Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 01:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4660239ef0f4684ddd09d97b8d87d2c0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4660239ef0f4684ddd09d97b8d87d2c0_NeikiAnalytics.exe
-
Size
392KB
-
MD5
4660239ef0f4684ddd09d97b8d87d2c0
-
SHA1
21da1d4d46c014c82646e5a9c2524bfd093eb25e
-
SHA256
589cdf4538fd1893cc8c1c635e0b1b552215f80d5495323f42ad904448d46f44
-
SHA512
4b68fc207b5ca7bb7034835729fdc0df592503a9b53d9ffbbfd62f4f76e9a115657c8decd8b0173cadad9eb528c1cc4b3ef34b7c2240df38d29f6fd4ff29b287
-
SSDEEP
6144:n3C9BRIG0asYFm71mPfkVB8dKwaO5CVwOF:n3C9uYA7okVqdKwaO5CVr
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/2196-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1816-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2296-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2208-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2024-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1704-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/872-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1544-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
tnbhnt.exejppvp.exe5xlxrlr.exentnntb.exepjpvj.exe9lllrxf.exe9nhtbb.exepvpdp.exelllxrxf.exebthhhn.exejddjv.exeffxlxfr.exenhtbhh.exebbntnt.exevvvdj.exefxrflxr.exenbbhtb.exevvpjv.exevpdjd.exerlfrlrf.exe3nhhtt.exejdpvd.exehbtnhh.exetnhnbb.exedvjpd.exexrrrxxl.exebnbtht.exedjpdj.exexxlrffx.exehbthhn.exejdvdp.exefxffrrr.exefxxxlrr.exehnhhtb.exe9jvvd.exe3rxxrff.exenbthtt.exehbhbhb.exe9pvvd.exe5rffffl.exe1flffxf.exebthbbb.exetnhthh.exepdjpv.exe3flxxrr.exexlrxffr.exetbnhhb.exedvddd.exeppdjp.exe1frrrrx.exe7htbhh.exetnbtbb.exevvjpp.exe3pvdv.exexlfllll.exeflxxxxf.exe3nnntn.exehthhhb.exedpjdd.exexlrffxl.exelxllrrx.exebntntt.exebnhhhb.exe7pdpj.exepid process 2152 tnbhnt.exe 2552 jppvp.exe 2684 5xlxrlr.exe 2616 ntnntb.exe 2188 pjpvj.exe 2608 9lllrxf.exe 2424 9nhtbb.exe 2916 pvpdp.exe 1816 lllxrxf.exe 2500 bthhhn.exe 2756 jddjv.exe 2296 ffxlxfr.exe 1232 nhtbhh.exe 2300 bbntnt.exe 1660 vvvdj.exe 1544 fxrflxr.exe 2780 nbbhtb.exe 2928 vvpjv.exe 2796 vpdjd.exe 1884 rlfrlrf.exe 2208 3nhhtt.exe 872 jdpvd.exe 1508 hbtnhh.exe 1724 tnhnbb.exe 692 dvjpd.exe 1836 xrrrxxl.exe 1704 bnbtht.exe 3012 djpdj.exe 2348 xxlrffx.exe 1904 hbthhn.exe 2024 jdvdp.exe 2140 fxffrrr.exe 1516 fxxxlrr.exe 2596 hnhhtb.exe 2560 9jvvd.exe 2996 3rxxrff.exe 2568 nbthtt.exe 2832 hbhbhb.exe 2612 9pvvd.exe 2960 5rffffl.exe 2408 1flffxf.exe 2572 bthbbb.exe 2952 tnhthh.exe 1032 pdjpv.exe 1656 3flxxrr.exe 2724 xlrxffr.exe 2792 tbnhhb.exe 2332 dvddd.exe 2764 ppdjp.exe 1776 1frrrrx.exe 1192 7htbhh.exe 2176 tnbtbb.exe 1464 vvjpp.exe 824 3pvdv.exe 1352 xlfllll.exe 1980 flxxxxf.exe 2796 3nnntn.exe 1884 hthhhb.exe 764 dpjdd.exe 468 xlrffxl.exe 1824 lxllrrx.exe 1340 bntntt.exe 2492 bnhhhb.exe 2060 7pdpj.exe -
