Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10-05-2024 18:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
43f516efa3adfe881d783fd76c0db8c0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
43f516efa3adfe881d783fd76c0db8c0_NeikiAnalytics.exe
-
Size
970KB
-
MD5
43f516efa3adfe881d783fd76c0db8c0
-
SHA1
d809ed5ef09b00e4c8ce0bee501a3019cc5576e3
-
SHA256
215bb0a1c292ae3d85a2fbbc6910f231d8ed15b8af74585d3680a0fa78f2ffb2
-
SHA512
0af90f7ab3c8dbacd85db32fff7c889149428e852b60677427040057dc203d38d768a634bf659b6c2e9598f14a1236023a2edbccde2519c854ff49009eaac1d3
-
SSDEEP
12288:n3C9yMo+S0L9xRnoq7H9xqYL04iVypNKvzcMwdBS3b3aoqYveXVadBlHD+CURPO5:SgD4bhoqLDqYLagB6Wj1+Cyv
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2820-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/864-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2984-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1604-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/536-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1152-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1964-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2080-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 864 xxllffr.exe 2984 hhnhtt.exe 2668 rrffrrx.exe 2720 3rxfffr.exe 2832 5bntnb.exe 2620 jjddj.exe 2740 lxlrxrr.exe 2592 ththth.exe 2920 pdvvd.exe 1028 rrflrxf.exe 1956 ddvdp.exe 2892 rrrrflx.exe 2444 nbtbhn.exe 1604 jjjjd.exe 2448 7tttnn.exe 2036 jvpvp.exe 536 lfrrxxf.exe 1152 btthtt.exe 2168 hhtttb.exe 1444 djddj.exe 2860 ffrlxxr.exe 2968 bnhhth.exe 1864 ddpdp.exe 2472 7rllrfr.exe 1664 rlffxfx.exe 1236 thbnhb.exe 1872 9htthh.exe 1964 7rllflx.exe 1012 7vddj.exe 2080 1frxlll.exe 2828 ntntbh.exe 1700 3pvvd.exe 2268 jvdvd.exe 1600 7lxflrx.exe 2792 nnttbh.exe 1816 ddddp.exe 1740 nhbhth.exe 2732 vpjjv.exe 2644 frllrxx.exe 2352 nhhntt.exe 2552 5vjjp.exe 2940 ffllrrx.exe 2580 bbbhtb.exe 2576 9dvdp.exe 2904 fxlxrxf.exe 2592 hbbbnt.exe 1912 pdvjj.exe 1936 5rxflrr.exe 2752 9tnttn.exe 2812 djpjp.exe 2200 fxxrrrf.exe 836 tttbnb.exe 2192 jjvpp.exe 1368 9rrlxxf.exe 2452 tnhbhh.exe 772 vpddj.exe 1180 5xlflll.exe 1152 tnhhtb.exe 2168 1vpvv.exe 2304 lfxxrxl.exe 2308 7thhtb.exe 588 jjvpd.exe 3004 xlflllr.exe 1808 5thtbh.exe -
resource yara_rule behavioral1/memory/2820-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/864-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1604-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/536-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1152-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1964-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-299-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2820 wrote