Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 06:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8b7cf6a2384c121ec64b1a3c6fab8020_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
8b7cf6a2384c121ec64b1a3c6fab8020_NeikiAnalytics.exe
-
Size
67KB
-
MD5
8b7cf6a2384c121ec64b1a3c6fab8020
-
SHA1
be8666189a652e2f0c2079ca2de89fc4e9f34f17
-
SHA256
65a5868cc59c3fd38ebf2eabe525bcff18d76d9f32bac54af64032a40a4e5c80
-
SHA512
9565331afa792c8f5b17b3a93b16ac8de175e12a69bba88d7651dd2c1c43dd572bb262e05486a289074b1c0edd640fd6ee2a07803d8b7e5c354d6085323f928d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfsIQl:ymb3NkkiQ3mdBjFI4VAIQl
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral2/memory/3592-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4164-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1628-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/224-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4728-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4912-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/440-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2560-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3416-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/772-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3416-68-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1892-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2404-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4008-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1960-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3644-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2260-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2328-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4248-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1048-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rrfflll.exeddvpj.exevpdvv.exerfrrxfl.exexrxrlff.exe9tnhhn.exejddvp.exejddvj.exexrrlrll.exerxllllf.exenhtnbt.exejddvp.exefflffff.exennhbbb.exennnhbb.exevpvjv.exelxxxrrr.exerfrlflf.exehhnbnn.exevppdv.exejdvpd.exe3pppp.exefrxxrrl.exenbbttt.exedvjdv.exevpvpj.exelxfxrrr.exe3ttnhh.exenbbbtt.exepjdjd.exexrlfxrx.exehbhbtt.exebthbbb.exe5pjdv.exepppjd.exelrfxrxf.exerllfxxr.exebhbtnn.exejvvpj.exedvvpd.exe9fxrfff.exe3hnnnn.exebbbtnb.exe3dvvd.exelllfxxx.exe3bhttn.exedvpjd.exe1jdvp.exelfxxffl.exenhnbbb.exepjjdv.exevpjdv.exe1rllffx.exehhhbtt.exebttnhh.exedpvvp.exelllflxr.exerxrrrrf.exebntnhb.exe5hhtnn.exeddjdd.exelfllfff.exebtbtnb.exettbtnn.exepid process 4164 rrfflll.exe 4912 ddvpj.exe 4728 vpdvv.exe 1628 rfrrxfl.exe 224 xrxrlff.exe 3160 9tnhhn.exe 440 jddvp.exe 2560 jddvj.exe 3416 xrrlrll.exe 772 