Analysis
- max time kernel
150s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
18/06/2024, 14:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
51287248e0a642b928666484dbe8b3c0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
- Target 51287248e0a642b928666484dbe8b3c0_NeikiAnalytics.exe
- Size 230KB
- Sample240618-rt3vdaxerh
- SHA256 eac1ca779ace6899beef284b6be3a314b40091bd9a8582846b435d0177cfd705
- MD5 51287248e0a642b928666484dbe8b3c0
- SHA1 85d1e911e0f6980b76bf2cde5ca269a50ab9aa23
- SHA512 eead2db16c07d4116a8be0bd97ceb310c4cbe6ac03433dc2500038a2a5e31843723767e805a28615b56bf7db5f47c590f70eb9abcfe5dbb6e65e15f2245bf43c
- SSDEEP 3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31z8mF7CP:n3C9BRo7MlrWKo+lfFeP
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 30 IoCs
resource yara_rule behavioral2/memory/4584-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2860-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/228-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3016-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1448-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1288-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2380-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2776-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3180-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/64-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/736-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4472-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5088-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3380-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3236-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2464-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-80-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/408-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-73-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/560-66-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/560-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/536-59-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/536-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1940-52-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4160-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2680-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 2860 tnhhtn.exe 228 jvjvj.exe 3016 xlxrllf.exe 2680 3lrlffr.exe 4160 5nbnbt.exe 1940 vjdpd.exe 536 vpjvj.exe 560 rfrffxr.exe 2012 lxlllrr.exe 408 bbbnbt.exe 2464 3nnhtn.exe 4484 vpjjv.exe 1144 pddpj.exe 3236 rrlxlrr.exe 5064 3llfxxr.exe 3380 3hbnbt.exe 5088 bnnnhn.exe 4472 vvjdp.exe 1448 9vvpd.exe 4828 xxxrfxf.exe 736 frlxlfr.exe 1288 hntnht.exe 4808 5pjpd.exe 64 5ddpv.exe 4520 xlrlxxl.exe 2380 fxrfxlx.exe 3180 htbbnh.exe 4644 thhtht.exe 2776 pjdpp.exe 1284 ddjjp.exe 3940 rrxlxrl.exe 1632 xrfxxlr.exe 4660 thnbtn.exe 4492 nhbhnn.exe 3068 jdvpv.exe 696 pppjv.exe 1356 xlrfxxx.exe 5008 3rxfxrl.exe 2256 5nhbnh.exe 1888 nbhhtt.exe 1260 9vdjd.exe 2732 pddpd.exe 1112 rrrrlfx.exe 3228 rfxrlfr.exe 1164 thbthb.exe 3812 nnthbn.exe 4440 jvvjd.exe 224 pdjjv.exe 232 lrxlxrl.exe 3988 5lrfxrl.exe 3572 7tbtnn.exe 440 pvjdp.exe 2656 djddd.exe 4172 xrlfrrl.exe 560 flxflrx.exe 960 nntnbb.exe 1568 vpvjp.exe 4920 9xrlfxr.exe 3512 3nnhth.exe 2148 bttnhh.exe 1988 jpdvv.exe 5048 fxlrrrr.exe 4952 7djdd.exe 1384 3rrfrfx.exe -
