Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 12:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4be3b077b59ef04896f19507e594e4facce7ed4af8ec264daa746a672590edff_NeikiAnalytics.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
4be3b077b59ef04896f19507e594e4facce7ed4af8ec264daa746a672590edff_NeikiAnalytics.exe
-
Size
56KB
-
MD5
b0a9a55fbebae79c87ac820fc23cc970
-
SHA1
0034c370f57336bd29b0afbdc9cd4d328e198a55
-
SHA256
4be3b077b59ef04896f19507e594e4facce7ed4af8ec264daa746a672590edff
-
SHA512
ab834ec8c469838fbe15955b4d807d2ef9fa6330e6db7eeddd4e7879630f51cbcbbba7aab43acb552c1a1fc9461f7b2dfac69f4427c25f3faa93af344cf103ed
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFeD:ymb3NkkiQ3mdBjFIFeD
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2312-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3020-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-61-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2496-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-82-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2092-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1732-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1628-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1564-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1920-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1448-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1524-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1556-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1412-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1400-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-1540-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2312 9nhhtb.exe 3032 5nbtbh.exe 2668 pjvdp.exe 2768 lfrlxxl.exe 2496 7jdvj.exe 2504 9dppv.exe 2492 xrlllrr.exe 2092 nbhhnn.exe 1732 1bnhhb.exe 1628 vjpvd.exe 2700 rfxxfff.exe 2688 3xfrflx.exe 2368 hthnbt.exe 1564 7bnntn.exe 1900 jdjdj.exe 1920 7dppd.exe 1448 rlrrxxf.exe 1524 hthtbb.exe 2088 bnhhhb.exe 2196 vpdjp.exe 840 7ffllrx.exe 576 xrrrxxl.exe 2440 nbnntt.exe 1532 hthbhh.exe 2308 7vjpv.exe 3060 dvdjd.exe 3064 fxrrfff.exe 1556 lfxfllr.exe 2260 tntthh.exe 1412 vpddj.exe 1400 jdvvp.exe 2876 fxlffxf.exe 1588 5thhnt.exe 2992 hthhhh.exe 2608 vjppp.exe 2812 jvjjv.exe 2616 lflllfr.exe 2824 xlrrxxf.exe 2804 9fxlrrx.exe 2600 7nhbnt.exe 2752 vjvvv.exe 2540 vpdjv.exe 2524 3xrrlrl.exe 884 frxxlrx.exe 396 lxrlrrx.exe 1348 1thntt.exe 1852 5btbnt.exe 2700 9jvjj.exe 2420 dpddp.exe 1668 frllrrr.exe 752 rfflrrr.exe 1564 hbhhbb.exe 1220 btbhtn.exe 1460 vpdjp.exe 2788 5ddvd.exe 2552 3dppv.exe 2204 lfrxffl.exe 2088 7lxfrrf.exe 2280 nhntbh.exe 476 7dppv.exe 1392 jjdpd.exe 584 dpvvp.exe 2440 3fxlrrr.exe 2996 5nhthh.exe -
