Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03-06-2024 03:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9ab072ccd484d8da62ebb19ebdde2f60_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
9ab072ccd484d8da62ebb19ebdde2f60_NeikiAnalytics.exe
-
Size
835KB
-
MD5
9ab072ccd484d8da62ebb19ebdde2f60
-
SHA1
9912dc7816a7a9e8544ee7477cefcba7ddd0d011
-
SHA256
672913e70c81197a5f6633d5c5376330f7617a16c81c947183a2e4b7721953de
-
SHA512
dca4e79d183478b9322617e73648ee7807ecd47d8b262bdb225d805a356bd4e7b5eeac3023500917f31cad18b60051acd6d113126a4d4c5a36da49c4e474ba46
-
SSDEEP
24576:Sgdn8whSenedn8whhdn76gdn8whSfgdn8whSzn:TFyVPfm
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/2624-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4856-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2888-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4048-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/872-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/708-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2476-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1704-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3448-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4432-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4384-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3008-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/832-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4848-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4960-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3920-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1384-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3220-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3200-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1180-79-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1180-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/792-72-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/792-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4472-69-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4472-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2232-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3904-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4856 pdjjj.exe 3904 rrxfrlr.exe 2232 tnnntt.exe 2888 ppjjj.exe 4048 frllrfx.exe 1176 pvjvp.exe 3056 5rrfllr.exe 4472 9vpvv.exe 792 fxlxxff.exe 1180 hhttbb.exe 3200 vpdvv.exe 3220 fxxffff.exe 1384 bntbnh.exe 3920 7vvvd.exe 4960 llxxxfr.exe 4848 tthhhh.exe 832 dvddj.exe 3008 lxffrxl.exe 4384 bntttb.exe 4432 5jvvj.exe 4464 xfflrfl.exe 3448 ntbbbb.exe 3036 pdjpp.exe 932 xrfrffr.exe 1704 nnnhbt.exe 4348 pvjpp.exe 2476 tbtnbb.exe 708 jjppp.exe 1988 5rxxflr.exe 872 btbhht.exe 4180 dvdjv.exe 2980 rrrfrxx.exe 2616 pjpvp.exe 552 flxxllx.exe 1624 nntnbt.exe 1652 vjvdd.exe 392 rrrxflr.exe 2236 tnhnbn.exe 4568 lfrrfll.exe 1736 bbhhnn.exe 3632 jvpvv.exe 4012 rrxfffl.exe 888 nnttth.exe 216 vpvpp.exe 4616 lrrrrrr.exe 4324 thbhhn.exe 2924 1vvvv.exe 4204 rxlrrxf.exe 2096 nthhnn.exe 5108 pjjdj.exe 2800 lxfffff.exe 860 hbtttt.exe 472 vjvpd.exe 3252 bhnbnh.exe 1168 ddppp.exe 4652 lxxxrxf.exe 1680 hhnbtn.exe 2948 jdvpj.exe 2264 bnbbtb.exe 3376 dvdjd.exe 4964 flffrfx.exe 3220 nbhnnh.exe 3920 jppvj.exe 4960 nnnnnt.exe -
