Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
13/06/2024, 08:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6ec85bac33d430f780a45bc821c95630_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
6ec85bac33d430f780a45bc821c95630_NeikiAnalytics.exe
-
Size
100KB
-
MD5
6ec85bac33d430f780a45bc821c95630
-
SHA1
54795fcb6355d8043307a2a19064246098334ecd
-
SHA256
6748ea4d0b92457d40b89e76575151658f4461fcbcc4d0ef907142a831af699b
-
SHA512
f0c8361451d4119cdda7e9cd1db2b2d628a83091e1b0433fd5b6c21795deaef52de6b97796c0feca5c097a4f11919340ed8303a4a92d86bed0ae384bdd16f882
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDodtzn6zDaE0R5p:ymb3NkkiQ3mdBjFodt2zE3p
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/1704-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3048-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-68-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2364-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/712-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2356-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1968-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2508-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1044-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1660-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1568-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1732-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2056 dpvjd.exe 3048 3frlrlr.exe 2644 9tbthn.exe 2736 jvjvj.exe 2700 fxxrxrx.exe 2772 xllrrlr.exe 2580 3nhnhh.exe 2584 pddvd.exe 2364 rlrrfxf.exe 712 rrflxfr.exe 2860 3nhntb.exe 2888 5dddp.exe 2356 1vvpp.exe 2036 5lxflrx.exe 1968 5hnntt.exe 2508 3jpjd.exe 1044 pjpdd.exe 1660 5fxxllr.exe 2256 xlrrrrl.exe 2516 1thnbb.exe 2372 pdddp.exe 380 7rllrrx.exe 1148 lflrxlx.exe 1740 nhhtnn.exe 1532 nnthnt.exe 1568 jdjjj.exe 2144 lfrrrrx.exe 2924 bnbbhh.exe 1648 nbntbh.exe 1732 vdvjj.exe 1684 dpddj.exe 3020 1rxlllf.exe 1704 nbtbtn.exe 2720 3bttth.exe 3044 nbnbtt.exe 1592 vpdjd.exe 2684 vjpdj.exe 2696 rllrflf.exe 1544 lfrxxff.exe 2788 hhtbhh.exe 3004 hbbbbb.exe 2772 jdpjp.exe 2552 ddvpd.exe 2576 lrllrrf.exe 2288 3lxfflx.exe 2592 tnbbhh.exe 2824 btnbtt.exe 2768 ppddp.exe 1036 jdpvd.exe 2044 3rllllx.exe 1956 xlllrrx.exe 864 rlflffr.exe 316 htbhhh.exe 2012 1tntbt.exe 1564 vjjvv.exe 1044 pjdvd.exe 1660 9pdjv.exe 2304 xrfxfxl.exe 2852 xrxxflr.exe 2928 tnhntb.exe 2920 bhntbb.exe 380 pjvvd.exe 484 5pjpj.exe 1740 3flrlrx.exe -
