Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
07/06/2024, 21:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6d7110d1c3a480c33ae4da35d2963d30_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
6d7110d1c3a480c33ae4da35d2963d30_NeikiAnalytics.exe
-
Size
387KB
-
MD5
6d7110d1c3a480c33ae4da35d2963d30
-
SHA1
784eec1aa5be81b6f426d8a34d71b788a55768af
-
SHA256
7b45a7c79e23dafa99936e4bc34aa24f96cd210724a2759aa20d326f298fc548
-
SHA512
471353f67da6f6ebcb176d346c9a44be6f0f091b8f4586f00bf759e92094dfe5749b4449f21f8c8a740d98bba28978d53ee066a5eb9176a6d9bfb16c6e5b5a68
-
SSDEEP
12288:n3C9ytvngQjpUXoSWlnwJv90aKToFqwfm:SgdnJVU4TlnwJ6GoD
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/1740-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/820-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2068-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/908-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1680-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/904-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/604-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2236-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1604-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1120-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/564-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/576-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1052-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/952-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1320-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/912-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2928 pjddp.exe 2924 xrxxxxx.exe 2156 vpvvd.exe 2676 lfrxxxf.exe 2572 thntnh.exe 2708 frxflrr.exe 2568 ffxrffl.exe 2444 ttbhbh.exe 2704 jdvdp.exe 820 5flrlxl.exe 2728 tnthht.exe 2068 dvppp.exe 908 rllfxll.exe 1680 ppvvj.exe 904 jdjdv.exe 2176 lfxxlfl.exe 604 hhnhbn.exe 2236 vjppv.exe 1604 nbnnhh.exe 3000 pjddj.exe 748 9flllfx.exe 1120 9htbhh.exe 2060 7pvpp.exe 564 7llxfxr.exe 576 1hhbhn.exe 1052 9httbh.exe 952 9fxxxxf.exe 1320 3nhntt.exe 1720 jvvpd.exe 912 hbbhbt.exe 2036 vpdvj.exe 1976 xfrfffl.exe 1744 btbntt.exe 2612 jjpdj.exe 3024 frflllx.exe 2680 fxrrxfr.exe 2696 5ntnnh.exe 2648 9pvpv.exe 2800 7xflxrf.exe 2452 rlflxxl.exe 2776 hbthnn.exe 2596 vpddp.exe 2936 jjjjp.exe 2892 lfxfxxl.exe 1688 hbttbt.exe 2724 hbbbhh.exe 1796 jdpdp.exe 2068 pjjjv.exe 1332 xxrxflf.exe 1652 ttnbhn.exe 2320 hbntbh.exe 1832 3vppd.exe 596 fxrrrrf.exe 612 nhhnhn.exe 1224 hbtbhb.exe 1516 9vjjd.exe 3064 pjvvj.exe 2904 rlffllr.exe 2880 bthbnh.exe 2268 3tnbhn.exe 2112 jdpdj.exe 1412 lfrrfff.exe 1872 1xllrxx.exe 412 hhthhb.exe -
