Analysis
- max time kernel
150s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
22/06/2024, 01:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7556d2f2f07eb9578cac1391edd44623bd7c5cfb40013e00bfc00355fbcb9828_NeikiAnalytics.exe
Resource
win7-20240611-en
5 signatures
150 seconds
General
- Target 7556d2f2f07eb9578cac1391edd44623bd7c5cfb40013e00bfc00355fbcb9828_NeikiAnalytics.exe
- Size 481KB
- Sample240622-bhl5gstepn
- SHA256 7556d2f2f07eb9578cac1391edd44623bd7c5cfb40013e00bfc00355fbcb9828
- MD5 a1fb4e5b3e655099b0cc4b3cd3a23c70
- SHA1 faef930df48806da99a129e2a6a5926613664071
- SHA512 2ac716d6f1655fd0384b5fb28e4b4a4f6577e73eaba54d67e2f8bc2e92739941a5eaeb564e9631b656aa14e0edf62a552607499b4ad62ee12dfe27b0ef306009
- SSDEEP 12288:n3C9uDVw6326pKZ9asZqoZHz+evcn0Meh2Fez/:Su326p0aroZt0s/
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/4676-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4676-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1536-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4600-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3524-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/888-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2064-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3744-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1904-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2284-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4656-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2564-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/792-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3664-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3380-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4068-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3592-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1512-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4212-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2260-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1044-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3812-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 1536 xfxrlfr.exe 4600 3rxlffx.exe 3524 ntbnhh.exe 888 nhhbtn.exe 2064 1fxlfxr.exe 3744 9jjvp.exe 2968 dppjj.exe 1904 vpvpj.exe 2676 jpjvd.exe 2284 htbnhb.exe 5004 dvvpv.exe 4656 3ttnhh.exe 2564 hnthbt.exe 792 rxfxfrl.exe 3664 xlllxrx.exe 684 frxflxx.exe 3380 btbnnh.exe 3196 vpvpd.exe 4068 nhhbhh.exe 3592 fxfxrlx.exe 2028 pdjpd.exe 1512 llxxfxr.exe 1884 3dpjj.exe 5108 3vdvp.exe 4212 dppjd.exe 2260 nbthth.exe 1580 tnbntn.exe 4532 jvdvp.exe 2832 rrllfxx.exe 1044 llxrlxr.exe 3812 pdjjv.exe 4608 djjdd.exe 2884 rffxlfx.exe 1108 bbhbhb.exe 2692 vjpjd.exe 4816 5xrfxrl.exe 3412 hbhtnb.exe 4356 jvddj.exe 4976 lxxrfxf.exe 2644 1bbthb.exe 872 hbtnhb.exe 1632 vpjdj.exe 4804 xllfxxr.exe 4800 nthnth.exe 3624 3pddd.exe 4852 frxffll.exe 208 5xffffx.exe 4836 thnbbb.exe 344 vdpjv.exe 2740 fflfrrf.exe 3516 9nnnhh.exe 2888 5jdpp.exe 1536 frxlxrr.exe 4824 bhtntn.exe 1548 hhbtnh.exe 2164 dvdpj.exe 2908 fllfxxr.exe 1116 bhnhbt.exe 2892 ntbhnn.exe 3744 pvjdv.exe 4668 rlxlrlr.exe 3404 thnhbh.exe 1904 bhnbtn.exe 3076 jvpjv.exe -
