Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
12/05/2024, 12:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f2667d9d5e04ab12ef3c6e76678d4d0_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
0f2667d9d5e04ab12ef3c6e76678d4d0_NeikiAnalytics.exe
-
Size
76KB
-
MD5
0f2667d9d5e04ab12ef3c6e76678d4d0
-
SHA1
65a933e2e095bd54c2dabe38ee38bd081ad8a133
-
SHA256
6f72e25e98e74a03e71c841647bda10f3e847176733c032ded1f0ffe3624eb0d
-
SHA512
359d1d926922cd7a2cec7a8237d62a314bcfb22d1b5ff9183336aaf9f24f48c17a1e6dc734b57585c602cfd7b3e0f0dcb34c0c221c712f34821bdbc6d8ebb190
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrAE:ymb3NkkiQ3mdBjFIIp9L9QrrAE
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/2656-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1468-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3112-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3488-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2648-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2144-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2144-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2924-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2816-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1984-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3840-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1880-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3092-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1396-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5104-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/532-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2824-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1356-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/940-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1692-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4160-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1120-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2052-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2356-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3676-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/956-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1468 fllxrlx.exe 3112 nhbbhh.exe 3488 vpvdp.exe 2648 3frrlrr.exe 2924 1bhhbt.exe 2144 rrlrrrl.exe 2816 lxlxrrl.exe 1984 jdpjj.exe 5108 flrrlll.exe 1844 nhhbth.exe 3840 jddjd.exe 5040 1vdvv.exe 1880 rlrlffx.exe 4232 hbttbb.exe 3092 ddvvv.exe 1396 1pjpj.exe 5104 frxxllr.exe 532 lxffxxr.exe 2824 nhbbtt.exe 1356 pdjjv.exe 1160 3rfxlfx.exe 940 lfflfff.exe 1692 nhnntt.exe 4160 pjpjd.exe 1120 vvvjj.exe 2052 xlrxllx.exe 2164 1ttttt.exe 2356 jvvdp.exe 3676 vpjpd.exe 956 7lxfxxr.exe 5060 bhtbht.exe 1260 bbnnbt.exe 2400 vddpv.exe 1988 llxxlrl.exe 1300 rffxrxr.exe 4820 htbtnn.exe 928 dpddp.exe 4316 9vddp.exe 5008 5lrlffx.exe 2068 9hnhbb.exe 3324 vjjjj.exe 4148 dpvpj.exe 4800 lflfxxx.exe 3488 1bbbhh.exe 404 hhhhbh.exe 3336 1vjjj.exe 4884 jvdvj.exe 548 xrrrrll.exe 3412 jvpdj.exe 2704 9pjdd.exe 2208 5rffffx.exe 1348 nthtbn.exe 4772 ntnhbb.exe 3528 dpvdd.exe 1880 dvjdv.exe 2256 rxfxllf.exe 4472 5tnnnn.exe 2588 hnnntb.exe 756 3vpjd.exe 1932 5fxrlll.exe 2060 lrxrlll.exe 620 ttthnh.exe 3564 bttnbb.exe 1616 jpvpp.exe -
