Analysis
-
max time kernel
150s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 02:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
83e840db3223e5aa7b0089816fc74480_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
83e840db3223e5aa7b0089816fc74480_NeikiAnalytics.exe
-
Size
386KB
-
MD5
83e840db3223e5aa7b0089816fc74480
-
SHA1
edfcb069026a516204028bdc19a914d136ea890c
-
SHA256
9d8e91850acc745386ad1e33f9c341930df95a8102dff1bb93526fc59414c17a
-
SHA512
76e7f44e6b3e7599fb853caca9e2ec129ce94a5184714ff142f0fdfea7a21ad799ca9a06f9e1b5af9b12ce54e8680b5edb55015a8db7fe47a23b9e843b80f76e
-
SSDEEP
6144:n3C9BRIG0asYFm71mPfkVB8dKwaO5CVwthmx:n3C9uYA7okVqdKwaO5CVMhmx
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/3148-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4772-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2988-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2964-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2964-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4948-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4560-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/620-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3176-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4024-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4056-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/208-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2084-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1356-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3700-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5032-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1652-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2408-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4080-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/428-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3536-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2724-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/808-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3764-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4012-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/316-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2056-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4772 fxxxrrr.exe 2988 1nhhbb.exe 1832 dvdvp.exe 2964 xlfxrlf.exe 4948 frxlffr.exe 4560 fxlfxxl.exe 620 lllfffx.exe 3176 hhbtbb.exe 4024 5jjdv.exe 4056 5rrlrxr.exe 208 dpjdj.exe 2084 9ttbbb.exe 1548 jpddp.exe 1356 tnbbnt.exe 3700 tnbttt.exe 1904 dvvpj.exe 5032 hbbtnn.exe 4192 7ntnhh.exe 1652 fxlfxxf.exe 2408 3vjjj.exe 4080 thnnhh.exe 2008 jvdpj.exe 3536 thbthb.exe 428 djppp.exe 2724 vpvpj.exe 808 jppjp.exe 3764 5xfxxxr.exe 4012 vpdvp.exe 316 lxlfxrl.exe 2056 hbbtbb.exe 884 nnhhbb.exe 3980 pjvvd.exe 1372 jvvpj.exe 3148 7flxrlf.exe 4528 btbtbn.exe 2120 vjpvp.exe 1868 frrlffr.exe 2692 ffllffx.exe 4912 hntttb.exe 2256 dpppj.exe 1104 3jjjv.exe 4868 ffxrrll.exe 4124 tbhbtt.exe 4948 djpvp.exe 3324 vvvpd.exe 2836 ffrlffl.exe 3988 bbbnhb.exe 2932 ntnbnh.exe 5092 jpvjd.exe 5020 btbbbb.exe 4500 pjpjj.exe 624 5jdvd.exe 1176 fxfxrrr.exe 3468 thnhbt.exe 2084 ppvpj.exe 2104 rrfxllx.exe 3236 nbhbnn.exe 4412 vdjpj.exe 4664 frfxllf.exe 5088 rxllxxx.exe 2184 nhtntn.exe 968 vppjj.exe 1824 ppdpj.exe 2272 rrrlffx.exe -
