Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
05-06-2024 07:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
47cea8209545d336d3b209d33d90e700_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
47cea8209545d336d3b209d33d90e700_NeikiAnalytics.exe
-
Size
61KB
-
MD5
47cea8209545d336d3b209d33d90e700
-
SHA1
ecaacff768ec00783217bcdc3b83c4eaff4668aa
-
SHA256
71d31d033ef5d845ce6b0158e5d28e4efb0524e7899da52f7f832e3bee01113f
-
SHA512
638a4c25f2b2e9525f33f410b126c8427ccb046315665409d942317fb590b0c0c92484e119ceed880f265e7fcaf9e4f144fcb20114c23089913138a42d902112
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvAEaFJLn:ymb3NkkiQ3mdBjFIvAvn
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/1616-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1292-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2044-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3428-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/452-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1884-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2148-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3184-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3740-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3508-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/768-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1880-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4316-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3668-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4028-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2632-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3440-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1012-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2288-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1536-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4868-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3616-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1292 3vdvp.exe 2044 xxxrfxx.exe 3428 xlrlffx.exe 452 tbtbtb.exe 2704 jjdvp.exe 1884 dvppj.exe 5044 xflfxxx.exe 3000 bthhbb.exe 4940 jjjpj.exe 2148 pdpdv.exe 3184 flxrlll.exe 4896 ttbbbb.exe 3740 dvppj.exe 3508 ffxrlll.exe 768 bthhnn.exe 1880 httnhh.exe 4316 ddjdd.exe 3668 llfxxxr.exe 796 7ntnbh.exe 4028 dpppj.exe 2632 rlxrlll.exe 3440 3flrlrr.exe 1468 bbbhhn.exe 1012 dpvvv.exe 1652 ppppj.exe 2288 xfxrrll.exe 1536 ffrxrrl.exe 2412 tnthbt.exe 4868 9vvvj.exe 3616 3fflffl.exe 1828 xrlfxrx.exe 1972 7bhhhh.exe 4804 vpdvp.exe 4984 vpjdv.exe 4156 xffxrrr.exe 4708 bbttnb.exe 1000 1nbnnb.exe 4548 vjpjj.exe 1128 lffxlrl.exe 1228 lrxxxxr.exe 1616 hnnnhh.exe 3560 9nhhtn.exe 3140 jjddp.exe 2372 vdjdv.exe 3964 9flfxxr.exe 2884 ffllffx.exe 4792 bnnhbb.exe 732 3jjdv.exe 2576 1djjv.exe 1172 fxxrlll.exe 4032 7bhhhh.exe 3996 9bttnn.exe 960 vpjdv.exe 1136 3ppvj.exe 2980 llllrrx.exe 4320 rfllfff.exe 2392 9bbbbb.exe 1656 nhhhnn.exe 3012 ddddv.exe 3784 jjdvp.exe 2976 fffxrrr.exe 1968 xlffffx.exe 4532 hnnntt.exe 4652 hnbbtt.exe -
