Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 19:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
071724ce31366f800f04f3ed10f6ea00_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
071724ce31366f800f04f3ed10f6ea00_NeikiAnalytics.exe
-
Size
60KB
-
MD5
071724ce31366f800f04f3ed10f6ea00
-
SHA1
eac7ef090b246984ecfdae6bced81505037575d9
-
SHA256
a58166adb95932e89137cc187b1aeec06304c968f54db3bb244d7462ee883483
-
SHA512
8c65735d71823a6f5c83784d880e434ad7fd8edcc0b98ce48d8be8152d2138f944b99d56eb63c977b98a0cb6f20cb3919f6eaf9ba53b6b007f41772aa1032fb7
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvAEaFJLw:ymb3NkkiQ3mdBjFIvAvw
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral1/memory/2940-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2344-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2344-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2452-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2024-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2012-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1888-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1572-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/884-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1392-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1712-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1836-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/788-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2160-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
thhtbb.exexxfxxll.exennntht.exetnbtht.exepdjvv.exellfrrlx.exelxffffr.exennnhtn.exejpvjp.exexrffllr.exebththh.exehbnttt.exejvdpd.exefxfllrl.exerlrxflr.exe9nnthn.exedvpvd.exerflxlrf.exebnhnbb.exetntbtt.exe3vppv.exexfrxlxl.exeffrflrx.exettthhh.exe1dpjp.exexlffrrx.exefrxfrlr.exethtthh.exedvjvd.exepvdpv.exefrxrrlr.exettnbnn.exebhnnht.exejdddp.exerlfrffl.exexlfrlxr.exe5ntntn.exedvppv.exedvddp.exelrrllxr.exe9lllrrl.exebtnbbh.exebbhhtn.exevpjpj.exexfxrlxr.exennbbnn.exebthntt.exedvjjv.exeppddp.exefflrxll.exelllllxx.exebbhnbb.exe3bbhhn.exenbhnnt.exedjddp.exeppjpp.exe7rxxlrf.exe7rlxllr.exetnhhnt.exenbbbhh.exejjdvp.exevddpp.exexrllrrx.exe1xrlrxx.exepid process 2344 thhtbb.exe 2992 xxfxxll.exe 2736 nnntht.exe 2572 tnbtht.exe 2660 pdjvv.exe 2480 llfrrlx.exe 2452 lxffffr.exe 2496 nnnhtn.exe 2024 jpvjp.exe 2672 xrffllr.exe 2540 bththh.exe 1948 hbnttt.exe 2012 jvdpd.exe 1888 fxfllrl.exe 1572 rlrxflr.exe 884 9nnthn.exe 1648 dvpvd.exe 2116 rflxlrf.exe 2272 bnhnbb.exe 1652 tntbtt.exe 1392 3vppv.exe 600 xfrxlxl.exe 1000 ffrflrx.exe 3012 ttthhh.exe 1712 1dpjp.exe 