Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
01/06/2024, 04:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8cf49fb36ba7877d2a6507fb8d7087c0_NeikiAnalytics.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
8cf49fb36ba7877d2a6507fb8d7087c0_NeikiAnalytics.exe
-
Size
105KB
-
MD5
8cf49fb36ba7877d2a6507fb8d7087c0
-
SHA1
a9c7e49481ed62eac53a0db7175c91ab796a51b8
-
SHA256
b8772df95e941b06040c9fb9ab27e41c1032b0a1b0d2c78909e4c419a1d5eccf
-
SHA512
99c8fe53121bcd2c36b10b961a83c61e44373c1c905ad3c730ce1b1a9ef263ee7d82d3e97a373e9ea035b192a7e68aab07a426a1c9b237f2969d6b343ce8c006
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoTNKDeS98hPUdHV7RNzfJNI:ymb3NkkiQ3mdBjFo5KDe88g1fDI
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2068-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/548-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1792-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1792-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2964-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-64-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1424-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/632-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2004-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1636-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2268-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1040-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1660-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 548 xffxflx.exe 1792 nnbhbb.exe 2964 pjjpd.exe 2664 ntnbbn.exe 2748 tnnnhh.exe 2528 7vpdv.exe 2760 xffxrrl.exe 2684 hhthth.exe 2516 pjvjv.exe 2924 5vddd.exe 2484 3thhnn.exe 1424 3hhhtb.exe 1960 jpddp.exe 632 rfrrlrx.exe 2004 nntnhb.exe 2580 1nttbt.exe 2412 vpdvd.exe 1636 ffrfrrf.exe 2796 3hhtnt.exe 2248 dpjjp.exe 2268 jjdjv.exe 536 7rlxrfr.exe 1040 ttbbnt.exe 2864 jddjd.exe 1652 7flrfxx.exe 1392 3ttbhn.exe 1532 5jjjv.exe 1000 3vvdd.exe 1660 xrllflr.exe 2124 nbhbhh.exe 2364 ttnttb.exe 2096 vppvd.exe 1628 xrflxfr.exe 1588 xrlrxlr.exe 760 nhtbnn.exe 2780 tnnbhb.exe 2700 dvjvp.exe 1796 jvjvp.exe 812 rlxlflx.exe 3020 thbhhh.exe 2748 nhtbtt.exe 2072 7dpvj.exe 2836 jjdjp.exe 2712 pjddv.exe 2520 fxlxflf.exe 2596 rxfxlff.exe 2640 nnbhhh.exe 1908 jpdvv.exe 2484 pjddj.exe 1116 7rfrrlr.exe 1328 7fxfllf.exe 2172 nbnhnh.exe 1948 bbbtnb.exe 2004 vpddj.exe 352 1jdjj.exe 376 7xxxxrr.exe 2908 rlflxlr.exe 1636 thtttt.exe 2252 1hbtbh.exe 2464 dvjjv.exe 2268 jvvvj.exe 780 rlfrxxl.exe 1476 hbnttb.exe 664 hnnbhb.exe -
