Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
12/05/2024, 16:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
30e170dbcab94661908a177cc47072e0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
30e170dbcab94661908a177cc47072e0_NeikiAnalytics.exe
-
Size
126KB
-
MD5
30e170dbcab94661908a177cc47072e0
-
SHA1
b9041004d9db6a212b10984db050adce1cdd1645
-
SHA256
254d069624b2341c8d8dd8554ddc0cdd60c3a7a412b4455b217a0349ecbcf01a
-
SHA512
27e4128120c9b63d9e69daa6ea7d8eafcaba82ce11370d7f5aaa3ed2b367871391f83f2e2745119f824aae9503008ee7c6439c729b8acd028cd232b333340ac6
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73oYUCD7R2F2UVbyy0NgVyFsZW:ymb3NkkiQ3mdBjFo73HUoMsAbrxVBo
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/4732-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2780-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4528-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3412-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2104-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3764-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/988-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1552-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1316-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2096-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2096-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1148-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5072-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3456-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3836-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2312-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2720-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3032-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2824-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1636-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3668-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1816-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4172-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2780 pjpjj.exe 4528 rxxrllf.exe 3412 1fllffx.exe 3764 nnnntn.exe 2104 dpvvv.exe 988 vjjvj.exe 1552 bntbtb.exe 4904 1bhttt.exe 1316 jpppd.exe 2096 lrxxxll.exe 1148 vjjdj.exe 5072 9jpjj.exe 2224 xxrfxrx.exe 2344 nhnttt.exe 3456 5vdvp.exe 3836 vppjd.exe 2312 xxlffff.exe 2720 bbhbhh.exe 3032 7vjvp.exe 3276 frrlxxx.exe 2824 rfrxrxr.exe 1636 hbnbbb.exe 3668 dpvvp.exe 2300 ddjjj.exe 1432 frrlffx.exe 3344 ttntbb.exe 1816 jddvp.exe 4172 rlfxrrx.exe 4328 bbnnnt.exe 3184 vvvjj.exe 2496 jpvvv.exe 4228 xrlflfl.exe 3660 hbnhbt.exe 460 ddpdp.exe 3936 vjjdp.exe 1736 xrxrrrr.exe 2456 bbtnhb.exe 2336 nbhhhb.exe 4384 ppvpj.exe 4368 xrfxllf.exe 4732 xlffffr.exe 2332 btnhhh.exe 1516 jjjjv.exe 788 xfrlrrx.exe 4156 hthhhn.exe 4628 htttnn.exe 3432 jdjjd.exe 4304 ffxrffx.exe 4424 xxfxrxx.exe 2960 nbnhhb.exe 2684 dvpvj.exe 396 ppvpj.exe 388 rllfrxr.exe 3192 lxllflr.exe 3332 nbhbnh.exe 5048 jvvjd.exe 4860 fxxrlfx.exe 4240 fllffff.exe 3624 3hhbbb.exe 696 jddvp.exe 884 dddvd.exe 4140 lrlrxxr.exe 4132 xflfxxx.exe 4020 nbbbtt.exe -
