Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16/06/2024, 05:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d921263007408c19dfe8e8eb498c8770_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
d921263007408c19dfe8e8eb498c8770_NeikiAnalytics.exe
-
Size
76KB
-
MD5
d921263007408c19dfe8e8eb498c8770
-
SHA1
4ff779d21ed3d2bcd56a2cc06dc4668b241c2715
-
SHA256
36d2d9e232f60f95b26fc4467ff7bca10d2d0e17f12b019e47f8b3a5612aa5ec
-
SHA512
60b37bde778663d8676208a382237cde629a0909950ba7b9a3fa105f9116b5b064cb42a5f2cfc8471feaa367f4819630443bcff884fb0fe6a7ebd03b6341a351
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIrmCeRMKeWqNSZeN:ymb3NkkiQ3mdBjFIjek5VN
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/1688-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-84-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3012-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2868-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/900-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1852-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1524-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1400-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1988-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1724-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/788-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/760-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2072-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2608 dvdvv.exe 2140 lfllrxf.exe 2796 vvvdv.exe 2776 vvjvj.exe 2852 xrxxxfl.exe 2568 nhhbht.exe 2544 nhnntn.exe 3012 vpjjp.exe 1584 1lxllff.exe 2844 rflffxx.exe 2868 7bhhhb.exe 900 nhbhtb.exe 1852 dpjpv.exe 1524 rlrfffr.exe 1528 xlxxfxx.exe 1400 tnttnb.exe 1276 vjdpv.exe 1988 jdvpp.exe 2564 rflrrrx.exe 2504 5frrffl.exe 1724 tnbhnn.exe 696 3ddvj.exe 1084 frfllll.exe 1860 7flrflx.exe 920 bbtbbh.exe 788 7nbtnh.exe 760 1pjdj.exe 1148 dvvpp.exe 2188 xllllll.exe 2072 5fllxrf.exe 2016 5thtnt.exe 2268 dpjpd.exe 1596 fxrfrrf.exe 2216 fxllrlr.exe 2664 nhnntb.exe 2172 tnhntt.exe 2628 ppdjj.exe 2756 pjdjj.exe 2684 frffxxf.exe 2700 1lllllr.exe 2864 nhbhnt.exe 2688 tnnhtb.exe 2600 dvjjp.exe 2784 dvjdj.exe 3004 xrlrrrf.exe 2836 1fxxxxl.exe 2788 hbthnt.exe 2848 bnnbbh.exe 2896 5vjpp.exe 2408 9vpjv.exe 1936 1rffllx.exe 2496 1lrfxxl.exe 2236 nhthth.exe 1052 1dpdp.exe 1384 jdppv.exe 1276 1rllrxf.exe 1292 hbhnnt.exe 2940 9nntht.exe 2948 vjvvj.exe 2504 9vpvv.exe 484 3rlrxfx.exe 1644 fxffrxl.exe 592 hbntbh.exe 1864 thhhnt.exe -