resource yara_rule behavioral1/memory/1704-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2364-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/712-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1968-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1044-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1568-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1732-287-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1704 wrote to memory of 2056 1704 6ec85bac33d430f780a45bc821c95630_NeikiAnalytics.exe 28 PID 1704 wrote to memory of 2056 1704 6ec85bac33d430f780a45bc821c95630_NeikiAnalytics.exe 28 PID 1704 wrote to memory of 2056 1704 6ec85bac33d430f780a45bc821c95630_NeikiAnalytics.exe 28 PID 1704 wrote to memory of 2056 1704 6ec85bac33d430f780a45bc821c95630_NeikiAnalytics.exe 28 PID 2056 wrote to memory of 3048 2056 dpvjd.exe 29 PID 2056 wrote to memory of 3048 2056 dpvjd.exe 29 PID 2056 wrote to memory of 3048 2056 dpvjd.exe 29 PID 2056 wrote to memory of 3048 2056 dpvjd.exe 29 PID 3048 wrote to memory of 2644 3048 3frlrlr.exe 30 PID 3048 wrote to memory of 2644 3048 3frlrlr.exe 30 PID 3048 wrote to memory of 2644 3048 3frlrlr.exe 30 PID 3048 wrote to memory of 2644 3048 3frlrlr.exe 30 PID 2644 wrote to memory of 2736 2644 9tbthn.exe 31 PID 2644 wrote to memory of 2736 2644 9tbthn.exe 31 PID 2644 wrote to memory of 2736 2644 9tbthn.exe 31 PID 2644 wrote to memory of 2736 2644 9tbthn.exe 31 PID 2736 wrote to memory of 2700 2736 jvjvj.exe 32 PID 2736 wrote to memory of 2700 2736 jvjvj.exe 32 PID 2736 wrote to memory of 2700 2736 jvjvj.exe 32 PID 2736 wrote to memory of 2700 2736 jvjvj.exe 32 PID 2700 wrote to memory of 2772 2700 fxxrxrx.exe 33 PID 2700 wrote to memory of 2772 2700 fxxrxrx.exe 33 PID 2700 wrote to memory of 2772 2700 fxxrxrx.exe 33 PID 2700 wrote to memory of 2772 2700 fxxrxrx.exe 33 PID 2772 wrote to memory of 2580 2772 xllrrlr.exe 34 PID 2772 wrote to memory of 2580 2772 xllrrlr.exe 34 PID 2772 wrote to memory of 2580 2772 xllrrlr.exe 34 PID 2772 wrote to memory of 2580 2772 xllrrlr.exe 34 PID 2580 wrote to memory of 2584 2580 3nhnhh.exe 35 PID 2580 wrote to memory of 2584 2580 3nhnhh.exe 35 PID 2580 wrote to memory of 2584 2580 3nhnhh.exe 35 PID 2580 wrote to memory of 2584 2580 3nhnhh.exe 35 PID 2584 wrote to memory of 2364 2584 pddvd.exe 36 PID 2584 wrote to memory of 2364 2584 pddvd.exe 36 PID 2584 wrote to memory of 2364 2584 pddvd.exe 36 PID 2584 wrote to memory of 2364 2584 pddvd.exe 36 PID 2364 wrote to memory of 712 2364 rlrrfxf.exe 37 PID 2364 wrote to memory of 712 2364 rlrrfxf.exe 37 PID 2364 wrote to memory of 712 2364 rlrrfxf.exe 37 PID 2364 wrote to memory of 712 2364 rlrrfxf.exe 37 PID 712 wrote to memory of 2860 712 rrflxfr.exe 38 PID 712 wrote to memory of 2860 712 rrflxfr.exe 38 PID 712 wrote to memory of 2860 712 rrflxfr.exe 38 PID 712 wrote to memory of 2860 712 rrflxfr.exe 38 PID 2860 wrote to memory of 2888 2860 3nhntb.exe 39 PID 2860 wrote to memory of 2888 2860 3nhntb.exe 