Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 06:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8f8d2e19eca2f9a3d98543ceaef4c7e0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
8f8d2e19eca2f9a3d98543ceaef4c7e0_NeikiAnalytics.exe
-
Size
75KB
-
MD5
8f8d2e19eca2f9a3d98543ceaef4c7e0
-
SHA1
eadc2712cd941a31f357336f0878f231a308f122
-
SHA256
0fd144de79974779c99e0a68304a35eb1bb817cdc85e6773d699b75954be977d
-
SHA512
8ea534976a81a740185cdc97a7c7e58143d5631d15cebb67c62a1c1d79a2c83f73451ed930999f6548ad9fda18906f85f8e54687cc3d922d80676689e1b5b00a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC54:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCi
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/1540-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1540-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2388-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1480-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1176-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2244-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/324-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/412-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/564-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2972-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ppvdp.exerlrfllr.exenhnnnn.exejdpdp.exerlrrxxf.exelfflrxf.exe9tnbnh.exe3vpvp.exexlxrxxf.exerlxllrr.exe9nbbbh.exepjdpj.exepvdpj.exerrlffxf.exebnbhbb.exenhnnhn.exepvppv.exepdjjd.exeffflrrr.exenbntbt.exetnhhbb.exedjvjj.exepjjpv.exe5rflxfl.exeflffrxl.exebbhbbb.exetthhtt.exejvjvj.exexlfllff.exe5rlfrrx.exehbnnbt.exebnthth.exedpjjp.exerlflrrf.exe7lxlfff.exexrlrxfl.exehbtbnn.exenhtbhn.exejvvpv.exelxxfrrf.exexfxflrx.exexxrfllr.exehthntt.exejdvvd.exevvppj.exelxlrllx.exefxxfllx.exe7tbnbb.exetttbnn.exe1hnbbb.exepjddj.exedpjpv.exelllrlrx.exe5nbtbh.exedpddd.exedpddd.exe3rflxxf.exexfllllx.exe9btttb.exentnntb.exevvdjj.exe7pddj.exerflflrr.exexlrlfff.exepid process 2388 ppvdp.exe 2168 rlrfllr.exe 1876 nhnnnn.exe 2656 jdpdp.exe 2568 rlrrxxf.exe 2604 lfflrxf.exe 2580 9tnbnh.exe 2464 3vpvp.exe 2916 xlxrxxf.exe 2924 rlxllrr.exe 1760 9nbbbh.exe 1664 pjdpj.exe 1480 pvdpj.exe 1176 rrlffxf.exe 2756 bnbhbb.exe 1984 nhnnhn.exe 1740 pvppv.exe 2244 pdjjd.exe 1864 ffflrrr.exe 1524 nbntbt.exe 324 tnhhbb.exe 708 djvjj.exe 828 pjjpv.exe 2340 5rflxfl.exe 412 flffrxl.exe 384 bbhbbb.exe 1820 tthhtt.exe 1988 jvjvj.exe 1636 xlfllff.exe 564 5rlfrrx.exe 2972 hbnnbt.exe 1592 bnthth.exe 1576 dpjjp.exe 3028 rlflrrf.exe 2188 7lxlfff.exe 2804 xrlrxfl.exe 2660 hbtbnn.exe 2592 