Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14-05-2024 19:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1962c2d255ddda41f20c413cdcbe4110_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
1962c2d255ddda41f20c413cdcbe4110_NeikiAnalytics.exe
-
Size
55KB
-
MD5
1962c2d255ddda41f20c413cdcbe4110
-
SHA1
b23ff4331c1051ce6405cac6df102bf41b5f80e3
-
SHA256
ef9db928876eb3d34dd614934c87cebb26b0302bcf332ed21c34fe6a68be0764
-
SHA512
45c1477e07f8bf56f0c72ae38bb590d125e435e660e1dc6d15c485e124309cbbb4a14bfbfd3e8ac26cfddc1492a326e12634277ad1005ff0016c2d1d697398d1
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFes:ymb3NkkiQ3mdBjFIFes
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/1612-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4408-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3100-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3312-30-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3312-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2044-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4788-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2580-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3412-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2740-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3532-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4376-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/368-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2248-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1576-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2704-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4044-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3496-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2276-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4408 ddjjj.exe 3100 xxxlffx.exe 3312 bbnhhh.exe 2044 vdvvv.exe 3984 rlflfrr.exe 4788 rrrrrxf.exe 2580 bhhntb.exe 3412 ddvvd.exe 4688 xrrlfll.exe 3240 xrxrrxx.exe 3776 1nhhhh.exe 3280 dpdvv.exe 2740 flffxfx.exe 3532 rrxxrrr.exe 4376 bbhhhh.exe 368 pjjvv.exe 1360 flllllr.exe 2248 ttbbht.exe 4968 vvpvd.exe 1576 fxllrrl.exe 2704 htbnhh.exe 3036 djdjp.exe 2992 xllllrr.exe 4044 htbttn.exe 3592 htbbbb.exe 1400 ddjjj.exe 4768 lfxllll.exe 4724 hhbbbh.exe 1528 nthbtb.exe 3496 jdpjp.exe 2276 7xxlrrl.exe 1472 lllffff.exe 4804 hhnhhh.exe 3148 tbhbtb.exe 3408 jdjjv.exe 1724 jdvdj.exe 1604 ffffffl.exe 3140 lffxxxx.exe 1736 ttbhhh.exe 4624 hbbbbb.exe 1552 jvppj.exe 4808 ddvvv.exe 2096 frxrrrr.exe 1764 ffrfrrf.exe 224 7bbhhb.exe 800 btnnhh.exe 4000 vdvvp.exe 4216 dvdvv.exe 4820 ffxxflr.exe 1044 rfxxfrr.exe 380 hbbhhn.exe 4348 hbbhnn.exe 2732 jppvp.exe 3056 jdvdd.exe 2012 rrxfffl.exe 1140 flxxxfx.exe 3776 nhhhhn.exe 4380 dvjjv.exe 2548 jdpvd.exe 1840 lxllfff.exe 516 bnbhtb.exe 4168 djpvp.exe 2376 frxxrxr.exe 1384 rfrlrxl.exe -
