Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18/05/2024, 13:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ce01be62f58718eabfede085397a70a0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
ce01be62f58718eabfede085397a70a0_NeikiAnalytics.exe
-
Size
445KB
-
MD5
ce01be62f58718eabfede085397a70a0
-
SHA1
31e71352ba06573728dedbf6bca5b79d8781e21e
-
SHA256
6819f9595f091398a7b16062b59d207f6f86e6278eec18cfb8f9c8bced0ad918
-
SHA512
6f0e56a0a6e8fdb7a3be52ec92f963ddb5ac2fad3b2ed7ef44fcd9dcced804b86db84ba7237381fffe8ec1653b2a9e9ba4d98776a6752e4f124211fdb3a487bf
-
SSDEEP
6144:n3C9BRo7tvnJ9Fywhk/T4i37K3BoKg0p5WI09JN:n3C9ytvn8whkb4i3e3GFO6JN
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/1924-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1724-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2964-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2112-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1840-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1784-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1544-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2304-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1340-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2020-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1896-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1596-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/888-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1392-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/592-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1724 thhhnh.exe 2964 ppjjp.exe 2608 nnthtn.exe 2700 jdvdd.exe 1940 ffxxrxr.exe 2560 7btttb.exe 2436 9vjjd.exe 2112 llffrrl.exe 2656 tttnnn.exe 2744 5frxflx.exe 2632 lfrxffr.exe 1840 hhbhnt.exe 1784 5vjjv.exe 1544 rlrflfr.exe 2788 btnbnt.exe 2304 pjppd.exe 2020 vjvvj.exe 1340 7htnnn.exe 1896 vpdvd.exe 1608 dvvjp.exe 592 nhthnt.exe 1392 jpvjj.exe 2784 5rfflfl.exe 1132 fxllrrx.exe 2108 btbhnh.exe 2300 1vjdd.exe 1596 frffllx.exe 2316 hthbtb.exe 1468 5jddj.exe 1936 5nbhhh.exe 888 7nbbbb.exe 2296 dpvpv.exe 1652 xlrrxfx.exe 2528 nntntt.exe 2860 tnhbbt.exe 2672 dvjjv.exe 2588 xrlllrr.exe 2604 hthntb.exe 2416 jjvdj.exe 2284 ppdjp.exe 2156 3xfflrx.exe 2896 7xlllff.exe 2912 thbtbb.exe 2904 dppjv.exe 2644 jjvpd.exe 2740 xrxfffl.exe 2568 xrrrrxl.exe 2632 5hnbhb.exe 1604 jvjvv.exe 1352 vjpjv.exe 340 lxllrrx.exe 2640 3tbbbh.exe 2016 nhnthb.exe 2028 dvddd.exe 2008 vjvvv.exe 2796 frffllr.exe 1828 bthnbb.exe 1644 hbnhbb.exe 788 vjdvd.exe 636 jvjdd.exe 1732 frflxxf.exe 576 bttntn.exe 2976 5vvjd.exe 2104 tnnnbb.exe -
