Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 20:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0a5ecea5c89d4ed6891aa742f120a280_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0a5ecea5c89d4ed6891aa742f120a280_NeikiAnalytics.exe
-
Size
67KB
-
MD5
0a5ecea5c89d4ed6891aa742f120a280
-
SHA1
6a3b1280cb7bb036e71a74034f7d96f0550b47ee
-
SHA256
32330c1c7bc496cd32f6e0b7439321fe11e5765f7b0d7b4b72a4e7b6bf95eaca
-
SHA512
59f28f881e0d7889aa273e02c913de7f24afe6ac44f9fccb5d583d324dbd654176e6fc7292c3b6b658a86cc0875d08132aa7bc90545939e0fa18ef8720c5af96
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLrm:ymb3NkkiQ3mdBjFIvl358nLrm
Malware Config
Signatures
-
Detect Blackmoon payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/1756-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2280-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1320-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2972-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1088-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2968-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1584-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1640-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1912-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1044-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
dvjjp.exejppjp.exetnbhtt.exevjddp.exe3lxxffr.exefxllxfx.exetnhbnn.exevjppd.exedjjvp.exefrxxfxx.exe7nthtb.exebthnhn.exe1pjdp.exefxrfrff.exe5xlxlrf.exettnthn.exennbnbb.exe5dvdj.exepvvdp.exexrlrxff.exettbhhb.exe7bbthb.exe7vvvp.exevvvjd.exerlxfrxl.exetttbnb.exennbnhn.exe3vpjd.exerfrxlxf.exenhhnbh.exehhbhtb.exejdjvv.exe1xlllrr.exerllrrrx.exe5hnnnt.exejdvdj.exe9llxlxr.exe7nhnht.exetntthn.exevvdvd.exejdvdv.exelrxxxlx.exe5rlxllx.exebhntnt.exehbthtb.exe1vvvd.exevjvvj.exexfllxxf.exe1fxlrxf.exe3hhnbh.exebnthbh.exejdppj.exejjvdd.exejdvdv.exefxrrrrf.exetnnbtb.exetntbhn.exevpddd.exedvpdj.exelxrflxx.exe1flllll.exe3htnnn.exe7hbbnt.exepjddj.exepid process 2280 dvjjp.exe 2560 jppjp.exe 2664 tnbhtt.exe 1320 vjddp.exe 2684 3lxxffr.exe 2632 fxllxfx.exe 2384 tnhbnn.exe 2972 vjppd.exe 1088 djjvp.exe 2816 frxxfxx.exe 2968 7nthtb.exe 1884 bthnhn.exe 1988 1pjdp.exe 1584 fxrfrff.exe 2456 5xlxlrf.exe 2768 ttnthn.exe 1640 nnbnbb.exe 2100 5dvdj.exe 2564 pvvdp.exe 1268 xrlrxff.exe 1964 ttbhhb.exe 112 7bbthb.exe 1648 7vvvp.exe 1912 vvvjd.exe 2928 rlxfrxl.exe 1044 tttbnb.exe 1028 nnbnhn.exe 552 3vpjd.exe 572 rfrxlxf.exe 2184 nhhnbh.exe 1620 hhbhtb.exe 2144 jdjvv.exe 1580 1xlllrr.exe 2272 rllrrrx.exe 2680 