Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 02:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
972cf0e3b69e24bdb23d3c32fcd7a200_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
972cf0e3b69e24bdb23d3c32fcd7a200_NeikiAnalytics.exe
-
Size
200KB
-
MD5
972cf0e3b69e24bdb23d3c32fcd7a200
-
SHA1
12a505a4452288dc7bed6db40f8f6138eb84fa9b
-
SHA256
ea26b33804ee71f2d80e26137860025b22662751b5f05f1a6d70c9cbfb70578a
-
SHA512
14e377f91d6f3a5c8c8bd9b8b99291884769a91cfaaa262b607337e6a6521ff6206fedb4019b2eabe7ad3063a1ed67be812534e03eca187455f7797200ec81ed
-
SSDEEP
3072:ymb3NkkiQ3mdBjFIi/0RU6QeYQsm71vPmc51+GqekBJCvr6zJBUVv1Tg:n3C9BRIG0asYFm71m8+GdkB9Cv1s
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral2/memory/3792-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1508-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4732-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1536-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1724-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/596-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3092-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2340-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2768-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3136-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1200-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1184-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1308-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4500-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3856-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1492-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/372-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/740-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2052-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xxlxxll.exettnttn.exevpvdv.exerlrlrxl.exenhtttt.exevdvpj.exevjjdv.exellrrrrl.exedpjvv.exexxlxlfr.exebbnbnt.exejpjvj.exebbbtnn.exevjpjd.exefrfxrrx.exenthhhh.exejdvpd.exedpjdd.exelflfllx.exedjddd.exe5hbbtt.exexlrrrll.exehnnthb.exejdpjd.exerrxrlll.exe1hnhbn.exevjppp.exefxrfxxr.exennnhtt.exevjjjj.exepvppp.exe7flrrxl.exethhbtb.exepjvpp.exexrfxxxx.exe1rlxxll.exentbbtt.exe7nbtnh.exe9ddvp.exeffrrxxr.exerrxfxxf.exenhnhbh.exethtnhn.exevpjdv.exerrfxrrr.exetntbbh.exehttttt.exe3jvpj.exerfrrllf.exe5llfxxx.exenthnhh.exehbhbth.exepvjjj.exevvjjj.exenthhtt.exetttnth.exejvpjd.exexfrlfll.exehbbbbb.exettnnbh.exedvjvv.exexrxxfll.exebnhhbh.exehbnnnt.exepid process 3408 xxlxxll.exe 1508 ttnttn.exe 4732 vpvdv.exe 1724 rlrlrxl.exe 1536 nhtttt.exe 596 vdvpj.exe 3092 vjjdv.exe 1472 llrrrrl.exe 3576 dpjvv.exe 2340 xxlxlfr.exe 2768 bbnbnt.exe 4420 jpjvj.exe 3136 