Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02-06-2024 01:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1be7273c7fbab4c570bef17218151d60_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
1be7273c7fbab4c570bef17218151d60_NeikiAnalytics.exe
-
Size
57KB
-
MD5
1be7273c7fbab4c570bef17218151d60
-
SHA1
bb232c294015701e576aa3d3a2052d345be62040
-
SHA256
5f9d638fe63a8d9b14f183e8a2a8c97e788e427a52f52d879fdc8f1e64a4b3c9
-
SHA512
f5efdaba92ceac4da85baf14ff6129bb0786b50379b4a9a624067db304b2c4c2e35949d6e2e99994a8f567ff7e7c008d516a8400d757ad34f982c39a3b6c877b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuSwFNr:ymb3NkkiQ3mdBjFIvIFNr
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/2104-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1548-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4296-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4140-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1520-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4600-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1840-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4900-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4116-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4492-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2752-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2240-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2748-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2480-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1616-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/764-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2296-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4656-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4136-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1040-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4852 224002.exe 4296 3jvpj.exe 1548 htnnht.exe 3060 20268.exe 4140 rlfxxxx.exe 1520 nbnnbt.exe 4600 a6222.exe 1840 u282222.exe 4900 jpddp.exe 4116 lfxrxxl.exe 4492 8622622.exe 2752 ddjdj.exe 2916 bttnhh.exe 1844 xlrlllr.exe 2240 84240.exe 2748 tnnhtb.exe 2480 8240260.exe 2368 00622.exe 1612 g6648.exe 4564 lflrfxx.exe 1616 fxlllrr.exe 536 rfrffxf.exe 5080 7jjdv.exe 764 pjjdj.exe 2296 nnbtht.exe 4656 llffxrr.exe 4136 086228.exe 1040 5lrrlrl.exe 3788 thnbtt.exe 4488 m6282.exe 2800 jjjdd.exe 1044 02828.exe 640 688604.exe 4240 jdvpp.exe 4232 4088666.exe 404 htbbnb.exe 436 2680028.exe 1228 64628.exe 4540 nbbttt.exe 4808 9rxxffr.exe 4892 84660.exe 3556 64604.exe 2968 004608.exe 4296 0806228.exe 4196 0688660.exe 2892 046626.exe 3820 3bbbtt.exe 4464 pdjvj.exe 1020 468806.exe 3640 fxrlffx.exe 4756 04440.exe 1752 5ffffff.exe 656 26228.exe 3844 m4008.exe 3840 xfrxxff.exe 2840 vpppj.exe 4492 6420404.exe 1360 jdvvv.exe 2784 tttthb.exe 4760 lflfrrr.exe 1844 rlrrrxf.exe 1408 82844.exe 4352 262600.exe 4784 42868.exe -
resource yara_rule behavioral2/memory/2104-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4296-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4296-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4296-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4140-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1520-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4600-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1840-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4116-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4492-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2752-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2240-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2748-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2480-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1616-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/764-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2296-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4136-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1040-188-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2104 