Analysis
-
max time kernel
150s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 02:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5291e23ba149ce59ef6f4484d9925890_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
5291e23ba149ce59ef6f4484d9925890_NeikiAnalytics.exe
-
Size
226KB
-
MD5
5291e23ba149ce59ef6f4484d9925890
-
SHA1
c0bdb588f540e204651f95d92ca9a9cc03f9583b
-
SHA256
ae44d21e6b6bf3f13a1ed40818423df39a3784cdea29a9792ad3a59a9dc2e20a
-
SHA512
3e8f7e191faa6e25c53fca4b59a288c520217718b10825b3a5b36bb5e99fb02eb714cfaa09a1a7d7d356ddee033f223a93629a99550f842641621fc3919f6bef
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x47WBQ:n3C9BRo7MlrWKo+lxQ
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral2/memory/400-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3620-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2848-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4712-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4312-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4920-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5040-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3988-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1196-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2152-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3992-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1312-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4832-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2496-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2832-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/988-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2640-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2924-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2948-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4496-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2604-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4580-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
flrxrff.exethnhhn.exeppjdj.exeddjjv.exe3rlllll.exetbhnhn.exevpdvd.exepjpjj.exexxfxxxx.exe1bnnnn.exejdpjv.exerxfxrrx.exehthbtt.exepjddp.exeffllffr.exejjdvv.exejpvvp.exelrfxffl.exenbnhhb.exepdppj.exe7ttnhb.exenhnhtt.exevjjdv.exebhnnhn.exepjvpd.exexrxrlff.exevvdvp.exe1lxrllf.exehntnhn.exejpdvv.exerlllffx.exexffrrff.exe7ntnhh.exevpppj.exerllxlxr.exebbnnnn.exe3pvvv.exelrlffff.exe9rxrllr.exejdpjd.exexxrlfxf.exehhtnhh.exeppdvv.exejjjdd.exelrrfflr.exe3nbbnb.exepdjjv.exexfrlfff.exe1flllll.exehbnnhn.exejvjdp.exevjvvd.exe1fffrxr.exenbhbnn.exedppjd.exevpddv.exeffrrxxr.exethtttt.exevpvpj.exepdpdd.exelflffxx.exexxfxrrl.exebtthbb.exeppjdd.exepid process 3620 flrxrff.exe 4908 thnhhn.exe 4920 ppjdj.exe 