Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 06:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
373ed25d65526bbe332b74369ec52940_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
373ed25d65526bbe332b74369ec52940_NeikiAnalytics.exe
-
Size
313KB
-
MD5
373ed25d65526bbe332b74369ec52940
-
SHA1
38afa388712e1fa8c322856525add9b3367e70f3
-
SHA256
b74316955e4d9e73a364fc0d2779573a2831dc935895206e1fcf243346b930a2
-
SHA512
c58177fd9835fe46c4d52d8fc51b2eb81f17bb755abe13ce1058e02ad500627bc0b467075202d9307eb1208ca074212a535ca1113edb014dc9883205dc26b859
-
SSDEEP
6144:n3C9BRo/AIX2h97aUzpbBj3+b2ziJC39QS8hDJd+Q7ZLbjwmm:n3C9uDC97aUFbZ42ziM39QS8hDJd+Q7y
Malware Config
Signatures
-
Detect Blackmoon payload 31 IoCs
resource yara_rule behavioral2/memory/4036-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1456-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1772-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1668-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4084-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4928-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3956-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3268-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4580-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3792-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3992-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3988-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/548-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/728-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2908-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/780-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4868-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/416-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4772-82-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4772-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2440-75-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2440-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3464-68-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3464-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1456-61-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1788-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1744-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4388-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3192 3lrfxxr.exe 4388 frxlxxl.exe 4036 btnhbb.exe 1744 vppjd.exe 1788 pjpjd.exe 5064 3ffxrlf.exe 1456 thnhbb.exe 3464 bntnbb.exe 2440 vjjjd.exe 4772 fflfrrl.exe 416 xfllxxl.exe 4868 ttnnnn.exe 4824 jddvv.exe 780 vjpjj.exe 2908 rlffxff.exe 728 9xxrffx.exe 548 bhnnnn.exe 2028 ttbttn.exe 3988 pdvpj.exe 3992 rfrxfff.exe 3792 9lrrlll.exe 3680 ntbtnh.exe 4580 btnnhn.exe 3268 ppjdv.exe 3956 fxxrfll.exe 4928 fxfxrlf.exe 3872 1hhbtt.exe 4084 bnnhnh.exe 1668 pvdvj.exe 1772 vjdvp.exe 4068 lrxrxxr.exe 2520 hhnbth.exe 2268 jpjdv.exe 4508 xlxffff.exe 4536 xxrrfff.exe 2480 thnhbb.exe 2764 jdjdv.exe 4576 lxfxrrl.exe 1656 flfxxxx.exe 408 bhnnhh.exe 3140 nhhbnn.exe 4612 3djvp.exe 2684 jvjdp.exe 2040 flxlffx.exe 3084 rllfrff.exe 4384 bhthbb.exe 3756 dpppj.exe 4020 dpppj.exe 3728 rrxrlff.exe 2756 flrxrlf.exe 4416 bnnhbt.exe 4820 thhbnn.exe 1744 jvpjp.exe 2776 dddjd.exe 3388 xlrlfxr.exe 2636 7hhbtn.exe 4300 tntnhh.exe 1704 vjpjd.exe 4592 jpppj.exe 1168 1lfxrlf.exe 3076 tnntnt.exe 2004 pjjdd.exe 3964 rrrlllx.exe 468 bhbhbb.exe -
