Analysis
-
max time kernel
101s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 22:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
15da6ff50c57734fd5fea002c76a2670_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
15da6ff50c57734fd5fea002c76a2670_NeikiAnalytics.exe
-
Size
75KB
-
MD5
15da6ff50c57734fd5fea002c76a2670
-
SHA1
2ea1564ddd79191acd83cd17745b387a12755281
-
SHA256
f4463d2638f7b545912b56e05b1d1fb876a525a9d96630e762bdcb3e2649c34b
-
SHA512
e3a4d9befd0cacc5f1ef877f0ba9a49b4138e5fe1c82a20246a60b2ea94002bacbd64ec15b7c7f03067560b8dd703e8d82be20ef101f022a665cb9cc4118b727
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAX8gu3Gno9yvrjKD:ymb3NkkiQ3mdBjFo68t3Gno9I4
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/2320-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/312-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-60-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2896-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3008-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/352-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1044-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1840-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2164-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1884-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1636-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xrlrlrx.exe3tthth.exedvddp.exe5fxrxxr.exenhbntb.exepjdpd.exepjjvj.exe9lxrxxl.exebbhtbt.exetthntb.exe7vvdj.exejvpdv.exe3xrfxff.exebthnth.exehbtttt.exe3jjvv.exe7djvj.exelrlflll.exe1tthbn.exebthnnn.exedjvjj.exe5dvjv.exe5lflrrx.exe9hnntt.exebnbhhh.exevpjjp.exedpvpp.exelrflrrf.exetnhtbb.exehhtbth.exevjvdj.exerrlxxll.exelfrflrx.exebbnthh.exehhbttb.exeppddv.exeddvdv.exexlflxrr.exenbntbb.exetthbhb.exepdvpv.exe9ddjj.exerlxxlrf.exefxrrffl.exe5nnntn.exejpvjd.exejdvpp.exexxlxxlf.exelfllxxx.exennbbhh.exenhtbtb.exehhbnhb.exevpjjj.exejddjp.exellxrxrr.exerflrxfl.exehbtbnb.exe3btbbh.exevpppp.exedvdjv.exedvjpv.exerlrrflx.exerlrxxlr.exetntbbb.exepid process 3028 xrlrlrx.exe 312 3tthth.exe 2656 dvddp.exe 2584 5fxrxxr.exe 2896 nhbntb.exe 3008 pjdpd.exe 2464 pjjvj.exe 2520 9lxrxxl.exe 2992 bbhtbt.exe 2848 tthntb.exe 2836 7vvdj.exe 2436 jvpdv.exe 2336 3xrfxff.exe 352 bthnth.exe 1888 hbtttt.exe 2764 3jjvv.exe 1044 7djvj.exe 1840 lrlflll.exe 1336 1tthbn.exe 2440 bthnnn.exe 2096 djvjj.exe 696 5dvjv.exe 1396 5lflrrx.exe 2164 9hnntt.exe 1084 bnbhhh.exe 1884 vpjjp.exe 1220 dpvpp.exe 2272 lrflrrf.exe 1636 tnhtbb.exe 1528 hhtbth.exe 1516 vjvdj.exe 2208 rrlxxll.exe 2888 