Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 16:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cdc6c67f2a54696c9e6c4b3379bf32a0_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
cdc6c67f2a54696c9e6c4b3379bf32a0_NeikiAnalytics.exe
-
Size
74KB
-
MD5
cdc6c67f2a54696c9e6c4b3379bf32a0
-
SHA1
1c245b8ff35ba7543dc060d8f2e3c92bc632520e
-
SHA256
457c9c1cb696ca7bb5667f34c3536a53c1c4989f05e709c083a6d7cffd76f0e7
-
SHA512
cfc748278243343f453747b1fbf802bc373ff7c44b68ca015a240ad572c4e5c5ab466b70507dfcc05d16c5c7e9623ccefea065e0e35047741aa02204eb21650a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIrmCeRMKeWqNSd:ymb3NkkiQ3mdBjFIjek5A
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2352-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2352-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3044-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-58-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2100-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1180-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1184-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1932-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1200-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/944-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2064-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/896-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2044-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1876-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/760-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2992 nhntbt.exe 3044 dvdpv.exe 2540 vpdvj.exe 2652 rflrrrx.exe 2576 hnbtnh.exe 2100 nbnnnh.exe 2616 jvddv.exe 2480 llxlfxf.exe 2928 hnbttb.exe 1180 tnhhtb.exe 2764 jvjdd.exe 1912 vvppv.exe 2040 xlxffxf.exe 1184 1lxlfxf.exe 2820 bthhnn.exe 1932 9nhhtn.exe 1200 1djdd.exe 1452 fxrxffl.exe 944 flrlxxx.exe 2064 tbhnth.exe 2124 pdjdv.exe 896 jvpvd.exe 2432 lrxllll.exe 2044 1xfrxrf.exe 1876 nhhbhh.exe 760 thtttt.exe 2000 jjvjd.exe 968 rlxrrrr.exe 2208 7ntthb.exe 3036 5bttnh.exe 2528 jddpd.exe 2376 jvdvd.exe 1616 rfrrllr.exe 2384 hnbhtb.exe 2184 ttnbnt.exe 2792 pdpjj.exe 2144 xxxfrxl.exe 2608 1ffrlff.exe 1472 fxrxflr.exe 2824 bnbbhb.exe 2624 9ddjv.exe 2708 5djjv.exe 2720 lfxfllr.exe 2684 tnhnnn.exe 2140 vpjdv.exe 1556 3rrrxxx.exe 1952 7rfxllx.exe 2764 rrxxlff.exe 1196 nbnnbn.exe 2324 5jjjj.exe 2552 jddjv.exe 2768 3dppp.exe 772 3rfxxxf.exe 808 7bhthb.exe 2260 nbbbnt.exe 2232 vpvpp.exe 1532 jvppv.exe 944 lxllrfr.exe 780 rlrrlxf.exe 540 thtnnn.exe 2704 tntbhb.exe 748 dvvvp.exe 2120 djpvj.exe 2116 3lrffrx.exe -
