Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 19:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a84001b3e407d21fa9334ecf2c360e41cadf0dfb9fca96c913b11703c467e9ed_NeikiAnalytics.exe
Resource
win7-20240611-en
windows7-x64
5 signatures
150 seconds
General
-
Target
a84001b3e407d21fa9334ecf2c360e41cadf0dfb9fca96c913b11703c467e9ed_NeikiAnalytics.exe
-
Size
78KB
-
MD5
44fdb01ba49c8e6d31607de64921fae0
-
SHA1
c704f0a93f20e11bf368b4ebf370c3f59cebf2ff
-
SHA256
a84001b3e407d21fa9334ecf2c360e41cadf0dfb9fca96c913b11703c467e9ed
-
SHA512
67e0e17ed3a09ffef69a52e3b7fe588a723c4d80a3c62337ef5f411124ca43dede52b393bed1ecc407bd1446873a718cd9a988f8457a6f6110ef6e827486a01d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA8v:ymb3NkkiQ3mdBjFIIp9L9QrrA8v
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral1/memory/2360-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2360-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2424-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2284-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2284-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1060-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2108-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1596-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1984-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1228-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1704-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1080-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2400-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/532-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1988-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2392-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/884-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2424 o460600.exe 2388 e66640.exe 2780 82620.exe 2900 i640668.exe 2732 k04422.exe 2284 006288.exe 2580 ntbtbb.exe 1092 lrxfllx.exe 1060 hbthnh.exe 2444 268684.exe 2108 7htttb.exe 2800 dvjvj.exe 1596 ddjvj.exe 2784 448462.exe 1676 806004.exe 2952 lrlrxfr.exe 1984 208466.exe 1228 rrxfflx.exe 1704 86224.exe 1080 tnnnhn.exe 2400 26446.exe 532 4206224.exe 844 fxflxrr.exe 2384 04846.exe 2376 666800.exe 1372 20246.exe 1640 00646.exe 956 462202.exe 1988 0406862.exe 2392 7bhhhh.exe 884 82008.exe 2172 lrfxlrx.exe 1572 4640628.exe 2156 frxxlff.exe 2776 jvddj.exe 2844 i622040.exe 2724 jjppd.exe 2880 a8488.exe 2204 246286.exe 2888 2626666.exe 2616 208844.exe 2600 422660.exe 2628 7nbbbt.exe 2104 202842.exe 1092 llflxff.exe 2288 s4440.exe 2256 1dppj.exe 2112 24004.exe 2148 0848822.exe 2632 86444.exe 2808 pdvjj.exe 1888 02440.exe 2964 0804604.exe 1884 vvdpj.exe 1584 nbtnhb.exe 1720 m8028.exe 620 u022484.exe 2856 q24422.exe 2448 6208602.exe 2548 jvvpv.exe 1000 04028.exe 1760 24666.exe 1140 rfffxrx.exe 1516 ntbhnn.exe -
