Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 01:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3cba0fb76f7e24be8758c1e572b55740_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
3cba0fb76f7e24be8758c1e572b55740_NeikiAnalytics.exe
-
Size
585KB
-
MD5
3cba0fb76f7e24be8758c1e572b55740
-
SHA1
a0ab49bee53e8f3bc354e8e43dbf7ed0a7348338
-
SHA256
eecb456061d27393e42c39490c265eb5c7e73d5c8a11057f06e6eded4bee8d30
-
SHA512
00363f0e437a777ea17a6b5f9ea1144f446c9b70e83804bc74f118ab04877d343b4bd210ee0262c59b021390817c7ce5cf59cb6859b9dbe513c8715d7f1a0350
-
SSDEEP
12288:n3C9ytvngQjuPh2kkkkK4kXkkkkkkkkl888888888888888888nusMH0QiZQ:SgdnJKPh2kkkkK4kXkkkkkkkkJQ
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/1920-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2340-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/800-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1632-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/280-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/752-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3048-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3008-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1824-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1504-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/588-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1264-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pdppv.exebtbtnh.exedvvjv.exefrllffl.exejvpvj.exeflxxlrl.exerrllxfl.exeddddv.exe5xxfxfl.exenbnthh.exelxfxrxl.exehthntt.exedpdvv.exeddpvj.exe9rxxffr.exe9hhhtb.exepdjpp.exexrxfflr.exefxffxfl.exe9lxxfll.exe9dvvj.exe1rffrxl.exe5thhnn.exevpdjp.exetnnhhb.exe1nhbbt.exevjvjj.exetnnnnb.exedpjjp.exefrflllf.exehnnnbh.exe7dpdv.exehnbbnt.exe7jddj.exexrxflfl.exebnntnb.exedjdjj.exerrfrxfl.exe3xrrffl.exethtbtt.exevjvpp.exe5vjjp.exe5rllrxl.exehbbhhb.exejdjjj.exe1jjjj.exe7rffflx.exenbtbhb.exe1hbbnh.exedvdvp.exexrfxxrf.exerrllllr.exe5nbbbh.exejdppp.exe1dvpj.exelfxxxrx.exerlrrflr.exehbtthh.exe1jddj.exeddddd.exetnbthh.exehbthhh.exefxllrxf.exerlrrxff.exepid process 2900 pdppv.exe 2616 btbtnh.exe 2540 dvvjv.exe 2448 frllffl.exe 2576 jvpvj.exe 2428 flxxlrl.exe 2840 rrllxfl.exe 2340 ddddv.exe 2136 5xxfxfl.exe 2472 nbnthh.exe 800 lxfxrxl.exe 280 hthntt.exe 1632 dpdvv.exe 1576 ddpvj.exe 1648 9rxxffr.exe 1264 9hhhtb.exe 2052 pdjpp.exe 2684 xrxfflr.exe 588 fxffxfl.exe 752 9lxxfll.exe 3048 9dvvj.exe 1148 1rffrxl.exe 2224 5thhnn.exe 1160 vpdjp.exe 2092 tnnhhb.exe 1504 1nhbbt.exe 1824 vjvjj.exe 764 tnnnnb.exe 696 dpjjp.exe 3008 frflllf.exe 2384 hnnnbh.exe 