Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 05:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7e2ad2f2bec82f25d5c233f3bec51530_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
7e2ad2f2bec82f25d5c233f3bec51530_NeikiAnalytics.exe
-
Size
134KB
-
MD5
7e2ad2f2bec82f25d5c233f3bec51530
-
SHA1
61bfaf1c499c2efc14877011005b1fd898a6d63e
-
SHA256
778fca23aa12b132439d36f0be16f82400633da40f2e37f1533ebb1ecf334407
-
SHA512
b658d345e0d17b16f721e2948fc7948e2342d89655a246d357d0d0eb9727eaa7eec53fbe0d4169edf5aa4ae0ed527cedc5493179930d29b70e06a9b6ed61a5a6
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afoHVpx+dGor/:n3C9BRW0j/1px+dGU
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral2/memory/2988-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3004-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3012-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4580-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4920-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3452-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2092-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4616-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2080-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1972-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3232-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4252-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1544-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3484-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1464-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1152-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3300-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3612-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1136-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rrrrrll.exehhttnn.exevvppj.exennttbb.exejdpjj.exe5jjjj.exetnttnn.exejvdjd.exevpdvd.exe9flffff.exenhhhbb.exevpjdd.exedvvvp.exefxrfxxx.exebntbbb.exevdddp.exe9lrllrr.exehtbbtn.exenbnhhh.exevpdvp.exellllffx.exe3tbttt.exe9pjpd.exejpdvv.exerfllrlr.exenhnnnh.exe1jpjj.exepddvj.exelxxxllf.exelflffff.exe7hbbtt.exevvdvp.exevpvjv.exerllffff.exerlffxfl.exehhhnnn.exebthbnn.exeddpjj.exe1xrlffx.exehbtbbh.exepjjjd.exejdpjp.exexxrflff.exehbbtbb.exehbhhbt.exepddjd.exellxrxxx.exelrrllll.exehtntnn.exehthbbt.exedvvvv.exevjdvv.exerlllffx.exefffxxxr.exenhhhhn.exebhhhhh.exevpjdv.exejvddd.exe1rfffff.exerxlfrrr.exe3hnnnn.exehbbbbh.exejddpp.exepjddd.exepid process 3004 rrrrrll.exe 3012 hhttnn.exe 4580 vvppj.exe 1388 nnttbb.exe 4920 jdpjj.exe 3452 5jjjj.exe 2092 tnttnn.exe 4520 jvdjd.exe 4792 vpdvd.exe 4616 9flffff.exe 2844 nhhhbb.exe 2080 vpjdd.exe 812 dvvvp.exe 