Analysis
-
max time kernel
149s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21/05/2024, 09:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2b4e88f05b501e93f5d99b2671ba811cb3cf65f22766811cef39a9dfe0229211_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
2b4e88f05b501e93f5d99b2671ba811cb3cf65f22766811cef39a9dfe0229211_NeikiAnalytics.exe
-
Size
134KB
-
MD5
662b3a7ef89fe4673b736e2f459e68b0
-
SHA1
0ee957c9ee4ba64d80a86eba91639876f1d867a0
-
SHA256
2b4e88f05b501e93f5d99b2671ba811cb3cf65f22766811cef39a9dfe0229211
-
SHA512
93dfabd58466b96148b11ce000068f34f74330998499d067d1d5843b1673acb19712685ba2aad87163aeb69722c16b5ba6a14b49cae3d66c983dfe03c6e0f789
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afoHVpx+dGorn:n3C9BRW0j/1px+dGC
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/2120-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1380-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3532-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2472-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1948-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1748-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1780-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2168-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3952-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1952-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3252-6-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2072-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4092-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1840-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4208-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3024-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3832-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3164-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3392-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1652-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4476-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3468-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4076-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2120 5djdj.exe 1380 1jjjj.exe 3532 lxxrlff.exe 1780 rxxlfxl.exe 1748 hbbbtn.exe 2472 vvvpj.exe 1948 5vdvd.exe 2168 llrlxrl.exe 1952 nnbnbh.exe 3952 jpvvj.exe 1260 ppvvj.exe 2072 llrfrlx.exe 4092 bnntth.exe 1840 3dppv.exe 4208 frfxlxr.exe 3024 nhbtnt.exe 4992 pdvpv.exe 224 jjjjp.exe 4960 7llxrrl.exe 3832 nbhbbb.exe 1788 jpdvp.exe 3256 pdvvv.exe 3164 hnnnhh.exe 5044 jdjdv.exe 2928 rlrrlfx.exe 3392 rxflfxr.exe 1652 hnbnhh.exe 2468 jdpjj.exe 4476 pppjv.exe 3468 5llfxxr.exe 4076 rfllfff.exe 2716 btnhbn.exe 2000 3pjjd.exe 3504 rrfxrlf.exe 4528 fxrrllf.exe 3792 thbtnn.exe 4708 bhbbtt.exe 4584 dvdjd.exe 3592 dvdvd.exe 2432 xxlfflf.exe 1380 7btnbb.exe 4752 nbhhbt.exe 2576 jjdvp.exe 3388 jpppj.exe 3656 7fffxxx.exe 2344 xrrrllf.exe 4564 hhhtnb.exe 4072 5vvpd.exe 1304 llfxxrr.exe 4996 fxrlrrl.exe 2168 nthbtt.exe 1436 jddpj.exe 3952 jddvj.exe 1104 xxlfrlf.exe 4572 fxllrlr.exe 4128 hbbtnn.exe 3496 jjjvj.exe 4140 5pjdp.exe 1140 xxfxlfx.exe 2964 xrrrllx.exe 3516 hhhbtt.exe 8 ppjdv.exe 2152 5xlxllf.exe 3300 tntnbb.exe -
