Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21/05/2024, 08:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
208d3b658c5f1cb0c50a72414b6d072e835cfbd9124e504baf1afdda06143ce8_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
208d3b658c5f1cb0c50a72414b6d072e835cfbd9124e504baf1afdda06143ce8_NeikiAnalytics.exe
-
Size
116KB
-
MD5
76667956752aa3effc37228498e89f20
-
SHA1
76efc7297dee85ab0c7b5bf790854b18e81c9f87
-
SHA256
208d3b658c5f1cb0c50a72414b6d072e835cfbd9124e504baf1afdda06143ce8
-
SHA512
7da973e1d2cb352e9157206bdfa622e307f2d6de963f08b44313840c3df5f95de49c43c65e1b5e480de64a3cd3afac177dfdc52c56ba8b429447bd07e75f72f1
-
SSDEEP
3072:ymb3NkkiQ3mdBjFosxXGPXbXQMFHLgDWSmjlkFw:n3C9BRosxW8MFHLMWvlZ
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/1712-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4180-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4924-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3712-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4932-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3332-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4380-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4732-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3508-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2536-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1736-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2236-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3816-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3152-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1296-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2320-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1924-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3300-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1152-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4180 djvpp.exe 4004 flffxfx.exe 4924 5thbnt.exe 3712 9jjjd.exe 4932 xrffffx.exe 3332 3llflll.exe 4380 nttthh.exe 4732 vvdjj.exe 3508 fxfxlfr.exe 3928 3bbtnn.exe 2288 pjppv.exe 2536 9xxrrll.exe 1736 fffxllf.exe 392 nnhbbb.exe 2236 llxxfrr.exe 3816 tnnbtn.exe 4608 nhnhbb.exe 3680 fxrllll.exe 4644 hnthbt.exe 3172 ntnhhh.exe 3524 jdpdj.exe 3152 lfrrrfx.exe 1296 thnbtt.exe 1428 pdjjd.exe 4856 xrlrrrl.exe 2320 5nhbtb.exe 1924 jdpvj.exe 3300 dddvj.exe 4636 bhnnbh.exe 1152 hhnttt.exe 2552 pvvvp.exe 4044 nbtbtb.exe 5072 9bbttt.exe 4976 dpdjv.exe 2736 lxfxrrl.exe 2296 1hnhtt.exe 1720 tthhhh.exe 972 vppvd.exe 632 flrxxll.exe 4376 tnntnt.exe 4072 jvpjd.exe 4656 lxllxxr.exe 4344 rfrrxlr.exe 3480 bhnnnt.exe 452 pvdjv.exe 2384 ddpvv.exe 1636 llrllrr.exe 100 5hhhhh.exe 1696 djjjd.exe 4840 jpvdd.exe 4380 ffxrxxr.exe 5016 xxfxrrr.exe 3316 tthhtn.exe 1764 5jjjd.exe 4792 xrlllll.exe 2288 xxxxxxx.exe 3268 nnntbh.exe 2540 dvvpv.exe 2192 vjdpd.exe 2236 lxfrrlf.exe 4708 bthnnt.exe 4912 nbnbtt.exe 3656 jpppj.exe 2668 flrlxxr.exe -
