Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 05:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1f2c6bf219350ecd07168d1cd92eb370_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
1f2c6bf219350ecd07168d1cd92eb370_NeikiAnalytics.exe
-
Size
64KB
-
MD5
1f2c6bf219350ecd07168d1cd92eb370
-
SHA1
af2e906c4b71037750bf3f8c68f97d86ae32a6fe
-
SHA256
f2c0891f0b29c29ff9e3b00a377dd15af1deb8f1efd9b0d2d8ad1ec6621d7d20
-
SHA512
3025a8207dea7258b66b9f0e31afc7171d24d19d61cf3aa5a7e41474d0cee0e9c29f06da1d7eac49f4a647f7b0eae27f70c5f263b93e21206970bdb71501bfbd
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfw:ymb3NkkiQ3mdBjFI4VE
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/1712-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2472-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3044-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1636-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1284-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1832-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2000-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1680-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/608-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1352-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1672-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/964-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1628-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1816-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
1xrxrlx.exexrflrrl.exetnbtbh.exetnbhnn.exelfxllrx.exe7hbhtb.exejjppd.exedvvpv.exe7xfllrx.exenhhnhn.exe9dvdp.exe9vpvp.exe1xlxflr.exebbtthb.exe7hbthn.exe9vvjv.exefxlrffx.exe5bttbn.exe9hhnhn.exe9vjjv.exejjvdp.exefffrfrf.exetnnbht.exe1hbnth.exedpdvj.exefxrlxfr.exe3bhthb.exepjvjv.exejjjpj.exerfrfxlr.exebttnhn.exevvpdv.exeppvjj.exelfflxlr.exe1lfxlrl.exehhhbnb.exetnnhtb.exejvvjj.exeddjpv.exevpjpv.exelflrflr.exennbthn.exe9tbhth.exejjvdv.exedvdjp.exe9frxfrf.exellfxrrf.exennbnbn.exehbbhnt.exejpdpj.exedvjjv.exellrflrf.exelflrfxr.exe1nntbh.exettnbhn.exe3rrxffl.exelxrxfrx.exebthnbb.exeppvpd.exepjddj.exerlfrrxl.exexxlrxlx.exennnnbt.exebnbbnb.exepid process 2472 1xrxrlx.exe 2860 xrflrrl.exe 3044 tnbtbh.exe 2844 tnbhnn.exe 2896 lfxllrx.exe 2608 7hbhtb.exe 2688 jjppd.exe 2540 dvvpv.exe 2784 7xfllrx.exe 780 nhhnhn.exe 1636 9dvdp.exe 2700 9vpvp.exe 1284 1xlxflr.exe 1832 bbtthb.exe 776 7hbthn.exe 2000 9vvjv.exe 1680 fxlrffx.exe 608 5bttbn.exe 1352 9hhnhn.exe 1672 9vjjv.exe 2616 jjvdp.exe 2708 fffrfrf.exe 3060 tnnbht.exe 964 1hbnth.exe 540 dpdvj.exe 1664 fxrlxfr.exe 1640 3bhthb.exe 1628 pjvjv.exe 576 jjjpj.exe 1716 rfrfxlr.exe 1816 bttnhn.exe 2952 vvpdv.exe 2020 ppvjj.exe 2888 lfflxlr.exe 3036 1lfxlrl.exe 2624 hhhbnb.exe 2812 tnnhtb.exe 2652 jvvjj.exe 2944 ddjpv.exe 3048 vpjpv.exe 2852 lflrflr.exe 2684 nnbthn.exe 2780 9tbhth.exe 2592 jjvdv.exe 2540 dvdjp.exe 1580 9frxfrf.exe 856 llfxrrf.exe 2508 nnbnbn.exe 1636 hbbhnt.exe 2728 jpdpj.exe 1032 dvjjv.exe 2224 llrflrf.exe 1956 lflrfxr.exe 1100 1nntbh.exe 2000 ttnbhn.exe 788 3rrxffl.exe 2440 lxrxfrx.exe 1624 bthnbb.exe 644 ppvpd.exe 2340 pjddj.exe 2332 rlfrrxl.exe 3028 xxlrxlx.exe 2116 nnnnbt.exe 1760 bnbbnb.exe -
