Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 01:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3ff298c595aff6c51b40ff7e0704b620_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
3ff298c595aff6c51b40ff7e0704b620_NeikiAnalytics.exe
-
Size
414KB
-
MD5
3ff298c595aff6c51b40ff7e0704b620
-
SHA1
194d6dd6ac350cb082e6e9d361e65bc12a7ede7f
-
SHA256
e23d1acf650eb13666a4c98c2a7fbd869e718928672f23e2d5c21ba5993befb9
-
SHA512
eecc2e40295caab0bd690b79980a579097c0ec159c7a688ec13f3670f1f231b12115819f4accec8a9a8f4148062d2e3f60887fb44692dcd54d74e9e01d70896d
-
SSDEEP
12288:n3C9ytvngQj4DtvnV9wLn9UTfC8eieJNBNIsYPU:SgdnJUdnV90
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/1916-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2420-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2968-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2392-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2328-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1432-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/552-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1228-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1128-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1596-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/688-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2008-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2420 nthtbb.exe 2592 rlfllrx.exe 2704 djpvv.exe 2652 tbtthn.exe 2620 rrrxllf.exe 2524 hnthbh.exe 2496 lfxlxlx.exe 2968 vpjjd.exe 348 9hhnhn.exe 2812 3bbbhh.exe 2856 5lrlxfr.exe 1948 3tntth.exe 2392 1rrfrlx.exe 2328 5tntbh.exe 1924 lllxrxx.exe 1432 hnhtnb.exe 2064 frxxfxx.exe 2820 7bhhbh.exe 2904 xrfxrxr.exe 552 7nnhth.exe 1228 xfffllx.exe 2192 tnbnbn.exe 1072 rrfxllx.exe 1128 nnbhnt.exe 2152 jjdjj.exe 1532 lllxrxr.exe 1596 vvvdp.exe 688 frxrlfl.exe 2148 7vdjp.exe 2104 7lfrxfl.exe 2008 ddvpp.exe 1052 rrfflrf.exe 2988 dpvjd.exe 2224 xrlrfrl.exe 2000 3tnbht.exe 2020 9djdv.exe 1384 djdjp.exe 2696 llrxrxx.exe 2692 nnnhtt.exe 2508 jppdp.exe 2536 xrfrxrf.exe 3008 9lxlrxl.exe 2548 tbhnhn.exe 2552 djdpj.exe 2188 3xlfrrx.exe 2980 9hhnhb.exe 2960 tnbhnt.exe 348 vvppv.exe 2848 5xrxffr.exe 1944 ttntht.exe 2160 jvddd.exe 1948 frxllfl.exe 2168 lllrxfr.exe 2396 tnbhtb.exe 1508 3dvvd.exe 1512 lxfxrff.exe 1792 tthnnb.exe 2120 3vvvj.exe 2908 jjdvj.exe 2480 fllxlxx.exe 2052 hnhtht.exe 1484 jpvjj.exe 1228 xxrxlxl.exe 1760 9tthnt.exe -
