Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
16-05-2024 20:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
28dda816ee26542b738699f8fdeda1f0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
28dda816ee26542b738699f8fdeda1f0_NeikiAnalytics.exe
-
Size
62KB
-
MD5
28dda816ee26542b738699f8fdeda1f0
-
SHA1
284f16d914964d195295d9261d0387115680678c
-
SHA256
2d9d3c45bbc5c50c88ca9d3d94b14eab5f73d7c4009b61ca5516f5203cadd92f
-
SHA512
87f5426e0464a3da5adf862ba3bbbdd8b2e18781d80e571297e272aa16cce0e32c346ea2b6ece5aeab021049cf2fc4a744a7c1b1a392a7f7d6dfaf86c8b6d9c9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8mbUhz:ymb3NkkiQ3mdBjF0yMjE
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2264-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2080-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1632-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3020-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2256-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2980-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1236-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/860-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1020-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2460 vpjpv.exe 2348 xrffrxx.exe 2600 hbnthn.exe 2756 pdjdd.exe 2748 lfxrxfl.exe 2080 xrfxffl.exe 2752 thnhnh.exe 2560 vpvjp.exe 2448 dvvjv.exe 1632 lrfflfl.exe 2584 7tnnbt.exe 2684 1hhnht.exe 2828 5vjjj.exe 2728 1dvpj.exe 2912 rlflrxf.exe 3032 bbhtbt.exe 864 nbttbh.exe 3020 1vddp.exe 2064 jdvdj.exe 2256 fxllrxf.exe 2980 lxlrrrx.exe 1236 7nhbtn.exe 2004 vpppp.exe 1740 vdpdp.exe 860 flrxxrl.exe 1744 hbnnnn.exe 288 3hnttt.exe 2144 pdpvj.exe 1020 xrxlrrr.exe 2096 7ntntb.exe 3004 hhbhnt.exe 1676 vppjp.exe 1936 pjvdp.exe 2088 3rfrlrl.exe 1736 1bnbbn.exe 2640 hthnbt.exe 2600 pjpdj.exe 2740 flxlllr.exe 2780 1frffll.exe 2520 ntnhbh.exe 1888 tnbtht.exe 2512 1pppp.exe 2944 3dpvd.exe 1704 xrffrxf.exe 1244 lfrxflf.exe 320 hhnbnt.exe 1528 1hbhtt.exe 2800 jppjj.exe 2388 dddvd.exe 1428 lxlxxlr.exe 2932 lllxxfr.exe 2844 bbthht.exe 1424 ttnhtb.exe 1292 jpddj.exe 1412 3djdj.exe 2076 frlrflx.exe 2224 tnhtbt.exe 2312 5nbhnb.exe 2256 9dvdj.exe 108 7pjvj.exe 1176 fxfxrfx.exe 772 xrlrfff.exe 1868 btntbb.exe 1780 5jpdj.exe -
resource yara_rule behavioral1/memory/2264-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1632-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1236-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/860-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1020-285-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2264 wrote to memory of 2460 2264 28dda816ee26542b738699f8fdeda1f0_NeikiAnalytics.exe 