lfrflrx.exe 1588 bbnthh.exe 3048 hhbttb.exe 2684 ppddv.exe 2656 ddvdv.exe 3040 xlflxrr.exe 2284 nbntbb.exe 2896 tthbhb.exe 3008 pdvpv.exe 2456 9ddjj.exe 2296 rlxxlrf.exe 1936 fxrrffl.exe 1544 5nnntn.exe 2824 jpvjd.exe 1960 jdvpp.exe 2820 xxlxxlf.exe 2768 lfllxxx.exe 2336 nnbbhh.exe 352 nhtbtb.exe 2772 hhbnhb.exe 1772 vpjjj.exe 2764 jddjp.exe 1668 llxrxrr.exe 1760 rflrxfl.exe 2044 hbtbnb.exe 2920 3btbbh.exe 2444 vpppp.exe 2084 dvdjv.exe 696 dvjpv.exe 576 rlrrflx.exe 1836 rlrxxlr.exe 2428 tntbbb.exe -
Processes:
resource yara_rule behavioral1/memory/2320-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/312-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/352-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1044-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1840-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2164-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1884-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1636-278-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
15da6ff50c57734fd5fea002c76a2670_NeikiAnalytics.exexrlrlrx.exe3tthth.exedvddp.exe5fxrxxr.exenhbntb.exepjdpd.exepjjvj.exe9lxrxxl.exebbhtbt.exetthntb.exe7vvdj.exejvpdv.exe3xrfxff.exebthnth.exehbtttt.exedescription pid process target process PID 2320 wrote to memory of 3028 2320 15da6ff50c57734fd5fea002c76a2670_NeikiAnalytics.exe xrlrlrx.exe PID 2320 wrote to memory of 3028 2320 15da6ff50c57734fd5fea002c76a2670_NeikiAnalytics.exe xrlrlrx.exe PID 2320 wrote to memory of 3028 2320 15da6ff50c57734fd5fea002c76a2670_NeikiAnalytics.exe xrlrlrx.exe PID 2320 wrote to memory of 3028 2320 15da6ff50c57734fd5fea002c76a2670_NeikiAnalytics.exe xrlrlrx.exe PID 3028 wrote to memory of 312 3028 xrlrlrx.exe 3tthth.exe PID 3028 wrote to memory of 312 3028 xrlrlrx.exe 3tthth.exe PID 3028 wrote to memory of 312 3028 xrlrlrx.exe 3tthth.exe PID 3028 wrote to memory of 312 3028 xrlrlrx.exe 3tthth.exe PID 312 wrote to memory of 2656 312 3tthth.exe dvddp.exe PID 312 wrote to memory of 2656 312 3tthth.exe dvddp.exe PID 312 wrote to memory of 2656 312 3tthth.exe dvddp.exe PID 312 wrote to memory of 2656 312 3tthth.exe dvddp.exe PID 2656 wrote to memory of 2584 2656 dvddp.exe 5fxrxxr.exe PID 2656 wrote to memory of 2584 2656 dvddp.exe 5fxrxxr.exe PID 2656 wrote to memory of 2584 2656 dvddp.exe 5fxrxxr.exe PID 2656 wrote to memory of 2584 2656 dvddp.exe 5fxrxxr.exe PID 2584 wrote to memory of 2896 2584 5fxrxxr.exe nhbntb.exe PID 2584 wrote to memory of 2896 2584 5fxrxxr.exe nhbntb.exe PID 2584 wrote to memory of 2896 2584 