Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 20:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f9cab79ffdb3a86775e5a10fdd97f960_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
f9cab79ffdb3a86775e5a10fdd97f960_NeikiAnalytics.exe
-
Size
59KB
-
MD5
f9cab79ffdb3a86775e5a10fdd97f960
-
SHA1
791bb55121a5def4a9787b1dd10f908531272d76
-
SHA256
d1ba04ee89069f4fa51e3eaf318c3a9a4d82b93f4dc478cb984664b7f534c97c
-
SHA512
0d1b4089e4dce1385608962fd757dd7756bc5da431969c67c11ecd2eb130d71ac902e3668bf5bd1f6cf6b51643caf9db685f5d6f93937bbbfaf72ca7ed4d7604
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk9UWt:ymb3NkkiQ3mdBjFIvlqm
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/1660-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2292-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2296-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2000-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1800-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1688-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/560-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/664-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/620-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1480-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2292 frxllfx.exe 2496 tthbnt.exe 2748 bntnnt.exe 2584 vpvdp.exe 2672 rlfxffl.exe 2296 nhttbb.exe 2440 vpdjp.exe 2832 vjvvd.exe 2088 xxrxxlr.exe 2352 tnnnbb.exe 2000 dddjd.exe 320 pjvpp.exe 1800 lxllxfx.exe 1992 ffrrflx.exe 2036 tnhnhn.exe 1688 nhhhht.exe 2812 vvjjv.exe 3032 5jdvj.exe 1920 xrlrxlx.exe 2836 lfxlxxl.exe 560 nnnnbn.exe 664 7bnntn.exe 648 9vpvj.exe 620 vpdjj.exe 2772 fxflllr.exe 1864 fxrlrrr.exe 1064 hbhnbt.exe 2856 jjdjv.exe 1480 7flfllr.exe 2200 ffrfxfr.exe 900 hbhbhh.exe 2184 ddvvp.exe 1540 vppvv.exe 2632 1flfllx.exe 2516 5lrxfxr.exe 2640 hbnnbb.exe 2608 btntbb.exe 2468 dpddd.exe 2532 9jdjp.exe 2376 3xrlrrx.exe 2420 fxlrxxl.exe 2440 5nhtbh.exe 2416 hthhth.exe 1228 pjpdd.exe 1052 vpppp.exe 2088 rxlrrxf.exe 1220 rrrlrrl.exe 1604 ntbbth.exe 1888 hbtnnn.exe 2016 vjvvd.exe 1800 pvppj.exe 1892 lxxlxrf.exe 1808 9rrfffr.exe 2696 fxlflfl.exe 2692 tttbhn.exe 2196 nhnnbn.exe 844 5jjvj.exe 536 rlxrrrx.exe 480 ffflxxx.exe 792 nhbbhh.exe 1420 7bnbbt.exe 1320 9pdvd.exe 3068 vjppv.exe 452 rlllllr.exe -