resource yara_rule behavioral1/memory/1916-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1916-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1432-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/552-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1228-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1128-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1596-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/688-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-303-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1916 wrote to memory of 2420 1916 3ff298c595aff6c51b40ff7e0704b620_NeikiAnalytics.exe 28 PID 1916 wrote to memory of 2420 1916 3ff298c595aff6c51b40ff7e0704b620_NeikiAnalytics.exe 28 PID 1916 wrote to memory of 2420 1916 3ff298c595aff6c51b40ff7e0704b620_NeikiAnalytics.exe 28 PID 1916 wrote to memory of 2420 1916 3ff298c595aff6c51b40ff7e0704b620_NeikiAnalytics.exe 28 PID 2420 wrote to memory of 2592 2420 nthtbb.exe 29 PID 2420 wrote to memory of 2592 2420 nthtbb.exe 29 PID 2420 wrote to memory of 2592 2420 nthtbb.exe 29 PID 2420 wrote to memory of 2592 2420 nthtbb.exe 29 PID 2592 wrote to memory of 2704 2592 rlfllrx.exe 30 PID 2592 wrote to memory of 2704 2592 rlfllrx.exe 30 PID 2592 wrote to memory of 2704 2592 rlfllrx.exe 30 PID 2592 wrote to memory of 2704 2592 rlfllrx.exe 30 PID 2704 wrote to memory of 2652 2704 djpvv.exe 31 PID 2704 wrote to memory of 2652 2704 djpvv.exe 31 PID 2704 wrote to memory of 2652 2704 djpvv.exe 31 PID 2704 wrote to memory of 2652 2704 djpvv.exe 31 PID 2652 wrote to memory of 2620 2652 tbtthn.exe 32 PID 2652 wrote to memory of 2620 2652 tbtthn.exe 32 PID 2652 wrote to memory of 2620 2652 tbtthn.exe 32 PID 2652 wrote to memory of 2620 2652 tbtthn.exe 32 PID 2620 wrote to memory of 2524 2620 rrrxllf.exe 33 PID 2620 wrote to memory of 2524 2620 rrrxllf.exe 33 PID 2620 wrote to memory of 2524 2620 rrrxllf.exe 33 PID 2620 wrote to memory of 2524 2620 rrrxllf.exe 33 PID 2524 wrote to memory of 2496 2524 hnthbh.exe 34 PID 2524 wrote to memory of 2496 2524 hnthbh.exe 34 PID 2524 wrote to memory of 2496 2524 hnthbh.exe 34 PID 2524 wrote to memory of 2496 2524 hnthbh.exe 34 PID 2496 wrote to memory of 2968 2496 lfxlxlx.exe 35 PID 2496 wrote to memory of 2968 2496 lfxlxlx.exe 35 PID 2496 wrote to memory of 2968 2496 lfxlxlx.exe 35 PID 2496 wrote to memory of 2968 2496 lfxlxlx.exe 35 PID 2968 wrote to memory of 348 2968 vpjjd.exe 36 PID 2968 wrote to memory of 348 2968 vpjjd.exe 36 PID 2968 wrote to memory of 348 2968 vpjjd.exe 36 PID 2968 wrote to memory of 348 2968 vpjjd.exe 36 PID 348 wrote to memory of 2812 348 9hhnhn.exe 37 PID 348 wrote to memory of 2812 348 9hhnhn.exe 37 PID 348 wrote to memory of 2812 348 9hhnhn.exe 37 PID 348 wrote to memory of 2812 348 9hhnhn.exe 37 PID 2812 wrote to memory of 2856 2812 3bbbhh.exe 38 PID 2812 wrote to memory of 2856 2812 3bbbhh.exe 38 PID 2812 wrote to memory of 2856 2812 3bbbhh.exe 38 PID 2812 wrote to memory of 2856 2812 3bbbhh.exe 38 PID 2856 wrote to memory of 1948 2856 5lrlxfr.exe 39 PID 2856 