Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
01/06/2024, 09:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b11991e13c7b7b28ed3b568d318014f0_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
b11991e13c7b7b28ed3b568d318014f0_NeikiAnalytics.exe
-
Size
232KB
-
MD5
b11991e13c7b7b28ed3b568d318014f0
-
SHA1
d37bd1564bc1d29b1fe683972e9be87ba369553e
-
SHA256
3a299c4f7b9693a6560484d21875b532071e1a37aab920d6841c747ea33b1a7e
-
SHA512
9ac71d08031f70338c949fcceb663933fb126c8f7cf54279f40a88ce3c6e7af3080e49dc5f0f07c6217b3e158e3745cda8b97eb593138e60fed611d3c83e7abc
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo7LAIRUohTF/SjSrbzLAuBjfwFOmoFzMvUpGqC5n+H:n3C9BRo/AIuuFSjA8uBjwI7FjpjC5+H
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/3036-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2044-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2888-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2092-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2352-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/292-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1752-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2304-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/624-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/928-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2956-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/352-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2288-309-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2888 1ppjp.exe 2044 1xllffr.exe 2748 nhbbhn.exe 2092 rfllrrr.exe 2856 frxrfxr.exe 2380 jjjvd.exe 2128 vjjjv.exe 2300 hhhnht.exe 2124 djdpv.exe 2612 7rlrflx.exe 2352 thnhtt.exe 292 9vdjv.exe 1752 lfxfxrl.exe 2700 bbtbnt.exe 2304 vvpvj.exe 1244 1fxlrrf.exe 2792 bthhth.exe 540 jvjpv.exe 2360 3xlrffl.exe 3068 bhhhtt.exe 580 ppvpv.exe 624 xxflxfr.exe 796 hhtbhn.exe 928 vvjpd.exe 2956 jvvdp.exe 1700 xrfrffx.exe 2064 jvpjj.exe 2852 9lffrrx.exe 352 xxxlxfr.exe 276 bbtnnb.exe 2288 bthtnt.exe 3036 ddjvp.exe 2556 llfxrxl.exe 2528 9fflxfx.exe 3064 nnbhnb.exe 2576 jjvjv.exe 2384 dvjpp.exe 2908 rrllxlx.exe 2540 hthntt.exe 2100 nnttnt.exe 2372 dvpdj.exe 2448 frffffr.exe 1676 lrfxrfl.exe 2348 nbhnbb.exe 1476 vvjdp.exe 1748 3fxfrfr.exe 2612 fxffrxf.exe 2664 btbnhn.exe 640 7nnbnt.exe 1904 ddjvd.exe 1752 lfrfllr.exe 2700 3rlxlrx.exe 1324 nhtntb.exe 2304 dpjpp.exe 2688 rrlrflx.exe 2696 7fxlffl.exe 684 5nbbnt.exe 1980 htnttn.exe 896 ddpdp.exe 1316 1xflrrf.exe 580 flxlxlr.exe 624 hbtntn.exe 820 jvdjd.exe 2004 1jddj.exe -
