Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
04/06/2024, 19:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8d1354813c4786fb75be21c6656ee240_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
8d1354813c4786fb75be21c6656ee240_NeikiAnalytics.exe
-
Size
414KB
-
MD5
8d1354813c4786fb75be21c6656ee240
-
SHA1
5dddb0a24af45992ad463a805de8b0aaeb916172
-
SHA256
7135dfa958ed5c5053a8ab269aabe85d2fd2f47caaea50a389e62dc299f3774d
-
SHA512
0c0dc203bc1fd4dbb968ca89956be0956911cfb37dc829db00540b2ea8785fc2378c84384a2721e9a370a66278a359063f265b186cbc735e13978f29b6de6778
-
SSDEEP
12288:n3C9ytvngQj4DtvnV9wLn9UTfC8eieJNBNIsYP9:SgdnJUdnV9d
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/1772-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1744-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2268-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1988-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/376-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1792-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1760-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2000-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2124 dppdv.exe 2680 flxlrff.exe 2652 1llfllx.exe 2620 btbhnn.exe 2784 ffffxlx.exe 2212 1hbnbn.exe 2500 jvpdv.exe 2192 bnhnbn.exe 2664 djpvp.exe 2776 fxflrxf.exe 2916 jpdpp.exe 2964 frflxlx.exe 2432 jdddv.exe 2208 xrfxrfx.exe 1128 1tnbnb.exe 2160 ffflxxl.exe 316 tthntb.exe 1744 vvvpj.exe 1504 nnhnbb.exe 2268 hthhbh.exe 1988 rlfrllf.exe 2108 btnnhn.exe 376 5rllrrl.exe 816 9thnbn.exe 1792 rrxlxfr.exe 1760 nhtbhn.exe 1856 rfxrflx.exe 1948 1httbb.exe 2336 lflrxxl.exe 2168 nnbbnt.exe 2000 pvppd.exe 1920 lxflfxf.exe 2112 ddvdp.exe 3040 xxrrrxf.exe 2376 tnntnn.exe 2332 ddvjv.exe 1572 flrlflr.exe 2704 fxxfrxl.exe 2652 hhbtbb.exe 1152 jjjpd.exe 2684 lrlxflr.exe 2784 nnhhtt.exe 2496 hthbht.exe 2568 djpdd.exe 2200 xrlrxxr.exe 2940 hhthnb.exe 2808 bthhnn.exe 2904 pvvdp.exe 2956 1lflxlx.exe 1852 9nnnbb.exe 2012 thnnnb.exe 2412 7dvdj.exe 1176 rrlrxfl.exe 3024 fxlllrf.exe 768 bbtnbb.exe 1056 vpjjp.exe 884 llxflrx.exe 1752 ffrrrrx.exe 1504 htnbhb.exe 852 1ppdp.exe 2868 9pddj.exe 596 xxrflxf.exe 1040 hhbhtb.exe 1108 3hbhht.exe -
resource yara_rule behavioral1/memory/1772-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1744-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2268-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1988-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/376-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1760-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2000-299-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1772 wrote to memory of 2124 1772 