Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 05:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1f2c6bf219350ecd07168d1cd92eb370_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
1f2c6bf219350ecd07168d1cd92eb370_NeikiAnalytics.exe
-
Size
64KB
-
MD5
1f2c6bf219350ecd07168d1cd92eb370
-
SHA1
af2e906c4b71037750bf3f8c68f97d86ae32a6fe
-
SHA256
f2c0891f0b29c29ff9e3b00a377dd15af1deb8f1efd9b0d2d8ad1ec6621d7d20
-
SHA512
3025a8207dea7258b66b9f0e31afc7171d24d19d61cf3aa5a7e41474d0cee0e9c29f06da1d7eac49f4a647f7b0eae27f70c5f263b93e21206970bdb71501bfbd
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfw:ymb3NkkiQ3mdBjFI4VE
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral2/memory/4824-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/392-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2972-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3636-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3936-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3936-42-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4572-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1976-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1580-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3624-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1976-56-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5036-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3276-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4644-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3008-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1064-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1812-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1892-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/112-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2024-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1056-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/908-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3936-485-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jdvdj.exeflrlffx.exenttttt.exenbhbtt.exe3pjvp.exexrxxrrr.exe9llfxxr.exetnnhhh.exehtbttn.exedddjd.exerlrrlxr.exe5rrrrll.exentnhhb.exevjvjd.exelrxrlll.exerrlrllf.exebhthnb.exejvvpj.exe9fllrrr.exe3hhbhh.exehhhbhb.exejddvd.exellllfff.exehnbnnt.exethbbnh.exeffxxflx.exerfllxfx.exetnnnhh.exepvvdd.exevvddv.exellfxfff.exexrffxxr.exe7bbbtt.exe5jdjj.exejdjjd.exe7xrrflf.exerfffffx.exebntttt.exenhhhbb.exenttnhh.exedpdpd.exerrrlxrl.exenttnnh.exehbhbbb.exejjjdd.exepddjd.exelfflffl.exebttttt.exentnhbb.exepvddp.exe3xxrrxx.exefrxxxff.exebtbttt.exedvvjd.exexrrrfff.exelrfxffl.exenhhhbh.exehbtnbb.exethhbtt.exevdjjd.exejdpjd.exefxrlxxr.exefxxrlll.exe9ppjd.exepid process 392 jdvdj.exe 3636 flrlffx.exe 2972 nttttt.exe 4572 nbhbtt.exe 3936 3pjvp.exe 3444 xrxxrrr.exe 1976 9llfxxr.exe 1580 tnnhhh.exe 3624 htbttn.exe 4768 dddjd.exe 5036 rlrrlxr.exe 4520 5rrrrll.exe 1896 ntnhhb.exe 3276 vjvjd.exe 4284 lrxrlll.exe 4644 rrlrllf.exe 3008 bhthnb.exe 1152 jvvpj.exe 1812 9fllrrr.exe 1064 3hhbhh.exe 1892 hhhbhb.exe 112 jddvd.exe 208 llllfff.exe 2024 hnbnnt.exe 1056 thbbnh.exe 4720 ffxxflx.exe 1396 rfllxfx.exe 3588 tnnnhh.exe 1212 pvvdd.exe 908 vvddv.exe 2908 llfxfff.exe 3380 xrffxxr.exe 3480 7bbbtt.exe 4556 5jdjj.exe 2364 jdjjd.exe 2088 7xrrflf.exe 1292 rfffffx.exe 2964 bntttt.exe 840 nhhhbb.exe 884 nttnhh.exe 5052 dpdpd.exe 4828 rrrlxrl.exe 1692 nttnnh.exe 4520 hbhbbb.exe 3724 jjjdd.exe 4672 pddjd.exe 3120 lfflffl.exe 4600 bttttt.exe 1072 ntnhbb.exe 3200 pvddp.exe 3964 3xxrrxx.exe 652 frxxxff.exe 228 btbttt.exe 3628 dvvjd.exe 336 xrrrfff.exe 1764 lrfxffl.exe 2024 nhhhbh.exe 3952 hbtnbb.exe 4032 thhbtt.exe 4708 vdjjd.exe 2848 jdpjd.exe 1752 fxrlxxr.exe 4444 fxxrlll.exe 1212 9ppjd.exe -