5hnnnt.exe 2616 jdvdj.exe 2476 9llxlxr.exe 2884 7nhnht.exe 2728 tntthn.exe 2592 vvdvd.exe 2468 jdvdv.exe 2520 lrxxxlx.exe 2500 5rlxllx.exe 2424 bhntnt.exe 2776 hbthtb.exe 2840 1vvvd.exe 2852 vjvvj.exe 2940 xfllxxf.exe 2716 1fxlrxf.exe 1432 3hhnbh.exe 1988 bnthbh.exe 1584 jdppj.exe 2536 jjvdd.exe 2780 jdvdv.exe 1500 fxrrrrf.exe 1232 tnnbtb.exe 2100 tntbhn.exe 2332 vpddd.exe 2452 dvpdj.exe 324 lxrflxx.exe 720 1flllll.exe 2508 3htnnn.exe 1648 7hbbnt.exe 1848 pjddj.exe -
Processes:
resource yara_rule behavioral1/memory/1756-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1320-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1088-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1584-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1912-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1044-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-303-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0a5ecea5c89d4ed6891aa742f120a280_NeikiAnalytics.exedvjjp.exejppjp.exetnbhtt.exevjddp.exe3lxxffr.exefxllxfx.exetnhbnn.exevjppd.exedjjvp.exefrxxfxx.exe7nthtb.exebthnhn.exe1pjdp.exefxrfrff.exe5xlxlrf.exedescription pid process target process PID 1756 wrote to memory of 2280 1756 0a5ecea5c89d4ed6891aa742f120a280_NeikiAnalytics.exe dvjjp.exe PID 1756 wrote to memory of 2280 1756 0a5ecea5c89d4ed6891aa742f120a280_NeikiAnalytics.exe dvjjp.exe PID 1756 wrote to memory of 2280 1756 0a5ecea5c89d4ed6891aa742f120a280_NeikiAnalytics.exe dvjjp.exe PID 1756 wrote to memory of 2280 1756 0a5ecea5c89d4ed6891aa742f120a280_NeikiAnalytics.exe dvjjp.exe PID 2280 wrote to memory of 2560 2280 dvjjp.exe jppjp.exe PID 2280 wrote to memory of 2560 2280 dvjjp.exe jppjp.exe PID 2280 wrote to memory of 2560 2280 dvjjp.exe jppjp.exe PID 2280 wrote to memory of 2560 2280 dvjjp.exe jppjp.exe PID 2560 wrote to memory of 2664 2560 jppjp.exe tnbhtt.exe PID 2560 wrote to memory of 2664 2560 jppjp.exe tnbhtt.exe PID 2560 wrote to memory of 2664 2560 jppjp.exe tnbhtt.exe PID 2560 wrote to memory of 2664 2560 jppjp.exe tnbhtt.exe PID 2664 wrote to memory of 1320 2664 tnbhtt.exe vjddp.exe PID 2664 wrote to memory of 1320 2664 tnbhtt.exe vjddp.exe PID 2664 wrote to memory of 1320 2664 tnbhtt.exe vjddp.exe PID 2664 wrote to memory of 1320 2664 tnbhtt.exe vjddp.exe PID 1320 wrote to memory of 2684 1320 vjddp.exe 3lxxffr.exe PID 1320 wrote to memory of 2684 1320 vjddp.exe 3lxxffr.exe PID 1320 wrote to memory of 2684 1320 vjddp.exe 3lxxffr.exe PID 1320 wrote to memory of 2684 1320 vjddp.exe 3lxxffr.exe PID 2684 wrote