Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
20/05/2024, 10:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e54ae86212c2e30aef9435df2ff7e7e0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
- Target e54ae86212c2e30aef9435df2ff7e7e0_NeikiAnalytics.exe
- Size 116KB
- Sample240520-l83v2afe8v
- SHA256 08fbc2cdc276b6d5edc3b66e8b59dd9e41b2ddbd3824f8c8a273073cdf4991b6
- MD5 e54ae86212c2e30aef9435df2ff7e7e0
- SHA1 95ef366dadebc8ca9ae9c316f2075d7039ba03bc
- SHA512 bfe4fcb87bd0a24c2f24420f01c6876e07327f8275e693373d344cf7059737d065d7ae3db3ae3c306888ddbaf361f12ae93c4a412ee81c7aa77f89e9848f6a15
- SSDEEP 3072:ymb3NkkiQ3mdBjFosxXGPXbXQMFHLgDWSmjlkFn:n3C9BRosxW8MFHLMWvlm
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/3716-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3480-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4540-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2544-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1484-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4272-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3372-58-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3776-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2192-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2412-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4140-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4144-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4252-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4500-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3432-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4872-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1576-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1444-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3724-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2304-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3208-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3428-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1752-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3880-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4684-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 3480 lxxrflr.exe 2544 tttnnh.exe 4540 lllxfxx.exe 2192 pjvvv.exe 3776 xxlfllx.exe 1484 ttbntt.exe 3372 pjvvd.exe 4272 xrxfrfl.exe 4836 lflllrr.exe 4844 btbhbb.exe 2412 ddppp.exe 4140 xxrflfl.exe 4144 hnnhtt.exe 4252 jppdv.exe 4500 lrrlllf.exe 3432 btnttn.exe 4872 jjvpd.exe 1576 5nbntt.exe 1444 tbhttt.exe 3724 fllrrxl.exe 2304 htbhhn.exe 3208 nhntbn.exe 888 xlrrlxr.exe 4676 hthbbb.exe 3428 vjpdd.exe 3060 lrllxfl.exe 1752 bbtbtn.exe 5056 vpjjj.exe 3880 vpjdv.exe 4684 xrlxlfr.exe 3956 lrrxlfl.exe 3612 nntbht.exe 1864 pvjvv.exe 2140 lrfrrxl.exe 4924 hbbnbn.exe 1228 hbtttt.exe 1152 jdppp.exe 2496 dpvdd.exe 1188 ffxfrxx.exe 3196 nnnbbn.exe 4436 tnbhhn.exe 3924 jdppj.exe 3772 vvjvp.exe 1452 rxxlxrf.exe 4472 bbnhht.exe 2324 pjjjd.exe 1632 pppdd.exe 4304 3lxlflf.exe 2196 7xlrrff.exe 4360 bbtbbb.exe 264 jvvdv.exe 852 rxflfrl.exe 4776 xlflffr.exe 2012 nhbttb.exe 4844 hbnnht.exe 2412 7djjd.exe 2940 rlfxrlf.exe 5092 bttnhh.exe 520 btnttt.exe 1264 vdjdj.exe 2580 lxxrlfx.exe 2504 xfrllfl.exe 3028 bntttb.exe 1184 dvjjv.exe -
