Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 14:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d85f88f4b1bb117749b203a50f5661a0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
d85f88f4b1bb117749b203a50f5661a0_NeikiAnalytics.exe
-
Size
128KB
-
MD5
d85f88f4b1bb117749b203a50f5661a0
-
SHA1
be9aec9d7eb327a4c94f25ca55e2c57b9bc9e0cc
-
SHA256
a8a98c20f1e25f16f2be197063fd689de49ea950efccfa24a51b7c9065571135
-
SHA512
86b70645ac614be816fceb5b9a95b4ba453082c6cf88b309587bfb4702421bda5c8d8940d36267d185007c125baa37e7262805c4d5c9ca65dff98cbb9c39181b
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afoHvmQ+EZMYX/x6gtn:n3C9BRW0j/uVEZFJvZ
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/1732-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/760-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2092-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/612-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1932-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1816-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2296-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2216-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/324-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/320-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/796-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
nhtbht.exejpddv.exexlflrfl.exebbthtt.exeppjvj.exe5dddd.exe9frfllx.exefxrrxfr.exetnhntb.exeddvjd.exepjvjd.exerlfrxxf.exennhnhh.exehthbnn.exejjdjv.exerlxxffl.exexrlxllf.exennbnth.exe1djvd.exevpjpd.exelfxlxfl.exehbhnbb.exehbntbh.exevvjpv.exelllfrfx.exe3lfrlrx.exehbthnt.exejjdpp.exelfrrlxl.exe7nnthn.exebbnnbh.exevvpdv.exe5frrffl.exeffflxxl.exe1bnhnn.exetnbhnb.exe3djvj.exejjjvv.exerxrxlxl.exexxffffl.exebbnhtt.exe1hhnbb.exehbntbh.exepvvjp.exevvvdp.exerlxxffr.exerlffrrf.exe7bhhth.exe1ttbth.exe1dvjp.exejdjvd.exexlxllrf.exeffxfrrl.exefxffllr.exebthnnt.exetnhntt.exe1vpvj.exevvpdp.exerfrxxfl.exe7xrlxlr.exehhbbbh.exehhbbtb.exehnhhtb.exeppdjd.exepid process 3000 nhtbht.exe 2540 jpddv.exe 2644 xlflrfl.exe 2604 bbthtt.exe 2696 ppjvj.exe 2468 5dddd.exe 760 9frfllx.exe 2524 fxrrxfr.exe 2092 tnhntb.exe 2744 ddvjd.exe 2816 pjvjd.exe 3064 rlfrxxf.exe 612 nnhnhh.exe 272 hthbnn.exe 1932 jjdjv.exe 2756 rlxxffl.exe 1816 xrlxllf.exe 860 nnbnth.exe 2296 1djvd.exe 2860 vpjpd.exe 2216 lfxlxfl.exe 324 hbhnbb.exe 1116 hbntbh.exe 3024 vvjpv.exe 1140 lllfrfx.exe 1252 3lfrlrx.exe 320 hbthnt.exe 2532 jjdpp.exe 1716 lfrrlxl.exe 796 7nnthn.exe 1512 bbnnbh.exe 1788 vvpdv.exe 2888 5frrffl.exe 2372 ffflxxl.exe 2996 