resource yara_rule behavioral1/memory/2068-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/548-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1424-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/632-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2004-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1636-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2268-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1040-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-283-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-292-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2068 wrote to memory of 548 2068 8cf49fb36ba7877d2a6507fb8d7087c0_NeikiAnalytics.exe 28 PID 2068 wrote to memory of 548 2068 8cf49fb36ba7877d2a6507fb8d7087c0_NeikiAnalytics.exe 28 PID 2068 wrote to memory of 548 2068 8cf49fb36ba7877d2a6507fb8d7087c0_NeikiAnalytics.exe 28 PID 2068 wrote to memory of 548 2068 8cf49fb36ba7877d2a6507fb8d7087c0_NeikiAnalytics.exe 28 PID 548 wrote to memory of 1792 548 xffxflx.exe 29 PID 548 wrote to memory of 1792 548 xffxflx.exe 29 PID 548 wrote to memory of 1792 548 xffxflx.exe 29 PID 548 wrote to memory of 1792 548 xffxflx.exe 29 PID 1792 wrote to memory of 2964 1792 nnbhbb.exe 30 PID 1792 wrote to memory of 2964 1792 nnbhbb.exe 30 PID 1792 wrote to memory of 2964 1792 nnbhbb.exe 30 PID 1792 wrote to memory of 2964 1792 nnbhbb.exe 30 PID 2964 wrote to memory of 2664 2964 pjjpd.exe 31 PID 2964 wrote to memory of 2664 2964 pjjpd.exe 31 PID 2964 wrote to memory of 2664 2964 pjjpd.exe 31 PID 2964 wrote to memory of 2664 2964 pjjpd.exe 31 PID 2664 wrote to memory of 2748 2664 ntnbbn.exe 32 PID 2664 wrote to memory of 2748 2664 ntnbbn.exe 32 PID 2664 wrote to memory of 2748 2664 ntnbbn.exe 32 PID 2664 wrote to memory of 2748 2664 ntnbbn.exe 32 PID 2748 wrote to memory of 2528 2748 tnnnhh.exe 33 PID 2748 wrote to memory of 2528 2748 tnnnhh.exe 33 PID 2748 wrote to memory of 2528 2748 tnnnhh.exe 33 PID 2748 wrote to memory of 2528 2748 tnnnhh.exe 33 PID 2528 wrote to memory of 2760 2528 7vpdv.exe 34 PID 2528 wrote to memory of 2760 2528 7vpdv.exe 34 PID 2528 wrote to memory of 2760 2528 7vpdv.exe 34 PID 2528 wrote to memory of 2760 2528 7vpdv.exe 34 PID 2760 wrote to memory of 2684 2760 xffxrrl.exe 35 PID 2760 wrote to memory of 2684 2760 xffxrrl.exe 35 PID 2760 wrote to memory of 2684 2760 xffxrrl.exe 35 PID 2760 wrote to memory of 2684 2760 xffxrrl.exe 35 PID 2684 wrote to memory of 2516 2684 hhthth.exe 36 PID 2684 wrote to memory of 2516 2684 hhthth.exe 36 PID 2684 wrote to memory of 2516 2684 hhthth.exe 36 PID 2684 wrote to memory of 2516 2684 hhthth.exe 36 PID 2516 wrote to memory of 2924 2516 pjvjv.exe 37 PID 2516 wrote to memory of 2924 2516 pjvjv.exe 37 PID 2516 wrote to memory of 2924 2516 pjvjv.exe 37 PID 2516 wrote to memory of 2924 2516 pjvjv.exe 37 PID 2924 wrote to memory of 2484 2924 5vddd.exe 38 PID 2924 wrote to memory of 2484 2924 5vddd.exe 38 PID 2924 wrote to memory of 2484 2924 5vddd.exe 