Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28-05-2024 01:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2cc1b47cdbfd32db5694b2edb07ceb10_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
2cc1b47cdbfd32db5694b2edb07ceb10_NeikiAnalytics.exe
-
Size
56KB
-
MD5
2cc1b47cdbfd32db5694b2edb07ceb10
-
SHA1
4fb78a4047a4afbcf5ea04cc942d246f947308ed
-
SHA256
53ae40a5f5e64a10d74076f1cca0230657775f3a74cfd3d716f2dc48b8deec50
-
SHA512
d3c3ae309d2a596cc8c3a8f3aa2033451553a34fe512cbf4bbc02535ee3cf5c7767bb9089678ae8ef2a5a42d955b38544ec77793c3218722c8af312d9e27c62a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuSwFH:ymb3NkkiQ3mdBjFIvIFH
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral1/memory/620-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2052-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-49-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/304-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1580-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1568-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2184-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1356-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/532-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/976-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/904-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1668-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1112-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1660-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-2392-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2648 nthhtt.exe 2232 pjvjd.exe 2724 vjvpv.exe 2756 xxxrrxx.exe 2052 bthbnt.exe 2508 7bbhtt.exe 2492 djjdv.exe 2312 lxlrrfr.exe 304 nhthtn.exe 2768 ddvpd.exe 1580 xxrxxll.exe 1552 bthhnt.exe 1568 tbnnth.exe 2184 vpddp.exe 1356 pdpvj.exe 532 5xxxllx.exe 2156 xrllrxf.exe 2820 btnnbn.exe 2984 jdjpd.exe 976 ffflxlf.exe 2228 rxllffl.exe 2236 hbnbhn.exe 2824 nhhtnt.exe 2840 jpvvv.exe 904 dvpvj.exe 1284 flffxfr.exe 1668 tbtbbn.exe 1112 bthnht.exe 1944 jvjdj.exe 1660 llxxlrf.exe 2060 xrlrxxr.exe 2356 ttntht.exe 2284 ddvpd.exe 2588 pdjjd.exe 1728 fxflxfx.exe 1192 nhbnhn.exe 2468 bbtbtb.exe 1628 djpvj.exe 2816 jddjv.exe 2632 1xxlxlx.exe 2476 9lxrxff.exe 2536 1rlrxfx.exe 2956 hbnbbb.exe 1228 5bttnt.exe 2696 5pvvd.exe 2808 9dvdd.exe 2776 5xlxlrf.exe 1744 1frxlxf.exe 1576 bnnbhn.exe 2196 nnhthh.exe 1572 xxrffrf.exe 1408 fxlrxlr.exe 1452 1hbnbb.exe 476 tthtnn.exe 2168 jvpjj.exe 2024 jdjpv.exe 2844 xrlxflr.exe 2976 lfxfrxx.exe 2260 nbhnbn.exe 2444 3dpdp.exe 2084 vvvpd.exe 1736 fffrflr.exe 1740 xxxlxfl.exe 1772 nhttnb.exe -
