Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 05:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
670a366d9c3502226bb44d289bca8280_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
670a366d9c3502226bb44d289bca8280_NeikiAnalytics.exe
-
Size
70KB
-
MD5
670a366d9c3502226bb44d289bca8280
-
SHA1
72588d8b3c4df118caeff8a3534a3f6c407f1146
-
SHA256
33754ec150fe48c025ef07cd0b88cd2ac86218dde1598bf01851bd56d48e160d
-
SHA512
6fdc2b8f792c2581715aaccdb75151f3d812046b4df8a75a1160ecdd7446ba8c0d1ff639886cfd42d6b246cab7d08be5e720f7827963f6656dff1eaf272fc450
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb7tAHEqSCkKWSq:ymb3NkkiQ3mdBjFIynIKq
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2980-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/804-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1928-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-73-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2712-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1048-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3064-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3008-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2488-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2244-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1400-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1184-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1524-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2396-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2040 xlflxlx.exe 804 9nhtnt.exe 2660 7dpdp.exe 2948 lfxllrf.exe 1928 tntbth.exe 2712 5pvpp.exe 1048 5lflxfr.exe 2592 bthnbh.exe 3064 djvdd.exe 2884 xffllrl.exe 3008 1rffxff.exe 760 nbnnnh.exe 608 pjvpj.exe 2488 1rxfrxr.exe 2244 5tnbnt.exe 2848 1nthbh.exe 1400 jdppv.exe 1184 xrxrffx.exe 1524 nntbht.exe 2864 3jpvp.exe 2796 5jpvp.exe 2616 3xxrllx.exe 1152 3tbbbb.exe 824 nnbnht.exe 2396 pvvjj.exe 1352 rlflfxr.exe 1724 3frxllr.exe 556 1ntbht.exe 2928 jvvjp.exe 2128 dvddj.exe 1956 rrxxlxf.exe 1248 tntbtt.exe 1720 7hbhbh.exe 2436 ffxrxlx.exe 2040 5rxlxff.exe 2776 hbbntb.exe 2816 hbtnbn.exe 2936 vjjdp.exe 2788 jddjj.exe 2720 xrllxxr.exe 2540 llfxrfl.exe 2560 thhntt.exe 2684 jddjp.exe 2592 dvvjj.exe 308 9xrllfx.exe 2896 rlxxlxx.exe 2884 bbtthn.exe 2728 vvdpd.exe 864 pdvpp.exe 316 3xxlfrl.exe 2752 xrflrfl.exe 1628 ttbnhb.exe 2748 7tnnht.exe 352 dpvjp.exe 1620 rrrrrfr.exe 2084 llxlrrx.exe 2112 dppvd.exe 2124 ppjvd.exe 2944 9rllfrf.exe 2268 nbnttb.exe 764 hhnntt.exe 1480 vvdvj.exe 1812 dvjpp.exe 824 rxxxrfr.exe -