resource yara_rule behavioral2/memory/1712-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4180-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4924-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3712-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4932-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3332-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4380-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3508-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2536-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3816-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1296-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2320-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3300-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1152-196-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1712 wrote to memory of 4180 1712 208d3b658c5f1cb0c50a72414b6d072e835cfbd9124e504baf1afdda06143ce8_NeikiAnalytics.exe 83 PID 1712 wrote to memory of 4180 1712 208d3b658c5f1cb0c50a72414b6d072e835cfbd9124e504baf1afdda06143ce8_NeikiAnalytics.exe 83 PID 1712 wrote to memory of 4180 1712 208d3b658c5f1cb0c50a72414b6d072e835cfbd9124e504baf1afdda06143ce8_NeikiAnalytics.exe 83 PID 4180 wrote to memory of 4004 4180 djvpp.exe 84 PID 4180 wrote to memory of 4004 4180 djvpp.exe 84 PID 4180 wrote to memory of 4004 4180 djvpp.exe 84 PID 4004 wrote to memory of 4924 4004 flffxfx.exe 85 PID 4004 wrote to memory of 4924 4004 flffxfx.exe 85 PID 4004 wrote to memory of 4924 4004 flffxfx.exe 85 PID 4924 wrote to memory of 3712 4924 5thbnt.exe 86 PID 4924 wrote to memory of 3712 4924 5thbnt.exe 86 PID 4924 wrote to memory of 3712 4924 5thbnt.exe 86 PID 3712 wrote to memory of 4932 3712 9jjjd.exe 87 PID 3712 wrote to memory of 4932 3712 9jjjd.exe 87 PID 3712 wrote to memory of 4932 3712 9jjjd.exe 87 PID 4932 wrote to memory of 3332 4932 xrffffx.exe 88 PID 4932 wrote to memory of 3332 4932 xrffffx.exe 88 PID 4932 wrote to memory of 3332 4932 xrffffx.exe 88 PID 3332 wrote to memory of 4380 3332 3llflll.exe 89 PID 3332 wrote to memory of 4380 3332 3llflll.exe 89 PID 3332 wrote to memory of 4380 3332 3llflll.exe 89 PID 4380 wrote to memory of 4732 4380 nttthh.exe 90 PID 4380 wrote to memory of 4732 4380 nttthh.exe 90 PID 4380 wrote to memory of 4732 4380 nttthh.exe 90 PID 4732 wrote to memory of 3508 4732 vvdjj.exe 91 PID 4732 wrote to memory of 3508 4732 vvdjj.exe 91 PID 4732 wrote to memory of 3508 4732 vvdjj.exe 91 PID 3508 wrote to memory of 3928 3508 fxfxlfr.exe 92 PID 3508 wrote to memory of 3928 3508 fxfxlfr.exe 92 PID 3508 wrote to memory of 3928 3508 fxfxlfr.exe 92 PID 3928 wrote to memory of 2288 3928 3bbtnn.exe 93 PID 3928 wrote to memory of 2288 3928 3bbtnn.exe 93 PID 3928 wrote to memory of 2288 3928 3bbtnn.exe 93 PID 2288 wrote to memory of 2536 2288 pjppv.exe 94 PID 2288 wrote to memory of 2536 2288 pjppv.exe 94 PID 2288 wrote to memory of 2536 2288 pjppv.exe 94 PID 2536 wrote to memory of 1736 