1bnhnn.exe 2076 tnbhnb.exe 2596 3djvj.exe 2672 jjjvv.exe 2628 rxrxlxl.exe 2808 xxffffl.exe 2640 bbnhtt.exe 2440 1hhnbb.exe 760 hbntbh.exe 2228 pvvjp.exe 2924 vvvdp.exe 2704 rlxxffr.exe 2912 rlffrrf.exe 2484 7bhhth.exe 880 1ttbth.exe 1552 1dvjp.exe 1524 jdjvd.exe 1432 xlxllrf.exe 2736 ffxfrrl.exe 2772 fxffllr.exe 1332 bthnnt.exe 2052 tnhntt.exe 2120 1vpvj.exe 2428 vvpdp.exe 1736 rfrxxfl.exe 668 7xrlxlr.exe 712 hhbbbh.exe 1480 hhbbtb.exe 544 hnhhtb.exe 1516 ppdjd.exe -
Processes:
resource yara_rule behavioral1/memory/1732-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1732-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/760-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/612-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1932-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1816-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/324-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/320-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/796-290-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d85f88f4b1bb117749b203a50f5661a0_NeikiAnalytics.exenhtbht.exejpddv.exexlflrfl.exebbthtt.exeppjvj.exe5dddd.exe9frfllx.exefxrrxfr.exetnhntb.exeddvjd.exepjvjd.exerlfrxxf.exennhnhh.exehthbnn.exejjdjv.exedescription pid process target process PID 1732 wrote to memory of 3000 1732 d85f88f4b1bb117749b203a50f5661a0_NeikiAnalytics.exe nhtbht.exe PID 1732 wrote to memory of 3000 1732 d85f88f4b1bb117749b203a50f5661a0_NeikiAnalytics.exe nhtbht.exe PID 1732 wrote to memory of 3000 1732 d85f88f4b1bb117749b203a50f5661a0_NeikiAnalytics.exe nhtbht.exe PID 1732 wrote to memory of 3000 1732 d85f88f4b1bb117749b203a50f5661a0_NeikiAnalytics.exe nhtbht.exe PID 3000 wrote to memory of 2540 3000 nhtbht.exe jpddv.exe PID 3000 wrote to memory of 2540 3000 nhtbht.exe jpddv.exe PID 3000 wrote to memory of 2540 3000 nhtbht.exe jpddv.exe PID 3000 wrote to memory of 2540 3000 nhtbht.exe jpddv.exe PID 2540 wrote to memory of 2644 2540 jpddv.exe xlflrfl.exe PID 2540 wrote to memory of 2644 2540 jpddv.exe xlflrfl.exe PID 2540 wrote to memory of 2644 2540 jpddv.exe xlflrfl.exe PID 2540 wrote to memory of 2644 2540 jpddv.exe xlflrfl.exe PID 2644 wrote to memory of 2604 2644 xlflrfl.exe bbthtt.exe PID 2644 wrote to memory of 2604 2644 xlflrfl.exe bbthtt.exe PID 2644 wrote to memory of 2604 2644 xlflrfl.exe bbthtt.exe PID 2644 wrote to memory of 2604 2644 xlflrfl.exe bbthtt.exe PID 2604 wrote to memory of 2696 2604 bbthtt.exe ppjvj.exe PID 2604 wrote to memory of 2696 2604 bbthtt.exe ppjvj.exe PID 2604 wrote to memory