Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
07/06/2024, 23:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
777aef0b15f109f3e3ec249fef6c8f40_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
- Target 777aef0b15f109f3e3ec249fef6c8f40_NeikiAnalytics.exe
- Size 229KB
- Sample240607-3k6epaeb3t
- SHA256 ac24769dd1e91568ccfe270a2b70212e49227bcb8df07ec092c47d4a7e8db1cb
- MD5 777aef0b15f109f3e3ec249fef6c8f40
- SHA1 860e9a8fad7a2ed601337c2c299b7131753eda51
- SHA512 7c0a282903b17deab76c9b36fd14494c2e470adb3e17aa823fa125ca4d40c74284fd05e9bb7e84aa567f3d778ed8870d8383e7a949cfaecbadcc3f546935e2ef
- SSDEEP 3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xLn/cta:n3C9BRo7MlrWKo+lxKkta
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/2420-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4924-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1356-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2676-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/940-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2072-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3288-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3508-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2712-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3812-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1572-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/344-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/444-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2956-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3272-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3516-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2704-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4244-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1508-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2264-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3960-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3648-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 428 lfllllf.exe 4924 bbbntn.exe 1356 tttnhn.exe 2676 3pdjj.exe 940 xxxxxxx.exe 3508 hhtthn.exe 3288 1bthtt.exe 2072 jjjdv.exe 2712 frrrffx.exe 3844 rlrrrll.exe 3812 tnnhnn.exe 1572 dvpjp.exe 4468 xxxrlrf.exe 344 nbhhhh.exe 444 xrflrrf.exe 2956 hhbtnn.exe 728 xrfxxxx.exe 4744 hhtbhh.exe 2936 9djdv.exe 3272 xxlfxfx.exe 3516 1lfxflr.exe 4652 dpvvd.exe 2704 nhtnhh.exe 4244 vdpdj.exe 1508 xxflrxr.exe 2264 xlxlrll.exe 772 vvvvd.exe 116 jjppp.exe 3960 1hnhhh.exe 2980 7hnnbn.exe 3648 vpjdv.exe 4572 rrfxxxr.exe 4780 hthbtn.exe 3700 dvvvp.exe 3260 rllllrx.exe 3584 tnttbb.exe 4900 tnbtnn.exe 1040 5pdvp.exe 3276 1pdvd.exe 4444 xrxrrrl.exe 2800 bnbbbb.exe 4928 5nnnhh.exe 4924 pjvpp.exe 2252 1rrllll.exe 4736 9rrlrlx.exe 1128 htbbhb.exe 4800 vdjvp.exe 4084 rlrxxxl.exe 1520 xrrrxxx.exe 1532 7nnnnn.exe 2072 ppppj.exe 2900 vvjdd.exe 4036 ffxrlfx.exe 1364 hnbbtt.exe 5072 pdjdv.exe 2768 vpjjd.exe 1572 ffflrrf.exe 3804 xxfxxxx.exe 4012 vjppp.exe 3620 dvvpj.exe 796 xxrlffx.exe 1836 tthttt.exe 792 bbttbt.exe 1976 dpppv.exe -
