Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 06:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0ea57f855bd5ce895bc87519588edeacfbcdd859f2acfea278013bd17f68b0ad_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0ea57f855bd5ce895bc87519588edeacfbcdd859f2acfea278013bd17f68b0ad_NeikiAnalytics.exe
-
Size
70KB
-
MD5
1488de7775fdcf49c50f2fee54027730
-
SHA1
3cdeecdf8b8d06c2c3ade21a9cb0f0154adfdff0
-
SHA256
0ea57f855bd5ce895bc87519588edeacfbcdd859f2acfea278013bd17f68b0ad
-
SHA512
ce56818471e9499ac8deb7d828eb8711f8275d578d447897bbf3ad5db1514a9c460c0cf66458f3389cf1597c31cb6d202b168cea425e9fdc617a3757cc2f5d35
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73tgyYrv:ymb3NkkiQ3mdBjFo73thYD
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/2008-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1184-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2508-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1484-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2108-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2868-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1280-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2184-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1196-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/664-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1544-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1312-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1332-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
5bbhnt.exevvpdd.exehbttbn.exebthnnt.exejjppv.exe5llrlxf.exe7bbnth.exetbnnhb.exeffffffl.exexflxfxr.exennbnhn.exejdpvj.exedvjpj.exexfflxfr.exettnbnb.exethbtbh.exeddvjj.exexrrfxlx.exe9nnnbt.exehbtttt.exeppjvd.exedvpvp.exexrrxflr.exe9bhntn.exevpjvj.exevvpdd.exexrlfxlr.exehbnthh.exejpjvp.exevdjdj.exe5fxxllx.exebbthtb.exevvdjd.exe7dpvd.exe9rfxlrx.exetnbtbb.exe3pjjp.exe3jdvj.exepjjjj.exe9fxfflx.exebnnhhn.exevvvdd.exedjjpp.exerfrffrx.exefrxrrll.exe3hbnbn.exe9ppdp.exevpdjv.exe5fxxlrf.exe3rfxrrl.exehhbtnb.exe1jvvd.exerlxflxl.exelflxlrl.exe7flxfff.exetnhhtt.exeppjdp.exevvvdv.exeflrlrxl.exelllfrfl.exe9tbhtt.exetnhbbh.exevvjpj.exevvvpv.exepid process 1184 5bbhnt.exe 2596 vvpdd.exe 2672 hbttbn.exe 2652 bthnnt.exe 2752 jjppv.exe 2564 5llrlxf.exe 2508 7bbnth.exe 1964 tbnnhb.exe 1484 ffffffl.exe 1368 xflxfxr.exe 2740 nnbnhn.exe 2116 jdpvj.exe 1648 dvjpj.exe 2108 xfflxfr.exe 2756 ttnbnb.exe 2868 thbtbh.exe 1280 ddvjj.exe 2864 xrrfxlx.exe 2184 9nnnbt.exe 1196 hbtttt.exe 664 ppjvd.exe 1544 dvpvp.exe 1784 xrrxflr.exe 1312 9bhntn.exe 848 vpjvj.exe 1228 vvpdd.exe 1332 xrlfxlr.exe 1752 hbnthh.exe 644 jpjvp.exe 