Analysis
-
max time kernel
149s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 03:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a402c1f1d60cf1356854d5f3a554cea0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
a402c1f1d60cf1356854d5f3a554cea0_NeikiAnalytics.exe
-
Size
91KB
-
MD5
a402c1f1d60cf1356854d5f3a554cea0
-
SHA1
7106f357bbfb1a57248935262dde8ee2393604eb
-
SHA256
757f87b5960d477b8a85993d0dcd2e3e16d3c117898edec2bc588b2b07be06c6
-
SHA512
2fb3b7eeb59b865142a767a5ac9fb8ce6f15347f0736a19cf0ff081efc57a4315e0467c20ff64167f30940d35834e0161c2488615c16efd4643bc95920c03757
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxS1rj/21B:ymb3NkkiQ3mdBjFo73PYP1lri3K8GL
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral2/memory/3708-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4292-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3600-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2420-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2880-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4560-47-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1728-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1740-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1772-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1952-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3100-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/956-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1240-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2792-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2532-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2580-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3292-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1632-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2444-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2940-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1376-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3284-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2384-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jjddj.exerlllrfl.exehnhhbh.exepdvvp.exelrflflr.exebhnhbh.exevvdjv.exexrrrrrr.exehnhtbn.exedvjjp.exennhhnb.exebttnnn.exejvjdv.exexrrrrrl.exebtbttt.exebbhbbb.exejdpjd.exexxxrrrl.exentnbhb.exe5dvvj.exevpjjd.exerllfffx.exe3bbbth.exeddddd.exe9xlfrrf.exebnbtnt.exepjvjj.exejdpjj.exexlxrrrf.exejjjjj.exelllfxxx.exennhnnn.exevpdvp.exedpvdp.exefxxfxrl.exe7nnnnt.exedvddj.exe7fllffx.exelrfffff.exetbtnnn.exehnttnn.exejpddp.exevvpjp.exe7fffrrr.exetnhhbb.exebthbtn.exedvppv.exe3lrllll.exelxrrffl.exentttht.exepjpdp.exepvdvp.exexrrlllf.exehbttth.exehtthbn.exevvvvj.exexlrfxrl.exebhnttt.exebtbhhn.exepjjjp.exejddvp.exe7lxxffl.exeflxllll.exethntnn.exepid process 4292 jjddj.exe 3600 