5fxrxxr.exe nhbntb.exe PID 2584 wrote to memory of 2896 2584 5fxrxxr.exe nhbntb.exe PID 2896 wrote to memory of 3008 2896 nhbntb.exe pjdpd.exe PID 2896 wrote to memory of 3008 2896 nhbntb.exe pjdpd.exe PID 2896 wrote to memory of 3008 2896 nhbntb.exe pjdpd.exe PID 2896 wrote to memory of 3008 2896 nhbntb.exe pjdpd.exe PID 3008 wrote to memory of 2464 3008 pjdpd.exe pjjvj.exe PID 3008 wrote to memory of 2464 3008 pjdpd.exe pjjvj.exe PID 3008 wrote to memory of 2464 3008 pjdpd.exe pjjvj.exe PID 3008 wrote to memory of 2464 3008 pjdpd.exe pjjvj.exe PID 2464 wrote to memory of 2520 2464 pjjvj.exe 9lxrxxl.exe PID 2464 wrote to memory of 2520 2464 pjjvj.exe 9lxrxxl.exe PID 2464 wrote to memory of 2520 2464 pjjvj.exe 9lxrxxl.exe PID 2464 wrote to memory of 2520 2464 pjjvj.exe 9lxrxxl.exe PID 2520 wrote to memory of 2992 2520 9lxrxxl.exe bbhtbt.exe PID 2520 wrote to memory of 2992 2520 9lxrxxl.exe bbhtbt.exe PID 2520 wrote to memory of 2992 2520 9lxrxxl.exe bbhtbt.exe PID 2520 wrote to memory of 2992 2520 9lxrxxl.exe bbhtbt.exe PID 2992 wrote to memory of 2848 2992 bbhtbt.exe tthntb.exe PID 2992 wrote to memory of 2848 2992 bbhtbt.exe tthntb.exe PID 2992 wrote to memory of 2848 2992 bbhtbt.exe tthntb.exe PID 2992 wrote to memory of 2848 2992 bbhtbt.exe tthntb.exe PID 2848 wrote to memory of 2836 2848 tthntb.exe 7vvdj.exe PID 2848 wrote to memory of 2836 2848 tthntb.exe 7vvdj.exe PID 2848 wrote to memory of 2836 2848 tthntb.exe 7vvdj.exe PID 2848 wrote to memory of 2836 2848 tthntb.exe 7vvdj.exe PID 2836 wrote to memory of 2436 2836 7vvdj.exe jvpdv.exe PID 2836 wrote to memory of 2436 2836 7vvdj.exe jvpdv.exe PID 2836 wrote to memory of 2436 2836 7vvdj.exe jvpdv.exe PID 2836 wrote to memory of 2436 2836 7vvdj.exe jvpdv.exe PID 2436 wrote to memory of 2336 2436 jvpdv.exe 3xrfxff.exe PID 2436 wrote to memory of 2336 2436 jvpdv.exe 3xrfxff.exe PID 2436 wrote to memory of 2336 2436 jvpdv.exe 3xrfxff.exe PID 2436 wrote to memory of 2336 2436 jvpdv.exe 3xrfxff.exe PID 2336 wrote to memory of 352 2336 3xrfxff.exe bthnth.exe PID 2336 wrote to memory of 352 2336 3xrfxff.exe bthnth.exe PID 2336 wrote to memory of 352 2336 3xrfxff.exe bthnth.exe PID 2336 wrote to memory of 352 2336 3xrfxff.exe bthnth.exe PID 352 wrote to memory of 1888 352 bthnth.exe hbtttt.exe PID 352 wrote to memory of 1888 352 bthnth.exe hbtttt.exe PID 352 wrote to memory of 1888 352 bthnth.exe hbtttt.exe PID 352 wrote to memory of 1888 352 bthnth.exe hbtttt.exe PID 1888 wrote to memory of 2764 1888 hbtttt.exe 3jjvv.exe PID 1888 wrote to