Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 15:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7ecbb366e744b9c6020991d161917e10_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
7ecbb366e744b9c6020991d161917e10_NeikiAnalytics.exe
-
Size
59KB
-
MD5
7ecbb366e744b9c6020991d161917e10
-
SHA1
9be298c7f444665c2dd68872349bdd0994420034
-
SHA256
e545e06055e75102c08633e94e72cd40b3f151622f1bef371921e850abcd5060
-
SHA512
1ee21eb4f8e713609e3d42e3af6d5056cd730b161f7852f7903ba26274cf924cc565817a53b9abc22f41343552686b97951af1d16d379757e6e4f9def9139d11
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk9UI:ymb3NkkiQ3mdBjFIvlqI
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral1/memory/3036-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3008-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2360-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-58-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/304-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1524-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1916-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/608-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1428-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2092-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/532-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1368-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1124-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1184-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3036 vpdvv.exe 2360 hbtnhn.exe 2720 nnntbh.exe 2612 jdvjp.exe 2620 ddpjp.exe 2532 xffrlfx.exe 2504 ddppd.exe 2940 rxfrrll.exe 304 btnbnn.exe 2804 5pjjp.exe 2920 lxxllrl.exe 1524 rrrllfx.exe 1916 nntnnn.exe 2464 vjjpp.exe 608 xxrllxr.exe 2260 bbbtnt.exe 2192 3htnbh.exe 1428 vvjpp.exe 2092 9xrfffl.exe 2824 1bhbnh.exe 2880 7ppvj.exe 532 jvjpp.exe 660 lfllxxr.exe 2032 9bnbtn.exe 2008 nnhntb.exe 1368 jvpvd.exe 2264 lfrrxlx.exe 2996 hhtbbb.exe 1124 vppjd.exe 1184 pjpdp.exe 1740 7lfrrrr.exe 2336 bbthnt.exe 1552 ppdjv.exe 1700 vjvjj.exe 1972 xrrlrxf.exe 3068 ffrfrrx.exe 2872 hbbhnn.exe 3064 dppvj.exe 2612 pjpjp.exe 2412 lfrfffl.exe 2560 bbnhtb.exe 2520 jjvdp.exe 2424 vvjpd.exe 2676 5xxrflx.exe 1904 3xfrlrl.exe 2604 htnttb.exe 2956 ttnttt.exe 2316 pjvdv.exe 1936 dvjjp.exe 1848 fxlrffl.exe 904 rlflxxf.exe 760 btbthh.exe 624 jddjp.exe 1604 5pjpp.exe 836 lxlrxxf.exe 1260 rfrxfrx.exe 1428 nnnttb.exe 2460 pjdvv.exe 2884 pdvvd.exe 2112 ffflxxf.exe 476 xxffrxl.exe 280 hhnbnt.exe 660 3bthnn.exe 1244 vppvv.exe -
