Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 14:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d7cfaa175b9665062d9390403948c3d0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
d7cfaa175b9665062d9390403948c3d0_NeikiAnalytics.exe
-
Size
55KB
-
MD5
d7cfaa175b9665062d9390403948c3d0
-
SHA1
dd705e7c50150361fec2a5f7a5d2164d8dc834c5
-
SHA256
7f13963b7296a6f96dc5d95b2d5889319dabba0cbef9af1d830a2bbb1a7c9006
-
SHA512
13a9956d024f1489d7895bca76e94706724cea866536bc5ce3dbafa65ab85486c3e5afb5b1f795a3c71393ae995116506c8e2304f8d82fa11e865e2df29ab07b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIfEB:ymb3NkkiQ3mdBjFIM
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral1/memory/2932-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1936-43-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1936-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-63-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2444-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2420-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1496-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1624-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1360-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1924-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2252-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/784-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vvpjd.exejpdvp.exenthnhb.exenthhtt.exe3dppv.exejpdjj.exerfrlxxf.exetbhnnn.exettnnnb.exe1djjp.exe7rfrrrf.exexlxffrx.exebtnntt.exe3tbttt.exevjddd.exe9dvdj.exexrffffl.exe9fxxflx.exehttthn.exe9nbbbh.exejdddd.exerlrrfxf.exexllfxxf.exethttbb.exebthtbh.exepjppd.exefxlrrll.exe7flffll.exenhbntt.exebbnnhn.exepddvd.exexlrrrrr.exenbhnhh.exedjvjd.exe5vdvp.exe9lxxxxr.exehbnnnb.exenbnnhn.exeppvpv.exe3pdpv.exelxfxxrf.exe7rlrffl.exetnbhhh.exehbthbh.exehbnntb.exevjpvp.exe1xxxfxf.exexlxxfxf.exe3tbbhb.exe1ttttn.exentbhnb.exedppjp.exepdppj.exelflrrlx.exefrrrxrx.exethnthb.exepdjjp.exelfrrrrx.exefxlxfxl.exe9hnhnt.exenbhbhh.exejppdj.exe9jppp.exexrrlllf.exepid process 2908 vvpjd.exe 2616 jpdvp.exe 1936 nthnhb.exe 2704 nthhtt.exe 2444 3dppv.exe 2420 jpdjj.exe 2136 rfrlxxf.exe 2896 tbhnnn.exe 2728 ttnnnb.exe 2760 1djjp.exe 1496 7rfrrrf.exe 1624 xlxffrx.exe 1760 btnntt.exe 2372 3tbttt.exe 1360 vjddd.exe 2040 9dvdj.exe 2016 xrffffl.exe 2248 9fxxflx.exe 1924 httthn.exe 2252 9nbbbh.exe 528 jdddd.exe 784 rlrrfxf.exe 3000 xllfxxf.exe 1132 thttbb.exe 1952 bthtbh.exe 2012 pjppd.exe 1712 fxlrrll.exe 568 7flffll.exe 2120 nhbntt.exe 896 bbnnhn.exe 2060 pddvd.exe 