bbbtnn.exe 1052 vjpjd.exe 4500 frfxrrx.exe 1200 nthhhh.exe 1308 jdvpd.exe 1184 dpjdd.exe 3000 lflfllx.exe 3856 djddd.exe 5044 5hbbtt.exe 1492 xlrrrll.exe 3896 hnnthb.exe 372 jdpjd.exe 2256 rrxrlll.exe 740 1hnhbn.exe 3500 vjppp.exe 2052 fxrfxxr.exe 4464 nnnhtt.exe 3352 vjjjj.exe 2296 pvppp.exe 2268 7flrrxl.exe 2208 thhbtb.exe 4700 pjvpp.exe 232 xrfxxxx.exe 4488 1rlxxll.exe 628 ntbbtt.exe 3972 7nbtnh.exe 3484 9ddvp.exe 1804 ffrrxxr.exe 1824 rrxfxxf.exe 2328 nhnhbh.exe 1816 thtnhn.exe 2252 vpjdv.exe 1888 rrfxrrr.exe 3372 tntbbh.exe 3092 httttt.exe 840 3jvpj.exe 3576 rfrrllf.exe 3240 5llfxxx.exe 3124 nthnhh.exe 4332 hbhbth.exe 640 pvjjj.exe 4404 vvjjj.exe 3136 nthhtt.exe 1988 tttnth.exe 2376 jvpjd.exe 548 xfrlfll.exe 1848 hbbbbb.exe 4180 ttnnbh.exe 3788 dvjvv.exe 5056 xrxxfll.exe 4812 bnhhbh.exe 4052 hbnnnt.exe -
Processes:
resource yara_rule behavioral2/memory/3792-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1508-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1536-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1724-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/596-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/596-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/596-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3092-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2340-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3136-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1200-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1184-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1308-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3856-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1492-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/372-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/740-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2052-186-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
972cf0e3b69e24bdb23d3c32fcd7a200_NeikiAnalytics.exexxlxxll.exettnttn.exevpvdv.exerlrlrxl.exenhtttt.exevdvpj.exevjjdv.exellrrrrl.exedpjvv.exexxlxlfr.exebbnbnt.exejpjvj.exebbbtnn.exevjpjd.exefrfxrrx.exenthhhh.exejdvpd.exedpjdd.exelflfllx.exedjddd.exe5hbbtt.exedescription pid process target process PID 3792 wrote to memory of 3408 3792 972cf0e3b69e24bdb23d3c32fcd7a200_NeikiAnalytics.exe xxlxxll.exe PID 3792 wrote to memory of 3408 3792 972cf0e3b69e24bdb23d3c32fcd7a200_NeikiAnalytics.exe xxlxxll.exe PID 3792 wrote to memory of 3408 3792 972cf0e3b69e24bdb23d3c32fcd7a200_NeikiAnalytics.exe xxlxxll.exe PID 3408 wrote to memory of 1508 3408 xxlxxll.exe ttnttn.exe PID 3408 wrote to memory of 1508 3408 xxlxxll.exe ttnttn.exe PID 3408 wrote to memory of 1508 3408 