Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 15:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e0407ffc9cf647a120d8198331dcb0f0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
e0407ffc9cf647a120d8198331dcb0f0_NeikiAnalytics.exe
-
Size
443KB
-
MD5
e0407ffc9cf647a120d8198331dcb0f0
-
SHA1
335fe0a0253e3d0bb1b1ef0378c46446b831991d
-
SHA256
c3153848133f63b17670feec9c4785ecdb28e3f57828f077de4b577dbd231291
-
SHA512
a0b5b9a5deb9550eb85cd8d47d9f83cb2279af1ae59faaf4dd97e21b0e9713db490ba6ee9784bfd20ca309814ddaf55e83a3bf458bf1872675d6c79438436809
-
SSDEEP
6144:n3C9BRo7tvnJ9Fywhk/T4i37K3BoKg0p5WI09JQ:n3C9ytvn8whkb4i3e3GFO6JQ
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/2336-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1308-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1428-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2892-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3084-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3608-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3392-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3276-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1360-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3536-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4476-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5040-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/464-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3376-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4284-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/524-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2932-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3296-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2280-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4148-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/60-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3320-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1748-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
9lrllll.exehtbbbb.exedvjpd.exebttnnn.exepdddd.exevpvvv.exelfrrrrx.exennhnnt.exenthhhh.exejvdvv.exexxxrlxx.exejjpjd.exe1btthn.exepvvvv.exehnnttt.exe3vddj.exelrxxxff.exevpvdd.exe3nttth.exepjppp.exe7rlffll.exejvpjj.exetnhhbh.exedjdjv.exebhtttb.exexlxrrlr.exepjpdj.exefxrrllf.exelffxxxr.exetbnbth.exejjvjp.exenhtttt.exe7vddd.exerlrrffr.exebbhtth.exevdjjj.exerrlffrf.exetbbbth.exejvdjj.exexxllffx.exenhhbbh.exeppvvj.exerxfxxxr.exehbttbn.exe9pdvj.exedpppj.exe5rllfxx.exeflxlrll.exettbhtb.exe5jppv.exerxxffll.exethttbn.exehbbbbb.exeppppp.exexrxxrrr.exelrrrxrr.exebhhbtt.exedpdjv.exefflfflf.exentttnn.exedjppp.exexxrxllx.exelflllrf.exe5bnbnh.exepid process 1308 9lrllll.exe 1428 htbbbb.exe 2892 