resource yara_rule behavioral1/memory/2312-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1732-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1564-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1920-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1448-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1524-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1412-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1400-299-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-1540-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3020 wrote to memory of 2312 3020 4be3b077b59ef04896f19507e594e4facce7ed4af8ec264daa746a672590edff_NeikiAnalytics.exe 28 PID 3020 wrote to memory of 2312 3020 4be3b077b59ef04896f19507e594e4facce7ed4af8ec264daa746a672590edff_NeikiAnalytics.exe 28 PID 3020 wrote to memory of 2312 3020 4be3b077b59ef04896f19507e594e4facce7ed4af8ec264daa746a672590edff_NeikiAnalytics.exe 28 PID 3020 wrote to memory of 2312 3020 4be3b077b59ef04896f19507e594e4facce7ed4af8ec264daa746a672590edff_NeikiAnalytics.exe 28 PID 2312 wrote to memory of 3032 2312 9nhhtb.exe 29 PID 2312 wrote to memory of 3032 2312 9nhhtb.exe 29 PID 2312 wrote to memory of 3032 2312 9nhhtb.exe 29 PID 2312 wrote to memory of 3032 2312 9nhhtb.exe 29 PID 3032 wrote to memory of 2668 3032 5nbtbh.exe 30 PID 3032 wrote to memory of 2668 3032 5nbtbh.exe 30 PID 3032 wrote to memory of 2668 3032 5nbtbh.exe 30 PID 3032 wrote to memory of 2668 3032 5nbtbh.exe 30 PID 2668 wrote to memory of 2768 2668 pjvdp.exe 31 PID 2668 wrote to memory of 2768 2668 pjvdp.exe 31 PID 2668 wrote to memory of 2768 2668 pjvdp.exe 31 PID 2668 wrote to memory of 2768 2668 pjvdp.exe 31 PID 2768 wrote to memory of 2496 2768 lfrlxxl.exe 32 PID 2768 wrote to memory of 2496 2768 lfrlxxl.exe 32 PID 2768 wrote to memory of 2496 2768 lfrlxxl.exe 32 PID 2768 wrote to memory of 2496 2768 lfrlxxl.exe 32 PID 2496 wrote to memory of 2504 2496 7jdvj.exe 33 PID 2496 wrote to memory of 2504 2496 7jdvj.exe 33 PID 2496 wrote to memory of 2504 2496 7jdvj.exe 33 PID 2496 wrote to memory of 2504 2496 7jdvj.exe 33 PID 2504 wrote to memory of 2492 2504 9dppv.exe 34 PID 2504 wrote to memory of 2492 2504 9dppv.exe 34 PID 2504 wrote to memory of 2492 2504 9dppv.exe 34 PID 2504 wrote to memory of 2492 2504 9dppv.exe 34 PID 2492 wrote to memory of 2092 2492 xrlllrr.exe 35 PID 2492 wrote to memory of 2092 2492 xrlllrr.exe 35 PID 2492 wrote to memory of 2092 2492 xrlllrr.exe 35 PID 2492 wrote to memory of 2092 2492 xrlllrr.exe 35 PID 2092 wrote to memory of 1732 2092 nbhhnn.exe 36 PID 2092 wrote to memory of 1732 2092 nbhhnn.exe 36 PID 2092 wrote to memory of 1732 2092 nbhhnn.exe 36 PID 2092 wrote to memory of 1732 2092 nbhhnn.exe 36 PID 1732 wrote to memory of 1628 1732 1bnhhb.exe 37 PID 1732 wrote to memory of 1628 1732 1bnhhb.exe 37 PID 1732 wrote to memory of 1628 1732 1bnhhb.exe 37 PID 1732 wrote to memory of 1628 1732 1bnhhb.exe 37 PID 1628 wrote