Analysis
-
max time kernel
150s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 05:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a96dd4eb94155e73dcec598f545eb130_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
a96dd4eb94155e73dcec598f545eb130_NeikiAnalytics.exe
-
Size
94KB
-
MD5
a96dd4eb94155e73dcec598f545eb130
-
SHA1
363e70c93e627a87a9a87bb64280eef10dad4b18
-
SHA256
6cb8fb268273d6db25f2d569f9e414860ffb16f36cb58dafa638404f1b8ee1a7
-
SHA512
861976f34b1aa141097dcdc028eb8e1eb3ec453fa625142a64cfe2f4b183d2daaf47e6428067c29019b8002e0e13254fc80f96e95869c2cc0b134eb16002dcbf
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDInWeNCYGyA2R7JxJAg8dtr:ymb3NkkiQ3mdBjFIWeFGyAsJAg2r
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/2364-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/768-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/540-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/540-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2160-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2600-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3896-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3296-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3808-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4804-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4576-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2980-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4192-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3648-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/812-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3852-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3916-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/732-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3448-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3424-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5080-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2072-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 768 1pdpp.exe 540 jjjvj.exe 2160 nbbtbt.exe 2600 pvvvv.exe 3896 xllxffr.exe 3296 xxfxlxf.exe 2584 1htnbt.exe 3808 httnhb.exe 2900 1dddv.exe 4804 frlxlxx.exe 2204 xlfxrlf.exe 3052 tbhbtn.exe 4512 jvppd.exe 3956 xrlfxrr.exe 4576 5rxlxxr.exe 2980 bnnhbt.exe 3596 vvjvd.exe 4192 9rxlffr.exe 3648 xllfxrl.exe 4508 ntntnb.exe 812 pdddv.exe 3852 vppdp.exe 5056 xrllfff.exe 3916 tnthht.exe 732 vdddv.exe 3448 pjpjp.exe 3528 llrlfxr.exe 4888 bnnbnt.exe 3424 djpjd.exe 5080 jpvpj.exe 2072 xrfrrff.exe 4928 nttnhb.exe 320 dpvvp.exe 3000 lrxrlll.exe 4868 hbtttt.exe 5040 dvvpj.exe 3212 3vvjv.exe 5012 fllffrx.exe 4304 bhtnht.exe 3088 9bhttn.exe 3684 pvddp.exe 1412 frxlfxx.exe 3368 lxxrllf.exe 4112 bnnbtn.exe 972 vdjdd.exe 3948 ttbnht.exe 4552 bhhtht.exe 2152 jdjvv.exe 3808 xlfxffx.exe 4700 flffxrf.exe 1152 tnnhhh.exe 760 jddvd.exe 4016 frrxflf.exe 1036 rflxrrl.exe 1232 nbbthh.exe 1120 9nhbtn.exe 4380 pvjdj.exe 1156 9ddvp.exe 3636 frfrxrl.exe 452 1hhbnh.exe 3728 hthbtt.exe 436 jdpdj.exe 2884 1vvjv.exe 2368 xxllfxr.exe -
