Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
04-06-2024 22:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0ba969ec7a2b428b3bc4ad47e3709700_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0ba969ec7a2b428b3bc4ad47e3709700_NeikiAnalytics.exe
-
Size
146KB
-
MD5
0ba969ec7a2b428b3bc4ad47e3709700
-
SHA1
71a960e96a9ce7a48e49940a78719d2c1ff61511
-
SHA256
774c54e1cb3a8b7a74bf6650bf9a40dd6ea07e02dcf07703110bc45928d956b6
-
SHA512
a16e19e0c6983c699d313ce204371401cd3a8c95e452d353cb686244167cda21c1077d14f6141ad45b9d08b5d100607715d22208fb8f3634c8552b4c96aabb1f
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp9gFbctg0IyAyhZvjDUOy/nmPmT9se4:n3C9BRo7tvnJ9oH0IRgZvjDhy+Pmxse4
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral1/memory/3012-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1912-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-30-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-41-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3032-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-66-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1512-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1592-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/348-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2076-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1764-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/300-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/812-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1032-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-2970-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1912 tbbbbt.exe 3032 jdjdj.exe 2672 lfffrlr.exe 2596 rxfxlrl.exe 2652 rrlxlrf.exe 2516 3frxrrr.exe 2536 jdpdp.exe 2636 rffxlff.exe 1512 nthnnb.exe 1592 vjdpd.exe 2708 xrflxxf.exe 2412 ffrfffr.exe 2360 nnhntb.exe 348 jpdvd.exe 1664 vvdjv.exe 1860 flffrxl.exe 2788 hhbbnn.exe 2928 3vpvd.exe 2220 rlxrxfr.exe 2056 3ffxflx.exe 2076 bthhnt.exe 688 ddvdp.exe 1764 rlrlrrf.exe 300 tnhhbh.exe 2408 1vvvv.exe 812 dvpdp.exe 900 1rxrxxr.exe 1032 nnbhtn.exe 2064 vvjpd.exe 2944 7lfrfxl.exe 892 nhtbtt.exe 2892 bthtnn.exe 2292 dpddp.exe 1504 rlrrfff.exe 3032 7rxfxfr.exe 2644 btnntt.exe 2616 7nbnhh.exe 2748 5vdpv.exe 2772 dpvvd.exe 2468 1rlxflx.exe 2504 xlfrflf.exe 2492 bbhhnb.exe 2908 hnthtn.exe 2920 pjvpv.exe 2352 dvpdp.exe 1628 rfrxffr.exe 2448 lxfrrlf.exe 2724 nhbbhn.exe 756 7pjpv.exe 2376 pppdv.exe 1544 fxxfxfr.exe 1888 lxflrxf.exe 1892 5nthtt.exe 1844 tnbhbb.exe 1860 ppdpv.exe 1432 ddvvj.exe 2088 frllrxl.exe 2212 rfxxxfl.exe 1820 nhnhnt.exe 2032 btnntb.exe 1660 jdddp.exe 2440 vvddd.exe 2704 xxrxlrf.exe 608 fxrrffx.exe -
