Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 01:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
14ae39f5b9618b4c342e4e65fc6dc6f0_NeikiAnalytics.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
14ae39f5b9618b4c342e4e65fc6dc6f0_NeikiAnalytics.exe
-
Size
82KB
-
MD5
14ae39f5b9618b4c342e4e65fc6dc6f0
-
SHA1
9fd7efadb5a9cabd5948f6fb58b469040903fe02
-
SHA256
4380c5195a50469cba8a36e2556908349f07b97fe3fd771c81157dd2d89457d6
-
SHA512
a75c90e0784c27ed62a8df027ecfc577baf253990e3e25b8fe16310c1b722f626aab126e11af26a30767f70d829bb3b3aafab118445546681f2cc7f6e87e05a6
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDInWeNCYGyA2R7JkZPsvnz:ymb3NkkiQ3mdBjFIWeFGyA9PUz
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/1228-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1516-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-82-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1704-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/588-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/812-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1616-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1708-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/992-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1228 3xrlrrr.exe 2776 xrxlrxf.exe 2680 thttbb.exe 2640 dvjpv.exe 2744 5dvvv.exe 2836 rlfflrx.exe 2544 frfxllr.exe 2540 bthnbb.exe 2960 9fllxfx.exe 2772 3tnttt.exe 2812 pvdvv.exe 2944 9djpv.exe 1648 fxrflll.exe 1052 9btbhh.exe 1724 dvppj.exe 1704 vvjpv.exe 1876 frfxffr.exe 1688 3rlflfl.exe 2060 hbhhtn.exe 2840 9dvvp.exe 2892 jdpjp.exe 264 1fxxllx.exe 588 3rlrrlx.exe 812 nbnttt.exe 2456 9ppjp.exe 792 jdpvd.exe 1616 7lfxxxf.exe 2436 hbhntb.exe 1708 vpjpp.exe 992 pdddj.exe 1512 fxrrffr.exe 2988 tntbhh.exe 2768 nbnnnn.exe 1596 1jpvp.exe 2116 xrflffr.exe 2692 xrllxlx.exe 2680 xrflrxf.exe 2868 bnbbhh.exe 2512 btnnbh.exe 2136 pjdjd.exe 1092 9vpjp.exe 2484 lfrlxfr.exe 2564 3flflfr.exe 848 htbtbt.exe 2012 nhthhn.exe 2816 dvjpd.exe 2728 3dppp.exe 2804 fffllrx.exe 1328 fxffxff.exe 2452 bthhnn.exe 1992 nhntth.exe 1988 dvpvv.exe 280 jdpdp.exe 2180 pjddj.exe 2308 rrffrrx.exe 1768 thnnbb.exe 2260 3nbbhb.exe 2056 dpddj.exe 2888 ppjjv.exe 2196 3frrrrr.exe 1180 hhtbtb.exe 640 7btnnn.exe 1592 dvddj.exe 832 jdvdj.exe -
resource yara_rule behavioral1/memory/1228-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1516-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1704-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/588-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/812-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1616-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/992-290-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1516 