Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
04/06/2024, 19:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b6ffb41ff2018092ea09d33099504370_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
b6ffb41ff2018092ea09d33099504370_NeikiAnalytics.exe
-
Size
97KB
-
MD5
b6ffb41ff2018092ea09d33099504370
-
SHA1
2dffae3112a34293708cf2eaefe07b595bbbd6bc
-
SHA256
cfc8de022b5f77eb20b8fbdf5776fb37d31502bf9a29880ddf0bc5521f4a1e06
-
SHA512
0550acdcef6c254a7c22e2388ba267e94245bec4947240984cc6080596df82568d87a1d932d925643aafd6b5bc2e53626f5c47dcf87bcd2e82b20ca716c0a069
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxS1rj/2Cn:ymb3NkkiQ3mdBjFo73PYP1lri3K8Gwyg
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/2244-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2868-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2248-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2156-97-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1924-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1456-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2064-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/592-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/664-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/640-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1636-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1692-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/708-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2080-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2248-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2248 xrfrflr.exe 2868 hbthth.exe 2688 tntnbn.exe 2148 vjvjp.exe 2080 rlxfllx.exe 2516 flxfllr.exe 2524 tbntbb.exe 2156 nhnthh.exe 1924 vpjjd.exe 2832 vpddd.exe 708 vjdjp.exe 1692 xxrxlrf.exe 1636 hhhhtt.exe 2708 bnbtbb.exe 640 jdpjp.exe 1456 jdpdj.exe 2864 xxlrxfl.exe 2064 fffflrl.exe 2568 hhtbnt.exe 592 9nhhtb.exe 1248 pdjpd.exe 2908 vpvjd.exe 664 9djvp.exe 1596 llfflrf.exe 2444 xlflrxl.exe 1800 9hbhtt.exe 2120 1tnnbh.exe 1232 dvpjj.exe 3012 vpjjp.exe 892 llflrfr.exe 2392 7frflrf.exe 2388 ttthbb.exe 1704 bbttbn.exe 2620 pdvjp.exe 2736 ddvdv.exe 2744 rlxfxlr.exe 2500 xxlfxxr.exe 2720 1frllxl.exe 2488 dddjp.exe 2764 llrfrrl.exe 2536 ffxlxlx.exe 2360 bntbnn.exe 2496 3xxxllr.exe 1924 nhtbht.exe 1928 btbbbb.exe 2768 1hnbhh.exe 2980 btbbnn.exe 1564 3pddd.exe 1636 vjppd.exe 2560 3vjjp.exe 1408 3xxfrrx.exe 2836 thnnbt.exe 2040 7bnnbt.exe 2452 hthnhh.exe 2052 vvpjp.exe 2016 5jvpv.exe 2876 rlxflrl.exe 2072 rfrxllr.exe 844 bnttbt.exe 2456 9nthhh.exe 664 vpjdp.exe 1596 dpppv.exe 112 rfrlrrr.exe 964 rrfrflf.exe -
