Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16/06/2024, 20:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
01389d44edcd5fa16126e0deab6345c0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
01389d44edcd5fa16126e0deab6345c0_NeikiAnalytics.exe
-
Size
106KB
-
MD5
01389d44edcd5fa16126e0deab6345c0
-
SHA1
b86140ef3d95e3dd5b3c83c708c72e534816bc6f
-
SHA256
def989f027784c9de06ee757552e6cc0a94b4be1e7efe0c85b559012e563e467
-
SHA512
b50a6a347d699bf30077e665f1af9a8b075a9465aa997e9991162c4b0297b761a771f4c12011dde8bc623c80c8b1e5819b496b2f3176ed227c9739b409a39bdc
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoTNKDeS98hPUdHV7RNzfJN7u:ymb3NkkiQ3mdBjFo5KDe88g1fD7u
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/2980-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3120-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4676-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4040-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2584-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3356-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4244-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/544-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2924-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/620-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3040-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2576-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3340-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1600-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1508-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2752-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4260-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3176-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3152-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1948-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3120 xflfrrr.exe 4676 btbnhh.exe 4040 1jdpd.exe 4004 fxxrffx.exe 4544 bttnhh.exe 2584 5pvpp.exe 3356 rxxrrlf.exe 4860 thbttt.exe 4244 tnthbb.exe 544 pvjpj.exe 2924 xrrrrxr.exe 620 hnttnb.exe 4484 pdpjj.exe 4880 fllflff.exe 3040 hhnhbb.exe 2576 3ddvv.exe 3340 rxfxxrr.exe 1600 nhtnnh.exe 540 jvddd.exe 1508 9xffxxr.exe 2752 3bttbb.exe 448 ppvpp.exe 4920 rflrlll.exe 4260 3fllfff.exe 4592 bbbbtt.exe 3176 7nnntt.exe 5044 jpvpd.exe 3152 rfffxxr.exe 1948 nnnhtn.exe 2536 tnttnn.exe 1576 djjdp.exe 4268 xxlrxxf.exe 1880 fxfflll.exe 4296 hbhbbt.exe 3960 btbttt.exe 2100 3dppj.exe 1844 1vpjv.exe 2976 rfrrflf.exe 1208 xxxrrlf.exe 5080 hnttnn.exe 1620 httnnn.exe 4328 pjjdv.exe 2688 jdjjd.exe 1464 xrrlxxx.exe 2492 rllllll.exe 2316 3tbtnh.exe 1400 bbhbhh.exe 4864 pdpdj.exe 3708 pjvpj.exe 3424 llllfll.exe 4548 nbbbbb.exe 3972 tbnhnn.exe 3556 pdddp.exe 1520 pvdvp.exe 624 ffffllr.exe 1796 lfxxrrl.exe 2308 tthhnn.exe 4932 hnnntt.exe 2612 ddjdv.exe 2220 pvvpj.exe 4248 frfflff.exe 3280 bttnhh.exe 3040 hbhbtt.exe 3224 jdppv.exe -