2260 7dpdv.exe 1892 hnbbnt.exe 1552 7jddj.exe 1920 xrxflfl.exe 2924 bnntnb.exe 2652 djdjj.exe 328 rrfrxfl.exe 2540 3xrrffl.exe 2116 thtbtt.exe 2468 vjvpp.exe 2460 5vjjp.exe 2428 5rllrxl.exe 884 hbbhhb.exe 2632 jdjjj.exe 1388 1jjjj.exe 2600 7rffflx.exe 2332 nbtbhb.exe 1440 1hbbnh.exe 1748 dvdvp.exe 1664 xrfxxrf.exe 2688 rrllllr.exe 2140 5nbbbh.exe 2120 jdppp.exe 2016 1dvpj.exe 240 lfxxxrx.exe 2748 rlrrflr.exe 676 hbtthh.exe 600 1jddj.exe 2720 ddddd.exe 1456 tnbthh.exe 2744 hbthhh.exe 1636 fxllrxf.exe 2040 rlrrxff.exe -
Processes:
resource yara_rule behavioral1/memory/1920-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/800-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1632-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/280-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/752-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1824-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1504-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/588-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1264-163-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3cba0fb76f7e24be8758c1e572b55740_NeikiAnalytics.exepdppv.exebtbtnh.exedvvjv.exefrllffl.exejvpvj.exeflxxlrl.exerrllxfl.exeddddv.exe5xxfxfl.exenbnthh.exelxfxrxl.exehthntt.exedpdvv.exeddpvj.exe9rxxffr.exedescription pid process target process PID 1920 wrote to memory of 2900 1920 3cba0fb76f7e24be8758c1e572b55740_NeikiAnalytics.exe pdppv.exe PID 1920 wrote to memory of 2900 1920 3cba0fb76f7e24be8758c1e572b55740_NeikiAnalytics.exe pdppv.exe PID 1920 wrote to memory of 2900 1920 3cba0fb76f7e24be8758c1e572b55740_NeikiAnalytics.exe pdppv.exe PID 1920 wrote to memory of 2900 1920 3cba0fb76f7e24be8758c1e572b55740_NeikiAnalytics.exe pdppv.exe PID 2900 wrote to memory of 2616 2900 pdppv.exe btbtnh.exe PID 2900 wrote to memory of 2616 2900 pdppv.exe btbtnh.exe PID 2900 wrote to memory of 2616 2900 pdppv.exe btbtnh.exe PID 2900 wrote to memory of 2616 2900 pdppv.exe btbtnh.exe PID 2616 wrote to memory of 2540 2616 btbtnh.exe 3xrrffl.exe PID 2616 wrote to memory of 2540 2616 btbtnh.exe 3xrrffl.exe PID 2616 wrote to memory of 2540 2616 btbtnh.exe 3xrrffl.exe PID 2616 wrote to memory of 2540 2616 btbtnh.exe 3xrrffl.exe PID 2540 wrote to memory of 2448 2540 dvvjv.exe frllffl.exe PID 2540 wrote to memory of 2448 2540 dvvjv.exe frllffl.exe PID 2540 wrote to memory of 2448 2540 dvvjv.exe frllffl.exe PID 2540 wrote to memory of 2448 2540 dvvjv.exe frllffl.exe PID 2448 wrote to memory of 2576 2448 frllffl.exe jvpvj.exe PID 2448 wrote to memory of 