Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
16-05-2024 20:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2b002ce59d44c42799d775df6d9a2bd0_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
2b002ce59d44c42799d775df6d9a2bd0_NeikiAnalytics.exe
-
Size
99KB
-
MD5
2b002ce59d44c42799d775df6d9a2bd0
-
SHA1
6bfb036e7b1cce21bbb3ca7d1bc06c6864a2fcdc
-
SHA256
1a20d719f1949d1f74c5ace0bfdd3a26f81d599db303fe658dd9cab897aa5912
-
SHA512
1f65d339074f2a9fb5594c73774bf36143b9492e607c329fdd5b15dcfb2c07c36f4486a5d1fe2cf3eca5b5b2bb89c8092e12af637ddbf6bb6e9deea174b68810
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDodtzn6zDaE0R5K:ymb3NkkiQ3mdBjFodt2zE3K
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/1888-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1440-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1020-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/600-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/908-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1448-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1144-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1812-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/240-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2324-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1528-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1684-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1572-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2504 hbntbb.exe 2568 djppj.exe 2540 xxrrlrf.exe 2648 thbnbh.exe 1740 9jvvj.exe 2416 1dvpp.exe 2580 xrlffrf.exe 2848 rlxxfxf.exe 1572 nnnbtn.exe 1440 vpdjv.exe 1684 jdppd.exe 1528 rfffflr.exe 1020 5rlrrrr.exe 2324 hbttbh.exe 240 bbhtnb.exe 2740 pjvdv.exe 1284 xxxlfxr.exe 2816 lfllrrx.exe 2112 hbtbhh.exe 2148 1jdpj.exe 600 7dpvd.exe 1004 xrflrrf.exe 1812 lfxflrx.exe 1144 hhtbtt.exe 1988 jvjdp.exe 968 jjjjv.exe 908 5rfllrr.exe 2220 9tbtnt.exe 1716 jpvdd.exe 1028 lrrlxxx.exe 1448 lrrflll.exe 2184 nthhbt.exe 2988 hthhtn.exe 1672 dvvdj.exe 2652 jjpdv.exe 2608 rlxxllr.exe 2704 7xfxflx.exe 2876 bbhnbt.exe 2460 5tnbtb.exe 2464 nnbhnn.exe 2832 3dvdp.exe 3024 9vvvd.exe 2580 rrlfxlf.exe 1536 fxlfxfr.exe 1572 rrxfflx.exe 2332 hhtbnt.exe 280 bhttht.exe 1632 jjvdj.exe 1664 pjjpv.exe 2688 rrlrlfr.exe 1592 llrfrxl.exe 240 xffxrfl.exe 2740 lfflffx.exe 2360 nhthhn.exe 2016 bttbhh.exe 2780 bhbntb.exe 1960 jpjpj.exe 1340 vvdjp.exe 1428 5rrlrxl.exe 1420 rrxlxfr.exe 1048 xfxflfx.exe 3028 btnbhh.exe 388 bhbhnt.exe 524 bnhhhn.exe -