resource yara_rule behavioral2/memory/3716-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3480-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2544-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2544-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2544-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4540-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2544-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1484-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4272-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3776-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2192-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2412-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4140-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4144-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4252-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3432-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4872-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1576-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1444-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3724-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2304-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3208-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3428-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3880-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4684-199-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3716 wrote to memory of 3480 3716 e54ae86212c2e30aef9435df2ff7e7e0_NeikiAnalytics.exe 83 PID 3716 wrote to memory of 3480 3716 e54ae86212c2e30aef9435df2ff7e7e0_NeikiAnalytics.exe 83 PID 3716 wrote to memory of 3480 3716 e54ae86212c2e30aef9435df2ff7e7e0_NeikiAnalytics.exe 83 PID 3480 wrote to memory of 2544 3480 lxxrflr.exe 84 PID 3480 wrote to memory of 2544 3480 lxxrflr.exe 84 PID 3480 wrote to memory of 2544 3480 lxxrflr.exe 84 PID 2544 wrote to memory of 4540 2544 tttnnh.exe 85 PID 2544 wrote to memory of 4540 2544 tttnnh.exe 85 PID 2544 wrote to memory of 4540 2544 tttnnh.exe 85 PID 4540 wrote to memory of 2192 4540 lllxfxx.exe 86 PID 4540 wrote to memory of 2192 4540 lllxfxx.exe 86 PID 4540 wrote to memory of 2192 4540 lllxfxx.exe 86 PID 2192 wrote to memory of 3776 2192 pjvvv.exe 87 PID 2192 wrote to memory of 3776 2192 pjvvv.exe 87 PID 2192 wrote to memory of 3776 2192 pjvvv.exe 87 PID 3776 wrote to memory of 1484 3776 xxlfllx.exe 88 PID 3776 wrote to memory of 1484 3776 xxlfllx.exe 88 PID 3776 wrote to memory of 1484 3776 xxlfllx.exe 88 PID 1484 wrote to memory of 3372 1484 ttbntt.exe 89 PID 1484 wrote to memory of 3372 1484 ttbntt.exe 89 PID 1484 wrote to memory of 3372 1484 ttbntt.exe 89 PID 3372 wrote to memory of 4272 3372 pjvvd.exe 90 PID 3372 wrote to memory of 4272 3372 pjvvd.exe 90 PID 3372 wrote to memory of 4272 3372 pjvvd.exe 90 PID 4272 wrote to memory of 4836 4272 xrxfrfl.exe 92 PID 4272 wrote to memory of 4836 4272 