1396 xlffrrx.exe 1836 frxfrlr.exe 1892 thtthh.exe 788 dvjvd.exe 2160 pvdpv.exe 2168 frxrrlr.exe 1464 ttnbnn.exe 1992 bhnnht.exe 2056 jdddp.exe 1624 rlfrffl.exe 2568 xlfrlxr.exe 2640 5ntntn.exe 2596 dvppv.exe 2636 dvddp.exe 2464 lrrllxr.exe 2556 9lllrrl.exe 2712 btnbbh.exe 2552 bbhhtn.exe 2456 vpjpj.exe 2920 xfxrlxr.exe 2424 nnbbnn.exe 2688 bthntt.exe 2672 dvjjv.exe 1036 ppddp.exe 2192 fflrxll.exe 320 lllllxx.exe 472 bbhnbb.exe 1216 3bbhhn.exe 2328 nbhnnt.exe 1608 djddp.exe 1444 ppjpp.exe 2312 7rxxlrf.exe 2116 7rlxllr.exe 2536 tnhhnt.exe 2104 nbbbhh.exe 592 jjdvp.exe 576 vddpp.exe 1508 xrllrrx.exe 1336 1xrlrxx.exe -
Processes:
resource yara_rule behavioral1/memory/2940-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2012-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1888-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1572-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/884-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1392-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1712-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1836-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/788-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2160-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-298-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
071724ce31366f800f04f3ed10f6ea00_NeikiAnalytics.exethhtbb.exexxfxxll.exennntht.exetnbtht.exepdjvv.exellfrrlx.exelxffffr.exennnhtn.exejpvjp.exexrffllr.exebththh.exehbnttt.exejvdpd.exefxfllrl.exerlrxflr.exedescription pid process target process PID 2940 wrote to memory of 2344 2940 071724ce31366f800f04f3ed10f6ea00_NeikiAnalytics.exe thhtbb.exe PID 2940 wrote to memory of 2344 2940 071724ce31366f800f04f3ed10f6ea00_NeikiAnalytics.exe thhtbb.exe PID 2940 wrote to memory of 2344 2940 071724ce31366f800f04f3ed10f6ea00_NeikiAnalytics.exe thhtbb.exe PID 2940 wrote to memory of 2344 2940 071724ce31366f800f04f3ed10f6ea00_NeikiAnalytics.exe thhtbb.exe PID 2344 wrote to memory of 2992 2344 thhtbb.exe xxfxxll.exe PID 2344 wrote to memory of 2992 2344 thhtbb.exe xxfxxll.exe PID 2344 wrote to memory of 2992 2344 thhtbb.exe xxfxxll.exe PID 2344 wrote to memory of 2992 2344 thhtbb.exe xxfxxll.exe PID 2992 wrote to memory of 2736 2992 xxfxxll.exe nnntht.exe PID 2992 wrote to memory of 2736 2992 xxfxxll.exe nnntht.exe PID 2992 wrote to memory of 2736 2992 xxfxxll.exe nnntht.exe PID 2992 wrote to memory of 2736 2992 xxfxxll.exe nnntht.exe PID 2736 wrote to memory of 2572 2736 nnntht.exe tnbtht.exe PID 2736 wrote to memory of 2572 2736 nnntht.exe tnbtht.exe PID 2736 wrote to