Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 20:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e9a73a7234d05d176e7d74dad477f250_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
e9a73a7234d05d176e7d74dad477f250_NeikiAnalytics.exe
-
Size
91KB
-
MD5
e9a73a7234d05d176e7d74dad477f250
-
SHA1
dcff0a4e5b1f2e84d4f17b70ca52dba7a88a9543
-
SHA256
80c192638732b46615fe7e53cf17c9327dd9df9b6bc7cc0a4500b44d2390dedc
-
SHA512
8a944a532780f7834e04e805c89b352421acacf263183889c35b6abec25a6e295cacb041ff3df30d1b748db3a09bef5ebb4be462938d34ec0996b1239b00366a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIQIDyviFxx2hCtgIMLP9rBZaRBt:ymb3NkkiQ3mdBjFIVLd2hWZGreRCUlb1
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2124-22-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2124-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1280-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1996-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1852-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1244-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1392-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-1379-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2124 btntbn.exe 2680 hbhtnn.exe 2708 xxlrflx.exe 2460 3httbn.exe 2784 dvjjd.exe 2188 xrflrrx.exe 2528 tnhttb.exe 2200 lfxflxl.exe 1996 rlfxlrf.exe 2672 7bnbbh.exe 2936 djvvv.exe 1852 5ppjp.exe 2024 xffrlxr.exe 1244 1tnhnn.exe 2300 1ppdj.exe 768 ddvjv.exe 108 fxlrffr.exe 1648 1btbht.exe 1596 djdjp.exe 1900 3xlfrrf.exe 2876 lllrflf.exe 672 1hthnn.exe 1616 ppjdp.exe 1788 pjpjp.exe 1784 llfxflx.exe 2372 9hbtbt.exe 1392 1tnttt.exe 2576 pdpvd.exe 1804 3htntt.exe 2096 5nntnt.exe 2884 9pvvv.exe 1280 lfrrxfl.exe 1576 1bnbhn.exe 3052 ppjvj.exe 2700 jvppv.exe 2860 fflrffr.exe 2708 rrfllrx.exe 1152 tntbhn.exe 2684 vvjpj.exe 2784 rlxrffr.exe 2552 ttntbn.exe 2188 5hbbbh.exe 3008 vpdpv.exe 2664 pjvjj.exe 2484 3rxflxl.exe 2788 xrffrrx.exe 2960 1tnttb.exe 2952 hbhnnn.exe 2412 pjpvv.exe 2208 1lfrffr.exe 1176 9lxlllx.exe 1064 nttbnh.exe 2592 pjdpj.exe 2428 dvpvj.exe 1388 jdddd.exe 1752 1rxfrrr.exe 2256 hbhhnh.exe 1180 tnbbht.exe 2856 jdpvj.exe 380 vpvjp.exe 764 rffflll.exe 672 fxflrrx.exe 1480 nhbbnn.exe 640 ttnhtt.exe -
resource yara_rule behavioral1/memory/1280-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1280-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1996-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1852-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1244-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1392-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-304-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1280 wrote