Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18/05/2024, 13:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c8f1d3a952bf245af6a3bd6a40cac750_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
c8f1d3a952bf245af6a3bd6a40cac750_NeikiAnalytics.exe
-
Size
95KB
-
MD5
c8f1d3a952bf245af6a3bd6a40cac750
-
SHA1
990bb0ce368c73bd8d2777f73e7a6d9b8c6893ad
-
SHA256
774ce49654e01c0721cdbf09dd548920001f31951a4500c41913e0e35bbcbf81
-
SHA512
463f5778cc6a833d046b8e980a47342ab1882a07c9daa87beaf5c36db3f7729563865efa1e6e740e64cdb4cca29fb2fe342b1f906620d910a53f227bf2be83f1
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qP1hvZo66Ox4oq2SQwfTQA:ymb3NkkiQ3mdBjFIj+qNhvZuHQY0A
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2276-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2308-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2488-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-40-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2628-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2392-80-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2392-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1908-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2260-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/284-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/956-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/280-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/312-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1728-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2308 rlflxfx.exe 2488 bnttnn.exe 2616 pjvdj.exe 2628 lfrrrrr.exe 2412 5ttnnn.exe 2544 tntbhh.exe 2392 dvddd.exe 2932 3jppp.exe 1908 3lfrxrx.exe 2708 hhnhht.exe 2744 1nttbh.exe 1620 dvjjj.exe 2260 frrrxlr.exe 2336 xxlrrlx.exe 1256 htbnnn.exe 284 9dvvd.exe 1464 jdpjv.exe 2476 jdppv.exe 1976 xrfflrx.exe 2356 nhtnhh.exe 2192 bbntbh.exe 488 ddppd.exe 956 frxllrx.exe 1320 xrlrrxx.exe 280 hthnnb.exe 312 nbnthh.exe 1728 7bnhnn.exe 756 jdjpv.exe 2252 fxlrxfr.exe 2132 rfrrrrx.exe 1440 hbnbbh.exe 1936 pjvvd.exe 1204 pddvd.exe 2904 lfrxllx.exe 2560 1xlfrlr.exe 2952 hbhhtb.exe 2584 bthhbb.exe 2384 vvddv.exe 2628 9pjjv.exe 2104 rlfllxf.exe 2376 fxffxrf.exe 2544 hbhhnn.exe 2444 nhtbnh.exe 1912 dvpdj.exe 2676 jdpdp.exe 2468 rfrxrxl.exe 2708 bnbbhh.exe 2744 btbhhn.exe 472 nhhntt.exe 2076 dvpdp.exe 1876 jvvvd.exe 1572 rfrrxxl.exe 820 fxxfrrf.exe 1536 7tbttt.exe 1700 ththnt.exe 2888 pjdjj.exe 2236 llxxllf.exe 2580 rfllffx.exe 2204 9ttbtt.exe 692 1tnnbh.exe 584 5ddjj.exe 1076 jdppv.exe 1420 rlrrrxf.exe 2944 bnntbh.exe -
