Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 03:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
87564fea8e3713d7a55735ce58d5bd40_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
- Target 87564fea8e3713d7a55735ce58d5bd40_NeikiAnalytics.exe
- Size 835KB
- Sample240518-ejmdesah9s
- SHA256 627a670795d7c031893280428f1491e0ecda3cc0cbd31a5c624caec69b28c8a4
- MD5 87564fea8e3713d7a55735ce58d5bd40
- SHA1 ea9443838b4030e6d4b368430bb857ba3a9be8d6
- SHA512 61231b5f79eee525bb888c3a8bc955b5441cdf624efe1903ebce8cdb6a48140efc440bc54b7c422309f0430be9a4b9cdaad69bdd7bdf436c69bd90a392d0f115
- SSDEEP 24576:Sgdn8whSenedn8whhdn76gdn8whSfgdn8whSzU:TFyVPfd
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/3092-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3092-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1836-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/368-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4368-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5104-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4012-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1680-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1500-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1660-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4644-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4084-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3156-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4664-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2568-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4708-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3220-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3448-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4684-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3160-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1976-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1988-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1472-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2620-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1424-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 1836 flrrrrr.exe 5104 hbbbtb.exe 368 rflfllr.exe 4368 nhnnhb.exe 4012 rffxrrr.exe 2004 5httnn.exe 1680 fxxrrlr.exe 1500 3bhbbb.exe 1660 vvvjd.exe 4644 rxfxxxx.exe 4084 jpvpp.exe 3156 bnntbt.exe 4664 vpvvv.exe 2568 3rrllrx.exe 3220 nbbtth.exe 4708 xrlffrr.exe 448 hbhhhh.exe 4860 pjddv.exe 4072 fxrlfxx.exe 3448 vjpvp.exe 3112 rxfflfx.exe 4684 3bhhhh.exe 3160 vvpdv.exe 1976 hhhnnb.exe 2620 3djdv.exe 1988 bhbnnb.exe 1472 xxxfxxr.exe 380 lllfxxr.exe 3216 hhbttb.exe 4932 vdvpp.exe 1424 vvjjv.exe 4892 lfrrlff.exe 3252 tttbnn.exe 1624 vvjjj.exe 1724 lffxrrf.exe 5068 dpjdd.exe 4444 5rxrxxx.exe 2820 ttttbb.exe 4036 1jjvp.exe 728 rxxrrll.exe 3356 ppvpp.exe 2884 frfxxrl.exe 3792 jjddv.exe 2020 3flfxrl.exe 628 tbhbtt.exe 2952 vdjjp.exe 2004 lrxrxrf.exe 1824 tbtttt.exe 4872 vjpvv.exe 552 xrxxrfx.exe 4000 3nnhbt.exe 4280 vpddd.exe 2100 llffxxx.exe 1296 hbtttt.exe 3156 jppjj.exe 3840 3ffffrl.exe 3880 nbhbtt.exe 3220 dvppp.exe 4728 xxflrrx.exe 4048 5hhbtt.exe 4112 pjpdv.exe 2016 llrxllr.exe 4652 nbbbbb.exe 3536 vjdvd.exe -
