Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 20:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f9cab79ffdb3a86775e5a10fdd97f960_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
f9cab79ffdb3a86775e5a10fdd97f960_NeikiAnalytics.exe
-
Size
59KB
-
MD5
f9cab79ffdb3a86775e5a10fdd97f960
-
SHA1
791bb55121a5def4a9787b1dd10f908531272d76
-
SHA256
d1ba04ee89069f4fa51e3eaf318c3a9a4d82b93f4dc478cb984664b7f534c97c
-
SHA512
0d1b4089e4dce1385608962fd757dd7756bc5da431969c67c11ecd2eb130d71ac902e3668bf5bd1f6cf6b51643caf9db685f5d6f93937bbbfaf72ca7ed4d7604
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk9UWt:ymb3NkkiQ3mdBjFIvlqm
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/1516-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2128-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2128-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4488-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4612-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3548-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4696-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1860-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1868-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1804-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3608-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1984-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1912-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3312-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4472-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2060-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2148-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2624-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4548-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1536-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1184-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3128-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/696-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2996-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2656-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2128 xxfxllx.exe 4612 hntttt.exe 4488 jjpjd.exe 4592 vppjd.exe 3548 xfllrrl.exe 4696 xlrxrrr.exe 1860 7pppd.exe 1868 9pvpd.exe 1804 xllfrrx.exe 3608 nbbthh.exe 1984 5jvpj.exe 1912 lflllll.exe 3312 httnhh.exe 4472 jjvjj.exe 2060 rxllrrf.exe 3196 htttnh.exe 2148 vddvp.exe 3088 pvjvp.exe 2624 xflfxxx.exe 4548 bhhnhh.exe 4712 tbhbnn.exe 1120 pjjjj.exe 408 frlxllf.exe 1536 nntnbb.exe 1184 ppvjp.exe 4460 7rfxllx.exe 3128 xlllrrl.exe 1852 5ntntt.exe 696 vvvvp.exe 2996 lfxrffx.exe 2656 xfxrlfx.exe 4624 9bbtnn.exe 2432 rlrlllf.exe 2244 rlfxrfx.exe 4588 tnnhbb.exe 1416 tbbtnt.exe 4372 jjvvj.exe 1508 flrrfff.exe 4912 bntttt.exe 3632 bntnnh.exe 464 1vjjj.exe 3620 ddvpj.exe 4448 hnhhnh.exe 404 tnhbbb.exe 1636 vdpjv.exe 2164 9rfxlrr.exe 1720 rllflfr.exe 4704 nnbtnn.exe 4820 bntnbb.exe 3412 jjvpj.exe 3548 ffxrrll.exe 3248 xfrlrff.exe 220 nbhttn.exe 5116 1ppjd.exe 1860 pdvpp.exe 5100 llrllrl.exe 5088 hhnhnn.exe 2864 jvpdd.exe 1340 1lrfrrl.exe 624 lxlfxxx.exe 2700 1bhtnt.exe 5040 bnthbt.exe 3428 jdvpd.exe 4472 1xlfffx.exe -
