Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11-05-2024 19:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2f52f1e2b796c2bae7dfe34789d23aa0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
2f52f1e2b796c2bae7dfe34789d23aa0_NeikiAnalytics.exe
-
Size
90KB
-
MD5
2f52f1e2b796c2bae7dfe34789d23aa0
-
SHA1
653bd51311812ba17c1033facc02e97c121e35fd
-
SHA256
f3692658f708f809fc12f0b79a0ed23b69a254417f3dbfc70e273966848567d4
-
SHA512
61a4a75edb257bb8d7739173584d5b9b9baae1d04222431beb62bd43088689931520dab361620d891bae4938a61d6e192496a246cbd6d2e038eef58204fa7b5d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDodtzac0Hobv0byLufTJfJVM:ymb3NkkiQ3mdBjFodt27HobvcyLufNfo
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/1848-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2328-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1632-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1516-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1596-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1568-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2284-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1128-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/656-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2240-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-1773-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-1781-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2708 9nbntn.exe 2476 3pvvp.exe 2636 7xflrrf.exe 2500 xrfllxf.exe 2468 xlffffl.exe 2416 flrlrrf.exe 2440 lrrlffr.exe 2820 hnntth.exe 2328 5tnntb.exe 2432 pdvdp.exe 1632 frxllff.exe 1516 rrrlxlx.exe 1620 hnthtn.exe 1596 hbttbb.exe 1568 vpjdp.exe 2284 dvpdd.exe 860 lxxllxf.exe 1844 5hntbt.exe 1128 bnnhnn.exe 1204 1vjpp.exe 3036 xfxrffr.exe 1408 frrrrll.exe 656 tbhhhb.exe 2068 tnntht.exe 2864 7vjvd.exe 352 pppvp.exe 576 frlflxr.exe 2232 7tbbhh.exe 616 1nhhnn.exe 2240 jjdjd.exe 916 9pvdv.exe 1040 xrxxxrx.exe 1732 nbtbbb.exe 1540 hbntbb.exe 2872 7pjdj.exe 2520 dvddd.exe 2624 frfrflf.exe 2556 3bhbbt.exe 2648 dvjjd.exe 2532 1jjvv.exe 2392 jdpvd.exe 2852 rxlrxfl.exe 2336 9btbbt.exe 2820 nhbnnn.exe 472 hnthtn.exe 2608 jvjjj.exe 2604 vjppp.exe 1632 xxlfrxf.exe 2152 ffxxxxf.exe 380 hbhntb.exe 1644 nbnntt.exe 324 vjpvv.exe 780 9vdvj.exe 1036 lrxxlff.exe 1696 tbnhtt.exe 1840 nttbtt.exe 1972 pjppv.exe 1860 vdppv.exe 1204 lfllllx.exe 1404 xrfxfxl.exe 836 1httbt.exe 1444 tnhnnt.exe 2444 dvdpp.exe 2732 pjvdd.exe -
