Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 02:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7cda909b9b7cfacaa3ed6179476b5870_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
7cda909b9b7cfacaa3ed6179476b5870_NeikiAnalytics.exe
-
Size
88KB
-
MD5
7cda909b9b7cfacaa3ed6179476b5870
-
SHA1
16b35a4e4baab536df3a7f38dce93d29aec84e36
-
SHA256
5f63d8ccc2d8e08eb25f2da86b38affbde699d958ef11ffb9424dabfd74d68c5
-
SHA512
6797e0ba73d5307968fad892403909fec619b3ad689c258a1e9ebc161f29f230e744089ad2bc1387464891bfa461fc83c2286e2989e666a4c3fa2aff8b0f186e
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73yqKH/KjveT:ymb3NkkiQ3mdBjFo73yX+vm
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral1/memory/3012-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2376-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2276-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1428-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1896-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1232-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2320-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/544-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1732-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1108-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2236-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1568-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1908-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bbtbtb.exethtnnn.exelrrfxxr.exetnhtbt.exeppjjd.exeddvpv.exe3xlflrx.exenbtnbb.exeppddv.exevpjjd.exerxrrrlr.exebhbnbt.exebbttth.exevvdpd.exejjjvd.exe9llxlrl.exenhnnbh.exethbbbt.exevjpvd.exerlfrlfr.exefrffflx.exehhbthn.exehhtnbb.exe7vjpd.exefflrxrl.exeffxrxrx.exenthnhh.exepjddp.exevjpdd.exeffflrfr.exebtbttt.exejvpjp.exefffflxr.exefffxfff.exebtnntt.exe1ppvd.exe9vppp.exe5rrfxfr.exentthhb.exebbbtth.exejpvvj.exevdvpj.exelrxxlll.exe9frfrrl.exe5bnbtt.exedjvjp.exefrxxrrr.exebtbntt.exe7pjjv.exejpvpd.exerfxxlxr.exenbhnnb.exehbbnbn.exejdjdj.exeffrrfxx.exe9rxfflf.exebntntb.exevpjjj.exe5vvdp.exexrfxlrr.exerrfrrfl.exetnhntb.exehhtbnt.exe3pdvv.exepid process 2556 bbtbtb.exe 2524 thtnnn.exe 2532 lrrfxxr.exe 2560 tnhtbt.exe 2400 ppjjd.exe 2376 ddvpv.exe 2128 3xlflrx.exe 2276 nbtnbb.exe 1428 ppddv.exe 768 vpjjd.exe 2668 rxrrrlr.exe 1552 bhbnbt.exe 1636 bbttth.exe 1896 vvdpd.exe 1720 jjjvd.exe 1232 9llxlrl.exe 2716 nhnnbh.exe 2684 thbbbt.exe 2136 vjpvd.exe 2320 rlfrlfr.exe 544 frffflx.exe 1572 hhbthn.exe 1732 hhtnbb.exe 1108 7vjpd.exe 2236 fflrxrl.exe 1944 ffxrxrx.exe 1568 nthnhh.exe 2852 pjddp.exe 1908 vjpdd.exe 2200 ffflrfr.exe 2340 btbttt.exe 1368 jvpjp.exe 3064 fffflxr.exe 2044 fffxfff.exe 2504 btnntt.exe 2652 1ppvd.exe 2092 9vppp.exe 2548 5rrfxfr.exe 2856 ntthhb.exe 2492 bbbtth.exe 2420 jpvvj.exe 2860 vdvpj.exe 280 lrxxlll.exe 2008 9frfrrl.exe 2364 5bnbtt.exe 1888 djvjp.exe 1612 frxxrrr.exe 1552 btbntt.exe 240 7pjjv.exe 1616 jpvpd.exe 2164 rfxxlxr.exe 1720 nbhnnb.exe 1040 hbbnbn.exe 2588 jdjdj.exe 540 ffrrfxx.exe 2360 9rxfflf.exe 2336 bntntb.exe 896 vpjjj.exe 2924 5vvdp.exe 1620 xrfxlrr.exe 1144 rrfrrfl.exe 660 tnhntb.exe 2004 hhtbnt.exe 2956 3pdvv.exe -
