Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17/05/2024, 20:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
27b5c4b6a4437f865ee4a03f89142350_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
27b5c4b6a4437f865ee4a03f89142350_NeikiAnalytics.exe
-
Size
72KB
-
MD5
27b5c4b6a4437f865ee4a03f89142350
-
SHA1
4ca74651d0f15ee7223c6038afc64486cd5c9cb8
-
SHA256
080981783f42abbd3ff4f90bdd429fc2563b6d257807b6ad3a2a64d6ce19260a
-
SHA512
52c7983dc7e22207a3d1609e0a4145a76700b73299c4ac43682458f517fc47d7c100c9afc46a6acd268bdeedb1447e6b5c6bcc3901f26c1ca7061b91a9557a14
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIrmCeRMKwo:ymb3NkkiQ3mdBjFIjeKo
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/1960-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/360-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1316-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2352-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1272-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/560-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1668-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1640-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2020-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1960 7flrxrx.exe 2020 9bbhbh.exe 2576 nhtbhh.exe 2788 pjjdd.exe 2460 ddvjp.exe 2616 rlfrxxx.exe 2424 btnnbn.exe 2596 nhtntb.exe 1640 pdpjj.exe 2748 djjpp.exe 2904 xrlllfr.exe 1668 rlxxfff.exe 1636 bbnbhh.exe 1520 5bntbh.exe 360 dvjjj.exe 2484 jvjjv.exe 1316 ffxfrfr.exe 1280 rlflflr.exe 2088 hthtbb.exe 2604 nhtthh.exe 2808 dpvpp.exe 560 pjppd.exe 1088 3rxlxfr.exe 840 1lflflx.exe 1272 1bbthn.exe 812 nhbbnn.exe 2508 1pjjp.exe 1152 pddjp.exe 2352 xrflxfl.exe 1984 xrxlxxl.exe 1736 tnhhtn.exe 2288 bthntt.exe 3000 1bttbt.exe 300 vppvp.exe 2532 dddvd.exe 2656 rrlxffl.exe 2996 fxlxfll.exe 2452 nhhhhb.exe 2692 tnntbh.exe 2436 nhbhbh.exe 2572 5ddvp.exe 1804 jdjpv.exe 1820 rrrrrfx.exe 2768 lfxfflx.exe 2920 nhhtnt.exe 2684 nbnbhb.exe 1920 jjvvv.exe 2028 frrxfll.exe 1604 fllxrfx.exe 1520 1tbntt.exe 2608 htbhbh.exe 2188 7hbtbh.exe 1304 dpdjd.exe 1316 lxxlflf.exe 1544 lrxxrlx.exe 2408 xlllrrx.exe 1704 1thhnh.exe 2760 thnttt.exe 2808 7vdjj.exe 1100 pjvvv.exe 2924 lfxfrxx.exe 2396 lxlrxrl.exe 836 frflllr.exe 764 httbnh.exe -
resource yara_rule behavioral1/memory/1960-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/360-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1316-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2352-283-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1272-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/560-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1668-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-24-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2988 