Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
12-05-2024 13:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
14ba7ca65a45fbb0f9debfdd0e0c8010_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
14ba7ca65a45fbb0f9debfdd0e0c8010_NeikiAnalytics.exe
-
Size
145KB
-
MD5
14ba7ca65a45fbb0f9debfdd0e0c8010
-
SHA1
8c3c03abf076c11372abd0f17f3df5d92dcdcf03
-
SHA256
0a2c1a8883faa63329c8a8efd7920c17c8ce1ea6748e9925cf4209dc1e346c99
-
SHA512
d1f692c3e40db80a2cfcec5d6e6ee40717b5e7963a7d92060e8a9911efa40286031a96eafb8263463ab7897cd57d919b0dc292c88cfa8964e43b24eeca2c91ae
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp9gFbctg0IyAyhZvjDUOy/nmPmT9seU:n3C9BRo7tvnJ9oH0IRgZvjDhy+PmxseU
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2348-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/904-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2400-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1960-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1900-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1440-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2276-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2288-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2248-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/324-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1084-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1884-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2172-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1288-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 904 jdddp.exe 2400 rrlrrxl.exe 2652 5jppd.exe 2608 rrlxlrf.exe 2572 btnhht.exe 2480 pjjdp.exe 2460 ffllfff.exe 2924 fxxlrff.exe 1960 ppjpd.exe 2772 vpdpj.exe 2820 xxrrrrf.exe 1424 nhbtbh.exe 1968 9bbhnn.exe 1900 vvpdd.exe 1956 xfrxxfl.exe 2444 ffxrffr.exe 1440 5nhntb.exe 2276 bhnhth.exe 2072 dpjpv.exe 2288 xxffxfx.exe 2248 htthnh.exe 324 tththt.exe 1084 5djjv.exe 1884 djpvp.exe 2324 rxlrxxr.exe 1340 thttbt.exe 2172 vppvj.exe 572 3xrxrxr.exe 1172 fxrfrxf.exe 1288 nntbnb.exe 2908 jjpvd.exe 1808 rfrrxrx.exe 1256 hhbnbb.exe 1600 bnttbn.exe 2564 5vvjv.exe 2596 jjvdj.exe 2720 rrlrflx.exe 2464 9rlxlrx.exe 2492 htnbtb.exe 2728 bbhntt.exe 2712 dvppj.exe 2476 vpjjd.exe 2460 xrxfrxf.exe 1036 lfxlffr.exe 2768 bnbnnt.exe 1876 bbnbtb.exe 2808 pddjp.exe 1676 rrfrfrl.exe 1856 fxfffxr.exe 2340 hbnhtn.exe 1668 5vjpv.exe 1608 djjpj.exe 2432 fxllrfl.exe 1532 nhbnnt.exe 888 ttnhth.exe 636 jjdpv.exe 2872 7ddvp.exe 3068 5llllrl.exe 1940 nhtntb.exe 1316 tthbhh.exe 392 ppjvj.exe 1484 9flrllx.exe 1824 lxrrrlx.exe 1888 hhtbnn.exe -
