Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 06:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
13ccedd2f14485d2851a68ccff464f84faa45d3b2b5cebd045e16d4dbf6b47a7_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
13ccedd2f14485d2851a68ccff464f84faa45d3b2b5cebd045e16d4dbf6b47a7_NeikiAnalytics.exe
-
Size
480KB
-
MD5
bdf8e9336f08d504a96e6a17fe3ceef0
-
SHA1
9e52db39105ce762b2a60f24939763274f547846
-
SHA256
13ccedd2f14485d2851a68ccff464f84faa45d3b2b5cebd045e16d4dbf6b47a7
-
SHA512
b947047a686ec0cbb4f84c85e27e84c9f6aff46cd0572162bed82eb26ca3dfb783326bc9b790f5a875f6140fb41eb3a3361b97966517460906fe8de4a59e171d
-
SSDEEP
12288:n3C9uDVw6326pKZ9asZqoZHz+evcn0Meh2Fezt:Su326p0aroZt0st
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/108-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2964-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1616-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1376-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1692-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1584-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1236-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1852-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1904-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1284-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1944-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/280-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1724-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2216 lxfxfxr.exe 2964 jdvjj.exe 2620 rxrfrxr.exe 2664 nnhtnt.exe 2704 fxlrfrx.exe 1616 nhbbhh.exe 2464 xxrlxfx.exe 2888 hhbbhn.exe 2192 ffxflfl.exe 1376 3nhnhh.exe 1692 7lxlxfr.exe 1584 1bnntt.exe 1236 xfflffr.exe 1852 thnbnb.exe 2388 rrlrrxr.exe 1904 pjvdp.exe 1284 5rfxrrf.exe 2504 9tbbnn.exe 1944 7rflrrf.exe 2764 nhbnbt.exe 2428 jdjjp.exe 324 xxrrxrf.exe 2348 ppdpv.exe 608 rrfxxxl.exe 1912 7tnbtb.exe 280 lfrxffl.exe 860 nhbhnn.exe 736 vvjvj.exe 1952 rfrrffl.exe 1724 nbhhhb.exe 1444 hhhthh.exe 2084 nnntbb.exe 1956 rxlfxff.exe 2244 bhbthh.exe 3008 ppjvd.exe 2812 1rfrrxf.exe 2672 xxrfrfx.exe 2688 tnttbh.exe 2708 vvjjv.exe 2704 rlxrxxl.exe 2720 nnbnbb.exe 2476 3thntb.exe 2188 pdppv.exe 1988 lfxxlxl.exe 1808 tnbbht.exe 1532 djvjj.exe 1464 vppdp.exe 1232 1xlxrfr.exe 1384 llfrxxl.exe 2752 1tbnhn.exe 1800 pppvp.exe 2392 rfxfxfl.exe 1664 fxxflrf.exe 2432 bbnthh.exe 344 ddvvj.exe 2024 ddvdp.exe 2788 xrfflrf.exe 1936 5ntnhh.exe 1972 dvjvd.exe 2764 llflrrf.exe 536 1lfxrfr.exe 1412 httbnb.exe 1792 vjddp.exe 1712 3pjjj.exe -