memory of 2572 2736 nnntht.exe tnbtht.exe PID 2736 wrote to memory of 2572 2736 nnntht.exe tnbtht.exe PID 2572 wrote to memory of 2660 2572 tnbtht.exe pdjvv.exe PID 2572 wrote to memory of 2660 2572 tnbtht.exe pdjvv.exe PID 2572 wrote to memory of 2660 2572 tnbtht.exe pdjvv.exe PID 2572 wrote to memory of 2660 2572 tnbtht.exe pdjvv.exe PID 2660 wrote to memory of 2480 2660 pdjvv.exe llfrrlx.exe PID 2660 wrote to memory of 2480 2660 pdjvv.exe llfrrlx.exe PID 2660 wrote to memory of 2480 2660 pdjvv.exe llfrrlx.exe PID 2660 wrote to memory of 2480 2660 pdjvv.exe llfrrlx.exe PID 2480 wrote to memory of 2452 2480 llfrrlx.exe lxffffr.exe PID 2480 wrote to memory of 2452 2480 llfrrlx.exe lxffffr.exe PID 2480 wrote to memory of 2452 2480 llfrrlx.exe lxffffr.exe PID 2480 wrote to memory of 2452 2480 llfrrlx.exe lxffffr.exe PID 2452 wrote to memory of 2496 2452 lxffffr.exe nnnhtn.exe PID 2452 wrote to memory of 2496 2452 lxffffr.exe nnnhtn.exe PID 2452 wrote to memory of 2496 2452 lxffffr.exe nnnhtn.exe PID 2452 wrote to memory of 2496 2452 lxffffr.exe nnnhtn.exe PID 2496 wrote to memory of 2024 2496 nnnhtn.exe jpvjp.exe PID 2496 wrote to memory of 2024 2496 nnnhtn.exe jpvjp.exe PID 2496 wrote to memory of 2024 2496 nnnhtn.exe jpvjp.exe PID 2496 wrote to memory of 2024 2496 nnnhtn.exe jpvjp.exe PID 2024 wrote to memory of 2672 2024 jpvjp.exe xrffllr.exe PID 2024 wrote to memory of 2672 2024 jpvjp.exe xrffllr.exe PID 2024 wrote to memory of 2672 2024 jpvjp.exe xrffllr.exe PID 2024 wrote to memory of 2672 2024 jpvjp.exe xrffllr.exe PID 2672 wrote to memory of 2540 2672 xrffllr.exe bththh.exe PID 2672 wrote to memory of 2540 2672 xrffllr.exe bththh.exe PID 2672 wrote to memory of 2540 2672 xrffllr.exe bththh.exe PID 2672 wrote to memory of 2540 2672 xrffllr.exe bththh.exe PID 2540 wrote to memory of 1948 2540 bththh.exe hbnttt.exe PID 2540 wrote to memory of 1948 2540 bththh.exe hbnttt.exe PID 2540 wrote to memory of 1948 2540 bththh.exe hbnttt.exe PID 2540 wrote to memory of 1948 2540 bththh.exe hbnttt.exe PID 1948 wrote to memory of 2012 1948 hbnttt.exe jvdpd.exe PID 1948 wrote to memory of 2012 1948 hbnttt.exe jvdpd.exe PID 1948 wrote to memory of 2012 1948 hbnttt.exe jvdpd.exe PID 1948 wrote to memory of 2012 1948 hbnttt.exe jvdpd.exe PID 2012 wrote to memory of 1888 2012 jvdpd.exe fxfllrl.exe PID 2012 wrote to memory of 1888 2012 jvdpd.exe fxfllrl.exe PID 2012 wrote to memory of 1888 2012 jvdpd.exe fxfllrl.exe PID 2012 wrote to memory of 1888 2012 jvdpd.exe fxfllrl.exe PID 1888 wrote to memory of 1572 1888 fxfllrl.exe rlrxflr.exe PID 1888 wrote