to memory of 2124 1280 e9a73a7234d05d176e7d74dad477f250_NeikiAnalytics.exe 28 PID 1280 wrote to memory of 2124 1280 e9a73a7234d05d176e7d74dad477f250_NeikiAnalytics.exe 28 PID 1280 wrote to memory of 2124 1280 e9a73a7234d05d176e7d74dad477f250_NeikiAnalytics.exe 28 PID 1280 wrote to memory of 2124 1280 e9a73a7234d05d176e7d74dad477f250_NeikiAnalytics.exe 28 PID 2124 wrote to memory of 2680 2124 btntbn.exe 29 PID 2124 wrote to memory of 2680 2124 btntbn.exe 29 PID 2124 wrote to memory of 2680 2124 btntbn.exe 29 PID 2124 wrote to memory of 2680 2124 btntbn.exe 29 PID 2680 wrote to memory of 2708 2680 hbhtnn.exe 30 PID 2680 wrote to memory of 2708 2680 hbhtnn.exe 30 PID 2680 wrote to memory of 2708 2680 hbhtnn.exe 30 PID 2680 wrote to memory of 2708 2680 hbhtnn.exe 30 PID 2708 wrote to memory of 2460 2708 xxlrflx.exe 31 PID 2708 wrote to memory of 2460 2708 xxlrflx.exe 31 PID 2708 wrote to memory of 2460 2708 xxlrflx.exe 31 PID 2708 wrote to memory of 2460 2708 xxlrflx.exe 31 PID 2460 wrote to memory of 2784 2460 3httbn.exe 32 PID 2460 wrote to memory of 2784 2460 3httbn.exe 32 PID 2460 wrote to memory of 2784 2460 3httbn.exe 32 PID 2460 wrote to memory of 2784 2460 3httbn.exe 32 PID 2784 wrote to memory of 2188 2784 dvjjd.exe 33 PID 2784 wrote to memory of 2188 2784 dvjjd.exe 33 PID 2784 wrote to memory of 2188 2784 dvjjd.exe 33 PID 2784 wrote to memory of 2188 2784 dvjjd.exe 33 PID 2188 wrote to memory of 2528 2188 xrflrrx.exe 34 PID 2188 wrote to memory of 2528 2188 xrflrrx.exe 34 PID 2188 wrote to memory of 2528 2188 xrflrrx.exe 34 PID 2188 wrote to memory of 2528 2188 xrflrrx.exe 34 PID 2528 wrote to memory of 2200 2528 tnhttb.exe 35 PID 2528 wrote to memory of 2200 2528 tnhttb.exe 35 PID 2528 wrote to memory of 2200 2528 tnhttb.exe 35 PID 2528 wrote to memory of 2200 2528 tnhttb.exe 35 PID 2200 wrote to memory of 1996 2200 lfxflxl.exe 36 PID 2200 wrote to memory of 1996 2200 lfxflxl.exe 36 PID 2200 wrote to memory of 1996 2200 lfxflxl.exe 36 PID 2200 wrote to memory of 1996 2200 lfxflxl.exe 36 PID 1996 wrote to memory of 2672 1996 rlfxlrf.exe 37 PID 1996 wrote to memory of 2672 1996 rlfxlrf.exe 37 PID 1996 wrote to memory of 2672 1996 rlfxlrf.exe 37 PID 1996 wrote to memory of 2672 1996 rlfxlrf.exe 37 PID 2672 wrote to memory of 2936 2672 7bnbbh.exe 38 PID 2672 wrote to memory of 2936 2672 7bnbbh.exe 38 PID 2672 wrote to memory of 2936 2672 7bnbbh.exe 38 PID 2672 wrote to memory of 2936 2672 7bnbbh.exe 38 PID 2936 wrote to memory of 1852 2936 djvvv.exe 39 PID 2936 wrote to memory of 1852 2936 djvvv.exe 39 PID 2936 wrote to memory of 1852 2936 djvvv.exe 39 PID 2936 wrote to memory of 1852 2936 djvvv.exe 39 PID 1852 