Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/06/2024, 04:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
282e4aa73ec2168ee75b4a71261b2dd0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
282e4aa73ec2168ee75b4a71261b2dd0_NeikiAnalytics.exe
-
Size
213KB
-
MD5
282e4aa73ec2168ee75b4a71261b2dd0
-
SHA1
12b5509d7feb5644fa039ac9db93cdd24172db95
-
SHA256
682c6424ab9a6f9e38b1d152a68b687cf1556f0319312c02bb2a7f2604a54999
-
SHA512
97ac75f68e61eef0f10760b85a005adf77f2961af1b61513f4d9104da15aa826e585fed18c9e523fa7cb3652e79e18d7acd59e8108ea9e48d087c279c8c3ed58
-
SSDEEP
3072:ymb3NkkiQ3mdBjFIi/0RU6QeYQsm71vPmc51+GqekBJCvr6zJBUmABvW:n3C9BRIG0asYFm71m8+GdkB9EBe
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2156-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2044-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3008-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1892-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1892-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1708-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1904-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2292-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1336-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1628-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2084-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1392-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2308-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2044 jvppv.exe 2636 bnbbnb.exe 2516 djjpv.exe 3008 lllxrfr.exe 2796 nnbtth.exe 2412 5pddj.exe 2912 thtntn.exe 1892 dvjjp.exe 2780 7lxflxl.exe 2800 nntnhb.exe 1708 ddjjp.exe 1904 lfxxfxl.exe 2132 nnnbtb.exe 2292 7ppjv.exe 1504 rlflfrf.exe 1336 bhbbht.exe 1628 pddjv.exe 2084 ppvdj.exe 2844 bhnhhb.exe 2244 bnnbht.exe 792 fxrfrrx.exe 1392 3xxlllr.exe 1720 btbbtt.exe 912 dppjj.exe 412 xxxlxxx.exe 2308 9hntnb.exe 2176 djddj.exe 2860 lflrxrf.exe 2184 tthnbt.exe 1640 dpvpp.exe 1876 5rrrllx.exe 1500 ntbbhb.exe 2996 vjjpj.exe 2628 flxlxfx.exe 2624 1bbbnb.exe 2828 djdjj.exe 2516 jvjjj.exe 2436 lxlflll.exe 2372 3hhbbh.exe 2444 pvdvp.exe 2488 7pddv.exe 1184 1lxfllr.exe 1736 9tnhtb.exe 2772 vvjvd.exe 2768 3pdjv.exe 332 fxxfllr.exe 1860 3tnnbt.exe 1708 7nbtbh.exe 1672 vvjvv.exe 1352 rflxrxf.exe 2672 bnntbb.exe 2324 thnthn.exe 1504 vjpdd.exe 1244 3frxlrx.exe 3028 9hthth.exe 1608 hhbbht.exe 1832 vpdjv.exe 540 lrfffxl.exe 588 9bnthh.exe 2592 7bbbbb.exe 2900 djjjd.exe 604 xxxrfrl.exe 2212 fxfrrxx.exe 1180 nnthbh.exe -
