Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 20:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
322a1c0c1f4ce2e0a88f6e1fb7c673d0_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
322a1c0c1f4ce2e0a88f6e1fb7c673d0_NeikiAnalytics.exe
-
Size
480KB
-
MD5
322a1c0c1f4ce2e0a88f6e1fb7c673d0
-
SHA1
bd21b297b46cce6e571198a618fd6b8b4396dc27
-
SHA256
5506e4b8bbedb26fd9432c665a7f573467b962e460fe3bfa31d1e7d246cb75db
-
SHA512
349c53a49c00482edd24ff3dfb413bc4d4cca6fa022beed207de8321ff798066997b0ed0a9f0a36e9552b8adab98ef469fe0bf793498c24f5ecdb4f454c6c879
-
SSDEEP
12288:n3C9uDVw6326pKZ9asZqoZHz+evcn0Meh2Fez3:Su326p0aroZt0s3
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/1620-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3456-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3616-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1332-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4068-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2464-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4580-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1228-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2144-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4396-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3976-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5080-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1000-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4260-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1564-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2756-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4172-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2908-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4064-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3456 pddvv.exe 3616 fxxrrlr.exe 4524 frfxrlf.exe 3320 5vdvj.exe 1332 nhtnnn.exe 4068 xlfxrlf.exe 4592 tnhbnh.exe 2464 lrrlfxr.exe 2364 btnnhh.exe 4580 1pvpv.exe 1228 dpvpd.exe 2144 frrlffx.exe 4396 xxxxxfl.exe 2856 httbtt.exe 3976 xfxxrrl.exe 2724 pjjdj.exe 5080 btthbb.exe 2060 ffxrffx.exe 1000 btnbtb.exe 2276 xffxxrr.exe 1564 1lrrrlf.exe 4260 pjjjd.exe 1972 5lxxffr.exe 5040 fllfxxx.exe 2756 bntttn.exe 4172 7jdpd.exe 2236 9rlfxrr.exe 2908 pdddv.exe 4308 fxfxlfx.exe 968 dppjd.exe 4064 xrlffrx.exe 1856 fxllxxx.exe 4080 jjjdv.exe 4380 rrfxrrr.exe 1044 tbnhtt.exe 1108 pvvpv.exe 2044 bnthnh.exe 2196 jdjdd.exe 1032 vpjjp.exe 1036 fxlfxxr.exe 1316 tnhnbh.exe 1376 dvvpj.exe 2248 xlfrfxf.exe 4052 nhhtnb.exe 4440 thhnbh.exe 2860 vpvvp.exe 2016 lflllff.exe 2124 nhhbbb.exe 1244 7pjdv.exe 3852 rrrrrxx.exe 4580 hhttbh.exe 2740 nbhbbt.exe 4168 dpvvv.exe 2208 5xxrlrl.exe 516 htbbbb.exe 2096 1ddvp.exe 1896 rrxffrx.exe 3976 nhnhnh.exe 2768 vjddd.exe 668 7ppdv.exe 1484 xrrlfrl.exe 4728 btttnh.exe 4996 dvddv.exe 2244 xrrlllf.exe -