memory of 2764 1888 hbtttt.exe 3jjvv.exe PID 1888 wrote to memory of 2764 1888 hbtttt.exe 3jjvv.exe PID 1888 wrote to memory of 2764 1888 hbtttt.exe 3jjvv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\15da6ff50c57734fd5fea002c76a2670_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\15da6ff50c57734fd5fea002c76a2670_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\xrlrlrx.exec:\xrlrlrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\3tthth.exec:\3tthth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312 -
\??\c:\dvddp.exec:\dvddp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\5fxrxxr.exec:\5fxrxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\nhbntb.exec:\nhbntb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\pjdpd.exec:\pjdpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\pjjvj.exec:\pjjvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\9lxrxxl.exec:\9lxrxxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\bbhtbt.exec:\bbhtbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\tthntb.exec:\tthntb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\7vvdj.exec:\7vvdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\jvpdv.exec:\jvpdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\3xrfxff.exec:\3xrfxff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\bthnth.exec:\bthnth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:352 -
\??\c:\hbtttt.exec:\hbtttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\3jjvv.exec:\3jjvv.exe17⤵
- Executes dropped EXE
PID:2764 -
\??\c:\7djvj.exec:\7djvj.exe18⤵
- Executes dropped EXE
PID:1044 -
\??\c:\lrlflll.exec:\lrlflll.exe19⤵
- Executes dropped EXE
PID:1840 -
\??\c:\1tthbn.exec:\1tthbn.exe20⤵
- Executes dropped EXE
PID:1336 -
\??\c:\bthnnn.exec:\bthnnn.exe21⤵
- Executes dropped EXE
PID:2440 -
\??\c:\djvjj.exec:\djvjj.exe22⤵
- Executes dropped EXE
PID:2096 -
\??\c:\5dvjv.exec:\5dvjv.exe23⤵
- Executes dropped EXE
PID:696 -
\??\c:\5lflrrx.exec:\5lflrrx.exe24⤵
- Executes dropped EXE
PID:1396 -
\??\c:\9hnntt.exec:\9hnntt.exe25⤵
- Executes dropped EXE
PID:2164 -
\??\c:\bnbhhh.exec:\bnbhhh.exe26⤵
- Executes dropped EXE
PID:1084 -
\??\c:\vpjjp.exec:\vpjjp.exe27⤵
- Executes dropped EXE
PID:1884 -
\??\c:\dpvpp.exec:\dpvpp.exe28⤵
- Executes dropped EXE
PID:1220 -
\??\c:\lrflrrf.exec:\lrflrrf.exe29⤵
- Executes dropped EXE
PID:2272 -
\??\c:\tnhtbb.exec:\tnhtbb.exe30⤵
- Executes dropped EXE
PID:1636 -
\??\c:\hhtbth.exec:\hhtbth.exe31⤵
- Executes dropped EXE
PID:1528 -
\??\c:\vjvdj.exec:\vjvdj.exe32⤵