resource yara_rule behavioral2/memory/2120-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1380-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3532-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2472-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1948-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1748-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1780-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2168-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2168-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2168-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1952-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4092-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1840-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4208-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3024-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3832-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3164-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3392-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1652-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4076-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3252 wrote to memory of 2120 3252 2b4e88f05b501e93f5d99b2671ba811cb3cf65f22766811cef39a9dfe0229211_NeikiAnalytics.exe 82 PID 3252 wrote to memory of 2120 3252 2b4e88f05b501e93f5d99b2671ba811cb3cf65f22766811cef39a9dfe0229211_NeikiAnalytics.exe 82 PID 3252 wrote to memory of 2120 3252 2b4e88f05b501e93f5d99b2671ba811cb3cf65f22766811cef39a9dfe0229211_NeikiAnalytics.exe 82 PID 2120 wrote to memory of 1380 2120 5djdj.exe 83 PID 2120 wrote to memory of 1380 2120 5djdj.exe 83 PID 2120 wrote to memory of 1380 2120 5djdj.exe 83 PID 1380 wrote to memory of 3532 1380 1jjjj.exe 84 PID 1380 wrote to memory of 3532 1380 1jjjj.exe 84 PID 1380 wrote to memory of 3532 1380 1jjjj.exe 84 PID 3532 wrote to memory of 1780 3532 lxxrlff.exe 85 PID 3532 wrote to memory of 1780 3532 lxxrlff.exe 85 PID 3532 wrote to memory of 1780 3532 lxxrlff.exe 85 PID 1780 wrote to memory of 1748 1780 rxxlfxl.exe 86 PID 1780 wrote to memory of 1748 1780 rxxlfxl.exe 86 PID 1780 wrote to memory of 1748 1780 rxxlfxl.exe 86 PID 1748 wrote to memory of 2472 1748 hbbbtn.exe 87 PID 1748 wrote to memory of 2472 1748 hbbbtn.exe 87 PID 1748 wrote to memory of 2472 1748 hbbbtn.exe 87 PID 2472 wrote to memory of 1948 2472 vvvpj.exe 88 PID 2472 wrote to memory of 1948 2472 vvvpj.exe 88 PID 2472 wrote to memory of 1948 2472 vvvpj.exe 88 PID 1948 wrote to memory of 2168 1948 5vdvd.exe 89 PID 1948 wrote to memory of 2168 1948 5vdvd.exe 89 PID 1948 wrote to memory of 2168 1948 5vdvd.exe 89 PID 2168 wrote to memory of 1952 2168 llrlxrl.exe 90 PID 2168 wrote to memory of 1952 2168 llrlxrl.exe 90 PID 2168 wrote to memory of 1952 2168 llrlxrl.exe 90 PID 1952 wrote to memory of 3952 1952 nnbnbh.exe 91 PID 1952 wrote to memory of 3952 1952 