Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
02-06-2024 01:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1be7273c7fbab4c570bef17218151d60_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
1be7273c7fbab4c570bef17218151d60_NeikiAnalytics.exe
-
Size
57KB
-
MD5
1be7273c7fbab4c570bef17218151d60
-
SHA1
bb232c294015701e576aa3d3a2052d345be62040
-
SHA256
5f9d638fe63a8d9b14f183e8a2a8c97e788e427a52f52d879fdc8f1e64a4b3c9
-
SHA512
f5efdaba92ceac4da85baf14ff6129bb0786b50379b4a9a624067db304b2c4c2e35949d6e2e99994a8f567ff7e7c008d516a8400d757ad34f982c39a3b6c877b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuSwFNr:ymb3NkkiQ3mdBjFIvIFNr
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2176-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1524-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1516-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1680-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2936-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2116-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/768-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1692-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1900-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/888-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2960 hbhbhh.exe 2016 9pdpd.exe 2648 bnhntt.exe 2672 vpjjp.exe 2680 xxrfrxl.exe 2876 nbtthn.exe 1524 ttnthn.exe 2640 vvjjd.exe 3044 bthtbb.exe 2856 nnbtnn.exe 2976 vvjdv.exe 1516 lrlxflf.exe 1040 nnbnbh.exe 652 1btnbb.exe 2172 ppjpd.exe 2852 xxllxxx.exe 1680 rlfrxxl.exe 1296 nhhntb.exe 1184 pjdpv.exe 2924 lxfflff.exe 2936 7xrflrx.exe 556 nbtbnn.exe 584 bnbtbn.exe 2116 dpddj.exe 2308 rrffffl.exe 768 xxxlfrl.exe 1424 7bttht.exe 2324 dvppp.exe 1692 9lfxlfl.exe 1900 5fxxfff.exe 888 tnttnt.exe 1292 thbnhh.exe 1588 dpdvd.exe 2972 xrfllxl.exe 2136 xlrrxxx.exe 2132 thbhnh.exe 2768 pdjdp.exe 2908 xlrlllr.exe 2636 xrlrllr.exe 2812 tnttbb.exe 2684 7htbhh.exe 3068 1jdvv.exe 2588 dpdjj.exe 2564 3xrlxxf.exe 1276 frrxxxx.exe 2208 nhtbnh.exe 3024 1tbttn.exe 3020 dpjjp.exe 1520 vpddp.exe 2316 xrxflrx.exe 1040 fxfxllr.exe 2476 hntnnn.exe 2716 hththb.exe 2844 dvjpp.exe 1304 frfflxf.exe 1324 lxrxffl.exe 2612 5tbbhn.exe 2228 nhtbht.exe 2220 dvpdj.exe 2084 7pvpp.exe 2916 jdjjv.exe 664 3xlfxxf.exe 1096 9nhtbb.exe 1856 nbtnnh.exe -
