Analysis
-
max time kernel
150s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
12-05-2024 12:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0ccda6b0f06754e12cccd2311052aa70_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0ccda6b0f06754e12cccd2311052aa70_NeikiAnalytics.exe
-
Size
83KB
-
MD5
0ccda6b0f06754e12cccd2311052aa70
-
SHA1
d0d835365043ab277b3c339bb8d94f1ca645fac6
-
SHA256
515dcec1aaf26887d18c3bf34d050b897b0c0c4c2869cf7fb4617c998f9ee753
-
SHA512
fc5018b916f8f7ab6d9cd8f0de7b3fb37725deab60648f05e1e2d3a4b75547975a739b208670acb617d5a1ebd9d4e2f9b084759f554c35ae147a805a73551962
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAXPfgr2hKmdbcPi2vL:ymb3NkkiQ3mdBjFo6Pfgy3dbc/L
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/4712-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1916-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4068-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4624-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3084-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2584-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3048-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3048-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2356-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2264-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3416-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1516-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4380-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4252-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3636-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1416-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2760-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3200-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1264-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4888-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4224-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4068 jvvvd.exe 1916 9bbtnh.exe 3984 hbnhnn.exe 4624 rrrxxrr.exe 3084 xfrlxrl.exe 2584 9tnhbb.exe 3048 pdjdv.exe 4468 nbhbtt.exe 2356 vvvpv.exe 2264 xrflrfr.exe 1560 tbbhtn.exe 3416 pppdp.exe 1516 jjjdp.exe 4380 fflllxl.exe 4252 hbbnhn.exe 3636 bthbbb.exe 1416 vdpjd.exe 448 lxrrlrr.exe 4904 tntttn.exe 4780 pvvpd.exe 3060 xlxrrrr.exe 2760 hthnbb.exe 876 nntbtb.exe 3200 vdvvj.exe 1264 xxrrrrr.exe 4888 hhhhtt.exe 1128 pvpjv.exe 3704 fxrfxrf.exe 4772 rlrrrrf.exe 1992 nbbtbn.exe 4224 jjpjj.exe 3500 7ffrlxr.exe 976 nbtnnh.exe 4316 9vvpj.exe 4712 flxxxll.exe 1140 fffllrr.exe 2160 nnnnnn.exe 384 tnnnth.exe 1144 jppvj.exe 4208 rrffllx.exe 1400 xllffxf.exe 2616 3bnnnn.exe 2576 nhtbbh.exe 2384 1jvvj.exe 2900 pjvdv.exe 3944 3rrlfxl.exe 2528 1fxrfxr.exe 2356 hbbtnn.exe 4984 9jjjj.exe 1160 vvvpd.exe 1036 7lrllll.exe 4680 xrrrrrr.exe 4368 nbnnnt.exe 2816 bbhhbb.exe 2996 1vppp.exe 840 xxllxxx.exe 3596 lrxrrlx.exe 2744 nhnnnn.exe 3168 bthnbn.exe 2884 djvjd.exe 812 xlxrrrx.exe 4884 rlfrrxr.exe 3012 bthbhh.exe 1352 7thhnt.exe -
