Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
11-05-2024 00:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
438c2c204bd3f478410246581267f670_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
438c2c204bd3f478410246581267f670_NeikiAnalytics.exe
-
Size
392KB
-
MD5
438c2c204bd3f478410246581267f670
-
SHA1
e2b3127f3943ce753ca784376a528a7b254e2ae7
-
SHA256
2f3d907b14c46a0531a6f82dd56768aeb78fc86e8960a451981be95d0d9b7c82
-
SHA512
75eefc596cbd27a84e5e376d37fdaf40e6c21d69cb2bf838260327f9ed117e5d367e4086d3d5da61a391745b88ae61e80ac9289315cd058aa1d6c3126ffd2a44
-
SSDEEP
6144:n3C9BRIG0asYFm71mPfkVB8dKwaO5CVwOV:n3C9uYA7okVqdKwaO5CV3
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2384-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1420-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3056-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2144-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1264-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1604-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2000-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2400-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/308-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1572-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1944-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2248-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2240-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1420 bthhtb.exe 3056 vppdp.exe 2684 rlflflx.exe 2144 bbtbnt.exe 2856 tbbtnb.exe 2520 lrlfxlf.exe 2528 3hbttb.exe 2240 nnhhhn.exe 2764 9pvvv.exe 2848 jvdvj.exe 2948 nhbthn.exe 812 pjvdp.exe 1264 9llrxfr.exe 1604 xfrllrr.exe 1568 hthhnt.exe 352 vvpvv.exe 2248 xrlfrfx.exe 2040 bthhtt.exe 1944 jdppv.exe 3028 fffrxfl.exe 2000 htttnt.exe 696 pjdjv.exe 576 xxlxflx.exe 1892 9vvpj.exe 648 dppjj.exe 1572 xfxlrrf.exe 308 9ppdp.exe 1328 5dddp.exe 1416 lrlxxxr.exe 2400 tnhbnn.exe 1756 1vpvj.exe 2316 9llrffr.exe 1876 bntnbn.exe 2036 tnnbth.exe 2224 dddjv.exe 2888 1fxxlrx.exe 2684 rrrflrf.exe 2492 nhhthn.exe 2664 jvdpp.exe 2796 jdvdv.exe 2968 tbntth.exe 2536 dpjdp.exe 2792 dvppp.exe 2812 frrlxll.exe 2964 xfrlxxx.exe 1464 hhbnhn.exe 2956 tnbhtb.exe 1680 ddpdv.exe 2356 rrrxlrf.exe 2744 rrlfrff.exe 1768 7btbbb.exe 2476 pjvvd.exe 1972 fllxlrl.exe 2248 hbthbh.exe 1616 dvppd.exe 2804 ttnhtb.exe 2352 nnhntb.exe 592 vpppj.exe 2000 lfxfrxf.exe 696 xxlrxxf.exe 2692 3tntht.exe 1344 ddppv.exe 624 vvddj.exe 1728 xllrffr.exe -