resource yara_rule behavioral2/memory/1616-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1292-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3428-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/452-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1884-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3000-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3184-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3740-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3508-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/768-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1880-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4316-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4028-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2632-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3440-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1012-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2288-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1536-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4868-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-196-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1616 wrote to memory of 1292 1616 47cea8209545d336d3b209d33d90e700_NeikiAnalytics.exe 81 PID 1616 wrote to memory of 1292 1616 47cea8209545d336d3b209d33d90e700_NeikiAnalytics.exe 81 PID 1616 wrote to memory of 1292 1616 47cea8209545d336d3b209d33d90e700_NeikiAnalytics.exe 81 PID 1292 wrote to memory of 2044 1292 3vdvp.exe 82 PID 1292 wrote to memory of 2044 1292 3vdvp.exe 82 PID 1292 wrote to memory of 2044 1292 3vdvp.exe 82 PID 2044 wrote to memory of 3428 2044 xxxrfxx.exe 83 PID 2044 wrote to memory of 3428 2044 xxxrfxx.exe 83 PID 2044 wrote to memory of 3428 2044 xxxrfxx.exe 83 PID 3428 wrote to memory of 452 3428 xlrlffx.exe 84 PID 3428 wrote to memory of 452 3428 xlrlffx.exe 84 PID 3428 wrote to memory of 452 3428 xlrlffx.exe 84 PID 452 wrote to memory of 2704 452 tbtbtb.exe 85 PID 452 wrote to memory of 2704 452 tbtbtb.exe 85 PID 452 wrote to memory of 2704 452 tbtbtb.exe 85 PID 2704 wrote to memory of 1884 2704 jjdvp.exe 86 PID 2704 wrote to memory of 1884 2704 jjdvp.exe 86 PID 2704 wrote to memory of 1884 2704 jjdvp.exe 86 PID 1884 wrote to memory of 5044 1884 dvppj.exe 87 PID 1884 wrote to memory of 5044 1884 dvppj.exe 87 PID 1884 wrote to memory of 5044 1884 dvppj.exe 87 PID 5044 wrote to memory of 3000 5044 xflfxxx.exe 88 PID 5044 wrote to memory of 3000 5044 xflfxxx.exe 88 PID 5044 wrote to memory of 3000 5044 xflfxxx.exe 88 PID 3000 wrote to memory of 4940 3000 bthhbb.exe 90 PID 3000 wrote to memory of 4940 3000 bthhbb.exe 90 PID 3000 wrote to memory of 4940 3000 bthhbb.exe 90 PID 4940 wrote to memory of 2148 4940 jjjpj.exe 91 PID 4940 wrote to memory of 2148 4940 jjjpj.exe 91 PID 4940 wrote to memory of 2148 4940 jjjpj.exe 91 PID 2148 wrote to memory of 3184 2148 pdpdv.exe 92 PID 2148 wrote to memory