Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 19:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
21e503679a62b666e270e1662410cb40_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
21e503679a62b666e270e1662410cb40_NeikiAnalytics.exe
-
Size
72KB
-
MD5
21e503679a62b666e270e1662410cb40
-
SHA1
9a1fac33d75ab7ce255e8cb4de4bdabe3e092014
-
SHA256
654baa2fe470c1f9f5c32d860220002af96c3e15f920ca4b101801119e1a8739
-
SHA512
f1b6ac105a27af12f83bb3015e2961b8f3ddcfc44687c4e468faf63a9615c973160123b736d01b50be7c49f515abb1e375bb0355b515b39b0c6cfc13410ca6dc
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIfv7+afCD+QsQbKQPVxX:ymb3NkkiQ3mdBjFIfvTfCD+HlQLX
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/1632-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3488-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1632-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3292-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2876-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2556-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2216-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1620-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2628-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3648-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2152-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3476-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2040-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4620-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2372-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3692-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2976-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4376-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3032-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/508-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3000-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3668-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3764-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3488 5lrllrx.exe 2876 7nthhh.exe 3292 9ttnhh.exe 2556 vpdvj.exe 2216 5xxfxrr.exe 1620 hbnntn.exe 2628 3vddd.exe 184 xllxflr.exe 2460 1rxxrxx.exe 3648 5hhhbb.exe 2152 jvvdv.exe 3476 lfllrfr.exe 4564 bbtbth.exe 4828 pddvp.exe 4908 rxflllf.exe 2040 hbbbhh.exe 4620 nnnttb.exe 2372 jjjjd.exe 3692 9rlllrl.exe 2976 tnbtbt.exe 4696 dvvdv.exe 4376 rrrxlxf.exe 3032 3bbnhh.exe 508 vvddp.exe 1988 pddvp.exe 3592 lffxrlf.exe 2992 rffrlff.exe 3000 3hhhht.exe 3668 jjjdv.exe 3764 3bhhbb.exe 4540 9hnnhn.exe 2412 pvpjv.exe 5084 9flfxlf.exe 4160 bnntnt.exe 2296 7pvdd.exe 3772 lxrlffx.exe 4580 9ttnhh.exe 1108 tnttnn.exe 4004 vdjjj.exe 928 vdddv.exe 5016 7rxrflf.exe 4828 rflrllf.exe 212 hbbnnt.exe 2436 tbntbb.exe 4456 pvppp.exe 2960 djvpj.exe 1596 rrrrlrl.exe 3692 xrrrlxx.exe 4888 hntthb.exe 4772 5hbtnb.exe 4644 djjjj.exe 3184 pjppd.exe 4244 xlffxxr.exe 1252 llfffff.exe 1664 nhhbtt.exe 3260 tbnnnb.exe 3592 3pvvp.exe 4900 1vvpp.exe 3540 lrlfrxf.exe 4724 ffxxxlf.exe 2112 nhnntt.exe 3764 9bbtnh.exe 5012 7jppj.exe 624 1pjjj.exe -
