Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 03:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1c43acdffaceee861fc39ff61a659960_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
1c43acdffaceee861fc39ff61a659960_NeikiAnalytics.exe
-
Size
94KB
-
MD5
1c43acdffaceee861fc39ff61a659960
-
SHA1
4acfca21813bcfc7160af8d1fc7137f7898cf70f
-
SHA256
8bffe28b1fa4f4ac40b854942d9d2428513740ba1926d6c6a5dbcab6819143d1
-
SHA512
bcccd9b911fa18619c379ad1ea0a5e676b6696a3cdeae365e779e1d6d4a33ee2123a084aeae12b118fa5deee461b28ac7e971f1ecaf0b111d49d3b2a6b3f3eff
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxE6vr/mAF:ymb3NkkiQ3mdBjFo73PYP1lri3KVT+bE
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral1/memory/2944-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2132-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-42-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2328-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2452-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1812-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1452-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1912-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2068-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/776-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/284-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1864-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1600-306-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2120 pjvdv.exe 2132 xffrxlf.exe 2660 thtbhb.exe 2800 3vpdj.exe 2744 ttnbtb.exe 2824 pjdpv.exe 2524 7llrflx.exe 2640 nhbhnt.exe 1652 5jjdj.exe 2780 1rxxlfl.exe 2564 tththn.exe 2328 htntbb.exe 2452 dppdp.exe 1812 7rxrflx.exe 2416 tnttbb.exe 1452 jdjvp.exe 1284 7flfrrx.exe 1760 tbhbhn.exe 1152 3tnbnb.exe 1912 ddvdj.exe 2068 ffrfflf.exe 776 tttnnh.exe 284 ppjjp.exe 572 rlrxfrf.exe 2492 9ttbnt.exe 1864 bbtnbh.exe 908 djvjj.exe 2604 xxffflf.exe 2372 tnbhnn.exe 2480 pppvj.exe 1600 lfflflf.exe 2968 xfxrxrl.exe 1684 nbbnhh.exe 3040 vjvdj.exe 2616 jdjpd.exe 2676 fxxrffr.exe 2660 9xflxxr.exe 2864 nbnthh.exe 2800 dvjdv.exe 2196 fflxrfx.exe 2776 9lxlxfr.exe 2540 ttnhhn.exe 2940 7tbbnh.exe 2344 vddpv.exe 1860 btbhtt.exe 2772 bthhhh.exe 2844 vpvdv.exe 2036 vpjjj.exe 2428 rlfrfrf.exe 1556 9ffllxr.exe 2448 nhbbtn.exe 2440 pjjdp.exe 1420 ddvdj.exe 1524 lxrfllr.exe 1320 rllrflx.exe 2300 nnhntn.exe 2080 jjvjv.exe 2700 vpdpp.exe 2876 5rrxlxf.exe 1912 xrrflll.exe 1252 tnttbb.exe 540 1thhnt.exe 1736 jvjjp.exe 1816 vjjpp.exe -
