Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 19:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1dd150b2e16628bf3a2e0f665ed74590_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
1dd150b2e16628bf3a2e0f665ed74590_NeikiAnalytics.exe
-
Size
122KB
-
MD5
1dd150b2e16628bf3a2e0f665ed74590
-
SHA1
4e36b3da46ad656e13d09768c271b1c836d2d242
-
SHA256
a5bf35b082de71c42a8a99b9245a84d71d874ac754db166300774dd43d10cb18
-
SHA512
12aad920e6b3245497b27f5d0ff7427806e262c44c6f8b7b678454024dabe53a031287ab1b527b673f9fdac1c0edb895ba5fa2e9173176772604028043906bc7
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afoHvmQ+EZMYX90Ifcmt:n3C9BRW0j/uVEZFmIkS
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/1368-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/848-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-71-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1712-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1640-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/988-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1676-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1752-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/348-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xrflxxl.exetnbhnt.exebbtthb.exevpdpv.exe7tbtht.exe3pppp.exexxlxlrx.exe5thhnb.exe1hbnbt.exexrllxfl.exelxrfrrr.exedddvv.exedjvjv.exerxrrllx.exexlrfxfx.exehhtbnt.exe1dpvd.exevvpjp.exexxrxxxr.exe7tnhbt.exetnbbnt.exe9ppdj.exepjvvv.exennhbht.exehnhhbh.exenntbhh.exe3ddjv.exennnhbh.exehnbttn.exedvjjd.exerxfxrrr.exefxrrxxf.exebbntnn.exevpjjp.exejvjdp.exexrrxfff.exerlxflxl.exebthhtt.exehhttnn.exepjjjv.exe3ddpj.exelfxfflr.exe9rrxrxl.exerlxxffl.exentbhbt.exedvpvj.exe5jvdj.exexxlxrxf.exelfrxllr.exe3hhthb.exe5ntbnt.exevdvjd.exevppvj.exelffrfxr.exexxlxflr.exehhhthn.exennbhhh.exevpvdj.exerrflxlf.exexfxlflx.exepjvvj.exevpvvd.exefxrrlrx.exe7rfrxfl.exepid process 2088 xrflxxl.exe 2168 tnbhnt.exe 848 bbtthb.exe 2824 vpdpv.exe 2520 7tbtht.exe 2748 3pppp.exe 2676 xxlxlrx.exe 2528 5thhnb.exe 1620 1hbnbt.exe 1712 xrllxfl.exe 2580 lxrfrrr.exe 2788 dddvv.exe 1640 djvjv.exe 1084 rxrrllx.exe 2432 xlrfxfx.exe 2244 hhtbnt.exe 532 1dpvd.exe 988 vvpjp.exe 2864 xxrxxxr.exe 544 7tnhbt.exe 3068 tnbbnt.exe 2920 9ppdj.exe 2932 pjvvv.exe 1100 nnhbht.exe 1828 hnhhbh.exe 1676 nntbhh.exe 1752 3ddjv.exe 900 nnnhbh.exe 1672 hnbttn.exe 3000 dvjjd.exe 348 rxfxrrr.exe 2220 fxrrxxf.exe 1688 bbntnn.exe 2088 vpjjp.exe 2840 jvjdp.exe 624 xrrxfff.exe 2100 rlxflxl.exe 2736 bthhtt.exe 2352 hhttnn.exe 2628 