Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 23:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5e5fa6abb78b337db014c67da8007de0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
5e5fa6abb78b337db014c67da8007de0_NeikiAnalytics.exe
-
Size
74KB
-
MD5
5e5fa6abb78b337db014c67da8007de0
-
SHA1
68301dca22e9872c85d616a1a1ed0f172d952974
-
SHA256
0e3f42e05bc777b2cab3d1fa3e69979d290b05c6644aff549276e991bfe8df3f
-
SHA512
548a68fdf1994dada640e75fd0fe6c373f9328eba14dc777fb882cf09c72af65979bc5e1306252db61ad976c57c00a34e8f0175e379a6eba55795496fdc72005
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqK2:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqK2
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral1/memory/2320-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3040-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2320-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2360-39-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2360-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1388-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1388-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1284-10-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1284-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1032-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1124-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1616-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1976-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/708-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1792-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1800-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1920-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
1nbttb.exe1hbnbh.exejdppv.exejjjpj.exe1flrlrl.exelxlfrxf.exelfxxxxf.exehntntn.exe5hhbnb.exepjvjp.exevdjdp.exe7bttbh.exevpjvd.exeffrlrrf.exe3lfrfrx.exe1tnnhn.exe9bbtnn.exepjjpv.exejdvpv.exellflffl.exe7thntt.exe5pjdj.exerflfffl.exebbbbnt.exeddvvd.exejjvdp.exebbtbhn.exeddvdp.exejdvjp.exefflrlfr.exefxrrlrr.exethhbth.exejdppv.exe5pdjv.exelfxflrx.exexxlxlfx.exenhtbht.exenhtbnt.exedvvpp.exe1jvpp.exe5xxflrx.exefxlxfll.exebbhhtt.exehbnnnt.exedvpdj.exe1djvj.exe3vjdd.exerlflrxf.exetntbnt.exepjpvj.exedjdpv.exerrrfrfr.exexrflxfl.exenhbhhn.exennhhtn.exepjjvv.exevjddd.exe1rlxlrf.exexrxxlrf.exenhtbht.exehbtnbt.exejjdvv.exejjjjp.exelxrlrrx.exepid process 1388 1nbttb.exe 2320 1hbnbh.exe 2360 jdppv.exe 2752 jjjpj.exe 2512 1flrlrl.exe 2540 lxlfrxf.exe 2704 lfxxxxf.exe 2520 hntntn.exe 3040 5hhbnb.exe 1032 pjvjp.exe 2768 vdjdp.exe 1124 7bttbh.exe 1968 vpjvd.exe 1616 ffrlrrf.exe 