wrote to memory of 1228 1516 14ae39f5b9618b4c342e4e65fc6dc6f0_NeikiAnalytics.exe 28 PID 1516 wrote to memory of 1228 1516 14ae39f5b9618b4c342e4e65fc6dc6f0_NeikiAnalytics.exe 28 PID 1516 wrote to memory of 1228 1516 14ae39f5b9618b4c342e4e65fc6dc6f0_NeikiAnalytics.exe 28 PID 1516 wrote to memory of 1228 1516 14ae39f5b9618b4c342e4e65fc6dc6f0_NeikiAnalytics.exe 28 PID 1228 wrote to memory of 2776 1228 3xrlrrr.exe 29 PID 1228 wrote to memory of 2776 1228 3xrlrrr.exe 29 PID 1228 wrote to memory of 2776 1228 3xrlrrr.exe 29 PID 1228 wrote to memory of 2776 1228 3xrlrrr.exe 29 PID 2776 wrote to memory of 2680 2776 xrxlrxf.exe 30 PID 2776 wrote to memory of 2680 2776 xrxlrxf.exe 30 PID 2776 wrote to memory of 2680 2776 xrxlrxf.exe 30 PID 2776 wrote to memory of 2680 2776 xrxlrxf.exe 30 PID 2680 wrote to memory of 2640 2680 thttbb.exe 31 PID 2680 wrote to memory of 2640 2680 thttbb.exe 31 PID 2680 wrote to memory of 2640 2680 thttbb.exe 31 PID 2680 wrote to memory of 2640 2680 thttbb.exe 31 PID 2640 wrote to memory of 2744 2640 dvjpv.exe 32 PID 2640 wrote to memory of 2744 2640 dvjpv.exe 32 PID 2640 wrote to memory of 2744 2640 dvjpv.exe 32 PID 2640 wrote to memory of 2744 2640 dvjpv.exe 32 PID 2744 wrote to memory of 2836 2744 5dvvv.exe 33 PID 2744 wrote to memory of 2836 2744 5dvvv.exe 33 PID 2744 wrote to memory of 2836 2744 5dvvv.exe 33 PID 2744 wrote to memory of 2836 2744 5dvvv.exe 33 PID 2836 wrote to memory of 2544 2836 rlfflrx.exe 34 PID 2836 wrote to memory of 2544 2836 rlfflrx.exe 34 PID 2836 wrote to memory of 2544 2836 rlfflrx.exe 34 PID 2836 wrote to memory of 2544 2836 rlfflrx.exe 34 PID 2544 wrote to memory of 2540 2544 frfxllr.exe 35 PID 2544 wrote to memory of 2540 2544 frfxllr.exe 35 PID 2544 wrote to memory of 2540 2544 frfxllr.exe 35 PID 2544 wrote to memory of 2540 2544 frfxllr.exe 35 PID 2540 wrote to memory of 2960 2540 bthnbb.exe 36 PID 2540 wrote to memory of 2960 2540 bthnbb.exe 36 PID 2540 wrote to memory of 2960 2540 bthnbb.exe 36 PID 2540 wrote to memory of 2960 2540 bthnbb.exe 36 PID 2960 wrote to memory of 2772 2960 9fllxfx.exe 37 PID 2960 wrote to memory of 2772 2960 9fllxfx.exe 37 PID 2960 wrote to memory of 2772 2960 9fllxfx.exe 37 PID 2960 wrote to memory of 2772 2960 9fllxfx.exe 37 PID 2772 wrote to memory of 2812 2772 3tnttt.exe 38 PID 2772 wrote to memory of 2812 2772 3tnttt.exe 38 PID 2772 wrote to memory of 2812 2772 3tnttt.exe 38 PID 2772 wrote to memory of 2812 2772 3tnttt.exe 38 PID 2812 wrote to memory of 2944 2812 pvdvv.exe 39 PID 2812 wrote to memory of 2944 2812 pvdvv.exe 39 PID 2812 wrote to memory of 2944 2812 pvdvv.exe 39 PID 2812 wrote to memory of 