Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 16:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eda32fa8507878b463aa129e1758e4f0_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
eda32fa8507878b463aa129e1758e4f0_NeikiAnalytics.exe
-
Size
88KB
-
MD5
eda32fa8507878b463aa129e1758e4f0
-
SHA1
e132422db030d64fad1c34077a2deb6770ce249e
-
SHA256
37d759a04d0c876cb85e6822c0cefb7a0255aab825fda5472805badc503eb6ac
-
SHA512
8c66d517acd005d55c81953fe523ad3087fab9ea0d375163473740e7a45481c8f5b71b3b34d3ec7ace741c15ebc151e68ad848efc37d357f14e7a89cdfe6272b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoLU1grORPfr0k890Ce:ymb3NkkiQ3mdBjFoLk8Pk890Ce
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral2/memory/2300-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5580-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3604-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3420-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4744-32-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4744-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5312-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3084-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3768-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5332-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4832-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5152-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5176-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4084-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5112-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2708-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3372-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3968-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2268-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5708-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5520-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4556-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2700-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
3bhbbt.exeddvpj.exejdpdp.exenbnnnt.exevvjjj.exerrrxxrx.exe5nbttn.exepddpd.exejjjvv.exerlllfff.exennbbbt.exeppvpv.exe5lfxfxx.exebhhhbh.exenhnhbb.exejddjj.exelffffff.exe9httnt.exe5pdvv.exepdjjj.exexrxrrrr.exenhttnn.exedvdvj.exevvppp.exellrrffr.exetbbbbn.exe7djvv.exevdvvj.exe9llllrr.exenbnnnn.exebnbhnt.exevpdjv.exefxrfrxx.exetbbtnn.exejjddv.exerrfxffx.exefxflllr.exenthbhn.exehhttbh.exe5pvpp.exe7jpdv.exe7xfxxrr.exetnhhhh.exedppjd.exejjdvp.exe5rlfrxl.exe3hbbbh.exeddpjp.exejjpjd.exellllxff.exehhhnnb.exedvvdd.exexlrllfx.exexlffxxx.exe3hnnnn.exejdjvv.exelflrxfx.exellfflll.exennbhnh.exetnbnth.exejdppd.exerlffrxr.exexrllfrl.exebbbbtt.exepid process 3604 3bhbbt.exe 