resource yara_rule behavioral1/memory/2244-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1456-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/592-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/664-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/640-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1636-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1692-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/708-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2248-15-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2248 2244 b6ffb41ff2018092ea09d33099504370_NeikiAnalytics.exe 28 PID 2244 wrote to memory of 2248 2244 b6ffb41ff2018092ea09d33099504370_NeikiAnalytics.exe 28 PID 2244 wrote to memory of 2248 2244 b6ffb41ff2018092ea09d33099504370_NeikiAnalytics.exe 28 PID 2244 wrote to memory of 2248 2244 b6ffb41ff2018092ea09d33099504370_NeikiAnalytics.exe 28 PID 2248 wrote to memory of 2868 2248 xrfrflr.exe 29 PID 2248 wrote to memory of 2868 2248 xrfrflr.exe 29 PID 2248 wrote to memory of 2868 2248 xrfrflr.exe 29 PID 2248 wrote to memory of 2868 2248 xrfrflr.exe 29 PID 2868 wrote to memory of 2688 2868 hbthth.exe 30 PID 2868 wrote to memory of 2688 2868 hbthth.exe 30 PID 2868 wrote to memory of 2688 2868 hbthth.exe 30 PID 2868 wrote to memory of 2688 2868 hbthth.exe 30 PID 2688 wrote to memory of 2148 2688 tntnbn.exe 31 PID 2688 wrote to memory of 2148 2688 tntnbn.exe 31 PID 2688 wrote to memory of 2148 2688 tntnbn.exe 31 PID 2688 wrote to memory of 2148 2688 tntnbn.exe 31 PID 2148 wrote to memory of 2080 2148 vjvjp.exe 32 PID 2148 wrote to memory of 2080 2148 vjvjp.exe 32 PID 2148 wrote to memory of 2080 2148 vjvjp.exe 32 PID 2148 wrote to memory of 2080 2148 vjvjp.exe 32 PID 2080 wrote to memory of 2516 2080 rlxfllx.exe 33 PID 2080 wrote to memory of 2516 2080 rlxfllx.exe 33 PID 2080 wrote to memory of 2516 2080 rlxfllx.exe 33 PID 2080 wrote to memory of 2516 2080 rlxfllx.exe 33 PID 2516 wrote to memory of 2524 2516 flxfllr.exe 34 PID 2516 wrote to memory of 2524 2516 flxfllr.exe 34 PID 2516 wrote to memory of 2524 2516 flxfllr.exe 34 PID 2516 wrote to memory of 2524 2516 flxfllr.exe 34 PID 2524 wrote to memory of 2156 2524 tbntbb.exe 35 PID 2524 wrote to memory of 2156 2524 tbntbb.exe 35 PID 2524 wrote to memory of 2156 2524 tbntbb.exe 35 PID 2524 wrote to memory of 2156 2524 tbntbb.exe 35 PID 2156 wrote to memory of 1924 2156 nhnthh.exe 36 PID 2156 wrote to memory of 1924 2156 nhnthh.exe 36 PID 2156 wrote to memory of 1924 2156 nhnthh.exe 36 PID 2156 wrote to memory of 1924 2156 nhnthh.exe 36 PID 1924 wrote to memory of 2832 1924 vpjjd.exe 37 PID 1924 wrote to memory of 2832 1924 vpjjd.exe 37 PID 1924 wrote to memory of 2832 1924 vpjjd.exe 37 PID 1924 wrote to memory of 2832 1924 vpjjd.exe 37 PID 2832 wrote to memory of 708 2832 vpddd.exe 38 PID 2832 wrote to memory of 708 2832 vpddd.exe 38 PID 2832 wrote to memory of 708 