Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
11/06/2024, 21:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
057896b0f30d41dffa75ed43f6d705c0_NeikiAnalytics.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
057896b0f30d41dffa75ed43f6d705c0_NeikiAnalytics.exe
-
Size
97KB
-
MD5
057896b0f30d41dffa75ed43f6d705c0
-
SHA1
6112cae62d31a700cb740fd6141024a1f16dcca7
-
SHA256
a5d605a6b1a15743a8e046db4c9686dc60972d130af93c9191ebc7360345140b
-
SHA512
4f3907e8308fc9ab6cc4698b521b24e459c2858a3446ab49fc13f3765cee5f7dfd8fe51ead891e802a458d42936e327e998554099aacd58716184c7c6db3869c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDInWeNCYGyA2R7JxJAg8dta:ymb3NkkiQ3mdBjFIWeFGyAsJAg2a
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/1860-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2404-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1860-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2516-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1584-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1008-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2244-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1172-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1412-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2324-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2216-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2864 ttnbhn.exe 2596 7bnntb.exe 2404 vvjvj.exe 1648 9jvvd.exe 2844 rlxxlxr.exe 2376 xrllxfr.exe 2516 nnnhbn.exe 2272 jdpdd.exe 2428 nhtbhh.exe 2696 pjddp.exe 1584 fxxfrxl.exe 1008 7rflxrf.exe 2244 bthbhh.exe 344 5tnhhh.exe 1352 jdjjv.exe 1172 9xrxflr.exe 2040 xrffllx.exe 2948 ththnn.exe 1668 pjddj.exe 1728 9dpdv.exe 664 xrrxfrf.exe 1412 rlfrlrf.exe 572 ttnthn.exe 1076 tntnbb.exe 2328 7vjjv.exe 2324 xrflxxl.exe 2296 5htbth.exe 2232 nhthtb.exe 1740 jjdpd.exe 2216 1ddjv.exe 1424 llfrffr.exe 2128 3btbtt.exe 1528 hbbnnt.exe 2100 3jvvj.exe 2656 5jvdj.exe 2740 7rrrllx.exe 2616 hhbnhh.exe 3048 hbnntt.exe 2844 dvpvd.exe 2472 jdjdj.exe 2624 rlflrrl.exe 2016 9xlflfr.exe 2568 3hhntt.exe 1596 nhhntn.exe 1756 3pvvv.exe 2764 7dvdp.exe 2696 9pjdj.exe 2804 7xlxrxl.exe 2800 thbhtn.exe 1644 nbnntt.exe 1312 pjjjj.exe 836 vjdjj.exe 1352 fflrrxl.exe 2020 5rxffxl.exe 2028 nnthnt.exe 2204 btntbb.exe 2948 bthhnn.exe 1616 vpvvv.exe 492 9pddv.exe 2184 7fxxlrx.exe 380 1tnnnn.exe 756 hhtbnn.exe 572 tnbbtt.exe 1652 dvjjv.exe -
