Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
30-05-2024 22:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6be826529daad59455168e12fb86bbf0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
6be826529daad59455168e12fb86bbf0_NeikiAnalytics.exe
-
Size
59KB
-
MD5
6be826529daad59455168e12fb86bbf0
-
SHA1
48ec0d4d2c7f7c3564a3006d4948b327c00d3bbf
-
SHA256
0170eb96e3b819c1bd6490e8baa518d635d2548a28398b1282e262cd76c0089c
-
SHA512
bb8d3b46298792672f160bae05f83f58c35707ed938692a7a1be0a2abf1e81f96a9a5ce4bfacf4c5cee582087c2f2e6b56fc2380c60a91ec2d55fd23031970a7
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsImshz:ymb3NkkiQ3mdBjFIsIFhz
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral1/memory/1992-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2052-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1584-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1840-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1408-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3056-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-266-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1252-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1088-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1236-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1508-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1636-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/344-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/876-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-64-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2408-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2052 7pvpj.exe 2016 lfrxxfr.exe 2652 xlrrrlr.exe 2544 7nbhnb.exe 2408 9hbhbh.exe 2440 5dvjd.exe 2460 1vvpv.exe 876 9ffrxfx.exe 344 7bbbnn.exe 1504 ntnbnb.exe 1584 5dpdp.exe 2188 5pdjp.exe 1636 pjjjj.exe 1840 lxlfffl.exe 2200 xrflrxf.exe 3016 thnnnn.exe 1508 7hnntn.exe 1236 jvjdd.exe 2236 ddjvp.exe 1088 lxrrflf.exe 540 btnbnt.exe 1408 hbnntb.exe 1708 9thnnn.exe 1252 pjvdp.exe 2824 xrlrflx.exe 1812 llrxllf.exe 2848 bhnnnb.exe 2932 jdjjd.exe 2156 3dvvj.exe 2884 fxlrrrx.exe 3056 7lrrrrr.exe 1992 fxlrffl.exe 1980 5nbbtn.exe 2592 7pvjj.exe 2508 pdddd.exe 2624 rlxxffl.exe 2476 fxflrll.exe 2808 rflffxr.exe 2512 hbnhtn.exe 2648 jdppd.exe 1772 vpdvv.exe 1712 5ppjp.exe 2356 xfllfxx.exe 2632 xrflffl.exe 1500 frrlxrl.exe 2844 5thhtn.exe 1592 hhtbbb.exe 1624 tnnhhb.exe 304 pdvdj.exe 1316 jdppv.exe 2172 rrxxrlx.exe 1552 ffxfrrx.exe 1952 7hbnbb.exe 1948 hbbnnh.exe 1968 dvjpp.exe 2424 5djdd.exe 1192 1jdjp.exe 480 5fxlxxl.exe 588 lxfxffl.exe 1176 1btbhn.exe 1824 nbhntt.exe 2144 jvdpp.exe 412 xlxxrxx.exe 1680 frxxxrx.exe -