2620 xlrrrrr.exe 1644 nbhnhh.exe 2692 djvjd.exe 2572 5vdvp.exe 2696 9lxxxxr.exe 2680 hbnnnb.exe 1452 nbnnhn.exe 2496 ppvpv.exe 2464 3pdpv.exe 352 lxfxxrf.exe 2408 7rlrffl.exe 2764 tnbhhh.exe 2768 hbthbh.exe 2904 hbnntb.exe 1244 vjpvp.exe 1768 1xxxfxf.exe 2124 xlxxfxf.exe 284 3tbbhb.exe 1252 1ttttn.exe 1176 ntbhnb.exe 1688 dppjp.exe 2024 pdppj.exe 2072 lflrrlx.exe 2828 frrrxrx.exe 1924 thnthb.exe 268 pdjjp.exe 1148 lfrrrrx.exe 2824 fxlxfxl.exe 1448 9hnhnt.exe 2396 nbhbhh.exe 1064 jppdj.exe 2992 9jppp.exe 2092 xrrlllf.exe -
Processes:
resource yara_rule behavioral1/memory/2932-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1936-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1496-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1624-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1360-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2252-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/784-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-230-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d7cfaa175b9665062d9390403948c3d0_NeikiAnalytics.exevvpjd.exejpdvp.exenthnhb.exenthhtt.exe3dppv.exejpdjj.exerfrlxxf.exetbhnnn.exettnnnb.exe1djjp.exe7rfrrrf.exexlxffrx.exebtnntt.exe3tbttt.exevjddd.exedescription pid process target process PID 2932 wrote to memory of 2908 2932 d7cfaa175b9665062d9390403948c3d0_NeikiAnalytics.exe vvpjd.exe PID 2932 wrote to memory of 2908 2932 d7cfaa175b9665062d9390403948c3d0_NeikiAnalytics.exe vvpjd.exe PID 2932 wrote to memory of 2908 2932 d7cfaa175b9665062d9390403948c3d0_NeikiAnalytics.exe vvpjd.exe PID 2932 wrote to memory of 2908 2932 d7cfaa175b9665062d9390403948c3d0_NeikiAnalytics.exe vvpjd.exe PID 2908 wrote to memory of 2616 2908 vvpjd.exe jpdvp.exe PID 2908 wrote to memory of 2616 2908 vvpjd.exe jpdvp.exe PID 2908 wrote to memory of 2616 2908 vvpjd.exe jpdvp.exe PID 2908 wrote to memory of 2616 2908 vvpjd.exe jpdvp.exe PID 2616 wrote to memory of 1936 2616 jpdvp.exe nthnhb.exe PID 2616 wrote to memory of 1936 2616 jpdvp.exe nthnhb.exe PID 2616 wrote to memory of 1936 2616 jpdvp.exe nthnhb.exe PID 2616 wrote to memory of 1936 2616 jpdvp.exe nthnhb.exe PID 1936 wrote to memory of 2704 1936 nthnhb.exe nthhtt.exe PID 1936 wrote to memory of 2704 1936 nthnhb.exe nthhtt.exe PID 1936 wrote to memory of 2704 1936 nthnhb.exe nthhtt.exe PID 1936 wrote to memory of 2704 1936 nthnhb.exe nthhtt.exe PID 2704 wrote to memory of 2444 2704 nthhtt.exe 3dppv.exe PID 2704 wrote to memory of 2444 2704 nthhtt.exe 3dppv.exe PID 2704 wrote to memory of 2444 2704 