resource yara_rule behavioral1/memory/108-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1616-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1376-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1692-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1584-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1236-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1852-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1904-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1284-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1944-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/280-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1724-292-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 108 wrote to memory of 2216 108 13ccedd2f14485d2851a68ccff464f84faa45d3b2b5cebd045e16d4dbf6b47a7_NeikiAnalytics.exe 28 PID 108 wrote to memory of 2216 108 13ccedd2f14485d2851a68ccff464f84faa45d3b2b5cebd045e16d4dbf6b47a7_NeikiAnalytics.exe 28 PID 108 wrote to memory of 2216 108 13ccedd2f14485d2851a68ccff464f84faa45d3b2b5cebd045e16d4dbf6b47a7_NeikiAnalytics.exe 28 PID 108 wrote to memory of 2216 108 13ccedd2f14485d2851a68ccff464f84faa45d3b2b5cebd045e16d4dbf6b47a7_NeikiAnalytics.exe 28 PID 2216 wrote to memory of 2964 2216 lxfxfxr.exe 29 PID 2216 wrote to memory of 2964 2216 lxfxfxr.exe 29 PID 2216 wrote to memory of 2964 2216 lxfxfxr.exe 29 PID 2216 wrote to memory of 2964 2216 lxfxfxr.exe 29 PID 2964 wrote to memory of 2620 2964 jdvjj.exe 30 PID 2964 wrote to memory of 2620 2964 jdvjj.exe 30 PID 2964 wrote to memory of 2620 2964 jdvjj.exe 30 PID 2964 wrote to memory of 2620 2964 jdvjj.exe 30 PID 2620 wrote to memory of 2664 2620 rxrfrxr.exe 31 PID 2620 wrote to memory of 2664 2620 rxrfrxr.exe 31 PID 2620 wrote to memory of 2664 2620 rxrfrxr.exe 31 PID 2620 wrote to memory of 2664 2620 rxrfrxr.exe 31 PID 2664 wrote to memory of 2704 2664 nnhtnt.exe 32 PID 2664 wrote to memory of 2704 2664 nnhtnt.exe 32 PID 2664 wrote to memory of 2704 2664 nnhtnt.exe 32 PID 2664 wrote to memory of 2704 2664 nnhtnt.exe 32 PID 2704 wrote to memory of 1616 2704 fxlrfrx.exe 33 PID 2704 wrote to memory of 1616 2704 fxlrfrx.exe 33 PID 2704 wrote to memory of 1616 2704 fxlrfrx.exe 33 PID 2704 wrote to memory of 1616 2704 fxlrfrx.exe 33 PID 1616 wrote to memory of 2464 1616 nhbbhh.exe 34 PID 1616 wrote to memory of 2464 1616 nhbbhh.exe 34 PID 1616 wrote to memory of 2464 1616 nhbbhh.exe 34 PID 1616 wrote to memory of 2464 1616 nhbbhh.exe 34 PID 2464 wrote to memory of 2888 2464 xxrlxfx.exe 35 PID 2464 wrote to memory of 2888 2464 xxrlxfx.exe 35 PID 2464 wrote to memory of 2888 2464 xxrlxfx.exe 35 PID 2464 wrote to memory of 2888 2464 xxrlxfx.exe 35 PID 2888 wrote to memory of 2192 2888 hhbbhn.exe 36 PID 2888 wrote to memory of 2192 2888 hhbbhn.exe 36 PID 2888 wrote to memory of 2192 2888 hhbbhn.exe 36 PID 2888 wrote to memory of 2192 2888 hhbbhn.exe 36 PID 2192 wrote to memory of 1376 2192 ffxflfl.exe 37 PID 2192 wrote to memory of 1376 2192 ffxflfl.exe 37 PID 2192 wrote to memory of 1376 2192 ffxflfl.exe 37 PID 2192 wrote to memory of 1376 2192 ffxflfl.exe 37 PID 1376 wrote to memory of 1692 1376 