Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 15:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0dd5cfd56bced358eff752d77482d0c0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
0dd5cfd56bced358eff752d77482d0c0_NeikiAnalytics.exe
-
Size
65KB
-
MD5
0dd5cfd56bced358eff752d77482d0c0
-
SHA1
a21e3078aa4ad70d54086a69f91a93905f4422c5
-
SHA256
aa7d71b70f6f3c4a2e3be99394724a3a4c3a7b16cb5ce54913a1aaabb1dbc37f
-
SHA512
5c84b689389182c1bb73095e1c47e96eb76d7e01a3f8a85f0c98edd6fb86bc874ada04e7c87e5674090e858b2467eafa056facce5d3cd3c3c8fd7a24f12ab518
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8+Luvdt:ymb3NkkiQ3mdBjF0yMlu
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/332-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3048-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-65-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2660-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2024-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2392-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1672-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1216-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1700-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1780-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2276-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1336-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/908-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/752-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1752-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3048 tthbhh.exe 2532 vpvdp.exe 2648 frlrxrf.exe 2564 nhbhhn.exe 2660 pdppv.exe 2480 1rllxrx.exe 2456 3nbhtb.exe 2504 bbhnbb.exe 2024 vvpvp.exe 2680 lflfrfx.exe 2800 fxlxflx.exe 2392 1nhnbt.exe 1672 nhntbh.exe 1216 jvjdd.exe 2328 3dvvj.exe 932 7lxxfrx.exe 1700 btnthb.exe 1780 hhnbth.exe 2536 jddjj.exe 2796 pdjjv.exe 2276 rfrlxxr.exe 688 btbbnn.exe 1336 hhhthn.exe 908 9jppj.exe 752 jpdpd.exe 1752 rrfxffr.exe 1136 hhtnth.exe 2268 5htbhh.exe 1980 vpddv.exe 1716 pjddp.exe 2180 lfxfxfr.exe 2056 fxrrflf.exe 2968 bhbnnh.exe 1728 9nhntt.exe 2532 dpddp.exe 2636 jdddd.exe 2724 xrxxlfl.exe 2988 xrfllxf.exe 2760 tntbbb.exe 2664 5tthnh.exe 2552 7djdp.exe 2896 vjpvv.exe 2920 lflxlxf.exe 2424 rxfrfrr.exe 1896 nbhntt.exe 2628 nhnbtt.exe 2184 ntnhhh.exe 2332 jdvjp.exe 2392 dvvjp.exe 1672 rllfffr.exe 1572 xrlflxx.exe 780 bnbbbt.exe 2356 hbbnbt.exe 308 dvvdj.exe 1700 djpvv.exe 2324 fffrlff.exe 1652 1frxffl.exe 2624 htbhhh.exe 2308 tnbhtt.exe 712 pdpjp.exe 488 9fxxffl.exe 3012 rrfrflx.exe 3000 hntnnb.exe 1920 vpddv.exe -