pjjjv.exe 2540 3ddpj.exe 2748 lfxfflr.exe 2700 9rrxrxl.exe 2564 rlxxffl.exe 2556 ntbhbt.exe 3024 dvpvj.exe 1620 5jvdj.exe 2572 xxlxrxf.exe 2780 lfrxllr.exe 1364 3hhthb.exe 1920 5ntbnt.exe 2020 vdvjd.exe 1684 vppvj.exe 2176 lffrfxr.exe 1644 xxlxflr.exe 1756 hhhthn.exe 1132 nnbhhh.exe 300 vpvdj.exe 1840 rrflxlf.exe 2328 xfxlflx.exe 1632 pjvvj.exe 2152 vpvvd.exe 2312 fxrrlrx.exe 2932 7rfrxfl.exe -
Processes:
resource yara_rule behavioral1/memory/1368-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/848-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1712-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/988-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1676-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/348-301-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1dd150b2e16628bf3a2e0f665ed74590_NeikiAnalytics.exexrflxxl.exetnbhnt.exebbtthb.exevpdpv.exe7tbtht.exe3pppp.exexxlxlrx.exe5thhnb.exe1hbnbt.exexrllxfl.exelxrfrrr.exedddvv.exedjvjv.exerxrrllx.exexlrfxfx.exedescription pid process target process PID 1368 wrote to memory of 2088 1368 1dd150b2e16628bf3a2e0f665ed74590_NeikiAnalytics.exe xrflxxl.exe PID 1368 wrote to memory of 2088 1368 1dd150b2e16628bf3a2e0f665ed74590_NeikiAnalytics.exe xrflxxl.exe PID 1368 wrote to memory of 2088 1368 1dd150b2e16628bf3a2e0f665ed74590_NeikiAnalytics.exe xrflxxl.exe PID 1368 wrote to memory of 2088 1368 1dd150b2e16628bf3a2e0f665ed74590_NeikiAnalytics.exe xrflxxl.exe PID 2088 wrote to memory of 2168 2088 xrflxxl.exe tnbhnt.exe PID 2088 wrote to memory of 2168 2088 xrflxxl.exe tnbhnt.exe PID 2088 wrote to memory of 2168 2088 xrflxxl.exe tnbhnt.exe PID 2088 wrote to memory of 2168 2088 xrflxxl.exe tnbhnt.exe PID 2168 wrote to memory of 848 2168 tnbhnt.exe bbtthb.exe PID 2168 wrote to memory of 848 2168 tnbhnt.exe bbtthb.exe PID 2168 wrote to memory of 848 2168 tnbhnt.exe bbtthb.exe PID 2168 wrote to memory of 848 2168 tnbhnt.exe bbtthb.exe PID 848 wrote to memory of 2824 848 bbtthb.exe vpdpv.exe PID 848 wrote to memory of 2824 848 bbtthb.exe vpdpv.exe PID 848 wrote to memory of 2824 848 bbtthb.exe vpdpv.exe PID 848 wrote to memory of 2824 848 bbtthb.exe vpdpv.exe PID 2824 wrote to memory of 2520 2824 vpdpv.exe 7tbtht.exe PID 2824 wrote to memory of 2520 2824 vpdpv.exe 7tbtht.exe PID 2824 wrote to memory of 2520 2824 vpdpv.exe 7tbtht.exe PID 2824 wrote to memory of 2520 2824 vpdpv.exe 7tbtht.exe PID 2520 wrote to memory of 2748 2520 7tbtht.exe 3pppp.exe PID 2520 wrote to memory of 2748 2520 7tbtht.exe 3pppp.exe