Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 20:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
01fc11a317e4ff7f6c1bb9522739d310_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
01fc11a317e4ff7f6c1bb9522739d310_NeikiAnalytics.exe
-
Size
392KB
-
MD5
01fc11a317e4ff7f6c1bb9522739d310
-
SHA1
2fa3a3b38f0448850425f6bdeac401d7150c4a1a
-
SHA256
27cec1de18331ab45a1176542d437d9fe9ea60412e3bc57c4c6ef1997d733acb
-
SHA512
3f2710e9e5e04623c9889b037c4dd9d7f505e6b723440721c2de489ab363305dfde405c45b4ac05ac864b6b8ee689cc995d8eff6ddfffa25e83875c1ba4e751e
-
SSDEEP
6144:n3C9BRo7tvnJ9oH0IRgZvjkIfzBgZJmAhc:n3C9ytvngQj1fz6ZJmAW
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/4932-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3964-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3336-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/996-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3148-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1552-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3928-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1168-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3992-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4632-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2796-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4912-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4140-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1812-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1292-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/436-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/456-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2740-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1624-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1316-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3148 pdvpj.exe 3964 xxxrxff.exe 996 xlrlfxr.exe 4208 nbbtnh.exe 3336 vjdvj.exe 1552 xfrlxrf.exe 3928 dvdvp.exe 1168 tbhbhb.exe 3992 pvvvd.exe 4632 frflrlr.exe 2796 vjvdv.exe 2500 1nthbt.exe 1500 flfrlfx.exe 3596 pvdvp.exe 4912 xfrflxl.exe 1196 vpvvd.exe 4476 jvjdd.exe 4140 hthtnn.exe 1812 nbbtnn.exe 4484 pdvpj.exe 436 3rlfxxr.exe 1292 9rxlfxr.exe 456 5ntbht.exe 3384 hbbtnn.exe 2468 1pdpv.exe 1616 fxfrfff.exe 5020 nnthbt.exe 2740 lxfxlfx.exe 1624 bthbbb.exe 4436 ffxrffl.exe 1316 thnhnn.exe 4252 9xxxrlf.exe 3156 rlffxfx.exe 3224 pddvp.exe 5108 9xrrffx.exe 2360 3hbthh.exe 1256 rxlfxxr.exe 1620 hbhbtt.exe 2076 pdjjj.exe 2820 rrrfffx.exe 3400 tbhhbb.exe 4056 9bnnnn.exe 3740 7vjdp.exe 1360 xrxrllr.exe 540 tnnnht.exe 1468 pjpjd.exe 1600 vppjp.exe 4396 fffxrrr.exe 1676 htbtnn.exe 1784 jjjdp.exe 2736 pvjpp.exe 964 nttnbt.exe 640 hbnhtt.exe 3524 7vvpj.exe 2488 xxfffll.exe 636 flffllx.exe 3772 nnnnnn.exe 2456 ddpjv.exe 2788 frfxfff.exe 3760 bbhbtb.exe 2052 jvvvp.exe 4412 xxfxrrl.exe 2760 5hhtnt.exe 1004 pjppd.exe -
