Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 20:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
18f36b0a187b1cc0d0d53845d2bc2090NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
18f36b0a187b1cc0d0d53845d2bc2090NeikiAnalytics.exe
-
Size
306KB
-
MD5
18f36b0a187b1cc0d0d53845d2bc2090
-
SHA1
edd81614f44930665a75a5a8335549c362ae2090
-
SHA256
bc69da80983e37d6636f3afec6a3316f13730e864c635a38979ca0d971c17e44
-
SHA512
5b3083af89e027e03073728e03c6f0a662bc40a7a3b44de54709cfc55a87208c736a6b3134f32fd5f371c228de31699212c5d7cb13176b67e6b8caea8e6de8cf
-
SSDEEP
6144:n3C9BRo/CH26ZAmaOXicLrnRukAPXt1UP+3OgEbXeTiDSd2va:n3C9uUnAvtd3Ogld2va
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral2/memory/1788-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1380-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2604-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3220-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1388-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/976-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2212-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1448-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4368-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1452-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4888-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1924-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1412-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2952-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4300-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2116-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1380 7fxrrrr.exe 4420 tnnnhh.exe 3220 tttntt.exe 2604 nhhbtb.exe 2028 pddpj.exe 1388 lflfrrl.exe 976 lfxlxrf.exe 2212 ppjvv.exe 1448 ththth.exe 4368 tttnbb.exe 2012 rlflxxf.exe 2688 ffffxrr.exe 3600 1djpj.exe 5040 lxxrffl.exe 3376 hhnbtt.exe 1452 pjjdd.exe 3316 nbbtnn.exe 4936 5dppv.exe 3936 xlrlllf.exe 2108 bhnhhh.exe 4888 jdvjd.exe 1924 vvjjj.exe 4508 nbbttt.exe 1412 nhhhbh.exe 2952 3xrllrl.exe 4300 lxffxxl.exe 2264 thhhnn.exe 452 dpddd.exe 2116 3rxrlfx.exe 3780 ntthth.exe 2948 djpjd.exe 3572 ffxfxxr.exe 4080 thhbtt.exe 3332 5jdjv.exe 2408 jjppp.exe 5092 xlrlfxl.exe 4056 ntnnhb.exe 2964 tnnhbb.exe 4364 dpppj.exe 2416 lrrrlrl.exe 1624 rrxxxxf.exe 3908 bbttnn.exe 852 dvvpj.exe 3096 7lrfrrr.exe 1320 9xxrlrl.exe 4212 bttnnn.exe 4820 tthhbh.exe 4872 pdddd.exe 5036 lxxrrrr.exe 3820 lrlllll.exe 3956 thhhtt.exe 512 9vvpd.exe 1532 pdpjd.exe 3632 ffrlllr.exe 3660 nntntn.exe 1792 jvvjp.exe 3544 dvvpp.exe 800 rfrlllf.exe 4680 bnhbnh.exe 3988 pjdvp.exe 3420 7lffxxx.exe 2392 htbhbn.exe 1884 pjdvp.exe 4600 jddvv.exe -