PID 2520 wrote to memory of 2748 2520 7tbtht.exe 3pppp.exe PID 2520 wrote to memory of 2748 2520 7tbtht.exe 3pppp.exe PID 2748 wrote to memory of 2676 2748 3pppp.exe xxlxlrx.exe PID 2748 wrote to memory of 2676 2748 3pppp.exe xxlxlrx.exe PID 2748 wrote to memory of 2676 2748 3pppp.exe xxlxlrx.exe PID 2748 wrote to memory of 2676 2748 3pppp.exe xxlxlrx.exe PID 2676 wrote to memory of 2528 2676 xxlxlrx.exe 5thhnb.exe PID 2676 wrote to memory of 2528 2676 xxlxlrx.exe 5thhnb.exe PID 2676 wrote to memory of 2528 2676 xxlxlrx.exe 5thhnb.exe PID 2676 wrote to memory of 2528 2676 xxlxlrx.exe 5thhnb.exe PID 2528 wrote to memory of 1620 2528 5thhnb.exe 1hbnbt.exe PID 2528 wrote to memory of 1620 2528 5thhnb.exe 1hbnbt.exe PID 2528 wrote to memory of 1620 2528 5thhnb.exe 1hbnbt.exe PID 2528 wrote to memory of 1620 2528 5thhnb.exe 1hbnbt.exe PID 1620 wrote to memory of 1712 1620 1hbnbt.exe xrllxfl.exe PID 1620 wrote to memory of 1712 1620 1hbnbt.exe xrllxfl.exe PID 1620 wrote to memory of 1712 1620 1hbnbt.exe xrllxfl.exe PID 1620 wrote to memory of 1712 1620 1hbnbt.exe xrllxfl.exe PID 1712 wrote to memory of 2580 1712 xrllxfl.exe lxrfrrr.exe PID 1712 wrote to memory of 2580 1712 xrllxfl.exe lxrfrrr.exe PID 1712 wrote to memory of 2580 1712 xrllxfl.exe lxrfrrr.exe PID 1712 wrote to memory of 2580 1712 xrllxfl.exe lxrfrrr.exe PID 2580 wrote to memory of 2788 2580 lxrfrrr.exe dddvv.exe PID 2580 wrote to memory of 2788 2580 lxrfrrr.exe dddvv.exe PID 2580 wrote to memory of 2788 2580 lxrfrrr.exe dddvv.exe PID 2580 wrote to memory of 2788 2580 lxrfrrr.exe dddvv.exe PID 2788 wrote to memory of 1640 2788 dddvv.exe djvjv.exe PID 2788 wrote to memory of 1640 2788 dddvv.exe djvjv.exe PID 2788 wrote to memory of 1640 2788 dddvv.exe djvjv.exe PID 2788 wrote to memory of 1640 2788 dddvv.exe djvjv.exe PID 1640 wrote to memory of 1084 1640 djvjv.exe rxrrllx.exe PID 1640 wrote to memory of 1084 1640 djvjv.exe rxrrllx.exe PID 1640 wrote to memory of 1084 1640 djvjv.exe rxrrllx.exe PID 1640 wrote to memory of 1084 1640 djvjv.exe rxrrllx.exe PID 1084 wrote to memory of 2432 1084 rxrrllx.exe xlrfxfx.exe PID 1084 wrote to memory of 2432 1084 rxrrllx.exe xlrfxfx.exe PID 1084 wrote to memory of 2432 1084 rxrrllx.exe xlrfxfx.exe PID 1084 wrote to memory of 2432 1084 rxrrllx.exe xlrfxfx.exe PID 2432 wrote to memory of 2244 2432 xlrfxfx.exe hhtbnt.exe PID 2432 wrote to memory of 2244 2432 xlrfxfx.exe hhtbnt.exe PID 2432 wrote to memory of 2244 2432 xlrfxfx.exe hhtbnt.exe PID 2432 wrote to memory of 2244 