Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 10:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ead32d5c78a0754c3fe61a24369fe500_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
ead32d5c78a0754c3fe61a24369fe500_NeikiAnalytics.exe
-
Size
94KB
-
MD5
ead32d5c78a0754c3fe61a24369fe500
-
SHA1
e36f372ae49e71616e4b5cec7049ae9b8be25458
-
SHA256
41a50754da5c6b2d7623f4ffa77fc5e6c630270103a1ebcfacfcc6f3155d5c96
-
SHA512
63b2a349f107b2715f89cd5ae63c1d96dbc2a58adab902684808eb7c2622f5129aef21612af4416e6beed4a2cdaa0578efeda4bf4542e126d77307c48907b713
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qP1hvZo66Ox4oq2SQwfTQ/:ymb3NkkiQ3mdBjFIj+qNhvZuHQY0/
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/1908-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2256-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/888-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1416-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1956-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/764-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1564-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1864-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1824-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1752-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1336-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
llxlrfr.exedvjpv.exe3rflxxx.exe5bhtbn.exevjpjv.exexxrxfll.exebhtbbb.exenhbbnn.exe5pvdj.exepdpjp.exexrfrflx.exetbnbtn.exe7jvvd.exevpdjp.exerrfflxf.exelfrlllx.exe3nhhtt.exevvpdv.exelfrxllf.exe1hbhtb.exe7jdpv.exe5pdpd.exexxlrfrl.exetbbnbn.exevjvdp.exevpvpv.exe3lffrrx.exebthbbb.exe1dvdp.exejvvjj.exe7fllrxl.exe9ntnbb.exejdpjv.exe7pjpp.exeddppd.exeffxlxrx.exebtntbb.exebtbbbh.exe3jjdd.exedvppv.exe5fflllr.exe3fxxfrx.exehbnthh.exebhthhb.exevvpvj.exedvjdj.exeffxxfrx.exe9xrlrrf.exe3bbhhh.exebthhnn.exedvjpd.exedvjdj.exerlrxlfr.exe9rlxlrr.exehbttht.exe9tnthn.exepjvjj.exeffxxxfl.exefllllfl.exe9nhbhn.exevpvdj.exepvjpv.exefflllll.exelfrfrxr.exepid process 2256 llxlrfr.exe 3028 dvjpv.exe 2652 3rflxxx.exe 2440 5bhtbn.exe 2536 vjpjv.exe 2488 xxrxfll.exe 2464 bhtbbb.exe 2484 nhbbnn.exe 888 5pvdj.exe 1416 pdpjp.exe 2700 xrfrflx.exe 1956 tbnbtn.exe 764 7jvvd.exe 300 vpdjp.exe 1932 rrfflxf.exe 1564 lfrlllx.exe 1488 3nhhtt.exe 1388 vvpdv.exe 2152 lfrxllf.exe 2416 1hbhtb.exe 2088 7jdpv.exe 484 5pdpd.exe 1864 xxlrfrl.exe 2872 tbbnbn.exe 2328 vjvdp.exe 1824 vpvpv.exe 904 3lffrrx.exe 2896 bthbbb.exe 1752 1dvdp.exe 2148 jvvjj.exe 1336 7fllrxl.exe 1596 9ntnbb.exe 2272 jdpjv.exe 2528 7pjpp.exe 