Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 20:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
190a1474af89729a306e773f782feb00_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
190a1474af89729a306e773f782feb00_NeikiAnalytics.exe
-
Size
655KB
-
MD5
190a1474af89729a306e773f782feb00
-
SHA1
1a82d81c38809ada2ea36862fd503084d1494c68
-
SHA256
398c30e69449cd9ce77be84dddf3842977789d0eb06a41c4e4258f992be54bf9
-
SHA512
fbb12b630f35ba37eb70be66107df02b8aae0149e96719173fc1bc8711af00ce64ebf73df0c8108b19861c6732be5ed6060811025c202a9a6881bd7afd0533fb
-
SSDEEP
12288:n3C9yMo+S0L9xRnoq7H9xqYL5oeEF5rna9sUxg7udOxPJVSjYg8lcmJ1MZxEkTsU:SgD4bhoqLDqYLS7wv
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/1320-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2052-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2280-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1540-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2112-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1812-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1980-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/772-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1320 lfrrflr.exe 2920 rxxxxrl.exe 2516 vjjjv.exe 2620 flrffll.exe 2052 lrxfrxr.exe 2748 pjjvp.exe 2432 dvvpp.exe 2416 fxxrxfl.exe 2924 xfllxxf.exe 1628 nbhntn.exe 2696 frrlfxl.exe 2720 vdvdv.exe 2280 bthnbn.exe 1892 dvdvv.exe 2312 ttntnb.exe 1540 5ppdd.exe 1680 btnhtt.exe 2840 ppvpv.exe 2220 frxrlrx.exe 2036 xrfffll.exe 2100 hhbtbn.exe 2752 xrxrlfr.exe 3036 ddvvp.exe 2112 hbhbnb.exe 1812 jpddj.exe 1980 nhhnbb.exe 2168 pjjdd.exe 1308 rxxrrlf.exe 2880 xlfrxlf.exe 772 btthtb.exe 1560 pjvvj.exe 880 9xxrlfl.exe 2816 3pdvd.exe 760 rxrrxrf.exe 2008 ffxlllx.exe 3028 nbhbtn.exe 2916 9vjvd.exe 2596 llrxflr.exe 2540 btntbb.exe 2512 ddddd.exe 2768 llrlffx.exe 2732 hbhtbn.exe 2748 jjjjd.exe 2456 flrlrrl.exe 2556 hhbbnh.exe 2436 hbbbtt.exe 2924 vppdj.exe 2688 rlffrxr.exe 2692 pvvvp.exe 2696 vvjvp.exe 764 5fllxfr.exe 1904 bthtnb.exe 2276 pjjdv.exe 2116 fxfxxrl.exe 2284 btbnnt.exe 2340 vjpdp.exe 1428 xrlxllr.exe 628 7thbhb.exe 2108 jdpjj.exe 2264 pjvvp.exe 2784 9lflxlf.exe 1820 tnttbh.exe 824 7dppv.exe 1132 fffrflf.exe -
resource yara_rule behavioral1/memory/2192-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1320-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1540-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2112-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1812-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1980-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/772-292-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2192 wrote to memory