resource yara_rule behavioral2/memory/2420-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4924-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1356-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2676-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/940-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2712-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3288-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3508-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2712-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3812-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1572-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/344-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/444-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3516-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2704-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1508-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2264-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3960-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-200-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2420 wrote to memory of 428 2420 777aef0b15f109f3e3ec249fef6c8f40_NeikiAnalytics.exe 81 PID 2420 wrote to memory of 428 2420 777aef0b15f109f3e3ec249fef6c8f40_NeikiAnalytics.exe 81 PID 2420 wrote to memory of 428 2420 777aef0b15f109f3e3ec249fef6c8f40_NeikiAnalytics.exe 81 PID 428 wrote to memory of 4924 428 lfllllf.exe 82 PID 428 wrote to memory of 4924 428 lfllllf.exe 82 PID 428 wrote to memory of 4924 428 lfllllf.exe 82 PID 4924 wrote to memory of 1356 4924 bbbntn.exe 83 PID 4924 wrote to memory of 1356 4924 bbbntn.exe 83 PID 4924 wrote to memory of 1356 4924 bbbntn.exe 83 PID 1356 wrote to memory of 2676 1356 tttnhn.exe 84 PID 1356 wrote to memory of 2676 1356 tttnhn.exe 84 PID 1356 wrote to memory of 2676 1356 tttnhn.exe 84 PID 2676 wrote to memory of 940 2676 3pdjj.exe 85 PID 2676 wrote to memory of 940 2676 3pdjj.exe 85 PID 2676 wrote to memory of 940 2676 3pdjj.exe 85 PID 940 wrote to memory of 3508 940 xxxxxxx.exe 86 PID 940 wrote to memory of 3508 940 xxxxxxx.exe 86 PID 940 wrote to memory of 3508 940 xxxxxxx.exe 86 PID 3508 wrote to memory of 3288 3508 hhtthn.exe 87 PID 3508 wrote to memory of 3288 3508 hhtthn.exe 87 PID 3508 wrote to memory of 3288 3508 hhtthn.exe 87 PID 3288 wrote to memory of 2072 3288 1bthtt.exe 88 PID 3288 wrote to memory of 2072 3288 1bthtt.exe 88 PID 3288 wrote to memory of 2072 3288 1bthtt.exe 88 PID 2072 wrote to memory of 2712 2072 jjjdv.exe 89 PID 2072 wrote to memory of 2712 2072 jjjdv.exe 89 PID 2072 wrote to memory of 2712 2072 jjjdv.exe 89 PID 2712 wrote to memory of 3844 2712 frrrffx.exe 90 PID 2712 wrote to memory of 3844 2712 frrrffx.exe 90 PID 2712 wrote to memory of 3844 2712 frrrffx.exe 90 PID 3844 wrote to memory of 3812 3844 rlrrrll.exe 92 PID 3844 wrote to memory of 3812 3844 rlrrrll.exe 92 