resource yara_rule behavioral2/memory/4932-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3964-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3336-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/996-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3148-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1552-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3928-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1168-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3992-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4632-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4632-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2796-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3596-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4140-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1812-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1292-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/436-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/456-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2740-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1624-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1316-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4932 wrote to memory of 3148 4932 01fc11a317e4ff7f6c1bb9522739d310_NeikiAnalytics.exe 81 PID 4932 wrote to memory of 3148 4932 01fc11a317e4ff7f6c1bb9522739d310_NeikiAnalytics.exe 81 PID 4932 wrote to memory of 3148 4932 01fc11a317e4ff7f6c1bb9522739d310_NeikiAnalytics.exe 81 PID 3148 wrote to memory of 3964 3148 pdvpj.exe 82 PID 3148 wrote to memory of 3964 3148 pdvpj.exe 82 PID 3148 wrote to memory of 3964 3148 pdvpj.exe 82 PID 3964 wrote to memory of 996 3964 xxxrxff.exe 83 PID 3964 wrote to memory of 996 3964 xxxrxff.exe 83 PID 3964 wrote to memory of 996 3964 xxxrxff.exe 83 PID 996 wrote to memory of 4208 996 xlrlfxr.exe 84 PID 996 wrote to memory of 4208 996 xlrlfxr.exe 84 PID 996 wrote to memory of 4208 996 xlrlfxr.exe 84 PID 4208 wrote to memory of 3336 4208 nbbtnh.exe 85 PID 4208 wrote to memory of 3336 4208 nbbtnh.exe 85 PID 4208 wrote to memory of 3336 4208 nbbtnh.exe 85 PID 3336 wrote to memory of 1552 3336 vjdvj.exe 86 PID 3336 wrote to memory of 1552 3336 vjdvj.exe 86 PID 3336 wrote to memory of 1552 3336 vjdvj.exe 86 PID 1552 wrote to memory of 3928 1552 xfrlxrf.exe 87 PID 1552 wrote to memory of 3928 1552 xfrlxrf.exe 87 PID 1552 wrote to memory of 3928 1552 xfrlxrf.exe 87 PID 3928 wrote to memory of 1168 3928 dvdvp.exe 88 PID 3928 wrote to memory of 1168 3928 dvdvp.exe 88 PID 3928 wrote to memory of 1168 3928 dvdvp.exe 88 PID 1168 wrote to memory of 3992 1168 tbhbhb.exe 89 PID 1168 wrote to memory of 3992 1168 tbhbhb.exe 89 PID 1168 wrote to memory of 3992 1168 tbhbhb.exe 89 PID 3992 wrote to memory of 4632 3992 pvvvd.exe 90 PID 3992 wrote to memory of 4632 3992 pvvvd.exe 90 PID 3992 wrote to memory of 4632 3992 pvvvd.exe 90 PID 4632 wrote to memory of 2796 4632 frflrlr.exe 91 PID 4632 wrote to memory of 2796 4632 frflrlr.exe 91 PID 4632 wrote to