Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 09:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bd7375b54596a1950f33491d803b2d40_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
bd7375b54596a1950f33491d803b2d40_NeikiAnalytics.exe
-
Size
90KB
-
MD5
bd7375b54596a1950f33491d803b2d40
-
SHA1
cdedb96014950d6bbfd7fd5f66d5f32ffcb4109a
-
SHA256
e547f5cdd3d2a6144bfb6642eb85678baf8b781eea47863715e72e8694ef219e
-
SHA512
2a9589639a91a25f85e36b6bdd40b913352f52c09dd8044cef5297ac77ff332505f9783815c5888dccb0d870e83d2f0bbbeaa3881a6394df559ba9e9c542a9a9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDodtzac0Hobv0byLufTJfJV1:ymb3NkkiQ3mdBjFodt27HobvcyLufNfp
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral1/memory/912-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2140-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2868-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-67-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/884-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1704-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1288-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2276-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1928-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2064-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1300-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2140 vjvvd.exe 2868 ttbhhh.exe 2564 7pdjj.exe 2616 rrrllll.exe 2496 tntnnb.exe 2648 5pvdd.exe 2480 1frrflx.exe 2992 5xxxflx.exe 2200 dpppd.exe 2792 jjdjd.exe 2996 fxrlllr.exe 884 fxfrflx.exe 2656 5hbhtt.exe 1704 bbtbnt.exe 2668 7jvpj.exe 2780 fxxlxlr.exe 2556 7xrrlrx.exe 1288 1tnbtn.exe 2036 ttbhth.exe 2276 ppddj.exe 1928 rrflrfl.exe 488 7nnbnt.exe 1648 thnttt.exe 2064 jdpjj.exe 2012 xxrlxxl.exe 1300 7xxxlxl.exe 1076 nbtttt.exe 2540 jdppv.exe 2220 1xrrxfl.exe 2776 5llllxf.exe 1824 bbbhnt.exe 1712 nbbbnt.exe 1400 djppd.exe 2116 xlllllx.exe 2884 xrlrlrl.exe 2684 tthhhh.exe 2584 1nbtbt.exe 2576 jdpvv.exe 2844 xfxrxff.exe 2744 ffxfxlx.exe 2492 1bhbht.exe 2580 bthnbb.exe 3008 pppjd.exe 2836 vjvdd.exe 2476 1lflfff.exe 2816 htthtt.exe 1732 dddpj.exe 1656 rflflxl.exe 1608 xxlxrrf.exe 1680 3hbtht.exe 2520 pvpvv.exe 1576 pddvp.exe 1860 lrlfffr.exe 1528 lfffffl.exe 2316 1tntbn.exe 1812 tnhntb.exe 2444 vdvvv.exe 2440 xlrlfff.exe 2164 thttbh.exe 1016 thnnhh.exe 324 jvppv.exe 584 jjjdv.exe 1828 3ffxffl.exe 1108 htbbhh.exe -