nhtbhn.exe 2072 jvvpv.exe 2480 lxxfrrf.exe 2828 xfxflrx.exe 2616 xxrfllr.exe 2524 hthntt.exe 2564 jdvvd.exe 2044 vvppj.exe 2368 lxlrllx.exe 2732 fxxfllx.exe 1940 7tbnbb.exe 968 tttbnn.exe 956 1hnbbb.exe 1896 pjddj.exe 2768 dpjpv.exe 2412 lllrlrx.exe 1632 5nbtbh.exe 1700 dpddd.exe 2928 dpddd.exe 1104 3rflxxf.exe 2628 xfllllx.exe 2272 9btttb.exe 592 ntnntb.exe 324 vvdjj.exe 1304 7pddj.exe 2336 rflflrr.exe 696 xlrlfff.exe -
Processes:
resource yara_rule behavioral1/memory/1540-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1876-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1876-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1876-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1480-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1176-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2244-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/324-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/412-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/564-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-303-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8f8d2e19eca2f9a3d98543ceaef4c7e0_NeikiAnalytics.exeppvdp.exerlrfllr.exenhnnnn.exejdpdp.exerlrrxxf.exelfflrxf.exe9tnbnh.exe3vpvp.exexlxrxxf.exerlxllrr.exe9nbbbh.exepjdpj.exepvdpj.exerrlffxf.exebnbhbb.exedescription pid process target process PID 1540 wrote to memory of 2388 1540 8f8d2e19eca2f9a3d98543ceaef4c7e0_NeikiAnalytics.exe ppvdp.exe PID 1540 wrote to memory of 2388 1540 8f8d2e19eca2f9a3d98543ceaef4c7e0_NeikiAnalytics.exe ppvdp.exe PID 1540 wrote to memory of 2388 1540 8f8d2e19eca2f9a3d98543ceaef4c7e0_NeikiAnalytics.exe ppvdp.exe PID 1540 wrote to memory of 2388 1540 8f8d2e19eca2f9a3d98543ceaef4c7e0_NeikiAnalytics.exe ppvdp.exe PID 2388 wrote to memory of 2168 2388 ppvdp.exe rlrfllr.exe PID 2388 wrote to memory of 2168 2388 ppvdp.exe rlrfllr.exe PID 2388 wrote to memory of 2168 2388 ppvdp.exe rlrfllr.exe PID 2388 wrote to memory of 2168 2388 ppvdp.exe rlrfllr.exe PID 2168 wrote to memory of 1876 2168 rlrfllr.exe nhnnnn.exe PID 2168 wrote to memory of 1876 2168 rlrfllr.exe nhnnnn.exe PID 2168 wrote to memory of 1876 2168 rlrfllr.exe nhnnnn.exe PID 2168 wrote to memory of 1876 2168 rlrfllr.exe nhnnnn.exe PID 1876 wrote to memory of 2656 1876 nhnnnn.exe jdpdp.exe PID 1876 wrote to memory of 2656 1876 nhnnnn.exe jdpdp.exe PID 1876 wrote to memory of 2656 1876 nhnnnn.exe jdpdp.exe PID 1876 wrote to memory of 2656 1876 nhnnnn.exe jdpdp.exe PID 2656 wrote to memory of 2568 2656 jdpdp.exe rlrrxxf.exe PID 2656 wrote to memory