memory of 2796 4632 frflrlr.exe 91 PID 2796 wrote to memory of 2500 2796 vjvdv.exe 92 PID 2796 wrote to memory of 2500 2796 vjvdv.exe 92 PID 2796 wrote to memory of 2500 2796 vjvdv.exe 92 PID 2500 wrote to memory of 1500 2500 1nthbt.exe 93 PID 2500 wrote to memory of 1500 2500 1nthbt.exe 93 PID 2500 wrote to memory of 1500 2500 1nthbt.exe 93 PID 1500 wrote to memory of 3596 1500 flfrlfx.exe 94 PID 1500 wrote to memory of 3596 1500 flfrlfx.exe 94 PID 1500 wrote to memory of 3596 1500 flfrlfx.exe 94 PID 3596 wrote to memory of 4912 3596 pvdvp.exe 95 PID 3596 wrote to memory of 4912 3596 pvdvp.exe 95 PID 3596 wrote to memory of 4912 3596 pvdvp.exe 95 PID 4912 wrote to memory of 1196 4912 xfrflxl.exe 96 PID 4912 wrote to memory of 1196 4912 xfrflxl.exe 96 PID 4912 wrote to memory of 1196 4912 xfrflxl.exe 96 PID 1196 wrote to memory of 4476 1196 vpvvd.exe 97 PID 1196 wrote to memory of 4476 1196 vpvvd.exe 97 PID 1196 wrote to memory of 4476 1196 vpvvd.exe 97 PID 4476 wrote to memory of 4140 4476 jvjdd.exe 98 PID 4476 wrote to memory of 4140 4476 jvjdd.exe 98 PID 4476 wrote to memory of 4140 4476 jvjdd.exe 98 PID 4140 wrote to memory of 1812 4140 hthtnn.exe 99 PID 4140 wrote to memory of 1812 4140 hthtnn.exe 99 PID 4140 wrote to memory of 1812 4140 hthtnn.exe 99 PID 1812 wrote to memory of 4484 1812 nbbtnn.exe 100 PID 1812 wrote to memory of 4484 1812 nbbtnn.exe 100 PID 1812 wrote to memory of 4484 1812 nbbtnn.exe 100 PID 4484 wrote to memory of 436 4484 pdvpj.exe 101 PID 4484 wrote to memory of 436 4484 pdvpj.exe 101 PID 4484 wrote to memory of 436 4484 pdvpj.exe 101 PID 436 wrote to memory of 1292 436 3rlfxxr.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\01fc11a317e4ff7f6c1bb9522739d310_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\01fc11a317e4ff7f6c1bb9522739d310_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\pdvpj.exec:\pdvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\xxxrxff.exec:\xxxrxff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\xlrlfxr.exec:\xlrlfxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\nbbtnh.exec:\nbbtnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\vjdvj.exec:\vjdvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
\??\c:\xfrlxrf.exec:\xfrlxrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\dvdvp.exec:\dvdvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
\??\c:\tbhbhb.exec:\tbhbhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\pvvvd.exec:\pvvvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\frflrlr.exec:\frflrlr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\vjvdv.exec:\vjvdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\1nthbt.exec:\1nthbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\flfrlfx.exec:\flfrlfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\pvdvp.exec:\pvdvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\xfrflxl.exec:\xfrflxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\vpvvd.exec:\vpvvd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\jvjdd.exec:\jvjdd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\hthtnn.exec:\hthtnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\nbbtnn.exec:\nbbtnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\pdvpj.exec:\pdvpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\3rlfxxr.exec:\3rlfxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\9rxlfxr.exec:\9rxlfxr.exe23⤵
- Executes dropped EXE
PID:1292 -
\??\c:\5ntbht.exec:\5ntbht.exe24⤵
- Executes dropped EXE
PID:456 -
\??\c:\hbbtnn.exec:\hbbtnn.exe25⤵
- Executes dropped EXE
PID:3384 -
\??\c:\1pdpv.exec:\1pdpv.exe26⤵
- Executes dropped EXE
PID:2468 -
\??\c:\fxfrfff.exec:\fxfrfff.exe27⤵
- Executes dropped EXE
PID:1616 -
\??\c:\nnthbt.exec:\nnthbt.exe28⤵
- Executes dropped EXE
PID:5020 -
\??\c:\lxfxlfx.exec:\lxfxlfx.exe29⤵
- Executes dropped EXE
PID:2740 -
\??\c:\bthbbb.exec:\bthbbb.exe30⤵
- Executes dropped EXE
PID:1624 -
\??\c:\ffxrffl.exec:\ffxrffl.exe31⤵
- Executes dropped EXE
PID:4436 -
\??\c:\thnhnn.exec:\thnhnn.exe32⤵
- Executes dropped EXE
PID:1316 -
\??\c:\9xxxrlf.exec:\9xxxrlf.exe33⤵
- Executes dropped EXE
PID:4252 -
\??\c:\rlffxfx.exec:\rlffxfx.exe34⤵
- Executes dropped EXE
PID:3156 -
\??\c:\pddvp.exec:\pddvp.exe35⤵
- Executes dropped EXE
PID:3224 -
\??\c:\9xrrffx.exec:\9xrrffx.exe36⤵
- Executes dropped EXE
PID:5108 -
\??\c:\3hbthh.exec:\3hbthh.exe37⤵
- Executes dropped EXE
PID:2360 -
\??\c:\rxlfxxr.exec:\rxlfxxr.exe38⤵
- Executes dropped EXE
PID:1256 -
\??\c:\hbhbtt.exec:\hbhbtt.exe39⤵
- Executes dropped EXE
PID:1620 -
\??\c:\pdjjj.exec:\pdjjj.exe40⤵
- Executes dropped EXE
PID:2076 -
\??\c:\rrrfffx.exec:\rrrfffx.exe41⤵
- Executes dropped EXE
PID:2820 -
\??\c:\tbhhbb.exec:\tbhhbb.exe42⤵
- Executes dropped EXE
PID:3400 -
\??\c:\9bnnnn.exec:\9bnnnn.exe43⤵
- Executes dropped EXE
PID:4056 -
\??\c:\7vjdp.exec:\7vjdp.exe44⤵
- Executes dropped EXE
PID:3740 -
\??\c:\xrxrllr.exec:\xrxrllr.exe45⤵
- Executes dropped EXE
PID:1360 -
\??\c:\tnnnht.exec:\tnnnht.exe46⤵
- Executes dropped EXE
PID:540 -
\??\c:\pjpjd.exec:\pjpjd.exe47⤵
- Executes dropped EXE
PID:1468 -
\??\c:\vppjp.exec:\vppjp.exe48⤵
- Executes dropped EXE
PID:1600 -
\??\c:\fffxrrr.exec:\fffxrrr.exe49⤵
- Executes dropped EXE
PID:4396 -
\??\c:\htbtnn.exec:\htbtnn.exe50⤵
- Executes dropped EXE
PID:1676 -
\??\c:\jjjdp.exec:\jjjdp.exe51⤵
- Executes dropped EXE
PID:1784 -
\??\c:\pvjpp.exec:\pvjpp.exe52⤵
- Executes dropped EXE
PID:2736 -
\??\c:\nttnbt.exec:\nttnbt.exe53⤵
- Executes dropped EXE
PID:964 -
\??\c:\hbnhtt.exec:\hbnhtt.exe54⤵
- Executes dropped EXE
PID:640 -
\??\c:\7vvpj.exec:\7vvpj.exe55⤵
- Executes dropped EXE
PID:3524 -
\??\c:\xxfffll.exec:\xxfffll.exe56⤵
- Executes dropped EXE
PID:2488 -
\??\c:\flffllx.exec:\flffllx.exe57⤵
- Executes dropped EXE
PID:636 -
\??\c:\nnnnnn.exec:\nnnnnn.exe58⤵
- Executes dropped EXE
PID:3772 -
\??\c:\ddpjv.exec:\ddpjv.exe59⤵
- Executes dropped EXE
PID:2456 -
\??\c:\frfxfff.exec:\frfxfff.exe60⤵