Processes:
resource yara_rule behavioral1/memory/3012-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2276-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1428-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1896-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1232-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2320-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/544-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1732-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1108-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1568-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1908-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-291-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7cda909b9b7cfacaa3ed6179476b5870_NeikiAnalytics.exebbtbtb.exethtnnn.exelrrfxxr.exetnhtbt.exeppjjd.exeddvpv.exe3xlflrx.exenbtnbb.exeppddv.exevpjjd.exerxrrrlr.exebhbnbt.exebbttth.exevvdpd.exejjjvd.exedescription pid process target process PID 3012 wrote to memory of 2556 3012 7cda909b9b7cfacaa3ed6179476b5870_NeikiAnalytics.exe bbtbtb.exe PID 3012 wrote to memory of 2556 3012 7cda909b9b7cfacaa3ed6179476b5870_NeikiAnalytics.exe bbtbtb.exe PID 3012 wrote to memory of 2556 3012 7cda909b9b7cfacaa3ed6179476b5870_NeikiAnalytics.exe bbtbtb.exe PID 3012 wrote to memory of 2556 3012 7cda909b9b7cfacaa3ed6179476b5870_NeikiAnalytics.exe bbtbtb.exe PID 2556 wrote to memory of 2524 2556 bbtbtb.exe thtnnn.exe PID 2556 wrote to memory of 2524 2556 bbtbtb.exe thtnnn.exe PID 2556 wrote to memory of 2524 2556 bbtbtb.exe thtnnn.exe PID 2556 wrote to memory of 2524 2556 bbtbtb.exe thtnnn.exe PID 2524 wrote to memory of 2532 2524 thtnnn.exe lrrfxxr.exe PID 2524 wrote to memory of 2532 2524 thtnnn.exe lrrfxxr.exe PID 2524 wrote to memory of 2532 2524 thtnnn.exe lrrfxxr.exe PID 2524 wrote to memory of 2532 2524 thtnnn.exe lrrfxxr.exe PID 2532 wrote to memory of 2560 2532 lrrfxxr.exe tnhtbt.exe PID 2532 wrote to memory of 2560 2532 lrrfxxr.exe tnhtbt.exe PID 2532 wrote to memory of 2560 2532 lrrfxxr.exe tnhtbt.exe PID 2532 wrote to memory of 2560 2532 lrrfxxr.exe tnhtbt.exe PID 2560 wrote to memory of 2400 2560 tnhtbt.exe ppjjd.exe PID 2560 wrote to memory of 2400 2560 tnhtbt.exe ppjjd.exe PID 2560 wrote to memory of 2400 2560 tnhtbt.exe ppjjd.exe PID 2560 wrote to memory of 2400 2560 tnhtbt.exe ppjjd.exe PID 2400 wrote to memory of 2376 2400 ppjjd.exe ddvpv.exe PID 2400 wrote to memory of 2376 2400 ppjjd.exe ddvpv.exe PID 2400 wrote to memory of 2376 2400 ppjjd.exe ddvpv.exe PID 2400 wrote to memory of 2376 2400 ppjjd.exe ddvpv.exe PID 2376 wrote to memory of 2128 2376 ddvpv.exe 3xlflrx.exe PID 2376 wrote to memory of 2128 2376 ddvpv.exe 3xlflrx.exe PID 2376 wrote to memory of 2128 2376 ddvpv.exe 3xlflrx.exe PID 2376 wrote to memory of 2128 2376 ddvpv.exe 3xlflrx.exe PID 2128 wrote to memory of 2276 2128 3xlflrx.exe nbtnbb.exe PID 2128 wrote to memory of 2276 2128 3xlflrx.exe nbtnbb.exe PID 2128 wrote to memory of 2276 2128 