Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 01:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4b94ba8aa80f0d2f319098dc0a3ec970_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4b94ba8aa80f0d2f319098dc0a3ec970_NeikiAnalytics.exe
-
Size
277KB
-
MD5
4b94ba8aa80f0d2f319098dc0a3ec970
-
SHA1
cc387a62374c6aa9bf42869b9934662b917720ad
-
SHA256
ced3f7480324116317b57e0ab8dc0db3836a69a6227932fa6693836c49c2ac0e
-
SHA512
6304617db62a78e2d50e966c916b057b2733dccefec9991b5caf72840f8169ed502f699725e0a9d20cc2239be52d1b0787c4940ff0dd10aadd3d3f8057a799d0
-
SSDEEP
6144:n3C9BRIG0asYFm71m8+GdkB9yMu7VvemN:n3C9uYA71kSMuP
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/2864-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2332-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/472-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1820-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1576-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2068-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2252-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2080-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1480-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2420-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
dvdpv.exeflxfrxf.exeddvpd.exejvddj.exe7bnttt.exe5nbthb.exe5pjjj.exefxlxxrx.exe5thbhb.exe7nbhnh.exe5lxrrxx.exennhbhb.exe7thhnt.exexlrrxlx.exexrfxfff.exenhttnh.exe9ddjp.exexxxxrrf.exexrllrfr.exennhhnt.exefrllxxl.exelrfxrlf.exevjvvd.exellxxlxf.exerlxrxfr.exettbnnh.exevvdvp.exe5frxxrf.exebhhbbt.exejvjjj.exexrflffl.exetthntn.exe5pddj.exerlxxxxf.exerfllrrf.exenhhbhn.exepjvdj.exevjvdv.exenhhbbb.exepjddp.exe5rxxfff.exehbnnnb.exe9dvjj.exehbbntt.exe1vjjp.exelxrrffl.exebntthb.exejdpdj.exevjjpd.exexfxlxff.exehbnthb.exedvppp.exe1ffxfll.exelfxfllr.exetthhtt.exe1vjjp.exe5rlfrrf.exetbhbth.exejdvjd.exefffrflx.exellfrllx.exennhtht.exejvvvj.exe9rfffff.exepid process 2332 dvdpv.exe 2792 flxfrxf.exe 3032 ddvpd.exe 2804 jvddj.exe 2692 7bnttt.exe 2668 5nbthb.exe 2592 5pjjj.exe 2448 fxlxxrx.exe 2192 5thbhb.exe 2892 7nbhnh.exe 2752 5lxrrxx.exe 2744 nnhbhb.exe 472 7thhnt.exe 2000 xlrrxlx.exe 2412 xrfxfff.exe 1820 nhttnh.exe 2420 9ddjp.exe 1576 xxxxrrf.exe 2116 xrllrfr.exe 2068 nnhhnt.exe 2828 frllxxl.exe 2252 lrfxrlf.exe 1480 vjvvd.exe 2404 llxxlxf.exe 1624 rlxrxfr.exe 1076 ttbnnh.exe 1664 vvdvp.exe 2992 5frxxrf.exe 992 bhhbbt.exe 2080 jvjjj.exe 2384 xrflffl.exe 2536 tthntn.exe 2360 5pddj.exe 2636 rlxxxxf.exe 1796 rfllrrf.exe 2652 nhhbhn.exe 2676 pjvdj.exe 2804 vjvdv.exe 