Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16-05-2024 16:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e418f0c6d353387a4f9f5ecbf2b57aa0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
e418f0c6d353387a4f9f5ecbf2b57aa0_NeikiAnalytics.exe
-
Size
471KB
-
MD5
e418f0c6d353387a4f9f5ecbf2b57aa0
-
SHA1
3f902786b3441fe0a49290e53b34fae2b089e371
-
SHA256
0b1baf6b62193648cbfd5345181179bbb7aa5b1715bfef29fd0c820ee0cc7a9d
-
SHA512
d9f720e3fbe008735953c1b62a773c14b12d134ef9e2b1497fa62b9fdf4d7dd059d18b6519d34aa8742fd7a28edccf58254c23e0f5455ead18df3c47402b1cdd
-
SSDEEP
6144:n3C9BRo7MlrWKo+lS0Le4xRSAoq78yoyfx93sY0AJq4mZAx5O:n3C9yMo+S0L9xRnoq7H9pmom
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/2928-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1144-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2356-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1696-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1976-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1256-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2968-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/408-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2352-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1760-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1712-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1144 vdjvv.exe 2696 thhnbn.exe 2648 3pdjv.exe 2736 pdpvv.exe 2120 xllfrrf.exe 2764 pvjpp.exe 2552 xfxxllf.exe 2564 nhbhnt.exe 2356 llffxfx.exe 1700 hbnbhn.exe 2784 5tntnt.exe 1696 ffrrxfr.exe 1976 hbbbth.exe 664 nhbbhn.exe 1156 jddpv.exe 796 bnthhb.exe 2204 vpjdv.exe 1568 9tntbn.exe 2920 9hbhtb.exe 1256 3nhthh.exe 2968 xrflxfr.exe 708 bnbhnn.exe 1792 hnbtbb.exe 408 5lxxfxl.exe 2352 1bhntt.exe 1760 3lflxfx.exe 1396 thntnh.exe 2300 xxlrffl.exe 908 nhbbhn.exe 1712 flflxxr.exe 1268 jjddv.exe 2288 5lxlrrf.exe 1504 bbtbht.exe 1336 7lrxxxr.exe 1564 nnhnbb.exe 1144 vvvjd.exe 2124 1xrxxxf.exe 2664 nnbbtn.exe 2800 1jjpd.exe 2648 7vvpj.exe 2668 7tthnt.exe 2880 ddvvj.exe 2680 3lxlrfr.exe 2516 nttbtb.exe 2552 1djvp.exe 2444 xxxrlrr.exe 2568 7btbhn.exe 2700 jvjdv.exe 2836 dpvjd.exe 2760 xrrrlrl.exe 1696 5thnhn.exe 2244 djpdd.exe 896 lfrxffx.exe 1900 nhbnbh.exe 1156 djpvj.exe 1660 3lxrxrl.exe 1680 9rrxrxr.exe 2992 nnnhtt.exe 2912 dvppd.exe 2920 lfrfrxf.exe 1256 hbthhn.exe 2956 1vvdp.exe 2432 xrlfxrf.exe 1768 ntnbnn.exe -