resource yara_rule behavioral2/memory/2364-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/768-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/540-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/540-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2160-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2600-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3896-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3296-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3808-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4804-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4576-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2980-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3596-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4192-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/812-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3852-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3916-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/732-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3424-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5080-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2364 wrote to memory of 768 2364 a96dd4eb94155e73dcec598f545eb130_NeikiAnalytics.exe 82 PID 2364 wrote to memory of 768 2364 a96dd4eb94155e73dcec598f545eb130_NeikiAnalytics.exe 82 PID 2364 wrote to memory of 768 2364 a96dd4eb94155e73dcec598f545eb130_NeikiAnalytics.exe 82 PID 768 wrote to memory of 540 768 1pdpp.exe 83 PID 768 wrote to memory of 540 768 1pdpp.exe 83 PID 768 wrote to memory of 540 768 1pdpp.exe 83 PID 540 wrote to memory of 2160 540 jjjvj.exe 84 PID 540 wrote to memory of 2160 540 jjjvj.exe 84 PID 540 wrote to memory of 2160 540 jjjvj.exe 84 PID 2160 wrote to memory of 2600 2160 nbbtbt.exe 85 PID 2160 wrote to memory of 2600 2160 nbbtbt.exe 85 PID 2160 wrote to memory of 2600 2160 nbbtbt.exe 85 PID 2600 wrote to memory of 3896 2600 pvvvv.exe 86 PID 2600 wrote to memory of 3896 2600 pvvvv.exe 86 PID 2600 wrote to memory of 3896 2600 pvvvv.exe 86 PID 3896 wrote to memory of 3296 3896 xllxffr.exe 87 PID 3896 wrote to memory of 3296 3896 xllxffr.exe 87 PID 3896 wrote to memory of 3296 3896 xllxffr.exe 87 PID 3296 wrote to memory of 2584 3296 xxfxlxf.exe 88 PID 3296 wrote to memory of 2584 3296 xxfxlxf.exe 88 PID 3296 wrote to memory of 2584 3296 xxfxlxf.exe 88 PID 2584 wrote to memory of 3808 2584 1htnbt.exe 89 PID 2584 wrote to memory of 3808 2584 1htnbt.exe 89 PID 2584 wrote to memory of 3808 2584 1htnbt.exe 89 PID 3808 wrote to memory of 2900 3808 httnhb.exe 90 PID 3808 wrote to memory of 2900 3808 httnhb.exe 90 PID 3808 wrote to memory of 2900 3808 httnhb.exe 90 PID 2900 wrote to memory of 4804 2900 1dddv.exe 91 PID 2900 wrote to memory of 4804 2900 1dddv.exe 91 PID 2900 wrote to memory of 4804 2900 1dddv.exe 91 PID 4804 wrote to memory of 2204 4804 frlxlxx.exe 92 PID 4804 wrote to