resource yara_rule behavioral1/memory/1860-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2404-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1584-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1008-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2244-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1172-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1412-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2324-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-291-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1860 wrote to memory of 2864 1860 057896b0f30d41dffa75ed43f6d705c0_NeikiAnalytics.exe 28 PID 1860 wrote to memory of 2864 1860 057896b0f30d41dffa75ed43f6d705c0_NeikiAnalytics.exe 28 PID 1860 wrote to memory of 2864 1860 057896b0f30d41dffa75ed43f6d705c0_NeikiAnalytics.exe 28 PID 1860 wrote to memory of 2864 1860 057896b0f30d41dffa75ed43f6d705c0_NeikiAnalytics.exe 28 PID 2864 wrote to memory of 2596 2864 ttnbhn.exe 29 PID 2864 wrote to memory of 2596 2864 ttnbhn.exe 29 PID 2864 wrote to memory of 2596 2864 ttnbhn.exe 29 PID 2864 wrote to memory of 2596 2864 ttnbhn.exe 29 PID 2596 wrote to memory of 2404 2596 7bnntb.exe 30 PID 2596 wrote to memory of 2404 2596 7bnntb.exe 30 PID 2596 wrote to memory of 2404 2596 7bnntb.exe 30 PID 2596 wrote to memory of 2404 2596 7bnntb.exe 30 PID 2404 wrote to memory of 1648 2404 vvjvj.exe 31 PID 2404 wrote to memory of 1648 2404 vvjvj.exe 31 PID 2404 wrote to memory of 1648 2404 vvjvj.exe 31 PID 2404 wrote to memory of 1648 2404 vvjvj.exe 31 PID 1648 wrote to memory of 2844 1648 9jvvd.exe 32 PID 1648 wrote to memory of 2844 1648 9jvvd.exe 32 PID 1648 wrote to memory of 2844 1648 9jvvd.exe 32 PID 1648 wrote to memory of 2844 1648 9jvvd.exe 32 PID 2844 wrote to memory of 2376 2844 rlxxlxr.exe 33 PID 2844 wrote to memory of 2376 2844 rlxxlxr.exe 33 PID 2844 wrote to memory of 2376 2844 rlxxlxr.exe 33 PID 2844 wrote to memory of 2376 2844 rlxxlxr.exe 33 PID 2376 wrote to memory of 2516 2376 xrllxfr.exe 34 PID 2376 wrote to memory of 2516 2376 xrllxfr.exe 34 PID 2376 wrote to memory of 2516 2376 xrllxfr.exe 34 PID 2376 wrote to memory of 2516 2376 xrllxfr.exe 34 PID 2516 wrote to memory of 2272 2516 nnnhbn.exe 35 PID 2516 wrote to memory of 2272 2516 nnnhbn.exe 35 PID 2516 wrote to memory of 2272 2516 nnnhbn.exe 35 PID 2516 wrote to memory of 2272 2516 nnnhbn.exe 35 PID 2272 wrote to memory of 2428 2272 jdpdd.exe 36 PID 2272 wrote to memory of 2428 2272 jdpdd.exe 36 PID 2272 wrote to memory of 2428 2272 jdpdd.exe 36 PID 2272 wrote to memory of 2428 2272 jdpdd.exe 36 PID 2428 wrote to memory of 2696 2428 nhtbhh.exe 37 PID 2428 wrote to memory of 2696 2428 nhtbhh.exe 37 PID 2428 wrote to memory of 2696 2428 nhtbhh.exe 37 PID 2428 wrote to memory of 2696 2428 nhtbhh.exe 37 PID 2696 wrote to memory of 1584 2696 pjddp.exe 38 PID 2696 wrote to memory of 1584 2696 pjddp.exe 38 PID 2696 wrote to memory of 1584 2696 pjddp.exe 38 PID 2696 wrote to memory of 1584 2696 pjddp.exe 38 PID 1584 wrote to memory of 1008 1584 fxxfrxl.exe 39 