Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 02:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
733e256ea2349a7e7546fa7a205ab280_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
733e256ea2349a7e7546fa7a205ab280_NeikiAnalytics.exe
-
Size
54KB
-
MD5
733e256ea2349a7e7546fa7a205ab280
-
SHA1
8d2f1ae0eae614d18bdbe6830e510967e250ad8a
-
SHA256
bda02be31992ffd3c2737da30b1e35ea744aae0094b6a80320f404f9c4a66389
-
SHA512
834cdaa7ec6827d156174d8e3366fcfd5425354adc068e0ef892d4ccea1399b7e467f47a405050bbf5662326a623f73bc6ecb7eeef423f0b98fd319be42459ca
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFx:ymb3NkkiQ3mdBjFIFx
Malware Config
Signatures
-
Detect Blackmoon payload 17 IoCs
resource yara_rule behavioral1/memory/2932-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2868-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1676-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1580-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1636-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1252-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1916-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1760-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3032 dpvvd.exe 2608 fxrlfrf.exe 2548 nnbnth.exe 2572 flllrlx.exe 2868 rrfxxlr.exe 2940 nhbhnt.exe 2532 5jdvj.exe 2468 dvjpp.exe 2644 xrfllrf.exe 1676 tbhhnn.exe 2844 btttnn.exe 2960 ppvdj.exe 2752 rxxlllx.exe 1580 ttnbnn.exe 1636 tnhnnb.exe 2664 9djjp.exe 2776 jjvpp.exe 1252 9lfxlfr.exe 1096 hbnbnt.exe 2120 djppj.exe 1916 ffxflfl.exe 1760 3xrxflr.exe 776 thtttt.exe 584 bbnbtt.exe 1800 jdppv.exe 1668 5pjjv.exe 2908 ffrrlff.exe 380 htnbhh.exe 1316 hbnnnh.exe 1740 5jvpp.exe 1684 dpddd.exe 812 5lrrffl.exe 768 bhnbth.exe 3024 thtntb.exe 2512 jdpdj.exe 1600 jvjpp.exe 2636 frrlrlr.exe 2624 rfxrlrx.exe 2884 btbhtt.exe 2580 hhhhhn.exe 2592 3vjjp.exe 1712 pdvvp.exe 2416 7frrxfl.exe 2492 1nbbbb.exe 2468 bbnttt.exe 3004 ddjvj.exe 2820 vpjjp.exe 2816 xlxrxfl.exe 2460 ntnbth.exe 1788 tntnbt.exe 2696 dddvv.exe 1956 ffrfflr.exe 1664 7frfxfr.exe 2488 hbntbt.exe 1652 vpdjd.exe 2776 ddvpj.exe 1276 jdpvd.exe 2252 ffflxrr.exe 2772 rxxlxxr.exe 2256 1htbhn.exe 2880 dpjpv.exe 752 1jvpp.exe 1476 rrrrxfr.exe 1172 frrxlrl.exe -
resource yara_rule behavioral1/memory/2932-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1676-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1580-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1636-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1252-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1916-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1760-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-260-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2932 