Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/05/2024, 21:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
44dd4a993028693f9c236f5fa473b3e0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
44dd4a993028693f9c236f5fa473b3e0_NeikiAnalytics.exe
-
Size
94KB
-
MD5
44dd4a993028693f9c236f5fa473b3e0
-
SHA1
c005759f054200c21cc8347c5ea81bf0a0bad2ef
-
SHA256
fe8e9c1f002320cfdd77d161f1623a8198d88611d869e3b1f557a376a21e8580
-
SHA512
bdcd83153cdc34d20162686b1f5bc6086c3e0e3f023dc8e273181c82048b9961e28e0a3e6f1e91261a60ad80ba3fc547f78b5a7cb4eb5c79414a543c32dbb3e4
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qP1hvZo66Ox4oq2SQwfTQY:ymb3NkkiQ3mdBjFIj+qNhvZuHQY0Y
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2988-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1692-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2508-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2396-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1980-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/840-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/276-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1672-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1748-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/272-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/768-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1064-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1692 djjdv.exe 3036 rlrxfrf.exe 2584 3xxfllr.exe 2508 hbnbht.exe 2660 vjdpj.exe 2516 fllllll.exe 2396 hnbbbt.exe 2932 nnhthn.exe 1980 pjpdp.exe 2688 ffxxfxr.exe 2724 nhnhhb.exe 2748 pjvvj.exe 840 9dvdj.exe 276 5xxfrrx.exe 2300 bbnthh.exe 240 tntntt.exe 1672 vpdvd.exe 1748 xxlxrlf.exe 2856 3thbnn.exe 1740 7vjjp.exe 272 vpdvd.exe 536 7lfflrx.exe 768 1rflxxf.exe 1064 3tnbnb.exe 1896 hhtnth.exe 356 djvpj.exe 1576 ffxfrfr.exe 1728 thbbhh.exe 1824 5djpj.exe 2464 dvppv.exe 2916 lxfxrff.exe 1572 btthth.exe 2148 ppjdv.exe 2056 9lllfrf.exe 1560 nhtnbh.exe 2524 hbhbhn.exe 2156 dvdjv.exe 2572 llxxrxf.exe 2392 xfllflx.exe 2540 hbhtbh.exe 2640 nnhhtb.exe 2492 djdvv.exe 2516 xflffff.exe 2880 3ffrfrr.exe 2272 tttnbn.exe 1984 hbnhtn.exe 2012 dppvj.exe 2472 xrrlffx.exe 2716 3fflrrl.exe 1240 3hnnnn.exe 2204 jjvjp.exe 2184 dvpvd.exe 2188 lxrrlfx.exe 2164 fxxfxlx.exe 2160 3nhhnn.exe 1700 tnttth.exe 1764 3jvjd.exe 1748 7rrfrfx.exe 2248 3rlllrx.exe 1740 bhbnth.exe 592 hntnhh.exe 1436 vvjjv.exe 892 7jvvv.exe 1600 9llxrrf.exe -