dvjpd.exe 3084 bttnnn.exe 3832 pdddd.exe 3608 vpvvv.exe 3392 lfrrrrx.exe 3276 nnhnnt.exe 1360 nthhhh.exe 5060 jvdvv.exe 2456 xxxrlxx.exe 3536 jjpjd.exe 4476 1btthn.exe 3428 pvvvv.exe 5040 hnnttt.exe 464 3vddj.exe 4456 lrxxxff.exe 3376 vpvdd.exe 3660 3nttth.exe 4284 pjppp.exe 524 7rlffll.exe 2932 jvpjj.exe 1616 tnhhbh.exe 3296 djdjv.exe 2280 bhtttb.exe 3048 xlxrrlr.exe 4148 pjpdj.exe 60 fxrrllf.exe 3320 lffxxxr.exe 4364 tbnbth.exe 1748 jjvjp.exe 1692 nhtttt.exe 432 7vddd.exe 1000 rlrrffr.exe 4572 bbhtth.exe 1632 vdjjj.exe 4404 rrlffrf.exe 2656 tbbbth.exe 1804 jvdjj.exe 4220 xxllffx.exe 1428 nhhbbh.exe 3488 ppvvj.exe 2952 rxfxxxr.exe 1176 hbttbn.exe 2500 9pdvj.exe 4592 dpppj.exe 4588 5rllfxx.exe 1420 flxlrll.exe 3392 ttbhtb.exe 436 5jppv.exe 2204 rxxffll.exe 3736 thttbn.exe 3640 hbbbbb.exe 4668 ppppp.exe 1388 xrxxrrr.exe 3536 lrrrxrr.exe 8 bhhbtt.exe 1676 dpdjv.exe 444 fflfflf.exe 4716 ntttnn.exe 3388 djppp.exe 1956 xxrxllx.exe 2368 lflllrf.exe 1240 5bnbnh.exe -
Processes:
resource yara_rule behavioral2/memory/2336-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1308-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1428-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2892-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3084-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3608-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3392-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3276-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1360-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3536-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5040-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/464-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3376-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/524-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2932-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3296-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4148-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/60-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3320-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1748-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e0407ffc9cf647a120d8198331dcb0f0_NeikiAnalytics.exe9lrllll.exehtbbbb.exedvjpd.exebttnnn.exepdddd.exevpvvv.exelfrrrrx.exennhnnt.exenthhhh.exejvdvv.exexxxrlxx.exejjpjd.exe1btthn.exepvvvv.exehnnttt.exe3vddj.exelrxxxff.exevpvdd.exe3nttth.exepjppp.exe7rlffll.exedescription pid process target process PID 2336 wrote to memory of 1308 2336 e0407ffc9cf647a120d8198331dcb0f0_NeikiAnalytics.exe 9lrllll.exe PID 2336 wrote to memory of 1308 2336 e0407ffc9cf647a120d8198331dcb0f0_NeikiAnalytics.exe 9lrllll.exe PID 2336 wrote to memory of 1308 