Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
07/06/2024, 10:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4e3d7e49296907913ab82632ec311a20_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
4e3d7e49296907913ab82632ec311a20_NeikiAnalytics.exe
-
Size
62KB
-
MD5
4e3d7e49296907913ab82632ec311a20
-
SHA1
6a9c043ebc57a1d9830608a5e195d383406c8e73
-
SHA256
10b50da046ed2c8151669499690f51c5d24f38dcf67690ed10671118b7cc3c4f
-
SHA512
700cb70c1810a19c273912f8e576c017b6b4f1ccc611004b08527c064266b7ad5544addcdc637d831b3490ba156b8bed3b14e9c9ee1ef167649f851fbf421042
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIug6bL6ZKE:ymb3NkkiQ3mdBjFIugpR
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral1/memory/3056-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1016-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2144-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2144-41-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2276-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2276-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3064-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2236-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2984-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1724-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1708-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/468-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1332-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/604-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1020-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1016 nnbhnh.exe 2616 ddpvj.exe 2144 rrfrxfl.exe 2688 htbbbb.exe 2816 3pjpp.exe 2648 9xlfllr.exe 2276 bthhnt.exe 2548 bthntn.exe 3064 pjpvv.exe 2236 llfrxrr.exe 2984 7rxrrrf.exe 3028 bbnbnh.exe 2820 dvjpd.exe 348 vpdvj.exe 2600 9xrrffl.exe 2632 hbntbh.exe 2756 7pjpj.exe 1428 ddddd.exe 1724 xlfxxrx.exe 1708 tnhhnn.exe 468 1nhnth.exe 2804 ppjpp.exe 2244 3xrrlfr.exe 1480 1xrrffr.exe 1808 hbnntb.exe 1332 3jvpd.exe 1780 xrrrffr.exe 604 xlrfrxf.exe 1020 btnhnn.exe 1800 bnhntn.exe 2500 1vpdv.exe 1688 xrlxxfr.exe 2024 5bhhnn.exe 2456 bthnhn.exe 812 dvpvd.exe 2712 jdpvj.exe 2612 1lllrrf.exe 2144 ntnnbb.exe 2904 bntbhb.exe 2656 9vvjj.exe 2816 3jvvv.exe 2700 rlfrrxf.exe 2832 xrxlxff.exe 2572 9hbbhh.exe 2996 3hbhtt.exe 1948 ddjdv.exe 2876 dvpdd.exe 3032 llffrrr.exe 2984 3frllrf.exe 900 9bbbnn.exe 1684 htnhnt.exe 1440 vjdjp.exe 1976 jvjjj.exe 1900 rfrxffx.exe 2632 fxlxxfl.exe 380 tnbntb.exe 1316 7nhbnn.exe 1752 pjvvv.exe 1676 jdjjv.exe 2512 lfrllfl.exe 468 9tnthh.exe 1312 9httbb.exe 920 pjppv.exe 1812 pjdpv.exe -
