Analysis
- max time kernel
150s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
11/05/2024, 02:22
Behavioral task
behavioral1
Sample
5934d86700437151743e734033194ec0_NeikiAnalytics.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
- Target 5934d86700437151743e734033194ec0_NeikiAnalytics.exe
- Size 486KB
- Sample240511-ctjdeaaf67
- SHA256 07ba279d4a34577d7638559b4af7f4297f7e4f83e4f1b31beb03090a1f7e5934
- MD5 5934d86700437151743e734033194ec0
- SHA1 1e878472a1750c6425ec904674775a1af5a60f5b
- SHA512 f9ba1f1624bdbfa027343d22cd0cc72cb570a398151ed53255e401674ac0d2fc5d015628f24eee7ebeb64e93e9d5e5b3efc922a06a5ca39754a19aa0d8699133
- SSDEEP 6144:n3C9BRo7tvnJ9oH0IRgZvjkUo7tvnJ9oH0IiVByq9CPobNVj:n3C9ytvngQjgtvngSV3CPobNVj
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/3104-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4440-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1016-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3476-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2000-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3012-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/544-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/852-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4064-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2772-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2772-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5080-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2976-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/836-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4660-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1972-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2176-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2376-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3588-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3940-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1936-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2852-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4324-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4928-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 4440 thbnth.exe 1016 dpdvj.exe 2000 xflfxrl.exe 3476 hbtnhh.exe 3012 tbbtnh.exe 544 tnntnn.exe 852 nhnntn.exe 4064 3xrlffx.exe 4908 nnbtbb.exe 2772 bttnht.exe 5056 nnhtbn.exe 5080 ddvpj.exe 2976 tthbtt.exe 2464 jjjpp.exe 836 xlrlfll.exe 4660 ttbtnh.exe 4592 9hhbtt.exe 2440 hthbhn.exe 1972 bhbnhh.exe 2176 fxlfllr.exe 2376 btnhtt.exe 3588 hnnhbb.exe 3940 pppdj.exe 3504 rlrlflf.exe 1936 lxfxrrr.exe 976 vppjp.exe 2852 1rxffrr.exe 4324 vjjjj.exe 4412 5xfrlxr.exe 4928 nhbhhn.exe 4844 rfrlffx.exe 4392 pvdvv.exe 212 frrlfxr.exe 3500 nhhbbb.exe 4296 3vpdv.exe 1236 jjddp.exe 3360 7xffxfl.exe 2444 vpvpp.exe 3452 xxffllx.exe 2000 httnhh.exe 64 dddpj.exe 2124 xllfxrl.exe 3432 tnhtbn.exe 5060 pppdp.exe 4352 fxfxxff.exe 4520 nhtbth.exe 3736 9pvjd.exe 3040 rrrrlrr.exe 448 jddvv.exe 676 lxrlxrr.exe 4532 nhhtnh.exe 4816 vdjpp.exe 1796 frxrlrr.exe 3164 3bbtnh.exe 4688 rrxrrxx.exe 5080 rlfxrrr.exe 1776 jvddv.exe 3424 lxfxrlf.exe 1280 ththnb.exe 4924 pjdvv.exe 884 lflfrlr.exe 3512 bbhbtt.exe 4592 pdvpp.exe 3948 xrffxxr.exe -