3nhnhh.exe 38 PID 1376 wrote to memory of 1692 1376 3nhnhh.exe 38 PID 1376 wrote to memory of 1692 1376 3nhnhh.exe 38 PID 1376 wrote to memory of 1692 1376 3nhnhh.exe 38 PID 1692 wrote to memory of 1584 1692 7lxlxfr.exe 39 PID 1692 wrote to memory of 1584 1692 7lxlxfr.exe 39 PID 1692 wrote to memory of 1584 1692 7lxlxfr.exe 39 PID 1692 wrote to memory of 1584 1692 7lxlxfr.exe 39 PID 1584 wrote to memory of 1236 1584 1bnntt.exe 40 PID 1584 wrote to memory of 1236 1584 1bnntt.exe 40 PID 1584 wrote to memory of 1236 1584 1bnntt.exe 40 PID 1584 wrote to memory of 1236 1584 1bnntt.exe 40 PID 1236 wrote to memory of 1852 1236 xfflffr.exe 41 PID 1236 wrote to memory of 1852 1236 xfflffr.exe 41 PID 1236 wrote to memory of 1852 1236 xfflffr.exe 41 PID 1236 wrote to memory of 1852 1236 xfflffr.exe 41 PID 1852 wrote to memory of 2388 1852 thnbnb.exe 42 PID 1852 wrote to memory of 2388 1852 thnbnb.exe 42 PID 1852 wrote to memory of 2388 1852 thnbnb.exe 42 PID 1852 wrote to memory of 2388 1852 thnbnb.exe 42 PID 2388 wrote to memory of 1904 2388 rrlrrxr.exe 43 PID 2388 wrote to memory of 1904 2388 rrlrrxr.exe 43 PID 2388 wrote to memory of 1904 2388 rrlrrxr.exe 43 PID 2388 wrote to memory of 1904 2388 rrlrrxr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\13ccedd2f14485d2851a68ccff464f84faa45d3b2b5cebd045e16d4dbf6b47a7_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\13ccedd2f14485d2851a68ccff464f84faa45d3b2b5cebd045e16d4dbf6b47a7_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:108 -
\??\c:\lxfxfxr.exec:\lxfxfxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\jdvjj.exec:\jdvjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\rxrfrxr.exec:\rxrfrxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\nnhtnt.exec:\nnhtnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\fxlrfrx.exec:\fxlrfrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\nhbbhh.exec:\nhbbhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\xxrlxfx.exec:\xxrlxfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\hhbbhn.exec:\hhbbhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\ffxflfl.exec:\ffxflfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\3nhnhh.exec:\3nhnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\7lxlxfr.exec:\7lxlxfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\1bnntt.exec:\1bnntt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\xfflffr.exec:\xfflffr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\thnbnb.exec:\thnbnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\rrlrrxr.exec:\rrlrrxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\pjvdp.exec:\pjvdp.exe17⤵
- Executes dropped EXE
PID:1904 -
\??\c:\5rfxrrf.exec:\5rfxrrf.exe18⤵
- Executes dropped EXE
PID:1284 -
\??\c:\9tbbnn.exec:\9tbbnn.exe19⤵
- Executes dropped EXE
PID:2504 -
\??\c:\7rflrrf.exec:\7rflrrf.exe20⤵
