Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2024, 20:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2c33d5e90e52bf7c2d996c28560f5570_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
- Target 2c33d5e90e52bf7c2d996c28560f5570_NeikiAnalytics.exe
- Size 277KB
- Sample240519-ytyc8afe5x
- SHA256 aa97a4f53d8e017b25570ff2625dd2f3e85228a592c698cf2786ab7f225cdd5e
- MD5 2c33d5e90e52bf7c2d996c28560f5570
- SHA1 57a3bf0786267c58d9d1698c964db6aeacbaae95
- SHA512 ab36368e4257030678352ede723e2eca8abf2cf02e6119d92e9c6099e51da62f8d599b21e0297ac87e37108c04c5b9ead4aaa6d0df95c9d11a90a9e262337c04
- SSDEEP 6144:n3C9BRIG0asYFm71m8+GdkB9yMu7VvemD:n3C9uYA71kSMu5
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/996-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3300-16-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3300-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4372-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1740-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1740-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1072-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4068-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2864-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3532-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2384-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4796-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/960-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2328-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3564-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4772-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1432-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1268-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2744-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3016-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3220-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2236-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 3300 lfxrlll.exe 4372 btnhbb.exe 1740 xlrrlll.exe 1072 hnbttt.exe 4068 pvvjv.exe 2864 rfxrlrl.exe 2328 thbttn.exe 3532 tbthtn.exe 2384 bbnntn.exe 4796 dvpjd.exe 3284 3xfxffx.exe 4956 htthhh.exe 960 jjjpj.exe 2840 rxllrll.exe 3564 rrlrrrr.exe 4752 nhhtbt.exe 4772 vddpv.exe 2236 7lrlflf.exe 4668 nnnnhb.exe 1432 jvjdj.exe 4420 1lxlxxl.exe 1268 bhbnhh.exe 3668 9jpjj.exe 2744 pvjjv.exe 3004 tbnnhb.exe 3544 hnnbtn.exe 3596 pjdvp.exe 3016 rfxrlfx.exe 424 hnntnn.exe 3220 jddjj.exe 2212 lrxxrrl.exe 2348 tbnhtb.exe 4508 dvdvv.exe 3044 rlllfll.exe 4568 ttbthn.exe 4908 pvppp.exe 2800 9bbttt.exe 3664 ppppj.exe 3476 pddvp.exe 1812 fxfxxxr.exe 2440 3xrlffx.exe 5096 bbtnhh.exe 4216 jvjdd.exe 4944 7pjdv.exe 400 rxffffx.exe 1428 3nttnn.exe 2428 ddvvd.exe 3792 3xxfxff.exe 4692 htnnbb.exe 3264 nhtttb.exe 2924 jdpjj.exe 2284 rxfrllf.exe 4728 ttttnn.exe 4316 vjvjp.exe 5032 pvdvv.exe 4268 rffrxlf.exe 2856 nhbbtt.exe 4400 nhbbbb.exe 4772 vppjj.exe 2720 rflffff.exe 736 ddvpd.exe 972 ddjpd.exe 2276 1xrlfxx.exe 3924 fflfxxl.exe -