1948 vdjdj.exe 2848 5fxxllx.exe 872 bbthtb.exe 2356 vvdjd.exe 1744 7dpvd.exe 1184 9rfxlrx.exe 3060 tnbtbb.exe 2696 3pjjp.exe 2596 3jdvj.exe 2708 pjjjj.exe 2744 9fxfflx.exe 2624 bnnhhn.exe 2452 vvvdd.exe 2572 djjpp.exe 2516 rfrffrx.exe 108 frxrrll.exe 1964 3hbnbn.exe 1484 9ppdp.exe 2640 vpdjv.exe 2540 5fxxlrf.exe 908 3rfxrrl.exe 1836 hhbtnb.exe 344 1jvvd.exe 2244 rlxflxl.exe 2092 lflxlrl.exe 1424 7flxfff.exe 2924 tnhhtt.exe 2876 ppjdp.exe 2220 vvvdv.exe 2184 flrlrxl.exe 2296 lllfrfl.exe 572 9tbhtt.exe 880 tnhbbh.exe 2552 vvjpj.exe 1784 vvvpv.exe -
Processes:
resource yara_rule behavioral1/memory/2008-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1184-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1964-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1964-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1964-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1484-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1280-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1196-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/664-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1544-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1312-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1332-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-288-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0ea57f855bd5ce895bc87519588edeacfbcdd859f2acfea278013bd17f68b0ad_NeikiAnalytics.exe5bbhnt.exevvpdd.exehbttbn.exebthnnt.exejjppv.exe5llrlxf.exe7bbnth.exetbnnhb.exeffffffl.exexflxfxr.exennbnhn.exejdpvj.exedvjpj.exexfflxfr.exettnbnb.exedescription pid process target process PID 2008 wrote to memory of 1184 2008 0ea57f855bd5ce895bc87519588edeacfbcdd859f2acfea278013bd17f68b0ad_NeikiAnalytics.exe 5bbhnt.exe PID 2008 wrote to memory of 1184 2008 0ea57f855bd5ce895bc87519588edeacfbcdd859f2acfea278013bd17f68b0ad_NeikiAnalytics.exe 5bbhnt.exe PID 2008 wrote to memory of 1184 2008 0ea57f855bd5ce895bc87519588edeacfbcdd859f2acfea278013bd17f68b0ad_NeikiAnalytics.exe 5bbhnt.exe PID 2008 wrote to memory of 1184 2008 0ea57f855bd5ce895bc87519588edeacfbcdd859f2acfea278013bd17f68b0ad_NeikiAnalytics.exe 5bbhnt.exe PID 1184 wrote to memory of 2596 1184 5bbhnt.exe vvpdd.exe PID 1184 wrote to memory of 2596 1184 5bbhnt.exe vvpdd.exe PID 1184 wrote to memory of 2596 1184 5bbhnt.exe vvpdd.exe PID 1184 wrote to memory of 2596 1184 5bbhnt.exe vvpdd.exe PID 2596 wrote to memory of 2672 2596 vvpdd.exe hbttbn.exe PID 2596 wrote to memory of 2672 2596 vvpdd.exe hbttbn.exe PID 2596 wrote to memory of 2672 2596 vvpdd.exe hbttbn.exe PID 2596 wrote to memory of 2672 2596 vvpdd.exe