Processes:
resource yara_rule behavioral1/memory/1712-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1636-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1284-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1832-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2000-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1680-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/608-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1352-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/964-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1816-296-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1f2c6bf219350ecd07168d1cd92eb370_NeikiAnalytics.exe1xrxrlx.exexrflrrl.exetnbtbh.exetnbhnn.exelfxllrx.exe7hbhtb.exejjppd.exedvvpv.exe7xfllrx.exenhhnhn.exe9dvdp.exe9vpvp.exe1xlxflr.exebbtthb.exe7hbthn.exedescription pid process target process PID 1712 wrote to memory of 2472 1712 1f2c6bf219350ecd07168d1cd92eb370_NeikiAnalytics.exe 1xrxrlx.exe PID 1712 wrote to memory of 2472 1712 1f2c6bf219350ecd07168d1cd92eb370_NeikiAnalytics.exe 1xrxrlx.exe PID 1712 wrote to memory of 2472 1712 1f2c6bf219350ecd07168d1cd92eb370_NeikiAnalytics.exe 1xrxrlx.exe PID 1712 wrote to memory of 2472 1712 1f2c6bf219350ecd07168d1cd92eb370_NeikiAnalytics.exe 1xrxrlx.exe PID 2472 wrote to memory of 2860 2472 1xrxrlx.exe xrflrrl.exe PID 2472 wrote to memory of 2860 2472 1xrxrlx.exe xrflrrl.exe PID 2472 wrote to memory of 2860 2472 1xrxrlx.exe xrflrrl.exe PID 2472 wrote to memory of 2860 2472 1xrxrlx.exe xrflrrl.exe PID 2860 wrote to memory of 3044 2860 xrflrrl.exe tnbtbh.exe PID 2860 wrote to memory of 3044 2860 xrflrrl.exe tnbtbh.exe PID 2860 wrote to memory of 3044 2860 xrflrrl.exe tnbtbh.exe PID 2860 wrote to memory of 3044 2860 xrflrrl.exe tnbtbh.exe PID 3044 wrote to memory of 2844 3044 tnbtbh.exe tnbhnn.exe PID 3044 wrote to memory of 2844 3044 tnbtbh.exe tnbhnn.exe PID 3044 wrote to memory of 2844 3044 tnbtbh.exe tnbhnn.exe PID 3044 wrote to memory of 2844 3044 tnbtbh.exe tnbhnn.exe PID 2844 wrote to memory of 2896 2844 tnbhnn.exe lfxllrx.exe PID 2844 wrote to memory of 2896 2844 tnbhnn.exe lfxllrx.exe PID 2844 wrote to memory of 2896 2844 tnbhnn.exe lfxllrx.exe PID 2844 wrote to memory of 2896 2844 tnbhnn.exe lfxllrx.exe PID 2896 wrote to memory of 2608 2896 lfxllrx.exe 7hbhtb.exe PID 2896 wrote to memory of 2608 2896 lfxllrx.exe 7hbhtb.exe PID 2896 wrote to memory of 2608 2896 lfxllrx.exe 7hbhtb.exe PID 2896 wrote to memory of 2608 2896 lfxllrx.exe 7hbhtb.exe PID 2608 wrote to memory of 2688 2608 7hbhtb.exe jjppd.exe PID 2608 wrote to memory of 2688 2608 7hbhtb.exe jjppd.exe PID 2608 wrote to memory of 2688 2608 7hbhtb.exe jjppd.exe PID 2608 wrote to memory of 2688 2608 7hbhtb.exe jjppd.exe PID 2688 wrote to memory of 2540 2688 jjppd.exe dvvpv.exe PID 2688 wrote to memory of 2540 2688 jjppd.exe dvvpv.exe PID 2688 wrote to memory of 2540 2688 jjppd.exe dvvpv.exe PID 2688 