2848 ddjjv.exe 4712 3rlllll.exe 4312 tbhnhn.exe 1300 vpdvd.exe 2616 pjpjj.exe 812 xxfxxxx.exe 4688 1bnnnn.exe 5040 jdpjv.exe 3988 rxfxrrx.exe 1196 hthbtt.exe 2152 pjddp.exe 3992 ffllffr.exe 1312 jjdvv.exe 5012 jpvvp.exe 4832 lrfxffl.exe 2496 nbnhhb.exe 2832 pdppj.exe 3280 7ttnhb.exe 988 nhnhtt.exe 3900 vjjdv.exe 2640 bhnnhn.exe 3244 pjvpd.exe 2004 xrxrlff.exe 2924 vvdvp.exe 2948 1lxrllf.exe 4496 hntnhn.exe 4580 jpdvv.exe 2604 rlllffx.exe 216 xffrrff.exe 4588 7ntnhh.exe 4224 vpppj.exe 232 rllxlxr.exe 2936 bbnnnn.exe 3472 3pvvv.exe 3848 lrlffff.exe 1776 9rxrllr.exe 4020 jdpjd.exe 1480 xxrlfxf.exe 5028 hhtnhh.exe 2304 ppdvv.exe 588 jjjdd.exe 4596 lrrfflr.exe 3736 3nbbnb.exe 1740 pdjjv.exe 3020 xfrlfff.exe 1832 1flllll.exe 3584 hbnnhn.exe 2124 jvjdp.exe 1196 vjvvd.exe 4472 1fffrxr.exe 4632 nbhbnn.exe 3992 dppjd.exe 1176 vpddv.exe 3416 ffrrxxr.exe 4440 thtttt.exe 4832 vpvpj.exe 3272 pdpdd.exe 5080 lflffxx.exe 1512 xxfxrrl.exe 2108 btthbb.exe 1632 ppjdd.exe -
Processes:
resource yara_rule behavioral2/memory/400-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3620-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2848-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4712-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4312-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4920-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5040-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3988-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1196-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2152-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3992-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1312-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4832-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2496-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2832-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/988-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2640-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2948-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4496-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-198-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5291e23ba149ce59ef6f4484d9925890_NeikiAnalytics.exeflrxrff.exethnhhn.exeppjdj.exeddjjv.exe3rlllll.exetbhnhn.exevpdvd.exepjpjj.exexxfxxxx.exe1bnnnn.exejdpjv.exerxfxrrx.exehthbtt.exepjddp.exeffllffr.exejjdvv.exejpvvp.exelrfxffl.exenbnhhb.exepdppj.exe7ttnhb.exedescription pid process target process PID 400 wrote to memory of 3620 400 5291e23ba149ce59ef6f4484d9925890_NeikiAnalytics.exe flrxrff.exe PID 400 wrote to memory of 3620 400 5291e23ba149ce59ef6f4484d9925890_NeikiAnalytics.exe flrxrff.exe PID 400 wrote to memory of 3620 400 