Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/06/2024, 20:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
01389d44edcd5fa16126e0deab6345c0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
01389d44edcd5fa16126e0deab6345c0_NeikiAnalytics.exe
-
Size
106KB
-
MD5
01389d44edcd5fa16126e0deab6345c0
-
SHA1
b86140ef3d95e3dd5b3c83c708c72e534816bc6f
-
SHA256
def989f027784c9de06ee757552e6cc0a94b4be1e7efe0c85b559012e563e467
-
SHA512
b50a6a347d699bf30077e665f1af9a8b075a9465aa997e9991162c4b0297b761a771f4c12011dde8bc623c80c8b1e5819b496b2f3176ed227c9739b409a39bdc
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoTNKDeS98hPUdHV7RNzfJN7u:ymb3NkkiQ3mdBjFo5KDe88g1fD7u
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/2936-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2276-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1736-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1960-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1504-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1704-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1920-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1752-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2092-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/580-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1856-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1192-266-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/884-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3028 xlrrlll.exe 2820 tbtbbb.exe 2588 bhttbn.exe 2664 pvjpv.exe 2276 bbhbhh.exe 2948 thnhhb.exe 2620 ppvvp.exe 2568 xxlfffl.exe 2920 nnbnht.exe 2680 jjvpv.exe 2764 rfflrfl.exe 1736 bbhthn.exe 1960 ppdvv.exe 1504 pdvjd.exe 1704 1htbbb.exe 1920 bbnthn.exe 1752 jjvdj.exe 1080 rrxfllr.exe 2092 hntbhh.exe 2308 tbhbnh.exe 2428 vvpdp.exe 596 ffxfrxf.exe 580 rrrrfxx.exe 1856 nthbhn.exe 2420 dvpjd.exe 624 xlxlrrf.exe 1192 nnhbnb.exe 1040 9nnntt.exe 884 ppjpj.exe 1260 xrlrxlf.exe 2876 hthbbn.exe 1652 htbhnb.exe 2156 djdpd.exe 1616 3rxrrfx.exe 2968 hnbtbb.exe 2300 djdjp.exe 2652 xrlllrf.exe 2592 thhttn.exe 2828 hntnbb.exe 2276 5pjvv.exe 2780 1rrlfrl.exe 2948 llxflxl.exe 2448 ntttnt.exe 2904 hbtbnn.exe 848 jppjd.exe 2536 5fxxlrx.exe 2516 ffrlrrx.exe 2792 llflxlx.exe 2224 tnhnbh.exe 2332 7bbbtb.exe 1960 ppvdd.exe 1504 9pjjv.exe 1940 rfxxxxf.exe 1072 thnbbn.exe 1028 bthnbb.exe 2104 vdpdj.exe 2128 dvddp.exe 1780 lrxxrrx.exe 2848 1nnnnn.exe 536 hhtbbh.exe 480 jpvpd.exe 1484 xxrxfrx.exe 580 xxflxxx.exe 2416 hthhnt.exe -
