Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 21:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3f9749336d3c821526de4a61502a1cd0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
3f9749336d3c821526de4a61502a1cd0_NeikiAnalytics.exe
-
Size
55KB
-
MD5
3f9749336d3c821526de4a61502a1cd0
-
SHA1
23d1e7b3540c250946fdded77d56879eda2767aa
-
SHA256
3d413113005b2b2714358ce0d10600bfb0b08cb87d618afa98832d212fb421c3
-
SHA512
db2d7f7ace3c8ee294abb71d3b1bcedebdae0d0276d25455030d17c5f42c61b5c2662132ec0691df6d0751b46e781439f3ba522b1ce4bc91c7d4497410ad0329
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0chVn+:ymb3NkkiQ3mdBjF0cr+
Malware Config
Signatures
-
Detect Blackmoon payload 17 IoCs
Processes:
resource yara_rule behavioral1/memory/2384-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2164-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1832-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1376-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1980-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2136-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/700-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1556-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2360-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
7frlxlx.exentbbbn.exejjdpv.exelffrfll.exexxrfrxf.exe5tnhnb.exetnbhbh.exe5vpvv.exeffxfrfr.exe3frxxfx.exe5bttbb.exe9bbthh.exejddpd.exexfrrflx.exellflfrr.exebbtbtn.exehhnnbh.exepvpjp.exevpvdj.exellxlrxl.exetthnhh.exettnhth.exe1pppd.exevdpdj.exefflxffl.exexfrxlrx.exenhbnbh.exehnhthb.exepjdjp.exexxrrflx.exehhbntn.exeththnt.exe3pvvp.exepvvpp.exellxfrrx.exe1fxlfll.exehhbthb.exetbnhnh.exeppvjp.exevjjdd.exerlrrxxl.exe3xxfrxl.exehbnnth.exejpdvd.exe9vjpd.exefrflllx.exeffrxlrx.exetnhthn.exehhbnnb.exe7pjpp.exejvjjj.exerrffrrf.exellrfxfl.exehhttbt.exe1hnnbh.exe5vjdp.exe1dppv.exeflfxffx.exerflffff.exe1nhtbb.exettnbtb.exepdvvv.exevvpvd.exefxlrfxl.exepid process 2384 7frlxlx.exe 3024 ntbbbn.exe 2568 jjdpv.exe 2580 lffrfll.exe 2600 xxrfrxf.exe 2732 5tnhnb.exe 2612 tnbhbh.exe 2468 5vpvv.exe 2644 ffxfrfr.exe 2164 3frxxfx.exe 2512 5bttbb.exe 1832 9bbthh.exe 1376 jddpd.exe 1980 xfrrflx.exe 1668 llflfrr.exe 2688 bbtbtn.exe 932 hhnnbh.exe 2272 pvpjp.exe 2136 vpvdj.exe 2096 llxlrxl.exe 2244 tthnhh.exe 700 ttnhth.exe 968 1pppd.exe 1912 vdpdj.exe 1556 fflxffl.exe 616 xfrxlrx.exe 400 nhbnbh.exe 1660 hnhthb.exe 2360 pjdjp.exe 2340 xxrrflx.exe 1180 hhbntn.exe 2320 ththnt.exe 2384 3pvvp.exe 2160 pvvpp.exe 1724 llxfrrx.exe 3008 1fxlfll.exe 2692 hhbthb.exe 2720 tbnhnh.exe 2628 ppvjp.exe 2736 vjjdd.exe 2788 rlrrxxl.exe 2528 3xxfrxl.exe 2476 hbnnth.exe 1624 jpdvd.exe 2548 9vjpd.exe 2924 frflllx.exe 2036 ffrxlrx.exe 1480 tnhthn.exe 816 hhbnnb.exe 1796 7pjpp.exe 764 jvjjj.exe 2676 rrffrrf.exe 1692 llrfxfl.exe 1776 hhttbt.exe 1712 1hnnbh.exe 2188 5vjdp.exe 2300 1dppv.exe 1752 flfxffx.exe 536 rflffff.exe 2128 1nhtbb.exe 684 ttnbtb.exe 348 pdvvv.exe 2452 vvpvd.exe 1124 fxlrfxl.exe -
Processes:
resource yara_rule behavioral1/memory/2888-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2164-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1832-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1376-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1980-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2136-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/700-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-277-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3f9749336d3c821526de4a61502a1cd0_NeikiAnalytics.exe7frlxlx.exentbbbn.exejjdpv.exelffrfll.exexxrfrxf.exe5tnhnb.exetnbhbh.exe5vpvv.exeffxfrfr.exe3frxxfx.exe5bttbb.exe9bbthh.exejddpd.exexfrrflx.exellflfrr.exedescription pid process target process PID 2888 wrote to memory of 2384 2888 3f9749336d3c821526de4a61502a1cd0_NeikiAnalytics.exe 7frlxlx.exe PID 2888 wrote to memory of 2384 2888 3f9749336d3c821526de4a61502a1cd0_NeikiAnalytics.exe 7frlxlx.exe PID 2888 wrote to memory of 2384 2888 3f9749336d3c821526de4a61502a1cd0_NeikiAnalytics.exe 7frlxlx.exe PID 2888 wrote to memory of 2384 2888 3f9749336d3c821526de4a61502a1cd0_NeikiAnalytics.exe 7frlxlx.exe PID 2384 wrote to memory of 3024 2384 7frlxlx.exe ntbbbn.exe PID 2384 wrote to memory of 3024 2384 7frlxlx.exe ntbbbn.exe PID 2384 wrote to memory of 3024 2384 7frlxlx.exe ntbbbn.exe PID 2384 wrote to memory of 3024 2384 7frlxlx.exe ntbbbn.exe PID 3024 wrote to memory of 2568 3024 ntbbbn.exe jjdpv.exe PID 3024 wrote to memory of 2568 3024 ntbbbn.exe jjdpv.exe PID 3024 wrote to memory of 2568 3024 ntbbbn.exe jjdpv.exe PID 3024 wrote to memory of 2568 3024 ntbbbn.exe jjdpv.exe PID 2568 wrote to memory of 2580 2568 jjdpv.exe lffrfll.exe PID 2568 wrote to memory of 2580 2568 jjdpv.exe lffrfll.exe PID 2568 wrote to memory of 2580 2568 jjdpv.exe lffrfll.exe PID 2568 wrote to memory of 2580 2568 jjdpv.exe lffrfll.exe PID 2580 wrote to memory of 2600 2580 lffrfll.exe xxrfrxf.exe PID 2580 wrote to memory of 2600 2580 lffrfll.exe xxrfrxf.exe PID 2580 wrote to memory of 2600 2580 lffrfll.exe xxrfrxf.exe PID 2580 wrote to memory of 2600 2580 lffrfll.exe xxrfrxf.exe PID 2600 wrote to memory of 2732 2600 xxrfrxf.exe 5tnhnb.exe PID 2600 wrote to memory of 2732 2600 xxrfrxf.exe 5tnhnb.exe PID 2600 wrote to memory of 2732 2600 xxrfrxf.exe 5tnhnb.exe PID 2600 wrote to memory of 2732 2600 xxrfrxf.exe 5tnhnb.exe PID 2732 wrote to memory of 2612 2732 5tnhnb.exe tnbhbh.exe PID 2732 wrote to memory of 2612 2732 5tnhnb.exe tnbhbh.exe PID 2732 wrote to memory of 2612 2732 5tnhnb.exe tnbhbh.exe PID 2732 wrote to memory of 2612 2732 5tnhnb.exe tnbhbh.exe PID 2612 wrote to memory of 2468 2612 tnbhbh.exe 5vpvv.exe PID 2612 wrote to memory of 2468 2612 tnbhbh.exe 5vpvv.exe PID 2612 wrote to memory of 2468 2612 tnbhbh.exe 5vpvv.exe PID 2612 wrote to memory of 2468 2612 tnbhbh.exe 5vpvv.exe PID 2468 wrote to memory of 2644 2468 5vpvv.exe ffxfrfr.exe PID 2468 wrote to memory of 2644 2468 5vpvv.exe ffxfrfr.exe PID 2468 wrote to memory of 2644 2468 5vpvv.exe ffxfrfr.exe