resource yara_rule behavioral1/memory/620-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/304-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1580-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1568-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1356-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/532-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/976-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/904-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1668-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1112-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-2392-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 620 wrote to memory of 2648 620 2cc1b47cdbfd32db5694b2edb07ceb10_NeikiAnalytics.exe 28 PID 620 wrote to memory of 2648 620 2cc1b47cdbfd32db5694b2edb07ceb10_NeikiAnalytics.exe 28 PID 620 wrote to memory of 2648 620 2cc1b47cdbfd32db5694b2edb07ceb10_NeikiAnalytics.exe 28 PID 620 wrote to memory of 2648 620 2cc1b47cdbfd32db5694b2edb07ceb10_NeikiAnalytics.exe 28 PID 2648 wrote to memory of 2232 2648 nthhtt.exe 29 PID 2648 wrote to memory of 2232 2648 nthhtt.exe 29 PID 2648 wrote to memory of 2232 2648 nthhtt.exe 29 PID 2648 wrote to memory of 2232 2648 nthhtt.exe 29 PID 2232 wrote to memory of 2724 2232 pjvjd.exe 30 PID 2232 wrote to memory of 2724 2232 pjvjd.exe 30 PID 2232 wrote to memory of 2724 2232 pjvjd.exe 30 PID 2232 wrote to memory of 2724 2232 pjvjd.exe 30 PID 2724 wrote to memory of 2756 2724 vjvpv.exe 31 PID 2724 wrote to memory of 2756 2724 vjvpv.exe 31 PID 2724 wrote to memory of 2756 2724 vjvpv.exe 31 PID 2724 wrote to memory of 2756 2724 vjvpv.exe 31 PID 2756 wrote to memory of 2052 2756 xxxrrxx.exe 32 PID 2756 wrote to memory of 2052 2756 xxxrrxx.exe 32 PID 2756 wrote to memory of 2052 2756 xxxrrxx.exe 32 PID 2756 wrote to memory of 2052 2756 xxxrrxx.exe 32 PID 2052 wrote to memory of 2508 2052 bthbnt.exe 33 PID 2052 wrote to memory of 2508 2052 bthbnt.exe 33 PID 2052 wrote to memory of 2508 2052 bthbnt.exe 33 PID 2052 wrote to memory of 2508 2052 bthbnt.exe 33 PID 2508 wrote to memory of 2492 2508 7bbhtt.exe 34 PID 2508 wrote to memory of 2492 2508 7bbhtt.exe 34 PID 2508 wrote to memory of 2492 2508 7bbhtt.exe 34 PID 2508 wrote to memory of 2492 2508 7bbhtt.exe 34 PID 2492 wrote to memory of 2312 2492 djjdv.exe 35 PID 2492 wrote to memory of 2312 2492 djjdv.exe 35 PID 2492 wrote to memory of 2312 2492 djjdv.exe 35 PID 2492 wrote to memory of 2312 2492 djjdv.exe 35 PID 2312 wrote to memory of 304 2312 lxlrrfr.exe 36 PID 2312 wrote to memory of 304 2312 lxlrrfr.exe 36 PID 2312 wrote to memory of 304 2312 lxlrrfr.exe 36 PID 2312 wrote to memory of 304 2312 lxlrrfr.exe 36 PID 304 wrote to memory of 2768 304 nhthtn.exe 37 PID 304 wrote to memory of 2768 304 nhthtn.exe 37 PID 304 wrote to memory of 2768 304 nhthtn.exe 37 PID 304 wrote to memory of 2768 304 nhthtn.exe 37 PID 2768 wrote to memory of 1580 2768 ddvpd.exe 38 PID 2768 wrote to memory of 1580 2768 