2944 2812 pvdvv.exe 39 PID 2944 wrote to memory of 1648 2944 9djpv.exe 40 PID 2944 wrote to memory of 1648 2944 9djpv.exe 40 PID 2944 wrote to memory of 1648 2944 9djpv.exe 40 PID 2944 wrote to memory of 1648 2944 9djpv.exe 40 PID 1648 wrote to memory of 1052 1648 fxrflll.exe 41 PID 1648 wrote to memory of 1052 1648 fxrflll.exe 41 PID 1648 wrote to memory of 1052 1648 fxrflll.exe 41 PID 1648 wrote to memory of 1052 1648 fxrflll.exe 41 PID 1052 wrote to memory of 1724 1052 9btbhh.exe 42 PID 1052 wrote to memory of 1724 1052 9btbhh.exe 42 PID 1052 wrote to memory of 1724 1052 9btbhh.exe 42 PID 1052 wrote to memory of 1724 1052 9btbhh.exe 42 PID 1724 wrote to memory of 1704 1724 dvppj.exe 43 PID 1724 wrote to memory of 1704 1724 dvppj.exe 43 PID 1724 wrote to memory of 1704 1724 dvppj.exe 43 PID 1724 wrote to memory of 1704 1724 dvppj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\14ae39f5b9618b4c342e4e65fc6dc6f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\14ae39f5b9618b4c342e4e65fc6dc6f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\3xrlrrr.exec:\3xrlrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\xrxlrxf.exec:\xrxlrxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\thttbb.exec:\thttbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\dvjpv.exec:\dvjpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\5dvvv.exec:\5dvvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\rlfflrx.exec:\rlfflrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\frfxllr.exec:\frfxllr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\bthnbb.exec:\bthnbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\9fllxfx.exec:\9fllxfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\3tnttt.exec:\3tnttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\pvdvv.exec:\pvdvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\9djpv.exec:\9djpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\fxrflll.exec:\fxrflll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\9btbhh.exec:\9btbhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\dvppj.exec:\dvppj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\vvjpv.exec:\vvjpv.exe17⤵
- Executes dropped EXE
PID:1704 -
\??\c:\frfxffr.exec:\frfxffr.exe18⤵
- Executes dropped EXE
PID:1876 -
\??\c:\3rlflfl.exec:\3rlflfl.exe19⤵
- Executes dropped EXE
PID:1688 -
\??\c:\hbhhtn.exec:\hbhhtn.exe20⤵
- Executes dropped EXE
PID:2060 -
\??\c:\9dvvp.exec:\9dvvp.exe21⤵
- Executes dropped EXE
PID:2840 -
\??\c:\jdpjp.exec:\jdpjp.exe22⤵
- Executes dropped EXE
PID:2892 -
\??\c:\1fxxllx.exec:\1fxxllx.exe23⤵
- Executes dropped EXE
PID:264 -
\??\c:\3rlrrlx.exec:\3rlrrlx.exe24⤵
- Executes dropped EXE
