Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30-05-2024 05:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
670a366d9c3502226bb44d289bca8280_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
670a366d9c3502226bb44d289bca8280_NeikiAnalytics.exe
-
Size
70KB
-
MD5
670a366d9c3502226bb44d289bca8280
-
SHA1
72588d8b3c4df118caeff8a3534a3f6c407f1146
-
SHA256
33754ec150fe48c025ef07cd0b88cd2ac86218dde1598bf01851bd56d48e160d
-
SHA512
6fdc2b8f792c2581715aaccdb75151f3d812046b4df8a75a1160ecdd7446ba8c0d1ff639886cfd42d6b246cab7d08be5e720f7827963f6656dff1eaf272fc450
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb7tAHEqSCkKWSq:ymb3NkkiQ3mdBjFIynIKq
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/3208-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1332-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3292-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1444-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3552-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/856-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2008-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5076-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2244-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4684-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3996-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3704-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4984-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1488-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/452-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2948-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1216-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3580-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1648-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2928-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3052-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1332 hbbnnn.exe 2228 flxrrrr.exe 3292 hbbbbh.exe 4568 pdjdd.exe 1444 jpddp.exe 3552 1xxrlrl.exe 856 llrrlrr.exe 2008 hnnntt.exe 5116 pvdvp.exe 5076 rrfxlxf.exe 2244 btbtnh.exe 4020 lfxrxfr.exe 4684 fxlfffl.exe 3080 bhhnhb.exe 3996 ddjdd.exe 3212 lxlffff.exe 3704 rxrxrrf.exe 3632 hhbbnn.exe 1532 3jvpd.exe 4984 rxflxxx.exe 1488 7xflxfr.exe 3684 hhbbhh.exe 452 jpddp.exe 2948 vdpdp.exe 1216 7rxxrrr.exe 3580 tnbhhn.exe 4228 pvvpj.exe 1648 dpdvj.exe 2760 hbhntn.exe 2928 pjpdp.exe 3052 lxrxrrx.exe 648 9hnnnt.exe 3556 htbttt.exe 2000 jddvv.exe 5112 xfrlxxr.exe 1192 hhbbbb.exe 4592 ttbbtt.exe 4656 7vjdd.exe 4444 nbhhhh.exe 1052 pppjd.exe 1184 dpjjv.exe 3460 ffffflr.exe 3808 nthbnh.exe 2260 3bnbbn.exe 2180 jjvvd.exe 4584 vvjdp.exe 2008 frllxll.exe 3736 bhnhtb.exe 4796 vpvpd.exe 2812 lffxllf.exe 3132 rrrllff.exe 2376 tthbhh.exe 4904 bhnhbt.exe 4348 jvvpj.exe 5028 lfrrllx.exe 3224 xrlfxxr.exe 3560 tbnhhh.exe 3356 tbnnhh.exe 3212 vjvjj.exe 3732 pjjjv.exe 4860 jdvvj.exe 4640 lffxrlf.exe 4384 thbnhn.exe 3616 hnbtnn.exe -
