Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 02:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7bbc0794be0decc6cdeef75d88ba6620_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
7bbc0794be0decc6cdeef75d88ba6620_NeikiAnalytics.exe
-
Size
70KB
-
MD5
7bbc0794be0decc6cdeef75d88ba6620
-
SHA1
56ddf8d1a08a4d98087384be6ebfda11aa3c26b8
-
SHA256
6836cf9c4082c9deca48d8d8500542d6b4f76c5abe56b5640199e778d11a5ce5
-
SHA512
adaba19961403a14398fb34a45a7031d9e54d3c33f766def437e447eec4eeac3935e67bca1fdc5a2958e8b412668028fb62a8a8fc17e283077019396954b67a7
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb7tAHEqSCkKWr:ymb3NkkiQ3mdBjFIynIK+
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/2416-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1756-32-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1480-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2028-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/548-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1808-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2000-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1304-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1248-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1756-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2296-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bnhttt.exepjdvp.exelrrffxf.exerfxfxfl.exehbtbhn.exetttntb.exepjpvd.exerfxxffl.exe1rrrflr.exehthntt.exevjppj.exedjdjp.exexrlrfxf.exettbbnn.exe7tnthh.exepvpdj.exejpdpv.exe3xffflf.exelxlffxr.exehnhhhn.exetnhhtb.exevvpvv.exevpdvv.exerlxflll.exe9ffrlfl.exe5thnbh.exenhttbb.exejjvjv.exevddvp.exerlxlllx.exebntntt.exethhbnt.exejdppv.exedpjpj.exerrflxfl.exebntnbb.exebnhhtt.exexffxffx.exe1fxlxfl.exefllflfl.exentntbn.exenbhnth.exebtnbnt.exeppvvd.exepjdpj.exerlxfxfr.exellxxrfx.exethhnhh.exennbtnh.exenhbhbh.exepvvvp.exeppvpj.exefrrllfl.exexxrlxxf.exe1bnhtb.exettthht.exeppvpj.exe3pjvd.exejdddv.exerlxlrfr.exexrlrflf.exenhttbt.exe7nhhbh.exepvdpj.exepid process 2296 bnhttt.exe 1756 pjdvp.exe 2580 lrrffxf.exe 2608 rfxfxfl.exe 2612 hbtbhn.exe 2784 tttntb.exe 2564 pjpvd.exe 2528 rfxxffl.exe 2124 1rrrflr.exe 2812 hthntt.exe 2996 vjppj.exe 240 djdjp.exe 1248 xrlrfxf.exe 1952 ttbbnn.exe 1532 7tnthh.exe 1028 pvpdj.exe 1444 jpdpv.exe 1304 3xffflf.exe 2000 lxlffxr.exe 2888 hnhhhn.exe 1236 tnhhtb.exe 984 vvpvv.exe 1480 vpdvv.exe 1808 rlxflll.exe 944 9ffrlfl.exe 548 5thnbh.exe 908 nhttbb.exe 1016 jjvjv.exe 2016 vddvp.exe 884 rlxlllx.exe 2028 bntntt.exe 1856 thhbnt.exe 2176 jdppv.exe 2544 dpjpj.exe 2648 rrflxfl.exe 2584 bntnbb.exe 2608 bnhhtt.exe 2380 xffxffx.exe 2620 1fxlxfl.exe 2452 fllflfl.exe 2964 ntntbn.exe 2716 nbhnth.exe 2804 btnbnt.exe 2988 ppvvd.exe 2668 pjdpj.exe 2500 rlxfxfr.exe 2628 llxxrfx.exe 1668 thhnhh.exe 404 nnbtnh.exe 2540 nhbhbh.exe 1440 pvvvp.exe 852 ppvpj.exe 1624 frrllfl.exe 2292 xxrlxxf.exe 2760 1bnhtb.exe 1284 ttthht.exe 672 ppvpj.exe 588 3pjvd.exe 2552 jdddv.exe 564 rlxlrfr.exe 1480 xrlrflf.exe 2068 nhttbt.exe 944 7nhhbh.exe 2892 pvdpj.exe -
Processes:
resource yara_rule behavioral1/memory/2416-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1480-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2028-302-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/548-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1808-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2000-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1304-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1248-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1756-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-22-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7bbc0794be0decc6cdeef75d88ba6620_NeikiAnalytics.exebnhttt.exepjdvp.exelrrffxf.exerfxfxfl.exehbtbhn.exetttntb.exepjpvd.exerfxxffl.exe1rrrflr.exehthntt.exevjppj.exedjdjp.exexrlrfxf.exettbbnn.exe7tnthh.exedescription pid process target process PID 2416 wrote to memory of 2296 2416 7bbc0794be0decc6cdeef75d88ba6620_NeikiAnalytics.exe bnhttt.exe PID 2416 wrote to memory of 2296 2416 7bbc0794be0decc6cdeef75d88ba6620_NeikiAnalytics.exe bnhttt.exe PID 2416 wrote to memory of 2296 2416 7bbc0794be0decc6cdeef75d88ba6620_NeikiAnalytics.exe bnhttt.exe PID 2416 wrote to memory of 2296 2416 7bbc0794be0decc6cdeef75d88ba6620_NeikiAnalytics.exe bnhttt.exe PID 2296 wrote to memory of 1756 2296 bnhttt.exe pjdvp.exe PID 2296 wrote to memory of 1756 2296 bnhttt.exe pjdvp.exe PID 2296 wrote to memory of 1756 2296 bnhttt.exe pjdvp.exe PID 2296 wrote to memory of 1756 2296 bnhttt.exe pjdvp.exe PID 1756 wrote to memory of 2580 1756 pjdvp.exe lrrffxf.exe PID 1756 wrote to memory of 2580 1756 pjdvp.exe lrrffxf.exe PID 1756 wrote to memory of 2580 1756 pjdvp.exe lrrffxf.exe PID 1756 wrote to memory of 2580 1756 pjdvp.exe lrrffxf.exe PID 2580 wrote to memory of 2608 2580 lrrffxf.exe rfxfxfl.exe PID 2580 wrote to memory of 2608 2580 lrrffxf.exe rfxfxfl.exe PID 2580 wrote to memory of 2608 2580 lrrffxf.exe rfxfxfl.exe PID 2580 wrote to memory of 2608 2580 lrrffxf.exe rfxfxfl.exe PID 2608 wrote to memory of 2612 2608 rfxfxfl.exe hbtbhn.exe PID 2608 wrote to memory of 2612 2608 rfxfxfl.exe hbtbhn.exe PID 2608 wrote to memory of 2612 2608 rfxfxfl.exe hbtbhn.exe PID 2608 wrote to memory of 2612 2608 rfxfxfl.exe hbtbhn.exe PID 2612 wrote to memory of 2784 2612 hbtbhn.exe tttntb.exe PID 2612 wrote to memory of 2784 2612 hbtbhn.exe tttntb.exe PID 2612 wrote to memory of 2784 2612 hbtbhn.exe tttntb.exe PID 2612 wrote to memory of 2784 2612 hbtbhn.exe tttntb.exe PID 2784 wrote to memory of 2564 2784 tttntb.exe pjpvd.exe PID 2784 wrote to memory of 2564 2784 tttntb.exe pjpvd.exe PID 2784 wrote to memory of 2564 2784 tttntb.exe pjpvd.exe PID 2784 wrote to memory of 2564 2784 tttntb.exe pjpvd.exe PID 2564 wrote to memory of 2528 2564 pjpvd.exe rfxxffl.exe PID 2564 wrote to memory of 2528 2564 pjpvd.exe rfxxffl.exe PID 2564 wrote to memory of 2528 2564 pjpvd.exe rfxxffl.exe PID 2564 wrote to memory of 2528 2564 pjpvd.exe rfxxffl.exe PID 2528 wrote to memory of 2124 2528 rfxxffl.exe 1rrrflr.exe PID 