Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 01:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
80257122a6603984ef181ced2c319de0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
80257122a6603984ef181ced2c319de0_NeikiAnalytics.exe
-
Size
335KB
-
MD5
80257122a6603984ef181ced2c319de0
-
SHA1
4af3abb2282bf969fcb828fef1a7f53bf2e81607
-
SHA256
74e36c3d155db76f3e7c112c6d99f4dd8b5f9e96b7bd13f1853468178fb352a7
-
SHA512
39af7195744fe0aae40e64d84a5f671299e029724a29d531ec6dffc5d013566ac8becada59cf07c318ab83ee3ad1a1a9787d488ca605099cc7b828fe62ac481a
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp99zm+/KZBHqnuOeHzmB600TUA6Z7zupc+BE:n3C9BRo7tvnJ99T/KZEuOod00TG+BE
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/3040-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1604-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1000-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/928-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1432-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1852-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2488-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1124-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1800-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2968-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1724-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2788 pdjvd.exe 3040 rrfflrx.exe 2896 lfrrflr.exe 3060 tnbbnn.exe 2844 dpddj.exe 2772 pjpvj.exe 2524 xlrffrx.exe 2968 tnthhb.exe 2720 3bhttt.exe 2804 ppjpp.exe 1800 7fxfffl.exe 108 frxfxlx.exe 1604 thhhnt.exe 1124 1pvdv.exe 2424 jvjdj.exe 1652 rfrxrxr.exe 1336 hthhnn.exe 2488 5djvv.exe 2008 jvpvd.exe 1852 3lxrrlr.exe 604 xrffrxf.exe 1432 9tbbhn.exe 1756 jvdjj.exe 1864 1rrfxxr.exe 412 3hnbth.exe 1000 hhbhnn.exe 928 1vjpp.exe 2900 rfrlrrr.exe 1456 nnhtbh.exe 2532 dvjjp.exe 908 lxxxxfr.exe 2536 bnttht.exe 3044 nhhnhn.exe 2000 ppdjv.exe 2748 frflxxl.exe 2556 5ntttt.exe 2484 nbbhnn.exe 1624 vpddj.exe 2464 7xlrlll.exe 3020 htbbhh.exe 2492 hhnnnn.exe 2684 vpdvd.exe 2808 3frrrrf.exe 2664 3llxrxl.exe 2456 hbbbhb.exe 1620 1hbtnh.exe 2328 vpjpv.exe 1492 rlllflx.exe 2336 btthbh.exe 1248 nhhbtt.exe 1296 1jjvv.exe 2984 3vvvv.exe 1956 1rlrfxf.exe 2840 5xllxll.exe 2548 bththb.exe 788 1jvvv.exe 1592 jvddd.exe 1432 frfrlfr.exe 3032 fxfflrf.exe 1212 tnbttb.exe 1020 pdvpv.exe 1648 3dpvj.exe 916 3rffrrx.exe 2920 btntbh.exe -