resource yara_rule behavioral1/memory/3056-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1016-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2144-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2276-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2276-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3064-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1724-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/468-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1332-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/604-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1020-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-302-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3056 wrote to memory of 1016 3056 4e3d7e49296907913ab82632ec311a20_NeikiAnalytics.exe 28 PID 3056 wrote to memory of 1016 3056 4e3d7e49296907913ab82632ec311a20_NeikiAnalytics.exe 28 PID 3056 wrote to memory of 1016 3056 4e3d7e49296907913ab82632ec311a20_NeikiAnalytics.exe 28 PID 3056 wrote to memory of 1016 3056 4e3d7e49296907913ab82632ec311a20_NeikiAnalytics.exe 28 PID 1016 wrote to memory of 2616 1016 nnbhnh.exe 29 PID 1016 wrote to memory of 2616 1016 nnbhnh.exe 29 PID 1016 wrote to memory of 2616 1016 nnbhnh.exe 29 PID 1016 wrote to memory of 2616 1016 nnbhnh.exe 29 PID 2616 wrote to memory of 2144 2616 ddpvj.exe 30 PID 2616 wrote to memory of 2144 2616 ddpvj.exe 30 PID 2616 wrote to memory of 2144 2616 ddpvj.exe 30 PID 2616 wrote to memory of 2144 2616 ddpvj.exe 30 PID 2144 wrote to memory of 2688 2144 rrfrxfl.exe 31 PID 2144 wrote to memory of 2688 2144 rrfrxfl.exe 31 PID 2144 wrote to memory of 2688 2144 rrfrxfl.exe 31 PID 2144 wrote to memory of 2688 2144 rrfrxfl.exe 31 PID 2688 wrote to memory of 2816 2688 htbbbb.exe 32 PID 2688 wrote to memory of 2816 2688 htbbbb.exe 32 PID 2688 wrote to memory of 2816 2688 htbbbb.exe 32 PID 2688 wrote to memory of 2816 2688 htbbbb.exe 32 PID 2816 wrote to memory of 2648 2816 3pjpp.exe 33 PID 2816 wrote to memory of 2648 2816 3pjpp.exe 33 PID 2816 wrote to memory of 2648 2816 3pjpp.exe 33 PID 2816 wrote to memory of 2648 2816 3pjpp.exe 33 PID 2648 wrote to memory of 2276 2648 9xlfllr.exe 34 PID 2648 wrote to memory of 2276 2648 9xlfllr.exe 34 PID 2648 wrote to memory of 2276 2648 9xlfllr.exe 34 PID 2648 wrote to memory of 2276 2648 9xlfllr.exe 34 PID 2276 wrote to memory of 2548 2276 bthhnt.exe 35 PID 2276 wrote to memory of 2548 2276 bthhnt.exe 35 PID 2276 wrote to memory of 2548 2276 bthhnt.exe 35 PID 2276 wrote to memory of 2548 2276 bthhnt.exe 35 PID 2548 wrote to memory of 3064 2548 bthntn.exe 36 PID 2548 wrote to memory of 3064 2548 bthntn.exe 36 PID 2548 wrote to memory of 3064 2548 bthntn.exe 36 PID 2548 wrote to memory of 3064 2548 bthntn.exe 36 PID 3064 wrote to memory of 2236 3064 pjpvv.exe 37 PID 3064 wrote to memory of 2236 3064 pjpvv.exe 37 PID 3064 wrote to memory of 2236 3064 pjpvv.exe 37 PID 3064 wrote to memory of 2236 3064 pjpvv.exe 37 PID 2236 wrote to memory