Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 05:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1ebf60c0cfb3947ce82c66b3ef5b2020_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
1ebf60c0cfb3947ce82c66b3ef5b2020_NeikiAnalytics.exe
-
Size
62KB
-
MD5
1ebf60c0cfb3947ce82c66b3ef5b2020
-
SHA1
928d93df72d5ef691cdcb49e8d3d715c57676952
-
SHA256
24e8254dc2bf7b061be0f0988e0a9a553e3e13c11d23ff476079d95fc469f6f3
-
SHA512
f4948f2dfc4f5d87e61c0b175f64f8419bf91872c0a6926fe7e529518754c503aea3db68f36ca965d775fa6657fbd4134f1b497b1ad5a0fa6d45ec9e8504b756
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDISoFGDa:ymb3NkkiQ3mdBjFIk+
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/2924-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/928-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/852-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1960-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/536-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1116-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2092-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vpjpv.exejvvvd.exenntbbn.exepdjjv.exexrffrxr.exefrxrfxf.exetbnnbh.exevpdjp.exeppjvj.exelfxlrrf.exe7btbhb.exe1bbnht.exedvpdp.exexxlrrfx.exerrxlxfl.exenhtbhh.exe3nbhbt.exejvppj.exelrxrrxx.exe9frrrll.exetntntt.exe5vpvd.exejvjjp.exe3llrrfr.exe1lrrllx.exe7htbtn.exevjvjp.exejdvdv.exerlflllr.exe7hbbhn.exedjvdp.exepvjjj.exerffrrfx.exerxfrlxx.exe5hnntt.exe5htnnt.exe7pddv.exerfrlllr.exefrxxrlr.exeflxrxrr.exethnnnh.exe1jpdd.exejvvvj.exerlrxffl.exerfrrxfl.exethbnbh.exehbnthh.exehththh.exe9pjjj.exexrxlrxx.exefxfllll.exethbbhh.exenbhnbb.exeppvdv.exe5jvvd.exefxxfxlf.exerrlxlxl.exebnbbbh.exennhtth.exejvjjp.exe7pjdd.exexlrrxxx.exelfrrxxx.exethnntn.exepid process 2908 vpjpv.exe 2608 jvvvd.exe 2544 nntbbn.exe 2676 pdjjv.exe 2920 xrffrxr.exe 2476 frxrfxf.exe 2540 tbnnbh.exe 2892 vpdjp.exe 2636 ppjvj.exe 2648 lfxlrrf.exe 1260 7btbhb.exe 340 1bbnht.exe 2124 dvpdp.exe 1512 xxlrrfx.exe 2480 rrxlxfl.exe 928 nhtbhh.exe 852 3nbhbt.exe 2068 jvppj.exe 2192 lrxrrxx.exe 1960 9frrrll.exe 536 tntntt.exe 2840 5vpvd.exe 1412 jvjjp.exe 1116 3llrrfr.exe 2220 1lrrllx.exe 1552 7htbtn.exe 2844 vjvjp.exe 2092 jdvdv.exe 1652 rlflllr.exe 2288 7hbbhn.exe 2380 djvdp.exe 2320 pvjjj.exe 2368 rffrrfx.exe 2512 rxfrlxx.exe 1932 5hnntt.exe 2548 5htnnt.exe 2572 7pddv.exe 2536 rfrlllr.exe 2600 frxxrlr.exe 2584 flxrxrr.exe 2436 thnnnh.exe 2880 1jpdd.exe 2484 jvvvj.exe 780 rlrxffl.exe 2892 rfrrxfl.exe 2780 thbnbh.exe 1636 hbnthh.exe 2900 hththh.exe 2300 9pjjj.exe 340 xrxlrxx.exe 2124 fxfllll.exe 2460 thbbhh.exe 876 nbhnbb.exe 1188 ppvdv.exe 928 5jvvd.exe 852 fxxfxlf.exe 2236 rrlxlxl.exe 2404 bnbbbh.exe 2216 nnhtth.exe 528 jvjjp.exe 924 7pjdd.exe 2840 xlrrxxx.exe 2308 lfrrxxx.exe 2096 thnntn.exe -
Processes:
resource yara_rule behavioral1/memory/2924-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/928-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/852-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1960-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/536-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1116-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-299-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1ebf60c0cfb3947ce82c66b3ef5b2020_NeikiAnalytics.exevpjpv.exejvvvd.exenntbbn.exepdjjv.exexrffrxr.exefrxrfxf.exetbnnbh.exevpdjp.exeppjvj.exelfxlrrf.exe7btbhb.exe1bbnht.exedvpdp.exexxlrrfx.exerrxlxfl.exedescription pid process target process PID 2924 wrote to memory of 2908 2924 1ebf60c0cfb3947ce82c66b3ef5b2020_NeikiAnalytics.exe vpjpv.exe PID 2924 wrote to memory of 2908 2924 1ebf60c0cfb3947ce82c66b3ef5b2020_NeikiAnalytics.exe vpjpv.exe PID 2924 wrote to memory of 2908 2924 1ebf60c0cfb3947ce82c66b3ef5b2020_NeikiAnalytics.exe vpjpv.exe PID 2924 wrote to memory of 2908 2924 1ebf60c0cfb3947ce82c66b3ef5b2020_NeikiAnalytics.exe vpjpv.exe PID 2908 wrote to memory of 2608 2908 vpjpv.exe jvvvd.exe PID 2908 wrote to memory of 2608 2908 vpjpv.exe jvvvd.exe PID 2908 wrote to memory of 2608 2908 vpjpv.exe jvvvd.exe PID 2908 wrote to memory of 2608 2908 vpjpv.exe jvvvd.exe PID 2608 wrote to memory of 2544 2608 jvvvd.exe nntbbn.exe PID 2608 wrote to memory of 2544 2608 jvvvd.exe nntbbn.exe PID 2608 wrote to memory of 2544 2608 jvvvd.exe nntbbn.exe PID 2608 wrote to memory of 2544 2608 jvvvd.exe nntbbn.exe PID 2544 wrote to memory of 2676 2544 nntbbn.exe pdjjv.exe PID 2544 wrote to memory of 2676 2544 nntbbn.exe pdjjv.exe PID 2544 wrote to memory of 2676 2544 nntbbn.exe pdjjv.exe PID 2544 wrote to memory of 2676 2544 nntbbn.exe pdjjv.exe PID 2676 wrote to memory of 2920 2676 pdjjv.exe xrffrxr.exe PID 2676 wrote to memory of 2920 2676 pdjjv.exe xrffrxr.exe PID 2676 wrote to memory of 2920 2676 pdjjv.exe xrffrxr.exe PID 2676 wrote to memory of 2920 2676 pdjjv.exe xrffrxr.exe PID 2920 wrote to memory of 2476 2920 xrffrxr.exe frxrfxf.exe PID 2920 wrote to memory of 2476 2920 xrffrxr.exe frxrfxf.exe PID 2920 wrote to memory of 2476 2920 xrffrxr.exe frxrfxf.exe PID 2920 wrote to memory of 2476 2920 xrffrxr.exe frxrfxf.exe PID 2476 wrote to memory of 2540 2476 frxrfxf.exe tbnnbh.exe PID 2476 wrote to memory of 2540 2476 frxrfxf.exe tbnnbh.exe PID 2476 wrote to memory of 2540 2476 frxrfxf.exe tbnnbh.exe PID 2476 wrote to memory of 2540 2476 frxrfxf.exe tbnnbh.exe PID 2540 wrote to memory of 2892 2540 tbnnbh.exe vpdjp.exe PID 2540 wrote to memory of 2892 2540 tbnnbh.exe vpdjp.exe PID 2540 wrote to memory of 2892 2540 tbnnbh.exe vpdjp.exe PID 2540 wrote to memory of 2892 2540 tbnnbh.exe vpdjp.exe PID 2892 wrote to memory of 2636 2892 vpdjp.exe ppjvj.exe PID 2892 wrote to memory of 2636 2892 vpdjp.exe ppjvj.exe PID 2892 wrote to memory of 2636 2892 vpdjp.exe ppjvj.exe PID 2892 wrote to memory of 2636 2892 vpdjp.exe ppjvj.exe PID 2636 wrote to memory of 2648 2636 ppjvj.exe lfxlrrf.exe PID 2636 wrote to memory of 