Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 22:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6be826529daad59455168e12fb86bbf0_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
6be826529daad59455168e12fb86bbf0_NeikiAnalytics.exe
-
Size
59KB
-
MD5
6be826529daad59455168e12fb86bbf0
-
SHA1
48ec0d4d2c7f7c3564a3006d4948b327c00d3bbf
-
SHA256
0170eb96e3b819c1bd6490e8baa518d635d2548a28398b1282e262cd76c0089c
-
SHA512
bb8d3b46298792672f160bae05f83f58c35707ed938692a7a1be0a2abf1e81f96a9a5ce4bfacf4c5cee582087c2f2e6b56fc2380c60a91ec2d55fd23031970a7
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsImshz:ymb3NkkiQ3mdBjFIsIFhz
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/4604-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2188-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3544-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4224-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3084-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4368-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1852-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2556-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3376-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/656-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3672-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4640-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3088-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4052-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4244-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1048-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3280-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3908-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1052-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3908 frlxlff.exe 4604 nnnnht.exe 2188 ddjdd.exe 5108 rfrxflr.exe 396 7nhbtt.exe 3280 pjdvp.exe 3544 xlxrxxx.exe 4224 bhhbtb.exe 4428 pvjjd.exe 3452 rrflxxr.exe 1048 9nnbnb.exe 3084 hbbbbn.exe 2368 vvjjd.exe 3440 1lrxffl.exe 4368 hbbtth.exe 1852 pvjpj.exe 4244 xrfxrrr.exe 4052 1xfrrll.exe 2556 hbtbht.exe 3088 vjpjd.exe 4640 frrfxxl.exe 4420 1hbthb.exe 3672 bbttnn.exe 2300 vjvpp.exe 656 5ffxrxx.exe 3376 xllllrx.exe 1728 nnnhtb.exe 2216 jjpdd.exe 4836 7jdvj.exe 3008 rlllfff.exe 3788 nbbtnh.exe 2896 3tnhtt.exe 2564 pdpjj.exe 4552 fxllxfr.exe 2196 7flfrlf.exe 4948 ththbt.exe 2136 dpjjp.exe 1820 dppjv.exe 2532 xffrlfx.exe 4612 tbtnhn.exe 3808 tnbtnt.exe 2852 ppvjp.exe 4316 xlffxrr.exe 3472 ffxflfx.exe 1508 hnbnht.exe 3056 htbntn.exe 1020 pdvdv.exe 2840 dppjv.exe 2732 frfrlff.exe 2620 lrlxrlx.exe 3768 tthhhh.exe 4620 thnhbb.exe 1332 htnntt.exe 2580 pddvp.exe 4648 vvpjj.exe 1976 frxrrxr.exe 64 ttttnh.exe 4200 7tnhtt.exe 1292 tnbbht.exe 4416 pvdvv.exe 1428 5xlfxxr.exe 2152 xlrllff.exe 2892 nhnbnn.exe 3928 jddvd.exe -
