Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28-05-2024 01:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2cc1b47cdbfd32db5694b2edb07ceb10_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
2cc1b47cdbfd32db5694b2edb07ceb10_NeikiAnalytics.exe
-
Size
56KB
-
MD5
2cc1b47cdbfd32db5694b2edb07ceb10
-
SHA1
4fb78a4047a4afbcf5ea04cc942d246f947308ed
-
SHA256
53ae40a5f5e64a10d74076f1cca0230657775f3a74cfd3d716f2dc48b8deec50
-
SHA512
d3c3ae309d2a596cc8c3a8f3aa2033451553a34fe512cbf4bbc02535ee3cf5c7767bb9089678ae8ef2a5a42d955b38544ec77793c3218722c8af312d9e27c62a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuSwFH:ymb3NkkiQ3mdBjFIvIFH
Malware Config
Signatures
-
Detect Blackmoon payload 30 IoCs
resource yara_rule behavioral2/memory/4272-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3080-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3624-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/964-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1020-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1020-34-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3920-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4864-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1520-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3440-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3088-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4984-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3168-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2076-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3152-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2736-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4080-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4152-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3744-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4832-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1476-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4184-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4748-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1988-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3148-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1672-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1444-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4632-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3080 vvdvj.exe 3624 tttnhh.exe 964 5dvpv.exe 1020 jvpdv.exe 3920 rlxrllf.exe 4864 3pjdd.exe 1520 9pvpd.exe 3440 flflxlx.exe 3088 htntnt.exe 4984 ddjjd.exe 3168 xrrxxll.exe 2076 1nbbtt.exe 2736 pvddv.exe 3152 rfllxxx.exe 4080 3flxrxx.exe 4152 tthbhh.exe 2132 bthbbh.exe 3744 pdjjd.exe 3144 jpvvv.exe 4832 rxlffxf.exe 1476 btbbtt.exe 4184 9pdpv.exe 4748 lxxfrxx.exe 408 fxfxrrl.exe 1988 7tbhbt.exe 3148 nnnbnh.exe 4224 1pvvp.exe 1672 ffrlrxl.exe 1444 frrrrrr.exe 2364 3tbbtb.exe 4632 9djjd.exe 2476 7vjdv.exe 4924 llfflrr.exe 4436 nnnttb.exe 1696 pdpdj.exe 3380 3rrfxxx.exe 1740 nntbnn.exe 4576 hhbhtt.exe 1568 vdjdv.exe 2072 nntntb.exe 4300 7hhbnn.exe 4880 jjpjd.exe 4512 rlfxrrl.exe 1776 xxflrxl.exe 3476 1nnnnb.exe 3980 vppjj.exe 208 jjpjd.exe 4092 fxxllxx.exe 3376 lxflffl.exe 4380 nhtnbt.exe 4956 3pvpj.exe 2596 ppjjj.exe 2020 llrlxxf.exe 4532 hbtthh.exe 4844 nthhbb.exe 5020 vpvpj.exe 1700 dvvvp.exe 2288 lxlxxrr.exe 3436 nhhbtn.exe 3016 ttbnhn.exe 4976 vvvdp.exe 4792 xxfxrxx.exe 4080 xlrlffx.exe 4320 btbtth.exe -