of 2984 2236 llfrxrr.exe 38 PID 2236 wrote to memory of 2984 2236 llfrxrr.exe 38 PID 2236 wrote to memory of 2984 2236 llfrxrr.exe 38 PID 2236 wrote to memory of 2984 2236 llfrxrr.exe 38 PID 2984 wrote to memory of 3028 2984 7rxrrrf.exe 39 PID 2984 wrote to memory of 3028 2984 7rxrrrf.exe 39 PID 2984 wrote to memory of 3028 2984 7rxrrrf.exe 39 PID 2984 wrote to memory of 3028 2984 7rxrrrf.exe 39 PID 3028 wrote to memory of 2820 3028 bbnbnh.exe 40 PID 3028 wrote to memory of 2820 3028 bbnbnh.exe 40 PID 3028 wrote to memory of 2820 3028 bbnbnh.exe 40 PID 3028 wrote to memory of 2820 3028 bbnbnh.exe 40 PID 2820 wrote to memory of 348 2820 dvjpd.exe 41 PID 2820 wrote to memory of 348 2820 dvjpd.exe 41 PID 2820 wrote to memory of 348 2820 dvjpd.exe 41 PID 2820 wrote to memory of 348 2820 dvjpd.exe 41 PID 348 wrote to memory of 2600 348 vpdvj.exe 42 PID 348 wrote to memory of 2600 348 vpdvj.exe 42 PID 348 wrote to memory of 2600 348 vpdvj.exe 42 PID 348 wrote to memory of 2600 348 vpdvj.exe 42 PID 2600 wrote to memory of 2632 2600 9xrrffl.exe 43 PID 2600 wrote to memory of 2632 2600 9xrrffl.exe 43 PID 2600 wrote to memory of 2632 2600 9xrrffl.exe 43 PID 2600 wrote to memory of 2632 2600 9xrrffl.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e3d7e49296907913ab82632ec311a20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4e3d7e49296907913ab82632ec311a20_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\nnbhnh.exec:\nnbhnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\ddpvj.exec:\ddpvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\rrfrxfl.exec:\rrfrxfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\htbbbb.exec:\htbbbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\3pjpp.exec:\3pjpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\9xlfllr.exec:\9xlfllr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\bthhnt.exec:\bthhnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\bthntn.exec:\bthntn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\pjpvv.exec:\pjpvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\llfrxrr.exec:\llfrxrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\7rxrrrf.exec:\7rxrrrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\bbnbnh.exec:\bbnbnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\dvjpd.exec:\dvjpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\vpdvj.exec:\vpdvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\9xrrffl.exec:\9xrrffl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\hbntbh.exec:\hbntbh.exe17⤵
- Executes dropped EXE
PID:2632 -
\??\c:\7pjpj.exec:\7pjpj.exe18⤵
- Executes dropped EXE
PID:2756 -
\??\c:\ddddd.exec:\ddddd.exe19⤵
- Executes dropped EXE
PID:1428 -
\??\c:\xlfxxrx.exec:\xlfxxrx.exe20⤵
- Executes dropped EXE
PID:1724 -
\??\c:\tnhhnn.exec:\tnhhnn.exe21⤵
