Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 15:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e07c914f0862632d95ee7faa3bc43c80_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
e07c914f0862632d95ee7faa3bc43c80_NeikiAnalytics.exe
-
Size
95KB
-
MD5
e07c914f0862632d95ee7faa3bc43c80
-
SHA1
0bd61dd909d33059962d64d22f575e06223197dc
-
SHA256
7be71980a0d9f10be05d6f5e7d4f96548b1f2f1ff359a46b3a72cf3d784b956c
-
SHA512
dbcff67a7a01aca4f508e3b30f4729bf1c78fcf86067042410d591f5835cec30d967fdcf541bc501eabed7a470a54d79f282be6374b8041cdd5b3ad1fc59e5ba
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qP1hvZo66Ox4oq2SQwfTG:ymb3NkkiQ3mdBjFIj+qNhvZuHQYy
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral1/memory/2064-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-39-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-88-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2428-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2364-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/324-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1548-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1116-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2276-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1376-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1880-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
1dvdj.exefxfrffr.exe9xxfxfr.exethbbht.exedvjvj.exe7pddd.exefxllllr.exe1rfllxx.exethnnnn.exe9jjvv.exefxlxxxf.exebtntnn.exebnhnhb.exepdjvp.exepddjp.exexlxffrx.exe9xflfff.exe7hbhnt.exepppdv.exepdjdd.exe7rllfll.exe9lrlxrx.exethhhbt.exetnhbht.exe9dvjp.exejdppp.exexrfrflx.exebntnhh.exehtnhbt.exe7jvpp.exelfrrrll.exe9xxxfxf.exe5tbbhh.exetthbbn.exe9bhbbt.exevpvdv.exejvpjd.exefxlffff.exe7frffxx.exebththb.exehtbttt.exehtbbbb.exevjppj.exevpdjd.exelxffrll.exefxlrxff.exehthnnh.exethnntn.exe5jppp.exe1pddd.exexlrxrll.exe1flllxr.exe1tnnnn.exe7tbthh.exetntnhn.exe3djdj.exedppjp.exefrxrrrx.exehbhhnn.exehthbtn.exedpdvp.exepdjjp.exe1xrxxfr.exelxflfff.exepid process 2920 1dvdj.exe 2784 fxfrffr.exe 2520 9xxfxfr.exe 2660 thbbht.exe 2572 dvjvj.exe 2620 7pddd.exe 2456 fxllllr.exe 2428 1rfllxx.exe 2552 thnnnn.exe 2888 9jjvv.exe 2496 fxlxxxf.exe 2608 btntnn.exe 2364 bnhnhb.exe 2752 pdjvp.exe 1980 pddjp.exe 1988 xlxffrx.exe 324 9xflfff.exe 792 7hbhnt.exe 1548 pppdv.exe 1116 pdjdd.exe 2908 7rllfll.exe 2264 9lrlxrx.exe 2300 thhhbt.exe 2276 tnhbht.exe 1376 9dvjp.exe 1880 jdppp.exe 2340 xrfrflx.exe 2988 bntnhh.exe 2040 htnhbt.exe 2008 7jvpp.exe 896 lfrrrll.exe 1740 9xxxfxf.exe 1824 5tbbhh.exe 2912 