xxlxxll.exe ttnttn.exe PID 1508 wrote to memory of 4732 1508 ttnttn.exe vpvdv.exe PID 1508 wrote to memory of 4732 1508 ttnttn.exe vpvdv.exe PID 1508 wrote to memory of 4732 1508 ttnttn.exe vpvdv.exe PID 4732 wrote to memory of 1724 4732 vpvdv.exe rlrlrxl.exe PID 4732 wrote to memory of 1724 4732 vpvdv.exe rlrlrxl.exe PID 4732 wrote to memory of 1724 4732 vpvdv.exe rlrlrxl.exe PID 1724 wrote to memory of 1536 1724 rlrlrxl.exe nhtttt.exe PID 1724 wrote to memory of 1536 1724 rlrlrxl.exe nhtttt.exe PID 1724 wrote to memory of 1536 1724 rlrlrxl.exe nhtttt.exe PID 1536 wrote to memory of 596 1536 nhtttt.exe vdvpj.exe PID 1536 wrote to memory of 596 1536 nhtttt.exe vdvpj.exe PID 1536 wrote to memory of 596 1536 nhtttt.exe vdvpj.exe PID 596 wrote to memory of 3092 596 vdvpj.exe vjjdv.exe PID 596 wrote to memory of 3092 596 vdvpj.exe vjjdv.exe PID 596 wrote to memory of 3092 596 vdvpj.exe vjjdv.exe PID 3092 wrote to memory of 1472 3092 vjjdv.exe llrrrrl.exe PID 3092 wrote to memory of 1472 3092 vjjdv.exe llrrrrl.exe PID 3092 wrote to memory of 1472 3092 vjjdv.exe llrrrrl.exe PID 1472 wrote to memory of 3576 1472 llrrrrl.exe dpjvv.exe PID 1472 wrote to memory of 3576 1472 llrrrrl.exe dpjvv.exe PID 1472 wrote to memory of 3576 1472 llrrrrl.exe dpjvv.exe PID 3576 wrote to memory of 2340 3576 dpjvv.exe xxlxlfr.exe PID 3576 wrote to memory of 2340 3576 dpjvv.exe xxlxlfr.exe PID 3576 wrote to memory of 2340 3576 dpjvv.exe xxlxlfr.exe PID 2340 wrote to memory of 2768 2340 xxlxlfr.exe bbnbnt.exe PID 2340 wrote to memory of 2768 2340 xxlxlfr.exe bbnbnt.exe PID 2340 wrote to memory of 2768 2340 xxlxlfr.exe bbnbnt.exe PID 2768 wrote to memory of 4420 2768 bbnbnt.exe jpjvj.exe PID 2768 wrote to memory of 4420 2768 bbnbnt.exe jpjvj.exe PID 2768 wrote to memory of 4420 2768 bbnbnt.exe jpjvj.exe PID 4420 wrote to memory of 3136 4420 jpjvj.exe bbbtnn.exe PID 4420 wrote to memory of 3136 4420 jpjvj.exe bbbtnn.exe PID 4420 wrote to memory of 3136 4420 jpjvj.exe bbbtnn.exe PID 3136 wrote to memory of 1052 3136 bbbtnn.exe vjpjd.exe PID 3136 wrote to memory of 1052 3136 bbbtnn.exe vjpjd.exe PID 3136 wrote to memory of 1052 3136 bbbtnn.exe vjpjd.exe PID 1052 wrote to memory of 4500 1052 vjpjd.exe frfxrrx.exe PID 1052 wrote to memory of 4500 1052 vjpjd.exe frfxrrx.exe PID 1052 wrote to memory of 4500 1052 vjpjd.exe frfxrrx.exe PID 4500 wrote to memory of 1200 4500 frfxrrx.exe nthhhh.exe PID 4500 wrote to memory of 1200 4500 frfxrrx.exe nthhhh.exe PID 4500 wrote to memory of 1200 4500 frfxrrx.exe nthhhh.exe PID 1200 wrote to memory of 1308 1200 nthhhh.exe jdvpd.exe PID 1200 wrote to memory of 1308 1200 nthhhh.exe jdvpd.exe PID 1200 wrote to memory of 1308 1200 