1976 3lfrfrx.exe 664 1tnnhn.exe 1156 9bbtnn.exe 796 pjjpv.exe 2204 jdvpv.exe 1568 llflffl.exe 2920 7thntt.exe 1256 5pjdj.exe 2968 rflfffl.exe 708 bbbbnt.exe 1792 ddvvd.exe 2848 jjvdp.exe 1264 bbtbhn.exe 1800 ddvdp.exe 1916 jdvjp.exe 1920 fflrlfr.exe 2472 fxrrlrr.exe 876 thhbth.exe 1244 jdppv.exe 3068 5pdjv.exe 2360 lfxflrx.exe 2796 xxlxlfx.exe 1656 nhtbht.exe 2180 nhtbnt.exe 2656 dvvpp.exe 2536 1jvpp.exe 2720 5xxflrx.exe 2584 fxlxfll.exe 2500 bbhhtt.exe 2044 hbnnnt.exe 2568 dvpdj.exe 1564 1djvj.exe 2596 3vjdd.exe 2684 rlflrxf.exe 2768 tntbnt.exe 1744 pjpvj.exe 1260 djdpv.exe 2224 rrrfrfr.exe 2404 xrflxfl.exe 484 nhbhhn.exe 1484 nnhhtn.exe 760 pjjvv.exe 1140 vjddd.exe 1724 1rlxlrf.exe 1644 xrxxlrf.exe 2904 nhtbht.exe 3020 hbtnbt.exe 2272 jjdvv.exe 2688 jjjjp.exe 1848 lxrlrrx.exe -
Processes:
resource yara_rule behavioral1/memory/2320-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1388-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1284-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1032-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1124-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1616-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/708-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1800-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1920-289-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5e5fa6abb78b337db014c67da8007de0_NeikiAnalytics.exe1nbttb.exe1hbnbh.exejdppv.exejjjpj.exe1flrlrl.exelxlfrxf.exelfxxxxf.exehntntn.exe5hhbnb.exepjvjp.exevdjdp.exe7bttbh.exevpjvd.exeffrlrrf.exe3lfrfrx.exedescription pid process target process PID 1284 wrote to memory of 1388 1284 5e5fa6abb78b337db014c67da8007de0_NeikiAnalytics.exe 1nbttb.exe PID 1284 wrote to memory of 1388 1284 5e5fa6abb78b337db014c67da8007de0_NeikiAnalytics.exe 1nbttb.exe PID 1284 wrote to memory of 1388 1284 5e5fa6abb78b337db014c67da8007de0_NeikiAnalytics.exe 1nbttb.exe PID 1284 wrote to memory of 1388 1284 5e5fa6abb78b337db014c67da8007de0_NeikiAnalytics.exe 1nbttb.exe PID 1388 wrote to memory of 2320 1388 1nbttb.exe 1hbnbh.exe PID 1388 wrote to memory of 2320 1388 1nbttb.exe 1hbnbh.exe PID 1388 wrote to memory of 2320 1388 1nbttb.exe 1hbnbh.exe PID 1388 wrote to memory of 2320 1388 1nbttb.exe 1hbnbh.exe PID 2320 wrote to memory of 2360 2320 1hbnbh.exe jdppv.exe PID 2320 wrote to memory of 2360 2320 1hbnbh.exe jdppv.exe PID 2320 wrote to memory of 2360 2320 1hbnbh.exe jdppv.exe PID 2320 wrote to memory of 2360 2320 1hbnbh.exe jdppv.exe PID 2360 wrote to memory of 2752 2360 jdppv.exe jjjpj.exe PID 2360 wrote to memory of 2752 2360 jdppv.exe