resource yara_rule behavioral1/memory/1848-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1632-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1516-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1596-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1568-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1128-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/656-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-295-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-1773-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-1781-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1848 wrote to memory of 2708 1848 2f52f1e2b796c2bae7dfe34789d23aa0_NeikiAnalytics.exe 28 PID 1848 wrote to memory of 2708 1848 2f52f1e2b796c2bae7dfe34789d23aa0_NeikiAnalytics.exe 28 PID 1848 wrote to memory of 2708 1848 2f52f1e2b796c2bae7dfe34789d23aa0_NeikiAnalytics.exe 28 PID 1848 wrote to memory of 2708 1848 2f52f1e2b796c2bae7dfe34789d23aa0_NeikiAnalytics.exe 28 PID 2708 wrote to memory of 2476 2708 9nbntn.exe 29 PID 2708 wrote to memory of 2476 2708 9nbntn.exe 29 PID 2708 wrote to memory of 2476 2708 9nbntn.exe 29 PID 2708 wrote to memory of 2476 2708 9nbntn.exe 29 PID 2476 wrote to memory of 2636 2476 3pvvp.exe 30 PID 2476 wrote to memory of 2636 2476 3pvvp.exe 30 PID 2476 wrote to memory of 2636 2476 3pvvp.exe 30 PID 2476 wrote to memory of 2636 2476 3pvvp.exe 30 PID 2636 wrote to memory of 2500 2636 7xflrrf.exe 31 PID 2636 wrote to memory of 2500 2636 7xflrrf.exe 31 PID 2636 wrote to memory of 2500 2636 7xflrrf.exe 31 PID 2636 wrote to memory of 2500 2636 7xflrrf.exe 31 PID 2500 wrote to memory of 2468 2500 xrfllxf.exe 32 PID 2500 wrote to memory of 2468 2500 xrfllxf.exe 32 PID 2500 wrote to memory of 2468 2500 xrfllxf.exe 32 PID 2500 wrote to memory of 2468 2500 xrfllxf.exe 32 PID 2468 wrote to memory of 2416 2468 xlffffl.exe 33 PID 2468 wrote to memory of 2416 2468 xlffffl.exe 33 PID 2468 wrote to memory of 2416 2468 xlffffl.exe 33 PID 2468 wrote to memory of 2416 2468 xlffffl.exe 33 PID 2416 wrote to memory of 2440 2416 flrlrrf.exe 34 PID 2416 wrote to memory of 2440 2416 flrlrrf.exe 34 PID 2416 wrote to memory of 2440 2416 flrlrrf.exe 34 PID 2416 wrote to memory of 2440 2416 flrlrrf.exe 34 PID 2440 wrote to memory of 2820 2440 lrrlffr.exe 35 PID 2440 wrote to memory of 2820 2440 lrrlffr.exe 35 PID 2440 wrote to memory of 2820 2440 lrrlffr.exe 35 PID 2440 wrote to memory of 2820 2440 lrrlffr.exe 35 PID 2820 wrote to memory of 2328 2820 hnntth.exe 36 PID 2820 wrote to memory of 2328 2820 hnntth.exe 36 PID 2820 wrote to memory of 2328 2820 hnntth.exe 36 PID 2820 wrote to memory of 2328 2820 hnntth.exe 36 PID 2328 wrote to memory of 2432 2328 5tnntb.exe 37 PID 2328 wrote to memory of 2432 2328 5tnntb.exe 37 PID 2328 wrote to memory of 2432 2328 5tnntb.exe 37 PID 2328 wrote to memory of 2432 2328 5tnntb.exe 37 PID 2432 wrote to memory of 1632 2432 pdvdp.exe 38 PID 2432 wrote to memory of 1632 2432 pdvdp.exe 38 PID 2432 wrote to memory of 1632 2432 pdvdp.exe 38 PID 2432 wrote to memory of 1632 