3xlflrx.exe nbtnbb.exe PID 2128 wrote to memory of 2276 2128 3xlflrx.exe nbtnbb.exe PID 2276 wrote to memory of 1428 2276 nbtnbb.exe ppddv.exe PID 2276 wrote to memory of 1428 2276 nbtnbb.exe ppddv.exe PID 2276 wrote to memory of 1428 2276 nbtnbb.exe ppddv.exe PID 2276 wrote to memory of 1428 2276 nbtnbb.exe ppddv.exe PID 1428 wrote to memory of 768 1428 ppddv.exe vpjjd.exe PID 1428 wrote to memory of 768 1428 ppddv.exe vpjjd.exe PID 1428 wrote to memory of 768 1428 ppddv.exe vpjjd.exe PID 1428 wrote to memory of 768 1428 ppddv.exe vpjjd.exe PID 768 wrote to memory of 2668 768 vpjjd.exe rxrrrlr.exe PID 768 wrote to memory of 2668 768 vpjjd.exe rxrrrlr.exe PID 768 wrote to memory of 2668 768 vpjjd.exe rxrrrlr.exe PID 768 wrote to memory of 2668 768 vpjjd.exe rxrrrlr.exe PID 2668 wrote to memory of 1552 2668 rxrrrlr.exe bhbnbt.exe PID 2668 wrote to memory of 1552 2668 rxrrrlr.exe bhbnbt.exe PID 2668 wrote to memory of 1552 2668 rxrrrlr.exe bhbnbt.exe PID 2668 wrote to memory of 1552 2668 rxrrrlr.exe bhbnbt.exe PID 1552 wrote to memory of 1636 1552 bhbnbt.exe bbttth.exe PID 1552 wrote to memory of 1636 1552 bhbnbt.exe bbttth.exe PID 1552 wrote to memory of 1636 1552 bhbnbt.exe bbttth.exe PID 1552 wrote to memory of 1636 1552 bhbnbt.exe bbttth.exe PID 1636 wrote to memory of 1896 1636 bbttth.exe vvdpd.exe PID 1636 wrote to memory of 1896 1636 bbttth.exe vvdpd.exe PID 1636 wrote to memory of 1896 1636 bbttth.exe vvdpd.exe PID 1636 wrote to memory of 1896 1636 bbttth.exe vvdpd.exe PID 1896 wrote to memory of 1720 1896 vvdpd.exe jjjvd.exe PID 1896 wrote to memory of 1720 1896 vvdpd.exe jjjvd.exe PID 1896 wrote to memory of 1720 1896 vvdpd.exe jjjvd.exe PID 1896 wrote to memory of 1720 1896 vvdpd.exe jjjvd.exe PID 1720 wrote to memory of 1232 1720 jjjvd.exe 9llxlrl.exe PID 1720 wrote to memory of 1232 1720 jjjvd.exe 9llxlrl.exe PID 1720 wrote to memory of 1232 1720 jjjvd.exe 9llxlrl.exe PID 1720 wrote to memory of 1232 1720 jjjvd.exe 9llxlrl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7cda909b9b7cfacaa3ed6179476b5870_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7cda909b9b7cfacaa3ed6179476b5870_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\bbtbtb.exec:\bbtbtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\thtnnn.exec:\thtnnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\lrrfxxr.exec:\lrrfxxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\tnhtbt.exec:\tnhtbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\ppjjd.exec:\ppjjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\ddvpv.exec:\ddvpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\3xlflrx.exec:\3xlflrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\nbtnbb.exec:\nbtnbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\ppddv.exec:\ppddv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\vpjjd.exec:\vpjjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\rxrrrlr.exec:\rxrrrlr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\bhbnbt.exec:\bhbnbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\bbttth.exec:\bbttth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\vvdpd.exec:\vvdpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\jjjvd.exec:\jjjvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\9llxlrl.exec:\9llxlrl.exe17⤵
