Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
06-06-2024 21:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1bbfd0ca0a3151322a6522498592de10_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
1bbfd0ca0a3151322a6522498592de10_NeikiAnalytics.exe
-
Size
63KB
-
MD5
1bbfd0ca0a3151322a6522498592de10
-
SHA1
095759eeaebfcacc4e81c481d89de1fc127b28c8
-
SHA256
e863add68e6d290408035c6363bef0c9a4f2070ddc6d8f93fcc41ed306528bf9
-
SHA512
b74a4b257899ca31138070d4c1d09856c6cb60a106a58975574313ea7923e5e7573d76544473397f2f017e715e6f1a78670aa00cc49b8ebd77388f297b029b58
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIug6bL6Nf:ymb3NkkiQ3mdBjFIugph
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2184-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2236-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2236-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2288-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1068-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2224-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2216-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1452-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1588-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1844-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1516-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2184 7bttbh.exe 3052 jpddp.exe 2756 tnhbth.exe 2288 btnbnt.exe 2828 jdjpd.exe 2584 ffrflrf.exe 2580 btnbnb.exe 2764 hbntnn.exe 2032 vpjpv.exe 2788 llfrffl.exe 2880 9llxrrf.exe 2336 9nhnht.exe 1068 pjvvj.exe 2224 jvppd.exe 2216 flrlffr.exe 1452 nhttbh.exe 1588 nhntth.exe 2300 vjjjv.exe 1192 lfxfrrf.exe 3060 rrrrllx.exe 2240 htntnb.exe 744 7nhbnn.exe 1492 djjvv.exe 2576 9xfflrr.exe 1844 9nbhht.exe 1936 1bbnnn.exe 1908 pjddp.exe 2080 1jpvj.exe 1768 lrlrflx.exe 2484 thnhnh.exe 1516 dvjpv.exe 2236 xrrlrrl.exe 2380 bhbhbt.exe 2724 tnbhnt.exe 2644 1vjdp.exe 2772 vjvjv.exe 2660 5rffrrx.exe 2832 nbnbth.exe 2624 5hbhtb.exe 2824 tnhhnt.exe 2548 vvdjv.exe 2608 xxlllrf.exe 2580 rllxxff.exe 2020 bnthtb.exe 2792 nbhtth.exe 2856 3jpvd.exe 764 jvvdv.exe 2880 5xfrlrl.exe 2024 nhtbnn.exe 2424 hhthbh.exe 2496 jdpvd.exe 2404 5dpjv.exe 2204 fxlrxxx.exe 1740 1rflrrx.exe 1776 hhthtb.exe 2056 hbntbb.exe 2928 vjvvj.exe 3044 pdvvj.exe 2284 fxxfffl.exe 788 xxflrxl.exe 1500 1tthnt.exe 2052 vjvvd.exe 1792 1jdjv.exe 1752 rlflffr.exe -