rlllrfl.exe 2420 hnhhbh.exe 1728 pdvvp.exe 2880 lrflflr.exe 4560 bhnhbh.exe 2244 vvdjv.exe 1740 xrrrrrr.exe 1772 hnhtbn.exe 1952 dvjjp.exe 3100 nnhhnb.exe 3768 bttnnn.exe 956 jvjdv.exe 4116 xrrrrrl.exe 1240 btbttt.exe 2792 bbhbbb.exe 2532 jdpjd.exe 2580 xxxrrrl.exe 3292 ntnbhb.exe 1632 5dvvj.exe 1124 vpjjd.exe 2856 rllfffx.exe 1488 3bbbth.exe 2444 ddddd.exe 2940 9xlfrrf.exe 2096 bnbtnt.exe 1376 pjvjj.exe 3284 jdpjj.exe 4440 xlxrrrf.exe 2384 jjjjj.exe 4888 lllfxxx.exe 4072 nnhnnn.exe 4052 vpdvp.exe 3412 dpvdp.exe 3332 fxxfxrl.exe 1300 7nnnnt.exe 3152 dvddj.exe 1464 7fllffx.exe 1204 lrfffff.exe 1264 tbtnnn.exe 1952 hnttnn.exe 2156 jpddp.exe 400 vvpjp.exe 3232 7fffrrr.exe 3304 tnhhbb.exe 4520 bthbtn.exe 3136 dvppv.exe 3240 3lrllll.exe 3400 lxrrffl.exe 3736 ntttht.exe 880 pjpdp.exe 3292 pvdvp.exe 2428 xrrlllf.exe 1124 hbttth.exe 4080 htthbn.exe 2240 vvvvj.exe 1324 xlrfxrl.exe 1668 bhnttt.exe 2940 btbhhn.exe 1696 pjjjp.exe 800 jddvp.exe 4584 7lxxffl.exe 744 flxllll.exe 3724 thntnn.exe -
Processes:
resource yara_rule behavioral2/memory/3708-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4292-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3600-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2420-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2880-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1728-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1740-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1772-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1772-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1772-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1952-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3100-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/956-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1240-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2792-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2532-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2580-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3292-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1632-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2444-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2940-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1376-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3284-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2384-198-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a402c1f1d60cf1356854d5f3a554cea0_NeikiAnalytics.exejjddj.exerlllrfl.exehnhhbh.exepdvvp.exelrflflr.exebhnhbh.exevvdjv.exexrrrrrr.exehnhtbn.exedvjjp.exennhhnb.exebttnnn.exejvjdv.exexrrrrrl.exebtbttt.exebbhbbb.exejdpjd.exexxxrrrl.exentnbhb.exe5dvvj.exevpjjd.exedescription pid process target process PID 3708 