resource yara_rule behavioral1/memory/2944-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2132-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1812-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1452-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1912-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/776-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/284-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1864-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-298-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1600-306-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2944 wrote to memory of 2120 2944 1c43acdffaceee861fc39ff61a659960_NeikiAnalytics.exe 28 PID 2944 wrote to memory of 2120 2944 1c43acdffaceee861fc39ff61a659960_NeikiAnalytics.exe 28 PID 2944 wrote to memory of 2120 2944 1c43acdffaceee861fc39ff61a659960_NeikiAnalytics.exe 28 PID 2944 wrote to memory of 2120 2944 1c43acdffaceee861fc39ff61a659960_NeikiAnalytics.exe 28 PID 2120 wrote to memory of 2132 2120 pjvdv.exe 29 PID 2120 wrote to memory of 2132 2120 pjvdv.exe 29 PID 2120 wrote to memory of 2132 2120 pjvdv.exe 29 PID 2120 wrote to memory of 2132 2120 pjvdv.exe 29 PID 2132 wrote to memory of 2660 2132 xffrxlf.exe 30 PID 2132 wrote to memory of 2660 2132 xffrxlf.exe 30 PID 2132 wrote to memory of 2660 2132 xffrxlf.exe 30 PID 2132 wrote to memory of 2660 2132 xffrxlf.exe 30 PID 2660 wrote to memory of 2800 2660 thtbhb.exe 31 PID 2660 wrote to memory of 2800 2660 thtbhb.exe 31 PID 2660 wrote to memory of 2800 2660 thtbhb.exe 31 PID 2660 wrote to memory of 2800 2660 thtbhb.exe 31 PID 2800 wrote to memory of 2744 2800 3vpdj.exe 32 PID 2800 wrote to memory of 2744 2800 3vpdj.exe 32 PID 2800 wrote to memory of 2744 2800 3vpdj.exe 32 PID 2800 wrote to memory of 2744 2800 3vpdj.exe 32 PID 2744 wrote to memory of 2824 2744 ttnbtb.exe 33 PID 2744 wrote to memory of 2824 2744 ttnbtb.exe 33 PID 2744 wrote to memory of 2824 2744 ttnbtb.exe 33 PID 2744 wrote to memory of 2824 2744 ttnbtb.exe 33 PID 2824 wrote to memory of 2524 2824 pjdpv.exe 34 PID 2824 wrote to memory of 2524 2824 pjdpv.exe 34 PID 2824 wrote to memory of 2524 2824 pjdpv.exe 34 PID 2824 wrote to memory of 2524 2824 pjdpv.exe 34 PID 2524 wrote to memory of 2640 2524 7llrflx.exe 35 PID 2524 wrote to memory of 2640 2524 7llrflx.exe 35 PID 2524 wrote to memory of 2640 2524 7llrflx.exe 35 PID 2524 wrote to memory of 2640 2524 7llrflx.exe 35 PID 2640 wrote to memory of 1652 2640 nhbhnt.exe 36 PID 2640 wrote to memory of 1652 2640 nhbhnt.exe 36 PID 2640 wrote to memory of 1652 2640 nhbhnt.exe 36 PID 2640 wrote to memory of 1652 2640 nhbhnt.exe 36 PID 1652 wrote to memory of 2780 1652 5jjdj.exe 37 PID 1652 wrote to memory of 2780 1652 5jjdj.exe 37 PID 1652 wrote to memory of 2780 1652 5jjdj.exe 37 PID 1652 wrote to memory of 2780 1652 5jjdj.exe 37 PID 2780 wrote to memory of 2564 2780 1rxxlfl.exe 38 PID 2780 wrote to memory of 2564 2780 1rxxlfl.exe 38 PID 2780 wrote to memory of 2564 2780 1rxxlfl.exe 38 PID 2780 