wrote to memory of 3032 2932 733e256ea2349a7e7546fa7a205ab280_NeikiAnalytics.exe 28 PID 2932 wrote to memory of 3032 2932 733e256ea2349a7e7546fa7a205ab280_NeikiAnalytics.exe 28 PID 2932 wrote to memory of 3032 2932 733e256ea2349a7e7546fa7a205ab280_NeikiAnalytics.exe 28 PID 2932 wrote to memory of 3032 2932 733e256ea2349a7e7546fa7a205ab280_NeikiAnalytics.exe 28 PID 3032 wrote to memory of 2608 3032 dpvvd.exe 29 PID 3032 wrote to memory of 2608 3032 dpvvd.exe 29 PID 3032 wrote to memory of 2608 3032 dpvvd.exe 29 PID 3032 wrote to memory of 2608 3032 dpvvd.exe 29 PID 2608 wrote to memory of 2548 2608 fxrlfrf.exe 30 PID 2608 wrote to memory of 2548 2608 fxrlfrf.exe 30 PID 2608 wrote to memory of 2548 2608 fxrlfrf.exe 30 PID 2608 wrote to memory of 2548 2608 fxrlfrf.exe 30 PID 2548 wrote to memory of 2572 2548 nnbnth.exe 31 PID 2548 wrote to memory of 2572 2548 nnbnth.exe 31 PID 2548 wrote to memory of 2572 2548 nnbnth.exe 31 PID 2548 wrote to memory of 2572 2548 nnbnth.exe 31 PID 2572 wrote to memory of 2868 2572 flllrlx.exe 32 PID 2572 wrote to memory of 2868 2572 flllrlx.exe 32 PID 2572 wrote to memory of 2868 2572 flllrlx.exe 32 PID 2572 wrote to memory of 2868 2572 flllrlx.exe 32 PID 2868 wrote to memory of 2940 2868 rrfxxlr.exe 33 PID 2868 wrote to memory of 2940 2868 rrfxxlr.exe 33 PID 2868 wrote to memory of 2940 2868 rrfxxlr.exe 33 PID 2868 wrote to memory of 2940 2868 rrfxxlr.exe 33 PID 2940 wrote to memory of 2532 2940 nhbhnt.exe 34 PID 2940 wrote to memory of 2532 2940 nhbhnt.exe 34 PID 2940 wrote to memory of 2532 2940 nhbhnt.exe 34 PID 2940 wrote to memory of 2532 2940 nhbhnt.exe 34 PID 2532 wrote to memory of 2468 2532 5jdvj.exe 35 PID 2532 wrote to memory of 2468 2532 5jdvj.exe 35 PID 2532 wrote to memory of 2468 2532 5jdvj.exe 35 PID 2532 wrote to memory of 2468 2532 5jdvj.exe 35 PID 2468 wrote to memory of 2644 2468 dvjpp.exe 36 PID 2468 wrote to memory of 2644 2468 dvjpp.exe 36 PID 2468 wrote to memory of 2644 2468 dvjpp.exe 36 PID 2468 wrote to memory of 2644 2468 dvjpp.exe 36 PID 2644 wrote to memory of 1676 2644 xrfllrf.exe 37 PID 2644 wrote to memory of 1676 2644 xrfllrf.exe 37 PID 2644 wrote to memory of 1676 2644 xrfllrf.exe 37 PID 2644 wrote to memory of 1676 2644 xrfllrf.exe 37 PID 1676 wrote to memory of 2844 1676 tbhhnn.exe 38 PID 1676 wrote to memory of 2844 1676 tbhhnn.exe 38 PID 1676 wrote to memory of 2844 1676 tbhhnn.exe 38 PID 1676 wrote to memory of 2844 1676 tbhhnn.exe 38 PID 2844 wrote to memory of 2960 2844 btttnn.exe 39 PID 2844 wrote to memory of 2960 2844 btttnn.exe 39 PID 2844 wrote to memory of 2960 2844 btttnn.exe 39 PID 2844 wrote to memory of 2960 