resource yara_rule behavioral2/memory/1788-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1380-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3220-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1388-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/976-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2212-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1448-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1452-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1412-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2952-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4300-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-191-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1788 wrote to memory of 1380 1788 18f36b0a187b1cc0d0d53845d2bc2090NeikiAnalytics.exe 81 PID 1788 wrote to memory of 1380 1788 18f36b0a187b1cc0d0d53845d2bc2090NeikiAnalytics.exe 81 PID 1788 wrote to memory of 1380 1788 18f36b0a187b1cc0d0d53845d2bc2090NeikiAnalytics.exe 81 PID 1380 wrote to memory of 4420 1380 7fxrrrr.exe 82 PID 1380 wrote to memory of 4420 1380 7fxrrrr.exe 82 PID 1380 wrote to memory of 4420 1380 7fxrrrr.exe 82 PID 4420 wrote to memory of 3220 4420 tnnnhh.exe 83 PID 4420 wrote to memory of 3220 4420 tnnnhh.exe 83 PID 4420 wrote to memory of 3220 4420 tnnnhh.exe 83 PID 3220 wrote to memory of 2604 3220 tttntt.exe 84 PID 3220 wrote to memory of 2604 3220 tttntt.exe 84 PID 3220 wrote to memory of 2604 3220 tttntt.exe 84 PID 2604 wrote to memory of 2028 2604 nhhbtb.exe 85 PID 2604 wrote to memory of 2028 2604 nhhbtb.exe 85 PID 2604 wrote to memory of 2028 2604 nhhbtb.exe 85 PID 2028 wrote to memory of 1388 2028 pddpj.exe 87 PID 2028 wrote to memory of 1388 2028 pddpj.exe 87 PID 2028 wrote to memory of 1388 2028 pddpj.exe 87 PID 1388 wrote to memory of 976 1388 lflfrrl.exe 88 PID 1388 wrote to memory of 976 1388 lflfrrl.exe 88 PID 1388 wrote to memory of 976 1388 lflfrrl.exe 88 PID 976 wrote to memory of 2212 976 lfxlxrf.exe 89 PID 976 wrote to memory of 2212 976 lfxlxrf.exe 89 PID 976 wrote to memory of 2212 976 lfxlxrf.exe 89 PID 2212 wrote to memory of 1448 2212 ppjvv.exe 91 PID 2212 wrote to memory of 1448 2212 ppjvv.exe 91 PID 2212 wrote to memory of 1448 2212 ppjvv.exe 91 PID 1448 wrote to memory of 4368 1448 ththth.exe 92 PID 1448 wrote to memory of 4368 1448 ththth.exe 92 PID 1448 wrote to memory of 4368 1448 ththth.exe 92 PID 4368 wrote to memory of 2012 4368 tttnbb.exe 93 PID 4368 wrote to memory of 2012 4368 tttnbb.exe 93 PID 4368 wrote to memory of 2012 4368 tttnbb.exe 93 PID 2012 wrote to memory of 2688 2012 rlflxxf.exe 94 PID 2012 wrote to memory of 2688 2012 rlflxxf.exe 94 PID 2012 wrote to memory of 2688 2012 rlflxxf.exe 94 PID 2688 wrote to memory of 3600 2688 ffffxrr.exe 95 PID 2688 wrote to memory of 3600 2688 ffffxrr.exe 95 PID 2688 wrote to memory of 3600 2688 ffffxrr.exe 95 PID 3600 wrote to memory of 5040 3600 1djpj.exe 96 PID 3600 wrote to memory of 5040 3600 1djpj.exe 