28 PID 2264 wrote to memory of 2460 2264 28dda816ee26542b738699f8fdeda1f0_NeikiAnalytics.exe 28 PID 2264 wrote to memory of 2460 2264 28dda816ee26542b738699f8fdeda1f0_NeikiAnalytics.exe 28 PID 2264 wrote to memory of 2460 2264 28dda816ee26542b738699f8fdeda1f0_NeikiAnalytics.exe 28 PID 2460 wrote to memory of 2348 2460 vpjpv.exe 29 PID 2460 wrote to memory of 2348 2460 vpjpv.exe 29 PID 2460 wrote to memory of 2348 2460 vpjpv.exe 29 PID 2460 wrote to memory of 2348 2460 vpjpv.exe 29 PID 2348 wrote to memory of 2600 2348 xrffrxx.exe 30 PID 2348 wrote to memory of 2600 2348 xrffrxx.exe 30 PID 2348 wrote to memory of 2600 2348 xrffrxx.exe 30 PID 2348 wrote to memory of 2600 2348 xrffrxx.exe 30 PID 2600 wrote to memory of 2756 2600 hbnthn.exe 31 PID 2600 wrote to memory of 2756 2600 hbnthn.exe 31 PID 2600 wrote to memory of 2756 2600 hbnthn.exe 31 PID 2600 wrote to memory of 2756 2600 hbnthn.exe 31 PID 2756 wrote to memory of 2748 2756 pdjdd.exe 32 PID 2756 wrote to memory of 2748 2756 pdjdd.exe 32 PID 2756 wrote to memory of 2748 2756 pdjdd.exe 32 PID 2756 wrote to memory of 2748 2756 pdjdd.exe 32 PID 2748 wrote to memory of 2080 2748 lfxrxfl.exe 33 PID 2748 wrote to memory of 2080 2748 lfxrxfl.exe 33 PID 2748 wrote to memory of 2080 2748 lfxrxfl.exe 33 PID 2748 wrote to memory of 2080 2748 lfxrxfl.exe 33 PID 2080 wrote to memory of 2752 2080 xrfxffl.exe 34 PID 2080 wrote to memory of 2752 2080 xrfxffl.exe 34 PID 2080 wrote to memory of 2752 2080 xrfxffl.exe 34 PID 2080 wrote to memory of 2752 2080 xrfxffl.exe 34 PID 2752 wrote to memory of 2560 2752 thnhnh.exe 35 PID 2752 wrote to memory of 2560 2752 thnhnh.exe 35 PID 2752 wrote to memory of 2560 2752 thnhnh.exe 35 PID 2752 wrote to memory of 2560 2752 thnhnh.exe 35 PID 2560 wrote to memory of 2448 2560 vpvjp.exe 36 PID 2560 wrote to memory of 2448 2560 vpvjp.exe 36 PID 2560 wrote to memory of 2448 2560 vpvjp.exe 36 PID 2560 wrote to memory of 2448 2560 vpvjp.exe 36 PID 2448 wrote to memory of 1632 2448 dvvjv.exe 37 PID 2448 wrote to memory of 1632 2448 dvvjv.exe 37 PID 2448 wrote to memory of 1632 2448 dvvjv.exe 37 PID 2448 wrote to memory of 1632 2448 dvvjv.exe 37 PID 1632 wrote to memory of 2584 1632 lrfflfl.exe 38 PID 1632 wrote to memory of 2584 1632 lrfflfl.exe 38 PID 1632 wrote to memory of 2584 1632 lrfflfl.exe 38 PID 1632 wrote to memory of 2584 1632 lrfflfl.exe 38 PID 2584 wrote to memory of 2684 2584 7tnnbt.exe 39 PID 2584 wrote to memory of 2684 2584 7tnnbt.exe 39 PID 2584 wrote to memory of 2684 2584 7tnnbt.exe 39 PID 2584 wrote to memory of 2684 2584 7tnnbt.exe 39 PID 2684 wrote to memory of 2828 2684 1hhnht.exe 40 PID 2684 wrote