Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
14-06-2024 10:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b716963946e2f99989a6f17de94f25e0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
b716963946e2f99989a6f17de94f25e0_NeikiAnalytics.exe
-
Size
966KB
-
MD5
b716963946e2f99989a6f17de94f25e0
-
SHA1
0426d4d8bb38f8b4196f82c7b9cf433470153007
-
SHA256
22f3dcfa88dd3d383c587f562a1cadc08a00fac24d794f51cf4f1921fdba9e5d
-
SHA512
6f4cf78cc82e8a5a98222b3f9e5b546d36133c728963c7067e1335af04ba5b1d54228ca3fa68a543a93db0ef9e41bb09e8db07f34cbb158783a0c3ee66fb94c9
-
SSDEEP
12288:n3C9ytvngQjy3C9I3YEWpYe+GalTLfOX+I3C9S3C9ytvngQj65syLr9fuWpw:SgdnJVwLgdnJq9fu3
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/888-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1960-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1528-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2144-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1868-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1756-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1656-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/956-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/884-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/588-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/344-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2136-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1928-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1828-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1960 vvvjv.exe 1528 djdjp.exe 2144 tnbhtb.exe 2588 9jppv.exe 2596 pjpdp.exe 2828 lrfrlxf.exe 2580 rrlrfrr.exe 2456 bbnhbh.exe 2368 rxxfrxx.exe 1868 tthnth.exe 1756 hthnhh.exe 1656 bbnbhn.exe 956 bnhnhb.exe 2040 pjjpd.exe 1268 jdpjv.exe 884 nhnntn.exe 2792 frxflrr.exe 2124 7ttttn.exe 2620 dvvdp.exe 2848 tnnbtn.exe 588 5jpjd.exe 2336 xxxlflr.exe 344 ddjjv.exe 2136 xxxfxxx.exe 1980 vpjvv.exe 1928 rxxxlrx.exe 1720 lflrfxl.exe 1828 9nnbbb.exe 2380 lfxrffx.exe 2860 9tnbbn.exe 564 hthhbt.exe 2032 rlffxlx.exe 2868 bhbnht.exe 2180 xrlrlrf.exe 1960 5btthh.exe 2120 jpppd.exe 2984 5rrlxlr.exe 2656 7ttntt.exe 2548 1dddv.exe 2560 7rffxlr.exe 2708 bntntt.exe 2688 dvjdp.exe 2464 llfflxl.exe 2520 nnhttb.exe 2908 1vjdp.exe 2988 rllrllx.exe 1880 3nhntb.exe 2516 djddj.exe 2024 flflxlx.exe 1480 tnntbb.exe 1176 vjvvv.exe 964 rfrlllr.exe 2736 tnbhbh.exe 2812 nhhntn.exe 1620 lfflxfr.exe 1632 5lxrxxx.exe 3024 nbthtb.exe 684 5dvdd.exe 2260 llrrxfr.exe 708 nnnttb.exe 1892 pjddj.exe 1120 rrrxflr.exe 1052 tthtth.exe 1964 ddvdj.exe -
