Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03-06-2024 03:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9ab072ccd484d8da62ebb19ebdde2f60_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
9ab072ccd484d8da62ebb19ebdde2f60_NeikiAnalytics.exe
-
Size
835KB
-
MD5
9ab072ccd484d8da62ebb19ebdde2f60
-
SHA1
9912dc7816a7a9e8544ee7477cefcba7ddd0d011
-
SHA256
672913e70c81197a5f6633d5c5376330f7617a16c81c947183a2e4b7721953de
-
SHA512
dca4e79d183478b9322617e73648ee7807ecd47d8b262bdb225d805a356bd4e7b5eeac3023500917f31cad18b60051acd6d113126a4d4c5a36da49c4e474ba46
-
SSDEEP
24576:Sgdn8whSenedn8whhdn76gdn8whSfgdn8whSzn:TFyVPfm
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2212-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1708-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1788-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1532-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1348-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1084-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/552-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1808-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/564-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1680-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2988 88284.exe 3060 nntbnh.exe 2656 822446.exe 2564 7hnnnt.exe 2728 042244.exe 2976 hhbbhh.exe 2608 4488222.exe 1708 rfrrrrr.exe 2764 dpjpp.exe 2948 86406.exe 2152 djjdj.exe 1880 xxxflrl.exe 1788 jdddd.exe 1532 pvvjp.exe 2684 dddpv.exe 1348 m2484.exe 1124 i224062.exe 2316 dvjpj.exe 1976 xxlrlll.exe 2840 1ttbth.exe 784 00404.exe 1084 802008.exe 552 208624.exe 1136 m6662.exe 2396 bbhhbb.exe 1752 hbhthb.exe 1808 ttnnnn.exe 1100 26842.exe 556 426882.exe 564 vjppd.exe 1680 bttbnt.exe 1052 m4402.exe 1688 xrrlrlf.exe 1844 ffxllxf.exe 1560 22486.exe 1500 o642624.exe 2532 7bthbn.exe 2584 pjvdj.exe 2688 5pjpv.exe 2724 fllxxrr.exe 2600 080240.exe 2448 3tnnnt.exe 2604 5jvpj.exe 2976 84286.exe 1564 268266.exe 240 hhntbn.exe 2908 2420662.exe 2888 4840880.exe 1508 486426.exe 1056 9vdpj.exe 1832 tthhbb.exe 1880 vvvpd.exe 632 806846.exe 2696 86240.exe 1700 886244.exe 1760 rfrflrl.exe 1728 26468.exe 812 820688.exe 2248 66606.exe 2424 00042.exe 2292 444222.exe 332 044608.exe 940 2626648.exe 1888 0244666.exe -
resource yara_rule behavioral1/memory/2212-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1788-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1532-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1348-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1084-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/552-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1808-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/564-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1680-299-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2212 wrote to memory of 2988 2212 9ab072ccd484d8da62ebb19ebdde2f60_NeikiAnalytics.exe 28 PID 2212 wrote to memory of 2988 2212 9ab072ccd484d8da62ebb19ebdde2f60_NeikiAnalytics.exe 28 PID 2212 wrote to memory of 2988 2212 9ab072ccd484d8da62ebb19ebdde2f60_NeikiAnalytics.exe 28 PID 2212 wrote to memory of 2988 2212 9ab072ccd484d8da62ebb19ebdde2f60_NeikiAnalytics.exe 28 PID 2988 wrote to memory of 3060 2988 88284.exe 29 PID 2988 wrote to memory of 3060 2988 88284.exe 29 PID 2988 wrote to memory of 3060 2988 88284.exe 29 PID 2988 wrote to