resource yara_rule behavioral2/memory/2624-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4048-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/872-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/708-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2476-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4432-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4384-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3008-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/832-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4848-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4960-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1384-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3220-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3200-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1180-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/792-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4472-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2232-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3904-17-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2624 wrote to memory of 4856 2624 9ab072ccd484d8da62ebb19ebdde2f60_NeikiAnalytics.exe 84 PID 2624 wrote to memory of 4856 2624 9ab072ccd484d8da62ebb19ebdde2f60_NeikiAnalytics.exe 84 PID 2624 wrote to memory of 4856 2624 9ab072ccd484d8da62ebb19ebdde2f60_NeikiAnalytics.exe 84 PID 4856 wrote to memory of 3904 4856 pdjjj.exe 85 PID 4856 wrote to memory of 3904 4856 pdjjj.exe 85 PID 4856 wrote to memory of 3904 4856 pdjjj.exe 85 PID 3904 wrote to memory of 2232 3904 rrxfrlr.exe 86 PID 3904 wrote to memory of 2232 3904 rrxfrlr.exe 86 PID 3904 wrote to memory of 2232 3904 rrxfrlr.exe 86 PID 2232 wrote to memory of 2888 2232 tnnntt.exe 87 PID 2232 wrote to memory of 2888 2232 tnnntt.exe 87 PID 2232 wrote to memory of 2888 2232 tnnntt.exe 87 PID 2888 wrote to memory of 4048 2888 ppjjj.exe 88 PID 2888 wrote to memory of 4048 2888 ppjjj.exe 88 PID 2888 wrote to memory of 4048 2888 ppjjj.exe 88 PID 4048 wrote to memory of 1176 4048 frllrfx.exe 89 PID 4048 wrote to memory of 1176 4048 frllrfx.exe 89 PID 4048 wrote to memory of 1176 4048 frllrfx.exe 89 PID 1176 wrote to memory of 3056 1176 pvjvp.exe 90 PID 1176 wrote to memory of 3056 1176 pvjvp.exe 90 PID 1176 wrote to memory of 3056 1176 pvjvp.exe 90 PID 3056 wrote to memory of 4472 3056 5rrfllr.exe 91 PID 3056 wrote to memory of 4472 3056 5rrfllr.exe 91 PID 3056 wrote to memory of 4472 3056 5rrfllr.exe 91 PID 4472 wrote to memory of 792 4472 9vpvv.exe 92 PID 4472 wrote to memory of 792 4472 9vpvv.exe 92 PID 4472 wrote to memory of 792 4472 9vpvv.exe 92 PID 792 wrote to memory of 1180 792 fxlxxff.exe 93 PID 792 wrote to memory of 1180 792 fxlxxff.exe 93 