resource yara_rule behavioral1/memory/2184-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1068-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2224-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1452-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1588-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1844-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1516-300-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2184 2236 1bbfd0ca0a3151322a6522498592de10_NeikiAnalytics.exe 28 PID 2236 wrote to memory of 2184 2236 1bbfd0ca0a3151322a6522498592de10_NeikiAnalytics.exe 28 PID 2236 wrote to memory of 2184 2236 1bbfd0ca0a3151322a6522498592de10_NeikiAnalytics.exe 28 PID 2236 wrote to memory of 2184 2236 1bbfd0ca0a3151322a6522498592de10_NeikiAnalytics.exe 28 PID 2184 wrote to memory of 3052 2184 7bttbh.exe 29 PID 2184 wrote to memory of 3052 2184 7bttbh.exe 29 PID 2184 wrote to memory of 3052 2184 7bttbh.exe 29 PID 2184 wrote to memory of 3052 2184 7bttbh.exe 29 PID 3052 wrote to memory of 2756 3052 jpddp.exe 30 PID 3052 wrote to memory of 2756 3052 jpddp.exe 30 PID 3052 wrote to memory of 2756 3052 jpddp.exe 30 PID 3052 wrote to memory of 2756 3052 jpddp.exe 30 PID 2756 wrote to memory of 2288 2756 tnhbth.exe 31 PID 2756 wrote to memory of 2288 2756 tnhbth.exe 31 PID 2756 wrote to memory of 2288 2756 tnhbth.exe 31 PID 2756 wrote to memory of 2288 2756 tnhbth.exe 31 PID 2288 wrote to memory of 2828 2288 btnbnt.exe 32 PID 2288 wrote to memory of 2828 2288 btnbnt.exe 32 PID 2288 wrote to memory of 2828 2288 btnbnt.exe 32 PID 2288 wrote to memory of 2828 2288 btnbnt.exe 32 PID 2828 wrote to memory of 2584 2828 jdjpd.exe 33 PID 2828 wrote to memory of 2584 2828 jdjpd.exe 33 PID 2828 wrote to memory of 2584 2828 jdjpd.exe 33 PID 2828 wrote to memory of 2584 2828 jdjpd.exe 33 PID 2584 wrote to memory of 2580 2584 ffrflrf.exe 34 PID 2584 wrote to memory of 2580 2584 ffrflrf.exe 34 PID 2584 wrote to memory of 2580 2584 ffrflrf.exe 34 PID 2584 wrote to memory of 2580 2584 ffrflrf.exe 34 PID 2580 wrote to memory of 2764 2580 btnbnb.exe 35 PID 2580 wrote to memory of 2764 2580 btnbnb.exe 35 PID 2580 wrote to memory of 2764 2580 btnbnb.exe 35 PID 2580 wrote to memory of 2764 2580 btnbnb.exe 35 PID 2764 wrote to memory of 2032 2764 hbntnn.exe 36 PID 2764 wrote to memory of 2032 2764 hbntnn.exe 36 PID 2764 wrote to memory of 2032 2764 hbntnn.exe 36 PID 2764 wrote to memory of 2032 2764 hbntnn.exe 36 PID 2032 wrote to memory of 2788 2032 vpjpv.exe 37 PID 2032 wrote to memory of 2788 2032 vpjpv.exe 37 PID 2032 wrote to memory of 2788 2032 vpjpv.exe 37 PID 2032 wrote to memory of 2788 2032 vpjpv.exe 37 PID 2788 wrote to memory of 2880 2788 llfrffl.exe 38 PID 2788 wrote to memory of 2880 2788 llfrffl.exe 38 PID 2788 wrote to memory of 2880 2788 llfrffl.exe 38 PID 2788 wrote to memory of 2880 2788 llfrffl.exe 38 PID 2880 wrote to memory of 2336 2880 9llxrrf.exe 39 PID 2880 wrote to memory of 2336 2880 9llxrrf.exe 39 PID 2880 wrote to memory of 2336 2880 9llxrrf.exe 