Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 02:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
534618ceaa18345134ac451d65d039a0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
534618ceaa18345134ac451d65d039a0_NeikiAnalytics.exe
-
Size
59KB
-
MD5
534618ceaa18345134ac451d65d039a0
-
SHA1
3f0a0a01fdfac23edf147da2a07d65acb66f7f0e
-
SHA256
186cac11b588b7e2f7bc7970a0aeca9dfd779f3f2ca241d8b90b701e83ea6eff
-
SHA512
55aa777bc8287307b5b26e1903a06bcfef9d22bbc8777c4d742ed9f6e1404955793719bac3110ba67baa7a011dba146887dbd8cabd6c866b71f5c9b470e998e9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzkzp:ymb3NkkiQ3mdBjFIvlF
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral1/memory/616-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1708-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/616-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2072-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1928-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/832-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/356-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1028-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1320-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/896-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rlxxflr.exehbttbh.exefffrlrl.exehnntht.exepjvvd.exevpvdd.exe5frrfll.exe9tbhhb.exepjdvd.exejdpdd.exexrfllrf.exelllrlfl.exeppdjv.exejdjpv.exeffxrxlr.exenbnntb.exeddvjj.exevjdjp.exerrflfxl.exellffrxf.exe7bttbn.exevjvjj.exe1rrfrfr.exelfrxflr.exetnbntt.exejjvvv.exejdppp.exe1lxrffr.exetnbntb.exehhbnhh.exeppjjp.exellfxxxf.exexfffrfr.exebtthbb.exe9hbnbn.exeppjpv.exexlrlllr.exe1nbtbb.exe9bntnb.exepdvvd.exe1jvjp.exeffxrlrr.exerxrrlff.exebnbtbb.exetnbbtt.exe1vvjv.exexrllxfx.exe5lxxxfl.exetnnbnn.exe9hbhbh.exejjdpd.exeflrffxx.exelfllrxf.exennhhnt.exe7bnntt.exe5jvdv.exejdvjp.exerlxrxfr.exefxxxlrf.exehhbnhb.exe5tntth.exe3pdjj.exexrfllfl.exexxlxrxx.exepid process 1708 rlxxflr.exe 2680 hbttbh.exe 2684 fffrlrl.exe 2648 hnntht.exe 2892 pjvvd.exe 2520 vpvdd.exe 2716 5frrfll.exe 2568 9tbhhb.exe 2996 pjdvd.exe 2988 jdpdd.exe 2312 xrfllrf.exe 2072 lllrlfl.exe 2812 ppdjv.exe 1928 jdjpv.exe 2564 ffxrxlr.exe 2872 nbnntb.exe 832 ddvjj.exe 356 vjdjp.exe 2124 rrflfxl.exe 1072 llffrxf.exe 2916 7bttbn.exe 2816 vjvjj.exe 1028 1rrfrfr.exe 1092 lfrxflr.exe 1840 tnbntt.exe 1320 jjvvv.exe 2184 jdppp.exe 896 1lxrffr.exe 2956 tnbntb.exe 2292 hhbnhh.exe 2388 ppjjp.exe 2028 llfxxxf.exe 2168 xfffrfr.exe 1564 btthbb.exe 2212 9hbnbn.exe 2640 ppjpv.exe 2992 xlrlllr.exe 2760 