Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 20:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
322a1c0c1f4ce2e0a88f6e1fb7c673d0_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
322a1c0c1f4ce2e0a88f6e1fb7c673d0_NeikiAnalytics.exe
-
Size
480KB
-
MD5
322a1c0c1f4ce2e0a88f6e1fb7c673d0
-
SHA1
bd21b297b46cce6e571198a618fd6b8b4396dc27
-
SHA256
5506e4b8bbedb26fd9432c665a7f573467b962e460fe3bfa31d1e7d246cb75db
-
SHA512
349c53a49c00482edd24ff3dfb413bc4d4cca6fa022beed207de8321ff798066997b0ed0a9f0a36e9552b8adab98ef469fe0bf793498c24f5ecdb4f454c6c879
-
SSDEEP
12288:n3C9uDVw6326pKZ9asZqoZHz+evcn0Meh2Fez3:Su326p0aroZt0s3
Malware Config
Signatures
-
Detect Blackmoon payload 18 IoCs
resource yara_rule behavioral1/memory/1680-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2216-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2404-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1048-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1588-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1596-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1280-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2012-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/268-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1896-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1824-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2276-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2688 fxflxfl.exe 2540 jdjpj.exe 2216 9htbhb.exe 2680 pjdvp.exe 2552 3thhtb.exe 2404 7dvpj.exe 2580 ffxfxfx.exe 1572 bnhtht.exe 1048 1lffllf.exe 2644 nbbnnb.exe 1776 vvvjv.exe 1588 5xlrrxf.exe 1596 nnhntn.exe 308 dppjv.exe 2448 tntnhn.exe 2320 jjvjp.exe 1280 lfflxfr.exe 2012 7nbbbh.exe 1932 9vvdj.exe 2368 bnhtbh.exe 268 7vvpj.exe 564 xrlrllf.exe 980 ppdjv.exe 1896 xrrrlxl.exe 2924 9nhhtt.exe 1824 vjdjv.exe 868 jdvpj.exe 1656 dvjpd.exe 1952 1tntbh.exe 2996 ppjpp.exe 2276 ttntnb.exe 1500 vvvdj.exe 1520 llflxlf.exe 2504 nnnthn.exe 2848 ddvvd.exe 2904 lxrxllf.exe 2516 rlffxxl.exe 2932 tnhbtt.exe 2436 ddvvj.exe 2628 lfrrffl.exe 2408 llxlflx.exe 2412 hhthnt.exe 2404 ddpvj.exe 1564 jdjpv.exe 1276 fxllrfl.exe 2472 nnnbhn.exe 2716 vddpp.exe 2168 fxrrlrf.exe 1788 rlflrrf.exe 1784 tnhhbh.exe 2156 9pdjd.exe 1628 rxxlllf.exe 1012 nhtbnb.exe 1028 hbnthn.exe 1268 rrrlxfr.exe 1756 rxrfxxf.exe 1936 tttbtb.exe 1960 vpjjp.exe 1920 xrllxfr.exe 580 rlxxxfr.exe 540 7tnthn.exe 1412 ddppd.exe 1820 rrffrrl.exe 624 xrxxlxf.exe -