wrote to memory of 2564 2780 1rxxlfl.exe 38 PID 2564 wrote to memory of 2328 2564 tththn.exe 39 PID 2564 wrote to memory of 2328 2564 tththn.exe 39 PID 2564 wrote to memory of 2328 2564 tththn.exe 39 PID 2564 wrote to memory of 2328 2564 tththn.exe 39 PID 2328 wrote to memory of 2452 2328 htntbb.exe 40 PID 2328 wrote to memory of 2452 2328 htntbb.exe 40 PID 2328 wrote to memory of 2452 2328 htntbb.exe 40 PID 2328 wrote to memory of 2452 2328 htntbb.exe 40 PID 2452 wrote to memory of 1812 2452 dppdp.exe 41 PID 2452 wrote to memory of 1812 2452 dppdp.exe 41 PID 2452 wrote to memory of 1812 2452 dppdp.exe 41 PID 2452 wrote to memory of 1812 2452 dppdp.exe 41 PID 1812 wrote to memory of 2416 1812 7rxrflx.exe 42 PID 1812 wrote to memory of 2416 1812 7rxrflx.exe 42 PID 1812 wrote to memory of 2416 1812 7rxrflx.exe 42 PID 1812 wrote to memory of 2416 1812 7rxrflx.exe 42 PID 2416 wrote to memory of 1452 2416 tnttbb.exe 43 PID 2416 wrote to memory of 1452 2416 tnttbb.exe 43 PID 2416 wrote to memory of 1452 2416 tnttbb.exe 43 PID 2416 wrote to memory of 1452 2416 tnttbb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c43acdffaceee861fc39ff61a659960_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1c43acdffaceee861fc39ff61a659960_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\pjvdv.exec:\pjvdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\xffrxlf.exec:\xffrxlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\thtbhb.exec:\thtbhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\3vpdj.exec:\3vpdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\ttnbtb.exec:\ttnbtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\pjdpv.exec:\pjdpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\7llrflx.exec:\7llrflx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\nhbhnt.exec:\nhbhnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\5jjdj.exec:\5jjdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\1rxxlfl.exec:\1rxxlfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\tththn.exec:\tththn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\htntbb.exec:\htntbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\dppdp.exec:\dppdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\7rxrflx.exec:\7rxrflx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\tnttbb.exec:\tnttbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\jdjvp.exec:\jdjvp.exe17⤵
- Executes dropped EXE
PID:1452 -
\??\c:\7flfrrx.exec:\7flfrrx.exe18⤵
- Executes dropped EXE
PID:1284 -
\??\c:\tbhbhn.exec:\tbhbhn.exe19⤵
- Executes dropped EXE
PID:1760 -
\??\c:\3tnbnb.exec:\3tnbnb.exe20⤵
- Executes dropped EXE
PID:1152 -
\??\c:\ddvdj.exec:\ddvdj.exe21⤵
- Executes dropped EXE
PID:1912 -
\??\c:\ffrfflf.exec:\ffrfflf.exe22⤵
- Executes dropped EXE
