Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 20:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0a81d6de9a73518776e3c141cd3f17e0_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0a81d6de9a73518776e3c141cd3f17e0_NeikiAnalytics.exe
-
Size
64KB
-
MD5
0a81d6de9a73518776e3c141cd3f17e0
-
SHA1
00583453fc75b583c5dca7a87887fa6f4e1bb345
-
SHA256
f67e3022b39d951607d0f7ad6047d931091f9e1dfb8851ac98bc7142d0e51fcd
-
SHA512
ca528e304bf1e7cb4608ef52064b464acae017baf5fae7d1c2fd8966eba5cd5baadedf355f67bb02a80c7c4bf303b8fad8885d610fc8644c42bc37dfd5aae42f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIhJm/wk:ymb3NkkiQ3mdBjFILmT
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2180-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-82-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2876-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3008-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1960-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2508-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2280-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/484-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1844-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1636-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/548-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2388 ppdjv.exe 2632 7hbhnt.exe 2748 pjdvp.exe 2672 vpdjv.exe 2724 tnhnbb.exe 2676 5nbbhh.exe 2548 jdvvj.exe 3024 xrflxfx.exe 1644 bbbbbt.exe 2876 9btbnn.exe 3008 pjvdv.exe 2524 vvdvv.exe 1964 7xrrffl.exe 1960 hhtbhh.exe 2508 bbnthh.exe 2804 7vjjj.exe 2148 xxxfffr.exe 1236 htnnbh.exe 2280 nhbbhn.exe 2908 vpjdj.exe 2968 lfrrflr.exe 484 lfrlxxl.exe 1308 nthnnh.exe 2348 jvjpj.exe 2488 vpdpd.exe 1348 lrxfrrx.exe 1844 tbhttb.exe 1636 7pdvv.exe 1996 ffxlrlx.exe 548 rfrrffl.exe 1740 hbhtht.exe 3004 bthhtb.exe 2380 jpdjp.exe 1596 fxflrrl.exe 1248 fxffllr.exe 3044 btnthh.exe 2764 ntbtbb.exe 2100 dvvdd.exe 2936 vddjd.exe 2564 rlrrlrx.exe 2224 1lllrrf.exe 2536 bbhnnn.exe 2616 5bttnh.exe 2588 ppdjj.exe 3016 pvjdj.exe 2888 frffrrf.exe 2896 9rxlfrr.exe 1152 bhhnhb.exe 376 vpdjp.exe 2524 1ddjj.exe 2020 llrxfrl.exe 1616 lrxllxx.exe 2784 9thtbn.exe 2820 pdjpp.exe 1508 pjvdj.exe 2156 xrfflrl.exe 2312 ffrxflr.exe 2960 5hbhnn.exe 1408 9ddjp.exe 2908 5dvdd.exe 1160 lxrrxxl.exe 1316 3bbtnb.exe 988 nthhhh.exe 2308 jvppd.exe -