1nbtbb.exe 2504 9bntnb.exe 2532 pdvvd.exe 2852 1jvjp.exe 2776 ffxrlrr.exe 2528 rxrrlff.exe 1624 bnbtbb.exe 3000 tnbbtt.exe 2948 1vvjv.exe 2272 xrllxfx.exe 2092 5lxxxfl.exe 2744 tnnbnn.exe 2008 9hbhbh.exe 2016 jjdpd.exe 2556 flrffxx.exe 2820 lfllrxf.exe 2864 nnhhnt.exe 1812 7bnntt.exe 832 5jvdv.exe 2244 jdvjp.exe 2084 rlxrxfr.exe 3032 fxxxlrf.exe 2260 hhbnhb.exe 532 5tntth.exe 968 3pdjj.exe 2740 xrfllfl.exe 1968 xxlxrxx.exe -
Processes:
resource yara_rule behavioral1/memory/1708-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/616-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1928-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/832-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/356-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1028-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1320-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/896-273-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
534618ceaa18345134ac451d65d039a0_NeikiAnalytics.exerlxxflr.exehbttbh.exefffrlrl.exehnntht.exepjvvd.exevpvdd.exe5frrfll.exe9tbhhb.exepjdvd.exejdpdd.exexrfllrf.exelllrlfl.exeppdjv.exejdjpv.exeffxrxlr.exedescription pid process target process PID 616 wrote to memory of 1708 616 534618ceaa18345134ac451d65d039a0_NeikiAnalytics.exe rlxxflr.exe PID 616 wrote to memory of 1708 616 534618ceaa18345134ac451d65d039a0_NeikiAnalytics.exe rlxxflr.exe PID 616 wrote to memory of 1708 616 534618ceaa18345134ac451d65d039a0_NeikiAnalytics.exe rlxxflr.exe PID 616 wrote to memory of 1708 616 534618ceaa18345134ac451d65d039a0_NeikiAnalytics.exe rlxxflr.exe PID 1708 wrote to memory of 2680 1708 rlxxflr.exe hbttbh.exe PID 1708 wrote to memory of 2680 1708 rlxxflr.exe hbttbh.exe PID 1708 wrote to memory of 2680 1708 rlxxflr.exe hbttbh.exe PID 1708 wrote to memory of 2680 1708 rlxxflr.exe hbttbh.exe PID 2680 wrote to memory of 2684 2680 hbttbh.exe fffrlrl.exe PID 2680 wrote to memory of 2684 2680 hbttbh.exe fffrlrl.exe PID 2680 wrote to memory of 2684 2680 hbttbh.exe fffrlrl.exe PID 2680 wrote to memory of 2684 2680 hbttbh.exe fffrlrl.exe PID 2684 wrote to memory of 2648 2684 fffrlrl.exe hnntht.exe PID 2684 wrote to memory of 2648 2684 fffrlrl.exe hnntht.exe PID 2684 wrote to memory of 2648 2684 fffrlrl.exe hnntht.exe PID 2684 wrote to memory of 2648 2684 fffrlrl.exe hnntht.exe PID 2648 wrote to memory of 2892 2648 hnntht.exe pjvvd.exe PID 2648 wrote to memory of 2892 2648 hnntht.exe pjvvd.exe PID 2648 wrote to memory of 2892 2648 hnntht.exe pjvvd.exe PID 2648 wrote to memory of 2892 2648 