Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 04:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
712d44a283a5b97e816d1d989a79e340_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
712d44a283a5b97e816d1d989a79e340_NeikiAnalytics.exe
-
Size
68KB
-
MD5
712d44a283a5b97e816d1d989a79e340
-
SHA1
374b7d0815ffd301b6032b34930331f97c2f9647
-
SHA256
6c79532d140d71388a5e4deea089b4a82605e7cc3b180af938dfe4e0125e06c9
-
SHA512
470c5662f5fca7c990cb932f21ccbf6a21c1c857ba932d23da05da2d59c7b2527896b67a6a950f20f4cd08a54f9ccf88f9d4519ac1496d54b986c1eebbdb6ec1
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIfv7+afCD+QsQbLj:ymb3NkkiQ3mdBjFIfvTfCD+HG
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/3068-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-43-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2028-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1604-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/708-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1824-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/620-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
7hbbhn.exevpjdv.exetntntt.exepdpjd.exerlxrxxx.exerlxflfl.exebthhnh.exe1tbtbn.exevpddd.exe9xxfxlr.exe3rrflxf.exetnntht.exe1vppd.exepdvvd.exe7fxxlrf.exelfxxfrr.exehthhhh.exe7jpjp.exevpvdp.exerlxxflr.exebthnbh.exepdpjp.exedvjpd.exerlflxrf.exehbhhtb.exehbhntt.exe9jvvd.exepjppd.exethbhtb.exe1nhnnn.exedpdjv.exe3jdjj.exe1rrxffr.exe1nhtbb.exe7hhhtt.exejdpvv.exevpdjv.exellxfllx.exerlfllfr.exethttbn.exenhtnbb.exe5vjvj.exevpddp.exexffxrlf.exelllrrfl.exe5bnnnn.exenhhhhn.exe9ntbtb.exejvjvj.exe1vvpv.exeffrfflx.exefxrflfl.exe9thtbh.exethtttb.exepppvv.exepdvvd.exerlffxfr.exefrllrxl.exe5tnthn.exebnhnnt.exe1pjjp.exe9vjdp.exe3lxfllr.exexrlfllr.exepid process 2200 7hbbhn.exe 2612 vpjdv.exe 2752 tntntt.exe 2644 pdpjd.exe 2772 rlxrxxx.exe 2232 rlxflfl.exe 2532 bthhnh.exe 3012 1tbtbn.exe 2028 vpddd.exe 2880 9xxfxlr.exe 3004 3rrflxf.exe 1604 tnntht.exe 2412 1vppd.exe 348 pdvvd.exe 1044 7fxxlrf.exe 2852 lfxxfrr.exe 1668 hthhhh.exe 1568 7jpjp.exe 1716 vpvdp.exe 2788 rlxxflr.exe 2920 bthnbh.exe 332 pdpjp.exe 708 dvjpd.exe 1824 rlflxrf.exe 1992 hbhhtb.exe 620 hbhntt.exe 2952 9jvvd.exe 2472 pjppd.exe 2128 thbhtb.exe 2416 1nhnnn.exe 1744 dpdjv.exe 2604 3jdjj.exe 2900 1rrxffr.exe 1588 1nhtbb.exe 2808 7hhhtt.exe 2668 jdpvv.exe 2780 vpdjv.exe 2752 llxfllx.exe 2712 rlfllfr.exe 2608 thttbn.exe 2568 nhtnbb.exe 2552 5vjvj.exe 2532 vpddp.exe 1436 xffxrlf.exe 2108 lllrrfl.exe 2820 5bnnnn.exe 2996 nhhhhn.exe 1396 9ntbtb.exe 2316 jvjvj.exe 2016 1vvpv.exe 768 ffrfflx.exe 1052 fxrflfl.exe 2824 9thtbh.exe 1836 thtttb.exe 300 pppvv.exe 2072 pdvvd.exe 1264 rlffxfr.exe 2928 frllrxl.exe 2388 5tnthn.exe 2256 bnhnnt.exe 984 1pjjp.exe 332 9vjdp.exe 1360 3lxfllr.exe 644 xrlfllr.exe -
