Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24/05/2024, 23:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ae801a344716adec281b492bd7a40520_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
ae801a344716adec281b492bd7a40520_NeikiAnalytics.exe
-
Size
83KB
-
MD5
ae801a344716adec281b492bd7a40520
-
SHA1
4bc9e9a87abce227c6ef282d88057816efac47b1
-
SHA256
f94b47f92b4540fc4f850e319a3b4974811f2424b98181ade17d3f035ee191d1
-
SHA512
ab4df4e75a3d1497c7abaeb0df947a2dfeb69ac61ad0777226c822140e49a900f372f3922d263792fe5f2286fd8019239b3dfd2db52e547bae14223a756757fb
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73yqKH/KjvHo+WdNR:ymb3NkkiQ3mdBjFo73yX+vI+qz
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/2880-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2880-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3048-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-39-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2120-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2956-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1244-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1868-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1996-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1152-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/952-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1828-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/568-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1908-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3048 jdpvd.exe 2760 lfllxrr.exe 2120 btthtn.exe 2684 jpddv.exe 2888 vddvj.exe 2648 lrxrlff.exe 2600 tbttnh.exe 2448 bthhnn.exe 2732 dpvjp.exe 2416 9jddd.exe 2956 xlxlflf.exe 3012 xflfxxl.exe 2768 tnnbtt.exe 2780 thbnbt.exe 2660 jvjdd.exe 2652 vpjdp.exe 2820 lxllrll.exe 2000 thhhhh.exe 1244 htbhhh.exe 1868 5dppj.exe 2724 1ddvv.exe 1996 xflllff.exe 1152 xlrlrlf.exe 1472 tnhhnh.exe 560 vdpjv.exe 952 dpvvv.exe 1828 xrxlxlr.exe 568 rxfxrll.exe 2212 bttthh.exe 2292 pjdpp.exe 1908 jvddj.exe 2176 frxlflr.exe 1952 1rrlfff.exe 2876 3httnn.exe 3052 nbbbnb.exe 2760 pjvdp.exe 2644 3pvdv.exe 2636 lxllrrr.exe 2584 9ffrxrx.exe 1784 lxrxxrx.exe 2544 thnbnn.exe 2484 hthhhb.exe 2480 pdjvd.exe 2440 pdddj.exe 1636 frfffxx.exe 2848 3lfffxx.exe 2864 bnnhtn.exe 3028 nbhtth.exe 1728 3djpp.exe 1748 jvjdd.exe 2496 7lfrxfl.exe 1584 xlxllll.exe 1280 btntbb.exe 2680 3nbttn.exe 2816 7jdjv.exe 1716 pdppv.exe 2312 xrlrxxl.exe 2796 9xxxfrx.exe 1868 nnnnht.exe 324 bhntnn.exe 776 vpdjv.exe 596 dpjdv.exe 1304 7rffrrr.exe 332 lflrllr.exe -