resource yara_rule behavioral1/memory/2384-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1420-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2144-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1264-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1604-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2000-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/308-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1572-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1944-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2248-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-36-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2384 wrote to memory of 1420 2384 438c2c204bd3f478410246581267f670_NeikiAnalytics.exe 28 PID 2384 wrote to memory of 1420 2384 438c2c204bd3f478410246581267f670_NeikiAnalytics.exe 28 PID 2384 wrote to memory of 1420 2384 438c2c204bd3f478410246581267f670_NeikiAnalytics.exe 28 PID 2384 wrote to memory of 1420 2384 438c2c204bd3f478410246581267f670_NeikiAnalytics.exe 28 PID 1420 wrote to memory of 3056 1420 bthhtb.exe 29 PID 1420 wrote to memory of 3056 1420 bthhtb.exe 29 PID 1420 wrote to memory of 3056 1420 bthhtb.exe 29 PID 1420 wrote to memory of 3056 1420 bthhtb.exe 29 PID 3056 wrote to memory of 2684 3056 vppdp.exe 105 PID 3056 wrote to memory of 2684 3056 vppdp.exe 105 PID 3056 wrote to memory of 2684 3056 vppdp.exe 105 PID 3056 wrote to memory of 2684 3056 vppdp.exe 105 PID 2684 wrote to memory of 2144 2684 rlflflx.exe 31 PID 2684 wrote to memory of 2144 2684 rlflflx.exe 31 PID 2684 wrote to memory of 2144 2684 rlflflx.exe 31 PID 2684 wrote to memory of 2144 2684 rlflflx.exe 31 PID 2144 wrote to memory of 2856 2144 bbtbnt.exe 32 PID 2144 wrote to memory of 2856 2144 bbtbnt.exe 32 PID 2144 wrote to memory of 2856 2144 bbtbnt.exe 32 PID 2144 wrote to memory of 2856 2144 bbtbnt.exe 32 PID 2856 wrote to memory of 2520 2856 tbbtnb.exe 33 PID 2856 wrote to memory of 2520 2856 tbbtnb.exe 33 PID 2856 wrote to memory of 2520 2856 tbbtnb.exe 33 PID 2856 wrote to memory of 2520 2856 tbbtnb.exe 33 PID 2520 wrote to memory of 2528 2520 lrlfxlf.exe 34 PID 2520 wrote to memory of 2528 2520 lrlfxlf.exe 34 PID 2520 wrote to memory of 2528 2520 lrlfxlf.exe 34 PID 2520 wrote to memory of 2528 2520 lrlfxlf.exe 34 PID 2528 wrote to memory of 2240 2528 3hbttb.exe 35 PID 2528 wrote to memory of 2240 2528 3hbttb.exe 35 PID 2528 wrote to memory of 2240 2528 3hbttb.exe 35 PID 2528 wrote to memory of 2240 2528 3hbttb.exe 35 PID 2240 wrote to memory of 2764 2240 nnhhhn.exe 36 PID 2240 wrote to memory of 2764 2240 nnhhhn.exe 36 PID 2240 wrote to memory of 2764 2240 nnhhhn.exe 36 PID 2240 wrote to memory of 2764 2240 nnhhhn.exe 36 PID 2764 wrote to memory of 2848 2764 9pvvv.exe 37 PID 2764 wrote to memory of 2848 2764 9pvvv.exe 37 PID 2764 wrote to memory of 2848 2764 9pvvv.exe 37 PID 2764 wrote to memory of 2848 2764 9pvvv.exe 37 PID 2848 wrote to memory of 2948 2848 jvdvj.exe 38 PID 2848 wrote to memory of 2948 2848 jvdvj.exe 38 PID 2848 wrote to memory of 2948 