39 PID 2880 wrote to memory of 2336 2880 9llxrrf.exe 39 PID 2336 wrote to memory of 1068 2336 9nhnht.exe 40 PID 2336 wrote to memory of 1068 2336 9nhnht.exe 40 PID 2336 wrote to memory of 1068 2336 9nhnht.exe 40 PID 2336 wrote to memory of 1068 2336 9nhnht.exe 40 PID 1068 wrote to memory of 2224 1068 pjvvj.exe 41 PID 1068 wrote to memory of 2224 1068 pjvvj.exe 41 PID 1068 wrote to memory of 2224 1068 pjvvj.exe 41 PID 1068 wrote to memory of 2224 1068 pjvvj.exe 41 PID 2224 wrote to memory of 2216 2224 jvppd.exe 42 PID 2224 wrote to memory of 2216 2224 jvppd.exe 42 PID 2224 wrote to memory of 2216 2224 jvppd.exe 42 PID 2224 wrote to memory of 2216 2224 jvppd.exe 42 PID 2216 wrote to memory of 1452 2216 flrlffr.exe 43 PID 2216 wrote to memory of 1452 2216 flrlffr.exe 43 PID 2216 wrote to memory of 1452 2216 flrlffr.exe 43 PID 2216 wrote to memory of 1452 2216 flrlffr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bbfd0ca0a3151322a6522498592de10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1bbfd0ca0a3151322a6522498592de10_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\7bttbh.exec:\7bttbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\jpddp.exec:\jpddp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\tnhbth.exec:\tnhbth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\btnbnt.exec:\btnbnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\jdjpd.exec:\jdjpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\ffrflrf.exec:\ffrflrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\btnbnb.exec:\btnbnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\hbntnn.exec:\hbntnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\vpjpv.exec:\vpjpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\llfrffl.exec:\llfrffl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\9llxrrf.exec:\9llxrrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\9nhnht.exec:\9nhnht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\pjvvj.exec:\pjvvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\jvppd.exec:\jvppd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\flrlffr.exec:\flrlffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\nhttbh.exec:\nhttbh.exe17⤵
- Executes dropped EXE
PID:1452 -
\??\c:\nhntth.exec:\nhntth.exe18⤵
- Executes dropped EXE
PID:1588 -
\??\c:\vjjjv.exec:\vjjjv.exe19⤵
- Executes dropped EXE
PID:2300 -
\??\c:\lfxfrrf.exec:\lfxfrrf.exe20⤵
- Executes dropped EXE
PID:1192 -
\??\c:\rrrrllx.exec:\rrrrllx.exe21⤵
- Executes dropped EXE
PID:3060 -
\??\c:\htntnb.exec:\htntnb.exe22⤵
- Executes dropped EXE
PID:2240 -
\??\c:\7nhbnn.exec:\7nhbnn.exe23⤵
- Executes dropped EXE
PID:744 -
\??\c:\djjvv.exec:\djjvv.exe24⤵