2432 xlrfxfx.exe hhtbnt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1dd150b2e16628bf3a2e0f665ed74590_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1dd150b2e16628bf3a2e0f665ed74590_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\xrflxxl.exec:\xrflxxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\tnbhnt.exec:\tnbhnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\bbtthb.exec:\bbtthb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\vpdpv.exec:\vpdpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\7tbtht.exec:\7tbtht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\3pppp.exec:\3pppp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\xxlxlrx.exec:\xxlxlrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\5thhnb.exec:\5thhnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\1hbnbt.exec:\1hbnbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\xrllxfl.exec:\xrllxfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\lxrfrrr.exec:\lxrfrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\dddvv.exec:\dddvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\djvjv.exec:\djvjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\rxrrllx.exec:\rxrrllx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\xlrfxfx.exec:\xlrfxfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\hhtbnt.exec:\hhtbnt.exe17⤵
- Executes dropped EXE
PID:2244 -
\??\c:\1dpvd.exec:\1dpvd.exe18⤵
- Executes dropped EXE
PID:532 -
\??\c:\vvpjp.exec:\vvpjp.exe19⤵
- Executes dropped EXE
PID:988 -
\??\c:\xxrxxxr.exec:\xxrxxxr.exe20⤵
- Executes dropped EXE
PID:2864 -
\??\c:\7tnhbt.exec:\7tnhbt.exe21⤵
- Executes dropped EXE
PID:544 -
\??\c:\tnbbnt.exec:\tnbbnt.exe22⤵
- Executes dropped EXE
PID:3068 -
\??\c:\9ppdj.exec:\9ppdj.exe23⤵
- Executes dropped EXE
PID:2920 -
\??\c:\pjvvv.exec:\pjvvv.exe24⤵
- Executes dropped EXE
PID:2932 -
\??\c:\nnhbht.exec:\nnhbht.exe25⤵
- Executes dropped EXE
PID:1100 -
\??\c:\hnhhbh.exec:\hnhhbh.exe26⤵
- Executes dropped EXE
PID:1828 -
\??\c:\nntbhh.exec:\nntbhh.exe27⤵
- Executes dropped EXE
PID:1676 -
\??\c:\3ddjv.exec:\3ddjv.exe28⤵
- Executes dropped EXE
PID:1752 -
\??\c:\nnnhbh.exec:\nnnhbh.exe29⤵
- Executes dropped EXE
PID:900 -
\??\c:\hnbttn.exec:\hnbttn.exe30⤵
- Executes dropped EXE
PID:1672 -
\??\c:\dvjjd.exec:\dvjjd.exe31⤵
- Executes dropped EXE
PID:3000 -
\??\c:\rxfxrrr.exec:\rxfxrrr.exe32⤵
- Executes dropped EXE
PID:348 -
\??\c:\fxrrxxf.exec:\fxrrxxf.exe33⤵
- Executes dropped EXE
PID:2220 -
\??\c:\bbntnn.exec:\bbntnn.exe34⤵