resource yara_rule behavioral1/memory/2156-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1892-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1892-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1892-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1892-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1904-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1336-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1392-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2308-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-276-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2156 wrote to memory of 2044 2156 282e4aa73ec2168ee75b4a71261b2dd0_NeikiAnalytics.exe 28 PID 2156 wrote to memory of 2044 2156 282e4aa73ec2168ee75b4a71261b2dd0_NeikiAnalytics.exe 28 PID 2156 wrote to memory of 2044 2156 282e4aa73ec2168ee75b4a71261b2dd0_NeikiAnalytics.exe 28 PID 2156 wrote to memory of 2044 2156 282e4aa73ec2168ee75b4a71261b2dd0_NeikiAnalytics.exe 28 PID 2044 wrote to memory of 2636 2044 jvppv.exe 29 PID 2044 wrote to memory of 2636 2044 jvppv.exe 29 PID 2044 wrote to memory of 2636 2044 jvppv.exe 29 PID 2044 wrote to memory of 2636 2044 jvppv.exe 29 PID 2636 wrote to memory of 2516 2636 bnbbnb.exe 30 PID 2636 wrote to memory of 2516 2636 bnbbnb.exe 30 PID 2636 wrote to memory of 2516 2636 bnbbnb.exe 30 PID 2636 wrote to memory of 2516 2636 bnbbnb.exe 30 PID 2516 wrote to memory of 3008 2516 djjpv.exe 31 PID 2516 wrote to memory of 3008 2516 djjpv.exe 31 PID 2516 wrote to memory of 3008 2516 djjpv.exe 31 PID 2516 wrote to memory of 3008 2516 djjpv.exe 31 PID 3008 wrote to memory of 2796 3008 lllxrfr.exe 32 PID 3008 wrote to memory of 2796 3008 lllxrfr.exe 32 PID 3008 wrote to memory of 2796 3008 lllxrfr.exe 32 PID 3008 wrote to memory of 2796 3008 lllxrfr.exe 32 PID 2796 wrote to memory of 2412 2796 nnbtth.exe 33 PID 2796 wrote to memory of 2412 2796 nnbtth.exe 33 PID 2796 wrote to memory of 2412 2796 nnbtth.exe 33 PID 2796 wrote to memory of 2412 2796 nnbtth.exe 33 PID 2412 wrote to memory of 2912 2412 5pddj.exe 34 PID 2412 wrote to memory of 2912 2412 5pddj.exe 34 PID 2412 wrote to memory of 2912 2412 5pddj.exe 34 PID 2412 wrote to memory of 2912 2412 5pddj.exe 34 PID 2912 wrote to memory of 1892 2912 thtntn.exe 35 PID 2912 wrote to memory of 1892 2912 thtntn.exe 35 PID 2912 wrote to memory of 1892 2912 thtntn.exe 35 PID 2912 wrote to memory of 1892 2912 thtntn.exe 35 PID 1892 wrote to memory of 2780 1892 dvjjp.exe 36 PID 1892 wrote to memory of 2780 1892 dvjjp.exe 36 PID 1892 wrote to memory of 2780 1892 dvjjp.exe 36 PID 1892 wrote to memory of 2780 1892 dvjjp.exe 36 PID 2780 wrote to memory of 2800 2780 7lxflxl.exe 37 PID 2780 wrote to memory of 2800 2780 7lxflxl.exe 37 PID 2780 wrote to memory of 2800 2780 7lxflxl.exe 37 PID 2780 wrote to memory of 2800 2780 7lxflxl.exe 37 PID 2800 wrote to memory of 1708 2800 nntnhb.exe 38 PID 2800 wrote to memory of 1708 2800 nntnhb.exe 38 PID 2800 wrote to memory of 1708 2800 nntnhb.exe 38 PID 2800 wrote to