resource yara_rule behavioral1/memory/2880-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2956-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1244-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1868-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1996-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1152-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/952-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1828-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/568-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1908-298-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2880 wrote to memory of 3048 2880 ae801a344716adec281b492bd7a40520_NeikiAnalytics.exe 28 PID 2880 wrote to memory of 3048 2880 ae801a344716adec281b492bd7a40520_NeikiAnalytics.exe 28 PID 2880 wrote to memory of 3048 2880 ae801a344716adec281b492bd7a40520_NeikiAnalytics.exe 28 PID 2880 wrote to memory of 3048 2880 ae801a344716adec281b492bd7a40520_NeikiAnalytics.exe 28 PID 3048 wrote to memory of 2760 3048 jdpvd.exe 29 PID 3048 wrote to memory of 2760 3048 jdpvd.exe 29 PID 3048 wrote to memory of 2760 3048 jdpvd.exe 29 PID 3048 wrote to memory of 2760 3048 jdpvd.exe 29 PID 2760 wrote to memory of 2120 2760 lfllxrr.exe 30 PID 2760 wrote to memory of 2120 2760 lfllxrr.exe 30 PID 2760 wrote to memory of 2120 2760 lfllxrr.exe 30 PID 2760 wrote to memory of 2120 2760 lfllxrr.exe 30 PID 2120 wrote to memory of 2684 2120 btthtn.exe 31 PID 2120 wrote to memory of 2684 2120 btthtn.exe 31 PID 2120 wrote to memory of 2684 2120 btthtn.exe 31 PID 2120 wrote to memory of 2684 2120 btthtn.exe 31 PID 2684 wrote to memory of 2888 2684 jpddv.exe 32 PID 2684 wrote to memory of 2888 2684 jpddv.exe 32 PID 2684 wrote to memory of 2888 2684 jpddv.exe 32 PID 2684 wrote to memory of 2888 2684 jpddv.exe 32 PID 2888 wrote to memory of 2648 2888 vddvj.exe 33 PID 2888 wrote to memory of 2648 2888 vddvj.exe 33 PID 2888 wrote to memory of 2648 2888 vddvj.exe 33 PID 2888 wrote to memory of 2648 2888 vddvj.exe 33 PID 2648 wrote to memory of 2600 2648 lrxrlff.exe 34 PID 2648 wrote to memory of 2600 2648 lrxrlff.exe 34 PID 2648 wrote to memory of 2600 2648 lrxrlff.exe 34 PID 2648 wrote to memory of 2600 2648 lrxrlff.exe 34 PID 2600 wrote to memory of 2448 2600 tbttnh.exe 35 PID 2600 wrote to memory of 2448 2600 tbttnh.exe 35 PID 2600 wrote to memory of 2448 2600 tbttnh.exe 35 PID 2600 wrote to memory of 2448 2600 tbttnh.exe 35 PID 2448 wrote to memory of 2732 2448 bthhnn.exe 36 PID 2448 wrote to memory of 2732 2448 bthhnn.exe 36 PID 2448 wrote to memory of 2732 2448 bthhnn.exe 36 PID 2448 wrote to memory of 2732 2448 bthhnn.exe 36 PID 2732 wrote to memory of 2416 2732 dpvjp.exe 37 PID 2732 wrote to memory of 2416 2732 dpvjp.exe 37 PID 2732 wrote to memory of 2416 2732 dpvjp.exe 37 PID 2732 wrote to memory of 2416 2732 dpvjp.exe 37 PID 2416 wrote to memory of 2956 2416 9jddd.exe 38 PID 2416 wrote to memory of 2956 2416 9jddd.exe 38 PID 2416 wrote to memory of 