resource yara_rule behavioral1/memory/888-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1960-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1528-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2144-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1868-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1756-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1656-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/956-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/884-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/588-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/344-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2136-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1928-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1828-277-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 888 wrote to memory of 1960 888 b716963946e2f99989a6f17de94f25e0_NeikiAnalytics.exe 28 PID 888 wrote to memory of 1960 888 b716963946e2f99989a6f17de94f25e0_NeikiAnalytics.exe 28 PID 888 wrote to memory of 1960 888 b716963946e2f99989a6f17de94f25e0_NeikiAnalytics.exe 28 PID 888 wrote to memory of 1960 888 b716963946e2f99989a6f17de94f25e0_NeikiAnalytics.exe 28 PID 1960 wrote to memory of 1528 1960 vvvjv.exe 29 PID 1960 wrote to memory of 1528 1960 vvvjv.exe 29 PID 1960 wrote to memory of 1528 1960 vvvjv.exe 29 PID 1960 wrote to memory of 1528 1960 vvvjv.exe 29 PID 1528 wrote to memory of 2144 1528 djdjp.exe 30 PID 1528 wrote to memory of 2144 1528 djdjp.exe 30 PID 1528 wrote to memory of 2144 1528 djdjp.exe 30 PID 1528 wrote to memory of 2144 1528 djdjp.exe 30 PID 2144 wrote to memory of 2588 2144 tnbhtb.exe 31 PID 2144 wrote to memory of 2588 2144 tnbhtb.exe 31 PID 2144 wrote to memory of 2588 2144 tnbhtb.exe 31 PID 2144 wrote to memory of 2588 2144 tnbhtb.exe 31 PID 2588 wrote to memory of 2596 2588 9jppv.exe 32 PID 2588 wrote to memory of 2596 2588 9jppv.exe 32 PID 2588 wrote to memory of 2596 2588 9jppv.exe 32 PID 2588 wrote to memory of 2596 2588 9jppv.exe 32 PID 2596 wrote to memory of 2828 2596 pjpdp.exe 33 PID 2596 wrote to memory of 2828 2596 pjpdp.exe 33 PID 2596 wrote to memory of 2828 2596 pjpdp.exe 33 PID 2596 wrote to memory of 2828 2596 pjpdp.exe 33 PID 2828 wrote to memory of 2580 2828 lrfrlxf.exe 34 PID 2828 wrote to memory of 2580 2828 lrfrlxf.exe 34 PID 2828 wrote to memory of 2580 2828 lrfrlxf.exe 34 PID 2828 wrote to memory of 2580 2828 lrfrlxf.exe 34 PID 2580 wrote to memory of 2456 2580 rrlrfrr.exe 35 PID 2580 wrote to memory of 2456 2580 rrlrfrr.exe 35 PID 2580 wrote to memory of 2456 2580 rrlrfrr.exe 35 PID 2580 wrote to memory of 2456 2580 rrlrfrr.exe 35 PID 2456 wrote to memory of 2368 2456 bbnhbh.exe 36 PID 2456 wrote to memory of 2368 2456 bbnhbh.exe 36 PID 2456 wrote to memory of 2368 2456 bbnhbh.exe 36 PID 2456 wrote to memory of 2368 2456 bbnhbh.exe 36 PID 2368 wrote to memory of 1868 2368 rxxfrxx.exe 37 PID 2368 wrote to memory of 1868 2368 rxxfrxx.exe 37 PID 2368 wrote to memory of 1868 2368 rxxfrxx.exe 37 PID 2368 wrote to memory of 1868 2368 rxxfrxx.exe 