1972 fxrfxxx.exe 3232 bntbbb.exe 4252 vdddp.exe 1544 9lrllrr.exe 3628 htbbtn.exe 4692 nbnhhh.exe 3484 vpdvp.exe 1464 llllffx.exe 1152 3tbttt.exe 2452 9pjpd.exe 3300 jpdvv.exe 3516 rfllrlr.exe 4372 nhnnnh.exe 3612 1jpjj.exe 2624 pddvj.exe 3248 lxxxllf.exe 3460 lflffff.exe 1136 7hbbtt.exe 4160 vvdvp.exe 3992 vpvjv.exe 1488 rllffff.exe 3400 rlffxfl.exe 4992 hhhnnn.exe 2008 bthbnn.exe 5112 ddpjj.exe 1408 1xrlffx.exe 4416 hbtbbh.exe 1420 pjjjd.exe 552 jdpjp.exe 692 xxrflff.exe 3176 hbbtbb.exe 2232 hbhhbt.exe 3752 pddjd.exe 4252 llxrxxx.exe 4860 lrrllll.exe 1812 htntnn.exe 3008 hthbbt.exe 1664 dvvvv.exe 3672 vjdvv.exe 4936 rlllffx.exe 4040 fffxxxr.exe 1180 nhhhhn.exe 3440 bhhhhh.exe 4876 vpjdv.exe 3860 jvddd.exe 1508 1rfffff.exe 2436 rxlfrrr.exe 3792 3hnnnn.exe 1036 hbbbbh.exe 436 jddpp.exe 2328 pjddd.exe -
Processes:
resource yara_rule behavioral2/memory/2988-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3004-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3012-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4920-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3452-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3452-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2092-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2080-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3232-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4252-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1544-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3484-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1464-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1152-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3300-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3612-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1136-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7e2ad2f2bec82f25d5c233f3bec51530_NeikiAnalytics.exerrrrrll.exehhttnn.exevvppj.exennttbb.exejdpjj.exe5jjjj.exetnttnn.exejvdjd.exevpdvd.exe9flffff.exenhhhbb.exevpjdd.exedvvvp.exefxrfxxx.exebntbbb.exevdddp.exe9lrllrr.exehtbbtn.exenbnhhh.exevpdvp.exellllffx.exedescription pid process target process PID 2988 wrote to memory of 3004 2988 7e2ad2f2bec82f25d5c233f3bec51530_NeikiAnalytics.exe rrrrrll.exe PID 2988 wrote to memory of 3004 2988 7e2ad2f2bec82f25d5c233f3bec51530_NeikiAnalytics.exe rrrrrll.exe PID 2988 wrote to memory of 3004 2988 7e2ad2f2bec82f25d5c233f3bec51530_NeikiAnalytics.exe rrrrrll.exe PID 3004 wrote to memory of 3012 3004 rrrrrll.exe hhttnn.exe PID 3004 wrote to memory of 3012 3004 rrrrrll.exe hhttnn.exe PID 3004 wrote to memory of 3012 3004 rrrrrll.exe hhttnn.exe PID 3012 wrote to memory of 