Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12-05-2024 09:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
82a1d57941989bbedc6fa19893efbdd0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
82a1d57941989bbedc6fa19893efbdd0_NeikiAnalytics.exe
-
Size
371KB
-
MD5
82a1d57941989bbedc6fa19893efbdd0
-
SHA1
46cae7b2e437de12c706d6b35dc8b54aed92ed60
-
SHA256
193e9fef40e8a1b82c7e5ff63202e6b1d2048d6dacb3dbaedc838850796c7c42
-
SHA512
004e3e2587e473318888f1c90195489f3ea705203b67ae4e5b8b3cba966e666ca85a5f79a0df4861eca9abebd03bcbdf49f12fd61d4b6f3790118c6467337204
-
SSDEEP
6144:n3C9BRo7MlrWKo+lS0Le4xRSAoq7mjKPC+gy:n3C9yMo+S0L9xRnoq7mePPT
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/2864-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1828-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/904-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1500-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/564-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1660-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2916 lfxflrf.exe 2148 vvpdv.exe 2644 3ttbnn.exe 2556 7htthn.exe 2756 fxlxlrx.exe 2932 hnhtbb.exe 2444 7jdpv.exe 2200 lflflrl.exe 2924 hbtnnn.exe 2720 pdpvj.exe 2688 lrrflfr.exe 1828 htbbhh.exe 2360 ppppd.exe 2240 ffxxffl.exe 1740 nbnthn.exe 2120 jvpvd.exe 904 btbhhn.exe 1500 bnttbt.exe 2124 rfxfrxl.exe 2836 hhnbnn.exe 2824 pjvjp.exe 540 lfrlxxf.exe 564 bththh.exe 1660 jvjpd.exe 1876 xlfllrl.exe 1636 3bhbbt.exe 2136 rlxfffr.exe 920 tthhnn.exe 2532 nbbtbb.exe 3004 jdjjp.exe 2192 bbhthn.exe 1680 pjdpv.exe 2864 7xxxlrl.exe 1620 nbbnbb.exe 2964 5bhtbb.exe 3020 1jjpd.exe 2676 jdvjv.exe 2680 1fxrxxf.exe 2736 nbtbhh.exe 2696 jjvjv.exe 2492 jdddp.exe 2932 xfxflfr.exe 2620 hhnntb.exe 2508 thtbbh.exe 2020 7dppd.exe 2924 9xxrxxl.exe 2536 1fxflrf.exe 2772 bthnnt.exe 2028 vpjvj.exe 1656 jdvvd.exe 1880 lfrxfrf.exe 1832 hbhbnh.exe 1648 ntnnnn.exe 1556 dpdjv.exe 1348 xxrrrxf.exe 1288 rrrxflx.exe 1332 hbhnnh.exe 2304 jjddj.exe 1932 lxllrfl.exe 2268 nhbnbh.exe 772 hthnbb.exe 540 pjjvj.exe 564 fxflrxr.exe 1788 hthhnn.exe -
resource yara_rule behavioral1/memory/2864-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1828-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/904-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1500-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/564-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-296-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2864 wrote to memory of 2916 2864 82a1d57941989bbedc6fa19893efbdd0_NeikiAnalytics.exe 28 PID 2864 wrote to memory of 2916 2864 82a1d57941989bbedc6fa19893efbdd0_NeikiAnalytics.exe 