Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 19:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
10576250f3bca1089e6277e9e44ecb30_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
10576250f3bca1089e6277e9e44ecb30_NeikiAnalytics.exe
-
Size
66KB
-
MD5
10576250f3bca1089e6277e9e44ecb30
-
SHA1
b320daf96da6c4a165e181407028ced066016f9b
-
SHA256
f714f902b143b780e5d2a433fd664ef8e99d649f50f7a0ce5aa7427a6277e9f4
-
SHA512
b78839afc98e0f3ad2665fe233ad68e4c05d1930f6f97b2a3bc3c72f9e362e147eaaf8a77181ff0ad284c5b50dfccd2dd44389d520695353a39b2c3087f0d58a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6Mu/ePS3AyXmcz:ymb3NkkiQ3mdBjFI46TQyXmcz
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2116-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2004-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2076-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1996-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1048-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1772-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1244-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/824-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/380-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/800-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2084-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2004 rlxflrf.exe 2076 jddjv.exe 2796 rlfrfrx.exe 2668 lxrxxrx.exe 2636 hhnnhb.exe 2620 3fxxfxf.exe 2516 nbhbbt.exe 2640 1nhnhh.exe 1996 pvdjv.exe 2744 1vdpp.exe 2828 lfxlxlx.exe 1048 vjvpv.exe 1244 pjjvp.exe 1772 xfrrfff.exe 824 9hhhtb.exe 2740 jjjpd.exe 380 ppjjv.exe 800 frllrrf.exe 1752 9nhthn.exe 1780 dvpdp.exe 2084 lrxlrff.exe 2884 5rllrfr.exe 2696 btntbn.exe 568 vvpjv.exe 108 dvvdj.exe 1992 rrxlrfx.exe 1844 7nntht.exe 916 jdpdj.exe 1176 flxrxrr.exe 2044 hbtthh.exe 2212 vpdjj.exe 3020 vvpdv.exe 1968 lrrlllx.exe 1712 bhhnbt.exe 1596 nnttbn.exe 2004 vdvdj.exe 2788 xflxxfx.exe 2792 rrflxfr.exe 2652 1tthnt.exe 2712 dvpvv.exe 2540 1ddpd.exe 2688 xxxrxxf.exe 2548 hbtntt.exe 2584 btnbtt.exe 2220 pvvjv.exe 2984 frxffll.exe 2036 7flxxrr.exe 2556 7tbnth.exe 780 3ttbbh.exe 1604 djdpd.exe 1808 dvjdp.exe 1448 3xxfrfr.exe 328 5llxflr.exe 352 tthnbb.exe 688 bnhtbb.exe 1156 djddp.exe 380 flxlrlf.exe 800 1rrrflf.exe 2296 3bbhtt.exe 1584 ddjvv.exe 2500 5llflrx.exe 2176 hbtbnb.exe 2016 ttbnnn.exe 2080 3jpvj.exe -