- Executes dropped EXE
PID:1944 -
\??\c:\nhbnbt.exec:\nhbnbt.exe21⤵
- Executes dropped EXE
PID:2764 -
\??\c:\jdjjp.exec:\jdjjp.exe22⤵
- Executes dropped EXE
PID:2428 -
\??\c:\xxrrxrf.exec:\xxrrxrf.exe23⤵
- Executes dropped EXE
PID:324 -
\??\c:\ppdpv.exec:\ppdpv.exe24⤵
- Executes dropped EXE
PID:2348 -
\??\c:\rrfxxxl.exec:\rrfxxxl.exe25⤵
- Executes dropped EXE
PID:608 -
\??\c:\7tnbtb.exec:\7tnbtb.exe26⤵
- Executes dropped EXE
PID:1912 -
\??\c:\lfrxffl.exec:\lfrxffl.exe27⤵
- Executes dropped EXE
PID:280 -
\??\c:\nhbhnn.exec:\nhbhnn.exe28⤵
- Executes dropped EXE
PID:860 -
\??\c:\vvjvj.exec:\vvjvj.exe29⤵
- Executes dropped EXE
PID:736 -
\??\c:\rfrrffl.exec:\rfrrffl.exe30⤵
- Executes dropped EXE
PID:1952 -
\??\c:\nbhhhb.exec:\nbhhhb.exe31⤵
- Executes dropped EXE
PID:1724 -
\??\c:\hhhthh.exec:\hhhthh.exe32⤵
- Executes dropped EXE
PID:1444 -
\??\c:\nnntbb.exec:\nnntbb.exe33⤵
- Executes dropped EXE
PID:2084 -
\??\c:\rxlfxff.exec:\rxlfxff.exe34⤵
- Executes dropped EXE
PID:1956 -
\??\c:\bhbthh.exec:\bhbthh.exe35⤵
- Executes dropped EXE
PID:2244 -
\??\c:\ppjvd.exec:\ppjvd.exe36⤵
- Executes dropped EXE
PID:3008 -
\??\c:\1rfrrxf.exec:\1rfrrxf.exe37⤵
- Executes dropped EXE
PID:2812 -
\??\c:\xxrfrfx.exec:\xxrfrfx.exe38⤵
- Executes dropped EXE
PID:2672 -
\??\c:\tnttbh.exec:\tnttbh.exe39⤵
- Executes dropped EXE
PID:2688 -
\??\c:\vvjjv.exec:\vvjjv.exe40⤵
- Executes dropped EXE
PID:2708 -
\??\c:\rlxrxxl.exec:\rlxrxxl.exe41⤵
- Executes dropped EXE
PID:2704 -
\??\c:\nnbnbb.exec:\nnbnbb.exe42⤵
- Executes dropped EXE
PID:2720 -
\??\c:\3thntb.exec:\3thntb.exe43⤵
- Executes dropped EXE
PID:2476 -
\??\c:\pdppv.exec:\pdppv.exe44⤵
- Executes dropped EXE
PID:2188 -
\??\c:\lfxxlxl.exec:\lfxxlxl.exe45⤵
- Executes dropped EXE
PID:1988 -
\??\c:\tnbbht.exec:\tnbbht.exe46⤵
- Executes dropped EXE
PID:1808 -
\??\c:\djvjj.exec:\djvjj.exe47⤵
- Executes dropped EXE
PID:1532 -
\??\c:\vppdp.exec:\vppdp.exe48⤵
- Executes dropped EXE
PID:1464 -
\??\c:\1xlxrfr.exec:\1xlxrfr.exe49⤵
- Executes dropped EXE
PID:1232 -
\??\c:\llfrxxl.exec:\llfrxxl.exe50⤵
- Executes dropped EXE
PID:1384 -
\??\c:\1tbnhn.exec:\1tbnhn.exe51⤵
- Executes dropped EXE
PID:2752 -
\??\c:\pppvp.exec:\pppvp.exe52⤵
- Executes dropped EXE
PID:1800 -
\??\c:\rfxfxfl.exec:\rfxfxfl.exe53⤵
- Executes dropped EXE
PID:2392 -
\??\c:\fxxflrf.exec:\fxxflrf.exe54⤵
- Executes dropped EXE
PID:1664 -
\??\c:\bbnthh.exec:\bbnthh.exe55⤵
- Executes dropped EXE
PID:2432 -
\??\c:\ddvvj.exec:\ddvvj.exe56⤵
- Executes dropped EXE
PID:344 -
\??\c:\ddvdp.exec:\ddvdp.exe57⤵
- Executes dropped EXE
PID:2024 -
\??\c:\xrfflrf.exec:\xrfflrf.exe58⤵
- Executes dropped EXE
PID:2788 -
\??\c:\5ntnhh.exec:\5ntnhh.exe59⤵
- Executes dropped EXE
PID:1936 -
\??\c:\dvjvd.exec:\dvjvd.exe60⤵
- Executes dropped EXE
PID:1972 -
\??\c:\llflrrf.exec:\llflrrf.exe61⤵
- Executes dropped EXE
PID:2764 -