resource yara_rule behavioral1/memory/3036-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2352-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/292-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/624-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/928-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2956-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/352-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-309-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3036 wrote to memory of 2888 3036 b11991e13c7b7b28ed3b568d318014f0_NeikiAnalytics.exe 28 PID 3036 wrote to memory of 2888 3036 b11991e13c7b7b28ed3b568d318014f0_NeikiAnalytics.exe 28 PID 3036 wrote to memory of 2888 3036 b11991e13c7b7b28ed3b568d318014f0_NeikiAnalytics.exe 28 PID 3036 wrote to memory of 2888 3036 b11991e13c7b7b28ed3b568d318014f0_NeikiAnalytics.exe 28 PID 2888 wrote to memory of 2044 2888 1ppjp.exe 29 PID 2888 wrote to memory of 2044 2888 1ppjp.exe 29 PID 2888 wrote to memory of 2044 2888 1ppjp.exe 29 PID 2888 wrote to memory of 2044 2888 1ppjp.exe 29 PID 2044 wrote to memory of 2748 2044 1xllffr.exe 30 PID 2044 wrote to memory of 2748 2044 1xllffr.exe 30 PID 2044 wrote to memory of 2748 2044 1xllffr.exe 30 PID 2044 wrote to memory of 2748 2044 1xllffr.exe 30 PID 2748 wrote to memory of 2092 2748 nhbbhn.exe 31 PID 2748 wrote to memory of 2092 2748 nhbbhn.exe 31 PID 2748 wrote to memory of 2092 2748 nhbbhn.exe 31 PID 2748 wrote to memory of 2092 2748 nhbbhn.exe 31 PID 2092 wrote to memory of 2856 2092 rfllrrr.exe 32 PID 2092 wrote to memory of 2856 2092 rfllrrr.exe 32 PID 2092 wrote to memory of 2856 2092 rfllrrr.exe 32 PID 2092 wrote to memory of 2856 2092 rfllrrr.exe 32 PID 2856 wrote to memory of 2380 2856 frxrfxr.exe 33 PID 2856 wrote to memory of 2380 2856 frxrfxr.exe 33 PID 2856 wrote to memory of 2380 2856 frxrfxr.exe 33 PID 2856 wrote to memory of 2380 2856 frxrfxr.exe 33 PID 2380 wrote to memory of 2128 2380 jjjvd.exe 34 PID 2380 wrote to memory of 2128 2380 jjjvd.exe 34 PID 2380 wrote to memory of 2128 2380 jjjvd.exe 34 PID 2380 wrote to memory of 2128 2380 jjjvd.exe 34 PID 2128 wrote to memory of 2300 2128 vjjjv.exe 35 PID 2128 wrote to memory of 2300 2128 vjjjv.exe 35 PID 2128 wrote to memory of 2300 2128 vjjjv.exe 35 PID 2128 wrote to memory of 2300 2128 vjjjv.exe 35 PID 2300 wrote to memory of 2124 2300 hhhnht.exe 36 PID 2300 wrote to memory of 2124 2300 hhhnht.exe 36 PID 2300 wrote to memory of 2124 2300 hhhnht.exe 36 PID 2300 wrote to memory of 2124 2300 hhhnht.exe 36 PID 2124 wrote to memory of 2612 2124 djdpv.exe 37 PID 2124 wrote to memory of 2612 2124 djdpv.exe 37 PID 2124 wrote to memory of 2612 2124 djdpv.exe 37 PID 2124 wrote to memory of 2612 2124 djdpv.exe 37 PID 2612 wrote to memory of 2352 2612 7rlrflx.exe 38 PID 2612 wrote to memory of 2352 2612 7rlrflx.exe 38 PID 2612 wrote to memory of 2352 2612 7rlrflx.exe 38 PID 2612 wrote to memory of 2352 2612 7rlrflx.exe 38 PID 2352 