resource yara_rule behavioral1/memory/2116-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2004-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2076-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1996-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1048-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1772-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1244-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/824-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/380-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/800-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-211-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2116 wrote to memory of 2004 2116 10576250f3bca1089e6277e9e44ecb30_NeikiAnalytics.exe 28 PID 2116 wrote to memory of 2004 2116 10576250f3bca1089e6277e9e44ecb30_NeikiAnalytics.exe 28 PID 2116 wrote to memory of 2004 2116 10576250f3bca1089e6277e9e44ecb30_NeikiAnalytics.exe 28 PID 2116 wrote to memory of 2004 2116 10576250f3bca1089e6277e9e44ecb30_NeikiAnalytics.exe 28 PID 2004 wrote to memory of 2076 2004 rlxflrf.exe 29 PID 2004 wrote to memory of 2076 2004 rlxflrf.exe 29 PID 2004 wrote to memory of 2076 2004 rlxflrf.exe 29 PID 2004 wrote to memory of 2076 2004 rlxflrf.exe 29 PID 2076 wrote to memory of 2796 2076 jddjv.exe 30 PID 2076 wrote to memory of 2796 2076 jddjv.exe 30 PID 2076 wrote to memory of 2796 2076 jddjv.exe 30 PID 2076 wrote to memory of 2796 2076 jddjv.exe 30 PID 2796 wrote to memory of 2668 2796 rlfrfrx.exe 31 PID 2796 wrote to memory of 2668 2796 rlfrfrx.exe 31 PID 2796 wrote to memory of 2668 2796 rlfrfrx.exe 31 PID 2796 wrote to memory of 2668 2796 rlfrfrx.exe 31 PID 2668 wrote to memory of 2636 2668 lxrxxrx.exe 32 PID 2668 wrote to memory of 2636 2668 lxrxxrx.exe 32 PID 2668 wrote to memory of 2636 2668 lxrxxrx.exe 32 PID 2668 wrote to memory of 2636 2668 lxrxxrx.exe 32 PID 2636 wrote to memory of 2620 2636 hhnnhb.exe 33 PID 2636 wrote to memory of 2620 2636 hhnnhb.exe 33 PID 2636 wrote to memory of 2620 2636 hhnnhb.exe 33 PID 2636 wrote to memory of 2620 2636 hhnnhb.exe 33 PID 2620 wrote to memory of 2516 2620 3fxxfxf.exe 34 PID 2620 wrote to memory of 2516 2620 3fxxfxf.exe 34 PID 2620 wrote to memory of 2516 2620 3fxxfxf.exe 34 PID 2620 wrote to memory of 2516 2620 3fxxfxf.exe 34 PID 2516 wrote to memory of 2640 2516 nbhbbt.exe 35 PID 2516 wrote to memory of 2640 2516 nbhbbt.exe 35 PID 2516 wrote to memory of 2640 2516 nbhbbt.exe 35 PID 2516 wrote to memory of 2640 2516 nbhbbt.exe 35 PID 2640 wrote to memory of 1996 2640 1nhnhh.exe 36 PID 2640 wrote to memory of 1996 2640 1nhnhh.exe 36 PID 2640 wrote to memory of 1996 2640 1nhnhh.exe 36 PID 2640 wrote to memory of 1996 2640 1nhnhh.exe 36 PID 1996 wrote to memory of 2744 1996 pvdjv.exe 37 PID 1996 wrote to memory of 2744 1996 pvdjv.exe 37 PID 1996 wrote to memory of 2744 1996 pvdjv.exe 37 PID 1996 wrote to memory of 2744 1996 pvdjv.exe 37 PID 2744 wrote to memory of 2828 2744 1vdpp.exe 38 PID 2744 wrote to memory of 2828 2744 1vdpp.exe 38 PID 2744 wrote to memory of 2828 2744 1vdpp.exe 38 PID 2744 wrote to memory of 2828 2744 1vdpp.exe 