- Executes dropped EXE
PID:1232 -
\??\c:\nhnnbh.exec:\nhnnbh.exe18⤵
- Executes dropped EXE
PID:2716 -
\??\c:\thbbbt.exec:\thbbbt.exe19⤵
- Executes dropped EXE
PID:2684 -
\??\c:\vjpvd.exec:\vjpvd.exe20⤵
- Executes dropped EXE
PID:2136 -
\??\c:\rlfrlfr.exec:\rlfrlfr.exe21⤵
- Executes dropped EXE
PID:2320 -
\??\c:\frffflx.exec:\frffflx.exe22⤵
- Executes dropped EXE
PID:544 -
\??\c:\hhbthn.exec:\hhbthn.exe23⤵
- Executes dropped EXE
PID:1572 -
\??\c:\hhtnbb.exec:\hhtnbb.exe24⤵
- Executes dropped EXE
PID:1732 -
\??\c:\7vjpd.exec:\7vjpd.exe25⤵
- Executes dropped EXE
PID:1108 -
\??\c:\fflrxrl.exec:\fflrxrl.exe26⤵
- Executes dropped EXE
PID:2236 -
\??\c:\ffxrxrx.exec:\ffxrxrx.exe27⤵
- Executes dropped EXE
PID:1944 -
\??\c:\nthnhh.exec:\nthnhh.exe28⤵
- Executes dropped EXE
PID:1568 -
\??\c:\pjddp.exec:\pjddp.exe29⤵
- Executes dropped EXE
PID:2852 -
\??\c:\vjpdd.exec:\vjpdd.exe30⤵
- Executes dropped EXE
PID:1908 -
\??\c:\ffflrfr.exec:\ffflrfr.exe31⤵
- Executes dropped EXE
PID:2200 -
\??\c:\btbttt.exec:\btbttt.exe32⤵
- Executes dropped EXE
PID:2340 -
\??\c:\jvpjp.exec:\jvpjp.exe33⤵
- Executes dropped EXE
PID:1368 -
\??\c:\pjvpv.exec:\pjvpv.exe34⤵PID:2484
-
\??\c:\fffflxr.exec:\fffflxr.exe35⤵
- Executes dropped EXE
PID:3064 -
\??\c:\fffxfff.exec:\fffxfff.exe36⤵
- Executes dropped EXE
PID:2044 -
\??\c:\btnntt.exec:\btnntt.exe37⤵
- Executes dropped EXE
PID:2504 -
\??\c:\1ppvd.exec:\1ppvd.exe38⤵
- Executes dropped EXE
PID:2652 -
\??\c:\9vppp.exec:\9vppp.exe39⤵
- Executes dropped EXE
PID:2092 -
\??\c:\5rrfxfr.exec:\5rrfxfr.exe40⤵
- Executes dropped EXE
PID:2548 -
\??\c:\ntthhb.exec:\ntthhb.exe41⤵
- Executes dropped EXE
PID:2856 -
\??\c:\bbbtth.exec:\bbbtth.exe42⤵
- Executes dropped EXE
PID:2492 -
\??\c:\jpvvj.exec:\jpvvj.exe43⤵
- Executes dropped EXE
PID:2420 -
\??\c:\vdvpj.exec:\vdvpj.exe44⤵
- Executes dropped EXE
PID:2860 -
\??\c:\lrxxlll.exec:\lrxxlll.exe45⤵
- Executes dropped EXE
PID:280 -
\??\c:\9frfrrl.exec:\9frfrrl.exe46⤵
- Executes dropped EXE
PID:2008 -
\??\c:\5bnbtt.exec:\5bnbtt.exe47⤵
- Executes dropped EXE
PID:2364 -
\??\c:\djvjp.exec:\djvjp.exe48⤵
- Executes dropped EXE
PID:1888 -
\??\c:\frxxrrr.exec:\frxxrrr.exe49⤵
- Executes dropped EXE
PID:1612 -
\??\c:\btbntt.exec:\btbntt.exe50⤵
- Executes dropped EXE
PID:1552 -
\??\c:\7pjjv.exec:\7pjjv.exe51⤵
- Executes dropped EXE
PID:240 -
\??\c:\jpvpd.exec:\jpvpd.exe52⤵
- Executes dropped EXE
PID:1616 -
\??\c:\rfxxlxr.exec:\rfxxlxr.exe53⤵
- Executes dropped EXE
PID:2164 -
\??\c:\nbhnnb.exec:\nbhnnb.exe54⤵
- Executes dropped EXE
PID:1720 -
\??\c:\hbbnbn.exec:\hbbnbn.exe55⤵
- Executes dropped EXE
PID:1040 -
\??\c:\jdjdj.exec:\jdjdj.exe56⤵
- Executes dropped EXE
PID:2588 -
\??\c:\ffrrfxx.exec:\ffrrfxx.exe57⤵
- Executes dropped EXE
PID:540 -
\??\c:\9rxfflf.exec:\9rxfflf.exe58⤵
- Executes dropped EXE
PID:2360 -
\??\c:\bntntb.exec:\bntntb.exe59⤵