resource yara_rule behavioral2/memory/3148-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4772-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2988-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2964-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2964-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2964-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2964-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4948-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/620-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3176-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4024-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4024-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4056-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/208-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2084-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1356-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3700-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5032-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1652-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2408-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4080-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/428-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3536-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2724-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/808-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3764-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/316-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2056-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3148 wrote to memory of 4772 3148 83e840db3223e5aa7b0089816fc74480_NeikiAnalytics.exe 83 PID 3148 wrote to memory of 4772 3148 83e840db3223e5aa7b0089816fc74480_NeikiAnalytics.exe 83 PID 3148 wrote to memory of 4772 3148 83e840db3223e5aa7b0089816fc74480_NeikiAnalytics.exe 83 PID 4772 wrote to memory of 2988 4772 fxxxrrr.exe 84 PID 4772 wrote to memory of 2988 4772 fxxxrrr.exe 84 PID 4772 wrote to memory of 2988 4772 fxxxrrr.exe 84 PID 2988 wrote to memory of 1832 2988 1nhhbb.exe 85 PID 2988 wrote to memory of 1832 2988 1nhhbb.exe 85 PID 2988 wrote to memory of 1832 2988 1nhhbb.exe 85 PID 1832 wrote to memory of 2964 1832 dvdvp.exe 86 PID 1832 wrote to memory of 2964 1832 dvdvp.exe 86 PID 1832 wrote to memory of 2964 1832 dvdvp.exe 86 PID 2964 wrote to memory of 4948 2964 xlfxrlf.exe 87 PID 2964 wrote to memory of 4948 2964 xlfxrlf.exe 87 PID 2964 wrote to memory of 4948 2964 xlfxrlf.exe 87 PID 4948 wrote to memory of 4560 4948 frxlffr.exe 88 PID 4948 wrote to memory of 4560 4948 frxlffr.exe 88 PID 4948 wrote to memory of 4560 4948 frxlffr.exe 88 PID 4560 wrote to memory of 620 4560 fxlfxxl.exe 89 PID 4560 wrote to memory of 620 4560 fxlfxxl.exe 89 PID 4560 wrote to memory of 620 4560 fxlfxxl.exe 89 PID 620 wrote to memory of 3176 620 lllfffx.exe 90 PID 620 wrote to