Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13-05-2024 19:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0c85ea076dcc9296f4fa953ba6674e50_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0c85ea076dcc9296f4fa953ba6674e50_NeikiAnalytics.exe
-
Size
232KB
-
MD5
0c85ea076dcc9296f4fa953ba6674e50
-
SHA1
f260eeee25c8ee1ba8824bea39aa5e934ba96f4d
-
SHA256
73520ba9871e7eb4d409d7e98a28019a12ff12b2a38b08f5608de875c040e5cc
-
SHA512
d593f587be0ef23d7e1a7477a427f1d8bbe75420b61c56cc59280d0a8c5018eac398a6d7f0de0e0136dabadce04fa60e078ba2640fa24a7bae5f41134f1e211c
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo7LAIRUohTF/SjSrbzLAuBjfwFOmoFzMvUpGqC5n+4:n3C9BRo/AIuuFSjA8uBjwI7FjpjC5+4
Malware Config
Signatures
-
Detect Blackmoon payload 18 IoCs
resource yara_rule behavioral1/memory/1296-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2020-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2320-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1028-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2392-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/608-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2284-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2044-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2216-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/580-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/644-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2020 7lrrxlx.exe 2612 3jpvj.exe 2796 llflfrl.exe 2648 tnntnt.exe 2320 tnhnbb.exe 2424 9ddpp.exe 2896 1xxrxxl.exe 1028 rlfffxx.exe 2720 nhtthh.exe 2752 ddppp.exe 1616 ppjpv.exe 1260 5lxffrx.exe 832 bthhnt.exe 1968 bbtnnt.exe 1508 7jpvv.exe 644 xrfrxlr.exe 840 llfllfr.exe 3036 nhbbbn.exe 1636 hbntbb.exe 2392 pjvvj.exe 608 rlxlfff.exe 580 bntnnn.exe 1416 tnnnht.exe 2284 pvpdp.exe 2316 3fxlrfx.exe 1032 9rlxrlr.exe 1088 bbhhtb.exe 2216 rrfrxfr.exe 2044 xrrlrxr.exe 1928 7thbnt.exe 2220 vvvjv.exe 2008 1dvdp.exe 2144 xrrrllr.exe 2692 llxlfrx.exe 2624 hhttbb.exe 2420 jjdpd.exe 1124 9pppd.exe 2440 rrxlxlr.exe 2680 frffrrx.exe 2320 tbtbtb.exe 2412 btbbbh.exe 2416 hbbbbh.exe 2468 dvjpd.exe 2740 jjpvp.exe 2776 ffflflf.exe 2304 llfrlrr.exe 2636 nhttnn.exe 2132 xxlrxrf.exe 1916 7lflxfr.exe 2764 bbnhnt.exe 2388 3vpvj.exe 1436 bbtbtt.exe 2184 bthnbt.exe 1492 3jvdp.exe 2260 ddjdv.exe 2080 rlfrrxf.exe 1636 7nhnbh.exe 488 dpdjp.exe 2116 rrffllr.exe 2192 tnhnbh.exe 2816 5httbh.exe 1568 vpdjp.exe 2100 1dppj.exe 544 3xxflxl.exe -