resource yara_rule behavioral1/memory/2928-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1144-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1256-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/408-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2352-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1760-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1712-290-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2928 wrote to memory of 1144 2928 e418f0c6d353387a4f9f5ecbf2b57aa0_NeikiAnalytics.exe 28 PID 2928 wrote to memory of 1144 2928 e418f0c6d353387a4f9f5ecbf2b57aa0_NeikiAnalytics.exe 28 PID 2928 wrote to memory of 1144 2928 e418f0c6d353387a4f9f5ecbf2b57aa0_NeikiAnalytics.exe 28 PID 2928 wrote to memory of 1144 2928 e418f0c6d353387a4f9f5ecbf2b57aa0_NeikiAnalytics.exe 28 PID 1144 wrote to memory of 2696 1144 vdjvv.exe 29 PID 1144 wrote to memory of 2696 1144 vdjvv.exe 29 PID 1144 wrote to memory of 2696 1144 vdjvv.exe 29 PID 1144 wrote to memory of 2696 1144 vdjvv.exe 29 PID 2696 wrote to memory of 2648 2696 thhnbn.exe 30 PID 2696 wrote to memory of 2648 2696 thhnbn.exe 30 PID 2696 wrote to memory of 2648 2696 thhnbn.exe 30 PID 2696 wrote to memory of 2648 2696 thhnbn.exe 30 PID 2648 wrote to memory of 2736 2648 3pdjv.exe 31 PID 2648 wrote to memory of 2736 2648 3pdjv.exe 31 PID 2648 wrote to memory of 2736 2648 3pdjv.exe 31 PID 2648 wrote to memory of 2736 2648 3pdjv.exe 31 PID 2736 wrote to memory of 2120 2736 pdpvv.exe 32 PID 2736 wrote to memory of 2120 2736 pdpvv.exe 32 PID 2736 wrote to memory of 2120 2736 pdpvv.exe 32 PID 2736 wrote to memory of 2120 2736 pdpvv.exe 32 PID 2120 wrote to memory of 2764 2120 xllfrrf.exe 33 PID 2120 wrote to memory of 2764 2120 xllfrrf.exe 33 PID 2120 wrote to memory of 2764 2120 xllfrrf.exe 33 PID 2120 wrote to memory of 2764 2120 xllfrrf.exe 33 PID 2764 wrote to memory of 2552 2764 pvjpp.exe 34 PID 2764 wrote to memory of 2552 2764 pvjpp.exe 34 PID 2764 wrote to memory of 2552 2764 pvjpp.exe 34 PID 2764 wrote to memory of 2552 2764 pvjpp.exe 34 PID 2552 wrote to memory of 2564 2552 xfxxllf.exe 35 PID 2552 wrote to memory of 2564 2552 xfxxllf.exe 35 PID 2552 wrote to memory of 2564 2552 xfxxllf.exe 35 PID 2552 wrote to memory of 2564 2552 xfxxllf.exe 35 PID 2564 wrote to memory of 2356 2564 nhbhnt.exe 36 PID 2564 wrote to memory of 2356 2564 nhbhnt.exe 36 PID 2564 wrote to memory of 2356 2564 nhbhnt.exe 36 PID 2564 wrote to memory of 2356 2564 nhbhnt.exe 36 PID 2356 wrote to memory of 1700 2356 llffxfx.exe 37 PID 2356 wrote to memory of 1700 2356 llffxfx.exe 37 PID 2356 wrote to memory of 1700 2356 llffxfx.exe 37 PID 2356 wrote to memory of 1700 2356 llffxfx.exe 37 PID 1700 wrote to memory of 2784 1700 hbnbhn.exe 38 PID 1700 wrote to memory of 2784 1700 hbnbhn.exe 38 PID 1700 wrote to memory of 2784 1700 hbnbhn.exe 38 PID 1700 wrote to memory of 2784 1700 hbnbhn.exe 38 PID 2784 wrote to memory of 1696 2784 5tntnt.exe 39 PID 2784 wrote to memory of 1696 2784 5tntnt.exe 39 PID 2784 wrote to memory