Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/06/2024, 03:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4619606bc01fd6c0e01def9f244cec54fb3222b6898d7e74832dc63aea9a4ebb_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
4619606bc01fd6c0e01def9f244cec54fb3222b6898d7e74832dc63aea9a4ebb_NeikiAnalytics.exe
-
Size
134KB
-
MD5
df75f2f7b76e9d30b9ae01f960224a10
-
SHA1
b29ca4c0a88811c53424d23e9607a156c2acd460
-
SHA256
4619606bc01fd6c0e01def9f244cec54fb3222b6898d7e74832dc63aea9a4ebb
-
SHA512
8c19d0b62304fcea9862b374d86815d5393da7e0cc586f71e2eb4f835c6b39d28f8bec0951f9ec668f3d06ac1b48f5979391091fbd4d36ecb5c891db16b839fb
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afoHVpx+dGorp+:n3C9BRW0j/1px+dG8+
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2964-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2160-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/768-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/764-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1836-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/324-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1072-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1568-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/872-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1728-308-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2736 tnhhtt.exe 2628 nhtbnb.exe 2536 llxxllx.exe 2528 5bhbhh.exe 2160 vppvp.exe 2424 5xxfrrx.exe 2464 9tbhnt.exe 2660 dvpvj.exe 2608 dpddp.exe 2928 fxxrrrx.exe 768 bthntb.exe 2388 1bhhhn.exe 2140 dpdvv.exe 2932 dvjjv.exe 764 fxfxflx.exe 1584 fflrfxf.exe 2196 nhtbhh.exe 1836 pvpjv.exe 2656 5pddj.exe 324 lfrxffr.exe 1072 hthnnn.exe 1776 tnhtht.exe 1176 pjvjv.exe 1952 lflrrrf.exe 1100 xlrrfxx.exe 1568 nhtbnt.exe 2220 jvjjj.exe 2864 vpdvj.exe 1652 7llllrf.exe 872 nnnthb.exe 1728 nhtbnt.exe 2816 vjddp.exe 1500 xrrrlrf.exe 2556 lfflxxf.exe 2540 9tnbtt.exe 2828 5bhhnn.exe 3008 dvppd.exe 1312 jvjdv.exe 2528 7xrllrx.exe 2412 lfflllr.exe 2484 bnttbb.exe 2064 5thbhn.exe 1936 5vpjp.exe 2512 7dvjj.exe 2760 lllffxx.exe 2896 tththh.exe 1708 hbnntb.exe 1696 dvvvd.exe 2300 pdjjj.exe 2388 7frfllx.exe 2664 frlrxff.exe 1848 bnbhnn.exe 1588 hthbhb.exe 1888 pvppv.exe 1512 jdjjd.exe 2196 rlflxfl.exe 2396 9xllxrf.exe 2256 bthbnt.exe 788 hhbnnb.exe 540 dpvjd.exe 2924 rrlxxxf.exe 1120 thnnnh.exe 1268 tnhnhh.exe 696 vpvvd.exe -