96 PID 3600 wrote to memory of 5040 3600 1djpj.exe 96 PID 5040 wrote to memory of 3376 5040 lxxrffl.exe 98 PID 5040 wrote to memory of 3376 5040 lxxrffl.exe 98 PID 5040 wrote to memory of 3376 5040 lxxrffl.exe 98 PID 3376 wrote to memory of 1452 3376 hhnbtt.exe 99 PID 3376 wrote to memory of 1452 3376 hhnbtt.exe 99 PID 3376 wrote to memory of 1452 3376 hhnbtt.exe 99 PID 1452 wrote to memory of 3316 1452 pjjdd.exe 100 PID 1452 wrote to memory of 3316 1452 pjjdd.exe 100 PID 1452 wrote to memory of 3316 1452 pjjdd.exe 100 PID 3316 wrote to memory of 4936 3316 nbbtnn.exe 101 PID 3316 wrote to memory of 4936 3316 nbbtnn.exe 101 PID 3316 wrote to memory of 4936 3316 nbbtnn.exe 101 PID 4936 wrote to memory of 3936 4936 5dppv.exe 102 PID 4936 wrote to memory of 3936 4936 5dppv.exe 102 PID 4936 wrote to memory of 3936 4936 5dppv.exe 102 PID 3936 wrote to memory of 2108 3936 xlrlllf.exe 103 PID 3936 wrote to memory of 2108 3936 xlrlllf.exe 103 PID 3936 wrote to memory of 2108 3936 xlrlllf.exe 103 PID 2108 wrote to memory of 4888 2108 bhnhhh.exe 104 PID 2108 wrote to memory of 4888 2108 bhnhhh.exe 104 PID 2108 wrote to memory of 4888 2108 bhnhhh.exe 104 PID 4888 wrote to memory of 1924 4888 jdvjd.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\18f36b0a187b1cc0d0d53845d2bc2090NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f36b0a187b1cc0d0d53845d2bc2090NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\7fxrrrr.exec:\7fxrrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\tnnnhh.exec:\tnnnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\tttntt.exec:\tttntt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\nhhbtb.exec:\nhhbtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\pddpj.exec:\pddpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\lflfrrl.exec:\lflfrrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\lfxlxrf.exec:\lfxlxrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
\??\c:\ppjvv.exec:\ppjvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\ththth.exec:\ththth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\tttnbb.exec:\tttnbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\rlflxxf.exec:\rlflxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\ffffxrr.exec:\ffffxrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\1djpj.exec:\1djpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\lxxrffl.exec:\lxxrffl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\hhnbtt.exec:\hhnbtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
\??\c:\pjjdd.exec:\pjjdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\nbbtnn.exec:\nbbtnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\5dppv.exec:\5dppv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\xlrlllf.exec:\xlrlllf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\bhnhhh.exec:\bhnhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\jdvjd.exec:\jdvjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\vvjjj.exec:\vvjjj.exe23⤵