2336 e0407ffc9cf647a120d8198331dcb0f0_NeikiAnalytics.exe 9lrllll.exe PID 1308 wrote to memory of 1428 1308 9lrllll.exe htbbbb.exe PID 1308 wrote to memory of 1428 1308 9lrllll.exe htbbbb.exe PID 1308 wrote to memory of 1428 1308 9lrllll.exe htbbbb.exe PID 1428 wrote to memory of 2892 1428 htbbbb.exe dvjpd.exe PID 1428 wrote to memory of 2892 1428 htbbbb.exe dvjpd.exe PID 1428 wrote to memory of 2892 1428 htbbbb.exe dvjpd.exe PID 2892 wrote to memory of 3084 2892 dvjpd.exe bttnnn.exe PID 2892 wrote to memory of 3084 2892 dvjpd.exe bttnnn.exe PID 2892 wrote to memory of 3084 2892 dvjpd.exe bttnnn.exe PID 3084 wrote to memory of 3832 3084 bttnnn.exe pdddd.exe PID 3084 wrote to memory of 3832 3084 bttnnn.exe pdddd.exe PID 3084 wrote to memory of 3832 3084 bttnnn.exe pdddd.exe PID 3832 wrote to memory of 3608 3832 pdddd.exe vpvvv.exe PID 3832 wrote to memory of 3608 3832 pdddd.exe vpvvv.exe PID 3832 wrote to memory of 3608 3832 pdddd.exe vpvvv.exe PID 3608 wrote to memory of 3392 3608 vpvvv.exe lfrrrrx.exe PID 3608 wrote to memory of 3392 3608 vpvvv.exe lfrrrrx.exe PID 3608 wrote to memory of 3392 3608 vpvvv.exe lfrrrrx.exe PID 3392 wrote to memory of 3276 3392 lfrrrrx.exe nnhnnt.exe PID 3392 wrote to memory of 3276 3392 lfrrrrx.exe nnhnnt.exe PID 3392 wrote to memory of 3276 3392 lfrrrrx.exe nnhnnt.exe PID 3276 wrote to memory of 1360 3276 nnhnnt.exe nthhhh.exe PID 3276 wrote to memory of 1360 3276 nnhnnt.exe nthhhh.exe PID 3276 wrote to memory of 1360 3276 nnhnnt.exe nthhhh.exe PID 1360 wrote to memory of 5060 1360 nthhhh.exe jvdvv.exe PID 1360 wrote to memory of 5060 1360 nthhhh.exe jvdvv.exe PID 1360 wrote to memory of 5060 1360 nthhhh.exe jvdvv.exe PID 5060 wrote to memory of 2456 5060 jvdvv.exe xxxrlxx.exe PID 5060 wrote to memory of 2456 5060 jvdvv.exe xxxrlxx.exe PID 5060 wrote to memory of 2456 5060 jvdvv.exe xxxrlxx.exe PID 2456 wrote to memory of 3536 2456 xxxrlxx.exe jjpjd.exe PID 2456 wrote to memory of 3536 2456 xxxrlxx.exe jjpjd.exe PID 2456 wrote to memory of 3536 2456 xxxrlxx.exe jjpjd.exe PID 3536 wrote to memory of 4476 3536 jjpjd.exe 1btthn.exe PID 3536 wrote to memory of 4476 3536 jjpjd.exe 1btthn.exe PID 3536 wrote to memory of 4476 3536 jjpjd.exe 1btthn.exe PID 4476 wrote to memory of 3428 4476 1btthn.exe pvvvv.exe PID 4476 wrote to memory of 3428 4476 1btthn.exe pvvvv.exe PID 4476 wrote to memory of 3428 4476 1btthn.exe pvvvv.exe PID 3428 wrote to memory of 5040 3428 pvvvv.exe hnnttt.exe PID 3428 wrote to memory of 5040 3428 pvvvv.exe hnnttt.exe PID 3428 wrote to memory of 5040 3428 pvvvv.exe hnnttt.exe PID 5040 wrote to memory of 464 5040 hnnttt.exe 3vddj.exe PID 5040 wrote to memory of 464 5040 hnnttt.exe 3vddj.exe PID 5040 wrote to memory of 