wrote to memory of 4292 3708 a402c1f1d60cf1356854d5f3a554cea0_NeikiAnalytics.exe jjddj.exe PID 3708 wrote to memory of 4292 3708 a402c1f1d60cf1356854d5f3a554cea0_NeikiAnalytics.exe jjddj.exe PID 3708 wrote to memory of 4292 3708 a402c1f1d60cf1356854d5f3a554cea0_NeikiAnalytics.exe jjddj.exe PID 4292 wrote to memory of 3600 4292 jjddj.exe rlllrfl.exe PID 4292 wrote to memory of 3600 4292 jjddj.exe rlllrfl.exe PID 4292 wrote to memory of 3600 4292 jjddj.exe rlllrfl.exe PID 3600 wrote to memory of 2420 3600 rlllrfl.exe hnhhbh.exe PID 3600 wrote to memory of 2420 3600 rlllrfl.exe hnhhbh.exe PID 3600 wrote to memory of 2420 3600 rlllrfl.exe hnhhbh.exe PID 2420 wrote to memory of 1728 2420 hnhhbh.exe pdvvp.exe PID 2420 wrote to memory of 1728 2420 hnhhbh.exe pdvvp.exe PID 2420 wrote to memory of 1728 2420 hnhhbh.exe pdvvp.exe PID 1728 wrote to memory of 2880 1728 pdvvp.exe lrflflr.exe PID 1728 wrote to memory of 2880 1728 pdvvp.exe lrflflr.exe PID 1728 wrote to memory of 2880 1728 pdvvp.exe lrflflr.exe PID 2880 wrote to memory of 4560 2880 lrflflr.exe bhnhbh.exe PID 2880 wrote to memory of 4560 2880 lrflflr.exe bhnhbh.exe PID 2880 wrote to memory of 4560 2880 lrflflr.exe bhnhbh.exe PID 4560 wrote to memory of 2244 4560 bhnhbh.exe vvdjv.exe PID 4560 wrote to memory of 2244 4560 bhnhbh.exe vvdjv.exe PID 4560 wrote to memory of 2244 4560 bhnhbh.exe vvdjv.exe PID 2244 wrote to memory of 1740 2244 vvdjv.exe xrrrrrr.exe PID 2244 wrote to memory of 1740 2244 vvdjv.exe xrrrrrr.exe PID 2244 wrote to memory of 1740 2244 vvdjv.exe xrrrrrr.exe PID 1740 wrote to memory of 1772 1740 xrrrrrr.exe hnhtbn.exe PID 1740 wrote to memory of 1772 1740 xrrrrrr.exe hnhtbn.exe PID 1740 wrote to memory of 1772 1740 xrrrrrr.exe hnhtbn.exe PID 1772 wrote to memory of 1952 1772 hnhtbn.exe dvjjp.exe PID 1772 wrote to memory of 1952 1772 hnhtbn.exe dvjjp.exe PID 1772 wrote to memory of 1952 1772 hnhtbn.exe dvjjp.exe PID 1952 wrote to memory of 3100 1952 dvjjp.exe nnhhnb.exe PID 1952 wrote to memory of 3100 1952 dvjjp.exe nnhhnb.exe PID 1952 wrote to memory of 3100 1952 dvjjp.exe nnhhnb.exe PID 3100 wrote to memory of 3768 3100 nnhhnb.exe bttnnn.exe PID 3100 wrote to memory of 3768 3100 nnhhnb.exe bttnnn.exe PID 3100 wrote to memory of 3768 3100 nnhhnb.exe bttnnn.exe PID 3768 wrote to memory of 956 3768 bttnnn.exe jvjdv.exe PID 3768 wrote to memory of 956 3768 bttnnn.exe jvjdv.exe PID 3768 wrote to memory of 956 3768 bttnnn.exe jvjdv.exe PID 956 wrote to memory of 4116 956 jvjdv.exe xrrrrrl.exe PID 956 wrote to memory of 4116 956 jvjdv.exe xrrrrrl.exe PID 956 wrote to memory of 4116 956 jvjdv.exe xrrrrrl.exe PID 4116 wrote to memory of 1240 4116 xrrrrrl.exe btbttt.exe PID 4116 wrote to memory of 1240 4116 xrrrrrl.exe btbttt.exe PID 4116 wrote