Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 17:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
03a161f1b06e9ecf748b62a0c327b9d0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
03a161f1b06e9ecf748b62a0c327b9d0_NeikiAnalytics.exe
-
Size
61KB
-
MD5
03a161f1b06e9ecf748b62a0c327b9d0
-
SHA1
edd1b1b023a4fcfa608508cb7d4d1feae118e7fe
-
SHA256
7a54f1ec4ce70604fbf6751cdf32c43cc1092b887951e9cbb0e2f04850a25c97
-
SHA512
c3e72b155f14f8a071f34513593ab599e3e2ae172a0ffe57cce590276560ec357994ed9bd567d24b945b6f05f1705c8fa734c85d436c7f129eca873ff2c8400f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvAEaFJLD:ymb3NkkiQ3mdBjFIvAvD
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/1076-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2724-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/216-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3180-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2104-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2564-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3032-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1692-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4912-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1984-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2764-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3692-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2696-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3696-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4980-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4984-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1576-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2108-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2300-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3460-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2724 3vjjd.exe 216 xxrxlrl.exe 2104 7bbbbh.exe 4400 9bnhnb.exe 3180 7djjp.exe 4912 xxrrrrx.exe 4808 1dddd.exe 2564 rrllllf.exe 3032 fxfxrxr.exe 1692 tnttnt.exe 1984 vvdvp.exe 2764 3djjj.exe 3692 xlxxrxx.exe 556 9nttnt.exe 4076 dpvjd.exe 5036 lfrlflf.exe 2696 btnnhb.exe 3696 pjpvv.exe 1824 lfxrxfr.exe 4980 hthbhb.exe 4984 vvjdv.exe 1576 fxflrfx.exe 2108 xrxrrrl.exe 4056 htbbnn.exe 4476 pppjd.exe 3592 llllxff.exe 2460 htttbn.exe 2300 7djjj.exe 4088 7fxrxfx.exe 4836 fxfxrlf.exe 3460 hntbbh.exe 3636 ddjvp.exe 1684 xfrlrfl.exe 4392 hnhtht.exe 2572 pjdvj.exe 496 vjpjd.exe 5116 lffxxrx.exe 2584 nbtnnh.exe 1952 dvddv.exe 2724 pjdjp.exe 4332 frxlxfx.exe 3004 bhtnnn.exe 3376 9btnnb.exe 4400 3ppjd.exe 2004 frxrxfl.exe 3040 lxffxfl.exe 5084 1hnhhn.exe 4888 nbhbhb.exe 2928 vpvvj.exe 868 xlrllrx.exe 4364 rrfxrrr.exe 2636 nhnhhh.exe 660 bhnbtt.exe 4240 vvjdp.exe 3280 lxfrrrl.exe 2684 rlrffff.exe 556 bbntbh.exe 4592 btthtn.exe 2120 vdpjv.exe 4784 3ddvp.exe 2256 fxxrflr.exe 2696 1thbtt.exe 4956 tnhtbh.exe 4856 pdppv.exe -