PID:588 -
\??\c:\nbnttt.exec:\nbnttt.exe25⤵
- Executes dropped EXE
PID:812 -
\??\c:\9ppjp.exec:\9ppjp.exe26⤵
- Executes dropped EXE
PID:2456 -
\??\c:\jdpvd.exec:\jdpvd.exe27⤵
- Executes dropped EXE
PID:792 -
\??\c:\7lfxxxf.exec:\7lfxxxf.exe28⤵
- Executes dropped EXE
PID:1616 -
\??\c:\hbhntb.exec:\hbhntb.exe29⤵
- Executes dropped EXE
PID:2436 -
\??\c:\vpjpp.exec:\vpjpp.exe30⤵
- Executes dropped EXE
PID:1708 -
\??\c:\pdddj.exec:\pdddj.exe31⤵
- Executes dropped EXE
PID:992 -
\??\c:\fxrrffr.exec:\fxrrffr.exe32⤵
- Executes dropped EXE
PID:1512 -
\??\c:\tntbhh.exec:\tntbhh.exe33⤵
- Executes dropped EXE
PID:2988 -
\??\c:\nbnnnn.exec:\nbnnnn.exe34⤵
- Executes dropped EXE
PID:2768 -
\??\c:\1jpvp.exec:\1jpvp.exe35⤵
- Executes dropped EXE
PID:1596 -
\??\c:\xrflffr.exec:\xrflffr.exe36⤵
- Executes dropped EXE
PID:2116 -
\??\c:\xrllxlx.exec:\xrllxlx.exe37⤵
- Executes dropped EXE
PID:2692 -
\??\c:\xrflrxf.exec:\xrflrxf.exe38⤵
- Executes dropped EXE
PID:2680 -
\??\c:\bnbbhh.exec:\bnbbhh.exe39⤵
- Executes dropped EXE
PID:2868 -
\??\c:\btnnbh.exec:\btnnbh.exe40⤵
- Executes dropped EXE
PID:2512 -
\??\c:\pjdjd.exec:\pjdjd.exe41⤵
- Executes dropped EXE
PID:2136 -
\??\c:\9vpjp.exec:\9vpjp.exe42⤵
- Executes dropped EXE
PID:1092 -
\??\c:\lfrlxfr.exec:\lfrlxfr.exe43⤵
- Executes dropped EXE
PID:2484 -
\??\c:\3flflfr.exec:\3flflfr.exe44⤵
- Executes dropped EXE
PID:2564 -
\??\c:\htbtbt.exec:\htbtbt.exe45⤵
- Executes dropped EXE
PID:848 -
\??\c:\nhthhn.exec:\nhthhn.exe46⤵
- Executes dropped EXE
PID:2012 -
\??\c:\dvjpd.exec:\dvjpd.exe47⤵
- Executes dropped EXE
PID:2816 -
\??\c:\3dppp.exec:\3dppp.exe48⤵
- Executes dropped EXE
PID:2728 -
\??\c:\fffllrx.exec:\fffllrx.exe49⤵
- Executes dropped EXE
PID:2804 -
\??\c:\fxffxff.exec:\fxffxff.exe50⤵
- Executes dropped EXE
PID:1328 -
\??\c:\bthhnn.exec:\bthhnn.exe51⤵
- Executes dropped EXE
PID:2452 -
\??\c:\nhntth.exec:\nhntth.exe52⤵
- Executes dropped EXE
PID:1992 -
\??\c:\dvpvv.exec:\dvpvv.exe53⤵
- Executes dropped EXE
PID:1988 -
\??\c:\jdpdp.exec:\jdpdp.exe54⤵
- Executes dropped EXE
PID:280 -
\??\c:\pjddj.exec:\pjddj.exe55⤵
- Executes dropped EXE
PID:2180 -
\??\c:\rrffrrx.exec:\rrffrrx.exe56⤵
- Executes dropped EXE
PID:2308 -
\??\c:\thnnbb.exec:\thnnbb.exe57⤵
- Executes dropped EXE
PID:1768 -
\??\c:\3nbbhb.exec:\3nbbhb.exe58⤵
- Executes dropped EXE
PID:2260 -
\??\c:\dpddj.exec:\dpddj.exe59⤵
- Executes dropped EXE
PID:2056 -
\??\c:\ppjjv.exec:\ppjjv.exe60⤵
- Executes dropped EXE
PID:2888 -
\??\c:\3frrrrr.exec:\3frrrrr.exe61⤵
- Executes dropped EXE
PID:2196 -
\??\c:\hhtbtb.exec:\hhtbtb.exe62⤵
- Executes dropped EXE
PID:1180 -
\??\c:\7btnnn.exec:\7btnnn.exe63⤵
- Executes dropped EXE
PID:640 -
\??\c:\dvddj.exec:\dvddj.exe64⤵
