Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 09:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2b4e88f05b501e93f5d99b2671ba811cb3cf65f22766811cef39a9dfe0229211_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
2b4e88f05b501e93f5d99b2671ba811cb3cf65f22766811cef39a9dfe0229211_NeikiAnalytics.exe
-
Size
134KB
-
MD5
662b3a7ef89fe4673b736e2f459e68b0
-
SHA1
0ee957c9ee4ba64d80a86eba91639876f1d867a0
-
SHA256
2b4e88f05b501e93f5d99b2671ba811cb3cf65f22766811cef39a9dfe0229211
-
SHA512
93dfabd58466b96148b11ce000068f34f74330998499d067d1d5843b1673acb19712685ba2aad87163aeb69722c16b5ba6a14b49cae3d66c983dfe03c6e0f789
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afoHVpx+dGorn:n3C9BRW0j/1px+dGC
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral1/memory/2916-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-8-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2980-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-82-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2052-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1260-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2164-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2224-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1940-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1064-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2012-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1712-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-1543-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2928 jvddd.exe 2980 fxlxffl.exe 2612 hthntt.exe 2988 jjjvv.exe 2748 1xllrll.exe 2588 9xllrxl.exe 2484 bnbntt.exe 2052 9vppd.exe 2636 rflrxfl.exe 2648 lfxfxxr.exe 1260 5hnnhh.exe 340 7djpp.exe 2124 5pddd.exe 1512 xlrxffr.exe 2480 nnnbtb.exe 2164 nnnbtb.exe 2032 vdpdd.exe 2224 xfffxll.exe 2516 5lrxxff.exe 1940 9btbhb.exe 1972 5vvpp.exe 692 ddpjv.exe 1420 rfrflfl.exe 1808 xrlrxxl.exe 1064 ntbbhh.exe 1556 dvdpv.exe 2848 pjdjv.exe 2012 xrflxrx.exe 1712 nhnthn.exe 568 nhhntb.exe 2120 5vdvd.exe 1444 1llrrxf.exe 2924 hthhhn.exe 1544 btnbnt.exe 2608 1vppv.exe 2560 vpvvv.exe 2544 xxrxxxr.exe 2028 frfrrxl.exe 2652 nbhbbh.exe 2448 5bntth.exe 1452 jvdvd.exe 2492 ppjpj.exe 2936 pdvvd.exe 2336 llxxrrf.exe 352 xrffllf.exe 2780 bntbtt.exe 2752 bnbhhb.exe 1496 vjvdj.exe 1260 jjvjd.exe 1376 9rffxxx.exe 556 lfrlllx.exe 1508 htbhhb.exe 2384 7tttnn.exe 1612 pdvjp.exe 2044 jpjdd.exe 2084 xrlflrl.exe 2072 rxfxxrx.exe 2236 htnnth.exe 2252 hbnnnh.exe 604 jvjpd.exe 2840 jdpvj.exe 268 lfrxlxf.exe 1720 xrlrxxr.exe 1132 bthbnh.exe -