resource yara_rule behavioral1/memory/1688-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1688-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/900-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1852-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1524-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1400-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1988-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1724-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/788-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/760-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-292-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1688 wrote to memory of 2608 1688 d921263007408c19dfe8e8eb498c8770_NeikiAnalytics.exe 28 PID 1688 wrote to memory of 2608 1688 d921263007408c19dfe8e8eb498c8770_NeikiAnalytics.exe 28 PID 1688 wrote to memory of 2608 1688 d921263007408c19dfe8e8eb498c8770_NeikiAnalytics.exe 28 PID 1688 wrote to memory of 2608 1688 d921263007408c19dfe8e8eb498c8770_NeikiAnalytics.exe 28 PID 2608 wrote to memory of 2140 2608 dvdvv.exe 29 PID 2608 wrote to memory of 2140 2608 dvdvv.exe 29 PID 2608 wrote to memory of 2140 2608 dvdvv.exe 29 PID 2608 wrote to memory of 2140 2608 dvdvv.exe 29 PID 2140 wrote to memory of 2796 2140 lfllrxf.exe 30 PID 2140 wrote to memory of 2796 2140 lfllrxf.exe 30 PID 2140 wrote to memory of 2796 2140 lfllrxf.exe 30 PID 2140 wrote to memory of 2796 2140 lfllrxf.exe 30 PID 2796 wrote to memory of 2776 2796 vvvdv.exe 31 PID 2796 wrote to memory of 2776 2796 vvvdv.exe 31 PID 2796 wrote to memory of 2776 2796 vvvdv.exe 31 PID 2796 wrote to memory of 2776 2796 vvvdv.exe 31 PID 2776 wrote to memory of 2852 2776 vvjvj.exe 32 PID 2776 wrote to memory of 2852 2776 vvjvj.exe 32 PID 2776 wrote to memory of 2852 2776 vvjvj.exe 32 PID 2776 wrote to memory of 2852 2776 vvjvj.exe 32 PID 2852 wrote to memory of 2568 2852 xrxxxfl.exe 33 PID 2852 wrote to memory of 2568 2852 xrxxxfl.exe 33 PID 2852 wrote to memory of 2568 2852 xrxxxfl.exe 33 PID 2852 wrote to memory of 2568 2852 xrxxxfl.exe 33 PID 2568 wrote to memory of 2544 2568 nhhbht.exe 34 PID 2568 wrote to memory of 2544 2568 nhhbht.exe 34 PID 2568 wrote to memory of 2544 2568 nhhbht.exe 34 PID 2568 wrote to memory of 2544 2568 nhhbht.exe 34 PID 2544 wrote to memory of 3012 2544 nhnntn.exe 35 PID 2544 wrote to memory of 3012 2544 nhnntn.exe 35 PID 2544 wrote to memory of 3012 2544 nhnntn.exe 35 PID 2544 wrote to memory of 3012 2544 nhnntn.exe 35 PID 3012 wrote to memory of 1584 3012 vpjjp.exe 36 PID 3012 wrote to memory of 1584 3012 vpjjp.exe 36 PID 3012 wrote to memory of 1584 3012 vpjjp.exe 36 PID 3012 wrote to memory of 1584 3012 vpjjp.exe 36 PID 1584 wrote to memory of 2844 1584 1lxllff.exe 37 PID 1584 wrote to memory of 2844 1584 1lxllff.exe 37 PID 1584 wrote to memory of 2844 1584 1lxllff.exe 37 PID 1584 wrote to memory of 2844 1584 1lxllff.exe 37 PID 2844 wrote to memory of 2868 2844 rflffxx.exe 38 PID 2844 wrote to memory of 2868 2844 rflffxx.exe 38 PID 2844 wrote to memory of 2868 2844 