resource yara_rule behavioral2/memory/1632-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3488-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1632-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3292-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2876-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2556-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2216-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1620-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1620-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2628-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2152-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4620-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3692-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2976-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4376-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/508-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3000-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3764-196-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1632 wrote to memory of 3488 1632 21e503679a62b666e270e1662410cb40_NeikiAnalytics.exe 90 PID 1632 wrote to memory of 3488 1632 21e503679a62b666e270e1662410cb40_NeikiAnalytics.exe 90 PID 1632 wrote to memory of 3488 1632 21e503679a62b666e270e1662410cb40_NeikiAnalytics.exe 90 PID 3488 wrote to memory of 2876 3488 5lrllrx.exe 91 PID 3488 wrote to memory of 2876 3488 5lrllrx.exe 91 PID 3488 wrote to memory of 2876 3488 5lrllrx.exe 91 PID 2876 wrote to memory of 3292 2876 7nthhh.exe 92 PID 2876 wrote to memory of 3292 2876 7nthhh.exe 92 PID 2876 wrote to memory of 3292 2876 7nthhh.exe 92 PID 3292 wrote to memory of 2556 3292 9ttnhh.exe 93 PID 3292 wrote to memory of 2556 3292 9ttnhh.exe 93 PID 3292 wrote to memory of 2556 3292 9ttnhh.exe 93 PID 2556 wrote to memory of 2216 2556 vpdvj.exe 94 PID 2556 wrote to memory of 2216 2556 vpdvj.exe 94 PID 2556 wrote to memory of 2216 2556 vpdvj.exe 94 PID 2216 wrote to memory of 1620 2216 5xxfxrr.exe 95 PID 2216 wrote to memory of 1620 2216 5xxfxrr.exe 95 PID 2216 wrote to memory of 1620 2216 5xxfxrr.exe 95 PID 1620 wrote to memory of 2628 1620 hbnntn.exe 96 PID 1620 wrote to memory of 2628 1620 hbnntn.exe 96 PID 1620 wrote to memory of 2628 1620 hbnntn.exe 96 PID 2628 wrote to memory of 184 2628 3vddd.exe 97 PID 2628 wrote to memory of 184 2628 3vddd.exe 97 PID 2628 wrote to memory of 184 2628 3vddd.exe 97 PID 184 wrote to memory of 2460 184 xllxflr.exe 98 PID 184 wrote to memory of 2460 184 xllxflr.exe 98 PID 184 wrote to memory of 2460 184 xllxflr.exe 98 PID 2460 wrote to memory of 3648 2460 1rxxrxx.exe 99 PID 2460 wrote to memory of 3648 2460 1rxxrxx.exe 99 PID 2460 wrote to memory of 3648 2460 1rxxrxx.exe 99 PID 3648 wrote to memory of 2152 3648 5hhhbb.exe 100 PID 3648 wrote to memory of 2152 3648 5hhhbb.exe 100 PID 3648 