resource yara_rule behavioral1/memory/3040-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1604-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1000-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/928-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1432-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1852-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1124-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1800-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1724-4-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1724 wrote to memory of 2788 1724 80257122a6603984ef181ced2c319de0_NeikiAnalytics.exe 28 PID 1724 wrote to memory of 2788 1724 80257122a6603984ef181ced2c319de0_NeikiAnalytics.exe 28 PID 1724 wrote to memory of 2788 1724 80257122a6603984ef181ced2c319de0_NeikiAnalytics.exe 28 PID 1724 wrote to memory of 2788 1724 80257122a6603984ef181ced2c319de0_NeikiAnalytics.exe 28 PID 2788 wrote to memory of 3040 2788 pdjvd.exe 101 PID 2788 wrote to memory of 3040 2788 pdjvd.exe 101 PID 2788 wrote to memory of 3040 2788 pdjvd.exe 101 PID 2788 wrote to memory of 3040 2788 pdjvd.exe 101 PID 3040 wrote to memory of 2896 3040 rrfflrx.exe 30 PID 3040 wrote to memory of 2896 3040 rrfflrx.exe 30 PID 3040 wrote to memory of 2896 3040 rrfflrx.exe 30 PID 3040 wrote to memory of 2896 3040 rrfflrx.exe 30 PID 2896 wrote to memory of 3060 2896 lfrrflr.exe 187 PID 2896 wrote to memory of 3060 2896 lfrrflr.exe 187 PID 2896 wrote to memory of 3060 2896 lfrrflr.exe 187 PID 2896 wrote to memory of 3060 2896 lfrrflr.exe 187 PID 3060 wrote to memory of 2844 3060 tnbbnn.exe 398 PID 3060 wrote to memory of 2844 3060 tnbbnn.exe 398 PID 3060 wrote to memory of 2844 3060 tnbbnn.exe 398 PID 3060 wrote to memory of 2844 3060 tnbbnn.exe 398 PID 2844 wrote to memory of 2772 2844 dpddj.exe 33 PID 2844 wrote to memory of 2772 2844 dpddj.exe 33 PID 2844 wrote to memory of 2772 2844 dpddj.exe 33 PID 2844 wrote to memory of 2772 2844 dpddj.exe 33 PID 2772 wrote to memory of 2524 2772 pjpvj.exe 34 PID 2772 wrote to memory of 2524 2772 pjpvj.exe 34 PID 2772 wrote to memory of 2524 2772 pjpvj.exe 34 PID 2772 wrote to memory of 2524 2772 pjpvj.exe 34 PID 2524 wrote to memory of 2968 2524 xlrffrx.exe 35 PID 2524 wrote to memory of 2968 2524 xlrffrx.exe 35 PID 2524 wrote to memory of 2968 2524 xlrffrx.exe 35 PID 2524 wrote to memory of 2968 2524 xlrffrx.exe 35 PID 2968 wrote to memory of 2720 2968 tnthhb.exe 36 PID 2968 wrote to memory of 2720 2968 tnthhb.exe 36 PID 2968 wrote to memory of 2720 2968 tnthhb.exe 36 PID 2968 wrote to memory of 2720 2968 tnthhb.exe 36 PID 2720 wrote to memory of 2804 2720 3bhttt.exe 320 PID 2720 wrote to memory of 2804 2720 3bhttt.exe 320 PID 2720 wrote to memory of 2804 2720 3bhttt.exe 320 PID 2720 wrote to memory of 2804 2720 3bhttt.exe 320 PID 2804 wrote to memory of 1800 2804 ppjpp.exe 38 PID 2804 wrote to memory of 1800 2804 ppjpp.exe 38 PID 2804 wrote to memory of 1800 2804 ppjpp.exe 38 PID 2804 wrote to memory of 1800 2804 ppjpp.exe 38 PID 1800 wrote to memory of 108 1800 7fxfffl.exe 