Analysis
- max time kernel
150s - max time network
123s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system - submitted
20/05/2024, 03:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
99bea019d4b93de66383b665510fa650_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
- Target 99bea019d4b93de66383b665510fa650_NeikiAnalytics.exe
- Size 244KB
- Sample240520-dkdbgagg29
- SHA256 0627ed496f206674dece03a74dd373daba287ccce27e30325f8cfdbb0260b9f3
- MD5 99bea019d4b93de66383b665510fa650
- SHA1 7edd063d50bdd7047759cc5da724414c0f887f72
- SHA512 1678fb3fc663b73a67264de1fc5918e4ea26c09f5d18539c5f55f6e6e482c3f58c92088a99346cbea09d8bd3fcd0bb8e45f4af9a1bb7b1a4f298aaba76ee849b
- SSDEEP 6144:n3C9BRo/AIX27NHWpU00VIxas1oa3YiFRs:n3C9uD6AUDCa4NYmRs
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/1276-5-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1276-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3044-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2028-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1764-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2012-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1988-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1744-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1976-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/484-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1484-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1660-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1244-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2208-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 2232 jdjpd.exe 3044 jdvjp.exe 2732 tnbhnt.exe 2520 lllfrfx.exe 2800 lxfrrfx.exe 2676 tnbbnt.exe 2556 vjvdp.exe 3052 fxrrfll.exe 2028 dvvdp.exe 2820 1rrfxlf.exe 2872 nhbbnb.exe 1764 dvjpp.exe 2012 rlxrxll.exe 1988 hbttbb.exe 1744 xxxfflf.exe 1424 lrrfllr.exe 1628 ppjvd.exe 2056 3ffrlrr.exe 2096 bbbtht.exe 1976 nnthhn.exe 2112 9jdjd.exe 484 3ffrxlf.exe 1484 5nhnht.exe 1660 ddvdv.exe 3056 lfxfrxl.exe 1708 5nbnht.exe 880 lxfrrrf.exe 1244 bntnnh.exe 1624 vppvp.exe 2448 rflrxll.exe 2208 1ththb.exe 2072 pdppd.exe 2232 9xrrflf.exe 1732 7tbhhb.exe 2652 9ddjd.exe 2752 dddpp.exe 2640 frrxrxl.exe 1736 ntnnnh.exe 2520 djdjp.exe 2760 dpvvv.exe 2544 rrfllxf.exe 2980 tnnhnh.exe 2440 btnnbh.exe 1884 jvdpp.exe 2768 fxfflrf.exe 2840 rfxfrrf.exe 2968 hhttbh.exe 1992 jvppv.exe 1836 pdjpp.exe 1820 xrxrflx.exe 1348 fxlxfrf.exe 2216 btbbhh.exe 1760 9vvvd.exe 1428 1dvjv.exe 1680 5lflrrf.exe 2116 rlrxrfr.exe 2472 tttnbt.exe 2128 jjvjv.exe 2220 5jpvp.exe 540 rrlflll.exe 596 bthntb.exe 1916 pdddj.exe 2080 3dvjv.exe 2348 xrllllr.exe -