resource yara_rule behavioral1/memory/912-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/884-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1704-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1288-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2276-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1928-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1300-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-289-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 912 wrote to memory of 2140 912 bd7375b54596a1950f33491d803b2d40_NeikiAnalytics.exe 28 PID 912 wrote to memory of 2140 912 bd7375b54596a1950f33491d803b2d40_NeikiAnalytics.exe 28 PID 912 wrote to memory of 2140 912 bd7375b54596a1950f33491d803b2d40_NeikiAnalytics.exe 28 PID 912 wrote to memory of 2140 912 bd7375b54596a1950f33491d803b2d40_NeikiAnalytics.exe 28 PID 2140 wrote to memory of 2868 2140 vjvvd.exe 29 PID 2140 wrote to memory of 2868 2140 vjvvd.exe 29 PID 2140 wrote to memory of 2868 2140 vjvvd.exe 29 PID 2140 wrote to memory of 2868 2140 vjvvd.exe 29 PID 2868 wrote to memory of 2564 2868 ttbhhh.exe 30 PID 2868 wrote to memory of 2564 2868 ttbhhh.exe 30 PID 2868 wrote to memory of 2564 2868 ttbhhh.exe 30 PID 2868 wrote to memory of 2564 2868 ttbhhh.exe 30 PID 2564 wrote to memory of 2616 2564 7pdjj.exe 31 PID 2564 wrote to memory of 2616 2564 7pdjj.exe 31 PID 2564 wrote to memory of 2616 2564 7pdjj.exe 31 PID 2564 wrote to memory of 2616 2564 7pdjj.exe 31 PID 2616 wrote to memory of 2496 2616 rrrllll.exe 32 PID 2616 wrote to memory of 2496 2616 rrrllll.exe 32 PID 2616 wrote to memory of 2496 2616 rrrllll.exe 32 PID 2616 wrote to memory of 2496 2616 rrrllll.exe 32 PID 2496 wrote to memory of 2648 2496 tntnnb.exe 33 PID 2496 wrote to memory of 2648 2496 tntnnb.exe 33 PID 2496 wrote to memory of 2648 2496 tntnnb.exe 33 PID 2496 wrote to memory of 2648 2496 tntnnb.exe 33 PID 2648 wrote to memory of 2480 2648 5pvdd.exe 34 PID 2648 wrote to memory of 2480 2648 5pvdd.exe 34 PID 2648 wrote to memory of 2480 2648 5pvdd.exe 34 PID 2648 wrote to memory of 2480 2648 5pvdd.exe 34 PID 2480 wrote to memory of 2992 2480 1frrflx.exe 35 PID 2480 wrote to memory of 2992 2480 1frrflx.exe 35 PID 2480 wrote to memory of 2992 2480 1frrflx.exe 35 PID 2480 wrote to memory of 2992 2480 1frrflx.exe 35 PID 2992 wrote to memory of 2200 2992 5xxxflx.exe 36 PID 2992 wrote to memory of 2200 2992 5xxxflx.exe 36 PID 2992 wrote to memory of 2200 2992 5xxxflx.exe 36 PID 2992 wrote to memory of 2200 2992 5xxxflx.exe 36 PID 2200 wrote to memory of 2792 2200 dpppd.exe 37 PID 2200 wrote to memory of 2792 2200 dpppd.exe 37 PID 2200 wrote to memory of 2792 2200 dpppd.exe 37 PID 2200 wrote to memory of 2792 2200 dpppd.exe 37 PID 2792 wrote to memory of 2996 2792 jjdjd.exe 38 PID 2792 wrote to memory of 2996 2792 jjdjd.exe 38 PID 2792 wrote to memory of 2996 2792 jjdjd.exe 38 PID 2792 wrote to memory of 2996 2792 jjdjd.exe 38 PID 2996 wrote to memory of 884 2996 fxrlllr.exe 39 PID 2996 wrote to memory of 884 2996 