resource yara_rule behavioral1/memory/2964-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2160-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2160-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2160-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/768-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/764-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1836-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/324-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1072-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1568-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/872-299-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1728-308-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2964 wrote to memory of 2736 2964 4619606bc01fd6c0e01def9f244cec54fb3222b6898d7e74832dc63aea9a4ebb_NeikiAnalytics.exe 28 PID 2964 wrote to memory of 2736 2964 4619606bc01fd6c0e01def9f244cec54fb3222b6898d7e74832dc63aea9a4ebb_NeikiAnalytics.exe 28 PID 2964 wrote to memory of 2736 2964 4619606bc01fd6c0e01def9f244cec54fb3222b6898d7e74832dc63aea9a4ebb_NeikiAnalytics.exe 28 PID 2964 wrote to memory of 2736 2964 4619606bc01fd6c0e01def9f244cec54fb3222b6898d7e74832dc63aea9a4ebb_NeikiAnalytics.exe 28 PID 2736 wrote to memory of 2628 2736 tnhhtt.exe 29 PID 2736 wrote to memory of 2628 2736 tnhhtt.exe 29 PID 2736 wrote to memory of 2628 2736 tnhhtt.exe 29 PID 2736 wrote to memory of 2628 2736 tnhhtt.exe 29 PID 2628 wrote to memory of 2536 2628 nhtbnb.exe 30 PID 2628 wrote to memory of 2536 2628 nhtbnb.exe 30 PID 2628 wrote to memory of 2536 2628 nhtbnb.exe 30 PID 2628 wrote to memory of 2536 2628 nhtbnb.exe 30 PID 2536 wrote to memory of 2528 2536 llxxllx.exe 31 PID 2536 wrote to memory of 2528 2536 llxxllx.exe 31 PID 2536 wrote to memory of 2528 2536 llxxllx.exe 31 PID 2536 wrote to memory of 2528 2536 llxxllx.exe 31 PID 2528 wrote to memory of 2160 2528 5bhbhh.exe 32 PID 2528 wrote to memory of 2160 2528 5bhbhh.exe 32 PID 2528 wrote to memory of 2160 2528 5bhbhh.exe 32 PID 2528 wrote to memory of 2160 2528 5bhbhh.exe 32 PID 2160 wrote to memory of 2424 2160 vppvp.exe 33 PID 2160 wrote to memory of 2424 2160 vppvp.exe 33 PID 2160 wrote to memory of 2424 2160 vppvp.exe 33 PID 2160 wrote to memory of 2424 2160 vppvp.exe 33 PID 2424 wrote to memory of 2464 2424 5xxfrrx.exe 34 PID 2424 wrote to memory of 2464 2424 5xxfrrx.exe 34 PID 2424 wrote to memory of 2464 2424 5xxfrrx.exe 34 PID 2424 wrote to memory of 2464 2424 5xxfrrx.exe 34 PID 2464 wrote to memory of 2660 2464 9tbhnt.exe 35 PID 2464 wrote to memory of 2660 2464 9tbhnt.exe 35 PID 2464 wrote to memory of 2660 2464 9tbhnt.exe 35 PID 2464 wrote to memory of 2660 2464 9tbhnt.exe 35 PID 2660 wrote to memory of 2608 2660 dvpvj.exe 36 PID 2660 wrote to memory of 2608 2660 dvpvj.exe 36 PID 2660 wrote to memory of 2608 2660 dvpvj.exe 36 PID 2660 wrote to memory of 2608 2660 dvpvj.exe 36 PID 2608 wrote to memory of 2928 2608 dpddp.exe 37 PID 2608 wrote to memory of 2928 2608 dpddp.exe 37 PID 2608 wrote to memory of 2928 2608 dpddp.exe 37 PID 2608 wrote to memory of 2928 2608 dpddp.exe 37 PID 2928 wrote to memory of 768 2928 fxxrrrx.exe 38 PID 2928 wrote to memory of 768 2928 fxxrrrx.exe 38 