nthhtt.exe 3dppv.exe PID 2704 wrote to memory of 2444 2704 nthhtt.exe 3dppv.exe PID 2444 wrote to memory of 2420 2444 3dppv.exe jpdjj.exe PID 2444 wrote to memory of 2420 2444 3dppv.exe jpdjj.exe PID 2444 wrote to memory of 2420 2444 3dppv.exe jpdjj.exe PID 2444 wrote to memory of 2420 2444 3dppv.exe jpdjj.exe PID 2420 wrote to memory of 2136 2420 jpdjj.exe rfrlxxf.exe PID 2420 wrote to memory of 2136 2420 jpdjj.exe rfrlxxf.exe PID 2420 wrote to memory of 2136 2420 jpdjj.exe rfrlxxf.exe PID 2420 wrote to memory of 2136 2420 jpdjj.exe rfrlxxf.exe PID 2136 wrote to memory of 2896 2136 rfrlxxf.exe tbhnnn.exe PID 2136 wrote to memory of 2896 2136 rfrlxxf.exe tbhnnn.exe PID 2136 wrote to memory of 2896 2136 rfrlxxf.exe tbhnnn.exe PID 2136 wrote to memory of 2896 2136 rfrlxxf.exe tbhnnn.exe PID 2896 wrote to memory of 2728 2896 tbhnnn.exe ttnnnb.exe PID 2896 wrote to memory of 2728 2896 tbhnnn.exe ttnnnb.exe PID 2896 wrote to memory of 2728 2896 tbhnnn.exe ttnnnb.exe PID 2896 wrote to memory of 2728 2896 tbhnnn.exe ttnnnb.exe PID 2728 wrote to memory of 2760 2728 ttnnnb.exe 1djjp.exe PID 2728 wrote to memory of 2760 2728 ttnnnb.exe 1djjp.exe PID 2728 wrote to memory of 2760 2728 ttnnnb.exe 1djjp.exe PID 2728 wrote to memory of 2760 2728 ttnnnb.exe 1djjp.exe PID 2760 wrote to memory of 1496 2760 1djjp.exe 7rfrrrf.exe PID 2760 wrote to memory of 1496 2760 1djjp.exe 7rfrrrf.exe PID 2760 wrote to memory of 1496 2760 1djjp.exe 7rfrrrf.exe PID 2760 wrote to memory of 1496 2760 1djjp.exe 7rfrrrf.exe PID 1496 wrote to memory of 1624 1496 7rfrrrf.exe xlxffrx.exe PID 1496 wrote to memory of 1624 1496 7rfrrrf.exe xlxffrx.exe PID 1496 wrote to memory of 1624 1496 7rfrrrf.exe xlxffrx.exe PID 1496 wrote to memory of 1624 1496 7rfrrrf.exe xlxffrx.exe PID 1624 wrote to memory of 1760 1624 xlxffrx.exe btnntt.exe PID 1624 wrote to memory of 1760 1624 xlxffrx.exe btnntt.exe PID 1624 wrote to memory of 1760 1624 xlxffrx.exe btnntt.exe PID 1624 wrote to memory of 1760 1624 xlxffrx.exe btnntt.exe PID 1760 wrote to memory of 2372 1760 btnntt.exe 3tbttt.exe PID 1760 wrote to memory of 2372 1760 btnntt.exe 3tbttt.exe PID 1760 wrote to memory of 2372 1760 btnntt.exe 3tbttt.exe PID 1760 wrote to memory of 2372 1760 btnntt.exe 3tbttt.exe PID 2372 wrote to memory of 1360 2372 3tbttt.exe vjddd.exe PID 2372 wrote to memory of 1360 2372 3tbttt.exe vjddd.exe PID 2372 wrote to memory of 1360 2372 3tbttt.exe vjddd.exe PID 2372 wrote to memory of 1360 2372 3tbttt.exe vjddd.exe PID 1360 wrote to memory of 2040 1360 vjddd.exe 9dvdj.exe PID 