2432 pdvdp.exe 38 PID 1632 wrote to memory of 1516 1632 frxllff.exe 39 PID 1632 wrote to memory of 1516 1632 frxllff.exe 39 PID 1632 wrote to memory of 1516 1632 frxllff.exe 39 PID 1632 wrote to memory of 1516 1632 frxllff.exe 39 PID 1516 wrote to memory of 1620 1516 rrrlxlx.exe 40 PID 1516 wrote to memory of 1620 1516 rrrlxlx.exe 40 PID 1516 wrote to memory of 1620 1516 rrrlxlx.exe 40 PID 1516 wrote to memory of 1620 1516 rrrlxlx.exe 40 PID 1620 wrote to memory of 1596 1620 hnthtn.exe 41 PID 1620 wrote to memory of 1596 1620 hnthtn.exe 41 PID 1620 wrote to memory of 1596 1620 hnthtn.exe 41 PID 1620 wrote to memory of 1596 1620 hnthtn.exe 41 PID 1596 wrote to memory of 1568 1596 hbttbb.exe 42 PID 1596 wrote to memory of 1568 1596 hbttbb.exe 42 PID 1596 wrote to memory of 1568 1596 hbttbb.exe 42 PID 1596 wrote to memory of 1568 1596 hbttbb.exe 42 PID 1568 wrote to memory of 2284 1568 vpjdp.exe 43 PID 1568 wrote to memory of 2284 1568 vpjdp.exe 43 PID 1568 wrote to memory of 2284 1568 vpjdp.exe 43 PID 1568 wrote to memory of 2284 1568 vpjdp.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f52f1e2b796c2bae7dfe34789d23aa0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2f52f1e2b796c2bae7dfe34789d23aa0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\9nbntn.exec:\9nbntn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\3pvvp.exec:\3pvvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\7xflrrf.exec:\7xflrrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\xrfllxf.exec:\xrfllxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\xlffffl.exec:\xlffffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\flrlrrf.exec:\flrlrrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\lrrlffr.exec:\lrrlffr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\hnntth.exec:\hnntth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\5tnntb.exec:\5tnntb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\pdvdp.exec:\pdvdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\frxllff.exec:\frxllff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\rrrlxlx.exec:\rrrlxlx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\hnthtn.exec:\hnthtn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\hbttbb.exec:\hbttbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\vpjdp.exec:\vpjdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\dvpdd.exec:\dvpdd.exe17⤵
- Executes dropped EXE
PID:2284 -
\??\c:\lxxllxf.exec:\lxxllxf.exe18⤵
- Executes dropped EXE
PID:860 -
\??\c:\5hntbt.exec:\5hntbt.exe19⤵
- Executes dropped EXE
PID:1844 -
\??\c:\bnnhnn.exec:\bnnhnn.exe20⤵
- Executes dropped EXE
PID:1128 -
\??\c:\1vjpp.exec:\1vjpp.exe21⤵
- Executes dropped EXE
PID:1204 -
\??\c:\xfxrffr.exec:\xfxrffr.exe22⤵