38 PID 2828 wrote to memory of 1048 2828 lfxlxlx.exe 39 PID 2828 wrote to memory of 1048 2828 lfxlxlx.exe 39 PID 2828 wrote to memory of 1048 2828 lfxlxlx.exe 39 PID 2828 wrote to memory of 1048 2828 lfxlxlx.exe 39 PID 1048 wrote to memory of 1244 1048 vjvpv.exe 40 PID 1048 wrote to memory of 1244 1048 vjvpv.exe 40 PID 1048 wrote to memory of 1244 1048 vjvpv.exe 40 PID 1048 wrote to memory of 1244 1048 vjvpv.exe 40 PID 1244 wrote to memory of 1772 1244 pjjvp.exe 41 PID 1244 wrote to memory of 1772 1244 pjjvp.exe 41 PID 1244 wrote to memory of 1772 1244 pjjvp.exe 41 PID 1244 wrote to memory of 1772 1244 pjjvp.exe 41 PID 1772 wrote to memory of 824 1772 xfrrfff.exe 42 PID 1772 wrote to memory of 824 1772 xfrrfff.exe 42 PID 1772 wrote to memory of 824 1772 xfrrfff.exe 42 PID 1772 wrote to memory of 824 1772 xfrrfff.exe 42 PID 824 wrote to memory of 2740 824 9hhhtb.exe 43 PID 824 wrote to memory of 2740 824 9hhhtb.exe 43 PID 824 wrote to memory of 2740 824 9hhhtb.exe 43 PID 824 wrote to memory of 2740 824 9hhhtb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\10576250f3bca1089e6277e9e44ecb30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\10576250f3bca1089e6277e9e44ecb30_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\rlxflrf.exec:\rlxflrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\jddjv.exec:\jddjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\rlfrfrx.exec:\rlfrfrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\lxrxxrx.exec:\lxrxxrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\hhnnhb.exec:\hhnnhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\3fxxfxf.exec:\3fxxfxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\nbhbbt.exec:\nbhbbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\1nhnhh.exec:\1nhnhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\pvdjv.exec:\pvdjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\1vdpp.exec:\1vdpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\lfxlxlx.exec:\lfxlxlx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\vjvpv.exec:\vjvpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\pjjvp.exec:\pjjvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\xfrrfff.exec:\xfrrfff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\9hhhtb.exec:\9hhhtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\jjjpd.exec:\jjjpd.exe17⤵
- Executes dropped EXE
PID:2740 -
\??\c:\ppjjv.exec:\ppjjv.exe18⤵
- Executes dropped EXE
PID:380 -
\??\c:\frllrrf.exec:\frllrrf.exe19⤵
- Executes dropped EXE
PID:800 -
\??\c:\9nhthn.exec:\9nhthn.exe20⤵
- Executes dropped EXE
PID:1752 -
\??\c:\dvpdp.exec:\dvpdp.exe21⤵
- Executes dropped EXE
PID:1780 -
\??\c:\lrxlrff.exec:\lrxlrff.exe22⤵
- Executes dropped EXE
PID:2084 -