1360 wrote to memory of 2040 1360 vjddd.exe 9dvdj.exe PID 1360 wrote to memory of 2040 1360 vjddd.exe 9dvdj.exe PID 1360 wrote to memory of 2040 1360 vjddd.exe 9dvdj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7cfaa175b9665062d9390403948c3d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d7cfaa175b9665062d9390403948c3d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\vvpjd.exec:\vvpjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\jpdvp.exec:\jpdvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\nthnhb.exec:\nthnhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\nthhtt.exec:\nthhtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\3dppv.exec:\3dppv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\jpdjj.exec:\jpdjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\rfrlxxf.exec:\rfrlxxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\tbhnnn.exec:\tbhnnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\ttnnnb.exec:\ttnnnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\1djjp.exec:\1djjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\7rfrrrf.exec:\7rfrrrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\xlxffrx.exec:\xlxffrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\btnntt.exec:\btnntt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\3tbttt.exec:\3tbttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\vjddd.exec:\vjddd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\9dvdj.exec:\9dvdj.exe17⤵
- Executes dropped EXE
PID:2040 -
\??\c:\xrffffl.exec:\xrffffl.exe18⤵
- Executes dropped EXE
PID:2016 -
\??\c:\9fxxflx.exec:\9fxxflx.exe19⤵
- Executes dropped EXE
PID:2248 -
\??\c:\httthn.exec:\httthn.exe20⤵
- Executes dropped EXE
PID:1924 -
\??\c:\9nbbbh.exec:\9nbbbh.exe21⤵
- Executes dropped EXE
PID:2252 -
\??\c:\jdddd.exec:\jdddd.exe22⤵
- Executes dropped EXE
PID:528 -
\??\c:\rlrrfxf.exec:\rlrrfxf.exe23⤵
- Executes dropped EXE
PID:784 -
\??\c:\xllfxxf.exec:\xllfxxf.exe24⤵
- Executes dropped EXE
PID:3000 -
\??\c:\thttbb.exec:\thttbb.exe25⤵
- Executes dropped EXE
PID:1132 -
\??\c:\bthtbh.exec:\bthtbh.exe26⤵
- Executes dropped EXE
PID:1952 -
\??\c:\pjppd.exec:\pjppd.exe27⤵
- Executes dropped EXE
PID:2012 -
\??\c:\fxlrrll.exec:\fxlrrll.exe28⤵
- Executes dropped EXE
PID:1712 -
\??\c:\7flffll.exec:\7flffll.exe29⤵
- Executes dropped EXE
PID:568 -
\??\c:\nhbntt.exec:\nhbntt.exe30⤵
- Executes dropped EXE
PID:2120 -
\??\c:\bbnnhn.exec:\bbnnhn.exe31⤵
- Executes dropped EXE
PID:896 -
\??\c:\pddvd.exec:\pddvd.exe32⤵
- Executes dropped EXE
PID:2060 -