of 2568 2656 jdpdp.exe rlrrxxf.exe PID 2656 wrote to memory of 2568 2656 jdpdp.exe rlrrxxf.exe PID 2656 wrote to memory of 2568 2656 jdpdp.exe rlrrxxf.exe PID 2568 wrote to memory of 2604 2568 rlrrxxf.exe lfflrxf.exe PID 2568 wrote to memory of 2604 2568 rlrrxxf.exe lfflrxf.exe PID 2568 wrote to memory of 2604 2568 rlrrxxf.exe lfflrxf.exe PID 2568 wrote to memory of 2604 2568 rlrrxxf.exe lfflrxf.exe PID 2604 wrote to memory of 2580 2604 lfflrxf.exe 9tnbnh.exe PID 2604 wrote to memory of 2580 2604 lfflrxf.exe 9tnbnh.exe PID 2604 wrote to memory of 2580 2604 lfflrxf.exe 9tnbnh.exe PID 2604 wrote to memory of 2580 2604 lfflrxf.exe 9tnbnh.exe PID 2580 wrote to memory of 2464 2580 9tnbnh.exe 3vpvp.exe PID 2580 wrote to memory of 2464 2580 9tnbnh.exe 3vpvp.exe PID 2580 wrote to memory of 2464 2580 9tnbnh.exe 3vpvp.exe PID 2580 wrote to memory of 2464 2580 9tnbnh.exe 3vpvp.exe PID 2464 wrote to memory of 2916 2464 3vpvp.exe xlxrxxf.exe PID 2464 wrote to memory of 2916 2464 3vpvp.exe xlxrxxf.exe PID 2464 wrote to memory of 2916 2464 3vpvp.exe xlxrxxf.exe PID 2464 wrote to memory of 2916 2464 3vpvp.exe xlxrxxf.exe PID 2916 wrote to memory of 2924 2916 xlxrxxf.exe rlxllrr.exe PID 2916 wrote to memory of 2924 2916 xlxrxxf.exe rlxllrr.exe PID 2916 wrote to memory of 2924 2916 xlxrxxf.exe rlxllrr.exe PID 2916 wrote to memory of 2924 2916 xlxrxxf.exe rlxllrr.exe PID 2924 wrote to memory of 1760 2924 rlxllrr.exe 9nbbbh.exe PID 2924 wrote to memory of 1760 2924 rlxllrr.exe 9nbbbh.exe PID 2924 wrote to memory of 1760 2924 rlxllrr.exe 9nbbbh.exe PID 2924 wrote to memory of 1760 2924 rlxllrr.exe 9nbbbh.exe PID 1760 wrote to memory of 1664 1760 9nbbbh.exe pjdpj.exe PID 1760 wrote to memory of 1664 1760 9nbbbh.exe pjdpj.exe PID 1760 wrote to memory of 1664 1760 9nbbbh.exe pjdpj.exe PID 1760 wrote to memory of 1664 1760 9nbbbh.exe pjdpj.exe PID 1664 wrote to memory of 1480 1664 pjdpj.exe pvdpj.exe PID 1664 wrote to memory of 1480 1664 pjdpj.exe pvdpj.exe PID 1664 wrote to memory of 1480 1664 pjdpj.exe pvdpj.exe PID 1664 wrote to memory of 1480 1664 pjdpj.exe pvdpj.exe PID 1480 wrote to memory of 1176 1480 pvdpj.exe rrlffxf.exe PID 1480 wrote to memory of 1176 1480 pvdpj.exe rrlffxf.exe PID 1480 wrote to memory of 1176 1480 pvdpj.exe rrlffxf.exe PID 1480 wrote to memory of 1176 1480 pvdpj.exe rrlffxf.exe PID 1176 wrote to memory of 2756 1176 rrlffxf.exe bnbhbb.exe PID 1176 wrote to memory of 2756 1176 rrlffxf.exe bnbhbb.exe PID 1176 wrote to memory of 2756 1176 rrlffxf.exe bnbhbb.exe PID 1176 wrote to memory of 2756 1176 rrlffxf.exe