- Executes dropped EXE
PID:1708 -
\??\c:\1nhnth.exec:\1nhnth.exe22⤵
- Executes dropped EXE
PID:468 -
\??\c:\ppjpp.exec:\ppjpp.exe23⤵
- Executes dropped EXE
PID:2804 -
\??\c:\3xrrlfr.exec:\3xrrlfr.exe24⤵
- Executes dropped EXE
PID:2244 -
\??\c:\1xrrffr.exec:\1xrrffr.exe25⤵
- Executes dropped EXE
PID:1480 -
\??\c:\hbnntb.exec:\hbnntb.exe26⤵
- Executes dropped EXE
PID:1808 -
\??\c:\3jvpd.exec:\3jvpd.exe27⤵
- Executes dropped EXE
PID:1332 -
\??\c:\xrrrffr.exec:\xrrrffr.exe28⤵
- Executes dropped EXE
PID:1780 -
\??\c:\xlrfrxf.exec:\xlrfrxf.exe29⤵
- Executes dropped EXE
PID:604 -
\??\c:\btnhnn.exec:\btnhnn.exe30⤵
- Executes dropped EXE
PID:1020 -
\??\c:\bnhntn.exec:\bnhntn.exe31⤵
- Executes dropped EXE
PID:1800 -
\??\c:\1vpdv.exec:\1vpdv.exe32⤵
- Executes dropped EXE
PID:2500 -
\??\c:\xrlxxfr.exec:\xrlxxfr.exe33⤵
- Executes dropped EXE
PID:1688 -
\??\c:\5bhhnn.exec:\5bhhnn.exe34⤵
- Executes dropped EXE
PID:2024 -
\??\c:\bthnhn.exec:\bthnhn.exe35⤵
- Executes dropped EXE
PID:2456 -
\??\c:\dvpvd.exec:\dvpvd.exe36⤵
- Executes dropped EXE
PID:812 -
\??\c:\jdpvj.exec:\jdpvj.exe37⤵
- Executes dropped EXE
PID:2712 -
\??\c:\1lllrrf.exec:\1lllrrf.exe38⤵
- Executes dropped EXE
PID:2612 -
\??\c:\ntnnbb.exec:\ntnnbb.exe39⤵
- Executes dropped EXE
PID:2144 -
\??\c:\bntbhb.exec:\bntbhb.exe40⤵
- Executes dropped EXE
PID:2904 -
\??\c:\9vvjj.exec:\9vvjj.exe41⤵
- Executes dropped EXE
PID:2656 -
\??\c:\3jvvv.exec:\3jvvv.exe42⤵
- Executes dropped EXE
PID:2816 -
\??\c:\rlfrrxf.exec:\rlfrrxf.exe43⤵
- Executes dropped EXE
PID:2700 -
\??\c:\xrxlxff.exec:\xrxlxff.exe44⤵
- Executes dropped EXE
PID:2832 -
\??\c:\9hbbhh.exec:\9hbbhh.exe45⤵
- Executes dropped EXE
PID:2572 -
\??\c:\3hbhtt.exec:\3hbhtt.exe46⤵
- Executes dropped EXE
PID:2996 -
\??\c:\ddjdv.exec:\ddjdv.exe47⤵
- Executes dropped EXE
PID:1948 -
\??\c:\dvpdd.exec:\dvpdd.exe48⤵
- Executes dropped EXE
PID:2876 -
\??\c:\llffrrr.exec:\llffrrr.exe49⤵
- Executes dropped EXE
PID:3032 -
\??\c:\3frllrf.exec:\3frllrf.exe50⤵
- Executes dropped EXE
PID:2984 -
\??\c:\9bbbnn.exec:\9bbbnn.exe51⤵
- Executes dropped EXE
PID:900 -
\??\c:\htnhnt.exec:\htnhnt.exe52⤵
- Executes dropped EXE
PID:1684 -
\??\c:\vjdjp.exec:\vjdjp.exe53⤵
- Executes dropped EXE
PID:1440 -
\??\c:\jvjjj.exec:\jvjjj.exe54⤵
- Executes dropped EXE
PID:1976 -
\??\c:\rfrxffx.exec:\rfrxffx.exe55⤵
- Executes dropped EXE
PID:1900 -
\??\c:\fxlxxfl.exec:\fxlxxfl.exe56⤵
- Executes dropped EXE
PID:2632 -
\??\c:\tnbntb.exec:\tnbntb.exe57⤵
- Executes dropped EXE
PID:380 -
\??\c:\7nhbnn.exec:\7nhbnn.exe58⤵
- Executes dropped EXE
PID:1316 -
\??\c:\pjvvv.exec:\pjvvv.exe59⤵
- Executes dropped EXE
PID:1752 -
\??\c:\jdjjv.exec:\jdjjv.exe60⤵
- Executes dropped EXE
PID:1676 -
\??\c:\lfrllfl.exec:\lfrllfl.exe61⤵
- Executes dropped EXE
PID:2512 -
\??\c:\9tnthh.exec:\9tnthh.exe62⤵