memory of 2204 4804 frlxlxx.exe 92 PID 4804 wrote to memory of 2204 4804 frlxlxx.exe 92 PID 2204 wrote to memory of 3052 2204 xlfxrlf.exe 93 PID 2204 wrote to memory of 3052 2204 xlfxrlf.exe 93 PID 2204 wrote to memory of 3052 2204 xlfxrlf.exe 93 PID 3052 wrote to memory of 4512 3052 tbhbtn.exe 94 PID 3052 wrote to memory of 4512 3052 tbhbtn.exe 94 PID 3052 wrote to memory of 4512 3052 tbhbtn.exe 94 PID 4512 wrote to memory of 3956 4512 jvppd.exe 95 PID 4512 wrote to memory of 3956 4512 jvppd.exe 95 PID 4512 wrote to memory of 3956 4512 jvppd.exe 95 PID 3956 wrote to memory of 4576 3956 xrlfxrr.exe 96 PID 3956 wrote to memory of 4576 3956 xrlfxrr.exe 96 PID 3956 wrote to memory of 4576 3956 xrlfxrr.exe 96 PID 4576 wrote to memory of 2980 4576 5rxlxxr.exe 97 PID 4576 wrote to memory of 2980 4576 5rxlxxr.exe 97 PID 4576 wrote to memory of 2980 4576 5rxlxxr.exe 97 PID 2980 wrote to memory of 3596 2980 bnnhbt.exe 98 PID 2980 wrote to memory of 3596 2980 bnnhbt.exe 98 PID 2980 wrote to memory of 3596 2980 bnnhbt.exe 98 PID 3596 wrote to memory of 4192 3596 vvjvd.exe 99 PID 3596 wrote to memory of 4192 3596 vvjvd.exe 99 PID 3596 wrote to memory of 4192 3596 vvjvd.exe 99 PID 4192 wrote to memory of 3648 4192 9rxlffr.exe 100 PID 4192 wrote to memory of 3648 4192 9rxlffr.exe 100 PID 4192 wrote to memory of 3648 4192 9rxlffr.exe 100 PID 3648 wrote to memory of 4508 3648 xllfxrl.exe 101 PID 3648 wrote to memory of 4508 3648 xllfxrl.exe 101 PID 3648 wrote to memory of 4508 3648 xllfxrl.exe 101 PID 4508 wrote to memory of 812 4508 ntntnb.exe 102 PID 4508 wrote to memory of 812 4508 ntntnb.exe 102 PID 4508 wrote to memory of 812 4508 ntntnb.exe 102 PID 812 wrote to memory of 3852 812 pdddv.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\a96dd4eb94155e73dcec598f545eb130_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a96dd4eb94155e73dcec598f545eb130_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\1pdpp.exec:\1pdpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\jjjvj.exec:\jjjvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\nbbtbt.exec:\nbbtbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\pvvvv.exec:\pvvvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\xllxffr.exec:\xllxffr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\xxfxlxf.exec:\xxfxlxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
\??\c:\1htnbt.exec:\1htnbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\httnhb.exec:\httnhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\1dddv.exec:\1dddv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\frlxlxx.exec:\frlxlxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\xlfxrlf.exec:\xlfxrlf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\tbhbtn.exec:\tbhbtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\jvppd.exec:\jvppd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\xrlfxrr.exec:\xrlfxrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\5rxlxxr.exec:\5rxlxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\bnnhbt.exec:\bnnhbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\vvjvd.exec:\vvjvd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\9rxlffr.exec:\9rxlffr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\xllfxrl.exec:\xllfxrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