hnntht.exe pjvvd.exe PID 2892 wrote to memory of 2520 2892 pjvvd.exe vpvdd.exe PID 2892 wrote to memory of 2520 2892 pjvvd.exe vpvdd.exe PID 2892 wrote to memory of 2520 2892 pjvvd.exe vpvdd.exe PID 2892 wrote to memory of 2520 2892 pjvvd.exe vpvdd.exe PID 2520 wrote to memory of 2716 2520 vpvdd.exe 5frrfll.exe PID 2520 wrote to memory of 2716 2520 vpvdd.exe 5frrfll.exe PID 2520 wrote to memory of 2716 2520 vpvdd.exe 5frrfll.exe PID 2520 wrote to memory of 2716 2520 vpvdd.exe 5frrfll.exe PID 2716 wrote to memory of 2568 2716 5frrfll.exe 9tbhhb.exe PID 2716 wrote to memory of 2568 2716 5frrfll.exe 9tbhhb.exe PID 2716 wrote to memory of 2568 2716 5frrfll.exe 9tbhhb.exe PID 2716 wrote to memory of 2568 2716 5frrfll.exe 9tbhhb.exe PID 2568 wrote to memory of 2996 2568 9tbhhb.exe pjdvd.exe PID 2568 wrote to memory of 2996 2568 9tbhhb.exe pjdvd.exe PID 2568 wrote to memory of 2996 2568 9tbhhb.exe pjdvd.exe PID 2568 wrote to memory of 2996 2568 9tbhhb.exe pjdvd.exe PID 2996 wrote to memory of 2988 2996 pjdvd.exe jdpdd.exe PID 2996 wrote to memory of 2988 2996 pjdvd.exe jdpdd.exe PID 2996 wrote to memory of 2988 2996 pjdvd.exe jdpdd.exe PID 2996 wrote to memory of 2988 2996 pjdvd.exe jdpdd.exe PID 2988 wrote to memory of 2312 2988 jdpdd.exe xrfllrf.exe PID 2988 wrote to memory of 2312 2988 jdpdd.exe xrfllrf.exe PID 2988 wrote to memory of 2312 2988 jdpdd.exe xrfllrf.exe PID 2988 wrote to memory of 2312 2988 jdpdd.exe xrfllrf.exe PID 2312 wrote to memory of 2072 2312 xrfllrf.exe lllrlfl.exe PID 2312 wrote to memory of 2072 2312 xrfllrf.exe lllrlfl.exe PID 2312 wrote to memory of 2072 2312 xrfllrf.exe lllrlfl.exe PID 2312 wrote to memory of 2072 2312 xrfllrf.exe lllrlfl.exe PID 2072 wrote to memory of 2812 2072 lllrlfl.exe ppdjv.exe PID 2072 wrote to memory of 2812 2072 lllrlfl.exe ppdjv.exe PID 2072 wrote to memory of 2812 2072 lllrlfl.exe ppdjv.exe PID 2072 wrote to memory of 2812 2072 lllrlfl.exe ppdjv.exe PID 2812 wrote to memory of 1928 2812 ppdjv.exe jdjpv.exe PID 2812 wrote to memory of 1928 2812 ppdjv.exe jdjpv.exe PID 2812 wrote to memory of 1928 2812 ppdjv.exe jdjpv.exe PID 2812 wrote to memory of 1928 2812 ppdjv.exe jdjpv.exe PID 1928 wrote to memory of 2564 1928 jdjpv.exe ffxrxlr.exe PID 1928 wrote to memory of 2564 1928 jdjpv.exe ffxrxlr.exe PID 1928 wrote to memory of 2564 1928 jdjpv.exe ffxrxlr.exe PID 1928 wrote to memory of 2564 1928 jdjpv.exe ffxrxlr.exe PID 2564 wrote to memory of 2872 2564 ffxrxlr.exe nbnntb.exe PID 2564 wrote to memory of 2872 2564 ffxrxlr.exe nbnntb.exe PID 2564 wrote to memory of 2872 2564 ffxrxlr.exe nbnntb.exe PID 2564 wrote to memory of 2872 2564 ffxrxlr.exe nbnntb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\534618ceaa18345134ac451d65d039a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\534618ceaa18345134ac451d65d039a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:616 -