2956 2416 9jddd.exe 38 PID 2416 wrote to memory of 2956 2416 9jddd.exe 38 PID 2956 wrote to memory of 3012 2956 xlxlflf.exe 39 PID 2956 wrote to memory of 3012 2956 xlxlflf.exe 39 PID 2956 wrote to memory of 3012 2956 xlxlflf.exe 39 PID 2956 wrote to memory of 3012 2956 xlxlflf.exe 39 PID 3012 wrote to memory of 2768 3012 xflfxxl.exe 40 PID 3012 wrote to memory of 2768 3012 xflfxxl.exe 40 PID 3012 wrote to memory of 2768 3012 xflfxxl.exe 40 PID 3012 wrote to memory of 2768 3012 xflfxxl.exe 40 PID 2768 wrote to memory of 2780 2768 tnnbtt.exe 41 PID 2768 wrote to memory of 2780 2768 tnnbtt.exe 41 PID 2768 wrote to memory of 2780 2768 tnnbtt.exe 41 PID 2768 wrote to memory of 2780 2768 tnnbtt.exe 41 PID 2780 wrote to memory of 2660 2780 thbnbt.exe 42 PID 2780 wrote to memory of 2660 2780 thbnbt.exe 42 PID 2780 wrote to memory of 2660 2780 thbnbt.exe 42 PID 2780 wrote to memory of 2660 2780 thbnbt.exe 42 PID 2660 wrote to memory of 2652 2660 jvjdd.exe 43 PID 2660 wrote to memory of 2652 2660 jvjdd.exe 43 PID 2660 wrote to memory of 2652 2660 jvjdd.exe 43 PID 2660 wrote to memory of 2652 2660 jvjdd.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae801a344716adec281b492bd7a40520_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ae801a344716adec281b492bd7a40520_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\jdpvd.exec:\jdpvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\lfllxrr.exec:\lfllxrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\btthtn.exec:\btthtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\jpddv.exec:\jpddv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\vddvj.exec:\vddvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\lrxrlff.exec:\lrxrlff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\tbttnh.exec:\tbttnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\bthhnn.exec:\bthhnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\dpvjp.exec:\dpvjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\9jddd.exec:\9jddd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\xlxlflf.exec:\xlxlflf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\xflfxxl.exec:\xflfxxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\tnnbtt.exec:\tnnbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\thbnbt.exec:\thbnbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\jvjdd.exec:\jvjdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\vpjdp.exec:\vpjdp.exe17⤵
- Executes dropped EXE
PID:2652 -
\??\c:\lxllrll.exec:\lxllrll.exe18⤵
- Executes dropped EXE
PID:2820 -
\??\c:\thhhhh.exec:\thhhhh.exe19⤵
- Executes dropped EXE
PID:2000 -
\??\c:\htbhhh.exec:\htbhhh.exe20⤵
- Executes dropped EXE
PID:1244 -
\??\c:\5dppj.exec:\5dppj.exe21⤵
- Executes dropped EXE
PID:1868 -
\??\c:\1ddvv.exec:\1ddvv.exe22⤵