464 5040 hnnttt.exe 3vddj.exe PID 464 wrote to memory of 4456 464 3vddj.exe lrxxxff.exe PID 464 wrote to memory of 4456 464 3vddj.exe lrxxxff.exe PID 464 wrote to memory of 4456 464 3vddj.exe lrxxxff.exe PID 4456 wrote to memory of 3376 4456 lrxxxff.exe vpvdd.exe PID 4456 wrote to memory of 3376 4456 lrxxxff.exe vpvdd.exe PID 4456 wrote to memory of 3376 4456 lrxxxff.exe vpvdd.exe PID 3376 wrote to memory of 3660 3376 vpvdd.exe 3nttth.exe PID 3376 wrote to memory of 3660 3376 vpvdd.exe 3nttth.exe PID 3376 wrote to memory of 3660 3376 vpvdd.exe 3nttth.exe PID 3660 wrote to memory of 4284 3660 3nttth.exe pjppp.exe PID 3660 wrote to memory of 4284 3660 3nttth.exe pjppp.exe PID 3660 wrote to memory of 4284 3660 3nttth.exe pjppp.exe PID 4284 wrote to memory of 524 4284 pjppp.exe 7rlffll.exe PID 4284 wrote to memory of 524 4284 pjppp.exe 7rlffll.exe PID 4284 wrote to memory of 524 4284 pjppp.exe 7rlffll.exe PID 524 wrote to memory of 2932 524 7rlffll.exe jvpjj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0407ffc9cf647a120d8198331dcb0f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e0407ffc9cf647a120d8198331dcb0f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\9lrllll.exec:\9lrllll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\htbbbb.exec:\htbbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\dvjpd.exec:\dvjpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\bttnnn.exec:\bttnnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\pdddd.exec:\pdddd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
\??\c:\vpvvv.exec:\vpvvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\lfrrrrx.exec:\lfrrrrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\nnhnnt.exec:\nnhnnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
\??\c:\nthhhh.exec:\nthhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\jvdvv.exec:\jvdvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\xxxrlxx.exec:\xxxrlxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\jjpjd.exec:\jjpjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\1btthn.exec:\1btthn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\pvvvv.exec:\pvvvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\hnnttt.exec:\hnnttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\3vddj.exec:\3vddj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\lrxxxff.exec:\lrxxxff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\vpvdd.exec:\vpvdd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
\??\c:\3nttth.exec:\3nttth.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\pjppp.exec:\pjppp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\7rlffll.exec:\7rlffll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:524 -