- Executes dropped EXE
PID:1516 -
\??\c:\rrlxxll.exec:\rrlxxll.exe33⤵
- Executes dropped EXE
PID:2208 -
\??\c:\lfrflrx.exec:\lfrflrx.exe34⤵
- Executes dropped EXE
PID:2888 -
\??\c:\bbnthh.exec:\bbnthh.exe35⤵
- Executes dropped EXE
PID:1588 -
\??\c:\hhbttb.exec:\hhbttb.exe36⤵
- Executes dropped EXE
PID:3048 -
\??\c:\ppddv.exec:\ppddv.exe37⤵
- Executes dropped EXE
PID:2684 -
\??\c:\ddvdv.exec:\ddvdv.exe38⤵
- Executes dropped EXE
PID:2656 -
\??\c:\xlflxrr.exec:\xlflxrr.exe39⤵
- Executes dropped EXE
PID:3040 -
\??\c:\nbntbb.exec:\nbntbb.exe40⤵
- Executes dropped EXE
PID:2284 -
\??\c:\tthbhb.exec:\tthbhb.exe41⤵
- Executes dropped EXE
PID:2896 -
\??\c:\pdvpv.exec:\pdvpv.exe42⤵
- Executes dropped EXE
PID:3008 -
\??\c:\9ddjj.exec:\9ddjj.exe43⤵
- Executes dropped EXE
PID:2456 -
\??\c:\rlxxlrf.exec:\rlxxlrf.exe44⤵
- Executes dropped EXE
PID:2296 -
\??\c:\fxrrffl.exec:\fxrrffl.exe45⤵
- Executes dropped EXE
PID:1936 -
\??\c:\5nnntn.exec:\5nnntn.exe46⤵
- Executes dropped EXE
PID:1544 -
\??\c:\jpvjd.exec:\jpvjd.exe47⤵
- Executes dropped EXE
PID:2824 -
\??\c:\jdvpp.exec:\jdvpp.exe48⤵
- Executes dropped EXE
PID:1960 -
\??\c:\xxlxxlf.exec:\xxlxxlf.exe49⤵
- Executes dropped EXE
PID:2820 -
\??\c:\lfllxxx.exec:\lfllxxx.exe50⤵
- Executes dropped EXE
PID:2768 -
\??\c:\nnbbhh.exec:\nnbbhh.exe51⤵
- Executes dropped EXE
PID:2336 -
\??\c:\nhtbtb.exec:\nhtbtb.exe52⤵
- Executes dropped EXE
PID:352 -
\??\c:\hhbnhb.exec:\hhbnhb.exe53⤵
- Executes dropped EXE
PID:2772 -
\??\c:\vpjjj.exec:\vpjjj.exe54⤵
- Executes dropped EXE
PID:1772 -
\??\c:\jddjp.exec:\jddjp.exe55⤵
- Executes dropped EXE
PID:2764 -
\??\c:\llxrxrr.exec:\llxrxrr.exe56⤵
- Executes dropped EXE
PID:1668 -
\??\c:\rflrxfl.exec:\rflrxfl.exe57⤵
- Executes dropped EXE
PID:1760 -
\??\c:\hbtbnb.exec:\hbtbnb.exe58⤵
- Executes dropped EXE
PID:2044 -
\??\c:\3btbbh.exec:\3btbbh.exe59⤵
- Executes dropped EXE
PID:2920 -
\??\c:\vpppp.exec:\vpppp.exe60⤵
- Executes dropped EXE
PID:2444 -
\??\c:\dvdjv.exec:\dvdjv.exe61⤵
- Executes dropped EXE
PID:2084 -
\??\c:\dvjpv.exec:\dvjpv.exe62⤵
- Executes dropped EXE
PID:696 -
\??\c:\rlrrflx.exec:\rlrrflx.exe63⤵
- Executes dropped EXE
PID:576 -
\??\c:\rlrxxlr.exec:\rlrxxlr.exe64⤵
- Executes dropped EXE
PID:1836 -
\??\c:\tntbbb.exec:\tntbbb.exe65⤵
- Executes dropped EXE
PID:2428 -
\??\c:\nhtthh.exec:\nhtthh.exe66⤵PID:2156
-
\??\c:\dvpjp.exec:\dvpjp.exe67⤵PID:452
-
\??\c:\pjddp.exec:\pjddp.exe68⤵PID:1268
-
\??\c:\pjddj.exec:\pjddj.exe69⤵PID:996
-
\??\c:\1flrlxx.exec:\1flrlxx.exe70⤵PID:1160
-
\??\c:\frrfxrx.exec:\frrfxrx.exe71⤵PID:3060
-