to memory of 1240 4116 xrrrrrl.exe btbttt.exe PID 1240 wrote to memory of 2792 1240 btbttt.exe bbhbbb.exe PID 1240 wrote to memory of 2792 1240 btbttt.exe bbhbbb.exe PID 1240 wrote to memory of 2792 1240 btbttt.exe bbhbbb.exe PID 2792 wrote to memory of 2532 2792 bbhbbb.exe jdpjd.exe PID 2792 wrote to memory of 2532 2792 bbhbbb.exe jdpjd.exe PID 2792 wrote to memory of 2532 2792 bbhbbb.exe jdpjd.exe PID 2532 wrote to memory of 2580 2532 jdpjd.exe xxxrrrl.exe PID 2532 wrote to memory of 2580 2532 jdpjd.exe xxxrrrl.exe PID 2532 wrote to memory of 2580 2532 jdpjd.exe xxxrrrl.exe PID 2580 wrote to memory of 3292 2580 xxxrrrl.exe ntnbhb.exe PID 2580 wrote to memory of 3292 2580 xxxrrrl.exe ntnbhb.exe PID 2580 wrote to memory of 3292 2580 xxxrrrl.exe ntnbhb.exe PID 3292 wrote to memory of 1632 3292 ntnbhb.exe 5dvvj.exe PID 3292 wrote to memory of 1632 3292 ntnbhb.exe 5dvvj.exe PID 3292 wrote to memory of 1632 3292 ntnbhb.exe 5dvvj.exe PID 1632 wrote to memory of 1124 1632 5dvvj.exe vpjjd.exe PID 1632 wrote to memory of 1124 1632 5dvvj.exe vpjjd.exe PID 1632 wrote to memory of 1124 1632 5dvvj.exe vpjjd.exe PID 1124 wrote to memory of 2856 1124 vpjjd.exe rllfffx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a402c1f1d60cf1356854d5f3a554cea0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a402c1f1d60cf1356854d5f3a554cea0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\jjddj.exec:\jjddj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
\??\c:\rlllrfl.exec:\rlllrfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\hnhhbh.exec:\hnhhbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\pdvvp.exec:\pdvvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\lrflflr.exec:\lrflflr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\bhnhbh.exec:\bhnhbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\vvdjv.exec:\vvdjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\xrrrrrr.exec:\xrrrrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\hnhtbn.exec:\hnhtbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\dvjjp.exec:\dvjjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\nnhhnb.exec:\nnhhnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\bttnnn.exec:\bttnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
\??\c:\jvjdv.exec:\jvjdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
\??\c:\xrrrrrl.exec:\xrrrrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\btbttt.exec:\btbttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\bbhbbb.exec:\bbhbbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\jdpjd.exec:\jdpjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\xxxrrrl.exec:\xxxrrrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\ntnbhb.exec:\ntnbhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\5dvvj.exec:\5dvvj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\vpjjd.exec:\vpjjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