resource yara_rule behavioral1/memory/1740-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/820-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/908-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1680-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/904-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/604-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1604-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1120-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/564-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/576-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1052-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/952-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1320-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/912-290-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1740 wrote to memory of 2928 1740 6d7110d1c3a480c33ae4da35d2963d30_NeikiAnalytics.exe 28 PID 1740 wrote to memory of 2928 1740 6d7110d1c3a480c33ae4da35d2963d30_NeikiAnalytics.exe 28 PID 1740 wrote to memory of 2928 1740 6d7110d1c3a480c33ae4da35d2963d30_NeikiAnalytics.exe 28 PID 1740 wrote to memory of 2928 1740 6d7110d1c3a480c33ae4da35d2963d30_NeikiAnalytics.exe 28 PID 2928 wrote to memory of 2924 2928 pjddp.exe 29 PID 2928 wrote to memory of 2924 2928 pjddp.exe 29 PID 2928 wrote to memory of 2924 2928 pjddp.exe 29 PID 2928 wrote to memory of 2924 2928 pjddp.exe 29 PID 2924 wrote to memory of 2156 2924 xrxxxxx.exe 30 PID 2924 wrote to memory of 2156 2924 xrxxxxx.exe 30 PID 2924 wrote to memory of 2156 2924 xrxxxxx.exe 30 PID 2924 wrote to memory of 2156 2924 xrxxxxx.exe 30 PID 2156 wrote to memory of 2676 2156 vpvvd.exe 31 PID 2156 wrote to memory of 2676 2156 vpvvd.exe 31 PID 2156 wrote to memory of 2676 2156 vpvvd.exe 31 PID 2156 wrote to memory of 2676 2156 vpvvd.exe 31 PID 2676 wrote to memory of 2572 2676 lfrxxxf.exe 32 PID 2676 wrote to memory of 2572 2676 lfrxxxf.exe 32 PID 2676 wrote to memory of 2572 2676 lfrxxxf.exe 32 PID 2676 wrote to memory of 2572 2676 lfrxxxf.exe 32 PID 2572 wrote to memory of 2708 2572 thntnh.exe 33 PID 2572 wrote to memory of 2708 2572 thntnh.exe 33 PID 2572 wrote to memory of 2708 2572 thntnh.exe 33 PID 2572 wrote to memory of 2708 2572 thntnh.exe 33 PID 2708 wrote to memory of 2568 2708 frxflrr.exe 34 PID 2708 wrote to memory of 2568 2708 frxflrr.exe 34 PID 2708 wrote to memory of 2568 2708 frxflrr.exe 34 PID 2708 wrote to memory of 2568 2708 frxflrr.exe 34 PID 2568 wrote to memory of 2444 2568 ffxrffl.exe 35 PID 2568 wrote to memory of 2444 2568 ffxrffl.exe 35 PID 2568 wrote to memory of 2444 2568 ffxrffl.exe 35 PID 2568 wrote to memory of 2444 2568 ffxrffl.exe 35 PID 2444 wrote to memory of 2704 2444 ttbhbh.exe 36 PID 2444 wrote to memory of 2704 2444 ttbhbh.exe 36 PID 2444 wrote to memory of 2704 2444 ttbhbh.exe 36 PID 2444 wrote to memory of 2704 2444 ttbhbh.exe 36 PID 2704 wrote to memory of 820 2704 jdvdp.exe 37 PID 2704 wrote to memory of 820 2704 jdvdp.exe 37 PID 2704 wrote to memory of 820 