8d1354813c4786fb75be21c6656ee240_NeikiAnalytics.exe 28 PID 1772 wrote to memory of 2124 1772 8d1354813c4786fb75be21c6656ee240_NeikiAnalytics.exe 28 PID 1772 wrote to memory of 2124 1772 8d1354813c4786fb75be21c6656ee240_NeikiAnalytics.exe 28 PID 1772 wrote to memory of 2124 1772 8d1354813c4786fb75be21c6656ee240_NeikiAnalytics.exe 28 PID 2124 wrote to memory of 2680 2124 dppdv.exe 29 PID 2124 wrote to memory of 2680 2124 dppdv.exe 29 PID 2124 wrote to memory of 2680 2124 dppdv.exe 29 PID 2124 wrote to memory of 2680 2124 dppdv.exe 29 PID 2680 wrote to memory of 2652 2680 flxlrff.exe 30 PID 2680 wrote to memory of 2652 2680 flxlrff.exe 30 PID 2680 wrote to memory of 2652 2680 flxlrff.exe 30 PID 2680 wrote to memory of 2652 2680 flxlrff.exe 30 PID 2652 wrote to memory of 2620 2652 1llfllx.exe 31 PID 2652 wrote to memory of 2620 2652 1llfllx.exe 31 PID 2652 wrote to memory of 2620 2652 1llfllx.exe 31 PID 2652 wrote to memory of 2620 2652 1llfllx.exe 31 PID 2620 wrote to memory of 2784 2620 btbhnn.exe 32 PID 2620 wrote to memory of 2784 2620 btbhnn.exe 32 PID 2620 wrote to memory of 2784 2620 btbhnn.exe 32 PID 2620 wrote to memory of 2784 2620 btbhnn.exe 32 PID 2784 wrote to memory of 2212 2784 ffffxlx.exe 33 PID 2784 wrote to memory of 2212 2784 ffffxlx.exe 33 PID 2784 wrote to memory of 2212 2784 ffffxlx.exe 33 PID 2784 wrote to memory of 2212 2784 ffffxlx.exe 33 PID 2212 wrote to memory of 2500 2212 1hbnbn.exe 34 PID 2212 wrote to memory of 2500 2212 1hbnbn.exe 34 PID 2212 wrote to memory of 2500 2212 1hbnbn.exe 34 PID 2212 wrote to memory of 2500 2212 1hbnbn.exe 34 PID 2500 wrote to memory of 2192 2500 jvpdv.exe 35 PID 2500 wrote to memory of 2192 2500 jvpdv.exe 35 PID 2500 wrote to memory of 2192 2500 jvpdv.exe 35 PID 2500 wrote to memory of 2192 2500 jvpdv.exe 35 PID 2192 wrote to memory of 2664 2192 bnhnbn.exe 36 PID 2192 wrote to memory of 2664 2192 bnhnbn.exe 36 PID 2192 wrote to memory of 2664 2192 bnhnbn.exe 36 PID 2192 wrote to memory of 2664 2192 bnhnbn.exe 36 PID 2664 wrote to memory of 2776 2664 djpvp.exe 37 PID 2664 wrote to memory of 2776 2664 djpvp.exe 37 PID 2664 wrote to memory of 2776 2664 djpvp.exe 37 PID 2664 wrote to memory of 2776 2664 djpvp.exe 37 PID 2776 wrote to memory of 2916 2776 fxflrxf.exe 38 PID 2776 wrote to memory of 2916 2776 fxflrxf.exe 38 PID 2776 wrote to memory of 2916 2776 fxflrxf.exe 38 PID 2776 wrote to memory of 2916 2776 fxflrxf.exe 38 PID 2916 wrote to memory of 2964 2916 jpdpp.exe 39 PID 2916 wrote to memory of 2964 2916 jpdpp.exe 39 PID 2916 wrote to memory of 2964 2916 jpdpp.exe 39 PID 2916 wrote to memory of 2964 2916 jpdpp.exe 39 PID 2964 wrote to memory of 2432 2964 frflxlx.exe 