Analysis
- max time kernel
150s - max time network
106s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
19/06/2024, 22:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
140fff1bdb290d66fb2f7d719b21f9b2075e6f4ebd57a785e37fae784bf79a23_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
- Target 140fff1bdb290d66fb2f7d719b21f9b2075e6f4ebd57a785e37fae784bf79a23_NeikiAnalytics.exe
- Size 123KB
- Sample240619-2vda8avhqa
- SHA256 140fff1bdb290d66fb2f7d719b21f9b2075e6f4ebd57a785e37fae784bf79a23
- MD5 18daf81eb861ae86c90aed56697397e0
- SHA1 715dd79be0d7bf0c6e93bee3216c5ab9c62e5490
- SHA512 e38e7c9307b80d027d040eac3820b218c2b1dd78804a5b80fa62625eb8efae92533237c87455987d7a5d3a984f93f6bb1869545765dcffe013d0dee723321e61
- SSDEEP 3072:ymb3NkkiQ3mdBjFo7LAIRUohDLSULrCimBaH8UH30w0Y+:n3C9BRo/AIuunSppaH8m3Dd+
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/4040-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2388-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1060-26-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1060-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/964-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/928-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2468-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1312-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3736-71-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2636-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2968-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4656-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1536-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1220-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/492-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4216-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1640-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2548-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2084-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3520-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 2388 hnnhnn.exe 1804 1jjdp.exe 1060 flfxrrr.exe 964 xfllfff.exe 928 ppjdv.exe 2468 fllllrx.exe 1312 fxxrllf.exe 3752 3ntnhb.exe 3736 dvvvp.exe 2636 9vvdv.exe 848 nhhbbh.exe 4092 jdvpj.exe 2968 5djdj.exe 4080 xrrllff.exe 4656 nhnnhh.exe 220 1pvpj.exe 1536 pjppj.exe 4420 xllrlll.exe 1220 7ffxxrr.exe 492 nhthnh.exe 116 vvpjj.exe 1928 rlxrlfl.exe 4216 lffxrrr.exe 4368 3bhhnn.exe 1048 vppjv.exe 5036 5jjdv.exe 1640 xllfffx.exe 4752 nbhtbt.exe 2548 nhhbnn.exe 2084 djjjj.exe 3520 pdvpj.exe 4800 rlfxllf.exe 1988 hbtntt.exe 2776 vdpjd.exe 4592 pdvjv.exe 4928 xxrfxll.exe 2352 nhbtnh.exe 2344 tnnbnn.exe 2700 dvjdd.exe 3084 1jjdv.exe 2972 fxffxll.exe 4296 3rrrrrr.exe 3228 httthh.exe 2376 ppvpj.exe 1232 xrrlrrx.exe 3636 nbtnhb.exe 1756 1bbthh.exe 2760 ppjdp.exe 2532 lfrllff.exe 4744 rlffxxr.exe 1572 bnnhbb.exe 768 nhtnbb.exe 4364 1jjdp.exe 4756 pjjdd.exe 3592 lfflxfx.exe 4660 llxxrrl.exe 4888 tbbnhb.exe 2152 bhbbnn.exe 2372 9vvjd.exe 4420 pppdv.exe 2536 lxrflfx.exe 208 xrrlrrl.exe 492 tbthbt.exe 3876 btnhtn.exe -
