Analysis
-
max time kernel
150s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
14/06/2024, 10:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b716963946e2f99989a6f17de94f25e0_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
b716963946e2f99989a6f17de94f25e0_NeikiAnalytics.exe
-
Size
966KB
-
MD5
b716963946e2f99989a6f17de94f25e0
-
SHA1
0426d4d8bb38f8b4196f82c7b9cf433470153007
-
SHA256
22f3dcfa88dd3d383c587f562a1cadc08a00fac24d794f51cf4f1921fdba9e5d
-
SHA512
6f4cf78cc82e8a5a98222b3f9e5b546d36133c728963c7067e1335af04ba5b1d54228ca3fa68a543a93db0ef9e41bb09e8db07f34cbb158783a0c3ee66fb94c9
-
SSDEEP
12288:n3C9ytvngQjy3C9I3YEWpYe+GalTLfOX+I3C9S3C9ytvngQj65syLr9fuWpw:SgdnJVwLgdnJq9fu3
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/4612-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1432-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1576-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1712-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3612-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4424-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1320-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1140-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4620-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1484-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1420-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4476-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2940-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2708-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2612-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2908-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4320-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4056-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4716-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/572-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1432 bhtnhh.exe 1576 lxxlfxr.exe 1712 nhhtnh.exe 3612 jjvdp.exe 4424 hnnbtn.exe 4688 vddpd.exe 1320 jpppd.exe 1140 tnnnhn.exe 4620 bntnbb.exe 4824 rffxlfr.exe 1484 1rxllfr.exe 1420 hbhbnb.exe 4476 dpvvp.exe 2940 vddvd.exe 2708 7xxlxxl.exe 2612 pdpjd.exe 2908 jdjpd.exe 1928 9nnhbt.exe 4320 vjjvj.exe 4056 pvddv.exe 1568 dddvp.exe 1208 httnhb.exe 1192 5vpjp.exe 2888 jjdvd.exe 4660 lrlrfrf.exe 4536 ddjvj.exe 4428 xrrlffr.exe 4716 nbnbbt.exe 4280 rxxrrlf.exe 572 nhhbnb.exe 4228 vdpvv.exe 968 9vdvp.exe 2232 9ffxrrl.exe 4952 vjpjv.exe 2996 pjjdv.exe 2676 llrfrfl.exe 2320 tnbntn.exe 1468 vpvpj.exe 2036 7nthtt.exe 5104 3ntnht.exe 1492 llrlfxr.exe 1892 jddvv.exe 4300 ffllxrl.exe 4496 tntnhh.exe 3632 jdjvv.exe 2204 lrrfxrl.exe 8 pdjdd.exe 3540 vpvvv.exe 3836 1nnhnb.exe 1420 pvdjv.exe 1920 xrrllll.exe 2784 btnhbt.exe 2708 pjpjj.exe 2252 llrlxxf.exe 756 3bbbtt.exe 3336 1jjdj.exe 2932 rflllll.exe 4892 jdjdd.exe 2300 xlrlfxl.exe 2416 nnnnhh.exe 3760 vvppj.exe 3704 xlxxxxx.exe 1192 tthbtn.exe 2888 dvdpp.exe -