to memory of 1572 1888 fxfllrl.exe rlrxflr.exe PID 1888 wrote to memory of 1572 1888 fxfllrl.exe rlrxflr.exe PID 1888 wrote to memory of 1572 1888 fxfllrl.exe rlrxflr.exe PID 1572 wrote to memory of 884 1572 rlrxflr.exe 9nnthn.exe PID 1572 wrote to memory of 884 1572 rlrxflr.exe 9nnthn.exe PID 1572 wrote to memory of 884 1572 rlrxflr.exe 9nnthn.exe PID 1572 wrote to memory of 884 1572 rlrxflr.exe 9nnthn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\071724ce31366f800f04f3ed10f6ea00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\071724ce31366f800f04f3ed10f6ea00_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\thhtbb.exec:\thhtbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\xxfxxll.exec:\xxfxxll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\nnntht.exec:\nnntht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\tnbtht.exec:\tnbtht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\pdjvv.exec:\pdjvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\llfrrlx.exec:\llfrrlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\lxffffr.exec:\lxffffr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\nnnhtn.exec:\nnnhtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\jpvjp.exec:\jpvjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\xrffllr.exec:\xrffllr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\bththh.exec:\bththh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\hbnttt.exec:\hbnttt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\jvdpd.exec:\jvdpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\fxfllrl.exec:\fxfllrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\rlrxflr.exec:\rlrxflr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\9nnthn.exec:\9nnthn.exe17⤵
- Executes dropped EXE
PID:884 -
\??\c:\dvpvd.exec:\dvpvd.exe18⤵
- Executes dropped EXE
PID:1648 -
\??\c:\rflxlrf.exec:\rflxlrf.exe19⤵
- Executes dropped EXE
PID:2116 -
\??\c:\bnhnbb.exec:\bnhnbb.exe20⤵
- Executes dropped EXE
PID:2272 -
\??\c:\tntbtt.exec:\tntbtt.exe21⤵
- Executes dropped EXE
PID:1652 -
\??\c:\3vppv.exec:\3vppv.exe22⤵
- Executes dropped EXE
PID:1392 -
\??\c:\xfrxlxl.exec:\xfrxlxl.exe23⤵
- Executes dropped EXE
PID:600 -
\??\c:\ffrflrx.exec:\ffrflrx.exe24⤵
- Executes dropped EXE
PID:1000 -
\??\c:\ttthhh.exec:\ttthhh.exe25⤵
- Executes dropped EXE
PID:3012 -
\??\c:\1dpjp.exec:\1dpjp.exe26⤵
- Executes dropped EXE
PID:1712 -
\??\c:\xlffrrx.exec:\xlffrrx.exe27⤵
- Executes dropped EXE
PID:1396 -
\??\c:\frxfrlr.exec:\frxfrlr.exe28⤵
- Executes dropped EXE
PID:1836 -
\??\c:\thtthh.exec:\thtthh.exe29⤵