to memory of 2828 2684 1hhnht.exe 40 PID 2684 wrote to memory of 2828 2684 1hhnht.exe 40 PID 2684 wrote to memory of 2828 2684 1hhnht.exe 40 PID 2828 wrote to memory of 2728 2828 5vjjj.exe 41 PID 2828 wrote to memory of 2728 2828 5vjjj.exe 41 PID 2828 wrote to memory of 2728 2828 5vjjj.exe 41 PID 2828 wrote to memory of 2728 2828 5vjjj.exe 41 PID 2728 wrote to memory of 2912 2728 1dvpj.exe 42 PID 2728 wrote to memory of 2912 2728 1dvpj.exe 42 PID 2728 wrote to memory of 2912 2728 1dvpj.exe 42 PID 2728 wrote to memory of 2912 2728 1dvpj.exe 42 PID 2912 wrote to memory of 3032 2912 rlflrxf.exe 43 PID 2912 wrote to memory of 3032 2912 rlflrxf.exe 43 PID 2912 wrote to memory of 3032 2912 rlflrxf.exe 43 PID 2912 wrote to memory of 3032 2912 rlflrxf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\28dda816ee26542b738699f8fdeda1f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\28dda816ee26542b738699f8fdeda1f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\vpjpv.exec:\vpjpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\xrffrxx.exec:\xrffrxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\hbnthn.exec:\hbnthn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\pdjdd.exec:\pdjdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\lfxrxfl.exec:\lfxrxfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\xrfxffl.exec:\xrfxffl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\thnhnh.exec:\thnhnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\vpvjp.exec:\vpvjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\dvvjv.exec:\dvvjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\lrfflfl.exec:\lrfflfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\7tnnbt.exec:\7tnnbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\1hhnht.exec:\1hhnht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\5vjjj.exec:\5vjjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\1dvpj.exec:\1dvpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\rlflrxf.exec:\rlflrxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\bbhtbt.exec:\bbhtbt.exe17⤵
- Executes dropped EXE
PID:3032 -
\??\c:\nbttbh.exec:\nbttbh.exe18⤵
- Executes dropped EXE
PID:864 -
\??\c:\1vddp.exec:\1vddp.exe19⤵
- Executes dropped EXE
PID:3020 -
\??\c:\jdvdj.exec:\jdvdj.exe20⤵
- Executes dropped EXE
PID:2064 -
\??\c:\fxllrxf.exec:\fxllrxf.exe21⤵
- Executes dropped EXE
PID:2256 -
\??\c:\lxlrrrx.exec:\lxlrrrx.exe22⤵
- Executes dropped EXE
PID:2980 -
\??\c:\7nhbtn.exec:\7nhbtn.exe23⤵
- Executes dropped EXE
PID:1236 -
\??\c:\vpppp.exec:\vpppp.exe24⤵
- Executes dropped EXE
PID:2004 -
\??\c:\vdpdp.exec:\vdpdp.exe25⤵
- Executes dropped EXE