2180 nhhbbb.exe 2764 pjddp.exe 2568 5rxxfff.exe 2472 hbnnnb.exe 2448 9dvjj.exe 1316 hbbntt.exe 2452 1vjjp.exe 2776 lxrrffl.exe 2556 bntthb.exe 2944 jdpdj.exe 1816 vjjpd.exe 1152 xfxlxff.exe 852 hbnthb.exe 1756 dvppp.exe 1820 1ffxfll.exe 1684 lfxfllr.exe 2124 tthhtt.exe 2704 1vjjp.exe 2316 5rlfrrf.exe 2432 tbhbth.exe 1392 jdvjd.exe 1048 fffrflx.exe 2292 llfrllx.exe 1480 nnhtht.exe 452 jvvvj.exe 2312 9rfffff.exe -
Processes:
resource yara_rule behavioral1/memory/2864-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/472-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1820-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1576-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2252-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1480-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-111-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4b94ba8aa80f0d2f319098dc0a3ec970_NeikiAnalytics.exedvdpv.exeflxfrxf.exeddvpd.exejvddj.exe7bnttt.exe5nbthb.exe5pjjj.exefxlxxrx.exe5thbhb.exe7nbhnh.exe5lxrrxx.exennhbhb.exe7thhnt.exexlrrxlx.exexrfxfff.exedescription pid process target process PID 2864 wrote to memory of 2332 2864 4b94ba8aa80f0d2f319098dc0a3ec970_NeikiAnalytics.exe dvdpv.exe PID 2864 wrote to memory of 2332 2864 4b94ba8aa80f0d2f319098dc0a3ec970_NeikiAnalytics.exe dvdpv.exe PID 2864 wrote to memory of 2332 2864 4b94ba8aa80f0d2f319098dc0a3ec970_NeikiAnalytics.exe dvdpv.exe PID 2864 wrote to memory of 2332 2864 4b94ba8aa80f0d2f319098dc0a3ec970_NeikiAnalytics.exe dvdpv.exe PID 2332 wrote to memory of 2792 2332 dvdpv.exe flxfrxf.exe PID 2332 wrote to memory of 2792 2332 dvdpv.exe flxfrxf.exe PID 2332 wrote to memory of 2792 2332 dvdpv.exe flxfrxf.exe PID 2332 wrote to memory of 2792 2332 dvdpv.exe flxfrxf.exe PID 2792 wrote to memory of 3032 2792 flxfrxf.exe ddvpd.exe PID 2792 wrote to memory of 3032 2792 flxfrxf.exe ddvpd.exe PID 2792 wrote to memory of 3032 2792 flxfrxf.exe ddvpd.exe PID 2792 wrote to memory of 3032 2792 flxfrxf.exe ddvpd.exe PID 3032 wrote to memory of 2804 3032 ddvpd.exe vjvdv.exe PID 3032 wrote to memory of 2804 3032 ddvpd.exe vjvdv.exe PID 3032 wrote to memory of 2804 3032 ddvpd.exe vjvdv.exe PID 3032 wrote to memory of 2804 3032 ddvpd.exe vjvdv.exe PID 2804 wrote to memory of 2692 2804 jvddj.exe 7bnttt.exe PID 2804 wrote to memory of 2692 2804 jvddj.exe 7bnttt.exe PID 2804 wrote to memory of 2692 2804 jvddj.exe 7bnttt.exe PID 2804 wrote to memory of 2692 2804 jvddj.exe 7bnttt.exe PID 2692 wrote to memory of 2668 2692 7bnttt.exe 5nbthb.exe PID 