memory of 3176 620 lllfffx.exe 90 PID 620 wrote to memory of 3176 620 lllfffx.exe 90 PID 3176 wrote to memory of 4024 3176 hhbtbb.exe 91 PID 3176 wrote to memory of 4024 3176 hhbtbb.exe 91 PID 3176 wrote to memory of 4024 3176 hhbtbb.exe 91 PID 4024 wrote to memory of 4056 4024 5jjdv.exe 92 PID 4024 wrote to memory of 4056 4024 5jjdv.exe 92 PID 4024 wrote to memory of 4056 4024 5jjdv.exe 92 PID 4056 wrote to memory of 208 4056 5rrlrxr.exe 93 PID 4056 wrote to memory of 208 4056 5rrlrxr.exe 93 PID 4056 wrote to memory of 208 4056 5rrlrxr.exe 93 PID 208 wrote to memory of 2084 208 dpjdj.exe 94 PID 208 wrote to memory of 2084 208 dpjdj.exe 94 PID 208 wrote to memory of 2084 208 dpjdj.exe 94 PID 2084 wrote to memory of 1548 2084 9ttbbb.exe 95 PID 2084 wrote to memory of 1548 2084 9ttbbb.exe 95 PID 2084 wrote to memory of 1548 2084 9ttbbb.exe 95 PID 1548 wrote to memory of 1356 1548 jpddp.exe 96 PID 1548 wrote to memory of 1356 1548 jpddp.exe 96 PID 1548 wrote to memory of 1356 1548 jpddp.exe 96 PID 1356 wrote to memory of 3700 1356 tnbbnt.exe 98 PID 1356 wrote to memory of 3700 1356 tnbbnt.exe 98 PID 1356 wrote to memory of 3700 1356 tnbbnt.exe 98 PID 3700 wrote to memory of 1904 3700 tnbttt.exe 99 PID 3700 wrote to memory of 1904 3700 tnbttt.exe 99 PID 3700 wrote to memory of 1904 3700 tnbttt.exe 99 PID 1904 wrote to memory of 5032 1904 dvvpj.exe 100 PID 1904 wrote to memory of 5032 1904 dvvpj.exe 100 PID 1904 wrote to memory of 5032 1904 dvvpj.exe 100 PID 5032 wrote to memory of 4192 5032 hbbtnn.exe 101 PID 5032 wrote to memory of 4192 5032 hbbtnn.exe 101 PID 5032 wrote to memory of 4192 5032 hbbtnn.exe 101 PID 4192 wrote to memory of 1652 4192 7ntnhh.exe 102 PID 4192 wrote to memory of 1652 4192 7ntnhh.exe 102 PID 4192 wrote to memory of 1652 4192 7ntnhh.exe 102 PID 1652 wrote to memory of 2408 1652 fxlfxxf.exe 103 PID 1652 wrote to memory of 2408 1652 fxlfxxf.exe 103 PID 1652 wrote to memory of 2408 1652 fxlfxxf.exe 103 PID 2408 wrote to memory of 4080 2408 3vjjj.exe 104 PID 2408 wrote to memory of 4080 2408 3vjjj.exe 104 PID 2408 wrote to memory of 4080 2408 3vjjj.exe 104 PID 4080 wrote to memory of 2008 4080 thnnhh.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\83e840db3223e5aa7b0089816fc74480_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\83e840db3223e5aa7b0089816fc74480_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\fxxxrrr.exec:\fxxxrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\1nhhbb.exec:\1nhhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\dvdvp.exec:\dvdvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\xlfxrlf.exec:\xlfxrlf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\frxlffr.exec:\frxlffr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\fxlfxxl.exec:\fxlfxxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\lllfffx.exec:\lllfffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