resource yara_rule behavioral1/memory/2916-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1260-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2164-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2224-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1940-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1064-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2012-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1712-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-1543-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2916 wrote to memory of 2928 2916 2b4e88f05b501e93f5d99b2671ba811cb3cf65f22766811cef39a9dfe0229211_NeikiAnalytics.exe 28 PID 2916 wrote to memory of 2928 2916 2b4e88f05b501e93f5d99b2671ba811cb3cf65f22766811cef39a9dfe0229211_NeikiAnalytics.exe 28 PID 2916 wrote to memory of 2928 2916 2b4e88f05b501e93f5d99b2671ba811cb3cf65f22766811cef39a9dfe0229211_NeikiAnalytics.exe 28 PID 2916 wrote to memory of 2928 2916 2b4e88f05b501e93f5d99b2671ba811cb3cf65f22766811cef39a9dfe0229211_NeikiAnalytics.exe 28 PID 2928 wrote to memory of 2980 2928 jvddd.exe 29 PID 2928 wrote to memory of 2980 2928 jvddd.exe 29 PID 2928 wrote to memory of 2980 2928 jvddd.exe 29 PID 2928 wrote to memory of 2980 2928 jvddd.exe 29 PID 2980 wrote to memory of 2612 2980 fxlxffl.exe 30 PID 2980 wrote to memory of 2612 2980 fxlxffl.exe 30 PID 2980 wrote to memory of 2612 2980 fxlxffl.exe 30 PID 2980 wrote to memory of 2612 2980 fxlxffl.exe 30 PID 2612 wrote to memory of 2988 2612 hthntt.exe 31 PID 2612 wrote to memory of 2988 2612 hthntt.exe 31 PID 2612 wrote to memory of 2988 2612 hthntt.exe 31 PID 2612 wrote to memory of 2988 2612 hthntt.exe 31 PID 2988 wrote to memory of 2748 2988 jjjvv.exe 32 PID 2988 wrote to memory of 2748 2988 jjjvv.exe 32 PID 2988 wrote to memory of 2748 2988 jjjvv.exe 32 PID 2988 wrote to memory of 2748 2988 jjjvv.exe 32 PID 2748 wrote to memory of 2588 2748 1xllrll.exe 33 PID 2748 wrote to memory of 2588 2748 1xllrll.exe 33 PID 2748 wrote to memory of 2588 2748 1xllrll.exe 33 PID 2748 wrote to memory of 2588 2748 1xllrll.exe 33 PID 2588 wrote to memory of 2484 2588 9xllrxl.exe 34 PID 2588 wrote to memory of 2484 2588 9xllrxl.exe 34 PID 2588 wrote to memory of 2484 2588 9xllrxl.exe 34 PID 2588 wrote to memory of 2484 2588 9xllrxl.exe 34 PID 2484 wrote to memory of 2052 2484 bnbntt.exe 35 PID 2484 wrote to memory of 2052 2484 bnbntt.exe 35 PID 2484 wrote to memory of 2052 2484 bnbntt.exe 35 PID 2484 wrote to memory of 2052 2484 bnbntt.exe 35 PID 2052 wrote to memory of 2636 2052 9vppd.exe 36 PID 2052 wrote to memory of 2636 2052 9vppd.exe 36 PID 2052 wrote to memory of 2636 2052 9vppd.exe 36 PID 2052 wrote to memory of 2636 2052 9vppd.exe 36 PID 2636 wrote to memory of 2648 2636 rflrxfl.exe 37 PID 2636 wrote to memory of 2648 2636 rflrxfl.exe 37 PID 2636 wrote to memory of 2648 2636 rflrxfl.exe 37 PID 2636 wrote to memory of 2648 2636 rflrxfl.exe 37 PID 2648 wrote to memory of 1260 2648 lfxfxxr.exe 38 PID 2648 wrote to memory of 1260 2648 lfxfxxr.exe 38 PID 2648 