2536 9xxrrll.exe 95 PID 2536 wrote to memory of 1736 2536 9xxrrll.exe 95 PID 2536 wrote to memory of 1736 2536 9xxrrll.exe 95 PID 1736 wrote to memory of 392 1736 fffxllf.exe 96 PID 1736 wrote to memory of 392 1736 fffxllf.exe 96 PID 1736 wrote to memory of 392 1736 fffxllf.exe 96 PID 392 wrote to memory of 2236 392 nnhbbb.exe 97 PID 392 wrote to memory of 2236 392 nnhbbb.exe 97 PID 392 wrote to memory of 2236 392 nnhbbb.exe 97 PID 2236 wrote to memory of 3816 2236 llxxfrr.exe 98 PID 2236 wrote to memory of 3816 2236 llxxfrr.exe 98 PID 2236 wrote to memory of 3816 2236 llxxfrr.exe 98 PID 3816 wrote to memory of 4608 3816 tnnbtn.exe 99 PID 3816 wrote to memory of 4608 3816 tnnbtn.exe 99 PID 3816 wrote to memory of 4608 3816 tnnbtn.exe 99 PID 4608 wrote to memory of 3680 4608 nhnhbb.exe 100 PID 4608 wrote to memory of 3680 4608 nhnhbb.exe 100 PID 4608 wrote to memory of 3680 4608 nhnhbb.exe 100 PID 3680 wrote to memory of 4644 3680 fxrllll.exe 101 PID 3680 wrote to memory of 4644 3680 fxrllll.exe 101 PID 3680 wrote to memory of 4644 3680 fxrllll.exe 101 PID 4644 wrote to memory of 3172 4644 hnthbt.exe 102 PID 4644 wrote to memory of 3172 4644 hnthbt.exe 102 PID 4644 wrote to memory of 3172 4644 hnthbt.exe 102 PID 3172 wrote to memory of 3524 3172 ntnhhh.exe 103 PID 3172 wrote to memory of 3524 3172 ntnhhh.exe 103 PID 3172 wrote to memory of 3524 3172 ntnhhh.exe 103 PID 3524 wrote to memory of 3152 3524 jdpdj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\208d3b658c5f1cb0c50a72414b6d072e835cfbd9124e504baf1afdda06143ce8_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\208d3b658c5f1cb0c50a72414b6d072e835cfbd9124e504baf1afdda06143ce8_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\djvpp.exec:\djvpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\flffxfx.exec:\flffxfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\5thbnt.exec:\5thbnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\9jjjd.exec:\9jjjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\xrffffx.exec:\xrffffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\3llflll.exec:\3llflll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
\??\c:\nttthh.exec:\nttthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\vvdjj.exec:\vvdjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\fxfxlfr.exec:\fxfxlfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\3bbtnn.exec:\3bbtnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
\??\c:\pjppv.exec:\pjppv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\9xxrrll.exec:\9xxrrll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\fffxllf.exec:\fffxllf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\nnhbbb.exec:\nnhbbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\llxxfrr.exec:\llxxfrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\tnnbtn.exec:\tnnbtn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\nhnhbb.exec:\nhnhbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\fxrllll.exec:\fxrllll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