resource yara_rule behavioral2/memory/3092-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3092-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1836-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/368-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5104-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1680-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1500-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1660-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4644-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4084-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3156-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4664-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2568-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4708-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3220-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4684-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1976-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1988-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1472-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1424-204-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3092 wrote to memory of 1836 3092 87564fea8e3713d7a55735ce58d5bd40_NeikiAnalytics.exe 83 PID 3092 wrote to memory of 1836 3092 87564fea8e3713d7a55735ce58d5bd40_NeikiAnalytics.exe 83 PID 3092 wrote to memory of 1836 3092 87564fea8e3713d7a55735ce58d5bd40_NeikiAnalytics.exe 83 PID 1836 wrote to memory of 5104 1836 flrrrrr.exe 84 PID 1836 wrote to memory of 5104 1836 flrrrrr.exe 84 PID 1836 wrote to memory of 5104 1836 flrrrrr.exe 84 PID 5104 wrote to memory of 368 5104 hbbbtb.exe 85 PID 5104 wrote to memory of 368 5104 hbbbtb.exe 85 PID 5104 wrote to memory of 368 5104 hbbbtb.exe 85 PID 368 wrote to memory of 4368 368 rflfllr.exe 86 PID 368 wrote to memory of 4368 368 rflfllr.exe 86 PID 368 wrote to memory of 4368 368 rflfllr.exe 86 PID 4368 wrote to memory of 4012 4368 nhnnhb.exe 87 PID 4368 wrote to memory of 4012 4368 nhnnhb.exe 87 PID 4368 wrote to memory of 4012 4368 nhnnhb.exe 87 PID 4012 wrote to memory of 2004 4012 rffxrrr.exe 88 PID 4012 wrote to memory of 2004 4012 rffxrrr.exe 88 PID 4012 wrote to memory of 2004 4012 rffxrrr.exe 88 PID 2004 wrote to memory of 1680 2004 5httnn.exe 89 PID 2004 wrote to memory of 1680 2004 5httnn.exe 89 PID 2004 wrote to memory of 1680 2004 5httnn.exe 89 PID 1680 wrote to memory of 1500 1680 fxxrrlr.exe 90 PID 1680 wrote to memory of 1500 1680 fxxrrlr.exe 90 PID 1680 wrote to memory of 1500 1680 fxxrrlr.exe 90 PID 1500 wrote to memory of 1660 1500 3bhbbb.exe 92 PID 1500 wrote to memory of 1660 1500 3bhbbb.exe 92 PID 1500 wrote to memory of 1660 1500 3bhbbb.exe 92 PID 1660 wrote to memory of 4644 1660 vvvjd.exe 93 PID 1660 wrote to memory of 4644 1660 vvvjd.exe 93 PID 1660 wrote to memory of 4644 