2648 2636 ppjvj.exe lfxlrrf.exe PID 2636 wrote to memory of 2648 2636 ppjvj.exe lfxlrrf.exe PID 2636 wrote to memory of 2648 2636 ppjvj.exe lfxlrrf.exe PID 2648 wrote to memory of 1260 2648 lfxlrrf.exe 7btbhb.exe PID 2648 wrote to memory of 1260 2648 lfxlrrf.exe 7btbhb.exe PID 2648 wrote to memory of 1260 2648 lfxlrrf.exe 7btbhb.exe PID 2648 wrote to memory of 1260 2648 lfxlrrf.exe 7btbhb.exe PID 1260 wrote to memory of 340 1260 7btbhb.exe 1bbnht.exe PID 1260 wrote to memory of 340 1260 7btbhb.exe 1bbnht.exe PID 1260 wrote to memory of 340 1260 7btbhb.exe 1bbnht.exe PID 1260 wrote to memory of 340 1260 7btbhb.exe 1bbnht.exe PID 340 wrote to memory of 2124 340 1bbnht.exe dvpdp.exe PID 340 wrote to memory of 2124 340 1bbnht.exe dvpdp.exe PID 340 wrote to memory of 2124 340 1bbnht.exe dvpdp.exe PID 340 wrote to memory of 2124 340 1bbnht.exe dvpdp.exe PID 2124 wrote to memory of 1512 2124 dvpdp.exe xxlrrfx.exe PID 2124 wrote to memory of 1512 2124 dvpdp.exe xxlrrfx.exe PID 2124 wrote to memory of 1512 2124 dvpdp.exe xxlrrfx.exe PID 2124 wrote to memory of 1512 2124 dvpdp.exe xxlrrfx.exe PID 1512 wrote to memory of 2480 1512 xxlrrfx.exe rrxlxfl.exe PID 1512 wrote to memory of 2480 1512 xxlrrfx.exe rrxlxfl.exe PID 1512 wrote to memory of 2480 1512 xxlrrfx.exe rrxlxfl.exe PID 1512 wrote to memory of 2480 1512 xxlrrfx.exe rrxlxfl.exe PID 2480 wrote to memory of 928 2480 rrxlxfl.exe nhtbhh.exe PID 2480 wrote to memory of 928 2480 rrxlxfl.exe nhtbhh.exe PID 2480 wrote to memory of 928 2480 rrxlxfl.exe nhtbhh.exe PID 2480 wrote to memory of 928 2480 rrxlxfl.exe nhtbhh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ebf60c0cfb3947ce82c66b3ef5b2020_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1ebf60c0cfb3947ce82c66b3ef5b2020_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\vpjpv.exec:\vpjpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\jvvvd.exec:\jvvvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\nntbbn.exec:\nntbbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\pdjjv.exec:\pdjjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\xrffrxr.exec:\xrffrxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\frxrfxf.exec:\frxrfxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\tbnnbh.exec:\tbnnbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\vpdjp.exec:\vpdjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\ppjvj.exec:\ppjvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\lfxlrrf.exec:\lfxlrrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\7btbhb.exec:\7btbhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\1bbnht.exec:\1bbnht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:340 -
\??\c:\dvpdp.exec:\dvpdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\xxlrrfx.exec:\xxlrrfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\rrxlxfl.exec:\rrxlxfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\nhtbhh.exec:\nhtbhh.exe17⤵