resource yara_rule behavioral1/memory/2936-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2276-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1736-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1960-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1504-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1704-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1920-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/580-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1856-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1192-266-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/884-285-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2936 wrote to memory of 3028 2936 01389d44edcd5fa16126e0deab6345c0_NeikiAnalytics.exe 28 PID 2936 wrote to memory of 3028 2936 01389d44edcd5fa16126e0deab6345c0_NeikiAnalytics.exe 28 PID 2936 wrote to memory of 3028 2936 01389d44edcd5fa16126e0deab6345c0_NeikiAnalytics.exe 28 PID 2936 wrote to memory of 3028 2936 01389d44edcd5fa16126e0deab6345c0_NeikiAnalytics.exe 28 PID 3028 wrote to memory of 2820 3028 xlrrlll.exe 29 PID 3028 wrote to memory of 2820 3028 xlrrlll.exe 29 PID 3028 wrote to memory of 2820 3028 xlrrlll.exe 29 PID 3028 wrote to memory of 2820 3028 xlrrlll.exe 29 PID 2820 wrote to memory of 2588 2820 tbtbbb.exe 30 PID 2820 wrote to memory of 2588 2820 tbtbbb.exe 30 PID 2820 wrote to memory of 2588 2820 tbtbbb.exe 30 PID 2820 wrote to memory of 2588 2820 tbtbbb.exe 30 PID 2588 wrote to memory of 2664 2588 bhttbn.exe 31 PID 2588 wrote to memory of 2664 2588 bhttbn.exe 31 PID 2588 wrote to memory of 2664 2588 bhttbn.exe 31 PID 2588 wrote to memory of 2664 2588 bhttbn.exe 31 PID 2664 wrote to memory of 2276 2664 pvjpv.exe 32 PID 2664 wrote to memory of 2276 2664 pvjpv.exe 32 PID 2664 wrote to memory of 2276 2664 pvjpv.exe 32 PID 2664 wrote to memory of 2276 2664 pvjpv.exe 32 PID 2276 wrote to memory of 2948 2276 bbhbhh.exe 33 PID 2276 wrote to memory of 2948 2276 bbhbhh.exe 33 PID 2276 wrote to memory of 2948 2276 bbhbhh.exe 33 PID 2276 wrote to memory of 2948 2276 bbhbhh.exe 33 PID 2948 wrote to memory of 2620 2948 thnhhb.exe 34 PID 2948 wrote to memory of 2620 2948 thnhhb.exe 34 PID 2948 wrote to memory of 2620 2948 thnhhb.exe 34 PID 2948 wrote to memory of 2620 2948 thnhhb.exe 34 PID 2620 wrote to memory of 2568 2620 ppvvp.exe 35 PID 2620 wrote to memory of 2568 2620 ppvvp.exe 35 PID 2620 wrote to memory of 2568 2620 ppvvp.exe 35 PID 2620 wrote to memory of 2568 2620 ppvvp.exe 35 PID 2568 wrote to memory of 2920 2568 xxlfffl.exe 36 PID 2568 wrote to memory of 2920 2568 xxlfffl.exe 36 PID 2568 wrote to memory of 2920 2568 xxlfffl.exe 36 PID 2568 wrote to memory of 2920 2568 xxlfffl.exe 36 PID 2920 wrote to memory of 2680 2920 nnbnht.exe 37 PID 2920 wrote to memory of 2680 2920 nnbnht.exe 37 PID 2920 wrote to memory of 2680 2920 nnbnht.exe 37 PID 2920 wrote to memory of 2680 2920 nnbnht.exe 37 PID 2680 wrote to memory of 2764 2680 jjvpv.exe 38 PID 2680 wrote to memory of 2764 2680 jjvpv.exe 38 PID 2680 