resource yara_rule behavioral2/memory/1052-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2188-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4224-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4224-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4224-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4428-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3084-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1852-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2556-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3376-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/656-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4052-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1048-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3280-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3908-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1052-9-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1052 wrote to memory of 3908 1052 6be826529daad59455168e12fb86bbf0_NeikiAnalytics.exe 82 PID 1052 wrote to memory of 3908 1052 6be826529daad59455168e12fb86bbf0_NeikiAnalytics.exe 82 PID 1052 wrote to memory of 3908 1052 6be826529daad59455168e12fb86bbf0_NeikiAnalytics.exe 82 PID 3908 wrote to memory of 4604 3908 frlxlff.exe 83 PID 3908 wrote to memory of 4604 3908 frlxlff.exe 83 PID 3908 wrote to memory of 4604 3908 frlxlff.exe 83 PID 4604 wrote to memory of 2188 4604 nnnnht.exe 84 PID 4604 wrote to memory of 2188 4604 nnnnht.exe 84 PID 4604 wrote to memory of 2188 4604 nnnnht.exe 84 PID 2188 wrote to memory of 5108 2188 ddjdd.exe 178 PID 2188 wrote to memory of 5108 2188 ddjdd.exe 178 PID 2188 wrote to memory of 5108 2188 ddjdd.exe 178 PID 5108 wrote to memory of 396 5108 rfrxflr.exe 86 PID 5108 wrote to memory of 396 5108 rfrxflr.exe 86 PID 5108 wrote to memory of 396 5108 rfrxflr.exe 86 PID 396 wrote to memory of 3280 396 7nhbtt.exe 232 PID 396 wrote to memory of 3280 396 7nhbtt.exe 232 PID 396 wrote to memory of 3280 396 7nhbtt.exe 232 PID 3280 wrote to memory of 3544 3280 pjdvp.exe 376 PID 3280 wrote to memory of 3544 3280 pjdvp.exe 376 PID 3280 wrote to memory of 3544 3280 pjdvp.exe 376 PID 3544 wrote to memory of 4224 3544 xlxrxxx.exe 375 PID 3544 wrote to memory of 4224 3544 xlxrxxx.exe 375 PID 3544 wrote to memory of 4224 3544 xlxrxxx.exe 375 PID 4224 wrote to memory of 4428 4224 bhhbtb.exe 187 PID 4224 wrote to memory of 4428 4224 bhhbtb.exe 187 PID 4224 wrote to memory of 4428 4224 bhhbtb.exe 187 PID 4428 wrote to memory of 3452 4428 pvjjd.exe 91 PID 4428 wrote to memory of 3452 4428 pvjjd.exe 91 PID 4428 wrote to memory of 3452 4428 pvjjd.exe 91 PID 3452 wrote to memory of 1048 3452 rrflxxr.exe 333 PID 3452 wrote to memory of 1048 3452 rrflxxr.exe 333 PID 3452 wrote to memory of 1048 3452 rrflxxr.exe 333 PID 1048 wrote to memory of 3084 1048 9nnbnb.exe 94 PID 1048 wrote to memory of 3084 1048 9nnbnb.exe 94 PID 1048 wrote to memory of 3084 1048 9nnbnb.exe 94 PID 3084 wrote to memory of 