wrote to memory of 2540 2688 jjppd.exe dvvpv.exe PID 2540 wrote to memory of 2784 2540 dvvpv.exe 7xfllrx.exe PID 2540 wrote to memory of 2784 2540 dvvpv.exe 7xfllrx.exe PID 2540 wrote to memory of 2784 2540 dvvpv.exe 7xfllrx.exe PID 2540 wrote to memory of 2784 2540 dvvpv.exe 7xfllrx.exe PID 2784 wrote to memory of 780 2784 7xfllrx.exe nhhnhn.exe PID 2784 wrote to memory of 780 2784 7xfllrx.exe nhhnhn.exe PID 2784 wrote to memory of 780 2784 7xfllrx.exe nhhnhn.exe PID 2784 wrote to memory of 780 2784 7xfllrx.exe nhhnhn.exe PID 780 wrote to memory of 1636 780 nhhnhn.exe 9dvdp.exe PID 780 wrote to memory of 1636 780 nhhnhn.exe 9dvdp.exe PID 780 wrote to memory of 1636 780 nhhnhn.exe 9dvdp.exe PID 780 wrote to memory of 1636 780 nhhnhn.exe 9dvdp.exe PID 1636 wrote to memory of 2700 1636 9dvdp.exe 9vpvp.exe PID 1636 wrote to memory of 2700 1636 9dvdp.exe 9vpvp.exe PID 1636 wrote to memory of 2700 1636 9dvdp.exe 9vpvp.exe PID 1636 wrote to memory of 2700 1636 9dvdp.exe 9vpvp.exe PID 2700 wrote to memory of 1284 2700 9vpvp.exe 1xlxflr.exe PID 2700 wrote to memory of 1284 2700 9vpvp.exe 1xlxflr.exe PID 2700 wrote to memory of 1284 2700 9vpvp.exe 1xlxflr.exe PID 2700 wrote to memory of 1284 2700 9vpvp.exe 1xlxflr.exe PID 1284 wrote to memory of 1832 1284 1xlxflr.exe bbtthb.exe PID 1284 wrote to memory of 1832 1284 1xlxflr.exe bbtthb.exe PID 1284 wrote to memory of 1832 1284 1xlxflr.exe bbtthb.exe PID 1284 wrote to memory of 1832 1284 1xlxflr.exe bbtthb.exe PID 1832 wrote to memory of 776 1832 bbtthb.exe 7hbthn.exe PID 1832 wrote to memory of 776 1832 bbtthb.exe 7hbthn.exe PID 1832 wrote to memory of 776 1832 bbtthb.exe 7hbthn.exe PID 1832 wrote to memory of 776 1832 bbtthb.exe 7hbthn.exe PID 776 wrote to memory of 2000 776 7hbthn.exe 9vvjv.exe PID 776 wrote to memory of 2000 776 7hbthn.exe 9vvjv.exe PID 776 wrote to memory of 2000 776 7hbthn.exe 9vvjv.exe PID 776 wrote to memory of 2000 776 7hbthn.exe 9vvjv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f2c6bf219350ecd07168d1cd92eb370_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1f2c6bf219350ecd07168d1cd92eb370_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\1xrxrlx.exec:\1xrxrlx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\xrflrrl.exec:\xrflrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\tnbtbh.exec:\tnbtbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\tnbhnn.exec:\tnbhnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\lfxllrx.exec:\lfxllrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\7hbhtb.exec:\7hbhtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\jjppd.exec:\jjppd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\dvvpv.exec:\dvvpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\7xfllrx.exec:\7xfllrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\nhhnhn.exec:\nhhnhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