to memory of 864 2820 43f516efa3adfe881d783fd76c0db8c0_NeikiAnalytics.exe 28 PID 2820 wrote to memory of 864 2820 43f516efa3adfe881d783fd76c0db8c0_NeikiAnalytics.exe 28 PID 2820 wrote to memory of 864 2820 43f516efa3adfe881d783fd76c0db8c0_NeikiAnalytics.exe 28 PID 2820 wrote to memory of 864 2820 43f516efa3adfe881d783fd76c0db8c0_NeikiAnalytics.exe 28 PID 864 wrote to memory of 2984 864 xxllffr.exe 29 PID 864 wrote to memory of 2984 864 xxllffr.exe 29 PID 864 wrote to memory of 2984 864 xxllffr.exe 29 PID 864 wrote to memory of 2984 864 xxllffr.exe 29 PID 2984 wrote to memory of 2668 2984 hhnhtt.exe 30 PID 2984 wrote to memory of 2668 2984 hhnhtt.exe 30 PID 2984 wrote to memory of 2668 2984 hhnhtt.exe 30 PID 2984 wrote to memory of 2668 2984 hhnhtt.exe 30 PID 2668 wrote to memory of 2720 2668 rrffrrx.exe 31 PID 2668 wrote to memory of 2720 2668 rrffrrx.exe 31 PID 2668 wrote to memory of 2720 2668 rrffrrx.exe 31 PID 2668 wrote to memory of 2720 2668 rrffrrx.exe 31 PID 2720 wrote to memory of 2832 2720 3rxfffr.exe 32 PID 2720 wrote to memory of 2832 2720 3rxfffr.exe 32 PID 2720 wrote to memory of 2832 2720 3rxfffr.exe 32 PID 2720 wrote to memory of 2832 2720 3rxfffr.exe 32 PID 2832 wrote to memory of 2620 2832 5bntnb.exe 33 PID 2832 wrote to memory of 2620 2832 5bntnb.exe 33 PID 2832 wrote to memory of 2620 2832 5bntnb.exe 33 PID 2832 wrote to memory of 2620 2832 5bntnb.exe 33 PID 2620 wrote to memory of 2740 2620 jjddj.exe 34 PID 2620 wrote to memory of 2740 2620 jjddj.exe 34 PID 2620 wrote to memory of 2740 2620 jjddj.exe 34 PID 2620 wrote to memory of 2740 2620 jjddj.exe 34 PID 2740 wrote to memory of 2592 2740 lxlrxrr.exe 35 PID 2740 wrote to memory of 2592 2740 lxlrxrr.exe 35 PID 2740 wrote to memory of 2592 2740 lxlrxrr.exe 35 PID 2740 wrote to memory of 2592 2740 lxlrxrr.exe 35 PID 2592 wrote to memory of 2920 2592 ththth.exe 36 PID 2592 wrote to memory of 2920 2592 ththth.exe 36 PID 2592 wrote to memory of 2920 2592 ththth.exe 36 PID 2592 wrote to memory of 2920 2592 ththth.exe 36 PID 2920 wrote to memory of 1028 2920 pdvvd.exe 37 PID 2920 wrote to memory of 1028 2920 pdvvd.exe 37 PID 2920 wrote to memory of 1028 2920 pdvvd.exe 37 PID 2920 wrote to memory of 1028 2920 pdvvd.exe 37 PID 1028 wrote to memory of 1956 1028 rrflrxf.exe 38 PID 1028 wrote to memory of 1956 1028 rrflrxf.exe 38 PID 1028 wrote to memory of 1956 1028 rrflrxf.exe 38 PID 1028 wrote to memory of 1956 1028 rrflrxf.exe 38 PID 1956 wrote to memory of 2892 1956 ddvdp.exe 39 PID 1956 wrote to memory of 2892 1956 ddvdp.exe 39 PID 1956 wrote to memory of 2892 1956 ddvdp.exe 39 PID 1956 wrote to memory of 2892 1956 ddvdp.exe 39 PID 2892 wrote to memory of 2444 