resource yara_rule behavioral1/memory/2360-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1060-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1596-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1984-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1228-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1704-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1080-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/532-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1988-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/884-297-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2424 2360 a84001b3e407d21fa9334ecf2c360e41cadf0dfb9fca96c913b11703c467e9ed_NeikiAnalytics.exe 28 PID 2360 wrote to memory of 2424 2360 a84001b3e407d21fa9334ecf2c360e41cadf0dfb9fca96c913b11703c467e9ed_NeikiAnalytics.exe 28 PID 2360 wrote to memory of 2424 2360 a84001b3e407d21fa9334ecf2c360e41cadf0dfb9fca96c913b11703c467e9ed_NeikiAnalytics.exe 28 PID 2360 wrote to memory of 2424 2360 a84001b3e407d21fa9334ecf2c360e41cadf0dfb9fca96c913b11703c467e9ed_NeikiAnalytics.exe 28 PID 2424 wrote to memory of 2388 2424 o460600.exe 29 PID 2424 wrote to memory of 2388 2424 o460600.exe 29 PID 2424 wrote to memory of 2388 2424 o460600.exe 29 PID 2424 wrote to memory of 2388 2424 o460600.exe 29 PID 2388 wrote to memory of 2780 2388 e66640.exe 30 PID 2388 wrote to memory of 2780 2388 e66640.exe 30 PID 2388 wrote to memory of 2780 2388 e66640.exe 30 PID 2388 wrote to memory of 2780 2388 e66640.exe 30 PID 2780 wrote to memory of 2900 2780 82620.exe 31 PID 2780 wrote to memory of 2900 2780 82620.exe 31 PID 2780 wrote to memory of 2900 2780 82620.exe 31 PID 2780 wrote to memory of 2900 2780 82620.exe 31 PID 2900 wrote to memory of 2732 2900 i640668.exe 32 PID 2900 wrote to memory of 2732 2900 i640668.exe 32 PID 2900 wrote to memory of 2732 2900 i640668.exe 32 PID 2900 wrote to memory of 2732 2900 i640668.exe 32 PID 2732 wrote to memory of 2284 2732 k04422.exe 33 PID 2732 wrote to memory of 2284 2732 k04422.exe 33 PID 2732 wrote to memory of 2284 2732 k04422.exe 33 PID 2732 wrote to memory of 2284 2732 k04422.exe 33 PID 2284 wrote to memory of 2580 2284 006288.exe 34 PID 2284 wrote to memory of 2580 2284 006288.exe 34 PID 2284 wrote to memory of 2580 2284 006288.exe 34 PID 2284 wrote to memory of 2580 2284 006288.exe 34 PID 2580 wrote to memory of 1092 2580 ntbtbb.exe 35 PID 2580 wrote to memory of 1092 2580 ntbtbb.exe 35 PID 2580 wrote to memory of 1092 2580 ntbtbb.exe 35 PID 2580 wrote to memory of 1092 2580 ntbtbb.exe 35 PID 1092 wrote to memory of 1060 1092 lrxfllx.exe 36 PID 1092 wrote to memory of 1060 1092 lrxfllx.exe 36 PID 1092 wrote to memory of 1060 1092 lrxfllx.exe 36 PID 1092 wrote to memory of 1060 1092 lrxfllx.exe 36 PID 1060 wrote to memory of 2444 1060 hbthnh.exe 37 PID 1060 wrote to memory of 2444 1060 hbthnh.exe 37 PID 1060 wrote to memory of 