resource yara_rule behavioral2/memory/1516-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2128-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2128-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4488-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4612-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3548-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2128-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4696-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1860-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1804-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1804-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1868-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1804-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3608-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1984-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1912-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3312-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4472-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2060-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2624-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4548-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1536-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1184-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3128-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/696-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2996-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2656-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1516 wrote to memory of 2128 1516 f9cab79ffdb3a86775e5a10fdd97f960_NeikiAnalytics.exe 82 PID 1516 wrote to memory of 2128 1516 f9cab79ffdb3a86775e5a10fdd97f960_NeikiAnalytics.exe 82 PID 1516 wrote to memory of 2128 1516 f9cab79ffdb3a86775e5a10fdd97f960_NeikiAnalytics.exe 82 PID 2128 wrote to memory of 4612 2128 xxfxllx.exe 83 PID 2128 wrote to memory of 4612 2128 xxfxllx.exe 83 PID 2128 wrote to memory of 4612 2128 xxfxllx.exe 83 PID 4612 wrote to memory of 4488 4612 hntttt.exe 84 PID 4612 wrote to memory of 4488 4612 hntttt.exe 84 PID 4612 wrote to memory of 4488 4612 hntttt.exe 84 PID 4488 wrote to memory of 4592 4488 jjpjd.exe 85 PID 4488 wrote to memory of 4592 4488 jjpjd.exe 85 PID 4488 wrote to memory of 4592 4488 jjpjd.exe 85 PID 4592 wrote to memory of 3548 4592 vppjd.exe 86 PID 4592 wrote to memory of 3548 4592 vppjd.exe 86 PID 4592 wrote to memory of 3548 4592 vppjd.exe 86 PID 3548 wrote to memory of 4696 3548 xfllrrl.exe 87 PID 3548 wrote to memory of 4696 3548 xfllrrl.exe 87 PID 3548 wrote to memory of 4696 3548 xfllrrl.exe 87 PID 4696 wrote to memory of 1860 4696 xlrxrrr.exe 88 PID 4696 wrote to memory of 1860 4696 xlrxrrr.exe 88 PID 4696 wrote to memory of 1860 4696 xlrxrrr.exe 88 PID 1860 wrote to memory of 1868 1860 7pppd.exe 89 PID 1860 wrote to memory of 1868 1860 7pppd.exe 89 PID 1860 wrote to memory of 1868 1860 7pppd.exe 89 PID 1868 wrote to memory of 1804 1868 9pvpd.exe 