Analysis
-
max time kernel
150s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 15:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e26007e4db2359cc2a4e052765839f70_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
e26007e4db2359cc2a4e052765839f70_NeikiAnalytics.exe
-
Size
65KB
-
MD5
e26007e4db2359cc2a4e052765839f70
-
SHA1
f32cb25597a63e106df79d3fe0b37cbcac00ea2c
-
SHA256
603cccfe76c4f9bd06a8cee8289a76480a84f54401c0e9fd74e23080dc737d81
-
SHA512
0716768eed2e0ab87f8abf7ab0d19807fae32ba9b9a757a473dd0ffecdafb11532325d67ad3c14be71298f8d9314f5690a772673afc3a1cbcbd3690c062eb796
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfc:ymb3NkkiQ3mdBjFI4V4
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral2/memory/4524-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3472-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3936-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2936-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3356-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4272-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3296-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5072-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3932-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2848-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/984-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1072-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5088-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4312-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4364-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1048-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/940-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3264-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
3jpjv.exe3flxrrf.exe7ffxrrl.exetnbtnh.exe3bbtbb.exedjpdp.exepjjdj.exe5lrfrlf.exehntbhh.exehtbttt.exejvjdv.exepvjjv.exefxxlxxr.exexlrflff.exenhhbhn.exebbnnhb.exepjppd.exe9dvpd.exe9xrllff.exehbhtth.exenbbnhb.exeddjjp.exejdvjv.exe1rlfxll.exe1lrrrxf.exebtthbh.exejdjjv.exedvvpd.exelxxxrll.exefflfxfx.exehhbtnn.exehbhhnh.exe5jpjd.exepvpjv.exelflffrl.exe9rrlffr.exehhhtnt.exetnhbnh.exevdvpj.exe1vdvj.exe7xfxxxx.exenhnhnh.exebttthb.exepjpjj.exerrlfrxf.exennttnn.exebthbnh.exe9jvvp.exepjvpv.exexflxlrl.exexfxxrrl.exenbtnbn.exetnnbbh.exejjdpp.exepdvjj.exelrxrlfx.exebtnhtn.exehbbtnn.exe7jjdd.exejvvvp.exerxxrllf.exe9frlrrx.exe1btnhb.exettttnn.exepid process 4976 3jpjv.exe 4852 3flxrrf.exe 3472 7ffxrrl.exe 908 tnbtnh.exe 3936 3bbtbb.exe 2936 djpdp.exe 3356 pjjdj.exe 4272 5lrfrlf.exe 4636 hntbhh.exe 3516 htbttt.exe 3264 jvjdv.exe 3296 pvjjv.exe 940 fxxlxxr.exe 5072 xlrflff.exe 3044 nhhbhn.exe 3932 bbnnhb.exe 1048 pjppd.exe 