wrote to memory of 1960 2988 27b5c4b6a4437f865ee4a03f89142350_NeikiAnalytics.exe 28 PID 2988 wrote to memory of 1960 2988 27b5c4b6a4437f865ee4a03f89142350_NeikiAnalytics.exe 28 PID 2988 wrote to memory of 1960 2988 27b5c4b6a4437f865ee4a03f89142350_NeikiAnalytics.exe 28 PID 2988 wrote to memory of 1960 2988 27b5c4b6a4437f865ee4a03f89142350_NeikiAnalytics.exe 28 PID 1960 wrote to memory of 2020 1960 7flrxrx.exe 29 PID 1960 wrote to memory of 2020 1960 7flrxrx.exe 29 PID 1960 wrote to memory of 2020 1960 7flrxrx.exe 29 PID 1960 wrote to memory of 2020 1960 7flrxrx.exe 29 PID 2020 wrote to memory of 2576 2020 9bbhbh.exe 30 PID 2020 wrote to memory of 2576 2020 9bbhbh.exe 30 PID 2020 wrote to memory of 2576 2020 9bbhbh.exe 30 PID 2020 wrote to memory of 2576 2020 9bbhbh.exe 30 PID 2576 wrote to memory of 2788 2576 nhtbhh.exe 270 PID 2576 wrote to memory of 2788 2576 nhtbhh.exe 270 PID 2576 wrote to memory of 2788 2576 nhtbhh.exe 270 PID 2576 wrote to memory of 2788 2576 nhtbhh.exe 270 PID 2788 wrote to memory of 2460 2788 pjjdd.exe 32 PID 2788 wrote to memory of 2460 2788 pjjdd.exe 32 PID 2788 wrote to memory of 2460 2788 pjjdd.exe 32 PID 2788 wrote to memory of 2460 2788 pjjdd.exe 32 PID 2460 wrote to memory of 2616 2460 ddvjp.exe 108 PID 2460 wrote to memory of 2616 2460 ddvjp.exe 108 PID 2460 wrote to memory of 2616 2460 ddvjp.exe 108 PID 2460 wrote to memory of 2616 2460 ddvjp.exe 108 PID 2616 wrote to memory of 2424 2616 rlfrxxx.exe 233 PID 2616 wrote to memory of 2424 2616 rlfrxxx.exe 233 PID 2616 wrote to memory of 2424 2616 rlfrxxx.exe 233 PID 2616 wrote to memory of 2424 2616 rlfrxxx.exe 233 PID 2424 wrote to memory of 2596 2424 btnnbn.exe 153 PID 2424 wrote to memory of 2596 2424 btnnbn.exe 153 PID 2424 wrote to memory of 2596 2424 btnnbn.exe 153 PID 2424 wrote to memory of 2596 2424 btnnbn.exe 153 PID 2596 wrote to memory of 1640 2596 nhtntb.exe 36 PID 2596 wrote to memory of 1640 2596 nhtntb.exe 36 PID 2596 wrote to memory of 1640 2596 nhtntb.exe 36 PID 2596 wrote to memory of 1640 2596 nhtntb.exe 36 PID 1640 wrote to memory of 2748 1640 pdpjj.exe 37 PID 1640 wrote to memory of 2748 1640 pdpjj.exe 37 PID 1640 wrote to memory of 2748 1640 pdpjj.exe 37 PID 1640 wrote to memory of 2748 1640 pdpjj.exe 37 PID 2748 wrote to memory of 2904 2748 djjpp.exe 156 PID 2748 wrote to memory of 2904 2748 djjpp.exe 156 PID 2748 wrote to memory of 2904 2748 djjpp.exe 156 PID 2748 wrote to memory of 2904 2748 djjpp.exe 156 PID 2904 wrote to memory of 1668 2904 xrlllfr.exe 39 PID 2904 wrote to memory of 1668 2904 xrlllfr.exe 39 PID 2904 wrote to memory of 1668 2904 xrlllfr.exe 39 PID 2904 