rxllllf.exe 5016 nhtnbt.exe 1892 jddvp.exe 2404 fflffff.exe 4008 nnhbbb.exe 1960 nnnhbb.exe 4152 vpvjv.exe 4516 lxxxrrr.exe 4780 rfrlflf.exe 1472 hhnbnn.exe 3644 vppdv.exe 2260 jdvpd.exe 396 3pppp.exe 2024 frxxrrl.exe 348 nbbttt.exe 2328 dvjdv.exe 4248 vpvpj.exe 2204 lxfxrrr.exe 1480 3ttnhh.exe 1048 nbbbtt.exe 4264 pjdjd.exe 3504 xrlfxrx.exe 4472 hbhbtt.exe 2692 bthbbb.exe 4968 5pjdv.exe 5004 pppjd.exe 4528 lrfxrxf.exe 2980 rllfxxr.exe 4636 bhbtnn.exe 1900 jvvpj.exe 3856 dvvpd.exe 536 9fxrfff.exe 4308 3hnnnn.exe 3592 bbbtnb.exe 3560 3dvvd.exe 4912 lllfxxx.exe 3960 3bhttn.exe 1148 dvpjd.exe 3588 1jdvp.exe 4864 lfxxffl.exe 2944 nhnbbb.exe 2720 pjjdv.exe 4800 vpjdv.exe 3892 1rllffx.exe 3220 hhhbtt.exe 3256 bttnhh.exe 2452 dpvvp.exe 3408 lllflxr.exe 5048 rxrrrrf.exe 2736 bntnhb.exe 3772 5hhtnn.exe 1052 ddjdd.exe 4024 lfllfff.exe 4944 btbtnb.exe 2816 ttbtnn.exe -
Processes:
resource yara_rule behavioral2/memory/3592-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4164-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1628-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4728-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/440-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2560-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3416-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/772-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1892-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2404-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4008-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1960-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3644-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2260-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4248-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1048-189-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8b7cf6a2384c121ec64b1a3c6fab8020_NeikiAnalytics.exerrfflll.exeddvpj.exevpdvv.exerfrrxfl.exexrxrlff.exe9tnhhn.exejddvp.exejddvj.exexrrlrll.exerxllllf.exenhtnbt.exejddvp.exefflffff.exennhbbb.exennnhbb.exevpvjv.exelxxxrrr.exerfrlflf.exehhnbnn.exevppdv.exejdvpd.exedescription pid process target process PID 3592 wrote to memory of 4164 3592 8b7cf6a2384c121ec64b1a3c6fab8020_NeikiAnalytics.exe rrfflll.exe PID 3592 wrote to memory of 4164 3592 8b7cf6a2384c121ec64b1a3c6fab8020_NeikiAnalytics.exe rrfflll.exe PID 3592 wrote to memory of 4164 3592 8b7cf6a2384c121ec64b1a3c6fab8020_NeikiAnalytics.exe rrfflll.exe PID 4164 wrote to memory of 4912 4164 rrfflll.exe ddvpj.exe PID 4164 wrote to memory of 4912 4164 rrfflll.exe ddvpj.exe PID 4164 wrote to memory of 4912 4164 rrfflll.exe ddvpj.exe PID 4912 wrote to memory of 4728 4912 