to memory of 2632 2684 3lxxffr.exe fxllxfx.exe PID 2684 wrote to memory of 2632 2684 3lxxffr.exe fxllxfx.exe PID 2684 wrote to memory of 2632 2684 3lxxffr.exe fxllxfx.exe PID 2684 wrote to memory of 2632 2684 3lxxffr.exe fxllxfx.exe PID 2632 wrote to memory of 2384 2632 fxllxfx.exe tnhbnn.exe PID 2632 wrote to memory of 2384 2632 fxllxfx.exe tnhbnn.exe PID 2632 wrote to memory of 2384 2632 fxllxfx.exe tnhbnn.exe PID 2632 wrote to memory of 2384 2632 fxllxfx.exe tnhbnn.exe PID 2384 wrote to memory of 2972 2384 tnhbnn.exe vjppd.exe PID 2384 wrote to memory of 2972 2384 tnhbnn.exe vjppd.exe PID 2384 wrote to memory of 2972 2384 tnhbnn.exe vjppd.exe PID 2384 wrote to memory of 2972 2384 tnhbnn.exe vjppd.exe PID 2972 wrote to memory of 1088 2972 vjppd.exe djjvp.exe PID 2972 wrote to memory of 1088 2972 vjppd.exe djjvp.exe PID 2972 wrote to memory of 1088 2972 vjppd.exe djjvp.exe PID 2972 wrote to memory of 1088 2972 vjppd.exe djjvp.exe PID 1088 wrote to memory of 2816 1088 djjvp.exe frxxfxx.exe PID 1088 wrote to memory of 2816 1088 djjvp.exe frxxfxx.exe PID 1088 wrote to memory of 2816 1088 djjvp.exe frxxfxx.exe PID 1088 wrote to memory of 2816 1088 djjvp.exe frxxfxx.exe PID 2816 wrote to memory of 2968 2816 frxxfxx.exe 7nthtb.exe PID 2816 wrote to memory of 2968 2816 frxxfxx.exe 7nthtb.exe PID 2816 wrote to memory of 2968 2816 frxxfxx.exe 7nthtb.exe PID 2816 wrote to memory of 2968 2816 frxxfxx.exe 7nthtb.exe PID 2968 wrote to memory of 1884 2968 7nthtb.exe bthnhn.exe PID 2968 wrote to memory of 1884 2968 7nthtb.exe bthnhn.exe PID 2968 wrote to memory of 1884 2968 7nthtb.exe bthnhn.exe PID 2968 wrote to memory of 1884 2968 7nthtb.exe bthnhn.exe PID 1884 wrote to memory of 1988 1884 bthnhn.exe 1pjdp.exe PID 1884 wrote to memory of 1988 1884 bthnhn.exe 1pjdp.exe PID 1884 wrote to memory of 1988 1884 bthnhn.exe 1pjdp.exe PID 1884 wrote to memory of 1988 1884 bthnhn.exe 1pjdp.exe PID 1988 wrote to memory of 1584 1988 1pjdp.exe fxrfrff.exe PID 1988 wrote to memory of 1584 1988 1pjdp.exe fxrfrff.exe PID 1988 wrote to memory of 1584 1988 1pjdp.exe fxrfrff.exe PID 1988 wrote to memory of 1584 1988 1pjdp.exe fxrfrff.exe PID 1584 wrote to memory of 2456 1584 fxrfrff.exe 5xlxlrf.exe PID 1584 wrote to memory of 2456 1584 fxrfrff.exe 5xlxlrf.exe PID 1584 wrote to memory of 2456 1584 fxrfrff.exe 5xlxlrf.exe PID 1584 wrote to memory of 2456 1584 fxrfrff.exe 5xlxlrf.exe PID 2456 wrote to memory of 2768 2456 5xlxlrf.exe ttnthn.exe PID 2456 wrote to memory of 2768 2456 5xlxlrf.exe ttnthn.exe PID 