resource yara_rule behavioral2/memory/4272-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3080-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3624-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/964-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1020-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1520-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1520-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3440-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3440-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3440-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4984-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3168-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2076-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2736-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4080-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4152-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3744-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4832-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1476-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4184-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4748-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1988-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3148-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1672-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1444-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4632-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4272 wrote to memory of 3080 4272 2cc1b47cdbfd32db5694b2edb07ceb10_NeikiAnalytics.exe 84 PID 4272 wrote to memory of 3080 4272 2cc1b47cdbfd32db5694b2edb07ceb10_NeikiAnalytics.exe 84 PID 4272 wrote to memory of 3080 4272 2cc1b47cdbfd32db5694b2edb07ceb10_NeikiAnalytics.exe 84 PID 3080 wrote to memory of 3624 3080 vvdvj.exe 85 PID 3080 wrote to memory of 3624 3080 vvdvj.exe 85 PID 3080 wrote to memory of 3624 3080 vvdvj.exe 85 PID 3624 wrote to memory of 964 3624 tttnhh.exe 86 PID 3624 wrote to memory of 964 3624 tttnhh.exe 86 PID 3624 wrote to memory of 964 3624 tttnhh.exe 86 PID 964 wrote to memory of 1020 964 5dvpv.exe 87 PID 964 wrote to memory of 1020 964 5dvpv.exe 87 PID 964 wrote to memory of 1020 964 5dvpv.exe 87 PID 1020 wrote to memory of 3920 1020 jvpdv.exe 88 PID 1020 wrote to memory of 3920 1020 jvpdv.exe 88 PID 1020 wrote to memory of 3920 1020 jvpdv.exe 88 PID 3920 wrote to memory of 4864 3920 rlxrllf.exe 89 PID 3920 wrote to memory of 4864 3920 rlxrllf.exe 89 PID 3920 wrote to memory of 4864 3920 rlxrllf.exe 89 PID 4864 wrote to memory of 1520 4864 3pjdd.exe 90 PID 4864 wrote to memory of 1520 4864 3pjdd.exe 90 PID 4864 wrote to memory of 1520 4864 3pjdd.exe 90 PID 1520 wrote to memory of 3440 1520 9pvpd.exe 91 PID 1520 wrote to memory of 3440 1520 9pvpd.exe 91 PID 