resource yara_rule behavioral1/memory/332-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1216-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1700-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1780-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2276-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1336-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/908-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/752-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-257-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 332 wrote to memory of 3048 332 0dd5cfd56bced358eff752d77482d0c0_NeikiAnalytics.exe 28 PID 332 wrote to memory of 3048 332 0dd5cfd56bced358eff752d77482d0c0_NeikiAnalytics.exe 28 PID 332 wrote to memory of 3048 332 0dd5cfd56bced358eff752d77482d0c0_NeikiAnalytics.exe 28 PID 332 wrote to memory of 3048 332 0dd5cfd56bced358eff752d77482d0c0_NeikiAnalytics.exe 28 PID 3048 wrote to memory of 2532 3048 tthbhh.exe 29 PID 3048 wrote to memory of 2532 3048 tthbhh.exe 29 PID 3048 wrote to memory of 2532 3048 tthbhh.exe 29 PID 3048 wrote to memory of 2532 3048 tthbhh.exe 29 PID 2532 wrote to memory of 2648 2532 vpvdp.exe 30 PID 2532 wrote to memory of 2648 2532 vpvdp.exe 30 PID 2532 wrote to memory of 2648 2532 vpvdp.exe 30 PID 2532 wrote to memory of 2648 2532 vpvdp.exe 30 PID 2648 wrote to memory of 2564 2648 frlrxrf.exe 31 PID 2648 wrote to memory of 2564 2648 frlrxrf.exe 31 PID 2648 wrote to memory of 2564 2648 frlrxrf.exe 31 PID 2648 wrote to memory of 2564 2648 frlrxrf.exe 31 PID 2564 wrote to memory of 2660 2564 nhbhhn.exe 32 PID 2564 wrote to memory of 2660 2564 nhbhhn.exe 32 PID 2564 wrote to memory of 2660 2564 nhbhhn.exe 32 PID 2564 wrote to memory of 2660 2564 nhbhhn.exe 32 PID 2660 wrote to memory of 2480 2660 pdppv.exe 33 PID 2660 wrote to memory of 2480 2660 pdppv.exe 33 PID 2660 wrote to memory of 2480 2660 pdppv.exe 33 PID 2660 wrote to memory of 2480 2660 pdppv.exe 33 PID 2480 wrote to memory of 2456 2480 1rllxrx.exe 34 PID 2480 wrote to memory of 2456 2480 1rllxrx.exe 34 PID 2480 wrote to memory of 2456 2480 1rllxrx.exe 34 PID 2480 wrote to memory of 2456 2480 1rllxrx.exe 34 PID 2456 wrote to memory of 2504 2456 3nbhtb.exe 35 PID 2456 wrote to memory of 2504 2456 3nbhtb.exe 35 PID 2456 wrote to memory of 2504 2456 3nbhtb.exe 35 PID 2456 wrote to memory of 2504 2456 3nbhtb.exe 35 PID 2504 wrote to memory of 2024 2504 bbhnbb.exe 36 PID 2504 wrote to memory of 2024 2504 bbhnbb.exe 36 PID 2504 wrote to memory of 2024 2504 bbhnbb.exe 36 PID 2504 wrote to memory of 2024 2504 bbhnbb.exe 36 PID 2024 wrote to memory of 2680 2024 vvpvp.exe 37 PID 2024 wrote to memory of 2680 2024 vvpvp.exe 37 PID 2024 wrote to memory of 2680 2024 vvpvp.exe 37 PID 2024 wrote to memory of 2680 2024 vvpvp.exe 37 PID 2680 wrote to memory of 2800 2680 lflfrfx.exe 38 PID 2680 wrote to memory of 2800 2680 lflfrfx.exe 38 PID 2680 wrote to memory of 2800 2680 lflfrfx.exe 38 PID 