Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 02:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
21fd02934695328955b1fe69e11619e0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
21fd02934695328955b1fe69e11619e0_NeikiAnalytics.exe
-
Size
61KB
-
MD5
21fd02934695328955b1fe69e11619e0
-
SHA1
4e6a91ec585a2be0bfb11317bc66b3cf537f7511
-
SHA256
69130e48a0377a8911c9f642d18454af6f4558d281626cfb3479e7765313e6d1
-
SHA512
975f18d7efafa4c502dcf9ad848ed2b07da9d4faf52af69f10517a4eefda1a1d8d152af4e179607763775017b95717b159a98f809e3162ffe347f047b0fa884a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDII9ZvHKEV:ymb3NkkiQ3mdBjFII9ZvHKEV
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/1732-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1732-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/632-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1232-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2104-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2144-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1588-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1696-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3048-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1576-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1456-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1944-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2876 bthhbb.exe 2512 dvjpv.exe 2564 fxllllr.exe 2088 tthnth.exe 2552 dpvjj.exe 2640 vvjdp.exe 2428 rffrxll.exe 2816 hthntb.exe 632 jvvpd.exe 2424 9pvpv.exe 1232 7rrfxxr.exe 2104 nhtbhn.exe 2144 btthtt.exe 1588 dpdjv.exe 2128 3pdjp.exe 384 ffrffll.exe 2688 3lflrll.exe 1696 httbht.exe 2704 vpdpd.exe 2196 pjvdp.exe 3048 3rlxfxl.exe 1576 bthhbh.exe 2596 hnhnht.exe 1456 dpjvj.exe 712 9vjpj.exe 1660 llllrxr.exe 2748 7btntn.exe 2928 hbnnbh.exe 1996 1pppp.exe 1944 ppdpp.exe 2304 5fflrrx.exe 1868 llrrrxf.exe 1544 5tbbtt.exe 2708 nhnnbb.exe 2476 jvjjv.exe 1928 lxrflrf.exe 2636 rflllfl.exe 2396 1btbnn.exe 2088 nbnnbt.exe 2532 dpjpv.exe 2404 7vpvv.exe 2852 ffrxffl.exe 2336 3xllxfl.exe 3012 7hhbbh.exe 2244 1nnnbb.exe 2592 bnhhht.exe 1800 dvjjp.exe 1592 vvjpv.exe 2136 xflrxrx.exe 300 9rfxrlr.exe 1572 hbbbnt.exe 1792 hthbbn.exe 540 pjpvp.exe 384 djjdd.exe 1184 lxlllrr.exe 2796 fxffllx.exe 2812 htbhhb.exe 2700 hbtthb.exe 3036 vpjvj.exe 1408 jvvdd.exe 2680 jdjjd.exe 2316 xlrffxx.exe 2444 xrrxxxf.exe 1724 nbbbhh.exe -