ddvpj.exe vpdvv.exe PID 4912 wrote to memory of 4728 4912 ddvpj.exe vpdvv.exe PID 4912 wrote to memory of 4728 4912 ddvpj.exe vpdvv.exe PID 4728 wrote to memory of 1628 4728 vpdvv.exe rfrrxfl.exe PID 4728 wrote to memory of 1628 4728 vpdvv.exe rfrrxfl.exe PID 4728 wrote to memory of 1628 4728 vpdvv.exe rfrrxfl.exe PID 1628 wrote to memory of 224 1628 rfrrxfl.exe xrxrlff.exe PID 1628 wrote to memory of 224 1628 rfrrxfl.exe xrxrlff.exe PID 1628 wrote to memory of 224 1628 rfrrxfl.exe xrxrlff.exe PID 224 wrote to memory of 3160 224 xrxrlff.exe 9tnhhn.exe PID 224 wrote to memory of 3160 224 xrxrlff.exe 9tnhhn.exe PID 224 wrote to memory of 3160 224 xrxrlff.exe 9tnhhn.exe PID 3160 wrote to memory of 440 3160 9tnhhn.exe jddvp.exe PID 3160 wrote to memory of 440 3160 9tnhhn.exe jddvp.exe PID 3160 wrote to memory of 440 3160 9tnhhn.exe jddvp.exe PID 440 wrote to memory of 2560 440 jddvp.exe jddvj.exe PID 440 wrote to memory of 2560 440 jddvp.exe jddvj.exe PID 440 wrote to memory of 2560 440 jddvp.exe jddvj.exe PID 2560 wrote to memory of 3416 2560 jddvj.exe xrrlrll.exe PID 2560 wrote to memory of 3416 2560 jddvj.exe xrrlrll.exe PID 2560 wrote to memory of 3416 2560 jddvj.exe xrrlrll.exe PID 3416 wrote to memory of 772 3416 xrrlrll.exe rxllllf.exe PID 3416 wrote to memory of 772 3416 xrrlrll.exe rxllllf.exe PID 3416 wrote to memory of 772 3416 xrrlrll.exe rxllllf.exe PID 772 wrote to memory of 5016 772 rxllllf.exe nhtnbt.exe PID 772 wrote to memory of 5016 772 rxllllf.exe nhtnbt.exe PID 772 wrote to memory of 5016 772 rxllllf.exe nhtnbt.exe PID 5016 wrote to memory of 1892 5016 nhtnbt.exe jddvp.exe PID 5016 wrote to memory of 1892 5016 nhtnbt.exe jddvp.exe PID 5016 wrote to memory of 1892 5016 nhtnbt.exe jddvp.exe PID 1892 wrote to memory of 2404 1892 jddvp.exe fflffff.exe PID 1892 wrote to memory of 2404 1892 jddvp.exe fflffff.exe PID 1892 wrote to memory of 2404 1892 jddvp.exe fflffff.exe PID 2404 wrote to memory of 4008 2404 fflffff.exe nnhbbb.exe PID 2404 wrote to memory of 4008 2404 fflffff.exe nnhbbb.exe PID 2404 wrote to memory of 4008 2404 fflffff.exe nnhbbb.exe PID 4008 wrote to memory of 1960 4008 nnhbbb.exe nnnhbb.exe PID 4008 wrote to memory of 1960 4008 nnhbbb.exe nnnhbb.exe PID 4008 wrote to memory of 1960 4008 nnhbbb.exe nnnhbb.exe PID 1960 wrote to memory of 4152 1960 nnnhbb.exe vpvjv.exe PID 1960 wrote to memory of 4152 1960 nnnhbb.exe vpvjv.exe PID 1960 wrote to memory of 4152 1960 nnnhbb.exe vpvjv.exe PID 4152 wrote to memory of 4516 4152 vpvjv.exe lxxxrrr.exe PID 4152 wrote to memory of 4516 4152 vpvjv.exe lxxxrrr.exe PID 4152 wrote to memory of 4516 4152 vpvjv.exe lxxxrrr.exe PID 4516 wrote to memory of 4780 