Analysis
-
max time kernel
149s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 03:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5eef8191e12bcea07d3af23002803010_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
5eef8191e12bcea07d3af23002803010_NeikiAnalytics.exe
-
Size
56KB
-
MD5
5eef8191e12bcea07d3af23002803010
-
SHA1
9b0756d39b9fb400f971a5ca17488197cdb5b81c
-
SHA256
d6f093f86d3408033cfad63d4ee610b773ed0db4d3c2cc278fa451d1554bcb80
-
SHA512
c9a5c3edb2d1c116029bfa6635d00e45d255e038a0d49fda311e7eae215526daf557d8fc02f8cf4291d173ba747e6d9f5f08bd0a6aa35e954e37abfbf33dea8e
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0chVnEz:ymb3NkkiQ3mdBjF0crEz
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
Processes:
resource yara_rule behavioral2/memory/1224-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2676-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1920-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3556-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1476-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4244-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4744-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2768-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4312-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3668-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2724-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1876-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2288-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3000-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2804-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4984-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xffxrll.exehhbhhn.exepvjpp.exellflfll.exehnhhhh.exedpvpp.exexrxrlxr.exexflxlfr.exebbnhhh.exe1vpjj.exefffrrxx.exerlrrlrl.exentbbtt.exejvvpj.exedjppj.exeffllllf.exefxlfffl.exebttttt.exejvpvd.exevpvdd.exerrllxxx.exenhnhbh.exehnbbtt.exepjjjj.exexxxfxxx.exe7bhhbb.exe5bhhhh.exellrlrrx.exellrrlll.exepdjdp.exefrlllll.exehhhhhh.exe9djjd.exerffffll.exe1nbbnt.exehtttnb.exeddjjd.exeffxxflr.exerlrfffl.exebbnhth.exepjdjv.exe1vdvv.exexlxrfff.exe3thhbb.exehtbbtt.exepjjdv.exevjpdv.exelxffxff.exebthhtb.exehbntht.exe9vpvp.exelllfrxr.exentnbth.exedjvpd.exexrlfrrl.exerlxllff.exebtnbhh.exevjpdv.exepdjdj.exexrrrrrr.exehnnnnn.exehbhbht.exe7ddvv.exerlflxxl.exepid process 2676 xffxrll.exe 1920 hhbhhn.exe 5100 pvjpp.exe 3556 llflfll.exe 1476 hnhhhh.exe 4244 dpvpp.exe 2708 xrxrlxr.exe 4744 xflxlfr.exe 2012 bbnhhh.exe 2844 1vpjj.exe 2768 fffrrxx.exe 3120 rlrrlrl.exe 4312 ntbbtt.exe 2284 jvvpj.exe 1800 djppj.exe 1620 ffllllf.exe 4552 fxlfffl.exe 4192 