resource yara_rule behavioral2/memory/1612-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3100-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3312-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2580-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3412-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2740-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3532-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4376-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/368-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2248-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1576-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2704-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3496-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2276-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1612 wrote to memory of 4408 1612 1962c2d255ddda41f20c413cdcbe4110_NeikiAnalytics.exe 82 PID 1612 wrote to memory of 4408 1612 1962c2d255ddda41f20c413cdcbe4110_NeikiAnalytics.exe 82 PID 1612 wrote to memory of 4408 1612 1962c2d255ddda41f20c413cdcbe4110_NeikiAnalytics.exe 82 PID 4408 wrote to memory of 3100 4408 ddjjj.exe 83 PID 4408 wrote to memory of 3100 4408 ddjjj.exe 83 PID 4408 wrote to memory of 3100 4408 ddjjj.exe 83 PID 3100 wrote to memory of 3312 3100 xxxlffx.exe 84 PID 3100 wrote to memory of 3312 3100 xxxlffx.exe 84 PID 3100 wrote to memory of 3312 3100 xxxlffx.exe 84 PID 3312 wrote to memory of 2044 3312 bbnhhh.exe 85 PID 3312 wrote to memory of 2044 3312 bbnhhh.exe 85 PID 3312 wrote to memory of 2044 3312 bbnhhh.exe 85 PID 2044 wrote to memory of 3984 2044 vdvvv.exe 86 PID 2044 wrote to memory of 3984 2044 vdvvv.exe 86 PID 2044 wrote to memory of 3984 2044 vdvvv.exe 86 PID 3984 wrote to memory of 4788 3984 rlflfrr.exe 87 PID 3984 wrote to memory of 4788 3984 rlflfrr.exe 87 PID 3984 wrote to memory of 4788 3984 rlflfrr.exe 87 PID 4788 wrote to memory of 2580 4788 rrrrrxf.exe 88 PID 4788 wrote to memory of 2580 4788 rrrrrxf.exe 88 PID 4788 wrote to memory of 2580 4788 rrrrrxf.exe 88 PID 2580 wrote to memory of 3412 2580 bhhntb.exe 89 PID 2580 wrote to memory of 3412 2580 bhhntb.exe 89 PID 2580 wrote to memory of 3412 2580 bhhntb.exe 89 PID 3412 wrote to memory of 4688 3412 ddvvd.exe 90 PID 3412 wrote to memory of 4688 3412 ddvvd.exe 90 PID 3412 wrote to memory of 4688 3412 ddvvd.exe 90 PID 4688 wrote to memory of 3240 4688 xrrlfll.exe 91 PID 4688 wrote to memory of 3240 4688 xrrlfll.exe 91 PID 4688 wrote to memory of 3240 4688 xrrlfll.exe 91 PID 3240 wrote to memory of 3776 3240 xrxrrxx.exe 93 PID 3240 wrote to memory of 3776 3240 xrxrrxx.exe 93 PID 3240 wrote to memory of 3776 3240 xrxrrxx.exe 93 PID 3776 wrote to memory of 3280 3776 1nhhhh.exe 94 PID 3776 wrote to memory of 3280 3776 1nhhhh.exe 94 PID 3776 wrote to memory of 3280 3776 1nhhhh.exe 94 PID 3280 wrote to memory of 2740 3280 dpdvv.exe 95 PID 3280 wrote to memory of 2740 3280 