nthhhh.exe jdvpd.exe PID 1308 wrote to memory of 1184 1308 jdvpd.exe dpjdd.exe PID 1308 wrote to memory of 1184 1308 jdvpd.exe dpjdd.exe PID 1308 wrote to memory of 1184 1308 jdvpd.exe dpjdd.exe PID 1184 wrote to memory of 3000 1184 dpjdd.exe lflfllx.exe PID 1184 wrote to memory of 3000 1184 dpjdd.exe lflfllx.exe PID 1184 wrote to memory of 3000 1184 dpjdd.exe lflfllx.exe PID 3000 wrote to memory of 3856 3000 lflfllx.exe djddd.exe PID 3000 wrote to memory of 3856 3000 lflfllx.exe djddd.exe PID 3000 wrote to memory of 3856 3000 lflfllx.exe djddd.exe PID 3856 wrote to memory of 5044 3856 djddd.exe 5hbbtt.exe PID 3856 wrote to memory of 5044 3856 djddd.exe 5hbbtt.exe PID 3856 wrote to memory of 5044 3856 djddd.exe 5hbbtt.exe PID 5044 wrote to memory of 1492 5044 5hbbtt.exe xlrrrll.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\972cf0e3b69e24bdb23d3c32fcd7a200_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\972cf0e3b69e24bdb23d3c32fcd7a200_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3792 -
\??\c:\xxlxxll.exec:\xxlxxll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
\??\c:\ttnttn.exec:\ttnttn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\vpvdv.exec:\vpvdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\rlrlrxl.exec:\rlrlrxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\nhtttt.exec:\nhtttt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\vdvpj.exec:\vdvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:596 -
\??\c:\vjjdv.exec:\vjjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\llrrrrl.exec:\llrrrrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\dpjvv.exec:\dpjvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\xxlxlfr.exec:\xxlxlfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\bbnbnt.exec:\bbnbnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\jpjvj.exec:\jpjvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\bbbtnn.exec:\bbbtnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\vjpjd.exec:\vjpjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\frfxrrx.exec:\frfxrrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\nthhhh.exec:\nthhhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\jdvpd.exec:\jdvpd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\dpjdd.exec:\dpjdd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\lflfllx.exec:\lflfllx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\djddd.exec:\djddd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
\??\c:\5hbbtt.exec:\5hbbtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\xlrrrll.exec:\xlrrrll.exe23⤵
- Executes dropped EXE
PID:1492 -
\??\c:\hnnthb.exec:\hnnthb.exe24⤵