- Executes dropped EXE
PID:928 -
\??\c:\3nbhbt.exec:\3nbhbt.exe18⤵
- Executes dropped EXE
PID:852 -
\??\c:\jvppj.exec:\jvppj.exe19⤵
- Executes dropped EXE
PID:2068 -
\??\c:\lrxrrxx.exec:\lrxrrxx.exe20⤵
- Executes dropped EXE
PID:2192 -
\??\c:\9frrrll.exec:\9frrrll.exe21⤵
- Executes dropped EXE
PID:1960 -
\??\c:\tntntt.exec:\tntntt.exe22⤵
- Executes dropped EXE
PID:536 -
\??\c:\5vpvd.exec:\5vpvd.exe23⤵
- Executes dropped EXE
PID:2840 -
\??\c:\jvjjp.exec:\jvjjp.exe24⤵
- Executes dropped EXE
PID:1412 -
\??\c:\3llrrfr.exec:\3llrrfr.exe25⤵
- Executes dropped EXE
PID:1116 -
\??\c:\1lrrllx.exec:\1lrrllx.exe26⤵
- Executes dropped EXE
PID:2220 -
\??\c:\7htbtn.exec:\7htbtn.exe27⤵
- Executes dropped EXE
PID:1552 -
\??\c:\vjvjp.exec:\vjvjp.exe28⤵
- Executes dropped EXE
PID:2844 -
\??\c:\jdvdv.exec:\jdvdv.exe29⤵
- Executes dropped EXE
PID:2092 -
\??\c:\rlflllr.exec:\rlflllr.exe30⤵
- Executes dropped EXE
PID:1652 -
\??\c:\7hbbhn.exec:\7hbbhn.exe31⤵
- Executes dropped EXE
PID:2288 -
\??\c:\djvdp.exec:\djvdp.exe32⤵
- Executes dropped EXE
PID:2380 -
\??\c:\pvjjj.exec:\pvjjj.exe33⤵
- Executes dropped EXE
PID:2320 -
\??\c:\rffrrfx.exec:\rffrrfx.exe34⤵
- Executes dropped EXE
PID:2368 -
\??\c:\rxfrlxx.exec:\rxfrlxx.exe35⤵
- Executes dropped EXE
PID:2512 -
\??\c:\5hnntt.exec:\5hnntt.exe36⤵
- Executes dropped EXE
PID:1932 -
\??\c:\5htnnt.exec:\5htnnt.exe37⤵
- Executes dropped EXE
PID:2548 -
\??\c:\7pddv.exec:\7pddv.exe38⤵
- Executes dropped EXE
PID:2572 -
\??\c:\rfrlllr.exec:\rfrlllr.exe39⤵
- Executes dropped EXE
PID:2536 -
\??\c:\frxxrlr.exec:\frxxrlr.exe40⤵
- Executes dropped EXE
PID:2600 -
\??\c:\flxrxrr.exec:\flxrxrr.exe41⤵
- Executes dropped EXE
PID:2584 -
\??\c:\thnnnh.exec:\thnnnh.exe42⤵
- Executes dropped EXE
PID:2436 -
\??\c:\1jpdd.exec:\1jpdd.exe43⤵
- Executes dropped EXE
PID:2880 -
\??\c:\jvvvj.exec:\jvvvj.exe44⤵
- Executes dropped EXE
PID:2484 -
\??\c:\rlrxffl.exec:\rlrxffl.exe45⤵
- Executes dropped EXE
PID:780 -
\??\c:\rfrrxfl.exec:\rfrrxfl.exe46⤵
- Executes dropped EXE
PID:2892 -
\??\c:\thbnbh.exec:\thbnbh.exe47⤵
- Executes dropped EXE
PID:2780 -
\??\c:\hbnthh.exec:\hbnthh.exe48⤵
- Executes dropped EXE
PID:1636 -
\??\c:\hththh.exec:\hththh.exe49⤵
- Executes dropped EXE
PID:2900 -
\??\c:\9pjjj.exec:\9pjjj.exe50⤵
- Executes dropped EXE
PID:2300 -
\??\c:\xrxlrxx.exec:\xrxlrxx.exe51⤵
- Executes dropped EXE
PID:340 -
\??\c:\fxfllll.exec:\fxfllll.exe52⤵
- Executes dropped EXE
PID:2124 -
\??\c:\thbbhh.exec:\thbbhh.exe53⤵
- Executes dropped EXE
PID:2460 -
\??\c:\nbhnbb.exec:\nbhnbb.exe54⤵
- Executes dropped EXE
PID:876 -
\??\c:\ppvdv.exec:\ppvdv.exe55⤵
- Executes dropped EXE
PID:1188 -
\??\c:\5jvvd.exec:\5jvvd.exe56⤵
- Executes dropped EXE
PID:928 -
\??\c:\fxxfxlf.exec:\fxxfxlf.exe57⤵
- Executes dropped EXE
PID:852 -
\??\c:\rrlxlxl.exec:\rrlxlxl.exe58⤵
- Executes dropped EXE
PID:2236 -
\??\c:\bnbbbh.exec:\bnbbbh.exe59⤵
- Executes dropped EXE
PID:2404 -
\??\c:\nnhtth.exec:\nnhtth.exe60⤵