hbttbn.exe PID 2672 wrote to memory of 2652 2672 hbttbn.exe bthnnt.exe PID 2672 wrote to memory of 2652 2672 hbttbn.exe bthnnt.exe PID 2672 wrote to memory of 2652 2672 hbttbn.exe bthnnt.exe PID 2672 wrote to memory of 2652 2672 hbttbn.exe bthnnt.exe PID 2652 wrote to memory of 2752 2652 bthnnt.exe jjppv.exe PID 2652 wrote to memory of 2752 2652 bthnnt.exe jjppv.exe PID 2652 wrote to memory of 2752 2652 bthnnt.exe jjppv.exe PID 2652 wrote to memory of 2752 2652 bthnnt.exe jjppv.exe PID 2752 wrote to memory of 2564 2752 jjppv.exe 5llrlxf.exe PID 2752 wrote to memory of 2564 2752 jjppv.exe 5llrlxf.exe PID 2752 wrote to memory of 2564 2752 jjppv.exe 5llrlxf.exe PID 2752 wrote to memory of 2564 2752 jjppv.exe 5llrlxf.exe PID 2564 wrote to memory of 2508 2564 5llrlxf.exe 7bbnth.exe PID 2564 wrote to memory of 2508 2564 5llrlxf.exe 7bbnth.exe PID 2564 wrote to memory of 2508 2564 5llrlxf.exe 7bbnth.exe PID 2564 wrote to memory of 2508 2564 5llrlxf.exe 7bbnth.exe PID 2508 wrote to memory of 1964 2508 7bbnth.exe tbnnhb.exe PID 2508 wrote to memory of 1964 2508 7bbnth.exe tbnnhb.exe PID 2508 wrote to memory of 1964 2508 7bbnth.exe tbnnhb.exe PID 2508 wrote to memory of 1964 2508 7bbnth.exe tbnnhb.exe PID 1964 wrote to memory of 1484 1964 tbnnhb.exe ffffffl.exe PID 1964 wrote to memory of 1484 1964 tbnnhb.exe ffffffl.exe PID 1964 wrote to memory of 1484 1964 tbnnhb.exe ffffffl.exe PID 1964 wrote to memory of 1484 1964 tbnnhb.exe ffffffl.exe PID 1484 wrote to memory of 1368 1484 ffffffl.exe xflxfxr.exe PID 1484 wrote to memory of 1368 1484 ffffffl.exe xflxfxr.exe PID 1484 wrote to memory of 1368 1484 ffffffl.exe xflxfxr.exe PID 1484 wrote to memory of 1368 1484 ffffffl.exe xflxfxr.exe PID 1368 wrote to memory of 2740 1368 xflxfxr.exe nnbnhn.exe PID 1368 wrote to memory of 2740 1368 xflxfxr.exe nnbnhn.exe PID 1368 wrote to memory of 2740 1368 xflxfxr.exe nnbnhn.exe PID 1368 wrote to memory of 2740 1368 xflxfxr.exe nnbnhn.exe PID 2740 wrote to memory of 2116 2740 nnbnhn.exe jdpvj.exe PID 2740 wrote to memory of 2116 2740 nnbnhn.exe jdpvj.exe PID 2740 wrote to memory of 2116 2740 nnbnhn.exe jdpvj.exe PID 2740 wrote to memory of 2116 2740 nnbnhn.exe jdpvj.exe PID 2116 wrote to memory of 1648 2116 jdpvj.exe dvjpj.exe PID 2116 wrote to memory of 1648 2116 jdpvj.exe dvjpj.exe PID 2116 wrote to memory of 1648 2116 jdpvj.exe dvjpj.exe PID 2116 wrote to memory of 1648 2116 jdpvj.exe dvjpj.exe PID 1648 wrote to memory of 2108 1648 dvjpj.exe xfflxfr.exe PID 1648 wrote to memory of 2108 1648 dvjpj.exe xfflxfr.exe PID 1648 wrote to memory of 2108 1648 dvjpj.exe xfflxfr.exe PID 1648 wrote to memory