- Executes dropped EXE
PID:3036 -
\??\c:\frrrrll.exec:\frrrrll.exe23⤵
- Executes dropped EXE
PID:1408 -
\??\c:\tbhhhb.exec:\tbhhhb.exe24⤵
- Executes dropped EXE
PID:656 -
\??\c:\tnntht.exec:\tnntht.exe25⤵
- Executes dropped EXE
PID:2068 -
\??\c:\7vjvd.exec:\7vjvd.exe26⤵
- Executes dropped EXE
PID:2864 -
\??\c:\pppvp.exec:\pppvp.exe27⤵
- Executes dropped EXE
PID:352 -
\??\c:\frlflxr.exec:\frlflxr.exe28⤵
- Executes dropped EXE
PID:576 -
\??\c:\7tbbhh.exec:\7tbbhh.exe29⤵
- Executes dropped EXE
PID:2232 -
\??\c:\1nhhnn.exec:\1nhhnn.exe30⤵
- Executes dropped EXE
PID:616 -
\??\c:\jjdjd.exec:\jjdjd.exe31⤵
- Executes dropped EXE
PID:2240 -
\??\c:\9pvdv.exec:\9pvdv.exe32⤵
- Executes dropped EXE
PID:916 -
\??\c:\xrxxxrx.exec:\xrxxxrx.exe33⤵
- Executes dropped EXE
PID:1040 -
\??\c:\nbtbbb.exec:\nbtbbb.exe34⤵
- Executes dropped EXE
PID:1732 -
\??\c:\hbntbb.exec:\hbntbb.exe35⤵
- Executes dropped EXE
PID:1540 -
\??\c:\7pjdj.exec:\7pjdj.exe36⤵
- Executes dropped EXE
PID:2872 -
\??\c:\dvddd.exec:\dvddd.exe37⤵
- Executes dropped EXE
PID:2520 -
\??\c:\frfrflf.exec:\frfrflf.exe38⤵
- Executes dropped EXE
PID:2624 -
\??\c:\3bhbbt.exec:\3bhbbt.exe39⤵
- Executes dropped EXE
PID:2556 -
\??\c:\dvjjd.exec:\dvjjd.exe40⤵
- Executes dropped EXE
PID:2648 -
\??\c:\1jjvv.exec:\1jjvv.exe41⤵
- Executes dropped EXE
PID:2532 -
\??\c:\jdpvd.exec:\jdpvd.exe42⤵
- Executes dropped EXE
PID:2392 -
\??\c:\rxlrxfl.exec:\rxlrxfl.exe43⤵
- Executes dropped EXE
PID:2852 -
\??\c:\9btbbt.exec:\9btbbt.exe44⤵
- Executes dropped EXE
PID:2336 -
\??\c:\nhbnnn.exec:\nhbnnn.exe45⤵
- Executes dropped EXE
PID:2820 -
\??\c:\hnthtn.exec:\hnthtn.exe46⤵
- Executes dropped EXE
PID:472 -
\??\c:\jvjjj.exec:\jvjjj.exe47⤵
- Executes dropped EXE
PID:2608 -
\??\c:\vjppp.exec:\vjppp.exe48⤵
- Executes dropped EXE
PID:2604 -
\??\c:\xxlfrxf.exec:\xxlfrxf.exe49⤵
- Executes dropped EXE
PID:1632 -
\??\c:\ffxxxxf.exec:\ffxxxxf.exe50⤵
- Executes dropped EXE
PID:2152 -
\??\c:\hbhntb.exec:\hbhntb.exe51⤵
- Executes dropped EXE
PID:380 -
\??\c:\nbnntt.exec:\nbnntt.exe52⤵
- Executes dropped EXE
PID:1644 -
\??\c:\vjpvv.exec:\vjpvv.exe53⤵
- Executes dropped EXE
PID:324 -
\??\c:\9vdvj.exec:\9vdvj.exe54⤵
- Executes dropped EXE
PID:780 -
\??\c:\lrxxlff.exec:\lrxxlff.exe55⤵
- Executes dropped EXE
PID:1036 -
\??\c:\tbnhtt.exec:\tbnhtt.exe56⤵
- Executes dropped EXE
PID:1696 -
\??\c:\nttbtt.exec:\nttbtt.exe57⤵
- Executes dropped EXE
PID:1840 -
\??\c:\pjppv.exec:\pjppv.exe58⤵
- Executes dropped EXE
PID:1972 -
\??\c:\vdppv.exec:\vdppv.exe59⤵
- Executes dropped EXE
PID:1860 -
\??\c:\lfllllx.exec:\lfllllx.exe60⤵
- Executes dropped EXE
PID:1204 -
\??\c:\xrfxfxl.exec:\xrfxfxl.exe61⤵
- Executes dropped EXE
PID:1404 -
\??\c:\1httbt.exec:\1httbt.exe62⤵
- Executes dropped EXE
PID:836 -
\??\c:\tnhnnt.exec:\tnhnnt.exe63⤵