resource yara_rule behavioral2/memory/1620-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3456-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4524-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1332-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4068-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2464-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1228-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2144-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4396-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5080-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1000-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4260-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1564-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2756-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4172-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2908-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4064-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1620 wrote to memory of 3456 1620 322a1c0c1f4ce2e0a88f6e1fb7c673d0_NeikiAnalytics.exe 83 PID 1620 wrote to memory of 3456 1620 322a1c0c1f4ce2e0a88f6e1fb7c673d0_NeikiAnalytics.exe 83 PID 1620 wrote to memory of 3456 1620 322a1c0c1f4ce2e0a88f6e1fb7c673d0_NeikiAnalytics.exe 83 PID 3456 wrote to memory of 3616 3456 pddvv.exe 84 PID 3456 wrote to memory of 3616 3456 pddvv.exe 84 PID 3456 wrote to memory of 3616 3456 pddvv.exe 84 PID 3616 wrote to memory of 4524 3616 fxxrrlr.exe 85 PID 3616 wrote to memory of 4524 3616 fxxrrlr.exe 85 PID 3616 wrote to memory of 4524 3616 fxxrrlr.exe 85 PID 4524 wrote to memory of 3320 4524 frfxrlf.exe 86 PID 4524 wrote to memory of 3320 4524 frfxrlf.exe 86 PID 4524 wrote to memory of 3320 4524 frfxrlf.exe 86 PID 3320 wrote to memory of 1332 3320 5vdvj.exe 87 PID 3320 wrote to memory of 1332 3320 5vdvj.exe 87 PID 3320 wrote to memory of 1332 3320 5vdvj.exe 87 PID 1332 wrote to memory of 4068 1332 nhtnnn.exe 88 PID 1332 wrote to memory of 4068 1332 nhtnnn.exe 88 PID 1332 wrote to memory of 4068 1332 nhtnnn.exe 88 PID 4068 wrote to memory of 4592 4068 xlfxrlf.exe 89 PID 4068 wrote to memory of 4592 4068 xlfxrlf.exe 89 PID 4068 wrote to memory of 4592 4068 xlfxrlf.exe 89 PID 4592 wrote to memory of 2464 4592 tnhbnh.exe 91 PID 4592 wrote to memory of 2464 4592 tnhbnh.exe 91 PID 4592 wrote to memory of 2464 4592 tnhbnh.exe 91 PID 2464 wrote to memory of 2364 2464 lrrlfxr.exe 92 PID 2464 wrote to memory of 2364 2464 lrrlfxr.exe 92 PID 2464 wrote to memory of 2364 2464 lrrlfxr.exe 92 PID 2364 wrote to memory of 4580 2364 btnnhh.exe 93 PID 2364 wrote to memory of 4580 2364 btnnhh.exe 93 PID 2364 wrote to memory of 4580 2364 btnnhh.exe 93 PID 4580 wrote to memory of 1228 4580 1pvpv.exe 94 PID 4580 wrote to memory of 1228 4580 1pvpv.exe 94 PID 4580 wrote to memory of 1228 4580 1pvpv.exe 94 PID 1228 wrote to memory of 2144 1228 dpvpd.exe 95 PID 1228 wrote to memory of 2144 1228 dpvpd.exe 95 PID 1228 wrote to memory of 2144 1228 dpvpd.exe 