\??\c:\5rllrfr.exec:\5rllrfr.exe23⤵
- Executes dropped EXE
PID:2884 -
\??\c:\btntbn.exec:\btntbn.exe24⤵
- Executes dropped EXE
PID:2696 -
\??\c:\vvpjv.exec:\vvpjv.exe25⤵
- Executes dropped EXE
PID:568 -
\??\c:\dvvdj.exec:\dvvdj.exe26⤵
- Executes dropped EXE
PID:108 -
\??\c:\rrxlrfx.exec:\rrxlrfx.exe27⤵
- Executes dropped EXE
PID:1992 -
\??\c:\7nntht.exec:\7nntht.exe28⤵
- Executes dropped EXE
PID:1844 -
\??\c:\jdpdj.exec:\jdpdj.exe29⤵
- Executes dropped EXE
PID:916 -
\??\c:\flxrxrr.exec:\flxrxrr.exe30⤵
- Executes dropped EXE
PID:1176 -
\??\c:\hbtthh.exec:\hbtthh.exe31⤵
- Executes dropped EXE
PID:2044 -
\??\c:\vpdjj.exec:\vpdjj.exe32⤵
- Executes dropped EXE
PID:2212 -
\??\c:\vvpdv.exec:\vvpdv.exe33⤵
- Executes dropped EXE
PID:3020 -
\??\c:\lrrlllx.exec:\lrrlllx.exe34⤵
- Executes dropped EXE
PID:1968 -
\??\c:\bhhnbt.exec:\bhhnbt.exe35⤵
- Executes dropped EXE
PID:1712 -
\??\c:\nnttbn.exec:\nnttbn.exe36⤵
- Executes dropped EXE
PID:1596 -
\??\c:\vdvdj.exec:\vdvdj.exe37⤵
- Executes dropped EXE
PID:2004 -
\??\c:\xflxxfx.exec:\xflxxfx.exe38⤵
- Executes dropped EXE
PID:2788 -
\??\c:\rrflxfr.exec:\rrflxfr.exe39⤵
- Executes dropped EXE
PID:2792 -
\??\c:\1tthnt.exec:\1tthnt.exe40⤵
- Executes dropped EXE
PID:2652 -
\??\c:\dvpvv.exec:\dvpvv.exe41⤵
- Executes dropped EXE
PID:2712 -
\??\c:\1ddpd.exec:\1ddpd.exe42⤵
- Executes dropped EXE
PID:2540 -
\??\c:\xxxrxxf.exec:\xxxrxxf.exe43⤵
- Executes dropped EXE
PID:2688 -
\??\c:\hbtntt.exec:\hbtntt.exe44⤵
- Executes dropped EXE
PID:2548 -
\??\c:\btnbtt.exec:\btnbtt.exe45⤵
- Executes dropped EXE
PID:2584 -
\??\c:\pvvjv.exec:\pvvjv.exe46⤵
- Executes dropped EXE
PID:2220 -
\??\c:\frxffll.exec:\frxffll.exe47⤵
- Executes dropped EXE
PID:2984 -
\??\c:\7flxxrr.exec:\7flxxrr.exe48⤵
- Executes dropped EXE
PID:2036 -
\??\c:\7tbnth.exec:\7tbnth.exe49⤵
- Executes dropped EXE
PID:2556 -
\??\c:\3ttbbh.exec:\3ttbbh.exe50⤵
- Executes dropped EXE
PID:780 -
\??\c:\djdpd.exec:\djdpd.exe51⤵
- Executes dropped EXE
PID:1604 -
\??\c:\dvjdp.exec:\dvjdp.exe52⤵
- Executes dropped EXE
PID:1808 -
\??\c:\3xxfrfr.exec:\3xxfrfr.exe53⤵
- Executes dropped EXE
PID:1448 -
\??\c:\5llxflr.exec:\5llxflr.exe54⤵
- Executes dropped EXE
PID:328 -
\??\c:\tthnbb.exec:\tthnbb.exe55⤵
- Executes dropped EXE
PID:352 -
\??\c:\bnhtbb.exec:\bnhtbb.exe56⤵
- Executes dropped EXE
PID:688 -
\??\c:\djddp.exec:\djddp.exe57⤵
- Executes dropped EXE
PID:1156 -
\??\c:\flxlrlf.exec:\flxlrlf.exe58⤵
- Executes dropped EXE
PID:380 -
\??\c:\1rrrflf.exec:\1rrrflf.exe59⤵
- Executes dropped EXE
PID:800 -
\??\c:\3bbhtt.exec:\3bbhtt.exe60⤵
- Executes dropped EXE
PID:2296 -
\??\c:\ddjvv.exec:\ddjvv.exe61⤵
- Executes dropped EXE
PID:1584 -
\??\c:\5llflrx.exec:\5llflrx.exe62⤵
- Executes dropped EXE
PID:2500 -
\??\c:\hbtbnb.exec:\hbtbnb.exe63⤵