\??\c:\hhbtbb.exec:\hhbtbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\5jjdv.exec:\5jjdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\5rrlrxr.exec:\5rrlrxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\dpjdj.exec:\dpjdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\9ttbbb.exec:\9ttbbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\jpddp.exec:\jpddp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\tnbbnt.exec:\tnbbnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\tnbttt.exec:\tnbttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\dvvpj.exec:\dvvpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\hbbtnn.exec:\hbbtnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\7ntnhh.exec:\7ntnhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\fxlfxxf.exec:\fxlfxxf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\3vjjj.exec:\3vjjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\thnnhh.exec:\thnnhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\jvdpj.exec:\jvdpj.exe23⤵
- Executes dropped EXE
PID:2008 -
\??\c:\thbthb.exec:\thbthb.exe24⤵
- Executes dropped EXE
PID:3536 -
\??\c:\djppp.exec:\djppp.exe25⤵
- Executes dropped EXE
PID:428 -
\??\c:\vpvpj.exec:\vpvpj.exe26⤵
- Executes dropped EXE
PID:2724 -
\??\c:\jppjp.exec:\jppjp.exe27⤵
- Executes dropped EXE
PID:808 -
\??\c:\5xfxxxr.exec:\5xfxxxr.exe28⤵
- Executes dropped EXE
PID:3764 -
\??\c:\vpdvp.exec:\vpdvp.exe29⤵
- Executes dropped EXE
PID:4012 -
\??\c:\lxlfxrl.exec:\lxlfxrl.exe30⤵
- Executes dropped EXE
PID:316 -
\??\c:\hbbtbb.exec:\hbbtbb.exe31⤵
- Executes dropped EXE
PID:2056 -
\??\c:\nnhhbb.exec:\nnhhbb.exe32⤵
- Executes dropped EXE
PID:884 -
\??\c:\pjvvd.exec:\pjvvd.exe33⤵
- Executes dropped EXE
PID:3980 -
\??\c:\jvvpj.exec:\jvvpj.exe34⤵
- Executes dropped EXE
PID:1372 -
\??\c:\7flxrlf.exec:\7flxrlf.exe35⤵
- Executes dropped EXE
PID:3148 -
\??\c:\btbtbn.exec:\btbtbn.exe36⤵
- Executes dropped EXE
PID:4528 -
\??\c:\vjpvp.exec:\vjpvp.exe37⤵
- Executes dropped EXE
PID:2120 -
\??\c:\frrlffr.exec:\frrlffr.exe38⤵
- Executes dropped EXE
PID:1868 -
\??\c:\ffllffx.exec:\ffllffx.exe39⤵
- Executes dropped EXE
PID:2692 -
\??\c:\hntttb.exec:\hntttb.exe40⤵
- Executes dropped EXE
PID:4912 -
\??\c:\dpppj.exec:\dpppj.exe41⤵
- Executes dropped EXE
PID:2256 -
\??\c:\3jjjv.exec:\3jjjv.exe42⤵
- Executes dropped EXE
PID:1104 -
\??\c:\ffxrrll.exec:\ffxrrll.exe43⤵
- Executes dropped EXE
PID:4868 -
\??\c:\tbhbtt.exec:\tbhbtt.exe44⤵
- Executes dropped EXE
PID:4124 -
\??\c:\djpvp.exec:\djpvp.exe45⤵
- Executes dropped EXE
PID:4948 -
\??\c:\vvvpd.exec:\vvvpd.exe46⤵
- Executes dropped EXE
PID:3324 -
\??\c:\ffrlffl.exec:\ffrlffl.exe47⤵
- Executes dropped EXE
PID:2836 -
\??\c:\bbbnhb.exec:\bbbnhb.exe48⤵
- Executes dropped EXE
PID:3988 -
\??\c:\ntnbnh.exec:\ntnbnh.exe49⤵
- Executes dropped EXE
PID:2932 -
\??\c:\jpvjd.exec:\jpvjd.exe50⤵
- Executes dropped EXE
PID:5092 -
\??\c:\btbbbb.exec:\btbbbb.exe51⤵
- Executes dropped EXE
PID:5020 -
\??\c:\pjpjj.exec:\pjpjj.exe52⤵
- Executes dropped EXE
PID:4500 -
\??\c:\5jdvd.exec:\5jdvd.exe53⤵
- Executes dropped EXE
PID:624 -
\??\c:\fxfxrrr.exec:\fxfxrrr.exe54⤵
- Executes dropped EXE
PID:1176 -
\??\c:\thnhbt.exec:\thnhbt.exe55⤵
- Executes dropped EXE
PID:3468 -
\??\c:\ppvpj.exec:\ppvpj.exe56⤵
- Executes dropped EXE
PID:2084 -
\??\c:\rrfxllx.exec:\rrfxllx.exe57⤵
- Executes dropped EXE
