Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 22:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
579f6614da2fb36b029036c4d6bbeb80_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
579f6614da2fb36b029036c4d6bbeb80_NeikiAnalytics.exe
-
Size
60KB
-
MD5
579f6614da2fb36b029036c4d6bbeb80
-
SHA1
c53b158f50c9dae512034cfc3af3b35c1bbfe1b9
-
SHA256
a312e5ed2aa6186d129f6c2e09b4dea5981483aa0ab9349bc3f092912162f69f
-
SHA512
77157094b6ed8770b2eff8d0d5e44399754348e555ec2a0a07f556db43a697b1b466b36fda50362ab35dac53f9b5600a33f7db93992f28e954201840fe33314c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+p:ymb3NkkiQ3mdBjF0y7p
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/3048-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3048-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2108-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2968-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1572-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1732-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1684-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1568-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1404-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/476-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/636-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2112-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1148-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1688-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2108 dvjjj.exe 2616 vddjp.exe 2768 nhnttb.exe 2588 jjvvd.exe 2628 vpvvp.exe 2152 rfffrfl.exe 2736 lxxxxxf.exe 2692 hbnttt.exe 2508 nbhtnh.exe 2968 jvddj.exe 752 jdvdj.exe 1572 rxrrrfl.exe 1732 rlxrrrx.exe 1684 bthtbb.exe 1640 dpppp.exe 1568 5jdvj.exe 628 5xrllrx.exe 1404 rflllrr.exe 2532 nnnntn.exe 1184 djjjv.exe 1296 jdppd.exe 476 1lxxllx.exe 636 rflxxlr.exe 2112 bthhtb.exe 1148 tthnnn.exe 952 ppjjd.exe 2408 fflrlxx.exe 692 3hbnbt.exe 2096 9nbnnn.exe 2924 dvjpp.exe 1688 1lrlrrr.exe 1832 xlfrrlx.exe 1588 9btbnn.exe 2040 ppjjv.exe 2512 rlxxxfr.exe 2252 9xlxlrf.exe 2580 ttnthb.exe 2572 9hbbtt.exe 2780 ddpdp.exe 2716 dvpvj.exe 2536 rflrffr.exe 2724 9bbhht.exe 2520 nhtbhn.exe 2324 djdpd.exe 2916 3ddpv.exe 2696 5lfrffl.exe 2320 rlxlxxl.exe 2196 ttbtnb.exe 2192 tnbhhb.exe 1732 1pjpd.exe 1672 fxrrxxl.exe 1648 frfxffl.exe 2160 htnhth.exe 2420 9nntnb.exe 628 7jpjp.exe 2720 3rfxxrf.exe 1072 fxxxflr.exe 2104 nhnntb.exe 1228 hntnbn.exe 1296 pvvvp.exe 268 jpjdd.exe 1360 rfrrxxf.exe 1496 rllxllr.exe 840 hthhtn.exe -