\??\c:\rllfffx.exec:\rllfffx.exe23⤵
- Executes dropped EXE
PID:2856 -
\??\c:\3bbbth.exec:\3bbbth.exe24⤵
- Executes dropped EXE
PID:1488 -
\??\c:\ddddd.exec:\ddddd.exe25⤵
- Executes dropped EXE
PID:2444 -
\??\c:\9xlfrrf.exec:\9xlfrrf.exe26⤵
- Executes dropped EXE
PID:2940 -
\??\c:\bnbtnt.exec:\bnbtnt.exe27⤵
- Executes dropped EXE
PID:2096 -
\??\c:\pjvjj.exec:\pjvjj.exe28⤵
- Executes dropped EXE
PID:1376 -
\??\c:\jdpjj.exec:\jdpjj.exe29⤵
- Executes dropped EXE
PID:3284 -
\??\c:\xlxrrrf.exec:\xlxrrrf.exe30⤵
- Executes dropped EXE
PID:4440 -
\??\c:\jjjjj.exec:\jjjjj.exe31⤵
- Executes dropped EXE
PID:2384 -
\??\c:\lllfxxx.exec:\lllfxxx.exe32⤵
- Executes dropped EXE
PID:4888 -
\??\c:\nnhnnn.exec:\nnhnnn.exe33⤵
- Executes dropped EXE
PID:4072 -
\??\c:\vpdvp.exec:\vpdvp.exe34⤵
- Executes dropped EXE
PID:4052 -
\??\c:\dpvdp.exec:\dpvdp.exe35⤵
- Executes dropped EXE
PID:3412 -
\??\c:\fxxfxrl.exec:\fxxfxrl.exe36⤵
- Executes dropped EXE
PID:3332 -
\??\c:\7nnnnt.exec:\7nnnnt.exe37⤵
- Executes dropped EXE
PID:1300 -
\??\c:\dvddj.exec:\dvddj.exe38⤵
- Executes dropped EXE
PID:3152 -
\??\c:\7fllffx.exec:\7fllffx.exe39⤵
- Executes dropped EXE
PID:1464 -
\??\c:\lrfffff.exec:\lrfffff.exe40⤵
- Executes dropped EXE
PID:1204 -
\??\c:\tbtnnn.exec:\tbtnnn.exe41⤵
- Executes dropped EXE
PID:1264 -
\??\c:\hnttnn.exec:\hnttnn.exe42⤵
- Executes dropped EXE
PID:1952 -
\??\c:\jpddp.exec:\jpddp.exe43⤵
- Executes dropped EXE
PID:2156 -
\??\c:\vvpjp.exec:\vvpjp.exe44⤵
- Executes dropped EXE
PID:400 -
\??\c:\7fffrrr.exec:\7fffrrr.exe45⤵
- Executes dropped EXE
PID:3232 -
\??\c:\tnhhbb.exec:\tnhhbb.exe46⤵
- Executes dropped EXE
PID:3304 -
\??\c:\bthbtn.exec:\bthbtn.exe47⤵
- Executes dropped EXE
PID:4520 -
\??\c:\dvppv.exec:\dvppv.exe48⤵
- Executes dropped EXE
PID:3136 -
\??\c:\3lrllll.exec:\3lrllll.exe49⤵
- Executes dropped EXE
PID:3240 -
\??\c:\lxrrffl.exec:\lxrrffl.exe50⤵
- Executes dropped EXE
PID:3400 -
\??\c:\ntttht.exec:\ntttht.exe51⤵
- Executes dropped EXE
PID:3736 -
\??\c:\pjpdp.exec:\pjpdp.exe52⤵
- Executes dropped EXE
PID:880 -
\??\c:\pvdvp.exec:\pvdvp.exe53⤵
- Executes dropped EXE
PID:3292 -
\??\c:\xrrlllf.exec:\xrrlllf.exe54⤵
- Executes dropped EXE
PID:2428 -
\??\c:\hbttth.exec:\hbttth.exe55⤵
- Executes dropped EXE
PID:1124 -
\??\c:\htthbn.exec:\htthbn.exe56⤵
- Executes dropped EXE
PID:4080 -
\??\c:\vvvvj.exec:\vvvvj.exe57⤵
- Executes dropped EXE
PID:2240 -
\??\c:\xlrfxrl.exec:\xlrfxrl.exe58⤵
- Executes dropped EXE
PID:1324 -
\??\c:\bhnttt.exec:\bhnttt.exe59⤵
- Executes dropped EXE
PID:1668 -
\??\c:\btbhhn.exec:\btbhhn.exe60⤵
- Executes dropped EXE
PID:2940 -