PID:2104 -
\??\c:\nbhbnn.exec:\nbhbnn.exe58⤵
- Executes dropped EXE
PID:3236 -
\??\c:\vdjpj.exec:\vdjpj.exe59⤵
- Executes dropped EXE
PID:4412 -
\??\c:\frfxllf.exec:\frfxllf.exe60⤵
- Executes dropped EXE
PID:4664 -
\??\c:\rxllxxx.exec:\rxllxxx.exe61⤵
- Executes dropped EXE
PID:5088 -
\??\c:\nhtntn.exec:\nhtntn.exe62⤵
- Executes dropped EXE
PID:2184 -
\??\c:\vppjj.exec:\vppjj.exe63⤵
- Executes dropped EXE
PID:968 -
\??\c:\ppdpj.exec:\ppdpj.exe64⤵
- Executes dropped EXE
PID:1824 -
\??\c:\rrrlffx.exec:\rrrlffx.exe65⤵
- Executes dropped EXE
PID:2272 -
\??\c:\nbbtnn.exec:\nbbtnn.exe66⤵PID:1204
-
\??\c:\jpvjd.exec:\jpvjd.exe67⤵PID:4000
-
\??\c:\pjjdv.exec:\pjjdv.exe68⤵PID:3440
-
\??\c:\rlrfxfl.exec:\rlrfxfl.exe69⤵PID:3612
-
\??\c:\htttbb.exec:\htttbb.exe70⤵PID:1756
-
\??\c:\nhbttn.exec:\nhbttn.exe71⤵PID:1380
-
\??\c:\vppjv.exec:\vppjv.exe72⤵PID:4584
-
\??\c:\lxfxlrl.exec:\lxfxlrl.exe73⤵PID:4876
-
\??\c:\lrxrrrl.exec:\lrxrrrl.exe74⤵PID:2148
-
\??\c:\hbhbtt.exec:\hbhbtt.exe75⤵PID:3764
-
\??\c:\jvpvj.exec:\jvpvj.exe76⤵PID:384
-
\??\c:\jddpj.exec:\jddpj.exe77⤵PID:4464
-
\??\c:\rflfxrr.exec:\rflfxrr.exe78⤵PID:848
-
\??\c:\bnttnn.exec:\bnttnn.exe79⤵PID:4280
-
\??\c:\hhhtnh.exec:\hhhtnh.exe80⤵PID:1944
-
\??\c:\pjjdv.exec:\pjjdv.exe81⤵PID:4296
-
\??\c:\nnhhtt.exec:\nnhhtt.exe82⤵PID:2716
-
\??\c:\tthhnh.exec:\tthhnh.exe83⤵PID:2700
-
\??\c:\jjjvp.exec:\jjjvp.exe84⤵PID:2212
-
\??\c:\lrxrllx.exec:\lrxrllx.exe85⤵PID:3076
-
\??\c:\hhhhbb.exec:\hhhhbb.exe86⤵PID:3128
-
\??\c:\5hhbtn.exec:\5hhbtn.exe87⤵PID:3108
-
\??\c:\jjpjd.exec:\jjpjd.exe88⤵PID:976
-
\??\c:\xxrrrlf.exec:\xxrrrlf.exe89⤵PID:1104
-
\??\c:\3rxrfxf.exec:\3rxrfxf.exe90⤵PID:4868
-
\??\c:\hhhbtn.exec:\hhhbtn.exe91⤵PID:4188
-
\??\c:\ddppv.exec:\ddppv.exe92⤵PID:1568
-
\??\c:\jjjpj.exec:\jjjpj.exe93⤵PID:4092
-
\??\c:\1rfrfxf.exec:\1rfrfxf.exe94⤵PID:2260
-
\??\c:\nhttbt.exec:\nhttbt.exe95⤵PID:2448
-
\??\c:\1nntbn.exec:\1nntbn.exe96⤵PID:1360
-
\??\c:\vppjj.exec:\vppjj.exe97⤵PID:4656
-
\??\c:\1xxrllf.exec:\1xxrllf.exe98⤵PID:4780
-
\??\c:\3rlfxxr.exec:\3rlfxxr.exe99⤵PID:776
-
\??\c:\nhbthb.exec:\nhbthb.exe100⤵PID:1904
-
\??\c:\jjvpv.exec:\jjvpv.exe101⤵PID:4436
-
\??\c:\rllfrll.exec:\rllfrll.exe102⤵PID:2756
-
\??\c:\1nhbtt.exec:\1nhbtt.exe103⤵PID:3132
-
\??\c:\djjdp.exec:\djjdp.exe104⤵PID:3852
-
\??\c:\9xxrrrr.exec:\9xxrrrr.exe105⤵PID:3252
-
\??\c:\lffrllf.exec:\lffrllf.exe106⤵PID:3264
-
\??\c:\djjdv.exec:\djjdv.exe107⤵PID:2356
-
\??\c:\djvjd.exec:\djvjd.exe108⤵PID:2244
-
\??\c:\lxrlxxr.exec:\lxrlxxr.exe109⤵PID:2736
-
\??\c:\5nhhbb.exec:\5nhhbb.exe110⤵PID:1732
-
\??\c:\vjjdv.exec:\vjjdv.exe111⤵PID:3708
-
\??\c:\rfrxrrl.exec:\rfrxrrl.exe112⤵PID:4216
-
\??\c:\hntnhh.exec:\hntnhh.exe113⤵PID:1984
-
\??\c:\tbhbht.exec:\tbhbht.exe114⤵PID:3628
-
\??\c:\jjpjj.exec:\jjpjj.exe115⤵PID:672
-
\??\c:\bntnnh.exec:\bntnnh.exe116⤵PID:2180
-
\??\c:\hnhhbb.exec:\hnhhbb.exe117⤵PID:1396
-
\??\c:\5dvpp.exec:\5dvpp.exe118⤵PID:1976
-
\??\c:\xxxrllf.exec:\xxxrllf.exe119⤵PID:2984
-
\??\c:\1hbthb.exec:\1hbthb.exe120⤵PID:2388
-
\??\c:\httntn.exec:\httntn.exe121⤵PID:3304
-
\??\c:\7pvpj.exec:\7pvpj.exe122⤵PID:1924
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-