of 1320 2192 190a1474af89729a306e773f782feb00_NeikiAnalytics.exe 28 PID 2192 wrote to memory of 1320 2192 190a1474af89729a306e773f782feb00_NeikiAnalytics.exe 28 PID 2192 wrote to memory of 1320 2192 190a1474af89729a306e773f782feb00_NeikiAnalytics.exe 28 PID 2192 wrote to memory of 1320 2192 190a1474af89729a306e773f782feb00_NeikiAnalytics.exe 28 PID 1320 wrote to memory of 2920 1320 lfrrflr.exe 29 PID 1320 wrote to memory of 2920 1320 lfrrflr.exe 29 PID 1320 wrote to memory of 2920 1320 lfrrflr.exe 29 PID 1320 wrote to memory of 2920 1320 lfrrflr.exe 29 PID 2920 wrote to memory of 2516 2920 rxxxxrl.exe 30 PID 2920 wrote to memory of 2516 2920 rxxxxrl.exe 30 PID 2920 wrote to memory of 2516 2920 rxxxxrl.exe 30 PID 2920 wrote to memory of 2516 2920 rxxxxrl.exe 30 PID 2516 wrote to memory of 2620 2516 vjjjv.exe 31 PID 2516 wrote to memory of 2620 2516 vjjjv.exe 31 PID 2516 wrote to memory of 2620 2516 vjjjv.exe 31 PID 2516 wrote to memory of 2620 2516 vjjjv.exe 31 PID 2620 wrote to memory of 2052 2620 flrffll.exe 32 PID 2620 wrote to memory of 2052 2620 flrffll.exe 32 PID 2620 wrote to memory of 2052 2620 flrffll.exe 32 PID 2620 wrote to memory of 2052 2620 flrffll.exe 32 PID 2052 wrote to memory of 2748 2052 lrxfrxr.exe 33 PID 2052 wrote to memory of 2748 2052 lrxfrxr.exe 33 PID 2052 wrote to memory of 2748 2052 lrxfrxr.exe 33 PID 2052 wrote to memory of 2748 2052 lrxfrxr.exe 33 PID 2748 wrote to memory of 2432 2748 pjjvp.exe 34 PID 2748 wrote to memory of 2432 2748 pjjvp.exe 34 PID 2748 wrote to memory of 2432 2748 pjjvp.exe 34 PID 2748 wrote to memory of 2432 2748 pjjvp.exe 34 PID 2432 wrote to memory of 2416 2432 dvvpp.exe 35 PID 2432 wrote to memory of 2416 2432 dvvpp.exe 35 PID 2432 wrote to memory of 2416 2432 dvvpp.exe 35 PID 2432 wrote to memory of 2416 2432 dvvpp.exe 35 PID 2416 wrote to memory of 2924 2416 fxxrxfl.exe 36 PID 2416 wrote to memory of 2924 2416 fxxrxfl.exe 36 PID 2416 wrote to memory of 2924 2416 fxxrxfl.exe 36 PID 2416 wrote to memory of 2924 2416 fxxrxfl.exe 36 PID 2924 wrote to memory of 1628 2924 xfllxxf.exe 37 PID 2924 wrote to memory of 1628 2924 xfllxxf.exe 37 PID 2924 wrote to memory of 1628 2924 xfllxxf.exe 37 PID 2924 wrote to memory of 1628 2924 xfllxxf.exe 37 PID 1628 wrote to memory of 2696 1628 nbhntn.exe 38 PID 1628 wrote to memory of 2696 1628 nbhntn.exe 38 PID 1628 wrote to memory of 2696 1628 nbhntn.exe 38 PID 1628 wrote to memory of 2696 1628 nbhntn.exe 38 PID 2696 wrote to memory of 2720 2696 frrlfxl.exe 39 PID 2696 wrote to memory of 2720 2696 frrlfxl.exe 39 PID 2696 wrote to memory of 2720 2696 frrlfxl.exe 39 PID 2696 wrote to memory of 2720 2696 frrlfxl.exe 39 PID 2720 wrote