Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 05:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
20c2ae1adf98979e676e81903e75a800_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
20c2ae1adf98979e676e81903e75a800_NeikiAnalytics.exe
-
Size
75KB
-
MD5
20c2ae1adf98979e676e81903e75a800
-
SHA1
90a9e1d227a8f2734fce9e66ce95a9d13125c822
-
SHA256
066e197becd04e501bb1faf937568c4b021aaac23b7765ee6b7f911fda05e686
-
SHA512
4bcad320fece15228c96188cebb7d8bfff8f69bc66fdee5138dcd48afc5746b29eb0f882c792528726bd8579e37b30b70a73dacf125fc7cf0eb609d6e22aa8dc
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIoAh2QpUnX1A2:ymb3NkkiQ3mdBjFIsIVbpUH
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/1424-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2980-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1944-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/760-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1660-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/624-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1372-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2228-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/668-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1476-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/836-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2408 3lfrxfl.exe 3036 tnttbb.exe 3052 ppdvp.exe 2660 dvppj.exe 2760 nnbbnn.exe 2528 vjppv.exe 2740 llxlrxf.exe 2576 hhbbtn.exe 2980 5jjvj.exe 2784 3rxxrrf.exe 2844 ttbttn.exe 1556 htnnbt.exe 1944 vvvjd.exe 760 fxxflrf.exe 1660 rrxlflx.exe 2568 nnttbt.exe 624 1pddd.exe 1372 jvjjj.exe 2308 lxrlflf.exe 2228 nthnhb.exe 2900 hbtntt.exe 668 ddjdp.exe 1476 9vdvp.exe 836 7rrfxfx.exe 1760 hhbhbn.exe 1368 7pjjp.exe 688 pjpdd.exe 2148 ffxfrxf.exe 3000 hbtbtt.exe 2036 1pdvj.exe 3004 rrlrfrr.exe 2996 1fllrxf.exe 1424 hbtbnb.exe 2868 vvppd.exe 2700 vvvjd.exe 2592 ffxrflx.exe 2608 xxrflrx.exe 2508 hththn.exe 2772 hbtbhh.exe 2776 3pjpd.exe 2880 dpddv.exe 2616 flrrflr.exe 2520 lfxlffl.exe 2968 tnhbtb.exe 2984 nhbnhn.exe 2716 vppvd.exe 2816 xrfllrf.exe 2864 xrlxlrx.exe 392 1tntbb.exe 1708 9bthhh.exe 1940 hbhthh.exe 1992 pdpdd.exe 1552 flllffl.exe 1328 xxrxlrf.exe 1504 nhtbnb.exe 840 nhhtht.exe 2064 vpdjj.exe 2076 7vvpv.exe 1724 rrlrrfl.exe 2232 fxrfllf.exe 480 nhhbnn.exe 2684 7ttbnt.exe 1468 9dvvj.exe 1096 jjjvv.exe -