2680 wrote to memory of 2800 2680 lflfrfx.exe 38 PID 2800 wrote to memory of 2392 2800 fxlxflx.exe 39 PID 2800 wrote to memory of 2392 2800 fxlxflx.exe 39 PID 2800 wrote to memory of 2392 2800 fxlxflx.exe 39 PID 2800 wrote to memory of 2392 2800 fxlxflx.exe 39 PID 2392 wrote to memory of 1672 2392 1nhnbt.exe 40 PID 2392 wrote to memory of 1672 2392 1nhnbt.exe 40 PID 2392 wrote to memory of 1672 2392 1nhnbt.exe 40 PID 2392 wrote to memory of 1672 2392 1nhnbt.exe 40 PID 1672 wrote to memory of 1216 1672 nhntbh.exe 41 PID 1672 wrote to memory of 1216 1672 nhntbh.exe 41 PID 1672 wrote to memory of 1216 1672 nhntbh.exe 41 PID 1672 wrote to memory of 1216 1672 nhntbh.exe 41 PID 1216 wrote to memory of 2328 1216 jvjdd.exe 42 PID 1216 wrote to memory of 2328 1216 jvjdd.exe 42 PID 1216 wrote to memory of 2328 1216 jvjdd.exe 42 PID 1216 wrote to memory of 2328 1216 jvjdd.exe 42 PID 2328 wrote to memory of 932 2328 3dvvj.exe 43 PID 2328 wrote to memory of 932 2328 3dvvj.exe 43 PID 2328 wrote to memory of 932 2328 3dvvj.exe 43 PID 2328 wrote to memory of 932 2328 3dvvj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\0dd5cfd56bced358eff752d77482d0c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0dd5cfd56bced358eff752d77482d0c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:332 -
\??\c:\tthbhh.exec:\tthbhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\vpvdp.exec:\vpvdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\frlrxrf.exec:\frlrxrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\nhbhhn.exec:\nhbhhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\pdppv.exec:\pdppv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\1rllxrx.exec:\1rllxrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\3nbhtb.exec:\3nbhtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\bbhnbb.exec:\bbhnbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\vvpvp.exec:\vvpvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\lflfrfx.exec:\lflfrfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\fxlxflx.exec:\fxlxflx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\1nhnbt.exec:\1nhnbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\nhntbh.exec:\nhntbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\jvjdd.exec:\jvjdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\3dvvj.exec:\3dvvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\7lxxfrx.exec:\7lxxfrx.exe17⤵
- Executes dropped EXE
PID:932 -
\??\c:\btnthb.exec:\btnthb.exe18⤵
- Executes dropped EXE
PID:1700 -
\??\c:\hhnbth.exec:\hhnbth.exe19⤵
- Executes dropped EXE
PID:1780 -
\??\c:\jddjj.exec:\jddjj.exe20⤵
- Executes dropped EXE
PID:2536 -
\??\c:\pdjjv.exec:\pdjjv.exe21⤵
- Executes dropped EXE
PID:2796 -
\??\c:\rfrlxxr.exec:\rfrlxxr.exe22⤵