5580 ddvpj.exe 4744 jdpdp.exe 3420 nbnnnt.exe 5312 vvjjj.exe 832 rrrxxrx.exe 3084 5nbttn.exe 3768 pddpd.exe 5332 jjjvv.exe 4832 rlllfff.exe 5152 nnbbbt.exe 5176 ppvpv.exe 4092 5lfxfxx.exe 4084 bhhhbh.exe 5112 nhnhbb.exe 2708 jddjj.exe 3972 lffffff.exe 3372 9httnt.exe 3968 5pdvv.exe 5644 pdjjj.exe 4764 xrxrrrr.exe 2268 nhttnn.exe 2420 dvdvj.exe 5708 vvppp.exe 4368 llrrffr.exe 5520 tbbbbn.exe 4724 7djvv.exe 4556 vdvvj.exe 2700 9llllrr.exe 1644 nbnnnn.exe 5396 bnbhnt.exe 1624 vpdjv.exe 2852 fxrfrxx.exe 2724 tbbtnn.exe 3064 jjddv.exe 3676 rrfxffx.exe 2092 fxflllr.exe 3068 nthbhn.exe 3952 hhttbh.exe 2828 5pvpp.exe 428 7jpdv.exe 4768 7xfxxrr.exe 1528 tnhhhh.exe 5356 dppjd.exe 3024 jjdvp.exe 5348 5rlfrxl.exe 6120 3hbbbh.exe 4712 ddpjp.exe 5476 jjpjd.exe 756 llllxff.exe 3104 hhhnnb.exe 3028 dvvdd.exe 5660 xlrllfx.exe 2572 xlffxxx.exe 836 3hnnnn.exe 3524 jdjvv.exe 2328 lflrxfx.exe 5536 llfflll.exe 2788 nnbhnh.exe 1560 tnbnth.exe 2044 jdppd.exe 3396 rlffrxr.exe 4964 xrllfrl.exe 6012 bbbbtt.exe -
Processes:
resource yara_rule behavioral2/memory/2300-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5580-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3604-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3420-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4744-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5312-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3084-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3768-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5332-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4832-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5152-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5176-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4084-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2708-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3372-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2268-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5708-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5520-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2700-192-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
eda32fa8507878b463aa129e1758e4f0_NeikiAnalytics.exe3bhbbt.exeddvpj.exejdpdp.exenbnnnt.exevvjjj.exerrrxxrx.exe5nbttn.exepddpd.exejjjvv.exerlllfff.exennbbbt.exeppvpv.exe5lfxfxx.exebhhhbh.exenhnhbb.exejddjj.exelffffff.exe9httnt.exe5pdvv.exepdjjj.exexrxrrrr.exedescription pid process target process PID 2300 wrote to memory of 3604 2300 eda32fa8507878b463aa129e1758e4f0_NeikiAnalytics.exe 3bhbbt.exe PID 2300 wrote to memory of 3604 2300 eda32fa8507878b463aa129e1758e4f0_NeikiAnalytics.exe 3bhbbt.exe PID 2300 wrote to memory of 3604 2300 eda32fa8507878b463aa129e1758e4f0_NeikiAnalytics.exe 