4516 lxxxrrr.exe rfrlflf.exe PID 4516 wrote to memory of 4780 4516 lxxxrrr.exe rfrlflf.exe PID 4516 wrote to memory of 4780 4516 lxxxrrr.exe rfrlflf.exe PID 4780 wrote to memory of 1472 4780 rfrlflf.exe hhnbnn.exe PID 4780 wrote to memory of 1472 4780 rfrlflf.exe hhnbnn.exe PID 4780 wrote to memory of 1472 4780 rfrlflf.exe hhnbnn.exe PID 1472 wrote to memory of 3644 1472 hhnbnn.exe vppdv.exe PID 1472 wrote to memory of 3644 1472 hhnbnn.exe vppdv.exe PID 1472 wrote to memory of 3644 1472 hhnbnn.exe vppdv.exe PID 3644 wrote to memory of 2260 3644 vppdv.exe jdvpd.exe PID 3644 wrote to memory of 2260 3644 vppdv.exe jdvpd.exe PID 3644 wrote to memory of 2260 3644 vppdv.exe jdvpd.exe PID 2260 wrote to memory of 396 2260 jdvpd.exe 3pppp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b7cf6a2384c121ec64b1a3c6fab8020_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8b7cf6a2384c121ec64b1a3c6fab8020_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\rrfflll.exec:\rrfflll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
\??\c:\ddvpj.exec:\ddvpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\vpdvv.exec:\vpdvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\rfrrxfl.exec:\rfrrxfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\xrxrlff.exec:\xrxrlff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\9tnhhn.exec:\9tnhhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\jddvp.exec:\jddvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\jddvj.exec:\jddvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\xrrlrll.exec:\xrrlrll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
\??\c:\rxllllf.exec:\rxllllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\nhtnbt.exec:\nhtnbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\jddvp.exec:\jddvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\fflffff.exec:\fflffff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\nnhbbb.exec:\nnhbbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\nnnhbb.exec:\nnnhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\vpvjv.exec:\vpvjv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\lxxxrrr.exec:\lxxxrrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\rfrlflf.exec:\rfrlflf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\hhnbnn.exec:\hhnbnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\vppdv.exec:\vppdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\jdvpd.exec:\jdvpd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\3pppp.exec:\3pppp.exe23⤵
- Executes dropped EXE
PID:396 -
\??\c:\frxxrrl.exec:\frxxrrl.exe24⤵
- Executes dropped EXE
PID:2024 -
\??\c:\nbbttt.exec:\nbbttt.exe25⤵