90 PID 1868 wrote to memory of 1804 1868 9pvpd.exe 90 PID 1868 wrote to memory of 1804 1868 9pvpd.exe 90 PID 1804 wrote to memory of 3608 1804 xllfrrx.exe 91 PID 1804 wrote to memory of 3608 1804 xllfrrx.exe 91 PID 1804 wrote to memory of 3608 1804 xllfrrx.exe 91 PID 3608 wrote to memory of 1984 3608 nbbthh.exe 93 PID 3608 wrote to memory of 1984 3608 nbbthh.exe 93 PID 3608 wrote to memory of 1984 3608 nbbthh.exe 93 PID 1984 wrote to memory of 1912 1984 5jvpj.exe 94 PID 1984 wrote to memory of 1912 1984 5jvpj.exe 94 PID 1984 wrote to memory of 1912 1984 5jvpj.exe 94 PID 1912 wrote to memory of 3312 1912 lflllll.exe 95 PID 1912 wrote to memory of 3312 1912 lflllll.exe 95 PID 1912 wrote to memory of 3312 1912 lflllll.exe 95 PID 3312 wrote to memory of 4472 3312 httnhh.exe 96 PID 3312 wrote to memory of 4472 3312 httnhh.exe 96 PID 3312 wrote to memory of 4472 3312 httnhh.exe 96 PID 4472 wrote to memory of 2060 4472 jjvjj.exe 97 PID 4472 wrote to memory of 2060 4472 jjvjj.exe 97 PID 4472 wrote to memory of 2060 4472 jjvjj.exe 97 PID 2060 wrote to memory of 3196 2060 rxllrrf.exe 98 PID 2060 wrote to memory of 3196 2060 rxllrrf.exe 98 PID 2060 wrote to memory of 3196 2060 rxllrrf.exe 98 PID 3196 wrote to memory of 2148 3196 htttnh.exe 99 PID 3196 wrote to memory of 2148 3196 htttnh.exe 99 PID 3196 wrote to memory of 2148 3196 htttnh.exe 99 PID 2148 wrote to memory of 3088 2148 vddvp.exe 100 PID 2148 wrote to memory of 3088 2148 vddvp.exe 100 PID 2148 wrote to memory of 3088 2148 vddvp.exe 100 PID 3088 wrote to memory of 2624 3088 pvjvp.exe 101 PID 3088 wrote to memory of 2624 3088 pvjvp.exe 101 PID 3088 wrote to memory of 2624 3088 pvjvp.exe 101 PID 2624 wrote to memory of 4548 2624 xflfxxx.exe 103 PID 2624 wrote to memory of 4548 2624 xflfxxx.exe 103 PID 2624 wrote to memory of 4548 2624 xflfxxx.exe 103 PID 4548 wrote to memory of 4712 4548 bhhnhh.exe 104 PID 4548 wrote to memory of 4712 4548 bhhnhh.exe 104 PID 4548 wrote to memory of 4712 4548 bhhnhh.exe 104 PID 4712 wrote to memory of 1120 4712 tbhbnn.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9cab79ffdb3a86775e5a10fdd97f960_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\f9cab79ffdb3a86775e5a10fdd97f960_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\xxfxllx.exec:\xxfxllx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\hntttt.exec:\hntttt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\jjpjd.exec:\jjpjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\vppjd.exec:\vppjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\xfllrrl.exec:\xfllrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\xlrxrrr.exec:\xlrxrrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\7pppd.exec:\7pppd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\9pvpd.exec:\9pvpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\xllfrrx.exec:\xllfrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\nbbthh.exec:\nbbthh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\5jvpj.exec:\5jvpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\lflllll.exec:\lflllll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\httnhh.exec:\httnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
