Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
31-05-2024 00:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6e59366cbf414d2f36b1c406de666110_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
6e59366cbf414d2f36b1c406de666110_NeikiAnalytics.exe
-
Size
55KB
-
MD5
6e59366cbf414d2f36b1c406de666110
-
SHA1
fa4d33307c702ba6e3ae81d0fc62fc1d6d857b60
-
SHA256
2dcbd3b8e67df09445a5c4149d249517abe460116654826fc57cb3cc74970c1b
-
SHA512
3dffd5182850e60bf92753116dbd0da7144b1fb3df04305797eae64cd175527c23909779d0fe54a1d6c42493e41e6656fc00761bcc08d2934473641e17274317
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIfEVB:ymb3NkkiQ3mdBjFIe
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/308-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/308-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2356-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2356-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1452-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2508-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1212-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1940-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2244-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/348-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2304-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1484-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2376-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/892-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1724-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2616 1dddd.exe 2356 ffflrlf.exe 1452 jdpvj.exe 2736 rfrxrfr.exe 2636 ttthnt.exe 2692 dvppd.exe 2456 xlrxxlf.exe 2576 bbbhbn.exe 2412 jjpjj.exe 2508 5fxfrfl.exe 2756 btnntt.exe 1212 jjdjp.exe 1940 1rfxlxl.exe 1740 5xxrrrf.exe 2244 thbbtb.exe 348 jjvvv.exe 1620 lfrfxrx.exe 1700 tbhbhb.exe 2312 dvvjj.exe 2320 rrflxxx.exe 2304 flxlxlr.exe 648 tnthtb.exe 1484 dvjvd.exe 2940 vppdd.exe 448 llxxlrf.exe 2376 ntbbhb.exe 892 9httht.exe 1388 5vpdd.exe 372 5lflxlf.exe 1724 hbbnhn.exe 884 jjpvj.exe 2024 ffxffrr.exe 2612 btnhhb.exe 1704 nbbhtb.exe 1992 jjvjj.exe 3040 pjpvv.exe 2660 fxfllrf.exe 1452 xrflrxf.exe 2788 hthnhn.exe 2004 nnhnbb.exe 2884 ddjpd.exe 2696 jdpjv.exe 2536 7lrxrfx.exe 2456 3rlrxxf.exe 2580 1tnhnh.exe 1432 1ddvj.exe 1664 fllflrr.exe 1672 1rlrffr.exe 2824 9hbnth.exe 1928 nhbhnt.exe 1228 7vvpv.exe 828 llfrlff.exe 2952 llllxll.exe 2244 9nbnhn.exe 1600 pdjpp.exe 2348 dpjpv.exe 2628 flrxffl.exe 2104 tttbhb.exe 1916 nnnbht.exe 1912 djjvp.exe 772 3pdpj.exe 2116 frrlfxr.exe 648 xxfrflx.exe 2184 7nbbnn.exe -