bttttt.exe 3668 jvpvd.exe 2724 vpvdd.exe 4232 rrllxxx.exe 1876 nhnhbh.exe 4444 hnbbtt.exe 2288 pjjjj.exe 4832 xxxfxxx.exe 3000 7bhhbb.exe 1952 5bhhhh.exe 2804 llrlrrx.exe 4868 llrrlll.exe 4984 pdjdp.exe 3732 frlllll.exe 4684 hhhhhh.exe 4532 9djjd.exe 1628 rffffll.exe 1236 1nbbnt.exe 4608 htttnb.exe 2016 ddjjd.exe 700 ffxxflr.exe 4328 rlrfffl.exe 4580 bbnhth.exe 4708 pjdjv.exe 1760 1vdvv.exe 3660 xlxrfff.exe 512 3thhbb.exe 4336 htbbtt.exe 3192 pjjdv.exe 2232 vjpdv.exe 3024 lxffxff.exe 2520 bthhtb.exe 2588 hbntht.exe 5096 9vpvp.exe 2668 lllfrxr.exe 912 ntnbth.exe 2312 djvpd.exe 2080 xrlfrrl.exe 1136 rlxllff.exe 1484 btnbhh.exe 3648 vjpdv.exe 3284 pdjdj.exe 2860 xrrrrrr.exe 776 hnnnnn.exe 5092 hbhbht.exe 4904 7ddvv.exe 436 rlflxxl.exe -
Processes:
resource yara_rule behavioral2/memory/1224-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2676-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1920-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1920-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3556-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1476-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4744-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4312-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2724-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1876-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2288-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3000-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2804-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4984-197-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5eef8191e12bcea07d3af23002803010_NeikiAnalytics.exexffxrll.exehhbhhn.exepvjpp.exellflfll.exehnhhhh.exedpvpp.exexrxrlxr.exexflxlfr.exebbnhhh.exe1vpjj.exefffrrxx.exerlrrlrl.exentbbtt.exejvvpj.exedjppj.exeffllllf.exefxlfffl.exebttttt.exejvpvd.exevpvdd.exerrllxxx.exedescription pid process target process PID 1224 wrote to memory of 2676 1224 5eef8191e12bcea07d3af23002803010_NeikiAnalytics.exe xffxrll.exe PID 1224 wrote to memory of 2676 1224 5eef8191e12bcea07d3af23002803010_NeikiAnalytics.exe xffxrll.exe PID 1224 wrote to memory of 2676 1224 5eef8191e12bcea07d3af23002803010_NeikiAnalytics.exe xffxrll.exe PID 2676 wrote to memory of 1920 2676 xffxrll.exe hhbhhn.exe PID 2676 wrote to memory of 1920 2676 xffxrll.exe hhbhhn.exe PID 2676 wrote to memory of 1920 2676 xffxrll.exe hhbhhn.exe PID 1920 wrote to memory of 5100 1920 hhbhhn.exe pvjpp.exe PID 1920 wrote to memory of 5100 1920 hhbhhn.exe pvjpp.exe PID 1920 wrote to memory of 5100 1920 hhbhhn.exe pvjpp.exe PID 5100 wrote to memory of 3556 5100 pvjpp.exe llflfll.exe