resource yara_rule behavioral1/memory/3048-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1572-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1732-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1684-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1568-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1404-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/476-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/636-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2112-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1148-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1688-296-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3048 wrote to memory of 2108 3048 579f6614da2fb36b029036c4d6bbeb80_NeikiAnalytics.exe 28 PID 3048 wrote to memory of 2108 3048 579f6614da2fb36b029036c4d6bbeb80_NeikiAnalytics.exe 28 PID 3048 wrote to memory of 2108 3048 579f6614da2fb36b029036c4d6bbeb80_NeikiAnalytics.exe 28 PID 3048 wrote to memory of 2108 3048 579f6614da2fb36b029036c4d6bbeb80_NeikiAnalytics.exe 28 PID 2108 wrote to memory of 2616 2108 dvjjj.exe 29 PID 2108 wrote to memory of 2616 2108 dvjjj.exe 29 PID 2108 wrote to memory of 2616 2108 dvjjj.exe 29 PID 2108 wrote to memory of 2616 2108 dvjjj.exe 29 PID 2616 wrote to memory of 2768 2616 vddjp.exe 30 PID 2616 wrote to memory of 2768 2616 vddjp.exe 30 PID 2616 wrote to memory of 2768 2616 vddjp.exe 30 PID 2616 wrote to memory of 2768 2616 vddjp.exe 30 PID 2768 wrote to memory of 2588 2768 nhnttb.exe 31 PID 2768 wrote to memory of 2588 2768 nhnttb.exe 31 PID 2768 wrote to memory of 2588 2768 nhnttb.exe 31 PID 2768 wrote to memory of 2588 2768 nhnttb.exe 31 PID 2588 wrote to memory of 2628 2588 jjvvd.exe 32 PID 2588 wrote to memory of 2628 2588 jjvvd.exe 32 PID 2588 wrote to memory of 2628 2588 jjvvd.exe 32 PID 2588 wrote to memory of 2628 2588 jjvvd.exe 32 PID 2628 wrote to memory of 2152 2628 vpvvp.exe 33 PID 2628 wrote to memory of 2152 2628 vpvvp.exe 33 PID 2628 wrote to memory of 2152 2628 vpvvp.exe 33 PID 2628 wrote to memory of 2152 2628 vpvvp.exe 33 PID 2152 wrote to memory of 2736 2152 rfffrfl.exe 34 PID 2152 wrote to memory of 2736 2152 rfffrfl.exe 34 PID 2152 wrote to memory of 2736 2152 rfffrfl.exe 34 PID 2152 wrote to memory of 2736 2152 rfffrfl.exe 34 PID 2736 wrote to memory of 2692 2736 lxxxxxf.exe 35 PID 2736 wrote to memory of 2692 2736 lxxxxxf.exe 35 PID 2736 wrote to memory of 2692 2736 lxxxxxf.exe 35 PID 2736 wrote to memory of 2692 2736 lxxxxxf.exe 35 PID 2692 wrote to memory of 2508 2692 hbnttt.exe 36 PID 2692 wrote to memory of 2508 2692 hbnttt.exe 36 PID 2692 wrote to memory of 2508 2692 hbnttt.exe 36 PID 2692 wrote to memory of 2508 2692 hbnttt.exe 36 PID 2508 wrote to memory of 2968 2508 nbhtnh.exe 37 PID 2508 wrote to memory of 2968 2508 nbhtnh.exe 37 PID 2508 wrote to memory of 2968 2508 nbhtnh.exe 37 PID 2508 wrote to memory of 2968 2508 nbhtnh.exe 37 PID 2968 wrote to memory of 752 2968 jvddj.exe 38 PID 2968 wrote to memory of 752 2968 jvddj.exe 38 PID 2968 wrote