resource yara_rule behavioral1/memory/1680-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2404-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1048-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1588-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1596-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1280-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2012-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/268-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1896-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1824-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2276-300-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1680 wrote to memory of 2688 1680 322a1c0c1f4ce2e0a88f6e1fb7c673d0_NeikiAnalytics.exe 28 PID 1680 wrote to memory of 2688 1680 322a1c0c1f4ce2e0a88f6e1fb7c673d0_NeikiAnalytics.exe 28 PID 1680 wrote to memory of 2688 1680 322a1c0c1f4ce2e0a88f6e1fb7c673d0_NeikiAnalytics.exe 28 PID 1680 wrote to memory of 2688 1680 322a1c0c1f4ce2e0a88f6e1fb7c673d0_NeikiAnalytics.exe 28 PID 2688 wrote to memory of 2540 2688 fxflxfl.exe 29 PID 2688 wrote to memory of 2540 2688 fxflxfl.exe 29 PID 2688 wrote to memory of 2540 2688 fxflxfl.exe 29 PID 2688 wrote to memory of 2540 2688 fxflxfl.exe 29 PID 2540 wrote to memory of 2216 2540 jdjpj.exe 30 PID 2540 wrote to memory of 2216 2540 jdjpj.exe 30 PID 2540 wrote to memory of 2216 2540 jdjpj.exe 30 PID 2540 wrote to memory of 2216 2540 jdjpj.exe 30 PID 2216 wrote to memory of 2680 2216 9htbhb.exe 31 PID 2216 wrote to memory of 2680 2216 9htbhb.exe 31 PID 2216 wrote to memory of 2680 2216 9htbhb.exe 31 PID 2216 wrote to memory of 2680 2216 9htbhb.exe 31 PID 2680 wrote to memory of 2552 2680 pjdvp.exe 32 PID 2680 wrote to memory of 2552 2680 pjdvp.exe 32 PID 2680 wrote to memory of 2552 2680 pjdvp.exe 32 PID 2680 wrote to memory of 2552 2680 pjdvp.exe 32 PID 2552 wrote to memory of 2404 2552 3thhtb.exe 33 PID 2552 wrote to memory of 2404 2552 3thhtb.exe 33 PID 2552 wrote to memory of 2404 2552 3thhtb.exe 33 PID 2552 wrote to memory of 2404 2552 3thhtb.exe 33 PID 2404 wrote to memory of 2580 2404 7dvpj.exe 34 PID 2404 wrote to memory of 2580 2404 7dvpj.exe 34 PID 2404 wrote to memory of 2580 2404 7dvpj.exe 34 PID 2404 wrote to memory of 2580 2404 7dvpj.exe 34 PID 2580 wrote to memory of 1572 2580 ffxfxfx.exe 35 PID 2580 wrote to memory of 1572 2580 ffxfxfx.exe 35 PID 2580 wrote to memory of 1572 2580 ffxfxfx.exe 35 PID 2580 wrote to memory of 1572 2580 ffxfxfx.exe 35 PID 1572 wrote to memory of 1048 1572 bnhtht.exe 36 PID 1572 wrote to memory of 1048 1572 bnhtht.exe 36 PID 1572 wrote to memory of 1048 1572 bnhtht.exe 36 PID 1572 wrote to memory of 1048 1572 bnhtht.exe 36 PID 1048 wrote to memory of 2644 1048 1lffllf.exe 37 PID 1048 wrote to memory of 2644 1048 1lffllf.exe 37 PID 1048 wrote to memory of 2644 1048 1lffllf.exe 37 PID 1048 wrote to memory of 2644 1048 1lffllf.exe 37 PID 2644 wrote to memory of 1776 2644 nbbnnb.exe 38 PID 2644 wrote to memory of 1776 2644 nbbnnb.exe 38 PID 2644 wrote to memory of 1776 2644 nbbnnb.exe 