- Executes dropped EXE
PID:1492 -
\??\c:\9xfflrr.exec:\9xfflrr.exe25⤵
- Executes dropped EXE
PID:2576 -
\??\c:\9nbhht.exec:\9nbhht.exe26⤵
- Executes dropped EXE
PID:1844 -
\??\c:\1bbnnn.exec:\1bbnnn.exe27⤵
- Executes dropped EXE
PID:1936 -
\??\c:\pjddp.exec:\pjddp.exe28⤵
- Executes dropped EXE
PID:1908 -
\??\c:\1jpvj.exec:\1jpvj.exe29⤵
- Executes dropped EXE
PID:2080 -
\??\c:\lrlrflx.exec:\lrlrflx.exe30⤵
- Executes dropped EXE
PID:1768 -
\??\c:\thnhnh.exec:\thnhnh.exe31⤵
- Executes dropped EXE
PID:2484 -
\??\c:\dvjpv.exec:\dvjpv.exe32⤵
- Executes dropped EXE
PID:1516 -
\??\c:\xrrlrrl.exec:\xrrlrrl.exe33⤵
- Executes dropped EXE
PID:2236 -
\??\c:\bhbhbt.exec:\bhbhbt.exe34⤵
- Executes dropped EXE
PID:2380 -
\??\c:\tnbhnt.exec:\tnbhnt.exe35⤵
- Executes dropped EXE
PID:2724 -
\??\c:\1vjdp.exec:\1vjdp.exe36⤵
- Executes dropped EXE
PID:2644 -
\??\c:\vjvjv.exec:\vjvjv.exe37⤵
- Executes dropped EXE
PID:2772 -
\??\c:\5rffrrx.exec:\5rffrrx.exe38⤵
- Executes dropped EXE
PID:2660 -
\??\c:\nbnbth.exec:\nbnbth.exe39⤵
- Executes dropped EXE
PID:2832 -
\??\c:\5hbhtb.exec:\5hbhtb.exe40⤵
- Executes dropped EXE
PID:2624 -
\??\c:\tnhhnt.exec:\tnhhnt.exe41⤵
- Executes dropped EXE
PID:2824 -
\??\c:\vvdjv.exec:\vvdjv.exe42⤵
- Executes dropped EXE
PID:2548 -
\??\c:\xxlllrf.exec:\xxlllrf.exe43⤵
- Executes dropped EXE
PID:2608 -
\??\c:\rllxxff.exec:\rllxxff.exe44⤵
- Executes dropped EXE
PID:2580 -
\??\c:\bnthtb.exec:\bnthtb.exe45⤵
- Executes dropped EXE
PID:2020 -
\??\c:\nbhtth.exec:\nbhtth.exe46⤵
- Executes dropped EXE
PID:2792 -
\??\c:\3jpvd.exec:\3jpvd.exe47⤵
- Executes dropped EXE
PID:2856 -
\??\c:\jvvdv.exec:\jvvdv.exe48⤵
- Executes dropped EXE
PID:764 -
\??\c:\5xfrlrl.exec:\5xfrlrl.exe49⤵
- Executes dropped EXE
PID:2880 -
\??\c:\nhtbnn.exec:\nhtbnn.exe50⤵
- Executes dropped EXE
PID:2024 -
\??\c:\hhthbh.exec:\hhthbh.exe51⤵
- Executes dropped EXE
PID:2424 -
\??\c:\jdpvd.exec:\jdpvd.exe52⤵
- Executes dropped EXE
PID:2496 -
\??\c:\5dpjv.exec:\5dpjv.exe53⤵
- Executes dropped EXE
PID:2404 -
\??\c:\fxlrxxx.exec:\fxlrxxx.exe54⤵
- Executes dropped EXE
PID:2204 -
\??\c:\1rflrrx.exec:\1rflrrx.exe55⤵
- Executes dropped EXE
PID:1740 -
\??\c:\hhthtb.exec:\hhthtb.exe56⤵
- Executes dropped EXE
PID:1776 -
\??\c:\hbntbb.exec:\hbntbb.exe57⤵
- Executes dropped EXE
PID:2056 -
\??\c:\vjvvj.exec:\vjvvj.exe58⤵
- Executes dropped EXE
PID:2928 -
\??\c:\pdvvj.exec:\pdvvj.exe59⤵
- Executes dropped EXE
PID:3044 -
\??\c:\fxxfffl.exec:\fxxfffl.exe60⤵
- Executes dropped EXE
PID:2284 -
\??\c:\xxflrxl.exec:\xxflrxl.exe61⤵
- Executes dropped EXE
PID:788 -
\??\c:\1tthnt.exec:\1tthnt.exe62⤵
- Executes dropped EXE
PID:1500 -
\??\c:\vjvvd.exec:\vjvvd.exe63⤵
- Executes dropped EXE
PID:2052 -
\??\c:\1jdjv.exec:\1jdjv.exe64⤵
