Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 21:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
05eeeee3d5fde450abaf3106d34638c0_NeikiAnalytics.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
05eeeee3d5fde450abaf3106d34638c0_NeikiAnalytics.exe
-
Size
128KB
-
MD5
05eeeee3d5fde450abaf3106d34638c0
-
SHA1
b4d037545e8f8349a8bfcea1982eff5970dad181
-
SHA256
502559d5d4c7dc36ddb527c3f2ca52a6fb6ff4bd3e872857d1c8b3fad03da045
-
SHA512
46589abea19fd88b553e83c9260213e6ee5682e930cdc3fcc99b4ddc4f042b14a7523c152d32cde36c8acc1d93197e2991d64fae8ec776536d35d1cf810d3f7d
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afoHvmQ+EZMYX/x6gtr:n3C9BRW0j/uVEZFJvJ
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral2/memory/1252-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1460-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1524-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4492-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3620-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/804-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1936-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4212-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4328-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1656-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3180-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4960-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2980-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2700-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1588-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5056 7jdvp.exe 1524 xrxffrr.exe 1460 rffxllf.exe 4492 5nhnbt.exe 640 jjdvp.exe 3620 rxxrrlx.exe 804 ntthbt.exe 1936 htnbth.exe 3984 xllxfxr.exe 720 9lrxflr.exe 4212 dvddv.exe 4328 fxrfrrx.exe 4036 9tbbbt.exe 1656 btnhnn.exe 4596 pdpvv.exe 5024 fffxrll.exe 4048 9vjdv.exe 3180 7ddvj.exe 4536 5xxrlrl.exe 2648 bnntnb.exe 4552 jjvpp.exe 4960 rfxrxxr.exe 2980 rxxrfff.exe 400 7hntht.exe 2396 9dvpv.exe 4288 xlrlfxx.exe 2700 9ttnnh.exe 1588 dvvvd.exe 1600 jvpdd.exe 4164 ddjdv.exe 2216 7rrxffr.exe 3636 nntbnn.exe 3736 jdpdd.exe 4144 lffxllf.exe 2084 3xrrllf.exe 2464 3bbnhh.exe 4372 tthtbt.exe 1484 jdddp.exe 2004 xfxrfxr.exe 3208 5rlflfl.exe 3352 bhbtnh.exe 4436 dpvvv.exe 652 xrrlrrr.exe 3824 nhbthh.exe 1524 pppjd.exe 532 vvpjd.exe 3348 7rrfrlr.exe 628 xrllffr.exe 4276 hhbttn.exe 880 vjpjd.exe 3280 dvjvp.exe 1032 xxrxllf.exe 3836 hntnhh.exe 4396 nntnht.exe 3716 5jjpj.exe 2020 pdpdp.exe 5016 xflrrrx.exe 1648 hnhnhh.exe 2088 tnthtt.exe 4596 9jdvd.exe 3828 vppdp.exe 4628 rlfxrrl.exe 5104 bttnnh.exe 2696 tnnhnn.exe -