to memory of 2700 1628 vjpvd.exe 38 PID 1628 wrote to memory of 2700 1628 vjpvd.exe 38 PID 1628 wrote to memory of 2700 1628 vjpvd.exe 38 PID 1628 wrote to memory of 2700 1628 vjpvd.exe 38 PID 2700 wrote to memory of 2688 2700 rfxxfff.exe 39 PID 2700 wrote to memory of 2688 2700 rfxxfff.exe 39 PID 2700 wrote to memory of 2688 2700 rfxxfff.exe 39 PID 2700 wrote to memory of 2688 2700 rfxxfff.exe 39 PID 2688 wrote to memory of 2368 2688 3xfrflx.exe 40 PID 2688 wrote to memory of 2368 2688 3xfrflx.exe 40 PID 2688 wrote to memory of 2368 2688 3xfrflx.exe 40 PID 2688 wrote to memory of 2368 2688 3xfrflx.exe 40 PID 2368 wrote to memory of 1564 2368 hthnbt.exe 41 PID 2368 wrote to memory of 1564 2368 hthnbt.exe 41 PID 2368 wrote to memory of 1564 2368 hthnbt.exe 41 PID 2368 wrote to memory of 1564 2368 hthnbt.exe 41 PID 1564 wrote to memory of 1900 1564 7bnntn.exe 42 PID 1564 wrote to memory of 1900 1564 7bnntn.exe 42 PID 1564 wrote to memory of 1900 1564 7bnntn.exe 42 PID 1564 wrote to memory of 1900 1564 7bnntn.exe 42 PID 1900 wrote to memory of 1920 1900 jdjdj.exe 43 PID 1900 wrote to memory of 1920 1900 jdjdj.exe 43 PID 1900 wrote to memory of 1920 1900 jdjdj.exe 43 PID 1900 wrote to memory of 1920 1900 jdjdj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\4be3b077b59ef04896f19507e594e4facce7ed4af8ec264daa746a672590edff_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4be3b077b59ef04896f19507e594e4facce7ed4af8ec264daa746a672590edff_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\9nhhtb.exec:\9nhhtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\5nbtbh.exec:\5nbtbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\pjvdp.exec:\pjvdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\lfrlxxl.exec:\lfrlxxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\7jdvj.exec:\7jdvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\9dppv.exec:\9dppv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\xrlllrr.exec:\xrlllrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\nbhhnn.exec:\nbhhnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\1bnhhb.exec:\1bnhhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\vjpvd.exec:\vjpvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\rfxxfff.exec:\rfxxfff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\3xfrflx.exec:\3xfrflx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\hthnbt.exec:\hthnbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\7bnntn.exec:\7bnntn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\jdjdj.exec:\jdjdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\7dppd.exec:\7dppd.exe17⤵
- Executes dropped EXE
PID:1920 -
\??\c:\rlrrxxf.exec:\rlrrxxf.exe18⤵
- Executes dropped EXE
PID:1448 -
\??\c:\hthtbb.exec:\hthtbb.exe19⤵
- Executes dropped EXE
PID:1524 -
\??\c:\bnhhhb.exec:\bnhhhb.exe20⤵