resource yara_rule behavioral1/memory/2988-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1692-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1980-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/276-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1748-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/272-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/768-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1064-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-282-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2988 wrote to memory of 1692 2988 44dd4a993028693f9c236f5fa473b3e0_NeikiAnalytics.exe 28 PID 2988 wrote to memory of 1692 2988 44dd4a993028693f9c236f5fa473b3e0_NeikiAnalytics.exe 28 PID 2988 wrote to memory of 1692 2988 44dd4a993028693f9c236f5fa473b3e0_NeikiAnalytics.exe 28 PID 2988 wrote to memory of 1692 2988 44dd4a993028693f9c236f5fa473b3e0_NeikiAnalytics.exe 28 PID 1692 wrote to memory of 3036 1692 djjdv.exe 29 PID 1692 wrote to memory of 3036 1692 djjdv.exe 29 PID 1692 wrote to memory of 3036 1692 djjdv.exe 29 PID 1692 wrote to memory of 3036 1692 djjdv.exe 29 PID 3036 wrote to memory of 2584 3036 rlrxfrf.exe 30 PID 3036 wrote to memory of 2584 3036 rlrxfrf.exe 30 PID 3036 wrote to memory of 2584 3036 rlrxfrf.exe 30 PID 3036 wrote to memory of 2584 3036 rlrxfrf.exe 30 PID 2584 wrote to memory of 2508 2584 3xxfllr.exe 31 PID 2584 wrote to memory of 2508 2584 3xxfllr.exe 31 PID 2584 wrote to memory of 2508 2584 3xxfllr.exe 31 PID 2584 wrote to memory of 2508 2584 3xxfllr.exe 31 PID 2508 wrote to memory of 2660 2508 hbnbht.exe 32 PID 2508 wrote to memory of 2660 2508 hbnbht.exe 32 PID 2508 wrote to memory of 2660 2508 hbnbht.exe 32 PID 2508 wrote to memory of 2660 2508 hbnbht.exe 32 PID 2660 wrote to memory of 2516 2660 vjdpj.exe 33 PID 2660 wrote to memory of 2516 2660 vjdpj.exe 33 PID 2660 wrote to memory of 2516 2660 vjdpj.exe 33 PID 2660 wrote to memory of 2516 2660 vjdpj.exe 33 PID 2516 wrote to memory of 2396 2516 fllllll.exe 34 PID 2516 wrote to memory of 2396 2516 fllllll.exe 34 PID 2516 wrote to memory of 2396 2516 fllllll.exe 34 PID 2516 wrote to memory of 2396 2516 fllllll.exe 34 PID 2396 wrote to memory of 2932 2396 hnbbbt.exe 35 PID 2396 wrote to memory of 2932 2396 hnbbbt.exe 35 PID 2396 wrote to memory of 2932 2396 hnbbbt.exe 35 PID 2396 wrote to memory of 2932 2396 hnbbbt.exe 35 PID 2932 wrote to memory of 1980 2932 nnhthn.exe 36 PID 2932 wrote to memory of 1980 2932 nnhthn.exe 36 PID 2932 wrote to memory of 1980 2932 nnhthn.exe 36 PID 2932 wrote to memory of 1980 2932 nnhthn.exe 36 PID 1980 wrote to memory of 2688 1980 pjpdp.exe 37 PID 1980 wrote to memory of 2688 1980 pjpdp.exe 37 PID 1980 wrote to memory of 2688 1980 pjpdp.exe 37 PID 1980 wrote to memory of 2688 1980 pjpdp.exe 37 PID 2688 wrote to memory of 2724 2688 ffxxfxr.exe 38 PID 2688 wrote to memory of 2724 2688 ffxxfxr.exe 38 PID 2688 wrote to memory of 2724 2688 ffxxfxr.exe 38 PID 2688 wrote to memory of 2724 2688 ffxxfxr.exe 38 PID 2724 wrote to