Analysis
-
max time kernel
81s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 22:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
135fc4914e879247fd8951963012db10_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
135fc4914e879247fd8951963012db10_NeikiAnalytics.exe
-
Size
65KB
-
MD5
135fc4914e879247fd8951963012db10
-
SHA1
066e34c413d54a9b4988b58957e64799c8f4d1ac
-
SHA256
b2432b844c7a40263894904a48b2675c207c57bb23f5239fbb405b1628075c9b
-
SHA512
2b0a039a3472fc82e10daf84ac6b2764557ab80e720d0a6c5a8163efd2eaf0d74fa2ab3c3ed41491e880acf4b9f31b947ff6d66383a1615433c993a871eab9a5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfQ:ymb3NkkiQ3mdBjFI4Vc
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2380-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1784-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-305-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1052-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2020-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2252-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/596-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2296-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1756-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1168-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1088-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2344-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2380 frllrrr.exe 3016 rrlrxxr.exe 2568 nnnbbh.exe 2580 nnhtnt.exe 2104 ddvvj.exe 2776 vvjvj.exe 2724 5xlfrxl.exe 2548 rlxxflr.exe 1644 nnbbbh.exe 2344 nbthnb.exe 944 pppjd.exe 1088 xrrxlxr.exe 1168 htbbhb.exe 1332 1bhtbh.exe 2660 9vjjp.exe 1756 ppvdv.exe 1784 llxlxxf.exe 2940 7rrrlll.exe 1216 1hthbt.exe 2296 1htbtn.exe 596 vpdpv.exe 2452 pjdpd.exe 2252 xxlrlrx.exe 2368 lfllxff.exe 1028 tthnbb.exe 2020 nhnhnn.exe 1052 pdjpd.exe 2360 rrlrflx.exe 1008 xfxrfrf.exe 1092 lxrlllr.exe 2312 ttntnb.exe 2964 nthbbt.exe 1488 djjpv.exe 2952 llfrfxx.exe 2700 lfxfrxf.exe 2844 xlrrxxl.exe 2068 ntbbbt.exe 2388 vdjjd.exe 2492 jvjvd.exe 2532 1rrxlrl.exe 2596 llxlxfr.exe 2752 btnbth.exe 2176 3tntbn.exe 2344 dvjpd.exe 1376 ddvdv.exe 1980 lfrrlrx.exe 2936 lxrrxxl.exe 2676 9hbhnb.exe 2552 tbbthn.exe 1712 nhtbhb.exe 2168 jjdjv.exe 2188 ppjpd.exe 1136 5rrrxfr.exe 876 ffxrlxl.exe 688 hntnbb.exe 2736 thbnbt.exe 1228 9btthh.exe 828 jdvjv.exe 680 rrflxlr.exe 1196 nhtbhn.exe 1880 nbtbhh.exe 1028 tntbtb.exe 2300 pjpvv.exe 2020 frfxllx.exe -