resource yara_rule behavioral2/memory/4676-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4676-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1536-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4600-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3524-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/888-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2064-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2064-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2064-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3744-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1904-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1904-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1904-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2284-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2564-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/792-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3664-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4068-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3592-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1512-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4212-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2260-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4532-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1044-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3812-205-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4676 wrote to memory of 1536 4676 7556d2f2f07eb9578cac1391edd44623bd7c5cfb40013e00bfc00355fbcb9828_NeikiAnalytics.exe 81 PID 4676 wrote to memory of 1536 4676 7556d2f2f07eb9578cac1391edd44623bd7c5cfb40013e00bfc00355fbcb9828_NeikiAnalytics.exe 81 PID 4676 wrote to memory of 1536 4676 7556d2f2f07eb9578cac1391edd44623bd7c5cfb40013e00bfc00355fbcb9828_NeikiAnalytics.exe 81 PID 1536 wrote to memory of 4600 1536 xfxrlfr.exe 82 PID 1536 wrote to memory of 4600 1536 xfxrlfr.exe 82 PID 1536 wrote to memory of 4600 1536 xfxrlfr.exe 82 PID 4600 wrote to memory of 3524 4600 3rxlffx.exe 83 PID 4600 wrote to memory of 3524 4600 3rxlffx.exe 83 PID 4600 wrote to memory of 3524 4600 3rxlffx.exe 83 PID 3524 wrote to memory of 888 3524 ntbnhh.exe 84 PID 3524 wrote to memory of 888 3524 ntbnhh.exe 84 PID 3524 wrote to memory of 888 3524 ntbnhh.exe 84 PID 888 wrote to memory of 2064 888 nhhbtn.exe 85 PID 888 wrote to memory of 2064 888 nhhbtn.exe 85 PID 888 wrote to memory of 2064 888 nhhbtn.exe 85 PID 2064 wrote to memory of 3744 2064 1fxlfxr.exe 86 PID 2064 wrote to memory of 3744 2064 1fxlfxr.exe 86 PID 2064 wrote to memory of 3744 2064 1fxlfxr.exe 86 PID 3744 wrote to memory of 2968 3744 9jjvp.exe 87 PID 3744 wrote to memory of 2968 3744 9jjvp.exe 87 PID 3744 wrote to memory of 2968 3744 9jjvp.exe 87 PID 2968 wrote to memory of 1904 2968 dppjj.exe 88 PID 2968 wrote to memory of 1904 2968 dppjj.exe 88 PID 2968 wrote to memory of 1904 2968 dppjj.exe 88 PID 1904 wrote to memory of 2676 1904 vpvpj.exe 89 PID 1904 wrote to memory of 2676 