to memory of 752 2968 jvddj.exe 38 PID 2968 wrote to memory of 752 2968 jvddj.exe 38 PID 752 wrote to memory of 1572 752 jdvdj.exe 39 PID 752 wrote to memory of 1572 752 jdvdj.exe 39 PID 752 wrote to memory of 1572 752 jdvdj.exe 39 PID 752 wrote to memory of 1572 752 jdvdj.exe 39 PID 1572 wrote to memory of 1732 1572 rxrrrfl.exe 40 PID 1572 wrote to memory of 1732 1572 rxrrrfl.exe 40 PID 1572 wrote to memory of 1732 1572 rxrrrfl.exe 40 PID 1572 wrote to memory of 1732 1572 rxrrrfl.exe 40 PID 1732 wrote to memory of 1684 1732 rlxrrrx.exe 41 PID 1732 wrote to memory of 1684 1732 rlxrrrx.exe 41 PID 1732 wrote to memory of 1684 1732 rlxrrrx.exe 41 PID 1732 wrote to memory of 1684 1732 rlxrrrx.exe 41 PID 1684 wrote to memory of 1640 1684 bthtbb.exe 42 PID 1684 wrote to memory of 1640 1684 bthtbb.exe 42 PID 1684 wrote to memory of 1640 1684 bthtbb.exe 42 PID 1684 wrote to memory of 1640 1684 bthtbb.exe 42 PID 1640 wrote to memory of 1568 1640 dpppp.exe 43 PID 1640 wrote to memory of 1568 1640 dpppp.exe 43 PID 1640 wrote to memory of 1568 1640 dpppp.exe 43 PID 1640 wrote to memory of 1568 1640 dpppp.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\579f6614da2fb36b029036c4d6bbeb80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\579f6614da2fb36b029036c4d6bbeb80_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\dvjjj.exec:\dvjjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\vddjp.exec:\vddjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\nhnttb.exec:\nhnttb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\jjvvd.exec:\jjvvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\vpvvp.exec:\vpvvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\rfffrfl.exec:\rfffrfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\lxxxxxf.exec:\lxxxxxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\hbnttt.exec:\hbnttt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\nbhtnh.exec:\nbhtnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\jvddj.exec:\jvddj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\jdvdj.exec:\jdvdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\rxrrrfl.exec:\rxrrrfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\rlxrrrx.exec:\rlxrrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\bthtbb.exec:\bthtbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\dpppp.exec:\dpppp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\5jdvj.exec:\5jdvj.exe17⤵
- Executes dropped EXE
PID:1568 -
\??\c:\5xrllrx.exec:\5xrllrx.exe18⤵
- Executes dropped EXE
PID:628 -
\??\c:\rflllrr.exec:\rflllrr.exe19⤵
- Executes dropped EXE
PID:1404 -
\??\c:\nnnntn.exec:\nnnntn.exe20⤵
- Executes dropped EXE
PID:2532 -
\??\c:\djjjv.exec:\djjjv.exe21⤵
- Executes dropped EXE
PID:1184 -
\??\c:\jdppd.exec:\jdppd.exe22⤵