resource yara_rule behavioral1/memory/2276-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2308-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1908-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2260-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/284-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/956-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/280-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/312-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1728-261-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2276 wrote to memory of 2308 2276 c8f1d3a952bf245af6a3bd6a40cac750_NeikiAnalytics.exe 28 PID 2276 wrote to memory of 2308 2276 c8f1d3a952bf245af6a3bd6a40cac750_NeikiAnalytics.exe 28 PID 2276 wrote to memory of 2308 2276 c8f1d3a952bf245af6a3bd6a40cac750_NeikiAnalytics.exe 28 PID 2276 wrote to memory of 2308 2276 c8f1d3a952bf245af6a3bd6a40cac750_NeikiAnalytics.exe 28 PID 2308 wrote to memory of 2488 2308 rlflxfx.exe 29 PID 2308 wrote to memory of 2488 2308 rlflxfx.exe 29 PID 2308 wrote to memory of 2488 2308 rlflxfx.exe 29 PID 2308 wrote to memory of 2488 2308 rlflxfx.exe 29 PID 2488 wrote to memory of 2616 2488 bnttnn.exe 30 PID 2488 wrote to memory of 2616 2488 bnttnn.exe 30 PID 2488 wrote to memory of 2616 2488 bnttnn.exe 30 PID 2488 wrote to memory of 2616 2488 bnttnn.exe 30 PID 2616 wrote to memory of 2628 2616 pjvdj.exe 31 PID 2616 wrote to memory of 2628 2616 pjvdj.exe 31 PID 2616 wrote to memory of 2628 2616 pjvdj.exe 31 PID 2616 wrote to memory of 2628 2616 pjvdj.exe 31 PID 2628 wrote to memory of 2412 2628 lfrrrrr.exe 32 PID 2628 wrote to memory of 2412 2628 lfrrrrr.exe 32 PID 2628 wrote to memory of 2412 2628 lfrrrrr.exe 32 PID 2628 wrote to memory of 2412 2628 lfrrrrr.exe 32 PID 2412 wrote to memory of 2544 2412 5ttnnn.exe 33 PID 2412 wrote to memory of 2544 2412 5ttnnn.exe 33 PID 2412 wrote to memory of 2544 2412 5ttnnn.exe 33 PID 2412 wrote to memory of 2544 2412 5ttnnn.exe 33 PID 2544 wrote to memory of 2392 2544 tntbhh.exe 34 PID 2544 wrote to memory of 2392 2544 tntbhh.exe 34 PID 2544 wrote to memory of 2392 2544 tntbhh.exe 34 PID 2544 wrote to memory of 2392 2544 tntbhh.exe 34 PID 2392 wrote to memory of 2932 2392 dvddd.exe 35 PID 2392 wrote to memory of 2932 2392 dvddd.exe 35 PID 2392 wrote to memory of 2932 2392 dvddd.exe 35 PID 2392 wrote to memory of 2932 2392 dvddd.exe 35 PID 2932 wrote to memory of 1908 2932 3jppp.exe 36 PID 2932 wrote to memory of 1908 2932 3jppp.exe 36 PID 2932 wrote to memory of 1908 2932 3jppp.exe 36 PID 2932 wrote to memory of 1908 2932 3jppp.exe 36 PID 1908 wrote to memory of 2708 1908 3lfrxrx.exe 37 PID 1908 wrote to memory of 2708 1908 3lfrxrx.exe 37 PID 1908 wrote to memory of 2708 1908 3lfrxrx.exe 37 PID 1908 wrote to memory of 2708 1908 3lfrxrx.exe 37 PID 2708 wrote to memory of 2744 2708 hhnhht.exe 38 PID 2708 wrote to memory of 2744 2708 hhnhht.exe 38 PID 2708 wrote to memory of 2744 2708 hhnhht.exe 