wrote to memory of 2764 2680 jjvpv.exe 38 PID 2680 wrote to memory of 2764 2680 jjvpv.exe 38 PID 2764 wrote to memory of 1736 2764 rfflrfl.exe 39 PID 2764 wrote to memory of 1736 2764 rfflrfl.exe 39 PID 2764 wrote to memory of 1736 2764 rfflrfl.exe 39 PID 2764 wrote to memory of 1736 2764 rfflrfl.exe 39 PID 1736 wrote to memory of 1960 1736 bbhthn.exe 40 PID 1736 wrote to memory of 1960 1736 bbhthn.exe 40 PID 1736 wrote to memory of 1960 1736 bbhthn.exe 40 PID 1736 wrote to memory of 1960 1736 bbhthn.exe 40 PID 1960 wrote to memory of 1504 1960 ppdvv.exe 41 PID 1960 wrote to memory of 1504 1960 ppdvv.exe 41 PID 1960 wrote to memory of 1504 1960 ppdvv.exe 41 PID 1960 wrote to memory of 1504 1960 ppdvv.exe 41 PID 1504 wrote to memory of 1704 1504 pdvjd.exe 42 PID 1504 wrote to memory of 1704 1504 pdvjd.exe 42 PID 1504 wrote to memory of 1704 1504 pdvjd.exe 42 PID 1504 wrote to memory of 1704 1504 pdvjd.exe 42 PID 1704 wrote to memory of 1920 1704 1htbbb.exe 43 PID 1704 wrote to memory of 1920 1704 1htbbb.exe 43 PID 1704 wrote to memory of 1920 1704 1htbbb.exe 43 PID 1704 wrote to memory of 1920 1704 1htbbb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\01389d44edcd5fa16126e0deab6345c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\01389d44edcd5fa16126e0deab6345c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\xlrrlll.exec:\xlrrlll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\tbtbbb.exec:\tbtbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\bhttbn.exec:\bhttbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\pvjpv.exec:\pvjpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\bbhbhh.exec:\bbhbhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\thnhhb.exec:\thnhhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\ppvvp.exec:\ppvvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\xxlfffl.exec:\xxlfffl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\nnbnht.exec:\nnbnht.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\jjvpv.exec:\jjvpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\rfflrfl.exec:\rfflrfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\bbhthn.exec:\bbhthn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\ppdvv.exec:\ppdvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\pdvjd.exec:\pdvjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\1htbbb.exec:\1htbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\bbnthn.exec:\bbnthn.exe17⤵
- Executes dropped EXE
PID:1920 -
\??\c:\jjvdj.exec:\jjvdj.exe18⤵
- Executes dropped EXE
PID:1752 -
\??\c:\rrxfllr.exec:\rrxfllr.exe19⤵
- Executes dropped EXE
PID:1080 -
\??\c:\hntbhh.exec:\hntbhh.exe20⤵
- Executes dropped EXE
PID:2092 -
\??\c:\tbhbnh.exec:\tbhbnh.exe21⤵
- Executes dropped EXE
PID:2308 -
\??\c:\vvpdp.exec:\vvpdp.exe22⤵