resource yara_rule behavioral2/memory/2656-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1468-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1468-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3112-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3488-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2648-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2144-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2144-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1984-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1984-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1984-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3840-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1880-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3092-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1396-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5104-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/532-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1356-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/940-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1692-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4160-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1120-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2052-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2356-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3676-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/956-199-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2656 wrote to memory of 1468 2656 0f2667d9d5e04ab12ef3c6e76678d4d0_NeikiAnalytics.exe 83 PID 2656 wrote to memory of 1468 2656 0f2667d9d5e04ab12ef3c6e76678d4d0_NeikiAnalytics.exe 83 PID 2656 wrote to memory of 1468 2656 0f2667d9d5e04ab12ef3c6e76678d4d0_NeikiAnalytics.exe 83 PID 1468 wrote to memory of 3112 1468 fllxrlx.exe 84 PID 1468 wrote to memory of 3112 1468 fllxrlx.exe 84 PID 1468 wrote to memory of 3112 1468 fllxrlx.exe 84 PID 3112 wrote to memory of 3488 3112 nhbbhh.exe 85 PID 3112 wrote to memory of 3488 3112 nhbbhh.exe 85 PID 3112 wrote to memory of 3488 3112 nhbbhh.exe 85 PID 3488 wrote to memory of 2648 3488 vpvdp.exe 86 PID 3488 wrote to memory of 2648 3488 vpvdp.exe 86 PID 3488 wrote to memory of 2648 3488 vpvdp.exe 86 PID 2648 wrote to memory of 2924 2648 3frrlrr.exe 87 PID 2648 wrote to memory of 2924 2648 3frrlrr.exe 87 PID 2648 wrote to memory of 2924 2648 3frrlrr.exe 87 PID 2924 wrote to memory of 2144 2924 1bhhbt.exe 88 PID 2924 wrote to memory of 2144 2924 1bhhbt.exe 88 PID 2924 wrote to memory of 2144 2924 1bhhbt.exe 88 PID 2144 wrote to memory of 2816 2144 rrlrrrl.exe 89 PID 2144 wrote to memory of 2816 2144 rrlrrrl.exe 89 PID 2144 wrote to memory of 2816 2144 rrlrrrl.exe 89 PID 2816 wrote to memory of 1984 2816 lxlxrrl.exe 90 PID 2816 wrote to memory of 1984 2816 lxlxrrl.exe 90 PID 2816 wrote to memory of 1984 2816 lxlxrrl.exe 90 PID 1984 wrote to memory