resource yara_rule behavioral2/memory/3104-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4440-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3012-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/544-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/544-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/852-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4064-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2772-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2772-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5080-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2976-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/836-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4660-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2176-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2376-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3940-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1936-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2852-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4324-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-208-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3104 wrote to memory of 4440 3104 5934d86700437151743e734033194ec0_NeikiAnalytics.exe 82 PID 3104 wrote to memory of 4440 3104 5934d86700437151743e734033194ec0_NeikiAnalytics.exe 82 PID 3104 wrote to memory of 4440 3104 5934d86700437151743e734033194ec0_NeikiAnalytics.exe 82 PID 4440 wrote to memory of 1016 4440 thbnth.exe 83 PID 4440 wrote to memory of 1016 4440 thbnth.exe 83 PID 4440 wrote to memory of 1016 4440 thbnth.exe 83 PID 1016 wrote to memory of 2000 1016 dpdvj.exe 84 PID 1016 wrote to memory of 2000 1016 dpdvj.exe 84 PID 1016 wrote to memory of 2000 1016 dpdvj.exe 84 PID 2000 wrote to memory of 3476 2000 xflfxrl.exe 85 PID 2000 wrote to memory of 3476 2000 xflfxrl.exe 85 PID 2000 wrote to memory of 3476 2000 xflfxrl.exe 85 PID 3476 wrote to memory of 3012 3476 hbtnhh.exe 86 PID 3476 wrote to memory of 3012 3476 hbtnhh.exe 86 PID 3476 wrote to memory of 3012 3476 hbtnhh.exe 86 PID 3012 wrote to memory of 544 3012 tbbtnh.exe 87 PID 3012 wrote to memory of 544 3012 tbbtnh.exe 87 PID 3012 wrote to memory of 544 3012 tbbtnh.exe 87 PID 544 wrote to memory of 852 544 tnntnn.exe 90 PID 544 wrote to memory of 852 544 tnntnn.exe 90 PID 544 wrote to memory of 852 544 tnntnn.exe 90 PID 852 wrote to memory of 4064 852 nhnntn.exe 91 PID 852 wrote to memory of 4064 852 nhnntn.exe 91 PID 852 wrote to memory of 4064 852 nhnntn.exe 91 PID 4064 wrote to memory of 4908 4064 3xrlffx.exe 93 PID 4064 wrote to memory of 4908 4064 3xrlffx.exe 93 PID 4064 wrote to memory of 4908 4064 3xrlffx.exe 93 PID 4908 wrote to memory of 2772 4908 nnbtbb.exe 94 PID 4908 wrote to memory of 2772 4908 nnbtbb.exe 94 PID 4908 wrote to