wrote to memory of 2152 3648 5hhhbb.exe 100 PID 2152 wrote to memory of 3476 2152 jvvdv.exe 101 PID 2152 wrote to memory of 3476 2152 jvvdv.exe 101 PID 2152 wrote to memory of 3476 2152 jvvdv.exe 101 PID 3476 wrote to memory of 4564 3476 lfllrfr.exe 102 PID 3476 wrote to memory of 4564 3476 lfllrfr.exe 102 PID 3476 wrote to memory of 4564 3476 lfllrfr.exe 102 PID 4564 wrote to memory of 4828 4564 bbtbth.exe 103 PID 4564 wrote to memory of 4828 4564 bbtbth.exe 103 PID 4564 wrote to memory of 4828 4564 bbtbth.exe 103 PID 4828 wrote to memory of 4908 4828 pddvp.exe 104 PID 4828 wrote to memory of 4908 4828 pddvp.exe 104 PID 4828 wrote to memory of 4908 4828 pddvp.exe 104 PID 4908 wrote to memory of 2040 4908 rxflllf.exe 105 PID 4908 wrote to memory of 2040 4908 rxflllf.exe 105 PID 4908 wrote to memory of 2040 4908 rxflllf.exe 105 PID 2040 wrote to memory of 4620 2040 hbbbhh.exe 106 PID 2040 wrote to memory of 4620 2040 hbbbhh.exe 106 PID 2040 wrote to memory of 4620 2040 hbbbhh.exe 106 PID 4620 wrote to memory of 2372 4620 nnnttb.exe 107 PID 4620 wrote to memory of 2372 4620 nnnttb.exe 107 PID 4620 wrote to memory of 2372 4620 nnnttb.exe 107 PID 2372 wrote to memory of 3692 2372 jjjjd.exe 108 PID 2372 wrote to memory of 3692 2372 jjjjd.exe 108 PID 2372 wrote to memory of 3692 2372 jjjjd.exe 108 PID 3692 wrote to memory of 2976 3692 9rlllrl.exe 109 PID 3692 wrote to memory of 2976 3692 9rlllrl.exe 109 PID 3692 wrote to memory of 2976 3692 9rlllrl.exe 109 PID 2976 wrote to memory of 4696 2976 tnbtbt.exe 110 PID 2976 wrote to memory of 4696 2976 tnbtbt.exe 110 PID 2976 wrote to memory of 4696 2976 tnbtbt.exe 110 PID 4696 wrote to memory of 4376 4696 dvvdv.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\21e503679a62b666e270e1662410cb40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\21e503679a62b666e270e1662410cb40_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\5lrllrx.exec:\5lrllrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\7nthhh.exec:\7nthhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\9ttnhh.exec:\9ttnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\vpdvj.exec:\vpdvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\5xxfxrr.exec:\5xxfxrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\hbnntn.exec:\hbnntn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\3vddd.exec:\3vddd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\xllxflr.exec:\xllxflr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:184 -
\??\c:\1rxxrxx.exec:\1rxxrxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\5hhhbb.exec:\5hhhbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