resource yara_rule behavioral1/memory/2980-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/804-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1928-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1928-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1928-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1928-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1048-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3064-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2244-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1400-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1184-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1524-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-291-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2980 wrote to memory of 2040 2980 670a366d9c3502226bb44d289bca8280_NeikiAnalytics.exe 28 PID 2980 wrote to memory of 2040 2980 670a366d9c3502226bb44d289bca8280_NeikiAnalytics.exe 28 PID 2980 wrote to memory of 2040 2980 670a366d9c3502226bb44d289bca8280_NeikiAnalytics.exe 28 PID 2980 wrote to memory of 2040 2980 670a366d9c3502226bb44d289bca8280_NeikiAnalytics.exe 28 PID 2040 wrote to memory of 804 2040 xlflxlx.exe 29 PID 2040 wrote to memory of 804 2040 xlflxlx.exe 29 PID 2040 wrote to memory of 804 2040 xlflxlx.exe 29 PID 2040 wrote to memory of 804 2040 xlflxlx.exe 29 PID 804 wrote to memory of 2660 804 9nhtnt.exe 30 PID 804 wrote to memory of 2660 804 9nhtnt.exe 30 PID 804 wrote to memory of 2660 804 9nhtnt.exe 30 PID 804 wrote to memory of 2660 804 9nhtnt.exe 30 PID 2660 wrote to memory of 2948 2660 7dpdp.exe 31 PID 2660 wrote to memory of 2948 2660 7dpdp.exe 31 PID 2660 wrote to memory of 2948 2660 7dpdp.exe 31 PID 2660 wrote to memory of 2948 2660 7dpdp.exe 31 PID 2948 wrote to memory of 1928 2948 lfxllrf.exe 32 PID 2948 wrote to memory of 1928 2948 lfxllrf.exe 32 PID 2948 wrote to memory of 1928 2948 lfxllrf.exe 32 PID 2948 wrote to memory of 1928 2948 lfxllrf.exe 32 PID 1928 wrote to memory of 2712 1928 tntbth.exe 33 PID 1928 wrote to memory of 2712 1928 tntbth.exe 33 PID 1928 wrote to memory of 2712 1928 tntbth.exe 33 PID 1928 wrote to memory of 2712 1928 tntbth.exe 33 PID 2712 wrote to memory of 1048 2712 5pvpp.exe 34 PID 2712 wrote to memory of 1048 2712 5pvpp.exe 34 PID 2712 wrote to memory of 1048 2712 5pvpp.exe 34 PID 2712 wrote to memory of 1048 2712 5pvpp.exe 34 PID 1048 wrote to memory of 2592 1048 5lflxfr.exe 35 PID 1048 wrote to memory of 2592 1048 5lflxfr.exe 35 PID 1048 wrote to memory of 2592 1048 5lflxfr.exe 35 PID 1048 wrote to memory of 2592 1048 5lflxfr.exe 35 PID 2592 wrote to memory of 3064 2592 bthnbh.exe 36 PID 2592 wrote to memory of 3064 2592 bthnbh.exe 36 PID 2592 wrote to memory of 3064 2592 bthnbh.exe 36 PID 2592 wrote to memory of 3064 2592 bthnbh.exe 36 PID 3064 wrote to memory of 2884 3064 djvdd.exe 37 PID 3064 wrote to memory of 2884 3064 djvdd.exe 37 PID 3064 wrote to memory of 2884 3064 djvdd.exe 37 PID 3064 wrote to memory of 2884 3064 djvdd.exe 37 PID 2884 wrote to memory of 3008 2884 xffllrl.exe 