1520 wrote to memory of 3440 1520 9pvpd.exe 91 PID 3440 wrote to memory of 3088 3440 flflxlx.exe 92 PID 3440 wrote to memory of 3088 3440 flflxlx.exe 92 PID 3440 wrote to memory of 3088 3440 flflxlx.exe 92 PID 3088 wrote to memory of 4984 3088 htntnt.exe 93 PID 3088 wrote to memory of 4984 3088 htntnt.exe 93 PID 3088 wrote to memory of 4984 3088 htntnt.exe 93 PID 4984 wrote to memory of 3168 4984 ddjjd.exe 94 PID 4984 wrote to memory of 3168 4984 ddjjd.exe 94 PID 4984 wrote to memory of 3168 4984 ddjjd.exe 94 PID 3168 wrote to memory of 2076 3168 xrrxxll.exe 95 PID 3168 wrote to memory of 2076 3168 xrrxxll.exe 95 PID 3168 wrote to memory of 2076 3168 xrrxxll.exe 95 PID 2076 wrote to memory of 2736 2076 1nbbtt.exe 96 PID 2076 wrote to memory of 2736 2076 1nbbtt.exe 96 PID 2076 wrote to memory of 2736 2076 1nbbtt.exe 96 PID 2736 wrote to memory of 3152 2736 pvddv.exe 97 PID 2736 wrote to memory of 3152 2736 pvddv.exe 97 PID 2736 wrote to memory of 3152 2736 pvddv.exe 97 PID 3152 wrote to memory of 4080 3152 rfllxxx.exe 98 PID 3152 wrote to memory of 4080 3152 rfllxxx.exe 98 PID 3152 wrote to memory of 4080 3152 rfllxxx.exe 98 PID 4080 wrote to memory of 4152 4080 3flxrxx.exe 99 PID 4080 wrote to memory of 4152 4080 3flxrxx.exe 99 PID 4080 wrote to memory of 4152 4080 3flxrxx.exe 99 PID 4152 wrote to memory of 2132 4152 tthbhh.exe 100 PID 4152 wrote to memory of 2132 4152 tthbhh.exe 100 PID 4152 wrote to memory of 2132 4152 tthbhh.exe 100 PID 2132 wrote to memory of 3744 2132 bthbbh.exe 101 PID 2132 wrote to memory of 3744 2132 bthbbh.exe 101 PID 2132 wrote to memory of 3744 2132 bthbbh.exe 101 PID 3744 wrote to memory of 3144 3744 pdjjd.exe 102 PID 3744 wrote to memory of 3144 3744 pdjjd.exe 102 PID 3744 wrote to memory of 3144 3744 pdjjd.exe 102 PID 3144 wrote to memory of 4832 3144 jpvvv.exe 103 PID 3144 wrote to memory of 4832 3144 jpvvv.exe 103 PID 3144 wrote to memory of 4832 3144 jpvvv.exe 103 PID 4832 wrote to memory of 1476 4832 rxlffxf.exe 104 PID 4832 wrote to memory of 1476 4832 rxlffxf.exe 104 PID 4832 wrote to memory of 1476 4832 rxlffxf.exe 104 PID 1476 wrote to memory of 4184 1476 btbbtt.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cc1b47cdbfd32db5694b2edb07ceb10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2cc1b47cdbfd32db5694b2edb07ceb10_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\vvdvj.exec:\vvdvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\tttnhh.exec:\tttnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\5dvpv.exec:\5dvpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\jvpdv.exec:\jvpdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\rlxrllf.exec:\rlxrllf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\3pjdd.exec:\3pjdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\9pvpd.exec:\9pvpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\flflxlx.exec:\flflxlx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\htntnt.exec:\htntnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\ddjjd.exec:\ddjjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\xrrxxll.exec:\xrrxxll