38 PID 2644 wrote to memory of 1776 2644 nbbnnb.exe 38 PID 1776 wrote to memory of 1588 1776 vvvjv.exe 39 PID 1776 wrote to memory of 1588 1776 vvvjv.exe 39 PID 1776 wrote to memory of 1588 1776 vvvjv.exe 39 PID 1776 wrote to memory of 1588 1776 vvvjv.exe 39 PID 1588 wrote to memory of 1596 1588 5xlrrxf.exe 40 PID 1588 wrote to memory of 1596 1588 5xlrrxf.exe 40 PID 1588 wrote to memory of 1596 1588 5xlrrxf.exe 40 PID 1588 wrote to memory of 1596 1588 5xlrrxf.exe 40 PID 1596 wrote to memory of 308 1596 nnhntn.exe 41 PID 1596 wrote to memory of 308 1596 nnhntn.exe 41 PID 1596 wrote to memory of 308 1596 nnhntn.exe 41 PID 1596 wrote to memory of 308 1596 nnhntn.exe 41 PID 308 wrote to memory of 2448 308 dppjv.exe 42 PID 308 wrote to memory of 2448 308 dppjv.exe 42 PID 308 wrote to memory of 2448 308 dppjv.exe 42 PID 308 wrote to memory of 2448 308 dppjv.exe 42 PID 2448 wrote to memory of 2320 2448 tntnhn.exe 43 PID 2448 wrote to memory of 2320 2448 tntnhn.exe 43 PID 2448 wrote to memory of 2320 2448 tntnhn.exe 43 PID 2448 wrote to memory of 2320 2448 tntnhn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\322a1c0c1f4ce2e0a88f6e1fb7c673d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\322a1c0c1f4ce2e0a88f6e1fb7c673d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\fxflxfl.exec:\fxflxfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\jdjpj.exec:\jdjpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\9htbhb.exec:\9htbhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\pjdvp.exec:\pjdvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\3thhtb.exec:\3thhtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\7dvpj.exec:\7dvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\ffxfxfx.exec:\ffxfxfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\bnhtht.exec:\bnhtht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\1lffllf.exec:\1lffllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\nbbnnb.exec:\nbbnnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\vvvjv.exec:\vvvjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\5xlrrxf.exec:\5xlrrxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\nnhntn.exec:\nnhntn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\dppjv.exec:\dppjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:308 -
\??\c:\tntnhn.exec:\tntnhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\jjvjp.exec:\jjvjp.exe17⤵
- Executes dropped EXE
PID:2320 -
\??\c:\lfflxfr.exec:\lfflxfr.exe18⤵
- Executes dropped EXE
PID:1280 -
\??\c:\7nbbbh.exec:\7nbbbh.exe19⤵
- Executes dropped EXE
PID:2012 -
\??\c:\9vvdj.exec:\9vvdj.exe20⤵
- Executes dropped EXE
PID:1932 -
\??\c:\bnhtbh.exec:\bnhtbh.exe21⤵
- Executes dropped EXE
PID:2368 -
\??\c:\7vvpj.exec:\7vvpj.exe22⤵
