Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 00:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6007507ee4e870d54002d695cf047710_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
6007507ee4e870d54002d695cf047710_NeikiAnalytics.exe
-
Size
61KB
-
MD5
6007507ee4e870d54002d695cf047710
-
SHA1
11585ef509848e568948f2a16b3f37a57db61eb3
-
SHA256
cc8e602b9e85e6a4f8648c27ca62f8e62fc68b58d9abe06acec52d7bcf72fe05
-
SHA512
5d4cf564dabea7755e3a920a5579684b965b06a2a66488145fdcf28caf5fb804354e8b3324268a8e9929f3ac53d7468e84fde0b83657e5ee389f80845394ff27
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvAEaFJL8:ymb3NkkiQ3mdBjFIvAv8
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2160-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2868-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/552-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1728-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1624-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/576-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1244-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1684-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/636-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1000-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/752-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/848-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2220 thtbbt.exe 2600 nbnbtb.exe 2524 pvdvv.exe 2512 5rxxxll.exe 2532 llfrfxl.exe 2388 nnhthb.exe 2868 3djjj.exe 552 lfrxfxf.exe 2380 xlrrrxf.exe 2704 htbbbt.exe 1740 bthtnh.exe 1728 vjpjp.exe 1716 xlrlxxx.exe 1624 7xlrfll.exe 1668 thhhhb.exe 576 nbhhnh.exe 1244 9dvvd.exe 1652 9vjpv.exe 3016 xffffxx.exe 1684 bnbbhn.exe 2768 3htnnn.exe 636 dddvv.exe 2812 vjvvv.exe 1000 rlrxflr.exe 752 7tthhn.exe 960 nhtnnn.exe 2268 jvdvd.exe 3056 dpdvd.exe 848 rflfxrx.exe 2960 rxlffrx.exe 2976 nbhbbb.exe 2120 dpddd.exe 2616 vjpjj.exe 1496 xllfrlf.exe 2600 nthbbt.exe 2592 3nbbhn.exe 2660 vpjjd.exe 2172 pjddp.exe 2396 fxrrrrf.exe 2628 lfrfrrx.exe 2452 9nbbbh.exe 2368 vpddj.exe 2080 dpdjj.exe 2496 9xlllrf.exe 2456 lfxflxl.exe 2276 bthbhh.exe 2292 nhhhbn.exe 240 hnbbhb.exe 1728 jdpdv.exe 1580 7vvdp.exe 2140 3jvvv.exe 2280 lflrxxr.exe 544 1xxfllr.exe 1272 thtbbt.exe 1348 hbhbnt.exe 2896 htbhbb.exe 1424 jvjpd.exe 832 1vppv.exe 2224 5rflrlx.exe 2376 llllrrx.exe 636 nbtbnt.exe 320 bnbtbh.exe 1000 7ppvv.exe 1620 5xrlrrr.exe -