memory of 2748 2724 nhnhhb.exe 39 PID 2724 wrote to memory of 2748 2724 nhnhhb.exe 39 PID 2724 wrote to memory of 2748 2724 nhnhhb.exe 39 PID 2724 wrote to memory of 2748 2724 nhnhhb.exe 39 PID 2748 wrote to memory of 840 2748 pjvvj.exe 40 PID 2748 wrote to memory of 840 2748 pjvvj.exe 40 PID 2748 wrote to memory of 840 2748 pjvvj.exe 40 PID 2748 wrote to memory of 840 2748 pjvvj.exe 40 PID 840 wrote to memory of 276 840 9dvdj.exe 41 PID 840 wrote to memory of 276 840 9dvdj.exe 41 PID 840 wrote to memory of 276 840 9dvdj.exe 41 PID 840 wrote to memory of 276 840 9dvdj.exe 41 PID 276 wrote to memory of 2300 276 5xxfrrx.exe 42 PID 276 wrote to memory of 2300 276 5xxfrrx.exe 42 PID 276 wrote to memory of 2300 276 5xxfrrx.exe 42 PID 276 wrote to memory of 2300 276 5xxfrrx.exe 42 PID 2300 wrote to memory of 240 2300 bbnthh.exe 43 PID 2300 wrote to memory of 240 2300 bbnthh.exe 43 PID 2300 wrote to memory of 240 2300 bbnthh.exe 43 PID 2300 wrote to memory of 240 2300 bbnthh.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\44dd4a993028693f9c236f5fa473b3e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\44dd4a993028693f9c236f5fa473b3e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\djjdv.exec:\djjdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\rlrxfrf.exec:\rlrxfrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\3xxfllr.exec:\3xxfllr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\hbnbht.exec:\hbnbht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\vjdpj.exec:\vjdpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\fllllll.exec:\fllllll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\hnbbbt.exec:\hnbbbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\nnhthn.exec:\nnhthn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\pjpdp.exec:\pjpdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\ffxxfxr.exec:\ffxxfxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\nhnhhb.exec:\nhnhhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\pjvvj.exec:\pjvvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\9dvdj.exec:\9dvdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\5xxfrrx.exec:\5xxfrrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:276 -
\??\c:\bbnthh.exec:\bbnthh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\tntntt.exec:\tntntt.exe17⤵
- Executes dropped EXE
PID:240 -
\??\c:\vpdvd.exec:\vpdvd.exe18⤵
- Executes dropped EXE
PID:1672 -
\??\c:\xxlxrlf.exec:\xxlxrlf.exe19⤵
- Executes dropped EXE
PID:1748 -
\??\c:\3thbnn.exec:\3thbnn.exe20⤵
- Executes dropped EXE
PID:2856 -
\??\c:\7vjjp.exec:\7vjjp.exe21⤵
- Executes dropped EXE
PID:1740 -
\??\c:\vpdvd.exec:\vpdvd.exe22⤵
- Executes dropped EXE
PID:272 -
\??\c:\7lfflrx.exec:\7lfflrx.exe23⤵