xrxfrfl.exe 92 PID 4272 wrote to memory of 4836 4272 xrxfrfl.exe 92 PID 4836 wrote to memory of 4844 4836 lflllrr.exe 93 PID 4836 wrote to memory of 4844 4836 lflllrr.exe 93 PID 4836 wrote to memory of 4844 4836 lflllrr.exe 93 PID 4844 wrote to memory of 2412 4844 btbhbb.exe 94 PID 4844 wrote to memory of 2412 4844 btbhbb.exe 94 PID 4844 wrote to memory of 2412 4844 btbhbb.exe 94 PID 2412 wrote to memory of 4140 2412 ddppp.exe 95 PID 2412 wrote to memory of 4140 2412 ddppp.exe 95 PID 2412 wrote to memory of 4140 2412 ddppp.exe 95 PID 4140 wrote to memory of 4144 4140 xxrflfl.exe 96 PID 4140 wrote to memory of 4144 4140 xxrflfl.exe 96 PID 4140 wrote to memory of 4144 4140 xxrflfl.exe 96 PID 4144 wrote to memory of 4252 4144 hnnhtt.exe 97 PID 4144 wrote to memory of 4252 4144 hnnhtt.exe 97 PID 4144 wrote to memory of 4252 4144 hnnhtt.exe 97 PID 4252 wrote to memory of 4500 4252 jppdv.exe 98 PID 4252 wrote to memory of 4500 4252 jppdv.exe 98 PID 4252 wrote to memory of 4500 4252 jppdv.exe 98 PID 4500 wrote to memory of 3432 4500 lrrlllf.exe 99 PID 4500 wrote to memory of 3432 4500 lrrlllf.exe 99 PID 4500 wrote to memory of 3432 4500 lrrlllf.exe 99 PID 3432 wrote to memory of 4872 3432 btnttn.exe 100 PID 3432 wrote to memory of 4872 3432 btnttn.exe 100 PID 3432 wrote to memory of 4872 3432 btnttn.exe 100 PID 4872 wrote to memory of 1576 4872 jjvpd.exe 102 PID 4872 wrote to memory of 1576 4872 jjvpd.exe 102 PID 4872 wrote to memory of 1576 4872 jjvpd.exe 102 PID 1576 wrote to memory of 1444 1576 5nbntt.exe 103 PID 1576 wrote to memory of 1444 1576 5nbntt.exe 103 PID 1576 wrote to memory of 1444 1576 5nbntt.exe 103 PID 1444 wrote to memory of 3724 1444 tbhttt.exe 104 PID 1444 wrote to memory of 3724 1444 tbhttt.exe 104 PID 1444 wrote to memory of 3724 1444 tbhttt.exe 104 PID 3724 wrote to memory of 2304 3724 fllrrxl.exe 105 PID 3724 wrote to memory of 2304 3724 fllrrxl.exe 105 PID 3724 wrote to memory of 2304 3724 fllrrxl.exe 105 PID 2304 wrote to memory of 3208 2304 htbhhn.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\e54ae86212c2e30aef9435df2ff7e7e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e54ae86212c2e30aef9435df2ff7e7e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\lxxrflr.exec:\lxxrflr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\tttnnh.exec:\tttnnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\lllxfxx.exec:\lllxfxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\pjvvv.exec:\pjvvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\xxlfllx.exec:\xxlfllx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\ttbntt.exec:\ttbntt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\pjvvd.exec:\pjvvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\xrxfrfl.exec:\xrxfrfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\lflllrr.exec:\lflllrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\btbhbb.exec:\btbhbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\ddppp.exec:\ddppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\xxrflfl.exec:\xxrflfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\hnnhtt.exec:\hnnhtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