95 PID 2144 wrote to memory of 4396 2144 frrlffx.exe 97 PID 2144 wrote to memory of 4396 2144 frrlffx.exe 97 PID 2144 wrote to memory of 4396 2144 frrlffx.exe 97 PID 4396 wrote to memory of 2856 4396 xxxxxfl.exe 98 PID 4396 wrote to memory of 2856 4396 xxxxxfl.exe 98 PID 4396 wrote to memory of 2856 4396 xxxxxfl.exe 98 PID 2856 wrote to memory of 3976 2856 httbtt.exe 99 PID 2856 wrote to memory of 3976 2856 httbtt.exe 99 PID 2856 wrote to memory of 3976 2856 httbtt.exe 99 PID 3976 wrote to memory of 2724 3976 xfxxrrl.exe 100 PID 3976 wrote to memory of 2724 3976 xfxxrrl.exe 100 PID 3976 wrote to memory of 2724 3976 xfxxrrl.exe 100 PID 2724 wrote to memory of 5080 2724 pjjdj.exe 101 PID 2724 wrote to memory of 5080 2724 pjjdj.exe 101 PID 2724 wrote to memory of 5080 2724 pjjdj.exe 101 PID 5080 wrote to memory of 2060 5080 btthbb.exe 102 PID 5080 wrote to memory of 2060 5080 btthbb.exe 102 PID 5080 wrote to memory of 2060 5080 btthbb.exe 102 PID 2060 wrote to memory of 1000 2060 ffxrffx.exe 103 PID 2060 wrote to memory of 1000 2060 ffxrffx.exe 103 PID 2060 wrote to memory of 1000 2060 ffxrffx.exe 103 PID 1000 wrote to memory of 2276 1000 btnbtb.exe 104 PID 1000 wrote to memory of 2276 1000 btnbtb.exe 104 PID 1000 wrote to memory of 2276 1000 btnbtb.exe 104 PID 2276 wrote to memory of 1564 2276 xffxxrr.exe 105 PID 2276 wrote to memory of 1564 2276 xffxxrr.exe 105 PID 2276 wrote to memory of 1564 2276 xffxxrr.exe 105 PID 1564 wrote to memory of 4260 1564 1lrrrlf.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\322a1c0c1f4ce2e0a88f6e1fb7c673d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\322a1c0c1f4ce2e0a88f6e1fb7c673d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\pddvv.exec:\pddvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\fxxrrlr.exec:\fxxrrlr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\frfxrlf.exec:\frfxrlf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\5vdvj.exec:\5vdvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\nhtnnn.exec:\nhtnnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\xlfxrlf.exec:\xlfxrlf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\tnhbnh.exec:\tnhbnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\lrrlfxr.exec:\lrrlfxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\btnnhh.exec:\btnnhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\1pvpv.exec:\1pvpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\dpvpd.exec:\dpvpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\frrlffx.exec:\frrlffx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\xxxxxfl.exec:\xxxxxfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\httbtt.exec:\httbtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\xfxxrrl.exec:\xfxxrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\pjjdj.exec:\pjjdj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\btthbb.exec:\btthbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\ffxrffx.exec:\ffxrffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\btnbtb.exec:\btnbtb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