resource yara_rule behavioral2/memory/4712-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4068-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4068-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4068-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4068-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4624-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3084-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2584-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2584-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2584-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2584-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3048-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3048-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3048-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2356-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2264-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3416-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1516-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4380-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4252-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3636-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1416-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2760-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3200-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1264-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4224-210-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4712 wrote to memory of 4068 4712 0ccda6b0f06754e12cccd2311052aa70_NeikiAnalytics.exe 82 PID 4712 wrote to memory of 4068 4712 0ccda6b0f06754e12cccd2311052aa70_NeikiAnalytics.exe 82 PID 4712 wrote to memory of 4068 4712 0ccda6b0f06754e12cccd2311052aa70_NeikiAnalytics.exe 82 PID 4068 wrote to memory of 1916 4068 jvvvd.exe 83 PID 4068 wrote to memory of 1916 4068 jvvvd.exe 83 PID 4068 wrote to memory of 1916 4068 jvvvd.exe 83 PID 1916 wrote to memory of 3984 1916 9bbtnh.exe 84 PID 1916 wrote to memory of 3984 1916 9bbtnh.exe 84 PID 1916 wrote to memory of 3984 1916 9bbtnh.exe 84 PID 3984 wrote to memory of 4624 3984 hbnhnn.exe 85 PID 3984 wrote to memory of 4624 3984 hbnhnn.exe 85 PID 3984 wrote to memory of 4624 3984 hbnhnn.exe 85 PID 4624 wrote to memory of 3084 4624 rrrxxrr.exe 86 PID 4624 wrote to memory of 3084 4624 rrrxxrr.exe 86 PID 4624 wrote to memory of 3084 4624 rrrxxrr.exe 86 PID 3084 wrote to memory of 2584 3084 xfrlxrl.exe 87 PID 3084 wrote to memory of 2584 3084 xfrlxrl.exe 87 PID 3084 wrote to memory of 2584 3084 xfrlxrl.exe 87 PID 2584 wrote to memory of 3048 2584 9tnhbb.exe 88 PID 2584 wrote to memory of 3048 2584 9tnhbb.exe 88 PID 2584 wrote to memory of 3048 2584 9tnhbb.exe 88 PID 3048 wrote to memory of 4468 3048 pdjdv.exe 89 PID 3048 wrote to memory of 4468 3048 pdjdv.exe 89 PID 3048 wrote to memory of 4468 3048 pdjdv.exe 89 PID 4468 wrote to memory of 2356 4468 nbhbtt.exe 90 PID 4468 wrote to memory of 2356 4468 nbhbtt.exe 90 PID 4468 wrote to memory of 2356 4468 nbhbtt.exe 90 PID 2356 wrote to memory of 