resource yara_rule behavioral1/memory/1992-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1584-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1840-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1408-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-303-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-275-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-266-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1252-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1088-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1236-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1508-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1636-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/344-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/876-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-23-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1992 wrote to memory of 2052 1992 6be826529daad59455168e12fb86bbf0_NeikiAnalytics.exe 28 PID 1992 wrote to memory of 2052 1992 6be826529daad59455168e12fb86bbf0_NeikiAnalytics.exe 28 PID 1992 wrote to memory of 2052 1992 6be826529daad59455168e12fb86bbf0_NeikiAnalytics.exe 28 PID 1992 wrote to memory of 2052 1992 6be826529daad59455168e12fb86bbf0_NeikiAnalytics.exe 28 PID 2052 wrote to memory of 2016 2052 7pvpj.exe 29 PID 2052 wrote to memory of 2016 2052 7pvpj.exe 29 PID 2052 wrote to memory of 2016 2052 7pvpj.exe 29 PID 2052 wrote to memory of 2016 2052 7pvpj.exe 29 PID 2016 wrote to memory of 2652 2016 lfrxxfr.exe 30 PID 2016 wrote to memory of 2652 2016 lfrxxfr.exe 30 PID 2016 wrote to memory of 2652 2016 lfrxxfr.exe 30 PID 2016 wrote to memory of 2652 2016 lfrxxfr.exe 30 PID 2652 wrote to memory of 2544 2652 xlrrrlr.exe 31 PID 2652 wrote to memory of 2544 2652 xlrrrlr.exe 31 PID 2652 wrote to memory of 2544 2652 xlrrrlr.exe 31 PID 2652 wrote to memory of 2544 2652 xlrrrlr.exe 31 PID 2544 wrote to memory of 2408 2544 7nbhnb.exe 32 PID 2544 wrote to memory of 2408 2544 7nbhnb.exe 32 PID 2544 wrote to memory of 2408 2544 7nbhnb.exe 32 PID 2544 wrote to memory of 2408 2544 7nbhnb.exe 32 PID 2408 wrote to memory of 2440 2408 9hbhbh.exe 33 PID 2408 wrote to memory of 2440 2408 9hbhbh.exe 33 PID 2408 wrote to memory of 2440 2408 9hbhbh.exe 33 PID 2408 wrote to memory of 2440 2408 9hbhbh.exe 33 PID 2440 wrote to memory of 2460 2440 5dvjd.exe 34 PID 2440 wrote to memory of 2460 2440 5dvjd.exe 34 PID 2440 wrote to memory of 2460 2440 5dvjd.exe 34 PID 2440 wrote to memory of 2460 2440 5dvjd.exe 34 PID 2460 wrote to memory of 876 2460 1vvpv.exe 35 PID 2460 wrote to memory of 876 2460 1vvpv.exe 35 PID 2460 wrote to memory of 876 2460 1vvpv.exe 35 PID 2460 wrote to memory of 876 2460 1vvpv.exe 35 PID 876 wrote to memory of 344 876 9ffrxfx.exe 36 PID 876 wrote to memory of 344 876 9ffrxfx.exe 36 PID 876 wrote to memory of 344 876 9ffrxfx.exe 36 PID 876 wrote to memory of 344 876 9ffrxfx.exe 36 PID 344 wrote to memory of 1504 344 7bbbnn.exe 37 PID 344 wrote to memory of 1504 344 7bbbnn.exe 37 PID 