resource yara_rule behavioral1/memory/3012-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1912-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1512-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1592-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/348-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2076-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1764-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/300-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/812-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1032-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-2970-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3012 wrote to memory of 1912 3012 0ba969ec7a2b428b3bc4ad47e3709700_NeikiAnalytics.exe 28 PID 3012 wrote to memory of 1912 3012 0ba969ec7a2b428b3bc4ad47e3709700_NeikiAnalytics.exe 28 PID 3012 wrote to memory of 1912 3012 0ba969ec7a2b428b3bc4ad47e3709700_NeikiAnalytics.exe 28 PID 3012 wrote to memory of 1912 3012 0ba969ec7a2b428b3bc4ad47e3709700_NeikiAnalytics.exe 28 PID 1912 wrote to memory of 3032 1912 tbbbbt.exe 29 PID 1912 wrote to memory of 3032 1912 tbbbbt.exe 29 PID 1912 wrote to memory of 3032 1912 tbbbbt.exe 29 PID 1912 wrote to memory of 3032 1912 tbbbbt.exe 29 PID 3032 wrote to memory of 2672 3032 jdjdj.exe 30 PID 3032 wrote to memory of 2672 3032 jdjdj.exe 30 PID 3032 wrote to memory of 2672 3032 jdjdj.exe 30 PID 3032 wrote to memory of 2672 3032 jdjdj.exe 30 PID 2672 wrote to memory of 2596 2672 lfffrlr.exe 31 PID 2672 wrote to memory of 2596 2672 lfffrlr.exe 31 PID 2672 wrote to memory of 2596 2672 lfffrlr.exe 31 PID 2672 wrote to memory of 2596 2672 lfffrlr.exe 31 PID 2596 wrote to memory of 2652 2596 rxfxlrl.exe 32 PID 2596 wrote to memory of 2652 2596 rxfxlrl.exe 32 PID 2596 wrote to memory of 2652 2596 rxfxlrl.exe 32 PID 2596 wrote to memory of 2652 2596 rxfxlrl.exe 32 PID 2652 wrote to memory of 2516 2652 rrlxlrf.exe 33 PID 2652 wrote to memory of 2516 2652 rrlxlrf.exe 33 PID 2652 wrote to memory of 2516 2652 rrlxlrf.exe 33 PID 2652 wrote to memory of 2516 2652 rrlxlrf.exe 33 PID 2516 wrote to memory of 2536 2516 3frxrrr.exe 34 PID 2516 wrote to memory of 2536 2516 3frxrrr.exe 34 PID 2516 wrote to memory of 2536 2516 3frxrrr.exe 34 PID 2516 wrote to memory of 2536 2516 3frxrrr.exe 34 PID 2536 wrote to memory of 2636 2536 jdpdp.exe 35 PID 2536 wrote to memory of 2636 2536 jdpdp.exe 35 PID 2536 wrote to memory of 2636 2536 jdpdp.exe 35 PID 2536 wrote to memory of 2636 2536 jdpdp.exe 35 PID 2636 wrote to memory of 1512 2636 rffxlff.exe 36 PID 2636 wrote to memory of 1512 2636 rffxlff.exe 36 PID 2636 wrote to memory of 1512 2636 rffxlff.exe 36 PID 2636 wrote to memory of 1512 2636 rffxlff.exe 36 PID 1512 wrote to memory of 1592 1512 nthnnb.exe 37 PID 1512 wrote to memory of 1592 1512 nthnnb.exe 37 PID 1512 wrote to memory of 1592 1512 nthnnb.exe 37 PID 1512 wrote to memory of 1592 1512 nthnnb.exe 37 PID 1592 wrote to memory of 2708 