wrote to memory of 1668 2904 xrlllfr.exe 39 PID 1668 wrote to memory of 1636 1668 rlxxfff.exe 200 PID 1668 wrote to memory of 1636 1668 rlxxfff.exe 200 PID 1668 wrote to memory of 1636 1668 rlxxfff.exe 200 PID 1668 wrote to memory of 1636 1668 rlxxfff.exe 200 PID 1636 wrote to memory of 1520 1636 bbnbhh.exe 286 PID 1636 wrote to memory of 1520 1636 bbnbhh.exe 286 PID 1636 wrote to memory of 1520 1636 bbnbhh.exe 286 PID 1636 wrote to memory of 1520 1636 bbnbhh.exe 286 PID 1520 wrote to memory of 360 1520 5bntbh.exe 42 PID 1520 wrote to memory of 360 1520 5bntbh.exe 42 PID 1520 wrote to memory of 360 1520 5bntbh.exe 42 PID 1520 wrote to memory of 360 1520 5bntbh.exe 42 PID 360 wrote to memory of 2484 360 dvjjj.exe 43 PID 360 wrote to memory of 2484 360 dvjjj.exe 43 PID 360 wrote to memory of 2484 360 dvjjj.exe 43 PID 360 wrote to memory of 2484 360 dvjjj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\27b5c4b6a4437f865ee4a03f89142350_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\27b5c4b6a4437f865ee4a03f89142350_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\7flrxrx.exec:\7flrxrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\9bbhbh.exec:\9bbhbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\nhtbhh.exec:\nhtbhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\pjjdd.exec:\pjjdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\ddvjp.exec:\ddvjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\rlfrxxx.exec:\rlfrxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\btnnbn.exec:\btnnbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\nhtntb.exec:\nhtntb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\pdpjj.exec:\pdpjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\djjpp.exec:\djjpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\xrlllfr.exec:\xrlllfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\rlxxfff.exec:\rlxxfff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\bbnbhh.exec:\bbnbhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\5bntbh.exec:\5bntbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\dvjjj.exec:\dvjjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:360 -
\??\c:\jvjjv.exec:\jvjjv.exe17⤵
- Executes dropped EXE
PID:2484 -
\??\c:\ffxfrfr.exec:\ffxfrfr.exe18⤵
- Executes dropped EXE
PID:1316 -
\??\c:\rlflflr.exec:\rlflflr.exe19⤵
- Executes dropped EXE
PID:1280 -
\??\c:\hthtbb.exec:\hthtbb.exe20⤵
- Executes dropped EXE
PID:2088 -
\??\c:\nhtthh.exec:\nhtthh.exe21⤵
- Executes dropped EXE
PID:2604 -
\??\c:\dpvpp.exec:\dpvpp.exe22⤵
- Executes dropped EXE
PID:2808 -
\??\c:\pjppd.exec:\pjppd.exe23⤵
- Executes dropped EXE
PID:560 -
\??\c:\3rxlxfr.exec:\3rxlxfr.exe24⤵