2848 9dvpd.exe 4364 9xrllff.exe 872 hbhtth.exe 4312 nbbnhb.exe 4492 ddjjp.exe 5088 jdvjv.exe 1072 1rlfxll.exe 3996 1lrrrxf.exe 1676 btthbh.exe 1104 jdjjv.exe 4472 dvvpd.exe 3208 lxxxrll.exe 4396 fflfxfx.exe 984 hhbtnn.exe 3972 hbhhnh.exe 2464 5jpjd.exe 4308 pvpjv.exe 1016 lflffrl.exe 1164 9rrlffr.exe 2600 hhhtnt.exe 2488 tnhbnh.exe 4972 vdvpj.exe 2492 1vdvj.exe 5012 7xfxxxx.exe 4260 nhnhnh.exe 3056 bttthb.exe 3560 pjpjj.exe 2068 rrlfrxf.exe 2908 nnttnn.exe 2732 bthbnh.exe 5056 9jvvp.exe 4708 pjvpv.exe 5068 xflxlrl.exe 3788 xfxxrrl.exe 4356 nbtnbn.exe 4872 tnnbbh.exe 1960 jjdpp.exe 2764 pdvjj.exe 468 lrxrlfx.exe 4408 btnhtn.exe 1864 hbbtnn.exe 1436 7jjdd.exe 2596 jvvvp.exe 4648 rxxrllf.exe 3352 9frlrrx.exe 4856 1btnhb.exe 768 ttttnn.exe -
Processes:
resource yara_rule behavioral2/memory/4524-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3472-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3936-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2936-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2936-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3356-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4272-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4272-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3296-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5072-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3932-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2848-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/984-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1072-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5088-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4312-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4364-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1048-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/940-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3264-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4272-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4272-59-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e26007e4db2359cc2a4e052765839f70_NeikiAnalytics.exe3jpjv.exe3flxrrf.exe7ffxrrl.exetnbtnh.exe3bbtbb.exedjpdp.exepjjdj.exe5lrfrlf.exehntbhh.exehtbttt.exejvjdv.exepvjjv.exefxxlxxr.exexlrflff.exenhhbhn.exebbnnhb.exepjppd.exe9dvpd.exe9xrllff.exehbhtth.exenbbnhb.exedescription pid process target process PID 4524 wrote to memory of 4976 4524 e26007e4db2359cc2a4e052765839f70_NeikiAnalytics.exe 3jpjv.exe PID 4524 wrote to memory of 4976 4524 e26007e4db2359cc2a4e052765839f70_NeikiAnalytics.exe 3jpjv.exe PID 4524 wrote to memory of 4976 4524 e26007e4db2359cc2a4e052765839f70_NeikiAnalytics.exe 3jpjv.exe PID 4976 wrote to memory