wrote to memory of 1948 2856 5lrlxfr.exe 39 PID 2856 wrote to memory of 1948 2856 5lrlxfr.exe 39 PID 2856 wrote to memory of 1948 2856 5lrlxfr.exe 39 PID 1948 wrote to memory of 2392 1948 3tntth.exe 40 PID 1948 wrote to memory of 2392 1948 3tntth.exe 40 PID 1948 wrote to memory of 2392 1948 3tntth.exe 40 PID 1948 wrote to memory of 2392 1948 3tntth.exe 40 PID 2392 wrote to memory of 2328 2392 1rrfrlx.exe 41 PID 2392 wrote to memory of 2328 2392 1rrfrlx.exe 41 PID 2392 wrote to memory of 2328 2392 1rrfrlx.exe 41 PID 2392 wrote to memory of 2328 2392 1rrfrlx.exe 41 PID 2328 wrote to memory of 1924 2328 5tntbh.exe 42 PID 2328 wrote to memory of 1924 2328 5tntbh.exe 42 PID 2328 wrote to memory of 1924 2328 5tntbh.exe 42 PID 2328 wrote to memory of 1924 2328 5tntbh.exe 42 PID 1924 wrote to memory of 1432 1924 lllxrxx.exe 43 PID 1924 wrote to memory of 1432 1924 lllxrxx.exe 43 PID 1924 wrote to memory of 1432 1924 lllxrxx.exe 43 PID 1924 wrote to memory of 1432 1924 lllxrxx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ff298c595aff6c51b40ff7e0704b620_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3ff298c595aff6c51b40ff7e0704b620_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\nthtbb.exec:\nthtbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\rlfllrx.exec:\rlfllrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\djpvv.exec:\djpvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\tbtthn.exec:\tbtthn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\rrrxllf.exec:\rrrxllf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\hnthbh.exec:\hnthbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\lfxlxlx.exec:\lfxlxlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\vpjjd.exec:\vpjjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\9hhnhn.exec:\9hhnhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\3bbbhh.exec:\3bbbhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\5lrlxfr.exec:\5lrlxfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\3tntth.exec:\3tntth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\1rrfrlx.exec:\1rrfrlx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\5tntbh.exec:\5tntbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\lllxrxx.exec:\lllxrxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\hnhtnb.exec:\hnhtnb.exe17⤵
- Executes dropped EXE
PID:1432 -
\??\c:\frxxfxx.exec:\frxxfxx.exe18⤵
- Executes dropped EXE
PID:2064 -
\??\c:\7bhhbh.exec:\7bhhbh.exe19⤵
- Executes dropped EXE
PID:2820 -
\??\c:\xrfxrxr.exec:\xrfxrxr.exe20⤵
- Executes dropped EXE
PID:2904 -
\??\c:\7nnhth.exec:\7nnhth.exe21⤵
- Executes dropped EXE
PID:552 -
\??\c:\xfffllx.exec:\xfffllx.exe22⤵
- Executes dropped EXE
PID:1228 -
\??\c:\tnbnbn.exec:\tnbnbn.exe23⤵