\??\c:\rlxxflr.exec:\rlxxflr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\hbttbh.exec:\hbttbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\fffrlrl.exec:\fffrlrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\hnntht.exec:\hnntht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\pjvvd.exec:\pjvvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\vpvdd.exec:\vpvdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\5frrfll.exec:\5frrfll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\9tbhhb.exec:\9tbhhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\pjdvd.exec:\pjdvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\jdpdd.exec:\jdpdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\xrfllrf.exec:\xrfllrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\lllrlfl.exec:\lllrlfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\ppdjv.exec:\ppdjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\jdjpv.exec:\jdjpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\ffxrxlr.exec:\ffxrxlr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\nbnntb.exec:\nbnntb.exe17⤵
- Executes dropped EXE
PID:2872 -
\??\c:\ddvjj.exec:\ddvjj.exe18⤵
- Executes dropped EXE
PID:832 -
\??\c:\vjdjp.exec:\vjdjp.exe19⤵
- Executes dropped EXE
PID:356 -
\??\c:\rrflfxl.exec:\rrflfxl.exe20⤵
- Executes dropped EXE
PID:2124 -
\??\c:\llffrxf.exec:\llffrxf.exe21⤵
- Executes dropped EXE
PID:1072 -
\??\c:\7bttbn.exec:\7bttbn.exe22⤵
- Executes dropped EXE
PID:2916 -
\??\c:\vjvjj.exec:\vjvjj.exe23⤵
- Executes dropped EXE
PID:2816 -
\??\c:\1rrfrfr.exec:\1rrfrfr.exe24⤵
- Executes dropped EXE
PID:1028 -
\??\c:\lfrxflr.exec:\lfrxflr.exe25⤵
- Executes dropped EXE
PID:1092 -
\??\c:\tnbntt.exec:\tnbntt.exe26⤵
- Executes dropped EXE
PID:1840 -
\??\c:\jjvvv.exec:\jjvvv.exe27⤵
- Executes dropped EXE
PID:1320 -
\??\c:\jdppp.exec:\jdppp.exe28⤵
- Executes dropped EXE
PID:2184 -
\??\c:\1lxrffr.exec:\1lxrffr.exe29⤵
- Executes dropped EXE
PID:896 -
\??\c:\tnbntb.exec:\tnbntb.exe30⤵
- Executes dropped EXE
PID:2956 -
\??\c:\hhbnhh.exec:\hhbnhh.exe31⤵
- Executes dropped EXE
PID:2292 -
\??\c:\ppjjp.exec:\ppjjp.exe32⤵
- Executes dropped EXE
PID:2388 -
\??\c:\llfxxxf.exec:\llfxxxf.exe33⤵
