Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17-06-2024 11:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
83f2ab36bda595afc10c03efe3400420_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
83f2ab36bda595afc10c03efe3400420_NeikiAnalytics.exe
-
Size
88KB
-
MD5
83f2ab36bda595afc10c03efe3400420
-
SHA1
c3f454876a76344883a5efad875b5c3c520d12c4
-
SHA256
6ea5a337cabc1b7a86eae78b72878ff7be68a3a6d7417d0fdd5f0dbf9fb33966
-
SHA512
b9eb92ca686769bd6c946065bc0bdfadb79ad40cc10758f921e4ec30d871d6b99864b95aac10909cf1ecba767fbc3bf98bdf0daa5c3b51ec041741653700d4e9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2iJvRirE0DmmdL2jqWkB9:ymb3NkkiQ3mdBjF+3TU2iBRioSumWS1P
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2360-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2172-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1296-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2180-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1404-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1336-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/988-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1508-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2172 604462.exe 3032 u428064.exe 2572 3pjpv.exe 2728 w08462.exe 2156 tnbbbh.exe 2456 vppvd.exe 2496 1pppv.exe 2552 0008808.exe 2992 tbtnbb.exe 2804 rxrrlrf.exe 2952 08002.exe 2660 028462.exe 1296 vvvjp.exe 2668 nhbntn.exe 2180 tnbhtb.exe 2800 3rlfxxr.exe 1404 fxlfrxf.exe 1336 btbhtb.exe 2012 ddjjp.exe 1796 5jvpp.exe 988 04620.exe 920 jdjvv.exe 2304 bttttb.exe 1508 ddvjj.exe 1040 60266.exe 2088 1dppp.exe 884 hhnbhb.exe 2928 u240662.exe 2308 084028.exe 348 bnbbnh.exe 1684 806842.exe 2360 btnttb.exe 1676 s6464.exe 2056 4844046.exe 2172 dppdd.exe 2580 m4628.exe 2704 a4268.exe 2736 26808.exe 2888 i866684.exe 308 6400062.exe 2600 jddjj.exe 2428 hbhhnt.exe 2508 3hhbtt.exe 1660 08006.exe 1620 0840062.exe 2844 fxrfrxr.exe 2828 8680062.exe 2932 0028420.exe 1608 824628.exe 2484 48246.exe 1916 fxlrflx.exe 1964 408080.exe 1956 3lrxrrf.exe 1988 i868068.exe 1312 i240228.exe 2264 a2288.exe 1336 040066.exe 1788 nhntbh.exe 1984 484066.exe 2144 602622.exe 1140 8880686.exe 1656 04224.exe 864 02642.exe 2884 86884.exe -
resource yara_rule behavioral1/memory/2360-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2172-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2172-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2172-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2172-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1296-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2180-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1404-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1336-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/988-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1508-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-276-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2172 2360 83f2ab36bda595afc10c03efe3400420_NeikiAnalytics.exe 28 PID 2360 wrote to memory of 2172 2360 83f2ab36bda595afc10c03efe3400420_NeikiAnalytics.exe 28 PID 2360 wrote to memory of 2172 2360 83f2ab36bda595afc10c03efe3400420_NeikiAnalytics.exe 28 PID 2360 wrote to memory of 2172 2360 83f2ab36bda595afc10c03efe3400420_NeikiAnalytics.exe 28 PID 2172 wrote to memory of 3032 2172 604462.exe 29 PID 2172 wrote to memory of 3032 2172 604462.exe 29 PID 