39 PID 2860 wrote to memory of 2888 2860 3nhntb.exe 39 PID 2860 wrote to memory of 2888 2860 3nhntb.exe 39 PID 2888 wrote to memory of 2356 2888 5dddp.exe 40 PID 2888 wrote to memory of 2356 2888 5dddp.exe 40 PID 2888 wrote to memory of 2356 2888 5dddp.exe 40 PID 2888 wrote to memory of 2356 2888 5dddp.exe 40 PID 2356 wrote to memory of 2036 2356 1vvpp.exe 41 PID 2356 wrote to memory of 2036 2356 1vvpp.exe 41 PID 2356 wrote to memory of 2036 2356 1vvpp.exe 41 PID 2356 wrote to memory of 2036 2356 1vvpp.exe 41 PID 2036 wrote to memory of 1968 2036 5lxflrx.exe 42 PID 2036 wrote to memory of 1968 2036 5lxflrx.exe 42 PID 2036 wrote to memory of 1968 2036 5lxflrx.exe 42 PID 2036 wrote to memory of 1968 2036 5lxflrx.exe 42 PID 1968 wrote to memory of 2508 1968 5hnntt.exe 43 PID 1968 wrote to memory of 2508 1968 5hnntt.exe 43 PID 1968 wrote to memory of 2508 1968 5hnntt.exe 43 PID 1968 wrote to memory of 2508 1968 5hnntt.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ec85bac33d430f780a45bc821c95630_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6ec85bac33d430f780a45bc821c95630_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\dpvjd.exec:\dpvjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\3frlrlr.exec:\3frlrlr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\9tbthn.exec:\9tbthn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\jvjvj.exec:\jvjvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\fxxrxrx.exec:\fxxrxrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\xllrrlr.exec:\xllrrlr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\3nhnhh.exec:\3nhnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\pddvd.exec:\pddvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\rlrrfxf.exec:\rlrrfxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\rrflxfr.exec:\rrflxfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
\??\c:\3nhntb.exec:\3nhntb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\5dddp.exec:\5dddp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\1vvpp.exec:\1vvpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\5lxflrx.exec:\5lxflrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\5hnntt.exec:\5hnntt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\3jpjd.exec:\3jpjd.exe17⤵
- Executes dropped EXE
PID:2508 -
\??\c:\pjpdd.exec:\pjpdd.exe18⤵
- Executes dropped EXE
PID:1044 -
\??\c:\5fxxllr.exec:\5fxxllr.exe19⤵
- Executes dropped EXE
PID:1660 -
\??\c:\xlrrrrl.exec:\xlrrrrl.exe20⤵
- Executes dropped EXE
PID:2256 -
\??\c:\1thnbb.exec:\1thnbb.exe21⤵
- Executes dropped EXE
PID:2516 -
\??\c:\pdddp.exec:\pdddp.exe22⤵
- Executes dropped EXE
PID:2372 -
\??\c:\7rllrrx.exec:\7rllrrx.exe23⤵
- Executes dropped EXE
PID:380 -