\??\c:\jvvdv.exec:\jvvdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\lfllrfr.exec:\lfllrfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\bbtbth.exec:\bbtbth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\pddvp.exec:\pddvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\rxflllf.exec:\rxflllf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\hbbbhh.exec:\hbbbhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\nnnttb.exec:\nnnttb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\jjjjd.exec:\jjjjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\9rlllrl.exec:\9rlllrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\tnbtbt.exec:\tnbtbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\dvvdv.exec:\dvvdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\rrrxlxf.exec:\rrrxlxf.exe23⤵
- Executes dropped EXE
PID:4376 -
\??\c:\3bbnhh.exec:\3bbnhh.exe24⤵
- Executes dropped EXE
PID:3032 -
\??\c:\vvddp.exec:\vvddp.exe25⤵
- Executes dropped EXE
PID:508 -
\??\c:\pddvp.exec:\pddvp.exe26⤵
- Executes dropped EXE
PID:1988 -
\??\c:\lffxrlf.exec:\lffxrlf.exe27⤵
- Executes dropped EXE
PID:3592 -
\??\c:\rffrlff.exec:\rffrlff.exe28⤵
- Executes dropped EXE
PID:2992 -
\??\c:\3hhhht.exec:\3hhhht.exe29⤵
- Executes dropped EXE
PID:3000 -
\??\c:\jjjdv.exec:\jjjdv.exe30⤵
- Executes dropped EXE
PID:3668 -
\??\c:\3bhhbb.exec:\3bhhbb.exe31⤵
- Executes dropped EXE
PID:3764 -
\??\c:\9hnnhn.exec:\9hnnhn.exe32⤵
- Executes dropped EXE
PID:4540 -
\??\c:\pvpjv.exec:\pvpjv.exe33⤵
- Executes dropped EXE
PID:2412 -
\??\c:\9flfxlf.exec:\9flfxlf.exe34⤵
- Executes dropped EXE
PID:5084 -
\??\c:\bnntnt.exec:\bnntnt.exe35⤵
- Executes dropped EXE
PID:4160 -
\??\c:\7pvdd.exec:\7pvdd.exe36⤵
- Executes dropped EXE
PID:2296 -
\??\c:\lxrlffx.exec:\lxrlffx.exe37⤵
- Executes dropped EXE
PID:3772 -
\??\c:\9ttnhh.exec:\9ttnhh.exe38⤵
- Executes dropped EXE
PID:4580 -
\??\c:\tnttnn.exec:\tnttnn.exe39⤵
- Executes dropped EXE
PID:1108 -
\??\c:\vdjjj.exec:\vdjjj.exe40⤵
- Executes dropped EXE
PID:4004 -
\??\c:\vdddv.exec:\vdddv.exe41⤵
- Executes dropped EXE
PID:928 -
\??\c:\7rxrflf.exec:\7rxrflf.exe42⤵
- Executes dropped EXE
PID:5016 -
\??\c:\rflrllf.exec:\rflrllf.exe43⤵
- Executes dropped EXE
PID:4828 -
\??\c:\hbbnnt.exec:\hbbnnt.exe44⤵
- Executes dropped EXE
PID:212 -
\??\c:\tbntbb.exec:\tbntbb.exe45⤵
- Executes dropped EXE
PID:2436 -
\??\c:\pvppp.exec:\pvppp.exe46⤵
- Executes dropped EXE
PID:4456 -
\??\c:\djvpj.exec:\djvpj.exe47⤵
- Executes dropped EXE
PID:2960 -
\??\c:\rrrrlrl.exec:\rrrrlrl.exe48⤵
- Executes dropped EXE
PID:1596 -
\??\c:\xrrrlxx.exec:\xrrrlxx.exe49⤵
- Executes dropped EXE
PID:3692 -
\??\c:\hntthb.exec:\hntthb.exe50⤵
- Executes dropped EXE
PID:4888 -
\??\c:\5hbtnb.exec:\5hbtnb.exe51⤵
- Executes dropped EXE
PID:4772 -
\??\c:\djjjj.exec:\djjjj.exe52⤵
- Executes dropped EXE
PID:4644 -
\??\c:\pjppd.exec:\pjppd.exe53⤵
- Executes dropped EXE
PID:3184 -
\??\c:\xlffxxr.exec:\xlffxxr.exe54⤵
- Executes dropped EXE
PID:4244 -
\??\c:\llfffff.exec:\llfffff.exe55⤵
- Executes dropped EXE
PID:1252 -
\??\c:\nhhbtt.exec:\nhhbtt.exe56⤵
- Executes dropped EXE
PID:1664 -
\??\c:\tbnnnb.exec:\tbnnnb.exe57⤵
- Executes dropped EXE
PID:3260 -
\??\c:\3pvvp.exec:\3pvvp.exe58⤵
- Executes dropped EXE
PID:3592 -
\??\c:\1vvpp.exec:\1vvpp.exe59⤵
- Executes dropped EXE
PID:4900 -