resource yara_rule behavioral1/memory/3036-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/304-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1524-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1916-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/608-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1428-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/532-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1368-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1124-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1184-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-300-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3008 wrote to memory of 3036 3008 7ecbb366e744b9c6020991d161917e10_NeikiAnalytics.exe 28 PID 3008 wrote to memory of 3036 3008 7ecbb366e744b9c6020991d161917e10_NeikiAnalytics.exe 28 PID 3008 wrote to memory of 3036 3008 7ecbb366e744b9c6020991d161917e10_NeikiAnalytics.exe 28 PID 3008 wrote to memory of 3036 3008 7ecbb366e744b9c6020991d161917e10_NeikiAnalytics.exe 28 PID 3036 wrote to memory of 2360 3036 vpdvv.exe 29 PID 3036 wrote to memory of 2360 3036 vpdvv.exe 29 PID 3036 wrote to memory of 2360 3036 vpdvv.exe 29 PID 3036 wrote to memory of 2360 3036 vpdvv.exe 29 PID 2360 wrote to memory of 2720 2360 hbtnhn.exe 30 PID 2360 wrote to memory of 2720 2360 hbtnhn.exe 30 PID 2360 wrote to memory of 2720 2360 hbtnhn.exe 30 PID 2360 wrote to memory of 2720 2360 hbtnhn.exe 30 PID 2720 wrote to memory of 2612 2720 nnntbh.exe 31 PID 2720 wrote to memory of 2612 2720 nnntbh.exe 31 PID 2720 wrote to memory of 2612 2720 nnntbh.exe 31 PID 2720 wrote to memory of 2612 2720 nnntbh.exe 31 PID 2612 wrote to memory of 2620 2612 jdvjp.exe 32 PID 2612 wrote to memory of 2620 2612 jdvjp.exe 32 PID 2612 wrote to memory of 2620 2612 jdvjp.exe 32 PID 2612 wrote to memory of 2620 2612 jdvjp.exe 32 PID 2620 wrote to memory of 2532 2620 ddpjp.exe 33 PID 2620 wrote to memory of 2532 2620 ddpjp.exe 33 PID 2620 wrote to memory of 2532 2620 ddpjp.exe 33 PID 2620 wrote to memory of 2532 2620 ddpjp.exe 33 PID 2532 wrote to memory of 2504 2532 xffrlfx.exe 34 PID 2532 wrote to memory of 2504 2532 xffrlfx.exe 34 PID 2532 wrote to memory of 2504 2532 xffrlfx.exe 34 PID 2532 wrote to memory of 2504 2532 xffrlfx.exe 34 PID 2504 wrote to memory of 2940 2504 ddppd.exe 35 PID 2504 wrote to memory of 2940 2504 ddppd.exe 35 PID 2504 wrote to memory of 2940 2504 ddppd.exe 35 PID 2504 wrote to memory of 2940 2504 ddppd.exe 35 PID 2940 wrote to memory of 304 2940 rxfrrll.exe 36 PID 2940 wrote to memory of 304 2940 rxfrrll.exe 36 PID 2940 wrote to memory of 304 2940 rxfrrll.exe 36 PID 2940 wrote to memory of 304 2940 rxfrrll.exe 36 PID 304 wrote to memory of 2804 304 btnbnn.exe 37 PID 304 wrote to memory of 2804 304 btnbnn.exe 37 PID 304 wrote to memory of 2804 304 btnbnn.exe 37 PID 304 wrote to memory of 2804 304 btnbnn.exe 37 PID 2804 wrote to memory of 2920 2804 5pjjp.exe 38 PID 2804 wrote to memory of 2920 2804 5pjjp.exe 38 PID 2804 wrote to memory