\??\c:\lflrxlx.exec:\lflrxlx.exe24⤵
- Executes dropped EXE
PID:1148 -
\??\c:\nhhtnn.exec:\nhhtnn.exe25⤵
- Executes dropped EXE
PID:1740 -
\??\c:\nnthnt.exec:\nnthnt.exe26⤵
- Executes dropped EXE
PID:1532 -
\??\c:\jdjjj.exec:\jdjjj.exe27⤵
- Executes dropped EXE
PID:1568 -
\??\c:\lfrrrrx.exec:\lfrrrrx.exe28⤵
- Executes dropped EXE
PID:2144 -
\??\c:\bnbbhh.exec:\bnbbhh.exe29⤵
- Executes dropped EXE
PID:2924 -
\??\c:\nbntbh.exec:\nbntbh.exe30⤵
- Executes dropped EXE
PID:1648 -
\??\c:\vdvjj.exec:\vdvjj.exe31⤵
- Executes dropped EXE
PID:1732 -
\??\c:\dpddj.exec:\dpddj.exe32⤵
- Executes dropped EXE
PID:1684 -
\??\c:\1rxlllf.exec:\1rxlllf.exe33⤵
- Executes dropped EXE
PID:3020 -
\??\c:\nbtbtn.exec:\nbtbtn.exe34⤵
- Executes dropped EXE
PID:1704 -
\??\c:\3bttth.exec:\3bttth.exe35⤵
- Executes dropped EXE
PID:2720 -
\??\c:\nbnbtt.exec:\nbnbtt.exe36⤵
- Executes dropped EXE
PID:3044 -
\??\c:\vpdjd.exec:\vpdjd.exe37⤵
- Executes dropped EXE
PID:1592 -
\??\c:\vjpdj.exec:\vjpdj.exe38⤵
- Executes dropped EXE
PID:2684 -
\??\c:\rllrflf.exec:\rllrflf.exe39⤵
- Executes dropped EXE
PID:2696 -
\??\c:\lfrxxff.exec:\lfrxxff.exe40⤵
- Executes dropped EXE
PID:1544 -
\??\c:\hhtbhh.exec:\hhtbhh.exe41⤵
- Executes dropped EXE
PID:2788 -
\??\c:\hbbbbb.exec:\hbbbbb.exe42⤵
- Executes dropped EXE
PID:3004 -
\??\c:\jdpjp.exec:\jdpjp.exe43⤵
- Executes dropped EXE
PID:2772 -
\??\c:\ddvpd.exec:\ddvpd.exe44⤵
- Executes dropped EXE
PID:2552 -
\??\c:\lrllrrf.exec:\lrllrrf.exe45⤵
- Executes dropped EXE
PID:2576 -
\??\c:\3lxfflx.exec:\3lxfflx.exe46⤵
- Executes dropped EXE
PID:2288 -
\??\c:\tnbbhh.exec:\tnbbhh.exe47⤵
- Executes dropped EXE
PID:2592 -
\??\c:\btnbtt.exec:\btnbtt.exe48⤵
- Executes dropped EXE
PID:2824 -
\??\c:\ppddp.exec:\ppddp.exe49⤵
- Executes dropped EXE
PID:2768 -
\??\c:\jdpvd.exec:\jdpvd.exe50⤵
- Executes dropped EXE
PID:1036 -
\??\c:\3rllllx.exec:\3rllllx.exe51⤵
- Executes dropped EXE
PID:2044 -
\??\c:\xlllrrx.exec:\xlllrrx.exe52⤵
- Executes dropped EXE
PID:1956 -
\??\c:\rlflffr.exec:\rlflffr.exe53⤵
- Executes dropped EXE
PID:864 -
\??\c:\htbhhh.exec:\htbhhh.exe54⤵
- Executes dropped EXE
PID:316 -
\??\c:\1tntbt.exec:\1tntbt.exe55⤵
- Executes dropped EXE
PID:2012 -
\??\c:\vjjvv.exec:\vjjvv.exe56⤵
- Executes dropped EXE
PID:1564 -
\??\c:\pjdvd.exec:\pjdvd.exe57⤵
- Executes dropped EXE
PID:1044 -
\??\c:\9pdjv.exec:\9pdjv.exe58⤵
- Executes dropped EXE
PID:1660 -
\??\c:\xrfxfxl.exec:\xrfxfxl.exe59⤵
- Executes dropped EXE
PID:2304 -
\??\c:\xrxxflr.exec:\xrxxflr.exe60⤵
- Executes dropped EXE
PID:2852 -
\??\c:\tnhntb.exec:\tnhntb.exe61⤵
- Executes dropped EXE
PID:2928 -
\??\c:\bhntbb.exec:\bhntbb.exe62⤵
- Executes dropped EXE
PID:2920 -
\??\c:\pjvvd.exec:\pjvvd.exe63⤵
- Executes dropped EXE