- Executes dropped EXE
PID:2028 -
\??\c:\xfffrfr.exec:\xfffrfr.exe34⤵
- Executes dropped EXE
PID:2168 -
\??\c:\btthbb.exec:\btthbb.exe35⤵
- Executes dropped EXE
PID:1564 -
\??\c:\9hbnbn.exec:\9hbnbn.exe36⤵
- Executes dropped EXE
PID:2212 -
\??\c:\ppjpv.exec:\ppjpv.exe37⤵
- Executes dropped EXE
PID:2640 -
\??\c:\xlrlllr.exec:\xlrlllr.exe38⤵
- Executes dropped EXE
PID:2992 -
\??\c:\1nbtbb.exec:\1nbtbb.exe39⤵
- Executes dropped EXE
PID:2760 -
\??\c:\9bntnb.exec:\9bntnb.exe40⤵
- Executes dropped EXE
PID:2504 -
\??\c:\pdvvd.exec:\pdvvd.exe41⤵
- Executes dropped EXE
PID:2532 -
\??\c:\1jvjp.exec:\1jvjp.exe42⤵
- Executes dropped EXE
PID:2852 -
\??\c:\ffxrlrr.exec:\ffxrlrr.exe43⤵
- Executes dropped EXE
PID:2776 -
\??\c:\rxrrlff.exec:\rxrrlff.exe44⤵
- Executes dropped EXE
PID:2528 -
\??\c:\bnbtbb.exec:\bnbtbb.exe45⤵
- Executes dropped EXE
PID:1624 -
\??\c:\tnbbtt.exec:\tnbbtt.exe46⤵
- Executes dropped EXE
PID:3000 -
\??\c:\1vvjv.exec:\1vvjv.exe47⤵
- Executes dropped EXE
PID:2948 -
\??\c:\xrllxfx.exec:\xrllxfx.exe48⤵
- Executes dropped EXE
PID:2272 -
\??\c:\5lxxxfl.exec:\5lxxxfl.exe49⤵
- Executes dropped EXE
PID:2092 -
\??\c:\tnnbnn.exec:\tnnbnn.exe50⤵
- Executes dropped EXE
PID:2744 -
\??\c:\9hbhbh.exec:\9hbhbh.exe51⤵
- Executes dropped EXE
PID:2008 -
\??\c:\jjdpd.exec:\jjdpd.exe52⤵
- Executes dropped EXE
PID:2016 -
\??\c:\flrffxx.exec:\flrffxx.exe53⤵
- Executes dropped EXE
PID:2556 -
\??\c:\lfllrxf.exec:\lfllrxf.exe54⤵
- Executes dropped EXE
PID:2820 -
\??\c:\nnhhnt.exec:\nnhhnt.exe55⤵
- Executes dropped EXE
PID:2864 -
\??\c:\7bnntt.exec:\7bnntt.exe56⤵
- Executes dropped EXE
PID:1812 -
\??\c:\5jvdv.exec:\5jvdv.exe57⤵
- Executes dropped EXE
PID:832 -
\??\c:\jdvjp.exec:\jdvjp.exe58⤵
- Executes dropped EXE
PID:2244 -
\??\c:\rlxrxfr.exec:\rlxrxfr.exe59⤵
- Executes dropped EXE
PID:2084 -
\??\c:\fxxxlrf.exec:\fxxxlrf.exe60⤵
- Executes dropped EXE
PID:3032 -
\??\c:\hhbnhb.exec:\hhbnhb.exe61⤵
- Executes dropped EXE
PID:2260 -
\??\c:\5tntth.exec:\5tntth.exe62⤵
- Executes dropped EXE
PID:532 -
\??\c:\3pdjj.exec:\3pdjj.exe63⤵
- Executes dropped EXE
PID:968 -
\??\c:\xrfllfl.exec:\xrfllfl.exe64⤵
- Executes dropped EXE
PID:2740 -
\??\c:\xxlxrxx.exec:\xxlxrxx.exe65⤵
- Executes dropped EXE
PID:1968 -
\??\c:\hbnbtb.exec:\hbnbtb.exe66⤵PID:2464
-
\??\c:\bnbbtb.exec:\bnbbtb.exe67⤵PID:2236
-
\??\c:\ddpvd.exec:\ddpvd.exe68⤵PID:1904
-
\??\c:\7pddj.exec:\7pddj.exe69⤵PID:652
-
\??\c:\flrxrfx.exec:\flrxrfx.exe70⤵PID:3020
-
\??\c:\lflrlrl.exec:\lflrlrl.exe71⤵PID:896
-
\??\c:\nthbbt.exec:\nthbbt.exe72⤵PID:1648
-