PID 5100 wrote to memory of 3556 5100 pvjpp.exe llflfll.exe PID 5100 wrote to memory of 3556 5100 pvjpp.exe llflfll.exe PID 3556 wrote to memory of 1476 3556 llflfll.exe hnhhhh.exe PID 3556 wrote to memory of 1476 3556 llflfll.exe hnhhhh.exe PID 3556 wrote to memory of 1476 3556 llflfll.exe hnhhhh.exe PID 1476 wrote to memory of 4244 1476 hnhhhh.exe dpvpp.exe PID 1476 wrote to memory of 4244 1476 hnhhhh.exe dpvpp.exe PID 1476 wrote to memory of 4244 1476 hnhhhh.exe dpvpp.exe PID 4244 wrote to memory of 2708 4244 dpvpp.exe xrxrlxr.exe PID 4244 wrote to memory of 2708 4244 dpvpp.exe xrxrlxr.exe PID 4244 wrote to memory of 2708 4244 dpvpp.exe xrxrlxr.exe PID 2708 wrote to memory of 4744 2708 xrxrlxr.exe xflxlfr.exe PID 2708 wrote to memory of 4744 2708 xrxrlxr.exe xflxlfr.exe PID 2708 wrote to memory of 4744 2708 xrxrlxr.exe xflxlfr.exe PID 4744 wrote to memory of 2012 4744 xflxlfr.exe bbnhhh.exe PID 4744 wrote to memory of 2012 4744 xflxlfr.exe bbnhhh.exe PID 4744 wrote to memory of 2012 4744 xflxlfr.exe bbnhhh.exe PID 2012 wrote to memory of 2844 2012 bbnhhh.exe 1vpjj.exe PID 2012 wrote to memory of 2844 2012 bbnhhh.exe 1vpjj.exe PID 2012 wrote to memory of 2844 2012 bbnhhh.exe 1vpjj.exe PID 2844 wrote to memory of 2768 2844 1vpjj.exe fffrrxx.exe PID 2844 wrote to memory of 2768 2844 1vpjj.exe fffrrxx.exe PID 2844 wrote to memory of 2768 2844 1vpjj.exe fffrrxx.exe PID 2768 wrote to memory of 3120 2768 fffrrxx.exe rlrrlrl.exe PID 2768 wrote to memory of 3120 2768 fffrrxx.exe rlrrlrl.exe PID 2768 wrote to memory of 3120 2768 fffrrxx.exe rlrrlrl.exe PID 3120 wrote to memory of 4312 3120 rlrrlrl.exe ntbbtt.exe PID 3120 wrote to memory of 4312 3120 rlrrlrl.exe ntbbtt.exe PID 3120 wrote to memory of 4312 3120 rlrrlrl.exe ntbbtt.exe PID 4312 wrote to memory of 2284 4312 ntbbtt.exe jvvpj.exe PID 4312 wrote to memory of 2284 4312 ntbbtt.exe jvvpj.exe PID 4312 wrote to memory of 2284 4312 ntbbtt.exe jvvpj.exe PID 2284 wrote to memory of 1800 2284 jvvpj.exe djppj.exe PID 2284 wrote to memory of 1800 2284 jvvpj.exe djppj.exe PID 2284 wrote to memory of 1800 2284 jvvpj.exe djppj.exe PID 1800 wrote to memory of 1620 1800 djppj.exe ffllllf.exe PID 1800 wrote to memory of 1620 1800 djppj.exe ffllllf.exe PID 1800 wrote to memory of 1620 1800 djppj.exe ffllllf.exe PID 1620 wrote to memory of 4552 1620 ffllllf.exe fxlfffl.exe PID 1620 wrote to memory of 4552 1620 ffllllf.exe fxlfffl.exe PID 1620 wrote to memory of 4552 1620 ffllllf.exe fxlfffl.exe PID 4552 wrote to memory of 4192 4552 fxlfffl.exe bttttt.exe PID 4552 wrote to memory of 4192 4552 fxlfffl.exe bttttt.exe PID 4552 wrote to memory of 4192 4552 