resource yara_rule behavioral1/memory/2348-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/904-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1960-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1900-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1440-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2276-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2248-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/324-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1084-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1884-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2172-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1288-291-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2348 wrote to memory of 904 2348 14ba7ca65a45fbb0f9debfdd0e0c8010_NeikiAnalytics.exe 28 PID 2348 wrote to memory of 904 2348 14ba7ca65a45fbb0f9debfdd0e0c8010_NeikiAnalytics.exe 28 PID 2348 wrote to memory of 904 2348 14ba7ca65a45fbb0f9debfdd0e0c8010_NeikiAnalytics.exe 28 PID 2348 wrote to memory of 904 2348 14ba7ca65a45fbb0f9debfdd0e0c8010_NeikiAnalytics.exe 28 PID 904 wrote to memory of 2400 904 jdddp.exe 29 PID 904 wrote to memory of 2400 904 jdddp.exe 29 PID 904 wrote to memory of 2400 904 jdddp.exe 29 PID 904 wrote to memory of 2400 904 jdddp.exe 29 PID 2400 wrote to memory of 2652 2400 rrlrrxl.exe 30 PID 2400 wrote to memory of 2652 2400 rrlrrxl.exe 30 PID 2400 wrote to memory of 2652 2400 rrlrrxl.exe 30 PID 2400 wrote to memory of 2652 2400 rrlrrxl.exe 30 PID 2652 wrote to memory of 2608 2652 5jppd.exe 31 PID 2652 wrote to memory of 2608 2652 5jppd.exe 31 PID 2652 wrote to memory of 2608 2652 5jppd.exe 31 PID 2652 wrote to memory of 2608 2652 5jppd.exe 31 PID 2608 wrote to memory of 2572 2608 rrlxlrf.exe 32 PID 2608 wrote to memory of 2572 2608 rrlxlrf.exe 32 PID 2608 wrote to memory of 2572 2608 rrlxlrf.exe 32 PID 2608 wrote to memory of 2572 2608 rrlxlrf.exe 32 PID 2572 wrote to memory of 2480 2572 btnhht.exe 33 PID 2572 wrote to memory of 2480 2572 btnhht.exe 33 PID 2572 wrote to memory of 2480 2572 btnhht.exe 33 PID 2572 wrote to memory of 2480 2572 btnhht.exe 33 PID 2480 wrote to memory of 2460 2480 pjjdp.exe 34 PID 2480 wrote to memory of 2460 2480 pjjdp.exe 34 PID 2480 wrote to memory of 2460 2480 pjjdp.exe 34 PID 2480 wrote to memory of 2460 2480 pjjdp.exe 34 PID 2460 wrote to memory of 2924 2460 ffllfff.exe 35 PID 2460 wrote to memory of 2924 2460 ffllfff.exe 35 PID 2460 wrote to memory of 2924 2460 ffllfff.exe 35 PID 2460 wrote to memory of 2924 2460 ffllfff.exe 35 PID 2924 wrote to memory of 1960 2924 fxxlrff.exe 36 PID 2924 wrote to memory of 1960 2924 fxxlrff.exe 36 PID 2924 wrote to memory of 1960 2924 fxxlrff.exe 36 PID 2924 wrote to memory of 1960 2924 fxxlrff.exe 36 PID 1960 wrote to memory of 2772 1960 ppjpd.exe 37 PID 1960 wrote to memory of 2772 1960 ppjpd.exe 37 PID 1960 wrote to memory of 2772 1960 ppjpd.exe 37 PID 1960 wrote to memory of 2772 1960 ppjpd.exe 37 PID 2772 wrote to memory of 2820 2772 vpdpj.exe 38 PID 2772 