resource yara_rule behavioral1/memory/1888-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1440-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1020-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/600-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/908-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1448-298-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1144-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1812-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/240-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2324-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1528-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1684-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1572-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-22-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1888 wrote to memory of 2504 1888 2b002ce59d44c42799d775df6d9a2bd0_NeikiAnalytics.exe 28 PID 1888 wrote to memory of 2504 1888 2b002ce59d44c42799d775df6d9a2bd0_NeikiAnalytics.exe 28 PID 1888 wrote to memory of 2504 1888 2b002ce59d44c42799d775df6d9a2bd0_NeikiAnalytics.exe 28 PID 1888 wrote to memory of 2504 1888 2b002ce59d44c42799d775df6d9a2bd0_NeikiAnalytics.exe 28 PID 2504 wrote to memory of 2568 2504 hbntbb.exe 29 PID 2504 wrote to memory of 2568 2504 hbntbb.exe 29 PID 2504 wrote to memory of 2568 2504 hbntbb.exe 29 PID 2504 wrote to memory of 2568 2504 hbntbb.exe 29 PID 2568 wrote to memory of 2540 2568 djppj.exe 30 PID 2568 wrote to memory of 2540 2568 djppj.exe 30 PID 2568 wrote to memory of 2540 2568 djppj.exe 30 PID 2568 wrote to memory of 2540 2568 djppj.exe 30 PID 2540 wrote to memory of 2648 2540 xxrrlrf.exe 31 PID 2540 wrote to memory of 2648 2540 xxrrlrf.exe 31 PID 2540 wrote to memory of 2648 2540 xxrrlrf.exe 31 PID 2540 wrote to memory of 2648 2540 xxrrlrf.exe 31 PID 2648 wrote to memory of 1740 2648 thbnbh.exe 32 PID 2648 wrote to memory of 1740 2648 thbnbh.exe 32 PID 2648 wrote to memory of 1740 2648 thbnbh.exe 32 PID 2648 wrote to memory of 1740 2648 thbnbh.exe 32 PID 1740 wrote to memory of 2416 1740 9jvvj.exe 33 PID 1740 wrote to memory of 2416 1740 9jvvj.exe 33 PID 1740 wrote to memory of 2416 1740 9jvvj.exe 33 PID 1740 wrote to memory of 2416 1740 9jvvj.exe 33 PID 2416 wrote to memory of 2580 2416 1dvpp.exe 34 PID 2416 wrote to memory of 2580 2416 1dvpp.exe 34 PID 2416 wrote to memory of 2580 2416 1dvpp.exe 34 PID 2416 wrote to memory of 2580 2416 1dvpp.exe 34 PID 2580 wrote to memory of 2848 2580 xrlffrf.exe 35 PID 2580 wrote to memory of 2848 2580 xrlffrf.exe 35 PID 2580 wrote to memory of 2848 2580 xrlffrf.exe 35 PID 2580 wrote to memory of 2848 2580 xrlffrf.exe 35 PID 2848 wrote to memory of 1572 2848 rlxxfxf.exe 36 PID 2848 wrote to memory of 1572 2848 rlxxfxf.exe 36 PID 2848 wrote to memory of 1572 2848 rlxxfxf.exe 36 PID 2848 wrote to memory of 1572 2848 rlxxfxf.exe 36 PID 1572 wrote to memory of 1440 1572 nnnbtn.exe 37 PID 1572 wrote to memory of 1440 1572 nnnbtn.exe 37 PID 1572 wrote to memory of 1440 1572 nnnbtn.exe 37 PID 1572 wrote to memory of 1440 1572 nnnbtn.exe 37 PID 1440 wrote to memory