2444 1060 hbthnh.exe 37 PID 1060 wrote to memory of 2444 1060 hbthnh.exe 37 PID 2444 wrote to memory of 2108 2444 268684.exe 38 PID 2444 wrote to memory of 2108 2444 268684.exe 38 PID 2444 wrote to memory of 2108 2444 268684.exe 38 PID 2444 wrote to memory of 2108 2444 268684.exe 38 PID 2108 wrote to memory of 2800 2108 7htttb.exe 39 PID 2108 wrote to memory of 2800 2108 7htttb.exe 39 PID 2108 wrote to memory of 2800 2108 7htttb.exe 39 PID 2108 wrote to memory of 2800 2108 7htttb.exe 39 PID 2800 wrote to memory of 1596 2800 dvjvj.exe 40 PID 2800 wrote to memory of 1596 2800 dvjvj.exe 40 PID 2800 wrote to memory of 1596 2800 dvjvj.exe 40 PID 2800 wrote to memory of 1596 2800 dvjvj.exe 40 PID 1596 wrote to memory of 2784 1596 ddjvj.exe 41 PID 1596 wrote to memory of 2784 1596 ddjvj.exe 41 PID 1596 wrote to memory of 2784 1596 ddjvj.exe 41 PID 1596 wrote to memory of 2784 1596 ddjvj.exe 41 PID 2784 wrote to memory of 1676 2784 448462.exe 42 PID 2784 wrote to memory of 1676 2784 448462.exe 42 PID 2784 wrote to memory of 1676 2784 448462.exe 42 PID 2784 wrote to memory of 1676 2784 448462.exe 42 PID 1676 wrote to memory of 2952 1676 806004.exe 43 PID 1676 wrote to memory of 2952 1676 806004.exe 43 PID 1676 wrote to memory of 2952 1676 806004.exe 43 PID 1676 wrote to memory of 2952 1676 806004.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\a84001b3e407d21fa9334ecf2c360e41cadf0dfb9fca96c913b11703c467e9ed_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a84001b3e407d21fa9334ecf2c360e41cadf0dfb9fca96c913b11703c467e9ed_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\o460600.exec:\o460600.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\e66640.exec:\e66640.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\82620.exec:\82620.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\i640668.exec:\i640668.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\k04422.exec:\k04422.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\006288.exec:\006288.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\ntbtbb.exec:\ntbtbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\lrxfllx.exec:\lrxfllx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\hbthnh.exec:\hbthnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\268684.exec:\268684.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\7htttb.exec:\7htttb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\dvjvj.exec:\dvjvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\ddjvj.exec:\ddjvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\448462.exec:\448462.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\806004.exec:\806004.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\lrlrxfr.exec:\lrlrxfr.exe17⤵
- Executes dropped EXE
PID:2952 -
\??\c:\208466.exec:\208466.exe18⤵
- Executes dropped EXE
PID:1984 -
\??\c:\rrxfflx.exec:\rrxfflx.exe19⤵