3bhbbt.exe PID 3604 wrote to memory of 5580 3604 3bhbbt.exe ddvpj.exe PID 3604 wrote to memory of 5580 3604 3bhbbt.exe ddvpj.exe PID 3604 wrote to memory of 5580 3604 3bhbbt.exe ddvpj.exe PID 5580 wrote to memory of 4744 5580 ddvpj.exe jdpdp.exe PID 5580 wrote to memory of 4744 5580 ddvpj.exe jdpdp.exe PID 5580 wrote to memory of 4744 5580 ddvpj.exe jdpdp.exe PID 4744 wrote to memory of 3420 4744 jdpdp.exe nbnnnt.exe PID 4744 wrote to memory of 3420 4744 jdpdp.exe nbnnnt.exe PID 4744 wrote to memory of 3420 4744 jdpdp.exe nbnnnt.exe PID 3420 wrote to memory of 5312 3420 nbnnnt.exe vvjjj.exe PID 3420 wrote to memory of 5312 3420 nbnnnt.exe vvjjj.exe PID 3420 wrote to memory of 5312 3420 nbnnnt.exe vvjjj.exe PID 5312 wrote to memory of 832 5312 vvjjj.exe rrrxxrx.exe PID 5312 wrote to memory of 832 5312 vvjjj.exe rrrxxrx.exe PID 5312 wrote to memory of 832 5312 vvjjj.exe rrrxxrx.exe PID 832 wrote to memory of 3084 832 rrrxxrx.exe 5nbttn.exe PID 832 wrote to memory of 3084 832 rrrxxrx.exe 5nbttn.exe PID 832 wrote to memory of 3084 832 rrrxxrx.exe 5nbttn.exe PID 3084 wrote to memory of 3768 3084 5nbttn.exe pddpd.exe PID 3084 wrote to memory of 3768 3084 5nbttn.exe pddpd.exe PID 3084 wrote to memory of 3768 3084 5nbttn.exe pddpd.exe PID 3768 wrote to memory of 5332 3768 pddpd.exe jjjvv.exe PID 3768 wrote to memory of 5332 3768 pddpd.exe jjjvv.exe PID 3768 wrote to memory of 5332 3768 pddpd.exe jjjvv.exe PID 5332 wrote to memory of 4832 5332 jjjvv.exe rlllfff.exe PID 5332 wrote to memory of 4832 5332 jjjvv.exe rlllfff.exe PID 5332 wrote to memory of 4832 5332 jjjvv.exe rlllfff.exe PID 4832 wrote to memory of 5152 4832 rlllfff.exe nnbbbt.exe PID 4832 wrote to memory of 5152 4832 rlllfff.exe nnbbbt.exe PID 4832 wrote to memory of 5152 4832 rlllfff.exe nnbbbt.exe PID 5152 wrote to memory of 5176 5152 nnbbbt.exe ppvpv.exe PID 5152 wrote to memory of 5176 5152 nnbbbt.exe ppvpv.exe PID 5152 wrote to memory of 5176 5152 nnbbbt.exe ppvpv.exe PID 5176 wrote to memory of 4092 5176 ppvpv.exe 5lfxfxx.exe PID 5176 wrote to memory of 4092 5176 ppvpv.exe 5lfxfxx.exe PID 5176 wrote to memory of 4092 5176 ppvpv.exe 5lfxfxx.exe PID 4092 wrote to memory of 4084 4092 5lfxfxx.exe bhhhbh.exe PID 4092 wrote to memory of 4084 4092 5lfxfxx.exe bhhhbh.exe PID 4092 wrote to memory of 4084 4092 5lfxfxx.exe bhhhbh.exe PID 4084 wrote to memory of 5112 4084 bhhhbh.exe nhnhbb.exe PID 4084 wrote to memory of 5112 4084 bhhhbh.exe nhnhbb.exe PID 4084 wrote to memory of 5112 4084 bhhhbh.exe nhnhbb.exe PID 5112 wrote to memory of 2708 5112 nhnhbb.exe jddjj.exe PID 5112 wrote to memory of 2708 5112 nhnhbb.exe jddjj.exe PID 5112 wrote to memory of 2708 5112 nhnhbb.exe jddjj.exe PID 2708 wrote to