2576 2448 frllffl.exe jvpvj.exe PID 2448 wrote to memory of 2576 2448 frllffl.exe jvpvj.exe PID 2448 wrote to memory of 2576 2448 frllffl.exe jvpvj.exe PID 2576 wrote to memory of 2428 2576 jvpvj.exe 5rllrxl.exe PID 2576 wrote to memory of 2428 2576 jvpvj.exe 5rllrxl.exe PID 2576 wrote to memory of 2428 2576 jvpvj.exe 5rllrxl.exe PID 2576 wrote to memory of 2428 2576 jvpvj.exe 5rllrxl.exe PID 2428 wrote to memory of 2840 2428 flxxlrl.exe rrllxfl.exe PID 2428 wrote to memory of 2840 2428 flxxlrl.exe rrllxfl.exe PID 2428 wrote to memory of 2840 2428 flxxlrl.exe rrllxfl.exe PID 2428 wrote to memory of 2840 2428 flxxlrl.exe rrllxfl.exe PID 2840 wrote to memory of 2340 2840 rrllxfl.exe ddddv.exe PID 2840 wrote to memory of 2340 2840 rrllxfl.exe ddddv.exe PID 2840 wrote to memory of 2340 2840 rrllxfl.exe ddddv.exe PID 2840 wrote to memory of 2340 2840 rrllxfl.exe ddddv.exe PID 2340 wrote to memory of 2136 2340 ddddv.exe 5xxfxfl.exe PID 2340 wrote to memory of 2136 2340 ddddv.exe 5xxfxfl.exe PID 2340 wrote to memory of 2136 2340 ddddv.exe 5xxfxfl.exe PID 2340 wrote to memory of 2136 2340 ddddv.exe 5xxfxfl.exe PID 2136 wrote to memory of 2472 2136 5xxfxfl.exe nbnthh.exe PID 2136 wrote to memory of 2472 2136 5xxfxfl.exe nbnthh.exe PID 2136 wrote to memory of 2472 2136 5xxfxfl.exe nbnthh.exe PID 2136 wrote to memory of 2472 2136 5xxfxfl.exe nbnthh.exe PID 2472 wrote to memory of 800 2472 nbnthh.exe lxfxrxl.exe PID 2472 wrote to memory of 800 2472 nbnthh.exe lxfxrxl.exe PID 2472 wrote to memory of 800 2472 nbnthh.exe lxfxrxl.exe PID 2472 wrote to memory of 800 2472 nbnthh.exe lxfxrxl.exe PID 800 wrote to memory of 280 800 lxfxrxl.exe hthntt.exe PID 800 wrote to memory of 280 800 lxfxrxl.exe hthntt.exe PID 800 wrote to memory of 280 800 lxfxrxl.exe hthntt.exe PID 800 wrote to memory of 280 800 lxfxrxl.exe hthntt.exe PID 280 wrote to memory of 1632 280 hthntt.exe dpdvv.exe PID 280 wrote to memory of 1632 280 hthntt.exe dpdvv.exe PID 280 wrote to memory of 1632 280 hthntt.exe dpdvv.exe PID 280 wrote to memory of 1632 280 hthntt.exe dpdvv.exe PID 1632 wrote to memory of 1576 1632 dpdvv.exe ddpvj.exe PID 1632 wrote to memory of 1576 1632 dpdvv.exe ddpvj.exe PID 1632 wrote to memory of 1576 1632 dpdvv.exe ddpvj.exe PID 1632 wrote to memory of 1576 1632 dpdvv.exe ddpvj.exe PID 1576 wrote to memory of 1648 1576 ddpvj.exe 9rxxffr.exe PID 1576 wrote to memory of 1648 1576 ddpvj.exe 9rxxffr.exe PID 1576 wrote to memory of 1648 1576 ddpvj.exe 9rxxffr.exe PID 1576 wrote to memory of 1648 1576 ddpvj.exe 9rxxffr.exe PID 1648 wrote to