resource yara_rule behavioral1/memory/1924-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1724-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2112-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1840-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1784-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1544-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1340-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1896-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1596-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/888-302-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1392-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/592-211-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1924 wrote to memory of 1724 1924 ce01be62f58718eabfede085397a70a0_NeikiAnalytics.exe 28 PID 1924 wrote to memory of 1724 1924 ce01be62f58718eabfede085397a70a0_NeikiAnalytics.exe 28 PID 1924 wrote to memory of 1724 1924 ce01be62f58718eabfede085397a70a0_NeikiAnalytics.exe 28 PID 1924 wrote to memory of 1724 1924 ce01be62f58718eabfede085397a70a0_NeikiAnalytics.exe 28 PID 1724 wrote to memory of 2964 1724 thhhnh.exe 29 PID 1724 wrote to memory of 2964 1724 thhhnh.exe 29 PID 1724 wrote to memory of 2964 1724 thhhnh.exe 29 PID 1724 wrote to memory of 2964 1724 thhhnh.exe 29 PID 2964 wrote to memory of 2608 2964 ppjjp.exe 30 PID 2964 wrote to memory of 2608 2964 ppjjp.exe 30 PID 2964 wrote to memory of 2608 2964 ppjjp.exe 30 PID 2964 wrote to memory of 2608 2964 ppjjp.exe 30 PID 2608 wrote to memory of 2700 2608 nnthtn.exe 31 PID 2608 wrote to memory of 2700 2608 nnthtn.exe 31 PID 2608 wrote to memory of 2700 2608 nnthtn.exe 31 PID 2608 wrote to memory of 2700 2608 nnthtn.exe 31 PID 2700 wrote to memory of 1940 2700 jdvdd.exe 32 PID 2700 wrote to memory of 1940 2700 jdvdd.exe 32 PID 2700 wrote to memory of 1940 2700 jdvdd.exe 32 PID 2700 wrote to memory of 1940 2700 jdvdd.exe 32 PID 1940 wrote to memory of 2560 1940 ffxxrxr.exe 33 PID 1940 wrote to memory of 2560 1940 ffxxrxr.exe 33 PID 1940 wrote to memory of 2560 1940 ffxxrxr.exe 33 PID 1940 wrote to memory of 2560 1940 ffxxrxr.exe 33 PID 2560 wrote to memory of 2436 2560 7btttb.exe 34 PID 2560 wrote to memory of 2436 2560 7btttb.exe 34 PID 2560 wrote to memory of 2436 2560 7btttb.exe 34 PID 2560 wrote to memory of 2436 2560 7btttb.exe 34 PID 2436 wrote to memory of 2112 2436 9vjjd.exe 35 PID 2436 wrote to memory of 2112 2436 9vjjd.exe 35 PID 2436 wrote to memory of 2112 2436 9vjjd.exe 35 PID 2436 wrote to memory of 2112 2436 9vjjd.exe 35 PID 2112 wrote to memory of 2656 2112 llffrrl.exe 36 PID 2112 wrote to memory of 2656 2112 llffrrl.exe 36 PID 2112 wrote to memory of 2656 2112 llffrrl.exe 36 PID 2112 wrote to memory of 2656 2112 llffrrl.exe 36 PID 2656 wrote to memory of 2744 2656 tttnnn.exe 37 PID 2656 wrote to memory of 2744 2656 tttnnn.exe 37 PID 2656 wrote to memory of 2744 2656 tttnnn.exe 37 PID 2656 wrote to memory of 2744 2656 tttnnn.exe 37 PID 2744 wrote to memory of 2632 2744 