Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30-05-2024 22:06
Behavioral task
behavioral1
Sample
6a3b73961aaf59a68034c98cea3f1a30_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
6 signatures
150 seconds
General
-
Target
6a3b73961aaf59a68034c98cea3f1a30_NeikiAnalytics.exe
-
Size
487KB
-
MD5
6a3b73961aaf59a68034c98cea3f1a30
-
SHA1
0a78f5c8625735cc39e3fb1e05966803d747e260
-
SHA256
61113d46fac84c03255967f8d498b74667f5352e20cd16eb90dec8db2150c181
-
SHA512
c823195fcd1a51cc5f168efe73b2480dc732391a1c4a270862127bf9f4797fb35dcf3644cf2f6a218fb69fd91601becdb49a54202544bbb6d75c95f1f84769fb
-
SSDEEP
6144:n3C9BRo7tvnJ9oH0IRgZvjkUo7tvnJ9oH0IiVByq9CPobNVlv:n3C9ytvngQjgtvngSV3CPobNVp
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/4040-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4040-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4032-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4804-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3604-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4884-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4884-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3120-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3120-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1892-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/376-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4252-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/216-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1584-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2480-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4116-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1120-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1668-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3720-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4980-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1884-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/516-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4032 rffxxxr.exe 4804 nhnhbb.exe 3604 9xffllr.exe 4348 nhhbtt.exe 4884 pjpjd.exe 1796 xllxlxr.exe 3120 5ttnnn.exe 4976 ttttnn.exe 4796 tnhbtt.exe 1892 xrrrlll.exe 376 9vpjd.exe 4252 rrxffll.exe 3264 7jddv.exe 216 hnnhbt.exe 4756 3vvvp.exe 4068 5lrlxrl.exe 2608 pdjdd.exe 1584 7xfllrr.exe 2480 bhbthb.exe 4632 pdvdj.exe 4116 fxxxrrr.exe 1120 7hhnnb.exe 1668 1djdj.exe 1196 1dvpj.exe 3720 pvdpd.exe 516 nhthtn.exe 1884 3lfxrrl.exe 4980 tntnbn.exe 4196 hhthbb.exe 4532 pjppv.exe 4516 lffxrrl.exe 2968 tnbthb.exe 3984 dvjdj.exe 1944 3ppjv.exe 832 nhttnn.exe 4016 3tbthb.exe 4476 3vdvv.exe 3604 1fxrllf.exe 4360 tnhbtn.exe 1888 9pjdv.exe 2724 pjdpj.exe 5052 5hhtbt.exe 3592 pdvpd.exe 436 rrrxrll.exe 4636 frrlffx.exe 3836 nbhhbt.exe 1484 jddjd.exe 4080 rrxrfxr.exe 1804 btnthn.exe 2792 jdppv.exe 3312 jjvpv.exe 392 7flfllf.exe 2252 jdpjd.exe 5028 7llxrlf.exe 2020 xlfrfff.exe 3468 bnnhhb.exe 1720 jddpj.exe 4028 lffxllx.exe 4328 nbbttt.exe 1904 vvpjd.exe 4652 rlrxlfl.exe 1952 bthtth.exe 4892 nbnbhb.exe 3388 vdddv.exe -