resource yara_rule behavioral2/memory/1252-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1460-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1524-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4492-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3620-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/804-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1936-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4212-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4328-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1656-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3180-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4960-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2980-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2700-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1588-184-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1252 wrote to memory of 5056 1252 05eeeee3d5fde450abaf3106d34638c0_NeikiAnalytics.exe 81 PID 1252 wrote to memory of 5056 1252 05eeeee3d5fde450abaf3106d34638c0_NeikiAnalytics.exe 81 PID 1252 wrote to memory of 5056 1252 05eeeee3d5fde450abaf3106d34638c0_NeikiAnalytics.exe 81 PID 5056 wrote to memory of 1524 5056 7jdvp.exe 82 PID 5056 wrote to memory of 1524 5056 7jdvp.exe 82 PID 5056 wrote to memory of 1524 5056 7jdvp.exe 82 PID 1524 wrote to memory of 1460 1524 xrxffrr.exe 83 PID 1524 wrote to memory of 1460 1524 xrxffrr.exe 83 PID 1524 wrote to memory of 1460 1524 xrxffrr.exe 83 PID 1460 wrote to memory of 4492 1460 rffxllf.exe 84 PID 1460 wrote to memory of 4492 1460 rffxllf.exe 84 PID 1460 wrote to memory of 4492 1460 rffxllf.exe 84 PID 4492 wrote to memory of 640 4492 5nhnbt.exe 85 PID 4492 wrote to memory of 640 4492 5nhnbt.exe 85 PID 4492 wrote to memory of 640 4492 5nhnbt.exe 85 PID 640 wrote to memory of 3620 640 jjdvp.exe 86 PID 640 wrote to memory of 3620 640 jjdvp.exe 86 PID 640 wrote to memory of 3620 640 jjdvp.exe 86 PID 3620 wrote to memory of 804 3620 rxxrrlx.exe 87 PID 3620 wrote to memory of 804 3620 rxxrrlx.exe 87 PID 3620 wrote to memory of 804 3620 rxxrrlx.exe 87 PID 804 wrote to memory of 1936 804 ntthbt.exe 88 PID 804 wrote to memory of 1936 804 ntthbt.exe 88 PID 804 wrote to memory of 1936 804 ntthbt.exe 88 PID 1936 wrote to memory of 3984 1936 htnbth.exe 89 PID 1936 wrote to memory of 3984 1936 htnbth.exe 89 PID 1936 wrote to memory of 3984 1936 htnbth.exe 89 PID 3984 wrote to memory of 720 3984 xllxfxr.exe 90 PID 3984 wrote to memory of 720 3984 xllxfxr.exe 90 PID 3984 wrote to memory of 720 3984 xllxfxr.exe 90 PID 720 wrote to memory of 4212 720 9lrxflr.exe 91 PID 720 wrote to memory of 4212 720 9lrxflr.exe 91 PID 720 wrote to memory of 4212 720 9lrxflr.exe 91 PID 4212 wrote to memory of 4328 4212 dvddv.exe 92 PID 4212 wrote to memory of 4328 4212 dvddv.exe 92 PID 4212 wrote to memory of 4328 4212 dvddv.exe 92 PID 4328 wrote to memory of 4036 4328 fxrfrrx.exe 93 PID 4328 wrote to memory of 4036 4328 fxrfrrx.exe 93 PID 4328 wrote to memory of 4036 4328 fxrfrrx.exe 93 PID 4036 wrote to