memory of 3972 2708 jddjj.exe lffffff.exe PID 2708 wrote to memory of 3972 2708 jddjj.exe lffffff.exe PID 2708 wrote to memory of 3972 2708 jddjj.exe lffffff.exe PID 3972 wrote to memory of 3372 3972 lffffff.exe 9httnt.exe PID 3972 wrote to memory of 3372 3972 lffffff.exe 9httnt.exe PID 3972 wrote to memory of 3372 3972 lffffff.exe 9httnt.exe PID 3372 wrote to memory of 3968 3372 9httnt.exe 5pdvv.exe PID 3372 wrote to memory of 3968 3372 9httnt.exe 5pdvv.exe PID 3372 wrote to memory of 3968 3372 9httnt.exe 5pdvv.exe PID 3968 wrote to memory of 5644 3968 5pdvv.exe pdjjj.exe PID 3968 wrote to memory of 5644 3968 5pdvv.exe pdjjj.exe PID 3968 wrote to memory of 5644 3968 5pdvv.exe pdjjj.exe PID 5644 wrote to memory of 4764 5644 pdjjj.exe xrxrrrr.exe PID 5644 wrote to memory of 4764 5644 pdjjj.exe xrxrrrr.exe PID 5644 wrote to memory of 4764 5644 pdjjj.exe xrxrrrr.exe PID 4764 wrote to memory of 2268 4764 xrxrrrr.exe nhttnn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eda32fa8507878b463aa129e1758e4f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\eda32fa8507878b463aa129e1758e4f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\3bhbbt.exec:\3bhbbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\ddvpj.exec:\ddvpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5580 -
\??\c:\jdpdp.exec:\jdpdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\nbnnnt.exec:\nbnnnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
\??\c:\vvjjj.exec:\vvjjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5312 -
\??\c:\rrrxxrx.exec:\rrrxxrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\5nbttn.exec:\5nbttn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\pddpd.exec:\pddpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
\??\c:\jjjvv.exec:\jjjvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5332 -
\??\c:\rlllfff.exec:\rlllfff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\nnbbbt.exec:\nnbbbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5152 -
\??\c:\ppvpv.exec:\ppvpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5176 -
\??\c:\5lfxfxx.exec:\5lfxfxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\bhhhbh.exec:\bhhhbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\nhnhbb.exec:\nhnhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\jddjj.exec:\jddjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\lffffff.exec:\lffffff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\9httnt.exec:\9httnt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\5pdvv.exec:\5pdvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\pdjjj.exec:\pdjjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5644 -