memory of 3060 2988 88284.exe 29 PID 3060 wrote to memory of 2656 3060 nntbnh.exe 30 PID 3060 wrote to memory of 2656 3060 nntbnh.exe 30 PID 3060 wrote to memory of 2656 3060 nntbnh.exe 30 PID 3060 wrote to memory of 2656 3060 nntbnh.exe 30 PID 2656 wrote to memory of 2564 2656 822446.exe 31 PID 2656 wrote to memory of 2564 2656 822446.exe 31 PID 2656 wrote to memory of 2564 2656 822446.exe 31 PID 2656 wrote to memory of 2564 2656 822446.exe 31 PID 2564 wrote to memory of 2728 2564 7hnnnt.exe 32 PID 2564 wrote to memory of 2728 2564 7hnnnt.exe 32 PID 2564 wrote to memory of 2728 2564 7hnnnt.exe 32 PID 2564 wrote to memory of 2728 2564 7hnnnt.exe 32 PID 2728 wrote to memory of 2976 2728 042244.exe 33 PID 2728 wrote to memory of 2976 2728 042244.exe 33 PID 2728 wrote to memory of 2976 2728 042244.exe 33 PID 2728 wrote to memory of 2976 2728 042244.exe 33 PID 2976 wrote to memory of 2608 2976 hhbbhh.exe 34 PID 2976 wrote to memory of 2608 2976 hhbbhh.exe 34 PID 2976 wrote to memory of 2608 2976 hhbbhh.exe 34 PID 2976 wrote to memory of 2608 2976 hhbbhh.exe 34 PID 2608 wrote to memory of 1708 2608 4488222.exe 35 PID 2608 wrote to memory of 1708 2608 4488222.exe 35 PID 2608 wrote to memory of 1708 2608 4488222.exe 35 PID 2608 wrote to memory of 1708 2608 4488222.exe 35 PID 1708 wrote to memory of 2764 1708 rfrrrrr.exe 36 PID 1708 wrote to memory of 2764 1708 rfrrrrr.exe 36 PID 1708 wrote to memory of 2764 1708 rfrrrrr.exe 36 PID 1708 wrote to memory of 2764 1708 rfrrrrr.exe 36 PID 2764 wrote to memory of 2948 2764 dpjpp.exe 37 PID 2764 wrote to memory of 2948 2764 dpjpp.exe 37 PID 2764 wrote to memory of 2948 2764 dpjpp.exe 37 PID 2764 wrote to memory of 2948 2764 dpjpp.exe 37 PID 2948 wrote to memory of 2152 2948 86406.exe 38 PID 2948 wrote to memory of 2152 2948 86406.exe 38 PID 2948 wrote to memory of 2152 2948 86406.exe 38 PID 2948 wrote to memory of 2152 2948 86406.exe 38 PID 2152 wrote to memory of 1880 2152 djjdj.exe 39 PID 2152 wrote to memory of 1880 2152 djjdj.exe 39 PID 2152 wrote to memory of 1880 2152 djjdj.exe 39 PID 2152 wrote to memory of 1880 2152 djjdj.exe 39 PID 1880 wrote to memory of 1788 1880 xxxflrl.exe 40 PID 1880 wrote to memory of 1788 1880 xxxflrl.exe 40 PID 1880 wrote to memory of 1788 1880 xxxflrl.exe 40 PID 1880 wrote to memory of 1788 1880 xxxflrl.exe 40 PID 1788 wrote to memory of 1532 1788 jdddd.exe 41 PID 1788 wrote to memory of 1532 1788 jdddd.exe 41 PID 1788 wrote to memory of 1532 1788 jdddd.exe 41 PID 1788 wrote to memory of 1532 1788 jdddd.exe 41 PID 1532 wrote to memory of 2684 1532 pvvjp.exe 42 PID 1532 wrote to memory of 2684 1532 pvvjp.exe 42 PID 1532 wrote to memory of 2684 1532 pvvjp.exe 42 PID 1532 wrote to memory of 2684 1532 pvvjp.exe 42 PID 2684 wrote to memory of 1348 2684 dddpv.exe 43 PID 2684 wrote to memory of 1348 2684 dddpv.exe 43 PID 2684 wrote to memory of 1348 2684 dddpv.exe 43 PID 2684 wrote to memory of 1348 2684 dddpv.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ab072ccd484d8da62ebb19ebdde2f60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9ab072ccd484d8da62ebb19ebdde2f60_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\88284.exec:\88284.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\nntbnh.exec:\nntbnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\822446.exec:\822446.