Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 14:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
da82ba94ef5606324cf310950fc1c6b0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
da82ba94ef5606324cf310950fc1c6b0_NeikiAnalytics.exe
-
Size
95KB
-
MD5
da82ba94ef5606324cf310950fc1c6b0
-
SHA1
043e28f21c9504e936d272b11b2504e358c74da6
-
SHA256
a86c839ca497b110b293d86f86c1174f03d6eb7d1c97e7a4056db21e1d37da48
-
SHA512
8a743ff781ab2f3ec6e5b392bf1da6eaa8a48e76f05baf11bb02bf51d90a2645b2aa0f3a919de85917caf1290c06dcd554920578d45284da2301ef0fe0d67aa8
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxEPOfPrAc:ymb3NkkiQ3mdBjFo73PYP1lri3KuOnrT
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/1708-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1988-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1988-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1812-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1080-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1072-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1944-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1348-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1100-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1984-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
7vddp.exe3jjvj.exefrxlflf.exepjvpv.exe7lfrflx.exebtntht.exebthntb.exe7dppp.exellflxxl.exexrflxxf.exebnttbt.exe3hbhhn.exedvjpd.exe9fflrxl.exe5bnthh.exetthnbh.exe1dpdj.exevvvjv.exerxxlflx.exe3thntb.exebbthtb.exejjvvd.exe5ffrxlf.exexrflrxf.exe1nbnnt.exeppvjv.exellxfxfr.exe7xlrffx.exentbtnh.exejdpvj.exevpdvv.exexlffllr.exerrlrflf.exehbnntt.exenbnbhh.exe7vpjv.exedvvpd.exe7xllxfl.exerrfflfr.exe3bhnbb.exe9thnnn.exe1jpdj.exejjppv.exerlrfxlr.exexlfrrxl.exenhttbb.exenhbbbb.exepdvpd.exejvdjd.exefxlrxxf.exe1xrxrxf.exetbhnhh.exebthhtn.exedvjpd.exelflrflr.exexrflrxl.exenhbntt.exe5nbbnh.exedvppd.exejdvvv.exexlxfflr.exefxlrffl.exe3bthht.exe5bbhhb.exepid process 1988 7vddp.exe 2772 3jjvj.exe 2636 frxlflf.exe 2640 pjvpv.exe 3036 7lfrflx.exe 2576 btntht.exe 2544 bthntb.exe 2564 7dppp.exe 2952 llflxxl.exe 2784 xrflxxf.exe 2740 bnttbt.exe 1812 3hbhhn.exe 1080 dvjpd.exe 1072 9fflrxl.exe 1944 5bnthh.exe 264 tthnbh.exe 1348 1dpdj.exe 1100 vvvjv.exe 2584 rxxlflx.exe 1088 3thntb.exe 2004 bbthtb.exe 2452 jjvvd.exe 2876 5ffrxlf.exe 1984 xrflrxf.exe 900 1nbnnt.exe 1744 ppvjv.exe 544 llxfxfr.exe 1732 7xlrffx.exe 2364 ntbtnh.exe 1672 jdpvj.exe 2000 vpdvv.exe 2184 xlffllr.exe 2580 rrlrflf.exe 3012 hbnntt.exe 1556 nbnbhh.exe 2696 7vpjv.exe 2856 dvvpd.exe 2672 