resource yara_rule behavioral2/memory/4020-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1456-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1772-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1668-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4084-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3956-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3268-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3792-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3992-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3988-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/548-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/728-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2908-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/780-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4868-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/416-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4772-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2440-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3464-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1788-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1744-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4388-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-10-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4020 wrote to memory of 3192 4020 373ed25d65526bbe332b74369ec52940_NeikiAnalytics.exe 81 PID 4020 wrote to memory of 3192 4020 373ed25d65526bbe332b74369ec52940_NeikiAnalytics.exe 81 PID 4020 wrote to memory of 3192 4020 373ed25d65526bbe332b74369ec52940_NeikiAnalytics.exe 81 PID 3192 wrote to memory of 4388 3192 3lrfxxr.exe 82 PID 3192 wrote to memory of 4388 3192 3lrfxxr.exe 82 PID 3192 wrote to memory of 4388 3192 3lrfxxr.exe 82 PID 4388 wrote to memory of 4036 4388 frxlxxl.exe 83 PID 4388 wrote to memory of 4036 4388 frxlxxl.exe 83 PID 4388 wrote to memory of 4036 4388 frxlxxl.exe 83 PID 4036 wrote to memory of 1744 4036 btnhbb.exe 84 PID 4036 wrote to memory of 1744 4036 btnhbb.exe 84 PID 4036 wrote to memory of 1744 4036 btnhbb.exe 84 PID 1744 wrote to memory of 1788 1744 vppjd.exe 85 PID 1744 wrote to memory of 1788 1744 vppjd.exe 85 PID 1744 wrote to memory of 1788 1744 vppjd.exe 85 PID 1788 wrote to memory of 5064 1788 pjpjd.exe 86 PID 1788 wrote to memory of 5064 1788 pjpjd.exe 86 PID 1788 wrote to memory of 5064 1788 pjpjd.exe 86 PID 5064 wrote to memory of 1456 5064 3ffxrlf.exe 87 PID 5064 wrote to memory of 1456 5064 3ffxrlf.exe 87 PID 5064 wrote to memory of 1456 5064 3ffxrlf.exe 87 PID 1456 wrote to memory of 3464 1456 thnhbb.exe 88 PID 1456 wrote to memory of 3464 1456 thnhbb.exe 88 PID 1456 wrote to memory of 3464 1456 thnhbb.exe 88 PID 3464 wrote to memory of 2440 3464 bntnbb.exe 