wrote to memory of 2024 1852 5ppjp.exe 40 PID 1852 wrote to memory of 2024 1852 5ppjp.exe 40 PID 1852 wrote to memory of 2024 1852 5ppjp.exe 40 PID 1852 wrote to memory of 2024 1852 5ppjp.exe 40 PID 2024 wrote to memory of 1244 2024 xffrlxr.exe 41 PID 2024 wrote to memory of 1244 2024 xffrlxr.exe 41 PID 2024 wrote to memory of 1244 2024 xffrlxr.exe 41 PID 2024 wrote to memory of 1244 2024 xffrlxr.exe 41 PID 1244 wrote to memory of 2300 1244 1tnhnn.exe 42 PID 1244 wrote to memory of 2300 1244 1tnhnn.exe 42 PID 1244 wrote to memory of 2300 1244 1tnhnn.exe 42 PID 1244 wrote to memory of 2300 1244 1tnhnn.exe 42 PID 2300 wrote to memory of 768 2300 1ppdj.exe 43 PID 2300 wrote to memory of 768 2300 1ppdj.exe 43 PID 2300 wrote to memory of 768 2300 1ppdj.exe 43 PID 2300 wrote to memory of 768 2300 1ppdj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9a73a7234d05d176e7d74dad477f250_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e9a73a7234d05d176e7d74dad477f250_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\btntbn.exec:\btntbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\hbhtnn.exec:\hbhtnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\xxlrflx.exec:\xxlrflx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\3httbn.exec:\3httbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\dvjjd.exec:\dvjjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\xrflrrx.exec:\xrflrrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\tnhttb.exec:\tnhttb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\lfxflxl.exec:\lfxflxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\rlfxlrf.exec:\rlfxlrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\7bnbbh.exec:\7bnbbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\djvvv.exec:\djvvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\5ppjp.exec:\5ppjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\xffrlxr.exec:\xffrlxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\1tnhnn.exec:\1tnhnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\1ppdj.exec:\1ppdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\ddvjv.exec:\ddvjv.exe17⤵
- Executes dropped EXE
PID:768 -
\??\c:\fxlrffr.exec:\fxlrffr.exe18⤵
- Executes dropped EXE
PID:108 -
\??\c:\1btbht.exec:\1btbht.exe19⤵
- Executes dropped EXE
PID:1648 -
\??\c:\djdjp.exec:\djdjp.exe20⤵
- Executes dropped EXE
PID:1596 -
\??\c:\3xlfrrf.exec:\3xlfrrf.exe21⤵
- Executes dropped EXE
PID:1900 -
\??\c:\lllrflf.exec:\lllrflf.exe22⤵
- Executes dropped EXE
PID:2876 -
\??\c:\1hthnn.exec:\1hthnn.exe23⤵
- Executes dropped EXE
PID:672 -
\??\c:\ppjdp.exec:\ppjdp.exe24⤵
- Executes dropped EXE
PID:1616 -
\??\c:\pjpjp.exec:\pjpjp.exe25⤵