resource yara_rule behavioral2/memory/4732-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2780-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3412-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3764-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/988-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1552-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1316-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2096-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2096-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1148-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5072-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3456-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2720-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1636-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1816-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4172-187-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4732 wrote to memory of 2780 4732 30e170dbcab94661908a177cc47072e0_NeikiAnalytics.exe 82 PID 4732 wrote to memory of 2780 4732 30e170dbcab94661908a177cc47072e0_NeikiAnalytics.exe 82 PID 4732 wrote to memory of 2780 4732 30e170dbcab94661908a177cc47072e0_NeikiAnalytics.exe 82 PID 2780 wrote to memory of 4528 2780 pjpjj.exe 83 PID 2780 wrote to memory of 4528 2780 pjpjj.exe 83 PID 2780 wrote to memory of 4528 2780 pjpjj.exe 83 PID 4528 wrote to memory of 3412 4528 rxxrllf.exe 84 PID 4528 wrote to memory of 3412 4528 rxxrllf.exe 84 PID 4528 wrote to memory of 3412 4528 rxxrllf.exe 84 PID 3412 wrote to memory of 3764 3412 1fllffx.exe 85 PID 3412 wrote to memory of 3764 3412 1fllffx.exe 85 PID 3412 wrote to memory of 3764 3412 1fllffx.exe 85 PID 3764 wrote to memory of 2104 3764 nnnntn.exe 86 PID 3764 wrote to memory of 2104 3764 nnnntn.exe 86 PID 3764 wrote to memory of 2104 3764 nnnntn.exe 86 PID 2104 wrote to memory of 988 2104 dpvvv.exe 87 PID 2104 wrote to memory of 988 2104 dpvvv.exe 87 PID 2104 wrote to memory of 988 2104 dpvvv.exe 87 PID 988 wrote to memory of 1552 988 vjjvj.exe 88 PID 988 wrote to memory of 1552 988 vjjvj.exe 88 PID 988 wrote to memory of 1552 988 vjjvj.exe 88 PID 1552 wrote to memory of 4904 1552 bntbtb.exe 89 PID 1552 wrote to memory of 4904 1552 bntbtb.exe 89 PID 1552 wrote to memory of 4904 1552 bntbtb.exe 89 PID 4904 wrote to memory of 1316 4904 1bhttt.exe 90 PID 4904 wrote to memory of 1316 4904 1bhttt.exe 90 PID 4904 wrote to memory of 1316 4904 1bhttt.exe 90 PID 1316 wrote to memory of 2096 1316 jpppd.exe 91 PID 1316 wrote to memory of 2096 1316 jpppd.exe 91 PID 1316 wrote to memory of 2096 1316 jpppd.exe 91 PID 2096 wrote to memory of 1148 2096 lrxxxll.exe 92 PID 2096 wrote to memory of 1148 2096 lrxxxll.exe 92 PID 2096 wrote to memory of 1148 2096 lrxxxll.exe 92 PID 