dpdvv.exe 95 PID 3280 wrote to memory of 2740 3280 dpdvv.exe 95 PID 2740 wrote to memory of 3532 2740 flffxfx.exe 96 PID 2740 wrote to memory of 3532 2740 flffxfx.exe 96 PID 2740 wrote to memory of 3532 2740 flffxfx.exe 96 PID 3532 wrote to memory of 4376 3532 rrxxrrr.exe 97 PID 3532 wrote to memory of 4376 3532 rrxxrrr.exe 97 PID 3532 wrote to memory of 4376 3532 rrxxrrr.exe 97 PID 4376 wrote to memory of 368 4376 bbhhhh.exe 98 PID 4376 wrote to memory of 368 4376 bbhhhh.exe 98 PID 4376 wrote to memory of 368 4376 bbhhhh.exe 98 PID 368 wrote to memory of 1360 368 pjjvv.exe 99 PID 368 wrote to memory of 1360 368 pjjvv.exe 99 PID 368 wrote to memory of 1360 368 pjjvv.exe 99 PID 1360 wrote to memory of 2248 1360 flllllr.exe 101 PID 1360 wrote to memory of 2248 1360 flllllr.exe 101 PID 1360 wrote to memory of 2248 1360 flllllr.exe 101 PID 2248 wrote to memory of 4968 2248 ttbbht.exe 102 PID 2248 wrote to memory of 4968 2248 ttbbht.exe 102 PID 2248 wrote to memory of 4968 2248 ttbbht.exe 102 PID 4968 wrote to memory of 1576 4968 vvpvd.exe 103 PID 4968 wrote to memory of 1576 4968 vvpvd.exe 103 PID 4968 wrote to memory of 1576 4968 vvpvd.exe 103 PID 1576 wrote to memory of 2704 1576 fxllrrl.exe 104 PID 1576 wrote to memory of 2704 1576 fxllrrl.exe 104 PID 1576 wrote to memory of 2704 1576 fxllrrl.exe 104 PID 2704 wrote to memory of 3036 2704 htbnhh.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\1962c2d255ddda41f20c413cdcbe4110_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1962c2d255ddda41f20c413cdcbe4110_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\ddjjj.exec:\ddjjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\xxxlffx.exec:\xxxlffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\bbnhhh.exec:\bbnhhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
\??\c:\vdvvv.exec:\vdvvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\rlflfrr.exec:\rlflfrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\rrrrrxf.exec:\rrrrrxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\bhhntb.exec:\bhhntb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\ddvvd.exec:\ddvvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\xrrlfll.exec:\xrrlfll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\xrxrrxx.exec:\xrxrrxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
\??\c:\1nhhhh.exec:\1nhhhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\dpdvv.exec:\dpdvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\flffxfx.exec:\flffxfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\rrxxrrr.exec:\rrxxrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\bbhhhh.exec:\bbhhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
\??\c:\pjjvv.exec:\pjjvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