of 5108 1984 jdpjj.exe 91 PID 1984 wrote to memory of 5108 1984 jdpjj.exe 91 PID 1984 wrote to memory of 5108 1984 jdpjj.exe 91 PID 5108 wrote to memory of 1844 5108 flrrlll.exe 93 PID 5108 wrote to memory of 1844 5108 flrrlll.exe 93 PID 5108 wrote to memory of 1844 5108 flrrlll.exe 93 PID 1844 wrote to memory of 3840 1844 nhhbth.exe 94 PID 1844 wrote to memory of 3840 1844 nhhbth.exe 94 PID 1844 wrote to memory of 3840 1844 nhhbth.exe 94 PID 3840 wrote to memory of 5040 3840 jddjd.exe 95 PID 3840 wrote to memory of 5040 3840 jddjd.exe 95 PID 3840 wrote to memory of 5040 3840 jddjd.exe 95 PID 5040 wrote to memory of 1880 5040 1vdvv.exe 96 PID 5040 wrote to memory of 1880 5040 1vdvv.exe 96 PID 5040 wrote to memory of 1880 5040 1vdvv.exe 96 PID 1880 wrote to memory of 4232 1880 rlrlffx.exe 97 PID 1880 wrote to memory of 4232 1880 rlrlffx.exe 97 PID 1880 wrote to memory of 4232 1880 rlrlffx.exe 97 PID 4232 wrote to memory of 3092 4232 hbttbb.exe 98 PID 4232 wrote to memory of 3092 4232 hbttbb.exe 98 PID 4232 wrote to memory of 3092 4232 hbttbb.exe 98 PID 3092 wrote to memory of 1396 3092 ddvvv.exe 99 PID 3092 wrote to memory of 1396 3092 ddvvv.exe 99 PID 3092 wrote to memory of 1396 3092 ddvvv.exe 99 PID 1396 wrote to memory of 5104 1396 1pjpj.exe 100 PID 1396 wrote to memory of 5104 1396 1pjpj.exe 100 PID 1396 wrote to memory of 5104 1396 1pjpj.exe 100 PID 5104 wrote to memory of 532 5104 frxxllr.exe 101 PID 5104 wrote to memory of 532 5104 frxxllr.exe 101 PID 5104 wrote to memory of 532 5104 frxxllr.exe 101 PID 532 wrote to memory of 2824 532 lxffxxr.exe 102 PID 532 wrote to memory of 2824 532 lxffxxr.exe 102 PID 532 wrote to memory of 2824 532 lxffxxr.exe 102 PID 2824 wrote to memory of 1356 2824 nhbbtt.exe 103 PID 2824 wrote to memory of 1356 2824 nhbbtt.exe 103 PID 2824 wrote to memory of 1356 2824 nhbbtt.exe 103 PID 1356 wrote to memory of 1160 1356 pdjjv.exe 105 PID 1356 wrote to memory of 1160 1356 pdjjv.exe 105 PID 1356 wrote to memory of 1160 1356 pdjjv.exe 105 PID 1160 wrote to memory of 940 1160 3rfxlfx.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f2667d9d5e04ab12ef3c6e76678d4d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0f2667d9d5e04ab12ef3c6e76678d4d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\fllxrlx.exec:\fllxrlx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\nhbbhh.exec:\nhbbhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\vpvdp.exec:\vpvdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\3frrlrr.exec:\3frrlrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\1bhhbt.exec:\1bhhbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\rrlrrrl.exec:\rrlrrrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\lxlxrrl.exec:\lxlxrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\jdpjj.exec:\jdpjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\flrrlll.exec:\flrrlll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\nhhbth.exec:\nhhbth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\jddjd.exec:\jddjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\1vdvv.exec:\1vdvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\rlrlffx.exec:\rlrlffx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\hbttbb.exec:\hbttbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\ddvvv.exec:\ddvvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\1pjpj.exec:\1pjpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\frxxllr.exec:\frxxllr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\lxffxxr.exec:\lxffxxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\nhbbtt.exec:\nhbbtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\pdjjv.exec:\pdjjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\3rfxlfx.exec:\3rfxlfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\lfflfff.exec:\lfflfff.exe23⤵
- Executes dropped EXE
PID:940 -
\??\c:\nhnntt.exec:\nhnntt.exe24⤵
- Executes dropped EXE
PID:1692 -
\??\c:\pjpjd.exec:\pjpjd.exe25⤵
- Executes dropped EXE
PID:4160 -
\??\c:\vvvjj.exec:\vvvjj.exe26⤵
- Executes dropped EXE
PID:1120 -
\??\c:\xlrxllx.exec:\xlrxllx.exe27⤵
- Executes dropped EXE
PID:2052 -
\??\c:\1ttttt.exec:\1ttttt.exe28⤵
- Executes dropped EXE
PID:2164 -
\??\c:\jvvdp.exec:\jvvdp.exe29⤵
- Executes dropped EXE
PID:2356 -
\??\c:\vpjpd.exec:\vpjpd.exe30⤵
- Executes dropped EXE
PID:3676 -
\??\c:\7lxfxxr.exec:\7lxfxxr.exe31⤵
- Executes dropped EXE
PID:956 -
\??\c:\bhtbht.exec:\bhtbht.exe32⤵
- Executes dropped EXE
PID:5060 -
\??\c:\bbnnbt.exec:\bbnnbt.exe33⤵
- Executes dropped EXE
PID:1260 -
\??\c:\vddpv.exec:\vddpv.exe34⤵
- Executes dropped EXE
PID:2400 -
\??\c:\llxxlrl.exec:\llxxlrl.exe35⤵
- Executes dropped EXE
PID:1988 -
\??\c:\rffxrxr.exec:\rffxrxr.exe36⤵
- Executes dropped EXE
PID:1300 -
\??\c:\htbtnn.exec:\htbtnn.exe37⤵
- Executes dropped EXE
PID:4820 -
\??\c:\dpddp.exec:\dpddp.exe38⤵
- Executes dropped EXE
PID:928 -
\??\c:\9vddp.exec:\9vddp.exe39⤵
- Executes dropped EXE
PID:4316 -
\??\c:\5lrlffx.exec:\5lrlffx.exe40⤵
- Executes dropped EXE
PID:5008 -
\??\c:\9hnhbb.exec:\9hnhbb.exe41⤵
- Executes dropped EXE
PID:2068 -
\??\c:\vjjjj.exec:\vjjjj.exe42⤵
- Executes dropped EXE
PID:3324 -
\??\c:\dpvpj.exec:\dpvpj.exe43⤵
- Executes dropped EXE
PID:4148 -
\??\c:\lflfxxx.exec:\lflfxxx.exe44⤵
- Executes dropped EXE
PID:4800 -
\??\c:\1bbbhh.exec:\1bbbhh.exe45⤵
- Executes dropped EXE
PID:3488 -
\??\c:\hhhhbh.exec:\hhhhbh.exe46⤵
- Executes dropped EXE
PID:404 -
\??\c:\1vjjj.exec:\1vjjj.exe47⤵
- Executes dropped EXE
PID:3336 -
\??\c:\jvdvj.exec:\jvdvj.exe48⤵
- Executes dropped EXE
PID:4884 -
\??\c:\xrrrrll.exec:\xrrrrll.exe49⤵
- Executes dropped EXE
PID:548 -
\??\c:\jvpdj.exec:\jvpdj.exe50⤵
- Executes dropped EXE
PID:3412 -
\??\c:\9pjdd.exec:\9pjdd.exe51⤵
- Executes dropped EXE
PID:2704 -
\??\c:\5rffffx.exec:\5rffffx.exe52⤵
- Executes dropped EXE
PID:2208 -
\??\c:\nthtbn.exec:\nthtbn.exe53⤵
- Executes dropped EXE
PID:1348 -
\??\c:\ntnhbb.exec:\ntnhbb.exe54⤵
- Executes dropped EXE
PID:4772 -
\??\c:\dpvdd.exec:\dpvdd.exe55⤵
- Executes dropped EXE
PID:3528 -
\??\c:\dvjdv.exec:\dvjdv.exe56⤵
- Executes dropped EXE
PID:1880 -
\??\c:\rxfxllf.exec:\rxfxllf.exe57⤵
- Executes dropped EXE
PID:2256 -
\??\c:\5tnnnn.exec:\5tnnnn.exe58⤵