5291e23ba149ce59ef6f4484d9925890_NeikiAnalytics.exe flrxrff.exe PID 3620 wrote to memory of 4908 3620 flrxrff.exe thnhhn.exe PID 3620 wrote to memory of 4908 3620 flrxrff.exe thnhhn.exe PID 3620 wrote to memory of 4908 3620 flrxrff.exe thnhhn.exe PID 4908 wrote to memory of 4920 4908 thnhhn.exe ppjdj.exe PID 4908 wrote to memory of 4920 4908 thnhhn.exe ppjdj.exe PID 4908 wrote to memory of 4920 4908 thnhhn.exe ppjdj.exe PID 4920 wrote to memory of 2848 4920 ppjdj.exe ddjjv.exe PID 4920 wrote to memory of 2848 4920 ppjdj.exe ddjjv.exe PID 4920 wrote to memory of 2848 4920 ppjdj.exe ddjjv.exe PID 2848 wrote to memory of 4712 2848 ddjjv.exe 3rlllll.exe PID 2848 wrote to memory of 4712 2848 ddjjv.exe 3rlllll.exe PID 2848 wrote to memory of 4712 2848 ddjjv.exe 3rlllll.exe PID 4712 wrote to memory of 4312 4712 3rlllll.exe tbhnhn.exe PID 4712 wrote to memory of 4312 4712 3rlllll.exe tbhnhn.exe PID 4712 wrote to memory of 4312 4712 3rlllll.exe tbhnhn.exe PID 4312 wrote to memory of 1300 4312 tbhnhn.exe vpdvd.exe PID 4312 wrote to memory of 1300 4312 tbhnhn.exe vpdvd.exe PID 4312 wrote to memory of 1300 4312 tbhnhn.exe vpdvd.exe PID 1300 wrote to memory of 2616 1300 vpdvd.exe pjpjj.exe PID 1300 wrote to memory of 2616 1300 vpdvd.exe pjpjj.exe PID 1300 wrote to memory of 2616 1300 vpdvd.exe pjpjj.exe PID 2616 wrote to memory of 812 2616 pjpjj.exe xxfxxxx.exe PID 2616 wrote to memory of 812 2616 pjpjj.exe xxfxxxx.exe PID 2616 wrote to memory of 812 2616 pjpjj.exe xxfxxxx.exe PID 812 wrote to memory of 4688 812 xxfxxxx.exe 1bnnnn.exe PID 812 wrote to memory of 4688 812 xxfxxxx.exe 1bnnnn.exe PID 812 wrote to memory of 4688 812 xxfxxxx.exe 1bnnnn.exe PID 4688 wrote to memory of 5040 4688 1bnnnn.exe jdpjv.exe PID 4688 wrote to memory of 5040 4688 1bnnnn.exe jdpjv.exe PID 4688 wrote to memory of 5040 4688 1bnnnn.exe jdpjv.exe PID 5040 wrote to memory of 3988 5040 jdpjv.exe rxfxrrx.exe PID 5040 wrote to memory of 3988 5040 jdpjv.exe rxfxrrx.exe PID 5040 wrote to memory of 3988 5040 jdpjv.exe rxfxrrx.exe PID 3988 wrote to memory of 1196 3988 rxfxrrx.exe hthbtt.exe PID 3988 wrote to memory of 1196 3988 rxfxrrx.exe hthbtt.exe PID 3988 wrote to memory of 1196 3988 rxfxrrx.exe hthbtt.exe PID 1196 wrote to memory of 2152 1196 hthbtt.exe pjddp.exe PID 1196 wrote to memory of 2152 1196 hthbtt.exe pjddp.exe PID 1196 wrote to memory of 2152 1196 hthbtt.exe pjddp.exe PID 2152 wrote to memory of 3992 2152 pjddp.exe ffllffr.exe PID 2152 wrote to memory of 3992 2152 pjddp.exe ffllffr.exe PID 2152 wrote to memory of 3992 2152 pjddp.exe ffllffr.exe PID 3992 wrote to memory of 1312 3992 ffllffr.exe jjdvv.exe PID 3992 wrote to memory of 1312 3992 ffllffr.exe jjdvv.exe PID 3992 wrote to memory of 