1660 vvvjd.exe 93 PID 4644 wrote to memory of 4084 4644 rxfxxxx.exe 94 PID 4644 wrote to memory of 4084 4644 rxfxxxx.exe 94 PID 4644 wrote to memory of 4084 4644 rxfxxxx.exe 94 PID 4084 wrote to memory of 3156 4084 jpvpp.exe 95 PID 4084 wrote to memory of 3156 4084 jpvpp.exe 95 PID 4084 wrote to memory of 3156 4084 jpvpp.exe 95 PID 3156 wrote to memory of 4664 3156 bnntbt.exe 96 PID 3156 wrote to memory of 4664 3156 bnntbt.exe 96 PID 3156 wrote to memory of 4664 3156 bnntbt.exe 96 PID 4664 wrote to memory of 2568 4664 vpvvv.exe 97 PID 4664 wrote to memory of 2568 4664 vpvvv.exe 97 PID 4664 wrote to memory of 2568 4664 vpvvv.exe 97 PID 2568 wrote to memory of 3220 2568 3rrllrx.exe 98 PID 2568 wrote to memory of 3220 2568 3rrllrx.exe 98 PID 2568 wrote to memory of 3220 2568 3rrllrx.exe 98 PID 3220 wrote to memory of 4708 3220 nbbtth.exe 99 PID 3220 wrote to memory of 4708 3220 nbbtth.exe 99 PID 3220 wrote to memory of 4708 3220 nbbtth.exe 99 PID 4708 wrote to memory of 448 4708 xrlffrr.exe 100 PID 4708 wrote to memory of 448 4708 xrlffrr.exe 100 PID 4708 wrote to memory of 448 4708 xrlffrr.exe 100 PID 448 wrote to memory of 4860 448 hbhhhh.exe 101 PID 448 wrote to memory of 4860 448 hbhhhh.exe 101 PID 448 wrote to memory of 4860 448 hbhhhh.exe 101 PID 4860 wrote to memory of 4072 4860 pjddv.exe 103 PID 4860 wrote to memory of 4072 4860 pjddv.exe 103 PID 4860 wrote to memory of 4072 4860 pjddv.exe 103 PID 4072 wrote to memory of 3448 4072 fxrlfxx.exe 104 PID 4072 wrote to memory of 3448 4072 fxrlfxx.exe 104 PID 4072 wrote to memory of 3448 4072 fxrlfxx.exe 104 PID 3448 wrote to memory of 3112 3448 vjpvp.exe 105 PID 3448 wrote to memory of 3112 3448 vjpvp.exe 105 PID 3448 wrote to memory of 3112 3448 vjpvp.exe 105 PID 3112 wrote to memory of 4684 3112 rxfflfx.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\87564fea8e3713d7a55735ce58d5bd40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\87564fea8e3713d7a55735ce58d5bd40_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\flrrrrr.exec:\flrrrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\hbbbtb.exec:\hbbbtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\rflfllr.exec:\rflfllr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
\??\c:\nhnnhb.exec:\nhnnhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\rffxrrr.exec:\rffxrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\5httnn.exec:\5httnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\fxxrrlr.exec:\fxxrrlr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\3bhbbb.exec:\3bhbbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\vvvjd.exec:\vvvjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\rxfxxxx.exec:\rxfxxxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