tthbbn.exe 3024 9bhbbt.exe 2680 vpvdv.exe 1616 jvpjd.exe 2556 fxlffff.exe 2576 7frffxx.exe 2140 bththb.exe 2712 htbttt.exe 2624 htbbbb.exe 2448 vjppj.exe 2892 vpdjd.exe 2600 lxffrll.exe 2416 fxlrxff.exe 1968 hthnnh.exe 1732 thnntn.exe 2324 5jppp.exe 1992 1pddd.exe 2396 xlrxrll.exe 2320 1flllxr.exe 1660 1tnnnn.exe 596 7tbthh.exe 324 tntnhn.exe 792 3djdj.exe 2872 dppjp.exe 2088 frxrrrx.exe 588 hbhhnn.exe 2908 hthbtn.exe 1500 dpdvp.exe 1120 pdjjp.exe 2112 1xrxxfr.exe 576 lxflfff.exe -
Processes:
resource yara_rule behavioral1/memory/2064-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2364-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/324-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1548-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1116-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2276-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1376-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1880-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-268-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e07c914f0862632d95ee7faa3bc43c80_NeikiAnalytics.exe1dvdj.exefxfrffr.exe9xxfxfr.exethbbht.exedvjvj.exe7pddd.exefxllllr.exe1rfllxx.exethnnnn.exe9jjvv.exefxlxxxf.exebtntnn.exebnhnhb.exepdjvp.exepddjp.exedescription pid process target process PID 2064 wrote to memory of 2920 2064 e07c914f0862632d95ee7faa3bc43c80_NeikiAnalytics.exe 1dvdj.exe PID 2064 wrote to memory of 2920 2064 e07c914f0862632d95ee7faa3bc43c80_NeikiAnalytics.exe 1dvdj.exe PID 2064 wrote to memory of 2920 2064 e07c914f0862632d95ee7faa3bc43c80_NeikiAnalytics.exe 1dvdj.exe PID 2064 wrote to memory of 2920 2064 e07c914f0862632d95ee7faa3bc43c80_NeikiAnalytics.exe 1dvdj.exe PID 2920 wrote to memory of 2784 2920 1dvdj.exe fxfrffr.exe PID 2920 wrote to memory of 2784 2920 1dvdj.exe fxfrffr.exe PID 2920 wrote to memory of 2784 2920 1dvdj.exe fxfrffr.exe PID 2920 wrote to memory of 2784 2920 1dvdj.exe fxfrffr.exe PID 2784 wrote to memory of 2520 2784 fxfrffr.exe 9xxfxfr.exe PID 2784 wrote to memory of 2520 2784 fxfrffr.exe 9xxfxfr.exe PID 2784 wrote to memory of 2520 2784 fxfrffr.exe 9xxfxfr.exe PID 2784 wrote to memory of 2520 2784 fxfrffr.exe 9xxfxfr.exe PID 2520 wrote to memory of 2660 2520 9xxfxfr.exe thbbht.exe PID 2520 wrote to memory of 2660 2520 9xxfxfr.exe thbbht.exe PID 2520 wrote to memory of 2660 2520 9xxfxfr.exe thbbht.exe PID 2520 wrote to memory of 2660 2520 9xxfxfr.exe thbbht.exe PID 2660 wrote to memory of 2572 2660 thbbht.exe dvjvj.exe PID 2660 wrote to memory of 2572 2660 thbbht.exe dvjvj.exe