7xllxfl.exe 2524 rrfflfr.exe 2652 3bhnbb.exe 2576 9thnnn.exe 2544 1jpdj.exe 2076 jjppv.exe 288 rlrfxlr.exe 2788 xlfrrxl.exe 2588 nhttbb.exe 2820 nhbbbb.exe 1084 pdvpd.exe 1476 jvdjd.exe 1788 fxlrxxf.exe 1072 1xrxrxf.exe 1612 tbhnhh.exe 344 bthhtn.exe 756 dvjpd.exe 1664 lflrflr.exe 1124 xrflrxl.exe 2584 nhbntt.exe 1940 5nbbnh.exe 2088 dvppd.exe 2308 jdvvv.exe 1948 xlxfflr.exe 1796 fxlrffl.exe 908 3bthht.exe 2072 5bbhhb.exe -
Processes:
resource yara_rule behavioral1/memory/1708-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1988-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1812-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1080-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1072-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1944-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1348-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1100-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1984-235-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
da82ba94ef5606324cf310950fc1c6b0_NeikiAnalytics.exe7vddp.exe3jjvj.exefrxlflf.exepjvpv.exe7lfrflx.exebtntht.exebthntb.exe7dppp.exellflxxl.exexrflxxf.exebnttbt.exe3hbhhn.exedvjpd.exe9fflrxl.exe5bnthh.exedescription pid process target process PID 1708 wrote to memory of 1988 1708 da82ba94ef5606324cf310950fc1c6b0_NeikiAnalytics.exe 7vddp.exe PID 1708 wrote to memory of 1988 1708 da82ba94ef5606324cf310950fc1c6b0_NeikiAnalytics.exe 7vddp.exe PID 1708 wrote to memory of 1988 1708 da82ba94ef5606324cf310950fc1c6b0_NeikiAnalytics.exe 7vddp.exe PID 1708 wrote to memory of 1988 1708 da82ba94ef5606324cf310950fc1c6b0_NeikiAnalytics.exe 7vddp.exe PID 1988 wrote to memory of 2772 1988 7vddp.exe 3jjvj.exe PID 1988 wrote to memory of 2772 1988 7vddp.exe 3jjvj.exe PID 1988 wrote to memory of 2772 1988 7vddp.exe 3jjvj.exe PID 1988 wrote to memory of 2772 1988 7vddp.exe 3jjvj.exe PID 2772 wrote to memory of 2636 2772 3jjvj.exe frxlflf.exe PID 2772 wrote to memory of 2636 2772 3jjvj.exe frxlflf.exe PID 2772 wrote to memory of 2636 2772 3jjvj.exe frxlflf.exe PID 2772 wrote to memory of 2636 2772 3jjvj.exe frxlflf.exe PID 2636 wrote to memory of 2640 2636 frxlflf.exe pjvpv.exe PID 2636 wrote to memory of 2640 2636 frxlflf.exe pjvpv.exe PID 2636 wrote to memory of 2640 2636 frxlflf.exe pjvpv.exe PID 2636 wrote to memory of 2640 2636 frxlflf.exe pjvpv.exe PID 2640 wrote to memory of 3036 2640 pjvpv.exe 7lfrflx.exe PID 2640 wrote to memory of 3036 2640 pjvpv.exe 7lfrflx.exe PID 2640 wrote to memory of 3036 2640 pjvpv.exe 7lfrflx.exe PID 2640 wrote