resource yara_rule behavioral1/memory/2380-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2104-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1784-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-305-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1052-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2252-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/596-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1756-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1168-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1088-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2104-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2104-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-3-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2880 wrote to memory of 2380 2880 135fc4914e879247fd8951963012db10_NeikiAnalytics.exe 28 PID 2880 wrote to memory of 2380 2880 135fc4914e879247fd8951963012db10_NeikiAnalytics.exe 28 PID 2880 wrote to memory of 2380 2880 135fc4914e879247fd8951963012db10_NeikiAnalytics.exe 28 PID 2880 wrote to memory of 2380 2880 135fc4914e879247fd8951963012db10_NeikiAnalytics.exe 28 PID 2380 wrote to memory of 3016 2380 frllrrr.exe 29 PID 2380 wrote to memory of 3016 2380 frllrrr.exe 29 PID 2380 wrote to memory of 3016 2380 frllrrr.exe 29 PID 2380 wrote to memory of 3016 2380 frllrrr.exe 29 PID 3016 wrote to memory of 2568 3016 rrlrxxr.exe 30 PID 3016 wrote to memory of 2568 3016 rrlrxxr.exe 30 PID 3016 wrote to memory of 2568 3016 rrlrxxr.exe 30 PID 3016 wrote to memory of 2568 3016 rrlrxxr.exe 30 PID 2568 wrote to memory of 2580 2568 nnnbbh.exe 31 PID 2568 wrote to memory of 2580 2568 nnnbbh.exe 31 PID 2568 wrote to memory of 2580 2568 nnnbbh.exe 31 PID 2568 wrote to memory of 2580 2568 nnnbbh.exe 31 PID 2580 wrote to memory of 2104 2580 nnhtnt.exe 32 PID 2580 wrote to memory of 2104 2580 nnhtnt.exe 32 PID 2580 wrote to memory of 2104 2580 nnhtnt.exe 32 PID 2580 wrote to memory of 2104 2580 nnhtnt.exe 32 PID 2104 wrote to memory of 2776 2104 ddvvj.exe 33 PID 2104 wrote to memory of 2776 2104 ddvvj.exe 33 PID 2104 wrote to memory of 2776 2104 ddvvj.exe 33 PID 2104 wrote to memory of 2776 2104 ddvvj.exe 33 PID 2776 wrote to memory of 2724 2776 vvjvj.exe 34 PID 2776 wrote to memory of 2724 2776 vvjvj.exe 34 PID 2776 wrote to memory of 2724 2776 vvjvj.exe 34 PID 2776 wrote to memory of 2724 2776 vvjvj.exe 34 PID 2724 wrote to memory of 2548 2724 5xlfrxl.exe 150 PID 2724 wrote to memory of 2548 2724 5xlfrxl.exe 150 PID 2724 wrote to memory of 2548 2724 5xlfrxl.exe 150 PID 2724 wrote to memory of 2548 2724 5xlfrxl.exe 150 PID 2548 wrote to memory of 1644 2548 rlxxflr.exe 236 PID 2548 wrote to memory of 1644 2548 rlxxflr.exe 236 PID 2548 wrote to memory of 1644 2548 rlxxflr.exe 236 PID 2548 wrote to memory of 1644 2548 rlxxflr.exe 236 PID 1644 wrote to memory of 2344 1644 nnbbbh.exe 71 PID 1644 wrote to memory of 2344 1644 nnbbbh.exe 71 PID 1644 wrote to memory of 2344 1644 nnbbbh.exe 71 PID 1644 wrote to memory of 2344 1644 nnbbbh.exe 71 PID 2344 wrote to memory of 944 2344 nbthnb.exe 38 PID 2344 wrote to memory of 944 2344 