1592 vjdpd.exe 38 PID 1592 wrote to memory of 2708 1592 vjdpd.exe 38 PID 1592 wrote to memory of 2708 1592 vjdpd.exe 38 PID 1592 wrote to memory of 2708 1592 vjdpd.exe 38 PID 2708 wrote to memory of 2412 2708 xrflxxf.exe 39 PID 2708 wrote to memory of 2412 2708 xrflxxf.exe 39 PID 2708 wrote to memory of 2412 2708 xrflxxf.exe 39 PID 2708 wrote to memory of 2412 2708 xrflxxf.exe 39 PID 2412 wrote to memory of 2360 2412 ffrfffr.exe 40 PID 2412 wrote to memory of 2360 2412 ffrfffr.exe 40 PID 2412 wrote to memory of 2360 2412 ffrfffr.exe 40 PID 2412 wrote to memory of 2360 2412 ffrfffr.exe 40 PID 2360 wrote to memory of 348 2360 nnhntb.exe 41 PID 2360 wrote to memory of 348 2360 nnhntb.exe 41 PID 2360 wrote to memory of 348 2360 nnhntb.exe 41 PID 2360 wrote to memory of 348 2360 nnhntb.exe 41 PID 348 wrote to memory of 1664 348 jpdvd.exe 42 PID 348 wrote to memory of 1664 348 jpdvd.exe 42 PID 348 wrote to memory of 1664 348 jpdvd.exe 42 PID 348 wrote to memory of 1664 348 jpdvd.exe 42 PID 1664 wrote to memory of 1860 1664 vvdjv.exe 43 PID 1664 wrote to memory of 1860 1664 vvdjv.exe 43 PID 1664 wrote to memory of 1860 1664 vvdjv.exe 43 PID 1664 wrote to memory of 1860 1664 vvdjv.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ba969ec7a2b428b3bc4ad47e3709700_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0ba969ec7a2b428b3bc4ad47e3709700_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\tbbbbt.exec:\tbbbbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\jdjdj.exec:\jdjdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\lfffrlr.exec:\lfffrlr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\rxfxlrl.exec:\rxfxlrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\rrlxlrf.exec:\rrlxlrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\3frxrrr.exec:\3frxrrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\jdpdp.exec:\jdpdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\rffxlff.exec:\rffxlff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\nthnnb.exec:\nthnnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\vjdpd.exec:\vjdpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\xrflxxf.exec:\xrflxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\ffrfffr.exec:\ffrfffr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\nnhntb.exec:\nnhntb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\jpdvd.exec:\jpdvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\vvdjv.exec:\vvdjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\flffrxl.exec:\flffrxl.exe17⤵
- Executes dropped EXE
PID:1860 -
\??\c:\hhbbnn.exec:\hhbbnn.exe18⤵
- Executes dropped EXE
PID:2788 -
\??\c:\3vpvd.exec:\3vpvd.exe19⤵
- Executes dropped EXE
PID:2928 -
\??\c:\rlxrxfr.exec:\rlxrxfr.exe20⤵
- Executes dropped EXE
PID:2220 -
\??\c:\3ffxflx.exec:\3ffxflx.exe21⤵
