Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 18:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
434fb356b44099233f93bad587424d90_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
434fb356b44099233f93bad587424d90_NeikiAnalytics.exe
-
Size
114KB
-
MD5
434fb356b44099233f93bad587424d90
-
SHA1
cd1c644873299f56590d456c1e96e61a692b2be8
-
SHA256
66d80073c3288cea285f33a2cec63f31442d6561e6202d049779e487c1e90364
-
SHA512
544d841bf7f6a684a5d61d79f127dec3fc0d1c5656285be00493b2bd44a3051461a8b418f3515e4ca7a7d0b3df3e845f056b7cab601e12324c6155dcb99e54e0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73oYUCD7R2F2UVbyy0NN:ymb3NkkiQ3mdBjFo73HUoMsAbrK
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral1/memory/2332-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1796-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2180-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1892-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1828-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1256-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1900-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/664-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1484-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1908-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/932-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2304-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2332 3rlrrxf.exe 1796 htbhnn.exe 2180 5vppv.exe 2564 rflrxrx.exe 2716 rrllrfr.exe 2728 bthhht.exe 2168 hhbhtb.exe 2468 7vpjd.exe 2884 vpdvj.exe 1892 rlrxfxf.exe 2760 9hntht.exe 1032 nhtthh.exe 332 dvjpd.exe 1828 rrrxffr.exe 1256 nnbbhh.exe 1900 pjvvj.exe 664 3rrrxfr.exe 1684 xxfxxrx.exe 2124 bthnbh.exe 1964 vpdjp.exe 2432 7xrflxl.exe 384 ffffxrf.exe 1484 nnhnbh.exe 1804 jjjvv.exe 1908 fxrxflx.exe 3068 7xxxffl.exe 932 vvpjv.exe 840 5lfxxfl.exe 2268 tbhhnb.exe 2304 hntbtb.exe 1740 ppvjj.exe 2296 xxrrffr.exe 1724 rlrrllx.exe 2740 hbtbbn.exe 2380 nntbbh.exe 2584 vvddj.exe 2180 lfrrflr.exe 2460 frxflxx.exe 2644 bnbbbh.exe 2928 vjdjj.exe 2464 1fxlrrx.exe 2576 rfffflf.exe 2888 httnnn.exe 2600 ddpvj.exe 2756 5xlfffl.exe 1892 rfrrxxf.exe 3004 7tthbn.exe 884 pdppv.exe 2896 djpvj.exe 312 frfflrx.exe 1756 pjjjv.exe 1980 lrxlrfx.exe 1660 ffxrfxx.exe 2072 1htbhh.exe 1556 nhbhtb.exe 1328 dvddp.exe 2248 5lflrrl.exe 2812 ttbhnn.exe 1428 7jjpd.exe 2160 jppdv.exe 1476 1rlfllf.exe 2184 frflllr.exe 2344 thnnnn.exe 1912 jjdjp.exe -