28 PID 2864 wrote to memory of 2916 2864 82a1d57941989bbedc6fa19893efbdd0_NeikiAnalytics.exe 28 PID 2864 wrote to memory of 2916 2864 82a1d57941989bbedc6fa19893efbdd0_NeikiAnalytics.exe 28 PID 2916 wrote to memory of 2148 2916 lfxflrf.exe 29 PID 2916 wrote to memory of 2148 2916 lfxflrf.exe 29 PID 2916 wrote to memory of 2148 2916 lfxflrf.exe 29 PID 2916 wrote to memory of 2148 2916 lfxflrf.exe 29 PID 2148 wrote to memory of 2644 2148 vvpdv.exe 30 PID 2148 wrote to memory of 2644 2148 vvpdv.exe 30 PID 2148 wrote to memory of 2644 2148 vvpdv.exe 30 PID 2148 wrote to memory of 2644 2148 vvpdv.exe 30 PID 2644 wrote to memory of 2556 2644 3ttbnn.exe 31 PID 2644 wrote to memory of 2556 2644 3ttbnn.exe 31 PID 2644 wrote to memory of 2556 2644 3ttbnn.exe 31 PID 2644 wrote to memory of 2556 2644 3ttbnn.exe 31 PID 2556 wrote to memory of 2756 2556 7htthn.exe 32 PID 2556 wrote to memory of 2756 2556 7htthn.exe 32 PID 2556 wrote to memory of 2756 2556 7htthn.exe 32 PID 2556 wrote to memory of 2756 2556 7htthn.exe 32 PID 2756 wrote to memory of 2932 2756 fxlxlrx.exe 33 PID 2756 wrote to memory of 2932 2756 fxlxlrx.exe 33 PID 2756 wrote to memory of 2932 2756 fxlxlrx.exe 33 PID 2756 wrote to memory of 2932 2756 fxlxlrx.exe 33 PID 2932 wrote to memory of 2444 2932 hnhtbb.exe 34 PID 2932 wrote to memory of 2444 2932 hnhtbb.exe 34 PID 2932 wrote to memory of 2444 2932 hnhtbb.exe 34 PID 2932 wrote to memory of 2444 2932 hnhtbb.exe 34 PID 2444 wrote to memory of 2200 2444 7jdpv.exe 35 PID 2444 wrote to memory of 2200 2444 7jdpv.exe 35 PID 2444 wrote to memory of 2200 2444 7jdpv.exe 35 PID 2444 wrote to memory of 2200 2444 7jdpv.exe 35 PID 2200 wrote to memory of 2924 2200 lflflrl.exe 36 PID 2200 wrote to memory of 2924 2200 lflflrl.exe 36 PID 2200 wrote to memory of 2924 2200 lflflrl.exe 36 PID 2200 wrote to memory of 2924 2200 lflflrl.exe 36 PID 2924 wrote to memory of 2720 2924 hbtnnn.exe 37 PID 2924 wrote to memory of 2720 2924 hbtnnn.exe 37 PID 2924 wrote to memory of 2720 2924 hbtnnn.exe 37 PID 2924 wrote to memory of 2720 2924 hbtnnn.exe 37 PID 2720 wrote to memory of 2688 2720 pdpvj.exe 38 PID 2720 wrote to memory of 2688 2720 pdpvj.exe 38 PID 2720 wrote to memory of 2688 2720 pdpvj.exe 38 PID 2720 wrote to memory of 2688 2720 pdpvj.exe 38 PID 2688 wrote to memory of 1828 2688 lrrflfr.exe 39 PID 2688 wrote to memory of 1828 2688 lrrflfr.exe 39 PID 2688 wrote to memory of 1828 2688 lrrflfr.exe 39 PID 2688 wrote to memory of 1828 2688 lrrflfr.exe 39 PID 1828 wrote to memory of 2360 1828 htbbhh.exe 40 PID 1828 wrote to memory of 2360 1828 htbbhh.exe 40 PID 1828 wrote to memory of 2360 