\??\c:\xrxrrrr.exec:\xrxrrrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\nhttnn.exec:\nhttnn.exe23⤵
- Executes dropped EXE
PID:2268 -
\??\c:\dvdvj.exec:\dvdvj.exe24⤵
- Executes dropped EXE
PID:2420 -
\??\c:\vvppp.exec:\vvppp.exe25⤵
- Executes dropped EXE
PID:5708 -
\??\c:\llrrffr.exec:\llrrffr.exe26⤵
- Executes dropped EXE
PID:4368 -
\??\c:\tbbbbn.exec:\tbbbbn.exe27⤵
- Executes dropped EXE
PID:5520 -
\??\c:\7djvv.exec:\7djvv.exe28⤵
- Executes dropped EXE
PID:4724 -
\??\c:\vdvvj.exec:\vdvvj.exe29⤵
- Executes dropped EXE
PID:4556 -
\??\c:\9llllrr.exec:\9llllrr.exe30⤵
- Executes dropped EXE
PID:2700 -
\??\c:\nbnnnn.exec:\nbnnnn.exe31⤵
- Executes dropped EXE
PID:1644 -
\??\c:\bnbhnt.exec:\bnbhnt.exe32⤵
- Executes dropped EXE
PID:5396 -
\??\c:\vpdjv.exec:\vpdjv.exe33⤵
- Executes dropped EXE
PID:1624 -
\??\c:\fxrfrxx.exec:\fxrfrxx.exe34⤵
- Executes dropped EXE
PID:2852 -
\??\c:\tbbtnn.exec:\tbbtnn.exe35⤵
- Executes dropped EXE
PID:2724 -
\??\c:\jjddv.exec:\jjddv.exe36⤵
- Executes dropped EXE
PID:3064 -
\??\c:\rrfxffx.exec:\rrfxffx.exe37⤵
- Executes dropped EXE
PID:3676 -
\??\c:\fxflllr.exec:\fxflllr.exe38⤵
- Executes dropped EXE
PID:2092 -
\??\c:\nthbhn.exec:\nthbhn.exe39⤵
- Executes dropped EXE
PID:3068 -
\??\c:\hhttbh.exec:\hhttbh.exe40⤵
- Executes dropped EXE
PID:3952 -
\??\c:\5pvpp.exec:\5pvpp.exe41⤵
- Executes dropped EXE
PID:2828 -
\??\c:\7jpdv.exec:\7jpdv.exe42⤵
- Executes dropped EXE
PID:428 -
\??\c:\7xfxxrr.exec:\7xfxxrr.exe43⤵
- Executes dropped EXE
PID:4768 -
\??\c:\tnhhhh.exec:\tnhhhh.exe44⤵
- Executes dropped EXE
PID:1528 -
\??\c:\dppjd.exec:\dppjd.exe45⤵
- Executes dropped EXE
PID:5356 -
\??\c:\jjdvp.exec:\jjdvp.exe46⤵
- Executes dropped EXE
PID:3024 -
\??\c:\5rlfrxl.exec:\5rlfrxl.exe47⤵
- Executes dropped EXE
PID:5348 -
\??\c:\3hbbbh.exec:\3hbbbh.exe48⤵
- Executes dropped EXE
PID:6120 -
\??\c:\ddpjp.exec:\ddpjp.exe49⤵
- Executes dropped EXE
PID:4712 -
\??\c:\jjpjd.exec:\jjpjd.exe50⤵
- Executes dropped EXE
PID:5476 -
\??\c:\llllxff.exec:\llllxff.exe51⤵
- Executes dropped EXE
PID:756 -
\??\c:\hhhnnb.exec:\hhhnnb.exe52⤵
- Executes dropped EXE
PID:3104 -
\??\c:\dvvdd.exec:\dvvdd.exe53⤵
- Executes dropped EXE
PID:3028 -
\??\c:\xlrllfx.exec:\xlrllfx.exe54⤵
- Executes dropped EXE
PID:5660 -
\??\c:\xlffxxx.exec:\xlffxxx.exe55⤵
- Executes dropped EXE
PID:2572 -
\??\c:\3hnnnn.exec:\3hnnnn.exe56⤵
- Executes dropped EXE
PID:836 -
\??\c:\jdjvv.exec:\jdjvv.exe57⤵
- Executes dropped EXE
PID:3524 -
\??\c:\lflrxfx.exec:\lflrxfx.exe58⤵
- Executes dropped EXE
PID:2328 -
\??\c:\llfflll.exec:\llfflll.exe59⤵
- Executes dropped EXE
PID:5536 -
\??\c:\nnbhnh.exec:\nnbhnh.exe60⤵
- Executes dropped EXE
PID:2788 -
\??\c:\tnbnth.exec:\tnbnth.exe61⤵
- Executes dropped EXE
PID:1560 -
\??\c:\jdppd.exec:\jdppd.exe62⤵
- Executes dropped EXE