- Executes dropped EXE
PID:1688 -
\??\c:\vpjjp.exec:\vpjjp.exe35⤵
- Executes dropped EXE
PID:2088 -
\??\c:\jvjdp.exec:\jvjdp.exe36⤵
- Executes dropped EXE
PID:2840 -
\??\c:\xrrxfff.exec:\xrrxfff.exe37⤵
- Executes dropped EXE
PID:624 -
\??\c:\rlxflxl.exec:\rlxflxl.exe38⤵
- Executes dropped EXE
PID:2100 -
\??\c:\bthhtt.exec:\bthhtt.exe39⤵
- Executes dropped EXE
PID:2736 -
\??\c:\hhttnn.exec:\hhttnn.exe40⤵
- Executes dropped EXE
PID:2352 -
\??\c:\pjjjv.exec:\pjjjv.exe41⤵
- Executes dropped EXE
PID:2628 -
\??\c:\3ddpj.exec:\3ddpj.exe42⤵
- Executes dropped EXE
PID:2540 -
\??\c:\lfxfflr.exec:\lfxfflr.exe43⤵
- Executes dropped EXE
PID:2748 -
\??\c:\9rrxrxl.exec:\9rrxrxl.exe44⤵
- Executes dropped EXE
PID:2700 -
\??\c:\rlxxffl.exec:\rlxxffl.exe45⤵
- Executes dropped EXE
PID:2564 -
\??\c:\ntbhbt.exec:\ntbhbt.exe46⤵
- Executes dropped EXE
PID:2556 -
\??\c:\dvpvj.exec:\dvpvj.exe47⤵
- Executes dropped EXE
PID:3024 -
\??\c:\5jvdj.exec:\5jvdj.exe48⤵
- Executes dropped EXE
PID:1620 -
\??\c:\xxlxrxf.exec:\xxlxrxf.exe49⤵
- Executes dropped EXE
PID:2572 -
\??\c:\lfrxllr.exec:\lfrxllr.exe50⤵
- Executes dropped EXE
PID:2780 -
\??\c:\3hhthb.exec:\3hhthb.exe51⤵
- Executes dropped EXE
PID:1364 -
\??\c:\5ntbnt.exec:\5ntbnt.exe52⤵
- Executes dropped EXE
PID:1920 -
\??\c:\vdvjd.exec:\vdvjd.exe53⤵
- Executes dropped EXE
PID:2020 -
\??\c:\vppvj.exec:\vppvj.exe54⤵
- Executes dropped EXE
PID:1684 -
\??\c:\lffrfxr.exec:\lffrfxr.exe55⤵
- Executes dropped EXE
PID:2176 -
\??\c:\xxlxflr.exec:\xxlxflr.exe56⤵
- Executes dropped EXE
PID:1644 -
\??\c:\hhhthn.exec:\hhhthn.exe57⤵
- Executes dropped EXE
PID:1756 -
\??\c:\nnbhhh.exec:\nnbhhh.exe58⤵
- Executes dropped EXE
PID:1132 -
\??\c:\vpvdj.exec:\vpvdj.exe59⤵
- Executes dropped EXE
PID:300 -
\??\c:\rrflxlf.exec:\rrflxlf.exe60⤵
- Executes dropped EXE
PID:1840 -
\??\c:\xfxlflx.exec:\xfxlflx.exe61⤵
- Executes dropped EXE
PID:2328 -
\??\c:\pjvvj.exec:\pjvvj.exe62⤵
- Executes dropped EXE
PID:1632 -
\??\c:\vpvvd.exec:\vpvvd.exe63⤵
- Executes dropped EXE
PID:2152 -
\??\c:\fxrrlrx.exec:\fxrrlrx.exe64⤵
- Executes dropped EXE
PID:2312 -
\??\c:\7rfrxfl.exec:\7rfrxfl.exe65⤵
- Executes dropped EXE
PID:2932 -
\??\c:\btnnhh.exec:\btnnhh.exe66⤵PID:3056
-
\??\c:\1httbh.exec:\1httbh.exe67⤵PID:1528
-
\??\c:\5pjjp.exec:\5pjjp.exe68⤵PID:928
-
\??\c:\1ppvj.exec:\1ppvj.exe69⤵PID:2936
-
\??\c:\xlfflrx.exec:\xlfflrx.exe70⤵PID:2284
-
\??\c:\xxxlxff.exec:\xxxlxff.exe71⤵PID:2360
-
\??\c:\btbhbb.exec:\btbhbb.exe72⤵PID:3016
-
\??\c:\7bthnt.exec:\7bthnt.exe73⤵PID:1884
-
