Analysis
- max time kernel
150s - max time network
112s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 04:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8816a80fe2e33bb221de4dabeac84590_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
- Target 8816a80fe2e33bb221de4dabeac84590_NeikiAnalytics.exe
- Size 372KB
- Sample240518-ek33kabb38
- SHA256 ad05ba9fed1ceb11cbf174c47203929d46492944ec93f464d3b65238e16e776c
- MD5 8816a80fe2e33bb221de4dabeac84590
- SHA1 80c9c57f7b5adc1e56d5f0abcffbb3c4c783becd
- SHA512 1a643c435ceff6537eee2faa4eff1b0fb48a528e05a75c3f374cd74ff9d17702cae766a1d840b11bde61dcec6d0e2b7156f482b89ac81945df8ccf5d412e6c0b
- SSDEEP 6144:n3C9BRIG0asYFm71mJl3/X8mak5gNv9rC8IwLaYNUvtTxTKMMl:n3C9uYA7i3/stR9HGYyvtTxTKMu
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/1536-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4632-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4876-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1976-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3028-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2448-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3600-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/764-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5012-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2768-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/980-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1092-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/768-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1912-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2164-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4392-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 4876 pjjdv.exe 4632 xlrlfxr.exe 4572 xxllxxl.exe 1976 ntttnn.exe 3028 rlfxrrl.exe 2448 7nttnn.exe 2524 flxxxxx.exe 3228 nttnhb.exe 3600 9lrlllf.exe 4636 hhbhhh.exe 2092 vppdp.exe 3640 tbnhhb.exe 764 lxxlffr.exe 5084 hhtnnb.exe 5012 fffffrr.exe 4440 7vvvd.exe 2768 1rlfflf.exe 980 bhtntb.exe 1092 rrxrlxx.exe 768 hbhbhh.exe 1272 xxfffxf.exe 3056 jjpjd.exe 2344 lrlllff.exe 1912 7hhbth.exe 5004 pdddp.exe 544 hbhbbb.exe 2164 xlrlflf.exe 3724 xrfxxll.exe 2808 nhnbbb.exe 4392 hhbbtn.exe 4600 tnnttb.exe 4588 jddvv.exe 2672 lfffflf.exe 548 nntttb.exe 4352 rrflffl.exe 1428 nhtttt.exe 224 xfrrxxr.exe 3120 flrrrrr.exe 2004 pvddj.exe 4820 xrrffrr.exe 3188 nttttt.exe 2836 ddjjj.exe 1976 pjvpp.exe 4204 lflrrxf.exe 1464 9bnhhn.exe 2524 lrxrxxx.exe 3456 xrxrlrl.exe 1984 htbtnn.exe 3600 jpddd.exe 5068 ddpjv.exe 2928 rlffrrx.exe 3280 bnnttt.exe 3640 ppvvd.exe 3960 xfxffrx.exe 212 ffrrfll.exe 740 bhhhbb.exe 988 7hnhnn.exe 1884 jdddv.exe 2596 pjjjp.exe 1768 rxxxxxx.exe 2320 1hnbtt.exe 1112 pjvvp.exe 4276 rxrrrxx.exe 1748 flrlflf.exe -