PID:2044 -
\??\c:\rlffrxr.exec:\rlffrxr.exe63⤵
- Executes dropped EXE
PID:3396 -
\??\c:\xrllfrl.exec:\xrllfrl.exe64⤵
- Executes dropped EXE
PID:4964 -
\??\c:\bbbbtt.exec:\bbbbtt.exe65⤵
- Executes dropped EXE
PID:6012 -
\??\c:\dvvpj.exec:\dvvpj.exe66⤵PID:2804
-
\??\c:\9vvpp.exec:\9vvpp.exe67⤵PID:4040
-
\??\c:\5ffxxxr.exec:\5ffxxxr.exe68⤵PID:4436
-
\??\c:\3xllxxf.exec:\3xllxxf.exe69⤵PID:4440
-
\??\c:\3bbbbn.exec:\3bbbbn.exe70⤵PID:1556
-
\??\c:\1thnnb.exec:\1thnnb.exe71⤵PID:3604
-
\??\c:\5pjdv.exec:\5pjdv.exe72⤵PID:452
-
\??\c:\xxxrxxr.exec:\xxxrxxr.exe73⤵PID:6128
-
\??\c:\xxrrlrr.exec:\xxrrlrr.exe74⤵PID:1312
-
\??\c:\hnttnn.exec:\hnttnn.exe75⤵PID:2220
-
\??\c:\pvddv.exec:\pvddv.exe76⤵PID:4156
-
\??\c:\3rxxllf.exec:\3rxxllf.exe77⤵PID:2188
-
\??\c:\ntnttn.exec:\ntnttn.exe78⤵PID:5684
-
\??\c:\pjddv.exec:\pjddv.exe79⤵PID:3084
-
\??\c:\vppjv.exec:\vppjv.exe80⤵PID:2080
-
\??\c:\lrllxxr.exec:\lrllxxr.exe81⤵PID:5352
-
\??\c:\fxflfll.exec:\fxflfll.exe82⤵PID:3512
-
\??\c:\bhhhhh.exec:\bhhhhh.exe83⤵PID:5156
-
\??\c:\9djjj.exec:\9djjj.exe84⤵PID:4072
-
\??\c:\jvjdp.exec:\jvjdp.exe85⤵PID:3940
-
\??\c:\llrxxfx.exec:\llrxxfx.exe86⤵PID:4064
-
\??\c:\9rxfrll.exec:\9rxfrll.exe87⤵PID:3088
-
\??\c:\hnhtth.exec:\hnhtth.exe88⤵PID:5636
-
\??\c:\5dvvp.exec:\5dvvp.exe89⤵PID:2264
-
\??\c:\ffxlrfl.exec:\ffxlrfl.exe90⤵PID:3776
-
\??\c:\rlrfrrx.exec:\rlrfrrx.exe91⤵PID:3868
-
\??\c:\tthhtb.exec:\tthhtb.exe92⤵PID:3688
-
\??\c:\jvvjj.exec:\jvvjj.exe93⤵PID:4184
-
\??\c:\fflfffx.exec:\fflfffx.exe94⤵PID:2632
-
\??\c:\rlrlllf.exec:\rlrlllf.exe95⤵PID:3912
-
\??\c:\5ntnnn.exec:\5ntnnn.exe96⤵PID:5144
-
\??\c:\1jppd.exec:\1jppd.exe97⤵PID:5560
-
\??\c:\xrffxxr.exec:\xrffxxr.exe98⤵PID:3428
-
\??\c:\lrxrllf.exec:\lrxrllf.exe99⤵PID:6060
-
\??\c:\thnnnn.exec:\thnnnn.exe100⤵PID:3464
-
\??\c:\vppjd.exec:\vppjd.exe101⤵PID:1700
-
\??\c:\lrxrrrr.exec:\lrxrrrr.exe102⤵PID:4640
-
\??\c:\lflfxrr.exec:\lflfxrr.exe103⤵PID:2760
-
\??\c:\tthhhh.exec:\tthhhh.exe104⤵PID:868
-
\??\c:\ddjjd.exec:\ddjjd.exe105⤵PID:4232
-
\??\c:\ppdvv.exec:\ppdvv.exe106⤵PID:2700
-
\??\c:\3rxrllf.exec:\3rxrllf.exe107⤵PID:6020
-
\??\c:\bbhhbh.exec:\bbhhbh.exe108⤵PID:1144
-
\??\c:\ntnbbb.exec:\ntnbbb.exe109⤵PID:2248
-
\??\c:\7ddjj.exec:\7ddjj.exe110⤵PID:2672
-
\??\c:\9jdvp.exec:\9jdvp.exe111⤵PID:1140
-
\??\c:\xlrlflf.exec:\xlrlflf.exe112⤵PID:2052
-
\??\c:\xffxrlf.exec:\xffxrlf.exe113⤵PID:3056
-
\??\c:\tnntnt.exec:\tnntnt.exe114⤵PID:3840
-
\??\c:\hbhhht.exec:\hbhhht.exe115⤵PID:2732
-
\??\c:\djvjj.exec:\djvjj.exe116⤵PID:5244
-
\??\c:\dpvvv.exec:\dpvvv.exe117⤵PID:5012
-
\??\c:\lllflff.exec:\lllflff.exe118⤵PID:4600
-
\??\c:\jddpj.exec:\jddpj.exe119⤵PID:4212
-
\??\c:\dvjpp.exec:\dvjpp.exe120⤵PID:3400
-
\??\c:\lrrrlxf.exec:\lrrrlxf.exe121⤵PID:5440
-