\??\c:\5hbhtb.exec:\5hbhtb.exe72⤵PID:1308
-
\??\c:\hhbhbb.exec:\hhbhbb.exe73⤵PID:1516
-
\??\c:\ppdjd.exec:\ppdjd.exe74⤵PID:308
-
\??\c:\jpjdd.exec:\jpjdd.exe75⤵PID:2028
-
\??\c:\fffllrx.exec:\fffllrx.exe76⤵PID:3044
-
\??\c:\xrfrxlx.exec:\xrfrxlx.exe77⤵PID:2252
-
\??\c:\tbtbnn.exec:\tbtbnn.exe78⤵PID:2908
-
\??\c:\nbnbnn.exec:\nbnbnn.exe79⤵PID:2592
-
\??\c:\pjppv.exec:\pjppv.exe80⤵PID:2612
-
\??\c:\1vvjv.exec:\1vvjv.exe81⤵PID:1736
-
\??\c:\ddvvp.exec:\ddvvp.exe82⤵PID:2704
-
\??\c:\5lxlrxx.exec:\5lxlrxx.exe83⤵PID:2532
-
\??\c:\1xxrxfl.exec:\1xxrxfl.exe84⤵PID:2984
-
\??\c:\3nbbnb.exec:\3nbbnb.exe85⤵PID:2520
-
\??\c:\nhntbb.exec:\nhntbb.exe86⤵PID:2068
-
\??\c:\9pjpv.exec:\9pjpv.exe87⤵PID:2880
-
\??\c:\pppvp.exec:\pppvp.exe88⤵PID:2868
-
\??\c:\fffrlrl.exec:\fffrlrl.exe89⤵PID:2796
-
\??\c:\lfxllxr.exec:\lfxllxr.exe90⤵PID:2968
-
\??\c:\nbhttb.exec:\nbhttb.exe91⤵PID:2820
-
\??\c:\bbtbth.exec:\bbtbth.exe92⤵PID:1932
-
\??\c:\dvppd.exec:\dvppd.exe93⤵PID:2508
-
\??\c:\jvjjd.exec:\jvjjd.exe94⤵PID:2776
-
\??\c:\ppdvj.exec:\ppdvj.exe95⤵PID:1004
-
\??\c:\lxlrxlf.exec:\lxlrxlf.exe96⤵PID:1772
-
\??\c:\xrrrrxl.exec:\xrrrrxl.exe97⤵PID:920
-
\??\c:\hnttnb.exec:\hnttnb.exe98⤵PID:1928
-
\??\c:\1htthb.exec:\1htthb.exe99⤵PID:2040
-
\??\c:\3vppd.exec:\3vppd.exe100⤵PID:668
-
\??\c:\pjpvd.exec:\pjpvd.exe101⤵PID:1596
-
\??\c:\rlrlrxx.exec:\rlrlrxx.exe102⤵PID:1252
-
\??\c:\xxlrrxx.exec:\xxlrrxx.exe103⤵PID:1496
-
\??\c:\7ttbnb.exec:\7ttbnb.exe104⤵PID:1052
-
\??\c:\vppvp.exec:\vppvp.exe105⤵PID:1872
-
\??\c:\ppvdv.exec:\ppvdv.exe106⤵PID:1684
-
\??\c:\hnbhnt.exec:\hnbhnt.exe107⤵PID:1060
-
\??\c:\jvvdp.exec:\jvvdp.exe108⤵PID:2156
-
\??\c:\xxfflrf.exec:\xxfflrf.exe109⤵PID:1220
-
\??\c:\nbnntt.exec:\nbnntt.exe110⤵PID:320
-
\??\c:\7vvvd.exec:\7vvvd.exe111⤵PID:560
-
\??\c:\dvjpv.exec:\dvjpv.exe112⤵PID:3024
-
\??\c:\flffflx.exec:\flffflx.exe113⤵PID:3060
-
\??\c:\nhbbth.exec:\nhbbth.exe114⤵PID:2224
-
\??\c:\3pdjp.exec:\3pdjp.exe115⤵PID:1516
-
\??\c:\5pjdp.exec:\5pjdp.exe116⤵PID:2888
-
\??\c:\rfrrffr.exec:\rfrrffr.exe117⤵PID:1700
-
\??\c:\9ffflrf.exec:\9ffflrf.exe118⤵PID:2660
-
\??\c:\nhttbh.exec:\nhttbh.exe119⤵PID:2640
-
\??\c:\tnntht.exec:\tnntht.exe120⤵PID:2908
-
\??\c:\hbbhhn.exec:\hbbhhn.exe121⤵PID:3036
-
\??\c:\jddpp.exec:\jddpp.exe122⤵PID:2576
-
\??\c:\xrlxxlr.exec:\xrlxxlr.exe123⤵PID:2472
-
\??\c:\fxlrrxl.exec:\fxlrrxl.exe124⤵PID:2524
-
\??\c:\hhbnhn.exec:\hhbnhn.exe125⤵PID:2464
-
\??\c:\tttbhn.exec:\tttbhn.exe126⤵PID:2980
-
\??\c:\vddpp.exec:\vddpp.exe127⤵PID:2856
-
\??\c:\vvdvd.exec:\vvdvd.exe128⤵PID:2992
-
\??\c:\5rfrfxx.exec:\5rfrfxx.exe129⤵PID:2804