rflffxx.exe 38 PID 2844 wrote to memory of 2868 2844 rflffxx.exe 38 PID 2868 wrote to memory of 900 2868 7bhhhb.exe 39 PID 2868 wrote to memory of 900 2868 7bhhhb.exe 39 PID 2868 wrote to memory of 900 2868 7bhhhb.exe 39 PID 2868 wrote to memory of 900 2868 7bhhhb.exe 39 PID 900 wrote to memory of 1852 900 nhbhtb.exe 40 PID 900 wrote to memory of 1852 900 nhbhtb.exe 40 PID 900 wrote to memory of 1852 900 nhbhtb.exe 40 PID 900 wrote to memory of 1852 900 nhbhtb.exe 40 PID 1852 wrote to memory of 1524 1852 dpjpv.exe 41 PID 1852 wrote to memory of 1524 1852 dpjpv.exe 41 PID 1852 wrote to memory of 1524 1852 dpjpv.exe 41 PID 1852 wrote to memory of 1524 1852 dpjpv.exe 41 PID 1524 wrote to memory of 1528 1524 rlrfffr.exe 42 PID 1524 wrote to memory of 1528 1524 rlrfffr.exe 42 PID 1524 wrote to memory of 1528 1524 rlrfffr.exe 42 PID 1524 wrote to memory of 1528 1524 rlrfffr.exe 42 PID 1528 wrote to memory of 1400 1528 xlxxfxx.exe 43 PID 1528 wrote to memory of 1400 1528 xlxxfxx.exe 43 PID 1528 wrote to memory of 1400 1528 xlxxfxx.exe 43 PID 1528 wrote to memory of 1400 1528 xlxxfxx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\d921263007408c19dfe8e8eb498c8770_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d921263007408c19dfe8e8eb498c8770_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\dvdvv.exec:\dvdvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\lfllrxf.exec:\lfllrxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\vvvdv.exec:\vvvdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\vvjvj.exec:\vvjvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\xrxxxfl.exec:\xrxxxfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\nhhbht.exec:\nhhbht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\nhnntn.exec:\nhnntn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\vpjjp.exec:\vpjjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\1lxllff.exec:\1lxllff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\rflffxx.exec:\rflffxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\7bhhhb.exec:\7bhhhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\nhbhtb.exec:\nhbhtb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
\??\c:\dpjpv.exec:\dpjpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\rlrfffr.exec:\rlrfffr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\xlxxfxx.exec:\xlxxfxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\tnttnb.exec:\tnttnb.exe17⤵
- Executes dropped EXE
PID:1400 -
\??\c:\vjdpv.exec:\vjdpv.exe18⤵
- Executes dropped EXE
PID:1276 -
\??\c:\jdvpp.exec:\jdvpp.exe19⤵
- Executes dropped EXE
PID:1988 -
\??\c:\rflrrrx.exec:\rflrrrx.exe20⤵
- Executes dropped EXE
PID:2564 -
\??\c:\5frrffl.exec:\5frrffl.exe21⤵
- Executes dropped EXE
PID:2504 -
\??\c:\tnbhnn.exec:\tnbhnn.exe22⤵