of 1684 1440 vpdjv.exe 38 PID 1440 wrote to memory of 1684 1440 vpdjv.exe 38 PID 1440 wrote to memory of 1684 1440 vpdjv.exe 38 PID 1440 wrote to memory of 1684 1440 vpdjv.exe 38 PID 1684 wrote to memory of 1528 1684 jdppd.exe 39 PID 1684 wrote to memory of 1528 1684 jdppd.exe 39 PID 1684 wrote to memory of 1528 1684 jdppd.exe 39 PID 1684 wrote to memory of 1528 1684 jdppd.exe 39 PID 1528 wrote to memory of 1020 1528 rfffflr.exe 40 PID 1528 wrote to memory of 1020 1528 rfffflr.exe 40 PID 1528 wrote to memory of 1020 1528 rfffflr.exe 40 PID 1528 wrote to memory of 1020 1528 rfffflr.exe 40 PID 1020 wrote to memory of 2324 1020 5rlrrrr.exe 41 PID 1020 wrote to memory of 2324 1020 5rlrrrr.exe 41 PID 1020 wrote to memory of 2324 1020 5rlrrrr.exe 41 PID 1020 wrote to memory of 2324 1020 5rlrrrr.exe 41 PID 2324 wrote to memory of 240 2324 hbttbh.exe 163 PID 2324 wrote to memory of 240 2324 hbttbh.exe 163 PID 2324 wrote to memory of 240 2324 hbttbh.exe 163 PID 2324 wrote to memory of 240 2324 hbttbh.exe 163 PID 240 wrote to memory of 2740 240 bbhtnb.exe 80 PID 240 wrote to memory of 2740 240 bbhtnb.exe 80 PID 240 wrote to memory of 2740 240 bbhtnb.exe 80 PID 240 wrote to memory of 2740 240 bbhtnb.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b002ce59d44c42799d775df6d9a2bd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2b002ce59d44c42799d775df6d9a2bd0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\hbntbb.exec:\hbntbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\djppj.exec:\djppj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\xxrrlrf.exec:\xxrrlrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\thbnbh.exec:\thbnbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\9jvvj.exec:\9jvvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\1dvpp.exec:\1dvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\xrlffrf.exec:\xrlffrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\rlxxfxf.exec:\rlxxfxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\nnnbtn.exec:\nnnbtn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\vpdjv.exec:\vpdjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\jdppd.exec:\jdppd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\rfffflr.exec:\rfffflr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\5rlrrrr.exec:\5rlrrrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\hbttbh.exec:\hbttbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\bbhtnb.exec:\bbhtnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
\??\c:\pjvdv.exec:\pjvdv.exe17⤵
- Executes dropped EXE
PID:2740 -
\??\c:\xxxlfxr.exec:\xxxlfxr.exe18⤵
- Executes dropped EXE
PID:1284 -
\??\c:\lfllrrx.exec:\lfllrrx.exe19⤵
- Executes dropped EXE
PID:2816 -
\??\c:\hbtbhh.exec:\hbtbhh.exe20⤵
- Executes dropped EXE
PID:2112 -
\??\c:\1jdpj.exec:\1jdpj.exe21⤵