PID 3844 wrote to memory of 3812 3844 rlrrrll.exe 92 PID 3812 wrote to memory of 1572 3812 tnnhnn.exe 93 PID 3812 wrote to memory of 1572 3812 tnnhnn.exe 93 PID 3812 wrote to memory of 1572 3812 tnnhnn.exe 93 PID 1572 wrote to memory of 4468 1572 dvpjp.exe 94 PID 1572 wrote to memory of 4468 1572 dvpjp.exe 94 PID 1572 wrote to memory of 4468 1572 dvpjp.exe 94 PID 4468 wrote to memory of 344 4468 xxxrlrf.exe 96 PID 4468 wrote to memory of 344 4468 xxxrlrf.exe 96 PID 4468 wrote to memory of 344 4468 xxxrlrf.exe 96 PID 344 wrote to memory of 444 344 nbhhhh.exe 97 PID 344 wrote to memory of 444 344 nbhhhh.exe 97 PID 344 wrote to memory of 444 344 nbhhhh.exe 97 PID 444 wrote to memory of 2956 444 xrflrrf.exe 98 PID 444 wrote to memory of 2956 444 xrflrrf.exe 98 PID 444 wrote to memory of 2956 444 xrflrrf.exe 98 PID 2956 wrote to memory of 728 2956 hhbtnn.exe 99 PID 2956 wrote to memory of 728 2956 hhbtnn.exe 99 PID 2956 wrote to memory of 728 2956 hhbtnn.exe 99 PID 728 wrote to memory of 4744 728 xrfxxxx.exe 100 PID 728 wrote to memory of 4744 728 xrfxxxx.exe 100 PID 728 wrote to memory of 4744 728 xrfxxxx.exe 100 PID 4744 wrote to memory of 2936 4744 hhtbhh.exe 101 PID 4744 wrote to memory of 2936 4744 hhtbhh.exe 101 PID 4744 wrote to memory of 2936 4744 hhtbhh.exe 101 PID 2936 wrote to memory of 3272 2936 9djdv.exe 103 PID 2936 wrote to memory of 3272 2936 9djdv.exe 103 PID 2936 wrote to memory of 3272 2936 9djdv.exe 103 PID 3272 wrote to memory of 3516 3272 xxlfxfx.exe 104 PID 3272 wrote to memory of 3516 3272 xxlfxfx.exe 104 PID 3272 wrote to memory of 3516 3272 xxlfxfx.exe 104 PID 3516 wrote to memory of 4652 3516 1lfxflr.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\777aef0b15f109f3e3ec249fef6c8f40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\777aef0b15f109f3e3ec249fef6c8f40_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\lfllllf.exec:\lfllllf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
\??\c:\bbbntn.exec:\bbbntn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\tttnhn.exec:\tttnhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\3pdjj.exec:\3pdjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\xxxxxxx.exec:\xxxxxxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\hhtthn.exec:\hhtthn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\1bthtt.exec:\1bthtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\jjjdv.exec:\jjjdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\frrrffx.exec:\frrrffx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\rlrrrll.exec:\rlrrrll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\tnnhnn.exec:\tnnhnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\dvpjp.exec:\dvpjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\xxxrlrf.exec:\xxxrlrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\nbhhhh.exec:\nbhhhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
\??\c:\xrflrrf.exec:\xrflrrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