memory of 1656 4036 9tbbbt.exe 94 PID 4036 wrote to memory of 1656 4036 9tbbbt.exe 94 PID 4036 wrote to memory of 1656 4036 9tbbbt.exe 94 PID 1656 wrote to memory of 4596 1656 btnhnn.exe 95 PID 1656 wrote to memory of 4596 1656 btnhnn.exe 95 PID 1656 wrote to memory of 4596 1656 btnhnn.exe 95 PID 4596 wrote to memory of 5024 4596 pdpvv.exe 96 PID 4596 wrote to memory of 5024 4596 pdpvv.exe 96 PID 4596 wrote to memory of 5024 4596 pdpvv.exe 96 PID 5024 wrote to memory of 4048 5024 fffxrll.exe 97 PID 5024 wrote to memory of 4048 5024 fffxrll.exe 97 PID 5024 wrote to memory of 4048 5024 fffxrll.exe 97 PID 4048 wrote to memory of 3180 4048 9vjdv.exe 98 PID 4048 wrote to memory of 3180 4048 9vjdv.exe 98 PID 4048 wrote to memory of 3180 4048 9vjdv.exe 98 PID 3180 wrote to memory of 4536 3180 7ddvj.exe 99 PID 3180 wrote to memory of 4536 3180 7ddvj.exe 99 PID 3180 wrote to memory of 4536 3180 7ddvj.exe 99 PID 4536 wrote to memory of 2648 4536 5xxrlrl.exe 100 PID 4536 wrote to memory of 2648 4536 5xxrlrl.exe 100 PID 4536 wrote to memory of 2648 4536 5xxrlrl.exe 100 PID 2648 wrote to memory of 4552 2648 bnntnb.exe 102 PID 2648 wrote to memory of 4552 2648 bnntnb.exe 102 PID 2648 wrote to memory of 4552 2648 bnntnb.exe 102 PID 4552 wrote to memory of 4960 4552 jjvpp.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\05eeeee3d5fde450abaf3106d34638c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\05eeeee3d5fde450abaf3106d34638c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\7jdvp.exec:\7jdvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\xrxffrr.exec:\xrxffrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\rffxllf.exec:\rffxllf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\5nhnbt.exec:\5nhnbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\jjdvp.exec:\jjdvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\rxxrrlx.exec:\rxxrrlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\ntthbt.exec:\ntthbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
\??\c:\htnbth.exec:\htnbth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\xllxfxr.exec:\xllxfxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\9lrxflr.exec:\9lrxflr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
\??\c:\dvddv.exec:\dvddv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\fxrfrrx.exec:\fxrfrrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\9tbbbt.exec:\9tbbbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\btnhnn.exec:\btnhnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\pdpvv.exec:\pdpvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\fffxrll.exec:\fffxrll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\9vjdv.exec:\9vjdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\7ddvj.exec:\7ddvj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