of 3184 2148 pdpdv.exe 92 PID 2148 wrote to memory of 3184 2148 pdpdv.exe 92 PID 3184 wrote to memory of 4896 3184 flxrlll.exe 93 PID 3184 wrote to memory of 4896 3184 flxrlll.exe 93 PID 3184 wrote to memory of 4896 3184 flxrlll.exe 93 PID 4896 wrote to memory of 3740 4896 ttbbbb.exe 94 PID 4896 wrote to memory of 3740 4896 ttbbbb.exe 94 PID 4896 wrote to memory of 3740 4896 ttbbbb.exe 94 PID 3740 wrote to memory of 3508 3740 dvppj.exe 95 PID 3740 wrote to memory of 3508 3740 dvppj.exe 95 PID 3740 wrote to memory of 3508 3740 dvppj.exe 95 PID 3508 wrote to memory of 768 3508 ffxrlll.exe 97 PID 3508 wrote to memory of 768 3508 ffxrlll.exe 97 PID 3508 wrote to memory of 768 3508 ffxrlll.exe 97 PID 768 wrote to memory of 1880 768 bthhnn.exe 98 PID 768 wrote to memory of 1880 768 bthhnn.exe 98 PID 768 wrote to memory of 1880 768 bthhnn.exe 98 PID 1880 wrote to memory of 4316 1880 httnhh.exe 99 PID 1880 wrote to memory of 4316 1880 httnhh.exe 99 PID 1880 wrote to memory of 4316 1880 httnhh.exe 99 PID 4316 wrote to memory of 3668 4316 ddjdd.exe 100 PID 4316 wrote to memory of 3668 4316 ddjdd.exe 100 PID 4316 wrote to memory of 3668 4316 ddjdd.exe 100 PID 3668 wrote to memory of 796 3668 llfxxxr.exe 101 PID 3668 wrote to memory of 796 3668 llfxxxr.exe 101 PID 3668 wrote to memory of 796 3668 llfxxxr.exe 101 PID 796 wrote to memory of 4028 796 7ntnbh.exe 102 PID 796 wrote to memory of 4028 796 7ntnbh.exe 102 PID 796 wrote to memory of 4028 796 7ntnbh.exe 102 PID 4028 wrote to memory of 2632 4028 dpppj.exe 104 PID 4028 wrote to memory of 2632 4028 dpppj.exe 104 PID 4028 wrote to memory of 2632 4028 dpppj.exe 104 PID 2632 wrote to memory of 3440 2632 rlxrlll.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\47cea8209545d336d3b209d33d90e700_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\47cea8209545d336d3b209d33d90e700_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\3vdvp.exec:\3vdvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\xxxrfxx.exec:\xxxrfxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\xlrlffx.exec:\xlrlffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\tbtbtb.exec:\tbtbtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\jjdvp.exec:\jjdvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\dvppj.exec:\dvppj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\xflfxxx.exec:\xflfxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\bthhbb.exec:\bthhbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\jjjpj.exec:\jjjpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\pdpdv.exec:\pdpdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\flxrlll.exec:\flxrlll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\ttbbbb.exec:\ttbbbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\dvppj.exec:\dvppj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\ffxrlll.exec:\ffxrlll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\bthhnn.exec:\bthhnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\httnhh.exec:\httnhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\ddjdd.exec:\ddjdd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\llfxxxr.exec:\llfxxxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\7ntnbh.exec:\7ntnbh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