nnbnbh.exe 91 PID 1952 wrote to memory of 3952 1952 nnbnbh.exe 91 PID 3952 wrote to memory of 1260 3952 jpvvj.exe 92 PID 3952 wrote to memory of 1260 3952 jpvvj.exe 92 PID 3952 wrote to memory of 1260 3952 jpvvj.exe 92 PID 1260 wrote to memory of 2072 1260 ppvvj.exe 93 PID 1260 wrote to memory of 2072 1260 ppvvj.exe 93 PID 1260 wrote to memory of 2072 1260 ppvvj.exe 93 PID 2072 wrote to memory of 4092 2072 llrfrlx.exe 94 PID 2072 wrote to memory of 4092 2072 llrfrlx.exe 94 PID 2072 wrote to memory of 4092 2072 llrfrlx.exe 94 PID 4092 wrote to memory of 1840 4092 bnntth.exe 95 PID 4092 wrote to memory of 1840 4092 bnntth.exe 95 PID 4092 wrote to memory of 1840 4092 bnntth.exe 95 PID 1840 wrote to memory of 4208 1840 3dppv.exe 96 PID 1840 wrote to memory of 4208 1840 3dppv.exe 96 PID 1840 wrote to memory of 4208 1840 3dppv.exe 96 PID 4208 wrote to memory of 3024 4208 frfxlxr.exe 97 PID 4208 wrote to memory of 3024 4208 frfxlxr.exe 97 PID 4208 wrote to memory of 3024 4208 frfxlxr.exe 97 PID 3024 wrote to memory of 4992 3024 nhbtnt.exe 98 PID 3024 wrote to memory of 4992 3024 nhbtnt.exe 98 PID 3024 wrote to memory of 4992 3024 nhbtnt.exe 98 PID 4992 wrote to memory of 224 4992 pdvpv.exe 99 PID 4992 wrote to memory of 224 4992 pdvpv.exe 99 PID 4992 wrote to memory of 224 4992 pdvpv.exe 99 PID 224 wrote to memory of 4960 224 jjjjp.exe 100 PID 224 wrote to memory of 4960 224 jjjjp.exe 100 PID 224 wrote to memory of 4960 224 jjjjp.exe 100 PID 4960 wrote to memory of 3832 4960 7llxrrl.exe 101 PID 4960 wrote to memory of 3832 4960 7llxrrl.exe 101 PID 4960 wrote to memory of 3832 4960 7llxrrl.exe 101 PID 3832 wrote to memory of 1788 3832 nbhbbb.exe 102 PID 3832 wrote to memory of 1788 3832 nbhbbb.exe 102 PID 3832 wrote to memory of 1788 3832 nbhbbb.exe 102 PID 1788 wrote to memory of 3256 1788 jpdvp.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b4e88f05b501e93f5d99b2671ba811cb3cf65f22766811cef39a9dfe0229211_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2b4e88f05b501e93f5d99b2671ba811cb3cf65f22766811cef39a9dfe0229211_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\5djdj.exec:\5djdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\1jjjj.exec:\1jjjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\lxxrlff.exec:\lxxrlff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\rxxlfxl.exec:\rxxlfxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\hbbbtn.exec:\hbbbtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\vvvpj.exec:\vvvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\5vdvd.exec:\5vdvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\llrlxrl.exec:\llrlxrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\nnbnbh.exec:\nnbnbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\jpvvj.exec:\jpvvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\ppvvj.exec:\ppvvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\llrfrlx.exec:\llrfrlx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\bnntth.exec:\bnntth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