wrote to memory of 292 2352 thnhtt.exe 39 PID 2352 wrote to memory of 292 2352 thnhtt.exe 39 PID 2352 wrote to memory of 292 2352 thnhtt.exe 39 PID 2352 wrote to memory of 292 2352 thnhtt.exe 39 PID 292 wrote to memory of 1752 292 9vdjv.exe 40 PID 292 wrote to memory of 1752 292 9vdjv.exe 40 PID 292 wrote to memory of 1752 292 9vdjv.exe 40 PID 292 wrote to memory of 1752 292 9vdjv.exe 40 PID 1752 wrote to memory of 2700 1752 lfxfxrl.exe 41 PID 1752 wrote to memory of 2700 1752 lfxfxrl.exe 41 PID 1752 wrote to memory of 2700 1752 lfxfxrl.exe 41 PID 1752 wrote to memory of 2700 1752 lfxfxrl.exe 41 PID 2700 wrote to memory of 2304 2700 bbtbnt.exe 42 PID 2700 wrote to memory of 2304 2700 bbtbnt.exe 42 PID 2700 wrote to memory of 2304 2700 bbtbnt.exe 42 PID 2700 wrote to memory of 2304 2700 bbtbnt.exe 42 PID 2304 wrote to memory of 1244 2304 vvpvj.exe 43 PID 2304 wrote to memory of 1244 2304 vvpvj.exe 43 PID 2304 wrote to memory of 1244 2304 vvpvj.exe 43 PID 2304 wrote to memory of 1244 2304 vvpvj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\b11991e13c7b7b28ed3b568d318014f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b11991e13c7b7b28ed3b568d318014f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\1ppjp.exec:\1ppjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\1xllffr.exec:\1xllffr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\nhbbhn.exec:\nhbbhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\rfllrrr.exec:\rfllrrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\frxrfxr.exec:\frxrfxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\jjjvd.exec:\jjjvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\vjjjv.exec:\vjjjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\hhhnht.exec:\hhhnht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\djdpv.exec:\djdpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\7rlrflx.exec:\7rlrflx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\thnhtt.exec:\thnhtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\9vdjv.exec:\9vdjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:292 -
\??\c:\lfxfxrl.exec:\lfxfxrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\bbtbnt.exec:\bbtbnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\vvpvj.exec:\vvpvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\1fxlrrf.exec:\1fxlrrf.exe17⤵
- Executes dropped EXE
PID:1244 -
\??\c:\bthhth.exec:\bthhth.exe18⤵
- Executes dropped EXE
PID:2792 -
\??\c:\jvjpv.exec:\jvjpv.exe19⤵
- Executes dropped EXE
PID:540 -
\??\c:\3xlrffl.exec:\3xlrffl.exe20⤵
- Executes dropped EXE
PID:2360 -
\??\c:\bhhhtt.exec:\bhhhtt.exe21⤵
- Executes dropped EXE
PID:3068 -
\??\c:\ppvpv.exec:\ppvpv.exe22⤵
- Executes dropped EXE
PID:580 -
\??\c:\xxflxfr.exec:\xxflxfr.exe23⤵