of 4852 4976 3jpjv.exe 3flxrrf.exe PID 4976 wrote to memory of 4852 4976 3jpjv.exe 3flxrrf.exe PID 4976 wrote to memory of 4852 4976 3jpjv.exe 3flxrrf.exe PID 4852 wrote to memory of 3472 4852 3flxrrf.exe 7ffxrrl.exe PID 4852 wrote to memory of 3472 4852 3flxrrf.exe 7ffxrrl.exe PID 4852 wrote to memory of 3472 4852 3flxrrf.exe 7ffxrrl.exe PID 3472 wrote to memory of 908 3472 7ffxrrl.exe tnbtnh.exe PID 3472 wrote to memory of 908 3472 7ffxrrl.exe tnbtnh.exe PID 3472 wrote to memory of 908 3472 7ffxrrl.exe tnbtnh.exe PID 908 wrote to memory of 3936 908 tnbtnh.exe 3bbtbb.exe PID 908 wrote to memory of 3936 908 tnbtnh.exe 3bbtbb.exe PID 908 wrote to memory of 3936 908 tnbtnh.exe 3bbtbb.exe PID 3936 wrote to memory of 2936 3936 3bbtbb.exe djpdp.exe PID 3936 wrote to memory of 2936 3936 3bbtbb.exe djpdp.exe PID 3936 wrote to memory of 2936 3936 3bbtbb.exe djpdp.exe PID 2936 wrote to memory of 3356 2936 djpdp.exe pjjdj.exe PID 2936 wrote to memory of 3356 2936 djpdp.exe pjjdj.exe PID 2936 wrote to memory of 3356 2936 djpdp.exe pjjdj.exe PID 3356 wrote to memory of 4272 3356 pjjdj.exe 5lrfrlf.exe PID 3356 wrote to memory of 4272 3356 pjjdj.exe 5lrfrlf.exe PID 3356 wrote to memory of 4272 3356 pjjdj.exe 5lrfrlf.exe PID 4272 wrote to memory of 4636 4272 5lrfrlf.exe hntbhh.exe PID 4272 wrote to memory of 4636 4272 5lrfrlf.exe hntbhh.exe PID 4272 wrote to memory of 4636 4272 5lrfrlf.exe hntbhh.exe PID 4636 wrote to memory of 3516 4636 hntbhh.exe htbttt.exe PID 4636 wrote to memory of 3516 4636 hntbhh.exe htbttt.exe PID 4636 wrote to memory of 3516 4636 hntbhh.exe htbttt.exe PID 3516 wrote to memory of 3264 3516 htbttt.exe jvjdv.exe PID 3516 wrote to memory of 3264 3516 htbttt.exe jvjdv.exe PID 3516 wrote to memory of 3264 3516 htbttt.exe jvjdv.exe PID 3264 wrote to memory of 3296 3264 jvjdv.exe pvjjv.exe PID 3264 wrote to memory of 3296 3264 jvjdv.exe pvjjv.exe PID 3264 wrote to memory of 3296 3264 jvjdv.exe pvjjv.exe PID 3296 wrote to memory of 940 3296 pvjjv.exe fxxlxxr.exe PID 3296 wrote to memory of 940 3296 pvjjv.exe fxxlxxr.exe PID 3296 wrote to memory of 940 3296 pvjjv.exe fxxlxxr.exe PID 940 wrote to memory of 5072 940 fxxlxxr.exe xlrflff.exe PID 940 wrote to memory of 5072 940 fxxlxxr.exe xlrflff.exe PID 940 wrote to memory of 5072 940 fxxlxxr.exe xlrflff.exe PID 5072 wrote to memory of 3044 5072 xlrflff.exe nhhbhn.exe PID 5072 wrote to memory of 3044 5072 xlrflff.exe nhhbhn.exe PID 5072 wrote to memory of 3044 5072 xlrflff.exe nhhbhn.exe PID 3044 wrote to memory of 3932 3044 nhhbhn.exe bbnnhb.exe PID 3044 wrote to memory of 3932 3044 nhhbhn.exe bbnnhb.exe PID 3044 wrote to memory of 3932 3044 nhhbhn.exe bbnnhb.exe PID 3932 wrote to memory of 1048 3932 