec:\7jdvp.exe69⤵PID:4856
-
\??\c:\lrxrffx.exec:\lrxrffx.exe70⤵PID:2312
-
\??\c:\lffffrr.exec:\lffffrr.exe71⤵PID:4056
-
\??\c:\thnhbb.exec:\thnhbb.exe72⤵PID:3944
-
\??\c:\nhbthh.exec:\nhbthh.exe73⤵PID:2532
-
\??\c:\vvpjp.exec:\vvpjp.exe74⤵PID:2540
-
\??\c:\fxlfffx.exec:\fxlfffx.exe75⤵PID:2988
-
\??\c:\3ttttn.exec:\3ttttn.exe76⤵PID:3016
-
\??\c:\hntnbb.exec:\hntnbb.exe77⤵PID:624
-
\??\c:\pddvp.exec:\pddvp.exe78⤵PID:3180
-
\??\c:\vvdvv.exec:\vvdvv.exe79⤵PID:628
-
\??\c:\xrrlxxr.exec:\xrrlxxr.exe80⤵PID:1552
-
\??\c:\bnhhbb.exec:\bnhhbb.exe81⤵PID:5080
-
\??\c:\bbbthh.exec:\bbbthh.exe82⤵PID:4000
-
\??\c:\dpvpj.exec:\dpvpj.exe83⤵PID:1948
-
\??\c:\vjppp.exec:\vjppp.exe84⤵PID:4848
-
\??\c:\vjjdv.exec:\vjjdv.exe85⤵PID:868
-
\??\c:\rrrlffx.exec:\rrrlffx.exe86⤵PID:4652
-
\??\c:\htttnb.exec:\htttnb.exe87⤵PID:3020
-
\??\c:\htbhhb.exec:\htbhhb.exe88⤵PID:4912
-
\??\c:\7dpjj.exec:\7dpjj.exe89⤵PID:1928
-
\??\c:\vvjjv.exec:\vvjjv.exe90⤵PID:1696
-
\??\c:\vdppp.exec:\vdppp.exe91⤵PID:2000
-
\??\c:\frrlflf.exec:\frrlflf.exe92⤵PID:2820
-
\??\c:\frllxxr.exec:\frllxxr.exe93⤵PID:756
-
\??\c:\tbhnhn.exec:\tbhnhn.exe94⤵PID:4304
-
\??\c:\jjpvp.exec:\jjpvp.exe95⤵PID:228
-
\??\c:\1vdpd.exec:\1vdpd.exe96⤵PID:4336
-
\??\c:\xrxrffx.exec:\xrxrffx.exe97⤵PID:2252
-
\??\c:\fxfxrfx.exec:\fxfxrfx.exe98⤵PID:1156
-
\??\c:\9tttnb.exec:\9tttnb.exe99⤵PID:660
-
\??\c:\jdvpj.exec:\jdvpj.exe100⤵PID:3608
-
\??\c:\5vvvp.exec:\5vvvp.exe101⤵PID:4380
-
\??\c:\lfxxllf.exec:\lfxxllf.exe102⤵PID:412
-
\??\c:\rxxflxf.exec:\rxxflxf.exe103⤵PID:4732
-
\??\c:\tnnhhh.exec:\tnnhhh.exe104⤵PID:4928
-
\??\c:\tbtnht.exec:\tbtnht.exe105⤵PID:1636
-
\??\c:\vdjdp.exec:\vdjdp.exe106⤵PID:4940
-
\??\c:\pvddd.exec:\pvddd.exe107⤵PID:5000
-
\??\c:\lxxrffx.exec:\lxxrffx.exe108⤵PID:1356
-
\??\c:\3nbbhh.exec:\3nbbhh.exe109⤵PID:2236
-
\??\c:\3bbthh.exec:\3bbthh.exe110⤵PID:4052
-
\??\c:\jjpjj.exec:\jjpjj.exe111⤵PID:3336
-
\??\c:\vpvpp.exec:\vpvpp.exe112⤵PID:2276
-
\??\c:\jdjjj.exec:\jdjjj.exe113⤵PID:2124
-
\??\c:\lxxxrrr.exec:\lxxxrrr.exe114⤵PID:1704
-
\??\c:\rllrllf.exec:\rllrllf.exe115⤵PID:4432
-
\??\c:\9ttbth.exec:\9ttbth.exe116⤵PID:2304
-
\??\c:\hbhbtt.exec:\hbhbtt.exe117⤵PID:1964
-
\??\c:\ddjjj.exec:\ddjjj.exe118⤵PID:3752
-
\??\c:\fxrlxxr.exec:\fxrlxxr.exe119⤵PID:4016
-
\??\c:\llfffff.exec:\llfffff.exe120⤵PID:2292
-
\??\c:\tnnhbb.exec:\tnnhbb.exe121⤵PID:3540
-
\??\c:\tntntn.exec:\tntntn.exe122⤵PID:2492
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-