Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 02:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
96cf1073e1fdaa134d1e12fad5a493c0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
96cf1073e1fdaa134d1e12fad5a493c0_NeikiAnalytics.exe
-
Size
59KB
-
MD5
96cf1073e1fdaa134d1e12fad5a493c0
-
SHA1
24fcdae0065ddc8b7c3dbc6d1cdda9f5a433e956
-
SHA256
fdc5b000c41842926c4339fe20edd31b86f3cbd0ac4d93ab608338801bd37c0b
-
SHA512
7c8f4bb6124089b062ef45ecf5b78f7fdf76e43ea0804790973724322f094a07d231f5cd6697c3f9f5b4b075214e3d887677b4bb0a023fa314f6237302690961
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9Li:ymb3NkkiQ3mdBjFI9m
Malware Config
Signatures
-
Detect Blackmoon payload 18 IoCs
resource yara_rule behavioral1/memory/2936-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1532-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2396-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1500-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1612-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1484-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2268-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2240-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1736-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1152-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/944-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3024 pvpvd.exe 2900 lfxflrx.exe 2648 thhhhh.exe 1532 btbbhn.exe 2672 9vvvv.exe 2556 lflrflf.exe 2396 fxffrfx.exe 2880 hbbbhb.exe 1592 vpjpv.exe 1500 vpjjj.exe 1612 5rrxlrx.exe 2316 lxlllfr.exe 1484 tbbhbn.exe 856 jdvdj.exe 2268 xlxrflr.exe 324 fxrfrrx.exe 1552 htnnht.exe 2036 9jdpv.exe 2480 1pdvv.exe 1416 5xrxlfr.exe 2344 xlxxffl.exe 2240 nbtbnn.exe 1736 hthhnn.exe 2340 jpvvv.exe 1152 xlxrffl.exe 944 xxllrfr.exe 1620 hbnnhn.exe 928 pdjjj.exe 2072 3xlxxfl.exe 2856 btnhhh.exe 2796 nbhntb.exe 1428 pjvvd.exe 1712 lxlxflr.exe 1632 1xlxllr.exe 2568 hbnhtb.exe 2488 hthntt.exe 2632 vpjjv.exe 2748 5djdd.exe 2744 9xxfrfr.exe 2680 rfflxxf.exe 2288 nthhhb.exe 2384 nbnnbn.exe 2460 nnhtth.exe 2432 pdpjd.exe 760 ddppd.exe 1276 rlrrxrx.exe 1852 7nbtnn.exe 1012 tnbhnn.exe 2356 pddjp.exe 1544 vddpd.exe 344 5lxxxff.exe 1456 xfflxxf.exe 1660 nbnntt.exe 488 1bthbt.exe 688 dvppp.exe 2692 dpjjp.exe 2848 vjvvd.exe 2708 xxfllrl.exe 652 rlrxflr.exe 1408 9bbntt.exe 1892 bthhhh.exe 1776 jppvp.exe 812 7ddjv.exe 2564 fxxxlrf.exe -