resource yara_rule behavioral1/memory/2864-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2180-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1892-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1828-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1256-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1900-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/664-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1484-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1908-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/932-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-301-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2864 wrote to memory of 2332 2864 434fb356b44099233f93bad587424d90_NeikiAnalytics.exe 28 PID 2864 wrote to memory of 2332 2864 434fb356b44099233f93bad587424d90_NeikiAnalytics.exe 28 PID 2864 wrote to memory of 2332 2864 434fb356b44099233f93bad587424d90_NeikiAnalytics.exe 28 PID 2864 wrote to memory of 2332 2864 434fb356b44099233f93bad587424d90_NeikiAnalytics.exe 28 PID 2332 wrote to memory of 1796 2332 3rlrrxf.exe 29 PID 2332 wrote to memory of 1796 2332 3rlrrxf.exe 29 PID 2332 wrote to memory of 1796 2332 3rlrrxf.exe 29 PID 2332 wrote to memory of 1796 2332 3rlrrxf.exe 29 PID 1796 wrote to memory of 2180 1796 htbhnn.exe 30 PID 1796 wrote to memory of 2180 1796 htbhnn.exe 30 PID 1796 wrote to memory of 2180 1796 htbhnn.exe 30 PID 1796 wrote to memory of 2180 1796 htbhnn.exe 30 PID 2180 wrote to memory of 2564 2180 5vppv.exe 31 PID 2180 wrote to memory of 2564 2180 5vppv.exe 31 PID 2180 wrote to memory of 2564 2180 5vppv.exe 31 PID 2180 wrote to memory of 2564 2180 5vppv.exe 31 PID 2564 wrote to memory of 2716 2564 rflrxrx.exe 32 PID 2564 wrote to memory of 2716 2564 rflrxrx.exe 32 PID 2564 wrote to memory of 2716 2564 rflrxrx.exe 32 PID 2564 wrote to memory of 2716 2564 rflrxrx.exe 32 PID 2716 wrote to memory of 2728 2716 rrllrfr.exe 33 PID 2716 wrote to memory of 2728 2716 rrllrfr.exe 33 PID 2716 wrote to memory of 2728 2716 rrllrfr.exe 33 PID 2716 wrote to memory of 2728 2716 rrllrfr.exe 33 PID 2728 wrote to memory of 2168 2728 bthhht.exe 34 PID 2728 wrote to memory of 2168 2728 bthhht.exe 34 PID 2728 wrote to memory of 2168 2728 bthhht.exe 34 PID 2728 wrote to memory of 2168 2728 bthhht.exe 34 PID 2168 wrote to memory of 2468 2168 hhbhtb.exe 35 PID 2168 wrote to memory of 2468 2168 hhbhtb.exe 35 PID 2168 wrote to memory of 2468 2168 hhbhtb.exe 35 PID 2168 wrote to memory of 2468 2168 hhbhtb.exe 35 PID 2468 wrote to memory of 2884 2468 7vpjd.exe 36 PID 2468 wrote to memory of 2884 2468 7vpjd.exe 36 PID 2468 wrote to memory of 2884 2468 7vpjd.exe 36 PID 2468 wrote to memory of 2884 2468 7vpjd.exe 36 PID 2884 wrote to memory of 1892 2884 vpdvj.exe 37 PID 2884 wrote to memory of 1892 2884 vpdvj.exe 37 PID 2884 wrote to memory of 1892 2884 vpdvj.exe 37 PID 2884 wrote to memory of 1892 2884 vpdvj.exe 37 PID 1892 wrote to memory of 2760 1892 rlrxfxf.exe 38 PID 1892 wrote to memory of 2760 1892 rlrxfxf.exe 38 PID 1892 wrote to memory of 2760 1892 rlrxfxf.exe 38 PID 1892 