37 PID 1868 wrote to memory of 1756 1868 tthnth.exe 38 PID 1868 wrote to memory of 1756 1868 tthnth.exe 38 PID 1868 wrote to memory of 1756 1868 tthnth.exe 38 PID 1868 wrote to memory of 1756 1868 tthnth.exe 38 PID 1756 wrote to memory of 1656 1756 hthnhh.exe 39 PID 1756 wrote to memory of 1656 1756 hthnhh.exe 39 PID 1756 wrote to memory of 1656 1756 hthnhh.exe 39 PID 1756 wrote to memory of 1656 1756 hthnhh.exe 39 PID 1656 wrote to memory of 956 1656 bbnbhn.exe 40 PID 1656 wrote to memory of 956 1656 bbnbhn.exe 40 PID 1656 wrote to memory of 956 1656 bbnbhn.exe 40 PID 1656 wrote to memory of 956 1656 bbnbhn.exe 40 PID 956 wrote to memory of 2040 956 bnhnhb.exe 41 PID 956 wrote to memory of 2040 956 bnhnhb.exe 41 PID 956 wrote to memory of 2040 956 bnhnhb.exe 41 PID 956 wrote to memory of 2040 956 bnhnhb.exe 41 PID 2040 wrote to memory of 1268 2040 pjjpd.exe 42 PID 2040 wrote to memory of 1268 2040 pjjpd.exe 42 PID 2040 wrote to memory of 1268 2040 pjjpd.exe 42 PID 2040 wrote to memory of 1268 2040 pjjpd.exe 42 PID 1268 wrote to memory of 884 1268 jdpjv.exe 43 PID 1268 wrote to memory of 884 1268 jdpjv.exe 43 PID 1268 wrote to memory of 884 1268 jdpjv.exe 43 PID 1268 wrote to memory of 884 1268 jdpjv.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\b716963946e2f99989a6f17de94f25e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b716963946e2f99989a6f17de94f25e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\vvvjv.exec:\vvvjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\djdjp.exec:\djdjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\tnbhtb.exec:\tnbhtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\9jppv.exec:\9jppv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\pjpdp.exec:\pjpdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\lrfrlxf.exec:\lrfrlxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\rrlrfrr.exec:\rrlrfrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\bbnhbh.exec:\bbnhbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\rxxfrxx.exec:\rxxfrxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\tthnth.exec:\tthnth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\hthnhh.exec:\hthnhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\bbnbhn.exec:\bbnbhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\bnhnhb.exec:\bnhnhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
\??\c:\pjjpd.exec:\pjjpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\jdpjv.exec:\jdpjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\nhnntn.exec:\nhnntn.exe17⤵
- Executes dropped EXE
PID:884 -
\??\c:\frxflrr.exec:\frxflrr.exe18⤵
- Executes dropped EXE
PID:2792 -
\??\c:\7ttttn.exec:\7ttttn.exe19⤵
- Executes dropped EXE
PID:2124 -
\??\c:\dvvdp.exec:\dvvdp.exe20⤵
- Executes dropped EXE
PID:2620 -
\??\c:\tnnbtn.exec:\tnnbtn.exe21⤵