resource yara_rule behavioral1/memory/2160-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/552-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1728-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1624-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/576-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1244-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1684-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/636-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1000-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/752-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/848-283-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2160 wrote to memory of 2220 2160 6007507ee4e870d54002d695cf047710_NeikiAnalytics.exe 28 PID 2160 wrote to memory of 2220 2160 6007507ee4e870d54002d695cf047710_NeikiAnalytics.exe 28 PID 2160 wrote to memory of 2220 2160 6007507ee4e870d54002d695cf047710_NeikiAnalytics.exe 28 PID 2160 wrote to memory of 2220 2160 6007507ee4e870d54002d695cf047710_NeikiAnalytics.exe 28 PID 2220 wrote to memory of 2600 2220 thtbbt.exe 29 PID 2220 wrote to memory of 2600 2220 thtbbt.exe 29 PID 2220 wrote to memory of 2600 2220 thtbbt.exe 29 PID 2220 wrote to memory of 2600 2220 thtbbt.exe 29 PID 2600 wrote to memory of 2524 2600 nbnbtb.exe 30 PID 2600 wrote to memory of 2524 2600 nbnbtb.exe 30 PID 2600 wrote to memory of 2524 2600 nbnbtb.exe 30 PID 2600 wrote to memory of 2524 2600 nbnbtb.exe 30 PID 2524 wrote to memory of 2512 2524 pvdvv.exe 31 PID 2524 wrote to memory of 2512 2524 pvdvv.exe 31 PID 2524 wrote to memory of 2512 2524 pvdvv.exe 31 PID 2524 wrote to memory of 2512 2524 pvdvv.exe 31 PID 2512 wrote to memory of 2532 2512 5rxxxll.exe 32 PID 2512 wrote to memory of 2532 2512 5rxxxll.exe 32 PID 2512 wrote to memory of 2532 2512 5rxxxll.exe 32 PID 2512 wrote to memory of 2532 2512 5rxxxll.exe 32 PID 2532 wrote to memory of 2388 2532 llfrfxl.exe 33 PID 2532 wrote to memory of 2388 2532 llfrfxl.exe 33 PID 2532 wrote to memory of 2388 2532 llfrfxl.exe 33 PID 2532 wrote to memory of 2388 2532 llfrfxl.exe 33 PID 2388 wrote to memory of 2868 2388 nnhthb.exe 34 PID 2388 wrote to memory of 2868 2388 nnhthb.exe 34 PID 2388 wrote to memory of 2868 2388 nnhthb.exe 34 PID 2388 wrote to memory of 2868 2388 nnhthb.exe 34 PID 2868 wrote to memory of 552 2868 3djjj.exe 35 PID 2868 wrote to memory of 552 2868 3djjj.exe 35 PID 2868 wrote to memory of 552 2868 3djjj.exe 35 PID 2868 wrote to memory of 552 2868 3djjj.exe 35 PID 552 wrote to memory of 2380 552 lfrxfxf.exe 36 PID 552 wrote to memory of 2380 552 lfrxfxf.exe 36 PID 552 wrote to memory of 2380 552 lfrxfxf.exe 36 PID 552 wrote to memory of 2380 552 lfrxfxf.exe 36 PID 2380 wrote to memory of 2704 2380 xlrrrxf.exe 37 PID 2380 wrote to memory of 2704 2380 xlrrrxf.exe 37 PID 2380 wrote to memory of 2704 2380 xlrrrxf.exe 37 PID 2380 wrote to memory of 2704 2380 xlrrrxf.exe 37 PID 2704 wrote to memory of 1740 2704 htbbbt.exe 38 PID 2704 wrote to memory of 1740 2704 htbbbt.exe 38 PID 2704 wrote to memory of 1740 2704 htbbbt.exe 38 PID 2704 wrote to memory of 