PID 1584 wrote to memory of 1008 1584 fxxfrxl.exe 39 PID 1584 wrote to memory of 1008 1584 fxxfrxl.exe 39 PID 1584 wrote to memory of 1008 1584 fxxfrxl.exe 39 PID 1008 wrote to memory of 2244 1008 7rflxrf.exe 40 PID 1008 wrote to memory of 2244 1008 7rflxrf.exe 40 PID 1008 wrote to memory of 2244 1008 7rflxrf.exe 40 PID 1008 wrote to memory of 2244 1008 7rflxrf.exe 40 PID 2244 wrote to memory of 344 2244 bthbhh.exe 41 PID 2244 wrote to memory of 344 2244 bthbhh.exe 41 PID 2244 wrote to memory of 344 2244 bthbhh.exe 41 PID 2244 wrote to memory of 344 2244 bthbhh.exe 41 PID 344 wrote to memory of 1352 344 5tnhhh.exe 42 PID 344 wrote to memory of 1352 344 5tnhhh.exe 42 PID 344 wrote to memory of 1352 344 5tnhhh.exe 42 PID 344 wrote to memory of 1352 344 5tnhhh.exe 42 PID 1352 wrote to memory of 1172 1352 jdjjv.exe 43 PID 1352 wrote to memory of 1172 1352 jdjjv.exe 43 PID 1352 wrote to memory of 1172 1352 jdjjv.exe 43 PID 1352 wrote to memory of 1172 1352 jdjjv.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\057896b0f30d41dffa75ed43f6d705c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\057896b0f30d41dffa75ed43f6d705c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\ttnbhn.exec:\ttnbhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\7bnntb.exec:\7bnntb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\vvjvj.exec:\vvjvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\9jvvd.exec:\9jvvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\rlxxlxr.exec:\rlxxlxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\xrllxfr.exec:\xrllxfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\nnnhbn.exec:\nnnhbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\jdpdd.exec:\jdpdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\nhtbhh.exec:\nhtbhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\pjddp.exec:\pjddp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\fxxfrxl.exec:\fxxfrxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\7rflxrf.exec:\7rflxrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\bthbhh.exec:\bthbhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\5tnhhh.exec:\5tnhhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
\??\c:\jdjjv.exec:\jdjjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\9xrxflr.exec:\9xrxflr.exe17⤵
- Executes dropped EXE
PID:1172 -
\??\c:\xrffllx.exec:\xrffllx.exe18⤵
- Executes dropped EXE
PID:2040 -
\??\c:\ththnn.exec:\ththnn.exe19⤵
- Executes dropped EXE
PID:2948 -
\??\c:\pjddj.exec:\pjddj.exe20⤵
- Executes dropped EXE
PID:1668 -
\??\c:\9dpdv.exec:\9dpdv.exe21⤵
- Executes dropped EXE
PID:1728 -
\??\c:\xrrxfrf.exec:\xrrxfrf.exe22⤵
- Executes dropped EXE
PID:664 -
\??\c:\rlfrlrf.exec:\rlfrlrf.exe23⤵