\??\c:\1lfxrfr.exec:\1lfxrfr.exe62⤵
- Executes dropped EXE
PID:536 -
\??\c:\httbnb.exec:\httbnb.exe63⤵
- Executes dropped EXE
PID:1412 -
\??\c:\vjddp.exec:\vjddp.exe64⤵
- Executes dropped EXE
PID:1792 -
\??\c:\3pjjj.exec:\3pjjj.exe65⤵
- Executes dropped EXE
PID:1712 -
\??\c:\xrffrrf.exec:\xrffrrf.exe66⤵PID:1736
-
\??\c:\nhbntb.exec:\nhbntb.exe67⤵PID:2868
-
\??\c:\9nhthh.exec:\9nhthh.exe68⤵PID:900
-
\??\c:\jdpdv.exec:\jdpdv.exe69⤵PID:876
-
\??\c:\frllxxr.exec:\frllxxr.exe70⤵PID:612
-
\??\c:\xxlrflx.exec:\xxlrflx.exe71⤵PID:1984
-
\??\c:\btbbnt.exec:\btbbnt.exe72⤵PID:1720
-
\??\c:\3jvdd.exec:\3jvdd.exe73⤵PID:1440
-
\??\c:\fxrrxxf.exec:\fxrrxxf.exe74⤵PID:2936
-
\??\c:\1lxxfxx.exec:\1lxxfxx.exe75⤵PID:2176
-
\??\c:\btttbb.exec:\btttbb.exe76⤵PID:2220
-
\??\c:\vpdvv.exec:\vpdvv.exe77⤵PID:2740
-
\??\c:\djjpv.exec:\djjpv.exe78⤵PID:2276
-
\??\c:\fxfrxrx.exec:\fxfrxrx.exe79⤵PID:2668
-
\??\c:\bnnbbh.exec:\bnnbbh.exe80⤵PID:2596
-
\??\c:\vddpj.exec:\vddpj.exe81⤵PID:2968
-
\??\c:\5xllrlr.exec:\5xllrlr.exe82⤵PID:2664
-
\??\c:\xrlrxxr.exec:\xrlrxxr.exe83⤵PID:2600
-
\??\c:\tnnntb.exec:\tnnntb.exe84⤵PID:1732
-
\??\c:\jdjpv.exec:\jdjpv.exe85⤵PID:2496
-
\??\c:\djvjv.exec:\djvjv.exe86⤵PID:2516
-
\??\c:\5lffffr.exec:\5lffffr.exe87⤵PID:2904
-
\??\c:\tthnbh.exec:\tthnbh.exe88⤵PID:1628
-
\??\c:\1vddd.exec:\1vddd.exe89⤵PID:2192
-
\??\c:\pjdjv.exec:\pjdjv.exe90⤵PID:1376
-
\??\c:\rlflffl.exec:\rlflffl.exe91⤵PID:1692
-
\??\c:\5hbhhb.exec:\5hbhhb.exe92⤵PID:1900
-
\??\c:\tnhnbb.exec:\tnhnbb.exe93⤵PID:1780
-
\??\c:\vpdjj.exec:\vpdjj.exe94⤵PID:2180
-
\??\c:\llffxlf.exec:\llffxlf.exe95⤵PID:2148
-
\??\c:\lfxxflr.exec:\lfxxflr.exe96⤵PID:2372
-
\??\c:\9btnbn.exec:\9btnbn.exe97⤵PID:1368
-
\??\c:\9pjvd.exec:\9pjvd.exe98⤵PID:1220
-
\??\c:\xrlxxfl.exec:\xrlxxfl.exe99⤵PID:1904
-
\??\c:\xxrrlrl.exec:\xxrrlrl.exe100⤵PID:2504
-
\??\c:\hbtbhn.exec:\hbtbhn.exe101⤵PID:1944
-
\??\c:\dvpdj.exec:\dvpdj.exe102⤵PID:2560
-
\??\c:\ffrrxxl.exec:\ffrrxxl.exe103⤵PID:1972
-
\??\c:\7fxxxfl.exec:\7fxxxfl.exe104⤵PID:596
-
\??\c:\bhnbth.exec:\bhnbth.exe105⤵PID:276
-
\??\c:\vdjvv.exec:\vdjvv.exe106⤵PID:2348
-
\??\c:\rlfrffx.exec:\rlfrffx.exe107⤵PID:2288
-
\??\c:\xlxxrxf.exec:\xlxxrxf.exe108⤵PID:948
-
\??\c:\hnnbbh.exec:\hnnbbh.exe109⤵PID:2284
-
\??\c:\vpjpd.exec:\vpjpd.exe110⤵PID:280
-
\??\c:\lflrfff.exec:\lflrfff.exe111⤵PID:1484
-
\??\c:\fxlllfl.exec:\fxlllfl.exe112⤵PID:328
-
\??\c:\hbtbhn.exec:\hbtbhn.exe113⤵PID:2860
-
\??\c:\5djjd.exec:\5djjd.exe114⤵PID:2960
-
\??\c:\dvjpv.exec:\dvjpv.exe115⤵PID:3056
-
\??\c:\xxrfrrl.exec:\xxrfrrl.exe116⤵PID:2920
-
\??\c:\hbtbnn.exec:\hbtbnn.exe117⤵PID:1548
-
\??\c:\7vpvj.exec:\7vpvj.exe118⤵PID:1520
-
\??\c:\ffflxxl.exec:\ffflxxl.exe119⤵PID:2220
-
\??\c:\3jvvp.exec:\3jvvp.exe120⤵PID:2740
-
\??\c:\llflxxr.exec:\llflxxr.exe121⤵PID:2676
-
\??\c:\3lffxfx.exec:\3lffxfx.exe122⤵PID:2668
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-