- Executes dropped EXE
PID:2148 -
\??\c:\7dpvd.exec:\7dpvd.exe22⤵
- Executes dropped EXE
PID:600 -
\??\c:\xrflrrf.exec:\xrflrrf.exe23⤵
- Executes dropped EXE
PID:1004 -
\??\c:\lfxflrx.exec:\lfxflrx.exe24⤵
- Executes dropped EXE
PID:1812 -
\??\c:\hhtbtt.exec:\hhtbtt.exe25⤵
- Executes dropped EXE
PID:1144 -
\??\c:\jvjdp.exec:\jvjdp.exe26⤵
- Executes dropped EXE
PID:1988 -
\??\c:\jjjjv.exec:\jjjjv.exe27⤵
- Executes dropped EXE
PID:968 -
\??\c:\5rfllrr.exec:\5rfllrr.exe28⤵
- Executes dropped EXE
PID:908 -
\??\c:\9tbtnt.exec:\9tbtnt.exe29⤵
- Executes dropped EXE
PID:2220 -
\??\c:\jpvdd.exec:\jpvdd.exe30⤵
- Executes dropped EXE
PID:1716 -
\??\c:\lrrlxxx.exec:\lrrlxxx.exe31⤵
- Executes dropped EXE
PID:1028 -
\??\c:\lrrflll.exec:\lrrflll.exe32⤵
- Executes dropped EXE
PID:1448 -
\??\c:\nthhbt.exec:\nthhbt.exe33⤵
- Executes dropped EXE
PID:2184 -
\??\c:\hthhtn.exec:\hthhtn.exe34⤵
- Executes dropped EXE
PID:2988 -
\??\c:\dvvdj.exec:\dvvdj.exe35⤵
- Executes dropped EXE
PID:1672 -
\??\c:\jjpdv.exec:\jjpdv.exe36⤵
- Executes dropped EXE
PID:2652 -
\??\c:\rlxxllr.exec:\rlxxllr.exe37⤵
- Executes dropped EXE
PID:2608 -
\??\c:\7xfxflx.exec:\7xfxflx.exe38⤵
- Executes dropped EXE
PID:2704 -
\??\c:\bbhnbt.exec:\bbhnbt.exe39⤵
- Executes dropped EXE
PID:2876 -
\??\c:\5tnbtb.exec:\5tnbtb.exe40⤵
- Executes dropped EXE
PID:2460 -
\??\c:\nnbhnn.exec:\nnbhnn.exe41⤵
- Executes dropped EXE
PID:2464 -
\??\c:\3dvdp.exec:\3dvdp.exe42⤵
- Executes dropped EXE
PID:2832 -
\??\c:\9vvvd.exec:\9vvvd.exe43⤵
- Executes dropped EXE
PID:3024 -
\??\c:\rrlfxlf.exec:\rrlfxlf.exe44⤵
- Executes dropped EXE
PID:2580 -
\??\c:\fxlfxfr.exec:\fxlfxfr.exe45⤵
- Executes dropped EXE
PID:1536 -
\??\c:\rrxfflx.exec:\rrxfflx.exe46⤵
- Executes dropped EXE
PID:1572 -
\??\c:\hhtbnt.exec:\hhtbnt.exe47⤵
- Executes dropped EXE
PID:2332 -
\??\c:\bhttht.exec:\bhttht.exe48⤵
- Executes dropped EXE
PID:280 -
\??\c:\jjvdj.exec:\jjvdj.exe49⤵
- Executes dropped EXE
PID:1632 -
\??\c:\pjjpv.exec:\pjjpv.exe50⤵
- Executes dropped EXE
PID:1664 -
\??\c:\rrlrlfr.exec:\rrlrlfr.exe51⤵
- Executes dropped EXE
PID:2688 -
\??\c:\llrfrxl.exec:\llrfrxl.exe52⤵
- Executes dropped EXE
PID:1592 -
\??\c:\xffxrfl.exec:\xffxrfl.exe53⤵
- Executes dropped EXE
PID:240 -
\??\c:\lfflffx.exec:\lfflffx.exe54⤵
- Executes dropped EXE
PID:2740 -
\??\c:\nhthhn.exec:\nhthhn.exe55⤵
- Executes dropped EXE
PID:2360 -
\??\c:\bttbhh.exec:\bttbhh.exe56⤵
- Executes dropped EXE
PID:2016 -
\??\c:\bhbntb.exec:\bhbntb.exe57⤵
- Executes dropped EXE
PID:2780 -
\??\c:\jpjpj.exec:\jpjpj.exe58⤵
- Executes dropped EXE
PID:1960 -
\??\c:\vvdjp.exec:\vvdjp.exe59⤵
- Executes dropped EXE
PID:1340 -
\??\c:\5rrlrxl.exec:\5rrlrxl.exe60⤵
- Executes dropped EXE
PID:1428 -
\??\c:\rrxlxfr.exec:\rrxlxfr.exe61⤵
- Executes dropped EXE
PID:1420 -
\??\c:\xfxflfx.exec:\xfxflfx.exe62⤵