resource yara_rule behavioral2/memory/4612-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1432-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1576-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1712-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3612-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3612-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1320-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1140-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4620-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4620-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1484-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1420-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2940-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2708-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2612-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2908-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4320-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4056-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4428-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4716-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/572-199-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4612 wrote to memory of 1432 4612 b716963946e2f99989a6f17de94f25e0_NeikiAnalytics.exe 85 PID 4612 wrote to memory of 1432 4612 b716963946e2f99989a6f17de94f25e0_NeikiAnalytics.exe 85 PID 4612 wrote to memory of 1432 4612 b716963946e2f99989a6f17de94f25e0_NeikiAnalytics.exe 85 PID 1432 wrote to memory of 1576 1432 bhtnhh.exe 87 PID 1432 wrote to memory of 1576 1432 bhtnhh.exe 87 PID 1432 wrote to memory of 1576 1432 bhtnhh.exe 87 PID 1576 wrote to memory of 1712 1576 lxxlfxr.exe 88 PID 1576 wrote to memory of 1712 1576 lxxlfxr.exe 88 PID 1576 wrote to memory of 1712 1576 lxxlfxr.exe 88 PID 1712 wrote to memory of 3612 1712 nhhtnh.exe 90 PID 1712 wrote to memory of 3612 1712 nhhtnh.exe 90 PID 1712 wrote to memory of 3612 1712 nhhtnh.exe 90 PID 3612 wrote to memory of 4424 3612 jjvdp.exe 92 PID 3612 wrote to memory of 4424 3612 jjvdp.exe 92 PID 3612 wrote to memory of 4424 3612 jjvdp.exe 92 PID 4424 wrote to memory of 4688 4424 hnnbtn.exe 93 PID 4424 wrote to memory of 4688 4424 hnnbtn.exe 93 PID 4424 wrote to memory of 4688 4424 hnnbtn.exe 93 PID 4688 wrote to memory of 1320 4688 vddpd.exe 94 PID 4688 wrote to memory of 1320 4688 vddpd.exe 94 PID 4688 wrote to memory of 1320 4688 vddpd.exe 94 PID 1320 wrote to memory of 1140 1320 jpppd.exe 95 PID 1320 wrote to memory of 1140 1320 jpppd.exe 95 PID 1320 wrote to memory of 1140 1320 jpppd.exe 95 PID 1140 wrote to memory of 4620 1140 tnnnhn.exe 96 PID 1140 wrote to memory of 4620 1140 tnnnhn.exe 96 PID 1140 wrote to memory of 4620 1140 tnnnhn.exe 96 PID 4620 wrote to memory of 4824 4620 bntnbb.exe 97 PID 4620 wrote to memory of 4824 4620 bntnbb.exe 97 PID 4620 wrote to memory of 4824 4620 bntnbb.exe 97 PID 4824 wrote to memory of 1484 4824 rffxlfr.exe 98 PID 4824 wrote to memory of 1484 