Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 13:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4d0b19513986ae2c19b443cb5c889e20_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
4d0b19513986ae2c19b443cb5c889e20_NeikiAnalytics.exe
-
Size
94KB
-
MD5
4d0b19513986ae2c19b443cb5c889e20
-
SHA1
82b23a64d9eb327c930b2a53c4d911b862ba10ac
-
SHA256
2e62c70fad803ab3ace1d9492d3f6a18d6296ce05273549579e0e2a67fe0ab66
-
SHA512
a61668f02a754f70fa6c9d30098b0f9a65b68ad1f20d64688eadd2f923ef74bacd22fd9ac443f21f6c7e11fb820a72f69801662b7a449f12902c50d9edf98303
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDInWeNCYGyA2R7JxJAg8dtq:ymb3NkkiQ3mdBjFIWeFGyAsJAg2q
Malware Config
Signatures
-
Detect Blackmoon payload 17 IoCs
resource yara_rule behavioral1/memory/3040-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1708-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2324-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3020-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2248-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1796-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1512-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/936-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1708 3frrxxf.exe 2616 3lllllx.exe 2768 nbhbhn.exe 2580 7bnntn.exe 2556 pjjjv.exe 2928 vjvvd.exe 2604 xrrlrrx.exe 2436 lrflxrx.exe 2324 7btbhh.exe 3020 btttbb.exe 1212 htnhhb.exe 2180 3vjpp.exe 1076 3jpjp.exe 1784 rfrlfxf.exe 936 9rrxffx.exe 1740 3thhhh.exe 1512 nnhttb.exe 1796 pdjdj.exe 2712 jpvdd.exe 2248 1vddp.exe 2260 5xlffff.exe 528 xlrxxxx.exe 584 tnbnhb.exe 1888 htbttt.exe 444 hbtbhh.exe 1952 dpppv.exe 1748 lfrxflx.exe 2056 lxfxfll.exe 2960 7tbbnh.exe 2096 1thnnt.exe 1696 pjvdj.exe 3048 dvjpv.exe 1584 xfrrxrx.exe 2044 xfrrlxr.exe 2252 bnttbt.exe 2516 thtbbb.exe 2632 hhnbbt.exe 2664 jjdjd.exe 2468 dppjj.exe 2724 fxllxxx.exe 2444 rxflxlx.exe 2552 9nbbbt.exe 2996 tbhhnn.exe 2176 tntntn.exe 3060 vpddv.exe 2188 djvdv.exe 812 7ntttt.exe 804 dvvvp.exe 2672 btnbnb.exe 1204 5jvvd.exe 1664 vvpdp.exe 1840 fxrrflx.exe 1424 nnntth.exe 2836 xrrxflf.exe 1828 nhbntb.exe 2064 vjvvv.exe 2272 dvjpd.exe 1328 bhnntt.exe 528 btntbh.exe 1360 hbnnbb.exe 1988 dddvv.exe 2796 llxxrfl.exe 2500 5rrlffx.exe 588 nhnbtb.exe -
resource yara_rule behavioral1/memory/3040-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2324-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2248-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1512-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/936-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-44-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3040 wrote to memory of 1708 