Processes:
resource yara_rule behavioral1/memory/3068-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2028-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1604-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/708-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1824-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/620-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-291-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
712d44a283a5b97e816d1d989a79e340_NeikiAnalytics.exe7hbbhn.exevpjdv.exetntntt.exepdpjd.exerlxrxxx.exerlxflfl.exebthhnh.exe1tbtbn.exevpddd.exe9xxfxlr.exe3rrflxf.exetnntht.exe1vppd.exepdvvd.exe7fxxlrf.exedescription pid process target process PID 3068 wrote to memory of 2200 3068 712d44a283a5b97e816d1d989a79e340_NeikiAnalytics.exe 7hbbhn.exe PID 3068 wrote to memory of 2200 3068 712d44a283a5b97e816d1d989a79e340_NeikiAnalytics.exe 7hbbhn.exe PID 3068 wrote to memory of 2200 3068 712d44a283a5b97e816d1d989a79e340_NeikiAnalytics.exe 7hbbhn.exe PID 3068 wrote to memory of 2200 3068 712d44a283a5b97e816d1d989a79e340_NeikiAnalytics.exe 7hbbhn.exe PID 2200 wrote to memory of 2612 2200 7hbbhn.exe vpjdv.exe PID 2200 wrote to memory of 2612 2200 7hbbhn.exe vpjdv.exe PID 2200 wrote to memory of 2612 2200 7hbbhn.exe vpjdv.exe PID 2200 wrote to memory of 2612 2200 7hbbhn.exe vpjdv.exe PID 2612 wrote to memory of 2752 2612 vpjdv.exe tntntt.exe PID 2612 wrote to memory of 2752 2612 vpjdv.exe tntntt.exe PID 2612 wrote to memory of 2752 2612 vpjdv.exe tntntt.exe PID 2612 wrote to memory of 2752 2612 vpjdv.exe tntntt.exe PID 2752 wrote to memory of 2644 2752 tntntt.exe pdpjd.exe PID 2752 wrote to memory of 2644 2752 tntntt.exe pdpjd.exe PID 2752 wrote to memory of 2644 2752 tntntt.exe pdpjd.exe PID 2752 wrote to memory of 2644 2752 tntntt.exe pdpjd.exe PID 2644 wrote to memory of 2772 2644 pdpjd.exe rlxrxxx.exe PID 2644 wrote to memory of 2772 2644 pdpjd.exe rlxrxxx.exe PID 2644 wrote to memory of 2772 2644 pdpjd.exe rlxrxxx.exe PID 2644 wrote to memory of 2772 2644 pdpjd.exe rlxrxxx.exe PID 2772 wrote to memory of 2232 2772 rlxrxxx.exe rlxflfl.exe PID 2772 wrote to memory of 2232 2772 rlxrxxx.exe rlxflfl.exe PID 2772 wrote to memory of 2232 2772 rlxrxxx.exe