- Executes dropped EXE
PID:1788 -
\??\c:\llfxflx.exec:\llfxflx.exe26⤵
- Executes dropped EXE
PID:1784 -
\??\c:\9hbtbt.exec:\9hbtbt.exe27⤵
- Executes dropped EXE
PID:2372 -
\??\c:\1tnttt.exec:\1tnttt.exe28⤵
- Executes dropped EXE
PID:1392 -
\??\c:\pdpvd.exec:\pdpvd.exe29⤵
- Executes dropped EXE
PID:2576 -
\??\c:\3htntt.exec:\3htntt.exe30⤵
- Executes dropped EXE
PID:1804 -
\??\c:\5nntnt.exec:\5nntnt.exe31⤵
- Executes dropped EXE
PID:2096 -
\??\c:\9pvvv.exec:\9pvvv.exe32⤵
- Executes dropped EXE
PID:2884 -
\??\c:\lfrrxfl.exec:\lfrrxfl.exe33⤵
- Executes dropped EXE
PID:1280 -
\??\c:\1bnbhn.exec:\1bnbhn.exe34⤵
- Executes dropped EXE
PID:1576 -
\??\c:\ppjvj.exec:\ppjvj.exe35⤵
- Executes dropped EXE
PID:3052 -
\??\c:\jvppv.exec:\jvppv.exe36⤵
- Executes dropped EXE
PID:2700 -
\??\c:\fflrffr.exec:\fflrffr.exe37⤵
- Executes dropped EXE
PID:2860 -
\??\c:\rrfllrx.exec:\rrfllrx.exe38⤵
- Executes dropped EXE
PID:2708 -
\??\c:\tntbhn.exec:\tntbhn.exe39⤵
- Executes dropped EXE
PID:1152 -
\??\c:\vvjpj.exec:\vvjpj.exe40⤵
- Executes dropped EXE
PID:2684 -
\??\c:\rlxrffr.exec:\rlxrffr.exe41⤵
- Executes dropped EXE
PID:2784 -
\??\c:\ttntbn.exec:\ttntbn.exe42⤵
- Executes dropped EXE
PID:2552 -
\??\c:\5hbbbh.exec:\5hbbbh.exe43⤵
- Executes dropped EXE
PID:2188 -
\??\c:\vpdpv.exec:\vpdpv.exe44⤵
- Executes dropped EXE
PID:3008 -
\??\c:\pjvjj.exec:\pjvjj.exe45⤵
- Executes dropped EXE
PID:2664 -
\??\c:\3rxflxl.exec:\3rxflxl.exe46⤵
- Executes dropped EXE
PID:2484 -
\??\c:\xrffrrx.exec:\xrffrrx.exe47⤵
- Executes dropped EXE
PID:2788 -
\??\c:\1tnttb.exec:\1tnttb.exe48⤵
- Executes dropped EXE
PID:2960 -
\??\c:\hbhnnn.exec:\hbhnnn.exe49⤵
- Executes dropped EXE
PID:2952 -
\??\c:\pjpvv.exec:\pjpvv.exe50⤵
- Executes dropped EXE
PID:2412 -
\??\c:\1lfrffr.exec:\1lfrffr.exe51⤵
- Executes dropped EXE
PID:2208 -
\??\c:\9lxlllx.exec:\9lxlllx.exe52⤵
- Executes dropped EXE
PID:1176 -
\??\c:\nttbnh.exec:\nttbnh.exe53⤵
- Executes dropped EXE
PID:1064 -
\??\c:\pjdpj.exec:\pjdpj.exe54⤵
- Executes dropped EXE
PID:2592 -
\??\c:\dvpvj.exec:\dvpvj.exe55⤵
- Executes dropped EXE
PID:2428 -
\??\c:\jdddd.exec:\jdddd.exe56⤵
- Executes dropped EXE
PID:1388 -
\??\c:\1rxfrrr.exec:\1rxfrrr.exe57⤵
- Executes dropped EXE
PID:1752 -
\??\c:\hbhhnh.exec:\hbhhnh.exe58⤵
- Executes dropped EXE
PID:2256 -
\??\c:\tnbbht.exec:\tnbbht.exe59⤵
- Executes dropped EXE
PID:1180 -
\??\c:\jdpvj.exec:\jdpvj.exe60⤵
- Executes dropped EXE
PID:2856 -
\??\c:\vpvjp.exec:\vpvjp.exe61⤵
- Executes dropped EXE
PID:380 -
\??\c:\rffflll.exec:\rffflll.exe62⤵
- Executes dropped EXE
PID:764 -
\??\c:\fxflrrx.exec:\fxflrrx.exe63⤵
- Executes dropped EXE
PID:672 -
\??\c:\nhbbnn.exec:\nhbbnn.exe64⤵