3040 4d0b19513986ae2c19b443cb5c889e20_NeikiAnalytics.exe 28 PID 3040 wrote to memory of 1708 3040 4d0b19513986ae2c19b443cb5c889e20_NeikiAnalytics.exe 28 PID 3040 wrote to memory of 1708 3040 4d0b19513986ae2c19b443cb5c889e20_NeikiAnalytics.exe 28 PID 3040 wrote to memory of 1708 3040 4d0b19513986ae2c19b443cb5c889e20_NeikiAnalytics.exe 28 PID 1708 wrote to memory of 2616 1708 3frrxxf.exe 29 PID 1708 wrote to memory of 2616 1708 3frrxxf.exe 29 PID 1708 wrote to memory of 2616 1708 3frrxxf.exe 29 PID 1708 wrote to memory of 2616 1708 3frrxxf.exe 29 PID 2616 wrote to memory of 2768 2616 3lllllx.exe 30 PID 2616 wrote to memory of 2768 2616 3lllllx.exe 30 PID 2616 wrote to memory of 2768 2616 3lllllx.exe 30 PID 2616 wrote to memory of 2768 2616 3lllllx.exe 30 PID 2768 wrote to memory of 2580 2768 nbhbhn.exe 31 PID 2768 wrote to memory of 2580 2768 nbhbhn.exe 31 PID 2768 wrote to memory of 2580 2768 nbhbhn.exe 31 PID 2768 wrote to memory of 2580 2768 nbhbhn.exe 31 PID 2580 wrote to memory of 2556 2580 7bnntn.exe 32 PID 2580 wrote to memory of 2556 2580 7bnntn.exe 32 PID 2580 wrote to memory of 2556 2580 7bnntn.exe 32 PID 2580 wrote to memory of 2556 2580 7bnntn.exe 32 PID 2556 wrote to memory of 2928 2556 pjjjv.exe 33 PID 2556 wrote to memory of 2928 2556 pjjjv.exe 33 PID 2556 wrote to memory of 2928 2556 pjjjv.exe 33 PID 2556 wrote to memory of 2928 2556 pjjjv.exe 33 PID 2928 wrote to memory of 2604 2928 vjvvd.exe 34 PID 2928 wrote to memory of 2604 2928 vjvvd.exe 34 PID 2928 wrote to memory of 2604 2928 vjvvd.exe 34 PID 2928 wrote to memory of 2604 2928 vjvvd.exe 34 PID 2604 wrote to memory of 2436 2604 xrrlrrx.exe 35 PID 2604 wrote to memory of 2436 2604 xrrlrrx.exe 35 PID 2604 wrote to memory of 2436 2604 xrrlrrx.exe 35 PID 2604 wrote to memory of 2436 2604 xrrlrrx.exe 35 PID 2436 wrote to memory of 2324 2436 lrflxrx.exe 36 PID 2436 wrote to memory of 2324 2436 lrflxrx.exe 36 PID 2436 wrote to memory of 2324 2436 lrflxrx.exe 36 PID 2436 wrote to memory of 2324 2436 lrflxrx.exe 36 PID 2324 wrote to memory of 3020 2324 7btbhh.exe 37 PID 2324 wrote to memory of 3020 2324 7btbhh.exe 37 PID 2324 wrote to memory of 3020 2324 7btbhh.exe 37 PID 2324 wrote to memory of 3020 2324 7btbhh.exe 37 PID 3020 wrote to memory of 1212 3020 btttbb.exe 38 PID 3020 wrote to memory of 1212 3020 btttbb.exe 38 PID 3020 wrote to memory of 1212 3020 btttbb.exe 38 PID 3020 wrote to memory of 1212 3020 btttbb.exe 38 PID 1212 wrote to memory of 2180 1212 htnhhb.exe 39 PID 1212 wrote to memory of 2180 1212 htnhhb.exe 39 PID 1212 wrote to memory of 2180 1212 htnhhb.exe 39 PID 1212 wrote to memory of 2180 1212 htnhhb.exe 39 PID 2180 wrote to memory of 