resource yara_rule behavioral1/memory/1296-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2320-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2320-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2320-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1028-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/608-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-298-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/580-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/644-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-66-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1296 wrote to memory of 2020 1296 0c85ea076dcc9296f4fa953ba6674e50_NeikiAnalytics.exe 28 PID 1296 wrote to memory of 2020 1296 0c85ea076dcc9296f4fa953ba6674e50_NeikiAnalytics.exe 28 PID 1296 wrote to memory of 2020 1296 0c85ea076dcc9296f4fa953ba6674e50_NeikiAnalytics.exe 28 PID 1296 wrote to memory of 2020 1296 0c85ea076dcc9296f4fa953ba6674e50_NeikiAnalytics.exe 28 PID 2020 wrote to memory of 2612 2020 7lrrxlx.exe 29 PID 2020 wrote to memory of 2612 2020 7lrrxlx.exe 29 PID 2020 wrote to memory of 2612 2020 7lrrxlx.exe 29 PID 2020 wrote to memory of 2612 2020 7lrrxlx.exe 29 PID 2612 wrote to memory of 2796 2612 3jpvj.exe 30 PID 2612 wrote to memory of 2796 2612 3jpvj.exe 30 PID 2612 wrote to memory of 2796 2612 3jpvj.exe 30 PID 2612 wrote to memory of 2796 2612 3jpvj.exe 30 PID 2796 wrote to memory of 2648 2796 llflfrl.exe 31 PID 2796 wrote to memory of 2648 2796 llflfrl.exe 31 PID 2796 wrote to memory of 2648 2796 llflfrl.exe 31 PID 2796 wrote to memory of 2648 2796 llflfrl.exe 31 PID 2648 wrote to memory of 2320 2648 tnntnt.exe 32 PID 2648 wrote to memory of 2320 2648 tnntnt.exe 32 PID 2648 wrote to memory of 2320 2648 tnntnt.exe 32 PID 2648 wrote to memory of 2320 2648 tnntnt.exe 32 PID 2320 wrote to memory of 2424 2320 tnhnbb.exe 33 PID 2320 wrote to memory of 2424 2320 tnhnbb.exe 33 PID 2320 wrote to memory of 2424 2320 tnhnbb.exe 33 PID 2320 wrote to memory of 2424 2320 tnhnbb.exe 33 PID 2424 wrote to memory of 2896 2424 9ddpp.exe 34 PID 2424 wrote to memory of 2896 2424 9ddpp.exe 34 PID 2424 wrote to memory of 2896 2424 9ddpp.exe 34 PID 2424 wrote to memory of 2896 2424 9ddpp.exe 34 PID 2896 wrote to memory of 1028 2896 1xxrxxl.exe 35 PID 2896 wrote to memory of 1028 2896 1xxrxxl.exe 35 PID 2896 wrote to memory of 1028 2896 1xxrxxl.exe 35 PID 2896 wrote to memory of 1028 2896 1xxrxxl.exe 35 PID 1028 wrote to memory of 2720 1028 rlfffxx.exe 36 PID 1028 wrote to memory of 2720 1028 rlfffxx.exe 36 PID 1028 wrote to memory of 2720 1028 rlfffxx.exe 36 PID 1028 wrote to memory of 2720 1028 rlfffxx.exe 36 PID 2720 wrote to memory of 2752 2720 nhtthh.exe 37 PID 2720 wrote to memory of 2752 2720 nhtthh.exe 37 PID 2720 wrote to memory of 2752 2720 nhtthh.exe 37 PID 2720 wrote to memory of 2752 2720 nhtthh.exe 37 PID 2752 wrote to memory of 1616 2752 ddppp.exe 38 PID 2752 wrote to memory of 1616 2752 ddppp.exe 38 PID 2752 wrote to memory of 1616 2752 ddppp.exe 38 PID 2752 wrote to memory