Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13-05-2024 10:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b168380e33e36cda7361e54740876ce0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
b168380e33e36cda7361e54740876ce0_NeikiAnalytics.exe
-
Size
55KB
-
MD5
b168380e33e36cda7361e54740876ce0
-
SHA1
f0912a4c554ca25f6b26195e2647f0795d2a218d
-
SHA256
c8474e22b4805c873f3eefb3ba8665c668bf76920e04448c6f4ccccd6931a3db
-
SHA512
5e4d6d76abe558b12be4101d1e990008aa87fa2081b727c4b57e14a32ff3466edd5765d09c0f1739c2538db91becbb793c00c9944f36b74750aa5b49afd981f8
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0chVnY:ymb3NkkiQ3mdBjF0crY
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/1672-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1924-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1468-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1468-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1360-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2548-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2908-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2932-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2448-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3712-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/920-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3236-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2736-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/548-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2936-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4888-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2620-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/372-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1984-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2040-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1924 ppppp.exe 2548 nnhhhb.exe 1468 hbbbhh.exe 3000 3djjj.exe 1360 lfrlxxr.exe 388 fflfffx.exe 2908 9jdpd.exe 4792 jppdd.exe 2932 rlrrfff.exe 2448 hnnnhh.exe 1668 5jjdv.exe 4628 flllfff.exe 4064 ffrrlff.exe 3712 thnnnn.exe 920 pdvjp.exe 3236 lfffxxr.exe 2736 bbhnhh.exe 548 5jdvv.exe 2936 rllxlfl.exe 4564 nhtnht.exe 4888 1bhbbh.exe 2620 jvvpj.exe 1656 7flfxff.exe 372 btnhbb.exe 3536 5xrfrxr.exe 1012 nbnntn.exe 396 bthbtt.exe 1984 dvvpj.exe 4864 xxlflfx.exe 2040 llllfff.exe 4120 3bbhbb.exe 2984 9jjdd.exe 3448 jvvpj.exe 4764 1flfxff.exe 4768 rlrrrxx.exe 4288 ttbnhh.exe 3096 tntnhh.exe 1672 jjppj.exe 3416 lxxrlfx.exe 3196 frxlfxr.exe 1868 hbbnhh.exe 2016 3nbbbn.exe 2988 jjddj.exe 4948 xxxxrxr.exe 2120 fxfrxxl.exe 4560 tntthh.exe 424 1nhhbb.exe 3256 5jvpj.exe 1236 3vddd.exe 2836 fxxrllf.exe 2368 hnnnnn.exe 3176 9hhbtt.exe 2192 pdjpj.exe 2260 djdjd.exe 4024 flrrxfr.exe 4208 lffxxxr.exe 3224 3bnhbn.exe 1668 thhhtt.exe 4892 7dddv.exe 1376 jvjjp.exe 2104 fxllfll.exe 3700 9hhnnt.exe 1596 9bhhhn.exe 1904 3dppj.exe -