resource yara_rule behavioral2/memory/1076-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2724-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3180-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2564-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1692-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1984-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2764-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3692-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2696-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4984-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1576-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2108-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2300-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3460-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1076 wrote to memory of 2724 1076 03a161f1b06e9ecf748b62a0c327b9d0_NeikiAnalytics.exe 83 PID 1076 wrote to memory of 2724 1076 03a161f1b06e9ecf748b62a0c327b9d0_NeikiAnalytics.exe 83 PID 1076 wrote to memory of 2724 1076 03a161f1b06e9ecf748b62a0c327b9d0_NeikiAnalytics.exe 83 PID 2724 wrote to memory of 216 2724 3vjjd.exe 84 PID 2724 wrote to memory of 216 2724 3vjjd.exe 84 PID 2724 wrote to memory of 216 2724 3vjjd.exe 84 PID 216 wrote to memory of 2104 216 xxrxlrl.exe 85 PID 216 wrote to memory of 2104 216 xxrxlrl.exe 85 PID 216 wrote to memory of 2104 216 xxrxlrl.exe 85 PID 2104 wrote to memory of 4400 2104 7bbbbh.exe 86 PID 2104 wrote to memory of 4400 2104 7bbbbh.exe 86 PID 2104 wrote to memory of 4400 2104 7bbbbh.exe 86 PID 4400 wrote to memory of 3180 4400 9bnhnb.exe 87 PID 4400 wrote to memory of 3180 4400 9bnhnb.exe 87 PID 4400 wrote to memory of 3180 4400 9bnhnb.exe 87 PID 3180 wrote to memory of 4912 3180 7djjp.exe 88 PID 3180 wrote to memory of 4912 3180 7djjp.exe 88 PID 3180 wrote to memory of 4912 3180 7djjp.exe 88 PID 4912 wrote to memory of 4808 4912 xxrrrrx.exe 89 PID 4912 wrote to memory of 4808 4912 xxrrrrx.exe 89 PID 4912 wrote to memory of 4808 4912 xxrrrrx.exe 89 PID 4808 wrote to memory of 2564 4808 1dddd.exe 90 PID 4808 wrote to memory of 2564 4808 1dddd.exe 90 PID 4808 wrote to memory of 2564 4808 1dddd.exe 90 PID 2564 wrote to memory of 3032 2564 rrllllf.exe 91 PID 2564 wrote to memory of 3032 2564 rrllllf.exe 91 PID 2564 wrote to memory of 3032 2564 rrllllf.exe 91 PID 3032 wrote to memory of 1692 3032 fxfxrxr.exe 92 PID 3032 wrote to memory of 1692 3032 fxfxrxr.exe 92 PID 3032 wrote to memory of 1692 3032 fxfxrxr.exe 92 PID 1692 wrote to memory of 1984 1692 tnttnt.exe 93 PID 1692 wrote to memory of 1984 1692 tnttnt.exe 93 PID 1692 wrote to memory of 1984 1692 tnttnt.exe 93 PID 1984 wrote to memory of 2764 1984 vvdvp.exe 94 PID 1984 wrote to memory of 2764 1984 vvdvp.exe 94 PID 1984 wrote to memory of 2764 1984 vvdvp.exe 94 PID 2764 wrote to memory of 3692 2764 3djjj.exe 95 