memory of 1264 1648 9rxxffr.exe 9hhhtb.exe PID 1648 wrote to memory of 1264 1648 9rxxffr.exe 9hhhtb.exe PID 1648 wrote to memory of 1264 1648 9rxxffr.exe 9hhhtb.exe PID 1648 wrote to memory of 1264 1648 9rxxffr.exe 9hhhtb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3cba0fb76f7e24be8758c1e572b55740_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3cba0fb76f7e24be8758c1e572b55740_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\pdppv.exec:\pdppv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\btbtnh.exec:\btbtnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\dvvjv.exec:\dvvjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\frllffl.exec:\frllffl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\jvpvj.exec:\jvpvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\flxxlrl.exec:\flxxlrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\rrllxfl.exec:\rrllxfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\ddddv.exec:\ddddv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\5xxfxfl.exec:\5xxfxfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\nbnthh.exec:\nbnthh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\lxfxrxl.exec:\lxfxrxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
\??\c:\hthntt.exec:\hthntt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:280 -
\??\c:\dpdvv.exec:\dpdvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\ddpvj.exec:\ddpvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\9rxxffr.exec:\9rxxffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\9hhhtb.exec:\9hhhtb.exe17⤵
- Executes dropped EXE
PID:1264 -
\??\c:\pdjpp.exec:\pdjpp.exe18⤵
- Executes dropped EXE
PID:2052 -
\??\c:\xrxfflr.exec:\xrxfflr.exe19⤵
- Executes dropped EXE
PID:2684 -
\??\c:\fxffxfl.exec:\fxffxfl.exe20⤵
- Executes dropped EXE
PID:588 -
\??\c:\9lxxfll.exec:\9lxxfll.exe21⤵
- Executes dropped EXE
PID:752 -
\??\c:\9dvvj.exec:\9dvvj.exe22⤵
- Executes dropped EXE
PID:3048 -
\??\c:\1rffrxl.exec:\1rffrxl.exe23⤵
- Executes dropped EXE
PID:1148 -
\??\c:\5thhnn.exec:\5thhnn.exe24⤵
- Executes dropped EXE
PID:2224 -
\??\c:\vpdjp.exec:\vpdjp.exe25⤵
- Executes dropped EXE
PID:1160 -
\??\c:\tnnhhb.exec:\tnnhhb.exe26⤵
- Executes dropped EXE
PID:2092 -
\??\c:\1nhbbt.exec:\1nhbbt.exe27⤵
- Executes dropped EXE
PID:1504 -
\??\c:\vjvjj.exec:\vjvjj.exe28⤵
- Executes dropped EXE
PID:1824 -
\??\c:\tnnnnb.exec:\tnnnnb.exe29⤵
- Executes dropped EXE
PID:764 -
\??\c:\dpjjp.exec:\dpjjp.exe30⤵
- Executes dropped EXE
PID:696 -
\??\c:\frflllf.exec:\frflllf.exe31⤵
- Executes dropped EXE