- Executes dropped EXE
PID:2088 -
\??\c:\vpdjp.exec:\vpdjp.exe21⤵
- Executes dropped EXE
PID:2196 -
\??\c:\7ffllrx.exec:\7ffllrx.exe22⤵
- Executes dropped EXE
PID:840 -
\??\c:\xrrrxxl.exec:\xrrrxxl.exe23⤵
- Executes dropped EXE
PID:576 -
\??\c:\nbnntt.exec:\nbnntt.exe24⤵
- Executes dropped EXE
PID:2440 -
\??\c:\hthbhh.exec:\hthbhh.exe25⤵
- Executes dropped EXE
PID:1532 -
\??\c:\7vjpv.exec:\7vjpv.exe26⤵
- Executes dropped EXE
PID:2308 -
\??\c:\dvdjd.exec:\dvdjd.exe27⤵
- Executes dropped EXE
PID:3060 -
\??\c:\fxrrfff.exec:\fxrrfff.exe28⤵
- Executes dropped EXE
PID:3064 -
\??\c:\lfxfllr.exec:\lfxfllr.exe29⤵
- Executes dropped EXE
PID:1556 -
\??\c:\tntthh.exec:\tntthh.exe30⤵
- Executes dropped EXE
PID:2260 -
\??\c:\vpddj.exec:\vpddj.exe31⤵
- Executes dropped EXE
PID:1412 -
\??\c:\jdvvp.exec:\jdvvp.exe32⤵
- Executes dropped EXE
PID:1400 -
\??\c:\fxlffxf.exec:\fxlffxf.exe33⤵
- Executes dropped EXE
PID:2876 -
\??\c:\5thhnt.exec:\5thhnt.exe34⤵
- Executes dropped EXE
PID:1588 -
\??\c:\hthhhh.exec:\hthhhh.exe35⤵
- Executes dropped EXE
PID:2992 -
\??\c:\vjppp.exec:\vjppp.exe36⤵
- Executes dropped EXE
PID:2608 -
\??\c:\jvjjv.exec:\jvjjv.exe37⤵
- Executes dropped EXE
PID:2812 -
\??\c:\lflllfr.exec:\lflllfr.exe38⤵
- Executes dropped EXE
PID:2616 -
\??\c:\xlrrxxf.exec:\xlrrxxf.exe39⤵
- Executes dropped EXE
PID:2824 -
\??\c:\9fxlrrx.exec:\9fxlrrx.exe40⤵
- Executes dropped EXE
PID:2804 -
\??\c:\7nhbnt.exec:\7nhbnt.exe41⤵
- Executes dropped EXE
PID:2600 -
\??\c:\vjvvv.exec:\vjvvv.exe42⤵
- Executes dropped EXE
PID:2752 -
\??\c:\vpdjv.exec:\vpdjv.exe43⤵
- Executes dropped EXE
PID:2540 -
\??\c:\3xrrlrl.exec:\3xrrlrl.exe44⤵
- Executes dropped EXE
PID:2524 -
\??\c:\frxxlrx.exec:\frxxlrx.exe45⤵
- Executes dropped EXE
PID:884 -
\??\c:\lxrlrrx.exec:\lxrlrrx.exe46⤵
- Executes dropped EXE
PID:396 -
\??\c:\1thntt.exec:\1thntt.exe47⤵
- Executes dropped EXE
PID:1348 -
\??\c:\5btbnt.exec:\5btbnt.exe48⤵
- Executes dropped EXE
PID:1852 -
\??\c:\9jvjj.exec:\9jvjj.exe49⤵
- Executes dropped EXE
PID:2700 -
\??\c:\dpddp.exec:\dpddp.exe50⤵
- Executes dropped EXE
PID:2420 -
\??\c:\frllrrr.exec:\frllrrr.exe51⤵
- Executes dropped EXE
PID:1668 -
\??\c:\rfflrrr.exec:\rfflrrr.exe52⤵
- Executes dropped EXE
PID:752 -
\??\c:\hbhhbb.exec:\hbhhbb.exe53⤵
- Executes dropped EXE
PID:1564 -
\??\c:\btbhtn.exec:\btbhtn.exe54⤵
- Executes dropped EXE
PID:1220 -
\??\c:\vpdjp.exec:\vpdjp.exe55⤵
- Executes dropped EXE
PID:1460 -
\??\c:\5ddvd.exec:\5ddvd.exe56⤵
- Executes dropped EXE
PID:2788 -
\??\c:\3dppv.exec:\3dppv.exe57⤵
- Executes dropped EXE
PID:2552 -
\??\c:\lfrxffl.exec:\lfrxffl.exe58⤵
- Executes dropped EXE
PID:2204 -
\??\c:\7lxfrrf.exec:\7lxfrrf.exe59⤵
- Executes dropped EXE
PID:2088 -
\??\c:\nhntbh.exec:\nhntbh.exe60⤵
- Executes dropped EXE
PID:2280 -
\??\c:\7dppv.exec:\7dppv.exe61⤵
- Executes dropped EXE
PID:476 -