2456 wrote to memory of 2768 2456 5xlxlrf.exe ttnthn.exe PID 2456 wrote to memory of 2768 2456 5xlxlrf.exe ttnthn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a5ecea5c89d4ed6891aa742f120a280_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0a5ecea5c89d4ed6891aa742f120a280_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\dvjjp.exec:\dvjjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\jppjp.exec:\jppjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\tnbhtt.exec:\tnbhtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\vjddp.exec:\vjddp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\3lxxffr.exec:\3lxxffr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\fxllxfx.exec:\fxllxfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\tnhbnn.exec:\tnhbnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\vjppd.exec:\vjppd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\djjvp.exec:\djjvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\frxxfxx.exec:\frxxfxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\7nthtb.exec:\7nthtb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\bthnhn.exec:\bthnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\1pjdp.exec:\1pjdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\fxrfrff.exec:\fxrfrff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\5xlxlrf.exec:\5xlxlrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\ttnthn.exec:\ttnthn.exe17⤵
- Executes dropped EXE
PID:2768 -
\??\c:\nnbnbb.exec:\nnbnbb.exe18⤵
- Executes dropped EXE
PID:1640 -
\??\c:\5dvdj.exec:\5dvdj.exe19⤵
- Executes dropped EXE
PID:2100 -
\??\c:\pvvdp.exec:\pvvdp.exe20⤵
- Executes dropped EXE
PID:2564 -
\??\c:\xrlrxff.exec:\xrlrxff.exe21⤵
- Executes dropped EXE
PID:1268 -
\??\c:\ttbhhb.exec:\ttbhhb.exe22⤵
- Executes dropped EXE
PID:1964 -
\??\c:\7bbthb.exec:\7bbthb.exe23⤵
- Executes dropped EXE
PID:112 -
\??\c:\7vvvp.exec:\7vvvp.exe24⤵
- Executes dropped EXE
PID:1648 -
\??\c:\vvvjd.exec:\vvvjd.exe25⤵
- Executes dropped EXE
PID:1912 -
\??\c:\rlxfrxl.exec:\rlxfrxl.exe26⤵
- Executes dropped EXE
PID:2928 -
\??\c:\tttbnb.exec:\tttbnb.exe27⤵
- Executes dropped EXE
PID:1044 -
\??\c:\nnbnhn.exec:\nnbnhn.exe28⤵
- Executes dropped EXE
PID:1028 -
\??\c:\3vpjd.exec:\3vpjd.exe29⤵
- Executes dropped EXE
PID:552 -
\??\c:\rfrxlxf.exec:\rfrxlxf.exe30⤵
- Executes dropped EXE
PID:572 -
\??\c:\nhhnbh.exec:\nhhnbh.exe31⤵
- Executes dropped EXE
PID:2184 -
\??\c:\hhbhtb.exec:\hhbhtb.exe32⤵
- Executes dropped EXE
PID:1620 -
\??\c:\jdjvv.exec:\jdjvv.exe33⤵
