Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 12:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f2667d9d5e04ab12ef3c6e76678d4d0_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
0f2667d9d5e04ab12ef3c6e76678d4d0_NeikiAnalytics.exe
-
Size
76KB
-
MD5
0f2667d9d5e04ab12ef3c6e76678d4d0
-
SHA1
65a933e2e095bd54c2dabe38ee38bd081ad8a133
-
SHA256
6f72e25e98e74a03e71c841647bda10f3e847176733c032ded1f0ffe3624eb0d
-
SHA512
359d1d926922cd7a2cec7a8237d62a314bcfb22d1b5ff9183336aaf9f24f48c17a1e6dc734b57585c602cfd7b3e0f0dcb34c0c221c712f34821bdbc6d8ebb190
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrAE:ymb3NkkiQ3mdBjFIIp9L9QrrAE
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2004-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2108-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-34-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2616-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2256-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-54-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2588-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1616-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1672-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1552-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2060-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1328-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1868-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/776-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-305-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2108 vjdjj.exe 2616 flxfrxl.exe 2256 hbnbtb.exe 2588 pvpvj.exe 2628 pjvdj.exe 2776 lfxxfll.exe 2460 tnttbb.exe 2444 pjvdd.exe 2752 xfrlrff.exe 2864 1xlxxxf.exe 320 thnbhh.exe 1616 ttttbb.exe 1672 jjppp.exe 1648 1frrxxf.exe 1624 3lrrrrx.exe 1064 tnbbbh.exe 1552 3ntnnn.exe 2836 vpvvv.exe 2060 xlrlrxf.exe 2064 xllxffl.exe 536 5tnnhn.exe 1328 jdjjv.exe 1944 pdjjj.exe 1760 rflflrf.exe 2400 xrrlflf.exe 1868 tnbbtt.exe 776 5dpdd.exe 2088 5djpv.exe 1172 lflllfr.exe 2820 fxxfllr.exe 2772 nhbbbh.exe 2288 bnnttt.exe 2012 jvvvj.exe 3024 xlrrrll.exe 1588 fxxrfxf.exe 2128 tbhntn.exe 2512 nnhhtn.exe 2616 pjppp.exe 2640 9xlrrxf.exe 2656 xrxrrlr.exe 2676 bhttbb.exe 2628 jddvv.exe 2152 jvjjp.exe 2484 jjddp.exe 2452 rfxllfr.exe 2544 ntbbnn.exe 2968 nhbnnb.exe 2388 1pdjj.exe 2864 1jvvp.exe 1268 lfrxffl.exe 1676 xxlrlfl.exe 1684 nthbbn.exe 1640 7btbbh.exe 1644 djvpj.exe 2160 djvdv.exe 1504 rffrxxf.exe 1424 fxfxlrx.exe 2532 1bhntt.exe 1168 thtttb.exe 2228 djvpj.exe 2132 vjjdd.exe 1228 rfrfrrx.exe 1636 thhhtt.exe 584 5hnhbt.exe -