PID:3008 -
\??\c:\hnnnbh.exec:\hnnnbh.exe32⤵
- Executes dropped EXE
PID:2384 -
\??\c:\7dpdv.exec:\7dpdv.exe33⤵
- Executes dropped EXE
PID:2260 -
\??\c:\hnbbnt.exec:\hnbbnt.exe34⤵
- Executes dropped EXE
PID:1892 -
\??\c:\7jddj.exec:\7jddj.exe35⤵
- Executes dropped EXE
PID:1552 -
\??\c:\xrxflfl.exec:\xrxflfl.exe36⤵
- Executes dropped EXE
PID:1920 -
\??\c:\bnntnb.exec:\bnntnb.exe37⤵
- Executes dropped EXE
PID:2924 -
\??\c:\djdjj.exec:\djdjj.exe38⤵
- Executes dropped EXE
PID:2652 -
\??\c:\rrfrxfl.exec:\rrfrxfl.exe39⤵
- Executes dropped EXE
PID:328 -
\??\c:\3xrrffl.exec:\3xrrffl.exe40⤵
- Executes dropped EXE
PID:2540 -
\??\c:\thtbtt.exec:\thtbtt.exe41⤵
- Executes dropped EXE
PID:2116 -
\??\c:\vjvpp.exec:\vjvpp.exe42⤵
- Executes dropped EXE
PID:2468 -
\??\c:\5vjjp.exec:\5vjjp.exe43⤵
- Executes dropped EXE
PID:2460 -
\??\c:\5rllrxl.exec:\5rllrxl.exe44⤵
- Executes dropped EXE
PID:2428 -
\??\c:\hbbhhb.exec:\hbbhhb.exe45⤵
- Executes dropped EXE
PID:884 -
\??\c:\jdjjj.exec:\jdjjj.exe46⤵
- Executes dropped EXE
PID:2632 -
\??\c:\1jjjj.exec:\1jjjj.exe47⤵
- Executes dropped EXE
PID:1388 -
\??\c:\7rffflx.exec:\7rffflx.exe48⤵
- Executes dropped EXE
PID:2600 -
\??\c:\nbtbhb.exec:\nbtbhb.exe49⤵
- Executes dropped EXE
PID:2332 -
\??\c:\1hbbnh.exec:\1hbbnh.exe50⤵
- Executes dropped EXE
PID:1440 -
\??\c:\dvdvp.exec:\dvdvp.exe51⤵
- Executes dropped EXE
PID:1748 -
\??\c:\xrfxxrf.exec:\xrfxxrf.exe52⤵
- Executes dropped EXE
PID:1664 -
\??\c:\rrllllr.exec:\rrllllr.exe53⤵
- Executes dropped EXE
PID:2688 -
\??\c:\5nbbbh.exec:\5nbbbh.exe54⤵
- Executes dropped EXE
PID:2140 -
\??\c:\jdppp.exec:\jdppp.exe55⤵
- Executes dropped EXE
PID:2120 -
\??\c:\1dvpj.exec:\1dvpj.exe56⤵
- Executes dropped EXE
PID:2016 -
\??\c:\lfxxxrx.exec:\lfxxxrx.exe57⤵
- Executes dropped EXE
PID:240 -
\??\c:\rlrrflr.exec:\rlrrflr.exe58⤵
- Executes dropped EXE
PID:2748 -
\??\c:\hbtthh.exec:\hbtthh.exe59⤵
- Executes dropped EXE
PID:676 -
\??\c:\1jddj.exec:\1jddj.exe60⤵
- Executes dropped EXE
PID:600 -
\??\c:\ddddd.exec:\ddddd.exe61⤵
- Executes dropped EXE
PID:2720 -
\??\c:\tnbthh.exec:\tnbthh.exe62⤵
- Executes dropped EXE
PID:1456 -
\??\c:\hbthhh.exec:\hbthhh.exe63⤵
- Executes dropped EXE
PID:2744 -
\??\c:\fxllrxf.exec:\fxllrxf.exe64⤵
- Executes dropped EXE
PID:1636 -
\??\c:\rlrrxff.exec:\rlrrxff.exe65⤵
- Executes dropped EXE
PID:2040 -
\??\c:\ntbthh.exec:\ntbthh.exe66⤵PID:2596
-
\??\c:\vjvvj.exec:\vjvvj.exe67⤵PID:2160
-
\??\c:\5vpdv.exec:\5vpdv.exe68⤵PID:968
-
\??\c:\5fflllr.exec:\5fflllr.exe69⤵PID:3032
-
\??\c:\thtbhh.exec:\thtbhh.exe70⤵PID:2668
-