jjjpj.exe PID 2360 wrote to memory of 2752 2360 jdppv.exe jjjpj.exe PID 2360 wrote to memory of 2752 2360 jdppv.exe jjjpj.exe PID 2752 wrote to memory of 2512 2752 jjjpj.exe 1flrlrl.exe PID 2752 wrote to memory of 2512 2752 jjjpj.exe 1flrlrl.exe PID 2752 wrote to memory of 2512 2752 jjjpj.exe 1flrlrl.exe PID 2752 wrote to memory of 2512 2752 jjjpj.exe 1flrlrl.exe PID 2512 wrote to memory of 2540 2512 1flrlrl.exe lxlfrxf.exe PID 2512 wrote to memory of 2540 2512 1flrlrl.exe lxlfrxf.exe PID 2512 wrote to memory of 2540 2512 1flrlrl.exe lxlfrxf.exe PID 2512 wrote to memory of 2540 2512 1flrlrl.exe lxlfrxf.exe PID 2540 wrote to memory of 2704 2540 lxlfrxf.exe lfxxxxf.exe PID 2540 wrote to memory of 2704 2540 lxlfrxf.exe lfxxxxf.exe PID 2540 wrote to memory of 2704 2540 lxlfrxf.exe lfxxxxf.exe PID 2540 wrote to memory of 2704 2540 lxlfrxf.exe lfxxxxf.exe PID 2704 wrote to memory of 2520 2704 lfxxxxf.exe hntntn.exe PID 2704 wrote to memory of 2520 2704 lfxxxxf.exe hntntn.exe PID 2704 wrote to memory of 2520 2704 lfxxxxf.exe hntntn.exe PID 2704 wrote to memory of 2520 2704 lfxxxxf.exe hntntn.exe PID 2520 wrote to memory of 3040 2520 hntntn.exe 5hhbnb.exe PID 2520 wrote to memory of 3040 2520 hntntn.exe 5hhbnb.exe PID 2520 wrote to memory of 3040 2520 hntntn.exe 5hhbnb.exe PID 2520 wrote to memory of 3040 2520 hntntn.exe 5hhbnb.exe PID 3040 wrote to memory of 1032 3040 5hhbnb.exe pjvjp.exe PID 3040 wrote to memory of 1032 3040 5hhbnb.exe pjvjp.exe PID 3040 wrote to memory of 1032 3040 5hhbnb.exe pjvjp.exe PID 3040 wrote to memory of 1032 3040 5hhbnb.exe pjvjp.exe PID 1032 wrote to memory of 2768 1032 pjvjp.exe vdjdp.exe PID 1032 wrote to memory of 2768 1032 pjvjp.exe vdjdp.exe PID 1032 wrote to memory of 2768 1032 pjvjp.exe vdjdp.exe PID 1032 wrote to memory of 2768 1032 pjvjp.exe vdjdp.exe PID 2768 wrote to memory of 1124 2768 vdjdp.exe 7bttbh.exe PID 2768 wrote to memory of 1124 2768 vdjdp.exe 7bttbh.exe PID 2768 wrote to memory of 1124 2768 vdjdp.exe 7bttbh.exe PID 2768 wrote to memory of 1124 2768 vdjdp.exe 7bttbh.exe PID 1124 wrote to memory of 1968 1124 7bttbh.exe vpjvd.exe PID 1124 wrote to memory of 1968 1124 7bttbh.exe vpjvd.exe PID 1124 wrote to memory of 1968 1124 7bttbh.exe vpjvd.exe PID 1124 wrote to memory of 1968 1124 7bttbh.exe vpjvd.exe PID 1968 wrote to memory of 1616 1968 vpjvd.exe ffrlrrf.exe PID 1968 wrote to memory of 1616 1968 vpjvd.exe ffrlrrf.exe PID 1968 wrote to memory of 1616 1968 vpjvd.exe ffrlrrf.exe PID 1968 wrote to memory of 1616 1968 vpjvd.exe ffrlrrf.exe PID 1616 wrote to memory of 1976 1616 ffrlrrf.exe 3lfrfrx.exe PID 