PID 2928 wrote to memory of 768 2928 fxxrrrx.exe 38 PID 2928 wrote to memory of 768 2928 fxxrrrx.exe 38 PID 768 wrote to memory of 2388 768 bthntb.exe 39 PID 768 wrote to memory of 2388 768 bthntb.exe 39 PID 768 wrote to memory of 2388 768 bthntb.exe 39 PID 768 wrote to memory of 2388 768 bthntb.exe 39 PID 2388 wrote to memory of 2140 2388 1bhhhn.exe 40 PID 2388 wrote to memory of 2140 2388 1bhhhn.exe 40 PID 2388 wrote to memory of 2140 2388 1bhhhn.exe 40 PID 2388 wrote to memory of 2140 2388 1bhhhn.exe 40 PID 2140 wrote to memory of 2932 2140 dpdvv.exe 41 PID 2140 wrote to memory of 2932 2140 dpdvv.exe 41 PID 2140 wrote to memory of 2932 2140 dpdvv.exe 41 PID 2140 wrote to memory of 2932 2140 dpdvv.exe 41 PID 2932 wrote to memory of 764 2932 dvjjv.exe 42 PID 2932 wrote to memory of 764 2932 dvjjv.exe 42 PID 2932 wrote to memory of 764 2932 dvjjv.exe 42 PID 2932 wrote to memory of 764 2932 dvjjv.exe 42 PID 764 wrote to memory of 1584 764 fxfxflx.exe 43 PID 764 wrote to memory of 1584 764 fxfxflx.exe 43 PID 764 wrote to memory of 1584 764 fxfxflx.exe 43 PID 764 wrote to memory of 1584 764 fxfxflx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\4619606bc01fd6c0e01def9f244cec54fb3222b6898d7e74832dc63aea9a4ebb_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4619606bc01fd6c0e01def9f244cec54fb3222b6898d7e74832dc63aea9a4ebb_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\tnhhtt.exec:\tnhhtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\nhtbnb.exec:\nhtbnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\llxxllx.exec:\llxxllx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\5bhbhh.exec:\5bhbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\vppvp.exec:\vppvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\5xxfrrx.exec:\5xxfrrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\9tbhnt.exec:\9tbhnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\dvpvj.exec:\dvpvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\dpddp.exec:\dpddp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\fxxrrrx.exec:\fxxrrrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\bthntb.exec:\bthntb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\1bhhhn.exec:\1bhhhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\dpdvv.exec:\dpdvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\dvjjv.exec:\dvjjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\fxfxflx.exec:\fxfxflx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\fflrfxf.exec:\fflrfxf.exe17⤵
- Executes dropped EXE
PID:1584 -
\??\c:\nhtbhh.exec:\nhtbhh.exe18⤵
- Executes dropped EXE
PID:2196 -
\??\c:\pvpjv.exec:\pvpjv.exe19⤵
- Executes dropped EXE
PID:1836 -
\??\c:\5pddj.exec:\5pddj.exe20⤵
- Executes dropped EXE
PID:2656 -
\??\c:\lfrxffr.exec:\lfrxffr.exe21⤵