- Executes dropped EXE
PID:2724 -
\??\c:\xflllff.exec:\xflllff.exe23⤵
- Executes dropped EXE
PID:1996 -
\??\c:\xlrlrlf.exec:\xlrlrlf.exe24⤵
- Executes dropped EXE
PID:1152 -
\??\c:\tnhhnh.exec:\tnhhnh.exe25⤵
- Executes dropped EXE
PID:1472 -
\??\c:\vdpjv.exec:\vdpjv.exe26⤵
- Executes dropped EXE
PID:560 -
\??\c:\dpvvv.exec:\dpvvv.exe27⤵
- Executes dropped EXE
PID:952 -
\??\c:\xrxlxlr.exec:\xrxlxlr.exe28⤵
- Executes dropped EXE
PID:1828 -
\??\c:\rxfxrll.exec:\rxfxrll.exe29⤵
- Executes dropped EXE
PID:568 -
\??\c:\bttthh.exec:\bttthh.exe30⤵
- Executes dropped EXE
PID:2212 -
\??\c:\pjdpp.exec:\pjdpp.exe31⤵
- Executes dropped EXE
PID:2292 -
\??\c:\jvddj.exec:\jvddj.exe32⤵
- Executes dropped EXE
PID:1908 -
\??\c:\frxlflr.exec:\frxlflr.exe33⤵
- Executes dropped EXE
PID:2176 -
\??\c:\1rrlfff.exec:\1rrlfff.exe34⤵
- Executes dropped EXE
PID:1952 -
\??\c:\3httnn.exec:\3httnn.exe35⤵
- Executes dropped EXE
PID:2876 -
\??\c:\nbbbnb.exec:\nbbbnb.exe36⤵
- Executes dropped EXE
PID:3052 -
\??\c:\pjvdp.exec:\pjvdp.exe37⤵
- Executes dropped EXE
PID:2760 -
\??\c:\3pvdv.exec:\3pvdv.exe38⤵
- Executes dropped EXE
PID:2644 -
\??\c:\lxllrrr.exec:\lxllrrr.exe39⤵
- Executes dropped EXE
PID:2636 -
\??\c:\9ffrxrx.exec:\9ffrxrx.exe40⤵
- Executes dropped EXE
PID:2584 -
\??\c:\lxrxxrx.exec:\lxrxxrx.exe41⤵
- Executes dropped EXE
PID:1784 -
\??\c:\thnbnn.exec:\thnbnn.exe42⤵
- Executes dropped EXE
PID:2544 -
\??\c:\hthhhb.exec:\hthhhb.exe43⤵
- Executes dropped EXE
PID:2484 -
\??\c:\pdjvd.exec:\pdjvd.exe44⤵
- Executes dropped EXE
PID:2480 -
\??\c:\pdddj.exec:\pdddj.exe45⤵
- Executes dropped EXE
PID:2440 -
\??\c:\frfffxx.exec:\frfffxx.exe46⤵
- Executes dropped EXE
PID:1636 -
\??\c:\3lfffxx.exec:\3lfffxx.exe47⤵
- Executes dropped EXE
PID:2848 -
\??\c:\bnnhtn.exec:\bnnhtn.exe48⤵
- Executes dropped EXE
PID:2864 -
\??\c:\nbhtth.exec:\nbhtth.exe49⤵
- Executes dropped EXE
PID:3028 -
\??\c:\3djpp.exec:\3djpp.exe50⤵
- Executes dropped EXE
PID:1728 -
\??\c:\jvjdd.exec:\jvjdd.exe51⤵
- Executes dropped EXE
PID:1748 -
\??\c:\7lfrxfl.exec:\7lfrxfl.exe52⤵
- Executes dropped EXE
PID:2496 -
\??\c:\xlxllll.exec:\xlxllll.exe53⤵
- Executes dropped EXE
PID:1584 -
\??\c:\btntbb.exec:\btntbb.exe54⤵
- Executes dropped EXE
PID:1280 -
\??\c:\3nbttn.exec:\3nbttn.exe55⤵
- Executes dropped EXE
PID:2680 -
\??\c:\7jdjv.exec:\7jdjv.exe56⤵
- Executes dropped EXE
PID:2816 -
\??\c:\pdppv.exec:\pdppv.exe57⤵
- Executes dropped EXE
PID:1716 -
\??\c:\xrlrxxl.exec:\xrlrxxl.exe58⤵
- Executes dropped EXE
PID:2312 -
\??\c:\9xxxfrx.exec:\9xxxfrx.exe59⤵
- Executes dropped EXE
PID:2796 -
\??\c:\nnnnht.exec:\nnnnht.exe60⤵
- Executes dropped EXE
PID:1868 -
\??\c:\bhntnn.exec:\bhntnn.exe61⤵
- Executes dropped EXE
PID:324 -
\??\c:\vpdjv.exec:\vpdjv.exe62⤵
- Executes dropped EXE
PID:776 -