2844 btttnn.exe 39 PID 2960 wrote to memory of 2752 2960 ppvdj.exe 40 PID 2960 wrote to memory of 2752 2960 ppvdj.exe 40 PID 2960 wrote to memory of 2752 2960 ppvdj.exe 40 PID 2960 wrote to memory of 2752 2960 ppvdj.exe 40 PID 2752 wrote to memory of 1580 2752 rxxlllx.exe 41 PID 2752 wrote to memory of 1580 2752 rxxlllx.exe 41 PID 2752 wrote to memory of 1580 2752 rxxlllx.exe 41 PID 2752 wrote to memory of 1580 2752 rxxlllx.exe 41 PID 1580 wrote to memory of 1636 1580 ttnbnn.exe 42 PID 1580 wrote to memory of 1636 1580 ttnbnn.exe 42 PID 1580 wrote to memory of 1636 1580 ttnbnn.exe 42 PID 1580 wrote to memory of 1636 1580 ttnbnn.exe 42 PID 1636 wrote to memory of 2664 1636 tnhnnb.exe 43 PID 1636 wrote to memory of 2664 1636 tnhnnb.exe 43 PID 1636 wrote to memory of 2664 1636 tnhnnb.exe 43 PID 1636 wrote to memory of 2664 1636 tnhnnb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\733e256ea2349a7e7546fa7a205ab280_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\733e256ea2349a7e7546fa7a205ab280_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\dpvvd.exec:\dpvvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\fxrlfrf.exec:\fxrlfrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\nnbnth.exec:\nnbnth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\flllrlx.exec:\flllrlx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\rrfxxlr.exec:\rrfxxlr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\nhbhnt.exec:\nhbhnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\5jdvj.exec:\5jdvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\dvjpp.exec:\dvjpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\xrfllrf.exec:\xrfllrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\tbhhnn.exec:\tbhhnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\btttnn.exec:\btttnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\ppvdj.exec:\ppvdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\rxxlllx.exec:\rxxlllx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\ttnbnn.exec:\ttnbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\tnhnnb.exec:\tnhnnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\9djjp.exec:\9djjp.exe17⤵
- Executes dropped EXE
PID:2664 -
\??\c:\jjvpp.exec:\jjvpp.exe18⤵
- Executes dropped EXE
PID:2776 -
\??\c:\9lfxlfr.exec:\9lfxlfr.exe19⤵
- Executes dropped EXE
PID:1252 -
\??\c:\hbnbnt.exec:\hbnbnt.exe20⤵
- Executes dropped EXE
PID:1096 -
\??\c:\djppj.exec:\djppj.exe21⤵
- Executes dropped EXE
PID:2120 -
\??\c:\ffxflfl.exec:\ffxflfl.exe22⤵
- Executes dropped EXE
PID:1916 -
\??\c:\3xrxflr.exec:\3xrxflr.exe23⤵
- Executes dropped EXE
PID:1760 -
\??\c:\thtttt.exec:\thtttt.exe24⤵
- Executes dropped EXE