\??\c:\jjvjj.exec:\jjvjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\rxllrrf.exec:\rxllrrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\htttnh.exec:\htttnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\vddvp.exec:\vddvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\pvjvp.exec:\pvjvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\xflfxxx.exec:\xflfxxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\bhhnhh.exec:\bhhnhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\tbhbnn.exec:\tbhbnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\pjjjj.exec:\pjjjj.exe23⤵
- Executes dropped EXE
PID:1120 -
\??\c:\frlxllf.exec:\frlxllf.exe24⤵
- Executes dropped EXE
PID:408 -
\??\c:\nntnbb.exec:\nntnbb.exe25⤵
- Executes dropped EXE
PID:1536 -
\??\c:\ppvjp.exec:\ppvjp.exe26⤵
- Executes dropped EXE
PID:1184 -
\??\c:\7rfxllx.exec:\7rfxllx.exe27⤵
- Executes dropped EXE
PID:4460 -
\??\c:\xlllrrl.exec:\xlllrrl.exe28⤵
- Executes dropped EXE
PID:3128 -
\??\c:\5ntntt.exec:\5ntntt.exe29⤵
- Executes dropped EXE
PID:1852 -
\??\c:\vvvvp.exec:\vvvvp.exe30⤵
- Executes dropped EXE
PID:696 -
\??\c:\lfxrffx.exec:\lfxrffx.exe31⤵
- Executes dropped EXE
PID:2996 -
\??\c:\xfxrlfx.exec:\xfxrlfx.exe32⤵
- Executes dropped EXE
PID:2656 -
\??\c:\9bbtnn.exec:\9bbtnn.exe33⤵
- Executes dropped EXE
PID:4624 -
\??\c:\rlrlllf.exec:\rlrlllf.exe34⤵
- Executes dropped EXE
PID:2432 -
\??\c:\rlfxrfx.exec:\rlfxrfx.exe35⤵
- Executes dropped EXE
PID:2244 -
\??\c:\tnnhbb.exec:\tnnhbb.exe36⤵
- Executes dropped EXE
PID:4588 -
\??\c:\tbbtnt.exec:\tbbtnt.exe37⤵
- Executes dropped EXE
PID:1416 -
\??\c:\jjvvj.exec:\jjvvj.exe38⤵
- Executes dropped EXE
PID:4372 -
\??\c:\flrrfff.exec:\flrrfff.exe39⤵
- Executes dropped EXE
PID:1508 -
\??\c:\bntttt.exec:\bntttt.exe40⤵
- Executes dropped EXE
PID:4912 -
\??\c:\bntnnh.exec:\bntnnh.exe41⤵
- Executes dropped EXE
PID:3632 -
\??\c:\1vjjj.exec:\1vjjj.exe42⤵
- Executes dropped EXE
PID:464 -
\??\c:\ddvpj.exec:\ddvpj.exe43⤵
- Executes dropped EXE
PID:3620 -
\??\c:\llflfrx.exec:\llflfrx.exe44⤵PID:2876
-
\??\c:\hnhhnh.exec:\hnhhnh.exe45⤵
- Executes dropped EXE
PID:4448 -
\??\c:\tnhbbb.exec:\tnhbbb.exe46⤵
- Executes dropped EXE
PID:404 -
\??\c:\vdpjv.exec:\vdpjv.exe47⤵
- Executes dropped EXE
PID:1636 -
\??\c:\9rfxlrr.exec:\9rfxlrr.exe48⤵
- Executes dropped EXE
PID:2164 -
\??\c:\rllflfr.exec:\rllflfr.exe49⤵
- Executes dropped EXE
PID:1720 -
\??\c:\nnbtnn.exec:\nnbtnn.exe50⤵
- Executes dropped EXE
PID:4704 -
\??\c:\bntnbb.exec:\bntnbb.exe51⤵
- Executes dropped EXE
PID:4820 -
\??\c:\jjvpj.exec:\jjvpj.exe52⤵
- Executes dropped EXE
PID:3412 -
\??\c:\ffxrrll.exec:\ffxrrll.exe53⤵
- Executes dropped EXE
PID:3548 -
\??\c:\xfrlrff.exec:\xfrlrff.exe54⤵
- Executes dropped EXE
PID:3248 -
\??\c:\nbhttn.exec:\nbhttn.exe55⤵
- Executes dropped EXE
PID:220 -
\??\c:\1ppjd.exec:\1ppjd.exe56⤵
- Executes dropped EXE
PID:5116 -
\??\c:\pdvpp.exec:\pdvpp.exe57⤵
- Executes dropped EXE
PID:1860 -
\??\c:\llrllrl.exec:\llrllrl.exe58⤵
- Executes dropped EXE