PID 2660 wrote to memory of 2572 2660 thbbht.exe dvjvj.exe PID 2660 wrote to memory of 2572 2660 thbbht.exe dvjvj.exe PID 2572 wrote to memory of 2620 2572 dvjvj.exe 7pddd.exe PID 2572 wrote to memory of 2620 2572 dvjvj.exe 7pddd.exe PID 2572 wrote to memory of 2620 2572 dvjvj.exe 7pddd.exe PID 2572 wrote to memory of 2620 2572 dvjvj.exe 7pddd.exe PID 2620 wrote to memory of 2456 2620 7pddd.exe fxllllr.exe PID 2620 wrote to memory of 2456 2620 7pddd.exe fxllllr.exe PID 2620 wrote to memory of 2456 2620 7pddd.exe fxllllr.exe PID 2620 wrote to memory of 2456 2620 7pddd.exe fxllllr.exe PID 2456 wrote to memory of 2428 2456 fxllllr.exe 1rfllxx.exe PID 2456 wrote to memory of 2428 2456 fxllllr.exe 1rfllxx.exe PID 2456 wrote to memory of 2428 2456 fxllllr.exe 1rfllxx.exe PID 2456 wrote to memory of 2428 2456 fxllllr.exe 1rfllxx.exe PID 2428 wrote to memory of 2552 2428 1rfllxx.exe thnnnn.exe PID 2428 wrote to memory of 2552 2428 1rfllxx.exe thnnnn.exe PID 2428 wrote to memory of 2552 2428 1rfllxx.exe thnnnn.exe PID 2428 wrote to memory of 2552 2428 1rfllxx.exe thnnnn.exe PID 2552 wrote to memory of 2888 2552 thnnnn.exe 9jjvv.exe PID 2552 wrote to memory of 2888 2552 thnnnn.exe 9jjvv.exe PID 2552 wrote to memory of 2888 2552 thnnnn.exe 9jjvv.exe PID 2552 wrote to memory of 2888 2552 thnnnn.exe 9jjvv.exe PID 2888 wrote to memory of 2496 2888 9jjvv.exe fxlxxxf.exe PID 2888 wrote to memory of 2496 2888 9jjvv.exe fxlxxxf.exe PID 2888 wrote to memory of 2496 2888 9jjvv.exe fxlxxxf.exe PID 2888 wrote to memory of 2496 2888 9jjvv.exe fxlxxxf.exe PID 2496 wrote to memory of 2608 2496 fxlxxxf.exe btntnn.exe PID 2496 wrote to memory of 2608 2496 fxlxxxf.exe btntnn.exe PID 2496 wrote to memory of 2608 2496 fxlxxxf.exe btntnn.exe PID 2496 wrote to memory of 2608 2496 fxlxxxf.exe btntnn.exe PID 2608 wrote to memory of 2364 2608 btntnn.exe bnhnhb.exe PID 2608 wrote to memory of 2364 2608 btntnn.exe bnhnhb.exe PID 2608 wrote to memory of 2364 2608 btntnn.exe bnhnhb.exe PID 2608 wrote to memory of 2364 2608 btntnn.exe bnhnhb.exe PID 2364 wrote to memory of 2752 2364 bnhnhb.exe pdjvp.exe PID 2364 wrote to memory of 2752 2364 bnhnhb.exe pdjvp.exe PID 2364 wrote to memory of 2752 2364 bnhnhb.exe pdjvp.exe PID 2364 wrote to memory of 2752 2364 bnhnhb.exe pdjvp.exe PID 2752 wrote to memory of 1980 2752 pdjvp.exe pddjp.exe PID 2752 wrote to memory of 1980 2752 pdjvp.exe pddjp.exe PID 2752 wrote to memory of 1980 2752 pdjvp.exe pddjp.exe PID 2752 wrote to memory of 1980 2752 pdjvp.exe pddjp.exe PID 1980 wrote to memory of 1988 1980 