\??\c:\jvpjj.exec:\jvpjj.exe23⤵
- Executes dropped EXE
PID:2932 -
\??\c:\tnhhbh.exec:\tnhhbh.exe24⤵
- Executes dropped EXE
PID:1616 -
\??\c:\djdjv.exec:\djdjv.exe25⤵
- Executes dropped EXE
PID:3296 -
\??\c:\bhtttb.exec:\bhtttb.exe26⤵
- Executes dropped EXE
PID:2280 -
\??\c:\xlxrrlr.exec:\xlxrrlr.exe27⤵
- Executes dropped EXE
PID:3048 -
\??\c:\pjpdj.exec:\pjpdj.exe28⤵
- Executes dropped EXE
PID:4148 -
\??\c:\fxrrllf.exec:\fxrrllf.exe29⤵
- Executes dropped EXE
PID:60 -
\??\c:\lffxxxr.exec:\lffxxxr.exe30⤵
- Executes dropped EXE
PID:3320 -
\??\c:\tbnbth.exec:\tbnbth.exe31⤵
- Executes dropped EXE
PID:4364 -
\??\c:\jjvjp.exec:\jjvjp.exe32⤵
- Executes dropped EXE
PID:1748 -
\??\c:\nhtttt.exec:\nhtttt.exe33⤵
- Executes dropped EXE
PID:1692 -
\??\c:\7vddd.exec:\7vddd.exe34⤵
- Executes dropped EXE
PID:432 -
\??\c:\rlrrffr.exec:\rlrrffr.exe35⤵
- Executes dropped EXE
PID:1000 -
\??\c:\bbhtth.exec:\bbhtth.exe36⤵
- Executes dropped EXE
PID:4572 -
\??\c:\vdjjj.exec:\vdjjj.exe37⤵
- Executes dropped EXE
PID:1632 -
\??\c:\rrlffrf.exec:\rrlffrf.exe38⤵
- Executes dropped EXE
PID:4404 -
\??\c:\tbbbth.exec:\tbbbth.exe39⤵
- Executes dropped EXE
PID:2656 -
\??\c:\jvdjj.exec:\jvdjj.exe40⤵
- Executes dropped EXE
PID:1804 -
\??\c:\xxllffx.exec:\xxllffx.exe41⤵
- Executes dropped EXE
PID:4220 -
\??\c:\nhhbbh.exec:\nhhbbh.exe42⤵
- Executes dropped EXE
PID:1428 -
\??\c:\ppvvj.exec:\ppvvj.exe43⤵
- Executes dropped EXE
PID:3488 -
\??\c:\rxfxxxr.exec:\rxfxxxr.exe44⤵
- Executes dropped EXE
PID:2952 -
\??\c:\hbttbn.exec:\hbttbn.exe45⤵
- Executes dropped EXE
PID:1176 -
\??\c:\9pdvj.exec:\9pdvj.exe46⤵
- Executes dropped EXE
PID:2500 -
\??\c:\dpppj.exec:\dpppj.exe47⤵
- Executes dropped EXE
PID:4592 -
\??\c:\5rllfxx.exec:\5rllfxx.exe48⤵
- Executes dropped EXE
PID:4588 -
\??\c:\flxlrll.exec:\flxlrll.exe49⤵
- Executes dropped EXE
PID:1420 -
\??\c:\ttbhtb.exec:\ttbhtb.exe50⤵
- Executes dropped EXE
PID:3392 -
\??\c:\5jppv.exec:\5jppv.exe51⤵
- Executes dropped EXE
PID:436 -
\??\c:\rxxffll.exec:\rxxffll.exe52⤵
- Executes dropped EXE
PID:2204 -
\??\c:\thttbn.exec:\thttbn.exe53⤵
- Executes dropped EXE
PID:3736 -
\??\c:\hbbbbb.exec:\hbbbbb.exe54⤵
- Executes dropped EXE
PID:3640 -
\??\c:\ppppp.exec:\ppppp.exe55⤵
- Executes dropped EXE
PID:4668 -
\??\c:\xrxxrrr.exec:\xrxxrrr.exe56⤵
- Executes dropped EXE
PID:1388 -
\??\c:\lrrrxrr.exec:\lrrrxrr.exe57⤵
- Executes dropped EXE
PID:3536 -
\??\c:\bhhbtt.exec:\bhhbtt.exe58⤵
- Executes dropped EXE
PID:8 -
\??\c:\dpdjv.exec:\dpdjv.exe59⤵
- Executes dropped EXE
PID:1676 -
\??\c:\fflfflf.exec:\fflfflf.exe60⤵
- Executes dropped EXE
PID:444 -
\??\c:\ntttnn.exec:\ntttnn.exe61⤵
- Executes dropped EXE
PID:4716 -
\??\c:\djppp.exec:\djppp.exe62⤵
- Executes dropped EXE