resource yara_rule behavioral1/memory/2180-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1960-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/484-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1844-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1636-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/548-289-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2180 wrote to memory of 2388 2180 0a81d6de9a73518776e3c141cd3f17e0_NeikiAnalytics.exe 28 PID 2180 wrote to memory of 2388 2180 0a81d6de9a73518776e3c141cd3f17e0_NeikiAnalytics.exe 28 PID 2180 wrote to memory of 2388 2180 0a81d6de9a73518776e3c141cd3f17e0_NeikiAnalytics.exe 28 PID 2180 wrote to memory of 2388 2180 0a81d6de9a73518776e3c141cd3f17e0_NeikiAnalytics.exe 28 PID 2388 wrote to memory of 2632 2388 ppdjv.exe 29 PID 2388 wrote to memory of 2632 2388 ppdjv.exe 29 PID 2388 wrote to memory of 2632 2388 ppdjv.exe 29 PID 2388 wrote to memory of 2632 2388 ppdjv.exe 29 PID 2632 wrote to memory of 2748 2632 7hbhnt.exe 30 PID 2632 wrote to memory of 2748 2632 7hbhnt.exe 30 PID 2632 wrote to memory of 2748 2632 7hbhnt.exe 30 PID 2632 wrote to memory of 2748 2632 7hbhnt.exe 30 PID 2748 wrote to memory of 2672 2748 pjdvp.exe 31 PID 2748 wrote to memory of 2672 2748 pjdvp.exe 31 PID 2748 wrote to memory of 2672 2748 pjdvp.exe 31 PID 2748 wrote to memory of 2672 2748 pjdvp.exe 31 PID 2672 wrote to memory of 2724 2672 vpdjv.exe 32 PID 2672 wrote to memory of 2724 2672 vpdjv.exe 32 PID 2672 wrote to memory of 2724 2672 vpdjv.exe 32 PID 2672 wrote to memory of 2724 2672 vpdjv.exe 32 PID 2724 wrote to memory of 2676 2724 tnhnbb.exe 33 PID 2724 wrote to memory of 2676 2724 tnhnbb.exe 33 PID 2724 wrote to memory of 2676 2724 tnhnbb.exe 33 PID 2724 wrote to memory of 2676 2724 tnhnbb.exe 33 PID 2676 wrote to memory of 2548 2676 5nbbhh.exe 34 PID 2676 wrote to memory of 2548 2676 5nbbhh.exe 34 PID 2676 wrote to memory of 2548 2676 5nbbhh.exe 34 PID 2676 wrote to memory of 2548 2676 5nbbhh.exe 34 PID 2548 wrote to memory of 3024 2548 jdvvj.exe 35 PID 2548 wrote to memory of 3024 2548 jdvvj.exe 35 PID 2548 wrote to memory of 3024 2548 jdvvj.exe 35 PID 2548 wrote to memory of 3024 2548 jdvvj.exe 35 PID 3024 wrote to memory of 1644 3024 xrflxfx.exe 36 PID 3024 wrote to memory of 1644 3024 xrflxfx.exe 36 PID 3024 wrote to memory of 1644 3024 xrflxfx.exe 36 PID 3024 wrote to memory of 1644 3024 xrflxfx.exe 36 PID 1644 wrote to memory of 2876 1644 bbbbbt.exe 37 PID 1644 wrote to memory of 2876 1644 bbbbbt.exe 37 PID 1644 wrote to memory of 2876 1644 bbbbbt.exe 37 PID 1644 wrote to memory of 2876 1644 bbbbbt.exe 37 PID 2876 wrote to memory of 3008 2876 9btbnn.exe 38 PID 2876 wrote to memory of 3008 2876 9btbnn.exe 38 PID 2876 wrote to memory of 3008 2876 9btbnn.exe 38 PID 2876 wrote to memory of 3008 2876 9btbnn.exe 38 PID 3008 wrote to memory of 2524 3008 pjvdv.exe 39 PID 3008 wrote to memory of 2524 3008 pjvdv.exe 39 PID 3008 wrote to memory of 2524 3008 pjvdv.exe 39 PID 3008 wrote to memory of 2524 