PID 2468 wrote to memory of 2644 2468 5vpvv.exe ffxfrfr.exe PID 2644 wrote to memory of 2164 2644 ffxfrfr.exe 3frxxfx.exe PID 2644 wrote to memory of 2164 2644 ffxfrfr.exe 3frxxfx.exe PID 2644 wrote to memory of 2164 2644 ffxfrfr.exe 3frxxfx.exe PID 2644 wrote to memory of 2164 2644 ffxfrfr.exe 3frxxfx.exe PID 2164 wrote to memory of 2512 2164 3frxxfx.exe 5bttbb.exe PID 2164 wrote to memory of 2512 2164 3frxxfx.exe 5bttbb.exe PID 2164 wrote to memory of 2512 2164 3frxxfx.exe 5bttbb.exe PID 2164 wrote to memory of 2512 2164 3frxxfx.exe 5bttbb.exe PID 2512 wrote to memory of 1832 2512 5bttbb.exe 9bbthh.exe PID 2512 wrote to memory of 1832 2512 5bttbb.exe 9bbthh.exe PID 2512 wrote to memory of 1832 2512 5bttbb.exe 9bbthh.exe PID 2512 wrote to memory of 1832 2512 5bttbb.exe 9bbthh.exe PID 1832 wrote to memory of 1376 1832 9bbthh.exe jddpd.exe PID 1832 wrote to memory of 1376 1832 9bbthh.exe jddpd.exe PID 1832 wrote to memory of 1376 1832 9bbthh.exe jddpd.exe PID 1832 wrote to memory of 1376 1832 9bbthh.exe jddpd.exe PID 1376 wrote to memory of 1980 1376 jddpd.exe xfrrflx.exe PID 1376 wrote to memory of 1980 1376 jddpd.exe xfrrflx.exe PID 1376 wrote to memory of 1980 1376 jddpd.exe xfrrflx.exe PID 1376 wrote to memory of 1980 1376 jddpd.exe xfrrflx.exe PID 1980 wrote to memory of 1668 1980 xfrrflx.exe llflfrr.exe PID 1980 wrote to memory of 1668 1980 xfrrflx.exe llflfrr.exe PID 1980 wrote to memory of 1668 1980 xfrrflx.exe llflfrr.exe PID 1980 wrote to memory of 1668 1980 xfrrflx.exe llflfrr.exe PID 1668 wrote to memory of 2688 1668 llflfrr.exe bbtbtn.exe PID 1668 wrote to memory of 2688 1668 llflfrr.exe bbtbtn.exe PID 1668 wrote to memory of 2688 1668 llflfrr.exe bbtbtn.exe PID 1668 wrote to memory of 2688 1668 llflfrr.exe bbtbtn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f9749336d3c821526de4a61502a1cd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3f9749336d3c821526de4a61502a1cd0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\7frlxlx.exec:\7frlxlx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\ntbbbn.exec:\ntbbbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\jjdpv.exec:\jjdpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\lffrfll.exec:\lffrfll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\xxrfrxf.exec:\xxrfrxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\5tnhnb.exec:\5tnhnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\tnbhbh.exec:\tnbhbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\5vpvv.exec:\5vpvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\ffxfrfr.exec:\ffxfrfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\3frxxfx.exec:\3frxxfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\5bttbb.exec:\5bttbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\9bbthh.exec:\9bbthh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\jddpd.exec:\jddpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\xfrrflx.exec:\xfrrflx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\llflfrr.exec:\llflfrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\bbtbtn.exec:\bbtbtn.exe17⤵