- Executes dropped EXE
PID:2276 -
\??\c:\btbbnn.exec:\btbbnn.exe23⤵
- Executes dropped EXE
PID:688 -
\??\c:\hhhthn.exec:\hhhthn.exe24⤵
- Executes dropped EXE
PID:1336 -
\??\c:\9jppj.exec:\9jppj.exe25⤵
- Executes dropped EXE
PID:908 -
\??\c:\jpdpd.exec:\jpdpd.exe26⤵
- Executes dropped EXE
PID:752 -
\??\c:\rrfxffr.exec:\rrfxffr.exe27⤵
- Executes dropped EXE
PID:1752 -
\??\c:\hhtnth.exec:\hhtnth.exe28⤵
- Executes dropped EXE
PID:1136 -
\??\c:\5htbhh.exec:\5htbhh.exe29⤵
- Executes dropped EXE
PID:2268 -
\??\c:\vpddv.exec:\vpddv.exe30⤵
- Executes dropped EXE
PID:1980 -
\??\c:\pjddp.exec:\pjddp.exe31⤵
- Executes dropped EXE
PID:1716 -
\??\c:\lfxfxfr.exec:\lfxfxfr.exe32⤵
- Executes dropped EXE
PID:2180 -
\??\c:\fxrrflf.exec:\fxrrflf.exe33⤵
- Executes dropped EXE
PID:2056 -
\??\c:\bhbnnh.exec:\bhbnnh.exe34⤵
- Executes dropped EXE
PID:2968 -
\??\c:\9nhntt.exec:\9nhntt.exe35⤵
- Executes dropped EXE
PID:1728 -
\??\c:\dpddp.exec:\dpddp.exe36⤵
- Executes dropped EXE
PID:2532 -
\??\c:\jdddd.exec:\jdddd.exe37⤵
- Executes dropped EXE
PID:2636 -
\??\c:\xrxxlfl.exec:\xrxxlfl.exe38⤵
- Executes dropped EXE
PID:2724 -
\??\c:\xrfllxf.exec:\xrfllxf.exe39⤵
- Executes dropped EXE
PID:2988 -
\??\c:\tntbbb.exec:\tntbbb.exe40⤵
- Executes dropped EXE
PID:2760 -
\??\c:\5tthnh.exec:\5tthnh.exe41⤵
- Executes dropped EXE
PID:2664 -
\??\c:\7djdp.exec:\7djdp.exe42⤵
- Executes dropped EXE
PID:2552 -
\??\c:\vjpvv.exec:\vjpvv.exe43⤵
- Executes dropped EXE
PID:2896 -
\??\c:\lflxlxf.exec:\lflxlxf.exe44⤵
- Executes dropped EXE
PID:2920 -
\??\c:\rxfrfrr.exec:\rxfrfrr.exe45⤵
- Executes dropped EXE
PID:2424 -
\??\c:\nbhntt.exec:\nbhntt.exe46⤵
- Executes dropped EXE
PID:1896 -
\??\c:\nhnbtt.exec:\nhnbtt.exe47⤵
- Executes dropped EXE
PID:2628 -
\??\c:\ntnhhh.exec:\ntnhhh.exe48⤵
- Executes dropped EXE
PID:2184 -
\??\c:\jdvjp.exec:\jdvjp.exe49⤵
- Executes dropped EXE
PID:2332 -
\??\c:\dvvjp.exec:\dvvjp.exe50⤵
- Executes dropped EXE
PID:2392 -
\??\c:\rllfffr.exec:\rllfffr.exe51⤵
- Executes dropped EXE
PID:1672 -
\??\c:\xrlflxx.exec:\xrlflxx.exe52⤵
- Executes dropped EXE
PID:1572 -
\??\c:\bnbbbt.exec:\bnbbbt.exe53⤵
- Executes dropped EXE
PID:780 -
\??\c:\hbbnbt.exec:\hbbnbt.exe54⤵
- Executes dropped EXE
PID:2356 -
\??\c:\dvvdj.exec:\dvvdj.exe55⤵
- Executes dropped EXE
PID:308 -
\??\c:\djpvv.exec:\djpvv.exe56⤵
- Executes dropped EXE
PID:1700 -
\??\c:\fffrlff.exec:\fffrlff.exe57⤵
- Executes dropped EXE
PID:2324 -
\??\c:\1frxffl.exec:\1frxffl.exe58⤵
- Executes dropped EXE
PID:1652 -
\??\c:\htbhhh.exec:\htbhhh.exe59⤵
- Executes dropped EXE
PID:2624 -
\??\c:\tnbhtt.exec:\tnbhtt.exe60⤵
- Executes dropped EXE
PID:2308 -
\??\c:\pdpjp.exec:\pdpjp.exe61⤵
- Executes dropped EXE
PID:712 -
\??\c:\9fxxffl.exec:\9fxxffl.exe62⤵
- Executes dropped EXE
PID:488 -
\??\c:\rrfrflx.exec:\rrfrflx.exe63⤵