4580 3012 hhttnn.exe vvppj.exe PID 3012 wrote to memory of 4580 3012 hhttnn.exe vvppj.exe PID 3012 wrote to memory of 4580 3012 hhttnn.exe vvppj.exe PID 4580 wrote to memory of 1388 4580 vvppj.exe nnttbb.exe PID 4580 wrote to memory of 1388 4580 vvppj.exe nnttbb.exe PID 4580 wrote to memory of 1388 4580 vvppj.exe nnttbb.exe PID 1388 wrote to memory of 4920 1388 nnttbb.exe jdpjj.exe PID 1388 wrote to memory of 4920 1388 nnttbb.exe jdpjj.exe PID 1388 wrote to memory of 4920 1388 nnttbb.exe jdpjj.exe PID 4920 wrote to memory of 3452 4920 jdpjj.exe 5jjjj.exe PID 4920 wrote to memory of 3452 4920 jdpjj.exe 5jjjj.exe PID 4920 wrote to memory of 3452 4920 jdpjj.exe 5jjjj.exe PID 3452 wrote to memory of 2092 3452 5jjjj.exe tnttnn.exe PID 3452 wrote to memory of 2092 3452 5jjjj.exe tnttnn.exe PID 3452 wrote to memory of 2092 3452 5jjjj.exe tnttnn.exe PID 2092 wrote to memory of 4520 2092 tnttnn.exe jvdjd.exe PID 2092 wrote to memory of 4520 2092 tnttnn.exe jvdjd.exe PID 2092 wrote to memory of 4520 2092 tnttnn.exe jvdjd.exe PID 4520 wrote to memory of 4792 4520 jvdjd.exe vpdvd.exe PID 4520 wrote to memory of 4792 4520 jvdjd.exe vpdvd.exe PID 4520 wrote to memory of 4792 4520 jvdjd.exe vpdvd.exe PID 4792 wrote to memory of 4616 4792 vpdvd.exe 9flffff.exe PID 4792 wrote to memory of 4616 4792 vpdvd.exe 9flffff.exe PID 4792 wrote to memory of 4616 4792 vpdvd.exe 9flffff.exe PID 4616 wrote to memory of 2844 4616 9flffff.exe nhhhbb.exe PID 4616 wrote to memory of 2844 4616 9flffff.exe nhhhbb.exe PID 4616 wrote to memory of 2844 4616 9flffff.exe nhhhbb.exe PID 2844 wrote to memory of 2080 2844 nhhhbb.exe vpjdd.exe PID 2844 wrote to memory of 2080 2844 nhhhbb.exe vpjdd.exe PID 2844 wrote to memory of 2080 2844 nhhhbb.exe vpjdd.exe PID 2080 wrote to memory of 812 2080 vpjdd.exe dvvvp.exe PID 2080 wrote to memory of 812 2080 vpjdd.exe dvvvp.exe PID 2080 wrote to memory of 812 2080 vpjdd.exe dvvvp.exe PID 812 wrote to memory of 1972 812 dvvvp.exe fxrfxxx.exe PID 812 wrote to memory of 1972 812 dvvvp.exe fxrfxxx.exe PID 812 wrote to memory of 1972 812 dvvvp.exe fxrfxxx.exe PID 1972 wrote to memory of 3232 1972 fxrfxxx.exe bntbbb.exe PID 1972 wrote to memory of 3232 1972 fxrfxxx.exe bntbbb.exe PID 1972 wrote to memory of 3232 1972 fxrfxxx.exe bntbbb.exe PID 3232 wrote to memory of 4252 3232 bntbbb.exe vdddp.exe PID 3232 wrote to memory of 4252 3232 bntbbb.exe vdddp.exe PID 3232 wrote to memory of 4252 3232 bntbbb.exe vdddp.exe PID 4252 wrote to memory of 1544 4252 vdddp.exe 9lrllrr.exe PID 4252 wrote to memory of 1544 4252 vdddp.exe 9lrllrr.exe PID 4252 wrote to memory of 1544 4252 vdddp.exe 9lrllrr.exe PID 1544 wrote to memory of 3628 