1740 2704 htbbbt.exe 38 PID 1740 wrote to memory of 1728 1740 bthtnh.exe 39 PID 1740 wrote to memory of 1728 1740 bthtnh.exe 39 PID 1740 wrote to memory of 1728 1740 bthtnh.exe 39 PID 1740 wrote to memory of 1728 1740 bthtnh.exe 39 PID 1728 wrote to memory of 1716 1728 vjpjp.exe 40 PID 1728 wrote to memory of 1716 1728 vjpjp.exe 40 PID 1728 wrote to memory of 1716 1728 vjpjp.exe 40 PID 1728 wrote to memory of 1716 1728 vjpjp.exe 40 PID 1716 wrote to memory of 1624 1716 xlrlxxx.exe 41 PID 1716 wrote to memory of 1624 1716 xlrlxxx.exe 41 PID 1716 wrote to memory of 1624 1716 xlrlxxx.exe 41 PID 1716 wrote to memory of 1624 1716 xlrlxxx.exe 41 PID 1624 wrote to memory of 1668 1624 7xlrfll.exe 42 PID 1624 wrote to memory of 1668 1624 7xlrfll.exe 42 PID 1624 wrote to memory of 1668 1624 7xlrfll.exe 42 PID 1624 wrote to memory of 1668 1624 7xlrfll.exe 42 PID 1668 wrote to memory of 576 1668 thhhhb.exe 43 PID 1668 wrote to memory of 576 1668 thhhhb.exe 43 PID 1668 wrote to memory of 576 1668 thhhhb.exe 43 PID 1668 wrote to memory of 576 1668 thhhhb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\6007507ee4e870d54002d695cf047710_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6007507ee4e870d54002d695cf047710_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\thtbbt.exec:\thtbbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\nbnbtb.exec:\nbnbtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\pvdvv.exec:\pvdvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\5rxxxll.exec:\5rxxxll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\llfrfxl.exec:\llfrfxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\nnhthb.exec:\nnhthb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\3djjj.exec:\3djjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\lfrxfxf.exec:\lfrxfxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\xlrrrxf.exec:\xlrrrxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\htbbbt.exec:\htbbbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\bthtnh.exec:\bthtnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\vjpjp.exec:\vjpjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\xlrlxxx.exec:\xlrlxxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\7xlrfll.exec:\7xlrfll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\thhhhb.exec:\thhhhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\nbhhnh.exec:\nbhhnh.exe17⤵
- Executes dropped EXE
PID:576 -
\??\c:\9dvvd.exec:\9dvvd.exe18⤵
- Executes dropped EXE
PID:1244 -
\??\c:\9vjpv.exec:\9vjpv.exe19⤵
- Executes dropped EXE
PID:1652 -
\??\c:\xffffxx.exec:\xffffxx.exe20⤵
- Executes dropped EXE
PID:3016 -
\??\c:\bnbbhn.exec:\bnbbhn.exe21⤵
- Executes dropped EXE
PID:1684 -
\??\c:\3htnnn.exec:\3htnnn.exe22⤵
- Executes dropped EXE
