Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
13-05-2024 17:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bfcc09368ed99958968933ed3065fa40_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
bfcc09368ed99958968933ed3065fa40_NeikiAnalytics.exe
-
Size
94KB
-
MD5
bfcc09368ed99958968933ed3065fa40
-
SHA1
c3ea9a6c8ba17149e1ee83e4f6fdae6c46ef03b1
-
SHA256
79c73d8395a231a586d5e6b8c144a021443d4ef1a4e8335a1eceb1d1dc982021
-
SHA512
691ebdda08f6d48bbe0dcc77f260bd7864690f98c33dfff251e487cf15566094e93bca8c5c12d7f0ad1607ef3878336fc880267014c4cad38b6ec1bce310f152
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxEPOfPrA2:ymb3NkkiQ3mdBjFo73PYP1lri3KuOnrL
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/3876-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4620-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4408-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3908-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3636-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4292-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2280-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5028-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1620-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3304-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4488-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1756-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3896-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4352-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/940-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4616-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2568-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2728-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4620 rxllxlf.exe 4408 1nthbt.exe 3908 dpppd.exe 3636 rffrffr.exe 2028 tthbnn.exe 4292 9tnhnn.exe 2280 1dvjd.exe 5028 xxrlxrl.exe 4976 1lrfxxl.exe 1620 tnbhbn.exe 4524 vpjvj.exe 3304 rfrlxfl.exe 4488 httnhh.exe 4904 jpdpj.exe 220 frxrxfr.exe 1756 5thhhh.exe 3836 5tbthh.exe 4440 dddpv.exe 3896 lxfxlll.exe 4352 btnnhh.exe 5084 vvppv.exe 940 pdjdd.exe 4424 fxfflxl.exe 2344 tttnht.exe 4616 lxllxxx.exe 2568 nhbnhh.exe 1540 dpvvv.exe 4004 rrxxxrx.exe 4852 frxfxlf.exe 3800 nhnhtt.exe 2728 jjdjp.exe 3184 ppjjj.exe 4980 rrxllxx.exe 228 rxlrrfl.exe 1884 btnnnn.exe 4676 7ddjd.exe 4772 jjppv.exe 1428 xrlfxxx.exe 3696 nbnbtn.exe 4492 ttnnnb.exe 2856 jdjdv.exe 1380 3xfxllf.exe 2340 llxrxxr.exe 4660 tnhtnh.exe 2028 ppjdv.exe 2228 vpdjv.exe 5116 7xfrxxr.exe 4588 5lrllfx.exe 1848 bttttb.exe 4420 1fxlrfx.exe 1620 lffxlfr.exe 3132 nbtthh.exe 5000 nbtnbt.exe 3304 ppjvj.exe 2348 lxflfxr.exe 924 llrxrrl.exe 4828 nhhhbb.exe 5076 dvdpp.exe 1360 fflllxf.exe 3488 hthbtn.exe 4228 9vdpv.exe 1280 jdpjd.exe 2968 ffxrfxl.exe 2256 7rxrlfx.exe -