- Executes dropped EXE
PID:1892 -
\??\c:\dvjvd.exec:\dvjvd.exe30⤵
- Executes dropped EXE
PID:788 -
\??\c:\pvdpv.exec:\pvdpv.exe31⤵
- Executes dropped EXE
PID:2160 -
\??\c:\frxrrlr.exec:\frxrrlr.exe32⤵
- Executes dropped EXE
PID:2168 -
\??\c:\ttnbnn.exec:\ttnbnn.exe33⤵
- Executes dropped EXE
PID:1464 -
\??\c:\bhnnht.exec:\bhnnht.exe34⤵
- Executes dropped EXE
PID:1992 -
\??\c:\jdddp.exec:\jdddp.exe35⤵
- Executes dropped EXE
PID:2056 -
\??\c:\rlfrffl.exec:\rlfrffl.exe36⤵
- Executes dropped EXE
PID:1624 -
\??\c:\xlfrlxr.exec:\xlfrlxr.exe37⤵
- Executes dropped EXE
PID:2568 -
\??\c:\5ntntn.exec:\5ntntn.exe38⤵
- Executes dropped EXE
PID:2640 -
\??\c:\dvppv.exec:\dvppv.exe39⤵
- Executes dropped EXE
PID:2596 -
\??\c:\dvddp.exec:\dvddp.exe40⤵
- Executes dropped EXE
PID:2636 -
\??\c:\lrrllxr.exec:\lrrllxr.exe41⤵
- Executes dropped EXE
PID:2464 -
\??\c:\9lllrrl.exec:\9lllrrl.exe42⤵
- Executes dropped EXE
PID:2556 -
\??\c:\btnbbh.exec:\btnbbh.exe43⤵
- Executes dropped EXE
PID:2712 -
\??\c:\bbhhtn.exec:\bbhhtn.exe44⤵
- Executes dropped EXE
PID:2552 -
\??\c:\vpjpj.exec:\vpjpj.exe45⤵
- Executes dropped EXE
PID:2456 -
\??\c:\xfxrlxr.exec:\xfxrlxr.exe46⤵
- Executes dropped EXE
PID:2920 -
\??\c:\nnbbnn.exec:\nnbbnn.exe47⤵
- Executes dropped EXE
PID:2424 -
\??\c:\bthntt.exec:\bthntt.exe48⤵
- Executes dropped EXE
PID:2688 -
\??\c:\dvjjv.exec:\dvjjv.exe49⤵
- Executes dropped EXE
PID:2672 -
\??\c:\ppddp.exec:\ppddp.exe50⤵
- Executes dropped EXE
PID:1036 -
\??\c:\fflrxll.exec:\fflrxll.exe51⤵
- Executes dropped EXE
PID:2192 -
\??\c:\lllllxx.exec:\lllllxx.exe52⤵
- Executes dropped EXE
PID:320 -
\??\c:\bbhnbb.exec:\bbhnbb.exe53⤵
- Executes dropped EXE
PID:472 -
\??\c:\3bbhhn.exec:\3bbhhn.exe54⤵
- Executes dropped EXE
PID:1216 -
\??\c:\nbhnnt.exec:\nbhnnt.exe55⤵
- Executes dropped EXE
PID:2328 -
\??\c:\djddp.exec:\djddp.exe56⤵
- Executes dropped EXE
PID:1608 -
\??\c:\ppjpp.exec:\ppjpp.exe57⤵
- Executes dropped EXE
PID:1444 -
\??\c:\7rxxlrf.exec:\7rxxlrf.exe58⤵
- Executes dropped EXE
PID:2312 -
\??\c:\7rlxllr.exec:\7rlxllr.exe59⤵
- Executes dropped EXE
PID:2116 -
\??\c:\tnhhnt.exec:\tnhhnt.exe60⤵
- Executes dropped EXE
PID:2536 -
\??\c:\nbbbhh.exec:\nbbbhh.exe61⤵
- Executes dropped EXE
PID:2104 -
\??\c:\jjdvp.exec:\jjdvp.exe62⤵
- Executes dropped EXE
PID:592 -
\??\c:\vddpp.exec:\vddpp.exe63⤵
- Executes dropped EXE
PID:576 -
\??\c:\xrllrrx.exec:\xrllrrx.exe64⤵
- Executes dropped EXE
PID:1508 -
\??\c:\1xrlrxx.exec:\1xrlrxx.exe65⤵
- Executes dropped EXE
PID:1336 -
\??\c:\tbbtbn.exec:\tbbtbn.exe66⤵PID:1924
-
\??\c:\7jvjd.exec:\7jvjd.exe67⤵PID:992
-
\??\c:\ddvjv.exec:\ddvjv.exe68⤵PID:1324