2692 wrote to memory of 2668 2692 7bnttt.exe 5nbthb.exe PID 2692 wrote to memory of 2668 2692 7bnttt.exe 5nbthb.exe PID 2692 wrote to memory of 2668 2692 7bnttt.exe 5nbthb.exe PID 2668 wrote to memory of 2592 2668 5nbthb.exe 5pjjj.exe PID 2668 wrote to memory of 2592 2668 5nbthb.exe 5pjjj.exe PID 2668 wrote to memory of 2592 2668 5nbthb.exe 5pjjj.exe PID 2668 wrote to memory of 2592 2668 5nbthb.exe 5pjjj.exe PID 2592 wrote to memory of 2448 2592 5pjjj.exe fxlxxrx.exe PID 2592 wrote to memory of 2448 2592 5pjjj.exe fxlxxrx.exe PID 2592 wrote to memory of 2448 2592 5pjjj.exe fxlxxrx.exe PID 2592 wrote to memory of 2448 2592 5pjjj.exe fxlxxrx.exe PID 2448 wrote to memory of 2192 2448 fxlxxrx.exe 5thbhb.exe PID 2448 wrote to memory of 2192 2448 fxlxxrx.exe 5thbhb.exe PID 2448 wrote to memory of 2192 2448 fxlxxrx.exe 5thbhb.exe PID 2448 wrote to memory of 2192 2448 fxlxxrx.exe 5thbhb.exe PID 2192 wrote to memory of 2892 2192 5thbhb.exe 7nbhnh.exe PID 2192 wrote to memory of 2892 2192 5thbhb.exe 7nbhnh.exe PID 2192 wrote to memory of 2892 2192 5thbhb.exe 7nbhnh.exe PID 2192 wrote to memory of 2892 2192 5thbhb.exe 7nbhnh.exe PID 2892 wrote to memory of 2752 2892 7nbhnh.exe 5lxrrxx.exe PID 2892 wrote to memory of 2752 2892 7nbhnh.exe 5lxrrxx.exe PID 2892 wrote to memory of 2752 2892 7nbhnh.exe 5lxrrxx.exe PID 2892 wrote to memory of 2752 2892 7nbhnh.exe 5lxrrxx.exe PID 2752 wrote to memory of 2744 2752 5lxrrxx.exe nnhbhb.exe PID 2752 wrote to memory of 2744 2752 5lxrrxx.exe nnhbhb.exe PID 2752 wrote to memory of 2744 2752 5lxrrxx.exe nnhbhb.exe PID 2752 wrote to memory of 2744 2752 5lxrrxx.exe nnhbhb.exe PID 2744 wrote to memory of 472 2744 nnhbhb.exe 7thhnt.exe PID 2744 wrote to memory of 472 2744 nnhbhb.exe 7thhnt.exe PID 2744 wrote to memory of 472 2744 nnhbhb.exe 7thhnt.exe PID 2744 wrote to memory of 472 2744 nnhbhb.exe 7thhnt.exe PID 472 wrote to memory of 2000 472 7thhnt.exe xlrrxlx.exe PID 472 wrote to memory of 2000 472 7thhnt.exe xlrrxlx.exe PID 472 wrote to memory of 2000 472 7thhnt.exe xlrrxlx.exe PID 472 wrote to memory of 2000 472 7thhnt.exe xlrrxlx.exe PID 2000 wrote to memory of 2412 2000 xlrrxlx.exe xrfxfff.exe PID 2000 wrote to memory of 2412 2000 xlrrxlx.exe xrfxfff.exe PID 2000 wrote to memory of 2412 2000 xlrrxlx.exe xrfxfff.exe PID 2000 wrote to memory of 2412 2000 xlrrxlx.exe xrfxfff.exe PID 2412 wrote to memory of 1820 2412 xrfxfff.exe nhttnh.exe PID 2412 wrote to memory of 1820 2412 xrfxfff.exe nhttnh.exe PID 2412 wrote to memory of 1820 2412 xrfxfff.exe nhttnh.exe