Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 02:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2ced4349ede0a5881688ceb1ff3c1d80_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
2ced4349ede0a5881688ceb1ff3c1d80_NeikiAnalytics.exe
-
Size
76KB
-
MD5
2ced4349ede0a5881688ceb1ff3c1d80
-
SHA1
f093ab03f40bf9ade4e91e2c6bd7eac55a1ef845
-
SHA256
d390b731bea6a550236ef1c365a3e68a6dd08acbb68259ff2918e9e94f2b2e08
-
SHA512
4c079eceeab8304c46d5b8823f3eef001d1e8a4b12bb540f0074d427aae9754d9e4fdb5c5f2fd9718c73b069fd72157657f392914621ce38c9e78c7fbf2ed721
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrAY:ymb3NkkiQ3mdBjFIIp9L9QrrAY
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/1776-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2720-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3360-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4496-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1040-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1120-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3644-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3644-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2604-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2744-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3900-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2864-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5104-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1260-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3780-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3988-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1364-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/228-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1652-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3144-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/384-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2720 xrllfff.exe 3360 7bnbbb.exe 4496 vjdjj.exe 2592 xlllffx.exe 1040 frlrfrr.exe 5008 3nnnhh.exe 1120 xrllffx.exe 2344 lffxrlf.exe 3644 dppjj.exe 2604 jjjjp.exe 2744 xfffxfx.exe 4912 3tbnnt.exe 3900 ttnhhb.exe 4036 dpdvv.exe 5100 lrxrlll.exe 2864 nbhhbt.exe 5104 bthhhn.exe 1260 ppppp.exe 3780 pdvpp.exe 3988 flffrxx.exe 1364 thnhnn.exe 228 htbbtt.exe 1652 5ppjd.exe 4804 rlllffx.exe 3144 lrlrrxx.exe 2584 tbhthb.exe 1128 jdvvj.exe 4676 jdjvj.exe 4568 lfllllr.exe 3388 hhthbn.exe 384 5pjjd.exe 396 fxrlxxf.exe 2556 bnhbbt.exe 1252 pjvpd.exe 4408 jddvp.exe 788 ffxfxxx.exe 4592 hntnhb.exe 5068 djpdv.exe 4392 xrxrllr.exe 2028 fxrlfff.exe 4420 btnnnb.exe 4228 pjjdd.exe 2684 1jvvv.exe 3808 rxflxxr.exe 3548 fxxxrrx.exe 3928 nhttnh.exe 636 3nhthb.exe 3468 pjdvj.exe 1792 lffxrlf.exe 3052 rrrlfxr.exe 1424 9bthbt.exe 2016 btnhtn.exe 2236 djdvj.exe 4136 lfrlrrf.exe 5080 rflflfx.exe 544 tnbbtn.exe 2388 bnnhtb.exe 1772 5pjjv.exe 3796 vpjdv.exe 5104 lrfxfxr.exe 3544 xrlfrrl.exe 2768 nthnbh.exe 372 jjjjv.exe 4244 dvpjv.exe -
