Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
15-05-2024 14:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d5afc026b48989055c3f50b560cfd590_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
d5afc026b48989055c3f50b560cfd590_NeikiAnalytics.exe
-
Size
56KB
-
MD5
d5afc026b48989055c3f50b560cfd590
-
SHA1
5b2001b50e115b9041029c0af803c0473ceb608c
-
SHA256
ac7caee2cc7011864bcdda6102cbe3a8274eb671788e0de5c1a70542ddbe8673
-
SHA512
9bdef22fbad5cbd8a80a5cdb4c67790c6bcc564126f22d3f1b8862f087ae94ef14ca886622874f6f213094eb72722d485720bf725d8507a5f53f4b9fb7911740
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb6tZ9bO:ymb3NkkiQ3mdBjFIb6tZNO
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/316-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2132-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1984-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1972-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1820-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1872-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1152-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2136-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/616-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/292-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/896-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 316 xrxfrxl.exe 2760 nhnttb.exe 2684 dpvvd.exe 2648 xrxxrrr.exe 2800 btbbhn.exe 2592 hbhnnn.exe 2408 5jpdv.exe 2612 fxrrflr.exe 2132 nhbhtb.exe 1984 nhtttb.exe 916 dvjvp.exe 1328 1rflrlr.exe 2200 rlflfff.exe 1972 9hbbtt.exe 1820 vvjpv.exe 2976 1jdjv.exe 1872 fflrllx.exe 1036 tntnbh.exe 2264 5nbnhh.exe 2820 jdjjp.exe 2832 9vpjp.exe 568 xrffxrx.exe 1152 nhtbhh.exe 2372 1ntbht.exe 2136 jjjpd.exe 616 7pvvj.exe 2032 llxflrf.exe 708 3nbhbb.exe 292 dvddj.exe 988 dvddp.exe 896 9xrlrxl.exe 1588 5rxxlrl.exe 2844 hhbbhh.exe 2792 7jvdd.exe 2584 7vpjj.exe 2932 9xxfrrf.exe 2324 xrllxfl.exe 2620 btnntt.exe 2752 bthhnt.exe 2780 dvppd.exe 2764 pjvvv.exe 2592 rlxxxxf.exe 2488 1lxlxfl.exe 2876 bthnhh.exe 2612 nhnnnt.exe 1672 vpdjj.exe 2012 jvpjp.exe 2768 fffxflf.exe 2580 5lxlxrx.exe 1756 hbbbbh.exe 1996 tnhhnt.exe 2044 vjdjj.exe 1820 7pjjp.exe 852 frfxfll.exe 1828 9lflrxf.exe 288 3htbnn.exe 1036 bnbtbt.exe 1160 dvjjj.exe 2712 dddjd.exe 2296 xllxfll.exe 692 lflrfxl.exe 1052 hbhnhn.exe 2376 9bnbhh.exe 816 ppdjv.exe -