resource yara_rule behavioral1/memory/2352-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1180-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1184-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1932-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1200-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/944-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/896-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1876-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/760-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-298-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2992 2352 cdc6c67f2a54696c9e6c4b3379bf32a0_NeikiAnalytics.exe 28 PID 2352 wrote to memory of 2992 2352 cdc6c67f2a54696c9e6c4b3379bf32a0_NeikiAnalytics.exe 28 PID 2352 wrote to memory of 2992 2352 cdc6c67f2a54696c9e6c4b3379bf32a0_NeikiAnalytics.exe 28 PID 2352 wrote to memory of 2992 2352 cdc6c67f2a54696c9e6c4b3379bf32a0_NeikiAnalytics.exe 28 PID 2992 wrote to memory of 3044 2992 nhntbt.exe 29 PID 2992 wrote to memory of 3044 2992 nhntbt.exe 29 PID 2992 wrote to memory of 3044 2992 nhntbt.exe 29 PID 2992 wrote to memory of 3044 2992 nhntbt.exe 29 PID 3044 wrote to memory of 2540 3044 dvdpv.exe 30 PID 3044 wrote to memory of 2540 3044 dvdpv.exe 30 PID 3044 wrote to memory of 2540 3044 dvdpv.exe 30 PID 3044 wrote to memory of 2540 3044 dvdpv.exe 30 PID 2540 wrote to memory of 2652 2540 vpdvj.exe 31 PID 2540 wrote to memory of 2652 2540 vpdvj.exe 31 PID 2540 wrote to memory of 2652 2540 vpdvj.exe 31 PID 2540 wrote to memory of 2652 2540 vpdvj.exe 31 PID 2652 wrote to memory of 2576 2652 rflrrrx.exe 32 PID 2652 wrote to memory of 2576 2652 rflrrrx.exe 32 PID 2652 wrote to memory of 2576 2652 rflrrrx.exe 32 PID 2652 wrote to memory of 2576 2652 rflrrrx.exe 32 PID 2576 wrote to memory of 2100 2576 hnbtnh.exe 33 PID 2576 wrote to memory of 2100 2576 hnbtnh.exe 33 PID 2576 wrote to memory of 2100 2576 hnbtnh.exe 33 PID 2576 wrote to memory of 2100 2576 hnbtnh.exe 33 PID 2100 wrote to memory of 2616 2100 nbnnnh.exe 34 PID 2100 wrote to memory of 2616 2100 nbnnnh.exe 34 PID 2100 wrote to memory of 2616 2100 nbnnnh.exe 34 PID 2100 wrote to memory of 2616 2100 nbnnnh.exe 34 PID 2616 wrote to memory of 2480 2616 jvddv.exe 35 PID 2616 wrote to memory of 2480 2616 jvddv.exe 35 PID 2616 wrote to memory of 2480 2616 jvddv.exe 35 PID 2616 wrote to memory of 2480 2616 jvddv.exe 35 PID 2480 wrote to memory of 2928 2480 llxlfxf.exe 36 PID 2480 wrote to memory of 2928 2480 llxlfxf.exe 36 PID 2480 wrote to memory of 2928 2480 llxlfxf.exe 36 PID 2480 wrote to memory of 2928 2480 llxlfxf.exe 36 PID 2928 wrote to memory of 1180 2928 hnbttb.exe 37 PID 2928 wrote to memory of 1180 2928 hnbttb.exe 37 PID 2928 wrote to memory of 1180 2928 hnbttb.exe 37 PID 2928 wrote to memory of 1180 2928 hnbttb.exe 37 PID 1180 wrote to memory of 2764 1180 tnhhtb.exe 38 PID 1180 wrote to memory of 2764 1180 tnhhtb.exe 38 PID 1180 wrote to