2544 ddppd.exe 2676 ffxlxrx.exe 2948 btntbb.exe 2540 btbbbh.exe 2440 3jjdd.exe 2664 dvppv.exe 2600 5fflllr.exe 2428 3fxxfrx.exe 2608 hbnthh.exe 1744 bhthhb.exe 2408 vvpvj.exe 1660 dvjdj.exe 1416 ffxxfrx.exe 2700 9xrlrrf.exe 2356 3bbhhh.exe 2352 bthhnn.exe 1652 dvjpd.exe 1656 dvjdj.exe 2324 rlrxlfr.exe 1508 9rlxlrr.exe 856 hbttht.exe 1248 9tnthn.exe 2380 pjvjj.exe 1740 ffxxxfl.exe 2416 fllllfl.exe 2788 9nhbhn.exe 672 vpvdj.exe 1484 pvjpv.exe 1092 fflllll.exe 1124 lfrfrxr.exe -
Processes:
resource yara_rule behavioral1/memory/1908-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/888-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1416-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/764-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1564-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1864-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1824-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-283-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1336-301-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ead32d5c78a0754c3fe61a24369fe500_NeikiAnalytics.exellxlrfr.exedvjpv.exe3rflxxx.exe5bhtbn.exevjpjv.exexxrxfll.exebhtbbb.exenhbbnn.exe5pvdj.exepdpjp.exexrfrflx.exetbnbtn.exe7jvvd.exevpdjp.exerrfflxf.exedescription pid process target process PID 1908 wrote to memory of 2256 1908 ead32d5c78a0754c3fe61a24369fe500_NeikiAnalytics.exe llxlrfr.exe PID 1908 wrote to memory of 2256 1908 ead32d5c78a0754c3fe61a24369fe500_NeikiAnalytics.exe llxlrfr.exe PID 1908 wrote to memory of 2256 1908 ead32d5c78a0754c3fe61a24369fe500_NeikiAnalytics.exe llxlrfr.exe PID 1908 wrote to memory of 2256 1908 ead32d5c78a0754c3fe61a24369fe500_NeikiAnalytics.exe llxlrfr.exe PID 2256 wrote to memory of 3028 2256 llxlrfr.exe dvjpv.exe PID 2256 wrote to memory of 3028 2256 llxlrfr.exe dvjpv.exe PID 2256 wrote to memory of 3028 2256 llxlrfr.exe dvjpv.exe PID 2256 wrote to memory of 3028 2256 llxlrfr.exe dvjpv.exe PID 3028 wrote to memory of 2652 3028 dvjpv.exe 3rflxxx.exe PID 3028 wrote to memory of 2652 3028 dvjpv.exe 3rflxxx.exe PID 3028 wrote to memory of 2652 3028 dvjpv.exe 3rflxxx.exe PID 3028 wrote to memory of 2652 3028 dvjpv.exe 3rflxxx.exe PID 2652 wrote to memory of 2440 2652 3rflxxx.exe 5bhtbn.exe PID 2652 wrote to memory of 2440 2652 3rflxxx.exe 5bhtbn.exe PID 2652 wrote to memory of 2440 2652 3rflxxx.exe 5bhtbn.exe PID 2652 wrote to memory of 2440 2652 3rflxxx.exe 5bhtbn.exe PID 2440 wrote to memory of 2536 2440 5bhtbn.exe vjpjv.exe PID 2440 wrote to memory of 2536 2440 5bhtbn.exe vjpjv.exe