bnbhbb.exe PID 2756 wrote to memory of 1984 2756 bnbhbb.exe nhnnhn.exe PID 2756 wrote to memory of 1984 2756 bnbhbb.exe nhnnhn.exe PID 2756 wrote to memory of 1984 2756 bnbhbb.exe nhnnhn.exe PID 2756 wrote to memory of 1984 2756 bnbhbb.exe nhnnhn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f8d2e19eca2f9a3d98543ceaef4c7e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8f8d2e19eca2f9a3d98543ceaef4c7e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\ppvdp.exec:\ppvdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\rlrfllr.exec:\rlrfllr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\nhnnnn.exec:\nhnnnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\jdpdp.exec:\jdpdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\rlrrxxf.exec:\rlrrxxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\lfflrxf.exec:\lfflrxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\9tnbnh.exec:\9tnbnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\3vpvp.exec:\3vpvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\xlxrxxf.exec:\xlxrxxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\rlxllrr.exec:\rlxllrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\9nbbbh.exec:\9nbbbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\pjdpj.exec:\pjdpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\pvdpj.exec:\pvdpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\rrlffxf.exec:\rrlffxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
\??\c:\bnbhbb.exec:\bnbhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\nhnnhn.exec:\nhnnhn.exe17⤵
- Executes dropped EXE
PID:1984 -
\??\c:\pvppv.exec:\pvppv.exe18⤵
- Executes dropped EXE
PID:1740 -
\??\c:\pdjjd.exec:\pdjjd.exe19⤵
- Executes dropped EXE
PID:2244 -
\??\c:\ffflrrr.exec:\ffflrrr.exe20⤵
- Executes dropped EXE
PID:1864 -
\??\c:\nbntbt.exec:\nbntbt.exe21⤵
- Executes dropped EXE
PID:1524 -
\??\c:\tnhhbb.exec:\tnhhbb.exe22⤵
- Executes dropped EXE
PID:324 -
\??\c:\djvjj.exec:\djvjj.exe23⤵
- Executes dropped EXE
PID:708 -
\??\c:\pjjpv.exec:\pjjpv.exe24⤵
- Executes dropped EXE
PID:828 -
\??\c:\5rflxfl.exec:\5rflxfl.exe25⤵
- Executes dropped EXE
PID:2340 -
\??\c:\flffrxl.exec:\flffrxl.exe26⤵
- Executes dropped EXE
PID:412 -
\??\c:\bbhbbb.exec:\bbhbbb.exe27⤵
- Executes dropped EXE
PID:384 -
\??\c:\tthhtt.exec:\tthhtt.exe28⤵
- Executes dropped EXE
PID:1820 -
\??\c:\jvjvj.exec:\jvjvj.exe29⤵
- Executes dropped EXE
PID:1988 -
\??\c:\xlfllff.exec:\xlfllff.exe30⤵
- Executes dropped EXE
PID:1636 -
\??\c:\5rlfrrx.exec:\5rlfrrx.exe31⤵
- Executes dropped EXE
