Analysis
-
max time kernel
139s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 05:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7c8553c5fe13cb4407280f2984f72020_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
7c8553c5fe13cb4407280f2984f72020_NeikiAnalytics.exe
-
Size
55KB
-
MD5
7c8553c5fe13cb4407280f2984f72020
-
SHA1
dc730967018e05e8702b688d0c1197d78dbad1a2
-
SHA256
35ba9c7f281972ff6123940f8dc9c2446cb0358768b638e04cbd9d8f5dd18c22
-
SHA512
62be8b2d6553244f235f12761ffedc18d4dd1e116acf7575397fc22aa729742cdb35026ba34842f7cfe239ef31c21093130a986233ee3d08e2fb5cdb0e77f8d8
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIfEVA:ymb3NkkiQ3mdBjFIn
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral2/memory/3392-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1704-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/920-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/776-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2932-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3296-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/924-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4236-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2940-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1108-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3792-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2096-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1424-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1476-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2072-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5088-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2000-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4452-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4708-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3440-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
7nhnnt.exevpvpj.exelxxlxxf.exehtbnbh.exehnnttb.exedpppj.exelrrfllx.exethtnnn.exedpjpp.exelflxrrr.exentbbtb.exepddjv.exepjjjd.exexrrlllr.exe7htnnn.exedpvvj.exedjpjj.exefxxllll.exethbbbh.exebnnnhh.exepdjpp.exedddvv.exeffrxxll.exetnhhhh.exenbbtnb.exeppppj.exevpppj.exebhhhbb.exenhhhbh.exepdpjd.exexxffrfl.exellffrlf.exehttthb.exedpdjp.exerxrflxl.exerlrlfxl.exebttbbb.exepjdjv.exerlflxlr.exebnnnhh.exe7thhhh.exevpjvp.exevvpjv.exelrllffx.exe7nnhbt.exepjjvv.exe3jpvv.exexxrxfrr.exebnhnth.exevpjpv.exejddvp.exefrlxlxx.exehnttnh.exe7nbbhn.exe1vppj.exedpjvp.exexrrxrrx.exebhhbbb.exebttnbb.exepjpjv.exe7vvjv.exerlrrllr.exexxxrrll.exebnnntt.exepid process 1704 7nhnnt.exe 920 vpvpj.exe 548 lxxlxxf.exe 776 htbnbh.exe 748 hnnttb.exe 2904 dpppj.exe 2932 lrrfllx.exe 2184 thtnnn.exe 3296 dpjpp.exe 924 lflxrrr.exe 