40 PID 2964 wrote to memory of 2432 2964 frflxlx.exe 40 PID 2964 wrote to memory of 2432 2964 frflxlx.exe 40 PID 2964 wrote to memory of 2432 2964 frflxlx.exe 40 PID 2432 wrote to memory of 2208 2432 jdddv.exe 41 PID 2432 wrote to memory of 2208 2432 jdddv.exe 41 PID 2432 wrote to memory of 2208 2432 jdddv.exe 41 PID 2432 wrote to memory of 2208 2432 jdddv.exe 41 PID 2208 wrote to memory of 1128 2208 xrfxrfx.exe 42 PID 2208 wrote to memory of 1128 2208 xrfxrfx.exe 42 PID 2208 wrote to memory of 1128 2208 xrfxrfx.exe 42 PID 2208 wrote to memory of 1128 2208 xrfxrfx.exe 42 PID 1128 wrote to memory of 2160 1128 1tnbnb.exe 43 PID 1128 wrote to memory of 2160 1128 1tnbnb.exe 43 PID 1128 wrote to memory of 2160 1128 1tnbnb.exe 43 PID 1128 wrote to memory of 2160 1128 1tnbnb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d1354813c4786fb75be21c6656ee240_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8d1354813c4786fb75be21c6656ee240_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\dppdv.exec:\dppdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\flxlrff.exec:\flxlrff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\1llfllx.exec:\1llfllx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\btbhnn.exec:\btbhnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\ffffxlx.exec:\ffffxlx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\1hbnbn.exec:\1hbnbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\jvpdv.exec:\jvpdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\bnhnbn.exec:\bnhnbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\djpvp.exec:\djpvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\fxflrxf.exec:\fxflrxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\jpdpp.exec:\jpdpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\frflxlx.exec:\frflxlx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\jdddv.exec:\jdddv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\xrfxrfx.exec:\xrfxrfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\1tnbnb.exec:\1tnbnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\ffflxxl.exec:\ffflxxl.exe17⤵
- Executes dropped EXE
PID:2160 -
\??\c:\tthntb.exec:\tthntb.exe18⤵
- Executes dropped EXE
PID:316 -
\??\c:\vvvpj.exec:\vvvpj.exe19⤵
- Executes dropped EXE
PID:1744 -
\??\c:\nnhnbb.exec:\nnhnbb.exe20⤵
- Executes dropped EXE
PID:1504 -
\??\c:\hthhbh.exec:\hthhbh.exe21⤵
- Executes dropped EXE
PID:2268 -
\??\c:\rlfrllf.exec:\rlfrllf.exe22⤵
- Executes dropped EXE
PID:1988 -
\??\c:\btnnhn.exec:\btnnhn.exe23⤵
- Executes dropped EXE
PID:2108 -
\??\c:\5rllrrl.exec:\5rllrrl.exe24⤵
- Executes dropped EXE
PID:376 -
\??\c:\9thnbn.exec:\9thnbn.exe25⤵