Processes:
resource yara_rule behavioral1/memory/2196-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1816-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-299-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1704-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/872-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1544-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-111-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4660239ef0f4684ddd09d97b8d87d2c0_NeikiAnalytics.exetnbhnt.exejppvp.exe5xlxrlr.exentnntb.exepjpvj.exe9lllrxf.exe9nhtbb.exepvpdp.exelllxrxf.exebthhhn.exejddjv.exeffxlxfr.exenhtbhh.exebbntnt.exevvvdj.exedescription pid process target process PID 2196 wrote to memory of 2152 2196 4660239ef0f4684ddd09d97b8d87d2c0_NeikiAnalytics.exe tnbhnt.exe PID 2196 wrote to memory of 2152 2196 4660239ef0f4684ddd09d97b8d87d2c0_NeikiAnalytics.exe tnbhnt.exe PID 2196 wrote to memory of 2152 2196 4660239ef0f4684ddd09d97b8d87d2c0_NeikiAnalytics.exe tnbhnt.exe PID 2196 wrote to memory of 2152 2196 4660239ef0f4684ddd09d97b8d87d2c0_NeikiAnalytics.exe tnbhnt.exe PID 2152 wrote to memory of 2552 2152 tnbhnt.exe jppvp.exe PID 2152 wrote to memory of 2552 2152 tnbhnt.exe jppvp.exe PID 2152 wrote to memory of 2552 2152 tnbhnt.exe jppvp.exe PID 2152 wrote to memory of 2552 2152 tnbhnt.exe jppvp.exe PID 2552 wrote to memory of 2684 2552 jppvp.exe 5xlxrlr.exe PID 2552 wrote to memory of 2684 2552 jppvp.exe 5xlxrlr.exe PID 2552 wrote to memory of 2684 2552 jppvp.exe 5xlxrlr.exe PID 2552 wrote to memory of 2684 2552 jppvp.exe 5xlxrlr.exe PID 2684 wrote to memory of 2616 2684 5xlxrlr.exe ntnntb.exe PID 2684 wrote to memory of 2616 2684 5xlxrlr.exe ntnntb.exe PID 2684 wrote to memory of 2616 2684 5xlxrlr.exe ntnntb.exe PID 2684 wrote to memory of 2616 2684 5xlxrlr.exe ntnntb.exe PID 2616 wrote to memory of 2188 2616 ntnntb.exe pjpvj.exe PID 2616 wrote to memory of 2188 2616 ntnntb.exe pjpvj.exe PID 2616 wrote to memory of 2188 2616 ntnntb.exe pjpvj.exe PID 2616 wrote to memory of 2188 2616 ntnntb.exe pjpvj.exe PID 2188 wrote to memory of 2608 2188 pjpvj.exe 9lllrxf.exe PID 2188 wrote to memory of 2608 2188 pjpvj.exe 9lllrxf.exe PID 2188 wrote