resource yara_rule behavioral2/memory/3208-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1332-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3292-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4568-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1444-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3552-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/856-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2008-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5076-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5076-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5076-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5076-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2244-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4684-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3996-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3704-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4984-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1488-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/452-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2948-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1216-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3580-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1648-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2928-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3052-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3208 wrote to memory of 1332 3208 670a366d9c3502226bb44d289bca8280_NeikiAnalytics.exe 82 PID 3208 wrote to memory of 1332 3208 670a366d9c3502226bb44d289bca8280_NeikiAnalytics.exe 82 PID 3208 wrote to memory of 1332 3208 670a366d9c3502226bb44d289bca8280_NeikiAnalytics.exe 82 PID 1332 wrote to memory of 2228 1332 hbbnnn.exe 83 PID 1332 wrote to memory of 2228 1332 hbbnnn.exe 83 PID 1332 wrote to memory of 2228 1332 hbbnnn.exe 83 PID 2228 wrote to memory of 3292 2228 flxrrrr.exe 84 PID 2228 wrote to memory of 3292 2228 flxrrrr.exe 84 PID 2228 wrote to memory of 3292 2228 flxrrrr.exe 84 PID 3292 wrote to memory of 4568 3292 hbbbbh.exe 85 PID 3292 wrote to memory of 4568 3292 hbbbbh.exe 85 PID 3292 wrote to memory of 4568 3292 hbbbbh.exe 85 PID 4568 wrote to memory of 1444 4568 pdjdd.exe 86 PID 4568 wrote to memory of 1444 4568 pdjdd.exe 86 PID 4568 wrote to memory of 1444 4568 pdjdd.exe 86 PID 1444 wrote to memory of 3552 1444 jpddp.exe 87 PID 1444 wrote to memory of 3552 1444 jpddp.exe 87 PID 1444 wrote to memory of 3552 1444 jpddp.exe 87 PID 3552 wrote to memory of 856 3552 1xxrlrl.exe 88 PID 3552 wrote to memory of 856 3552 1xxrlrl.exe 88 PID 3552 wrote to memory of 856 3552 1xxrlrl.exe 88 PID 856 wrote to memory of 2008 856 llrrlrr.exe 89 PID 856 wrote to memory of 2008 856 llrrlrr.exe 89 PID 856 wrote to memory of 2008 856 llrrlrr.exe 89 PID 2008 wrote to memory of 5116 2008 hnnntt.exe 90 PID 2008 wrote to memory of 5116 2008 hnnntt.exe 90 PID 2008 wrote to memory of 5116 2008 hnnntt.exe 90 PID 5116 wrote to memory of 5076 5116 pvdvp.exe 91 PID 5116 wrote to memory of 5076 5116 pvdvp.exe 91 PID 