Analysis
-
max time kernel
150s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28-05-2024 08:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3c493674068d0af156602861c20661c0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
3c493674068d0af156602861c20661c0_NeikiAnalytics.exe
-
Size
153KB
-
MD5
3c493674068d0af156602861c20661c0
-
SHA1
f3ba9f6a2d77f52bc69a40b531f4b473583d3c69
-
SHA256
e04a147d4176fb7637c7ffd8b5c260818b4f65b0cc3b75a4b1e5bddb3e3d51c1
-
SHA512
5e5bcf9018f67caf96d044a29a4a24997ac414dc25af9631172805ae4a37230ba0a192f50d8e76a44853337e3859d985eac45d3815ef23007865d02a48b878dd
-
SSDEEP
3072:ymb3NkkiQ3mdBjFIi/0RU6QeYQsm71vPmX5k2LrCimBaH8UH303g:n3C9BRIG0asYFm71mJkzpaH8m37
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/1532-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2940-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/436-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2940-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3016-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/776-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/944-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3856-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4800-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/428-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3112-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4116-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4476-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2864-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4328-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3088-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1772-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3640-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1244-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3744-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1852-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3016 vdjjd.exe 2940 xrfxffr.exe 436 nhbbhh.exe 396 rxxrlll.exe 4368 7nnnnn.exe 776 dvvpp.exe 944 xrfxxxf.exe 3856 1jpjj.exe 4800 frrxfxx.exe 428 nnbbbb.exe 3112 vddpd.exe 4116 hbtnbh.exe 4476 pvvpp.exe 1732 vjjdv.exe 4572 lxlfrrr.exe 116 tbnthh.exe 2864 jjvvp.exe 4328 lxrlxlx.exe 3088 ntttnn.exe 2896 tnnhtt.exe 4592 pdjdv.exe 384 rflfffx.exe 2328 nnbhbh.exe 1772 vjvvp.exe 4072 xlrlllf.exe 2320 bnhbtn.exe 3640 dppdv.exe 1244 lfrffll.exe 2212 nnhtnn.exe 3744 frxfxrl.exe 1852 rxfrrff.exe 1140 htnbtn.exe 2012 jdpjp.exe 2588 xfffrll.exe 3816 bnnbnh.exe 3368 bbthbt.exe 4216 jjpjd.exe 3936 fxfxfxf.exe 732 tnnhbb.exe 5000 7tnhbt.exe 2716 vddvj.exe 1272 pdpdp.exe 3404 3llxrfx.exe 4780 3ntnhh.exe 3712 jdpjp.exe 3924 vvvvj.exe 320 lfxrlff.exe 1820 hbhbtt.exe 3980 bthbhb.exe 3216 jvjjp.exe 5016 pvppj.exe 3600 rxxxfrf.exe 5004 hbhbbh.exe 4788 bnnhbb.exe 1712 9vvpd.exe 3680 1lxlfrr.exe 4308 7xxxrxl.exe 224 5nbbth.exe 3308 nttnnn.exe 2400 djjdp.exe 1760 lrrxrlf.exe 3088 fxrlxrl.exe 2292 tnttbb.exe 2200 jjppj.exe -