wrote to memory of 4852 2104 1be7273c7fbab4c570bef17218151d60_NeikiAnalytics.exe 82 PID 2104 wrote to memory of 4852 2104 1be7273c7fbab4c570bef17218151d60_NeikiAnalytics.exe 82 PID 2104 wrote to memory of 4852 2104 1be7273c7fbab4c570bef17218151d60_NeikiAnalytics.exe 82 PID 4852 wrote to memory of 4296 4852 224002.exe 83 PID 4852 wrote to memory of 4296 4852 224002.exe 83 PID 4852 wrote to memory of 4296 4852 224002.exe 83 PID 4296 wrote to memory of 1548 4296 3jvpj.exe 84 PID 4296 wrote to memory of 1548 4296 3jvpj.exe 84 PID 4296 wrote to memory of 1548 4296 3jvpj.exe 84 PID 1548 wrote to memory of 3060 1548 htnnht.exe 85 PID 1548 wrote to memory of 3060 1548 htnnht.exe 85 PID 1548 wrote to memory of 3060 1548 htnnht.exe 85 PID 3060 wrote to memory of 4140 3060 20268.exe 86 PID 3060 wrote to memory of 4140 3060 20268.exe 86 PID 3060 wrote to memory of 4140 3060 20268.exe 86 PID 4140 wrote to memory of 1520 4140 rlfxxxx.exe 87 PID 4140 wrote to memory of 1520 4140 rlfxxxx.exe 87 PID 4140 wrote to memory of 1520 4140 rlfxxxx.exe 87 PID 1520 wrote to memory of 4600 1520 nbnnbt.exe 88 PID 1520 wrote to memory of 4600 1520 nbnnbt.exe 88 PID 1520 wrote to memory of 4600 1520 nbnnbt.exe 88 PID 4600 wrote to memory of 1840 4600 a6222.exe 89 PID 4600 wrote to memory of 1840 4600 a6222.exe 89 PID 4600 wrote to memory of 1840 4600 a6222.exe 89 PID 1840 wrote to memory of 4900 1840 u282222.exe 90 PID 1840 wrote to memory of 4900 1840 u282222.exe 90 PID 1840 wrote to memory of 4900 1840 u282222.exe 90 PID 4900 wrote to memory of 4116 4900 jpddp.exe 91 PID 4900 wrote to memory of 4116 4900 jpddp.exe 91 PID 4900 wrote to memory of 4116 4900 jpddp.exe 91 PID 4116 wrote to memory of 4492 4116 lfxrxxl.exe 93 PID 4116 wrote to memory of 4492 4116 lfxrxxl.exe 93 PID 4116 wrote to memory of 4492 4116 lfxrxxl.exe 93 PID 4492 wrote to memory of 2752 4492 8622622.exe 94 PID 4492 wrote to memory of 2752 4492 8622622.exe 94 PID 4492 wrote to memory of 2752 4492 8622622.exe 94 PID 2752 wrote to memory of 2916 2752 ddjdj.exe 95 PID 2752 wrote to memory of 2916 2752 ddjdj.exe 95 PID 2752 wrote to memory of 2916 2752 ddjdj.exe 95 PID 2916 wrote to memory of 1844 2916 bttnhh.exe 96 PID 2916 wrote to memory of 1844 2916 bttnhh.exe 96 PID 2916 wrote to memory of 1844 2916 bttnhh.exe 96 PID 1844 wrote to memory of 2240 1844 xlrlllr.exe 97 PID 1844 wrote to memory of 2240 1844 xlrlllr.exe 97 PID 1844 wrote to memory of 2240 1844 xlrlllr.exe 97 PID 2240 wrote to memory of 2748 2240 84240.exe 98 PID 2240 wrote to memory of 2748 2240 84240.exe 98 PID 2240 wrote to memory of 2748 2240 84240.exe 98 PID 2748 wrote to memory of 2480 2748 tnnhtb.exe 99 PID 2748 wrote to memory of 2480 2748 tnnhtb.exe 99 PID 2748 wrote to memory of 2480 2748 tnnhtb.exe 99 PID 2480 wrote to memory of 2368 2480 8240260.exe 100 PID 2480 wrote to memory of 2368 2480 8240260.exe 100 PID 2480 wrote to memory of 2368 2480 8240260.exe 100 PID 2368 wrote to memory of 1612 2368 00622.exe 102 PID 2368 wrote to memory of 1612 2368 00622.exe 102 PID 2368 wrote to memory of 1612 2368 00622.exe 102 PID 1612 wrote to memory of 4564 1612 g6648.exe 103 PID 1612 wrote to memory of 4564 1612 g6648.exe 103 PID 1612 wrote to memory of 4564 1612 g6648.exe 103 PID 4564 wrote to memory of 1616 4564 lflrfxx.exe 104 PID 4564 wrote to memory of 1616 4564 lflrfxx.exe 104 PID 4564 wrote to memory of 1616 4564 lflrfxx.exe 104 PID 1616 wrote to memory of 536 1616 fxlllrr.