1544 9lrllrr.exe htbbtn.exe PID 1544 wrote to memory of 3628 1544 9lrllrr.exe htbbtn.exe PID 1544 wrote to memory of 3628 1544 9lrllrr.exe htbbtn.exe PID 3628 wrote to memory of 4692 3628 htbbtn.exe nbnhhh.exe PID 3628 wrote to memory of 4692 3628 htbbtn.exe nbnhhh.exe PID 3628 wrote to memory of 4692 3628 htbbtn.exe nbnhhh.exe PID 4692 wrote to memory of 3484 4692 nbnhhh.exe vpdvp.exe PID 4692 wrote to memory of 3484 4692 nbnhhh.exe vpdvp.exe PID 4692 wrote to memory of 3484 4692 nbnhhh.exe vpdvp.exe PID 3484 wrote to memory of 1464 3484 vpdvp.exe llllffx.exe PID 3484 wrote to memory of 1464 3484 vpdvp.exe llllffx.exe PID 3484 wrote to memory of 1464 3484 vpdvp.exe llllffx.exe PID 1464 wrote to memory of 1152 1464 llllffx.exe 3tbttt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e2ad2f2bec82f25d5c233f3bec51530_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7e2ad2f2bec82f25d5c233f3bec51530_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\rrrrrll.exec:\rrrrrll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\hhttnn.exec:\hhttnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\vvppj.exec:\vvppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\nnttbb.exec:\nnttbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\jdpjj.exec:\jdpjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\5jjjj.exec:\5jjjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\tnttnn.exec:\tnttnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\jvdjd.exec:\jvdjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\vpdvd.exec:\vpdvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\9flffff.exec:\9flffff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\nhhhbb.exec:\nhhhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\vpjdd.exec:\vpjdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\dvvvp.exec:\dvvvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\fxrfxxx.exec:\fxrfxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\bntbbb.exec:\bntbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\vdddp.exec:\vdddp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\9lrllrr.exec:\9lrllrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\htbbtn.exec:\htbbtn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\nbnhhh.exec:\nbnhhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\vpdvp.exec:\vpdvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\llllffx.exec:\llllffx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\3tbttt.exec:\3tbttt.exe23⤵
- Executes dropped EXE
PID:1152 -
\??\c:\9pjpd.exec:\9pjpd.exe24⤵
- Executes dropped EXE
PID:2452 -
\??\c:\jpdvv.exec:\jpdvv.exe25⤵
- Executes dropped EXE