to memory of 2608 2188 pjpvj.exe 9lllrxf.exe PID 2188 wrote to memory of 2608 2188 pjpvj.exe 9lllrxf.exe PID 2608 wrote to memory of 2424 2608 9lllrxf.exe 9nhtbb.exe PID 2608 wrote to memory of 2424 2608 9lllrxf.exe 9nhtbb.exe PID 2608 wrote to memory of 2424 2608 9lllrxf.exe 9nhtbb.exe PID 2608 wrote to memory of 2424 2608 9lllrxf.exe 9nhtbb.exe PID 2424 wrote to memory of 2916 2424 9nhtbb.exe pvpdp.exe PID 2424 wrote to memory of 2916 2424 9nhtbb.exe pvpdp.exe PID 2424 wrote to memory of 2916 2424 9nhtbb.exe pvpdp.exe PID 2424 wrote to memory of 2916 2424 9nhtbb.exe pvpdp.exe PID 2916 wrote to memory of 1816 2916 pvpdp.exe lllxrxf.exe PID 2916 wrote to memory of 1816 2916 pvpdp.exe lllxrxf.exe PID 2916 wrote to memory of 1816 2916 pvpdp.exe lllxrxf.exe PID 2916 wrote to memory of 1816 2916 pvpdp.exe lllxrxf.exe PID 1816 wrote to memory of 2500 1816 lllxrxf.exe bthhhn.exe PID 1816 wrote to memory of 2500 1816 lllxrxf.exe bthhhn.exe PID 1816 wrote to memory of 2500 1816 lllxrxf.exe bthhhn.exe PID 1816 wrote to memory of 2500 1816 lllxrxf.exe bthhhn.exe PID 2500 wrote to memory of 2756 2500 bthhhn.exe jddjv.exe PID 2500 wrote to memory of 2756 2500 bthhhn.exe jddjv.exe PID 2500 wrote to memory of 2756 2500 bthhhn.exe jddjv.exe PID 2500 wrote to memory of 2756 2500 bthhhn.exe jddjv.exe PID 2756 wrote to memory of 2296 2756 jddjv.exe ffxlxfr.exe PID 2756 wrote to memory of 2296 2756 jddjv.exe ffxlxfr.exe PID 2756 wrote to memory of 2296 2756 jddjv.exe ffxlxfr.exe PID 2756 wrote to memory of 2296 2756 jddjv.exe ffxlxfr.exe PID 2296 wrote to memory of 1232 2296 ffxlxfr.exe nhtbhh.exe PID 2296 wrote to memory of 1232 2296 ffxlxfr.exe nhtbhh.exe PID 2296 wrote to memory of 1232 2296 ffxlxfr.exe nhtbhh.exe PID 2296 wrote to memory of 1232 2296 ffxlxfr.exe nhtbhh.exe PID 1232 wrote to memory of 2300 1232 nhtbhh.exe bbntnt.exe PID 1232 wrote to memory of 2300 1232 nhtbhh.exe bbntnt.exe PID 1232 wrote to memory of 2300 1232 nhtbhh.exe bbntnt.exe PID 1232 wrote to memory of 2300 1232 nhtbhh.exe bbntnt.exe PID 2300 wrote to memory of 1660 2300 bbntnt.exe vvvdj.exe PID 2300 wrote to memory of 1660 2300 bbntnt.exe vvvdj.exe PID 2300 wrote to memory of 1660 2300 bbntnt.exe vvvdj.exe PID 2300 wrote to memory of 1660 2300 bbntnt.exe vvvdj.exe PID 1660 wrote to memory of 1544 1660 vvvdj.exe fxrflxr.exe PID 1660 wrote to memory of 1544 1660 vvvdj.exe fxrflxr.exe PID 1660 wrote to memory of 1544 1660 vvvdj.exe fxrflxr.exe PID 1660 wrote to memory of 1544 1660 vvvdj.exe