resource yara_rule behavioral2/memory/1672-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1672-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1468-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1468-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1468-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1468-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/388-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1360-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2548-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/388-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2908-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2932-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2448-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3712-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/920-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2736-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/548-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2936-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/372-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1984-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1672 wrote to memory of 1924 1672 b168380e33e36cda7361e54740876ce0_NeikiAnalytics.exe 82 PID 1672 wrote to memory of 1924 1672 b168380e33e36cda7361e54740876ce0_NeikiAnalytics.exe 82 PID 1672 wrote to memory of 1924 1672 b168380e33e36cda7361e54740876ce0_NeikiAnalytics.exe 82 PID 1924 wrote to memory of 2548 1924 ppppp.exe 83 PID 1924 wrote to memory of 2548 1924 ppppp.exe 83 PID 1924 wrote to memory of 2548 1924 ppppp.exe 83 PID 2548 wrote to memory of 1468 2548 nnhhhb.exe 84 PID 2548 wrote to memory of 1468 2548 nnhhhb.exe 84 PID 2548 wrote to memory of 1468 2548 nnhhhb.exe 84 PID 1468 wrote to memory of 3000 1468 hbbbhh.exe 86 PID 1468 wrote to memory of 3000 1468 hbbbhh.exe 86 PID 1468 wrote to memory of 3000 1468 hbbbhh.exe 86 PID 3000 wrote to memory of 1360 3000 3djjj.exe 87 PID 3000 wrote to memory of 1360 3000 3djjj.exe 87 PID 3000 wrote to memory of 1360 3000 3djjj.exe 87 PID 1360 wrote to memory of 388 1360 lfrlxxr.exe 88 PID 1360 wrote to memory of 388 1360 lfrlxxr.exe 88 PID 1360 wrote to memory of 388 1360 lfrlxxr.exe 88 PID 388 wrote to memory of 2908 388 fflfffx.exe 89 PID 388 wrote to memory of 2908 388 fflfffx.exe 89 PID 388 wrote to memory of 2908 388 fflfffx.exe 89 PID 2908 wrote to memory of 4792 2908 9jdpd.exe 90 PID 2908 wrote to memory of 4792 2908 9jdpd.exe 90 PID 2908 wrote to memory of 4792 2908 9jdpd.exe 90 PID 4792 wrote to memory of 2932 4792 jppdd.exe 91 PID 4792 wrote to memory of 2932 4792 jppdd.exe 91 PID 4792 wrote to memory of 2932 4792 jppdd.exe 91 PID 2932 wrote to memory of 2448 2932 rlrrfff.exe 93 PID 2932 wrote to memory of 2448 2932 rlrrfff.exe 93 PID 2932 wrote to memory of 2448 2932 rlrrfff.exe 93 PID 2448 wrote to memory of 1668 2448 hnnnhh.exe 94 PID 2448 wrote to memory of 1668 2448 hnnnhh.exe 94 PID 2448 wrote to memory of 1668 2448 hnnnhh.exe 94 