- Executes dropped EXE
PID:3896 -
\??\c:\jdpjd.exec:\jdpjd.exe25⤵
- Executes dropped EXE
PID:372 -
\??\c:\rrxrlll.exec:\rrxrlll.exe26⤵
- Executes dropped EXE
PID:2256 -
\??\c:\1hnhbn.exec:\1hnhbn.exe27⤵
- Executes dropped EXE
PID:740 -
\??\c:\vjppp.exec:\vjppp.exe28⤵
- Executes dropped EXE
PID:3500 -
\??\c:\fxrfxxr.exec:\fxrfxxr.exe29⤵
- Executes dropped EXE
PID:2052 -
\??\c:\nnnhtt.exec:\nnnhtt.exe30⤵
- Executes dropped EXE
PID:4464 -
\??\c:\vjjjj.exec:\vjjjj.exe31⤵
- Executes dropped EXE
PID:3352 -
\??\c:\pvppp.exec:\pvppp.exe32⤵
- Executes dropped EXE
PID:2296 -
\??\c:\7flrrxl.exec:\7flrrxl.exe33⤵
- Executes dropped EXE
PID:2268 -
\??\c:\thhbtb.exec:\thhbtb.exe34⤵
- Executes dropped EXE
PID:2208 -
\??\c:\pjvpp.exec:\pjvpp.exe35⤵
- Executes dropped EXE
PID:4700 -
\??\c:\xrfxxxx.exec:\xrfxxxx.exe36⤵
- Executes dropped EXE
PID:232 -
\??\c:\1rlxxll.exec:\1rlxxll.exe37⤵
- Executes dropped EXE
PID:4488 -
\??\c:\ntbbtt.exec:\ntbbtt.exe38⤵
- Executes dropped EXE
PID:628 -
\??\c:\7nbtnh.exec:\7nbtnh.exe39⤵
- Executes dropped EXE
PID:3972 -
\??\c:\9ddvp.exec:\9ddvp.exe40⤵
- Executes dropped EXE
PID:3484 -
\??\c:\ffrrxxr.exec:\ffrrxxr.exe41⤵
- Executes dropped EXE
PID:1804 -
\??\c:\rrxfxxf.exec:\rrxfxxf.exe42⤵
- Executes dropped EXE
PID:1824 -
\??\c:\nhnhbh.exec:\nhnhbh.exe43⤵
- Executes dropped EXE
PID:2328 -
\??\c:\thtnhn.exec:\thtnhn.exe44⤵
- Executes dropped EXE
PID:1816 -
\??\c:\vpjdv.exec:\vpjdv.exe45⤵
- Executes dropped EXE
PID:2252 -
\??\c:\rrfxrrr.exec:\rrfxrrr.exe46⤵
- Executes dropped EXE
PID:1888 -
\??\c:\tntbbh.exec:\tntbbh.exe47⤵
- Executes dropped EXE
PID:3372 -
\??\c:\httttt.exec:\httttt.exe48⤵
- Executes dropped EXE
PID:3092 -
\??\c:\3jvpj.exec:\3jvpj.exe49⤵
- Executes dropped EXE
PID:840 -
\??\c:\rfrrllf.exec:\rfrrllf.exe50⤵
- Executes dropped EXE
PID:3576 -
\??\c:\5llfxxx.exec:\5llfxxx.exe51⤵
- Executes dropped EXE
PID:3240 -
\??\c:\nthnhh.exec:\nthnhh.exe52⤵
- Executes dropped EXE
PID:3124 -
\??\c:\hbhbth.exec:\hbhbth.exe53⤵
- Executes dropped EXE
PID:4332 -
\??\c:\pvjjj.exec:\pvjjj.exe54⤵
- Executes dropped EXE
PID:640 -
\??\c:\vvjjj.exec:\vvjjj.exe55⤵
- Executes dropped EXE
PID:4404 -
\??\c:\nthhtt.exec:\nthhtt.exe56⤵
- Executes dropped EXE
PID:3136 -
\??\c:\tttnth.exec:\tttnth.exe57⤵
- Executes dropped EXE
PID:1988 -
\??\c:\jvpjd.exec:\jvpjd.exe58⤵
- Executes dropped EXE
PID:2376 -
\??\c:\xfrlfll.exec:\xfrlfll.exe59⤵
- Executes dropped EXE
PID:548 -
\??\c:\hbbbbb.exec:\hbbbbb.exe60⤵
- Executes dropped EXE
PID:1848 -
\??\c:\ttnnbh.exec:\ttnnbh.exe61⤵
- Executes dropped EXE
PID:4180 -
\??\c:\dvjvv.exec:\dvjvv.exe62⤵
- Executes dropped EXE
PID:3788 -
\??\c:\xrxxfll.exec:\xrxxfll.exe63⤵
- Executes dropped EXE
PID:5056 -