89 PID 3464 wrote to memory of 2440 3464 bntnbb.exe 89 PID 3464 wrote to memory of 2440 3464 bntnbb.exe 89 PID 2440 wrote to memory of 4772 2440 vjjjd.exe 90 PID 2440 wrote to memory of 4772 2440 vjjjd.exe 90 PID 2440 wrote to memory of 4772 2440 vjjjd.exe 90 PID 4772 wrote to memory of 416 4772 fflfrrl.exe 91 PID 4772 wrote to memory of 416 4772 fflfrrl.exe 91 PID 4772 wrote to memory of 416 4772 fflfrrl.exe 91 PID 416 wrote to memory of 4868 416 xfllxxl.exe 92 PID 416 wrote to memory of 4868 416 xfllxxl.exe 92 PID 416 wrote to memory of 4868 416 xfllxxl.exe 92 PID 4868 wrote to memory of 4824 4868 ttnnnn.exe 93 PID 4868 wrote to memory of 4824 4868 ttnnnn.exe 93 PID 4868 wrote to memory of 4824 4868 ttnnnn.exe 93 PID 4824 wrote to memory of 780 4824 jddvv.exe 94 PID 4824 wrote to memory of 780 4824 jddvv.exe 94 PID 4824 wrote to memory of 780 4824 jddvv.exe 94 PID 780 wrote to memory of 2908 780 vjpjj.exe 95 PID 780 wrote to memory of 2908 780 vjpjj.exe 95 PID 780 wrote to memory of 2908 780 vjpjj.exe 95 PID 2908 wrote to memory of 728 2908 rlffxff.exe 96 PID 2908 wrote to memory of 728 2908 rlffxff.exe 96 PID 2908 wrote to memory of 728 2908 rlffxff.exe 96 PID 728 wrote to memory of 548 728 9xxrffx.exe 97 PID 728 wrote to memory of 548 728 9xxrffx.exe 97 PID 728 wrote to memory of 548 728 9xxrffx.exe 97 PID 548 wrote to memory of 2028 548 bhnnnn.exe 146 PID 548 wrote to memory of 2028 548 bhnnnn.exe 146 PID 548 wrote to memory of 2028 548 bhnnnn.exe 146 PID 2028 wrote to memory of 3988 2028 ttbttn.exe 99 PID 2028 wrote to memory of 3988 2028 ttbttn.exe 99 PID 2028 wrote to memory of 3988 2028 ttbttn.exe 99 PID 3988 wrote to memory of 3992 3988 pdvpj.exe 100 PID 3988 wrote to memory of 3992 3988 pdvpj.exe 100 PID 3988 wrote to memory of 3992 3988 pdvpj.exe 100 PID 3992 wrote to memory of 3792 3992 rfrxfff.exe 101 PID 3992 wrote to memory of 3792 3992 rfrxfff.exe 101 PID 3992 wrote to memory of 3792 3992 rfrxfff.exe 101 PID 3792 wrote to memory of 3680 3792 9lrrlll.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\373ed25d65526bbe332b74369ec52940_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\373ed25d65526bbe332b74369ec52940_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\3lrfxxr.exec:\3lrfxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\frxlxxl.exec:\frxlxxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\btnhbb.exec:\btnhbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\vppjd.exec:\vppjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\pjpjd.exec:\pjpjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\3ffxrlf.exec:\3ffxrlf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\thnhbb.exec:\thnhbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\bntnbb.exec:\bntnbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
\??\c:\vjjjd.exec:\vjjjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\fflfrrl.exec:\fflfrrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\xfllxxl.exec:\xfllxxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