1076 2180 3vjpp.exe 40 PID 2180 wrote to memory of 1076 2180 3vjpp.exe 40 PID 2180 wrote to memory of 1076 2180 3vjpp.exe 40 PID 2180 wrote to memory of 1076 2180 3vjpp.exe 40 PID 1076 wrote to memory of 1784 1076 3jpjp.exe 41 PID 1076 wrote to memory of 1784 1076 3jpjp.exe 41 PID 1076 wrote to memory of 1784 1076 3jpjp.exe 41 PID 1076 wrote to memory of 1784 1076 3jpjp.exe 41 PID 1784 wrote to memory of 936 1784 rfrlfxf.exe 42 PID 1784 wrote to memory of 936 1784 rfrlfxf.exe 42 PID 1784 wrote to memory of 936 1784 rfrlfxf.exe 42 PID 1784 wrote to memory of 936 1784 rfrlfxf.exe 42 PID 936 wrote to memory of 1740 936 9rrxffx.exe 43 PID 936 wrote to memory of 1740 936 9rrxffx.exe 43 PID 936 wrote to memory of 1740 936 9rrxffx.exe 43 PID 936 wrote to memory of 1740 936 9rrxffx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d0b19513986ae2c19b443cb5c889e20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4d0b19513986ae2c19b443cb5c889e20_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\3frrxxf.exec:\3frrxxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\3lllllx.exec:\3lllllx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\nbhbhn.exec:\nbhbhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\7bnntn.exec:\7bnntn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\pjjjv.exec:\pjjjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\vjvvd.exec:\vjvvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\xrrlrrx.exec:\xrrlrrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\lrflxrx.exec:\lrflxrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\7btbhh.exec:\7btbhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\btttbb.exec:\btttbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\htnhhb.exec:\htnhhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\3vjpp.exec:\3vjpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\3jpjp.exec:\3jpjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\rfrlfxf.exec:\rfrlfxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\9rrxffx.exec:\9rrxffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
\??\c:\3thhhh.exec:\3thhhh.exe17⤵
- Executes dropped EXE
PID:1740 -
\??\c:\nnhttb.exec:\nnhttb.exe18⤵
- Executes dropped EXE
PID:1512 -
\??\c:\pdjdj.exec:\pdjdj.exe19⤵
- Executes dropped EXE
PID:1796 -
\??\c:\jpvdd.exec:\jpvdd.exe20⤵
- Executes dropped EXE
PID:2712 -
\??\c:\1vddp.exec:\1vddp.exe21⤵
- Executes dropped EXE
PID:2248 -
\??\c:\5xlffff.exec:\5xlffff.exe22⤵
- Executes dropped EXE
PID:2260 -
\??\c:\xlrxxxx.exec:\xlrxxxx.exe23⤵
- Executes dropped EXE
PID:528 -
\??\c:\tnbnhb.exec:\tnbnhb.exe24⤵
- Executes dropped EXE
PID:584 -
\??\c:\htbttt.exec:\htbttt.exe25⤵