resource yara_rule behavioral1/memory/2176-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1524-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1516-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1680-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2116-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/768-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1692-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1900-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/888-302-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2176 wrote to memory of 2960 2176 1be7273c7fbab4c570bef17218151d60_NeikiAnalytics.exe 28 PID 2176 wrote to memory of 2960 2176 1be7273c7fbab4c570bef17218151d60_NeikiAnalytics.exe 28 PID 2176 wrote to memory of 2960 2176 1be7273c7fbab4c570bef17218151d60_NeikiAnalytics.exe 28 PID 2176 wrote to memory of 2960 2176 1be7273c7fbab4c570bef17218151d60_NeikiAnalytics.exe 28 PID 2960 wrote to memory of 2016 2960 hbhbhh.exe 29 PID 2960 wrote to memory of 2016 2960 hbhbhh.exe 29 PID 2960 wrote to memory of 2016 2960 hbhbhh.exe 29 PID 2960 wrote to memory of 2016 2960 hbhbhh.exe 29 PID 2016 wrote to memory of 2648 2016 9pdpd.exe 30 PID 2016 wrote to memory of 2648 2016 9pdpd.exe 30 PID 2016 wrote to memory of 2648 2016 9pdpd.exe 30 PID 2016 wrote to memory of 2648 2016 9pdpd.exe 30 PID 2648 wrote to memory of 2672 2648 bnhntt.exe 31 PID 2648 wrote to memory of 2672 2648 bnhntt.exe 31 PID 2648 wrote to memory of 2672 2648 bnhntt.exe 31 PID 2648 wrote to memory of 2672 2648 bnhntt.exe 31 PID 2672 wrote to memory of 2680 2672 vpjjp.exe 32 PID 2672 wrote to memory of 2680 2672 vpjjp.exe 32 PID 2672 wrote to memory of 2680 2672 vpjjp.exe 32 PID 2672 wrote to memory of 2680 2672 vpjjp.exe 32 PID 2680 wrote to memory of 2876 2680 xxrfrxl.exe 33 PID 2680 wrote to memory of 2876 2680 xxrfrxl.exe 33 PID 2680 wrote to memory of 2876 2680 xxrfrxl.exe 33 PID 2680 wrote to memory of 2876 2680 xxrfrxl.exe 33 PID 2876 wrote to memory of 1524 2876 nbtthn.exe 34 PID 2876 wrote to memory of 1524 2876 nbtthn.exe 34 PID 2876 wrote to memory of 1524 2876 nbtthn.exe 34 PID 2876 wrote to memory of 1524 2876 nbtthn.exe 34 PID 1524 wrote to memory of 2640 1524 ttnthn.exe 35 PID 1524 wrote to memory of 2640 1524 ttnthn.exe 35 PID 1524 wrote to memory of 2640 1524 ttnthn.exe 35 PID 1524 wrote to memory of 2640 1524 ttnthn.exe 35 PID 2640 wrote to memory of 3044 2640 vvjjd.exe 36 PID 2640 wrote to memory of 3044 2640 vvjjd.exe 36 PID 2640 wrote to memory of 3044 2640 vvjjd.exe 36 PID 2640 wrote to memory of 3044 2640 vvjjd.exe 36 PID 3044 wrote to memory of 2856 3044 bthtbb.exe 37 PID 3044 wrote to memory of 2856 3044 bthtbb.exe 37 PID 3044 wrote to memory of 2856 3044 bthtbb.exe 37 PID 3044 wrote to memory of 2856 3044 bthtbb.exe 37 PID 2856 wrote to memory of 2976 2856 nnbtnn.exe 38 PID 2856 wrote to memory of 2976 2856 nnbtnn.exe 38 PID 2856 wrote to memory of 2976 2856 nnbtnn.exe 38 PID 2856 wrote to memory of 2976 2856 nnbtnn.exe 38 PID 2976 wrote to memory of 1516 2976 vvjdv.exe 39 PID 2976 wrote to memory of 1516 2976 vvjdv.exe 39 PID 