pddjp.exe xlxffrx.exe PID 1980 wrote to memory of 1988 1980 pddjp.exe xlxffrx.exe PID 1980 wrote to memory of 1988 1980 pddjp.exe xlxffrx.exe PID 1980 wrote to memory of 1988 1980 pddjp.exe xlxffrx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e07c914f0862632d95ee7faa3bc43c80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e07c914f0862632d95ee7faa3bc43c80_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\1dvdj.exec:\1dvdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\fxfrffr.exec:\fxfrffr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\9xxfxfr.exec:\9xxfxfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\thbbht.exec:\thbbht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\dvjvj.exec:\dvjvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\7pddd.exec:\7pddd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\fxllllr.exec:\fxllllr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\1rfllxx.exec:\1rfllxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\thnnnn.exec:\thnnnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\9jjvv.exec:\9jjvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\fxlxxxf.exec:\fxlxxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\btntnn.exec:\btntnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\bnhnhb.exec:\bnhnhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\pdjvp.exec:\pdjvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\pddjp.exec:\pddjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\xlxffrx.exec:\xlxffrx.exe17⤵
- Executes dropped EXE
PID:1988 -
\??\c:\9xflfff.exec:\9xflfff.exe18⤵
- Executes dropped EXE
PID:324 -
\??\c:\7hbhnt.exec:\7hbhnt.exe19⤵
- Executes dropped EXE
PID:792 -
\??\c:\pppdv.exec:\pppdv.exe20⤵
- Executes dropped EXE
PID:1548 -
\??\c:\pdjdd.exec:\pdjdd.exe21⤵
- Executes dropped EXE
PID:1116 -
\??\c:\7rllfll.exec:\7rllfll.exe22⤵
- Executes dropped EXE
PID:2908 -
\??\c:\9lrlxrx.exec:\9lrlxrx.exe23⤵
- Executes dropped EXE
PID:2264 -
\??\c:\thhhbt.exec:\thhhbt.exe24⤵
- Executes dropped EXE
PID:2300 -
\??\c:\tnhbht.exec:\tnhbht.exe25⤵
- Executes dropped EXE
PID:2276 -
\??\c:\9dvjp.exec:\9dvjp.exe26⤵
- Executes dropped EXE
PID:1376 -
\??\c:\jdppp.exec:\jdppp.exe27⤵
- Executes dropped EXE
PID:1880 -
\??\c:\xrfrflx.exec:\xrfrflx.exe28⤵
- Executes dropped EXE
PID:2340 -
\??\c:\bntnhh.exec:\bntnhh.exe29⤵
- Executes dropped EXE
PID:2988 -
\??\c:\htnhbt.exec:\htnhbt.exe30⤵
- Executes dropped EXE
PID:2040 -
\??\c:\7jvpp.exec:\7jvpp.exe31⤵
- Executes dropped EXE
PID:2008 -
\??\c:\lfrrrll.exec:\lfrrrll.exe32⤵