bbnnhb.exe pjppd.exe PID 3932 wrote to memory of 1048 3932 bbnnhb.exe pjppd.exe PID 3932 wrote to memory of 1048 3932 bbnnhb.exe pjppd.exe PID 1048 wrote to memory of 2848 1048 pjppd.exe 9dvpd.exe PID 1048 wrote to memory of 2848 1048 pjppd.exe 9dvpd.exe PID 1048 wrote to memory of 2848 1048 pjppd.exe 9dvpd.exe PID 2848 wrote to memory of 4364 2848 9dvpd.exe 9xrllff.exe PID 2848 wrote to memory of 4364 2848 9dvpd.exe 9xrllff.exe PID 2848 wrote to memory of 4364 2848 9dvpd.exe 9xrllff.exe PID 4364 wrote to memory of 872 4364 9xrllff.exe hbhtth.exe PID 4364 wrote to memory of 872 4364 9xrllff.exe hbhtth.exe PID 4364 wrote to memory of 872 4364 9xrllff.exe hbhtth.exe PID 872 wrote to memory of 4312 872 hbhtth.exe nbbnhb.exe PID 872 wrote to memory of 4312 872 hbhtth.exe nbbnhb.exe PID 872 wrote to memory of 4312 872 hbhtth.exe nbbnhb.exe PID 4312 wrote to memory of 4492 4312 nbbnhb.exe ddjjp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e26007e4db2359cc2a4e052765839f70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e26007e4db2359cc2a4e052765839f70_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\3jpjv.exec:\3jpjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\3flxrrf.exec:\3flxrrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\7ffxrrl.exec:\7ffxrrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\tnbtnh.exec:\tnbtnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
\??\c:\3bbtbb.exec:\3bbtbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\djpdp.exec:\djpdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\pjjdj.exec:\pjjdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\5lrfrlf.exec:\5lrfrlf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\hntbhh.exec:\hntbhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\htbttt.exec:\htbttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\jvjdv.exec:\jvjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
\??\c:\pvjjv.exec:\pvjjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
\??\c:\fxxlxxr.exec:\fxxlxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\xlrflff.exec:\xlrflff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\nhhbhn.exec:\nhhbhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\bbnnhb.exec:\bbnnhb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\pjppd.exec:\pjppd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\9dvpd.exec:\9dvpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\9xrllff.exec:\9xrllff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\hbhtth.exec:\hbhtth.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\nbbnhb.exec:\nbbnhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\ddjjp.exec:\ddjjp.exe23⤵