\??\c:\pdjdj.exec:\pdjdj.exe71⤵PID:3012
-
\??\c:\xxxxflx.exec:\xxxxflx.exe72⤵PID:2976
-
\??\c:\9hbbnt.exec:\9hbbnt.exe73⤵PID:3008
-
\??\c:\5nbbbb.exec:\5nbbbb.exe74⤵PID:2984
-
\??\c:\djjvp.exec:\djjvp.exe75⤵PID:2344
-
\??\c:\3xfxrxf.exec:\3xfxrxf.exe76⤵PID:1448
-
\??\c:\7nbbhb.exec:\7nbbhb.exe77⤵PID:2800
-
\??\c:\dvjjv.exec:\dvjjv.exe78⤵PID:2700
-
\??\c:\fxrrffr.exec:\fxrrffr.exe79⤵PID:2936
-
\??\c:\hbhnbb.exec:\hbhnbb.exe80⤵PID:2620
-
\??\c:\hbhnhb.exec:\hbhnhb.exe81⤵PID:2560
-
\??\c:\pjpjj.exec:\pjpjj.exe82⤵PID:2772
-
\??\c:\rflfrfl.exec:\rflfrfl.exe83⤵PID:2736
-
\??\c:\pjddp.exec:\pjddp.exe84⤵PID:2540
-
\??\c:\vpdvd.exec:\vpdvd.exe85⤵PID:2528
-
\??\c:\lxxxfll.exec:\lxxxfll.exe86⤵PID:2584
-
\??\c:\nnnnnn.exec:\nnnnnn.exe87⤵PID:3020
-
\??\c:\pdppp.exec:\pdppp.exe88⤵PID:1652
-
\??\c:\9fxfxxl.exec:\9fxfxxl.exe89⤵PID:2300
-
\??\c:\9lxxfff.exec:\9lxxfff.exe90⤵PID:2480
-
\??\c:\ttthhb.exec:\ttthhb.exe91⤵PID:2488
-
\??\c:\1pppj.exec:\1pppj.exe92⤵PID:2472
-
\??\c:\xlrlrrr.exec:\xlrlrrr.exe93⤵PID:2588
-
\??\c:\3hhntb.exec:\3hhntb.exe94⤵PID:1624
-
\??\c:\3nbbtn.exec:\3nbbtn.exe95⤵PID:1944
-
\??\c:\dvddj.exec:\dvddj.exe96⤵PID:2200
-
\??\c:\xllxfxx.exec:\xllxfxx.exe97⤵PID:2688
-
\??\c:\nhhhnn.exec:\nhhhnn.exe98⤵PID:2324
-
\??\c:\7pjdd.exec:\7pjdd.exe99⤵PID:2072
-
\??\c:\pddpp.exec:\pddpp.exe100⤵PID:2052
-
\??\c:\ffxxfll.exec:\ffxxfll.exe101⤵PID:580
-
\??\c:\htbhhb.exec:\htbhhb.exe102⤵PID:2788
-
\??\c:\pdpdd.exec:\pdpdd.exe103⤵PID:572
-
\??\c:\fxrrxff.exec:\fxrrxff.exe104⤵PID:2392
-
\??\c:\nhnntt.exec:\nhnntt.exe105⤵PID:1048
-
\??\c:\nhnhhh.exec:\nhnhhh.exe106⤵PID:2172
-
\??\c:\jdjpd.exec:\jdjpd.exe107⤵PID:1124
-
\??\c:\xxrrflx.exec:\xxrrflx.exe108⤵PID:3056
-
\??\c:\thbhbh.exec:\thbhbh.exe109⤵PID:1480
-
\??\c:\pjjdv.exec:\pjjdv.exe110⤵PID:2596
-
\??\c:\nntthh.exec:\nntthh.exe111⤵PID:3052
-
\??\c:\jvdpp.exec:\jvdpp.exe112⤵PID:1720
-
\??\c:\rlrlfxr.exec:\rlrlfxr.exe113⤵PID:2220
-
\??\c:\bnnhnh.exec:\bnnhnh.exe114⤵PID:1660
-
\??\c:\dvdvd.exec:\dvdvd.exe115⤵PID:1692
-
\??\c:\7flrrxr.exec:\7flrrxr.exe116⤵PID:2920
-
\??\c:\1rlrrxf.exec:\1rlrrxf.exe117⤵PID:2384
-
\??\c:\bbtnbh.exec:\bbtnbh.exe118⤵PID:376
-
\??\c:\ddvdp.exec:\ddvdp.exe119⤵PID:2204
-
\??\c:\rrxxfrr.exec:\rrxxfrr.exe120⤵PID:2184
-
\??\c:\bbtnbt.exec:\bbtnbt.exe121⤵PID:2552
-
\??\c:\dvpvj.exec:\dvpvj.exe122⤵PID:2056
-
\??\c:\jvdvv.exec:\jvdvv.exe123⤵PID:2672
-
\??\c:\1frlrrr.exec:\1frlrrr.exe124⤵PID:2616
-
\??\c:\nhthtb.exec:\nhthtb.exe125⤵PID:2724
-
\??\c:\tthhbn.exec:\tthhbn.exe126⤵PID:2664
-
\??\c:\vvppd.exec:\vvppd.exe127⤵PID:2412
-
\??\c:\rfxffxx.exec:\rfxffxx.exe128⤵PID:2444