2264 2356 vvvpv.exe 91 PID 2356 wrote to memory of 2264 2356 vvvpv.exe 91 PID 2356 wrote to memory of 2264 2356 vvvpv.exe 91 PID 2264 wrote to memory of 1560 2264 xrflrfr.exe 92 PID 2264 wrote to memory of 1560 2264 xrflrfr.exe 92 PID 2264 wrote to memory of 1560 2264 xrflrfr.exe 92 PID 1560 wrote to memory of 3416 1560 tbbhtn.exe 93 PID 1560 wrote to memory of 3416 1560 tbbhtn.exe 93 PID 1560 wrote to memory of 3416 1560 tbbhtn.exe 93 PID 3416 wrote to memory of 1516 3416 pppdp.exe 94 PID 3416 wrote to memory of 1516 3416 pppdp.exe 94 PID 3416 wrote to memory of 1516 3416 pppdp.exe 94 PID 1516 wrote to memory of 4380 1516 jjjdp.exe 95 PID 1516 wrote to memory of 4380 1516 jjjdp.exe 95 PID 1516 wrote to memory of 4380 1516 jjjdp.exe 95 PID 4380 wrote to memory of 4252 4380 fflllxl.exe 96 PID 4380 wrote to memory of 4252 4380 fflllxl.exe 96 PID 4380 wrote to memory of 4252 4380 fflllxl.exe 96 PID 4252 wrote to memory of 3636 4252 hbbnhn.exe 97 PID 4252 wrote to memory of 3636 4252 hbbnhn.exe 97 PID 4252 wrote to memory of 3636 4252 hbbnhn.exe 97 PID 3636 wrote to memory of 1416 3636 bthbbb.exe 98 PID 3636 wrote to memory of 1416 3636 bthbbb.exe 98 PID 3636 wrote to memory of 1416 3636 bthbbb.exe 98 PID 1416 wrote to memory of 448 1416 vdpjd.exe 99 PID 1416 wrote to memory of 448 1416 vdpjd.exe 99 PID 1416 wrote to memory of 448 1416 vdpjd.exe 99 PID 448 wrote to memory of 4904 448 lxrrlrr.exe 100 PID 448 wrote to memory of 4904 448 lxrrlrr.exe 100 PID 448 wrote to memory of 4904 448 lxrrlrr.exe 100 PID 4904 wrote to memory of 4780 4904 tntttn.exe 101 PID 4904 wrote to memory of 4780 4904 tntttn.exe 101 PID 4904 wrote to memory of 4780 4904 tntttn.exe 101 PID 4780 wrote to memory of 3060 4780 pvvpd.exe 102 PID 4780 wrote to memory of 3060 4780 pvvpd.exe 102 PID 4780 wrote to memory of 3060 4780 pvvpd.exe 102 PID 3060 wrote to memory of 2760 3060 xlxrrrr.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ccda6b0f06754e12cccd2311052aa70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0ccda6b0f06754e12cccd2311052aa70_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\jvvvd.exec:\jvvvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\9bbtnh.exec:\9bbtnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\hbnhnn.exec:\hbnhnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\rrrxxrr.exec:\rrrxxrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\xfrlxrl.exec:\xfrlxrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\9tnhbb.exec:\9tnhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\pdjdv.exec:\pdjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\nbhbtt.exec:\nbhbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\vvvpv.exec:\vvvpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\xrflrfr.exec:\xrflrfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\tbbhtn.exec:\tbbhtn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\pppdp.exec:\pppdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