wrote to memory of 2760 1892 rlrxfxf.exe 38 PID 2760 wrote to memory of 1032 2760 9hntht.exe 39 PID 2760 wrote to memory of 1032 2760 9hntht.exe 39 PID 2760 wrote to memory of 1032 2760 9hntht.exe 39 PID 2760 wrote to memory of 1032 2760 9hntht.exe 39 PID 1032 wrote to memory of 332 1032 nhtthh.exe 40 PID 1032 wrote to memory of 332 1032 nhtthh.exe 40 PID 1032 wrote to memory of 332 1032 nhtthh.exe 40 PID 1032 wrote to memory of 332 1032 nhtthh.exe 40 PID 332 wrote to memory of 1828 332 dvjpd.exe 41 PID 332 wrote to memory of 1828 332 dvjpd.exe 41 PID 332 wrote to memory of 1828 332 dvjpd.exe 41 PID 332 wrote to memory of 1828 332 dvjpd.exe 41 PID 1828 wrote to memory of 1256 1828 rrrxffr.exe 42 PID 1828 wrote to memory of 1256 1828 rrrxffr.exe 42 PID 1828 wrote to memory of 1256 1828 rrrxffr.exe 42 PID 1828 wrote to memory of 1256 1828 rrrxffr.exe 42 PID 1256 wrote to memory of 1900 1256 nnbbhh.exe 43 PID 1256 wrote to memory of 1900 1256 nnbbhh.exe 43 PID 1256 wrote to memory of 1900 1256 nnbbhh.exe 43 PID 1256 wrote to memory of 1900 1256 nnbbhh.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\434fb356b44099233f93bad587424d90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\434fb356b44099233f93bad587424d90_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\3rlrrxf.exec:\3rlrrxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\htbhnn.exec:\htbhnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\5vppv.exec:\5vppv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\rflrxrx.exec:\rflrxrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\rrllrfr.exec:\rrllrfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\bthhht.exec:\bthhht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\hhbhtb.exec:\hhbhtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\7vpjd.exec:\7vpjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\vpdvj.exec:\vpdvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\rlrxfxf.exec:\rlrxfxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\9hntht.exec:\9hntht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\nhtthh.exec:\nhtthh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\dvjpd.exec:\dvjpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:332 -
\??\c:\rrrxffr.exec:\rrrxffr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\nnbbhh.exec:\nnbbhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\pjvvj.exec:\pjvvj.exe17⤵
- Executes dropped EXE
PID:1900 -
\??\c:\3rrrxfr.exec:\3rrrxfr.exe18⤵
- Executes dropped EXE
PID:664 -
\??\c:\xxfxxrx.exec:\xxfxxrx.exe19⤵
- Executes dropped EXE
PID:1684 -
\??\c:\bthnbh.exec:\bthnbh.exe20⤵
- Executes dropped EXE
PID:2124 -
\??\c:\vpdjp.exec:\vpdjp.exe21⤵
- Executes dropped EXE
PID:1964 -
\??\c:\7xrflxl.exec:\7xrflxl.exe22⤵