2704 jdvdp.exe 37 PID 2704 wrote to memory of 820 2704 jdvdp.exe 37 PID 820 wrote to memory of 2728 820 5flrlxl.exe 38 PID 820 wrote to memory of 2728 820 5flrlxl.exe 38 PID 820 wrote to memory of 2728 820 5flrlxl.exe 38 PID 820 wrote to memory of 2728 820 5flrlxl.exe 38 PID 2728 wrote to memory of 2068 2728 tnthht.exe 39 PID 2728 wrote to memory of 2068 2728 tnthht.exe 39 PID 2728 wrote to memory of 2068 2728 tnthht.exe 39 PID 2728 wrote to memory of 2068 2728 tnthht.exe 39 PID 2068 wrote to memory of 908 2068 dvppp.exe 40 PID 2068 wrote to memory of 908 2068 dvppp.exe 40 PID 2068 wrote to memory of 908 2068 dvppp.exe 40 PID 2068 wrote to memory of 908 2068 dvppp.exe 40 PID 908 wrote to memory of 1680 908 rllfxll.exe 41 PID 908 wrote to memory of 1680 908 rllfxll.exe 41 PID 908 wrote to memory of 1680 908 rllfxll.exe 41 PID 908 wrote to memory of 1680 908 rllfxll.exe 41 PID 1680 wrote to memory of 904 1680 ppvvj.exe 42 PID 1680 wrote to memory of 904 1680 ppvvj.exe 42 PID 1680 wrote to memory of 904 1680 ppvvj.exe 42 PID 1680 wrote to memory of 904 1680 ppvvj.exe 42 PID 904 wrote to memory of 2176 904 jdjdv.exe 43 PID 904 wrote to memory of 2176 904 jdjdv.exe 43 PID 904 wrote to memory of 2176 904 jdjdv.exe 43 PID 904 wrote to memory of 2176 904 jdjdv.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d7110d1c3a480c33ae4da35d2963d30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6d7110d1c3a480c33ae4da35d2963d30_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\pjddp.exec:\pjddp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\xrxxxxx.exec:\xrxxxxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\vpvvd.exec:\vpvvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\lfrxxxf.exec:\lfrxxxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\thntnh.exec:\thntnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\frxflrr.exec:\frxflrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\ffxrffl.exec:\ffxrffl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\ttbhbh.exec:\ttbhbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\jdvdp.exec:\jdvdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\5flrlxl.exec:\5flrlxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
\??\c:\tnthht.exec:\tnthht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\dvppp.exec:\dvppp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\rllfxll.exec:\rllfxll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
\??\c:\ppvvj.exec:\ppvvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\jdjdv.exec:\jdjdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
\??\c:\lfxxlfl.exec:\lfxxlfl.exe17⤵
- Executes dropped EXE
PID:2176 -
\??\c:\hhnhbn.exec:\hhnhbn.exe18⤵
- Executes dropped EXE
PID:604 -
\??\c:\vjppv.exec:\vjppv.exe19⤵
- Executes dropped EXE
PID:2236 -
\??\c:\nbnnhh.exec:\nbnnhh.exe20⤵
