Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17/05/2024, 16:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ef08ab8fa9b6c767f1a1f8006c42f110_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
ef08ab8fa9b6c767f1a1f8006c42f110_NeikiAnalytics.exe
-
Size
492KB
-
MD5
ef08ab8fa9b6c767f1a1f8006c42f110
-
SHA1
430558510a4ed473e1b52572e52ae2beaaac8de0
-
SHA256
7efc8c5773b8996353453ab9cb02746dd3a4300fb0f897623c7fc50453f7ff0c
-
SHA512
801c0b09a031d06f83b2e7a5b09c27718e3929b9ff1e2f6295c413439b7531d7c6c31fc1f7dcf286c1aaa2102cfeadd8706f0d5a57c04aa75c3d1634e2038a00
-
SSDEEP
6144:n3C9BRo7MlrWKo+lS0Le4xRSAoq78yoyfx93svqTbWL5wEpOQ9DRRv:n3C9yMo+S0L9xRnoq7H9QYcmeN9DX
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/1724-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2244-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/268-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-309-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2208-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2224-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2320-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1936-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1280-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/284-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2788 ddvvv.exe 2732 bnhhbh.exe 2600 7jvdp.exe 2648 rrfrlrf.exe 2616 lrlrlrf.exe 2500 7xffrrx.exe 2624 nnttbh.exe 2696 pjddj.exe 2708 1vvvd.exe 2824 9llfrlf.exe 284 1vjpd.exe 1620 flfxxrx.exe 824 5rllrfr.exe 2512 ppjjp.exe 2412 lrlxlrf.exe 1468 1nhbhh.exe 1280 vvppd.exe 1936 rxxlfrx.exe 2244 1tbhnt.exe 268 5jvvd.exe 584 llxrrrf.exe 1792 nnttnb.exe 2320 pjvvd.exe 2224 7flfrxx.exe 2892 lffxffx.exe 1220 bnnhhn.exe 2208 rffrlll.exe 1784 ntnthn.exe 1680 vdjpd.exe 1616 xrrfllf.exe 2096 1bntbh.exe 1724 pdppd.exe 3064 1lxfffl.exe 2788 hhbhbn.exe 2596 jdpvd.exe 2456 llxlxfr.exe 2632 tnbhnt.exe 2896 pjvdj.exe 2776 dvppv.exe 2616 ffxlfxr.exe 2472 btnbht.exe 2980 djjpj.exe 2720 ddvdp.exe 2792 3xfllrf.exe 2508 xrrrffr.exe 1912 5hbthh.exe 1564 jppvj.exe 1908 lfrlxxl.exe 1620 xfrrxfr.exe 312 tnttbt.exe 1436 nnhthh.exe 776 ddppv.exe 2412 rfrllff.exe 2128 fxrrxrf.exe 2400 9thtnn.exe 1852 7pjpd.exe 604 9xrrffr.exe 1432 xxxfrxr.exe 1756 ttnbhn.exe 1740 1vvjv.exe 2288 jjjpd.exe 412 fxflrxf.exe 2228 hntttn.exe 928 5nbbtt.exe -