- Executes dropped EXE
PID:348 -
\??\c:\dvjdv.exec:\dvjdv.exe26⤵
- Executes dropped EXE
PID:2328 -
\??\c:\vpvpj.exec:\vpvpj.exe27⤵
- Executes dropped EXE
PID:4248 -
\??\c:\lxfxrrr.exec:\lxfxrrr.exe28⤵
- Executes dropped EXE
PID:2204 -
\??\c:\3ttnhh.exec:\3ttnhh.exe29⤵
- Executes dropped EXE
PID:1480 -
\??\c:\nbbbtt.exec:\nbbbtt.exe30⤵
- Executes dropped EXE
PID:1048 -
\??\c:\pjdjd.exec:\pjdjd.exe31⤵
- Executes dropped EXE
PID:4264 -
\??\c:\xrlfxrx.exec:\xrlfxrx.exe32⤵
- Executes dropped EXE
PID:3504 -
\??\c:\hbhbtt.exec:\hbhbtt.exe33⤵
- Executes dropped EXE
PID:4472 -
\??\c:\bthbbb.exec:\bthbbb.exe34⤵
- Executes dropped EXE
PID:2692 -
\??\c:\5pjdv.exec:\5pjdv.exe35⤵
- Executes dropped EXE
PID:4968 -
\??\c:\pppjd.exec:\pppjd.exe36⤵
- Executes dropped EXE
PID:5004 -
\??\c:\lrfxrxf.exec:\lrfxrxf.exe37⤵
- Executes dropped EXE
PID:4528 -
\??\c:\rllfxxr.exec:\rllfxxr.exe38⤵
- Executes dropped EXE
PID:2980 -
\??\c:\bhbtnn.exec:\bhbtnn.exe39⤵
- Executes dropped EXE
PID:4636 -
\??\c:\jvvpj.exec:\jvvpj.exe40⤵
- Executes dropped EXE
PID:1900 -
\??\c:\dvvpd.exec:\dvvpd.exe41⤵
- Executes dropped EXE
PID:3856 -
\??\c:\9fxrfff.exec:\9fxrfff.exe42⤵
- Executes dropped EXE
PID:536 -
\??\c:\3hnnnn.exec:\3hnnnn.exe43⤵
- Executes dropped EXE
PID:4308 -
\??\c:\bbbtnb.exec:\bbbtnb.exe44⤵
- Executes dropped EXE
PID:3592 -
\??\c:\3dvvd.exec:\3dvvd.exe45⤵
- Executes dropped EXE
PID:3560 -
\??\c:\lllfxxx.exec:\lllfxxx.exe46⤵
- Executes dropped EXE
PID:4912 -
\??\c:\3bhttn.exec:\3bhttn.exe47⤵
- Executes dropped EXE
PID:3960 -
\??\c:\dvpjd.exec:\dvpjd.exe48⤵
- Executes dropped EXE
PID:1148 -
\??\c:\1jdvp.exec:\1jdvp.exe49⤵
- Executes dropped EXE
PID:3588 -
\??\c:\lfxxffl.exec:\lfxxffl.exe50⤵
- Executes dropped EXE
PID:4864 -
\??\c:\nhnbbb.exec:\nhnbbb.exe51⤵
- Executes dropped EXE
PID:2944 -
\??\c:\pjjdv.exec:\pjjdv.exe52⤵
- Executes dropped EXE
PID:2720 -
\??\c:\vpjdv.exec:\vpjdv.exe53⤵
- Executes dropped EXE
PID:4800 -
\??\c:\1rllffx.exec:\1rllffx.exe54⤵
- Executes dropped EXE
PID:3892 -
\??\c:\hhhbtt.exec:\hhhbtt.exe55⤵
- Executes dropped EXE
PID:3220 -
\??\c:\bttnhh.exec:\bttnhh.exe56⤵
- Executes dropped EXE
PID:3256 -
\??\c:\dpvvp.exec:\dpvvp.exe57⤵
- Executes dropped EXE
PID:2452 -
\??\c:\lllflxr.exec:\lllflxr.exe58⤵
- Executes dropped EXE
PID:3408 -
\??\c:\rxrrrrf.exec:\rxrrrrf.exe59⤵
- Executes dropped EXE
PID:5048 -
\??\c:\bntnhb.exec:\bntnhb.exe60⤵
- Executes dropped EXE
PID:2736 -
\??\c:\5hhtnn.exec:\5hhtnn.exe61⤵
- Executes dropped EXE
PID:3772 -
\??\c:\ddjdd.exec:\ddjdd.exe62⤵
- Executes dropped EXE
PID:1052 -
\??\c:\lfllfff.exec:\lfllfff.exe63⤵
- Executes dropped EXE
PID:4024 -
\??\c:\btbtnb.exec:\btbtnb.exe64⤵
- Executes dropped EXE
PID:4944 -