to memory of 3036 2640 pjvpv.exe 7lfrflx.exe PID 3036 wrote to memory of 2576 3036 7lfrflx.exe btntht.exe PID 3036 wrote to memory of 2576 3036 7lfrflx.exe btntht.exe PID 3036 wrote to memory of 2576 3036 7lfrflx.exe btntht.exe PID 3036 wrote to memory of 2576 3036 7lfrflx.exe btntht.exe PID 2576 wrote to memory of 2544 2576 btntht.exe bthntb.exe PID 2576 wrote to memory of 2544 2576 btntht.exe bthntb.exe PID 2576 wrote to memory of 2544 2576 btntht.exe bthntb.exe PID 2576 wrote to memory of 2544 2576 btntht.exe bthntb.exe PID 2544 wrote to memory of 2564 2544 bthntb.exe 7dppp.exe PID 2544 wrote to memory of 2564 2544 bthntb.exe 7dppp.exe PID 2544 wrote to memory of 2564 2544 bthntb.exe 7dppp.exe PID 2544 wrote to memory of 2564 2544 bthntb.exe 7dppp.exe PID 2564 wrote to memory of 2952 2564 7dppp.exe llflxxl.exe PID 2564 wrote to memory of 2952 2564 7dppp.exe llflxxl.exe PID 2564 wrote to memory of 2952 2564 7dppp.exe llflxxl.exe PID 2564 wrote to memory of 2952 2564 7dppp.exe llflxxl.exe PID 2952 wrote to memory of 2784 2952 llflxxl.exe xrflxxf.exe PID 2952 wrote to memory of 2784 2952 llflxxl.exe xrflxxf.exe PID 2952 wrote to memory of 2784 2952 llflxxl.exe xrflxxf.exe PID 2952 wrote to memory of 2784 2952 llflxxl.exe xrflxxf.exe PID 2784 wrote to memory of 2740 2784 xrflxxf.exe bnttbt.exe PID 2784 wrote to memory of 2740 2784 xrflxxf.exe bnttbt.exe PID 2784 wrote to memory of 2740 2784 xrflxxf.exe bnttbt.exe PID 2784 wrote to memory of 2740 2784 xrflxxf.exe bnttbt.exe PID 2740 wrote to memory of 1812 2740 bnttbt.exe 3hbhhn.exe PID 2740 wrote to memory of 1812 2740 bnttbt.exe 3hbhhn.exe PID 2740 wrote to memory of 1812 2740 bnttbt.exe 3hbhhn.exe PID 2740 wrote to memory of 1812 2740 bnttbt.exe 3hbhhn.exe PID 1812 wrote to memory of 1080 1812 3hbhhn.exe dvjpd.exe PID 1812 wrote to memory of 1080 1812 3hbhhn.exe dvjpd.exe PID 1812 wrote to memory of 1080 1812 3hbhhn.exe dvjpd.exe PID 1812 wrote to memory of 1080 1812 3hbhhn.exe dvjpd.exe PID 1080 wrote to memory of 1072 1080 dvjpd.exe 9fflrxl.exe PID 1080 wrote to memory of 1072 1080 dvjpd.exe 9fflrxl.exe PID 1080 wrote to memory of 1072 1080 dvjpd.exe 9fflrxl.exe PID 1080 wrote to memory of 1072 1080 dvjpd.exe 9fflrxl.exe PID 1072 wrote to memory of 1944 1072 9fflrxl.exe 5bnthh.exe PID 1072 wrote to memory of 1944 1072 9fflrxl.exe 5bnthh.exe PID 1072 wrote to memory of 1944 1072 9fflrxl.exe 5bnthh.exe PID 1072 wrote to memory of 1944 1072 9fflrxl.exe 5bnthh.exe PID 1944 wrote to memory of 264 1944 5bnthh.exe tthnbh.exe PID 1944 wrote to memory of 