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\1be7273c7fbab4c570bef17218151d60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1be7273c7fbab4c570bef17218151d60_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\224002.exec:\224002.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\3jvpj.exec:\3jvpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\htnnht.exec:\htnnht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\20268.exec:\20268.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\rlfxxxx.exec:\rlfxxxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\nbnnbt.exec:\nbnnbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\a6222.exec:\a6222.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\u282222.exec:\u282222.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\jpddp.exec:\jpddp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\lfxrxxl.exec:\lfxrxxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\8622622.exec:\8622622.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\ddjdj.exec:\ddjdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\bttnhh.exec:\bttnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\xlrlllr.exec:\xlrlllr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\84240.exec:\84240.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\tnnhtb.exec:\tnnhtb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\8240260.exec:\8240260.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\00622.exec:\00622.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\g6648.exec:\g6648.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\lflrfxx.exec:\lflrfxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\fxlllrr.exec:\fxlllrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\rfrffxf.exec:\rfrffxf.exe23⤵
- Executes dropped EXE
PID:536 -
\??\c:\7jjdv.exec:\7jjdv.exe24⤵
- Executes dropped EXE
PID:5080 -
\??\c:\pjjdj.exec:\pjjdj.exe25⤵
- Executes dropped EXE
PID:764 -
\??\c:\nnbtht.exec:\nnbtht.exe26⤵
- Executes dropped EXE
PID:2296 -
\??\c:\llffxrr.exec:\llffxrr.exe27⤵
- Executes dropped EXE
PID:4656 -
\??\c:\086228.exec:\086228.exe28⤵
- Executes dropped EXE
PID:4136 -
\??\c:\5lrrlrl.exec:\5lrrlrl.exe29⤵
- Executes dropped EXE
PID:1040 -
\??\c:\thnbtt.exec:\thnbtt.exe30⤵
- Executes dropped EXE
PID:3788 -
\??\c:\m6282.exec:\m6282.exe31⤵
- Executes dropped EXE
PID:4488 -
\??\c:\jjjdd.exec:\jjjdd.exe32⤵
- Executes dropped EXE
PID:2800 -
\??\c:\02828.exec:\02828.exe33⤵
- Executes dropped EXE
PID:1044 -
\??\c:\688604.exec:\688604.exe34⤵
- Executes dropped EXE
PID:640 -
\??\c:\jdvpp.exec:\jdvpp.exe35⤵
- Executes dropped EXE
PID:4240 -
\??\c:\4088666.exec:\4088666.exe36⤵
- Executes dropped EXE
PID:4232 -
\??\c:\htbbnb.exec:\htbbnb.exe37⤵
- Executes dropped EXE
PID:404 -
\??\c:\2680028.exec:\2680028.exe38⤵
- Executes dropped EXE
PID:436 -
\??\c:\64628.exec:\64628.exe39⤵
- Executes dropped EXE
PID:1228 -
\??\c:\nbbttt.exec:\nbbttt.exe40⤵
- Executes dropped EXE
PID:4540 -
\??\c:\9rxxffr.exec:\9rxxffr.exe41⤵
- Executes dropped EXE
PID:4808 -
\??\c:\84660.exec:\84660.exe42⤵
- Executes dropped EXE
PID:4892 -
\??\c:\ffxrxlx.exec:\ffxrxlx.exe43⤵PID:4172
-
\??\c:\64604.exec:\64604.exe44⤵
- Executes dropped EXE
PID:3556 -
\??\c:\004608.exec:\004608.exe45⤵
- Executes dropped EXE
PID:2968 -
\??\c:\0806228.exec:\0806228.exe46⤵
- Executes dropped EXE
PID:4296 -
\??\c:\0688660.exec:\0688660.exe47⤵
- Executes dropped EXE
PID:4196 -
\??\c:\046626.exec:\046626.exe48⤵
- Executes dropped EXE
PID:2892 -
\??\c:\3bbbtt.exec:\3bbbtt.exe49⤵
- Executes dropped EXE
PID:3820 -