nbthnb.exe 38 PID 2344 wrote to memory of 944 2344 nbthnb.exe 38 PID 2344 wrote to memory of 944 2344 nbthnb.exe 38 PID 944 wrote to memory of 1088 944 pppjd.exe 39 PID 944 wrote to memory of 1088 944 pppjd.exe 39 PID 944 wrote to memory of 1088 944 pppjd.exe 39 PID 944 wrote to memory of 1088 944 pppjd.exe 39 PID 1088 wrote to memory of 1168 1088 xrrxlxr.exe 40 PID 1088 wrote to memory of 1168 1088 xrrxlxr.exe 40 PID 1088 wrote to memory of 1168 1088 xrrxlxr.exe 40 PID 1088 wrote to memory of 1168 1088 xrrxlxr.exe 40 PID 1168 wrote to memory of 1332 1168 htbbhb.exe 41 PID 1168 wrote to memory of 1332 1168 htbbhb.exe 41 PID 1168 wrote to memory of 1332 1168 htbbhb.exe 41 PID 1168 wrote to memory of 1332 1168 htbbhb.exe 41 PID 1332 wrote to memory of 2660 1332 1bhtbh.exe 158 PID 1332 wrote to memory of 2660 1332 1bhtbh.exe 158 PID 1332 wrote to memory of 2660 1332 1bhtbh.exe 158 PID 1332 wrote to memory of 2660 1332 1bhtbh.exe 158 PID 2660 wrote to memory of 1756 2660 9vjjp.exe 43 PID 2660 wrote to memory of 1756 2660 9vjjp.exe 43 PID 2660 wrote to memory of 1756 2660 9vjjp.exe 43 PID 2660 wrote to memory of 1756 2660 9vjjp.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\135fc4914e879247fd8951963012db10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\135fc4914e879247fd8951963012db10_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\frllrrr.exec:\frllrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\rrlrxxr.exec:\rrlrxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\nnnbbh.exec:\nnnbbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\nnhtnt.exec:\nnhtnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\ddvvj.exec:\ddvvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\vvjvj.exec:\vvjvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\5xlfrxl.exec:\5xlfrxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\rlxxflr.exec:\rlxxflr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\nnbbbh.exec:\nnbbbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\nbthnb.exec:\nbthnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\pppjd.exec:\pppjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\xrrxlxr.exec:\xrrxlxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\htbbhb.exec:\htbbhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\1bhtbh.exec:\1bhtbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\9vjjp.exec:\9vjjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\ppvdv.exec:\ppvdv.exe17⤵
- Executes dropped EXE
PID:1756 -
\??\c:\llxlxxf.exec:\llxlxxf.exe18⤵
- Executes dropped EXE
PID:1784 -
\??\c:\7rrrlll.exec:\7rrrlll.exe19⤵
- Executes dropped EXE
PID:2940 -
\??\c:\1hthbt.exec:\1hthbt.exe20⤵
- Executes dropped EXE
PID:1216 -
\??\c:\1htbtn.exec:\1htbtn.exe21⤵
- Executes dropped EXE
PID:2296 -