PID:564 -
\??\c:\hbnnbt.exec:\hbnnbt.exe32⤵
- Executes dropped EXE
PID:2972 -
\??\c:\bnthth.exec:\bnthth.exe33⤵
- Executes dropped EXE
PID:1592 -
\??\c:\dpjjp.exec:\dpjjp.exe34⤵
- Executes dropped EXE
PID:1576 -
\??\c:\rlflrrf.exec:\rlflrrf.exe35⤵
- Executes dropped EXE
PID:3028 -
\??\c:\7lxlfff.exec:\7lxlfff.exe36⤵
- Executes dropped EXE
PID:2188 -
\??\c:\xrlrxfl.exec:\xrlrxfl.exe37⤵
- Executes dropped EXE
PID:2804 -
\??\c:\hbtbnn.exec:\hbtbnn.exe38⤵
- Executes dropped EXE
PID:2660 -
\??\c:\nhtbhn.exec:\nhtbhn.exe39⤵
- Executes dropped EXE
PID:2592 -
\??\c:\jvvpv.exec:\jvvpv.exe40⤵
- Executes dropped EXE
PID:2072 -
\??\c:\lxxfrrf.exec:\lxxfrrf.exe41⤵
- Executes dropped EXE
PID:2480 -
\??\c:\xfxflrx.exec:\xfxflrx.exe42⤵
- Executes dropped EXE
PID:2828 -
\??\c:\xxrfllr.exec:\xxrfllr.exe43⤵
- Executes dropped EXE
PID:2616 -
\??\c:\hthntt.exec:\hthntt.exe44⤵
- Executes dropped EXE
PID:2524 -
\??\c:\jdvvd.exec:\jdvvd.exe45⤵
- Executes dropped EXE
PID:2564 -
\??\c:\vvppj.exec:\vvppj.exe46⤵
- Executes dropped EXE
PID:2044 -
\??\c:\lxlrllx.exec:\lxlrllx.exe47⤵
- Executes dropped EXE
PID:2368 -
\??\c:\fxxfllx.exec:\fxxfllx.exe48⤵
- Executes dropped EXE
PID:2732 -
\??\c:\7tbnbb.exec:\7tbnbb.exe49⤵
- Executes dropped EXE
PID:1940 -
\??\c:\tttbnn.exec:\tttbnn.exe50⤵
- Executes dropped EXE
PID:968 -
\??\c:\1hnbbb.exec:\1hnbbb.exe51⤵
- Executes dropped EXE
PID:956 -
\??\c:\pjddj.exec:\pjddj.exe52⤵
- Executes dropped EXE
PID:1896 -
\??\c:\dpjpv.exec:\dpjpv.exe53⤵
- Executes dropped EXE
PID:2768 -
\??\c:\lllrlrx.exec:\lllrlrx.exe54⤵
- Executes dropped EXE
PID:2412 -
\??\c:\5nbtbh.exec:\5nbtbh.exe55⤵
- Executes dropped EXE
PID:1632 -
\??\c:\dpddd.exec:\dpddd.exe56⤵
- Executes dropped EXE
PID:1700 -
\??\c:\dpddd.exec:\dpddd.exe57⤵
- Executes dropped EXE
PID:2928 -
\??\c:\3rflxxf.exec:\3rflxxf.exe58⤵
- Executes dropped EXE
PID:1104 -
\??\c:\xfllllx.exec:\xfllllx.exe59⤵
- Executes dropped EXE
PID:2628 -
\??\c:\9btttb.exec:\9btttb.exe60⤵
- Executes dropped EXE
PID:2272 -
\??\c:\ntnntb.exec:\ntnntb.exe61⤵
- Executes dropped EXE
PID:592 -
\??\c:\vvdjj.exec:\vvdjj.exe62⤵
- Executes dropped EXE
PID:324 -
\??\c:\7pddj.exec:\7pddj.exe63⤵
- Executes dropped EXE
PID:1304 -
\??\c:\rflflrr.exec:\rflflrr.exe64⤵
- Executes dropped EXE
PID:2336 -
\??\c:\xlrlfff.exec:\xlrlfff.exe65⤵
- Executes dropped EXE
PID:696 -
\??\c:\hbbbbh.exec:\hbbbbh.exe66⤵PID:2416
-
\??\c:\3nhhnt.exec:\3nhhnt.exe67⤵PID:412
-
\??\c:\btbhtb.exec:\btbhtb.exe68⤵PID:1720
-
\??\c:\dpdvp.exec:\dpdvp.exe69⤵PID:1888
-
\??\c:\llxflrf.exec:\llxflrf.exe70⤵PID:1556
-