2172 wrote to memory of 3032 2172 604462.exe 29 PID 2172 wrote to memory of 3032 2172 604462.exe 29 PID 3032 wrote to memory of 2572 3032 u428064.exe 30 PID 3032 wrote to memory of 2572 3032 u428064.exe 30 PID 3032 wrote to memory of 2572 3032 u428064.exe 30 PID 3032 wrote to memory of 2572 3032 u428064.exe 30 PID 2572 wrote to memory of 2728 2572 3pjpv.exe 31 PID 2572 wrote to memory of 2728 2572 3pjpv.exe 31 PID 2572 wrote to memory of 2728 2572 3pjpv.exe 31 PID 2572 wrote to memory of 2728 2572 3pjpv.exe 31 PID 2728 wrote to memory of 2156 2728 w08462.exe 32 PID 2728 wrote to memory of 2156 2728 w08462.exe 32 PID 2728 wrote to memory of 2156 2728 w08462.exe 32 PID 2728 wrote to memory of 2156 2728 w08462.exe 32 PID 2156 wrote to memory of 2456 2156 tnbbbh.exe 33 PID 2156 wrote to memory of 2456 2156 tnbbbh.exe 33 PID 2156 wrote to memory of 2456 2156 tnbbbh.exe 33 PID 2156 wrote to memory of 2456 2156 tnbbbh.exe 33 PID 2456 wrote to memory of 2496 2456 vppvd.exe 34 PID 2456 wrote to memory of 2496 2456 vppvd.exe 34 PID 2456 wrote to memory of 2496 2456 vppvd.exe 34 PID 2456 wrote to memory of 2496 2456 vppvd.exe 34 PID 2496 wrote to memory of 2552 2496 1pppv.exe 35 PID 2496 wrote to memory of 2552 2496 1pppv.exe 35 PID 2496 wrote to memory of 2552 2496 1pppv.exe 35 PID 2496 wrote to memory of 2552 2496 1pppv.exe 35 PID 2552 wrote to memory of 2992 2552 0008808.exe 36 PID 2552 wrote to memory of 2992 2552 0008808.exe 36 PID 2552 wrote to memory of 2992 2552 0008808.exe 36 PID 2552 wrote to memory of 2992 2552 0008808.exe 36 PID 2992 wrote to memory of 2804 2992 tbtnbb.exe 37 PID 2992 wrote to memory of 2804 2992 tbtnbb.exe 37 PID 2992 wrote to memory of 2804 2992 tbtnbb.exe 37 PID 2992 wrote to memory of 2804 2992 tbtnbb.exe 37 PID 2804 wrote to memory of 2952 2804 rxrrlrf.exe 38 PID 2804 wrote to memory of 2952 2804 rxrrlrf.exe 38 PID 2804 wrote to memory of 2952 2804 rxrrlrf.exe 38 PID 2804 wrote to memory of 2952 2804 rxrrlrf.exe 38 PID 2952 wrote to memory of 2660 2952 08002.exe 39 PID 2952 wrote to memory of 2660 2952 08002.exe 39 PID 2952 wrote to memory of 2660 2952 08002.exe 39 PID 2952 wrote to memory of 2660 2952 08002.exe 39 PID 2660 wrote to memory of 1296 2660 028462.exe 40 PID 2660 wrote to memory of 1296 2660 028462.exe 40 PID 2660 wrote to memory of 1296 2660 028462.exe 40 PID 2660 wrote to memory of 1296 2660 028462.exe 40 PID 1296 wrote to memory of 2668 1296 vvvjp.exe 41 PID 1296 wrote to memory of 2668 1296 vvvjp.exe 41 PID 1296 wrote to memory of 2668 1296 vvvjp.exe 41 PID 1296 wrote to memory of 2668 1296 vvvjp.exe 41 PID 2668 wrote to memory of 2180 2668 nhbntn.exe 42 PID 2668 wrote to memory of 2180 2668 nhbntn.exe 42 PID 2668 wrote to memory of 2180 2668 nhbntn.exe 42 PID 2668 wrote to memory of 2180 2668 nhbntn.exe 42 PID 2180 wrote to memory of 2800 2180 tnbhtb.exe 43 PID 2180 wrote to memory of 2800 2180 tnbhtb.exe 43 PID 2180 wrote to memory of 2800 2180 tnbhtb.exe 43 PID 2180 wrote to memory of 2800 2180 tnbhtb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\83f2ab36bda595afc10c03efe3400420_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\83f2ab36bda595afc10c03efe3400420_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\604462.exec:\604462.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\u428064.exec:\u428064.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\3pjpv.exec:\3pjpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\w08462.exec:\w08462.