2892 rrrrflx.exe 40 PID 2892 wrote to memory of 2444 2892 rrrrflx.exe 40 PID 2892 wrote to memory of 2444 2892 rrrrflx.exe 40 PID 2892 wrote to memory of 2444 2892 rrrrflx.exe 40 PID 2444 wrote to memory of 1604 2444 nbtbhn.exe 41 PID 2444 wrote to memory of 1604 2444 nbtbhn.exe 41 PID 2444 wrote to memory of 1604 2444 nbtbhn.exe 41 PID 2444 wrote to memory of 1604 2444 nbtbhn.exe 41 PID 1604 wrote to memory of 2448 1604 jjjjd.exe 42 PID 1604 wrote to memory of 2448 1604 jjjjd.exe 42 PID 1604 wrote to memory of 2448 1604 jjjjd.exe 42 PID 1604 wrote to memory of 2448 1604 jjjjd.exe 42 PID 2448 wrote to memory of 2036 2448 7tttnn.exe 43 PID 2448 wrote to memory of 2036 2448 7tttnn.exe 43 PID 2448 wrote to memory of 2036 2448 7tttnn.exe 43 PID 2448 wrote to memory of 2036 2448 7tttnn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\43f516efa3adfe881d783fd76c0db8c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\43f516efa3adfe881d783fd76c0db8c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\xxllffr.exec:\xxllffr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\hhnhtt.exec:\hhnhtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\rrffrrx.exec:\rrffrrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\3rxfffr.exec:\3rxfffr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\5bntnb.exec:\5bntnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\jjddj.exec:\jjddj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\lxlrxrr.exec:\lxlrxrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\ththth.exec:\ththth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\pdvvd.exec:\pdvvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\rrflrxf.exec:\rrflrxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\ddvdp.exec:\ddvdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\rrrrflx.exec:\rrrrflx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\nbtbhn.exec:\nbtbhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\jjjjd.exec:\jjjjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\7tttnn.exec:\7tttnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\jvpvp.exec:\jvpvp.exe17⤵
- Executes dropped EXE
PID:2036 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe18⤵
- Executes dropped EXE
PID:536 -
\??\c:\btthtt.exec:\btthtt.exe19⤵
- Executes dropped EXE
PID:1152 -
\??\c:\hhtttb.exec:\hhtttb.exe20⤵
- Executes dropped EXE
PID:2168 -
\??\c:\djddj.exec:\djddj.exe21⤵
- Executes dropped EXE
PID:1444 -
\??\c:\ffrlxxr.exec:\ffrlxxr.exe22⤵
- Executes dropped EXE
PID:2860 -
\??\c:\bnhhth.exec:\bnhhth.exe23⤵
- Executes dropped EXE
PID:2968 -
\??\c:\ddpdp.exec:\ddpdp.exe24⤵
- Executes dropped EXE
PID:1864 -