- Executes dropped EXE
PID:896 -
\??\c:\9xxxfxf.exec:\9xxxfxf.exe33⤵
- Executes dropped EXE
PID:1740 -
\??\c:\5tbbhh.exec:\5tbbhh.exe34⤵
- Executes dropped EXE
PID:1824 -
\??\c:\tthbbn.exec:\tthbbn.exe35⤵
- Executes dropped EXE
PID:2912 -
\??\c:\9bhbbt.exec:\9bhbbt.exe36⤵
- Executes dropped EXE
PID:3024 -
\??\c:\vpvdv.exec:\vpvdv.exe37⤵
- Executes dropped EXE
PID:2680 -
\??\c:\jvpjd.exec:\jvpjd.exe38⤵
- Executes dropped EXE
PID:1616 -
\??\c:\fxlffff.exec:\fxlffff.exe39⤵
- Executes dropped EXE
PID:2556 -
\??\c:\7frffxx.exec:\7frffxx.exe40⤵
- Executes dropped EXE
PID:2576 -
\??\c:\bththb.exec:\bththb.exe41⤵
- Executes dropped EXE
PID:2140 -
\??\c:\htbttt.exec:\htbttt.exe42⤵
- Executes dropped EXE
PID:2712 -
\??\c:\htbbbb.exec:\htbbbb.exe43⤵
- Executes dropped EXE
PID:2624 -
\??\c:\vjppj.exec:\vjppj.exe44⤵
- Executes dropped EXE
PID:2448 -
\??\c:\vpdjd.exec:\vpdjd.exe45⤵
- Executes dropped EXE
PID:2892 -
\??\c:\lxffrll.exec:\lxffrll.exe46⤵
- Executes dropped EXE
PID:2600 -
\??\c:\fxlrxff.exec:\fxlrxff.exe47⤵
- Executes dropped EXE
PID:2416 -
\??\c:\hthnnh.exec:\hthnnh.exe48⤵
- Executes dropped EXE
PID:1968 -
\??\c:\thnntn.exec:\thnntn.exe49⤵
- Executes dropped EXE
PID:1732 -
\??\c:\5jppp.exec:\5jppp.exe50⤵
- Executes dropped EXE
PID:2324 -
\??\c:\1pddd.exec:\1pddd.exe51⤵
- Executes dropped EXE
PID:1992 -
\??\c:\xlrxrll.exec:\xlrxrll.exe52⤵
- Executes dropped EXE
PID:2396 -
\??\c:\1flllxr.exec:\1flllxr.exe53⤵
- Executes dropped EXE
PID:2320 -
\??\c:\1tnnnn.exec:\1tnnnn.exe54⤵
- Executes dropped EXE
PID:1660 -
\??\c:\7tbthh.exec:\7tbthh.exe55⤵
- Executes dropped EXE
PID:596 -
\??\c:\tntnhn.exec:\tntnhn.exe56⤵
- Executes dropped EXE
PID:324 -
\??\c:\3djdj.exec:\3djdj.exe57⤵
- Executes dropped EXE
PID:792 -
\??\c:\dppjp.exec:\dppjp.exe58⤵
- Executes dropped EXE
PID:2872 -
\??\c:\frxrrrx.exec:\frxrrrx.exe59⤵
- Executes dropped EXE
PID:2088 -
\??\c:\hbhhnn.exec:\hbhhnn.exe60⤵
- Executes dropped EXE
PID:588 -
\??\c:\hthbtn.exec:\hthbtn.exe61⤵
- Executes dropped EXE
PID:2908 -
\??\c:\dpdvp.exec:\dpdvp.exe62⤵
- Executes dropped EXE
PID:1500 -
\??\c:\pdjjp.exec:\pdjjp.exe63⤵
- Executes dropped EXE
PID:1120 -
\??\c:\1xrxxfr.exec:\1xrxxfr.exe64⤵
- Executes dropped EXE
PID:2112 -
\??\c:\lxflfff.exec:\lxflfff.exe65⤵
- Executes dropped EXE
PID:576 -
\??\c:\fxlrflx.exec:\fxlrflx.exe66⤵PID:1028
-
\??\c:\htbbnn.exec:\htbbnn.exe67⤵PID:1048
-
\??\c:\9bthtn.exec:\9bthtn.exe68⤵PID:708
-
\??\c:\vjdjd.exec:\vjdjd.exe69⤵PID:2044
-
\??\c:\5vdjp.exec:\5vdjp.exe70⤵PID:1316
-
\??\c:\rlrrxxr.exec:\rlrrxxr.exe71⤵PID:2196
-