resource yara_rule behavioral1/memory/1724-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2244-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/268-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-309-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2224-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2320-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1936-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1280-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/284-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-27-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1724 wrote to memory of 2788 1724 ef08ab8fa9b6c767f1a1f8006c42f110_NeikiAnalytics.exe 61 PID 1724 wrote to memory of 2788 1724 ef08ab8fa9b6c767f1a1f8006c42f110_NeikiAnalytics.exe 61 PID 1724 wrote to memory of 2788 1724 ef08ab8fa9b6c767f1a1f8006c42f110_NeikiAnalytics.exe 61 PID 1724 wrote to memory of 2788 1724 ef08ab8fa9b6c767f1a1f8006c42f110_NeikiAnalytics.exe 61 PID 2788 wrote to memory of 2732 2788 ddvvv.exe 29 PID 2788 wrote to memory of 2732 2788 ddvvv.exe 29 PID 2788 wrote to memory of 2732 2788 ddvvv.exe 29 PID 2788 wrote to memory of 2732 2788 ddvvv.exe 29 PID 2732 wrote to memory of 2600 2732 bnhhbh.exe 30 PID 2732 wrote to memory of 2600 2732 bnhhbh.exe 30 PID 2732 wrote to memory of 2600 2732 bnhhbh.exe 30 PID 2732 wrote to memory of 2600 2732 bnhhbh.exe 30 PID 2600 wrote to memory of 2648 2600 7jvdp.exe 31 PID 2600 wrote to memory of 2648 2600 7jvdp.exe 31 PID 2600 wrote to memory of 2648 2600 7jvdp.exe 31 PID 2600 wrote to memory of 2648 2600 7jvdp.exe 31 PID 2648 wrote to memory of 2616 2648 rrfrlrf.exe 67 PID 2648 wrote to memory of 2616 2648 rrfrlrf.exe 67 PID 2648 wrote to memory of 2616 2648 rrfrlrf.exe 67 PID 2648 wrote to memory of 2616 2648 rrfrlrf.exe 67 PID 2616 wrote to memory of 2500 2616 lrlrlrf.exe 109 PID 2616 wrote to memory of 2500 2616 lrlrlrf.exe 109 PID 2616 wrote to memory of 2500 2616 lrlrlrf.exe 109 PID 2616 wrote to memory of 2500 2616 lrlrlrf.exe 109 PID 2500 wrote to memory of 2624 2500 7xffrrx.exe 34 PID 2500 wrote to memory of 2624 2500 7xffrrx.exe 34 PID 2500 wrote to memory of 2624 2500 7xffrrx.exe 34 PID 2500 wrote to memory of 2624 2500 7xffrrx.exe 34 PID 2624 wrote to memory of 2696 2624 nnttbh.exe 35 PID 2624 wrote to memory of 2696 2624 nnttbh.exe 35 PID 2624 wrote to memory of 2696 2624 nnttbh.exe 35 PID 2624 wrote to memory of 2696 2624 nnttbh.exe 35 PID 2696 wrote to memory of 2708 2696 pjddj.exe 36 PID 2696 wrote to memory of 2708 2696 pjddj.exe 36 PID 2696 wrote to memory of 2708 2696 pjddj.exe 36 PID 2696 wrote to memory of 2708 2696 pjddj.exe 36 PID 2708 wrote to memory of 2824 2708 1vvvd.exe 37 PID 2708 wrote to memory of 2824 2708 1vvvd.exe 37 PID 2708 wrote to memory of 2824 2708 1vvvd.exe 37 PID 2708 wrote to memory of 2824 2708 1vvvd.exe 37 PID 2824 wrote to memory of 284 2824 9llfrlf.exe 38 PID 2824 wrote to memory of 284 2824 9llfrlf.exe 38 PID 2824 wrote to memory of 284 2824 9llfrlf.exe 38 PID 2824 wrote to memory of 284 2824 9llfrlf.exe 38 PID 284 wrote to memory of 1620 284 1vjpd.exe 39 PID 284 wrote