\??\c:\jjvjv.exec:\jjvjv.exe74⤵PID:892
-
\??\c:\dppvj.exec:\dppvj.exe75⤵PID:2480
-
\??\c:\fxxlxxl.exec:\fxxlxxl.exe76⤵PID:1056
-
\??\c:\llrfllr.exec:\llrfllr.exe77⤵PID:1868
-
\??\c:\btbbht.exec:\btbbht.exe78⤵PID:2484
-
\??\c:\bthnth.exec:\bthnth.exe79⤵PID:1580
-
\??\c:\jdvdp.exec:\jdvdp.exe80⤵PID:2740
-
\??\c:\jjvdp.exec:\jjvdp.exe81⤵PID:2820
-
\??\c:\rlxxffr.exec:\rlxxffr.exe82⤵PID:2816
-
\??\c:\xxllrrf.exec:\xxllrrf.exe83⤵PID:2828
-
\??\c:\xxflxfx.exec:\xxflxfx.exe84⤵PID:2672
-
\??\c:\bththn.exec:\bththn.exe85⤵PID:2752
-
\??\c:\dvppd.exec:\dvppd.exe86⤵PID:2568
-
\??\c:\3jdpp.exec:\3jdpp.exe87⤵PID:2676
-
\??\c:\dvvvj.exec:\dvvvj.exe88⤵PID:2196
-
\??\c:\rrrxflx.exec:\rrrxflx.exe89⤵PID:1596
-
\??\c:\xxrxlrx.exec:\xxrxlrx.exe90⤵PID:3024
-
\??\c:\bhthtt.exec:\bhthtt.exe91⤵PID:2800
-
\??\c:\nnhttb.exec:\nnhttb.exe92⤵PID:548
-
\??\c:\dpjvv.exec:\dpjvv.exe93⤵PID:2768
-
\??\c:\jdpvd.exec:\jdpvd.exe94⤵PID:1296
-
\??\c:\xrlffff.exec:\xrlffff.exe95⤵PID:2228
-
\??\c:\nnbnbn.exec:\nnbnbn.exe96⤵PID:1808
-
\??\c:\hbnnhn.exec:\hbnnhn.exe97⤵PID:2852
-
\??\c:\jjvjv.exec:\jjvjv.exe98⤵PID:2244
-
\??\c:\3vppd.exec:\3vppd.exe99⤵PID:1156
-
\??\c:\1llxllx.exec:\1llxllx.exe100⤵PID:572
-
\??\c:\ffrrxxf.exec:\ffrrxxf.exe101⤵PID:760
-
\??\c:\hnhtht.exec:\hnhtht.exe102⤵PID:1848
-
\??\c:\hbtbnn.exec:\hbtbnn.exe103⤵PID:2872
-
\??\c:\jjdjv.exec:\jjdjv.exe104⤵PID:2552
-
\??\c:\dvjvd.exec:\dvjvd.exe105⤵PID:2920
-
\??\c:\3xlllxr.exec:\3xlllxr.exe106⤵PID:2856
-
\??\c:\9lflrxl.exec:\9lflrxl.exe107⤵PID:612
-
\??\c:\rlrrffr.exec:\rlrrffr.exe108⤵PID:952
-
\??\c:\7hbbbb.exec:\7hbbbb.exe109⤵PID:1760
-
\??\c:\jdppv.exec:\jdppv.exe110⤵PID:1536
-
\??\c:\jjvvv.exec:\jjvvv.exe111⤵PID:1748
-
\??\c:\5xlrxfx.exec:\5xlrxfx.exe112⤵PID:1904
-
\??\c:\xrrxlrl.exec:\xrrxlrl.exe113⤵PID:692
-
\??\c:\tntbnt.exec:\tntbnt.exe114⤵PID:1944
-
\??\c:\hbtntt.exec:\hbtntt.exe115⤵PID:3000
-
\??\c:\jdvdp.exec:\jdvdp.exe116⤵PID:1484
-
\??\c:\jdpjj.exec:\jdpjj.exe117⤵PID:1452
-
\??\c:\ffrxffr.exec:\ffrxffr.exe118⤵PID:2084
-
\??\c:\rlxxflx.exec:\rlxxflx.exe119⤵PID:1368
-
\??\c:\nnthnt.exec:\nnthnt.exe120⤵PID:2088
-
\??\c:\tbhnhb.exec:\tbhnhb.exe121⤵PID:2840
-
\??\c:\dvjvd.exec:\dvjvd.exe122⤵PID:2656
-
\??\c:\jdpvd.exec:\jdpvd.exe123⤵PID:2100
-
\??\c:\xxxfxxl.exec:\xxxfxxl.exe124⤵PID:2652
-
\??\c:\rlrlxxf.exec:\rlrlxxf.exe125⤵PID:2352
-
\??\c:\nnntnb.exec:\nnntnb.exe126⤵PID:2848
-
\??\c:\nhnbnn.exec:\nhnbnn.exe127⤵PID:2200
-
\??\c:\jdvvp.exec:\jdvvp.exe128⤵PID:2540
-
\??\c:\3xrxffr.exec:\3xrxffr.exe129⤵PID:2700
-
\??\c:\lllxxll.exec:\lllxxll.exe130⤵PID:2564