PID:3300 -
\??\c:\rfllrlr.exec:\rfllrlr.exe26⤵
- Executes dropped EXE
PID:3516 -
\??\c:\nhnnnh.exec:\nhnnnh.exe27⤵
- Executes dropped EXE
PID:4372 -
\??\c:\1jpjj.exec:\1jpjj.exe28⤵
- Executes dropped EXE
PID:3612 -
\??\c:\pddvj.exec:\pddvj.exe29⤵
- Executes dropped EXE
PID:2624 -
\??\c:\lxxxllf.exec:\lxxxllf.exe30⤵
- Executes dropped EXE
PID:3248 -
\??\c:\lflffff.exec:\lflffff.exe31⤵
- Executes dropped EXE
PID:3460 -
\??\c:\7hbbtt.exec:\7hbbtt.exe32⤵
- Executes dropped EXE
PID:1136 -
\??\c:\vvdvp.exec:\vvdvp.exe33⤵
- Executes dropped EXE
PID:4160 -
\??\c:\vpvjv.exec:\vpvjv.exe34⤵
- Executes dropped EXE
PID:3992 -
\??\c:\rllffff.exec:\rllffff.exe35⤵
- Executes dropped EXE
PID:1488 -
\??\c:\rlffxfl.exec:\rlffxfl.exe36⤵
- Executes dropped EXE
PID:3400 -
\??\c:\hhhnnn.exec:\hhhnnn.exe37⤵
- Executes dropped EXE
PID:4992 -
\??\c:\bthbnn.exec:\bthbnn.exe38⤵
- Executes dropped EXE
PID:2008 -
\??\c:\ddpjj.exec:\ddpjj.exe39⤵
- Executes dropped EXE
PID:5112 -
\??\c:\1xrlffx.exec:\1xrlffx.exe40⤵
- Executes dropped EXE
PID:1408 -
\??\c:\hbtbbh.exec:\hbtbbh.exe41⤵
- Executes dropped EXE
PID:4416 -
\??\c:\pjjjd.exec:\pjjjd.exe42⤵
- Executes dropped EXE
PID:1420 -
\??\c:\jdpjp.exec:\jdpjp.exe43⤵
- Executes dropped EXE
PID:552 -
\??\c:\xxrflff.exec:\xxrflff.exe44⤵
- Executes dropped EXE
PID:692 -
\??\c:\hbbtbb.exec:\hbbtbb.exe45⤵
- Executes dropped EXE
PID:3176 -
\??\c:\hbhhbt.exec:\hbhhbt.exe46⤵
- Executes dropped EXE
PID:2232 -
\??\c:\pddjd.exec:\pddjd.exe47⤵
- Executes dropped EXE
PID:3752 -
\??\c:\llxrxxx.exec:\llxrxxx.exe48⤵
- Executes dropped EXE
PID:4252 -
\??\c:\lrrllll.exec:\lrrllll.exe49⤵
- Executes dropped EXE
PID:4860 -
\??\c:\htntnn.exec:\htntnn.exe50⤵
- Executes dropped EXE
PID:1812 -
\??\c:\hthbbt.exec:\hthbbt.exe51⤵
- Executes dropped EXE
PID:3008 -
\??\c:\dvvvv.exec:\dvvvv.exe52⤵
- Executes dropped EXE
PID:1664 -
\??\c:\vjdvv.exec:\vjdvv.exe53⤵
- Executes dropped EXE
PID:3672 -
\??\c:\rlllffx.exec:\rlllffx.exe54⤵
- Executes dropped EXE
PID:4936 -
\??\c:\fffxxxr.exec:\fffxxxr.exe55⤵
- Executes dropped EXE
PID:4040 -
\??\c:\nhhhhn.exec:\nhhhhn.exe56⤵
- Executes dropped EXE
PID:1180 -
\??\c:\bhhhhh.exec:\bhhhhh.exe57⤵
- Executes dropped EXE
PID:3440 -
\??\c:\vpjdv.exec:\vpjdv.exe58⤵
- Executes dropped EXE
PID:4876 -
\??\c:\jvddd.exec:\jvddd.exe59⤵
- Executes dropped EXE
PID:3860 -
\??\c:\1rfffff.exec:\1rfffff.exe60⤵
- Executes dropped EXE
PID:1508 -
\??\c:\rxlfrrr.exec:\rxlfrrr.exe61⤵
- Executes dropped EXE
PID:2436 -
\??\c:\3hnnnn.exec:\3hnnnn.exe62⤵
- Executes dropped EXE
PID:3792 -
\??\c:\hbbbbh.exec:\hbbbbh.exe63⤵
- Executes dropped EXE
PID:1036 -
\??\c:\jddpp.exec:\jddpp.exe64⤵
- Executes dropped EXE
PID:436 -