PID 792 wrote to memory of 1180 792 fxlxxff.exe 93 PID 1180 wrote to memory of 3200 1180 hhttbb.exe 94 PID 1180 wrote to memory of 3200 1180 hhttbb.exe 94 PID 1180 wrote to memory of 3200 1180 hhttbb.exe 94 PID 3200 wrote to memory of 3220 3200 vpdvv.exe 95 PID 3200 wrote to memory of 3220 3200 vpdvv.exe 95 PID 3200 wrote to memory of 3220 3200 vpdvv.exe 95 PID 3220 wrote to memory of 1384 3220 fxxffff.exe 96 PID 3220 wrote to memory of 1384 3220 fxxffff.exe 96 PID 3220 wrote to memory of 1384 3220 fxxffff.exe 96 PID 1384 wrote to memory of 3920 1384 bntbnh.exe 97 PID 1384 wrote to memory of 3920 1384 bntbnh.exe 97 PID 1384 wrote to memory of 3920 1384 bntbnh.exe 97 PID 3920 wrote to memory of 4960 3920 7vvvd.exe 98 PID 3920 wrote to memory of 4960 3920 7vvvd.exe 98 PID 3920 wrote to memory of 4960 3920 7vvvd.exe 98 PID 4960 wrote to memory of 4848 4960 llxxxfr.exe 99 PID 4960 wrote to memory of 4848 4960 llxxxfr.exe 99 PID 4960 wrote to memory of 4848 4960 llxxxfr.exe 99 PID 4848 wrote to memory of 832 4848 tthhhh.exe 100 PID 4848 wrote to memory of 832 4848 tthhhh.exe 100 PID 4848 wrote to memory of 832 4848 tthhhh.exe 100 PID 832 wrote to memory of 3008 832 dvddj.exe 101 PID 832 wrote to memory of 3008 832 dvddj.exe 101 PID 832 wrote to memory of 3008 832 dvddj.exe 101 PID 3008 wrote to memory of 4384 3008 lxffrxl.exe 102 PID 3008 wrote to memory of 4384 3008 lxffrxl.exe 102 PID 3008 wrote to memory of 4384 3008 lxffrxl.exe 102 PID 4384 wrote to memory of 4432 4384 bntttb.exe 103 PID 4384 wrote to memory of 4432 4384 bntttb.exe 103 PID 4384 wrote to memory of 4432 4384 bntttb.exe 103 PID 4432 wrote to memory of 4464 4432 5jvvj.exe 104 PID 4432 wrote to memory of 4464 4432 5jvvj.exe 104 PID 4432 wrote to memory of 4464 4432 5jvvj.exe 104 PID 4464 wrote to memory of 3448 4464 xfflrfl.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ab072ccd484d8da62ebb19ebdde2f60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9ab072ccd484d8da62ebb19ebdde2f60_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\pdjjj.exec:\pdjjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\rrxfrlr.exec:\rrxfrlr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\tnnntt.exec:\tnnntt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\ppjjj.exec:\ppjjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\frllrfx.exec:\frllrfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\pvjvp.exec:\pvjvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
\??\c:\5rrfllr.exec:\5rrfllr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\9vpvv.exec:\9vpvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\fxlxxff.exec:\fxlxxff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\hhttbb.exec:\hhttbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\vpdvv.exec:\vpdvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\fxxffff.exec:\fxxffff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\bntbnh.exec:\bntbnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\7vvvd.exec:\7vvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\llxxxfr.exec:\llxxxfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\tthhhh.exec:\tthhhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\dvddj.exec:\dvddj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\lxffrxl.exec:\lxffrxl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\bntttb.exec:\bntttb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