resource yara_rule behavioral1/memory/308-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1452-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1212-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1940-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2244-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/348-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1484-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/892-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1724-296-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 308 wrote to memory of 2616 308 6e59366cbf414d2f36b1c406de666110_NeikiAnalytics.exe 28 PID 308 wrote to memory of 2616 308 6e59366cbf414d2f36b1c406de666110_NeikiAnalytics.exe 28 PID 308 wrote to memory of 2616 308 6e59366cbf414d2f36b1c406de666110_NeikiAnalytics.exe 28 PID 308 wrote to memory of 2616 308 6e59366cbf414d2f36b1c406de666110_NeikiAnalytics.exe 28 PID 2616 wrote to memory of 2356 2616 1dddd.exe 29 PID 2616 wrote to memory of 2356 2616 1dddd.exe 29 PID 2616 wrote to memory of 2356 2616 1dddd.exe 29 PID 2616 wrote to memory of 2356 2616 1dddd.exe 29 PID 2356 wrote to memory of 1452 2356 ffflrlf.exe 30 PID 2356 wrote to memory of 1452 2356 ffflrlf.exe 30 PID 2356 wrote to memory of 1452 2356 ffflrlf.exe 30 PID 2356 wrote to memory of 1452 2356 ffflrlf.exe 30 PID 1452 wrote to memory of 2736 1452 jdpvj.exe 31 PID 1452 wrote to memory of 2736 1452 jdpvj.exe 31 PID 1452 wrote to memory of 2736 1452 jdpvj.exe 31 PID 1452 wrote to memory of 2736 1452 jdpvj.exe 31 PID 2736 wrote to memory of 2636 2736 rfrxrfr.exe 32 PID 2736 wrote to memory of 2636 2736 rfrxrfr.exe 32 PID 2736 wrote to memory of 2636 2736 rfrxrfr.exe 32 PID 2736 wrote to memory of 2636 2736 rfrxrfr.exe 32 PID 2636 wrote to memory of 2692 2636 ttthnt.exe 33 PID 2636 wrote to memory of 2692 2636 ttthnt.exe 33 PID 2636 wrote to memory of 2692 2636 ttthnt.exe 33 PID 2636 wrote to memory of 2692 2636 ttthnt.exe 33 PID 2692 wrote to memory of 2456 2692 dvppd.exe 34 PID 2692 wrote to memory of 2456 2692 dvppd.exe 34 PID 2692 wrote to memory of 2456 2692 dvppd.exe 34 PID 2692 wrote to memory of 2456 2692 dvppd.exe 34 PID 2456 wrote to memory of 2576 2456 xlrxxlf.exe 35 PID 2456 wrote to memory of 2576 2456 xlrxxlf.exe 35 PID 2456 wrote to memory of 2576 2456 xlrxxlf.exe 35 PID 2456 wrote to memory of 2576 2456 xlrxxlf.exe 35 PID 2576 wrote to memory of 2412 2576 bbbhbn.exe 36 PID 2576 wrote to memory of 2412 2576 bbbhbn.exe 36 PID 2576 wrote to memory of 2412 2576 bbbhbn.exe 36 PID 2576 wrote to memory of 2412 2576 bbbhbn.exe 36 PID 2412 wrote to memory of 2508 2412 jjpjj.exe 37 PID 2412 wrote to memory of 2508 2412 jjpjj.exe 37 PID 2412 wrote to memory of 2508 2412 jjpjj.exe 37 PID 2412 wrote to memory of 2508 2412 jjpjj.exe 37 PID 2508 wrote to memory of 2756 2508 5fxfrfl.exe 38 PID 2508 wrote to memory of 2756 2508 5fxfrfl.exe 38 PID 2508 wrote to memory of 2756 2508 5fxfrfl.exe 38 