Analysis
- max time kernel
150s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
22/06/2024, 01:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
77c15f722e2293a0529c836107d2400a960e2547f2abc599c77dc733dece1f11_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
- Target 77c15f722e2293a0529c836107d2400a960e2547f2abc599c77dc733dece1f11_NeikiAnalytics.exe
- Size 87KB
- Sample240622-cchesasbnb
- SHA256 77c15f722e2293a0529c836107d2400a960e2547f2abc599c77dc733dece1f11
- MD5 a5ab250b5494f2bce7c3deb5f9b891f0
- SHA1 7b4ab7d326be62f376c96dd7bae6b9ada0afdbc7
- SHA512 3540b4e652b5facb912d003ff1ed8b0d3208efe1b61733b371238cd9813b14ecd80a599e9f39c74a71c52fe8045ca76d2d3db7b509c3f552937da0748e7de67d
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2iJvRirE0DmmdL2jqWkH:ymb3NkkiQ3mdBjF+3TU2iBRioSumWW
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/2472-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1764-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4376-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3820-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2904-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4700-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4604-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1612-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2540-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/224-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4392-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4584-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5040-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3572-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1584-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2476-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1636-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/812-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1860-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2848-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 1764 nthhbb.exe 4376 jjppd.exe 3820 dppjd.exe 2904 xrrrllr.exe 4700 tttnhb.exe 4604 ppvdp.exe 4004 fxrllfx.exe 1612 bbtnnn.exe 2540 jjpvp.exe 224 xrflrfl.exe 1576 lfrrlxx.exe 4392 pdjjd.exe 4584 vvpjj.exe 5040 fxrrllf.exe 400 bhnnhh.exe 3572 7jvvp.exe 1584 pddjd.exe 4180 lffxffx.exe 2476 9bhbbt.exe 1532 3vpdj.exe 5060 9frxrxr.exe 808 3xfrxrf.exe 4828 7tnhtn.exe 1636 3ppdv.exe 5036 lrfxlfr.exe 4384 ffxlfrl.exe 812 tththb.exe 1860 1vpdv.exe 1448 dppdd.exe 2848 xfxrllr.exe 3608 thnbtt.exe 1396 hhnhnb.exe 2584 3dpdj.exe 1280 jppjd.exe 4948 xlrfrfr.exe 4120 nnnbbt.exe 2312 thbntn.exe 4412 vdvdp.exe 2440 3ppjp.exe 2596 1llflfr.exe 3432 9fxxxxr.exe 4420 btnhbb.exe 4272 jjvjv.exe 1768 rflxlff.exe 4512 bhhbtt.exe 2576 thhhbt.exe 912 3jjdj.exe 3200 jvjdv.exe 4640 jjppj.exe 4392 xrrlffx.exe 1016 lfrlrrx.exe 3384 hnhnhh.exe 4992 bttnbb.exe 4312 jppjd.exe 1244 vjjpd.exe 1648 rfrlffx.exe 3428 xlrlfxr.exe 2476 3nbttt.exe 3148 nbnhnn.exe 4068 vjjdv.exe 4664 vvvvp.exe 2392 jddvp.exe 3260 xrrllll.exe 3028 xxlffxr.exe -