memory of 1708 2800 nntnhb.exe 38 PID 1708 wrote to memory of 1904 1708 ddjjp.exe 39 PID 1708 wrote to memory of 1904 1708 ddjjp.exe 39 PID 1708 wrote to memory of 1904 1708 ddjjp.exe 39 PID 1708 wrote to memory of 1904 1708 ddjjp.exe 39 PID 1904 wrote to memory of 2132 1904 lfxxfxl.exe 40 PID 1904 wrote to memory of 2132 1904 lfxxfxl.exe 40 PID 1904 wrote to memory of 2132 1904 lfxxfxl.exe 40 PID 1904 wrote to memory of 2132 1904 lfxxfxl.exe 40 PID 2132 wrote to memory of 2292 2132 nnnbtb.exe 41 PID 2132 wrote to memory of 2292 2132 nnnbtb.exe 41 PID 2132 wrote to memory of 2292 2132 nnnbtb.exe 41 PID 2132 wrote to memory of 2292 2132 nnnbtb.exe 41 PID 2292 wrote to memory of 1504 2292 7ppjv.exe 42 PID 2292 wrote to memory of 1504 2292 7ppjv.exe 42 PID 2292 wrote to memory of 1504 2292 7ppjv.exe 42 PID 2292 wrote to memory of 1504 2292 7ppjv.exe 42 PID 1504 wrote to memory of 1336 1504 rlflfrf.exe 43 PID 1504 wrote to memory of 1336 1504 rlflfrf.exe 43 PID 1504 wrote to memory of 1336 1504 rlflfrf.exe 43 PID 1504 wrote to memory of 1336 1504 rlflfrf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\282e4aa73ec2168ee75b4a71261b2dd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\282e4aa73ec2168ee75b4a71261b2dd0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\jvppv.exec:\jvppv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\bnbbnb.exec:\bnbbnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\djjpv.exec:\djjpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\lllxrfr.exec:\lllxrfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\nnbtth.exec:\nnbtth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\5pddj.exec:\5pddj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\thtntn.exec:\thtntn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\dvjjp.exec:\dvjjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\7lxflxl.exec:\7lxflxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\nntnhb.exec:\nntnhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\ddjjp.exec:\ddjjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\lfxxfxl.exec:\lfxxfxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\nnnbtb.exec:\nnnbtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\7ppjv.exec:\7ppjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\rlflfrf.exec:\rlflfrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\bhbbht.exec:\bhbbht.exe17⤵
- Executes dropped EXE
PID:1336 -
\??\c:\pddjv.exec:\pddjv.exe18⤵
- Executes dropped EXE
PID:1628 -
\??\c:\ppvdj.exec:\ppvdj.exe19⤵
- Executes dropped EXE
PID:2084 -
\??\c:\bhnhhb.exec:\bhnhhb.exe20⤵
- Executes dropped EXE
PID:2844 -
\??\c:\bnnbht.exec:\bnnbht.exe21⤵
- Executes dropped EXE
PID:2244 -
\??\c:\fxrfrrx.exec:\fxrfrrx.exe22⤵
- Executes dropped EXE