\??\c:\hnthbt.exec:\hnthbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
\??\c:\ntnhhh.exec:\ntnhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\jdpdj.exec:\jdpdj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\lfrrrfx.exec:\lfrrrfx.exe23⤵
- Executes dropped EXE
PID:3152 -
\??\c:\thnbtt.exec:\thnbtt.exe24⤵
- Executes dropped EXE
PID:1296 -
\??\c:\pdjjd.exec:\pdjjd.exe25⤵
- Executes dropped EXE
PID:1428 -
\??\c:\xrlrrrl.exec:\xrlrrrl.exe26⤵
- Executes dropped EXE
PID:4856 -
\??\c:\5nhbtb.exec:\5nhbtb.exe27⤵
- Executes dropped EXE
PID:2320 -
\??\c:\jdpvj.exec:\jdpvj.exe28⤵
- Executes dropped EXE
PID:1924 -
\??\c:\dddvj.exec:\dddvj.exe29⤵
- Executes dropped EXE
PID:3300 -
\??\c:\bhnnbh.exec:\bhnnbh.exe30⤵
- Executes dropped EXE
PID:4636 -
\??\c:\hhnttt.exec:\hhnttt.exe31⤵
- Executes dropped EXE
PID:1152 -
\??\c:\pvvvp.exec:\pvvvp.exe32⤵
- Executes dropped EXE
PID:2552 -
\??\c:\nbtbtb.exec:\nbtbtb.exe33⤵
- Executes dropped EXE
PID:4044 -
\??\c:\9bbttt.exec:\9bbttt.exe34⤵
- Executes dropped EXE
PID:5072 -
\??\c:\dpdjv.exec:\dpdjv.exe35⤵
- Executes dropped EXE
PID:4976 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe36⤵
- Executes dropped EXE
PID:2736 -
\??\c:\1hnhtt.exec:\1hnhtt.exe37⤵
- Executes dropped EXE
PID:2296 -
\??\c:\tthhhh.exec:\tthhhh.exe38⤵
- Executes dropped EXE
PID:1720 -
\??\c:\vppvd.exec:\vppvd.exe39⤵
- Executes dropped EXE
PID:972 -
\??\c:\flrxxll.exec:\flrxxll.exe40⤵
- Executes dropped EXE
PID:632 -
\??\c:\tnntnt.exec:\tnntnt.exe41⤵
- Executes dropped EXE
PID:4376 -
\??\c:\jvpjd.exec:\jvpjd.exe42⤵
- Executes dropped EXE
PID:4072 -
\??\c:\lxllxxr.exec:\lxllxxr.exe43⤵
- Executes dropped EXE
PID:4656 -
\??\c:\rfrrxlr.exec:\rfrrxlr.exe44⤵
- Executes dropped EXE
PID:4344 -
\??\c:\bhnnnt.exec:\bhnnnt.exe45⤵
- Executes dropped EXE
PID:3480 -
\??\c:\pvdjv.exec:\pvdjv.exe46⤵
- Executes dropped EXE
PID:452 -
\??\c:\ddpvv.exec:\ddpvv.exe47⤵
- Executes dropped EXE
PID:2384 -
\??\c:\llrllrr.exec:\llrllrr.exe48⤵
- Executes dropped EXE
PID:1636 -
\??\c:\5hhhhh.exec:\5hhhhh.exe49⤵
- Executes dropped EXE
PID:100 -
\??\c:\djjjd.exec:\djjjd.exe50⤵
- Executes dropped EXE
PID:1696 -
\??\c:\jpvdd.exec:\jpvdd.exe51⤵
- Executes dropped EXE
PID:4840 -
\??\c:\ffxrxxr.exec:\ffxrxxr.exe52⤵
- Executes dropped EXE
PID:4380 -
\??\c:\xxfxrrr.exec:\xxfxrrr.exe53⤵
- Executes dropped EXE
PID:5016 -
\??\c:\tthhtn.exec:\tthhtn.exe54⤵
- Executes dropped EXE
PID:3316 -
\??\c:\5jjjd.exec:\5jjjd.exe55⤵
- Executes dropped EXE
PID:1764 -
\??\c:\xrlllll.exec:\xrlllll.exe56⤵
- Executes dropped EXE
PID:4792 -
\??\c:\xxxxxxx.exec:\xxxxxxx.exe57⤵
- Executes dropped EXE
PID:2288 -
\??\c:\nnntbh.exec:\nnntbh.exe58⤵
- Executes dropped EXE
PID:3268 -
\??\c:\dvvpv.exec:\dvvpv.exe59⤵
- Executes dropped EXE
PID:2540 -
\??\c:\vjdpd.exec:\vjdpd.exe60⤵
- Executes dropped EXE
PID:2192 -