PID 1668 wrote to memory of 4628 1668 5jjdv.exe 95 PID 1668 wrote to memory of 4628 1668 5jjdv.exe 95 PID 1668 wrote to memory of 4628 1668 5jjdv.exe 95 PID 4628 wrote to memory of 4064 4628 flllfff.exe 96 PID 4628 wrote to memory of 4064 4628 flllfff.exe 96 PID 4628 wrote to memory of 4064 4628 flllfff.exe 96 PID 4064 wrote to memory of 3712 4064 ffrrlff.exe 97 PID 4064 wrote to memory of 3712 4064 ffrrlff.exe 97 PID 4064 wrote to memory of 3712 4064 ffrrlff.exe 97 PID 3712 wrote to memory of 920 3712 thnnnn.exe 98 PID 3712 wrote to memory of 920 3712 thnnnn.exe 98 PID 3712 wrote to memory of 920 3712 thnnnn.exe 98 PID 920 wrote to memory of 3236 920 pdvjp.exe 99 PID 920 wrote to memory of 3236 920 pdvjp.exe 99 PID 920 wrote to memory of 3236 920 pdvjp.exe 99 PID 3236 wrote to memory of 2736 3236 lfffxxr.exe 100 PID 3236 wrote to memory of 2736 3236 lfffxxr.exe 100 PID 3236 wrote to memory of 2736 3236 lfffxxr.exe 100 PID 2736 wrote to memory of 548 2736 bbhnhh.exe 101 PID 2736 wrote to memory of 548 2736 bbhnhh.exe 101 PID 2736 wrote to memory of 548 2736 bbhnhh.exe 101 PID 548 wrote to memory of 2936 548 5jdvv.exe 102 PID 548 wrote to memory of 2936 548 5jdvv.exe 102 PID 548 wrote to memory of 2936 548 5jdvv.exe 102 PID 2936 wrote to memory of 4564 2936 rllxlfl.exe 103 PID 2936 wrote to memory of 4564 2936 rllxlfl.exe 103 PID 2936 wrote to memory of 4564 2936 rllxlfl.exe 103 PID 4564 wrote to memory of 4888 4564 nhtnht.exe 105 PID 4564 wrote to memory of 4888 4564 nhtnht.exe 105 PID 4564 wrote to memory of 4888 4564 nhtnht.exe 105 PID 4888 wrote to memory of 2620 4888 1bhbbh.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\b168380e33e36cda7361e54740876ce0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b168380e33e36cda7361e54740876ce0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\ppppp.exec:\ppppp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\nnhhhb.exec:\nnhhhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\hbbbhh.exec:\hbbbhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\3djjj.exec:\3djjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\lfrlxxr.exec:\lfrlxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\fflfffx.exec:\fflfffx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\9jdpd.exec:\9jdpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\jppdd.exec:\jppdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\rlrrfff.exec:\rlrrfff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\hnnnhh.exec:\hnnnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\5jjdv.exec:\5jjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\flllfff.exec:\flllfff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\ffrrlff.exec:\ffrrlff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\thnnnn.exec:\thnnnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\pdvjp.exec:\pdvjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\lfffxxr.exec:\lfffxxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\bbhnhh.exec:\bbhnhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\5jdvv.exec:\5jdvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\rllxlfl.exec:\rllxlfl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\nhtnht.exec:\nhtnht.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\1bhbbh.exec:\1bhbbh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\jvvpj.exec:\jvvpj.exe23⤵