-
\??\c:\5tnbnt.exec:\5tnbnt.exe131⤵PID:2980
-
\??\c:\tntbnn.exec:\tntbnn.exe132⤵PID:2136
-
\??\c:\jjvpd.exec:\jjvpd.exe133⤵PID:1620
-
\??\c:\llflrxf.exec:\llflrxf.exe134⤵PID:1936
-
\??\c:\xrllrrx.exec:\xrllrrx.exe135⤵PID:2780
-
\??\c:\hbntbb.exec:\hbntbb.exe136⤵PID:2836
-
\??\c:\jvvpv.exec:\jvvpv.exe137⤵PID:1920
-
\??\c:\jjdjp.exec:\jjdjp.exe138⤵PID:2412
-
\??\c:\rfrlxfr.exec:\rfrlxfr.exe139⤵PID:1684
-
\??\c:\ttthbn.exec:\ttthbn.exe140⤵PID:2176
-
\??\c:\1bbnbh.exec:\1bbnbh.exe141⤵PID:1720
-
\??\c:\9pppv.exec:\9pppv.exe142⤵PID:2216
-
\??\c:\dppdv.exec:\dppdv.exe143⤵PID:1132
-
\??\c:\9ffxrlx.exec:\9ffxrlx.exe144⤵PID:632
-
\??\c:\nbttbh.exec:\nbttbh.exe145⤵PID:1840
-
\??\c:\bnhhnt.exec:\bnhhnt.exe146⤵PID:2864
-
\??\c:\ppjdp.exec:\ppjdp.exe147⤵PID:1632
-
\??\c:\9ppjj.exec:\9ppjj.exe148⤵PID:2608
-
\??\c:\fxxrfrf.exec:\fxxrfrf.exe149⤵PID:2312
-
\??\c:\btnnbh.exec:\btnnbh.exe150⤵PID:1316
-
\??\c:\hhnhnb.exec:\hhnhnb.exe151⤵PID:3056
-
\??\c:\pjdjv.exec:\pjdjv.exe152⤵PID:1788
-
\??\c:\lfxrlff.exec:\lfxrlff.exe153⤵PID:928
-
\??\c:\rrlrxlf.exec:\rrlrxlf.exe154⤵PID:1956
-
\??\c:\nhnnbb.exec:\nhnnbb.exe155⤵PID:2284
-
\??\c:\btnnbb.exec:\btnnbb.exe156⤵PID:2272
-
\??\c:\1vppv.exec:\1vppv.exe157⤵PID:3016
-
\??\c:\fxrlflx.exec:\fxrlflx.exe158⤵PID:1780
-
\??\c:\lllllfl.exec:\lllllfl.exe159⤵PID:892
-
\??\c:\tnhbhh.exec:\tnhbhh.exe160⤵PID:884
-
\??\c:\ttnbht.exec:\ttnbht.exe161⤵PID:2116
-
\??\c:\pdjjv.exec:\pdjjv.exe162⤵PID:1688
-
\??\c:\dpdjp.exec:\dpdjp.exe163⤵PID:2484
-
\??\c:\xrffrrf.exec:\xrffrrf.exe164⤵PID:1872
-
\??\c:\btnhtb.exec:\btnhtb.exe165⤵PID:2740
-
\??\c:\9thhnn.exec:\9thhnn.exe166⤵PID:2824
-
\??\c:\dvpjp.exec:\dvpjp.exe167⤵PID:2816
-
\??\c:\vpvjp.exec:\vpvjp.exe168⤵PID:2828
-
\??\c:\1rlxflx.exec:\1rlxflx.exe169⤵PID:2628
-
\??\c:\ttntbh.exec:\ttntbh.exe170⤵PID:2560
-
\??\c:\ntbttb.exec:\ntbttb.exe171⤵PID:2568
-
\??\c:\jdvjj.exec:\jdvjj.exe172⤵PID:2676
-
\??\c:\pppvd.exec:\pppvd.exe173⤵PID:2196
-
\??\c:\3lxlrrf.exec:\3lxlrrf.exe174⤵PID:1596
-
\??\c:\nnhttt.exec:\nnhttt.exe175⤵PID:1192
-
\??\c:\bthhbh.exec:\bthhbh.exe176⤵PID:1620
-
\??\c:\5jjjv.exec:\5jjjv.exe177⤵PID:2572
-
\??\c:\vvddp.exec:\vvddp.exe178⤵PID:2788
-
\??\c:\flrxfrf.exec:\flrxfrf.exe179⤵PID:1296
-
\??\c:\xrrffrr.exec:\xrrffrr.exe180⤵PID:840
-
\??\c:\hnhnbb.exec:\hnhnbb.exe181⤵PID:1808
-
\??\c:\1nnthn.exec:\1nnthn.exe182⤵PID:2020
-
\??\c:\vvddp.exec:\vvddp.exe183⤵PID:1644
-
\??\c:\dvpvd.exec:\dvpvd.exe184⤵PID:2244
-
\??\c:\frrflxf.exec:\frrflxf.exe185⤵PID:572
-
\??\c:\nbhbnt.exec:\nbhbnt.exe186⤵PID:296