39 PID 1800 wrote to memory of 108 1800 7fxfffl.exe 39 PID 1800 wrote to memory of 108 1800 7fxfffl.exe 39 PID 1800 wrote to memory of 108 1800 7fxfffl.exe 39 PID 108 wrote to memory of 1604 108 frxfxlx.exe 40 PID 108 wrote to memory of 1604 108 frxfxlx.exe 40 PID 108 wrote to memory of 1604 108 frxfxlx.exe 40 PID 108 wrote to memory of 1604 108 frxfxlx.exe 40 PID 1604 wrote to memory of 1124 1604 thhhnt.exe 41 PID 1604 wrote to memory of 1124 1604 thhhnt.exe 41 PID 1604 wrote to memory of 1124 1604 thhhnt.exe 41 PID 1604 wrote to memory of 1124 1604 thhhnt.exe 41 PID 1124 wrote to memory of 2424 1124 1pvdv.exe 42 PID 1124 wrote to memory of 2424 1124 1pvdv.exe 42 PID 1124 wrote to memory of 2424 1124 1pvdv.exe 42 PID 1124 wrote to memory of 2424 1124 1pvdv.exe 42 PID 2424 wrote to memory of 1652 2424 jvjdj.exe 43 PID 2424 wrote to memory of 1652 2424 jvjdj.exe 43 PID 2424 wrote to memory of 1652 2424 jvjdj.exe 43 PID 2424 wrote to memory of 1652 2424 jvjdj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\80257122a6603984ef181ced2c319de0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\80257122a6603984ef181ced2c319de0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\pdjvd.exec:\pdjvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\rrfflrx.exec:\rrfflrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\lfrrflr.exec:\lfrrflr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\tnbbnn.exec:\tnbbnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\dpddj.exec:\dpddj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\pjpvj.exec:\pjpvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\xlrffrx.exec:\xlrffrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\tnthhb.exec:\tnthhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\3bhttt.exec:\3bhttt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\ppjpp.exec:\ppjpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\7fxfffl.exec:\7fxfffl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\frxfxlx.exec:\frxfxlx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:108 -
\??\c:\thhhnt.exec:\thhhnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\1pvdv.exec:\1pvdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
\??\c:\jvjdj.exec:\jvjdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\rfrxrxr.exec:\rfrxrxr.exe17⤵
- Executes dropped EXE
PID:1652 -
\??\c:\hthhnn.exec:\hthhnn.exe18⤵
- Executes dropped EXE
PID:1336 -
\??\c:\5djvv.exec:\5djvv.exe19⤵
- Executes dropped EXE
PID:2488 -
\??\c:\jvpvd.exec:\jvpvd.exe20⤵
- Executes dropped EXE
PID:2008 -
\??\c:\3lxrrlr.exec:\3lxrrlr.exe21⤵
- Executes dropped EXE
PID:1852 -
\??\c:\xrffrxf.exec:\xrffrxf.exe22⤵
- Executes dropped EXE
PID:604 -
\??\c:\9tbbhn.exec:\9tbbhn.exe23⤵