1312 3992 ffllffr.exe jjdvv.exe PID 1312 wrote to memory of 5012 1312 jjdvv.exe jpvvp.exe PID 1312 wrote to memory of 5012 1312 jjdvv.exe jpvvp.exe PID 1312 wrote to memory of 5012 1312 jjdvv.exe jpvvp.exe PID 5012 wrote to memory of 4832 5012 jpvvp.exe lrfxffl.exe PID 5012 wrote to memory of 4832 5012 jpvvp.exe lrfxffl.exe PID 5012 wrote to memory of 4832 5012 jpvvp.exe lrfxffl.exe PID 4832 wrote to memory of 2496 4832 lrfxffl.exe nbnhhb.exe PID 4832 wrote to memory of 2496 4832 lrfxffl.exe nbnhhb.exe PID 4832 wrote to memory of 2496 4832 lrfxffl.exe nbnhhb.exe PID 2496 wrote to memory of 2832 2496 nbnhhb.exe pdppj.exe PID 2496 wrote to memory of 2832 2496 nbnhhb.exe pdppj.exe PID 2496 wrote to memory of 2832 2496 nbnhhb.exe pdppj.exe PID 2832 wrote to memory of 3280 2832 pdppj.exe 7ttnhb.exe PID 2832 wrote to memory of 3280 2832 pdppj.exe 7ttnhb.exe PID 2832 wrote to memory of 3280 2832 pdppj.exe 7ttnhb.exe PID 3280 wrote to memory of 988 3280 7ttnhb.exe nhnhtt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5291e23ba149ce59ef6f4484d9925890_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5291e23ba149ce59ef6f4484d9925890_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\flrxrff.exec:\flrxrff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\thnhhn.exec:\thnhhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\ppjdj.exec:\ppjdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\ddjjv.exec:\ddjjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\3rlllll.exec:\3rlllll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\tbhnhn.exec:\tbhnhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\vpdvd.exec:\vpdvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\pjpjj.exec:\pjpjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\xxfxxxx.exec:\xxfxxxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\1bnnnn.exec:\1bnnnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\jdpjv.exec:\jdpjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\rxfxrrx.exec:\rxfxrrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\hthbtt.exec:\hthbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\pjddp.exec:\pjddp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\ffllffr.exec:\ffllffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\jjdvv.exec:\jjdvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\jpvvp.exec:\jpvvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\lrfxffl.exec:\lrfxffl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\nbnhhb.exec:\nbnhhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\pdppj.exec:\pdppj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\7ttnhb.exec:\7ttnhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\nhnhtt.exec:\nhnhtt.exe23⤵