- Executes dropped EXE
PID:324 -
\??\c:\hthnnn.exec:\hthnnn.exe22⤵
- Executes dropped EXE
PID:1072 -
\??\c:\tnhtht.exec:\tnhtht.exe23⤵
- Executes dropped EXE
PID:1776 -
\??\c:\pjvjv.exec:\pjvjv.exe24⤵
- Executes dropped EXE
PID:1176 -
\??\c:\lflrrrf.exec:\lflrrrf.exe25⤵
- Executes dropped EXE
PID:1952 -
\??\c:\xlrrfxx.exec:\xlrrfxx.exe26⤵
- Executes dropped EXE
PID:1100 -
\??\c:\nhtbnt.exec:\nhtbnt.exe27⤵
- Executes dropped EXE
PID:1568 -
\??\c:\jvjjj.exec:\jvjjj.exe28⤵
- Executes dropped EXE
PID:2220 -
\??\c:\vpdvj.exec:\vpdvj.exe29⤵
- Executes dropped EXE
PID:2864 -
\??\c:\7llllrf.exec:\7llllrf.exe30⤵
- Executes dropped EXE
PID:1652 -
\??\c:\nnnthb.exec:\nnnthb.exe31⤵
- Executes dropped EXE
PID:872 -
\??\c:\nhtbnt.exec:\nhtbnt.exe32⤵
- Executes dropped EXE
PID:1728 -
\??\c:\vjddp.exec:\vjddp.exe33⤵
- Executes dropped EXE
PID:2816 -
\??\c:\xrrrlrf.exec:\xrrrlrf.exe34⤵
- Executes dropped EXE
PID:1500 -
\??\c:\lfflxxf.exec:\lfflxxf.exe35⤵
- Executes dropped EXE
PID:2556 -
\??\c:\9tnbtt.exec:\9tnbtt.exe36⤵
- Executes dropped EXE
PID:2540 -
\??\c:\5bhhnn.exec:\5bhhnn.exe37⤵
- Executes dropped EXE
PID:2828 -
\??\c:\dvppd.exec:\dvppd.exe38⤵
- Executes dropped EXE
PID:3008 -
\??\c:\jvjdv.exec:\jvjdv.exe39⤵
- Executes dropped EXE
PID:1312 -
\??\c:\7xrllrx.exec:\7xrllrx.exe40⤵
- Executes dropped EXE
PID:2528 -
\??\c:\lfflllr.exec:\lfflllr.exe41⤵
- Executes dropped EXE
PID:2412 -
\??\c:\bnttbb.exec:\bnttbb.exe42⤵
- Executes dropped EXE
PID:2484 -
\??\c:\5thbhn.exec:\5thbhn.exe43⤵
- Executes dropped EXE
PID:2064 -
\??\c:\5vpjp.exec:\5vpjp.exe44⤵
- Executes dropped EXE
PID:1936 -
\??\c:\7dvjj.exec:\7dvjj.exe45⤵
- Executes dropped EXE
PID:2512 -
\??\c:\lllffxx.exec:\lllffxx.exe46⤵
- Executes dropped EXE
PID:2760 -
\??\c:\tththh.exec:\tththh.exe47⤵
- Executes dropped EXE
PID:2896 -
\??\c:\hbnntb.exec:\hbnntb.exe48⤵
- Executes dropped EXE
PID:1708 -
\??\c:\dvvvd.exec:\dvvvd.exe49⤵
- Executes dropped EXE
PID:1696 -
\??\c:\pdjjj.exec:\pdjjj.exe50⤵
- Executes dropped EXE
PID:2300 -
\??\c:\7frfllx.exec:\7frfllx.exe51⤵
- Executes dropped EXE
PID:2388 -
\??\c:\frlrxff.exec:\frlrxff.exe52⤵
- Executes dropped EXE
PID:2664 -
\??\c:\bnbhnn.exec:\bnbhnn.exe53⤵
- Executes dropped EXE
PID:1848 -
\??\c:\hthbhb.exec:\hthbhb.exe54⤵
- Executes dropped EXE
PID:1588 -
\??\c:\pvppv.exec:\pvppv.exe55⤵
- Executes dropped EXE
PID:1888 -
\??\c:\jdjjd.exec:\jdjjd.exe56⤵
- Executes dropped EXE
PID:1512 -
\??\c:\rlflxfl.exec:\rlflxfl.exe57⤵
- Executes dropped EXE
PID:2196 -
\??\c:\9xllxrf.exec:\9xllxrf.exe58⤵
- Executes dropped EXE
PID:2396 -
\??\c:\bthbnt.exec:\bthbnt.exe59⤵
- Executes dropped EXE
PID:2256 -
\??\c:\hhbnnb.exec:\hhbnnb.exe60⤵
- Executes dropped EXE
PID:788 -
\??\c:\dpvjd.exec:\dpvjd.exe61⤵
- Executes dropped EXE
PID:540 -
\??\c:\rrlxxxf.exec:\rrlxxxf.exe62⤵
- Executes dropped EXE