of 2696 2604 bbthtt.exe ppjvj.exe PID 2604 wrote to memory of 2696 2604 bbthtt.exe ppjvj.exe PID 2696 wrote to memory of 2468 2696 ppjvj.exe 5dddd.exe PID 2696 wrote to memory of 2468 2696 ppjvj.exe 5dddd.exe PID 2696 wrote to memory of 2468 2696 ppjvj.exe 5dddd.exe PID 2696 wrote to memory of 2468 2696 ppjvj.exe 5dddd.exe PID 2468 wrote to memory of 760 2468 5dddd.exe 9frfllx.exe PID 2468 wrote to memory of 760 2468 5dddd.exe 9frfllx.exe PID 2468 wrote to memory of 760 2468 5dddd.exe 9frfllx.exe PID 2468 wrote to memory of 760 2468 5dddd.exe 9frfllx.exe PID 760 wrote to memory of 2524 760 9frfllx.exe fxrrxfr.exe PID 760 wrote to memory of 2524 760 9frfllx.exe fxrrxfr.exe PID 760 wrote to memory of 2524 760 9frfllx.exe fxrrxfr.exe PID 760 wrote to memory of 2524 760 9frfllx.exe fxrrxfr.exe PID 2524 wrote to memory of 2092 2524 fxrrxfr.exe tnhntb.exe PID 2524 wrote to memory of 2092 2524 fxrrxfr.exe tnhntb.exe PID 2524 wrote to memory of 2092 2524 fxrrxfr.exe tnhntb.exe PID 2524 wrote to memory of 2092 2524 fxrrxfr.exe tnhntb.exe PID 2092 wrote to memory of 2744 2092 tnhntb.exe ddvjd.exe PID 2092 wrote to memory of 2744 2092 tnhntb.exe ddvjd.exe PID 2092 wrote to memory of 2744 2092 tnhntb.exe ddvjd.exe PID 2092 wrote to memory of 2744 2092 tnhntb.exe ddvjd.exe PID 2744 wrote to memory of 2816 2744 ddvjd.exe pjvjd.exe PID 2744 wrote to memory of 2816 2744 ddvjd.exe pjvjd.exe PID 2744 wrote to memory of 2816 2744 ddvjd.exe pjvjd.exe PID 2744 wrote to memory of 2816 2744 ddvjd.exe pjvjd.exe PID 2816 wrote to memory of 3064 2816 pjvjd.exe rlfrxxf.exe PID 2816 wrote to memory of 3064 2816 pjvjd.exe rlfrxxf.exe PID 2816 wrote to memory of 3064 2816 pjvjd.exe rlfrxxf.exe PID 2816 wrote to memory of 3064 2816 pjvjd.exe rlfrxxf.exe PID 3064 wrote to memory of 612 3064 rlfrxxf.exe nnhnhh.exe PID 3064 wrote to memory of 612 3064 rlfrxxf.exe nnhnhh.exe PID 3064 wrote to memory of 612 3064 rlfrxxf.exe nnhnhh.exe PID 3064 wrote to memory of 612 3064 rlfrxxf.exe nnhnhh.exe PID 612 wrote to memory of 272 612 nnhnhh.exe hthbnn.exe PID 612 wrote to memory of 272 612 nnhnhh.exe hthbnn.exe PID 612 wrote to memory of 272 612 nnhnhh.exe hthbnn.exe PID 612 wrote to memory of 272 612 nnhnhh.exe hthbnn.exe PID 272 wrote to memory of 1932 272 hthbnn.exe jjdjv.exe PID 272 wrote to memory of 1932 272 hthbnn.exe jjdjv.exe PID 272 wrote to memory of 1932 272 hthbnn.exe jjdjv.exe PID 272 wrote to memory of 1932 272 hthbnn.exe jjdjv.exe PID 1932 wrote to memory of 2756 1932 jjdjv.exe rlxxffl.exe PID 1932 wrote to memory of 2756 1932 