\??\c:\pdjvj.exec:\pdjvj.exe50⤵
- Executes dropped EXE
PID:4464 -
\??\c:\468806.exec:\468806.exe51⤵
- Executes dropped EXE
PID:1020 -
\??\c:\fxrlffx.exec:\fxrlffx.exe52⤵
- Executes dropped EXE
PID:3640 -
\??\c:\04440.exec:\04440.exe53⤵
- Executes dropped EXE
PID:4756 -
\??\c:\5ffffff.exec:\5ffffff.exe54⤵
- Executes dropped EXE
PID:1752 -
\??\c:\26228.exec:\26228.exe55⤵
- Executes dropped EXE
PID:656 -
\??\c:\m4008.exec:\m4008.exe56⤵
- Executes dropped EXE
PID:3844 -
\??\c:\xfrxxff.exec:\xfrxxff.exe57⤵
- Executes dropped EXE
PID:3840 -
\??\c:\vpppj.exec:\vpppj.exe58⤵
- Executes dropped EXE
PID:2840 -
\??\c:\6420404.exec:\6420404.exe59⤵
- Executes dropped EXE
PID:4492 -
\??\c:\jdvvv.exec:\jdvvv.exe60⤵
- Executes dropped EXE
PID:1360 -
\??\c:\tttthb.exec:\tttthb.exe61⤵
- Executes dropped EXE
PID:2784 -
\??\c:\lflfrrr.exec:\lflfrrr.exe62⤵
- Executes dropped EXE
PID:4760 -
\??\c:\rlrrrxf.exec:\rlrrrxf.exe63⤵
- Executes dropped EXE
PID:1844 -
\??\c:\82844.exec:\82844.exe64⤵
- Executes dropped EXE
PID:1408 -
\??\c:\262600.exec:\262600.exe65⤵
- Executes dropped EXE
PID:4352 -
\??\c:\42868.exec:\42868.exe66⤵
- Executes dropped EXE
PID:4784 -
\??\c:\hhbthh.exec:\hhbthh.exe67⤵PID:2040
-
\??\c:\64846.exec:\64846.exe68⤵PID:3396
-
\??\c:\ntnhtt.exec:\ntnhtt.exe69⤵PID:1560
-
\??\c:\c662600.exec:\c662600.exe70⤵PID:4944
-
\??\c:\httbbb.exec:\httbbb.exe71⤵PID:3876
-
\??\c:\hhnnnn.exec:\hhnnnn.exe72⤵PID:4836
-
\??\c:\nbtttt.exec:\nbtttt.exe73⤵PID:1052
-
\??\c:\20280.exec:\20280.exe74⤵PID:3176
-
\??\c:\nbhhhh.exec:\nbhhhh.exe75⤵PID:3108
-
\??\c:\htbbbb.exec:\htbbbb.exe76⤵PID:2572
-
\??\c:\c060000.exec:\c060000.exe77⤵PID:4460
-
\??\c:\626222.exec:\626222.exe78⤵PID:2464
-
\??\c:\hhbbnn.exec:\hhbbnn.exe79⤵PID:1092
-
\??\c:\5ppjp.exec:\5ppjp.exe80⤵PID:2780
-
\??\c:\o262266.exec:\o262266.exe81⤵PID:2032
-
\??\c:\vpppj.exec:\vpppj.exe82⤵PID:3836
-
\??\c:\hhnnbh.exec:\hhnnbh.exe83⤵PID:3588
-
\??\c:\40826.exec:\40826.exe84⤵PID:1300
-
\??\c:\pdvvp.exec:\pdvvp.exe85⤵PID:3600
-
\??\c:\lffxlxr.exec:\lffxlxr.exe86⤵PID:4328
-
\??\c:\6400004.exec:\6400004.exe87⤵PID:4240
-
\??\c:\bhhhnh.exec:\bhhhnh.exe88⤵PID:628
-
\??\c:\ddddd.exec:\ddddd.exe89⤵PID:2148
-
\??\c:\5jdvv.exec:\5jdvv.exe90⤵PID:3428
-
\??\c:\9lllxrr.exec:\9lllxrr.exe91⤵PID:4700
-
\??\c:\i644006.exec:\i644006.exe92⤵PID:1948
-
\??\c:\m6604.exec:\m6604.exe93⤵PID:4060
-
\??\c:\c280486.exec:\c280486.exe94⤵PID:4776
-
\??\c:\008488.exec:\008488.exe95⤵PID:3164
-
\??\c:\vpddj.exec:\vpddj.exe96⤵PID:516
-
\??\c:\vvjjj.exec:\vvjjj.exe97⤵PID:116
-
\??\c:\frffrrx.exec:\frffrrx.exe98⤵PID:216
-
\??\c:\lrlflrr.exec:\lrlflrr.exe99⤵PID:992
-
\??\c:\46204.exec:\46204.exe100⤵PID:4252
-
\??\c:\606046.exec:\606046.exe101⤵PID:4632
-
\??\c:\2406426.exec:\2406426.exe102⤵PID:4464
-
\??\c:\8288226.exec:\8288226.exe103⤵PID:4600
-
\??\c:\422206.exec:\422206.exe104⤵PID:4752
-
\??\c:\thhtbh.exec:\thhtbh.exe105⤵PID:4144
-
\??\c:\5tnhnn.exec:\5tnhnn.exe106⤵PID:1752
-
\??\c:\684800.exec:\684800.exe107⤵PID:4012
-
\??\c:\w62200.exec:\w62200.exe108⤵PID:3844
-
\??\c:\4884680.exec:\4884680.exe109⤵PID:3840
-
\??\c:\2808642.exec:\2808642.exe110⤵PID:2840
-
\??\c:\5rxrrxr.exec:\5rxrrxr.exe111⤵PID:4780
-
\??\c:\424826.exec:\424826.exe112⤵PID:4536
-
\??\c:\68004.exec:\68004.exe113⤵PID:2784
-
\??\c:\djjjv.exec:\djjjv.exe114⤵PID:4760
-
\??\c:\9nhbtn.exec:\9nhbtn.exe115⤵PID:1844
-
\??\c:\vjdvd.exec:\vjdvd.exe116⤵PID:2736
-
\??\c:\fxfxllf.exec:\fxfxllf.exe117⤵PID:4532
-
\??\c:\48484.exec:\48484.exe118⤵PID:1876
-
\??\c:\ddpvd.exec:\ddpvd.exe119⤵PID:1136
-
\??\c:\ttntht.exec:\ttntht.exe120⤵PID:1832
-
\??\c:\4220004.exec:\4220004.exe121⤵PID:2200
-
\??\c:\04868.exec:\04868.exe122⤵PID:1616
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-