- Executes dropped EXE
PID:4492 -
\??\c:\jdvjv.exec:\jdvjv.exe24⤵
- Executes dropped EXE
PID:5088 -
\??\c:\1rlfxll.exec:\1rlfxll.exe25⤵
- Executes dropped EXE
PID:1072 -
\??\c:\1lrrrxf.exec:\1lrrrxf.exe26⤵
- Executes dropped EXE
PID:3996 -
\??\c:\btthbh.exec:\btthbh.exe27⤵
- Executes dropped EXE
PID:1676 -
\??\c:\jdjjv.exec:\jdjjv.exe28⤵
- Executes dropped EXE
PID:1104 -
\??\c:\dvvpd.exec:\dvvpd.exe29⤵
- Executes dropped EXE
PID:4472 -
\??\c:\lxxxrll.exec:\lxxxrll.exe30⤵
- Executes dropped EXE
PID:3208 -
\??\c:\fflfxfx.exec:\fflfxfx.exe31⤵
- Executes dropped EXE
PID:4396 -
\??\c:\hhbtnn.exec:\hhbtnn.exe32⤵
- Executes dropped EXE
PID:984 -
\??\c:\hbhhnh.exec:\hbhhnh.exe33⤵
- Executes dropped EXE
PID:3972 -
\??\c:\5jpjd.exec:\5jpjd.exe34⤵
- Executes dropped EXE
PID:2464 -
\??\c:\pvpjv.exec:\pvpjv.exe35⤵
- Executes dropped EXE
PID:4308 -
\??\c:\lflffrl.exec:\lflffrl.exe36⤵
- Executes dropped EXE
PID:1016 -
\??\c:\9rrlffr.exec:\9rrlffr.exe37⤵
- Executes dropped EXE
PID:1164 -
\??\c:\hhhtnt.exec:\hhhtnt.exe38⤵
- Executes dropped EXE
PID:2600 -
\??\c:\tnhbnh.exec:\tnhbnh.exe39⤵
- Executes dropped EXE
PID:2488 -
\??\c:\vdvpj.exec:\vdvpj.exe40⤵
- Executes dropped EXE
PID:4972 -
\??\c:\1vdvj.exec:\1vdvj.exe41⤵
- Executes dropped EXE
PID:2492 -
\??\c:\7xfxxxx.exec:\7xfxxxx.exe42⤵
- Executes dropped EXE
PID:5012 -
\??\c:\nhnhnh.exec:\nhnhnh.exe43⤵
- Executes dropped EXE
PID:4260 -
\??\c:\bttthb.exec:\bttthb.exe44⤵
- Executes dropped EXE
PID:3056 -
\??\c:\pjpjj.exec:\pjpjj.exe45⤵
- Executes dropped EXE
PID:3560 -
\??\c:\rrlfrxf.exec:\rrlfrxf.exe46⤵
- Executes dropped EXE
PID:2068 -
\??\c:\nnttnn.exec:\nnttnn.exe47⤵
- Executes dropped EXE
PID:2908 -
\??\c:\bthbnh.exec:\bthbnh.exe48⤵
- Executes dropped EXE
PID:2732 -
\??\c:\9jvvp.exec:\9jvvp.exe49⤵
- Executes dropped EXE
PID:5056 -
\??\c:\pjvpv.exec:\pjvpv.exe50⤵
- Executes dropped EXE
PID:4708 -
\??\c:\xflxlrl.exec:\xflxlrl.exe51⤵
- Executes dropped EXE
PID:5068 -
\??\c:\xfxxrrl.exec:\xfxxrrl.exe52⤵
- Executes dropped EXE
PID:3788 -
\??\c:\nbtnbn.exec:\nbtnbn.exe53⤵
- Executes dropped EXE
PID:4356 -
\??\c:\tnnbbh.exec:\tnnbbh.exe54⤵
- Executes dropped EXE
PID:4872 -
\??\c:\jjdpp.exec:\jjdpp.exe55⤵
- Executes dropped EXE
PID:1960 -
\??\c:\pdvjj.exec:\pdvjj.exe56⤵
- Executes dropped EXE
PID:2764 -
\??\c:\lrxrlfx.exec:\lrxrlfx.exe57⤵
- Executes dropped EXE
PID:468 -
\??\c:\btnhtn.exec:\btnhtn.exe58⤵
- Executes dropped EXE
PID:4408 -
\??\c:\hbbtnn.exec:\hbbtnn.exe59⤵
- Executes dropped EXE
PID:1864 -
\??\c:\7jjdd.exec:\7jjdd.exe60⤵
- Executes dropped EXE
PID:1436 -
\??\c:\jvvvp.exec:\jvvvp.exe61⤵
- Executes dropped EXE
PID:2596 -
\??\c:\rxxrllf.exec:\rxxrllf.exe62⤵
- Executes dropped EXE
PID:4648 -
\??\c:\9frlrrx.exec:\9frlrrx.exe63⤵