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\1nbbtt.exec:\1nbbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\pvddv.exec:\pvddv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\rfllxxx.exec:\rfllxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\3flxrxx.exec:\3flxrxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\tthbhh.exec:\tthbhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\bthbbh.exec:\bthbbh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\pdjjd.exec:\pdjjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\jpvvv.exec:\jpvvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\rxlffxf.exec:\rxlffxf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\btbbtt.exec:\btbbtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\9pdpv.exec:\9pdpv.exe23⤵
- Executes dropped EXE
PID:4184 -
\??\c:\lxxfrxx.exec:\lxxfrxx.exe24⤵
- Executes dropped EXE
PID:4748 -
\??\c:\fxfxrrl.exec:\fxfxrrl.exe25⤵
- Executes dropped EXE
PID:408 -
\??\c:\7tbhbt.exec:\7tbhbt.exe26⤵
- Executes dropped EXE
PID:1988 -
\??\c:\nnnbnh.exec:\nnnbnh.exe27⤵
- Executes dropped EXE
PID:3148 -
\??\c:\1pvvp.exec:\1pvvp.exe28⤵
- Executes dropped EXE
PID:4224 -
\??\c:\ffrlrxl.exec:\ffrlrxl.exe29⤵
- Executes dropped EXE
PID:1672 -
\??\c:\frrrrrr.exec:\frrrrrr.exe30⤵
- Executes dropped EXE
PID:1444 -
\??\c:\3tbbtb.exec:\3tbbtb.exe31⤵
- Executes dropped EXE
PID:2364 -
\??\c:\9djjd.exec:\9djjd.exe32⤵
- Executes dropped EXE
PID:4632 -
\??\c:\7vjdv.exec:\7vjdv.exe33⤵
- Executes dropped EXE
PID:2476 -
\??\c:\llfflrr.exec:\llfflrr.exe34⤵
- Executes dropped EXE
PID:4924 -
\??\c:\nnnttb.exec:\nnnttb.exe35⤵
- Executes dropped EXE
PID:4436 -
\??\c:\pdpdj.exec:\pdpdj.exe36⤵
- Executes dropped EXE
PID:1696 -
\??\c:\3rrfxxx.exec:\3rrfxxx.exe37⤵
- Executes dropped EXE
PID:3380 -
\??\c:\nntbnn.exec:\nntbnn.exe38⤵
- Executes dropped EXE
PID:1740 -
\??\c:\hhbhtt.exec:\hhbhtt.exe39⤵
- Executes dropped EXE
PID:4576 -
\??\c:\vdjdv.exec:\vdjdv.exe40⤵
- Executes dropped EXE
PID:1568 -
\??\c:\nntntb.exec:\nntntb.exe41⤵
- Executes dropped EXE
PID:2072 -
\??\c:\7hhbnn.exec:\7hhbnn.exe42⤵
- Executes dropped EXE
PID:4300 -
\??\c:\jjpjd.exec:\jjpjd.exe43⤵
- Executes dropped EXE
PID:4880 -
\??\c:\rlfxrrl.exec:\rlfxrrl.exe44⤵
- Executes dropped EXE
PID:4512 -
\??\c:\xxflrxl.exec:\xxflrxl.exe45⤵
- Executes dropped EXE
PID:1776 -
\??\c:\1nnnnb.exec:\1nnnnb.exe46⤵
- Executes dropped EXE
PID:3476 -
\??\c:\vppjj.exec:\vppjj.exe47⤵
- Executes dropped EXE
PID:3980 -
\??\c:\jjpjd.exec:\jjpjd.exe48⤵
- Executes dropped EXE
PID:208 -
\??\c:\fxxllxx.exec:\fxxllxx.exe49⤵
- Executes dropped EXE
PID:4092 -
\??\c:\lxflffl.exec:\lxflffl.exe50⤵
- Executes dropped EXE
PID:3376 -
\??\c:\nhtnbt.exec:\nhtnbt.exe51⤵
- Executes dropped EXE
PID:4380 -
\??\c:\3pvpj.exec:\3pvpj.exe52⤵
- Executes dropped EXE
PID:4956 -
\??\c:\ppjjj.exec:\ppjjj.exe53⤵
- Executes dropped EXE
PID:2596 -
\??\c:\llrlxxf.exec:\llrlxxf.exe54⤵
- Executes dropped EXE
PID:2020 -
\??\c:\hbtthh.exec:\hbtthh.exe55⤵
- Executes dropped EXE
PID:4532 -
\??\c:\nthhbb.exec:\nthhbb.exe56⤵
- Executes dropped EXE
PID:4844 -
\??\c:\vpvpj.exec:\vpvpj.exe57⤵
- Executes dropped EXE
PID:5020 -