-
\??\c:\btbbhh.exec:\btbbhh.exe129⤵PID:2832
-
\??\c:\jjjpd.exec:\jjjpd.exe130⤵PID:2180
-
\??\c:\ddjpd.exec:\ddjpd.exe131⤵PID:2408
-
\??\c:\7fxxrxx.exec:\7fxxrxx.exe132⤵PID:1384
-
\??\c:\hbtbht.exec:\hbtbht.exe133⤵PID:1500
-
\??\c:\pdvvj.exec:\pdvvj.exe134⤵PID:2480
-
\??\c:\pvjjd.exec:\pvjjd.exe135⤵PID:2360
-
\??\c:\xfflfrl.exec:\xfflfrl.exe136⤵PID:800
-
\??\c:\3nbnnn.exec:\3nbnnn.exe137⤵PID:280
-
\??\c:\pjppv.exec:\pjppv.exe138⤵PID:1632
-
\??\c:\lfxlrfl.exec:\lfxlrfl.exe139⤵PID:2124
-
\??\c:\fxrrxfr.exec:\fxrrxfr.exe140⤵PID:3000
-
\??\c:\bbttht.exec:\bbttht.exe141⤵PID:1208
-
\??\c:\vpvvd.exec:\vpvvd.exe142⤵PID:2288
-
\??\c:\llxxflx.exec:\llxxflx.exe143⤵PID:2064
-
\??\c:\7nbbhh.exec:\7nbbhh.exe144⤵PID:780
-
\??\c:\httttt.exec:\httttt.exe145⤵PID:772
-
\??\c:\7dppj.exec:\7dppj.exe146⤵PID:752
-
\??\c:\xlxrrxf.exec:\xlxrrxf.exe147⤵PID:2012
-
\??\c:\7htbbh.exec:\7htbbh.exe148⤵PID:1760
-
\??\c:\3bnhnn.exec:\3bnhnn.exe149⤵PID:1992
-
\??\c:\vdjpj.exec:\vdjpj.exe150⤵PID:1000
-
\??\c:\xlxrlxl.exec:\xlxrlxl.exe151⤵PID:3064
-
\??\c:\bntntt.exec:\bntntt.exe152⤵PID:1612
-
\??\c:\hhtthh.exec:\hhtthh.exe153⤵PID:1908
-
\??\c:\djvvv.exec:\djvvv.exe154⤵PID:2096
-
\??\c:\9frxxfl.exec:\9frxxfl.exe155⤵PID:1732
-
\??\c:\nhbbhh.exec:\nhbbhh.exe156⤵PID:896
-
\??\c:\7vjdj.exec:\7vjdj.exe157⤵PID:2032
-
\??\c:\3jdjj.exec:\3jdjj.exe158⤵PID:1904
-
\??\c:\fxxfxrl.exec:\fxxfxrl.exe159⤵PID:2272
-
\??\c:\7nbhnt.exec:\7nbhnt.exe160⤵PID:3028
-
\??\c:\vvddp.exec:\vvddp.exe161⤵PID:1452
-
\??\c:\vjppv.exec:\vjppv.exe162⤵PID:1956
-
\??\c:\3xllrrl.exec:\3xllrrl.exe163⤵PID:1520
-
\??\c:\3htttn.exec:\3htttn.exe164⤵PID:2988
-
\??\c:\ppppv.exec:\ppppv.exe165⤵PID:1552
-
\??\c:\dvvvp.exec:\dvvvp.exe166⤵PID:2900
-
\??\c:\1xffrrx.exec:\1xffrrx.exe167⤵PID:2624
-
\??\c:\tnbbtb.exec:\tnbbtb.exe168⤵PID:2648
-
\??\c:\ddvpv.exec:\ddvpv.exe169⤵PID:2876
-
\??\c:\vddjd.exec:\vddjd.exe170⤵PID:2572
-
\??\c:\9lxxrrr.exec:\9lxxrrr.exe171⤵PID:2704
-
\??\c:\ttbbnh.exec:\ttbbnh.exe172⤵PID:2532
-
\??\c:\dpjvd.exec:\dpjvd.exe173⤵PID:2468
-
\??\c:\pjpvj.exec:\pjpvj.exe174⤵PID:1884
-
\??\c:\xrfflxx.exec:\xrfflxx.exe175⤵PID:1652
-
\??\c:\thbhbb.exec:\thbhbb.exe176⤵PID:2500
-
\??\c:\dpdvv.exec:\dpdvv.exe177⤵PID:1472
-
\??\c:\jdjjj.exec:\jdjjj.exe178⤵PID:2600
-
\??\c:\fxfrlrf.exec:\fxfrlrf.exe179⤵PID:2176
-
\??\c:\htbbhh.exec:\htbbhh.exe180⤵PID:1580
-
\??\c:\jddvp.exec:\jddvp.exe181⤵PID:284
-
\??\c:\vjpjj.exec:\vjpjj.exe182⤵PID:1944
-
\??\c:\5rlrxrl.exec:\5rlrxrl.exe183⤵PID:2200
-
\??\c:\hhbtht.exec:\hhbtht.exe184⤵PID:2688
-
\??\c:\vpdpj.exec:\vpdpj.exe185⤵PID:1676
-