wrote to memory of 2820 2772 vpdpj.exe 38 PID 2772 wrote to memory of 2820 2772 vpdpj.exe 38 PID 2772 wrote to memory of 2820 2772 vpdpj.exe 38 PID 2820 wrote to memory of 1424 2820 xxrrrrf.exe 39 PID 2820 wrote to memory of 1424 2820 xxrrrrf.exe 39 PID 2820 wrote to memory of 1424 2820 xxrrrrf.exe 39 PID 2820 wrote to memory of 1424 2820 xxrrrrf.exe 39 PID 1424 wrote to memory of 1968 1424 nhbtbh.exe 40 PID 1424 wrote to memory of 1968 1424 nhbtbh.exe 40 PID 1424 wrote to memory of 1968 1424 nhbtbh.exe 40 PID 1424 wrote to memory of 1968 1424 nhbtbh.exe 40 PID 1968 wrote to memory of 1900 1968 9bbhnn.exe 41 PID 1968 wrote to memory of 1900 1968 9bbhnn.exe 41 PID 1968 wrote to memory of 1900 1968 9bbhnn.exe 41 PID 1968 wrote to memory of 1900 1968 9bbhnn.exe 41 PID 1900 wrote to memory of 1956 1900 vvpdd.exe 42 PID 1900 wrote to memory of 1956 1900 vvpdd.exe 42 PID 1900 wrote to memory of 1956 1900 vvpdd.exe 42 PID 1900 wrote to memory of 1956 1900 vvpdd.exe 42 PID 1956 wrote to memory of 2444 1956 xfrxxfl.exe 43 PID 1956 wrote to memory of 2444 1956 xfrxxfl.exe 43 PID 1956 wrote to memory of 2444 1956 xfrxxfl.exe 43 PID 1956 wrote to memory of 2444 1956 xfrxxfl.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\14ba7ca65a45fbb0f9debfdd0e0c8010_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\14ba7ca65a45fbb0f9debfdd0e0c8010_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\jdddp.exec:\jdddp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
\??\c:\rrlrrxl.exec:\rrlrrxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\5jppd.exec:\5jppd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\rrlxlrf.exec:\rrlxlrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\btnhht.exec:\btnhht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\pjjdp.exec:\pjjdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\ffllfff.exec:\ffllfff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\fxxlrff.exec:\fxxlrff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\ppjpd.exec:\ppjpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\vpdpj.exec:\vpdpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\xxrrrrf.exec:\xxrrrrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\nhbtbh.exec:\nhbtbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\9bbhnn.exec:\9bbhnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\vvpdd.exec:\vvpdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\xfrxxfl.exec:\xfrxxfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\ffxrffr.exec:\ffxrffr.exe17⤵
- Executes dropped EXE
PID:2444 -
\??\c:\5nhntb.exec:\5nhntb.exe18⤵
- Executes dropped EXE
PID:1440 -
\??\c:\bhnhth.exec:\bhnhth.exe19⤵
- Executes dropped EXE
PID:2276 -
\??\c:\dpjpv.exec:\dpjpv.exe20⤵
- Executes dropped EXE
PID:2072 -
\??\c:\xxffxfx.exec:\xxffxfx.exe21⤵