\??\c:\frxrrll.exec:\frxrrll.exe33⤵PID:2548
-
\??\c:\xlrrrrr.exec:\xlrrrrr.exe34⤵
- Executes dropped EXE
PID:2620 -
\??\c:\nbhnhh.exec:\nbhnhh.exe35⤵
- Executes dropped EXE
PID:1644 -
\??\c:\djvjd.exec:\djvjd.exe36⤵
- Executes dropped EXE
PID:2692 -
\??\c:\5vdvp.exec:\5vdvp.exe37⤵
- Executes dropped EXE
PID:2572 -
\??\c:\9lxxxxr.exec:\9lxxxxr.exe38⤵
- Executes dropped EXE
PID:2696 -
\??\c:\hbnnnb.exec:\hbnnnb.exe39⤵
- Executes dropped EXE
PID:2680 -
\??\c:\nbnnhn.exec:\nbnnhn.exe40⤵
- Executes dropped EXE
PID:1452 -
\??\c:\ppvpv.exec:\ppvpv.exe41⤵
- Executes dropped EXE
PID:2496 -
\??\c:\3pdpv.exec:\3pdpv.exe42⤵
- Executes dropped EXE
PID:2464 -
\??\c:\lxfxxrf.exec:\lxfxxrf.exe43⤵
- Executes dropped EXE
PID:352 -
\??\c:\7rlrffl.exec:\7rlrffl.exe44⤵
- Executes dropped EXE
PID:2408 -
\??\c:\tnbhhh.exec:\tnbhhh.exe45⤵
- Executes dropped EXE
PID:2764 -
\??\c:\hbthbh.exec:\hbthbh.exe46⤵
- Executes dropped EXE
PID:2768 -
\??\c:\hbnntb.exec:\hbnntb.exe47⤵
- Executes dropped EXE
PID:2904 -
\??\c:\vjpvp.exec:\vjpvp.exe48⤵
- Executes dropped EXE
PID:1244 -
\??\c:\1xxxfxf.exec:\1xxxfxf.exe49⤵
- Executes dropped EXE
PID:1768 -
\??\c:\xlxxfxf.exec:\xlxxfxf.exe50⤵
- Executes dropped EXE
PID:2124 -
\??\c:\3tbbhb.exec:\3tbbhb.exe51⤵
- Executes dropped EXE
PID:284 -
\??\c:\1ttttn.exec:\1ttttn.exe52⤵
- Executes dropped EXE
PID:1252 -
\??\c:\ntbhnb.exec:\ntbhnb.exe53⤵
- Executes dropped EXE
PID:1176 -
\??\c:\dppjp.exec:\dppjp.exe54⤵
- Executes dropped EXE
PID:1688 -
\??\c:\pdppj.exec:\pdppj.exe55⤵
- Executes dropped EXE
PID:2024 -
\??\c:\lflrrlx.exec:\lflrrlx.exe56⤵
- Executes dropped EXE
PID:2072 -
\??\c:\frrrxrx.exec:\frrrxrx.exe57⤵
- Executes dropped EXE
PID:2828 -
\??\c:\thnthb.exec:\thnthb.exe58⤵
- Executes dropped EXE
PID:1924 -
\??\c:\pdjjp.exec:\pdjjp.exe59⤵
- Executes dropped EXE
PID:268 -
\??\c:\lfrrrrx.exec:\lfrrrrx.exe60⤵
- Executes dropped EXE
PID:1148 -
\??\c:\fxlxfxl.exec:\fxlxfxl.exe61⤵
- Executes dropped EXE
PID:2824 -
\??\c:\9hnhnt.exec:\9hnhnt.exe62⤵
- Executes dropped EXE
PID:1448 -
\??\c:\nbhbhh.exec:\nbhbhh.exe63⤵
- Executes dropped EXE
PID:2396 -
\??\c:\jppdj.exec:\jppdj.exe64⤵
- Executes dropped EXE
PID:1064 -
\??\c:\9jppp.exec:\9jppp.exe65⤵
- Executes dropped EXE
PID:2992 -
\??\c:\xrrlllf.exec:\xrrlllf.exe66⤵
- Executes dropped EXE
PID:2092 -
\??\c:\frrrrrx.exec:\frrrrrx.exe67⤵PID:1600
-
\??\c:\5xfxfxf.exec:\5xfxfxf.exe68⤵PID:328
-
\??\c:\tttbtn.exec:\tttbtn.exe69⤵PID:1276
-
\??\c:\dvjpp.exec:\dvjpp.exe70⤵PID:2944
-
\??\c:\jdjpj.exec:\jdjpj.exe71⤵PID:2152
-
\??\c:\vjddj.exec:\vjddj.exe72⤵PID:2740