resource yara_rule behavioral1/memory/316-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2132-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1984-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1972-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1820-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1872-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1152-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2136-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/616-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/292-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/896-299-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2912 wrote to memory of 316 2912 d5afc026b48989055c3f50b560cfd590_NeikiAnalytics.exe 28 PID 2912 wrote to memory of 316 2912 d5afc026b48989055c3f50b560cfd590_NeikiAnalytics.exe 28 PID 2912 wrote to memory of 316 2912 d5afc026b48989055c3f50b560cfd590_NeikiAnalytics.exe 28 PID 2912 wrote to memory of 316 2912 d5afc026b48989055c3f50b560cfd590_NeikiAnalytics.exe 28 PID 316 wrote to memory of 2760 316 xrxfrxl.exe 29 PID 316 wrote to memory of 2760 316 xrxfrxl.exe 29 PID 316 wrote to memory of 2760 316 xrxfrxl.exe 29 PID 316 wrote to memory of 2760 316 xrxfrxl.exe 29 PID 2760 wrote to memory of 2684 2760 nhnttb.exe 30 PID 2760 wrote to memory of 2684 2760 nhnttb.exe 30 PID 2760 wrote to memory of 2684 2760 nhnttb.exe 30 PID 2760 wrote to memory of 2684 2760 nhnttb.exe 30 PID 2684 wrote to memory of 2648 2684 dpvvd.exe 31 PID 2684 wrote to memory of 2648 2684 dpvvd.exe 31 PID 2684 wrote to memory of 2648 2684 dpvvd.exe 31 PID 2684 wrote to memory of 2648 2684 dpvvd.exe 31 PID 2648 wrote to memory of 2800 2648 xrxxrrr.exe 32 PID 2648 wrote to memory of 2800 2648 xrxxrrr.exe 32 PID 2648 wrote to memory of 2800 2648 xrxxrrr.exe 32 PID 2648 wrote to memory of 2800 2648 xrxxrrr.exe 32 PID 2800 wrote to memory of 2592 2800 btbbhn.exe 33 PID 2800 wrote to memory of 2592 2800 btbbhn.exe 33 PID 2800 wrote to memory of 2592 2800 btbbhn.exe 33 PID 2800 wrote to memory of 2592 2800 btbbhn.exe 33 PID 2592 wrote to memory of 2408 2592 hbhnnn.exe 34 PID 2592 wrote to memory of 2408 2592 hbhnnn.exe 34 PID 2592 wrote to memory of 2408 2592 hbhnnn.exe 34 PID 2592 wrote to memory of 2408 2592 hbhnnn.exe 34 PID 2408 wrote to memory of 2612 2408 5jpdv.exe 35 PID 2408 wrote to memory of 2612 2408 5jpdv.exe 35 PID 2408 wrote to memory of 2612 2408 5jpdv.exe 35 PID 2408 wrote to memory of 2612 2408 5jpdv.exe 35 PID 2612 wrote to memory of 2132 2612 fxrrflr.exe 36 PID 2612 wrote to memory of 2132 2612 fxrrflr.exe 36 PID 2612 wrote to memory of 2132 2612 fxrrflr.exe 36 PID 2612 wrote to memory of 2132 2612 fxrrflr.exe 36 PID 2132 wrote to memory of 1984 2132 nhbhtb.exe 37 PID 2132 wrote to memory of 1984 2132 nhbhtb.exe 37 PID 2132 wrote to memory of 1984 2132 nhbhtb.exe 37 PID 2132 wrote to memory of 1984 2132 nhbhtb.exe 37 PID 1984 wrote to memory of 916 1984 nhtttb.exe 38 PID 1984 wrote to memory of 916 1984 nhtttb.exe 38 PID 1984 wrote to memory of 916 1984 nhtttb.exe 38 PID 1984 wrote to memory of 916 1984 nhtttb.exe 38 PID 