\??\c:\pjjjp.exec:\pjjjp.exe61⤵
- Executes dropped EXE
PID:1696 -
\??\c:\jddvp.exec:\jddvp.exe62⤵
- Executes dropped EXE
PID:800 -
\??\c:\7lxxffl.exec:\7lxxffl.exe63⤵
- Executes dropped EXE
PID:4584 -
\??\c:\flxllll.exec:\flxllll.exe64⤵
- Executes dropped EXE
PID:744 -
\??\c:\thntnn.exec:\thntnn.exe65⤵
- Executes dropped EXE
PID:3724 -
\??\c:\hhnntb.exec:\hhnntb.exe66⤵PID:4908
-
\??\c:\vdjjd.exec:\vdjjd.exe67⤵PID:4812
-
\??\c:\jddvd.exec:\jddvd.exe68⤵PID:4548
-
\??\c:\jjvvj.exec:\jjvvj.exe69⤵PID:4052
-
\??\c:\xxlfxrf.exec:\xxlfxrf.exe70⤵PID:4020
-
\??\c:\9bnnhn.exec:\9bnnhn.exe71⤵PID:4064
-
\??\c:\5jvpv.exec:\5jvpv.exe72⤵PID:2292
-
\??\c:\frxxrfr.exec:\frxxrfr.exe73⤵PID:2132
-
\??\c:\3rxrrrr.exec:\3rxrrrr.exe74⤵PID:2912
-
\??\c:\nhttnb.exec:\nhttnb.exe75⤵PID:456
-
\??\c:\7vdjd.exec:\7vdjd.exe76⤵PID:1952
-
\??\c:\rfrflrx.exec:\rfrflrx.exe77⤵PID:2420
-
\??\c:\3lllrxf.exec:\3lllrxf.exe78⤵PID:4376
-
\??\c:\btttnt.exec:\btttnt.exe79⤵PID:4552
-
\??\c:\bbhhnt.exec:\bbhhnt.exe80⤵PID:1636
-
\??\c:\dpvdp.exec:\dpvdp.exe81⤵PID:3528
-
\??\c:\1xfrrrl.exec:\1xfrrrl.exe82⤵PID:5024
-
\??\c:\nbnnhh.exec:\nbnnhh.exe83⤵PID:1268
-
\??\c:\pjpjj.exec:\pjpjj.exe84⤵PID:3240
-
\??\c:\jjvpp.exec:\jjvpp.exe85⤵PID:1396
-
\??\c:\rffxrrr.exec:\rffxrrr.exe86⤵PID:4712
-
\??\c:\nbbbtt.exec:\nbbbtt.exe87⤵PID:2700
-
\??\c:\pjpjd.exec:\pjpjd.exe88⤵PID:3292
-
\??\c:\dpjpv.exec:\dpjpv.exe89⤵PID:4004
-
\??\c:\3lrrrff.exec:\3lrrrff.exe90⤵PID:2856
-
\??\c:\fxxrllx.exec:\fxxrllx.exe91⤵PID:544
-
\??\c:\tnnnhh.exec:\tnnnhh.exe92⤵PID:1060
-
\??\c:\nhhtnn.exec:\nhhtnn.exe93⤵PID:1552
-
\??\c:\pddjj.exec:\pddjj.exe94⤵PID:4664
-
\??\c:\ddjjp.exec:\ddjjp.exe95⤵PID:3012
-
\??\c:\rlfxxxx.exec:\rlfxxxx.exe96⤵PID:4412
-
\??\c:\xrlrrrf.exec:\xrlrrrf.exe97⤵PID:4944
-
\??\c:\bttttt.exec:\bttttt.exe98⤵PID:3348
-
\??\c:\ddvvp.exec:\ddvvp.exe99⤵PID:2956
-
\??\c:\dvjdj.exec:\dvjdj.exe100⤵PID:1004
-
\??\c:\rllrlrr.exec:\rllrlrr.exe101⤵PID:4256
-
\??\c:\bnhbnn.exec:\bnhbnn.exe102⤵PID:3844
-
\??\c:\3xfxrrr.exec:\3xfxrrr.exe103⤵PID:1728
-
\??\c:\1tbtbb.exec:\1tbtbb.exe104⤵PID:4740
-
\??\c:\nhnnnt.exec:\nhnnnt.exe105⤵PID:4248
-
\??\c:\ddddp.exec:\ddddp.exe106⤵PID:3256
-
\??\c:\jjpjd.exec:\jjpjd.exe107⤵PID:1464
-
\??\c:\lrxlxrr.exec:\lrxlxrr.exe108⤵PID:2052
-
\??\c:\tnbttt.exec:\tnbttt.exe109⤵PID:1108
-
\??\c:\7hnntb.exec:\7hnntb.exe110⤵PID:3100
-
\??\c:\pjvpv.exec:\pjvpv.exe111⤵PID:2156
-
\??\c:\xrxxrrl.exec:\xrxxrrl.exe112⤵PID:1492
-
\??\c:\hnbbnn.exec:\hnbbnn.exe113⤵PID:956
-
\??\c:\5jppp.exec:\5jppp.exe114⤵PID:1636
-
\??\c:\nhnhbb.exec:\nhnhbb.exe115⤵PID:3528
-
\??\c:\3nhhhh.exec:\3nhhhh.exe116⤵PID:5024
-
\??\c:\jdjpd.exec:\jdjpd.exe117⤵PID:1268
-
\??\c:\rrxxllf.exec:\rrxxllf.exe118⤵PID:1384
-
\??\c:\llrlllf.exec:\llrlllf.exe119⤵PID:2120
-
\??\c:\nhhbbb.exec:\nhhbbb.exe120⤵PID:4712