\??\c:\bnhhbh.exec:\bnhhbh.exe64⤵
- Executes dropped EXE
PID:4812 -
\??\c:\hbnnnt.exec:\hbnnnt.exe65⤵
- Executes dropped EXE
PID:4052 -
\??\c:\vdpjj.exec:\vdpjj.exe66⤵PID:4200
-
\??\c:\1lrlfff.exec:\1lrlfff.exe67⤵PID:1252
-
\??\c:\rlrrxxx.exec:\rlrrxxx.exe68⤵PID:4100
-
\??\c:\9pjjd.exec:\9pjjd.exe69⤵PID:3968
-
\??\c:\9fxxrrl.exec:\9fxxrrl.exe70⤵PID:1124
-
\??\c:\9xxrxxl.exec:\9xxrxxl.exe71⤵PID:4840
-
\??\c:\hhbttt.exec:\hhbttt.exe72⤵PID:2492
-
\??\c:\djvpj.exec:\djvpj.exe73⤵PID:3472
-
\??\c:\3rxlllf.exec:\3rxlllf.exe74⤵PID:3384
-
\??\c:\hthnnt.exec:\hthnnt.exe75⤵PID:3656
-
\??\c:\3vjdj.exec:\3vjdj.exe76⤵PID:3144
-
\??\c:\1pdvp.exec:\1pdvp.exe77⤵PID:3584
-
\??\c:\frxxxxr.exec:\frxxxxr.exe78⤵PID:2592
-
\??\c:\lrxxffx.exec:\lrxxffx.exe79⤵PID:1812
-
\??\c:\nnhhbh.exec:\nnhhbh.exe80⤵PID:2632
-
\??\c:\pvjjd.exec:\pvjjd.exe81⤵PID:2068
-
\??\c:\ffrrxrx.exec:\ffrrxrx.exe82⤵PID:4112
-
\??\c:\rlrlfrl.exec:\rlrlfrl.exe83⤵PID:232
-
\??\c:\nhbtbb.exec:\nhbtbb.exe84⤵PID:3084
-
\??\c:\vpjdv.exec:\vpjdv.exe85⤵PID:1508
-
\??\c:\dvdvp.exec:\dvdvp.exe86⤵PID:1832
-
\??\c:\xlrllll.exec:\xlrllll.exe87⤵PID:1984
-
\??\c:\rlllxrl.exec:\rlllxrl.exe88⤵PID:1724
-
\??\c:\pjddv.exec:\pjddv.exe89⤵PID:4224
-
\??\c:\vpdjj.exec:\vpdjj.exe90⤵PID:1164
-
\??\c:\7fffxxr.exec:\7fffxxr.exe91⤵PID:1880
-
\??\c:\djddp.exec:\djddp.exe92⤵PID:2332
-
\??\c:\llrxrrl.exec:\llrxrrl.exe93⤵PID:3892
-
\??\c:\nbthhb.exec:\nbthhb.exe94⤵PID:4936
-
\??\c:\9vjdd.exec:\9vjdd.exe95⤵PID:316
-
\??\c:\lrxrrff.exec:\lrxrrff.exe96⤵PID:3228
-
\??\c:\bbhbbt.exec:\bbhbbt.exe97⤵PID:4412
-
\??\c:\btbtht.exec:\btbtht.exe98⤵PID:996
-
\??\c:\pdpdv.exec:\pdpdv.exe99⤵PID:4468
-
\??\c:\lxlfxxx.exec:\lxlfxxx.exe100⤵PID:2216
-
\??\c:\frxrrlf.exec:\frxrrlf.exe101⤵PID:3600
-
\??\c:\3nttnn.exec:\3nttnn.exe102⤵PID:2212
-
\??\c:\jdvdp.exec:\jdvdp.exe103⤵PID:1172
-
\??\c:\rxlfrrr.exec:\rxlfrrr.exe104⤵PID:1848
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe105⤵PID:4328
-
\??\c:\bbbnht.exec:\bbbnht.exe106⤵PID:4400
-
\??\c:\vpdvp.exec:\vpdvp.exe107⤵PID:4052
-
\??\c:\jdjdd.exec:\jdjdd.exe108⤵PID:4084
-
\??\c:\ffxflxl.exec:\ffxflxl.exe109⤵PID:1180
-
\??\c:\9hbnhb.exec:\9hbnhb.exe110⤵PID:372
-
\??\c:\hhnhhh.exec:\hhnhhh.exe111⤵PID:4840
-
\??\c:\vpvpj.exec:\vpvpj.exe112⤵PID:2492
-
\??\c:\jjvdj.exec:\jjvdj.exe113⤵PID:4004
-
\??\c:\rlrrlll.exec:\rlrrlll.exe114⤵PID:2384
-
\??\c:\rrfffll.exec:\rrfffll.exe115⤵PID:3016
-
\??\c:\bttttt.exec:\bttttt.exe116⤵PID:2176
-
\??\c:\jdjjd.exec:\jdjjd.exe117⤵PID:4764
-
\??\c:\ffrllll.exec:\ffrllll.exe118⤵PID:3580
-
\??\c:\jvjdv.exec:\jvjdv.exe119⤵PID:2632
-
\??\c:\vjpjv.exec:\vjpjv.exe120⤵PID:4748
-
\??\c:\rxffxff.exec:\rxffxff.exe121⤵PID:3792
-
\??\c:\nhbbhh.exec:\nhbbhh.exe122⤵PID:3400
-