resource yara_rule behavioral2/memory/4584-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2860-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/228-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3016-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1448-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1288-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2380-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2776-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3180-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/64-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/736-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4472-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5088-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2464-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/560-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/536-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4160-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2680-31-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4584 wrote to memory of 2860 4584 51287248e0a642b928666484dbe8b3c0_NeikiAnalytics.exe 82 PID 4584 wrote to memory of 2860 4584 51287248e0a642b928666484dbe8b3c0_NeikiAnalytics.exe 82 PID 4584 wrote to memory of 2860 4584 51287248e0a642b928666484dbe8b3c0_NeikiAnalytics.exe 82 PID 2860 wrote to memory of 228 2860 tnhhtn.exe 83 PID 2860 wrote to memory of 228 2860 tnhhtn.exe 83 PID 2860 wrote to memory of 228 2860 tnhhtn.exe 83 PID 228 wrote to memory of 3016 228 jvjvj.exe 84 PID 228 wrote to memory of 3016 228 jvjvj.exe 84 PID 228 wrote to memory of 3016 228 jvjvj.exe 84 PID 3016 wrote to memory of 2680 3016 xlxrllf.exe 85 PID 3016 wrote to memory of 2680 3016 xlxrllf.exe 85 PID 3016 wrote to memory of 2680 3016 xlxrllf.exe 85 PID 2680 wrote to memory of 4160 2680 3lrlffr.exe 86 PID 2680 wrote to memory of 4160 2680 3lrlffr.exe 86 PID 2680 wrote to memory of 4160 2680 3lrlffr.exe 86 PID 4160 wrote to memory of 1940 4160 5nbnbt.exe 87 PID 4160 wrote to memory of 1940 4160 5nbnbt.exe 87 PID 4160 wrote to memory of 1940 4160 5nbnbt.exe 87 PID 1940 wrote to memory of 536 1940 vjdpd.exe 88 PID 1940 wrote to memory of 536 1940 vjdpd.exe 88 PID 1940 wrote to memory of 536 1940 vjdpd.exe 88 PID 536 wrote to memory of 560 536 vpjvj.exe 137 PID 536 wrote to memory of 560 536 vpjvj.exe 137 PID 536 wrote to memory of 560 536 vpjvj.exe 137 PID 560 wrote to memory of 2012 560 rfrffxr.exe 90 PID 560 wrote to memory of 2012 560 rfrffxr.exe 90 PID 560 wrote to memory of 2012 560 rfrffxr.exe 90 PID 2012 wrote to memory of 408 2012 lxlllrr.exe 91 PID 2012 wrote to memory of 408 2012 lxlllrr.exe 