PID:3388 -
\??\c:\xxrxllx.exec:\xxrxllx.exe63⤵
- Executes dropped EXE
PID:1956 -
\??\c:\lflllrf.exec:\lflllrf.exe64⤵
- Executes dropped EXE
PID:2368 -
\??\c:\5bnbnh.exec:\5bnbnh.exe65⤵
- Executes dropped EXE
PID:1240 -
\??\c:\djvdd.exec:\djvdd.exe66⤵PID:2912
-
\??\c:\ffffxrr.exec:\ffffxrr.exe67⤵PID:2124
-
\??\c:\nbbtbt.exec:\nbbtbt.exe68⤵PID:4928
-
\??\c:\ppvdv.exec:\ppvdv.exe69⤵PID:4156
-
\??\c:\5rllffx.exec:\5rllffx.exe70⤵PID:4772
-
\??\c:\xflfrrl.exec:\xflfrrl.exe71⤵PID:2932
-
\??\c:\tntbbn.exec:\tntbbn.exe72⤵PID:1616
-
\??\c:\ddvpj.exec:\ddvpj.exe73⤵PID:1924
-
\??\c:\rfflfxr.exec:\rfflfxr.exe74⤵PID:3996
-
\??\c:\9thhhh.exec:\9thhhh.exe75⤵PID:2280
-
\??\c:\9pddp.exec:\9pddp.exe76⤵PID:4032
-
\??\c:\fllfrlf.exec:\fllfrlf.exe77⤵PID:3796
-
\??\c:\btbbhh.exec:\btbbhh.exe78⤵PID:3808
-
\??\c:\hnbnbb.exec:\hnbnbb.exe79⤵PID:3960
-
\??\c:\jjdjj.exec:\jjdjj.exe80⤵PID:1480
-
\??\c:\frxxxxr.exec:\frxxxxr.exe81⤵PID:1052
-
\??\c:\nnbnnh.exec:\nnbnnh.exe82⤵PID:2808
-
\??\c:\pjddv.exec:\pjddv.exe83⤵PID:3416
-
\??\c:\pjjdd.exec:\pjjdd.exe84⤵PID:5016
-
\??\c:\xrxfllf.exec:\xrxfllf.exe85⤵PID:1184
-
\??\c:\5bhthb.exec:\5bhthb.exe86⤵PID:3060
-
\??\c:\ppvvv.exec:\ppvvv.exe87⤵PID:4644
-
\??\c:\frfllff.exec:\frfllff.exe88⤵PID:4412
-
\??\c:\htbbtb.exec:\htbbtb.exe89⤵PID:2724
-
\??\c:\btbbtt.exec:\btbbtt.exe90⤵PID:2584
-
\??\c:\5vdjj.exec:\5vdjj.exe91⤵PID:1912
-
\??\c:\xlrlffx.exec:\xlrlffx.exe92⤵PID:920
-
\??\c:\bnnbtn.exec:\bnnbtn.exe93⤵PID:3780
-
\??\c:\nbntnn.exec:\nbntnn.exe94⤵PID:2440
-
\??\c:\jpddp.exec:\jpddp.exe95⤵PID:3084
-
\??\c:\flrlllf.exec:\flrlllf.exe96⤵PID:4232
-
\??\c:\nnbnnb.exec:\nnbnnb.exe97⤵PID:2988
-
\??\c:\pdjdv.exec:\pdjdv.exe98⤵PID:532
-
\??\c:\lxfxrfx.exec:\lxfxrfx.exe99⤵PID:3152
-
\??\c:\5fffflr.exec:\5fffflr.exe100⤵PID:396
-
\??\c:\ttnnnt.exec:\ttnnnt.exe101⤵PID:4816
-
\??\c:\9vvvv.exec:\9vvvv.exe102⤵PID:740
-
\??\c:\xxllxxf.exec:\xxllxxf.exe103⤵PID:2504
-
\??\c:\1nhtnb.exec:\1nhtnb.exe104⤵PID:3236
-
\??\c:\jpvjd.exec:\jpvjd.exe105⤵PID:3188
-
\??\c:\frrlffx.exec:\frrlffx.exe106⤵PID:608
-
\??\c:\llxxlfr.exec:\llxxlfr.exe107⤵PID:3928
-
\??\c:\nnbtnn.exec:\nnbtnn.exe108⤵PID:4676
-
\??\c:\vvpvv.exec:\vvpvv.exe109⤵PID:8
-
\??\c:\dpddj.exec:\dpddj.exe110⤵PID:64
-
\??\c:\7rxxxxx.exec:\7rxxxxx.exe111⤵PID:1356
-
\??\c:\bhthhb.exec:\bhthhb.exe112⤵PID:4716
-
\??\c:\vpvvd.exec:\vpvvd.exe113⤵PID:3388
-
\??\c:\lfxxrlf.exec:\lfxxrlf.exe114⤵PID:4728
-
\??\c:\lfxllfr.exec:\lfxllfr.exe115⤵PID:1712
-
\??\c:\7ttnhb.exec:\7ttnhb.exe116⤵PID:1240
-
\??\c:\7jjvp.exec:\7jjvp.exe117⤵PID:2912
-
\??\c:\fxxrlfr.exec:\fxxrlfr.exe118⤵PID:3616
-
\??\c:\rllxrrl.exec:\rllxrrl.exe119⤵PID:4928
-
\??\c:\hbhbbt.exec:\hbhbbt.exe120⤵PID:3696
-
\??\c:\ddpdd.exec:\ddpdd.exe121⤵PID:4772
-