resource yara_rule behavioral1/memory/1660-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2000-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1800-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1688-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/560-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/664-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/620-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1480-290-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1660 wrote to memory of 2292 1660 f9cab79ffdb3a86775e5a10fdd97f960_NeikiAnalytics.exe 28 PID 1660 wrote to memory of 2292 1660 f9cab79ffdb3a86775e5a10fdd97f960_NeikiAnalytics.exe 28 PID 1660 wrote to memory of 2292 1660 f9cab79ffdb3a86775e5a10fdd97f960_NeikiAnalytics.exe 28 PID 1660 wrote to memory of 2292 1660 f9cab79ffdb3a86775e5a10fdd97f960_NeikiAnalytics.exe 28 PID 2292 wrote to memory of 2496 2292 frxllfx.exe 29 PID 2292 wrote to memory of 2496 2292 frxllfx.exe 29 PID 2292 wrote to memory of 2496 2292 frxllfx.exe 29 PID 2292 wrote to memory of 2496 2292 frxllfx.exe 29 PID 2496 wrote to memory of 2748 2496 tthbnt.exe 30 PID 2496 wrote to memory of 2748 2496 tthbnt.exe 30 PID 2496 wrote to memory of 2748 2496 tthbnt.exe 30 PID 2496 wrote to memory of 2748 2496 tthbnt.exe 30 PID 2748 wrote to memory of 2584 2748 bntnnt.exe 31 PID 2748 wrote to memory of 2584 2748 bntnnt.exe 31 PID 2748 wrote to memory of 2584 2748 bntnnt.exe 31 PID 2748 wrote to memory of 2584 2748 bntnnt.exe 31 PID 2584 wrote to memory of 2672 2584 vpvdp.exe 32 PID 2584 wrote to memory of 2672 2584 vpvdp.exe 32 PID 2584 wrote to memory of 2672 2584 vpvdp.exe 32 PID 2584 wrote to memory of 2672 2584 vpvdp.exe 32 PID 2672 wrote to memory of 2296 2672 rlfxffl.exe 33 PID 2672 wrote to memory of 2296 2672 rlfxffl.exe 33 PID 2672 wrote to memory of 2296 2672 rlfxffl.exe 33 PID 2672 wrote to memory of 2296 2672 rlfxffl.exe 33 PID 2296 wrote to memory of 2440 2296 nhttbb.exe 34 PID 2296 wrote to memory of 2440 2296 nhttbb.exe 34 PID 2296 wrote to memory of 2440 2296 nhttbb.exe 34 PID 2296 wrote to memory of 2440 2296 nhttbb.exe 34 PID 2440 wrote to memory of 2832 2440 vpdjp.exe 35 PID 2440 wrote to memory of 2832 2440 vpdjp.exe 35 PID 2440 wrote to memory of 2832 2440 vpdjp.exe 35 PID 2440 wrote to memory of 2832 2440 vpdjp.exe 35 PID 2832 wrote to memory of 2088 2832 vjvvd.exe 36 PID 2832 wrote to memory of 2088 2832 vjvvd.exe 36 PID 2832 wrote to memory of 2088 2832 vjvvd.exe 36 PID 2832 wrote to memory of 2088 2832 vjvvd.exe 36 PID 2088 wrote to memory of 2352 2088 xxrxxlr.exe 37 PID 2088 wrote to memory of 2352 2088 xxrxxlr.exe 37 PID 2088 wrote to memory of 2352 2088 xxrxxlr.exe 37 PID 2088 wrote to memory of 2352 2088 xxrxxlr.exe 37 PID 2352 wrote to memory of 2000 2352 tnnnbb.exe 38 PID 2352 wrote to memory of 2000 2352 tnnnbb.exe 38 PID 2352 wrote to memory of 2000 2352 tnnnbb.exe 38 PID 2352 wrote to memory of 2000 2352 tnnnbb.exe 38 PID 2000 wrote to memory of 320 2000 dddjd.exe 39 PID 2000 wrote to memory of 320 2000 dddjd.exe 39 PID 2000 wrote to memory of 320 2000 