- Executes dropped EXE
PID:1888 -
\??\c:\hbtbhh.exec:\hbtbhh.exe26⤵
- Executes dropped EXE
PID:444 -
\??\c:\dpppv.exec:\dpppv.exe27⤵
- Executes dropped EXE
PID:1952 -
\??\c:\lfrxflx.exec:\lfrxflx.exe28⤵
- Executes dropped EXE
PID:1748 -
\??\c:\lxfxfll.exec:\lxfxfll.exe29⤵
- Executes dropped EXE
PID:2056 -
\??\c:\7tbbnh.exec:\7tbbnh.exe30⤵
- Executes dropped EXE
PID:2960 -
\??\c:\1thnnt.exec:\1thnnt.exe31⤵
- Executes dropped EXE
PID:2096 -
\??\c:\pjvdj.exec:\pjvdj.exe32⤵
- Executes dropped EXE
PID:1696 -
\??\c:\dvjpv.exec:\dvjpv.exe33⤵
- Executes dropped EXE
PID:3048 -
\??\c:\xfrrxrx.exec:\xfrrxrx.exe34⤵
- Executes dropped EXE
PID:1584 -
\??\c:\xfrrlxr.exec:\xfrrlxr.exe35⤵
- Executes dropped EXE
PID:2044 -
\??\c:\bnttbt.exec:\bnttbt.exe36⤵
- Executes dropped EXE
PID:2252 -
\??\c:\thtbbb.exec:\thtbbb.exe37⤵
- Executes dropped EXE
PID:2516 -
\??\c:\hhnbbt.exec:\hhnbbt.exe38⤵
- Executes dropped EXE
PID:2632 -
\??\c:\jjdjd.exec:\jjdjd.exe39⤵
- Executes dropped EXE
PID:2664 -
\??\c:\dppjj.exec:\dppjj.exe40⤵
- Executes dropped EXE
PID:2468 -
\??\c:\fxllxxx.exec:\fxllxxx.exe41⤵
- Executes dropped EXE
PID:2724 -
\??\c:\rxflxlx.exec:\rxflxlx.exe42⤵
- Executes dropped EXE
PID:2444 -
\??\c:\9nbbbt.exec:\9nbbbt.exe43⤵
- Executes dropped EXE
PID:2552 -
\??\c:\tbhhnn.exec:\tbhhnn.exe44⤵
- Executes dropped EXE
PID:2996 -
\??\c:\tntntn.exec:\tntntn.exe45⤵
- Executes dropped EXE
PID:2176 -
\??\c:\vpddv.exec:\vpddv.exe46⤵
- Executes dropped EXE
PID:3060 -
\??\c:\djvdv.exec:\djvdv.exe47⤵
- Executes dropped EXE
PID:2188 -
\??\c:\7ntttt.exec:\7ntttt.exe48⤵
- Executes dropped EXE
PID:812 -
\??\c:\dvvvp.exec:\dvvvp.exe49⤵
- Executes dropped EXE
PID:804 -
\??\c:\btnbnb.exec:\btnbnb.exe50⤵
- Executes dropped EXE
PID:2672 -
\??\c:\5jvvd.exec:\5jvvd.exe51⤵
- Executes dropped EXE
PID:1204 -
\??\c:\vvpdp.exec:\vvpdp.exe52⤵
- Executes dropped EXE
PID:1664 -
\??\c:\fxrrflx.exec:\fxrrflx.exe53⤵
- Executes dropped EXE
PID:1840 -
\??\c:\nnntth.exec:\nnntth.exe54⤵
- Executes dropped EXE
PID:1424 -
\??\c:\xrrxflf.exec:\xrrxflf.exe55⤵
- Executes dropped EXE
PID:2836 -
\??\c:\nhbntb.exec:\nhbntb.exe56⤵
- Executes dropped EXE
PID:1828 -
\??\c:\vjvvv.exec:\vjvvv.exe57⤵
- Executes dropped EXE
PID:2064 -
\??\c:\dvjpd.exec:\dvjpd.exe58⤵
- Executes dropped EXE
PID:2272 -
\??\c:\bhnntt.exec:\bhnntt.exe59⤵
- Executes dropped EXE
PID:1328 -
\??\c:\btntbh.exec:\btntbh.exe60⤵
- Executes dropped EXE
PID:528 -
\??\c:\hbnnbb.exec:\hbnnbb.exe61⤵
- Executes dropped EXE
PID:1360 -
\??\c:\dddvv.exec:\dddvv.exe62⤵
- Executes dropped EXE
PID:1988 -
\??\c:\llxxrfl.exec:\llxxrfl.exe63⤵
- Executes dropped EXE
PID:2796 -
\??\c:\5rrlffx.exec:\5rrlffx.exe64⤵