resource yara_rule behavioral2/memory/1536-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4632-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4876-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1976-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1976-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3028-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2448-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3600-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/764-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5012-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/980-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1092-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/768-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1912-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2164-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4392-197-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1536 wrote to memory of 4876 1536 8816a80fe2e33bb221de4dabeac84590_NeikiAnalytics.exe 83 PID 1536 wrote to memory of 4876 1536 8816a80fe2e33bb221de4dabeac84590_NeikiAnalytics.exe 83 PID 1536 wrote to memory of 4876 1536 8816a80fe2e33bb221de4dabeac84590_NeikiAnalytics.exe 83 PID 4876 wrote to memory of 4632 4876 pjjdv.exe 84 PID 4876 wrote to memory of 4632 4876 pjjdv.exe 84 PID 4876 wrote to memory of 4632 4876 pjjdv.exe 84 PID 4632 wrote to memory of 4572 4632 xlrlfxr.exe 85 PID 4632 wrote to memory of 4572 4632 xlrlfxr.exe 85 PID 4632 wrote to memory of 4572 4632 xlrlfxr.exe 85 PID 4572 wrote to memory of 1976 4572 xxllxxl.exe 86 PID 4572 wrote to memory of 1976 4572 xxllxxl.exe 86 PID 4572 wrote to memory of 1976 4572 xxllxxl.exe 86 PID 1976 wrote to memory of 3028 1976 ntttnn.exe 87 PID 1976 wrote to memory of 3028 1976 ntttnn.exe 87 PID 1976 wrote to memory of 3028 1976 ntttnn.exe 87 PID 3028 wrote to memory of 2448 3028 rlfxrrl.exe 88 PID 3028 wrote to memory of 2448 3028 rlfxrrl.exe 88 PID 3028 wrote to memory of 2448 3028 rlfxrrl.exe 88 PID 2448 wrote to memory of 2524 2448 7nttnn.exe 89 PID 2448 wrote to memory of 2524 2448 7nttnn.exe 89 PID 2448 wrote to memory of 2524 2448 7nttnn.exe 89 PID 2524 wrote to memory of 3228 2524 flxxxxx.exe 90 PID 2524 wrote to memory of 3228 2524 flxxxxx.exe 90 PID 2524 wrote to memory of 3228 2524 flxxxxx.exe 90 PID 3228 wrote to memory of 3600 3228 nttnhb.exe 91 PID 3228 wrote to memory of 3600 3228 nttnhb.exe 91 PID 3228 wrote to memory of 3600 3228 nttnhb.exe 91 PID 3600 wrote to memory of 4636 3600 9lrlllf.exe 92 PID 3600 wrote to memory of 4636 3600 9lrlllf.exe 92 PID 3600 wrote to memory of 4636 3600 9lrlllf.exe 92 PID 4636 wrote to memory of 2092 4636 hhbhhh.exe 93 PID 4636 wrote to memory of 2092 4636 hhbhhh.exe 93 PID 4636 wrote to memory of 2092 4636 hhbhhh.exe 93 PID 2092 wrote to memory of 3640 2092 vppdp.exe 94 PID 2092 wrote to memory of 3640 2092 vppdp.exe 94 PID 2092 wrote to memory of 3640 2092 vppdp.exe 94 PID 3640 wrote to memory of 764 3640 tbnhhb.exe 