PID 2440 wrote to memory of 2536 2440 5bhtbn.exe vjpjv.exe PID 2440 wrote to memory of 2536 2440 5bhtbn.exe vjpjv.exe PID 2536 wrote to memory of 2488 2536 vjpjv.exe xxrxfll.exe PID 2536 wrote to memory of 2488 2536 vjpjv.exe xxrxfll.exe PID 2536 wrote to memory of 2488 2536 vjpjv.exe xxrxfll.exe PID 2536 wrote to memory of 2488 2536 vjpjv.exe xxrxfll.exe PID 2488 wrote to memory of 2464 2488 xxrxfll.exe bhtbbb.exe PID 2488 wrote to memory of 2464 2488 xxrxfll.exe bhtbbb.exe PID 2488 wrote to memory of 2464 2488 xxrxfll.exe bhtbbb.exe PID 2488 wrote to memory of 2464 2488 xxrxfll.exe bhtbbb.exe PID 2464 wrote to memory of 2484 2464 bhtbbb.exe nhbbnn.exe PID 2464 wrote to memory of 2484 2464 bhtbbb.exe nhbbnn.exe PID 2464 wrote to memory of 2484 2464 bhtbbb.exe nhbbnn.exe PID 2464 wrote to memory of 2484 2464 bhtbbb.exe nhbbnn.exe PID 2484 wrote to memory of 888 2484 nhbbnn.exe 5pvdj.exe PID 2484 wrote to memory of 888 2484 nhbbnn.exe 5pvdj.exe PID 2484 wrote to memory of 888 2484 nhbbnn.exe 5pvdj.exe PID 2484 wrote to memory of 888 2484 nhbbnn.exe 5pvdj.exe PID 888 wrote to memory of 1416 888 5pvdj.exe pdpjp.exe PID 888 wrote to memory of 1416 888 5pvdj.exe pdpjp.exe PID 888 wrote to memory of 1416 888 5pvdj.exe pdpjp.exe PID 888 wrote to memory of 1416 888 5pvdj.exe pdpjp.exe PID 1416 wrote to memory of 2700 1416 pdpjp.exe xrfrflx.exe PID 1416 wrote to memory of 2700 1416 pdpjp.exe xrfrflx.exe PID 1416 wrote to memory of 2700 1416 pdpjp.exe xrfrflx.exe PID 1416 wrote to memory of 2700 1416 pdpjp.exe xrfrflx.exe PID 2700 wrote to memory of 1956 2700 xrfrflx.exe tbnbtn.exe PID 2700 wrote to memory of 1956 2700 xrfrflx.exe tbnbtn.exe PID 2700 wrote to memory of 1956 2700 xrfrflx.exe tbnbtn.exe PID 2700 wrote to memory of 1956 2700 xrfrflx.exe tbnbtn.exe PID 1956 wrote to memory of 764 1956 tbnbtn.exe 7jvvd.exe PID 1956 wrote to memory of 764 1956 tbnbtn.exe 7jvvd.exe PID 1956 wrote to memory of 764 1956 tbnbtn.exe 7jvvd.exe PID 1956 wrote to memory of 764 1956 tbnbtn.exe 7jvvd.exe PID 764 wrote to memory of 300 764 7jvvd.exe vpdjp.exe PID 764 wrote to memory of 300 764 7jvvd.exe vpdjp.exe PID 764 wrote to memory of 300 764 7jvvd.exe vpdjp.exe PID 764 wrote to memory of 300 764 7jvvd.exe vpdjp.exe PID 300 wrote to memory of 1932 300 vpdjp.exe rrfflxf.exe PID 300 wrote to memory of 1932 300 vpdjp.exe rrfflxf.exe PID 300 wrote to memory of 1932 300 vpdjp.exe rrfflxf.exe PID 300 wrote to memory of 1932 300 vpdjp.exe rrfflxf.exe PID 1932 wrote to memory of 1564 1932 rrfflxf.exe lfrlllx.exe PID 1932 