memory of 2772 4908 nnbtbb.exe 94 PID 2772 wrote to memory of 5056 2772 bttnht.exe 95 PID 2772 wrote to memory of 5056 2772 bttnht.exe 95 PID 2772 wrote to memory of 5056 2772 bttnht.exe 95 PID 5056 wrote to memory of 5080 5056 nnhtbn.exe 96 PID 5056 wrote to memory of 5080 5056 nnhtbn.exe 96 PID 5056 wrote to memory of 5080 5056 nnhtbn.exe 96 PID 5080 wrote to memory of 2976 5080 ddvpj.exe 97 PID 5080 wrote to memory of 2976 5080 ddvpj.exe 97 PID 5080 wrote to memory of 2976 5080 ddvpj.exe 97 PID 2976 wrote to memory of 2464 2976 tthbtt.exe 98 PID 2976 wrote to memory of 2464 2976 tthbtt.exe 98 PID 2976 wrote to memory of 2464 2976 tthbtt.exe 98 PID 2464 wrote to memory of 836 2464 jjjpp.exe 99 PID 2464 wrote to memory of 836 2464 jjjpp.exe 99 PID 2464 wrote to memory of 836 2464 jjjpp.exe 99 PID 836 wrote to memory of 4660 836 xlrlfll.exe 101 PID 836 wrote to memory of 4660 836 xlrlfll.exe 101 PID 836 wrote to memory of 4660 836 xlrlfll.exe 101 PID 4660 wrote to memory of 4592 4660 ttbtnh.exe 102 PID 4660 wrote to memory of 4592 4660 ttbtnh.exe 102 PID 4660 wrote to memory of 4592 4660 ttbtnh.exe 102 PID 4592 wrote to memory of 2440 4592 9hhbtt.exe 103 PID 4592 wrote to memory of 2440 4592 9hhbtt.exe 103 PID 4592 wrote to memory of 2440 4592 9hhbtt.exe 103 PID 2440 wrote to memory of 1972 2440 hthbhn.exe 104 PID 2440 wrote to memory of 1972 2440 hthbhn.exe 104 PID 2440 wrote to memory of 1972 2440 hthbhn.exe 104 PID 1972 wrote to memory of 2176 1972 bhbnhh.exe 105 PID 1972 wrote to memory of 2176 1972 bhbnhh.exe 105 PID 1972 wrote to memory of 2176 1972 bhbnhh.exe 105 PID 2176 wrote to memory of 2376 2176 fxlfllr.exe 106 PID 2176 wrote to memory of 2376 2176 fxlfllr.exe 106 PID 2176 wrote to memory of 2376 2176 fxlfllr.exe 106 PID 2376 wrote to memory of 3588 2376 btnhtt.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\5934d86700437151743e734033194ec0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5934d86700437151743e734033194ec0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\thbnth.exec:\thbnth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\dpdvj.exec:\dpdvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\xflfxrl.exec:\xflfxrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\hbtnhh.exec:\hbtnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\tbbtnh.exec:\tbbtnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\tnntnn.exec:\tnntnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\nhnntn.exec:\nhnntn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\3xrlffx.exec:\3xrlffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\nnbtbb.exec:\nnbtbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\bttnht.exec:\bttnht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\nnhtbn.exec:\nnhtbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\ddvpj.exec:\ddvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\tthbtt.exec:\tthbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\jjjpp.exec:\jjjpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