PID:1740 -
\??\c:\flrxxrl.exec:\flrxxrl.exe26⤵
- Executes dropped EXE
PID:860 -
\??\c:\hbnnnn.exec:\hbnnnn.exe27⤵
- Executes dropped EXE
PID:1744 -
\??\c:\3hnttt.exec:\3hnttt.exe28⤵
- Executes dropped EXE
PID:288 -
\??\c:\pdpvj.exec:\pdpvj.exe29⤵
- Executes dropped EXE
PID:2144 -
\??\c:\xrxlrrr.exec:\xrxlrrr.exe30⤵
- Executes dropped EXE
PID:1020 -
\??\c:\7ntntb.exec:\7ntntb.exe31⤵
- Executes dropped EXE
PID:2096 -
\??\c:\hhbhnt.exec:\hhbhnt.exe32⤵
- Executes dropped EXE
PID:3004 -
\??\c:\vppjp.exec:\vppjp.exe33⤵
- Executes dropped EXE
PID:1676 -
\??\c:\pjvdp.exec:\pjvdp.exe34⤵
- Executes dropped EXE
PID:1936 -
\??\c:\3rfrlrl.exec:\3rfrlrl.exe35⤵
- Executes dropped EXE
PID:2088 -
\??\c:\1bnbbn.exec:\1bnbbn.exe36⤵
- Executes dropped EXE
PID:1736 -
\??\c:\hthnbt.exec:\hthnbt.exe37⤵
- Executes dropped EXE
PID:2640 -
\??\c:\pjpdj.exec:\pjpdj.exe38⤵
- Executes dropped EXE
PID:2600 -
\??\c:\flxlllr.exec:\flxlllr.exe39⤵
- Executes dropped EXE
PID:2740 -
\??\c:\1frffll.exec:\1frffll.exe40⤵
- Executes dropped EXE
PID:2780 -
\??\c:\ntnhbh.exec:\ntnhbh.exe41⤵
- Executes dropped EXE
PID:2520 -
\??\c:\tnbtht.exec:\tnbtht.exe42⤵
- Executes dropped EXE
PID:1888 -
\??\c:\1pppp.exec:\1pppp.exe43⤵
- Executes dropped EXE
PID:2512 -
\??\c:\3dpvd.exec:\3dpvd.exe44⤵
- Executes dropped EXE
PID:2944 -
\??\c:\xrffrxf.exec:\xrffrxf.exe45⤵
- Executes dropped EXE
PID:1704 -
\??\c:\lfrxflf.exec:\lfrxflf.exe46⤵
- Executes dropped EXE
PID:1244 -
\??\c:\hhnbnt.exec:\hhnbnt.exe47⤵
- Executes dropped EXE
PID:320 -
\??\c:\1hbhtt.exec:\1hbhtt.exe48⤵
- Executes dropped EXE
PID:1528 -
\??\c:\jppjj.exec:\jppjj.exe49⤵
- Executes dropped EXE
PID:2800 -
\??\c:\dddvd.exec:\dddvd.exe50⤵
- Executes dropped EXE
PID:2388 -
\??\c:\lxlxxlr.exec:\lxlxxlr.exe51⤵
- Executes dropped EXE
PID:1428 -
\??\c:\lllxxfr.exec:\lllxxfr.exe52⤵
- Executes dropped EXE
PID:2932 -
\??\c:\bbthht.exec:\bbthht.exe53⤵
- Executes dropped EXE
PID:2844 -
\??\c:\ttnhtb.exec:\ttnhtb.exe54⤵
- Executes dropped EXE
PID:1424 -
\??\c:\jpddj.exec:\jpddj.exe55⤵
- Executes dropped EXE
PID:1292 -
\??\c:\3djdj.exec:\3djdj.exe56⤵
- Executes dropped EXE
PID:1412 -
\??\c:\frlrflx.exec:\frlrflx.exe57⤵
- Executes dropped EXE
PID:2076 -
\??\c:\tnhtbt.exec:\tnhtbt.exe58⤵
- Executes dropped EXE
PID:2224 -
\??\c:\5nbhnb.exec:\5nbhnb.exe59⤵
- Executes dropped EXE
PID:2312 -
\??\c:\9dvdj.exec:\9dvdj.exe60⤵
- Executes dropped EXE
PID:2256 -
\??\c:\7pjvj.exec:\7pjvj.exe61⤵
- Executes dropped EXE
PID:108 -
\??\c:\fxfxrfx.exec:\fxfxrfx.exe62⤵
- Executes dropped EXE
PID:1176 -
\??\c:\xrlrfff.exec:\xrlrfff.exe63⤵
- Executes dropped EXE
PID:772 -
\??\c:\btntbb.exec:\btntbb.exe64⤵
- Executes dropped EXE