resource yara_rule behavioral1/memory/2004-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2004-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1616-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1552-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1328-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1868-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/776-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-305-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2004 wrote to memory of 2108 2004 0f2667d9d5e04ab12ef3c6e76678d4d0_NeikiAnalytics.exe 28 PID 2004 wrote to memory of 2108 2004 0f2667d9d5e04ab12ef3c6e76678d4d0_NeikiAnalytics.exe 28 PID 2004 wrote to memory of 2108 2004 0f2667d9d5e04ab12ef3c6e76678d4d0_NeikiAnalytics.exe 28 PID 2004 wrote to memory of 2108 2004 0f2667d9d5e04ab12ef3c6e76678d4d0_NeikiAnalytics.exe 28 PID 2108 wrote to memory of 2616 2108 vjdjj.exe 29 PID 2108 wrote to memory of 2616 2108 vjdjj.exe 29 PID 2108 wrote to memory of 2616 2108 vjdjj.exe 29 PID 2108 wrote to memory of 2616 2108 vjdjj.exe 29 PID 2616 wrote to memory of 2256 2616 flxfrxl.exe 30 PID 2616 wrote to memory of 2256 2616 flxfrxl.exe 30 PID 2616 wrote to memory of 2256 2616 flxfrxl.exe 30 PID 2616 wrote to memory of 2256 2616 flxfrxl.exe 30 PID 2256 wrote to memory of 2588 2256 hbnbtb.exe 31 PID 2256 wrote to memory of 2588 2256 hbnbtb.exe 31 PID 2256 wrote to memory of 2588 2256 hbnbtb.exe 31 PID 2256 wrote to memory of 2588 2256 hbnbtb.exe 31 PID 2588 wrote to memory of 2628 2588 pvpvj.exe 32 PID 2588 wrote to memory of 2628 2588 pvpvj.exe 32 PID 2588 wrote to memory of 2628 2588 pvpvj.exe 32 PID 2588 wrote to memory of 2628 2588 pvpvj.exe 32 PID 2628 wrote to memory of 2776 2628 pjvdj.exe 33 PID 2628 wrote to memory of 2776 2628 pjvdj.exe 33 PID 2628 wrote to memory of 2776 2628 pjvdj.exe 33 PID 2628 wrote to memory of 2776 2628 pjvdj.exe 33 PID 2776 wrote to memory of 2460 2776 lfxxfll.exe 34 PID 2776 wrote to memory of 2460 2776 lfxxfll.exe 34 PID 2776 wrote to memory of 2460 2776 lfxxfll.exe 34 PID 2776 wrote to memory of 2460 2776 lfxxfll.exe 34 PID 2460 wrote to memory of 2444 2460 tnttbb.exe 35 PID 2460 wrote to memory of 2444 2460 tnttbb.exe 35 PID 2460 wrote to memory of 2444 2460 tnttbb.exe 35 PID 2460 wrote to memory of 2444 2460 tnttbb.exe 35 PID 2444 wrote to memory of 2752 2444 pjvdd.exe 36 PID 2444 wrote to memory of 2752 2444 pjvdd.exe 36 PID 2444 wrote to memory of 2752 2444 pjvdd.exe 36 PID 2444 wrote to memory of 2752 2444 pjvdd.exe 36 PID 2752 wrote to memory of 2864 2752 xfrlrff.exe 37 PID 2752 wrote to memory of 2864 2752 xfrlrff.exe 37 PID 2752 wrote to memory of 2864 2752 xfrlrff.exe 37 PID 2752 wrote to memory of 2864 2752 xfrlrff.exe 37 PID 2864 wrote to memory of 320 2864 1xlxxxf.exe 38 PID 2864 wrote to memory of 320 2864 1xlxxxf.exe 38 PID 2864 wrote to memory of 320 2864 1xlxxxf.exe 38 PID 2864 wrote to memory