38 PID 2924 wrote to memory of 2484 2924 5vddd.exe 38 PID 2484 wrote to memory of 1424 2484 3thhnn.exe 39 PID 2484 wrote to memory of 1424 2484 3thhnn.exe 39 PID 2484 wrote to memory of 1424 2484 3thhnn.exe 39 PID 2484 wrote to memory of 1424 2484 3thhnn.exe 39 PID 1424 wrote to memory of 1960 1424 3hhhtb.exe 40 PID 1424 wrote to memory of 1960 1424 3hhhtb.exe 40 PID 1424 wrote to memory of 1960 1424 3hhhtb.exe 40 PID 1424 wrote to memory of 1960 1424 3hhhtb.exe 40 PID 1960 wrote to memory of 632 1960 jpddp.exe 41 PID 1960 wrote to memory of 632 1960 jpddp.exe 41 PID 1960 wrote to memory of 632 1960 jpddp.exe 41 PID 1960 wrote to memory of 632 1960 jpddp.exe 41 PID 632 wrote to memory of 2004 632 rfrrlrx.exe 42 PID 632 wrote to memory of 2004 632 rfrrlrx.exe 42 PID 632 wrote to memory of 2004 632 rfrrlrx.exe 42 PID 632 wrote to memory of 2004 632 rfrrlrx.exe 42 PID 2004 wrote to memory of 2580 2004 nntnhb.exe 43 PID 2004 wrote to memory of 2580 2004 nntnhb.exe 43 PID 2004 wrote to memory of 2580 2004 nntnhb.exe 43 PID 2004 wrote to memory of 2580 2004 nntnhb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cf49fb36ba7877d2a6507fb8d7087c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8cf49fb36ba7877d2a6507fb8d7087c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\xffxflx.exec:\xffxflx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\nnbhbb.exec:\nnbhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\pjjpd.exec:\pjjpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\ntnbbn.exec:\ntnbbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\tnnnhh.exec:\tnnnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\7vpdv.exec:\7vpdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\xffxrrl.exec:\xffxrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\hhthth.exec:\hhthth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\pjvjv.exec:\pjvjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\5vddd.exec:\5vddd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\3thhnn.exec:\3thhnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\3hhhtb.exec:\3hhhtb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\jpddp.exec:\jpddp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\rfrrlrx.exec:\rfrrlrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\nntnhb.exec:\nntnhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\1nttbt.exec:\1nttbt.exe17⤵
- Executes dropped EXE
PID:2580 -
\??\c:\vpdvd.exec:\vpdvd.exe18⤵
- Executes dropped EXE
PID:2412 -
\??\c:\ffrfrrf.exec:\ffrfrrf.exe19⤵
- Executes dropped EXE
PID:1636 -
\??\c:\3hhtnt.exec:\3hhtnt.exe20⤵
- Executes dropped EXE
PID:2796 -
\??\c:\dpjjp.exec:\dpjjp.exe21⤵
- Executes dropped EXE
PID:2248 -
\??\c:\jjdjv.exec:\jjdjv.exe22⤵
- Executes dropped EXE