resource yara_rule behavioral1/memory/1276-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2028-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1764-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2012-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1988-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1744-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/484-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1484-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1244-275-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-302-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1276 wrote to memory of 2232 1276 99bea019d4b93de66383b665510fa650_NeikiAnalytics.exe 28 PID 1276 wrote to memory of 2232 1276 99bea019d4b93de66383b665510fa650_NeikiAnalytics.exe 28 PID 1276 wrote to memory of 2232 1276 99bea019d4b93de66383b665510fa650_NeikiAnalytics.exe 28 PID 1276 wrote to memory of 2232 1276 99bea019d4b93de66383b665510fa650_NeikiAnalytics.exe 28 PID 2232 wrote to memory of 3044 2232 jdjpd.exe 29 PID 2232 wrote to memory of 3044 2232 jdjpd.exe 29 PID 2232 wrote to memory of 3044 2232 jdjpd.exe 29 PID 2232 wrote to memory of 3044 2232 jdjpd.exe 29 PID 3044 wrote to memory of 2732 3044 jdvjp.exe 30 PID 3044 wrote to memory of 2732 3044 jdvjp.exe 30 PID 3044 wrote to memory of 2732 3044 jdvjp.exe 30 PID 3044 wrote to memory of 2732 3044 jdvjp.exe 30 PID 2732 wrote to memory of 2520 2732 tnbhnt.exe 31 PID 2732 wrote to memory of 2520 2732 tnbhnt.exe 31 PID 2732 wrote to memory of 2520 2732 tnbhnt.exe 31 PID 2732 wrote to memory of 2520 2732 tnbhnt.exe 31 PID 2520 wrote to memory of 2800 2520 lllfrfx.exe 32 PID 2520 wrote to memory of 2800 2520 lllfrfx.exe 32 PID 2520 wrote to memory of 2800 2520 lllfrfx.exe 32 PID 2520 wrote to memory of 2800 2520 lllfrfx.exe 32 PID 2800 wrote to memory of 2676 2800 lxfrrfx.exe 33 PID 2800 wrote to memory of 2676 2800 lxfrrfx.exe 33 PID 2800 wrote to memory of 2676 2800 lxfrrfx.exe 33 PID 2800 wrote to memory of 2676 2800 lxfrrfx.exe 33 PID 2676 wrote to memory of 2556 2676 tnbbnt.exe 34 PID 2676 wrote to memory of 2556 2676 tnbbnt.exe 34 PID 2676 wrote to memory of 2556 2676 tnbbnt.exe 34 PID 2676 wrote to memory of 2556 2676 tnbbnt.exe 34 PID 2556 wrote to memory of 3052 2556 vjvdp.exe 35 PID 2556 wrote to memory of 3052 2556 vjvdp.exe 35 PID 2556 wrote to memory of 3052 2556 vjvdp.exe 35 PID 2556 wrote to memory of 3052 2556 vjvdp.exe 35 PID 3052 wrote to memory of 2028 3052 fxrrfll.exe 36 PID 3052 wrote to memory of 2028 3052 fxrrfll.exe 36 PID 3052 wrote to memory of 2028 3052 fxrrfll.exe 36 PID 3052 wrote to memory of 2028 3052 fxrrfll.exe 36 PID 2028 wrote to memory of 2820 2028 dvvdp.exe 37 PID 2028 wrote to memory of 2820 2028 dvvdp.exe 37 PID 2028 wrote to memory of 2820 2028 dvvdp.exe 37 PID 2028 wrote to memory of 2820 2028 dvvdp.exe 37 PID 2820 wrote to memory of 2872 2820 1rrfxlf.exe 38 PID 2820 wrote to memory of 2872 