1616 wrote to memory of 1976 1616 ffrlrrf.exe 3lfrfrx.exe PID 1616 wrote to memory of 1976 1616 ffrlrrf.exe 3lfrfrx.exe PID 1616 wrote to memory of 1976 1616 ffrlrrf.exe 3lfrfrx.exe PID 1976 wrote to memory of 664 1976 3lfrfrx.exe 1tnnhn.exe PID 1976 wrote to memory of 664 1976 3lfrfrx.exe 1tnnhn.exe PID 1976 wrote to memory of 664 1976 3lfrfrx.exe 1tnnhn.exe PID 1976 wrote to memory of 664 1976 3lfrfrx.exe 1tnnhn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e5fa6abb78b337db014c67da8007de0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5e5fa6abb78b337db014c67da8007de0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\1nbttb.exec:\1nbttb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\1hbnbh.exec:\1hbnbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\jdppv.exec:\jdppv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\jjjpj.exec:\jjjpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\1flrlrl.exec:\1flrlrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\lxlfrxf.exec:\lxlfrxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\lfxxxxf.exec:\lfxxxxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\hntntn.exec:\hntntn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\5hhbnb.exec:\5hhbnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\pjvjp.exec:\pjvjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\vdjdp.exec:\vdjdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\7bttbh.exec:\7bttbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
\??\c:\vpjvd.exec:\vpjvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\ffrlrrf.exec:\ffrlrrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\3lfrfrx.exec:\3lfrfrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\1tnnhn.exec:\1tnnhn.exe17⤵
- Executes dropped EXE
PID:664 -
\??\c:\9bbtnn.exec:\9bbtnn.exe18⤵
- Executes dropped EXE
PID:1156 -
\??\c:\pjjpv.exec:\pjjpv.exe19⤵
- Executes dropped EXE
PID:796 -
\??\c:\jdvpv.exec:\jdvpv.exe20⤵
- Executes dropped EXE
PID:2204 -
\??\c:\llflffl.exec:\llflffl.exe21⤵
- Executes dropped EXE
PID:1568 -
\??\c:\7thntt.exec:\7thntt.exe22⤵
- Executes dropped EXE
PID:2920 -
\??\c:\5pjdj.exec:\5pjdj.exe23⤵
- Executes dropped EXE
PID:1256 -
\??\c:\rflfffl.exec:\rflfffl.exe24⤵
- Executes dropped EXE
PID:2968 -
\??\c:\bbbbnt.exec:\bbbbnt.exe25⤵
- Executes dropped EXE
PID:708 -
\??\c:\ddvvd.exec:\ddvvd.exe26⤵
- Executes dropped EXE
PID:1792 -
\??\c:\jjvdp.exec:\jjvdp.exe27⤵
- Executes dropped EXE
PID:2848 -
\??\c:\bbtbhn.exec:\bbtbhn.exe28⤵
- Executes dropped EXE
PID:1264 -
\??\c:\ddvdp.exec:\ddvdp.exe29⤵
- Executes dropped EXE
PID:1800 -