- Executes dropped EXE
PID:2192 -
\??\c:\rrfxllx.exec:\rrfxllx.exe24⤵
- Executes dropped EXE
PID:1072 -
\??\c:\nnbhnt.exec:\nnbhnt.exe25⤵
- Executes dropped EXE
PID:1128 -
\??\c:\jjdjj.exec:\jjdjj.exe26⤵
- Executes dropped EXE
PID:2152 -
\??\c:\lllxrxr.exec:\lllxrxr.exe27⤵
- Executes dropped EXE
PID:1532 -
\??\c:\vvvdp.exec:\vvvdp.exe28⤵
- Executes dropped EXE
PID:1596 -
\??\c:\frxrlfl.exec:\frxrlfl.exe29⤵
- Executes dropped EXE
PID:688 -
\??\c:\7vdjp.exec:\7vdjp.exe30⤵
- Executes dropped EXE
PID:2148 -
\??\c:\7lfrxfl.exec:\7lfrxfl.exe31⤵
- Executes dropped EXE
PID:2104 -
\??\c:\ddvpp.exec:\ddvpp.exe32⤵
- Executes dropped EXE
PID:2008 -
\??\c:\rrfflrf.exec:\rrfflrf.exe33⤵
- Executes dropped EXE
PID:1052 -
\??\c:\dpvjd.exec:\dpvjd.exe34⤵
- Executes dropped EXE
PID:2988 -
\??\c:\xrlrfrl.exec:\xrlrfrl.exe35⤵
- Executes dropped EXE
PID:2224 -
\??\c:\3tnbht.exec:\3tnbht.exe36⤵
- Executes dropped EXE
PID:2000 -
\??\c:\9djdv.exec:\9djdv.exe37⤵
- Executes dropped EXE
PID:2020 -
\??\c:\djdjp.exec:\djdjp.exe38⤵
- Executes dropped EXE
PID:1384 -
\??\c:\llrxrxx.exec:\llrxrxx.exe39⤵
- Executes dropped EXE
PID:2696 -
\??\c:\nnnhtt.exec:\nnnhtt.exe40⤵
- Executes dropped EXE
PID:2692 -
\??\c:\jppdp.exec:\jppdp.exe41⤵
- Executes dropped EXE
PID:2508 -
\??\c:\xrfrxrf.exec:\xrfrxrf.exe42⤵
- Executes dropped EXE
PID:2536 -
\??\c:\9lxlrxl.exec:\9lxlrxl.exe43⤵
- Executes dropped EXE
PID:3008 -
\??\c:\tbhnhn.exec:\tbhnhn.exe44⤵
- Executes dropped EXE
PID:2548 -
\??\c:\djdpj.exec:\djdpj.exe45⤵
- Executes dropped EXE
PID:2552 -
\??\c:\3xlfrrx.exec:\3xlfrrx.exe46⤵
- Executes dropped EXE
PID:2188 -
\??\c:\9hhnhb.exec:\9hhnhb.exe47⤵
- Executes dropped EXE
PID:2980 -
\??\c:\tnbhnt.exec:\tnbhnt.exe48⤵
- Executes dropped EXE
PID:2960 -
\??\c:\vvppv.exec:\vvppv.exe49⤵
- Executes dropped EXE
PID:348 -
\??\c:\5xrxffr.exec:\5xrxffr.exe50⤵
- Executes dropped EXE
PID:2848 -
\??\c:\ttntht.exec:\ttntht.exe51⤵
- Executes dropped EXE
PID:1944 -
\??\c:\jvddd.exec:\jvddd.exe52⤵
- Executes dropped EXE
PID:2160 -
\??\c:\frxllfl.exec:\frxllfl.exe53⤵
- Executes dropped EXE
PID:1948 -
\??\c:\lllrxfr.exec:\lllrxfr.exe54⤵
- Executes dropped EXE
PID:2168 -
\??\c:\tnbhtb.exec:\tnbhtb.exe55⤵
- Executes dropped EXE
PID:2396 -
\??\c:\3dvvd.exec:\3dvvd.exe56⤵
- Executes dropped EXE
PID:1508 -
\??\c:\lxfxrff.exec:\lxfxrff.exe57⤵
- Executes dropped EXE
PID:1512 -
\??\c:\tthnnb.exec:\tthnnb.exe58⤵
- Executes dropped EXE
PID:1792 -
\??\c:\3vvvj.exec:\3vvvj.exe59⤵
- Executes dropped EXE
PID:2120 -
\??\c:\jjdvj.exec:\jjdvj.exe60⤵
- Executes dropped EXE
PID:2908 -
\??\c:\fllxlxx.exec:\fllxlxx.exe61⤵
- Executes dropped EXE
PID:2480 -
\??\c:\hnhtht.exec:\hnhtht.exe62⤵
- Executes dropped EXE
PID:2052 -
\??\c:\jpvjj.exec:\jpvjj.exe63⤵