- Executes dropped EXE
PID:2688 -
\??\c:\hhnnbh.exec:\hhnnbh.exe18⤵
- Executes dropped EXE
PID:932 -
\??\c:\pvpjp.exec:\pvpjp.exe19⤵
- Executes dropped EXE
PID:2272 -
\??\c:\vpvdj.exec:\vpvdj.exe20⤵
- Executes dropped EXE
PID:2136 -
\??\c:\llxlrxl.exec:\llxlrxl.exe21⤵
- Executes dropped EXE
PID:2096 -
\??\c:\tthnhh.exec:\tthnhh.exe22⤵
- Executes dropped EXE
PID:2244 -
\??\c:\ttnhth.exec:\ttnhth.exe23⤵
- Executes dropped EXE
PID:700 -
\??\c:\1pppd.exec:\1pppd.exe24⤵
- Executes dropped EXE
PID:968 -
\??\c:\vdpdj.exec:\vdpdj.exe25⤵
- Executes dropped EXE
PID:1912 -
\??\c:\fflxffl.exec:\fflxffl.exe26⤵
- Executes dropped EXE
PID:1556 -
\??\c:\xfrxlrx.exec:\xfrxlrx.exe27⤵
- Executes dropped EXE
PID:616 -
\??\c:\nhbnbh.exec:\nhbnbh.exe28⤵
- Executes dropped EXE
PID:400 -
\??\c:\hnhthb.exec:\hnhthb.exe29⤵
- Executes dropped EXE
PID:1660 -
\??\c:\pjdjp.exec:\pjdjp.exe30⤵
- Executes dropped EXE
PID:2360 -
\??\c:\xxrrflx.exec:\xxrrflx.exe31⤵
- Executes dropped EXE
PID:2340 -
\??\c:\hhbntn.exec:\hhbntn.exe32⤵
- Executes dropped EXE
PID:1180 -
\??\c:\ththnt.exec:\ththnt.exe33⤵
- Executes dropped EXE
PID:2320 -
\??\c:\3pvvp.exec:\3pvvp.exe34⤵
- Executes dropped EXE
PID:2384 -
\??\c:\pvvpp.exec:\pvvpp.exe35⤵
- Executes dropped EXE
PID:2160 -
\??\c:\llxfrrx.exec:\llxfrrx.exe36⤵
- Executes dropped EXE
PID:1724 -
\??\c:\1fxlfll.exec:\1fxlfll.exe37⤵
- Executes dropped EXE
PID:3008 -
\??\c:\hhbthb.exec:\hhbthb.exe38⤵
- Executes dropped EXE
PID:2692 -
\??\c:\tbnhnh.exec:\tbnhnh.exe39⤵
- Executes dropped EXE
PID:2720 -
\??\c:\ppvjp.exec:\ppvjp.exe40⤵
- Executes dropped EXE
PID:2628 -
\??\c:\vjjdd.exec:\vjjdd.exe41⤵
- Executes dropped EXE
PID:2736 -
\??\c:\rlrrxxl.exec:\rlrrxxl.exe42⤵
- Executes dropped EXE
PID:2788 -
\??\c:\3xxfrxl.exec:\3xxfrxl.exe43⤵
- Executes dropped EXE
PID:2528 -
\??\c:\hbnnth.exec:\hbnnth.exe44⤵
- Executes dropped EXE
PID:2476 -
\??\c:\jpdvd.exec:\jpdvd.exe45⤵
- Executes dropped EXE
PID:1624 -
\??\c:\9vjpd.exec:\9vjpd.exe46⤵
- Executes dropped EXE
PID:2548 -
\??\c:\frflllx.exec:\frflllx.exe47⤵
- Executes dropped EXE
PID:2924 -
\??\c:\ffrxlrx.exec:\ffrxlrx.exe48⤵
- Executes dropped EXE
PID:2036 -
\??\c:\tnhthn.exec:\tnhthn.exe49⤵
- Executes dropped EXE
PID:1480 -
\??\c:\hhbnnb.exec:\hhbnnb.exe50⤵
- Executes dropped EXE
PID:816 -
\??\c:\7pjpp.exec:\7pjpp.exe51⤵
- Executes dropped EXE
PID:1796 -
\??\c:\jvjjj.exec:\jvjjj.exe52⤵
- Executes dropped EXE
PID:764 -
\??\c:\rrffrrf.exec:\rrffrrf.exe53⤵
- Executes dropped EXE
PID:2676 -
\??\c:\llrfxfl.exec:\llrfxfl.exe54⤵
- Executes dropped EXE
PID:1692 -
\??\c:\hhttbt.exec:\hhttbt.exe55⤵
- Executes dropped EXE
PID:1776 -
\??\c:\1hnnbh.exec:\1hnnbh.exe56⤵
- Executes dropped EXE
PID:1712 -
\??\c:\5vjdp.exec:\5vjdp.exe57⤵
- Executes dropped EXE
PID:2188 -
\??\c:\1dppv.exec:\1dppv.exe58⤵
- Executes dropped EXE
PID:2300 -
\??\c:\flfxffx.exec:\flfxffx.exe59⤵
- Executes dropped EXE
PID:1752 -