resource yara_rule behavioral2/memory/4040-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4804-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3604-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4884-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4884-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1796-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3120-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3120-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4796-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1892-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/376-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4252-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1584-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2480-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4116-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1120-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1668-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3720-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1884-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-181-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4040 wrote to memory of 4032 4040 6a3b73961aaf59a68034c98cea3f1a30_NeikiAnalytics.exe 82 PID 4040 wrote to memory of 4032 4040 6a3b73961aaf59a68034c98cea3f1a30_NeikiAnalytics.exe 82 PID 4040 wrote to memory of 4032 4040 6a3b73961aaf59a68034c98cea3f1a30_NeikiAnalytics.exe 82 PID 4032 wrote to memory of 4804 4032 rffxxxr.exe 83 PID 4032 wrote to memory of 4804 4032 rffxxxr.exe 83 PID 4032 wrote to memory of 4804 4032 rffxxxr.exe 83 PID 4804 wrote to memory of 3604 4804 nhnhbb.exe 84 PID 4804 wrote to memory of 3604 4804 nhnhbb.exe 84 PID 4804 wrote to memory of 3604 4804 nhnhbb.exe 84 PID 3604 wrote to memory of 4348 3604 9xffllr.exe 85 PID 3604 wrote to memory of 4348 3604 9xffllr.exe 85 PID 3604 wrote to memory of 4348 3604 9xffllr.exe 85 PID 4348 wrote to memory of 4884 4348 nhhbtt.exe 86 PID 4348 wrote to memory of 4884 4348 nhhbtt.exe 86 PID 4348 wrote to memory of 4884 4348 nhhbtt.exe 86 PID 4884 wrote to memory of 1796 4884 pjpjd.exe 87 PID 4884 wrote to memory of 1796 4884 pjpjd.exe 87 PID 4884 wrote to memory of 1796 4884 pjpjd.exe 87 PID 1796 wrote to memory of 3120 1796 xllxlxr.exe 88 PID 1796 wrote to memory of 3120 1796 xllxlxr.exe 88 PID 1796 wrote to memory of 3120 1796 xllxlxr.exe 88 PID 3120 wrote to memory of 4976 3120 5ttnnn.exe 89 PID 3120 wrote to memory of 4976 3120 5ttnnn.exe 89 PID 3120 wrote to memory of 4976 3120 5ttnnn.exe 89 PID 4976 wrote to memory of 4796 4976 ttttnn.exe 90 PID 4976 wrote to memory of 4796 4976 ttttnn.exe 90 PID 4976 wrote to memory of 4796 4976 ttttnn.exe 90 PID 4796 wrote to memory of 1892 4796 tnhbtt.exe 91 PID 4796 wrote to memory of 1892 4796 tnhbtt.exe 91 PID 4796 wrote to memory of 1892 4796 tnhbtt.exe 91 PID 1892 wrote to memory of 376 1892 xrrrlll.exe 92 PID 