of 1696 2784 5tntnt.exe 39 PID 2784 wrote to memory of 1696 2784 5tntnt.exe 39 PID 1696 wrote to memory of 1976 1696 ffrrxfr.exe 40 PID 1696 wrote to memory of 1976 1696 ffrrxfr.exe 40 PID 1696 wrote to memory of 1976 1696 ffrrxfr.exe 40 PID 1696 wrote to memory of 1976 1696 ffrrxfr.exe 40 PID 1976 wrote to memory of 664 1976 hbbbth.exe 41 PID 1976 wrote to memory of 664 1976 hbbbth.exe 41 PID 1976 wrote to memory of 664 1976 hbbbth.exe 41 PID 1976 wrote to memory of 664 1976 hbbbth.exe 41 PID 664 wrote to memory of 1156 664 nhbbhn.exe 42 PID 664 wrote to memory of 1156 664 nhbbhn.exe 42 PID 664 wrote to memory of 1156 664 nhbbhn.exe 42 PID 664 wrote to memory of 1156 664 nhbbhn.exe 42 PID 1156 wrote to memory of 796 1156 jddpv.exe 43 PID 1156 wrote to memory of 796 1156 jddpv.exe 43 PID 1156 wrote to memory of 796 1156 jddpv.exe 43 PID 1156 wrote to memory of 796 1156 jddpv.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\e418f0c6d353387a4f9f5ecbf2b57aa0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e418f0c6d353387a4f9f5ecbf2b57aa0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\vdjvv.exec:\vdjvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\thhnbn.exec:\thhnbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\3pdjv.exec:\3pdjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\pdpvv.exec:\pdpvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\xllfrrf.exec:\xllfrrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\pvjpp.exec:\pvjpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\xfxxllf.exec:\xfxxllf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\nhbhnt.exec:\nhbhnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\llffxfx.exec:\llffxfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\hbnbhn.exec:\hbnbhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\5tntnt.exec:\5tntnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\ffrrxfr.exec:\ffrrxfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\hbbbth.exec:\hbbbth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\nhbbhn.exec:\nhbbhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\jddpv.exec:\jddpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\bnthhb.exec:\bnthhb.exe17⤵
- Executes dropped EXE
PID:796 -
\??\c:\vpjdv.exec:\vpjdv.exe18⤵
- Executes dropped EXE
PID:2204 -
\??\c:\9tntbn.exec:\9tntbn.exe19⤵
- Executes dropped EXE
PID:1568 -
\??\c:\9hbhtb.exec:\9hbhtb.exe20⤵
- Executes dropped EXE
PID:2920 -
\??\c:\3nhthh.exec:\3nhthh.exe21⤵
- Executes dropped EXE
PID:1256 -
\??\c:\xrflxfr.exec:\xrflxfr.exe22⤵
- Executes dropped EXE
PID:2968 -
\??\c:\bnbhnn.exec:\bnbhnn.exe23⤵
- Executes dropped EXE
PID:708 -
\??\c:\hnbtbb.exec:\hnbtbb.exe24⤵