PID 2508 wrote to memory of 2756 2508 5fxfrfl.exe 38 PID 2756 wrote to memory of 1212 2756 btnntt.exe 39 PID 2756 wrote to memory of 1212 2756 btnntt.exe 39 PID 2756 wrote to memory of 1212 2756 btnntt.exe 39 PID 2756 wrote to memory of 1212 2756 btnntt.exe 39 PID 1212 wrote to memory of 1940 1212 jjdjp.exe 40 PID 1212 wrote to memory of 1940 1212 jjdjp.exe 40 PID 1212 wrote to memory of 1940 1212 jjdjp.exe 40 PID 1212 wrote to memory of 1940 1212 jjdjp.exe 40 PID 1940 wrote to memory of 1740 1940 1rfxlxl.exe 41 PID 1940 wrote to memory of 1740 1940 1rfxlxl.exe 41 PID 1940 wrote to memory of 1740 1940 1rfxlxl.exe 41 PID 1940 wrote to memory of 1740 1940 1rfxlxl.exe 41 PID 1740 wrote to memory of 2244 1740 5xxrrrf.exe 42 PID 1740 wrote to memory of 2244 1740 5xxrrrf.exe 42 PID 1740 wrote to memory of 2244 1740 5xxrrrf.exe 42 PID 1740 wrote to memory of 2244 1740 5xxrrrf.exe 42 PID 2244 wrote to memory of 348 2244 thbbtb.exe 43 PID 2244 wrote to memory of 348 2244 thbbtb.exe 43 PID 2244 wrote to memory of 348 2244 thbbtb.exe 43 PID 2244 wrote to memory of 348 2244 thbbtb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e59366cbf414d2f36b1c406de666110_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6e59366cbf414d2f36b1c406de666110_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:308 -
\??\c:\1dddd.exec:\1dddd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\ffflrlf.exec:\ffflrlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\jdpvj.exec:\jdpvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\rfrxrfr.exec:\rfrxrfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\ttthnt.exec:\ttthnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\dvppd.exec:\dvppd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\xlrxxlf.exec:\xlrxxlf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\bbbhbn.exec:\bbbhbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\jjpjj.exec:\jjpjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\5fxfrfl.exec:\5fxfrfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\btnntt.exec:\btnntt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\jjdjp.exec:\jjdjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\1rfxlxl.exec:\1rfxlxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\5xxrrrf.exec:\5xxrrrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\thbbtb.exec:\thbbtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\jjvvv.exec:\jjvvv.exe17⤵
- Executes dropped EXE
PID:348 -
\??\c:\lfrfxrx.exec:\lfrfxrx.exe18⤵
- Executes dropped EXE
PID:1620 -
\??\c:\tbhbhb.exec:\tbhbhb.exe19⤵
- Executes dropped EXE
PID:1700 -
\??\c:\dvvjj.exec:\dvvjj.exe20⤵
- Executes dropped EXE
PID:2312 -
\??\c:\rrflxxx.exec:\rrflxxx.exe21⤵
- Executes dropped EXE
PID:2320 -
\??\c:\flxlxlr.exec:\flxlxlr.exe22⤵