38 PID 2884 wrote to memory of 3008 2884 xffllrl.exe 38 PID 2884 wrote to memory of 3008 2884 xffllrl.exe 38 PID 2884 wrote to memory of 3008 2884 xffllrl.exe 38 PID 3008 wrote to memory of 760 3008 1rffxff.exe 39 PID 3008 wrote to memory of 760 3008 1rffxff.exe 39 PID 3008 wrote to memory of 760 3008 1rffxff.exe 39 PID 3008 wrote to memory of 760 3008 1rffxff.exe 39 PID 760 wrote to memory of 608 760 nbnnnh.exe 40 PID 760 wrote to memory of 608 760 nbnnnh.exe 40 PID 760 wrote to memory of 608 760 nbnnnh.exe 40 PID 760 wrote to memory of 608 760 nbnnnh.exe 40 PID 608 wrote to memory of 2488 608 pjvpj.exe 41 PID 608 wrote to memory of 2488 608 pjvpj.exe 41 PID 608 wrote to memory of 2488 608 pjvpj.exe 41 PID 608 wrote to memory of 2488 608 pjvpj.exe 41 PID 2488 wrote to memory of 2244 2488 1rxfrxr.exe 42 PID 2488 wrote to memory of 2244 2488 1rxfrxr.exe 42 PID 2488 wrote to memory of 2244 2488 1rxfrxr.exe 42 PID 2488 wrote to memory of 2244 2488 1rxfrxr.exe 42 PID 2244 wrote to memory of 2848 2244 5tnbnt.exe 43 PID 2244 wrote to memory of 2848 2244 5tnbnt.exe 43 PID 2244 wrote to memory of 2848 2244 5tnbnt.exe 43 PID 2244 wrote to memory of 2848 2244 5tnbnt.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\670a366d9c3502226bb44d289bca8280_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\670a366d9c3502226bb44d289bca8280_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\xlflxlx.exec:\xlflxlx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\9nhtnt.exec:\9nhtnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
\??\c:\7dpdp.exec:\7dpdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\lfxllrf.exec:\lfxllrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\tntbth.exec:\tntbth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\5pvpp.exec:\5pvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\5lflxfr.exec:\5lflxfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\bthnbh.exec:\bthnbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\djvdd.exec:\djvdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\xffllrl.exec:\xffllrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\1rffxff.exec:\1rffxff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\nbnnnh.exec:\nbnnnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\pjvpj.exec:\pjvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:608 -
\??\c:\1rxfrxr.exec:\1rxfrxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\5tnbnt.exec:\5tnbnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\1nthbh.exec:\1nthbh.exe17⤵
- Executes dropped EXE
PID:2848 -
\??\c:\jdppv.exec:\jdppv.exe18⤵
- Executes dropped EXE
PID:1400 -
\??\c:\xrxrffx.exec:\xrxrffx.exe19⤵
- Executes dropped EXE
PID:1184 -
\??\c:\nntbht.exec:\nntbht.exe20⤵
- Executes dropped EXE
PID:1524 -
\??\c:\3jpvp.exec:\3jpvp.exe21⤵