1904 vpvpj.exe 89 PID 1904 wrote to memory of 2676 1904 vpvpj.exe 89 PID 2676 wrote to memory of 2284 2676 jpjvd.exe 90 PID 2676 wrote to memory of 2284 2676 jpjvd.exe 90 PID 2676 wrote to memory of 2284 2676 jpjvd.exe 90 PID 2284 wrote to memory of 5004 2284 htbnhb.exe 91 PID 2284 wrote to memory of 5004 2284 htbnhb.exe 91 PID 2284 wrote to memory of 5004 2284 htbnhb.exe 91 PID 5004 wrote to memory of 4656 5004 dvvpv.exe 92 PID 5004 wrote to memory of 4656 5004 dvvpv.exe 92 PID 5004 wrote to memory of 4656 5004 dvvpv.exe 92 PID 4656 wrote to memory of 2564 4656 3ttnhh.exe 93 PID 4656 wrote to memory of 2564 4656 3ttnhh.exe 93 PID 4656 wrote to memory of 2564 4656 3ttnhh.exe 93 PID 2564 wrote to memory of 792 2564 hnthbt.exe 94 PID 2564 wrote to memory of 792 2564 hnthbt.exe 94 PID 2564 wrote to memory of 792 2564 hnthbt.exe 94 PID 792 wrote to memory of 3664 792 rxfxfrl.exe 95 PID 792 wrote to memory of 3664 792 rxfxfrl.exe 95 PID 792 wrote to memory of 3664 792 rxfxfrl.exe 95 PID 3664 wrote to memory of 684 3664 xlllxrx.exe 96 PID 3664 wrote to memory of 684 3664 xlllxrx.exe 96 PID 3664 wrote to memory of 684 3664 xlllxrx.exe 96 PID 684 wrote to memory of 3380 684 frxflxx.exe 97 PID 684 wrote to memory of 3380 684 frxflxx.exe 97 PID 684 wrote to memory of 3380 684 frxflxx.exe 97 PID 3380 wrote to memory of 3196 3380 btbnnh.exe 98 PID 3380 wrote to memory of 3196 3380 btbnnh.exe 98 PID 3380 wrote to memory of 3196 3380 btbnnh.exe 98 PID 3196 wrote to memory of 4068 3196 vpvpd.exe 99 PID 3196 wrote to memory of 4068 3196 vpvpd.exe 99 PID 3196 wrote to memory of 4068 3196 vpvpd.exe 99 PID 4068 wrote to memory of 3592 4068 nhhbhh.exe 100 PID 4068 wrote to memory of 3592 4068 nhhbhh.exe 100 PID 4068 wrote to memory of 3592 4068 nhhbhh.exe 100 PID 3592 wrote to memory of 2028 3592 fxfxrlx.exe 101 PID 3592 wrote to memory of 2028 3592 fxfxrlx.exe 101 PID 3592 wrote to memory of 2028 3592 fxfxrlx.exe 101 PID 2028 wrote to memory of 1512 2028 pdjpd.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\7556d2f2f07eb9578cac1391edd44623bd7c5cfb40013e00bfc00355fbcb9828_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7556d2f2f07eb9578cac1391edd44623bd7c5cfb40013e00bfc00355fbcb9828_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\xfxrlfr.exec:\xfxrlfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\3rxlffx.exec:\3rxlffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\ntbnhh.exec:\ntbnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\nhhbtn.exec:\nhhbtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\1fxlfxr.exec:\1fxlfxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\9jjvp.exec:\9jjvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\dppjj.exec:\dppjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\vpvpj.exec:\vpvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\jpjvd.exec:\jpjvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\htbnhb.exec:\htbnhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\dvvpv.exec:\dvvpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\3ttnhh.exec:\3ttnhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\hnthbt.exec:\hnthbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\rxfxfrl.exec:\rxfxfrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\xlllxrx.exec:\xlllxrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\frxflxx.exec:\frxflxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\btbnnh.exec:\btbnnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\vpvpd.exec:\vpvpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\nhhbhh.exec:\nhhbhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\fxfxrlx.exec:\fxfxrlx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\pdjpd.exec:\pdjpd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\llxxfxr.exec:\llxxfxr.exe23⤵
- Executes dropped EXE
PID:1512 -
\??\c:\3dpjj.exec:\3dpjj.exe24⤵
- Executes dropped EXE
PID:1884 -
\??\c:\3vdvp.exec:\3vdvp.exe25⤵
- Executes dropped EXE
PID:5108 -
\??\c:\dppjd.exec:\dppjd.exe26⤵
- Executes dropped EXE
PID:4212 -
\??\c:\nbthth.exec:\nbthth.exe27⤵
- Executes dropped EXE
PID:2260 -
\??\c:\tnbntn.exec:\tnbntn.exe28⤵
- Executes dropped EXE
PID:1580 -
\??\c:\jvdvp.exec:\jvdvp.exe29⤵
- Executes dropped EXE
PID:4532 -
\??\c:\rrllfxx.exec:\rrllfxx.exe30⤵
- Executes dropped EXE
PID:2832 -
\??\c:\llxrlxr.exec:\llxrlxr.exe31⤵
- Executes dropped EXE
PID:1044 -
\??\c:\pdjjv.exec:\pdjjv.exe32⤵
- Executes dropped EXE
PID:3812 -
\??\c:\djjdd.exec:\djjdd.exe33⤵
- Executes dropped EXE
PID:4608 -
\??\c:\rffxlfx.exec:\rffxlfx.exe34⤵
- Executes dropped EXE
PID:2884 -
\??\c:\bbhbhb.exec:\bbhbhb.exe35⤵
- Executes dropped EXE
PID:1108 -
\??\c:\vjpjd.exec:\vjpjd.exe36⤵
- Executes dropped EXE
PID:2692 -
\??\c:\5xrfxrl.exec:\5xrfxrl.exe37⤵
- Executes dropped EXE
PID:4816 -
\??\c:\hbhtnb.exec:\hbhtnb.exe38⤵
- Executes dropped EXE
PID:3412 -
\??\c:\jvddj.exec:\jvddj.exe39⤵
- Executes dropped EXE
PID:4356 -
\??\c:\lxxrfxf.exec:\lxxrfxf.exe40⤵
- Executes dropped EXE
PID:4976 -
\??\c:\1bbthb.exec:\1bbthb.exe41⤵
- Executes dropped EXE
PID:2644 -
\??\c:\hbtnhb.exec:\hbtnhb.exe42⤵
- Executes dropped EXE
PID:872 -
\??\c:\vpjdj.exec:\vpjdj.exe43⤵
- Executes dropped EXE
PID:1632 -
\??\c:\xllfxxr.exec:\xllfxxr.exe44⤵
- Executes dropped EXE
PID:4804 -
\??\c:\nthnth.exec:\nthnth.exe45⤵
- Executes dropped EXE
PID:4800 -
\??\c:\3pddd.exec:\3pddd.exe46⤵
- Executes dropped EXE
PID:3624 -
\??\c:\frxffll.exec:\frxffll.exe47⤵
- Executes dropped EXE
PID:4852 -
\??\c:\5xffffx.exec:\5xffffx.exe48⤵
- Executes dropped EXE
PID:208 -
\??\c:\thnbbb.exec:\thnbbb.exe49⤵
- Executes dropped EXE
PID:4836 -
\??\c:\vdpjv.exec:\vdpjv.exe50⤵
- Executes dropped EXE
PID:344 -
\??\c:\fflfrrf.exec:\fflfrrf.exe51⤵
- Executes dropped EXE
PID:2740 -
\??\c:\9nnnhh.exec:\9nnnhh.exe52⤵
- Executes dropped EXE
PID:3516 -
\??\c:\5jdpp.exec:\5jdpp.exe53⤵
- Executes dropped EXE
PID:2888 -
\??\c:\frxlxrr.exec:\frxlxrr.exe54⤵
- Executes dropped EXE
PID:1536 -
\??\c:\bhtntn.exec:\bhtntn.exe55⤵
- Executes dropped EXE
PID:4824 -
\??\c:\hhbtnh.exec:\hhbtnh.exe56⤵
- Executes dropped EXE
PID:1548 -
\??\c:\dvdpj.exec:\dvdpj.exe57⤵
- Executes dropped EXE
PID:2164 -
\??\c:\fllfxxr.exec:\fllfxxr.exe58⤵