\??\c:\ttbtnn.exec:\ttbtnn.exe65⤵
- Executes dropped EXE
PID:2816 -
\??\c:\pdjdv.exec:\pdjdv.exe66⤵PID:4320
-
\??\c:\fllfxxx.exec:\fllfxxx.exe67⤵PID:3144
-
\??\c:\bbnntt.exec:\bbnntt.exe68⤵PID:3364
-
\??\c:\9thbtt.exec:\9thbtt.exe69⤵PID:3660
-
\??\c:\dddpj.exec:\dddpj.exe70⤵PID:5024
-
\??\c:\dpvdv.exec:\dpvdv.exe71⤵PID:1680
-
\??\c:\xffxllf.exec:\xffxllf.exe72⤵PID:1280
-
\??\c:\xllrrrl.exec:\xllrrrl.exe73⤵PID:948
-
\??\c:\5ntnhb.exec:\5ntnhb.exe74⤵PID:2024
-
\??\c:\hbbttt.exec:\hbbttt.exe75⤵PID:3604
-
\??\c:\pjdpp.exec:\pjdpp.exe76⤵PID:1236
-
\??\c:\jvdvj.exec:\jvdvj.exe77⤵PID:3804
-
\??\c:\xrlxllf.exec:\xrlxllf.exe78⤵PID:2624
-
\??\c:\rxxxrxr.exec:\rxxxrxr.exe79⤵PID:1456
-
\??\c:\hbhbbb.exec:\hbhbbb.exe80⤵PID:3188
-
\??\c:\tnhbtn.exec:\tnhbtn.exe81⤵PID:1548
-
\??\c:\pdddv.exec:\pdddv.exe82⤵PID:1048
-
\??\c:\5fffxxx.exec:\5fffxxx.exe83⤵PID:1080
-
\??\c:\htnhtn.exec:\htnhtn.exe84⤵PID:2488
-
\??\c:\jdvpj.exec:\jdvpj.exe85⤵PID:4924
-
\??\c:\3lrflxf.exec:\3lrflxf.exe86⤵PID:2192
-
\??\c:\rxrrxfl.exec:\rxrrxfl.exe87⤵PID:2960
-
\??\c:\5nnnhh.exec:\5nnnhh.exe88⤵PID:388
-
\??\c:\pddvp.exec:\pddvp.exe89⤵PID:3944
-
\??\c:\ddvvj.exec:\ddvvj.exe90⤵PID:628
-
\??\c:\xflxxrr.exec:\xflxxrr.exe91⤵PID:4528
-
\??\c:\fxlfrrf.exec:\fxlfrrf.exe92⤵PID:1120
-
\??\c:\7flfxxr.exec:\7flfxxr.exe93⤵PID:404
-
\??\c:\bhhbbn.exec:\bhhbbn.exe94⤵PID:1392
-
\??\c:\pvvpp.exec:\pvvpp.exe95⤵PID:4292
-
\??\c:\lfxxrxx.exec:\lfxxrxx.exe96⤵PID:900
-
\??\c:\rrffxrr.exec:\rrffxrr.exe97⤵PID:4280
-
\??\c:\1tbbtt.exec:\1tbbtt.exe98⤵PID:4164
-
\??\c:\jpddv.exec:\jpddv.exe99⤵PID:1508
-
\??\c:\5ffrlfx.exec:\5ffrlfx.exe100⤵PID:1208
-
\??\c:\nbhbtt.exec:\nbhbtt.exe101⤵PID:4288
-
\??\c:\9btnbb.exec:\9btnbb.exe102⤵PID:4092
-
\??\c:\1jpjj.exec:\1jpjj.exe103⤵PID:3848
-
\??\c:\thtnnn.exec:\thtnnn.exe104⤵PID:4116
-
\??\c:\frrlxxl.exec:\frrlxxl.exe105⤵PID:4956
-
\??\c:\bnnnnt.exec:\bnnnnt.exe106⤵PID:3088
-
\??\c:\tntnbb.exec:\tntnbb.exe107⤵PID:3484
-
\??\c:\rllxrrf.exec:\rllxrrf.exe108⤵PID:4844
-
\??\c:\lxrxxxx.exec:\lxrxxxx.exe109⤵PID:4980
-
\??\c:\1hhbnb.exec:\1hhbnb.exe110⤵PID:3780
-
\??\c:\3jddv.exec:\3jddv.exe111⤵PID:3616
-
\??\c:\5xfxllf.exec:\5xfxllf.exe112⤵PID:4816
-
\??\c:\llllllr.exec:\llllllr.exe113⤵PID:4420
-
\??\c:\httntt.exec:\httntt.exe114⤵PID:3152
-
\??\c:\pjvpj.exec:\pjvpj.exe115⤵PID:2440
-
\??\c:\pvvjd.exec:\pvvjd.exe116⤵PID:3964
-
\??\c:\llxllff.exec:\llxllff.exe117⤵PID:4812
-
\??\c:\fffxxxx.exec:\fffxxxx.exe118⤵PID:4856
-
\??\c:\7hnnhh.exec:\7hnnhh.exe119⤵PID:4612
-
\??\c:\5hbthh.exec:\5hbthh.exe120⤵PID:3144
-
\??\c:\dvvdp.exec:\dvvdp.exe121⤵PID:3972
-
\??\c:\xlfxrll.exec:\xlfxrll.exe122⤵PID:1476
-
\??\c:\hnbttt.exec:\hnbttt.exe123⤵PID:5024
-