resource yara_rule behavioral1/memory/1424-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1424-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1944-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/760-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/624-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1372-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/668-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1476-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/836-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-283-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1424 wrote to memory of 2408 1424 20c2ae1adf98979e676e81903e75a800_NeikiAnalytics.exe 28 PID 1424 wrote to memory of 2408 1424 20c2ae1adf98979e676e81903e75a800_NeikiAnalytics.exe 28 PID 1424 wrote to memory of 2408 1424 20c2ae1adf98979e676e81903e75a800_NeikiAnalytics.exe 28 PID 1424 wrote to memory of 2408 1424 20c2ae1adf98979e676e81903e75a800_NeikiAnalytics.exe 28 PID 2408 wrote to memory of 3036 2408 3lfrxfl.exe 29 PID 2408 wrote to memory of 3036 2408 3lfrxfl.exe 29 PID 2408 wrote to memory of 3036 2408 3lfrxfl.exe 29 PID 2408 wrote to memory of 3036 2408 3lfrxfl.exe 29 PID 3036 wrote to memory of 3052 3036 tnttbb.exe 30 PID 3036 wrote to memory of 3052 3036 tnttbb.exe 30 PID 3036 wrote to memory of 3052 3036 tnttbb.exe 30 PID 3036 wrote to memory of 3052 3036 tnttbb.exe 30 PID 3052 wrote to memory of 2660 3052 ppdvp.exe 31 PID 3052 wrote to memory of 2660 3052 ppdvp.exe 31 PID 3052 wrote to memory of 2660 3052 ppdvp.exe 31 PID 3052 wrote to memory of 2660 3052 ppdvp.exe 31 PID 2660 wrote to memory of 2760 2660 dvppj.exe 32 PID 2660 wrote to memory of 2760 2660 dvppj.exe 32 PID 2660 wrote to memory of 2760 2660 dvppj.exe 32 PID 2660 wrote to memory of 2760 2660 dvppj.exe 32 PID 2760 wrote to memory of 2528 2760 nnbbnn.exe 33 PID 2760 wrote to memory of 2528 2760 nnbbnn.exe 33 PID 2760 wrote to memory of 2528 2760 nnbbnn.exe 33 PID 2760 wrote to memory of 2528 2760 nnbbnn.exe 33 PID 2528 wrote to memory of 2740 2528 vjppv.exe 34 PID 2528 wrote to memory of 2740 2528 vjppv.exe 34 PID 2528 wrote to memory of 2740 2528 vjppv.exe 34 PID 2528 wrote to memory of 2740 2528 vjppv.exe 34 PID 2740 wrote to memory of 2576 2740 llxlrxf.exe 35 PID 2740 wrote to memory of 2576 2740 llxlrxf.exe 35 PID 2740 wrote to memory of 2576 2740 llxlrxf.exe 35 PID 2740 wrote to memory of 2576 2740 llxlrxf.exe 35 PID 2576 wrote to memory of 2980 2576 hhbbtn.exe 36 PID 2576 wrote to memory of 2980 2576 hhbbtn.exe 36 PID 2576 wrote to memory of 2980 2576 hhbbtn.exe 36 PID 2576 wrote to memory of 2980 2576 hhbbtn.exe 36 PID 2980 wrote to memory of 2784 2980 5jjvj.exe 37 PID 2980 wrote to memory of 2784 2980 5jjvj.exe 37 PID 2980 wrote to memory of 2784 2980 5jjvj.exe 37 PID 2980 wrote to memory of 2784 2980 5jjvj.exe 37 PID 2784 wrote to memory of 2844 2784 3rxxrrf.exe 38 PID 2784 wrote to memory of 2844 2784 3rxxrrf.exe 38 PID 2784 wrote to memory of 2844 2784 3rxxrrf.exe 38 PID 2784 wrote to memory of 2844 2784 3rxxrrf.exe 38 PID 2844 wrote to memory of 1556 2844 