resource yara_rule behavioral2/memory/3876-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4620-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3908-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3636-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4292-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5028-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5028-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5028-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5028-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1620-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3304-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4488-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1756-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3896-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4352-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/940-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2568-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2728-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3876 wrote to memory of 4620 3876 bfcc09368ed99958968933ed3065fa40_NeikiAnalytics.exe 82 PID 3876 wrote to memory of 4620 3876 bfcc09368ed99958968933ed3065fa40_NeikiAnalytics.exe 82 PID 3876 wrote to memory of 4620 3876 bfcc09368ed99958968933ed3065fa40_NeikiAnalytics.exe 82 PID 4620 wrote to memory of 4408 4620 rxllxlf.exe 83 PID 4620 wrote to memory of 4408 4620 rxllxlf.exe 83 PID 4620 wrote to memory of 4408 4620 rxllxlf.exe 83 PID 4408 wrote to memory of 3908 4408 1nthbt.exe 84 PID 4408 wrote to memory of 3908 4408 1nthbt.exe 84 PID 4408 wrote to memory of 3908 4408 1nthbt.exe 84 PID 3908 wrote to memory of 3636 3908 dpppd.exe 85 PID 3908 wrote to memory of 3636 3908 dpppd.exe 85 PID 3908 wrote to memory of 3636 3908 dpppd.exe 85 PID 3636 wrote to memory of 2028 3636 rffrffr.exe 86 PID 3636 wrote to memory of 2028 3636 rffrffr.exe 86 PID 3636 wrote to memory of 2028 3636 rffrffr.exe 86 PID 2028 wrote to memory of 4292 2028 tthbnn.exe 87 PID 2028 wrote to memory of 4292 2028 tthbnn.exe 87 PID 2028 wrote to memory of 4292 2028 tthbnn.exe 87 PID 4292 wrote to memory of 2280 4292 9tnhnn.exe 88 PID 4292 wrote to memory of 2280 4292 9tnhnn.exe 88 PID 4292 wrote to memory of 2280 4292 9tnhnn.exe 88 PID 2280 wrote to memory of 5028 2280 1dvjd.exe 89 PID 2280 wrote to memory of 5028 2280 1dvjd.exe 89 PID 2280 wrote to memory of 5028 2280 1dvjd.exe 89 PID 5028 wrote to memory of 4976 5028 xxrlxrl.exe 90 PID 5028 wrote to memory of 4976 5028 xxrlxrl.exe 90 PID 5028 wrote to memory of 4976 5028 xxrlxrl.exe 90 PID 4976 wrote to memory of 1620 4976 1lrfxxl.exe 91 PID 4976 wrote to memory of 1620 4976 1lrfxxl.exe 91 PID 4976 wrote to memory of 1620 4976 1lrfxxl.exe 91 PID 1620 wrote to memory of 4524 1620 tnbhbn.exe 92 PID 1620 wrote to memory of 4524 1620 tnbhbn.exe 92 PID 1620 wrote to memory of 4524 1620 tnbhbn.exe 92 PID 4524 wrote to memory of 3304 4524 vpjvj.exe 93 PID 4524 wrote to memory of 3304 4524 vpjvj.exe 93 PID 4524 wrote to memory