\??\c:\hhbtnn.exec:\hhbtnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\xrfxxxx.exec:\xrfxxxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:728 -
\??\c:\hhtbhh.exec:\hhtbhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\9djdv.exec:\9djdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\xxlfxfx.exec:\xxlfxfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\1lfxflr.exec:\1lfxflr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\dpvvd.exec:\dpvvd.exe23⤵
- Executes dropped EXE
PID:4652 -
\??\c:\nhtnhh.exec:\nhtnhh.exe24⤵
- Executes dropped EXE
PID:2704 -
\??\c:\vdpdj.exec:\vdpdj.exe25⤵
- Executes dropped EXE
PID:4244 -
\??\c:\xxflrxr.exec:\xxflrxr.exe26⤵
- Executes dropped EXE
PID:1508 -
\??\c:\xlxlrll.exec:\xlxlrll.exe27⤵
- Executes dropped EXE
PID:2264 -
\??\c:\vvvvd.exec:\vvvvd.exe28⤵
- Executes dropped EXE
PID:772 -
\??\c:\jjppp.exec:\jjppp.exe29⤵
- Executes dropped EXE
PID:116 -
\??\c:\1hnhhh.exec:\1hnhhh.exe30⤵
- Executes dropped EXE
PID:3960 -
\??\c:\7hnnbn.exec:\7hnnbn.exe31⤵
- Executes dropped EXE
PID:2980 -
\??\c:\vpjdv.exec:\vpjdv.exe32⤵
- Executes dropped EXE
PID:3648 -
\??\c:\rrfxxxr.exec:\rrfxxxr.exe33⤵
- Executes dropped EXE
PID:4572 -
\??\c:\hthbtn.exec:\hthbtn.exe34⤵
- Executes dropped EXE
PID:4780 -
\??\c:\dvvvp.exec:\dvvvp.exe35⤵
- Executes dropped EXE
PID:3700 -
\??\c:\rllllrx.exec:\rllllrx.exe36⤵
- Executes dropped EXE
PID:3260 -
\??\c:\tnttbb.exec:\tnttbb.exe37⤵
- Executes dropped EXE
PID:3584 -
\??\c:\tnbtnn.exec:\tnbtnn.exe38⤵
- Executes dropped EXE
PID:4900 -
\??\c:\5pdvp.exec:\5pdvp.exe39⤵
- Executes dropped EXE
PID:1040 -
\??\c:\1pdvd.exec:\1pdvd.exe40⤵
- Executes dropped EXE
PID:3276 -
\??\c:\xrxrrrl.exec:\xrxrrrl.exe41⤵
- Executes dropped EXE
PID:4444 -
\??\c:\bnbbbb.exec:\bnbbbb.exe42⤵
- Executes dropped EXE
PID:2800 -
\??\c:\5nnnhh.exec:\5nnnhh.exe43⤵
- Executes dropped EXE
PID:4928 -
\??\c:\pjvpp.exec:\pjvpp.exe44⤵
- Executes dropped EXE
PID:4924 -
\??\c:\1rrllll.exec:\1rrllll.exe45⤵
- Executes dropped EXE
PID:2252 -
\??\c:\9rrlrlx.exec:\9rrlrlx.exe46⤵
- Executes dropped EXE
PID:4736 -
\??\c:\htbbhb.exec:\htbbhb.exe47⤵
- Executes dropped EXE
PID:1128 -
\??\c:\vdjvp.exec:\vdjvp.exe48⤵
- Executes dropped EXE
PID:4800 -
\??\c:\rlrxxxl.exec:\rlrxxxl.exe49⤵
- Executes dropped EXE
PID:4084 -
\??\c:\xrrrxxx.exec:\xrrrxxx.exe50⤵
- Executes dropped EXE
PID:1520 -
\??\c:\7nnnnn.exec:\7nnnnn.exe51⤵
- Executes dropped EXE
PID:1532 -
\??\c:\ppppj.exec:\ppppj.exe52⤵
- Executes dropped EXE
PID:2072 -
\??\c:\vvjdd.exec:\vvjdd.exe53⤵
- Executes dropped EXE
PID:2900 -
\??\c:\ffxrlfx.exec:\ffxrlfx.exe54⤵
- Executes dropped EXE
PID:4036 -
\??\c:\hnbbtt.exec:\hnbbtt.exe55⤵
- Executes dropped EXE
PID:1364 -
\??\c:\pdjdv.exec:\pdjdv.exe56⤵
- Executes dropped EXE
PID:5072 -
\??\c:\vpjjd.exec:\vpjjd.exe57⤵
- Executes dropped EXE
PID:2768 -
\??\c:\ffflrrf.exec:\ffflrrf.exe58⤵
- Executes dropped EXE
PID:1572 -
\??\c:\xxfxxxx.exec:\xxfxxxx.exe59⤵
- Executes dropped EXE
PID:3804 -
\??\c:\vjppp.exec:\vjppp.exe60⤵