4236 ntbbtb.exe 1008 pddjv.exe 2940 pjjjd.exe 3232 xrrlllr.exe 1108 7htnnn.exe 4608 dpvvj.exe 3792 djpjj.exe 2540 fxxllll.exe 2096 thbbbh.exe 1424 bnnnhh.exe 1476 pdjpp.exe 1988 dddvv.exe 2072 ffrxxll.exe 5088 tnhhhh.exe 2000 nbbtnb.exe 3752 ppppj.exe 2944 vpppj.exe 4452 bhhhbb.exe 4708 nhhhbh.exe 3440 pdpjd.exe 4060 xxffrfl.exe 964 llffrlf.exe 3264 httthb.exe 3580 dpdjp.exe 3120 rxrflxl.exe 116 rlrlfxl.exe 2268 bttbbb.exe 4364 pjdjv.exe 2980 rlflxlr.exe 1960 bnnnhh.exe 920 7thhhh.exe 4804 vpjvp.exe 776 vvpjv.exe 2528 lrllffx.exe 672 7nnhbt.exe 4848 pjjvv.exe 3992 3jpvv.exe 900 xxrxfrr.exe 4884 bnhnth.exe 3984 vpjpv.exe 4552 jddvp.exe 180 frlxlxx.exe 1700 hnttnh.exe 1952 7nbbhn.exe 916 1vppj.exe 4932 dpjvp.exe 4868 xrrxrrx.exe 2468 bhhbbb.exe 4464 bttnbb.exe 632 pjpjv.exe 448 7vvjv.exe 344 rlrrllr.exe 1588 xxxrrll.exe 1476 bnnntt.exe -
Processes:
resource yara_rule behavioral2/memory/3392-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/920-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/776-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2932-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2932-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2184-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2184-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3296-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/924-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4236-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2940-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1108-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3792-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2096-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1424-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1476-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5088-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4452-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4708-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3440-196-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7c8553c5fe13cb4407280f2984f72020_NeikiAnalytics.exe7nhnnt.exevpvpj.exelxxlxxf.exehtbnbh.exehnnttb.exedpppj.exelrrfllx.exethtnnn.exedpjpp.exelflxrrr.exentbbtb.exepddjv.exepjjjd.exexrrlllr.exe7htnnn.exedpvvj.exedjpjj.exefxxllll.exethbbbh.exebnnnhh.exepdjpp.exedescription pid process target process PID 3392 wrote to memory of 1704 3392 7c8553c5fe13cb4407280f2984f72020_NeikiAnalytics.exe 7nhnnt.exe PID 3392 wrote to memory of 1704 3392 7c8553c5fe13cb4407280f2984f72020_NeikiAnalytics.exe 7nhnnt.exe PID 3392 wrote to memory of 1704 3392 7c8553c5fe13cb4407280f2984f72020_NeikiAnalytics.exe 7nhnnt.exe PID 1704 wrote to memory of 920 