- Executes dropped EXE
PID:1792 -
\??\c:\5lxxfxl.exec:\5lxxfxl.exe25⤵
- Executes dropped EXE
PID:408 -
\??\c:\1bhntt.exec:\1bhntt.exe26⤵
- Executes dropped EXE
PID:2352 -
\??\c:\3lflxfx.exec:\3lflxfx.exe27⤵
- Executes dropped EXE
PID:1760 -
\??\c:\thntnh.exec:\thntnh.exe28⤵
- Executes dropped EXE
PID:1396 -
\??\c:\xxlrffl.exec:\xxlrffl.exe29⤵
- Executes dropped EXE
PID:2300 -
\??\c:\nhbbhn.exec:\nhbbhn.exe30⤵
- Executes dropped EXE
PID:908 -
\??\c:\flflxxr.exec:\flflxxr.exe31⤵
- Executes dropped EXE
PID:1712 -
\??\c:\jjddv.exec:\jjddv.exe32⤵
- Executes dropped EXE
PID:1268 -
\??\c:\5lxlrrf.exec:\5lxlrrf.exe33⤵
- Executes dropped EXE
PID:2288 -
\??\c:\bbtbht.exec:\bbtbht.exe34⤵
- Executes dropped EXE
PID:1504 -
\??\c:\7lrxxxr.exec:\7lrxxxr.exe35⤵
- Executes dropped EXE
PID:1336 -
\??\c:\nnhnbb.exec:\nnhnbb.exe36⤵
- Executes dropped EXE
PID:1564 -
\??\c:\vvvjd.exec:\vvvjd.exe37⤵
- Executes dropped EXE
PID:1144 -
\??\c:\1xrxxxf.exec:\1xrxxxf.exe38⤵
- Executes dropped EXE
PID:2124 -
\??\c:\nnbbtn.exec:\nnbbtn.exe39⤵
- Executes dropped EXE
PID:2664 -
\??\c:\1jjpd.exec:\1jjpd.exe40⤵
- Executes dropped EXE
PID:2800 -
\??\c:\7vvpj.exec:\7vvpj.exe41⤵
- Executes dropped EXE
PID:2648 -
\??\c:\7tthnt.exec:\7tthnt.exe42⤵
- Executes dropped EXE
PID:2668 -
\??\c:\ddvvj.exec:\ddvvj.exe43⤵
- Executes dropped EXE
PID:2880 -
\??\c:\3lxlrfr.exec:\3lxlrfr.exe44⤵
- Executes dropped EXE
PID:2680 -
\??\c:\nttbtb.exec:\nttbtb.exe45⤵
- Executes dropped EXE
PID:2516 -
\??\c:\1djvp.exec:\1djvp.exe46⤵
- Executes dropped EXE
PID:2552 -
\??\c:\xxxrlrr.exec:\xxxrlrr.exe47⤵
- Executes dropped EXE
PID:2444 -
\??\c:\7btbhn.exec:\7btbhn.exe48⤵
- Executes dropped EXE
PID:2568 -
\??\c:\jvjdv.exec:\jvjdv.exe49⤵
- Executes dropped EXE
PID:2700 -
\??\c:\dpvjd.exec:\dpvjd.exe50⤵
- Executes dropped EXE
PID:2836 -
\??\c:\xrrrlrl.exec:\xrrrlrl.exe51⤵
- Executes dropped EXE
PID:2760 -
\??\c:\5thnhn.exec:\5thnhn.exe52⤵
- Executes dropped EXE
PID:1696 -
\??\c:\djpdd.exec:\djpdd.exe53⤵
- Executes dropped EXE
PID:2244 -
\??\c:\lfrxffx.exec:\lfrxffx.exe54⤵
- Executes dropped EXE
PID:896 -
\??\c:\nhbnbh.exec:\nhbnbh.exe55⤵
- Executes dropped EXE
PID:1900 -
\??\c:\djpvj.exec:\djpvj.exe56⤵
- Executes dropped EXE
PID:1156 -
\??\c:\3lxrxrl.exec:\3lxrxrl.exe57⤵
- Executes dropped EXE
PID:1660 -
\??\c:\9rrxrxr.exec:\9rrxrxr.exe58⤵
- Executes dropped EXE
PID:1680 -
\??\c:\nnnhtt.exec:\nnnhtt.exe59⤵
- Executes dropped EXE
PID:2992 -
\??\c:\dvppd.exec:\dvppd.exe60⤵
- Executes dropped EXE
PID:2912 -
\??\c:\lfrfrxf.exec:\lfrfrxf.exe61⤵
- Executes dropped EXE
PID:2920 -
\??\c:\hbthhn.exec:\hbthhn.exe62⤵
- Executes dropped EXE
PID:1256 -
\??\c:\1vvdp.exec:\1vvdp.exe63⤵
- Executes dropped EXE
PID:2956 -