2368 3084 hbbbbn.exe 381 PID 3084 wrote to memory of 2368 3084 hbbbbn.exe 381 PID 3084 wrote to memory of 2368 3084 hbbbbn.exe 381 PID 2368 wrote to memory of 3440 2368 vvjjd.exe 194 PID 2368 wrote to memory of 3440 2368 vvjjd.exe 194 PID 2368 wrote to memory of 3440 2368 vvjjd.exe 194 PID 3440 wrote to memory of 4368 3440 1lrxffl.exe 97 PID 3440 wrote to memory of 4368 3440 1lrxffl.exe 97 PID 3440 wrote to memory of 4368 3440 1lrxffl.exe 97 PID 4368 wrote to memory of 1852 4368 hbbtth.exe 99 PID 4368 wrote to memory of 1852 4368 hbbtth.exe 99 PID 4368 wrote to memory of 1852 4368 hbbtth.exe 99 PID 1852 wrote to memory of 4244 1852 pvjpj.exe 100 PID 1852 wrote to memory of 4244 1852 pvjpj.exe 100 PID 1852 wrote to memory of 4244 1852 pvjpj.exe 100 PID 4244 wrote to memory of 4052 4244 xrfxrrr.exe 101 PID 4244 wrote to memory of 4052 4244 xrfxrrr.exe 101 PID 4244 wrote to memory of 4052 4244 xrfxrrr.exe 101 PID 4052 wrote to memory of 2556 4052 1xfrrll.exe 102 PID 4052 wrote to memory of 2556 4052 1xfrrll.exe 102 PID 4052 wrote to memory of 2556 4052 1xfrrll.exe 102 PID 2556 wrote to memory of 3088 2556 hbtbht.exe 344 PID 2556 wrote to memory of 3088 2556 hbtbht.exe 344 PID 2556 wrote to memory of 3088 2556 hbtbht.exe 344 PID 3088 wrote to memory of 4640 3088 vjpjd.exe 388 PID 3088 wrote to memory of 4640 3088 vjpjd.exe 388 PID 3088 wrote to memory of 4640 3088 vjpjd.exe 388 PID 4640 wrote to memory of 4420 4640 frrfxxl.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\6be826529daad59455168e12fb86bbf0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6be826529daad59455168e12fb86bbf0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\frlxlff.exec:\frlxlff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
\??\c:\nnnnht.exec:\nnnnht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\ddjdd.exec:\ddjdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\rfrxflr.exec:\rfrxflr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\7nhbtt.exec:\7nhbtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\pjdvp.exec:\pjdvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\xlxrxxx.exec:\xlxrxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
\??\c:\bhhbtb.exec:\bhhbtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\pvjjd.exec:\pvjjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\rrflxxr.exec:\rrflxxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\9nnbnb.exec:\9nnbnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\hbbbbn.exec:\hbbbbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\vvjjd.exec:\vvjjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\1lrxffl.exec:\1lrxffl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\hbbtth.exec:\hbbtth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\pvjpj.exec:\pvjpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\xrfxrrr.exec:\xrfxrrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