- Executes dropped EXE
PID:1296 -
\??\c:\1lxxllx.exec:\1lxxllx.exe23⤵
- Executes dropped EXE
PID:476 -
\??\c:\rflxxlr.exec:\rflxxlr.exe24⤵
- Executes dropped EXE
PID:636 -
\??\c:\bthhtb.exec:\bthhtb.exe25⤵
- Executes dropped EXE
PID:2112 -
\??\c:\tthnnn.exec:\tthnnn.exe26⤵
- Executes dropped EXE
PID:1148 -
\??\c:\ppjjd.exec:\ppjjd.exe27⤵
- Executes dropped EXE
PID:952 -
\??\c:\fflrlxx.exec:\fflrlxx.exe28⤵
- Executes dropped EXE
PID:2408 -
\??\c:\3hbnbt.exec:\3hbnbt.exe29⤵
- Executes dropped EXE
PID:692 -
\??\c:\9nbnnn.exec:\9nbnnn.exe30⤵
- Executes dropped EXE
PID:2096 -
\??\c:\dvjpp.exec:\dvjpp.exe31⤵
- Executes dropped EXE
PID:2924 -
\??\c:\1lrlrrr.exec:\1lrlrrr.exe32⤵
- Executes dropped EXE
PID:1688 -
\??\c:\xlfrrlx.exec:\xlfrrlx.exe33⤵
- Executes dropped EXE
PID:1832 -
\??\c:\9btbnn.exec:\9btbnn.exe34⤵
- Executes dropped EXE
PID:1588 -
\??\c:\ppjjv.exec:\ppjjv.exe35⤵
- Executes dropped EXE
PID:2040 -
\??\c:\rlxxxfr.exec:\rlxxxfr.exe36⤵
- Executes dropped EXE
PID:2512 -
\??\c:\9xlxlrf.exec:\9xlxlrf.exe37⤵
- Executes dropped EXE
PID:2252 -
\??\c:\ttnthb.exec:\ttnthb.exe38⤵
- Executes dropped EXE
PID:2580 -
\??\c:\9hbbtt.exec:\9hbbtt.exe39⤵
- Executes dropped EXE
PID:2572 -
\??\c:\ddpdp.exec:\ddpdp.exe40⤵
- Executes dropped EXE
PID:2780 -
\??\c:\dvpvj.exec:\dvpvj.exe41⤵
- Executes dropped EXE
PID:2716 -
\??\c:\rflrffr.exec:\rflrffr.exe42⤵
- Executes dropped EXE
PID:2536 -
\??\c:\9bbhht.exec:\9bbhht.exe43⤵
- Executes dropped EXE
PID:2724 -
\??\c:\nhtbhn.exec:\nhtbhn.exe44⤵
- Executes dropped EXE
PID:2520 -
\??\c:\djdpd.exec:\djdpd.exe45⤵
- Executes dropped EXE
PID:2324 -
\??\c:\3ddpv.exec:\3ddpv.exe46⤵
- Executes dropped EXE
PID:2916 -
\??\c:\5lfrffl.exec:\5lfrffl.exe47⤵
- Executes dropped EXE
PID:2696 -
\??\c:\rlxlxxl.exec:\rlxlxxl.exe48⤵
- Executes dropped EXE
PID:2320 -
\??\c:\ttbtnb.exec:\ttbtnb.exe49⤵
- Executes dropped EXE
PID:2196 -
\??\c:\tnbhhb.exec:\tnbhhb.exe50⤵
- Executes dropped EXE
PID:2192 -
\??\c:\1pjpd.exec:\1pjpd.exe51⤵
- Executes dropped EXE
PID:1732 -
\??\c:\fxrrxxl.exec:\fxrrxxl.exe52⤵
- Executes dropped EXE
PID:1672 -
\??\c:\frfxffl.exec:\frfxffl.exe53⤵
- Executes dropped EXE
PID:1648 -
\??\c:\htnhth.exec:\htnhth.exe54⤵
- Executes dropped EXE
PID:2160 -
\??\c:\9nntnb.exec:\9nntnb.exe55⤵
- Executes dropped EXE
PID:2420 -
\??\c:\7jpjp.exec:\7jpjp.exe56⤵
- Executes dropped EXE
PID:628 -
\??\c:\3rfxxrf.exec:\3rfxxrf.exe57⤵
- Executes dropped EXE
PID:2720 -
\??\c:\fxxxflr.exec:\fxxxflr.exe58⤵
- Executes dropped EXE
PID:1072 -
\??\c:\nhnntb.exec:\nhnntb.exe59⤵
- Executes dropped EXE
PID:2104 -
\??\c:\hntnbn.exec:\hntnbn.exe60⤵
- Executes dropped EXE
PID:1228 -
\??\c:\pvvvp.exec:\pvvvp.exe61⤵
- Executes dropped EXE
PID:1296 -
\??\c:\jpjdd.exec:\jpjdd.exe62⤵
- Executes dropped EXE
PID:268 -