\??\c:\xffxxrr.exec:\xffxxrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\1lrrrlf.exec:\1lrrrlf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\pjjjd.exec:\pjjjd.exe23⤵
- Executes dropped EXE
PID:4260 -
\??\c:\5lxxffr.exec:\5lxxffr.exe24⤵
- Executes dropped EXE
PID:1972 -
\??\c:\fllfxxx.exec:\fllfxxx.exe25⤵
- Executes dropped EXE
PID:5040 -
\??\c:\bntttn.exec:\bntttn.exe26⤵
- Executes dropped EXE
PID:2756 -
\??\c:\7jdpd.exec:\7jdpd.exe27⤵
- Executes dropped EXE
PID:4172 -
\??\c:\9rlfxrr.exec:\9rlfxrr.exe28⤵
- Executes dropped EXE
PID:2236 -
\??\c:\pdddv.exec:\pdddv.exe29⤵
- Executes dropped EXE
PID:2908 -
\??\c:\fxfxlfx.exec:\fxfxlfx.exe30⤵
- Executes dropped EXE
PID:4308 -
\??\c:\dppjd.exec:\dppjd.exe31⤵
- Executes dropped EXE
PID:968 -
\??\c:\xrlffrx.exec:\xrlffrx.exe32⤵
- Executes dropped EXE
PID:4064 -
\??\c:\fxllxxx.exec:\fxllxxx.exe33⤵
- Executes dropped EXE
PID:1856 -
\??\c:\jjjdv.exec:\jjjdv.exe34⤵
- Executes dropped EXE
PID:4080 -
\??\c:\rrfxrrr.exec:\rrfxrrr.exe35⤵
- Executes dropped EXE
PID:4380 -
\??\c:\tbnhtt.exec:\tbnhtt.exe36⤵
- Executes dropped EXE
PID:1044 -
\??\c:\pvvpv.exec:\pvvpv.exe37⤵
- Executes dropped EXE
PID:1108 -
\??\c:\bnthnh.exec:\bnthnh.exe38⤵
- Executes dropped EXE
PID:2044 -
\??\c:\jdjdd.exec:\jdjdd.exe39⤵
- Executes dropped EXE
PID:2196 -
\??\c:\vpjjp.exec:\vpjjp.exe40⤵
- Executes dropped EXE
PID:1032 -
\??\c:\fxlfxxr.exec:\fxlfxxr.exe41⤵
- Executes dropped EXE
PID:1036 -
\??\c:\tnhnbh.exec:\tnhnbh.exe42⤵
- Executes dropped EXE
PID:1316 -
\??\c:\dvvpj.exec:\dvvpj.exe43⤵
- Executes dropped EXE
PID:1376 -
\??\c:\xlfrfxf.exec:\xlfrfxf.exe44⤵
- Executes dropped EXE
PID:2248 -
\??\c:\nhhtnb.exec:\nhhtnb.exe45⤵
- Executes dropped EXE
PID:4052 -
\??\c:\thhnbh.exec:\thhnbh.exe46⤵
- Executes dropped EXE
PID:4440 -
\??\c:\vpvvp.exec:\vpvvp.exe47⤵
- Executes dropped EXE
PID:2860 -
\??\c:\lflllff.exec:\lflllff.exe48⤵
- Executes dropped EXE
PID:2016 -
\??\c:\nhhbbb.exec:\nhhbbb.exe49⤵
- Executes dropped EXE
PID:2124 -
\??\c:\7pjdv.exec:\7pjdv.exe50⤵
- Executes dropped EXE
PID:1244 -
\??\c:\rrrrrxx.exec:\rrrrrxx.exe51⤵
- Executes dropped EXE
PID:3852 -
\??\c:\hhttbh.exec:\hhttbh.exe52⤵
- Executes dropped EXE
PID:4580 -
\??\c:\nbhbbt.exec:\nbhbbt.exe53⤵
- Executes dropped EXE
PID:2740 -
\??\c:\dpvvv.exec:\dpvvv.exe54⤵
- Executes dropped EXE
PID:4168 -
\??\c:\5xxrlrl.exec:\5xxrlrl.exe55⤵
- Executes dropped EXE
PID:2208 -
\??\c:\htbbbb.exec:\htbbbb.exe56⤵
- Executes dropped EXE
PID:516 -
\??\c:\1ddvp.exec:\1ddvp.exe57⤵
- Executes dropped EXE
PID:2096 -
\??\c:\rrxffrx.exec:\rrxffrx.exe58⤵
- Executes dropped EXE
PID:1896 -
\??\c:\nhnhnh.exec:\nhnhnh.exe59⤵
- Executes dropped EXE
PID:3976 -
\??\c:\vjddd.exec:\vjddd.exe60⤵
- Executes dropped EXE
PID:2768 -