wrote to memory of 1260 2648 lfxfxxr.exe 38 PID 2648 wrote to memory of 1260 2648 lfxfxxr.exe 38 PID 1260 wrote to memory of 340 1260 5hnnhh.exe 39 PID 1260 wrote to memory of 340 1260 5hnnhh.exe 39 PID 1260 wrote to memory of 340 1260 5hnnhh.exe 39 PID 1260 wrote to memory of 340 1260 5hnnhh.exe 39 PID 340 wrote to memory of 2124 340 7djpp.exe 40 PID 340 wrote to memory of 2124 340 7djpp.exe 40 PID 340 wrote to memory of 2124 340 7djpp.exe 40 PID 340 wrote to memory of 2124 340 7djpp.exe 40 PID 2124 wrote to memory of 1512 2124 5pddd.exe 41 PID 2124 wrote to memory of 1512 2124 5pddd.exe 41 PID 2124 wrote to memory of 1512 2124 5pddd.exe 41 PID 2124 wrote to memory of 1512 2124 5pddd.exe 41 PID 1512 wrote to memory of 2480 1512 xlrxffr.exe 42 PID 1512 wrote to memory of 2480 1512 xlrxffr.exe 42 PID 1512 wrote to memory of 2480 1512 xlrxffr.exe 42 PID 1512 wrote to memory of 2480 1512 xlrxffr.exe 42 PID 2480 wrote to memory of 2164 2480 nnnbtb.exe 43 PID 2480 wrote to memory of 2164 2480 nnnbtb.exe 43 PID 2480 wrote to memory of 2164 2480 nnnbtb.exe 43 PID 2480 wrote to memory of 2164 2480 nnnbtb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b4e88f05b501e93f5d99b2671ba811cb3cf65f22766811cef39a9dfe0229211_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2b4e88f05b501e93f5d99b2671ba811cb3cf65f22766811cef39a9dfe0229211_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\jvddd.exec:\jvddd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\fxlxffl.exec:\fxlxffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\hthntt.exec:\hthntt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\jjjvv.exec:\jjjvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\1xllrll.exec:\1xllrll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\9xllrxl.exec:\9xllrxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\bnbntt.exec:\bnbntt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\9vppd.exec:\9vppd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\rflrxfl.exec:\rflrxfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\lfxfxxr.exec:\lfxfxxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\5hnnhh.exec:\5hnnhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\7djpp.exec:\7djpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:340 -
\??\c:\5pddd.exec:\5pddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\xlrxffr.exec:\xlrxffr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\nnnbtb.exec:\nnnbtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\nnnbtb.exec:\nnnbtb.exe17⤵
- Executes dropped EXE
PID:2164 -
\??\c:\vdpdd.exec:\vdpdd.exe18⤵
- Executes dropped EXE
PID:2032 -
\??\c:\xfffxll.exec:\xfffxll.exe19⤵
- Executes dropped EXE
PID:2224 -
\??\c:\5lrxxff.exec:\5lrxxff.exe20⤵
- Executes dropped EXE
PID:2516 -
\??\c:\9btbhb.exec:\9btbhb.exe21⤵