1892 wrote to memory of 376 1892 xrrrlll.exe 92 PID 1892 wrote to memory of 376 1892 xrrrlll.exe 92 PID 376 wrote to memory of 4252 376 9vpjd.exe 93 PID 376 wrote to memory of 4252 376 9vpjd.exe 93 PID 376 wrote to memory of 4252 376 9vpjd.exe 93 PID 4252 wrote to memory of 3264 4252 rrxffll.exe 95 PID 4252 wrote to memory of 3264 4252 rrxffll.exe 95 PID 4252 wrote to memory of 3264 4252 rrxffll.exe 95 PID 3264 wrote to memory of 216 3264 7jddv.exe 97 PID 3264 wrote to memory of 216 3264 7jddv.exe 97 PID 3264 wrote to memory of 216 3264 7jddv.exe 97 PID 216 wrote to memory of 4756 216 hnnhbt.exe 98 PID 216 wrote to memory of 4756 216 hnnhbt.exe 98 PID 216 wrote to memory of 4756 216 hnnhbt.exe 98 PID 4756 wrote to memory of 4068 4756 3vvvp.exe 100 PID 4756 wrote to memory of 4068 4756 3vvvp.exe 100 PID 4756 wrote to memory of 4068 4756 3vvvp.exe 100 PID 4068 wrote to memory of 2608 4068 5lrlxrl.exe 101 PID 4068 wrote to memory of 2608 4068 5lrlxrl.exe 101 PID 4068 wrote to memory of 2608 4068 5lrlxrl.exe 101 PID 2608 wrote to memory of 1584 2608 pdjdd.exe 102 PID 2608 wrote to memory of 1584 2608 pdjdd.exe 102 PID 2608 wrote to memory of 1584 2608 pdjdd.exe 102 PID 1584 wrote to memory of 2480 1584 7xfllrr.exe 103 PID 1584 wrote to memory of 2480 1584 7xfllrr.exe 103 PID 1584 wrote to memory of 2480 1584 7xfllrr.exe 103 PID 2480 wrote to memory of 4632 2480 bhbthb.exe 104 PID 2480 wrote to memory of 4632 2480 bhbthb.exe 104 PID 2480 wrote to memory of 4632 2480 bhbthb.exe 104 PID 4632 wrote to memory of 4116 4632 pdvdj.exe 105 PID 4632 wrote to memory of 4116 4632 pdvdj.exe 105 PID 4632 wrote to memory of 4116 4632 pdvdj.exe 105 PID 4116 wrote to memory of 1120 4116 fxxxrrr.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a3b73961aaf59a68034c98cea3f1a30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6a3b73961aaf59a68034c98cea3f1a30_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\rffxxxr.exec:\rffxxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\nhnhbb.exec:\nhnhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\9xffllr.exec:\9xffllr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\nhhbtt.exec:\nhhbtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\pjpjd.exec:\pjpjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\xllxlxr.exec:\xllxlxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\5ttnnn.exec:\5ttnnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\ttttnn.exec:\ttttnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\tnhbtt.exec:\tnhbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\xrrrlll.exec:\xrrrlll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\9vpjd.exec:\9vpjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\rrxffll.exec:\rrxffll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\7jddv.exec:\7jddv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