- Executes dropped EXE
PID:2144 -
\??\c:\1xlllrr.exec:\1xlllrr.exe34⤵
- Executes dropped EXE
PID:1580 -
\??\c:\rllrrrx.exec:\rllrrrx.exe35⤵
- Executes dropped EXE
PID:2272 -
\??\c:\5hnnnt.exec:\5hnnnt.exe36⤵
- Executes dropped EXE
PID:2680 -
\??\c:\jdvdj.exec:\jdvdj.exe37⤵
- Executes dropped EXE
PID:2616 -
\??\c:\9llxlxr.exec:\9llxlxr.exe38⤵
- Executes dropped EXE
PID:2476 -
\??\c:\7nhnht.exec:\7nhnht.exe39⤵
- Executes dropped EXE
PID:2884 -
\??\c:\tntthn.exec:\tntthn.exe40⤵
- Executes dropped EXE
PID:2728 -
\??\c:\vvdvd.exec:\vvdvd.exe41⤵
- Executes dropped EXE
PID:2592 -
\??\c:\jdvdv.exec:\jdvdv.exe42⤵
- Executes dropped EXE
PID:2468 -
\??\c:\lrxxxlx.exec:\lrxxxlx.exe43⤵
- Executes dropped EXE
PID:2520 -
\??\c:\5rlxllx.exec:\5rlxllx.exe44⤵
- Executes dropped EXE
PID:2500 -
\??\c:\bhntnt.exec:\bhntnt.exe45⤵
- Executes dropped EXE
PID:2424 -
\??\c:\hbthtb.exec:\hbthtb.exe46⤵
- Executes dropped EXE
PID:2776 -
\??\c:\1vvvd.exec:\1vvvd.exe47⤵
- Executes dropped EXE
PID:2840 -
\??\c:\vjvvj.exec:\vjvvj.exe48⤵
- Executes dropped EXE
PID:2852 -
\??\c:\xfllxxf.exec:\xfllxxf.exe49⤵
- Executes dropped EXE
PID:2940 -
\??\c:\1fxlrxf.exec:\1fxlrxf.exe50⤵
- Executes dropped EXE
PID:2716 -
\??\c:\3hhnbh.exec:\3hhnbh.exe51⤵
- Executes dropped EXE
PID:1432 -
\??\c:\bnthbh.exec:\bnthbh.exe52⤵
- Executes dropped EXE
PID:1988 -
\??\c:\jdppj.exec:\jdppj.exe53⤵
- Executes dropped EXE
PID:1584 -
\??\c:\jjvdd.exec:\jjvdd.exe54⤵
- Executes dropped EXE
PID:2536 -
\??\c:\jdvdv.exec:\jdvdv.exe55⤵
- Executes dropped EXE
PID:2780 -
\??\c:\fxrrrrf.exec:\fxrrrrf.exe56⤵
- Executes dropped EXE
PID:1500 -
\??\c:\tnnbtb.exec:\tnnbtb.exe57⤵
- Executes dropped EXE
PID:1232 -
\??\c:\tntbhn.exec:\tntbhn.exe58⤵
- Executes dropped EXE
PID:2100 -
\??\c:\vpddd.exec:\vpddd.exe59⤵
- Executes dropped EXE
PID:2332 -
\??\c:\dvpdj.exec:\dvpdj.exe60⤵
- Executes dropped EXE
PID:2452 -
\??\c:\lxrflxx.exec:\lxrflxx.exe61⤵
- Executes dropped EXE
PID:324 -
\??\c:\1flllll.exec:\1flllll.exe62⤵
- Executes dropped EXE
PID:720 -
\??\c:\3htnnn.exec:\3htnnn.exe63⤵
- Executes dropped EXE
PID:2508 -
\??\c:\7hbbnt.exec:\7hbbnt.exe64⤵
- Executes dropped EXE
PID:1648 -
\??\c:\pjddj.exec:\pjddj.exe65⤵
- Executes dropped EXE
PID:1848 -
\??\c:\9lrxrxr.exec:\9lrxrxr.exe66⤵PID:2928
-
\??\c:\lxlrxrx.exec:\lxlrxrx.exe67⤵PID:2308
-
\??\c:\rllffff.exec:\rllffff.exe68⤵PID:936
-
\??\c:\nntbtb.exec:\nntbtb.exe69⤵PID:908
-
\??\c:\bnthnh.exec:\bnthnh.exe70⤵PID:320
-
\??\c:\pvpdd.exec:\pvpdd.exe71⤵PID:1808
-
\??\c:\lxflfff.exec:\lxflfff.exe72⤵PID:1508