PID:2068 -
\??\c:\tttnnh.exec:\tttnnh.exe23⤵
- Executes dropped EXE
PID:776 -
\??\c:\ppjjp.exec:\ppjjp.exe24⤵
- Executes dropped EXE
PID:284 -
\??\c:\rlrxfrf.exec:\rlrxfrf.exe25⤵
- Executes dropped EXE
PID:572 -
\??\c:\9ttbnt.exec:\9ttbnt.exe26⤵
- Executes dropped EXE
PID:2492 -
\??\c:\bbtnbh.exec:\bbtnbh.exe27⤵
- Executes dropped EXE
PID:1864 -
\??\c:\djvjj.exec:\djvjj.exe28⤵
- Executes dropped EXE
PID:908 -
\??\c:\xxffflf.exec:\xxffflf.exe29⤵
- Executes dropped EXE
PID:2604 -
\??\c:\tnbhnn.exec:\tnbhnn.exe30⤵
- Executes dropped EXE
PID:2372 -
\??\c:\pppvj.exec:\pppvj.exe31⤵
- Executes dropped EXE
PID:2480 -
\??\c:\lfflflf.exec:\lfflflf.exe32⤵
- Executes dropped EXE
PID:1600 -
\??\c:\xfxrxrl.exec:\xfxrxrl.exe33⤵
- Executes dropped EXE
PID:2968 -
\??\c:\nbbnhh.exec:\nbbnhh.exe34⤵
- Executes dropped EXE
PID:1684 -
\??\c:\vjvdj.exec:\vjvdj.exe35⤵
- Executes dropped EXE
PID:3040 -
\??\c:\jdjpd.exec:\jdjpd.exe36⤵
- Executes dropped EXE
PID:2616 -
\??\c:\fxxrffr.exec:\fxxrffr.exe37⤵
- Executes dropped EXE
PID:2676 -
\??\c:\9xflxxr.exec:\9xflxxr.exe38⤵
- Executes dropped EXE
PID:2660 -
\??\c:\nbnthh.exec:\nbnthh.exe39⤵
- Executes dropped EXE
PID:2864 -
\??\c:\dvjdv.exec:\dvjdv.exe40⤵
- Executes dropped EXE
PID:2800 -
\??\c:\fflxrfx.exec:\fflxrfx.exe41⤵
- Executes dropped EXE
PID:2196 -
\??\c:\9lxlxfr.exec:\9lxlxfr.exe42⤵
- Executes dropped EXE
PID:2776 -
\??\c:\ttnhhn.exec:\ttnhhn.exe43⤵
- Executes dropped EXE
PID:2540 -
\??\c:\7tbbnh.exec:\7tbbnh.exe44⤵
- Executes dropped EXE
PID:2940 -
\??\c:\vddpv.exec:\vddpv.exe45⤵
- Executes dropped EXE
PID:2344 -
\??\c:\btbhtt.exec:\btbhtt.exe46⤵
- Executes dropped EXE
PID:1860 -
\??\c:\bthhhh.exec:\bthhhh.exe47⤵
- Executes dropped EXE
PID:2772 -
\??\c:\vpvdv.exec:\vpvdv.exe48⤵
- Executes dropped EXE
PID:2844 -
\??\c:\vpjjj.exec:\vpjjj.exe49⤵
- Executes dropped EXE
PID:2036 -
\??\c:\rlfrfrf.exec:\rlfrfrf.exe50⤵
- Executes dropped EXE
PID:2428 -
\??\c:\9ffllxr.exec:\9ffllxr.exe51⤵
- Executes dropped EXE
PID:1556 -
\??\c:\nhbbtn.exec:\nhbbtn.exe52⤵
- Executes dropped EXE
PID:2448 -
\??\c:\pjjdp.exec:\pjjdp.exe53⤵
- Executes dropped EXE
PID:2440 -
\??\c:\ddvdj.exec:\ddvdj.exe54⤵
- Executes dropped EXE
PID:1420 -
\??\c:\lxrfllr.exec:\lxrfllr.exe55⤵
- Executes dropped EXE
PID:1524 -
\??\c:\rllrflx.exec:\rllrflx.exe56⤵
- Executes dropped EXE
PID:1320 -
\??\c:\nnhntn.exec:\nnhntn.exe57⤵
- Executes dropped EXE
PID:2300 -
\??\c:\jjvjv.exec:\jjvjv.exe58⤵
- Executes dropped EXE
PID:2080 -
\??\c:\vpdpp.exec:\vpdpp.exe59⤵
- Executes dropped EXE
PID:2700 -
\??\c:\5rrxlxf.exec:\5rrxlxf.exe60⤵
- Executes dropped EXE
PID:2876 -
\??\c:\xrrflll.exec:\xrrflll.exe61⤵
- Executes dropped EXE
PID:1912 -
\??\c:\tnttbb.exec:\tnttbb.exe62⤵
- Executes dropped EXE
PID:1252 -
\??\c:\1thhnt.exec:\1thhnt.exe63⤵