resource yara_rule behavioral1/memory/2936-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1532-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1500-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1612-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1484-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2268-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1736-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1152-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/944-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-297-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2936 wrote to memory of 3024 2936 96cf1073e1fdaa134d1e12fad5a493c0_NeikiAnalytics.exe 28 PID 2936 wrote to memory of 3024 2936 96cf1073e1fdaa134d1e12fad5a493c0_NeikiAnalytics.exe 28 PID 2936 wrote to memory of 3024 2936 96cf1073e1fdaa134d1e12fad5a493c0_NeikiAnalytics.exe 28 PID 2936 wrote to memory of 3024 2936 96cf1073e1fdaa134d1e12fad5a493c0_NeikiAnalytics.exe 28 PID 3024 wrote to memory of 2900 3024 pvpvd.exe 29 PID 3024 wrote to memory of 2900 3024 pvpvd.exe 29 PID 3024 wrote to memory of 2900 3024 pvpvd.exe 29 PID 3024 wrote to memory of 2900 3024 pvpvd.exe 29 PID 2900 wrote to memory of 2648 2900 lfxflrx.exe 30 PID 2900 wrote to memory of 2648 2900 lfxflrx.exe 30 PID 2900 wrote to memory of 2648 2900 lfxflrx.exe 30 PID 2900 wrote to memory of 2648 2900 lfxflrx.exe 30 PID 2648 wrote to memory of 1532 2648 thhhhh.exe 31 PID 2648 wrote to memory of 1532 2648 thhhhh.exe 31 PID 2648 wrote to memory of 1532 2648 thhhhh.exe 31 PID 2648 wrote to memory of 1532 2648 thhhhh.exe 31 PID 1532 wrote to memory of 2672 1532 btbbhn.exe 32 PID 1532 wrote to memory of 2672 1532 btbbhn.exe 32 PID 1532 wrote to memory of 2672 1532 btbbhn.exe 32 PID 1532 wrote to memory of 2672 1532 btbbhn.exe 32 PID 2672 wrote to memory of 2556 2672 9vvvv.exe 33 PID 2672 wrote to memory of 2556 2672 9vvvv.exe 33 PID 2672 wrote to memory of 2556 2672 9vvvv.exe 33 PID 2672 wrote to memory of 2556 2672 9vvvv.exe 33 PID 2556 wrote to memory of 2396 2556 lflrflf.exe 34 PID 2556 wrote to memory of 2396 2556 lflrflf.exe 34 PID 2556 wrote to memory of 2396 2556 lflrflf.exe 34 PID 2556 wrote to memory of 2396 2556 lflrflf.exe 34 PID 2396 wrote to memory of 2880 2396 fxffrfx.exe 35 PID 2396 wrote to memory of 2880 2396 fxffrfx.exe 35 PID 2396 wrote to memory of 2880 2396 fxffrfx.exe 35 PID 2396 wrote to memory of 2880 2396 fxffrfx.exe 35 PID 2880 wrote to memory of 1592 2880 hbbbhb.exe 36 PID 2880 wrote to memory of 1592 2880 hbbbhb.exe 36 PID 2880 wrote to memory of 1592 2880 hbbbhb.exe 36 PID 2880 wrote to memory of 1592 2880 hbbbhb.exe 36 PID 1592 wrote to memory of 1500 1592 vpjpv.exe 37 PID 1592 wrote to memory of 1500 1592 vpjpv.exe 37 PID 1592 wrote to memory of 1500 1592 vpjpv.exe 37 PID 1592 wrote to memory of 1500 1592 vpjpv.exe 37 PID 1500 wrote to memory of 1612 1500 vpjjj.exe 38 PID 1500 wrote to memory of 1612 1500 vpjjj.exe 38 PID 1500 wrote to memory of 1612 1500 vpjjj.exe 38 PID 1500 wrote to memory of 1612 1500 vpjjj.exe 38 PID 1612 wrote to