- Executes dropped EXE
PID:988 -
\??\c:\vjjdv.exec:\vjjdv.exe24⤵
- Executes dropped EXE
PID:3900 -
\??\c:\bhnnhn.exec:\bhnnhn.exe25⤵
- Executes dropped EXE
PID:2640 -
\??\c:\pjvpd.exec:\pjvpd.exe26⤵
- Executes dropped EXE
PID:3244 -
\??\c:\xrxrlff.exec:\xrxrlff.exe27⤵
- Executes dropped EXE
PID:2004 -
\??\c:\vvdvp.exec:\vvdvp.exe28⤵
- Executes dropped EXE
PID:2924 -
\??\c:\1lxrllf.exec:\1lxrllf.exe29⤵
- Executes dropped EXE
PID:2948 -
\??\c:\hntnhn.exec:\hntnhn.exe30⤵
- Executes dropped EXE
PID:4496 -
\??\c:\jpdvv.exec:\jpdvv.exe31⤵
- Executes dropped EXE
PID:4580 -
\??\c:\rlllffx.exec:\rlllffx.exe32⤵
- Executes dropped EXE
PID:2604 -
\??\c:\xffrrff.exec:\xffrrff.exe33⤵
- Executes dropped EXE
PID:216 -
\??\c:\7ntnhh.exec:\7ntnhh.exe34⤵
- Executes dropped EXE
PID:4588 -
\??\c:\vpppj.exec:\vpppj.exe35⤵
- Executes dropped EXE
PID:4224 -
\??\c:\rllxlxr.exec:\rllxlxr.exe36⤵
- Executes dropped EXE
PID:232 -
\??\c:\bbnnnn.exec:\bbnnnn.exe37⤵
- Executes dropped EXE
PID:2936 -
\??\c:\thtntn.exec:\thtntn.exe38⤵PID:4352
-
\??\c:\3pvvv.exec:\3pvvv.exe39⤵
- Executes dropped EXE
PID:3472 -
\??\c:\lrlffff.exec:\lrlffff.exe40⤵
- Executes dropped EXE
PID:3848 -
\??\c:\9rxrllr.exec:\9rxrllr.exe41⤵
- Executes dropped EXE
PID:1776 -
\??\c:\jdpjd.exec:\jdpjd.exe42⤵
- Executes dropped EXE
PID:4020 -
\??\c:\xxrlfxf.exec:\xxrlfxf.exe43⤵
- Executes dropped EXE
PID:1480 -
\??\c:\hhtnhh.exec:\hhtnhh.exe44⤵
- Executes dropped EXE
PID:5028 -
\??\c:\ppdvv.exec:\ppdvv.exe45⤵
- Executes dropped EXE
PID:2304 -
\??\c:\jjjdd.exec:\jjjdd.exe46⤵
- Executes dropped EXE
PID:588 -
\??\c:\lrrfflr.exec:\lrrfflr.exe47⤵
- Executes dropped EXE
PID:4596 -
\??\c:\3nbbnb.exec:\3nbbnb.exe48⤵
- Executes dropped EXE
PID:3736 -
\??\c:\pdjjv.exec:\pdjjv.exe49⤵
- Executes dropped EXE
PID:1740 -
\??\c:\xfrlfff.exec:\xfrlfff.exe50⤵
- Executes dropped EXE
PID:3020 -
\??\c:\1flllll.exec:\1flllll.exe51⤵
- Executes dropped EXE
PID:1832 -
\??\c:\hbnnhn.exec:\hbnnhn.exe52⤵
- Executes dropped EXE
PID:3584 -
\??\c:\jvjdp.exec:\jvjdp.exe53⤵
- Executes dropped EXE
PID:2124 -
\??\c:\vjvvd.exec:\vjvvd.exe54⤵
- Executes dropped EXE
PID:1196 -
\??\c:\1fffrxr.exec:\1fffrxr.exe55⤵
- Executes dropped EXE
PID:4472 -
\??\c:\nbhbnn.exec:\nbhbnn.exe56⤵
- Executes dropped EXE
PID:4632 -
\??\c:\dppjd.exec:\dppjd.exe57⤵
- Executes dropped EXE
PID:3992 -
\??\c:\vpddv.exec:\vpddv.exe58⤵
- Executes dropped EXE
PID:1176 -
\??\c:\ffrrxxr.exec:\ffrrxxr.exe59⤵
- Executes dropped EXE
PID:3416 -
\??\c:\thtttt.exec:\thtttt.exe60⤵
- Executes dropped EXE
PID:4440 -
\??\c:\vpvpj.exec:\vpvpj.exe61⤵
- Executes dropped EXE
PID:4832 -
\??\c:\pdpdd.exec:\pdpdd.exe62⤵
- Executes dropped EXE
PID:3272 -
\??\c:\lflffxx.exec:\lflffxx.exe63⤵