- Executes dropped EXE
PID:1592 -
\??\c:\jdvdj.exec:\jdvdj.exe65⤵
- Executes dropped EXE
PID:832 -
\??\c:\1rflrll.exec:\1rflrll.exe66⤵PID:2288
-
\??\c:\xxrrxrr.exec:\xxrrxrr.exe67⤵PID:2356
-
\??\c:\xxlfrrx.exec:\xxlfrrx.exe68⤵PID:1652
-
\??\c:\bnbttt.exec:\bnbttt.exe69⤵PID:2148
-
\??\c:\3bnbbn.exec:\3bnbbn.exe70⤵PID:2436
-
\??\c:\5pjdj.exec:\5pjdj.exe71⤵PID:2244
-
\??\c:\pjvdd.exec:\pjvdd.exe72⤵PID:2904
-
\??\c:\rlrrxxf.exec:\rlrrxxf.exe73⤵PID:2996
-
\??\c:\lxxfffl.exec:\lxxfffl.exe74⤵PID:2424
-
\??\c:\bnbhnn.exec:\bnbhnn.exe75⤵PID:2992
-
\??\c:\1bhhtb.exec:\1bhhtb.exe76⤵PID:2408
-
\??\c:\pdjjp.exec:\pdjjp.exe77⤵PID:1528
-
\??\c:\9fxrffr.exec:\9fxrffr.exe78⤵PID:3024
-
\??\c:\lflrxfl.exec:\lflrxfl.exe79⤵PID:1400
-
\??\c:\btnhtt.exec:\btnhtt.exe80⤵PID:2676
-
\??\c:\tnttbn.exec:\tnttbn.exe81⤵PID:2524
-
\??\c:\vpvpv.exec:\vpvpv.exe82⤵PID:2880
-
\??\c:\dvjpv.exec:\dvjpv.exe83⤵PID:2752
-
\??\c:\fxlfxxf.exec:\fxlfxxf.exe84⤵PID:2516
-
\??\c:\fxrxlll.exec:\fxrxlll.exe85⤵PID:2740
-
\??\c:\9rflrrx.exec:\9rflrrx.exe86⤵PID:2500
-
\??\c:\9tnhbn.exec:\9tnhbn.exe87⤵PID:2540
-
\??\c:\hhtthh.exec:\hhtthh.exe88⤵PID:2724
-
\??\c:\5pddj.exec:\5pddj.exe89⤵PID:2664
-
\??\c:\vpjpp.exec:\vpjpp.exe90⤵PID:2576
-
\??\c:\lfrrlrx.exec:\lfrrlrx.exe91⤵PID:2972
-
\??\c:\rllrxfl.exec:\rllrxfl.exe92⤵PID:2832
-
\??\c:\xlffrrr.exec:\xlffrrr.exe93⤵PID:1272
-
\??\c:\tnbbnn.exec:\tnbbnn.exe94⤵PID:548
-
\??\c:\bthnnn.exec:\bthnnn.exe95⤵PID:1684
-
\??\c:\ddvpv.exec:\ddvpv.exe96⤵PID:884
-
\??\c:\vpppj.exec:\vpppj.exe97⤵PID:2476
-
\??\c:\lfxfllx.exec:\lfxfllx.exe98⤵PID:1556
-
\??\c:\fxllxxf.exec:\fxllxxf.exe99⤵PID:1688
-
\??\c:\nhtntn.exec:\nhtntn.exe100⤵PID:2228
-
\??\c:\pjpdj.exec:\pjpdj.exe101⤵PID:2896
-
\??\c:\pdjjp.exec:\pdjjp.exe102⤵PID:2052
-
\??\c:\lxlrffr.exec:\lxlrffr.exe103⤵PID:332
-
\??\c:\1fxrfrf.exec:\1fxrfrf.exe104⤵PID:264
-
\??\c:\nbhntn.exec:\nbhntn.exe105⤵PID:2528
-
\??\c:\tntttt.exec:\tntttt.exe106⤵PID:2460
-
\??\c:\jdvvd.exec:\jdvvd.exe107⤵PID:2040
-
\??\c:\1vpvj.exec:\1vpvj.exe108⤵PID:2864
-
\??\c:\5dvvd.exec:\5dvvd.exe109⤵PID:792
-
\??\c:\lxfxxfl.exec:\lxfxxfl.exe110⤵PID:1032
-
\??\c:\1nhhnh.exec:\1nhhnh.exe111⤵PID:840
-
\??\c:\bthnht.exec:\bthnht.exe112⤵PID:1624
-
\??\c:\pjvpd.exec:\pjvpd.exe113⤵PID:1392
-
\??\c:\dvppp.exec:\dvppp.exe114⤵PID:872
-
\??\c:\xrxxxff.exec:\xrxxxff.exe115⤵PID:2068
-
\??\c:\xrfrxxf.exec:\xrfrxxf.exe116⤵PID:2340
-
\??\c:\nhttbb.exec:\nhttbb.exe117⤵PID:2860
-
\??\c:\nhnhnn.exec:\nhnhnn.exe118⤵PID:2876
-
\??\c:\7ddjj.exec:\7ddjj.exe119⤵PID:2572
-
\??\c:\vvdjv.exec:\vvdjv.exe120⤵PID:2236
-
\??\c:\jdvvd.exec:\jdvvd.exe121⤵PID:2736
-
\??\c:\fxfrxxx.exec:\fxfrxxx.exe122⤵PID:2748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-