of 1616 2752 ddppp.exe 38 PID 1616 wrote to memory of 1260 1616 ppjpv.exe 39 PID 1616 wrote to memory of 1260 1616 ppjpv.exe 39 PID 1616 wrote to memory of 1260 1616 ppjpv.exe 39 PID 1616 wrote to memory of 1260 1616 ppjpv.exe 39 PID 1260 wrote to memory of 832 1260 5lxffrx.exe 40 PID 1260 wrote to memory of 832 1260 5lxffrx.exe 40 PID 1260 wrote to memory of 832 1260 5lxffrx.exe 40 PID 1260 wrote to memory of 832 1260 5lxffrx.exe 40 PID 832 wrote to memory of 1968 832 bthhnt.exe 41 PID 832 wrote to memory of 1968 832 bthhnt.exe 41 PID 832 wrote to memory of 1968 832 bthhnt.exe 41 PID 832 wrote to memory of 1968 832 bthhnt.exe 41 PID 1968 wrote to memory of 1508 1968 bbtnnt.exe 42 PID 1968 wrote to memory of 1508 1968 bbtnnt.exe 42 PID 1968 wrote to memory of 1508 1968 bbtnnt.exe 42 PID 1968 wrote to memory of 1508 1968 bbtnnt.exe 42 PID 1508 wrote to memory of 644 1508 7jpvv.exe 43 PID 1508 wrote to memory of 644 1508 7jpvv.exe 43 PID 1508 wrote to memory of 644 1508 7jpvv.exe 43 PID 1508 wrote to memory of 644 1508 7jpvv.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c85ea076dcc9296f4fa953ba6674e50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0c85ea076dcc9296f4fa953ba6674e50_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\7lrrxlx.exec:\7lrrxlx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\3jpvj.exec:\3jpvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\llflfrl.exec:\llflfrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\tnntnt.exec:\tnntnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\tnhnbb.exec:\tnhnbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\9ddpp.exec:\9ddpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\1xxrxxl.exec:\1xxrxxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\rlfffxx.exec:\rlfffxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\nhtthh.exec:\nhtthh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\ddppp.exec:\ddppp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\ppjpv.exec:\ppjpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\5lxffrx.exec:\5lxffrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\bthhnt.exec:\bthhnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\bbtnnt.exec:\bbtnnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\7jpvv.exec:\7jpvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\xrfrxlr.exec:\xrfrxlr.exe17⤵
- Executes dropped EXE
PID:644 -
\??\c:\llfllfr.exec:\llfllfr.exe18⤵
- Executes dropped EXE
PID:840 -
\??\c:\nhbbbn.exec:\nhbbbn.exe19⤵
- Executes dropped EXE
PID:3036 -
\??\c:\hbntbb.exec:\hbntbb.exe20⤵
- Executes dropped EXE
PID:1636 -
\??\c:\pjvvj.exec:\pjvvj.exe21⤵
- Executes dropped EXE
PID:2392 -
\??\c:\rlxlfff.exec:\rlxlfff.exe22⤵
- Executes dropped EXE
PID:608 -