resource yara_rule behavioral2/memory/1532-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2940-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/436-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3016-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/776-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/944-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/944-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/944-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3856-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4800-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/428-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3112-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4116-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2864-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4328-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1772-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3640-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1244-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3744-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1852-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1532 wrote to memory of 3016 1532 3c493674068d0af156602861c20661c0_NeikiAnalytics.exe 83 PID 1532 wrote to memory of 3016 1532 3c493674068d0af156602861c20661c0_NeikiAnalytics.exe 83 PID 1532 wrote to memory of 3016 1532 3c493674068d0af156602861c20661c0_NeikiAnalytics.exe 83 PID 3016 wrote to memory of 2940 3016 vdjjd.exe 84 PID 3016 wrote to memory of 2940 3016 vdjjd.exe 84 PID 3016 wrote to memory of 2940 3016 vdjjd.exe 84 PID 2940 wrote to memory of 436 2940 xrfxffr.exe 85 PID 2940 wrote to memory of 436 2940 xrfxffr.exe 85 PID 2940 wrote to memory of 436 2940 xrfxffr.exe 85 PID 436 wrote to memory of 396 436 nhbbhh.exe 86 PID 436 wrote to memory of 396 436 nhbbhh.exe 86 PID 436 wrote to memory of 396 436 nhbbhh.exe 86 PID 396 wrote to memory of 4368 396 rxxrlll.exe 87 PID 396 wrote to memory of 4368 396 rxxrlll.exe 87 PID 396 wrote to memory of 4368 396 rxxrlll.exe 87 PID 4368 wrote to memory of 776 4368 7nnnnn.exe 88 PID 4368 wrote to memory of 776 4368 7nnnnn.exe 88 PID 4368 wrote to memory of 776 4368 7nnnnn.exe 88 PID 776 wrote to memory of 944 776 dvvpp.exe 90 PID 776 wrote to memory of 944 776 dvvpp.exe 90 PID 776 wrote to memory of 944 776 dvvpp.exe 90 PID 944 wrote to memory of 3856 944 xrfxxxf.exe 91 PID 944 wrote to memory of 3856 944 xrfxxxf.exe 91 PID 944 wrote to memory of 3856 944 xrfxxxf.exe 91 PID 3856 wrote to memory of 4800 3856 1jpjj.exe 92 PID 3856 wrote to memory of 4800 3856 1jpjj.exe 92 PID 3856 wrote to memory of 4800 3856 1jpjj.exe 92 PID 4800 wrote to memory of 428 4800 frrxfxx.exe 93 PID 4800 wrote to memory of 428 4800 frrxfxx.exe 93 PID 4800 wrote to memory of 428 4800 frrxfxx.exe 93 PID 428 wrote to memory of 3112 428 nnbbbb.exe 94 PID 428 wrote to memory of 3112 428 nnbbbb.exe 94 