fxrlllr.exe 39 PID 2996 wrote to memory of 884 2996 fxrlllr.exe 39 PID 2996 wrote to memory of 884 2996 fxrlllr.exe 39 PID 884 wrote to memory of 2656 884 fxfrflx.exe 40 PID 884 wrote to memory of 2656 884 fxfrflx.exe 40 PID 884 wrote to memory of 2656 884 fxfrflx.exe 40 PID 884 wrote to memory of 2656 884 fxfrflx.exe 40 PID 2656 wrote to memory of 1704 2656 5hbhtt.exe 41 PID 2656 wrote to memory of 1704 2656 5hbhtt.exe 41 PID 2656 wrote to memory of 1704 2656 5hbhtt.exe 41 PID 2656 wrote to memory of 1704 2656 5hbhtt.exe 41 PID 1704 wrote to memory of 2668 1704 bbtbnt.exe 42 PID 1704 wrote to memory of 2668 1704 bbtbnt.exe 42 PID 1704 wrote to memory of 2668 1704 bbtbnt.exe 42 PID 1704 wrote to memory of 2668 1704 bbtbnt.exe 42 PID 2668 wrote to memory of 2780 2668 7jvpj.exe 43 PID 2668 wrote to memory of 2780 2668 7jvpj.exe 43 PID 2668 wrote to memory of 2780 2668 7jvpj.exe 43 PID 2668 wrote to memory of 2780 2668 7jvpj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd7375b54596a1950f33491d803b2d40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\bd7375b54596a1950f33491d803b2d40_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\vjvvd.exec:\vjvvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\ttbhhh.exec:\ttbhhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\7pdjj.exec:\7pdjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\rrrllll.exec:\rrrllll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\tntnnb.exec:\tntnnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\5pvdd.exec:\5pvdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\1frrflx.exec:\1frrflx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\5xxxflx.exec:\5xxxflx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\dpppd.exec:\dpppd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\jjdjd.exec:\jjdjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\fxrlllr.exec:\fxrlllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\fxfrflx.exec:\fxfrflx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\5hbhtt.exec:\5hbhtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\bbtbnt.exec:\bbtbnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\7jvpj.exec:\7jvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\fxxlxlr.exec:\fxxlxlr.exe17⤵
- Executes dropped EXE
PID:2780 -
\??\c:\7xrrlrx.exec:\7xrrlrx.exe18⤵
- Executes dropped EXE
PID:2556 -
\??\c:\1tnbtn.exec:\1tnbtn.exe19⤵
- Executes dropped EXE
PID:1288 -
\??\c:\ttbhth.exec:\ttbhth.exe20⤵
- Executes dropped EXE
PID:2036 -
\??\c:\ppddj.exec:\ppddj.exe21⤵
- Executes dropped EXE
PID:2276 -
\??\c:\rrflrfl.exec:\rrflrfl.exe22⤵
- Executes dropped EXE
PID:1928 -
\??\c:\7nnbnt.exec:\7nnbnt.exe23⤵
- Executes dropped EXE
PID:488 -