95 PID 3640 wrote to memory of 764 3640 tbnhhb.exe 95 PID 3640 wrote to memory of 764 3640 tbnhhb.exe 95 PID 764 wrote to memory of 5084 764 lxxlffr.exe 96 PID 764 wrote to memory of 5084 764 lxxlffr.exe 96 PID 764 wrote to memory of 5084 764 lxxlffr.exe 96 PID 5084 wrote to memory of 5012 5084 hhtnnb.exe 98 PID 5084 wrote to memory of 5012 5084 hhtnnb.exe 98 PID 5084 wrote to memory of 5012 5084 hhtnnb.exe 98 PID 5012 wrote to memory of 4440 5012 fffffrr.exe 99 PID 5012 wrote to memory of 4440 5012 fffffrr.exe 99 PID 5012 wrote to memory of 4440 5012 fffffrr.exe 99 PID 4440 wrote to memory of 2768 4440 7vvvd.exe 100 PID 4440 wrote to memory of 2768 4440 7vvvd.exe 100 PID 4440 wrote to memory of 2768 4440 7vvvd.exe 100 PID 2768 wrote to memory of 980 2768 1rlfflf.exe 101 PID 2768 wrote to memory of 980 2768 1rlfflf.exe 101 PID 2768 wrote to memory of 980 2768 1rlfflf.exe 101 PID 980 wrote to memory of 1092 980 bhtntb.exe 103 PID 980 wrote to memory of 1092 980 bhtntb.exe 103 PID 980 wrote to memory of 1092 980 bhtntb.exe 103 PID 1092 wrote to memory of 768 1092 rrxrlxx.exe 104 PID 1092 wrote to memory of 768 1092 rrxrlxx.exe 104 PID 1092 wrote to memory of 768 1092 rrxrlxx.exe 104 PID 768 wrote to memory of 1272 768 hbhbhh.exe 106 PID 768 wrote to memory of 1272 768 hbhbhh.exe 106 PID 768 wrote to memory of 1272 768 hbhbhh.exe 106 PID 1272 wrote to memory of 3056 1272 xxfffxf.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\8816a80fe2e33bb221de4dabeac84590_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8816a80fe2e33bb221de4dabeac84590_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\pjjdv.exec:\pjjdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\xlrlfxr.exec:\xlrlfxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\xxllxxl.exec:\xxllxxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\ntttnn.exec:\ntttnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\rlfxrrl.exec:\rlfxrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\7nttnn.exec:\7nttnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\flxxxxx.exec:\flxxxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\nttnhb.exec:\nttnhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\9lrlllf.exec:\9lrlllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\hhbhhh.exec:\hhbhhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\vppdp.exec:\vppdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\tbnhhb.exec:\tbnhhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\lxxlffr.exec:\lxxlffr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\hhtnnb.exec:\hhtnnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\fffffrr.exec:\fffffrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\7vvvd.exec:\7vvvd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\1rlfflf.exec:\1rlfflf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\bhtntb.exec:\bhtntb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\rrxrlxx.exec:\rrxrlxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\hbhbhh.exec:\hbhbhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\xxfffxf.exec:\xxfffxf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\jjpjd.exec:\jjpjd.exe23⤵