- Executes dropped EXE
PID:1940 -
\??\c:\5vvpp.exec:\5vvpp.exe22⤵
- Executes dropped EXE
PID:1972 -
\??\c:\ddpjv.exec:\ddpjv.exe23⤵
- Executes dropped EXE
PID:692 -
\??\c:\rfrflfl.exec:\rfrflfl.exe24⤵
- Executes dropped EXE
PID:1420 -
\??\c:\xrlrxxl.exec:\xrlrxxl.exe25⤵
- Executes dropped EXE
PID:1808 -
\??\c:\ntbbhh.exec:\ntbbhh.exe26⤵
- Executes dropped EXE
PID:1064 -
\??\c:\dvdpv.exec:\dvdpv.exe27⤵
- Executes dropped EXE
PID:1556 -
\??\c:\pjdjv.exec:\pjdjv.exe28⤵
- Executes dropped EXE
PID:2848 -
\??\c:\xrflxrx.exec:\xrflxrx.exe29⤵
- Executes dropped EXE
PID:2012 -
\??\c:\nhnthn.exec:\nhnthn.exe30⤵
- Executes dropped EXE
PID:1712 -
\??\c:\nhhntb.exec:\nhhntb.exe31⤵
- Executes dropped EXE
PID:568 -
\??\c:\5vdvd.exec:\5vdvd.exe32⤵
- Executes dropped EXE
PID:2120 -
\??\c:\1llrrxf.exec:\1llrrxf.exe33⤵
- Executes dropped EXE
PID:1444 -
\??\c:\hthhhn.exec:\hthhhn.exe34⤵
- Executes dropped EXE
PID:2924 -
\??\c:\btnbnt.exec:\btnbnt.exe35⤵
- Executes dropped EXE
PID:1544 -
\??\c:\1vppv.exec:\1vppv.exe36⤵
- Executes dropped EXE
PID:2608 -
\??\c:\vpvvv.exec:\vpvvv.exe37⤵
- Executes dropped EXE
PID:2560 -
\??\c:\xxrxxxr.exec:\xxrxxxr.exe38⤵
- Executes dropped EXE
PID:2544 -
\??\c:\frfrrxl.exec:\frfrrxl.exe39⤵
- Executes dropped EXE
PID:2028 -
\??\c:\nbhbbh.exec:\nbhbbh.exe40⤵
- Executes dropped EXE
PID:2652 -
\??\c:\5bntth.exec:\5bntth.exe41⤵
- Executes dropped EXE
PID:2448 -
\??\c:\jvdvd.exec:\jvdvd.exe42⤵
- Executes dropped EXE
PID:1452 -
\??\c:\ppjpj.exec:\ppjpj.exe43⤵
- Executes dropped EXE
PID:2492 -
\??\c:\pdvvd.exec:\pdvvd.exe44⤵
- Executes dropped EXE
PID:2936 -
\??\c:\llxxrrf.exec:\llxxrrf.exe45⤵
- Executes dropped EXE
PID:2336 -
\??\c:\xrffllf.exec:\xrffllf.exe46⤵
- Executes dropped EXE
PID:352 -
\??\c:\bntbtt.exec:\bntbtt.exe47⤵
- Executes dropped EXE
PID:2780 -
\??\c:\bnbhhb.exec:\bnbhhb.exe48⤵
- Executes dropped EXE
PID:2752 -
\??\c:\vjvdj.exec:\vjvdj.exe49⤵
- Executes dropped EXE
PID:1496 -
\??\c:\jjvjd.exec:\jjvjd.exe50⤵
- Executes dropped EXE
PID:1260 -
\??\c:\9rffxxx.exec:\9rffxxx.exe51⤵
- Executes dropped EXE
PID:1376 -
\??\c:\lfrlllx.exec:\lfrlllx.exe52⤵
- Executes dropped EXE
PID:556 -
\??\c:\htbhhb.exec:\htbhhb.exe53⤵
- Executes dropped EXE
PID:1508 -
\??\c:\7tttnn.exec:\7tttnn.exe54⤵
- Executes dropped EXE
PID:2384 -
\??\c:\pdvjp.exec:\pdvjp.exe55⤵
- Executes dropped EXE
PID:1612 -
\??\c:\jpjdd.exec:\jpjdd.exe56⤵
- Executes dropped EXE
PID:2044 -
\??\c:\xrlflrl.exec:\xrlflrl.exe57⤵
- Executes dropped EXE
PID:2084 -
\??\c:\rxfxxrx.exec:\rxfxxrx.exe58⤵
- Executes dropped EXE
PID:2072 -
\??\c:\htnnth.exec:\htnnth.exe59⤵
- Executes dropped EXE
PID:2236 -
\??\c:\hbnnnh.exec:\hbnnnh.exe60⤵
- Executes dropped EXE
PID:2252 -
\??\c:\jvjpd.exec:\jvjpd.exe61⤵
- Executes dropped EXE
PID:604 -
\??\c:\jdpvj.exec:\jdpvj.exe62⤵
- Executes dropped EXE