1828 htbbhh.exe 40 PID 1828 wrote to memory of 2360 1828 htbbhh.exe 40 PID 2360 wrote to memory of 2240 2360 ppppd.exe 41 PID 2360 wrote to memory of 2240 2360 ppppd.exe 41 PID 2360 wrote to memory of 2240 2360 ppppd.exe 41 PID 2360 wrote to memory of 2240 2360 ppppd.exe 41 PID 2240 wrote to memory of 1740 2240 ffxxffl.exe 42 PID 2240 wrote to memory of 1740 2240 ffxxffl.exe 42 PID 2240 wrote to memory of 1740 2240 ffxxffl.exe 42 PID 2240 wrote to memory of 1740 2240 ffxxffl.exe 42 PID 1740 wrote to memory of 2120 1740 nbnthn.exe 43 PID 1740 wrote to memory of 2120 1740 nbnthn.exe 43 PID 1740 wrote to memory of 2120 1740 nbnthn.exe 43 PID 1740 wrote to memory of 2120 1740 nbnthn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\82a1d57941989bbedc6fa19893efbdd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\82a1d57941989bbedc6fa19893efbdd0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\lfxflrf.exec:\lfxflrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\vvpdv.exec:\vvpdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\3ttbnn.exec:\3ttbnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\7htthn.exec:\7htthn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\fxlxlrx.exec:\fxlxlrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\hnhtbb.exec:\hnhtbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\7jdpv.exec:\7jdpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\lflflrl.exec:\lflflrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\hbtnnn.exec:\hbtnnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\pdpvj.exec:\pdpvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\lrrflfr.exec:\lrrflfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\htbbhh.exec:\htbbhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\ppppd.exec:\ppppd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\ffxxffl.exec:\ffxxffl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\nbnthn.exec:\nbnthn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\jvpvd.exec:\jvpvd.exe17⤵
- Executes dropped EXE
PID:2120 -
\??\c:\btbhhn.exec:\btbhhn.exe18⤵
- Executes dropped EXE
PID:904 -
\??\c:\bnttbt.exec:\bnttbt.exe19⤵
- Executes dropped EXE
PID:1500 -
\??\c:\rfxfrxl.exec:\rfxfrxl.exe20⤵
- Executes dropped EXE
PID:2124 -
\??\c:\hhnbnn.exec:\hhnbnn.exe21⤵
- Executes dropped EXE
PID:2836 -
\??\c:\pjvjp.exec:\pjvjp.exe22⤵
- Executes dropped EXE
PID:2824 -
\??\c:\lfrlxxf.exec:\lfrlxxf.exe23⤵
- Executes dropped EXE
PID:540 -
\??\c:\bththh.exec:\bththh.exe24⤵
- Executes dropped EXE
PID:564 -
\??\c:\jvjpd.exec:\jvjpd.exe25⤵
- Executes dropped EXE
PID:1660 -
\??\c:\xlfllrl.exec:\xlfllrl.exe26⤵