- Executes dropped EXE
PID:3056 -
\??\c:\lrlllff.exec:\lrlllff.exe24⤵
- Executes dropped EXE
PID:2344 -
\??\c:\7hhbth.exec:\7hhbth.exe25⤵
- Executes dropped EXE
PID:1912 -
\??\c:\pdddp.exec:\pdddp.exe26⤵
- Executes dropped EXE
PID:5004 -
\??\c:\hbhbbb.exec:\hbhbbb.exe27⤵
- Executes dropped EXE
PID:544 -
\??\c:\xlrlflf.exec:\xlrlflf.exe28⤵
- Executes dropped EXE
PID:2164 -
\??\c:\xrfxxll.exec:\xrfxxll.exe29⤵
- Executes dropped EXE
PID:3724 -
\??\c:\nhnbbb.exec:\nhnbbb.exe30⤵
- Executes dropped EXE
PID:2808 -
\??\c:\hhbbtn.exec:\hhbbtn.exe31⤵
- Executes dropped EXE
PID:4392 -
\??\c:\tnnttb.exec:\tnnttb.exe32⤵
- Executes dropped EXE
PID:4600 -
\??\c:\jddvv.exec:\jddvv.exe33⤵
- Executes dropped EXE
PID:4588 -
\??\c:\lfffflf.exec:\lfffflf.exe34⤵
- Executes dropped EXE
PID:2672 -
\??\c:\nntttb.exec:\nntttb.exe35⤵
- Executes dropped EXE
PID:548 -
\??\c:\rrflffl.exec:\rrflffl.exe36⤵
- Executes dropped EXE
PID:4352 -
\??\c:\nhtttt.exec:\nhtttt.exe37⤵
- Executes dropped EXE
PID:1428 -
\??\c:\xfrrxxr.exec:\xfrrxxr.exe38⤵
- Executes dropped EXE
PID:224 -
\??\c:\flrrrrr.exec:\flrrrrr.exe39⤵
- Executes dropped EXE
PID:3120 -
\??\c:\pvddj.exec:\pvddj.exe40⤵
- Executes dropped EXE
PID:2004 -
\??\c:\xrrffrr.exec:\xrrffrr.exe41⤵
- Executes dropped EXE
PID:4820 -
\??\c:\nttttt.exec:\nttttt.exe42⤵
- Executes dropped EXE
PID:3188 -
\??\c:\ddjjj.exec:\ddjjj.exe43⤵
- Executes dropped EXE
PID:2836 -
\??\c:\pjvpp.exec:\pjvpp.exe44⤵
- Executes dropped EXE
PID:1976 -
\??\c:\lflrrxf.exec:\lflrrxf.exe45⤵
- Executes dropped EXE
PID:4204 -
\??\c:\9bnhhn.exec:\9bnhhn.exe46⤵
- Executes dropped EXE
PID:1464 -
\??\c:\lrxrxxx.exec:\lrxrxxx.exe47⤵
- Executes dropped EXE
PID:2524 -
\??\c:\xrxrlrl.exec:\xrxrlrl.exe48⤵
- Executes dropped EXE
PID:3456 -
\??\c:\htbtnn.exec:\htbtnn.exe49⤵
- Executes dropped EXE
PID:1984 -
\??\c:\jpddd.exec:\jpddd.exe50⤵
- Executes dropped EXE
PID:3600 -
\??\c:\ddpjv.exec:\ddpjv.exe51⤵
- Executes dropped EXE
PID:5068 -
\??\c:\rlffrrx.exec:\rlffrrx.exe52⤵
- Executes dropped EXE
PID:2928 -
\??\c:\bnnttt.exec:\bnnttt.exe53⤵
- Executes dropped EXE
PID:3280 -
\??\c:\ppvvd.exec:\ppvvd.exe54⤵
- Executes dropped EXE
PID:3640 -
\??\c:\xfxffrx.exec:\xfxffrx.exe55⤵
- Executes dropped EXE
PID:3960 -
\??\c:\ffrrfll.exec:\ffrrfll.exe56⤵
- Executes dropped EXE
PID:212 -
\??\c:\bhhhbb.exec:\bhhhbb.exe57⤵
- Executes dropped EXE
PID:740 -
\??\c:\7hnhnn.exec:\7hnhnn.exe58⤵
- Executes dropped EXE
PID:988 -
\??\c:\jdddv.exec:\jdddv.exe59⤵
- Executes dropped EXE
PID:1884 -
\??\c:\pjjjp.exec:\pjjjp.exe60⤵
- Executes dropped EXE
PID:2596 -
\??\c:\rxxxxxx.exec:\rxxxxxx.exe61⤵