- Executes dropped EXE
PID:1048 -
\??\c:\btnbhh.exec:\btnbhh.exe63⤵
- Executes dropped EXE
PID:3028 -
\??\c:\bhbhnt.exec:\bhbhnt.exe64⤵
- Executes dropped EXE
PID:388 -
\??\c:\bnhhhn.exec:\bnhhhn.exe65⤵
- Executes dropped EXE
PID:524 -
\??\c:\pjvjd.exec:\pjvjd.exe66⤵PID:1660
-
\??\c:\dvpvp.exec:\dvpvp.exe67⤵PID:2232
-
\??\c:\fxffrrf.exec:\fxffrrf.exe68⤵PID:2196
-
\??\c:\rrfrxlx.exec:\rrfrxlx.exe69⤵PID:1432
-
\??\c:\lflxflx.exec:\lflxflx.exe70⤵PID:616
-
\??\c:\hthntt.exec:\hthntt.exe71⤵PID:376
-
\??\c:\5nhnhb.exec:\5nhnhb.exe72⤵PID:2156
-
\??\c:\htntht.exec:\htntht.exe73⤵PID:1956
-
\??\c:\vjddp.exec:\vjddp.exe74⤵PID:2184
-
\??\c:\dvpdp.exec:\dvpdp.exe75⤵PID:2924
-
\??\c:\llffxfx.exec:\llffxfx.exe76⤵PID:2628
-
\??\c:\3rlfflr.exec:\3rlfflr.exe77⤵PID:2748
-
\??\c:\fxllxfr.exec:\fxllxfr.exe78⤵PID:2516
-
\??\c:\htthnb.exec:\htthnb.exe79⤵PID:2536
-
\??\c:\3ntbbn.exec:\3ntbbn.exe80⤵PID:2604
-
\??\c:\lrrflrx.exec:\lrrflrx.exe81⤵PID:2468
-
\??\c:\3tnntb.exec:\3tnntb.exe82⤵PID:2456
-
\??\c:\btthnt.exec:\btthnt.exe83⤵PID:2612
-
\??\c:\tnhbnt.exec:\tnhbnt.exe84⤵PID:2840
-
\??\c:\ppjvp.exec:\ppjvp.exe85⤵PID:2300
-
\??\c:\jjvdv.exec:\jjvdv.exe86⤵PID:1500
-
\??\c:\9jvdp.exec:\9jvdp.exe87⤵PID:2484
-
\??\c:\rffflll.exec:\rffflll.exe88⤵PID:2488
-
\??\c:\7lfxrlr.exec:\7lfxrlr.exe89⤵PID:2312
-
\??\c:\hnnnbb.exec:\hnnnbb.exe90⤵PID:1556
-
\??\c:\bbnthn.exec:\bbnthn.exe91⤵PID:1628
-
\??\c:\hbttbh.exec:\hbttbh.exe92⤵PID:1800
-
\??\c:\1jddv.exec:\1jddv.exe93⤵PID:1676
-
\??\c:\ddvjd.exec:\ddvjd.exe94⤵PID:1640
-
\??\c:\jjvvp.exec:\jjvvp.exe95⤵PID:1236
-
\??\c:\ffxfxxl.exec:\ffxfxxl.exe96⤵PID:2308
-
\??\c:\xrrxlxf.exec:\xrrxlxf.exe97⤵PID:2828
-
\??\c:\tththn.exec:\tththn.exe98⤵PID:2068
-
\??\c:\nhntht.exec:\nhntht.exe99⤵PID:1748
-
\??\c:\hbtnhn.exec:\hbtnhn.exe100⤵PID:2288
-
\??\c:\ddvjv.exec:\ddvjv.exe101⤵PID:780
-
\??\c:\7jdjj.exec:\7jdjj.exe102⤵PID:2008
-
\??\c:\flxfflf.exec:\flxfflf.exe103⤵PID:1772
-
\??\c:\5llxfrf.exec:\5llxfrf.exe104⤵PID:956
-
\??\c:\bbbbhh.exec:\bbbbhh.exe105⤵PID:1144
-
\??\c:\7bntht.exec:\7bntht.exe106⤵PID:108
-
\??\c:\thtbnh.exec:\thtbnh.exe107⤵PID:320
-
\??\c:\9pdpj.exec:\9pdpj.exe108⤵PID:1824
-
\??\c:\pjpvj.exec:\pjpvj.exe109⤵PID:772
-
\??\c:\xlxrrfl.exec:\xlxrrfl.exe110⤵PID:2380
-
\??\c:\xlrrrll.exec:\xlrrrll.exe111⤵PID:1056
-
\??\c:\ttbbnt.exec:\ttbbnt.exe112⤵PID:2700
-
\??\c:\hbhnnt.exec:\hbhnnt.exe113⤵PID:2860
-
\??\c:\ppvdp.exec:\ppvdp.exe114⤵PID:1892
-
\??\c:\dvvdj.exec:\dvvdj.exe115⤵PID:2960
-
\??\c:\pvjvv.exec:\pvjvv.exe116⤵PID:2936
-
\??\c:\fxrxffr.exec:\fxrxffr.exe117⤵PID:2108
-
\??\c:\lflrlxr.exec:\lflrlxr.exe118⤵PID:2384
-
\??\c:\hhtbtb.exec:\hhtbtb.exe119⤵PID:1704
-
\??\c:\hhnnbt.exec:\hhnnbt.exe120⤵PID:2728
-
\??\c:\7nhthn.exec:\7nhthn.exe121⤵PID:2044
-
\??\c:\dppjd.exec:\dppjd.exe122⤵PID:2576
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-