jjdjv.exe rlxxffl.exe PID 1932 wrote to memory of 2756 1932 jjdjv.exe rlxxffl.exe PID 1932 wrote to memory of 2756 1932 jjdjv.exe rlxxffl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d85f88f4b1bb117749b203a50f5661a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d85f88f4b1bb117749b203a50f5661a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\nhtbht.exec:\nhtbht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\jpddv.exec:\jpddv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\xlflrfl.exec:\xlflrfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\bbthtt.exec:\bbthtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\ppjvj.exec:\ppjvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\5dddd.exec:\5dddd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\9frfllx.exec:\9frfllx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\fxrrxfr.exec:\fxrrxfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\tnhntb.exec:\tnhntb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\ddvjd.exec:\ddvjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\pjvjd.exec:\pjvjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\rlfrxxf.exec:\rlfrxxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\nnhnhh.exec:\nnhnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:612 -
\??\c:\hthbnn.exec:\hthbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:272 -
\??\c:\jjdjv.exec:\jjdjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\rlxxffl.exec:\rlxxffl.exe17⤵
- Executes dropped EXE
PID:2756 -
\??\c:\xrlxllf.exec:\xrlxllf.exe18⤵
- Executes dropped EXE
PID:1816 -
\??\c:\nnbnth.exec:\nnbnth.exe19⤵
- Executes dropped EXE
PID:860 -
\??\c:\1djvd.exec:\1djvd.exe20⤵
- Executes dropped EXE
PID:2296 -
\??\c:\vpjpd.exec:\vpjpd.exe21⤵
- Executes dropped EXE
PID:2860 -
\??\c:\lfxlxfl.exec:\lfxlxfl.exe22⤵
- Executes dropped EXE
PID:2216 -
\??\c:\hbhnbb.exec:\hbhnbb.exe23⤵
- Executes dropped EXE
PID:324 -
\??\c:\hbntbh.exec:\hbntbh.exe24⤵
- Executes dropped EXE
PID:1116 -
\??\c:\vvjpv.exec:\vvjpv.exe25⤵
- Executes dropped EXE
PID:3024 -
\??\c:\lllfrfx.exec:\lllfrfx.exe26⤵
- Executes dropped EXE
PID:1140 -
\??\c:\3lfrlrx.exec:\3lfrlrx.exe27⤵
- Executes dropped EXE
PID:1252 -
\??\c:\hbthnt.exec:\hbthnt.exe28⤵
- Executes dropped EXE
PID:320 -
\??\c:\jjdpp.exec:\jjdpp.exe29⤵
- Executes dropped EXE
PID:2532 -
\??\c:\lfrrlxl.exec:\lfrrlxl.exe30⤵
- Executes dropped EXE
PID:1716 -
\??\c:\7nnthn.exec:\7nnthn.exe31⤵
- Executes dropped EXE
PID:796 -
\??\c:\bbnnbh.exec:\bbnnbh.exe32⤵
- Executes dropped EXE
PID:1512 -