- Executes dropped EXE
PID:5080 -
\??\c:\xxfxrrl.exec:\xxfxrrl.exe64⤵
- Executes dropped EXE
PID:1512 -
\??\c:\btthbb.exec:\btthbb.exe65⤵
- Executes dropped EXE
PID:2108 -
\??\c:\ppjdd.exec:\ppjdd.exe66⤵
- Executes dropped EXE
PID:1632 -
\??\c:\ffllfff.exec:\ffllfff.exe67⤵PID:2024
-
\??\c:\tnttnn.exec:\tnttnn.exe68⤵PID:4796
-
\??\c:\vjpjj.exec:\vjpjj.exe69⤵PID:1844
-
\??\c:\ffxxxxx.exec:\ffxxxxx.exe70⤵PID:2864
-
\??\c:\xrfxflr.exec:\xrfxflr.exe71⤵PID:4080
-
\??\c:\nhhttt.exec:\nhhttt.exe72⤵PID:528
-
\??\c:\5pvpd.exec:\5pvpd.exe73⤵PID:4708
-
\??\c:\frlfflf.exec:\frlfflf.exe74⤵PID:2948
-
\??\c:\1lrlrxf.exec:\1lrlrxf.exe75⤵PID:3676
-
\??\c:\bthbtt.exec:\bthbtt.exe76⤵PID:3772
-
\??\c:\djvvv.exec:\djvvv.exe77⤵PID:2360
-
\??\c:\lffxrrl.exec:\lffxrrl.exe78⤵PID:4400
-
\??\c:\7tnhbb.exec:\7tnhbb.exe79⤵PID:2912
-
\??\c:\bttthh.exec:\bttthh.exe80⤵PID:4544
-
\??\c:\5jjpd.exec:\5jjpd.exe81⤵PID:3856
-
\??\c:\lflxrrr.exec:\lflxrrr.exe82⤵PID:4340
-
\??\c:\rxlfffx.exec:\rxlfffx.exe83⤵PID:4332
-
\??\c:\tnhhbt.exec:\tnhhbt.exe84⤵PID:4208
-
\??\c:\9ddvj.exec:\9ddvj.exe85⤵PID:4268
-
\??\c:\5tbthh.exec:\5tbthh.exe86⤵PID:3472
-
\??\c:\tbnnbb.exec:\tbnnbb.exe87⤵PID:4860
-
\??\c:\pjvpp.exec:\pjvpp.exe88⤵PID:2448
-
\??\c:\xllfxxr.exec:\xllfxxr.exe89⤵PID:3732
-
\??\c:\pvdvp.exec:\pvdvp.exe90⤵PID:3220
-
\??\c:\xrxrrll.exec:\xrxrrll.exe91⤵PID:1004
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe92⤵PID:5116
-
\??\c:\bbnnnn.exec:\bbnnnn.exe93⤵PID:588
-
\??\c:\7jjpp.exec:\7jjpp.exe94⤵PID:3688
-
\??\c:\vdjvv.exec:\vdjvv.exe95⤵PID:2716
-
\??\c:\rxffxxx.exec:\rxffxxx.exe96⤵PID:1636
-
\??\c:\hbnnhb.exec:\hbnnhb.exe97⤵PID:2568
-
\??\c:\9djjv.exec:\9djjv.exe98⤵PID:4024
-
\??\c:\flrlffx.exec:\flrlffx.exe99⤵PID:1584
-
\??\c:\tntthh.exec:\tntthh.exe100⤵PID:1196
-
\??\c:\dvddv.exec:\dvddv.exe101⤵PID:2264
-
\??\c:\vppvp.exec:\vppvp.exe102⤵PID:4632
-
\??\c:\1rrllrl.exec:\1rrllrl.exe103⤵PID:1312
-
\??\c:\rffxrxr.exec:\rffxrxr.exe104⤵PID:5024
-
\??\c:\hhtttt.exec:\hhtttt.exe105⤵PID:3416
-
\??\c:\pjdvp.exec:\pjdvp.exe106⤵PID:4440
-
\??\c:\3jppj.exec:\3jppj.exe107⤵PID:4408
-
\??\c:\lxxrllf.exec:\lxxrllf.exe108⤵PID:760
-
\??\c:\tthtnn.exec:\tthtnn.exe109⤵PID:3496
-
\??\c:\nthbbt.exec:\nthbbt.exe110⤵PID:4636
-
\??\c:\pdddd.exec:\pdddd.exe111⤵PID:1256
-
\??\c:\rrfxffr.exec:\rrfxffr.exe112⤵PID:3592
-
\??\c:\xlfffxx.exec:\xlfffxx.exe113⤵PID:3256
-
\??\c:\nhbhbb.exec:\nhbhbb.exe114⤵PID:2864
-
\??\c:\jvvpj.exec:\jvvpj.exe115⤵PID:2656
-
\??\c:\5jppv.exec:\5jppv.exe116⤵PID:528
-
\??\c:\fffxxrl.exec:\fffxxrl.exe117⤵PID:1348
-
\??\c:\nntntt.exec:\nntntt.exe118⤵PID:1920
-
\??\c:\hbhttt.exec:\hbhttt.exe119⤵PID:2900
-
\??\c:\jdvpd.exec:\jdvpd.exe120⤵PID:3348
-
\??\c:\lxfxrxl.exec:\lxfxrxl.exe121⤵PID:3632