- Executes dropped EXE
PID:1768 -
\??\c:\1hnbtt.exec:\1hnbtt.exe62⤵
- Executes dropped EXE
PID:2320 -
\??\c:\pjvvp.exec:\pjvvp.exe63⤵
- Executes dropped EXE
PID:1112 -
\??\c:\rxrrrxx.exec:\rxrrrxx.exe64⤵
- Executes dropped EXE
PID:4276 -
\??\c:\flrlflf.exec:\flrlflf.exe65⤵
- Executes dropped EXE
PID:1748 -
\??\c:\5nnbbn.exec:\5nnbbn.exe66⤵PID:1640
-
\??\c:\9vpjd.exec:\9vpjd.exe67⤵PID:3584
-
\??\c:\rrllxfr.exec:\rrllxfr.exe68⤵PID:748
-
\??\c:\fxllrrr.exec:\fxllrrr.exe69⤵PID:3464
-
\??\c:\bbtttt.exec:\bbtttt.exe70⤵PID:1520
-
\??\c:\nntttb.exec:\nntttb.exe71⤵PID:3232
-
\??\c:\dvddv.exec:\dvddv.exe72⤵PID:3244
-
\??\c:\flxrrrr.exec:\flxrrrr.exe73⤵PID:4660
-
\??\c:\lrflrrr.exec:\lrflrrr.exe74⤵PID:3492
-
\??\c:\tntttt.exec:\tntttt.exe75⤵PID:3716
-
\??\c:\nntbbh.exec:\nntbbh.exe76⤵PID:1052
-
\??\c:\pjpvv.exec:\pjpvv.exe77⤵PID:2440
-
\??\c:\5rrllxx.exec:\5rrllxx.exe78⤵PID:2980
-
\??\c:\nhbbbb.exec:\nhbbbb.exe79⤵PID:928
-
\??\c:\pvppd.exec:\pvppd.exe80⤵PID:1980
-
\??\c:\5vvvp.exec:\5vvvp.exe81⤵PID:4356
-
\??\c:\lrrrlfl.exec:\lrrrlfl.exe82⤵PID:4036
-
\??\c:\bthnnn.exec:\bthnnn.exe83⤵PID:4876
-
\??\c:\ppvvv.exec:\ppvvv.exe84⤵PID:1012
-
\??\c:\lxfxrlf.exec:\lxfxrlf.exe85⤵PID:1476
-
\??\c:\xrrrllf.exec:\xrrrllf.exe86⤵PID:4880
-
\??\c:\hbhhhn.exec:\hbhhhn.exe87⤵PID:4820
-
\??\c:\jjddp.exec:\jjddp.exe88⤵PID:5116
-
\??\c:\flrlrxf.exec:\flrlrxf.exe89⤵PID:4596
-
\??\c:\fxlrffx.exec:\fxlrffx.exe90⤵PID:4216
-
\??\c:\7hhhnt.exec:\7hhhnt.exe91⤵PID:2104
-
\??\c:\vvjvj.exec:\vvjvj.exe92⤵PID:400
-
\??\c:\pjvpp.exec:\pjvpp.exe93⤵PID:1680
-
\??\c:\7xxrrrr.exec:\7xxrrrr.exe94⤵PID:3912
-
\??\c:\bhttnn.exec:\bhttnn.exe95⤵PID:1940
-
\??\c:\hbnhhn.exec:\hbnhhn.exe96⤵PID:2428
-
\??\c:\vdjpv.exec:\vdjpv.exe97⤵PID:5044
-
\??\c:\rxfxrlf.exec:\rxfxrlf.exe98⤵PID:3620
-
\??\c:\hbhbbh.exec:\hbhbbh.exe99⤵PID:4744
-
\??\c:\bhttnt.exec:\bhttnt.exe100⤵PID:3960
-
\??\c:\3ppjj.exec:\3ppjj.exe101⤵PID:4124
-
\??\c:\rlrllll.exec:\rlrllll.exe102⤵PID:3560
-
\??\c:\ffxfffr.exec:\ffxfffr.exe103⤵PID:4644
-
\??\c:\tbbbbb.exec:\tbbbbb.exe104⤵PID:2976
-
\??\c:\vdjdv.exec:\vdjdv.exe105⤵PID:348
-
\??\c:\flxfrrr.exec:\flxfrrr.exe106⤵PID:2116
-
\??\c:\5ntttt.exec:\5ntttt.exe107⤵PID:2492
-
\??\c:\bbbbbh.exec:\bbbbbh.exe108⤵PID:3260
-
\??\c:\jvvvp.exec:\jvvvp.exe109⤵PID:4852
-
\??\c:\frxxxxr.exec:\frxxxxr.exe110⤵PID:3748
-
\??\c:\5rlrlrr.exec:\5rlrlrr.exe111⤵PID:5000
-
\??\c:\hhnbbb.exec:\hhnbbb.exe112⤵PID:3292
-
\??\c:\pvdjj.exec:\pvdjj.exe113⤵PID:3684
-
\??\c:\pdpjj.exec:\pdpjj.exe114⤵PID:4120
-
\??\c:\xrrfxfx.exec:\xrrfxfx.exe115⤵PID:1796
-
\??\c:\ttnbtn.exec:\ttnbtn.exe116⤵PID:2804
-
\??\c:\ddppp.exec:\ddppp.exe117⤵PID:2308
-
\??\c:\jjpjj.exec:\jjpjj.exe118⤵PID:4928
-
\??\c:\lrffxxx.exec:\lrffxxx.exe119⤵PID:1040
-
\??\c:\nthnbt.exec:\nthnbt.exe120⤵PID:384
-
\??\c:\httnbh.exec:\httnbh.exe121⤵PID:3612
-
\??\c:\ppvvv.exec:\ppvvv.exe122⤵PID:3964
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-