\??\c:\dpppj.exec:\dpppj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\rlxrlll.exec:\rlxrlll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\3flrlrr.exec:\3flrlrr.exe23⤵
- Executes dropped EXE
PID:3440 -
\??\c:\bbbhhn.exec:\bbbhhn.exe24⤵
- Executes dropped EXE
PID:1468 -
\??\c:\dpvvv.exec:\dpvvv.exe25⤵
- Executes dropped EXE
PID:1012 -
\??\c:\ppppj.exec:\ppppj.exe26⤵
- Executes dropped EXE
PID:1652 -
\??\c:\xfxrrll.exec:\xfxrrll.exe27⤵
- Executes dropped EXE
PID:2288 -
\??\c:\ffrxrrl.exec:\ffrxrrl.exe28⤵
- Executes dropped EXE
PID:1536 -
\??\c:\tnthbt.exec:\tnthbt.exe29⤵
- Executes dropped EXE
PID:2412 -
\??\c:\9vvvj.exec:\9vvvj.exe30⤵
- Executes dropped EXE
PID:4868 -
\??\c:\3fflffl.exec:\3fflffl.exe31⤵
- Executes dropped EXE
PID:3616 -
\??\c:\xrlfxrx.exec:\xrlfxrx.exe32⤵
- Executes dropped EXE
PID:1828 -
\??\c:\7bhhhh.exec:\7bhhhh.exe33⤵
- Executes dropped EXE
PID:1972 -
\??\c:\vpdvp.exec:\vpdvp.exe34⤵
- Executes dropped EXE
PID:4804 -
\??\c:\vpjdv.exec:\vpjdv.exe35⤵
- Executes dropped EXE
PID:4984 -
\??\c:\xffxrrr.exec:\xffxrrr.exe36⤵
- Executes dropped EXE
PID:4156 -
\??\c:\bbttnb.exec:\bbttnb.exe37⤵
- Executes dropped EXE
PID:4708 -
\??\c:\1nbnnb.exec:\1nbnnb.exe38⤵
- Executes dropped EXE
PID:1000 -
\??\c:\vjpjj.exec:\vjpjj.exe39⤵
- Executes dropped EXE
PID:4548 -
\??\c:\lffxlrl.exec:\lffxlrl.exe40⤵
- Executes dropped EXE
PID:1128 -
\??\c:\lrxxxxr.exec:\lrxxxxr.exe41⤵
- Executes dropped EXE
PID:1228 -
\??\c:\hnnnhh.exec:\hnnnhh.exe42⤵
- Executes dropped EXE
PID:1616 -
\??\c:\9nhhtn.exec:\9nhhtn.exe43⤵
- Executes dropped EXE
PID:3560 -
\??\c:\jjddp.exec:\jjddp.exe44⤵
- Executes dropped EXE
PID:3140 -
\??\c:\vdjdv.exec:\vdjdv.exe45⤵
- Executes dropped EXE
PID:2372 -
\??\c:\9flfxxr.exec:\9flfxxr.exe46⤵
- Executes dropped EXE
PID:3964 -
\??\c:\ffllffx.exec:\ffllffx.exe47⤵
- Executes dropped EXE
PID:2884 -
\??\c:\bnnhbb.exec:\bnnhbb.exe48⤵
- Executes dropped EXE
PID:4792 -
\??\c:\3jjdv.exec:\3jjdv.exe49⤵
- Executes dropped EXE
PID:732 -
\??\c:\1djjv.exec:\1djjv.exe50⤵
- Executes dropped EXE
PID:2576 -
\??\c:\fxxrlll.exec:\fxxrlll.exe51⤵
- Executes dropped EXE
PID:1172 -
\??\c:\7bhhhh.exec:\7bhhhh.exe52⤵
- Executes dropped EXE
PID:4032 -
\??\c:\9bttnn.exec:\9bttnn.exe53⤵
- Executes dropped EXE
PID:3996 -
\??\c:\vpjdv.exec:\vpjdv.exe54⤵
- Executes dropped EXE
PID:960 -
\??\c:\3ppvj.exec:\3ppvj.exe55⤵
- Executes dropped EXE
PID:1136 -
\??\c:\llllrrx.exec:\llllrrx.exe56⤵
- Executes dropped EXE
PID:2980 -
\??\c:\rfllfff.exec:\rfllfff.exe57⤵
- Executes dropped EXE
PID:4320 -
\??\c:\9bbbbb.exec:\9bbbbb.exe58⤵
- Executes dropped EXE
PID:2392 -
\??\c:\nhhhnn.exec:\nhhhnn.exe59⤵
- Executes dropped EXE
PID:1656 -