of 2108 1648 dvjpj.exe xfflxfr.exe PID 2108 wrote to memory of 2756 2108 xfflxfr.exe ttnbnb.exe PID 2108 wrote to memory of 2756 2108 xfflxfr.exe ttnbnb.exe PID 2108 wrote to memory of 2756 2108 xfflxfr.exe ttnbnb.exe PID 2108 wrote to memory of 2756 2108 xfflxfr.exe ttnbnb.exe PID 2756 wrote to memory of 2868 2756 ttnbnb.exe thbtbh.exe PID 2756 wrote to memory of 2868 2756 ttnbnb.exe thbtbh.exe PID 2756 wrote to memory of 2868 2756 ttnbnb.exe thbtbh.exe PID 2756 wrote to memory of 2868 2756 ttnbnb.exe thbtbh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ea57f855bd5ce895bc87519588edeacfbcdd859f2acfea278013bd17f68b0ad_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0ea57f855bd5ce895bc87519588edeacfbcdd859f2acfea278013bd17f68b0ad_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\5bbhnt.exec:\5bbhnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\vvpdd.exec:\vvpdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\hbttbn.exec:\hbttbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\bthnnt.exec:\bthnnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\jjppv.exec:\jjppv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\5llrlxf.exec:\5llrlxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\7bbnth.exec:\7bbnth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\tbnnhb.exec:\tbnnhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\ffffffl.exec:\ffffffl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\xflxfxr.exec:\xflxfxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\nnbnhn.exec:\nnbnhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\jdpvj.exec:\jdpvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\dvjpj.exec:\dvjpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\xfflxfr.exec:\xfflxfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\ttnbnb.exec:\ttnbnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\thbtbh.exec:\thbtbh.exe17⤵
- Executes dropped EXE
PID:2868 -
\??\c:\ddvjj.exec:\ddvjj.exe18⤵
- Executes dropped EXE
PID:1280 -
\??\c:\xrrfxlx.exec:\xrrfxlx.exe19⤵
- Executes dropped EXE
PID:2864 -
\??\c:\9nnnbt.exec:\9nnnbt.exe20⤵
- Executes dropped EXE
PID:2184 -
\??\c:\hbtttt.exec:\hbtttt.exe21⤵
- Executes dropped EXE
PID:1196 -
\??\c:\ppjvd.exec:\ppjvd.exe22⤵
- Executes dropped EXE
PID:664 -
\??\c:\dvpvp.exec:\dvpvp.exe23⤵
- Executes dropped EXE
PID:1544 -
\??\c:\xrrxflr.exec:\xrrxflr.exe24⤵
- Executes dropped EXE
PID:1784 -
\??\c:\9bhntn.exec:\9bhntn.exe25⤵
- Executes dropped EXE
PID:1312 -
\??\c:\vpjvj.exec:\vpjvj.exe26⤵
- Executes dropped EXE
PID:848 -
\??\c:\vvpdd.exec:\vvpdd.exe27⤵
- Executes dropped EXE
PID:1228 -