resource yara_rule behavioral2/memory/1776-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2720-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3360-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4496-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1040-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1040-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1040-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1120-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1120-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1120-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1120-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3644-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3644-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2744-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3900-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2864-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5104-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3780-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3988-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1364-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/228-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1652-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4568-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/384-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1776 wrote to memory of 2720 1776 2ced4349ede0a5881688ceb1ff3c1d80_NeikiAnalytics.exe 81 PID 1776 wrote to memory of 2720 1776 2ced4349ede0a5881688ceb1ff3c1d80_NeikiAnalytics.exe 81 PID 1776 wrote to memory of 2720 1776 2ced4349ede0a5881688ceb1ff3c1d80_NeikiAnalytics.exe 81 PID 2720 wrote to memory of 3360 2720 xrllfff.exe 82 PID 2720 wrote to memory of 3360 2720 xrllfff.exe 82 PID 2720 wrote to memory of 3360 2720 xrllfff.exe 82 PID 3360 wrote to memory of 4496 3360 7bnbbb.exe 83 PID 3360 wrote to memory of 4496 3360 7bnbbb.exe 83 PID 3360 wrote to memory of 4496 3360 7bnbbb.exe 83 PID 4496 wrote to memory of 2592 4496 vjdjj.exe 84 PID 4496 wrote to memory of 2592 4496 vjdjj.exe 84 PID 4496 wrote to memory of 2592 4496 vjdjj.exe 84 PID 2592 wrote to memory of 1040 2592 xlllffx.exe 85 PID 2592 wrote to memory of 1040 2592 xlllffx.exe 85 PID 2592 wrote to memory of 1040 2592 xlllffx.exe 85 PID 1040 wrote to memory of 5008 1040 frlrfrr.exe 86 PID 1040 wrote to memory of 5008 1040 frlrfrr.exe 86 PID 1040 wrote to memory of 5008 1040 frlrfrr.exe 86 PID 5008 wrote to memory of 1120 5008 3nnnhh.exe 87 PID 5008 wrote to memory of 1120 5008 3nnnhh.exe 87 PID 5008 wrote to memory of 1120 5008 3nnnhh.exe 87 PID 1120 wrote to memory of 2344 1120 xrllffx.exe 89 PID 1120 wrote to memory of 2344 1120 xrllffx.exe 89 PID 1120 wrote to memory of 2344 1120 xrllffx.exe 89 PID 2344 wrote to memory of 3644 2344 lffxrlf.exe 90 PID 2344 wrote to memory of 3644 2344 lffxrlf.exe 90 PID 2344 wrote to memory of 3644 2344 lffxrlf.exe 90 PID 3644 wrote to memory of 2604 3644 dppjj.exe 91 PID 3644 wrote to memory of 2604 3644 dppjj.exe 91 PID 3644 wrote to memory of 