38 PID 2708 wrote to memory of 2744 2708 hhnhht.exe 38 PID 2744 wrote to memory of 1620 2744 1nttbh.exe 39 PID 2744 wrote to memory of 1620 2744 1nttbh.exe 39 PID 2744 wrote to memory of 1620 2744 1nttbh.exe 39 PID 2744 wrote to memory of 1620 2744 1nttbh.exe 39 PID 1620 wrote to memory of 2260 1620 dvjjj.exe 40 PID 1620 wrote to memory of 2260 1620 dvjjj.exe 40 PID 1620 wrote to memory of 2260 1620 dvjjj.exe 40 PID 1620 wrote to memory of 2260 1620 dvjjj.exe 40 PID 2260 wrote to memory of 2336 2260 frrrxlr.exe 41 PID 2260 wrote to memory of 2336 2260 frrrxlr.exe 41 PID 2260 wrote to memory of 2336 2260 frrrxlr.exe 41 PID 2260 wrote to memory of 2336 2260 frrrxlr.exe 41 PID 2336 wrote to memory of 1256 2336 xxlrrlx.exe 42 PID 2336 wrote to memory of 1256 2336 xxlrrlx.exe 42 PID 2336 wrote to memory of 1256 2336 xxlrrlx.exe 42 PID 2336 wrote to memory of 1256 2336 xxlrrlx.exe 42 PID 1256 wrote to memory of 284 1256 htbnnn.exe 43 PID 1256 wrote to memory of 284 1256 htbnnn.exe 43 PID 1256 wrote to memory of 284 1256 htbnnn.exe 43 PID 1256 wrote to memory of 284 1256 htbnnn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8f1d3a952bf245af6a3bd6a40cac750_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\c8f1d3a952bf245af6a3bd6a40cac750_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\rlflxfx.exec:\rlflxfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\bnttnn.exec:\bnttnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\pjvdj.exec:\pjvdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\lfrrrrr.exec:\lfrrrrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\5ttnnn.exec:\5ttnnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\tntbhh.exec:\tntbhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\dvddd.exec:\dvddd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\3jppp.exec:\3jppp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\3lfrxrx.exec:\3lfrxrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\hhnhht.exec:\hhnhht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\1nttbh.exec:\1nttbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\dvjjj.exec:\dvjjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\frrrxlr.exec:\frrrxlr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\xxlrrlx.exec:\xxlrrlx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\htbnnn.exec:\htbnnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\9dvvd.exec:\9dvvd.exe17⤵
- Executes dropped EXE
PID:284 -
\??\c:\jdpjv.exec:\jdpjv.exe18⤵
- Executes dropped EXE
PID:1464 -
\??\c:\jdppv.exec:\jdppv.exe19⤵
- Executes dropped EXE
PID:2476 -
\??\c:\xrfflrx.exec:\xrfflrx.exe20⤵
- Executes dropped EXE
PID:1976 -
\??\c:\nhtnhh.exec:\nhtnhh.exe21⤵
- Executes dropped EXE
PID:2356 -
\??\c:\bbntbh.exec:\bbntbh.exe22⤵