resource yara_rule behavioral1/memory/1732-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/632-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1232-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2104-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2144-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1588-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1576-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1456-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1944-289-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1732 wrote to memory of 2876 1732 21fd02934695328955b1fe69e11619e0_NeikiAnalytics.exe 28 PID 1732 wrote to memory of 2876 1732 21fd02934695328955b1fe69e11619e0_NeikiAnalytics.exe 28 PID 1732 wrote to memory of 2876 1732 21fd02934695328955b1fe69e11619e0_NeikiAnalytics.exe 28 PID 1732 wrote to memory of 2876 1732 21fd02934695328955b1fe69e11619e0_NeikiAnalytics.exe 28 PID 2876 wrote to memory of 2512 2876 bthhbb.exe 29 PID 2876 wrote to memory of 2512 2876 bthhbb.exe 29 PID 2876 wrote to memory of 2512 2876 bthhbb.exe 29 PID 2876 wrote to memory of 2512 2876 bthhbb.exe 29 PID 2512 wrote to memory of 2564 2512 dvjpv.exe 30 PID 2512 wrote to memory of 2564 2512 dvjpv.exe 30 PID 2512 wrote to memory of 2564 2512 dvjpv.exe 30 PID 2512 wrote to memory of 2564 2512 dvjpv.exe 30 PID 2564 wrote to memory of 2088 2564 fxllllr.exe 31 PID 2564 wrote to memory of 2088 2564 fxllllr.exe 31 PID 2564 wrote to memory of 2088 2564 fxllllr.exe 31 PID 2564 wrote to memory of 2088 2564 fxllllr.exe 31 PID 2088 wrote to memory of 2552 2088 tthnth.exe 32 PID 2088 wrote to memory of 2552 2088 tthnth.exe 32 PID 2088 wrote to memory of 2552 2088 tthnth.exe 32 PID 2088 wrote to memory of 2552 2088 tthnth.exe 32 PID 2552 wrote to memory of 2640 2552 dpvjj.exe 33 PID 2552 wrote to memory of 2640 2552 dpvjj.exe 33 PID 2552 wrote to memory of 2640 2552 dpvjj.exe 33 PID 2552 wrote to memory of 2640 2552 dpvjj.exe 33 PID 2640 wrote to memory of 2428 2640 vvjdp.exe 34 PID 2640 wrote to memory of 2428 2640 vvjdp.exe 34 PID 2640 wrote to memory of 2428 2640 vvjdp.exe 34 PID 2640 wrote to memory of 2428 2640 vvjdp.exe 34 PID 2428 wrote to memory of 2816 2428 rffrxll.exe 35 PID 2428 wrote to memory of 2816 2428 rffrxll.exe 35 PID 2428 wrote to memory of 2816 2428 rffrxll.exe 35 PID 2428 wrote to memory of 2816 2428 rffrxll.exe 35 PID 2816 wrote to memory of 632 2816 hthntb.exe 36 PID 2816 wrote to memory of 632 2816 hthntb.exe 36 PID 2816 wrote to memory of 632 2816 hthntb.exe 36 PID 2816 wrote to memory of 632 2816 hthntb.exe 36 PID 632 wrote to memory of 2424 632 jvvpd.exe 37 PID 632 wrote to memory of 2424 632 jvvpd.exe 37 PID 632 wrote to memory of 2424 632 jvvpd.exe 37 PID 632 wrote to memory of 2424 632 jvvpd.exe 37 PID 2424 wrote to memory of 1232 2424 9pvpv.exe 38 PID 2424 wrote to memory of 1232 2424 9pvpv.exe 38 PID 2424 wrote to memory of 1232 2424 9pvpv.exe 38 PID 2424 wrote to memory of 1232 2424 9pvpv.exe 38 PID 1232 wrote to memory of 2104 1232 7rrfxxr.exe 