- Executes dropped EXE
PID:2848 -
\??\c:\5jpjd.exec:\5jpjd.exe22⤵
- Executes dropped EXE
PID:588 -
\??\c:\xxxlflr.exec:\xxxlflr.exe23⤵
- Executes dropped EXE
PID:2336 -
\??\c:\ddjjv.exec:\ddjjv.exe24⤵
- Executes dropped EXE
PID:344 -
\??\c:\xxxfxxx.exec:\xxxfxxx.exe25⤵
- Executes dropped EXE
PID:2136 -
\??\c:\vpjvv.exec:\vpjvv.exe26⤵
- Executes dropped EXE
PID:1980 -
\??\c:\rxxxlrx.exec:\rxxxlrx.exe27⤵
- Executes dropped EXE
PID:1928 -
\??\c:\lflrfxl.exec:\lflrfxl.exe28⤵
- Executes dropped EXE
PID:1720 -
\??\c:\9nnbbb.exec:\9nnbbb.exe29⤵
- Executes dropped EXE
PID:1828 -
\??\c:\lfxrffx.exec:\lfxrffx.exe30⤵
- Executes dropped EXE
PID:2380 -
\??\c:\9tnbbn.exec:\9tnbbn.exe31⤵
- Executes dropped EXE
PID:2860 -
\??\c:\hthhbt.exec:\hthhbt.exe32⤵
- Executes dropped EXE
PID:564 -
\??\c:\rlffxlx.exec:\rlffxlx.exe33⤵
- Executes dropped EXE
PID:2032 -
\??\c:\bhbnht.exec:\bhbnht.exe34⤵
- Executes dropped EXE
PID:2868 -
\??\c:\9xrxflr.exec:\9xrxflr.exe35⤵PID:2316
-
\??\c:\xrlrlrf.exec:\xrlrlrf.exe36⤵
- Executes dropped EXE
PID:2180 -
\??\c:\5btthh.exec:\5btthh.exe37⤵
- Executes dropped EXE
PID:1960 -
\??\c:\jpppd.exec:\jpppd.exe38⤵
- Executes dropped EXE
PID:2120 -
\??\c:\5rrlxlr.exec:\5rrlxlr.exe39⤵
- Executes dropped EXE
PID:2984 -
\??\c:\7ttntt.exec:\7ttntt.exe40⤵
- Executes dropped EXE
PID:2656 -
\??\c:\1dddv.exec:\1dddv.exe41⤵
- Executes dropped EXE
PID:2548 -
\??\c:\7rffxlr.exec:\7rffxlr.exe42⤵
- Executes dropped EXE
PID:2560 -
\??\c:\bntntt.exec:\bntntt.exe43⤵
- Executes dropped EXE
PID:2708 -
\??\c:\dvjdp.exec:\dvjdp.exe44⤵
- Executes dropped EXE
PID:2688 -
\??\c:\llfflxl.exec:\llfflxl.exe45⤵
- Executes dropped EXE
PID:2464 -
\??\c:\nnhttb.exec:\nnhttb.exe46⤵
- Executes dropped EXE
PID:2520 -
\??\c:\1vjdp.exec:\1vjdp.exe47⤵
- Executes dropped EXE
PID:2908 -
\??\c:\rllrllx.exec:\rllrllx.exe48⤵
- Executes dropped EXE
PID:2988 -
\??\c:\3nhntb.exec:\3nhntb.exe49⤵
- Executes dropped EXE
PID:1880 -
\??\c:\djddj.exec:\djddj.exe50⤵
- Executes dropped EXE
PID:2516 -
\??\c:\flflxlx.exec:\flflxlx.exe51⤵
- Executes dropped EXE
PID:2024 -
\??\c:\tnntbb.exec:\tnntbb.exe52⤵
- Executes dropped EXE
PID:1480 -
\??\c:\vjvvv.exec:\vjvvv.exe53⤵
- Executes dropped EXE
PID:1176 -
\??\c:\rfrlllr.exec:\rfrlllr.exe54⤵
- Executes dropped EXE
PID:964 -
\??\c:\tnbhbh.exec:\tnbhbh.exe55⤵
- Executes dropped EXE
PID:2736 -
\??\c:\nhhntn.exec:\nhhntn.exe56⤵
- Executes dropped EXE
PID:2812 -
\??\c:\lfflxfr.exec:\lfflxfr.exe57⤵
- Executes dropped EXE
PID:1620 -
\??\c:\5lxrxxx.exec:\5lxrxxx.exe58⤵
- Executes dropped EXE
PID:1632 -
\??\c:\nbthtb.exec:\nbthtb.exe59⤵
- Executes dropped EXE
PID:3024 -
\??\c:\5dvdd.exec:\5dvdd.exe60⤵
- Executes dropped EXE
PID:684 -
\??\c:\llrrxfr.exec:\llrrxfr.exe61⤵
- Executes dropped EXE
PID:2260 -
\??\c:\nnnttb.exec:\nnnttb.exe62⤵
- Executes dropped EXE