resource yara_rule behavioral2/memory/2980-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3120-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4676-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2584-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3356-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/544-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/620-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3040-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2576-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3340-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1600-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1508-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2752-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4260-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3176-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1948-191-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2980 wrote to memory of 3120 2980 01389d44edcd5fa16126e0deab6345c0_NeikiAnalytics.exe 81 PID 2980 wrote to memory of 3120 2980 01389d44edcd5fa16126e0deab6345c0_NeikiAnalytics.exe 81 PID 2980 wrote to memory of 3120 2980 01389d44edcd5fa16126e0deab6345c0_NeikiAnalytics.exe 81 PID 3120 wrote to memory of 4676 3120 xflfrrr.exe 82 PID 3120 wrote to memory of 4676 3120 xflfrrr.exe 82 PID 3120 wrote to memory of 4676 3120 xflfrrr.exe 82 PID 4676 wrote to memory of 4040 4676 btbnhh.exe 83 PID 4676 wrote to memory of 4040 4676 btbnhh.exe 83 PID 4676 wrote to memory of 4040 4676 btbnhh.exe 83 PID 4040 wrote to memory of 4004 4040 1jdpd.exe 84 PID 4040 wrote to memory of 4004 4040 1jdpd.exe 84 PID 4040 wrote to memory of 4004 4040 1jdpd.exe 84 PID 4004 wrote to memory of 4544 4004 fxxrffx.exe 85 PID 4004 wrote to memory of 4544 4004 fxxrffx.exe 85 PID 4004 wrote to memory of 4544 4004 fxxrffx.exe 85 PID 4544 wrote to memory of 2584 4544 bttnhh.exe 86 PID 4544 wrote to memory of 2584 4544 bttnhh.exe 86 PID 4544 wrote to memory of 2584 4544 bttnhh.exe 86 PID 2584 wrote to memory of 3356 2584 5pvpp.exe 87 PID 2584 wrote to memory of 3356 2584 5pvpp.exe 87 PID 2584 wrote to memory of 3356 2584 5pvpp.exe 87 PID 3356 wrote to memory of 4860 3356 rxxrrlf.exe 88 PID 3356 wrote to memory of 4860 3356 rxxrrlf.exe 88 PID 3356 wrote to memory of 4860 3356 rxxrrlf.exe 88 PID 4860 wrote to memory of 4244 4860 thbttt.exe 89 PID 4860 wrote to memory of 4244 4860 thbttt.exe 89 PID 4860 wrote to memory of 4244 4860 thbttt.exe 89 PID 4244 wrote to memory of 544 4244 tnthbb.exe 90 PID 4244 wrote to memory of 544 4244 tnthbb.exe 90 PID 4244 wrote to memory of 544 4244 tnthbb.exe 90 PID 544 wrote to memory of 2924 544 pvjpj.exe 91 PID 544 wrote to memory of 2924 544 pvjpj.exe 91 PID 544 wrote to memory of 2924 544 pvjpj.exe 91 PID 2924 wrote to memory of 620 2924 xrrrrxr.exe 92 PID 2924 wrote to memory of 620 2924 xrrrrxr.exe 92 PID 2924 