39 PID 1232 wrote to memory of 2104 1232 7rrfxxr.exe 39 PID 1232 wrote to memory of 2104 1232 7rrfxxr.exe 39 PID 1232 wrote to memory of 2104 1232 7rrfxxr.exe 39 PID 2104 wrote to memory of 2144 2104 nhtbhn.exe 40 PID 2104 wrote to memory of 2144 2104 nhtbhn.exe 40 PID 2104 wrote to memory of 2144 2104 nhtbhn.exe 40 PID 2104 wrote to memory of 2144 2104 nhtbhn.exe 40 PID 2144 wrote to memory of 1588 2144 btthtt.exe 41 PID 2144 wrote to memory of 1588 2144 btthtt.exe 41 PID 2144 wrote to memory of 1588 2144 btthtt.exe 41 PID 2144 wrote to memory of 1588 2144 btthtt.exe 41 PID 1588 wrote to memory of 2128 1588 dpdjv.exe 42 PID 1588 wrote to memory of 2128 1588 dpdjv.exe 42 PID 1588 wrote to memory of 2128 1588 dpdjv.exe 42 PID 1588 wrote to memory of 2128 1588 dpdjv.exe 42 PID 2128 wrote to memory of 384 2128 3pdjp.exe 43 PID 2128 wrote to memory of 384 2128 3pdjp.exe 43 PID 2128 wrote to memory of 384 2128 3pdjp.exe 43 PID 2128 wrote to memory of 384 2128 3pdjp.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\21fd02934695328955b1fe69e11619e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\21fd02934695328955b1fe69e11619e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\bthhbb.exec:\bthhbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\dvjpv.exec:\dvjpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\fxllllr.exec:\fxllllr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\tthnth.exec:\tthnth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\dpvjj.exec:\dpvjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\vvjdp.exec:\vvjdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\rffrxll.exec:\rffrxll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\hthntb.exec:\hthntb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\jvvpd.exec:\jvvpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\9pvpv.exec:\9pvpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\7rrfxxr.exec:\7rrfxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\nhtbhn.exec:\nhtbhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\btthtt.exec:\btthtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\dpdjv.exec:\dpdjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\3pdjp.exec:\3pdjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\ffrffll.exec:\ffrffll.exe17⤵
- Executes dropped EXE
PID:384 -
\??\c:\3lflrll.exec:\3lflrll.exe18⤵
- Executes dropped EXE
PID:2688 -
\??\c:\httbht.exec:\httbht.exe19⤵
- Executes dropped EXE
PID:1696 -
\??\c:\vpdpd.exec:\vpdpd.exe20⤵
- Executes dropped EXE
PID:2704 -
\??\c:\pjvdp.exec:\pjvdp.exe21⤵
- Executes dropped EXE
PID:2196 -
\??\c:\3rlxfxl.exec:\3rlxfxl.exe22⤵
- Executes dropped EXE
PID:3048 -
\??\c:\bthhbh.exec:\bthhbh.exe23⤵