\??\c:\pjddd.exec:\pjddd.exe65⤵
- Executes dropped EXE
PID:2328 -
\??\c:\xlllfll.exec:\xlllfll.exe66⤵PID:3460
-
\??\c:\lffflrx.exec:\lffflrx.exe67⤵PID:3208
-
\??\c:\fxlfrrx.exec:\fxlfrrx.exe68⤵PID:440
-
\??\c:\btbbtn.exec:\btbbtn.exe69⤵PID:3564
-
\??\c:\vvvpp.exec:\vvvpp.exe70⤵PID:1332
-
\??\c:\vjdpj.exec:\vjdpj.exe71⤵PID:676
-
\??\c:\fllffff.exec:\fllffff.exe72⤵PID:4396
-
\??\c:\lfllfff.exec:\lfllfff.exe73⤵PID:5112
-
\??\c:\tntnbb.exec:\tntnbb.exe74⤵PID:2408
-
\??\c:\9ttttt.exec:\9ttttt.exe75⤵PID:3204
-
\??\c:\jpdvv.exec:\jpdvv.exe76⤵PID:4684
-
\??\c:\1xlfflf.exec:\1xlfflf.exe77⤵PID:1552
-
\??\c:\7flfxfx.exec:\7flfxfx.exe78⤵PID:2700
-
\??\c:\bnnhbb.exec:\bnnhbb.exe79⤵PID:564
-
\??\c:\hbbbbn.exec:\hbbbbn.exe80⤵PID:960
-
\??\c:\ddpjd.exec:\ddpjd.exe81⤵PID:1544
-
\??\c:\5jddp.exec:\5jddp.exe82⤵PID:1208
-
\??\c:\jvvpd.exec:\jvvpd.exe83⤵PID:4628
-
\??\c:\xrrlllf.exec:\xrrlllf.exe84⤵PID:2272
-
\??\c:\lxfffff.exec:\lxfffff.exe85⤵PID:1156
-
\??\c:\thtnnh.exec:\thtnnh.exe86⤵PID:2432
-
\??\c:\9vddv.exec:\9vddv.exe87⤵PID:1352
-
\??\c:\pjjpv.exec:\pjjpv.exe88⤵PID:1292
-
\??\c:\lllffll.exec:\lllffll.exe89⤵PID:1152
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe90⤵PID:1768
-
\??\c:\3nbtnn.exec:\3nbtnn.exe91⤵PID:1468
-
\??\c:\7bbbnt.exec:\7bbbnt.exe92⤵PID:4504
-
\??\c:\tntnhh.exec:\tntnhh.exe93⤵PID:2576
-
\??\c:\7ppdv.exec:\7ppdv.exe94⤵PID:3612
-
\??\c:\rlllfff.exec:\rlllfff.exe95⤵PID:1656
-
\??\c:\tntnnn.exec:\tntnnn.exe96⤵PID:4580
-
\??\c:\ttnhbh.exec:\ttnhbh.exe97⤵PID:2568
-
\??\c:\jvdvd.exec:\jvdvd.exe98⤵PID:2212
-
\??\c:\vjjdv.exec:\vjjdv.exe99⤵PID:4452
-
\??\c:\llxxxxf.exec:\llxxxxf.exe100⤵PID:4280
-
\??\c:\rfxxrrl.exec:\rfxxrrl.exe101⤵PID:4160
-
\??\c:\hbhnht.exec:\hbhnht.exe102⤵PID:2448
-
\??\c:\7hhbtt.exec:\7hhbtt.exe103⤵PID:4520
-
\??\c:\jvvdp.exec:\jvvdp.exe104⤵PID:4792
-
\??\c:\vdppj.exec:\vdppj.exe105⤵PID:2516
-
\??\c:\xxrlffx.exec:\xxrlffx.exe106⤵PID:4444
-
\??\c:\lfffrrr.exec:\lfffrrr.exe107⤵PID:4808
-
\??\c:\hbnhhh.exec:\hbnhhh.exe108⤵PID:1920
-
\??\c:\vvdvj.exec:\vvdvj.exe109⤵PID:3304
-
\??\c:\1fffrrr.exec:\1fffrrr.exe110⤵PID:1552
-
\??\c:\fxrrllf.exec:\fxrrllf.exe111⤵PID:3996
-
\??\c:\xrffrrx.exec:\xrffrrx.exe112⤵PID:1884
-
\??\c:\tttnhh.exec:\tttnhh.exe113⤵PID:748
-
\??\c:\pjdvv.exec:\pjdvv.exe114⤵PID:1808
-
\??\c:\rxffxxr.exec:\rxffxxr.exe115⤵PID:3560
-
\??\c:\fxffllr.exec:\fxffllr.exe116⤵PID:636
-
\??\c:\7hnhhh.exec:\7hnhhh.exe117⤵PID:3008
-
\??\c:\bhhhbb.exec:\bhhhbb.exe118⤵PID:1664
-
\??\c:\ddjdv.exec:\ddjdv.exe119⤵PID:1464
-
\??\c:\3dppd.exec:\3dppd.exe120⤵PID:2604
-
\??\c:\xfxrlfx.exec:\xfxrlfx.exe121⤵PID:1180
-
\??\c:\bthbbb.exec:\bthbbb.exe122⤵PID:348
-
\??\c:\pjpvj.exec:\pjpvj.exe123⤵PID:2796
-
