Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 15:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
43e4b1e7f3c60a1d63ad81c65210cfd0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
43e4b1e7f3c60a1d63ad81c65210cfd0_NeikiAnalytics.exe
-
Size
64KB
-
MD5
43e4b1e7f3c60a1d63ad81c65210cfd0
-
SHA1
9df315a64de32e61e5c2efb9f9068840d075b4c6
-
SHA256
d5f2bd91ab8e41fee17f3bc66849168b684607b3875be32da111cbd97e1a9157
-
SHA512
19cdf939cd69bad90d736be913243e75114bbf8dbdabadc8dbe1a017f0c469cb6a5459987d0cb76a5b6045804df66f8627e3a3623f6b24a10781b967b7dc614b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIhJm/wL:ymb3NkkiQ3mdBjFILmu
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/1732-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/880-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-44-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-83-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2444-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2360-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1828-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/780-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/344-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1704-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/560-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1796-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1352-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/944-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1036-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2116-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1516-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1732 ttbhhb.exe 2540 9ppvp.exe 2684 xlflrxr.exe 2572 nhntbh.exe 2564 pjpdp.exe 2916 frfffxx.exe 2444 lrrfxll.exe 2344 nhthnh.exe 2000 vpdjp.exe 2624 flxrfrf.exe 2876 lfrxlff.exe 1676 5tnbhh.exe 2360 3dpdj.exe 1828 dvdpv.exe 2336 xlfllfl.exe 780 nnbhnh.exe 344 vjddp.exe 2320 pvvjv.exe 1704 frlxxlr.exe 2952 xlrxlxl.exe 2100 tbhnhn.exe 560 7vpjd.exe 596 vpdjv.exe 1160 xrlrxff.exe 1796 hbnntt.exe 1352 bbtthh.exe 1948 vvjdv.exe 944 rllrffr.exe 1036 bnthbh.exe 2116 nhnnbn.exe 1516 pjppd.exe 2252 lfffrxx.exe 2228 3htbbh.exe 1740 jdvvd.exe 3000 ddpvj.exe 1548 1xrllxx.exe 2652 3rllrrl.exe 2684 tnhntb.exe 2724 htbbnn.exe 2748 7djvj.exe 2620 9pdpv.exe 2468 rrffllr.exe 2524 rxlrflr.exe 2888 hbnthh.exe 2200 nhnnbn.exe 2732 pdpjd.exe 2676 ddppd.exe 2744 xrflrrx.exe 2356 lxxxflx.exe 1676 btbtbb.exe 2372 nthnnb.exe 2272 vppjj.exe 2104 jjddd.exe 328 rfrlfff.exe 2244 xrllrlx.exe 2284 ntnttt.exe 1988 hhnhhh.exe 2328 pjdjv.exe 2804 vvvdj.exe 484 xxrxfrr.exe 576 3fllxxr.exe 1500 7bhnbb.exe 588 7nntbh.exe 2132 ppjvj.exe -