\??\c:\dvppj.exec:\dvppj.exe73⤵PID:2136
-
\??\c:\vpjvj.exec:\vpjvj.exe74⤵PID:1796
-
\??\c:\flrrxrx.exec:\flrrxrx.exe75⤵PID:616
-
\??\c:\nhbnhb.exec:\nhbnhb.exe76⤵PID:2792
-
\??\c:\hbttbb.exec:\hbttbb.exe77⤵PID:3056
-
\??\c:\vvjpd.exec:\vvjpd.exe78⤵PID:2296
-
\??\c:\xflrffl.exec:\xflrffl.exe79⤵PID:2064
-
\??\c:\xrllfxr.exec:\xrllfxr.exe80⤵PID:2684
-
\??\c:\tthtbn.exec:\tthtbn.exe81⤵PID:1300
-
\??\c:\hhtbht.exec:\hhtbht.exe82⤵PID:2656
-
\??\c:\jjppp.exec:\jjppp.exe83⤵PID:2892
-
\??\c:\rrlflfr.exec:\rrlflfr.exe84⤵PID:2632
-
\??\c:\xxflxll.exec:\xxflxll.exe85⤵PID:2492
-
\??\c:\bnhhtb.exec:\bnhhtb.exe86⤵PID:2496
-
\??\c:\hbthbt.exec:\hbthbt.exe87⤵PID:2976
-
\??\c:\vvddv.exec:\vvddv.exe88⤵PID:2392
-
\??\c:\jdpvd.exec:\jdpvd.exe89⤵PID:2592
-
\??\c:\xxrfxxf.exec:\xxrfxxf.exe90⤵PID:2964
-
\??\c:\3rrfrxl.exec:\3rrfrxl.exe91⤵PID:2312
-
\??\c:\hbnnnt.exec:\hbnnnt.exe92⤵PID:2732
-
\??\c:\hhhntb.exec:\hhhntb.exe93⤵PID:800
-
\??\c:\dvjvv.exec:\dvjvv.exe94⤵PID:316
-
\??\c:\pjpvd.exec:\pjpvd.exe95⤵PID:2752
-
\??\c:\rlfllxf.exec:\rlfllxf.exe96⤵PID:2596
-
\??\c:\xrlrrrr.exec:\xrlrrrr.exe97⤵PID:1924
-
\??\c:\btntth.exec:\btntth.exe98⤵PID:1688
-
\??\c:\3nbbbb.exec:\3nbbbb.exe99⤵PID:1580
-
\??\c:\vdvdv.exec:\vdvdv.exe100⤵PID:356
-
\??\c:\jvpvd.exec:\jvpvd.exe101⤵PID:2056
-
\??\c:\rrxffrf.exec:\rrxffrf.exe102⤵PID:2908
-
\??\c:\lxllffr.exec:\lxllffr.exe103⤵PID:1992
-
\??\c:\bbhntt.exec:\bbhntt.exe104⤵PID:768
-
\??\c:\hhhthn.exec:\hhhthn.exe105⤵PID:1476
-
\??\c:\jjvdp.exec:\jjvdp.exe106⤵PID:2280
-
\??\c:\7jdpd.exec:\7jdpd.exe107⤵PID:1496
-
\??\c:\rlxfllx.exec:\rlxfllx.exe108⤵PID:1656
-
\??\c:\rlxxflx.exec:\rlxxflx.exe109⤵PID:284
-
\??\c:\nhbnnt.exec:\nhbnnt.exe110⤵PID:2804
-
\??\c:\ntttbn.exec:\ntttbn.exe111⤵PID:2356
-
\??\c:\pdjdv.exec:\pdjdv.exe112⤵PID:1116
-
\??\c:\jdjpp.exec:\jdjpp.exe113⤵PID:1008
-
\??\c:\fxflxxf.exec:\fxflxxf.exe114⤵PID:624
-
\??\c:\7lfflxf.exec:\7lfflxf.exe115⤵PID:1488
-
\??\c:\1bthnn.exec:\1bthnn.exe116⤵PID:2936
-
\??\c:\3ttbhh.exec:\3ttbhh.exe117⤵PID:2232
-
\??\c:\vdpjj.exec:\vdpjj.exe118⤵PID:2168
-
\??\c:\vvppp.exec:\vvppp.exe119⤵PID:2800
-
\??\c:\xxrrxfx.exec:\xxrrxfx.exe120⤵PID:1980
-
\??\c:\bthnnb.exec:\bthnnb.exe121⤵PID:2704
-
\??\c:\hnntbn.exec:\hnntbn.exe122⤵PID:2604
-
\??\c:\5dvdj.exec:\5dvdj.exe123⤵PID:2712
-
\??\c:\vpvdd.exec:\vpvdd.exe124⤵PID:2768
-
\??\c:\ffxrxxx.exec:\ffxrxxx.exe125⤵PID:2784
-
\??\c:\xxxllfx.exec:\xxxllfx.exe126⤵PID:2552
-
\??\c:\nnnhbb.exec:\nnnhbb.exe127⤵PID:2668
-
\??\c:\hntbhb.exec:\hntbhb.exe128⤵PID:2528
-
\??\c:\7pddp.exec:\7pddp.exe129⤵PID:2972
-