264 1944 5bnthh.exe tthnbh.exe PID 1944 wrote to memory of 264 1944 5bnthh.exe tthnbh.exe PID 1944 wrote to memory of 264 1944 5bnthh.exe tthnbh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\da82ba94ef5606324cf310950fc1c6b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\da82ba94ef5606324cf310950fc1c6b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\7vddp.exec:\7vddp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\3jjvj.exec:\3jjvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\frxlflf.exec:\frxlflf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\pjvpv.exec:\pjvpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\7lfrflx.exec:\7lfrflx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\btntht.exec:\btntht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\bthntb.exec:\bthntb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\7dppp.exec:\7dppp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\llflxxl.exec:\llflxxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\xrflxxf.exec:\xrflxxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\bnttbt.exec:\bnttbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\3hbhhn.exec:\3hbhhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\dvjpd.exec:\dvjpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\9fflrxl.exec:\9fflrxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\5bnthh.exec:\5bnthh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\tthnbh.exec:\tthnbh.exe17⤵
- Executes dropped EXE
PID:264 -
\??\c:\1dpdj.exec:\1dpdj.exe18⤵
- Executes dropped EXE
PID:1348 -
\??\c:\vvvjv.exec:\vvvjv.exe19⤵
- Executes dropped EXE
PID:1100 -
\??\c:\rxxlflx.exec:\rxxlflx.exe20⤵
- Executes dropped EXE
PID:2584 -
\??\c:\3thntb.exec:\3thntb.exe21⤵
- Executes dropped EXE
PID:1088 -
\??\c:\bbthtb.exec:\bbthtb.exe22⤵
- Executes dropped EXE
PID:2004 -
\??\c:\jjvvd.exec:\jjvvd.exe23⤵
- Executes dropped EXE
PID:2452 -
\??\c:\5ffrxlf.exec:\5ffrxlf.exe24⤵
- Executes dropped EXE
PID:2876 -
\??\c:\xrflrxf.exec:\xrflrxf.exe25⤵
- Executes dropped EXE
PID:1984 -
\??\c:\1nbnnt.exec:\1nbnnt.exe26⤵
- Executes dropped EXE
PID:900 -
\??\c:\ppvjv.exec:\ppvjv.exe27⤵
- Executes dropped EXE
PID:1744 -
\??\c:\llxfxfr.exec:\llxfxfr.exe28⤵
- Executes dropped EXE
PID:544 -
\??\c:\7xlrffx.exec:\7xlrffx.exe29⤵
- Executes dropped EXE
PID:1732 -
\??\c:\ntbtnh.exec:\ntbtnh.exe30⤵
- Executes dropped EXE
PID:2364 -
\??\c:\jdpvj.exec:\jdpvj.exe31⤵
- Executes dropped EXE
PID:1672 -
\??\c:\vpdvv.exec:\vpdvv.exe32⤵
- Executes dropped EXE
PID:2000 -