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\tnbbbh.exec:\tnbbbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\vppvd.exec:\vppvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\1pppv.exec:\1pppv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\0008808.exec:\0008808.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\tbtnbb.exec:\tbtnbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\rxrrlrf.exec:\rxrrlrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\08002.exec:\08002.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\028462.exec:\028462.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\vvvjp.exec:\vvvjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\nhbntn.exec:\nhbntn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\tnbhtb.exec:\tnbhtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\3rlfxxr.exec:\3rlfxxr.exe17⤵
- Executes dropped EXE
PID:2800 -
\??\c:\fxlfrxf.exec:\fxlfrxf.exe18⤵
- Executes dropped EXE
PID:1404 -
\??\c:\btbhtb.exec:\btbhtb.exe19⤵
- Executes dropped EXE
PID:1336 -
\??\c:\ddjjp.exec:\ddjjp.exe20⤵
- Executes dropped EXE
PID:2012 -
\??\c:\5jvpp.exec:\5jvpp.exe21⤵
- Executes dropped EXE
PID:1796 -
\??\c:\04620.exec:\04620.exe22⤵
- Executes dropped EXE
PID:988 -
\??\c:\jdjvv.exec:\jdjvv.exe23⤵
- Executes dropped EXE
PID:920 -
\??\c:\bttttb.exec:\bttttb.exe24⤵
- Executes dropped EXE
PID:2304 -
\??\c:\ddvjj.exec:\ddvjj.exe25⤵
- Executes dropped EXE
PID:1508 -
\??\c:\60266.exec:\60266.exe26⤵
- Executes dropped EXE
PID:1040 -
\??\c:\1dppp.exec:\1dppp.exe27⤵
- Executes dropped EXE
PID:2088 -
\??\c:\hhnbhb.exec:\hhnbhb.exe28⤵
- Executes dropped EXE
PID:884 -
\??\c:\u240662.exec:\u240662.exe29⤵
- Executes dropped EXE
PID:2928 -
\??\c:\084028.exec:\084028.exe30⤵
- Executes dropped EXE
PID:2308 -
\??\c:\bnbbnh.exec:\bnbbnh.exe31⤵
- Executes dropped EXE
PID:348 -
\??\c:\806842.exec:\806842.exe32⤵
- Executes dropped EXE
PID:1684 -
\??\c:\btnttb.exec:\btnttb.exe33⤵
- Executes dropped EXE
PID:2360 -
\??\c:\s6464.exec:\s6464.exe34⤵
- Executes dropped EXE
PID:1676 -
\??\c:\4844046.exec:\4844046.exe35⤵
- Executes dropped EXE
PID:2056 -
\??\c:\dppdd.exec:\dppdd.exe36⤵
- Executes dropped EXE
PID:2172 -
\??\c:\m4628.exec:\m4628.exe37⤵
- Executes dropped EXE
PID:2580 -
\??\c:\a4268.exec:\a4268.exe38⤵
- Executes dropped EXE
PID:2704 -
\??\c:\26808.exec:\26808.exe39⤵
- Executes dropped EXE
PID:2736 -
\??\c:\i866684.exec:\i866684.exe40⤵
- Executes dropped EXE
PID:2888 -
\??\c:\6400062.exec:\6400062.exe41⤵
- Executes dropped EXE
PID:308 -
\??\c:\jddjj.exec:\jddjj.exe42⤵
- Executes dropped EXE
PID:2600 -
\??\c:\hbhhnt.exec:\hbhhnt.exe43⤵
- Executes dropped EXE
PID:2428 -
\??\c:\3hhbtt.exec:\3hhbtt.exe44⤵
- Executes dropped EXE
PID:2508 -
\??\c:\08006.exec:\08006.exe45⤵
- Executes dropped EXE
PID:1660 -
\??\c:\0840062.exec:\0840062.exe46⤵
- Executes dropped EXE
PID:1620 -
\??\c:\fxrfrxr.exec:\fxrfrxr.exe47⤵
- Executes dropped EXE
PID:2844 -
\??\c:\8680062.exec:\8680062.exe48⤵
- Executes dropped EXE
PID:2828 -
\??\c:\0028420.exec:\0028420.exe49⤵
- Executes dropped EXE
PID:2932 -
\??\c:\824628.exec:\824628.exe50⤵
- Executes dropped EXE
PID:1608 -
\??\c:\48246.exec:\48246.exe51⤵
- Executes dropped EXE
PID:2484 -
\??\c:\fxlrflx.exec:\fxlrflx.exe52⤵
- Executes dropped EXE
PID:1916 -
\??\c:\408080.exec:\408080.exe53⤵
- Executes dropped EXE