\??\c:\tbhbnb.exec:\tbhbnb.exe124⤵PID:4184
-
\??\c:\9pjvj.exec:\9pjvj.exe125⤵PID:1280
-
\??\c:\pjjdj.exec:\pjjdj.exe126⤵PID:1988
-
\??\c:\3fflxxf.exec:\3fflxxf.exe127⤵PID:412
-
\??\c:\nnnhnh.exec:\nnnhnh.exe128⤵PID:3148
-
\??\c:\5bbbbb.exec:\5bbbbb.exe129⤵PID:1236
-
\??\c:\vvpdj.exec:\vvpdj.exe130⤵PID:1672
-
\??\c:\fxxlxxr.exec:\fxxlxxr.exe131⤵PID:2204
-
\??\c:\xfllxrl.exec:\xfllxrl.exe132⤵PID:4508
-
\??\c:\ttttnn.exec:\ttttnn.exe133⤵PID:3188
-
\??\c:\9tthbt.exec:\9tthbt.exe134⤵PID:1548
-
\??\c:\jddvj.exec:\jddvj.exe135⤵PID:1048
-
\??\c:\7pjdp.exec:\7pjdp.exe136⤵PID:3404
-
\??\c:\xflrlrf.exec:\xflrlrf.exe137⤵PID:2488
-
\??\c:\nbbhht.exec:\nbbhht.exe138⤵PID:1928
-
\??\c:\vjpdv.exec:\vjpdv.exe139⤵PID:1808
-
\??\c:\djjdv.exec:\djjdv.exe140⤵PID:5064
-
\??\c:\rfxrrrx.exec:\rfxrrrx.exe141⤵PID:2348
-
\??\c:\rrrrrlf.exec:\rrrrrlf.exe142⤵PID:3944
-
\??\c:\tnnnhh.exec:\tnnnhh.exe143⤵PID:4036
-
\??\c:\dvvpd.exec:\dvvpd.exe144⤵PID:4528
-
\??\c:\jdjdd.exec:\jdjdd.exe145⤵PID:1900
-
\??\c:\rllrlff.exec:\rllrlff.exe146⤵PID:2696
-
\??\c:\7fxllll.exec:\7fxllll.exe147⤵PID:3672
-
\??\c:\hbnnhh.exec:\hbnnhh.exe148⤵PID:4292
-
\??\c:\vvvdj.exec:\vvvdj.exe149⤵PID:4160
-
\??\c:\9rrrfrf.exec:\9rrrfrf.exe150⤵PID:3560
-
\??\c:\rrffxfx.exec:\rrffxfx.exe151⤵PID:3980
-
\??\c:\5ntnhh.exec:\5ntnhh.exe152⤵PID:1836
-
\??\c:\9pvvp.exec:\9pvvp.exe153⤵PID:4860
-
\??\c:\vvddp.exec:\vvddp.exe154⤵PID:5020
-
\??\c:\9flfxxx.exec:\9flfxxx.exe155⤵PID:224
-
\??\c:\bnbhbb.exec:\bnbhbb.exe156⤵PID:2064
-
\??\c:\pvddp.exec:\pvddp.exe157⤵PID:3224
-
\??\c:\dvjdv.exec:\dvjdv.exe158⤵PID:5096
-
\??\c:\lllfrrl.exec:\lllfrrl.exe159⤵PID:1404
-
\??\c:\9fffxrr.exec:\9fffxrr.exe160⤵PID:2160
-
\??\c:\7ntnnh.exec:\7ntnnh.exe161⤵PID:3892
-
\??\c:\vppjd.exec:\vppjd.exe162⤵PID:1872
-
\??\c:\pdpdp.exec:\pdpdp.exe163⤵PID:3256
-
\??\c:\fffxxxx.exec:\fffxxxx.exe164⤵PID:2324
-
\??\c:\hbbtnh.exec:\hbbtnh.exe165⤵PID:2112
-
\??\c:\ppjdd.exec:\ppjdd.exe166⤵PID:4340
-
\??\c:\frfllll.exec:\frfllll.exe167⤵PID:2736
-
\??\c:\fxffxff.exec:\fxffxff.exe168⤵PID:3640
-
\??\c:\9nthhh.exec:\9nthhh.exe169⤵PID:2848
-
\??\c:\ttttnn.exec:\ttttnn.exe170⤵PID:2132
-
\??\c:\1vjjj.exec:\1vjjj.exe171⤵PID:1952
-
\??\c:\5lrlxxf.exec:\5lrlxxf.exe172⤵PID:1848
-
\??\c:\frrlxxr.exec:\frrlxxr.exe173⤵PID:2768
-
\??\c:\nnnhhh.exec:\nnnhhh.exe174⤵PID:2380
-
\??\c:\7jdvp.exec:\7jdvp.exe175⤵PID:3140
-
\??\c:\vpvvj.exec:\vpvvj.exe176⤵PID:1172
-
\??\c:\7xxrffx.exec:\7xxrffx.exe177⤵PID:3916
-
\??\c:\7fffxrx.exec:\7fffxrx.exe178⤵PID:668
-
\??\c:\tnhbtn.exec:\tnhbtn.exe179⤵PID:1376
-
\??\c:\ddppp.exec:\ddppp.exe180⤵PID:2444
-
\??\c:\pvddj.exec:\pvddj.exe181⤵PID:2612
-
\??\c:\flrlxxx.exec:\flrlxxx.exe182⤵PID:2732
-
\??\c:\tbbtnh.exec:\tbbtnh.exe183⤵PID:3172