ddvpd.exe 38 PID 2768 wrote to memory of 1580 2768 ddvpd.exe 38 PID 2768 wrote to memory of 1580 2768 ddvpd.exe 38 PID 1580 wrote to memory of 1552 1580 xxrxxll.exe 39 PID 1580 wrote to memory of 1552 1580 xxrxxll.exe 39 PID 1580 wrote to memory of 1552 1580 xxrxxll.exe 39 PID 1580 wrote to memory of 1552 1580 xxrxxll.exe 39 PID 1552 wrote to memory of 1568 1552 bthhnt.exe 40 PID 1552 wrote to memory of 1568 1552 bthhnt.exe 40 PID 1552 wrote to memory of 1568 1552 bthhnt.exe 40 PID 1552 wrote to memory of 1568 1552 bthhnt.exe 40 PID 1568 wrote to memory of 2184 1568 tbnnth.exe 41 PID 1568 wrote to memory of 2184 1568 tbnnth.exe 41 PID 1568 wrote to memory of 2184 1568 tbnnth.exe 41 PID 1568 wrote to memory of 2184 1568 tbnnth.exe 41 PID 2184 wrote to memory of 1356 2184 vpddp.exe 42 PID 2184 wrote to memory of 1356 2184 vpddp.exe 42 PID 2184 wrote to memory of 1356 2184 vpddp.exe 42 PID 2184 wrote to memory of 1356 2184 vpddp.exe 42 PID 1356 wrote to memory of 532 1356 pdpvj.exe 43 PID 1356 wrote to memory of 532 1356 pdpvj.exe 43 PID 1356 wrote to memory of 532 1356 pdpvj.exe 43 PID 1356 wrote to memory of 532 1356 pdpvj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cc1b47cdbfd32db5694b2edb07ceb10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2cc1b47cdbfd32db5694b2edb07ceb10_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:620 -
\??\c:\nthhtt.exec:\nthhtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\pjvjd.exec:\pjvjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\vjvpv.exec:\vjvpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\xxxrrxx.exec:\xxxrrxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\bthbnt.exec:\bthbnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\7bbhtt.exec:\7bbhtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\djjdv.exec:\djjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\lxlrrfr.exec:\lxlrrfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\nhthtn.exec:\nhthtn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:304 -
\??\c:\ddvpd.exec:\ddvpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\xxrxxll.exec:\xxrxxll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\bthhnt.exec:\bthhnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\tbnnth.exec:\tbnnth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\vpddp.exec:\vpddp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\pdpvj.exec:\pdpvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\5xxxllx.exec:\5xxxllx.exe17⤵
- Executes dropped EXE
PID:532 -
\??\c:\xrllrxf.exec:\xrllrxf.exe18⤵
- Executes dropped EXE
PID:2156 -
\??\c:\btnnbn.exec:\btnnbn.exe19⤵
- Executes dropped EXE
PID:2820 -
\??\c:\jdjpd.exec:\jdjpd.exe20⤵
- Executes dropped EXE
PID:2984 -
\??\c:\ffflxlf.exec:\ffflxlf.exe21⤵
- Executes dropped EXE