2848 jvdvj.exe 38 PID 2848 wrote to memory of 2948 2848 jvdvj.exe 38 PID 2948 wrote to memory of 812 2948 nhbthn.exe 39 PID 2948 wrote to memory of 812 2948 nhbthn.exe 39 PID 2948 wrote to memory of 812 2948 nhbthn.exe 39 PID 2948 wrote to memory of 812 2948 nhbthn.exe 39 PID 812 wrote to memory of 1264 812 pjvdp.exe 40 PID 812 wrote to memory of 1264 812 pjvdp.exe 40 PID 812 wrote to memory of 1264 812 pjvdp.exe 40 PID 812 wrote to memory of 1264 812 pjvdp.exe 40 PID 1264 wrote to memory of 1604 1264 9llrxfr.exe 41 PID 1264 wrote to memory of 1604 1264 9llrxfr.exe 41 PID 1264 wrote to memory of 1604 1264 9llrxfr.exe 41 PID 1264 wrote to memory of 1604 1264 9llrxfr.exe 41 PID 1604 wrote to memory of 1568 1604 xfrllrr.exe 42 PID 1604 wrote to memory of 1568 1604 xfrllrr.exe 42 PID 1604 wrote to memory of 1568 1604 xfrllrr.exe 42 PID 1604 wrote to memory of 1568 1604 xfrllrr.exe 42 PID 1568 wrote to memory of 352 1568 hthhnt.exe 43 PID 1568 wrote to memory of 352 1568 hthhnt.exe 43 PID 1568 wrote to memory of 352 1568 hthhnt.exe 43 PID 1568 wrote to memory of 352 1568 hthhnt.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\438c2c204bd3f478410246581267f670_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\438c2c204bd3f478410246581267f670_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\bthhtb.exec:\bthhtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\vppdp.exec:\vppdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\rlflflx.exec:\rlflflx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\bbtbnt.exec:\bbtbnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\tbbtnb.exec:\tbbtnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\lrlfxlf.exec:\lrlfxlf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\3hbttb.exec:\3hbttb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\nnhhhn.exec:\nnhhhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\9pvvv.exec:\9pvvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\jvdvj.exec:\jvdvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\nhbthn.exec:\nhbthn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\pjvdp.exec:\pjvdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\9llrxfr.exec:\9llrxfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\xfrllrr.exec:\xfrllrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\hthhnt.exec:\hthhnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\vvpvv.exec:\vvpvv.exe17⤵
- Executes dropped EXE
PID:352 -
\??\c:\xrlfrfx.exec:\xrlfrfx.exe18⤵
- Executes dropped EXE
PID:2248 -
\??\c:\bthhtt.exec:\bthhtt.exe19⤵
- Executes dropped EXE
PID:2040 -
\??\c:\jdppv.exec:\jdppv.exe20⤵
- Executes dropped EXE
PID:1944 -
\??\c:\fffrxfl.exec:\fffrxfl.exe21⤵
- Executes dropped EXE
PID:3028 -
\??\c:\htttnt.exec:\htttnt.exe22⤵