- Executes dropped EXE
PID:3352 -
\??\c:\1btnhb.exec:\1btnhb.exe64⤵
- Executes dropped EXE
PID:4856 -
\??\c:\ttttnn.exec:\ttttnn.exe65⤵
- Executes dropped EXE
PID:768 -
\??\c:\1ddvp.exec:\1ddvp.exe66⤵PID:2372
-
\??\c:\dvpjj.exec:\dvpjj.exe67⤵PID:1480
-
\??\c:\lxfrfff.exec:\lxfrfff.exe68⤵PID:3128
-
\??\c:\7ffxrrl.exec:\7ffxrrl.exe69⤵PID:3652
-
\??\c:\hbhbtn.exec:\hbhbtn.exe70⤵PID:3500
-
\??\c:\tnhbnh.exec:\tnhbnh.exe71⤵PID:1708
-
\??\c:\vddpj.exec:\vddpj.exe72⤵PID:1476
-
\??\c:\dvpjd.exec:\dvpjd.exe73⤵PID:2956
-
\??\c:\jjddv.exec:\jjddv.exe74⤵PID:2592
-
\??\c:\xxxlrll.exec:\xxxlrll.exe75⤵PID:3200
-
\??\c:\btnbhb.exec:\btnbhb.exe76⤵PID:3604
-
\??\c:\nhbtnh.exec:\nhbtnh.exe77⤵PID:3484
-
\??\c:\ntbbtt.exec:\ntbbtt.exe78⤵PID:1796
-
\??\c:\vvpvj.exec:\vvpvj.exe79⤵PID:4016
-
\??\c:\ddpjp.exec:\ddpjp.exe80⤵PID:2464
-
\??\c:\xlrfxrf.exec:\xlrfxrf.exe81⤵PID:4308
-
\??\c:\ffrxrlf.exec:\ffrxrlf.exe82⤵PID:4000
-
\??\c:\hnnhbb.exec:\hnnhbb.exe83⤵PID:4460
-
\??\c:\ntbthn.exec:\ntbthn.exe84⤵PID:3344
-
\??\c:\ppvpv.exec:\ppvpv.exe85⤵PID:2188
-
\??\c:\dvpdp.exec:\dvpdp.exe86⤵PID:2708
-
\??\c:\frrlxxr.exec:\frrlxxr.exe87⤵PID:452
-
\??\c:\lxfxrlf.exec:\lxfxrlf.exe88⤵PID:1448
-
\??\c:\tnntbt.exec:\tnntbt.exe89⤵PID:3716
-
\??\c:\tntbnb.exec:\tntbnb.exe90⤵PID:4020
-
\??\c:\vpdvd.exec:\vpdvd.exe91⤵PID:4972
-
\??\c:\xlfrfxl.exec:\xlfrfxl.exe92⤵PID:4780
-
\??\c:\3lrrxxf.exec:\3lrrxxf.exe93⤵PID:2908
-
\??\c:\nbtnhh.exec:\nbtnhh.exe94⤵PID:4908
-
\??\c:\jdvpj.exec:\jdvpj.exe95⤵PID:5036
-
\??\c:\3vvpd.exec:\3vvpd.exe96⤵PID:3328
-
\??\c:\lxfffff.exec:\lxfffff.exe97⤵PID:5044
-
\??\c:\lrrlllf.exec:\lrrlllf.exe98⤵PID:940
-
\??\c:\3tnhbt.exec:\3tnhbt.exe99⤵PID:3860
-
\??\c:\tthbnn.exec:\tthbnn.exe100⤵PID:4588
-
\??\c:\jvpjd.exec:\jvpjd.exe101⤵PID:4836
-
\??\c:\nhnbbt.exec:\nhnbbt.exe102⤵PID:1048
-
\??\c:\dvvpd.exec:\dvvpd.exe103⤵PID:2700
-
\??\c:\pjdvv.exec:\pjdvv.exe104⤵PID:1208
-
\??\c:\xlfrllf.exec:\xlfrllf.exe105⤵PID:872
-
\??\c:\btbbhn.exec:\btbbhn.exe106⤵PID:4996
-
\??\c:\thbtnh.exec:\thbtnh.exe107⤵PID:2396
-
\??\c:\5jjjj.exec:\5jjjj.exe108⤵PID:2508
-
\??\c:\dvddv.exec:\dvddv.exe109⤵PID:4484
-
\??\c:\lrlfrlf.exec:\lrlfrlf.exe110⤵PID:5088
-
\??\c:\5xxrffx.exec:\5xxrffx.exe111⤵PID:2372
-
\??\c:\bhttth.exec:\bhttth.exe112⤵PID:1480
-
\??\c:\vjvjd.exec:\vjvjd.exe113⤵PID:4888
-
\??\c:\vpdpp.exec:\vpdpp.exe114⤵PID:2884
-
\??\c:\9flfrrl.exec:\9flfrrl.exe115⤵PID:2452
-
\??\c:\rfxrfxx.exec:\rfxrfxx.exe116⤵PID:3744
-
\??\c:\nhhbbb.exec:\nhhbbb.exe117⤵PID:4372
-
\??\c:\1jvpj.exec:\1jvpj.exe118⤵PID:3188
-
\??\c:\1pjdv.exec:\1pjdv.exe119⤵PID:412
-
\??\c:\lfxrffx.exec:\lfxrffx.exe120⤵PID:4396
-
\??\c:\nnhtnb.exec:\nnhtnb.exe121⤵PID:4944
-
\??\c:\jjdpd.exec:\jjdpd.exe122⤵PID:4212
-