\??\c:\xlrrxxf.exec:\xlrrxxf.exe71⤵PID:1364
-
\??\c:\1htbbn.exec:\1htbbn.exe72⤵PID:2960
-
\??\c:\bnnttn.exec:\bnnttn.exe73⤵PID:572
-
\??\c:\jdjdj.exec:\jdjdj.exe74⤵PID:2184
-
\??\c:\pdjvp.exec:\pdjvp.exe75⤵PID:1596
-
\??\c:\ffffrxx.exec:\ffffrxx.exe76⤵PID:2388
-
\??\c:\rffrrlf.exec:\rffrrlf.exe77⤵PID:3032
-
\??\c:\lrxrrff.exec:\lrxrrff.exe78⤵PID:2168
-
\??\c:\9tbhbb.exec:\9tbhbb.exe79⤵PID:2132
-
\??\c:\5thttn.exec:\5thttn.exe80⤵PID:2316
-
\??\c:\3pvdj.exec:\3pvdj.exe81⤵PID:2576
-
\??\c:\dvjjp.exec:\dvjjp.exe82⤵PID:2832
-
\??\c:\dpvvv.exec:\dpvvv.exe83⤵PID:2716
-
\??\c:\1fxffxl.exec:\1fxffxl.exe84⤵PID:2556
-
\??\c:\fxfflll.exec:\fxfflll.exe85⤵PID:2460
-
\??\c:\httbbt.exec:\httbbt.exe86⤵PID:2448
-
\??\c:\nbtnnn.exec:\nbtnnn.exe87⤵PID:3044
-
\??\c:\dpvpv.exec:\dpvpv.exe88⤵PID:2504
-
\??\c:\ddppj.exec:\ddppj.exe89⤵PID:2432
-
\??\c:\xlxrrrr.exec:\xlxrrrr.exe90⤵PID:1932
-
\??\c:\frffxxl.exec:\frffxxl.exe91⤵PID:2036
-
\??\c:\ntbbbn.exec:\ntbbbn.exe92⤵PID:2000
-
\??\c:\bthbtt.exec:\bthbtt.exe93⤵PID:2332
-
\??\c:\3vjjd.exec:\3vjjd.exe94⤵PID:948
-
\??\c:\vdppp.exec:\vdppp.exe95⤵PID:1264
-
\??\c:\1frllrr.exec:\1frllrr.exe96⤵PID:1684
-
\??\c:\xrxlfxf.exec:\xrxlfxf.exe97⤵PID:884
-
\??\c:\lxfxrll.exec:\lxfxrll.exe98⤵PID:1620
-
\??\c:\bnhhbb.exec:\bnhhbb.exe99⤵PID:2976
-
\??\c:\7nbbbt.exec:\7nbbbt.exe100⤵PID:2232
-
\??\c:\dddpj.exec:\dddpj.exe101⤵PID:1976
-
\??\c:\djvvp.exec:\djvvp.exe102⤵PID:488
-
\??\c:\vjpvp.exec:\vjpvp.exe103⤵PID:108
-
\??\c:\lxfffff.exec:\lxfffff.exe104⤵PID:1476
-
\??\c:\rfxffff.exec:\rfxffff.exe105⤵PID:828
-
\??\c:\9nnhhb.exec:\9nnhhb.exe106⤵PID:344
-
\??\c:\nhnhbh.exec:\nhnhbh.exe107⤵PID:1788
-
\??\c:\nhhtbb.exec:\nhhtbb.exe108⤵PID:2340
-
\??\c:\vpddd.exec:\vpddd.exe109⤵PID:1080
-
\??\c:\vdjdd.exec:\vdjdd.exe110⤵PID:384
-
\??\c:\rfrllff.exec:\rfrllff.exe111⤵PID:856
-
\??\c:\lflxfff.exec:\lflxfff.exe112⤵PID:1324
-
\??\c:\htttbt.exec:\htttbt.exe113⤵PID:3036
-
\??\c:\nhtttt.exec:\nhtttt.exe114⤵PID:2360
-
\??\c:\pdddp.exec:\pdddp.exe115⤵PID:2972
-
\??\c:\jdjdj.exec:\jdjdj.exe116⤵PID:1060
-
\??\c:\3jjjj.exec:\3jjjj.exe117⤵PID:3008
-
\??\c:\lxllrll.exec:\lxllrll.exe118⤵PID:1960
-
\??\c:\rxxfrll.exec:\rxxfrll.exe119⤵PID:2964
-
\??\c:\xlxxfff.exec:\xlxxfff.exe120⤵PID:2724
-
\??\c:\tbhbbn.exec:\tbhbbn.exe121⤵PID:2140
-
\??\c:\htttbt.exec:\htttbt.exe122⤵PID:2652
-
\??\c:\jvvvd.exec:\jvvvd.exe123⤵PID:2844
-
\??\c:\1pdjd.exec:\1pdjd.exe124⤵PID:2568
-
\??\c:\jvvvv.exec:\jvvvv.exe125⤵PID:2468
-
\??\c:\lrfffxx.exec:\lrfffxx.exe126⤵PID:2492
-
\??\c:\fxllxxf.exec:\fxllxxf.exe127⤵PID:2440
-
\??\c:\tbhbhh.exec:\tbhbhh.exe128⤵PID:2744