wrote to memory of 1564 1932 rrfflxf.exe lfrlllx.exe PID 1932 wrote to memory of 1564 1932 rrfflxf.exe lfrlllx.exe PID 1932 wrote to memory of 1564 1932 rrfflxf.exe lfrlllx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ead32d5c78a0754c3fe61a24369fe500_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ead32d5c78a0754c3fe61a24369fe500_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\llxlrfr.exec:\llxlrfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\dvjpv.exec:\dvjpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\3rflxxx.exec:\3rflxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\5bhtbn.exec:\5bhtbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\vjpjv.exec:\vjpjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\xxrxfll.exec:\xxrxfll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\bhtbbb.exec:\bhtbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\nhbbnn.exec:\nhbbnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\5pvdj.exec:\5pvdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\pdpjp.exec:\pdpjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\xrfrflx.exec:\xrfrflx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\tbnbtn.exec:\tbnbtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\7jvvd.exec:\7jvvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\vpdjp.exec:\vpdjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:300 -
\??\c:\rrfflxf.exec:\rrfflxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\lfrlllx.exec:\lfrlllx.exe17⤵
- Executes dropped EXE
PID:1564 -
\??\c:\3nhhtt.exec:\3nhhtt.exe18⤵
- Executes dropped EXE
PID:1488 -
\??\c:\vvpdv.exec:\vvpdv.exe19⤵
- Executes dropped EXE
PID:1388 -
\??\c:\lfrxllf.exec:\lfrxllf.exe20⤵
- Executes dropped EXE
PID:2152 -
\??\c:\1hbhtb.exec:\1hbhtb.exe21⤵
- Executes dropped EXE
PID:2416 -
\??\c:\7jdpv.exec:\7jdpv.exe22⤵
- Executes dropped EXE
PID:2088 -
\??\c:\5pdpd.exec:\5pdpd.exe23⤵
- Executes dropped EXE
PID:484 -
\??\c:\xxlrfrl.exec:\xxlrfrl.exe24⤵
- Executes dropped EXE
PID:1864 -
\??\c:\tbbnbn.exec:\tbbnbn.exe25⤵
- Executes dropped EXE
PID:2872 -
\??\c:\vjvdp.exec:\vjvdp.exe26⤵
- Executes dropped EXE
PID:2328 -
\??\c:\vpvpv.exec:\vpvpv.exe27⤵
- Executes dropped EXE
PID:1824 -
\??\c:\3lffrrx.exec:\3lffrrx.exe28⤵
- Executes dropped EXE
PID:904 -
\??\c:\bthbbb.exec:\bthbbb.exe29⤵
- Executes dropped EXE
PID:2896 -
\??\c:\1dvdp.exec:\1dvdp.exe30⤵
- Executes dropped EXE
PID:1752 -
\??\c:\jvvjj.exec:\jvvjj.exe31⤵
- Executes dropped EXE
PID:2148 -
\??\c:\7fllrxl.exec:\7fllrxl.exe32⤵