of 3304 4524 vpjvj.exe 93 PID 3304 wrote to memory of 4488 3304 rfrlxfl.exe 94 PID 3304 wrote to memory of 4488 3304 rfrlxfl.exe 94 PID 3304 wrote to memory of 4488 3304 rfrlxfl.exe 94 PID 4488 wrote to memory of 4904 4488 httnhh.exe 95 PID 4488 wrote to memory of 4904 4488 httnhh.exe 95 PID 4488 wrote to memory of 4904 4488 httnhh.exe 95 PID 4904 wrote to memory of 220 4904 jpdpj.exe 96 PID 4904 wrote to memory of 220 4904 jpdpj.exe 96 PID 4904 wrote to memory of 220 4904 jpdpj.exe 96 PID 220 wrote to memory of 1756 220 frxrxfr.exe 97 PID 220 wrote to memory of 1756 220 frxrxfr.exe 97 PID 220 wrote to memory of 1756 220 frxrxfr.exe 97 PID 1756 wrote to memory of 3836 1756 5thhhh.exe 98 PID 1756 wrote to memory of 3836 1756 5thhhh.exe 98 PID 1756 wrote to memory of 3836 1756 5thhhh.exe 98 PID 3836 wrote to memory of 4440 3836 5tbthh.exe 99 PID 3836 wrote to memory of 4440 3836 5tbthh.exe 99 PID 3836 wrote to memory of 4440 3836 5tbthh.exe 99 PID 4440 wrote to memory of 3896 4440 dddpv.exe 100 PID 4440 wrote to memory of 3896 4440 dddpv.exe 100 PID 4440 wrote to memory of 3896 4440 dddpv.exe 100 PID 3896 wrote to memory of 4352 3896 lxfxlll.exe 101 PID 3896 wrote to memory of 4352 3896 lxfxlll.exe 101 PID 3896 wrote to memory of 4352 3896 lxfxlll.exe 101 PID 4352 wrote to memory of 5084 4352 btnnhh.exe 102 PID 4352 wrote to memory of 5084 4352 btnnhh.exe 102 PID 4352 wrote to memory of 5084 4352 btnnhh.exe 102 PID 5084 wrote to memory of 940 5084 vvppv.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfcc09368ed99958968933ed3065fa40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\bfcc09368ed99958968933ed3065fa40_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3876 -
\??\c:\rxllxlf.exec:\rxllxlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\1nthbt.exec:\1nthbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\dpppd.exec:\dpppd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
\??\c:\rffrffr.exec:\rffrffr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\tthbnn.exec:\tthbnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\9tnhnn.exec:\9tnhnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
\??\c:\1dvjd.exec:\1dvjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\xxrlxrl.exec:\xxrlxrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\1lrfxxl.exec:\1lrfxxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\tnbhbn.exec:\tnbhbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\vpjvj.exec:\vpjvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\rfrlxfl.exec:\rfrlxfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\httnhh.exec:\httnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\jpdpj.exec:\jpdpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\frxrxfr.exec:\frxrxfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\5thhhh.exec:\5thhhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\5tbthh.exec:\5tbthh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\dddpv.exec:\dddpv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\lxfxlll.exec:\lxfxlll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\btnnhh.exec:\btnnhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