\??\c:\9rrrllr.exec:\9rrrllr.exe130⤵PID:2860
-
\??\c:\5frxffx.exec:\5frxffx.exe131⤵PID:1684
-
\??\c:\hbnnbt.exec:\hbnnbt.exe132⤵PID:1428
-
\??\c:\nhbbhh.exec:\nhbbhh.exe133⤵PID:2060
-
\??\c:\pvjpd.exec:\pvjpd.exe134⤵PID:1996
-
\??\c:\djjvp.exec:\djjvp.exe135⤵PID:2736
-
\??\c:\lfrlxfr.exec:\lfrlxfr.exe136⤵PID:2016
-
\??\c:\llfrxxf.exec:\llfrxxf.exe137⤵PID:880
-
\??\c:\hbthtb.exec:\hbthtb.exe138⤵PID:2868
-
\??\c:\nhbhbb.exec:\nhbhbb.exe139⤵PID:2872
-
\??\c:\5vpdj.exec:\5vpdj.exe140⤵PID:2256
-
\??\c:\jdppj.exec:\jdppj.exe141⤵PID:1520
-
\??\c:\lllrffl.exec:\lllrffl.exe142⤵PID:1676
-
\??\c:\ttthnh.exec:\ttthnh.exe143⤵PID:2300
-
\??\c:\nnhhtb.exec:\nnhhtb.exe144⤵PID:1072
-
\??\c:\jjpvj.exec:\jjpvj.exe145⤵PID:1312
-
\??\c:\3pvjv.exec:\3pvjv.exe146⤵PID:532
-
\??\c:\fxffrrf.exec:\fxffrrf.exe147⤵PID:264
-
\??\c:\xfrxrff.exec:\xfrxrff.exe148⤵PID:2088
-
\??\c:\bhhbht.exec:\bhhbht.exe149⤵PID:1968
-
\??\c:\nthbhh.exec:\nthbhh.exe150⤵PID:596
-
\??\c:\vdpvp.exec:\vdpvp.exe151⤵PID:2236
-
\??\c:\9lxfllf.exec:\9lxfllf.exe152⤵PID:1904
-
\??\c:\lrlxxxr.exec:\lrlxxxr.exe153⤵PID:604
-
\??\c:\htnhhh.exec:\htnhhh.exe154⤵PID:3008
-
\??\c:\bbnhnt.exec:\bbnhnt.exe155⤵PID:3060
-
\??\c:\pjvpv.exec:\pjvpv.exe156⤵PID:2952
-
\??\c:\jdpvd.exec:\jdpvd.exe157⤵PID:1724
-
\??\c:\frlrrfl.exec:\frlrrfl.exe158⤵PID:2432
-
\??\c:\9rlxrxx.exec:\9rlxrxx.exe159⤵PID:2228
-
\??\c:\hbtthb.exec:\hbtthb.exe160⤵PID:1260
-
\??\c:\hhbhnn.exec:\hhbhnn.exe161⤵PID:2224
-
\??\c:\9ddvv.exec:\9ddvv.exe162⤵PID:2296
-
\??\c:\ddpdp.exec:\ddpdp.exe163⤵PID:2336
-
\??\c:\fxfxfrx.exec:\fxfxfrx.exe164⤵PID:2896
-
\??\c:\7xxfxll.exec:\7xxfxll.exe165⤵PID:2900
-
\??\c:\9bhthh.exec:\9bhthh.exe166⤵PID:2612
-
\??\c:\pdppv.exec:\pdppv.exe167⤵PID:1048
-
\??\c:\dddpv.exec:\dddpv.exe168⤵PID:2500
-
\??\c:\rlffffr.exec:\rlffffr.exe169⤵PID:2676
-
\??\c:\llrfxlx.exec:\llrfxlx.exe170⤵PID:2716
-
\??\c:\7bbbnt.exec:\7bbbnt.exe171⤵PID:1376
-
\??\c:\tnhnbt.exec:\tnhnbt.exe172⤵PID:1144
-
\??\c:\jpvpv.exec:\jpvpv.exe173⤵PID:1536
-
\??\c:\jjdvd.exec:\jjdvd.exe174⤵PID:2964
-
\??\c:\xrffrrx.exec:\xrffrrx.exe175⤵PID:1936
-
\??\c:\rlrflfr.exec:\rlrflfr.exe176⤵PID:2968
-
\??\c:\hhbhnb.exec:\hhbhnb.exe177⤵PID:468
-
\??\c:\1vvpv.exec:\1vvpv.exe178⤵PID:2840
-
\??\c:\vpjpv.exec:\vpjpv.exe179⤵PID:1948
-
\??\c:\rffffrx.exec:\rffffrx.exe180⤵PID:2820
-
\??\c:\rxlffrl.exec:\rxlffrl.exe181⤵PID:1984
-
\??\c:\hbbnbh.exec:\hbbnbh.exe182⤵PID:1572
-
\??\c:\nbntbb.exec:\nbntbb.exe183⤵PID:1504
-
\??\c:\pvdpv.exec:\pvdpv.exe184⤵PID:1284
-
\??\c:\5jvjd.exec:\5jvjd.exe185⤵PID:1964
-
\??\c:\rrflrxf.exec:\rrflrxf.exe186⤵PID:2908