-
\??\c:\1xxlfrx.exec:\1xxlfrx.exe69⤵PID:3028
-
\??\c:\lfffxfx.exec:\lfffxfx.exe70⤵PID:912
-
\??\c:\7bbhht.exec:\7bbhht.exe71⤵PID:1376
-
\??\c:\bbbnbn.exec:\bbbnbn.exe72⤵PID:572
-
\??\c:\pdjvd.exec:\pdjvd.exe73⤵PID:2268
-
\??\c:\pdpvp.exec:\pdpvp.exe74⤵PID:1204
-
\??\c:\9rffllr.exec:\9rffllr.exe75⤵PID:1532
-
\??\c:\lxrllff.exec:\lxrllff.exe76⤵PID:3044
-
\??\c:\htbtnn.exec:\htbtnn.exe77⤵PID:2520
-
\??\c:\nhthnn.exec:\nhthnn.exe78⤵PID:1600
-
\??\c:\ttnntb.exec:\ttnntb.exe79⤵PID:2912
-
\??\c:\vpdjv.exec:\vpdjv.exe80⤵PID:2176
-
\??\c:\9pvjp.exec:\9pvjp.exe81⤵PID:2824
-
\??\c:\1lffffl.exec:\1lffffl.exe82⤵PID:2564
-
\??\c:\rlxfllf.exec:\rlxfllf.exe83⤵PID:2728
-
\??\c:\nnntbh.exec:\nnntbh.exe84⤵PID:2572
-
\??\c:\ttbntb.exec:\ttbntb.exe85⤵PID:2660
-
\??\c:\pjppj.exec:\pjppj.exe86⤵PID:2448
-
\??\c:\vjdvd.exec:\vjdvd.exe87⤵PID:2244
-
\??\c:\llffxrr.exec:\llffxrr.exe88⤵PID:2156
-
\??\c:\ffxllxx.exec:\ffxllxx.exe89⤵PID:1840
-
\??\c:\ttbhtt.exec:\ttbhtt.exe90⤵PID:2684
-
\??\c:\btbbbh.exec:\btbbbh.exe91⤵PID:2708
-
\??\c:\9pjvj.exec:\9pjvj.exe92⤵PID:2756
-
\??\c:\jvppp.exec:\jvppp.exe93⤵PID:2368
-
\??\c:\xfrfrlr.exec:\xfrfrlr.exe94⤵PID:2028
-
\??\c:\btnbht.exec:\btnbht.exe95⤵PID:1672
-
\??\c:\bbhtbn.exec:\bbhtbn.exe96⤵PID:1940
-
\??\c:\jjvpj.exec:\jjvpj.exe97⤵PID:776
-
\??\c:\jdjpd.exec:\jdjpd.exe98⤵PID:2364
-
\??\c:\xlxrrrx.exec:\xlxrrrx.exe99⤵PID:1028
-
\??\c:\xrxffrx.exec:\xrxffrx.exe100⤵PID:852
-
\??\c:\1tnbnn.exec:\1tnbnn.exe101⤵PID:1644
-
\??\c:\hbtbnn.exec:\hbtbnn.exe102⤵PID:2844
-
\??\c:\pjjpj.exec:\pjjpj.exe103⤵PID:1160
-
\??\c:\jdpvp.exec:\jdpvp.exe104⤵PID:1652
-
\??\c:\xrflrrf.exec:\xrflrrf.exe105⤵PID:488
-
\??\c:\xrfxrxf.exec:\xrfxrxf.exe106⤵PID:1504
-
\??\c:\lflfrrx.exec:\lflfrrx.exe107⤵PID:1536
-
\??\c:\nttnbt.exec:\nttnbt.exe108⤵PID:1920
-
\??\c:\7nbhnt.exec:\7nbhnt.exe109⤵PID:3012
-
\??\c:\jjpvd.exec:\jjpvd.exe110⤵PID:2236
-
\??\c:\ddpvv.exec:\ddpvv.exe111⤵PID:1044
-
\??\c:\rfxfllx.exec:\rfxfllx.exe112⤵PID:1356
-
\??\c:\lrlffff.exec:\lrlffff.exe113⤵PID:1916
-
\??\c:\btnntt.exec:\btnntt.exe114⤵PID:1524
-
\??\c:\nhbbhn.exec:\nhbbhn.exe115⤵PID:1776
-
\??\c:\vpvdp.exec:\vpvdp.exe116⤵PID:2072
-
\??\c:\jdpjp.exec:\jdpjp.exe117⤵PID:1716
-
\??\c:\9xflfxx.exec:\9xflfxx.exe118⤵PID:2136
-
\??\c:\xfrllfl.exec:\xfrllfl.exe119⤵PID:2808
-
\??\c:\bnnnnn.exec:\bnnnnn.exe120⤵PID:1628
-
\??\c:\thtthn.exec:\thtthn.exe121⤵PID:2972
-
\??\c:\pdjpp.exec:\pdjpp.exe122⤵PID:2632
-
\??\c:\jvddj.exec:\jvddj.exe123⤵PID:2732
-
\??\c:\9xrxllx.exec:\9xrxllx.exe124⤵PID:2584
-
\??\c:\llxlxfr.exec:\llxlxfr.exe125⤵PID:2292
-
\??\c:\lfrrfxf.exec:\lfrrfxf.exe126⤵PID:2724