916 wrote to memory of 1328 916 dvjvp.exe 39 PID 916 wrote to memory of 1328 916 dvjvp.exe 39 PID 916 wrote to memory of 1328 916 dvjvp.exe 39 PID 916 wrote to memory of 1328 916 dvjvp.exe 39 PID 1328 wrote to memory of 2200 1328 1rflrlr.exe 40 PID 1328 wrote to memory of 2200 1328 1rflrlr.exe 40 PID 1328 wrote to memory of 2200 1328 1rflrlr.exe 40 PID 1328 wrote to memory of 2200 1328 1rflrlr.exe 40 PID 2200 wrote to memory of 1972 2200 rlflfff.exe 41 PID 2200 wrote to memory of 1972 2200 rlflfff.exe 41 PID 2200 wrote to memory of 1972 2200 rlflfff.exe 41 PID 2200 wrote to memory of 1972 2200 rlflfff.exe 41 PID 1972 wrote to memory of 1820 1972 9hbbtt.exe 42 PID 1972 wrote to memory of 1820 1972 9hbbtt.exe 42 PID 1972 wrote to memory of 1820 1972 9hbbtt.exe 42 PID 1972 wrote to memory of 1820 1972 9hbbtt.exe 42 PID 1820 wrote to memory of 2976 1820 vvjpv.exe 43 PID 1820 wrote to memory of 2976 1820 vvjpv.exe 43 PID 1820 wrote to memory of 2976 1820 vvjpv.exe 43 PID 1820 wrote to memory of 2976 1820 vvjpv.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5afc026b48989055c3f50b560cfd590_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d5afc026b48989055c3f50b560cfd590_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\xrxfrxl.exec:\xrxfrxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\nhnttb.exec:\nhnttb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\dpvvd.exec:\dpvvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\xrxxrrr.exec:\xrxxrrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\btbbhn.exec:\btbbhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\hbhnnn.exec:\hbhnnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\5jpdv.exec:\5jpdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\fxrrflr.exec:\fxrrflr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\nhbhtb.exec:\nhbhtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\nhtttb.exec:\nhtttb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\dvjvp.exec:\dvjvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
\??\c:\1rflrlr.exec:\1rflrlr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\rlflfff.exec:\rlflfff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\9hbbtt.exec:\9hbbtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\vvjpv.exec:\vvjpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\1jdjv.exec:\1jdjv.exe17⤵
- Executes dropped EXE
PID:2976 -
\??\c:\fflrllx.exec:\fflrllx.exe18⤵
- Executes dropped EXE
PID:1872 -
\??\c:\tntnbh.exec:\tntnbh.exe19⤵
- Executes dropped EXE
PID:1036 -
\??\c:\5nbnhh.exec:\5nbnhh.exe20⤵
- Executes dropped EXE
PID:2264 -
\??\c:\jdjjp.exec:\jdjjp.exe21⤵
- Executes dropped EXE
PID:2820 -
\??\c:\9vpjp.exec:\9vpjp.exe22⤵
- Executes dropped EXE
PID:2832 -