\??\c:\vddvd.exec:\vddvd.exe123⤵PID:2940
-
\??\c:\rrxlxlx.exec:\rrxlxlx.exe124⤵PID:3948
-
\??\c:\htbbtb.exec:\htbbtb.exe125⤵PID:4524
-
\??\c:\jjdjp.exec:\jjdjp.exe126⤵PID:5000
-
\??\c:\dpvdd.exec:\dpvdd.exe127⤵PID:4460
-
\??\c:\xlfxlfx.exec:\xlfxlfx.exe128⤵PID:628
-
\??\c:\hhhtnh.exec:\hhhtnh.exe129⤵PID:3900
-
\??\c:\bhthtt.exec:\bhthtt.exe130⤵PID:4124
-
\??\c:\pvvpd.exec:\pvvpd.exe131⤵PID:2880
-
\??\c:\pdddv.exec:\pdddv.exe132⤵PID:1944
-
\??\c:\rrxfxrl.exec:\rrxfxrl.exe133⤵PID:2436
-
\??\c:\lrrxxrr.exec:\lrrxxrr.exe134⤵PID:3560
-
\??\c:\bhnhbb.exec:\bhnhbb.exe135⤵PID:3536
-
\??\c:\3nthtn.exec:\3nthtn.exe136⤵PID:3516
-
\??\c:\djjdp.exec:\djjdp.exe137⤵PID:4804
-
\??\c:\jpvvj.exec:\jpvvj.exe138⤵PID:5036
-
\??\c:\fxxrrll.exec:\fxxrrll.exe139⤵PID:4368
-
\??\c:\frlxlfr.exec:\frlxlfr.exe140⤵PID:5072
-
\??\c:\bthbtt.exec:\bthbtt.exe141⤵PID:4920
-
\??\c:\bthnbn.exec:\bthnbn.exe142⤵PID:2248
-
\??\c:\vpppp.exec:\vpppp.exe143⤵PID:4412
-
\??\c:\5ppjv.exec:\5ppjv.exe144⤵PID:4564
-
\??\c:\9rrlfxr.exec:\9rrlfxr.exe145⤵PID:468
-
\??\c:\lxxrllx.exec:\lxxrllx.exe146⤵PID:1568
-
\??\c:\1nnhnn.exec:\1nnhnn.exe147⤵PID:5116
-
\??\c:\9tntnt.exec:\9tntnt.exe148⤵PID:864
-
\??\c:\vvvpj.exec:\vvvpj.exe149⤵PID:2596
-
\??\c:\rlrrllf.exec:\rlrrllf.exe150⤵PID:3540
-
\??\c:\vpvpj.exec:\vpvpj.exe151⤵PID:4856
-
\??\c:\ddpjv.exec:\ddpjv.exe152⤵PID:2312
-
\??\c:\rxxlfxr.exec:\rxxlfxr.exe153⤵PID:876
-
\??\c:\xfrrrrx.exec:\xfrrrrx.exe154⤵PID:1072
-
\??\c:\bhtbbh.exec:\bhtbbh.exe155⤵PID:4048
-
\??\c:\3bhbnn.exec:\3bhbnn.exe156⤵PID:4540
-
\??\c:\5jppp.exec:\5jppp.exe157⤵PID:4740
-
\??\c:\dppjv.exec:\dppjv.exe158⤵PID:4068
-
\??\c:\rffxlfx.exec:\rffxlfx.exe159⤵PID:4452
-
\??\c:\frrllfx.exec:\frrllfx.exe160⤵PID:3688
-
\??\c:\1htnhb.exec:\1htnhb.exe161⤵PID:3880
-
\??\c:\thnttt.exec:\thnttt.exe162⤵PID:2784
-
\??\c:\7dddp.exec:\7dddp.exe163⤵PID:3604
-
\??\c:\3ppjd.exec:\3ppjd.exe164⤵PID:1212
-
\??\c:\lffxllf.exec:\lffxllf.exe165⤵PID:1796
-
\??\c:\lxrlflf.exec:\lxrlflf.exe166⤵PID:2564
-
\??\c:\tntbtt.exec:\tntbtt.exe167⤵PID:3260
-
\??\c:\tbnthh.exec:\tbnthh.exe168⤵PID:1016
-
\??\c:\vjdvp.exec:\vjdvp.exe169⤵PID:3564
-
\??\c:\xfrlxrr.exec:\xfrlxrr.exe170⤵PID:2088
-
\??\c:\7llrffx.exec:\7llrffx.exe171⤵PID:4008
-
\??\c:\5bhhtt.exec:\5bhhtt.exe172⤵PID:4388
-
\??\c:\7nnhbb.exec:\7nnhbb.exe173⤵PID:4956
-
\??\c:\vdpjd.exec:\vdpjd.exe174⤵PID:696
-
\??\c:\1jjdv.exec:\1jjdv.exe175⤵PID:4908
-
\??\c:\rflllll.exec:\rflllll.exe176⤵PID:2180
-
\??\c:\lfxrxfx.exec:\lfxrxfx.exe177⤵PID:4120
-
\??\c:\hbbttb.exec:\hbbttb.exe178⤵PID:940
-
\??\c:\vpvpj.exec:\vpvpj.exe179⤵PID:4232
-
\??\c:\5vvdp.exec:\5vvdp.exe180⤵PID:1960
-
\??\c:\9ffxffx.exec:\9ffxffx.exe181⤵PID:3156
-
\??\c:\1rxxlfl.exec:\1rxxlfl.exe182⤵PID:2728
-