- Executes dropped EXE
PID:2176 -
\??\c:\ttbnnn.exec:\ttbnnn.exe64⤵
- Executes dropped EXE
PID:2016 -
\??\c:\3jpvj.exec:\3jpvj.exe65⤵
- Executes dropped EXE
PID:2080 -
\??\c:\lfxrfrf.exec:\lfxrfrf.exe66⤵PID:2376
-
\??\c:\xrlllll.exec:\xrlllll.exe67⤵PID:1096
-
\??\c:\tnttht.exec:\tnttht.exe68⤵PID:888
-
\??\c:\bbtttn.exec:\bbtttn.exe69⤵PID:2604
-
\??\c:\dvpdd.exec:\dvpdd.exe70⤵PID:1824
-
\??\c:\ffrlrlr.exec:\ffrlrlr.exe71⤵PID:2940
-
\??\c:\nnhnth.exec:\nnhnth.exe72⤵PID:2028
-
\??\c:\djvdd.exec:\djvdd.exe73⤵PID:2148
-
\??\c:\pdvjd.exec:\pdvjd.exe74⤵PID:2012
-
\??\c:\5ffrlxl.exec:\5ffrlxl.exe75⤵PID:1700
-
\??\c:\7nnnbt.exec:\7nnnbt.exe76⤵PID:2488
-
\??\c:\3pjjv.exec:\3pjjv.exe77⤵PID:2456
-
\??\c:\vvvjp.exec:\vvvjp.exe78⤵PID:1600
-
\??\c:\xrrxrfl.exec:\xrrxrfl.exe79⤵PID:2188
-
\??\c:\xffxlrf.exec:\xffxlrf.exe80⤵PID:2076
-
\??\c:\jpvjj.exec:\jpvjj.exe81⤵PID:2808
-
\??\c:\dvvjv.exec:\dvvjv.exe82⤵PID:2672
-
\??\c:\rrrfxfr.exec:\rrrfxfr.exe83⤵PID:2900
-
\??\c:\rrlxlxl.exec:\rrlxlxl.exe84⤵PID:2716
-
\??\c:\hnnnbb.exec:\hnnnbb.exe85⤵PID:2564
-
\??\c:\vpdjd.exec:\vpdjd.exe86⤵PID:2632
-
\??\c:\jjdvj.exec:\jjdvj.exe87⤵PID:2516
-
\??\c:\9rxrfxr.exec:\9rxrfxr.exe88⤵PID:2976
-
\??\c:\thttnh.exec:\thttnh.exe89⤵PID:1956
-
\??\c:\tbbnht.exec:\tbbnht.exe90⤵PID:2484
-
\??\c:\pddjv.exec:\pddjv.exe91⤵PID:2960
-
\??\c:\vvjvd.exec:\vvjvd.exe92⤵PID:1032
-
\??\c:\1rrlxfr.exec:\1rrlxfr.exe93⤵PID:1292
-
\??\c:\rlrxrfx.exec:\rlrxrfx.exe94⤵PID:776
-
\??\c:\1hhnht.exec:\1hhnht.exe95⤵PID:1244
-
\??\c:\bbnbnt.exec:\bbnbnt.exe96⤵PID:2404
-
\??\c:\7pvjp.exec:\7pvjp.exe97⤵PID:868
-
\??\c:\xxxlrfl.exec:\xxxlrfl.exe98⤵PID:600
-
\??\c:\llrfrrr.exec:\llrfrrr.exe99⤵PID:1000
-
\??\c:\ttntnt.exec:\ttntnt.exe100⤵PID:484
-
\??\c:\pjvjv.exec:\pjvjv.exe101⤵PID:1636
-
\??\c:\ddvpj.exec:\ddvpj.exe102⤵PID:1684
-
\??\c:\frllrlx.exec:\frllrlx.exe103⤵PID:1720
-
\??\c:\lfxlfxr.exec:\lfxlfxr.exe104⤵PID:1500
-
\??\c:\7btbnt.exec:\7btbnt.exe105⤵PID:2084
-
\??\c:\hbhbnb.exec:\hbhbnb.exe106⤵PID:2108
-
\??\c:\5vjvv.exec:\5vjvv.exe107⤵PID:1416
-
\??\c:\xrrrxfx.exec:\xrrrxfx.exe108⤵PID:568
-
\??\c:\lfllrxf.exec:\lfllrxf.exe109⤵PID:448
-
\??\c:\bbtbtb.exec:\bbtbtb.exe110⤵PID:1608
-
\??\c:\jpjjp.exec:\jpjjp.exe111⤵PID:1704
-
\??\c:\pvjvp.exec:\pvjvp.exe112⤵PID:2192
-
\??\c:\flfxfxl.exec:\flfxfxl.exe113⤵PID:624
-
\??\c:\ffrfrfl.exec:\ffrfrfl.exe114⤵PID:1616
-
\??\c:\hhhhnn.exec:\hhhhnn.exe115⤵PID:556
-
\??\c:\7dvpd.exec:\7dvpd.exe116⤵PID:1832
-
\??\c:\pddvp.exec:\pddvp.exe117⤵PID:1800
-
\??\c:\ffxrxxf.exec:\ffxrxxf.exe118⤵PID:2892
-
\??\c:\tbhbbb.exec:\tbhbbb.exe119⤵PID:1952
-
\??\c:\nbbhhh.exec:\nbbhhh.exe120⤵PID:640
-
\??\c:\jjvpp.exec:\jjvpp.exe121⤵PID:2448
-
\??\c:\jpjdv.exec:\jpjdv.exe122⤵PID:2664
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-