Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-06-2024 10:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
37ace104493fc601d378121297017200_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
37ace104493fc601d378121297017200_NeikiAnalytics.exe
-
Size
56KB
-
MD5
37ace104493fc601d378121297017200
-
SHA1
8f12daec013402982b6b1753abf47949dc316b43
-
SHA256
03edc67a971ca7ff5d91525980507167627342ea39009f50abdf90a3c233abc9
-
SHA512
91c9384b94c83a81205f25c53a093b77ba1de8fdac195f29c7cb7e8858da7848a24a4d033e5cec01da0c24a7902a913c5b99ccbe4d2a98127c1b900d46250907
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0chV+:ymb3NkkiQ3mdBjF0cr+
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2388-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2000-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2000-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1968-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2328-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/648-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2308-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1212-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1588-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1980-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2088 jdvdp.exe 2000 5rfrflr.exe 2756 9fxllxr.exe 2456 1httbh.exe 2652 tnnhnt.exe 2504 pvpdv.exe 2516 9rrxfll.exe 1968 xrllxxr.exe 2436 1hbntt.exe 2700 hhbtbb.exe 2816 dvpdd.exe 1752 jpdpp.exe 1528 ddpdv.exe 2328 llfrlxl.exe 1572 rrfrlll.exe 292 vjvdp.exe 648 7xfrxxx.exe 1212 flrxxrf.exe 2308 nnnthn.exe 2432 tnbnhn.exe 2548 jdpdj.exe 1424 pvjpd.exe 2908 rfrfrlr.exe 1588 bhthhb.exe 2996 bhhntt.exe 1804 ppvvd.exe 2232 dpdjv.exe 2092 lfflxxf.exe 112 ntthht.exe 2124 tttttn.exe 1980 hhhtbn.exe 2636 ddjdd.exe 2596 lffrxlx.exe 2748 rlffxrl.exe 2760 ffrxrrx.exe 1540 9nnthh.exe 2884 3tbnnb.exe 2456 vvdjj.exe 2556 3vjpp.exe 2452 7dppd.exe 2528 lfffxxl.exe 2724 1hbhhh.exe 2968 9pdpp.exe 2668 pdppv.exe 2436 fxrrxfl.exe 1800 rlfllxl.exe 1532 bhtthn.exe 2808 pjvdp.exe 1904 9lxrffl.exe 1124 lfrxlxf.exe 776 hbthth.exe 272 1rlllrx.exe 1652 lfrxflr.exe 1472 hbthtb.exe 1468 thbbhh.exe 2276 dpjpv.exe 1856 vpddj.exe 2288 rrlrlxr.exe 692 xrllxfr.exe 268 3lrlfrf.exe 1756 hbnhtb.exe 1420 nnbnbt.exe 3032 9dvjv.exe 448 rlxxllx.exe -
resource yara_rule behavioral1/memory/2388-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2000-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1968-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/648-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2308-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1212-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1588-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1980-299-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-289-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2388 