- Executes dropped EXE
PID:2056 -
\??\c:\bthhnt.exec:\bthhnt.exe22⤵
- Executes dropped EXE
PID:2076 -
\??\c:\ddvdp.exec:\ddvdp.exe23⤵
- Executes dropped EXE
PID:688 -
\??\c:\rlrlrrf.exec:\rlrlrrf.exe24⤵
- Executes dropped EXE
PID:1764 -
\??\c:\tnhhbh.exec:\tnhhbh.exe25⤵
- Executes dropped EXE
PID:300 -
\??\c:\1vvvv.exec:\1vvvv.exe26⤵
- Executes dropped EXE
PID:2408 -
\??\c:\dvpdp.exec:\dvpdp.exe27⤵
- Executes dropped EXE
PID:812 -
\??\c:\1rxrxxr.exec:\1rxrxxr.exe28⤵
- Executes dropped EXE
PID:900 -
\??\c:\nnbhtn.exec:\nnbhtn.exe29⤵
- Executes dropped EXE
PID:1032 -
\??\c:\vvjpd.exec:\vvjpd.exe30⤵
- Executes dropped EXE
PID:2064 -
\??\c:\7lfrfxl.exec:\7lfrfxl.exe31⤵
- Executes dropped EXE
PID:2944 -
\??\c:\nhtbtt.exec:\nhtbtt.exe32⤵
- Executes dropped EXE
PID:892 -
\??\c:\bthtnn.exec:\bthtnn.exe33⤵
- Executes dropped EXE
PID:2892 -
\??\c:\dpddp.exec:\dpddp.exe34⤵
- Executes dropped EXE
PID:2292 -
\??\c:\rlrrfff.exec:\rlrrfff.exe35⤵
- Executes dropped EXE
PID:1504 -
\??\c:\7rxfxfr.exec:\7rxfxfr.exe36⤵
- Executes dropped EXE
PID:3032 -
\??\c:\btnntt.exec:\btnntt.exe37⤵
- Executes dropped EXE
PID:2644 -
\??\c:\7nbnhh.exec:\7nbnhh.exe38⤵
- Executes dropped EXE
PID:2616 -
\??\c:\5vdpv.exec:\5vdpv.exe39⤵
- Executes dropped EXE
PID:2748 -
\??\c:\dpvvd.exec:\dpvvd.exe40⤵
- Executes dropped EXE
PID:2772 -
\??\c:\1rlxflx.exec:\1rlxflx.exe41⤵
- Executes dropped EXE
PID:2468 -
\??\c:\xlfrflf.exec:\xlfrflf.exe42⤵
- Executes dropped EXE
PID:2504 -
\??\c:\bbhhnb.exec:\bbhhnb.exe43⤵
- Executes dropped EXE
PID:2492 -
\??\c:\hnthtn.exec:\hnthtn.exe44⤵
- Executes dropped EXE
PID:2908 -
\??\c:\pjvpv.exec:\pjvpv.exe45⤵
- Executes dropped EXE
PID:2920 -
\??\c:\dvpdp.exec:\dvpdp.exe46⤵
- Executes dropped EXE
PID:2352 -
\??\c:\rfrxffr.exec:\rfrxffr.exe47⤵
- Executes dropped EXE
PID:1628 -
\??\c:\lxfrrlf.exec:\lxfrrlf.exe48⤵
- Executes dropped EXE
PID:2448 -
\??\c:\nhbbhn.exec:\nhbbhn.exe49⤵
- Executes dropped EXE
PID:2724 -
\??\c:\7pjpv.exec:\7pjpv.exe50⤵
- Executes dropped EXE
PID:756 -
\??\c:\pppdv.exec:\pppdv.exe51⤵
- Executes dropped EXE
PID:2376 -
\??\c:\fxxfxfr.exec:\fxxfxfr.exe52⤵
- Executes dropped EXE
PID:1544 -
\??\c:\lxflrxf.exec:\lxflrxf.exe53⤵
- Executes dropped EXE
PID:1888 -
\??\c:\5nthtt.exec:\5nthtt.exe54⤵
- Executes dropped EXE
PID:1892 -
\??\c:\tnbhbb.exec:\tnbhbb.exe55⤵
- Executes dropped EXE
PID:1844 -
\??\c:\ppdpv.exec:\ppdpv.exe56⤵
- Executes dropped EXE
PID:1860 -
\??\c:\ddvvj.exec:\ddvvj.exe57⤵
- Executes dropped EXE
PID:1432 -
\??\c:\frllrxl.exec:\frllrxl.exe58⤵
- Executes dropped EXE
PID:2088 -
\??\c:\rfxxxfl.exec:\rfxxxfl.exe59⤵
- Executes dropped EXE
PID:2212 -
\??\c:\nhnhnt.exec:\nhnhnt.exe60⤵
- Executes dropped EXE
PID:1820 -
\??\c:\btnntb.exec:\btnntb.exe61⤵
- Executes dropped EXE
PID:2032 -
\??\c:\jdddp.exec:\jdddp.exe62⤵
- Executes dropped EXE