resource yara_rule behavioral2/memory/996-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3300-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3300-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4372-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1740-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1740-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1072-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1072-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1072-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4068-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4068-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4068-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2864-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3532-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2384-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4796-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/960-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3564-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4772-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1432-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1268-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2744-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3596-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3016-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3220-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-133-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 996 wrote to memory of 3300 996 2c33d5e90e52bf7c2d996c28560f5570_NeikiAnalytics.exe 83 PID 996 wrote to memory of 3300 996 2c33d5e90e52bf7c2d996c28560f5570_NeikiAnalytics.exe 83 PID 996 wrote to memory of 3300 996 2c33d5e90e52bf7c2d996c28560f5570_NeikiAnalytics.exe 83 PID 3300 wrote to memory of 4372 3300 lfxrlll.exe 84 PID 3300 wrote to memory of 4372 3300 lfxrlll.exe 84 PID 3300 wrote to memory of 4372 3300 lfxrlll.exe 84 PID 4372 wrote to memory of 1740 4372 btnhbb.exe 85 PID 4372 wrote to memory of 1740 4372 btnhbb.exe 85 PID 4372 wrote to memory of 1740 4372 btnhbb.exe 85 PID 1740 wrote to memory of 1072 1740 xlrrlll.exe 86 PID 1740 wrote to memory of 1072 1740 xlrrlll.exe 86 PID 1740 wrote to memory of 1072 1740 xlrrlll.exe 86 PID 1072 wrote to memory of 4068 1072 hnbttt.exe 87 PID 1072 wrote to memory of 4068 1072 hnbttt.exe 87 PID 1072 wrote to memory of 4068 1072 hnbttt.exe 87 PID 4068 wrote to memory of 2864 4068 pvvjv.exe 88 PID 4068 wrote to memory of 2864 4068 pvvjv.exe 88 PID 4068 wrote to memory of 2864 4068 pvvjv.exe 88 PID 2864 wrote to memory of 2328 2864 rfxrlrl.exe 90 PID 2864 wrote to memory of 2328 2864 rfxrlrl.exe 90 PID 2864 wrote to memory of 2328 2864 rfxrlrl.exe 90 PID 2328 wrote to memory of 3532 2328 thbttn.exe 92 PID 2328 wrote to memory of 3532 2328 thbttn.exe 92 PID 2328 wrote to memory of 3532 2328 thbttn.exe 92 PID 3532 wrote to memory of 2384 3532 tbthtn.exe 93 PID 3532 wrote to memory of 2384 3532 tbthtn.exe 93 PID 3532 wrote to memory of 2384 3532 tbthtn.exe 93 PID 2384 wrote to memory