\3dppv.exec:\3dppv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\frfxlxr.exec:\frfxlxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\nhbtnt.exec:\nhbtnt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\pdvpv.exec:\pdvpv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\jjjjp.exec:\jjjjp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\7llxrrl.exec:\7llxrrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\nbhbbb.exec:\nbhbbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
\??\c:\jpdvp.exec:\jpdvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\pdvvv.exec:\pdvvv.exe23⤵
- Executes dropped EXE
PID:3256 -
\??\c:\hnnnhh.exec:\hnnnhh.exe24⤵
- Executes dropped EXE
PID:3164 -
\??\c:\jdjdv.exec:\jdjdv.exe25⤵
- Executes dropped EXE
PID:5044 -
\??\c:\rlrrlfx.exec:\rlrrlfx.exe26⤵
- Executes dropped EXE
PID:2928 -
\??\c:\rxflfxr.exec:\rxflfxr.exe27⤵
- Executes dropped EXE
PID:3392 -
\??\c:\hnbnhh.exec:\hnbnhh.exe28⤵
- Executes dropped EXE
PID:1652 -
\??\c:\jdpjj.exec:\jdpjj.exe29⤵
- Executes dropped EXE
PID:2468 -
\??\c:\pppjv.exec:\pppjv.exe30⤵
- Executes dropped EXE
PID:4476 -
\??\c:\5llfxxr.exec:\5llfxxr.exe31⤵
- Executes dropped EXE
PID:3468 -
\??\c:\rfllfff.exec:\rfllfff.exe32⤵
- Executes dropped EXE
PID:4076 -
\??\c:\btnhbn.exec:\btnhbn.exe33⤵
- Executes dropped EXE
PID:2716 -
\??\c:\3pjjd.exec:\3pjjd.exe34⤵
- Executes dropped EXE
PID:2000 -
\??\c:\rrfxrlf.exec:\rrfxrlf.exe35⤵
- Executes dropped EXE
PID:3504 -
\??\c:\fxrrllf.exec:\fxrrllf.exe36⤵
- Executes dropped EXE
PID:4528 -
\??\c:\thbtnn.exec:\thbtnn.exe37⤵
- Executes dropped EXE
PID:3792 -
\??\c:\bhbbtt.exec:\bhbbtt.exe38⤵
- Executes dropped EXE
PID:4708 -
\??\c:\dvdjd.exec:\dvdjd.exe39⤵
- Executes dropped EXE
PID:4584 -
\??\c:\dvdvd.exec:\dvdvd.exe40⤵
- Executes dropped EXE
PID:3592 -
\??\c:\xxlfflf.exec:\xxlfflf.exe41⤵
- Executes dropped EXE
PID:2432 -
\??\c:\7btnbb.exec:\7btnbb.exe42⤵
- Executes dropped EXE
PID:1380 -
\??\c:\nbhhbt.exec:\nbhhbt.exe43⤵
- Executes dropped EXE
PID:4752 -
\??\c:\jjdvp.exec:\jjdvp.exe44⤵
- Executes dropped EXE
PID:2576 -
\??\c:\jpppj.exec:\jpppj.exe45⤵
- Executes dropped EXE
PID:3388 -
\??\c:\7fffxxx.exec:\7fffxxx.exe46⤵
- Executes dropped EXE
PID:3656 -
\??\c:\xrrrllf.exec:\xrrrllf.exe47⤵
- Executes dropped EXE
PID:2344 -
\??\c:\hhhtnb.exec:\hhhtnb.exe48⤵
- Executes dropped EXE
PID:4564 -
\??\c:\5vvpd.exec:\5vvpd.exe49⤵
- Executes dropped EXE
PID:4072 -
\??\c:\llfxxrr.exec:\llfxxrr.exe50⤵
- Executes dropped EXE
PID:1304 -
\??\c:\fxrlrrl.exec:\fxrlrrl.exe51⤵
- Executes dropped EXE
PID:4996 -
\??\c:\nthbtt.exec:\nthbtt.exe52⤵
- Executes dropped EXE
PID:2168 -
\??\c:\jddpj.exec:\jddpj.exe53⤵
- Executes dropped EXE
PID:1436 -
\??\c:\jddvj.exec:\jddvj.exe54⤵
- Executes dropped EXE
PID:3952 -
\??\c:\xxlfrlf.exec:\xxlfrlf.exe55⤵
- Executes dropped EXE
PID:1104 -
\??\c:\fxllrlr.exec:\fxllrlr.exe56⤵
- Executes dropped EXE
PID:4572 -
\??\c:\hbbtnn.exec:\hbbtnn.exe57⤵
- Executes dropped EXE
PID:4128 -
\??\c:\jjjvj.exec:\jjjvj.exe58⤵
- Executes dropped EXE
PID:3496 -