- Executes dropped EXE
PID:1576 -
\??\c:\hnhnht.exec:\hnhnht.exe24⤵
- Executes dropped EXE
PID:2596 -
\??\c:\dpjvj.exec:\dpjvj.exe25⤵
- Executes dropped EXE
PID:1456 -
\??\c:\9vjpj.exec:\9vjpj.exe26⤵
- Executes dropped EXE
PID:712 -
\??\c:\llllrxr.exec:\llllrxr.exe27⤵
- Executes dropped EXE
PID:1660 -
\??\c:\7btntn.exec:\7btntn.exe28⤵
- Executes dropped EXE
PID:2748 -
\??\c:\hbnnbh.exec:\hbnnbh.exe29⤵
- Executes dropped EXE
PID:2928 -
\??\c:\1pppp.exec:\1pppp.exe30⤵
- Executes dropped EXE
PID:1996 -
\??\c:\ppdpp.exec:\ppdpp.exe31⤵
- Executes dropped EXE
PID:1944 -
\??\c:\5fflrrx.exec:\5fflrrx.exe32⤵
- Executes dropped EXE
PID:2304 -
\??\c:\llrrrxf.exec:\llrrrxf.exe33⤵
- Executes dropped EXE
PID:1868 -
\??\c:\5tbbtt.exec:\5tbbtt.exe34⤵
- Executes dropped EXE
PID:1544 -
\??\c:\nhnnbb.exec:\nhnnbb.exe35⤵
- Executes dropped EXE
PID:2708 -
\??\c:\jvjjv.exec:\jvjjv.exe36⤵
- Executes dropped EXE
PID:2476 -
\??\c:\lxrflrf.exec:\lxrflrf.exe37⤵
- Executes dropped EXE
PID:1928 -
\??\c:\rflllfl.exec:\rflllfl.exe38⤵
- Executes dropped EXE
PID:2636 -
\??\c:\1btbnn.exec:\1btbnn.exe39⤵
- Executes dropped EXE
PID:2396 -
\??\c:\nbnnbt.exec:\nbnnbt.exe40⤵
- Executes dropped EXE
PID:2088 -
\??\c:\dpjpv.exec:\dpjpv.exe41⤵
- Executes dropped EXE
PID:2532 -
\??\c:\7vpvv.exec:\7vpvv.exe42⤵
- Executes dropped EXE
PID:2404 -
\??\c:\ffrxffl.exec:\ffrxffl.exe43⤵
- Executes dropped EXE
PID:2852 -
\??\c:\3xllxfl.exec:\3xllxfl.exe44⤵
- Executes dropped EXE
PID:2336 -
\??\c:\7hhbbh.exec:\7hhbbh.exe45⤵
- Executes dropped EXE
PID:3012 -
\??\c:\1nnnbb.exec:\1nnnbb.exe46⤵
- Executes dropped EXE
PID:2244 -
\??\c:\bnhhht.exec:\bnhhht.exe47⤵
- Executes dropped EXE
PID:2592 -
\??\c:\dvjjp.exec:\dvjjp.exe48⤵
- Executes dropped EXE
PID:1800 -
\??\c:\vvjpv.exec:\vvjpv.exe49⤵
- Executes dropped EXE
PID:1592 -
\??\c:\xflrxrx.exec:\xflrxrx.exe50⤵
- Executes dropped EXE
PID:2136 -
\??\c:\9rfxrlr.exec:\9rfxrlr.exe51⤵
- Executes dropped EXE
PID:300 -
\??\c:\hbbbnt.exec:\hbbbnt.exe52⤵
- Executes dropped EXE
PID:1572 -
\??\c:\hthbbn.exec:\hthbbn.exe53⤵
- Executes dropped EXE
PID:1792 -
\??\c:\pjpvp.exec:\pjpvp.exe54⤵
- Executes dropped EXE
PID:540 -
\??\c:\djjdd.exec:\djjdd.exe55⤵
- Executes dropped EXE
PID:384 -
\??\c:\lxlllrr.exec:\lxlllrr.exe56⤵
- Executes dropped EXE
PID:1184 -
\??\c:\fxffllx.exec:\fxffllx.exe57⤵
- Executes dropped EXE
PID:2796 -
\??\c:\htbhhb.exec:\htbhhb.exe58⤵
- Executes dropped EXE
PID:2812 -
\??\c:\hbtthb.exec:\hbtthb.exe59⤵
- Executes dropped EXE
PID:2700 -
\??\c:\vpjvj.exec:\vpjvj.exe60⤵
- Executes dropped EXE
PID:3036 -
\??\c:\jvvdd.exec:\jvvdd.exe61⤵
- Executes dropped EXE
PID:1408 -
\??\c:\jdjjd.exec:\jdjjd.exe62⤵
- Executes dropped EXE
PID:2680 -
\??\c:\xlrffxx.exec:\xlrffxx.exe63⤵
- Executes dropped EXE