PID 2764 wrote to memory of 3692 2764 3djjj.exe 95 PID 2764 wrote to memory of 3692 2764 3djjj.exe 95 PID 3692 wrote to memory of 556 3692 xlxxrxx.exe 97 PID 3692 wrote to memory of 556 3692 xlxxrxx.exe 97 PID 3692 wrote to memory of 556 3692 xlxxrxx.exe 97 PID 556 wrote to memory of 4076 556 9nttnt.exe 98 PID 556 wrote to memory of 4076 556 9nttnt.exe 98 PID 556 wrote to memory of 4076 556 9nttnt.exe 98 PID 4076 wrote to memory of 5036 4076 dpvjd.exe 99 PID 4076 wrote to memory of 5036 4076 dpvjd.exe 99 PID 4076 wrote to memory of 5036 4076 dpvjd.exe 99 PID 5036 wrote to memory of 2696 5036 lfrlflf.exe 100 PID 5036 wrote to memory of 2696 5036 lfrlflf.exe 100 PID 5036 wrote to memory of 2696 5036 lfrlflf.exe 100 PID 2696 wrote to memory of 3696 2696 btnnhb.exe 101 PID 2696 wrote to memory of 3696 2696 btnnhb.exe 101 PID 2696 wrote to memory of 3696 2696 btnnhb.exe 101 PID 3696 wrote to memory of 1824 3696 pjpvv.exe 102 PID 3696 wrote to memory of 1824 3696 pjpvv.exe 102 PID 3696 wrote to memory of 1824 3696 pjpvv.exe 102 PID 1824 wrote to memory of 4980 1824 lfxrxfr.exe 103 PID 1824 wrote to memory of 4980 1824 lfxrxfr.exe 103 PID 1824 wrote to memory of 4980 1824 lfxrxfr.exe 103 PID 4980 wrote to memory of 4984 4980 hthbhb.exe 104 PID 4980 wrote to memory of 4984 4980 hthbhb.exe 104 PID 4980 wrote to memory of 4984 4980 hthbhb.exe 104 PID 4984 wrote to memory of 1576 4984 vvjdv.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\03a161f1b06e9ecf748b62a0c327b9d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\03a161f1b06e9ecf748b62a0c327b9d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\3vjjd.exec:\3vjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\xxrxlrl.exec:\xxrxlrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\7bbbbh.exec:\7bbbbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\9bnhnb.exec:\9bnhnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\7djjp.exec:\7djjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
\??\c:\xxrrrrx.exec:\xxrrrrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\1dddd.exec:\1dddd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\rrllllf.exec:\rrllllf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\fxfxrxr.exec:\fxfxrxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\tnttnt.exec:\tnttnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\vvdvp.exec:\vvdvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\3djjj.exec:\3djjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\xlxxrxx.exec:\xlxxrxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\9nttnt.exec:\9nttnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\dpvjd.exec:\dpvjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\lfrlflf.exec:\lfrlflf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\btnnhb.exec:\btnnhb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\pjpvv.exec:\pjpvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\lfxrxfr.exec:\lfxrxfr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\hthbhb.exec:\hthbhb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\vvjdv.exec:\vvjdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\fxflrfx.exec:\fxflrfx.exe23⤵