1148 wrote to memory of 5072 1148 vjjdj.exe 93 PID 1148 wrote to memory of 5072 1148 vjjdj.exe 93 PID 1148 wrote to memory of 5072 1148 vjjdj.exe 93 PID 5072 wrote to memory of 2224 5072 9jpjj.exe 94 PID 5072 wrote to memory of 2224 5072 9jpjj.exe 94 PID 5072 wrote to memory of 2224 5072 9jpjj.exe 94 PID 2224 wrote to memory of 2344 2224 xxrfxrx.exe 95 PID 2224 wrote to memory of 2344 2224 xxrfxrx.exe 95 PID 2224 wrote to memory of 2344 2224 xxrfxrx.exe 95 PID 2344 wrote to memory of 3456 2344 nhnttt.exe 96 PID 2344 wrote to memory of 3456 2344 nhnttt.exe 96 PID 2344 wrote to memory of 3456 2344 nhnttt.exe 96 PID 3456 wrote to memory of 3836 3456 5vdvp.exe 97 PID 3456 wrote to memory of 3836 3456 5vdvp.exe 97 PID 3456 wrote to memory of 3836 3456 5vdvp.exe 97 PID 3836 wrote to memory of 2312 3836 vppjd.exe 98 PID 3836 wrote to memory of 2312 3836 vppjd.exe 98 PID 3836 wrote to memory of 2312 3836 vppjd.exe 98 PID 2312 wrote to memory of 2720 2312 xxlffff.exe 99 PID 2312 wrote to memory of 2720 2312 xxlffff.exe 99 PID 2312 wrote to memory of 2720 2312 xxlffff.exe 99 PID 2720 wrote to memory of 3032 2720 bbhbhh.exe 100 PID 2720 wrote to memory of 3032 2720 bbhbhh.exe 100 PID 2720 wrote to memory of 3032 2720 bbhbhh.exe 100 PID 3032 wrote to memory of 3276 3032 7vjvp.exe 101 PID 3032 wrote to memory of 3276 3032 7vjvp.exe 101 PID 3032 wrote to memory of 3276 3032 7vjvp.exe 101 PID 3276 wrote to memory of 2824 3276 frrlxxx.exe 102 PID 3276 wrote to memory of 2824 3276 frrlxxx.exe 102 PID 3276 wrote to memory of 2824 3276 frrlxxx.exe 102 PID 2824 wrote to memory of 1636 2824 rfrxrxr.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\30e170dbcab94661908a177cc47072e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\30e170dbcab94661908a177cc47072e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\pjpjj.exec:\pjpjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\rxxrllf.exec:\rxxrllf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\1fllffx.exec:\1fllffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\nnnntn.exec:\nnnntn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\dpvvv.exec:\dpvvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\vjjvj.exec:\vjjvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
\??\c:\bntbtb.exec:\bntbtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\1bhttt.exec:\1bhttt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\jpppd.exec:\jpppd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\lrxxxll.exec:\lrxxxll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\vjjdj.exec:\vjjdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\9jpjj.exec:\9jpjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\xxrfxrx.exec:\xxrfxrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\nhnttt.exec:\nhnttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\5vdvp.exec:\5vdvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\vppjd.exec:\vppjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\xxlffff.exec:\xxlffff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\bbhbhh.exec:\bbhbhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\7vjvp.exec:\7vjvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\frrlxxx.exec:\frrlxxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