PID:792 -
\??\c:\3xxlllr.exec:\3xxlllr.exe23⤵
- Executes dropped EXE
PID:1392 -
\??\c:\btbbtt.exec:\btbbtt.exe24⤵
- Executes dropped EXE
PID:1720 -
\??\c:\dppjj.exec:\dppjj.exe25⤵
- Executes dropped EXE
PID:912 -
\??\c:\xxxlxxx.exec:\xxxlxxx.exe26⤵
- Executes dropped EXE
PID:412 -
\??\c:\9hntnb.exec:\9hntnb.exe27⤵
- Executes dropped EXE
PID:2308 -
\??\c:\djddj.exec:\djddj.exe28⤵
- Executes dropped EXE
PID:2176 -
\??\c:\lflrxrf.exec:\lflrxrf.exe29⤵
- Executes dropped EXE
PID:2860 -
\??\c:\tthnbt.exec:\tthnbt.exe30⤵
- Executes dropped EXE
PID:2184 -
\??\c:\dpvpp.exec:\dpvpp.exe31⤵
- Executes dropped EXE
PID:1640 -
\??\c:\5rrrllx.exec:\5rrrllx.exe32⤵
- Executes dropped EXE
PID:1876 -
\??\c:\ntbbhb.exec:\ntbbhb.exe33⤵
- Executes dropped EXE
PID:1500 -
\??\c:\vjjpj.exec:\vjjpj.exe34⤵
- Executes dropped EXE
PID:2996 -
\??\c:\flxlxfx.exec:\flxlxfx.exe35⤵
- Executes dropped EXE
PID:2628 -
\??\c:\1bbbnb.exec:\1bbbnb.exe36⤵
- Executes dropped EXE
PID:2624 -
\??\c:\djdjj.exec:\djdjj.exe37⤵
- Executes dropped EXE
PID:2828 -
\??\c:\jvjjj.exec:\jvjjj.exe38⤵
- Executes dropped EXE
PID:2516 -
\??\c:\lxlflll.exec:\lxlflll.exe39⤵
- Executes dropped EXE
PID:2436 -
\??\c:\3hhbbh.exec:\3hhbbh.exe40⤵
- Executes dropped EXE
PID:2372 -
\??\c:\pvdvp.exec:\pvdvp.exe41⤵
- Executes dropped EXE
PID:2444 -
\??\c:\7pddv.exec:\7pddv.exe42⤵
- Executes dropped EXE
PID:2488 -
\??\c:\1lxfllr.exec:\1lxfllr.exe43⤵
- Executes dropped EXE
PID:1184 -
\??\c:\9tnhtb.exec:\9tnhtb.exe44⤵
- Executes dropped EXE
PID:1736 -
\??\c:\vvjvd.exec:\vvjvd.exe45⤵
- Executes dropped EXE
PID:2772 -
\??\c:\3pdjv.exec:\3pdjv.exe46⤵
- Executes dropped EXE
PID:2768 -
\??\c:\fxxfllr.exec:\fxxfllr.exe47⤵
- Executes dropped EXE
PID:332 -
\??\c:\3tnnbt.exec:\3tnnbt.exe48⤵
- Executes dropped EXE
PID:1860 -
\??\c:\7nbtbh.exec:\7nbtbh.exe49⤵
- Executes dropped EXE
PID:1708 -
\??\c:\vvjvv.exec:\vvjvv.exe50⤵
- Executes dropped EXE
PID:1672 -
\??\c:\rflxrxf.exec:\rflxrxf.exe51⤵
- Executes dropped EXE
PID:1352 -
\??\c:\bnntbb.exec:\bnntbb.exe52⤵
- Executes dropped EXE
PID:2672 -
\??\c:\thnthn.exec:\thnthn.exe53⤵
- Executes dropped EXE
PID:2324 -
\??\c:\vjpdd.exec:\vjpdd.exe54⤵
- Executes dropped EXE
PID:1504 -
\??\c:\3frxlrx.exec:\3frxlrx.exe55⤵
- Executes dropped EXE
PID:1244 -
\??\c:\9hthth.exec:\9hthth.exe56⤵
- Executes dropped EXE
PID:3028 -
\??\c:\hhbbht.exec:\hhbbht.exe57⤵
- Executes dropped EXE
PID:1608 -
\??\c:\vpdjv.exec:\vpdjv.exe58⤵
- Executes dropped EXE
PID:1832 -
\??\c:\lrfffxl.exec:\lrfffxl.exe59⤵
- Executes dropped EXE
PID:540 -
\??\c:\9bnthh.exec:\9bnthh.exe60⤵
- Executes dropped EXE
PID:588 -
\??\c:\7bbbbb.exec:\7bbbbb.exe61⤵
- Executes dropped EXE
PID:2592 -
\??\c:\djjjd.exec:\djjjd.exe62⤵
- Executes dropped EXE
PID:2900 -
\??\c:\xxxrfrl.exec:\xxxrfrl.exe63⤵