Processes:
resource yara_rule behavioral2/memory/4824-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/392-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2972-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3636-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3936-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1976-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1580-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3624-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3276-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4644-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3008-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1064-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1812-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1892-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/112-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2024-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1056-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/908-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3936-485-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1f2c6bf219350ecd07168d1cd92eb370_NeikiAnalytics.exejdvdj.exeflrlffx.exenttttt.exenbhbtt.exe3pjvp.exexrxxrrr.exe9llfxxr.exetnnhhh.exehtbttn.exedddjd.exerlrrlxr.exe5rrrrll.exentnhhb.exevjvjd.exelrxrlll.exerrlrllf.exebhthnb.exejvvpj.exe9fllrrr.exe3hhbhh.exehhhbhb.exedescription pid process target process PID 4824 wrote to memory of 392 4824 1f2c6bf219350ecd07168d1cd92eb370_NeikiAnalytics.exe jdvdj.exe PID 4824 wrote to memory of 392 4824 1f2c6bf219350ecd07168d1cd92eb370_NeikiAnalytics.exe jdvdj.exe PID 4824 wrote to memory of 392 4824 1f2c6bf219350ecd07168d1cd92eb370_NeikiAnalytics.exe jdvdj.exe PID 392 wrote to memory of 3636 392 jdvdj.exe flrlffx.exe PID 392 wrote to memory of 3636 392 jdvdj.exe flrlffx.exe PID 392 wrote to memory of 3636 392 jdvdj.exe flrlffx.exe PID 3636 wrote to memory of 2972 3636 flrlffx.exe nttttt.exe PID 3636 wrote to memory of 2972 3636 flrlffx.exe nttttt.exe PID 3636 wrote to memory of 2972 3636 flrlffx.exe nttttt.exe PID 2972 wrote to memory of 4572 2972 nttttt.exe nbhbtt.exe PID 2972 wrote to memory of 4572 2972 nttttt.exe nbhbtt.exe PID 2972 wrote to memory of 4572 2972 nttttt.exe nbhbtt.exe PID 4572 wrote to memory of 3936 4572 nbhbtt.exe 3pjvp.exe PID 4572 wrote to memory of 3936 4572 nbhbtt.exe 3pjvp.exe PID 4572 wrote to memory of 3936 4572 nbhbtt.exe 3pjvp.exe PID 3936 wrote to memory of 3444 3936 3pjvp.exe xrxxrrr.exe PID 3936 wrote to memory of 3444 3936 3pjvp.exe xrxxrrr.exe PID 3936 wrote to memory of 3444 3936 3pjvp.exe xrxxrrr.exe PID 3444 wrote to memory of 1976 3444 xrxxrrr.exe 9llfxxr.exe PID 3444 wrote to memory of 1976 3444 xrxxrrr.exe 9llfxxr.exe PID 3444 wrote to memory of 1976 3444 xrxxrrr.exe 9llfxxr.exe