fxrflxr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4660239ef0f4684ddd09d97b8d87d2c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4660239ef0f4684ddd09d97b8d87d2c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\tnbhnt.exec:\tnbhnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\jppvp.exec:\jppvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\5xlxrlr.exec:\5xlxrlr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\ntnntb.exec:\ntnntb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\pjpvj.exec:\pjpvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\9lllrxf.exec:\9lllrxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\9nhtbb.exec:\9nhtbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\pvpdp.exec:\pvpdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\lllxrxf.exec:\lllxrxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\bthhhn.exec:\bthhhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\jddjv.exec:\jddjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\ffxlxfr.exec:\ffxlxfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\nhtbhh.exec:\nhtbhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\bbntnt.exec:\bbntnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\vvvdj.exec:\vvvdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\fxrflxr.exec:\fxrflxr.exe17⤵
- Executes dropped EXE
PID:1544 -
\??\c:\nbbhtb.exec:\nbbhtb.exe18⤵
- Executes dropped EXE
PID:2780 -
\??\c:\vvpjv.exec:\vvpjv.exe19⤵
- Executes dropped EXE
PID:2928 -
\??\c:\vpdjd.exec:\vpdjd.exe20⤵
- Executes dropped EXE
PID:2796 -
\??\c:\rlfrlrf.exec:\rlfrlrf.exe21⤵
- Executes dropped EXE
PID:1884 -
\??\c:\3nhhtt.exec:\3nhhtt.exe22⤵
- Executes dropped EXE
PID:2208 -
\??\c:\jdpvd.exec:\jdpvd.exe23⤵
- Executes dropped EXE
PID:872 -
\??\c:\hbtnhh.exec:\hbtnhh.exe24⤵
- Executes dropped EXE
PID:1508 -
\??\c:\tnhnbb.exec:\tnhnbb.exe25⤵
- Executes dropped EXE
PID:1724 -
\??\c:\dvjpd.exec:\dvjpd.exe26⤵
- Executes dropped EXE
PID:692 -
\??\c:\xrrrxxl.exec:\xrrrxxl.exe27⤵
- Executes dropped EXE
PID:1836 -
\??\c:\bnbtht.exec:\bnbtht.exe28⤵
- Executes dropped EXE
PID:1704 -
\??\c:\djpdj.exec:\djpdj.exe29⤵
- Executes dropped EXE
PID:3012 -
\??\c:\xxlrffx.exec:\xxlrffx.exe30⤵
- Executes dropped EXE
PID:2348 -
\??\c:\hbthhn.exec:\hbthhn.exe31⤵
- Executes dropped EXE
PID:1904 -
\??\c:\jdvdp.exec:\jdvdp.exe32⤵
- Executes dropped EXE
PID:2024 -
\??\c:\fxffrrr.exec:\fxffrrr.exe33⤵
- Executes dropped EXE
PID:2140 -
\??\c:\fxxxlrr.exec:\fxxxlrr.exe34⤵
- Executes dropped EXE