PID 428 wrote to memory of 3112 428 nnbbbb.exe 94 PID 3112 wrote to memory of 4116 3112 vddpd.exe 95 PID 3112 wrote to memory of 4116 3112 vddpd.exe 95 PID 3112 wrote to memory of 4116 3112 vddpd.exe 95 PID 4116 wrote to memory of 4476 4116 hbtnbh.exe 96 PID 4116 wrote to memory of 4476 4116 hbtnbh.exe 96 PID 4116 wrote to memory of 4476 4116 hbtnbh.exe 96 PID 4476 wrote to memory of 1732 4476 pvvpp.exe 97 PID 4476 wrote to memory of 1732 4476 pvvpp.exe 97 PID 4476 wrote to memory of 1732 4476 pvvpp.exe 97 PID 1732 wrote to memory of 4572 1732 vjjdv.exe 98 PID 1732 wrote to memory of 4572 1732 vjjdv.exe 98 PID 1732 wrote to memory of 4572 1732 vjjdv.exe 98 PID 4572 wrote to memory of 116 4572 lxlfrrr.exe 99 PID 4572 wrote to memory of 116 4572 lxlfrrr.exe 99 PID 4572 wrote to memory of 116 4572 lxlfrrr.exe 99 PID 116 wrote to memory of 2864 116 tbnthh.exe 100 PID 116 wrote to memory of 2864 116 tbnthh.exe 100 PID 116 wrote to memory of 2864 116 tbnthh.exe 100 PID 2864 wrote to memory of 4328 2864 jjvvp.exe 101 PID 2864 wrote to memory of 4328 2864 jjvvp.exe 101 PID 2864 wrote to memory of 4328 2864 jjvvp.exe 101 PID 4328 wrote to memory of 3088 4328 lxrlxlx.exe 102 PID 4328 wrote to memory of 3088 4328 lxrlxlx.exe 102 PID 4328 wrote to memory of 3088 4328 lxrlxlx.exe 102 PID 3088 wrote to memory of 2896 3088 ntttnn.exe 103 PID 3088 wrote to memory of 2896 3088 ntttnn.exe 103 PID 3088 wrote to memory of 2896 3088 ntttnn.exe 103 PID 2896 wrote to memory of 4592 2896 tnnhtt.exe 104 PID 2896 wrote to memory of 4592 2896 tnnhtt.exe 104 PID 2896 wrote to memory of 4592 2896 tnnhtt.exe 104 PID 4592 wrote to memory of 384 4592 pdjdv.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c493674068d0af156602861c20661c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3c493674068d0af156602861c20661c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\vdjjd.exec:\vdjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\xrfxffr.exec:\xrfxffr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\nhbbhh.exec:\nhbbhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\rxxrlll.exec:\rxxrlll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\7nnnnn.exec:\7nnnnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\dvvpp.exec:\dvvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\xrfxxxf.exec:\xrfxxxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\1jpjj.exec:\1jpjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
\??\c:\frrxfxx.exec:\frrxfxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\nnbbbb.exec:\nnbbbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