2604 3644 dppjj.exe 91 PID 2604 wrote to memory of 2744 2604 jjjjp.exe 92 PID 2604 wrote to memory of 2744 2604 jjjjp.exe 92 PID 2604 wrote to memory of 2744 2604 jjjjp.exe 92 PID 2744 wrote to memory of 4912 2744 xfffxfx.exe 93 PID 2744 wrote to memory of 4912 2744 xfffxfx.exe 93 PID 2744 wrote to memory of 4912 2744 xfffxfx.exe 93 PID 4912 wrote to memory of 3900 4912 3tbnnt.exe 94 PID 4912 wrote to memory of 3900 4912 3tbnnt.exe 94 PID 4912 wrote to memory of 3900 4912 3tbnnt.exe 94 PID 3900 wrote to memory of 4036 3900 ttnhhb.exe 95 PID 3900 wrote to memory of 4036 3900 ttnhhb.exe 95 PID 3900 wrote to memory of 4036 3900 ttnhhb.exe 95 PID 4036 wrote to memory of 5100 4036 dpdvv.exe 96 PID 4036 wrote to memory of 5100 4036 dpdvv.exe 96 PID 4036 wrote to memory of 5100 4036 dpdvv.exe 96 PID 5100 wrote to memory of 2864 5100 lrxrlll.exe 97 PID 5100 wrote to memory of 2864 5100 lrxrlll.exe 97 PID 5100 wrote to memory of 2864 5100 lrxrlll.exe 97 PID 2864 wrote to memory of 5104 2864 nbhhbt.exe 98 PID 2864 wrote to memory of 5104 2864 nbhhbt.exe 98 PID 2864 wrote to memory of 5104 2864 nbhhbt.exe 98 PID 5104 wrote to memory of 1260 5104 bthhhn.exe 99 PID 5104 wrote to memory of 1260 5104 bthhhn.exe 99 PID 5104 wrote to memory of 1260 5104 bthhhn.exe 99 PID 1260 wrote to memory of 3780 1260 ppppp.exe 100 PID 1260 wrote to memory of 3780 1260 ppppp.exe 100 PID 1260 wrote to memory of 3780 1260 ppppp.exe 100 PID 3780 wrote to memory of 3988 3780 pdvpp.exe 101 PID 3780 wrote to memory of 3988 3780 pdvpp.exe 101 PID 3780 wrote to memory of 3988 3780 pdvpp.exe 101 PID 3988 wrote to memory of 1364 3988 flffrxx.exe 102 PID 3988 wrote to memory of 1364 3988 flffrxx.exe 102 PID 3988 wrote to memory of 1364 3988 flffrxx.exe 102 PID 1364 wrote to memory of 228 1364 thnhnn.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ced4349ede0a5881688ceb1ff3c1d80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2ced4349ede0a5881688ceb1ff3c1d80_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\xrllfff.exec:\xrllfff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\7bnbbb.exec:\7bnbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
\??\c:\vjdjj.exec:\vjdjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\xlllffx.exec:\xlllffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\frlrfrr.exec:\frlrfrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\3nnnhh.exec:\3nnnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\xrllffx.exec:\xrllffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\lffxrlf.exec:\lffxrlf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\dppjj.exec:\dppjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\jjjjp.exec:\jjjjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\xfffxfx.exec:\xfffxfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\3tbnnt.exec:\3tbnnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\ttnhhb.exec:\ttnhhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\dpdvv.exec:\dpdvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\lrxrlll.exec:\lrxrlll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\nbhhbt.exec:\nbhhbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\bthhhn.exec:\bthhhn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\ppppp.exec:\ppppp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\pdvpp.exec:\pdvpp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