\??\c:\jpvpp.exec:\jpvpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\bnntbt.exec:\bnntbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\vpvvv.exec:\vpvvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\3rrllrx.exec:\3rrllrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\nbbtth.exec:\nbbtth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\xrlffrr.exec:\xrlffrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\hbhhhh.exec:\hbhhhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\pjddv.exec:\pjddv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\fxrlfxx.exec:\fxrlfxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
\??\c:\vjpvp.exec:\vjpvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\rxfflfx.exec:\rxfflfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\3bhhhh.exec:\3bhhhh.exe23⤵
- Executes dropped EXE
PID:4684 -
\??\c:\vvpdv.exec:\vvpdv.exe24⤵
- Executes dropped EXE
PID:3160 -
\??\c:\hhhnnb.exec:\hhhnnb.exe25⤵
- Executes dropped EXE
PID:1976 -
\??\c:\3djdv.exec:\3djdv.exe26⤵
- Executes dropped EXE
PID:2620 -
\??\c:\bhbnnb.exec:\bhbnnb.exe27⤵
- Executes dropped EXE
PID:1988 -
\??\c:\xxxfxxr.exec:\xxxfxxr.exe28⤵
- Executes dropped EXE
PID:1472 -
\??\c:\lllfxxr.exec:\lllfxxr.exe29⤵
- Executes dropped EXE
PID:380 -
\??\c:\hhbttb.exec:\hhbttb.exe30⤵
- Executes dropped EXE
PID:3216 -
\??\c:\vdvpp.exec:\vdvpp.exe31⤵
- Executes dropped EXE
PID:4932 -
\??\c:\vvjjv.exec:\vvjjv.exe32⤵
- Executes dropped EXE
PID:1424 -
\??\c:\lfrrlff.exec:\lfrrlff.exe33⤵
- Executes dropped EXE
PID:4892 -
\??\c:\tttbnn.exec:\tttbnn.exe34⤵
- Executes dropped EXE
PID:3252 -
\??\c:\vvjjj.exec:\vvjjj.exe35⤵
- Executes dropped EXE
PID:1624 -
\??\c:\lffxrrf.exec:\lffxrrf.exe36⤵
- Executes dropped EXE
PID:1724 -
\??\c:\dpjdd.exec:\dpjdd.exe37⤵
- Executes dropped EXE
PID:5068 -
\??\c:\5rxrxxx.exec:\5rxrxxx.exe38⤵
- Executes dropped EXE
PID:4444 -
\??\c:\ttttbb.exec:\ttttbb.exe39⤵
- Executes dropped EXE
PID:2820 -
\??\c:\1jjvp.exec:\1jjvp.exe40⤵
- Executes dropped EXE
PID:4036 -
\??\c:\rxxrrll.exec:\rxxrrll.exe41⤵
- Executes dropped EXE
PID:728 -
\??\c:\ppvpp.exec:\ppvpp.exe42⤵
- Executes dropped EXE
PID:3356 -
\??\c:\frfxxrl.exec:\frfxxrl.exe43⤵
- Executes dropped EXE
PID:2884 -
\??\c:\jjddv.exec:\jjddv.exe44⤵
- Executes dropped EXE
PID:3792 -
\??\c:\3flfxrl.exec:\3flfxrl.exe45⤵
- Executes dropped EXE
PID:2020 -
\??\c:\tbhbtt.exec:\tbhbtt.exe46⤵
- Executes dropped EXE
PID:628 -
\??\c:\vdjjp.exec:\vdjjp.exe47⤵
- Executes dropped EXE
PID:2952 -
\??\c:\lrxrxrf.exec:\lrxrxrf.exe48⤵
- Executes dropped EXE
PID:2004 -
\??\c:\tbtttt.exec:\tbtttt.exe49⤵
- Executes dropped EXE
PID:1824 -
\??\c:\vjpvv.exec:\vjpvv.exe50⤵
- Executes dropped EXE
PID:4872 -
\??\c:\xrxxrfx.exec:\xrxxrfx.exe51⤵
- Executes dropped EXE
PID:552 -
\??\c:\3nnhbt.exec:\3nnhbt.exe52⤵
- Executes dropped EXE
PID:4000 -
\??\c:\vpddd.exec:\vpddd.exe53⤵
- Executes dropped EXE
PID:4280 -
\??\c:\llffxxx.exec:\llffxxx.exe54⤵
- Executes dropped EXE
PID:2100 -
\??\c:\hbtttt.exec:\hbtttt.exe55⤵
- Executes dropped EXE
PID:1296 -
\??\c:\jppjj.exec:\jppjj.exe56⤵
- Executes dropped EXE
PID:3156 -
\??\c:\3ffffrl.exec:\3ffffrl.exe57⤵
- Executes dropped EXE
PID:3840 -
\??\c:\nbhbtt.exec:\nbhbtt.exe58⤵
- Executes dropped EXE
PID:3880 -
\??\c:\dvppp.exec:\dvppp.exe59⤵
- Executes dropped EXE