resource yara_rule behavioral1/memory/880-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1732-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/880-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1828-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/780-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/344-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1704-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/560-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1352-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/944-275-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1036-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2116-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1516-302-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 880 wrote to memory of 1732 880 43e4b1e7f3c60a1d63ad81c65210cfd0_NeikiAnalytics.exe 28 PID 880 wrote to memory of 1732 880 43e4b1e7f3c60a1d63ad81c65210cfd0_NeikiAnalytics.exe 28 PID 880 wrote to memory of 1732 880 43e4b1e7f3c60a1d63ad81c65210cfd0_NeikiAnalytics.exe 28 PID 880 wrote to memory of 1732 880 43e4b1e7f3c60a1d63ad81c65210cfd0_NeikiAnalytics.exe 28 PID 1732 wrote to memory of 2540 1732 ttbhhb.exe 29 PID 1732 wrote to memory of 2540 1732 ttbhhb.exe 29 PID 1732 wrote to memory of 2540 1732 ttbhhb.exe 29 PID 1732 wrote to memory of 2540 1732 ttbhhb.exe 29 PID 2540 wrote to memory of 2684 2540 9ppvp.exe 30 PID 2540 wrote to memory of 2684 2540 9ppvp.exe 30 PID 2540 wrote to memory of 2684 2540 9ppvp.exe 30 PID 2540 wrote to memory of 2684 2540 9ppvp.exe 30 PID 2684 wrote to memory of 2572 2684 xlflrxr.exe 31 PID 2684 wrote to memory of 2572 2684 xlflrxr.exe 31 PID 2684 wrote to memory of 2572 2684 xlflrxr.exe 31 PID 2684 wrote to memory of 2572 2684 xlflrxr.exe 31 PID 2572 wrote to memory of 2564 2572 nhntbh.exe 32 PID 2572 wrote to memory of 2564 2572 nhntbh.exe 32 PID 2572 wrote to memory of 2564 2572 nhntbh.exe 32 PID 2572 wrote to memory of 2564 2572 nhntbh.exe 32 PID 2564 wrote to memory of 2916 2564 pjpdp.exe 33 PID 2564 wrote to memory of 2916 2564 pjpdp.exe 33 PID 2564 wrote to memory of 2916 2564 pjpdp.exe 33 PID 2564 wrote to memory of 2916 2564 pjpdp.exe 33 PID 2916 wrote to memory of 2444 2916 frfffxx.exe 34 PID 2916 wrote to memory of 2444 2916 frfffxx.exe 34 PID 2916 wrote to memory of 2444 2916 frfffxx.exe 34 PID 2916 wrote to memory of 2444 2916 frfffxx.exe 34 PID 2444 wrote to memory of 2344 2444 lrrfxll.exe 35 PID 2444 wrote to memory of 2344 2444 lrrfxll.exe 35 PID 2444 wrote to memory of 2344 2444 lrrfxll.exe 35 PID 2444 wrote to memory of 2344 2444 lrrfxll.exe 35 PID 2344 wrote to memory of 2000 2344 nhthnh.exe 36 PID 2344 wrote to memory of 2000 2344 nhthnh.exe 36 PID 2344 wrote to memory of 2000 2344 nhthnh.exe 36 PID 2344 wrote to memory of 2000 2344 nhthnh.exe 36 PID 2000 wrote to memory of 2624 2000 vpdjp.exe 37 PID 2000 wrote to memory of 2624 2000 vpdjp.exe 37 PID 2000 wrote to memory of 2624 2000 