4824 rffxlfr.exe 98 PID 4824 wrote to memory of 1484 4824 rffxlfr.exe 98 PID 1484 wrote to memory of 1420 1484 1rxllfr.exe 99 PID 1484 wrote to memory of 1420 1484 1rxllfr.exe 99 PID 1484 wrote to memory of 1420 1484 1rxllfr.exe 99 PID 1420 wrote to memory of 4476 1420 hbhbnb.exe 100 PID 1420 wrote to memory of 4476 1420 hbhbnb.exe 100 PID 1420 wrote to memory of 4476 1420 hbhbnb.exe 100 PID 4476 wrote to memory of 2940 4476 dpvvp.exe 101 PID 4476 wrote to memory of 2940 4476 dpvvp.exe 101 PID 4476 wrote to memory of 2940 4476 dpvvp.exe 101 PID 2940 wrote to memory of 2708 2940 vddvd.exe 102 PID 2940 wrote to memory of 2708 2940 vddvd.exe 102 PID 2940 wrote to memory of 2708 2940 vddvd.exe 102 PID 2708 wrote to memory of 2612 2708 7xxlxxl.exe 103 PID 2708 wrote to memory of 2612 2708 7xxlxxl.exe 103 PID 2708 wrote to memory of 2612 2708 7xxlxxl.exe 103 PID 2612 wrote to memory of 2908 2612 pdpjd.exe 104 PID 2612 wrote to memory of 2908 2612 pdpjd.exe 104 PID 2612 wrote to memory of 2908 2612 pdpjd.exe 104 PID 2908 wrote to memory of 1928 2908 jdjpd.exe 105 PID 2908 wrote to memory of 1928 2908 jdjpd.exe 105 PID 2908 wrote to memory of 1928 2908 jdjpd.exe 105 PID 1928 wrote to memory of 4320 1928 9nnhbt.exe 106 PID 1928 wrote to memory of 4320 1928 9nnhbt.exe 106 PID 1928 wrote to memory of 4320 1928 9nnhbt.exe 106 PID 4320 wrote to memory of 4056 4320 vjjvj.exe 107 PID 4320 wrote to memory of 4056 4320 vjjvj.exe 107 PID 4320 wrote to memory of 4056 4320 vjjvj.exe 107 PID 4056 wrote to memory of 1568 4056 pvddv.exe 108 PID 4056 wrote to memory of 1568 4056 pvddv.exe 108 PID 4056 wrote to memory of 1568 4056 pvddv.exe 108 PID 1568 wrote to memory of 1208 1568 dddvp.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\b716963946e2f99989a6f17de94f25e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b716963946e2f99989a6f17de94f25e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\bhtnhh.exec:\bhtnhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\lxxlfxr.exec:\lxxlfxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\nhhtnh.exec:\nhhtnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\jjvdp.exec:\jjvdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\hnnbtn.exec:\hnnbtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\vddpd.exec:\vddpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\jpppd.exec:\jpppd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\tnnnhn.exec:\tnnnhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
\??\c:\bntnbb.exec:\bntnbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\rffxlfr.exec:\rffxlfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\1rxllfr.exec:\1rxllfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\hbhbnb.exec:\hbhbnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\dpvvp.exec:\dpvvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\vddvd.exec:\vddvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\7xxlxxl.exec:\7xxlxxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\pdpjd.exec:\pdpjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\jdjpd.exec:\jdjpd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\9nnhbt.exec:\9nnhbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\vjjvj.exec:\vjjvj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\pvddv.exec:\pvddv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\dddvp.exec:\dddvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\httnhb.exec:\httnhb.exe23⤵
- Executes dropped EXE
PID:1208 -
\??\c:\5vpjp.exec:\5vpjp.exe24⤵
- Executes dropped EXE
PID:1192 -
\??\c:\jjdvd.exec:\jjdvd.exe25⤵
- Executes dropped EXE
PID:2888 -
\??\c:\lrlrfrf.exec:\lrlrfrf.exe26⤵
- Executes dropped EXE
PID:4660 -
\??\c:\ddjvj.exec:\ddjvj.exe27⤵
- Executes dropped EXE
PID:4536 -
\??\c:\xrrlffr.exec:\xrrlffr.exe28⤵
- Executes dropped EXE
PID:4428 -
\??\c:\nbnbbt.exec:\nbnbbt.exe29⤵
- Executes dropped EXE
PID:4716 -
\??\c:\rxxrrlf.exec:\rxxrrlf.exe30⤵
- Executes dropped EXE
PID:4280 -
\??\c:\nhhbnb.exec:\nhhbnb.exe31⤵
- Executes dropped EXE
PID:572 -
\??\c:\vdpvv.exec:\vdpvv.exe32⤵
- Executes dropped EXE
PID:4228 -
\??\c:\9vdvp.exec:\9vdvp.exe33⤵
- Executes dropped EXE
PID:968 -
\??\c:\9ffxrrl.exec:\9ffxrrl.exe34⤵
- Executes dropped EXE
PID:2232 -
\??\c:\vjpjv.exec:\vjpjv.exe35⤵
- Executes dropped EXE
PID:4952 -
\??\c:\pjjdv.exec:\pjjdv.exe36⤵
- Executes dropped EXE
PID:2996 -
\??\c:\llrfrfl.exec:\llrfrfl.exe37⤵
- Executes dropped EXE
PID:2676 -
\??\c:\tnbntn.exec:\tnbntn.exe38⤵
- Executes dropped EXE
PID:2320 -
\??\c:\vpvpj.exec:\vpvpj.exe39⤵
- Executes dropped EXE
PID:1468 -
\??\c:\7nthtt.exec:\7nthtt.exe40⤵
- Executes dropped EXE
PID:2036 -
\??\c:\3ntnht.exec:\3ntnht.exe41⤵
- Executes dropped EXE
PID:5104 -
\??\c:\llrlfxr.exec:\llrlfxr.exe42⤵
- Executes dropped EXE
PID:1492 -
\??\c:\jddvv.exec:\jddvv.exe43⤵
- Executes dropped EXE
PID:1892 -
\??\c:\ffllxrl.exec:\ffllxrl.exe44⤵
- Executes dropped EXE
PID:4300 -
\??\c:\tntnhh.exec:\tntnhh.exe45⤵
- Executes dropped EXE
PID:4496 -
\??\c:\jdjvv.exec:\jdjvv.exe46⤵
- Executes dropped EXE
PID:3632 -
\??\c:\lrrfxrl.exec:\lrrfxrl.exe47⤵
- Executes dropped EXE
PID:2204 -
\??\c:\pdjdd.exec:\pdjdd.exe48⤵
- Executes dropped EXE
PID:8 -
\??\c:\vpvvv.exec:\vpvvv.exe49⤵
- Executes dropped EXE
PID:3540 -
\??\c:\1nnhnb.exec:\1nnhnb.exe50⤵
- Executes dropped EXE
PID:3836 -
\??\c:\pvdjv.exec:\pvdjv.exe51⤵
- Executes dropped EXE
PID:1420 -
\??\c:\xrrllll.exec:\xrrllll.exe52⤵
- Executes dropped EXE
PID:1920 -
\??\c:\btnhbt.exec:\btnhbt.exe53⤵
- Executes dropped EXE
PID:2784 -
\??\c:\pjpjj.exec:\pjpjj.exe54⤵
- Executes dropped EXE
PID:2708 -
\??\c:\llrlxxf.exec:\llrlxxf.exe55⤵
- Executes dropped EXE
PID:2252 -
\??\c:\3bbbtt.exec:\3bbbtt.exe56⤵
- Executes dropped EXE
PID:756 -
\??\c:\1jjdj.exec:\1jjdj.exe57⤵
- Executes dropped EXE
PID:3336 -
\??\c:\rflllll.exec:\rflllll.exe58⤵
- Executes dropped EXE
PID:2932 -
\??\c:\jdjdd.exec:\jdjdd.exe59⤵
- Executes dropped EXE
PID:4892 -