memory of 2316 1612 5rrxlrx.exe 39 PID 1612 wrote to memory of 2316 1612 5rrxlrx.exe 39 PID 1612 wrote to memory of 2316 1612 5rrxlrx.exe 39 PID 1612 wrote to memory of 2316 1612 5rrxlrx.exe 39 PID 2316 wrote to memory of 1484 2316 lxlllfr.exe 40 PID 2316 wrote to memory of 1484 2316 lxlllfr.exe 40 PID 2316 wrote to memory of 1484 2316 lxlllfr.exe 40 PID 2316 wrote to memory of 1484 2316 lxlllfr.exe 40 PID 1484 wrote to memory of 856 1484 tbbhbn.exe 41 PID 1484 wrote to memory of 856 1484 tbbhbn.exe 41 PID 1484 wrote to memory of 856 1484 tbbhbn.exe 41 PID 1484 wrote to memory of 856 1484 tbbhbn.exe 41 PID 856 wrote to memory of 2268 856 jdvdj.exe 42 PID 856 wrote to memory of 2268 856 jdvdj.exe 42 PID 856 wrote to memory of 2268 856 jdvdj.exe 42 PID 856 wrote to memory of 2268 856 jdvdj.exe 42 PID 2268 wrote to memory of 324 2268 xlxrflr.exe 43 PID 2268 wrote to memory of 324 2268 xlxrflr.exe 43 PID 2268 wrote to memory of 324 2268 xlxrflr.exe 43 PID 2268 wrote to memory of 324 2268 xlxrflr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\96cf1073e1fdaa134d1e12fad5a493c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\96cf1073e1fdaa134d1e12fad5a493c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\pvpvd.exec:\pvpvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\lfxflrx.exec:\lfxflrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\thhhhh.exec:\thhhhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\btbbhn.exec:\btbbhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\9vvvv.exec:\9vvvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\lflrflf.exec:\lflrflf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\fxffrfx.exec:\fxffrfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\hbbbhb.exec:\hbbbhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\vpjpv.exec:\vpjpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\vpjjj.exec:\vpjjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\5rrxlrx.exec:\5rrxlrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\lxlllfr.exec:\lxlllfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\tbbhbn.exec:\tbbhbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\jdvdj.exec:\jdvdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\xlxrflr.exec:\xlxrflr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\fxrfrrx.exec:\fxrfrrx.exe17⤵
- Executes dropped EXE
PID:324 -
\??\c:\htnnht.exec:\htnnht.exe18⤵
- Executes dropped EXE
PID:1552 -
\??\c:\9jdpv.exec:\9jdpv.exe19⤵
- Executes dropped EXE
PID:2036 -
\??\c:\1pdvv.exec:\1pdvv.exe20⤵
- Executes dropped EXE
PID:2480 -
\??\c:\5xrxlfr.exec:\5xrxlfr.exe21⤵
- Executes dropped EXE
PID:1416 -
\??\c:\xlxxffl.exec:\xlxxffl.exe22⤵
- Executes dropped EXE
PID:2344 -
\??\c:\nbtbnn.exec:\nbtbnn.exe23⤵