vpdjp.exe 37 PID 2000 wrote to memory of 2624 2000 vpdjp.exe 37 PID 2624 wrote to memory of 2876 2624 flxrfrf.exe 38 PID 2624 wrote to memory of 2876 2624 flxrfrf.exe 38 PID 2624 wrote to memory of 2876 2624 flxrfrf.exe 38 PID 2624 wrote to memory of 2876 2624 flxrfrf.exe 38 PID 2876 wrote to memory of 1676 2876 lfrxlff.exe 39 PID 2876 wrote to memory of 1676 2876 lfrxlff.exe 39 PID 2876 wrote to memory of 1676 2876 lfrxlff.exe 39 PID 2876 wrote to memory of 1676 2876 lfrxlff.exe 39 PID 1676 wrote to memory of 2360 1676 5tnbhh.exe 40 PID 1676 wrote to memory of 2360 1676 5tnbhh.exe 40 PID 1676 wrote to memory of 2360 1676 5tnbhh.exe 40 PID 1676 wrote to memory of 2360 1676 5tnbhh.exe 40 PID 2360 wrote to memory of 1828 2360 3dpdj.exe 41 PID 2360 wrote to memory of 1828 2360 3dpdj.exe 41 PID 2360 wrote to memory of 1828 2360 3dpdj.exe 41 PID 2360 wrote to memory of 1828 2360 3dpdj.exe 41 PID 1828 wrote to memory of 2336 1828 dvdpv.exe 42 PID 1828 wrote to memory of 2336 1828 dvdpv.exe 42 PID 1828 wrote to memory of 2336 1828 dvdpv.exe 42 PID 1828 wrote to memory of 2336 1828 dvdpv.exe 42 PID 2336 wrote to memory of 780 2336 xlfllfl.exe 43 PID 2336 wrote to memory of 780 2336 xlfllfl.exe 43 PID 2336 wrote to memory of 780 2336 xlfllfl.exe 43 PID 2336 wrote to memory of 780 2336 xlfllfl.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\43e4b1e7f3c60a1d63ad81c65210cfd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\43e4b1e7f3c60a1d63ad81c65210cfd0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\ttbhhb.exec:\ttbhhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\9ppvp.exec:\9ppvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\xlflrxr.exec:\xlflrxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\nhntbh.exec:\nhntbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\pjpdp.exec:\pjpdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\frfffxx.exec:\frfffxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\lrrfxll.exec:\lrrfxll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\nhthnh.exec:\nhthnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\vpdjp.exec:\vpdjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\flxrfrf.exec:\flxrfrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\lfrxlff.exec:\lfrxlff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\5tnbhh.exec:\5tnbhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\3dpdj.exec:\3dpdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\dvdpv.exec:\dvdpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\xlfllfl.exec:\xlfllfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\nnbhnh.exec:\nnbhnh.exe17⤵
- Executes dropped EXE
PID:780 -
\??\c:\vjddp.exec:\vjddp.exe18⤵
- Executes dropped EXE
PID:344 -
\??\c:\pvvjv.exec:\pvvjv.exe19⤵
- Executes dropped EXE
PID:2320 -
\??\c:\frlxxlr.exec:\frlxxlr.exe20⤵