\??\c:\7rllrfr.exec:\7rllrfr.exe25⤵
- Executes dropped EXE
PID:2472 -
\??\c:\rlffxfx.exec:\rlffxfx.exe26⤵
- Executes dropped EXE
PID:1664 -
\??\c:\thbnhb.exec:\thbnhb.exe27⤵
- Executes dropped EXE
PID:1236 -
\??\c:\9htthh.exec:\9htthh.exe28⤵
- Executes dropped EXE
PID:1872 -
\??\c:\7rllflx.exec:\7rllflx.exe29⤵
- Executes dropped EXE
PID:1964 -
\??\c:\7vddj.exec:\7vddj.exe30⤵
- Executes dropped EXE
PID:1012 -
\??\c:\1frxlll.exec:\1frxlll.exe31⤵
- Executes dropped EXE
PID:2080 -
\??\c:\ntntbh.exec:\ntntbh.exe32⤵
- Executes dropped EXE
PID:2828 -
\??\c:\3pvvd.exec:\3pvvd.exe33⤵
- Executes dropped EXE
PID:1700 -
\??\c:\jvdvd.exec:\jvdvd.exe34⤵
- Executes dropped EXE
PID:2268 -
\??\c:\7lxflrx.exec:\7lxflrx.exe35⤵
- Executes dropped EXE
PID:1600 -
\??\c:\nnttbh.exec:\nnttbh.exe36⤵
- Executes dropped EXE
PID:2792 -
\??\c:\ddddp.exec:\ddddp.exe37⤵
- Executes dropped EXE
PID:1816 -
\??\c:\nhbhth.exec:\nhbhth.exe38⤵
- Executes dropped EXE
PID:1740 -
\??\c:\vpjjv.exec:\vpjjv.exe39⤵
- Executes dropped EXE
PID:2732 -
\??\c:\frllrxx.exec:\frllrxx.exe40⤵
- Executes dropped EXE
PID:2644 -
\??\c:\nhhntt.exec:\nhhntt.exe41⤵
- Executes dropped EXE
PID:2352 -
\??\c:\5vjjp.exec:\5vjjp.exe42⤵
- Executes dropped EXE
PID:2552 -
\??\c:\ffllrrx.exec:\ffllrrx.exe43⤵
- Executes dropped EXE
PID:2940 -
\??\c:\bbbhtb.exec:\bbbhtb.exe44⤵
- Executes dropped EXE
PID:2580 -
\??\c:\9dvdp.exec:\9dvdp.exe45⤵
- Executes dropped EXE
PID:2576 -
\??\c:\fxlxrxf.exec:\fxlxrxf.exe46⤵
- Executes dropped EXE
PID:2904 -
\??\c:\hbbbnt.exec:\hbbbnt.exe47⤵
- Executes dropped EXE
PID:2592 -
\??\c:\pdvjj.exec:\pdvjj.exe48⤵
- Executes dropped EXE
PID:1912 -
\??\c:\5rxflrr.exec:\5rxflrr.exe49⤵
- Executes dropped EXE
PID:1936 -
\??\c:\9tnttn.exec:\9tnttn.exe50⤵
- Executes dropped EXE
PID:2752 -
\??\c:\djpjp.exec:\djpjp.exe51⤵
- Executes dropped EXE
PID:2812 -
\??\c:\fxxrrrf.exec:\fxxrrrf.exe52⤵
- Executes dropped EXE
PID:2200 -
\??\c:\tttbnb.exec:\tttbnb.exe53⤵
- Executes dropped EXE
PID:836 -
\??\c:\jjvpp.exec:\jjvpp.exe54⤵
- Executes dropped EXE
PID:2192 -
\??\c:\9rrlxxf.exec:\9rrlxxf.exe55⤵
- Executes dropped EXE
PID:1368 -
\??\c:\tnhbhh.exec:\tnhbhh.exe56⤵
- Executes dropped EXE
PID:2452 -
\??\c:\vpddj.exec:\vpddj.exe57⤵
- Executes dropped EXE
PID:772 -
\??\c:\5xlflll.exec:\5xlflll.exe58⤵
- Executes dropped EXE
PID:1180 -
\??\c:\tnhhtb.exec:\tnhhtb.exe59⤵
- Executes dropped EXE
PID:1152 -
\??\c:\1vpvv.exec:\1vpvv.exe60⤵
- Executes dropped EXE
PID:2168 -
\??\c:\lfxxrxl.exec:\lfxxrxl.exe61⤵
- Executes dropped EXE
PID:2304 -
\??\c:\7thhtb.exec:\7thhtb.exe62⤵
- Executes dropped EXE
PID:2308 -
\??\c:\jjvpd.exec:\jjvpd.exe63⤵
- Executes dropped EXE
PID:588 -
\??\c:\xlflllr.exec:\xlflllr.exe64⤵