PID 1976 wrote to memory of 1580 1976 9llfxxr.exe tnnhhh.exe PID 1976 wrote to memory of 1580 1976 9llfxxr.exe tnnhhh.exe PID 1976 wrote to memory of 1580 1976 9llfxxr.exe tnnhhh.exe PID 1580 wrote to memory of 3624 1580 tnnhhh.exe htbttn.exe PID 1580 wrote to memory of 3624 1580 tnnhhh.exe htbttn.exe PID 1580 wrote to memory of 3624 1580 tnnhhh.exe htbttn.exe PID 3624 wrote to memory of 4768 3624 htbttn.exe dddjd.exe PID 3624 wrote to memory of 4768 3624 htbttn.exe dddjd.exe PID 3624 wrote to memory of 4768 3624 htbttn.exe dddjd.exe PID 4768 wrote to memory of 5036 4768 dddjd.exe rlrrlxr.exe PID 4768 wrote to memory of 5036 4768 dddjd.exe rlrrlxr.exe PID 4768 wrote to memory of 5036 4768 dddjd.exe rlrrlxr.exe PID 5036 wrote to memory of 4520 5036 rlrrlxr.exe 5rrrrll.exe PID 5036 wrote to memory of 4520 5036 rlrrlxr.exe 5rrrrll.exe PID 5036 wrote to memory of 4520 5036 rlrrlxr.exe 5rrrrll.exe PID 4520 wrote to memory of 1896 4520 5rrrrll.exe ntnhhb.exe PID 4520 wrote to memory of 1896 4520 5rrrrll.exe ntnhhb.exe PID 4520 wrote to memory of 1896 4520 5rrrrll.exe ntnhhb.exe PID 1896 wrote to memory of 3276 1896 ntnhhb.exe vjvjd.exe PID 1896 wrote to memory of 3276 1896 ntnhhb.exe vjvjd.exe PID 1896 wrote to memory of 3276 1896 ntnhhb.exe vjvjd.exe PID 3276 wrote to memory of 4284 3276 vjvjd.exe lrxrlll.exe PID 3276 wrote to memory of 4284 3276 vjvjd.exe lrxrlll.exe PID 3276 wrote to memory of 4284 3276 vjvjd.exe lrxrlll.exe PID 4284 wrote to memory of 4644 4284 lrxrlll.exe rrlrllf.exe PID 4284 wrote to memory of 4644 4284 lrxrlll.exe rrlrllf.exe PID 4284 wrote to memory of 4644 4284 lrxrlll.exe rrlrllf.exe PID 4644 wrote to memory of 3008 4644 rrlrllf.exe bhthnb.exe PID 4644 wrote to memory of 3008 4644 rrlrllf.exe bhthnb.exe PID 4644 wrote to memory of 3008 4644 rrlrllf.exe bhthnb.exe PID 3008 wrote to memory of 1152 3008 bhthnb.exe jvvpj.exe PID 3008 wrote to memory of 1152 3008 bhthnb.exe jvvpj.exe PID 3008 wrote to memory of 1152 3008 bhthnb.exe jvvpj.exe PID 1152 wrote to memory of 1812 1152 jvvpj.exe 9fllrrr.exe PID 1152 wrote to memory of 1812 1152 jvvpj.exe 9fllrrr.exe PID 1152 wrote to memory of 1812 1152 jvvpj.exe 9fllrrr.exe PID 1812 wrote to memory of 1064 1812 9fllrrr.exe 3hhbhh.exe PID 1812 wrote to memory of 1064 1812 9fllrrr.exe 3hhbhh.exe PID 1812 wrote to memory of 1064 1812 9fllrrr.exe 3hhbhh.exe PID 1064 wrote to memory of 1892 1064 3hhbhh.exe hhhbhb.exe PID 1064 wrote to memory of 1892 1064 3hhbhh.exe hhhbhb.exe PID 1064 wrote to memory of 1892 1064 3hhbhh.exe hhhbhb.exe PID 1892 wrote to memory of 112 1892 hhhbhb.exe jddvd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f2c6bf219350ecd07168d1cd92eb370_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1f2c6bf219350ecd07168d1cd92eb370_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\jdvdj.exec:\jdvdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\flrlffx.exec:\flrlffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\nttttt.exec:\nttttt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\nbhbtt.exec:\nbhbtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\3pjvp.exec:\3pjvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\xrxxrrr.exec:\xrxxrrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\9llfxxr.exec:\9llfxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\tnnhhh.exec:\tnnhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\htbttn.exec:\htbttn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\dddjd.exec:\dddjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\rlrrlxr.exec:\rlrrlxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\5rrrrll.exec:\5rrrrll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\ntnhhb.exec:\ntnhhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\vjvjd.exec:\vjvjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
\??\c:\lrxrlll.exec:\lrxrlll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\rrlrllf.exec:\rrlrllf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
\??\c:\bhthnb.exec:\bhthnb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\jvvpj.exec:\jvvpj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\9fllrrr.exec:\9fllrrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\3hhbhh.exec:\3hhbhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\hhhbhb.exec:\hhhbhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\jddvd.exec:\jddvd.exe23⤵
- Executes dropped EXE
PID:112 -
\??\c:\llllfff.exec:\llllfff.exe24⤵
- Executes dropped EXE
PID:208 -
\??\c:\hnbnnt.exec:\hnbnnt.exe25⤵
- Executes dropped EXE
PID:2024 -
\??\c:\thbbnh.exec:\thbbnh.exe26⤵
- Executes dropped EXE
PID:1056 -
\??\c:\ffxxflx.exec:\ffxxflx.exe27⤵
- Executes dropped EXE
PID:4720 -
\??\c:\rfllxfx.exec:\rfllxfx.exe28⤵
- Executes dropped EXE
PID:1396 -
\??\c:\tnnnhh.exec:\tnnnhh.exe29⤵
- Executes dropped EXE
PID:3588 -
\??\c:\pvvdd.exec:\pvvdd.exe30⤵
- Executes dropped EXE
PID:1212 -
\??\c:\vvddv.exec:\vvddv.exe31⤵
- Executes dropped EXE
PID:908 -
\??\c:\llfxfff.exec:\llfxfff.exe32⤵
- Executes dropped EXE
PID:2908 -
\??\c:\xrffxxr.exec:\xrffxxr.exe33⤵
- Executes dropped EXE
PID:3380 -
\??\c:\7bbbtt.exec:\7bbbtt.exe34⤵
- Executes dropped EXE
PID:3480 -
\??\c:\5jdjj.exec:\5jdjj.exe35⤵
- Executes dropped EXE
PID:4556 -
\??\c:\jdjjd.exec:\jdjjd.exe36⤵
- Executes dropped EXE
PID:2364 -
\??\c:\7xrrflf.exec:\7xrrflf.exe37⤵
- Executes dropped EXE
PID:2088 -
\??\c:\rfffffx.exec:\rfffffx.exe38⤵
- Executes dropped EXE
PID:1292 -
\??\c:\bntttt.exec:\bntttt.exe39⤵
- Executes dropped EXE
PID:2964 -
\??\c:\nhhhbb.exec:\nhhhbb.exe40⤵
- Executes dropped EXE
PID:840 -
\??\c:\nttnhh.exec:\nttnhh.exe41⤵
- Executes dropped EXE
PID:884 -
\??\c:\dpdpd.exec:\dpdpd.exe42⤵
- Executes dropped EXE
PID:5052 -
\??\c:\rrrlxrl.exec:\rrrlxrl.exe43⤵
- Executes dropped EXE
PID:4828 -
\??\c:\nttnnh.exec:\nttnnh.exe44⤵
- Executes dropped EXE
PID:1692 -
\??\c:\hbhbbb.exec:\hbhbbb.exe45⤵
- Executes dropped EXE
PID:4520 -
\??\c:\jjjdd.exec:\jjjdd.exe46⤵
- Executes dropped EXE
PID:3724 -
\??\c:\pddjd.exec:\pddjd.exe47⤵
- Executes dropped EXE
PID:4672 -
\??\c:\lfflffl.exec:\lfflffl.exe48⤵
- Executes dropped EXE
PID:3120 -
\??\c:\bttttt.exec:\bttttt.exe49⤵
- Executes dropped EXE
PID:4600 -
\??\c:\ntnhbb.exec:\ntnhbb.exe50⤵
- Executes dropped EXE
PID:1072 -
\??\c:\pvddp.exec:\pvddp.exe51⤵
- Executes dropped EXE
PID:3200 -
\??\c:\3xxrrxx.exec:\3xxrrxx.exe52⤵
- Executes dropped EXE
PID:3964 -
\??\c:\frxxxff.exec:\frxxxff.exe53⤵
- Executes dropped EXE
PID:652 -
\??\c:\btbttt.exec:\btbttt.exe54⤵
- Executes dropped EXE
PID:228 -
\??\c:\dvvjd.exec:\dvvjd.exe55⤵