- Executes dropped EXE
PID:2240 -
\??\c:\hthhnn.exec:\hthhnn.exe24⤵
- Executes dropped EXE
PID:1736 -
\??\c:\jpvvv.exec:\jpvvv.exe25⤵
- Executes dropped EXE
PID:2340 -
\??\c:\xlxrffl.exec:\xlxrffl.exe26⤵
- Executes dropped EXE
PID:1152 -
\??\c:\xxllrfr.exec:\xxllrfr.exe27⤵
- Executes dropped EXE
PID:944 -
\??\c:\hbnnhn.exec:\hbnnhn.exe28⤵
- Executes dropped EXE
PID:1620 -
\??\c:\pdjjj.exec:\pdjjj.exe29⤵
- Executes dropped EXE
PID:928 -
\??\c:\3xlxxfl.exec:\3xlxxfl.exe30⤵
- Executes dropped EXE
PID:2072 -
\??\c:\btnhhh.exec:\btnhhh.exe31⤵
- Executes dropped EXE
PID:2856 -
\??\c:\nbhntb.exec:\nbhntb.exe32⤵
- Executes dropped EXE
PID:2796 -
\??\c:\pjvvd.exec:\pjvvd.exe33⤵
- Executes dropped EXE
PID:1428 -
\??\c:\lxlxflr.exec:\lxlxflr.exe34⤵
- Executes dropped EXE
PID:1712 -
\??\c:\1xlxllr.exec:\1xlxllr.exe35⤵
- Executes dropped EXE
PID:1632 -
\??\c:\hbnhtb.exec:\hbnhtb.exe36⤵
- Executes dropped EXE
PID:2568 -
\??\c:\hthntt.exec:\hthntt.exe37⤵
- Executes dropped EXE
PID:2488 -
\??\c:\vpjjv.exec:\vpjjv.exe38⤵
- Executes dropped EXE
PID:2632 -
\??\c:\5djdd.exec:\5djdd.exe39⤵
- Executes dropped EXE
PID:2748 -
\??\c:\9xxfrfr.exec:\9xxfrfr.exe40⤵
- Executes dropped EXE
PID:2744 -
\??\c:\rfflxxf.exec:\rfflxxf.exe41⤵
- Executes dropped EXE
PID:2680 -
\??\c:\nthhhb.exec:\nthhhb.exe42⤵
- Executes dropped EXE
PID:2288 -
\??\c:\nbnnbn.exec:\nbnnbn.exe43⤵
- Executes dropped EXE
PID:2384 -
\??\c:\nnhtth.exec:\nnhtth.exe44⤵
- Executes dropped EXE
PID:2460 -
\??\c:\pdpjd.exec:\pdpjd.exe45⤵
- Executes dropped EXE
PID:2432 -
\??\c:\ddppd.exec:\ddppd.exe46⤵
- Executes dropped EXE
PID:760 -
\??\c:\rlrrxrx.exec:\rlrrxrx.exe47⤵
- Executes dropped EXE
PID:1276 -
\??\c:\7nbtnn.exec:\7nbtnn.exe48⤵
- Executes dropped EXE
PID:1852 -
\??\c:\tnbhnn.exec:\tnbhnn.exe49⤵
- Executes dropped EXE
PID:1012 -
\??\c:\pddjp.exec:\pddjp.exe50⤵
- Executes dropped EXE
PID:2356 -
\??\c:\vddpd.exec:\vddpd.exe51⤵
- Executes dropped EXE
PID:1544 -
\??\c:\5lxxxff.exec:\5lxxxff.exe52⤵
- Executes dropped EXE
PID:344 -
\??\c:\xfflxxf.exec:\xfflxxf.exe53⤵
- Executes dropped EXE
PID:1456 -
\??\c:\nbnntt.exec:\nbnntt.exe54⤵
- Executes dropped EXE
PID:1660 -
\??\c:\1bthbt.exec:\1bthbt.exe55⤵
- Executes dropped EXE
PID:488 -
\??\c:\dvppp.exec:\dvppp.exe56⤵
- Executes dropped EXE
PID:688 -
\??\c:\dpjjp.exec:\dpjjp.exe57⤵
- Executes dropped EXE
PID:2692 -
\??\c:\vjvvd.exec:\vjvvd.exe58⤵
- Executes dropped EXE
PID:2848 -
\??\c:\xxfllrl.exec:\xxfllrl.exe59⤵
- Executes dropped EXE
PID:2708 -
\??\c:\rlrxflr.exec:\rlrxflr.exe60⤵
- Executes dropped EXE
PID:652 -
\??\c:\9bbntt.exec:\9bbntt.exe61⤵
- Executes dropped EXE
PID:1408 -
\??\c:\bthhhh.exec:\bthhhh.exe62⤵
- Executes dropped EXE
PID:1892 -
\??\c:\jppvp.exec:\jppvp.exe63⤵