of 2920 2804 5pjjp.exe 38 PID 2804 wrote to memory of 2920 2804 5pjjp.exe 38 PID 2920 wrote to memory of 1524 2920 lxxllrl.exe 39 PID 2920 wrote to memory of 1524 2920 lxxllrl.exe 39 PID 2920 wrote to memory of 1524 2920 lxxllrl.exe 39 PID 2920 wrote to memory of 1524 2920 lxxllrl.exe 39 PID 1524 wrote to memory of 1916 1524 rrrllfx.exe 40 PID 1524 wrote to memory of 1916 1524 rrrllfx.exe 40 PID 1524 wrote to memory of 1916 1524 rrrllfx.exe 40 PID 1524 wrote to memory of 1916 1524 rrrllfx.exe 40 PID 1916 wrote to memory of 2464 1916 nntnnn.exe 41 PID 1916 wrote to memory of 2464 1916 nntnnn.exe 41 PID 1916 wrote to memory of 2464 1916 nntnnn.exe 41 PID 1916 wrote to memory of 2464 1916 nntnnn.exe 41 PID 2464 wrote to memory of 608 2464 vjjpp.exe 42 PID 2464 wrote to memory of 608 2464 vjjpp.exe 42 PID 2464 wrote to memory of 608 2464 vjjpp.exe 42 PID 2464 wrote to memory of 608 2464 vjjpp.exe 42 PID 608 wrote to memory of 2260 608 xxrllxr.exe 43 PID 608 wrote to memory of 2260 608 xxrllxr.exe 43 PID 608 wrote to memory of 2260 608 xxrllxr.exe 43 PID 608 wrote to memory of 2260 608 xxrllxr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ecbb366e744b9c6020991d161917e10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7ecbb366e744b9c6020991d161917e10_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\vpdvv.exec:\vpdvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\hbtnhn.exec:\hbtnhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\nnntbh.exec:\nnntbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\jdvjp.exec:\jdvjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\ddpjp.exec:\ddpjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\xffrlfx.exec:\xffrlfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\ddppd.exec:\ddppd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\rxfrrll.exec:\rxfrrll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\btnbnn.exec:\btnbnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:304 -
\??\c:\5pjjp.exec:\5pjjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\lxxllrl.exec:\lxxllrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\rrrllfx.exec:\rrrllfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\nntnnn.exec:\nntnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\vjjpp.exec:\vjjpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\xxrllxr.exec:\xxrllxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:608 -
\??\c:\bbbtnt.exec:\bbbtnt.exe17⤵
- Executes dropped EXE
PID:2260 -
\??\c:\3htnbh.exec:\3htnbh.exe18⤵
- Executes dropped EXE
PID:2192 -
\??\c:\vvjpp.exec:\vvjpp.exe19⤵
- Executes dropped EXE
PID:1428 -
\??\c:\9xrfffl.exec:\9xrfffl.exe20⤵
- Executes dropped EXE
PID:2092 -
\??\c:\1bhbnh.exec:\1bhbnh.exe21⤵
- Executes dropped EXE
PID:2824 -