2528 wrote to memory of 2124 2528 rfxxffl.exe 1rrrflr.exe PID 2528 wrote to memory of 2124 2528 rfxxffl.exe 1rrrflr.exe PID 2528 wrote to memory of 2124 2528 rfxxffl.exe 1rrrflr.exe PID 2124 wrote to memory of 2812 2124 1rrrflr.exe 1fxfxlx.exe PID 2124 wrote to memory of 2812 2124 1rrrflr.exe 1fxfxlx.exe PID 2124 wrote to memory of 2812 2124 1rrrflr.exe 1fxfxlx.exe PID 2124 wrote to memory of 2812 2124 1rrrflr.exe 1fxfxlx.exe PID 2812 wrote to memory of 2996 2812 hthntt.exe vjppj.exe PID 2812 wrote to memory of 2996 2812 hthntt.exe vjppj.exe PID 2812 wrote to memory of 2996 2812 hthntt.exe vjppj.exe PID 2812 wrote to memory of 2996 2812 hthntt.exe vjppj.exe PID 2996 wrote to memory of 240 2996 vjppj.exe djdjp.exe PID 2996 wrote to memory of 240 2996 vjppj.exe djdjp.exe PID 2996 wrote to memory of 240 2996 vjppj.exe djdjp.exe PID 2996 wrote to memory of 240 2996 vjppj.exe djdjp.exe PID 240 wrote to memory of 1248 240 djdjp.exe xrlrfxf.exe PID 240 wrote to memory of 1248 240 djdjp.exe xrlrfxf.exe PID 240 wrote to memory of 1248 240 djdjp.exe xrlrfxf.exe PID 240 wrote to memory of 1248 240 djdjp.exe xrlrfxf.exe PID 1248 wrote to memory of 1952 1248 xrlrfxf.exe ttbbnn.exe PID 1248 wrote to memory of 1952 1248 xrlrfxf.exe ttbbnn.exe PID 1248 wrote to memory of 1952 1248 xrlrfxf.exe ttbbnn.exe PID 1248 wrote to memory of 1952 1248 xrlrfxf.exe ttbbnn.exe PID 1952 wrote to memory of 1532 1952 ttbbnn.exe 7tnthh.exe PID 1952 wrote to memory of 1532 1952 ttbbnn.exe 7tnthh.exe PID 1952 wrote to memory of 1532 1952 ttbbnn.exe 7tnthh.exe PID 1952 wrote to memory of 1532 1952 ttbbnn.exe 7tnthh.exe PID 1532 wrote to memory of 1028 1532 7tnthh.exe pvpdj.exe PID 1532 wrote to memory of 1028 1532 7tnthh.exe pvpdj.exe PID 1532 wrote to memory of 1028 1532 7tnthh.exe pvpdj.exe PID 1532 wrote to memory of 1028 1532 7tnthh.exe pvpdj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bbc0794be0decc6cdeef75d88ba6620_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7bbc0794be0decc6cdeef75d88ba6620_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\bnhttt.exec:\bnhttt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\pjdvp.exec:\pjdvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\lrrffxf.exec:\lrrffxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\rfxfxfl.exec:\rfxfxfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\hbtbhn.exec:\hbtbhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\tttntb.exec:\tttntb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\pjpvd.exec:\pjpvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\rfxxffl.exec:\rfxxffl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\1rrrflr.exec:\1rrrflr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\hthntt.exec:\hthntt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\vjppj.exec:\vjppj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\djdjp.exec:\djdjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