of 320 2864 1xlxxxf.exe 38 PID 320 wrote to memory of 1616 320 thnbhh.exe 39 PID 320 wrote to memory of 1616 320 thnbhh.exe 39 PID 320 wrote to memory of 1616 320 thnbhh.exe 39 PID 320 wrote to memory of 1616 320 thnbhh.exe 39 PID 1616 wrote to memory of 1672 1616 ttttbb.exe 40 PID 1616 wrote to memory of 1672 1616 ttttbb.exe 40 PID 1616 wrote to memory of 1672 1616 ttttbb.exe 40 PID 1616 wrote to memory of 1672 1616 ttttbb.exe 40 PID 1672 wrote to memory of 1648 1672 jjppp.exe 41 PID 1672 wrote to memory of 1648 1672 jjppp.exe 41 PID 1672 wrote to memory of 1648 1672 jjppp.exe 41 PID 1672 wrote to memory of 1648 1672 jjppp.exe 41 PID 1648 wrote to memory of 1624 1648 1frrxxf.exe 42 PID 1648 wrote to memory of 1624 1648 1frrxxf.exe 42 PID 1648 wrote to memory of 1624 1648 1frrxxf.exe 42 PID 1648 wrote to memory of 1624 1648 1frrxxf.exe 42 PID 1624 wrote to memory of 1064 1624 3lrrrrx.exe 43 PID 1624 wrote to memory of 1064 1624 3lrrrrx.exe 43 PID 1624 wrote to memory of 1064 1624 3lrrrrx.exe 43 PID 1624 wrote to memory of 1064 1624 3lrrrrx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f2667d9d5e04ab12ef3c6e76678d4d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0f2667d9d5e04ab12ef3c6e76678d4d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\vjdjj.exec:\vjdjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\flxfrxl.exec:\flxfrxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\hbnbtb.exec:\hbnbtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\pvpvj.exec:\pvpvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\pjvdj.exec:\pjvdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\lfxxfll.exec:\lfxxfll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\tnttbb.exec:\tnttbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\pjvdd.exec:\pjvdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\xfrlrff.exec:\xfrlrff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\1xlxxxf.exec:\1xlxxxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\thnbhh.exec:\thnbhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\ttttbb.exec:\ttttbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\jjppp.exec:\jjppp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\1frrxxf.exec:\1frrxxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\3lrrrrx.exec:\3lrrrrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\tnbbbh.exec:\tnbbbh.exe17⤵
- Executes dropped EXE
PID:1064 -
\??\c:\3ntnnn.exec:\3ntnnn.exe18⤵
- Executes dropped EXE
PID:1552 -
\??\c:\vpvvv.exec:\vpvvv.exe19⤵
- Executes dropped EXE
PID:2836 -
\??\c:\xlrlrxf.exec:\xlrlrxf.exe20⤵
- Executes dropped EXE
PID:2060 -
\??\c:\xllxffl.exec:\xllxffl.exe21⤵
- Executes dropped EXE
PID:2064 -
\??\c:\5tnnhn.exec:\5tnnhn.exe22⤵
- Executes dropped EXE