resource yara_rule behavioral2/memory/2472-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4376-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3820-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2904-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4700-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1612-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1612-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1612-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2540-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4392-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5040-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1584-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2476-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1636-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/812-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1860-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2848-201-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2472 wrote to memory of 1764 2472 77c15f722e2293a0529c836107d2400a960e2547f2abc599c77dc733dece1f11_NeikiAnalytics.exe 90 PID 2472 wrote to memory of 1764 2472 77c15f722e2293a0529c836107d2400a960e2547f2abc599c77dc733dece1f11_NeikiAnalytics.exe 90 PID 2472 wrote to memory of 1764 2472 77c15f722e2293a0529c836107d2400a960e2547f2abc599c77dc733dece1f11_NeikiAnalytics.exe 90 PID 1764 wrote to memory of 4376 1764 nthhbb.exe 91 PID 1764 wrote to memory of 4376 1764 nthhbb.exe 91 PID 1764 wrote to memory of 4376 1764 nthhbb.exe 91 PID 4376 wrote to memory of 3820 4376 jjppd.exe 92 PID 4376 wrote to memory of 3820 4376 jjppd.exe 92 PID 4376 wrote to memory of 3820 4376 jjppd.exe 92 PID 3820 wrote to memory of 2904 3820 dppjd.exe 93 PID 3820 wrote to memory of 2904 3820 dppjd.exe 93 PID 3820 wrote to memory of 2904 3820 dppjd.exe 93 PID 2904 wrote to memory of 4700 2904 xrrrllr.exe 94 PID 2904 wrote to memory of 4700 2904 xrrrllr.exe 94 PID 2904 wrote to memory of 4700 2904 xrrrllr.exe 94 PID 4700 wrote to memory of 4604 4700 tttnhb.exe 95 PID 4700 wrote to memory of 4604 4700 tttnhb.exe 95 PID 4700 wrote to memory of 4604 4700 tttnhb.exe 95 PID 4604 wrote to memory of 4004 4604 ppvdp.exe 96 PID 4604 wrote to memory of 4004 4604 ppvdp.exe 96 PID 4604 wrote to memory of 4004 4604 ppvdp.exe 96 PID 4004 wrote to memory of 1612 4004 fxrllfx.exe 97 PID 4004 wrote to memory of 1612 4004 fxrllfx.exe 97 PID 4004 wrote to memory of 1612 4004 fxrllfx.exe 97 PID 1612 wrote to memory of 2540 1612 bbtnnn.exe 98 PID 1612 wrote to memory of 2540 1612 bbtnnn.exe 98 PID 1612 wrote to memory of 2540 1612 bbtnnn.exe 98 PID 2540 wrote to memory of 224 2540 jjpvp.exe 99 PID 2540 wrote to memory of 224 2540 jjpvp.exe 99 PID 2540 wrote to memory of 224 2540 jjpvp.exe 99 PID 224 wrote to memory of 1576 224 xrflrfl.exe 100 PID 224 wrote to memory of 1576 224 xrflrfl.exe 100 PID 224 wrote to memory of 