2976 wrote to memory of 1516 2976 vvjdv.exe 39 PID 2976 wrote to memory of 1516 2976 vvjdv.exe 39 PID 1516 wrote to memory of 1040 1516 lrlxflf.exe 40 PID 1516 wrote to memory of 1040 1516 lrlxflf.exe 40 PID 1516 wrote to memory of 1040 1516 lrlxflf.exe 40 PID 1516 wrote to memory of 1040 1516 lrlxflf.exe 40 PID 1040 wrote to memory of 652 1040 nnbnbh.exe 41 PID 1040 wrote to memory of 652 1040 nnbnbh.exe 41 PID 1040 wrote to memory of 652 1040 nnbnbh.exe 41 PID 1040 wrote to memory of 652 1040 nnbnbh.exe 41 PID 652 wrote to memory of 2172 652 1btnbb.exe 42 PID 652 wrote to memory of 2172 652 1btnbb.exe 42 PID 652 wrote to memory of 2172 652 1btnbb.exe 42 PID 652 wrote to memory of 2172 652 1btnbb.exe 42 PID 2172 wrote to memory of 2852 2172 ppjpd.exe 43 PID 2172 wrote to memory of 2852 2172 ppjpd.exe 43 PID 2172 wrote to memory of 2852 2172 ppjpd.exe 43 PID 2172 wrote to memory of 2852 2172 ppjpd.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\1be7273c7fbab4c570bef17218151d60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1be7273c7fbab4c570bef17218151d60_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\hbhbhh.exec:\hbhbhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\9pdpd.exec:\9pdpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\bnhntt.exec:\bnhntt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\vpjjp.exec:\vpjjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\xxrfrxl.exec:\xxrfrxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\nbtthn.exec:\nbtthn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\ttnthn.exec:\ttnthn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\vvjjd.exec:\vvjjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\bthtbb.exec:\bthtbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\nnbtnn.exec:\nnbtnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\vvjdv.exec:\vvjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\lrlxflf.exec:\lrlxflf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\nnbnbh.exec:\nnbnbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\1btnbb.exec:\1btnbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
\??\c:\ppjpd.exec:\ppjpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\xxllxxx.exec:\xxllxxx.exe17⤵
- Executes dropped EXE
PID:2852 -
\??\c:\rlfrxxl.exec:\rlfrxxl.exe18⤵
- Executes dropped EXE
PID:1680 -
\??\c:\nhhntb.exec:\nhhntb.exe19⤵
- Executes dropped EXE
PID:1296 -
\??\c:\pjdpv.exec:\pjdpv.exe20⤵
- Executes dropped EXE
PID:1184 -
\??\c:\lxfflff.exec:\lxfflff.exe21⤵
- Executes dropped EXE
PID:2924 -
\??\c:\7xrflrx.exec:\7xrflrx.exe22⤵
- Executes dropped EXE
PID:2936 -
\??\c:\nbtbnn.exec:\nbtbnn.exe23⤵
- Executes dropped EXE
PID:556 -