\??\c:\xlffllr.exec:\xlffllr.exe33⤵
- Executes dropped EXE
PID:2184 -
\??\c:\rrlrflf.exec:\rrlrflf.exe34⤵
- Executes dropped EXE
PID:2580 -
\??\c:\hbnntt.exec:\hbnntt.exe35⤵
- Executes dropped EXE
PID:3012 -
\??\c:\nbnbhh.exec:\nbnbhh.exe36⤵
- Executes dropped EXE
PID:1556 -
\??\c:\7vpjv.exec:\7vpjv.exe37⤵
- Executes dropped EXE
PID:2696 -
\??\c:\dvvpd.exec:\dvvpd.exe38⤵
- Executes dropped EXE
PID:2856 -
\??\c:\7xllxfl.exec:\7xllxfl.exe39⤵
- Executes dropped EXE
PID:2672 -
\??\c:\rrfflfr.exec:\rrfflfr.exe40⤵
- Executes dropped EXE
PID:2524 -
\??\c:\3bhnbb.exec:\3bhnbb.exe41⤵
- Executes dropped EXE
PID:2652 -
\??\c:\9thnnn.exec:\9thnnn.exe42⤵
- Executes dropped EXE
PID:2576 -
\??\c:\1jpdj.exec:\1jpdj.exe43⤵
- Executes dropped EXE
PID:2544 -
\??\c:\jjppv.exec:\jjppv.exe44⤵
- Executes dropped EXE
PID:2076 -
\??\c:\rlrfxlr.exec:\rlrfxlr.exe45⤵
- Executes dropped EXE
PID:288 -
\??\c:\xlfrrxl.exec:\xlfrrxl.exe46⤵
- Executes dropped EXE
PID:2788 -
\??\c:\nhttbb.exec:\nhttbb.exe47⤵
- Executes dropped EXE
PID:2588 -
\??\c:\nhbbbb.exec:\nhbbbb.exe48⤵
- Executes dropped EXE
PID:2820 -
\??\c:\pdvpd.exec:\pdvpd.exe49⤵
- Executes dropped EXE
PID:1084 -
\??\c:\jvdjd.exec:\jvdjd.exe50⤵
- Executes dropped EXE
PID:1476 -
\??\c:\fxlrxxf.exec:\fxlrxxf.exe51⤵
- Executes dropped EXE
PID:1788 -
\??\c:\1xrxrxf.exec:\1xrxrxf.exe52⤵
- Executes dropped EXE
PID:1072 -
\??\c:\tbhnhh.exec:\tbhnhh.exe53⤵
- Executes dropped EXE
PID:1612 -
\??\c:\bthhtn.exec:\bthhtn.exe54⤵
- Executes dropped EXE
PID:344 -
\??\c:\dvjpd.exec:\dvjpd.exe55⤵
- Executes dropped EXE
PID:756 -
\??\c:\lflrflr.exec:\lflrflr.exe56⤵
- Executes dropped EXE
PID:1664 -
\??\c:\xrflrxl.exec:\xrflrxl.exe57⤵
- Executes dropped EXE
PID:1124 -
\??\c:\nhbntt.exec:\nhbntt.exe58⤵
- Executes dropped EXE
PID:2584 -
\??\c:\5nbbnh.exec:\5nbbnh.exe59⤵
- Executes dropped EXE
PID:1940 -
\??\c:\dvppd.exec:\dvppd.exe60⤵
- Executes dropped EXE
PID:2088 -
\??\c:\jdvvv.exec:\jdvvv.exe61⤵
- Executes dropped EXE
PID:2308 -
\??\c:\xlxfflr.exec:\xlxfflr.exe62⤵
- Executes dropped EXE
PID:1948 -
\??\c:\fxlrffl.exec:\fxlrffl.exe63⤵
- Executes dropped EXE
PID:1796 -
\??\c:\3bthht.exec:\3bthht.exe64⤵
- Executes dropped EXE
PID:908 -
\??\c:\5bbhhb.exec:\5bbhhb.exe65⤵
- Executes dropped EXE
PID:2072 -
\??\c:\5jjvv.exec:\5jjvv.exe66⤵PID:340
-
\??\c:\pdvdj.exec:\pdvdj.exe67⤵PID:596
-
\??\c:\rlrxrxf.exec:\rlrxrxf.exe68⤵PID:544
-
\??\c:\3frlrxx.exec:\3frlrxx.exe69⤵PID:284
-
\??\c:\btbbhh.exec:\btbbhh.exe70⤵PID:2768
-
\??\c:\7tttbb.exec:\7tttbb.exe71⤵PID:1592
-
\??\c:\dvddp.exec:\dvddp.exe72⤵PID:1428
-