\??\c:\1xfrrll.exec:\1xfrrll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\hbtbht.exec:\hbtbht.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\vjpjd.exec:\vjpjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\frrfxxl.exec:\frrfxxl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\1hbthb.exec:\1hbthb.exe23⤵
- Executes dropped EXE
PID:4420 -
\??\c:\bbttnn.exec:\bbttnn.exe24⤵
- Executes dropped EXE
PID:3672 -
\??\c:\vjvpp.exec:\vjvpp.exe25⤵
- Executes dropped EXE
PID:2300 -
\??\c:\5ffxrxx.exec:\5ffxrxx.exe26⤵
- Executes dropped EXE
PID:656 -
\??\c:\xllllrx.exec:\xllllrx.exe27⤵
- Executes dropped EXE
PID:3376 -
\??\c:\nnnhtb.exec:\nnnhtb.exe28⤵
- Executes dropped EXE
PID:1728 -
\??\c:\jjpdd.exec:\jjpdd.exe29⤵
- Executes dropped EXE
PID:2216 -
\??\c:\7jdvj.exec:\7jdvj.exe30⤵
- Executes dropped EXE
PID:4836 -
\??\c:\rlllfff.exec:\rlllfff.exe31⤵
- Executes dropped EXE
PID:3008 -
\??\c:\nbbtnh.exec:\nbbtnh.exe32⤵
- Executes dropped EXE
PID:3788 -
\??\c:\3tnhtt.exec:\3tnhtt.exe33⤵
- Executes dropped EXE
PID:2896 -
\??\c:\pdpjj.exec:\pdpjj.exe34⤵
- Executes dropped EXE
PID:2564 -
\??\c:\fxllxfr.exec:\fxllxfr.exe35⤵
- Executes dropped EXE
PID:4552 -
\??\c:\7flfrlf.exec:\7flfrlf.exe36⤵
- Executes dropped EXE
PID:2196 -
\??\c:\ththbt.exec:\ththbt.exe37⤵
- Executes dropped EXE
PID:4948 -
\??\c:\dpjjp.exec:\dpjjp.exe38⤵
- Executes dropped EXE
PID:2136 -
\??\c:\dppjv.exec:\dppjv.exe39⤵
- Executes dropped EXE
PID:1820 -
\??\c:\xffrlfx.exec:\xffrlfx.exe40⤵
- Executes dropped EXE
PID:2532 -
\??\c:\tbtnhn.exec:\tbtnhn.exe41⤵
- Executes dropped EXE
PID:4612 -
\??\c:\tnbtnt.exec:\tnbtnt.exe42⤵
- Executes dropped EXE
PID:3808 -
\??\c:\ppvjp.exec:\ppvjp.exe43⤵
- Executes dropped EXE
PID:2852 -
\??\c:\xlffxrr.exec:\xlffxrr.exe44⤵
- Executes dropped EXE
PID:4316 -
\??\c:\ffxflfx.exec:\ffxflfx.exe45⤵
- Executes dropped EXE
PID:3472 -
\??\c:\hnbnht.exec:\hnbnht.exe46⤵
- Executes dropped EXE
PID:1508 -
\??\c:\htbntn.exec:\htbntn.exe47⤵
- Executes dropped EXE
PID:3056 -
\??\c:\pdvdv.exec:\pdvdv.exe48⤵
- Executes dropped EXE
PID:1020 -
\??\c:\dppjv.exec:\dppjv.exe49⤵
- Executes dropped EXE
PID:2840 -
\??\c:\frfrlff.exec:\frfrlff.exe50⤵
- Executes dropped EXE
PID:2732 -
\??\c:\lrlxrlx.exec:\lrlxrlx.exe51⤵
- Executes dropped EXE
PID:2620 -
\??\c:\tthhhh.exec:\tthhhh.exe52⤵
- Executes dropped EXE
PID:3768 -
\??\c:\thnhbb.exec:\thnhbb.exe53⤵
- Executes dropped EXE
PID:4620 -
\??\c:\htnntt.exec:\htnntt.exe54⤵
- Executes dropped EXE
PID:1332 -
\??\c:\pddvp.exec:\pddvp.exe55⤵
- Executes dropped EXE
PID:2580 -
\??\c:\vvpjj.exec:\vvpjj.exe56⤵
- Executes dropped EXE
PID:4648 -
\??\c:\frxrrxr.exec:\frxrrxr.exe57⤵
- Executes dropped EXE
PID:1976 -
\??\c:\ttttnh.exec:\ttttnh.exe58⤵
- Executes dropped EXE
PID:64 -
\??\c:\7tnhtt.exec:\7tnhtt.exe59⤵
- Executes dropped EXE
PID:4200 -
\??\c:\tnbbht.exec:\tnbbht.exe60⤵
- Executes dropped EXE
PID:1292 -
\??\c:\pvdvv.exec:\pvdvv.exe61⤵