\??\c:\vpdpv.exec:\vpdpv.exe22⤵
- Executes dropped EXE
PID:596 -
\??\c:\pjdpd.exec:\pjdpd.exe23⤵
- Executes dropped EXE
PID:2452 -
\??\c:\xxlrlrx.exec:\xxlrlrx.exe24⤵
- Executes dropped EXE
PID:2252 -
\??\c:\lfllxff.exec:\lfllxff.exe25⤵
- Executes dropped EXE
PID:2368 -
\??\c:\tthnbb.exec:\tthnbb.exe26⤵
- Executes dropped EXE
PID:1028 -
\??\c:\nhnhnn.exec:\nhnhnn.exe27⤵
- Executes dropped EXE
PID:2020 -
\??\c:\pdjpd.exec:\pdjpd.exe28⤵
- Executes dropped EXE
PID:1052 -
\??\c:\rrlrflx.exec:\rrlrflx.exe29⤵
- Executes dropped EXE
PID:2360 -
\??\c:\xfxrfrf.exec:\xfxrfrf.exe30⤵
- Executes dropped EXE
PID:1008 -
\??\c:\lxrlllr.exec:\lxrlllr.exe31⤵
- Executes dropped EXE
PID:1092 -
\??\c:\ttntnb.exec:\ttntnb.exe32⤵
- Executes dropped EXE
PID:2312 -
\??\c:\nthbbt.exec:\nthbbt.exe33⤵
- Executes dropped EXE
PID:2964 -
\??\c:\djjpv.exec:\djjpv.exe34⤵
- Executes dropped EXE
PID:1488 -
\??\c:\llfrfxx.exec:\llfrfxx.exe35⤵
- Executes dropped EXE
PID:2952 -
\??\c:\lfxfrxf.exec:\lfxfrxf.exe36⤵
- Executes dropped EXE
PID:2700 -
\??\c:\xlrrxxl.exec:\xlrrxxl.exe37⤵
- Executes dropped EXE
PID:2844 -
\??\c:\ntbbbt.exec:\ntbbbt.exe38⤵
- Executes dropped EXE
PID:2068 -
\??\c:\vdjjd.exec:\vdjjd.exe39⤵
- Executes dropped EXE
PID:2388 -
\??\c:\jvjvd.exec:\jvjvd.exe40⤵
- Executes dropped EXE
PID:2492 -
\??\c:\1rrxlrl.exec:\1rrxlrl.exe41⤵
- Executes dropped EXE
PID:2532 -
\??\c:\llxlxfr.exec:\llxlxfr.exe42⤵
- Executes dropped EXE
PID:2596 -
\??\c:\btnbth.exec:\btnbth.exe43⤵
- Executes dropped EXE
PID:2752 -
\??\c:\3tntbn.exec:\3tntbn.exe44⤵
- Executes dropped EXE
PID:2176 -
\??\c:\dvjpd.exec:\dvjpd.exe45⤵
- Executes dropped EXE
PID:2344 -
\??\c:\ddvdv.exec:\ddvdv.exe46⤵
- Executes dropped EXE
PID:1376 -
\??\c:\lfrrlrx.exec:\lfrrlrx.exe47⤵
- Executes dropped EXE
PID:1980 -
\??\c:\lxrrxxl.exec:\lxrrxxl.exe48⤵
- Executes dropped EXE
PID:2936 -
\??\c:\9hbhnb.exec:\9hbhnb.exe49⤵
- Executes dropped EXE
PID:2676 -
\??\c:\tbbthn.exec:\tbbthn.exe50⤵
- Executes dropped EXE
PID:2552 -
\??\c:\nhtbhb.exec:\nhtbhb.exe51⤵
- Executes dropped EXE
PID:1712 -
\??\c:\jjdjv.exec:\jjdjv.exe52⤵
- Executes dropped EXE
PID:2168 -
\??\c:\ppjpd.exec:\ppjpd.exe53⤵
- Executes dropped EXE
PID:2188 -
\??\c:\5rrrxfr.exec:\5rrrxfr.exe54⤵
- Executes dropped EXE
PID:1136 -
\??\c:\ffxrlxl.exec:\ffxrlxl.exe55⤵
- Executes dropped EXE
PID:876 -
\??\c:\hntnbb.exec:\hntnbb.exe56⤵
- Executes dropped EXE
PID:688 -
\??\c:\thbnbt.exec:\thbnbt.exe57⤵
- Executes dropped EXE
PID:2736 -
\??\c:\9btthh.exec:\9btthh.exe58⤵
- Executes dropped EXE
PID:1228 -
\??\c:\jdvjv.exec:\jdvjv.exe59⤵
- Executes dropped EXE
PID:828 -
\??\c:\rrflxlr.exec:\rrflxlr.exe60⤵
- Executes dropped EXE
PID:680 -
\??\c:\nhtbhn.exec:\nhtbhn.exe61⤵
- Executes dropped EXE
PID:1196 -
\??\c:\nbtbhh.exec:\nbtbhh.exe62⤵
- Executes dropped EXE
PID:1880 -