-
\??\c:\5thhbn.exec:\5thhbn.exe127⤵PID:2472
-
\??\c:\nhhhbh.exec:\nhhhbh.exe128⤵PID:2216
-
\??\c:\jvpvv.exec:\jvpvv.exe129⤵PID:2432
-
\??\c:\5vjpd.exec:\5vjpd.exe130⤵PID:1912
-
\??\c:\pjppp.exec:\pjppp.exe131⤵PID:2220
-
\??\c:\fxlxllx.exec:\fxlxllx.exe132⤵PID:1956
-
\??\c:\9llrfrf.exec:\9llrfrf.exe133⤵PID:2528
-
\??\c:\5lrrxfl.exec:\5lrrxfl.exe134⤵PID:2908
-
\??\c:\bbhtbb.exec:\bbhtbb.exe135⤵PID:2892
-
\??\c:\5vvpp.exec:\5vvpp.exe136⤵PID:2876
-
\??\c:\5jjpj.exec:\5jjpj.exe137⤵PID:2012
-
\??\c:\7dpdp.exec:\7dpdp.exe138⤵PID:2228
-
\??\c:\frxfffr.exec:\frxfffr.exe139⤵PID:1908
-
\??\c:\llxlrrx.exec:\llxlrrx.exe140⤵PID:2360
-
\??\c:\hhtnbt.exec:\hhtnbt.exe141⤵PID:932
-
\??\c:\nntbbb.exec:\nntbbb.exe142⤵PID:2320
-
\??\c:\djpdd.exec:\djpdd.exe143⤵PID:2300
-
\??\c:\pdvpp.exec:\pdvpp.exe144⤵PID:2312
-
\??\c:\lxfxffl.exec:\lxfxffl.exe145⤵PID:2224
-
\??\c:\flxxlxr.exec:\flxxlxr.exe146⤵PID:2796
-
\??\c:\1rxlxfx.exec:\1rxlxfx.exe147⤵PID:1392
-
\??\c:\bnttbb.exec:\bnttbb.exe148⤵PID:1332
-
\??\c:\htbnhh.exec:\htbnhh.exe149⤵PID:112
-
\??\c:\9vvpp.exec:\9vvpp.exe150⤵PID:2784
-
\??\c:\dpppv.exec:\dpppv.exe151⤵PID:908
-
\??\c:\rfrrlrx.exec:\rfrrlrx.exe152⤵PID:1712
-
\??\c:\1rfrlrl.exec:\1rfrlrl.exe153⤵PID:1668
-
\??\c:\lxrlfff.exec:\lxrlfff.exe154⤵PID:652
-
\??\c:\ttthbn.exec:\ttthbn.exe155⤵PID:892
-
\??\c:\btbbtt.exec:\btbbtt.exe156⤵PID:2280
-
\??\c:\9vpvv.exec:\9vpvv.exe157⤵PID:2852
-
\??\c:\vpdjv.exec:\vpdjv.exe158⤵PID:3024
-
\??\c:\xrlrxlf.exec:\xrlrxlf.exe159⤵PID:2268
-
\??\c:\xrrfllx.exec:\xrrfllx.exe160⤵PID:2108
-
\??\c:\bttnbh.exec:\bttnbh.exe161⤵PID:2064
-
\??\c:\nbhhnt.exec:\nbhhnt.exe162⤵PID:1992
-
\??\c:\pjvvj.exec:\pjvvj.exe163⤵PID:2056
-
\??\c:\jdpvv.exec:\jdpvv.exe164⤵PID:1624
-
\??\c:\frxrxxf.exec:\frxrxxf.exe165⤵PID:2568
-
\??\c:\xrxfrrx.exec:\xrxfrrx.exe166⤵PID:2548
-
\??\c:\hbnhtt.exec:\hbnhtt.exe167⤵PID:2596
-
\??\c:\hththh.exec:\hththh.exe168⤵PID:2788
-
\??\c:\1htbhh.exec:\1htbhh.exe169⤵PID:2464
-
\??\c:\vpvvv.exec:\vpvvv.exe170⤵PID:2556
-
\??\c:\5jpdj.exec:\5jpdj.exe171⤵PID:2712
-
\??\c:\lfrxffr.exec:\lfrxffr.exe172⤵PID:2552
-
\??\c:\frfflff.exec:\frfflff.exe173⤵PID:2456
-
\??\c:\thtbhn.exec:\thtbhn.exe174⤵PID:2700
-
\??\c:\nnbhhh.exec:\nnbhhh.exe175⤵PID:2424
-
\??\c:\pdppv.exec:\pdppv.exe176⤵PID:2688
-
\??\c:\jpvjd.exec:\jpvjd.exe177⤵PID:2672
-
\??\c:\rflffxf.exec:\rflffxf.exe178⤵PID:1036
-
\??\c:\rlxfxxf.exec:\rlxfxxf.exe179⤵PID:1900
-
\??\c:\nnhntt.exec:\nnhntt.exe180⤵PID:320
-
\??\c:\tntntt.exec:\tntntt.exe181⤵PID:472
-
\??\c:\5nhhhh.exec:\5nhhhh.exe182⤵PID:556
-
\??\c:\jpjpp.exec:\jpjpp.exe183⤵PID:2328
-