PID:5100 -
\??\c:\hhnhnn.exec:\hhnhnn.exe59⤵
- Executes dropped EXE
PID:5088 -
\??\c:\jvpdd.exec:\jvpdd.exe60⤵
- Executes dropped EXE
PID:2864 -
\??\c:\1lrfrrl.exec:\1lrfrrl.exe61⤵
- Executes dropped EXE
PID:1340 -
\??\c:\lxlfxxx.exec:\lxlfxxx.exe62⤵
- Executes dropped EXE
PID:624 -
\??\c:\1bhtnt.exec:\1bhtnt.exe63⤵
- Executes dropped EXE
PID:2700 -
\??\c:\bnthbt.exec:\bnthbt.exe64⤵
- Executes dropped EXE
PID:5040 -
\??\c:\jdvpd.exec:\jdvpd.exe65⤵
- Executes dropped EXE
PID:3428 -
\??\c:\1xlfffx.exec:\1xlfffx.exe66⤵
- Executes dropped EXE
PID:4472 -
\??\c:\hhhhhb.exec:\hhhhhb.exe67⤵PID:5084
-
\??\c:\ntbtnb.exec:\ntbtnb.exe68⤵PID:3968
-
\??\c:\7djjv.exec:\7djjv.exe69⤵PID:1356
-
\??\c:\flrlxrl.exec:\flrlxrl.exe70⤵PID:4524
-
\??\c:\rlxlrrx.exec:\rlxlrrx.exe71⤵PID:1808
-
\??\c:\ntnnnb.exec:\ntnnnb.exe72⤵PID:2264
-
\??\c:\pjdvv.exec:\pjdvv.exe73⤵PID:764
-
\??\c:\djjpd.exec:\djjpd.exe74⤵PID:1512
-
\??\c:\llffrlf.exec:\llffrlf.exe75⤵PID:4024
-
\??\c:\btbttt.exec:\btbttt.exe76⤵PID:1692
-
\??\c:\jdpjd.exec:\jdpjd.exe77⤵PID:3692
-
\??\c:\lflfrrf.exec:\lflfrrf.exe78⤵PID:2200
-
\??\c:\1httnn.exec:\1httnn.exe79⤵PID:3140
-
\??\c:\vpppj.exec:\vpppj.exe80⤵PID:844
-
\??\c:\rflfrrl.exec:\rflfrrl.exe81⤵PID:1184
-
\??\c:\5llfrrl.exec:\5llfrrl.exe82⤵PID:2884
-
\??\c:\vpdvd.exec:\vpdvd.exe83⤵PID:3400
-
\??\c:\9pvpj.exec:\9pvpj.exe84⤵PID:3864
-
\??\c:\lxxxlll.exec:\lxxxlll.exe85⤵PID:1852
-
\??\c:\1ttnhh.exec:\1ttnhh.exe86⤵PID:3148
-
\??\c:\dpvvd.exec:\dpvvd.exe87⤵PID:3764
-
\??\c:\rrxxllr.exec:\rrxxllr.exe88⤵PID:2596
-
\??\c:\ffxrlff.exec:\ffxrlff.exe89⤵PID:544
-
\??\c:\hbnhnn.exec:\hbnhnn.exe90⤵PID:3376
-
\??\c:\pddvj.exec:\pddvj.exe91⤵PID:3564
-
\??\c:\9rxrffx.exec:\9rxrffx.exe92⤵PID:1464
-
\??\c:\1ttnhb.exec:\1ttnhb.exe93⤵PID:3016
-
\??\c:\9bttnn.exec:\9bttnn.exe94⤵PID:2452
-
\??\c:\3jpjv.exec:\3jpjv.exe95⤵PID:1540
-
\??\c:\jvvvj.exec:\jvvvj.exe96⤵PID:4760
-
\??\c:\lxrlxrl.exec:\lxrlxrl.exe97⤵PID:4480
-
\??\c:\httnhh.exec:\httnhh.exe98⤵PID:3588
-
\??\c:\5tnhbh.exec:\5tnhbh.exe99⤵PID:464
-
\??\c:\pjdvp.exec:\pjdvp.exe100⤵PID:4428
-
\??\c:\9dvpd.exec:\9dvpd.exe101⤵PID:2336
-
\??\c:\xfxrffx.exec:\xfxrffx.exe102⤵PID:2280
-
\??\c:\lrlfxxr.exec:\lrlfxxr.exe103⤵PID:2128
-
\??\c:\1htnhb.exec:\1htnhb.exe104⤵PID:208
-
\??\c:\vjjdv.exec:\vjjdv.exe105⤵PID:1996
-
\??\c:\5pdjd.exec:\5pdjd.exe106⤵PID:116
-
\??\c:\5fxlxrl.exec:\5fxlxrl.exe107⤵PID:4308
-
\??\c:\nnbtnb.exec:\nnbtnb.exe108⤵PID:4072
-
\??\c:\ttnhnn.exec:\ttnhnn.exe109⤵PID:436
-
\??\c:\jpvvv.exec:\jpvvv.exe110⤵PID:4328
-
\??\c:\3xfxxxf.exec:\3xfxxxf.exe111⤵PID:2080
-
\??\c:\5lxxrrr.exec:\5lxxrrr.exe112⤵PID:3800
-
\??\c:\bntnhb.exec:\bntnhb.exe113⤵PID:2696
-
\??\c:\vdppd.exec:\vdppd.exe114⤵PID:3236
-
\??\c:\pjdpj.exec:\pjdpj.exe115⤵PID:2912
-
\??\c:\flrflxl.exec:\flrflxl.exe116⤵PID:3720
-
\??\c:\ffrxffr.exec:\ffrxffr.exe117⤵PID:2572
-
\??\c:\7nhhbb.exec:\7nhhbb.exe118⤵PID:3584
-
\??\c:\3bbtnh.exec:\3bbtnh.exe119⤵PID:2056
-
\??\c:\pvvpj.exec:\pvvpj.exe120⤵PID:2784
-
\??\c:\lfrllfl.exec:\lfrllfl.exe121⤵PID:3120
-
\??\c:\rlrxrrr.exec:\rlrxrrr.exe122⤵PID:2712
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-