- Executes dropped EXE
PID:2192 -
\??\c:\ddppd.exec:\ddppd.exe23⤵
- Executes dropped EXE
PID:488 -
\??\c:\frxllrx.exec:\frxllrx.exe24⤵
- Executes dropped EXE
PID:956 -
\??\c:\xrlrrxx.exec:\xrlrrxx.exe25⤵
- Executes dropped EXE
PID:1320 -
\??\c:\hthnnb.exec:\hthnnb.exe26⤵
- Executes dropped EXE
PID:280 -
\??\c:\nbnthh.exec:\nbnthh.exe27⤵
- Executes dropped EXE
PID:312 -
\??\c:\7bnhnn.exec:\7bnhnn.exe28⤵
- Executes dropped EXE
PID:1728 -
\??\c:\jdjpv.exec:\jdjpv.exe29⤵
- Executes dropped EXE
PID:756 -
\??\c:\fxlrxfr.exec:\fxlrxfr.exe30⤵
- Executes dropped EXE
PID:2252 -
\??\c:\rfrrrrx.exec:\rfrrrrx.exe31⤵
- Executes dropped EXE
PID:2132 -
\??\c:\hbnbbh.exec:\hbnbbh.exe32⤵
- Executes dropped EXE
PID:1440 -
\??\c:\pjvvd.exec:\pjvvd.exe33⤵
- Executes dropped EXE
PID:1936 -
\??\c:\pddvd.exec:\pddvd.exe34⤵
- Executes dropped EXE
PID:1204 -
\??\c:\lfrxllx.exec:\lfrxllx.exe35⤵
- Executes dropped EXE
PID:2904 -
\??\c:\1xlfrlr.exec:\1xlfrlr.exe36⤵
- Executes dropped EXE
PID:2560 -
\??\c:\hbhhtb.exec:\hbhhtb.exe37⤵
- Executes dropped EXE
PID:2952 -
\??\c:\bthhbb.exec:\bthhbb.exe38⤵
- Executes dropped EXE
PID:2584 -
\??\c:\vvddv.exec:\vvddv.exe39⤵
- Executes dropped EXE
PID:2384 -
\??\c:\9pjjv.exec:\9pjjv.exe40⤵
- Executes dropped EXE
PID:2628 -
\??\c:\rlfllxf.exec:\rlfllxf.exe41⤵
- Executes dropped EXE
PID:2104 -
\??\c:\fxffxrf.exec:\fxffxrf.exe42⤵
- Executes dropped EXE
PID:2376 -
\??\c:\hbhhnn.exec:\hbhhnn.exe43⤵
- Executes dropped EXE
PID:2544 -
\??\c:\nhtbnh.exec:\nhtbnh.exe44⤵
- Executes dropped EXE
PID:2444 -
\??\c:\dvpdj.exec:\dvpdj.exe45⤵
- Executes dropped EXE
PID:1912 -
\??\c:\jdpdp.exec:\jdpdp.exe46⤵
- Executes dropped EXE
PID:2676 -
\??\c:\rfrxrxl.exec:\rfrxrxl.exe47⤵
- Executes dropped EXE
PID:2468 -
\??\c:\bnbbhh.exec:\bnbbhh.exe48⤵
- Executes dropped EXE
PID:2708 -
\??\c:\btbhhn.exec:\btbhhn.exe49⤵
- Executes dropped EXE
PID:2744 -
\??\c:\nhhntt.exec:\nhhntt.exe50⤵
- Executes dropped EXE
PID:472 -
\??\c:\dvpdp.exec:\dvpdp.exe51⤵
- Executes dropped EXE
PID:2076 -
\??\c:\jvvvd.exec:\jvvvd.exe52⤵
- Executes dropped EXE
PID:1876 -
\??\c:\rfrrxxl.exec:\rfrrxxl.exe53⤵
- Executes dropped EXE
PID:1572 -
\??\c:\fxxfrrf.exec:\fxxfrrf.exe54⤵
- Executes dropped EXE
PID:820 -
\??\c:\7tbttt.exec:\7tbttt.exe55⤵
- Executes dropped EXE
PID:1536 -
\??\c:\ththnt.exec:\ththnt.exe56⤵
- Executes dropped EXE
PID:1700 -
\??\c:\pjdjj.exec:\pjdjj.exe57⤵
- Executes dropped EXE
PID:2888 -
\??\c:\llxxllf.exec:\llxxllf.exe58⤵
- Executes dropped EXE
PID:2236 -
\??\c:\rfllffx.exec:\rfllffx.exe59⤵
- Executes dropped EXE
PID:2580 -
\??\c:\9ttbtt.exec:\9ttbtt.exe60⤵
- Executes dropped EXE
PID:2204 -
\??\c:\1tnnbh.exec:\1tnnbh.exe61⤵
- Executes dropped EXE
PID:692 -
\??\c:\5ddjj.exec:\5ddjj.exe62⤵
- Executes dropped EXE
PID:584 -