3008 pjvdv.exe 39 PID 2524 wrote to memory of 1964 2524 vvdvv.exe 40 PID 2524 wrote to memory of 1964 2524 vvdvv.exe 40 PID 2524 wrote to memory of 1964 2524 vvdvv.exe 40 PID 2524 wrote to memory of 1964 2524 vvdvv.exe 40 PID 1964 wrote to memory of 1960 1964 7xrrffl.exe 41 PID 1964 wrote to memory of 1960 1964 7xrrffl.exe 41 PID 1964 wrote to memory of 1960 1964 7xrrffl.exe 41 PID 1964 wrote to memory of 1960 1964 7xrrffl.exe 41 PID 1960 wrote to memory of 2508 1960 hhtbhh.exe 42 PID 1960 wrote to memory of 2508 1960 hhtbhh.exe 42 PID 1960 wrote to memory of 2508 1960 hhtbhh.exe 42 PID 1960 wrote to memory of 2508 1960 hhtbhh.exe 42 PID 2508 wrote to memory of 2804 2508 bbnthh.exe 43 PID 2508 wrote to memory of 2804 2508 bbnthh.exe 43 PID 2508 wrote to memory of 2804 2508 bbnthh.exe 43 PID 2508 wrote to memory of 2804 2508 bbnthh.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a81d6de9a73518776e3c141cd3f17e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0a81d6de9a73518776e3c141cd3f17e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\ppdjv.exec:\ppdjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\7hbhnt.exec:\7hbhnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\pjdvp.exec:\pjdvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\vpdjv.exec:\vpdjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\tnhnbb.exec:\tnhnbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\5nbbhh.exec:\5nbbhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\jdvvj.exec:\jdvvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\xrflxfx.exec:\xrflxfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\bbbbbt.exec:\bbbbbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\9btbnn.exec:\9btbnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\pjvdv.exec:\pjvdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\vvdvv.exec:\vvdvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\7xrrffl.exec:\7xrrffl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\hhtbhh.exec:\hhtbhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\bbnthh.exec:\bbnthh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\7vjjj.exec:\7vjjj.exe17⤵
- Executes dropped EXE
PID:2804 -
\??\c:\xxxfffr.exec:\xxxfffr.exe18⤵
- Executes dropped EXE
PID:2148 -
\??\c:\htnnbh.exec:\htnnbh.exe19⤵
- Executes dropped EXE
PID:1236 -
\??\c:\nhbbhn.exec:\nhbbhn.exe20⤵
- Executes dropped EXE
PID:2280 -
\??\c:\vpjdj.exec:\vpjdj.exe21⤵
- Executes dropped EXE
PID:2908 -
\??\c:\lfrrflr.exec:\lfrrflr.exe22⤵
- Executes dropped EXE
PID:2968 -
\??\c:\lfrlxxl.exec:\lfrlxxl.exe23⤵
- Executes dropped EXE
PID:484 -
\??\c:\nthnnh.exec:\nthnnh.exe24⤵
- Executes dropped EXE
PID:1308 -