- Executes dropped EXE
PID:2864 -
\??\c:\5jpvp.exec:\5jpvp.exe22⤵
- Executes dropped EXE
PID:2796 -
\??\c:\3xxrllx.exec:\3xxrllx.exe23⤵
- Executes dropped EXE
PID:2616 -
\??\c:\3tbbbb.exec:\3tbbbb.exe24⤵
- Executes dropped EXE
PID:1152 -
\??\c:\nnbnht.exec:\nnbnht.exe25⤵
- Executes dropped EXE
PID:824 -
\??\c:\pvvjj.exec:\pvvjj.exe26⤵
- Executes dropped EXE
PID:2396 -
\??\c:\rlflfxr.exec:\rlflfxr.exe27⤵
- Executes dropped EXE
PID:1352 -
\??\c:\3frxllr.exec:\3frxllr.exe28⤵
- Executes dropped EXE
PID:1724 -
\??\c:\1ntbht.exec:\1ntbht.exe29⤵
- Executes dropped EXE
PID:556 -
\??\c:\jvvjp.exec:\jvvjp.exe30⤵
- Executes dropped EXE
PID:2928 -
\??\c:\dvddj.exec:\dvddj.exe31⤵
- Executes dropped EXE
PID:2128 -
\??\c:\rrxxlxf.exec:\rrxxlxf.exe32⤵
- Executes dropped EXE
PID:1956 -
\??\c:\tntbtt.exec:\tntbtt.exe33⤵
- Executes dropped EXE
PID:1248 -
\??\c:\7hbhbh.exec:\7hbhbh.exe34⤵
- Executes dropped EXE
PID:1720 -
\??\c:\dpdjj.exec:\dpdjj.exe35⤵PID:2600
-
\??\c:\ffxrxlx.exec:\ffxrxlx.exe36⤵
- Executes dropped EXE
PID:2436 -
\??\c:\5rxlxff.exec:\5rxlxff.exe37⤵
- Executes dropped EXE
PID:2040 -
\??\c:\hbbntb.exec:\hbbntb.exe38⤵
- Executes dropped EXE
PID:2776 -
\??\c:\hbtnbn.exec:\hbtnbn.exe39⤵
- Executes dropped EXE
PID:2816 -
\??\c:\vjjdp.exec:\vjjdp.exe40⤵
- Executes dropped EXE
PID:2936 -
\??\c:\jddjj.exec:\jddjj.exe41⤵
- Executes dropped EXE
PID:2788 -
\??\c:\xrllxxr.exec:\xrllxxr.exe42⤵
- Executes dropped EXE
PID:2720 -
\??\c:\llfxrfl.exec:\llfxrfl.exe43⤵
- Executes dropped EXE
PID:2540 -
\??\c:\thhntt.exec:\thhntt.exe44⤵
- Executes dropped EXE
PID:2560 -
\??\c:\jddjp.exec:\jddjp.exe45⤵
- Executes dropped EXE
PID:2684 -
\??\c:\dvvjj.exec:\dvvjj.exe46⤵
- Executes dropped EXE
PID:2592 -
\??\c:\9xrllfx.exec:\9xrllfx.exe47⤵
- Executes dropped EXE
PID:308 -
\??\c:\rlxxlxx.exec:\rlxxlxx.exe48⤵
- Executes dropped EXE
PID:2896 -
\??\c:\bbtthn.exec:\bbtthn.exe49⤵
- Executes dropped EXE
PID:2884 -
\??\c:\vvdpd.exec:\vvdpd.exe50⤵
- Executes dropped EXE
PID:2728 -
\??\c:\pdvpp.exec:\pdvpp.exe51⤵
- Executes dropped EXE
PID:864 -
\??\c:\3xxlfrl.exec:\3xxlfrl.exe52⤵
- Executes dropped EXE
PID:316 -
\??\c:\xrflrfl.exec:\xrflrfl.exe53⤵
- Executes dropped EXE
PID:2752 -
\??\c:\ttbnhb.exec:\ttbnhb.exe54⤵
- Executes dropped EXE
PID:1628 -
\??\c:\7tnnht.exec:\7tnnht.exe55⤵
- Executes dropped EXE
PID:2748 -
\??\c:\dpvjp.exec:\dpvjp.exe56⤵
- Executes dropped EXE
PID:352 -
\??\c:\rrrrrfr.exec:\rrrrrfr.exe57⤵
- Executes dropped EXE
PID:1620 -
\??\c:\llxlrrx.exec:\llxlrrx.exe58⤵
- Executes dropped EXE
PID:2084 -
\??\c:\dppvd.exec:\dppvd.exe59⤵
- Executes dropped EXE
PID:2112 -
\??\c:\ppjvd.exec:\ppjvd.exe60⤵
- Executes dropped EXE
PID:2124 -
\??\c:\9rllfrf.exec:\9rllfrf.exe61⤵
- Executes dropped EXE
PID:2944 -
\??\c:\nbnttb.exec:\nbnttb.exe62⤵
- Executes dropped EXE
PID:2268 -