-
\??\c:\dvddd.exec:\dvddd.exe121⤵PID:4728
-
\??\c:\lrrlfff.exec:\lrrlfff.exe122⤵PID:1860
-
\??\c:\tnhbbb.exec:\tnhbbb.exe123⤵PID:1124
-
\??\c:\vjjdd.exec:\vjjdd.exe124⤵PID:2360
-
\??\c:\lllxrrl.exec:\lllxrrl.exe125⤵PID:2444
-
\??\c:\rxxrlff.exec:\rxxrlff.exe126⤵PID:1324
-
\??\c:\hnnhhh.exec:\hnnhhh.exe127⤵PID:1552
-
\??\c:\dpddp.exec:\dpddp.exe128⤵PID:4664
-
\??\c:\jdppv.exec:\jdppv.exe129⤵PID:3012
-
\??\c:\lfxrllf.exec:\lfxrllf.exe130⤵PID:4428
-
\??\c:\pvvpj.exec:\pvvpj.exe131⤵PID:4944
-
\??\c:\rlrlxrx.exec:\rlrlxrx.exe132⤵PID:3760
-
\??\c:\tnbtbb.exec:\tnbtbb.exe133⤵PID:2956
-
\??\c:\pjjpj.exec:\pjjpj.exe134⤵PID:1004
-
\??\c:\xrfxfxf.exec:\xrfxfxf.exe135⤵PID:4256
-
\??\c:\hnnbtn.exec:\hnnbtn.exe136⤵PID:2020
-
\??\c:\bnhtbn.exec:\bnhtbn.exe137⤵PID:4156
-
\??\c:\5jjjj.exec:\5jjjj.exe138⤵PID:1304
-
\??\c:\jdjpj.exec:\jdjpj.exe139⤵PID:3660
-
\??\c:\lflrxff.exec:\lflrxff.exe140⤵PID:3892
-
\??\c:\tbhhnh.exec:\tbhhnh.exe141⤵PID:1264
-
\??\c:\vppdv.exec:\vppdv.exe142⤵PID:1580
-
\??\c:\5ddvp.exec:\5ddvp.exe143⤵PID:4880
-
\??\c:\xlffxff.exec:\xlffxff.exe144⤵PID:400
-
\??\c:\rllrllf.exec:\rllrllf.exe145⤵PID:1648
-
\??\c:\btttnb.exec:\btttnb.exe146⤵PID:1636
-
\??\c:\pdjdd.exec:\pdjdd.exe147⤵PID:4696
-
\??\c:\pddvp.exec:\pddvp.exe148⤵PID:4968
-
\??\c:\7rlfrrl.exec:\7rlfrrl.exe149⤵PID:4528
-
\??\c:\7llfxrl.exec:\7llfxrl.exe150⤵PID:2428
-
\??\c:\bnhnth.exec:\bnhnth.exe151⤵PID:5056
-
\??\c:\vppdv.exec:\vppdv.exe152⤵PID:672
-
\??\c:\vjvdp.exec:\vjvdp.exe153⤵PID:756
-
\??\c:\rxxrffx.exec:\rxxrffx.exe154⤵PID:2444
-
\??\c:\xrffxxr.exec:\xrffxxr.exe155⤵PID:2940
-
\??\c:\hnbnbn.exec:\hnbnbn.exe156⤵PID:2948
-
\??\c:\1ddvp.exec:\1ddvp.exe157⤵PID:4432
-
\??\c:\xrlfxxx.exec:\xrlfxxx.exe158⤵PID:4584
-
\??\c:\bthnhb.exec:\bthnhb.exe159⤵PID:4428
-
\??\c:\pdjvv.exec:\pdjvv.exe160⤵PID:4944
-
\??\c:\tnnbhn.exec:\tnnbhn.exe161⤵PID:3760
-
\??\c:\vjppp.exec:\vjppp.exe162⤵PID:2956
-
\??\c:\rlfrrfx.exec:\rlfrrfx.exe163⤵PID:3008
-
\??\c:\1ntbnh.exec:\1ntbnh.exe164⤵PID:4256
-
\??\c:\jpjdv.exec:\jpjdv.exe165⤵PID:2020
-
\??\c:\5pddj.exec:\5pddj.exe166⤵PID:5028
-
\??\c:\lflxxxl.exec:\lflxxxl.exe167⤵PID:3480
-
\??\c:\bthhhh.exec:\bthhhh.exe168⤵PID:4232
-
\??\c:\dpdpd.exec:\dpdpd.exe169⤵PID:3936
-
\??\c:\flflrfl.exec:\flflrfl.exe170⤵PID:4960
-
\??\c:\rrrrrrx.exec:\rrrrrrx.exe171⤵PID:2796
-
\??\c:\9vpdv.exec:\9vpdv.exe172⤵PID:3060
-
\??\c:\djppd.exec:\djppd.exe173⤵PID:3560
-
\??\c:\rflllfl.exec:\rflllfl.exe174⤵PID:1928
-
\??\c:\tnnhtt.exec:\tnnhtt.exe175⤵PID:1268
-
\??\c:\vjpdp.exec:\vjpdp.exe176⤵PID:4696
-
\??\c:\xrxxfrr.exec:\xrxxfrr.exe177⤵PID:3824
-
\??\c:\lffffll.exec:\lffffll.exe178⤵PID:4528
-
\??\c:\tbbtnt.exec:\tbbtnt.exe179⤵PID:4080
-
\??\c:\jjjdj.exec:\jjjdj.exe180⤵PID:3912
-
\??\c:\rfllllr.exec:\rfllllr.exe181⤵PID:2496