resource yara_rule behavioral2/memory/4040-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1060-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/964-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/928-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2468-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1312-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2636-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2636-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2636-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1536-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1220-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/492-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4216-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1640-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2548-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2084-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3520-207-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4040 wrote to memory of 2388 4040 140fff1bdb290d66fb2f7d719b21f9b2075e6f4ebd57a785e37fae784bf79a23_NeikiAnalytics.exe 82 PID 4040 wrote to memory of 2388 4040 140fff1bdb290d66fb2f7d719b21f9b2075e6f4ebd57a785e37fae784bf79a23_NeikiAnalytics.exe 82 PID 4040 wrote to memory of 2388 4040 140fff1bdb290d66fb2f7d719b21f9b2075e6f4ebd57a785e37fae784bf79a23_NeikiAnalytics.exe 82 PID 2388 wrote to memory of 1804 2388 hnnhnn.exe 83 PID 2388 wrote to memory of 1804 2388 hnnhnn.exe 83 PID 2388 wrote to memory of 1804 2388 hnnhnn.exe 83 PID 1804 wrote to memory of 1060 1804 1jjdp.exe 84 PID 1804 wrote to memory of 1060 1804 1jjdp.exe 84 PID 1804 wrote to memory of 1060 1804 1jjdp.exe 84 PID 1060 wrote to memory of 964 1060 flfxrrr.exe 85 PID 1060 wrote to memory of 964 1060 flfxrrr.exe 85 PID 1060 wrote to memory of 964 1060 flfxrrr.exe 85 PID 964 wrote to memory of 928 964 xfllfff.exe 86 PID 964 wrote to memory of 928 964 xfllfff.exe 86 PID 964 wrote to memory of 928 964 xfllfff.exe 86 PID 928 wrote to memory of 2468 928 ppjdv.exe 87 PID 928 wrote to memory of 2468 928 ppjdv.exe 87 PID 928 wrote to memory of 2468 928 ppjdv.exe 87 PID 2468 wrote to memory of 1312 2468 fllllrx.exe 88 PID 2468 wrote to memory of 1312 2468 fllllrx.exe 88 PID 2468 wrote to memory of 1312 2468 fllllrx.exe 88 PID 1312 wrote to memory of 3752 1312 fxxrllf.exe 89 PID 1312 wrote to memory of 3752 1312 fxxrllf.exe 89 PID 1312 wrote to memory of 3752 1312 fxxrllf.exe 89 PID 3752 wrote to memory of 3736 3752 3ntnhb.exe 90 PID 3752 wrote to memory of 3736 3752 3ntnhb.exe 90 PID 3752 wrote to memory of 3736 3752 3ntnhb.exe 90 PID 3736 wrote to memory of 2636 3736 dvvvp.exe 91 PID 3736 wrote to memory of 2636 3736 dvvvp.exe 91 PID 3736 wrote to memory of 2636 3736 dvvvp.exe 91 PID 2636 wrote to memory of 848 2636 9vvdv.exe 92 PID 2636 wrote to memory of 848 2636 9vvdv.exe 92 PID 2636 wrote to