- Executes dropped EXE
PID:816 -
\??\c:\rrxlxfr.exec:\rrxlxfr.exe26⤵
- Executes dropped EXE
PID:1792 -
\??\c:\nhtbhn.exec:\nhtbhn.exe27⤵
- Executes dropped EXE
PID:1760 -
\??\c:\rfxrflx.exec:\rfxrflx.exe28⤵
- Executes dropped EXE
PID:1856 -
\??\c:\1httbb.exec:\1httbb.exe29⤵
- Executes dropped EXE
PID:1948 -
\??\c:\lflrxxl.exec:\lflrxxl.exe30⤵
- Executes dropped EXE
PID:2336 -
\??\c:\nnbbnt.exec:\nnbbnt.exe31⤵
- Executes dropped EXE
PID:2168 -
\??\c:\pvppd.exec:\pvppd.exe32⤵
- Executes dropped EXE
PID:2000 -
\??\c:\lxflfxf.exec:\lxflfxf.exe33⤵
- Executes dropped EXE
PID:1920 -
\??\c:\ddvdp.exec:\ddvdp.exe34⤵
- Executes dropped EXE
PID:2112 -
\??\c:\xxrrrxf.exec:\xxrrrxf.exe35⤵
- Executes dropped EXE
PID:3040 -
\??\c:\tnntnn.exec:\tnntnn.exe36⤵
- Executes dropped EXE
PID:2376 -
\??\c:\ddvjv.exec:\ddvjv.exe37⤵
- Executes dropped EXE
PID:2332 -
\??\c:\flrlflr.exec:\flrlflr.exe38⤵
- Executes dropped EXE
PID:1572 -
\??\c:\fxxfrxl.exec:\fxxfrxl.exe39⤵
- Executes dropped EXE
PID:2704 -
\??\c:\hhbtbb.exec:\hhbtbb.exe40⤵
- Executes dropped EXE
PID:2652 -
\??\c:\jjjpd.exec:\jjjpd.exe41⤵
- Executes dropped EXE
PID:1152 -
\??\c:\lrlxflr.exec:\lrlxflr.exe42⤵
- Executes dropped EXE
PID:2684 -
\??\c:\nnhhtt.exec:\nnhhtt.exe43⤵
- Executes dropped EXE
PID:2784 -
\??\c:\hthbht.exec:\hthbht.exe44⤵
- Executes dropped EXE
PID:2496 -
\??\c:\djpdd.exec:\djpdd.exe45⤵
- Executes dropped EXE
PID:2568 -
\??\c:\xrlrxxr.exec:\xrlrxxr.exe46⤵
- Executes dropped EXE
PID:2200 -
\??\c:\hhthnb.exec:\hhthnb.exe47⤵
- Executes dropped EXE
PID:2940 -
\??\c:\bthhnn.exec:\bthhnn.exe48⤵
- Executes dropped EXE
PID:2808 -
\??\c:\pvvdp.exec:\pvvdp.exe49⤵
- Executes dropped EXE
PID:2904 -
\??\c:\1lflxlx.exec:\1lflxlx.exe50⤵
- Executes dropped EXE
PID:2956 -
\??\c:\9nnnbb.exec:\9nnnbb.exe51⤵
- Executes dropped EXE
PID:1852 -
\??\c:\thnnnb.exec:\thnnnb.exe52⤵
- Executes dropped EXE
PID:2012 -
\??\c:\7dvdj.exec:\7dvdj.exe53⤵
- Executes dropped EXE
PID:2412 -
\??\c:\rrlrxfl.exec:\rrlrxfl.exe54⤵
- Executes dropped EXE
PID:1176 -
\??\c:\fxlllrf.exec:\fxlllrf.exe55⤵
- Executes dropped EXE
PID:3024 -
\??\c:\bbtnbb.exec:\bbtnbb.exe56⤵
- Executes dropped EXE
PID:768 -
\??\c:\vpjjp.exec:\vpjjp.exe57⤵
- Executes dropped EXE
PID:1056 -
\??\c:\llxflrx.exec:\llxflrx.exe58⤵
- Executes dropped EXE
PID:884 -
\??\c:\ffrrrrx.exec:\ffrrrrx.exe59⤵
- Executes dropped EXE
PID:1752 -
\??\c:\htnbhb.exec:\htnbhb.exe60⤵
- Executes dropped EXE
PID:1504 -
\??\c:\1ppdp.exec:\1ppdp.exe61⤵
- Executes dropped EXE
PID:852 -
\??\c:\9pddj.exec:\9pddj.exe62⤵
- Executes dropped EXE
PID:2868 -
\??\c:\xxrflxf.exec:\xxrflxf.exe63⤵
- Executes dropped EXE
PID:596 -
\??\c:\hhbhtb.exec:\hhbhtb.exe64⤵