\??\c:\rfrxrxr.exec:\rfrxrxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\hbnbbb.exec:\hbnbbb.exe23⤵
- Executes dropped EXE
PID:1636 -
\??\c:\dpvvp.exec:\dpvvp.exe24⤵
- Executes dropped EXE
PID:3668 -
\??\c:\ddjjj.exec:\ddjjj.exe25⤵
- Executes dropped EXE
PID:2300 -
\??\c:\frrlffx.exec:\frrlffx.exe26⤵
- Executes dropped EXE
PID:1432 -
\??\c:\ttntbb.exec:\ttntbb.exe27⤵
- Executes dropped EXE
PID:3344 -
\??\c:\jddvp.exec:\jddvp.exe28⤵
- Executes dropped EXE
PID:1816 -
\??\c:\rlfxrrx.exec:\rlfxrrx.exe29⤵
- Executes dropped EXE
PID:4172 -
\??\c:\bbnnnt.exec:\bbnnnt.exe30⤵
- Executes dropped EXE
PID:4328 -
\??\c:\vvvjj.exec:\vvvjj.exe31⤵
- Executes dropped EXE
PID:3184 -
\??\c:\jpvvv.exec:\jpvvv.exe32⤵
- Executes dropped EXE
PID:2496 -
\??\c:\xrlflfl.exec:\xrlflfl.exe33⤵
- Executes dropped EXE
PID:4228 -
\??\c:\hbnhbt.exec:\hbnhbt.exe34⤵
- Executes dropped EXE
PID:3660 -
\??\c:\ddpdp.exec:\ddpdp.exe35⤵
- Executes dropped EXE
PID:460 -
\??\c:\vjjdp.exec:\vjjdp.exe36⤵
- Executes dropped EXE
PID:3936 -
\??\c:\xrxrrrr.exec:\xrxrrrr.exe37⤵
- Executes dropped EXE
PID:1736 -
\??\c:\bbtnhb.exec:\bbtnhb.exe38⤵
- Executes dropped EXE
PID:2456 -
\??\c:\nbhhhb.exec:\nbhhhb.exe39⤵
- Executes dropped EXE
PID:2336 -
\??\c:\ppvpj.exec:\ppvpj.exe40⤵
- Executes dropped EXE
PID:4384 -
\??\c:\xrfxllf.exec:\xrfxllf.exe41⤵
- Executes dropped EXE
PID:4368 -
\??\c:\xlffffr.exec:\xlffffr.exe42⤵
- Executes dropped EXE
PID:4732 -
\??\c:\btnhhh.exec:\btnhhh.exe43⤵
- Executes dropped EXE
PID:2332 -
\??\c:\jjjjv.exec:\jjjjv.exe44⤵
- Executes dropped EXE
PID:1516 -
\??\c:\xfrlrrx.exec:\xfrlrrx.exe45⤵
- Executes dropped EXE
PID:788 -
\??\c:\hthhhn.exec:\hthhhn.exe46⤵
- Executes dropped EXE
PID:4156 -
\??\c:\htttnn.exec:\htttnn.exe47⤵
- Executes dropped EXE
PID:4628 -
\??\c:\jdjjd.exec:\jdjjd.exe48⤵
- Executes dropped EXE
PID:3432 -
\??\c:\ffxrffx.exec:\ffxrffx.exe49⤵
- Executes dropped EXE
PID:4304 -
\??\c:\xxfxrxx.exec:\xxfxrxx.exe50⤵
- Executes dropped EXE
PID:4424 -
\??\c:\nbnhhb.exec:\nbnhhb.exe51⤵
- Executes dropped EXE
PID:2960 -
\??\c:\dvpvj.exec:\dvpvj.exe52⤵
- Executes dropped EXE
PID:2684 -
\??\c:\ppvpj.exec:\ppvpj.exe53⤵
- Executes dropped EXE
PID:396 -
\??\c:\rllfrxr.exec:\rllfrxr.exe54⤵
- Executes dropped EXE
PID:388 -
\??\c:\lxllflr.exec:\lxllflr.exe55⤵
- Executes dropped EXE
PID:3192 -
\??\c:\nbhbnh.exec:\nbhbnh.exe56⤵
- Executes dropped EXE
PID:3332 -
\??\c:\jvvjd.exec:\jvvjd.exe57⤵
- Executes dropped EXE
PID:5048 -
\??\c:\fxxrlfx.exec:\fxxrlfx.exe58⤵
- Executes dropped EXE
PID:4860 -
\??\c:\fllffff.exec:\fllffff.exe59⤵
- Executes dropped EXE
PID:4240 -
\??\c:\3hhbbb.exec:\3hhbbb.exe60⤵