wrote to memory of 2088 2388 37ace104493fc601d378121297017200_NeikiAnalytics.exe 28 PID 2388 wrote to memory of 2088 2388 37ace104493fc601d378121297017200_NeikiAnalytics.exe 28 PID 2388 wrote to memory of 2088 2388 37ace104493fc601d378121297017200_NeikiAnalytics.exe 28 PID 2388 wrote to memory of 2088 2388 37ace104493fc601d378121297017200_NeikiAnalytics.exe 28 PID 2088 wrote to memory of 2000 2088 jdvdp.exe 29 PID 2088 wrote to memory of 2000 2088 jdvdp.exe 29 PID 2088 wrote to memory of 2000 2088 jdvdp.exe 29 PID 2088 wrote to memory of 2000 2088 jdvdp.exe 29 PID 2000 wrote to memory of 2756 2000 5rfrflr.exe 30 PID 2000 wrote to memory of 2756 2000 5rfrflr.exe 30 PID 2000 wrote to memory of 2756 2000 5rfrflr.exe 30 PID 2000 wrote to memory of 2756 2000 5rfrflr.exe 30 PID 2756 wrote to memory of 2456 2756 9fxllxr.exe 31 PID 2756 wrote to memory of 2456 2756 9fxllxr.exe 31 PID 2756 wrote to memory of 2456 2756 9fxllxr.exe 31 PID 2756 wrote to memory of 2456 2756 9fxllxr.exe 31 PID 2456 wrote to memory of 2652 2456 1httbh.exe 32 PID 2456 wrote to memory of 2652 2456 1httbh.exe 32 PID 2456 wrote to memory of 2652 2456 1httbh.exe 32 PID 2456 wrote to memory of 2652 2456 1httbh.exe 32 PID 2652 wrote to memory of 2504 2652 tnnhnt.exe 33 PID 2652 wrote to memory of 2504 2652 tnnhnt.exe 33 PID 2652 wrote to memory of 2504 2652 tnnhnt.exe 33 PID 2652 wrote to memory of 2504 2652 tnnhnt.exe 33 PID 2504 wrote to memory of 2516 2504 pvpdv.exe 34 PID 2504 wrote to memory of 2516 2504 pvpdv.exe 34 PID 2504 wrote to memory of 2516 2504 pvpdv.exe 34 PID 2504 wrote to memory of 2516 2504 pvpdv.exe 34 PID 2516 wrote to memory of 1968 2516 9rrxfll.exe 35 PID 2516 wrote to memory of 1968 2516 9rrxfll.exe 35 PID 2516 wrote to memory of 1968 2516 9rrxfll.exe 35 PID 2516 wrote to memory of 1968 2516 9rrxfll.exe 35 PID 1968 wrote to memory of 2436 1968 xrllxxr.exe 36 PID 1968 wrote to memory of 2436 1968 xrllxxr.exe 36 PID 1968 wrote to memory of 2436 1968 xrllxxr.exe 36 PID 1968 wrote to memory of 2436 1968 xrllxxr.exe 36 PID 2436 wrote to memory of 2700 2436 1hbntt.exe 37 PID 2436 wrote to memory of 2700 2436 1hbntt.exe 37 PID 2436 wrote to memory of 2700 2436 1hbntt.exe 37 PID 2436 wrote to memory of 2700 2436 1hbntt.exe 37 PID 2700 wrote to memory of 2816 2700 hhbtbb.exe 38 PID 2700 wrote to memory of 2816 2700 hhbtbb.exe 38 PID 2700 wrote to memory of 2816 2700 hhbtbb.exe 38 PID 2700 wrote to memory of 2816 2700 hhbtbb.exe 38 PID 2816 wrote to memory of 1752 2816 dvpdd.exe 39 PID 2816 wrote to memory of 1752 2816 dvpdd.exe 