- Executes dropped EXE
PID:1704 -
\??\c:\xlrxlxl.exec:\xlrxlxl.exe21⤵
- Executes dropped EXE
PID:2952 -
\??\c:\tbhnhn.exec:\tbhnhn.exe22⤵
- Executes dropped EXE
PID:2100 -
\??\c:\7vpjd.exec:\7vpjd.exe23⤵
- Executes dropped EXE
PID:560 -
\??\c:\vpdjv.exec:\vpdjv.exe24⤵
- Executes dropped EXE
PID:596 -
\??\c:\xrlrxff.exec:\xrlrxff.exe25⤵
- Executes dropped EXE
PID:1160 -
\??\c:\hbnntt.exec:\hbnntt.exe26⤵
- Executes dropped EXE
PID:1796 -
\??\c:\bbtthh.exec:\bbtthh.exe27⤵
- Executes dropped EXE
PID:1352 -
\??\c:\vvjdv.exec:\vvjdv.exe28⤵
- Executes dropped EXE
PID:1948 -
\??\c:\rllrffr.exec:\rllrffr.exe29⤵
- Executes dropped EXE
PID:944 -
\??\c:\bnthbh.exec:\bnthbh.exe30⤵
- Executes dropped EXE
PID:1036 -
\??\c:\nhnnbn.exec:\nhnnbn.exe31⤵
- Executes dropped EXE
PID:2116 -
\??\c:\pjppd.exec:\pjppd.exe32⤵
- Executes dropped EXE
PID:1516 -
\??\c:\lfffrxx.exec:\lfffrxx.exe33⤵
- Executes dropped EXE
PID:2252 -
\??\c:\3htbbh.exec:\3htbbh.exe34⤵
- Executes dropped EXE
PID:2228 -
\??\c:\jdvvd.exec:\jdvvd.exe35⤵
- Executes dropped EXE
PID:1740 -
\??\c:\ddpvj.exec:\ddpvj.exe36⤵
- Executes dropped EXE
PID:3000 -
\??\c:\1xrllxx.exec:\1xrllxx.exe37⤵
- Executes dropped EXE
PID:1548 -
\??\c:\3rllrrl.exec:\3rllrrl.exe38⤵
- Executes dropped EXE
PID:2652 -
\??\c:\tnhntb.exec:\tnhntb.exe39⤵
- Executes dropped EXE
PID:2684 -
\??\c:\htbbnn.exec:\htbbnn.exe40⤵
- Executes dropped EXE
PID:2724 -
\??\c:\7djvj.exec:\7djvj.exe41⤵
- Executes dropped EXE
PID:2748 -
\??\c:\9pdpv.exec:\9pdpv.exe42⤵
- Executes dropped EXE
PID:2620 -
\??\c:\rrffllr.exec:\rrffllr.exe43⤵
- Executes dropped EXE
PID:2468 -
\??\c:\rxlrflr.exec:\rxlrflr.exe44⤵
- Executes dropped EXE
PID:2524 -
\??\c:\hbnthh.exec:\hbnthh.exe45⤵
- Executes dropped EXE
PID:2888 -
\??\c:\nhnnbn.exec:\nhnnbn.exe46⤵
- Executes dropped EXE
PID:2200 -
\??\c:\pdpjd.exec:\pdpjd.exe47⤵
- Executes dropped EXE
PID:2732 -
\??\c:\ddppd.exec:\ddppd.exe48⤵
- Executes dropped EXE
PID:2676 -
\??\c:\xrflrrx.exec:\xrflrrx.exe49⤵
- Executes dropped EXE
PID:2744 -
\??\c:\lxxxflx.exec:\lxxxflx.exe50⤵
- Executes dropped EXE
PID:2356 -
\??\c:\btbtbb.exec:\btbtbb.exe51⤵
- Executes dropped EXE
PID:1676 -
\??\c:\nthnnb.exec:\nthnnb.exe52⤵
- Executes dropped EXE
PID:2372 -
\??\c:\vppjj.exec:\vppjj.exe53⤵
- Executes dropped EXE
PID:2272 -
\??\c:\jjddd.exec:\jjddd.exe54⤵
- Executes dropped EXE
PID:2104 -
\??\c:\rfrlfff.exec:\rfrlfff.exe55⤵
- Executes dropped EXE
PID:328 -
\??\c:\xrllrlx.exec:\xrllrlx.exe56⤵
- Executes dropped EXE
PID:2244 -
\??\c:\ntnttt.exec:\ntnttt.exe57⤵
- Executes dropped EXE
PID:2284 -
\??\c:\hhnhhh.exec:\hhnhhh.exe58⤵
- Executes dropped EXE
PID:1988 -
\??\c:\pjdjv.exec:\pjdjv.exe59⤵
- Executes dropped EXE
PID:2328 -
\??\c:\vvvdj.exec:\vvvdj.exe60⤵
- Executes dropped EXE
PID:2804 -
\??\c:\xxrxfrr.exec:\xxrxfrr.exe61⤵
- Executes dropped EXE
PID:484 -