\??\c:\pdjjd.exec:\pdjjd.exe123⤵PID:4528
-
\??\c:\djjjj.exec:\djjjj.exe124⤵PID:1804
-
\??\c:\frxfxxx.exec:\frxfxxx.exe125⤵PID:2948
-
\??\c:\3nbtnh.exec:\3nbtnh.exe126⤵PID:2144
-
\??\c:\vjjdv.exec:\vjjdv.exe127⤵PID:388
-
\??\c:\jjdvv.exec:\jjdvv.exe128⤵PID:1144
-
\??\c:\nhbthh.exec:\nhbthh.exe129⤵PID:3076
-
\??\c:\pjpjd.exec:\pjpjd.exe130⤵PID:2744
-
\??\c:\nbnnnn.exec:\nbnnnn.exe131⤵PID:2400
-
\??\c:\pjdvv.exec:\pjdvv.exe132⤵PID:1352
-
\??\c:\jdddj.exec:\jdddj.exe133⤵PID:2204
-
\??\c:\nnhnnh.exec:\nnhnnh.exe134⤵PID:2768
-
\??\c:\pvvjv.exec:\pvvjv.exe135⤵PID:3676
-
\??\c:\xrxffff.exec:\xrxffff.exe136⤵PID:640
-
\??\c:\5fxffff.exec:\5fxffff.exe137⤵PID:1640
-
\??\c:\bnnhtt.exec:\bnnhtt.exe138⤵PID:1924
-
\??\c:\vjpjd.exec:\vjpjd.exe139⤵PID:1988
-
\??\c:\ppdpj.exec:\ppdpj.exe140⤵PID:1544
-
\??\c:\xxrxfll.exec:\xxrxfll.exe141⤵PID:1560
-
\??\c:\3bhbnb.exec:\3bhbnb.exe142⤵PID:2128
-
\??\c:\dpddv.exec:\dpddv.exe143⤵PID:4328
-
\??\c:\vppjp.exec:\vppjp.exe144⤵PID:4584
-
\??\c:\rrlfrll.exec:\rrlfrll.exe145⤵PID:4200
-
\??\c:\bhtnhn.exec:\bhtnhn.exe146⤵PID:4100
-
\??\c:\djpjp.exec:\djpjp.exe147⤵PID:856
-
\??\c:\1vjdp.exec:\1vjdp.exe148⤵PID:3468
-
\??\c:\7xrlffl.exec:\7xrlffl.exe149⤵PID:4840
-
\??\c:\lxllrrr.exec:\lxllrrr.exe150⤵PID:448
-
\??\c:\ththtt.exec:\ththtt.exe151⤵PID:4120
-
\??\c:\jdpdd.exec:\jdpdd.exe152⤵PID:2384
-
\??\c:\vvdpj.exec:\vvdpj.exe153⤵PID:4724
-
\??\c:\7xfrrrr.exec:\7xfrrrr.exe154⤵PID:4316
-
\??\c:\hnnhhh.exec:\hnnhhh.exe155⤵PID:2208
-
\??\c:\ttbtnt.exec:\ttbtnt.exe156⤵PID:324
-
\??\c:\7jvdd.exec:\7jvdd.exe157⤵PID:4292
-
\??\c:\vpvvd.exec:\vpvvd.exe158⤵PID:232
-
\??\c:\rllfxrl.exec:\rllfxrl.exe159⤵PID:2304
-
\??\c:\3tttnn.exec:\3tttnn.exe160⤵PID:3400
-
\??\c:\bnttnn.exec:\bnttnn.exe161⤵PID:1404
-
\??\c:\9vjdp.exec:\9vjdp.exe162⤵PID:1804
-
\??\c:\1lfffff.exec:\1lfffff.exe163⤵PID:2328
-
\??\c:\lxxlxxr.exec:\lxxlxxr.exe164⤵PID:908
-
\??\c:\bbnhhb.exec:\bbnhhb.exe165⤵PID:2252
-
\??\c:\ttnnhh.exec:\ttnnhh.exe166⤵PID:1144
-
\??\c:\jpvdd.exec:\jpvdd.exe167⤵PID:4664
-
\??\c:\vjdpj.exec:\vjdpj.exe168⤵PID:2744
-
\??\c:\fxrlflr.exec:\fxrlflr.exe169⤵PID:2400
-
\??\c:\xfxlrff.exec:\xfxlrff.exe170⤵PID:396
-
\??\c:\tnhhnn.exec:\tnhhnn.exe171⤵PID:4864
-
\??\c:\pjppj.exec:\pjppj.exe172⤵PID:2016
-
\??\c:\pjvpp.exec:\pjvpp.exe173⤵PID:1200
-
\??\c:\rrrrxxx.exec:\rrrrxxx.exe174⤵PID:1924
-
\??\c:\lflfxxr.exec:\lflfxxr.exe175⤵PID:1184
-
\??\c:\tntnhn.exec:\tntnhn.exe176⤵PID:5096
-
\??\c:\hbbttn.exec:\hbbttn.exe177⤵PID:5056
-
\??\c:\pjpvp.exec:\pjpvp.exe178⤵PID:3368
-
\??\c:\vjvjj.exec:\vjvjj.exe179⤵PID:4052
-
\??\c:\flrlffx.exec:\flrlffx.exe180⤵PID:2596
-
\??\c:\lxlfxxr.exec:\lxlfxxr.exe181⤵PID:4200
-
\??\c:\nhnntt.exec:\nhnntt.exe182⤵PID:3984
-