- Executes dropped EXE
PID:1432 -
\??\c:\jvdjj.exec:\jvdjj.exe24⤵
- Executes dropped EXE
PID:1756 -
\??\c:\1rrfxxr.exec:\1rrfxxr.exe25⤵
- Executes dropped EXE
PID:1864 -
\??\c:\3hnbth.exec:\3hnbth.exe26⤵
- Executes dropped EXE
PID:412 -
\??\c:\hhbhnn.exec:\hhbhnn.exe27⤵
- Executes dropped EXE
PID:1000 -
\??\c:\1vjpp.exec:\1vjpp.exe28⤵
- Executes dropped EXE
PID:928 -
\??\c:\rfrlrrr.exec:\rfrlrrr.exe29⤵
- Executes dropped EXE
PID:2900 -
\??\c:\nnhtbh.exec:\nnhtbh.exe30⤵
- Executes dropped EXE
PID:1456 -
\??\c:\dvjjp.exec:\dvjjp.exe31⤵
- Executes dropped EXE
PID:2532 -
\??\c:\lxxxxfr.exec:\lxxxxfr.exe32⤵
- Executes dropped EXE
PID:908 -
\??\c:\bnttht.exec:\bnttht.exe33⤵
- Executes dropped EXE
PID:2536 -
\??\c:\nhhnhn.exec:\nhhnhn.exe34⤵
- Executes dropped EXE
PID:3044 -
\??\c:\ppdjv.exec:\ppdjv.exe35⤵
- Executes dropped EXE
PID:2000 -
\??\c:\frflxxl.exec:\frflxxl.exe36⤵
- Executes dropped EXE
PID:2748 -
\??\c:\5ntttt.exec:\5ntttt.exe37⤵
- Executes dropped EXE
PID:2556 -
\??\c:\nbbhnn.exec:\nbbhnn.exe38⤵
- Executes dropped EXE
PID:2484 -
\??\c:\vpddj.exec:\vpddj.exe39⤵
- Executes dropped EXE
PID:1624 -
\??\c:\7xlrlll.exec:\7xlrlll.exe40⤵
- Executes dropped EXE
PID:2464 -
\??\c:\htbbhh.exec:\htbbhh.exe41⤵
- Executes dropped EXE
PID:3020 -
\??\c:\hhnnnn.exec:\hhnnnn.exe42⤵
- Executes dropped EXE
PID:2492 -
\??\c:\vpdvd.exec:\vpdvd.exe43⤵
- Executes dropped EXE
PID:2684 -
\??\c:\3frrrrf.exec:\3frrrrf.exe44⤵
- Executes dropped EXE
PID:2808 -
\??\c:\3llxrxl.exec:\3llxrxl.exe45⤵
- Executes dropped EXE
PID:2664 -
\??\c:\hbbbhb.exec:\hbbbhb.exe46⤵
- Executes dropped EXE
PID:2456 -
\??\c:\1hbtnh.exec:\1hbtnh.exe47⤵
- Executes dropped EXE
PID:1620 -
\??\c:\vpjpv.exec:\vpjpv.exe48⤵
- Executes dropped EXE
PID:2328 -
\??\c:\rlllflx.exec:\rlllflx.exe49⤵
- Executes dropped EXE
PID:1492 -
\??\c:\btthbh.exec:\btthbh.exe50⤵
- Executes dropped EXE
PID:2336 -
\??\c:\nhhbtt.exec:\nhhbtt.exe51⤵
- Executes dropped EXE
PID:1248 -
\??\c:\1jjvv.exec:\1jjvv.exe52⤵
- Executes dropped EXE
PID:1296 -
\??\c:\3vvvv.exec:\3vvvv.exe53⤵
- Executes dropped EXE
PID:2984 -
\??\c:\1rlrfxf.exec:\1rlrfxf.exe54⤵
- Executes dropped EXE
PID:1956 -
\??\c:\5xllxll.exec:\5xllxll.exe55⤵
- Executes dropped EXE
PID:2840 -
\??\c:\bththb.exec:\bththb.exe56⤵
- Executes dropped EXE
PID:2548 -
\??\c:\1jvvv.exec:\1jvvv.exe57⤵
- Executes dropped EXE
PID:788 -
\??\c:\jvddd.exec:\jvddd.exe58⤵
- Executes dropped EXE
PID:1592 -
\??\c:\frfrlfr.exec:\frfrlfr.exe59⤵
- Executes dropped EXE
PID:1432 -
\??\c:\fxfflrf.exec:\fxfflrf.exe60⤵
- Executes dropped EXE
PID:3032 -
\??\c:\tnbttb.exec:\tnbttb.exe61⤵
- Executes dropped EXE
PID:1212 -
\??\c:\pdvpv.exec:\pdvpv.exe62⤵
- Executes dropped EXE
PID:1020 -
\??\c:\3dpvj.exec:\3dpvj.exe63⤵
- Executes dropped EXE