- Executes dropped EXE
PID:2620 -
\??\c:\7flfxff.exec:\7flfxff.exe24⤵
- Executes dropped EXE
PID:1656 -
\??\c:\btnhbb.exec:\btnhbb.exe25⤵
- Executes dropped EXE
PID:372 -
\??\c:\5xrfrxr.exec:\5xrfrxr.exe26⤵
- Executes dropped EXE
PID:3536 -
\??\c:\nbnntn.exec:\nbnntn.exe27⤵
- Executes dropped EXE
PID:1012 -
\??\c:\bthbtt.exec:\bthbtt.exe28⤵
- Executes dropped EXE
PID:396 -
\??\c:\dvvpj.exec:\dvvpj.exe29⤵
- Executes dropped EXE
PID:1984 -
\??\c:\xxlflfx.exec:\xxlflfx.exe30⤵
- Executes dropped EXE
PID:4864 -
\??\c:\llllfff.exec:\llllfff.exe31⤵
- Executes dropped EXE
PID:2040 -
\??\c:\3bbhbb.exec:\3bbhbb.exe32⤵
- Executes dropped EXE
PID:4120 -
\??\c:\9jjdd.exec:\9jjdd.exe33⤵
- Executes dropped EXE
PID:2984 -
\??\c:\jvvpj.exec:\jvvpj.exe34⤵
- Executes dropped EXE
PID:3448 -
\??\c:\1flfxff.exec:\1flfxff.exe35⤵
- Executes dropped EXE
PID:4764 -
\??\c:\rlrrrxx.exec:\rlrrrxx.exe36⤵
- Executes dropped EXE
PID:4768 -
\??\c:\ttbnhh.exec:\ttbnhh.exe37⤵
- Executes dropped EXE
PID:4288 -
\??\c:\tntnhh.exec:\tntnhh.exe38⤵
- Executes dropped EXE
PID:3096 -
\??\c:\jjppj.exec:\jjppj.exe39⤵
- Executes dropped EXE
PID:1672 -
\??\c:\lxxrlfx.exec:\lxxrlfx.exe40⤵
- Executes dropped EXE
PID:3416 -
\??\c:\frxlfxr.exec:\frxlfxr.exe41⤵
- Executes dropped EXE
PID:3196 -
\??\c:\hbbnhh.exec:\hbbnhh.exe42⤵
- Executes dropped EXE
PID:1868 -
\??\c:\3nbbbn.exec:\3nbbbn.exe43⤵
- Executes dropped EXE
PID:2016 -
\??\c:\jjddj.exec:\jjddj.exe44⤵
- Executes dropped EXE
PID:2988 -
\??\c:\xxxxrxr.exec:\xxxxrxr.exe45⤵
- Executes dropped EXE
PID:4948 -
\??\c:\fxfrxxl.exec:\fxfrxxl.exe46⤵
- Executes dropped EXE
PID:2120 -
\??\c:\tntthh.exec:\tntthh.exe47⤵
- Executes dropped EXE
PID:4560 -
\??\c:\1nhhbb.exec:\1nhhbb.exe48⤵
- Executes dropped EXE
PID:424 -
\??\c:\5jvpj.exec:\5jvpj.exe49⤵
- Executes dropped EXE
PID:3256 -
\??\c:\3vddd.exec:\3vddd.exe50⤵
- Executes dropped EXE
PID:1236 -
\??\c:\fxxrllf.exec:\fxxrllf.exe51⤵
- Executes dropped EXE
PID:2836 -
\??\c:\hnnnnn.exec:\hnnnnn.exe52⤵
- Executes dropped EXE
PID:2368 -
\??\c:\9hhbtt.exec:\9hhbtt.exe53⤵
- Executes dropped EXE
PID:3176 -
\??\c:\pdjpj.exec:\pdjpj.exe54⤵
- Executes dropped EXE
PID:2192 -
\??\c:\djdjd.exec:\djdjd.exe55⤵
- Executes dropped EXE
PID:2260 -
\??\c:\flrrxfr.exec:\flrrxfr.exe56⤵
- Executes dropped EXE
PID:4024 -
\??\c:\lffxxxr.exec:\lffxxxr.exe57⤵
- Executes dropped EXE
PID:4208 -
\??\c:\3bnhbn.exec:\3bnhbn.exe58⤵
- Executes dropped EXE
PID:3224 -
\??\c:\thhhtt.exec:\thhhtt.exe59⤵
- Executes dropped EXE
PID:1668 -
\??\c:\7dddv.exec:\7dddv.exe60⤵
- Executes dropped EXE