\??\c:\vvpdv.exec:\vvpdv.exe33⤵
- Executes dropped EXE
PID:1788 -
\??\c:\5frrffl.exec:\5frrffl.exe34⤵
- Executes dropped EXE
PID:2888 -
\??\c:\ffflxxl.exec:\ffflxxl.exe35⤵
- Executes dropped EXE
PID:2372 -
\??\c:\1bnhnn.exec:\1bnhnn.exe36⤵
- Executes dropped EXE
PID:2996 -
\??\c:\tnbhnb.exec:\tnbhnb.exe37⤵
- Executes dropped EXE
PID:2076 -
\??\c:\3djvj.exec:\3djvj.exe38⤵
- Executes dropped EXE
PID:2596 -
\??\c:\jjjvv.exec:\jjjvv.exe39⤵
- Executes dropped EXE
PID:2672 -
\??\c:\rxrxlxl.exec:\rxrxlxl.exe40⤵
- Executes dropped EXE
PID:2628 -
\??\c:\xxffffl.exec:\xxffffl.exe41⤵
- Executes dropped EXE
PID:2808 -
\??\c:\bbnhtt.exec:\bbnhtt.exe42⤵
- Executes dropped EXE
PID:2640 -
\??\c:\1hhnbb.exec:\1hhnbb.exe43⤵
- Executes dropped EXE
PID:2440 -
\??\c:\hbntbh.exec:\hbntbh.exe44⤵
- Executes dropped EXE
PID:760 -
\??\c:\pvvjp.exec:\pvvjp.exe45⤵
- Executes dropped EXE
PID:2228 -
\??\c:\vvvdp.exec:\vvvdp.exe46⤵
- Executes dropped EXE
PID:2924 -
\??\c:\rlxxffr.exec:\rlxxffr.exe47⤵
- Executes dropped EXE
PID:2704 -
\??\c:\rlffrrf.exec:\rlffrrf.exe48⤵
- Executes dropped EXE
PID:2912 -
\??\c:\7bhhth.exec:\7bhhth.exe49⤵
- Executes dropped EXE
PID:2484 -
\??\c:\1ttbth.exec:\1ttbth.exe50⤵
- Executes dropped EXE
PID:880 -
\??\c:\1dvjp.exec:\1dvjp.exe51⤵
- Executes dropped EXE
PID:1552 -
\??\c:\jdjvd.exec:\jdjvd.exe52⤵
- Executes dropped EXE
PID:1524 -
\??\c:\xlxllrf.exec:\xlxllrf.exe53⤵
- Executes dropped EXE
PID:1432 -
\??\c:\ffxfrrl.exec:\ffxfrrl.exe54⤵
- Executes dropped EXE
PID:2736 -
\??\c:\fxffllr.exec:\fxffllr.exe55⤵
- Executes dropped EXE
PID:2772 -
\??\c:\bthnnt.exec:\bthnnt.exe56⤵
- Executes dropped EXE
PID:1332 -
\??\c:\tnhntt.exec:\tnhntt.exe57⤵
- Executes dropped EXE
PID:2052 -
\??\c:\1vpvj.exec:\1vpvj.exe58⤵
- Executes dropped EXE
PID:2120 -
\??\c:\vvpdp.exec:\vvpdp.exe59⤵
- Executes dropped EXE
PID:2428 -
\??\c:\rfrxxfl.exec:\rfrxxfl.exe60⤵
- Executes dropped EXE
PID:1736 -
\??\c:\7xrlxlr.exec:\7xrlxlr.exe61⤵
- Executes dropped EXE
PID:668 -
\??\c:\hhbbbh.exec:\hhbbbh.exe62⤵
- Executes dropped EXE
PID:712 -
\??\c:\hhbbtb.exec:\hhbbtb.exe63⤵
- Executes dropped EXE
PID:1480 -
\??\c:\hnhhtb.exec:\hnhhtb.exe64⤵
- Executes dropped EXE
PID:544 -
\??\c:\ppdjd.exec:\ppdjd.exe65⤵
- Executes dropped EXE
PID:1516 -
\??\c:\3dvjj.exec:\3dvjj.exe66⤵PID:2248
-
\??\c:\fxlflxf.exec:\fxlflxf.exe67⤵PID:328
-
\??\c:\rlrxfrf.exec:\rlrxfrf.exe68⤵PID:836
-
\??\c:\tbbtth.exec:\tbbtth.exe69⤵PID:2148
-
\??\c:\nnthtt.exec:\nnthtt.exe70⤵PID:2220
-
\??\c:\pdppp.exec:\pdppp.exe71⤵PID:1864
-
\??\c:\dvpjv.exec:\dvpjv.exe72⤵PID:292
-