- Executes dropped EXE
PID:604 -
\??\c:\fxfrrxx.exec:\fxfrrxx.exe64⤵
- Executes dropped EXE
PID:2212 -
\??\c:\nnthbh.exec:\nnthbh.exe65⤵
- Executes dropped EXE
PID:1180 -
\??\c:\vppdj.exec:\vppdj.exe66⤵PID:836
-
\??\c:\ffxfrxl.exec:\ffxfrxl.exe67⤵PID:2220
-
\??\c:\xxxxflr.exec:\xxxxflr.exe68⤵PID:1732
-
\??\c:\hhhttt.exec:\hhhttt.exe69⤵PID:1688
-
\??\c:\vjpdj.exec:\vjpdj.exe70⤵PID:2860
-
\??\c:\dpppj.exec:\dpppj.exe71⤵PID:1424
-
\??\c:\lfrxflr.exec:\lfrxflr.exe72⤵PID:1944
-
\??\c:\btnbnt.exec:\btnbnt.exe73⤵PID:1480
-
\??\c:\btnhtb.exec:\btnhtb.exe74⤵PID:1632
-
\??\c:\dvddv.exec:\dvddv.exe75⤵PID:2156
-
\??\c:\frrlflx.exec:\frrlflx.exe76⤵PID:2620
-
\??\c:\fxrrxll.exec:\fxrrxll.exe77⤵PID:2716
-
\??\c:\nhtbth.exec:\nhtbth.exe78⤵PID:2544
-
\??\c:\bthtbn.exec:\bthtbn.exe79⤵PID:2536
-
\??\c:\7vpvv.exec:\7vpvv.exe80⤵PID:1312
-
\??\c:\9xrxlrr.exec:\9xrxlrr.exe81⤵PID:2580
-
\??\c:\lllfffl.exec:\lllfffl.exe82⤵PID:2432
-
\??\c:\3tbhnn.exec:\3tbhnn.exe83⤵PID:2172
-
\??\c:\dvvvp.exec:\dvvvp.exe84⤵PID:2064
-
\??\c:\dpdpd.exec:\dpdpd.exe85⤵PID:2296
-
\??\c:\xrflrxx.exec:\xrflrxx.exe86⤵PID:2744
-
\??\c:\btthnh.exec:\btthnh.exe87⤵PID:2784
-
\??\c:\tbhhhb.exec:\tbhhhb.exe88⤵PID:356
-
\??\c:\dpdvd.exec:\dpdvd.exe89⤵PID:2800
-
\??\c:\7fxfrfr.exec:\7fxfrfr.exe90⤵PID:2884
-
\??\c:\xxxxlrr.exec:\xxxxlrr.exe91⤵PID:1668
-
\??\c:\nnthbh.exec:\nnthbh.exe92⤵PID:1748
-
\??\c:\nnnbtb.exec:\nnnbtb.exe93⤵PID:2400
-
\??\c:\jpjdv.exec:\jpjdv.exe94⤵PID:764
-
\??\c:\9lffxrf.exec:\9lffxrf.exe95⤵PID:1600
-
\??\c:\tthttb.exec:\tthttb.exe96⤵PID:1612
-
\??\c:\ntnbnt.exec:\ntnbnt.exe97⤵PID:2252
-
\??\c:\3pjjd.exec:\3pjjd.exe98⤵PID:1984
-
\??\c:\rfxxffl.exec:\rfxxffl.exe99⤵PID:2200
-
\??\c:\lrllflr.exec:\lrllflr.exe100⤵PID:2852
-
\??\c:\bthnbb.exec:\bthnbb.exe101⤵PID:988
-
\??\c:\vpjdd.exec:\vpjdd.exe102⤵PID:1400
-
\??\c:\xrrrxll.exec:\xrrrxll.exe103⤵PID:1780
-
\??\c:\lxxlrrf.exec:\lxxlrrf.exe104⤵PID:1176
-
\??\c:\3thnbn.exec:\3thnbn.exe105⤵PID:1720
-
\??\c:\ppppj.exec:\ppppj.exe106⤵PID:2940
-
\??\c:\rrlxlxl.exec:\rrlxlxl.exe107⤵PID:1768
-
\??\c:\xxrxrxx.exec:\xxrxrxx.exe108⤵PID:2020
-
\??\c:\tnhhht.exec:\tnhhht.exe109⤵PID:1624
-
\??\c:\pppvj.exec:\pppvj.exe110⤵PID:2176
-
\??\c:\dpvjj.exec:\dpvjj.exe111⤵PID:1972
-
\??\c:\rlrxxxl.exec:\rlrxxxl.exe112⤵PID:1976
-
\??\c:\tbnbht.exec:\tbnbht.exe113⤵PID:1852
-
\??\c:\nhtbnt.exec:\nhtbnt.exe114⤵PID:1012
-
\??\c:\dvpdv.exec:\dvpdv.exe115⤵PID:1480
-
\??\c:\7lfrxlx.exec:\7lfrxlx.exe116⤵PID:2552
-
\??\c:\rxfxlff.exec:\rxfxlff.exe117⤵PID:2540
-
\??\c:\bthhhb.exec:\bthhhb.exe118⤵PID:2836
-
\??\c:\vvdjp.exec:\vvdjp.exe119⤵PID:2636
-
\??\c:\xlxfxxf.exec:\xlxfxxf.exe120⤵PID:2528
-
\??\c:\htbntb.exec:\htbntb.exe121⤵PID:2440
-
\??\c:\nthtbt.exec:\nthtbt.exe122⤵PID:2576
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-