- Executes dropped EXE
PID:536 -
\??\c:\1rflxxf.exec:\1rflxxf.exe24⤵
- Executes dropped EXE
PID:768 -
\??\c:\3tnbnb.exec:\3tnbnb.exe25⤵
- Executes dropped EXE
PID:1064 -
\??\c:\hhtnth.exec:\hhtnth.exe26⤵
- Executes dropped EXE
PID:1896 -
\??\c:\djvpj.exec:\djvpj.exe27⤵
- Executes dropped EXE
PID:356 -
\??\c:\ffxfrfr.exec:\ffxfrfr.exe28⤵
- Executes dropped EXE
PID:1576 -
\??\c:\thbbhh.exec:\thbbhh.exe29⤵
- Executes dropped EXE
PID:1728 -
\??\c:\5djpj.exec:\5djpj.exe30⤵
- Executes dropped EXE
PID:1824 -
\??\c:\dvppv.exec:\dvppv.exe31⤵
- Executes dropped EXE
PID:2464 -
\??\c:\lxfxrff.exec:\lxfxrff.exe32⤵
- Executes dropped EXE
PID:2916 -
\??\c:\btthth.exec:\btthth.exe33⤵
- Executes dropped EXE
PID:1572 -
\??\c:\ppjdv.exec:\ppjdv.exe34⤵
- Executes dropped EXE
PID:2148 -
\??\c:\9lllfrf.exec:\9lllfrf.exe35⤵
- Executes dropped EXE
PID:2056 -
\??\c:\xlfxffl.exec:\xlfxffl.exe36⤵PID:3000
-
\??\c:\nhtnbh.exec:\nhtnbh.exe37⤵
- Executes dropped EXE
PID:1560 -
\??\c:\hbhbhn.exec:\hbhbhn.exe38⤵
- Executes dropped EXE
PID:2524 -
\??\c:\dvdjv.exec:\dvdjv.exe39⤵
- Executes dropped EXE
PID:2156 -
\??\c:\llxxrxf.exec:\llxxrxf.exe40⤵
- Executes dropped EXE
PID:2572 -
\??\c:\xfllflx.exec:\xfllflx.exe41⤵
- Executes dropped EXE
PID:2392 -
\??\c:\hbhtbh.exec:\hbhtbh.exe42⤵
- Executes dropped EXE
PID:2540 -
\??\c:\nnhhtb.exec:\nnhhtb.exe43⤵
- Executes dropped EXE
PID:2640 -
\??\c:\djdvv.exec:\djdvv.exe44⤵
- Executes dropped EXE
PID:2492 -
\??\c:\xflffff.exec:\xflffff.exe45⤵
- Executes dropped EXE
PID:2516 -
\??\c:\3ffrfrr.exec:\3ffrfrr.exe46⤵
- Executes dropped EXE
PID:2880 -
\??\c:\tttnbn.exec:\tttnbn.exe47⤵
- Executes dropped EXE
PID:2272 -
\??\c:\hbnhtn.exec:\hbnhtn.exe48⤵
- Executes dropped EXE
PID:1984 -
\??\c:\dppvj.exec:\dppvj.exe49⤵
- Executes dropped EXE
PID:2012 -
\??\c:\xrrlffx.exec:\xrrlffx.exe50⤵
- Executes dropped EXE
PID:2472 -
\??\c:\3fflrrl.exec:\3fflrrl.exe51⤵
- Executes dropped EXE
PID:2716 -
\??\c:\3hnnnn.exec:\3hnnnn.exe52⤵
- Executes dropped EXE
PID:1240 -
\??\c:\jjvjp.exec:\jjvjp.exe53⤵
- Executes dropped EXE
PID:2204 -
\??\c:\dvpvd.exec:\dvpvd.exe54⤵
- Executes dropped EXE
PID:2184 -
\??\c:\lxrrlfx.exec:\lxrrlfx.exe55⤵
- Executes dropped EXE
PID:2188 -
\??\c:\fxxfxlx.exec:\fxxfxlx.exe56⤵
- Executes dropped EXE
PID:2164 -
\??\c:\3nhhnn.exec:\3nhhnn.exe57⤵
- Executes dropped EXE
PID:2160 -
\??\c:\tnttth.exec:\tnttth.exe58⤵
- Executes dropped EXE
PID:1700 -
\??\c:\3jvjd.exec:\3jvjd.exe59⤵
- Executes dropped EXE
PID:1764 -
\??\c:\7rrfrfx.exec:\7rrfrfx.exe60⤵
- Executes dropped EXE
PID:1748 -
\??\c:\3rlllrx.exec:\3rlllrx.exe61⤵
- Executes dropped EXE
PID:2248 -
\??\c:\bhbnth.exec:\bhbnth.exe62⤵
- Executes dropped EXE
PID:1740 -
\??\c:\hntnhh.exec:\hntnhh.exe63⤵
- Executes dropped EXE
PID:592 -