1576 224 xrflrfl.exe 100 PID 1576 wrote to memory of 4392 1576 lfrrlxx.exe 101 PID 1576 wrote to memory of 4392 1576 lfrrlxx.exe 101 PID 1576 wrote to memory of 4392 1576 lfrrlxx.exe 101 PID 4392 wrote to memory of 4584 4392 pdjjd.exe 102 PID 4392 wrote to memory of 4584 4392 pdjjd.exe 102 PID 4392 wrote to memory of 4584 4392 pdjjd.exe 102 PID 4584 wrote to memory of 5040 4584 vvpjj.exe 103 PID 4584 wrote to memory of 5040 4584 vvpjj.exe 103 PID 4584 wrote to memory of 5040 4584 vvpjj.exe 103 PID 5040 wrote to memory of 400 5040 fxrrllf.exe 105 PID 5040 wrote to memory of 400 5040 fxrrllf.exe 105 PID 5040 wrote to memory of 400 5040 fxrrllf.exe 105 PID 400 wrote to memory of 3572 400 bhnnhh.exe 106 PID 400 wrote to memory of 3572 400 bhnnhh.exe 106 PID 400 wrote to memory of 3572 400 bhnnhh.exe 106 PID 3572 wrote to memory of 1584 3572 7jvvp.exe 107 PID 3572 wrote to memory of 1584 3572 7jvvp.exe 107 PID 3572 wrote to memory of 1584 3572 7jvvp.exe 107 PID 1584 wrote to memory of 4180 1584 pddjd.exe 108 PID 1584 wrote to memory of 4180 1584 pddjd.exe 108 PID 1584 wrote to memory of 4180 1584 pddjd.exe 108 PID 4180 wrote to memory of 2476 4180 lffxffx.exe 110 PID 4180 wrote to memory of 2476 4180 lffxffx.exe 110 PID 4180 wrote to memory of 2476 4180 lffxffx.exe 110 PID 2476 wrote to memory of 1532 2476 9bhbbt.exe 111 PID 2476 wrote to memory of 1532 2476 9bhbbt.exe 111 PID 2476 wrote to memory of 1532 2476 9bhbbt.exe 111 PID 1532 wrote to memory of 5060 1532 3vpdj.exe 112 PID 1532 wrote to memory of 5060 1532 3vpdj.exe 112 PID 1532 wrote to memory of 5060 1532 3vpdj.exe 112 PID 5060 wrote to memory of 808 5060 9frxrxr.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\77c15f722e2293a0529c836107d2400a960e2547f2abc599c77dc733dece1f11_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\77c15f722e2293a0529c836107d2400a960e2547f2abc599c77dc733dece1f11_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\nthhbb.exec:\nthhbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\jjppd.exec:\jjppd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
\??\c:\dppjd.exec:\dppjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
\??\c:\xrrrllr.exec:\xrrrllr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\tttnhb.exec:\tttnhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\ppvdp.exec:\ppvdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\fxrllfx.exec:\fxrllfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\bbtnnn.exec:\bbtnnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\jjpvp.exec:\jjpvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\xrflrfl.exec:\xrflrfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\lfrrlxx.exec:\lfrrlxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\pdjjd.exec:\pdjjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