\??\c:\rfrrxxf.exec:\rfrrxxf.exe63⤵
- Executes dropped EXE
PID:1360 -
\??\c:\rllxllr.exec:\rllxllr.exe64⤵
- Executes dropped EXE
PID:1496 -
\??\c:\hthhtn.exec:\hthhtn.exe65⤵
- Executes dropped EXE
PID:840 -
\??\c:\btbbhh.exec:\btbbhh.exe66⤵PID:1620
-
\??\c:\3dpdd.exec:\3dpdd.exe67⤵PID:1768
-
\??\c:\vjvdp.exec:\vjvdp.exe68⤵PID:1172
-
\??\c:\fxlfrrx.exec:\fxlfrrx.exe69⤵PID:1100
-
\??\c:\hbhnbb.exec:\hbhnbb.exe70⤵PID:564
-
\??\c:\5bnbhh.exec:\5bnbhh.exe71⤵PID:2096
-
\??\c:\jvvjp.exec:\jvvjp.exe72⤵PID:1060
-
\??\c:\vjdjp.exec:\vjdjp.exe73⤵PID:876
-
\??\c:\lrfrrxf.exec:\lrfrrxf.exe74⤵PID:2896
-
\??\c:\rlxfxxl.exec:\rlxfxxl.exe75⤵PID:1560
-
\??\c:\hbhhhh.exec:\hbhhhh.exe76⤵PID:2140
-
\??\c:\btbbnh.exec:\btbbnh.exe77⤵PID:2040
-
\??\c:\3vppv.exec:\3vppv.exe78⤵PID:2616
-
\??\c:\jpjjj.exec:\jpjjj.exe79⤵PID:2252
-
\??\c:\frxlxrx.exec:\frxlxrx.exe80⤵PID:2792
-
\??\c:\bthnbn.exec:\bthnbn.exe81⤵PID:2572
-
\??\c:\vpvvj.exec:\vpvvj.exe82⤵PID:2584
-
\??\c:\pvvjp.exec:\pvvjp.exe83⤵PID:2600
-
\??\c:\5flrxff.exec:\5flrxff.exe84⤵PID:2436
-
\??\c:\xlllrlr.exec:\xlllrlr.exe85⤵PID:2724
-
\??\c:\7hhbnh.exec:\7hhbnh.exe86⤵PID:2692
-
\??\c:\nhbbbt.exec:\nhbbbt.exe87⤵PID:3060
-
\??\c:\jjdjd.exec:\jjdjd.exe88⤵PID:2852
-
\??\c:\dpjjd.exec:\dpjjd.exe89⤵PID:756
-
\??\c:\llxllxl.exec:\llxllxl.exe90⤵PID:1736
-
\??\c:\7lrrxrx.exec:\7lrrxrx.exe91⤵PID:1572
-
\??\c:\hbnhnt.exec:\hbnhnt.exe92⤵PID:1200
-
\??\c:\btbhtb.exec:\btbhtb.exe93⤵PID:328
-
\??\c:\pjjvj.exec:\pjjvj.exe94⤵PID:2404
-
\??\c:\vpvvp.exec:\vpvvp.exe95⤵PID:1608
-
\??\c:\1rlxrrf.exec:\1rlxrrf.exe96⤵PID:1452
-
\??\c:\xxrfxxr.exec:\xxrfxxr.exe97⤵PID:1552
-
\??\c:\lxlxrrx.exec:\lxlxrrx.exe98⤵PID:2076
-
\??\c:\tnnnbb.exec:\tnnnbb.exe99⤵PID:2720
-
\??\c:\9btbhn.exec:\9btbhn.exe100⤵PID:1092
-
\??\c:\pjvpd.exec:\pjvpd.exe101⤵PID:2064
-
\??\c:\dvdpv.exec:\dvdpv.exe102⤵PID:2224
-
\??\c:\xrflxrx.exec:\xrflxrx.exe103⤵PID:1460
-
\??\c:\xrlrrxx.exec:\xrlrrxx.exe104⤵PID:1888
-
\??\c:\rrlrflr.exec:\rrlrflr.exe105⤵PID:1860
-
\??\c:\1bthnt.exec:\1bthnt.exe106⤵PID:1600
-
\??\c:\jdpdp.exec:\jdpdp.exe107⤵PID:2396
-
\??\c:\dpvpv.exec:\dpvpv.exe108⤵PID:1756
-
\??\c:\rlrrffl.exec:\rlrrffl.exe109⤵PID:1752
-
\??\c:\llffxfl.exec:\llffxfl.exe110⤵PID:1456
-
\??\c:\rxllrrf.exec:\rxllrrf.exe111⤵PID:608
-
\??\c:\5htbnn.exec:\5htbnn.exe112⤵PID:2980
-
\??\c:\hbtbbb.exec:\hbtbbb.exe113⤵PID:1016
-
\??\c:\vvvjp.exec:\vvvjp.exe114⤵PID:1696
-
\??\c:\vjjjv.exec:\vjjjv.exe115⤵PID:1152
-
\??\c:\llxfrxf.exec:\llxfrxf.exe116⤵PID:1844
-
\??\c:\llxrlff.exec:\llxrlff.exe117⤵PID:2860
-
\??\c:\nhnbth.exec:\nhnbth.exe118⤵PID:1448
-
\??\c:\nnbnht.exec:\nnbnht.exe119⤵PID:2940
-
\??\c:\jvpdj.exec:\jvpdj.exe120⤵PID:2256
-
\??\c:\vpvdv.exec:\vpvdv.exe121⤵PID:2624
-
\??\c:\5fxlxfx.exec:\5fxlxfx.exe122⤵PID:2440
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-