\??\c:\xrlfxrf.exec:\xrlfxrf.exe64⤵
- Executes dropped EXE
PID:2432 -
\??\c:\ntnbnn.exec:\ntnbnn.exe65⤵
- Executes dropped EXE
PID:1768 -
\??\c:\jjvdp.exec:\jjvdp.exe66⤵PID:2188
-
\??\c:\rxfrlxf.exec:\rxfrlxf.exe67⤵PID:2144
-
\??\c:\xrrxrxl.exec:\xrrxrxl.exe68⤵PID:1764
-
\??\c:\bthbhb.exec:\bthbhb.exe69⤵PID:948
-
\??\c:\ppdpj.exec:\ppdpj.exe70⤵PID:1228
-
\??\c:\lfrlxrx.exec:\lfrlxrx.exe71⤵PID:1772
-
\??\c:\nnbnbn.exec:\nnbnbn.exe72⤵PID:900
-
\??\c:\dpjvd.exec:\dpjvd.exe73⤵PID:2860
-
\??\c:\rflxlxx.exec:\rflxlxx.exe74⤵PID:1936
-
\??\c:\tnhbnn.exec:\tnhbnn.exe75⤵PID:376
-
\??\c:\vvddv.exec:\vvddv.exe76⤵PID:2064
-
\??\c:\5dvvp.exec:\5dvvp.exe77⤵PID:1316
-
\??\c:\xfxfrrf.exec:\xfxfrrf.exe78⤵PID:2928
-
\??\c:\7nnntn.exec:\7nnntn.exe79⤵PID:1584
-
\??\c:\vjjdd.exec:\vjjdd.exe80⤵PID:2600
-
\??\c:\llxxrrf.exec:\llxxrrf.exe81⤵PID:1144
-
\??\c:\hnthht.exec:\hnthht.exe82⤵PID:2748
-
\??\c:\jppvd.exec:\jppvd.exe83⤵PID:2656
-
\??\c:\vdvdj.exec:\vdvdj.exe84⤵PID:2708
-
\??\c:\xxxlrrl.exec:\xxxlrrl.exe85⤵PID:2648
-
\??\c:\7btbnn.exec:\7btbnn.exe86⤵PID:2120
-
\??\c:\jvjvv.exec:\jvjvv.exe87⤵PID:2160
-
\??\c:\flfrxfx.exec:\flfrxfx.exe88⤵PID:2584
-
\??\c:\5nhbhn.exec:\5nhbhn.exe89⤵PID:2556
-
\??\c:\pjdpd.exec:\pjdpd.exe90⤵PID:3032
-
\??\c:\xfrrlff.exec:\xfrrlff.exe91⤵PID:1964
-
\??\c:\7hbhbh.exec:\7hbhbh.exe92⤵PID:1700
-
\??\c:\dvpvd.exec:\dvpvd.exe93⤵PID:1124
-
\??\c:\xlfrflx.exec:\xlfrflx.exe94⤵PID:1744
-
\??\c:\bnbhhh.exec:\bnbhhh.exe95⤵PID:2216
-
\??\c:\vvdvd.exec:\vvdvd.exe96⤵PID:264
-
\??\c:\lfrxrrr.exec:\lfrxrrr.exe97⤵PID:1052
-
\??\c:\thnbtn.exec:\thnbtn.exe98⤵PID:760
-
\??\c:\5pjdp.exec:\5pjdp.exe99⤵PID:580
-
\??\c:\3dddp.exec:\3dddp.exe100⤵PID:552
-
\??\c:\rfrrlrf.exec:\rfrrlrf.exe101⤵PID:2908
-
\??\c:\bhbthn.exec:\bhbthn.exe102⤵PID:2904
-
\??\c:\pjddv.exec:\pjddv.exe103⤵PID:2884
-
\??\c:\xlflllx.exec:\xlflllx.exe104⤵PID:2952
-
\??\c:\nnhhbh.exec:\nnhhbh.exe105⤵PID:2328
-
\??\c:\bhnbbt.exec:\bhnbbt.exe106⤵PID:1844
-
\??\c:\jvvvv.exec:\jvvvv.exe107⤵PID:2872
-
\??\c:\rxrllff.exec:\rxrllff.exe108⤵PID:2028
-
\??\c:\bbthnt.exec:\bbthnt.exe109⤵PID:444
-
\??\c:\jjvpd.exec:\jjvpd.exe110⤵PID:2000
-
\??\c:\jjvvj.exec:\jjvvj.exe111⤵PID:1544
-
\??\c:\xrrfrfl.exec:\xrrfrfl.exe112⤵PID:1520
-
\??\c:\nnnhnb.exec:\nnnhnb.exe113⤵PID:1264
-
\??\c:\jdpvd.exec:\jdpvd.exe114⤵PID:2172
-
\??\c:\lrlrxxl.exec:\lrlrxxl.exe115⤵PID:1916
-
\??\c:\ttnnhb.exec:\ttnnhb.exe116⤵PID:1036
-
\??\c:\tnhnbn.exec:\tnhnbn.exe117⤵PID:1712
-
\??\c:\1vddp.exec:\1vddp.exe118⤵PID:880
-
\??\c:\rlxxflf.exec:\rlxxflf.exe119⤵PID:2944
-
\??\c:\tnhntt.exec:\tnhntt.exe120⤵PID:1196
-
\??\c:\1vdpj.exec:\1vdpj.exe121⤵PID:1336
-
\??\c:\1lxrffx.exec:\1lxrffx.exe122⤵PID:1592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-