memory of 848 2636 9vvdv.exe 92 PID 848 wrote to memory of 4092 848 nhhbbh.exe 94 PID 848 wrote to memory of 4092 848 nhhbbh.exe 94 PID 848 wrote to memory of 4092 848 nhhbbh.exe 94 PID 4092 wrote to memory of 2968 4092 jdvpj.exe 95 PID 4092 wrote to memory of 2968 4092 jdvpj.exe 95 PID 4092 wrote to memory of 2968 4092 jdvpj.exe 95 PID 2968 wrote to memory of 4080 2968 5djdj.exe 96 PID 2968 wrote to memory of 4080 2968 5djdj.exe 96 PID 2968 wrote to memory of 4080 2968 5djdj.exe 96 PID 4080 wrote to memory of 4656 4080 xrrllff.exe 97 PID 4080 wrote to memory of 4656 4080 xrrllff.exe 97 PID 4080 wrote to memory of 4656 4080 xrrllff.exe 97 PID 4656 wrote to memory of 220 4656 nhnnhh.exe 98 PID 4656 wrote to memory of 220 4656 nhnnhh.exe 98 PID 4656 wrote to memory of 220 4656 nhnnhh.exe 98 PID 220 wrote to memory of 1536 220 1pvpj.exe 99 PID 220 wrote to memory of 1536 220 1pvpj.exe 99 PID 220 wrote to memory of 1536 220 1pvpj.exe 99 PID 1536 wrote to memory of 4420 1536 pjppj.exe 100 PID 1536 wrote to memory of 4420 1536 pjppj.exe 100 PID 1536 wrote to memory of 4420 1536 pjppj.exe 100 PID 4420 wrote to memory of 1220 4420 xllrlll.exe 101 PID 4420 wrote to memory of 1220 4420 xllrlll.exe 101 PID 4420 wrote to memory of 1220 4420 xllrlll.exe 101 PID 1220 wrote to memory of 492 1220 7ffxxrr.exe 103 PID 1220 wrote to memory of 492 1220 7ffxxrr.exe 103 PID 1220 wrote to memory of 492 1220 7ffxxrr.exe 103 PID 492 wrote to memory of 116 492 nhthnh.exe 104 PID 492 wrote to memory of 116 492 nhthnh.exe 104 PID 492 wrote to memory of 116 492 nhthnh.exe 104 PID 116 wrote to memory of 1928 116 vvpjj.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\140fff1bdb290d66fb2f7d719b21f9b2075e6f4ebd57a785e37fae784bf79a23_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\140fff1bdb290d66fb2f7d719b21f9b2075e6f4ebd57a785e37fae784bf79a23_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\hnnhnn.exec:\hnnhnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\1jjdp.exec:\1jjdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\flfxrrr.exec:\flfxrrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\xfllfff.exec:\xfllfff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\ppjdv.exec:\ppjdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
\??\c:\fllllrx.exec:\fllllrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\fxxrllf.exec:\fxxrllf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\3ntnhb.exec:\3ntnhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\dvvvp.exec:\dvvvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
\??\c:\9vvdv.exec:\9vvdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\nhhbbh.exec:\nhhbbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\jdvpj.exec:\jdvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\5djdj.exec:\5djdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\xrrllff.exec:\xrrllff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\nhnnhh.exec:\nhnnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\1pvpj.exec:\1pvpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\pjppj.exec:\pjppj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\xllrlll.exec:\xllrlll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\7ffxxrr.exec:\7ffxxrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\nhthnh.exec:\nhthnh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:492 -