- Executes dropped EXE
PID:1412 -
\??\c:\ttnthn.exec:\ttnthn.exe24⤵
- Executes dropped EXE
PID:572 -
\??\c:\tntnbb.exec:\tntnbb.exe25⤵
- Executes dropped EXE
PID:1076 -
\??\c:\7vjjv.exec:\7vjjv.exe26⤵
- Executes dropped EXE
PID:2328 -
\??\c:\xrflxxl.exec:\xrflxxl.exe27⤵
- Executes dropped EXE
PID:2324 -
\??\c:\5htbth.exec:\5htbth.exe28⤵
- Executes dropped EXE
PID:2296 -
\??\c:\nhthtb.exec:\nhthtb.exe29⤵
- Executes dropped EXE
PID:2232 -
\??\c:\jjdpd.exec:\jjdpd.exe30⤵
- Executes dropped EXE
PID:1740 -
\??\c:\1ddjv.exec:\1ddjv.exe31⤵
- Executes dropped EXE
PID:2216 -
\??\c:\llfrffr.exec:\llfrffr.exe32⤵
- Executes dropped EXE
PID:1424 -
\??\c:\3btbtt.exec:\3btbtt.exe33⤵
- Executes dropped EXE
PID:2128 -
\??\c:\hbbnnt.exec:\hbbnnt.exe34⤵
- Executes dropped EXE
PID:1528 -
\??\c:\3jvvj.exec:\3jvvj.exe35⤵
- Executes dropped EXE
PID:2100 -
\??\c:\5jvdj.exec:\5jvdj.exe36⤵
- Executes dropped EXE
PID:2656 -
\??\c:\7rrrllx.exec:\7rrrllx.exe37⤵
- Executes dropped EXE
PID:2740 -
\??\c:\hhbnhh.exec:\hhbnhh.exe38⤵
- Executes dropped EXE
PID:2616 -
\??\c:\hbnntt.exec:\hbnntt.exe39⤵
- Executes dropped EXE
PID:3048 -
\??\c:\dvpvd.exec:\dvpvd.exe40⤵
- Executes dropped EXE
PID:2844 -
\??\c:\jdjdj.exec:\jdjdj.exe41⤵
- Executes dropped EXE
PID:2472 -
\??\c:\rlflrrl.exec:\rlflrrl.exe42⤵
- Executes dropped EXE
PID:2624 -
\??\c:\9xlflfr.exec:\9xlflfr.exe43⤵
- Executes dropped EXE
PID:2016 -
\??\c:\3hhntt.exec:\3hhntt.exe44⤵
- Executes dropped EXE
PID:2568 -
\??\c:\nhhntn.exec:\nhhntn.exe45⤵
- Executes dropped EXE
PID:1596 -
\??\c:\3pvvv.exec:\3pvvv.exe46⤵
- Executes dropped EXE
PID:1756 -
\??\c:\7dvdp.exec:\7dvdp.exe47⤵
- Executes dropped EXE
PID:2764 -
\??\c:\9pjdj.exec:\9pjdj.exe48⤵
- Executes dropped EXE
PID:2696 -
\??\c:\7xlxrxl.exec:\7xlxrxl.exe49⤵
- Executes dropped EXE
PID:2804 -
\??\c:\thbhtn.exec:\thbhtn.exe50⤵
- Executes dropped EXE
PID:2800 -
\??\c:\nbnntt.exec:\nbnntt.exe51⤵
- Executes dropped EXE
PID:1644 -
\??\c:\pjjjj.exec:\pjjjj.exe52⤵
- Executes dropped EXE
PID:1312 -
\??\c:\vjdjj.exec:\vjdjj.exe53⤵
- Executes dropped EXE
PID:836 -
\??\c:\fflrrxl.exec:\fflrrxl.exe54⤵
- Executes dropped EXE
PID:1352 -
\??\c:\5rxffxl.exec:\5rxffxl.exe55⤵
- Executes dropped EXE
PID:2020 -
\??\c:\nnthnt.exec:\nnthnt.exe56⤵
- Executes dropped EXE
PID:2028 -
\??\c:\btntbb.exec:\btntbb.exe57⤵
- Executes dropped EXE
PID:2204 -
\??\c:\bthhnn.exec:\bthhnn.exe58⤵
- Executes dropped EXE
PID:2948 -
\??\c:\vpvvv.exec:\vpvvv.exe59⤵
- Executes dropped EXE
PID:1616 -
\??\c:\9pddv.exec:\9pddv.exe60⤵
- Executes dropped EXE
PID:492 -
\??\c:\7fxxlrx.exec:\7fxxlrx.exe61⤵
- Executes dropped EXE
PID:2184 -
\??\c:\1tnnnn.exec:\1tnnnn.exe62⤵
- Executes dropped EXE
PID:380 -
\??\c:\hhtbnn.exec:\hhtbnn.exe63⤵
- Executes dropped EXE