- Executes dropped EXE
PID:1924 -
\??\c:\nbbttt.exec:\nbbttt.exe24⤵
- Executes dropped EXE
PID:4508 -
\??\c:\nhhhbh.exec:\nhhhbh.exe25⤵
- Executes dropped EXE
PID:1412 -
\??\c:\3xrllrl.exec:\3xrllrl.exe26⤵
- Executes dropped EXE
PID:2952 -
\??\c:\lxffxxl.exec:\lxffxxl.exe27⤵
- Executes dropped EXE
PID:4300 -
\??\c:\thhhnn.exec:\thhhnn.exe28⤵
- Executes dropped EXE
PID:2264 -
\??\c:\dpddd.exec:\dpddd.exe29⤵
- Executes dropped EXE
PID:452 -
\??\c:\3rxrlfx.exec:\3rxrlfx.exe30⤵
- Executes dropped EXE
PID:2116 -
\??\c:\ntthth.exec:\ntthth.exe31⤵
- Executes dropped EXE
PID:3780 -
\??\c:\djpjd.exec:\djpjd.exe32⤵
- Executes dropped EXE
PID:2948 -
\??\c:\ffxfxxr.exec:\ffxfxxr.exe33⤵
- Executes dropped EXE
PID:3572 -
\??\c:\thhbtt.exec:\thhbtt.exe34⤵
- Executes dropped EXE
PID:4080 -
\??\c:\5jdjv.exec:\5jdjv.exe35⤵
- Executes dropped EXE
PID:3332 -
\??\c:\jjppp.exec:\jjppp.exe36⤵
- Executes dropped EXE
PID:2408 -
\??\c:\xlrlfxl.exec:\xlrlfxl.exe37⤵
- Executes dropped EXE
PID:5092 -
\??\c:\ntnnhb.exec:\ntnnhb.exe38⤵
- Executes dropped EXE
PID:4056 -
\??\c:\tnnhbb.exec:\tnnhbb.exe39⤵
- Executes dropped EXE
PID:2964 -
\??\c:\dpppj.exec:\dpppj.exe40⤵
- Executes dropped EXE
PID:4364 -
\??\c:\lrrrlrl.exec:\lrrrlrl.exe41⤵
- Executes dropped EXE
PID:2416 -
\??\c:\rrxxxxf.exec:\rrxxxxf.exe42⤵
- Executes dropped EXE
PID:1624 -
\??\c:\bbttnn.exec:\bbttnn.exe43⤵
- Executes dropped EXE
PID:3908 -
\??\c:\dvvpj.exec:\dvvpj.exe44⤵
- Executes dropped EXE
PID:852 -
\??\c:\7lrfrrr.exec:\7lrfrrr.exe45⤵
- Executes dropped EXE
PID:3096 -
\??\c:\9xxrlrl.exec:\9xxrlrl.exe46⤵
- Executes dropped EXE
PID:1320 -
\??\c:\bttnnn.exec:\bttnnn.exe47⤵
- Executes dropped EXE
PID:4212 -
\??\c:\tthhbh.exec:\tthhbh.exe48⤵
- Executes dropped EXE
PID:4820 -
\??\c:\pdddd.exec:\pdddd.exe49⤵
- Executes dropped EXE
PID:4872 -
\??\c:\lxxrrrr.exec:\lxxrrrr.exe50⤵
- Executes dropped EXE
PID:5036 -
\??\c:\lrlllll.exec:\lrlllll.exe51⤵
- Executes dropped EXE
PID:3820 -
\??\c:\thhhtt.exec:\thhhtt.exe52⤵
- Executes dropped EXE
PID:3956 -
\??\c:\9vvpd.exec:\9vvpd.exe53⤵
- Executes dropped EXE
PID:512 -
\??\c:\pdpjd.exec:\pdpjd.exe54⤵
- Executes dropped EXE
PID:1532 -
\??\c:\ffrlllr.exec:\ffrlllr.exe55⤵
- Executes dropped EXE
PID:3632 -
\??\c:\nntntn.exec:\nntntn.exe56⤵
- Executes dropped EXE
PID:3660 -
\??\c:\jvvjp.exec:\jvvjp.exe57⤵
- Executes dropped EXE
PID:1792 -
\??\c:\dvvpp.exec:\dvvpp.exe58⤵
- Executes dropped EXE
PID:3544 -
\??\c:\rfrlllf.exec:\rfrlllf.exe59⤵
- Executes dropped EXE
PID:800 -
\??\c:\bnhbnh.exec:\bnhbnh.exe60⤵
- Executes dropped EXE
PID:4680 -
\??\c:\pjdvp.exec:\pjdvp.exe61⤵
- Executes dropped EXE
PID:3988 -
\??\c:\7lffxxx.exec:\7lffxxx.exe62⤵