\??\c:\xxfxrrx.exec:\xxfxrrx.exe124⤵PID:4432
-
\??\c:\lflffff.exec:\lflffff.exe125⤵PID:4504
-
\??\c:\9hhhhh.exec:\9hhhhh.exe126⤵PID:2436
-
\??\c:\nbnhbh.exec:\nbnhbh.exe127⤵PID:3004
-
\??\c:\jppjd.exec:\jppjd.exe128⤵PID:1656
-
\??\c:\7jvpd.exec:\7jvpd.exe129⤵PID:2328
-
\??\c:\rfrrrrx.exec:\rfrrrrx.exe130⤵PID:2212
-
\??\c:\hthbbb.exec:\hthbbb.exe131⤵PID:4452
-
\??\c:\bbhbbb.exec:\bbhbbb.exe132⤵PID:1488
-
\??\c:\dpdvp.exec:\dpdvp.exe133⤵PID:4160
-
\??\c:\ffllffr.exec:\ffllffr.exe134⤵PID:2448
-
\??\c:\llrrxxx.exec:\llrrxxx.exe135⤵PID:2008
-
\??\c:\bbtbbb.exec:\bbtbbb.exe136⤵PID:880
-
\??\c:\hhtnhh.exec:\hhtnhh.exe137⤵PID:2516
-
\??\c:\9vddp.exec:\9vddp.exe138⤵PID:392
-
\??\c:\vvdvp.exec:\vvdvp.exe139⤵PID:4808
-
\??\c:\rrxxrrr.exec:\rrxxrrr.exe140⤵PID:1920
-
\??\c:\rfrlfff.exec:\rfrlfff.exe141⤵PID:3304
-
\??\c:\ntntnb.exec:\ntntnb.exe142⤵PID:3260
-
\??\c:\tnhhbn.exec:\tnhhbn.exe143⤵PID:4620
-
\??\c:\jdjdv.exec:\jdjdv.exe144⤵PID:1884
-
\??\c:\llxrlll.exec:\llxrlll.exe145⤵PID:748
-
\??\c:\bnbtnt.exec:\bnbtnt.exe146⤵PID:1808
-
\??\c:\bbbttt.exec:\bbbttt.exe147⤵PID:4324
-
\??\c:\dvvvp.exec:\dvvvp.exe148⤵PID:1356
-
\??\c:\nthhbh.exec:\nthhbh.exe149⤵PID:3672
-
\??\c:\ppvvv.exec:\ppvvv.exe150⤵PID:3984
-
\??\c:\nbhbtt.exec:\nbhbtt.exe151⤵PID:876
-
\??\c:\nnhhbn.exec:\nnhhbn.exe152⤵PID:4040
-
\??\c:\jdjjp.exec:\jdjjp.exe153⤵PID:1152
-
\??\c:\lflrlff.exec:\lflrlff.exe154⤵PID:4876
-
\??\c:\jvdvp.exec:\jvdvp.exe155⤵PID:3860
-
\??\c:\vvvdp.exec:\vvvdp.exe156⤵PID:3516
-
\??\c:\xfxxffl.exec:\xfxxffl.exe157⤵PID:3612
-
\??\c:\rxfffff.exec:\rxfffff.exe158⤵PID:3964
-
\??\c:\nhbbtt.exec:\nhbbtt.exe159⤵PID:452
-
\??\c:\nhtttt.exec:\nhtttt.exe160⤵PID:2308
-
\??\c:\pppjd.exec:\pppjd.exe161⤵PID:4896
-
\??\c:\jvdvj.exec:\jvdvj.exe162⤵PID:1488
-
\??\c:\xflllll.exec:\xflllll.exe163⤵PID:4952
-
\??\c:\rxfllll.exec:\rxfllll.exe164⤵PID:4648
-
\??\c:\bntttt.exec:\bntttt.exe165⤵PID:2844
-
\??\c:\nhhbnn.exec:\nhhbnn.exe166⤵PID:4444
-
\??\c:\jpjjd.exec:\jpjjd.exe167⤵PID:3776
-
\??\c:\jpvdj.exec:\jpvdj.exe168⤵PID:3304
-
\??\c:\3vpjd.exec:\3vpjd.exe169⤵PID:3260
-
\??\c:\xflrrrx.exec:\xflrrrx.exe170⤵PID:4860
-
\??\c:\llrrrxx.exec:\llrrrxx.exe171⤵PID:1812
-
\??\c:\1hhbtt.exec:\1hhbtt.exe172⤵PID:404
-
\??\c:\vppdd.exec:\vppdd.exe173⤵PID:1764
-
\??\c:\vddvp.exec:\vddvp.exe174⤵PID:1548
-
\??\c:\rrfflll.exec:\rrfflll.exe175⤵PID:3672
-
\??\c:\5rxrfrr.exec:\5rxrfrr.exe176⤵PID:4524
-
\??\c:\nbbttn.exec:\nbbttn.exe177⤵PID:1768
-
\??\c:\vpddv.exec:\vpddv.exe178⤵PID:5020
-
\??\c:\7jjjv.exec:\7jjjv.exe179⤵PID:1508
-
\??\c:\xfxrlff.exec:\xfxrlff.exe180⤵PID:3860
-
\??\c:\fffxrfx.exec:\fffxrfx.exe181⤵PID:1912
-
\??\c:\thtnnn.exec:\thtnnn.exe182⤵PID:4484
-