- Executes dropped EXE
PID:1040 -
\??\c:\3hbhht.exec:\3hbhht.exe65⤵
- Executes dropped EXE
PID:1108 -
\??\c:\jjvpd.exec:\jjvpd.exe66⤵PID:1656
-
\??\c:\lxrxffr.exec:\lxrxffr.exe67⤵PID:1296
-
\??\c:\hntbnh.exec:\hntbnh.exe68⤵PID:1528
-
\??\c:\dvpvv.exec:\dvpvv.exe69⤵PID:1972
-
\??\c:\vpjpv.exec:\vpjpv.exe70⤵PID:1604
-
\??\c:\llxfflr.exec:\llxfflr.exe71⤵PID:948
-
\??\c:\9tnhhn.exec:\9tnhhn.exe72⤵PID:2576
-
\??\c:\nhbbbh.exec:\nhbbbh.exe73⤵PID:2148
-
\??\c:\ddvjp.exec:\ddvjp.exe74⤵PID:2104
-
\??\c:\fxxfllx.exec:\fxxfllx.exe75⤵PID:1732
-
\??\c:\lxlxrrl.exec:\lxlxrrl.exe76⤵PID:3000
-
\??\c:\5ttbth.exec:\5ttbth.exe77⤵PID:2884
-
\??\c:\5jdjp.exec:\5jdjp.exe78⤵PID:2356
-
\??\c:\rrrrflx.exec:\rrrrflx.exe79⤵PID:2340
-
\??\c:\lffxrrf.exec:\lffxrrf.exe80⤵PID:2064
-
\??\c:\tbbnbb.exec:\tbbnbb.exe81⤵PID:2588
-
\??\c:\jdvpv.exec:\jdvpv.exe82⤵PID:2460
-
\??\c:\5jdjd.exec:\5jdjd.exe83⤵PID:2628
-
\??\c:\3ffrflf.exec:\3ffrflf.exe84⤵PID:2604
-
\??\c:\nhtbhn.exec:\nhtbhn.exe85⤵PID:2756
-
\??\c:\1hhtht.exec:\1hhtht.exe86⤵PID:2760
-
\??\c:\jjjvj.exec:\jjjvj.exe87⤵PID:2560
-
\??\c:\xrfxflr.exec:\xrfxflr.exe88⤵PID:2948
-
\??\c:\xrfllrr.exec:\xrfllrr.exe89⤵PID:2944
-
\??\c:\9bnhhh.exec:\9bnhhh.exe90⤵PID:2512
-
\??\c:\dvvvd.exec:\dvvvd.exe91⤵PID:2788
-
\??\c:\pjvvd.exec:\pjvvd.exe92⤵PID:2928
-
\??\c:\1rlrflf.exec:\1rlrflf.exe93⤵PID:2536
-
\??\c:\tnbhtn.exec:\tnbhtn.exe94⤵PID:1964
-
\??\c:\5nbhtb.exec:\5nbhtb.exe95⤵PID:1820
-
\??\c:\djdjv.exec:\djdjv.exe96⤵PID:2028
-
\??\c:\1lfrflf.exec:\1lfrflf.exe97⤵PID:1768
-
\??\c:\lfrlrxl.exec:\lfrlrxl.exe98⤵PID:2556
-
\??\c:\hhbbhn.exec:\hhbbhn.exe99⤵PID:2428
-
\??\c:\3dvvv.exec:\3dvvv.exe100⤵PID:2424
-
\??\c:\fxxlrfr.exec:\fxxlrfr.exe101⤵PID:1552
-
\??\c:\xlrrxrr.exec:\xlrrxrr.exe102⤵PID:1596
-
\??\c:\1bbbnn.exec:\1bbbnn.exe103⤵PID:1900
-
\??\c:\dvjvd.exec:\dvjvd.exe104⤵PID:628
-
\??\c:\vpjpd.exec:\vpjpd.exe105⤵PID:2676
-
\??\c:\rlrxxxf.exec:\rlrxxxf.exe106⤵PID:484
-
\??\c:\9nbhtt.exec:\9nbhtt.exe107⤵PID:588
-
\??\c:\vpvjp.exec:\vpvjp.exe108⤵PID:1844
-
\??\c:\vvvdp.exec:\vvvdp.exe109⤵PID:988
-
\??\c:\1xllxxx.exec:\1xllxxx.exe110⤵PID:1792
-
\??\c:\3hbthh.exec:\3hbthh.exe111⤵PID:1348
-
\??\c:\tttbnt.exec:\tttbnt.exe112⤵PID:1936
-
\??\c:\3vvjj.exec:\3vvjj.exe113⤵PID:892
-
\??\c:\rflrlxf.exec:\rflrlxf.exe114⤵PID:2296
-
\??\c:\lffrllx.exec:\lffrllx.exe115⤵PID:704
-
\??\c:\tthntb.exec:\tthntb.exe116⤵PID:1992
-
\??\c:\jjvpp.exec:\jjvpp.exe117⤵PID:2908
-
\??\c:\jjdvv.exec:\jjdvv.exe118⤵PID:2156
-
\??\c:\fxffllx.exec:\fxffllx.exe119⤵PID:2996
-
\??\c:\5tntbh.exec:\5tntbh.exe120⤵PID:2324
-
\??\c:\nnhnbn.exec:\nnhnbn.exe121⤵PID:3052
-
\??\c:\rrxlxxr.exec:\rrxlxxr.exe122⤵PID:1580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-