\??\c:\jjjdp.exec:\jjjdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\fflllxl.exec:\fflllxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\hbbnhn.exec:\hbbnhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\bthbbb.exec:\bthbbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\vdpjd.exec:\vdpjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\lxrrlrr.exec:\lxrrlrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\tntttn.exec:\tntttn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\pvvpd.exec:\pvvpd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\xlxrrrr.exec:\xlxrrrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\hthnbb.exec:\hthnbb.exe23⤵
- Executes dropped EXE
PID:2760 -
\??\c:\nntbtb.exec:\nntbtb.exe24⤵
- Executes dropped EXE
PID:876 -
\??\c:\vdvvj.exec:\vdvvj.exe25⤵
- Executes dropped EXE
PID:3200 -
\??\c:\xxrrrrr.exec:\xxrrrrr.exe26⤵
- Executes dropped EXE
PID:1264 -
\??\c:\hhhhtt.exec:\hhhhtt.exe27⤵
- Executes dropped EXE
PID:4888 -
\??\c:\pvpjv.exec:\pvpjv.exe28⤵
- Executes dropped EXE
PID:1128 -
\??\c:\fxrfxrf.exec:\fxrfxrf.exe29⤵
- Executes dropped EXE
PID:3704 -
\??\c:\rlrrrrf.exec:\rlrrrrf.exe30⤵
- Executes dropped EXE
PID:4772 -
\??\c:\nbbtbn.exec:\nbbtbn.exe31⤵
- Executes dropped EXE
PID:1992 -
\??\c:\jjpjj.exec:\jjpjj.exe32⤵
- Executes dropped EXE
PID:4224 -
\??\c:\7ffrlxr.exec:\7ffrlxr.exe33⤵
- Executes dropped EXE
PID:3500 -
\??\c:\nbtnnh.exec:\nbtnnh.exe34⤵
- Executes dropped EXE
PID:976 -
\??\c:\9vvpj.exec:\9vvpj.exe35⤵
- Executes dropped EXE
PID:4316 -
\??\c:\flxxxll.exec:\flxxxll.exe36⤵
- Executes dropped EXE
PID:4712 -
\??\c:\fffllrr.exec:\fffllrr.exe37⤵
- Executes dropped EXE
PID:1140 -
\??\c:\nnnnnn.exec:\nnnnnn.exe38⤵
- Executes dropped EXE
PID:2160 -
\??\c:\tnnnth.exec:\tnnnth.exe39⤵
- Executes dropped EXE
PID:384 -
\??\c:\jppvj.exec:\jppvj.exe40⤵
- Executes dropped EXE
PID:1144 -
\??\c:\rrffllx.exec:\rrffllx.exe41⤵
- Executes dropped EXE
PID:4208 -
\??\c:\xllffxf.exec:\xllffxf.exe42⤵
- Executes dropped EXE
PID:1400 -
\??\c:\3bnnnn.exec:\3bnnnn.exe43⤵
- Executes dropped EXE
PID:2616 -
\??\c:\nhtbbh.exec:\nhtbbh.exe44⤵
- Executes dropped EXE
PID:2576 -
\??\c:\1jvvj.exec:\1jvvj.exe45⤵
- Executes dropped EXE
PID:2384 -
\??\c:\pjvdv.exec:\pjvdv.exe46⤵
- Executes dropped EXE
PID:2900 -
\??\c:\3rrlfxl.exec:\3rrlfxl.exe47⤵
- Executes dropped EXE
PID:3944 -
\??\c:\1fxrfxr.exec:\1fxrfxr.exe48⤵
- Executes dropped EXE
PID:2528 -
\??\c:\hbbtnn.exec:\hbbtnn.exe49⤵
- Executes dropped EXE
PID:2356 -
\??\c:\9jjjj.exec:\9jjjj.exe50⤵
- Executes dropped EXE
PID:4984 -
\??\c:\vvvpd.exec:\vvvpd.exe51⤵
- Executes dropped EXE
PID:1160 -
\??\c:\7lrllll.exec:\7lrllll.exe52⤵
- Executes dropped EXE
PID:1036 -
\??\c:\xrrrrrr.exec:\xrrrrrr.exe53⤵
- Executes dropped EXE
PID:4680 -
\??\c:\nbnnnt.exec:\nbnnnt.exe54⤵
- Executes dropped EXE
PID:4368 -
\??\c:\bbhhbb.exec:\bbhhbb.exe55⤵
- Executes dropped EXE
PID:2816 -
\??\c:\1vppp.exec:\1vppp.exe56⤵
- Executes dropped EXE
PID:2996 -
\??\c:\xxllxxx.exec:\xxllxxx.exe57⤵
- Executes dropped EXE
PID:840 -
\??\c:\lrxrrlx.exec:\lrxrrlx.exe58⤵
- Executes dropped EXE
PID:3596 -
\??\c:\nhnnnn.exec:\nhnnnn.exe59⤵