PID:1516 -
\??\c:\hnhhtb.exec:\hnhhtb.exe35⤵
- Executes dropped EXE
PID:2596 -
\??\c:\9jvvd.exec:\9jvvd.exe36⤵
- Executes dropped EXE
PID:2560 -
\??\c:\3rxxrff.exec:\3rxxrff.exe37⤵
- Executes dropped EXE
PID:2996 -
\??\c:\nbthtt.exec:\nbthtt.exe38⤵
- Executes dropped EXE
PID:2568 -
\??\c:\hbhbhb.exec:\hbhbhb.exe39⤵
- Executes dropped EXE
PID:2832 -
\??\c:\9pvvd.exec:\9pvvd.exe40⤵
- Executes dropped EXE
PID:2612 -
\??\c:\5rffffl.exec:\5rffffl.exe41⤵
- Executes dropped EXE
PID:2960 -
\??\c:\1flffxf.exec:\1flffxf.exe42⤵
- Executes dropped EXE
PID:2408 -
\??\c:\bthbbb.exec:\bthbbb.exe43⤵
- Executes dropped EXE
PID:2572 -
\??\c:\tnhthh.exec:\tnhthh.exe44⤵
- Executes dropped EXE
PID:2952 -
\??\c:\pdjpv.exec:\pdjpv.exe45⤵
- Executes dropped EXE
PID:1032 -
\??\c:\3flxxrr.exec:\3flxxrr.exe46⤵
- Executes dropped EXE
PID:1656 -
\??\c:\xlrxffr.exec:\xlrxffr.exe47⤵
- Executes dropped EXE
PID:2724 -
\??\c:\tbnhhb.exec:\tbnhhb.exe48⤵
- Executes dropped EXE
PID:2792 -
\??\c:\dvddd.exec:\dvddd.exe49⤵
- Executes dropped EXE
PID:2332 -
\??\c:\ppdjp.exec:\ppdjp.exe50⤵
- Executes dropped EXE
PID:2764 -
\??\c:\1frrrrx.exec:\1frrrrx.exe51⤵
- Executes dropped EXE
PID:1776 -
\??\c:\7htbhh.exec:\7htbhh.exe52⤵
- Executes dropped EXE
PID:1192 -
\??\c:\tnbtbb.exec:\tnbtbb.exe53⤵
- Executes dropped EXE
PID:2176 -
\??\c:\vvjpp.exec:\vvjpp.exe54⤵
- Executes dropped EXE
PID:1464 -
\??\c:\3pvdv.exec:\3pvdv.exe55⤵
- Executes dropped EXE
PID:824 -
\??\c:\xlfllll.exec:\xlfllll.exe56⤵
- Executes dropped EXE
PID:1352 -
\??\c:\flxxxxf.exec:\flxxxxf.exe57⤵
- Executes dropped EXE
PID:1980 -
\??\c:\3nnntn.exec:\3nnntn.exe58⤵
- Executes dropped EXE
PID:2796 -
\??\c:\hthhhb.exec:\hthhhb.exe59⤵
- Executes dropped EXE
PID:1884 -
\??\c:\dpjdd.exec:\dpjdd.exe60⤵
- Executes dropped EXE
PID:764 -
\??\c:\xlrffxl.exec:\xlrffxl.exe61⤵
- Executes dropped EXE
PID:468 -
\??\c:\lxllrrx.exec:\lxllrrx.exe62⤵
- Executes dropped EXE
PID:1824 -
\??\c:\bntntt.exec:\bntntt.exe63⤵
- Executes dropped EXE
PID:1340 -
\??\c:\bnhhhb.exec:\bnhhhb.exe64⤵
- Executes dropped EXE
PID:2492 -
\??\c:\7pdpj.exec:\7pdpj.exe65⤵
- Executes dropped EXE
PID:2060 -
\??\c:\jppjj.exec:\jppjj.exe66⤵PID:352
-
\??\c:\5rflllx.exec:\5rflllx.exe67⤵PID:884
-
\??\c:\jdjjj.exec:\jdjjj.exe68⤵PID:1704
-
\??\c:\bnbnnb.exec:\bnbnnb.exe69⤵PID:340
-
\??\c:\vdjjp.exec:\vdjjp.exe70⤵PID:2276
-
\??\c:\ttthbn.exec:\ttthbn.exe71⤵PID:2320
-
\??\c:\9ttbbb.exec:\9ttbbb.exe72⤵PID:1460
-
\??\c:\xrlxffr.exec:\xrlxffr.exe73⤵PID:1640
-
\??\c:\hthtbn.exec:\hthtbn.exe74⤵PID:2140