to memory of 1620 284 1vjpd.exe 39 PID 284 wrote to memory of 1620 284 1vjpd.exe 39 PID 284 wrote to memory of 1620 284 1vjpd.exe 39 PID 1620 wrote to memory of 824 1620 flfxxrx.exe 40 PID 1620 wrote to memory of 824 1620 flfxxrx.exe 40 PID 1620 wrote to memory of 824 1620 flfxxrx.exe 40 PID 1620 wrote to memory of 824 1620 flfxxrx.exe 40 PID 824 wrote to memory of 2512 824 5rllrfr.exe 41 PID 824 wrote to memory of 2512 824 5rllrfr.exe 41 PID 824 wrote to memory of 2512 824 5rllrfr.exe 41 PID 824 wrote to memory of 2512 824 5rllrfr.exe 41 PID 2512 wrote to memory of 2412 2512 ppjjp.exe 80 PID 2512 wrote to memory of 2412 2512 ppjjp.exe 80 PID 2512 wrote to memory of 2412 2512 ppjjp.exe 80 PID 2512 wrote to memory of 2412 2512 ppjjp.exe 80 PID 2412 wrote to memory of 1468 2412 lrlxlrf.exe 43 PID 2412 wrote to memory of 1468 2412 lrlxlrf.exe 43 PID 2412 wrote to memory of 1468 2412 lrlxlrf.exe 43 PID 2412 wrote to memory of 1468 2412 lrlxlrf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef08ab8fa9b6c767f1a1f8006c42f110_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ef08ab8fa9b6c767f1a1f8006c42f110_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\ddvvv.exec:\ddvvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\bnhhbh.exec:\bnhhbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\7jvdp.exec:\7jvdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\rrfrlrf.exec:\rrfrlrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\lrlrlrf.exec:\lrlrlrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\7xffrrx.exec:\7xffrrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\nnttbh.exec:\nnttbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\pjddj.exec:\pjddj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\1vvvd.exec:\1vvvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\9llfrlf.exec:\9llfrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\1vjpd.exec:\1vjpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:284 -
\??\c:\flfxxrx.exec:\flfxxrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\5rllrfr.exec:\5rllrfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\ppjjp.exec:\ppjjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\lrlxlrf.exec:\lrlxlrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\1nhbhh.exec:\1nhbhh.exe17⤵
- Executes dropped EXE
PID:1468 -
\??\c:\vvppd.exec:\vvppd.exe18⤵
- Executes dropped EXE
PID:1280 -
\??\c:\rxxlfrx.exec:\rxxlfrx.exe19⤵
- Executes dropped EXE
PID:1936 -
\??\c:\1tbhnt.exec:\1tbhnt.exe20⤵
- Executes dropped EXE
PID:2244 -
\??\c:\5jvvd.exec:\5jvvd.exe21⤵
- Executes dropped EXE
PID:268 -
\??\c:\llxrrrf.exec:\llxrrrf.exe22⤵
- Executes dropped EXE
PID:584 -
\??\c:\nnttnb.exec:\nnttnb.exe23⤵
- Executes dropped EXE