- Executes dropped EXE
PID:1336 -
\??\c:\9ntnbb.exec:\9ntnbb.exe33⤵
- Executes dropped EXE
PID:1596 -
\??\c:\jdpjv.exec:\jdpjv.exe34⤵
- Executes dropped EXE
PID:2272 -
\??\c:\7pjpp.exec:\7pjpp.exe35⤵
- Executes dropped EXE
PID:2528 -
\??\c:\ddppd.exec:\ddppd.exe36⤵
- Executes dropped EXE
PID:2544 -
\??\c:\ffxlxrx.exec:\ffxlxrx.exe37⤵
- Executes dropped EXE
PID:2676 -
\??\c:\btntbb.exec:\btntbb.exe38⤵
- Executes dropped EXE
PID:2948 -
\??\c:\btbbbh.exec:\btbbbh.exe39⤵
- Executes dropped EXE
PID:2540 -
\??\c:\3jjdd.exec:\3jjdd.exe40⤵
- Executes dropped EXE
PID:2440 -
\??\c:\dvppv.exec:\dvppv.exe41⤵
- Executes dropped EXE
PID:2664 -
\??\c:\5fflllr.exec:\5fflllr.exe42⤵
- Executes dropped EXE
PID:2600 -
\??\c:\3fxxfrx.exec:\3fxxfrx.exe43⤵
- Executes dropped EXE
PID:2428 -
\??\c:\hbnthh.exec:\hbnthh.exe44⤵
- Executes dropped EXE
PID:2608 -
\??\c:\bhthhb.exec:\bhthhb.exe45⤵
- Executes dropped EXE
PID:1744 -
\??\c:\vvpvj.exec:\vvpvj.exe46⤵
- Executes dropped EXE
PID:2408 -
\??\c:\dvjdj.exec:\dvjdj.exe47⤵
- Executes dropped EXE
PID:1660 -
\??\c:\ffxxfrx.exec:\ffxxfrx.exe48⤵
- Executes dropped EXE
PID:1416 -
\??\c:\9xrlrrf.exec:\9xrlrrf.exe49⤵
- Executes dropped EXE
PID:2700 -
\??\c:\3bbhhh.exec:\3bbhhh.exe50⤵
- Executes dropped EXE
PID:2356 -
\??\c:\bthhnn.exec:\bthhnn.exe51⤵
- Executes dropped EXE
PID:2352 -
\??\c:\dvjpd.exec:\dvjpd.exe52⤵
- Executes dropped EXE
PID:1652 -
\??\c:\dvjdj.exec:\dvjdj.exe53⤵
- Executes dropped EXE
PID:1656 -
\??\c:\rlrxlfr.exec:\rlrxlfr.exe54⤵
- Executes dropped EXE
PID:2324 -
\??\c:\9rlxlrr.exec:\9rlxlrr.exe55⤵
- Executes dropped EXE
PID:1508 -
\??\c:\hbttht.exec:\hbttht.exe56⤵
- Executes dropped EXE
PID:856 -
\??\c:\9tnthn.exec:\9tnthn.exe57⤵
- Executes dropped EXE
PID:1248 -
\??\c:\pjvjj.exec:\pjvjj.exe58⤵
- Executes dropped EXE
PID:2380 -
\??\c:\ffxxxfl.exec:\ffxxxfl.exe59⤵
- Executes dropped EXE
PID:1740 -
\??\c:\fllllfl.exec:\fllllfl.exe60⤵
- Executes dropped EXE
PID:2416 -
\??\c:\9nhbhn.exec:\9nhbhn.exe61⤵
- Executes dropped EXE
PID:2788 -
\??\c:\vpvdj.exec:\vpvdj.exe62⤵
- Executes dropped EXE
PID:672 -
\??\c:\pvjpv.exec:\pvjpv.exe63⤵
- Executes dropped EXE
PID:1484 -
\??\c:\fflllll.exec:\fflllll.exe64⤵
- Executes dropped EXE
PID:1092 -
\??\c:\lfrfrxr.exec:\lfrfrxr.exe65⤵
- Executes dropped EXE
PID:1124 -
\??\c:\bthhhn.exec:\bthhhn.exe66⤵PID:940
-
\??\c:\tnhhbb.exec:\tnhhbb.exe67⤵PID:1144
-
\??\c:\vpjdp.exec:\vpjdp.exe68⤵PID:3012
-
\??\c:\1jpdv.exec:\1jpdv.exe69⤵PID:2884
-
\??\c:\rflrxfr.exec:\rflrxfr.exe70⤵PID:2808
-
\??\c:\5bntbn.exec:\5bntbn.exe71⤵PID:572
-