-
\??\c:\3ttnhh.exec:\3ttnhh.exe129⤵PID:2728
-
\??\c:\ddvdd.exec:\ddvdd.exe130⤵PID:2004
-
\??\c:\3vdvv.exec:\3vdvv.exe131⤵PID:1760
-
\??\c:\9vjjp.exec:\9vjjp.exe132⤵PID:1180
-
\??\c:\3lllllx.exec:\3lllllx.exe133⤵PID:1096
-
\??\c:\9frxfll.exec:\9frxfll.exe134⤵PID:2028
-
\??\c:\rffllff.exec:\rffllff.exe135⤵PID:2344
-
\??\c:\5tnhnn.exec:\5tnhnn.exe136⤵PID:2536
-
\??\c:\bntntn.exec:\bntntn.exe137⤵PID:320
-
\??\c:\dvjjj.exec:\dvjjj.exe138⤵PID:1268
-
\??\c:\dpjpp.exec:\dpjpp.exe139⤵PID:2904
-
\??\c:\3ppdv.exec:\3ppdv.exe140⤵PID:2888
-
\??\c:\lxxllrr.exec:\lxxllrr.exe141⤵PID:1428
-
\??\c:\9lrxfxf.exec:\9lrxfxf.exe142⤵PID:336
-
\??\c:\bntnnh.exec:\bntnnh.exe143⤵PID:2272
-
\??\c:\nbtnnn.exec:\nbtnnn.exe144⤵PID:592
-
\??\c:\vvppv.exec:\vvppv.exe145⤵PID:1892
-
\??\c:\dvjdj.exec:\dvjdj.exe146⤵PID:1304
-
\??\c:\rxfxrll.exec:\rxfxrll.exe147⤵PID:2336
-
\??\c:\flrrrll.exec:\flrrrll.exe148⤵PID:1812
-
\??\c:\1bhhhb.exec:\1bhhhb.exe149⤵PID:2384
-
\??\c:\7nnhnh.exec:\7nnhnh.exe150⤵PID:412
-
\??\c:\hthhhh.exec:\hthhhh.exe151⤵PID:1828
-
\??\c:\vpvpd.exec:\vpvpd.exe152⤵PID:1888
-
\??\c:\1dvdd.exec:\1dvdd.exe153⤵PID:2836
-
\??\c:\3xlxxrx.exec:\3xlxxrx.exe154⤵PID:1324
-
\??\c:\1xrrrrr.exec:\1xrrrrr.exe155⤵PID:1728
-
\??\c:\htnnnb.exec:\htnnnb.exe156⤵PID:572
-
\??\c:\5hthbb.exec:\5hthbb.exe157⤵PID:2868
-
\??\c:\hntbtn.exec:\hntbtn.exe158⤵PID:1604
-
\??\c:\1pvvd.exec:\1pvvd.exe159⤵PID:1596
-
\??\c:\vvjjd.exec:\vvjjd.exe160⤵PID:3016
-
\??\c:\xlflxrx.exec:\xlflxrx.exe161⤵PID:2188
-
\??\c:\rfrfxrr.exec:\rfrfxrr.exe162⤵PID:2168
-
\??\c:\nbhtth.exec:\nbhtth.exe163⤵PID:2600
-
\??\c:\1ntbnn.exec:\1ntbnn.exe164⤵PID:2452
-
\??\c:\vdddd.exec:\vdddd.exe165⤵PID:2472
-
\??\c:\vjvjv.exec:\vjvjv.exe166⤵PID:1956
-
\??\c:\lrffrrr.exec:\lrffrrr.exe167⤵PID:2696
-
\??\c:\flfxxll.exec:\flfxxll.exe168⤵PID:2512
-
\??\c:\xlrrlxx.exec:\xlrrlxx.exe169⤵PID:2912
-
\??\c:\nbtbtn.exec:\nbtbtn.exe170⤵PID:2100
-
\??\c:\tbhnnb.exec:\tbhnnb.exe171⤵PID:3044
-
\??\c:\djpjv.exec:\djpjv.exe172⤵PID:952
-
\??\c:\pdpvp.exec:\pdpvp.exe173⤵PID:2764
-
\??\c:\pdpjd.exec:\pdpjd.exe174⤵PID:2020
-
\??\c:\xrrxfff.exec:\xrrxfff.exe175⤵PID:1292
-
\??\c:\xxrxfff.exec:\xxrxfff.exe176⤵PID:956
-
\??\c:\htttbb.exec:\htttbb.exe177⤵PID:2736
-
\??\c:\hnthhb.exec:\hnthhb.exe178⤵PID:2760
-
\??\c:\jvvpp.exec:\jvvpp.exe179⤵PID:2412
-
\??\c:\jdjvp.exec:\jdjvp.exe180⤵PID:884
-
\??\c:\lfrxxrf.exec:\lfrxxrf.exe181⤵PID:2900
-
\??\c:\xrflxfl.exec:\xrflxfl.exe182⤵PID:2928
-
\??\c:\1tbbtt.exec:\1tbbtt.exe183⤵PID:1884
-
\??\c:\htnhnh.exec:\htnhnh.exe184⤵PID:2252
-
\??\c:\bnbnnh.exec:\bnbnnh.exe185⤵PID:1136