dddjd.exe 39 PID 2000 wrote to memory of 320 2000 dddjd.exe 39 PID 320 wrote to memory of 1800 320 pjvpp.exe 40 PID 320 wrote to memory of 1800 320 pjvpp.exe 40 PID 320 wrote to memory of 1800 320 pjvpp.exe 40 PID 320 wrote to memory of 1800 320 pjvpp.exe 40 PID 1800 wrote to memory of 1992 1800 lxllxfx.exe 41 PID 1800 wrote to memory of 1992 1800 lxllxfx.exe 41 PID 1800 wrote to memory of 1992 1800 lxllxfx.exe 41 PID 1800 wrote to memory of 1992 1800 lxllxfx.exe 41 PID 1992 wrote to memory of 2036 1992 ffrrflx.exe 42 PID 1992 wrote to memory of 2036 1992 ffrrflx.exe 42 PID 1992 wrote to memory of 2036 1992 ffrrflx.exe 42 PID 1992 wrote to memory of 2036 1992 ffrrflx.exe 42 PID 2036 wrote to memory of 1688 2036 tnhnhn.exe 43 PID 2036 wrote to memory of 1688 2036 tnhnhn.exe 43 PID 2036 wrote to memory of 1688 2036 tnhnhn.exe 43 PID 2036 wrote to memory of 1688 2036 tnhnhn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9cab79ffdb3a86775e5a10fdd97f960_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\f9cab79ffdb3a86775e5a10fdd97f960_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\frxllfx.exec:\frxllfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\tthbnt.exec:\tthbnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\bntnnt.exec:\bntnnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\vpvdp.exec:\vpvdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\rlfxffl.exec:\rlfxffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\nhttbb.exec:\nhttbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\vpdjp.exec:\vpdjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\vjvvd.exec:\vjvvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\xxrxxlr.exec:\xxrxxlr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\tnnnbb.exec:\tnnnbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\dddjd.exec:\dddjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\pjvpp.exec:\pjvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\lxllxfx.exec:\lxllxfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\ffrrflx.exec:\ffrrflx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\tnhnhn.exec:\tnhnhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\nhhhht.exec:\nhhhht.exe17⤵
- Executes dropped EXE
PID:1688 -
\??\c:\vvjjv.exec:\vvjjv.exe18⤵
- Executes dropped EXE
PID:2812 -
\??\c:\5jdvj.exec:\5jdvj.exe19⤵
- Executes dropped EXE
PID:3032 -
\??\c:\xrlrxlx.exec:\xrlrxlx.exe20⤵
- Executes dropped EXE
PID:1920 -
\??\c:\lfxlxxl.exec:\lfxlxxl.exe21⤵
- Executes dropped EXE
PID:2836 -
\??\c:\nnnnbn.exec:\nnnnbn.exe22⤵
- Executes dropped EXE
PID:560 -
\??\c:\7bnntn.exec:\7bnntn.exe23⤵
- Executes dropped EXE
PID:664 -
\??\c:\9vpvj.exec:\9vpvj.exe24⤵