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\7hnnnt.exec:\7hnnnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\042244.exec:\042244.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\hhbbhh.exec:\hhbbhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\4488222.exec:\4488222.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\rfrrrrr.exec:\rfrrrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\dpjpp.exec:\dpjpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\86406.exec:\86406.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\djjdj.exec:\djjdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\xxxflrl.exec:\xxxflrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\jdddd.exec:\jdddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\pvvjp.exec:\pvvjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\dddpv.exec:\dddpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\m2484.exec:\m2484.exe17⤵
- Executes dropped EXE
PID:1348 -
\??\c:\i224062.exec:\i224062.exe18⤵
- Executes dropped EXE
PID:1124 -
\??\c:\dvjpj.exec:\dvjpj.exe19⤵
- Executes dropped EXE
PID:2316 -
\??\c:\xxlrlll.exec:\xxlrlll.exe20⤵
- Executes dropped EXE
PID:1976 -
\??\c:\1ttbth.exec:\1ttbth.exe21⤵
- Executes dropped EXE
PID:2840 -
\??\c:\00404.exec:\00404.exe22⤵
- Executes dropped EXE
PID:784 -
\??\c:\802008.exec:\802008.exe23⤵
- Executes dropped EXE
PID:1084 -
\??\c:\208624.exec:\208624.exe24⤵
- Executes dropped EXE
PID:552 -
\??\c:\m6662.exec:\m6662.exe25⤵
- Executes dropped EXE
PID:1136 -
\??\c:\bbhhbb.exec:\bbhhbb.exe26⤵
- Executes dropped EXE
PID:2396 -
\??\c:\hbhthb.exec:\hbhthb.exe27⤵
- Executes dropped EXE
PID:1752 -
\??\c:\ttnnnn.exec:\ttnnnn.exe28⤵
- Executes dropped EXE
PID:1808 -
\??\c:\26842.exec:\26842.exe29⤵
- Executes dropped EXE
PID:1100 -
\??\c:\426882.exec:\426882.exe30⤵
- Executes dropped EXE
PID:556 -
\??\c:\vjppd.exec:\vjppd.exe31⤵
- Executes dropped EXE
PID:564 -
\??\c:\bttbnt.exec:\bttbnt.exe32⤵
- Executes dropped EXE
PID:1680 -
\??\c:\m4402.exec:\m4402.exe33⤵
- Executes dropped EXE
PID:1052 -
\??\c:\xrrlrlf.exec:\xrrlrlf.exe34⤵
- Executes dropped EXE
PID:1688 -
\??\c:\ffxllxf.exec:\ffxllxf.exe35⤵
- Executes dropped EXE
PID:1844 -
\??\c:\22486.exec:\22486.exe36⤵
- Executes dropped EXE
PID:1560 -
\??\c:\o642624.exec:\o642624.exe37⤵
- Executes dropped EXE
PID:1500 -
\??\c:\7bthbn.exec:\7bthbn.exe38⤵
- Executes dropped EXE
PID:2532 -
\??\c:\pjvdj.exec:\pjvdj.exe39⤵
- Executes dropped EXE
PID:2584 -
\??\c:\5pjpv.exec:\5pjpv.exe40⤵
- Executes dropped EXE
PID:2688 -
\??\c:\fllxxrr.exec:\fllxxrr.exe41⤵
- Executes dropped EXE
PID:2724 -
\??\c:\080240.exec:\080240.exe42⤵
- Executes dropped EXE
PID:2600 -
\??\c:\3tnnnt.exec:\3tnnnt.exe43⤵
- Executes dropped EXE
PID:2448 -
\??\c:\5jvpj.exec:\5jvpj.exe44⤵
- Executes dropped EXE
PID:2604 -
\??\c:\84286.exec:\84286.exe45⤵
- Executes dropped EXE
PID:2976 -
\??\c:\268266.exec:\268266.exe46⤵
- Executes dropped EXE
PID:1564 -
\??\c:\hhntbn.exec:\hhntbn.exe47⤵
- Executes dropped EXE
PID:240 -
\??\c:\2420662.exec:\2420662.exe48⤵
- Executes dropped EXE
PID:2908 -
\??\c:\4840880.exec:\4840880.exe49⤵
- Executes dropped EXE
PID:2888 -
\??\c:\486426.exec:\486426.exe50⤵
- Executes dropped EXE
PID:1508 -
\??\c:\9vdpj.exec:\9vdpj.exe51⤵
- Executes dropped EXE
PID:1056 -
\??\c:\tthhbb.exec:\tthhbb.exe52⤵
- Executes dropped EXE
PID:1832 -
\??\c:\vvvpd.exec:\vvvpd.exe53⤵
- Executes dropped EXE
PID:1880 -
\??\c:\806846.exec:\806846.exe54⤵