-
\??\c:\3ddvj.exec:\3ddvj.exe184⤵PID:1080
-
\??\c:\jvpjv.exec:\jvpjv.exe185⤵PID:4400
-
\??\c:\rfxrrrf.exec:\rfxrrrf.exe186⤵PID:4948
-
\??\c:\xfxxxxx.exec:\xfxxxxx.exe187⤵PID:4044
-
\??\c:\nbbbtt.exec:\nbbbtt.exe188⤵PID:4968
-
\??\c:\bttthh.exec:\bttthh.exe189⤵PID:4576
-
\??\c:\pjppd.exec:\pjppd.exe190⤵PID:4828
-
\??\c:\vddvp.exec:\vddvp.exe191⤵PID:2980
-
\??\c:\3rfxrfl.exec:\3rfxrfl.exe192⤵PID:4880
-
\??\c:\htnhtn.exec:\htnhtn.exe193⤵PID:2296
-
\??\c:\tnnhbt.exec:\tnnhbt.exe194⤵PID:4784
-
\??\c:\vpddp.exec:\vpddp.exe195⤵PID:3860
-
\??\c:\vppvp.exec:\vppvp.exe196⤵PID:1896
-
\??\c:\3lfrffx.exec:\3lfrffx.exe197⤵PID:4568
-
\??\c:\lxxxxxx.exec:\lxxxxxx.exe198⤵PID:4412
-
\??\c:\nhnntn.exec:\nhnntn.exe199⤵PID:2068
-
\??\c:\vvppj.exec:\vvppj.exe200⤵PID:1920
-
\??\c:\3vvjv.exec:\3vvjv.exe201⤵PID:1836
-
\??\c:\lrxffxr.exec:\lrxffxr.exe202⤵PID:964
-
\??\c:\3frfxxr.exec:\3frfxxr.exe203⤵PID:3580
-
\??\c:\htnnbb.exec:\htnnbb.exe204⤵PID:1504
-
\??\c:\dpppd.exec:\dpppd.exe205⤵PID:4324
-
\??\c:\9dddp.exec:\9dddp.exe206⤵PID:3224
-
\??\c:\rlffrrr.exec:\rlffrrr.exe207⤵PID:2596
-
\??\c:\llffxll.exec:\llffxll.exe208⤵PID:4800
-
\??\c:\nbhhhb.exec:\nbhhhb.exe209⤵PID:4260
-
\??\c:\nhhnnt.exec:\nhhnnt.exe210⤵PID:3892
-
\??\c:\dvvjd.exec:\dvvjd.exe211⤵PID:2076
-
\??\c:\9lrrffx.exec:\9lrrffx.exe212⤵PID:3436
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe213⤵PID:4396
-
\??\c:\nnnttt.exec:\nnnttt.exe214⤵PID:2932
-
\??\c:\bhnhhb.exec:\bhnhhb.exe215⤵PID:4080
-
\??\c:\jdjvp.exec:\jdjvp.exe216⤵PID:2736
-
\??\c:\pdjjd.exec:\pdjjd.exe217⤵PID:1436
-
\??\c:\ffrrrrl.exec:\ffrrrrl.exe218⤵PID:2848
-
\??\c:\nhhhbh.exec:\nhhhbh.exe219⤵PID:3744
-
\??\c:\1nhbbt.exec:\1nhbbt.exe220⤵PID:1876
-
\??\c:\vvvpj.exec:\vvvpj.exe221⤵PID:1560
-
\??\c:\3rllrrl.exec:\3rllrrl.exe222⤵PID:2768
-
\??\c:\rlfxrxr.exec:\rlfxrxr.exe223⤵PID:2044
-
\??\c:\htbbtt.exec:\htbbtt.exe224⤵PID:4452
-
\??\c:\3ttttt.exec:\3ttttt.exe225⤵PID:1172
-
\??\c:\pjjjj.exec:\pjjjj.exe226⤵PID:1128
-
\??\c:\7jdjd.exec:\7jdjd.exe227⤵PID:1888
-
\??\c:\lxrrrlf.exec:\lxrrrlf.exe228⤵PID:4440
-
\??\c:\fxffrlr.exec:\fxffrlr.exe229⤵PID:1000
-
\??\c:\nbhbtt.exec:\nbhbtt.exe230⤵PID:3180
-
\??\c:\bttnhh.exec:\bttnhh.exe231⤵PID:412
-
\??\c:\vvdjp.exec:\vvdjp.exe232⤵PID:4352
-
\??\c:\ddjdv.exec:\ddjdv.exe233⤵PID:4424
-
\??\c:\lrllffx.exec:\lrllffx.exe234⤵PID:1376
-
\??\c:\btnhbb.exec:\btnhbb.exe235⤵PID:4508
-
\??\c:\tnnbtt.exec:\tnnbtt.exe236⤵PID:3188
-
\??\c:\dvvpp.exec:\dvvpp.exe237⤵PID:2732
-
\??\c:\jdddp.exec:\jdddp.exe238⤵PID:1980
-
\??\c:\fxfffxf.exec:\fxfffxf.exe239⤵PID:3404
-
\??\c:\7tbbhb.exec:\7tbbhb.exe240⤵PID:4400
-
\??\c:\hnhbhh.exec:\hnhbhh.exe241⤵PID:4948
-
\??\c:\5pddp.exec:\5pddp.exe242⤵PID:388