-
\??\c:\rrfrrfx.exec:\rrfrrfx.exe73⤵PID:2664
-
\??\c:\3xxxxxx.exec:\3xxxxxx.exe74⤵PID:2628
-
\??\c:\tntthh.exec:\tntthh.exe75⤵PID:2560
-
\??\c:\tthhth.exec:\tthhth.exe76⤵PID:1644
-
\??\c:\jpjpp.exec:\jpjpp.exe77⤵PID:2624
-
\??\c:\pjvpp.exec:\pjvpp.exe78⤵PID:2568
-
\??\c:\7lxxxxf.exec:\7lxxxxf.exe79⤵PID:2808
-
\??\c:\1lrxffl.exec:\1lrxffl.exe80⤵PID:2704
-
\??\c:\nnthbh.exec:\nnthbh.exe81⤵PID:1452
-
\??\c:\btbhtb.exec:\btbhtb.exe82⤵PID:2540
-
\??\c:\vjdjj.exec:\vjdjj.exe83⤵PID:2464
-
\??\c:\vjddd.exec:\vjddd.exe84⤵PID:780
-
\??\c:\rlxrxll.exec:\rlxrxll.exe85⤵PID:2408
-
\??\c:\fxffrrr.exec:\fxffrrr.exe86⤵PID:2636
-
\??\c:\1tbtbt.exec:\1tbtbt.exe87⤵PID:1636
-
\??\c:\bhthht.exec:\bhthht.exe88⤵PID:2752
-
\??\c:\dvvvv.exec:\dvvvv.exe89⤵PID:1244
-
\??\c:\vjppj.exec:\vjppj.exe90⤵PID:1752
-
\??\c:\3dpjj.exec:\3dpjj.exe91⤵PID:2124
-
\??\c:\7xxlllr.exec:\7xxlllr.exe92⤵PID:2480
-
\??\c:\lfrxfrx.exec:\lfrxfrx.exe93⤵PID:1252
-
\??\c:\nbhnnh.exec:\nbhnnh.exe94⤵PID:3068
-
\??\c:\htbtnn.exec:\htbtnn.exe95⤵PID:1688
-
\??\c:\bnbhnn.exec:\bnbhnn.exe96⤵PID:1668
-
\??\c:\pjpjj.exec:\pjpjj.exe97⤵PID:2756
-
\??\c:\vpvdp.exec:\vpvdp.exe98⤵PID:1960
-
\??\c:\lfxxxrf.exec:\lfxxxrf.exe99⤵PID:1924
-
\??\c:\llrxxxf.exec:\llrxxxf.exe100⤵PID:528
-
\??\c:\nbnnnh.exec:\nbnnnh.exe101⤵PID:924
-
\??\c:\thttbh.exec:\thttbh.exe102⤵PID:2840
-
\??\c:\dpvvv.exec:\dpvvv.exe103⤵PID:1572
-
\??\c:\vpdvd.exec:\vpdvd.exe104⤵PID:2396
-
\??\c:\lfxffff.exec:\lfxffff.exe105⤵PID:1964
-
\??\c:\1llfffl.exec:\1llfffl.exe106⤵PID:1552
-
\??\c:\1llrxxf.exec:\1llrxxf.exe107⤵PID:2092
-
\??\c:\httthb.exec:\httthb.exe108⤵PID:1744
-
\??\c:\nhhhtb.exec:\nhhhtb.exe109⤵PID:996
-
\??\c:\7jdjj.exec:\7jdjj.exe110⤵PID:2008
-
\??\c:\dpdjp.exec:\dpdjp.exe111⤵PID:2944
-
\??\c:\dpddj.exec:\dpddj.exe112⤵PID:908
-
\??\c:\rrrlrrf.exec:\rrrlrrf.exe113⤵PID:2908
-
\??\c:\xrxflrx.exec:\xrxflrx.exe114⤵PID:2688
-
\??\c:\tttbnt.exec:\tttbnt.exe115⤵PID:2632
-
\??\c:\bbthtt.exec:\bbthtt.exe116⤵PID:2528
-
\??\c:\vjppj.exec:\vjppj.exe117⤵PID:1644
-
\??\c:\ppjpd.exec:\ppjpd.exe118⤵PID:2692
-
\??\c:\7rlllrr.exec:\7rlllrr.exe119⤵PID:2572
-
\??\c:\rrffllx.exec:\rrffllx.exe120⤵PID:2696
-
\??\c:\tnbhtb.exec:\tnbhtb.exe121⤵PID:2444
-
\??\c:\hnbbtn.exec:\hnbbtn.exe122⤵PID:2492
-
\??\c:\vjpdv.exec:\vjpdv.exe123⤵PID:2540
-
\??\c:\pvjvp.exec:\pvjvp.exe124⤵PID:1592
-
\??\c:\fxrxlfr.exec:\fxrxlfr.exe125⤵PID:780
-
\??\c:\rrlrfff.exec:\rrlrfff.exe126⤵PID:2668
-
\??\c:\nhthnt.exec:\nhthnt.exe127⤵PID:2764
-
\??\c:\nbnbhb.exec:\nbnbhb.exe128⤵PID:2900
-
\??\c:\dvvdp.exec:\dvvdp.exe129⤵PID:2752
-