of 4796 2384 bbnntn.exe 95 PID 2384 wrote to memory of 4796 2384 bbnntn.exe 95 PID 2384 wrote to memory of 4796 2384 bbnntn.exe 95 PID 4796 wrote to memory of 3284 4796 dvpjd.exe 96 PID 4796 wrote to memory of 3284 4796 dvpjd.exe 96 PID 4796 wrote to memory of 3284 4796 dvpjd.exe 96 PID 3284 wrote to memory of 4956 3284 3xfxffx.exe 97 PID 3284 wrote to memory of 4956 3284 3xfxffx.exe 97 PID 3284 wrote to memory of 4956 3284 3xfxffx.exe 97 PID 4956 wrote to memory of 960 4956 htthhh.exe 98 PID 4956 wrote to memory of 960 4956 htthhh.exe 98 PID 4956 wrote to memory of 960 4956 htthhh.exe 98 PID 960 wrote to memory of 2840 960 jjjpj.exe 99 PID 960 wrote to memory of 2840 960 jjjpj.exe 99 PID 960 wrote to memory of 2840 960 jjjpj.exe 99 PID 2840 wrote to memory of 3564 2840 rxllrll.exe 100 PID 2840 wrote to memory of 3564 2840 rxllrll.exe 100 PID 2840 wrote to memory of 3564 2840 rxllrll.exe 100 PID 3564 wrote to memory of 4752 3564 rrlrrrr.exe 101 PID 3564 wrote to memory of 4752 3564 rrlrrrr.exe 101 PID 3564 wrote to memory of 4752 3564 rrlrrrr.exe 101 PID 4752 wrote to memory of 4772 4752 nhhtbt.exe 102 PID 4752 wrote to memory of 4772 4752 nhhtbt.exe 102 PID 4752 wrote to memory of 4772 4752 nhhtbt.exe 102 PID 4772 wrote to memory of 2236 4772 vddpv.exe 103 PID 4772 wrote to memory of 2236 4772 vddpv.exe 103 PID 4772 wrote to memory of 2236 4772 vddpv.exe 103 PID 2236 wrote to memory of 4668 2236 7lrlflf.exe 104 PID 2236 wrote to memory of 4668 2236 7lrlflf.exe 104 PID 2236 wrote to memory of 4668 2236 7lrlflf.exe 104 PID 4668 wrote to memory of 1432 4668 nnnnhb.exe 105 PID 4668 wrote to memory of 1432 4668 nnnnhb.exe 105 PID 4668 wrote to memory of 1432 4668 nnnnhb.exe 105 PID 1432 wrote to memory of 4420 1432 jvjdj.exe 106 PID 1432 wrote to memory of 4420 1432 jvjdj.exe 106 PID 1432 wrote to memory of 4420 1432 jvjdj.exe 106 PID 4420 wrote to memory of 1268 4420 1lxlxxl.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c33d5e90e52bf7c2d996c28560f5570_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2c33d5e90e52bf7c2d996c28560f5570_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\lfxrlll.exec:\lfxrlll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
\??\c:\btnhbb.exec:\btnhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\xlrrlll.exec:\xlrrlll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\hnbttt.exec:\hnbttt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\pvvjv.exec:\pvvjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\rfxrlrl.exec:\rfxrlrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\thbttn.exec:\thbttn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\tbthtn.exec:\tbthtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\bbnntn.exec:\bbnntn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\dvpjd.exec:\dvpjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\3xfxffx.exec:\3xfxffx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
\??\c:\htthhh.exec:\htthhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\jjjpj.exec:\jjjpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