- Executes dropped EXE
PID:4012 -
\??\c:\dvvpj.exec:\dvvpj.exe61⤵
- Executes dropped EXE
PID:3620 -
\??\c:\xxrlffx.exec:\xxrlffx.exe62⤵
- Executes dropped EXE
PID:796 -
\??\c:\tthttt.exec:\tthttt.exe63⤵
- Executes dropped EXE
PID:1836 -
\??\c:\bbttbt.exec:\bbttbt.exe64⤵
- Executes dropped EXE
PID:792 -
\??\c:\dpppv.exec:\dpppv.exe65⤵
- Executes dropped EXE
PID:1976 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe66⤵PID:728
-
\??\c:\fxxxxrr.exec:\fxxxxrr.exe67⤵PID:4236
-
\??\c:\9hbbtt.exec:\9hbbtt.exe68⤵PID:2368
-
\??\c:\vdvpj.exec:\vdvpj.exe69⤵PID:3332
-
\??\c:\7pjjd.exec:\7pjjd.exe70⤵PID:2044
-
\??\c:\lfrlxxr.exec:\lfrlxxr.exe71⤵PID:4788
-
\??\c:\rfrxrrl.exec:\rfrxrrl.exe72⤵PID:4248
-
\??\c:\nbhntb.exec:\nbhntb.exe73⤵PID:3256
-
\??\c:\vvjjd.exec:\vvjjd.exe74⤵PID:2704
-
\??\c:\1nnnhh.exec:\1nnnhh.exe75⤵PID:964
-
\??\c:\pjvpd.exec:\pjvpd.exe76⤵PID:2288
-
\??\c:\pjppj.exec:\pjppj.exe77⤵PID:1284
-
\??\c:\rrrllfx.exec:\rrrllfx.exe78⤵PID:3608
-
\??\c:\hhtnhb.exec:\hhtnhb.exe79⤵PID:1588
-
\??\c:\hbhhtb.exec:\hbhhtb.exe80⤵PID:4576
-
\??\c:\3vdvd.exec:\3vdvd.exe81⤵PID:3416
-
\??\c:\frxlffx.exec:\frxlffx.exe82⤵PID:2156
-
\??\c:\xxffffx.exec:\xxffffx.exe83⤵PID:1000
-
\??\c:\nhthnn.exec:\nhthnn.exe84⤵PID:4964
-
\??\c:\1rfxrxr.exec:\1rfxrxr.exe85⤵PID:3232
-
\??\c:\rxfrrfr.exec:\rxfrrfr.exe86⤵PID:4780
-
\??\c:\nhnhnh.exec:\nhnhnh.exe87⤵PID:876
-
\??\c:\jddvj.exec:\jddvj.exe88⤵PID:5000
-
\??\c:\ddppp.exec:\ddppp.exe89⤵PID:4900
-
\??\c:\rllfxxr.exec:\rllfxxr.exe90⤵PID:1040
-
\??\c:\lfrrlxf.exec:\lfrrlxf.exe91⤵PID:4056
-
\??\c:\1bttnt.exec:\1bttnt.exe92⤵PID:2420
-
\??\c:\tnhbbb.exec:\tnhbbb.exe93⤵PID:2444
-
\??\c:\jjvvv.exec:\jjvvv.exe94⤵PID:400
-
\??\c:\fxrrllf.exec:\fxrrllf.exe95⤵PID:4100
-
\??\c:\fxfrxxx.exec:\fxfrxxx.exe96⤵PID:2252
-
\??\c:\ttttth.exec:\ttttth.exe97⤵PID:4736
-
\??\c:\tnhhnt.exec:\tnhhnt.exe98⤵PID:5036
-
\??\c:\1vppp.exec:\1vppp.exe99⤵PID:4800
-
\??\c:\lffflll.exec:\lffflll.exe100⤵PID:4512
-
\??\c:\fxllllr.exec:\fxllllr.exe101⤵PID:1520
-
\??\c:\5ttbth.exec:\5ttbth.exe102⤵PID:1532
-
\??\c:\jjvvp.exec:\jjvvp.exe103⤵PID:840
-
\??\c:\lflrrff.exec:\lflrrff.exe104⤵PID:3828
-
\??\c:\bhhhbh.exec:\bhhhbh.exe105⤵PID:396
-
\??\c:\ppjdp.exec:\ppjdp.exe106⤵PID:3812
-
\??\c:\dvjjv.exec:\dvjjv.exe107⤵PID:4504
-
\??\c:\xfflrfx.exec:\xfflrfx.exe108⤵PID:4836
-
\??\c:\nhnhnn.exec:\nhnhnn.exe109⤵PID:4428
-
\??\c:\nbbbtt.exec:\nbbbtt.exe110⤵PID:664
-
\??\c:\7jpjd.exec:\7jpjd.exe111⤵PID:5084
-
\??\c:\1pvvv.exec:\1pvvv.exe112⤵PID:2116
-
\??\c:\xrrrrrl.exec:\xrrrrrl.exe113⤵PID:796
-
\??\c:\flrrrrx.exec:\flrrrrx.exe114⤵PID:1736
-
\??\c:\hbhbbb.exec:\hbhbbb.exe115⤵PID:4896
-
\??\c:\btbbth.exec:\btbbth.exe116⤵PID:908
-
\??\c:\dvdvp.exec:\dvdvp.exe117⤵PID:4832
-
\??\c:\fxfxxxf.exec:\fxfxxxf.exe118⤵PID:1816
-
\??\c:\bbbbtt.exec:\bbbbtt.exe119⤵PID:2616
-
\??\c:\vvvvp.exec:\vvvvp.exe120⤵PID:364
-
\??\c:\pjvvp.exec:\pjvvp.exe121⤵PID:3520
-
\??\c:\rrllrxf.exec:\rrllrxf.exe122⤵PID:1656
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-