39 PID 2816 wrote to memory of 1752 2816 dvpdd.exe 39 PID 2816 wrote to memory of 1752 2816 dvpdd.exe 39 PID 1752 wrote to memory of 1528 1752 jpdpp.exe 40 PID 1752 wrote to memory of 1528 1752 jpdpp.exe 40 PID 1752 wrote to memory of 1528 1752 jpdpp.exe 40 PID 1752 wrote to memory of 1528 1752 jpdpp.exe 40 PID 1528 wrote to memory of 2328 1528 ddpdv.exe 41 PID 1528 wrote to memory of 2328 1528 ddpdv.exe 41 PID 1528 wrote to memory of 2328 1528 ddpdv.exe 41 PID 1528 wrote to memory of 2328 1528 ddpdv.exe 41 PID 2328 wrote to memory of 1572 2328 llfrlxl.exe 42 PID 2328 wrote to memory of 1572 2328 llfrlxl.exe 42 PID 2328 wrote to memory of 1572 2328 llfrlxl.exe 42 PID 2328 wrote to memory of 1572 2328 llfrlxl.exe 42 PID 1572 wrote to memory of 292 1572 rrfrlll.exe 43 PID 1572 wrote to memory of 292 1572 rrfrlll.exe 43 PID 1572 wrote to memory of 292 1572 rrfrlll.exe 43 PID 1572 wrote to memory of 292 1572 rrfrlll.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\37ace104493fc601d378121297017200_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\37ace104493fc601d378121297017200_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\jdvdp.exec:\jdvdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\5rfrflr.exec:\5rfrflr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\9fxllxr.exec:\9fxllxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\1httbh.exec:\1httbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\tnnhnt.exec:\tnnhnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\pvpdv.exec:\pvpdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\9rrxfll.exec:\9rrxfll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\xrllxxr.exec:\xrllxxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\1hbntt.exec:\1hbntt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\hhbtbb.exec:\hhbtbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\dvpdd.exec:\dvpdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\jpdpp.exec:\jpdpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\ddpdv.exec:\ddpdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\llfrlxl.exec:\llfrlxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\rrfrlll.exec:\rrfrlll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\vjvdp.exec:\vjvdp.exe17⤵
- Executes dropped EXE
PID:292 -
\??\c:\7xfrxxx.exec:\7xfrxxx.exe18⤵
- Executes dropped EXE
PID:648 -
\??\c:\flrxxrf.exec:\flrxxrf.exe19⤵
- Executes dropped EXE
PID:1212 -
\??\c:\nnnthn.exec:\nnnthn.exe20⤵
- Executes dropped EXE
PID:2308 -
\??\c:\tnbnhn.exec:\tnbnhn.exe21⤵
- Executes dropped EXE
PID:2432 -
\??\c:\jdpdj.exec:\jdpdj.exe22⤵
- Executes dropped EXE
PID:2548 -
\??\c:\pvjpd.exec:\pvjpd.exe23⤵
- Executes dropped EXE
PID:1424 -