\??\c:\7rrrrrl.exec:\7rrrrrl.exe72⤵PID:1776
-
\??\c:\tnnthh.exec:\tnnthh.exe73⤵PID:912
-
\??\c:\5ttbhh.exec:\5ttbhh.exe74⤵PID:2920
-
\??\c:\ddpdp.exec:\ddpdp.exe75⤵PID:2860
-
\??\c:\xrlrlxf.exec:\xrlrlxf.exe76⤵PID:1748
-
\??\c:\5lfrfrx.exec:\5lfrfrx.exe77⤵PID:2676
-
\??\c:\rfrrxfx.exec:\rfrrxfx.exe78⤵PID:1976
-
\??\c:\bbthtb.exec:\bbthtb.exe79⤵PID:2848
-
\??\c:\nbbhhn.exec:\nbbhhn.exe80⤵PID:2648
-
\??\c:\ppddj.exec:\ppddj.exe81⤵PID:2592
-
\??\c:\3vjvj.exec:\3vjvj.exe82⤵PID:2692
-
\??\c:\ffrflxf.exec:\ffrflxf.exe83⤵PID:2484
-
\??\c:\1lflxfl.exec:\1lflxfl.exe84⤵PID:2468
-
\??\c:\xxrfllx.exec:\xxrfllx.exe85⤵PID:2424
-
\??\c:\hhtbnb.exec:\hhtbnb.exe86⤵PID:2472
-
\??\c:\nhbhbb.exec:\nhbhbb.exe87⤵PID:2604
-
\??\c:\dvjjp.exec:\dvjjp.exe88⤵PID:2636
-
\??\c:\vpjjj.exec:\vpjjj.exe89⤵PID:2416
-
\??\c:\pjvdv.exec:\pjvdv.exe90⤵PID:2764
-
\??\c:\lfxxffr.exec:\lfxxffr.exe91⤵PID:1704
-
\??\c:\xrfrflr.exec:\xrfrflr.exe92⤵PID:2220
-
\??\c:\7frxxxr.exec:\7frxxxr.exe93⤵PID:1984
-
\??\c:\hnthbb.exec:\hnthbb.exe94⤵PID:1800
-
\??\c:\hbhhhn.exec:\hbhhhn.exe95⤵PID:1700
-
\??\c:\vjvpv.exec:\vjvpv.exe96⤵PID:1600
-
\??\c:\jdvjv.exec:\jdvjv.exe97⤵PID:2236
-
\??\c:\rlffrrx.exec:\rlffrrx.exe98⤵PID:1544
-
\??\c:\rrrflrf.exec:\rrrflrf.exe99⤵PID:1784
-
\??\c:\7ffflrf.exec:\7ffflrf.exe100⤵PID:2872
-
\??\c:\5nbhnn.exec:\5nbhnn.exe101⤵PID:3064
-
\??\c:\9nhhhn.exec:\9nhhhn.exe102⤵PID:1396
-
\??\c:\ttnbnh.exec:\ttnbnh.exe103⤵PID:1412
-
\??\c:\vvjjj.exec:\vvjjj.exe104⤵PID:1104
-
\??\c:\dvddd.exec:\dvddd.exe105⤵PID:2748
-
\??\c:\lfxrfrf.exec:\lfxrfrf.exe106⤵PID:992
-
\??\c:\xrrxxxl.exec:\xrrxxxl.exe107⤵PID:1052
-
\??\c:\hbttht.exec:\hbttht.exe108⤵PID:952
-
\??\c:\hhnhtt.exec:\hhnhtt.exe109⤵PID:868
-
\??\c:\tntbhh.exec:\tntbhh.exe110⤵PID:1944
-
\??\c:\jjvvj.exec:\jjvvj.exe111⤵PID:2376
-
\??\c:\ddpvd.exec:\ddpvd.exe112⤵PID:1720
-
\??\c:\5rlxxlr.exec:\5rlxxlr.exe113⤵PID:2196
-
\??\c:\nhhnnh.exec:\nhhnnh.exe114⤵PID:2072
-
\??\c:\btnbhh.exec:\btnbhh.exe115⤵PID:1756
-
\??\c:\vpddp.exec:\vpddp.exe116⤵PID:2192
-
\??\c:\ddjpv.exec:\ddjpv.exe117⤵PID:2612
-
\??\c:\jvpjd.exec:\jvpjd.exe118⤵PID:2200
-
\??\c:\xffrfff.exec:\xffrfff.exe119⤵PID:2812
-
\??\c:\1xlxfrf.exec:\1xlxfrf.exe120⤵PID:1616
-
\??\c:\9thhnh.exec:\9thhnh.exe121⤵PID:2572
-
\??\c:\ttnnhn.exec:\ttnnhn.exe122⤵PID:2756
-
\??\c:\bthnbb.exec:\bthnbb.exe123⤵PID:2592
-
\??\c:\jjvvj.exec:\jjvvj.exe124⤵PID:2700
-
\??\c:\vvjpd.exec:\vvjpd.exe125⤵PID:2452
-
\??\c:\xlxxfll.exec:\xlxxfll.exe126⤵PID:2468
-
\??\c:\fxfrrff.exec:\fxfrrff.exe127⤵PID:3044
-
\??\c:\hhnbnt.exec:\hhnbnt.exe128⤵PID:2896
-
\??\c:\htttbb.exec:\htttbb.exe129⤵PID:820