wrote to memory of 620 2924 xrrrrxr.exe 92 PID 620 wrote to memory of 4484 620 hnttnb.exe 93 PID 620 wrote to memory of 4484 620 hnttnb.exe 93 PID 620 wrote to memory of 4484 620 hnttnb.exe 93 PID 4484 wrote to memory of 4880 4484 pdpjj.exe 94 PID 4484 wrote to memory of 4880 4484 pdpjj.exe 94 PID 4484 wrote to memory of 4880 4484 pdpjj.exe 94 PID 4880 wrote to memory of 3040 4880 fllflff.exe 95 PID 4880 wrote to memory of 3040 4880 fllflff.exe 95 PID 4880 wrote to memory of 3040 4880 fllflff.exe 95 PID 3040 wrote to memory of 2576 3040 hhnhbb.exe 96 PID 3040 wrote to memory of 2576 3040 hhnhbb.exe 96 PID 3040 wrote to memory of 2576 3040 hhnhbb.exe 96 PID 2576 wrote to memory of 3340 2576 3ddvv.exe 97 PID 2576 wrote to memory of 3340 2576 3ddvv.exe 97 PID 2576 wrote to memory of 3340 2576 3ddvv.exe 97 PID 3340 wrote to memory of 1600 3340 rxfxxrr.exe 99 PID 3340 wrote to memory of 1600 3340 rxfxxrr.exe 99 PID 3340 wrote to memory of 1600 3340 rxfxxrr.exe 99 PID 1600 wrote to memory of 540 1600 nhtnnh.exe 100 PID 1600 wrote to memory of 540 1600 nhtnnh.exe 100 PID 1600 wrote to memory of 540 1600 nhtnnh.exe 100 PID 540 wrote to memory of 1508 540 jvddd.exe 102 PID 540 wrote to memory of 1508 540 jvddd.exe 102 PID 540 wrote to memory of 1508 540 jvddd.exe 102 PID 1508 wrote to memory of 2752 1508 9xffxxr.exe 103 PID 1508 wrote to memory of 2752 1508 9xffxxr.exe 103 PID 1508 wrote to memory of 2752 1508 9xffxxr.exe 103 PID 2752 wrote to memory of 448 2752 3bttbb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\01389d44edcd5fa16126e0deab6345c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\01389d44edcd5fa16126e0deab6345c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\xflfrrr.exec:\xflfrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\btbnhh.exec:\btbnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\1jdpd.exec:\1jdpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\fxxrffx.exec:\fxxrffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\bttnhh.exec:\bttnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\5pvpp.exec:\5pvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\rxxrrlf.exec:\rxxrrlf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\thbttt.exec:\thbttt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\tnthbb.exec:\tnthbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
\??\c:\pvjpj.exec:\pvjpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\xrrrrxr.exec:\xrrrrxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\hnttnb.exec:\hnttnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
\??\c:\pdpjj.exec:\pdpjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\fllflff.exec:\fllflff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\hhnhbb.exec:\hhnhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\3ddvv.exec:\3ddvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\rxfxxrr.exec:\rxfxxrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