\??\c:\dpjdv.exec:\dpjdv.exe63⤵
- Executes dropped EXE
PID:596 -
\??\c:\7rffrrr.exec:\7rffrrr.exe64⤵
- Executes dropped EXE
PID:1304 -
\??\c:\lflrllr.exec:\lflrllr.exe65⤵
- Executes dropped EXE
PID:332 -
\??\c:\7btnnn.exec:\7btnnn.exe66⤵PID:1612
-
\??\c:\nbnbbb.exec:\nbnbbb.exe67⤵PID:2288
-
\??\c:\dvjvd.exec:\dvjvd.exe68⤵PID:1816
-
\??\c:\9vjjj.exec:\9vjjj.exe69⤵PID:2252
-
\??\c:\dpjdp.exec:\dpjdp.exe70⤵PID:2256
-
\??\c:\9frrrrx.exec:\9frrrrx.exe71⤵PID:2212
-
\??\c:\5rrxlfl.exec:\5rrxlfl.exe72⤵PID:1712
-
\??\c:\nbnntt.exec:\nbnntt.exe73⤵PID:1160
-
\??\c:\hbtnnh.exec:\hbtnnh.exe74⤵PID:2932
-
\??\c:\dpjpj.exec:\dpjpj.exe75⤵PID:1600
-
\??\c:\dpvpj.exec:\dpvpj.exe76⤵PID:1592
-
\??\c:\frxffff.exec:\frxffff.exe77⤵PID:2936
-
\??\c:\rfrlllx.exec:\rfrlllx.exe78⤵PID:3052
-
\??\c:\9tbttt.exec:\9tbttt.exe79⤵PID:312
-
\??\c:\bthntn.exec:\bthntn.exe80⤵PID:2376
-
\??\c:\vjvvd.exec:\vjvvd.exe81⤵PID:2704
-
\??\c:\jdppd.exec:\jdppd.exe82⤵PID:2584
-
\??\c:\vpvvd.exec:\vpvvd.exe83⤵PID:2692
-
\??\c:\frffxxl.exec:\frffxxl.exe84⤵PID:1916
-
\??\c:\lxxxfxx.exec:\lxxxfxx.exe85⤵PID:2500
-
\??\c:\hthhnn.exec:\hthhnn.exe86⤵PID:2492
-
\??\c:\htbhth.exec:\htbhth.exe87⤵PID:2984
-
\??\c:\jdjpj.exec:\jdjpj.exe88⤵PID:2988
-
\??\c:\jvjpp.exec:\jvjpp.exe89⤵PID:3008
-
\??\c:\lfflxfl.exec:\lfflxfl.exe90⤵PID:1672
-
\??\c:\lxffrlr.exec:\lxffrlr.exe91⤵PID:3036
-
\??\c:\tthnbb.exec:\tthnbb.exe92⤵PID:2116
-
\??\c:\nbhhtn.exec:\nbhhtn.exe93⤵PID:2316
-
\??\c:\9bhhnt.exec:\9bhhnt.exe94⤵PID:2488
-
\??\c:\pddjp.exec:\pddjp.exe95⤵PID:2828
-
\??\c:\1ddpp.exec:\1ddpp.exe96⤵PID:2860
-
\??\c:\ddppv.exec:\ddppv.exe97⤵PID:1732
-
\??\c:\xxrfxfl.exec:\xxrfxfl.exe98⤵PID:2100
-
\??\c:\rlrrfff.exec:\rlrrfff.exe99⤵PID:840
-
\??\c:\bnhbnt.exec:\bnhbnt.exe100⤵PID:2384
-
\??\c:\hbnntt.exec:\hbnntt.exe101⤵PID:2904
-
\??\c:\ppdvj.exec:\ppdvj.exe102⤵PID:536
-
\??\c:\7dvvj.exec:\7dvvj.exe103⤵PID:2056
-
\??\c:\frffffl.exec:\frffffl.exe104⤵PID:1480
-
\??\c:\rfffrll.exec:\rfffrll.exe105⤵PID:1476
-
\??\c:\btnbhh.exec:\btnbhh.exe106⤵PID:1488
-
\??\c:\htbttn.exec:\htbttn.exe107⤵PID:560
-
\??\c:\5vppv.exec:\5vppv.exe108⤵PID:556
-
\??\c:\5pddj.exec:\5pddj.exe109⤵PID:1060
-
\??\c:\1rfflfr.exec:\1rfflfr.exe110⤵PID:900
-
\??\c:\lfflxxr.exec:\lfflxxr.exe111⤵PID:2380
-
\??\c:\htnnnn.exec:\htnnnn.exe112⤵PID:568
-
\??\c:\7htbbb.exec:\7htbbb.exe113⤵PID:1608
-
\??\c:\7jvvv.exec:\7jvvv.exe114⤵PID:2360
-
\??\c:\jdjjv.exec:\jdjjv.exe115⤵PID:2220
-
\??\c:\lxrrlrf.exec:\lxrrlrf.exe116⤵PID:2348
-
\??\c:\7xrxrrl.exec:\7xrxrrl.exe117⤵PID:2616
-
\??\c:\btbbnn.exec:\btbbnn.exe118⤵PID:3048
-
\??\c:\1hhhbh.exec:\1hhhbh.exe119⤵PID:2876
-
\??\c:\ntbhtt.exec:\ntbhtt.exe120⤵PID:2892
-
\??\c:\7vjjv.exec:\7vjjv.exe121⤵PID:2044
-
\??\c:\ddjpv.exec:\ddjpv.exe122⤵PID:2644
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-