\??\c:\5pjdp.exec:\5pjdp.exe59⤵
- Executes dropped EXE
PID:4140 -
\??\c:\xxfxlfx.exec:\xxfxlfx.exe60⤵
- Executes dropped EXE
PID:1140 -
\??\c:\xrrrllx.exec:\xrrrllx.exe61⤵
- Executes dropped EXE
PID:2964 -
\??\c:\hhhbtt.exec:\hhhbtt.exe62⤵
- Executes dropped EXE
PID:3516 -
\??\c:\ppjdv.exec:\ppjdv.exe63⤵
- Executes dropped EXE
PID:8 -
\??\c:\5xlxllf.exec:\5xlxllf.exe64⤵
- Executes dropped EXE
PID:2152 -
\??\c:\tntnbb.exec:\tntnbb.exe65⤵
- Executes dropped EXE
PID:3300 -
\??\c:\bnbhtn.exec:\bnbhtn.exe66⤵PID:448
-
\??\c:\vdpjj.exec:\vdpjj.exe67⤵PID:4212
-
\??\c:\dppjv.exec:\dppjv.exe68⤵PID:1188
-
\??\c:\rlxrffx.exec:\rlxrffx.exe69⤵PID:3776
-
\??\c:\nbbthh.exec:\nbbthh.exe70⤵PID:4644
-
\??\c:\htthhb.exec:\htthhb.exe71⤵PID:720
-
\??\c:\jvjvv.exec:\jvjvv.exe72⤵PID:3572
-
\??\c:\xfxrrxr.exec:\xfxrrxr.exe73⤵PID:3628
-
\??\c:\bhhbtn.exec:\bhhbtn.exe74⤵PID:1980
-
\??\c:\tnnthb.exec:\tnnthb.exe75⤵PID:372
-
\??\c:\vjjjv.exec:\vjjjv.exe76⤵PID:3056
-
\??\c:\7vpvp.exec:\7vpvp.exe77⤵PID:2400
-
\??\c:\5rrfrlf.exec:\5rrfrlf.exe78⤵PID:3976
-
\??\c:\xrfxrlf.exec:\xrfxrlf.exe79⤵PID:2276
-
\??\c:\tnhbtn.exec:\tnhbtn.exe80⤵PID:3220
-
\??\c:\nhtnbb.exec:\nhtnbb.exe81⤵PID:3504
-
\??\c:\9jpjp.exec:\9jpjp.exe82⤵PID:984
-
\??\c:\5pvpd.exec:\5pvpd.exe83⤵PID:4528
-
\??\c:\xlxllrf.exec:\xlxllrf.exe84⤵PID:4456
-
\??\c:\xxxrllf.exec:\xxxrllf.exe85⤵PID:1556
-
\??\c:\hnhbtn.exec:\hnhbtn.exe86⤵PID:3252
-
\??\c:\pdpdj.exec:\pdpdj.exe87⤵PID:2304
-
\??\c:\dvvjd.exec:\dvvjd.exe88⤵PID:1976
-
\??\c:\rlfrffx.exec:\rlfrffx.exe89⤵PID:3532
-
\??\c:\rxlffxr.exec:\rxlffxr.exe90⤵PID:3452
-
\??\c:\rxxrfxf.exec:\rxxrfxf.exe91⤵PID:936
-
\??\c:\ntbbtt.exec:\ntbbtt.exe92⤵PID:2340
-
\??\c:\dpvpj.exec:\dpvpj.exe93⤵PID:4916
-
\??\c:\dvdvv.exec:\dvdvv.exe94⤵PID:4464
-
\??\c:\lxrlfxr.exec:\lxrlfxr.exe95⤵PID:208
-
\??\c:\xfllffx.exec:\xfllffx.exe96⤵PID:2164
-
\??\c:\3tnbtt.exec:\3tnbtt.exe97⤵PID:3272
-
\??\c:\hnhtth.exec:\hnhtth.exe98⤵PID:676
-
\??\c:\jvddv.exec:\jvddv.exe99⤵PID:4376
-
\??\c:\ddddp.exec:\ddddp.exe100⤵PID:1260
-
\??\c:\5xxxrxx.exec:\5xxxrxx.exe101⤵PID:1168
-
\??\c:\3xxxrll.exec:\3xxxrll.exe102⤵PID:2072
-
\??\c:\bhttnn.exec:\bhttnn.exe103⤵PID:1808
-
\??\c:\hntnhh.exec:\hntnhh.exe104⤵PID:5016
-
\??\c:\jvjjd.exec:\jvjjd.exe105⤵PID:2516
-
\??\c:\jppjd.exec:\jppjd.exe106⤵PID:2420
-
\??\c:\fxfxlll.exec:\fxfxlll.exe107⤵PID:680
-
\??\c:\xrllfff.exec:\xrllfff.exe108⤵PID:3992
-
\??\c:\hbthtn.exec:\hbthtn.exe109⤵PID:8
-
\??\c:\djjjv.exec:\djjjv.exe110⤵PID:2652
-
\??\c:\dvpdp.exec:\dvpdp.exe111⤵PID:728
-
\??\c:\fxrlxxr.exec:\fxrlxxr.exe112⤵PID:1344
-
\??\c:\lxlrrfr.exec:\lxlrrfr.exe113⤵PID:3472
-
\??\c:\bttntn.exec:\bttntn.exe114⤵PID:4212
-
\??\c:\jdjdp.exec:\jdjdp.exe115⤵PID:4060
-
\??\c:\pvvjd.exec:\pvvjd.exe116⤵PID:4364
-
\??\c:\rrrlfxx.exec:\rrrlfxx.exe117⤵PID:3776
-
\??\c:\thhtbt.exec:\thhtbt.exe118⤵PID:4644
-
\??\c:\5tbbbh.exec:\5tbbbh.exe119⤵PID:720
-
\??\c:\vjjvd.exec:\vjjvd.exe120⤵PID:3572
-
\??\c:\pddpj.exec:\pddpj.exe121⤵PID:3628
-
\??\c:\rxlfxlx.exec:\rxlfxlx.exe122⤵PID:1264
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-