\??\c:\jvjjj.exec:\jvjjj.exe130⤵PID:1508
-
\??\c:\lxllrlf.exec:\lxllrlf.exe131⤵PID:1752
-
\??\c:\lfxfrrx.exec:\lfxfrrx.exe132⤵PID:1256
-
\??\c:\1nnhtb.exec:\1nnhtb.exe133⤵PID:284
-
\??\c:\bbbnbb.exec:\bbbnbb.exe134⤵PID:1216
-
\??\c:\ththnt.exec:\ththnt.exe135⤵PID:3068
-
\??\c:\1pddp.exec:\1pddp.exe136⤵PID:2236
-
\??\c:\dvjpd.exec:\dvjpd.exe137⤵PID:1668
-
\??\c:\xrllxfl.exec:\xrllxfl.exe138⤵PID:2756
-
\??\c:\7btnnh.exec:\7btnnh.exe139⤵PID:1960
-
\??\c:\nhtthh.exec:\nhtthh.exe140⤵PID:2836
-
\??\c:\jdvdj.exec:\jdvdj.exe141⤵PID:528
-
\??\c:\pdpdj.exec:\pdpdj.exe142⤵PID:1148
-
\??\c:\xrfflrx.exec:\xrfflrx.exe143⤵PID:2824
-
\??\c:\rxlfxll.exec:\rxlfxll.exe144⤵PID:240
-
\??\c:\htnbnb.exec:\htnbnb.exe145⤵PID:2396
-
\??\c:\nnnhtb.exec:\nnnhtb.exe146⤵PID:1132
-
\??\c:\bnnhnh.exec:\bnnhnh.exe147⤵PID:1552
-
\??\c:\vvpdd.exec:\vvpdd.exe148⤵PID:1896
-
\??\c:\5dvdp.exec:\5dvdp.exe149⤵PID:1744
-
\??\c:\fxlxxxl.exec:\fxlxxxl.exe150⤵PID:328
-
\??\c:\9flflff.exec:\9flflff.exe151⤵PID:2932
-
\??\c:\bnhhhh.exec:\bnhhhh.exe152⤵PID:1748
-
\??\c:\tttnbb.exec:\tttnbb.exe153⤵PID:908
-
\??\c:\vpdjd.exec:\vpdjd.exe154⤵PID:2740
-
\??\c:\pdvdj.exec:\pdvdj.exe155⤵PID:2688
-
\??\c:\xrfllrr.exec:\xrfllrr.exe156⤵PID:2628
-
\??\c:\7xlxxlr.exec:\7xlxxlr.exe157⤵PID:2528
-
\??\c:\ffrxxlr.exec:\ffrxxlr.exe158⤵PID:2676
-
\??\c:\9nntbb.exec:\9nntbb.exe159⤵PID:2692
-
\??\c:\hhtbhn.exec:\hhtbhn.exe160⤵PID:2568
-
\??\c:\htntbb.exec:\htntbb.exe161⤵PID:2696
-
\??\c:\jvpvj.exec:\jvpvj.exe162⤵PID:2484
-
\??\c:\vpjjj.exec:\vpjjj.exe163⤵PID:2492
-
\??\c:\3frxxff.exec:\3frxxff.exe164⤵PID:2116
-
\??\c:\rfllxrf.exec:\rfllxrf.exe165⤵PID:1592
-
\??\c:\xrlrxxf.exec:\xrlrxxf.exe166⤵PID:2644
-
\??\c:\1btntb.exec:\1btntb.exe167⤵PID:2668
-
\??\c:\nbhnnh.exec:\nbhnnh.exe168⤵PID:2636
-
\??\c:\9nttbb.exec:\9nttbb.exe169⤵PID:1624
-
\??\c:\dppdv.exec:\dppdv.exe170⤵PID:556
-
\??\c:\jdppp.exec:\jdppp.exe171⤵PID:1508
-
\??\c:\llfffrl.exec:\llfffrl.exe172⤵PID:1152
-
\??\c:\lflrrfl.exec:\lflrrfl.exe173⤵PID:1256
-
\??\c:\nhhnhb.exec:\nhhnhb.exe174⤵PID:2480
-
\??\c:\bnbhhn.exec:\bnbhhn.exe175⤵PID:1216
-
\??\c:\nbbtbt.exec:\nbbtbt.exe176⤵PID:3068
-
\??\c:\dvddp.exec:\dvddp.exe177⤵PID:2236
-
\??\c:\dpjpd.exec:\dpjpd.exe178⤵PID:2232
-
\??\c:\1fxrllr.exec:\1fxrllr.exe179⤵PID:2216
-
\??\c:\frxlfll.exec:\frxlfll.exe180⤵PID:1972
-
\??\c:\7bbntt.exec:\7bbntt.exe181⤵PID:1924
-
\??\c:\hbnnnh.exec:\hbnnnh.exe182⤵PID:1808
-
\??\c:\dvvdd.exec:\dvvdd.exe183⤵PID:1148
-
\??\c:\dvjdv.exec:\dvjdv.exe184⤵PID:2840
-
\??\c:\1lfflll.exec:\1lfflll.exe185⤵PID:1572
-
\??\c:\lfrrxxx.exec:\lfrrxxx.exe186⤵PID:1064