- Executes dropped EXE
PID:4472 -
\??\c:\hnnntb.exec:\hnnntb.exe59⤵
- Executes dropped EXE
PID:2588 -
\??\c:\3vpjd.exec:\3vpjd.exe60⤵
- Executes dropped EXE
PID:756 -
\??\c:\5fxrlll.exec:\5fxrlll.exe61⤵
- Executes dropped EXE
PID:1932 -
\??\c:\lrxrlll.exec:\lrxrlll.exe62⤵
- Executes dropped EXE
PID:2060 -
\??\c:\ttthnh.exec:\ttthnh.exe63⤵
- Executes dropped EXE
PID:620 -
\??\c:\bttnbb.exec:\bttnbb.exe64⤵
- Executes dropped EXE
PID:3564 -
\??\c:\jpvpp.exec:\jpvpp.exe65⤵
- Executes dropped EXE
PID:1616 -
\??\c:\rlxlxxr.exec:\rlxlxxr.exe66⤵PID:2388
-
\??\c:\fxxxfll.exec:\fxxxfll.exe67⤵PID:2272
-
\??\c:\tnnntt.exec:\tnnntt.exe68⤵PID:4744
-
\??\c:\bhnbtt.exec:\bhnbtt.exe69⤵PID:1804
-
\??\c:\pjjjj.exec:\pjjjj.exe70⤵PID:4016
-
\??\c:\xxrlfff.exec:\xxrlfff.exe71⤵PID:4512
-
\??\c:\xxxxrrl.exec:\xxxxrrl.exe72⤵PID:2352
-
\??\c:\5thhbb.exec:\5thhbb.exe73⤵PID:3596
-
\??\c:\hbhhtb.exec:\hbhhtb.exe74⤵PID:1876
-
\??\c:\pjjdd.exec:\pjjdd.exe75⤵PID:3932
-
\??\c:\frxrlll.exec:\frxrlll.exe76⤵PID:3492
-
\??\c:\frffxxr.exec:\frffxxr.exe77⤵PID:4748
-
\??\c:\ntnhnt.exec:\ntnhnt.exe78⤵PID:384
-
\??\c:\3jjdv.exec:\3jjdv.exe79⤵PID:2188
-
\??\c:\9lrrfrl.exec:\9lrrfrl.exe80⤵PID:4596
-
\??\c:\xxlfllr.exec:\xxlfllr.exe81⤵PID:208
-
\??\c:\htbtnb.exec:\htbtnb.exe82⤵PID:2336
-
\??\c:\dvvpj.exec:\dvvpj.exe83⤵PID:224
-
\??\c:\3jppj.exec:\3jppj.exe84⤵PID:4780
-
\??\c:\fxxxrrl.exec:\fxxxrrl.exe85⤵PID:4444
-
\??\c:\5bbbbb.exec:\5bbbbb.exe86⤵PID:3304
-
\??\c:\nbnntb.exec:\nbnntb.exe87⤵PID:4612
-
\??\c:\dpvpp.exec:\dpvpp.exe88⤵PID:2640
-
\??\c:\lfllllr.exec:\lfllllr.exe89⤵PID:4044
-
\??\c:\rlxxrfx.exec:\rlxxrfx.exe90⤵PID:4148
-
\??\c:\3ttnbb.exec:\3ttnbb.exe91⤵PID:2128
-
\??\c:\tnnbhh.exec:\tnnbhh.exe92⤵PID:3776
-
\??\c:\pvvjv.exec:\pvvjv.exe93⤵PID:2648
-
\??\c:\pdjpp.exec:\pdjpp.exe94⤵PID:4716
-
\??\c:\rlfxllf.exec:\rlfxllf.exe95⤵PID:4884
-
\??\c:\bbtnhb.exec:\bbtnhb.exe96⤵PID:2804
-
\??\c:\5hbthb.exec:\5hbthb.exe97⤵PID:2468
-
\??\c:\vjpjd.exec:\vjpjd.exe98⤵PID:3832
-
\??\c:\ppjvp.exec:\ppjvp.exe99⤵PID:1844
-
\??\c:\5ffxlxl.exec:\5ffxlxl.exe100⤵PID:4204
-
\??\c:\thhhnh.exec:\thhhnh.exe101⤵PID:2932
-
\??\c:\pvvvv.exec:\pvvvv.exe102⤵PID:4832
-
\??\c:\7ddpd.exec:\7ddpd.exe103⤵PID:1400
-
\??\c:\1rlfllf.exec:\1rlfllf.exe104⤵PID:992
-
\??\c:\frlxlfr.exec:\frlxlfr.exe105⤵PID:1472
-
\??\c:\thhtnh.exec:\thhtnh.exe106⤵PID:60
-
\??\c:\dvjdp.exec:\dvjdp.exe107⤵PID:3144
-
\??\c:\3rrllfr.exec:\3rrllfr.exe108⤵PID:4276
-
\??\c:\lfllrlr.exec:\lfllrlr.exe109⤵PID:1932
-
\??\c:\1ttnnb.exec:\1ttnnb.exe110⤵PID:4908
-
\??\c:\bhtnhh.exec:\bhtnhh.exe111⤵PID:4260
-
\??\c:\dvpjv.exec:\dvpjv.exe112⤵PID:3564
-
\??\c:\jddvp.exec:\jddvp.exe113⤵PID:3040
-
\??\c:\lxrfxrl.exec:\lxrfxrl.exe114⤵PID:1080
-
\??\c:\xffxrrr.exec:\xffxrrr.exe115⤵PID:1152
-
\??\c:\httnhh.exec:\httnhh.exe116⤵PID:2280
-
\??\c:\ppjjv.exec:\ppjjv.exe117⤵PID:4492
-
\??\c:\jvvjd.exec:\jvvjd.exe118⤵PID:4476
-
\??\c:\lxflflr.exec:\lxflflr.exe119⤵PID:3480
-
\??\c:\3ttttn.exec:\3ttttn.exe120⤵PID:3160
-
\??\c:\5nnbhh.exec:\5nnbhh.exe121⤵PID:2888
-
\??\c:\5hbtnt.exec:\5hbtnt.exe122⤵PID:2456
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-