\??\c:\hnnhbt.exec:\hnnhbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\3vvvp.exec:\3vvvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\5lrlxrl.exec:\5lrlxrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\pdjdd.exec:\pdjdd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\7xfllrr.exec:\7xfllrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\bhbthb.exec:\bhbthb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\pdvdj.exec:\pdvdj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\fxxxrrr.exec:\fxxxrrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\7hhnnb.exec:\7hhnnb.exe23⤵
- Executes dropped EXE
PID:1120 -
\??\c:\1djdj.exec:\1djdj.exe24⤵
- Executes dropped EXE
PID:1668 -
\??\c:\1dvpj.exec:\1dvpj.exe25⤵
- Executes dropped EXE
PID:1196 -
\??\c:\pvdpd.exec:\pvdpd.exe26⤵
- Executes dropped EXE
PID:3720 -
\??\c:\nhthtn.exec:\nhthtn.exe27⤵
- Executes dropped EXE
PID:516 -
\??\c:\3lfxrrl.exec:\3lfxrrl.exe28⤵
- Executes dropped EXE
PID:1884 -
\??\c:\tntnbn.exec:\tntnbn.exe29⤵
- Executes dropped EXE
PID:4980 -
\??\c:\hhthbb.exec:\hhthbb.exe30⤵
- Executes dropped EXE
PID:4196 -
\??\c:\pjppv.exec:\pjppv.exe31⤵
- Executes dropped EXE
PID:4532 -
\??\c:\lffxrrl.exec:\lffxrrl.exe32⤵
- Executes dropped EXE
PID:4516 -
\??\c:\tnbthb.exec:\tnbthb.exe33⤵
- Executes dropped EXE
PID:2968 -
\??\c:\dvjdj.exec:\dvjdj.exe34⤵
- Executes dropped EXE
PID:3984 -
\??\c:\3ppjv.exec:\3ppjv.exe35⤵
- Executes dropped EXE
PID:1944 -
\??\c:\nhttnn.exec:\nhttnn.exe36⤵
- Executes dropped EXE
PID:832 -
\??\c:\3tbthb.exec:\3tbthb.exe37⤵
- Executes dropped EXE
PID:4016 -
\??\c:\3vdvv.exec:\3vdvv.exe38⤵
- Executes dropped EXE
PID:4476 -
\??\c:\1fxrllf.exec:\1fxrllf.exe39⤵
- Executes dropped EXE
PID:3604 -
\??\c:\tnhbtn.exec:\tnhbtn.exe40⤵
- Executes dropped EXE
PID:4360 -
\??\c:\9pjdv.exec:\9pjdv.exe41⤵
- Executes dropped EXE
PID:1888 -
\??\c:\pjdpj.exec:\pjdpj.exe42⤵
- Executes dropped EXE
PID:2724 -
\??\c:\5hhtbt.exec:\5hhtbt.exe43⤵
- Executes dropped EXE
PID:5052 -
\??\c:\pdvpd.exec:\pdvpd.exe44⤵
- Executes dropped EXE
PID:3592 -
\??\c:\rrrxrll.exec:\rrrxrll.exe45⤵
- Executes dropped EXE
PID:436 -
\??\c:\frrlffx.exec:\frrlffx.exe46⤵
- Executes dropped EXE
PID:4636 -
\??\c:\nbhhbt.exec:\nbhhbt.exe47⤵
- Executes dropped EXE
PID:3836 -
\??\c:\jddjd.exec:\jddjd.exe48⤵
- Executes dropped EXE
PID:1484 -
\??\c:\rrxrfxr.exec:\rrxrfxr.exe49⤵
- Executes dropped EXE
PID:4080 -
\??\c:\btnthn.exec:\btnthn.exe50⤵
- Executes dropped EXE
PID:1804 -
\??\c:\jdppv.exec:\jdppv.exe51⤵
- Executes dropped EXE
PID:2792 -
\??\c:\jjvpv.exec:\jjvpv.exe52⤵
- Executes dropped EXE
PID:3312 -
\??\c:\7flfllf.exec:\7flfllf.exe53⤵
- Executes dropped EXE
PID:392 -
\??\c:\jdpjd.exec:\jdpjd.exe54⤵
- Executes dropped EXE
PID:2252 -
\??\c:\7llxrlf.exec:\7llxrlf.exe55⤵
- Executes dropped EXE
PID:5028 -
\??\c:\xlfrfff.exec:\xlfrfff.exe56⤵
- Executes dropped EXE
PID:2020 -
\??\c:\bnnhhb.exec:\bnnhhb.exe57⤵
- Executes dropped EXE
PID:3468 -
\??\c:\jddpj.exec:\jddpj.exe58⤵
- Executes dropped EXE
PID:1720 -
\??\c:\lffxllx.exec:\lffxllx.exe59⤵
- Executes dropped EXE
PID:4028 -
\??\c:\nbbttt.exec:\nbbttt.exe60⤵