- Executes dropped EXE
PID:2908 -
\??\c:\bhnhbt.exec:\bhnhbt.exe59⤵
- Executes dropped EXE
PID:1116 -
\??\c:\ntbhnn.exec:\ntbhnn.exe60⤵
- Executes dropped EXE
PID:2892 -
\??\c:\pvjdv.exec:\pvjdv.exe61⤵
- Executes dropped EXE
PID:3744 -
\??\c:\rlxlrlr.exec:\rlxlrlr.exe62⤵
- Executes dropped EXE
PID:4668 -
\??\c:\thnhbh.exec:\thnhbh.exe63⤵
- Executes dropped EXE
PID:3404 -
\??\c:\bhnbtn.exec:\bhnbtn.exe64⤵
- Executes dropped EXE
PID:1904 -
\??\c:\jvpjv.exec:\jvpjv.exe65⤵
- Executes dropped EXE
PID:3076 -
\??\c:\rllxlfx.exec:\rllxlfx.exe66⤵PID:2660
-
\??\c:\xllfrfx.exec:\xllfrfx.exe67⤵PID:1736
-
\??\c:\nbbnhb.exec:\nbbnhb.exe68⤵PID:3960
-
\??\c:\3vppd.exec:\3vppd.exe69⤵PID:1564
-
\??\c:\rrrlffx.exec:\rrrlffx.exe70⤵PID:5080
-
\??\c:\xrrfxrl.exec:\xrrfxrl.exe71⤵PID:440
-
\??\c:\btthtt.exec:\btthtt.exe72⤵PID:3252
-
\??\c:\5nhbtt.exec:\5nhbtt.exe73⤵PID:792
-
\??\c:\ppdvp.exec:\ppdvp.exe74⤵PID:3536
-
\??\c:\5xfxllf.exec:\5xfxllf.exe75⤵PID:4412
-
\??\c:\7bbthh.exec:\7bbthh.exe76⤵PID:2984
-
\??\c:\ppvpj.exec:\ppvpj.exe77⤵PID:1908
-
\??\c:\djpjv.exec:\djpjv.exe78⤵PID:1320
-
\??\c:\rlxrfxr.exec:\rlxrfxr.exe79⤵PID:4712
-
\??\c:\hhbtnn.exec:\hhbtnn.exe80⤵PID:1260
-
\??\c:\9vvpj.exec:\9vvpj.exe81⤵PID:972
-
\??\c:\rrxrfxl.exec:\rrxrfxl.exe82⤵PID:4012
-
\??\c:\frrfxxr.exec:\frrfxxr.exe83⤵PID:3248
-
\??\c:\tthbnb.exec:\tthbnb.exe84⤵PID:828
-
\??\c:\jdjvd.exec:\jdjvd.exe85⤵PID:3428
-
\??\c:\frxrlrl.exec:\frxrlrl.exe86⤵PID:412
-
\??\c:\ntbnnt.exec:\ntbnnt.exe87⤵PID:4820
-
\??\c:\nbhbtt.exec:\nbhbtt.exe88⤵PID:2548
-
\??\c:\pjvjv.exec:\pjvjv.exe89⤵PID:2928
-
\??\c:\jvvjv.exec:\jvvjv.exe90⤵PID:2808
-
\??\c:\rrfrrrr.exec:\rrfrrrr.exe91⤵PID:744
-
\??\c:\hnnbth.exec:\hnnbth.exe92⤵PID:4184
-
\??\c:\bnbddv.exec:\bnbddv.exe93⤵PID:1644
-
\??\c:\pjjvv.exec:\pjjvv.exe94⤵PID:3812
-
\??\c:\rllxrlf.exec:\rllxrlf.exe95⤵PID:3008
-
\??\c:\llxxllx.exec:\llxxllx.exe96⤵PID:2956
-
\??\c:\hhnhbb.exec:\hhnhbb.exe97⤵PID:520
-
\??\c:\vvpjv.exec:\vvpjv.exe98⤵PID:2840
-
\??\c:\rlxlxrf.exec:\rlxlxrf.exe99⤵PID:3836
-
\??\c:\lffxllx.exec:\lffxllx.exe100⤵PID:4300
-
\??\c:\ntbthh.exec:\ntbthh.exe101⤵PID:3540
-
\??\c:\djvvj.exec:\djvvj.exe102⤵PID:3688
-
\??\c:\xlxxrlr.exec:\xlxxrlr.exe103⤵PID:528
-
\??\c:\tbhtnh.exec:\tbhtnh.exe104⤵PID:4076
-
\??\c:\ddjdd.exec:\ddjdd.exe105⤵PID:1300
-
\??\c:\xrxrflf.exec:\xrxrflf.exe106⤵PID:3436
-
\??\c:\nbnbth.exec:\nbnbth.exe107⤵PID:1084
-
\??\c:\vjpjd.exec:\vjpjd.exe108⤵PID:3060
-
\??\c:\jdddv.exec:\jdddv.exe109⤵PID:548
-
\??\c:\xrrlxfx.exec:\xrrlxfx.exe110⤵PID:2212
-
\??\c:\5nttnh.exec:\5nttnh.exe111⤵PID:1120
-
\??\c:\dvdvv.exec:\dvdvv.exe112⤵PID:4420
-
\??\c:\lxxrlfr.exec:\lxxrlfr.exe113⤵PID:3424
-
\??\c:\xllxfrf.exec:\xllxfrf.exe114⤵PID:1200
-
\??\c:\bnbnnh.exec:\bnbnnh.exe115⤵PID:4504
-
\??\c:\pvdvp.exec:\pvdvp.exe116⤵PID:4736
-
\??\c:\fllrfrf.exec:\fllrfrf.exe117⤵PID:1960
-
\??\c:\5fxfxfx.exec:\5fxfxfx.exe118⤵PID:3352
-
\??\c:\tnbtnh.exec:\tnbtnh.exe119⤵PID:1180
-
\??\c:\vdjdp.exec:\vdjdp.exe120⤵PID:332
-
\??\c:\xrxxxrf.exec:\xrxxxrf.exe121⤵PID:640
-
\??\c:\tttnbb.exec:\tttnbb.exe122⤵PID:1584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-