\??\c:\hbbtnn.exec:\hbbtnn.exe72⤵PID:3004
-
\??\c:\1btttn.exec:\1btttn.exe73⤵PID:2812
-
\??\c:\djjpj.exec:\djjpj.exe74⤵PID:1700
-
\??\c:\vjjjj.exec:\vjjjj.exe75⤵PID:2840
-
\??\c:\rlflllf.exec:\rlflllf.exe76⤵PID:2620
-
\??\c:\tnbbhh.exec:\tnbbhh.exe77⤵PID:2624
-
\??\c:\nnbhnh.exec:\nnbhnh.exe78⤵PID:1112
-
\??\c:\vvjpv.exec:\vvjpv.exe79⤵PID:2656
-
\??\c:\dvjvv.exec:\dvjvv.exe80⤵PID:2560
-
\??\c:\rrxxrxr.exec:\rrxxrxr.exe81⤵PID:2616
-
\??\c:\rlxxllr.exec:\rlxxllr.exe82⤵PID:2880
-
\??\c:\hbnntt.exec:\hbnntt.exe83⤵PID:2448
-
\??\c:\9tnbnt.exec:\9tnbnt.exe84⤵PID:2556
-
\??\c:\vjdpp.exec:\vjdpp.exe85⤵PID:2428
-
\??\c:\lxxllxr.exec:\lxxllxr.exe86⤵PID:2480
-
\??\c:\nbbtnn.exec:\nbbtnn.exe87⤵PID:2864
-
\??\c:\1bbttb.exec:\1bbttb.exe88⤵PID:1548
-
\??\c:\jvdpp.exec:\jvdpp.exe89⤵PID:2844
-
\??\c:\dvppv.exec:\dvppv.exe90⤵PID:1968
-
\??\c:\rlxxflr.exec:\rlxxflr.exe91⤵PID:2340
-
\??\c:\tbnbtn.exec:\tbnbtn.exe92⤵PID:2208
-
\??\c:\btbthn.exec:\btbthn.exe93⤵PID:1960
-
\??\c:\pjjvp.exec:\pjjvp.exe94⤵PID:1840
-
\??\c:\vpvpp.exec:\vpvpp.exe95⤵PID:1932
-
\??\c:\xrfflrf.exec:\xrfflrf.exe96⤵PID:1936
-
\??\c:\xrffrxl.exec:\xrffrxl.exe97⤵PID:2072
-
\??\c:\nhbntt.exec:\nhbntt.exe98⤵PID:1208
-
\??\c:\bbbhbb.exec:\bbbhbb.exe99⤵PID:2224
-
\??\c:\jdpdp.exec:\jdpdp.exe100⤵PID:2792
-
\??\c:\dpjvp.exec:\dpjvp.exe101⤵PID:2276
-
\??\c:\9rfrrrr.exec:\9rfrrrr.exe102⤵PID:2236
-
\??\c:\rlxflrx.exec:\rlxflrx.exe103⤵PID:1468
-
\??\c:\xxlrfxl.exec:\xxlrfxl.exe104⤵PID:588
-
\??\c:\1tnbhn.exec:\1tnbhn.exe105⤵PID:1864
-
\??\c:\hbhnth.exec:\hbhnth.exe106⤵PID:1736
-
\??\c:\jjppv.exec:\jjppv.exe107⤵PID:2328
-
\??\c:\dvppj.exec:\dvppj.exe108⤵PID:2132
-
\??\c:\xllxffx.exec:\xllxffx.exe109⤵PID:1780
-
\??\c:\7lrrflx.exec:\7lrrflx.exe110⤵PID:1860
-
\??\c:\5xrffrr.exec:\5xrffrr.exe111⤵PID:3024
-
\??\c:\nhnnnn.exec:\nhnnnn.exe112⤵PID:560
-
\??\c:\rflfxxx.exec:\rflfxxx.exe113⤵PID:2204
-
\??\c:\ffrflll.exec:\ffrflll.exe114⤵PID:2516
-
\??\c:\hhhnbh.exec:\hhhnbh.exe115⤵PID:2212
-
\??\c:\7hbnbt.exec:\7hbnbt.exe116⤵PID:1908
-
\??\c:\pjvvj.exec:\pjvvj.exe117⤵PID:2280
-
\??\c:\dvjpj.exec:\dvjpj.exe118⤵PID:2920
-
\??\c:\frlrxxl.exec:\frlrxxl.exe119⤵PID:2588
-
\??\c:\rllllll.exec:\rllllll.exe120⤵PID:2776
-
\??\c:\1tnbtb.exec:\1tnbtb.exe121⤵PID:2948
-
\??\c:\9tnttn.exec:\9tnttn.exe122⤵PID:2540
-
\??\c:\dvjpv.exec:\dvjpv.exe123⤵PID:2188
-
\??\c:\jddvj.exec:\jddvj.exe124⤵PID:2664
-
\??\c:\1rffrxf.exec:\1rffrxf.exe125⤵PID:2600
-
\??\c:\rrxrxxl.exec:\rrxrxxl.exe126⤵PID:2444
-
\??\c:\xxlrfrx.exec:\xxlrfrx.exe127⤵PID:1040
-
\??\c:\nbnhnt.exec:\nbnhnt.exe128⤵PID:2608
-