-
\??\c:\lflrflf.exec:\lflrflf.exe75⤵PID:1528
-
\??\c:\nhtttt.exec:\nhtttt.exe76⤵PID:1892
-
\??\c:\vpdjp.exec:\vpdjp.exe77⤵PID:2656
-
\??\c:\xflllff.exec:\xflllff.exe78⤵PID:2980
-
\??\c:\5thbhh.exec:\5thbhh.exe79⤵PID:2624
-
\??\c:\3lxxrxl.exec:\3lxxrxl.exe80⤵PID:2556
-
\??\c:\1thtbb.exec:\1thtbb.exe81⤵PID:1996
-
\??\c:\7httbh.exec:\7httbh.exe82⤵PID:2428
-
\??\c:\5jppv.exec:\5jppv.exe83⤵PID:2404
-
\??\c:\lxfxrxf.exec:\lxfxrxf.exe84⤵PID:2476
-
\??\c:\fflrlrl.exec:\fflrlrl.exe85⤵PID:1760
-
\??\c:\htbnnh.exec:\htbnnh.exe86⤵PID:1576
-
\??\c:\jdjjp.exec:\jdjjp.exe87⤵PID:1344
-
\??\c:\pjdvv.exec:\pjdvv.exe88⤵PID:2112
-
\??\c:\rffxxlr.exec:\rffxxlr.exe89⤵PID:2500
-
\??\c:\5frllll.exec:\5frllll.exe90⤵PID:2156
-
\??\c:\9bntbb.exec:\9bntbb.exe91⤵PID:2660
-
\??\c:\1jvjd.exec:\1jvjd.exe92⤵PID:1920
-
\??\c:\jvddj.exec:\jvddj.exe93⤵PID:804
-
\??\c:\lllrrfx.exec:\lllrrfx.exe94⤵PID:1616
-
\??\c:\btnbhh.exec:\btnbhh.exe95⤵PID:2788
-
\??\c:\1bnbhh.exec:\1bnbhh.exe96⤵PID:1432
-
\??\c:\9vdvd.exec:\9vdvd.exe97⤵PID:2904
-
\??\c:\vdpjd.exec:\vdpjd.exe98⤵PID:2232
-
\??\c:\9lrllfl.exec:\9lrllfl.exe99⤵PID:2728
-
\??\c:\btnntt.exec:\btnntt.exe100⤵PID:1096
-
\??\c:\tnhhhh.exec:\tnhhhh.exe101⤵PID:2384
-
\??\c:\vpdjj.exec:\vpdjj.exe102⤵PID:1408
-
\??\c:\fxxffxx.exec:\fxxffxx.exe103⤵PID:1052
-
\??\c:\flfxxxx.exec:\flfxxxx.exe104⤵PID:1628
-
\??\c:\nnhtbh.exec:\nnhtbh.exe105⤵PID:1824
-
\??\c:\nbnnnn.exec:\nbnnnn.exe106⤵PID:1592
-
\??\c:\vjvvv.exec:\vjvvv.exe107⤵PID:1016
-
\??\c:\xrllllf.exec:\xrllllf.exe108⤵PID:992
-
\??\c:\ffxfffl.exec:\ffxfffl.exe109⤵PID:1172
-
\??\c:\htbntn.exec:\htbntn.exe110⤵PID:2284
-
\??\c:\jdvpp.exec:\jdvpp.exe111⤵PID:1280
-
\??\c:\lxrrxxf.exec:\lxrrxxf.exe112⤵PID:2264
-
\??\c:\1rfrffx.exec:\1rfrffx.exe113⤵PID:2844
-
\??\c:\tthnht.exec:\tthnht.exe114⤵PID:348
-
\??\c:\1ttbnt.exec:\1ttbnt.exe115⤵PID:2356
-
\??\c:\dpjjp.exec:\dpjjp.exe116⤵PID:2164
-
\??\c:\lfrflrf.exec:\lfrflrf.exe117⤵PID:2496
-
\??\c:\xlrflxx.exec:\xlrflxx.exe118⤵PID:2596
-
\??\c:\7ntnnn.exec:\7ntnnn.exe119⤵PID:2236
-
\??\c:\ddvvj.exec:\ddvvj.exe120⤵PID:2552
-
\??\c:\jvddd.exec:\jvddd.exe121⤵PID:1780
-
\??\c:\frxxxff.exec:\frxxxff.exe122⤵PID:3008
-
\??\c:\1fxrfxx.exec:\1fxrfxx.exe123⤵PID:2832
-
\??\c:\nbnhnn.exec:\nbnhnn.exe124⤵PID:2696
-
\??\c:\pjvpv.exec:\pjvpv.exe125⤵PID:2960
-
\??\c:\7pvvp.exec:\7pvvp.exe126⤵PID:2924
-
\??\c:\lxxfllr.exec:\lxxfllr.exe127⤵PID:2548
-
\??\c:\thtbbb.exec:\thtbbb.exe128⤵PID:2100
-
\??\c:\bhtnnh.exec:\bhtnnh.exe129⤵PID:2588
-
\??\c:\pjddj.exec:\pjddj.exe130⤵PID:2736
-