\??\c:\rrxrllx.exec:\rrxrllx.exe122⤵PID:4460
-
\??\c:\lxxrlxr.exec:\lxxrlxr.exe123⤵PID:1616
-
\??\c:\tnhhbb.exec:\tnhhbb.exe124⤵PID:2056
-
\??\c:\vdjdp.exec:\vdjdp.exe125⤵PID:3996
-
\??\c:\pddvj.exec:\pddvj.exe126⤵PID:1504
-
\??\c:\xrlfrrf.exec:\xrlfrrf.exe127⤵PID:2168
-
\??\c:\nhhbnn.exec:\nhhbnn.exe128⤵PID:1008
-
\??\c:\pjjdv.exec:\pjjdv.exe129⤵PID:3320
-
\??\c:\lffxrlf.exec:\lffxrlf.exe130⤵PID:2096
-
\??\c:\fffxrrl.exec:\fffxrrl.exe131⤵PID:4364
-
\??\c:\nnhbtn.exec:\nnhbtn.exe132⤵PID:4696
-
\??\c:\vvjpd.exec:\vvjpd.exe133⤵PID:4132
-
\??\c:\lffxxxr.exec:\lffxxxr.exe134⤵PID:1520
-
\??\c:\llllrxr.exec:\llllrxr.exe135⤵PID:3624
-
\??\c:\nhhbtn.exec:\nhhbtn.exe136⤵PID:4884
-
\??\c:\dpvjj.exec:\dpvjj.exe137⤵PID:4612
-
\??\c:\rlffxxx.exec:\rlffxxx.exe138⤵PID:4388
-
\??\c:\lfrrllx.exec:\lfrrllx.exe139⤵PID:868
-
\??\c:\1tbtnb.exec:\1tbtnb.exe140⤵PID:2288
-
\??\c:\dpvpp.exec:\dpvpp.exe141⤵PID:2480
-
\??\c:\vpdjp.exec:\vpdjp.exe142⤵PID:4508
-
\??\c:\rffxxxr.exec:\rffxxxr.exe143⤵PID:3052
-
\??\c:\bbtnnn.exec:\bbtnnn.exe144⤵PID:2952
-
\??\c:\ntbbtn.exec:\ntbbtn.exe145⤵PID:4048
-
\??\c:\ddjdv.exec:\ddjdv.exe146⤵PID:2420
-
\??\c:\lffrxll.exec:\lffrxll.exe147⤵PID:3832
-
\??\c:\htthbb.exec:\htthbb.exe148⤵PID:3308
-
\??\c:\nbbnhb.exec:\nbbnhb.exe149⤵PID:4480
-
\??\c:\dpjvp.exec:\dpjvp.exe150⤵PID:1668
-
\??\c:\lflfrlx.exec:\lflfrlx.exe151⤵PID:2956
-
\??\c:\xrxlrlf.exec:\xrxlrlf.exe152⤵PID:2268
-
\??\c:\nhbnhb.exec:\nhbnhb.exe153⤵PID:2884
-
\??\c:\pjjdp.exec:\pjjdp.exe154⤵PID:2876
-
\??\c:\5dpjv.exec:\5dpjv.exe155⤵PID:4476
-
\??\c:\lllffxr.exec:\lllffxr.exe156⤵PID:812
-
\??\c:\lffxxrx.exec:\lffxxrx.exe157⤵PID:5052
-
\??\c:\bntnhb.exec:\bntnhb.exe158⤵PID:3428
-
\??\c:\1ddvj.exec:\1ddvj.exe159⤵PID:5040
-
\??\c:\xxfxfll.exec:\xxfxfll.exe160⤵PID:2924
-
\??\c:\lrxrllf.exec:\lrxrllf.exe161⤵PID:1088
-
\??\c:\thnhhb.exec:\thnhhb.exe162⤵PID:4456
-
\??\c:\jdvjd.exec:\jdvjd.exe163⤵PID:3604
-
\??\c:\xlrrrlr.exec:\xlrrrlr.exe164⤵PID:4932
-
\??\c:\xrlfxrl.exec:\xrlfxrl.exe165⤵PID:2192
-
\??\c:\3nnnbb.exec:\3nnnbb.exe166⤵PID:1240
-
\??\c:\vpjdp.exec:\vpjdp.exe167⤵PID:2912
-
\??\c:\lxfrfxl.exec:\lxfrfxl.exe168⤵PID:4836
-
\??\c:\frxfxrl.exec:\frxfxrl.exe169⤵PID:4928
-
\??\c:\bnhbbt.exec:\bnhbbt.exe170⤵PID:2932
-
\??\c:\vvvjj.exec:\vvvjj.exe171⤵PID:4940
-
\??\c:\fllffrx.exec:\fllffrx.exe172⤵PID:1924
-
\??\c:\frxxrrl.exec:\frxxrrl.exe173⤵PID:4948
-
\??\c:\ttbtnb.exec:\ttbtnb.exe174⤵PID:2056
-
\??\c:\vjvpp.exec:\vjvpp.exe175⤵PID:4032
-
\??\c:\vjppj.exec:\vjppj.exe176⤵PID:4692
-
\??\c:\9xlllxx.exec:\9xlllxx.exe177⤵PID:2156
-
\??\c:\5hhbtt.exec:\5hhbtt.exe178⤵PID:1544
-
\??\c:\1pddd.exec:\1pddd.exe179⤵PID:4704
-
\??\c:\jdvpv.exec:\jdvpv.exe180⤵PID:2144
-
\??\c:\llxfxxx.exec:\llxfxxx.exe181⤵PID:4072
-