rlxflfl.exe PID 2772 wrote to memory of 2232 2772 rlxrxxx.exe rlxflfl.exe PID 2232 wrote to memory of 2532 2232 rlxflfl.exe bthhnh.exe PID 2232 wrote to memory of 2532 2232 rlxflfl.exe bthhnh.exe PID 2232 wrote to memory of 2532 2232 rlxflfl.exe bthhnh.exe PID 2232 wrote to memory of 2532 2232 rlxflfl.exe bthhnh.exe PID 2532 wrote to memory of 3012 2532 bthhnh.exe 1tbtbn.exe PID 2532 wrote to memory of 3012 2532 bthhnh.exe 1tbtbn.exe PID 2532 wrote to memory of 3012 2532 bthhnh.exe 1tbtbn.exe PID 2532 wrote to memory of 3012 2532 bthhnh.exe 1tbtbn.exe PID 3012 wrote to memory of 2028 3012 1tbtbn.exe vpddd.exe PID 3012 wrote to memory of 2028 3012 1tbtbn.exe vpddd.exe PID 3012 wrote to memory of 2028 3012 1tbtbn.exe vpddd.exe PID 3012 wrote to memory of 2028 3012 1tbtbn.exe vpddd.exe PID 2028 wrote to memory of 2880 2028 vpddd.exe 9xxfxlr.exe PID 2028 wrote to memory of 2880 2028 vpddd.exe 9xxfxlr.exe PID 2028 wrote to memory of 2880 2028 vpddd.exe 9xxfxlr.exe PID 2028 wrote to memory of 2880 2028 vpddd.exe 9xxfxlr.exe PID 2880 wrote to memory of 3004 2880 9xxfxlr.exe 3rrflxf.exe PID 2880 wrote to memory of 3004 2880 9xxfxlr.exe 3rrflxf.exe PID 2880 wrote to memory of 3004 2880 9xxfxlr.exe 3rrflxf.exe PID 2880 wrote to memory of 3004 2880 9xxfxlr.exe 3rrflxf.exe PID 3004 wrote to memory of 1604 3004 3rrflxf.exe tnntht.exe PID 3004 wrote to memory of 1604 3004 3rrflxf.exe tnntht.exe PID 3004 wrote to memory of 1604 3004 3rrflxf.exe tnntht.exe PID 3004 wrote to memory of 1604 3004 3rrflxf.exe tnntht.exe PID 1604 wrote to memory of 2412 1604 tnntht.exe 1vppd.exe PID 1604 wrote to memory of 2412 1604 tnntht.exe 1vppd.exe PID 1604 wrote to memory of 2412 1604 tnntht.exe 1vppd.exe PID 1604 wrote to memory of 2412 1604 tnntht.exe 1vppd.exe PID 2412 wrote to memory of 348 2412 1vppd.exe pdvvd.exe PID 2412 wrote to memory of 348 2412 1vppd.exe pdvvd.exe PID 2412 wrote to memory of 348 2412 1vppd.exe pdvvd.exe PID 2412 wrote to memory of 348 2412 1vppd.exe pdvvd.exe PID 348 wrote to memory of 1044 348 pdvvd.exe 7fxxlrf.exe PID 348 wrote to memory of 1044 348 pdvvd.exe 7fxxlrf.exe PID 348 wrote to memory of 1044 348 pdvvd.exe 7fxxlrf.exe PID 348 wrote to memory of 1044 348 pdvvd.exe 7fxxlrf.exe PID 1044 wrote to memory of 2852 1044 7fxxlrf.exe lfxxfrr.exe PID 1044 wrote to memory of 2852 1044 7fxxlrf.exe lfxxfrr.exe PID 1044 wrote to memory of 2852 1044 7fxxlrf.exe lfxxfrr.exe PID 1044 wrote to memory of 2852 1044 7fxxlrf.exe