ttbttn.exe 39 PID 2844 wrote to memory of 1556 2844 ttbttn.exe 39 PID 2844 wrote to memory of 1556 2844 ttbttn.exe 39 PID 2844 wrote to memory of 1556 2844 ttbttn.exe 39 PID 1556 wrote to memory of 1944 1556 htnnbt.exe 40 PID 1556 wrote to memory of 1944 1556 htnnbt.exe 40 PID 1556 wrote to memory of 1944 1556 htnnbt.exe 40 PID 1556 wrote to memory of 1944 1556 htnnbt.exe 40 PID 1944 wrote to memory of 760 1944 vvvjd.exe 41 PID 1944 wrote to memory of 760 1944 vvvjd.exe 41 PID 1944 wrote to memory of 760 1944 vvvjd.exe 41 PID 1944 wrote to memory of 760 1944 vvvjd.exe 41 PID 760 wrote to memory of 1660 760 fxxflrf.exe 42 PID 760 wrote to memory of 1660 760 fxxflrf.exe 42 PID 760 wrote to memory of 1660 760 fxxflrf.exe 42 PID 760 wrote to memory of 1660 760 fxxflrf.exe 42 PID 1660 wrote to memory of 2568 1660 rrxlflx.exe 43 PID 1660 wrote to memory of 2568 1660 rrxlflx.exe 43 PID 1660 wrote to memory of 2568 1660 rrxlflx.exe 43 PID 1660 wrote to memory of 2568 1660 rrxlflx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\20c2ae1adf98979e676e81903e75a800_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\20c2ae1adf98979e676e81903e75a800_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\3lfrxfl.exec:\3lfrxfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\tnttbb.exec:\tnttbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\ppdvp.exec:\ppdvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\dvppj.exec:\dvppj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\nnbbnn.exec:\nnbbnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\vjppv.exec:\vjppv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\llxlrxf.exec:\llxlrxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\hhbbtn.exec:\hhbbtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\5jjvj.exec:\5jjvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\3rxxrrf.exec:\3rxxrrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\ttbttn.exec:\ttbttn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\htnnbt.exec:\htnnbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\vvvjd.exec:\vvvjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\fxxflrf.exec:\fxxflrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\rrxlflx.exec:\rrxlflx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\nnttbt.exec:\nnttbt.exe17⤵
- Executes dropped EXE
PID:2568 -
\??\c:\1pddd.exec:\1pddd.exe18⤵
- Executes dropped EXE
PID:624 -
\??\c:\jvjjj.exec:\jvjjj.exe19⤵
- Executes dropped EXE
PID:1372 -
\??\c:\lxrlflf.exec:\lxrlflf.exe20⤵
- Executes dropped EXE
PID:2308 -
\??\c:\nthnhb.exec:\nthnhb.exe21⤵
- Executes dropped EXE
PID:2228 -
\??\c:\hbtntt.exec:\hbtntt.exe22⤵
- Executes dropped EXE
PID:2900 -
\??\c:\ddjdp.exec:\ddjdp.exe23⤵