91 PID 2012 wrote to memory of 408 2012 lxlllrr.exe 91 PID 408 wrote to memory of 2464 408 bbbnbt.exe 92 PID 408 wrote to memory of 2464 408 bbbnbt.exe 92 PID 408 wrote to memory of 2464 408 bbbnbt.exe 92 PID 2464 wrote to memory of 4484 2464 3nnhtn.exe 93 PID 2464 wrote to memory of 4484 2464 3nnhtn.exe 93 PID 2464 wrote to memory of 4484 2464 3nnhtn.exe 93 PID 4484 wrote to memory of 1144 4484 vpjjv.exe 94 PID 4484 wrote to memory of 1144 4484 vpjjv.exe 94 PID 4484 wrote to memory of 1144 4484 vpjjv.exe 94 PID 1144 wrote to memory of 3236 1144 pddpj.exe 95 PID 1144 wrote to memory of 3236 1144 pddpj.exe 95 PID 1144 wrote to memory of 3236 1144 pddpj.exe 95 PID 3236 wrote to memory of 5064 3236 rrlxlrr.exe 96 PID 3236 wrote to memory of 5064 3236 rrlxlrr.exe 96 PID 3236 wrote to memory of 5064 3236 rrlxlrr.exe 96 PID 5064 wrote to memory of 3380 5064 3llfxxr.exe 97 PID 5064 wrote to memory of 3380 5064 3llfxxr.exe 97 PID 5064 wrote to memory of 3380 5064 3llfxxr.exe 97 PID 3380 wrote to memory of 5088 3380 3hbnbt.exe 98 PID 3380 wrote to memory of 5088 3380 3hbnbt.exe 98 PID 3380 wrote to memory of 5088 3380 3hbnbt.exe 98 PID 5088 wrote to memory of 4472 5088 bnnnhn.exe 99 PID 5088 wrote to memory of 4472 5088 bnnnhn.exe 99 PID 5088 wrote to memory of 4472 5088 bnnnhn.exe 99 PID 4472 wrote to memory of 1448 4472 vvjdp.exe 100 PID 4472 wrote to memory of 1448 4472 vvjdp.exe 100 PID 4472 wrote to memory of 1448 4472 vvjdp.exe 100 PID 1448 wrote to memory of 4828 1448 9vvpd.exe 101 PID 1448 wrote to memory of 4828 1448 9vvpd.exe 101 PID 1448 wrote to memory of 4828 1448 9vvpd.exe 101 PID 4828 wrote to memory of 736 4828 xxxrfxf.exe 102 PID 4828 wrote to memory of 736 4828 xxxrfxf.exe 102 PID 4828 wrote to memory of 736 4828 xxxrfxf.exe 102 PID 736 wrote to memory of 1288 736 frlxlfr.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\51287248e0a642b928666484dbe8b3c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\51287248e0a642b928666484dbe8b3c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\tnhhtn.exec:\tnhhtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\jvjvj.exec:\jvjvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\xlxrllf.exec:\xlxrllf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\3lrlffr.exec:\3lrlffr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\5nbnbt.exec:\5nbnbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\vjdpd.exec:\vjdpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\vpjvj.exec:\vpjvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\rfrffxr.exec:\rfrffxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