\??\c:\jvjpj.exec:\jvjpj.exe25⤵
- Executes dropped EXE
PID:2348 -
\??\c:\vpdpd.exec:\vpdpd.exe26⤵
- Executes dropped EXE
PID:2488 -
\??\c:\lrxfrrx.exec:\lrxfrrx.exe27⤵
- Executes dropped EXE
PID:1348 -
\??\c:\tbhttb.exec:\tbhttb.exe28⤵
- Executes dropped EXE
PID:1844 -
\??\c:\7pdvv.exec:\7pdvv.exe29⤵
- Executes dropped EXE
PID:1636 -
\??\c:\ffxlrlx.exec:\ffxlrlx.exe30⤵
- Executes dropped EXE
PID:1996 -
\??\c:\rfrrffl.exec:\rfrrffl.exe31⤵
- Executes dropped EXE
PID:548 -
\??\c:\hbhtht.exec:\hbhtht.exe32⤵
- Executes dropped EXE
PID:1740 -
\??\c:\bthhtb.exec:\bthhtb.exe33⤵
- Executes dropped EXE
PID:3004 -
\??\c:\jpdjp.exec:\jpdjp.exe34⤵
- Executes dropped EXE
PID:2380 -
\??\c:\fxflrrl.exec:\fxflrrl.exe35⤵
- Executes dropped EXE
PID:1596 -
\??\c:\fxffllr.exec:\fxffllr.exe36⤵
- Executes dropped EXE
PID:1248 -
\??\c:\btnthh.exec:\btnthh.exe37⤵
- Executes dropped EXE
PID:3044 -
\??\c:\ntbtbb.exec:\ntbtbb.exe38⤵
- Executes dropped EXE
PID:2764 -
\??\c:\dvvdd.exec:\dvvdd.exe39⤵
- Executes dropped EXE
PID:2100 -
\??\c:\vddjd.exec:\vddjd.exe40⤵
- Executes dropped EXE
PID:2936 -
\??\c:\rlrrlrx.exec:\rlrrlrx.exe41⤵
- Executes dropped EXE
PID:2564 -
\??\c:\1lllrrf.exec:\1lllrrf.exe42⤵
- Executes dropped EXE
PID:2224 -
\??\c:\bbhnnn.exec:\bbhnnn.exe43⤵
- Executes dropped EXE
PID:2536 -
\??\c:\5bttnh.exec:\5bttnh.exe44⤵
- Executes dropped EXE
PID:2616 -
\??\c:\ppdjj.exec:\ppdjj.exe45⤵
- Executes dropped EXE
PID:2588 -
\??\c:\pvjdj.exec:\pvjdj.exe46⤵
- Executes dropped EXE
PID:3016 -
\??\c:\frffrrf.exec:\frffrrf.exe47⤵
- Executes dropped EXE
PID:2888 -
\??\c:\9rxlfrr.exec:\9rxlfrr.exe48⤵
- Executes dropped EXE
PID:2896 -
\??\c:\bhhnhb.exec:\bhhnhb.exe49⤵
- Executes dropped EXE
PID:1152 -
\??\c:\vpdjp.exec:\vpdjp.exe50⤵
- Executes dropped EXE
PID:376 -
\??\c:\1ddjj.exec:\1ddjj.exe51⤵
- Executes dropped EXE
PID:2524 -
\??\c:\llrxfrl.exec:\llrxfrl.exe52⤵
- Executes dropped EXE
PID:2020 -
\??\c:\lrxllxx.exec:\lrxllxx.exe53⤵
- Executes dropped EXE
PID:1616 -
\??\c:\9thtbn.exec:\9thtbn.exe54⤵
- Executes dropped EXE
PID:2784 -
\??\c:\pdjpp.exec:\pdjpp.exe55⤵
- Executes dropped EXE
PID:2820 -
\??\c:\pjvdj.exec:\pjvdj.exe56⤵
- Executes dropped EXE
PID:1508 -
\??\c:\xrfflrl.exec:\xrfflrl.exe57⤵
- Executes dropped EXE
PID:2156 -
\??\c:\ffrxflr.exec:\ffrxflr.exe58⤵
- Executes dropped EXE
PID:2312 -
\??\c:\5hbhnn.exec:\5hbhnn.exe59⤵
- Executes dropped EXE
PID:2960 -
\??\c:\9ddjp.exec:\9ddjp.exe60⤵
- Executes dropped EXE
PID:1408 -
\??\c:\5dvdd.exec:\5dvdd.exe61⤵
- Executes dropped EXE
PID:2908 -
\??\c:\lxrrxxl.exec:\lxrrxxl.exe62⤵
- Executes dropped EXE
PID:1160 -
\??\c:\3bbtnb.exec:\3bbtnb.exe63⤵
- Executes dropped EXE
PID:1316 -
\??\c:\nthhhh.exec:\nthhhh.exe64⤵