\??\c:\5xxrlrl.exec:\5xxrlrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\bnntnb.exec:\bnntnb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\jjvpp.exec:\jjvpp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\rfxrxxr.exec:\rfxrxxr.exe23⤵
- Executes dropped EXE
PID:4960 -
\??\c:\rxxrfff.exec:\rxxrfff.exe24⤵
- Executes dropped EXE
PID:2980 -
\??\c:\7hntht.exec:\7hntht.exe25⤵
- Executes dropped EXE
PID:400 -
\??\c:\9dvpv.exec:\9dvpv.exe26⤵
- Executes dropped EXE
PID:2396 -
\??\c:\xlrlfxx.exec:\xlrlfxx.exe27⤵
- Executes dropped EXE
PID:4288 -
\??\c:\9ttnnh.exec:\9ttnnh.exe28⤵
- Executes dropped EXE
PID:2700 -
\??\c:\dvvvd.exec:\dvvvd.exe29⤵
- Executes dropped EXE
PID:1588 -
\??\c:\jvpdd.exec:\jvpdd.exe30⤵
- Executes dropped EXE
PID:1600 -
\??\c:\ddjdv.exec:\ddjdv.exe31⤵
- Executes dropped EXE
PID:4164 -
\??\c:\7rrxffr.exec:\7rrxffr.exe32⤵
- Executes dropped EXE
PID:2216 -
\??\c:\nntbnn.exec:\nntbnn.exe33⤵
- Executes dropped EXE
PID:3636 -
\??\c:\jdpdd.exec:\jdpdd.exe34⤵
- Executes dropped EXE
PID:3736 -
\??\c:\lffxllf.exec:\lffxllf.exe35⤵
- Executes dropped EXE
PID:4144 -
\??\c:\3xrrllf.exec:\3xrrllf.exe36⤵
- Executes dropped EXE
PID:2084 -
\??\c:\3bbnhh.exec:\3bbnhh.exe37⤵
- Executes dropped EXE
PID:2464 -
\??\c:\tthtbt.exec:\tthtbt.exe38⤵
- Executes dropped EXE
PID:4372 -
\??\c:\jdddp.exec:\jdddp.exe39⤵
- Executes dropped EXE
PID:1484 -
\??\c:\xfxrfxr.exec:\xfxrfxr.exe40⤵
- Executes dropped EXE
PID:2004 -
\??\c:\5rlflfl.exec:\5rlflfl.exe41⤵
- Executes dropped EXE
PID:3208 -
\??\c:\bhbtnh.exec:\bhbtnh.exe42⤵
- Executes dropped EXE
PID:3352 -
\??\c:\dpvvv.exec:\dpvvv.exe43⤵
- Executes dropped EXE
PID:4436 -
\??\c:\xrrlrrr.exec:\xrrlrrr.exe44⤵
- Executes dropped EXE
PID:652 -
\??\c:\nhbthh.exec:\nhbthh.exe45⤵
- Executes dropped EXE
PID:3824 -
\??\c:\pppjd.exec:\pppjd.exe46⤵
- Executes dropped EXE
PID:1524 -
\??\c:\vvpjd.exec:\vvpjd.exe47⤵
- Executes dropped EXE
PID:532 -
\??\c:\7rrfrlr.exec:\7rrfrlr.exe48⤵
- Executes dropped EXE
PID:3348 -
\??\c:\xrllffr.exec:\xrllffr.exe49⤵
- Executes dropped EXE
PID:628 -
\??\c:\hhbttn.exec:\hhbttn.exe50⤵
- Executes dropped EXE
PID:4276 -
\??\c:\vjpjd.exec:\vjpjd.exe51⤵
- Executes dropped EXE
PID:880 -
\??\c:\dvjvp.exec:\dvjvp.exe52⤵
- Executes dropped EXE
PID:3280 -
\??\c:\xxrxllf.exec:\xxrxllf.exe53⤵
- Executes dropped EXE
PID:1032 -
\??\c:\hntnhh.exec:\hntnhh.exe54⤵
- Executes dropped EXE
PID:3836 -
\??\c:\nntnht.exec:\nntnht.exe55⤵
- Executes dropped EXE
PID:4396 -
\??\c:\5jjpj.exec:\5jjpj.exe56⤵
- Executes dropped EXE
PID:3716 -
\??\c:\pdpdp.exec:\pdpdp.exe57⤵
- Executes dropped EXE
PID:2020 -
\??\c:\xflrrrx.exec:\xflrrrx.exe58⤵
- Executes dropped EXE
PID:5016 -
\??\c:\hnhnhh.exec:\hnhnhh.exe59⤵
- Executes dropped EXE
PID:1648 -
\??\c:\tnthtt.exec:\tnthtt.exe60⤵
- Executes dropped EXE
PID:2088 -
\??\c:\9jdvd.exec:\9jdvd.exe61⤵
- Executes dropped EXE
PID:4596 -