lfxxfrr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\712d44a283a5b97e816d1d989a79e340_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\712d44a283a5b97e816d1d989a79e340_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\7hbbhn.exec:\7hbbhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\vpjdv.exec:\vpjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\tntntt.exec:\tntntt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\pdpjd.exec:\pdpjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\rlxrxxx.exec:\rlxrxxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\rlxflfl.exec:\rlxflfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\bthhnh.exec:\bthhnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\1tbtbn.exec:\1tbtbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\vpddd.exec:\vpddd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\9xxfxlr.exec:\9xxfxlr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\3rrflxf.exec:\3rrflxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\tnntht.exec:\tnntht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\1vppd.exec:\1vppd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\pdvvd.exec:\pdvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\7fxxlrf.exec:\7fxxlrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\lfxxfrr.exec:\lfxxfrr.exe17⤵
- Executes dropped EXE
PID:2852 -
\??\c:\hthhhh.exec:\hthhhh.exe18⤵
- Executes dropped EXE
PID:1668 -
\??\c:\7jpjp.exec:\7jpjp.exe19⤵
- Executes dropped EXE
PID:1568 -
\??\c:\vpvdp.exec:\vpvdp.exe20⤵
- Executes dropped EXE
PID:1716 -
\??\c:\rlxxflr.exec:\rlxxflr.exe21⤵
- Executes dropped EXE
PID:2788 -
\??\c:\bthnbh.exec:\bthnbh.exe22⤵
- Executes dropped EXE
PID:2920 -
\??\c:\pdpjp.exec:\pdpjp.exe23⤵
- Executes dropped EXE
PID:332 -
\??\c:\dvjpd.exec:\dvjpd.exe24⤵
- Executes dropped EXE
PID:708 -
\??\c:\rlflxrf.exec:\rlflxrf.exe25⤵
- Executes dropped EXE
PID:1824 -
\??\c:\hbhhtb.exec:\hbhhtb.exe26⤵
- Executes dropped EXE
PID:1992 -
\??\c:\hbhntt.exec:\hbhntt.exe27⤵
- Executes dropped EXE
PID:620 -
\??\c:\9jvvd.exec:\9jvvd.exe28⤵
- Executes dropped EXE
PID:2952 -
\??\c:\pjppd.exec:\pjppd.exe29⤵
- Executes dropped EXE
PID:2472 -
\??\c:\thbhtb.exec:\thbhtb.exe30⤵
- Executes dropped EXE
PID:2128 -
\??\c:\1nhnnn.exec:\1nhnnn.exe31⤵
- Executes dropped EXE
PID:2416 -
\??\c:\dpdjv.exec:\dpdjv.exe32⤵
- Executes dropped EXE
PID:1744 -
\??\c:\3jdjj.exec:\3jdjj.exe33⤵
- Executes dropped EXE
PID:2604 -
\??\c:\1rrxffr.exec:\1rrxffr.exe34⤵
- Executes dropped EXE
PID:2900 -