\??\c:\xrlfxlr.exec:\xrlfxlr.exe28⤵
- Executes dropped EXE
PID:1332 -
\??\c:\hbnthh.exec:\hbnthh.exe29⤵
- Executes dropped EXE
PID:1752 -
\??\c:\jpjvp.exec:\jpjvp.exe30⤵
- Executes dropped EXE
PID:644 -
\??\c:\vdjdj.exec:\vdjdj.exe31⤵
- Executes dropped EXE
PID:1948 -
\??\c:\5fxxllx.exec:\5fxxllx.exe32⤵
- Executes dropped EXE
PID:2848 -
\??\c:\bbthtb.exec:\bbthtb.exe33⤵
- Executes dropped EXE
PID:872 -
\??\c:\vvdjd.exec:\vvdjd.exe34⤵
- Executes dropped EXE
PID:2356 -
\??\c:\7dpvd.exec:\7dpvd.exe35⤵
- Executes dropped EXE
PID:1744 -
\??\c:\9llrlrf.exec:\9llrlrf.exe36⤵PID:2544
-
\??\c:\9rfxlrx.exec:\9rfxlrx.exe37⤵
- Executes dropped EXE
PID:1184 -
\??\c:\tnbtbb.exec:\tnbtbb.exe38⤵
- Executes dropped EXE
PID:3060 -
\??\c:\3pjjp.exec:\3pjjp.exe39⤵
- Executes dropped EXE
PID:2696 -
\??\c:\3jdvj.exec:\3jdvj.exe40⤵
- Executes dropped EXE
PID:2596 -
\??\c:\pjjjj.exec:\pjjjj.exe41⤵
- Executes dropped EXE
PID:2708 -
\??\c:\9fxfflx.exec:\9fxfflx.exe42⤵
- Executes dropped EXE
PID:2744 -
\??\c:\bnnhhn.exec:\bnnhhn.exe43⤵
- Executes dropped EXE
PID:2624 -
\??\c:\vvvdd.exec:\vvvdd.exe44⤵
- Executes dropped EXE
PID:2452 -
\??\c:\djjpp.exec:\djjpp.exe45⤵
- Executes dropped EXE
PID:2572 -
\??\c:\rfrffrx.exec:\rfrffrx.exe46⤵
- Executes dropped EXE
PID:2516 -
\??\c:\frxrrll.exec:\frxrrll.exe47⤵
- Executes dropped EXE
PID:108 -
\??\c:\3hbnbn.exec:\3hbnbn.exe48⤵
- Executes dropped EXE
PID:1964 -
\??\c:\9ppdp.exec:\9ppdp.exe49⤵
- Executes dropped EXE
PID:1484 -
\??\c:\vpdjv.exec:\vpdjv.exe50⤵
- Executes dropped EXE
PID:2640 -
\??\c:\5fxxlrf.exec:\5fxxlrf.exe51⤵
- Executes dropped EXE
PID:2540 -
\??\c:\3rfxrrl.exec:\3rfxrrl.exe52⤵
- Executes dropped EXE
PID:908 -
\??\c:\hhbtnb.exec:\hhbtnb.exe53⤵
- Executes dropped EXE
PID:1836 -
\??\c:\1jvvd.exec:\1jvvd.exe54⤵
- Executes dropped EXE
PID:344 -
\??\c:\rlxflxl.exec:\rlxflxl.exe55⤵
- Executes dropped EXE
PID:2244 -
\??\c:\lflxlrl.exec:\lflxlrl.exe56⤵
- Executes dropped EXE
PID:2092 -
\??\c:\7flxfff.exec:\7flxfff.exe57⤵
- Executes dropped EXE
PID:1424 -
\??\c:\tnhhtt.exec:\tnhhtt.exe58⤵
- Executes dropped EXE
PID:2924 -
\??\c:\ppjdp.exec:\ppjdp.exe59⤵
- Executes dropped EXE
PID:2876 -
\??\c:\vvvdv.exec:\vvvdv.exe60⤵
- Executes dropped EXE
PID:2220 -
\??\c:\flrlrxl.exec:\flrlrxl.exe61⤵
- Executes dropped EXE
PID:2184 -
\??\c:\lllfrfl.exec:\lllfrfl.exe62⤵
- Executes dropped EXE
PID:2296 -
\??\c:\9tbhtt.exec:\9tbhtt.exe63⤵
- Executes dropped EXE
PID:572 -
\??\c:\tnhbbh.exec:\tnhbbh.exe64⤵
- Executes dropped EXE
PID:880 -
\??\c:\vvjpj.exec:\vvjpj.exe65⤵
- Executes dropped EXE
PID:2552 -
\??\c:\vvvpv.exec:\vvvpv.exe66⤵
- Executes dropped EXE
PID:1784 -