\??\c:\rlfrxfl.exec:\rlfrxfl.exe73⤵PID:872
-
\??\c:\9lxlrfl.exec:\9lxlrfl.exe74⤵PID:2308
-
\??\c:\bntttt.exec:\bntttt.exe75⤵PID:1248
-
\??\c:\3tntbh.exec:\3tntbh.exe76⤵PID:2112
-
\??\c:\jdpvj.exec:\jdpvj.exe77⤵PID:2372
-
\??\c:\jppjd.exec:\jppjd.exe78⤵PID:2540
-
\??\c:\ffrrllx.exec:\ffrrllx.exe79⤵PID:2076
-
\??\c:\rrxfxxl.exec:\rrxfxxl.exe80⤵PID:2840
-
\??\c:\lllrflx.exec:\lllrflx.exe81⤵PID:2672
-
\??\c:\ttbtnn.exec:\ttbtnn.exe82⤵PID:2628
-
\??\c:\hbbhnb.exec:\hbbhnb.exe83⤵PID:2808
-
\??\c:\pjdjd.exec:\pjdjd.exe84⤵PID:2568
-
\??\c:\vpdjp.exec:\vpdjp.exe85⤵PID:2464
-
\??\c:\rlxlfxr.exec:\rlxlfxr.exe86⤵PID:760
-
\??\c:\tnbhbb.exec:\tnbhbb.exe87⤵PID:2228
-
\??\c:\nnhbnb.exec:\nnhbnb.exe88⤵PID:2812
-
\??\c:\3pvdj.exec:\3pvdj.exe89⤵PID:2324
-
\??\c:\dvpvp.exec:\dvpvp.exe90⤵PID:2912
-
\??\c:\7llrrxf.exec:\7llrrxf.exe91⤵PID:2484
-
\??\c:\fffflfl.exec:\fffflfl.exe92⤵PID:880
-
\??\c:\ffxfrxl.exec:\ffxfrxl.exe93⤵PID:1552
-
\??\c:\bbntbh.exec:\bbntbh.exe94⤵PID:2328
-
\??\c:\nnbnbh.exec:\nnbnbh.exe95⤵PID:1432
-
\??\c:\vpjpd.exec:\vpjpd.exe96⤵PID:1340
-
\??\c:\rlxfrxx.exec:\rlxfrxx.exe97⤵PID:2772
-
\??\c:\5rrrfll.exec:\5rrrfll.exe98⤵PID:1332
-
\??\c:\tnbhbt.exec:\tnbhbt.exe99⤵PID:2052
-
\??\c:\3tnnbt.exec:\3tnnbt.exe100⤵PID:2288
-
\??\c:\vpdjd.exec:\vpdjd.exe101⤵PID:2428
-
\??\c:\1xllxfr.exec:\1xllxfr.exe102⤵PID:1736
-
\??\c:\1flxlrf.exec:\1flxlrf.exe103⤵PID:668
-
\??\c:\nnbnhn.exec:\nnbnhn.exe104⤵PID:828
-
\??\c:\nnbnbb.exec:\nnbnbb.exe105⤵PID:2020
-
\??\c:\ppdjv.exec:\ppdjv.exe106⤵PID:1964
-
\??\c:\pjddp.exec:\pjddp.exe107⤵PID:1516
-
\??\c:\lfrfrxr.exec:\lfrfrxr.exe108⤵PID:1792
-
\??\c:\9xrflrx.exec:\9xrflrx.exe109⤵PID:1676
-
\??\c:\nhntbb.exec:\nhntbb.exe110⤵PID:836
-
\??\c:\1tnhnt.exec:\1tnhnt.exe111⤵PID:2148
-
\??\c:\ddjjv.exec:\ddjjv.exe112⤵PID:1716
-
\??\c:\ffxfrxl.exec:\ffxfrxl.exe113⤵PID:2040
-
\??\c:\ffflllr.exec:\ffflllr.exe114⤵PID:1512
-
\??\c:\nhnbbb.exec:\nhnbbb.exe115⤵PID:1616
-
\??\c:\3thntb.exec:\3thntb.exe116⤵PID:2364
-
\??\c:\7pddv.exec:\7pddv.exe117⤵PID:1248
-
\??\c:\lfrxflr.exec:\lfrxflr.exe118⤵PID:2168
-
\??\c:\1llllxl.exec:\1llllxl.exe119⤵PID:2664
-
\??\c:\hhnbhn.exec:\hhnbhn.exe120⤵PID:2652
-
\??\c:\tnhbnt.exec:\tnhbnt.exe121⤵PID:2076
-
\??\c:\pjvjv.exec:\pjvjv.exe122⤵PID:2800
-
\??\c:\dvddp.exec:\dvddp.exe123⤵PID:2696
-
\??\c:\xxlxlrf.exec:\xxlxlrf.exe124⤵PID:2968
-
\??\c:\xxlfxfr.exec:\xxlfxfr.exe125⤵PID:2808
-
\??\c:\btbhtb.exec:\btbhtb.exe126⤵PID:2456
-
\??\c:\tbnntn.exec:\tbnntn.exe127⤵PID:2464
-
\??\c:\5pdpd.exec:\5pdpd.exe128⤵PID:760
-
\??\c:\1jdjp.exec:\1jdjp.exe129⤵PID:2228
-