-
\??\c:\nbhhnh.exec:\nbhhnh.exe130⤵PID:1964
-
\??\c:\5pddd.exec:\5pddd.exe131⤵PID:2068
-
\??\c:\dvpvv.exec:\dvpvv.exe132⤵PID:2168
-
\??\c:\lfxfxfr.exec:\lfxfxfr.exe133⤵PID:1652
-
\??\c:\rlfrflr.exec:\rlfrflr.exe134⤵PID:1816
-
\??\c:\ffxlrxf.exec:\ffxlrxf.exe135⤵PID:1596
-
\??\c:\hbtttb.exec:\hbtttb.exe136⤵PID:1696
-
\??\c:\bthtbb.exec:\bthtbb.exe137⤵PID:892
-
\??\c:\7thhbt.exec:\7thhbt.exe138⤵PID:1224
-
\??\c:\1jjjp.exec:\1jjjp.exe139⤵PID:1536
-
\??\c:\jdvpv.exec:\jdvpv.exe140⤵PID:1924
-
\??\c:\lflrlrx.exec:\lflrlrx.exe141⤵PID:1928
-
\??\c:\9lxxflr.exec:\9lxxflr.exe142⤵PID:2872
-
\??\c:\xrfrflr.exec:\xrfrflr.exe143⤵PID:1948
-
\??\c:\7nhnhn.exec:\7nhnhn.exe144⤵PID:2304
-
\??\c:\hhbhbh.exec:\hhbhbh.exe145⤵PID:1120
-
\??\c:\9dvdj.exec:\9dvdj.exe146⤵PID:676
-
\??\c:\5vppv.exec:\5vppv.exe147⤵PID:1256
-
\??\c:\pjdjd.exec:\pjdjd.exe148⤵PID:2984
-
\??\c:\fflrffl.exec:\fflrffl.exe149⤵PID:608
-
\??\c:\xrlrfrf.exec:\xrlrfrf.exe150⤵PID:1812
-
\??\c:\lfllxxl.exec:\lfllxxl.exe151⤵PID:1444
-
\??\c:\btnthh.exec:\btnthh.exe152⤵PID:1524
-
\??\c:\bthntn.exec:\bthntn.exe153⤵PID:2508
-
\??\c:\jvdjp.exec:\jvdjp.exe154⤵PID:1776
-
\??\c:\ppjvv.exec:\ppjvv.exe155⤵PID:1324
-
\??\c:\fxllrrx.exec:\fxllrrx.exe156⤵PID:1248
-
\??\c:\rlxxffr.exec:\rlxxffr.exe157⤵PID:2868
-
\??\c:\9rlrffr.exec:\9rlrffr.exe158⤵PID:2976
-
\??\c:\9htbhh.exec:\9htbhh.exe159⤵PID:2720
-
\??\c:\btbbhn.exec:\btbbhn.exe160⤵PID:2560
-
\??\c:\vpjpj.exec:\vpjpj.exe161⤵PID:2436
-
\??\c:\jdpvj.exec:\jdpvj.exe162⤵PID:2852
-
\??\c:\frfffrx.exec:\frfffrx.exe163⤵PID:2548
-
\??\c:\lfrxllx.exec:\lfrxllx.exe164⤵PID:2688
-
\??\c:\bntttn.exec:\bntttn.exe165⤵PID:2712
-
\??\c:\vvddp.exec:\vvddp.exe166⤵PID:2544
-
\??\c:\5vpjd.exec:\5vpjd.exe167⤵PID:2448
-
\??\c:\jdpjp.exec:\jdpjp.exe168⤵PID:2552
-
\??\c:\1lfflxf.exec:\1lfflxf.exe169⤵PID:1676
-
\??\c:\ffrffxf.exec:\ffrffxf.exe170⤵PID:2496
-
\??\c:\hhhhtb.exec:\hhhhtb.exe171⤵PID:1968
-
\??\c:\ttnbht.exec:\ttnbht.exe172⤵PID:1828
-
\??\c:\3ddpv.exec:\3ddpv.exe173⤵PID:2324
-
\??\c:\3dvjv.exec:\3dvjv.exe174⤵PID:2220
-
\??\c:\fffxlxl.exec:\fffxlxl.exe175⤵PID:2780
-
\??\c:\nhtthh.exec:\nhtthh.exe176⤵PID:1980
-
\??\c:\ttnnbh.exec:\ttnnbh.exe177⤵PID:480
-
\??\c:\hbhhnh.exec:\hbhhnh.exe178⤵PID:336
-
\??\c:\jjdjd.exec:\jjdjd.exe179⤵PID:1328
-
\??\c:\dvdjd.exec:\dvdjd.exe180⤵PID:1544
-
\??\c:\xxrffxf.exec:\xxrffxf.exe181⤵PID:1452
-
\??\c:\lfxllrx.exec:\lfxllrx.exe182⤵PID:3000
-
\??\c:\hbtbnt.exec:\hbtbnt.exe183⤵PID:2268
-
\??\c:\1hbnhn.exec:\1hbnhn.exe184⤵PID:2908
-
\??\c:\jdddp.exec:\jdddp.exe185⤵PID:1500
-