1704 7nhnnt.exe vpvpj.exe PID 1704 wrote to memory of 920 1704 7nhnnt.exe vpvpj.exe PID 1704 wrote to memory of 920 1704 7nhnnt.exe vpvpj.exe PID 920 wrote to memory of 548 920 vpvpj.exe lxxlxxf.exe PID 920 wrote to memory of 548 920 vpvpj.exe lxxlxxf.exe PID 920 wrote to memory of 548 920 vpvpj.exe lxxlxxf.exe PID 548 wrote to memory of 776 548 lxxlxxf.exe htbnbh.exe PID 548 wrote to memory of 776 548 lxxlxxf.exe htbnbh.exe PID 548 wrote to memory of 776 548 lxxlxxf.exe htbnbh.exe PID 776 wrote to memory of 748 776 htbnbh.exe hnnttb.exe PID 776 wrote to memory of 748 776 htbnbh.exe hnnttb.exe PID 776 wrote to memory of 748 776 htbnbh.exe hnnttb.exe PID 748 wrote to memory of 2904 748 hnnttb.exe dpppj.exe PID 748 wrote to memory of 2904 748 hnnttb.exe dpppj.exe PID 748 wrote to memory of 2904 748 hnnttb.exe dpppj.exe PID 2904 wrote to memory of 2932 2904 dpppj.exe lrrfllx.exe PID 2904 wrote to memory of 2932 2904 dpppj.exe lrrfllx.exe PID 2904 wrote to memory of 2932 2904 dpppj.exe lrrfllx.exe PID 2932 wrote to memory of 2184 2932 lrrfllx.exe thtnnn.exe PID 2932 wrote to memory of 2184 2932 lrrfllx.exe thtnnn.exe PID 2932 wrote to memory of 2184 2932 lrrfllx.exe thtnnn.exe PID 2184 wrote to memory of 3296 2184 thtnnn.exe dpjpp.exe PID 2184 wrote to memory of 3296 2184 thtnnn.exe dpjpp.exe PID 2184 wrote to memory of 3296 2184 thtnnn.exe dpjpp.exe PID 3296 wrote to memory of 924 3296 dpjpp.exe lflxrrr.exe PID 3296 wrote to memory of 924 3296 dpjpp.exe lflxrrr.exe PID 3296 wrote to memory of 924 3296 dpjpp.exe lflxrrr.exe PID 924 wrote to memory of 4236 924 lflxrrr.exe ntbbtb.exe PID 924 wrote to memory of 4236 924 lflxrrr.exe ntbbtb.exe PID 924 wrote to memory of 4236 924 lflxrrr.exe ntbbtb.exe PID 4236 wrote to memory of 1008 4236 ntbbtb.exe pddjv.exe PID 4236 wrote to memory of 1008 4236 ntbbtb.exe pddjv.exe PID 4236 wrote to memory of 1008 4236 ntbbtb.exe pddjv.exe PID 1008 wrote to memory of 2940 1008 pddjv.exe pjjjd.exe PID 1008 wrote to memory of 2940 1008 pddjv.exe pjjjd.exe PID 1008 wrote to memory of 2940 1008 pddjv.exe pjjjd.exe PID 2940 wrote to memory of 3232 2940 pjjjd.exe xrrlllr.exe PID 2940 wrote to memory of 3232 2940 pjjjd.exe xrrlllr.exe PID 2940 wrote to memory of 3232 2940 pjjjd.exe xrrlllr.exe PID 3232 wrote to memory of 1108 3232 xrrlllr.exe 7htnnn.exe PID 3232 wrote to memory of 1108 3232 xrrlllr.exe 7htnnn.exe PID 3232 wrote to memory of 1108 3232 xrrlllr.exe 7htnnn.exe PID 1108 wrote to memory of 4608 1108 7htnnn.exe dpvvj.exe PID 1108 wrote to memory of 4608 1108 7htnnn.exe dpvvj.exe PID 1108 wrote to memory of 4608 1108 7htnnn.exe dpvvj.exe PID 4608 wrote to memory of 3792 4608 dpvvj.exe djpjj.exe PID 4608 wrote to