- Executes dropped EXE
PID:2428 -
\??\c:\ffxfrxf.exec:\ffxfrxf.exe23⤵
- Executes dropped EXE
PID:596 -
\??\c:\rrrrfxx.exec:\rrrrfxx.exe24⤵
- Executes dropped EXE
PID:580 -
\??\c:\nthbhn.exec:\nthbhn.exe25⤵
- Executes dropped EXE
PID:1856 -
\??\c:\dvpjd.exec:\dvpjd.exe26⤵
- Executes dropped EXE
PID:2420 -
\??\c:\xlxlrrf.exec:\xlxlrrf.exe27⤵
- Executes dropped EXE
PID:624 -
\??\c:\nnhbnb.exec:\nnhbnb.exe28⤵
- Executes dropped EXE
PID:1192 -
\??\c:\9nnntt.exec:\9nnntt.exe29⤵
- Executes dropped EXE
PID:1040 -
\??\c:\ppjpj.exec:\ppjpj.exe30⤵
- Executes dropped EXE
PID:884 -
\??\c:\xrlrxlf.exec:\xrlrxlf.exe31⤵
- Executes dropped EXE
PID:1260 -
\??\c:\hthbbn.exec:\hthbbn.exe32⤵
- Executes dropped EXE
PID:2876 -
\??\c:\htbhnb.exec:\htbhnb.exe33⤵
- Executes dropped EXE
PID:1652 -
\??\c:\djdpd.exec:\djdpd.exe34⤵
- Executes dropped EXE
PID:2156 -
\??\c:\3rxrrfx.exec:\3rxrrfx.exe35⤵
- Executes dropped EXE
PID:1616 -
\??\c:\hnbtbb.exec:\hnbtbb.exe36⤵
- Executes dropped EXE
PID:2968 -
\??\c:\djdjp.exec:\djdjp.exe37⤵
- Executes dropped EXE
PID:2300 -
\??\c:\xrlllrf.exec:\xrlllrf.exe38⤵
- Executes dropped EXE
PID:2652 -
\??\c:\thhttn.exec:\thhttn.exe39⤵
- Executes dropped EXE
PID:2592 -
\??\c:\hntnbb.exec:\hntnbb.exe40⤵
- Executes dropped EXE
PID:2828 -
\??\c:\5pjvv.exec:\5pjvv.exe41⤵
- Executes dropped EXE
PID:2276 -
\??\c:\1rrlfrl.exec:\1rrlfrl.exe42⤵
- Executes dropped EXE
PID:2780 -
\??\c:\llxflxl.exec:\llxflxl.exe43⤵
- Executes dropped EXE
PID:2948 -
\??\c:\ntttnt.exec:\ntttnt.exe44⤵
- Executes dropped EXE
PID:2448 -
\??\c:\hbtbnn.exec:\hbtbnn.exe45⤵
- Executes dropped EXE
PID:2904 -
\??\c:\jppjd.exec:\jppjd.exe46⤵
- Executes dropped EXE
PID:848 -
\??\c:\5fxxlrx.exec:\5fxxlrx.exe47⤵
- Executes dropped EXE
PID:2536 -
\??\c:\ffrlrrx.exec:\ffrlrrx.exe48⤵
- Executes dropped EXE
PID:2516 -
\??\c:\llflxlx.exec:\llflxlx.exe49⤵
- Executes dropped EXE
PID:2792 -
\??\c:\tnhnbh.exec:\tnhnbh.exe50⤵
- Executes dropped EXE
PID:2224 -
\??\c:\7bbbtb.exec:\7bbbtb.exe51⤵
- Executes dropped EXE
PID:2332 -
\??\c:\ppvdd.exec:\ppvdd.exe52⤵
- Executes dropped EXE
PID:1960 -
\??\c:\9pjjv.exec:\9pjjv.exe53⤵
- Executes dropped EXE
PID:1504 -
\??\c:\rfxxxxf.exec:\rfxxxxf.exe54⤵
- Executes dropped EXE
PID:1940 -
\??\c:\thnbbn.exec:\thnbbn.exe55⤵
- Executes dropped EXE
PID:1072 -
\??\c:\bthnbb.exec:\bthnbb.exe56⤵
- Executes dropped EXE
PID:1028 -
\??\c:\vdpdj.exec:\vdpdj.exe57⤵
- Executes dropped EXE
PID:2104 -
\??\c:\dvddp.exec:\dvddp.exe58⤵
- Executes dropped EXE
PID:2128 -
\??\c:\lrxxrrx.exec:\lrxxrrx.exe59⤵
- Executes dropped EXE
PID:1780 -
\??\c:\1nnnnn.exec:\1nnnnn.exe60⤵
- Executes dropped EXE
PID:2848 -
\??\c:\hhtbbh.exec:\hhtbbh.exe61⤵
- Executes dropped EXE
PID:536 -
\??\c:\jpvpd.exec:\jpvpd.exe62⤵
- Executes dropped EXE
PID:480 -