\??\c:\lfxlrxf.exec:\lfxlrxf.exe130⤵PID:2784
-
\??\c:\rlxlrxx.exec:\rlxlrxx.exe131⤵PID:2324
-
\??\c:\nntthh.exec:\nntthh.exe132⤵PID:1928
-
\??\c:\hhhnnb.exec:\hhhnnb.exe133⤵PID:3064
-
\??\c:\9pvvd.exec:\9pvvd.exe134⤵PID:1624
-
\??\c:\9dvdv.exec:\9dvdv.exe135⤵PID:1552
-
\??\c:\xrrrxfr.exec:\xrrrxfr.exe136⤵PID:2328
-
\??\c:\rrrxllx.exec:\rrrxllx.exe137⤵PID:1432
-
\??\c:\xxxfxfr.exec:\xxxfxfr.exe138⤵PID:1292
-
\??\c:\nhtbnt.exec:\nhtbnt.exe139⤵PID:2772
-
\??\c:\nbnbtn.exec:\nbnbtn.exe140⤵PID:2424
-
\??\c:\jjvjj.exec:\jjvjj.exe141⤵PID:2052
-
\??\c:\vpdjj.exec:\vpdjj.exe142⤵PID:2256
-
\??\c:\rlflxlr.exec:\rlflxlr.exe143⤵PID:2428
-
\??\c:\lflxflf.exec:\lflxflf.exe144⤵PID:588
-
\??\c:\nhbhnt.exec:\nhbhnt.exe145⤵PID:668
-
\??\c:\hbtbnn.exec:\hbtbnn.exe146⤵PID:1856
-
\??\c:\ddvvj.exec:\ddvvj.exe147⤵PID:2020
-
\??\c:\7vjjj.exec:\7vjjj.exe148⤵PID:1644
-
\??\c:\1xlrrxl.exec:\1xlrrxl.exe149⤵PID:1516
-
\??\c:\rrllxlr.exec:\rrllxlr.exe150⤵PID:1792
-
\??\c:\nhbnbh.exec:\nhbnbh.exe151⤵PID:1676
-
\??\c:\3nnhnt.exec:\3nnhnt.exe152⤵PID:1672
-
\??\c:\ttbhbb.exec:\ttbhbb.exe153⤵PID:2148
-
\??\c:\vdpvj.exec:\vdpvj.exe154⤵PID:2176
-
\??\c:\rlffxxl.exec:\rlffxxl.exe155⤵PID:2040
-
\??\c:\xxrlxxl.exec:\xxrlxxl.exe156⤵PID:1688
-
\??\c:\nnhnbn.exec:\nnhnbn.exe157⤵PID:1616
-
\??\c:\nnttnt.exec:\nnttnt.exe158⤵PID:2364
-
\??\c:\pvjpv.exec:\pvjpv.exe159⤵PID:1248
-
\??\c:\3dvdj.exec:\3dvdj.exe160⤵PID:2132
-
\??\c:\ppjpv.exec:\ppjpv.exe161⤵PID:2664
-
\??\c:\xfxffxf.exec:\xfxffxf.exe162⤵PID:2564
-
\??\c:\fxllrrr.exec:\fxllrrr.exe163⤵PID:2076
-
\??\c:\tnbntn.exec:\tnbntn.exe164⤵PID:2500
-
\??\c:\bbthhh.exec:\bbthhh.exe165⤵PID:2696
-
\??\c:\pdjpj.exec:\pdjpj.exe166⤵PID:2968
-
\??\c:\jdvdv.exec:\jdvdv.exe167⤵PID:2808
-
\??\c:\7llxrrf.exec:\7llxrrf.exe168⤵PID:800
-
\??\c:\hbtbtt.exec:\hbtbtt.exe169⤵PID:2464
-
\??\c:\9hhhnn.exec:\9hhhnn.exe170⤵PID:2624
-
\??\c:\nhbhnt.exec:\nhbhnt.exe171⤵PID:2228
-
\??\c:\pjpdj.exec:\pjpdj.exe172⤵PID:2784
-
\??\c:\1llrxlr.exec:\1llrxlr.exe173⤵PID:2172
-
\??\c:\llfxrxf.exec:\llfxrxf.exe174⤵PID:1928
-
\??\c:\3ttbhh.exec:\3ttbhh.exe175⤵PID:2484
-
\??\c:\ttntbb.exec:\ttntbb.exe176⤵PID:2700
-
\??\c:\vpvdp.exec:\vpvdp.exe177⤵PID:1552
-
\??\c:\ddpvv.exec:\ddpvv.exe178⤵PID:1400
-
\??\c:\llrrrfr.exec:\llrrrfr.exe179⤵PID:1432
-
\??\c:\fxfrxlf.exec:\fxfrxlf.exe180⤵PID:2124
-
\??\c:\9bhbbt.exec:\9bhbbt.exe181⤵PID:2772
-
\??\c:\nnbbbt.exec:\nnbbbt.exe182⤵PID:2872
-
\??\c:\ppvjp.exec:\ppvjp.exe183⤵PID:2632
-
\??\c:\jdvpj.exec:\jdvpj.exe184⤵PID:2544
-
\??\c:\dpvvd.exec:\dpvvd.exe185⤵PID:2428
-
\??\c:\lxlrxxx.exec:\lxlrxxx.exe186⤵PID:552