- Executes dropped EXE
PID:3420 -
\??\c:\htbhbn.exec:\htbhbn.exe63⤵
- Executes dropped EXE
PID:2392 -
\??\c:\pjdvp.exec:\pjdvp.exe64⤵
- Executes dropped EXE
PID:1884 -
\??\c:\jddvv.exec:\jddvv.exe65⤵
- Executes dropped EXE
PID:4600 -
\??\c:\lrrlffx.exec:\lrrlffx.exe66⤵PID:4328
-
\??\c:\nttttt.exec:\nttttt.exe67⤵PID:768
-
\??\c:\ddvpd.exec:\ddvpd.exe68⤵PID:3208
-
\??\c:\lffxlll.exec:\lffxlll.exe69⤵PID:348
-
\??\c:\tbnnnh.exec:\tbnnnh.exe70⤵PID:1924
-
\??\c:\hbbtnh.exec:\hbbtnh.exe71⤵PID:5108
-
\??\c:\pdjdv.exec:\pdjdv.exe72⤵PID:2560
-
\??\c:\ppvpj.exec:\ppvpj.exe73⤵PID:4964
-
\??\c:\rxlfrrr.exec:\rxlfrrr.exe74⤵PID:2080
-
\??\c:\5nbtnn.exec:\5nbtnn.exe75⤵PID:380
-
\??\c:\vjjpj.exec:\vjjpj.exe76⤵PID:2264
-
\??\c:\xlrfxxr.exec:\xlrfxxr.exe77⤵PID:2232
-
\??\c:\xfxxrrr.exec:\xfxxrrr.exe78⤵PID:4932
-
\??\c:\bbnntn.exec:\bbnntn.exe79⤵PID:3652
-
\??\c:\ttnhnh.exec:\ttnhnh.exe80⤵PID:1744
-
\??\c:\1ppjd.exec:\1ppjd.exe81⤵PID:4136
-
\??\c:\ffrrllr.exec:\ffrrllr.exe82⤵PID:5088
-
\??\c:\rxfxxrr.exec:\rxfxxrr.exe83⤵PID:4480
-
\??\c:\ntbbtt.exec:\ntbbtt.exe84⤵PID:4620
-
\??\c:\tbhthb.exec:\tbhthb.exe85⤵PID:3292
-
\??\c:\pjjdv.exec:\pjjdv.exe86⤵PID:4456
-
\??\c:\9lrlfff.exec:\9lrlfff.exe87⤵PID:4464
-
\??\c:\frlfxrl.exec:\frlfxrl.exe88⤵PID:2120
-
\??\c:\tnnhhb.exec:\tnnhhb.exe89⤵PID:4980
-
\??\c:\nttnhh.exec:\nttnhh.exe90⤵PID:1380
-
\??\c:\djdvv.exec:\djdvv.exe91⤵PID:1196
-
\??\c:\pvjdv.exec:\pvjdv.exe92⤵PID:3548
-
\??\c:\flfxxxf.exec:\flfxxxf.exe93⤵PID:2664
-
\??\c:\hbhbbb.exec:\hbhbbb.exe94⤵PID:1292
-
\??\c:\thnhtb.exec:\thnhtb.exe95⤵PID:3224
-
\??\c:\jjjdp.exec:\jjjdp.exe96⤵PID:1004
-
\??\c:\flxrllf.exec:\flxrllf.exe97⤵PID:2868
-
\??\c:\7xfrxxx.exec:\7xfrxxx.exe98⤵PID:2260
-
\??\c:\ntbbhn.exec:\ntbbhn.exe99⤵PID:3948
-
\??\c:\thtnhb.exec:\thtnhb.exe100⤵PID:2316
-
\??\c:\vvjvp.exec:\vvjvp.exe101⤵PID:1616
-
\??\c:\9rrrlfx.exec:\9rrrlfx.exe102⤵PID:1584
-
\??\c:\3fllfrl.exec:\3fllfrl.exe103⤵PID:3848
-
\??\c:\tthhnt.exec:\tthhnt.exe104⤵PID:1248
-
\??\c:\bnhbnb.exec:\bnhbnb.exe105⤵PID:4580
-
\??\c:\vpvvp.exec:\vpvvp.exe106⤵PID:1792
-
\??\c:\xrlffff.exec:\xrlffff.exe107⤵PID:3544
-
\??\c:\hbbnhb.exec:\hbbnhb.exe108⤵PID:4728
-
\??\c:\httttb.exec:\httttb.exe109⤵PID:3420
-
\??\c:\frxrxxx.exec:\frxrxxx.exe110⤵PID:1276
-
\??\c:\lfffxxx.exec:\lfffxxx.exe111⤵PID:4812
-
\??\c:\htbttb.exec:\htbttb.exe112⤵PID:216
-
\??\c:\tnhbbt.exec:\tnhbbt.exe113⤵PID:4008
-
\??\c:\7jjdv.exec:\7jjdv.exe114⤵PID:728
-
\??\c:\jdjpj.exec:\jdjpj.exe115⤵PID:2540
-
\??\c:\frxrfff.exec:\frxrfff.exe116⤵PID:688
-
\??\c:\hnbntn.exec:\hnbntn.exe117⤵PID:1364
-
\??\c:\1hnhth.exec:\1hnhth.exe118⤵PID:2080
-
\??\c:\rlfrxfl.exec:\rlfrxfl.exe119⤵PID:1056
-
\??\c:\1bhthh.exec:\1bhthh.exe120⤵PID:4180
-
\??\c:\5bnbnb.exec:\5bnbnb.exe121⤵PID:2232
-
\??\c:\pvvdp.exec:\pvvdp.exe122⤵PID:2912
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-