PID:2924 -
\??\c:\thnnnh.exec:\thnnnh.exe63⤵
- Executes dropped EXE
PID:1120 -
\??\c:\tnhnhh.exec:\tnhnhh.exe64⤵
- Executes dropped EXE
PID:1268 -
\??\c:\vpvvd.exec:\vpvvd.exe65⤵
- Executes dropped EXE
PID:696 -
\??\c:\1jvvd.exec:\1jvvd.exe66⤵PID:1300
-
\??\c:\rflxxxl.exec:\rflxxxl.exe67⤵PID:1100
-
\??\c:\xlrxlff.exec:\xlrxlff.exe68⤵PID:2984
-
\??\c:\9bntbn.exec:\9bntbn.exe69⤵PID:1716
-
\??\c:\1nhhhh.exec:\1nhhhh.exe70⤵PID:1688
-
\??\c:\jvjpv.exec:\jvjpv.exe71⤵PID:1636
-
\??\c:\pjvvd.exec:\pjvvd.exe72⤵PID:1652
-
\??\c:\xrlrfxf.exec:\xrlrfxf.exe73⤵PID:2264
-
\??\c:\lfxxffl.exec:\lfxxffl.exe74⤵PID:2964
-
\??\c:\tbttnn.exec:\tbttnn.exe75⤵PID:1520
-
\??\c:\hthnnh.exec:\hthnnh.exe76⤵PID:2552
-
\??\c:\1vjjp.exec:\1vjjp.exe77⤵PID:2712
-
\??\c:\jvjvd.exec:\jvjvd.exe78⤵PID:2564
-
\??\c:\xrllrrx.exec:\xrllrrx.exe79⤵PID:2420
-
\??\c:\lfxrxrx.exec:\lfxrxrx.exe80⤵PID:2588
-
\??\c:\7tnhnn.exec:\7tnhnn.exe81⤵PID:2796
-
\??\c:\thbbtb.exec:\thbbtb.exe82⤵PID:2460
-
\??\c:\1pjjp.exec:\1pjjp.exe83⤵PID:2432
-
\??\c:\vpjjp.exec:\vpjjp.exe84⤵PID:2532
-
\??\c:\3djpv.exec:\3djpv.exe85⤵PID:2916
-
\??\c:\lfrfrrf.exec:\lfrfrrf.exe86⤵PID:2688
-
\??\c:\xrlrflr.exec:\xrlrflr.exe87⤵PID:2788
-
\??\c:\1thntt.exec:\1thntt.exe88⤵PID:2752
-
\??\c:\5bnnnn.exec:\5bnnnn.exe89⤵PID:2792
-
\??\c:\3jdvv.exec:\3jdvv.exe90⤵PID:356
-
\??\c:\ppdpv.exec:\ppdpv.exe91⤵PID:1208
-
\??\c:\llflxxf.exec:\llflxxf.exe92⤵PID:2132
-
\??\c:\xlxrfll.exec:\xlxrfll.exe93⤵PID:2292
-
\??\c:\tnbhbh.exec:\tnbhbh.exe94⤵PID:2480
-
\??\c:\bthnnt.exec:\bthnnt.exe95⤵PID:2096
-
\??\c:\7jvvv.exec:\7jvvv.exe96⤵PID:1596
-
\??\c:\3dpjp.exec:\3dpjp.exe97⤵PID:1244
-
\??\c:\xxlxfrr.exec:\xxlxfrr.exe98⤵PID:2084
-
\??\c:\fxrlllx.exec:\fxrlllx.exe99⤵PID:2208
-
\??\c:\3tntnn.exec:\3tntnn.exe100⤵PID:2232
-
\??\c:\1thhnt.exec:\1thhnt.exe101⤵PID:336
-
\??\c:\ppvvd.exec:\ppvvd.exe102⤵PID:576
-
\??\c:\pjjpp.exec:\pjjpp.exe103⤵PID:1692
-
\??\c:\rlffrll.exec:\rlffrll.exe104⤵PID:560
-
\??\c:\1frflll.exec:\1frflll.exe105⤵PID:360
-
\??\c:\nbhntt.exec:\nbhntt.exe106⤵PID:2104
-
\??\c:\nbhhnt.exec:\nbhhnt.exe107⤵PID:3012
-
\??\c:\dvjvj.exec:\dvjvj.exe108⤵PID:984
-
\??\c:\dpdjp.exec:\dpdjp.exe109⤵PID:2028
-
\??\c:\frffxxf.exec:\frffxxf.exe110⤵PID:2176
-
\??\c:\7frrffl.exec:\7frrffl.exe111⤵PID:2220
-
\??\c:\hbbbnh.exec:\hbbbnh.exe112⤵PID:1972
-
\??\c:\9nbntt.exec:\9nbntt.exe113⤵PID:1640
-
\??\c:\jvdjd.exec:\jvdjd.exe114⤵PID:1852
-
\??\c:\vpvvv.exec:\vpvvv.exe115⤵PID:2968
-
\??\c:\lxfffrr.exec:\lxfffrr.exe116⤵PID:2604
-
\??\c:\fxrfrxf.exec:\fxrfrxf.exe117⤵PID:2972
-
\??\c:\htbbbn.exec:\htbbbn.exe118⤵PID:1500
-
\??\c:\ttttbt.exec:\ttttbt.exe119⤵PID:2632
-
\??\c:\vjpvp.exec:\vjpvp.exe120⤵PID:2716
-
\??\c:\dvjjd.exec:\dvjjd.exe121⤵PID:2636
-
\??\c:\9lrfxxx.exec:\9lrfxxx.exe122⤵PID:3008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-