\??\c:\bntnnn.exec:\bntnnn.exe23⤵
- Executes dropped EXE
PID:580 -
\??\c:\tnnnht.exec:\tnnnht.exe24⤵
- Executes dropped EXE
PID:1416 -
\??\c:\pvpdp.exec:\pvpdp.exe25⤵
- Executes dropped EXE
PID:2284 -
\??\c:\3fxlrfx.exec:\3fxlrfx.exe26⤵
- Executes dropped EXE
PID:2316 -
\??\c:\9rlxrlr.exec:\9rlxrlr.exe27⤵
- Executes dropped EXE
PID:1032 -
\??\c:\bbhhtb.exec:\bbhhtb.exe28⤵
- Executes dropped EXE
PID:1088 -
\??\c:\rrfrxfr.exec:\rrfrxfr.exe29⤵
- Executes dropped EXE
PID:2216 -
\??\c:\xrrlrxr.exec:\xrrlrxr.exe30⤵
- Executes dropped EXE
PID:2044 -
\??\c:\7thbnt.exec:\7thbnt.exe31⤵
- Executes dropped EXE
PID:1928 -
\??\c:\vvvjv.exec:\vvvjv.exe32⤵
- Executes dropped EXE
PID:2220 -
\??\c:\1dvdp.exec:\1dvdp.exe33⤵
- Executes dropped EXE
PID:2008 -
\??\c:\xrrrllr.exec:\xrrrllr.exe34⤵
- Executes dropped EXE
PID:2144 -
\??\c:\llxlfrx.exec:\llxlfrx.exe35⤵
- Executes dropped EXE
PID:2692 -
\??\c:\hhttbb.exec:\hhttbb.exe36⤵
- Executes dropped EXE
PID:2624 -
\??\c:\jjdpd.exec:\jjdpd.exe37⤵
- Executes dropped EXE
PID:2420 -
\??\c:\9pppd.exec:\9pppd.exe38⤵
- Executes dropped EXE
PID:1124 -
\??\c:\rrxlxlr.exec:\rrxlxlr.exe39⤵
- Executes dropped EXE
PID:2440 -
\??\c:\frffrrx.exec:\frffrrx.exe40⤵
- Executes dropped EXE
PID:2680 -
\??\c:\tbtbtb.exec:\tbtbtb.exe41⤵
- Executes dropped EXE
PID:2320 -
\??\c:\btbbbh.exec:\btbbbh.exe42⤵
- Executes dropped EXE
PID:2412 -
\??\c:\hbbbbh.exec:\hbbbbh.exe43⤵
- Executes dropped EXE
PID:2416 -
\??\c:\dvjpd.exec:\dvjpd.exe44⤵
- Executes dropped EXE
PID:2468 -
\??\c:\jjpvp.exec:\jjpvp.exe45⤵
- Executes dropped EXE
PID:2740 -
\??\c:\ffflflf.exec:\ffflflf.exe46⤵
- Executes dropped EXE
PID:2776 -
\??\c:\llfrlrr.exec:\llfrlrr.exe47⤵
- Executes dropped EXE
PID:2304 -
\??\c:\nhttnn.exec:\nhttnn.exe48⤵
- Executes dropped EXE
PID:2636 -
\??\c:\xxlrxrf.exec:\xxlrxrf.exe49⤵
- Executes dropped EXE
PID:2132 -
\??\c:\7lflxfr.exec:\7lflxfr.exe50⤵
- Executes dropped EXE
PID:1916 -
\??\c:\bbnhnt.exec:\bbnhnt.exe51⤵
- Executes dropped EXE
PID:2764 -
\??\c:\3vpvj.exec:\3vpvj.exe52⤵
- Executes dropped EXE
PID:2388 -
\??\c:\bbtbtt.exec:\bbtbtt.exe53⤵
- Executes dropped EXE
PID:1436 -
\??\c:\bthnbt.exec:\bthnbt.exe54⤵
- Executes dropped EXE
PID:2184 -
\??\c:\3jvdp.exec:\3jvdp.exe55⤵
- Executes dropped EXE
PID:1492 -
\??\c:\ddjdv.exec:\ddjdv.exe56⤵
- Executes dropped EXE
PID:2260 -
\??\c:\rlfrrxf.exec:\rlfrrxf.exe57⤵
- Executes dropped EXE
PID:2080 -
\??\c:\7nhnbh.exec:\7nhnbh.exe58⤵
- Executes dropped EXE
PID:1636 -
\??\c:\dpdjp.exec:\dpdjp.exe59⤵
- Executes dropped EXE
PID:488 -
\??\c:\rrffllr.exec:\rrffllr.exe60⤵
- Executes dropped EXE
PID:2116 -
\??\c:\tnhnbh.exec:\tnhnbh.exe61⤵
- Executes dropped EXE
PID:2192 -
\??\c:\5httbh.exec:\5httbh.exe62⤵
- Executes dropped EXE
PID:2816 -
\??\c:\vpdjp.exec:\vpdjp.exe63⤵