\??\c:\1nhtbb.exec:\1nhtbb.exe35⤵
- Executes dropped EXE
PID:1588 -
\??\c:\7hhhtt.exec:\7hhhtt.exe36⤵
- Executes dropped EXE
PID:2808 -
\??\c:\jdpvv.exec:\jdpvv.exe37⤵
- Executes dropped EXE
PID:2668 -
\??\c:\vpdjv.exec:\vpdjv.exe38⤵
- Executes dropped EXE
PID:2780 -
\??\c:\llxfllx.exec:\llxfllx.exe39⤵
- Executes dropped EXE
PID:2752 -
\??\c:\rlfllfr.exec:\rlfllfr.exe40⤵
- Executes dropped EXE
PID:2712 -
\??\c:\thttbn.exec:\thttbn.exe41⤵
- Executes dropped EXE
PID:2608 -
\??\c:\nhtnbb.exec:\nhtnbb.exe42⤵
- Executes dropped EXE
PID:2568 -
\??\c:\5vjvj.exec:\5vjvj.exe43⤵
- Executes dropped EXE
PID:2552 -
\??\c:\vpddp.exec:\vpddp.exe44⤵
- Executes dropped EXE
PID:2532 -
\??\c:\xffxrlf.exec:\xffxrlf.exe45⤵
- Executes dropped EXE
PID:1436 -
\??\c:\lllrrfl.exec:\lllrrfl.exe46⤵
- Executes dropped EXE
PID:2108 -
\??\c:\5bnnnn.exec:\5bnnnn.exe47⤵
- Executes dropped EXE
PID:2820 -
\??\c:\nhhhhn.exec:\nhhhhn.exe48⤵
- Executes dropped EXE
PID:2996 -
\??\c:\9ntbtb.exec:\9ntbtb.exe49⤵
- Executes dropped EXE
PID:1396 -
\??\c:\jvjvj.exec:\jvjvj.exe50⤵
- Executes dropped EXE
PID:2316 -
\??\c:\1vvpv.exec:\1vvpv.exe51⤵
- Executes dropped EXE
PID:2016 -
\??\c:\ffrfflx.exec:\ffrfflx.exe52⤵
- Executes dropped EXE
PID:768 -
\??\c:\fxrflfl.exec:\fxrflfl.exe53⤵
- Executes dropped EXE
PID:1052 -
\??\c:\9thtbh.exec:\9thtbh.exe54⤵
- Executes dropped EXE
PID:2824 -
\??\c:\thtttb.exec:\thtttb.exe55⤵
- Executes dropped EXE
PID:1836 -
\??\c:\pppvv.exec:\pppvv.exe56⤵
- Executes dropped EXE
PID:300 -
\??\c:\pdvvd.exec:\pdvvd.exe57⤵
- Executes dropped EXE
PID:2072 -
\??\c:\rlffxfr.exec:\rlffxfr.exe58⤵
- Executes dropped EXE
PID:1264 -
\??\c:\frllrxl.exec:\frllrxl.exe59⤵
- Executes dropped EXE
PID:2928 -
\??\c:\5tnthn.exec:\5tnthn.exe60⤵
- Executes dropped EXE
PID:2388 -
\??\c:\bnhnnt.exec:\bnhnnt.exe61⤵
- Executes dropped EXE
PID:2256 -
\??\c:\1pjjp.exec:\1pjjp.exe62⤵
- Executes dropped EXE
PID:984 -
\??\c:\9vjdp.exec:\9vjdp.exe63⤵
- Executes dropped EXE
PID:332 -
\??\c:\3lxfllr.exec:\3lxfllr.exe64⤵
- Executes dropped EXE
PID:1360 -
\??\c:\xrlfllr.exec:\xrlfllr.exe65⤵
- Executes dropped EXE
PID:644 -
\??\c:\hbnntb.exec:\hbnntb.exe66⤵PID:908
-
\??\c:\vpvdd.exec:\vpvdd.exe67⤵PID:1608
-
\??\c:\xlffrrx.exec:\xlffrrx.exe68⤵PID:620
-
\??\c:\rrflrrx.exec:\rrflrrx.exe69⤵PID:1036
-
\??\c:\fxllllx.exec:\fxllllx.exe70⤵PID:2080
-
\??\c:\bthhnh.exec:\bthhnh.exe71⤵PID:572
-
\??\c:\bthnnt.exec:\bthnnt.exe72⤵PID:2292
-
\??\c:\dvpvj.exec:\dvpvj.exe73⤵PID:880
-
\??\c:\vpdjj.exec:\vpdjj.exe74⤵PID:2804
-