- Executes dropped EXE
PID:2288 -
\??\c:\htthnh.exec:\htthnh.exe22⤵
- Executes dropped EXE
PID:2248 -
\??\c:\tththt.exec:\tththt.exe23⤵
- Executes dropped EXE
PID:324 -
\??\c:\5djjv.exec:\5djjv.exe24⤵
- Executes dropped EXE
PID:1084 -
\??\c:\djpvp.exec:\djpvp.exe25⤵
- Executes dropped EXE
PID:1884 -
\??\c:\rxlrxxr.exec:\rxlrxxr.exe26⤵
- Executes dropped EXE
PID:2324 -
\??\c:\thttbt.exec:\thttbt.exe27⤵
- Executes dropped EXE
PID:1340 -
\??\c:\vppvj.exec:\vppvj.exe28⤵
- Executes dropped EXE
PID:2172 -
\??\c:\3xrxrxr.exec:\3xrxrxr.exe29⤵
- Executes dropped EXE
PID:572 -
\??\c:\fxrfrxf.exec:\fxrfrxf.exe30⤵
- Executes dropped EXE
PID:1172 -
\??\c:\nntbnb.exec:\nntbnb.exe31⤵
- Executes dropped EXE
PID:1288 -
\??\c:\jjpvd.exec:\jjpvd.exe32⤵
- Executes dropped EXE
PID:2908 -
\??\c:\rfrrxrx.exec:\rfrrxrx.exe33⤵
- Executes dropped EXE
PID:1808 -
\??\c:\hhbnbb.exec:\hhbnbb.exe34⤵
- Executes dropped EXE
PID:1256 -
\??\c:\bnttbn.exec:\bnttbn.exe35⤵
- Executes dropped EXE
PID:1600 -
\??\c:\5vvjv.exec:\5vvjv.exe36⤵
- Executes dropped EXE
PID:2564 -
\??\c:\jjvdj.exec:\jjvdj.exe37⤵
- Executes dropped EXE
PID:2596 -
\??\c:\rrlrflx.exec:\rrlrflx.exe38⤵
- Executes dropped EXE
PID:2720 -
\??\c:\9rlxlrx.exec:\9rlxlrx.exe39⤵
- Executes dropped EXE
PID:2464 -
\??\c:\htnbtb.exec:\htnbtb.exe40⤵
- Executes dropped EXE
PID:2492 -
\??\c:\bbhntt.exec:\bbhntt.exe41⤵
- Executes dropped EXE
PID:2728 -
\??\c:\dvppj.exec:\dvppj.exe42⤵
- Executes dropped EXE
PID:2712 -
\??\c:\vpjjd.exec:\vpjjd.exe43⤵
- Executes dropped EXE
PID:2476 -
\??\c:\xrxfrxf.exec:\xrxfrxf.exe44⤵
- Executes dropped EXE
PID:2460 -
\??\c:\lfxlffr.exec:\lfxlffr.exe45⤵
- Executes dropped EXE
PID:1036 -
\??\c:\bnbnnt.exec:\bnbnnt.exe46⤵
- Executes dropped EXE
PID:2768 -
\??\c:\bbnbtb.exec:\bbnbtb.exe47⤵
- Executes dropped EXE
PID:1876 -
\??\c:\pddjp.exec:\pddjp.exe48⤵
- Executes dropped EXE
PID:2808 -
\??\c:\rrfrfrl.exec:\rrfrfrl.exe49⤵
- Executes dropped EXE
PID:1676 -
\??\c:\fxfffxr.exec:\fxfffxr.exe50⤵
- Executes dropped EXE
PID:1856 -
\??\c:\hbnhtn.exec:\hbnhtn.exe51⤵
- Executes dropped EXE
PID:2340 -
\??\c:\5vjpv.exec:\5vjpv.exe52⤵
- Executes dropped EXE
PID:1668 -
\??\c:\djjpj.exec:\djjpj.exe53⤵
- Executes dropped EXE
PID:1608 -
\??\c:\fxllrfl.exec:\fxllrfl.exe54⤵
- Executes dropped EXE
PID:2432 -
\??\c:\nhbnnt.exec:\nhbnnt.exe55⤵
- Executes dropped EXE
PID:1532 -
\??\c:\ttnhth.exec:\ttnhth.exe56⤵
- Executes dropped EXE
PID:888 -
\??\c:\jjdpv.exec:\jjdpv.exe57⤵
- Executes dropped EXE
PID:636 -
\??\c:\7ddvp.exec:\7ddvp.exe58⤵
- Executes dropped EXE
PID:2872 -
\??\c:\5llllrl.exec:\5llllrl.exe59⤵
- Executes dropped EXE
PID:3068 -
\??\c:\nhtntb.exec:\nhtntb.exe60⤵
- Executes dropped EXE
PID:1940 -
\??\c:\tthbhh.exec:\tthbhh.exe61⤵
- Executes dropped EXE
PID:1316 -
\??\c:\ppjvj.exec:\ppjvj.exe62⤵
- Executes dropped EXE