5frxflx.exe 75 PID 2744 wrote to memory of 2632 2744 5frxflx.exe 75 PID 2744 wrote to memory of 2632 2744 5frxflx.exe 75 PID 2744 wrote to memory of 2632 2744 5frxflx.exe 75 PID 2632 wrote to memory of 1840 2632 lfrxffr.exe 39 PID 2632 wrote to memory of 1840 2632 lfrxffr.exe 39 PID 2632 wrote to memory of 1840 2632 lfrxffr.exe 39 PID 2632 wrote to memory of 1840 2632 lfrxffr.exe 39 PID 1840 wrote to memory of 1784 1840 hhbhnt.exe 40 PID 1840 wrote to memory of 1784 1840 hhbhnt.exe 40 PID 1840 wrote to memory of 1784 1840 hhbhnt.exe 40 PID 1840 wrote to memory of 1784 1840 hhbhnt.exe 40 PID 1784 wrote to memory of 1544 1784 5vjjv.exe 41 PID 1784 wrote to memory of 1544 1784 5vjjv.exe 41 PID 1784 wrote to memory of 1544 1784 5vjjv.exe 41 PID 1784 wrote to memory of 1544 1784 5vjjv.exe 41 PID 1544 wrote to memory of 2788 1544 rlrflfr.exe 42 PID 1544 wrote to memory of 2788 1544 rlrflfr.exe 42 PID 1544 wrote to memory of 2788 1544 rlrflfr.exe 42 PID 1544 wrote to memory of 2788 1544 rlrflfr.exe 42 PID 2788 wrote to memory of 2304 2788 btnbnt.exe 43 PID 2788 wrote to memory of 2304 2788 btnbnt.exe 43 PID 2788 wrote to memory of 2304 2788 btnbnt.exe 43 PID 2788 wrote to memory of 2304 2788 btnbnt.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce01be62f58718eabfede085397a70a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ce01be62f58718eabfede085397a70a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\thhhnh.exec:\thhhnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\ppjjp.exec:\ppjjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\nnthtn.exec:\nnthtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\jdvdd.exec:\jdvdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\ffxxrxr.exec:\ffxxrxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\7btttb.exec:\7btttb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\9vjjd.exec:\9vjjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\llffrrl.exec:\llffrrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\tttnnn.exec:\tttnnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\5frxflx.exec:\5frxflx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\lfrxffr.exec:\lfrxffr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\hhbhnt.exec:\hhbhnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\5vjjv.exec:\5vjjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\rlrflfr.exec:\rlrflfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\btnbnt.exec:\btnbnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\pjppd.exec:\pjppd.exe17⤵
- Executes dropped EXE
PID:2304 -
\??\c:\vjvvj.exec:\vjvvj.exe18⤵
- Executes dropped EXE
PID:2020 -
\??\c:\7htnnn.exec:\7htnnn.exe19⤵
- Executes dropped EXE
PID:1340 -
\??\c:\vpdvd.exec:\vpdvd.exe20⤵
- Executes dropped EXE
PID:1896 -
\??\c:\dvvjp.exec:\dvvjp.exe21⤵