\??\c:\vddpd.exec:\vddpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\hbtnbh.exec:\hbtnbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\pvvpp.exec:\pvvpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\vjjdv.exec:\vjjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\lxlfrrr.exec:\lxlfrrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\tbnthh.exec:\tbnthh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\jjvvp.exec:\jjvvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\lxrlxlx.exec:\lxrlxlx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\ntttnn.exec:\ntttnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\tnnhtt.exec:\tnnhtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\pdjdv.exec:\pdjdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\rflfffx.exec:\rflfffx.exe23⤵
- Executes dropped EXE
PID:384 -
\??\c:\nnbhbh.exec:\nnbhbh.exe24⤵
- Executes dropped EXE
PID:2328 -
\??\c:\vjvvp.exec:\vjvvp.exe25⤵
- Executes dropped EXE
PID:1772 -
\??\c:\xlrlllf.exec:\xlrlllf.exe26⤵
- Executes dropped EXE
PID:4072 -
\??\c:\bnhbtn.exec:\bnhbtn.exe27⤵
- Executes dropped EXE
PID:2320 -
\??\c:\dppdv.exec:\dppdv.exe28⤵
- Executes dropped EXE
PID:3640 -
\??\c:\lfrffll.exec:\lfrffll.exe29⤵
- Executes dropped EXE
PID:1244 -
\??\c:\nnhtnn.exec:\nnhtnn.exe30⤵
- Executes dropped EXE
PID:2212 -
\??\c:\frxfxrl.exec:\frxfxrl.exe31⤵
- Executes dropped EXE
PID:3744 -
\??\c:\rxfrrff.exec:\rxfrrff.exe32⤵
- Executes dropped EXE
PID:1852 -
\??\c:\htnbtn.exec:\htnbtn.exe33⤵
- Executes dropped EXE
PID:1140 -
\??\c:\jdpjp.exec:\jdpjp.exe34⤵
- Executes dropped EXE
PID:2012 -
\??\c:\xfffrll.exec:\xfffrll.exe35⤵
- Executes dropped EXE
PID:2588 -
\??\c:\bnnbnh.exec:\bnnbnh.exe36⤵
- Executes dropped EXE
PID:3816 -
\??\c:\bbthbt.exec:\bbthbt.exe37⤵
- Executes dropped EXE
PID:3368 -
\??\c:\dvjjv.exec:\dvjjv.exe38⤵PID:3748
-
\??\c:\jjpjd.exec:\jjpjd.exe39⤵
- Executes dropped EXE
PID:4216 -
\??\c:\fxfxfxf.exec:\fxfxfxf.exe40⤵
- Executes dropped EXE
PID:3936 -
\??\c:\tnnhbb.exec:\tnnhbb.exe41⤵
- Executes dropped EXE
PID:732 -
\??\c:\7tnhbt.exec:\7tnhbt.exe42⤵
- Executes dropped EXE
PID:5000 -
\??\c:\vddvj.exec:\vddvj.exe43⤵
- Executes dropped EXE
PID:2716 -
\??\c:\pdpdp.exec:\pdpdp.exe44⤵
- Executes dropped EXE
PID:1272 -
\??\c:\3llxrfx.exec:\3llxrfx.exe45⤵
- Executes dropped EXE
PID:3404 -
\??\c:\3ntnhh.exec:\3ntnhh.exe46⤵
- Executes dropped EXE
PID:4780 -
\??\c:\jdpjp.exec:\jdpjp.exe47⤵
- Executes dropped EXE
PID:3712 -
\??\c:\vvvvj.exec:\vvvvj.exe48⤵
- Executes dropped EXE
PID:3924 -
\??\c:\lfxrlff.exec:\lfxrlff.exe49⤵
- Executes dropped EXE
PID:320 -
\??\c:\hbhbtt.exec:\hbhbtt.exe50⤵
- Executes dropped EXE
PID:1820 -
\??\c:\bthbhb.exec:\bthbhb.exe51⤵
- Executes dropped EXE
PID:3980 -
\??\c:\jvjjp.exec:\jvjjp.exe52⤵
- Executes dropped EXE
PID:3216 -
\??\c:\pvppj.exec:\pvppj.exe53⤵
- Executes dropped EXE
PID:5016 -
\??\c:\rxxxfrf.exec:\rxxxfrf.exe54⤵
- Executes dropped EXE
PID:3600 -
\??\c:\hbhbbh.exec:\hbhbbh.exe55⤵
- Executes dropped EXE
PID:5004 -
\??\c:\bnnhbb.exec:\bnnhbb.exe56⤵
- Executes dropped EXE
PID:4788 -
\??\c:\9vvpd.exec:\9vvpd.exe57⤵
- Executes dropped EXE
PID:1712 -
\??\c:\1lxlfrr.exec:\1lxlfrr.exe58⤵
- Executes dropped EXE
PID:3680 -
\??\c:\7xxxrxl.exec:\7xxxrxl.exe59⤵
- Executes dropped EXE
PID:4308 -
\??\c:\5nbbth.exec:\5nbbth.exe60⤵
- Executes dropped EXE