- Executes dropped EXE
PID:468 -
\??\c:\9httbb.exec:\9httbb.exe63⤵
- Executes dropped EXE
PID:1312 -
\??\c:\pjppv.exec:\pjppv.exe64⤵
- Executes dropped EXE
PID:920 -
\??\c:\pjdpv.exec:\pjdpv.exe65⤵
- Executes dropped EXE
PID:1812 -
\??\c:\lxllllr.exec:\lxllllr.exe66⤵PID:2488
-
\??\c:\rlxfrxx.exec:\rlxfrxx.exe67⤵PID:1760
-
\??\c:\fxlxflr.exec:\fxlxflr.exe68⤵PID:1980
-
\??\c:\btbnnn.exec:\btbnnn.exe69⤵PID:840
-
\??\c:\3nhbbb.exec:\3nhbbb.exe70⤵PID:2392
-
\??\c:\jdvjp.exec:\jdvjp.exe71⤵PID:1860
-
\??\c:\jdvvv.exec:\jdvvv.exe72⤵PID:780
-
\??\c:\lfxfrrx.exec:\lfxfrrx.exe73⤵PID:1740
-
\??\c:\llffrxl.exec:\llffrxl.exe74⤵PID:1944
-
\??\c:\thttbh.exec:\thttbh.exe75⤵PID:1836
-
\??\c:\5tbbnn.exec:\5tbbnn.exe76⤵PID:2228
-
\??\c:\dvdjv.exec:\dvdjv.exe77⤵PID:2464
-
\??\c:\jvpvv.exec:\jvpvv.exe78⤵PID:3040
-
\??\c:\9lflrlr.exec:\9lflrlr.exe79⤵PID:2624
-
\??\c:\rfrxlfl.exec:\rfrxlfl.exe80⤵PID:2284
-
\??\c:\hhbbnt.exec:\hhbbnt.exe81⤵PID:2612
-
\??\c:\1nnntb.exec:\1nnntb.exe82⤵PID:2812
-
\??\c:\7bnbhn.exec:\7bnbhn.exe83⤵PID:2068
-
\??\c:\1jpvd.exec:\1jpvd.exe84⤵PID:2556
-
\??\c:\vpddd.exec:\vpddd.exe85⤵PID:2692
-
\??\c:\llfflxf.exec:\llfflxf.exe86⤵PID:2544
-
\??\c:\1xrrrff.exec:\1xrrrff.exe87⤵PID:2604
-
\??\c:\1hhthb.exec:\1hhthb.exe88⤵PID:2344
-
\??\c:\bhhhhn.exec:\bhhhhn.exe89⤵PID:2580
-
\??\c:\7jdpv.exec:\7jdpv.exe90⤵PID:2976
-
\??\c:\vpvjv.exec:\vpvjv.exe91⤵PID:2988
-
\??\c:\1lxfflx.exec:\1lxfflx.exe92⤵PID:2492
-
\??\c:\lxflxxr.exec:\lxflxxr.exe93⤵PID:1728
-
\??\c:\tntbbt.exec:\tntbbt.exe94⤵PID:1596
-
\??\c:\1nhbbb.exec:\1nhbbb.exe95⤵PID:800
-
\??\c:\pjpvv.exec:\pjpvv.exe96⤵PID:352
-
\??\c:\9pdpp.exec:\9pdpp.exe97⤵PID:2744
-
\??\c:\3llxrxf.exec:\3llxrxf.exe98⤵PID:1320
-
\??\c:\fxlflxx.exec:\fxlflxx.exe99⤵PID:1412
-
\??\c:\hbtthh.exec:\hbtthh.exe100⤵PID:620
-
\??\c:\tnhhtt.exec:\tnhhtt.exe101⤵PID:320
-
\??\c:\pjvvd.exec:\pjvvd.exe102⤵PID:292
-
\??\c:\pjddd.exec:\pjddd.exe103⤵PID:2912
-
\??\c:\fxllxxf.exec:\fxllxxf.exe104⤵PID:2928
-
\??\c:\rlrflfl.exec:\rlrflfl.exe105⤵PID:644
-
\??\c:\tnbhnt.exec:\tnbhnt.exe106⤵PID:1668
-
\??\c:\hbhnnb.exec:\hbhnnb.exe107⤵PID:2628
-
\??\c:\9jvdd.exec:\9jvdd.exe108⤵PID:1808
-
\??\c:\vpvdj.exec:\vpvdj.exe109⤵PID:2444
-
\??\c:\lflflrr.exec:\lflflrr.exe110⤵PID:2496
-
\??\c:\1lxxfff.exec:\1lxxfff.exe111⤵PID:1980
-
\??\c:\xrlrffx.exec:\xrlrffx.exe112⤵PID:1784
-
\??\c:\nhthtt.exec:\nhthtt.exe113⤵PID:2392
-
\??\c:\nbbhtt.exec:\nbbhtt.exe114⤵PID:2124
-
\??\c:\ppjpp.exec:\ppjpp.exe115⤵PID:2204
-
\??\c:\pjvjd.exec:\pjvjd.exe116⤵PID:2500
-
\??\c:\7xxfrrf.exec:\7xxfrrf.exe117⤵PID:1572
-
\??\c:\xlrxflr.exec:\xlrxflr.exe118⤵PID:1544
-
\??\c:\thnnnn.exec:\thnnnn.exe119⤵PID:2228
-
\??\c:\7tbntb.exec:\7tbntb.exe120⤵PID:812
-
\??\c:\vpdjj.exec:\vpdjj.exe121⤵PID:2640
-
\??\c:\1vpvv.exec:\1vpvv.exe122⤵PID:2732
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-