\??\c:\7ppvj.exec:\7ppvj.exe22⤵
- Executes dropped EXE
PID:2880 -
\??\c:\jvjpp.exec:\jvjpp.exe23⤵
- Executes dropped EXE
PID:532 -
\??\c:\lfllxxr.exec:\lfllxxr.exe24⤵
- Executes dropped EXE
PID:660 -
\??\c:\9bnbtn.exec:\9bnbtn.exe25⤵
- Executes dropped EXE
PID:2032 -
\??\c:\nnhntb.exec:\nnhntb.exe26⤵
- Executes dropped EXE
PID:2008 -
\??\c:\jvpvd.exec:\jvpvd.exe27⤵
- Executes dropped EXE
PID:1368 -
\??\c:\lfrrxlx.exec:\lfrrxlx.exe28⤵
- Executes dropped EXE
PID:2264 -
\??\c:\hhtbbb.exec:\hhtbbb.exe29⤵
- Executes dropped EXE
PID:2996 -
\??\c:\vppjd.exec:\vppjd.exe30⤵
- Executes dropped EXE
PID:1124 -
\??\c:\pjpdp.exec:\pjpdp.exe31⤵
- Executes dropped EXE
PID:1184 -
\??\c:\7lfrrrr.exec:\7lfrrrr.exe32⤵
- Executes dropped EXE
PID:1740 -
\??\c:\bbthnt.exec:\bbthnt.exe33⤵
- Executes dropped EXE
PID:2336 -
\??\c:\ppdjv.exec:\ppdjv.exe34⤵
- Executes dropped EXE
PID:1552 -
\??\c:\vjvjj.exec:\vjvjj.exe35⤵
- Executes dropped EXE
PID:1700 -
\??\c:\xrrlrxf.exec:\xrrlrxf.exe36⤵
- Executes dropped EXE
PID:1972 -
\??\c:\ffrfrrx.exec:\ffrfrrx.exe37⤵
- Executes dropped EXE
PID:3068 -
\??\c:\hbbhnn.exec:\hbbhnn.exe38⤵
- Executes dropped EXE
PID:2872 -
\??\c:\dppvj.exec:\dppvj.exe39⤵
- Executes dropped EXE
PID:3064 -
\??\c:\pjpjp.exec:\pjpjp.exe40⤵
- Executes dropped EXE
PID:2612 -
\??\c:\lfrfffl.exec:\lfrfffl.exe41⤵
- Executes dropped EXE
PID:2412 -
\??\c:\bbnhtb.exec:\bbnhtb.exe42⤵
- Executes dropped EXE
PID:2560 -
\??\c:\jjvdp.exec:\jjvdp.exe43⤵
- Executes dropped EXE
PID:2520 -
\??\c:\vvjpd.exec:\vvjpd.exe44⤵
- Executes dropped EXE
PID:2424 -
\??\c:\5xxrflx.exec:\5xxrflx.exe45⤵
- Executes dropped EXE
PID:2676 -
\??\c:\3xfrlrl.exec:\3xfrlrl.exe46⤵
- Executes dropped EXE
PID:1904 -
\??\c:\htnttb.exec:\htnttb.exe47⤵
- Executes dropped EXE
PID:2604 -
\??\c:\ttnttt.exec:\ttnttt.exe48⤵
- Executes dropped EXE
PID:2956 -
\??\c:\pjvdv.exec:\pjvdv.exe49⤵
- Executes dropped EXE
PID:2316 -
\??\c:\dvjjp.exec:\dvjjp.exe50⤵
- Executes dropped EXE
PID:1936 -
\??\c:\fxlrffl.exec:\fxlrffl.exe51⤵
- Executes dropped EXE
PID:1848 -
\??\c:\rlflxxf.exec:\rlflxxf.exe52⤵
- Executes dropped EXE
PID:904 -
\??\c:\btbthh.exec:\btbthh.exe53⤵
- Executes dropped EXE
PID:760 -
\??\c:\jddjp.exec:\jddjp.exe54⤵
- Executes dropped EXE
PID:624 -
\??\c:\5pjpp.exec:\5pjpp.exe55⤵
- Executes dropped EXE
PID:1604 -
\??\c:\lxlrxxf.exec:\lxlrxxf.exe56⤵
- Executes dropped EXE
PID:836 -
\??\c:\rfrxfrx.exec:\rfrxfrx.exe57⤵
- Executes dropped EXE
PID:1260 -
\??\c:\nnnttb.exec:\nnnttb.exe58⤵
- Executes dropped EXE
PID:1428 -
\??\c:\pjdvv.exec:\pjdvv.exe59⤵
- Executes dropped EXE
PID:2460 -
\??\c:\pdvvd.exec:\pdvvd.exe60⤵
- Executes dropped EXE
PID:2884 -
\??\c:\ffflxxf.exec:\ffflxxf.exe61⤵
- Executes dropped EXE
PID:2112 -
\??\c:\xxffrxl.exec:\xxffrxl.exe62⤵
- Executes dropped EXE
PID:476 -