- Executes dropped EXE
PID:268 -
\??\c:\xrlrllf.exec:\xrlrllf.exe23⤵
- Executes dropped EXE
PID:564 -
\??\c:\ppdjv.exec:\ppdjv.exe24⤵
- Executes dropped EXE
PID:980 -
\??\c:\xrrrlxl.exec:\xrrrlxl.exe25⤵
- Executes dropped EXE
PID:1896 -
\??\c:\9nhhtt.exec:\9nhhtt.exe26⤵
- Executes dropped EXE
PID:2924 -
\??\c:\vjdjv.exec:\vjdjv.exe27⤵
- Executes dropped EXE
PID:1824 -
\??\c:\jdvpj.exec:\jdvpj.exe28⤵
- Executes dropped EXE
PID:868 -
\??\c:\dvjpd.exec:\dvjpd.exe29⤵
- Executes dropped EXE
PID:1656 -
\??\c:\1tntbh.exec:\1tntbh.exe30⤵
- Executes dropped EXE
PID:1952 -
\??\c:\ppjpp.exec:\ppjpp.exe31⤵
- Executes dropped EXE
PID:2996 -
\??\c:\ttntnb.exec:\ttntnb.exe32⤵
- Executes dropped EXE
PID:2276 -
\??\c:\vvvdj.exec:\vvvdj.exe33⤵
- Executes dropped EXE
PID:1500 -
\??\c:\llflxlf.exec:\llflxlf.exe34⤵
- Executes dropped EXE
PID:1520 -
\??\c:\nnnthn.exec:\nnnthn.exe35⤵
- Executes dropped EXE
PID:2504 -
\??\c:\ddvvd.exec:\ddvvd.exe36⤵
- Executes dropped EXE
PID:2848 -
\??\c:\lxrxllf.exec:\lxrxllf.exe37⤵
- Executes dropped EXE
PID:2904 -
\??\c:\rlffxxl.exec:\rlffxxl.exe38⤵
- Executes dropped EXE
PID:2516 -
\??\c:\tnhbtt.exec:\tnhbtt.exe39⤵
- Executes dropped EXE
PID:2932 -
\??\c:\ddvvj.exec:\ddvvj.exe40⤵
- Executes dropped EXE
PID:2436 -
\??\c:\lfrrffl.exec:\lfrrffl.exe41⤵
- Executes dropped EXE
PID:2628 -
\??\c:\llxlflx.exec:\llxlflx.exe42⤵
- Executes dropped EXE
PID:2408 -
\??\c:\hhthnt.exec:\hhthnt.exe43⤵
- Executes dropped EXE
PID:2412 -
\??\c:\ddpvj.exec:\ddpvj.exe44⤵
- Executes dropped EXE
PID:2404 -
\??\c:\jdjpv.exec:\jdjpv.exe45⤵
- Executes dropped EXE
PID:1564 -
\??\c:\fxllrfl.exec:\fxllrfl.exe46⤵
- Executes dropped EXE
PID:1276 -
\??\c:\nnnbhn.exec:\nnnbhn.exe47⤵
- Executes dropped EXE
PID:2472 -
\??\c:\vddpp.exec:\vddpp.exe48⤵
- Executes dropped EXE
PID:2716 -
\??\c:\fxrrlrf.exec:\fxrrlrf.exe49⤵
- Executes dropped EXE
PID:2168 -
\??\c:\rlflrrf.exec:\rlflrrf.exe50⤵
- Executes dropped EXE
PID:1788 -
\??\c:\tnhhbh.exec:\tnhhbh.exe51⤵
- Executes dropped EXE
PID:1784 -
\??\c:\9pdjd.exec:\9pdjd.exe52⤵
- Executes dropped EXE
PID:2156 -
\??\c:\rxxlllf.exec:\rxxlllf.exe53⤵
- Executes dropped EXE
PID:1628 -
\??\c:\nhtbnb.exec:\nhtbnb.exe54⤵
- Executes dropped EXE
PID:1012 -
\??\c:\hbnthn.exec:\hbnthn.exe55⤵
- Executes dropped EXE
PID:1028 -
\??\c:\rrrlxfr.exec:\rrrlxfr.exe56⤵
- Executes dropped EXE
PID:1268 -
\??\c:\rxrfxxf.exec:\rxrfxxf.exe57⤵
- Executes dropped EXE
PID:1756 -
\??\c:\tttbtb.exec:\tttbtb.exe58⤵
- Executes dropped EXE
PID:1936 -
\??\c:\vpjjp.exec:\vpjjp.exe59⤵
- Executes dropped EXE
PID:1960 -
\??\c:\xrllxfr.exec:\xrllxfr.exe60⤵
- Executes dropped EXE
PID:1920 -
\??\c:\rlxxxfr.exec:\rlxxxfr.exe61⤵
- Executes dropped EXE
PID:580 -
\??\c:\7tnthn.exec:\7tnthn.exe62⤵
- Executes dropped EXE
PID:540 -