PID 2412 wrote to memory of 1820 2412 xrfxfff.exe nhttnh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b94ba8aa80f0d2f319098dc0a3ec970_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4b94ba8aa80f0d2f319098dc0a3ec970_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\dvdpv.exec:\dvdpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\flxfrxf.exec:\flxfrxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\ddvpd.exec:\ddvpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\jvddj.exec:\jvddj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\7bnttt.exec:\7bnttt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\5nbthb.exec:\5nbthb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\5pjjj.exec:\5pjjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\fxlxxrx.exec:\fxlxxrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\5thbhb.exec:\5thbhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\7nbhnh.exec:\7nbhnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\5lxrrxx.exec:\5lxrrxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\nnhbhb.exec:\nnhbhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\7thhnt.exec:\7thhnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
\??\c:\xlrrxlx.exec:\xlrrxlx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\xrfxfff.exec:\xrfxfff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\nhttnh.exec:\nhttnh.exe17⤵
- Executes dropped EXE
PID:1820 -
\??\c:\9ddjp.exec:\9ddjp.exe18⤵
- Executes dropped EXE
PID:2420 -
\??\c:\xxxxrrf.exec:\xxxxrrf.exe19⤵
- Executes dropped EXE
PID:1576 -
\??\c:\xrllrfr.exec:\xrllrfr.exe20⤵
- Executes dropped EXE
PID:2116 -
\??\c:\nnhhnt.exec:\nnhhnt.exe21⤵
- Executes dropped EXE
PID:2068 -
\??\c:\frllxxl.exec:\frllxxl.exe22⤵
- Executes dropped EXE
PID:2828 -
\??\c:\lrfxrlf.exec:\lrfxrlf.exe23⤵
- Executes dropped EXE
PID:2252 -
\??\c:\vjvvd.exec:\vjvvd.exe24⤵
- Executes dropped EXE
PID:1480 -
\??\c:\llxxlxf.exec:\llxxlxf.exe25⤵
- Executes dropped EXE
PID:2404 -
\??\c:\rlxrxfr.exec:\rlxrxfr.exe26⤵
- Executes dropped EXE
PID:1624 -
\??\c:\ttbnnh.exec:\ttbnnh.exe27⤵
- Executes dropped EXE
PID:1076 -
\??\c:\vvdvp.exec:\vvdvp.exe28⤵
- Executes dropped EXE
PID:1664 -
\??\c:\5frxxrf.exec:\5frxxrf.exe29⤵
- Executes dropped EXE
PID:2992 -
\??\c:\bhhbbt.exec:\bhhbbt.exe30⤵
- Executes dropped EXE
PID:992 -
\??\c:\jvjjj.exec:\jvjjj.exe31⤵
- Executes dropped EXE
PID:2080 -
\??\c:\xrflffl.exec:\xrflffl.exe32⤵
- Executes dropped EXE
PID:2384 -
\??\c:\tthntn.exec:\tthntn.exe33⤵
- Executes dropped EXE