- Executes dropped EXE
PID:1876 -
\??\c:\3bhbbt.exec:\3bhbbt.exe27⤵
- Executes dropped EXE
PID:1636 -
\??\c:\rlxfffr.exec:\rlxfffr.exe28⤵
- Executes dropped EXE
PID:2136 -
\??\c:\tthhnn.exec:\tthhnn.exe29⤵
- Executes dropped EXE
PID:920 -
\??\c:\nbbtbb.exec:\nbbtbb.exe30⤵
- Executes dropped EXE
PID:2532 -
\??\c:\jdjjp.exec:\jdjjp.exe31⤵
- Executes dropped EXE
PID:3004 -
\??\c:\bbhthn.exec:\bbhthn.exe32⤵
- Executes dropped EXE
PID:2192 -
\??\c:\pjdpv.exec:\pjdpv.exe33⤵
- Executes dropped EXE
PID:1680 -
\??\c:\7xxxlrl.exec:\7xxxlrl.exe34⤵
- Executes dropped EXE
PID:2864 -
\??\c:\nbbnbb.exec:\nbbnbb.exe35⤵
- Executes dropped EXE
PID:1620 -
\??\c:\5bhtbb.exec:\5bhtbb.exe36⤵
- Executes dropped EXE
PID:2964 -
\??\c:\1jjpd.exec:\1jjpd.exe37⤵
- Executes dropped EXE
PID:3020 -
\??\c:\jdvjv.exec:\jdvjv.exe38⤵
- Executes dropped EXE
PID:2676 -
\??\c:\1fxrxxf.exec:\1fxrxxf.exe39⤵
- Executes dropped EXE
PID:2680 -
\??\c:\nbtbhh.exec:\nbtbhh.exe40⤵
- Executes dropped EXE
PID:2736 -
\??\c:\jjvjv.exec:\jjvjv.exe41⤵
- Executes dropped EXE
PID:2696 -
\??\c:\jdddp.exec:\jdddp.exe42⤵
- Executes dropped EXE
PID:2492 -
\??\c:\xfxflfr.exec:\xfxflfr.exe43⤵
- Executes dropped EXE
PID:2932 -
\??\c:\hhnntb.exec:\hhnntb.exe44⤵
- Executes dropped EXE
PID:2620 -
\??\c:\thtbbh.exec:\thtbbh.exe45⤵
- Executes dropped EXE
PID:2508 -
\??\c:\7dppd.exec:\7dppd.exe46⤵
- Executes dropped EXE
PID:2020 -
\??\c:\9xxrxxl.exec:\9xxrxxl.exe47⤵
- Executes dropped EXE
PID:2924 -
\??\c:\1fxflrf.exec:\1fxflrf.exe48⤵
- Executes dropped EXE
PID:2536 -
\??\c:\bthnnt.exec:\bthnnt.exe49⤵
- Executes dropped EXE
PID:2772 -
\??\c:\vpjvj.exec:\vpjvj.exe50⤵
- Executes dropped EXE
PID:2028 -
\??\c:\jdvvd.exec:\jdvvd.exe51⤵
- Executes dropped EXE
PID:1656 -
\??\c:\lfrxfrf.exec:\lfrxfrf.exe52⤵
- Executes dropped EXE
PID:1880 -
\??\c:\hbhbnh.exec:\hbhbnh.exe53⤵
- Executes dropped EXE
PID:1832 -
\??\c:\ntnnnn.exec:\ntnnnn.exe54⤵
- Executes dropped EXE
PID:1648 -
\??\c:\dpdjv.exec:\dpdjv.exe55⤵
- Executes dropped EXE
PID:1556 -
\??\c:\xxrrrxf.exec:\xxrrrxf.exe56⤵
- Executes dropped EXE
PID:1348 -
\??\c:\rrrxflx.exec:\rrrxflx.exe57⤵
- Executes dropped EXE
PID:1288 -
\??\c:\hbhnnh.exec:\hbhnnh.exe58⤵
- Executes dropped EXE
PID:1332 -
\??\c:\jjddj.exec:\jjddj.exe59⤵
- Executes dropped EXE
PID:2304 -
\??\c:\lxllrfl.exec:\lxllrfl.exe60⤵
- Executes dropped EXE
PID:1932 -
\??\c:\nhbnbh.exec:\nhbnbh.exe61⤵
- Executes dropped EXE
PID:2268 -
\??\c:\hthnbb.exec:\hthnbb.exe62⤵
- Executes dropped EXE
PID:772 -
\??\c:\pjjvj.exec:\pjjvj.exe63⤵
- Executes dropped EXE
PID:540 -
\??\c:\fxflrxr.exec:\fxflrxr.exe64⤵
- Executes dropped EXE
PID:564 -