-
\??\c:\xffxxrr.exec:\xffxxrr.exe130⤵PID:2868
-
\??\c:\lfrrfrf.exec:\lfrrfrf.exe131⤵PID:2032
-
\??\c:\pjvdp.exec:\pjvdp.exe132⤵PID:1996
-
\??\c:\9dppp.exec:\9dppp.exe133⤵PID:1412
-
\??\c:\ffxrrlf.exec:\ffxrrlf.exe134⤵PID:1932
-
\??\c:\ffxflrf.exec:\ffxflrf.exe135⤵PID:1952
-
\??\c:\hbtbhh.exec:\hbtbhh.exe136⤵PID:1776
-
\??\c:\hnbnnh.exec:\hnbnnh.exe137⤵PID:1784
-
\??\c:\5jdjv.exec:\5jdjv.exe138⤵PID:2312
-
\??\c:\jdpjj.exec:\jdpjj.exe139⤵PID:2916
-
\??\c:\rfrxfrx.exec:\rfrxfrx.exe140⤵PID:2700
-
\??\c:\fxrfrrx.exec:\fxrfrrx.exe141⤵PID:600
-
\??\c:\5tbbnb.exec:\5tbbnb.exe142⤵PID:2052
-
\??\c:\tbnnhn.exec:\tbnnhn.exe143⤵PID:332
-
\??\c:\7vdpd.exec:\7vdpd.exe144⤵PID:588
-
\??\c:\xxxrxlx.exec:\xxxrxlx.exe145⤵PID:2956
-
\??\c:\9lffrlx.exec:\9lffrlx.exe146⤵PID:2420
-
\??\c:\3nnntb.exec:\3nnntb.exe147⤵PID:1272
-
\??\c:\htnthn.exec:\htnthn.exe148⤵PID:412
-
\??\c:\9vdvd.exec:\9vdvd.exe149⤵PID:1244
-
\??\c:\dvjvd.exec:\dvjvd.exe150⤵PID:984
-
\??\c:\fxlllfl.exec:\fxlllfl.exe151⤵PID:572
-
\??\c:\rfxxrxf.exec:\rfxxrxf.exe152⤵PID:1676
-
\??\c:\hbnntt.exec:\hbnntt.exe153⤵PID:2936
-
\??\c:\jppvd.exec:\jppvd.exe154⤵PID:1520
-
\??\c:\vjvpd.exec:\vjvpd.exe155⤵PID:2200
-
\??\c:\7rrrxxf.exec:\7rrrxxf.exe156⤵PID:1308
-
\??\c:\hbnbnt.exec:\hbnbnt.exe157⤵PID:2208
-
\??\c:\hnhtbb.exec:\hnhtbb.exe158⤵PID:2888
-
\??\c:\ppvpd.exec:\ppvpd.exe159⤵PID:1700
-
\??\c:\9djdp.exec:\9djdp.exe160⤵PID:2660
-
\??\c:\frxxffr.exec:\frxxffr.exe161⤵PID:2900
-
\??\c:\frfrllr.exec:\frfrllr.exe162⤵PID:2908
-
\??\c:\btnttb.exec:\btnttb.exe163⤵PID:2728
-
\??\c:\nhbhbh.exec:\nhbhbh.exe164⤵PID:2676
-
\??\c:\vdjvv.exec:\vdjvv.exe165⤵PID:1976
-
\??\c:\vvjpv.exec:\vvjpv.exe166⤵PID:2716
-
\??\c:\dvdvj.exec:\dvdvj.exe167⤵PID:2296
-
\??\c:\xxrlfxr.exec:\xxrlfxr.exe168⤵PID:2984
-
\??\c:\lrfflrl.exec:\lrfflrl.exe169⤵PID:2856
-
\??\c:\3tnhnt.exec:\3tnhnt.exe170⤵PID:2780
-
\??\c:\bhttnb.exec:\bhttnb.exe171⤵PID:1960
-
\??\c:\pvjpj.exec:\pvjpj.exe172⤵PID:2436
-
\??\c:\rfxxlrf.exec:\rfxxlrf.exe173⤵PID:2760
-
\??\c:\ffxlxxf.exec:\ffxlxxf.exe174⤵PID:2000
-
\??\c:\hbtbhh.exec:\hbtbhh.exe175⤵PID:2528
-
\??\c:\nbnnth.exec:\nbnnth.exe176⤵PID:2340
-
\??\c:\jdvjv.exec:\jdvjv.exe177⤵PID:1952
-
\??\c:\dvpdv.exec:\dvpdv.exe178⤵PID:1776
-
\??\c:\jdvdp.exec:\jdvdp.exe179⤵PID:2108
-
\??\c:\9lfxflr.exec:\9lfxflr.exe180⤵PID:2080
-
\??\c:\1fxlrll.exec:\1fxlrll.exe181⤵PID:2916
-
\??\c:\1btbhb.exec:\1btbhb.exe182⤵PID:268
-
\??\c:\tnhntt.exec:\tnhntt.exe183⤵PID:600
-
\??\c:\9vdvv.exec:\9vdvv.exe184⤵PID:2052
-
\??\c:\1jpjv.exec:\1jpjv.exe185⤵PID:332
-
