Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
31-05-2024 20:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7f4bb024edda2b324c8c66345dc662c0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
7f4bb024edda2b324c8c66345dc662c0_NeikiAnalytics.exe
-
Size
93KB
-
MD5
7f4bb024edda2b324c8c66345dc662c0
-
SHA1
eac039c2ec1f76194277cea6584b9a92894b17fc
-
SHA256
1cfbc47565f530bcccf69ef02e628d64d1d79fdaf5a3bb007d88ab31c6a14252
-
SHA512
0b1c056fe465a41262b7d43f2e174a893958bc7481a00c26f71adb6f656c2f534fb8c50affab3380aaa2eee284377da87878549edd38952d56ca368cd928587d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo7NANTBuQG1np24+2OX6:ymb3NkkiQ3mdBjFo7NguQG1n0US6
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2368-8-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2368-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1580-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1580-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-70-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-92-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2440-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1644-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/568-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2956-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1924-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1556-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2216-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1580 jdppj.exe 2596 frrxflr.exe 2916 tnbhnn.exe 2900 tnnnhb.exe 2880 7vpdv.exe 2636 rlxxlfr.exe 2496 tnhnbh.exe 2440 xlxlfxf.exe 2804 hbnthn.exe 2856 vdjjd.exe 2976 xxrxxlr.exe 1644 7hbtbh.exe 1824 3bnhbh.exe 1372 pvvjj.exe 568 3pdvv.exe 1540 7rfxlxl.exe 1400 bbbnhb.exe 2040 1nbbbb.exe 2956 7vjpd.exe 2096 xlxrrrf.exe 1904 xxrfxlf.exe 1924 tnbhtb.exe 2928 pjjpj.exe 1472 jdjdp.exe 300 xrfflxf.exe 824 3hnbhh.exe 944 vppvp.exe 2268 xxrfrff.exe 1556 thtntt.exe 2216 ntnbnb.exe 340 vpjpv.exe 2368 9rxfrfr.exe 2416 nhtbhn.exe 1516 1vpjv.exe 2708 jjdpj.exe 1604 ffrfxff.exe 2760 rrlxffr.exe 2500 3nhnhb.exe 2568 bbhtbb.exe 2520 pvjdd.exe 2476 9lfxllx.exe 3004 1fxrflx.exe 2524 nhbhtt.exe 2792 nhnnbh.exe 2868 jjddj.exe 2864 9dvpv.exe 2664 3frfxfl.exe 2668 nbhhnh.exe 1644 ttntnt.exe 1220 ddvjp.exe 1828 9vjpv.exe 976 lflrxfr.exe 568 rfrxlrf.exe 2768 tnthtb.exe 3012 9dvjp.exe 2024 3vppv.exe 1976 lfrxlrf.exe 1892 xxllrrl.exe 1992 nhttnt.exe 2192 tthtnh.exe 1772 jddvd.exe 1108 5pjdj.exe 2052 rrlrxlx.exe 1544 bnbhnn.exe -