\xlrlfll.exec:\xlrlfll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\ttbtnh.exec:\ttbtnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\9hhbtt.exec:\9hhbtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\hthbhn.exec:\hthbhn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\bhbnhh.exec:\bhbnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\fxlfllr.exec:\fxlfllr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\btnhtt.exec:\btnhtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\hnnhbb.exec:\hnnhbb.exe23⤵
- Executes dropped EXE
PID:3588 -
\??\c:\pppdj.exec:\pppdj.exe24⤵
- Executes dropped EXE
PID:3940 -
\??\c:\rlrlflf.exec:\rlrlflf.exe25⤵
- Executes dropped EXE
PID:3504 -
\??\c:\lxfxrrr.exec:\lxfxrrr.exe26⤵
- Executes dropped EXE
PID:1936 -
\??\c:\vppjp.exec:\vppjp.exe27⤵
- Executes dropped EXE
PID:976 -
\??\c:\1rxffrr.exec:\1rxffrr.exe28⤵
- Executes dropped EXE
PID:2852 -
\??\c:\vjjjj.exec:\vjjjj.exe29⤵
- Executes dropped EXE
PID:4324 -
\??\c:\5xfrlxr.exec:\5xfrlxr.exe30⤵
- Executes dropped EXE
PID:4412 -
\??\c:\nhbhhn.exec:\nhbhhn.exe31⤵
- Executes dropped EXE
PID:4928 -
\??\c:\rfrlffx.exec:\rfrlffx.exe32⤵
- Executes dropped EXE
PID:4844 -
\??\c:\pvdvv.exec:\pvdvv.exe33⤵
- Executes dropped EXE
PID:4392 -
\??\c:\frrlfxr.exec:\frrlfxr.exe34⤵
- Executes dropped EXE
PID:212 -
\??\c:\nhhbbb.exec:\nhhbbb.exe35⤵
- Executes dropped EXE
PID:3500 -
\??\c:\3vpdv.exec:\3vpdv.exe36⤵
- Executes dropped EXE
PID:4296 -
\??\c:\jjddp.exec:\jjddp.exe37⤵
- Executes dropped EXE
PID:1236 -
\??\c:\7xffxfl.exec:\7xffxfl.exe38⤵
- Executes dropped EXE
PID:3360 -
\??\c:\vpvpp.exec:\vpvpp.exe39⤵
- Executes dropped EXE
PID:2444 -
\??\c:\xxffllx.exec:\xxffllx.exe40⤵
- Executes dropped EXE
PID:3452 -
\??\c:\httnhh.exec:\httnhh.exe41⤵
- Executes dropped EXE
PID:2000 -
\??\c:\dddpj.exec:\dddpj.exe42⤵
- Executes dropped EXE
PID:64 -
\??\c:\xllfxrl.exec:\xllfxrl.exe43⤵
- Executes dropped EXE
PID:2124 -
\??\c:\tnhtbn.exec:\tnhtbn.exe44⤵
- Executes dropped EXE
PID:3432 -
\??\c:\pppdp.exec:\pppdp.exe45⤵
- Executes dropped EXE
PID:5060 -
\??\c:\fxfxxff.exec:\fxfxxff.exe46⤵
- Executes dropped EXE
PID:4352 -
\??\c:\nhtbth.exec:\nhtbth.exe47⤵
- Executes dropped EXE
PID:4520 -
\??\c:\9pvjd.exec:\9pvjd.exe48⤵
- Executes dropped EXE
PID:3736 -
\??\c:\rrrrlrr.exec:\rrrrlrr.exe49⤵
- Executes dropped EXE
PID:3040 -
\??\c:\jddvv.exec:\jddvv.exe50⤵
- Executes dropped EXE
PID:448 -
\??\c:\lxrlxrr.exec:\lxrlxrr.exe51⤵
- Executes dropped EXE
PID:676 -
\??\c:\nhhtnh.exec:\nhhtnh.exe52⤵
- Executes dropped EXE
PID:4532 -
\??\c:\vdjpp.exec:\vdjpp.exe53⤵
- Executes dropped EXE
PID:4816 -
\??\c:\frxrlrr.exec:\frxrlrr.exe54⤵
- Executes dropped EXE
PID:1796 -
\??\c:\3bbtnh.exec:\3bbtnh.exe55⤵
- Executes dropped EXE
PID:3164 -
\??\c:\rrxrrxx.exec:\rrxrrxx.exe56⤵
- Executes dropped EXE
PID:4688 -
\??\c:\rlfxrrr.exec:\rlfxrrr.exe57⤵
- Executes dropped EXE
PID:5080 -
\??\c:\jvddv.exec:\jvddv.exe58⤵
- Executes dropped EXE
PID:1776 -
\??\c:\lxfxrlf.exec:\lxfxrlf.exe59⤵