-
\??\c:\nnnhbb.exec:\nnnhbb.exe122⤵PID:4180
-
\??\c:\hhhbht.exec:\hhhbht.exe123⤵PID:220
-
\??\c:\jjddj.exec:\jjddj.exe124⤵PID:3856
-
\??\c:\rflrlfl.exec:\rflrlfl.exe125⤵PID:4556
-
\??\c:\rflfffx.exec:\rflfffx.exe126⤵PID:1948
-
\??\c:\hhbttt.exec:\hhbttt.exe127⤵PID:1696
-
\??\c:\nntnbb.exec:\nntnbb.exe128⤵PID:4040
-
\??\c:\9djjv.exec:\9djjv.exe129⤵PID:668
-
\??\c:\ddjjd.exec:\ddjjd.exe130⤵PID:4868
-
\??\c:\9rrrrll.exec:\9rrrrll.exe131⤵PID:5028
-
\??\c:\hbnhnb.exec:\hbnhnb.exe132⤵PID:1984
-
\??\c:\7hnhbb.exec:\7hnhbb.exe133⤵PID:432
-
\??\c:\pjjjd.exec:\pjjjd.exe134⤵PID:3116
-
\??\c:\pvjdv.exec:\pvjdv.exe135⤵PID:2628
-
\??\c:\xrllrrx.exec:\xrllrrx.exe136⤵PID:4692
-
\??\c:\1ffffll.exec:\1ffffll.exe137⤵PID:116
-
\??\c:\9bbhbh.exec:\9bbhbh.exe138⤵PID:1584
-
\??\c:\vpjjj.exec:\vpjjj.exe139⤵PID:1196
-
\??\c:\fxfxllf.exec:\fxfxllf.exe140⤵PID:4904
-
\??\c:\5hbbtt.exec:\5hbbtt.exe141⤵PID:4896
-
\??\c:\jjvpj.exec:\jjvpj.exe142⤵PID:4120
-
\??\c:\rrxxrxx.exec:\rrxxrxx.exe143⤵PID:4592
-
\??\c:\ntbhnt.exec:\ntbhnt.exe144⤵PID:4176
-
\??\c:\dvdpj.exec:\dvdpj.exe145⤵PID:4076
-
\??\c:\1pjdv.exec:\1pjdv.exe146⤵PID:4260
-
\??\c:\3xxrllf.exec:\3xxrllf.exe147⤵PID:2128
-
\??\c:\tnbttn.exec:\tnbttn.exe148⤵PID:2608
-
\??\c:\vvjdd.exec:\vvjdd.exe149⤵PID:4752
-
\??\c:\rlxxxxl.exec:\rlxxxxl.exe150⤵PID:3244
-
\??\c:\9flffll.exec:\9flffll.exe151⤵PID:3256
-
\??\c:\tbbbtt.exec:\tbbbtt.exe152⤵PID:2344
-
\??\c:\ddjdv.exec:\ddjdv.exe153⤵PID:2656
-
\??\c:\5lfrlxr.exec:\5lfrlxr.exe154⤵PID:528
-
\??\c:\vdvvp.exec:\vdvvp.exe155⤵PID:3260
-
\??\c:\lrlfxxr.exec:\lrlfxxr.exe156⤵PID:3888
-
\??\c:\7lxxxff.exec:\7lxxxff.exe157⤵PID:3580
-
\??\c:\vjpjj.exec:\vjpjj.exe158⤵PID:3348
-
\??\c:\llflflx.exec:\llflflx.exe159⤵PID:3632
-
\??\c:\1dpjp.exec:\1dpjp.exe160⤵PID:3100
-
\??\c:\ddvpv.exec:\ddvpv.exe161⤵PID:4336
-
\??\c:\xrllffx.exec:\xrllffx.exe162⤵PID:4352
-
\??\c:\7bnnhh.exec:\7bnnhh.exe163⤵PID:5016
-
\??\c:\vppdv.exec:\vppdv.exe164⤵PID:1564
-
\??\c:\7pddj.exec:\7pddj.exe165⤵PID:2348
-
\??\c:\fxxfxrl.exec:\fxxfxrl.exe166⤵PID:4020
-
\??\c:\hbnhhb.exec:\hbnhhb.exe167⤵PID:3904
-
\??\c:\9ddpj.exec:\9ddpj.exe168⤵PID:4828
-
\??\c:\fflfxxr.exec:\fflfxxr.exe169⤵PID:1460
-
\??\c:\nhhtnt.exec:\nhhtnt.exe170⤵PID:588
-
\??\c:\vjppj.exec:\vjppj.exe171⤵PID:4788
-
\??\c:\3djvp.exec:\3djvp.exe172⤵PID:2724
-
\??\c:\rflffff.exec:\rflffff.exe173⤵PID:2124
-
\??\c:\5nhhhh.exec:\5nhhhh.exe174⤵PID:1028
-
\??\c:\htbtnn.exec:\htbtnn.exe175⤵PID:508
-
\??\c:\jvvpd.exec:\jvvpd.exe176⤵PID:1328
-
\??\c:\rflfrxr.exec:\rflfrxr.exe177⤵PID:552
-
\??\c:\bbhhnh.exec:\bbhhnh.exe178⤵PID:4476
-
\??\c:\bbbtnh.exec:\bbbtnh.exe179⤵PID:1320
-
\??\c:\vddjp.exec:\vddjp.exe180⤵PID:4264
-
\??\c:\llffxxx.exec:\llffxxx.exe181⤵PID:5080
-