\??\c:\jdddj.exec:\jdddj.exe186⤵PID:2016
-
\??\c:\lflfxfx.exec:\lflfxfx.exe187⤵PID:2148
-
\??\c:\bbbhnt.exec:\bbbhnt.exe188⤵PID:580
-
\??\c:\pvjdd.exec:\pvjdd.exe189⤵PID:2908
-
\??\c:\rrflrxf.exec:\rrflrxf.exe190⤵PID:532
-
\??\c:\lffxrll.exec:\lffxrll.exe191⤵PID:2084
-
\??\c:\7bhnnh.exec:\7bhnnh.exe192⤵PID:1048
-
\??\c:\9jvvd.exec:\9jvvd.exe193⤵PID:1988
-
\??\c:\9fxxxfr.exec:\9fxxxfr.exe194⤵PID:2248
-
\??\c:\1xfffff.exec:\1xfffff.exe195⤵PID:1300
-
\??\c:\hhthhn.exec:\hhthhn.exe196⤵PID:1332
-
\??\c:\1vvjd.exec:\1vvjd.exe197⤵PID:2596
-
\??\c:\rlxrlxf.exec:\rlxrlxf.exe198⤵PID:2024
-
\??\c:\7tnnbb.exec:\7tnnbb.exe199⤵PID:2160
-
\??\c:\tnthtt.exec:\tnthtt.exe200⤵PID:3016
-
\??\c:\dpvvj.exec:\dpvvj.exe201⤵PID:1568
-
\??\c:\9lxrlll.exec:\9lxrlll.exe202⤵PID:1660
-
\??\c:\nbttbb.exec:\nbttbb.exe203⤵PID:1692
-
\??\c:\3bbthb.exec:\3bbthb.exe204⤵PID:2864
-
\??\c:\dppjd.exec:\dppjd.exe205⤵PID:2044
-
\??\c:\lllfrrf.exec:\lllfrrf.exe206⤵PID:376
-
\??\c:\frrrrrl.exec:\frrrrrl.exe207⤵PID:2204
-
\??\c:\5bhhhn.exec:\5bhhhn.exe208⤵PID:2184
-
\??\c:\1vpjp.exec:\1vpjp.exe209⤵PID:2520
-
\??\c:\5jvvj.exec:\5jvvj.exe210⤵PID:2628
-
\??\c:\5rxrxlr.exec:\5rxrxlr.exe211⤵PID:2556
-
\??\c:\hbbhnn.exec:\hbbhnn.exe212⤵PID:2616
-
\??\c:\5vpdd.exec:\5vpdd.exe213⤵PID:2724
-
\??\c:\9xrlxfl.exec:\9xrlxfl.exe214⤵PID:2548
-
\??\c:\xfflxlf.exec:\xfflxlf.exe215⤵PID:2412
-
\??\c:\tnhbnn.exec:\tnhbnn.exe216⤵PID:2464
-
\??\c:\vpvvd.exec:\vpvvd.exe217⤵PID:2832
-
\??\c:\7pdjj.exec:\7pdjj.exe218⤵PID:292
-
\??\c:\ffflrlr.exec:\ffflrlr.exe219⤵PID:1476
-
\??\c:\bhhbhb.exec:\bhhbhb.exe220⤵PID:2388
-
\??\c:\hhhnbn.exec:\hhhnbn.exe221⤵PID:2316
-
\??\c:\dvpdj.exec:\dvpdj.exe222⤵PID:2308
-
\??\c:\3lxfxxr.exec:\3lxfxxr.exe223⤵PID:2296
-
\??\c:\nbnntt.exec:\nbnntt.exe224⤵PID:800
-
\??\c:\3nnhnt.exec:\3nnhnt.exe225⤵PID:1688
-
\??\c:\vjjjj.exec:\vjjjj.exe226⤵PID:1640
-
\??\c:\rfrfrxx.exec:\rfrfrxx.exe227⤵PID:108
-
\??\c:\nntnnb.exec:\nntnnb.exe228⤵PID:3000
-
\??\c:\tnnhhb.exec:\tnnhhb.exe229⤵PID:2060
-
\??\c:\9djvv.exec:\9djvv.exe230⤵PID:2288
-
\??\c:\lfrxrfr.exec:\lfrxrfr.exe231⤵PID:2064
-
\??\c:\xlflxfl.exec:\xlflxfl.exe232⤵PID:676
-
\??\c:\9thntt.exec:\9thntt.exe233⤵PID:1768
-
\??\c:\jdpdj.exec:\jdpdj.exe234⤵PID:2512
-
\??\c:\xfxlrrr.exec:\xfxlrrr.exe235⤵PID:848
-
\??\c:\lfffrll.exec:\lfffrll.exe236⤵PID:1148
-
\??\c:\tnnnbh.exec:\tnnnbh.exe237⤵PID:1636
-
\??\c:\5vpjj.exec:\5vpjj.exe238⤵PID:2172
-
\??\c:\fxlrxxf.exec:\fxlrxxf.exe239⤵PID:1560
-
\??\c:\xrlfrrr.exec:\xrlfrrr.exe240⤵PID:2092
-
\??\c:\bbbbth.exec:\bbbbth.exe241⤵PID:2380
-
\??\c:\djjpj.exec:\djjpj.exe242⤵PID:908