\??\c:\lrlfrxf.exec:\lrlfrxf.exe60⤵
- Executes dropped EXE
PID:3540 -
\??\c:\ffxxxlf.exec:\ffxxxlf.exe61⤵
- Executes dropped EXE
PID:4724 -
\??\c:\nhnntt.exec:\nhnntt.exe62⤵
- Executes dropped EXE
PID:2112 -
\??\c:\9bbtnh.exec:\9bbtnh.exe63⤵
- Executes dropped EXE
PID:3764 -
\??\c:\7jppj.exec:\7jppj.exe64⤵
- Executes dropped EXE
PID:5012 -
\??\c:\1pjjj.exec:\1pjjj.exe65⤵
- Executes dropped EXE
PID:624 -
\??\c:\vvvjd.exec:\vvvjd.exe66⤵PID:944
-
\??\c:\lfrrrrr.exec:\lfrrrrr.exe67⤵PID:4584
-
\??\c:\xlrlfff.exec:\xlrlfff.exe68⤵PID:1228
-
\??\c:\thnhbb.exec:\thnhbb.exe69⤵PID:4160
-
\??\c:\btbbtt.exec:\btbbtt.exe70⤵PID:2044
-
\??\c:\dvvvv.exec:\dvvvv.exe71⤵PID:3772
-
\??\c:\ddjjj.exec:\ddjjj.exe72⤵PID:1624
-
\??\c:\fxlfrfx.exec:\fxlfrfx.exe73⤵PID:2328
-
\??\c:\xlrrlrl.exec:\xlrrlrl.exe74⤵PID:4004
-
\??\c:\9bhbhh.exec:\9bhbhh.exe75⤵PID:1628
-
\??\c:\hbbntn.exec:\hbbntn.exe76⤵PID:744
-
\??\c:\nnhhhn.exec:\nnhhhn.exe77⤵PID:4908
-
\??\c:\dvdvj.exec:\dvdvj.exe78⤵PID:212
-
\??\c:\pjddp.exec:\pjddp.exe79⤵PID:2436
-
\??\c:\rlfxrrr.exec:\rlfxrrr.exe80⤵PID:2372
-
\??\c:\llffxxr.exec:\llffxxr.exe81⤵PID:552
-
\??\c:\htnthh.exec:\htnthh.exe82⤵PID:2116
-
\??\c:\bthbbb.exec:\bthbbb.exe83⤵PID:2976
-
\??\c:\pjpjd.exec:\pjpjd.exe84⤵PID:4480
-
\??\c:\7jpjj.exec:\7jpjj.exe85⤵PID:4488
-
\??\c:\rrxrrrr.exec:\rrxrrrr.exe86⤵PID:3248
-
\??\c:\hbthtt.exec:\hbthtt.exe87⤵PID:2752
-
\??\c:\ntbhbb.exec:\ntbhbb.exe88⤵PID:4384
-
\??\c:\dddjj.exec:\dddjj.exe89⤵PID:2292
-
\??\c:\jvvpj.exec:\jvvpj.exe90⤵PID:4288
-
\??\c:\ffxxfll.exec:\ffxxfll.exe91⤵PID:4320
-
\??\c:\llrlfff.exec:\llrlfff.exe92⤵PID:3188
-
\??\c:\5bbhhn.exec:\5bbhhn.exe93⤵PID:3532
-
\??\c:\ppjvp.exec:\ppjvp.exe94⤵PID:2796
-
\??\c:\9dvvv.exec:\9dvvv.exe95⤵PID:4896
-
\??\c:\9rxrfff.exec:\9rxrfff.exe96⤵PID:228
-
\??\c:\3xxxrxr.exec:\3xxxrxr.exe97⤵PID:3104
-
\??\c:\3tbbbb.exec:\3tbbbb.exe98⤵PID:4720
-
\??\c:\hhhnht.exec:\hhhnht.exe99⤵PID:2876
-
\??\c:\ppppd.exec:\ppppd.exe100⤵PID:4020
-
\??\c:\dpvdd.exec:\dpvdd.exe101⤵PID:364
-
\??\c:\ffxrllf.exec:\ffxrllf.exe102⤵PID:4172
-
\??\c:\frxxrrr.exec:\frxxrrr.exe103⤵PID:3264
-
\??\c:\hntnnn.exec:\hntnnn.exe104⤵PID:2152
-
\??\c:\ntnhhn.exec:\ntnhhn.exe105⤵PID:2580
-
\??\c:\ppjjj.exec:\ppjjj.exe106⤵PID:3048
-
\??\c:\pvjjj.exec:\pvjjj.exe107⤵PID:2764
-
\??\c:\rllfrrr.exec:\rllfrrr.exe108⤵PID:2564
-
\??\c:\7lllfll.exec:\7lllfll.exe109⤵PID:1468
-
\??\c:\tnnhnh.exec:\tnnhnh.exe110⤵PID:3576
-
\??\c:\bhbttb.exec:\bhbttb.exe111⤵PID:972
-
\??\c:\jdjdv.exec:\jdjdv.exe112⤵PID:2348
-
\??\c:\fxrllll.exec:\fxrllll.exe113⤵PID:1584
-
\??\c:\ffxxrrf.exec:\ffxxrrf.exe114⤵PID:1048
-
\??\c:\thnnhh.exec:\thnnhh.exe115⤵PID:840
-
\??\c:\hbbttn.exec:\hbbttn.exe116⤵PID:1740
-
\??\c:\nbnhtb.exec:\nbnhtb.exe117⤵PID:4480
-
\??\c:\1pvpj.exec:\1pvpj.exe118⤵PID:3788
-
\??\c:\ddvpp.exec:\ddvpp.exe119⤵PID:1160
-
\??\c:\fxxxxxr.exec:\fxxxxxr.exe120⤵PID:2752
-
\??\c:\xrrllll.exec:\xrrllll.exe121⤵PID:1952
-
\??\c:\5flfxrl.exec:\5flfxrl.exe122⤵PID:4592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-