\??\c:\jppdv.exec:\jppdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\lrrlllf.exec:\lrrlllf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\btnttn.exec:\btnttn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\jjvpd.exec:\jjvpd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\5nbntt.exec:\5nbntt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\tbhttt.exec:\tbhttt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\fllrrxl.exec:\fllrrxl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
\??\c:\htbhhn.exec:\htbhhn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\nhntbn.exec:\nhntbn.exe23⤵
- Executes dropped EXE
PID:3208 -
\??\c:\xlrrlxr.exec:\xlrrlxr.exe24⤵
- Executes dropped EXE
PID:888 -
\??\c:\hthbbb.exec:\hthbbb.exe25⤵
- Executes dropped EXE
PID:4676 -
\??\c:\vjpdd.exec:\vjpdd.exe26⤵
- Executes dropped EXE
PID:3428 -
\??\c:\lrllxfl.exec:\lrllxfl.exe27⤵
- Executes dropped EXE
PID:3060 -
\??\c:\bbtbtn.exec:\bbtbtn.exe28⤵
- Executes dropped EXE
PID:1752 -
\??\c:\vpjjj.exec:\vpjjj.exe29⤵
- Executes dropped EXE
PID:5056 -
\??\c:\vpjdv.exec:\vpjdv.exe30⤵
- Executes dropped EXE
PID:3880 -
\??\c:\xrlxlfr.exec:\xrlxlfr.exe31⤵
- Executes dropped EXE
PID:4684 -
\??\c:\lrrxlfl.exec:\lrrxlfl.exe32⤵
- Executes dropped EXE
PID:3956 -
\??\c:\nntbht.exec:\nntbht.exe33⤵
- Executes dropped EXE
PID:3612 -
\??\c:\pvjvv.exec:\pvjvv.exe34⤵
- Executes dropped EXE
PID:1864 -
\??\c:\lrfrrxl.exec:\lrfrrxl.exe35⤵
- Executes dropped EXE
PID:2140 -
\??\c:\hbbnbn.exec:\hbbnbn.exe36⤵
- Executes dropped EXE
PID:4924 -
\??\c:\hbtttt.exec:\hbtttt.exe37⤵
- Executes dropped EXE
PID:1228 -
\??\c:\jdppp.exec:\jdppp.exe38⤵
- Executes dropped EXE
PID:1152 -
\??\c:\dpvdd.exec:\dpvdd.exe39⤵
- Executes dropped EXE
PID:2496 -
\??\c:\ffxfrxx.exec:\ffxfrxx.exe40⤵
- Executes dropped EXE
PID:1188 -
\??\c:\nnnbbn.exec:\nnnbbn.exe41⤵
- Executes dropped EXE
PID:3196 -
\??\c:\tnbhhn.exec:\tnbhhn.exe42⤵
- Executes dropped EXE
PID:4436 -
\??\c:\jdppj.exec:\jdppj.exe43⤵
- Executes dropped EXE
PID:3924 -
\??\c:\vvjvp.exec:\vvjvp.exe44⤵
- Executes dropped EXE
PID:3772 -
\??\c:\rxxlxrf.exec:\rxxlxrf.exe45⤵
- Executes dropped EXE
PID:1452 -
\??\c:\bbnhht.exec:\bbnhht.exe46⤵
- Executes dropped EXE
PID:4472 -
\??\c:\pjjjd.exec:\pjjjd.exe47⤵
- Executes dropped EXE
PID:2324 -
\??\c:\pppdd.exec:\pppdd.exe48⤵
- Executes dropped EXE
PID:1632 -
\??\c:\3lxlflf.exec:\3lxlflf.exe49⤵
- Executes dropped EXE
PID:4304 -
\??\c:\7xlrrff.exec:\7xlrrff.exe50⤵
- Executes dropped EXE
PID:2196 -
\??\c:\bbtbbb.exec:\bbtbbb.exe51⤵
- Executes dropped EXE
PID:4360 -
\??\c:\jvvdv.exec:\jvvdv.exe52⤵
- Executes dropped EXE
PID:264 -
\??\c:\rxflfrl.exec:\rxflfrl.exe53⤵
- Executes dropped EXE
PID:852 -
\??\c:\xlflffr.exec:\xlflffr.exe54⤵
- Executes dropped EXE
PID:4776 -
\??\c:\nhbttb.exec:\nhbttb.exe55⤵
- Executes dropped EXE
PID:2012 -
\??\c:\hbnnht.exec:\hbnnht.exe56⤵
- Executes dropped EXE
PID:4844 -
\??\c:\7djjd.exec:\7djjd.exe57⤵
- Executes dropped EXE
PID:2412 -
\??\c:\rlfxrlf.exec:\rlfxrlf.exe58⤵