\??\c:\fxlrrrx.exec:\fxlrrrx.exe75⤵PID:2420
-
\??\c:\rlxxxfl.exec:\rlxxxfl.exe76⤵PID:1592
-
\??\c:\hbtttt.exec:\hbtttt.exe77⤵PID:1648
-
\??\c:\bbhbtt.exec:\bbhbtt.exe78⤵PID:2376
-
\??\c:\jvjvd.exec:\jvjvd.exe79⤵PID:2332
-
\??\c:\3djdj.exec:\3djdj.exe80⤵PID:2624
-
\??\c:\fxrrlrx.exec:\fxrrlrx.exe81⤵PID:2528
-
\??\c:\frxxxxx.exec:\frxxxxx.exe82⤵PID:2912
-
\??\c:\tnthnt.exec:\tnthnt.exe83⤵PID:2680
-
\??\c:\nnnthb.exec:\nnnthb.exe84⤵PID:2516
-
\??\c:\vjvjj.exec:\vjvjj.exe85⤵PID:1628
-
\??\c:\dvjjv.exec:\dvjjv.exe86⤵PID:2400
-
\??\c:\1frxxff.exec:\1frxxff.exe87⤵PID:2404
-
\??\c:\rlrlrlr.exec:\rlrlrlr.exe88⤵PID:2892
-
\??\c:\bnbbnn.exec:\bnbbnn.exe89⤵PID:2980
-
\??\c:\tnttbh.exec:\tnttbh.exe90⤵PID:2172
-
\??\c:\bttttn.exec:\bttttn.exe91⤵PID:2828
-
\??\c:\jdddj.exec:\jdddj.exe92⤵PID:2616
-
\??\c:\vjppv.exec:\vjppv.exe93⤵PID:700
-
\??\c:\lllrfrf.exec:\lllrfrf.exe94⤵PID:2708
-
\??\c:\llxxlfr.exec:\llxxlfr.exe95⤵PID:2508
-
\??\c:\tntbhh.exec:\tntbhh.exe96⤵PID:2848
-
\??\c:\ttthth.exec:\ttthth.exe97⤵PID:1660
-
\??\c:\1pddj.exec:\1pddj.exe98⤵PID:1600
-
\??\c:\1jjvv.exec:\1jjvv.exe99⤵PID:848
-
\??\c:\lfxxxxl.exec:\lfxxxxl.exe100⤵PID:320
-
\??\c:\lfllrxx.exec:\lfllrxx.exe101⤵PID:2432
-
\??\c:\lflrrxf.exec:\lflrrxf.exe102⤵PID:2092
-
\??\c:\nhntbt.exec:\nhntbt.exe103⤵PID:796
-
\??\c:\vpdpp.exec:\vpdpp.exe104⤵PID:928
-
\??\c:\3jpdd.exec:\3jpdd.exe105⤵PID:2368
-
\??\c:\rfflrll.exec:\rfflrll.exe106⤵PID:1784
-
\??\c:\fxllrll.exec:\fxllrll.exe107⤵PID:2320
-
\??\c:\xrfxxxf.exec:\xrfxxxf.exe108⤵PID:1296
-
\??\c:\bnbbhn.exec:\bnbbhn.exe109⤵PID:1872
-
\??\c:\dpddv.exec:\dpddv.exe110⤵PID:2152
-
\??\c:\vjpvv.exec:\vjpvv.exe111⤵PID:2352
-
\??\c:\rfrxffl.exec:\rfrxffl.exe112⤵PID:1720
-
\??\c:\rlxllrf.exec:\rlxllrf.exe113⤵PID:2128
-
\??\c:\1hbbnh.exec:\1hbbnh.exe114⤵PID:1028
-
\??\c:\tnhhbb.exec:\tnhhbb.exe115⤵PID:1744
-
\??\c:\hbnbnn.exec:\hbnbnn.exe116⤵PID:2424
-
\??\c:\jdvdv.exec:\jdvdv.exe117⤵PID:2604
-
\??\c:\pdvdd.exec:\pdvdd.exe118⤵PID:2488
-
\??\c:\9xxxfxf.exec:\9xxxfxf.exe119⤵PID:2660
-
\??\c:\rfrxxlr.exec:\rfrxxlr.exe120⤵PID:2736
-
\??\c:\9thnnn.exec:\9thnnn.exe121⤵PID:2272
-
\??\c:\btbnnn.exec:\btbnnn.exe122⤵PID:2652
-
\??\c:\ddpjv.exec:\ddpjv.exe123⤵PID:2556
-
\??\c:\pjdpv.exec:\pjdpv.exe124⤵PID:2544
-
\??\c:\1xrlrlr.exec:\1xrlrlr.exe125⤵PID:1316
-
\??\c:\lfffllr.exec:\lfffllr.exe126⤵PID:2584
-
\??\c:\ffrrlll.exec:\ffrrlll.exe127⤵PID:2656
-
\??\c:\5hhhhn.exec:\5hhhhn.exe128⤵PID:3028
-
\??\c:\5htbnn.exec:\5htbnn.exe129⤵PID:2696
-
\??\c:\pjvjv.exec:\pjvjv.exe130⤵PID:3000
-