\??\c:\hhnntt.exec:\hhnntt.exe63⤵
- Executes dropped EXE
PID:764 -
\??\c:\vvdvj.exec:\vvdvj.exe64⤵
- Executes dropped EXE
PID:1480 -
\??\c:\dvjpp.exec:\dvjpp.exe65⤵
- Executes dropped EXE
PID:1812 -
\??\c:\rxxxrfr.exec:\rxxxrfr.exe66⤵
- Executes dropped EXE
PID:824 -
\??\c:\rfxrrfx.exec:\rfxrrfx.exe67⤵PID:1544
-
\??\c:\ttbnnh.exec:\ttbnnh.exe68⤵PID:1624
-
\??\c:\jpjpj.exec:\jpjpj.exe69⤵PID:2496
-
\??\c:\dvjpv.exec:\dvjpv.exe70⤵PID:1724
-
\??\c:\xxrxlrf.exec:\xxrxlrf.exe71⤵PID:840
-
\??\c:\7xfxfxl.exec:\7xfxfxl.exe72⤵PID:1056
-
\??\c:\btbhhn.exec:\btbhhn.exe73⤵PID:2428
-
\??\c:\vpjpd.exec:\vpjpd.exe74⤵PID:2208
-
\??\c:\5jjvd.exec:\5jjvd.exe75⤵PID:1228
-
\??\c:\xlxflxl.exec:\xlxflxl.exe76⤵PID:2980
-
\??\c:\rxfxrxr.exec:\rxfxrxr.exe77⤵PID:1612
-
\??\c:\3bbhnt.exec:\3bbhnt.exe78⤵PID:2836
-
\??\c:\nnnhhn.exec:\nnnhhn.exe79⤵PID:804
-
\??\c:\3vjpv.exec:\3vjpv.exe80⤵PID:1276
-
\??\c:\vdvjd.exec:\vdvjd.exe81⤵PID:2644
-
\??\c:\xrffrxl.exec:\xrffrxl.exe82⤵PID:2640
-
\??\c:\xlrxrrl.exec:\xlrxrrl.exe83⤵PID:2828
-
\??\c:\3htnhb.exec:\3htnhb.exe84⤵PID:2020
-
\??\c:\dvpdp.exec:\dvpdp.exe85⤵PID:2688
-
\??\c:\3vddv.exec:\3vddv.exe86⤵PID:2532
-
\??\c:\fxfflxl.exec:\fxfflxl.exe87⤵PID:3020
-
\??\c:\3frxxfl.exec:\3frxxfl.exe88⤵PID:2332
-
\??\c:\bnhnnt.exec:\bnhnnt.exe89⤵PID:2880
-
\??\c:\jdjpj.exec:\jdjpj.exe90⤵PID:2920
-
\??\c:\vvpdp.exec:\vvpdp.exe91⤵PID:3044
-
\??\c:\flrxllx.exec:\flrxllx.exe92⤵PID:2716
-
\??\c:\rxlxxff.exec:\rxlxxff.exe93⤵PID:1916
-
\??\c:\hbbhbh.exec:\hbbhbh.exe94⤵PID:1688
-
\??\c:\ttthbh.exec:\ttthbh.exe95⤵PID:1860
-
\??\c:\ddvjd.exec:\ddvjd.exe96⤵PID:1808
-
\??\c:\9vjjp.exec:\9vjjp.exe97⤵PID:2244
-
\??\c:\rrfllxf.exec:\rrfllxf.exe98⤵PID:2080
-
\??\c:\rflrfxf.exec:\rflrfxf.exe99⤵PID:620
-
\??\c:\hbbthn.exec:\hbbthn.exe100⤵PID:1620
-
\??\c:\hbnhnt.exec:\hbnhnt.exe101⤵PID:2120
-
\??\c:\1vjdd.exec:\1vjdd.exe102⤵PID:1696
-
\??\c:\3jdpj.exec:\3jdpj.exe103⤵PID:2116
-
\??\c:\xrrffrx.exec:\xrrffrx.exe104⤵PID:776
-
\??\c:\lfrrxfx.exec:\lfrrxfx.exe105⤵PID:668
-
\??\c:\thnnnb.exec:\thnnnb.exe106⤵PID:1484
-
\??\c:\tnbbhn.exec:\tnbbhn.exe107⤵PID:628
-
\??\c:\pdjdd.exec:\pdjdd.exe108⤵PID:1836
-
\??\c:\dvvdv.exec:\dvvdv.exe109⤵PID:932
-
\??\c:\jddpp.exec:\jddpp.exe110⤵PID:1668
-
\??\c:\frrrrrr.exec:\frrrrrr.exe111⤵PID:2032
-
\??\c:\9xfrxfx.exec:\9xfrxfx.exe112⤵PID:1236
-
\??\c:\thttbh.exec:\thttbh.exe113⤵PID:2480
-
\??\c:\ntbtbb.exec:\ntbtbb.exe114⤵PID:2928
-
\??\c:\jdvjj.exec:\jdvjj.exe115⤵PID:1372
-
\??\c:\7pppd.exec:\7pppd.exe116⤵PID:1952
-
\??\c:\fxrrxfr.exec:\fxrrxfr.exe117⤵PID:2996
-
\??\c:\9ffrrrl.exec:\9ffrrrl.exe118⤵PID:2068
-
\??\c:\5bbhht.exec:\5bbhht.exe119⤵PID:2600
-
\??\c:\hbntnn.exec:\hbntnn.exe120⤵PID:2052
-
\??\c:\vppdj.exec:\vppdj.exe121⤵PID:2608
-
\??\c:\dvvjv.exec:\dvvjv.exe122⤵PID:2260
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-