- Executes dropped EXE
PID:4416 -
\??\c:\5xlfxxr.exec:\5xlfxxr.exe62⤵
- Executes dropped EXE
PID:1428 -
\??\c:\xlrllff.exec:\xlrllff.exe63⤵
- Executes dropped EXE
PID:2152 -
\??\c:\nhnbnn.exec:\nhnbnn.exe64⤵
- Executes dropped EXE
PID:2892 -
\??\c:\jddvd.exec:\jddvd.exe65⤵
- Executes dropped EXE
PID:3928 -
\??\c:\vjvpj.exec:\vjvpj.exe66⤵PID:976
-
\??\c:\ffflflx.exec:\ffflflx.exe67⤵PID:2964
-
\??\c:\xxllxrf.exec:\xxllxrf.exe68⤵PID:2224
-
\??\c:\tntnhb.exec:\tntnhb.exe69⤵PID:4332
-
\??\c:\dvddv.exec:\dvddv.exe70⤵PID:3068
-
\??\c:\vvvpj.exec:\vvvpj.exe71⤵PID:4536
-
\??\c:\rxrfrrx.exec:\rxrfrrx.exe72⤵PID:2644
-
\??\c:\5rrlllf.exec:\5rrlllf.exe73⤵PID:4348
-
\??\c:\htttnt.exec:\htttnt.exe74⤵PID:2300
-
\??\c:\7btthb.exec:\7btthb.exe75⤵PID:748
-
\??\c:\jpvpj.exec:\jpvpj.exe76⤵PID:4564
-
\??\c:\xfrxfll.exec:\xfrxfll.exe77⤵PID:5100
-
\??\c:\3bnbbh.exec:\3bnbbh.exe78⤵PID:3368
-
\??\c:\9ppvp.exec:\9ppvp.exe79⤵PID:3080
-
\??\c:\rfrffrf.exec:\rfrffrf.exe80⤵PID:2584
-
\??\c:\fxrfrlr.exec:\fxrfrlr.exe81⤵PID:5020
-
\??\c:\1hntnh.exec:\1hntnh.exe82⤵PID:2408
-
\??\c:\tnnhhb.exec:\tnnhhb.exe83⤵PID:3436
-
\??\c:\vjvpj.exec:\vjvpj.exe84⤵PID:1644
-
\??\c:\lxlfllr.exec:\lxlfllr.exe85⤵PID:3856
-
\??\c:\xxrffxl.exec:\xxrffxl.exe86⤵PID:3648
-
\??\c:\lrxrrfx.exec:\lrxrrfx.exe87⤵PID:2632
-
\??\c:\ntbhnb.exec:\ntbhnb.exe88⤵PID:3848
-
\??\c:\djjjj.exec:\djjjj.exe89⤵PID:3164
-
\??\c:\pvjpd.exec:\pvjpd.exe90⤵PID:4492
-
\??\c:\rffxlll.exec:\rffxlll.exe91⤵PID:1052
-
\??\c:\xffxrrl.exec:\xffxrrl.exe92⤵PID:4988
-
\??\c:\btnhbb.exec:\btnhbb.exe93⤵PID:3900
-
\??\c:\bhbtnh.exec:\bhbtnh.exe94⤵PID:1116
-
\??\c:\jvvjd.exec:\jvvjd.exe95⤵PID:5108
-
\??\c:\djjjp.exec:\djjjp.exe96⤵PID:3148
-
\??\c:\rlflrrl.exec:\rlflrrl.exe97⤵PID:4904
-
\??\c:\lxrfxxx.exec:\lxrfxxx.exe98⤵PID:4748
-
\??\c:\tnttbn.exec:\tnttbn.exe99⤵PID:1768
-
\??\c:\tbnnhh.exec:\tbnnhh.exe100⤵PID:1388
-
\??\c:\1vddj.exec:\1vddj.exe101⤵PID:440
-
\??\c:\1vdvd.exec:\1vdvd.exe102⤵PID:1868
-
\??\c:\7xxrfxx.exec:\7xxrfxx.exe103⤵PID:4624
-
\??\c:\7rfxxxr.exec:\7rfxxxr.exe104⤵PID:4428
-
\??\c:\xllxrrx.exec:\xllxrrx.exe105⤵PID:2276
-
\??\c:\5ttnnt.exec:\5ttnnt.exe106⤵PID:4544
-
\??\c:\bttbtt.exec:\bttbtt.exe107⤵PID:4512
-
\??\c:\1jppj.exec:\1jppj.exe108⤵PID:5068
-
\??\c:\pjjdv.exec:\pjjdv.exe109⤵PID:4952
-
\??\c:\llxfxrr.exec:\llxfxrr.exe110⤵PID:3984
-
\??\c:\3xrlffr.exec:\3xrlffr.exe111⤵PID:3440
-
\??\c:\7hbtnn.exec:\7hbtnn.exe112⤵PID:4932
-
\??\c:\bbtnnh.exec:\bbtnnh.exe113⤵PID:1928
-
\??\c:\vpvvp.exec:\vpvvp.exe114⤵PID:4136
-
\??\c:\jvpvj.exec:\jvpvj.exe115⤵PID:2892
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe116⤵PID:4700
-
\??\c:\1ffxlfx.exec:\1ffxlfx.exe117⤵PID:4628
-
\??\c:\nbthbb.exec:\nbthbb.exe118⤵PID:4976
-
\??\c:\9nthtb.exec:\9nthtb.exe119⤵PID:1368
-
\??\c:\vpddd.exec:\vpddd.exe120⤵PID:3432
-
\??\c:\jvvpj.exec:\jvvpj.exe121⤵PID:4008
-
\??\c:\1fffxxx.exec:\1fffxxx.exe122⤵PID:452
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-