PID:1868 -
\??\c:\5jpdj.exec:\5jpdj.exe65⤵
- Executes dropped EXE
PID:1780 -
\??\c:\pvjjd.exec:\pvjjd.exe66⤵PID:1116
-
\??\c:\3xrfflr.exec:\3xrfflr.exe67⤵PID:2060
-
\??\c:\rxfxrlf.exec:\rxfxrlf.exe68⤵PID:3008
-
\??\c:\tbtnhb.exec:\tbtnhb.exe69⤵PID:1508
-
\??\c:\7bntbh.exec:\7bntbh.exe70⤵PID:2320
-
\??\c:\vpddv.exec:\vpddv.exe71⤵PID:1756
-
\??\c:\jvdvv.exec:\jvdvv.exe72⤵PID:2096
-
\??\c:\xxrrrfl.exec:\xxrrrfl.exe73⤵PID:1544
-
\??\c:\rlfrlrr.exec:\rlfrlrr.exe74⤵PID:1572
-
\??\c:\3bhnbn.exec:\3bhnbn.exe75⤵PID:1596
-
\??\c:\nhttbb.exec:\nhttbb.exe76⤵PID:2588
-
\??\c:\vppdp.exec:\vppdp.exe77⤵PID:2620
-
\??\c:\vvjdj.exec:\vvjdj.exe78⤵PID:2700
-
\??\c:\fxxflrl.exec:\fxxflrl.exe79⤵PID:2648
-
\??\c:\rxxxxlf.exec:\rxxxxlf.exe80⤵PID:2712
-
\??\c:\nbhbbt.exec:\nbhbbt.exe81⤵PID:2672
-
\??\c:\nththn.exec:\nththn.exe82⤵PID:1080
-
\??\c:\pppdv.exec:\pppdv.exe83⤵PID:2656
-
\??\c:\jvppv.exec:\jvppv.exe84⤵PID:2540
-
\??\c:\llflrxf.exec:\llflrxf.exe85⤵PID:2536
-
\??\c:\rrrxxxl.exec:\rrrxxxl.exe86⤵PID:3068
-
\??\c:\bbnhtb.exec:\bbnhtb.exe87⤵PID:2720
-
\??\c:\hbttbh.exec:\hbttbh.exe88⤵PID:1636
-
\??\c:\ppdpv.exec:\ppdpv.exe89⤵PID:1608
-
\??\c:\pjdpp.exec:\pjdpp.exe90⤵PID:2908
-
\??\c:\9rllxfr.exec:\9rllxfr.exe91⤵PID:1352
-
\??\c:\lrrrxfl.exec:\lrrrxfl.exe92⤵PID:868
-
\??\c:\3bbhtb.exec:\3bbhtb.exe93⤵PID:2728
-
\??\c:\7ttbtb.exec:\7ttbtb.exe94⤵PID:1980
-
\??\c:\pjppj.exec:\pjppj.exe95⤵PID:2872
-
\??\c:\dvvvv.exec:\dvvvv.exe96⤵PID:1768
-
\??\c:\rrrrrxl.exec:\rrrrrxl.exe97⤵PID:3048
-
\??\c:\ffxxflr.exec:\ffxxflr.exe98⤵PID:3020
-
\??\c:\1hhtbn.exec:\1hhtbn.exe99⤵PID:2084
-
\??\c:\3tnhth.exec:\3tnhth.exe100⤵PID:2360
-
\??\c:\nhtnnb.exec:\nhtnnb.exe101⤵PID:324
-
\??\c:\5vjpv.exec:\5vjpv.exe102⤵PID:584
-
\??\c:\9vdjj.exec:\9vdjj.exe103⤵PID:2392
-
\??\c:\llxflrl.exec:\llxflrl.exe104⤵PID:1644
-
\??\c:\rlfxrfx.exec:\rlfxrfx.exe105⤵PID:1144
-
\??\c:\hhhnhn.exec:\hhhnhn.exe106⤵PID:1088
-
\??\c:\tnthht.exec:\tnthht.exe107⤵PID:2680
-
\??\c:\ttnbth.exec:\ttnbth.exe108⤵PID:1104
-
\??\c:\dpvpv.exec:\dpvpv.exe109⤵PID:3024
-
\??\c:\lllrlxl.exec:\lllrlxl.exe110⤵PID:1832
-
\??\c:\3rlxrxl.exec:\3rlxrxl.exe111⤵PID:2016
-
\??\c:\tbbthh.exec:\tbbthh.exe112⤵PID:2148
-
\??\c:\nnbnbb.exec:\nnbnbb.exe113⤵PID:2276
-
\??\c:\vddjv.exec:\vddjv.exe114⤵PID:1648
-
\??\c:\dddpd.exec:\dddpd.exe115⤵PID:1712
-
\??\c:\xxflffr.exec:\xxflffr.exe116⤵PID:2384
-
\??\c:\lfxflrx.exec:\lfxflrx.exe117⤵PID:2180
-
\??\c:\bhnbtn.exec:\bhnbtn.exe118⤵PID:2068
-
\??\c:\9ttntb.exec:\9ttntb.exe119⤵PID:2696
-
\??\c:\dvvjj.exec:\dvvjj.exe120⤵PID:2964
-
\??\c:\vppvj.exec:\vppvj.exe121⤵PID:2756
-
\??\c:\ddjpv.exec:\ddjpv.exe122⤵PID:2760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-