- Executes dropped EXE
PID:3424 -
\??\c:\ththnb.exec:\ththnb.exe60⤵
- Executes dropped EXE
PID:1280 -
\??\c:\pjdvv.exec:\pjdvv.exe61⤵
- Executes dropped EXE
PID:4924 -
\??\c:\lflfrlr.exec:\lflfrlr.exe62⤵
- Executes dropped EXE
PID:884 -
\??\c:\bbhbtt.exec:\bbhbtt.exe63⤵
- Executes dropped EXE
PID:3512 -
\??\c:\pdvpp.exec:\pdvpp.exe64⤵
- Executes dropped EXE
PID:4592 -
\??\c:\xrffxxr.exec:\xrffxxr.exe65⤵
- Executes dropped EXE
PID:3948 -
\??\c:\xlrlxxr.exec:\xlrlxxr.exe66⤵PID:2168
-
\??\c:\5nnnnh.exec:\5nnnnh.exe67⤵PID:984
-
\??\c:\jddvp.exec:\jddvp.exe68⤵PID:4956
-
\??\c:\9rrrrxx.exec:\9rrrrxx.exe69⤵PID:2388
-
\??\c:\bhnhhn.exec:\bhnhhn.exe70⤵PID:4156
-
\??\c:\jvdvp.exec:\jvdvp.exe71⤵PID:4340
-
\??\c:\frlfxfr.exec:\frlfxfr.exe72⤵PID:3352
-
\??\c:\thtttt.exec:\thtttt.exe73⤵PID:3940
-
\??\c:\1vvpj.exec:\1vvpj.exe74⤵PID:3480
-
\??\c:\xfrllll.exec:\xfrllll.exe75⤵PID:4840
-
\??\c:\bnbtnn.exec:\bnbtnn.exe76⤵PID:736
-
\??\c:\bbhbtn.exec:\bbhbtn.exe77⤵PID:4616
-
\??\c:\lflfxxx.exec:\lflfxxx.exe78⤵PID:4232
-
\??\c:\hbhhtt.exec:\hbhhtt.exe79⤵PID:1268
-
\??\c:\dpvdv.exec:\dpvdv.exe80⤵PID:3752
-
\??\c:\llrlffx.exec:\llrlffx.exe81⤵PID:4704
-
\??\c:\xrllxff.exec:\xrllxff.exe82⤵PID:324
-
\??\c:\nhnbhn.exec:\nhnbhn.exe83⤵PID:380
-
\??\c:\jjdpj.exec:\jjdpj.exe84⤵PID:2044
-
\??\c:\lxxxxlr.exec:\lxxxxlr.exe85⤵PID:4368
-
\??\c:\htnnhh.exec:\htnnhh.exe86⤵PID:3152
-
\??\c:\vjvjj.exec:\vjvjj.exe87⤵PID:1064
-
\??\c:\xlfxxxx.exec:\xlfxxxx.exe88⤵PID:2716
-
\??\c:\pvdvd.exec:\pvdvd.exe89⤵PID:1192
-
\??\c:\xfrfxxr.exec:\xfrfxxr.exe90⤵PID:3356
-
\??\c:\nbnbbb.exec:\nbnbbb.exe91⤵PID:2904
-
\??\c:\1vvvv.exec:\1vvvv.exe92⤵PID:1900
-
\??\c:\jdddd.exec:\jdddd.exe93⤵PID:4436
-
\??\c:\xrflrrl.exec:\xrflrrl.exe94⤵PID:3924
-
\??\c:\bnnhhh.exec:\bnnhhh.exe95⤵PID:2964
-
\??\c:\tnnnhh.exec:\tnnnhh.exe96⤵PID:1948
-
\??\c:\pddpj.exec:\pddpj.exe97⤵PID:1668
-
\??\c:\flfxfxf.exec:\flfxfxf.exe98⤵PID:4788
-
\??\c:\hnhnth.exec:\hnhnth.exe99⤵PID:4768
-
\??\c:\nhttbb.exec:\nhttbb.exe100⤵PID:2504
-
\??\c:\dvvvp.exec:\dvvvp.exe101⤵PID:2032
-
\??\c:\xrxrrfx.exec:\xrxrrfx.exe102⤵PID:932
-
\??\c:\xfxrrll.exec:\xfxrrll.exe103⤵PID:1684
-
\??\c:\1nhbtt.exec:\1nhbtt.exe104⤵PID:4908
-
\??\c:\vjdvj.exec:\vjdvj.exe105⤵PID:1996
-
\??\c:\lflfxlf.exec:\lflfxlf.exe106⤵PID:5064
-
\??\c:\hbbbtt.exec:\hbbbtt.exe107⤵PID:1924
-
\??\c:\3vvpj.exec:\3vvpj.exe108⤵PID:1428
-
\??\c:\pjvvj.exec:\pjvvj.exe109⤵PID:2468
-
\??\c:\9frllll.exec:\9frllll.exe110⤵PID:1404
-
\??\c:\nbbtnn.exec:\nbbtnn.exe111⤵PID:1964
-
\??\c:\hbntbb.exec:\hbntbb.exe112⤵PID:4864
-
\??\c:\pddvp.exec:\pddvp.exe113⤵PID:4660
-
\??\c:\frxrrrl.exec:\frxrrrl.exe114⤵PID:4868
-
\??\c:\tbhbbt.exec:\tbhbbt.exe115⤵PID:1308
-
\??\c:\vvpvp.exec:\vvpvp.exe116⤵PID:4592
-
\??\c:\pjjdv.exec:\pjjdv.exe117⤵PID:1972
-
\??\c:\xffxfxr.exec:\xffxfxr.exe118⤵PID:4524
-
\??\c:\thtbtn.exec:\thtbtn.exe119⤵PID:1568
-
\??\c:\jpjdp.exec:\jpjdp.exe120⤵PID:3000
-
\??\c:\rrllfff.exec:\rrllfff.exe121⤵PID:4484
-
\??\c:\5thhbb.exec:\5thhbb.exe122⤵PID:4508
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-