- Executes dropped EXE
PID:648 -
\??\c:\vpdjj.exec:\vpdjj.exe25⤵
- Executes dropped EXE
PID:620 -
\??\c:\fxflllr.exec:\fxflllr.exe26⤵
- Executes dropped EXE
PID:2772 -
\??\c:\fxrlrrr.exec:\fxrlrrr.exe27⤵
- Executes dropped EXE
PID:1864 -
\??\c:\hbhnbt.exec:\hbhnbt.exe28⤵
- Executes dropped EXE
PID:1064 -
\??\c:\jjdjv.exec:\jjdjv.exe29⤵
- Executes dropped EXE
PID:2856 -
\??\c:\7flfllr.exec:\7flfllr.exe30⤵
- Executes dropped EXE
PID:1480 -
\??\c:\ffrfxfr.exec:\ffrfxfr.exe31⤵
- Executes dropped EXE
PID:2200 -
\??\c:\hbhbhh.exec:\hbhbhh.exe32⤵
- Executes dropped EXE
PID:900 -
\??\c:\ddvvp.exec:\ddvvp.exe33⤵
- Executes dropped EXE
PID:2184 -
\??\c:\vvjpp.exec:\vvjpp.exe34⤵PID:3004
-
\??\c:\vppvv.exec:\vppvv.exe35⤵
- Executes dropped EXE
PID:1540 -
\??\c:\1flfllx.exec:\1flfllx.exe36⤵
- Executes dropped EXE
PID:2632 -
\??\c:\5lrxfxr.exec:\5lrxfxr.exe37⤵
- Executes dropped EXE
PID:2516 -
\??\c:\hbnnbb.exec:\hbnnbb.exe38⤵
- Executes dropped EXE
PID:2640 -
\??\c:\btntbb.exec:\btntbb.exe39⤵
- Executes dropped EXE
PID:2608 -
\??\c:\dpddd.exec:\dpddd.exe40⤵
- Executes dropped EXE
PID:2468 -
\??\c:\9jdjp.exec:\9jdjp.exe41⤵
- Executes dropped EXE
PID:2532 -
\??\c:\3xrlrrx.exec:\3xrlrrx.exe42⤵
- Executes dropped EXE
PID:2376 -
\??\c:\fxlrxxl.exec:\fxlrxxl.exe43⤵
- Executes dropped EXE
PID:2420 -
\??\c:\5nhtbh.exec:\5nhtbh.exe44⤵
- Executes dropped EXE
PID:2440 -
\??\c:\hthhth.exec:\hthhth.exe45⤵
- Executes dropped EXE
PID:2416 -
\??\c:\pjpdd.exec:\pjpdd.exe46⤵
- Executes dropped EXE
PID:1228 -
\??\c:\vpppp.exec:\vpppp.exe47⤵
- Executes dropped EXE
PID:1052 -
\??\c:\rxlrrxf.exec:\rxlrrxf.exe48⤵
- Executes dropped EXE
PID:2088 -
\??\c:\rrrlrrl.exec:\rrrlrrl.exe49⤵
- Executes dropped EXE
PID:1220 -
\??\c:\ntbbth.exec:\ntbbth.exe50⤵
- Executes dropped EXE
PID:1604 -
\??\c:\hbtnnn.exec:\hbtnnn.exe51⤵
- Executes dropped EXE
PID:1888 -
\??\c:\vjvvd.exec:\vjvvd.exe52⤵
- Executes dropped EXE
PID:2016 -
\??\c:\pvppj.exec:\pvppj.exe53⤵
- Executes dropped EXE
PID:1800 -
\??\c:\lxxlxrf.exec:\lxxlxrf.exe54⤵
- Executes dropped EXE
PID:1892 -
\??\c:\9rrfffr.exec:\9rrfffr.exe55⤵
- Executes dropped EXE
PID:1808 -
\??\c:\fxlflfl.exec:\fxlflfl.exe56⤵
- Executes dropped EXE
PID:2696 -
\??\c:\tttbhn.exec:\tttbhn.exe57⤵
- Executes dropped EXE
PID:2692 -
\??\c:\nhnnbn.exec:\nhnnbn.exe58⤵
- Executes dropped EXE
PID:2196 -
\??\c:\5jjvj.exec:\5jjvj.exe59⤵
- Executes dropped EXE
PID:844 -
\??\c:\rlxrrrx.exec:\rlxrrrx.exe60⤵
- Executes dropped EXE
PID:536 -
\??\c:\ffflxxx.exec:\ffflxxx.exe61⤵
- Executes dropped EXE
PID:480 -
\??\c:\nhbbhh.exec:\nhbbhh.exe62⤵
- Executes dropped EXE
PID:792 -
\??\c:\7bnbbt.exec:\7bnbbt.exe63⤵
- Executes dropped EXE
PID:1420 -
\??\c:\9pdvd.exec:\9pdvd.exe64⤵