to memory of 2280 2720 vdvdv.exe 40 PID 2720 wrote to memory of 2280 2720 vdvdv.exe 40 PID 2720 wrote to memory of 2280 2720 vdvdv.exe 40 PID 2720 wrote to memory of 2280 2720 vdvdv.exe 40 PID 2280 wrote to memory of 1892 2280 bthnbn.exe 41 PID 2280 wrote to memory of 1892 2280 bthnbn.exe 41 PID 2280 wrote to memory of 1892 2280 bthnbn.exe 41 PID 2280 wrote to memory of 1892 2280 bthnbn.exe 41 PID 1892 wrote to memory of 2312 1892 dvdvv.exe 42 PID 1892 wrote to memory of 2312 1892 dvdvv.exe 42 PID 1892 wrote to memory of 2312 1892 dvdvv.exe 42 PID 1892 wrote to memory of 2312 1892 dvdvv.exe 42 PID 2312 wrote to memory of 1540 2312 ttntnb.exe 43 PID 2312 wrote to memory of 1540 2312 ttntnb.exe 43 PID 2312 wrote to memory of 1540 2312 ttntnb.exe 43 PID 2312 wrote to memory of 1540 2312 ttntnb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\190a1474af89729a306e773f782feb00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\190a1474af89729a306e773f782feb00_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\lfrrflr.exec:\lfrrflr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\rxxxxrl.exec:\rxxxxrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\vjjjv.exec:\vjjjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\flrffll.exec:\flrffll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\lrxfrxr.exec:\lrxfrxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\pjjvp.exec:\pjjvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\dvvpp.exec:\dvvpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\fxxrxfl.exec:\fxxrxfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\xfllxxf.exec:\xfllxxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\nbhntn.exec:\nbhntn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\frrlfxl.exec:\frrlfxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\vdvdv.exec:\vdvdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\bthnbn.exec:\bthnbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\dvdvv.exec:\dvdvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\ttntnb.exec:\ttntnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\5ppdd.exec:\5ppdd.exe17⤵
- Executes dropped EXE
PID:1540 -
\??\c:\btnhtt.exec:\btnhtt.exe18⤵
- Executes dropped EXE
PID:1680 -
\??\c:\ppvpv.exec:\ppvpv.exe19⤵
- Executes dropped EXE
PID:2840 -
\??\c:\frxrlrx.exec:\frxrlrx.exe20⤵
- Executes dropped EXE
PID:2220 -
\??\c:\xrfffll.exec:\xrfffll.exe21⤵
- Executes dropped EXE
PID:2036 -
\??\c:\hhbtbn.exec:\hhbtbn.exe22⤵
- Executes dropped EXE
PID:2100 -
\??\c:\xrxrlfr.exec:\xrxrlfr.exe23⤵
- Executes dropped EXE
PID:2752 -
\??\c:\ddvvp.exec:\ddvvp.exe24⤵
- Executes dropped EXE
PID:3036 -