- Executes dropped EXE
PID:1228 -
\??\c:\86224.exec:\86224.exe20⤵
- Executes dropped EXE
PID:1704 -
\??\c:\tnnnhn.exec:\tnnnhn.exe21⤵
- Executes dropped EXE
PID:1080 -
\??\c:\26446.exec:\26446.exe22⤵
- Executes dropped EXE
PID:2400 -
\??\c:\4206224.exec:\4206224.exe23⤵
- Executes dropped EXE
PID:532 -
\??\c:\fxflxrr.exec:\fxflxrr.exe24⤵
- Executes dropped EXE
PID:844 -
\??\c:\04846.exec:\04846.exe25⤵
- Executes dropped EXE
PID:2384 -
\??\c:\666800.exec:\666800.exe26⤵
- Executes dropped EXE
PID:2376 -
\??\c:\20246.exec:\20246.exe27⤵
- Executes dropped EXE
PID:1372 -
\??\c:\00646.exec:\00646.exe28⤵
- Executes dropped EXE
PID:1640 -
\??\c:\462202.exec:\462202.exe29⤵
- Executes dropped EXE
PID:956 -
\??\c:\0406862.exec:\0406862.exe30⤵
- Executes dropped EXE
PID:1988 -
\??\c:\7bhhhh.exec:\7bhhhh.exe31⤵
- Executes dropped EXE
PID:2392 -
\??\c:\82008.exec:\82008.exe32⤵
- Executes dropped EXE
PID:884 -
\??\c:\lrfxlrx.exec:\lrfxlrx.exe33⤵
- Executes dropped EXE
PID:2172 -
\??\c:\4640628.exec:\4640628.exe34⤵
- Executes dropped EXE
PID:1572 -
\??\c:\frxxlff.exec:\frxxlff.exe35⤵
- Executes dropped EXE
PID:2156 -
\??\c:\jvddj.exec:\jvddj.exe36⤵
- Executes dropped EXE
PID:2776 -
\??\c:\i622040.exec:\i622040.exe37⤵
- Executes dropped EXE
PID:2844 -
\??\c:\jjppd.exec:\jjppd.exe38⤵
- Executes dropped EXE
PID:2724 -
\??\c:\a8488.exec:\a8488.exe39⤵
- Executes dropped EXE
PID:2880 -
\??\c:\246286.exec:\246286.exe40⤵
- Executes dropped EXE
PID:2204 -
\??\c:\2626666.exec:\2626666.exe41⤵
- Executes dropped EXE
PID:2888 -
\??\c:\208844.exec:\208844.exe42⤵
- Executes dropped EXE
PID:2616 -
\??\c:\422660.exec:\422660.exe43⤵
- Executes dropped EXE
PID:2600 -
\??\c:\7nbbbt.exec:\7nbbbt.exe44⤵
- Executes dropped EXE
PID:2628 -
\??\c:\202842.exec:\202842.exe45⤵
- Executes dropped EXE
PID:2104 -
\??\c:\llflxff.exec:\llflxff.exe46⤵
- Executes dropped EXE
PID:1092 -
\??\c:\s4440.exec:\s4440.exe47⤵
- Executes dropped EXE
PID:2288 -
\??\c:\1dppj.exec:\1dppj.exe48⤵
- Executes dropped EXE
PID:2256 -
\??\c:\24004.exec:\24004.exe49⤵
- Executes dropped EXE
PID:2112 -
\??\c:\0848822.exec:\0848822.exe50⤵
- Executes dropped EXE
PID:2148 -
\??\c:\86444.exec:\86444.exe51⤵
- Executes dropped EXE
PID:2632 -
\??\c:\pdvjj.exec:\pdvjj.exe52⤵
- Executes dropped EXE
PID:2808 -
\??\c:\02440.exec:\02440.exe53⤵
- Executes dropped EXE
PID:1888 -
\??\c:\0804604.exec:\0804604.exe54⤵
- Executes dropped EXE
PID:2964 -
\??\c:\vvdpj.exec:\vvdpj.exe55⤵
- Executes dropped EXE
PID:1884 -
\??\c:\nbtnhb.exec:\nbtnhb.exe56⤵
- Executes dropped EXE
PID:1584 -
\??\c:\m8028.exec:\m8028.exe57⤵
- Executes dropped EXE
PID:1720 -
\??\c:\u022484.exec:\u022484.exe58⤵
- Executes dropped EXE
PID:620 -
\??\c:\q24422.exec:\q24422.exe59⤵
- Executes dropped EXE
PID:2856 -
\??\c:\6208602.exec:\6208602.exe60⤵
- Executes dropped EXE
PID:2448 -
\??\c:\jvvpv.exec:\jvvpv.exe61⤵
- Executes dropped EXE