\??\c:\hthhnn.exec:\hthhnn.exe65⤵
- Executes dropped EXE
PID:1788 -
\??\c:\jvppv.exec:\jvppv.exe66⤵PID:2088
-
\??\c:\fxffffr.exec:\fxffffr.exe67⤵PID:1884
-
\??\c:\bnhhbh.exec:\bnhhbh.exe68⤵PID:776
-
\??\c:\dvjjv.exec:\dvjjv.exe69⤵PID:1504
-
\??\c:\rxfffrx.exec:\rxfffrx.exe70⤵PID:2224
-
\??\c:\fxlrrxf.exec:\fxlrrxf.exe71⤵PID:2164
-
\??\c:\5hbhnn.exec:\5hbhnn.exe72⤵PID:2080
-
\??\c:\tnnntt.exec:\tnnntt.exe73⤵PID:3004
-
\??\c:\vjpvd.exec:\vjpvd.exe74⤵PID:2192
-
\??\c:\llxrxxl.exec:\llxrxxl.exe75⤵PID:2212
-
\??\c:\1tntbn.exec:\1tntbn.exe76⤵PID:1612
-
\??\c:\jdjpj.exec:\jdjpj.exe77⤵PID:1748
-
\??\c:\pdpjp.exec:\pdpjp.exe78⤵PID:2984
-
\??\c:\5xflxfr.exec:\5xflxfr.exe79⤵PID:2148
-
\??\c:\nhnntt.exec:\nhnntt.exe80⤵PID:2652
-
\??\c:\tnhtbh.exec:\tnhtbh.exe81⤵PID:2640
-
\??\c:\jdjpp.exec:\jdjpp.exe82⤵PID:2628
-
\??\c:\lxlfffl.exec:\lxlfffl.exe83⤵PID:2612
-
\??\c:\hnbhnb.exec:\hnbhnb.exe84⤵PID:2448
-
\??\c:\vdjjp.exec:\vdjjp.exe85⤵PID:2496
-
\??\c:\3ppvd.exec:\3ppvd.exe86⤵PID:2936
-
\??\c:\rlfrflx.exec:\rlfrflx.exe87⤵PID:2568
-
\??\c:\7httbt.exec:\7httbt.exe88⤵PID:2712
-
\??\c:\nbbnbb.exec:\nbbnbb.exe89⤵PID:2624
-
\??\c:\vdddd.exec:\vdddd.exe90⤵PID:2900
-
\??\c:\rxxlfxf.exec:\rxxlfxf.exe91⤵PID:2880
-
\??\c:\nhhbnn.exec:\nhhbnn.exe92⤵PID:760
-
\??\c:\5jpdj.exec:\5jpdj.exe93⤵PID:1864
-
\??\c:\jvjvd.exec:\jvjvd.exe94⤵PID:1796
-
\??\c:\rrrfrfl.exec:\rrrfrfl.exe95⤵PID:1576
-
\??\c:\hhntbh.exec:\hhntbh.exe96⤵PID:1192
-
\??\c:\pvdjv.exec:\pvdjv.exe97⤵PID:2296
-
\??\c:\vvjvp.exec:\vvjvp.exe98⤵PID:1360
-
\??\c:\fffrxfr.exec:\fffrxfr.exe99⤵PID:2104
-
\??\c:\hthhnn.exec:\hthhnn.exe100⤵PID:2292
-
\??\c:\dvvdj.exec:\dvvdj.exe101⤵PID:2412
-
\??\c:\pjdvj.exec:\pjdvj.exe102⤵PID:1976
-
\??\c:\fffrlfx.exec:\fffrlfx.exe103⤵PID:688
-
\??\c:\ttntbn.exec:\ttntbn.exe104⤵PID:1496
-
\??\c:\1dvdp.exec:\1dvdp.exe105⤵PID:1664
-
\??\c:\3rxllll.exec:\3rxllll.exe106⤵PID:1756
-
\??\c:\fxfrfxx.exec:\fxfrfxx.exe107⤵PID:808
-
\??\c:\tnbhnn.exec:\tnbhnn.exe108⤵PID:952
-
\??\c:\jdvdj.exec:\jdvdj.exe109⤵PID:344
-
\??\c:\lrlxrxl.exec:\lrlxrxl.exe110⤵PID:964
-
\??\c:\nhnthn.exec:\nhnthn.exe111⤵PID:1188
-
\??\c:\9hbhbh.exec:\9hbhbh.exe112⤵PID:2528
-
\??\c:\jdvdp.exec:\jdvdp.exe113⤵PID:2264
-
\??\c:\xrfxlrf.exec:\xrfxlrf.exe114⤵PID:1516
-
\??\c:\xfflffr.exec:\xfflffr.exe115⤵PID:1972
-
\??\c:\hnhbnt.exec:\hnhbnt.exe116⤵PID:2872
-
\??\c:\ddpvd.exec:\ddpvd.exe117⤵PID:2920
-
\??\c:\jdvvj.exec:\jdvvj.exe118⤵PID:2368
-
\??\c:\lfxrffr.exec:\lfxrffr.exe119⤵PID:1148
-
\??\c:\hhbtnb.exec:\hhbtnb.exe120⤵PID:2656
-
\??\c:\7vvdj.exec:\7vvdj.exe121⤵PID:1988
-
\??\c:\dvjdj.exec:\dvjdj.exe122⤵PID:2600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-