\??\c:\hbhbnb.exec:\hbhbnb.exe25⤵
- Executes dropped EXE
PID:2112 -
\??\c:\jpddj.exec:\jpddj.exe26⤵
- Executes dropped EXE
PID:1812 -
\??\c:\nhhnbb.exec:\nhhnbb.exe27⤵
- Executes dropped EXE
PID:1980 -
\??\c:\pjjdd.exec:\pjjdd.exe28⤵
- Executes dropped EXE
PID:2168 -
\??\c:\rxxrrlf.exec:\rxxrrlf.exe29⤵
- Executes dropped EXE
PID:1308 -
\??\c:\xlfrxlf.exec:\xlfrxlf.exe30⤵
- Executes dropped EXE
PID:2880 -
\??\c:\btthtb.exec:\btthtb.exe31⤵
- Executes dropped EXE
PID:772 -
\??\c:\pjvvj.exec:\pjvvj.exe32⤵
- Executes dropped EXE
PID:1560 -
\??\c:\9xxrlfl.exec:\9xxrlfl.exe33⤵
- Executes dropped EXE
PID:880 -
\??\c:\3pdvd.exec:\3pdvd.exe34⤵
- Executes dropped EXE
PID:2816 -
\??\c:\rxrrxrf.exec:\rxrrxrf.exe35⤵
- Executes dropped EXE
PID:760 -
\??\c:\ffxlllx.exec:\ffxlllx.exe36⤵
- Executes dropped EXE
PID:2008 -
\??\c:\nbhbtn.exec:\nbhbtn.exe37⤵
- Executes dropped EXE
PID:3028 -
\??\c:\9vjvd.exec:\9vjvd.exe38⤵
- Executes dropped EXE
PID:2916 -
\??\c:\llrxflr.exec:\llrxflr.exe39⤵
- Executes dropped EXE
PID:2596 -
\??\c:\btntbb.exec:\btntbb.exe40⤵
- Executes dropped EXE
PID:2540 -
\??\c:\ddddd.exec:\ddddd.exe41⤵
- Executes dropped EXE
PID:2512 -
\??\c:\llrlffx.exec:\llrlffx.exe42⤵
- Executes dropped EXE
PID:2768 -
\??\c:\hbhtbn.exec:\hbhtbn.exe43⤵
- Executes dropped EXE
PID:2732 -
\??\c:\jjjjd.exec:\jjjjd.exe44⤵
- Executes dropped EXE
PID:2748 -
\??\c:\flrlrrl.exec:\flrlrrl.exe45⤵
- Executes dropped EXE
PID:2456 -
\??\c:\hhbbnh.exec:\hhbbnh.exe46⤵
- Executes dropped EXE
PID:2556 -
\??\c:\hbbbtt.exec:\hbbbtt.exe47⤵
- Executes dropped EXE
PID:2436 -
\??\c:\vppdj.exec:\vppdj.exe48⤵
- Executes dropped EXE
PID:2924 -
\??\c:\rlffrxr.exec:\rlffrxr.exe49⤵
- Executes dropped EXE
PID:2688 -
\??\c:\pvvvp.exec:\pvvvp.exe50⤵
- Executes dropped EXE
PID:2692 -
\??\c:\vvjvp.exec:\vvjvp.exe51⤵
- Executes dropped EXE
PID:2696 -
\??\c:\5fllxfr.exec:\5fllxfr.exe52⤵
- Executes dropped EXE
PID:764 -
\??\c:\bthtnb.exec:\bthtnb.exe53⤵
- Executes dropped EXE
PID:1904 -
\??\c:\pjjdv.exec:\pjjdv.exe54⤵
- Executes dropped EXE
PID:2276 -
\??\c:\fxfxxrl.exec:\fxfxxrl.exe55⤵
- Executes dropped EXE
PID:2116 -
\??\c:\btbnnt.exec:\btbnnt.exe56⤵
- Executes dropped EXE
PID:2284 -
\??\c:\vjpdp.exec:\vjpdp.exe57⤵
- Executes dropped EXE
PID:2340 -
\??\c:\xrlxllr.exec:\xrlxllr.exe58⤵
- Executes dropped EXE
PID:1428 -
\??\c:\7thbhb.exec:\7thbhb.exe59⤵
- Executes dropped EXE
PID:628 -
\??\c:\jdpjj.exec:\jdpjj.exe60⤵
- Executes dropped EXE
PID:2108 -
\??\c:\pjvvp.exec:\pjvvp.exe61⤵
- Executes dropped EXE
PID:2264 -
\??\c:\9lflxlf.exec:\9lflxlf.exe62⤵
- Executes dropped EXE
PID:2784 -
\??\c:\tnttbh.exec:\tnttbh.exe63⤵
- Executes dropped EXE
PID:1820 -
\??\c:\7dppv.exec:\7dppv.exe64⤵