\??\c:\pdpdj.exec:\pdpdj.exe186⤵PID:1808
-
\??\c:\flxxlxf.exec:\flxxlxf.exe187⤵PID:2748
-
\??\c:\rlffrxl.exec:\rlffrxl.exe188⤵PID:280
-
\??\c:\9hbhtt.exec:\9hbhtt.exe189⤵PID:1020
-
\??\c:\5nhhhh.exec:\5nhhhh.exe190⤵PID:2288
-
\??\c:\jvvpj.exec:\jvvpj.exe191⤵PID:708
-
\??\c:\pjvvd.exec:\pjvvd.exe192⤵PID:1812
-
\??\c:\5rlrxxl.exec:\5rlrxxl.exe193⤵PID:1532
-
\??\c:\lxlrffr.exec:\lxlrffr.exe194⤵PID:3012
-
\??\c:\nntbhn.exec:\nntbhn.exe195⤵PID:2924
-
\??\c:\3thttb.exec:\3thttb.exe196⤵PID:2876
-
\??\c:\vppvj.exec:\vppvj.exe197⤵PID:1756
-
\??\c:\pjppv.exec:\pjppv.exe198⤵PID:2916
-
\??\c:\ffrxfll.exec:\ffrxfll.exe199⤵PID:2868
-
\??\c:\llflxfx.exec:\llflxfx.exe200⤵PID:1628
-
\??\c:\tnbbht.exec:\tnbbht.exe201⤵PID:1592
-
\??\c:\tttbtb.exec:\tttbtb.exe202⤵PID:2708
-
\??\c:\ppdvd.exec:\ppdvd.exe203⤵PID:2308
-
\??\c:\jdjpd.exec:\jdjpd.exe204⤵PID:2664
-
\??\c:\dvpjv.exec:\dvpjv.exe205⤵PID:2204
-
\??\c:\rflxxfl.exec:\rflxxfl.exe206⤵PID:2484
-
\??\c:\7rrlfff.exec:\7rrlfff.exe207⤵PID:2532
-
\??\c:\hbhnbb.exec:\hbhnbb.exe208⤵PID:2480
-
\??\c:\tbnnnb.exec:\tbnnnb.exe209⤵PID:1648
-
\??\c:\vjvdj.exec:\vjvdj.exe210⤵PID:2736
-
\??\c:\1ddjj.exec:\1ddjj.exe211⤵PID:1796
-
\??\c:\fxlxffl.exec:\fxlxffl.exe212⤵PID:1332
-
\??\c:\7frxflr.exec:\7frxflr.exe213⤵PID:2768
-
\??\c:\frxflfx.exec:\frxflfx.exe214⤵PID:832
-
\??\c:\htbbnn.exec:\htbbnn.exe215⤵PID:2752
-
\??\c:\9bntht.exec:\9bntht.exe216⤵PID:2176
-
\??\c:\ddvjd.exec:\ddvjd.exe217⤵PID:612
-
\??\c:\pjvvv.exec:\pjvvv.exe218⤵PID:560
-
\??\c:\rrrrxlr.exec:\rrrrxlr.exe219⤵PID:1584
-
\??\c:\ffrfrxf.exec:\ffrfrxf.exe220⤵PID:1668
-
\??\c:\1rlrxfl.exec:\1rlrxfl.exe221⤵PID:1536
-
\??\c:\3tnttb.exec:\3tnttb.exe222⤵PID:2284
-
\??\c:\9nhttt.exec:\9nhttt.exe223⤵PID:2880
-
\??\c:\vjppp.exec:\vjppp.exe224⤵PID:2104
-
\??\c:\xllllfl.exec:\xllllfl.exe225⤵PID:2096
-
\??\c:\rxllrll.exec:\rxllrll.exe226⤵PID:2300
-
\??\c:\bnttbb.exec:\bnttbb.exe227⤵PID:2276
-
\??\c:\tnbtnb.exec:\tnbtnb.exe228⤵PID:2516
-
\??\c:\htbbtn.exec:\htbbtn.exe229⤵PID:920
-
\??\c:\jdjjd.exec:\jdjjd.exe230⤵PID:1768
-
\??\c:\pdjjv.exec:\pdjjv.exe231⤵PID:1020
-
\??\c:\7lxxxrr.exec:\7lxxxrr.exe232⤵PID:2120
-
\??\c:\frrrrlf.exec:\frrrrlf.exe233⤵PID:2988
-
\??\c:\hbhnhb.exec:\hbhnhb.exe234⤵PID:1708
-
\??\c:\7vdvv.exec:\7vdvv.exe235⤵PID:1168
-
\??\c:\pvvjj.exec:\pvvjj.exe236⤵PID:1884
-
\??\c:\lxfxrlr.exec:\lxfxrlr.exe237⤵PID:2172
-
\??\c:\3lrrxrx.exec:\3lrrxrx.exe238⤵PID:2860
-
\??\c:\5llrfxf.exec:\5llrfxf.exe239⤵PID:2520
-
\??\c:\hhhbbt.exec:\hhhbbt.exe240⤵PID:2676
-
\??\c:\bthnnh.exec:\bthnnh.exe241⤵PID:2716
-
\??\c:\dvjpv.exec:\dvjpv.exe242⤵PID:2848