\??\c:\rxllrll.exec:\rxllrll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\rrlrrrr.exec:\rrlrrrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
\??\c:\nhhtbt.exec:\nhhtbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\vddpv.exec:\vddpv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\7lrlflf.exec:\7lrlflf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\nnnnhb.exec:\nnnnhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
\??\c:\jvjdj.exec:\jvjdj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\1lxlxxl.exec:\1lxlxxl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\bhbnhh.exec:\bhbnhh.exe23⤵
- Executes dropped EXE
PID:1268 -
\??\c:\9jpjj.exec:\9jpjj.exe24⤵
- Executes dropped EXE
PID:3668 -
\??\c:\pvjjv.exec:\pvjjv.exe25⤵
- Executes dropped EXE
PID:2744 -
\??\c:\tbnnhb.exec:\tbnnhb.exe26⤵
- Executes dropped EXE
PID:3004 -
\??\c:\hnnbtn.exec:\hnnbtn.exe27⤵
- Executes dropped EXE
PID:3544 -
\??\c:\pjdvp.exec:\pjdvp.exe28⤵
- Executes dropped EXE
PID:3596 -
\??\c:\rfxrlfx.exec:\rfxrlfx.exe29⤵
- Executes dropped EXE
PID:3016 -
\??\c:\hnntnn.exec:\hnntnn.exe30⤵
- Executes dropped EXE
PID:424 -
\??\c:\jddjj.exec:\jddjj.exe31⤵
- Executes dropped EXE
PID:3220 -
\??\c:\lrxxrrl.exec:\lrxxrrl.exe32⤵
- Executes dropped EXE
PID:2212 -
\??\c:\tbnhtb.exec:\tbnhtb.exe33⤵
- Executes dropped EXE
PID:2348 -
\??\c:\dvdvv.exec:\dvdvv.exe34⤵
- Executes dropped EXE
PID:4508 -
\??\c:\rlllfll.exec:\rlllfll.exe35⤵
- Executes dropped EXE
PID:3044 -
\??\c:\ttbthn.exec:\ttbthn.exe36⤵
- Executes dropped EXE
PID:4568 -
\??\c:\pvppp.exec:\pvppp.exe37⤵
- Executes dropped EXE
PID:4908 -
\??\c:\9bbttt.exec:\9bbttt.exe38⤵
- Executes dropped EXE
PID:2800 -
\??\c:\ppppj.exec:\ppppj.exe39⤵
- Executes dropped EXE
PID:3664 -
\??\c:\pddvp.exec:\pddvp.exe40⤵
- Executes dropped EXE
PID:3476 -
\??\c:\fxfxxxr.exec:\fxfxxxr.exe41⤵
- Executes dropped EXE
PID:1812 -
\??\c:\3xrlffx.exec:\3xrlffx.exe42⤵
- Executes dropped EXE
PID:2440 -
\??\c:\bbtnhh.exec:\bbtnhh.exe43⤵
- Executes dropped EXE
PID:5096 -
\??\c:\jvjdd.exec:\jvjdd.exe44⤵
- Executes dropped EXE
PID:4216 -
\??\c:\7pjdv.exec:\7pjdv.exe45⤵
- Executes dropped EXE
PID:4944 -
\??\c:\rxffffx.exec:\rxffffx.exe46⤵
- Executes dropped EXE
PID:400 -
\??\c:\3nttnn.exec:\3nttnn.exe47⤵
- Executes dropped EXE
PID:1428 -
\??\c:\ddvvd.exec:\ddvvd.exe48⤵
- Executes dropped EXE
PID:2428 -
\??\c:\3xxfxff.exec:\3xxfxff.exe49⤵
- Executes dropped EXE
PID:3792 -
\??\c:\htnnbb.exec:\htnnbb.exe50⤵
- Executes dropped EXE
PID:4692 -
\??\c:\nhtttb.exec:\nhtttb.exe51⤵
- Executes dropped EXE
PID:3264 -
\??\c:\jdpjj.exec:\jdpjj.exe52⤵
- Executes dropped EXE
PID:2924 -
\??\c:\rxfrllf.exec:\rxfrllf.exe53⤵
- Executes dropped EXE
PID:2284 -
\??\c:\ttttnn.exec:\ttttnn.exe54⤵
- Executes dropped EXE
PID:4728 -
\??\c:\vjvjp.exec:\vjvjp.exe55⤵
- Executes dropped EXE
PID:4316 -
\??\c:\pvdvv.exec:\pvdvv.exe56⤵
- Executes dropped EXE
PID:5032 -
\??\c:\rffrxlf.exec:\rffrxlf.exe57⤵
- Executes dropped EXE
PID:4268 -
\??\c:\nhbbtt.exec:\nhbbtt.exe58⤵
- Executes dropped EXE