resource yara_rule behavioral1/memory/2368-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1580-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1644-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/568-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2956-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-290-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2368 wrote to memory of 1580 2368 7f4bb024edda2b324c8c66345dc662c0_NeikiAnalytics.exe 28 PID 2368 wrote to memory of 1580 2368 7f4bb024edda2b324c8c66345dc662c0_NeikiAnalytics.exe 28 PID 2368 wrote to memory of 1580 2368 7f4bb024edda2b324c8c66345dc662c0_NeikiAnalytics.exe 28 PID 2368 wrote to memory of 1580 2368 7f4bb024edda2b324c8c66345dc662c0_NeikiAnalytics.exe 28 PID 1580 wrote to memory of 2596 1580 jdppj.exe 29 PID 1580 wrote to memory of 2596 1580 jdppj.exe 29 PID 1580 wrote to memory of 2596 1580 jdppj.exe 29 PID 1580 wrote to memory of 2596 1580 jdppj.exe 29 PID 2596 wrote to memory of 2916 2596 frrxflr.exe 30 PID 2596 wrote to memory of 2916 2596 frrxflr.exe 30 PID 2596 wrote to memory of 2916 2596 frrxflr.exe 30 PID 2596 wrote to memory of 2916 2596 frrxflr.exe 30 PID 2916 wrote to memory of 2900 2916 tnbhnn.exe 31 PID 2916 wrote to memory of 2900 2916 tnbhnn.exe 31 PID 2916 wrote to memory of 2900 2916 tnbhnn.exe 31 PID 2916 wrote to memory of 2900 2916 tnbhnn.exe 31 PID 2900 wrote to memory of 2880 2900 tnnnhb.exe 32 PID 2900 wrote to memory of 2880 2900 tnnnhb.exe 32 PID 2900 wrote to memory of 2880 2900 tnnnhb.exe 32 PID 2900 wrote to memory of 2880 2900 tnnnhb.exe 32 PID 2880 wrote to memory of 2636 2880 7vpdv.exe 33 PID 2880 wrote to memory of 2636 2880 7vpdv.exe 33 PID 2880 wrote to memory of 2636 2880 7vpdv.exe 33 PID 2880 wrote to memory of 2636 2880 7vpdv.exe 33 PID 2636 wrote to memory of 2496 2636 rlxxlfr.exe 34 PID 2636 wrote to memory of 2496 2636 rlxxlfr.exe 34 PID 2636 wrote to memory of 2496 2636 rlxxlfr.exe 34 PID 2636 wrote to memory of 2496 2636 rlxxlfr.exe 34 PID 2496 wrote to memory of 2440 2496 tnhnbh.exe 35 PID 2496 wrote to memory of 2440 2496 tnhnbh.exe 35 PID 2496 wrote to memory of 2440 2496 tnhnbh.exe 35 PID 2496 wrote to memory of 2440 2496 tnhnbh.exe 35 PID 2440 wrote to memory of 2804 2440 xlxlfxf.exe 36 PID 2440 wrote to memory of 2804 2440 xlxlfxf.exe 36 PID 2440 wrote to memory of 2804 2440 xlxlfxf.exe 36 PID 2440 wrote to memory of 2804 2440 xlxlfxf.exe 36 PID 2804 wrote to memory of 2856 2804 hbnthn.exe 37 PID 2804 wrote to memory of 2856 2804 hbnthn.exe 37 PID 2804 wrote to memory of 2856 2804 hbnthn.exe 37 PID 2804 wrote to memory of 2856 2804 hbnthn.exe 37 PID 2856 wrote to memory of 2976 2856 vdjjd.exe 38 PID 2856 wrote to memory of 2976 2856 vdjjd.exe 38 PID 2856 wrote to memory of 2976 2856 vdjjd.exe 38 PID 2856 wrote to memory of 2976 2856 vdjjd.exe 38 PID 2976 wrote to memory of 1644 2976 xxrxxlr.exe 39 PID 2976 wrote to memory of 1644 