- Executes dropped EXE
PID:2432 -
\??\c:\ffffxrf.exec:\ffffxrf.exe23⤵
- Executes dropped EXE
PID:384 -
\??\c:\nnhnbh.exec:\nnhnbh.exe24⤵
- Executes dropped EXE
PID:1484 -
\??\c:\jjjvv.exec:\jjjvv.exe25⤵
- Executes dropped EXE
PID:1804 -
\??\c:\fxrxflx.exec:\fxrxflx.exe26⤵
- Executes dropped EXE
PID:1908 -
\??\c:\7xxxffl.exec:\7xxxffl.exe27⤵
- Executes dropped EXE
PID:3068 -
\??\c:\vvpjv.exec:\vvpjv.exe28⤵
- Executes dropped EXE
PID:932 -
\??\c:\5lfxxfl.exec:\5lfxxfl.exe29⤵
- Executes dropped EXE
PID:840 -
\??\c:\tbhhnb.exec:\tbhhnb.exe30⤵
- Executes dropped EXE
PID:2268 -
\??\c:\hntbtb.exec:\hntbtb.exe31⤵
- Executes dropped EXE
PID:2304 -
\??\c:\ppvjj.exec:\ppvjj.exe32⤵
- Executes dropped EXE
PID:1740 -
\??\c:\xxrrffr.exec:\xxrrffr.exe33⤵
- Executes dropped EXE
PID:2296 -
\??\c:\rlrrllx.exec:\rlrrllx.exe34⤵
- Executes dropped EXE
PID:1724 -
\??\c:\hbtbbn.exec:\hbtbbn.exe35⤵
- Executes dropped EXE
PID:2740 -
\??\c:\nntbbh.exec:\nntbbh.exe36⤵
- Executes dropped EXE
PID:2380 -
\??\c:\vvddj.exec:\vvddj.exe37⤵
- Executes dropped EXE
PID:2584 -
\??\c:\lfrrflr.exec:\lfrrflr.exe38⤵
- Executes dropped EXE
PID:2180 -
\??\c:\frxflxx.exec:\frxflxx.exe39⤵
- Executes dropped EXE
PID:2460 -
\??\c:\bnbbbh.exec:\bnbbbh.exe40⤵
- Executes dropped EXE
PID:2644 -
\??\c:\vjdjj.exec:\vjdjj.exe41⤵
- Executes dropped EXE
PID:2928 -
\??\c:\1fxlrrx.exec:\1fxlrrx.exe42⤵
- Executes dropped EXE
PID:2464 -
\??\c:\rfffflf.exec:\rfffflf.exe43⤵
- Executes dropped EXE
PID:2576 -
\??\c:\httnnn.exec:\httnnn.exe44⤵
- Executes dropped EXE
PID:2888 -
\??\c:\ddpvj.exec:\ddpvj.exe45⤵
- Executes dropped EXE
PID:2600 -
\??\c:\5xlfffl.exec:\5xlfffl.exe46⤵
- Executes dropped EXE
PID:2756 -
\??\c:\rfrrxxf.exec:\rfrrxxf.exe47⤵
- Executes dropped EXE
PID:1892 -
\??\c:\7tthbn.exec:\7tthbn.exe48⤵
- Executes dropped EXE
PID:3004 -
\??\c:\pdppv.exec:\pdppv.exe49⤵
- Executes dropped EXE
PID:884 -
\??\c:\djpvj.exec:\djpvj.exe50⤵
- Executes dropped EXE
PID:2896 -
\??\c:\frfflrx.exec:\frfflrx.exe51⤵
- Executes dropped EXE
PID:312 -
\??\c:\pjjjv.exec:\pjjjv.exe52⤵
- Executes dropped EXE
PID:1756 -
\??\c:\lrxlrfx.exec:\lrxlrfx.exe53⤵
- Executes dropped EXE
PID:1980 -
\??\c:\ffxrfxx.exec:\ffxrfxx.exe54⤵
- Executes dropped EXE
PID:1660 -
\??\c:\1htbhh.exec:\1htbhh.exe55⤵
- Executes dropped EXE
PID:2072 -
\??\c:\nhbhtb.exec:\nhbhtb.exe56⤵
- Executes dropped EXE
PID:1556 -
\??\c:\dvddp.exec:\dvddp.exe57⤵
- Executes dropped EXE
PID:1328 -
\??\c:\5lflrrl.exec:\5lflrrl.exe58⤵
- Executes dropped EXE
PID:2248 -
\??\c:\ttbhnn.exec:\ttbhnn.exe59⤵
- Executes dropped EXE
PID:2812 -
\??\c:\7jjpd.exec:\7jjpd.exe60⤵
- Executes dropped EXE
PID:1428 -
\??\c:\jppdv.exec:\jppdv.exe61⤵
- Executes dropped EXE
PID:2160 -
\??\c:\1rlfllf.exec:\1rlfllf.exe62⤵
- Executes dropped EXE
PID:1476 -