\??\c:\ttnnnn.exec:\ttnnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\jddvv.exec:\jddvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\vjpjj.exec:\vjpjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
\??\c:\rlffxff.exec:\rlffxff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\9xxrffx.exec:\9xxrffx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:728 -
\??\c:\bhnnnn.exec:\bhnnnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\ttbttn.exec:\ttbttn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\pdvpj.exec:\pdvpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\rfrxfff.exec:\rfrxfff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\9lrrlll.exec:\9lrrlll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
\??\c:\ntbtnh.exec:\ntbtnh.exe23⤵
- Executes dropped EXE
PID:3680 -
\??\c:\btnnhn.exec:\btnnhn.exe24⤵
- Executes dropped EXE
PID:4580 -
\??\c:\ppjdv.exec:\ppjdv.exe25⤵
- Executes dropped EXE
PID:3268 -
\??\c:\fxxrfll.exec:\fxxrfll.exe26⤵
- Executes dropped EXE
PID:3956 -
\??\c:\fxfxrlf.exec:\fxfxrlf.exe27⤵
- Executes dropped EXE
PID:4928 -
\??\c:\1hhbtt.exec:\1hhbtt.exe28⤵
- Executes dropped EXE
PID:3872 -
\??\c:\bnnhnh.exec:\bnnhnh.exe29⤵
- Executes dropped EXE
PID:4084 -
\??\c:\pvdvj.exec:\pvdvj.exe30⤵
- Executes dropped EXE
PID:1668 -
\??\c:\vjdvp.exec:\vjdvp.exe31⤵
- Executes dropped EXE
PID:1772 -
\??\c:\lrxrxxr.exec:\lrxrxxr.exe32⤵
- Executes dropped EXE
PID:4068 -
\??\c:\hhnbth.exec:\hhnbth.exe33⤵
- Executes dropped EXE
PID:2520 -
\??\c:\jpjdv.exec:\jpjdv.exe34⤵
- Executes dropped EXE
PID:2268 -
\??\c:\xlxffff.exec:\xlxffff.exe35⤵
- Executes dropped EXE
PID:4508 -
\??\c:\xxrrfff.exec:\xxrrfff.exe36⤵
- Executes dropped EXE
PID:4536 -
\??\c:\thnhbb.exec:\thnhbb.exe37⤵
- Executes dropped EXE
PID:2480 -
\??\c:\jdjdv.exec:\jdjdv.exe38⤵
- Executes dropped EXE
PID:2764 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe39⤵
- Executes dropped EXE
PID:4576 -
\??\c:\flfxxxx.exec:\flfxxxx.exe40⤵
- Executes dropped EXE
PID:1656 -
\??\c:\bhnnhh.exec:\bhnnhh.exe41⤵
- Executes dropped EXE
PID:408 -
\??\c:\nhhbnn.exec:\nhhbnn.exe42⤵
- Executes dropped EXE
PID:3140 -
\??\c:\3djvp.exec:\3djvp.exe43⤵
- Executes dropped EXE
PID:4612 -
\??\c:\jvjdp.exec:\jvjdp.exe44⤵
- Executes dropped EXE
PID:2684 -
\??\c:\flxlffx.exec:\flxlffx.exe45⤵
- Executes dropped EXE
PID:2040 -
\??\c:\rllfrff.exec:\rllfrff.exe46⤵
- Executes dropped EXE
PID:3084 -
\??\c:\bhthbb.exec:\bhthbb.exe47⤵
- Executes dropped EXE
PID:4384 -
\??\c:\dpppj.exec:\dpppj.exe48⤵
- Executes dropped EXE
PID:3756 -
\??\c:\dpppj.exec:\dpppj.exe49⤵
- Executes dropped EXE
PID:4020 -
\??\c:\rrxrlff.exec:\rrxrlff.exe50⤵
- Executes dropped EXE
PID:3728 -
\??\c:\flrxrlf.exec:\flrxrlf.exe51⤵
- Executes dropped EXE
PID:2756 -
\??\c:\bnnhbt.exec:\bnnhbt.exe52⤵
- Executes dropped EXE
PID:4416 -
\??\c:\thhbnn.exec:\thhbnn.exe53⤵
- Executes dropped EXE
PID:4820 -
\??\c:\jvpjp.exec:\jvpjp.exe54⤵
- Executes dropped EXE
PID:1744 -
\??\c:\dddjd.exec:\dddjd.exe55⤵
- Executes dropped EXE
PID:2776 -
\??\c:\xlrlfxr.exec:\xlrlfxr.exe56⤵
- Executes dropped EXE
PID:3388 -
\??\c:\7hhbtn.exec:\7hhbtn.exe57⤵
- Executes dropped EXE
PID:2636 -