- Executes dropped EXE
PID:2216 -
\??\c:\jvjjp.exec:\jvjjp.exe61⤵
- Executes dropped EXE
PID:528 -
\??\c:\7pjdd.exec:\7pjdd.exe62⤵
- Executes dropped EXE
PID:924 -
\??\c:\xlrrxxx.exec:\xlrrxxx.exe63⤵
- Executes dropped EXE
PID:2840 -
\??\c:\lfrrxxx.exec:\lfrrxxx.exe64⤵
- Executes dropped EXE
PID:2308 -
\??\c:\thnntn.exec:\thnntn.exe65⤵
- Executes dropped EXE
PID:2096 -
\??\c:\hnbnbn.exec:\hnbnbn.exe66⤵PID:992
-
\??\c:\vjvpp.exec:\vjvpp.exe67⤵PID:828
-
\??\c:\pjvpp.exec:\pjvpp.exe68⤵PID:280
-
\??\c:\3rlxxxf.exec:\3rlxxxf.exe69⤵PID:652
-
\??\c:\rrlrxfx.exec:\rrlrxfx.exe70⤵PID:1060
-
\??\c:\hbhbth.exec:\hbhbth.exe71⤵PID:1900
-
\??\c:\tbhbbb.exec:\tbhbbb.exe72⤵PID:2276
-
\??\c:\3jvpp.exec:\3jvpp.exe73⤵PID:1444
-
\??\c:\3jvdp.exec:\3jvdp.exe74⤵PID:1440
-
\??\c:\lxlflrx.exec:\lxlflrx.exe75⤵PID:2132
-
\??\c:\rfxxfxf.exec:\rfxxfxf.exe76⤵PID:2060
-
\??\c:\tnnhhn.exec:\tnnhhn.exe77⤵PID:1540
-
\??\c:\3thbbb.exec:\3thbbb.exe78⤵PID:1532
-
\??\c:\dpddj.exec:\dpddj.exe79⤵PID:2564
-
\??\c:\3vdpj.exec:\3vdpj.exe80⤵PID:2028
-
\??\c:\7vvvp.exec:\7vvvp.exe81⤵PID:2572
-
\??\c:\rffffff.exec:\rffffff.exe82⤵PID:2680
-
\??\c:\rfrrlxx.exec:\rfrrlxx.exe83⤵PID:2600
-
\??\c:\hntbbt.exec:\hntbbt.exe84⤵PID:2432
-
\??\c:\1bnhhb.exec:\1bnhhb.exe85⤵PID:2436
-
\??\c:\tttbtn.exec:\tttbtn.exe86⤵PID:2452
-
\??\c:\dvddv.exec:\dvddv.exe87⤵PID:2496
-
\??\c:\dpjjd.exec:\dpjjd.exe88⤵PID:2116
-
\??\c:\9xfrrlr.exec:\9xfrrlr.exe89⤵PID:2892
-
\??\c:\lfrxfxl.exec:\lfrxfxl.exe90⤵PID:2788
-
\??\c:\1bhthn.exec:\1bhthn.exe91⤵PID:1636
-
\??\c:\hbntbh.exec:\hbntbh.exe92⤵PID:1044
-
\??\c:\jpjvp.exec:\jpjvp.exe93⤵PID:2300
-
\??\c:\pddjp.exec:\pddjp.exe94⤵PID:1752
-
\??\c:\lfxlrrr.exec:\lfxlrrr.exe95⤵PID:1192
-
\??\c:\3rlfllr.exec:\3rlfllr.exe96⤵PID:284
-
\??\c:\nhnntn.exec:\nhnntn.exe97⤵PID:876
-
\??\c:\btttnn.exec:\btttnn.exe98⤵PID:1188
-
\??\c:\hbbtnh.exec:\hbbtnh.exe99⤵PID:2036
-
\??\c:\jjpdv.exec:\jjpdv.exe100⤵PID:2516
-
\??\c:\jvjvv.exec:\jvjvv.exe101⤵PID:2236
-
\??\c:\frlfrrx.exec:\frlfrrx.exe102⤵PID:1628
-
\??\c:\3xrxlxf.exec:\3xrxlxf.exe103⤵PID:2756
-
\??\c:\tnttnb.exec:\tnttnb.exe104⤵PID:692
-
\??\c:\hbbbnn.exec:\hbbbnn.exe105⤵PID:924
-
\??\c:\9vdpp.exec:\9vdpp.exe106⤵PID:596
-
\??\c:\vppdv.exec:\vppdv.exe107⤵PID:2308
-
\??\c:\vvddd.exec:\vvddd.exe108⤵PID:860
-
\??\c:\9frrrxf.exec:\9frrrxf.exe109⤵PID:1112
-
\??\c:\lrxrlfx.exec:\lrxrlfx.exe110⤵PID:1684
-
\??\c:\rfllrfr.exec:\rfllrfr.exe111⤵PID:1368
-
\??\c:\hthhhh.exec:\hthhhh.exe112⤵PID:2108
-
\??\c:\nbbhhn.exec:\nbbhhn.exe113⤵PID:1060
-
\??\c:\5pdvv.exec:\5pdvv.exe114⤵PID:2324
-
\??\c:\jvpjv.exec:\jvpjv.exe115⤵PID:2276
-
\??\c:\xllrxrr.exec:\xllrxrr.exe116⤵PID:3064
-
\??\c:\xxxlrxr.exec:\xxxlrxr.exe117⤵PID:1676
-
\??\c:\9htttn.exec:\9htttn.exe118⤵PID:2316
-
\??\c:\tnbbtb.exec:\tnbbtb.exe119⤵PID:2980
-
\??\c:\dpdvp.exec:\dpdvp.exe120⤵PID:3024
-
\??\c:\1ddvv.exec:\1ddvv.exe121⤵PID:2664
-
\??\c:\xllxxxl.exec:\xllxxxl.exe122⤵PID:2808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-