2976 xxrxxlr.exe 39 PID 2976 wrote to memory of 1644 2976 xxrxxlr.exe 39 PID 2976 wrote to memory of 1644 2976 xxrxxlr.exe 39 PID 1644 wrote to memory of 1824 1644 7hbtbh.exe 40 PID 1644 wrote to memory of 1824 1644 7hbtbh.exe 40 PID 1644 wrote to memory of 1824 1644 7hbtbh.exe 40 PID 1644 wrote to memory of 1824 1644 7hbtbh.exe 40 PID 1824 wrote to memory of 1372 1824 3bnhbh.exe 41 PID 1824 wrote to memory of 1372 1824 3bnhbh.exe 41 PID 1824 wrote to memory of 1372 1824 3bnhbh.exe 41 PID 1824 wrote to memory of 1372 1824 3bnhbh.exe 41 PID 1372 wrote to memory of 568 1372 pvvjj.exe 42 PID 1372 wrote to memory of 568 1372 pvvjj.exe 42 PID 1372 wrote to memory of 568 1372 pvvjj.exe 42 PID 1372 wrote to memory of 568 1372 pvvjj.exe 42 PID 568 wrote to memory of 1540 568 3pdvv.exe 43 PID 568 wrote to memory of 1540 568 3pdvv.exe 43 PID 568 wrote to memory of 1540 568 3pdvv.exe 43 PID 568 wrote to memory of 1540 568 3pdvv.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f4bb024edda2b324c8c66345dc662c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7f4bb024edda2b324c8c66345dc662c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\jdppj.exec:\jdppj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\frrxflr.exec:\frrxflr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\tnbhnn.exec:\tnbhnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\tnnnhb.exec:\tnnnhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\7vpdv.exec:\7vpdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\rlxxlfr.exec:\rlxxlfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\tnhnbh.exec:\tnhnbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\xlxlfxf.exec:\xlxlfxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\hbnthn.exec:\hbnthn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\vdjjd.exec:\vdjjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\xxrxxlr.exec:\xxrxxlr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\7hbtbh.exec:\7hbtbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\3bnhbh.exec:\3bnhbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\pvvjj.exec:\pvvjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\3pdvv.exec:\3pdvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\7rfxlxl.exec:\7rfxlxl.exe17⤵
- Executes dropped EXE
PID:1540 -
\??\c:\bbbnhb.exec:\bbbnhb.exe18⤵
- Executes dropped EXE
PID:1400 -
\??\c:\1nbbbb.exec:\1nbbbb.exe19⤵
- Executes dropped EXE
PID:2040 -
\??\c:\7vjpd.exec:\7vjpd.exe20⤵
- Executes dropped EXE
PID:2956 -
\??\c:\xlxrrrf.exec:\xlxrrrf.exe21⤵
- Executes dropped EXE
PID:2096 -
\??\c:\xxrfxlf.exec:\xxrfxlf.exe22⤵
- Executes dropped EXE
PID:1904 -
\??\c:\tnbhtb.exec:\tnbhtb.exe23⤵
- Executes dropped EXE
PID:1924 -