2832 vpddd.exe 38 PID 2832 wrote to memory of 708 2832 vpddd.exe 38 PID 708 wrote to memory of 1692 708 vjdjp.exe 39 PID 708 wrote to memory of 1692 708 vjdjp.exe 39 PID 708 wrote to memory of 1692 708 vjdjp.exe 39 PID 708 wrote to memory of 1692 708 vjdjp.exe 39 PID 1692 wrote to memory of 1636 1692 xxrxlrf.exe 40 PID 1692 wrote to memory of 1636 1692 xxrxlrf.exe 40 PID 1692 wrote to memory of 1636 1692 xxrxlrf.exe 40 PID 1692 wrote to memory of 1636 1692 xxrxlrf.exe 40 PID 1636 wrote to memory of 2708 1636 hhhhtt.exe 41 PID 1636 wrote to memory of 2708 1636 hhhhtt.exe 41 PID 1636 wrote to memory of 2708 1636 hhhhtt.exe 41 PID 1636 wrote to memory of 2708 1636 hhhhtt.exe 41 PID 2708 wrote to memory of 640 2708 bnbtbb.exe 42 PID 2708 wrote to memory of 640 2708 bnbtbb.exe 42 PID 2708 wrote to memory of 640 2708 bnbtbb.exe 42 PID 2708 wrote to memory of 640 2708 bnbtbb.exe 42 PID 640 wrote to memory of 1456 640 jdpjp.exe 43 PID 640 wrote to memory of 1456 640 jdpjp.exe 43 PID 640 wrote to memory of 1456 640 jdpjp.exe 43 PID 640 wrote to memory of 1456 640 jdpjp.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6ffb41ff2018092ea09d33099504370_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b6ffb41ff2018092ea09d33099504370_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\xrfrflr.exec:\xrfrflr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\hbthth.exec:\hbthth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\tntnbn.exec:\tntnbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\vjvjp.exec:\vjvjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\rlxfllx.exec:\rlxfllx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\flxfllr.exec:\flxfllr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\tbntbb.exec:\tbntbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\nhnthh.exec:\nhnthh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\vpjjd.exec:\vpjjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\vpddd.exec:\vpddd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\vjdjp.exec:\vjdjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
\??\c:\xxrxlrf.exec:\xxrxlrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\hhhhtt.exec:\hhhhtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\bnbtbb.exec:\bnbtbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\jdpjp.exec:\jdpjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\jdpdj.exec:\jdpdj.exe17⤵
- Executes dropped EXE
PID:1456 -
\??\c:\xxlrxfl.exec:\xxlrxfl.exe18⤵
- Executes dropped EXE
PID:2864 -
\??\c:\fffflrl.exec:\fffflrl.exe19⤵
- Executes dropped EXE
PID:2064 -
\??\c:\hhtbnt.exec:\hhtbnt.exe20⤵
- Executes dropped EXE
PID:2568 -
\??\c:\9nhhtb.exec:\9nhhtb.exe21⤵
- Executes dropped EXE
PID:592 -
\??\c:\pdjpd.exec:\pdjpd.exe22⤵