- Executes dropped EXE
PID:1576 -
\??\c:\xrxrrrl.exec:\xrxrrrl.exe24⤵
- Executes dropped EXE
PID:2108 -
\??\c:\htbbnn.exec:\htbbnn.exe25⤵
- Executes dropped EXE
PID:4056 -
\??\c:\pppjd.exec:\pppjd.exe26⤵
- Executes dropped EXE
PID:4476 -
\??\c:\llllxff.exec:\llllxff.exe27⤵
- Executes dropped EXE
PID:3592 -
\??\c:\htttbn.exec:\htttbn.exe28⤵
- Executes dropped EXE
PID:2460 -
\??\c:\7djjj.exec:\7djjj.exe29⤵
- Executes dropped EXE
PID:2300 -
\??\c:\7fxrxfx.exec:\7fxrxfx.exe30⤵
- Executes dropped EXE
PID:4088 -
\??\c:\fxfxrlf.exec:\fxfxrlf.exe31⤵
- Executes dropped EXE
PID:4836 -
\??\c:\hntbbh.exec:\hntbbh.exe32⤵
- Executes dropped EXE
PID:3460 -
\??\c:\ddjvp.exec:\ddjvp.exe33⤵
- Executes dropped EXE
PID:3636 -
\??\c:\xfrlrfl.exec:\xfrlrfl.exe34⤵
- Executes dropped EXE
PID:1684 -
\??\c:\hnhtht.exec:\hnhtht.exe35⤵
- Executes dropped EXE
PID:4392 -
\??\c:\pjdvj.exec:\pjdvj.exe36⤵
- Executes dropped EXE
PID:2572 -
\??\c:\vjpjd.exec:\vjpjd.exe37⤵
- Executes dropped EXE
PID:496 -
\??\c:\lffxxrx.exec:\lffxxrx.exe38⤵
- Executes dropped EXE
PID:5116 -
\??\c:\nbtnnh.exec:\nbtnnh.exe39⤵
- Executes dropped EXE
PID:2584 -
\??\c:\dvddv.exec:\dvddv.exe40⤵
- Executes dropped EXE
PID:1952 -
\??\c:\pjdjp.exec:\pjdjp.exe41⤵
- Executes dropped EXE
PID:2724 -
\??\c:\frxlxfx.exec:\frxlxfx.exe42⤵
- Executes dropped EXE
PID:4332 -
\??\c:\bhtnnn.exec:\bhtnnn.exe43⤵
- Executes dropped EXE
PID:3004 -
\??\c:\9btnnb.exec:\9btnnb.exe44⤵
- Executes dropped EXE
PID:3376 -
\??\c:\3ppjd.exec:\3ppjd.exe45⤵
- Executes dropped EXE
PID:4400 -
\??\c:\frxrxfl.exec:\frxrxfl.exe46⤵
- Executes dropped EXE
PID:2004 -
\??\c:\lxffxfl.exec:\lxffxfl.exe47⤵
- Executes dropped EXE
PID:3040 -
\??\c:\1hnhhn.exec:\1hnhhn.exe48⤵
- Executes dropped EXE
PID:5084 -
\??\c:\nbhbhb.exec:\nbhbhb.exe49⤵
- Executes dropped EXE
PID:4888 -
\??\c:\vpvvj.exec:\vpvvj.exe50⤵
- Executes dropped EXE
PID:2928 -
\??\c:\xlrllrx.exec:\xlrllrx.exe51⤵
- Executes dropped EXE
PID:868 -
\??\c:\rrfxrrr.exec:\rrfxrrr.exe52⤵
- Executes dropped EXE
PID:4364 -
\??\c:\nhnhhh.exec:\nhnhhh.exe53⤵
- Executes dropped EXE
PID:2636 -
\??\c:\bhnbtt.exec:\bhnbtt.exe54⤵
- Executes dropped EXE
PID:660 -
\??\c:\vvjdp.exec:\vvjdp.exe55⤵
- Executes dropped EXE
PID:4240 -
\??\c:\lxfrrrl.exec:\lxfrrrl.exe56⤵
- Executes dropped EXE
PID:3280 -
\??\c:\rlrffff.exec:\rlrffff.exe57⤵
- Executes dropped EXE
PID:2684 -
\??\c:\bbntbh.exec:\bbntbh.exe58⤵
- Executes dropped EXE
PID:556 -
\??\c:\btthtn.exec:\btthtn.exe59⤵
- Executes dropped EXE
PID:4592 -
\??\c:\vdpjv.exec:\vdpjv.exe60⤵
- Executes dropped EXE
PID:2120 -
\??\c:\3ddvp.exec:\3ddvp.exe61⤵