\??\c:\ddppd.exec:\ddppd.exe63⤵
- Executes dropped EXE
PID:1412 -
\??\c:\rrffrrl.exec:\rrffrrl.exe64⤵
- Executes dropped EXE
PID:1820 -
\??\c:\xrxxlxf.exec:\xrxxlxf.exe65⤵
- Executes dropped EXE
PID:624 -
\??\c:\nhtbbh.exec:\nhtbbh.exe66⤵PID:2964
-
\??\c:\pjvvd.exec:\pjvvd.exe67⤵PID:292
-
\??\c:\dvpjj.exec:\dvpjj.exe68⤵PID:1608
-
\??\c:\ffxfllr.exec:\ffxfllr.exe69⤵PID:1580
-
\??\c:\hbbtht.exec:\hbbtht.exe70⤵PID:788
-
\??\c:\jvdvv.exec:\jvdvv.exe71⤵PID:1992
-
\??\c:\dvdjd.exec:\dvdjd.exe72⤵PID:1952
-
\??\c:\rllrxxl.exec:\rllrxxl.exe73⤵PID:2260
-
\??\c:\hnhhnn.exec:\hnhhnn.exe74⤵PID:904
-
\??\c:\1vvjv.exec:\1vvjv.exe75⤵PID:2344
-
\??\c:\lxrfxfr.exec:\lxrfxfr.exe76⤵PID:1500
-
\??\c:\9rlrflf.exec:\9rlrflf.exe77⤵PID:1548
-
\??\c:\1thtbh.exec:\1thtbh.exe78⤵PID:2504
-
\??\c:\djjdd.exec:\djjdd.exe79⤵PID:2848
-
\??\c:\fxflllf.exec:\fxflllf.exe80⤵PID:2548
-
\??\c:\rlfrffr.exec:\rlfrffr.exe81⤵PID:2516
-
\??\c:\nhbhtb.exec:\nhbhtb.exe82⤵PID:2932
-
\??\c:\jddjv.exec:\jddjv.exe83⤵PID:2436
-
\??\c:\ddpdj.exec:\ddpdj.exe84⤵PID:2576
-
\??\c:\xrlxlrf.exec:\xrlxlrf.exe85⤵PID:2408
-
\??\c:\nhtbbb.exec:\nhtbbb.exe86⤵PID:2484
-
\??\c:\dvjpd.exec:\dvjpd.exe87⤵PID:2404
-
\??\c:\ppjdp.exec:\ppjdp.exe88⤵PID:1524
-
\??\c:\lfxlrfx.exec:\lfxlrfx.exe89⤵PID:1276
-
\??\c:\hhnthb.exec:\hhnthb.exe90⤵PID:2696
-
\??\c:\ppdvv.exec:\ppdvv.exe91⤵PID:2716
-
\??\c:\pjdpd.exec:\pjdpd.exe92⤵PID:2808
-
\??\c:\rllxlrf.exec:\rllxlrf.exe93⤵PID:676
-
\??\c:\nnhbnn.exec:\nnhbnn.exe94⤵PID:2304
-
\??\c:\vdvdp.exec:\vdvdp.exe95⤵PID:2184
-
\??\c:\pjpvp.exec:\pjpvp.exe96⤵PID:932
-
\??\c:\xrlxlrl.exec:\xrlxlrl.exe97⤵PID:1012
-
\??\c:\bhnnbh.exec:\bhnnbh.exe98⤵PID:2040
-
\??\c:\pjdpj.exec:\pjdpj.exe99⤵PID:3004
-
\??\c:\dpddv.exec:\dpddv.exe100⤵PID:2056
-
\??\c:\9fffrxf.exec:\9fffrxf.exe101⤵PID:1936
-
\??\c:\5rlxxxf.exec:\5rlxxxf.exe102⤵PID:2392
-
\??\c:\btntbh.exec:\btntbh.exe103⤵PID:2780
-
\??\c:\9djpv.exec:\9djpv.exe104⤵PID:1912
-
\??\c:\fxxrflr.exec:\fxxrflr.exe105⤵PID:540
-
\??\c:\xrffllx.exec:\xrffllx.exe106⤵PID:584
-
\??\c:\tththn.exec:\tththn.exe107⤵PID:1820
-
\??\c:\pppvj.exec:\pppvj.exe108⤵PID:1888
-
\??\c:\lfxxrxl.exec:\lfxxrxl.exe109⤵PID:2956
-
\??\c:\xxxfrxl.exec:\xxxfrxl.exe110⤵PID:384
-
\??\c:\nnhthn.exec:\nnhthn.exe111⤵PID:1448
-
\??\c:\pjvvd.exec:\pjvvd.exe112⤵PID:300
-
\??\c:\pjppd.exec:\pjppd.exe113⤵PID:788
-
\??\c:\rlrrrlr.exec:\rlrrrlr.exe114⤵PID:1656
-
\??\c:\btnhbn.exec:\btnhbn.exe115⤵PID:2892
-
\??\c:\nhthtt.exec:\nhthtt.exe116⤵PID:1424
-
\??\c:\1pddd.exec:\1pddd.exe117⤵PID:2744
-
\??\c:\fxflxfx.exec:\fxflxfx.exe118⤵PID:872
-
\??\c:\hhbhtb.exec:\hhbhtb.exe119⤵PID:1636
-
\??\c:\jdpvv.exec:\jdpvv.exe120⤵PID:2928
-
\??\c:\jjvdp.exec:\jjvdp.exe121⤵PID:2520
-
\??\c:\5rxxrxl.exec:\5rxxrxl.exe122⤵PID:2568
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-