- Executes dropped EXE
PID:1604 -
\??\c:\pjddj.exec:\pjddj.exe21⤵
- Executes dropped EXE
PID:3000 -
\??\c:\9flllfx.exec:\9flllfx.exe22⤵
- Executes dropped EXE
PID:748 -
\??\c:\9htbhh.exec:\9htbhh.exe23⤵
- Executes dropped EXE
PID:1120 -
\??\c:\7pvpp.exec:\7pvpp.exe24⤵
- Executes dropped EXE
PID:2060 -
\??\c:\7llxfxr.exec:\7llxfxr.exe25⤵
- Executes dropped EXE
PID:564 -
\??\c:\1hhbhn.exec:\1hhbhn.exe26⤵
- Executes dropped EXE
PID:576 -
\??\c:\9httbh.exec:\9httbh.exe27⤵
- Executes dropped EXE
PID:1052 -
\??\c:\9fxxxxf.exec:\9fxxxxf.exe28⤵
- Executes dropped EXE
PID:952 -
\??\c:\3nhntt.exec:\3nhntt.exe29⤵
- Executes dropped EXE
PID:1320 -
\??\c:\jvvpd.exec:\jvvpd.exe30⤵
- Executes dropped EXE
PID:1720 -
\??\c:\hbbhbt.exec:\hbbhbt.exe31⤵
- Executes dropped EXE
PID:912 -
\??\c:\vpdvj.exec:\vpdvj.exe32⤵
- Executes dropped EXE
PID:2036 -
\??\c:\xfrfffl.exec:\xfrfffl.exe33⤵
- Executes dropped EXE
PID:1976 -
\??\c:\btbntt.exec:\btbntt.exe34⤵
- Executes dropped EXE
PID:1744 -
\??\c:\jjpdj.exec:\jjpdj.exe35⤵
- Executes dropped EXE
PID:2612 -
\??\c:\frflllx.exec:\frflllx.exe36⤵
- Executes dropped EXE
PID:3024 -
\??\c:\fxrrxfr.exec:\fxrrxfr.exe37⤵
- Executes dropped EXE
PID:2680 -
\??\c:\5ntnnh.exec:\5ntnnh.exe38⤵
- Executes dropped EXE
PID:2696 -
\??\c:\9pvpv.exec:\9pvpv.exe39⤵
- Executes dropped EXE
PID:2648 -
\??\c:\7xflxrf.exec:\7xflxrf.exe40⤵
- Executes dropped EXE
PID:2800 -
\??\c:\rlflxxl.exec:\rlflxxl.exe41⤵
- Executes dropped EXE
PID:2452 -
\??\c:\hbthnn.exec:\hbthnn.exe42⤵
- Executes dropped EXE
PID:2776 -
\??\c:\vpddp.exec:\vpddp.exe43⤵
- Executes dropped EXE
PID:2596 -
\??\c:\jjjjp.exec:\jjjjp.exe44⤵
- Executes dropped EXE
PID:2936 -
\??\c:\lfxfxxl.exec:\lfxfxxl.exe45⤵
- Executes dropped EXE
PID:2892 -
\??\c:\hbttbt.exec:\hbttbt.exe46⤵
- Executes dropped EXE
PID:1688 -
\??\c:\hbbbhh.exec:\hbbbhh.exe47⤵
- Executes dropped EXE
PID:2724 -
\??\c:\jdpdp.exec:\jdpdp.exe48⤵
- Executes dropped EXE
PID:1796 -
\??\c:\pjjjv.exec:\pjjjv.exe49⤵
- Executes dropped EXE
PID:2068 -
\??\c:\xxrxflf.exec:\xxrxflf.exe50⤵
- Executes dropped EXE
PID:1332 -
\??\c:\ttnbhn.exec:\ttnbhn.exe51⤵
- Executes dropped EXE
PID:1652 -
\??\c:\hbntbh.exec:\hbntbh.exe52⤵
- Executes dropped EXE
PID:2320 -
\??\c:\3vppd.exec:\3vppd.exe53⤵
- Executes dropped EXE
PID:1832 -
\??\c:\fxrrrrf.exec:\fxrrrrf.exe54⤵
- Executes dropped EXE
PID:596 -
\??\c:\nhhnhn.exec:\nhhnhn.exe55⤵
- Executes dropped EXE
PID:612 -
\??\c:\hbtbhb.exec:\hbtbhb.exe56⤵
- Executes dropped EXE
PID:1224 -
\??\c:\9vjjd.exec:\9vjjd.exe57⤵
- Executes dropped EXE
PID:1516 -
\??\c:\pjvvj.exec:\pjvvj.exe58⤵
- Executes dropped EXE
PID:3064 -
\??\c:\rlffllr.exec:\rlffllr.exe59⤵
- Executes dropped EXE
PID:2904 -
\??\c:\bthbnh.exec:\bthbnh.exe60⤵
- Executes dropped EXE
PID:2880 -
\??\c:\3tnbhn.exec:\3tnbhn.exe61⤵
- Executes dropped EXE
PID:2268 -