- Executes dropped EXE
PID:4784 -
\??\c:\fxxrflr.exec:\fxxrflr.exe62⤵
- Executes dropped EXE
PID:2256 -
\??\c:\1thbtt.exec:\1thbtt.exe63⤵
- Executes dropped EXE
PID:2696 -
\??\c:\tnhtbh.exec:\tnhtbh.exe64⤵
- Executes dropped EXE
PID:4956 -
\??\c:\pdppv.exec:\pdppv.exe65⤵
- Executes dropped EXE
PID:4856 -
\??\c:\lfrrxxx.exec:\lfrrxxx.exe66⤵PID:1288
-
\??\c:\7frfffx.exec:\7frfffx.exe67⤵PID:3120
-
\??\c:\bnnhbt.exec:\bnnhbt.exe68⤵PID:4692
-
\??\c:\vpddv.exec:\vpddv.exe69⤵PID:4052
-
\??\c:\3xlllrx.exec:\3xlllrx.exe70⤵PID:1828
-
\??\c:\tnttnn.exec:\tnttnn.exe71⤵PID:4056
-
\??\c:\tnnntt.exec:\tnnntt.exe72⤵PID:4360
-
\??\c:\1pvvv.exec:\1pvvv.exe73⤵PID:2220
-
\??\c:\rrrfrxl.exec:\rrrfrxl.exe74⤵PID:1228
-
\??\c:\hhtttt.exec:\hhtttt.exe75⤵PID:2772
-
\??\c:\ddpvj.exec:\ddpvj.exe76⤵PID:4352
-
\??\c:\dvppj.exec:\dvppj.exe77⤵PID:1168
-
\??\c:\5rfrxxl.exec:\5rfrxxl.exe78⤵PID:1204
-
\??\c:\btttth.exec:\btttth.exe79⤵PID:3788
-
\??\c:\hnhbtt.exec:\hnhbtt.exe80⤵PID:3460
-
\??\c:\jdpjj.exec:\jdpjj.exe81⤵PID:3856
-
\??\c:\flffxff.exec:\flffxff.exe82⤵PID:3636
-
\??\c:\lfrrffx.exec:\lfrrffx.exe83⤵PID:3144
-
\??\c:\5btnhn.exec:\5btnhn.exe84⤵PID:2420
-
\??\c:\jjpvj.exec:\jjpvj.exe85⤵PID:4424
-
\??\c:\lrxxxxf.exec:\lrxxxxf.exe86⤵PID:1068
-
\??\c:\xrllfxl.exec:\xrllfxl.exe87⤵PID:2536
-
\??\c:\hthhhn.exec:\hthhhn.exe88⤵PID:2184
-
\??\c:\tnhhtt.exec:\tnhhtt.exe89⤵PID:1256
-
\??\c:\ddjdv.exec:\ddjdv.exe90⤵PID:4012
-
\??\c:\5xrrrrr.exec:\5xrrrrr.exe91⤵PID:4512
-
\??\c:\1flxrfx.exec:\1flxrfx.exe92⤵PID:3976
-
\??\c:\thhbtt.exec:\thhbtt.exe93⤵PID:4264
-
\??\c:\jvvpj.exec:\jvvpj.exe94⤵PID:1888
-
\??\c:\jdddd.exec:\jdddd.exe95⤵PID:5012
-
\??\c:\xrrllfx.exec:\xrrllfx.exe96⤵PID:1336
-
\??\c:\bnhhbb.exec:\bnhhbb.exe97⤵PID:4256
-
\??\c:\dvdvd.exec:\dvdvd.exe98⤵PID:4656
-
\??\c:\7ddpj.exec:\7ddpj.exe99⤵PID:1664
-
\??\c:\xfrrxff.exec:\xfrrxff.exe100⤵PID:3780
-
\??\c:\bttbbt.exec:\bttbbt.exe101⤵PID:3032
-
\??\c:\pdvdv.exec:\pdvdv.exe102⤵PID:3328
-
\??\c:\vjpvv.exec:\vjpvv.exe103⤵PID:3596
-
\??\c:\3frrlrr.exec:\3frrlrr.exe104⤵PID:4240
-
\??\c:\tnbbhb.exec:\tnbbhb.exe105⤵PID:3692
-
\??\c:\ppjdd.exec:\ppjdd.exe106⤵PID:1376
-
\??\c:\jpvdj.exec:\jpvdj.exe107⤵PID:712
-
\??\c:\xrrfxxl.exec:\xrrfxxl.exe108⤵PID:1372
-
\??\c:\3ttnhh.exec:\3ttnhh.exe109⤵PID:2784
-
\??\c:\tntntb.exec:\tntntb.exe110⤵PID:500
-
\??\c:\5hthbn.exec:\5hthbn.exe111⤵PID:640
-
\??\c:\pjdpd.exec:\pjdpd.exe112⤵PID:3140
-
\??\c:\pjvjd.exec:\pjvjd.exe113⤵PID:4188
-
\??\c:\llfllll.exec:\llfllll.exe114⤵PID:1824
-
\??\c:\1nnnbb.exec:\1nnnbb.exe115⤵PID:1948
-
\??\c:\5bbtnn.exec:\5bbtnn.exe116⤵PID:4984
-
\??\c:\ppppp.exec:\ppppp.exe117⤵PID:2308
-
\??\c:\pjvvj.exec:\pjvvj.exe118⤵PID:3836
-
\??\c:\xllfrrl.exec:\xllfrrl.exe119⤵PID:2088
-
\??\c:\1rrrrrr.exec:\1rrrrrr.exe120⤵PID:4476
-
\??\c:\bnthhh.exec:\bnthhh.exe121⤵PID:4972
-
\??\c:\jpvpd.exec:\jpvpd.exe122⤵PID:2220
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-