\??\c:\tnhtnh.exec:\tnhtnh.exe129⤵PID:1620
-
\??\c:\7vddp.exec:\7vddp.exe130⤵PID:2408
-
\??\c:\5pjdd.exec:\5pjdd.exe131⤵PID:1416
-
\??\c:\3vvjj.exec:\3vvjj.exe132⤵PID:2700
-
\??\c:\rlfflfl.exec:\rlfflfl.exe133⤵PID:1000
-
\??\c:\5xllllr.exec:\5xllllr.exe134⤵PID:2356
-
\??\c:\1htbhh.exec:\1htbhh.exe135⤵PID:1940
-
\??\c:\tnbntb.exec:\tnbntb.exe136⤵PID:1656
-
\??\c:\nhnhhh.exec:\nhnhhh.exe137⤵PID:1516
-
\??\c:\dpjpv.exec:\dpjpv.exe138⤵PID:1508
-
\??\c:\pjddj.exec:\pjddj.exe139⤵PID:2056
-
\??\c:\rlxfflr.exec:\rlxfflr.exe140⤵PID:1248
-
\??\c:\llfllrl.exec:\llfllrl.exe141⤵PID:1276
-
\??\c:\bntttb.exec:\bntttb.exe142⤵PID:2792
-
\??\c:\nbnhht.exec:\nbnhht.exe143⤵PID:2088
-
\??\c:\5jddd.exec:\5jddd.exe144⤵PID:2788
-
\??\c:\1dpjj.exec:\1dpjj.exe145⤵PID:608
-
\??\c:\lxflxxf.exec:\lxflxxf.exe146⤵PID:1484
-
\??\c:\xxflrrf.exec:\xxflrrf.exe147⤵PID:1092
-
\??\c:\bnbbhb.exec:\bnbbhb.exe148⤵PID:452
-
\??\c:\3nhbtb.exec:\3nhbtb.exe149⤵PID:940
-
\??\c:\btbnnh.exec:\btbnnh.exe150⤵PID:1784
-
\??\c:\dpddj.exec:\dpddj.exe151⤵PID:2832
-
\??\c:\5dvdp.exec:\5dvdp.exe152⤵PID:2820
-
\??\c:\jdjpv.exec:\jdjpv.exe153⤵PID:2808
-
\??\c:\rlrrxrx.exec:\rlrrxrx.exe154⤵PID:840
-
\??\c:\fxllrrf.exec:\fxllrrf.exe155⤵PID:3004
-
\??\c:\hhtnht.exec:\hhtnht.exe156⤵PID:2812
-
\??\c:\btntbh.exec:\btntbh.exe157⤵PID:1700
-
\??\c:\dpvpp.exec:\dpvpp.exe158⤵PID:2840
-
\??\c:\3djjj.exec:\3djjj.exe159⤵PID:2528
-
\??\c:\fxllrlx.exec:\fxllrlx.exe160⤵PID:2624
-
\??\c:\ttnbbt.exec:\ttnbbt.exe161⤵PID:1112
-
\??\c:\7nthnb.exec:\7nthnb.exe162⤵PID:2656
-
\??\c:\pvvjp.exec:\pvvjp.exe163⤵PID:2560
-
\??\c:\1xffrlf.exec:\1xffrlf.exe164⤵PID:2616
-
\??\c:\frxrxfx.exec:\frxrxfx.exe165⤵PID:2880
-
\??\c:\1dppj.exec:\1dppj.exe166⤵PID:2448
-
\??\c:\7vvjj.exec:\7vvjj.exe167⤵PID:1712
-
\??\c:\5lfflrr.exec:\5lfflrr.exe168⤵PID:2428
-
\??\c:\1ntbhb.exec:\1ntbhb.exe169⤵PID:1744
-
\??\c:\vpdpd.exec:\vpdpd.exe170⤵PID:2864
-
\??\c:\5pvdj.exec:\5pvdj.exe171⤵PID:1660
-
\??\c:\frxxrrl.exec:\frxxrrl.exe172⤵PID:2844
-
\??\c:\ntnhtt.exec:\ntnhtt.exe173⤵PID:1968
-
\??\c:\vdjvd.exec:\vdjvd.exe174⤵PID:2340
-
\??\c:\xxxlfxf.exec:\xxxlfxf.exe175⤵PID:2352
-
\??\c:\ttntbn.exec:\ttntbn.exe176⤵PID:2208
-
\??\c:\pppdj.exec:\pppdj.exe177⤵PID:2220
-
\??\c:\fflflxl.exec:\fflflxl.exe178⤵PID:1932
-
\??\c:\tntnnt.exec:\tntnnt.exe179⤵PID:1516
-
\??\c:\3htntb.exec:\3htntb.exe180⤵PID:2072
-
\??\c:\pjvpv.exec:\pjvpv.exe181⤵PID:1208
-
\??\c:\pdppj.exec:\pdppj.exe182⤵PID:828
-
\??\c:\rlrrrfr.exec:\rlrrrfr.exe183⤵PID:1740
-
\??\c:\3ddjp.exec:\3ddjp.exe184⤵PID:2180
-
\??\c:\5fxlrfl.exec:\5fxlrfl.exe185⤵PID:2416
-