PID:2536 -
\??\c:\1hnnnn.exec:\1hnnnn.exe34⤵PID:1600
-
\??\c:\5pddj.exec:\5pddj.exe35⤵
- Executes dropped EXE
PID:2360 -
\??\c:\rlxxxxf.exec:\rlxxxxf.exe36⤵
- Executes dropped EXE
PID:2636 -
\??\c:\rfllrrf.exec:\rfllrrf.exe37⤵
- Executes dropped EXE
PID:1796 -
\??\c:\nhhbhn.exec:\nhhbhn.exe38⤵
- Executes dropped EXE
PID:2652 -
\??\c:\pjvdj.exec:\pjvdj.exe39⤵
- Executes dropped EXE
PID:2676 -
\??\c:\vjvdv.exec:\vjvdv.exe40⤵
- Executes dropped EXE
PID:2804 -
\??\c:\nhhbbb.exec:\nhhbbb.exe41⤵
- Executes dropped EXE
PID:2180 -
\??\c:\pjddp.exec:\pjddp.exe42⤵
- Executes dropped EXE
PID:2764 -
\??\c:\5rxxfff.exec:\5rxxfff.exe43⤵
- Executes dropped EXE
PID:2568 -
\??\c:\hbnnnb.exec:\hbnnnb.exe44⤵
- Executes dropped EXE
PID:2472 -
\??\c:\9dvjj.exec:\9dvjj.exe45⤵
- Executes dropped EXE
PID:2448 -
\??\c:\hbbntt.exec:\hbbntt.exe46⤵
- Executes dropped EXE
PID:1316 -
\??\c:\1vjjp.exec:\1vjjp.exe47⤵
- Executes dropped EXE
PID:2452 -
\??\c:\lxrrffl.exec:\lxrrffl.exe48⤵
- Executes dropped EXE
PID:2776 -
\??\c:\bntthb.exec:\bntthb.exe49⤵
- Executes dropped EXE
PID:2556 -
\??\c:\jdpdj.exec:\jdpdj.exe50⤵
- Executes dropped EXE
PID:2944 -
\??\c:\vjjpd.exec:\vjjpd.exe51⤵
- Executes dropped EXE
PID:1816 -
\??\c:\xfxlxff.exec:\xfxlxff.exe52⤵
- Executes dropped EXE
PID:1152 -
\??\c:\hbnthb.exec:\hbnthb.exe53⤵
- Executes dropped EXE
PID:852 -
\??\c:\dvppp.exec:\dvppp.exe54⤵
- Executes dropped EXE
PID:1756 -
\??\c:\1ffxfll.exec:\1ffxfll.exe55⤵
- Executes dropped EXE
PID:1820 -
\??\c:\lfxfllr.exec:\lfxfllr.exe56⤵
- Executes dropped EXE
PID:1684 -
\??\c:\tthhtt.exec:\tthhtt.exe57⤵
- Executes dropped EXE
PID:2124 -
\??\c:\1vjjp.exec:\1vjjp.exe58⤵
- Executes dropped EXE
PID:2704 -
\??\c:\5rlfrrf.exec:\5rlfrrf.exe59⤵
- Executes dropped EXE
PID:2316 -
\??\c:\tbhbth.exec:\tbhbth.exe60⤵
- Executes dropped EXE
PID:2432 -
\??\c:\jdvjd.exec:\jdvjd.exe61⤵
- Executes dropped EXE
PID:1392 -
\??\c:\fffrflx.exec:\fffrflx.exe62⤵
- Executes dropped EXE
PID:1048 -
\??\c:\llfrllx.exec:\llfrllx.exe63⤵
- Executes dropped EXE
PID:2292 -
\??\c:\nnhtht.exec:\nnhtht.exe64⤵
- Executes dropped EXE
PID:1480 -
\??\c:\jvvvj.exec:\jvvvj.exe65⤵
- Executes dropped EXE
PID:452 -
\??\c:\9rfffff.exec:\9rfffff.exe66⤵
- Executes dropped EXE
PID:2312 -
\??\c:\tbbhtt.exec:\tbbhtt.exe67⤵PID:1920
-
\??\c:\jvppj.exec:\jvppj.exe68⤵PID:1648
-
\??\c:\xxrflxl.exec:\xxrflxl.exe69⤵PID:1664
-
\??\c:\tbnhht.exec:\tbnhht.exe70⤵PID:2280
-
\??\c:\nnnbnn.exec:\nnnbnn.exe71⤵PID:3052
-
\??\c:\jjdpd.exec:\jjdpd.exe72⤵PID:892
-
\??\c:\llfxflx.exec:\llfxflx.exe73⤵PID:1336