\??\c:\vvpjj.exec:\vvpjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\fxrrllf.exec:\fxrrllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\bhnnhh.exec:\bhnnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\7jvvp.exec:\7jvvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\pddjd.exec:\pddjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\lffxffx.exec:\lffxffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\9bhbbt.exec:\9bhbbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\3vpdj.exec:\3vpdj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\9frxrxr.exec:\9frxrxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\3xfrxrf.exec:\3xfrxrf.exe23⤵
- Executes dropped EXE
PID:808 -
\??\c:\7tnhtn.exec:\7tnhtn.exe24⤵
- Executes dropped EXE
PID:4828 -
\??\c:\3ppdv.exec:\3ppdv.exe25⤵
- Executes dropped EXE
PID:1636 -
\??\c:\lrfxlfr.exec:\lrfxlfr.exe26⤵
- Executes dropped EXE
PID:5036 -
\??\c:\ffxlfrl.exec:\ffxlfrl.exe27⤵
- Executes dropped EXE
PID:4384 -
\??\c:\tththb.exec:\tththb.exe28⤵
- Executes dropped EXE
PID:812 -
\??\c:\1vpdv.exec:\1vpdv.exe29⤵
- Executes dropped EXE
PID:1860 -
\??\c:\dppdd.exec:\dppdd.exe30⤵
- Executes dropped EXE
PID:1448 -
\??\c:\xfxrllr.exec:\xfxrllr.exe31⤵
- Executes dropped EXE
PID:2848 -
\??\c:\thnbtt.exec:\thnbtt.exe32⤵
- Executes dropped EXE
PID:3608 -
\??\c:\hhnhnb.exec:\hhnhnb.exe33⤵
- Executes dropped EXE
PID:1396 -
\??\c:\3dpdj.exec:\3dpdj.exe34⤵
- Executes dropped EXE
PID:2584 -
\??\c:\jppjd.exec:\jppjd.exe35⤵
- Executes dropped EXE
PID:1280 -
\??\c:\xlrfrfr.exec:\xlrfrfr.exe36⤵
- Executes dropped EXE
PID:4948 -
\??\c:\nnnbbt.exec:\nnnbbt.exe37⤵
- Executes dropped EXE
PID:4120 -
\??\c:\thbntn.exec:\thbntn.exe38⤵
- Executes dropped EXE
PID:2312 -
\??\c:\vdvdp.exec:\vdvdp.exe39⤵
- Executes dropped EXE
PID:4412 -
\??\c:\3ppjp.exec:\3ppjp.exe40⤵
- Executes dropped EXE
PID:2440 -
\??\c:\1llflfr.exec:\1llflfr.exe41⤵
- Executes dropped EXE
PID:2596 -
\??\c:\9fxxxxr.exec:\9fxxxxr.exe42⤵
- Executes dropped EXE
PID:3432 -
\??\c:\btnhbb.exec:\btnhbb.exe43⤵
- Executes dropped EXE
PID:4420 -
\??\c:\jjvjv.exec:\jjvjv.exe44⤵
- Executes dropped EXE
PID:4272 -
\??\c:\rflxlff.exec:\rflxlff.exe45⤵
- Executes dropped EXE
PID:1768 -
\??\c:\bhhbtt.exec:\bhhbtt.exe46⤵
- Executes dropped EXE
PID:4512 -
\??\c:\thhhbt.exec:\thhhbt.exe47⤵
- Executes dropped EXE
PID:2576 -
\??\c:\3jjdj.exec:\3jjdj.exe48⤵
- Executes dropped EXE
PID:912 -
\??\c:\jvjdv.exec:\jvjdv.exe49⤵
- Executes dropped EXE
PID:3200 -
\??\c:\jjppj.exec:\jjppj.exe50⤵
- Executes dropped EXE
PID:4640 -
\??\c:\xrrlffx.exec:\xrrlffx.exe51⤵
- Executes dropped EXE
PID:4392 -
\??\c:\lfrlrrx.exec:\lfrlrrx.exe52⤵
- Executes dropped EXE
PID:1016 -
\??\c:\hnhnhh.exec:\hnhnhh.exe53⤵
- Executes dropped EXE
PID:3384 -
\??\c:\bttnbb.exec:\bttnbb.exe54⤵
- Executes dropped EXE
PID:4992 -
\??\c:\jppjd.exec:\jppjd.exe55⤵
- Executes dropped EXE
PID:4312 -
\??\c:\vjjpd.exec:\vjjpd.exe56⤵
- Executes dropped EXE
PID:1244 -
\??\c:\rfrlffx.exec:\rfrlffx.exe57⤵
- Executes dropped EXE
PID:1648 -
\??\c:\xlrlfxr.exec:\xlrlfxr.exe58⤵
- Executes dropped EXE
PID:3428 -
\??\c:\3nbttt.exec:\3nbttt.exe59⤵
- Executes dropped EXE
PID:2476 -