PID:2768 -
\??\c:\dddvv.exec:\dddvv.exe23⤵
- Executes dropped EXE
PID:636 -
\??\c:\vjvvv.exec:\vjvvv.exe24⤵
- Executes dropped EXE
PID:2812 -
\??\c:\rlrxflr.exec:\rlrxflr.exe25⤵
- Executes dropped EXE
PID:1000 -
\??\c:\7tthhn.exec:\7tthhn.exe26⤵
- Executes dropped EXE
PID:752 -
\??\c:\nhtnnn.exec:\nhtnnn.exe27⤵
- Executes dropped EXE
PID:960 -
\??\c:\jvdvd.exec:\jvdvd.exe28⤵
- Executes dropped EXE
PID:2268 -
\??\c:\dpdvd.exec:\dpdvd.exe29⤵
- Executes dropped EXE
PID:3056 -
\??\c:\rflfxrx.exec:\rflfxrx.exe30⤵
- Executes dropped EXE
PID:848 -
\??\c:\rxlffrx.exec:\rxlffrx.exe31⤵
- Executes dropped EXE
PID:2960 -
\??\c:\nbhbbb.exec:\nbhbbb.exe32⤵
- Executes dropped EXE
PID:2976 -
\??\c:\dpddd.exec:\dpddd.exe33⤵
- Executes dropped EXE
PID:2120 -
\??\c:\vjpjj.exec:\vjpjj.exe34⤵
- Executes dropped EXE
PID:2616 -
\??\c:\xllfrlf.exec:\xllfrlf.exe35⤵
- Executes dropped EXE
PID:1496 -
\??\c:\nthbbt.exec:\nthbbt.exe36⤵
- Executes dropped EXE
PID:2600 -
\??\c:\3nbbhn.exec:\3nbbhn.exe37⤵
- Executes dropped EXE
PID:2592 -
\??\c:\vpjjd.exec:\vpjjd.exe38⤵
- Executes dropped EXE
PID:2660 -
\??\c:\pjddp.exec:\pjddp.exe39⤵
- Executes dropped EXE
PID:2172 -
\??\c:\fxrrrrf.exec:\fxrrrrf.exe40⤵
- Executes dropped EXE
PID:2396 -
\??\c:\lfrfrrx.exec:\lfrfrrx.exe41⤵
- Executes dropped EXE
PID:2628 -
\??\c:\9nbbbh.exec:\9nbbbh.exe42⤵
- Executes dropped EXE
PID:2452 -
\??\c:\vpddj.exec:\vpddj.exe43⤵
- Executes dropped EXE
PID:2368 -
\??\c:\dpdjj.exec:\dpdjj.exe44⤵
- Executes dropped EXE
PID:2080 -
\??\c:\9xlllrf.exec:\9xlllrf.exe45⤵
- Executes dropped EXE
PID:2496 -
\??\c:\lfxflxl.exec:\lfxflxl.exe46⤵
- Executes dropped EXE
PID:2456 -
\??\c:\bthbhh.exec:\bthbhh.exe47⤵
- Executes dropped EXE
PID:2276 -
\??\c:\nhhhbn.exec:\nhhhbn.exe48⤵
- Executes dropped EXE
PID:2292 -
\??\c:\hnbbhb.exec:\hnbbhb.exe49⤵
- Executes dropped EXE
PID:240 -
\??\c:\jdpdv.exec:\jdpdv.exe50⤵
- Executes dropped EXE
PID:1728 -
\??\c:\7vvdp.exec:\7vvdp.exe51⤵
- Executes dropped EXE
PID:1580 -
\??\c:\3jvvv.exec:\3jvvv.exe52⤵
- Executes dropped EXE
PID:2140 -
\??\c:\lflrxxr.exec:\lflrxxr.exe53⤵
- Executes dropped EXE
PID:2280 -
\??\c:\1xxfllr.exec:\1xxfllr.exe54⤵
- Executes dropped EXE
PID:544 -
\??\c:\thtbbt.exec:\thtbbt.exe55⤵
- Executes dropped EXE
PID:1272 -
\??\c:\hbhbnt.exec:\hbhbnt.exe56⤵
- Executes dropped EXE
PID:1348 -
\??\c:\htbhbb.exec:\htbhbb.exe57⤵
- Executes dropped EXE
PID:2896 -
\??\c:\jvjpd.exec:\jvjpd.exe58⤵
- Executes dropped EXE
PID:1424 -
\??\c:\1vppv.exec:\1vppv.exe59⤵
- Executes dropped EXE
PID:832 -
\??\c:\5rflrlx.exec:\5rflrlx.exe60⤵
- Executes dropped EXE
PID:2224 -
\??\c:\llllrrx.exec:\llllrrx.exe61⤵
- Executes dropped EXE
PID:2376 -
\??\c:\nbtbnt.exec:\nbtbnt.exe62⤵
- Executes dropped EXE
PID:636 -
\??\c:\bnbtbh.exec:\bnbtbh.exe63⤵