\??\c:\lxfrrlf.exec:\lxfrrlf.exe61⤵
- Executes dropped EXE
PID:2236 -
\??\c:\bthnnt.exec:\bthnnt.exe62⤵
- Executes dropped EXE
PID:4708 -
\??\c:\nbnbtt.exec:\nbnbtt.exe63⤵
- Executes dropped EXE
PID:4912 -
\??\c:\jpppj.exec:\jpppj.exe64⤵
- Executes dropped EXE
PID:3656 -
\??\c:\flrlxxr.exec:\flrlxxr.exe65⤵
- Executes dropped EXE
PID:2668 -
\??\c:\9fxrllf.exec:\9fxrllf.exe66⤵PID:4644
-
\??\c:\hhhbtt.exec:\hhhbtt.exe67⤵PID:760
-
\??\c:\djddv.exec:\djddv.exe68⤵PID:4688
-
\??\c:\1llfxxr.exec:\1llfxxr.exe69⤵PID:1808
-
\??\c:\xlfxrrf.exec:\xlfxrrf.exe70⤵PID:2408
-
\??\c:\bnnnhb.exec:\bnnnhb.exe71⤵PID:1596
-
\??\c:\pjpjj.exec:\pjpjj.exe72⤵PID:1428
-
\??\c:\rxffxff.exec:\rxffxff.exe73⤵PID:2224
-
\??\c:\xlllfrr.exec:\xlllfrr.exe74⤵PID:4480
-
\??\c:\lflrlxx.exec:\lflrlxx.exe75⤵PID:432
-
\??\c:\7bhbtt.exec:\7bhbtt.exe76⤵PID:1652
-
\??\c:\dvdvd.exec:\dvdvd.exe77⤵PID:4576
-
\??\c:\3djjj.exec:\3djjj.exe78⤵PID:4176
-
\??\c:\rxxrrrr.exec:\rxxrrrr.exe79⤵PID:1152
-
\??\c:\7lrrlrr.exec:\7lrrlrr.exe80⤵PID:4252
-
\??\c:\bnnhtb.exec:\bnnhtb.exe81⤵PID:1424
-
\??\c:\dvvdv.exec:\dvvdv.exe82⤵PID:2720
-
\??\c:\xrfrxrf.exec:\xrfrxrf.exe83⤵PID:5072
-
\??\c:\7rrlxxr.exec:\7rrlxxr.exe84⤵PID:3716
-
\??\c:\1nhbtn.exec:\1nhbtn.exe85⤵PID:3528
-
\??\c:\hnnhbb.exec:\hnnhbb.exe86⤵PID:220
-
\??\c:\jpjjj.exec:\jpjjj.exe87⤵PID:1720
-
\??\c:\ppjjv.exec:\ppjjv.exe88⤵PID:4472
-
\??\c:\1xflrrx.exec:\1xflrrx.exe89⤵PID:3128
-
\??\c:\btbhhh.exec:\btbhhh.exe90⤵PID:4212
-
\??\c:\9jjjj.exec:\9jjjj.exe91⤵PID:3144
-
\??\c:\ffrrrrr.exec:\ffrrrrr.exe92⤵PID:4392
-
\??\c:\xxxrrrl.exec:\xxxrrrl.exe93⤵PID:3692
-
\??\c:\bhbhhn.exec:\bhbhhn.exe94⤵PID:1304
-
\??\c:\hhhhnn.exec:\hhhhnn.exe95⤵PID:452
-
\??\c:\dvpjd.exec:\dvpjd.exe96⤵PID:1156
-
\??\c:\vddvj.exec:\vddvj.exe97⤵PID:1636
-
\??\c:\flrllrl.exec:\flrllrl.exe98⤵PID:2308
-
\??\c:\tbbtnn.exec:\tbbtnn.exe99⤵PID:5044
-
\??\c:\1btbnb.exec:\1btbnb.exe100⤵PID:1524
-
\??\c:\pvvvv.exec:\pvvvv.exe101⤵PID:5052
-
\??\c:\xxlffff.exec:\xxlffff.exe102⤵PID:4040
-
\??\c:\tbnhbn.exec:\tbnhbn.exe103⤵PID:3316
-
\??\c:\djddp.exec:\djddp.exe104⤵PID:956
-
\??\c:\jdpjd.exec:\jdpjd.exe105⤵PID:1180
-
\??\c:\lxrrlfx.exec:\lxrrlfx.exe106⤵PID:2900
-
\??\c:\frrllfx.exec:\frrllfx.exe107⤵PID:1716
-
\??\c:\hbtnhh.exec:\hbtnhh.exe108⤵PID:2540
-
\??\c:\bthhnh.exec:\bthhnh.exe109⤵PID:4876
-
\??\c:\9vpjv.exec:\9vpjv.exe110⤵PID:2236
-
\??\c:\rlffxxx.exec:\rlffxxx.exe111⤵PID:4708
-
\??\c:\fxffxrr.exec:\fxffxrr.exe112⤵PID:4912
-
\??\c:\tthhnt.exec:\tthhnt.exe113⤵PID:2564
-
\??\c:\xrrrfrx.exec:\xrrrfrx.exe114⤵PID:1268
-
\??\c:\bnbhhh.exec:\bnbhhh.exe115⤵PID:4552
-
\??\c:\jvvpd.exec:\jvvpd.exe116⤵PID:760
-
\??\c:\lffxrlf.exec:\lffxrlf.exe117⤵PID:3152
-
\??\c:\5lxxrrx.exec:\5lxxrrx.exe118⤵PID:1808
-
\??\c:\tnnnhn.exec:\tnnnhn.exe119⤵PID:2028
-
\??\c:\ddvdp.exec:\ddvdp.exe120⤵PID:4860
-
\??\c:\jvvvp.exec:\jvvvp.exe121⤵PID:1616
-
\??\c:\rrrlrlx.exec:\rrrlrlx.exe122⤵PID:4952
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-