-
\??\c:\7rfxlxl.exec:\7rfxlxl.exe73⤵PID:1880
-
\??\c:\tnhhtb.exec:\tnhhtb.exe74⤵PID:1744
-
\??\c:\nbnnnb.exec:\nbnnnb.exe75⤵PID:3060
-
\??\c:\dvvvd.exec:\dvvvd.exe76⤵PID:2260
-
\??\c:\jvddv.exec:\jvddv.exe77⤵PID:1116
-
\??\c:\7xlrrrx.exec:\7xlrrrx.exe78⤵PID:2572
-
\??\c:\lflfllr.exec:\lflfllr.exe79⤵PID:2692
-
\??\c:\hnttnn.exec:\hnttnn.exe80⤵PID:2628
-
\??\c:\btntnt.exec:\btntnt.exe81⤵PID:2820
-
\??\c:\dpvvd.exec:\dpvvd.exe82⤵PID:2812
-
\??\c:\jpvjd.exec:\jpvjd.exe83⤵PID:2524
-
\??\c:\lffflfl.exec:\lffflfl.exe84⤵PID:2632
-
\??\c:\rfrllff.exec:\rfrllff.exe85⤵PID:2464
-
\??\c:\bnntbb.exec:\bnntbb.exe86⤵PID:2988
-
\??\c:\dvddj.exec:\dvddj.exe87⤵PID:2792
-
\??\c:\vpjjd.exec:\vpjjd.exe88⤵PID:2824
-
\??\c:\lflrxxx.exec:\lflrxxx.exe89⤵PID:2960
-
\??\c:\lrllrxx.exec:\lrllrxx.exe90⤵PID:2952
-
\??\c:\rlfllrx.exec:\rlfllrx.exe91⤵PID:1788
-
\??\c:\hbbbhh.exec:\hbbbhh.exe92⤵PID:1884
-
\??\c:\nbnnhn.exec:\nbnnhn.exe93⤵PID:292
-
\??\c:\dpdjv.exec:\dpdjv.exe94⤵PID:556
-
\??\c:\jvddd.exec:\jvddd.exe95⤵PID:1152
-
\??\c:\1xrllll.exec:\1xrllll.exe96⤵PID:1532
-
\??\c:\frrrrlr.exec:\frrrrlr.exe97⤵PID:1708
-
\??\c:\3rllxxf.exec:\3rllxxf.exe98⤵PID:1276
-
\??\c:\nhnnhb.exec:\nhnnhb.exe99⤵PID:2032
-
\??\c:\bbbhhn.exec:\bbbhhn.exe100⤵PID:2448
-
\??\c:\vpddj.exec:\vpddj.exe101⤵PID:2028
-
\??\c:\vdppv.exec:\vdppv.exe102⤵PID:540
-
\??\c:\llxxxlr.exec:\llxxxlr.exe103⤵PID:1492
-
\??\c:\fxfxflx.exec:\fxfxflx.exe104⤵PID:988
-
\??\c:\nhnhnn.exec:\nhnhnn.exe105⤵PID:1356
-
\??\c:\hhttbb.exec:\hhttbb.exe106⤵PID:916
-
\??\c:\jdjvv.exec:\jdjvv.exe107⤵PID:1332
-
\??\c:\7vjjd.exec:\7vjjd.exe108⤵PID:920
-
\??\c:\lxllrrx.exec:\lxllrrx.exe109⤵PID:852
-
\??\c:\7lrrrxx.exec:\7lrrrxx.exe110⤵PID:3024
-
\??\c:\hbbbnn.exec:\hbbbnn.exe111⤵PID:1688
-
\??\c:\1htbbb.exec:\1htbbb.exe112⤵PID:1784
-
\??\c:\1jdvd.exec:\1jdvd.exe113⤵PID:2176
-
\??\c:\dpppp.exec:\dpppp.exe114⤵PID:2184
-
\??\c:\vvddj.exec:\vvddj.exe115⤵PID:2752
-
\??\c:\fxflxxf.exec:\fxflxxf.exe116⤵PID:1712
-
\??\c:\fffrxxf.exec:\fffrxxf.exe117⤵PID:1828
-
\??\c:\3bhntn.exec:\3bhntn.exe118⤵PID:2280
-
\??\c:\tbbbbb.exec:\tbbbbb.exe119⤵PID:3048
-
\??\c:\5jdpv.exec:\5jdpv.exe120⤵PID:2688
-
\??\c:\vjjjp.exec:\vjjjp.exe121⤵PID:2664
-
\??\c:\fxlllrx.exec:\fxlllrx.exe122⤵PID:2732
-
\??\c:\lffffxf.exec:\lffffxf.exe123⤵PID:2784
-
\??\c:\rlrlflr.exec:\rlrlflr.exe124⤵PID:2684
-
\??\c:\tbbtth.exec:\tbbtth.exe125⤵PID:2512
-
\??\c:\hbthnt.exec:\hbthnt.exe126⤵PID:2636
-
\??\c:\jvdvd.exec:\jvdvd.exe127⤵PID:2188
-
\??\c:\vpvdv.exec:\vpvdv.exe128⤵PID:3036
-
\??\c:\5frxffl.exec:\5frxffl.exe129⤵PID:1644