- Executes dropped EXE
PID:2000 -
\??\c:\pjdjv.exec:\pjdjv.exe23⤵
- Executes dropped EXE
PID:696 -
\??\c:\xxlxflx.exec:\xxlxflx.exe24⤵
- Executes dropped EXE
PID:576 -
\??\c:\9vvpj.exec:\9vvpj.exe25⤵
- Executes dropped EXE
PID:1892 -
\??\c:\dppjj.exec:\dppjj.exe26⤵
- Executes dropped EXE
PID:648 -
\??\c:\xfxlrrf.exec:\xfxlrrf.exe27⤵
- Executes dropped EXE
PID:1572 -
\??\c:\9ppdp.exec:\9ppdp.exe28⤵
- Executes dropped EXE
PID:308 -
\??\c:\5dddp.exec:\5dddp.exe29⤵
- Executes dropped EXE
PID:1328 -
\??\c:\lrlxxxr.exec:\lrlxxxr.exe30⤵
- Executes dropped EXE
PID:1416 -
\??\c:\tnhbnn.exec:\tnhbnn.exe31⤵
- Executes dropped EXE
PID:2400 -
\??\c:\1vpvj.exec:\1vpvj.exe32⤵
- Executes dropped EXE
PID:1756 -
\??\c:\9llrffr.exec:\9llrffr.exe33⤵
- Executes dropped EXE
PID:2316 -
\??\c:\bntnbn.exec:\bntnbn.exe34⤵
- Executes dropped EXE
PID:1876 -
\??\c:\tnnbth.exec:\tnnbth.exe35⤵
- Executes dropped EXE
PID:2036 -
\??\c:\dddjv.exec:\dddjv.exe36⤵
- Executes dropped EXE
PID:2224 -
\??\c:\1fxxlrx.exec:\1fxxlrx.exe37⤵
- Executes dropped EXE
PID:2888 -
\??\c:\rrrflrf.exec:\rrrflrf.exe38⤵
- Executes dropped EXE
PID:2684 -
\??\c:\nhhthn.exec:\nhhthn.exe39⤵
- Executes dropped EXE
PID:2492 -
\??\c:\jvdpp.exec:\jvdpp.exe40⤵
- Executes dropped EXE
PID:2664 -
\??\c:\jdvdv.exec:\jdvdv.exe41⤵
- Executes dropped EXE
PID:2796 -
\??\c:\tbntth.exec:\tbntth.exe42⤵
- Executes dropped EXE
PID:2968 -
\??\c:\dpjdp.exec:\dpjdp.exe43⤵
- Executes dropped EXE
PID:2536 -
\??\c:\dvppp.exec:\dvppp.exe44⤵
- Executes dropped EXE
PID:2792 -
\??\c:\frrlxll.exec:\frrlxll.exe45⤵
- Executes dropped EXE
PID:2812 -
\??\c:\xfrlxxx.exec:\xfrlxxx.exe46⤵
- Executes dropped EXE
PID:2964 -
\??\c:\hhbnhn.exec:\hhbnhn.exe47⤵
- Executes dropped EXE
PID:1464 -
\??\c:\tnbhtb.exec:\tnbhtb.exe48⤵
- Executes dropped EXE
PID:2956 -
\??\c:\ddpdv.exec:\ddpdv.exe49⤵
- Executes dropped EXE
PID:1680 -
\??\c:\rrrxlrf.exec:\rrrxlrf.exe50⤵
- Executes dropped EXE
PID:2356 -
\??\c:\rrlfrff.exec:\rrlfrff.exe51⤵
- Executes dropped EXE
PID:2744 -
\??\c:\7btbbb.exec:\7btbbb.exe52⤵
- Executes dropped EXE
PID:1768 -
\??\c:\pjvvd.exec:\pjvvd.exe53⤵
- Executes dropped EXE
PID:2476 -
\??\c:\fllxlrl.exec:\fllxlrl.exe54⤵
- Executes dropped EXE
PID:1972 -
\??\c:\hbthbh.exec:\hbthbh.exe55⤵
- Executes dropped EXE
PID:2248 -
\??\c:\dvppd.exec:\dvppd.exe56⤵
- Executes dropped EXE
PID:1616 -
\??\c:\ttnhtb.exec:\ttnhtb.exe57⤵
- Executes dropped EXE
PID:2804 -
\??\c:\nnhntb.exec:\nnhntb.exe58⤵
- Executes dropped EXE
PID:2352 -
\??\c:\vpppj.exec:\vpppj.exe59⤵
- Executes dropped EXE
PID:592 -
\??\c:\lfxfrxf.exec:\lfxfrxf.exe60⤵
- Executes dropped EXE
PID:2000 -
\??\c:\xxlrxxf.exec:\xxlrxxf.exe61⤵
- Executes dropped EXE
PID:696 -
\??\c:\3tntht.exec:\3tntht.exe62⤵
- Executes dropped EXE
PID:2692 -