- Executes dropped EXE
PID:1088 -
\??\c:\1lflflx.exec:\1lflflx.exe25⤵
- Executes dropped EXE
PID:840 -
\??\c:\1bbthn.exec:\1bbthn.exe26⤵
- Executes dropped EXE
PID:1272 -
\??\c:\nhbbnn.exec:\nhbbnn.exe27⤵
- Executes dropped EXE
PID:812 -
\??\c:\1pjjp.exec:\1pjjp.exe28⤵
- Executes dropped EXE
PID:2508 -
\??\c:\pddjp.exec:\pddjp.exe29⤵
- Executes dropped EXE
PID:1152 -
\??\c:\xrflxfl.exec:\xrflxfl.exe30⤵
- Executes dropped EXE
PID:2352 -
\??\c:\xrxlxxl.exec:\xrxlxxl.exe31⤵
- Executes dropped EXE
PID:1984 -
\??\c:\tnhhtn.exec:\tnhhtn.exe32⤵
- Executes dropped EXE
PID:1736 -
\??\c:\bthntt.exec:\bthntt.exe33⤵
- Executes dropped EXE
PID:2288 -
\??\c:\1bttbt.exec:\1bttbt.exe34⤵
- Executes dropped EXE
PID:3000 -
\??\c:\vppvp.exec:\vppvp.exe35⤵
- Executes dropped EXE
PID:300 -
\??\c:\dddvd.exec:\dddvd.exe36⤵
- Executes dropped EXE
PID:2532 -
\??\c:\rrlxffl.exec:\rrlxffl.exe37⤵
- Executes dropped EXE
PID:2656 -
\??\c:\fxlxfll.exec:\fxlxfll.exe38⤵
- Executes dropped EXE
PID:2996 -
\??\c:\nhhhhb.exec:\nhhhhb.exe39⤵
- Executes dropped EXE
PID:2452 -
\??\c:\tnntbh.exec:\tnntbh.exe40⤵
- Executes dropped EXE
PID:2692 -
\??\c:\nhbhbh.exec:\nhbhbh.exe41⤵
- Executes dropped EXE
PID:2436 -
\??\c:\5ddvp.exec:\5ddvp.exe42⤵
- Executes dropped EXE
PID:2572 -
\??\c:\jdjpv.exec:\jdjpv.exe43⤵
- Executes dropped EXE
PID:1804 -
\??\c:\rrrrrfx.exec:\rrrrrfx.exe44⤵
- Executes dropped EXE
PID:1820 -
\??\c:\lfxfflx.exec:\lfxfflx.exe45⤵
- Executes dropped EXE
PID:2768 -
\??\c:\nhhtnt.exec:\nhhtnt.exe46⤵
- Executes dropped EXE
PID:2920 -
\??\c:\nbnbhb.exec:\nbnbhb.exe47⤵
- Executes dropped EXE
PID:2684 -
\??\c:\jjvvv.exec:\jjvvv.exe48⤵
- Executes dropped EXE
PID:1920 -
\??\c:\frrxfll.exec:\frrxfll.exe49⤵
- Executes dropped EXE
PID:2028 -
\??\c:\fllxrfx.exec:\fllxrfx.exe50⤵
- Executes dropped EXE
PID:1604 -
\??\c:\1tbntt.exec:\1tbntt.exe51⤵
- Executes dropped EXE
PID:1520 -
\??\c:\htbhbh.exec:\htbhbh.exe52⤵
- Executes dropped EXE
PID:2608 -
\??\c:\7hbtbh.exec:\7hbtbh.exe53⤵
- Executes dropped EXE
PID:2188 -
\??\c:\dpdjd.exec:\dpdjd.exe54⤵
- Executes dropped EXE
PID:1304 -
\??\c:\lxxlflf.exec:\lxxlflf.exe55⤵
- Executes dropped EXE
PID:1316 -
\??\c:\lrxxrlx.exec:\lrxxrlx.exe56⤵
- Executes dropped EXE
PID:1544 -
\??\c:\xlllrrx.exec:\xlllrrx.exe57⤵
- Executes dropped EXE
PID:2408 -
\??\c:\1thhnh.exec:\1thhnh.exe58⤵
- Executes dropped EXE
PID:1704 -
\??\c:\thnttt.exec:\thnttt.exe59⤵
- Executes dropped EXE
PID:2760 -
\??\c:\7vdjj.exec:\7vdjj.exe60⤵
- Executes dropped EXE
PID:2808 -
\??\c:\pjvvv.exec:\pjvvv.exe61⤵
- Executes dropped EXE
PID:1100 -
\??\c:\lfxfrxx.exec:\lfxfrxx.exe62⤵
- Executes dropped EXE
PID:2924 -
\??\c:\lxlrxrl.exec:\lxlrxrl.exe63⤵
- Executes dropped EXE
PID:2396 -