\??\c:\hhnbnt.exec:\hhnbnt.exe63⤵
- Executes dropped EXE
PID:280 -
\??\c:\3bthnn.exec:\3bthnn.exe64⤵
- Executes dropped EXE
PID:660 -
\??\c:\vppvv.exec:\vppvv.exe65⤵
- Executes dropped EXE
PID:1244 -
\??\c:\1vjdd.exec:\1vjdd.exe66⤵PID:2084
-
\??\c:\lxlrllf.exec:\lxlrllf.exe67⤵PID:1852
-
\??\c:\hbtthh.exec:\hbtthh.exe68⤵PID:1368
-
\??\c:\btbtbn.exec:\btbtbn.exe69⤵PID:3012
-
\??\c:\5pvpd.exec:\5pvpd.exe70⤵PID:2784
-
\??\c:\flrlxxf.exec:\flrlxxf.exe71⤵PID:1772
-
\??\c:\fxrxrxx.exec:\fxrxrxx.exe72⤵PID:604
-
\??\c:\7tntnb.exec:\7tntnb.exe73⤵PID:308
-
\??\c:\jdpvd.exec:\jdpvd.exe74⤵PID:2100
-
\??\c:\5jjpv.exec:\5jjpv.exe75⤵PID:1568
-
\??\c:\flxfllx.exec:\flxfllx.exe76⤵PID:3040
-
\??\c:\3fxrfff.exec:\3fxrfff.exe77⤵PID:2724
-
\??\c:\hbbnhn.exec:\hbbnhn.exe78⤵PID:1084
-
\??\c:\9nhthh.exec:\9nhthh.exe79⤵PID:2660
-
\??\c:\dvjvv.exec:\dvjvv.exe80⤵PID:2512
-
\??\c:\5jjvd.exec:\5jjvd.exe81⤵PID:2608
-
\??\c:\ffxlxfx.exec:\ffxlxfx.exe82⤵PID:2968
-
\??\c:\llxlrrf.exec:\llxlrrf.exe83⤵PID:2700
-
\??\c:\nhbbhh.exec:\nhbbhh.exe84⤵PID:2516
-
\??\c:\ttnbbh.exec:\ttnbbh.exe85⤵PID:2576
-
\??\c:\5vpdd.exec:\5vpdd.exe86⤵PID:2208
-
\??\c:\vpvdv.exec:\vpvdv.exe87⤵PID:1588
-
\??\c:\1rxrllf.exec:\1rxrllf.exe88⤵PID:1188
-
\??\c:\xxlxfxx.exec:\xxlxfxx.exe89⤵PID:2844
-
\??\c:\5ttbtb.exec:\5ttbtb.exe90⤵PID:2324
-
\??\c:\hbttbb.exec:\hbttbb.exe91⤵PID:1624
-
\??\c:\pjvjv.exec:\pjvjv.exe92⤵PID:1836
-
\??\c:\rrxxxfr.exec:\rrxxxfr.exe93⤵PID:1676
-
\??\c:\lxxxxll.exec:\lxxxxll.exe94⤵PID:1600
-
\??\c:\nhhtbh.exec:\nhhtbh.exe95⤵PID:2200
-
\??\c:\tntttt.exec:\tntttt.exe96⤵PID:1432
-
\??\c:\pppdj.exec:\pppdj.exe97⤵PID:1328
-
\??\c:\vpdjp.exec:\vpdjp.exe98⤵PID:840
-
\??\c:\rlxlrfl.exec:\rlxlrfl.exe99⤵PID:1272
-
\??\c:\bnbhtb.exec:\bnbhtb.exe100⤵PID:2744
-
\??\c:\tbtbhn.exec:\tbtbhn.exe101⤵PID:2692
-
\??\c:\jjjdp.exec:\jjjdp.exe102⤵PID:2072
-
\??\c:\pjjpd.exec:\pjjpd.exe103⤵PID:772
-
\??\c:\rfxxrrf.exec:\rfxxrrf.exe104⤵PID:532
-
\??\c:\rlflxfl.exec:\rlflxfl.exe105⤵PID:1028
-
\??\c:\tthnbb.exec:\tthnbb.exe106⤵PID:1808
-
\??\c:\pdvdp.exec:\pdvdp.exe107⤵PID:2372
-
\??\c:\jjjpp.exec:\jjjpp.exe108⤵PID:924
-
\??\c:\rrxxlrl.exec:\rrxxlrl.exe109⤵PID:1596
-
\??\c:\rxfffrr.exec:\rxfffrr.exe110⤵PID:756
-
\??\c:\nbntbb.exec:\nbntbb.exe111⤵PID:2288
-
\??\c:\pjvvd.exec:\pjvvd.exe112⤵PID:1620
-
\??\c:\vdpvd.exec:\vdpvd.exe113⤵PID:2332
-
\??\c:\xxllfrl.exec:\xxllfrl.exe114⤵PID:1184
-
\??\c:\3flrlrf.exec:\3flrlrf.exe115⤵PID:3032
-
\??\c:\ttthbn.exec:\ttthbn.exe116⤵PID:3028
-
\??\c:\btthtb.exec:\btthtb.exe117⤵PID:3036
-
\??\c:\3jdpd.exec:\3jdpd.exe118⤵PID:2684
-
\??\c:\flfrxrr.exec:\flfrxrr.exe119⤵PID:2120
-
\??\c:\rlxfrlx.exec:\rlxfrlx.exe120⤵PID:2720
-
\??\c:\nbtthn.exec:\nbtthn.exe121⤵PID:2636
-
\??\c:\jppvd.exec:\jppvd.exe122⤵PID:2860
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-