\??\c:\ddppv.exec:\ddppv.exe63⤵
- Executes dropped EXE
PID:1344 -
\??\c:\vvddj.exec:\vvddj.exe64⤵
- Executes dropped EXE
PID:624 -
\??\c:\xllrffr.exec:\xllrffr.exe65⤵
- Executes dropped EXE
PID:1728 -
\??\c:\tnbbnn.exec:\tnbbnn.exe66⤵PID:1164
-
\??\c:\djvdv.exec:\djvdv.exe67⤵PID:568
-
\??\c:\frxxrlr.exec:\frxxrlr.exe68⤵PID:1716
-
\??\c:\lfxxflr.exec:\lfxxflr.exe69⤵PID:528
-
\??\c:\5hhhnn.exec:\5hhhnn.exe70⤵PID:2300
-
\??\c:\jjdpj.exec:\jjdpj.exe71⤵PID:2400
-
\??\c:\pjdpd.exec:\pjdpd.exe72⤵PID:1624
-
\??\c:\rxllrfx.exec:\rxllrfx.exe73⤵PID:1408
-
\??\c:\tnhnhn.exec:\tnhnhn.exe74⤵PID:1636
-
\??\c:\bhhbtn.exec:\bhhbtn.exe75⤵PID:3068
-
\??\c:\ddjvv.exec:\ddjvv.exe76⤵PID:2676
-
\??\c:\lrrflrf.exec:\lrrflrf.exe77⤵PID:2656
-
\??\c:\tnnthn.exec:\tnnthn.exe78⤵PID:2708
-
\??\c:\tntbtb.exec:\tntbtb.exe79⤵PID:2684
-
\??\c:\jjvdv.exec:\jjvdv.exe80⤵PID:2492
-
\??\c:\rxfxrfr.exec:\rxfxrfr.exe81⤵PID:1692
-
\??\c:\3tnnbh.exec:\3tnnbh.exe82⤵PID:2540
-
\??\c:\ddvpp.exec:\ddvpp.exe83⤵PID:2232
-
\??\c:\7rfxrlr.exec:\7rfxrlr.exe84⤵PID:2968
-
\??\c:\vdvvj.exec:\vdvvj.exe85⤵PID:2240
-
\??\c:\vdpjj.exec:\vdpjj.exe86⤵PID:2764
-
\??\c:\tttbth.exec:\tttbth.exe87⤵PID:320
-
\??\c:\pjdvj.exec:\pjdvj.exe88⤵PID:2532
-
\??\c:\fxrrffr.exec:\fxrrffr.exe89⤵PID:1828
-
\??\c:\tnbbhn.exec:\tnbbhn.exe90⤵PID:2364
-
\??\c:\pvvpp.exec:\pvvpp.exe91⤵PID:2348
-
\??\c:\xrlfrrf.exec:\xrlfrrf.exe92⤵PID:2852
-
\??\c:\nhnhnb.exec:\nhnhnb.exe93⤵PID:2552
-
\??\c:\rxflfrl.exec:\rxflfrl.exe94⤵PID:772
-
\??\c:\thbbtb.exec:\thbbtb.exe95⤵PID:872
-
\??\c:\djvjd.exec:\djvjd.exe96⤵PID:2128
-
\??\c:\fllrflf.exec:\fllrflf.exe97⤵PID:2564
-
\??\c:\5hbhnt.exec:\5hbhnt.exe98⤵PID:2444
-
\??\c:\dpjpj.exec:\dpjpj.exe99⤵PID:2236
-
\??\c:\xfrlrxl.exec:\xfrlrxl.exe100⤵PID:536
-
\??\c:\ffxfrxl.exec:\ffxfrxl.exe101⤵PID:1172
-
\??\c:\dpjpj.exec:\dpjpj.exe102⤵PID:916
-
\??\c:\jpjjj.exec:\jpjjj.exe103⤵PID:2808
-
\??\c:\xflllrl.exec:\xflllrl.exe104⤵PID:600
-
\??\c:\5htbhh.exec:\5htbhh.exe105⤵PID:1508
-
\??\c:\dvpjp.exec:\dvpjp.exe106⤵PID:844
-
\??\c:\flfxrll.exec:\flfxrll.exe107⤵PID:1068
-
\??\c:\rxxfxrx.exec:\rxxfxrx.exe108⤵PID:1572
-
\??\c:\btnbnt.exec:\btnbnt.exe109⤵PID:2424
-
\??\c:\ppdjv.exec:\ppdjv.exe110⤵PID:924
-
\??\c:\vvvdj.exec:\vvvdj.exe111⤵PID:2192
-
\??\c:\7hhbnb.exec:\7hhbnb.exe112⤵PID:684
-
\??\c:\pvdpd.exec:\pvdpd.exe113⤵PID:348
-
\??\c:\lxxxfxr.exec:\lxxxfxr.exe114⤵PID:1620
-
\??\c:\rxrxlll.exec:\rxrxlll.exe115⤵PID:1160
-
\??\c:\hnnbnn.exec:\hnnbnn.exe116⤵PID:2060
-
\??\c:\ddpjj.exec:\ddpjj.exe117⤵PID:2724
-
\??\c:\ffxlxfr.exec:\ffxlxfr.exe118⤵PID:2588
-
\??\c:\hhhtbh.exec:\hhhtbh.exe119⤵PID:3036
-
\??\c:\jjpdv.exec:\jjpdv.exe120⤵PID:2656
-
\??\c:\xlrlffl.exec:\xlrlffl.exe121⤵PID:2488
-
\??\c:\1bhhtn.exec:\1bhhtn.exe122⤵PID:2468
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-