- Executes dropped EXE
PID:1568 -
\??\c:\1dppj.exec:\1dppj.exe64⤵
- Executes dropped EXE
PID:2100 -
\??\c:\3xxflxl.exec:\3xxflxl.exe65⤵
- Executes dropped EXE
PID:544 -
\??\c:\9nttth.exec:\9nttth.exe66⤵PID:1724
-
\??\c:\5bhntn.exec:\5bhntn.exe67⤵PID:3052
-
\??\c:\ddjjj.exec:\ddjjj.exe68⤵PID:2948
-
\??\c:\3ppjv.exec:\3ppjv.exe69⤵PID:1728
-
\??\c:\rxfrxrr.exec:\rxfrxrr.exe70⤵PID:2788
-
\??\c:\bntthn.exec:\bntthn.exe71⤵PID:2244
-
\??\c:\nnhntb.exec:\nnhntb.exe72⤵PID:560
-
\??\c:\ppjpp.exec:\ppjpp.exe73⤵PID:2600
-
\??\c:\jdvpj.exec:\jdvpj.exe74⤵PID:2008
-
\??\c:\5xxxlrf.exec:\5xxxlrf.exe75⤵PID:2144
-
\??\c:\llfrflx.exec:\llfrflx.exe76⤵PID:2640
-
\??\c:\tntbnt.exec:\tntbnt.exe77⤵PID:2548
-
\??\c:\9dvpd.exec:\9dvpd.exe78⤵PID:2532
-
\??\c:\pjvvd.exec:\pjvvd.exe79⤵PID:2568
-
\??\c:\fxlfrrx.exec:\fxlfrrx.exe80⤵PID:2580
-
\??\c:\7lxfflx.exec:\7lxfflx.exe81⤵PID:2432
-
\??\c:\nnhbhn.exec:\nnhbhn.exe82⤵PID:2680
-
\??\c:\btnbnt.exec:\btnbnt.exe83⤵PID:2484
-
\??\c:\dpdpv.exec:\dpdpv.exe84⤵PID:2428
-
\??\c:\rrlrflr.exec:\rrlrflr.exe85⤵PID:776
-
\??\c:\bbtbth.exec:\bbtbth.exe86⤵PID:2756
-
\??\c:\1tnnbn.exec:\1tnnbn.exe87⤵PID:2720
-
\??\c:\nnthnn.exec:\nnthnn.exe88⤵PID:2752
-
\??\c:\jdpdv.exec:\jdpdv.exe89⤵PID:1600
-
\??\c:\3frlllx.exec:\3frlllx.exe90⤵PID:2636
-
\??\c:\fxxflxf.exec:\fxxflxf.exe91⤵PID:1900
-
\??\c:\rlffrxr.exec:\rlffrxr.exe92⤵PID:1916
-
\??\c:\nhtthh.exec:\nhtthh.exe93⤵PID:1968
-
\??\c:\pjddp.exec:\pjddp.exe94⤵PID:2388
-
\??\c:\5pdvv.exec:\5pdvv.exe95⤵PID:1336
-
\??\c:\7lxxflr.exec:\7lxxflr.exe96⤵PID:2184
-
\??\c:\lffflll.exec:\lffflll.exe97⤵PID:312
-
\??\c:\hbhthn.exec:\hbhthn.exe98⤵PID:2260
-
\??\c:\hhbhnn.exec:\hhbhnn.exe99⤵PID:2256
-
\??\c:\jjppj.exec:\jjppj.exe100⤵PID:2392
-
\??\c:\rfrlfxx.exec:\rfrlfxx.exe101⤵PID:1432
-
\??\c:\rlxfllx.exec:\rlxfllx.exe102⤵PID:584
-
\??\c:\nnbbhn.exec:\nnbbhn.exe103⤵PID:2808
-
\??\c:\ttnnbn.exec:\ttnnbn.exe104⤵PID:2344
-
\??\c:\jdpdp.exec:\jdpdp.exe105⤵PID:1472
-
\??\c:\rllrllx.exec:\rllrllx.exe106⤵PID:380
-
\??\c:\xrrrxxl.exec:\xrrrxxl.exe107⤵PID:800
-
\??\c:\tthnbh.exec:\tthnbh.exe108⤵PID:1764
-
\??\c:\hhtbtb.exec:\hhtbtb.exe109⤵PID:972
-
\??\c:\1dvvj.exec:\1dvvj.exe110⤵PID:916
-
\??\c:\ppjpv.exec:\ppjpv.exe111⤵PID:2104
-
\??\c:\fxflxxf.exec:\fxflxxf.exe112⤵PID:2212
-
\??\c:\9frrxfr.exec:\9frrxfr.exe113⤵PID:1444
-
\??\c:\ttbhnn.exec:\ttbhnn.exe114⤵PID:1984
-
\??\c:\btntht.exec:\btntht.exe115⤵PID:1276
-
\??\c:\vvppd.exec:\vvppd.exe116⤵PID:1544
-
\??\c:\lxlrxfl.exec:\lxlrxfl.exe117⤵PID:2692
-
\??\c:\fxffxxl.exec:\fxffxxl.exe118⤵PID:1520
-
\??\c:\tntbnn.exec:\tntbnn.exe119⤵PID:2608
-
\??\c:\7tnntt.exec:\7tnntt.exe120⤵PID:2676
-
\??\c:\5jdpd.exec:\5jdpd.exe121⤵PID:2448
-
\??\c:\jjvdj.exec:\jjvdj.exe122⤵PID:2992
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-