PID:380 -
\??\c:\5pjpj.exec:\5pjpj.exe64⤵
- Executes dropped EXE
PID:484 -
\??\c:\3flrlrx.exec:\3flrlrx.exe65⤵
- Executes dropped EXE
PID:1740 -
\??\c:\xrxrflr.exec:\xrxrflr.exe66⤵PID:1524
-
\??\c:\htnntt.exec:\htnntt.exe67⤵PID:900
-
\??\c:\1btnnn.exec:\1btnnn.exe68⤵PID:1872
-
\??\c:\pjvdj.exec:\pjvdj.exe69⤵PID:1052
-
\??\c:\pvjjj.exec:\pvjjj.exe70⤵PID:1820
-
\??\c:\xrrrllr.exec:\xrrrllr.exe71⤵PID:2616
-
\??\c:\fxllrrx.exec:\fxllrrx.exe72⤵PID:1648
-
\??\c:\lfrrffr.exec:\lfrrffr.exe73⤵PID:2900
-
\??\c:\5thhnn.exec:\5thhnn.exe74⤵PID:2492
-
\??\c:\5tbbhb.exec:\5tbbhb.exe75⤵PID:3024
-
\??\c:\pjdvv.exec:\pjdvv.exe76⤵PID:1276
-
\??\c:\7jjpd.exec:\7jjpd.exe77⤵PID:2720
-
\??\c:\3lrlrrr.exec:\3lrlrrr.exe78⤵PID:2360
-
\??\c:\lxrrxxf.exec:\lxrrxxf.exe79⤵PID:1700
-
\??\c:\bnttbt.exec:\bnttbt.exe80⤵PID:2748
-
\??\c:\nhbbhh.exec:\nhbbhh.exe81⤵PID:2672
-
\??\c:\dpjdd.exec:\dpjdd.exe82⤵PID:2692
-
\??\c:\5jpvj.exec:\5jpvj.exe83⤵PID:2272
-
\??\c:\5rxxffl.exec:\5rxxffl.exe84⤵PID:2700
-
\??\c:\rlxfffl.exec:\rlxfffl.exe85⤵PID:2652
-
\??\c:\thntbh.exec:\thntbh.exe86⤵PID:2548
-
\??\c:\ttbhnn.exec:\ttbhnn.exe87⤵PID:2984
-
\??\c:\nbnnbb.exec:\nbnnbb.exe88⤵PID:2024
-
\??\c:\jdjjp.exec:\jdjjp.exe89⤵PID:712
-
\??\c:\3vdvd.exec:\3vdvd.exe90⤵PID:2840
-
\??\c:\9flllrx.exec:\9flllrx.exe91⤵PID:2836
-
\??\c:\fflfllr.exec:\fflfllr.exe92⤵PID:2336
-
\??\c:\3tnnbt.exec:\3tnnbt.exe93⤵PID:2420
-
\??\c:\btnnnn.exec:\btnnnn.exe94⤵PID:2356
-
\??\c:\5jvjp.exec:\5jvjp.exe95⤵PID:780
-
\??\c:\vpvvj.exec:\vpvvj.exe96⤵PID:1764
-
\??\c:\pdpjj.exec:\pdpjj.exe97⤵PID:2508
-
\??\c:\xrffllr.exec:\xrffllr.exe98⤵PID:1744
-
\??\c:\3nhhnt.exec:\3nhhnt.exe99⤵PID:1688
-
\??\c:\htbntt.exec:\htbntt.exe100⤵PID:2108
-
\??\c:\nbnnnn.exec:\nbnnnn.exe101⤵PID:2308
-
\??\c:\9ppvv.exec:\9ppvv.exe102⤵PID:2328
-
\??\c:\dpvvj.exec:\dpvvj.exe103⤵PID:3056
-
\??\c:\xrxxfff.exec:\xrxxfff.exe104⤵PID:588
-
\??\c:\xrxxlrf.exec:\xrxxlrf.exe105⤵PID:704
-
\??\c:\nhnhtn.exec:\nhnhtn.exe106⤵PID:544
-
\??\c:\9tbbbb.exec:\9tbbbb.exe107⤵PID:1484
-
\??\c:\jvvpp.exec:\jvvpp.exe108⤵PID:1532
-
\??\c:\pjdjp.exec:\pjdjp.exe109⤵PID:1368
-
\??\c:\vjvvd.exec:\vjvvd.exe110⤵PID:1800
-
\??\c:\lfrrffr.exec:\lfrrffr.exe111⤵PID:1872
-
\??\c:\3lxxlfl.exec:\3lxxlfl.exe112⤵PID:2924
-
\??\c:\nhtbhn.exec:\nhtbhn.exe113⤵PID:948
-
\??\c:\htttnn.exec:\htttnn.exe114⤵PID:1164
-
\??\c:\tthhtn.exec:\tthhtn.exe115⤵PID:1648
-
\??\c:\vpddj.exec:\vpddj.exe116⤵PID:2408
-
\??\c:\7pjjj.exec:\7pjjj.exe117⤵PID:2488
-
\??\c:\xlrlrfl.exec:\xlrlrfl.exe118⤵PID:2428
-
\??\c:\lflrxrf.exec:\lflrxrf.exe119⤵PID:2440
-
\??\c:\thnnbt.exec:\thnnbt.exe120⤵PID:2820
-
\??\c:\5tntbb.exec:\5tntbb.exe121⤵PID:2280
-
\??\c:\7jvdp.exec:\7jvdp.exe122⤵PID:2344
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-