PID:976 -
\??\c:\rxllffl.exec:\rxllffl.exe22⤵
- Executes dropped EXE
PID:2228 -
\??\c:\hbnbhn.exec:\hbnbhn.exe23⤵
- Executes dropped EXE
PID:2236 -
\??\c:\nhhtnt.exec:\nhhtnt.exe24⤵
- Executes dropped EXE
PID:2824 -
\??\c:\jpvvv.exec:\jpvvv.exe25⤵
- Executes dropped EXE
PID:2840 -
\??\c:\dvpvj.exec:\dvpvj.exe26⤵
- Executes dropped EXE
PID:904 -
\??\c:\flffxfr.exec:\flffxfr.exe27⤵
- Executes dropped EXE
PID:1284 -
\??\c:\tbtbbn.exec:\tbtbbn.exe28⤵
- Executes dropped EXE
PID:1668 -
\??\c:\bthnht.exec:\bthnht.exe29⤵
- Executes dropped EXE
PID:1112 -
\??\c:\jvjdj.exec:\jvjdj.exe30⤵
- Executes dropped EXE
PID:1944 -
\??\c:\llxxlrf.exec:\llxxlrf.exe31⤵
- Executes dropped EXE
PID:1660 -
\??\c:\xrlrxxr.exec:\xrlrxxr.exe32⤵
- Executes dropped EXE
PID:2060 -
\??\c:\ttntht.exec:\ttntht.exe33⤵
- Executes dropped EXE
PID:2356 -
\??\c:\ddvpd.exec:\ddvpd.exe34⤵
- Executes dropped EXE
PID:2284 -
\??\c:\pdjjd.exec:\pdjjd.exe35⤵
- Executes dropped EXE
PID:2588 -
\??\c:\fxflxfx.exec:\fxflxfx.exe36⤵
- Executes dropped EXE
PID:1728 -
\??\c:\xrxrxfr.exec:\xrxrxfr.exe37⤵PID:2732
-
\??\c:\nhbnhn.exec:\nhbnhn.exe38⤵
- Executes dropped EXE
PID:1192 -
\??\c:\bbtbtb.exec:\bbtbtb.exe39⤵
- Executes dropped EXE
PID:2468 -
\??\c:\djpvj.exec:\djpvj.exe40⤵
- Executes dropped EXE
PID:1628 -
\??\c:\jddjv.exec:\jddjv.exe41⤵
- Executes dropped EXE
PID:2816 -
\??\c:\1xxlxlx.exec:\1xxlxlx.exe42⤵
- Executes dropped EXE
PID:2632 -
\??\c:\9lxrxff.exec:\9lxrxff.exe43⤵
- Executes dropped EXE
PID:2476 -
\??\c:\1rlrxfx.exec:\1rlrxfx.exe44⤵
- Executes dropped EXE
PID:2536 -
\??\c:\hbnbbb.exec:\hbnbbb.exe45⤵
- Executes dropped EXE
PID:2956 -
\??\c:\5bttnt.exec:\5bttnt.exe46⤵
- Executes dropped EXE
PID:1228 -
\??\c:\5pvvd.exec:\5pvvd.exe47⤵
- Executes dropped EXE
PID:2696 -
\??\c:\9dvdd.exec:\9dvdd.exe48⤵
- Executes dropped EXE
PID:2808 -
\??\c:\5xlxlrf.exec:\5xlxlrf.exe49⤵
- Executes dropped EXE
PID:2776 -
\??\c:\1frxlxf.exec:\1frxlxf.exe50⤵
- Executes dropped EXE
PID:1744 -
\??\c:\bnnbhn.exec:\bnnbhn.exe51⤵
- Executes dropped EXE
PID:1576 -
\??\c:\nnhthh.exec:\nnhthh.exe52⤵
- Executes dropped EXE
PID:2196 -
\??\c:\xxrffrf.exec:\xxrffrf.exe53⤵
- Executes dropped EXE
PID:1572 -
\??\c:\fxlrxlr.exec:\fxlrxlr.exe54⤵
- Executes dropped EXE
PID:1408 -
\??\c:\1hbnbb.exec:\1hbnbb.exe55⤵
- Executes dropped EXE
PID:1452 -
\??\c:\tthtnn.exec:\tthtnn.exe56⤵
- Executes dropped EXE
PID:476 -
\??\c:\jvpjj.exec:\jvpjj.exe57⤵
- Executes dropped EXE
PID:2168 -
\??\c:\jdjpv.exec:\jdjpv.exe58⤵
- Executes dropped EXE
PID:2024 -
\??\c:\xrlxflr.exec:\xrlxflr.exe59⤵
- Executes dropped EXE
PID:2844 -
\??\c:\lfxfrxx.exec:\lfxfrxx.exe60⤵
- Executes dropped EXE
PID:2976 -
\??\c:\nbhnbn.exec:\nbhnbn.exe61⤵
- Executes dropped EXE
PID:2260 -
\??\c:\3dpdp.exec:\3dpdp.exe62⤵
- Executes dropped EXE
PID:2444 -
\??\c:\vvvpd.exec:\vvvpd.exe63⤵