-
\??\c:\rfffrxl.exec:\rfffrxl.exe130⤵PID:2800
-
\??\c:\bntntt.exec:\bntntt.exe131⤵PID:2964
-
\??\c:\bnbbth.exec:\bnbbth.exe132⤵PID:1668
-
\??\c:\thtbtt.exec:\thtbtt.exe133⤵PID:1652
-
\??\c:\jdddv.exec:\jdddv.exe134⤵PID:1736
-
\??\c:\jvddd.exec:\jvddd.exe135⤵PID:1416
-
\??\c:\lxxrxrf.exec:\lxxrxrf.exe136⤵PID:1988
-
\??\c:\fxfxllx.exec:\fxfxllx.exe137⤵PID:1560
-
\??\c:\5nhhnn.exec:\5nhhnn.exe138⤵PID:1524
-
\??\c:\nhnthh.exec:\nhnthh.exe139⤵PID:1640
-
\??\c:\htnnnh.exec:\htnnnh.exe140⤵PID:1548
-
\??\c:\jdvjd.exec:\jdvjd.exe141⤵PID:2892
-
\??\c:\dpvpp.exec:\dpvpp.exe142⤵PID:2292
-
\??\c:\rfllffr.exec:\rfllffr.exe143⤵PID:1268
-
\??\c:\lfxlxrx.exec:\lfxlxrx.exe144⤵PID:2452
-
\??\c:\thnhtn.exec:\thnhtn.exe145⤵PID:608
-
\??\c:\bthnnn.exec:\bthnnn.exe146⤵PID:1772
-
\??\c:\vvvdd.exec:\vvvdd.exe147⤵PID:2000
-
\??\c:\pdpvd.exec:\pdpvd.exe148⤵PID:1776
-
\??\c:\9vjjp.exec:\9vjjp.exe149⤵PID:1084
-
\??\c:\lxlfrlr.exec:\lxlfrlr.exe150⤵PID:892
-
\??\c:\hbnhnt.exec:\hbnhnt.exe151⤵PID:1160
-
\??\c:\hnthnb.exec:\hnthnb.exe152⤵PID:2196
-
\??\c:\7hnhbt.exec:\7hnhbt.exe153⤵PID:3032
-
\??\c:\ddvpj.exec:\ddvpj.exe154⤵PID:2120
-
\??\c:\9jppd.exec:\9jppd.exe155⤵PID:3052
-
\??\c:\xlxxlfr.exec:\xlxxlfr.exe156⤵PID:1756
-
\??\c:\frflxxf.exec:\frflxxf.exe157⤵PID:1752
-
\??\c:\lxfxffx.exec:\lxfxffx.exe158⤵PID:1608
-
\??\c:\3tnhnt.exec:\3tnhnt.exe159⤵PID:2264
-
\??\c:\5thnbt.exec:\5thnbt.exe160⤵PID:2656
-
\??\c:\pjdpj.exec:\pjdpj.exe161⤵PID:2680
-
\??\c:\jdddp.exec:\jdddp.exe162⤵PID:2744
-
\??\c:\3xrrffr.exec:\3xrrffr.exe163⤵PID:2600
-
\??\c:\rrfrlxf.exec:\rrfrlxf.exe164⤵PID:2828
-
\??\c:\frxrrfl.exec:\frxrrfl.exe165⤵PID:340
-
\??\c:\3thhnt.exec:\3thhnt.exe166⤵PID:1200
-
\??\c:\nhnnbt.exec:\nhnnbt.exe167⤵PID:2468
-
\??\c:\pjvvp.exec:\pjvvp.exe168⤵PID:2520
-
\??\c:\3jdjv.exec:\3jdjv.exe169⤵PID:2168
-
\??\c:\pppvv.exec:\pppvv.exe170⤵PID:764
-
\??\c:\7fxxfff.exec:\7fxxfff.exe171⤵PID:2796
-
\??\c:\fxxfllr.exec:\fxxfllr.exe172⤵PID:3000
-
\??\c:\bttbhh.exec:\bttbhh.exe173⤵PID:1676
-
\??\c:\5bbtht.exec:\5bbtht.exe174⤵PID:2940
-
\??\c:\1jdjp.exec:\1jdjp.exe175⤵PID:2716
-
\??\c:\9ddpv.exec:\9ddpv.exe176⤵PID:2528
-
\??\c:\3pjpj.exec:\3pjpj.exe177⤵PID:2788
-
\??\c:\xrxxxfl.exec:\xrxxxfl.exe178⤵PID:1584
-
\??\c:\hhbhbt.exec:\hhbhbt.exe179⤵PID:2536
-
\??\c:\btnhtn.exec:\btnhtn.exe180⤵PID:1524
-
\??\c:\jpvvv.exec:\jpvvv.exe181⤵PID:628
-
\??\c:\pjdvd.exec:\pjdvd.exe182⤵PID:2296
-
\??\c:\flfxflx.exec:\flfxflx.exe183⤵PID:2100
-
\??\c:\xlrflxl.exec:\xlrflxl.exe184⤵PID:392
-
\??\c:\hbntbb.exec:\hbntbb.exe185⤵PID:1964