- Executes dropped EXE
PID:824 -
\??\c:\fffrflf.exec:\fffrflf.exe65⤵
- Executes dropped EXE
PID:1132 -
\??\c:\hhbtth.exec:\hhbtth.exe66⤵PID:2976
-
\??\c:\jpjdj.exec:\jpjdj.exe67⤵PID:2208
-
\??\c:\rflrlrf.exec:\rflrlrf.exe68⤵PID:1356
-
\??\c:\9tbhnb.exec:\9tbhnb.exe69⤵PID:756
-
\??\c:\ppdjd.exec:\ppdjd.exe70⤵PID:900
-
\??\c:\xxfrxxr.exec:\xxfrxxr.exe71⤵PID:3020
-
\??\c:\hhhtnb.exec:\hhhtnb.exe72⤵PID:2888
-
\??\c:\jjpjd.exec:\jjpjd.exe73⤵PID:2936
-
\??\c:\fxxxllx.exec:\fxxxllx.exe74⤵PID:1684
-
\??\c:\rrfrlfl.exec:\rrfrlfl.exe75⤵PID:1560
-
\??\c:\hbhhhh.exec:\hbhhhh.exe76⤵PID:1800
-
\??\c:\vvppj.exec:\vvppj.exe77⤵PID:1600
-
\??\c:\lffrxxf.exec:\lffrxxf.exe78⤵PID:2076
-
\??\c:\1btbnb.exec:\1btbnb.exe79⤵PID:2656
-
\??\c:\vjdvj.exec:\vjdvj.exe80⤵PID:2080
-
\??\c:\xxllffr.exec:\xxllffr.exe81⤵PID:2496
-
\??\c:\3thhbh.exec:\3thhbh.exe82⤵PID:2776
-
\??\c:\vjjdd.exec:\vjjdd.exe83⤵PID:2520
-
\??\c:\djdjp.exec:\djdjp.exe84⤵PID:2628
-
\??\c:\fllrfrl.exec:\fllrfrl.exe85⤵PID:2564
-
\??\c:\hbbtbb.exec:\hbbtbb.exe86⤵PID:2524
-
\??\c:\vjpdp.exec:\vjpdp.exe87⤵PID:2384
-
\??\c:\bthhhn.exec:\bthhhn.exe88⤵PID:2508
-
\??\c:\dvjdp.exec:\dvjdp.exe89⤵PID:2856
-
\??\c:\pddpp.exec:\pddpp.exe90⤵PID:2388
-
\??\c:\1fxxxfx.exec:\1fxxxfx.exe91⤵PID:2664
-
\??\c:\vpvjd.exec:\vpvjd.exe92⤵PID:2668
-
\??\c:\rffrflx.exec:\rffrflx.exe93⤵PID:1920
-
\??\c:\bttbtt.exec:\bttbtt.exe94⤵PID:1236
-
\??\c:\vpjpp.exec:\vpjpp.exe95⤵PID:2268
-
\??\c:\3pvvj.exec:\3pvvj.exe96⤵PID:1908
-
\??\c:\fxrxrlx.exec:\fxrxrlx.exe97⤵PID:320
-
\??\c:\tnnhth.exec:\tnnhth.exe98⤵PID:352
-
\??\c:\ddjdp.exec:\ddjdp.exe99⤵PID:500
-
\??\c:\xrlrxxx.exec:\xrlrxxx.exe100⤵PID:1508
-
\??\c:\3bhbbb.exec:\3bhbbb.exe101⤵PID:1268
-
\??\c:\vpjjd.exec:\vpjjd.exe102⤵PID:2960
-
\??\c:\ddjjp.exec:\ddjjp.exe103⤵PID:1932
-
\??\c:\xrxfrrl.exec:\xrxfrrl.exe104⤵PID:2036
-
\??\c:\bbtnbn.exec:\bbtnbn.exe105⤵PID:2092
-
\??\c:\7dpvv.exec:\7dpvv.exe106⤵PID:608
-
\??\c:\3xxlfxx.exec:\3xxlfxx.exe107⤵PID:1048
-
\??\c:\tnnnbh.exec:\tnnnbh.exe108⤵PID:2352
-
\??\c:\hbnhnt.exec:\hbnhnt.exe109⤵PID:2112
-
\??\c:\dvjjv.exec:\dvjjv.exe110⤵PID:1764
-
\??\c:\fxlrflf.exec:\fxlrflf.exe111⤵PID:1848
-
\??\c:\btbbbh.exec:\btbbbh.exe112⤵PID:1780
-
\??\c:\vdjjv.exec:\vdjjv.exe113⤵PID:1036
-
\??\c:\dvjpv.exec:\dvjpv.exe114⤵PID:2872
-
\??\c:\lllfrxl.exec:\lllfrxl.exe115⤵PID:2992
-
\??\c:\nnntbt.exec:\nnntbt.exe116⤵PID:576
-
\??\c:\vppdv.exec:\vppdv.exe117⤵PID:1304
-
\??\c:\flfxfrf.exec:\flfxfrf.exe118⤵PID:2824
-
\??\c:\thhnhn.exec:\thhnhn.exe119⤵PID:1608
-
\??\c:\jdvdv.exec:\jdvdv.exe120⤵PID:1112
-
\??\c:\pppjd.exec:\pppjd.exe121⤵PID:2176
-
\??\c:\lxllxrx.exec:\lxllxrx.exe122⤵PID:2200
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-