\??\c:\9dvdp.exec:\9dvdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\9vpvp.exec:\9vpvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\1xlxflr.exec:\1xlxflr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\bbtthb.exec:\bbtthb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\7hbthn.exec:\7hbthn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\9vvjv.exec:\9vvjv.exe17⤵
- Executes dropped EXE
PID:2000 -
\??\c:\fxlrffx.exec:\fxlrffx.exe18⤵
- Executes dropped EXE
PID:1680 -
\??\c:\5bttbn.exec:\5bttbn.exe19⤵
- Executes dropped EXE
PID:608 -
\??\c:\9hhnhn.exec:\9hhnhn.exe20⤵
- Executes dropped EXE
PID:1352 -
\??\c:\9vjjv.exec:\9vjjv.exe21⤵
- Executes dropped EXE
PID:1672 -
\??\c:\jjvdp.exec:\jjvdp.exe22⤵
- Executes dropped EXE
PID:2616 -
\??\c:\fffrfrf.exec:\fffrfrf.exe23⤵
- Executes dropped EXE
PID:2708 -
\??\c:\tnnbht.exec:\tnnbht.exe24⤵
- Executes dropped EXE
PID:3060 -
\??\c:\1hbnth.exec:\1hbnth.exe25⤵
- Executes dropped EXE
PID:964 -
\??\c:\dpdvj.exec:\dpdvj.exe26⤵
- Executes dropped EXE
PID:540 -
\??\c:\fxrlxfr.exec:\fxrlxfr.exe27⤵
- Executes dropped EXE
PID:1664 -
\??\c:\3bhthb.exec:\3bhthb.exe28⤵
- Executes dropped EXE
PID:1640 -
\??\c:\pjvjv.exec:\pjvjv.exe29⤵
- Executes dropped EXE
PID:1628 -
\??\c:\jjjpj.exec:\jjjpj.exe30⤵
- Executes dropped EXE
PID:576 -
\??\c:\rfrfxlr.exec:\rfrfxlr.exe31⤵
- Executes dropped EXE
PID:1716 -
\??\c:\bttnhn.exec:\bttnhn.exe32⤵
- Executes dropped EXE
PID:1816 -
\??\c:\vvpdv.exec:\vvpdv.exe33⤵
- Executes dropped EXE
PID:2952 -
\??\c:\ppvjj.exec:\ppvjj.exe34⤵
- Executes dropped EXE
PID:2020 -
\??\c:\lfflxlr.exec:\lfflxlr.exe35⤵
- Executes dropped EXE
PID:2888 -
\??\c:\1lfxlrl.exec:\1lfxlrl.exe36⤵
- Executes dropped EXE
PID:3036 -
\??\c:\hhhbnb.exec:\hhhbnb.exe37⤵
- Executes dropped EXE
PID:2624 -
\??\c:\tnnhtb.exec:\tnnhtb.exe38⤵
- Executes dropped EXE
PID:2812 -
\??\c:\jvvjj.exec:\jvvjj.exe39⤵
- Executes dropped EXE
PID:2652 -
\??\c:\ddjpv.exec:\ddjpv.exe40⤵
- Executes dropped EXE
PID:2944 -
\??\c:\vpjpv.exec:\vpjpv.exe41⤵
- Executes dropped EXE
PID:3048 -
\??\c:\lflrflr.exec:\lflrflr.exe42⤵
- Executes dropped EXE
PID:2852 -
\??\c:\nnbthn.exec:\nnbthn.exe43⤵
- Executes dropped EXE
PID:2684 -
\??\c:\9tbhth.exec:\9tbhth.exe44⤵
- Executes dropped EXE
PID:2780 -
\??\c:\jjvdv.exec:\jjvdv.exe45⤵
- Executes dropped EXE
PID:2592 -
\??\c:\dvdjp.exec:\dvdjp.exe46⤵
- Executes dropped EXE
PID:2540 -
\??\c:\9frxfrf.exec:\9frxfrf.exe47⤵
- Executes dropped EXE
PID:1580 -
\??\c:\llfxrrf.exec:\llfxrrf.exe48⤵
- Executes dropped EXE
PID:856 -
\??\c:\nnbnbn.exec:\nnbnbn.exe49⤵
- Executes dropped EXE
PID:2508 -
\??\c:\hbbhnt.exec:\hbbhnt.exe50⤵
- Executes dropped EXE
PID:1636 -
\??\c:\jpdpj.exec:\jpdpj.exe51⤵
- Executes dropped EXE
PID:2728 -
\??\c:\dvjjv.exec:\dvjjv.exe52⤵
- Executes dropped EXE
PID:1032 -
\??\c:\llrflrf.exec:\llrflrf.exe53⤵
- Executes dropped EXE
PID:2224 -
\??\c:\lflrfxr.exec:\lflrfxr.exe54⤵
- Executes dropped EXE
PID:1956 -
\??\c:\1nntbh.exec:\1nntbh.exe55⤵
- Executes dropped EXE
PID:1100 -
\??\c:\ttnbhn.exec:\ttnbhn.exe56⤵
- Executes dropped EXE
PID:2000 -
\??\c:\3rrxffl.exec:\3rrxffl.exe57⤵
- Executes dropped EXE
PID:788 -
\??\c:\lxrxfrx.exec:\lxrxfrx.exe58⤵
- Executes dropped EXE
PID:2440 -