fxlfffl.exe bttttt.exe PID 4192 wrote to memory of 3668 4192 bttttt.exe jvpvd.exe PID 4192 wrote to memory of 3668 4192 bttttt.exe jvpvd.exe PID 4192 wrote to memory of 3668 4192 bttttt.exe jvpvd.exe PID 3668 wrote to memory of 2724 3668 jvpvd.exe vpvdd.exe PID 3668 wrote to memory of 2724 3668 jvpvd.exe vpvdd.exe PID 3668 wrote to memory of 2724 3668 jvpvd.exe vpvdd.exe PID 2724 wrote to memory of 4232 2724 vpvdd.exe rrllxxx.exe PID 2724 wrote to memory of 4232 2724 vpvdd.exe rrllxxx.exe PID 2724 wrote to memory of 4232 2724 vpvdd.exe rrllxxx.exe PID 4232 wrote to memory of 1876 4232 rrllxxx.exe nhnhbh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5eef8191e12bcea07d3af23002803010_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5eef8191e12bcea07d3af23002803010_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\xffxrll.exec:\xffxrll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\hhbhhn.exec:\hhbhhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\pvjpp.exec:\pvjpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\llflfll.exec:\llflfll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\hnhhhh.exec:\hnhhhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\dpvpp.exec:\dpvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
\??\c:\xrxrlxr.exec:\xrxrlxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\xflxlfr.exec:\xflxlfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\bbnhhh.exec:\bbnhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\1vpjj.exec:\1vpjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\fffrrxx.exec:\fffrrxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\rlrrlrl.exec:\rlrrlrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\ntbbtt.exec:\ntbbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\jvvpj.exec:\jvvpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\djppj.exec:\djppj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\ffllllf.exec:\ffllllf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\fxlfffl.exec:\fxlfffl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\bttttt.exec:\bttttt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\jvpvd.exec:\jvpvd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\vpvdd.exec:\vpvdd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\rrllxxx.exec:\rrllxxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\nhnhbh.exec:\nhnhbh.exe23⤵
- Executes dropped EXE
PID:1876 -
\??\c:\hnbbtt.exec:\hnbbtt.exe24⤵
- Executes dropped EXE
PID:4444 -
\??\c:\pjjjj.exec:\pjjjj.exe25⤵
- Executes dropped EXE
PID:2288 -
\??\c:\xxxfxxx.exec:\xxxfxxx.exe26⤵
- Executes dropped EXE
PID:4832 -