memory of 3792 4608 dpvvj.exe djpjj.exe PID 4608 wrote to memory of 3792 4608 dpvvj.exe djpjj.exe PID 3792 wrote to memory of 2540 3792 djpjj.exe fxxllll.exe PID 3792 wrote to memory of 2540 3792 djpjj.exe fxxllll.exe PID 3792 wrote to memory of 2540 3792 djpjj.exe fxxllll.exe PID 2540 wrote to memory of 2096 2540 fxxllll.exe thbbbh.exe PID 2540 wrote to memory of 2096 2540 fxxllll.exe thbbbh.exe PID 2540 wrote to memory of 2096 2540 fxxllll.exe thbbbh.exe PID 2096 wrote to memory of 1424 2096 thbbbh.exe bnnnhh.exe PID 2096 wrote to memory of 1424 2096 thbbbh.exe bnnnhh.exe PID 2096 wrote to memory of 1424 2096 thbbbh.exe bnnnhh.exe PID 1424 wrote to memory of 1476 1424 bnnnhh.exe pdjpp.exe PID 1424 wrote to memory of 1476 1424 bnnnhh.exe pdjpp.exe PID 1424 wrote to memory of 1476 1424 bnnnhh.exe pdjpp.exe PID 1476 wrote to memory of 1988 1476 pdjpp.exe dddvv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c8553c5fe13cb4407280f2984f72020_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7c8553c5fe13cb4407280f2984f72020_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\7nhnnt.exec:\7nhnnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\vpvpj.exec:\vpvpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\lxxlxxf.exec:\lxxlxxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\htbnbh.exec:\htbnbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\hnnttb.exec:\hnnttb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\dpppj.exec:\dpppj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\lrrfllx.exec:\lrrfllx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\thtnnn.exec:\thtnnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\dpjpp.exec:\dpjpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
\??\c:\lflxrrr.exec:\lflxrrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\ntbbtb.exec:\ntbbtb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
\??\c:\pddjv.exec:\pddjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\pjjjd.exec:\pjjjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\xrrlllr.exec:\xrrlllr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\7htnnn.exec:\7htnnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\dpvvj.exec:\dpvvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\djpjj.exec:\djpjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
\??\c:\fxxllll.exec:\fxxllll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\thbbbh.exec:\thbbbh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\bnnnhh.exec:\bnnnhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\pdjpp.exec:\pdjpp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\dddvv.exec:\dddvv.exe23⤵
- Executes dropped EXE
PID:1988 -