\??\c:\jdvjp.exec:\jdvjp.exe30⤵
- Executes dropped EXE
PID:1916 -
\??\c:\fflrlfr.exec:\fflrlfr.exe31⤵
- Executes dropped EXE
PID:1920 -
\??\c:\fxrrlrr.exec:\fxrrlrr.exe32⤵
- Executes dropped EXE
PID:2472 -
\??\c:\thhbth.exec:\thhbth.exe33⤵
- Executes dropped EXE
PID:876 -
\??\c:\jdppv.exec:\jdppv.exe34⤵
- Executes dropped EXE
PID:1244 -
\??\c:\5pdjv.exec:\5pdjv.exe35⤵
- Executes dropped EXE
PID:3068 -
\??\c:\lfxflrx.exec:\lfxflrx.exe36⤵
- Executes dropped EXE
PID:2360 -
\??\c:\xxlxlfx.exec:\xxlxlfx.exe37⤵
- Executes dropped EXE
PID:2796 -
\??\c:\nhtbht.exec:\nhtbht.exe38⤵
- Executes dropped EXE
PID:1656 -
\??\c:\nhtbnt.exec:\nhtbnt.exe39⤵
- Executes dropped EXE
PID:2180 -
\??\c:\dvvpp.exec:\dvvpp.exe40⤵
- Executes dropped EXE
PID:2656 -
\??\c:\1jvpp.exec:\1jvpp.exe41⤵
- Executes dropped EXE
PID:2536 -
\??\c:\5xxflrx.exec:\5xxflrx.exe42⤵
- Executes dropped EXE
PID:2720 -
\??\c:\fxlxfll.exec:\fxlxfll.exe43⤵
- Executes dropped EXE
PID:2584 -
\??\c:\bbhhtt.exec:\bbhhtt.exe44⤵
- Executes dropped EXE
PID:2500 -
\??\c:\hbnnnt.exec:\hbnnnt.exe45⤵
- Executes dropped EXE
PID:2044 -
\??\c:\dvpdj.exec:\dvpdj.exe46⤵
- Executes dropped EXE
PID:2568 -
\??\c:\1djvj.exec:\1djvj.exe47⤵
- Executes dropped EXE
PID:1564 -
\??\c:\3vjdd.exec:\3vjdd.exe48⤵
- Executes dropped EXE
PID:2596 -
\??\c:\rlflrxf.exec:\rlflrxf.exe49⤵
- Executes dropped EXE
PID:2684 -
\??\c:\tntbnt.exec:\tntbnt.exe50⤵
- Executes dropped EXE
PID:2768 -
\??\c:\pjpvj.exec:\pjpvj.exe51⤵
- Executes dropped EXE
PID:1744 -
\??\c:\djdpv.exec:\djdpv.exe52⤵
- Executes dropped EXE
PID:1260 -
\??\c:\rrrfrfr.exec:\rrrfrfr.exe53⤵
- Executes dropped EXE
PID:2224 -
\??\c:\xrflxfl.exec:\xrflxfl.exe54⤵
- Executes dropped EXE
PID:2404 -
\??\c:\nhbhhn.exec:\nhbhhn.exe55⤵
- Executes dropped EXE
PID:484 -
\??\c:\nnhhtn.exec:\nnhhtn.exe56⤵
- Executes dropped EXE
PID:1484 -
\??\c:\pjjvv.exec:\pjjvv.exe57⤵
- Executes dropped EXE
PID:760 -
\??\c:\vjddd.exec:\vjddd.exe58⤵
- Executes dropped EXE
PID:1140 -
\??\c:\1rlxlrf.exec:\1rlxlrf.exe59⤵
- Executes dropped EXE
PID:1724 -
\??\c:\xrxxlrf.exec:\xrxxlrf.exe60⤵
- Executes dropped EXE
PID:1644 -
\??\c:\nhtbht.exec:\nhtbht.exe61⤵
- Executes dropped EXE
PID:2904 -
\??\c:\hbtnbt.exec:\hbtnbt.exe62⤵
- Executes dropped EXE
PID:3020 -
\??\c:\jjdvv.exec:\jjdvv.exe63⤵
- Executes dropped EXE
PID:2272 -
\??\c:\jjjjp.exec:\jjjjp.exe64⤵
- Executes dropped EXE
PID:2688 -
\??\c:\lxrlrrx.exec:\lxrlrrx.exe65⤵
- Executes dropped EXE
PID:1848 -
\??\c:\3rfxllf.exec:\3rfxllf.exe66⤵PID:2012
-
\??\c:\nbthhn.exec:\nbthhn.exe67⤵PID:1768
-
\??\c:\9tbhbb.exec:\9tbhbb.exe68⤵PID:1628
-
\??\c:\dvvjv.exec:\dvvjv.exe69⤵PID:1776