\??\c:\jvvdd.exec:\jvvdd.exe183⤵PID:2864
-
\??\c:\flxlllf.exec:\flxlllf.exe184⤵PID:1920
-
\??\c:\rrrrrrr.exec:\rrrrrrr.exe185⤵PID:4648
-
\??\c:\ppppp.exec:\ppppp.exe186⤵PID:1036
-
\??\c:\vjvpj.exec:\vjvpj.exe187⤵PID:3648
-
\??\c:\jpdjv.exec:\jpdjv.exe188⤵PID:2604
-
\??\c:\xrxrlxx.exec:\xrxrlxx.exe189⤵PID:3316
-
\??\c:\xlrlflf.exec:\xlrlflf.exe190⤵PID:2804
-
\??\c:\bbttnb.exec:\bbttnb.exe191⤵PID:5088
-
\??\c:\btttnb.exec:\btttnb.exe192⤵PID:4532
-
\??\c:\xxrxffr.exec:\xxrxffr.exe193⤵PID:3652
-
\??\c:\1vppp.exec:\1vppp.exe194⤵PID:4888
-
\??\c:\5rfffff.exec:\5rfffff.exe195⤵PID:2884
-
\??\c:\flxfxxl.exec:\flxfxxl.exe196⤵PID:2452
-
\??\c:\bhhtnn.exec:\bhhtnn.exe197⤵PID:4256
-
\??\c:\jvdvj.exec:\jvdvj.exe198⤵PID:4372
-
\??\c:\flrlfxr.exec:\flrlfxr.exe199⤵PID:1320
-
\??\c:\ffffxfx.exec:\ffffxfx.exe200⤵PID:680
-
\??\c:\fxflffx.exec:\fxflffx.exe201⤵PID:3940
-
\??\c:\hntttt.exec:\hntttt.exe202⤵PID:4016
-
\??\c:\hnhhhn.exec:\hnhhhn.exe203⤵PID:2564
-
\??\c:\pppjp.exec:\pppjp.exe204⤵PID:3260
-
\??\c:\jdjjd.exec:\jdjjd.exe205⤵PID:4460
-
\??\c:\jppjd.exec:\jppjd.exe206⤵PID:1176
-
\??\c:\xxxxxxr.exec:\xxxxxxr.exe207⤵PID:2284
-
\??\c:\lfxrlll.exec:\lfxrlll.exe208⤵PID:4112
-
\??\c:\nhbttt.exec:\nhbttt.exe209⤵PID:3240
-
\??\c:\nbhbtt.exec:\nbhbtt.exe210⤵PID:4772
-
\??\c:\djpdj.exec:\djpdj.exe211⤵PID:1612
-
\??\c:\dpdvp.exec:\dpdvp.exe212⤵PID:1728
-
\??\c:\pjvpj.exec:\pjvpj.exe213⤵PID:5036
-
\??\c:\lffxlrl.exec:\lffxlrl.exe214⤵PID:4804
-
\??\c:\frxxrxr.exec:\frxxrxr.exe215⤵PID:2480
-
\??\c:\bhhhhh.exec:\bhhhhh.exe216⤵PID:376
-
\??\c:\nnnhnn.exec:\nnnhnn.exe217⤵PID:4588
-
\??\c:\5dpjp.exec:\5dpjp.exe218⤵PID:1884
-
\??\c:\jdjdv.exec:\jdjdv.exe219⤵PID:4364
-
\??\c:\jdjjd.exec:\jdjjd.exe220⤵PID:3160
-
\??\c:\rrrlrrr.exec:\rrrlrrr.exe221⤵PID:1696
-
\??\c:\xrxrrrl.exec:\xrxrrrl.exe222⤵PID:1652
-
\??\c:\9tttnn.exec:\9tttnn.exe223⤵PID:2396
-
\??\c:\tbbnhb.exec:\tbbnhb.exe224⤵PID:2000
-
\??\c:\9pvpj.exec:\9pvpj.exe225⤵PID:5008
-
\??\c:\ppppj.exec:\ppppj.exe226⤵PID:876
-
\??\c:\lxrxfxl.exec:\lxrxfxl.exe227⤵PID:3128
-
\??\c:\5rxxffl.exec:\5rxxffl.exe228⤵PID:4532
-
\??\c:\3bnbbn.exec:\3bnbbn.exe229⤵PID:2296
-
\??\c:\hntbht.exec:\hntbht.exe230⤵PID:3244
-
\??\c:\ddvpj.exec:\ddvpj.exe231⤵PID:2884
-
\??\c:\fffxrrx.exec:\fffxrrx.exe232⤵PID:5060
-
\??\c:\tttthn.exec:\tttthn.exe233⤵PID:1272
-
\??\c:\nbhhbb.exec:\nbhhbb.exe234⤵PID:412
-
\??\c:\jvjjj.exec:\jvjjj.exe235⤵PID:3484
-
\??\c:\fxfrfff.exec:\fxfrfff.exe236⤵PID:4944
-
\??\c:\5xxxxxx.exec:\5xxxxxx.exe237⤵PID:3940
-
\??\c:\tbhhhh.exec:\tbhhhh.exe238⤵PID:3124
-
\??\c:\bbnhnn.exec:\bbnhnn.exe239⤵PID:1164
-
\??\c:\1pvvj.exec:\1pvvj.exe240⤵PID:3472
-
\??\c:\rllfxxf.exec:\rllfxxf.exe241⤵PID:4840
-
\??\c:\1xxxrrl.exec:\1xxxrrl.exe242⤵PID:4260