\??\c:\ffrxxll.exec:\ffrxxll.exe24⤵
- Executes dropped EXE
PID:2072 -
\??\c:\tnhhhh.exec:\tnhhhh.exe25⤵
- Executes dropped EXE
PID:5088 -
\??\c:\nbbtnb.exec:\nbbtnb.exe26⤵
- Executes dropped EXE
PID:2000 -
\??\c:\ppppj.exec:\ppppj.exe27⤵
- Executes dropped EXE
PID:3752 -
\??\c:\vpppj.exec:\vpppj.exe28⤵
- Executes dropped EXE
PID:2944 -
\??\c:\bhhhbb.exec:\bhhhbb.exe29⤵
- Executes dropped EXE
PID:4452 -
\??\c:\nhhhbh.exec:\nhhhbh.exe30⤵
- Executes dropped EXE
PID:4708 -
\??\c:\pdpjd.exec:\pdpjd.exe31⤵
- Executes dropped EXE
PID:3440 -
\??\c:\xxffrfl.exec:\xxffrfl.exe32⤵
- Executes dropped EXE
PID:4060 -
\??\c:\llffrlf.exec:\llffrlf.exe33⤵
- Executes dropped EXE
PID:964 -
\??\c:\httthb.exec:\httthb.exe34⤵
- Executes dropped EXE
PID:3264 -
\??\c:\dpdjp.exec:\dpdjp.exe35⤵
- Executes dropped EXE
PID:3580 -
\??\c:\rxrflxl.exec:\rxrflxl.exe36⤵
- Executes dropped EXE
PID:3120 -
\??\c:\rlrlfxl.exec:\rlrlfxl.exe37⤵
- Executes dropped EXE
PID:116 -
\??\c:\bttbbb.exec:\bttbbb.exe38⤵
- Executes dropped EXE
PID:2268 -
\??\c:\pjdjv.exec:\pjdjv.exe39⤵
- Executes dropped EXE
PID:4364 -
\??\c:\rlflxlr.exec:\rlflxlr.exe40⤵
- Executes dropped EXE
PID:2980 -
\??\c:\bnnnhh.exec:\bnnnhh.exe41⤵
- Executes dropped EXE
PID:1960 -
\??\c:\7thhhh.exec:\7thhhh.exe42⤵
- Executes dropped EXE
PID:920 -
\??\c:\vpjvp.exec:\vpjvp.exe43⤵
- Executes dropped EXE
PID:4804 -
\??\c:\vvpjv.exec:\vvpjv.exe44⤵
- Executes dropped EXE
PID:776 -
\??\c:\lrllffx.exec:\lrllffx.exe45⤵
- Executes dropped EXE
PID:2528 -
\??\c:\7nnhbt.exec:\7nnhbt.exe46⤵
- Executes dropped EXE
PID:672 -
\??\c:\pjjvv.exec:\pjjvv.exe47⤵
- Executes dropped EXE
PID:4848 -
\??\c:\3jpvv.exec:\3jpvv.exe48⤵
- Executes dropped EXE
PID:3992 -
\??\c:\xxrxfrr.exec:\xxrxfrr.exe49⤵
- Executes dropped EXE
PID:900 -
\??\c:\bnhnth.exec:\bnhnth.exe50⤵
- Executes dropped EXE
PID:4884 -
\??\c:\vpjpv.exec:\vpjpv.exe51⤵
- Executes dropped EXE
PID:3984 -
\??\c:\jddvp.exec:\jddvp.exe52⤵
- Executes dropped EXE
PID:4552 -
\??\c:\frlxlxx.exec:\frlxlxx.exe53⤵
- Executes dropped EXE
PID:180 -
\??\c:\hnttnh.exec:\hnttnh.exe54⤵
- Executes dropped EXE
PID:1700 -
\??\c:\7nbbhn.exec:\7nbbhn.exe55⤵
- Executes dropped EXE
PID:1952 -
\??\c:\1vppj.exec:\1vppj.exe56⤵
- Executes dropped EXE
PID:916 -
\??\c:\dpjvp.exec:\dpjvp.exe57⤵
- Executes dropped EXE
PID:4932 -
\??\c:\xrrxrrx.exec:\xrrxrrx.exe58⤵
- Executes dropped EXE
PID:4868 -
\??\c:\bhhbbb.exec:\bhhbbb.exe59⤵
- Executes dropped EXE
PID:2468 -
\??\c:\bttnbb.exec:\bttnbb.exe60⤵
- Executes dropped EXE
PID:4464 -
\??\c:\pjpjv.exec:\pjpjv.exe61⤵
- Executes dropped EXE
PID:632 -
\??\c:\7vvjv.exec:\7vvjv.exe62⤵
- Executes dropped EXE
PID:448 -
\??\c:\rlrrllr.exec:\rlrrllr.exe63⤵
- Executes dropped EXE
PID:344 -