- Executes dropped EXE
PID:320 -
\??\c:\7ppvv.exec:\7ppvv.exe64⤵
- Executes dropped EXE
PID:1000 -
\??\c:\5xrlrrr.exec:\5xrlrrr.exe65⤵
- Executes dropped EXE
PID:1620 -
\??\c:\lxlfllr.exec:\lxlfllr.exe66⤵PID:3024
-
\??\c:\hhbhbt.exec:\hhbhbt.exe67⤵PID:1480
-
\??\c:\jddjp.exec:\jddjp.exe68⤵PID:1964
-
\??\c:\rlxxllr.exec:\rlxxllr.exe69⤵PID:1416
-
\??\c:\1rxxfll.exec:\1rxxfll.exe70⤵PID:1100
-
\??\c:\htnnnt.exec:\htnnnt.exe71⤵PID:896
-
\??\c:\7btbhh.exec:\7btbhh.exe72⤵PID:2736
-
\??\c:\pjvvv.exec:\pjvvv.exe73⤵PID:3036
-
\??\c:\5dpvd.exec:\5dpvd.exe74⤵PID:2164
-
\??\c:\3lxflrf.exec:\3lxflrf.exe75⤵PID:2504
-
\??\c:\xrfrflx.exec:\xrfrflx.exe76⤵PID:1644
-
\??\c:\5bnnbb.exec:\5bnnbb.exe77⤵PID:2588
-
\??\c:\hbtbbt.exec:\hbtbbt.exe78⤵PID:2116
-
\??\c:\htnhnn.exec:\htnhnn.exe79⤵PID:2740
-
\??\c:\pjjjd.exec:\pjjjd.exe80⤵PID:2448
-
\??\c:\vvjvd.exec:\vvjvd.exe81⤵PID:2508
-
\??\c:\fxrlxxf.exec:\fxrlxxf.exe82⤵PID:2472
-
\??\c:\lxrxfxf.exec:\lxrxfxf.exe83⤵PID:2916
-
\??\c:\fxrfflx.exec:\fxrfflx.exe84⤵PID:2868
-
\??\c:\hthtth.exec:\hthtth.exe85⤵PID:800
-
\??\c:\9dpdv.exec:\9dpdv.exe86⤵PID:804
-
\??\c:\jddvp.exec:\jddvp.exe87⤵PID:2380
-
\??\c:\pjvdj.exec:\pjvdj.exe88⤵PID:2304
-
\??\c:\xrlxxxl.exec:\xrlxxxl.exe89⤵PID:1460
-
\??\c:\rrllfff.exec:\rrllfff.exe90⤵PID:280
-
\??\c:\hbtthh.exec:\hbtthh.exe91⤵PID:1576
-
\??\c:\9htbht.exec:\9htbht.exe92⤵PID:1488
-
\??\c:\5thhhb.exec:\5thhhb.exe93⤵PID:324
-
\??\c:\vvjdj.exec:\vvjdj.exe94⤵PID:336
-
\??\c:\dpdpd.exec:\dpdpd.exe95⤵PID:1856
-
\??\c:\frxflll.exec:\frxflll.exe96⤵PID:2040
-
\??\c:\xrxfxff.exec:\xrxfxff.exe97⤵PID:2232
-
\??\c:\9lrflrx.exec:\9lrflrx.exe98⤵PID:688
-
\??\c:\3htbnt.exec:\3htbnt.exe99⤵PID:1932
-
\??\c:\5pjdp.exec:\5pjdp.exe100⤵PID:1684
-
\??\c:\7vdjp.exec:\7vdjp.exe101⤵PID:2052
-
\??\c:\fxrrxxf.exec:\fxrrxxf.exe102⤵PID:2336
-
\??\c:\fxrxflf.exec:\fxrxflf.exe103⤵PID:2756
-
\??\c:\nhbhnn.exec:\nhbhnn.exe104⤵PID:3064
-
\??\c:\btbbbh.exec:\btbbbh.exe105⤵PID:844
-
\??\c:\vjppp.exec:\vjppp.exe106⤵PID:752
-
\??\c:\dpjjj.exec:\dpjjj.exe107⤵PID:1016
-
\??\c:\5fllxfl.exec:\5fllxfl.exe108⤵PID:608
-
\??\c:\rrrllfl.exec:\rrrllfl.exe109⤵PID:2268
-
\??\c:\nhbhbt.exec:\nhbhbt.exe110⤵PID:2216
-
\??\c:\7bnbtb.exec:\7bnbtb.exe111⤵PID:2020
-
\??\c:\thtbtt.exec:\thtbtt.exe112⤵PID:2988
-
\??\c:\1jdvv.exec:\1jdvv.exe113⤵PID:2932
-
\??\c:\xrxxfxl.exec:\xrxxfxl.exe114⤵PID:2540
-
\??\c:\9rxflfr.exec:\9rxflfr.exe115⤵PID:2644
-
\??\c:\1htntt.exec:\1htntt.exe116⤵PID:1524
-
\??\c:\7tnttb.exec:\7tnttb.exe117⤵PID:1532
-
\??\c:\jvjjp.exec:\jvjjp.exe118⤵PID:2908
-
\??\c:\pjdjp.exec:\pjdjp.exe119⤵PID:2524
-
\??\c:\1lxflxf.exec:\1lxflxf.exe120⤵PID:2512
-
\??\c:\lxxffxx.exec:\lxxffxx.exe121⤵PID:2860
-
\??\c:\ttbhnn.exec:\ttbhnn.exe122⤵PID:2460
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-