\??\c:\hhtnnt.exec:\hhtnnt.exe182⤵PID:1604
-
\??\c:\ppjpv.exec:\ppjpv.exe183⤵PID:2372
-
\??\c:\frlxxrl.exec:\frlxxrl.exe184⤵PID:4164
-
\??\c:\9nhbhb.exec:\9nhbhb.exe185⤵PID:3060
-
\??\c:\bhbnbt.exec:\bhbnbt.exe186⤵PID:2576
-
\??\c:\jjdjd.exec:\jjdjd.exe187⤵PID:4412
-
\??\c:\9lxrrrf.exec:\9lxrrrf.exe188⤵PID:1704
-
\??\c:\nntntn.exec:\nntntn.exe189⤵PID:4936
-
\??\c:\nbnbnn.exec:\nbnbnn.exe190⤵PID:1964
-
\??\c:\vddvv.exec:\vddvv.exe191⤵PID:2024
-
\??\c:\flflffl.exec:\flflffl.exe192⤵PID:1224
-
\??\c:\1nhbtb.exec:\1nhbtb.exe193⤵PID:3132
-
\??\c:\jjddv.exec:\jjddv.exe194⤵PID:1392
-
\??\c:\dvpdj.exec:\dvpdj.exe195⤵PID:4588
-
\??\c:\rxxffff.exec:\rxxffff.exe196⤵PID:2128
-
\??\c:\thnhbb.exec:\thnhbb.exe197⤵PID:2400
-
\??\c:\vppjd.exec:\vppjd.exe198⤵PID:3276
-
\??\c:\pddvv.exec:\pddvv.exe199⤵PID:2132
-
\??\c:\9lfllrx.exec:\9lfllrx.exe200⤵PID:4776
-
\??\c:\btbhhn.exec:\btbhhn.exe201⤵PID:4740
-
\??\c:\djppd.exec:\djppd.exe202⤵PID:3184
-
\??\c:\lffxrll.exec:\lffxrll.exe203⤵PID:2856
-
\??\c:\lfrlfff.exec:\lfrlfff.exe204⤵PID:3712
-
\??\c:\hhnnhh.exec:\hhnnhh.exe205⤵PID:3928
-
\??\c:\pvjjj.exec:\pvjjj.exe206⤵PID:1676
-
\??\c:\flxrxxf.exec:\flxrxxf.exe207⤵PID:8
-
\??\c:\bhhbbb.exec:\bhhbbb.exe208⤵PID:64
-
\??\c:\htbtnb.exec:\htbtnb.exe209⤵PID:1356
-
\??\c:\vvppv.exec:\vvppv.exe210⤵PID:1956
-
\??\c:\lfrrflf.exec:\lfrrflf.exe211⤵PID:3388
-
\??\c:\nnbbhn.exec:\nnbbhn.exe212⤵PID:4568
-
\??\c:\dvppp.exec:\dvppp.exe213⤵PID:1712
-
\??\c:\lrxllxr.exec:\lrxllxr.exe214⤵PID:2124
-
\??\c:\xlrlffx.exec:\xlrlffx.exe215⤵PID:1484
-
\??\c:\btnbtt.exec:\btnbtt.exe216⤵PID:3616
-
\??\c:\dpddj.exec:\dpddj.exe217⤵PID:4228
-
\??\c:\rxrrxfr.exec:\rxrrxfr.exe218⤵PID:3696
-
\??\c:\rlrlllf.exec:\rlrlllf.exe219⤵PID:4772
-
\??\c:\bttnnn.exec:\bttnnn.exe220⤵PID:4460
-
\??\c:\jjvjv.exec:\jjvjv.exe221⤵PID:540
-
\??\c:\frfxxff.exec:\frfxxff.exe222⤵PID:3708
-
\??\c:\xfrlffx.exec:\xfrlffx.exe223⤵PID:3996
-
\??\c:\bhnhbh.exec:\bhnhbh.exe224⤵PID:2604
-
\??\c:\ddvpj.exec:\ddvpj.exe225⤵PID:4012
-
\??\c:\fffffff.exec:\fffffff.exe226⤵PID:2068
-
\??\c:\rrxlffx.exec:\rrxlffx.exe227⤵PID:1016
-
\??\c:\hhhbnn.exec:\hhhbnn.exe228⤵PID:1052
-
\??\c:\dvdvj.exec:\dvdvj.exe229⤵PID:2732
-
\??\c:\pdddv.exec:\pdddv.exe230⤵PID:2784
-
\??\c:\rfrlflf.exec:\rfrlflf.exe231⤵PID:3160
-
\??\c:\nhtnbt.exec:\nhtnbt.exe232⤵PID:4408
-
\??\c:\9vvvj.exec:\9vvvj.exe233⤵PID:4980
-
\??\c:\1pvpd.exec:\1pvpd.exe234⤵PID:1804
-
\??\c:\xrxrxxr.exec:\xrxrxxr.exe235⤵PID:4852
-
\??\c:\bbnhbh.exec:\bbnhbh.exe236⤵PID:452
-
\??\c:\bnnbbt.exec:\bnnbbt.exe237⤵PID:4936
-
\??\c:\jddpj.exec:\jddpj.exe238⤵PID:1176
-
\??\c:\9rfxrfx.exec:\9rfxrfx.exe239⤵PID:2500
-
\??\c:\5hhbnt.exec:\5hhbnt.exe240⤵PID:3608
-
\??\c:\7ttnhh.exec:\7ttnhh.exe241⤵PID:2972
-
\??\c:\vpjdp.exec:\vpjdp.exe242⤵PID:1420