\??\c:\xxxrrll.exec:\xxxrrll.exe64⤵
- Executes dropped EXE
PID:1588 -
\??\c:\bnnntt.exec:\bnnntt.exe65⤵
- Executes dropped EXE
PID:1476 -
\??\c:\ttttnb.exec:\ttttnb.exe66⤵PID:4860
-
\??\c:\5ppjv.exec:\5ppjv.exe67⤵PID:4332
-
\??\c:\rflrffx.exec:\rflrffx.exe68⤵PID:516
-
\??\c:\rlflffx.exec:\rlflffx.exe69⤵PID:5108
-
\??\c:\bbttnn.exec:\bbttnn.exe70⤵PID:3644
-
\??\c:\ppppv.exec:\ppppv.exe71⤵PID:3688
-
\??\c:\vpvpj.exec:\vpvpj.exe72⤵PID:2336
-
\??\c:\jdvvv.exec:\jdvvv.exe73⤵PID:3480
-
\??\c:\frxllfr.exec:\frxllfr.exe74⤵PID:3924
-
\??\c:\xxrxxlf.exec:\xxrxxlf.exe75⤵PID:3428
-
\??\c:\btnbnh.exec:\btnbnh.exe76⤵PID:3200
-
\??\c:\hbnbtn.exec:\hbnbtn.exe77⤵PID:3852
-
\??\c:\dpvpp.exec:\dpvpp.exe78⤵PID:4264
-
\??\c:\xlllxxx.exec:\xlllxxx.exe79⤵PID:2872
-
\??\c:\llffffx.exec:\llffffx.exe80⤵PID:4524
-
\??\c:\httttt.exec:\httttt.exe81⤵PID:4648
-
\??\c:\djppp.exec:\djppp.exe82⤵PID:4436
-
\??\c:\djpjj.exec:\djpjj.exe83⤵PID:3392
-
\??\c:\5frfllx.exec:\5frfllx.exe84⤵PID:2364
-
\??\c:\5nbtnn.exec:\5nbtnn.exe85⤵PID:2740
-
\??\c:\hhtnhh.exec:\hhtnhh.exe86⤵PID:4204
-
\??\c:\3ppdv.exec:\3ppdv.exe87⤵PID:548
-
\??\c:\1fxxrff.exec:\1fxxrff.exe88⤵PID:1436
-
\??\c:\httbtt.exec:\httbtt.exe89⤵PID:2476
-
\??\c:\7vdjd.exec:\7vdjd.exe90⤵PID:2116
-
\??\c:\vdjdv.exec:\vdjdv.exe91⤵PID:672
-
\??\c:\xxrrlrl.exec:\xxrrlrl.exe92⤵PID:4848
-
\??\c:\xxfxxxx.exec:\xxfxxxx.exe93⤵PID:5072
-
\??\c:\hbbnbb.exec:\hbbnbb.exe94⤵PID:3692
-
\??\c:\rfffrrl.exec:\rfffrrl.exe95⤵PID:3720
-
\??\c:\xxflfxl.exec:\xxflfxl.exe96⤵PID:1840
-
\??\c:\thbtnh.exec:\thbtnh.exe97⤵PID:4728
-
\??\c:\5pjjv.exec:\5pjjv.exe98⤵PID:3112
-
\??\c:\3llffxr.exec:\3llffxr.exe99⤵PID:3660
-
\??\c:\rlrrrlf.exec:\rlrrrlf.exe100⤵PID:3160
-
\??\c:\nbbbbh.exec:\nbbbbh.exe101⤵PID:4356
-
\??\c:\lxrxxrr.exec:\lxrxxrr.exe102⤵PID:4580
-
\??\c:\5rrlffx.exec:\5rrlffx.exe103⤵PID:4296
-
\??\c:\9hhbtn.exec:\9hhbtn.exe104⤵PID:3268
-
\??\c:\ttthbt.exec:\ttthbt.exe105⤵PID:632
-
\??\c:\vddpd.exec:\vddpd.exe106⤵PID:64
-
\??\c:\llfrfxl.exec:\llfrfxl.exe107⤵PID:1056
-
\??\c:\ffxrffr.exec:\ffxrffr.exe108⤵PID:1036
-
\??\c:\btbhnh.exec:\btbhnh.exe109⤵PID:4968
-
\??\c:\hbtnbn.exec:\hbtnbn.exe110⤵PID:704
-
\??\c:\jdjvv.exec:\jdjvv.exe111⤵PID:1000
-
\??\c:\3xfrrlx.exec:\3xfrrlx.exe112⤵PID:628
-
\??\c:\rlffrfr.exec:\rlffrfr.exe113⤵PID:2820
-
\??\c:\hnhbnn.exec:\hnhbnn.exe114⤵PID:4528
-
\??\c:\nbhbht.exec:\nbhbht.exe115⤵PID:2308
-
\??\c:\jvdvv.exec:\jvdvv.exe116⤵PID:3760
-
\??\c:\rxxllxr.exec:\rxxllxr.exe117⤵PID:4504
-
\??\c:\5flflrl.exec:\5flflrl.exe118⤵PID:2620
-
\??\c:\bnhttb.exec:\bnhttb.exe119⤵PID:1492
-
\??\c:\ddddp.exec:\ddddp.exe120⤵PID:4548
-
\??\c:\jjjdp.exec:\jjjdp.exe121⤵PID:3616
-
\??\c:\flfxxlx.exec:\flfxxlx.exe122⤵PID:3988
-