-
\??\c:\vpddp.exec:\vpddp.exe70⤵PID:908
-
\??\c:\7xlfffr.exec:\7xlfffr.exe71⤵PID:2448
-
\??\c:\1xrxflr.exec:\1xrxflr.exe72⤵PID:840
-
\??\c:\tnnhtt.exec:\tnnhtt.exe73⤵PID:1432
-
\??\c:\tttntb.exec:\tttntb.exe74⤵PID:1728
-
\??\c:\9djpv.exec:\9djpv.exe75⤵PID:2428
-
\??\c:\vpdpp.exec:\vpdpp.exe76⤵PID:1144
-
\??\c:\fxrrxrf.exec:\fxrrxrf.exe77⤵PID:1312
-
\??\c:\rlfxxxf.exec:\rlfxxxf.exe78⤵PID:1320
-
\??\c:\3ttbnt.exec:\3ttbnt.exe79⤵PID:2360
-
\??\c:\9hhntb.exec:\9hhntb.exe80⤵PID:2512
-
\??\c:\nhttnt.exec:\nhttnt.exe81⤵PID:1656
-
\??\c:\dvdpj.exec:\dvdpj.exe82⤵PID:2736
-
\??\c:\pdvjp.exec:\pdvjp.exe83⤵PID:2572
-
\??\c:\xrrxxxf.exec:\xrrxxxf.exe84⤵PID:2536
-
\??\c:\7lfrffr.exec:\7lfrffr.exe85⤵PID:2720
-
\??\c:\7nbhbb.exec:\7nbhbb.exe86⤵PID:2740
-
\??\c:\nhnnbb.exec:\nhnnbb.exe87⤵PID:2500
-
\??\c:\tnbhnb.exec:\tnbhnb.exe88⤵PID:2700
-
\??\c:\vdjdj.exec:\vdjdj.exe89⤵PID:2568
-
\??\c:\1vdpv.exec:\1vdpv.exe90⤵PID:1564
-
\??\c:\lxrrflf.exec:\lxrrflf.exe91⤵PID:2824
-
\??\c:\xlffrxf.exec:\xlffrxf.exe92⤵PID:2684
-
\??\c:\thtthh.exec:\thtthh.exe93⤵PID:2768
-
\??\c:\9nhntb.exec:\9nhntb.exe94⤵PID:324
-
\??\c:\ddpjj.exec:\ddpjj.exe95⤵PID:1260
-
\??\c:\jdpdd.exec:\jdpdd.exe96⤵PID:264
-
\??\c:\lxxrllx.exec:\lxxrllx.exe97⤵PID:2404
-
\??\c:\xxxlxfl.exec:\xxxlxfl.exe98⤵PID:1000
-
\??\c:\xxfxxlf.exec:\xxfxxlf.exe99⤵PID:1484
-
\??\c:\1thbtb.exec:\1thbtb.exe100⤵PID:1100
-
\??\c:\3nhntb.exec:\3nhntb.exe101⤵PID:1140
-
\??\c:\pjdvj.exec:\pjdvj.exe102⤵PID:1572
-
\??\c:\3vvdp.exec:\3vvdp.exe103⤵PID:1644
-
\??\c:\7rlxrxf.exec:\7rlxrxf.exe104⤵PID:2896
-
\??\c:\9fflrxf.exec:\9fflrxf.exe105⤵PID:2240
-
\??\c:\bbthhb.exec:\bbthhb.exe106⤵PID:2464
-
\??\c:\nbnthb.exec:\nbnthb.exe107⤵PID:2688
-
\??\c:\5jddj.exec:\5jddj.exe108⤵PID:2780
-
\??\c:\vpjjp.exec:\vpjjp.exe109⤵PID:2012
-
\??\c:\3pjvj.exec:\3pjvj.exe110⤵PID:1768
-
\??\c:\3ffrxfl.exec:\3ffrxfl.exe111⤵PID:1048
-
\??\c:\lrlflfl.exec:\lrlflfl.exe112⤵PID:2152
-
\??\c:\htntth.exec:\htntth.exe113⤵PID:908
-
\??\c:\hbtbnt.exec:\hbtbnt.exe114⤵PID:2448
-
\??\c:\9pddj.exec:\9pddj.exe115⤵PID:840
-
\??\c:\dvvpj.exec:\dvvpj.exe116⤵PID:1732
-
\??\c:\7lxlrrl.exec:\7lxlrrl.exe117⤵PID:1728
-
\??\c:\lfxfflr.exec:\lfxfflr.exe118⤵PID:836
-
\??\c:\ttnnnt.exec:\ttnnnt.exe119⤵PID:1144
-
\??\c:\5hhthn.exec:\5hhthn.exe120⤵PID:2616
-
\??\c:\jjpdv.exec:\jjpdv.exe121⤵PID:1320
-
\??\c:\ddjdp.exec:\ddjdp.exe122⤵PID:2728
-
\??\c:\lrxxxfr.exec:\lrxxxfr.exe123⤵PID:2512
-
\??\c:\9nnnnt.exec:\9nnnnt.exe124⤵PID:2660
-
\??\c:\hhhntb.exec:\hhhntb.exe125⤵PID:2736
-
\??\c:\jjvdj.exec:\jjvdj.exe126⤵PID:2552
-
\??\c:\vppdj.exec:\vppdj.exe127⤵PID:2536
-