\??\c:\frxrrlr.exec:\frxrrlr.exe186⤵PID:588
-
\??\c:\ttnbnb.exec:\ttnbnb.exe187⤵PID:1652
-
\??\c:\9bnntt.exec:\9bnntt.exe188⤵PID:2420
-
\??\c:\vpvvj.exec:\vpvvj.exe189⤵PID:1272
-
\??\c:\vddvp.exec:\vddvp.exe190⤵PID:412
-
\??\c:\rlxxxfr.exec:\rlxxxfr.exe191⤵PID:1244
-
\??\c:\lfrxflr.exec:\lfrxflr.exe192⤵PID:984
-
\??\c:\ttbnbb.exec:\ttbnbb.exe193⤵PID:572
-
\??\c:\9bthbn.exec:\9bthbn.exe194⤵PID:2116
-
\??\c:\vpjjp.exec:\vpjjp.exe195⤵PID:2936
-
\??\c:\7vpvp.exec:\7vpvp.exe196⤵PID:1520
-
\??\c:\fxlrxxl.exec:\fxlrxxl.exe197⤵PID:3004
-
\??\c:\5nnthn.exec:\5nnthn.exe198⤵PID:2552
-
\??\c:\3jddp.exec:\3jddp.exe199⤵PID:3064
-
\??\c:\vppdj.exec:\vppdj.exe200⤵PID:2608
-
\??\c:\dvjdp.exec:\dvjdp.exe201⤵PID:2692
-
\??\c:\7xfffxf.exec:\7xfffxf.exe202⤵PID:2688
-
\??\c:\5ffrllf.exec:\5ffrllf.exe203⤵PID:2588
-
\??\c:\3nhhtt.exec:\3nhhtt.exe204⤵PID:1736
-
\??\c:\5bbhnn.exec:\5bbhnn.exe205⤵PID:2704
-
\??\c:\jvdpp.exec:\jvdpp.exe206⤵PID:2632
-
\??\c:\jdvdd.exec:\jdvdd.exe207⤵PID:2560
-
\??\c:\7ddpd.exec:\7ddpd.exe208⤵PID:2520
-
\??\c:\rrxfxll.exec:\rrxfxll.exe209⤵PID:2068
-
\??\c:\rlxxrrr.exec:\rlxxrrr.exe210⤵PID:2880
-
\??\c:\nhntnn.exec:\nhntnn.exe211⤵PID:1284
-
\??\c:\ththth.exec:\ththth.exe212⤵PID:2796
-
\??\c:\bbhtnt.exec:\bbhtnt.exe213⤵PID:2968
-
\??\c:\9pjpd.exec:\9pjpd.exe214⤵PID:2768
-
\??\c:\dvpvd.exec:\dvpvd.exe215⤵PID:2752
-
\??\c:\3jvjv.exec:\3jvjv.exe216⤵PID:2720
-
\??\c:\rffrxrr.exec:\rffrxrr.exe217⤵PID:2776
-
\??\c:\xrlxfrf.exec:\xrlxfrf.exe218⤵PID:2120
-
\??\c:\9xrxffx.exec:\9xrxffx.exe219⤵PID:2248
-
\??\c:\bntbhh.exec:\bntbhh.exe220⤵PID:1756
-
\??\c:\btnhbn.exec:\btnhbn.exe221⤵PID:1732
-
\??\c:\tntbhh.exec:\tntbhh.exe222⤵PID:2440
-
\??\c:\vjpdd.exec:\vjpdd.exe223⤵PID:780
-
\??\c:\pjjjp.exec:\pjjjp.exe224⤵PID:580
-
\??\c:\pjjjj.exec:\pjjjj.exe225⤵PID:1820
-
\??\c:\xrlrrrf.exec:\xrlrrrf.exe226⤵PID:816
-
\??\c:\xrlxxfr.exec:\xrlxxfr.exe227⤵PID:1052
-
\??\c:\llxlfff.exec:\llxlfff.exe228⤵PID:3000
-
\??\c:\nhbthh.exec:\nhbthh.exe229⤵PID:1428
-
\??\c:\nnnnbb.exec:\nnnnbb.exe230⤵PID:1764
-
\??\c:\9pppp.exec:\9pppp.exe231⤵PID:808
-
\??\c:\pdjjd.exec:\pdjjd.exe232⤵PID:1220
-
\??\c:\dvdjj.exec:\dvdjj.exe233⤵PID:1160
-
\??\c:\xrflrxr.exec:\xrflrxr.exe234⤵PID:560
-
\??\c:\xxxxrfx.exec:\xxxxrfx.exe235⤵PID:2016
-
\??\c:\thhntn.exec:\thhntn.exe236⤵PID:2188
-
\??\c:\tnbhbb.exec:\tnbhbb.exe237⤵PID:2200
-
\??\c:\ttnntt.exec:\ttnntt.exe238⤵PID:1308
-
\??\c:\dddjv.exec:\dddjv.exe239⤵PID:3004
-
\??\c:\jppvj.exec:\jppvj.exe240⤵PID:2600
-
\??\c:\lflfffx.exec:\lflfffx.exe241⤵PID:2680
-
\??\c:\3xfrrfx.exec:\3xfrrfx.exe242⤵PID:2708