\??\c:\jvjdv.exec:\jvjdv.exe183⤵PID:3604
-
\??\c:\vjjvd.exec:\vjjvd.exe184⤵PID:2328
-
\??\c:\rxfffxr.exec:\rxfffxr.exe185⤵PID:2196
-
\??\c:\nntnnn.exec:\nntnnn.exe186⤵PID:4452
-
\??\c:\dpddp.exec:\dpddp.exe187⤵PID:4792
-
\??\c:\rrxrffl.exec:\rrxrffl.exe188⤵PID:4952
-
\??\c:\nbnnht.exec:\nbnnht.exe189⤵PID:632
-
\??\c:\7tthbt.exec:\7tthbt.exe190⤵PID:4684
-
\??\c:\vppjp.exec:\vppjp.exe191⤵PID:4972
-
\??\c:\rffrlll.exec:\rffrlll.exe192⤵PID:3776
-
\??\c:\vdvjd.exec:\vdvjd.exe193⤵PID:3304
-
\??\c:\5bnhbh.exec:\5bnhbh.exe194⤵PID:1884
-
\??\c:\3hhbtt.exec:\3hhbtt.exe195⤵PID:1676
-
\??\c:\dpvdp.exec:\dpvdp.exe196⤵PID:2272
-
\??\c:\fxllfff.exec:\fxllfff.exe197⤵PID:3740
-
\??\c:\lxfflll.exec:\lxfflll.exe198⤵PID:1068
-
\??\c:\btbtnh.exec:\btbtnh.exe199⤵PID:1292
-
\??\c:\bttnhh.exec:\bttnhh.exe200⤵PID:4040
-
\??\c:\jpddv.exec:\jpddv.exe201⤵PID:4372
-
\??\c:\dvvpj.exec:\dvvpj.exe202⤵PID:4604
-
\??\c:\lffxxxf.exec:\lffxxxf.exe203⤵PID:2736
-
\??\c:\xxxxrxr.exec:\xxxxrxr.exe204⤵PID:5116
-
\??\c:\tnbbhh.exec:\tnbbhh.exe205⤵PID:3612
-
\??\c:\tthhhb.exec:\tthhhb.exe206⤵PID:3964
-
\??\c:\5pdvv.exec:\5pdvv.exe207⤵PID:1136
-
\??\c:\vpppp.exec:\vpppp.exe208⤵PID:2308
-
\??\c:\xrrrlll.exec:\xrrrlll.exe209⤵PID:2092
-
\??\c:\thbtth.exec:\thbtth.exe210⤵PID:4364
-
\??\c:\nbtttt.exec:\nbtttt.exe211⤵PID:4452
-
\??\c:\vvdjv.exec:\vvdjv.exe212⤵PID:4648
-
\??\c:\pvjdd.exec:\pvjdd.exe213⤵PID:4952
-
\??\c:\lffxlll.exec:\lffxlll.exe214⤵PID:4444
-
\??\c:\hhnttt.exec:\hhnttt.exe215⤵PID:1972
-
\??\c:\hhnhbt.exec:\hhnhbt.exe216⤵PID:564
-
\??\c:\1ppjj.exec:\1ppjj.exe217⤵PID:3260
-
\??\c:\dpddd.exec:\dpddd.exe218⤵PID:4860
-
\??\c:\frxrllf.exec:\frxrllf.exe219⤵PID:1884
-
\??\c:\tnntnn.exec:\tnntnn.exe220⤵PID:1676
-
\??\c:\hthnhh.exec:\hthnhh.exe221⤵PID:1356
-
\??\c:\ppdvd.exec:\ppdvd.exe222⤵PID:2872
-
\??\c:\dvvjd.exec:\dvvjd.exe223⤵PID:1068
-
\??\c:\rxxrlxr.exec:\rxxrlxr.exe224⤵PID:4524
-
\??\c:\thhbtt.exec:\thhbtt.exe225⤵PID:4336
-
\??\c:\htbbtt.exec:\htbbtt.exe226⤵PID:5020
-
\??\c:\3pvpp.exec:\3pvpp.exe227⤵PID:4504
-
\??\c:\dpvpd.exec:\dpvpd.exe228⤵PID:4528
-
\??\c:\xxlfrrl.exec:\xxlfrrl.exe229⤵PID:4840
-
\??\c:\9lxxflr.exec:\9lxxflr.exe230⤵PID:452
-
\??\c:\thhhbb.exec:\thhhbb.exe231⤵PID:1388
-
\??\c:\9bhhhh.exec:\9bhhhh.exe232⤵PID:3356
-
\??\c:\dvppp.exec:\dvppp.exe233⤵PID:1488
-
\??\c:\ppjdv.exec:\ppjdv.exe234⤵PID:5060
-
\??\c:\fxlllrx.exec:\fxlllrx.exe235⤵PID:4364
-
\??\c:\thttnn.exec:\thttnn.exe236⤵PID:2004
-
\??\c:\3bhhhh.exec:\3bhhhh.exe237⤵PID:2844
-
\??\c:\ttnnhh.exec:\ttnnhh.exe238⤵PID:4684
-
\??\c:\3jpjd.exec:\3jpjd.exe239⤵PID:464
-
\??\c:\vppvp.exec:\vppvp.exe240⤵PID:1004
-
\??\c:\lxrlffl.exec:\lxrlffl.exe241⤵PID:3304
-
\??\c:\1ffxrrr.exec:\1ffxrrr.exe242⤵PID:4168