\??\c:\vvppv.exec:\vvppv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\pdjdd.exec:\pdjdd.exe23⤵
- Executes dropped EXE
PID:940 -
\??\c:\fxfflxl.exec:\fxfflxl.exe24⤵
- Executes dropped EXE
PID:4424 -
\??\c:\tttnht.exec:\tttnht.exe25⤵
- Executes dropped EXE
PID:2344 -
\??\c:\lxllxxx.exec:\lxllxxx.exe26⤵
- Executes dropped EXE
PID:4616 -
\??\c:\nhbnhh.exec:\nhbnhh.exe27⤵
- Executes dropped EXE
PID:2568 -
\??\c:\dpvvv.exec:\dpvvv.exe28⤵
- Executes dropped EXE
PID:1540 -
\??\c:\rrxxxrx.exec:\rrxxxrx.exe29⤵
- Executes dropped EXE
PID:4004 -
\??\c:\frxfxlf.exec:\frxfxlf.exe30⤵
- Executes dropped EXE
PID:4852 -
\??\c:\nhnhtt.exec:\nhnhtt.exe31⤵
- Executes dropped EXE
PID:3800 -
\??\c:\jjdjp.exec:\jjdjp.exe32⤵
- Executes dropped EXE
PID:2728 -
\??\c:\ppjjj.exec:\ppjjj.exe33⤵
- Executes dropped EXE
PID:3184 -
\??\c:\rrxllxx.exec:\rrxllxx.exe34⤵
- Executes dropped EXE
PID:4980 -
\??\c:\rxlrrfl.exec:\rxlrrfl.exe35⤵
- Executes dropped EXE
PID:228 -
\??\c:\btnnnn.exec:\btnnnn.exe36⤵
- Executes dropped EXE
PID:1884 -
\??\c:\7ddjd.exec:\7ddjd.exe37⤵
- Executes dropped EXE
PID:4676 -
\??\c:\jjppv.exec:\jjppv.exe38⤵
- Executes dropped EXE
PID:4772 -
\??\c:\5lxrxfl.exec:\5lxrxfl.exe39⤵PID:4308
-
\??\c:\xrlfxxx.exec:\xrlfxxx.exe40⤵
- Executes dropped EXE
PID:1428 -
\??\c:\nbnbtn.exec:\nbnbtn.exe41⤵
- Executes dropped EXE
PID:3696 -
\??\c:\ttnnnb.exec:\ttnnnb.exe42⤵
- Executes dropped EXE
PID:4492 -
\??\c:\jdjdv.exec:\jdjdv.exe43⤵
- Executes dropped EXE
PID:2856 -
\??\c:\3xfxllf.exec:\3xfxllf.exe44⤵
- Executes dropped EXE
PID:1380 -
\??\c:\llxrxxr.exec:\llxrxxr.exe45⤵
- Executes dropped EXE
PID:2340 -
\??\c:\tnhtnh.exec:\tnhtnh.exe46⤵
- Executes dropped EXE
PID:4660 -
\??\c:\ppjdv.exec:\ppjdv.exe47⤵
- Executes dropped EXE
PID:2028 -
\??\c:\vpdjv.exec:\vpdjv.exe48⤵
- Executes dropped EXE
PID:2228 -
\??\c:\7xfrxxr.exec:\7xfrxxr.exe49⤵
- Executes dropped EXE
PID:5116 -
\??\c:\5lrllfx.exec:\5lrllfx.exe50⤵
- Executes dropped EXE
PID:4588 -
\??\c:\bttttb.exec:\bttttb.exe51⤵
- Executes dropped EXE
PID:1848 -
\??\c:\1fxlrfx.exec:\1fxlrfx.exe52⤵
- Executes dropped EXE
PID:4420 -
\??\c:\lffxlfr.exec:\lffxlfr.exe53⤵
- Executes dropped EXE
PID:1620 -
\??\c:\nbtthh.exec:\nbtthh.exe54⤵
- Executes dropped EXE
PID:3132 -
\??\c:\nbtnbt.exec:\nbtnbt.exe55⤵
- Executes dropped EXE
PID:5000 -
\??\c:\ppjvj.exec:\ppjvj.exe56⤵
- Executes dropped EXE
PID:3304 -
\??\c:\lxflfxr.exec:\lxflfxr.exe57⤵
- Executes dropped EXE
PID:2348 -
\??\c:\llrxrrl.exec:\llrxrrl.exe58⤵
- Executes dropped EXE
PID:924 -
\??\c:\nhhhbb.exec:\nhhhbb.exe59⤵
- Executes dropped EXE
PID:4828 -
\??\c:\dvdpp.exec:\dvdpp.exe60⤵
- Executes dropped EXE
PID:5076 -
\??\c:\fflllxf.exec:\fflllxf.exe61⤵