344 wrote to memory of 1504 344 7bbbnn.exe 37 PID 344 wrote to memory of 1504 344 7bbbnn.exe 37 PID 1504 wrote to memory of 1584 1504 ntnbnb.exe 38 PID 1504 wrote to memory of 1584 1504 ntnbnb.exe 38 PID 1504 wrote to memory of 1584 1504 ntnbnb.exe 38 PID 1504 wrote to memory of 1584 1504 ntnbnb.exe 38 PID 1584 wrote to memory of 2188 1584 5dpdp.exe 39 PID 1584 wrote to memory of 2188 1584 5dpdp.exe 39 PID 1584 wrote to memory of 2188 1584 5dpdp.exe 39 PID 1584 wrote to memory of 2188 1584 5dpdp.exe 39 PID 2188 wrote to memory of 1636 2188 5pdjp.exe 40 PID 2188 wrote to memory of 1636 2188 5pdjp.exe 40 PID 2188 wrote to memory of 1636 2188 5pdjp.exe 40 PID 2188 wrote to memory of 1636 2188 5pdjp.exe 40 PID 1636 wrote to memory of 1840 1636 pjjjj.exe 41 PID 1636 wrote to memory of 1840 1636 pjjjj.exe 41 PID 1636 wrote to memory of 1840 1636 pjjjj.exe 41 PID 1636 wrote to memory of 1840 1636 pjjjj.exe 41 PID 1840 wrote to memory of 2200 1840 lxlfffl.exe 42 PID 1840 wrote to memory of 2200 1840 lxlfffl.exe 42 PID 1840 wrote to memory of 2200 1840 lxlfffl.exe 42 PID 1840 wrote to memory of 2200 1840 lxlfffl.exe 42 PID 2200 wrote to memory of 3016 2200 xrflrxf.exe 43 PID 2200 wrote to memory of 3016 2200 xrflrxf.exe 43 PID 2200 wrote to memory of 3016 2200 xrflrxf.exe 43 PID 2200 wrote to memory of 3016 2200 xrflrxf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\6be826529daad59455168e12fb86bbf0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6be826529daad59455168e12fb86bbf0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\7pvpj.exec:\7pvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\lfrxxfr.exec:\lfrxxfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\xlrrrlr.exec:\xlrrrlr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\7nbhnb.exec:\7nbhnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\9hbhbh.exec:\9hbhbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\5dvjd.exec:\5dvjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\1vvpv.exec:\1vvpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\9ffrxfx.exec:\9ffrxfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\7bbbnn.exec:\7bbbnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
\??\c:\ntnbnb.exec:\ntnbnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\5dpdp.exec:\5dpdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\5pdjp.exec:\5pdjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\pjjjj.exec:\pjjjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\lxlfffl.exec:\lxlfffl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\xrflrxf.exec:\xrflrxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\thnnnn.exec:\thnnnn.exe17⤵
- Executes dropped EXE
PID:3016 -
\??\c:\7hnntn.exec:\7hnntn.exe18⤵
- Executes dropped EXE
PID:1508 -
\??\c:\jvjdd.exec:\jvjdd.exe19⤵
- Executes dropped EXE
PID:1236 -