\??\c:\5jvvj.exec:\5jvvj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\xfflrfl.exec:\xfflrfl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\ntbbbb.exec:\ntbbbb.exe23⤵
- Executes dropped EXE
PID:3448 -
\??\c:\pdjpp.exec:\pdjpp.exe24⤵
- Executes dropped EXE
PID:3036 -
\??\c:\xrfrffr.exec:\xrfrffr.exe25⤵
- Executes dropped EXE
PID:932 -
\??\c:\nnnhbt.exec:\nnnhbt.exe26⤵
- Executes dropped EXE
PID:1704 -
\??\c:\pvjpp.exec:\pvjpp.exe27⤵
- Executes dropped EXE
PID:4348 -
\??\c:\tbtnbb.exec:\tbtnbb.exe28⤵
- Executes dropped EXE
PID:2476 -
\??\c:\jjppp.exec:\jjppp.exe29⤵
- Executes dropped EXE
PID:708 -
\??\c:\5rxxflr.exec:\5rxxflr.exe30⤵
- Executes dropped EXE
PID:1988 -
\??\c:\btbhht.exec:\btbhht.exe31⤵
- Executes dropped EXE
PID:872 -
\??\c:\dvdjv.exec:\dvdjv.exe32⤵
- Executes dropped EXE
PID:4180 -
\??\c:\rrrfrxx.exec:\rrrfrxx.exe33⤵
- Executes dropped EXE
PID:2980 -
\??\c:\pjpvp.exec:\pjpvp.exe34⤵
- Executes dropped EXE
PID:2616 -
\??\c:\flxxllx.exec:\flxxllx.exe35⤵
- Executes dropped EXE
PID:552 -
\??\c:\nntnbt.exec:\nntnbt.exe36⤵
- Executes dropped EXE
PID:1624 -
\??\c:\vjvdd.exec:\vjvdd.exe37⤵
- Executes dropped EXE
PID:1652 -
\??\c:\rrrxflr.exec:\rrrxflr.exe38⤵
- Executes dropped EXE
PID:392 -
\??\c:\tnhnbn.exec:\tnhnbn.exe39⤵
- Executes dropped EXE
PID:2236 -
\??\c:\lfrrfll.exec:\lfrrfll.exe40⤵
- Executes dropped EXE
PID:4568 -
\??\c:\bbhhnn.exec:\bbhhnn.exe41⤵
- Executes dropped EXE
PID:1736 -
\??\c:\jvpvv.exec:\jvpvv.exe42⤵
- Executes dropped EXE
PID:3632 -
\??\c:\rrxfffl.exec:\rrxfffl.exe43⤵
- Executes dropped EXE
PID:4012 -
\??\c:\nnttth.exec:\nnttth.exe44⤵
- Executes dropped EXE
PID:888 -
\??\c:\vpvpp.exec:\vpvpp.exe45⤵
- Executes dropped EXE
PID:216 -
\??\c:\lrrrrrr.exec:\lrrrrrr.exe46⤵
- Executes dropped EXE
PID:4616 -
\??\c:\thbhhn.exec:\thbhhn.exe47⤵
- Executes dropped EXE
PID:4324 -
\??\c:\1vvvv.exec:\1vvvv.exe48⤵
- Executes dropped EXE
PID:2924 -
\??\c:\rxlrrxf.exec:\rxlrrxf.exe49⤵
- Executes dropped EXE
PID:4204 -
\??\c:\nthhnn.exec:\nthhnn.exe50⤵
- Executes dropped EXE
PID:2096 -
\??\c:\pjjdj.exec:\pjjdj.exe51⤵
- Executes dropped EXE
PID:5108 -
\??\c:\lxfffff.exec:\lxfffff.exe52⤵
- Executes dropped EXE
PID:2800 -
\??\c:\hbtttt.exec:\hbtttt.exe53⤵
- Executes dropped EXE
PID:860 -
\??\c:\vjvpd.exec:\vjvpd.exe54⤵
- Executes dropped EXE
PID:472 -
\??\c:\bhnbnh.exec:\bhnbnh.exe55⤵
- Executes dropped EXE
PID:3252 -
\??\c:\ddppp.exec:\ddppp.exe56⤵
- Executes dropped EXE
PID:1168 -
\??\c:\lxxxrxf.exec:\lxxxrxf.exe57⤵
- Executes dropped EXE
PID:4652 -
\??\c:\hhnbtn.exec:\hhnbtn.exe58⤵
- Executes dropped EXE
PID:1680 -
\??\c:\jdvpj.exec:\jdvpj.exe59⤵