- Executes dropped EXE
PID:2084 -
\??\c:\fffrflr.exec:\fffrflr.exe64⤵
- Executes dropped EXE
PID:1736 -
\??\c:\xxxlxfl.exec:\xxxlxfl.exe65⤵
- Executes dropped EXE
PID:1740 -
\??\c:\nhttnb.exec:\nhttnb.exe66⤵
- Executes dropped EXE
PID:1772 -
\??\c:\btnbnb.exec:\btnbnb.exe67⤵PID:1948
-
\??\c:\7pdjp.exec:\7pdjp.exe68⤵PID:1780
-
\??\c:\jvjpd.exec:\jvjpd.exe69⤵PID:800
-
\??\c:\3lfrxrf.exec:\3lfrxrf.exe70⤵PID:2080
-
\??\c:\fxlxlrx.exec:\fxlxlrx.exe71⤵PID:1468
-
\??\c:\xrxlflr.exec:\xrxlflr.exe72⤵PID:1844
-
\??\c:\nnbbtt.exec:\nnbbtt.exe73⤵PID:3012
-
\??\c:\5vpjj.exec:\5vpjj.exe74⤵PID:2320
-
\??\c:\dvvpv.exec:\dvvpv.exe75⤵PID:396
-
\??\c:\xlxfrrf.exec:\xlxfrrf.exe76⤵PID:1692
-
\??\c:\xxxfxfl.exec:\xxxfxfl.exe77⤵PID:2152
-
\??\c:\3rxflxx.exec:\3rxflxx.exe78⤵PID:2676
-
\??\c:\1bbthh.exec:\1bbthh.exe79⤵PID:3056
-
\??\c:\5nbhtb.exec:\5nbhtb.exe80⤵PID:2876
-
\??\c:\5jpvd.exec:\5jpvd.exe81⤵PID:2688
-
\??\c:\lfrxrfl.exec:\lfrxrfl.exe82⤵PID:2468
-
\??\c:\frflrrf.exec:\frflrrf.exe83⤵PID:2684
-
\??\c:\nhhthh.exec:\nhhthh.exe84⤵PID:1632
-
\??\c:\nnnbht.exec:\nnnbht.exe85⤵PID:2632
-
\??\c:\vppdd.exec:\vppdd.exe86⤵PID:2532
-
\??\c:\vpvjd.exec:\vpvjd.exe87⤵PID:1140
-
\??\c:\7lxxflr.exec:\7lxxflr.exe88⤵PID:752
-
\??\c:\lflxlrx.exec:\lflxlrx.exe89⤵PID:1204
-
\??\c:\bbbnbh.exec:\bbbnbh.exe90⤵PID:2696
-
\??\c:\1nhnbb.exec:\1nhnbb.exe91⤵PID:2796
-
\??\c:\djpjj.exec:\djpjj.exe92⤵PID:2776
-
\??\c:\1dddd.exec:\1dddd.exe93⤵PID:1744
-
\??\c:\xllrrxl.exec:\xllrrxl.exe94⤵PID:1576
-
\??\c:\9xxlffl.exec:\9xxlffl.exe95⤵PID:2360
-
\??\c:\hthtbt.exec:\hthtbt.exe96⤵PID:1572
-
\??\c:\9dvvj.exec:\9dvvj.exe97⤵PID:1656
-
\??\c:\pjdjv.exec:\pjdjv.exe98⤵PID:1452
-
\??\c:\lfflrxf.exec:\lfflrxf.exe99⤵PID:1032
-
\??\c:\fxrxlrl.exec:\fxrxlrl.exe100⤵PID:2168
-
\??\c:\tnbbnt.exec:\tnbbnt.exe101⤵PID:2012
-
\??\c:\nhtbbn.exec:\nhtbbn.exe102⤵PID:2844
-
\??\c:\1btbhh.exec:\1btbhh.exe103⤵PID:1404
-
\??\c:\9jdvv.exec:\9jdvv.exe104⤵PID:2260
-
\??\c:\pddpv.exec:\pddpv.exe105⤵PID:2892
-
\??\c:\xxrflrx.exec:\xxrflrx.exe106⤵PID:824
-
\??\c:\5fllffl.exec:\5fllffl.exe107⤵PID:2880
-
\??\c:\9bhnhn.exec:\9bhnhn.exe108⤵PID:1740
-
\??\c:\nnbbhn.exec:\nnbbhn.exe109⤵PID:2840
-
\??\c:\dddvv.exec:\dddvv.exe110⤵PID:1948
-
\??\c:\ppppp.exec:\ppppp.exe111⤵PID:340
-
\??\c:\lfxxflr.exec:\lfxxflr.exe112⤵PID:800
-
\??\c:\7rlrffr.exec:\7rlrffr.exe113⤵PID:1664
-
\??\c:\tntnbn.exec:\tntnbn.exe114⤵PID:1468
-
\??\c:\tttbbn.exec:\tttbbn.exe115⤵PID:1624
-
\??\c:\1vjpd.exec:\1vjpd.exe116⤵PID:3012
-
\??\c:\dvpjj.exec:\dvpjj.exe117⤵PID:1988
-
\??\c:\ffffxfr.exec:\ffffxfr.exe118⤵PID:396
-
\??\c:\lrfxxrr.exec:\lrfxxrr.exe119⤵PID:2436
-
\??\c:\nnntnn.exec:\nnntnn.exe120⤵PID:2152
-
\??\c:\bthtnn.exec:\bthtnn.exe121⤵PID:2736
-
\??\c:\vpvvj.exec:\vpvvj.exe122⤵PID:3056
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-