-
\??\c:\thhbbt.exec:\thhbbt.exe187⤵PID:1964
-
\??\c:\hntbhb.exec:\hntbhb.exe188⤵PID:1900
-
\??\c:\nhntbb.exec:\nhntbb.exe189⤵PID:2092
-
\??\c:\vvvvp.exec:\vvvvp.exe190⤵PID:1520
-
\??\c:\5pvvd.exec:\5pvvd.exe191⤵PID:328
-
\??\c:\lfrxfxl.exec:\lfrxfxl.exe192⤵PID:1796
-
\??\c:\1frrrlr.exec:\1frrrlr.exe193⤵PID:1748
-
\??\c:\rlxxffl.exec:\rlxxffl.exe194⤵PID:1504
-
\??\c:\7htntt.exec:\7htntt.exe195⤵PID:2908
-
\??\c:\7ntbhb.exec:\7ntbhb.exe196⤵PID:2928
-
\??\c:\vpddd.exec:\vpddd.exe197⤵PID:2628
-
\??\c:\jjdvj.exec:\jjdvj.exe198⤵PID:2812
-
\??\c:\rfxrlrr.exec:\rfxrlrr.exe199⤵PID:2676
-
\??\c:\3rfxfxx.exec:\3rfxfxx.exe200⤵PID:2656
-
\??\c:\7frrrrf.exec:\7frrrrf.exe201⤵PID:2424
-
\??\c:\bnhhhn.exec:\bnhhhn.exe202⤵PID:2452
-
\??\c:\hthhnn.exec:\hthhnn.exe203⤵PID:2484
-
\??\c:\dvdvd.exec:\dvdvd.exe204⤵PID:2640
-
\??\c:\vpdjj.exec:\vpdjj.exe205⤵PID:2784
-
\??\c:\dppjp.exec:\dppjp.exe206⤵PID:2736
-
\??\c:\xllfllr.exec:\xllfllr.exe207⤵PID:2644
-
\??\c:\1xfllrx.exec:\1xfllrx.exe208⤵PID:776
-
\??\c:\rlrrxfl.exec:\rlrrxfl.exe209⤵PID:2900
-
\??\c:\7nhbhh.exec:\7nhbhh.exe210⤵PID:1576
-
\??\c:\tnttth.exec:\tnttth.exe211⤵PID:1244
-
\??\c:\3vjdp.exec:\3vjdp.exe212⤵PID:1364
-
\??\c:\vpdjp.exec:\vpdjp.exe213⤵PID:1152
-
\??\c:\frffffl.exec:\frffffl.exe214⤵PID:2020
-
\??\c:\1frflxx.exec:\1frflxx.exe215⤵PID:2480
-
\??\c:\ttnbnn.exec:\ttnbnn.exe216⤵PID:2016
-
\??\c:\btnntt.exec:\btnntt.exe217⤵PID:3068
-
\??\c:\5hnbnh.exec:\5hnbnh.exe218⤵PID:2772
-
\??\c:\3jdvp.exec:\3jdvp.exe219⤵PID:2232
-
\??\c:\1dvpp.exec:\1dvpp.exe220⤵PID:2756
-
\??\c:\lfllrlf.exec:\lfllrlf.exe221⤵PID:1960
-
\??\c:\lfxrrrx.exec:\lfxrrrx.exe222⤵PID:2392
-
\??\c:\rlrxlrx.exec:\rlrxlrx.exe223⤵PID:1004
-
\??\c:\bnthhh.exec:\bnthhh.exe224⤵PID:1756
-
\??\c:\nhnnnh.exec:\nhnnnh.exe225⤵PID:2840
-
\??\c:\jdpjv.exec:\jdpjv.exe226⤵PID:240
-
\??\c:\rlrlflx.exec:\rlrlflx.exe227⤵PID:1064
-
\??\c:\hbhhtb.exec:\hbhhtb.exe228⤵PID:1132
-
\??\c:\jjvdj.exec:\jjvdj.exe229⤵PID:1900
-
\??\c:\5vdjp.exec:\5vdjp.exe230⤵PID:2092
-
\??\c:\xlxfrll.exec:\xlxfrll.exe231⤵PID:1520
-
\??\c:\rlrflfr.exec:\rlrflfr.exe232⤵PID:2316
-
\??\c:\xxfrxfx.exec:\xxfrxfx.exe233⤵PID:1796
-
\??\c:\bbhtht.exec:\bbhtht.exe234⤵PID:1540
-
\??\c:\9hbbhb.exec:\9hbbhb.exe235⤵PID:2820
-
\??\c:\5jddp.exec:\5jddp.exe236⤵PID:2908
-
\??\c:\pjvvv.exec:\pjvvv.exe237⤵PID:2688
-
\??\c:\jdjvv.exec:\jdjvv.exe238⤵PID:2628
-
\??\c:\rlrrrxl.exec:\rlrrrxl.exe239⤵PID:2556
-
\??\c:\rrffllx.exec:\rrffllx.exe240⤵PID:2676
-
\??\c:\nntthh.exec:\nntthh.exe241⤵PID:2572
-
\??\c:\tnnhhn.exec:\tnnhhn.exe242⤵PID:2424