\??\c:\fxrxlrx.exec:\fxrxlrx.exe67⤵PID:2364
-
\??\c:\rxrffrf.exec:\rxrffrf.exe68⤵PID:2100
-
\??\c:\nbhthn.exec:\nbhthn.exe69⤵PID:1700
-
\??\c:\hhntht.exec:\hhntht.exe70⤵PID:924
-
\??\c:\jddjv.exec:\jddjv.exe71⤵PID:1552
-
\??\c:\jjdvj.exec:\jjdvj.exe72⤵PID:2288
-
\??\c:\fxlrrrx.exec:\fxlrrrx.exe73⤵PID:2840
-
\??\c:\hbtntt.exec:\hbtntt.exe74⤵PID:1968
-
\??\c:\3tthtt.exec:\3tthtt.exe75⤵PID:1948
-
\??\c:\jdpjj.exec:\jdpjj.exe76⤵PID:2432
-
\??\c:\pdvvj.exec:\pdvvj.exe77⤵PID:2360
-
\??\c:\7xrlxxr.exec:\7xrlxxr.exe78⤵PID:1940
-
\??\c:\lfrxllx.exec:\lfrxllx.exe79⤵PID:1924
-
\??\c:\bbnhnt.exec:\bbnhnt.exe80⤵PID:2732
-
\??\c:\btthnt.exec:\btthnt.exe81⤵PID:1500
-
\??\c:\5jpdj.exec:\5jpdj.exe82⤵PID:3060
-
\??\c:\5ddvp.exec:\5ddvp.exe83⤵PID:2700
-
\??\c:\xxrxfrl.exec:\xxrxfrl.exe84⤵PID:2796
-
\??\c:\rrflllx.exec:\rrflllx.exe85⤵PID:2656
-
\??\c:\9lfrlrf.exec:\9lfrlrf.exe86⤵PID:2744
-
\??\c:\nhthbh.exec:\nhthbh.exe87⤵PID:1652
-
\??\c:\7ppjd.exec:\7ppjd.exe88⤵PID:2444
-
\??\c:\jdvvd.exec:\jdvvd.exe89⤵PID:2028
-
\??\c:\flrxlff.exec:\flrxlff.exe90⤵PID:1884
-
\??\c:\hhbhht.exec:\hhbhht.exe91⤵PID:2124
-
\??\c:\bbhbht.exec:\bbhbht.exe92⤵PID:1964
-
\??\c:\9djpv.exec:\9djpv.exe93⤵PID:1368
-
\??\c:\pjddv.exec:\pjddv.exe94⤵PID:1860
-
\??\c:\5xfrxlx.exec:\5xfrxlx.exe95⤵PID:2104
-
\??\c:\3lrrxrr.exec:\3lrrxrr.exe96⤵PID:1020
-
\??\c:\5nbhnh.exec:\5nbhnh.exe97⤵PID:1840
-
\??\c:\ttthth.exec:\ttthth.exe98⤵PID:2108
-
\??\c:\5jddv.exec:\5jddv.exe99⤵PID:2244
-
\??\c:\ddjdp.exec:\ddjdp.exe100⤵PID:1372
-
\??\c:\fxxfrfr.exec:\fxxfrfr.exe101⤵PID:620
-
\??\c:\3bbhth.exec:\3bbhth.exe102⤵PID:2924
-
\??\c:\ttntbb.exec:\ttntbb.exe103⤵PID:2852
-
\??\c:\dvpdp.exec:\dvpdp.exe104⤵PID:2212
-
\??\c:\vpjpj.exec:\vpjpj.exe105⤵PID:1896
-
\??\c:\lxrxrxr.exec:\lxrxrxr.exe106⤵PID:2296
-
\??\c:\llffxxf.exec:\llffxxf.exe107⤵PID:1104
-
\??\c:\hbnbbb.exec:\hbnbbb.exe108⤵PID:880
-
\??\c:\tnhbbh.exec:\tnhbbh.exe109⤵PID:2812
-
\??\c:\ddvjv.exec:\ddvjv.exe110⤵PID:2420
-
\??\c:\vppvd.exec:\vppvd.exe111⤵PID:112
-
\??\c:\pjdjj.exec:\pjdjj.exe112⤵PID:2100
-
\??\c:\lllflrl.exec:\lllflrl.exe113⤵PID:1572
-
\??\c:\ffxlfrf.exec:\ffxlfrf.exe114⤵PID:924
-
\??\c:\tnhntb.exec:\tnhntb.exe115⤵PID:2380
-
\??\c:\ttttbb.exec:\ttttbb.exe116⤵PID:752
-
\??\c:\dddjj.exec:\dddjj.exe117⤵PID:556
-
\??\c:\rrfxllx.exec:\rrfxllx.exe118⤵PID:1968
-
\??\c:\xxfxlxf.exec:\xxfxlxf.exe119⤵PID:2536
-
\??\c:\5bnthh.exec:\5bnthh.exe120⤵PID:2432
-
\??\c:\9ntnbh.exec:\9ntnbh.exe121⤵PID:2356
-
\??\c:\7vjjp.exec:\7vjjp.exe122⤵PID:1940
-
\??\c:\vdvvd.exec:\vdvvd.exe123⤵PID:1744
-
\??\c:\fxrxflx.exec:\fxrxflx.exe124⤵PID:2668
-
\??\c:\lfxrlxr.exec:\lfxrlxr.exe125⤵PID:2592
-