- Executes dropped EXE
PID:2948 -
\??\c:\bnbbtb.exec:\bnbbtb.exe60⤵
- Executes dropped EXE
PID:2264 -
\??\c:\dvdjd.exec:\dvdjd.exe61⤵
- Executes dropped EXE
PID:3376 -
\??\c:\flffrfx.exec:\flffrfx.exe62⤵
- Executes dropped EXE
PID:4964 -
\??\c:\nbhnnh.exec:\nbhnnh.exe63⤵
- Executes dropped EXE
PID:3220 -
\??\c:\jppvj.exec:\jppvj.exe64⤵
- Executes dropped EXE
PID:3920 -
\??\c:\nnnnnt.exec:\nnnnnt.exe65⤵
- Executes dropped EXE
PID:4960 -
\??\c:\jvdpv.exec:\jvdpv.exe66⤵PID:3020
-
\??\c:\fffflrx.exec:\fffflrx.exe67⤵PID:3924
-
\??\c:\ttttbh.exec:\ttttbh.exe68⤵PID:696
-
\??\c:\jjvdj.exec:\jjvdj.exe69⤵PID:1284
-
\??\c:\xrllrrx.exec:\xrllrrx.exe70⤵PID:3492
-
\??\c:\nnbhnt.exec:\nnbhnt.exe71⤵PID:3560
-
\??\c:\dpjdd.exec:\dpjdd.exe72⤵PID:4900
-
\??\c:\xrfffll.exec:\xrfffll.exe73⤵PID:4292
-
\??\c:\nnnhtt.exec:\nnnhtt.exe74⤵PID:3052
-
\??\c:\ppvvp.exec:\ppvvp.exe75⤵PID:1704
-
\??\c:\llllflx.exec:\llllflx.exe76⤵PID:2476
-
\??\c:\btbbhh.exec:\btbbhh.exe77⤵PID:2032
-
\??\c:\vvdjj.exec:\vvdjj.exe78⤵PID:1672
-
\??\c:\rllllff.exec:\rllllff.exe79⤵PID:1820
-
\??\c:\tnhbnt.exec:\tnhbnt.exe80⤵PID:4552
-
\??\c:\jppvv.exec:\jppvv.exe81⤵PID:2812
-
\??\c:\xxxflrx.exec:\xxxflrx.exe82⤵PID:3092
-
\??\c:\nhtnnt.exec:\nhtnnt.exe83⤵PID:3980
-
\??\c:\jjdjd.exec:\jjdjd.exe84⤵PID:1196
-
\??\c:\rrxxxrx.exec:\rrxxxrx.exe85⤵PID:916
-
\??\c:\hnntbb.exec:\hnntbb.exe86⤵PID:1240
-
\??\c:\pvddd.exec:\pvddd.exe87⤵PID:2236
-
\??\c:\bhhhhn.exec:\bhhhhn.exe88⤵PID:4480
-
\??\c:\pjjjd.exec:\pjjjd.exe89⤵PID:4992
-
\??\c:\ttbtnh.exec:\ttbtnh.exe90⤵PID:1244
-
\??\c:\ppvdd.exec:\ppvdd.exe91⤵PID:2688
-
\??\c:\frxxlxr.exec:\frxxlxr.exe92⤵PID:1464
-
\??\c:\httbtb.exec:\httbtb.exe93⤵PID:2364
-
\??\c:\frrxfrf.exec:\frrxfrf.exe94⤵PID:4548
-
\??\c:\jvjpv.exec:\jvjpv.exe95⤵PID:4484
-
\??\c:\llxxffx.exec:\llxxffx.exe96⤵PID:352
-
\??\c:\jpjjj.exec:\jpjjj.exe97⤵PID:952
-
\??\c:\rrlrrxx.exec:\rrlrrxx.exe98⤵PID:4476
-
\??\c:\bbtnbb.exec:\bbtnbb.exe99⤵PID:2388
-
\??\c:\rfxfflr.exec:\rfxfflr.exe100⤵PID:2472
-
\??\c:\bbttnt.exec:\bbttnt.exe101⤵PID:1012
-
\??\c:\9pjdp.exec:\9pjdp.exe102⤵PID:1428
-
\??\c:\llrrrfx.exec:\llrrrfx.exe103⤵PID:2792
-
\??\c:\dpvpp.exec:\dpvpp.exe104⤵PID:1224
-
\??\c:\xxfllxf.exec:\xxfllxf.exe105⤵PID:4376
-
\??\c:\pdppp.exec:\pdppp.exe106⤵PID:3056
-
\??\c:\lxfxrxr.exec:\lxfxrxr.exe107⤵PID:828
-
\??\c:\jppvd.exec:\jppvd.exe108⤵PID:4724
-
\??\c:\xfrlrlf.exec:\xfrlrlf.exe109⤵PID:3368
-
\??\c:\ntnnbn.exec:\ntnnbn.exe110⤵PID:3372
-
\??\c:\xrfrrfl.exec:\xrfrrfl.exe111⤵PID:1724
-
\??\c:\tbhhht.exec:\tbhhht.exe112⤵PID:2496
-
\??\c:\pjvvv.exec:\pjvvv.exe113⤵PID:4832
-
\??\c:\frxlrrx.exec:\frxlrrx.exe114⤵PID:4544
-
\??\c:\9bhhhh.exec:\9bhhhh.exe115⤵PID:636
-
\??\c:\lffxxll.exec:\lffxxll.exe116⤵PID:4432
-
\??\c:\hbbtnn.exec:\hbbtnn.exe117⤵PID:3948
-
\??\c:\pvppv.exec:\pvppv.exe118⤵PID:708
-
\??\c:\bnbbhh.exec:\bnbbhh.exe119⤵PID:3036
-
\??\c:\lrrrxfl.exec:\lrrrxfl.exe120⤵PID:1552
-
\??\c:\hhthhh.exec:\hhthhh.exe121⤵PID:4056
-
\??\c:\vdjjv.exec:\vdjjv.exe122⤵PID:3416
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-