-
\??\c:\lfxfflf.exec:\lfxfflf.exe187⤵PID:668
-
\??\c:\btbbnt.exec:\btbbnt.exe188⤵PID:1304
-
\??\c:\hhthbt.exec:\hhthbt.exe189⤵PID:2020
-
\??\c:\pjdjj.exec:\pjdjj.exe190⤵PID:1252
-
\??\c:\5dvvv.exec:\5dvvv.exe191⤵PID:564
-
\??\c:\xrrxffr.exec:\xrrxffr.exe192⤵PID:1956
-
\??\c:\tnbhnh.exec:\tnbhnh.exe193⤵PID:1676
-
\??\c:\nhnhnn.exec:\nhnhnn.exe194⤵PID:1672
-
\??\c:\htbhnh.exec:\htbhnh.exe195⤵PID:2148
-
\??\c:\vdpvv.exec:\vdpvv.exe196⤵PID:2636
-
\??\c:\pjdvj.exec:\pjdvj.exe197⤵PID:1604
-
\??\c:\rlxxffl.exec:\rlxxffl.exe198⤵PID:1724
-
\??\c:\xrxlrlf.exec:\xrxlrlf.exe199⤵PID:1616
-
\??\c:\3bhnbb.exec:\3bhnbb.exe200⤵PID:2592
-
\??\c:\nhbbth.exec:\nhbbth.exe201⤵PID:1248
-
\??\c:\jdpvp.exec:\jdpvp.exe202⤵PID:3004
-
\??\c:\pjvvv.exec:\pjvvv.exe203⤵PID:2664
-
\??\c:\xllfxxx.exec:\xllfxxx.exe204⤵PID:2264
-
\??\c:\xlrffff.exec:\xlrffff.exe205⤵PID:2076
-
\??\c:\9jpvj.exec:\9jpvj.exe206⤵PID:2612
-
\??\c:\vpjjd.exec:\vpjjd.exe207⤵PID:2696
-
\??\c:\rlxxxrx.exec:\rlxxxrx.exe208⤵PID:2968
-
\??\c:\1rfflrf.exec:\1rfflrf.exe209⤵PID:2808
-
\??\c:\bttntn.exec:\bttntn.exe210⤵PID:1940
-
\??\c:\bbttth.exec:\bbttth.exe211⤵PID:2000
-
\??\c:\9vjpp.exec:\9vjpp.exe212⤵PID:2936
-
\??\c:\vvjvp.exec:\vvjvp.exe213⤵PID:1428
-
\??\c:\lxxxffl.exec:\lxxxffl.exe214⤵PID:1924
-
\??\c:\9rflxfr.exec:\9rflxfr.exe215⤵PID:1640
-
\??\c:\bththh.exec:\bththh.exe216⤵PID:624
-
\??\c:\7bnhnb.exec:\7bnhnb.exe217⤵PID:300
-
\??\c:\vpdjv.exec:\vpdjv.exe218⤵PID:2736
-
\??\c:\pdpvv.exec:\pdpvv.exe219⤵PID:1340
-
\??\c:\1xrrxfl.exec:\1xrrxfl.exe220⤵PID:1500
-
\??\c:\xrfflfl.exec:\xrfflfl.exe221⤵PID:2244
-
\??\c:\hbnntn.exec:\hbnntn.exe222⤵PID:2096
-
\??\c:\7hhthn.exec:\7hhthn.exe223⤵PID:1256
-
\??\c:\bntnnh.exec:\bntnnh.exe224⤵PID:1756
-
\??\c:\dvpdp.exec:\dvpdp.exe225⤵PID:2632
-
\??\c:\1xfxxxl.exec:\1xfxxxl.exe226⤵PID:772
-
\??\c:\1rrlffx.exec:\1rrlffx.exe227⤵PID:1488
-
\??\c:\rffffll.exec:\rffffll.exe228⤵PID:1480
-
\??\c:\nnbbtt.exec:\nnbbtt.exe229⤵PID:992
-
\??\c:\nhnnhn.exec:\nhnnhn.exe230⤵PID:1112
-
\??\c:\pjpjj.exec:\pjpjj.exe231⤵PID:3040
-
\??\c:\dpdjp.exec:\dpdjp.exe232⤵PID:1692
-
\??\c:\3fxxxxl.exec:\3fxxxxl.exe233⤵PID:2188
-
\??\c:\xrflrrr.exec:\xrflrrr.exe234⤵PID:2848
-
\??\c:\hbnnnt.exec:\hbnnnt.exe235⤵PID:1716
-
\??\c:\7tntht.exec:\7tntht.exe236⤵PID:1864
-
\??\c:\9vjpv.exec:\9vjpv.exe237⤵PID:2948
-
\??\c:\jdppv.exec:\jdppv.exe238⤵PID:872
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe239⤵PID:2332
-
\??\c:\9lxfflx.exec:\9lxfflx.exe240⤵PID:1724
-
\??\c:\xrlrflf.exec:\xrlrflf.exe241⤵PID:2588
-
\??\c:\hbnthb.exec:\hbnthb.exe242⤵PID:2592