\??\c:\xrlrfll.exec:\xrlrfll.exe128⤵PID:3040
-
\??\c:\lxlrxlr.exec:\lxlrxlr.exe129⤵PID:2740
-
\??\c:\ffllrrf.exec:\ffllrrf.exe130⤵PID:2548
-
\??\c:\bthhhh.exec:\bthhhh.exe131⤵PID:2700
-
\??\c:\hbbbtn.exec:\hbbbtn.exe132⤵PID:2508
-
\??\c:\1pdvd.exec:\1pdvd.exe133⤵PID:1564
-
\??\c:\dpvpv.exec:\dpvpv.exe134⤵PID:1200
-
\??\c:\9lffrrx.exec:\9lffrrx.exe135⤵PID:2684
-
\??\c:\xlfrrxf.exec:\xlfrrxf.exe136⤵PID:1820
-
\??\c:\nbhhhb.exec:\nbhhhb.exe137⤵PID:2040
-
\??\c:\nttbtn.exec:\nttbtn.exe138⤵PID:2224
-
\??\c:\nttnbn.exec:\nttnbn.exe139⤵PID:264
-
\??\c:\pjpvd.exec:\pjpvd.exe140⤵PID:872
-
\??\c:\xrffxfx.exec:\xrffxfx.exe141⤵PID:1000
-
\??\c:\lllxrfx.exec:\lllxrfx.exe142⤵PID:1660
-
\??\c:\rlrflrf.exec:\rlrflrf.exe143⤵PID:1100
-
\??\c:\bthnbh.exec:\bthnbh.exe144⤵PID:2908
-
\??\c:\nnhttt.exec:\nnhttt.exe145⤵PID:2884
-
\??\c:\vjvvj.exec:\vjvvj.exe146⤵PID:1256
-
\??\c:\dvjvv.exec:\dvjvv.exe147⤵PID:2896
-
\??\c:\fxrfllr.exec:\fxrfllr.exe148⤵PID:2956
-
\??\c:\rlffrxf.exec:\rlffrxf.exe149⤵PID:2192
-
\??\c:\htbbbb.exec:\htbbbb.exe150⤵PID:2400
-
\??\c:\7htbtt.exec:\7htbtt.exe151⤵PID:2780
-
\??\c:\nhnhnb.exec:\nhnhnb.exe152⤵PID:1856
-
\??\c:\ppdvj.exec:\ppdvj.exe153⤵PID:1768
-
\??\c:\pdpvv.exec:\pdpvv.exe154⤵PID:1924
-
\??\c:\7fxflll.exec:\7fxflll.exe155⤵PID:1036
-
\??\c:\5lflxxf.exec:\5lflxxf.exe156⤵PID:1268
-
\??\c:\lfxffff.exec:\lfxffff.exe157⤵PID:2448
-
\??\c:\tntbbh.exec:\tntbbh.exe158⤵PID:2472
-
\??\c:\3thhnh.exec:\3thhnh.exe159⤵PID:1732
-
\??\c:\jvdpd.exec:\jvdpd.exe160⤵PID:1316
-
\??\c:\jdvpj.exec:\jdvpj.exe161⤵PID:836
-
\??\c:\3rlxffr.exec:\3rlxffr.exe162⤵PID:2340
-
\??\c:\1fxxflr.exec:\1fxxflr.exe163⤵PID:2616
-
\??\c:\1lrxllx.exec:\1lrxllx.exe164⤵PID:1320
-
\??\c:\btbbnn.exec:\btbbnn.exe165⤵PID:2728
-
\??\c:\nbnnbt.exec:\nbnnbt.exe166⤵PID:2680
-
\??\c:\pppvv.exec:\pppvv.exe167⤵PID:2660
-
\??\c:\7pvvj.exec:\7pvvj.exe168⤵PID:2620
-
\??\c:\rfllllx.exec:\rfllllx.exe169⤵PID:2560
-
\??\c:\1xrxrrx.exec:\1xrxrrx.exe170⤵PID:2536
-
\??\c:\nhnthh.exec:\nhnthh.exe171⤵PID:1700
-
\??\c:\dvppj.exec:\dvppj.exe172⤵PID:2724
-
\??\c:\jdjpv.exec:\jdjpv.exe173⤵PID:3016
-
\??\c:\lxlrrxl.exec:\lxlrrxl.exe174⤵PID:2828
-
\??\c:\nhntbb.exec:\nhntbb.exe175⤵PID:2760
-
\??\c:\bnbnbt.exec:\bnbnbt.exe176⤵PID:1564
-
\??\c:\jdddj.exec:\jdddj.exe177⤵PID:1044
-
\??\c:\pjjjv.exec:\pjjjv.exe178⤵PID:568
-
\??\c:\pjvjj.exec:\pjvjj.exe179⤵PID:1820
-
\??\c:\fxrxflx.exec:\fxrxflx.exe180⤵PID:2040
-
\??\c:\7btthh.exec:\7btthh.exe181⤵PID:2224
-
\??\c:\bthtbt.exec:\bthtbt.exe182⤵PID:748
-
\??\c:\3tthnt.exec:\3tthnt.exe183⤵PID:872
-
\??\c:\jpjdj.exec:\jpjdj.exe184⤵PID:1484
-
\??\c:\rlffflx.exec:\rlffflx.exe185⤵PID:1660