- Executes dropped EXE
PID:2336 -
\??\c:\vpjjj.exec:\vpjjj.exe60⤵
- Executes dropped EXE
PID:896 -
\??\c:\5vvdp.exec:\5vvdp.exe61⤵
- Executes dropped EXE
PID:2924 -
\??\c:\xrfxlrr.exec:\xrfxlrr.exe62⤵
- Executes dropped EXE
PID:1620 -
\??\c:\rrfrrfl.exec:\rrfrrfl.exe63⤵
- Executes dropped EXE
PID:1144 -
\??\c:\tnhntb.exec:\tnhntb.exe64⤵
- Executes dropped EXE
PID:660 -
\??\c:\hhtbnt.exec:\hhtbnt.exe65⤵
- Executes dropped EXE
PID:2004 -
\??\c:\3pdvv.exec:\3pdvv.exe66⤵
- Executes dropped EXE
PID:2956 -
\??\c:\5vdvv.exec:\5vdvv.exe67⤵PID:700
-
\??\c:\frxlxxf.exec:\frxlxxf.exe68⤵PID:924
-
\??\c:\xrxlrfx.exec:\xrxlrfx.exe69⤵PID:2784
-
\??\c:\hbbbbb.exec:\hbbbbb.exe70⤵PID:2852
-
\??\c:\tnntnn.exec:\tnntnn.exe71⤵PID:2936
-
\??\c:\vvjpj.exec:\vvjpj.exe72⤵PID:1992
-
\??\c:\xrlrxrf.exec:\xrlrxrf.exe73⤵PID:1640
-
\??\c:\rlflfrf.exec:\rlflfrf.exe74⤵PID:2892
-
\??\c:\bhnhnh.exec:\bhnhnh.exe75⤵PID:2576
-
\??\c:\dvvpd.exec:\dvvpd.exe76⤵PID:2876
-
\??\c:\jdpdp.exec:\jdpdp.exe77⤵PID:2748
-
\??\c:\1xxlrrl.exec:\1xxlrrl.exe78⤵PID:2628
-
\??\c:\nbtttb.exec:\nbtttb.exe79⤵PID:2532
-
\??\c:\bnbbht.exec:\bnbbht.exe80⤵PID:2100
-
\??\c:\7jdvd.exec:\7jdvd.exe81⤵PID:2372
-
\??\c:\rxlxxxl.exec:\rxlxxxl.exe82⤵PID:2408
-
\??\c:\rlffffx.exec:\rlffffx.exe83⤵PID:2816
-
\??\c:\htttnh.exec:\htttnh.exe84⤵PID:2500
-
\??\c:\djdvp.exec:\djdvp.exe85⤵PID:1608
-
\??\c:\dddjv.exec:\dddjv.exe86⤵PID:1456
-
\??\c:\lfrrxlx.exec:\lfrrxlx.exe87⤵PID:1556
-
\??\c:\bbhhnt.exec:\bbhhnt.exe88⤵PID:1788
-
\??\c:\7bnhhh.exec:\7bnhhh.exe89⤵PID:1928
-
\??\c:\dvvvv.exec:\dvvvv.exe90⤵PID:824
-
\??\c:\xfllfrx.exec:\xfllfrx.exe91⤵PID:1752
-
\??\c:\xrrflrr.exec:\xrrflrr.exe92⤵PID:1724
-
\??\c:\hhttbh.exec:\hhttbh.exe93⤵PID:1896
-
\??\c:\tnnnnn.exec:\tnnnnn.exe94⤵PID:864
-
\??\c:\dvdpd.exec:\dvdpd.exe95⤵PID:1148
-
\??\c:\jjjvv.exec:\jjjvv.exe96⤵PID:2712
-
\??\c:\5lrxffl.exec:\5lrxffl.exe97⤵PID:384
-
\??\c:\lfrrxlf.exec:\lfrrxlf.exe98⤵PID:2704
-
\??\c:\hbtttb.exec:\hbtttb.exe99⤵PID:1156
-
\??\c:\nthbhh.exec:\nthbhh.exe100⤵PID:2996
-
\??\c:\pjdpd.exec:\pjdpd.exe101⤵PID:3068
-
\??\c:\7fffrlx.exec:\7fffrlx.exe102⤵PID:1408
-
\??\c:\rxflffx.exec:\rxflffx.exe103⤵PID:1760
-
\??\c:\bnnbnh.exec:\bnnbnh.exe104⤵PID:796
-
\??\c:\nhbtnn.exec:\nhbtnn.exe105⤵PID:2332
-
\??\c:\7pjpv.exec:\7pjpv.exe106⤵PID:1592
-
\??\c:\fxfllrx.exec:\fxfllrx.exe107⤵PID:320
-
\??\c:\bhhnbb.exec:\bhhnbb.exe108⤵PID:2060
-
\??\c:\5htttt.exec:\5htttt.exe109⤵PID:2788
-
\??\c:\ppppj.exec:\ppppj.exe110⤵PID:352
-
\??\c:\7pvpd.exec:\7pvpd.exe111⤵PID:860
-
\??\c:\fffrfrx.exec:\fffrfrx.exe112⤵PID:2116
-
\??\c:\nhnhhn.exec:\nhnhhn.exe113⤵PID:2000
-
\??\c:\3bnntt.exec:\3bnntt.exe114⤵PID:2340
-
\??\c:\dvppv.exec:\dvppv.exe115⤵PID:1640
-
\??\c:\pjvjp.exec:\pjvjp.exe116⤵PID:2484
-
\??\c:\frfrflx.exec:\frfrflx.exe117⤵PID:2576
-
\??\c:\5btbtb.exec:\5btbtb.exe118⤵PID:2620
-
\??\c:\9bthtn.exec:\9bthtn.exe119⤵PID:2740
-
\??\c:\flxlxfr.exec:\flxlxfr.exe120⤵PID:2412
-
\??\c:\lxlxxxr.exec:\lxlxxxr.exe121⤵PID:2092
-
\??\c:\xxfrlxr.exec:\xxfrlxr.exe122⤵PID:2548
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-