\??\c:\vvjjv.exec:\vvjjv.exe64⤵
- Executes dropped EXE
PID:1436 -
\??\c:\7jvvv.exec:\7jvvv.exe65⤵
- Executes dropped EXE
PID:892 -
\??\c:\9llxrrf.exec:\9llxrrf.exe66⤵
- Executes dropped EXE
PID:1600 -
\??\c:\5lflxfr.exec:\5lflxfr.exe67⤵PID:1664
-
\??\c:\tnhtbn.exec:\tnhtbn.exe68⤵PID:2964
-
\??\c:\bbtnnb.exec:\bbtnnb.exe69⤵PID:1736
-
\??\c:\djdjv.exec:\djdjv.exe70⤵PID:1304
-
\??\c:\3pdjp.exec:\3pdjp.exe71⤵PID:3064
-
\??\c:\3rlxflx.exec:\3rlxflx.exe72⤵PID:2928
-
\??\c:\7rlllxf.exec:\7rlllxf.exe73⤵PID:1376
-
\??\c:\tnbntb.exec:\tnbntb.exe74⤵PID:2664
-
\??\c:\1ttthh.exec:\1ttthh.exe75⤵PID:624
-
\??\c:\vjjjd.exec:\vjjjd.exe76⤵PID:1524
-
\??\c:\rrxrxfx.exec:\rrxrxfx.exe77⤵PID:2288
-
\??\c:\xxrfrxr.exec:\xxrfrxr.exe78⤵PID:2988
-
\??\c:\xrfllrx.exec:\xrfllrx.exe79⤵PID:820
-
\??\c:\tthhhn.exec:\tthhhn.exe80⤵PID:1556
-
\??\c:\3vvjv.exec:\3vvjv.exe81⤵PID:2252
-
\??\c:\jdvdj.exec:\jdvdj.exe82⤵PID:2652
-
\??\c:\xrxxlrx.exec:\xrxxlrx.exe83⤵PID:2592
-
\??\c:\lrlrlll.exec:\lrlrlll.exe84⤵PID:2648
-
\??\c:\nhnhbh.exec:\nhnhbh.exe85⤵PID:1284
-
\??\c:\pvvvd.exec:\pvvvd.exe86⤵PID:2644
-
\??\c:\7pdvv.exec:\7pdvv.exe87⤵PID:2424
-
\??\c:\rlxlrxf.exec:\rlxlrxf.exe88⤵PID:2384
-
\??\c:\llxfxlf.exec:\llxfxlf.exe89⤵PID:2960
-
\??\c:\hbtnht.exec:\hbtnht.exe90⤵PID:2884
-
\??\c:\dpjdv.exec:\dpjdv.exe91⤵PID:2304
-
\??\c:\jvjjj.exec:\jvjjj.exe92⤵PID:2708
-
\??\c:\fxffllr.exec:\fxffllr.exe93⤵PID:2720
-
\??\c:\xrlxfrl.exec:\xrlxfrl.exe94⤵PID:2768
-
\??\c:\hnnbhb.exec:\hnnbhb.exe95⤵PID:1808
-
\??\c:\bhnbbn.exec:\bhnbbn.exe96⤵PID:2216
-
\??\c:\pppvd.exec:\pppvd.exe97⤵PID:2024
-
\??\c:\pjjpd.exec:\pjjpd.exe98⤵PID:292
-
\??\c:\fffrlfx.exec:\fffrlfx.exe99⤵PID:2020
-
\??\c:\1rlxflr.exec:\1rlxflr.exe100⤵PID:1688
-
\??\c:\nhtnht.exec:\nhtnht.exe101⤵PID:1672
-
\??\c:\hntbbn.exec:\hntbbn.exe102⤵PID:3056
-
\??\c:\5ppvp.exec:\5ppvp.exe103⤵PID:2212
-
\??\c:\ppvjj.exec:\ppvjj.exe104⤵PID:1248
-
\??\c:\1frflxr.exec:\1frflxr.exe105⤵PID:384
-
\??\c:\fxxfrxf.exec:\fxxfrxf.exe106⤵PID:600
-
\??\c:\hthhnn.exec:\hthhnn.exe107⤵PID:480
-
\??\c:\hbtnnh.exec:\hbtnnh.exe108⤵PID:1952
-
\??\c:\1jjvd.exec:\1jjvd.exe109⤵PID:1156
-
\??\c:\rrllxlx.exec:\rrllxlx.exe110⤵PID:1844
-
\??\c:\lrllxlr.exec:\lrllxlr.exe111⤵PID:1964
-
\??\c:\5nhhnt.exec:\5nhhnt.exe112⤵PID:808
-
\??\c:\djdpv.exec:\djdpv.exe113⤵PID:2924
-
\??\c:\rlfrrxl.exec:\rlfrrxl.exe114⤵PID:568
-
\??\c:\lxfflff.exec:\lxfflff.exe115⤵PID:1160
-
\??\c:\bhnntt.exec:\bhnntt.exe116⤵PID:2192
-
\??\c:\3nhhnn.exec:\3nhhnn.exe117⤵PID:1004
-
\??\c:\ddvpp.exec:\ddvpp.exe118⤵PID:1456
-
\??\c:\1vppv.exec:\1vppv.exe119⤵PID:1784
-
\??\c:\flrflxr.exec:\flrflxr.exe120⤵PID:1788
-
\??\c:\xrlrflf.exec:\xrlrflf.exe121⤵PID:2240
-
\??\c:\bbhhbt.exec:\bbhhbt.exe122⤵PID:1676
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-