PID:2268 -
\??\c:\7rlxrfr.exec:\7rlxrfr.exe23⤵
- Executes dropped EXE
PID:536 -
\??\c:\ttbbnt.exec:\ttbbnt.exe24⤵
- Executes dropped EXE
PID:1040 -
\??\c:\jddjd.exec:\jddjd.exe25⤵
- Executes dropped EXE
PID:2864 -
\??\c:\7flrfxx.exec:\7flrfxx.exe26⤵
- Executes dropped EXE
PID:1652 -
\??\c:\3ttbhn.exec:\3ttbhn.exe27⤵
- Executes dropped EXE
PID:1392 -
\??\c:\5jjjv.exec:\5jjjv.exe28⤵
- Executes dropped EXE
PID:1532 -
\??\c:\3vvdd.exec:\3vvdd.exe29⤵
- Executes dropped EXE
PID:1000 -
\??\c:\xrllflr.exec:\xrllflr.exe30⤵
- Executes dropped EXE
PID:1660 -
\??\c:\nbhbhh.exec:\nbhbhh.exe31⤵
- Executes dropped EXE
PID:2124 -
\??\c:\ttnttb.exec:\ttnttb.exe32⤵
- Executes dropped EXE
PID:2364 -
\??\c:\vppvd.exec:\vppvd.exe33⤵
- Executes dropped EXE
PID:2096 -
\??\c:\xrflxfr.exec:\xrflxfr.exe34⤵
- Executes dropped EXE
PID:1628 -
\??\c:\xrlrxlr.exec:\xrlrxlr.exe35⤵
- Executes dropped EXE
PID:1588 -
\??\c:\nhtbnn.exec:\nhtbnn.exe36⤵
- Executes dropped EXE
PID:760 -
\??\c:\tnnbhb.exec:\tnnbhb.exe37⤵
- Executes dropped EXE
PID:2780 -
\??\c:\dvjvp.exec:\dvjvp.exe38⤵
- Executes dropped EXE
PID:2700 -
\??\c:\jvjvp.exec:\jvjvp.exe39⤵
- Executes dropped EXE
PID:1796 -
\??\c:\rlxlflx.exec:\rlxlflx.exe40⤵
- Executes dropped EXE
PID:812 -
\??\c:\thbhhh.exec:\thbhhh.exe41⤵
- Executes dropped EXE
PID:3020 -
\??\c:\nhtbtt.exec:\nhtbtt.exe42⤵
- Executes dropped EXE
PID:2748 -
\??\c:\7dpvj.exec:\7dpvj.exe43⤵
- Executes dropped EXE
PID:2072 -
\??\c:\jjdjp.exec:\jjdjp.exe44⤵
- Executes dropped EXE
PID:2836 -
\??\c:\pjddv.exec:\pjddv.exe45⤵
- Executes dropped EXE
PID:2712 -
\??\c:\fxlxflf.exec:\fxlxflf.exe46⤵
- Executes dropped EXE
PID:2520 -
\??\c:\rxfxlff.exec:\rxfxlff.exe47⤵
- Executes dropped EXE
PID:2596 -
\??\c:\nnbhhh.exec:\nnbhhh.exe48⤵
- Executes dropped EXE
PID:2640 -
\??\c:\jpdvv.exec:\jpdvv.exe49⤵
- Executes dropped EXE
PID:1908 -
\??\c:\pjddj.exec:\pjddj.exe50⤵
- Executes dropped EXE
PID:2484 -
\??\c:\7rfrrlr.exec:\7rfrrlr.exe51⤵
- Executes dropped EXE
PID:1116 -
\??\c:\7fxfllf.exec:\7fxfllf.exe52⤵
- Executes dropped EXE
PID:1328 -
\??\c:\nbnhnh.exec:\nbnhnh.exe53⤵
- Executes dropped EXE
PID:2172 -
\??\c:\bbbtnb.exec:\bbbtnb.exe54⤵
- Executes dropped EXE
PID:1948 -
\??\c:\vpddj.exec:\vpddj.exe55⤵
- Executes dropped EXE
PID:2004 -
\??\c:\1jdjj.exec:\1jdjj.exe56⤵
- Executes dropped EXE
PID:352 -
\??\c:\7xxxxrr.exec:\7xxxxrr.exe57⤵
- Executes dropped EXE
PID:376 -
\??\c:\rlflxlr.exec:\rlflxlr.exe58⤵
- Executes dropped EXE
PID:2908 -
\??\c:\thtttt.exec:\thtttt.exe59⤵
- Executes dropped EXE
PID:1636 -
\??\c:\1hbtbh.exec:\1hbtbh.exe60⤵
- Executes dropped EXE
PID:2252 -
\??\c:\dvjjv.exec:\dvjjv.exe61⤵
- Executes dropped EXE
PID:2464 -
\??\c:\jvvvj.exec:\jvvvj.exe62⤵
- Executes dropped EXE
PID:2268 -
\??\c:\rlfrxxl.exec:\rlfrxxl.exe63⤵