- Executes dropped EXE
PID:1792 -
\??\c:\rlflffr.exec:\rlflffr.exe65⤵
- Executes dropped EXE
PID:1752 -
\??\c:\bbhnbt.exec:\bbhnbt.exe66⤵PID:820
-
\??\c:\1nhnhn.exec:\1nhnhn.exe67⤵PID:2920
-
\??\c:\9dvjv.exec:\9dvjv.exe68⤵PID:1888
-
\??\c:\9xxxffr.exec:\9xxxffr.exe69⤵PID:2068
-
\??\c:\rxffllf.exec:\rxffllf.exe70⤵PID:2080
-
\??\c:\hbhnnn.exec:\hbhnnn.exe71⤵PID:2932
-
\??\c:\nhtbth.exec:\nhtbth.exe72⤵PID:868
-
\??\c:\ddpdj.exec:\ddpdj.exe73⤵PID:1244
-
\??\c:\1dvpp.exec:\1dvpp.exe74⤵PID:1608
-
\??\c:\lfflflr.exec:\lfflflr.exe75⤵PID:2236
-
\??\c:\5xlrflr.exec:\5xlrflr.exe76⤵PID:2840
-
\??\c:\9hbtnb.exec:\9hbtnb.exe77⤵PID:2724
-
\??\c:\bbhbnb.exec:\bbhbnb.exe78⤵PID:3052
-
\??\c:\dvjpj.exec:\dvjpj.exe79⤵PID:2772
-
\??\c:\fxrxrxf.exec:\fxrxrxf.exe80⤵PID:2816
-
\??\c:\xrrrrrr.exec:\xrrrrrr.exe81⤵PID:2288
-
\??\c:\hhthbh.exec:\hhthbh.exe82⤵PID:2648
-
\??\c:\htbnhn.exec:\htbnhn.exe83⤵PID:2824
-
\??\c:\vdvpv.exec:\vdvpv.exe84⤵PID:2980
-
\??\c:\fxrxxrf.exec:\fxrxxrf.exe85⤵PID:2608
-
\??\c:\lfrrffr.exec:\lfrrffr.exe86⤵PID:348
-
\??\c:\tnbhnn.exec:\tnbhnn.exe87⤵PID:2020
-
\??\c:\jpvpp.exec:\jpvpp.exe88⤵PID:3000
-
\??\c:\vpjdp.exec:\vpjdp.exe89⤵PID:2856
-
\??\c:\fxrxxfr.exec:\fxrxxfr.exe90⤵PID:1804
-
\??\c:\nhbhbb.exec:\nhbhbb.exe91⤵PID:2880
-
\??\c:\jjvjd.exec:\jjvjd.exe92⤵PID:1032
-
\??\c:\vjdpj.exec:\vjdpj.exe93⤵PID:2424
-
\??\c:\lfrxfll.exec:\lfrxfll.exe94⤵PID:812
-
\??\c:\9nnbnt.exec:\9nnbnt.exe95⤵PID:2404
-
\??\c:\hhbhbh.exec:\hhbhbh.exe96⤵PID:308
-
\??\c:\1dppp.exec:\1dppp.exe97⤵PID:2632
-
\??\c:\dvdjj.exec:\dvdjj.exe98⤵PID:272
-
\??\c:\rlxflxl.exec:\rlxflxl.exe99⤵PID:2056
-
\??\c:\7htbhb.exec:\7htbhb.exe100⤵PID:2444
-
\??\c:\5tbhbb.exec:\5tbhbb.exe101⤵PID:3044
-
\??\c:\7jjdv.exec:\7jjdv.exe102⤵PID:1980
-
\??\c:\5pjvj.exec:\5pjvj.exe103⤵PID:788
-
\??\c:\rrffffr.exec:\rrffffr.exe104⤵PID:1484
-
\??\c:\xxrlrrl.exec:\xxrlrrl.exe105⤵PID:2052
-
\??\c:\htbhtt.exec:\htbhtt.exe106⤵PID:2576
-
\??\c:\bbthtt.exec:\bbthtt.exe107⤵PID:1752
-
\??\c:\1djpj.exec:\1djpj.exe108⤵PID:3036
-
\??\c:\3pjpv.exec:\3pjpv.exe109⤵PID:2920
-
\??\c:\fxrlxxf.exec:\fxrlxxf.exe110⤵PID:3012
-
\??\c:\bbnttb.exec:\bbnttb.exe111⤵PID:2068
-
\??\c:\tnnthn.exec:\tnnthn.exe112⤵PID:1404
-
\??\c:\djvdv.exec:\djvdv.exe113⤵PID:2932
-
\??\c:\pdvdj.exec:\pdvdj.exe114⤵PID:2432
-
\??\c:\ffxlllx.exec:\ffxlllx.exe115⤵PID:1244
-
\??\c:\fxrrlrr.exec:\fxrrlrr.exe116⤵PID:2416
-
\??\c:\5hbhbh.exec:\5hbhbh.exe117⤵PID:2236
-
\??\c:\9ttntb.exec:\9ttntb.exe118⤵PID:2840
-
\??\c:\dvvjd.exec:\dvvjd.exe119⤵PID:2724
-
\??\c:\vpdjp.exec:\vpdjp.exe120⤵PID:3052
-
\??\c:\7rrrxxl.exec:\7rrrxxl.exe121⤵PID:2768
-
\??\c:\1rllfxl.exec:\1rllfxl.exe122⤵PID:2816
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-