- Executes dropped EXE
PID:1480 -
\??\c:\ttnhtt.exec:\ttnhtt.exe65⤵
- Executes dropped EXE
PID:640 -
\??\c:\3dddv.exec:\3dddv.exe66⤵PID:2132
-
\??\c:\1ppjv.exec:\1ppjv.exe67⤵PID:1952
-
\??\c:\ffxflxf.exec:\ffxflxf.exe68⤵PID:2372
-
\??\c:\btnthb.exec:\btnthb.exe69⤵PID:1392
-
\??\c:\1tnbbb.exec:\1tnbbb.exe70⤵PID:1724
-
\??\c:\dvjpd.exec:\dvjpd.exe71⤵PID:2908
-
\??\c:\vpjvd.exec:\vpjvd.exe72⤵PID:888
-
\??\c:\9vvjv.exec:\9vvjv.exe73⤵PID:2988
-
\??\c:\fxfrflx.exec:\fxfrflx.exe74⤵PID:1492
-
\??\c:\nhttnn.exec:\nhttnn.exe75⤵PID:1548
-
\??\c:\bbnbhn.exec:\bbnbhn.exe76⤵PID:2080
-
\??\c:\3vjjj.exec:\3vjjj.exe77⤵PID:3044
-
\??\c:\dvjvd.exec:\dvjvd.exe78⤵PID:2600
-
\??\c:\fxllllx.exec:\fxllllx.exe79⤵PID:2704
-
\??\c:\7rlrrrr.exec:\7rlrrrr.exe80⤵PID:2744
-
\??\c:\hnbtbt.exec:\hnbtbt.exe81⤵PID:1712
-
\??\c:\7nnhnt.exec:\7nnhnt.exe82⤵PID:2612
-
\??\c:\jdvvj.exec:\jdvvj.exe83⤵PID:2408
-
\??\c:\jdppv.exec:\jdppv.exe84⤵PID:2632
-
\??\c:\xrfllrf.exec:\xrfllrf.exe85⤵PID:2948
-
\??\c:\xrxxllr.exec:\xrxxllr.exe86⤵PID:2944
-
\??\c:\3bbnbn.exec:\3bbnbn.exe87⤵PID:2200
-
\??\c:\tnbhnt.exec:\tnbhnt.exe88⤵PID:2748
-
\??\c:\vppvv.exec:\vppvv.exe89⤵PID:2928
-
\??\c:\ddvdp.exec:\ddvdp.exe90⤵PID:2016
-
\??\c:\rrxxllx.exec:\rrxxllx.exe91⤵PID:2432
-
\??\c:\hhhbhn.exec:\hhhbhn.exe92⤵PID:1820
-
\??\c:\nhbbhh.exec:\nhbbhh.exe93⤵PID:1980
-
\??\c:\jjdpp.exec:\jjdpp.exe94⤵PID:1768
-
\??\c:\ppjjp.exec:\ppjjp.exe95⤵PID:276
-
\??\c:\fxfrffx.exec:\fxfrffx.exe96⤵PID:2304
-
\??\c:\lfxlfxf.exec:\lfxlfxf.exe97⤵PID:1744
-
\??\c:\btnttb.exec:\btnttb.exe98⤵PID:2244
-
\??\c:\7hbbth.exec:\7hbbth.exe99⤵PID:1600
-
\??\c:\9pppv.exec:\9pppv.exe100⤵PID:2688
-
\??\c:\dvpvd.exec:\dvpvd.exe101⤵PID:2172
-
\??\c:\xxxllrr.exec:\xxxllrr.exe102⤵PID:2232
-
\??\c:\lfxfrrx.exec:\lfxfrrx.exe103⤵PID:548
-
\??\c:\tththb.exec:\tththb.exe104⤵PID:320
-
\??\c:\hbnthn.exec:\hbnthn.exe105⤵PID:2448
-
\??\c:\pjpjp.exec:\pjpjp.exe106⤵PID:1792
-
\??\c:\ddvdj.exec:\ddvdj.exe107⤵PID:1592
-
\??\c:\lfrflfr.exec:\lfrflfr.exe108⤵PID:1604
-
\??\c:\1bbbbh.exec:\1bbbbh.exe109⤵PID:2896
-
\??\c:\nnnbnb.exec:\nnnbnb.exe110⤵PID:948
-
\??\c:\bthbnn.exec:\bthbnn.exe111⤵PID:2836
-
\??\c:\vpvdp.exec:\vpvdp.exe112⤵PID:1724
-
\??\c:\xrxflrl.exec:\xrxflrl.exe113⤵PID:2900
-
\??\c:\fxlrxfl.exec:\fxlrxfl.exe114⤵PID:2096
-
\??\c:\1hhtbh.exec:\1hhtbh.exe115⤵PID:2376
-
\??\c:\9nbbhn.exec:\9nbbhn.exe116⤵PID:1572
-
\??\c:\3jpdp.exec:\3jpdp.exe117⤵PID:2340
-
\??\c:\jjdjp.exec:\jjdjp.exe118⤵PID:2344
-
\??\c:\1xrxxrf.exec:\1xrxxrf.exe119⤵PID:2652
-
\??\c:\3frxxfx.exec:\3frxxfx.exe120⤵PID:2624
-
\??\c:\nnbnth.exec:\nnbnth.exe121⤵PID:2504
-
\??\c:\vdjdd.exec:\vdjdd.exe122⤵PID:2656
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-