memory of 2764 1180 tnhhtb.exe 38 PID 1180 wrote to memory of 2764 1180 tnhhtb.exe 38 PID 2764 wrote to memory of 1912 2764 jvjdd.exe 39 PID 2764 wrote to memory of 1912 2764 jvjdd.exe 39 PID 2764 wrote to memory of 1912 2764 jvjdd.exe 39 PID 2764 wrote to memory of 1912 2764 jvjdd.exe 39 PID 1912 wrote to memory of 2040 1912 vvppv.exe 40 PID 1912 wrote to memory of 2040 1912 vvppv.exe 40 PID 1912 wrote to memory of 2040 1912 vvppv.exe 40 PID 1912 wrote to memory of 2040 1912 vvppv.exe 40 PID 2040 wrote to memory of 1184 2040 xlxffxf.exe 41 PID 2040 wrote to memory of 1184 2040 xlxffxf.exe 41 PID 2040 wrote to memory of 1184 2040 xlxffxf.exe 41 PID 2040 wrote to memory of 1184 2040 xlxffxf.exe 41 PID 1184 wrote to memory of 2820 1184 1lxlfxf.exe 42 PID 1184 wrote to memory of 2820 1184 1lxlfxf.exe 42 PID 1184 wrote to memory of 2820 1184 1lxlfxf.exe 42 PID 1184 wrote to memory of 2820 1184 1lxlfxf.exe 42 PID 2820 wrote to memory of 1932 2820 bthhnn.exe 43 PID 2820 wrote to memory of 1932 2820 bthhnn.exe 43 PID 2820 wrote to memory of 1932 2820 bthhnn.exe 43 PID 2820 wrote to memory of 1932 2820 bthhnn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdc6c67f2a54696c9e6c4b3379bf32a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\cdc6c67f2a54696c9e6c4b3379bf32a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\nhntbt.exec:\nhntbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\dvdpv.exec:\dvdpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\vpdvj.exec:\vpdvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\rflrrrx.exec:\rflrrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\hnbtnh.exec:\hnbtnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\nbnnnh.exec:\nbnnnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\jvddv.exec:\jvddv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\llxlfxf.exec:\llxlfxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\hnbttb.exec:\hnbttb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\tnhhtb.exec:\tnhhtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\jvjdd.exec:\jvjdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\vvppv.exec:\vvppv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\xlxffxf.exec:\xlxffxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\1lxlfxf.exec:\1lxlfxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\bthhnn.exec:\bthhnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\9nhhtn.exec:\9nhhtn.exe17⤵
- Executes dropped EXE
PID:1932 -
\??\c:\1djdd.exec:\1djdd.exe18⤵
- Executes dropped EXE
PID:1200 -
\??\c:\fxrxffl.exec:\fxrxffl.exe19⤵
- Executes dropped EXE
PID:1452 -
\??\c:\flrlxxx.exec:\flrlxxx.exe20⤵
- Executes dropped EXE
PID:944 -
\??\c:\tbhnth.exec:\tbhnth.exe21⤵
- Executes dropped EXE
PID:2064 -
\??\c:\pdjdv.exec:\pdjdv.exe22⤵