- Executes dropped EXE
PID:624 -
\??\c:\hhtbhn.exec:\hhtbhn.exe24⤵
- Executes dropped EXE
PID:796 -
\??\c:\vvjpd.exec:\vvjpd.exe25⤵
- Executes dropped EXE
PID:928 -
\??\c:\jvvdp.exec:\jvvdp.exe26⤵
- Executes dropped EXE
PID:2956 -
\??\c:\xrfrffx.exec:\xrfrffx.exe27⤵
- Executes dropped EXE
PID:1700 -
\??\c:\jvpjj.exec:\jvpjj.exe28⤵
- Executes dropped EXE
PID:2064 -
\??\c:\9lffrrx.exec:\9lffrrx.exe29⤵
- Executes dropped EXE
PID:2852 -
\??\c:\xxxlxfr.exec:\xxxlxfr.exe30⤵
- Executes dropped EXE
PID:352 -
\??\c:\bbtnnb.exec:\bbtnnb.exe31⤵
- Executes dropped EXE
PID:276 -
\??\c:\bthtnt.exec:\bthtnt.exe32⤵
- Executes dropped EXE
PID:2288 -
\??\c:\ddjvp.exec:\ddjvp.exe33⤵
- Executes dropped EXE
PID:3036 -
\??\c:\llfxrxl.exec:\llfxrxl.exe34⤵
- Executes dropped EXE
PID:2556 -
\??\c:\9fflxfx.exec:\9fflxfx.exe35⤵
- Executes dropped EXE
PID:2528 -
\??\c:\nnbhnb.exec:\nnbhnb.exe36⤵
- Executes dropped EXE
PID:3064 -
\??\c:\jjvjv.exec:\jjvjv.exe37⤵
- Executes dropped EXE
PID:2576 -
\??\c:\dvjpp.exec:\dvjpp.exe38⤵
- Executes dropped EXE
PID:2384 -
\??\c:\rrllxlx.exec:\rrllxlx.exe39⤵
- Executes dropped EXE
PID:2908 -
\??\c:\hthntt.exec:\hthntt.exe40⤵
- Executes dropped EXE
PID:2540 -
\??\c:\nnttnt.exec:\nnttnt.exe41⤵
- Executes dropped EXE
PID:2100 -
\??\c:\dvpdj.exec:\dvpdj.exe42⤵
- Executes dropped EXE
PID:2372 -
\??\c:\frffffr.exec:\frffffr.exe43⤵
- Executes dropped EXE
PID:2448 -
\??\c:\lrfxrfl.exec:\lrfxrfl.exe44⤵
- Executes dropped EXE
PID:1676 -
\??\c:\nbhnbb.exec:\nbhnbb.exe45⤵
- Executes dropped EXE
PID:2348 -
\??\c:\vvjdp.exec:\vvjdp.exe46⤵
- Executes dropped EXE
PID:1476 -
\??\c:\3fxfrfr.exec:\3fxfrfr.exe47⤵
- Executes dropped EXE
PID:1748 -
\??\c:\fxffrxf.exec:\fxffrxf.exe48⤵
- Executes dropped EXE
PID:2612 -
\??\c:\btbnhn.exec:\btbnhn.exe49⤵
- Executes dropped EXE
PID:2664 -
\??\c:\7nnbnt.exec:\7nnbnt.exe50⤵
- Executes dropped EXE
PID:640 -
\??\c:\ddjvd.exec:\ddjvd.exe51⤵
- Executes dropped EXE
PID:1904 -
\??\c:\lfrfllr.exec:\lfrfllr.exe52⤵
- Executes dropped EXE
PID:1752 -
\??\c:\3rlxlrx.exec:\3rlxlrx.exe53⤵
- Executes dropped EXE
PID:2700 -
\??\c:\nhtntb.exec:\nhtntb.exe54⤵
- Executes dropped EXE
PID:1324 -
\??\c:\dpjpp.exec:\dpjpp.exe55⤵
- Executes dropped EXE
PID:2304 -
\??\c:\rrlrflx.exec:\rrlrflx.exe56⤵
- Executes dropped EXE
PID:2688 -
\??\c:\7fxlffl.exec:\7fxlffl.exe57⤵
- Executes dropped EXE
PID:2696 -
\??\c:\5nbbnt.exec:\5nbbnt.exe58⤵
- Executes dropped EXE
PID:684 -
\??\c:\htnttn.exec:\htnttn.exe59⤵
- Executes dropped EXE
PID:1980 -
\??\c:\ddpdp.exec:\ddpdp.exe60⤵
- Executes dropped EXE
PID:896 -
\??\c:\1xflrrf.exec:\1xflrrf.exe61⤵
- Executes dropped EXE
PID:1316 -
\??\c:\flxlxlr.exec:\flxlxlr.exe62⤵
- Executes dropped EXE
PID:580 -
\??\c:\hbtntn.exec:\hbtntn.exe63⤵