\??\c:\rflffff.exec:\rflffff.exe60⤵
- Executes dropped EXE
PID:536 -
\??\c:\1nhtbb.exec:\1nhtbb.exe61⤵
- Executes dropped EXE
PID:2128 -
\??\c:\ttnbtb.exec:\ttnbtb.exe62⤵
- Executes dropped EXE
PID:684 -
\??\c:\pdvvv.exec:\pdvvv.exe63⤵
- Executes dropped EXE
PID:348 -
\??\c:\vvpvd.exec:\vvpvd.exe64⤵
- Executes dropped EXE
PID:2452 -
\??\c:\fxlrfxl.exec:\fxlrfxl.exe65⤵
- Executes dropped EXE
PID:1124 -
\??\c:\lfrrfrx.exec:\lfrrfrx.exe66⤵PID:844
-
\??\c:\3vvjd.exec:\3vvjd.exe67⤵PID:1604
-
\??\c:\xrffxxl.exec:\xrffxxl.exe68⤵PID:2264
-
\??\c:\xfxrxxl.exec:\xfxrxxl.exe69⤵PID:1888
-
\??\c:\ttbhnt.exec:\ttbhnt.exe70⤵PID:1540
-
\??\c:\bnbbhh.exec:\bnbbhh.exe71⤵PID:2972
-
\??\c:\ppjpv.exec:\ppjpv.exe72⤵PID:1768
-
\??\c:\dvvvp.exec:\dvvvp.exe73⤵PID:2316
-
\??\c:\rlflxfr.exec:\rlflxfr.exe74⤵PID:2884
-
\??\c:\xxxlffr.exec:\xxxlffr.exe75⤵PID:2320
-
\??\c:\tbhnbb.exec:\tbhnbb.exe76⤵PID:2148
-
\??\c:\1hhnhb.exec:\1hhnhb.exe77⤵PID:2160
-
\??\c:\ddvpp.exec:\ddvpp.exe78⤵PID:2896
-
\??\c:\dddjj.exec:\dddjj.exe79⤵PID:3012
-
\??\c:\lxlrffr.exec:\lxlrffr.exe80⤵PID:2692
-
\??\c:\lfrxxlx.exec:\lfrxxlx.exe81⤵PID:2844
-
\??\c:\9thnbh.exec:\9thnbh.exe82⤵PID:2628
-
\??\c:\bnnhhn.exec:\bnnhhn.exe83⤵PID:2500
-
\??\c:\ppvvd.exec:\ppvvd.exe84⤵PID:2648
-
\??\c:\jpppv.exec:\jpppv.exe85⤵PID:2528
-
\??\c:\llxlrxl.exec:\llxlrxl.exe86⤵PID:2492
-
\??\c:\rfllxrx.exec:\rfllxrx.exe87⤵PID:2816
-
\??\c:\hbnnnb.exec:\hbnnnb.exe88⤵PID:2460
-
\??\c:\dvjdj.exec:\dvjdj.exe89⤵PID:2448
-
\??\c:\3dpvv.exec:\3dpvv.exe90⤵PID:2352
-
\??\c:\prfrl.exec:\prfrl.exe91⤵PID:2168
-
\??\c:\fxlrxrf.exec:\fxlrxrf.exe92⤵PID:816
-
\??\c:\rfxlrff.exec:\rfxlrff.exe93⤵PID:1780
-
\??\c:\nbnthh.exec:\nbnthh.exe94⤵PID:764
-
\??\c:\bhhhnt.exec:\bhhhnt.exe95⤵PID:2784
-
\??\c:\5pjvv.exec:\5pjvv.exe96⤵PID:2428
-
\??\c:\dvdjj.exec:\dvdjj.exe97⤵PID:2688
-
\??\c:\xlfllxl.exec:\xlfllxl.exe98⤵PID:1256
-
\??\c:\fxrlrxl.exec:\fxrlrxl.exe99⤵PID:2904
-
\??\c:\7hbbnh.exec:\7hbbnh.exe100⤵PID:2300
-
\??\c:\btnbhh.exec:\btnbhh.exe101⤵PID:1388
-
\??\c:\5bbnnn.exec:\5bbnnn.exe102⤵PID:1204
-
\??\c:\ddjpd.exec:\ddjpd.exe103⤵PID:596
-
\??\c:\9djpv.exec:\9djpv.exe104⤵PID:700
-
\??\c:\lfxrflr.exec:\lfxrflr.exe105⤵PID:1916
-
\??\c:\3frrffr.exec:\3frrffr.exe106⤵PID:2452
-
\??\c:\tbbbnn.exec:\tbbbnn.exe107⤵PID:828
-
\??\c:\vvjjp.exec:\vvjjp.exe108⤵PID:2368
-
\??\c:\7jjjp.exec:\7jjjp.exe109⤵PID:1920
-
\??\c:\dvvjv.exec:\dvvjv.exe110⤵PID:2264
-
\??\c:\rfrrrrx.exec:\rfrrrrx.exe111⤵PID:1924
-
\??\c:\xxrfffr.exec:\xxrfffr.exe112⤵PID:1324
-
\??\c:\1ffrfrf.exec:\1ffrfrf.exe113⤵PID:2004
-
\??\c:\5hbnnt.exec:\5hbnnt.exe114⤵PID:1768
-
\??\c:\tnhhbn.exec:\tnhhbn.exe115⤵PID:2200
-
\??\c:\5jdjj.exec:\5jdjj.exe116⤵PID:2948
-
\??\c:\djvpp.exec:\djvpp.exe117⤵PID:2900
-
\??\c:\frllfxf.exec:\frllfxf.exe118⤵PID:2148
-
\??\c:\lfxflrr.exec:\lfxflrr.exe119⤵PID:2604
-
\??\c:\htthtt.exec:\htthtt.exe120⤵PID:2088
-
\??\c:\5bttbt.exec:\5bttbt.exe121⤵PID:3008
-
\??\c:\nhtntt.exec:\nhtntt.exe122⤵PID:2836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-