\??\c:\vdddd.exec:\vdddd.exe183⤵PID:372
-
\??\c:\dpddd.exec:\dpddd.exe184⤵PID:4164
-
\??\c:\9llllrr.exec:\9llllrr.exe185⤵PID:3352
-
\??\c:\lffffff.exec:\lffffff.exe186⤵PID:4728
-
\??\c:\htbttb.exec:\htbttb.exe187⤵PID:8
-
\??\c:\pdjjj.exec:\pdjjj.exe188⤵PID:4360
-
\??\c:\vddjj.exec:\vddjj.exe189⤵PID:2740
-
\??\c:\3xfxrrl.exec:\3xfxrrl.exe190⤵PID:4288
-
\??\c:\7xxrlrl.exec:\7xxrlrl.exe191⤵PID:4292
-
\??\c:\bbtttt.exec:\bbtttt.exe192⤵PID:4848
-
\??\c:\pvpjv.exec:\pvpjv.exe193⤵PID:4688
-
\??\c:\jjjjv.exec:\jjjjv.exe194⤵PID:2548
-
\??\c:\xllfrlr.exec:\xllfrlr.exe195⤵PID:2380
-
\??\c:\7rrxflr.exec:\7rrxflr.exe196⤵PID:1804
-
\??\c:\7ntnth.exec:\7ntnth.exe197⤵PID:388
-
\??\c:\jjvvj.exec:\jjvvj.exe198⤵PID:908
-
\??\c:\rlfxrlf.exec:\rlfxrlf.exe199⤵PID:3076
-
\??\c:\ffllrrx.exec:\ffllrrx.exe200⤵PID:4664
-
\??\c:\btnntb.exec:\btnntb.exe201⤵PID:3140
-
\??\c:\vvdvp.exec:\vvdvp.exe202⤵PID:940
-
\??\c:\pjjdv.exec:\pjjdv.exe203⤵PID:4548
-
\??\c:\llxfxff.exec:\llxfxff.exe204⤵PID:996
-
\??\c:\rflrrrx.exec:\rflrrrx.exe205⤵PID:4460
-
\??\c:\tbbtbt.exec:\tbbtbt.exe206⤵PID:4500
-
\??\c:\jdvjd.exec:\jdvjd.exe207⤵PID:1308
-
\??\c:\1lxxxxl.exec:\1lxxxxl.exe208⤵PID:3608
-
\??\c:\lfffxxr.exec:\lfffxxr.exe209⤵PID:4180
-
\??\c:\htbnnh.exec:\htbnnh.exe210⤵PID:4400
-
\??\c:\pjppj.exec:\pjppj.exe211⤵PID:1964
-
\??\c:\hbbbtt.exec:\hbbbtt.exe212⤵PID:3940
-
\??\c:\htbtnn.exec:\htbtnn.exe213⤵PID:3968
-
\??\c:\jdppp.exec:\jdppp.exe214⤵PID:924
-
\??\c:\ppjdj.exec:\ppjdj.exe215⤵PID:684
-
\??\c:\rrxxffl.exec:\rrxxffl.exe216⤵PID:3468
-
\??\c:\tntbtt.exec:\tntbtt.exe217⤵PID:4164
-
\??\c:\ppddj.exec:\ppddj.exe218⤵PID:4188
-
\??\c:\7pdvd.exec:\7pdvd.exe219⤵PID:4004
-
\??\c:\llfxflf.exec:\llfxflf.exe220⤵PID:3880
-
\??\c:\9bnnnn.exec:\9bnnnn.exe221⤵PID:2592
-
\??\c:\tbhhtt.exec:\tbhhtt.exe222⤵PID:3344
-
\??\c:\pvddv.exec:\pvddv.exe223⤵PID:4972
-
\??\c:\xflllff.exec:\xflllff.exe224⤵PID:4016
-
\??\c:\rrfxrrf.exec:\rrfxrrf.exe225⤵PID:3464
-
\??\c:\hhhhbb.exec:\hhhhbb.exe226⤵PID:232
-
\??\c:\pjpjj.exec:\pjpjj.exe227⤵PID:2276
-
\??\c:\vpjjj.exec:\vpjjj.exe228⤵PID:1832
-
\??\c:\fxlxffl.exec:\fxlxffl.exe229⤵PID:3680
-
\??\c:\bnnnnn.exec:\bnnnnn.exe230⤵PID:1816
-
\??\c:\hbhbtt.exec:\hbhbtt.exe231⤵PID:1164
-
\??\c:\7pvpj.exec:\7pvpj.exe232⤵PID:3092
-
\??\c:\pjdpj.exec:\pjdpj.exe233⤵PID:2744
-
\??\c:\xrrxxff.exec:\xrrxxff.exe234⤵PID:3228
-
\??\c:\lfrllll.exec:\lfrllll.exe235⤵PID:4468
-
\??\c:\nbtnnn.exec:\nbtnnn.exe236⤵PID:4404
-
\??\c:\7djdv.exec:\7djdv.exe237⤵PID:3460
-
\??\c:\jvdjv.exec:\jvdjv.exe238⤵PID:2760
-
\??\c:\lxxxllf.exec:\lxxxllf.exe239⤵PID:548
-
\??\c:\bntnhn.exec:\bntnhn.exe240⤵PID:1924
-
\??\c:\thnnhh.exec:\thnnhh.exe241⤵PID:4812
-
\??\c:\pjppp.exec:\pjppp.exe242⤵PID:5056