\??\c:\flrxfxf.exec:\flrxfxf.exe123⤵PID:3580
-
\??\c:\5rrlxrf.exec:\5rrlxrf.exe124⤵PID:4712
-
\??\c:\3xrlxxl.exec:\3xrlxxl.exe125⤵PID:4372
-
\??\c:\tbtnhb.exec:\tbtnhb.exe126⤵PID:4364
-
\??\c:\nnbthh.exec:\nnbthh.exe127⤵PID:3848
-
\??\c:\7jpdd.exec:\7jpdd.exe128⤵PID:4048
-
\??\c:\pvvjd.exec:\pvvjd.exe129⤵PID:4468
-
\??\c:\rffxrlx.exec:\rffxrlx.exe130⤵PID:776
-
\??\c:\3lrfxxr.exec:\3lrfxxr.exe131⤵PID:2904
-
\??\c:\tnhbtt.exec:\tnhbtt.exe132⤵PID:3872
-
\??\c:\httnhh.exec:\httnhh.exe133⤵PID:1328
-
\??\c:\dvdvj.exec:\dvdvj.exe134⤵PID:2152
-
\??\c:\flfrrrf.exec:\flfrrrf.exe135⤵PID:3692
-
\??\c:\rfxrlfr.exec:\rfxrlfr.exe136⤵PID:2808
-
\??\c:\7bbthb.exec:\7bbthb.exe137⤵PID:4644
-
\??\c:\nhtnnh.exec:\nhtnnh.exe138⤵PID:4840
-
\??\c:\9vdpj.exec:\9vdpj.exe139⤵PID:5008
-
\??\c:\jvddj.exec:\jvddj.exe140⤵PID:1344
-
\??\c:\fflllrl.exec:\fflllrl.exe141⤵PID:872
-
\??\c:\nhhbtt.exec:\nhhbtt.exe142⤵PID:2976
-
\??\c:\htbnbn.exec:\htbnbn.exe143⤵PID:3268
-
\??\c:\pjpjj.exec:\pjpjj.exe144⤵PID:2248
-
\??\c:\7jjdp.exec:\7jjdp.exe145⤵PID:2464
-
\??\c:\fffxlfr.exec:\fffxlfr.exe146⤵PID:4220
-
\??\c:\7xrlfxx.exec:\7xrlfxx.exe147⤵PID:2072
-
\??\c:\ttbhtt.exec:\ttbhtt.exe148⤵PID:3476
-
\??\c:\bhhbtn.exec:\bhhbtn.exe149⤵PID:3892
-
\??\c:\vdpvj.exec:\vdpvj.exe150⤵PID:3540
-
\??\c:\lxrlflf.exec:\lxrlflf.exe151⤵PID:1608
-
\??\c:\1rrrllf.exec:\1rrrllf.exe152⤵PID:4748
-
\??\c:\tnnhhb.exec:\tnnhhb.exe153⤵PID:3700
-
\??\c:\bnnhbn.exec:\bnnhbn.exe154⤵PID:4080
-
\??\c:\pjdvj.exec:\pjdvj.exe155⤵PID:2856
-
\??\c:\ffxlxxr.exec:\ffxlxxr.exe156⤵PID:4504
-
\??\c:\hbttnh.exec:\hbttnh.exe157⤵PID:2092
-
\??\c:\hbthtn.exec:\hbthtn.exe158⤵PID:4556
-
\??\c:\ddddd.exec:\ddddd.exe159⤵PID:4548
-
\??\c:\rrflllx.exec:\rrflllx.exe160⤵PID:3616
-
\??\c:\rlfllrx.exec:\rlfllrx.exe161⤵PID:4940
-
\??\c:\nnbtnh.exec:\nnbtnh.exe162⤵PID:4568
-
\??\c:\dvjdj.exec:\dvjdj.exe163⤵PID:2268
-
\??\c:\xfflfrx.exec:\xfflfrx.exe164⤵PID:1540
-
\??\c:\jdjpv.exec:\jdjpv.exe165⤵PID:2980
-
\??\c:\rflxlrf.exec:\rflxlrf.exe166⤵PID:1264
-
\??\c:\fxlxxrl.exec:\fxlxxrl.exe167⤵PID:4804
-
\??\c:\thbtnb.exec:\thbtnb.exe168⤵PID:4532
-
\??\c:\dvjjj.exec:\dvjjj.exe169⤵PID:2932
-
\??\c:\ddvpp.exec:\ddvpp.exe170⤵PID:4288
-
\??\c:\xffrxrf.exec:\xffrxrf.exe171⤵PID:4848
-
\??\c:\nbnbbt.exec:\nbnbbt.exe172⤵PID:4120
-
\??\c:\bbbnbt.exec:\bbbnbt.exe173⤵PID:3896
-
\??\c:\vjjdp.exec:\vjjdp.exe174⤵PID:1064
-
\??\c:\djjvp.exec:\djjvp.exe175⤵PID:4444
-
\??\c:\9xxrxfx.exec:\9xxrxfx.exe176⤵PID:3160
-
\??\c:\ntnbtn.exec:\ntnbtn.exe177⤵PID:3180
-
\??\c:\1vpdp.exec:\1vpdp.exe178⤵PID:4628
-
\??\c:\vpjdp.exec:\vpjdp.exe179⤵PID:876
-
\??\c:\xlfxrlf.exec:\xlfxrlf.exe180⤵PID:4520
-
\??\c:\rlfxrlr.exec:\rlfxrlr.exe181⤵PID:4512
-
\??\c:\ttnhbb.exec:\ttnhbb.exe182⤵PID:1060
-