\??\c:\nbnhnn.exec:\nbnhnn.exe60⤵
- Executes dropped EXE
PID:3148 -
\??\c:\vjjdv.exec:\vjjdv.exe61⤵
- Executes dropped EXE
PID:4068 -
\??\c:\vvvvp.exec:\vvvvp.exe62⤵
- Executes dropped EXE
PID:4664 -
\??\c:\jddvp.exec:\jddvp.exe63⤵
- Executes dropped EXE
PID:2392 -
\??\c:\xrrllll.exec:\xrrllll.exe64⤵
- Executes dropped EXE
PID:3260 -
\??\c:\xxlffxr.exec:\xxlffxr.exe65⤵
- Executes dropped EXE
PID:3028 -
\??\c:\tbbttt.exec:\tbbttt.exe66⤵PID:1636
-
\??\c:\nnhnhh.exec:\nnhnhh.exe67⤵PID:2300
-
\??\c:\vdddp.exec:\vdddp.exe68⤵PID:3228
-
\??\c:\pvjpv.exec:\pvjpv.exe69⤵PID:4432
-
\??\c:\lxrlxxr.exec:\lxrlxxr.exe70⤵PID:4236
-
\??\c:\hnttnn.exec:\hnttnn.exe71⤵PID:4156
-
\??\c:\3thbbb.exec:\3thbbb.exe72⤵PID:3996
-
\??\c:\httnbb.exec:\httnbb.exe73⤵PID:4888
-
\??\c:\djjdd.exec:\djjdd.exe74⤵PID:2988
-
\??\c:\5xxlffx.exec:\5xxlffx.exe75⤵PID:1420
-
\??\c:\5xxrlxx.exec:\5xxrlxx.exe76⤵PID:2584
-
\??\c:\1nhhhh.exec:\1nhhhh.exe77⤵PID:1132
-
\??\c:\5hnnbn.exec:\5hnnbn.exe78⤵PID:2860
-
\??\c:\vjddp.exec:\vjddp.exe79⤵PID:4928
-
\??\c:\rxxrlrl.exec:\rxxrlrl.exe80⤵PID:1616
-
\??\c:\dvvvp.exec:\dvvvp.exe81⤵PID:3204
-
\??\c:\fxrlffx.exec:\fxrlffx.exe82⤵PID:1516
-
\??\c:\rffxrlf.exec:\rffxrlf.exe83⤵PID:2816
-
\??\c:\tnthbb.exec:\tnthbb.exe84⤵PID:4940
-
\??\c:\bbtnhh.exec:\bbtnhh.exe85⤵PID:1568
-
\??\c:\vvvpj.exec:\vvvpj.exe86⤵PID:1760
-
\??\c:\rfffffx.exec:\rfffffx.exe87⤵PID:3492
-
\??\c:\rlllffx.exec:\rlllffx.exe88⤵PID:224
-
\??\c:\hbtthh.exec:\hbtthh.exe89⤵PID:3688
-
\??\c:\ttbtnn.exec:\ttbtnn.exe90⤵PID:3092
-
\??\c:\3vdvj.exec:\3vdvj.exe91⤵PID:732
-
\??\c:\5ppjd.exec:\5ppjd.exe92⤵PID:4584
-
\??\c:\3xfrrfx.exec:\3xfrrfx.exe93⤵PID:2824
-
\??\c:\rrrrrrl.exec:\rrrrrrl.exe94⤵PID:4812
-
\??\c:\bhhhnn.exec:\bhhhnn.exe95⤵PID:5052
-
\??\c:\nhhtnh.exec:\nhhtnh.exe96⤵PID:3408
-
\??\c:\jddpj.exec:\jddpj.exe97⤵PID:396
-
\??\c:\pjpjp.exec:\pjpjp.exe98⤵PID:2928
-
\??\c:\vdjpp.exec:\vdjpp.exe99⤵PID:4180
-
\??\c:\xlllxrr.exec:\xlllxrr.exe100⤵PID:1368
-
\??\c:\nhhnnn.exec:\nhhnnn.exe101⤵PID:3812
-
\??\c:\nbtnhb.exec:\nbtnhb.exe102⤵PID:2500
-
\??\c:\vpppj.exec:\vpppj.exe103⤵PID:4252
-
\??\c:\djpjd.exec:\djpjd.exe104⤵PID:4172
-
\??\c:\rrxxllf.exec:\rrxxllf.exe105⤵PID:3676
-
\??\c:\rlllfxr.exec:\rlllfxr.exe106⤵PID:4980
-
\??\c:\7tbtnn.exec:\7tbtnn.exe107⤵PID:2504
-
\??\c:\hhhntn.exec:\hhhntn.exe108⤵PID:4692
-
\??\c:\pjjdp.exec:\pjjdp.exe109⤵PID:4432
-
\??\c:\djpdd.exec:\djpdd.exe110⤵PID:4236
-
\??\c:\llfxllf.exec:\llfxllf.exe111⤵PID:4156
-
\??\c:\thnnhh.exec:\thnnhh.exe112⤵PID:4444
-
\??\c:\tnbhbb.exec:\tnbhbb.exe113⤵PID:3924
-
\??\c:\pjdvp.exec:\pjdvp.exe114⤵PID:2988
-
\??\c:\5pdvj.exec:\5pdvj.exe115⤵PID:1764
-
\??\c:\vpdvd.exec:\vpdvd.exe116⤵PID:4376
-
\??\c:\rlxrxrf.exec:\rlxrxrf.exe117⤵PID:4844
-
\??\c:\fflfxfx.exec:\fflfxfx.exe118⤵PID:2860
-
\??\c:\tnhbhh.exec:\tnhbhh.exe119⤵PID:4928
-
\??\c:\tnhtbt.exec:\tnhtbt.exe120⤵PID:2440
-
\??\c:\vpvpd.exec:\vpvpd.exe121⤵PID:2596
-
\??\c:\pvdvj.exec:\pvdvj.exe122⤵PID:5072
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-