\??\c:\rfrfrlr.exec:\rfrfrlr.exe24⤵
- Executes dropped EXE
PID:2908 -
\??\c:\bhthhb.exec:\bhthhb.exe25⤵
- Executes dropped EXE
PID:1588 -
\??\c:\bhhntt.exec:\bhhntt.exe26⤵
- Executes dropped EXE
PID:2996 -
\??\c:\ppvvd.exec:\ppvvd.exe27⤵
- Executes dropped EXE
PID:1804 -
\??\c:\dpdjv.exec:\dpdjv.exe28⤵
- Executes dropped EXE
PID:2232 -
\??\c:\lfflxxf.exec:\lfflxxf.exe29⤵
- Executes dropped EXE
PID:2092 -
\??\c:\ntthht.exec:\ntthht.exe30⤵
- Executes dropped EXE
PID:112 -
\??\c:\tttttn.exec:\tttttn.exe31⤵
- Executes dropped EXE
PID:2124 -
\??\c:\hhhtbn.exec:\hhhtbn.exe32⤵
- Executes dropped EXE
PID:1980 -
\??\c:\ddjdd.exec:\ddjdd.exe33⤵
- Executes dropped EXE
PID:2636 -
\??\c:\lffrxlx.exec:\lffrxlx.exe34⤵
- Executes dropped EXE
PID:2596 -
\??\c:\rlffxrl.exec:\rlffxrl.exe35⤵
- Executes dropped EXE
PID:2748 -
\??\c:\ffrxrrx.exec:\ffrxrrx.exe36⤵
- Executes dropped EXE
PID:2760 -
\??\c:\9nnthh.exec:\9nnthh.exe37⤵
- Executes dropped EXE
PID:1540 -
\??\c:\3tbnnb.exec:\3tbnnb.exe38⤵
- Executes dropped EXE
PID:2884 -
\??\c:\vvdjj.exec:\vvdjj.exe39⤵
- Executes dropped EXE
PID:2456 -
\??\c:\3vjpp.exec:\3vjpp.exe40⤵
- Executes dropped EXE
PID:2556 -
\??\c:\7dppd.exec:\7dppd.exe41⤵
- Executes dropped EXE
PID:2452 -
\??\c:\lfffxxl.exec:\lfffxxl.exe42⤵
- Executes dropped EXE
PID:2528 -
\??\c:\1hbhhh.exec:\1hbhhh.exe43⤵
- Executes dropped EXE
PID:2724 -
\??\c:\9pdpp.exec:\9pdpp.exe44⤵
- Executes dropped EXE
PID:2968 -
\??\c:\pdppv.exec:\pdppv.exe45⤵
- Executes dropped EXE
PID:2668 -
\??\c:\fxrrxfl.exec:\fxrrxfl.exe46⤵
- Executes dropped EXE
PID:2436 -
\??\c:\rlfllxl.exec:\rlfllxl.exe47⤵
- Executes dropped EXE
PID:1800 -
\??\c:\bhtthn.exec:\bhtthn.exe48⤵
- Executes dropped EXE
PID:1532 -
\??\c:\pjvdp.exec:\pjvdp.exe49⤵
- Executes dropped EXE
PID:2808 -
\??\c:\9lxrffl.exec:\9lxrffl.exe50⤵
- Executes dropped EXE
PID:1904 -
\??\c:\lfrxlxf.exec:\lfrxlxf.exe51⤵
- Executes dropped EXE
PID:1124 -
\??\c:\hbthth.exec:\hbthth.exe52⤵
- Executes dropped EXE
PID:776 -
\??\c:\1rlllrx.exec:\1rlllrx.exe53⤵
- Executes dropped EXE
PID:272 -
\??\c:\lfrxflr.exec:\lfrxflr.exe54⤵
- Executes dropped EXE
PID:1652 -
\??\c:\hbthtb.exec:\hbthtb.exe55⤵
- Executes dropped EXE
PID:1472 -
\??\c:\thbbhh.exec:\thbbhh.exe56⤵
- Executes dropped EXE
PID:1468 -
\??\c:\dpjpv.exec:\dpjpv.exe57⤵
- Executes dropped EXE
PID:2276 -
\??\c:\vpddj.exec:\vpddj.exe58⤵
- Executes dropped EXE
PID:1856 -
\??\c:\rrlrlxr.exec:\rrlrlxr.exe59⤵
- Executes dropped EXE
PID:2288 -
\??\c:\xrllxfr.exec:\xrllxfr.exe60⤵
- Executes dropped EXE
PID:692 -
\??\c:\3lrlfrf.exec:\3lrlfrf.exe61⤵
- Executes dropped EXE
PID:268 -
\??\c:\hbnhtb.exec:\hbnhtb.exe62⤵
- Executes dropped EXE
PID:1756 -
\??\c:\nnbnbt.exec:\nnbnbt.exe63⤵
- Executes dropped EXE