\??\c:\thbthb.exec:\thbthb.exe183⤵PID:4300
-
\??\c:\jdjvp.exec:\jdjvp.exe184⤵PID:4656
-
\??\c:\xrfxxrr.exec:\xrfxxrr.exe185⤵PID:2088
-
\??\c:\fllrrrr.exec:\fllrrrr.exe186⤵PID:960
-
\??\c:\htbnhb.exec:\htbnhb.exe187⤵PID:516
-
\??\c:\nhnhbh.exec:\nhnhbh.exe188⤵PID:2376
-
\??\c:\vpdvj.exec:\vpdvj.exe189⤵PID:3996
-
\??\c:\rllrrrx.exec:\rllrrrx.exe190⤵PID:3688
-
\??\c:\9llllfx.exec:\9llllfx.exe191⤵PID:3700
-
\??\c:\bbbttt.exec:\bbbttt.exe192⤵PID:2712
-
\??\c:\bnnbth.exec:\bnnbth.exe193⤵PID:2620
-
\??\c:\3pjvj.exec:\3pjvj.exe194⤵PID:4792
-
\??\c:\fffffrr.exec:\fffffrr.exe195⤵PID:4596
-
\??\c:\5rlfxrl.exec:\5rlfxrl.exe196⤵PID:4292
-
\??\c:\hntnhh.exec:\hntnhh.exe197⤵PID:3536
-
\??\c:\hthbtn.exec:\hthbtn.exe198⤵PID:2924
-
\??\c:\pjdvj.exec:\pjdvj.exe199⤵PID:1152
-
\??\c:\jddvj.exec:\jddvj.exe200⤵PID:2268
-
\??\c:\lfrrflr.exec:\lfrrflr.exe201⤵PID:3392
-
\??\c:\xflfrrf.exec:\xflfrrf.exe202⤵PID:3848
-
\??\c:\nnhhbh.exec:\nnhhbh.exe203⤵PID:4856
-
\??\c:\ddvpj.exec:\ddvpj.exe204⤵PID:4804
-
\??\c:\dvdvj.exec:\dvdvj.exe205⤵PID:4144
-
\??\c:\fxlrxrx.exec:\fxlrxrx.exe206⤵PID:2116
-
\??\c:\frfxlfx.exec:\frfxlfx.exe207⤵PID:4516
-
\??\c:\tbhttn.exec:\tbhttn.exe208⤵PID:2940
-
\??\c:\bbnbnh.exec:\bbnbnh.exe209⤵PID:4120
-
\??\c:\vpvjj.exec:\vpvjj.exe210⤵PID:1604
-
\??\c:\7xfrllf.exec:\7xfrllf.exe211⤵PID:916
-
\??\c:\3nhnhb.exec:\3nhnhb.exe212⤵PID:4444
-
\??\c:\bttnnh.exec:\bttnnh.exe213⤵PID:3160
-
\??\c:\dppjv.exec:\dppjv.exe214⤵PID:3180
-
\??\c:\fxfxlrl.exec:\fxfxlrl.exe215⤵PID:4296
-
\??\c:\frrlfxr.exec:\frrlfxr.exe216⤵PID:864
-
\??\c:\hnnbhh.exec:\hnnbhh.exe217⤵PID:4520
-
\??\c:\nnntbh.exec:\nnntbh.exe218⤵PID:2008
-
\??\c:\dppjp.exec:\dppjp.exe219⤵PID:756
-
\??\c:\vpjdp.exec:\vpjdp.exe220⤵PID:3084
-
\??\c:\flxxrlx.exec:\flxxrlx.exe221⤵PID:4656
-
\??\c:\fxxffff.exec:\fxxffff.exe222⤵PID:1260
-
\??\c:\nbtnhb.exec:\nbtnhb.exe223⤵PID:2000
-
\??\c:\vjpjv.exec:\vjpjv.exe224⤵PID:1608
-
\??\c:\5jpdv.exec:\5jpdv.exe225⤵PID:3996
-
\??\c:\frxrlxr.exec:\frxrlxr.exe226⤵PID:3760
-
\??\c:\bbhbhb.exec:\bbhbhb.exe227⤵PID:2120
-
\??\c:\vjdvp.exec:\vjdvp.exe228⤵PID:1092
-
\??\c:\jvvpd.exec:\jvvpd.exe229⤵PID:4504
-
\??\c:\xffrfrf.exec:\xffrfrf.exe230⤵PID:2092
-
\??\c:\1rrfxrl.exec:\1rrfxrl.exe231⤵PID:3976
-
\??\c:\hbthbt.exec:\hbthbt.exe232⤵PID:1908
-
\??\c:\jjjdd.exec:\jjjdd.exe233⤵PID:804
-
\??\c:\jvvvj.exec:\jvvvj.exe234⤵PID:4648
-
\??\c:\xxrflxf.exec:\xxrflxf.exe235⤵PID:1152
-
\??\c:\lxfllrl.exec:\lxfllrl.exe236⤵PID:4232
-
\??\c:\bnhtnh.exec:\bnhtnh.exe237⤵PID:3712
-
\??\c:\nhnhhb.exec:\nhnhhb.exe238⤵PID:3952
-
\??\c:\vpjdv.exec:\vpjdv.exe239⤵PID:2560
-
\??\c:\vddjj.exec:\vddjj.exe240⤵PID:4804
-
\??\c:\hhhthb.exec:\hhhthb.exe241⤵PID:3212
-
\??\c:\3hnbtb.exec:\3hnbtb.exe242⤵PID:4884