- Executes dropped EXE
PID:1360 -
\??\c:\hthbtn.exec:\hthbtn.exe62⤵
- Executes dropped EXE
PID:3488 -
\??\c:\9vdpv.exec:\9vdpv.exe63⤵
- Executes dropped EXE
PID:4228 -
\??\c:\jdpjd.exec:\jdpjd.exe64⤵
- Executes dropped EXE
PID:1280 -
\??\c:\ffxrfxl.exec:\ffxrfxl.exe65⤵
- Executes dropped EXE
PID:2968 -
\??\c:\7rxrlfx.exec:\7rxrlfx.exe66⤵
- Executes dropped EXE
PID:2256 -
\??\c:\nbthbt.exec:\nbthbt.exe67⤵PID:2332
-
\??\c:\bhbthb.exec:\bhbthb.exe68⤵PID:492
-
\??\c:\ddvvj.exec:\ddvvj.exe69⤵PID:4616
-
\??\c:\dpjdp.exec:\dpjdp.exe70⤵PID:5008
-
\??\c:\ffxxrrf.exec:\ffxxrrf.exe71⤵PID:4076
-
\??\c:\xrlfrlf.exec:\xrlfrlf.exe72⤵PID:2964
-
\??\c:\5ntnhb.exec:\5ntnhb.exe73⤵PID:1564
-
\??\c:\ddvvp.exec:\ddvvp.exe74⤵PID:4284
-
\??\c:\pjdpj.exec:\pjdpj.exe75⤵PID:5068
-
\??\c:\ffxrfxr.exec:\ffxrfxr.exe76⤵PID:3800
-
\??\c:\5rlrfll.exec:\5rlrfll.exe77⤵PID:2824
-
\??\c:\9bhtnh.exec:\9bhtnh.exe78⤵PID:3732
-
\??\c:\vpvvp.exec:\vpvvp.exe79⤵PID:1112
-
\??\c:\rxflfxl.exec:\rxflfxl.exe80⤵PID:4664
-
\??\c:\lfrlffx.exec:\lfrlffx.exe81⤵PID:4220
-
\??\c:\3btnhb.exec:\3btnhb.exe82⤵PID:4336
-
\??\c:\bhhbnn.exec:\bhhbnn.exe83⤵PID:1516
-
\??\c:\7ddvj.exec:\7ddvj.exe84⤵PID:1524
-
\??\c:\frflrlx.exec:\frflrlx.exe85⤵PID:4988
-
\??\c:\lfrfrfr.exec:\lfrfrfr.exe86⤵PID:1104
-
\??\c:\1bnhbt.exec:\1bnhbt.exe87⤵PID:4824
-
\??\c:\pdddv.exec:\pdddv.exe88⤵PID:4880
-
\??\c:\jdjpd.exec:\jdjpd.exe89⤵PID:3940
-
\??\c:\xrlxrfx.exec:\xrlxrfx.exe90⤵PID:1276
-
\??\c:\1ffxlfl.exec:\1ffxlfl.exe91⤵PID:4660
-
\??\c:\9bbtnh.exec:\9bbtnh.exe92⤵PID:2456
-
\??\c:\ttbtnn.exec:\ttbtnn.exe93⤵PID:2228
-
\??\c:\vjppp.exec:\vjppp.exe94⤵PID:3376
-
\??\c:\xrxlrrr.exec:\xrxlrrr.exe95⤵PID:2980
-
\??\c:\9rrfxrl.exec:\9rrfxrl.exe96⤵PID:5020
-
\??\c:\7bbtnn.exec:\7bbtnn.exe97⤵PID:4420
-
\??\c:\hnnbth.exec:\hnnbth.exe98⤵PID:5108
-
\??\c:\9ppdp.exec:\9ppdp.exe99⤵PID:4344
-
\??\c:\fxxlxxr.exec:\fxxlxxr.exe100⤵PID:2212
-
\??\c:\frrxxrr.exec:\frrxxrr.exe101⤵PID:3304
-
\??\c:\nhnnbb.exec:\nhnnbb.exe102⤵PID:4412
-
\??\c:\ntnhnn.exec:\ntnhnn.exe103⤵PID:2908
-
\??\c:\7ddpd.exec:\7ddpd.exe104⤵PID:220
-
\??\c:\vjdjj.exec:\vjdjj.exe105⤵PID:2604
-
\??\c:\7lrlfff.exec:\7lrlfff.exe106⤵PID:4440
-
\??\c:\hbtnbt.exec:\hbtnbt.exe107⤵PID:3804
-
\??\c:\nbthtn.exec:\nbthtn.exe108⤵PID:2416
-
\??\c:\tbbthb.exec:\tbbthb.exe109⤵PID:2900
-
\??\c:\djjvj.exec:\djjvj.exe110⤵PID:1616
-
\??\c:\jdpdp.exec:\jdpdp.exe111⤵PID:3780
-
\??\c:\rrxlxrl.exec:\rrxlxrl.exe112⤵PID:2332
-
\??\c:\llrlfxr.exec:\llrlfxr.exe113⤵PID:4212
-
\??\c:\bbhnhn.exec:\bbhnhn.exe114⤵PID:5096
-
\??\c:\9btnnh.exec:\9btnnh.exe115⤵PID:4028
-
\??\c:\jddpj.exec:\jddpj.exe116⤵PID:3768
-
\??\c:\7vjdp.exec:\7vjdp.exe117⤵PID:4132
-
\??\c:\fxrfrlx.exec:\fxrfrlx.exe118⤵PID:2640
-
\??\c:\1xxfxxr.exec:\1xxfxxr.exe119⤵PID:3364
-
\??\c:\nbhbtn.exec:\nbhbtn.exe120⤵PID:3328
-
\??\c:\bbnnbt.exec:\bbnnbt.exe121⤵PID:1920
-
\??\c:\jvvvp.exec:\jvvvp.exe122⤵PID:4972
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-