\??\c:\lxlllrr.exec:\lxlllrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\bbbnbt.exec:\bbbnbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\3nnhtn.exec:\3nnhtn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\vpjjv.exec:\vpjjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\pddpj.exec:\pddpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\rrlxlrr.exec:\rrlxlrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\3llfxxr.exec:\3llfxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\3hbnbt.exec:\3hbnbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\bnnnhn.exec:\bnnnhn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\vvjdp.exec:\vvjdp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\9vvpd.exec:\9vvpd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\xxxrfxf.exec:\xxxrfxf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\frlxlfr.exec:\frlxlfr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
\??\c:\hntnht.exec:\hntnht.exe23⤵
- Executes dropped EXE
PID:1288 -
\??\c:\5pjpd.exec:\5pjpd.exe24⤵
- Executes dropped EXE
PID:4808 -
\??\c:\5ddpv.exec:\5ddpv.exe25⤵
- Executes dropped EXE
PID:64 -
\??\c:\xlrlxxl.exec:\xlrlxxl.exe26⤵
- Executes dropped EXE
PID:4520 -
\??\c:\fxrfxlx.exec:\fxrfxlx.exe27⤵
- Executes dropped EXE
PID:2380 -
\??\c:\htbbnh.exec:\htbbnh.exe28⤵
- Executes dropped EXE
PID:3180 -
\??\c:\thhtht.exec:\thhtht.exe29⤵
- Executes dropped EXE
PID:4644 -
\??\c:\pjdpp.exec:\pjdpp.exe30⤵
- Executes dropped EXE
PID:2776 -
\??\c:\ddjjp.exec:\ddjjp.exe31⤵
- Executes dropped EXE
PID:1284 -
\??\c:\rrxlxrl.exec:\rrxlxrl.exe32⤵
- Executes dropped EXE
PID:3940 -
\??\c:\xrfxxlr.exec:\xrfxxlr.exe33⤵
- Executes dropped EXE
PID:1632 -
\??\c:\thnbtn.exec:\thnbtn.exe34⤵
- Executes dropped EXE
PID:4660 -
\??\c:\nhbhnn.exec:\nhbhnn.exe35⤵
- Executes dropped EXE
PID:4492 -
\??\c:\jdvpv.exec:\jdvpv.exe36⤵
- Executes dropped EXE
PID:3068 -
\??\c:\pppjv.exec:\pppjv.exe37⤵
- Executes dropped EXE
PID:696 -
\??\c:\xlrfxxx.exec:\xlrfxxx.exe38⤵
- Executes dropped EXE
PID:1356 -
\??\c:\3rxfxrl.exec:\3rxfxrl.exe39⤵
- Executes dropped EXE
PID:5008 -
\??\c:\5nhbnh.exec:\5nhbnh.exe40⤵
- Executes dropped EXE
PID:2256 -
\??\c:\nbhhtt.exec:\nbhhtt.exe41⤵
- Executes dropped EXE
PID:1888 -
\??\c:\9vdjd.exec:\9vdjd.exe42⤵
- Executes dropped EXE
PID:1260 -
\??\c:\pddpd.exec:\pddpd.exe43⤵
- Executes dropped EXE
PID:2732 -
\??\c:\rrrrlfx.exec:\rrrrlfx.exe44⤵
- Executes dropped EXE
PID:1112 -
\??\c:\rfxrlfr.exec:\rfxrlfr.exe45⤵
- Executes dropped EXE
PID:3228 -
\??\c:\thbthb.exec:\thbthb.exe46⤵
- Executes dropped EXE
PID:1164 -
\??\c:\nnthbn.exec:\nnthbn.exe47⤵
- Executes dropped EXE
PID:3812 -
\??\c:\jvvjd.exec:\jvvjd.exe48⤵
- Executes dropped EXE
PID:4440 -
\??\c:\pdjjv.exec:\pdjjv.exe49⤵
- Executes dropped EXE
PID:224 -
\??\c:\lrxlxrl.exec:\lrxlxrl.exe50⤵
- Executes dropped EXE
PID:232 -
\??\c:\5lrfxrl.exec:\5lrfxrl.exe51⤵
- Executes dropped EXE
PID:3988 -
\??\c:\7tbtnn.exec:\7tbtnn.exe52⤵
- Executes dropped EXE
PID:3572 -
\??\c:\pvjdp.exec:\pvjdp.exe53⤵
- Executes dropped EXE
PID:440 -
\??\c:\djddd.exec:\djddd.exe54⤵
- Executes dropped EXE
PID:2656 -
\??\c:\xrlfrrl.exec:\xrlfrrl.exe55⤵
- Executes dropped EXE
PID:4172 -
\??\c:\flxflrx.exec:\flxflrx.exe56⤵
- Executes dropped EXE
PID:560 -
\??\c:\nntnbb.exec:\nntnbb.exe57⤵
- Executes dropped EXE
PID:960 -
\??\c:\vpvjp.exec:\vpvjp.exe58⤵
- Executes dropped EXE
PID:1568 -
\??\c:\9xrlfxr.exec:\9xrlfxr.exe59⤵