- Executes dropped EXE
PID:1484 -
\??\c:\xxrxlxl.exec:\xxrxlxl.exe64⤵
- Executes dropped EXE
PID:1228 -
\??\c:\9tthnt.exec:\9tthnt.exe65⤵
- Executes dropped EXE
PID:1760 -
\??\c:\tnhhbb.exec:\tnhhbb.exe66⤵PID:1124
-
\??\c:\pjjvd.exec:\pjjvd.exe67⤵PID:1832
-
\??\c:\llrxlrf.exec:\llrxlrf.exe68⤵PID:988
-
\??\c:\bttbnt.exec:\bttbnt.exe69⤵PID:1536
-
\??\c:\5bttbn.exec:\5bttbn.exe70⤵PID:1980
-
\??\c:\jvvjp.exec:\jvvjp.exe71⤵PID:2916
-
\??\c:\rrlrflf.exec:\rrlrflf.exe72⤵PID:924
-
\??\c:\ttntnn.exec:\ttntnn.exe73⤵PID:1232
-
\??\c:\tnhhnt.exec:\tnhhnt.exe74⤵PID:756
-
\??\c:\pvpvp.exec:\pvpvp.exe75⤵PID:2104
-
\??\c:\lrllxlx.exec:\lrllxlx.exe76⤵PID:1736
-
\??\c:\bbtbnn.exec:\bbtbnn.exe77⤵PID:1748
-
\??\c:\jdvjd.exec:\jdvjd.exe78⤵PID:2428
-
\??\c:\pddpp.exec:\pddpp.exe79⤵PID:1300
-
\??\c:\xrfrflf.exec:\xrfrflf.exe80⤵PID:1680
-
\??\c:\5bttht.exec:\5bttht.exe81⤵PID:1288
-
\??\c:\3dvdj.exec:\3dvdj.exe82⤵PID:2688
-
\??\c:\7pjjd.exec:\7pjjd.exe83⤵PID:2892
-
\??\c:\rrrflxx.exec:\rrrflxx.exe84⤵PID:2884
-
\??\c:\nnnhbh.exec:\nnnhbh.exe85⤵PID:2664
-
\??\c:\jjdjv.exec:\jjdjv.exe86⤵PID:2528
-
\??\c:\rxfrlrl.exec:\rxfrlrl.exe87⤵PID:2676
-
\??\c:\rrxfxxl.exec:\rrxfxxl.exe88⤵PID:2196
-
\??\c:\thnhnh.exec:\thnhnh.exe89⤵PID:2624
-
\??\c:\hhnnht.exec:\hhnnht.exe90⤵PID:2332
-
\??\c:\bnbtbb.exec:\bnbtbb.exe91⤵PID:2716
-
\??\c:\3pjjv.exec:\3pjjv.exe92⤵PID:2804
-
\??\c:\lxflrxl.exec:\lxflrxl.exe93⤵PID:2852
-
\??\c:\9lrfflf.exec:\9lrfflf.exe94⤵PID:1956
-
\??\c:\bbtbhn.exec:\bbtbhn.exe95⤵PID:2236
-
\??\c:\djjdd.exec:\djjdd.exe96⤵PID:1660
-
\??\c:\rrxfxfr.exec:\rrxfxfr.exe97⤵PID:1560
-
\??\c:\hntbth.exec:\hntbth.exe98⤵PID:2488
-
\??\c:\nttbht.exec:\nttbht.exe99⤵PID:1440
-
\??\c:\7djdj.exec:\7djdj.exe100⤵PID:2300
-
\??\c:\1ttbtb.exec:\1ttbtb.exe101⤵PID:1320
-
\??\c:\nhhnhn.exec:\nhhnhn.exe102⤵PID:2084
-
\??\c:\vvdjj.exec:\vvdjj.exe103⤵PID:2912
-
\??\c:\xrxlrrl.exec:\xrxlrrl.exe104⤵PID:1080
-
\??\c:\lfxfxxl.exec:\lfxfxxl.exe105⤵PID:480
-
\??\c:\bhtntn.exec:\bhtntn.exe106⤵PID:568
-
\??\c:\1djvp.exec:\1djvp.exe107⤵PID:2684
-
\??\c:\ffrrrxf.exec:\ffrrrxf.exe108⤵PID:772
-
\??\c:\ttntbn.exec:\ttntbn.exe109⤵PID:2472
-
\??\c:\tbbnhn.exec:\tbbnhn.exe110⤵PID:2024
-
\??\c:\jdvvd.exec:\jdvvd.exe111⤵PID:1764
-
\??\c:\xfxlrfx.exec:\xfxlrfx.exe112⤵PID:1344
-
\??\c:\nhbhnt.exec:\nhbhnt.exe113⤵PID:1852
-
\??\c:\nnhhnt.exec:\nnhhnt.exe114⤵PID:1596
-
\??\c:\vpjpd.exec:\vpjpd.exe115⤵PID:944
-
\??\c:\rrrfxff.exec:\rrrfxff.exe116⤵PID:1936
-
\??\c:\nbthnt.exec:\nbthnt.exe117⤵PID:2924
-
\??\c:\3thtnn.exec:\3thtnn.exe118⤵PID:3000
-
\??\c:\9vpjd.exec:\9vpjd.exe119⤵PID:1732
-
\??\c:\xllfffr.exec:\xllfffr.exe120⤵PID:1656
-
\??\c:\btnthn.exec:\btnthn.exe121⤵PID:2992
-
\??\c:\jvpdj.exec:\jvpdj.exe122⤵PID:2976
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-