- Executes dropped EXE
PID:632 -
\??\c:\86240.exec:\86240.exe55⤵
- Executes dropped EXE
PID:2696 -
\??\c:\886244.exec:\886244.exe56⤵
- Executes dropped EXE
PID:1700 -
\??\c:\rfrflrl.exec:\rfrflrl.exe57⤵
- Executes dropped EXE
PID:1760 -
\??\c:\26468.exec:\26468.exe58⤵
- Executes dropped EXE
PID:1728 -
\??\c:\820688.exec:\820688.exe59⤵
- Executes dropped EXE
PID:812 -
\??\c:\66606.exec:\66606.exe60⤵
- Executes dropped EXE
PID:2248 -
\??\c:\00042.exec:\00042.exe61⤵
- Executes dropped EXE
PID:2424 -
\??\c:\444222.exec:\444222.exe62⤵
- Executes dropped EXE
PID:2292 -
\??\c:\044608.exec:\044608.exe63⤵
- Executes dropped EXE
PID:332 -
\??\c:\2626648.exec:\2626648.exe64⤵
- Executes dropped EXE
PID:940 -
\??\c:\0244666.exec:\0244666.exe65⤵
- Executes dropped EXE
PID:1888 -
\??\c:\4868408.exec:\4868408.exe66⤵PID:1804
-
\??\c:\086606.exec:\086606.exe67⤵PID:420
-
\??\c:\tnnthh.exec:\tnnthh.exe68⤵PID:2160
-
\??\c:\04628.exec:\04628.exe69⤵PID:1400
-
\??\c:\lrlffxr.exec:\lrlffxr.exe70⤵PID:1616
-
\??\c:\xrrxfll.exec:\xrrxfll.exe71⤵PID:1808
-
\??\c:\pjvvp.exec:\pjvvp.exe72⤵PID:620
-
\??\c:\2206466.exec:\2206466.exe73⤵PID:2408
-
\??\c:\4426000.exec:\4426000.exe74⤵PID:1632
-
\??\c:\4846080.exec:\4846080.exe75⤵PID:612
-
\??\c:\8482020.exec:\8482020.exe76⤵PID:2204
-
\??\c:\826206.exec:\826206.exe77⤵PID:892
-
\??\c:\thtbhh.exec:\thtbhh.exe78⤵PID:1748
-
\??\c:\bthnbt.exec:\bthnbt.exe79⤵PID:2952
-
\??\c:\u828624.exec:\u828624.exe80⤵PID:2804
-
\??\c:\rrflxff.exec:\rrflxff.exe81⤵PID:2624
-
\??\c:\dvvjd.exec:\dvvjd.exe82⤵PID:2988
-
\??\c:\rfxfrll.exec:\rfxfrll.exe83⤵PID:3000
-
\??\c:\g0404.exec:\g0404.exe84⤵PID:2568
-
\??\c:\808244.exec:\808244.exe85⤵PID:2660
-
\??\c:\ttnbhn.exec:\ttnbhn.exe86⤵PID:3032
-
\??\c:\8880808.exec:\8880808.exe87⤵PID:2708
-
\??\c:\2402084.exec:\2402084.exe88⤵PID:2244
-
\??\c:\04848.exec:\04848.exe89⤵PID:1852
-
\??\c:\60248.exec:\60248.exe90⤵PID:1896
-
\??\c:\hbbhnt.exec:\hbbhnt.exe91⤵PID:1652
-
\??\c:\fflrlxr.exec:\fflrlxr.exe92⤵PID:2768
-
\??\c:\hhnnbt.exec:\hhnnbt.exe93⤵PID:2916
-
\??\c:\68062.exec:\68062.exe94⤵PID:3040
-
\??\c:\fxlrflx.exec:\fxlrflx.exe95⤵PID:2000
-
\??\c:\84284.exec:\84284.exe96⤵PID:1988
-
\??\c:\20024.exec:\20024.exe97⤵PID:1800
-
\??\c:\w00222.exec:\w00222.exe98⤵PID:1788
-
\??\c:\688660.exec:\688660.exe99⤵PID:2616
-
\??\c:\thbbhn.exec:\thbbhn.exe100⤵PID:548
-
\??\c:\jvpvj.exec:\jvpvj.exe101⤵PID:1268
-
\??\c:\420062.exec:\420062.exe102⤵PID:1348
-
\??\c:\3bhntt.exec:\3bhntt.exe103⤵PID:1980
-
\??\c:\88206.exec:\88206.exe104⤵PID:1944
-
\??\c:\jjjvd.exec:\jjjvd.exe105⤵PID:2828
-
\??\c:\8284068.exec:\8284068.exe106⤵PID:2312
-
\??\c:\220028.exec:\220028.exe107⤵PID:384
-
\??\c:\q48028.exec:\q48028.exe108⤵PID:1164
-
\??\c:\088846.exec:\088846.exe109⤵PID:1084
-
\??\c:\htnttt.exec:\htnttt.exe110⤵PID:552
-
\??\c:\fxrrflx.exec:\fxrrflx.exe111⤵PID:1148
-
\??\c:\0424484.exec:\0424484.exe112⤵PID:1156
-
\??\c:\llffxlx.exec:\llffxlx.exe113⤵PID:2384
-
\??\c:\k80640.exec:\k80640.exe114⤵PID:1656
-
\??\c:\xrllxxx.exec:\xrllxxx.exe115⤵PID:956
-
\??\c:\xllrffl.exec:\xllrffl.exe116⤵PID:1860
-
\??\c:\886006.exec:\886006.exe117⤵PID:2836
-
\??\c:\lllflrx.exec:\lllflrx.exe118⤵PID:1764
-
\??\c:\8844262.exec:\8844262.exe119⤵PID:3056
-
\??\c:\dvjjv.exec:\dvjjv.exe120⤵PID:1648
-
\??\c:\8484220.exec:\8484220.exe121⤵PID:1052
-
\??\c:\k88062.exec:\k88062.exe122⤵PID:1688
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-