- Executes dropped EXE
PID:540 -
\??\c:\jvjjp.exec:\jvjjp.exe64⤵
- Executes dropped EXE
PID:1736 -
\??\c:\vjjpp.exec:\vjjpp.exe65⤵
- Executes dropped EXE
PID:1816 -
\??\c:\3lfllll.exec:\3lfllll.exe66⤵PID:448
-
\??\c:\btnthn.exec:\btnthn.exe67⤵PID:1044
-
\??\c:\nhbhtb.exec:\nhbhtb.exe68⤵PID:892
-
\??\c:\vpdvv.exec:\vpdvv.exe69⤵PID:2996
-
\??\c:\fxrlxrr.exec:\fxrlxrr.exe70⤵PID:2084
-
\??\c:\1rffrrx.exec:\1rffrrx.exe71⤵PID:3056
-
\??\c:\3bhthb.exec:\3bhthb.exe72⤵PID:1828
-
\??\c:\1hhbnt.exec:\1hhbnt.exe73⤵PID:992
-
\??\c:\dvjpp.exec:\dvjpp.exe74⤵PID:3008
-
\??\c:\7lfrlxl.exec:\7lfrlxl.exe75⤵PID:1584
-
\??\c:\frrrxxl.exec:\frrrxxl.exe76⤵PID:3036
-
\??\c:\3hnnbh.exec:\3hnnbh.exe77⤵PID:1056
-
\??\c:\tnhnnt.exec:\tnhnnt.exe78⤵PID:2624
-
\??\c:\bbbhht.exec:\bbbhht.exe79⤵PID:2616
-
\??\c:\3vvjp.exec:\3vvjp.exe80⤵PID:2672
-
\??\c:\rlflrxx.exec:\rlflrxx.exe81⤵PID:2532
-
\??\c:\lxrxllf.exec:\lxrxllf.exe82⤵PID:2560
-
\??\c:\bbthbh.exec:\bbthbh.exe83⤵PID:2656
-
\??\c:\ttttnt.exec:\ttttnt.exe84⤵PID:2756
-
\??\c:\jjddv.exec:\jjddv.exe85⤵PID:2556
-
\??\c:\dpdvv.exec:\dpdvv.exe86⤵PID:2600
-
\??\c:\fxlxlrf.exec:\fxlxlrf.exe87⤵PID:1628
-
\??\c:\xxrllll.exec:\xxrllll.exe88⤵PID:1448
-
\??\c:\bbthnt.exec:\bbthnt.exe89⤵PID:2832
-
\??\c:\tnhbtt.exec:\tnhbtt.exe90⤵PID:2340
-
\??\c:\9jpdd.exec:\9jpdd.exe91⤵PID:3032
-
\??\c:\5vdvv.exec:\5vdvv.exe92⤵PID:348
-
\??\c:\rlfrlfr.exec:\rlfrlfr.exe93⤵PID:1616
-
\??\c:\xlxxxxf.exec:\xlxxxxf.exe94⤵PID:1980
-
\??\c:\bntntt.exec:\bntntt.exe95⤵PID:1812
-
\??\c:\hbthnh.exec:\hbthnh.exe96⤵PID:852
-
\??\c:\1bnntn.exec:\1bnntn.exe97⤵PID:2276
-
\??\c:\3vjdp.exec:\3vjdp.exe98⤵PID:1264
-
\??\c:\xlxfrfr.exec:\xlxfrfr.exe99⤵PID:2264
-
\??\c:\lflxffr.exec:\lflxffr.exe100⤵PID:2252
-
\??\c:\5hnbbb.exec:\5hnbbb.exe101⤵PID:1152
-
\??\c:\htthnn.exec:\htthnn.exe102⤵PID:2112
-
\??\c:\dvvpd.exec:\dvvpd.exe103⤵PID:784
-
\??\c:\jjdjv.exec:\jjdjv.exe104⤵PID:1260
-
\??\c:\ffxxfff.exec:\ffxxfff.exe105⤵PID:1484
-
\??\c:\frrrlff.exec:\frrrlff.exe106⤵PID:1780
-
\??\c:\nhtbnn.exec:\nhtbnn.exe107⤵PID:572
-
\??\c:\dvdjp.exec:\dvdjp.exe108⤵PID:956
-
\??\c:\pddvj.exec:\pddvj.exe109⤵PID:768
-
\??\c:\frflrrx.exec:\frflrrx.exe110⤵PID:692
-
\??\c:\9lllxff.exec:\9lllxff.exe111⤵PID:1992
-
\??\c:\htbnbn.exec:\htbnbn.exe112⤵PID:1656
-
\??\c:\9btntn.exec:\9btntn.exe113⤵PID:608
-
\??\c:\jdvdj.exec:\jdvdj.exe114⤵PID:2220
-
\??\c:\frlrxrf.exec:\frlrxrf.exe115⤵PID:1180
-
\??\c:\llrxlxl.exec:\llrxlxl.exe116⤵PID:2716
-
\??\c:\hthhtt.exec:\hthhtt.exe117⤵PID:2852
-
\??\c:\9btbbn.exec:\9btbbn.exe118⤵PID:3044
-
\??\c:\jdvjd.exec:\jdvjd.exe119⤵PID:2128
-
\??\c:\frlfllx.exec:\frlfllx.exe120⤵PID:2132
-
\??\c:\lfrrxff.exec:\lfrrxff.exe121⤵PID:2752
-
\??\c:\nbttbb.exec:\nbttbb.exe122⤵PID:2812
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-