\??\c:\rxfffll.exec:\rxfffll.exe122⤵PID:5380
-
\??\c:\9nnhbb.exec:\9nnhbb.exe123⤵PID:2260
-
\??\c:\nhnnhh.exec:\nhnnhh.exe124⤵PID:2696
-
\??\c:\jjjdd.exec:\jjjdd.exe125⤵PID:4420
-
\??\c:\jpvpj.exec:\jpvpj.exe126⤵PID:1032
-
\??\c:\frxxlll.exec:\frxxlll.exe127⤵PID:2856
-
\??\c:\fxlrlrf.exec:\fxlrlrf.exe128⤵PID:616
-
\??\c:\ntbtnn.exec:\ntbtnn.exe129⤵PID:1664
-
\??\c:\ppjdd.exec:\ppjdd.exe130⤵PID:5608
-
\??\c:\pjjjd.exec:\pjjjd.exe131⤵PID:1180
-
\??\c:\frxrlrr.exec:\frxrlrr.exe132⤵PID:1916
-
\??\c:\7xxxxfr.exec:\7xxxxfr.exe133⤵PID:936
-
\??\c:\bnhhhn.exec:\bnhhhn.exe134⤵PID:696
-
\??\c:\5hbbtt.exec:\5hbbtt.exe135⤵PID:4360
-
\??\c:\ppdpj.exec:\ppdpj.exe136⤵PID:2328
-
\??\c:\rfrxxlx.exec:\rfrxxlx.exe137⤵PID:4388
-
\??\c:\5rrxxxl.exec:\5rrxxxl.exe138⤵PID:3368
-
\??\c:\5hhhbb.exec:\5hhhbb.exe139⤵PID:4624
-
\??\c:\thbnnn.exec:\thbnnn.exe140⤵PID:5048
-
\??\c:\3dvvv.exec:\3dvvv.exe141⤵PID:4964
-
\??\c:\dvvvp.exec:\dvvvp.exe142⤵PID:4972
-
\??\c:\lxxrrfx.exec:\lxxrrfx.exe143⤵PID:4444
-
\??\c:\3nnttt.exec:\3nnttt.exe144⤵PID:4776
-
\??\c:\5bhnnn.exec:\5bhnnn.exe145⤵PID:2676
-
\??\c:\tthnbb.exec:\tthnbb.exe146⤵PID:5960
-
\??\c:\jdvjv.exec:\jdvjv.exe147⤵PID:452
-
\??\c:\lfffxfx.exec:\lfffxfx.exe148⤵PID:4988
-
\??\c:\5rfxlfr.exec:\5rfxlfr.exe149⤵PID:5772
-
\??\c:\bhnnbh.exec:\bhnnbh.exe150⤵PID:5680
-
\??\c:\hhhhhn.exec:\hhhhhn.exe151⤵PID:4728
-
\??\c:\hbhbtt.exec:\hbhbtt.exe152⤵PID:2272
-
\??\c:\vvddv.exec:\vvddv.exe153⤵PID:4408
-
\??\c:\dvjdd.exec:\dvjdd.exe154⤵PID:384
-
\??\c:\rflfxff.exec:\rflfxff.exe155⤵PID:4216
-
\??\c:\hbtnhh.exec:\hbtnhh.exe156⤵PID:3664
-
\??\c:\jjddv.exec:\jjddv.exe157⤵PID:4908
-
\??\c:\9lfxrrl.exec:\9lfxrrl.exe158⤵PID:4064
-
\??\c:\bhhbbt.exec:\bhhbbt.exe159⤵PID:1564
-
\??\c:\7pjjp.exec:\7pjjp.exe160⤵PID:4468
-
\??\c:\7vddd.exec:\7vddd.exe161⤵PID:5112
-
\??\c:\fffxxrl.exec:\fffxxrl.exe162⤵PID:4076
-
\??\c:\vjjjj.exec:\vjjjj.exe163⤵PID:3624
-
\??\c:\dvpjj.exec:\dvpjj.exe164⤵PID:392
-
\??\c:\lfffxxx.exec:\lfffxxx.exe165⤵PID:1848
-
\??\c:\bnhhhb.exec:\bnhhhb.exe166⤵PID:4684
-
\??\c:\dvjpp.exec:\dvjpp.exe167⤵PID:3912
-
\??\c:\lrlffxx.exec:\lrlffxx.exe168⤵PID:2560
-
\??\c:\rxxxxxr.exec:\rxxxxxr.exe169⤵PID:5560
-
\??\c:\5ddvp.exec:\5ddvp.exe170⤵PID:5648
-
\??\c:\rlxxrrl.exec:\rlxxrrl.exe171⤵PID:2836
-
\??\c:\bnbbbb.exec:\bnbbbb.exe172⤵PID:5016
-
\??\c:\5jppj.exec:\5jppj.exe173⤵PID:2464
-
\??\c:\hbhhth.exec:\hbhhth.exe174⤵PID:3276
-
\??\c:\vpjvp.exec:\vpjvp.exe175⤵PID:2760
-
\??\c:\hhnnnh.exec:\hhnnnh.exe176⤵PID:1348
-
\??\c:\jvpvp.exec:\jvpvp.exe177⤵PID:6016
-
\??\c:\pvdvv.exec:\pvdvv.exe178⤵PID:1696
-
\??\c:\jddvd.exec:\jddvd.exe179⤵PID:4980
-
\??\c:\flxxlrr.exec:\flxxlrr.exe180⤵PID:4292
-
\??\c:\thnhbt.exec:\thnhbt.exe181⤵PID:5752
-
\??\c:\hbnhbt.exec:\hbnhbt.exe182⤵PID:2852
-