- Executes dropped EXE
PID:2124 -
\??\c:\jvpvd.exec:\jvpvd.exe23⤵
- Executes dropped EXE
PID:896 -
\??\c:\lrxllll.exec:\lrxllll.exe24⤵
- Executes dropped EXE
PID:2432 -
\??\c:\1xfrxrf.exec:\1xfrxrf.exe25⤵
- Executes dropped EXE
PID:2044 -
\??\c:\nhhbhh.exec:\nhhbhh.exe26⤵
- Executes dropped EXE
PID:1876 -
\??\c:\thtttt.exec:\thtttt.exe27⤵
- Executes dropped EXE
PID:760 -
\??\c:\jjvjd.exec:\jjvjd.exe28⤵
- Executes dropped EXE
PID:2000 -
\??\c:\rlxrrrr.exec:\rlxrrrr.exe29⤵
- Executes dropped EXE
PID:968 -
\??\c:\7ntthb.exec:\7ntthb.exe30⤵
- Executes dropped EXE
PID:2208 -
\??\c:\5bttnh.exec:\5bttnh.exe31⤵
- Executes dropped EXE
PID:3036 -
\??\c:\jddpd.exec:\jddpd.exe32⤵
- Executes dropped EXE
PID:2528 -
\??\c:\jvdvd.exec:\jvdvd.exe33⤵
- Executes dropped EXE
PID:2376 -
\??\c:\rfrrllr.exec:\rfrrllr.exe34⤵
- Executes dropped EXE
PID:1616 -
\??\c:\hnbhtb.exec:\hnbhtb.exe35⤵
- Executes dropped EXE
PID:2384 -
\??\c:\ttnbnt.exec:\ttnbnt.exe36⤵
- Executes dropped EXE
PID:2184 -
\??\c:\pdpjj.exec:\pdpjj.exe37⤵
- Executes dropped EXE
PID:2792 -
\??\c:\xxxfrxl.exec:\xxxfrxl.exe38⤵
- Executes dropped EXE
PID:2144 -
\??\c:\1ffrlff.exec:\1ffrlff.exe39⤵
- Executes dropped EXE
PID:2608 -
\??\c:\fxrxflr.exec:\fxrxflr.exe40⤵
- Executes dropped EXE
PID:1472 -
\??\c:\bnbbhb.exec:\bnbbhb.exe41⤵
- Executes dropped EXE
PID:2824 -
\??\c:\9ddjv.exec:\9ddjv.exe42⤵
- Executes dropped EXE
PID:2624 -
\??\c:\5djjv.exec:\5djjv.exe43⤵
- Executes dropped EXE
PID:2708 -
\??\c:\lfxfllr.exec:\lfxfllr.exe44⤵
- Executes dropped EXE
PID:2720 -
\??\c:\tnhnnn.exec:\tnhnnn.exe45⤵
- Executes dropped EXE
PID:2684 -
\??\c:\vpjdv.exec:\vpjdv.exe46⤵
- Executes dropped EXE
PID:2140 -
\??\c:\3rrrxxx.exec:\3rrrxxx.exe47⤵
- Executes dropped EXE
PID:1556 -
\??\c:\7rfxllx.exec:\7rfxllx.exe48⤵
- Executes dropped EXE
PID:1952 -
\??\c:\rrxxlff.exec:\rrxxlff.exe49⤵
- Executes dropped EXE
PID:2764 -
\??\c:\nbnnbn.exec:\nbnnbn.exe50⤵
- Executes dropped EXE
PID:1196 -
\??\c:\5jjjj.exec:\5jjjj.exe51⤵
- Executes dropped EXE
PID:2324 -
\??\c:\jddjv.exec:\jddjv.exe52⤵
- Executes dropped EXE
PID:2552 -
\??\c:\3dppp.exec:\3dppp.exe53⤵
- Executes dropped EXE
PID:2768 -
\??\c:\3rfxxxf.exec:\3rfxxxf.exe54⤵
- Executes dropped EXE
PID:772 -
\??\c:\7bhthb.exec:\7bhthb.exe55⤵
- Executes dropped EXE
PID:808 -
\??\c:\nbbbnt.exec:\nbbbnt.exe56⤵
- Executes dropped EXE
PID:2260 -
\??\c:\vpvpp.exec:\vpvpp.exe57⤵
- Executes dropped EXE
PID:2232 -
\??\c:\jvppv.exec:\jvppv.exe58⤵
- Executes dropped EXE
PID:1532 -
\??\c:\lxllrfr.exec:\lxllrfr.exe59⤵
- Executes dropped EXE
PID:944 -
\??\c:\rlrrlxf.exec:\rlrrlxf.exe60⤵
- Executes dropped EXE
PID:780 -
\??\c:\thtnnn.exec:\thtnnn.exe61⤵
- Executes dropped EXE
PID:540 -
\??\c:\tntbhb.exec:\tntbhb.exe62⤵
- Executes dropped EXE
PID:2704 -