\??\c:\5vpvp.exec:\5vpvp.exe131⤵PID:2888
-
\??\c:\5lflxxf.exec:\5lflxxf.exe132⤵PID:3004
-
\??\c:\lfxlrxr.exec:\lfxlrxr.exe133⤵PID:2024
-
\??\c:\tnbhtn.exec:\tnbhtn.exe134⤵PID:2176
-
\??\c:\hbnttb.exec:\hbnttb.exe135⤵PID:1852
-
\??\c:\1pddd.exec:\1pddd.exe136⤵PID:912
-
\??\c:\1pddj.exec:\1pddj.exe137⤵PID:2620
-
\??\c:\rlxffff.exec:\rlxffff.exe138⤵PID:2844
-
\??\c:\1xxlxxf.exec:\1xxlxxf.exe139⤵PID:1644
-
\??\c:\7hbhnh.exec:\7hbhnh.exe140⤵PID:1300
-
\??\c:\9hthtb.exec:\9hthtb.exe141⤵PID:1568
-
\??\c:\vjvvv.exec:\vjvvv.exe142⤵PID:1912
-
\??\c:\5vjpv.exec:\5vjpv.exe143⤵PID:2788
-
\??\c:\dvjjj.exec:\dvjjj.exe144⤵PID:2932
-
\??\c:\rflrllr.exec:\rflrllr.exe145⤵PID:1304
-
\??\c:\xlxfflx.exec:\xlxfflx.exe146⤵PID:2260
-
\??\c:\tnttbh.exec:\tnttbh.exe147⤵PID:1120
-
\??\c:\thnbbb.exec:\thnbbb.exe148⤵PID:2296
-
\??\c:\pjpvv.exec:\pjpvv.exe149⤵PID:1868
-
\??\c:\1vpvv.exec:\1vpvv.exe150⤵PID:2500
-
\??\c:\fxffxrf.exec:\fxffxrf.exe151⤵PID:1608
-
\??\c:\flrfxfx.exec:\flrfxfx.exe152⤵PID:972
-
\??\c:\tnbhnh.exec:\tnbhnh.exe153⤵PID:784
-
\??\c:\hhttbb.exec:\hhttbb.exe154⤵PID:2196
-
\??\c:\vpddj.exec:\vpddj.exe155⤵PID:548
-
\??\c:\3jvvv.exec:\3jvvv.exe156⤵PID:1804
-
\??\c:\1lfxllr.exec:\1lfxllr.exe157⤵PID:3068
-
\??\c:\fxflrrx.exec:\fxflrrx.exe158⤵PID:2200
-
\??\c:\thntbh.exec:\thntbh.exe159⤵PID:1560
-
\??\c:\bnttbh.exec:\bnttbh.exe160⤵PID:2208
-
\??\c:\ppddp.exec:\ppddp.exe161⤵PID:2716
-
\??\c:\1dvdd.exec:\1dvdd.exe162⤵PID:2668
-
\??\c:\lxlllrx.exec:\lxlllrx.exe163⤵PID:2760
-
\??\c:\llxllrx.exec:\llxllrx.exe164⤵PID:2752
-
\??\c:\thhhhh.exec:\thhhhh.exe165⤵PID:2712
-
\??\c:\hbnntb.exec:\hbnntb.exe166⤵PID:2520
-
\??\c:\1dddd.exec:\1dddd.exe167⤵PID:2568
-
\??\c:\pjvpv.exec:\pjvpv.exe168⤵PID:2372
-
\??\c:\jdppv.exec:\jdppv.exe169⤵PID:3024
-
\??\c:\lxffrxl.exec:\lxffrxl.exe170⤵PID:2028
-
\??\c:\rffxxxf.exec:\rffxxxf.exe171⤵PID:2992
-
\??\c:\tntbhn.exec:\tntbhn.exe172⤵PID:2384
-
\??\c:\btttbn.exec:\btttbn.exe173⤵PID:2996
-
\??\c:\pjvdd.exec:\pjvdd.exe174⤵PID:844
-
\??\c:\pdvpv.exec:\pdvpv.exe175⤵PID:836
-
\??\c:\rlflrrx.exec:\rlflrrx.exe176⤵PID:1752
-
\??\c:\3rlxffr.exec:\3rlxffr.exe177⤵PID:348
-
\??\c:\tntbtb.exec:\tntbtb.exe178⤵PID:1960
-
\??\c:\htbttt.exec:\htbttt.exe179⤵PID:2084
-
\??\c:\hbntht.exec:\hbntht.exe180⤵PID:1732
-
\??\c:\vjppp.exec:\vjppp.exe181⤵PID:1660
-
\??\c:\dvvjj.exec:\dvvjj.exe182⤵PID:2052
-
\??\c:\1frllrf.exec:\1frllrf.exe183⤵PID:2796
-
\??\c:\3fxlxxx.exec:\3fxlxxx.exe184⤵PID:2936
-
\??\c:\btnnnh.exec:\btnnnh.exe185⤵PID:676
-
\??\c:\bthnhb.exec:\bthnhb.exe186⤵PID:1376
-