- Executes dropped EXE
PID:2304 -
\??\c:\tnthtb.exec:\tnthtb.exe23⤵
- Executes dropped EXE
PID:648 -
\??\c:\dvjvd.exec:\dvjvd.exe24⤵
- Executes dropped EXE
PID:1484 -
\??\c:\vppdd.exec:\vppdd.exe25⤵
- Executes dropped EXE
PID:2940 -
\??\c:\llxxlrf.exec:\llxxlrf.exe26⤵
- Executes dropped EXE
PID:448 -
\??\c:\ntbbhb.exec:\ntbbhb.exe27⤵
- Executes dropped EXE
PID:2376 -
\??\c:\9httht.exec:\9httht.exe28⤵
- Executes dropped EXE
PID:892 -
\??\c:\5vpdd.exec:\5vpdd.exe29⤵
- Executes dropped EXE
PID:1388 -
\??\c:\5lflxlf.exec:\5lflxlf.exe30⤵
- Executes dropped EXE
PID:372 -
\??\c:\hbbnhn.exec:\hbbnhn.exe31⤵
- Executes dropped EXE
PID:1724 -
\??\c:\jjpvj.exec:\jjpvj.exe32⤵
- Executes dropped EXE
PID:884 -
\??\c:\ffxffrr.exec:\ffxffrr.exe33⤵
- Executes dropped EXE
PID:2024 -
\??\c:\btnhhb.exec:\btnhhb.exe34⤵
- Executes dropped EXE
PID:2612 -
\??\c:\nbbhtb.exec:\nbbhtb.exe35⤵
- Executes dropped EXE
PID:1704 -
\??\c:\jjvjj.exec:\jjvjj.exe36⤵
- Executes dropped EXE
PID:1992 -
\??\c:\pjpvv.exec:\pjpvv.exe37⤵
- Executes dropped EXE
PID:3040 -
\??\c:\fxfllrf.exec:\fxfllrf.exe38⤵
- Executes dropped EXE
PID:2660 -
\??\c:\xrflrxf.exec:\xrflrxf.exe39⤵
- Executes dropped EXE
PID:1452 -
\??\c:\hthnhn.exec:\hthnhn.exe40⤵
- Executes dropped EXE
PID:2788 -
\??\c:\nnhnbb.exec:\nnhnbb.exe41⤵
- Executes dropped EXE
PID:2004 -
\??\c:\ddjpd.exec:\ddjpd.exe42⤵
- Executes dropped EXE
PID:2884 -
\??\c:\jdpjv.exec:\jdpjv.exe43⤵
- Executes dropped EXE
PID:2696 -
\??\c:\7lrxrfx.exec:\7lrxrfx.exe44⤵
- Executes dropped EXE
PID:2536 -
\??\c:\3rlrxxf.exec:\3rlrxxf.exe45⤵
- Executes dropped EXE
PID:2456 -
\??\c:\1tnhnh.exec:\1tnhnh.exe46⤵
- Executes dropped EXE
PID:2580 -
\??\c:\1ddvj.exec:\1ddvj.exe47⤵
- Executes dropped EXE
PID:1432 -
\??\c:\fllflrr.exec:\fllflrr.exe48⤵
- Executes dropped EXE
PID:1664 -
\??\c:\1rlrffr.exec:\1rlrffr.exe49⤵
- Executes dropped EXE
PID:1672 -
\??\c:\9hbnth.exec:\9hbnth.exe50⤵
- Executes dropped EXE
PID:2824 -
\??\c:\nhbhnt.exec:\nhbhnt.exe51⤵
- Executes dropped EXE
PID:1928 -
\??\c:\7vvpv.exec:\7vvpv.exe52⤵
- Executes dropped EXE
PID:1228 -
\??\c:\llfrlff.exec:\llfrlff.exe53⤵
- Executes dropped EXE
PID:828 -
\??\c:\llllxll.exec:\llllxll.exe54⤵
- Executes dropped EXE
PID:2952 -
\??\c:\9nbnhn.exec:\9nbnhn.exe55⤵
- Executes dropped EXE
PID:2244 -
\??\c:\pdjpp.exec:\pdjpp.exe56⤵
- Executes dropped EXE
PID:1600 -
\??\c:\dpjpv.exec:\dpjpv.exe57⤵
- Executes dropped EXE
PID:2348 -
\??\c:\flrxffl.exec:\flrxffl.exe58⤵
- Executes dropped EXE
PID:2628 -
\??\c:\tttbhb.exec:\tttbhb.exe59⤵
- Executes dropped EXE
PID:2104 -
\??\c:\nnnbht.exec:\nnnbht.exe60⤵
- Executes dropped EXE
PID:1916 -
\??\c:\djjvp.exec:\djjvp.exe61⤵
- Executes dropped EXE
PID:1912 -
\??\c:\3pdpj.exec:\3pdpj.exe62⤵
- Executes dropped EXE
PID:772 -
\??\c:\frrlfxr.exec:\frrlfxr.exe63⤵