\??\c:\bthnbb.exec:\bthnbb.exe59⤵
- Executes dropped EXE
PID:1624 -
\??\c:\ppvpd.exec:\ppvpd.exe60⤵
- Executes dropped EXE
PID:644 -
\??\c:\pjddj.exec:\pjddj.exe61⤵
- Executes dropped EXE
PID:2340 -
\??\c:\rlfrrxl.exec:\rlfrrxl.exe62⤵
- Executes dropped EXE
PID:2332 -
\??\c:\xxlrxlx.exec:\xxlrxlx.exe63⤵
- Executes dropped EXE
PID:3028 -
\??\c:\nnnnbt.exec:\nnnnbt.exe64⤵
- Executes dropped EXE
PID:2116 -
\??\c:\bnbbnb.exec:\bnbbnb.exe65⤵
- Executes dropped EXE
PID:1760 -
\??\c:\vvpdj.exec:\vvpdj.exe66⤵PID:800
-
\??\c:\7jvdd.exec:\7jvdd.exe67⤵PID:1540
-
\??\c:\llfrfxf.exec:\llfrfxf.exe68⤵PID:1372
-
\??\c:\xrlxxxl.exec:\xrlxxxl.exe69⤵PID:2072
-
\??\c:\7hhbhb.exec:\7hhbhb.exe70⤵PID:1640
-
\??\c:\bthbnt.exec:\bthbnt.exe71⤵PID:1732
-
\??\c:\3jdjv.exec:\3jdjv.exe72⤵PID:1980
-
\??\c:\dvpvp.exec:\dvpvp.exe73⤵PID:2936
-
\??\c:\rlrlfxf.exec:\rlrlfxf.exe74⤵PID:1768
-
\??\c:\rfxflrl.exec:\rfxflrl.exe75⤵PID:2376
-
\??\c:\bttntt.exec:\bttntt.exe76⤵PID:3040
-
\??\c:\nnhntb.exec:\nnhntb.exe77⤵PID:1720
-
\??\c:\vpjpj.exec:\vpjpj.exe78⤵PID:2160
-
\??\c:\3vpdp.exec:\3vpdp.exe79⤵PID:2612
-
\??\c:\rlfrflx.exec:\rlfrflx.exe80⤵PID:2900
-
\??\c:\fffxflr.exec:\fffxflr.exe81⤵PID:2832
-
\??\c:\fffrxfr.exec:\fffrxfr.exe82⤵PID:2804
-
\??\c:\1bthnb.exec:\1bthnb.exe83⤵PID:2648
-
\??\c:\tnnnnn.exec:\tnnnnn.exe84⤵PID:2636
-
\??\c:\jdpvv.exec:\jdpvv.exe85⤵PID:2548
-
\??\c:\pjpvd.exec:\pjpvd.exe86⤵PID:2040
-
\??\c:\rlrrxfr.exec:\rlrrxfr.exe87⤵PID:2688
-
\??\c:\xlxlxxx.exec:\xlxlxxx.exe88⤵PID:2444
-
\??\c:\nhtbhn.exec:\nhtbhn.exe89⤵PID:1884
-
\??\c:\hbhhhn.exec:\hbhhhn.exe90⤵PID:356
-
\??\c:\dvjpp.exec:\dvjpp.exe91⤵PID:2748
-
\??\c:\1vpdd.exec:\1vpdd.exe92⤵PID:2824
-
\??\c:\fxxfrxl.exec:\fxxfrxl.exe93⤵PID:2736
-
\??\c:\9flxffr.exec:\9flxffr.exe94⤵PID:1844
-
\??\c:\hhbnbb.exec:\hhbnbb.exe95⤵PID:1876
-
\??\c:\thnhnb.exec:\thnhnb.exe96⤵PID:1832
-
\??\c:\ppjvd.exec:\ppjvd.exe97⤵PID:1752
-
\??\c:\vvjvp.exec:\vvjvp.exe98⤵PID:536
-
\??\c:\5fxrlxx.exec:\5fxrlxx.exe99⤵PID:340
-
\??\c:\xrxfxfl.exec:\xrxfxfl.exe100⤵PID:2448
-
\??\c:\3btthn.exec:\3btthn.exe101⤵PID:2768
-
\??\c:\hhhbhh.exec:\hhhbhh.exe102⤵PID:1780
-
\??\c:\3pjvj.exec:\3pjvj.exe103⤵PID:2360
-
\??\c:\9jvvj.exec:\9jvvj.exe104⤵PID:1316
-
\??\c:\lflrxxf.exec:\lflrxxf.exe105⤵PID:2708
-
\??\c:\7frfrxx.exec:\7frfrxx.exe106⤵PID:2172
-
\??\c:\tthtbb.exec:\tthtbb.exe107⤵PID:1872
-
\??\c:\nnntbn.exec:\nnntbn.exe108⤵PID:3052
-
\??\c:\3jjjp.exec:\3jjjp.exe109⤵PID:540
-
\??\c:\jjjjp.exec:\jjjjp.exe110⤵PID:1360
-
\??\c:\9pdpv.exec:\9pdpv.exe111⤵PID:1644
-
\??\c:\xrrfrxf.exec:\xrrfrxf.exe112⤵PID:1652
-
\??\c:\rrlrffr.exec:\rrlrffr.exe113⤵PID:2156
-
\??\c:\7tbnbh.exec:\7tbnbh.exe114⤵PID:1788
-
\??\c:\nnnbnh.exec:\nnnbnh.exe115⤵PID:1716
-
\??\c:\dvjpv.exec:\dvjpv.exe116⤵PID:2080
-
\??\c:\rrrrffr.exec:\rrrrffr.exe117⤵PID:904
-
\??\c:\5xxflrf.exec:\5xxflrf.exe118⤵PID:1724
-
\??\c:\nhnbtn.exec:\nhnbtn.exe119⤵PID:1328
-
\??\c:\7hnbbn.exec:\7hnbbn.exe120⤵PID:2716
-
\??\c:\hbnbnb.exec:\hbnbnb.exe121⤵PID:2628
-
\??\c:\1jvdp.exec:\1jvdp.exe122⤵PID:2800
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-