\??\c:\thnttt.exec:\thnttt.exe24⤵
- Executes dropped EXE
PID:1648 -
\??\c:\jdpjj.exec:\jdpjj.exe25⤵
- Executes dropped EXE
PID:2064 -
\??\c:\xxrlxxl.exec:\xxrlxxl.exe26⤵
- Executes dropped EXE
PID:2012 -
\??\c:\7xxxlxl.exec:\7xxxlxl.exe27⤵
- Executes dropped EXE
PID:1300 -
\??\c:\nbtttt.exec:\nbtttt.exe28⤵
- Executes dropped EXE
PID:1076 -
\??\c:\jdppv.exec:\jdppv.exe29⤵
- Executes dropped EXE
PID:2540 -
\??\c:\1xrrxfl.exec:\1xrrxfl.exe30⤵
- Executes dropped EXE
PID:2220 -
\??\c:\5llllxf.exec:\5llllxf.exe31⤵
- Executes dropped EXE
PID:2776 -
\??\c:\bbbhnt.exec:\bbbhnt.exe32⤵
- Executes dropped EXE
PID:1824 -
\??\c:\nbbbnt.exec:\nbbbnt.exe33⤵
- Executes dropped EXE
PID:1712 -
\??\c:\djppd.exec:\djppd.exe34⤵
- Executes dropped EXE
PID:1400 -
\??\c:\xlllllx.exec:\xlllllx.exe35⤵
- Executes dropped EXE
PID:2116 -
\??\c:\xrlrlrl.exec:\xrlrlrl.exe36⤵
- Executes dropped EXE
PID:2884 -
\??\c:\tthhhh.exec:\tthhhh.exe37⤵
- Executes dropped EXE
PID:2684 -
\??\c:\1nbtbt.exec:\1nbtbt.exe38⤵
- Executes dropped EXE
PID:2584 -
\??\c:\jdpvv.exec:\jdpvv.exe39⤵
- Executes dropped EXE
PID:2576 -
\??\c:\xfxrxff.exec:\xfxrxff.exe40⤵
- Executes dropped EXE
PID:2844 -
\??\c:\ffxfxlx.exec:\ffxfxlx.exe41⤵
- Executes dropped EXE
PID:2744 -
\??\c:\1bhbht.exec:\1bhbht.exe42⤵
- Executes dropped EXE
PID:2492 -
\??\c:\bthnbb.exec:\bthnbb.exe43⤵
- Executes dropped EXE
PID:2580 -
\??\c:\pppjd.exec:\pppjd.exe44⤵
- Executes dropped EXE
PID:3008 -
\??\c:\vjvdd.exec:\vjvdd.exe45⤵
- Executes dropped EXE
PID:2836 -
\??\c:\1lflfff.exec:\1lflfff.exe46⤵
- Executes dropped EXE
PID:2476 -
\??\c:\htthtt.exec:\htthtt.exe47⤵
- Executes dropped EXE
PID:2816 -
\??\c:\dddpj.exec:\dddpj.exe48⤵
- Executes dropped EXE
PID:1732 -
\??\c:\rflflxl.exec:\rflflxl.exe49⤵
- Executes dropped EXE
PID:1656 -
\??\c:\xxlxrrf.exec:\xxlxrrf.exe50⤵
- Executes dropped EXE
PID:1608 -
\??\c:\3hbtht.exec:\3hbtht.exe51⤵
- Executes dropped EXE
PID:1680 -
\??\c:\pvpvv.exec:\pvpvv.exe52⤵
- Executes dropped EXE
PID:2520 -
\??\c:\pddvp.exec:\pddvp.exe53⤵
- Executes dropped EXE
PID:1576 -
\??\c:\lrlfffr.exec:\lrlfffr.exe54⤵
- Executes dropped EXE
PID:1860 -
\??\c:\lfffffl.exec:\lfffffl.exe55⤵
- Executes dropped EXE
PID:1528 -
\??\c:\1tntbn.exec:\1tntbn.exe56⤵
- Executes dropped EXE
PID:2316 -
\??\c:\tnhntb.exec:\tnhntb.exe57⤵
- Executes dropped EXE
PID:1812 -
\??\c:\vdvvv.exec:\vdvvv.exe58⤵
- Executes dropped EXE
PID:2444 -
\??\c:\xlrlfff.exec:\xlrlfff.exe59⤵
- Executes dropped EXE
PID:2440 -
\??\c:\thttbh.exec:\thttbh.exe60⤵
- Executes dropped EXE
PID:2164 -
\??\c:\thnnhh.exec:\thnnhh.exe61⤵
- Executes dropped EXE
PID:1016 -
\??\c:\jvppv.exec:\jvppv.exe62⤵
- Executes dropped EXE
PID:324 -
\??\c:\jjjdv.exec:\jjjdv.exe63⤵
- Executes dropped EXE