\??\c:\dvvvp.exec:\dvvvp.exe58⤵
- Executes dropped EXE
PID:1700 -
\??\c:\lxlxxrr.exec:\lxlxxrr.exe59⤵
- Executes dropped EXE
PID:2288 -
\??\c:\nhhbtn.exec:\nhhbtn.exe60⤵
- Executes dropped EXE
PID:3436 -
\??\c:\ttbnhn.exec:\ttbnhn.exe61⤵
- Executes dropped EXE
PID:3016 -
\??\c:\vvvdp.exec:\vvvdp.exe62⤵
- Executes dropped EXE
PID:4976 -
\??\c:\xxfxrxx.exec:\xxfxrxx.exe63⤵
- Executes dropped EXE
PID:4792 -
\??\c:\xlrlffx.exec:\xlrlffx.exe64⤵
- Executes dropped EXE
PID:4080 -
\??\c:\btbtth.exec:\btbtth.exe65⤵
- Executes dropped EXE
PID:4320 -
\??\c:\7vvpj.exec:\7vvpj.exe66⤵PID:1952
-
\??\c:\vvddv.exec:\vvddv.exe67⤵PID:1472
-
\??\c:\xfrrlrl.exec:\xfrrlrl.exe68⤵PID:548
-
\??\c:\btnhnb.exec:\btnhnb.exe69⤵PID:3444
-
\??\c:\9jpvv.exec:\9jpvv.exe70⤵PID:2044
-
\??\c:\pdvjv.exec:\pdvjv.exe71⤵PID:4560
-
\??\c:\xxfxrrr.exec:\xxfxrrr.exe72⤵PID:1936
-
\??\c:\hbtttt.exec:\hbtttt.exe73⤵PID:428
-
\??\c:\dvjdd.exec:\dvjdd.exe74⤵PID:2328
-
\??\c:\lrrxfxl.exec:\lrrxfxl.exe75⤵PID:2392
-
\??\c:\hnhhnt.exec:\hnhhnt.exe76⤵PID:3684
-
\??\c:\tnnnnt.exec:\tnnnnt.exe77⤵PID:3180
-
\??\c:\vpppp.exec:\vpppp.exe78⤵PID:336
-
\??\c:\vpjpv.exec:\vpjpv.exe79⤵PID:3244
-
\??\c:\9xlrflx.exec:\9xlrflx.exe80⤵PID:1840
-
\??\c:\lrrrrll.exec:\lrrrrll.exe81⤵PID:4732
-
\??\c:\bnnnnn.exec:\bnnnnn.exe82⤵PID:3404
-
\??\c:\jvjjv.exec:\jvjjv.exe83⤵PID:4400
-
\??\c:\djpjd.exec:\djpjd.exe84⤵PID:4472
-
\??\c:\frrllrr.exec:\frrllrr.exe85⤵PID:4500
-
\??\c:\9tbbbb.exec:\9tbbbb.exe86⤵PID:1808
-
\??\c:\bhnbht.exec:\bhnbht.exe87⤵PID:1696
-
\??\c:\jpjpd.exec:\jpjpd.exe88⤵PID:3380
-
\??\c:\7frxfll.exec:\7frxfll.exe89⤵PID:3756
-
\??\c:\1nbbtb.exec:\1nbbtb.exe90⤵PID:2520
-
\??\c:\jpdvd.exec:\jpdvd.exe91⤵PID:4628
-
\??\c:\rlxrllr.exec:\rlxrllr.exe92⤵PID:2800
-
\??\c:\1rfrrff.exec:\1rfrrff.exe93⤵PID:3760
-
\??\c:\ttnnnn.exec:\ttnnnn.exe94⤵PID:3960
-
\??\c:\ddvdv.exec:\ddvdv.exe95⤵PID:4076
-
\??\c:\pjdvp.exec:\pjdvp.exe96⤵PID:2268
-
\??\c:\xrxrlxr.exec:\xrxrlxr.exe97⤵PID:3624
-
\??\c:\nbbttt.exec:\nbbttt.exe98⤵PID:4404
-
\??\c:\ttbbbn.exec:\ttbbbn.exe99⤵PID:1020
-
\??\c:\1pjjd.exec:\1pjjd.exe100⤵PID:2656
-
\??\c:\vvpjd.exec:\vvpjd.exe101⤵PID:3224
-
\??\c:\fxffffl.exec:\fxffffl.exe102⤵PID:440
-
\??\c:\nhtnbn.exec:\nhtnbn.exe103⤵PID:3892
-
\??\c:\bhbtbn.exec:\bhbtbn.exe104⤵PID:2120
-
\??\c:\7vpjv.exec:\7vpjv.exe105⤵PID:4260
-
\??\c:\frffxxr.exec:\frffxxr.exe106⤵PID:2452
-
\??\c:\1nnnnn.exec:\1nnnnn.exe107⤵PID:3216
-
\??\c:\vvdjj.exec:\vvdjj.exe108⤵PID:3780
-
\??\c:\jdddv.exec:\jdddv.exe109⤵PID:1036
-
\??\c:\fllllrl.exec:\fllllrl.exe110⤵PID:5000
-
\??\c:\thnnnn.exec:\thnnnn.exe111⤵PID:1220
-
\??\c:\htbtbb.exec:\htbtbb.exe112⤵PID:1912
-
\??\c:\ppjdd.exec:\ppjdd.exe113⤵PID:3000
-
\??\c:\lfrlfff.exec:\lfrlfff.exe114⤵PID:1436
-
\??\c:\lxxffff.exec:\lxxffff.exe115⤵PID:1780
-
\??\c:\nbhbbb.exec:\nbhbbb.exe116⤵PID:2132
-
\??\c:\3thbtt.exec:\3thbtt.exe117⤵PID:2768
-
\??\c:\ppjdp.exec:\ppjdp.exe118⤵PID:3660
-
\??\c:\rffrfrf.exec:\rffrfrf.exe119⤵PID:3364
-
\??\c:\nhhbhh.exec:\nhhbhh.exe120⤵PID:2104
-
\??\c:\3vjdv.exec:\3vjdv.exe121⤵PID:1476
-
\??\c:\xrlfxxx.exec:\xrlfxxx.exe122⤵PID:4184
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-