PID:708 -
\??\c:\pjddj.exec:\pjddj.exe63⤵
- Executes dropped EXE
PID:1892 -
\??\c:\rrrxflr.exec:\rrrxflr.exe64⤵
- Executes dropped EXE
PID:1120 -
\??\c:\tthtth.exec:\tthtth.exe65⤵
- Executes dropped EXE
PID:1052 -
\??\c:\ddvdj.exec:\ddvdj.exe66⤵
- Executes dropped EXE
PID:1964 -
\??\c:\5rrxllx.exec:\5rrxllx.exe67⤵PID:1536
-
\??\c:\ttbnth.exec:\ttbnth.exe68⤵PID:1456
-
\??\c:\dvdjp.exec:\dvdjp.exe69⤵PID:1824
-
\??\c:\3frxrrx.exec:\3frxrrx.exe70⤵PID:1820
-
\??\c:\lllxffx.exec:\lllxffx.exe71⤵PID:1904
-
\??\c:\nnnbth.exec:\nnnbth.exe72⤵PID:2872
-
\??\c:\pdppp.exec:\pdppp.exe73⤵PID:2324
-
\??\c:\xrffllx.exec:\xrffllx.exe74⤵PID:2960
-
\??\c:\nntbnt.exec:\nntbnt.exe75⤵PID:904
-
\??\c:\djjvj.exec:\djjvj.exe76⤵PID:2284
-
\??\c:\xrxxflr.exec:\xrxxflr.exe77⤵PID:1608
-
\??\c:\ttntnt.exec:\ttntnt.exe78⤵PID:2356
-
\??\c:\1jdjv.exec:\1jdjv.exe79⤵PID:2996
-
\??\c:\rlflrxr.exec:\rlflrxr.exe80⤵PID:2132
-
\??\c:\nnttnb.exec:\nnttnb.exe81⤵PID:1736
-
\??\c:\vppvd.exec:\vppvd.exe82⤵PID:2640
-
\??\c:\5rrrflr.exec:\5rrrflr.exe83⤵PID:2676
-
\??\c:\1hbbtn.exec:\1hbbtn.exe84⤵PID:2452
-
\??\c:\5vpjj.exec:\5vpjj.exe85⤵PID:2596
-
\??\c:\rlfffxx.exec:\rlfffxx.exe86⤵PID:2096
-
\??\c:\hbtbbn.exec:\hbtbbn.exe87⤵PID:2616
-
\??\c:\9jvdp.exec:\9jvdp.exe88⤵PID:2496
-
\??\c:\3xlrlrf.exec:\3xlrlrf.exe89⤵PID:2916
-
\??\c:\nhnthn.exec:\nhnthn.exe90⤵PID:2924
-
\??\c:\vpddd.exec:\vpddd.exe91⤵PID:2080
-
\??\c:\lrffrrl.exec:\lrffrrl.exe92⤵PID:2796
-
\??\c:\tnnnbh.exec:\tnnnbh.exe93⤵PID:1096
-
\??\c:\dvjpj.exec:\dvjpj.exe94⤵PID:816
-
\??\c:\7rxxllr.exec:\7rxxllr.exe95⤵PID:1872
-
\??\c:\nhnthn.exec:\nhnthn.exe96⤵PID:776
-
\??\c:\ddvpd.exec:\ddvpd.exe97⤵PID:2040
-
\??\c:\1frxxfr.exec:\1frxxfr.exe98⤵PID:1268
-
\??\c:\1hnnhb.exec:\1hnnhb.exe99⤵PID:1740
-
\??\c:\pvppj.exec:\pvppj.exe100⤵PID:2244
-
\??\c:\3frlrxf.exec:\3frlrxf.exe101⤵PID:1104
-
\??\c:\bhbhnb.exec:\bhbhnb.exe102⤵PID:1136
-
\??\c:\pdjdj.exec:\pdjdj.exe103⤵PID:896
-
\??\c:\fxffffr.exec:\fxffffr.exe104⤵PID:860
-
\??\c:\btnhbt.exec:\btnhbt.exe105⤵PID:852
-
\??\c:\vppjp.exec:\vppjp.exe106⤵PID:1920
-
\??\c:\xrlrrlx.exec:\xrlrrlx.exe107⤵PID:1284
-
\??\c:\bnbtnb.exec:\bnbtnb.exe108⤵PID:800
-
\??\c:\ppjjv.exec:\ppjjv.exe109⤵PID:2104
-
\??\c:\5xxxxxf.exec:\5xxxxxf.exe110⤵PID:1156
-
\??\c:\nnhnbb.exec:\nnhnbb.exe111⤵PID:1980
-
\??\c:\ddppj.exec:\ddppj.exe112⤵PID:1912
-
\??\c:\xrrrxfr.exec:\xrrrxfr.exe113⤵PID:700
-
\??\c:\tbttbt.exec:\tbttbt.exe114⤵PID:2348
-
\??\c:\dpvpv.exec:\dpvpv.exe115⤵PID:1716
-
\??\c:\rfrxrxl.exec:\rfrxrxl.exe116⤵PID:3068
-
\??\c:\5rllrrf.exec:\5rllrrf.exe117⤵PID:1060
-
\??\c:\5hbntb.exec:\5hbntb.exe118⤵PID:1540
-
\??\c:\pdvvv.exec:\pdvvv.exe119⤵PID:2884
-
\??\c:\fxllxxx.exec:\fxllxxx.exe120⤵PID:1944
-
\??\c:\hhtnbt.exec:\hhtnbt.exe121⤵PID:2204
-
\??\c:\dvvjp.exec:\dvvjp.exe122⤵PID:2140
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-