2820 1rrfxlf.exe 38 PID 2820 wrote to memory of 2872 2820 1rrfxlf.exe 38 PID 2820 wrote to memory of 2872 2820 1rrfxlf.exe 38 PID 2872 wrote to memory of 1764 2872 nhbbnb.exe 39 PID 2872 wrote to memory of 1764 2872 nhbbnb.exe 39 PID 2872 wrote to memory of 1764 2872 nhbbnb.exe 39 PID 2872 wrote to memory of 1764 2872 nhbbnb.exe 39 PID 1764 wrote to memory of 2012 1764 dvjpp.exe 40 PID 1764 wrote to memory of 2012 1764 dvjpp.exe 40 PID 1764 wrote to memory of 2012 1764 dvjpp.exe 40 PID 1764 wrote to memory of 2012 1764 dvjpp.exe 40 PID 2012 wrote to memory of 1988 2012 rlxrxll.exe 41 PID 2012 wrote to memory of 1988 2012 rlxrxll.exe 41 PID 2012 wrote to memory of 1988 2012 rlxrxll.exe 41 PID 2012 wrote to memory of 1988 2012 rlxrxll.exe 41 PID 1988 wrote to memory of 1744 1988 hbttbb.exe 42 PID 1988 wrote to memory of 1744 1988 hbttbb.exe 42 PID 1988 wrote to memory of 1744 1988 hbttbb.exe 42 PID 1988 wrote to memory of 1744 1988 hbttbb.exe 42 PID 1744 wrote to memory of 1424 1744 xxxfflf.exe 43 PID 1744 wrote to memory of 1424 1744 xxxfflf.exe 43 PID 1744 wrote to memory of 1424 1744 xxxfflf.exe 43 PID 1744 wrote to memory of 1424 1744 xxxfflf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\99bea019d4b93de66383b665510fa650_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\99bea019d4b93de66383b665510fa650_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\jdjpd.exec:\jdjpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\jdvjp.exec:\jdvjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\tnbhnt.exec:\tnbhnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\lllfrfx.exec:\lllfrfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\lxfrrfx.exec:\lxfrrfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\tnbbnt.exec:\tnbbnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\vjvdp.exec:\vjvdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\fxrrfll.exec:\fxrrfll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\dvvdp.exec:\dvvdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\1rrfxlf.exec:\1rrfxlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\nhbbnb.exec:\nhbbnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\dvjpp.exec:\dvjpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\rlxrxll.exec:\rlxrxll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\hbttbb.exec:\hbttbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\xxxfflf.exec:\xxxfflf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\lrrfllr.exec:\lrrfllr.exe17⤵
- Executes dropped EXE
PID:1424 -
\??\c:\ppjvd.exec:\ppjvd.exe18⤵
- Executes dropped EXE
PID:1628 -
\??\c:\3ffrlrr.exec:\3ffrlrr.exe19⤵
- Executes dropped EXE
PID:2056 -
\??\c:\bbbtht.exec:\bbbtht.exe20⤵
- Executes dropped EXE
PID:2096 -
\??\c:\nnthhn.exec:\nnthhn.exe21⤵
- Executes dropped EXE