-
\??\c:\ppvvj.exec:\ppvvj.exe187⤵PID:2860
-
\??\c:\5ppdv.exec:\5ppdv.exe188⤵PID:2956
-
\??\c:\rrxfxlr.exec:\rrxfxlr.exe189⤵PID:2552
-
\??\c:\bthhnb.exec:\bthhnb.exe190⤵PID:1632
-
\??\c:\bbhhhh.exec:\bbhhhh.exe191⤵PID:2920
-
\??\c:\pvjpd.exec:\pvjpd.exe192⤵PID:2312
-
\??\c:\7vjpv.exec:\7vjpv.exe193⤵PID:564
-
\??\c:\fxrxfxr.exec:\fxrxfxr.exe194⤵PID:3056
-
\??\c:\3fxlrxf.exec:\3fxlrxf.exe195⤵PID:1760
-
\??\c:\9nnbhh.exec:\9nnbhh.exe196⤵PID:1752
-
\??\c:\dvpdj.exec:\dvpdj.exe197⤵PID:1748
-
\??\c:\pvdpv.exec:\pvdpv.exe198⤵PID:2284
-
\??\c:\jdpvd.exec:\jdpvd.exe199⤵PID:2044
-
\??\c:\rlxlxxl.exec:\rlxlxxl.exe200⤵PID:3016
-
\??\c:\nnnnbb.exec:\nnnnbb.exe201⤵PID:2960
-
\??\c:\ttnbhh.exec:\ttnbhh.exe202⤵PID:2056
-
\??\c:\5ddjd.exec:\5ddjd.exe203⤵PID:1452
-
\??\c:\jdvjd.exec:\jdvjd.exe204⤵PID:2116
-
\??\c:\fxxxlrf.exec:\fxxxlrf.exe205⤵PID:1560
-
\??\c:\tnbhhn.exec:\tnbhhn.exe206⤵PID:2484
-
\??\c:\tnhnth.exec:\tnhnth.exe207⤵PID:2840
-
\??\c:\vpvdp.exec:\vpvdp.exe208⤵PID:2740
-
\??\c:\pjvpp.exec:\pjvpp.exe209⤵PID:624
-
\??\c:\ffxfxfr.exec:\ffxfxfr.exe210⤵PID:2816
-
\??\c:\lfxlxfx.exec:\lfxlxfx.exe211⤵PID:2520
-
\??\c:\hbtbtb.exec:\hbtbtb.exe212⤵PID:2628
-
\??\c:\bnbhnn.exec:\bnbhnn.exe213⤵PID:2200
-
\??\c:\ddpdp.exec:\ddpdp.exe214⤵PID:2568
-
\??\c:\pdjjj.exec:\pdjjj.exe215⤵PID:2556
-
\??\c:\xrrfxfr.exec:\xrrfxfr.exe216⤵PID:2196
-
\??\c:\rlxxxfr.exec:\rlxxxfr.exe217⤵PID:1804
-
\??\c:\hnbnbb.exec:\hnbnbb.exe218⤵PID:2136
-
\??\c:\nhtbht.exec:\nhtbht.exe219⤵PID:2772
-
\??\c:\7pjdd.exec:\7pjdd.exe220⤵PID:2572
-
\??\c:\jvjdj.exec:\jvjdj.exe221⤵PID:2780
-
\??\c:\rfrrxxf.exec:\rfrrxxf.exe222⤵PID:2768
-
\??\c:\tnhbhn.exec:\tnhbhn.exe223⤵PID:1920
-
\??\c:\tnbhhh.exec:\tnbhhh.exe224⤵PID:2852
-
\??\c:\3jddp.exec:\3jddp.exe225⤵PID:1684
-
\??\c:\vjvvj.exec:\vjvvj.exe226⤵PID:1488
-
\??\c:\xxlxfrx.exec:\xxlxfrx.exe227⤵PID:800
-
\??\c:\lrfrflr.exec:\lrfrflr.exe228⤵PID:292
-
\??\c:\9hhnbb.exec:\9hhnbb.exe229⤵PID:2876
-
\??\c:\7bthtt.exec:\7bthtt.exe230⤵PID:2304
-
\??\c:\7dvdp.exec:\7dvdp.exe231⤵PID:2956
-
\??\c:\vpddp.exec:\vpddp.exe232⤵PID:2888
-
\??\c:\fxflxll.exec:\fxflxll.exe233⤵PID:2280
-
\??\c:\ttnnbn.exec:\ttnnbn.exe234⤵PID:1632
-
\??\c:\nnhbht.exec:\nnhbht.exe235⤵PID:2372
-
\??\c:\pjvdj.exec:\pjvdj.exe236⤵PID:2312
-
\??\c:\7djjv.exec:\7djjv.exe237⤵PID:1416
-
\??\c:\llfrlfx.exec:\llfrlfx.exe238⤵PID:3056
-
\??\c:\7fffrxl.exec:\7fffrxl.exe239⤵PID:928
-
\??\c:\hthhtn.exec:\hthhtn.exe240⤵PID:1752
-
\??\c:\hbhntt.exec:\hbhntt.exe241⤵PID:808
-
\??\c:\jvjdv.exec:\jvjdv.exe242⤵PID:2148