\??\c:\jdppv.exec:\jdppv.exe63⤵
- Executes dropped EXE
PID:1076 -
\??\c:\rlrrrxf.exec:\rlrrrxf.exe64⤵
- Executes dropped EXE
PID:1420 -
\??\c:\bnntbh.exec:\bnntbh.exe65⤵
- Executes dropped EXE
PID:2944 -
\??\c:\bbtnbh.exec:\bbtnbh.exe66⤵PID:1560
-
\??\c:\1pdjp.exec:\1pdjp.exe67⤵PID:312
-
\??\c:\jdpdd.exec:\jdpdd.exe68⤵PID:1492
-
\??\c:\rlflxxf.exec:\rlflxxf.exe69⤵PID:2908
-
\??\c:\rrxfrlf.exec:\rrxfrlf.exe70⤵PID:2916
-
\??\c:\9hnnnn.exec:\9hnnnn.exe71⤵PID:1960
-
\??\c:\bhbhbh.exec:\bhbhbh.exe72⤵PID:1036
-
\??\c:\pjjjv.exec:\pjjjv.exe73⤵PID:904
-
\??\c:\7jvdj.exec:\7jvdj.exe74⤵PID:1032
-
\??\c:\rrflffl.exec:\rrflffl.exe75⤵PID:2136
-
\??\c:\rxlfrxf.exec:\rxlfrxf.exe76⤵PID:1672
-
\??\c:\bbnhhb.exec:\bbnhhb.exe77⤵PID:2072
-
\??\c:\tnhthh.exec:\tnhthh.exe78⤵PID:1664
-
\??\c:\pjvdj.exec:\pjvdj.exe79⤵PID:2532
-
\??\c:\dvvvj.exec:\dvvvj.exe80⤵PID:2644
-
\??\c:\pdvdp.exec:\pdvdp.exe81⤵PID:2868
-
\??\c:\xxlfffr.exec:\xxlfffr.exe82⤵PID:2400
-
\??\c:\rrflrxf.exec:\rrflrxf.exe83⤵PID:2652
-
\??\c:\nbtthn.exec:\nbtthn.exe84⤵PID:2440
-
\??\c:\bbtntt.exec:\bbtntt.exe85⤵PID:2116
-
\??\c:\vpppd.exec:\vpppd.exe86⤵PID:1592
-
\??\c:\dvvvd.exec:\dvvvd.exe87⤵PID:2108
-
\??\c:\5xrllfr.exec:\5xrllfr.exe88⤵PID:2692
-
\??\c:\nbnntt.exec:\nbnntt.exe89⤵PID:2764
-
\??\c:\tntntt.exec:\tntntt.exe90⤵PID:1648
-
\??\c:\tthntt.exec:\tthntt.exe91⤵PID:1580
-
\??\c:\5jjdv.exec:\5jjdv.exe92⤵PID:780
-
\??\c:\pjpvv.exec:\pjpvv.exe93⤵PID:1916
-
\??\c:\lrfxxrx.exec:\lrfxxrx.exe94⤵PID:1568
-
\??\c:\bnnnbh.exec:\bnnnbh.exe95⤵PID:1860
-
\??\c:\hthntt.exec:\hthntt.exe96⤵PID:1468
-
\??\c:\pdppp.exec:\pdppp.exe97⤵PID:1432
-
\??\c:\dpdjj.exec:\dpdjj.exe98⤵PID:868
-
\??\c:\dvjjp.exec:\dvjjp.exe99⤵PID:2096
-
\??\c:\llrlrrx.exec:\llrlrrx.exe100⤵PID:2164
-
\??\c:\nhnnbt.exec:\nhnnbt.exe101⤵PID:2212
-
\??\c:\bbnnbn.exec:\bbnnbn.exe102⤵PID:608
-
\??\c:\7vppp.exec:\7vppp.exe103⤵PID:1428
-
\??\c:\5dpvd.exec:\5dpvd.exe104⤵PID:532
-
\??\c:\ddjpj.exec:\ddjpj.exe105⤵PID:844
-
\??\c:\3llxrrx.exec:\3llxrrx.exe106⤵PID:2268
-
\??\c:\xlrlllr.exec:\xlrlllr.exe107⤵PID:2840
-
\??\c:\bntnnn.exec:\bntnnn.exe108⤵PID:240
-
\??\c:\7htttt.exec:\7htttt.exe109⤵PID:752
-
\??\c:\dvddp.exec:\dvddp.exe110⤵PID:1888
-
\??\c:\3dvdp.exec:\3dvdp.exe111⤵PID:2068
-
\??\c:\llrxffl.exec:\llrxffl.exe112⤵PID:2648
-
\??\c:\ffxfrrl.exec:\ffxfrrl.exe113⤵PID:3044
-
\??\c:\7hbbhh.exec:\7hbbhh.exe114⤵PID:2132
-
\??\c:\9ddvv.exec:\9ddvv.exe115⤵PID:1440
-
\??\c:\1ppjd.exec:\1ppjd.exe116⤵PID:2832
-
\??\c:\fxllrxl.exec:\fxllrxl.exe117⤵PID:1660
-
\??\c:\xlrxxrf.exec:\xlrxxrf.exe118⤵PID:1204
-
\??\c:\3nhntt.exec:\3nhntt.exe119⤵PID:3024
-
\??\c:\nbhnnn.exec:\nbhnnn.exe120⤵PID:2536
-
\??\c:\hthhnn.exec:\hthhnn.exe121⤵PID:2632
-
\??\c:\vjppp.exec:\vjppp.exe122⤵PID:2800
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-