PID:1976 -
\??\c:\9jdjd.exec:\9jdjd.exe22⤵
- Executes dropped EXE
PID:2112 -
\??\c:\3ffrxlf.exec:\3ffrxlf.exe23⤵
- Executes dropped EXE
PID:484 -
\??\c:\5nhnht.exec:\5nhnht.exe24⤵
- Executes dropped EXE
PID:1484 -
\??\c:\ddvdv.exec:\ddvdv.exe25⤵
- Executes dropped EXE
PID:1660 -
\??\c:\lfxfrxl.exec:\lfxfrxl.exe26⤵
- Executes dropped EXE
PID:3056 -
\??\c:\5nbnht.exec:\5nbnht.exe27⤵
- Executes dropped EXE
PID:1708 -
\??\c:\lxfrrrf.exec:\lxfrrrf.exe28⤵
- Executes dropped EXE
PID:880 -
\??\c:\bntnnh.exec:\bntnnh.exe29⤵
- Executes dropped EXE
PID:1244 -
\??\c:\vppvp.exec:\vppvp.exe30⤵
- Executes dropped EXE
PID:1624 -
\??\c:\rflrxll.exec:\rflrxll.exe31⤵
- Executes dropped EXE
PID:2448 -
\??\c:\1ththb.exec:\1ththb.exe32⤵
- Executes dropped EXE
PID:2208 -
\??\c:\pdppd.exec:\pdppd.exe33⤵
- Executes dropped EXE
PID:2072 -
\??\c:\9xrrflf.exec:\9xrrflf.exe34⤵
- Executes dropped EXE
PID:2232 -
\??\c:\7tbhhb.exec:\7tbhhb.exe35⤵
- Executes dropped EXE
PID:1732 -
\??\c:\9ddjd.exec:\9ddjd.exe36⤵
- Executes dropped EXE
PID:2652 -
\??\c:\dddpp.exec:\dddpp.exe37⤵
- Executes dropped EXE
PID:2752 -
\??\c:\frrxrxl.exec:\frrxrxl.exe38⤵
- Executes dropped EXE
PID:2640 -
\??\c:\ntnnnh.exec:\ntnnnh.exe39⤵
- Executes dropped EXE
PID:1736 -
\??\c:\djdjp.exec:\djdjp.exe40⤵
- Executes dropped EXE
PID:2520 -
\??\c:\dpvvv.exec:\dpvvv.exe41⤵
- Executes dropped EXE
PID:2760 -
\??\c:\rrfllxf.exec:\rrfllxf.exe42⤵
- Executes dropped EXE
PID:2544 -
\??\c:\tnnhnh.exec:\tnnhnh.exe43⤵
- Executes dropped EXE
PID:2980 -
\??\c:\btnnbh.exec:\btnnbh.exe44⤵
- Executes dropped EXE
PID:2440 -
\??\c:\jvdpp.exec:\jvdpp.exe45⤵
- Executes dropped EXE
PID:1884 -
\??\c:\fxfflrf.exec:\fxfflrf.exe46⤵
- Executes dropped EXE
PID:2768 -
\??\c:\rfxfrrf.exec:\rfxfrrf.exe47⤵
- Executes dropped EXE
PID:2840 -
\??\c:\hhttbh.exec:\hhttbh.exe48⤵
- Executes dropped EXE
PID:2968 -
\??\c:\jvppv.exec:\jvppv.exe49⤵
- Executes dropped EXE
PID:1992 -
\??\c:\pdjpp.exec:\pdjpp.exe50⤵
- Executes dropped EXE
PID:1836 -
\??\c:\xrxrflx.exec:\xrxrflx.exe51⤵
- Executes dropped EXE
PID:1820 -
\??\c:\fxlxfrf.exec:\fxlxfrf.exe52⤵
- Executes dropped EXE
PID:1348 -
\??\c:\btbbhh.exec:\btbbhh.exe53⤵
- Executes dropped EXE
PID:2216 -
\??\c:\9vvvd.exec:\9vvvd.exe54⤵
- Executes dropped EXE
PID:1760 -
\??\c:\1dvjv.exec:\1dvjv.exe55⤵
- Executes dropped EXE
PID:1428 -
\??\c:\5lflrrf.exec:\5lflrrf.exe56⤵
- Executes dropped EXE
PID:1680 -
\??\c:\rlrxrfr.exec:\rlrxrfr.exe57⤵
- Executes dropped EXE
PID:2116 -
\??\c:\tttnbt.exec:\tttnbt.exe58⤵
- Executes dropped EXE
PID:2472 -
\??\c:\jjvjv.exec:\jjvjv.exe59⤵
- Executes dropped EXE
PID:2128 -
\??\c:\5jpvp.exec:\5jpvp.exe60⤵
- Executes dropped EXE
PID:2220 -
\??\c:\rrlflll.exec:\rrlflll.exe61⤵
- Executes dropped EXE
PID:540 -
\??\c:\bthntb.exec:\bthntb.exe62⤵
- Executes dropped EXE