- Executes dropped EXE
PID:3004 -
\??\c:\5thtbh.exec:\5thtbh.exe65⤵
- Executes dropped EXE
PID:1808 -
\??\c:\jdddj.exec:\jdddj.exe66⤵PID:2372
-
\??\c:\1xrxrrf.exec:\1xrxrrf.exe67⤵PID:1376
-
\??\c:\hbtbnn.exec:\hbtbnn.exe68⤵PID:1984
-
\??\c:\pdvdd.exec:\pdvdd.exe69⤵PID:1988
-
\??\c:\flxffll.exec:\flxffll.exe70⤵PID:2880
-
\??\c:\9dpvd.exec:\9dpvd.exe71⤵PID:2344
-
\??\c:\lxrxlrr.exec:\lxrxlrr.exe72⤵PID:2876
-
\??\c:\hhtthh.exec:\hhtthh.exe73⤵PID:3016
-
\??\c:\dvjvv.exec:\dvjvv.exe74⤵PID:2080
-
\??\c:\nhbbbh.exec:\nhbbbh.exe75⤵PID:1696
-
\??\c:\pvpdd.exec:\pvpdd.exe76⤵PID:2116
-
\??\c:\9rxfllr.exec:\9rxfllr.exe77⤵PID:1588
-
\??\c:\tttbnb.exec:\tttbnb.exe78⤵PID:2260
-
\??\c:\nnnnbh.exec:\nnnnbh.exe79⤵PID:2612
-
\??\c:\jdpvd.exec:\jdpvd.exe80⤵PID:3024
-
\??\c:\7xxfxfl.exec:\7xxfxfl.exe81⤵PID:2204
-
\??\c:\nhbhhb.exec:\nhbhhb.exe82⤵PID:2648
-
\??\c:\ppjpv.exec:\ppjpv.exe83⤵PID:2524
-
\??\c:\fxllrrx.exec:\fxllrrx.exe84⤵PID:2636
-
\??\c:\nhtthn.exec:\nhtthn.exe85⤵PID:2540
-
\??\c:\3jpvj.exec:\3jpvj.exe86⤵PID:2780
-
\??\c:\frlfrrf.exec:\frlfrrf.exe87⤵PID:2548
-
\??\c:\btnthn.exec:\btnthn.exe88⤵PID:2688
-
\??\c:\vvjpp.exec:\vvjpp.exe89⤵PID:2924
-
\??\c:\ffrlrxx.exec:\ffrlrxx.exe90⤵PID:2184
-
\??\c:\tbthtb.exec:\tbthtb.exe91⤵PID:380
-
\??\c:\7jvpp.exec:\7jvpp.exe92⤵PID:1028
-
\??\c:\rlrxffl.exec:\rlrxffl.exe93⤵PID:752
-
\??\c:\htnbnh.exec:\htnbnh.exe94⤵PID:1000
-
\??\c:\vvppv.exec:\vvppv.exe95⤵PID:1996
-
\??\c:\rlrllrf.exec:\rlrllrf.exe96⤵PID:1824
-
\??\c:\hbhnbn.exec:\hbhnbn.exe97⤵PID:1032
-
\??\c:\pdjpj.exec:\pdjpj.exe98⤵PID:1852
-
\??\c:\pdpdp.exec:\pdpdp.exe99⤵PID:2036
-
\??\c:\9btnth.exec:\9btnth.exe100⤵PID:984
-
\??\c:\bthtnh.exec:\bthtnh.exe101⤵PID:992
-
\??\c:\vvvvd.exec:\vvvvd.exe102⤵PID:2480
-
\??\c:\bbttbh.exec:\bbttbh.exe103⤵PID:2844
-
\??\c:\pjvdj.exec:\pjvdj.exe104⤵PID:1444
-
\??\c:\ffllrrx.exec:\ffllrrx.exe105⤵PID:1488
-
\??\c:\nhbhtn.exec:\nhbhtn.exe106⤵PID:2616
-
\??\c:\djddd.exec:\djddd.exe107⤵PID:444
-
\??\c:\lfrxffl.exec:\lfrxffl.exe108⤵PID:1096
-
\??\c:\hthnbb.exec:\hthnbb.exe109⤵PID:1704
-
\??\c:\dvddj.exec:\dvddj.exe110⤵PID:2232
-
\??\c:\rxfrxfl.exec:\rxfrxfl.exe111⤵PID:920
-
\??\c:\thhtbb.exec:\thhtbb.exe112⤵PID:1976
-
\??\c:\ppjpp.exec:\ppjpp.exe113⤵PID:1992
-
\??\c:\lffxlfr.exec:\lffxlfr.exe114⤵PID:2208
-
\??\c:\btbhth.exec:\btbhth.exe115⤵PID:3040
-
\??\c:\htntbb.exec:\htntbb.exe116⤵PID:2824
-
\??\c:\vjjpd.exec:\vjjpd.exe117⤵PID:2084
-
\??\c:\xllrflx.exec:\xllrflx.exe118⤵PID:2828
-
\??\c:\hbntnt.exec:\hbntnt.exe119⤵PID:2096
-
\??\c:\1vjpv.exec:\1vjpv.exe120⤵PID:2132
-
\??\c:\9rxxxfl.exec:\9rxxxfl.exe121⤵PID:2264
-
\??\c:\hnttbh.exec:\hnttbh.exe122⤵PID:864
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-