- Executes dropped EXE
PID:668 -
\??\c:\9vdvp.exec:\9vdvp.exe24⤵
- Executes dropped EXE
PID:1476 -
\??\c:\7rrfxfx.exec:\7rrfxfx.exe25⤵
- Executes dropped EXE
PID:836 -
\??\c:\hhbhbn.exec:\hhbhbn.exe26⤵
- Executes dropped EXE
PID:1760 -
\??\c:\7pjjp.exec:\7pjjp.exe27⤵
- Executes dropped EXE
PID:1368 -
\??\c:\pjpdd.exec:\pjpdd.exe28⤵
- Executes dropped EXE
PID:688 -
\??\c:\ffxfrxf.exec:\ffxfrxf.exe29⤵
- Executes dropped EXE
PID:2148 -
\??\c:\hbtbtt.exec:\hbtbtt.exe30⤵
- Executes dropped EXE
PID:3000 -
\??\c:\1pdvj.exec:\1pdvj.exe31⤵
- Executes dropped EXE
PID:2036 -
\??\c:\rrlrfrr.exec:\rrlrfrr.exe32⤵
- Executes dropped EXE
PID:3004 -
\??\c:\1fllrxf.exec:\1fllrxf.exe33⤵
- Executes dropped EXE
PID:2996 -
\??\c:\hbtbnb.exec:\hbtbnb.exe34⤵
- Executes dropped EXE
PID:1424 -
\??\c:\vvppd.exec:\vvppd.exe35⤵
- Executes dropped EXE
PID:2868 -
\??\c:\vvvjd.exec:\vvvjd.exe36⤵
- Executes dropped EXE
PID:2700 -
\??\c:\ffxrflx.exec:\ffxrflx.exe37⤵
- Executes dropped EXE
PID:2592 -
\??\c:\xxrflrx.exec:\xxrflrx.exe38⤵
- Executes dropped EXE
PID:2608 -
\??\c:\hththn.exec:\hththn.exe39⤵
- Executes dropped EXE
PID:2508 -
\??\c:\hbtbhh.exec:\hbtbhh.exe40⤵
- Executes dropped EXE
PID:2772 -
\??\c:\3pjpd.exec:\3pjpd.exe41⤵
- Executes dropped EXE
PID:2776 -
\??\c:\dpddv.exec:\dpddv.exe42⤵
- Executes dropped EXE
PID:2880 -
\??\c:\flrrflr.exec:\flrrflr.exe43⤵
- Executes dropped EXE
PID:2616 -
\??\c:\lfxlffl.exec:\lfxlffl.exe44⤵
- Executes dropped EXE
PID:2520 -
\??\c:\tnhbtb.exec:\tnhbtb.exe45⤵
- Executes dropped EXE
PID:2968 -
\??\c:\nhbnhn.exec:\nhbnhn.exe46⤵
- Executes dropped EXE
PID:2984 -
\??\c:\vppvd.exec:\vppvd.exe47⤵
- Executes dropped EXE
PID:2716 -
\??\c:\xrfllrf.exec:\xrfllrf.exe48⤵
- Executes dropped EXE
PID:2816 -
\??\c:\xrlxlrx.exec:\xrlxlrx.exe49⤵
- Executes dropped EXE
PID:2864 -
\??\c:\1tntbb.exec:\1tntbb.exe50⤵
- Executes dropped EXE
PID:392 -
\??\c:\9bthhh.exec:\9bthhh.exe51⤵
- Executes dropped EXE
PID:1708 -
\??\c:\hbhthh.exec:\hbhthh.exe52⤵
- Executes dropped EXE
PID:1940 -
\??\c:\pdpdd.exec:\pdpdd.exe53⤵
- Executes dropped EXE
PID:1992 -
\??\c:\flllffl.exec:\flllffl.exe54⤵
- Executes dropped EXE
PID:1552 -
\??\c:\xxrxlrf.exec:\xxrxlrf.exe55⤵
- Executes dropped EXE
PID:1328 -
\??\c:\nhtbnb.exec:\nhtbnb.exe56⤵
- Executes dropped EXE
PID:1504 -
\??\c:\nhhtht.exec:\nhhtht.exe57⤵
- Executes dropped EXE
PID:840 -
\??\c:\vpdjj.exec:\vpdjj.exe58⤵
- Executes dropped EXE
PID:2064 -
\??\c:\7vvpv.exec:\7vvpv.exe59⤵
- Executes dropped EXE
PID:2076 -
\??\c:\rrlrrfl.exec:\rrlrrfl.exe60⤵
- Executes dropped EXE
PID:1724 -
\??\c:\fxrfllf.exec:\fxrfllf.exe61⤵
- Executes dropped EXE
PID:2232 -
\??\c:\nhhbnn.exec:\nhhbnn.exe62⤵
- Executes dropped EXE
PID:480 -
\??\c:\7ttbnt.exec:\7ttbnt.exe63⤵
- Executes dropped EXE