-
\??\c:\nnbnbn.exec:\nnbnbn.exe74⤵PID:2908
-
\??\c:\thnnbn.exec:\thnnbn.exe75⤵PID:1712
-
\??\c:\5djvj.exec:\5djvj.exe76⤵PID:2408
-
\??\c:\ffxlrxl.exec:\ffxlrxl.exe77⤵PID:2548
-
\??\c:\ffrrxff.exec:\ffrrxff.exe78⤵PID:2224
-
\??\c:\9hbhnb.exec:\9hbhnb.exe79⤵PID:848
-
\??\c:\pdvjd.exec:\pdvjd.exe80⤵PID:2600
-
\??\c:\ffflrxf.exec:\ffflrxf.exe81⤵PID:2392
-
\??\c:\9nhntb.exec:\9nhntb.exe82⤵PID:2804
-
\??\c:\nhtnhn.exec:\nhtnhn.exe83⤵PID:2780
-
\??\c:\vvpdj.exec:\vvpdj.exe84⤵PID:2668
-
\??\c:\pvvvv.exec:\pvvvv.exe85⤵PID:2724
-
\??\c:\frflfrf.exec:\frflfrf.exe86⤵PID:2884
-
\??\c:\hbnnnh.exec:\hbnnnh.exe87⤵PID:2448
-
\??\c:\vdvvj.exec:\vdvvj.exe88⤵PID:2500
-
\??\c:\rlfrxfx.exec:\rlfrxfx.exe89⤵PID:300
-
\??\c:\rllfffx.exec:\rllfffx.exe90⤵PID:804
-
\??\c:\thhbhh.exec:\thhbhh.exe91⤵PID:2752
-
\??\c:\1vppv.exec:\1vppv.exe92⤵PID:2744
-
\??\c:\pvjjv.exec:\pvjjv.exe93⤵PID:1436
-
\??\c:\frffllr.exec:\frffllr.exe94⤵PID:308
-
\??\c:\1hhntb.exec:\1hhntb.exe95⤵PID:2016
-
\??\c:\5jjpd.exec:\5jjpd.exe96⤵PID:2412
-
\??\c:\pdpjj.exec:\pdpjj.exe97⤵PID:1764
-
\??\c:\rflxfxl.exec:\rflxfxl.exe98⤵PID:1684
-
\??\c:\hhthtb.exec:\hhthtb.exe99⤵PID:1632
-
\??\c:\nnbnhh.exec:\nnbnhh.exe100⤵PID:2288
-
\??\c:\vpjjv.exec:\vpjjv.exe101⤵PID:2316
-
\??\c:\lrxllrx.exec:\lrxllrx.exe102⤵PID:2436
-
\??\c:\lfxrffr.exec:\lfxrffr.exe103⤵PID:1392
-
\??\c:\btnthn.exec:\btnthn.exe104⤵PID:1484
-
\??\c:\ddvvp.exec:\ddvvp.exe105⤵PID:608
-
\??\c:\fxllffl.exec:\fxllffl.exe106⤵PID:584
-
\??\c:\fxrxffr.exec:\fxrxffr.exe107⤵PID:2552
-
\??\c:\thtthh.exec:\thtthh.exe108⤵PID:1148
-
\??\c:\1pjjp.exec:\1pjjp.exe109⤵PID:1076
-
\??\c:\ddjdd.exec:\ddjdd.exe110⤵PID:1688
-
\??\c:\5frxxxf.exec:\5frxxxf.exe111⤵PID:2220
-
\??\c:\7hntbb.exec:\7hntbb.exe112⤵PID:1916
-
\??\c:\1djpp.exec:\1djpp.exe113⤵PID:3052
-
\??\c:\dvddj.exec:\dvddj.exe114⤵PID:1504
-
\??\c:\xlrxlrx.exec:\xlrxlrx.exe115⤵PID:1336
-
\??\c:\hthhnn.exec:\hthhnn.exe116⤵PID:2908
-
\??\c:\tnbbnt.exec:\tnbbnt.exe117⤵PID:1976
-
\??\c:\7jvpv.exec:\7jvpv.exe118⤵PID:1872
-
\??\c:\pjjpd.exec:\pjjpd.exe119⤵PID:1296
-
\??\c:\rfrlxlr.exec:\rfrlxlr.exe120⤵PID:2792
-
\??\c:\nthhtb.exec:\nthhtb.exe121⤵PID:2736
-
\??\c:\5jpvv.exec:\5jpvv.exe122⤵PID:2660
-
\??\c:\1lflrff.exec:\1lflrff.exe123⤵PID:2964
-
\??\c:\flfflfx.exec:\flfflfx.exe124⤵PID:2496
-
\??\c:\hhhtnn.exec:\hhhtnn.exe125⤵PID:2780
-
\??\c:\tbhthn.exec:\tbhthn.exe126⤵PID:2532
-
\??\c:\vvvdp.exec:\vvvdp.exe127⤵PID:2568
-
\??\c:\xrffllr.exec:\xrffllr.exe128⤵PID:2884
-
\??\c:\bhnnnh.exec:\bhnnnh.exe129⤵PID:2004
-
\??\c:\pjvjj.exec:\pjvjj.exe130⤵PID:2892