\??\c:\flffrxx.exec:\flffrxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\thnhnn.exec:\thnhnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\htbbtt.exec:\htbbtt.exe23⤵
- Executes dropped EXE
PID:228 -
\??\c:\5ppjd.exec:\5ppjd.exe24⤵
- Executes dropped EXE
PID:1652 -
\??\c:\rlllffx.exec:\rlllffx.exe25⤵
- Executes dropped EXE
PID:4804 -
\??\c:\lrlrrxx.exec:\lrlrrxx.exe26⤵
- Executes dropped EXE
PID:3144 -
\??\c:\tbhthb.exec:\tbhthb.exe27⤵
- Executes dropped EXE
PID:2584 -
\??\c:\jdvvj.exec:\jdvvj.exe28⤵
- Executes dropped EXE
PID:1128 -
\??\c:\jdjvj.exec:\jdjvj.exe29⤵
- Executes dropped EXE
PID:4676 -
\??\c:\lfllllr.exec:\lfllllr.exe30⤵
- Executes dropped EXE
PID:4568 -
\??\c:\hhthbn.exec:\hhthbn.exe31⤵
- Executes dropped EXE
PID:3388 -
\??\c:\5pjjd.exec:\5pjjd.exe32⤵
- Executes dropped EXE
PID:384 -
\??\c:\fxrlxxf.exec:\fxrlxxf.exe33⤵
- Executes dropped EXE
PID:396 -
\??\c:\bnhbbt.exec:\bnhbbt.exe34⤵
- Executes dropped EXE
PID:2556 -
\??\c:\pjvpd.exec:\pjvpd.exe35⤵
- Executes dropped EXE
PID:1252 -
\??\c:\jddvp.exec:\jddvp.exe36⤵
- Executes dropped EXE
PID:4408 -
\??\c:\ffxfxxx.exec:\ffxfxxx.exe37⤵
- Executes dropped EXE
PID:788 -
\??\c:\hntnhb.exec:\hntnhb.exe38⤵
- Executes dropped EXE
PID:4592 -
\??\c:\djpdv.exec:\djpdv.exe39⤵
- Executes dropped EXE
PID:5068 -
\??\c:\xrxrllr.exec:\xrxrllr.exe40⤵
- Executes dropped EXE
PID:4392 -
\??\c:\fxrlfff.exec:\fxrlfff.exe41⤵
- Executes dropped EXE
PID:2028 -
\??\c:\btnnnb.exec:\btnnnb.exe42⤵
- Executes dropped EXE
PID:4420 -
\??\c:\pjjdd.exec:\pjjdd.exe43⤵
- Executes dropped EXE
PID:4228 -
\??\c:\1jvvv.exec:\1jvvv.exe44⤵
- Executes dropped EXE
PID:2684 -
\??\c:\rxflxxr.exec:\rxflxxr.exe45⤵
- Executes dropped EXE
PID:3808 -
\??\c:\fxxxrrx.exec:\fxxxrrx.exe46⤵
- Executes dropped EXE
PID:3548 -
\??\c:\nhttnh.exec:\nhttnh.exe47⤵
- Executes dropped EXE
PID:3928 -
\??\c:\3nhthb.exec:\3nhthb.exe48⤵
- Executes dropped EXE
PID:636 -
\??\c:\pjdvj.exec:\pjdvj.exe49⤵
- Executes dropped EXE
PID:3468 -
\??\c:\lffxrlf.exec:\lffxrlf.exe50⤵
- Executes dropped EXE
PID:1792 -
\??\c:\rrrlfxr.exec:\rrrlfxr.exe51⤵
- Executes dropped EXE
PID:3052 -
\??\c:\9bthbt.exec:\9bthbt.exe52⤵
- Executes dropped EXE
PID:1424 -
\??\c:\btnhtn.exec:\btnhtn.exe53⤵
- Executes dropped EXE
PID:2016 -
\??\c:\djdvj.exec:\djdvj.exe54⤵
- Executes dropped EXE
PID:2236 -
\??\c:\lfrlrrf.exec:\lfrlrrf.exe55⤵
- Executes dropped EXE
PID:4136 -
\??\c:\rflflfx.exec:\rflflfx.exe56⤵
- Executes dropped EXE
PID:5080 -
\??\c:\tnbbtn.exec:\tnbbtn.exe57⤵
- Executes dropped EXE
PID:544 -
\??\c:\bnnhtb.exec:\bnnhtb.exe58⤵
- Executes dropped EXE
PID:2388 -
\??\c:\5pjjv.exec:\5pjjv.exe59⤵
- Executes dropped EXE