PID:776 -
\??\c:\bbnbtt.exec:\bbnbtt.exe25⤵
- Executes dropped EXE
PID:584 -
\??\c:\jdppv.exec:\jdppv.exe26⤵
- Executes dropped EXE
PID:1800 -
\??\c:\5pjjv.exec:\5pjjv.exe27⤵
- Executes dropped EXE
PID:1668 -
\??\c:\ffrrlff.exec:\ffrrlff.exe28⤵
- Executes dropped EXE
PID:2908 -
\??\c:\htnbhh.exec:\htnbhh.exe29⤵
- Executes dropped EXE
PID:380 -
\??\c:\hbnnnh.exec:\hbnnnh.exe30⤵
- Executes dropped EXE
PID:1316 -
\??\c:\5jvpp.exec:\5jvpp.exe31⤵
- Executes dropped EXE
PID:1740 -
\??\c:\dpddd.exec:\dpddd.exe32⤵
- Executes dropped EXE
PID:1684 -
\??\c:\5lrrffl.exec:\5lrrffl.exe33⤵
- Executes dropped EXE
PID:812 -
\??\c:\bhnbth.exec:\bhnbth.exe34⤵
- Executes dropped EXE
PID:768 -
\??\c:\thtntb.exec:\thtntb.exe35⤵
- Executes dropped EXE
PID:3024 -
\??\c:\jdpdj.exec:\jdpdj.exe36⤵
- Executes dropped EXE
PID:2512 -
\??\c:\jvjpp.exec:\jvjpp.exe37⤵
- Executes dropped EXE
PID:1600 -
\??\c:\frrlrlr.exec:\frrlrlr.exe38⤵
- Executes dropped EXE
PID:2636 -
\??\c:\rfxrlrx.exec:\rfxrlrx.exe39⤵
- Executes dropped EXE
PID:2624 -
\??\c:\btbhtt.exec:\btbhtt.exe40⤵
- Executes dropped EXE
PID:2884 -
\??\c:\hhhhhn.exec:\hhhhhn.exe41⤵
- Executes dropped EXE
PID:2580 -
\??\c:\3vjjp.exec:\3vjjp.exe42⤵
- Executes dropped EXE
PID:2592 -
\??\c:\pdvvp.exec:\pdvvp.exe43⤵
- Executes dropped EXE
PID:1712 -
\??\c:\7frrxfl.exec:\7frrxfl.exe44⤵
- Executes dropped EXE
PID:2416 -
\??\c:\1nbbbb.exec:\1nbbbb.exe45⤵
- Executes dropped EXE
PID:2492 -
\??\c:\bbnttt.exec:\bbnttt.exe46⤵
- Executes dropped EXE
PID:2468 -
\??\c:\ddjvj.exec:\ddjvj.exe47⤵
- Executes dropped EXE
PID:3004 -
\??\c:\vpjjp.exec:\vpjjp.exe48⤵
- Executes dropped EXE
PID:2820 -
\??\c:\xlxrxfl.exec:\xlxrxfl.exe49⤵
- Executes dropped EXE
PID:2816 -
\??\c:\ntnbth.exec:\ntnbth.exe50⤵
- Executes dropped EXE
PID:2460 -
\??\c:\tntnbt.exec:\tntnbt.exe51⤵
- Executes dropped EXE
PID:1788 -
\??\c:\dddvv.exec:\dddvv.exe52⤵
- Executes dropped EXE
PID:2696 -
\??\c:\ffrfflr.exec:\ffrfflr.exe53⤵
- Executes dropped EXE
PID:1956 -
\??\c:\7frfxfr.exec:\7frfxfr.exe54⤵
- Executes dropped EXE
PID:1664 -
\??\c:\hbntbt.exec:\hbntbt.exe55⤵
- Executes dropped EXE
PID:2488 -
\??\c:\vpdjd.exec:\vpdjd.exe56⤵
- Executes dropped EXE
PID:1652 -
\??\c:\ddvpj.exec:\ddvpj.exe57⤵
- Executes dropped EXE
PID:2776 -
\??\c:\jdpvd.exec:\jdpvd.exe58⤵
- Executes dropped EXE
PID:1276 -
\??\c:\ffflxrr.exec:\ffflxrr.exe59⤵
- Executes dropped EXE
PID:2252 -
\??\c:\rxxlxxr.exec:\rxxlxxr.exe60⤵
- Executes dropped EXE
PID:2772 -
\??\c:\1htbhn.exec:\1htbhn.exe61⤵
- Executes dropped EXE
PID:2256 -
\??\c:\dpjpv.exec:\dpjpv.exe62⤵
- Executes dropped EXE
PID:2880 -
\??\c:\1jvpp.exec:\1jvpp.exe63⤵
- Executes dropped EXE
PID:752 -
\??\c:\rrrrxfr.exec:\rrrrxfr.exe64⤵