PID:536 -
\??\c:\jdjjv.exec:\jdjjv.exe23⤵
- Executes dropped EXE
PID:1328 -
\??\c:\pdjjj.exec:\pdjjj.exe24⤵
- Executes dropped EXE
PID:1944 -
\??\c:\rflflrf.exec:\rflflrf.exe25⤵
- Executes dropped EXE
PID:1760 -
\??\c:\xrrlflf.exec:\xrrlflf.exe26⤵
- Executes dropped EXE
PID:2400 -
\??\c:\tnbbtt.exec:\tnbbtt.exe27⤵
- Executes dropped EXE
PID:1868 -
\??\c:\5dpdd.exec:\5dpdd.exe28⤵
- Executes dropped EXE
PID:776 -
\??\c:\5djpv.exec:\5djpv.exe29⤵
- Executes dropped EXE
PID:2088 -
\??\c:\lflllfr.exec:\lflllfr.exe30⤵
- Executes dropped EXE
PID:1172 -
\??\c:\fxxfllr.exec:\fxxfllr.exe31⤵
- Executes dropped EXE
PID:2820 -
\??\c:\nhbbbh.exec:\nhbbbh.exe32⤵
- Executes dropped EXE
PID:2772 -
\??\c:\bnnttt.exec:\bnnttt.exe33⤵
- Executes dropped EXE
PID:2288 -
\??\c:\jvvvj.exec:\jvvvj.exe34⤵
- Executes dropped EXE
PID:2012 -
\??\c:\xlrrrll.exec:\xlrrrll.exe35⤵
- Executes dropped EXE
PID:3024 -
\??\c:\fxxrfxf.exec:\fxxrfxf.exe36⤵
- Executes dropped EXE
PID:1588 -
\??\c:\tbhntn.exec:\tbhntn.exe37⤵
- Executes dropped EXE
PID:2128 -
\??\c:\nnhhtn.exec:\nnhhtn.exe38⤵
- Executes dropped EXE
PID:2512 -
\??\c:\pjppp.exec:\pjppp.exe39⤵
- Executes dropped EXE
PID:2616 -
\??\c:\9xlrrxf.exec:\9xlrrxf.exe40⤵
- Executes dropped EXE
PID:2640 -
\??\c:\xrxrrlr.exec:\xrxrrlr.exe41⤵
- Executes dropped EXE
PID:2656 -
\??\c:\bhttbb.exec:\bhttbb.exe42⤵
- Executes dropped EXE
PID:2676 -
\??\c:\jddvv.exec:\jddvv.exe43⤵
- Executes dropped EXE
PID:2628 -
\??\c:\jvjjp.exec:\jvjjp.exe44⤵
- Executes dropped EXE
PID:2152 -
\??\c:\jjddp.exec:\jjddp.exe45⤵
- Executes dropped EXE
PID:2484 -
\??\c:\rfxllfr.exec:\rfxllfr.exe46⤵
- Executes dropped EXE
PID:2452 -
\??\c:\ntbbnn.exec:\ntbbnn.exe47⤵
- Executes dropped EXE
PID:2544 -
\??\c:\nhbnnb.exec:\nhbnnb.exe48⤵
- Executes dropped EXE
PID:2968 -
\??\c:\1pdjj.exec:\1pdjj.exe49⤵
- Executes dropped EXE
PID:2388 -
\??\c:\1jvvp.exec:\1jvvp.exe50⤵
- Executes dropped EXE
PID:2864 -
\??\c:\lfrxffl.exec:\lfrxffl.exe51⤵
- Executes dropped EXE
PID:1268 -
\??\c:\xxlrlfl.exec:\xxlrlfl.exe52⤵
- Executes dropped EXE
PID:1676 -
\??\c:\nthbbn.exec:\nthbbn.exe53⤵
- Executes dropped EXE
PID:1684 -
\??\c:\7btbbh.exec:\7btbbh.exe54⤵
- Executes dropped EXE
PID:1640 -
\??\c:\djvpj.exec:\djvpj.exe55⤵
- Executes dropped EXE
PID:1644 -
\??\c:\djvdv.exec:\djvdv.exe56⤵
- Executes dropped EXE
PID:2160 -
\??\c:\rffrxxf.exec:\rffrxxf.exe57⤵
- Executes dropped EXE
PID:1504 -
\??\c:\fxfxlrx.exec:\fxfxlrx.exe58⤵
- Executes dropped EXE
PID:1424 -
\??\c:\1bhntt.exec:\1bhntt.exe59⤵
- Executes dropped EXE
PID:2532 -
\??\c:\thtttb.exec:\thtttb.exe60⤵
- Executes dropped EXE
PID:1168 -
\??\c:\djvpj.exec:\djvpj.exe61⤵
- Executes dropped EXE
PID:2228 -
\??\c:\vjjdd.exec:\vjjdd.exe62⤵
- Executes dropped EXE
PID:2132 -
\??\c:\rfrfrrx.exec:\rfrfrrx.exe63⤵