-
\??\c:\3nhntb.exec:\3nhntb.exe187⤵PID:664
-
\??\c:\5hhthh.exec:\5hhthh.exe188⤵PID:768
-
\??\c:\ddppj.exec:\ddppj.exe189⤵PID:1096
-
\??\c:\lxlrxfr.exec:\lxlrxfr.exe190⤵PID:1788
-
\??\c:\rlflxfl.exec:\rlflxfl.exe191⤵PID:1604
-
\??\c:\rlxfflx.exec:\rlxfflx.exe192⤵PID:776
-
\??\c:\tnbhnb.exec:\tnbhnb.exe193⤵PID:284
-
\??\c:\hbtbhn.exec:\hbtbhn.exe194⤵PID:3036
-
\??\c:\jjdpd.exec:\jjdpd.exe195⤵PID:2356
-
\??\c:\jdpvd.exec:\jdpvd.exe196⤵PID:2956
-
\??\c:\3lxxlrf.exec:\3lxxlrf.exe197⤵PID:1008
-
\??\c:\3xfxlxx.exec:\3xfxlxx.exe198⤵PID:348
-
\??\c:\1tnbbt.exec:\1tnbbt.exe199⤵PID:1492
-
\??\c:\nnbnth.exec:\nnbnth.exe200⤵PID:1592
-
\??\c:\pvpdp.exec:\pvpdp.exe201⤵PID:2232
-
\??\c:\pvdvd.exec:\pvdvd.exe202⤵PID:2168
-
\??\c:\rlflflx.exec:\rlflflx.exe203⤵PID:1804
-
\??\c:\fxxflrf.exec:\fxxflrf.exe204⤵PID:2764
-
\??\c:\tbhtth.exec:\tbhtth.exe205⤵PID:2628
-
\??\c:\tthtnn.exec:\tthtnn.exe206⤵PID:2680
-
\??\c:\bbhbhb.exec:\bbhbhb.exe207⤵PID:2760
-
\??\c:\pvdvd.exec:\pvdvd.exe208⤵PID:2288
-
\??\c:\3xxfflr.exec:\3xxfflr.exe209⤵PID:2508
-
\??\c:\flflxrl.exec:\flflxrl.exe210⤵PID:2852
-
\??\c:\bnhhnb.exec:\bnhhnb.exe211⤵PID:3028
-
\??\c:\bbhnbh.exec:\bbhnbh.exe212⤵PID:2616
-
\??\c:\dddpj.exec:\dddpj.exe213⤵PID:1748
-
\??\c:\jdjvv.exec:\jdjvv.exe214⤵PID:2988
-
\??\c:\lrrfrrl.exec:\lrrfrrl.exe215⤵PID:1684
-
\??\c:\lfrfllf.exec:\lfrfllf.exe216⤵PID:2352
-
\??\c:\3tttbh.exec:\3tttbh.exe217⤵PID:2060
-
\??\c:\htthhh.exec:\htthhh.exe218⤵PID:2032
-
\??\c:\pjvdv.exec:\pjvdv.exe219⤵PID:2736
-
\??\c:\jpjdd.exec:\jpjdd.exe220⤵PID:2484
-
\??\c:\lllxfll.exec:\lllxfll.exe221⤵PID:880
-
\??\c:\xxrxfrx.exec:\xxrxfrx.exe222⤵PID:1568
-
\??\c:\hbtbnt.exec:\hbtbnt.exe223⤵PID:2872
-
\??\c:\bbtbht.exec:\bbtbht.exe224⤵PID:1616
-
\??\c:\pppdp.exec:\pppdp.exe225⤵PID:1620
-
\??\c:\7jddj.exec:\7jddj.exe226⤵PID:2924
-
\??\c:\5frrxxf.exec:\5frrxxf.exe227⤵PID:2300
-
\??\c:\xrllxxr.exec:\xrllxxr.exe228⤵PID:1764
-
\??\c:\nnbhnb.exec:\nnbhnb.exe229⤵PID:1312
-
\??\c:\5hbhhn.exec:\5hbhhn.exe230⤵PID:2816
-
\??\c:\pjpvd.exec:\pjpvd.exe231⤵PID:544
-
\??\c:\pjddj.exec:\pjddj.exe232⤵PID:1460
-
\??\c:\llffllf.exec:\llffllf.exe233⤵PID:940
-
\??\c:\rlffrxl.exec:\rlffrxl.exe234⤵PID:1800
-
\??\c:\tnntnb.exec:\tnntnb.exe235⤵PID:1848
-
\??\c:\hbtttb.exec:\hbtttb.exe236⤵PID:3048
-
\??\c:\7jdjj.exec:\7jdjj.exe237⤵PID:3036
-
\??\c:\jjppv.exec:\jjppv.exe238⤵PID:3012
-
\??\c:\rllxlxl.exec:\rllxlxl.exe239⤵PID:1828
-
\??\c:\xxxxlfx.exec:\xxxxlfx.exe240⤵PID:872
-
\??\c:\ttbbhh.exec:\ttbbhh.exe241⤵PID:2928
-
\??\c:\3hbnnn.exec:\3hbnnn.exe242⤵PID:2028