- Executes dropped EXE
PID:3628 -
\??\c:\xrrrfff.exec:\xrrrfff.exe56⤵
- Executes dropped EXE
PID:336 -
\??\c:\lrfxffl.exec:\lrfxffl.exe57⤵
- Executes dropped EXE
PID:1764 -
\??\c:\nhhhbh.exec:\nhhhbh.exe58⤵
- Executes dropped EXE
PID:2024 -
\??\c:\hbtnbb.exec:\hbtnbb.exe59⤵
- Executes dropped EXE
PID:3952 -
\??\c:\thhbtt.exec:\thhbtt.exe60⤵
- Executes dropped EXE
PID:4032 -
\??\c:\vdjjd.exec:\vdjjd.exe61⤵
- Executes dropped EXE
PID:4708 -
\??\c:\jdpjd.exec:\jdpjd.exe62⤵
- Executes dropped EXE
PID:2848 -
\??\c:\fxrlxxr.exec:\fxrlxxr.exe63⤵
- Executes dropped EXE
PID:1752 -
\??\c:\fxxrlll.exec:\fxxrlll.exe64⤵
- Executes dropped EXE
PID:4444 -
\??\c:\9ppjd.exec:\9ppjd.exe65⤵
- Executes dropped EXE
PID:1212 -
\??\c:\jjvpd.exec:\jjvpd.exe66⤵PID:3112
-
\??\c:\ffxxrrr.exec:\ffxxrrr.exe67⤵PID:3636
-
\??\c:\bttbth.exec:\bttbth.exe68⤵PID:1864
-
\??\c:\ddddd.exec:\ddddd.exe69⤵PID:4796
-
\??\c:\1pppd.exec:\1pppd.exe70⤵PID:3708
-
\??\c:\xrrlxxf.exec:\xrrlxxf.exe71⤵PID:4624
-
\??\c:\3xrrrrl.exec:\3xrrrrl.exe72⤵PID:2712
-
\??\c:\btbthh.exec:\btbthh.exe73⤵PID:2436
-
\??\c:\bbttnn.exec:\bbttnn.exe74⤵PID:1016
-
\??\c:\vvdvv.exec:\vvdvv.exe75⤵PID:3624
-
\??\c:\5pvpd.exec:\5pvpd.exe76⤵PID:3676
-
\??\c:\jpppj.exec:\jpppj.exe77⤵PID:3700
-
\??\c:\rlxrlll.exec:\rlxrlll.exe78⤵PID:2320
-
\??\c:\rlxxflr.exec:\rlxxflr.exe79⤵PID:4588
-
\??\c:\bttnhh.exec:\bttnhh.exe80⤵PID:4152
-
\??\c:\3bnhbb.exec:\3bnhbb.exe81⤵PID:4284
-
\??\c:\pvvpp.exec:\pvvpp.exe82⤵PID:5108
-
\??\c:\dvjdd.exec:\dvjdd.exe83⤵PID:3256
-
\??\c:\pjjdp.exec:\pjjdp.exe84⤵PID:548
-
\??\c:\lfxrlfx.exec:\lfxrlfx.exe85⤵PID:1072
-
\??\c:\fxllfff.exec:\fxllfff.exe86⤵PID:756
-
\??\c:\tbbttn.exec:\tbbttn.exe87⤵PID:2808
-
\??\c:\tnttnn.exec:\tnttnn.exe88⤵PID:1064
-
\??\c:\pjpvp.exec:\pjpvp.exe89⤵PID:688
-
\??\c:\pdjdd.exec:\pdjdd.exe90⤵PID:3924
-
\??\c:\9fffrrr.exec:\9fffrrr.exe91⤵PID:4248
-
\??\c:\rlrxxrr.exec:\rlrxxrr.exe92⤵PID:1944
-
\??\c:\5bbbtt.exec:\5bbbtt.exe93⤵PID:1236
-
\??\c:\nhbbtt.exec:\nhbbtt.exe94⤵PID:2612
-
\??\c:\7jddv.exec:\7jddv.exe95⤵PID:4424
-
\??\c:\9fflxll.exec:\9fflxll.exe96⤵PID:3588
-
\??\c:\tttnnn.exec:\tttnnn.exe97⤵PID:544
-
\??\c:\jdppj.exec:\jdppj.exe98⤵PID:2472
-
\??\c:\xlrlllf.exec:\xlrlllf.exe99⤵PID:4824
-
\??\c:\ttbtnn.exec:\ttbtnn.exe100⤵PID:1532
-
\??\c:\5pjdv.exec:\5pjdv.exe101⤵PID:4576
-
\??\c:\jjvvj.exec:\jjvvj.exe102⤵PID:3936
-
\??\c:\frflrrr.exec:\frflrrr.exe103⤵PID:4080
-
\??\c:\7rrlffx.exec:\7rrlffx.exe104⤵PID:3300
-
\??\c:\3nhhhh.exec:\3nhhhh.exe105⤵PID:1292
-
\??\c:\9htnnn.exec:\9htnnn.exe106⤵PID:2132
-
\??\c:\7dpdp.exec:\7dpdp.exe107⤵PID:884
-
\??\c:\vjjdv.exec:\vjjdv.exe108⤵PID:5104
-
\??\c:\1lrrfll.exec:\1lrrfll.exe109⤵PID:4436
-
\??\c:\rlxxrrx.exec:\rlxxrrx.exe110⤵PID:820
-
\??\c:\bnnnth.exec:\bnnnth.exe111⤵PID:3276
-
\??\c:\ntbbnn.exec:\ntbbnn.exe112⤵PID:1868
-
\??\c:\hbhbnn.exec:\hbhbnn.exe113⤵PID:3060
-
\??\c:\jdddv.exec:\jdddv.exe114⤵PID:2224
-
\??\c:\vvdvp.exec:\vvdvp.exe115⤵PID:3920
-
\??\c:\xxxrlfx.exec:\xxxrlfx.exe116⤵PID:2808
-
\??\c:\rxlrllf.exec:\rxlrllf.exe117⤵PID:1064
-
\??\c:\ffrlllf.exec:\ffrlllf.exe118⤵PID:4332
-
\??\c:\thnhbb.exec:\thnhbb.exe119⤵PID:3236
-
\??\c:\thttnt.exec:\thttnt.exe120⤵PID:3492
-
\??\c:\1vvvp.exec:\1vvvp.exe121⤵PID:3284
-
\??\c:\pjvvp.exec:\pjvvp.exe122⤵PID:1484
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-