\??\c:\tntbtb.exec:\tntbtb.exe63⤵
- Executes dropped EXE
PID:1028 -
\??\c:\pjpvv.exec:\pjpvv.exe64⤵
- Executes dropped EXE
PID:2300 -
\??\c:\frfxllx.exec:\frfxllx.exe65⤵
- Executes dropped EXE
PID:2020 -
\??\c:\rrffrfr.exec:\rrffrfr.exe66⤵PID:1156
-
\??\c:\nnbbnn.exec:\nnbbnn.exe67⤵PID:1716
-
\??\c:\nnnthh.exec:\nnnthh.exe68⤵PID:2972
-
\??\c:\htbttt.exec:\htbttt.exe69⤵PID:2560
-
\??\c:\vdvpv.exec:\vdvpv.exe70⤵PID:2332
-
\??\c:\jdddj.exec:\jdddj.exe71⤵PID:2384
-
\??\c:\1lfflrf.exec:\1lfflrf.exe72⤵PID:2768
-
\??\c:\rrlrxfr.exec:\rrlrxfr.exe73⤵PID:2792
-
\??\c:\fxxfrrl.exec:\fxxfrrl.exe74⤵PID:2604
-
\??\c:\tnnbbb.exec:\tnnbbb.exe75⤵PID:2820
-
\??\c:\hbtbhn.exec:\hbtbhn.exe76⤵PID:2700
-
\??\c:\bbhhtb.exec:\bbhhtb.exe77⤵PID:2636
-
\??\c:\jdjjp.exec:\jdjjp.exe78⤵PID:3000
-
\??\c:\dvpvd.exec:\dvpvd.exe79⤵PID:2588
-
\??\c:\pjdvj.exec:\pjdvj.exe80⤵PID:2484
-
\??\c:\frffrfl.exec:\frffrfl.exe81⤵PID:2492
-
\??\c:\rrflxxl.exec:\rrflxxl.exe82⤵PID:2928
-
\??\c:\llfrfrl.exec:\llfrfrl.exe83⤵PID:2044
-
\??\c:\nnnnnt.exec:\nnnnnt.exe84⤵PID:1644
-
\??\c:\bbbttt.exec:\bbbttt.exe85⤵PID:1848
-
\??\c:\jjdjp.exec:\jjdjp.exe86⤵PID:760
-
\??\c:\vjpvd.exec:\vjpvd.exe87⤵PID:2348
-
\??\c:\dppjj.exec:\dppjj.exe88⤵PID:2488
-
\??\c:\xflxfrr.exec:\xflxfrr.exe89⤵PID:1060
-
\??\c:\xlrllfr.exec:\xlrllfr.exe90⤵PID:1692
-
\??\c:\ntbbth.exec:\ntbbth.exe91⤵PID:932
-
\??\c:\tthbbb.exec:\tthbbb.exe92⤵PID:2272
-
\??\c:\bbtbnb.exec:\bbtbnb.exe93⤵PID:3020
-
\??\c:\dpjvd.exec:\dpjvd.exe94⤵PID:1816
-
\??\c:\jjdvv.exec:\jjdvv.exe95⤵PID:1388
-
\??\c:\1dvpp.exec:\1dvpp.exe96⤵PID:536
-
\??\c:\frlrfrf.exec:\frlrfrf.exe97⤵PID:1696
-
\??\c:\lrlfrlx.exec:\lrlfrlx.exe98⤵PID:2456
-
\??\c:\tbtbnt.exec:\tbtbnt.exe99⤵PID:556
-
\??\c:\5bnhnt.exec:\5bnhnt.exe100⤵PID:2336
-
\??\c:\bbnhtb.exec:\bbnhtb.exe101⤵PID:2252
-
\??\c:\5vdjp.exec:\5vdjp.exe102⤵PID:2000
-
\??\c:\pdvvj.exec:\pdvvj.exe103⤵PID:1548
-
\??\c:\jdpjv.exec:\jdpjv.exe104⤵PID:1880
-
\??\c:\frflrrx.exec:\frflrrx.exe105⤵PID:1752
-
\??\c:\frfllfr.exec:\frfllfr.exe106⤵PID:1580
-
\??\c:\nhtttb.exec:\nhtttb.exe107⤵PID:1308
-
\??\c:\nnhnhn.exec:\nnhnhn.exe108⤵PID:2004
-
\??\c:\dvpvd.exec:\dvpvd.exe109⤵PID:1760
-
\??\c:\vjpdd.exec:\vjpdd.exe110⤵PID:1824
-
\??\c:\lxlrflx.exec:\lxlrflx.exe111⤵PID:2880
-
\??\c:\5frxlrl.exec:\5frxlrl.exe112⤵PID:1616
-
\??\c:\rflfrxr.exec:\rflfrxr.exe113⤵PID:3032
-
\??\c:\bbntth.exec:\bbntth.exe114⤵PID:2584
-
\??\c:\tbnntb.exec:\tbnntb.exe115⤵PID:1840
-
\??\c:\vjvvj.exec:\vjvvj.exe116⤵PID:2200
-
\??\c:\xfrlrrf.exec:\xfrlrrf.exe117⤵PID:868
-
\??\c:\ffxlfrl.exec:\ffxlfrl.exe118⤵PID:2628
-
\??\c:\xlrrrlr.exec:\xlrrrlr.exe119⤵PID:2636
-
\??\c:\hnnhhb.exec:\hnnhhb.exe120⤵PID:2468
-
\??\c:\pdvjp.exec:\pdvjp.exe121⤵PID:2472
-
\??\c:\1pjjp.exec:\1pjjp.exe122⤵PID:2484
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-