\??\c:\7bhhbb.exec:\7bhhbb.exe27⤵
- Executes dropped EXE
PID:3000 -
\??\c:\5bhhhh.exec:\5bhhhh.exe28⤵
- Executes dropped EXE
PID:1952 -
\??\c:\llrlrrx.exec:\llrlrrx.exe29⤵
- Executes dropped EXE
PID:2804 -
\??\c:\llrrlll.exec:\llrrlll.exe30⤵
- Executes dropped EXE
PID:4868 -
\??\c:\pdjdp.exec:\pdjdp.exe31⤵
- Executes dropped EXE
PID:4984 -
\??\c:\frlllll.exec:\frlllll.exe32⤵
- Executes dropped EXE
PID:3732 -
\??\c:\hhhhhh.exec:\hhhhhh.exe33⤵
- Executes dropped EXE
PID:4684 -
\??\c:\9djjd.exec:\9djjd.exe34⤵
- Executes dropped EXE
PID:4532 -
\??\c:\rffffll.exec:\rffffll.exe35⤵
- Executes dropped EXE
PID:1628 -
\??\c:\1nbbnt.exec:\1nbbnt.exe36⤵
- Executes dropped EXE
PID:1236 -
\??\c:\htttnb.exec:\htttnb.exe37⤵
- Executes dropped EXE
PID:4608 -
\??\c:\ddjjd.exec:\ddjjd.exe38⤵
- Executes dropped EXE
PID:2016 -
\??\c:\ffxxflr.exec:\ffxxflr.exe39⤵
- Executes dropped EXE
PID:700 -
\??\c:\rlrfffl.exec:\rlrfffl.exe40⤵
- Executes dropped EXE
PID:4328 -
\??\c:\bbnhth.exec:\bbnhth.exe41⤵
- Executes dropped EXE
PID:4580 -
\??\c:\pjdjv.exec:\pjdjv.exe42⤵
- Executes dropped EXE
PID:4708 -
\??\c:\1vdvv.exec:\1vdvv.exe43⤵
- Executes dropped EXE
PID:1760 -
\??\c:\xlxrfff.exec:\xlxrfff.exe44⤵
- Executes dropped EXE
PID:3660 -
\??\c:\3thhbb.exec:\3thhbb.exe45⤵
- Executes dropped EXE
PID:512 -
\??\c:\htbbtt.exec:\htbbtt.exe46⤵
- Executes dropped EXE
PID:4336 -
\??\c:\pjjdv.exec:\pjjdv.exe47⤵
- Executes dropped EXE
PID:3192 -
\??\c:\vjpdv.exec:\vjpdv.exe48⤵
- Executes dropped EXE
PID:2232 -
\??\c:\lxffxff.exec:\lxffxff.exe49⤵
- Executes dropped EXE
PID:3024 -
\??\c:\bthhtb.exec:\bthhtb.exe50⤵
- Executes dropped EXE
PID:2520 -
\??\c:\hbntht.exec:\hbntht.exe51⤵
- Executes dropped EXE
PID:2588 -
\??\c:\9vpvp.exec:\9vpvp.exe52⤵
- Executes dropped EXE
PID:5096 -
\??\c:\lllfrxr.exec:\lllfrxr.exe53⤵
- Executes dropped EXE
PID:2668 -
\??\c:\ntnbth.exec:\ntnbth.exe54⤵
- Executes dropped EXE
PID:912 -
\??\c:\djvpd.exec:\djvpd.exe55⤵
- Executes dropped EXE
PID:2312 -
\??\c:\xrlfrrl.exec:\xrlfrrl.exe56⤵
- Executes dropped EXE
PID:2080 -
\??\c:\rlxllff.exec:\rlxllff.exe57⤵
- Executes dropped EXE
PID:1136 -
\??\c:\btnbhh.exec:\btnbhh.exe58⤵
- Executes dropped EXE
PID:1484 -
\??\c:\vjpdv.exec:\vjpdv.exe59⤵
- Executes dropped EXE
PID:3648 -
\??\c:\pdjdj.exec:\pdjdj.exe60⤵
- Executes dropped EXE
PID:3284 -
\??\c:\xrrrrrr.exec:\xrrrrrr.exe61⤵
- Executes dropped EXE
PID:2860 -
\??\c:\hnnnnn.exec:\hnnnnn.exe62⤵
- Executes dropped EXE
PID:776 -
\??\c:\hbhbht.exec:\hbhbht.exe63⤵
- Executes dropped EXE
PID:5092 -
\??\c:\7ddvv.exec:\7ddvv.exe64⤵
- Executes dropped EXE
PID:4904 -
\??\c:\rlflxxl.exec:\rlflxxl.exe65⤵
- Executes dropped EXE
PID:436 -