PID:3220 -
\??\c:\xxflrrx.exec:\xxflrrx.exe60⤵
- Executes dropped EXE
PID:4728 -
\??\c:\5hhbtt.exec:\5hhbtt.exe61⤵
- Executes dropped EXE
PID:4048 -
\??\c:\pjpdv.exec:\pjpdv.exe62⤵
- Executes dropped EXE
PID:4112 -
\??\c:\llrxllr.exec:\llrxllr.exe63⤵
- Executes dropped EXE
PID:2016 -
\??\c:\nbbbbb.exec:\nbbbbb.exe64⤵
- Executes dropped EXE
PID:4652 -
\??\c:\vjdvd.exec:\vjdvd.exe65⤵
- Executes dropped EXE
PID:3536 -
\??\c:\lffffll.exec:\lffffll.exe66⤵PID:4396
-
\??\c:\htbtnn.exec:\htbtnn.exe67⤵PID:2036
-
\??\c:\vvpjp.exec:\vvpjp.exe68⤵PID:2956
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe69⤵PID:4056
-
\??\c:\hhhhhn.exec:\hhhhhn.exe70⤵PID:4676
-
\??\c:\ddppd.exec:\ddppd.exe71⤵PID:2576
-
\??\c:\lflfrfx.exec:\lflfrfx.exe72⤵PID:3084
-
\??\c:\thnhhh.exec:\thnhhh.exe73⤵PID:856
-
\??\c:\5dvpp.exec:\5dvpp.exe74⤵PID:4504
-
\??\c:\rfllrlf.exec:\rfllrlf.exe75⤵PID:3772
-
\??\c:\hbhbbb.exec:\hbhbbb.exe76⤵PID:1436
-
\??\c:\9vpvp.exec:\9vpvp.exe77⤵PID:1684
-
\??\c:\flrlrll.exec:\flrlrll.exe78⤵PID:1624
-
\??\c:\5hhbbh.exec:\5hhbbh.exe79⤵PID:4432
-
\??\c:\lrfxfff.exec:\lrfxfff.exe80⤵PID:4924
-
\??\c:\5tbbbh.exec:\5tbbbh.exe81⤵PID:1608
-
\??\c:\dpjvj.exec:\dpjvj.exe82⤵PID:1376
-
\??\c:\7fxlffx.exec:\7fxlffx.exe83⤵PID:1468
-
\??\c:\nnnnnn.exec:\nnnnnn.exe84⤵PID:2196
-
\??\c:\jvjdd.exec:\jvjdd.exe85⤵PID:3200
-
\??\c:\3frllll.exec:\3frllll.exe86⤵PID:2368
-
\??\c:\nbhnhn.exec:\nbhnhn.exe87⤵PID:3572
-
\??\c:\rrrfrrl.exec:\rrrfrrl.exe88⤵PID:3832
-
\??\c:\nnthnb.exec:\nnthnb.exe89⤵PID:3272
-
\??\c:\pjvpd.exec:\pjvpd.exe90⤵PID:4956
-
\??\c:\9rrfxxr.exec:\9rrfxxr.exe91⤵PID:3656
-
\??\c:\7htttt.exec:\7htttt.exe92⤵PID:552
-
\??\c:\djppp.exec:\djppp.exe93⤵PID:2128
-
\??\c:\rrxrfxf.exec:\rrxrfxf.exe94⤵PID:3172
-
\??\c:\nhnhht.exec:\nhnhht.exe95⤵PID:4468
-
\??\c:\xxrrrff.exec:\xxrrrff.exe96⤵PID:4460
-
\??\c:\5hhbtb.exec:\5hhbtb.exe97⤵PID:3520
-
\??\c:\9ppjj.exec:\9ppjj.exe98⤵PID:3696
-
\??\c:\flxxllr.exec:\flxxllr.exe99⤵PID:1408
-
\??\c:\tbnbth.exec:\tbnbth.exe100⤵PID:4476
-
\??\c:\pjjdv.exec:\pjjdv.exe101⤵PID:3080
-
\??\c:\htttnn.exec:\htttnn.exe102⤵PID:3196
-
\??\c:\7pvpp.exec:\7pvpp.exe103⤵PID:4948
-
\??\c:\xrxrxrr.exec:\xrxrxrr.exe104⤵PID:4804
-
\??\c:\hbbtnh.exec:\hbbtnh.exe105⤵PID:3448
-
\??\c:\dpvvp.exec:\dpvvp.exe106⤵PID:3756
-
\??\c:\nhnhhn.exec:\nhnhhn.exe107⤵PID:1656
-
\??\c:\pjjjj.exec:\pjjjj.exe108⤵PID:2956
-
\??\c:\1llfxrl.exec:\1llfxrl.exe109⤵PID:1108
-
\??\c:\tntntn.exec:\tntntn.exe110⤵PID:4676
-
\??\c:\jdjjv.exec:\jdjjv.exe111⤵PID:2008
-
\??\c:\rrffffl.exec:\rrffffl.exe112⤵PID:3084
-
\??\c:\nbnnnt.exec:\nbnnnt.exe113⤵PID:4516
-
\??\c:\vjdvp.exec:\vjdvp.exe114⤵PID:984
-
\??\c:\llrrxxl.exec:\llrrxxl.exe115⤵PID:732
-
\??\c:\ttnnnn.exec:\ttnnnn.exe116⤵PID:4904
-
\??\c:\vvvdd.exec:\vvvdd.exe117⤵PID:3164
-
\??\c:\7flfffl.exec:\7flfffl.exe118⤵PID:4308
-
\??\c:\lrrrlll.exec:\lrrrlll.exe119⤵PID:3888
-
\??\c:\nntnnb.exec:\nntnnb.exe120⤵PID:2684
-
\??\c:\ddvvp.exec:\ddvvp.exe121⤵PID:2736
-
\??\c:\llrrrrr.exec:\llrrrrr.exe122⤵PID:368
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-