- Executes dropped EXE
PID:1228 -
\??\c:\thhhtt.exec:\thhhtt.exe64⤵
- Executes dropped EXE
PID:1636 -
\??\c:\5hnhbt.exec:\5hnhbt.exe65⤵
- Executes dropped EXE
PID:584 -
\??\c:\jdjpd.exec:\jdjpd.exe66⤵PID:1988
-
\??\c:\7vpjp.exec:\7vpjp.exe67⤵PID:2992
-
\??\c:\1rxrxxl.exec:\1rxrxxl.exe68⤵PID:352
-
\??\c:\5flffxx.exec:\5flffxx.exe69⤵PID:972
-
\??\c:\7rxfflf.exec:\7rxfflf.exe70⤵PID:1900
-
\??\c:\nhttbb.exec:\nhttbb.exe71⤵PID:1048
-
\??\c:\htbnnh.exec:\htbnnh.exe72⤵PID:1752
-
\??\c:\jvdjj.exec:\jvdjj.exe73⤵PID:2080
-
\??\c:\5vpdd.exec:\5vpdd.exe74⤵PID:2608
-
\??\c:\7rlrllf.exec:\7rlrllf.exe75⤵PID:564
-
\??\c:\9lxxfrf.exec:\9lxxfrf.exe76⤵PID:1688
-
\??\c:\bbhnbh.exec:\bbhnbh.exe77⤵PID:2000
-
\??\c:\7bthht.exec:\7bthht.exe78⤵PID:2044
-
\??\c:\dvpvd.exec:\dvpvd.exe79⤵PID:1584
-
\??\c:\1vppj.exec:\1vppj.exe80⤵PID:2268
-
\??\c:\lxxlrll.exec:\lxxlrll.exe81⤵PID:2708
-
\??\c:\fxlrrrf.exec:\fxlrrrf.exe82⤵PID:2020
-
\??\c:\bhthht.exec:\bhthht.exe83⤵PID:2580
-
\??\c:\hbbthn.exec:\hbbthn.exe84⤵PID:2576
-
\??\c:\7jdjv.exec:\7jdjv.exe85⤵PID:2560
-
\??\c:\vvpjp.exec:\vvpjp.exe86⤵PID:2468
-
\??\c:\lxfflfl.exec:\lxfflfl.exe87⤵PID:2672
-
\??\c:\rlxflxx.exec:\rlxflxx.exe88⤵PID:2776
-
\??\c:\tnbhhh.exec:\tnbhhh.exe89⤵PID:2600
-
\??\c:\htnbhh.exec:\htnbhh.exe90⤵PID:2436
-
\??\c:\bnhnhh.exec:\bnhnhh.exe91⤵PID:2852
-
\??\c:\jvppv.exec:\jvppv.exe92⤵PID:2848
-
\??\c:\vjjjv.exec:\vjjjv.exe93⤵PID:1596
-
\??\c:\rlrrffr.exec:\rlrrffr.exe94⤵PID:1652
-
\??\c:\lfllrrl.exec:\lfllrrl.exe95⤵PID:2192
-
\??\c:\thbnhh.exec:\thbnhh.exe96⤵PID:1076
-
\??\c:\nbbhbb.exec:\nbbhbb.exe97⤵PID:1896
-
\??\c:\7ntttt.exec:\7ntttt.exe98⤵PID:936
-
\??\c:\1vjdj.exec:\1vjdj.exe99⤵PID:1664
-
\??\c:\7jjpj.exec:\7jjpj.exe100⤵PID:1740
-
\??\c:\frxrrrr.exec:\frxrrrr.exe101⤵PID:1420
-
\??\c:\rlxflfl.exec:\rlxflfl.exe102⤵PID:2756
-
\??\c:\hbhnbt.exec:\hbhnbt.exe103⤵PID:2076
-
\??\c:\hbtbbb.exec:\hbtbbb.exe104⤵PID:1080
-
\??\c:\3nhbbh.exec:\3nhbbh.exe105⤵PID:2036
-
\??\c:\9pjvj.exec:\9pjvj.exe106⤵PID:476
-
\??\c:\ppddv.exec:\ppddv.exe107⤵PID:2052
-
\??\c:\lfxxrxf.exec:\lfxxrxf.exe108⤵PID:1328
-
\??\c:\lflrxlf.exec:\lflrxlf.exe109⤵PID:1496
-
\??\c:\7nbbbb.exec:\7nbbbb.exe110⤵PID:1304
-
\??\c:\thhnhn.exec:\thhnhn.exe111⤵PID:2800
-
\??\c:\7bhthh.exec:\7bhthh.exe112⤵PID:352
-
\??\c:\pvvdj.exec:\pvvdj.exe113⤵PID:1948
-
\??\c:\vppvd.exec:\vppvd.exe114⤵PID:776
-
\??\c:\xrxrxrl.exec:\xrxrxrl.exe115⤵PID:1100
-
\??\c:\xrlxxfx.exec:\xrlxxfx.exe116⤵PID:1748
-
\??\c:\lxffrfl.exec:\lxffrfl.exe117⤵PID:1016
-
\??\c:\thtbbh.exec:\thtbbh.exe118⤵PID:2416
-
\??\c:\bttttb.exec:\bttttb.exe119⤵PID:2380
-
\??\c:\ppvvd.exec:\ppvvd.exe120⤵PID:2072
-
\??\c:\pvdpd.exec:\pvdpd.exe121⤵PID:1272
-
\??\c:\3jpvv.exec:\3jpvv.exe122⤵PID:1704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-