\??\c:\xrlrfxf.exec:\xrlrfxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\ttbbnn.exec:\ttbbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\7tnthh.exec:\7tnthh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\pvpdj.exec:\pvpdj.exe17⤵
- Executes dropped EXE
PID:1028 -
\??\c:\jpdpv.exec:\jpdpv.exe18⤵
- Executes dropped EXE
PID:1444 -
\??\c:\3xffflf.exec:\3xffflf.exe19⤵
- Executes dropped EXE
PID:1304 -
\??\c:\lxlffxr.exec:\lxlffxr.exe20⤵
- Executes dropped EXE
PID:2000 -
\??\c:\hnhhhn.exec:\hnhhhn.exe21⤵
- Executes dropped EXE
PID:2888 -
\??\c:\tnhhtb.exec:\tnhhtb.exe22⤵
- Executes dropped EXE
PID:1236 -
\??\c:\vvpvv.exec:\vvpvv.exe23⤵
- Executes dropped EXE
PID:984 -
\??\c:\vpdvv.exec:\vpdvv.exe24⤵
- Executes dropped EXE
PID:1480 -
\??\c:\rlxflll.exec:\rlxflll.exe25⤵
- Executes dropped EXE
PID:1808 -
\??\c:\9ffrlfl.exec:\9ffrlfl.exe26⤵
- Executes dropped EXE
PID:944 -
\??\c:\5thnbh.exec:\5thnbh.exe27⤵
- Executes dropped EXE
PID:548 -
\??\c:\nhttbb.exec:\nhttbb.exe28⤵
- Executes dropped EXE
PID:908 -
\??\c:\jjvjv.exec:\jjvjv.exe29⤵
- Executes dropped EXE
PID:1016 -
\??\c:\vddvp.exec:\vddvp.exe30⤵
- Executes dropped EXE
PID:2016 -
\??\c:\rlxlllx.exec:\rlxlllx.exe31⤵
- Executes dropped EXE
PID:884 -
\??\c:\bntntt.exec:\bntntt.exe32⤵
- Executes dropped EXE
PID:2028 -
\??\c:\thhbnt.exec:\thhbnt.exe33⤵
- Executes dropped EXE
PID:1856 -
\??\c:\jdppv.exec:\jdppv.exe34⤵
- Executes dropped EXE
PID:2176 -
\??\c:\dpjpj.exec:\dpjpj.exe35⤵
- Executes dropped EXE
PID:2544 -
\??\c:\rrflxfl.exec:\rrflxfl.exe36⤵
- Executes dropped EXE
PID:2648 -
\??\c:\bntnbb.exec:\bntnbb.exe37⤵
- Executes dropped EXE
PID:2584 -
\??\c:\bnhhtt.exec:\bnhhtt.exe38⤵
- Executes dropped EXE
PID:2608 -
\??\c:\xffxffx.exec:\xffxffx.exe39⤵
- Executes dropped EXE
PID:2380 -
\??\c:\1fxlxfl.exec:\1fxlxfl.exe40⤵
- Executes dropped EXE
PID:2620 -
\??\c:\fllflfl.exec:\fllflfl.exe41⤵
- Executes dropped EXE
PID:2452 -
\??\c:\ntntbn.exec:\ntntbn.exe42⤵
- Executes dropped EXE
PID:2964 -
\??\c:\nbhnth.exec:\nbhnth.exe43⤵
- Executes dropped EXE
PID:2716 -
\??\c:\btnbnt.exec:\btnbnt.exe44⤵
- Executes dropped EXE
PID:2804 -
\??\c:\ppvvd.exec:\ppvvd.exe45⤵
- Executes dropped EXE
PID:2988 -
\??\c:\pjdpj.exec:\pjdpj.exe46⤵
- Executes dropped EXE
PID:2668 -
\??\c:\rlxfxfr.exec:\rlxfxfr.exe47⤵
- Executes dropped EXE
PID:2500 -
\??\c:\llxxrfx.exec:\llxxrfx.exe48⤵
- Executes dropped EXE
PID:2628 -
\??\c:\thhnhh.exec:\thhnhh.exe49⤵
- Executes dropped EXE
PID:1668 -
\??\c:\nnbtnh.exec:\nnbtnh.exe50⤵
- Executes dropped EXE
PID:404 -
\??\c:\nhbhbh.exec:\nhbhbh.exe51⤵
- Executes dropped EXE
PID:2540 -
\??\c:\pvvvp.exec:\pvvvp.exe52⤵
- Executes dropped EXE
PID:1440 -
\??\c:\ppvpj.exec:\ppvpj.exe53⤵
- Executes dropped EXE
PID:852 -
\??\c:\frrllfl.exec:\frrllfl.exe54⤵
- Executes dropped EXE
PID:1624 -
\??\c:\xxrlxxf.exec:\xxrlxxf.exe55⤵
- Executes dropped EXE
PID:2292 -
\??\c:\1bnhtb.exec:\1bnhtb.exe56⤵
- Executes dropped EXE
PID:2760 -
\??\c:\ttthht.exec:\ttthht.exe57⤵
- Executes dropped EXE
PID:1284 -
\??\c:\ppvpj.exec:\ppvpj.exe58⤵
- Executes dropped EXE
PID:672 -
\??\c:\3pjvd.exec:\3pjvd.exe59⤵