\??\c:\dvvvp.exec:\dvvvp.exe63⤵
- Executes dropped EXE
PID:748 -
\??\c:\djpvj.exec:\djpvj.exe64⤵
- Executes dropped EXE
PID:2120 -
\??\c:\3lrffrx.exec:\3lrffrx.exe65⤵
- Executes dropped EXE
PID:2116 -
\??\c:\xxlxflr.exec:\xxlxflr.exe66⤵PID:1876
-
\??\c:\nbtbbb.exec:\nbtbbb.exe67⤵PID:1988
-
\??\c:\3thttn.exec:\3thttn.exe68⤵PID:2180
-
\??\c:\1hbbbh.exec:\1hbbbh.exe69⤵PID:2200
-
\??\c:\jvpvv.exec:\jvpvv.exe70⤵PID:2212
-
\??\c:\9vjdv.exec:\9vjdv.exe71⤵PID:2880
-
\??\c:\fxrrxxf.exec:\fxrrxxf.exe72⤵PID:892
-
\??\c:\nbbnht.exec:\nbbnht.exe73⤵PID:1752
-
\??\c:\tbnnnn.exec:\tbnnnn.exe74⤵PID:2952
-
\??\c:\ntthtb.exec:\ntthtb.exe75⤵PID:2920
-
\??\c:\9pdvp.exec:\9pdvp.exe76⤵PID:2992
-
\??\c:\vpvvj.exec:\vpvvj.exe77⤵PID:2384
-
\??\c:\3lxxflf.exec:\3lxxflf.exe78⤵PID:1052
-
\??\c:\xlrxxfl.exec:\xlrxxfl.exe79⤵PID:2560
-
\??\c:\thtbhh.exec:\thtbhh.exe80⤵PID:2144
-
\??\c:\3htbnt.exec:\3htbnt.exe81⤵PID:2556
-
\??\c:\pjvpp.exec:\pjvpp.exe82⤵PID:2812
-
\??\c:\dddjj.exec:\dddjj.exe83⤵PID:2488
-
\??\c:\dpvjj.exec:\dpvjj.exe84⤵PID:2624
-
\??\c:\xxxxfrl.exec:\xxxxfrl.exe85⤵PID:1808
-
\??\c:\xlxxfff.exec:\xlxxfff.exe86⤵PID:2720
-
\??\c:\1ntnnh.exec:\1ntnnh.exe87⤵PID:2932
-
\??\c:\7bnntn.exec:\7bnntn.exe88⤵PID:1936
-
\??\c:\thnhbt.exec:\thnhbt.exe89⤵PID:1168
-
\??\c:\5vvvp.exec:\5vvvp.exe90⤵PID:2508
-
\??\c:\3vjdj.exec:\3vjdj.exe91⤵PID:2328
-
\??\c:\dvppp.exec:\dvppp.exe92⤵PID:2516
-
\??\c:\rfrlrrr.exec:\rfrlrrr.exe93⤵PID:1660
-
\??\c:\lfrfxfl.exec:\lfrfxfl.exe94⤵PID:2552
-
\??\c:\3nhhnn.exec:\3nhhnn.exe95⤵PID:2536
-
\??\c:\hbnthh.exec:\hbnthh.exe96⤵PID:952
-
\??\c:\pjvvd.exec:\pjvvd.exe97⤵PID:1764
-
\??\c:\jdpdd.exec:\jdpdd.exe98⤵PID:2260
-
\??\c:\rlllflx.exec:\rlllflx.exe99⤵PID:1888
-
\??\c:\fxfffll.exec:\fxfffll.exe100⤵PID:2236
-
\??\c:\lxfflff.exec:\lxfflff.exe101⤵PID:1628
-
\??\c:\9hnnhn.exec:\9hnnhn.exe102⤵PID:1492
-
\??\c:\thbbnn.exec:\thbbnn.exe103⤵PID:2124
-
\??\c:\3vvdd.exec:\3vvdd.exe104⤵PID:1968
-
\??\c:\3jdpp.exec:\3jdpp.exe105⤵PID:1816
-
\??\c:\jvdvd.exec:\jvdvd.exe106⤵PID:2120
-
\??\c:\frfffff.exec:\frfffff.exe107⤵PID:1020
-
\??\c:\lxflrrr.exec:\lxflrrr.exe108⤵PID:824
-
\??\c:\htbhhh.exec:\htbhhh.exe109⤵PID:2008
-
\??\c:\bnhntt.exec:\bnhntt.exe110⤵PID:2180
-
\??\c:\hbtbtt.exec:\hbtbtt.exe111⤵PID:1084
-
\??\c:\ppdvv.exec:\ppdvv.exe112⤵PID:820
-
\??\c:\vvvdv.exec:\vvvdv.exe113⤵PID:2308
-
\??\c:\xllllff.exec:\xllllff.exe114⤵PID:1748
-
\??\c:\xrxlrlx.exec:\xrxlrlx.exe115⤵PID:3064
-
\??\c:\htnntt.exec:\htnntt.exe116⤵PID:2952
-
\??\c:\ttthnb.exec:\ttthnb.exe117⤵PID:1716
-
\??\c:\hthntt.exec:\hthntt.exe118⤵PID:2196
-
\??\c:\jpvpp.exec:\jpvpp.exe119⤵PID:3048
-
\??\c:\pdvvd.exec:\pdvvd.exe120⤵PID:1680
-
\??\c:\fxflxfl.exec:\fxflxfl.exe121⤵PID:2792
-
\??\c:\9fxffxx.exec:\9fxffxx.exe122⤵PID:2640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-