\??\c:\hhbtnh.exec:\hhbtnh.exe182⤵PID:3280
-
\??\c:\bttntb.exec:\bttntb.exe183⤵PID:1884
-
\??\c:\pppjj.exec:\pppjj.exe184⤵PID:2640
-
\??\c:\vjvjv.exec:\vjvjv.exe185⤵PID:2400
-
\??\c:\rrxfxxx.exec:\rrxfxxx.exe186⤵PID:4328
-
\??\c:\bhbbbb.exec:\bhbbbb.exe187⤵PID:3708
-
\??\c:\bnnhtt.exec:\bnnhtt.exe188⤵PID:2988
-
\??\c:\jddjd.exec:\jddjd.exe189⤵PID:1996
-
\??\c:\lrxxllf.exec:\lrxxllf.exe190⤵PID:5068
-
\??\c:\hbhbhn.exec:\hbhbhn.exe191⤵PID:2656
-
\??\c:\jjppd.exec:\jjppd.exe192⤵PID:528
-
\??\c:\vpvvj.exec:\vpvvj.exe193⤵PID:4276
-
\??\c:\xffxrrr.exec:\xffxrrr.exe194⤵PID:4848
-
\??\c:\nhtnhn.exec:\nhtnhn.exe195⤵PID:3580
-
\??\c:\7vddd.exec:\7vddd.exe196⤵PID:3268
-
\??\c:\7pjdp.exec:\7pjdp.exe197⤵PID:4368
-
\??\c:\rxflflf.exec:\rxflflf.exe198⤵PID:3856
-
\??\c:\bhtbtn.exec:\bhtbtn.exe199⤵PID:4556
-
\??\c:\jvdvv.exec:\jvdvv.exe200⤵PID:4352
-
\??\c:\jjppj.exec:\jjppj.exe201⤵PID:1700
-
\??\c:\fxlfxxr.exec:\fxlfxxr.exe202⤵PID:4184
-
\??\c:\5tttnb.exec:\5tttnb.exe203⤵PID:4488
-
\??\c:\nnnnhh.exec:\nnnnhh.exe204⤵PID:4020
-
\??\c:\5dpjd.exec:\5dpjd.exe205⤵PID:3940
-
\??\c:\vvjjp.exec:\vvjjp.exe206⤵PID:368
-
\??\c:\xxrrrrr.exec:\xxrrrrr.exe207⤵PID:1832
-
\??\c:\thbhbb.exec:\thbhbb.exe208⤵PID:588
-
\??\c:\hnttnn.exec:\hnttnn.exe209⤵PID:4024
-
\??\c:\jjjdd.exec:\jjjdd.exe210⤵PID:1036
-
\??\c:\lrffrrf.exec:\lrffrrf.exe211⤵PID:3192
-
\??\c:\9rlllll.exec:\9rlllll.exe212⤵PID:2264
-
\??\c:\3tbnhh.exec:\3tbnhh.exe213⤵PID:2600
-
\??\c:\vppjv.exec:\vppjv.exe214⤵PID:2316
-
\??\c:\rllfxxf.exec:\rllfxxf.exe215⤵PID:4960
-
\??\c:\5lxrxxf.exec:\5lxrxxf.exe216⤵PID:4592
-
\??\c:\1thbnn.exec:\1thbnn.exe217⤵PID:3112
-
\??\c:\jdjdv.exec:\jdjdv.exe218⤵PID:4116
-
\??\c:\xflrfrr.exec:\xflrfrr.exe219⤵PID:1632
-
\??\c:\hbtthh.exec:\hbtthh.exe220⤵PID:1884
-
\??\c:\jpvvd.exec:\jpvvd.exe221⤵PID:4796
-
\??\c:\pdppd.exec:\pdppd.exe222⤵PID:4752
-
\??\c:\fxxlfxr.exec:\fxxlfxr.exe223⤵PID:4484
-
\??\c:\nbnbbb.exec:\nbnbbb.exe224⤵PID:4080
-
\??\c:\tnbbhh.exec:\tnbbhh.exe225⤵PID:2344
-
\??\c:\dvvvv.exec:\dvvvv.exe226⤵PID:544
-
\??\c:\xlxrrrl.exec:\xlxrrrl.exe227⤵PID:4808
-
\??\c:\lffffff.exec:\lffffff.exe228⤵PID:4412
-
\??\c:\thhhhb.exec:\thhhhb.exe229⤵PID:2360
-
\??\c:\vpjdd.exec:\vpjdd.exe230⤵PID:2564
-
\??\c:\pvddp.exec:\pvddp.exe231⤵PID:2424
-
\??\c:\fxfxxff.exec:\fxfxxff.exe232⤵PID:2912
-
\??\c:\7btttt.exec:\7btttt.exe233⤵PID:232
-
\??\c:\hbhbnn.exec:\hbhbnn.exe234⤵PID:1336
-
\??\c:\jjvpd.exec:\jjvpd.exe235⤵PID:3180
-
\??\c:\3llxrll.exec:\3llxrll.exe236⤵PID:1948
-
\??\c:\hnnhht.exec:\hnnhht.exe237⤵PID:1564
-
\??\c:\jdvpj.exec:\jdvpj.exe238⤵PID:3460
-
\??\c:\5pddv.exec:\5pddv.exe239⤵PID:4184
-
\??\c:\fxfxrxx.exec:\fxfxrxx.exe240⤵PID:4488
-
\??\c:\rlxrfxf.exec:\rlxrfxf.exe241⤵PID:4020
-
\??\c:\tthtnn.exec:\tthtnn.exe242⤵PID:2716