\??\c:\nhtnnh.exec:\nhtnnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\jvddd.exec:\jvddd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\9xffxxr.exec:\9xffxxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\3bttbb.exec:\3bttbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\ppvpp.exec:\ppvpp.exe23⤵
- Executes dropped EXE
PID:448 -
\??\c:\rflrlll.exec:\rflrlll.exe24⤵
- Executes dropped EXE
PID:4920 -
\??\c:\3fllfff.exec:\3fllfff.exe25⤵
- Executes dropped EXE
PID:4260 -
\??\c:\bbbbtt.exec:\bbbbtt.exe26⤵
- Executes dropped EXE
PID:4592 -
\??\c:\7nnntt.exec:\7nnntt.exe27⤵
- Executes dropped EXE
PID:3176 -
\??\c:\jpvpd.exec:\jpvpd.exe28⤵
- Executes dropped EXE
PID:5044 -
\??\c:\rfffxxr.exec:\rfffxxr.exe29⤵
- Executes dropped EXE
PID:3152 -
\??\c:\nnnhtn.exec:\nnnhtn.exe30⤵
- Executes dropped EXE
PID:1948 -
\??\c:\tnttnn.exec:\tnttnn.exe31⤵
- Executes dropped EXE
PID:2536 -
\??\c:\djjdp.exec:\djjdp.exe32⤵
- Executes dropped EXE
PID:1576 -
\??\c:\xxlrxxf.exec:\xxlrxxf.exe33⤵
- Executes dropped EXE
PID:4268 -
\??\c:\fxfflll.exec:\fxfflll.exe34⤵
- Executes dropped EXE
PID:1880 -
\??\c:\hbhbbt.exec:\hbhbbt.exe35⤵
- Executes dropped EXE
PID:4296 -
\??\c:\btbttt.exec:\btbttt.exe36⤵
- Executes dropped EXE
PID:3960 -
\??\c:\3dppj.exec:\3dppj.exe37⤵
- Executes dropped EXE
PID:2100 -
\??\c:\1vpjv.exec:\1vpjv.exe38⤵
- Executes dropped EXE
PID:1844 -
\??\c:\rfrrflf.exec:\rfrrflf.exe39⤵
- Executes dropped EXE
PID:2976 -
\??\c:\xxxrrlf.exec:\xxxrrlf.exe40⤵
- Executes dropped EXE
PID:1208 -
\??\c:\hnttnn.exec:\hnttnn.exe41⤵
- Executes dropped EXE
PID:5080 -
\??\c:\httnnn.exec:\httnnn.exe42⤵
- Executes dropped EXE
PID:1620 -
\??\c:\pjjdv.exec:\pjjdv.exe43⤵
- Executes dropped EXE
PID:4328 -
\??\c:\jdjjd.exec:\jdjjd.exe44⤵
- Executes dropped EXE
PID:2688 -
\??\c:\xrrlxxx.exec:\xrrlxxx.exe45⤵
- Executes dropped EXE
PID:1464 -
\??\c:\rllllll.exec:\rllllll.exe46⤵
- Executes dropped EXE
PID:2492 -
\??\c:\3tbtnh.exec:\3tbtnh.exe47⤵
- Executes dropped EXE
PID:2316 -
\??\c:\bbhbhh.exec:\bbhbhh.exe48⤵
- Executes dropped EXE
PID:1400 -
\??\c:\pdpdj.exec:\pdpdj.exe49⤵
- Executes dropped EXE
PID:4864 -
\??\c:\pjvpj.exec:\pjvpj.exe50⤵
- Executes dropped EXE
PID:3708 -
\??\c:\llllfll.exec:\llllfll.exe51⤵
- Executes dropped EXE
PID:3424 -
\??\c:\nbbbbb.exec:\nbbbbb.exe52⤵
- Executes dropped EXE
PID:4548 -
\??\c:\tbnhnn.exec:\tbnhnn.exe53⤵
- Executes dropped EXE
PID:3972 -
\??\c:\pdddp.exec:\pdddp.exe54⤵
- Executes dropped EXE
PID:3556 -
\??\c:\pvdvp.exec:\pvdvp.exe55⤵
- Executes dropped EXE
PID:1520 -
\??\c:\ffffllr.exec:\ffffllr.exe56⤵
- Executes dropped EXE
PID:624 -
\??\c:\lfxxrrl.exec:\lfxxrrl.exe57⤵
- Executes dropped EXE
PID:1796 -
\??\c:\tthhnn.exec:\tthhnn.exe58⤵
- Executes dropped EXE
PID:2308 -
\??\c:\hnnntt.exec:\hnnntt.exe59⤵
- Executes dropped EXE
PID:4932 -
\??\c:\ddjdv.exec:\ddjdv.exe60⤵
- Executes dropped EXE
PID:2612 -