\??\c:\pjjpj.exec:\pjjpj.exe24⤵
- Executes dropped EXE
PID:2928 -
\??\c:\jdjdp.exec:\jdjdp.exe25⤵
- Executes dropped EXE
PID:1472 -
\??\c:\xrfflxf.exec:\xrfflxf.exe26⤵
- Executes dropped EXE
PID:300 -
\??\c:\3hnbhh.exec:\3hnbhh.exe27⤵
- Executes dropped EXE
PID:824 -
\??\c:\vppvp.exec:\vppvp.exe28⤵
- Executes dropped EXE
PID:944 -
\??\c:\xxrfrff.exec:\xxrfrff.exe29⤵
- Executes dropped EXE
PID:2268 -
\??\c:\thtntt.exec:\thtntt.exe30⤵
- Executes dropped EXE
PID:1556 -
\??\c:\ntnbnb.exec:\ntnbnb.exe31⤵
- Executes dropped EXE
PID:2216 -
\??\c:\vpjpv.exec:\vpjpv.exe32⤵
- Executes dropped EXE
PID:340 -
\??\c:\9rxfrfr.exec:\9rxfrfr.exe33⤵
- Executes dropped EXE
PID:2368 -
\??\c:\nhtbhn.exec:\nhtbhn.exe34⤵
- Executes dropped EXE
PID:2416 -
\??\c:\1vpjv.exec:\1vpjv.exe35⤵
- Executes dropped EXE
PID:1516 -
\??\c:\jjdpj.exec:\jjdpj.exe36⤵
- Executes dropped EXE
PID:2708 -
\??\c:\ffrfxff.exec:\ffrfxff.exe37⤵
- Executes dropped EXE
PID:1604 -
\??\c:\rrlxffr.exec:\rrlxffr.exe38⤵
- Executes dropped EXE
PID:2760 -
\??\c:\3nhnhb.exec:\3nhnhb.exe39⤵
- Executes dropped EXE
PID:2500 -
\??\c:\bbhtbb.exec:\bbhtbb.exe40⤵
- Executes dropped EXE
PID:2568 -
\??\c:\pvjdd.exec:\pvjdd.exe41⤵
- Executes dropped EXE
PID:2520 -
\??\c:\9lfxllx.exec:\9lfxllx.exe42⤵
- Executes dropped EXE
PID:2476 -
\??\c:\1fxrflx.exec:\1fxrflx.exe43⤵
- Executes dropped EXE
PID:3004 -
\??\c:\nhbhtt.exec:\nhbhtt.exe44⤵
- Executes dropped EXE
PID:2524 -
\??\c:\nhnnbh.exec:\nhnnbh.exe45⤵
- Executes dropped EXE
PID:2792 -
\??\c:\jjddj.exec:\jjddj.exe46⤵
- Executes dropped EXE
PID:2868 -
\??\c:\9dvpv.exec:\9dvpv.exe47⤵
- Executes dropped EXE
PID:2864 -
\??\c:\3frfxfl.exec:\3frfxfl.exe48⤵
- Executes dropped EXE
PID:2664 -
\??\c:\nbhhnh.exec:\nbhhnh.exe49⤵
- Executes dropped EXE
PID:2668 -
\??\c:\ttntnt.exec:\ttntnt.exe50⤵
- Executes dropped EXE
PID:1644 -
\??\c:\ddvjp.exec:\ddvjp.exe51⤵
- Executes dropped EXE
PID:1220 -
\??\c:\9vjpv.exec:\9vjpv.exe52⤵
- Executes dropped EXE
PID:1828 -
\??\c:\lflrxfr.exec:\lflrxfr.exe53⤵
- Executes dropped EXE
PID:976 -
\??\c:\rfrxlrf.exec:\rfrxlrf.exe54⤵
- Executes dropped EXE
PID:568 -
\??\c:\tnthtb.exec:\tnthtb.exe55⤵
- Executes dropped EXE
PID:2768 -
\??\c:\9dvjp.exec:\9dvjp.exe56⤵
- Executes dropped EXE
PID:3012 -
\??\c:\3vppv.exec:\3vppv.exe57⤵
- Executes dropped EXE
PID:2024 -
\??\c:\lfrxlrf.exec:\lfrxlrf.exe58⤵
- Executes dropped EXE
PID:1976 -
\??\c:\xxllrrl.exec:\xxllrrl.exe59⤵
- Executes dropped EXE
PID:1892 -
\??\c:\nhttnt.exec:\nhttnt.exe60⤵
- Executes dropped EXE
PID:1992 -
\??\c:\tthtnh.exec:\tthtnh.exe61⤵
- Executes dropped EXE
PID:2192 -
\??\c:\jddvd.exec:\jddvd.exe62⤵
- Executes dropped EXE
PID:1772 -
\??\c:\5pjdj.exec:\5pjdj.exe63⤵
- Executes dropped EXE
PID:1108 -