\??\c:\bnthbh.exec:\bnthbh.exe126⤵PID:2600
-
\??\c:\tbttbn.exec:\tbttbn.exe127⤵PID:2568
-
\??\c:\jvpjj.exec:\jvpjj.exe128⤵PID:2484
-
\??\c:\ddvjd.exec:\ddvjd.exe129⤵PID:2588
-
\??\c:\flrflfl.exec:\flrflfl.exe130⤵PID:2448
-
\??\c:\bhbtbb.exec:\bhbtbb.exe131⤵PID:2528
-
\??\c:\5bbbnh.exec:\5bbbnh.exe132⤵PID:2900
-
\??\c:\bnhnth.exec:\bnhnth.exe133⤵PID:1600
-
\??\c:\ddpvv.exec:\ddpvv.exe134⤵PID:2060
-
\??\c:\frllrxf.exec:\frllrxf.exe135⤵PID:1496
-
\??\c:\xlrfrxx.exec:\xlrfrxx.exe136⤵PID:2628
-
\??\c:\3fxxrfx.exec:\3fxxrfx.exe137⤵PID:2640
-
\??\c:\nnbttt.exec:\nnbttt.exe138⤵PID:348
-
\??\c:\vdjdv.exec:\vdjdv.exe139⤵PID:1856
-
\??\c:\3dpdd.exec:\3dpdd.exe140⤵PID:1648
-
\??\c:\rrrxfll.exec:\rrrxfll.exe141⤵PID:796
-
\??\c:\fxlxllr.exec:\fxlxllr.exe142⤵PID:2084
-
\??\c:\nnhnht.exec:\nnhnht.exe143⤵PID:1428
-
\??\c:\bnbntb.exec:\bnbntb.exe144⤵PID:1692
-
\??\c:\3pjjv.exec:\3pjjv.exe145⤵PID:2912
-
\??\c:\ddvjv.exec:\ddvjv.exe146⤵PID:2204
-
\??\c:\fxffllx.exec:\fxffllx.exe147⤵PID:2148
-
\??\c:\xrlxlrx.exec:\xrlxlrx.exe148⤵PID:2200
-
\??\c:\tnhtbh.exec:\tnhtbh.exe149⤵PID:768
-
\??\c:\5tbttb.exec:\5tbttb.exe150⤵PID:1052
-
\??\c:\jdvjp.exec:\jdvjp.exe151⤵PID:804
-
\??\c:\3vddj.exec:\3vddj.exe152⤵PID:1724
-
\??\c:\lxlfxxf.exec:\lxlfxxf.exe153⤵PID:1440
-
\??\c:\1rlfxfx.exec:\1rlfxfx.exe154⤵PID:2000
-
\??\c:\bbnthh.exec:\bbnthh.exe155⤵PID:2368
-
\??\c:\1hnbtb.exec:\1hnbtb.exe156⤵PID:1956
-
\??\c:\1pjvj.exec:\1pjvj.exe157⤵PID:1332
-
\??\c:\vdjpj.exec:\vdjpj.exe158⤵PID:688
-
\??\c:\xrlxrfl.exec:\xrlxrfl.exe159⤵PID:680
-
\??\c:\ffxrxxf.exec:\ffxrxxf.exe160⤵PID:1984
-
\??\c:\bbhthn.exec:\bbhthn.exe161⤵PID:608
-
\??\c:\tnbhbb.exec:\tnbhbb.exe162⤵PID:1452
-
\??\c:\ddjdp.exec:\ddjdp.exe163⤵PID:876
-
\??\c:\pjvvp.exec:\pjvvp.exe164⤵PID:1248
-
\??\c:\vppdd.exec:\vppdd.exe165⤵PID:1272
-
\??\c:\rlrrffr.exec:\rlrrffr.exe166⤵PID:2544
-
\??\c:\xrllflx.exec:\xrllflx.exe167⤵PID:1924
-
\??\c:\nhhtbn.exec:\nhhtbn.exe168⤵PID:2404
-
\??\c:\bbtbhh.exec:\bbtbhh.exe169⤵PID:1088
-
\??\c:\pddpv.exec:\pddpv.exe170⤵PID:2576
-
\??\c:\dvdjp.exec:\dvdjp.exe171⤵PID:2456
-
\??\c:\xlfrrrx.exec:\xlfrrrx.exe172⤵PID:2472
-
\??\c:\lfxlxxf.exec:\lfxlxxf.exe173⤵PID:2664
-
\??\c:\tttbhh.exec:\tttbhh.exe174⤵PID:1652
-
\??\c:\tnnbnb.exec:\tnnbnb.exe175⤵PID:2564
-
\??\c:\dvpdj.exec:\dvpdj.exe176⤵PID:2892
-
\??\c:\dvdjj.exec:\dvdjj.exe177⤵PID:756
-
\??\c:\1rxfllf.exec:\1rxfllf.exe178⤵PID:108
-
\??\c:\3llxrxx.exec:\3llxrxx.exe179⤵PID:1584
-
\??\c:\nhthbb.exec:\nhthbb.exe180⤵PID:2748
-
\??\c:\bbhbtb.exec:\bbhbtb.exe181⤵PID:860
-
\??\c:\7dvvd.exec:\7dvvd.exe182⤵PID:348
-
\??\c:\1jdjp.exec:\1jdjp.exe183⤵PID:1848
-
\??\c:\xfrrrxr.exec:\xfrrrxr.exe184⤵PID:2140