- Executes dropped EXE
PID:1608 -
\??\c:\nhthnt.exec:\nhthnt.exe22⤵
- Executes dropped EXE
PID:592 -
\??\c:\jpvjj.exec:\jpvjj.exe23⤵
- Executes dropped EXE
PID:1392 -
\??\c:\5rfflfl.exec:\5rfflfl.exe24⤵
- Executes dropped EXE
PID:2784 -
\??\c:\fxllrrx.exec:\fxllrrx.exe25⤵
- Executes dropped EXE
PID:1132 -
\??\c:\btbhnh.exec:\btbhnh.exe26⤵
- Executes dropped EXE
PID:2108 -
\??\c:\1vjdd.exec:\1vjdd.exe27⤵
- Executes dropped EXE
PID:2300 -
\??\c:\frffllx.exec:\frffllx.exe28⤵
- Executes dropped EXE
PID:1596 -
\??\c:\hthbtb.exec:\hthbtb.exe29⤵
- Executes dropped EXE
PID:2316 -
\??\c:\5jddj.exec:\5jddj.exe30⤵
- Executes dropped EXE
PID:1468 -
\??\c:\5nbhhh.exec:\5nbhhh.exe31⤵
- Executes dropped EXE
PID:1936 -
\??\c:\7nbbbb.exec:\7nbbbb.exe32⤵
- Executes dropped EXE
PID:888 -
\??\c:\dpvpv.exec:\dpvpv.exe33⤵
- Executes dropped EXE
PID:2296 -
\??\c:\xlrrxfx.exec:\xlrrxfx.exe34⤵
- Executes dropped EXE
PID:1652 -
\??\c:\nntntt.exec:\nntntt.exe35⤵
- Executes dropped EXE
PID:2528 -
\??\c:\tnhbbt.exec:\tnhbbt.exe36⤵
- Executes dropped EXE
PID:2860 -
\??\c:\dvjjv.exec:\dvjjv.exe37⤵
- Executes dropped EXE
PID:2672 -
\??\c:\xrlllrr.exec:\xrlllrr.exe38⤵
- Executes dropped EXE
PID:2588 -
\??\c:\hthntb.exec:\hthntb.exe39⤵
- Executes dropped EXE
PID:2604 -
\??\c:\jjvdj.exec:\jjvdj.exe40⤵
- Executes dropped EXE
PID:2416 -
\??\c:\ppdjp.exec:\ppdjp.exe41⤵
- Executes dropped EXE
PID:2284 -
\??\c:\3xfflrx.exec:\3xfflrx.exe42⤵
- Executes dropped EXE
PID:2156 -
\??\c:\7xlllff.exec:\7xlllff.exe43⤵
- Executes dropped EXE
PID:2896 -
\??\c:\thbtbb.exec:\thbtbb.exe44⤵
- Executes dropped EXE
PID:2912 -
\??\c:\dppjv.exec:\dppjv.exe45⤵
- Executes dropped EXE
PID:2904 -
\??\c:\jjvpd.exec:\jjvpd.exe46⤵
- Executes dropped EXE
PID:2644 -
\??\c:\xrxfffl.exec:\xrxfffl.exe47⤵
- Executes dropped EXE
PID:2740 -
\??\c:\xrrrrxl.exec:\xrrrrxl.exe48⤵
- Executes dropped EXE
PID:2568 -
\??\c:\5hnbhb.exec:\5hnbhb.exe49⤵
- Executes dropped EXE
PID:2632 -
\??\c:\jvjvv.exec:\jvjvv.exe50⤵
- Executes dropped EXE
PID:1604 -
\??\c:\vjpjv.exec:\vjpjv.exe51⤵
- Executes dropped EXE
PID:1352 -
\??\c:\lxllrrx.exec:\lxllrrx.exe52⤵
- Executes dropped EXE
PID:340 -
\??\c:\3tbbbh.exec:\3tbbbh.exe53⤵
- Executes dropped EXE
PID:2640 -
\??\c:\nhnthb.exec:\nhnthb.exe54⤵
- Executes dropped EXE
PID:2016 -
\??\c:\dvddd.exec:\dvddd.exe55⤵
- Executes dropped EXE
PID:2028 -
\??\c:\vjvvv.exec:\vjvvv.exe56⤵
- Executes dropped EXE
PID:2008 -
\??\c:\frffllr.exec:\frffllr.exe57⤵
- Executes dropped EXE
PID:2796 -
\??\c:\bthnbb.exec:\bthnbb.exe58⤵
- Executes dropped EXE
PID:1828 -
\??\c:\hbnhbb.exec:\hbnhbb.exe59⤵
- Executes dropped EXE
PID:1644 -
\??\c:\vjdvd.exec:\vjdvd.exe60⤵
- Executes dropped EXE
PID:788 -
\??\c:\jvjdd.exec:\jvjdd.exe61⤵
- Executes dropped EXE
PID:636 -
\??\c:\frflxxf.exec:\frflxxf.exe62⤵
- Executes dropped EXE