PID:2316 -
\??\c:\xrrxxxf.exec:\xrrxxxf.exe64⤵
- Executes dropped EXE
PID:2444 -
\??\c:\nbbbhh.exec:\nbbbhh.exe65⤵
- Executes dropped EXE
PID:1724 -
\??\c:\nbnhnt.exec:\nbnhnt.exe66⤵PID:1108
-
\??\c:\ddjvj.exec:\ddjvj.exe67⤵PID:2236
-
\??\c:\dvpvj.exec:\dvpvj.exe68⤵PID:908
-
\??\c:\jdvdj.exec:\jdvdj.exe69⤵PID:1904
-
\??\c:\1rllfll.exec:\1rllfll.exe70⤵PID:2228
-
\??\c:\rfrfxff.exec:\rfrfxff.exe71⤵PID:2240
-
\??\c:\7nhnnn.exec:\7nhnnn.exe72⤵PID:2288
-
\??\c:\ntnhhb.exec:\ntnhhb.exe73⤵PID:1668
-
\??\c:\ppjvd.exec:\ppjvd.exe74⤵PID:2936
-
\??\c:\vdddj.exec:\vdddj.exe75⤵PID:1536
-
\??\c:\fxlxfrr.exec:\fxlxfrr.exe76⤵PID:1544
-
\??\c:\xlllrll.exec:\xlllrll.exe77⤵PID:1856
-
\??\c:\nhtthb.exec:\nhtthb.exe78⤵PID:2456
-
\??\c:\1hbbbh.exec:\1hbbbh.exe79⤵PID:1928
-
\??\c:\djdpj.exec:\djdpj.exe80⤵PID:2588
-
\??\c:\dvjjv.exec:\dvjjv.exe81⤵PID:2900
-
\??\c:\lxfllfr.exec:\lxfllfr.exe82⤵PID:2468
-
\??\c:\llrrrrr.exec:\llrrrrr.exe83⤵PID:2532
-
\??\c:\frffffl.exec:\frffffl.exe84⤵PID:2488
-
\??\c:\thnbtt.exec:\thnbtt.exe85⤵PID:2852
-
\??\c:\9htbbh.exec:\9htbbh.exe86⤵PID:2336
-
\??\c:\9vvvp.exec:\9vvvp.exe87⤵PID:1512
-
\??\c:\7vvvv.exec:\7vvvv.exe88⤵PID:1248
-
\??\c:\dpvpp.exec:\dpvpp.exe89⤵PID:2608
-
\??\c:\rxfrrrr.exec:\rxfrrrr.exe90⤵PID:2600
-
\??\c:\7fllrll.exec:\7fllrll.exe91⤵PID:1232
-
\??\c:\bhbbbn.exec:\bhbbbn.exe92⤵PID:376
-
\??\c:\bnttnh.exec:\bnttnh.exe93⤵PID:300
-
\??\c:\dpjjj.exec:\dpjjj.exe94⤵PID:1588
-
\??\c:\pdjdj.exec:\pdjdj.exe95⤵PID:1792
-
\??\c:\rfxffff.exec:\rfxffff.exe96⤵PID:2036
-
\??\c:\5rxllff.exec:\5rxllff.exe97⤵PID:384
-
\??\c:\frxrlfx.exec:\frxrlfx.exe98⤵PID:2968
-
\??\c:\3thbtn.exec:\3thbtn.exe99⤵PID:1616
-
\??\c:\5htntn.exec:\5htntn.exe100⤵PID:2204
-
\??\c:\bntttn.exec:\bntttn.exe101⤵PID:2704
-
\??\c:\dvdvv.exec:\dvdvv.exe102⤵PID:1420
-
\??\c:\vjvpv.exec:\vjvpv.exe103⤵PID:596
-
\??\c:\frxrrrf.exec:\frxrrrf.exe104⤵PID:1308
-
\??\c:\rllffxr.exec:\rllffxr.exe105⤵PID:2316
-
\??\c:\frfffxf.exec:\frfffxf.exe106⤵PID:452
-
\??\c:\ntbnnh.exec:\ntbnnh.exe107⤵PID:1724
-
\??\c:\bnbbbb.exec:\bnbbbb.exe108⤵PID:804
-
\??\c:\jvpvp.exec:\jvpvp.exe109⤵PID:2236
-
\??\c:\jvddv.exec:\jvddv.exe110⤵PID:1260
-
\??\c:\xrffxxf.exec:\xrffxxf.exe111⤵PID:1904
-
\??\c:\rlxrxrr.exec:\rlxrxrr.exe112⤵PID:2768
-
\??\c:\xrlffxx.exec:\xrlffxx.exe113⤵PID:2692
-
\??\c:\djvvv.exec:\djvvv.exe114⤵PID:916
-
\??\c:\pddvp.exec:\pddvp.exe115⤵PID:1668
-
\??\c:\3dppp.exec:\3dppp.exe116⤵PID:1216
-
\??\c:\rfrffxx.exec:\rfrffxx.exe117⤵PID:1536
-
\??\c:\xllrxrx.exec:\xllrxrx.exe118⤵PID:2572
-
\??\c:\bnbhhb.exec:\bnbhhb.exe119⤵PID:1856
-
\??\c:\nhbhtb.exec:\nhbhtb.exe120⤵PID:2476
-
\??\c:\1vdvv.exec:\1vdvv.exe121⤵PID:1928
-
\??\c:\vddjj.exec:\vddjj.exe122⤵PID:2548
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-