PID:1792 -
\??\c:\pjvvd.exec:\pjvvd.exe24⤵
- Executes dropped EXE
PID:2320 -
\??\c:\7flfrxx.exec:\7flfrxx.exe25⤵
- Executes dropped EXE
PID:2224 -
\??\c:\lffxffx.exec:\lffxffx.exe26⤵
- Executes dropped EXE
PID:2892 -
\??\c:\bnnhhn.exec:\bnnhhn.exe27⤵
- Executes dropped EXE
PID:1220 -
\??\c:\rffrlll.exec:\rffrlll.exe28⤵
- Executes dropped EXE
PID:2208 -
\??\c:\ntnthn.exec:\ntnthn.exe29⤵
- Executes dropped EXE
PID:1784 -
\??\c:\vdjpd.exec:\vdjpd.exe30⤵
- Executes dropped EXE
PID:1680 -
\??\c:\xrrfllf.exec:\xrrfllf.exe31⤵
- Executes dropped EXE
PID:1616 -
\??\c:\1bntbh.exec:\1bntbh.exe32⤵
- Executes dropped EXE
PID:2096 -
\??\c:\pdppd.exec:\pdppd.exe33⤵
- Executes dropped EXE
PID:1724 -
\??\c:\1lxfffl.exec:\1lxfffl.exe34⤵
- Executes dropped EXE
PID:3064 -
\??\c:\hhbhbn.exec:\hhbhbn.exe35⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jdpvd.exec:\jdpvd.exe36⤵
- Executes dropped EXE
PID:2596 -
\??\c:\llxlxfr.exec:\llxlxfr.exe37⤵
- Executes dropped EXE
PID:2456 -
\??\c:\tnbhnt.exec:\tnbhnt.exe38⤵
- Executes dropped EXE
PID:2632 -
\??\c:\pjvdj.exec:\pjvdj.exe39⤵
- Executes dropped EXE
PID:2896 -
\??\c:\dvppv.exec:\dvppv.exe40⤵
- Executes dropped EXE
PID:2776 -
\??\c:\ffxlfxr.exec:\ffxlfxr.exe41⤵
- Executes dropped EXE
PID:2616 -
\??\c:\btnbht.exec:\btnbht.exe42⤵
- Executes dropped EXE
PID:2472 -
\??\c:\djjpj.exec:\djjpj.exe43⤵
- Executes dropped EXE
PID:2980 -
\??\c:\ddvdp.exec:\ddvdp.exe44⤵
- Executes dropped EXE
PID:2720 -
\??\c:\3xfllrf.exec:\3xfllrf.exe45⤵
- Executes dropped EXE
PID:2792 -
\??\c:\xrrrffr.exec:\xrrrffr.exe46⤵
- Executes dropped EXE
PID:2508 -
\??\c:\5hbthh.exec:\5hbthh.exe47⤵
- Executes dropped EXE
PID:1912 -
\??\c:\jppvj.exec:\jppvj.exe48⤵
- Executes dropped EXE
PID:1564 -
\??\c:\lfrlxxl.exec:\lfrlxxl.exe49⤵
- Executes dropped EXE
PID:1908 -
\??\c:\xfrrxfr.exec:\xfrrxfr.exe50⤵
- Executes dropped EXE
PID:1620 -
\??\c:\tnttbt.exec:\tnttbt.exe51⤵
- Executes dropped EXE
PID:312 -
\??\c:\nnhthh.exec:\nnhthh.exe52⤵
- Executes dropped EXE
PID:1436 -
\??\c:\ddppv.exec:\ddppv.exe53⤵
- Executes dropped EXE
PID:776 -
\??\c:\rfrllff.exec:\rfrllff.exe54⤵
- Executes dropped EXE
PID:2412 -
\??\c:\fxrrxrf.exec:\fxrrxrf.exe55⤵
- Executes dropped EXE
PID:2128 -
\??\c:\9thtnn.exec:\9thtnn.exe56⤵
- Executes dropped EXE
PID:2400 -
\??\c:\7pjpd.exec:\7pjpd.exe57⤵
- Executes dropped EXE
PID:1852 -
\??\c:\9xrrffr.exec:\9xrrffr.exe58⤵
- Executes dropped EXE
PID:604 -
\??\c:\xxxfrxr.exec:\xxxfrxr.exe59⤵
- Executes dropped EXE
PID:1432 -
\??\c:\ttnbhn.exec:\ttnbhn.exe60⤵
- Executes dropped EXE
PID:1756 -
\??\c:\1vvjv.exec:\1vvjv.exe61⤵
- Executes dropped EXE
PID:1740 -
\??\c:\jjjpd.exec:\jjjpd.exe62⤵
- Executes dropped EXE
PID:2288 -
\??\c:\fxflrxf.exec:\fxflrxf.exe63⤵