PID:224 -
\??\c:\nttnnn.exec:\nttnnn.exe61⤵
- Executes dropped EXE
PID:3308 -
\??\c:\djjdp.exec:\djjdp.exe62⤵
- Executes dropped EXE
PID:2400 -
\??\c:\lrrxrlf.exec:\lrrxrlf.exe63⤵
- Executes dropped EXE
PID:1760 -
\??\c:\fxrlxrl.exec:\fxrlxrl.exe64⤵
- Executes dropped EXE
PID:3088 -
\??\c:\tnttbb.exec:\tnttbb.exe65⤵
- Executes dropped EXE
PID:2292 -
\??\c:\jjppj.exec:\jjppj.exe66⤵
- Executes dropped EXE
PID:2200 -
\??\c:\jdpdp.exec:\jdpdp.exe67⤵PID:2384
-
\??\c:\lfxffxf.exec:\lfxffxf.exe68⤵PID:4048
-
\??\c:\5nbtbb.exec:\5nbtbb.exe69⤵PID:1952
-
\??\c:\jvddp.exec:\jvddp.exe70⤵PID:3020
-
\??\c:\jdddv.exec:\jdddv.exe71⤵PID:4568
-
\??\c:\fxffffr.exec:\fxffffr.exe72⤵PID:1436
-
\??\c:\btthnb.exec:\btthnb.exe73⤵PID:4448
-
\??\c:\ppvjd.exec:\ppvjd.exe74⤵PID:2132
-
\??\c:\rxfxrlf.exec:\rxfxrlf.exe75⤵PID:3808
-
\??\c:\7nbnbt.exec:\7nbnbt.exe76⤵PID:2320
-
\??\c:\pjpjv.exec:\pjpjv.exe77⤵PID:4744
-
\??\c:\rlffxrr.exec:\rlffxrr.exe78⤵PID:3516
-
\??\c:\nbbthh.exec:\nbbthh.exe79⤵PID:3744
-
\??\c:\tbhhbh.exec:\tbhhbh.exe80⤵PID:4760
-
\??\c:\jvvpj.exec:\jvvpj.exe81⤵PID:1140
-
\??\c:\xrxxrxx.exec:\xrxxrxx.exe82⤵PID:4220
-
\??\c:\fflllll.exec:\fflllll.exe83⤵PID:3256
-
\??\c:\ntnnhh.exec:\ntnnhh.exe84⤵PID:4764
-
\??\c:\tntntt.exec:\tntntt.exe85⤵PID:1452
-
\??\c:\1jvpd.exec:\1jvpd.exe86⤵PID:3748
-
\??\c:\lrrlfxf.exec:\lrrlfxf.exe87⤵PID:4216
-
\??\c:\xrfxllf.exec:\xrfxllf.exe88⤵PID:4348
-
\??\c:\7hnhtn.exec:\7hnhtn.exe89⤵PID:1612
-
\??\c:\tnhbhn.exec:\tnhbhn.exe90⤵PID:5000
-
\??\c:\jddpd.exec:\jddpd.exe91⤵PID:396
-
\??\c:\rxflrrf.exec:\rxflrrf.exe92⤵PID:1272
-
\??\c:\llrllff.exec:\llrllff.exe93⤵PID:1120
-
\??\c:\3ttnnt.exec:\3ttnnt.exe94⤵PID:2076
-
\??\c:\nbhtnh.exec:\nbhtnh.exe95⤵PID:944
-
\??\c:\dvdvv.exec:\dvdvv.exe96⤵PID:3924
-
\??\c:\dpjvj.exec:\dpjvj.exe97⤵PID:2168
-
\??\c:\rlllrrx.exec:\rlllrrx.exe98⤵PID:2856
-
\??\c:\ffxxlxf.exec:\ffxxlxf.exe99⤵PID:428
-
\??\c:\bbbtnh.exec:\bbbtnh.exe100⤵PID:5012
-
\??\c:\tttnnb.exec:\tttnnb.exe101⤵PID:5016
-
\??\c:\vpjdp.exec:\vpjdp.exe102⤵PID:3440
-
\??\c:\rrrrrxl.exec:\rrrrrxl.exe103⤵PID:1708
-
\??\c:\rlrrllr.exec:\rlrrllr.exe104⤵PID:4712
-
\??\c:\btnnhb.exec:\btnnhb.exe105⤵PID:724
-
\??\c:\1bhhhh.exec:\1bhhhh.exe106⤵PID:2620
-
\??\c:\hbnttt.exec:\hbnttt.exe107⤵PID:1372
-
\??\c:\jvvvv.exec:\jvvvv.exe108⤵PID:2864
-
\??\c:\7dddd.exec:\7dddd.exe109⤵PID:4428
-
\??\c:\xxxllll.exec:\xxxllll.exe110⤵PID:4616
-
\??\c:\1hhhhh.exec:\1hhhhh.exe111⤵PID:4528
-
\??\c:\7bhhbh.exec:\7bhhbh.exe112⤵PID:1904
-
\??\c:\jdpjd.exec:\jdpjd.exe113⤵PID:3964
-
\??\c:\ddjpp.exec:\ddjpp.exe114⤵PID:2200
-
\??\c:\flrllll.exec:\flrllll.exe115⤵PID:2384
-
\??\c:\btnnnn.exec:\btnnnn.exe116⤵PID:4048
-
\??\c:\pjjjj.exec:\pjjjj.exe117⤵PID:4716
-
\??\c:\xrrrrrr.exec:\xrrrrrr.exe118⤵PID:1832
-
\??\c:\9xrrffx.exec:\9xrrffx.exe119⤵PID:4576
-
\??\c:\9nhbtn.exec:\9nhbtn.exe120⤵PID:4448
-
\??\c:\pvvvp.exec:\pvvvp.exe121⤵PID:3496
-
\??\c:\dvpvp.exec:\dvpvp.exe122⤵PID:4524
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-