-
\??\c:\xxrfxfr.exec:\xxrfxfr.exe186⤵PID:1100
-
\??\c:\3hbbhn.exec:\3hbbhn.exe187⤵PID:1752
-
\??\c:\nbtnnt.exec:\nbtnnt.exe188⤵PID:2104
-
\??\c:\thttbh.exec:\thttbh.exe189⤵PID:1256
-
\??\c:\dvpjp.exec:\dvpjp.exe190⤵PID:1844
-
\??\c:\rlxlrxl.exec:\rlxlrxl.exe191⤵PID:2956
-
\??\c:\lfxfxxl.exec:\lfxfxxl.exe192⤵PID:292
-
\??\c:\nnhnnb.exec:\nnhnnb.exe193⤵PID:1600
-
\??\c:\hbhhtb.exec:\hbhhtb.exe194⤵PID:1788
-
\??\c:\jdpvp.exec:\jdpvp.exe195⤵PID:1856
-
\??\c:\vpjpp.exec:\vpjpp.exe196⤵PID:2408
-
\??\c:\llrrllx.exec:\llrrllx.exe197⤵PID:1924
-
\??\c:\rlxfrxf.exec:\rlxfrxf.exe198⤵PID:2468
-
\??\c:\btbhtb.exec:\btbhtb.exe199⤵PID:1268
-
\??\c:\7btbbb.exec:\7btbbb.exe200⤵PID:2072
-
\??\c:\pjvdd.exec:\pjvdd.exe201⤵PID:2592
-
\??\c:\1jppv.exec:\1jppv.exe202⤵PID:1244
-
\??\c:\rrrffxf.exec:\rrrffxf.exe203⤵PID:1316
-
\??\c:\nhbbhb.exec:\nhbbhb.exe204⤵PID:2264
-
\??\c:\hbtbhn.exec:\hbtbhn.exe205⤵PID:2364
-
\??\c:\pvvpd.exec:\pvvpd.exe206⤵PID:2616
-
\??\c:\jdppd.exec:\jdppd.exe207⤵PID:1320
-
\??\c:\fxlllrr.exec:\fxlllrr.exe208⤵PID:2728
-
\??\c:\rflrfrx.exec:\rflrfrx.exe209⤵PID:2680
-
\??\c:\bnbbbb.exec:\bnbbbb.exe210⤵PID:2504
-
\??\c:\nnbnhb.exec:\nnbnhb.exe211⤵PID:2620
-
\??\c:\3jvdj.exec:\3jvdj.exe212⤵PID:2552
-
\??\c:\llrlrxf.exec:\llrlrxf.exe213⤵PID:2628
-
\??\c:\tbttbb.exec:\tbttbb.exe214⤵PID:1700
-
\??\c:\tnnbbh.exec:\tnnbbh.exe215⤵PID:3028
-
\??\c:\pjjpj.exec:\pjjpj.exe216⤵PID:1748
-
\??\c:\5vpdd.exec:\5vpdd.exe217⤵PID:2856
-
\??\c:\xrfflxx.exec:\xrfflxx.exe218⤵PID:1956
-
\??\c:\7lfxfff.exec:\7lfxfff.exe219⤵PID:2020
-
\??\c:\tnbbhh.exec:\tnbbhh.exe220⤵PID:2236
-
\??\c:\vdjjp.exec:\vdjjp.exe221⤵PID:2212
-
\??\c:\dvjpj.exec:\dvjpj.exe222⤵PID:1820
-
\??\c:\rlxfxxf.exec:\rlxfxxf.exe223⤵PID:2040
-
\??\c:\3xrxffl.exec:\3xrxffl.exe224⤵PID:1804
-
\??\c:\bbhthh.exec:\bbhthh.exe225⤵PID:1156
-
\??\c:\3nnthb.exec:\3nnthb.exe226⤵PID:2876
-
\??\c:\vvpvp.exec:\vvpvp.exe227⤵PID:2608
-
\??\c:\ffrlllx.exec:\ffrlllx.exe228⤵PID:2888
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe229⤵PID:1644
-
\??\c:\1nbbhn.exec:\1nbbhn.exe230⤵PID:2960
-
\??\c:\pppdp.exec:\pppdp.exe231⤵PID:2604
-
\??\c:\pjvpj.exec:\pjvpj.exe232⤵PID:2456
-
\??\c:\lrfxxrx.exec:\lrfxxrx.exe233⤵PID:584
-
\??\c:\ffrflrf.exec:\ffrflrf.exe234⤵PID:1524
-
\??\c:\ffffxfr.exec:\ffffxfr.exe235⤵PID:1544
-
\??\c:\btnbnt.exec:\btnbnt.exe236⤵PID:1628
-
\??\c:\jvdjp.exec:\jvdjp.exe237⤵PID:1788
-
\??\c:\pjppj.exec:\pjppj.exe238⤵PID:1712
-
\??\c:\fxlrffr.exec:\fxlrffr.exe239⤵PID:548
-
\??\c:\rlffrlr.exec:\rlffrlr.exe240⤵PID:1920
-
\??\c:\tnbnbn.exec:\tnbnbn.exe241⤵PID:2468
-
\??\c:\thbbhh.exec:\thbbhh.exe242⤵PID:1284