PID:596 -
\??\c:\pdddj.exec:\pdddj.exe63⤵
- Executes dropped EXE
PID:1916 -
\??\c:\3dvjv.exec:\3dvjv.exe64⤵
- Executes dropped EXE
PID:2080 -
\??\c:\xrllllr.exec:\xrllllr.exe65⤵
- Executes dropped EXE
PID:2348 -
\??\c:\tnhntb.exec:\tnhntb.exe66⤵PID:2484
-
\??\c:\hbnbbh.exec:\hbnbbh.exe67⤵PID:840
-
\??\c:\1dvpd.exec:\1dvpd.exe68⤵PID:2460
-
\??\c:\llxlffx.exec:\llxlffx.exe69⤵PID:2468
-
\??\c:\fxrxlxl.exec:\fxrxlxl.exe70⤵PID:1244
-
\??\c:\hhbnbt.exec:\hhbnbt.exe71⤵PID:836
-
\??\c:\tttbhn.exec:\tttbhn.exe72⤵PID:2944
-
\??\c:\vdjpp.exec:\vdjpp.exe73⤵PID:1648
-
\??\c:\rlllfrf.exec:\rlllfrf.exe74⤵PID:2292
-
\??\c:\fflrrff.exec:\fflrrff.exe75⤵PID:2812
-
\??\c:\hhtnnt.exec:\hhtnnt.exe76⤵PID:1600
-
\??\c:\pjdjj.exec:\pjdjj.exe77⤵PID:2728
-
\??\c:\ppjjv.exec:\ppjjv.exe78⤵PID:3044
-
\??\c:\ffxfrff.exec:\ffxfrff.exe79⤵PID:2732
-
\??\c:\nbhthn.exec:\nbhthn.exe80⤵PID:2548
-
\??\c:\tttnnb.exec:\tttnnb.exe81⤵PID:2648
-
\??\c:\vpjvd.exec:\vpjvd.exe82⤵PID:2520
-
\??\c:\1lxxrfr.exec:\1lxxrfr.exe83⤵PID:2560
-
\??\c:\1tnbnh.exec:\1tnbnh.exe84⤵PID:2556
-
\??\c:\tttbbb.exec:\tttbbb.exe85⤵PID:2680
-
\??\c:\9ppvp.exec:\9ppvp.exe86⤵PID:2500
-
\??\c:\flxxffr.exec:\flxxffr.exe87⤵PID:2000
-
\??\c:\tnnthn.exec:\tnnthn.exe88⤵PID:2848
-
\??\c:\nhbhtt.exec:\nhbhtt.exe89⤵PID:304
-
\??\c:\vdpdp.exec:\vdpdp.exe90⤵PID:1796
-
\??\c:\xrlfrlf.exec:\xrlfrlf.exe91⤵PID:2008
-
\??\c:\rrrxrlf.exec:\rrrxrlf.exe92⤵PID:2024
-
\??\c:\7bbnbh.exec:\7bbnbh.exe93⤵PID:1720
-
\??\c:\9nhtth.exec:\9nhtth.exe94⤵PID:112
-
\??\c:\ppjvd.exec:\ppjvd.exe95⤵PID:2204
-
\??\c:\llxfllf.exec:\llxfllf.exe96⤵PID:1668
-
\??\c:\nhhhtb.exec:\nhhhtb.exe97⤵PID:1424
-
\??\c:\ttnbbh.exec:\ttnbbh.exe98⤵PID:1768
-
\??\c:\pvjpp.exec:\pvjpp.exe99⤵PID:2096
-
\??\c:\9lllflx.exec:\9lllflx.exe100⤵PID:2920
-
\??\c:\lxrrxfr.exec:\lxrrxfr.exe101⤵PID:1976
-
\??\c:\1nhbtb.exec:\1nhbtb.exe102⤵PID:1296
-
\??\c:\nnhnhh.exec:\nnhnhh.exe103⤵PID:692
-
\??\c:\dvjdd.exec:\dvjdd.exe104⤵PID:1484
-
\??\c:\rlflrff.exec:\rlflrff.exe105⤵PID:1916
-
\??\c:\xxlfflx.exec:\xxlfflx.exe106⤵PID:1752
-
\??\c:\tththh.exec:\tththh.exe107⤵PID:1716
-
\??\c:\jdvjv.exec:\jdvjv.exe108⤵PID:1632
-
\??\c:\pppvv.exec:\pppvv.exe109⤵PID:880
-
\??\c:\fxlffrx.exec:\fxlffrx.exe110⤵PID:2272
-
\??\c:\bbhbbn.exec:\bbhbbn.exe111⤵PID:1512
-
\??\c:\ttthhb.exec:\ttthhb.exe112⤵PID:884
-
\??\c:\dvjdj.exec:\dvjdj.exe113⤵PID:308
-
\??\c:\llxffrr.exec:\llxffrr.exe114⤵PID:2380
-
\??\c:\ffrlfff.exec:\ffrlfff.exe115⤵PID:1144
-
\??\c:\nnbnbn.exec:\nnbnbn.exe116⤵PID:1620
-
\??\c:\ppvjd.exec:\ppvjd.exe117⤵PID:2656
-
\??\c:\vppvd.exec:\vppvd.exe118⤵PID:2712
-
\??\c:\fllfffx.exec:\fllfffx.exe119⤵PID:2716
-
\??\c:\bhnbbb.exec:\bhnbbb.exe120⤵PID:2628
-
\??\c:\jjjvd.exec:\jjjvd.exe121⤵PID:2060
-
\??\c:\xrlrrfx.exec:\xrlrrfx.exe122⤵PID:2432
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-