PID:4892 -
\??\c:\jvjjp.exec:\jvjjp.exe61⤵
- Executes dropped EXE
PID:1376 -
\??\c:\fxllfll.exec:\fxllfll.exe62⤵
- Executes dropped EXE
PID:2104 -
\??\c:\9hhnnt.exec:\9hhnnt.exe63⤵
- Executes dropped EXE
PID:3700 -
\??\c:\9bhhhn.exec:\9bhhhn.exe64⤵
- Executes dropped EXE
PID:1596 -
\??\c:\3dppj.exec:\3dppj.exe65⤵
- Executes dropped EXE
PID:1904 -
\??\c:\vvdjj.exec:\vvdjj.exe66⤵PID:2216
-
\??\c:\frlfllr.exec:\frlfllr.exe67⤵PID:4412
-
\??\c:\xxllrxx.exec:\xxllrxx.exe68⤵PID:1832
-
\??\c:\hbhbbb.exec:\hbhbbb.exe69⤵PID:5088
-
\??\c:\ddjjv.exec:\ddjjv.exe70⤵PID:616
-
\??\c:\jpppj.exec:\jpppj.exe71⤵PID:4648
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe72⤵PID:3608
-
\??\c:\1fflllf.exec:\1fflllf.exe73⤵PID:1616
-
\??\c:\ntbhnn.exec:\ntbhnn.exe74⤵PID:1464
-
\??\c:\tnttbb.exec:\tnttbb.exe75⤵PID:4972
-
\??\c:\pvpdv.exec:\pvpdv.exe76⤵PID:2740
-
\??\c:\pjppp.exec:\pjppp.exe77⤵PID:2916
-
\??\c:\llllfll.exec:\llllfll.exe78⤵PID:4916
-
\??\c:\nnnbbh.exec:\nnnbbh.exe79⤵PID:1476
-
\??\c:\jdpjv.exec:\jdpjv.exe80⤵PID:396
-
\??\c:\xlrllll.exec:\xlrllll.exe81⤵PID:4708
-
\??\c:\lflffff.exec:\lflffff.exe82⤵PID:4012
-
\??\c:\bbntbn.exec:\bbntbn.exe83⤵PID:368
-
\??\c:\3dddv.exec:\3dddv.exe84⤵PID:384
-
\??\c:\lfrllll.exec:\lfrllll.exe85⤵PID:4380
-
\??\c:\fxlrrxf.exec:\fxlrrxf.exe86⤵PID:5036
-
\??\c:\tthhth.exec:\tthhth.exe87⤵PID:848
-
\??\c:\hnbhth.exec:\hnbhth.exe88⤵PID:4108
-
\??\c:\jvddv.exec:\jvddv.exe89⤵PID:4468
-
\??\c:\rrxlffl.exec:\rrxlffl.exe90⤵PID:2716
-
\??\c:\hnhbtb.exec:\hnhbtb.exe91⤵PID:2212
-
\??\c:\7ddvj.exec:\7ddvj.exe92⤵PID:3328
-
\??\c:\bbnthh.exec:\bbnthh.exe93⤵PID:4700
-
\??\c:\hhbthh.exec:\hhbthh.exe94⤵PID:2328
-
\??\c:\vpppj.exec:\vpppj.exe95⤵PID:5064
-
\??\c:\9rfxrrf.exec:\9rfxrrf.exe96⤵PID:976
-
\??\c:\hhbnnn.exec:\hhbnnn.exe97⤵PID:2120
-
\??\c:\jdvpv.exec:\jdvpv.exe98⤵PID:4560
-
\??\c:\rlfxrlf.exec:\rlfxrlf.exe99⤵PID:424
-
\??\c:\hbbhth.exec:\hbbhth.exe100⤵PID:1252
-
\??\c:\vvdvd.exec:\vvdvd.exe101⤵PID:4900
-
\??\c:\nhhtnn.exec:\nhhtnn.exe102⤵PID:3216
-
\??\c:\1ntnhh.exec:\1ntnhh.exe103⤵PID:2864
-
\??\c:\pvdvp.exec:\pvdvp.exe104⤵PID:4008
-
\??\c:\jdpvp.exec:\jdpvp.exe105⤵PID:2932
-
\??\c:\rrxrxll.exec:\rrxrxll.exe106⤵PID:2200
-
\??\c:\bnhbtb.exec:\bnhbtb.exe107⤵PID:4500
-
\??\c:\ttbtnn.exec:\ttbtnn.exe108⤵PID:2092
-
\??\c:\jppjd.exec:\jppjd.exe109⤵PID:1668
-
\??\c:\7rlfxfx.exec:\7rlfxfx.exe110⤵PID:1504
-
\??\c:\rllfffx.exec:\rllfffx.exe111⤵PID:528
-
\??\c:\bbhbnn.exec:\bbhbnn.exe112⤵PID:776
-
\??\c:\lxfffff.exec:\lxfffff.exe113⤵PID:3440
-
\??\c:\lfllffx.exec:\lfllffx.exe114⤵PID:4760
-
\??\c:\jvjpj.exec:\jvjpj.exe115⤵PID:2736
-
\??\c:\xlfffff.exec:\xlfffff.exe116⤵PID:3572
-
\??\c:\1bhbhh.exec:\1bhbhh.exe117⤵PID:3964
-
\??\c:\rrffflf.exec:\rrffflf.exe118⤵PID:2184
-
\??\c:\5ttttt.exec:\5ttttt.exe119⤵PID:4564
-
\??\c:\ppdvj.exec:\ppdvj.exe120⤵PID:4084
-
\??\c:\ppvdj.exec:\ppvdj.exe121⤵PID:3264
-
\??\c:\xxrxlrf.exec:\xxrxlrf.exe122⤵PID:2028
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-