- Executes dropped EXE
PID:1248 -
\??\c:\vpvjd.exec:\vpvjd.exe23⤵
- Executes dropped EXE
PID:2908 -
\??\c:\9djvp.exec:\9djvp.exe24⤵
- Executes dropped EXE
PID:664 -
\??\c:\llfflrf.exec:\llfflrf.exe25⤵
- Executes dropped EXE
PID:1596 -
\??\c:\xlflrxl.exec:\xlflrxl.exe26⤵
- Executes dropped EXE
PID:2444 -
\??\c:\9hbhtt.exec:\9hbhtt.exe27⤵
- Executes dropped EXE
PID:1800 -
\??\c:\1tnnbh.exec:\1tnnbh.exe28⤵
- Executes dropped EXE
PID:2120 -
\??\c:\dvpjj.exec:\dvpjj.exe29⤵
- Executes dropped EXE
PID:1232 -
\??\c:\vpjjp.exec:\vpjjp.exe30⤵
- Executes dropped EXE
PID:3012 -
\??\c:\llflrfr.exec:\llflrfr.exe31⤵
- Executes dropped EXE
PID:892 -
\??\c:\7frflrf.exec:\7frflrf.exe32⤵
- Executes dropped EXE
PID:2392 -
\??\c:\ttthbb.exec:\ttthbb.exe33⤵
- Executes dropped EXE
PID:2388 -
\??\c:\bbttbn.exec:\bbttbn.exe34⤵
- Executes dropped EXE
PID:1704 -
\??\c:\pdvjp.exec:\pdvjp.exe35⤵
- Executes dropped EXE
PID:2620 -
\??\c:\ddvdv.exec:\ddvdv.exe36⤵
- Executes dropped EXE
PID:2736 -
\??\c:\rlxfxlr.exec:\rlxfxlr.exe37⤵
- Executes dropped EXE
PID:2744 -
\??\c:\xxlfxxr.exec:\xxlfxxr.exe38⤵
- Executes dropped EXE
PID:2500 -
\??\c:\1frllxl.exec:\1frllxl.exe39⤵
- Executes dropped EXE
PID:2720 -
\??\c:\dddjp.exec:\dddjp.exe40⤵
- Executes dropped EXE
PID:2488 -
\??\c:\llrfrrl.exec:\llrfrrl.exe41⤵
- Executes dropped EXE
PID:2764 -
\??\c:\ffxlxlx.exec:\ffxlxlx.exe42⤵
- Executes dropped EXE
PID:2536 -
\??\c:\bntbnn.exec:\bntbnn.exe43⤵
- Executes dropped EXE
PID:2360 -
\??\c:\3xxxllr.exec:\3xxxllr.exe44⤵
- Executes dropped EXE
PID:2496 -
\??\c:\nhtbht.exec:\nhtbht.exe45⤵
- Executes dropped EXE
PID:1924 -
\??\c:\btbbbb.exec:\btbbbb.exe46⤵
- Executes dropped EXE
PID:1928 -
\??\c:\1hnbhh.exec:\1hnbhh.exe47⤵
- Executes dropped EXE
PID:2768 -
\??\c:\btbbnn.exec:\btbbnn.exe48⤵
- Executes dropped EXE
PID:2980 -
\??\c:\3pddd.exec:\3pddd.exe49⤵
- Executes dropped EXE
PID:1564 -
\??\c:\vjppd.exec:\vjppd.exe50⤵
- Executes dropped EXE
PID:1636 -
\??\c:\3vjjp.exec:\3vjjp.exe51⤵
- Executes dropped EXE
PID:2560 -
\??\c:\3xxfrrx.exec:\3xxfrrx.exe52⤵
- Executes dropped EXE
PID:1408 -
\??\c:\thnnbt.exec:\thnnbt.exe53⤵
- Executes dropped EXE
PID:2836 -
\??\c:\7bnnbt.exec:\7bnnbt.exe54⤵
- Executes dropped EXE
PID:2040 -
\??\c:\hthnhh.exec:\hthnhh.exe55⤵
- Executes dropped EXE
PID:2452 -
\??\c:\vvpjp.exec:\vvpjp.exe56⤵
- Executes dropped EXE
PID:2052 -
\??\c:\5jvpv.exec:\5jvpv.exe57⤵
- Executes dropped EXE
PID:2016 -
\??\c:\rlxflrl.exec:\rlxflrl.exe58⤵
- Executes dropped EXE
PID:2876 -
\??\c:\rfrxllr.exec:\rfrxllr.exe59⤵
- Executes dropped EXE
PID:2072 -
\??\c:\bnttbt.exec:\bnttbt.exe60⤵
- Executes dropped EXE
PID:844 -
\??\c:\9nthhh.exec:\9nthhh.exe61⤵
- Executes dropped EXE
PID:2456 -
\??\c:\vpjdp.exec:\vpjdp.exe62⤵
- Executes dropped EXE
PID:664 -
\??\c:\dpppv.exec:\dpppv.exe63⤵