\??\c:\xrffxrx.exec:\xrffxrx.exe23⤵
- Executes dropped EXE
PID:568 -
\??\c:\nhtbhh.exec:\nhtbhh.exe24⤵
- Executes dropped EXE
PID:1152 -
\??\c:\1ntbht.exec:\1ntbht.exe25⤵
- Executes dropped EXE
PID:2372 -
\??\c:\jjjpd.exec:\jjjpd.exe26⤵
- Executes dropped EXE
PID:2136 -
\??\c:\7pvvj.exec:\7pvvj.exe27⤵
- Executes dropped EXE
PID:616 -
\??\c:\llxflrf.exec:\llxflrf.exe28⤵
- Executes dropped EXE
PID:2032 -
\??\c:\3nbhbb.exec:\3nbhbb.exe29⤵
- Executes dropped EXE
PID:708 -
\??\c:\dvddj.exec:\dvddj.exe30⤵
- Executes dropped EXE
PID:292 -
\??\c:\dvddp.exec:\dvddp.exe31⤵
- Executes dropped EXE
PID:988 -
\??\c:\9xrlrxl.exec:\9xrlrxl.exe32⤵
- Executes dropped EXE
PID:896 -
\??\c:\5rxxlrl.exec:\5rxxlrl.exe33⤵
- Executes dropped EXE
PID:1588 -
\??\c:\hhbbhh.exec:\hhbbhh.exe34⤵
- Executes dropped EXE
PID:2844 -
\??\c:\7jvdd.exec:\7jvdd.exe35⤵
- Executes dropped EXE
PID:2792 -
\??\c:\7vpjj.exec:\7vpjj.exe36⤵
- Executes dropped EXE
PID:2584 -
\??\c:\9xxfrrf.exec:\9xxfrrf.exe37⤵
- Executes dropped EXE
PID:2932 -
\??\c:\xrllxfl.exec:\xrllxfl.exe38⤵
- Executes dropped EXE
PID:2324 -
\??\c:\btnntt.exec:\btnntt.exe39⤵
- Executes dropped EXE
PID:2620 -
\??\c:\bthhnt.exec:\bthhnt.exe40⤵
- Executes dropped EXE
PID:2752 -
\??\c:\dvppd.exec:\dvppd.exe41⤵
- Executes dropped EXE
PID:2780 -
\??\c:\pjvvv.exec:\pjvvv.exe42⤵
- Executes dropped EXE
PID:2764 -
\??\c:\rlxxxxf.exec:\rlxxxxf.exe43⤵
- Executes dropped EXE
PID:2592 -
\??\c:\1lxlxfl.exec:\1lxlxfl.exe44⤵
- Executes dropped EXE
PID:2488 -
\??\c:\bthnhh.exec:\bthnhh.exe45⤵
- Executes dropped EXE
PID:2876 -
\??\c:\nhnnnt.exec:\nhnnnt.exe46⤵
- Executes dropped EXE
PID:2612 -
\??\c:\vpdjj.exec:\vpdjj.exe47⤵
- Executes dropped EXE
PID:1672 -
\??\c:\jvpjp.exec:\jvpjp.exe48⤵
- Executes dropped EXE
PID:2012 -
\??\c:\fffxflf.exec:\fffxflf.exe49⤵
- Executes dropped EXE
PID:2768 -
\??\c:\5lxlxrx.exec:\5lxlxrx.exe50⤵
- Executes dropped EXE
PID:2580 -
\??\c:\hbbbbh.exec:\hbbbbh.exe51⤵
- Executes dropped EXE
PID:1756 -
\??\c:\tnhhnt.exec:\tnhhnt.exe52⤵
- Executes dropped EXE
PID:1996 -
\??\c:\vjdjj.exec:\vjdjj.exe53⤵
- Executes dropped EXE
PID:2044 -
\??\c:\7pjjp.exec:\7pjjp.exe54⤵
- Executes dropped EXE
PID:1820 -
\??\c:\frfxfll.exec:\frfxfll.exe55⤵
- Executes dropped EXE
PID:852 -
\??\c:\9lflrxf.exec:\9lflrxf.exe56⤵
- Executes dropped EXE
PID:1828 -
\??\c:\3htbnn.exec:\3htbnn.exe57⤵
- Executes dropped EXE
PID:288 -
\??\c:\bnbtbt.exec:\bnbtbt.exe58⤵
- Executes dropped EXE
PID:1036 -
\??\c:\dvjjj.exec:\dvjjj.exe59⤵
- Executes dropped EXE
PID:1160 -
\??\c:\dddjd.exec:\dddjd.exe60⤵
- Executes dropped EXE
PID:2712 -
\??\c:\xllxfll.exec:\xllxfll.exe61⤵
- Executes dropped EXE
PID:2296 -
\??\c:\lflrfxl.exec:\lflrfxl.exe62⤵
- Executes dropped EXE
PID:692 -
\??\c:\hbhnhn.exec:\hbhnhn.exe63⤵