- Executes dropped EXE
PID:3624 -
\??\c:\jddvp.exec:\jddvp.exe61⤵
- Executes dropped EXE
PID:696 -
\??\c:\dddvd.exec:\dddvd.exe62⤵
- Executes dropped EXE
PID:884 -
\??\c:\lrlrxxr.exec:\lrlrxxr.exe63⤵
- Executes dropped EXE
PID:4140 -
\??\c:\xflfxxx.exec:\xflfxxx.exe64⤵
- Executes dropped EXE
PID:4132 -
\??\c:\nbbbtt.exec:\nbbbtt.exe65⤵
- Executes dropped EXE
PID:4020 -
\??\c:\vdppp.exec:\vdppp.exe66⤵PID:1032
-
\??\c:\dvpjd.exec:\dvpjd.exe67⤵PID:4864
-
\??\c:\xllfxrr.exec:\xllfxrr.exe68⤵PID:3084
-
\??\c:\llxxffl.exec:\llxxffl.exe69⤵PID:2636
-
\??\c:\tnhnht.exec:\tnhnht.exe70⤵PID:1264
-
\??\c:\tnhbtn.exec:\tnhbtn.exe71⤵PID:1604
-
\??\c:\ppjvp.exec:\ppjvp.exe72⤵PID:736
-
\??\c:\frrlllf.exec:\frrlllf.exe73⤵PID:2768
-
\??\c:\xflflfr.exec:\xflflfr.exe74⤵PID:4836
-
\??\c:\tthbth.exec:\tthbth.exe75⤵PID:5036
-
\??\c:\dpvdd.exec:\dpvdd.exe76⤵PID:212
-
\??\c:\1vvpd.exec:\1vvpd.exe77⤵PID:3852
-
\??\c:\1rxffff.exec:\1rxffff.exe78⤵PID:2308
-
\??\c:\ffxlfrr.exec:\ffxlfrr.exe79⤵PID:216
-
\??\c:\thtbth.exec:\thtbth.exe80⤵PID:460
-
\??\c:\vdjvp.exec:\vdjvp.exe81⤵PID:3936
-
\??\c:\rrlllxx.exec:\rrlllxx.exe82⤵PID:4620
-
\??\c:\tthhth.exec:\tthhth.exe83⤵PID:32
-
\??\c:\hbhhhh.exec:\hbhhhh.exe84⤵PID:2336
-
\??\c:\vjvdd.exec:\vjvdd.exe85⤵PID:4384
-
\??\c:\jdpjp.exec:\jdpjp.exe86⤵PID:4368
-
\??\c:\lfrlxxl.exec:\lfrlxxl.exe87⤵PID:2780
-
\??\c:\hhthbn.exec:\hhthbn.exe88⤵PID:4896
-
\??\c:\btbthn.exec:\btbthn.exe89⤵PID:2564
-
\??\c:\vppjd.exec:\vppjd.exe90⤵PID:1128
-
\??\c:\jdddd.exec:\jdddd.exe91⤵PID:3000
-
\??\c:\1xxfxrr.exec:\1xxfxrr.exe92⤵PID:4772
-
\??\c:\lrfrxrx.exec:\lrfrxrx.exe93⤵PID:4888
-
\??\c:\ntttnt.exec:\ntttnt.exe94⤵PID:1788
-
\??\c:\pjdpv.exec:\pjdpv.exe95⤵PID:4444
-
\??\c:\dvjpv.exec:\dvjpv.exe96⤵PID:4308
-
\??\c:\xxrrrrr.exec:\xxrrrrr.exe97⤵PID:1372
-
\??\c:\frrrlll.exec:\frrrlll.exe98⤵PID:3304
-
\??\c:\nhbtth.exec:\nhbtth.exe99⤵PID:1656
-
\??\c:\nhhnbb.exec:\nhhnbb.exe100⤵PID:880
-
\??\c:\jdvvj.exec:\jdvvj.exe101⤵PID:428
-
\??\c:\dvddd.exec:\dvddd.exe102⤵PID:4224
-
\??\c:\flrrflf.exec:\flrrflf.exe103⤵PID:3332
-
\??\c:\nbnbbt.exec:\nbnbbt.exe104⤵PID:3904
-
\??\c:\9hnhhh.exec:\9hnhhh.exe105⤵PID:3760
-
\??\c:\dvvpv.exec:\dvvpv.exe106⤵PID:3836
-
\??\c:\ppdvv.exec:\ppdvv.exe107⤵PID:5012
-
\??\c:\lxffffx.exec:\lxffffx.exe108⤵PID:2004
-
\??\c:\xxfrllr.exec:\xxfrllr.exe109⤵PID:4544
-
\??\c:\bbhhbb.exec:\bbhhbb.exe110⤵PID:4564
-
\??\c:\hhhhhb.exec:\hhhhhb.exe111⤵PID:928
-
\??\c:\jppvp.exec:\jppvp.exe112⤵PID:3924
-
\??\c:\ddppp.exec:\ddppp.exe113⤵PID:3044
-
\??\c:\flxrxll.exec:\flxrxll.exe114⤵PID:3084
-
\??\c:\hnnhbh.exec:\hnnhbh.exe115⤵PID:2636
-
\??\c:\btnntt.exec:\btnntt.exe116⤵PID:1092
-
\??\c:\djjjv.exec:\djjjv.exe117⤵PID:1604
-
\??\c:\lrxfflf.exec:\lrxfflf.exe118⤵PID:316
-
\??\c:\bhhntn.exec:\bhhntn.exe119⤵PID:1076
-
\??\c:\jpvvp.exec:\jpvvp.exe120⤵PID:3744
-
\??\c:\pdpjd.exec:\pdpjd.exe121⤵PID:552
-
\??\c:\btbhhh.exec:\btbhhh.exe122⤵PID:3812
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-