\??\c:\3xffffr.exec:\3xffffr.exe131⤵PID:2460
-
\??\c:\nnbtbb.exec:\nnbtbb.exe132⤵PID:2956
-
\??\c:\hbbhnn.exec:\hbbhnn.exe133⤵PID:356
-
\??\c:\7vjjj.exec:\7vjjj.exe134⤵PID:2296
-
\??\c:\rfrlxlr.exec:\rfrlxlr.exe135⤵PID:2380
-
\??\c:\lxfxffl.exec:\lxfxffl.exe136⤵PID:1632
-
\??\c:\bnhbnh.exec:\bnhbnh.exe137⤵PID:1440
-
\??\c:\3vpjj.exec:\3vpjj.exe138⤵PID:1464
-
\??\c:\3pdjp.exec:\3pdjp.exe139⤵PID:2880
-
\??\c:\xfrllfl.exec:\xfrllfl.exe140⤵PID:1352
-
\??\c:\htbhnn.exec:\htbhnn.exe141⤵PID:1548
-
\??\c:\5jvvj.exec:\5jvvj.exe142⤵PID:664
-
\??\c:\1flrfrl.exec:\1flrfrl.exe143⤵PID:1240
-
\??\c:\ttnbhn.exec:\ttnbhn.exe144⤵PID:2892
-
\??\c:\hbnthb.exec:\hbnthb.exe145⤵PID:556
-
\??\c:\vvjjv.exec:\vvjjv.exe146⤵PID:3068
-
\??\c:\3xllrxl.exec:\3xllrxl.exe147⤵PID:904
-
\??\c:\ffxlxlr.exec:\ffxlxlr.exe148⤵PID:984
-
\??\c:\bnhthn.exec:\bnhthn.exe149⤵PID:1400
-
\??\c:\hthbtn.exec:\hthbtn.exe150⤵PID:2444
-
\??\c:\3jvpd.exec:\3jvpd.exe151⤵PID:1392
-
\??\c:\rlrxfll.exec:\rlrxfll.exe152⤵PID:2224
-
\??\c:\rlxxfff.exec:\rlxxfff.exe153⤵PID:2020
-
\??\c:\bbbhtb.exec:\bbbhtb.exe154⤵PID:1808
-
\??\c:\1vddj.exec:\1vddj.exe155⤵PID:2340
-
\??\c:\jjdpd.exec:\jjdpd.exe156⤵PID:2196
-
\??\c:\xlxflrx.exec:\xlxflrx.exe157⤵PID:1992
-
\??\c:\btbttb.exec:\btbttb.exe158⤵PID:2316
-
\??\c:\nttnth.exec:\nttnth.exe159⤵PID:2644
-
\??\c:\djdjj.exec:\djdjj.exe160⤵PID:2636
-
\??\c:\1xxfxlf.exec:\1xxfxlf.exe161⤵PID:2564
-
\??\c:\xxlrxrf.exec:\xxlrxrf.exe162⤵PID:2980
-
\??\c:\bnttbt.exec:\bnttbt.exe163⤵PID:2000
-
\??\c:\pjvdj.exec:\pjvdj.exe164⤵PID:2556
-
\??\c:\5pjvd.exec:\5pjvd.exe165⤵PID:2448
-
\??\c:\rxffxxr.exec:\rxffxxr.exe166⤵PID:2580
-
\??\c:\9ttbtb.exec:\9ttbtb.exe167⤵PID:2420
-
\??\c:\9nhntb.exec:\9nhntb.exe168⤵PID:2532
-
\??\c:\5vdpd.exec:\5vdpd.exe169⤵PID:1444
-
\??\c:\fxfxflx.exec:\fxfxflx.exe170⤵PID:2524
-
\??\c:\frlfffl.exec:\frlfffl.exe171⤵PID:2964
-
\??\c:\bthnhn.exec:\bthnhn.exe172⤵PID:2724
-
\??\c:\pvjjp.exec:\pvjjp.exe173⤵PID:1768
-
\??\c:\3pdpp.exec:\3pdpp.exe174⤵PID:2332
-
\??\c:\xllflff.exec:\xllflff.exe175⤵PID:1596
-
\??\c:\5xrrxff.exec:\5xrrxff.exe176⤵PID:1560
-
\??\c:\nnhntt.exec:\nnhntt.exe177⤵PID:1008
-
\??\c:\pdjdv.exec:\pdjdv.exe178⤵PID:2176
-
\??\c:\1pdvv.exec:\1pdvv.exe179⤵PID:2748
-
\??\c:\7xllrfl.exec:\7xllrfl.exe180⤵PID:824
-
\??\c:\7lrrrlr.exec:\7lrrrlr.exe181⤵PID:2904
-
\??\c:\5ttnnn.exec:\5ttnnn.exe182⤵PID:1980
-
\??\c:\pddvv.exec:\pddvv.exe183⤵PID:1896
-
\??\c:\5dvvd.exec:\5dvvd.exe184⤵PID:1884
-
\??\c:\fxlffff.exec:\fxlffff.exe185⤵PID:2512
-
\??\c:\bnhhnh.exec:\bnhhnh.exe186⤵PID:2384