\??\c:\ntntnb.exec:\ntntnb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\pdddv.exec:\pdddv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\vppdp.exec:\vppdp.exe23⤵
- Executes dropped EXE
PID:3852 -
\??\c:\xrllfff.exec:\xrllfff.exe24⤵
- Executes dropped EXE
PID:5056 -
\??\c:\tnthht.exec:\tnthht.exe25⤵
- Executes dropped EXE
PID:3916 -
\??\c:\vdddv.exec:\vdddv.exe26⤵
- Executes dropped EXE
PID:732 -
\??\c:\pjpjp.exec:\pjpjp.exe27⤵
- Executes dropped EXE
PID:3448 -
\??\c:\llrlfxr.exec:\llrlfxr.exe28⤵
- Executes dropped EXE
PID:3528 -
\??\c:\bnnbnt.exec:\bnnbnt.exe29⤵
- Executes dropped EXE
PID:4888 -
\??\c:\djpjd.exec:\djpjd.exe30⤵
- Executes dropped EXE
PID:3424 -
\??\c:\jpvpj.exec:\jpvpj.exe31⤵
- Executes dropped EXE
PID:5080 -
\??\c:\xrfrrff.exec:\xrfrrff.exe32⤵
- Executes dropped EXE
PID:2072 -
\??\c:\nttnhb.exec:\nttnhb.exe33⤵
- Executes dropped EXE
PID:4928 -
\??\c:\dpvvp.exec:\dpvvp.exe34⤵
- Executes dropped EXE
PID:320 -
\??\c:\lrxrlll.exec:\lrxrlll.exe35⤵
- Executes dropped EXE
PID:3000 -
\??\c:\hbtttt.exec:\hbtttt.exe36⤵
- Executes dropped EXE
PID:4868 -
\??\c:\dvvpj.exec:\dvvpj.exe37⤵
- Executes dropped EXE
PID:5040 -
\??\c:\3vvjv.exec:\3vvjv.exe38⤵
- Executes dropped EXE
PID:3212 -
\??\c:\fllffrx.exec:\fllffrx.exe39⤵
- Executes dropped EXE
PID:5012 -
\??\c:\bhtnht.exec:\bhtnht.exe40⤵
- Executes dropped EXE
PID:4304 -
\??\c:\9bhttn.exec:\9bhttn.exe41⤵
- Executes dropped EXE
PID:3088 -
\??\c:\pvddp.exec:\pvddp.exe42⤵
- Executes dropped EXE
PID:3684 -
\??\c:\frxlfxx.exec:\frxlfxx.exe43⤵
- Executes dropped EXE
PID:1412 -
\??\c:\lxxrllf.exec:\lxxrllf.exe44⤵
- Executes dropped EXE
PID:3368 -
\??\c:\bnnbtn.exec:\bnnbtn.exe45⤵
- Executes dropped EXE
PID:4112 -
\??\c:\vdjdd.exec:\vdjdd.exe46⤵
- Executes dropped EXE
PID:972 -
\??\c:\ttbnht.exec:\ttbnht.exe47⤵
- Executes dropped EXE
PID:3948 -
\??\c:\bhhtht.exec:\bhhtht.exe48⤵
- Executes dropped EXE
PID:4552 -
\??\c:\jdjvv.exec:\jdjvv.exe49⤵
- Executes dropped EXE
PID:2152 -
\??\c:\xlfxffx.exec:\xlfxffx.exe50⤵
- Executes dropped EXE
PID:3808 -
\??\c:\flffxrf.exec:\flffxrf.exe51⤵
- Executes dropped EXE
PID:4700 -
\??\c:\tnnhhh.exec:\tnnhhh.exe52⤵
- Executes dropped EXE
PID:1152 -
\??\c:\jddvd.exec:\jddvd.exe53⤵
- Executes dropped EXE
PID:760 -
\??\c:\frrxflf.exec:\frrxflf.exe54⤵
- Executes dropped EXE
PID:4016 -
\??\c:\rflxrrl.exec:\rflxrrl.exe55⤵
- Executes dropped EXE
PID:1036 -
\??\c:\nbbthh.exec:\nbbthh.exe56⤵
- Executes dropped EXE
PID:1232 -
\??\c:\9nhbtn.exec:\9nhbtn.exe57⤵
- Executes dropped EXE
PID:1120 -
\??\c:\pvjdj.exec:\pvjdj.exe58⤵
- Executes dropped EXE
PID:4380 -
\??\c:\9ddvp.exec:\9ddvp.exe59⤵
- Executes dropped EXE
PID:1156 -