\??\c:\pdddp.exec:\pdddp.exe183⤵PID:2348
-
\??\c:\xxlllxf.exec:\xxlllxf.exe184⤵PID:3064
-
\??\c:\rfrfrrx.exec:\rfrfrrx.exe185⤵PID:5384
-
\??\c:\nhtbtt.exec:\nhtbtt.exe186⤵PID:5480
-
\??\c:\vvvjd.exec:\vvvjd.exe187⤵PID:4992
-
\??\c:\vppjd.exec:\vppjd.exe188⤵PID:3952
-
\??\c:\1llfflf.exec:\1llfflf.exe189⤵PID:4600
-
\??\c:\lrffrrf.exec:\lrffrrf.exe190⤵PID:4768
-
\??\c:\hbntbb.exec:\hbntbb.exe191⤵PID:1528
-
\??\c:\xllffrr.exec:\xllffrr.exe192⤵PID:3008
-
\??\c:\thbhbb.exec:\thbhbb.exe193⤵PID:5380
-
\??\c:\7nhhtb.exec:\7nhhtb.exe194⤵PID:5348
-
\??\c:\vpjdv.exec:\vpjdv.exe195⤵PID:2124
-
\??\c:\rlxrfxl.exec:\rlxrfxl.exe196⤵PID:4112
-
\??\c:\nbhhhh.exec:\nbhhhh.exe197⤵PID:4708
-
\??\c:\jdddp.exec:\jdddp.exe198⤵PID:2856
-
\??\c:\3lrrrrx.exec:\3lrrrrx.exe199⤵PID:5696
-
\??\c:\hbhhbb.exec:\hbhhbb.exe200⤵PID:2488
-
\??\c:\pjdpp.exec:\pjdpp.exe201⤵PID:3628
-
\??\c:\7xfllxf.exec:\7xfllxf.exe202⤵PID:1800
-
\??\c:\lxllllf.exec:\lxllllf.exe203⤵PID:4820
-
\??\c:\hbhhbb.exec:\hbhhbb.exe204⤵PID:2432
-
\??\c:\dvvpv.exec:\dvvpv.exe205⤵PID:4892
-
\??\c:\9ddvp.exec:\9ddvp.exe206⤵PID:2544
-
\??\c:\7lffxff.exec:\7lffxff.exe207⤵PID:5536
-
\??\c:\ffrlrff.exec:\ffrlrff.exe208⤵PID:5236
-
\??\c:\1bhhbb.exec:\1bhhbb.exe209⤵PID:3396
-
\??\c:\hnnnnn.exec:\hnnnnn.exe210⤵PID:1984
-
\??\c:\7bnhhh.exec:\7bnhhh.exe211⤵PID:5288
-
\??\c:\djjdj.exec:\djjdj.exe212⤵PID:504
-
\??\c:\9pvpd.exec:\9pvpd.exe213⤵PID:4776
-
\??\c:\9xllrxl.exec:\9xllrxl.exe214⤵PID:760
-
\??\c:\7lxrlrx.exec:\7lxrlrx.exe215⤵PID:448
-
\??\c:\hbhhhn.exec:\hbhhhn.exe216⤵PID:1124
-
\??\c:\9jppp.exec:\9jppp.exe217⤵PID:4156
-
\??\c:\5pdpp.exec:\5pdpp.exe218⤵PID:5324
-
\??\c:\rlxrrll.exec:\rlxrrll.exe219⤵PID:3768
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe220⤵PID:2272
-
\??\c:\ttbbbb.exec:\ttbbbb.exe221⤵PID:4408
-
\??\c:\1nnnbh.exec:\1nnnbh.exe222⤵PID:4080
-
\??\c:\vjpjd.exec:\vjpjd.exe223⤵PID:3784
-
\??\c:\jjddd.exec:\jjddd.exe224⤵PID:3672
-
\??\c:\lrflfxx.exec:\lrflfxx.exe225⤵PID:4084
-
\??\c:\nnhthh.exec:\nnhthh.exe226⤵PID:2168
-
\??\c:\nhhhhh.exec:\nhhhhh.exe227⤵PID:1880
-
\??\c:\jvdvp.exec:\jvdvp.exe228⤵PID:5076
-
\??\c:\jdvpv.exec:\jdvpv.exe229⤵PID:4144
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe230⤵PID:3868
-
\??\c:\ffflfll.exec:\ffflfll.exe231⤵PID:3968
-
\??\c:\bttttt.exec:\bttttt.exe232⤵PID:2632
-
\??\c:\vdvvv.exec:\vdvvv.exe233⤵PID:2636
-
\??\c:\jvpdp.exec:\jvpdp.exe234⤵PID:4764
-
\??\c:\rrrrflf.exec:\rrrrflf.exe235⤵PID:2224
-
\??\c:\xffffff.exec:\xffffff.exe236⤵PID:5704
-
\??\c:\bbhhnt.exec:\bbhhnt.exe237⤵PID:4496
-
\??\c:\9pvpd.exec:\9pvpd.exe238⤵PID:3748
-
\??\c:\1jjjd.exec:\1jjjd.exe239⤵PID:4544
-
\??\c:\lfrlflf.exec:\lfrlflf.exe240⤵PID:2148
-
\??\c:\tnnhbn.exec:\tnnhbn.exe241⤵PID:1472
-
\??\c:\tnbthh.exec:\tnbthh.exe242⤵PID:4736