-
\??\c:\3hnbbb.exec:\3hnbbb.exe187⤵PID:2244
-
\??\c:\vvjjv.exec:\vvjjv.exe188⤵PID:924
-
\??\c:\vpddj.exec:\vpddj.exe189⤵PID:1712
-
\??\c:\rxllllr.exec:\rxllllr.exe190⤵PID:476
-
\??\c:\rflxxrr.exec:\rflxxrr.exe191⤵PID:896
-
\??\c:\htnntn.exec:\htnntn.exe192⤵PID:1568
-
\??\c:\9pvvd.exec:\9pvvd.exe193⤵PID:552
-
\??\c:\vvvpp.exec:\vvvpp.exe194⤵PID:1396
-
\??\c:\xrffffr.exec:\xrffffr.exe195⤵PID:2348
-
\??\c:\xlfxxff.exec:\xlfxxff.exe196⤵PID:2276
-
\??\c:\nhnnnt.exec:\nhnnnt.exe197⤵PID:1960
-
\??\c:\3pjjd.exec:\3pjjd.exe198⤵PID:1460
-
\??\c:\pppjj.exec:\pppjj.exe199⤵PID:1496
-
\??\c:\frrlfxf.exec:\frrlfxf.exe200⤵PID:2804
-
\??\c:\xlfxllr.exec:\xlfxllr.exe201⤵PID:2152
-
\??\c:\nhtnnn.exec:\nhtnnn.exe202⤵PID:2092
-
\??\c:\jdpdv.exec:\jdpdv.exe203⤵PID:2536
-
\??\c:\vvvjv.exec:\vvvjv.exe204⤵PID:2652
-
\??\c:\5rlrffr.exec:\5rlrffr.exe205⤵PID:2052
-
\??\c:\bthhhh.exec:\bthhhh.exe206⤵PID:2616
-
\??\c:\7hbtth.exec:\7hbtth.exe207⤵PID:1996
-
\??\c:\jjvdj.exec:\jjvdj.exe208⤵PID:2628
-
\??\c:\ppdjj.exec:\ppdjj.exe209⤵PID:2124
-
\??\c:\rlxlxfl.exec:\rlxlxfl.exe210⤵PID:2424
-
\??\c:\bhttht.exec:\bhttht.exe211⤵PID:2916
-
\??\c:\bthbhh.exec:\bthbhh.exe212⤵PID:2744
-
\??\c:\vjddj.exec:\vjddj.exe213⤵PID:1004
-
\??\c:\1lrxflr.exec:\1lrxflr.exe214⤵PID:2800
-
\??\c:\7xxfxfl.exec:\7xxfxfl.exe215⤵PID:2792
-
\??\c:\5nhhnt.exec:\5nhhnt.exe216⤵PID:1648
-
\??\c:\9dpvp.exec:\9dpvp.exe217⤵PID:1232
-
\??\c:\dvpjj.exec:\dvpjj.exe218⤵PID:1776
-
\??\c:\lfxlrrl.exec:\lfxlrrl.exe219⤵PID:1348
-
\??\c:\bnbbht.exec:\bnbbht.exe220⤵PID:1028
-
\??\c:\5nbthn.exec:\5nbthn.exe221⤵PID:2900
-
\??\c:\jdvdj.exec:\jdvdj.exe222⤵PID:1464
-
\??\c:\5jjjj.exec:\5jjjj.exe223⤵PID:2948
-
\??\c:\lfxxrrr.exec:\lfxxrrr.exe224⤵PID:1352
-
\??\c:\bnbttn.exec:\bnbttn.exe225⤵PID:1728
-
\??\c:\thnnnt.exec:\thnnnt.exe226⤵PID:664
-
\??\c:\1pjjp.exec:\1pjjp.exe227⤵PID:112
-
\??\c:\lfxxflr.exec:\lfxxflr.exe228⤵PID:2944
-
\??\c:\1rrrflx.exec:\1rrrflx.exe229⤵PID:2712
-
\??\c:\7tnntt.exec:\7tnntt.exe230⤵PID:840
-
\??\c:\vpjjv.exec:\vpjjv.exe231⤵PID:3068
-
\??\c:\dvjjj.exec:\dvjjj.exe232⤵PID:1724
-
\??\c:\rrflxfx.exec:\rrflxfx.exe233⤵PID:984
-
\??\c:\hbbtth.exec:\hbbtth.exe234⤵PID:1952
-
\??\c:\bthnnt.exec:\bthnnt.exe235⤵PID:1196
-
\??\c:\9pvdp.exec:\9pvdp.exe236⤵PID:2096
-
\??\c:\fxlrxxf.exec:\fxlrxxf.exe237⤵PID:1716
-
\??\c:\5fllrlr.exec:\5fllrlr.exe238⤵PID:1536
-
\??\c:\thhntb.exec:\thhntb.exe239⤵PID:1808
-
\??\c:\pdjdp.exec:\pdjdp.exe240⤵PID:348
-
\??\c:\1dppd.exec:\1dppd.exe241⤵PID:1164
-
\??\c:\dpddd.exec:\dpddd.exe242⤵PID:2164