PID:1772 -
\??\c:\vpjdv.exec:\vpjdv.exe60⤵
- Executes dropped EXE
PID:3796 -
\??\c:\lrfxfxr.exec:\lrfxfxr.exe61⤵
- Executes dropped EXE
PID:5104 -
\??\c:\xrlfrrl.exec:\xrlfrrl.exe62⤵
- Executes dropped EXE
PID:3544 -
\??\c:\nthnbh.exec:\nthnbh.exe63⤵
- Executes dropped EXE
PID:2768 -
\??\c:\jjjjv.exec:\jjjjv.exe64⤵
- Executes dropped EXE
PID:372 -
\??\c:\dvpjv.exec:\dvpjv.exe65⤵
- Executes dropped EXE
PID:4244 -
\??\c:\llfrllf.exec:\llfrllf.exe66⤵PID:448
-
\??\c:\lffxfll.exec:\lffxfll.exe67⤵PID:736
-
\??\c:\9ttbtn.exec:\9ttbtn.exe68⤵PID:4076
-
\??\c:\hbnhtn.exec:\hbnhtn.exe69⤵PID:3160
-
\??\c:\vpdvj.exec:\vpdvj.exe70⤵PID:5092
-
\??\c:\7ffrxxx.exec:\7ffrxxx.exe71⤵PID:4092
-
\??\c:\1hnbbt.exec:\1hnbbt.exe72⤵PID:2568
-
\??\c:\vpvjv.exec:\vpvjv.exe73⤵PID:2908
-
\??\c:\lllfrlf.exec:\lllfrlf.exe74⤵PID:1552
-
\??\c:\9nnbnh.exec:\9nnbnh.exe75⤵PID:4516
-
\??\c:\ttttth.exec:\ttttth.exe76⤵PID:908
-
\??\c:\rrffffl.exec:\rrffffl.exe77⤵PID:2792
-
\??\c:\xxfxllr.exec:\xxfxllr.exe78⤵PID:2740
-
\??\c:\nttbbn.exec:\nttbbn.exe79⤵PID:384
-
\??\c:\htbhnb.exec:\htbhnb.exe80⤵PID:2468
-
\??\c:\lllfrrl.exec:\lllfrrl.exe81⤵PID:2852
-
\??\c:\xlrrfrf.exec:\xlrrfrf.exe82⤵PID:4408
-
\??\c:\nhntnh.exec:\nhntnh.exe83⤵PID:2392
-
\??\c:\nhtntn.exec:\nhtntn.exe84⤵PID:4124
-
\??\c:\jdvvj.exec:\jdvvj.exe85⤵PID:3484
-
\??\c:\dddvd.exec:\dddvd.exe86⤵PID:1756
-
\??\c:\frlxlfr.exec:\frlxlfr.exe87⤵PID:4788
-
\??\c:\hhbtth.exec:\hhbtth.exe88⤵PID:3648
-
\??\c:\9jjdp.exec:\9jjdp.exe89⤵PID:4420
-
\??\c:\frlxxrr.exec:\frlxxrr.exe90⤵PID:1204
-
\??\c:\5flfffx.exec:\5flfffx.exe91⤵PID:1508
-
\??\c:\hbbthb.exec:\hbbthb.exe92⤵PID:4544
-
\??\c:\jvpjd.exec:\jvpjd.exe93⤵PID:1388
-
\??\c:\pjvpp.exec:\pjvpp.exe94⤵PID:2020
-
\??\c:\fxffxrr.exec:\fxffxrr.exe95⤵PID:2652
-
\??\c:\fxrlffr.exec:\fxrlffr.exe96⤵PID:2904
-
\??\c:\btnbtt.exec:\btnbtt.exe97⤵PID:1444
-
\??\c:\hhnbnh.exec:\hhnbnh.exe98⤵PID:4984
-
\??\c:\djjdp.exec:\djjdp.exe99⤵PID:4548
-
\??\c:\djddp.exec:\djddp.exe100⤵PID:4876
-
\??\c:\fflxfxf.exec:\fflxfxf.exe101⤵PID:2976
-
\??\c:\9xrrrlr.exec:\9xrrrlr.exe102⤵PID:2000
-
\??\c:\1hbbbb.exec:\1hbbbb.exe103⤵PID:5060
-
\??\c:\1nhthb.exec:\1nhthb.exe104⤵PID:3900
-
\??\c:\1jdpd.exec:\1jdpd.exe105⤵PID:2460
-
\??\c:\jdddd.exec:\jdddd.exe106⤵PID:2080
-
\??\c:\1lfxffx.exec:\1lfxffx.exe107⤵PID:1360
-
\??\c:\fxxfxff.exec:\fxxfxff.exe108⤵PID:2372
-
\??\c:\bntntt.exec:\bntntt.exe109⤵PID:2892
-
\??\c:\nhhbtb.exec:\nhhbtb.exe110⤵PID:212
-
\??\c:\jddpj.exec:\jddpj.exe111⤵PID:1152
-
\??\c:\3pjdv.exec:\3pjdv.exe112⤵PID:4480
-
\??\c:\lflrfrx.exec:\lflrfrx.exe113⤵PID:116
-
\??\c:\ffrffff.exec:\ffrffff.exe114⤵PID:2212
-
\??\c:\nntbnb.exec:\nntbnb.exe115⤵PID:432
-
\??\c:\7bbbnn.exec:\7bbbnn.exe116⤵PID:4372
-
\??\c:\jpdvd.exec:\jpdvd.exe117⤵PID:3904
-
\??\c:\1vpdp.exec:\1vpdp.exe118⤵PID:1436
-
\??\c:\fxfxxrl.exec:\fxfxxrl.exe119⤵PID:4500
-
\??\c:\9xrlrlr.exec:\9xrlrlr.exe120⤵PID:1064
-
\??\c:\bbnhbt.exec:\bbnhbt.exe121⤵PID:1128
-
\??\c:\nthtbh.exec:\nthtbh.exe122⤵PID:2832
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-