\??\c:\flllllr.exec:\flllllr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\ttbbht.exec:\ttbbht.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\vvpvd.exec:\vvpvd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\fxllrrl.exec:\fxllrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\htbnhh.exec:\htbnhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\djdjp.exec:\djdjp.exe23⤵
- Executes dropped EXE
PID:3036 -
\??\c:\xllllrr.exec:\xllllrr.exe24⤵
- Executes dropped EXE
PID:2992 -
\??\c:\htbttn.exec:\htbttn.exe25⤵
- Executes dropped EXE
PID:4044 -
\??\c:\htbbbb.exec:\htbbbb.exe26⤵
- Executes dropped EXE
PID:3592 -
\??\c:\ddjjj.exec:\ddjjj.exe27⤵
- Executes dropped EXE
PID:1400 -
\??\c:\lfxllll.exec:\lfxllll.exe28⤵
- Executes dropped EXE
PID:4768 -
\??\c:\hhbbbh.exec:\hhbbbh.exe29⤵
- Executes dropped EXE
PID:4724 -
\??\c:\nthbtb.exec:\nthbtb.exe30⤵
- Executes dropped EXE
PID:1528 -
\??\c:\jdpjp.exec:\jdpjp.exe31⤵
- Executes dropped EXE
PID:3496 -
\??\c:\7xxlrrl.exec:\7xxlrrl.exe32⤵
- Executes dropped EXE
PID:2276 -
\??\c:\lllffff.exec:\lllffff.exe33⤵
- Executes dropped EXE
PID:1472 -
\??\c:\hhnhhh.exec:\hhnhhh.exe34⤵
- Executes dropped EXE
PID:4804 -
\??\c:\tbhbtb.exec:\tbhbtb.exe35⤵
- Executes dropped EXE
PID:3148 -
\??\c:\jdjjv.exec:\jdjjv.exe36⤵
- Executes dropped EXE
PID:3408 -
\??\c:\jdvdj.exec:\jdvdj.exe37⤵
- Executes dropped EXE
PID:1724 -
\??\c:\ffffffl.exec:\ffffffl.exe38⤵
- Executes dropped EXE
PID:1604 -
\??\c:\lffxxxx.exec:\lffxxxx.exe39⤵
- Executes dropped EXE
PID:3140 -
\??\c:\ttbhhh.exec:\ttbhhh.exe40⤵
- Executes dropped EXE
PID:1736 -
\??\c:\hbbbbb.exec:\hbbbbb.exe41⤵
- Executes dropped EXE
PID:4624 -
\??\c:\jvppj.exec:\jvppj.exe42⤵
- Executes dropped EXE
PID:1552 -
\??\c:\ddvvv.exec:\ddvvv.exe43⤵
- Executes dropped EXE
PID:4808 -
\??\c:\frxrrrr.exec:\frxrrrr.exe44⤵
- Executes dropped EXE
PID:2096 -
\??\c:\ffrfrrf.exec:\ffrfrrf.exe45⤵
- Executes dropped EXE
PID:1764 -
\??\c:\7bbhhb.exec:\7bbhhb.exe46⤵
- Executes dropped EXE
PID:224 -
\??\c:\btnnhh.exec:\btnnhh.exe47⤵
- Executes dropped EXE
PID:800 -
\??\c:\vdvvp.exec:\vdvvp.exe48⤵
- Executes dropped EXE
PID:4000 -
\??\c:\dvdvv.exec:\dvdvv.exe49⤵
- Executes dropped EXE
PID:4216 -
\??\c:\ffxxflr.exec:\ffxxflr.exe50⤵
- Executes dropped EXE
PID:4820 -
\??\c:\rfxxfrr.exec:\rfxxfrr.exe51⤵
- Executes dropped EXE
PID:1044 -
\??\c:\hbbhhn.exec:\hbbhhn.exe52⤵
- Executes dropped EXE
PID:380 -
\??\c:\hbbhnn.exec:\hbbhnn.exe53⤵
- Executes dropped EXE
PID:4348 -
\??\c:\jppvp.exec:\jppvp.exe54⤵
- Executes dropped EXE
PID:2732 -
\??\c:\jdvdd.exec:\jdvdd.exe55⤵
- Executes dropped EXE
PID:3056 -
\??\c:\rrxfffl.exec:\rrxfffl.exe56⤵
- Executes dropped EXE
PID:2012 -
\??\c:\flxxxfx.exec:\flxxxfx.exe57⤵
- Executes dropped EXE
PID:1140 -
\??\c:\nhhhhn.exec:\nhhhhn.exe58⤵
- Executes dropped EXE
PID:3776 -
\??\c:\dvjjv.exec:\dvjjv.exe59⤵
- Executes dropped EXE
PID:4380 -
\??\c:\jdpvd.exec:\jdpvd.exe60⤵
- Executes dropped EXE
PID:2548 -
\??\c:\lxllfff.exec:\lxllfff.exe61⤵
- Executes dropped EXE