-
\??\c:\pjvvp.exec:\pjvvp.exe186⤵PID:896
-
\??\c:\pdvdv.exec:\pdvdv.exe187⤵PID:852
-
\??\c:\3lxffff.exec:\3lxffff.exe188⤵PID:2052
-
\??\c:\3rrrlfl.exec:\3rrrlfl.exe189⤵PID:1504
-
\??\c:\nbhhnh.exec:\nbhhnh.exe190⤵PID:2068
-
\??\c:\tnnntt.exec:\tnnntt.exe191⤵PID:1904
-
\??\c:\bhnnhn.exec:\bhnnhn.exe192⤵PID:2384
-
\??\c:\dvdjj.exec:\dvdjj.exe193⤵PID:2872
-
\??\c:\jdjvp.exec:\jdjvp.exe194⤵PID:1688
-
\??\c:\fllfrrr.exec:\fllfrrr.exe195⤵PID:3068
-
\??\c:\xlffxfx.exec:\xlffxfx.exe196⤵PID:904
-
\??\c:\5nnhnh.exec:\5nnhnh.exe197⤵PID:1748
-
\??\c:\nbnhhh.exec:\nbnhhh.exe198⤵PID:1520
-
\??\c:\9hnhhb.exec:\9hnhhb.exe199⤵PID:1452
-
\??\c:\3vjdd.exec:\3vjdd.exe200⤵PID:1604
-
\??\c:\jdpvd.exec:\jdpvd.exe201⤵PID:1412
-
\??\c:\fxrllfl.exec:\fxrllfl.exe202⤵PID:2128
-
\??\c:\frxfxxr.exec:\frxfxxr.exe203⤵PID:2676
-
\??\c:\5nnnnh.exec:\5nnnnh.exe204⤵PID:2168
-
\??\c:\bthhhb.exec:\bthhhb.exe205⤵PID:2644
-
\??\c:\dpjjd.exec:\dpjjd.exe206⤵PID:2592
-
\??\c:\dpvvv.exec:\dpvvv.exe207⤵PID:2604
-
\??\c:\lxrxllf.exec:\lxrxllf.exe208⤵PID:2480
-
\??\c:\xlxxfff.exec:\xlxxfff.exe209⤵PID:2612
-
\??\c:\7nhbbb.exec:\7nhbbb.exe210⤵PID:2616
-
\??\c:\nbthhn.exec:\nbthhn.exe211⤵PID:1992
-
\??\c:\vpvvv.exec:\vpvvv.exe212⤵PID:2564
-
\??\c:\1djjj.exec:\1djjj.exe213⤵PID:2504
-
\??\c:\frxffxf.exec:\frxffxf.exe214⤵PID:2368
-
\??\c:\1xflxff.exec:\1xflxff.exe215⤵PID:1664
-
\??\c:\nbbtbt.exec:\nbbtbt.exe216⤵PID:1192
-
\??\c:\thtbnh.exec:\thtbnh.exe217⤵PID:2748
-
\??\c:\5pvvd.exec:\5pvvd.exe218⤵PID:2756
-
\??\c:\dpvdd.exec:\dpvdd.exe219⤵PID:2788
-
\??\c:\ppvjp.exec:\ppvjp.exe220⤵PID:2768
-
\??\c:\3xrfxll.exec:\3xrfxll.exe221⤵PID:1680
-
\??\c:\fxfllll.exec:\fxfllll.exe222⤵PID:1700
-
\??\c:\hnhhhh.exec:\hnhhhh.exe223⤵PID:2276
-
\??\c:\thttbt.exec:\thttbt.exe224⤵PID:2260
-
\??\c:\vdvjd.exec:\vdvjd.exe225⤵PID:1524
-
\??\c:\vdpvv.exec:\vdpvv.exe226⤵PID:1212
-
\??\c:\lxxxxxl.exec:\lxxxxxl.exe227⤵PID:2544
-
\??\c:\7xfflfl.exec:\7xfflfl.exe228⤵PID:588
-
\??\c:\ffxxfll.exec:\ffxxfll.exe229⤵PID:324
-
\??\c:\tnbbnn.exec:\tnbbnn.exe230⤵PID:2052
-
\??\c:\tbnttb.exec:\tbnttb.exe231⤵PID:860
-
\??\c:\jdjjp.exec:\jdjjp.exe232⤵PID:1908
-
\??\c:\dvvjj.exec:\dvvjj.exe233⤵PID:1616
-
\??\c:\dvpdv.exec:\dvpdv.exe234⤵PID:2384
-
\??\c:\rfrrllr.exec:\rfrrllr.exe235⤵PID:2348
-
\??\c:\5htttt.exec:\5htttt.exe236⤵PID:2840
-
\??\c:\3hbbtt.exec:\3hbbtt.exe237⤵PID:1636
-
\??\c:\ntthnh.exec:\ntthnh.exe238⤵PID:912
-
\??\c:\vvvjv.exec:\vvvjv.exe239⤵PID:2772
-
\??\c:\pdjpp.exec:\pdjpp.exe240⤵PID:2884
-
\??\c:\xfrflxr.exec:\xfrflxr.exe241⤵PID:1600
-
\??\c:\xllfrrx.exec:\xllfrrx.exe242⤵PID:2584