PID:584 -
\??\c:\3ffxffl.exec:\3ffxffl.exe64⤵
- Executes dropped EXE
PID:1828 -
\??\c:\htbbhh.exec:\htbbhh.exe65⤵
- Executes dropped EXE
PID:1108 -
\??\c:\dvjjp.exec:\dvjjp.exe66⤵PID:2924
-
\??\c:\3djdp.exec:\3djdp.exe67⤵PID:1840
-
\??\c:\1frxllr.exec:\1frxllr.exe68⤵PID:956
-
\??\c:\flrllfl.exec:\flrllfl.exe69⤵PID:2916
-
\??\c:\bttbnb.exec:\bttbnb.exe70⤵PID:2540
-
\??\c:\pjdjj.exec:\pjdjj.exe71⤵PID:624
-
\??\c:\xxrrxxf.exec:\xxrrxxf.exe72⤵PID:2252
-
\??\c:\rrxxrxx.exec:\rrxxrxx.exe73⤵PID:2920
-
\??\c:\nttnhn.exec:\nttnhn.exe74⤵PID:1112
-
\??\c:\3nbbnb.exec:\3nbbnb.exe75⤵PID:1260
-
\??\c:\9vvvv.exec:\9vvvv.exe76⤵PID:2108
-
\??\c:\dvppv.exec:\dvppv.exe77⤵PID:3036
-
\??\c:\rlxrfff.exec:\rlxrfff.exe78⤵PID:2288
-
\??\c:\ttnbnn.exec:\ttnbnn.exe79⤵PID:2468
-
\??\c:\nhhnnt.exec:\nhhnnt.exe80⤵PID:2756
-
\??\c:\ttbnhh.exec:\ttbnhh.exe81⤵PID:2620
-
\??\c:\jjvjp.exec:\jjvjp.exe82⤵PID:2632
-
\??\c:\jdppd.exec:\jdppd.exe83⤵PID:2732
-
\??\c:\llxfxlx.exec:\llxfxlx.exe84⤵PID:2512
-
\??\c:\xxxrlxx.exec:\xxxrlxx.exe85⤵PID:2092
-
\??\c:\5tnnht.exec:\5tnnht.exe86⤵PID:2536
-
\??\c:\nntnbb.exec:\nntnbb.exe87⤵PID:2840
-
\??\c:\1vdvv.exec:\1vdvv.exe88⤵PID:2832
-
\??\c:\3fffrxr.exec:\3fffrxr.exe89⤵PID:2700
-
\??\c:\1frrlxr.exec:\1frrlxr.exe90⤵PID:1972
-
\??\c:\bbhhnb.exec:\bbhhnb.exe91⤵PID:884
-
\??\c:\hhbhnt.exec:\hhbhnt.exe92⤵PID:1952
-
\??\c:\ddppd.exec:\ddppd.exe93⤵PID:936
-
\??\c:\vdjjv.exec:\vdjjv.exe94⤵PID:304
-
\??\c:\rfrlxxr.exec:\rfrlxxr.exe95⤵PID:776
-
\??\c:\1flffxx.exec:\1flffxx.exe96⤵PID:824
-
\??\c:\thnhbt.exec:\thnhbt.exe97⤵PID:2556
-
\??\c:\vdpvp.exec:\vdpvp.exe98⤵PID:1532
-
\??\c:\vvvdd.exec:\vvvdd.exe99⤵PID:2052
-
\??\c:\3fflflf.exec:\3fflflf.exe100⤵PID:2892
-
\??\c:\lfrrfrf.exec:\lfrrfrf.exe101⤵PID:540
-
\??\c:\hbnbhb.exec:\hbnbhb.exe102⤵PID:2276
-
\??\c:\nhbtbn.exec:\nhbtbn.exe103⤵PID:1488
-
\??\c:\jjpdp.exec:\jjpdp.exe104⤵PID:968
-
\??\c:\dvpvp.exec:\dvpvp.exe105⤵PID:3056
-
\??\c:\lfxrffx.exec:\lfxrffx.exe106⤵PID:1152
-
\??\c:\hnhhnh.exec:\hnhhnh.exe107⤵PID:2136
-
\??\c:\btnthb.exec:\btnthb.exe108⤵PID:2924
-
\??\c:\dpvjj.exec:\dpvjj.exe109⤵PID:2044
-
\??\c:\9bnnhn.exec:\9bnnhn.exe110⤵PID:2396
-
\??\c:\thnbbt.exec:\thnbbt.exe111⤵PID:2168
-
\??\c:\pjpdp.exec:\pjpdp.exe112⤵PID:2220
-
\??\c:\xrrllrl.exec:\xrrllrl.exe113⤵PID:2776
-
\??\c:\xrlrflx.exec:\xrlrflx.exe114⤵PID:2068
-
\??\c:\bbthbb.exec:\bbthbb.exe115⤵PID:2088
-
\??\c:\3bttbb.exec:\3bttbb.exe116⤵PID:1112
-
\??\c:\dpvvd.exec:\dpvvd.exe117⤵PID:1716
-
\??\c:\5vvdj.exec:\5vvdj.exe118⤵PID:2116
-
\??\c:\rxxlrrf.exec:\rxxlrrf.exe119⤵PID:1948
-
\??\c:\ththnn.exec:\ththnn.exe120⤵PID:2884
-
\??\c:\3bnnnt.exec:\3bnnnt.exe121⤵PID:2608
-
\??\c:\1vpvv.exec:\1vpvv.exe122⤵PID:2756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-