- Executes dropped EXE
PID:780 -
\??\c:\hbnttb.exec:\hbnttb.exe64⤵
- Executes dropped EXE
PID:1476 -
\??\c:\hnnbhb.exec:\hnnbhb.exe65⤵
- Executes dropped EXE
PID:664 -
\??\c:\tnhhtb.exec:\tnhhtb.exe66⤵PID:1848
-
\??\c:\vvdjd.exec:\vvdjd.exe67⤵PID:960
-
\??\c:\xffxflr.exec:\xffxflr.exe68⤵PID:1036
-
\??\c:\rlflrfl.exec:\rlflrfl.exe69⤵PID:1148
-
\??\c:\hnbbth.exec:\hnbbth.exe70⤵PID:3016
-
\??\c:\tthnth.exec:\tthnth.exe71⤵PID:592
-
\??\c:\jdvvp.exec:\jdvvp.exe72⤵PID:1604
-
\??\c:\jjvjv.exec:\jjvjv.exe73⤵PID:568
-
\??\c:\1llfllx.exec:\1llfllx.exe74⤵PID:316
-
\??\c:\7lflrfr.exec:\7lflrfr.exe75⤵PID:1564
-
\??\c:\hbttnn.exec:\hbttnn.exe76⤵PID:2096
-
\??\c:\ttnthh.exec:\ttnthh.exe77⤵PID:1684
-
\??\c:\3dddv.exec:\3dddv.exe78⤵PID:1588
-
\??\c:\5ddjv.exec:\5ddjv.exe79⤵PID:760
-
\??\c:\llxfrrx.exec:\llxfrrx.exe80⤵PID:2780
-
\??\c:\3lffllf.exec:\3lffllf.exe81⤵PID:2964
-
\??\c:\7bnntb.exec:\7bnntb.exe82⤵PID:1796
-
\??\c:\bbnnnn.exec:\bbnnnn.exe83⤵PID:2672
-
\??\c:\ddpvp.exec:\ddpvp.exe84⤵PID:3020
-
\??\c:\jvpvv.exec:\jvpvv.exe85⤵PID:2756
-
\??\c:\lfxxllr.exec:\lfxxllr.exe86⤵PID:2760
-
\??\c:\5rxfffl.exec:\5rxfffl.exe87⤵PID:2740
-
\??\c:\tnhnhn.exec:\tnhnhn.exe88⤵PID:3004
-
\??\c:\5bnthh.exec:\5bnthh.exe89⤵PID:2520
-
\??\c:\vvdjv.exec:\vvdjv.exe90⤵PID:2596
-
\??\c:\5vvdj.exec:\5vvdj.exe91⤵PID:2936
-
\??\c:\xrlrfll.exec:\xrlrfll.exe92⤵PID:1908
-
\??\c:\ffrfllx.exec:\ffrfllx.exe93⤵PID:1424
-
\??\c:\bnnhtb.exec:\bnnhtb.exe94⤵PID:1608
-
\??\c:\1nnhnt.exec:\1nnhnt.exe95⤵PID:2216
-
\??\c:\jdvdd.exec:\jdvdd.exe96⤵PID:2200
-
\??\c:\vvpdj.exec:\vvpdj.exe97⤵PID:1948
-
\??\c:\xrllxxl.exec:\xrllxxl.exe98⤵PID:2004
-
\??\c:\5rlrffr.exec:\5rlrffr.exe99⤵PID:2588
-
\??\c:\httbnt.exec:\httbnt.exe100⤵PID:376
-
\??\c:\bththn.exec:\bththn.exe101⤵PID:1756
-
\??\c:\5jdpp.exec:\5jdpp.exe102⤵PID:1636
-
\??\c:\ppjvv.exec:\ppjvv.exe103⤵PID:2252
-
\??\c:\1xllxrf.exec:\1xllxrf.exe104⤵PID:2464
-
\??\c:\9rlrrfl.exec:\9rlrrfl.exe105⤵PID:2268
-
\??\c:\lfrfrrf.exec:\lfrfrrf.exe106⤵PID:780
-
\??\c:\5htbtb.exec:\5htbtb.exe107⤵PID:1476
-
\??\c:\jppjp.exec:\jppjp.exe108⤵PID:664
-
\??\c:\pjjvv.exec:\pjjvv.exe109⤵PID:1540
-
\??\c:\5rfrxrx.exec:\5rfrxrx.exe110⤵PID:960
-
\??\c:\lxfrlrf.exec:\lxfrlrf.exe111⤵PID:1532
-
\??\c:\nntthn.exec:\nntthn.exe112⤵PID:1148
-
\??\c:\hbnnbb.exec:\hbnnbb.exe113⤵PID:2432
-
\??\c:\9vdpd.exec:\9vdpd.exe114⤵PID:592
-
\??\c:\9vpvd.exec:\9vpvd.exe115⤵PID:3060
-
\??\c:\llxfrrx.exec:\llxfrrx.exe116⤵PID:568
-
\??\c:\1lxfllx.exec:\1lxfllx.exe117⤵PID:1600
-
\??\c:\nhhhnt.exec:\nhhhnt.exe118⤵PID:1580
-
\??\c:\hbnbnt.exec:\hbnbnt.exe119⤵PID:2096
-
\??\c:\bbthhn.exec:\bbthhn.exe120⤵PID:2916
-
\??\c:\pjdjd.exec:\pjdjd.exe121⤵PID:2604
-
\??\c:\5ppvv.exec:\5ppvv.exe122⤵PID:760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-