\??\c:\pvvpj.exec:\pvvpj.exe61⤵
- Executes dropped EXE
PID:2220 -
\??\c:\frfflff.exec:\frfflff.exe62⤵
- Executes dropped EXE
PID:4248 -
\??\c:\bttnhh.exec:\bttnhh.exe63⤵
- Executes dropped EXE
PID:3280 -
\??\c:\hbhbtt.exec:\hbhbtt.exe64⤵
- Executes dropped EXE
PID:3040 -
\??\c:\jdppv.exec:\jdppv.exe65⤵
- Executes dropped EXE
PID:3224 -
\??\c:\jdvpp.exec:\jdvpp.exe66⤵PID:2352
-
\??\c:\rrxrffl.exec:\rrxrffl.exe67⤵PID:228
-
\??\c:\nttnhb.exec:\nttnhb.exe68⤵PID:3724
-
\??\c:\nnbtbb.exec:\nnbtbb.exe69⤵PID:540
-
\??\c:\9vdvv.exec:\9vdvv.exe70⤵PID:3048
-
\??\c:\ddjdd.exec:\ddjdd.exe71⤵PID:1408
-
\??\c:\frlfrrr.exec:\frlfrrr.exe72⤵PID:4856
-
\??\c:\7xfxrrx.exec:\7xfxrrx.exe73⤵PID:3584
-
\??\c:\hnntnn.exec:\hnntnn.exe74⤵PID:1868
-
\??\c:\ttthbb.exec:\ttthbb.exe75⤵PID:1460
-
\??\c:\jvvpj.exec:\jvvpj.exe76⤵PID:3692
-
\??\c:\frrrllf.exec:\frrrllf.exe77⤵PID:4828
-
\??\c:\rflfxxr.exec:\rflfxxr.exe78⤵PID:5112
-
\??\c:\tnhhbn.exec:\tnhhbn.exe79⤵PID:4992
-
\??\c:\nbbhtb.exec:\nbbhtb.exe80⤵PID:2448
-
\??\c:\vdjdv.exec:\vdjdv.exe81⤵PID:3596
-
\??\c:\lxxxrrr.exec:\lxxxrrr.exe82⤵PID:3344
-
\??\c:\httnnh.exec:\httnnh.exe83⤵PID:1588
-
\??\c:\nbhhtt.exec:\nbhhtt.exe84⤵PID:4652
-
\??\c:\vpdvv.exec:\vpdvv.exe85⤵PID:1544
-
\??\c:\pjppj.exec:\pjppj.exe86⤵PID:3324
-
\??\c:\3jpjj.exec:\3jpjj.exe87⤵PID:2256
-
\??\c:\lfrrllf.exec:\lfrrllf.exe88⤵PID:3456
-
\??\c:\xrlfxrr.exec:\xrlfxrr.exe89⤵PID:1880
-
\??\c:\tthntt.exec:\tthntt.exe90⤵PID:4296
-
\??\c:\btnhbh.exec:\btnhbh.exe91⤵PID:3960
-
\??\c:\1pjdj.exec:\1pjdj.exe92⤵PID:3036
-
\??\c:\dpppj.exec:\dpppj.exe93⤵PID:1372
-
\??\c:\ffllxrl.exec:\ffllxrl.exe94⤵PID:2976
-
\??\c:\hhhhbn.exec:\hhhhbn.exe95⤵PID:1208
-
\??\c:\hbtnhn.exec:\hbtnhn.exe96⤵PID:2252
-
\??\c:\jjppj.exec:\jjppj.exe97⤵PID:1620
-
\??\c:\xrllrxr.exec:\xrllrxr.exe98⤵PID:4328
-
\??\c:\llfxrrl.exec:\llfxrrl.exe99⤵PID:4408
-
\??\c:\5tttnn.exec:\5tttnn.exe100⤵PID:1464
-
\??\c:\7hnnnn.exec:\7hnnnn.exe101⤵PID:3480
-
\??\c:\pppvp.exec:\pppvp.exe102⤵PID:1096
-
\??\c:\pddvj.exec:\pddvj.exe103⤵PID:1764
-
\??\c:\frxxllx.exec:\frxxllx.exe104⤵PID:3020
-
\??\c:\rrrlffx.exec:\rrrlffx.exe105⤵PID:4544
-
\??\c:\nbnhbb.exec:\nbnhbb.exe106⤵PID:3300
-
\??\c:\9bhhtb.exec:\9bhhtb.exe107⤵PID:2620
-
\??\c:\ppjjv.exec:\ppjjv.exe108⤵PID:1580
-
\??\c:\ppvpd.exec:\ppvpd.exe109⤵PID:3556
-
\??\c:\1flfrrl.exec:\1flfrrl.exe110⤵PID:1520
-
\??\c:\xxrrlll.exec:\xxrrlll.exe111⤵PID:2956
-
\??\c:\tthbhn.exec:\tthbhn.exe112⤵PID:4488
-
\??\c:\htbbnn.exec:\htbbnn.exe113⤵PID:2924
-
\??\c:\vvpjv.exec:\vvpjv.exe114⤵PID:2096
-
\??\c:\frxfxxx.exec:\frxfxxx.exe115⤵PID:2764
-
\??\c:\7fllffx.exec:\7fllffx.exe116⤵PID:2220
-
\??\c:\tnnnhh.exec:\tnnnhh.exe117⤵PID:4248
-
\??\c:\hntnbh.exec:\hntnbh.exe118⤵PID:3980
-
\??\c:\ntnnhh.exec:\ntnnhh.exe119⤵PID:3040
-
\??\c:\1jjpd.exec:\1jjpd.exe120⤵PID:3224
-
\??\c:\jvdjd.exec:\jvdjd.exe121⤵PID:1600
-
\??\c:\llxrfff.exec:\llxrfff.exe122⤵PID:228
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-