5116 wrote to memory of 5076 5116 pvdvp.exe 91 PID 5076 wrote to memory of 2244 5076 rrfxlxf.exe 92 PID 5076 wrote to memory of 2244 5076 rrfxlxf.exe 92 PID 5076 wrote to memory of 2244 5076 rrfxlxf.exe 92 PID 2244 wrote to memory of 4020 2244 btbtnh.exe 93 PID 2244 wrote to memory of 4020 2244 btbtnh.exe 93 PID 2244 wrote to memory of 4020 2244 btbtnh.exe 93 PID 4020 wrote to memory of 4684 4020 lfxrxfr.exe 94 PID 4020 wrote to memory of 4684 4020 lfxrxfr.exe 94 PID 4020 wrote to memory of 4684 4020 lfxrxfr.exe 94 PID 4684 wrote to memory of 3080 4684 fxlfffl.exe 95 PID 4684 wrote to memory of 3080 4684 fxlfffl.exe 95 PID 4684 wrote to memory of 3080 4684 fxlfffl.exe 95 PID 3080 wrote to memory of 3996 3080 bhhnhb.exe 96 PID 3080 wrote to memory of 3996 3080 bhhnhb.exe 96 PID 3080 wrote to memory of 3996 3080 bhhnhb.exe 96 PID 3996 wrote to memory of 3212 3996 ddjdd.exe 97 PID 3996 wrote to memory of 3212 3996 ddjdd.exe 97 PID 3996 wrote to memory of 3212 3996 ddjdd.exe 97 PID 3212 wrote to memory of 3704 3212 lxlffff.exe 98 PID 3212 wrote to memory of 3704 3212 lxlffff.exe 98 PID 3212 wrote to memory of 3704 3212 lxlffff.exe 98 PID 3704 wrote to memory of 3632 3704 rxrxrrf.exe 99 PID 3704 wrote to memory of 3632 3704 rxrxrrf.exe 99 PID 3704 wrote to memory of 3632 3704 rxrxrrf.exe 99 PID 3632 wrote to memory of 1532 3632 hhbbnn.exe 100 PID 3632 wrote to memory of 1532 3632 hhbbnn.exe 100 PID 3632 wrote to memory of 1532 3632 hhbbnn.exe 100 PID 1532 wrote to memory of 4984 1532 3jvpd.exe 101 PID 1532 wrote to memory of 4984 1532 3jvpd.exe 101 PID 1532 wrote to memory of 4984 1532 3jvpd.exe 101 PID 4984 wrote to memory of 1488 4984 rxflxxx.exe 102 PID 4984 wrote to memory of 1488 4984 rxflxxx.exe 102 PID 4984 wrote to memory of 1488 4984 rxflxxx.exe 102 PID 1488 wrote to memory of 3684 1488 7xflxfr.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\670a366d9c3502226bb44d289bca8280_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\670a366d9c3502226bb44d289bca8280_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3208 -
\??\c:\hbbnnn.exec:\hbbnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\flxrrrr.exec:\flxrrrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\hbbbbh.exec:\hbbbbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\pdjdd.exec:\pdjdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\jpddp.exec:\jpddp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\1xxrlrl.exec:\1xxrlrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\llrrlrr.exec:\llrrlrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\hnnntt.exec:\hnnntt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\pvdvp.exec:\pvdvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\rrfxlxf.exec:\rrfxlxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\btbtnh.exec:\btbtnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\lfxrxfr.exec:\lfxrxfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\fxlfffl.exec:\fxlfffl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\bhhnhb.exec:\bhhnhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\ddjdd.exec:\ddjdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\lxlffff.exec:\lxlffff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\rxrxrrf.exec:\rxrxrrf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\hhbbnn.exec:\hhbbnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\3jvpd.exec:\3jvpd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\rxflxxx.exec:\rxflxxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\7xflxfr.exec:\7xflxfr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\hhbbhh.exec:\hhbbhh.exe23⤵
- Executes dropped EXE
PID:3684 -
\??\c:\jpddp.exec:\jpddp.exe24⤵
- Executes dropped EXE
PID:452 -
\??\c:\vdpdp.exec:\vdpdp.exe25⤵
- Executes dropped EXE
PID:2948 -
\??\c:\7rxxrrr.exec:\7rxxrrr.exe26⤵
- Executes dropped EXE
PID:1216 -
\??\c:\tnbhhn.exec:\tnbhhn.exe27⤵
- Executes dropped EXE
PID:3580 -
\??\c:\pvvpj.exec:\pvvpj.exe28⤵
- Executes dropped EXE
PID:4228 -
\??\c:\dpdvj.exec:\dpdvj.exe29⤵
- Executes dropped EXE
PID:1648 -
\??\c:\hbhntn.exec:\hbhntn.exe30⤵
- Executes dropped EXE
PID:2760 -
\??\c:\pjpdp.exec:\pjpdp.exe31⤵
- Executes dropped EXE
PID:2928 -
\??\c:\lxrxrrx.exec:\lxrxrrx.exe32⤵
- Executes dropped EXE
PID:3052 -
\??\c:\9hnnnt.exec:\9hnnnt.exe33⤵
- Executes dropped EXE
PID:648 -
\??\c:\htbttt.exec:\htbttt.exe34⤵
- Executes dropped EXE
PID:3556 -
\??\c:\jddvv.exec:\jddvv.exe35⤵
- Executes dropped EXE
PID:2000 -
\??\c:\xfrlxxr.exec:\xfrlxxr.exe36⤵
- Executes dropped EXE
PID:5112 -
\??\c:\hhbbbb.exec:\hhbbbb.exe37⤵
- Executes dropped EXE
PID:1192 -
\??\c:\ttbbtt.exec:\ttbbtt.exe38⤵
- Executes dropped EXE
PID:4592 -
\??\c:\7vjdd.exec:\7vjdd.exe39⤵
- Executes dropped EXE
PID:4656 -
\??\c:\5rrrlll.exec:\5rrrlll.exe40⤵PID:4268
-
\??\c:\nbhhhh.exec:\nbhhhh.exe41⤵
- Executes dropped EXE
PID:4444 -
\??\c:\pppjd.exec:\pppjd.exe42⤵
- Executes dropped EXE
PID:1052 -
\??\c:\dpjjv.exec:\dpjjv.exe43⤵
- Executes dropped EXE
PID:1184 -
\??\c:\ffffflr.exec:\ffffflr.exe44⤵
- Executes dropped EXE
PID:3460 -
\??\c:\nthbnh.exec:\nthbnh.exe45⤵
- Executes dropped EXE
PID:3808 -
\??\c:\3bnbbn.exec:\3bnbbn.exe46⤵
- Executes dropped EXE
PID:2260 -
\??\c:\jjvvd.exec:\jjvvd.exe47⤵
- Executes dropped EXE
PID:2180 -
\??\c:\vvjdp.exec:\vvjdp.exe48⤵
- Executes dropped EXE
PID:4584 -
\??\c:\frllxll.exec:\frllxll.exe49⤵
- Executes dropped EXE
PID:2008 -
\??\c:\bhnhtb.exec:\bhnhtb.exe50⤵
- Executes dropped EXE
PID:3736 -
\??\c:\vpvpd.exec:\vpvpd.exe51⤵
- Executes dropped EXE
PID:4796 -
\??\c:\lffxllf.exec:\lffxllf.exe52⤵
- Executes dropped EXE
PID:2812 -
\??\c:\rrrllff.exec:\rrrllff.exe53⤵
- Executes dropped EXE
PID:3132 -
\??\c:\tthbhh.exec:\tthbhh.exe54⤵
- Executes dropped EXE
PID:2376 -
\??\c:\bhnhbt.exec:\bhnhbt.exe55⤵
- Executes dropped EXE
PID:4904 -
\??\c:\jvvpj.exec:\jvvpj.exe56⤵
- Executes dropped EXE
PID:4348 -
\??\c:\lfrrllx.exec:\lfrrllx.exe57⤵
- Executes dropped EXE
PID:5028 -
\??\c:\xrlfxxr.exec:\xrlfxxr.exe58⤵
- Executes dropped EXE
PID:3224 -
\??\c:\tbnhhh.exec:\tbnhhh.exe59⤵
- Executes dropped EXE