\??\c:\btttnn.exec:\btttnn.exe66⤵PID:3684
-
\??\c:\7tbttt.exec:\7tbttt.exe67⤵PID:2512
-
\??\c:\vppjj.exec:\vppjj.exe68⤵PID:4456
-
\??\c:\xxxlfrl.exec:\xxxlfrl.exe69⤵PID:1756
-
\??\c:\nnhhbh.exec:\nnhhbh.exe70⤵PID:408
-
\??\c:\5jpjp.exec:\5jpjp.exe71⤵PID:2688
-
\??\c:\jvjdd.exec:\jvjdd.exe72⤵PID:384
-
\??\c:\lxlxrff.exec:\lxlxrff.exe73⤵PID:5008
-
\??\c:\fxrllff.exec:\fxrllff.exe74⤵PID:4508
-
\??\c:\hbhhtt.exec:\hbhhtt.exe75⤵PID:1636
-
\??\c:\5jpjj.exec:\5jpjj.exe76⤵PID:4976
-
\??\c:\dppdv.exec:\dppdv.exe77⤵PID:2804
-
\??\c:\lflrlrl.exec:\lflrlrl.exe78⤵PID:4340
-
\??\c:\btnnnn.exec:\btnnnn.exe79⤵PID:2324
-
\??\c:\nbtntt.exec:\nbtntt.exe80⤵PID:2412
-
\??\c:\3jpjd.exec:\3jpjd.exe81⤵PID:3804
-
\??\c:\vpvvp.exec:\vpvvp.exe82⤵PID:4360
-
\??\c:\9lxrxlr.exec:\9lxrxlr.exe83⤵PID:3300
-
\??\c:\frrxxxr.exec:\frrxxxr.exe84⤵PID:4996
-
\??\c:\7nhhhn.exec:\7nhhhn.exe85⤵PID:740
-
\??\c:\vvdpp.exec:\vvdpp.exe86⤵PID:3060
-
\??\c:\3lflxff.exec:\3lflxff.exe87⤵PID:3212
-
\??\c:\bbhhhn.exec:\bbhhhn.exe88⤵PID:1120
-
\??\c:\ddddv.exec:\ddddv.exe89⤵PID:4352
-
\??\c:\rllfxrl.exec:\rllfxrl.exe90⤵PID:3500
-
\??\c:\fxrxrrl.exec:\fxrxrrl.exe91⤵PID:2676
-
\??\c:\3nbbtt.exec:\3nbbtt.exe92⤵PID:4128
-
\??\c:\ppvpj.exec:\ppvpj.exe93⤵PID:1920
-
\??\c:\9xrrllr.exec:\9xrrllr.exe94⤵PID:3584
-
\??\c:\nbbnnn.exec:\nbbnnn.exe95⤵PID:2944
-
\??\c:\pvjjd.exec:\pvjjd.exe96⤵PID:4512
-
\??\c:\lxxrllf.exec:\lxxrllf.exe97⤵PID:3292
-
\??\c:\bbtbtb.exec:\bbtbtb.exe98⤵PID:3468
-
\??\c:\bbnnbh.exec:\bbnnbh.exe99⤵PID:2884
-
\??\c:\dpvpp.exec:\dpvpp.exe100⤵PID:3836
-
\??\c:\rrrrrxl.exec:\rrrrrxl.exe101⤵PID:4744
-
\??\c:\xlxxxlr.exec:\xlxxxlr.exe102⤵PID:4960
-
\??\c:\hbhtht.exec:\hbhtht.exe103⤵PID:2844
-
\??\c:\bthtbb.exec:\bthtbb.exe104⤵PID:1324
-
\??\c:\dvvpj.exec:\dvvpj.exe105⤵PID:860
-
\??\c:\fxfffrf.exec:\fxfffrf.exe106⤵PID:556
-
\??\c:\ffxxflf.exec:\ffxxflf.exe107⤵PID:4140
-
\??\c:\tbtnhh.exec:\tbtnhh.exe108⤵PID:2284
-
\??\c:\btbbtn.exec:\btbbtn.exe109⤵PID:2644
-
\??\c:\vpvpd.exec:\vpvpd.exe110⤵PID:5004
-
\??\c:\7xfxrrf.exec:\7xfxrrf.exe111⤵PID:4192
-
\??\c:\rrfxrxf.exec:\rrfxrxf.exe112⤵PID:5048
-
\??\c:\bbttht.exec:\bbttht.exe113⤵PID:436
-
\??\c:\7rrrrxr.exec:\7rrrrxr.exe114⤵PID:4460
-
\??\c:\rxxxrrl.exec:\rxxxrrl.exe115⤵PID:1836
-
\??\c:\btbbth.exec:\btbbth.exe116⤵PID:4948
-
\??\c:\bhbtnt.exec:\bhbtnt.exe117⤵PID:4224
-
\??\c:\hbbbnn.exec:\hbbbnn.exe118⤵PID:1640
-
\??\c:\jvppj.exec:\jvppj.exe119⤵PID:440
-
\??\c:\jdvjd.exec:\jdvjd.exe120⤵PID:5052
-
\??\c:\rrrrllf.exec:\rrrrllf.exe121⤵PID:624
-
\??\c:\bhnhbb.exec:\bhnhbb.exe122⤵PID:3520
-
\??\c:\nbtbtt.exec:\nbtbtt.exe123⤵PID:3512
-
\??\c:\dpppd.exec:\dpppd.exe124⤵PID:3044
-