\??\c:\nhtntb.exec:\nhtntb.exe186⤵PID:580
-
\??\c:\hnbbhh.exec:\hnbbhh.exe187⤵PID:808
-
\??\c:\tnhnbn.exec:\tnhnbn.exe188⤵PID:1484
-
\??\c:\pdpvj.exec:\pdpvj.exe189⤵PID:1088
-
\??\c:\9llffff.exec:\9llffff.exe190⤵PID:2328
-
\??\c:\7rlrxxf.exec:\7rlrxxf.exe191⤵PID:2976
-
\??\c:\thttbh.exec:\thttbh.exe192⤵PID:948
-
\??\c:\nhbhhh.exec:\nhbhhh.exe193⤵PID:688
-
\??\c:\dvdvd.exec:\dvdvd.exe194⤵PID:3012
-
\??\c:\1dddj.exec:\1dddj.exe195⤵PID:2308
-
\??\c:\llxfxxf.exec:\llxfxxf.exe196⤵PID:572
-
\??\c:\nbtnnt.exec:\nbtnnt.exe197⤵PID:1788
-
\??\c:\bththh.exec:\bththh.exe198⤵PID:2756
-
\??\c:\7ntnbh.exec:\7ntnbh.exe199⤵PID:2816
-
\??\c:\jjvpp.exec:\jjvpp.exe200⤵PID:1280
-
\??\c:\fxrxffl.exec:\fxrxffl.exe201⤵PID:2388
-
\??\c:\llrxlll.exec:\llrxlll.exe202⤵PID:2620
-
\??\c:\hbthbh.exec:\hbthbh.exe203⤵PID:1112
-
\??\c:\thtbhn.exec:\thtbhn.exe204⤵PID:2544
-
\??\c:\pjjjj.exec:\pjjjj.exe205⤵PID:2680
-
\??\c:\vpvvd.exec:\vpvvd.exe206⤵PID:2628
-
\??\c:\dvdpj.exec:\dvdpj.exe207⤵PID:1748
-
\??\c:\flrllxf.exec:\flrllxf.exe208⤵PID:2448
-
\??\c:\rlxfrfr.exec:\rlxfrfr.exe209⤵PID:2708
-
\??\c:\nhbhtb.exec:\nhbhtb.exe210⤵PID:2428
-
\??\c:\hbtbnt.exec:\hbtbnt.exe211⤵PID:1744
-
\??\c:\ddvvj.exec:\ddvvj.exe212⤵PID:1540
-
\??\c:\9jjpv.exec:\9jjpv.exe213⤵PID:1624
-
\??\c:\rlffllr.exec:\rlffllr.exe214⤵PID:400
-
\??\c:\xxxflrf.exec:\xxxflrf.exe215⤵PID:2524
-
\??\c:\tnbtbh.exec:\tnbtbh.exe216⤵PID:2836
-
\??\c:\nbbbnb.exec:\nbbbnb.exe217⤵PID:2960
-
\??\c:\dvpdv.exec:\dvpdv.exe218⤵PID:2208
-
\??\c:\pvdpp.exec:\pvdpp.exe219⤵PID:1940
-
\??\c:\1rxfflx.exec:\1rxfflx.exe220⤵PID:2196
-
\??\c:\fxrrxxf.exec:\fxrrxxf.exe221⤵PID:1432
-
\??\c:\fxrrflx.exec:\fxrrflx.exe222⤵PID:1152
-
\??\c:\bbtbnn.exec:\bbtbnn.exe223⤵PID:2688
-
\??\c:\djjdd.exec:\djjdd.exe224⤵PID:856
-
\??\c:\vvppv.exec:\vvppv.exe225⤵PID:2024
-
\??\c:\7rrxlrf.exec:\7rrxlrf.exe226⤵PID:2392
-
\??\c:\nbttbb.exec:\nbttbb.exe227⤵PID:2980
-
\??\c:\nnnnnt.exec:\nnnnnt.exe228⤵PID:2416
-
\??\c:\3jdvj.exec:\3jdvj.exe229⤵PID:588
-
\??\c:\vvpvd.exec:\vvpvd.exe230⤵PID:808
-
\??\c:\rxllffr.exec:\rxllffr.exe231⤵PID:1484
-
\??\c:\rrxxflr.exec:\rrxxflr.exe232⤵PID:1088
-
\??\c:\nbbbhh.exec:\nbbbhh.exe233⤵PID:1124
-
\??\c:\bnbhnt.exec:\bnbhnt.exe234⤵PID:940
-
\??\c:\3vpvd.exec:\3vpvd.exe235⤵PID:948
-
\??\c:\xxxfffl.exec:\xxxfffl.exe236⤵PID:688
-
\??\c:\fffxrxr.exec:\fffxrxr.exe237⤵PID:876
-
\??\c:\ttbhtt.exec:\ttbhtt.exe238⤵PID:2308
-
\??\c:\djdpv.exec:\djdpv.exe239⤵PID:572
-
\??\c:\jjdjp.exec:\jjdjp.exe240⤵PID:1996
-
\??\c:\flxxlrx.exec:\flxxlrx.exe241⤵PID:2256
-
\??\c:\rlffrrx.exec:\rlffrrx.exe242⤵PID:2816