- Executes dropped EXE
PID:2744 -
\??\c:\bthnbn.exec:\bthnbn.exe60⤵
- Executes dropped EXE
PID:3168 -
\??\c:\djvjd.exec:\djvjd.exe61⤵
- Executes dropped EXE
PID:2884 -
\??\c:\xlxrrrx.exec:\xlxrrrx.exe62⤵
- Executes dropped EXE
PID:812 -
\??\c:\rlfrrxr.exec:\rlfrrxr.exe63⤵
- Executes dropped EXE
PID:4884 -
\??\c:\bthbhh.exec:\bthbhh.exe64⤵
- Executes dropped EXE
PID:3012 -
\??\c:\7thhnt.exec:\7thhnt.exe65⤵
- Executes dropped EXE
PID:1352 -
\??\c:\ddvvp.exec:\ddvvp.exe66⤵PID:884
-
\??\c:\ppvpv.exec:\ppvpv.exe67⤵PID:732
-
\??\c:\lffxrlr.exec:\lffxrlr.exe68⤵PID:3528
-
\??\c:\rfllfxx.exec:\rfllfxx.exe69⤵PID:4844
-
\??\c:\hhhhbh.exec:\hhhhbh.exe70⤵PID:4620
-
\??\c:\bbttnn.exec:\bbttnn.exe71⤵PID:4888
-
\??\c:\3ppjd.exec:\3ppjd.exe72⤵PID:2424
-
\??\c:\3lxxxxf.exec:\3lxxxxf.exe73⤵PID:2432
-
\??\c:\ffxxflx.exec:\ffxxflx.exe74⤵PID:3704
-
\??\c:\5ttbbn.exec:\5ttbbn.exe75⤵PID:1052
-
\??\c:\nbbbnt.exec:\nbbbnt.exe76⤵PID:3352
-
\??\c:\ddppj.exec:\ddppj.exe77⤵PID:1572
-
\??\c:\tntnnt.exec:\tntnnt.exe78⤵PID:1564
-
\??\c:\3ttbtt.exec:\3ttbtt.exe79⤵PID:3608
-
\??\c:\dpvvv.exec:\dpvvv.exe80⤵PID:4372
-
\??\c:\rfxrlxr.exec:\rfxrlxr.exe81⤵PID:684
-
\??\c:\3xxxrxr.exec:\3xxxrxr.exe82⤵PID:2108
-
\??\c:\nbtttt.exec:\nbtttt.exe83⤵PID:4500
-
\??\c:\vjppj.exec:\vjppj.exe84⤵PID:1624
-
\??\c:\pppjj.exec:\pppjj.exe85⤵PID:1576
-
\??\c:\flrlrlf.exec:\flrlrlf.exe86⤵PID:4112
-
\??\c:\xrxxxxf.exec:\xrxxxxf.exe87⤵PID:4144
-
\??\c:\1ntnnn.exec:\1ntnnn.exe88⤵PID:908
-
\??\c:\9vjdj.exec:\9vjdj.exe89⤵PID:1132
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe90⤵PID:4364
-
\??\c:\nbhbbb.exec:\nbhbbb.exe91⤵PID:4996
-
\??\c:\jpdvj.exec:\jpdvj.exe92⤵PID:4848
-
\??\c:\jdjjd.exec:\jdjjd.exe93⤵PID:1748
-
\??\c:\xlrrlll.exec:\xlrrlll.exe94⤵PID:2528
-
\??\c:\xrxlrrr.exec:\xrxlrrr.exe95⤵PID:4512
-
\??\c:\nhntbh.exec:\nhntbh.exe96⤵PID:2756
-
\??\c:\9tnbtn.exec:\9tnbtn.exe97⤵PID:1560
-
\??\c:\dvjjv.exec:\dvjjv.exe98⤵PID:1896
-
\??\c:\9jvpv.exec:\9jvpv.exe99⤵PID:2228
-
\??\c:\xllfxxx.exec:\xllfxxx.exe100⤵PID:4760
-
\??\c:\lxfxxlx.exec:\lxfxxlx.exe101⤵PID:3020
-
\??\c:\ttnhnn.exec:\ttnhnn.exe102⤵PID:2996
-
\??\c:\dppjj.exec:\dppjj.exe103⤵PID:452
-
\??\c:\djjjp.exec:\djjjp.exe104⤵PID:3432
-
\??\c:\fffffff.exec:\fffffff.exe105⤵PID:4396
-
\??\c:\rfffxrr.exec:\rfffxrr.exe106⤵PID:4892
-
\??\c:\bbhbhh.exec:\bbhbhh.exe107⤵PID:4904
-
\??\c:\bhtbbb.exec:\bhtbbb.exe108⤵PID:812
-
\??\c:\jvdvv.exec:\jvdvv.exe109⤵PID:3092
-
\??\c:\5rxxxxx.exec:\5rxxxxx.exe110⤵PID:2804
-
\??\c:\fxxfffr.exec:\fxxfffr.exe111⤵PID:1352
-
\??\c:\hhnbnh.exec:\hhnbnh.exe112⤵PID:884
-
\??\c:\pppvv.exec:\pppvv.exe113⤵PID:3532
-
\??\c:\vppjd.exec:\vppjd.exe114⤵PID:2008
-
\??\c:\fxxrlll.exec:\fxxrlll.exe115⤵PID:3600
-
\??\c:\ffrrffr.exec:\ffrrffr.exe116⤵PID:3688
-
\??\c:\tttttt.exec:\tttttt.exe117⤵PID:4024
-
\??\c:\thttnn.exec:\thttnn.exe118⤵PID:2424
-
\??\c:\5vpjd.exec:\5vpjd.exe119⤵PID:2432
-
\??\c:\vvpjj.exec:\vvpjj.exe120⤵PID:2116
-
\??\c:\xxxfflx.exec:\xxxfflx.exe121⤵PID:2132
-
\??\c:\xfllfff.exec:\xfllfff.exe122⤵PID:1720
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-