PID:1648 -
\??\c:\3rffrrx.exec:\3rffrrx.exe64⤵
- Executes dropped EXE
PID:916 -
\??\c:\btntbh.exec:\btntbh.exe65⤵
- Executes dropped EXE
PID:2920 -
\??\c:\thhnnb.exec:\thhnnb.exe66⤵PID:2784
-
\??\c:\pdjdd.exec:\pdjdd.exe67⤵PID:568
-
\??\c:\xrxxlfr.exec:\xrxxlfr.exe68⤵PID:1692
-
\??\c:\lrxxfff.exec:\lrxxfff.exe69⤵PID:2188
-
\??\c:\tnhnbb.exec:\tnhnbb.exe70⤵PID:1032
-
\??\c:\9nnthn.exec:\9nnthn.exe71⤵PID:2912
-
\??\c:\pjvdj.exec:\pjvdj.exe72⤵PID:2536
-
\??\c:\vpvdj.exec:\vpvdj.exe73⤵PID:1996
-
\??\c:\fxlxlrl.exec:\fxlxlrl.exe74⤵PID:3036
-
\??\c:\3ttttb.exec:\3ttttb.exe75⤵PID:3040
-
\??\c:\nbnntb.exec:\nbnntb.exe76⤵PID:2736
-
\??\c:\dpdjj.exec:\dpdjj.exe77⤵PID:2884
-
\??\c:\jvddv.exec:\jvddv.exe78⤵PID:2552
-
\??\c:\llxrrrf.exec:\llxrrrf.exe79⤵PID:2588
-
\??\c:\frflrrf.exec:\frflrrf.exe80⤵PID:2508
-
\??\c:\bthbth.exec:\bthbth.exe81⤵PID:1688
-
\??\c:\pjvvj.exec:\pjvvj.exe82⤵PID:2968
-
\??\c:\dvdvp.exec:\dvdvp.exe83⤵PID:2768
-
\??\c:\fllfxlf.exec:\fllfxlf.exe84⤵PID:2684
-
\??\c:\lrlxlfl.exec:\lrlxlfl.exe85⤵PID:2540
-
\??\c:\bhtnbb.exec:\bhtnbb.exe86⤵PID:1544
-
\??\c:\pjvdj.exec:\pjvdj.exe87⤵PID:1564
-
\??\c:\1dddd.exec:\1dddd.exe88⤵PID:1376
-
\??\c:\3lrrxrr.exec:\3lrrxrr.exe89⤵PID:2272
-
\??\c:\ntbbnn.exec:\ntbbnn.exe90⤵PID:2512
-
\??\c:\bbnthn.exec:\bbnthn.exe91⤵PID:2412
-
\??\c:\3dppp.exec:\3dppp.exe92⤵PID:1460
-
\??\c:\jvjjp.exec:\jvjjp.exe93⤵PID:1652
-
\??\c:\xlxrrrx.exec:\xlxrrrx.exe94⤵PID:2868
-
\??\c:\3nbhnt.exec:\3nbhnt.exe95⤵PID:2276
-
\??\c:\bnthhb.exec:\bnthhb.exe96⤵PID:2112
-
\??\c:\djvpd.exec:\djvpd.exe97⤵PID:1572
-
\??\c:\9xlrxxl.exec:\9xlrxxl.exe98⤵PID:540
-
\??\c:\rlxxrxr.exec:\rlxxrxr.exe99⤵PID:1420
-
\??\c:\nhhthn.exec:\nhhthn.exe100⤵PID:656
-
\??\c:\tthttt.exec:\tthttt.exe101⤵PID:1868
-
\??\c:\dpjjj.exec:\dpjjj.exe102⤵PID:2224
-
\??\c:\pvjjp.exec:\pvjjp.exe103⤵PID:2416
-
\??\c:\flxlffl.exec:\flxlffl.exe104⤵PID:1028
-
\??\c:\rlfxrxx.exec:\rlfxrxx.exe105⤵PID:1220
-
\??\c:\nhbbnn.exec:\nhbbnn.exe106⤵PID:3052
-
\??\c:\1nhnbn.exec:\1nhnbn.exe107⤵PID:2148
-
\??\c:\dvvjv.exec:\dvvjv.exe108⤵PID:2716
-
\??\c:\9vjjv.exec:\9vjjv.exe109⤵PID:1424
-
\??\c:\xrxflxl.exec:\xrxflxl.exe110⤵PID:112
-
\??\c:\nnhttb.exec:\nnhttb.exe111⤵PID:2532
-
\??\c:\3nbnbh.exec:\3nbnbh.exe112⤵PID:1944
-
\??\c:\hbnttt.exec:\hbnttt.exe113⤵PID:1600
-
\??\c:\vvvdp.exec:\vvvdp.exe114⤵PID:2496
-
\??\c:\vvvvj.exec:\vvvvj.exe115⤵PID:2732
-
\??\c:\rlrlrrx.exec:\rlrlrrx.exe116⤵PID:2604
-
\??\c:\7bbhbb.exec:\7bbhbb.exe117⤵PID:2896
-
\??\c:\tnnnbb.exec:\tnnnbb.exe118⤵PID:2852
-
\??\c:\jdjjv.exec:\jdjjv.exe119⤵PID:2616
-
\??\c:\vpdpv.exec:\vpdpv.exe120⤵PID:1948
-
\??\c:\fxfxflr.exec:\fxfxflr.exe121⤵PID:1988
-
\??\c:\9flrrfl.exec:\9flrrfl.exe122⤵PID:2528
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-