\??\c:\jjdpd.exec:\jjdpd.exe62⤵
- Executes dropped EXE
PID:1392 -
\??\c:\dpvvp.exec:\dpvvp.exe63⤵
- Executes dropped EXE
PID:584 -
\??\c:\3fxlrrr.exec:\3fxlrrr.exe64⤵
- Executes dropped EXE
PID:2440 -
\??\c:\5nhthh.exec:\5nhthh.exe65⤵
- Executes dropped EXE
PID:2996 -
\??\c:\pjdjp.exec:\pjdjp.exe66⤵PID:944
-
\??\c:\9vvvd.exec:\9vvvd.exe67⤵PID:900
-
\??\c:\jvjpv.exec:\jvjpv.exe68⤵PID:636
-
\??\c:\frfffff.exec:\frfffff.exe69⤵PID:2064
-
\??\c:\ffrrxfl.exec:\ffrrxfl.exe70⤵PID:1908
-
\??\c:\thhnbb.exec:\thhnbb.exe71⤵PID:2952
-
\??\c:\bntbhb.exec:\bntbhb.exe72⤵PID:892
-
\??\c:\pjdjp.exec:\pjdjp.exe73⤵PID:2392
-
\??\c:\dpddd.exec:\dpddd.exe74⤵PID:3020
-
\??\c:\dppdj.exec:\dppdj.exe75⤵PID:2872
-
\??\c:\frllxlx.exec:\frllxlx.exe76⤵PID:2292
-
\??\c:\1ffxlll.exec:\1ffxlll.exe77⤵PID:3024
-
\??\c:\7htbhn.exec:\7htbhn.exe78⤵PID:2656
-
\??\c:\hbtbhh.exec:\hbtbhh.exe79⤵PID:2748
-
\??\c:\pjpvj.exec:\pjpvj.exe80⤵PID:2676
-
\??\c:\dvvpv.exec:\dvvpv.exe81⤵PID:2784
-
\??\c:\xlfffff.exec:\xlfffff.exe82⤵PID:2484
-
\??\c:\frfflfl.exec:\frfflfl.exe83⤵PID:2396
-
\??\c:\bnbbnh.exec:\bnbbnh.exe84⤵PID:2536
-
\??\c:\bnhtnb.exec:\bnhtnb.exe85⤵PID:2940
-
\??\c:\vpjjv.exec:\vpjjv.exe86⤵PID:2164
-
\??\c:\3dppp.exec:\3dppp.exe87⤵PID:2092
-
\??\c:\rlffrrf.exec:\rlffrrf.exe88⤵PID:1512
-
\??\c:\llrxrxf.exec:\llrxrxf.exe89⤵PID:2532
-
\??\c:\btnbtb.exec:\btnbtb.exe90⤵PID:1856
-
\??\c:\nnbnhh.exec:\nnbnhh.exe91⤵PID:2160
-
\??\c:\dvdjd.exec:\dvdjd.exe92⤵PID:2412
-
\??\c:\7pdpv.exec:\7pdpv.exe93⤵PID:2368
-
\??\c:\dvdjv.exec:\dvdjv.exe94⤵PID:1892
-
\??\c:\xffxxrl.exec:\xffxxrl.exe95⤵PID:1624
-
\??\c:\3rlxllx.exec:\3rlxllx.exe96⤵PID:1844
-
\??\c:\bnbhbb.exec:\bnbhbb.exe97⤵PID:1416
-
\??\c:\7nhhhn.exec:\7nhhhn.exe98⤵PID:3016
-
\??\c:\dvddd.exec:\dvddd.exe99⤵PID:2012
-
\??\c:\pdvpp.exec:\pdvpp.exe100⤵PID:2224
-
\??\c:\7lrlrlr.exec:\7lrlrlr.exe101⤵PID:2240
-
\??\c:\9frrllf.exec:\9frrllf.exe102⤵PID:672
-
\??\c:\thtntt.exec:\thtntt.exe103⤵PID:652
-
\??\c:\7ththh.exec:\7ththh.exe104⤵PID:688
-
\??\c:\pjvvd.exec:\pjvvd.exe105⤵PID:1768
-
\??\c:\vpjpd.exec:\vpjpd.exe106⤵PID:608
-
\??\c:\1rlllfl.exec:\1rlllfl.exe107⤵PID:1644
-
\??\c:\7frlfll.exec:\7frlfll.exe108⤵PID:1008
-
\??\c:\ffrfrxr.exec:\ffrfrxr.exe109⤵PID:848
-
\??\c:\3bntbn.exec:\3bntbn.exe110⤵PID:928
-
\??\c:\nbnhnn.exec:\nbnhnn.exe111⤵PID:1700
-
\??\c:\jvdjd.exec:\jvdjd.exe112⤵PID:984
-
\??\c:\dpdpj.exec:\dpdpj.exe113⤵PID:2256
-
\??\c:\5xlrxxf.exec:\5xlrxxf.exe114⤵PID:780
-
\??\c:\rfxrxrx.exec:\rfxrxrx.exe115⤵PID:1400
-
\??\c:\bbntnn.exec:\bbntnn.exe116⤵PID:1500
-
\??\c:\hbbhnt.exec:\hbbhnt.exe117⤵PID:2080
-
\??\c:\9vjpv.exec:\9vjpv.exe118⤵PID:2292
-
\??\c:\jdjdp.exec:\jdjdp.exe119⤵PID:2664
-
\??\c:\lfxxfff.exec:\lfxxfff.exe120⤵PID:2832
-
\??\c:\lxlrxrr.exec:\lxlrxrr.exe121⤵PID:2976
-
\??\c:\btnntt.exec:\btnntt.exe122⤵PID:2668
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-