- Executes dropped EXE
PID:1724 -
\??\c:\3ddvj.exec:\3ddvj.exe23⤵
- Executes dropped EXE
PID:696 -
\??\c:\frfllll.exec:\frfllll.exe24⤵
- Executes dropped EXE
PID:1084 -
\??\c:\7flrflx.exec:\7flrflx.exe25⤵
- Executes dropped EXE
PID:1860 -
\??\c:\bbtbbh.exec:\bbtbbh.exe26⤵
- Executes dropped EXE
PID:920 -
\??\c:\7nbtnh.exec:\7nbtnh.exe27⤵
- Executes dropped EXE
PID:788 -
\??\c:\1pjdj.exec:\1pjdj.exe28⤵
- Executes dropped EXE
PID:760 -
\??\c:\dvvpp.exec:\dvvpp.exe29⤵
- Executes dropped EXE
PID:1148 -
\??\c:\xllllll.exec:\xllllll.exe30⤵
- Executes dropped EXE
PID:2188 -
\??\c:\5fllxrf.exec:\5fllxrf.exe31⤵
- Executes dropped EXE
PID:2072 -
\??\c:\5thtnt.exec:\5thtnt.exe32⤵
- Executes dropped EXE
PID:2016 -
\??\c:\dpjpd.exec:\dpjpd.exe33⤵
- Executes dropped EXE
PID:2268 -
\??\c:\fxrfrrf.exec:\fxrfrrf.exe34⤵
- Executes dropped EXE
PID:1596 -
\??\c:\fxllrlr.exec:\fxllrlr.exe35⤵
- Executes dropped EXE
PID:2216 -
\??\c:\nhnntb.exec:\nhnntb.exe36⤵
- Executes dropped EXE
PID:2664 -
\??\c:\tnhntt.exec:\tnhntt.exe37⤵
- Executes dropped EXE
PID:2172 -
\??\c:\ppdjj.exec:\ppdjj.exe38⤵
- Executes dropped EXE
PID:2628 -
\??\c:\pjdjj.exec:\pjdjj.exe39⤵
- Executes dropped EXE
PID:2756 -
\??\c:\frffxxf.exec:\frffxxf.exe40⤵
- Executes dropped EXE
PID:2684 -
\??\c:\1lllllr.exec:\1lllllr.exe41⤵
- Executes dropped EXE
PID:2700 -
\??\c:\nhbhnt.exec:\nhbhnt.exe42⤵
- Executes dropped EXE
PID:2864 -
\??\c:\tnnhtb.exec:\tnnhtb.exe43⤵
- Executes dropped EXE
PID:2688 -
\??\c:\dvjjp.exec:\dvjjp.exe44⤵
- Executes dropped EXE
PID:2600 -
\??\c:\dvjdj.exec:\dvjdj.exe45⤵
- Executes dropped EXE
PID:2784 -
\??\c:\xrlrrrf.exec:\xrlrrrf.exe46⤵
- Executes dropped EXE
PID:3004 -
\??\c:\1fxxxxl.exec:\1fxxxxl.exe47⤵
- Executes dropped EXE
PID:2836 -
\??\c:\hbthnt.exec:\hbthnt.exe48⤵
- Executes dropped EXE
PID:2788 -
\??\c:\bnnbbh.exec:\bnnbbh.exe49⤵
- Executes dropped EXE
PID:2848 -
\??\c:\5vjpp.exec:\5vjpp.exe50⤵
- Executes dropped EXE
PID:2896 -
\??\c:\9vpjv.exec:\9vpjv.exe51⤵
- Executes dropped EXE
PID:2408 -
\??\c:\1rffllx.exec:\1rffllx.exe52⤵
- Executes dropped EXE
PID:1936 -
\??\c:\1lrfxxl.exec:\1lrfxxl.exe53⤵
- Executes dropped EXE
PID:2496 -
\??\c:\nhthth.exec:\nhthth.exe54⤵
- Executes dropped EXE
PID:2236 -
\??\c:\1dpdp.exec:\1dpdp.exe55⤵
- Executes dropped EXE
PID:1052 -
\??\c:\jdppv.exec:\jdppv.exe56⤵
- Executes dropped EXE
PID:1384 -
\??\c:\1rllrxf.exec:\1rllrxf.exe57⤵
- Executes dropped EXE
PID:1276 -
\??\c:\hbhnnt.exec:\hbhnnt.exe58⤵
- Executes dropped EXE
PID:1292 -
\??\c:\9nntht.exec:\9nntht.exe59⤵
- Executes dropped EXE
PID:2940 -
\??\c:\vjvvj.exec:\vjvvj.exe60⤵
- Executes dropped EXE
PID:2948 -
\??\c:\9vpvv.exec:\9vpvv.exe61⤵
- Executes dropped EXE
PID:2504 -
\??\c:\3rlrxfx.exec:\3rlrxfx.exe62⤵
- Executes dropped EXE
PID:484 -