\??\c:\bnbtbn.exec:\bnbtbn.exe24⤵
- Executes dropped EXE
PID:584 -
\??\c:\dpddj.exec:\dpddj.exe25⤵
- Executes dropped EXE
PID:2116 -
\??\c:\rrffffl.exec:\rrffffl.exe26⤵
- Executes dropped EXE
PID:2308 -
\??\c:\xxxlfrl.exec:\xxxlfrl.exe27⤵
- Executes dropped EXE
PID:768 -
\??\c:\7bttht.exec:\7bttht.exe28⤵
- Executes dropped EXE
PID:1424 -
\??\c:\dvppp.exec:\dvppp.exe29⤵
- Executes dropped EXE
PID:2324 -
\??\c:\9lfxlfl.exec:\9lfxlfl.exe30⤵
- Executes dropped EXE
PID:1692 -
\??\c:\5fxxfff.exec:\5fxxfff.exe31⤵
- Executes dropped EXE
PID:1900 -
\??\c:\tnttnt.exec:\tnttnt.exe32⤵
- Executes dropped EXE
PID:888 -
\??\c:\thbnhh.exec:\thbnhh.exe33⤵
- Executes dropped EXE
PID:1292 -
\??\c:\dpdvd.exec:\dpdvd.exe34⤵
- Executes dropped EXE
PID:1588 -
\??\c:\xrfllxl.exec:\xrfllxl.exe35⤵
- Executes dropped EXE
PID:2972 -
\??\c:\xlrrxxx.exec:\xlrrxxx.exe36⤵
- Executes dropped EXE
PID:2136 -
\??\c:\thbhnh.exec:\thbhnh.exe37⤵
- Executes dropped EXE
PID:2132 -
\??\c:\pdjdp.exec:\pdjdp.exe38⤵
- Executes dropped EXE
PID:2768 -
\??\c:\xlrlllr.exec:\xlrlllr.exe39⤵
- Executes dropped EXE
PID:2908 -
\??\c:\xrlrllr.exec:\xrlrllr.exe40⤵
- Executes dropped EXE
PID:2636 -
\??\c:\tnttbb.exec:\tnttbb.exe41⤵
- Executes dropped EXE
PID:2812 -
\??\c:\7htbhh.exec:\7htbhh.exe42⤵
- Executes dropped EXE
PID:2684 -
\??\c:\1jdvv.exec:\1jdvv.exe43⤵
- Executes dropped EXE
PID:3068 -
\??\c:\dpdjj.exec:\dpdjj.exe44⤵
- Executes dropped EXE
PID:2588 -
\??\c:\3xrlxxf.exec:\3xrlxxf.exe45⤵
- Executes dropped EXE
PID:2564 -
\??\c:\frrxxxx.exec:\frrxxxx.exe46⤵
- Executes dropped EXE
PID:1276 -
\??\c:\nhtbnh.exec:\nhtbnh.exe47⤵
- Executes dropped EXE
PID:2208 -
\??\c:\1tbttn.exec:\1tbttn.exe48⤵
- Executes dropped EXE
PID:3024 -
\??\c:\dpjjp.exec:\dpjjp.exe49⤵
- Executes dropped EXE
PID:3020 -
\??\c:\vpddp.exec:\vpddp.exe50⤵
- Executes dropped EXE
PID:1520 -
\??\c:\xrxflrx.exec:\xrxflrx.exe51⤵
- Executes dropped EXE
PID:2316 -
\??\c:\fxfxllr.exec:\fxfxllr.exe52⤵
- Executes dropped EXE
PID:1040 -
\??\c:\hntnnn.exec:\hntnnn.exe53⤵
- Executes dropped EXE
PID:2476 -
\??\c:\hththb.exec:\hththb.exe54⤵
- Executes dropped EXE
PID:2716 -
\??\c:\dvjpp.exec:\dvjpp.exe55⤵
- Executes dropped EXE
PID:2844 -
\??\c:\frfflxf.exec:\frfflxf.exe56⤵
- Executes dropped EXE
PID:1304 -
\??\c:\lxrxffl.exec:\lxrxffl.exe57⤵
- Executes dropped EXE
PID:1324 -
\??\c:\5tbbhn.exec:\5tbbhn.exe58⤵
- Executes dropped EXE
PID:2612 -
\??\c:\nhtbht.exec:\nhtbht.exe59⤵
- Executes dropped EXE
PID:2228 -
\??\c:\dvpdj.exec:\dvpdj.exe60⤵
- Executes dropped EXE
PID:2220 -
\??\c:\7pvpp.exec:\7pvpp.exe61⤵
- Executes dropped EXE
PID:2084 -
\??\c:\jdjjv.exec:\jdjjv.exe62⤵
- Executes dropped EXE
PID:2916 -
\??\c:\3xlfxxf.exec:\3xlfxxf.exe63⤵
- Executes dropped EXE
PID:664 -