\??\c:\jdpdj.exec:\jdpdj.exe62⤵
- Executes dropped EXE
PID:2112 -
\??\c:\lfrrfff.exec:\lfrrfff.exe63⤵
- Executes dropped EXE
PID:1412 -
\??\c:\1xllrxx.exec:\1xllrxx.exe64⤵
- Executes dropped EXE
PID:1872 -
\??\c:\hhthhb.exec:\hhthhb.exe65⤵
- Executes dropped EXE
PID:412 -
\??\c:\jvppd.exec:\jvppd.exe66⤵PID:1020
-
\??\c:\ddpvj.exec:\ddpvj.exe67⤵PID:920
-
\??\c:\xrffxff.exec:\xrffxff.exe68⤵PID:952
-
\??\c:\nnhthn.exec:\nnhthn.exe69⤵PID:1568
-
\??\c:\ntnntt.exec:\ntnntt.exe70⤵PID:3012
-
\??\c:\dvjdd.exec:\dvjdd.exe71⤵PID:2368
-
\??\c:\pdjjj.exec:\pdjjj.exe72⤵PID:1168
-
\??\c:\rlxxrrr.exec:\rlxxrrr.exe73⤵PID:2036
-
\??\c:\7bnhtn.exec:\7bnhtn.exe74⤵PID:2716
-
\??\c:\5tnntt.exec:\5tnntt.exe75⤵PID:2172
-
\??\c:\pdpvj.exec:\pdpvj.exe76⤵PID:2612
-
\??\c:\fxrflrl.exec:\fxrflrl.exe77⤵PID:2560
-
\??\c:\xrlrlrx.exec:\xrlrlrx.exe78⤵PID:2660
-
\??\c:\nbttbh.exec:\nbttbh.exe79⤵PID:2392
-
\??\c:\bbbhbb.exec:\bbbhbb.exe80⤵PID:2464
-
\??\c:\jpjpd.exec:\jpjpd.exe81⤵PID:2708
-
\??\c:\xrflffl.exec:\xrflffl.exe82⤵PID:2428
-
\??\c:\xxrxllf.exec:\xxrxllf.exe83⤵PID:2500
-
\??\c:\nhtthh.exec:\nhtthh.exe84⤵PID:2568
-
\??\c:\dvvvd.exec:\dvvvd.exe85⤵PID:2208
-
\??\c:\9pjpd.exec:\9pjpd.exe86⤵PID:2504
-
\??\c:\rrlxlrl.exec:\rrlxlrl.exe87⤵PID:2772
-
\??\c:\btbbnt.exec:\btbbnt.exe88⤵PID:2736
-
\??\c:\ttttnb.exec:\ttttnb.exe89⤵PID:784
-
\??\c:\vdvdp.exec:\vdvdp.exe90⤵PID:2324
-
\??\c:\9vppv.exec:\9vppv.exe91⤵PID:2752
-
\??\c:\xlffrxf.exec:\xlffrxf.exe92⤵PID:684
-
\??\c:\1tthtb.exec:\1tthtb.exe93⤵PID:904
-
\??\c:\nntbtb.exec:\nntbtb.exe94⤵PID:548
-
\??\c:\pjjpv.exec:\pjjpv.exe95⤵PID:2224
-
\??\c:\rlfflrf.exec:\rlfflrf.exe96⤵PID:380
-
\??\c:\ffrfllr.exec:\ffrfllr.exe97⤵PID:1584
-
\??\c:\btnbbn.exec:\btnbbn.exe98⤵PID:1452
-
\??\c:\jjvpd.exec:\jjvpd.exe99⤵PID:1500
-
\??\c:\7ppvv.exec:\7ppvv.exe100⤵PID:1508
-
\??\c:\xfxlrrf.exec:\xfxlrrf.exe101⤵PID:2280
-
\??\c:\fxrrffx.exec:\fxrrffx.exe102⤵PID:748
-
\??\c:\3hbhth.exec:\3hbhth.exe103⤵PID:2816
-
\??\c:\5pddp.exec:\5pddp.exe104⤵PID:2152
-
\??\c:\dvjdj.exec:\dvjdj.exe105⤵PID:1840
-
\??\c:\1frrxff.exec:\1frrxff.exe106⤵PID:1768
-
\??\c:\3lrrxfr.exec:\3lrrxfr.exe107⤵PID:708
-
\??\c:\tnbnth.exec:\tnbnth.exe108⤵PID:1932
-
\??\c:\1dpdp.exec:\1dpdp.exe109⤵PID:2376
-
\??\c:\5vjdj.exec:\5vjdj.exe110⤵PID:2120
-
\??\c:\llrrxxf.exec:\llrrxxf.exe111⤵PID:2844
-
\??\c:\rlfflrl.exec:\rlfflrl.exe112⤵PID:2012
-
\??\c:\btntbh.exec:\btntbh.exe113⤵PID:1592
-
\??\c:\pvpvj.exec:\pvpvj.exe114⤵PID:1616
-
\??\c:\jjddj.exec:\jjddj.exe115⤵PID:1744
-
\??\c:\xlffllx.exec:\xlffllx.exe116⤵PID:2140
-
\??\c:\1lfflrx.exec:\1lfflrx.exe117⤵PID:2540
-
\??\c:\9htbbh.exec:\9htbbh.exe118⤵PID:2684
-
\??\c:\bbnntt.exec:\bbnntt.exe119⤵PID:2680
-
\??\c:\pdvvd.exec:\pdvvd.exe120⤵PID:2812
-
\??\c:\lfxfxfx.exec:\lfxfxfx.exe121⤵PID:2308
-
\??\c:\xxxlflf.exec:\xxxlflf.exe122⤵PID:2452
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-