\??\c:\ddddv.exec:\ddddv.exe60⤵
- Executes dropped EXE
PID:3012 -
\??\c:\jjdvp.exec:\jjdvp.exe61⤵
- Executes dropped EXE
PID:3784 -
\??\c:\fffxrrr.exec:\fffxrrr.exe62⤵
- Executes dropped EXE
PID:2976 -
\??\c:\xlffffx.exec:\xlffffx.exe63⤵
- Executes dropped EXE
PID:1968 -
\??\c:\hnnntt.exec:\hnnntt.exe64⤵
- Executes dropped EXE
PID:4532 -
\??\c:\hnbbtt.exec:\hnbbtt.exe65⤵
- Executes dropped EXE
PID:4652 -
\??\c:\1ppjd.exec:\1ppjd.exe66⤵PID:5036
-
\??\c:\vjddd.exec:\vjddd.exe67⤵PID:1356
-
\??\c:\7lffxxf.exec:\7lffxxf.exe68⤵PID:4904
-
\??\c:\rxxfffl.exec:\rxxfffl.exe69⤵PID:2752
-
\??\c:\nhhhhh.exec:\nhhhhh.exe70⤵PID:4028
-
\??\c:\nntbnt.exec:\nntbnt.exe71⤵PID:3660
-
\??\c:\ppvdv.exec:\ppvdv.exe72⤵PID:4924
-
\??\c:\vjvpd.exec:\vjvpd.exe73⤵PID:820
-
\??\c:\3xlfllx.exec:\3xlfllx.exe74⤵PID:1824
-
\??\c:\9fffffx.exec:\9fffffx.exe75⤵PID:3436
-
\??\c:\7bhbbn.exec:\7bhbbn.exe76⤵PID:3928
-
\??\c:\hnntbb.exec:\hnntbb.exe77⤵PID:1188
-
\??\c:\vpjdv.exec:\vpjdv.exe78⤵PID:4248
-
\??\c:\ddjjd.exec:\ddjjd.exe79⤵PID:3304
-
\??\c:\rlxlxlx.exec:\rlxlxlx.exe80⤵PID:2412
-
\??\c:\1hnttt.exec:\1hnttt.exe81⤵PID:4416
-
\??\c:\ddppj.exec:\ddppj.exe82⤵PID:4264
-
\??\c:\jdjpj.exec:\jdjpj.exe83⤵PID:4584
-
\??\c:\xffflll.exec:\xffflll.exe84⤵PID:1828
-
\??\c:\bbtttt.exec:\bbtttt.exe85⤵PID:3172
-
\??\c:\ppvpp.exec:\ppvpp.exe86⤵PID:1516
-
\??\c:\jdjvp.exec:\jdjvp.exe87⤵PID:4988
-
\??\c:\xllfxxx.exec:\xllfxxx.exe88⤵PID:4736
-
\??\c:\xxrrrxr.exec:\xxrrrxr.exe89⤵PID:5076
-
\??\c:\7thhnn.exec:\7thhnn.exe90⤵PID:4708
-
\??\c:\dppdv.exec:\dppdv.exe91⤵PID:1000
-
\??\c:\vjjvj.exec:\vjjvj.exe92⤵PID:4548
-
\??\c:\lllxrlf.exec:\lllxrlf.exe93⤵PID:4420
-
\??\c:\fxrlffx.exec:\fxrlffx.exe94⤵PID:3644
-
\??\c:\tnhbbb.exec:\tnhbbb.exe95⤵PID:1616
-
\??\c:\bbthbb.exec:\bbthbb.exe96⤵PID:1444
-
\??\c:\jjpvv.exec:\jjpvv.exe97⤵PID:3444
-
\??\c:\rfxrffr.exec:\rfxrffr.exe98⤵PID:4348
-
\??\c:\lrxffxx.exec:\lrxffxx.exe99⤵PID:944
-
\??\c:\xxxrrrr.exec:\xxxrrrr.exe100⤵PID:452
-
\??\c:\bbnhhb.exec:\bbnhhb.exe101⤵PID:4792
-
\??\c:\dvvjd.exec:\dvvjd.exe102⤵PID:220
-
\??\c:\ddvdp.exec:\ddvdp.exe103⤵PID:2576
-
\??\c:\xrfxlfl.exec:\xrfxlfl.exe104⤵PID:1584
-
\??\c:\llxlfrx.exec:\llxlfrx.exe105⤵PID:784
-
\??\c:\nhhnbb.exec:\nhhnbb.exe106⤵PID:792
-
\??\c:\hbnnnn.exec:\hbnnnn.exe107⤵PID:960
-
\??\c:\dddpp.exec:\dddpp.exe108⤵PID:1136
-
\??\c:\flrlrrr.exec:\flrlrrr.exe109⤵PID:2980
-
\??\c:\xlxlrlx.exec:\xlxlrlx.exe110⤵PID:4320
-
\??\c:\bhnhnn.exec:\bhnhnn.exe111⤵PID:3740
-
\??\c:\nttnhb.exec:\nttnhb.exe112⤵PID:3508
-
\??\c:\vdjvv.exec:\vdjvv.exe113⤵PID:3012
-
\??\c:\pjvjp.exec:\pjvjp.exe114⤵PID:3784
-
\??\c:\xfllfrf.exec:\xfllfrf.exe115⤵PID:2976
-
\??\c:\3bhhbt.exec:\3bhhbt.exe116⤵PID:1968
-
\??\c:\hhhnbb.exec:\hhhnbb.exe117⤵PID:2956
-
\??\c:\1dddp.exec:\1dddp.exe118⤵PID:4652
-
\??\c:\dvjjd.exec:\dvjjd.exe119⤵PID:5036
-
\??\c:\ffrffrf.exec:\ffrffrf.exe120⤵PID:1356
-
\??\c:\flxlrxr.exec:\flxlrxr.exe121⤵PID:2616
-
\??\c:\bbhhbt.exec:\bbhhbt.exe122⤵PID:4480
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-