\??\c:\9nhtbb.exec:\9nhtbb.exe64⤵
- Executes dropped EXE
PID:1096 -
\??\c:\nbtnnh.exec:\nbtnnh.exe65⤵
- Executes dropped EXE
PID:1856 -
\??\c:\jvvvd.exec:\jvvvd.exe66⤵PID:1724
-
\??\c:\3dpvj.exec:\3dpvj.exe67⤵PID:2900
-
\??\c:\xflrflr.exec:\xflrflr.exe68⤵PID:600
-
\??\c:\9xlxlff.exec:\9xlxlff.exe69⤵PID:2340
-
\??\c:\5thbnh.exec:\5thbnh.exe70⤵PID:2188
-
\??\c:\btnttt.exec:\btnttt.exe71⤵PID:2224
-
\??\c:\jvddj.exec:\jvddj.exe72⤵PID:2216
-
\??\c:\vjvpj.exec:\vjvpj.exe73⤵PID:1604
-
\??\c:\lfrxllr.exec:\lfrxllr.exe74⤵PID:1052
-
\??\c:\xrxffxf.exec:\xrxffxf.exe75⤵PID:2204
-
\??\c:\1bhtbb.exec:\1bhtbb.exe76⤵PID:1712
-
\??\c:\hbtbhh.exec:\hbtbhh.exe77⤵PID:2240
-
\??\c:\vjjdj.exec:\vjjdj.exe78⤵PID:1644
-
\??\c:\5vdpp.exec:\5vdpp.exe79⤵PID:2016
-
\??\c:\lfxffxf.exec:\lfxffxf.exe80⤵PID:2780
-
\??\c:\9xlrffl.exec:\9xlrffl.exe81⤵PID:2040
-
\??\c:\5bttnt.exec:\5bttnt.exe82⤵PID:2672
-
\??\c:\nbbthh.exec:\nbbthh.exe83⤵PID:2656
-
\??\c:\vjvjj.exec:\vjvjj.exe84⤵PID:2572
-
\??\c:\1vjdp.exec:\1vjdp.exe85⤵PID:796
-
\??\c:\lxfffff.exec:\lxfffff.exe86⤵PID:3000
-
\??\c:\lxllrrx.exec:\lxllrrx.exe87⤵PID:3040
-
\??\c:\3ntbtn.exec:\3ntbtn.exe88⤵PID:1748
-
\??\c:\hhnnnn.exec:\hhnnnn.exe89⤵PID:2864
-
\??\c:\vpjpp.exec:\vpjpp.exe90⤵PID:2964
-
\??\c:\1pdpv.exec:\1pdpv.exe91⤵PID:2712
-
\??\c:\rrlfxxf.exec:\rrlfxxf.exe92⤵PID:1716
-
\??\c:\fxrrfrx.exec:\fxrrfrx.exe93⤵PID:2704
-
\??\c:\hnbnhb.exec:\hnbnhb.exe94⤵PID:1252
-
\??\c:\hthbth.exec:\hthbth.exe95⤵PID:2492
-
\??\c:\jvpvj.exec:\jvpvj.exe96⤵PID:1612
-
\??\c:\dpddj.exec:\dpddj.exe97⤵PID:2356
-
\??\c:\5rllrxx.exec:\5rllrxx.exe98⤵PID:1388
-
\??\c:\5xflfxf.exec:\5xflfxf.exe99⤵PID:2096
-
\??\c:\3htttt.exec:\3htttt.exe100⤵PID:1296
-
\??\c:\9nntbb.exec:\9nntbb.exe101⤵PID:2104
-
\??\c:\jdjpj.exec:\jdjpj.exe102⤵PID:2924
-
\??\c:\5pdjv.exec:\5pdjv.exe103⤵PID:320
-
\??\c:\rrrrrll.exec:\rrrrrll.exe104⤵PID:2496
-
\??\c:\lfffflx.exec:\lfffflx.exe105⤵PID:1632
-
\??\c:\hbnntt.exec:\hbnntt.exe106⤵PID:2376
-
\??\c:\nbntbb.exec:\nbntbb.exe107⤵PID:2116
-
\??\c:\vjddv.exec:\vjddv.exe108⤵PID:2308
-
\??\c:\vjpjj.exec:\vjpjj.exe109⤵PID:1048
-
\??\c:\rxlrlll.exec:\rxlrlll.exe110⤵PID:864
-
\??\c:\lxxfffr.exec:\lxxfffr.exe111⤵PID:2200
-
\??\c:\xrxfflx.exec:\xrxfflx.exe112⤵PID:1704
-
\??\c:\7bnnbb.exec:\7bnnbb.exe113⤵PID:1792
-
\??\c:\dpvvd.exec:\dpvvd.exe114⤵PID:1500
-
\??\c:\pdvpp.exec:\pdvpp.exe115⤵PID:2432
-
\??\c:\jdvvd.exec:\jdvvd.exe116⤵PID:848
-
\??\c:\lfxffxf.exec:\lfxffxf.exe117⤵PID:2196
-
\??\c:\9rllllr.exec:\9rllllr.exe118⤵PID:3064
-
\??\c:\thttbb.exec:\thttbb.exe119⤵PID:3060
-
\??\c:\nbnhhb.exec:\nbnhhb.exe120⤵PID:2136
-
\??\c:\dvvdj.exec:\dvvdj.exe121⤵PID:2752
-
\??\c:\jpdvd.exec:\jpdvd.exe122⤵PID:2768
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-