\??\c:\ddjvp.exec:\ddjvp.exe20⤵
- Executes dropped EXE
PID:2236 -
\??\c:\lxrrflf.exec:\lxrrflf.exe21⤵
- Executes dropped EXE
PID:1088 -
\??\c:\btnbnt.exec:\btnbnt.exe22⤵
- Executes dropped EXE
PID:540 -
\??\c:\hbnntb.exec:\hbnntb.exe23⤵
- Executes dropped EXE
PID:1408 -
\??\c:\9thnnn.exec:\9thnnn.exe24⤵
- Executes dropped EXE
PID:1708 -
\??\c:\pjvdp.exec:\pjvdp.exe25⤵
- Executes dropped EXE
PID:1252 -
\??\c:\xrlrflx.exec:\xrlrflx.exe26⤵
- Executes dropped EXE
PID:2824 -
\??\c:\llrxllf.exec:\llrxllf.exe27⤵
- Executes dropped EXE
PID:1812 -
\??\c:\bhnnnb.exec:\bhnnnb.exe28⤵
- Executes dropped EXE
PID:2848 -
\??\c:\jdjjd.exec:\jdjjd.exe29⤵
- Executes dropped EXE
PID:2932 -
\??\c:\3dvvj.exec:\3dvvj.exe30⤵
- Executes dropped EXE
PID:2156 -
\??\c:\fxlrrrx.exec:\fxlrrrx.exe31⤵
- Executes dropped EXE
PID:2884 -
\??\c:\7lrrrrr.exec:\7lrrrrr.exe32⤵
- Executes dropped EXE
PID:3056 -
\??\c:\fxlrffl.exec:\fxlrffl.exe33⤵
- Executes dropped EXE
PID:1992 -
\??\c:\5nbbtn.exec:\5nbbtn.exe34⤵
- Executes dropped EXE
PID:1980 -
\??\c:\7pvjj.exec:\7pvjj.exe35⤵
- Executes dropped EXE
PID:2592 -
\??\c:\pdddd.exec:\pdddd.exe36⤵
- Executes dropped EXE
PID:2508 -
\??\c:\rlxxffl.exec:\rlxxffl.exe37⤵
- Executes dropped EXE
PID:2624 -
\??\c:\fxflrll.exec:\fxflrll.exe38⤵
- Executes dropped EXE
PID:2476 -
\??\c:\rflffxr.exec:\rflffxr.exe39⤵
- Executes dropped EXE
PID:2808 -
\??\c:\hbnhtn.exec:\hbnhtn.exe40⤵
- Executes dropped EXE
PID:2512 -
\??\c:\jdppd.exec:\jdppd.exe41⤵
- Executes dropped EXE
PID:2648 -
\??\c:\vpdvv.exec:\vpdvv.exe42⤵
- Executes dropped EXE
PID:1772 -
\??\c:\5ppjp.exec:\5ppjp.exe43⤵
- Executes dropped EXE
PID:1712 -
\??\c:\xfllfxx.exec:\xfllfxx.exe44⤵
- Executes dropped EXE
PID:2356 -
\??\c:\xrflffl.exec:\xrflffl.exe45⤵
- Executes dropped EXE
PID:2632 -
\??\c:\frrlxrl.exec:\frrlxrl.exe46⤵
- Executes dropped EXE
PID:1500 -
\??\c:\5thhtn.exec:\5thhtn.exe47⤵
- Executes dropped EXE
PID:2844 -
\??\c:\hhtbbb.exec:\hhtbbb.exe48⤵
- Executes dropped EXE
PID:1592 -
\??\c:\tnnhhb.exec:\tnnhhb.exe49⤵
- Executes dropped EXE
PID:1624 -
\??\c:\pdvdj.exec:\pdvdj.exe50⤵
- Executes dropped EXE
PID:304 -
\??\c:\jdppv.exec:\jdppv.exe51⤵
- Executes dropped EXE
PID:1316 -
\??\c:\rrxxrlx.exec:\rrxxrlx.exe52⤵
- Executes dropped EXE
PID:2172 -
\??\c:\ffxfrrx.exec:\ffxfrrx.exe53⤵
- Executes dropped EXE
PID:1552 -
\??\c:\7hbnbb.exec:\7hbnbb.exe54⤵
- Executes dropped EXE
PID:1952 -
\??\c:\hbbnnh.exec:\hbbnnh.exe55⤵
- Executes dropped EXE
PID:1948 -
\??\c:\dvjpp.exec:\dvjpp.exe56⤵
- Executes dropped EXE
PID:1968 -
\??\c:\5djdd.exec:\5djdd.exe57⤵
- Executes dropped EXE
PID:2424 -
\??\c:\1jdjp.exec:\1jdjp.exe58⤵
- Executes dropped EXE
PID:1192 -
\??\c:\5fxlxxl.exec:\5fxlxxl.exe59⤵
- Executes dropped EXE
PID:480 -
\??\c:\lxfxffl.exec:\lxfxffl.exe60⤵
- Executes dropped EXE
PID:588 -
\??\c:\1btbhn.exec:\1btbhn.exe61⤵
- Executes dropped EXE
PID:1176 -