PID:1964 -
\??\c:\3lrxrrf.exec:\3lrxrrf.exe54⤵
- Executes dropped EXE
PID:1956 -
\??\c:\i868068.exec:\i868068.exe55⤵
- Executes dropped EXE
PID:1988 -
\??\c:\i240228.exec:\i240228.exe56⤵
- Executes dropped EXE
PID:1312 -
\??\c:\a2288.exec:\a2288.exe57⤵
- Executes dropped EXE
PID:2264 -
\??\c:\040066.exec:\040066.exe58⤵
- Executes dropped EXE
PID:1336 -
\??\c:\nhntbh.exec:\nhntbh.exe59⤵
- Executes dropped EXE
PID:1788 -
\??\c:\484066.exec:\484066.exe60⤵
- Executes dropped EXE
PID:1984 -
\??\c:\602622.exec:\602622.exe61⤵
- Executes dropped EXE
PID:2144 -
\??\c:\8880686.exec:\8880686.exe62⤵
- Executes dropped EXE
PID:1140 -
\??\c:\04224.exec:\04224.exe63⤵
- Executes dropped EXE
PID:1656 -
\??\c:\02642.exec:\02642.exe64⤵
- Executes dropped EXE
PID:864 -
\??\c:\86884.exec:\86884.exe65⤵
- Executes dropped EXE
PID:2884 -
\??\c:\rfrxflx.exec:\rfrxflx.exe66⤵PID:1124
-
\??\c:\48684.exec:\48684.exe67⤵PID:1044
-
\??\c:\7nnnnt.exec:\7nnnnt.exe68⤵PID:320
-
\??\c:\ttbbnh.exec:\ttbbnh.exe69⤵PID:884
-
\??\c:\jdpdp.exec:\jdpdp.exe70⤵PID:2268
-
\??\c:\k02840.exec:\k02840.exe71⤵PID:2368
-
\??\c:\nhbhhb.exec:\nhbhhb.exe72⤵PID:2516
-
\??\c:\048400.exec:\048400.exe73⤵PID:816
-
\??\c:\264488.exec:\264488.exe74⤵PID:2244
-
\??\c:\7xxxfrl.exec:\7xxxfrl.exe75⤵PID:2252
-
\??\c:\3pjjj.exec:\3pjjj.exe76⤵PID:1676
-
\??\c:\btnhnb.exec:\btnhnb.exe77⤵PID:2140
-
\??\c:\llflrxr.exec:\llflrxr.exe78⤵PID:3032
-
\??\c:\tthtnn.exec:\tthtnn.exe79⤵PID:2588
-
\??\c:\s0462.exec:\s0462.exe80⤵PID:2708
-
\??\c:\426662.exec:\426662.exe81⤵PID:2560
-
\??\c:\7dvdp.exec:\7dvdp.exe82⤵PID:2728
-
\??\c:\0000280.exec:\0000280.exe83⤵PID:2544
-
\??\c:\084682.exec:\084682.exe84⤵PID:2464
-
\??\c:\002842.exec:\002842.exe85⤵PID:2444
-
\??\c:\42648.exec:\42648.exe86⤵PID:2508
-
\??\c:\08000.exec:\08000.exe87⤵PID:1632
-
\??\c:\ppjvj.exec:\ppjvj.exe88⤵PID:2520
-
\??\c:\k24022.exec:\k24022.exe89⤵PID:2852
-
\??\c:\e42888.exec:\e42888.exe90⤵PID:2960
-
\??\c:\jvjjv.exec:\jvjjv.exe91⤵PID:2752
-
\??\c:\48426.exec:\48426.exe92⤵PID:1432
-
\??\c:\hbhntn.exec:\hbhntn.exe93⤵PID:2764
-
\??\c:\1jdjd.exec:\1jdjd.exe94⤵PID:1644
-
\??\c:\vpddj.exec:\vpddj.exe95⤵PID:2652
-
\??\c:\vvvdp.exec:\vvvdp.exe96⤵PID:2180
-
\??\c:\66404.exec:\66404.exe97⤵PID:1988
-
\??\c:\jjdvj.exec:\jjdvj.exe98⤵PID:860
-
\??\c:\48642.exec:\48642.exe99⤵PID:1316
-
\??\c:\420224.exec:\420224.exe100⤵PID:1776
-
\??\c:\260684.exec:\260684.exe101⤵PID:2284
-
\??\c:\6480662.exec:\6480662.exe102⤵PID:1796
-
\??\c:\xrxxllx.exec:\xrxxllx.exe103⤵PID:556
-
\??\c:\ddpdp.exec:\ddpdp.exe104⤵PID:1140
-
\??\c:\0866442.exec:\0866442.exe105⤵PID:1768
-
\??\c:\60284.exec:\60284.exe106⤵PID:1508
-
\??\c:\hnhnbh.exec:\hnhnbh.exe107⤵PID:960
-
\??\c:\60222.exec:\60222.exe108⤵PID:908
-
\??\c:\a8042.exec:\a8042.exe109⤵PID:1784
-
\??\c:\tnbntt.exec:\tnbntt.exe110⤵PID:320
-
\??\c:\c862628.exec:\c862628.exe111⤵PID:1580
-
\??\c:\bnbbbh.exec:\bnbbbh.exe112⤵PID:2024
-
\??\c:\fllxxrx.exec:\fllxxrx.exe113⤵PID:1192
-
\??\c:\ppvjp.exec:\ppvjp.exe114⤵PID:880
-
\??\c:\6086280.exec:\6086280.exe115⤵PID:2136
-
\??\c:\6086262.exec:\6086262.exe116⤵PID:2244
-
\??\c:\0424440.exec:\0424440.exe117⤵PID:2360
-
\??\c:\8228002.exec:\8228002.exe118⤵PID:1668
-
\??\c:\00802.exec:\00802.exe119⤵PID:2056
-
\??\c:\frrrffr.exec:\frrrffr.exe120⤵PID:2168
-
\??\c:\c268068.exec:\c268068.exe121⤵PID:2580
-
\??\c:\9lxlrrl.exec:\9lxlrrl.exe122⤵PID:2704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-