\??\c:\vpppv.exec:\vpppv.exe73⤵PID:1644
-
\??\c:\pdppv.exec:\pdppv.exe74⤵PID:1972
-
\??\c:\9rllrrx.exec:\9rllrrx.exe75⤵PID:2376
-
\??\c:\fxffllx.exec:\fxffllx.exe76⤵PID:2628
-
\??\c:\9btthb.exec:\9btthb.exe77⤵PID:2772
-
\??\c:\tnhnbt.exec:\tnhnbt.exe78⤵PID:2752
-
\??\c:\jdjjd.exec:\jdjjd.exe79⤵PID:2612
-
\??\c:\1vvjp.exec:\1vvjp.exe80⤵PID:2748
-
\??\c:\5lxffrr.exec:\5lxffrr.exe81⤵PID:2516
-
\??\c:\xxffxxf.exec:\xxffxxf.exe82⤵PID:2484
-
\??\c:\hhbhnn.exec:\hhbhnn.exe83⤵PID:2492
-
\??\c:\hthhnn.exec:\hthhnn.exe84⤵PID:2104
-
\??\c:\dvvdj.exec:\dvvdj.exe85⤵PID:2936
-
\??\c:\3jddj.exec:\3jddj.exe86⤵PID:2776
-
\??\c:\xrllxxf.exec:\xrllxxf.exe87⤵PID:2800
-
\??\c:\xrffrll.exec:\xrffrll.exe88⤵PID:2912
-
\??\c:\5xrrffl.exec:\5xrrffl.exe89⤵PID:2740
-
\??\c:\1bttbb.exec:\1bttbb.exe90⤵PID:1608
-
\??\c:\hhthtb.exec:\hhthtb.exe91⤵PID:1880
-
\??\c:\vvjpd.exec:\vvjpd.exe92⤵PID:1588
-
\??\c:\ppjpd.exec:\ppjpd.exe93⤵PID:2224
-
\??\c:\9rlfxxl.exec:\9rlfxxl.exe94⤵PID:1228
-
\??\c:\xxrfrxl.exec:\xxrfrxl.exe95⤵PID:580
-
\??\c:\bttthh.exec:\bttthh.exe96⤵PID:2208
-
\??\c:\ntnntn.exec:\ntnntn.exe97⤵PID:1180
-
\??\c:\vvpvd.exec:\vvpvd.exe98⤵PID:1756
-
\??\c:\3dpvv.exec:\3dpvv.exe99⤵PID:2268
-
\??\c:\7lffllr.exec:\7lffllr.exe100⤵PID:1928
-
\??\c:\5rlflfr.exec:\5rlflfr.exe101⤵PID:2872
-
\??\c:\7nbnbn.exec:\7nbnbn.exe102⤵PID:2280
-
\??\c:\nhntbb.exec:\nhntbb.exe103⤵PID:2256
-
\??\c:\ttbbbb.exec:\ttbbbb.exe104⤵PID:1984
-
\??\c:\vjdvj.exec:\vjdvj.exe105⤵PID:3068
-
\??\c:\jdvvd.exec:\jdvvd.exe106⤵PID:828
-
\??\c:\7rlfllr.exec:\7rlfllr.exe107⤵PID:1800
-
\??\c:\xrxlxlr.exec:\xrxlxlr.exe108⤵PID:2116
-
\??\c:\hbnntt.exec:\hbnntt.exe109⤵PID:2060
-
\??\c:\bbtbhn.exec:\bbtbhn.exe110⤵PID:2196
-
\??\c:\jjdjv.exec:\jjdjv.exe111⤵PID:2896
-
\??\c:\ddvpv.exec:\ddvpv.exe112⤵PID:1872
-
\??\c:\xxrxxll.exec:\xxrxxll.exe113⤵PID:2100
-
\??\c:\xxxxfll.exec:\xxxxfll.exe114⤵PID:2184
-
\??\c:\hbnnbb.exec:\hbnnbb.exe115⤵PID:2180
-
\??\c:\hbnbhh.exec:\hbnbhh.exe116⤵PID:3012
-
\??\c:\jjpdv.exec:\jjpdv.exe117⤵PID:2596
-
\??\c:\ppdpv.exec:\ppdpv.exe118⤵PID:2696
-
\??\c:\1rfxflr.exec:\1rfxflr.exe119⤵PID:2704
-
\??\c:\rxxfxfx.exec:\rxxfxfx.exe120⤵PID:2672
-
\??\c:\nhnntt.exec:\nhnntt.exe121⤵PID:2852
-
\??\c:\btnntt.exec:\btnntt.exe122⤵PID:2652
-
\??\c:\ddpvp.exec:\ddpvp.exe123⤵PID:2200
-
\??\c:\dpjpv.exec:\dpjpv.exe124⤵PID:2544
-
\??\c:\frffrxf.exec:\frffrxf.exe125⤵PID:2536
-
\??\c:\lfrlrfr.exec:\lfrlrfr.exe126⤵PID:288
-
\??\c:\hbnbhh.exec:\hbnbhh.exe127⤵PID:2804
-
\??\c:\bbntnn.exec:\bbntnn.exe128⤵PID:2588
-
\??\c:\ddpdj.exec:\ddpdj.exe129⤵PID:2784
-