- Executes dropped EXE
PID:412 -
\??\c:\hntttn.exec:\hntttn.exe64⤵
- Executes dropped EXE
PID:2228 -
\??\c:\5nbbtt.exec:\5nbbtt.exe65⤵
- Executes dropped EXE
PID:928 -
\??\c:\vvpdp.exec:\vvpdp.exe66⤵PID:1220
-
\??\c:\jdjjj.exec:\jdjjj.exe67⤵PID:1700
-
\??\c:\lfrfrrl.exec:\lfrfrrl.exe68⤵PID:1152
-
\??\c:\nbbnhh.exec:\nbbnhh.exe69⤵PID:1692
-
\??\c:\hhtbhb.exec:\hhtbhb.exe70⤵PID:1680
-
\??\c:\9vpvd.exec:\9vpvd.exe71⤵PID:2404
-
\??\c:\xlffllx.exec:\xlffllx.exe72⤵PID:2636
-
\??\c:\lxllxxf.exec:\lxllxxf.exe73⤵PID:1656
-
\??\c:\nhhhtt.exec:\nhhhtt.exe74⤵PID:2088
-
\??\c:\jjpvj.exec:\jjpvj.exe75⤵PID:2756
-
\??\c:\jjvjj.exec:\jjvjj.exe76⤵PID:2560
-
\??\c:\rlxrffl.exec:\rlxrffl.exe77⤵PID:2596
-
\??\c:\9tnthn.exec:\9tnthn.exe78⤵PID:2476
-
\??\c:\tnnbhh.exec:\tnnbhh.exe79⤵PID:2724
-
\??\c:\jvvdv.exec:\jvvdv.exe80⤵PID:2220
-
\??\c:\pjvdp.exec:\pjvdp.exe81⤵PID:2608
-
\??\c:\rlllrlr.exec:\rlllrlr.exe82⤵PID:3020
-
\??\c:\fxrxllx.exec:\fxrxllx.exe83⤵PID:2500
-
\??\c:\nhbhnt.exec:\nhbhnt.exe84⤵PID:2472
-
\??\c:\jjdpd.exec:\jjdpd.exe85⤵PID:2464
-
\??\c:\jdvdj.exec:\jdvdj.exe86⤵PID:2800
-
\??\c:\xrfflrx.exec:\xrfflrx.exe87⤵PID:2792
-
\??\c:\nnhtbb.exec:\nnhtbb.exe88⤵PID:1892
-
\??\c:\htnhnh.exec:\htnhnh.exe89⤵PID:2832
-
\??\c:\vvvdj.exec:\vvvdj.exe90⤵PID:2692
-
\??\c:\3ddpd.exec:\3ddpd.exe91⤵PID:320
-
\??\c:\xrrllfl.exec:\xrrllfl.exe92⤵PID:2360
-
\??\c:\bhtnnh.exec:\bhtnnh.exe93⤵PID:1476
-
\??\c:\9nnthn.exec:\9nnthn.exe94⤵PID:1652
-
\??\c:\jjdjp.exec:\jjdjp.exe95⤵PID:648
-
\??\c:\fxrrxxl.exec:\fxrrxxl.exe96⤵PID:1296
-
\??\c:\fxlrxxl.exec:\fxlrxxl.exe97⤵PID:2944
-
\??\c:\hhhthn.exec:\hhhthn.exe98⤵PID:1492
-
\??\c:\ppjjp.exec:\ppjjp.exe99⤵PID:2956
-
\??\c:\dvjjj.exec:\dvjjj.exe100⤵PID:336
-
\??\c:\fxlrflx.exec:\fxlrflx.exe101⤵PID:1420
-
\??\c:\ffrxfxf.exec:\ffrxfxf.exe102⤵PID:1432
-
\??\c:\bthttb.exec:\bthttb.exe103⤵PID:1020
-
\??\c:\9pddj.exec:\9pddj.exe104⤵PID:704
-
\??\c:\frfxflr.exec:\frfxflr.exe105⤵PID:3036
-
\??\c:\lxllllr.exec:\lxllllr.exe106⤵PID:1764
-
\??\c:\ttttnt.exec:\ttttnt.exe107⤵PID:2232
-
\??\c:\bbtbnn.exec:\bbtbnn.exe108⤵PID:2092
-
\??\c:\dpjpv.exec:\dpjpv.exe109⤵PID:708
-
\??\c:\pppdj.exec:\pppdj.exe110⤵PID:2420
-
\??\c:\xxrfxfx.exec:\xxrfxfx.exe111⤵PID:2836
-
\??\c:\5bbhtt.exec:\5bbhtt.exe112⤵PID:924
-
\??\c:\nhtbht.exec:\nhtbht.exe113⤵PID:1676
-
\??\c:\ppjpv.exec:\ppjpv.exe114⤵PID:2096
-
\??\c:\vpddd.exec:\vpddd.exe115⤵PID:1216
-
\??\c:\xrffllx.exec:\xrffllx.exe116⤵PID:2748
-
\??\c:\7hbhnb.exec:\7hbhnb.exe117⤵PID:568
-
\??\c:\7vddj.exec:\7vddj.exe118⤵PID:2556
-
\??\c:\lfrlxxx.exec:\lfrlxxx.exe119⤵PID:2652
-
\??\c:\9tnthn.exec:\9tnthn.exe120⤵PID:3016
-
\??\c:\5pjpv.exec:\5pjpv.exe121⤵PID:2844
-
\??\c:\9jjpv.exec:\9jjpv.exe122⤵PID:2884
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-