\??\c:\vvpjj.exec:\vvpjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\rlxrlfl.exec:\rlxrlfl.exe23⤵
- Executes dropped EXE
PID:1928 -
\??\c:\lffxrrr.exec:\lffxrrr.exe24⤵
- Executes dropped EXE
PID:4216 -
\??\c:\3bhhnn.exec:\3bhhnn.exe25⤵
- Executes dropped EXE
PID:4368 -
\??\c:\vppjv.exec:\vppjv.exe26⤵
- Executes dropped EXE
PID:1048 -
\??\c:\5jjdv.exec:\5jjdv.exe27⤵
- Executes dropped EXE
PID:5036 -
\??\c:\xllfffx.exec:\xllfffx.exe28⤵
- Executes dropped EXE
PID:1640 -
\??\c:\nbhtbt.exec:\nbhtbt.exe29⤵
- Executes dropped EXE
PID:4752 -
\??\c:\nhhbnn.exec:\nhhbnn.exe30⤵
- Executes dropped EXE
PID:2548 -
\??\c:\djjjj.exec:\djjjj.exe31⤵
- Executes dropped EXE
PID:2084 -
\??\c:\pdvpj.exec:\pdvpj.exe32⤵
- Executes dropped EXE
PID:3520 -
\??\c:\rlfxllf.exec:\rlfxllf.exe33⤵
- Executes dropped EXE
PID:4800 -
\??\c:\hbtntt.exec:\hbtntt.exe34⤵
- Executes dropped EXE
PID:1988 -
\??\c:\vdpjd.exec:\vdpjd.exe35⤵
- Executes dropped EXE
PID:2776 -
\??\c:\pdvjv.exec:\pdvjv.exe36⤵
- Executes dropped EXE
PID:4592 -
\??\c:\xxrfxll.exec:\xxrfxll.exe37⤵
- Executes dropped EXE
PID:4928 -
\??\c:\nhbtnh.exec:\nhbtnh.exe38⤵
- Executes dropped EXE
PID:2352 -
\??\c:\tnnbnn.exec:\tnnbnn.exe39⤵
- Executes dropped EXE
PID:2344 -
\??\c:\dvjdd.exec:\dvjdd.exe40⤵
- Executes dropped EXE
PID:2700 -
\??\c:\1jjdv.exec:\1jjdv.exe41⤵
- Executes dropped EXE
PID:3084 -
\??\c:\fxffxll.exec:\fxffxll.exe42⤵
- Executes dropped EXE
PID:2972 -
\??\c:\3rrrrrr.exec:\3rrrrrr.exe43⤵
- Executes dropped EXE
PID:4296 -
\??\c:\httthh.exec:\httthh.exe44⤵
- Executes dropped EXE
PID:3228 -
\??\c:\ppvpj.exec:\ppvpj.exe45⤵
- Executes dropped EXE
PID:2376 -
\??\c:\xrrlrrx.exec:\xrrlrrx.exe46⤵
- Executes dropped EXE
PID:1232 -
\??\c:\nbtnhb.exec:\nbtnhb.exe47⤵
- Executes dropped EXE
PID:3636 -
\??\c:\1bbthh.exec:\1bbthh.exe48⤵
- Executes dropped EXE
PID:1756 -
\??\c:\ppjdp.exec:\ppjdp.exe49⤵
- Executes dropped EXE
PID:2760 -
\??\c:\lfrllff.exec:\lfrllff.exe50⤵
- Executes dropped EXE
PID:2532 -
\??\c:\rlffxxr.exec:\rlffxxr.exe51⤵
- Executes dropped EXE
PID:4744 -
\??\c:\bnnhbb.exec:\bnnhbb.exe52⤵
- Executes dropped EXE
PID:1572 -
\??\c:\nhtnbb.exec:\nhtnbb.exe53⤵
- Executes dropped EXE
PID:768 -
\??\c:\1jjdp.exec:\1jjdp.exe54⤵
- Executes dropped EXE
PID:4364 -
\??\c:\pjjdd.exec:\pjjdd.exe55⤵
- Executes dropped EXE
PID:4756 -
\??\c:\lfflxfx.exec:\lfflxfx.exe56⤵
- Executes dropped EXE
PID:3592 -
\??\c:\llxxrrl.exec:\llxxrrl.exe57⤵
- Executes dropped EXE
PID:4660 -
\??\c:\tbbnhb.exec:\tbbnhb.exe58⤵
- Executes dropped EXE
PID:4888 -
\??\c:\bhbbnn.exec:\bhbbnn.exe59⤵
- Executes dropped EXE
PID:2152 -