\??\c:\xxrxfrx.exec:\xxrxfrx.exe63⤵
- Executes dropped EXE
PID:1484 -
\??\c:\xxflxxx.exec:\xxflxxx.exe64⤵
- Executes dropped EXE
PID:580 -
\??\c:\hthhnt.exec:\hthhnt.exe65⤵
- Executes dropped EXE
PID:2416 -
\??\c:\vpdjp.exec:\vpdjp.exe66⤵PID:2320
-
\??\c:\jjvdp.exec:\jjvdp.exe67⤵PID:1380
-
\??\c:\rxllrfx.exec:\rxllrfx.exe68⤵PID:920
-
\??\c:\ffrxfrx.exec:\ffrxfrx.exe69⤵PID:1192
-
\??\c:\ttnbhn.exec:\ttnbhn.exe70⤵PID:2068
-
\??\c:\hhtthh.exec:\hhtthh.exe71⤵PID:3060
-
\??\c:\pvjvp.exec:\pvjvp.exe72⤵PID:904
-
\??\c:\jpdvd.exec:\jpdvd.exe73⤵PID:2528
-
\??\c:\rffxrfl.exec:\rffxrfl.exe74⤵PID:3040
-
\??\c:\xlrxlrf.exec:\xlrxlrf.exe75⤵PID:2940
-
\??\c:\hhbttt.exec:\hhbttt.exe76⤵PID:2172
-
\??\c:\vjvjp.exec:\vjvjp.exe77⤵PID:1620
-
\??\c:\3jdpv.exec:\3jdpv.exe78⤵PID:2540
-
\??\c:\lflxlff.exec:\lflxlff.exe79⤵PID:2668
-
\??\c:\lrxfrxx.exec:\lrxfrxx.exe80⤵PID:2660
-
\??\c:\ttnbnt.exec:\ttnbnt.exe81⤵PID:2664
-
\??\c:\dvjjd.exec:\dvjjd.exe82⤵PID:2840
-
\??\c:\pdjjj.exec:\pdjjj.exe83⤵PID:2704
-
\??\c:\flrlrrl.exec:\flrlrrl.exe84⤵PID:2472
-
\??\c:\nbbhht.exec:\nbbhht.exe85⤵PID:2524
-
\??\c:\djdvd.exec:\djdvd.exe86⤵PID:2620
-
\??\c:\ppddp.exec:\ppddp.exe87⤵PID:640
-
\??\c:\1lrlfxl.exec:\1lrlfxl.exe88⤵PID:2688
-
\??\c:\rxlllxf.exec:\rxlllxf.exe89⤵PID:2760
-
\??\c:\nnbhnb.exec:\nnbhnb.exe90⤵PID:2680
-
\??\c:\dpdpj.exec:\dpdpj.exe91⤵PID:2036
-
\??\c:\rlxxrrx.exec:\rlxxrrx.exe92⤵PID:2240
-
\??\c:\bbttnt.exec:\bbttnt.exe93⤵PID:380
-
\??\c:\5bhnnh.exec:\5bhnnh.exe94⤵PID:1532
-
\??\c:\pjvjv.exec:\pjvjv.exe95⤵PID:1928
-
\??\c:\vjjpd.exec:\vjjpd.exe96⤵PID:1032
-
\??\c:\rxlllfl.exec:\rxlllfl.exe97⤵PID:1048
-
\??\c:\lxlffff.exec:\lxlffff.exe98⤵PID:1340
-
\??\c:\tbtthh.exec:\tbtthh.exe99⤵PID:2088
-
\??\c:\thhbhb.exec:\thhbhb.exe100⤵PID:2252
-
\??\c:\vpvpv.exec:\vpvpv.exe101⤵PID:2256
-
\??\c:\xrfllrf.exec:\xrfllrf.exe102⤵PID:628
-
\??\c:\xrxfflf.exec:\xrxfflf.exe103⤵PID:1112
-
\??\c:\bthntb.exec:\bthntb.exe104⤵PID:2720
-
\??\c:\jdppj.exec:\jdppj.exe105⤵PID:2912
-
\??\c:\lxrxlrf.exec:\lxrxlrf.exe106⤵PID:1692
-
\??\c:\tbnhnh.exec:\tbnhnh.exe107⤵PID:2420
-
\??\c:\jdjdv.exec:\jdjdv.exe108⤵PID:1516
-
\??\c:\jjdvp.exec:\jjdvp.exe109⤵PID:2192
-
\??\c:\9xxxxlf.exec:\9xxxxlf.exe110⤵PID:920
-
\??\c:\bnnhnn.exec:\bnnhnn.exe111⤵PID:2004
-
\??\c:\hbbhnb.exec:\hbbhnb.exe112⤵PID:2068
-
\??\c:\jvjjd.exec:\jvjjd.exe113⤵PID:1808
-
\??\c:\djjvd.exec:\djjvd.exe114⤵PID:904
-
\??\c:\xrrxlrf.exec:\xrrxlrf.exe115⤵PID:2532
-
\??\c:\nhtbnb.exec:\nhtbnb.exe116⤵PID:2020
-
\??\c:\hbbnth.exec:\hbbnth.exe117⤵PID:1744
-
\??\c:\9dvjj.exec:\9dvjj.exe118⤵PID:2156
-
\??\c:\vpdvd.exec:\vpdvd.exe119⤵PID:2556
-
\??\c:\xxrfxlr.exec:\xxrfxlr.exe120⤵PID:2672
-
\??\c:\xlxxlff.exec:\xlxxlff.exe121⤵PID:2580
-
\??\c:\tnttth.exec:\tnttth.exe122⤵PID:2660
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-