- Executes dropped EXE
PID:4920 -
\??\c:\3nnhth.exec:\3nnhth.exe60⤵
- Executes dropped EXE
PID:3512 -
\??\c:\bttnhh.exec:\bttnhh.exe61⤵
- Executes dropped EXE
PID:2148 -
\??\c:\jpdvv.exec:\jpdvv.exe62⤵
- Executes dropped EXE
PID:1988 -
\??\c:\fxlrrrr.exec:\fxlrrrr.exe63⤵
- Executes dropped EXE
PID:5048 -
\??\c:\7djdd.exec:\7djdd.exe64⤵
- Executes dropped EXE
PID:4952 -
\??\c:\3rrfrfx.exec:\3rrfrfx.exe65⤵
- Executes dropped EXE
PID:1384 -
\??\c:\xxlxllr.exec:\xxlxllr.exe66⤵PID:4696
-
\??\c:\tnthtn.exec:\tnthtn.exe67⤵PID:1724
-
\??\c:\tnbttt.exec:\tnbttt.exe68⤵PID:3300
-
\??\c:\dvdpd.exec:\dvdpd.exe69⤵PID:1912
-
\??\c:\7lrxllf.exec:\7lrxllf.exe70⤵PID:1452
-
\??\c:\3tbtnh.exec:\3tbtnh.exe71⤵PID:2104
-
\??\c:\1htntt.exec:\1htntt.exe72⤵PID:616
-
\??\c:\vdpvp.exec:\vdpvp.exe73⤵PID:3548
-
\??\c:\pdjdd.exec:\pdjdd.exe74⤵PID:4396
-
\??\c:\lffxlll.exec:\lffxlll.exe75⤵PID:3344
-
\??\c:\thtnhb.exec:\thtnhb.exe76⤵PID:3796
-
\??\c:\7vvdd.exec:\7vvdd.exe77⤵PID:2900
-
\??\c:\pjvdd.exec:\pjvdd.exe78⤵PID:4660
-
\??\c:\fllxrlf.exec:\fllxrlf.exe79⤵PID:4492
-
\??\c:\rrxxflr.exec:\rrxxflr.exe80⤵PID:4308
-
\??\c:\bnbhbn.exec:\bnbhbn.exe81⤵PID:1820
-
\??\c:\pddvp.exec:\pddvp.exe82⤵PID:4876
-
\??\c:\5djvv.exec:\5djvv.exe83⤵PID:4516
-
\??\c:\rflfrlf.exec:\rflfrlf.exe84⤵PID:2568
-
\??\c:\rlrfxxr.exec:\rlrfxxr.exe85⤵PID:2032
-
\??\c:\tnnbbb.exec:\tnnbbb.exe86⤵PID:4704
-
\??\c:\vjjjp.exec:\vjjjp.exe87⤵PID:636
-
\??\c:\3ppjv.exec:\3ppjv.exe88⤵PID:1884
-
\??\c:\rfffxrl.exec:\rfffxrl.exe89⤵PID:2448
-
\??\c:\5xfxfxr.exec:\5xfxfxr.exe90⤵PID:3748
-
\??\c:\ttbnhb.exec:\ttbnhb.exe91⤵PID:2444
-
\??\c:\vjdvj.exec:\vjdvj.exe92⤵PID:4012
-
\??\c:\rflfxxf.exec:\rflfxxf.exe93⤵PID:1368
-
\??\c:\fxlffxf.exec:\fxlffxf.exe94⤵PID:1496
-
\??\c:\hbbthh.exec:\hbbthh.exe95⤵PID:1484
-
\??\c:\tbnbnh.exec:\tbnbnh.exe96⤵PID:1640
-
\??\c:\jvvvj.exec:\jvvvj.exe97⤵PID:764
-
\??\c:\lxrlfrl.exec:\lxrlfrl.exe98⤵PID:4192
-
\??\c:\lxrlxrl.exec:\lxrlxrl.exe99⤵PID:324
-
\??\c:\thhbnh.exec:\thhbnh.exe100⤵PID:2892
-
\??\c:\bbnbtn.exec:\bbnbtn.exe101⤵PID:228
-
\??\c:\3pjvj.exec:\3pjvj.exe102⤵PID:700
-
\??\c:\vpdpv.exec:\vpdpv.exe103⤵PID:1572
-
\??\c:\9xxlrll.exec:\9xxlrll.exe104⤵PID:2260
-
\??\c:\rrfxrll.exec:\rrfxrll.exe105⤵PID:2656
-
\??\c:\3nnhbt.exec:\3nnhbt.exe106⤵PID:4004
-
\??\c:\pjvpd.exec:\pjvpd.exe107⤵PID:560
-
\??\c:\dpdvp.exec:\dpdvp.exe108⤵PID:2228
-
\??\c:\7lfrxrf.exec:\7lfrxrf.exe109⤵PID:4484
-
\??\c:\fllfrrl.exec:\fllfrrl.exe110⤵PID:384
-
\??\c:\nhbthb.exec:\nhbthb.exe111⤵PID:1644
-
\??\c:\bhhtbt.exec:\bhhtbt.exe112⤵PID:672
-
\??\c:\dpvjj.exec:\dpvjj.exe113⤵PID:4016
-
\??\c:\5rxlxrf.exec:\5rxlxrf.exe114⤵PID:5048
-
\??\c:\rxfxlfx.exec:\rxfxlfx.exe115⤵PID:2888
-
\??\c:\3bhtnh.exec:\3bhtnh.exe116⤵PID:2408
-
\??\c:\hbhtnh.exec:\hbhtnh.exe117⤵PID:1448
-
\??\c:\jvjvp.exec:\jvjvp.exe118⤵PID:4580
-
\??\c:\vpjdj.exec:\vpjdj.exe119⤵PID:1724
-
\??\c:\lffxlff.exec:\lffxlff.exe120⤵PID:3300
-
\??\c:\xllfffr.exec:\xllfffr.exe121⤵PID:2400
-
\??\c:\7nthbt.exec:\7nthbt.exe122⤵PID:1452
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-