-
\??\c:\xxlxlff.exec:\xxlxlff.exe182⤵PID:1324
-
\??\c:\7htnbb.exec:\7htnbb.exe183⤵PID:1552
-
\??\c:\jvvpd.exec:\jvvpd.exe184⤵PID:800
-
\??\c:\fxllfrx.exec:\fxllfrx.exe185⤵PID:4720
-
\??\c:\lfrrxxr.exec:\lfrrxxr.exe186⤵PID:3244
-
\??\c:\nhhhhh.exec:\nhhhhh.exe187⤵PID:2716
-
\??\c:\nhbbbb.exec:\nhbbbb.exe188⤵PID:5044
-
\??\c:\vpjjd.exec:\vpjjd.exe189⤵PID:4320
-
\??\c:\7vvpd.exec:\7vvpd.exe190⤵PID:2128
-
\??\c:\ffxrlff.exec:\ffxrlff.exe191⤵PID:4052
-
\??\c:\5hhhhh.exec:\5hhhhh.exe192⤵PID:2916
-
\??\c:\9bttth.exec:\9bttth.exe193⤵PID:4256
-
\??\c:\dvvpv.exec:\dvvpv.exe194⤵PID:2552
-
\??\c:\rrxxxxx.exec:\rrxxxxx.exe195⤵PID:4848
-
\??\c:\1nttnh.exec:\1nttnh.exe196⤵PID:3892
-
\??\c:\thtnhh.exec:\thtnhh.exe197⤵PID:4232
-
\??\c:\djddv.exec:\djddv.exe198⤵PID:3936
-
\??\c:\jvjdv.exec:\jvjdv.exe199⤵PID:4960
-
\??\c:\5xrrxrx.exec:\5xrrxrx.exe200⤵PID:2796
-
\??\c:\7bbbtb.exec:\7bbbtb.exe201⤵PID:5032
-
\??\c:\bnbbnn.exec:\bnbbnn.exe202⤵PID:1636
-
\??\c:\dvpvp.exec:\dvpvp.exe203⤵PID:1396
-
\??\c:\rrfxrfx.exec:\rrfxrfx.exe204⤵PID:1816
-
\??\c:\nnnnnn.exec:\nnnnnn.exe205⤵PID:4696
-
\??\c:\hnnttb.exec:\hnnttb.exe206⤵PID:1104
-
\??\c:\dpdvp.exec:\dpdvp.exe207⤵PID:5056
-
\??\c:\rlrlxxx.exec:\rlrlxxx.exe208⤵PID:1488
-
\??\c:\htttht.exec:\htttht.exe209⤵PID:3080
-
\??\c:\vdjvv.exec:\vdjvv.exe210⤵PID:2644
-
\??\c:\fxxrxxl.exec:\fxxrxxl.exe211⤵PID:3492
-
\??\c:\lxfffff.exec:\lxfffff.exe212⤵PID:4524
-
\??\c:\hbnnhh.exec:\hbnnhh.exe213⤵PID:1668
-
\??\c:\hnbnth.exec:\hnbnth.exe214⤵PID:3216
-
\??\c:\xxfffrr.exec:\xxfffrr.exe215⤵PID:4424
-
\??\c:\xrfxxlr.exec:\xrfxxlr.exe216⤵PID:4432
-
\??\c:\9nbntn.exec:\9nbntn.exe217⤵PID:4584
-
\??\c:\tnbtnt.exec:\tnbtnt.exe218⤵PID:2228
-
\??\c:\3jpjp.exec:\3jpjp.exe219⤵PID:2716
-
\??\c:\flrxxxl.exec:\flrxxxl.exe220⤵PID:2364
-
\??\c:\nhtbnb.exec:\nhtbnb.exe221⤵PID:928
-
\??\c:\pvppj.exec:\pvppj.exe222⤵PID:3844
-
\??\c:\1pppp.exec:\1pppp.exe223⤵PID:1672
-
\??\c:\xflxrfx.exec:\xflxrfx.exe224⤵PID:4740
-
\??\c:\hhhtbh.exec:\hhhtbh.exe225⤵PID:5028
-
\??\c:\htbbnb.exec:\htbbnb.exe226⤵PID:2912
-
\??\c:\5pppp.exec:\5pppp.exe227⤵PID:3908
-
\??\c:\xflxrfx.exec:\xflxrfx.exe228⤵PID:2000
-
\??\c:\bhhbnh.exec:\bhhbnh.exe229⤵PID:2508
-
\??\c:\nbhhbt.exec:\nbhhbt.exe230⤵PID:3936
-
\??\c:\vdvjp.exec:\vdvjp.exe231⤵PID:4520
-
\??\c:\lfrrlll.exec:\lfrrlll.exe232⤵PID:1084
-
\??\c:\xxrxxxx.exec:\xxrxxxx.exe233⤵PID:1612
-
\??\c:\1thhnn.exec:\1thhnn.exe234⤵PID:1396
-
\??\c:\jppdv.exec:\jppdv.exe235⤵PID:3028
-
\??\c:\xffflrl.exec:\xffflrl.exe236⤵PID:3460
-
\??\c:\thhbbt.exec:\thhbbt.exe237⤵PID:4612
-
\??\c:\7bnbbb.exec:\7bnbbb.exe238⤵PID:5056
-
\??\c:\dvvjp.exec:\dvvjp.exe239⤵PID:1916
-
\??\c:\lllrxlx.exec:\lllrxlx.exe240⤵PID:3024
-
\??\c:\btbbtb.exec:\btbbtb.exe241⤵PID:1560
-
\??\c:\3bnnbt.exec:\3bnnbt.exe242⤵PID:756