PID:1840 -
\??\c:\bnbhtb.exec:\bnbhtb.exe62⤵
- Executes dropped EXE
PID:516 -
\??\c:\djpvp.exec:\djpvp.exe63⤵
- Executes dropped EXE
PID:4168 -
\??\c:\frxxrxr.exec:\frxxrxr.exe64⤵
- Executes dropped EXE
PID:2376 -
\??\c:\rfrlrxl.exec:\rfrlrxl.exe65⤵
- Executes dropped EXE
PID:1384 -
\??\c:\hbhhth.exec:\hbhhth.exe66⤵PID:5024
-
\??\c:\vvddj.exec:\vvddj.exe67⤵PID:2644
-
\??\c:\9xffrxx.exec:\9xffrxx.exe68⤵PID:4424
-
\??\c:\bntbhn.exec:\bntbhn.exe69⤵PID:3028
-
\??\c:\ddvvd.exec:\ddvvd.exe70⤵PID:4620
-
\??\c:\lrrfffx.exec:\lrrfffx.exe71⤵PID:2164
-
\??\c:\thnttb.exec:\thnttb.exe72⤵PID:3136
-
\??\c:\1nhhth.exec:\1nhhth.exe73⤵PID:964
-
\??\c:\pjjjj.exec:\pjjjj.exe74⤵PID:4728
-
\??\c:\5xllfrr.exec:\5xllfrr.exe75⤵PID:2088
-
\??\c:\9xlrfrl.exec:\9xlrfrl.exe76⤵PID:3708
-
\??\c:\3nbbtb.exec:\3nbbtb.exe77⤵PID:3592
-
\??\c:\ddddd.exec:\ddddd.exe78⤵PID:4864
-
\??\c:\fxxfxff.exec:\fxxfxff.exe79⤵PID:3492
-
\??\c:\nhnhbt.exec:\nhnhbt.exe80⤵PID:1388
-
\??\c:\xlrxrff.exec:\xlrxrff.exe81⤵PID:1836
-
\??\c:\bthhhh.exec:\bthhhh.exe82⤵PID:2516
-
\??\c:\ppddj.exec:\ppddj.exe83⤵PID:2856
-
\??\c:\llrrlll.exec:\llrrlll.exe84⤵PID:2876
-
\??\c:\pjppv.exec:\pjppv.exe85⤵PID:4860
-
\??\c:\pdpdv.exec:\pdpdv.exe86⤵PID:3728
-
\??\c:\frxxxfx.exec:\frxxxfx.exe87⤵PID:1968
-
\??\c:\ttthhn.exec:\ttthhn.exe88⤵PID:3076
-
\??\c:\pjjdd.exec:\pjjdd.exe89⤵PID:4784
-
\??\c:\1lrxrff.exec:\1lrxrff.exe90⤵PID:908
-
\??\c:\tntttb.exec:\tntttb.exe91⤵PID:4432
-
\??\c:\hbhbbb.exec:\hbhbbb.exe92⤵PID:3268
-
\??\c:\7ddvj.exec:\7ddvj.exe93⤵PID:2208
-
\??\c:\rflfxfx.exec:\rflfxfx.exe94⤵PID:1620
-
\??\c:\bbhnhn.exec:\bbhnhn.exe95⤵PID:4760
-
\??\c:\tthttb.exec:\tthttb.exe96⤵PID:1060
-
\??\c:\pjpdd.exec:\pjpdd.exe97⤵PID:2900
-
\??\c:\lxfxrxr.exec:\lxfxrxr.exe98⤵PID:3400
-
\??\c:\9nbtnt.exec:\9nbtnt.exe99⤵PID:2044
-
\??\c:\9pvvv.exec:\9pvvv.exe100⤵PID:3200
-
\??\c:\xfrlfll.exec:\xfrlfll.exe101⤵PID:4820
-
\??\c:\3bbhht.exec:\3bbhht.exe102⤵PID:4184
-
\??\c:\thtttb.exec:\thtttb.exe103⤵PID:1408
-
\??\c:\3jvvp.exec:\3jvvp.exe104⤵PID:4980
-
\??\c:\pjvpj.exec:\pjvpj.exe105⤵PID:2040
-
\??\c:\xllllll.exec:\xllllll.exe106⤵PID:2372
-
\??\c:\9thhhh.exec:\9thhhh.exe107⤵PID:320
-
\??\c:\ntbbtt.exec:\ntbbtt.exe108⤵PID:4628
-
\??\c:\hhnhhn.exec:\hhnhhn.exe109⤵PID:1860
-
\??\c:\pjvvd.exec:\pjvvd.exe110⤵PID:2356
-
\??\c:\xflffrl.exec:\xflffrl.exe111⤵PID:2052
-
\??\c:\flflxfl.exec:\flflxfl.exe112⤵PID:2684
-
\??\c:\nthtnn.exec:\nthtnn.exe113⤵PID:1916
-
\??\c:\tnbtbh.exec:\tnbtbh.exe114⤵PID:2712
-
\??\c:\ttttnt.exec:\ttttnt.exe115⤵PID:1360
-
\??\c:\ddjjd.exec:\ddjjd.exe116⤵PID:1228
-
\??\c:\bbnnhn.exec:\bbnnhn.exe117⤵PID:1576
-
\??\c:\bhthhh.exec:\bhthhh.exe118⤵PID:408
-
\??\c:\dvjvp.exec:\dvjvp.exe119⤵PID:4924
-
\??\c:\ddpdd.exec:\ddpdd.exe120⤵PID:3328
-
\??\c:\dvpvd.exec:\dvpvd.exe121⤵PID:2948
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe122⤵PID:4516
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-