- Executes dropped EXE
PID:4328 -
\??\c:\vvpjd.exec:\vvpjd.exe61⤵
- Executes dropped EXE
PID:1904 -
\??\c:\rlrxlfl.exec:\rlrxlfl.exe62⤵
- Executes dropped EXE
PID:4652 -
\??\c:\bthtth.exec:\bthtth.exe63⤵
- Executes dropped EXE
PID:1952 -
\??\c:\nbnbhb.exec:\nbnbhb.exe64⤵
- Executes dropped EXE
PID:4892 -
\??\c:\vdddv.exec:\vdddv.exe65⤵
- Executes dropped EXE
PID:3388 -
\??\c:\xflfrrl.exec:\xflfrrl.exe66⤵PID:3092
-
\??\c:\htbthb.exec:\htbthb.exe67⤵PID:2860
-
\??\c:\nbbthb.exec:\nbbthb.exe68⤵PID:2136
-
\??\c:\dvjjv.exec:\dvjjv.exe69⤵PID:1076
-
\??\c:\jjvpd.exec:\jjvpd.exe70⤵PID:1932
-
\??\c:\fffrfxr.exec:\fffrfxr.exe71⤵PID:2184
-
\??\c:\djdvp.exec:\djdvp.exe72⤵PID:2624
-
\??\c:\5ffxrlf.exec:\5ffxrlf.exe73⤵PID:1312
-
\??\c:\hthhbb.exec:\hthhbb.exe74⤵PID:3324
-
\??\c:\vjjjd.exec:\vjjjd.exe75⤵PID:1632
-
\??\c:\ppjjd.exec:\ppjjd.exe76⤵PID:1000
-
\??\c:\rrlrrlf.exec:\rrlrrlf.exe77⤵PID:2896
-
\??\c:\hhttnh.exec:\hhttnh.exe78⤵PID:2560
-
\??\c:\bbbnht.exec:\bbbnht.exe79⤵PID:1220
-
\??\c:\jpppj.exec:\jpppj.exe80⤵PID:4124
-
\??\c:\7lllflf.exec:\7lllflf.exe81⤵PID:832
-
\??\c:\xxrrlll.exec:\xxrrlll.exe82⤵PID:744
-
\??\c:\nhtbbh.exec:\nhtbbh.exe83⤵PID:3840
-
\??\c:\1bbttt.exec:\1bbttt.exe84⤵PID:4624
-
\??\c:\ddvpp.exec:\ddvpp.exe85⤵PID:1832
-
\??\c:\frlxlrl.exec:\frlxlrl.exe86⤵PID:3248
-
\??\c:\7lllffx.exec:\7lllffx.exe87⤵PID:4884
-
\??\c:\hbnnhb.exec:\hbnnhb.exe88⤵PID:2580
-
\??\c:\pjdjv.exec:\pjdjv.exe89⤵PID:4716
-
\??\c:\ppppj.exec:\ppppj.exe90⤵PID:4668
-
\??\c:\rrlfxxx.exec:\rrlfxxx.exe91⤵PID:4636
-
\??\c:\thbbtt.exec:\thbbtt.exe92⤵PID:2068
-
\??\c:\bbntnn.exec:\bbntnn.exe93⤵PID:1484
-
\??\c:\9jvjp.exec:\9jvjp.exe94⤵PID:3576
-
\??\c:\rxxxxxr.exec:\rxxxxxr.exe95⤵PID:1084
-
\??\c:\7xxrllr.exec:\7xxrllr.exe96⤵PID:1860
-
\??\c:\tthbtt.exec:\tthbtt.exe97⤵PID:2392
-
\??\c:\jdpdp.exec:\jdpdp.exe98⤵PID:2944
-
\??\c:\9rlfxxx.exec:\9rlfxxx.exe99⤵PID:3588
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe100⤵PID:976
-
\??\c:\btntbt.exec:\btntbt.exe101⤵PID:1916
-
\??\c:\vpjjj.exec:\vpjjj.exe102⤵PID:2720
-
\??\c:\3ddvv.exec:\3ddvv.exe103⤵PID:388
-
\??\c:\ffrlxxf.exec:\ffrlxxf.exe104⤵PID:748
-
\??\c:\btbbtt.exec:\btbbtt.exe105⤵PID:4004
-
\??\c:\ppppd.exec:\ppppd.exe106⤵PID:5020
-
\??\c:\xrrrlrr.exec:\xrrrlrr.exe107⤵PID:4200
-
\??\c:\3rxxrrr.exec:\3rxxrrr.exe108⤵PID:1368
-
\??\c:\5nbtbb.exec:\5nbtbb.exe109⤵PID:4672
-
\??\c:\7dvpd.exec:\7dvpd.exe110⤵PID:4036
-
\??\c:\dppdj.exec:\dppdj.exe111⤵PID:2340
-
\??\c:\rlxxllf.exec:\rlxxllf.exe112⤵PID:1076
-
\??\c:\3nttnn.exec:\3nttnn.exe113⤵PID:3720
-
\??\c:\bbnhtt.exec:\bbnhtt.exe114⤵PID:4412
-
\??\c:\1dpdj.exec:\1dpdj.exe115⤵PID:2236
-
\??\c:\fxrrlll.exec:\fxrrlll.exe116⤵PID:3616
-
\??\c:\lllfxxr.exec:\lllfxxr.exe117⤵PID:2968
-
\??\c:\hbhbnn.exec:\hbhbnn.exe118⤵PID:1068
-
\??\c:\vvvpv.exec:\vvvpv.exe119⤵PID:1988
-
\??\c:\xxxrfff.exec:\xxxrfff.exe120⤵PID:4160
-
\??\c:\llrlxrr.exec:\llrlxrr.exe121⤵PID:4072
-
\??\c:\5bbbtb.exec:\5bbbtb.exe122⤵PID:4644
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-