-
\??\c:\lfxrflx.exec:\lfxrflx.exe185⤵PID:2376
-
\??\c:\tbhbtb.exec:\tbhbtb.exe186⤵PID:2084
-
\??\c:\tntbnt.exec:\tntbnt.exe187⤵PID:2772
-
\??\c:\5dpvp.exec:\5dpvp.exe188⤵PID:2928
-
\??\c:\xxrxrrf.exec:\xxrxrrf.exe189⤵PID:2924
-
\??\c:\7frrffl.exec:\7frrffl.exe190⤵PID:2204
-
\??\c:\bhtbnt.exec:\bhtbnt.exe191⤵PID:2220
-
\??\c:\3pvpp.exec:\3pvpp.exe192⤵PID:2184
-
\??\c:\xrfflrl.exec:\xrfflrl.exe193⤵PID:2736
-
\??\c:\xrxlxfl.exec:\xrxlxfl.exe194⤵PID:1052
-
\??\c:\5nhnbh.exec:\5nhnbh.exe195⤵PID:804
-
\??\c:\vvvdp.exec:\vvvdp.exe196⤵PID:2264
-
\??\c:\jdpvd.exec:\jdpvd.exe197⤵PID:3016
-
\??\c:\xxxrxfl.exec:\xxxrxfl.exe198⤵PID:1016
-
\??\c:\llxlflx.exec:\llxlflx.exe199⤵PID:2368
-
\??\c:\ttnhbh.exec:\ttnhbh.exe200⤵PID:1760
-
\??\c:\1bttbb.exec:\1bttbb.exe201⤵PID:1332
-
\??\c:\vvdpp.exec:\vvdpp.exe202⤵PID:688
-
\??\c:\9xrrlrx.exec:\9xrrlrx.exe203⤵PID:680
-
\??\c:\1rfxlrl.exec:\1rfxlrl.exe204⤵PID:2944
-
\??\c:\3htnbh.exec:\3htnbh.exe205⤵PID:608
-
\??\c:\3bhhnb.exec:\3bhhnb.exe206⤵PID:2044
-
\??\c:\bnnhnt.exec:\bnnhnt.exe207⤵PID:876
-
\??\c:\pjjvj.exec:\pjjvj.exe208⤵PID:2008
-
\??\c:\jjpvj.exec:\jjpvj.exe209⤵PID:1272
-
\??\c:\rrllrrx.exec:\rrllrrx.exe210⤵PID:2544
-
\??\c:\9rlrffl.exec:\9rlrffl.exe211⤵PID:1924
-
\??\c:\5tnbtb.exec:\5tnbtb.exe212⤵PID:2404
-
\??\c:\hhnttt.exec:\hhnttt.exe213⤵PID:1088
-
\??\c:\3jddj.exec:\3jddj.exe214⤵PID:2760
-
\??\c:\xrfflrf.exec:\xrfflrf.exe215⤵PID:2456
-
\??\c:\tnhthn.exec:\tnhthn.exe216⤵PID:2468
-
\??\c:\nnhbnt.exec:\nnhbnt.exe217⤵PID:2664
-
\??\c:\pdvdj.exec:\pdvdj.exe218⤵PID:2500
-
\??\c:\jjddd.exec:\jjddd.exe219⤵PID:2564
-
\??\c:\pjjjv.exec:\pjjjv.exe220⤵PID:1576
-
\??\c:\1xrxlrx.exec:\1xrxlrx.exe221⤵PID:756
-
\??\c:\frxlrrx.exec:\frxlrrx.exe222⤵PID:1460
-
\??\c:\ttnbnn.exec:\ttnbnn.exe223⤵PID:2740
-
\??\c:\btbnbb.exec:\btbnbb.exe224⤵PID:2748
-
\??\c:\5vjdp.exec:\5vjdp.exe225⤵PID:860
-
\??\c:\pjvjv.exec:\pjvjv.exe226⤵PID:908
-
\??\c:\rfxrrxx.exec:\rfxrrxx.exe227⤵PID:1848
-
\??\c:\llfrlrl.exec:\llfrlrl.exe228⤵PID:1412
-
\??\c:\bhtbbt.exec:\bhtbbt.exe229⤵PID:2376
-
\??\c:\btbbbb.exec:\btbbbb.exe230⤵PID:2084
-
\??\c:\7pvdp.exec:\7pvdp.exe231⤵PID:2772
-
\??\c:\1vdpv.exec:\1vdpv.exe232⤵PID:2928
-
\??\c:\rlflxrx.exec:\rlflxrx.exe233⤵PID:2852
-
\??\c:\5xlrflf.exec:\5xlrflf.exe234⤵PID:772
-
\??\c:\hbnnbb.exec:\hbnnbb.exe235⤵PID:2200
-
\??\c:\tnthbh.exec:\tnthbh.exe236⤵PID:1896
-
\??\c:\1djvd.exec:\1djvd.exe237⤵PID:2412
-
\??\c:\dddjp.exec:\dddjp.exe238⤵PID:2336
-
\??\c:\1fxxxfl.exec:\1fxxxfl.exe239⤵PID:1544
-
\??\c:\xrxxlrf.exec:\xrxxlrf.exe240⤵PID:1516
-
\??\c:\7nnhth.exec:\7nnhth.exe241⤵PID:2000
-
\??\c:\hbthtb.exec:\hbthtb.exe242⤵PID:1300