\??\c:\7ppvj.exec:\7ppvj.exe184⤵PID:1656
-
\??\c:\ffrxllx.exec:\ffrxllx.exe185⤵PID:1444
-
\??\c:\rfrfrrx.exec:\rfrfrrx.exe186⤵PID:1660
-
\??\c:\hthbtb.exec:\hthbtb.exe187⤵PID:2116
-
\??\c:\9btbhh.exec:\9btbhh.exe188⤵PID:1708
-
\??\c:\nhbnbh.exec:\nhbnbh.exe189⤵PID:2104
-
\??\c:\5djjp.exec:\5djjp.exe190⤵PID:592
-
\??\c:\3pvdj.exec:\3pvdj.exe191⤵PID:576
-
\??\c:\flrrxrx.exec:\flrrxrx.exe192⤵PID:560
-
\??\c:\frfllrr.exec:\frfllrr.exe193⤵PID:1336
-
\??\c:\1nnbhb.exec:\1nnbhb.exe194⤵PID:752
-
\??\c:\bhbnbn.exec:\bhbnbn.exe195⤵PID:992
-
\??\c:\1vdjd.exec:\1vdjd.exe196⤵PID:1952
-
\??\c:\vpdpj.exec:\vpdpj.exe197⤵PID:3028
-
\??\c:\rlflllx.exec:\rlflllx.exe198⤵PID:2164
-
\??\c:\5xlflrr.exec:\5xlflrr.exe199⤵PID:1376
-
\??\c:\rlfllfl.exec:\rlfllfl.exe200⤵PID:1980
-
\??\c:\hbhnbb.exec:\hbhnbb.exe201⤵PID:2172
-
\??\c:\bntbhb.exec:\bntbhb.exe202⤵PID:1068
-
\??\c:\5pjjv.exec:\5pjjv.exe203⤵PID:2188
-
\??\c:\7dppp.exec:\7dppp.exe204⤵PID:1620
-
\??\c:\fxfxfrx.exec:\fxfxfrx.exe205⤵PID:3048
-
\??\c:\jvjpp.exec:\jvjpp.exe206⤵PID:2764
-
\??\c:\vvjdp.exec:\vvjdp.exe207⤵PID:2968
-
\??\c:\jjjvj.exec:\jjjvj.exe208⤵PID:2640
-
\??\c:\xrrxrxf.exec:\xrrxrxf.exe209⤵PID:2736
-
\??\c:\flrfffx.exec:\flrfffx.exe210⤵PID:2564
-
\??\c:\nbhbhb.exec:\nbhbhb.exe211⤵PID:2740
-
\??\c:\1bttnn.exec:\1bttnn.exe212⤵PID:2616
-
\??\c:\vpdjp.exec:\vpdjp.exe213⤵PID:2216
-
\??\c:\pdjpv.exec:\pdjpv.exe214⤵PID:2480
-
\??\c:\llfrxxx.exec:\llfrxxx.exe215⤵PID:1912
-
\??\c:\xfxrxxl.exec:\xfxrxxl.exe216⤵PID:2220
-
\??\c:\5tnbnn.exec:\5tnbnn.exe217⤵PID:2496
-
\??\c:\bnbbbh.exec:\bnbbbh.exe218⤵PID:1896
-
\??\c:\htbttt.exec:\htbttt.exe219⤵PID:2776
-
\??\c:\7vpvp.exec:\7vpvp.exe220⤵PID:2756
-
\??\c:\dpddd.exec:\dpddd.exe221⤵PID:2392
-
\??\c:\5xlxxfl.exec:\5xlxxfl.exe222⤵PID:1820
-
\??\c:\xllrfrx.exec:\xllrfrx.exe223⤵PID:1032
-
\??\c:\1ttbbb.exec:\1ttbbb.exe224⤵PID:1972
-
\??\c:\bhhbtn.exec:\bhhbtn.exe225⤵PID:1256
-
\??\c:\pvvjd.exec:\pvvjd.exe226⤵PID:2380
-
\??\c:\jvvdv.exec:\jvvdv.exe227⤵PID:1648
-
\??\c:\7dddd.exec:\7dddd.exe228⤵PID:1164
-
\??\c:\xrlfxff.exec:\xrlfxff.exe229⤵PID:2980
-
\??\c:\thnthn.exec:\thnthn.exe230⤵PID:2624
-
\??\c:\bntntt.exec:\bntntt.exe231⤵PID:2960
-
\??\c:\jdjpv.exec:\jdjpv.exe232⤵PID:2296
-
\??\c:\ppdpd.exec:\ppdpd.exe233⤵PID:384
-
\??\c:\5xffffx.exec:\5xffffx.exe234⤵PID:3000
-
\??\c:\xrfrrxx.exec:\xrfrrxx.exe235⤵PID:968
-
\??\c:\1rrllxr.exec:\1rrllxr.exe236⤵PID:3012
-
\??\c:\9nnhtt.exec:\9nnhtt.exe237⤵PID:280
-
\??\c:\nbnntt.exec:\nbnntt.exe238⤵PID:1564
-
\??\c:\dvjpp.exec:\dvjpp.exe239⤵PID:1044
-
\??\c:\ddpvv.exec:\ddpvv.exe240⤵PID:1104
-
\??\c:\5xlxrxl.exec:\5xlxrxl.exe241⤵PID:2032
-