PID:1660 -
\??\c:\vvddd.exec:\vvddd.exe63⤵
- Executes dropped EXE
PID:2440 -
\??\c:\xxrxlrf.exec:\xxrxlrf.exe64⤵
- Executes dropped EXE
PID:2704 -
\??\c:\fxrrffx.exec:\fxrrffx.exe65⤵
- Executes dropped EXE
PID:608 -
\??\c:\hthhtt.exec:\hthhtt.exe66⤵PID:3052
-
\??\c:\pjpvp.exec:\pjpvp.exe67⤵PID:3060
-
\??\c:\vjppj.exec:\vjppj.exe68⤵PID:3064
-
\??\c:\fxfflrx.exec:\fxfflrx.exe69⤵PID:848
-
\??\c:\lfxrfrl.exec:\lfxrfrl.exe70⤵PID:2836
-
\??\c:\tnhhtt.exec:\tnhhtt.exe71⤵PID:2864
-
\??\c:\bbnthn.exec:\bbnthn.exe72⤵PID:2064
-
\??\c:\3pddd.exec:\3pddd.exe73⤵PID:2932
-
\??\c:\1xrfrxf.exec:\1xrfrxf.exe74⤵PID:2392
-
\??\c:\frffxrl.exec:\frffxrl.exe75⤵PID:2872
-
\??\c:\ttnbtt.exec:\ttnbtt.exe76⤵PID:2892
-
\??\c:\tbhtbt.exec:\tbhtbt.exe77⤵PID:2292
-
\??\c:\jdvjp.exec:\jdvjp.exe78⤵PID:2780
-
\??\c:\5xrllrf.exec:\5xrllrf.exe79⤵PID:2736
-
\??\c:\xxrfrxl.exec:\xxrfrxl.exe80⤵PID:2984
-
\??\c:\tthnbb.exec:\tthnbb.exe81⤵PID:2616
-
\??\c:\hbtthn.exec:\hbtthn.exe82⤵PID:2832
-
\??\c:\dvjdj.exec:\dvjdj.exe83⤵PID:2460
-
\??\c:\dppvp.exec:\dppvp.exe84⤵PID:2596
-
\??\c:\xxrxflx.exec:\xxrxflx.exe85⤵PID:2504
-
\??\c:\nhthnn.exec:\nhthnn.exe86⤵PID:2512
-
\??\c:\tnbbtt.exec:\tnbbtt.exe87⤵PID:2908
-
\??\c:\dvjvj.exec:\dvjvj.exe88⤵PID:2924
-
\??\c:\fxxxllx.exec:\fxxxllx.exe89⤵PID:2352
-
\??\c:\rrlfxlx.exec:\rrlfxlx.exe90⤵PID:1632
-
\??\c:\nhnntb.exec:\nhnntb.exe91⤵PID:2532
-
\??\c:\hbtbhh.exec:\hbtbhh.exe92⤵PID:1772
-
\??\c:\dpppv.exec:\dpppv.exe93⤵PID:756
-
\??\c:\lrffflr.exec:\lrffflr.exe94⤵PID:1668
-
\??\c:\lfxlrxf.exec:\lfxlrxf.exe95⤵PID:1544
-
\??\c:\9nnbth.exec:\9nnbth.exe96⤵PID:1900
-
\??\c:\pdjdj.exec:\pdjdj.exe97⤵PID:1428
-
\??\c:\jdddp.exec:\jdddp.exe98⤵PID:1624
-
\??\c:\xrrrffl.exec:\xrrrffl.exe99⤵PID:2916
-
\??\c:\hbtbbh.exec:\hbtbbh.exe100⤵PID:2788
-
\??\c:\btntbt.exec:\btntbt.exe101⤵PID:2800
-
\??\c:\7jvpv.exec:\7jvpv.exe102⤵PID:2224
-
\??\c:\rlfxflf.exec:\rlfxflf.exe103⤵PID:2240
-
\??\c:\7fxrrfr.exec:\7fxrrfr.exe104⤵PID:2056
-
\??\c:\7tnbhn.exec:\7tnbhn.exe105⤵PID:1660
-
\??\c:\vpddp.exec:\vpddp.exe106⤵PID:1720
-
\??\c:\djjjv.exec:\djjjv.exe107⤵PID:2704
-
\??\c:\xflrllf.exec:\xflrllf.exe108⤵PID:1684
-
\??\c:\htnnth.exec:\htnnth.exe109⤵PID:3052
-
\??\c:\tbtbnt.exec:\tbtbnt.exe110⤵PID:1232
-
\??\c:\5pjpd.exec:\5pjpd.exe111⤵PID:3064
-
\??\c:\pjddv.exec:\pjddv.exe112⤵PID:900
-
\??\c:\rllfrxl.exec:\rllfrxl.exe113⤵PID:2836
-
\??\c:\rrfrlrx.exec:\rrfrlrx.exe114⤵PID:780
-
\??\c:\hhtthh.exec:\hhtthh.exe115⤵PID:2260
-
\??\c:\5nnhbn.exec:\5nnhbn.exe116⤵PID:880
-
\??\c:\7pppj.exec:\7pppj.exe117⤵PID:2392
-
\??\c:\jjdpd.exec:\jjdpd.exe118⤵PID:1508
-
\??\c:\btnnbn.exec:\btnnbn.exe119⤵PID:1912
-
\??\c:\vpjdv.exec:\vpjdv.exe120⤵PID:2608
-
\??\c:\rrflxxl.exec:\rrflxxl.exe121⤵PID:3032
-
\??\c:\hhhnbb.exec:\hhhnbb.exe122⤵PID:2656
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-