\??\c:\vpvvd.exec:\vpvvd.exe130⤵PID:1084
-
\??\c:\xrxxxrf.exec:\xrxxxrf.exe131⤵PID:1608
-
\??\c:\fxffrrf.exec:\fxffrrf.exe132⤵PID:1788
-
\??\c:\xxrxfff.exec:\xxrxfff.exe133⤵PID:1856
-
\??\c:\1bnhhn.exec:\1bnhhn.exe134⤵PID:1612
-
\??\c:\3nthtb.exec:\3nthtb.exe135⤵PID:344
-
\??\c:\dvpdp.exec:\dvpdp.exe136⤵PID:756
-
\??\c:\xrllrlf.exec:\xrllrlf.exe137⤵PID:1280
-
\??\c:\7frlllr.exec:\7frlllr.exe138⤵PID:1124
-
\??\c:\rlxxlrl.exec:\rlxxlrl.exe139⤵PID:844
-
\??\c:\nnhntb.exec:\nnhntb.exe140⤵PID:2260
-
\??\c:\bntnbt.exec:\bntnbt.exe141⤵PID:2292
-
\??\c:\7jdpd.exec:\7jdpd.exe142⤵PID:2308
-
\??\c:\pdpvp.exec:\pdpvp.exe143⤵PID:2340
-
\??\c:\rrxlflf.exec:\rrxlflf.exe144⤵PID:1796
-
\??\c:\rlflxfr.exec:\rlflxfr.exe145⤵PID:1604
-
\??\c:\hbbhnn.exec:\hbbhnn.exe146⤵PID:2072
-
\??\c:\9hbbbb.exec:\9hbbbb.exe147⤵PID:1156
-
\??\c:\pdjjj.exec:\pdjjj.exe148⤵PID:596
-
\??\c:\xxlrxxl.exec:\xxlrxxl.exe149⤵PID:1876
-
\??\c:\lfxlxlx.exec:\lfxlxlx.exe150⤵PID:284
-
\??\c:\thnntt.exec:\thnntt.exe151⤵PID:2836
-
\??\c:\hbhbbb.exec:\hbhbbb.exe152⤵PID:1592
-
\??\c:\vvjjv.exec:\vvjjv.exe153⤵PID:2988
-
\??\c:\lfrlxfr.exec:\lfrlxfr.exe154⤵PID:1644
-
\??\c:\rrlxffr.exec:\rrlxffr.exe155⤵PID:1708
-
\??\c:\ttbtnn.exec:\ttbtnn.exe156⤵PID:2376
-
\??\c:\nnhbhh.exec:\nnhbhh.exe157⤵PID:2580
-
\??\c:\jdppj.exec:\jdppj.exe158⤵PID:2772
-
\??\c:\3jddp.exec:\3jddp.exe159⤵PID:2716
-
\??\c:\9fffrxl.exec:\9fffrxl.exe160⤵PID:2612
-
\??\c:\frxlfxr.exec:\frxlfxr.exe161⤵PID:2672
-
\??\c:\tntbbb.exec:\tntbbb.exe162⤵PID:2524
-
\??\c:\tnthbh.exec:\tnthbh.exe163⤵PID:2508
-
\??\c:\5dvdj.exec:\5dvdj.exe164⤵PID:2492
-
\??\c:\3ddjp.exec:\3ddjp.exe165⤵PID:1852
-
\??\c:\dvvvp.exec:\dvvvp.exe166⤵PID:2076
-
\??\c:\xrffllr.exec:\xrffllr.exe167⤵PID:2808
-
\??\c:\5rllrrf.exec:\5rllrrf.exe168⤵PID:2800
-
\??\c:\hthhhh.exec:\hthhhh.exe169⤵PID:2788
-
\??\c:\3tnttt.exec:\3tnttt.exe170⤵PID:2740
-
\??\c:\vpjvj.exec:\vpjvj.exe171⤵PID:2820
-
\??\c:\pdjjp.exec:\pdjjp.exe172⤵PID:1880
-
\??\c:\fxxrflr.exec:\fxxrflr.exe173⤵PID:1588
-
\??\c:\rrflrxx.exec:\rrflrxx.exe174⤵PID:2224
-
\??\c:\nbnntn.exec:\nbnntn.exe175⤵PID:1228
-
\??\c:\tnbbhn.exec:\tnbbhn.exe176⤵PID:580
-
\??\c:\pjpjj.exec:\pjpjj.exe177⤵PID:856
-
\??\c:\jdvdv.exec:\jdvdv.exe178⤵PID:1180
-
\??\c:\ffrlffl.exec:\ffrlffl.exe179⤵PID:2584
-
\??\c:\rlxfrxl.exec:\rlxfrxl.exe180⤵PID:2276
-
\??\c:\btbhnt.exec:\btbhnt.exe181⤵PID:2324
-
\??\c:\tnhntb.exec:\tnhntb.exe182⤵PID:2872
-
\??\c:\jjpvv.exec:\jjpvv.exe183⤵PID:772
-
\??\c:\pjvvj.exec:\pjvvj.exe184⤵PID:1912
-
\??\c:\rlrxllr.exec:\rlrxllr.exe185⤵PID:2352
-
\??\c:\rrllxlx.exec:\rrllxlx.exe186⤵PID:3068