- Executes dropped EXE
PID:1320 -
\??\c:\vjppv.exec:\vjppv.exe65⤵
- Executes dropped EXE
PID:3068 -
\??\c:\rlllllr.exec:\rlllllr.exe66⤵
- Executes dropped EXE
PID:452 -
\??\c:\7rflrll.exec:\7rflrll.exe67⤵PID:2972
-
\??\c:\htnttn.exec:\htnttn.exe68⤵PID:2968
-
\??\c:\hhttnb.exec:\hhttnb.exe69⤵PID:2900
-
\??\c:\hbnnnt.exec:\hbnnnt.exe70⤵PID:1740
-
\??\c:\vjdpv.exec:\vjdpv.exe71⤵PID:344
-
\??\c:\7pdpv.exec:\7pdpv.exe72⤵PID:1468
-
\??\c:\xfrllrx.exec:\xfrllrx.exe73⤵PID:1652
-
\??\c:\xrfrxff.exec:\xrfrxff.exe74⤵PID:2804
-
\??\c:\nbbhbb.exec:\nbbhbb.exe75⤵PID:2112
-
\??\c:\vpjjj.exec:\vpjjj.exe76⤵PID:2176
-
\??\c:\lxrlllx.exec:\lxrlllx.exe77⤵PID:1512
-
\??\c:\7ttbtb.exec:\7ttbtb.exe78⤵PID:2956
-
\??\c:\tbnnhb.exec:\tbnnhb.exe79⤵PID:2472
-
\??\c:\ppddj.exec:\ppddj.exe80⤵PID:2496
-
\??\c:\vdjpp.exec:\vdjpp.exe81⤵PID:2652
-
\??\c:\1llrxfr.exec:\1llrxfr.exe82⤵PID:2600
-
\??\c:\5rffffl.exec:\5rffffl.exe83⤵PID:2468
-
\??\c:\rllfrxl.exec:\rllfrxl.exe84⤵PID:2392
-
\??\c:\tthhnn.exec:\tthhnn.exe85⤵PID:2376
-
\??\c:\hhthhn.exec:\hhthhn.exe86⤵PID:2296
-
\??\c:\pdppd.exec:\pdppd.exe87⤵PID:2440
-
\??\c:\dvjpp.exec:\dvjpp.exe88⤵PID:2824
-
\??\c:\rlxxfff.exec:\rlxxfff.exe89⤵PID:1276
-
\??\c:\bnbbhn.exec:\bnbbhn.exe90⤵PID:1956
-
\??\c:\hbnnnt.exec:\hbnnnt.exe91⤵PID:1936
-
\??\c:\3hhhbh.exec:\3hhhbh.exe92⤵PID:2020
-
\??\c:\dvppd.exec:\dvppd.exe93⤵PID:2000
-
\??\c:\7jvvj.exec:\7jvvj.exe94⤵PID:2096
-
\??\c:\rfrxffl.exec:\rfrxffl.exe95⤵PID:920
-
\??\c:\fxrxffr.exec:\fxrxffr.exe96⤵PID:1648
-
\??\c:\btthbh.exec:\btthbh.exe97⤵PID:1892
-
\??\c:\tntbhn.exec:\tntbhn.exe98⤵PID:2036
-
\??\c:\vjvpp.exec:\vjvpp.exe99⤵PID:2696
-
\??\c:\vvvjd.exec:\vvvjd.exe100⤵PID:2676
-
\??\c:\frxflfr.exec:\frxflfr.exe101⤵PID:864
-
\??\c:\fllllfr.exec:\fllllfr.exe102⤵PID:1572
-
\??\c:\bttbhn.exec:\bttbhn.exe103⤵PID:536
-
\??\c:\tnbntb.exec:\tnbntb.exe104⤵PID:892
-
\??\c:\dvjdp.exec:\dvjdp.exe105⤵PID:592
-
\??\c:\vjpvj.exec:\vjpvj.exe106⤵PID:2580
-
\??\c:\lfrrrrf.exec:\lfrrrrf.exe107⤵PID:1628
-
\??\c:\5xrxflr.exec:\5xrxflr.exe108⤵PID:1016
-
\??\c:\bthnnn.exec:\bthnnn.exe109⤵PID:1848
-
\??\c:\hbbtnn.exec:\hbbtnn.exe110⤵PID:704
-
\??\c:\7jddd.exec:\7jddd.exe111⤵PID:2968
-
\??\c:\vpddd.exec:\vpddd.exe112⤵PID:2984
-
\??\c:\xrllrxl.exec:\xrllrxl.exe113⤵PID:1740
-
\??\c:\fxllxxl.exec:\fxllxxl.exe114⤵PID:344
-
\??\c:\tnnhht.exec:\tnnhht.exe115⤵PID:1468
-
\??\c:\5tnthn.exec:\5tnthn.exe116⤵PID:2056
-
\??\c:\jdjdd.exec:\jdjdd.exe117⤵PID:1660
-
\??\c:\9jvjp.exec:\9jvjp.exe118⤵PID:900
-
\??\c:\lxlrrrx.exec:\lxlrrrx.exe119⤵PID:2176
-
\??\c:\fxffffr.exec:\fxffffr.exe120⤵PID:1656
-
\??\c:\bhnhbh.exec:\bhnhbh.exe121⤵PID:2956
-
\??\c:\htnntb.exec:\htnntb.exe122⤵PID:1244
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-