\??\c:\nbhntt.exec:\nbhntt.exe62⤵
- Executes dropped EXE
PID:1824 -
\??\c:\jvdpp.exec:\jvdpp.exe63⤵
- Executes dropped EXE
PID:2144 -
\??\c:\xlxxrxx.exec:\xlxxrxx.exe64⤵
- Executes dropped EXE
PID:412 -
\??\c:\frxxxrx.exec:\frxxxrx.exe65⤵
- Executes dropped EXE
PID:1680 -
\??\c:\frrrrlf.exec:\frrrrlf.exe66⤵PID:3000
-
\??\c:\hhttbb.exec:\hhttbb.exe67⤵PID:2340
-
\??\c:\btnthb.exec:\btnthb.exe68⤵PID:3040
-
\??\c:\pjddp.exec:\pjddp.exe69⤵PID:3064
-
\??\c:\7vjjd.exec:\7vjjd.exe70⤵PID:1960
-
\??\c:\jjjpv.exec:\jjjpv.exe71⤵PID:3048
-
\??\c:\xrfllll.exec:\xrfllll.exe72⤵PID:2468
-
\??\c:\lxlxllr.exec:\lxlxllr.exe73⤵PID:2052
-
\??\c:\tbtnnb.exec:\tbtnnb.exe74⤵PID:2580
-
\??\c:\hbthnt.exec:\hbthnt.exe75⤵PID:2256
-
\??\c:\7dpvd.exec:\7dpvd.exe76⤵PID:2724
-
\??\c:\dvvdp.exec:\dvvdp.exe77⤵PID:2500
-
\??\c:\ddvvj.exec:\ddvvj.exe78⤵PID:2672
-
\??\c:\rrrlffr.exec:\rrrlffr.exe79⤵PID:2428
-
\??\c:\xllflfr.exec:\xllflfr.exe80⤵PID:2476
-
\??\c:\vpvdj.exec:\vpvdj.exe81⤵PID:2556
-
\??\c:\rlxxffr.exec:\rlxxffr.exe82⤵PID:2792
-
\??\c:\tntbbh.exec:\tntbbh.exe83⤵PID:1608
-
\??\c:\hhthtb.exec:\hhthtb.exe84⤵PID:852
-
\??\c:\vjvvd.exec:\vjvvd.exe85⤵PID:2372
-
\??\c:\ffxxlrf.exec:\ffxxlrf.exe86⤵PID:2448
-
\??\c:\llxxfff.exec:\llxxfff.exe87⤵PID:2692
-
\??\c:\llffrfx.exec:\llffrfx.exe88⤵PID:1500
-
\??\c:\3bbhbb.exec:\3bbhbb.exe89⤵PID:2844
-
\??\c:\3bnnnn.exec:\3bnnnn.exe90⤵PID:1592
-
\??\c:\nhhntt.exec:\nhhntt.exe91⤵PID:1748
-
\??\c:\dvjpv.exec:\dvjpv.exe92⤵PID:1816
-
\??\c:\pjvdv.exec:\pjvdv.exe93⤵PID:1316
-
\??\c:\dvpdd.exec:\dvpdd.exe94⤵PID:2172
-
\??\c:\rrlflxr.exec:\rrlflxr.exe95⤵PID:904
-
\??\c:\5rffrxx.exec:\5rffrxx.exe96⤵PID:1952
-
\??\c:\rrfrfxf.exec:\rrfrfxf.exe97⤵PID:2316
-
\??\c:\ttbhtt.exec:\ttbhtt.exe98⤵PID:1236
-
\??\c:\3nbhhn.exec:\3nbhhn.exe99⤵PID:2424
-
\??\c:\nnhnbh.exec:\nnhnbh.exe100⤵PID:2076
-
\??\c:\jdjvj.exec:\jdjvj.exe101⤵PID:1568
-
\??\c:\ppjjp.exec:\ppjjp.exe102⤵PID:588
-
\??\c:\ddvpd.exec:\ddvpd.exe103⤵PID:2364
-
\??\c:\5lfxxxf.exec:\5lfxxxf.exe104⤵PID:1824
-
\??\c:\1lllrrf.exec:\1lllrrf.exe105⤵PID:336
-
\??\c:\lxflffr.exec:\lxflffr.exe106⤵PID:412
-
\??\c:\bhnbht.exec:\bhnbht.exe107⤵PID:1680
-
\??\c:\ttnhth.exec:\ttnhth.exe108⤵PID:3000
-
\??\c:\tbnntt.exec:\tbnntt.exe109⤵PID:2128
-
\??\c:\vvjjp.exec:\vvjjp.exe110⤵PID:3040
-
\??\c:\vpvdp.exec:\vpvdp.exe111⤵PID:3064
-
\??\c:\pjpdv.exec:\pjpdv.exe112⤵PID:1960
-
\??\c:\jjppd.exec:\jjppd.exe113⤵PID:2056
-
\??\c:\9ffrflx.exec:\9ffrflx.exe114⤵PID:1992
-
\??\c:\5llxllx.exec:\5llxllx.exe115⤵PID:2052
-
\??\c:\fxffxxr.exec:\fxffxxr.exe116⤵PID:2580
-
\??\c:\ttbtht.exec:\ttbtht.exe117⤵PID:2256
-
\??\c:\7hbntb.exec:\7hbntb.exe118⤵PID:2724
-
\??\c:\3hthbb.exec:\3hthbb.exe119⤵PID:2500
-
\??\c:\pjjpd.exec:\pjjpd.exe120⤵PID:2672
-
\??\c:\7jdpv.exec:\7jdpv.exe121⤵PID:2396
-
\??\c:\1vpdp.exec:\1vpdp.exe122⤵PID:2476
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-