\??\c:\xlrlfxl.exec:\xlrlfxl.exe60⤵
- Executes dropped EXE
PID:2300 -
\??\c:\nnnnhh.exec:\nnnnhh.exe61⤵
- Executes dropped EXE
PID:2416 -
\??\c:\vvppj.exec:\vvppj.exe62⤵
- Executes dropped EXE
PID:3760 -
\??\c:\xlxxxxx.exec:\xlxxxxx.exe63⤵
- Executes dropped EXE
PID:3704 -
\??\c:\tthbtn.exec:\tthbtn.exe64⤵
- Executes dropped EXE
PID:1192 -
\??\c:\dvdpp.exec:\dvdpp.exe65⤵
- Executes dropped EXE
PID:2888 -
\??\c:\nhhbnn.exec:\nhhbnn.exe66⤵PID:3340
-
\??\c:\vpdvp.exec:\vpdvp.exe67⤵PID:4256
-
\??\c:\3lrlxrf.exec:\3lrlxrf.exe68⤵PID:2820
-
\??\c:\thbtnh.exec:\thbtnh.exe69⤵PID:3164
-
\??\c:\jddpv.exec:\jddpv.exe70⤵PID:1128
-
\??\c:\lflfxrl.exec:\lflfxrl.exe71⤵PID:4328
-
\??\c:\ntbnht.exec:\ntbnht.exe72⤵PID:3260
-
\??\c:\djjvp.exec:\djjvp.exe73⤵PID:4336
-
\??\c:\3rxrxxx.exec:\3rxrxxx.exe74⤵PID:3892
-
\??\c:\dddvp.exec:\dddvp.exe75⤵PID:4956
-
\??\c:\jddpd.exec:\jddpd.exe76⤵PID:4864
-
\??\c:\bbtnhh.exec:\bbtnhh.exe77⤵PID:2232
-
\??\c:\vvvjv.exec:\vvvjv.exe78⤵PID:1228
-
\??\c:\lfxrlfx.exec:\lfxrlfx.exe79⤵PID:1556
-
\??\c:\9tnbbt.exec:\9tnbbt.exe80⤵PID:2676
-
\??\c:\ppvjd.exec:\ppvjd.exe81⤵PID:2320
-
\??\c:\rfrflff.exec:\rfrflff.exe82⤵PID:772
-
\??\c:\hbhbtn.exec:\hbhbtn.exe83⤵PID:1072
-
\??\c:\vddvp.exec:\vddvp.exe84⤵PID:5104
-
\??\c:\lffffxf.exec:\lffffxf.exe85⤵PID:4848
-
\??\c:\nbhhnh.exec:\nbhhnh.exe86⤵PID:1340
-
\??\c:\jpvjv.exec:\jpvjv.exe87⤵PID:2792
-
\??\c:\1llxrfr.exec:\1llxrfr.exe88⤵PID:4632
-
\??\c:\tbbthb.exec:\tbbthb.exe89⤵PID:1068
-
\??\c:\rflxrxl.exec:\rflxrxl.exe90⤵PID:4972
-
\??\c:\nbbbnn.exec:\nbbbnn.exe91⤵PID:1484
-
\??\c:\dpvdv.exec:\dpvdv.exe92⤵PID:2452
-
\??\c:\xffxllf.exec:\xffxllf.exe93⤵PID:884
-
\??\c:\thbthb.exec:\thbthb.exe94⤵PID:2940
-
\??\c:\pjjdv.exec:\pjjdv.exe95⤵PID:3264
-
\??\c:\rrfxrlx.exec:\rrfxrlx.exe96⤵PID:1848
-
\??\c:\thhtnh.exec:\thhtnh.exe97⤵PID:3328
-
\??\c:\vpvpv.exec:\vpvpv.exe98⤵PID:2908
-
\??\c:\fxxrfxl.exec:\fxxrfxl.exe99⤵PID:3676
-
\??\c:\jvvvv.exec:\jvvvv.exe100⤵PID:4320
-
\??\c:\lllxfff.exec:\lllxfff.exe101⤵PID:3964
-
\??\c:\ntbtnh.exec:\ntbtnh.exe102⤵PID:2228
-
\??\c:\vpjvj.exec:\vpjvj.exe103⤵PID:3028
-
\??\c:\5rlrlff.exec:\5rlrlff.exe104⤵PID:2416
-
\??\c:\jdpjd.exec:\jdpjd.exe105⤵PID:1900
-
\??\c:\xffrlfx.exec:\xffrlfx.exe106⤵PID:4284
-
\??\c:\thnbtn.exec:\thnbtn.exe107⤵PID:4032
-
\??\c:\dppjd.exec:\dppjd.exe108⤵PID:3840
-
\??\c:\9rlfrrl.exec:\9rlfrrl.exe109⤵PID:3760
-
\??\c:\bhtnhb.exec:\bhtnhb.exe110⤵PID:2024
-
\??\c:\jdddd.exec:\jdddd.exe111⤵PID:4660
-
\??\c:\xffxxrr.exec:\xffxxrr.exe112⤵PID:4980
-
\??\c:\nhhbtt.exec:\nhhbtt.exe113⤵PID:2384
-
\??\c:\xrfxlll.exec:\xrfxlll.exe114⤵PID:2840
-
\??\c:\nbhbbb.exec:\nbhbbb.exe115⤵PID:1668
-
\??\c:\jpvpd.exec:\jpvpd.exe116⤵PID:5056
-
\??\c:\bhtnhb.exec:\bhtnhb.exe117⤵PID:4692
-
\??\c:\jpddv.exec:\jpddv.exe118⤵PID:4352
-
\??\c:\9rfxrrl.exec:\9rfxrrl.exe119⤵PID:1316
-
\??\c:\hthhbb.exec:\hthhbb.exe120⤵PID:4976
-
\??\c:\7dvjj.exec:\7dvjj.exe121⤵PID:2164
-
\??\c:\5xlrxrr.exec:\5xlrxrr.exe122⤵PID:4860
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-