- Executes dropped EXE
PID:2116 -
\??\c:\xxfrflx.exec:\xxfrflx.exe64⤵
- Executes dropped EXE
PID:648 -
\??\c:\7nbbnn.exec:\7nbbnn.exe65⤵
- Executes dropped EXE
PID:2184 -
\??\c:\3bthhh.exec:\3bthhh.exe66⤵PID:3020
-
\??\c:\vpvvd.exec:\vpvvd.exe67⤵PID:1644
-
\??\c:\7lfrflf.exec:\7lfrflf.exe68⤵PID:1168
-
\??\c:\lxrlfxl.exec:\lxrlfxl.exe69⤵PID:2080
-
\??\c:\nntbbt.exec:\nntbbt.exe70⤵PID:1372
-
\??\c:\ddvjv.exec:\ddvjv.exe71⤵PID:2196
-
\??\c:\5jjjj.exec:\5jjjj.exe72⤵PID:2892
-
\??\c:\xlrrlxx.exec:\xlrrlxx.exe73⤵PID:1768
-
\??\c:\llflrrl.exec:\llflrrl.exe74⤵PID:2384
-
\??\c:\nbthtb.exec:\nbthtb.exe75⤵PID:308
-
\??\c:\ppvdv.exec:\ppvdv.exe76⤵PID:2024
-
\??\c:\pppvp.exec:\pppvp.exe77⤵PID:2364
-
\??\c:\lxrffrl.exec:\lxrffrl.exe78⤵PID:1704
-
\??\c:\frllfrf.exec:\frllfrf.exe79⤵PID:1708
-
\??\c:\hbttnn.exec:\hbttnn.exe80⤵PID:3040
-
\??\c:\tntnnb.exec:\tntnnb.exe81⤵PID:2764
-
\??\c:\3jvjv.exec:\3jvjv.exe82⤵PID:2796
-
\??\c:\fxrxllf.exec:\fxrxllf.exe83⤵PID:3044
-
\??\c:\fxlrflx.exec:\fxlrflx.exe84⤵PID:2880
-
\??\c:\ttntbb.exec:\ttntbb.exe85⤵PID:2884
-
\??\c:\jjdvp.exec:\jjdvp.exe86⤵PID:2696
-
\??\c:\jjjpv.exec:\jjjpv.exe87⤵PID:2968
-
\??\c:\frllffr.exec:\frllffr.exe88⤵PID:2456
-
\??\c:\7rffxxx.exec:\7rffxxx.exe89⤵PID:2580
-
\??\c:\hbtbtt.exec:\hbtbtt.exe90⤵PID:1432
-
\??\c:\ddvpv.exec:\ddvpv.exe91⤵PID:1040
-
\??\c:\9djvp.exec:\9djvp.exe92⤵PID:1672
-
\??\c:\ffxxrlx.exec:\ffxxrlx.exe93⤵PID:2824
-
\??\c:\rrlflxf.exec:\rrlflxf.exe94⤵PID:2192
-
\??\c:\thntbh.exec:\thntbh.exe95⤵PID:1228
-
\??\c:\nbtntn.exec:\nbtntn.exe96⤵PID:828
-
\??\c:\vjppd.exec:\vjppd.exe97⤵PID:2952
-
\??\c:\pvjpv.exec:\pvjpv.exe98⤵PID:2244
-
\??\c:\ffxrrfl.exec:\ffxrrfl.exe99⤵PID:1164
-
\??\c:\fxrxrxx.exec:\fxrxrxx.exe100⤵PID:2348
-
\??\c:\btnnbh.exec:\btnnbh.exe101⤵PID:2628
-
\??\c:\nhnntt.exec:\nhnntt.exe102⤵PID:2120
-
\??\c:\5dvdv.exec:\5dvdv.exe103⤵PID:2092
-
\??\c:\fffxlrf.exec:\fffxlrf.exe104⤵PID:2320
-
\??\c:\5xrrxff.exec:\5xrrxff.exe105⤵PID:1496
-
\??\c:\ntnnnn.exec:\ntnnnn.exe106⤵PID:2116
-
\??\c:\vvvdp.exec:\vvvdp.exe107⤵PID:904
-
\??\c:\vvdvj.exec:\vvdvj.exe108⤵PID:2184
-
\??\c:\9rfrxrr.exec:\9rfrxrr.exe109⤵PID:3020
-
\??\c:\rffxfrx.exec:\rffxfrx.exe110⤵PID:1644
-
\??\c:\ntbbbt.exec:\ntbbbt.exe111⤵PID:2000
-
\??\c:\7vpvd.exec:\7vpvd.exe112⤵PID:2080
-
\??\c:\jdppv.exec:\jdppv.exe113⤵PID:1388
-
\??\c:\fxrrxxl.exec:\fxrrxxl.exe114⤵PID:2936
-
\??\c:\9fxfrlf.exec:\9fxfrlf.exe115⤵PID:2892
-
\??\c:\tthbbt.exec:\tthbbt.exe116⤵PID:1768
-
\??\c:\tnhhhb.exec:\tnhhhb.exe117⤵PID:2140
-
\??\c:\dpjjp.exec:\dpjjp.exe118⤵PID:2144
-
\??\c:\3ffxfff.exec:\3ffxfff.exe119⤵PID:3048
-
\??\c:\xxlrrxr.exec:\xxlrrxr.exe120⤵PID:2392
-
\??\c:\tbhnnt.exec:\tbhnnt.exe121⤵PID:2036
-
\??\c:\vdpjp.exec:\vdpjp.exe122⤵PID:2732
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-