- Executes dropped EXE
PID:2500 -
\??\c:\nhnbtb.exec:\nhnbtb.exe65⤵
- Executes dropped EXE
PID:588 -
\??\c:\nhnthh.exec:\nhnthh.exe66⤵PID:1952
-
\??\c:\jvjjd.exec:\jvjjd.exe67⤵PID:1744
-
\??\c:\jvdjp.exec:\jvdjp.exe68⤵PID:2608
-
\??\c:\pjjjv.exec:\pjjjv.exe69⤵PID:1008
-
\??\c:\fxrlfrl.exec:\fxrlfrl.exe70⤵PID:2960
-
\??\c:\llfrxlf.exec:\llfrxlf.exe71⤵PID:608
-
\??\c:\5tthtn.exec:\5tthtn.exe72⤵PID:1696
-
\??\c:\tnnbtb.exec:\tnnbtb.exe73⤵PID:1764
-
\??\c:\vpvvj.exec:\vpvvj.exe74⤵PID:2336
-
\??\c:\jdpvv.exec:\jdpvv.exe75⤵PID:2860
-
\??\c:\9xxfrfx.exec:\9xxfrfx.exe76⤵PID:3000
-
\??\c:\5lxfrxf.exec:\5lxfrxf.exe77⤵PID:2416
-
\??\c:\rrlrxxf.exec:\rrlrxxf.exe78⤵PID:2560
-
\??\c:\hbhhhn.exec:\hbhhhn.exe79⤵PID:2564
-
\??\c:\7ttbnn.exec:\7ttbnn.exe80⤵PID:2292
-
\??\c:\ddjvv.exec:\ddjvv.exe81⤵PID:2648
-
\??\c:\5vjvd.exec:\5vjvd.exe82⤵PID:2596
-
\??\c:\7dpjj.exec:\7dpjj.exe83⤵PID:2476
-
\??\c:\xxxlxrf.exec:\xxxlxrf.exe84⤵PID:2436
-
\??\c:\fxrxflr.exec:\fxrxflr.exe85⤵PID:2548
-
\??\c:\ttbnht.exec:\ttbnht.exe86⤵PID:2628
-
\??\c:\hbhhnt.exec:\hbhhnt.exe87⤵PID:1268
-
\??\c:\btbhnt.exec:\btbhnt.exe88⤵PID:1212
-
\??\c:\pvvjv.exec:\pvvjv.exe89⤵PID:2188
-
\??\c:\vjvpp.exec:\vjvpp.exe90⤵PID:2508
-
\??\c:\xxlrrxf.exec:\xxlrrxf.exe91⤵PID:2432
-
\??\c:\1xlrffl.exec:\1xlrffl.exe92⤵PID:2492
-
\??\c:\nbbntt.exec:\nbbntt.exe93⤵PID:936
-
\??\c:\ttnbhb.exec:\ttnbhb.exe94⤵PID:2404
-
\??\c:\jdpvp.exec:\jdpvp.exe95⤵PID:2948
-
\??\c:\pjvvd.exec:\pjvvd.exe96⤵PID:2720
-
\??\c:\lxrxxrx.exec:\lxrxxrx.exe97⤵PID:2836
-
\??\c:\lxrrflr.exec:\lxrrflr.exe98⤵PID:2224
-
\??\c:\lxxfflf.exec:\lxxfflf.exe99⤵PID:772
-
\??\c:\5thbhn.exec:\5thbhn.exe100⤵PID:1472
-
\??\c:\nhbbnh.exec:\nhbbnh.exe101⤵PID:1496
-
\??\c:\dpvjj.exec:\dpvjj.exe102⤵PID:628
-
\??\c:\9jdjv.exec:\9jdjv.exe103⤵PID:352
-
\??\c:\vpdvd.exec:\vpdvd.exe104⤵PID:1860
-
\??\c:\1xlrxlr.exec:\1xlrxlr.exe105⤵PID:1756
-
\??\c:\xrlxrxl.exec:\xrlxrxl.exe106⤵PID:968
-
\??\c:\htbtnh.exec:\htbtnh.exe107⤵PID:692
-
\??\c:\bnbhtn.exec:\bnbhtn.exe108⤵PID:2944
-
\??\c:\1vpdv.exec:\1vpdv.exe109⤵PID:2964
-
\??\c:\dvjvj.exec:\dvjvj.exe110⤵PID:2608
-
\??\c:\xrlfffr.exec:\xrlfffr.exe111⤵PID:1008
-
\??\c:\xxlxrlx.exec:\xxlxrlx.exe112⤵PID:2960
-
\??\c:\hhthhn.exec:\hhthhn.exe113⤵PID:2040
-
\??\c:\nnhhth.exec:\nnhhth.exe114⤵PID:2232
-
\??\c:\pjvdj.exec:\pjvdj.exe115⤵PID:1584
-
\??\c:\ddvvj.exec:\ddvvj.exe116⤵PID:2512
-
\??\c:\rfllllr.exec:\rfllllr.exe117⤵PID:2540
-
\??\c:\5rrxllx.exec:\5rrxllx.exe118⤵PID:876
-
\??\c:\hthttb.exec:\hthttb.exe119⤵PID:2580
-
\??\c:\hthhnn.exec:\hthhnn.exe120⤵PID:2560
-
\??\c:\3jvdj.exec:\3jvdj.exe121⤵PID:2360
-
\??\c:\9ppjv.exec:\9ppjv.exe122⤵PID:2928
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-