-
\??\c:\1ttbnt.exec:\1ttbnt.exe186⤵PID:1476
-
\??\c:\pjddd.exec:\pjddd.exe187⤵PID:2160
-
\??\c:\dvjpp.exec:\dvjpp.exe188⤵PID:1624
-
\??\c:\jdpvp.exec:\jdpvp.exe189⤵PID:1356
-
\??\c:\llfflrf.exec:\llfflrf.exe190⤵PID:1848
-
\??\c:\9rrxxlx.exec:\9rrxxlx.exe191⤵PID:2876
-
\??\c:\nnbnbn.exec:\nnbnbn.exe192⤵PID:2916
-
\??\c:\nhtnhn.exec:\nhtnhn.exe193⤵PID:1724
-
\??\c:\9jjpd.exec:\9jjpd.exe194⤵PID:2196
-
\??\c:\dpdjv.exec:\dpdjv.exe195⤵PID:3012
-
\??\c:\9frxfrf.exec:\9frxfrf.exe196⤵PID:1784
-
\??\c:\ffxffxf.exec:\ffxffxf.exe197⤵PID:2224
-
\??\c:\7xrlxlf.exec:\7xrlxlf.exe198⤵PID:1880
-
\??\c:\7nbhth.exec:\7nbhth.exe199⤵PID:1660
-
\??\c:\dvjpj.exec:\dvjpj.exe200⤵PID:2140
-
\??\c:\vvvjp.exec:\vvvjp.exe201⤵PID:2252
-
\??\c:\7dpvd.exec:\7dpvd.exe202⤵PID:2676
-
\??\c:\7rxrrxl.exec:\7rxrrxl.exe203⤵PID:1428
-
\??\c:\xxfrflx.exec:\xxfrflx.exe204⤵PID:2692
-
\??\c:\nnnthh.exec:\nnnthh.exe205⤵PID:2736
-
\??\c:\btbnbn.exec:\btbnbn.exe206⤵PID:3064
-
\??\c:\jvvjj.exec:\jvvjj.exe207⤵PID:2592
-
\??\c:\5vjvv.exec:\5vjvv.exe208⤵PID:2524
-
\??\c:\lfffflr.exec:\lfffflr.exe209⤵PID:2532
-
\??\c:\1fllllf.exec:\1fllllf.exe210⤵PID:2992
-
\??\c:\5htntn.exec:\5htntn.exe211⤵PID:2988
-
\??\c:\1hnnnh.exec:\1hnnnh.exe212⤵PID:3036
-
\??\c:\jvvvd.exec:\jvvvd.exe213⤵PID:2652
-
\??\c:\3frflxx.exec:\3frflxx.exe214⤵PID:2924
-
\??\c:\3xflrxf.exec:\3xflrxf.exe215⤵PID:2952
-
\??\c:\hnnbtb.exec:\hnnbtb.exe216⤵PID:1788
-
\??\c:\tnhbbb.exec:\tnhbbb.exe217⤵PID:380
-
\??\c:\djpjd.exec:\djpjd.exe218⤵PID:1432
-
\??\c:\jdjjv.exec:\jdjjv.exe219⤵PID:556
-
\??\c:\rffffff.exec:\rffffff.exe220⤵PID:2456
-
\??\c:\xxrxflr.exec:\xxrxflr.exe221⤵PID:2768
-
\??\c:\3tthnt.exec:\3tthnt.exe222⤵PID:2044
-
\??\c:\bbthhh.exec:\bbthhh.exe223⤵PID:2244
-
\??\c:\dvppv.exec:\dvppv.exe224⤵PID:1680
-
\??\c:\jdpjp.exec:\jdpjp.exe225⤵PID:2332
-
\??\c:\1frxffl.exec:\1frxffl.exe226⤵PID:448
-
\??\c:\7frfffl.exec:\7frfffl.exe227⤵PID:324
-
\??\c:\hbhhhh.exec:\hbhhhh.exe228⤵PID:1492
-
\??\c:\bbhbth.exec:\bbhbth.exe229⤵PID:3004
-
\??\c:\7djjv.exec:\7djjv.exe230⤵PID:2336
-
\??\c:\dvdjd.exec:\dvdjd.exe231⤵PID:916
-
\??\c:\llrrrxr.exec:\llrrrxr.exe232⤵PID:1332
-
\??\c:\xrllflr.exec:\xrllflr.exe233⤵PID:2308
-
\??\c:\3bthnt.exec:\3bthnt.exe234⤵PID:1040
-
\??\c:\bntthh.exec:\bntthh.exe235⤵PID:752
-
\??\c:\bthbht.exec:\bthbht.exe236⤵PID:2288
-
\??\c:\pdpvp.exec:\pdpvp.exe237⤵PID:980
-
\??\c:\jdvvd.exec:\jdvvd.exe238⤵PID:1784
-
\??\c:\lllxrxl.exec:\lllxrxl.exe239⤵PID:2184
-
\??\c:\fxxrllx.exec:\fxxrllx.exe240⤵PID:2752
-
\??\c:\btbbhh.exec:\btbbhh.exe241⤵PID:1712
-