PID:2548 -
\??\c:\04028.exec:\04028.exe62⤵
- Executes dropped EXE
PID:1000 -
\??\c:\24666.exec:\24666.exe63⤵
- Executes dropped EXE
PID:1760 -
\??\c:\rfffxrx.exec:\rfffxrx.exe64⤵
- Executes dropped EXE
PID:1140 -
\??\c:\ntbhnn.exec:\ntbhnn.exe65⤵
- Executes dropped EXE
PID:1516 -
\??\c:\pdjvv.exec:\pdjvv.exe66⤵PID:2000
-
\??\c:\084448.exec:\084448.exe67⤵PID:1824
-
\??\c:\lxxxxxr.exec:\lxxxxxr.exe68⤵PID:1636
-
\??\c:\frrrxrr.exec:\frrrxrr.exe69⤵PID:900
-
\??\c:\7vddp.exec:\7vddp.exe70⤵PID:2492
-
\??\c:\fxrllfl.exec:\fxrllfl.exe71⤵PID:1256
-
\??\c:\7pddp.exec:\7pddp.exe72⤵PID:2292
-
\??\c:\1dvdd.exec:\1dvdd.exe73⤵PID:1756
-
\??\c:\dvpvv.exec:\dvpvv.exe74⤵PID:880
-
\??\c:\a6228.exec:\a6228.exe75⤵PID:1564
-
\??\c:\2622606.exec:\2622606.exe76⤵PID:2432
-
\??\c:\8060600.exec:\8060600.exe77⤵PID:2424
-
\??\c:\3jvvd.exec:\3jvvd.exe78⤵PID:2852
-
\??\c:\8686662.exec:\8686662.exe79⤵PID:2840
-
\??\c:\m6400.exec:\m6400.exe80⤵PID:2728
-
\??\c:\02822.exec:\02822.exe81⤵PID:2576
-
\??\c:\e84044.exec:\e84044.exe82⤵PID:1684
-
\??\c:\s8068.exec:\s8068.exe83⤵PID:2736
-
\??\c:\xlrlrlr.exec:\xlrlrlr.exe84⤵PID:2564
-
\??\c:\1pvvd.exec:\1pvvd.exe85⤵PID:492
-
\??\c:\4622266.exec:\4622266.exe86⤵PID:1908
-
\??\c:\vjvvd.exec:\vjvvd.exe87⤵PID:1420
-
\??\c:\bnthnh.exec:\bnthnh.exe88⤵PID:2036
-
\??\c:\868882.exec:\868882.exe89⤵PID:2120
-
\??\c:\nttbbn.exec:\nttbbn.exe90⤵PID:2116
-
\??\c:\9flrxxx.exec:\9flrxxx.exe91⤵PID:2824
-
\??\c:\4228444.exec:\4228444.exe92⤵PID:1656
-
\??\c:\c240004.exec:\c240004.exe93⤵PID:904
-
\??\c:\xrxxflx.exec:\xrxxflx.exe94⤵PID:316
-
\??\c:\fxlxxfx.exec:\fxlxxfx.exe95⤵PID:2944
-
\??\c:\0844000.exec:\0844000.exe96⤵PID:2940
-
\??\c:\602826.exec:\602826.exe97⤵PID:1608
-
\??\c:\pdjjj.exec:\pdjjj.exe98⤵PID:1492
-
\??\c:\864840.exec:\864840.exe99⤵PID:1864
-
\??\c:\dppjv.exec:\dppjv.exe100⤵PID:2076
-
\??\c:\bbnnhb.exec:\bbnnhb.exe101⤵PID:2396
-
\??\c:\vjpvd.exec:\vjpvd.exe102⤵PID:1556
-
\??\c:\xlflxlr.exec:\xlflxlr.exe103⤵PID:756
-
\??\c:\k02844.exec:\k02844.exe104⤵PID:2540
-
\??\c:\hbnnbb.exec:\hbnnbb.exe105⤵PID:2052
-
\??\c:\w22468.exec:\w22468.exe106⤵PID:1504
-
\??\c:\u200062.exec:\u200062.exe107⤵PID:1796
-
\??\c:\xrllflr.exec:\xrllflr.exe108⤵PID:872
-
\??\c:\2224662.exec:\2224662.exe109⤵PID:1588
-
\??\c:\602882.exec:\602882.exe110⤵PID:540
-
\??\c:\g2408.exec:\g2408.exe111⤵PID:1252
-
\??\c:\hbnhtt.exec:\hbnhtt.exe112⤵PID:1408
-
\??\c:\pdpjp.exec:\pdpjp.exe113⤵PID:2980
-
\??\c:\64684.exec:\64684.exe114⤵PID:1360
-
\??\c:\ffxlxxl.exec:\ffxlxxl.exe115⤵PID:1956
-
\??\c:\m0840.exec:\m0840.exe116⤵PID:2272
-
\??\c:\04006.exec:\04006.exe117⤵PID:2044
-
\??\c:\7dvvv.exec:\7dvvv.exe118⤵PID:2160
-
\??\c:\7vpvp.exec:\7vpvp.exe119⤵PID:2848
-
\??\c:\vjjdd.exec:\vjjdd.exe120⤵PID:3004
-
\??\c:\tntbnn.exec:\tntbnn.exe121⤵PID:2876
-
\??\c:\rllxffl.exec:\rllxffl.exe122⤵PID:2772
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-