- Executes dropped EXE
PID:988 -
\??\c:\jvppd.exec:\jvppd.exe65⤵
- Executes dropped EXE
PID:2308 -
\??\c:\9rlrrxf.exec:\9rlrrxf.exe66⤵PID:916
-
\??\c:\xrxflrl.exec:\xrxflrl.exe67⤵PID:2488
-
\??\c:\nhtbhh.exec:\nhtbhh.exe68⤵PID:2972
-
\??\c:\9hnttt.exec:\9hnttt.exe69⤵PID:636
-
\??\c:\vjvdj.exec:\vjvdj.exe70⤵PID:1132
-
\??\c:\vvddd.exec:\vvddd.exe71⤵PID:844
-
\??\c:\lfxfrlf.exec:\lfxfrlf.exe72⤵PID:1996
-
\??\c:\5xxfrxl.exec:\5xxfrxl.exe73⤵PID:2072
-
\??\c:\3tthhb.exec:\3tthhb.exe74⤵PID:1740
-
\??\c:\thttbh.exec:\thttbh.exe75⤵PID:2164
-
\??\c:\7pjjj.exec:\7pjjj.exe76⤵PID:2356
-
\??\c:\jdjpd.exec:\jdjpd.exe77⤵PID:2352
-
\??\c:\rlxfrlx.exec:\rlxfrlx.exe78⤵PID:2096
-
\??\c:\tnttht.exec:\tnttht.exe79⤵PID:2736
-
\??\c:\hhhhth.exec:\hhhhth.exe80⤵PID:2944
-
\??\c:\7ddpj.exec:\7ddpj.exe81⤵PID:2748
-
\??\c:\1ddvd.exec:\1ddvd.exe82⤵PID:2848
-
\??\c:\lxffrxx.exec:\lxffrxx.exe83⤵PID:2812
-
\??\c:\3rxxflr.exec:\3rxxflr.exe84⤵PID:2708
-
\??\c:\bnttbh.exec:\bnttbh.exe85⤵PID:2676
-
\??\c:\9ttnth.exec:\9ttnth.exe86⤵PID:1672
-
\??\c:\pjjjv.exec:\pjjjv.exe87⤵PID:3028
-
\??\c:\vvjvj.exec:\vvjvj.exe88⤵PID:2816
-
\??\c:\fffffxl.exec:\fffffxl.exe89⤵PID:2640
-
\??\c:\ttnbbn.exec:\ttnbbn.exe90⤵PID:2996
-
\??\c:\nbthtt.exec:\nbthtt.exe91⤵PID:2484
-
\??\c:\3vjpp.exec:\3vjpp.exe92⤵PID:1756
-
\??\c:\rrrrlxr.exec:\rrrrlxr.exe93⤵PID:1220
-
\??\c:\xxrfrfl.exec:\xxrfrfl.exe94⤵PID:808
-
\??\c:\hbthtt.exec:\hbthtt.exe95⤵PID:1960
-
\??\c:\7bbbth.exec:\7bbbth.exe96⤵PID:2508
-
\??\c:\pjdvd.exec:\pjdvd.exe97⤵PID:1412
-
\??\c:\5lrxflr.exec:\5lrxflr.exe98⤵PID:1520
-
\??\c:\3lxlrfl.exec:\3lxlrfl.exe99⤵PID:2288
-
\??\c:\bhbnhn.exec:\bhbnhn.exe100⤵PID:1704
-
\??\c:\1ttnbh.exec:\1ttnbh.exe101⤵PID:2280
-
\??\c:\7pjpd.exec:\7pjpd.exe102⤵PID:1928
-
\??\c:\5lfxllr.exec:\5lfxllr.exe103⤵PID:536
-
\??\c:\1fxllrf.exec:\1fxllrf.exe104⤵PID:1036
-
\??\c:\nhntbn.exec:\nhntbn.exe105⤵PID:1104
-
\??\c:\3hnbnb.exec:\3hnbnb.exe106⤵PID:1680
-
\??\c:\pjpdv.exec:\pjpdv.exe107⤵PID:2348
-
\??\c:\3vjpv.exec:\3vjpv.exe108⤵PID:896
-
\??\c:\frxfrxl.exec:\frxfrxl.exe109⤵PID:1708
-
\??\c:\nhnbnn.exec:\nhnbnn.exe110⤵PID:1800
-
\??\c:\hhbbbt.exec:\hhbbbt.exe111⤵PID:2964
-
\??\c:\vjdpp.exec:\vjdpp.exe112⤵PID:1804
-
\??\c:\jvjjp.exec:\jvjjp.exe113⤵PID:832
-
\??\c:\lrxxrff.exec:\lrxxrff.exe114⤵PID:2128
-
\??\c:\fflrlrx.exec:\fflrlrx.exe115⤵PID:2260
-
\??\c:\hnhhth.exec:\hnhhth.exe116⤵PID:2504
-
\??\c:\dpppv.exec:\dpppv.exe117⤵PID:2220
-
\??\c:\vvvvj.exec:\vvvvj.exe118⤵PID:1604
-
\??\c:\lrxrlfl.exec:\lrxrlfl.exe119⤵PID:1600
-
\??\c:\fxrfxxf.exec:\fxrfxxf.exe120⤵PID:2092
-
\??\c:\1bntbh.exec:\1bntbh.exe121⤵PID:2684
-
\??\c:\3jppp.exec:\3jppp.exe122⤵PID:2764
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-