\??\c:\frflllr.exec:\frflllr.exe64⤵
- Executes dropped EXE
PID:836 -
\??\c:\httbnh.exec:\httbnh.exe65⤵
- Executes dropped EXE
PID:764 -
\??\c:\btnnhn.exec:\btnnhn.exe66⤵PID:904
-
\??\c:\pjvdp.exec:\pjvdp.exe67⤵PID:1932
-
\??\c:\jjjvj.exec:\jjjvj.exe68⤵PID:1808
-
\??\c:\dvpjj.exec:\dvpjj.exe69⤵PID:2972
-
\??\c:\rrrrxff.exec:\rrrrxff.exe70⤵PID:648
-
\??\c:\7fxxffx.exec:\7fxxffx.exe71⤵PID:1252
-
\??\c:\rffrrrx.exec:\rffrrrx.exe72⤵PID:1736
-
\??\c:\thnhbb.exec:\thnhbb.exe73⤵PID:2288
-
\??\c:\htbbhh.exec:\htbbhh.exe74⤵PID:2004
-
\??\c:\nbhbtn.exec:\nbhbtn.exe75⤵PID:2568
-
\??\c:\9vpvd.exec:\9vpvd.exe76⤵PID:2636
-
\??\c:\jdjpd.exec:\jdjpd.exe77⤵PID:2532
-
\??\c:\xlrlllx.exec:\xlrlllx.exe78⤵PID:2980
-
\??\c:\7lxllrx.exec:\7lxllrx.exe79⤵PID:2560
-
\??\c:\3ntttb.exec:\3ntttb.exe80⤵PID:2356
-
\??\c:\tntbhh.exec:\tntbhh.exe81⤵PID:2460
-
\??\c:\jjpdp.exec:\jjpdp.exe82⤵PID:2616
-
\??\c:\5vjpv.exec:\5vjpv.exe83⤵PID:2884
-
\??\c:\jvjpp.exec:\jvjpp.exe84⤵PID:1992
-
\??\c:\5rfrfxf.exec:\5rfrfxf.exe85⤵PID:2796
-
\??\c:\xrrrxrl.exec:\xrrrxrl.exe86⤵PID:2744
-
\??\c:\bnbhnn.exec:\bnbhnn.exe87⤵PID:2556
-
\??\c:\nbhbhb.exec:\nbhbhb.exe88⤵PID:2860
-
\??\c:\pdddv.exec:\pdddv.exe89⤵PID:1940
-
\??\c:\xxfrrxx.exec:\xxfrrxx.exe90⤵PID:2304
-
\??\c:\7lllxrf.exec:\7lllxrf.exe91⤵PID:2264
-
\??\c:\rlxffrx.exec:\rlxffrx.exe92⤵PID:1904
-
\??\c:\thbhhh.exec:\thbhhh.exe93⤵PID:808
-
\??\c:\3nnthb.exec:\3nnthb.exe94⤵PID:360
-
\??\c:\ddpvp.exec:\ddpvp.exe95⤵PID:868
-
\??\c:\1pdjd.exec:\1pdjd.exe96⤵PID:1836
-
\??\c:\rlrfrrx.exec:\rlrfrrx.exe97⤵PID:1944
-
\??\c:\frxrfll.exec:\frxrfll.exe98⤵PID:1996
-
\??\c:\fxflxxf.exec:\fxflxxf.exe99⤵PID:1420
-
\??\c:\5hbhnh.exec:\5hbhnh.exe100⤵PID:1900
-
\??\c:\nbtnhn.exec:\nbtnhn.exe101⤵PID:2716
-
\??\c:\7jppd.exec:\7jppd.exe102⤵PID:1480
-
\??\c:\pjppd.exec:\pjppd.exe103⤵PID:948
-
\??\c:\xrflrlr.exec:\xrflrlr.exe104⤵PID:1656
-
\??\c:\xlxxflr.exec:\xlxxflr.exe105⤵PID:840
-
\??\c:\fxffxlr.exec:\fxffxlr.exe106⤵PID:1612
-
\??\c:\bttbnt.exec:\bttbnt.exe107⤵PID:552
-
\??\c:\bnhhnt.exec:\bnhhnt.exe108⤵PID:572
-
\??\c:\pdppj.exec:\pdppj.exe109⤵PID:2348
-
\??\c:\vppvv.exec:\vppvv.exe110⤵PID:2092
-
\??\c:\jdvvv.exec:\jdvvv.exe111⤵PID:2076
-
\??\c:\xrffffl.exec:\xrffffl.exe112⤵PID:1984
-
\??\c:\frxxlfl.exec:\frxxlfl.exe113⤵PID:2392
-
\??\c:\ttnntt.exec:\ttnntt.exe114⤵PID:2712
-
\??\c:\bntnnn.exec:\bntnnn.exe115⤵PID:1692
-
\??\c:\5vjpv.exec:\5vjpv.exe116⤵PID:1184
-
\??\c:\jvppv.exec:\jvppv.exe117⤵PID:300
-
\??\c:\jvjjd.exec:\jvjjd.exe118⤵PID:2652
-
\??\c:\7pdvv.exec:\7pdvv.exe119⤵PID:872
-
\??\c:\frfflrf.exec:\frfflrf.exe120⤵PID:2588
-
\??\c:\9ffxxxl.exec:\9ffxxxl.exe121⤵PID:2752
-
\??\c:\7nbbnh.exec:\7nbbnh.exe122⤵PID:2536
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-