\??\c:\lxlxrxx.exec:\lxlxrxx.exe125⤵PID:4124
-
\??\c:\9lfxffl.exec:\9lfxffl.exe126⤵PID:3312
-
\??\c:\tbtbhh.exec:\tbtbhh.exe127⤵PID:4540
-
\??\c:\9llrrrf.exec:\9llrrrf.exe128⤵PID:2808
-
\??\c:\xrxfxfl.exec:\xrxfxfl.exe129⤵PID:2240
-
\??\c:\1hbnnn.exec:\1hbnnn.exe130⤵PID:4788
-
\??\c:\9vppp.exec:\9vppp.exe131⤵PID:4820
-
\??\c:\vpjjv.exec:\vpjjv.exe132⤵PID:1236
-
\??\c:\xxxrflf.exec:\xxxrflf.exe133⤵PID:628
-
\??\c:\hntbhn.exec:\hntbhn.exe134⤵PID:5040
-
\??\c:\7bbtnh.exec:\7bbtnh.exe135⤵PID:700
-
\??\c:\1pvpv.exec:\1pvpv.exe136⤵PID:4352
-
\??\c:\ffrffff.exec:\ffrffff.exe137⤵PID:1892
-
\??\c:\lllllll.exec:\lllllll.exe138⤵PID:756
-
\??\c:\nbhhhh.exec:\nbhhhh.exe139⤵PID:512
-
\??\c:\nnbnhh.exec:\nnbnhh.exe140⤵PID:3768
-
\??\c:\vjjjd.exec:\vjjjd.exe141⤵PID:4940
-
\??\c:\ddvvv.exec:\ddvvv.exe142⤵PID:372
-
\??\c:\pvjvj.exec:\pvjvj.exe143⤵PID:3292
-
\??\c:\xxffxff.exec:\xxffxff.exe144⤵PID:552
-
\??\c:\fxxfxfx.exec:\fxxfxfx.exe145⤵PID:412
-
\??\c:\hhttnn.exec:\hhttnn.exe146⤵PID:3796
-
\??\c:\pjdvp.exec:\pjdvp.exe147⤵PID:1996
-
\??\c:\xrrllll.exec:\xrrllll.exe148⤵PID:2312
-
\??\c:\7nnnhh.exec:\7nnnhh.exe149⤵PID:1136
-
\??\c:\hbnhbt.exec:\hbnhbt.exe150⤵PID:1732
-
\??\c:\dddvd.exec:\dddvd.exe151⤵PID:4908
-
\??\c:\vjjpp.exec:\vjjpp.exe152⤵PID:1800
-
\??\c:\7xrlflx.exec:\7xrlflx.exe153⤵PID:2284
-
\??\c:\rrxrffx.exec:\rrxrffx.exe154⤵PID:3268
-
\??\c:\1tbttn.exec:\1tbttn.exe155⤵PID:5004
-
\??\c:\tnttnn.exec:\tnttnn.exe156⤵PID:3668
-
\??\c:\3vpdp.exec:\3vpdp.exe157⤵PID:3440
-
\??\c:\xxflrlr.exec:\xxflrlr.exe158⤵PID:4472
-
\??\c:\lffffff.exec:\lffffff.exe159⤵PID:4884
-
\??\c:\tnnhhh.exec:\tnnhhh.exe160⤵PID:4492
-
\??\c:\ppjpp.exec:\ppjpp.exe161⤵PID:676
-
\??\c:\vvvjj.exec:\vvvjj.exe162⤵PID:2196
-
\??\c:\fflllxf.exec:\fflllxf.exe163⤵PID:4440
-
\??\c:\hntttt.exec:\hntttt.exe164⤵PID:4824
-
\??\c:\ttbbth.exec:\ttbbth.exe165⤵PID:4508
-
\??\c:\jddvv.exec:\jddvv.exe166⤵PID:1636
-
\??\c:\9rxrlff.exec:\9rxrlff.exe167⤵PID:3520
-
\??\c:\rrrffxr.exec:\rrrffxr.exe168⤵PID:4868
-
\??\c:\1hhhhn.exec:\1hhhhn.exe169⤵PID:2168
-
\??\c:\vpjdd.exec:\vpjdd.exe170⤵PID:3044
-
\??\c:\jdpjj.exec:\jdpjj.exe171⤵PID:4124
-
\??\c:\lxlfxxx.exec:\lxlfxxx.exe172⤵PID:3312
-
\??\c:\fxrrlll.exec:\fxrrlll.exe173⤵PID:4540
-
\??\c:\tnhtnn.exec:\tnhtnn.exe174⤵PID:2808
-
\??\c:\nhnnnt.exec:\nhnnnt.exe175⤵PID:2240
-
\??\c:\pdddv.exec:\pdddv.exe176⤵PID:212
-
\??\c:\vppjd.exec:\vppjd.exe177⤵PID:5080
-
\??\c:\lfrlllf.exec:\lfrlllf.exe178⤵PID:3232
-
\??\c:\lflflff.exec:\lflflff.exe179⤵PID:3212
-
\??\c:\hbbnnb.exec:\hbbnnb.exe180⤵PID:3032
-
\??\c:\nhbtnh.exec:\nhbtnh.exe181⤵PID:1696
-
\??\c:\jvddp.exec:\jvddp.exe182⤵PID:4628
-
\??\c:\dvvvj.exec:\dvvvj.exe183⤵PID:756
-