- Executes dropped EXE
PID:2788 -
\??\c:\bbhbtb.exec:\bbhbtb.exe61⤵
- Executes dropped EXE
PID:3760 -
\??\c:\jvvvp.exec:\jvvvp.exe62⤵
- Executes dropped EXE
PID:2052 -
\??\c:\xxfxrrl.exec:\xxfxrrl.exe63⤵
- Executes dropped EXE
PID:4412 -
\??\c:\5hhtnt.exec:\5hhtnt.exe64⤵
- Executes dropped EXE
PID:2760 -
\??\c:\pjppd.exec:\pjppd.exe65⤵
- Executes dropped EXE
PID:1004 -
\??\c:\vpvpp.exec:\vpvpp.exe66⤵PID:1824
-
\??\c:\bbbntn.exec:\bbbntn.exe67⤵PID:2328
-
\??\c:\hthbbb.exec:\hthbbb.exe68⤵PID:4124
-
\??\c:\jjjjd.exec:\jjjjd.exe69⤵PID:5096
-
\??\c:\rrffllx.exec:\rrffllx.exe70⤵PID:632
-
\??\c:\ntntth.exec:\ntntth.exe71⤵PID:2500
-
\??\c:\djvpp.exec:\djvpp.exe72⤵PID:3428
-
\??\c:\fxffxxr.exec:\fxffxxr.exe73⤵PID:2144
-
\??\c:\bbttnn.exec:\bbttnn.exe74⤵PID:5012
-
\??\c:\vpvvv.exec:\vpvvv.exe75⤵PID:4912
-
\??\c:\rrllrxl.exec:\rrllrxl.exe76⤵PID:1396
-
\??\c:\hhttbb.exec:\hhttbb.exe77⤵PID:3644
-
\??\c:\vvvpp.exec:\vvvpp.exe78⤵PID:1352
-
\??\c:\lxxrllr.exec:\lxxrllr.exe79⤵PID:2896
-
\??\c:\bnttnn.exec:\bnttnn.exe80⤵PID:1804
-
\??\c:\tnbtbb.exec:\tnbtbb.exe81⤵PID:2872
-
\??\c:\dvdvv.exec:\dvdvv.exe82⤵PID:3032
-
\??\c:\rlrrflf.exec:\rlrrflf.exe83⤵PID:3696
-
\??\c:\tttbbb.exec:\tttbbb.exe84⤵PID:724
-
\??\c:\vvdvj.exec:\vvdvj.exe85⤵PID:4184
-
\??\c:\jjddp.exec:\jjddp.exe86⤵PID:3068
-
\??\c:\rxxxxxx.exec:\rxxxxxx.exe87⤵PID:1744
-
\??\c:\htbbtb.exec:\htbbtb.exe88⤵PID:4660
-
\??\c:\jjvvp.exec:\jjvvp.exe89⤵PID:1340
-
\??\c:\3pdvv.exec:\3pdvv.exe90⤵PID:1420
-
\??\c:\lfrflrr.exec:\lfrflrr.exe91⤵PID:1532
-
\??\c:\tthhtb.exec:\tthhtb.exe92⤵PID:1372
-
\??\c:\vjvpd.exec:\vjvpd.exe93⤵PID:1860
-
\??\c:\llxlrll.exec:\llxlrll.exe94⤵PID:4940
-
\??\c:\rlfxllf.exec:\rlfxllf.exe95⤵PID:4636
-
\??\c:\5hnnhn.exec:\5hnnhn.exe96⤵PID:3424
-
\??\c:\djvpj.exec:\djvpj.exe97⤵PID:2188
-
\??\c:\rrffxrr.exec:\rrffxrr.exe98⤵PID:688
-
\??\c:\rxrrrlf.exec:\rxrrrlf.exe99⤵PID:2412
-
\??\c:\bnthnb.exec:\bnthnb.exe100⤵PID:2628
-
\??\c:\pjppv.exec:\pjppv.exe101⤵PID:2560
-
\??\c:\3xxxrxr.exec:\3xxxrxr.exe102⤵PID:1052
-
\??\c:\ttbtbb.exec:\ttbtbb.exe103⤵PID:2140
-
\??\c:\vdjdd.exec:\vdjdd.exe104⤵PID:4400
-
\??\c:\5tbtnn.exec:\5tbtnn.exe105⤵PID:1640
-
\??\c:\tnbbbb.exec:\tnbbbb.exe106⤵PID:3516
-
\??\c:\jvdpj.exec:\jvdpj.exe107⤵PID:4148
-
\??\c:\rlxlrrx.exec:\rlxlrrx.exe108⤵PID:3024
-
\??\c:\bhnhnh.exec:\bhnhnh.exe109⤵PID:3048
-
\??\c:\dvddp.exec:\dvddp.exe110⤵PID:4716
-
\??\c:\dpdvp.exec:\dpdvp.exe111⤵PID:4416
-
\??\c:\fxxrffx.exec:\fxxrffx.exe112⤵PID:1652
-
\??\c:\1nttbb.exec:\1nttbb.exe113⤵PID:2044
-
\??\c:\dvvvj.exec:\dvvvj.exe114⤵PID:1676
-
\??\c:\lxlfrrr.exec:\lxlfrrr.exe115⤵PID:740
-
\??\c:\flxrflf.exec:\flxrflf.exe116⤵PID:2736
-
\??\c:\9hbttn.exec:\9hbttn.exe117⤵PID:964
-
\??\c:\pddvd.exec:\pddvd.exe118⤵PID:640
-
\??\c:\fflfxxr.exec:\fflfxxr.exe119⤵PID:2248
-
\??\c:\xrxrxxl.exec:\xrxrxxl.exe120⤵PID:2488
-
\??\c:\1ntnhb.exec:\1ntnhb.exe121⤵PID:636
-
\??\c:\jjvpv.exec:\jjvpv.exe122⤵PID:4552
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-