- Executes dropped EXE
PID:2940 -
\??\c:\bttnhh.exec:\bttnhh.exe59⤵
- Executes dropped EXE
PID:5092 -
\??\c:\btnttt.exec:\btnttt.exe60⤵
- Executes dropped EXE
PID:520 -
\??\c:\vdjdj.exec:\vdjdj.exe61⤵
- Executes dropped EXE
PID:1264 -
\??\c:\lxxrlfx.exec:\lxxrlfx.exe62⤵
- Executes dropped EXE
PID:2580 -
\??\c:\xfrllfl.exec:\xfrllfl.exe63⤵
- Executes dropped EXE
PID:2504 -
\??\c:\bntttb.exec:\bntttb.exe64⤵
- Executes dropped EXE
PID:3028 -
\??\c:\dvjjv.exec:\dvjjv.exe65⤵
- Executes dropped EXE
PID:1184 -
\??\c:\vdddd.exec:\vdddd.exe66⤵PID:1196
-
\??\c:\ffrxxxx.exec:\ffrxxxx.exe67⤵PID:4236
-
\??\c:\tnnttt.exec:\tnnttt.exe68⤵PID:4672
-
\??\c:\pdjdd.exec:\pdjdd.exe69⤵PID:872
-
\??\c:\rlxllrr.exec:\rlxllrr.exe70⤵PID:3520
-
\??\c:\1ntbtt.exec:\1ntbtt.exe71⤵PID:3088
-
\??\c:\nbbthh.exec:\nbbthh.exe72⤵PID:888
-
\??\c:\1jjdj.exec:\1jjdj.exe73⤵PID:4676
-
\??\c:\llrfxrl.exec:\llrfxrl.exe74⤵PID:3752
-
\??\c:\nnbtth.exec:\nnbtth.exe75⤵PID:3524
-
\??\c:\hhbhnb.exec:\hhbhnb.exe76⤵PID:3000
-
\??\c:\djvdp.exec:\djvdp.exe77⤵PID:2284
-
\??\c:\rfxffll.exec:\rfxffll.exe78⤵PID:5056
-
\??\c:\tbbnht.exec:\tbbnht.exe79⤵PID:3880
-
\??\c:\5bnhnb.exec:\5bnhnb.exe80⤵PID:4684
-
\??\c:\dvppj.exec:\dvppj.exe81⤵PID:4008
-
\??\c:\1frlrfl.exec:\1frlrfl.exe82⤵PID:1344
-
\??\c:\bbhtnb.exec:\bbhtnb.exe83⤵PID:1244
-
\??\c:\bhhhtb.exec:\bhhhtb.exe84⤵PID:4420
-
\??\c:\vjpdp.exec:\vjpdp.exe85⤵PID:3264
-
\??\c:\xfrllrr.exec:\xfrllrr.exe86⤵PID:2140
-
\??\c:\hnbbnn.exec:\hnbbnn.exe87⤵PID:3608
-
\??\c:\jpdjj.exec:\jpdjj.exe88⤵PID:4328
-
\??\c:\vvjjv.exec:\vvjjv.exe89⤵PID:4340
-
\??\c:\rflflff.exec:\rflflff.exe90⤵PID:2596
-
\??\c:\hbntth.exec:\hbntth.exe91⤵PID:1560
-
\??\c:\hhnhbb.exec:\hhnhbb.exe92⤵PID:4064
-
\??\c:\jpvvp.exec:\jpvvp.exe93⤵PID:4436
-
\??\c:\ppddv.exec:\ppddv.exe94⤵PID:4372
-
\??\c:\rrrllff.exec:\rrrllff.exe95⤵PID:4540
-
\??\c:\nnhhhn.exec:\nnhhhn.exe96⤵PID:1644
-
\??\c:\nhnnnn.exec:\nhnnnn.exe97⤵PID:3776
-
\??\c:\ddjjd.exec:\ddjjd.exe98⤵PID:4708
-
\??\c:\3llllll.exec:\3llllll.exe99⤵PID:4896
-
\??\c:\9rxrrfx.exec:\9rxrrfx.exe100⤵PID:4360
-
\??\c:\hbbtnh.exec:\hbbtnh.exe101⤵PID:2152
-
\??\c:\9hnhtt.exec:\9hnhtt.exe102⤵PID:4836
-
\??\c:\vpjdv.exec:\vpjdv.exe103⤵PID:1808
-
\??\c:\ppvvd.exec:\ppvvd.exe104⤵PID:3992
-
\??\c:\9xlffff.exec:\9xlffff.exe105⤵PID:4844
-
\??\c:\bbhnhb.exec:\bbhnhb.exe106⤵PID:4164
-
\??\c:\xxrlffx.exec:\xxrlffx.exe107⤵PID:4688
-
\??\c:\5xrlffx.exec:\5xrlffx.exe108⤵PID:4040
-
\??\c:\bntnnn.exec:\bntnnn.exe109⤵PID:2092
-
\??\c:\jpddj.exec:\jpddj.exe110⤵PID:3432
-
\??\c:\3pppd.exec:\3pppd.exe111⤵PID:1760
-
\??\c:\lxffxxx.exec:\lxffxxx.exe112⤵PID:4872
-
\??\c:\nhtnhh.exec:\nhtnhh.exe113⤵PID:664
-
\??\c:\jvpvp.exec:\jvpvp.exe114⤵PID:1092
-
\??\c:\xfxlfll.exec:\xfxlfll.exe115⤵PID:4960
-
\??\c:\frlrrxf.exec:\frlrrxf.exe116⤵PID:2624
-
\??\c:\hhnhnt.exec:\hhnhnt.exe117⤵PID:3208
-
\??\c:\bnbtnb.exec:\bnbtnb.exe118⤵PID:2204
-
\??\c:\dddpd.exec:\dddpd.exe119⤵PID:4044
-
\??\c:\rfxrlfl.exec:\rfxrlfl.exe120⤵PID:888
-
\??\c:\ddpjj.exec:\ddpjj.exe121⤵PID:1528
-
\??\c:\1xllrrr.exec:\1xllrrr.exe122⤵PID:5104
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-