\??\c:\rrlrxlx.exec:\rrlrxlx.exe64⤵
- Executes dropped EXE
PID:2052 -
\??\c:\bnbhnn.exec:\bnbhnn.exe65⤵
- Executes dropped EXE
PID:1544 -
\??\c:\tbbtht.exec:\tbbtht.exe66⤵PID:3060
-
\??\c:\dvpdj.exec:\dvpdj.exe67⤵PID:844
-
\??\c:\vddvv.exec:\vddvv.exe68⤵PID:2108
-
\??\c:\xrrfrrf.exec:\xrrfrrf.exe69⤵PID:2400
-
\??\c:\lxlrxrf.exec:\lxlrxrf.exe70⤵PID:2000
-
\??\c:\tbbnbh.exec:\tbbnbh.exe71⤵PID:2788
-
\??\c:\pjvdp.exec:\pjvdp.exe72⤵PID:1656
-
\??\c:\dvddj.exec:\dvddj.exe73⤵PID:992
-
\??\c:\lxxrxlr.exec:\lxxrxlr.exe74⤵PID:1608
-
\??\c:\rlxxflr.exec:\rlxxflr.exe75⤵PID:2696
-
\??\c:\9thnbn.exec:\9thnbn.exe76⤵PID:2416
-
\??\c:\bhnbbh.exec:\bhnbbh.exe77⤵PID:2704
-
\??\c:\7dpvj.exec:\7dpvj.exe78⤵PID:2700
-
\??\c:\jdjjp.exec:\jdjjp.exe79⤵PID:2060
-
\??\c:\xxrlrrx.exec:\xxrlrrx.exe80⤵PID:2760
-
\??\c:\1xrrflx.exec:\1xrrflx.exe81⤵PID:2356
-
\??\c:\7nnhnt.exec:\7nnhnt.exe82⤵PID:2568
-
\??\c:\5nbhhn.exec:\5nbhhn.exe83⤵PID:2532
-
\??\c:\vjppp.exec:\vjppp.exe84⤵PID:2476
-
\??\c:\vpjpd.exec:\vpjpd.exe85⤵PID:2204
-
\??\c:\3xxxflr.exec:\3xxxflr.exe86⤵PID:2524
-
\??\c:\llllrxl.exec:\llllrxl.exe87⤵PID:2840
-
\??\c:\hbnnnh.exec:\hbnnnh.exe88⤵PID:2868
-
\??\c:\htbhhb.exec:\htbhhb.exe89⤵PID:836
-
\??\c:\3vpjd.exec:\3vpjd.exe90⤵PID:2664
-
\??\c:\dpjvv.exec:\dpjvv.exe91⤵PID:2668
-
\??\c:\lfrrrrx.exec:\lfrrrrx.exe92⤵PID:1644
-
\??\c:\lfxxffr.exec:\lfxxffr.exe93⤵PID:1664
-
\??\c:\tnbhbh.exec:\tnbhbh.exe94⤵PID:1828
-
\??\c:\nnbhnt.exec:\nnbhnt.exe95⤵PID:976
-
\??\c:\djvpv.exec:\djvpv.exe96⤵PID:568
-
\??\c:\vpvvv.exec:\vpvvv.exe97⤵PID:3040
-
\??\c:\5fflflf.exec:\5fflflf.exe98⤵PID:2028
-
\??\c:\fxlrflr.exec:\fxlrflr.exe99⤵PID:2504
-
\??\c:\bbtttt.exec:\bbtttt.exe100⤵PID:1976
-
\??\c:\ttbhnt.exec:\ttbhnt.exe101⤵PID:1892
-
\??\c:\pjdvd.exec:\pjdvd.exe102⤵PID:1992
-
\??\c:\ddvjj.exec:\ddvjj.exe103⤵PID:2920
-
\??\c:\vpddd.exec:\vpddd.exe104⤵PID:1292
-
\??\c:\llllxxf.exec:\llllxxf.exe105⤵PID:1568
-
\??\c:\bbhbnt.exec:\bbhbnt.exe106⤵PID:2052
-
\??\c:\djdpj.exec:\djdpj.exe107⤵PID:3056
-
\??\c:\3pddd.exec:\3pddd.exe108⤵PID:916
-
\??\c:\xrffxfr.exec:\xrffxfr.exe109⤵PID:556
-
\??\c:\xrllrlx.exec:\xrllrlx.exe110⤵PID:2108
-
\??\c:\7bbbth.exec:\7bbbth.exe111⤵PID:2332
-
\??\c:\5nnbbt.exec:\5nnbbt.exe112⤵PID:2000
-
\??\c:\ddddj.exec:\ddddj.exe113⤵PID:1888
-
\??\c:\vpdpv.exec:\vpdpv.exe114⤵PID:1656
-
\??\c:\rrrfxrx.exec:\rrrfxrx.exe115⤵PID:2432
-
\??\c:\xxxlrxl.exec:\xxxlrxl.exe116⤵PID:2560
-
\??\c:\xxlrxfr.exec:\xxlrxfr.exe117⤵PID:2124
-
\??\c:\nnhnbh.exec:\nnhnbh.exe118⤵PID:2416
-
\??\c:\9nhnbb.exec:\9nhnbb.exe119⤵PID:2624
-
\??\c:\pdvdp.exec:\pdvdp.exe120⤵PID:2724
-
\??\c:\jjdjp.exec:\jjdjp.exe121⤵PID:2672
-
\??\c:\fffrffr.exec:\fffrffr.exe122⤵PID:2760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-