\??\c:\7ppdv.exec:\7ppdv.exe61⤵
- Executes dropped EXE
PID:668 -
\??\c:\xrrlfrl.exec:\xrrlfrl.exe62⤵
- Executes dropped EXE
PID:1484 -
\??\c:\btttnh.exec:\btttnh.exe63⤵
- Executes dropped EXE
PID:4728 -
\??\c:\dvddv.exec:\dvddv.exe64⤵
- Executes dropped EXE
PID:4996 -
\??\c:\xrrlllf.exec:\xrrlllf.exe65⤵
- Executes dropped EXE
PID:2244 -
\??\c:\nbnttt.exec:\nbnttt.exe66⤵PID:4744
-
\??\c:\nhnhhh.exec:\nhnhhh.exe67⤵PID:3844
-
\??\c:\vjpjj.exec:\vjpjj.exe68⤵PID:4604
-
\??\c:\nnnhbt.exec:\nnnhbt.exe69⤵PID:5040
-
\??\c:\1pvvp.exec:\1pvvp.exe70⤵PID:2976
-
\??\c:\rxlrrxx.exec:\rxlrrxx.exe71⤵PID:3648
-
\??\c:\rflfrxx.exec:\rflfrxx.exe72⤵PID:2652
-
\??\c:\bbnnhn.exec:\bbnnhn.exe73⤵PID:4304
-
\??\c:\jdddv.exec:\jdddv.exe74⤵PID:3752
-
\??\c:\7lxxxfl.exec:\7lxxxfl.exe75⤵PID:2596
-
\??\c:\tntttb.exec:\tntttb.exe76⤵PID:4280
-
\??\c:\tbhhtt.exec:\tbhhtt.exe77⤵PID:1464
-
\??\c:\dpddd.exec:\dpddd.exe78⤵PID:4320
-
\??\c:\lfxrfxr.exec:\lfxrfxr.exe79⤵PID:4300
-
\??\c:\tbbbtt.exec:\tbbbtt.exe80⤵PID:3944
-
\??\c:\pjppj.exec:\pjppj.exe81⤵PID:4584
-
\??\c:\pjddd.exec:\pjddd.exe82⤵PID:3616
-
\??\c:\fxffllr.exec:\fxffllr.exe83⤵PID:1944
-
\??\c:\hnhntt.exec:\hnhntt.exe84⤵PID:4628
-
\??\c:\dpddj.exec:\dpddj.exe85⤵PID:1480
-
\??\c:\lxfffff.exec:\lxfffff.exe86⤵PID:2052
-
\??\c:\5bbhtb.exec:\5bbhtb.exe87⤵PID:4984
-
\??\c:\ppvdd.exec:\ppvdd.exe88⤵PID:4464
-
\??\c:\7fffxfx.exec:\7fffxfx.exe89⤵PID:3084
-
\??\c:\nttnhh.exec:\nttnhh.exe90⤵PID:4592
-
\??\c:\hhhbbb.exec:\hhhbbb.exe91⤵PID:2860
-
\??\c:\1jppj.exec:\1jppj.exe92⤵PID:2016
-
\??\c:\5lrrfrx.exec:\5lrrfrx.exe93⤵PID:2124
-
\??\c:\9ttbbh.exec:\9ttbbh.exe94⤵PID:3600
-
\??\c:\btnhbb.exec:\btnhbb.exe95⤵PID:3316
-
\??\c:\7djdd.exec:\7djdd.exe96⤵PID:1228
-
\??\c:\frxrlll.exec:\frxrlll.exe97⤵PID:2988
-
\??\c:\tbtnhb.exec:\tbtnhb.exe98⤵PID:516
-
\??\c:\5vddd.exec:\5vddd.exe99⤵PID:4760
-
\??\c:\3vddd.exec:\3vddd.exe100⤵PID:1104
-
\??\c:\lrlrrrr.exec:\lrlrrrr.exe101⤵PID:3756
-
\??\c:\nhtbbb.exec:\nhtbbb.exe102⤵PID:4268
-
\??\c:\jjjdv.exec:\jjjdv.exe103⤵PID:2276
-
\??\c:\xlrlfff.exec:\xlrlfff.exe104⤵PID:3152
-
\??\c:\xxxxfll.exec:\xxxxfll.exe105⤵PID:1884
-
\??\c:\tthbbh.exec:\tthbbh.exe106⤵PID:3360
-
\??\c:\rrfflll.exec:\rrfflll.exe107⤵PID:4232
-
\??\c:\flfffll.exec:\flfffll.exe108⤵PID:1632
-
\??\c:\bhhhbh.exec:\bhhhbh.exe109⤵PID:3648
-
\??\c:\jvdjd.exec:\jvdjd.exe110⤵PID:5056
-
\??\c:\rlrrrrx.exec:\rlrrrrx.exe111⤵PID:3132
-
\??\c:\nnnnbt.exec:\nnnnbt.exe112⤵PID:3656
-
\??\c:\tbhhbh.exec:\tbhhbh.exe113⤵PID:1856
-
\??\c:\ddvvv.exec:\ddvvv.exe114⤵PID:420
-
\??\c:\rlxffff.exec:\rlxffff.exe115⤵PID:4620
-
\??\c:\hhhnhb.exec:\hhhnhb.exe116⤵PID:3612
-
\??\c:\vdjdv.exec:\vdjdv.exe117⤵PID:5044
-
\??\c:\fxxllfx.exec:\fxxllfx.exe118⤵PID:5100
-
\??\c:\hhtttt.exec:\hhtttt.exe119⤵PID:3024
-
\??\c:\9ddpp.exec:\9ddpp.exe120⤵PID:4444
-
\??\c:\dpddj.exec:\dpddj.exe121⤵PID:1628
-
\??\c:\llxllrx.exec:\llxllrx.exe122⤵PID:4500
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-