\??\c:\tntnhh.exec:\tntnhh.exe58⤵
- Executes dropped EXE
PID:4300 -
\??\c:\vjpjd.exec:\vjpjd.exe59⤵
- Executes dropped EXE
PID:1704 -
\??\c:\jpppj.exec:\jpppj.exe60⤵
- Executes dropped EXE
PID:4592 -
\??\c:\1lfxrlf.exec:\1lfxrlf.exe61⤵
- Executes dropped EXE
PID:1168 -
\??\c:\tnntnt.exec:\tnntnt.exe62⤵
- Executes dropped EXE
PID:3076 -
\??\c:\pjjdd.exec:\pjjdd.exe63⤵
- Executes dropped EXE
PID:2004 -
\??\c:\rrrlllx.exec:\rrrlllx.exe64⤵
- Executes dropped EXE
PID:3964 -
\??\c:\bhbhbb.exec:\bhbhbb.exe65⤵
- Executes dropped EXE
PID:468 -
\??\c:\hhbbhh.exec:\hhbbhh.exe66⤵PID:5108
-
\??\c:\pjdvd.exec:\pjdvd.exe67⤵PID:2028
-
\??\c:\xlrlfxx.exec:\xlrlfxx.exe68⤵PID:868
-
\??\c:\ffllffx.exec:\ffllffx.exe69⤵PID:4404
-
\??\c:\tthhbn.exec:\tthhbn.exe70⤵PID:3960
-
\??\c:\vpvpj.exec:\vpvpj.exe71⤵PID:2356
-
\??\c:\frrfxxr.exec:\frrfxxr.exe72⤵PID:452
-
\??\c:\lxrfxrl.exec:\lxrfxrl.exe73⤵PID:4972
-
\??\c:\1hnthh.exec:\1hnthh.exe74⤵PID:1096
-
\??\c:\1djjv.exec:\1djjv.exe75⤵PID:1260
-
\??\c:\ddvjp.exec:\ddvjp.exe76⤵PID:3124
-
\??\c:\rlffxrl.exec:\rlffxrl.exe77⤵PID:2036
-
\??\c:\nnhbnh.exec:\nnhbnh.exe78⤵PID:4292
-
\??\c:\pjvdp.exec:\pjvdp.exe79⤵PID:1896
-
\??\c:\pvdpj.exec:\pvdpj.exe80⤵PID:1956
-
\??\c:\rflffxr.exec:\rflffxr.exe81⤵PID:3592
-
\??\c:\hhtttb.exec:\hhtttb.exe82⤵PID:1860
-
\??\c:\ntnbtb.exec:\ntnbtb.exe83⤵PID:1104
-
\??\c:\vjjjv.exec:\vjjjv.exe84⤵PID:2680
-
\??\c:\dppjd.exec:\dppjd.exe85⤵PID:1832
-
\??\c:\frrlffr.exec:\frrlffr.exe86⤵PID:3780
-
\??\c:\lrrlxrl.exec:\lrrlxrl.exe87⤵PID:5056
-
\??\c:\tnhbtn.exec:\tnhbtn.exe88⤵PID:3140
-
\??\c:\pjdvp.exec:\pjdvp.exe89⤵PID:3048
-
\??\c:\xlfxrrl.exec:\xlfxrrl.exe90⤵PID:3612
-
\??\c:\rllrxfx.exec:\rllrxfx.exe91⤵PID:3752
-
\??\c:\htnbtn.exec:\htnbtn.exe92⤵PID:3356
-
\??\c:\rrllfxr.exec:\rrllfxr.exe93⤵PID:2708
-
\??\c:\tbbttt.exec:\tbbttt.exe94⤵PID:236
-
\??\c:\thtnhh.exec:\thtnhh.exe95⤵PID:4540
-
\??\c:\djppj.exec:\djppj.exe96⤵PID:4348
-
\??\c:\ppdvd.exec:\ppdvd.exe97⤵PID:1984
-
\??\c:\fllxfxl.exec:\fllxfxl.exe98⤵PID:744
-
\??\c:\nhhbbt.exec:\nhhbbt.exe99⤵PID:3068
-
\??\c:\vvjpp.exec:\vvjpp.exe100⤵PID:2856
-
\??\c:\jvvvp.exec:\jvvvp.exe101⤵PID:2044
-
\??\c:\xrxfrrx.exec:\xrxfrrx.exe102⤵PID:2920
-
\??\c:\htnhbt.exec:\htnhbt.exe103⤵PID:2140
-
\??\c:\nhhbtn.exec:\nhhbtn.exe104⤵PID:700
-
\??\c:\3ppjd.exec:\3ppjd.exe105⤵PID:2636
-
\??\c:\dvjjd.exec:\dvjjd.exe106⤵PID:1440
-
\??\c:\llxrffl.exec:\llxrffl.exe107⤵PID:2436
-
\??\c:\bbntbt.exec:\bbntbt.exe108⤵PID:2296
-
\??\c:\jvjjj.exec:\jvjjj.exe109⤵PID:3944
-
\??\c:\5vppd.exec:\5vppd.exe110⤵PID:628
-
\??\c:\llfxrll.exec:\llfxrll.exe111⤵PID:2572
-
\??\c:\lllfxrl.exec:\lllfxrl.exe112⤵PID:3144
-
\??\c:\nhnhhn.exec:\nhnhhn.exe113⤵PID:536
-
\??\c:\jpppj.exec:\jpppj.exe114⤵PID:1748
-
\??\c:\jdjjj.exec:\jdjjj.exe115⤵PID:4556
-
\??\c:\rlfllxl.exec:\rlfllxl.exe116⤵PID:2516
-
\??\c:\frllflf.exec:\frllflf.exe117⤵PID:1236
-
\??\c:\3bbtnn.exec:\3bbtnn.exe118⤵PID:1392
-
\??\c:\nhbtnh.exec:\nhbtnh.exe119⤵PID:2068
-
\??\c:\7dvvp.exec:\7dvvp.exe120⤵PID:2356
-
\??\c:\ffxrrrr.exec:\ffxrrrr.exe121⤵PID:452
-
\??\c:\nhtbhh.exec:\nhtbhh.exe122⤵PID:2008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-