-
\??\c:\dvppd.exec:\dvppd.exe131⤵PID:1156
-
\??\c:\xrxffxf.exec:\xrxffxf.exe132⤵PID:628
-
\??\c:\ffxfrlr.exec:\ffxfrlr.exe133⤵PID:2556
-
\??\c:\7bhhnn.exec:\7bhhnn.exe134⤵PID:2744
-
\??\c:\3jvvv.exec:\3jvvv.exe135⤵PID:472
-
\??\c:\7ffflrr.exec:\7ffflrr.exe136⤵PID:1888
-
\??\c:\5thbhb.exec:\5thbhb.exe137⤵PID:1676
-
\??\c:\dvddj.exec:\dvddj.exe138⤵PID:1756
-
\??\c:\7frxlrx.exec:\7frxlrx.exe139⤵PID:1028
-
\??\c:\lrfrfll.exec:\lrfrfll.exe140⤵PID:1684
-
\??\c:\7htbht.exec:\7htbht.exe141⤵PID:1632
-
\??\c:\pjdpd.exec:\pjdpd.exe142⤵PID:2288
-
\??\c:\3vpvd.exec:\3vpvd.exe143⤵PID:672
-
\??\c:\lfllrxl.exec:\lfllrxl.exe144⤵PID:1476
-
\??\c:\rlflrxl.exec:\rlflrxl.exe145⤵PID:1392
-
\??\c:\nhbhtt.exec:\nhbhtt.exe146⤵PID:1484
-
\??\c:\ppvjp.exec:\ppvjp.exe147⤵PID:1356
-
\??\c:\3vdpd.exec:\3vdpd.exe148⤵PID:1652
-
\??\c:\lxffxrl.exec:\lxffxrl.exe149⤵PID:2552
-
\??\c:\ttnthh.exec:\ttnthh.exe150⤵PID:1148
-
\??\c:\1nbbnh.exec:\1nbbnh.exe151⤵PID:1920
-
\??\c:\7jvvj.exec:\7jvvj.exe152⤵PID:1688
-
\??\c:\dddjj.exec:\dddjj.exe153⤵PID:3040
-
\??\c:\xlflrfl.exec:\xlflrfl.exe154⤵PID:2280
-
\??\c:\rrrfrxf.exec:\rrrfrxf.exe155⤵PID:2864
-
\??\c:\hhhthh.exec:\hhhthh.exe156⤵PID:1504
-
\??\c:\pvvdp.exec:\pvvdp.exe157⤵PID:1600
-
\??\c:\vvpvj.exec:\vvpvj.exe158⤵PID:2380
-
\??\c:\5rlrxlx.exec:\5rlrxlx.exe159⤵PID:1976
-
\??\c:\nhtbhn.exec:\nhtbhn.exe160⤵PID:2920
-
\??\c:\tnhnhn.exec:\tnhnhn.exe161⤵PID:1296
-
\??\c:\3jpjj.exec:\3jpjj.exe162⤵PID:2792
-
\??\c:\1lflffx.exec:\1lflffx.exe163⤵PID:2736
-
\??\c:\xlxflfl.exec:\xlxflfl.exe164⤵PID:2692
-
\??\c:\tnbhbh.exec:\tnbhbh.exe165⤵PID:2392
-
\??\c:\hhnbnh.exec:\hhnbnh.exe166⤵PID:2456
-
\??\c:\jdpvd.exec:\jdpvd.exe167⤵PID:2780
-
\??\c:\rflxffr.exec:\rflxffr.exe168⤵PID:2128
-
\??\c:\5lxxflr.exec:\5lxxflr.exe169⤵PID:2568
-
\??\c:\hbnthh.exec:\hbnthh.exe170⤵PID:2760
-
\??\c:\3jpjj.exec:\3jpjj.exe171⤵PID:2576
-
\??\c:\7pjdd.exec:\7pjdd.exe172⤵PID:332
-
\??\c:\rlrxxrx.exec:\rlrxxrx.exe173⤵PID:2008
-
\??\c:\tttnnt.exec:\tttnnt.exe174⤵PID:344
-
\??\c:\9hnbtt.exec:\9hnbtt.exe175⤵PID:2336
-
\??\c:\vvpdd.exec:\vvpdd.exe176⤵PID:1980
-
\??\c:\9pdpp.exec:\9pdpp.exe177⤵PID:472
-
\??\c:\xxrfrrf.exec:\xxrfrrf.exe178⤵PID:1108
-
\??\c:\tnhthh.exec:\tnhthh.exe179⤵PID:1660
-
\??\c:\ntbttn.exec:\ntbttn.exe180⤵PID:2012
-
\??\c:\3vjpv.exec:\3vjpv.exe181⤵PID:2512
-
\??\c:\ppdpd.exec:\ppdpd.exe182⤵PID:2116
-
\??\c:\llxlxxr.exec:\llxlxxr.exe183⤵PID:2244
-
\??\c:\1lffxfr.exec:\1lffxfr.exe184⤵PID:1632
-
\??\c:\nhhbbn.exec:\nhhbbn.exe185⤵PID:2824
-
\??\c:\dvdvv.exec:\dvdvv.exe186⤵PID:2252