\??\c:\3fllxxr.exec:\3fllxxr.exe62⤵
- Executes dropped EXE
PID:576 -
\??\c:\7bhnbb.exec:\7bhnbb.exe63⤵
- Executes dropped EXE
PID:1500 -
\??\c:\7nntbh.exec:\7nntbh.exe64⤵
- Executes dropped EXE
PID:588 -
\??\c:\ppjvj.exec:\ppjvj.exe65⤵
- Executes dropped EXE
PID:2132 -
\??\c:\jppvj.exec:\jppvj.exe66⤵PID:1020
-
\??\c:\rfflflf.exec:\rfflflf.exe67⤵PID:1884
-
\??\c:\xrfrllx.exec:\xrfrllx.exe68⤵PID:1636
-
\??\c:\tbhbhn.exec:\tbhbhn.exe69⤵PID:2980
-
\??\c:\nhhhhn.exec:\nhhhhn.exe70⤵PID:2264
-
\??\c:\dvjdd.exec:\dvjdd.exe71⤵PID:3008
-
\??\c:\pjjdp.exec:\pjjdp.exe72⤵PID:1640
-
\??\c:\lflrlll.exec:\lflrlll.exe73⤵PID:1512
-
\??\c:\ttnnhn.exec:\ttnnhn.exe74⤵PID:1816
-
\??\c:\tnnbbh.exec:\tnnbbh.exe75⤵PID:2836
-
\??\c:\jdvdp.exec:\jdvdp.exe76⤵PID:1620
-
\??\c:\5vpdd.exec:\5vpdd.exe77⤵PID:1724
-
\??\c:\lrflfll.exec:\lrflfll.exe78⤵PID:1264
-
\??\c:\5hbnnb.exec:\5hbnnb.exe79⤵PID:2716
-
\??\c:\tbhttn.exec:\tbhttn.exe80⤵PID:2664
-
\??\c:\pjjdd.exec:\pjjdd.exe81⤵PID:2600
-
\??\c:\pjppj.exec:\pjppj.exe82⤵PID:2572
-
\??\c:\fxllrrf.exec:\fxllrrf.exe83⤵PID:2472
-
\??\c:\rrxflxr.exec:\rrxflxr.exe84⤵PID:2748
-
\??\c:\3nbhhh.exec:\3nbhhh.exe85⤵PID:2560
-
\??\c:\hnthbn.exec:\hnthbn.exe86⤵PID:2920
-
\??\c:\jjdjd.exec:\jjdjd.exe87⤵PID:1032
-
\??\c:\vpjjv.exec:\vpjjv.exe88⤵PID:1920
-
\??\c:\frffxfl.exec:\frffxfl.exe89⤵PID:2536
-
\??\c:\9bntbh.exec:\9bntbh.exe90⤵PID:2976
-
\??\c:\nhnttt.exec:\nhnttt.exe91⤵PID:2340
-
\??\c:\dpdvd.exec:\dpdvd.exe92⤵PID:1808
-
\??\c:\3vdjd.exec:\3vdjd.exe93⤵PID:2240
-
\??\c:\dpjpd.exec:\dpjpd.exe94⤵PID:1812
-
\??\c:\lflrxxr.exec:\lflrxxr.exe95⤵PID:1824
-
\??\c:\xrflrrx.exec:\xrflrrx.exe96⤵PID:2336
-
\??\c:\tnhnbb.exec:\tnhnbb.exe97⤵PID:1776
-
\??\c:\vjjdv.exec:\vjjdv.exe98⤵PID:1696
-
\??\c:\jdppv.exec:\jdppv.exe99⤵PID:2280
-
\??\c:\7lffflr.exec:\7lffflr.exe100⤵PID:2428
-
\??\c:\lxfffxf.exec:\lxfffxf.exe101⤵PID:2112
-
\??\c:\bhnhnt.exec:\bhnhnt.exe102⤵PID:536
-
\??\c:\nhhhtt.exec:\nhhhtt.exe103⤵PID:808
-
\??\c:\ppvdp.exec:\ppvdp.exe104⤵PID:700
-
\??\c:\9jdpv.exec:\9jdpv.exe105⤵PID:1664
-
\??\c:\lfrxxrf.exec:\lfrxxrf.exe106⤵PID:1852
-
\??\c:\nhtbtt.exec:\nhtbtt.exe107⤵PID:620
-
\??\c:\hhbnhn.exec:\hhbnhn.exe108⤵PID:1712
-
\??\c:\3dppp.exec:\3dppp.exe109⤵PID:1632
-
\??\c:\pdjdd.exec:\pdjdd.exe110⤵PID:1940
-
\??\c:\rfllrxf.exec:\rfllrxf.exe111⤵PID:1636
-
\??\c:\fflxlfx.exec:\fflxlfx.exe112⤵PID:2980
-
\??\c:\htntbb.exec:\htntbb.exe113⤵PID:2996
-
\??\c:\7htnnn.exec:\7htnnn.exe114⤵PID:1756
-
\??\c:\ppddj.exec:\ppddj.exe115⤵PID:376
-
\??\c:\pvdpj.exec:\pvdpj.exe116⤵PID:1688
-
\??\c:\1htbtt.exec:\1htbtt.exe117⤵PID:2252
-
\??\c:\5bnbbn.exec:\5bnbbn.exe118⤵PID:2836
-
\??\c:\pdpjd.exec:\pdpjd.exe119⤵PID:3040
-
\??\c:\dvddj.exec:\dvddj.exe120⤵PID:3000
-
\??\c:\5xxxffl.exec:\5xxxffl.exe121⤵PID:1264
-
\??\c:\xrflxfl.exec:\xrflxfl.exe122⤵PID:2580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-