- Executes dropped EXE
PID:624 -
\??\c:\jvdjd.exec:\jvdjd.exe64⤵
- Executes dropped EXE
PID:820 -
\??\c:\1jddj.exec:\1jddj.exe65⤵
- Executes dropped EXE
PID:2004 -
\??\c:\rrlxfxr.exec:\rrlxfxr.exe66⤵PID:2076
-
\??\c:\fxxxfxf.exec:\fxxxfxf.exe67⤵PID:2956
-
\??\c:\7tntbh.exec:\7tntbh.exe68⤵PID:2636
-
\??\c:\3vpdj.exec:\3vpdj.exe69⤵PID:2836
-
\??\c:\rlflfll.exec:\rlflfll.exe70⤵PID:860
-
\??\c:\rxlffxr.exec:\rxlffxr.exe71⤵PID:2084
-
\??\c:\hbnnhb.exec:\hbnnhb.exe72⤵PID:2780
-
\??\c:\dddvj.exec:\dddvj.exe73⤵PID:1932
-
\??\c:\pdjjj.exec:\pdjjj.exe74⤵PID:2468
-
\??\c:\fflxfxf.exec:\fflxfxf.exe75⤵PID:2944
-
\??\c:\rfrrxxx.exec:\rfrrxxx.exe76⤵PID:3012
-
\??\c:\bntbhh.exec:\bntbhh.exe77⤵PID:2044
-
\??\c:\tntbnh.exec:\tntbnh.exe78⤵PID:2740
-
\??\c:\jdpvv.exec:\jdpvv.exe79⤵PID:2560
-
\??\c:\1rfxlfr.exec:\1rfxlfr.exe80⤵PID:2736
-
\??\c:\rrflfrf.exec:\rrflfrf.exe81⤵PID:2544
-
\??\c:\nhnbbn.exec:\nhnbbn.exe82⤵PID:2584
-
\??\c:\tnhnbh.exec:\tnhnbh.exe83⤵PID:2156
-
\??\c:\ddpvd.exec:\ddpvd.exe84⤵PID:2808
-
\??\c:\1rllxxr.exec:\1rllxxr.exe85⤵PID:2452
-
\??\c:\xlrrfxf.exec:\xlrrfxf.exe86⤵PID:280
-
\??\c:\nbhhhb.exec:\nbhhhb.exe87⤵PID:1188
-
\??\c:\jdpvj.exec:\jdpvj.exe88⤵PID:2436
-
\??\c:\1vjpd.exec:\1vjpd.exe89⤵PID:1788
-
\??\c:\xxfflxl.exec:\xxfflxl.exe90⤵PID:1564
-
\??\c:\rrfrffr.exec:\rrfrffr.exe91⤵PID:2284
-
\??\c:\tntbbb.exec:\tntbbb.exe92⤵PID:1680
-
\??\c:\btbhhn.exec:\btbhhn.exe93⤵PID:356
-
\??\c:\jdpvd.exec:\jdpvd.exe94⤵PID:1544
-
\??\c:\xlxlrxx.exec:\xlxlrxx.exe95⤵PID:340
-
\??\c:\llxffrr.exec:\llxffrr.exe96⤵PID:1040
-
\??\c:\3nbthn.exec:\3nbthn.exe97⤵PID:2416
-
\??\c:\vpdvj.exec:\vpdvj.exe98⤵PID:2588
-
\??\c:\pddpv.exec:\pddpv.exe99⤵PID:1968
-
\??\c:\rlllxxx.exec:\rlllxxx.exe100⤵PID:2464
-
\??\c:\3hnbbb.exec:\3hnbbb.exe101⤵PID:324
-
\??\c:\3nhnbb.exec:\3nhnbb.exe102⤵PID:604
-
\??\c:\dpvvv.exec:\dpvvv.exe103⤵PID:2768
-
\??\c:\vpvvj.exec:\vpvvj.exe104⤵PID:2892
-
\??\c:\xrxflrx.exec:\xrxflrx.exe105⤵PID:1104
-
\??\c:\9tbhnh.exec:\9tbhnh.exe106⤵PID:1284
-
\??\c:\thntbt.exec:\thntbt.exe107⤵PID:2104
-
\??\c:\vppvj.exec:\vppvj.exe108⤵PID:1268
-
\??\c:\xxfxxrx.exec:\xxfxxrx.exe109⤵PID:924
-
\??\c:\fxrxlxf.exec:\fxrxlxf.exe110⤵PID:2060
-
\??\c:\btbhnh.exec:\btbhnh.exe111⤵PID:2840
-
\??\c:\9vpvj.exec:\9vpvj.exe112⤵PID:2232
-
\??\c:\3vjdv.exec:\3vjdv.exe113⤵PID:3004
-
\??\c:\fxrrxxr.exec:\fxrrxxr.exe114⤵PID:2340
-
\??\c:\xlrrlfl.exec:\xlrrlfl.exe115⤵PID:2148
-
\??\c:\htbhtt.exec:\htbhtt.exe116⤵PID:3052
-
\??\c:\5tbnhh.exec:\5tbnhh.exe117⤵PID:1504
-
\??\c:\5dppp.exec:\5dppp.exe118⤵PID:2556
-
\??\c:\1rxrlll.exec:\1rxrlll.exe119⤵PID:2564
-
\??\c:\xlrxlrr.exec:\xlrxlrr.exe120⤵PID:2532
-
\??\c:\bntntn.exec:\bntntn.exe121⤵PID:2568
-
\??\c:\5nhhhh.exec:\5nhhhh.exe122⤵PID:2512
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-