- Executes dropped EXE
PID:1776 -
\??\c:\7ddjv.exec:\7ddjv.exe64⤵
- Executes dropped EXE
PID:812 -
\??\c:\fxxxlrf.exec:\fxxxlrf.exe65⤵
- Executes dropped EXE
PID:2564 -
\??\c:\lrrrxxf.exec:\lrrrxxf.exe66⤵PID:1472
-
\??\c:\bhbtbt.exec:\bhbtbt.exe67⤵PID:1324
-
\??\c:\7vjjv.exec:\7vjjv.exe68⤵PID:1972
-
\??\c:\vjpvp.exec:\vjpvp.exe69⤵PID:2084
-
\??\c:\3vvvp.exec:\3vvvp.exe70⤵PID:1600
-
\??\c:\fffflll.exec:\fffflll.exe71⤵PID:928
-
\??\c:\rlxxffr.exec:\rlxxffr.exe72⤵PID:1464
-
\??\c:\htnnhh.exec:\htnnhh.exe73⤵PID:2812
-
\??\c:\7bnhnn.exec:\7bnhnn.exe74⤵PID:1700
-
\??\c:\pppjj.exec:\pppjj.exe75⤵PID:2908
-
\??\c:\pjdjd.exec:\pjdjd.exe76⤵PID:1520
-
\??\c:\rflrxxl.exec:\rflrxxl.exe77⤵PID:1712
-
\??\c:\5rxxfrx.exec:\5rxxfrx.exe78⤵PID:1636
-
\??\c:\hbnhtt.exec:\hbnhtt.exe79⤵PID:2904
-
\??\c:\jvjjj.exec:\jvjjj.exe80⤵PID:2492
-
\??\c:\vpjpv.exec:\vpjpv.exe81⤵PID:2632
-
\??\c:\jdjjv.exec:\jdjjv.exe82⤵PID:2592
-
\??\c:\xlrrllr.exec:\xlrrllr.exe83⤵PID:2660
-
\??\c:\rlrflll.exec:\rlrflll.exe84⤵PID:2680
-
\??\c:\nhbnht.exec:\nhbnht.exe85⤵PID:2288
-
\??\c:\nhntbh.exec:\nhntbh.exe86⤵PID:2520
-
\??\c:\jjvvd.exec:\jjvvd.exe87⤵PID:2460
-
\??\c:\dvjpv.exec:\dvjpv.exe88⤵PID:3056
-
\??\c:\3xlrflf.exec:\3xlrflf.exe89⤵PID:2448
-
\??\c:\1rrxlfr.exec:\1rrxlfr.exe90⤵PID:2176
-
\??\c:\9thhnt.exec:\9thhnt.exe91⤵PID:1852
-
\??\c:\nbhbbb.exec:\nbhbbb.exe92⤵PID:2276
-
\??\c:\dvpvj.exec:\dvpvj.exe93⤵PID:2356
-
\??\c:\frllfff.exec:\frllfff.exe94⤵PID:1440
-
\??\c:\frffffl.exec:\frffffl.exe95⤵PID:344
-
\??\c:\7flrrlr.exec:\7flrrlr.exe96⤵PID:1576
-
\??\c:\tbhhhh.exec:\tbhhhh.exe97⤵PID:768
-
\??\c:\bnbnbh.exec:\bnbnbh.exe98⤵PID:788
-
\??\c:\vpvvv.exec:\vpvvv.exe99⤵PID:776
-
\??\c:\1jpdj.exec:\1jpdj.exe100⤵PID:2608
-
\??\c:\djddd.exec:\djddd.exe101⤵PID:2848
-
\??\c:\lfrrxrx.exec:\lfrrxrx.exe102⤵PID:2732
-
\??\c:\7lflrlr.exec:\7lflrlr.exe103⤵PID:652
-
\??\c:\9bbbnn.exec:\9bbbnn.exe104⤵PID:1416
-
\??\c:\1nbhhn.exec:\1nbhhn.exe105⤵PID:2052
-
\??\c:\vpjpv.exec:\vpjpv.exe106⤵PID:2216
-
\??\c:\5dpdd.exec:\5dpdd.exe107⤵PID:1732
-
\??\c:\jvpjp.exec:\jvpjp.exe108⤵PID:2484
-
\??\c:\9frrxrr.exec:\9frrxrr.exe109⤵PID:1788
-
\??\c:\lllxxxl.exec:\lllxxxl.exe110⤵PID:1676
-
\??\c:\tnhbnn.exec:\tnhbnn.exe111⤵PID:1972
-
\??\c:\vppvp.exec:\vppvp.exe112⤵PID:912
-
\??\c:\pdppv.exec:\pdppv.exe113⤵PID:1600
-
\??\c:\lrfxlfl.exec:\lrfxlfl.exe114⤵PID:2784
-
\??\c:\3fxfrlr.exec:\3fxfrlr.exe115⤵PID:2072
-
\??\c:\9bhhbt.exec:\9bhhbt.exe116⤵PID:1652
-
\??\c:\5hbtbn.exec:\5hbtbn.exe117⤵PID:1700
-
\??\c:\vddpj.exec:\vddpj.exe118⤵PID:2144
-
\??\c:\frflxxr.exec:\frflxxr.exe119⤵PID:1496
-
\??\c:\rlrflrx.exec:\rlrflrx.exe120⤵PID:2624
-
\??\c:\3tnnnn.exec:\3tnnnn.exe121⤵PID:1636
-
\??\c:\ntnbnb.exec:\ntnbnb.exe122⤵PID:2820
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-