\??\c:\frfrxrl.exec:\frfrxrl.exe60⤵
- Executes dropped EXE
PID:3636 -
\??\c:\1hhbnh.exec:\1hhbnh.exe61⤵
- Executes dropped EXE
PID:452 -
\??\c:\hthbtt.exec:\hthbtt.exe62⤵
- Executes dropped EXE
PID:3728 -
\??\c:\jdpdj.exec:\jdpdj.exe63⤵
- Executes dropped EXE
PID:436 -
\??\c:\1vvjv.exec:\1vvjv.exe64⤵
- Executes dropped EXE
PID:2884 -
\??\c:\xxllfxr.exec:\xxllfxr.exe65⤵
- Executes dropped EXE
PID:2368 -
\??\c:\ntnhbn.exec:\ntnhbn.exe66⤵PID:3060
-
\??\c:\thhtbh.exec:\thhtbh.exe67⤵PID:884
-
\??\c:\jvvdj.exec:\jvvdj.exe68⤵PID:1260
-
\??\c:\pvdvv.exec:\pvdvv.exe69⤵PID:2304
-
\??\c:\ffrlfrx.exec:\ffrlfrx.exe70⤵PID:2704
-
\??\c:\5lfrflf.exec:\5lfrflf.exe71⤵PID:3448
-
\??\c:\nnnhth.exec:\nnnhth.exe72⤵PID:4916
-
\??\c:\jvdpd.exec:\jvdpd.exe73⤵PID:636
-
\??\c:\rrrlxlf.exec:\rrrlxlf.exe74⤵PID:3192
-
\??\c:\lfxxrll.exec:\lfxxrll.exe75⤵PID:4796
-
\??\c:\bntnnn.exec:\bntnnn.exe76⤵PID:3928
-
\??\c:\vpjdp.exec:\vpjdp.exe77⤵PID:2424
-
\??\c:\rlxrxxr.exec:\rlxrxxr.exe78⤵PID:4928
-
\??\c:\5fxlxrl.exec:\5fxlxrl.exe79⤵PID:320
-
\??\c:\tbhbtn.exec:\tbhbtn.exe80⤵PID:3000
-
\??\c:\hnntnn.exec:\hnntnn.exe81⤵PID:4868
-
\??\c:\3vvpj.exec:\3vvpj.exe82⤵PID:2956
-
\??\c:\jvvvj.exec:\jvvvj.exe83⤵PID:4528
-
\??\c:\lfxxrxf.exec:\lfxxrxf.exe84⤵PID:4372
-
\??\c:\nhtbht.exec:\nhtbht.exe85⤵PID:4716
-
\??\c:\hbbtbb.exec:\hbbtbb.exe86⤵PID:3684
-
\??\c:\vjjvj.exec:\vjjvj.exe87⤵PID:540
-
\??\c:\pvvpv.exec:\pvvpv.exe88⤵PID:2648
-
\??\c:\9ffrfxx.exec:\9ffrfxx.exe89⤵PID:4212
-
\??\c:\1rlfrfr.exec:\1rlfrfr.exe90⤵PID:3372
-
\??\c:\rffrfxl.exec:\rffrfxl.exe91⤵PID:3048
-
\??\c:\btbntn.exec:\btbntn.exe92⤵PID:4552
-
\??\c:\dpjpv.exec:\dpjpv.exe93⤵PID:4704
-
\??\c:\vjdpj.exec:\vjdpj.exe94⤵PID:2952
-
\??\c:\lflxlff.exec:\lflxlff.exe95⤵PID:4700
-
\??\c:\rxxffxx.exec:\rxxffxx.exe96⤵PID:4964
-
\??\c:\3bbbbt.exec:\3bbbbt.exe97⤵PID:2204
-
\??\c:\btttbb.exec:\btttbb.exe98⤵PID:3860
-
\??\c:\pvpdj.exec:\pvpdj.exe99⤵PID:5004
-
\??\c:\pvvdp.exec:\pvvdp.exe100⤵PID:3804
-
\??\c:\rrrflfx.exec:\rrrflfx.exe101⤵PID:1904
-
\??\c:\lrfxlfr.exec:\lrfxlfr.exe102⤵PID:4092
-
\??\c:\thnbbt.exec:\thnbbt.exe103⤵PID:2852
-
\??\c:\3tnhnh.exec:\3tnhnh.exe104⤵PID:2428
-
\??\c:\vjjdp.exec:\vjjdp.exe105⤵PID:4708
-
\??\c:\5vpdp.exec:\5vpdp.exe106⤵PID:4596
-
\??\c:\lxrflfx.exec:\lxrflfx.exe107⤵PID:4396
-
\??\c:\9xlxllx.exec:\9xlxllx.exe108⤵PID:3432
-
\??\c:\hbbtnh.exec:\hbbtnh.exe109⤵PID:1032
-
\??\c:\hnhtnh.exec:\hnhtnh.exe110⤵PID:4556
-
\??\c:\dppjj.exec:\dppjj.exe111⤵PID:1524
-
\??\c:\1vpjv.exec:\1vpjv.exe112⤵PID:2760
-
\??\c:\1llxlfx.exec:\1llxlfx.exe113⤵PID:1664
-
\??\c:\rffxrlf.exec:\rffxrlf.exe114⤵PID:2164
-
\??\c:\tnnhtt.exec:\tnnhtt.exe115⤵PID:4296
-
\??\c:\ntthnt.exec:\ntthnt.exe116⤵PID:3756
-
\??\c:\ddpjj.exec:\ddpjj.exe117⤵PID:648
-
\??\c:\vddpd.exec:\vddpd.exe118⤵PID:1612
-
\??\c:\lrrfxrl.exec:\lrrfxrl.exe119⤵PID:1952
-
\??\c:\7ttntn.exec:\7ttntn.exe120⤵PID:2172
-
\??\c:\nbnhtn.exec:\nbnhtn.exe121⤵PID:4012
-
\??\c:\pppdv.exec:\pppdv.exe122⤵PID:1928
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-