\??\c:\fxffrxl.exec:\fxffrxl.exe63⤵
- Executes dropped EXE
PID:1644 -
\??\c:\hbntbh.exec:\hbntbh.exe64⤵
- Executes dropped EXE
PID:592 -
\??\c:\thhhnt.exec:\thhhnt.exe65⤵
- Executes dropped EXE
PID:1864 -
\??\c:\pjppp.exec:\pjppp.exe66⤵PID:2476
-
\??\c:\ddjpd.exec:\ddjpd.exe67⤵PID:1616
-
\??\c:\xrxrxrx.exec:\xrxrxrx.exe68⤵PID:2968
-
\??\c:\rrflrxf.exec:\rrflrxf.exe69⤵PID:2932
-
\??\c:\nhttbh.exec:\nhttbh.exe70⤵PID:3060
-
\??\c:\nbhnbh.exec:\nbhnbh.exe71⤵PID:2196
-
\??\c:\pjjpp.exec:\pjjpp.exe72⤵PID:1632
-
\??\c:\jdpdp.exec:\jdpdp.exe73⤵PID:2180
-
\??\c:\xrxrxxf.exec:\xrxrxxf.exe74⤵PID:1504
-
\??\c:\rrlxlrl.exec:\rrlxlrl.exe75⤵PID:2032
-
\??\c:\nnbhnt.exec:\nnbhnt.exe76⤵PID:1708
-
\??\c:\ttnbnn.exec:\ttnbnn.exe77⤵PID:2144
-
\??\c:\tnhntb.exec:\tnhntb.exe78⤵PID:2216
-
\??\c:\pjdvd.exec:\pjdvd.exe79⤵PID:2004
-
\??\c:\9rrrllr.exec:\9rrrllr.exe80⤵PID:2172
-
\??\c:\xxxxfrr.exec:\xxxxfrr.exe81⤵PID:2628
-
\??\c:\bbbnbn.exec:\bbbnbn.exe82⤵PID:2756
-
\??\c:\tnhnbb.exec:\tnhnbb.exe83⤵PID:3048
-
\??\c:\ntnhhh.exec:\ntnhhh.exe84⤵PID:2700
-
\??\c:\dpjpj.exec:\dpjpj.exe85⤵PID:2540
-
\??\c:\rlrrxxf.exec:\rlrrxxf.exe86⤵PID:2688
-
\??\c:\3lxxxll.exec:\3lxxxll.exe87⤵PID:3020
-
\??\c:\bntttn.exec:\bntttn.exe88⤵PID:2784
-
\??\c:\hhbhbb.exec:\hhbhbb.exe89⤵PID:1800
-
\??\c:\dvdpj.exec:\dvdpj.exe90⤵PID:2836
-
\??\c:\3dppv.exec:\3dppv.exe91⤵PID:2820
-
\??\c:\pjppv.exec:\pjppv.exe92⤵PID:2848
-
\??\c:\rlrrfxl.exec:\rlrrfxl.exe93⤵PID:2896
-
\??\c:\1rllllf.exec:\1rllllf.exe94⤵PID:2408
-
\??\c:\bnbhnt.exec:\bnbhnt.exe95⤵PID:1936
-
\??\c:\7nbttn.exec:\7nbttn.exe96⤵PID:2496
-
\??\c:\1ppvd.exec:\1ppvd.exe97⤵PID:2236
-
\??\c:\jjdjv.exec:\jjdjv.exe98⤵PID:1052
-
\??\c:\1fxxlrx.exec:\1fxxlrx.exe99⤵PID:1384
-
\??\c:\rlxrxrf.exec:\rlxrxrf.exe100⤵PID:1276
-
\??\c:\bbbthn.exec:\bbbthn.exe101⤵PID:2508
-
\??\c:\nbnhhb.exec:\nbnhhb.exe102⤵PID:2940
-
\??\c:\hhtttt.exec:\hhtttt.exe103⤵PID:2948
-
\??\c:\1jdjj.exec:\1jdjj.exe104⤵PID:2504
-
\??\c:\ddppd.exec:\ddppd.exe105⤵PID:576
-
\??\c:\lxlflfl.exec:\lxlflfl.exe106⤵PID:1644
-
\??\c:\xrxlxfl.exec:\xrxlxfl.exe107⤵PID:1104
-
\??\c:\9bnnhh.exec:\9bnnhh.exe108⤵PID:1864
-
\??\c:\btnthh.exec:\btnthh.exe109⤵PID:1872
-
\??\c:\pjpvp.exec:\pjpvp.exe110⤵PID:816
-
\??\c:\pjdjv.exec:\pjdjv.exe111⤵PID:1976
-
\??\c:\3rllllr.exec:\3rllllr.exe112⤵PID:2932
-
\??\c:\7lfflfl.exec:\7lfflfl.exe113⤵PID:2312
-
\??\c:\nhthhh.exec:\nhthhh.exe114⤵PID:2196
-
\??\c:\9nhntt.exec:\9nhntt.exe115⤵PID:1816
-
\??\c:\1hnntb.exec:\1hnntb.exe116⤵PID:2180
-
\??\c:\pjdjv.exec:\pjdjv.exe117⤵PID:1688
-
\??\c:\pddvv.exec:\pddvv.exe118⤵PID:2032
-
\??\c:\rlffrxl.exec:\rlffrxl.exe119⤵PID:1944
-
\??\c:\9fxfllr.exec:\9fxfllr.exe120⤵PID:2144
-
\??\c:\hbhthh.exec:\hbhthh.exe121⤵PID:2216
-
\??\c:\3bnbtt.exec:\3bnbtt.exe122⤵PID:2004
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-