PID:392 -
\??\c:\9flrllx.exec:\9flrllx.exe63⤵
- Executes dropped EXE
PID:1484 -
\??\c:\lxrrrlx.exec:\lxrrrlx.exe64⤵
- Executes dropped EXE
PID:1824 -
\??\c:\hhtbnn.exec:\hhtbnn.exe65⤵
- Executes dropped EXE
PID:1888 -
\??\c:\vppjj.exec:\vppjj.exe66⤵PID:1540
-
\??\c:\xflrllf.exec:\xflrllf.exe67⤵PID:1048
-
\??\c:\hbbbtt.exec:\hbbbtt.exe68⤵PID:1324
-
\??\c:\nbhhnn.exec:\nbhhnn.exe69⤵PID:1840
-
\??\c:\jjjpp.exec:\jjjpp.exe70⤵PID:1764
-
\??\c:\ffxrfxr.exec:\ffxrfxr.exe71⤵PID:2840
-
\??\c:\7hnnnn.exec:\7hnnnn.exe72⤵PID:2264
-
\??\c:\9htthb.exec:\9htthb.exe73⤵PID:3064
-
\??\c:\1ppvp.exec:\1ppvp.exe74⤵PID:884
-
\??\c:\lllrlfl.exec:\lllrlfl.exe75⤵PID:1592
-
\??\c:\hbtntb.exec:\hbtntb.exe76⤵PID:2104
-
\??\c:\5bhnbh.exec:\5bhnbh.exe77⤵PID:2184
-
\??\c:\vppjv.exec:\vppjv.exe78⤵PID:2560
-
\??\c:\pdddp.exec:\pdddp.exe79⤵PID:2680
-
\??\c:\rxfxrxf.exec:\rxfxrxf.exe80⤵PID:2848
-
\??\c:\hbhtbt.exec:\hbhtbt.exe81⤵PID:2752
-
\??\c:\7dpvd.exec:\7dpvd.exe82⤵PID:2792
-
\??\c:\rrllxxx.exec:\rrllxxx.exe83⤵PID:2484
-
\??\c:\5fxllxr.exec:\5fxllxr.exe84⤵PID:2480
-
\??\c:\1tntbn.exec:\1tntbn.exe85⤵PID:1804
-
\??\c:\dpppp.exec:\dpppp.exe86⤵PID:2576
-
\??\c:\pjvjv.exec:\pjvjv.exe87⤵PID:2472
-
\??\c:\rlllfrf.exec:\rlllfrf.exe88⤵PID:2788
-
\??\c:\ttnhtt.exec:\ttnhtt.exe89⤵PID:2916
-
\??\c:\1tnbtn.exec:\1tnbtn.exe90⤵PID:556
-
\??\c:\dvdvp.exec:\dvdvp.exe91⤵PID:3040
-
\??\c:\fxxrlxr.exec:\fxxrlxr.exe92⤵PID:500
-
\??\c:\7btbnt.exec:\7btbnt.exe93⤵PID:1968
-
\??\c:\bhbhtt.exec:\bhbhtt.exe94⤵PID:812
-
\??\c:\dvjpd.exec:\dvjpd.exe95⤵PID:2508
-
\??\c:\llxflrx.exec:\llxflrx.exe96⤵PID:1680
-
\??\c:\nhnbnt.exec:\nhnbnt.exe97⤵PID:1892
-
\??\c:\hhhtnb.exec:\hhhtnb.exe98⤵PID:2304
-
\??\c:\vvvjv.exec:\vvvjv.exe99⤵PID:864
-
\??\c:\xxffxrf.exec:\xxffxrf.exe100⤵PID:2060
-
\??\c:\tnhhtb.exec:\tnhhtb.exe101⤵PID:2684
-
\??\c:\bhhbnb.exec:\bhhbnb.exe102⤵PID:2860
-
\??\c:\3vjjp.exec:\3vjjp.exe103⤵PID:1352
-
\??\c:\lxxfxff.exec:\lxxfxff.exe104⤵PID:2992
-
\??\c:\tnbhnn.exec:\tnbhnn.exe105⤵PID:1084
-
\??\c:\hhhtbh.exec:\hhhtbh.exe106⤵PID:1636
-
\??\c:\vpjdv.exec:\vpjdv.exe107⤵PID:2036
-
\??\c:\9xxrxfl.exec:\9xxrxfl.exe108⤵PID:1056
-
\??\c:\llxfxrx.exec:\llxfxrx.exe109⤵PID:1360
-
\??\c:\bhbnbt.exec:\bhbnbt.exe110⤵PID:3020
-
\??\c:\hntnhn.exec:\hntnhn.exe111⤵PID:880
-
\??\c:\xrxxrxl.exec:\xrxxrxl.exe112⤵PID:848
-
\??\c:\3jpdp.exec:\3jpdp.exe113⤵PID:2884
-
\??\c:\3pdjp.exec:\3pdjp.exe114⤵PID:1728
-
\??\c:\lrrlflr.exec:\lrrlflr.exe115⤵PID:2012
-
\??\c:\5rfflrx.exec:\5rfflrx.exe116⤵PID:2192
-
\??\c:\7hntnt.exec:\7hntnt.exe117⤵PID:1604
-
\??\c:\pvjdd.exec:\pvjdd.exe118⤵PID:2096
-
\??\c:\vjvdj.exec:\vjvdj.exe119⤵PID:2984
-
\??\c:\rlrxxxf.exec:\rlrxxxf.exe120⤵PID:2548
-
\??\c:\rrlfxfx.exec:\rrlfxfx.exe121⤵PID:2696
-
\??\c:\7ffflrf.exec:\7ffflrf.exe122⤵PID:2616
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-