- Executes dropped EXE
PID:1444 -
\??\c:\dvdpp.exec:\dvdpp.exe64⤵
- Executes dropped EXE
PID:2444 -
\??\c:\pjvdd.exec:\pjvdd.exe65⤵
- Executes dropped EXE
PID:2732 -
\??\c:\rlrxflr.exec:\rlrxflr.exe66⤵PID:2864
-
\??\c:\xrlrllx.exec:\xrlrllx.exe67⤵PID:908
-
\??\c:\1bnnnn.exec:\1bnnnn.exe68⤵PID:2060
-
\??\c:\bhbnth.exec:\bhbnth.exe69⤵PID:576
-
\??\c:\jddvd.exec:\jddvd.exe70⤵PID:2232
-
\??\c:\jdvdj.exec:\jdvdj.exe71⤵PID:1876
-
\??\c:\frrlxrf.exec:\frrlxrf.exe72⤵PID:1436
-
\??\c:\ffllfxr.exec:\ffllfxr.exe73⤵PID:1864
-
\??\c:\3bhttt.exec:\3bhttt.exe74⤵PID:916
-
\??\c:\nhbhtt.exec:\nhbhtt.exe75⤵PID:2544
-
\??\c:\vvvdp.exec:\vvvdp.exe76⤵PID:2512
-
\??\c:\5jvvd.exec:\5jvvd.exe77⤵PID:2616
-
\??\c:\5xfffff.exec:\5xfffff.exe78⤵PID:2564
-
\??\c:\1rlrlll.exec:\1rlrlll.exe79⤵PID:2720
-
\??\c:\ntbtbb.exec:\ntbtbb.exe80⤵PID:1356
-
\??\c:\7htntn.exec:\7htntn.exe81⤵PID:2568
-
\??\c:\1jddd.exec:\1jddd.exe82⤵PID:2640
-
\??\c:\pjdjd.exec:\pjdjd.exe83⤵PID:2380
-
\??\c:\lfffflr.exec:\lfffflr.exe84⤵PID:2808
-
\??\c:\7lrffxf.exec:\7lrffxf.exe85⤵PID:2428
-
\??\c:\rfrxxrx.exec:\rfrxxrx.exe86⤵PID:2972
-
\??\c:\7nnnbb.exec:\7nnnbb.exe87⤵PID:888
-
\??\c:\tbnnbb.exec:\tbnnbb.exe88⤵PID:1248
-
\??\c:\pjddd.exec:\pjddd.exe89⤵PID:1800
-
\??\c:\jjppp.exec:\jjppp.exe90⤵PID:2104
-
\??\c:\fxflxrf.exec:\fxflxrf.exe91⤵PID:2112
-
\??\c:\fxxfllr.exec:\fxxfllr.exe92⤵PID:1560
-
\??\c:\rfxxfff.exec:\rfxxfff.exe93⤵PID:2136
-
\??\c:\nnnhnb.exec:\nnnhnb.exe94⤵PID:1612
-
\??\c:\hbhhnn.exec:\hbhhnn.exe95⤵PID:2272
-
\??\c:\9dpjp.exec:\9dpjp.exe96⤵PID:480
-
\??\c:\dvdjv.exec:\dvdjv.exe97⤵PID:1168
-
\??\c:\lrxrrrr.exec:\lrxrrrr.exe98⤵PID:860
-
\??\c:\ffxfxff.exec:\ffxfxff.exe99⤵PID:3028
-
\??\c:\7tbttn.exec:\7tbttn.exe100⤵PID:2012
-
\??\c:\9nhbhh.exec:\9nhbhh.exe101⤵PID:3048
-
\??\c:\dvdpp.exec:\dvdpp.exe102⤵PID:1576
-
\??\c:\jjpdd.exec:\jjpdd.exe103⤵PID:2344
-
\??\c:\5rlrrxr.exec:\5rlrrxr.exe104⤵PID:2312
-
\??\c:\frlxrlf.exec:\frlxrlf.exe105⤵PID:2064
-
\??\c:\nbnhhh.exec:\nbnhhh.exe106⤵PID:1160
-
\??\c:\hhnbhh.exec:\hhnbhh.exe107⤵PID:452
-
\??\c:\pjjpd.exec:\pjjpd.exe108⤵PID:1924
-
\??\c:\djvvv.exec:\djvvv.exe109⤵PID:2832
-
\??\c:\rfxfrrr.exec:\rfxfrrr.exe110⤵PID:1964
-
\??\c:\1rxrlxr.exec:\1rxrlxr.exe111⤵PID:1872
-
\??\c:\lflllrr.exec:\lflllrr.exe112⤵PID:2964
-
\??\c:\nhtbhh.exec:\nhtbhh.exe113⤵PID:892
-
\??\c:\bhnhnb.exec:\bhnhnb.exe114⤵PID:2212
-
\??\c:\vjvpp.exec:\vjvpp.exe115⤵PID:2292
-
\??\c:\vjddd.exec:\vjddd.exe116⤵PID:1848
-
\??\c:\rlxlrlx.exec:\rlxlrlx.exe117⤵PID:1928
-
\??\c:\1llxrrr.exec:\1llxrrr.exe118⤵PID:2580
-
\??\c:\nhtthn.exec:\nhtthn.exe119⤵PID:2088
-
\??\c:\nhbtbt.exec:\nhbtbt.exe120⤵PID:2080
-
\??\c:\5dvpv.exec:\5dvpv.exe121⤵PID:2792
-
\??\c:\5djvp.exec:\5djvp.exe122⤵PID:2584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-