PID:2856 -
\??\c:\nhbbbb.exec:\nhbbbb.exe59⤵
- Executes dropped EXE
PID:4400 -
\??\c:\vppjj.exec:\vppjj.exe60⤵
- Executes dropped EXE
PID:4772 -
\??\c:\rflffff.exec:\rflffff.exe61⤵
- Executes dropped EXE
PID:2720 -
\??\c:\ddvpd.exec:\ddvpd.exe62⤵
- Executes dropped EXE
PID:736 -
\??\c:\ddjpd.exec:\ddjpd.exe63⤵
- Executes dropped EXE
PID:972 -
\??\c:\1xrlfxx.exec:\1xrlfxx.exe64⤵
- Executes dropped EXE
PID:2276 -
\??\c:\fflfxxl.exec:\fflfxxl.exe65⤵
- Executes dropped EXE
PID:3924 -
\??\c:\bnbttn.exec:\bnbttn.exe66⤵PID:1940
-
\??\c:\vjpjd.exec:\vjpjd.exe67⤵PID:1796
-
\??\c:\rxffxff.exec:\rxffxff.exe68⤵PID:3200
-
\??\c:\7hhbtt.exec:\7hhbtt.exe69⤵PID:2176
-
\??\c:\ntnhbb.exec:\ntnhbb.exe70⤵PID:3376
-
\??\c:\vjppj.exec:\vjppj.exe71⤵PID:2292
-
\??\c:\xxfxlll.exec:\xxfxlll.exe72⤵PID:1488
-
\??\c:\nhbbbb.exec:\nhbbbb.exe73⤵PID:5004
-
\??\c:\rflfxxr.exec:\rflfxxr.exe74⤵PID:2332
-
\??\c:\frxrxxr.exec:\frxrxxr.exe75⤵PID:4536
-
\??\c:\tnnhbb.exec:\tnnhbb.exe76⤵PID:4472
-
\??\c:\pppjv.exec:\pppjv.exe77⤵PID:1392
-
\??\c:\vjjjp.exec:\vjjjp.exe78⤵PID:4460
-
\??\c:\9llfffx.exec:\9llfffx.exe79⤵PID:4508
-
\??\c:\5ttnnn.exec:\5ttnnn.exe80⤵PID:712
-
\??\c:\hthbbb.exec:\hthbbb.exe81⤵PID:64
-
\??\c:\jpddp.exec:\jpddp.exe82⤵PID:536
-
\??\c:\flxxllx.exec:\flxxllx.exe83⤵PID:2616
-
\??\c:\1xllrrf.exec:\1xllrrf.exe84⤵PID:2800
-
\??\c:\btnnnn.exec:\btnnnn.exe85⤵PID:3664
-
\??\c:\bhtbhb.exec:\bhtbhb.exe86⤵PID:4592
-
\??\c:\vdvdv.exec:\vdvdv.exe87⤵PID:1900
-
\??\c:\llffffx.exec:\llffffx.exe88⤵PID:544
-
\??\c:\7lfxxxr.exec:\7lfxxxr.exe89⤵PID:1888
-
\??\c:\httttb.exec:\httttb.exe90⤵PID:4016
-
\??\c:\nhnhhh.exec:\nhnhhh.exe91⤵PID:3860
-
\??\c:\9vvvv.exec:\9vvvv.exe92⤵PID:5008
-
\??\c:\jdpdd.exec:\jdpdd.exe93⤵PID:3532
-
\??\c:\9xfxrxx.exec:\9xfxrxx.exe94⤵PID:2464
-
\??\c:\tthhnn.exec:\tthhnn.exe95⤵PID:2384
-
\??\c:\5jjjd.exec:\5jjjd.exe96⤵PID:4796
-
\??\c:\5xrrlrr.exec:\5xrrlrr.exe97⤵PID:1152
-
\??\c:\bthnhh.exec:\bthnhh.exe98⤵PID:2360
-
\??\c:\jjvpd.exec:\jjvpd.exe99⤵PID:3700
-
\??\c:\jvvvp.exec:\jvvvp.exe100⤵PID:2308
-
\??\c:\nhnhnn.exec:\nhnhnn.exe101⤵PID:4912
-
\??\c:\jjvpp.exec:\jjvpp.exe102⤵PID:3276
-
\??\c:\flllfxl.exec:\flllfxl.exe103⤵PID:4752
-
\??\c:\nhhhbb.exec:\nhhhbb.exe104⤵PID:1052
-
\??\c:\dvdjj.exec:\dvdjj.exe105⤵PID:3296
-
\??\c:\vpvdd.exec:\vpvdd.exe106⤵PID:2720
-
\??\c:\lrrflff.exec:\lrrflff.exe107⤵PID:3504
-
\??\c:\ntnntn.exec:\ntnntn.exe108⤵PID:3240
-
\??\c:\thtnnh.exec:\thtnnh.exe109⤵PID:3032
-
\??\c:\dvjdp.exec:\dvjdp.exe110⤵PID:2204
-
\??\c:\llflrlx.exec:\llflrlx.exe111⤵PID:4724
-
\??\c:\rllfxxx.exec:\rllfxxx.exe112⤵PID:4292
-
\??\c:\tnttnn.exec:\tnttnn.exe113⤵PID:1488
-
\??\c:\nhtnth.exec:\nhtnth.exe114⤵PID:5004
-
\??\c:\pdppj.exec:\pdppj.exe115⤵PID:2332
-
\??\c:\ppppp.exec:\ppppp.exe116⤵PID:944
-
\??\c:\xxfffll.exec:\xxfffll.exe117⤵PID:4256
-
\??\c:\7bbbtt.exec:\7bbbtt.exe118⤵PID:4464
-
\??\c:\pjppj.exec:\pjppj.exe119⤵PID:996
-
\??\c:\rlrrllr.exec:\rlrrllr.exe120⤵PID:3244
-
\??\c:\ntbbbb.exec:\ntbbbb.exe121⤵PID:1008
-
\??\c:\5vjpd.exec:\5vjpd.exe122⤵PID:4908
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-