\??\c:\vppdp.exec:\vppdp.exe62⤵
- Executes dropped EXE
PID:3828 -
\??\c:\rlfxrrl.exec:\rlfxrrl.exe63⤵
- Executes dropped EXE
PID:4628 -
\??\c:\bttnnh.exec:\bttnnh.exe64⤵
- Executes dropped EXE
PID:5104 -
\??\c:\tnnhnn.exec:\tnnhnn.exe65⤵
- Executes dropped EXE
PID:2696 -
\??\c:\vjppd.exec:\vjppd.exe66⤵PID:756
-
\??\c:\lflfrrl.exec:\lflfrrl.exe67⤵PID:2096
-
\??\c:\lrflrlr.exec:\lrflrlr.exe68⤵PID:5044
-
\??\c:\9nbtnt.exec:\9nbtnt.exe69⤵PID:3956
-
\??\c:\pddvp.exec:\pddvp.exe70⤵PID:1952
-
\??\c:\9djdp.exec:\9djdp.exe71⤵PID:2260
-
\??\c:\xfxxrlx.exec:\xfxxrlx.exe72⤵PID:2028
-
\??\c:\nbtnhn.exec:\nbtnhn.exe73⤵PID:1576
-
\??\c:\pvvpj.exec:\pvvpj.exe74⤵PID:1044
-
\??\c:\7rrfxfx.exec:\7rrfxfx.exe75⤵PID:2208
-
\??\c:\xxxrfxr.exec:\xxxrfxr.exe76⤵PID:2476
-
\??\c:\nttttb.exec:\nttttb.exe77⤵PID:2404
-
\??\c:\jjpvp.exec:\jjpvp.exe78⤵PID:3816
-
\??\c:\ffxxlll.exec:\ffxxlll.exe79⤵PID:3252
-
\??\c:\3rrrrff.exec:\3rrrrff.exe80⤵PID:3972
-
\??\c:\hthbhb.exec:\hthbhb.exe81⤵PID:2824
-
\??\c:\jddvj.exec:\jddvj.exe82⤵PID:864
-
\??\c:\vvdjv.exec:\vvdjv.exe83⤵PID:4468
-
\??\c:\9xxrllf.exec:\9xxrllf.exe84⤵PID:436
-
\??\c:\nnttnt.exec:\nnttnt.exe85⤵PID:4448
-
\??\c:\dvpjv.exec:\dvpjv.exe86⤵PID:4208
-
\??\c:\djdvj.exec:\djdvj.exe87⤵PID:4940
-
\??\c:\rrfffxf.exec:\rrfffxf.exe88⤵PID:3376
-
\??\c:\nhbbbh.exec:\nhbbbh.exe89⤵PID:2556
-
\??\c:\pjvpv.exec:\pjvpv.exe90⤵PID:1796
-
\??\c:\rfxlxfl.exec:\rfxlxfl.exe91⤵PID:948
-
\??\c:\tbnhnn.exec:\tbnhnn.exe92⤵PID:1152
-
\??\c:\ppdvp.exec:\ppdvp.exe93⤵PID:1216
-
\??\c:\xlxxxlx.exec:\xlxxxlx.exe94⤵PID:652
-
\??\c:\flllfxl.exec:\flllfxl.exe95⤵PID:4716
-
\??\c:\nnhtnh.exec:\nnhtnh.exe96⤵PID:2220
-
\??\c:\7jpjd.exec:\7jpjd.exe97⤵PID:364
-
\??\c:\lrrrlrx.exec:\lrrrlrx.exe98⤵PID:4736
-
\??\c:\bbtbhn.exec:\bbtbhn.exe99⤵PID:956
-
\??\c:\vjdjp.exec:\vjdjp.exe100⤵PID:1700
-
\??\c:\jvjvp.exec:\jvjvp.exe101⤵PID:4000
-
\??\c:\3rrlffx.exec:\3rrlffx.exe102⤵PID:1488
-
\??\c:\hbnhhn.exec:\hbnhhn.exe103⤵PID:1956
-
\??\c:\jpjpv.exec:\jpjpv.exe104⤵PID:1304
-
\??\c:\rxlrxlr.exec:\rxlrxlr.exe105⤵PID:1976
-
\??\c:\xflrxlr.exec:\xflrxlr.exe106⤵PID:4328
-
\??\c:\bbthtt.exec:\bbthtt.exe107⤵PID:1736
-
\??\c:\vpvpd.exec:\vpvpd.exe108⤵PID:4836
-
\??\c:\xllxfrl.exec:\xllxfrl.exe109⤵PID:4804
-
\??\c:\hhnnnt.exec:\hhnnnt.exe110⤵PID:1572
-
\??\c:\jpvpp.exec:\jpvpp.exe111⤵PID:5020
-
\??\c:\thbthh.exec:\thbthh.exe112⤵PID:3724
-
\??\c:\dvjdd.exec:\dvjdd.exe113⤵PID:2384
-
\??\c:\vpjjd.exec:\vpjjd.exe114⤵PID:2432
-
\??\c:\lffrfff.exec:\lffrfff.exe115⤵PID:1968
-
\??\c:\hbbtnn.exec:\hbbtnn.exe116⤵PID:4356
-
\??\c:\tnhbbt.exec:\tnhbbt.exe117⤵PID:4464
-
\??\c:\dpvpp.exec:\dpvpp.exe118⤵PID:4704
-
\??\c:\pppjd.exec:\pppjd.exe119⤵PID:4712
-
\??\c:\ttthbb.exec:\ttthbb.exe120⤵PID:3704
-
\??\c:\tbbtnn.exec:\tbbtnn.exe121⤵PID:4748
-
\??\c:\vdddv.exec:\vdddv.exe122⤵PID:4908
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-