PID:2684 -
\??\c:\9dvvj.exec:\9dvvj.exe64⤵
- Executes dropped EXE
PID:1468 -
\??\c:\jjjvv.exec:\jjjvv.exe65⤵
- Executes dropped EXE
PID:1096 -
\??\c:\rrlrflx.exec:\rrlrflx.exe66⤵PID:2136
-
\??\c:\5llfrxf.exec:\5llfrxf.exe67⤵PID:1788
-
\??\c:\btthbb.exec:\btthbb.exe68⤵PID:1044
-
\??\c:\ttnthh.exec:\ttnthh.exe69⤵PID:3028
-
\??\c:\tttnhh.exec:\tttnhh.exe70⤵PID:1936
-
\??\c:\vpdjp.exec:\vpdjp.exe71⤵PID:2872
-
\??\c:\vpjpd.exec:\vpjpd.exe72⤵PID:2876
-
\??\c:\frxlrrl.exec:\frxlrrl.exe73⤵PID:2272
-
\??\c:\xrlrffl.exec:\xrlrffl.exe74⤵PID:1748
-
\??\c:\nnhthn.exec:\nnhthn.exe75⤵PID:2116
-
\??\c:\nthtnb.exec:\nthtnb.exe76⤵PID:2976
-
\??\c:\pppdj.exec:\pppdj.exe77⤵PID:2000
-
\??\c:\jjvdv.exec:\jjvdv.exe78⤵PID:2736
-
\??\c:\llxflrr.exec:\llxflrr.exe79⤵PID:1384
-
\??\c:\7xlrffx.exec:\7xlrffx.exe80⤵PID:2892
-
\??\c:\rrrxrxl.exec:\rrrxrxl.exe81⤵PID:2224
-
\??\c:\1bhbtt.exec:\1bhbtt.exe82⤵PID:2620
-
\??\c:\3vvvd.exec:\3vvvd.exe83⤵PID:2728
-
\??\c:\pjjjj.exec:\pjjjj.exe84⤵PID:2640
-
\??\c:\rrrxxfr.exec:\rrrxxfr.exe85⤵PID:2528
-
\??\c:\lfrxllx.exec:\lfrxllx.exe86⤵PID:2572
-
\??\c:\nhhtnt.exec:\nhhtnt.exe87⤵PID:2184
-
\??\c:\tntbnn.exec:\tntbnn.exe88⤵PID:1636
-
\??\c:\jdpdp.exec:\jdpdp.exe89⤵PID:2980
-
\??\c:\vpdjp.exec:\vpdjp.exe90⤵PID:2808
-
\??\c:\xxxfxfr.exec:\xxxfxfr.exe91⤵PID:2952
-
\??\c:\frrflrr.exec:\frrflrr.exe92⤵PID:1960
-
\??\c:\bbnthn.exec:\bbnthn.exe93⤵PID:1256
-
\??\c:\tttnth.exec:\tttnth.exe94⤵PID:804
-
\??\c:\pvvjj.exec:\pvvjj.exe95⤵PID:2168
-
\??\c:\xffxxrr.exec:\xffxxrr.exe96⤵PID:1992
-
\??\c:\3lflrxf.exec:\3lflrxf.exe97⤵PID:1648
-
\??\c:\3lxfllf.exec:\3lxfllf.exe98⤵PID:1200
-
\??\c:\nthhtn.exec:\nthhtn.exe99⤵PID:2056
-
\??\c:\vpvjp.exec:\vpvjp.exe100⤵PID:2068
-
\??\c:\9pjpj.exec:\9pjpj.exe101⤵PID:1900
-
\??\c:\xxrrxxr.exec:\xxrrxxr.exe102⤵PID:2588
-
\??\c:\rfrxllx.exec:\rfrxllx.exe103⤵PID:592
-
\??\c:\bbhnnn.exec:\bbhnnn.exe104⤵PID:1080
-
\??\c:\hnttnt.exec:\hnttnt.exe105⤵PID:1484
-
\??\c:\vpjvj.exec:\vpjvj.exe106⤵PID:1844
-
\??\c:\7vppp.exec:\7vppp.exe107⤵PID:632
-
\??\c:\rlrxlll.exec:\rlrxlll.exe108⤵PID:2920
-
\??\c:\rrflxfx.exec:\rrflxfx.exe109⤵PID:1088
-
\??\c:\3hbtbb.exec:\3hbtbb.exe110⤵PID:1368
-
\??\c:\tnnntb.exec:\tnnntb.exe111⤵PID:2220
-
\??\c:\3dvvd.exec:\3dvvd.exe112⤵PID:284
-
\??\c:\5frxfxf.exec:\5frxfxf.exe113⤵PID:2924
-
\??\c:\hhbbtb.exec:\hhbbtb.exe114⤵PID:1492
-
\??\c:\tthnth.exec:\tthnth.exe115⤵PID:876
-
\??\c:\ppppv.exec:\ppppv.exe116⤵PID:3004
-
\??\c:\jvvdp.exec:\jvvdp.exe117⤵PID:1776
-
\??\c:\flrrlrl.exec:\flrrlrl.exe118⤵PID:1424
-
\??\c:\7llrxxl.exec:\7llrxxl.exe119⤵PID:2796
-
\??\c:\thttnn.exec:\thttnn.exe120⤵PID:2700
-
\??\c:\hbtbhn.exec:\hbtbhn.exe121⤵PID:2636
-
\??\c:\jvpdv.exec:\jvpdv.exe122⤵PID:2884
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-