- Executes dropped EXE
PID:1476 -
\??\c:\frrxlrl.exec:\frrxlrl.exe65⤵
- Executes dropped EXE
PID:1172 -
\??\c:\nhbnhn.exec:\nhbnhn.exe66⤵PID:3052
-
\??\c:\tbtbnt.exec:\tbtbnt.exe67⤵PID:1568
-
\??\c:\ppjvj.exec:\ppjvj.exe68⤵PID:1668
-
\??\c:\ppvpd.exec:\ppvpd.exe69⤵PID:1220
-
\??\c:\xrlrxlx.exec:\xrlrxlx.exe70⤵PID:1028
-
\??\c:\xrflrrx.exec:\xrflrrx.exe71⤵PID:1100
-
\??\c:\thnbtb.exec:\thnbtb.exe72⤵PID:1724
-
\??\c:\hbtbhn.exec:\hbtbhn.exe73⤵PID:1428
-
\??\c:\jvdvj.exec:\jvdvj.exe74⤵PID:1692
-
\??\c:\ddjpd.exec:\ddjpd.exe75⤵PID:1612
-
\??\c:\rflxlxf.exec:\rflxlxf.exe76⤵PID:2064
-
\??\c:\xflflff.exec:\xflflff.exe77⤵PID:1032
-
\??\c:\9lxfllx.exec:\9lxfllx.exe78⤵PID:1596
-
\??\c:\tnhtbh.exec:\tnhtbh.exe79⤵PID:3060
-
\??\c:\thtnnh.exec:\thtnnh.exe80⤵PID:2660
-
\??\c:\pjddd.exec:\pjddd.exe81⤵PID:2636
-
\??\c:\1vvpv.exec:\1vvpv.exe82⤵PID:2624
-
\??\c:\xfrlfrr.exec:\xfrlfrr.exe83⤵PID:2804
-
\??\c:\9lffrll.exec:\9lffrll.exe84⤵PID:2456
-
\??\c:\tntnnh.exec:\tntnnh.exe85⤵PID:2584
-
\??\c:\tnbhbb.exec:\tnbhbb.exe86⤵PID:2464
-
\??\c:\ntnntb.exec:\ntnntb.exe87⤵PID:2496
-
\??\c:\jdpjj.exec:\jdpjj.exe88⤵PID:848
-
\??\c:\jdppp.exec:\jdppp.exe89⤵PID:2644
-
\??\c:\fxxlxfx.exec:\fxxlxfx.exe90⤵PID:2964
-
\??\c:\5rfxrll.exec:\5rfxrll.exe91⤵PID:2840
-
\??\c:\7rxfrlf.exec:\7rxfrlf.exe92⤵PID:2992
-
\??\c:\ttnbth.exec:\ttnbth.exe93⤵PID:2692
-
\??\c:\thnthn.exec:\thnthn.exe94⤵PID:1772
-
\??\c:\jjppp.exec:\jjppp.exe95⤵PID:2696
-
\??\c:\3jppp.exec:\3jppp.exe96⤵PID:2480
-
\??\c:\dvpvd.exec:\dvpvd.exe97⤵PID:1664
-
\??\c:\fxfxrff.exec:\fxfxrff.exe98⤵PID:2756
-
\??\c:\3nhnbn.exec:\3nhnbn.exe99⤵PID:1812
-
\??\c:\1thhhb.exec:\1thhhb.exe100⤵PID:2000
-
\??\c:\hhttbh.exec:\hhttbh.exe101⤵PID:1320
-
\??\c:\9jppj.exec:\9jppj.exe102⤵PID:500
-
\??\c:\vdpjj.exec:\vdpjj.exe103⤵PID:1928
-
\??\c:\1ppdj.exec:\1ppdj.exe104⤵PID:672
-
\??\c:\frxrrrx.exec:\frxrrrx.exe105⤵PID:592
-
\??\c:\1rfxxrf.exec:\1rfxxrf.exe106⤵PID:272
-
\??\c:\3rxfllf.exec:\3rxfllf.exe107⤵PID:580
-
\??\c:\9tnntt.exec:\9tnntt.exe108⤵PID:2968
-
\??\c:\nnnnhn.exec:\nnnnhn.exe109⤵PID:960
-
\??\c:\9vdvv.exec:\9vdvv.exe110⤵PID:1056
-
\??\c:\pdppv.exec:\pdppv.exe111⤵PID:948
-
\??\c:\3vvjd.exec:\3vvjd.exe112⤵PID:900
-
\??\c:\lfrfxrr.exec:\lfrfxrr.exe113⤵PID:1924
-
\??\c:\fxllxxr.exec:\fxllxxr.exe114⤵PID:2344
-
\??\c:\9frxrlx.exec:\9frxrlx.exe115⤵PID:2276
-
\??\c:\nhbbhh.exec:\nhbbhh.exe116⤵PID:1684
-
\??\c:\hbhnnb.exec:\hbhnnb.exe117⤵PID:2864
-
\??\c:\thnhtb.exec:\thnhtb.exe118⤵PID:2200
-
\??\c:\jvddv.exec:\jvddv.exe119⤵PID:2064
-
\??\c:\jjjjp.exec:\jjjjp.exe120⤵PID:2112
-
\??\c:\lrfxxxf.exec:\lrfxxxf.exe121⤵PID:1596
-
\??\c:\rffxflf.exec:\rffxflf.exe122⤵PID:2640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-