PID:1420 -
\??\c:\9dvjv.exec:\9dvjv.exe64⤵
- Executes dropped EXE
PID:3032 -
\??\c:\rlxxllx.exec:\rlxxllx.exe65⤵
- Executes dropped EXE
PID:448 -
\??\c:\nhhtth.exec:\nhhtth.exe66⤵PID:1732
-
\??\c:\ppjpd.exec:\ppjpd.exe67⤵PID:2056
-
\??\c:\7vvpv.exec:\7vvpv.exe68⤵PID:1312
-
\??\c:\9hnnbt.exec:\9hnnbt.exe69⤵PID:1252
-
\??\c:\thbntn.exec:\thbntn.exe70⤵PID:2108
-
\??\c:\7vdjd.exec:\7vdjd.exe71⤵PID:2876
-
\??\c:\dpddv.exec:\dpddv.exe72⤵PID:2404
-
\??\c:\lrlrrrf.exec:\lrlrrrf.exe73⤵PID:2388
-
\??\c:\frflrrx.exec:\frflrrx.exe74⤵PID:1584
-
\??\c:\1nhnhn.exec:\1nhnhn.exe75⤵PID:2560
-
\??\c:\jppjv.exec:\jppjv.exe76⤵PID:2740
-
\??\c:\rfrrrfr.exec:\rfrrrfr.exe77⤵PID:2888
-
\??\c:\rrflrxl.exec:\rrflrxl.exe78⤵PID:2600
-
\??\c:\9hhnbt.exec:\9hhnbt.exe79⤵PID:2728
-
\??\c:\tbbhtt.exec:\tbbhtt.exe80⤵PID:1996
-
\??\c:\7vvdp.exec:\7vvdp.exe81⤵PID:2220
-
\??\c:\dddpv.exec:\dddpv.exe82⤵PID:2648
-
\??\c:\llxxrxr.exec:\llxxrxr.exe83⤵PID:2504
-
\??\c:\9rrfrrf.exec:\9rrfrrf.exe84⤵PID:2528
-
\??\c:\hhbhbh.exec:\hhbhbh.exe85⤵PID:2724
-
\??\c:\vvpjv.exec:\vvpjv.exe86⤵PID:2968
-
\??\c:\pjvjp.exec:\pjvjp.exe87⤵PID:2796
-
\??\c:\lfxflxl.exec:\lfxflxl.exe88⤵PID:2436
-
\??\c:\1rffflr.exec:\1rffflr.exe89⤵PID:2816
-
\??\c:\hbhhnt.exec:\hbhhnt.exe90⤵PID:2824
-
\??\c:\nbthnh.exec:\nbthnh.exe91⤵PID:2808
-
\??\c:\pdvpv.exec:\pdvpv.exe92⤵PID:1904
-
\??\c:\1vjjp.exec:\1vjjp.exe93⤵PID:2328
-
\??\c:\llrfrrf.exec:\llrfrrf.exe94⤵PID:776
-
\??\c:\htnbbh.exec:\htnbbh.exe95⤵PID:272
-
\??\c:\tnbbbb.exec:\tnbbbb.exe96⤵PID:1652
-
\??\c:\dvjjj.exec:\dvjjj.exe97⤵PID:1472
-
\??\c:\dvjjv.exec:\dvjjv.exe98⤵PID:1468
-
\??\c:\ffxxrfx.exec:\ffxxrfx.exe99⤵PID:2276
-
\??\c:\xxllllr.exec:\xxllllr.exe100⤵PID:1856
-
\??\c:\nhtbbh.exec:\nhtbbh.exe101⤵PID:896
-
\??\c:\nhbthn.exec:\nhbthn.exe102⤵PID:692
-
\??\c:\pjddj.exec:\pjddj.exe103⤵PID:268
-
\??\c:\pjddp.exec:\pjddp.exe104⤵PID:1756
-
\??\c:\rlxrlrl.exec:\rlxrlrl.exe105⤵PID:1420
-
\??\c:\3xrlxlf.exec:\3xrlxlf.exe106⤵PID:2224
-
\??\c:\xffxlxr.exec:\xffxlxr.exe107⤵PID:1932
-
\??\c:\hhbhtn.exec:\hhbhtn.exe108⤵PID:1732
-
\??\c:\5vjpj.exec:\5vjpj.exe109⤵PID:1120
-
\??\c:\vjjjd.exec:\vjjjd.exe110⤵PID:1312
-
\??\c:\vpjvd.exec:\vpjvd.exe111⤵PID:1456
-
\??\c:\rrflfrx.exec:\rrflfrx.exe112⤵PID:2240
-
\??\c:\nhnbhn.exec:\nhnbhn.exe113⤵PID:1808
-
\??\c:\bnbhnt.exec:\bnbhnt.exe114⤵PID:2992
-
\??\c:\jjvjv.exec:\jjvjv.exe115⤵PID:1672
-
\??\c:\9dvvj.exec:\9dvvj.exe116⤵PID:1584
-
\??\c:\rlrxfrl.exec:\rlrxfrl.exe117⤵PID:2560
-
\??\c:\fxrxrxl.exec:\fxrxrxl.exe118⤵PID:2740
-
\??\c:\hbntnt.exec:\hbntnt.exe119⤵PID:2612
-
\??\c:\bhhttt.exec:\bhhttt.exe120⤵PID:2600
-
\??\c:\5dpjd.exec:\5dpjd.exe121⤵PID:2728
-
\??\c:\djdjv.exec:\djdjv.exe122⤵PID:1996
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-