-
\??\c:\nhhhbb.exec:\nhhhbb.exe187⤵PID:908
-
\??\c:\tntthh.exec:\tntthh.exe188⤵PID:1800
-
\??\c:\hbbtnt.exec:\hbbtnt.exe189⤵PID:888
-
\??\c:\ddppv.exec:\ddppv.exe190⤵PID:2060
-
\??\c:\jddpd.exec:\jddpd.exe191⤵PID:544
-
\??\c:\llxxlrx.exec:\llxxlrx.exe192⤵PID:2896
-
\??\c:\1lxxllx.exec:\1lxxllx.exe193⤵PID:2036
-
\??\c:\7btbnn.exec:\7btbnn.exe194⤵PID:2100
-
\??\c:\btbbnt.exec:\btbbnt.exe195⤵PID:1428
-
\??\c:\jvjvd.exec:\jvjvd.exe196⤵PID:2180
-
\??\c:\jdpvd.exec:\jdpvd.exe197⤵PID:1972
-
\??\c:\rlllxxl.exec:\rlllxxl.exe198⤵PID:2596
-
\??\c:\5rlrxfl.exec:\5rlrxfl.exe199⤵PID:2628
-
\??\c:\bbntht.exec:\bbntht.exe200⤵PID:2704
-
\??\c:\tnbtbb.exec:\tnbtbb.exe201⤵PID:2660
-
\??\c:\vvjdd.exec:\vvjdd.exe202⤵PID:2852
-
\??\c:\9dvdp.exec:\9dvdp.exe203⤵PID:2748
-
\??\c:\rfrrxxl.exec:\rfrrxxl.exe204⤵PID:2200
-
\??\c:\1frflfl.exec:\1frflfl.exe205⤵PID:2932
-
\??\c:\hbbtbt.exec:\hbbtbt.exe206⤵PID:2536
-
\??\c:\9bnnhn.exec:\9bnnhn.exe207⤵PID:2104
-
\??\c:\pjvvv.exec:\pjvvv.exe208⤵PID:2804
-
\??\c:\1xrrffr.exec:\1xrrffr.exe209⤵PID:1804
-
\??\c:\nbnthh.exec:\nbnthh.exe210⤵PID:2784
-
\??\c:\bbbbnt.exec:\bbbbnt.exe211⤵PID:2912
-
\??\c:\dvjjd.exec:\dvjjd.exe212⤵PID:1084
-
\??\c:\rllfrrf.exec:\rllfrrf.exe213⤵PID:660
-
\??\c:\xrffffr.exec:\xrffffr.exe214⤵PID:1588
-
\??\c:\tnbbhh.exec:\tnbbhh.exe215⤵PID:2224
-
\??\c:\vpjjj.exec:\vpjjj.exe216⤵PID:1452
-
\??\c:\xrlfrrl.exec:\xrlfrrl.exe217⤵PID:580
-
\??\c:\xrrrffl.exec:\xrrrffl.exe218⤵PID:1932
-
\??\c:\nbhhnh.exec:\nbhhnh.exe219⤵PID:2208
-
\??\c:\btbbhb.exec:\btbbhb.exe220⤵PID:1664
-
\??\c:\jdpjd.exec:\jdpjd.exe221⤵PID:2276
-
\??\c:\frlrrxl.exec:\frlrrxl.exe222⤵PID:1940
-
\??\c:\fxrxlfl.exec:\fxrxlfl.exe223⤵PID:2872
-
\??\c:\9nttbn.exec:\9nttbn.exe224⤵PID:2088
-
\??\c:\tnbhhh.exec:\tnbhhh.exe225⤵PID:2256
-
\??\c:\dpvvv.exec:\dpvvv.exe226⤵PID:2352
-
\??\c:\vjvjp.exec:\vjvjp.exe227⤵PID:1984
-
\??\c:\xrrrlrx.exec:\xrrrlrx.exe228⤵PID:908
-
\??\c:\9lxffxf.exec:\9lxffxf.exe229⤵PID:2296
-
\??\c:\nbtttt.exec:\nbtttt.exe230⤵PID:596
-
\??\c:\tbhnnb.exec:\tbhnnb.exe231⤵PID:2060
-
\??\c:\vpvvd.exec:\vpvvd.exe232⤵PID:284
-
\??\c:\vpvvd.exec:\vpvvd.exe233⤵PID:1592
-
\??\c:\fxlxfrf.exec:\fxlxfrf.exe234⤵PID:2216
-
\??\c:\xrrrrrf.exec:\xrrrrrf.exe235⤵PID:2676
-
\??\c:\nthbbb.exec:\nthbbb.exe236⤵PID:1560
-
\??\c:\7nttht.exec:\7nttht.exe237⤵PID:1708
-
\??\c:\5dvpp.exec:\5dvpp.exe238⤵PID:2760
-
\??\c:\fxrflxf.exec:\fxrflxf.exe239⤵PID:2732
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe240⤵PID:2604
-
\??\c:\thhbbb.exec:\thhbbb.exe241⤵PID:2976
-
\??\c:\1bnbhh.exec:\1bnbhh.exe242⤵PID:2600