PID:2840 -
\??\c:\lfrxlxf.exec:\lfrxlxf.exe63⤵
- Executes dropped EXE
PID:268 -
\??\c:\xrlrxxr.exec:\xrlrxxr.exe64⤵
- Executes dropped EXE
PID:1720 -
\??\c:\bthbnh.exec:\bthbnh.exe65⤵
- Executes dropped EXE
PID:1132 -
\??\c:\thnttn.exec:\thnttn.exe66⤵PID:448
-
\??\c:\vppdp.exec:\vppdp.exe67⤵PID:1552
-
\??\c:\5djvv.exec:\5djvv.exe68⤵PID:2284
-
\??\c:\xrfllfx.exec:\xrfllfx.exe69⤵PID:652
-
\??\c:\lfxxrlr.exec:\lfxxrlr.exe70⤵PID:972
-
\??\c:\3lffllx.exec:\3lffllx.exe71⤵PID:328
-
\??\c:\htbntt.exec:\htbntt.exe72⤵PID:1820
-
\??\c:\7nhttb.exec:\7nhttb.exe73⤵PID:2932
-
\??\c:\5vpvd.exec:\5vpvd.exe74⤵PID:1520
-
\??\c:\jjdvv.exec:\jjdvv.exe75⤵PID:2060
-
\??\c:\rfxrrrx.exec:\rfxrrrx.exe76⤵PID:2928
-
\??\c:\llrfxxr.exec:\llrfxxr.exe77⤵PID:3024
-
\??\c:\nbhhnh.exec:\nbhhnh.exe78⤵PID:1544
-
\??\c:\nhthbb.exec:\nhthbb.exe79⤵PID:2548
-
\??\c:\jdpdv.exec:\jdpdv.exe80⤵PID:2956
-
\??\c:\pjdjp.exec:\pjdjp.exe81⤵PID:2544
-
\??\c:\5rlrxfl.exec:\5rlrxfl.exe82⤵PID:2572
-
\??\c:\ffxxfff.exec:\ffxxfff.exe83⤵PID:2652
-
\??\c:\ntthnt.exec:\ntthnt.exe84⤵PID:2556
-
\??\c:\3nbhhb.exec:\3nbhhb.exe85⤵PID:1452
-
\??\c:\pdjdj.exec:\pdjdj.exe86⤵PID:2492
-
\??\c:\7dvdd.exec:\7dvdd.exe87⤵PID:2116
-
\??\c:\lxlxxfl.exec:\lxlxxfl.exe88⤵PID:2336
-
\??\c:\lxllrrr.exec:\lxllrrr.exe89⤵PID:352
-
\??\c:\bnbntt.exec:\bnbntt.exe90⤵PID:2780
-
\??\c:\tntntt.exec:\tntntt.exe91⤵PID:2752
-
\??\c:\pdvdd.exec:\pdvdd.exe92⤵PID:1496
-
\??\c:\vvpdj.exec:\vvpdj.exe93⤵PID:1260
-
\??\c:\rfrrrrx.exec:\rfrrrrx.exe94⤵PID:1376
-
\??\c:\lfxflrx.exec:\lfxflrx.exe95⤵PID:2312
-
\??\c:\7thhhb.exec:\7thhhb.exe96⤵PID:1508
-
\??\c:\bthbht.exec:\bthbht.exe97⤵PID:2176
-
\??\c:\pjppv.exec:\pjppv.exe98⤵PID:2208
-
\??\c:\5rxffrx.exec:\5rxffrx.exe99⤵PID:2020
-
\??\c:\xlrrxxx.exec:\xlrrxxx.exe100⤵PID:2084
-
\??\c:\1htbhb.exec:\1htbhb.exe101⤵PID:2404
-
\??\c:\nhttbh.exec:\nhttbh.exe102⤵PID:2236
-
\??\c:\dvpjj.exec:\dvpjj.exe103⤵PID:2252
-
\??\c:\jvppp.exec:\jvppp.exe104⤵PID:604
-
\??\c:\5lffffl.exec:\5lffffl.exe105⤵PID:584
-
\??\c:\xrlllfl.exec:\xrlllfl.exe106⤵PID:268
-
\??\c:\nhnttt.exec:\nhnttt.exe107⤵PID:1448
-
\??\c:\htbbbn.exec:\htbbbn.exe108⤵PID:2396
-
\??\c:\3djdd.exec:\3djdd.exe109⤵PID:1680
-
\??\c:\vvvjv.exec:\vvvjv.exe110⤵PID:1552
-
\??\c:\rlxfrxf.exec:\rlxfrxf.exe111⤵PID:884
-
\??\c:\lfrxxxx.exec:\lfrxxxx.exe112⤵PID:652
-
\??\c:\9bnttt.exec:\9bnttt.exe113⤵PID:972
-
\??\c:\3hbhbt.exec:\3hbhbt.exe114⤵PID:328
-
\??\c:\pjddp.exec:\pjddp.exe115⤵PID:2324
-
\??\c:\vpvdj.exec:\vpvdj.exe116⤵PID:2932
-
\??\c:\5xffrrf.exec:\5xffrrf.exe117⤵PID:2120
-
\??\c:\xllxfrf.exec:\xllxfrf.exe118⤵PID:2916
-
\??\c:\3nbbbt.exec:\3nbbbt.exe119⤵PID:1532
-
\??\c:\vjjvv.exec:\vjjvv.exe120⤵PID:2564
-
\??\c:\9lrrffl.exec:\9lrrffl.exe121⤵PID:2820
-
\??\c:\xlllrxf.exec:\xlllrxf.exe122⤵PID:2692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-