\??\c:\xrlfllx.exec:\xrlfllx.exe184⤵PID:512
-
\??\c:\xflrxxf.exec:\xflrxxf.exe185⤵PID:3192
-
\??\c:\ttnnnn.exec:\ttnnnn.exe186⤵PID:1452
-
\??\c:\nttnbb.exec:\nttnbb.exe187⤵PID:2708
-
\??\c:\pddpj.exec:\pddpj.exe188⤵PID:4744
-
\??\c:\fxlrxlx.exec:\fxlrxlx.exe189⤵PID:2880
-
\??\c:\lxfrfrl.exec:\lxfrfrl.exe190⤵PID:1996
-
\??\c:\5xxlffr.exec:\5xxlffr.exe191⤵PID:4272
-
\??\c:\bttnnn.exec:\bttnnn.exe192⤵PID:2544
-
\??\c:\hnnntb.exec:\hnnntb.exe193⤵PID:5112
-
\??\c:\jppjd.exec:\jppjd.exe194⤵PID:1632
-
\??\c:\jpvvv.exec:\jpvvv.exe195⤵PID:4544
-
\??\c:\llxxflr.exec:\llxxflr.exe196⤵PID:5020
-
\??\c:\thnntt.exec:\thnntt.exe197⤵PID:1032
-
\??\c:\nhnnnt.exec:\nhnnnt.exe198⤵PID:4472
-
\??\c:\hhbtbb.exec:\hhbtbb.exe199⤵PID:4796
-
\??\c:\jddvp.exec:\jddvp.exe200⤵PID:4816
-
\??\c:\vpvpp.exec:\vpvpp.exe201⤵PID:2688
-
\??\c:\7ffxxll.exec:\7ffxxll.exe202⤵PID:4372
-
\??\c:\9nhhbb.exec:\9nhhbb.exe203⤵PID:5008
-
\??\c:\1btnnt.exec:\1btnnt.exe204⤵PID:3000
-
\??\c:\jjjdp.exec:\jjjdp.exe205⤵PID:3304
-
\??\c:\xxxlrlr.exec:\xxxlrlr.exe206⤵PID:4972
-
\??\c:\nhbbtb.exec:\nhbbtb.exe207⤵PID:4524
-
\??\c:\nhtnht.exec:\nhtnht.exe208⤵PID:2168
-
\??\c:\vpppj.exec:\vpppj.exe209⤵PID:3116
-
\??\c:\1jppj.exec:\1jppj.exe210⤵PID:5044
-
\??\c:\5rfllll.exec:\5rfllll.exe211⤵PID:4936
-
\??\c:\fxxfxff.exec:\fxxfxff.exe212⤵PID:2128
-
\??\c:\hbnnbn.exec:\hbnnbn.exe213⤵PID:1564
-
\??\c:\hnttnt.exec:\hnttnt.exe214⤵PID:2624
-
\??\c:\vpddd.exec:\vpddd.exe215⤵PID:4776
-
\??\c:\vjpjd.exec:\vjpjd.exe216⤵PID:1760
-
\??\c:\rllflll.exec:\rllflll.exe217⤵PID:2744
-
\??\c:\hntnhh.exec:\hntnhh.exe218⤵PID:628
-
\??\c:\3tbbhh.exec:\3tbbhh.exe219⤵PID:3232
-
\??\c:\vddvp.exec:\vddvp.exe220⤵PID:3212
-
\??\c:\pdvjj.exec:\pdvjj.exe221⤵PID:3660
-
\??\c:\rlrlfll.exec:\rlrlfll.exe222⤵PID:1696
-
\??\c:\tbtttt.exec:\tbtttt.exe223⤵PID:4628
-
\??\c:\nbhhbb.exec:\nbhhbb.exe224⤵PID:744
-
\??\c:\vjvdv.exec:\vjvdv.exe225⤵PID:4136
-
\??\c:\ppppj.exec:\ppppj.exe226⤵PID:3860
-
\??\c:\xrxxxfl.exec:\xrxxxfl.exe227⤵PID:2912
-
\??\c:\llfllll.exec:\llfllll.exe228⤵PID:1452
-
\??\c:\nhnttb.exec:\nhnttb.exe229⤵PID:2708
-
\??\c:\tbbtnn.exec:\tbbtnn.exe230⤵PID:812
-
\??\c:\jpjpv.exec:\jpjpv.exe231⤵PID:2408
-
\??\c:\jpddd.exec:\jpddd.exe232⤵PID:1996
-
\??\c:\frxflxx.exec:\frxflxx.exe233⤵PID:1368
-
\??\c:\lfrrxxx.exec:\lfrrxxx.exe234⤵PID:2300
-
\??\c:\nhntnt.exec:\nhntnt.exe235⤵PID:5112
-
\??\c:\nbbbtb.exec:\nbbbtb.exe236⤵PID:4192
-
\??\c:\dddvv.exec:\dddvv.exe237⤵PID:3684
-
\??\c:\jvddp.exec:\jvddp.exe238⤵PID:3764
-
\??\c:\xxfxrrl.exec:\xxfxrrl.exe239⤵PID:1876
-
\??\c:\fffxlll.exec:\fffxlll.exe240⤵PID:4948
-
\??\c:\bbbbbb.exec:\bbbbbb.exe241⤵PID:676
-
\??\c:\hnbntn.exec:\hnbntn.exe242⤵PID:1880