\??\c:\9vvjd.exec:\9vvjd.exe60⤵
- Executes dropped EXE
PID:2372 -
\??\c:\pppdv.exec:\pppdv.exe61⤵
- Executes dropped EXE
PID:4420 -
\??\c:\lxrflfx.exec:\lxrflfx.exe62⤵
- Executes dropped EXE
PID:2536 -
\??\c:\xrrlrrl.exec:\xrrlrrl.exe63⤵
- Executes dropped EXE
PID:208 -
\??\c:\tbthbt.exec:\tbthbt.exe64⤵
- Executes dropped EXE
PID:492 -
\??\c:\btnhtn.exec:\btnhtn.exe65⤵
- Executes dropped EXE
PID:3876 -
\??\c:\9pvjv.exec:\9pvjv.exe66⤵PID:2336
-
\??\c:\9ddjp.exec:\9ddjp.exe67⤵PID:2148
-
\??\c:\lrlfrlf.exec:\lrlfrlf.exe68⤵PID:4216
-
\??\c:\fllfrrf.exec:\fllfrrf.exe69⤵PID:4112
-
\??\c:\hbtnnt.exec:\hbtnnt.exe70⤵PID:980
-
\??\c:\1bthtt.exec:\1bthtt.exe71⤵PID:1872
-
\??\c:\vjjvj.exec:\vjjvj.exe72⤵PID:2508
-
\??\c:\pjpdv.exec:\pjpdv.exe73⤵PID:5076
-
\??\c:\7lxxfrf.exec:\7lxxfrf.exe74⤵PID:1704
-
\??\c:\flxlxrl.exec:\flxlxrl.exe75⤵PID:4856
-
\??\c:\9tbtbt.exec:\9tbtbt.exe76⤵PID:4464
-
\??\c:\bttntb.exec:\bttntb.exe77⤵PID:2756
-
\??\c:\jvjjj.exec:\jvjjj.exe78⤵PID:4316
-
\??\c:\pdvjj.exec:\pdvjj.exe79⤵PID:4276
-
\??\c:\lxxlxrf.exec:\lxxlxrf.exe80⤵PID:5052
-
\??\c:\xrxrffr.exec:\xrxrffr.exe81⤵PID:3376
-
\??\c:\thnhtn.exec:\thnhtn.exe82⤵PID:3956
-
\??\c:\vjvjp.exec:\vjvjp.exe83⤵PID:3948
-
\??\c:\3pdvv.exec:\3pdvv.exe84⤵PID:4128
-
\??\c:\5xxlfrr.exec:\5xxlfrr.exe85⤵PID:4340
-
\??\c:\fxfxfxl.exec:\fxfxfxl.exe86⤵PID:1128
-
\??\c:\nbtbnt.exec:\nbtbnt.exe87⤵PID:4056
-
\??\c:\3tnbnt.exec:\3tnbnt.exe88⤵PID:1060
-
\??\c:\jvdpd.exec:\jvdpd.exe89⤵PID:2524
-
\??\c:\pjdvd.exec:\pjdvd.exe90⤵PID:2816
-
\??\c:\rlrlrlf.exec:\rlrlrlf.exe91⤵PID:4272
-
\??\c:\1hhbnh.exec:\1hhbnh.exe92⤵PID:3228
-
\??\c:\hhhbhb.exec:\hhhbhb.exe93⤵PID:2664
-
\??\c:\ddvvv.exec:\ddvvv.exe94⤵PID:1232
-
\??\c:\flffrlr.exec:\flffrlr.exe95⤵PID:3636
-
\??\c:\fflffxl.exec:\fflffxl.exe96⤵PID:1492
-
\??\c:\bhtnhb.exec:\bhtnhb.exe97⤵PID:1396
-
\??\c:\jpjdj.exec:\jpjdj.exe98⤵PID:1844
-
\??\c:\rrlffrx.exec:\rrlffrx.exe99⤵PID:4076
-
\??\c:\nttnbt.exec:\nttnbt.exe100⤵PID:1572
-
\??\c:\thbnbt.exec:\thbnbt.exe101⤵PID:768
-
\??\c:\7jdpd.exec:\7jdpd.exe102⤵PID:1348
-
\??\c:\rxfrllf.exec:\rxfrllf.exe103⤵PID:4756
-
\??\c:\7lfrfxl.exec:\7lfrfxl.exe104⤵PID:4864
-
\??\c:\tnhbtn.exec:\tnhbtn.exe105⤵PID:1580
-
\??\c:\ttnhnh.exec:\ttnhnh.exe106⤵PID:1416
-
\??\c:\3vpjp.exec:\3vpjp.exe107⤵PID:2228
-
\??\c:\vvvjv.exec:\vvvjv.exe108⤵PID:1884
-
\??\c:\rlrlxrl.exec:\rlrlxrl.exe109⤵PID:4972
-
\??\c:\llflrlx.exec:\llflrlx.exe110⤵PID:3788
-
\??\c:\nbthnb.exec:\nbthnb.exe111⤵PID:1372
-
\??\c:\vjdvv.exec:\vjdvv.exe112⤵PID:2908
-
\??\c:\pppdp.exec:\pppdp.exe113⤵PID:5024
-
\??\c:\pdpdj.exec:\pdpdj.exe114⤵PID:4712
-
\??\c:\frflfrf.exec:\frflfrf.exe115⤵PID:4740
-
\??\c:\xxxlxxl.exec:\xxxlxxl.exe116⤵PID:4552
-
\??\c:\9tnttt.exec:\9tnttt.exe117⤵PID:3236
-
\??\c:\jpjpp.exec:\jpjpp.exe118⤵PID:5012
-
\??\c:\frxlfff.exec:\frxlfff.exe119⤵PID:1300
-
\??\c:\7hbbtn.exec:\7hbbtn.exe120⤵PID:4588
-
\??\c:\hhhhth.exec:\hhhhth.exe121⤵PID:2080
-
\??\c:\1dvpd.exec:\1dvpd.exe122⤵PID:2988
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-