- Executes dropped EXE
PID:588 -
\??\c:\jdddv.exec:\jdddv.exe60⤵
- Executes dropped EXE
PID:2552 -
\??\c:\rlxlrfr.exec:\rlxlrfr.exe61⤵
- Executes dropped EXE
PID:564 -
\??\c:\xrlrflf.exec:\xrlrflf.exe62⤵
- Executes dropped EXE
PID:1480 -
\??\c:\nhttbt.exec:\nhttbt.exe63⤵
- Executes dropped EXE
PID:2068 -
\??\c:\7nhhbh.exec:\7nhhbh.exe64⤵
- Executes dropped EXE
PID:944 -
\??\c:\pvdpj.exec:\pvdpj.exe65⤵
- Executes dropped EXE
PID:2892 -
\??\c:\pppdp.exec:\pppdp.exe66⤵PID:1648
-
\??\c:\rlflxfl.exec:\rlflxfl.exe67⤵PID:908
-
\??\c:\xrfllxf.exec:\xrfllxf.exe68⤵PID:1712
-
\??\c:\xlffllx.exec:\xlffllx.exe69⤵PID:2200
-
\??\c:\7bbnbb.exec:\7bbnbb.exe70⤵PID:1048
-
\??\c:\htbbhn.exec:\htbbhn.exe71⤵PID:1792
-
\??\c:\7dvjv.exec:\7dvjv.exe72⤵PID:2028
-
\??\c:\jjvjv.exec:\jjvjv.exe73⤵PID:1856
-
\??\c:\flffxrx.exec:\flffxrx.exe74⤵PID:1688
-
\??\c:\fxlxlxl.exec:\fxlxlxl.exe75⤵PID:2592
-
\??\c:\7xxxflx.exec:\7xxxflx.exe76⤵PID:2576
-
\??\c:\7nttnb.exec:\7nttnb.exe77⤵PID:2656
-
\??\c:\7tthnn.exec:\7tthnn.exe78⤵PID:1716
-
\??\c:\jjvdp.exec:\jjvdp.exe79⤵PID:2704
-
\??\c:\vvdvj.exec:\vvdvj.exe80⤵PID:2056
-
\??\c:\jddpv.exec:\jddpv.exe81⤵PID:2808
-
\??\c:\xxxxlrx.exec:\xxxxlrx.exe82⤵PID:2012
-
\??\c:\xlxxxff.exec:\xlxxxff.exe83⤵PID:2324
-
\??\c:\xllxflf.exec:\xllxflf.exe84⤵PID:1984
-
\??\c:\tntnnn.exec:\tntnnn.exe85⤵PID:2716
-
\??\c:\btntbb.exec:\btntbb.exe86⤵PID:2804
-
\??\c:\jjpjv.exec:\jjpjv.exe87⤵PID:1644
-
\??\c:\7vdvj.exec:\7vdvj.exe88⤵PID:2668
-
\??\c:\jjpvv.exec:\jjpvv.exe89⤵PID:2500
-
\??\c:\rxrxxlf.exec:\rxrxxlf.exe90⤵PID:2628
-
\??\c:\lflrxxl.exec:\lflrxxl.exe91⤵PID:1668
-
\??\c:\xrfrxlr.exec:\xrfrxlr.exe92⤵PID:404
-
\??\c:\ttbbbb.exec:\ttbbbb.exe93⤵PID:2540
-
\??\c:\tttnht.exec:\tttnht.exe94⤵PID:1440
-
\??\c:\7dvdj.exec:\7dvdj.exe95⤵PID:1516
-
\??\c:\dpddp.exec:\dpddp.exe96⤵PID:1624
-
\??\c:\vppvp.exec:\vppvp.exe97⤵PID:2432
-
\??\c:\dvvdj.exec:\dvvdj.exe98⤵PID:2760
-
\??\c:\lrffrrl.exec:\lrffrrl.exe99⤵PID:1724
-
\??\c:\7rxfrxr.exec:\7rxfrxr.exe100⤵PID:672
-
\??\c:\3ffrxlr.exec:\3ffrxlr.exe101⤵PID:2548
-
\??\c:\1bnhbh.exec:\1bnhbh.exe102⤵PID:2552
-
\??\c:\bhhbhb.exec:\bhhbhb.exe103⤵PID:988
-
\??\c:\bntnth.exec:\bntnth.exe104⤵PID:1480
-
\??\c:\jvjpv.exec:\jvjpv.exe105⤵PID:2068
-
\??\c:\9ddvv.exec:\9ddvv.exe106⤵PID:944
-
\??\c:\fllffxx.exec:\fllffxx.exe107⤵PID:2352
-
\??\c:\rrxlfxl.exec:\rrxlfxl.exe108⤵PID:1648
-
\??\c:\flxrxxf.exec:\flxrxxf.exe109⤵PID:908
-
\??\c:\llrfxxf.exec:\llrfxxf.exe110⤵PID:1712
-
\??\c:\btthtt.exec:\btthtt.exe111⤵PID:2904
-
\??\c:\nhbhnt.exec:\nhbhnt.exe112⤵PID:1048
-
\??\c:\bbhbnb.exec:\bbhbnb.exe113⤵PID:1792
-
\??\c:\dpvvd.exec:\dpvvd.exe114⤵PID:2028
-
\??\c:\5vdpp.exec:\5vdpp.exe115⤵PID:1720
-
\??\c:\jdvjp.exec:\jdvjp.exe116⤵PID:1688
-
\??\c:\xxxxfll.exec:\xxxxfll.exe117⤵PID:2592
-
\??\c:\lxxllxx.exec:\lxxllxx.exe118⤵PID:2576
-
\??\c:\xxrfrfr.exec:\xxrfrfr.exe119⤵PID:2696
-
\??\c:\5nbhnt.exec:\5nbhnt.exe120⤵PID:1716
-
\??\c:\hhbbbn.exec:\hhbbbn.exe121⤵PID:3060
-
\??\c:\thbtbn.exec:\thbtbn.exe122⤵PID:2056
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-