- Executes dropped EXE
PID:1052 -
\??\c:\9bnbhh.exec:\9bnbhh.exe64⤵
- Executes dropped EXE
PID:2376 -
\??\c:\ppdjv.exec:\ppdjv.exe65⤵
- Executes dropped EXE
PID:816 -
\??\c:\1vjjv.exec:\1vjjv.exe66⤵PID:912
-
\??\c:\lfxxflr.exec:\lfxxflr.exe67⤵PID:2020
-
\??\c:\hbntnh.exec:\hbntnh.exe68⤵PID:2008
-
\??\c:\pvjjp.exec:\pvjjp.exe69⤵PID:1556
-
\??\c:\5dvdj.exec:\5dvdj.exe70⤵PID:1704
-
\??\c:\1dppp.exec:\1dppp.exe71⤵PID:1536
-
\??\c:\fxlxlrr.exec:\fxlxlrr.exe72⤵PID:2220
-
\??\c:\fxlfflr.exec:\fxlfflr.exe73⤵PID:2852
-
\??\c:\7bnnhn.exec:\7bnnhn.exe74⤵PID:2900
-
\??\c:\5nnbhh.exec:\5nnbhh.exe75⤵PID:1728
-
\??\c:\1jdpd.exec:\1jdpd.exe76⤵PID:1396
-
\??\c:\jdppd.exec:\jdppd.exe77⤵PID:2672
-
\??\c:\fxfrflx.exec:\fxfrflx.exe78⤵PID:2600
-
\??\c:\lxllrxl.exec:\lxllrxl.exe79⤵PID:2700
-
\??\c:\btntht.exec:\btntht.exe80⤵PID:2644
-
\??\c:\tnbnnn.exec:\tnbnnn.exe81⤵PID:2736
-
\??\c:\pdjvd.exec:\pdjvd.exe82⤵PID:2316
-
\??\c:\ppdvd.exec:\ppdvd.exe83⤵PID:2628
-
\??\c:\3jvvd.exec:\3jvvd.exe84⤵PID:2520
-
\??\c:\xxlllfl.exec:\xxlllfl.exe85⤵PID:2524
-
\??\c:\9flflll.exec:\9flflll.exe86⤵PID:2944
-
\??\c:\nhhnth.exec:\nhhnth.exe87⤵PID:2152
-
\??\c:\tnhhnt.exec:\tnhhnt.exe88⤵PID:1856
-
\??\c:\9jjpp.exec:\9jjpp.exe89⤵PID:2148
-
\??\c:\pjpvd.exec:\pjpvd.exe90⤵PID:1656
-
\??\c:\fxllllr.exec:\fxllllr.exe91⤵PID:1320
-
\??\c:\rfrrllx.exec:\rfrrllx.exe92⤵PID:2188
-
\??\c:\btbnbt.exec:\btbnbt.exe93⤵PID:2200
-
\??\c:\hbhhnn.exec:\hbhhnn.exe94⤵PID:1428
-
\??\c:\jdddp.exec:\jdddp.exe95⤵PID:1796
-
\??\c:\pdppd.exec:\pdppd.exe96⤵PID:1948
-
\??\c:\xlflxfl.exec:\xlflxfl.exe97⤵PID:1804
-
\??\c:\xrxxllr.exec:\xrxxllr.exe98⤵PID:768
-
\??\c:\btbhnn.exec:\btbhnn.exe99⤵PID:772
-
\??\c:\3btthn.exec:\3btthn.exe100⤵PID:2236
-
\??\c:\9pdjv.exec:\9pdjv.exe101⤵PID:2176
-
\??\c:\pdvpv.exec:\pdvpv.exe102⤵PID:2104
-
\??\c:\lfllllr.exec:\lfllllr.exe103⤵PID:264
-
\??\c:\fxfrxfr.exec:\fxfrxfr.exe104⤵PID:568
-
\??\c:\nhtbnn.exec:\nhtbnn.exe105⤵PID:1088
-
\??\c:\bnhhhb.exec:\bnhhhb.exe106⤵PID:1868
-
\??\c:\dpvdd.exec:\dpvdd.exe107⤵PID:1132
-
\??\c:\7pppv.exec:\7pppv.exe108⤵PID:1008
-
\??\c:\frllllr.exec:\frllllr.exe109⤵PID:616
-
\??\c:\rlxfrxr.exec:\rlxfrxr.exe110⤵PID:552
-
\??\c:\tttbhb.exec:\tttbhb.exe111⤵PID:2924
-
\??\c:\tnbnbn.exec:\tnbnbn.exe112⤵PID:788
-
\??\c:\hnbhtb.exec:\hnbhtb.exe113⤵PID:2344
-
\??\c:\pjvvd.exec:\pjvvd.exe114⤵PID:2864
-
\??\c:\pdppp.exec:\pdppp.exe115⤵PID:1508
-
\??\c:\frxfrrf.exec:\frxfrrf.exe116⤵PID:2912
-
\??\c:\xlrrrxf.exec:\xlrrrxf.exe117⤵PID:1732
-
\??\c:\tnbhtt.exec:\tnbhtt.exe118⤵PID:848
-
\??\c:\hthhbb.exec:\hthhbb.exe119⤵PID:2584
-
\??\c:\jdpdp.exec:\jdpdp.exe120⤵PID:2676
-
\??\c:\xrffffl.exec:\xrffffl.exe121⤵PID:2324
-
\??\c:\9xrrxfl.exec:\9xrrxfl.exe122⤵PID:2716
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-