- Executes dropped EXE
PID:3012 -
\??\c:\hntnnb.exec:\hntnnb.exe64⤵
- Executes dropped EXE
PID:3000 -
\??\c:\vpddv.exec:\vpddv.exe65⤵
- Executes dropped EXE
PID:1920 -
\??\c:\flxlrrr.exec:\flxlrrr.exe66⤵PID:1952
-
\??\c:\5xxlrrf.exec:\5xxlrrf.exe67⤵PID:1916
-
\??\c:\9btttb.exec:\9btttb.exe68⤵PID:2000
-
\??\c:\htbnhh.exec:\htbnhh.exe69⤵PID:1252
-
\??\c:\bttbbh.exec:\bttbbh.exe70⤵PID:2168
-
\??\c:\9jvvp.exec:\9jvvp.exe71⤵PID:2004
-
\??\c:\5pdpv.exec:\5pdpv.exe72⤵PID:2108
-
\??\c:\lfxxlxf.exec:\lfxxlxf.exe73⤵PID:2520
-
\??\c:\lrrrrfl.exec:\lrrrrfl.exe74⤵PID:2808
-
\??\c:\nhhhhh.exec:\nhhhhh.exe75⤵PID:2568
-
\??\c:\hbtbnn.exec:\hbtbnn.exe76⤵PID:1600
-
\??\c:\vvppv.exec:\vvppv.exe77⤵PID:2912
-
\??\c:\ppvjj.exec:\ppvjj.exe78⤵PID:2584
-
\??\c:\rfxxllr.exec:\rfxxllr.exe79⤵PID:2292
-
\??\c:\5fxlxlr.exec:\5fxlxlr.exe80⤵PID:2788
-
\??\c:\xxfllrx.exec:\xxfllrx.exe81⤵PID:2988
-
\??\c:\thtthb.exec:\thtthb.exe82⤵PID:2576
-
\??\c:\1hbnnt.exec:\1hbnnt.exe83⤵PID:2512
-
\??\c:\jvvvv.exec:\jvvvv.exe84⤵PID:2456
-
\??\c:\3vjvj.exec:\3vjvj.exe85⤵PID:2484
-
\??\c:\rxffrlf.exec:\rxffrlf.exe86⤵PID:2668
-
\??\c:\rfrfrxl.exec:\rfrfrxl.exe87⤵PID:2696
-
\??\c:\9nhhhn.exec:\9nhhhn.exe88⤵PID:2024
-
\??\c:\3tbtbb.exec:\3tbtbb.exe89⤵PID:2752
-
\??\c:\jdjjp.exec:\jdjjp.exe90⤵PID:1820
-
\??\c:\vvpdp.exec:\vvpdp.exe91⤵PID:2040
-
\??\c:\lrxrrxl.exec:\lrxrrxl.exe92⤵PID:2036
-
\??\c:\5frrllx.exec:\5frrllx.exe93⤵PID:1216
-
\??\c:\ffxlxlr.exec:\ffxlxlr.exe94⤵PID:1572
-
\??\c:\tnbbhn.exec:\tnbbhn.exe95⤵PID:2380
-
\??\c:\nhbbhn.exec:\nhbbhn.exe96⤵PID:1604
-
\??\c:\dpddj.exec:\dpddj.exe97⤵PID:1656
-
\??\c:\vjvvd.exec:\vjvvd.exe98⤵PID:2836
-
\??\c:\lfrflxl.exec:\lfrflxl.exe99⤵PID:2960
-
\??\c:\ffxxfxr.exec:\ffxxfxr.exe100⤵PID:1392
-
\??\c:\rfllllr.exec:\rfllllr.exe101⤵PID:2624
-
\??\c:\3bbbhb.exec:\3bbbhb.exe102⤵PID:576
-
\??\c:\hhthtb.exec:\hhthtb.exe103⤵PID:1508
-
\??\c:\pjvpv.exec:\pjvpv.exe104⤵PID:1336
-
\??\c:\1jdpd.exec:\1jdpd.exe105⤵PID:908
-
\??\c:\rfrllrx.exec:\rfrllrx.exe106⤵PID:1104
-
\??\c:\xfrxxfr.exec:\xfrxxfr.exe107⤵PID:1892
-
\??\c:\nhhnnt.exec:\nhhnnt.exe108⤵PID:1376
-
\??\c:\bbnbbh.exec:\bbnbbh.exe109⤵PID:2280
-
\??\c:\nhtbnn.exec:\nhtbnn.exe110⤵PID:1524
-
\??\c:\jdjvj.exec:\jdjvj.exe111⤵PID:1776
-
\??\c:\3vjjp.exec:\3vjjp.exe112⤵PID:1528
-
\??\c:\5rffrrx.exec:\5rffrrx.exe113⤵PID:1304
-
\??\c:\lfxrlrf.exec:\lfxrlrf.exe114⤵PID:2344
-
\??\c:\9xlrffl.exec:\9xlrffl.exe115⤵PID:2544
-
\??\c:\nhnntt.exec:\nhnntt.exe116⤵PID:3040
-
\??\c:\thbbbb.exec:\thbbbb.exe117⤵PID:2716
-
\??\c:\5dddj.exec:\5dddj.exe118⤵PID:2720
-
\??\c:\ddpvj.exec:\ddpvj.exe119⤵PID:2648
-
\??\c:\ddppj.exec:\ddppj.exe120⤵PID:2264
-
\??\c:\lrlxfrf.exec:\lrlxfrf.exe121⤵PID:2616
-
\??\c:\fxxxrfr.exec:\fxxxrfr.exe122⤵PID:2472
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-