- Executes dropped EXE
PID:1596 -
\??\c:\rfrlrrr.exec:\rfrlrrr.exe64⤵
- Executes dropped EXE
PID:112 -
\??\c:\rrfrflf.exec:\rrfrflf.exe65⤵
- Executes dropped EXE
PID:964 -
\??\c:\tbtnht.exec:\tbtnht.exe66⤵PID:1800
-
\??\c:\5hbbbb.exec:\5hbbbb.exe67⤵PID:2284
-
\??\c:\7nbbbb.exec:\7nbbbb.exe68⤵PID:648
-
\??\c:\vpjjp.exec:\vpjjp.exe69⤵PID:2032
-
\??\c:\vjppv.exec:\vjppv.exe70⤵PID:1060
-
\??\c:\rxrrfxr.exec:\rxrrfxr.exe71⤵PID:2000
-
\??\c:\3frrrrx.exec:\3frrrrx.exe72⤵PID:1836
-
\??\c:\3htthn.exec:\3htthn.exe73⤵PID:2612
-
\??\c:\3hnnbb.exec:\3hnnbb.exe74⤵PID:2372
-
\??\c:\djddd.exec:\djddd.exe75⤵PID:1612
-
\??\c:\pdjjv.exec:\pdjjv.exe76⤵PID:2480
-
\??\c:\llfxflx.exec:\llfxflx.exe77⤵PID:1132
-
\??\c:\rrfxrrx.exec:\rrfxrrx.exe78⤵PID:1156
-
\??\c:\9tnthn.exec:\9tnthn.exe79⤵PID:2148
-
\??\c:\hhttbh.exec:\hhttbh.exe80⤵PID:2432
-
\??\c:\nbnthh.exec:\nbnthh.exe81⤵PID:2588
-
\??\c:\1pdpv.exec:\1pdpv.exe82⤵PID:3056
-
\??\c:\pjpvj.exec:\pjpvj.exe83⤵PID:2212
-
\??\c:\rrfrlxf.exec:\rrfrlxf.exe84⤵PID:2824
-
\??\c:\lflrflx.exec:\lflrflx.exe85⤵PID:1944
-
\??\c:\nhtbhh.exec:\nhtbhh.exe86⤵PID:2484
-
\??\c:\ttthnh.exec:\ttthnh.exe87⤵PID:2200
-
\??\c:\tnbtbb.exec:\tnbtbb.exe88⤵PID:2704
-
\??\c:\vppvp.exec:\vppvp.exe89⤵PID:1120
-
\??\c:\llrxrxl.exec:\llrxrxl.exe90⤵PID:2716
-
\??\c:\9lrlxfr.exec:\9lrlxfr.exe91⤵PID:1700
-
\??\c:\rfffrrx.exec:\rfffrrx.exe92⤵PID:1416
-
\??\c:\nhhbhn.exec:\nhhbhn.exe93⤵PID:1932
-
\??\c:\bthhnt.exec:\bthhnt.exe94⤵PID:308
-
\??\c:\dvvvd.exec:\dvvvd.exe95⤵PID:2920
-
\??\c:\jpdpd.exec:\jpdpd.exe96⤵PID:1652
-
\??\c:\9lllxlf.exec:\9lllxlf.exe97⤵PID:536
-
\??\c:\ffflxfl.exec:\ffflxfl.exe98⤵PID:268
-
\??\c:\7thhnn.exec:\7thhnn.exe99⤵PID:1448
-
\??\c:\5bnnhh.exec:\5bnnhh.exe100⤵PID:1512
-
\??\c:\7vppv.exec:\7vppv.exe101⤵PID:2028
-
\??\c:\vjvdj.exec:\vjvdj.exe102⤵PID:1884
-
\??\c:\rfllrrx.exec:\rfllrrx.exe103⤵PID:1164
-
\??\c:\fxrflrf.exec:\fxrflrf.exe104⤵PID:2140
-
\??\c:\1htbbb.exec:\1htbbb.exe105⤵PID:376
-
\??\c:\bthbhn.exec:\bthbhn.exe106⤵PID:2400
-
\??\c:\5htntn.exec:\5htntn.exe107⤵PID:716
-
\??\c:\3jppv.exec:\3jppv.exe108⤵PID:1800
-
\??\c:\dpvpv.exec:\dpvpv.exe109⤵PID:1232
-
\??\c:\rlxxffx.exec:\rlxxffx.exe110⤵PID:2900
-
\??\c:\tbhhhb.exec:\tbhhhb.exe111⤵PID:2960
-
\??\c:\nthhtt.exec:\nthhtt.exe112⤵PID:2244
-
\??\c:\jjvvv.exec:\jjvvv.exe113⤵PID:2392
-
\??\c:\7vvvv.exec:\7vvvv.exe114⤵PID:848
-
\??\c:\frrlffr.exec:\frrlffr.exe115⤵PID:2396
-
\??\c:\xlfrlxl.exec:\xlfrlxl.exe116⤵PID:2624
-
\??\c:\hthtbb.exec:\hthtbb.exe117⤵PID:2684
-
\??\c:\nhnnht.exec:\nhnnht.exe118⤵PID:2736
-
\??\c:\jjjpd.exec:\jjjpd.exe119⤵PID:2744
-
\??\c:\pdpdj.exec:\pdpdj.exe120⤵PID:2500
-
\??\c:\rllxfrr.exec:\rllxfrr.exe121⤵PID:2504
-
\??\c:\rrlrlrx.exec:\rrlrlrx.exe122⤵PID:2548
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-