PID:756 -
\??\c:\tnbbtt.exec:\tnbbtt.exe64⤵
- Executes dropped EXE
PID:572 -
\??\c:\dvjjv.exec:\dvjjv.exe65⤵
- Executes dropped EXE
PID:1652 -
\??\c:\vpvpd.exec:\vpvpd.exe66⤵PID:1540
-
\??\c:\9rflrfr.exec:\9rflrfr.exe67⤵PID:1672
-
\??\c:\fxrxfrx.exec:\fxrxfrx.exe68⤵PID:860
-
\??\c:\hhtbnn.exec:\hhtbnn.exe69⤵PID:2252
-
\??\c:\hhtttt.exec:\hhtttt.exe70⤵PID:2232
-
\??\c:\ddvpj.exec:\ddvpj.exe71⤵PID:2904
-
\??\c:\vjdvd.exec:\vjdvd.exe72⤵PID:2136
-
\??\c:\9xlfflx.exec:\9xlfflx.exe73⤵PID:1600
-
\??\c:\xxfxlrr.exec:\xxfxlrr.exe74⤵PID:2096
-
\??\c:\bthbnt.exec:\bthbnt.exe75⤵PID:1208
-
\??\c:\btntht.exec:\btntht.exe76⤵PID:2008
-
\??\c:\9jvvd.exec:\9jvvd.exe77⤵PID:1520
-
\??\c:\9ddjv.exec:\9ddjv.exe78⤵PID:2736
-
\??\c:\7rlxffr.exec:\7rlxffr.exe79⤵PID:2732
-
\??\c:\5xrflrf.exec:\5xrflrf.exe80⤵PID:2476
-
\??\c:\nhttbb.exec:\nhttbb.exe81⤵PID:2876
-
\??\c:\7tntbb.exec:\7tntbb.exe82⤵PID:2724
-
\??\c:\pjvjp.exec:\pjvjp.exe83⤵PID:2744
-
\??\c:\jddvv.exec:\jddvv.exe84⤵PID:2460
-
\??\c:\rrrxrxl.exec:\rrrxrxl.exe85⤵PID:2120
-
\??\c:\rrflrxf.exec:\rrflrxf.exe86⤵PID:2504
-
\??\c:\1bnntn.exec:\1bnntn.exe87⤵PID:2700
-
\??\c:\nnhnnn.exec:\nnhnnn.exe88⤵PID:2640
-
\??\c:\jdvjd.exec:\jdvjd.exe89⤵PID:2680
-
\??\c:\ppjjj.exec:\ppjjj.exe90⤵PID:1584
-
\??\c:\frffllx.exec:\frffllx.exe91⤵PID:1704
-
\??\c:\rlxxrxr.exec:\rlxxrxr.exe92⤵PID:2364
-
\??\c:\nhnhtb.exec:\nhnhtb.exe93⤵PID:2240
-
\??\c:\pjvdd.exec:\pjvdd.exe94⤵PID:1508
-
\??\c:\jvddd.exec:\jvddd.exe95⤵PID:2796
-
\??\c:\3xffllx.exec:\3xffllx.exe96⤵PID:1228
-
\??\c:\rfrrxxl.exec:\rfrrxxl.exe97⤵PID:2092
-
\??\c:\7htttb.exec:\7htttb.exe98⤵PID:2932
-
\??\c:\htbbtt.exec:\htbbtt.exe99⤵PID:1536
-
\??\c:\1vvjp.exec:\1vvjp.exe100⤵PID:1612
-
\??\c:\pjdjv.exec:\pjdjv.exe101⤵PID:764
-
\??\c:\xrllxrf.exec:\xrllxrf.exe102⤵PID:1880
-
\??\c:\rfxlrxf.exec:\rfxlrxf.exe103⤵PID:948
-
\??\c:\hhtntb.exec:\hhtntb.exe104⤵PID:1812
-
\??\c:\hbtbnt.exec:\hbtbnt.exe105⤵PID:2452
-
\??\c:\vvvjj.exec:\vvvjj.exe106⤵PID:1912
-
\??\c:\pjpvd.exec:\pjpvd.exe107⤵PID:1460
-
\??\c:\xrllrrf.exec:\xrllrrf.exe108⤵PID:984
-
\??\c:\xrfrlfl.exec:\xrfrlfl.exe109⤵PID:2324
-
\??\c:\tbbnnn.exec:\tbbnnn.exe110⤵PID:920
-
\??\c:\3nnthh.exec:\3nnthh.exe111⤵PID:3020
-
\??\c:\pjjdj.exec:\pjjdj.exe112⤵PID:1680
-
\??\c:\vvjpv.exec:\vvjpv.exe113⤵PID:1932
-
\??\c:\rrllrff.exec:\rrllrff.exe114⤵PID:2068
-
\??\c:\flrlrll.exec:\flrlrll.exe115⤵PID:1968
-
\??\c:\ttnbnb.exec:\ttnbnb.exe116⤵PID:2128
-
\??\c:\9nnnnn.exec:\9nnnnn.exe117⤵PID:1532
-
\??\c:\vjvdd.exec:\vjvdd.exe118⤵PID:2720
-
\??\c:\pdjjd.exec:\pdjjd.exe119⤵PID:2872
-
\??\c:\xrllflx.exec:\xrllflx.exe120⤵PID:2588
-
\??\c:\rfrxxrx.exec:\rfrxxrx.exe121⤵PID:2836
-
\??\c:\5hhhtt.exec:\5hhhtt.exe122⤵PID:3028
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-