PID:3560 -
\??\c:\tbnnhh.exec:\tbnnhh.exe60⤵
- Executes dropped EXE
PID:3356 -
\??\c:\vjvjj.exec:\vjvjj.exe61⤵
- Executes dropped EXE
PID:3212 -
\??\c:\pjjjv.exec:\pjjjv.exe62⤵
- Executes dropped EXE
PID:3732 -
\??\c:\jdvvj.exec:\jdvvj.exe63⤵
- Executes dropped EXE
PID:4860 -
\??\c:\lffxrlf.exec:\lffxrlf.exe64⤵
- Executes dropped EXE
PID:4640 -
\??\c:\thbnhn.exec:\thbnhn.exe65⤵
- Executes dropped EXE
PID:4384 -
\??\c:\hnbtnn.exec:\hnbtnn.exe66⤵
- Executes dropped EXE
PID:3616 -
\??\c:\1dpjj.exec:\1dpjj.exe67⤵PID:2696
-
\??\c:\lfxfrrr.exec:\lfxfrrr.exe68⤵PID:4416
-
\??\c:\9xfxffl.exec:\9xfxffl.exe69⤵PID:2884
-
\??\c:\hbbbbb.exec:\hbbbbb.exe70⤵PID:3196
-
\??\c:\ddpdv.exec:\ddpdv.exe71⤵PID:3956
-
\??\c:\rfffxll.exec:\rfffxll.exe72⤵PID:3464
-
\??\c:\rfffxxx.exec:\rfffxxx.exe73⤵PID:5100
-
\??\c:\pvjjd.exec:\pvjjd.exe74⤵PID:3756
-
\??\c:\vpppd.exec:\vpppd.exe75⤵PID:664
-
\??\c:\xrxrfff.exec:\xrxrfff.exe76⤵PID:4080
-
\??\c:\flrrllf.exec:\flrrllf.exe77⤵PID:2964
-
\??\c:\tnbthb.exec:\tnbthb.exe78⤵PID:1256
-
\??\c:\jvpdj.exec:\jvpdj.exe79⤵PID:4564
-
\??\c:\vjjvv.exec:\vjjvv.exe80⤵PID:464
-
\??\c:\ffxlffl.exec:\ffxlffl.exe81⤵PID:1628
-
\??\c:\9hbhbb.exec:\9hbhbb.exe82⤵PID:4928
-
\??\c:\bntnhh.exec:\bntnhh.exe83⤵PID:4440
-
\??\c:\ddvjv.exec:\ddvjv.exe84⤵PID:1212
-
\??\c:\djpdv.exec:\djpdv.exe85⤵PID:4324
-
\??\c:\rfflrll.exec:\rfflrll.exe86⤵PID:4368
-
\??\c:\xrflffl.exec:\xrflffl.exe87⤵PID:4296
-
\??\c:\hbhbbt.exec:\hbhbbt.exe88⤵PID:2952
-
\??\c:\bbbhtt.exec:\bbbhtt.exe89⤵PID:2556
-
\??\c:\jddvv.exec:\jddvv.exe90⤵PID:752
-
\??\c:\rllfxrr.exec:\rllfxrr.exe91⤵PID:1928
-
\??\c:\3xfxrlx.exec:\3xfxrlx.exe92⤵PID:3808
-
\??\c:\5hhhhh.exec:\5hhhhh.exe93⤵PID:3800
-
\??\c:\5ttbnt.exec:\5ttbnt.exe94⤵PID:4160
-
\??\c:\vjpjj.exec:\vjpjj.exe95⤵PID:3960
-
\??\c:\pjpjj.exec:\pjpjj.exe96⤵PID:1692
-
\??\c:\lffxxxx.exec:\lffxxxx.exe97⤵PID:5000
-
\??\c:\ffflxxl.exec:\ffflxxl.exe98⤵PID:2540
-
\??\c:\3bbbhh.exec:\3bbbhh.exe99⤵PID:4304
-
\??\c:\jvjjd.exec:\jvjjd.exe100⤵PID:4840
-
\??\c:\7vvdv.exec:\7vvdv.exe101⤵PID:2376
-
\??\c:\lffxrxx.exec:\lffxrxx.exe102⤵PID:5052
-
\??\c:\ntbtnh.exec:\ntbtnh.exe103⤵PID:4276
-
\??\c:\hbhbhh.exec:\hbhbhh.exe104⤵PID:2868
-
\??\c:\jddvj.exec:\jddvj.exe105⤵PID:4536
-
\??\c:\dddjd.exec:\dddjd.exe106⤵PID:3216
-
\??\c:\3rlfrxf.exec:\3rlfrxf.exe107⤵PID:3436
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe108⤵PID:4816
-
\??\c:\bhhbhh.exec:\bhhbhh.exe109⤵PID:4520
-
\??\c:\nnnntt.exec:\nnnntt.exe110⤵PID:1844
-
\??\c:\jvdvp.exec:\jvdvp.exe111⤵PID:1384
-
\??\c:\dddvp.exec:\dddvp.exe112⤵PID:224
-
\??\c:\lfrlxxr.exec:\lfrlxxr.exe113⤵PID:3616
-
\??\c:\ntnhhn.exec:\ntnhhn.exe114⤵PID:2424
-
\??\c:\hhnhhh.exec:\hhnhhh.exe115⤵PID:2884
-
\??\c:\pjpvp.exec:\pjpvp.exe116⤵PID:3204
-
\??\c:\jdppd.exec:\jdppd.exe117⤵PID:3464
-
\??\c:\xlrrlff.exec:\xlrrlff.exe118⤵PID:2572
-
\??\c:\hhnntb.exec:\hhnntb.exe119⤵PID:1632
-
\??\c:\9hntnn.exec:\9hntnn.exe120⤵PID:3908
-
\??\c:\7jpjj.exec:\7jpjj.exe121⤵PID:4168
-
\??\c:\pjpjv.exec:\pjpjv.exe122⤵PID:2276
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-