\??\c:\frflllr.exec:\frflllr.exe63⤵
- Executes dropped EXE
PID:2184 -
\??\c:\thnnnn.exec:\thnnnn.exe64⤵
- Executes dropped EXE
PID:2344 -
\??\c:\jjdjp.exec:\jjdjp.exe65⤵
- Executes dropped EXE
PID:1912 -
\??\c:\dvdjv.exec:\dvdjv.exe66⤵PID:1860
-
\??\c:\xxrxxxr.exec:\xxrxxxr.exe67⤵PID:2808
-
\??\c:\btnbbh.exec:\btnbbh.exe68⤵PID:2220
-
\??\c:\nnntbh.exec:\nnntbh.exe69⤵PID:2080
-
\??\c:\9dpjp.exec:\9dpjp.exe70⤵PID:288
-
\??\c:\xfxrfrr.exec:\xfxrfrr.exe71⤵PID:2352
-
\??\c:\xrlrllr.exec:\xrlrllr.exe72⤵PID:1872
-
\??\c:\9hbhhn.exec:\9hbhhn.exe73⤵PID:2788
-
\??\c:\tnttbb.exec:\tnttbb.exe74⤵PID:2372
-
\??\c:\ddvvp.exec:\ddvvp.exe75⤵PID:2792
-
\??\c:\pdppv.exec:\pdppv.exe76⤵PID:2400
-
\??\c:\1rlrrxl.exec:\1rlrrxl.exe77⤵PID:3032
-
\??\c:\fllxfff.exec:\fllxfff.exe78⤵PID:2380
-
\??\c:\1nbhtb.exec:\1nbhtb.exe79⤵PID:2648
-
\??\c:\bbbbnn.exec:\bbbbnn.exe80⤵PID:2180
-
\??\c:\1jvvv.exec:\1jvvv.exe81⤵PID:2716
-
\??\c:\9lrrxff.exec:\9lrrxff.exe82⤵PID:2660
-
\??\c:\xlrfllx.exec:\xlrfllx.exe83⤵PID:2516
-
\??\c:\hthhhh.exec:\hthhhh.exe84⤵PID:2608
-
\??\c:\ppvpp.exec:\ppvpp.exe85⤵PID:2320
-
\??\c:\dpppp.exec:\dpppp.exe86⤵PID:2696
-
\??\c:\xxrfrrr.exec:\xxrfrrr.exe87⤵PID:2572
-
\??\c:\lxllrlr.exec:\lxllrlr.exe88⤵PID:2756
-
\??\c:\nbbhnn.exec:\nbbhnn.exe89⤵PID:3048
-
\??\c:\hnbhhn.exec:\hnbhhn.exe90⤵PID:1784
-
\??\c:\pjdpd.exec:\pjdpd.exe91⤵PID:332
-
\??\c:\7jdjj.exec:\7jdjj.exe92⤵PID:2744
-
\??\c:\xrffllr.exec:\xrffllr.exe93⤵PID:1880
-
\??\c:\1ttnnn.exec:\1ttnnn.exe94⤵PID:1420
-
\??\c:\vpdvv.exec:\vpdvv.exe95⤵PID:2704
-
\??\c:\jvvpp.exec:\jvvpp.exe96⤵PID:1620
-
\??\c:\7rffffl.exec:\7rffffl.exe97⤵PID:1632
-
\??\c:\9tbbbt.exec:\9tbbbt.exe98⤵PID:1556
-
\??\c:\5hhnbh.exec:\5hhnbh.exe99⤵PID:2316
-
\??\c:\vjvpd.exec:\vjvpd.exe100⤵PID:2064
-
\??\c:\xfrffxx.exec:\xfrffxx.exe101⤵PID:672
-
\??\c:\xlflllr.exec:\xlflllr.exe102⤵PID:2252
-
\??\c:\bhbnbt.exec:\bhbnbt.exe103⤵PID:608
-
\??\c:\1ntnth.exec:\1ntnth.exe104⤵PID:584
-
\??\c:\jvppv.exec:\jvppv.exe105⤵PID:1924
-
\??\c:\3fllflr.exec:\3fllflr.exe106⤵PID:1076
-
\??\c:\nnbbhh.exec:\nnbbhh.exe107⤵PID:1920
-
\??\c:\3nbbtt.exec:\3nbbtt.exe108⤵PID:3040
-
\??\c:\pvppj.exec:\pvppj.exe109⤵PID:2988
-
\??\c:\rxxrrxf.exec:\rxxrrxf.exe110⤵PID:840
-
\??\c:\xrxfxrx.exec:\xrxfxrx.exe111⤵PID:560
-
\??\c:\3nnnnt.exec:\3nnnnt.exe112⤵PID:1196
-
\??\c:\vpvdp.exec:\vpvdp.exe113⤵PID:1916
-
\??\c:\vpvdj.exec:\vpvdj.exe114⤵PID:1280
-
\??\c:\flfllxx.exec:\flfllxx.exe115⤵PID:2296
-
\??\c:\3lffrlr.exec:\3lffrlr.exe116⤵PID:2960
-
\??\c:\thnhnn.exec:\thnhnn.exe117⤵PID:772
-
\??\c:\3tnbbb.exec:\3tnbbb.exe118⤵PID:2612
-
\??\c:\7dppj.exec:\7dppj.exe119⤵PID:2956
-
\??\c:\xxlfrxl.exec:\xxlfrxl.exe120⤵PID:2564
-
\??\c:\tnbbnn.exec:\tnbbnn.exe121⤵PID:2664
-
\??\c:\bbbhtt.exec:\bbbhtt.exe122⤵PID:2480
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-