-
\??\c:\vppvp.exec:\vppvp.exe187⤵PID:2188
-
\??\c:\rlfrxfl.exec:\rlfrxfl.exe188⤵PID:2404
-
\??\c:\xrrfxfx.exec:\xrrfxfx.exe189⤵PID:1616
-
\??\c:\tnntht.exec:\tnntht.exe190⤵PID:912
-
\??\c:\thtbnb.exec:\thtbnb.exe191⤵PID:1480
-
\??\c:\vvpvv.exec:\vvpvv.exe192⤵PID:904
-
\??\c:\lxxllrf.exec:\lxxllrf.exe193⤵PID:1716
-
\??\c:\rxfffff.exec:\rxfffff.exe194⤵PID:1608
-
\??\c:\bnbttt.exec:\bnbttt.exe195⤵PID:288
-
\??\c:\jdpdj.exec:\jdpdj.exe196⤵PID:2164
-
\??\c:\pjddp.exec:\pjddp.exe197⤵PID:1508
-
\??\c:\lxlxfrf.exec:\lxlxfrf.exe198⤵PID:1524
-
\??\c:\5xllrlx.exec:\5xllrlx.exe199⤵PID:1500
-
\??\c:\9bbbth.exec:\9bbbth.exe200⤵PID:772
-
\??\c:\jvdpv.exec:\jvdpv.exe201⤵PID:2356
-
\??\c:\pdvvd.exec:\pdvvd.exe202⤵PID:2604
-
\??\c:\1lxfflr.exec:\1lxfflr.exe203⤵PID:2648
-
\??\c:\xxxflfr.exec:\xxxflfr.exe204⤵PID:2076
-
\??\c:\hhhthn.exec:\hhhthn.exe205⤵PID:2732
-
\??\c:\bhntbn.exec:\bhntbn.exe206⤵PID:2736
-
\??\c:\5vpdv.exec:\5vpdv.exe207⤵PID:2476
-
\??\c:\rrffffr.exec:\rrffffr.exe208⤵PID:2772
-
\??\c:\btbbhh.exec:\btbbhh.exe209⤵PID:2728
-
\??\c:\tbhthh.exec:\tbhthh.exe210⤵PID:2880
-
\??\c:\vvjvd.exec:\vvjvd.exe211⤵PID:2748
-
\??\c:\ddjjv.exec:\ddjjv.exe212⤵PID:2492
-
\??\c:\lxlfxlf.exec:\lxlfxlf.exe213⤵PID:2632
-
\??\c:\7fxllll.exec:\7fxllll.exe214⤵PID:1784
-
\??\c:\5nbbbb.exec:\5nbbbb.exe215⤵PID:2348
-
\??\c:\ppddv.exec:\ppddv.exe216⤵PID:2944
-
\??\c:\dpdvp.exec:\dpdvp.exe217⤵PID:2556
-
\??\c:\xlxrxxf.exec:\xlxrxxf.exe218⤵PID:664
-
\??\c:\9xllrxf.exec:\9xllrxf.exe219⤵PID:1628
-
\??\c:\bthtbt.exec:\bthtbt.exe220⤵PID:1896
-
\??\c:\9djdp.exec:\9djdp.exe221⤵PID:1820
-
\??\c:\pdjdd.exec:\pdjdd.exe222⤵PID:1576
-
\??\c:\rxfrlfl.exec:\rxfrlfl.exe223⤵PID:2248
-
\??\c:\ffxxxxr.exec:\ffxxxxr.exe224⤵PID:2272
-
\??\c:\btnbnt.exec:\btnbnt.exe225⤵PID:2260
-
\??\c:\thtnth.exec:\thtnth.exe226⤵PID:2284
-
\??\c:\vdjvd.exec:\vdjvd.exe227⤵PID:2432
-
\??\c:\9lrfxrl.exec:\9lrfxrl.exe228⤵PID:592
-
\??\c:\xxrxrfr.exec:\xxrxrfr.exe229⤵PID:1492
-
\??\c:\3htbhb.exec:\3htbhb.exe230⤵PID:1472
-
\??\c:\vdvjv.exec:\vdvjv.exe231⤵PID:2808
-
\??\c:\dvpvj.exec:\dvpvj.exe232⤵PID:1116
-
\??\c:\frrlrfl.exec:\frrlrfl.exe233⤵PID:652
-
\??\c:\lfrlrrx.exec:\lfrlrrx.exe234⤵PID:1692
-
\??\c:\hbtthh.exec:\hbtthh.exe235⤵PID:3064
-
\??\c:\9htttt.exec:\9htttt.exe236⤵PID:2996
-
\??\c:\3djjd.exec:\3djjd.exe237⤵PID:2080
-
\??\c:\xxlflrr.exec:\xxlflrr.exe238⤵PID:2788
-
\??\c:\nhntbh.exec:\nhntbh.exe239⤵PID:2384
-
\??\c:\btbtbt.exec:\btbtbt.exe240⤵PID:1228
-
\??\c:\dvpvd.exec:\dvpvd.exe241⤵PID:2916
-
\??\c:\flxfrrf.exec:\flxfrrf.exe242⤵PID:2956