\??\c:\1vjpv.exec:\1vjpv.exe187⤵PID:796
-
\??\c:\jjdjj.exec:\jjdjj.exe188⤵PID:332
-
\??\c:\dvppv.exec:\dvppv.exe189⤵PID:824
-
\??\c:\lfflxxr.exec:\lfflxxr.exe190⤵PID:1928
-
\??\c:\frxfllr.exec:\frxfllr.exe191⤵PID:1924
-
\??\c:\btbhhn.exec:\btbhhn.exe192⤵PID:940
-
\??\c:\7nnntt.exec:\7nnntt.exe193⤵PID:1512
-
\??\c:\pjvvv.exec:\pjvvv.exe194⤵PID:696
-
\??\c:\jdpjd.exec:\jdpjd.exe195⤵PID:2088
-
\??\c:\rlfxlxf.exec:\rlfxlxf.exe196⤵PID:2444
-
\??\c:\fxrffff.exec:\fxrffff.exe197⤵PID:1816
-
\??\c:\nbhnbh.exec:\nbhnbh.exe198⤵PID:2956
-
\??\c:\3btttt.exec:\3btttt.exe199⤵PID:2492
-
\??\c:\htbnnh.exec:\htbnnh.exe200⤵PID:2424
-
\??\c:\vjjvv.exec:\vjjvv.exe201⤵PID:1584
-
\??\c:\7vppd.exec:\7vppd.exe202⤵PID:1648
-
\??\c:\xlxfrlx.exec:\xlxfrlx.exe203⤵PID:2208
-
\??\c:\xrfxllr.exec:\xrfxllr.exe204⤵PID:2924
-
\??\c:\nbnnnn.exec:\nbnnnn.exe205⤵PID:2776
-
\??\c:\5hnhnn.exec:\5hnhnn.exe206⤵PID:2652
-
\??\c:\jdvdd.exec:\jdvdd.exe207⤵PID:2556
-
\??\c:\3dpjj.exec:\3dpjj.exe208⤵PID:2684
-
\??\c:\9lxxlxf.exec:\9lxxlxf.exe209⤵PID:1316
-
\??\c:\5rrflll.exec:\5rrflll.exe210⤵PID:3020
-
\??\c:\htntbt.exec:\htntbt.exe211⤵PID:2656
-
\??\c:\bthnhh.exec:\bthnhh.exe212⤵PID:3028
-
\??\c:\lfrlrxf.exec:\lfrlrxf.exe213⤵PID:2028
-
\??\c:\rlxflfl.exec:\rlxflfl.exe214⤵PID:2836
-
\??\c:\1lllrxr.exec:\1lllrxr.exe215⤵PID:2888
-
\??\c:\9hhntt.exec:\9hhntt.exe216⤵PID:1968
-
\??\c:\pjppd.exec:\pjppd.exe217⤵PID:2616
-
\??\c:\3djpv.exec:\3djpv.exe218⤵PID:2412
-
\??\c:\xrxflrl.exec:\xrxflrl.exe219⤵PID:1852
-
\??\c:\thtbbh.exec:\thtbbh.exe220⤵PID:912
-
\??\c:\1pdpv.exec:\1pdpv.exe221⤵PID:2852
-
\??\c:\vpjjj.exec:\vpjjj.exe222⤵PID:1240
-
\??\c:\lxrlrrx.exec:\lxrlrrx.exe223⤵PID:2072
-
\??\c:\rlflxxf.exec:\rlflxxf.exe224⤵PID:1724
-
\??\c:\nhtbbb.exec:\nhtbbb.exe225⤵PID:1400
-
\??\c:\hbnhhn.exec:\hbnhhn.exe226⤵PID:536
-
\??\c:\nhtbbb.exec:\nhtbbb.exe227⤵PID:1232
-
\??\c:\pjvvp.exec:\pjvvp.exe228⤵PID:2932
-
\??\c:\9vvvp.exec:\9vvvp.exe229⤵PID:1304
-
\??\c:\frfffff.exec:\frfffff.exe230⤵PID:2260
-
\??\c:\rlflrrl.exec:\rlflrrl.exe231⤵PID:1784
-
\??\c:\hhbnnn.exec:\hhbnnn.exe232⤵PID:2320
-
\??\c:\tnbhhn.exec:\tnbhhn.exe233⤵PID:852
-
\??\c:\ppdjj.exec:\ppdjj.exe234⤵PID:772
-
\??\c:\ddvjd.exec:\ddvjd.exe235⤵PID:1428
-
\??\c:\xlxxllx.exec:\xlxxllx.exe236⤵PID:2904
-
\??\c:\1rrrxrx.exec:\1rrrxrx.exe237⤵PID:2336
-
\??\c:\thnbhn.exec:\thnbhn.exe238⤵PID:2292
-
\??\c:\tnnthh.exec:\tnnthh.exe239⤵PID:2416
-
\??\c:\ddjpd.exec:\ddjpd.exe240⤵PID:1804
-
\??\c:\1vpdj.exec:\1vpdj.exe241⤵PID:3068
-
\??\c:\llxfflr.exec:\llxfflr.exe242⤵PID:1700