PID:1732 -
\??\c:\bttntn.exec:\bttntn.exe63⤵
- Executes dropped EXE
PID:576 -
\??\c:\5vvjd.exec:\5vvjd.exe64⤵
- Executes dropped EXE
PID:2976 -
\??\c:\tnnnbb.exec:\tnnnbb.exe65⤵
- Executes dropped EXE
PID:2104 -
\??\c:\lxxrxxl.exec:\lxxrxxl.exe66⤵PID:2340
-
\??\c:\tbthht.exec:\tbthht.exe67⤵PID:1616
-
\??\c:\flxxflx.exec:\flxxflx.exe68⤵PID:2096
-
\??\c:\hbtbhn.exec:\hbtbhn.exe69⤵PID:1596
-
\??\c:\vvjvv.exec:\vvjvv.exe70⤵PID:2052
-
\??\c:\xxllllx.exec:\xxllllx.exe71⤵PID:3048
-
\??\c:\hbttbb.exec:\hbttbb.exe72⤵PID:900
-
\??\c:\9rrfxfl.exec:\9rrfxfl.exe73⤵PID:1920
-
\??\c:\5htthb.exec:\5htthb.exe74⤵PID:2804
-
\??\c:\thtbhh.exec:\thtbhh.exe75⤵PID:1724
-
\??\c:\pdpdj.exec:\pdpdj.exe76⤵PID:1532
-
\??\c:\fxrxllf.exec:\fxrxllf.exe77⤵PID:1520
-
\??\c:\1lxxxrr.exec:\1lxxxrr.exe78⤵PID:2580
-
\??\c:\nbhbbt.exec:\nbhbbt.exe79⤵PID:2400
-
\??\c:\5pvpj.exec:\5pvpj.exe80⤵PID:2688
-
\??\c:\dvdjv.exec:\dvdjv.exe81⤵PID:2524
-
\??\c:\5frlfff.exec:\5frlfff.exe82⤵PID:1952
-
\??\c:\nhtbbb.exec:\nhtbbb.exe83⤵PID:2448
-
\??\c:\9hnntn.exec:\9hnntn.exe84⤵PID:2152
-
\??\c:\7vdvv.exec:\7vdvv.exe85⤵PID:2404
-
\??\c:\frlrrrl.exec:\frlrrrl.exe86⤵PID:356
-
\??\c:\fxllrrx.exec:\fxllrrx.exe87⤵PID:2908
-
\??\c:\thbtbt.exec:\thbtbt.exe88⤵PID:2724
-
\??\c:\jvdvd.exec:\jvdvd.exe89⤵PID:1260
-
\??\c:\lfxrfff.exec:\lfxrfff.exe90⤵PID:1348
-
\??\c:\3rflrlr.exec:\3rflrlr.exe91⤵PID:1836
-
\??\c:\thttbt.exec:\thttbt.exe92⤵PID:1660
-
\??\c:\vpvdj.exec:\vpvdj.exe93⤵PID:1592
-
\??\c:\fxfxxrf.exec:\fxfxxrf.exe94⤵PID:1168
-
\??\c:\7rfflrx.exec:\7rfflrx.exe95⤵PID:2892
-
\??\c:\nbbhbh.exec:\nbbhbh.exe96⤵PID:856
-
\??\c:\pdddj.exec:\pdddj.exe97⤵PID:2888
-
\??\c:\9jvvd.exec:\9jvvd.exe98⤵PID:2368
-
\??\c:\xrffffl.exec:\xrffffl.exe99⤵PID:2216
-
\??\c:\bbbhhn.exec:\bbbhhn.exe100⤵PID:1896
-
\??\c:\nnnttn.exec:\nnnttn.exe101⤵PID:536
-
\??\c:\jvvpp.exec:\jvvpp.exe102⤵PID:2088
-
\??\c:\fxlfrrf.exec:\fxlfrrf.exe103⤵PID:1384
-
\??\c:\lfxffrf.exec:\lfxffrf.exe104⤵PID:1420
-
\??\c:\bhthth.exec:\bhthth.exe105⤵PID:920
-
\??\c:\dpvvd.exec:\dpvvd.exe106⤵PID:3020
-
\??\c:\pjjjd.exec:\pjjjd.exe107⤵PID:2076
-
\??\c:\xlfrxfx.exec:\xlfrxfx.exe108⤵PID:1944
-
\??\c:\hhbhbb.exec:\hhbhbb.exe109⤵PID:768
-
\??\c:\btnthh.exec:\btnthh.exe110⤵PID:2252
-
\??\c:\5jdjp.exec:\5jdjp.exe111⤵PID:2832
-
\??\c:\5rllrrx.exec:\5rllrrx.exe112⤵PID:1864
-
\??\c:\xrllrrf.exec:\xrllrrf.exe113⤵PID:1224
-
\??\c:\thtttn.exec:\thtttn.exe114⤵PID:1936
-
\??\c:\jdvdp.exec:\jdvdp.exe115⤵PID:888
-
\??\c:\9jdvp.exec:\9jdvp.exe116⤵PID:996
-
\??\c:\rrflxxl.exec:\rrflxxl.exe117⤵PID:2916
-
\??\c:\thnhtt.exec:\thnhtt.exe118⤵PID:2516
-
\??\c:\nnhnbh.exec:\nnhnbh.exe119⤵PID:2060
-
\??\c:\7ddjd.exec:\7ddjd.exe120⤵PID:2612
-
\??\c:\xrrxflr.exec:\xrrxflr.exe121⤵PID:2716
-
\??\c:\thnhhh.exec:\thnhhh.exe122⤵PID:2772
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-