Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 03:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5e444a7286f7b6f237208e1ca46dab40_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
5e444a7286f7b6f237208e1ca46dab40_NeikiAnalytics.exe
-
Size
68KB
-
MD5
5e444a7286f7b6f237208e1ca46dab40
-
SHA1
18148e71db38b14951bf5168dc51e4ac082f07d0
-
SHA256
97fe2f9b7e857ec41e0e7dc64656ea35de7861e3c2ae51b96af5d066e46c2337
-
SHA512
f07ec4eaff94e9d5633f29fef5def149e82618c2f78e618882f323b15915ab9d7a7ed93fe95537f8d4bdd080770fd218748ddbc4e6fef1b8dd0683f3e3920f5f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUwcsbY/H:ymb3NkkiQ3mdBjF0yjcsMP
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral1/memory/2212-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2192-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-63-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3060-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2228-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2044-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1984-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/668-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1512-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/932-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1632-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
nnbbtb.exe7jpvd.exetnbnbh.exedvdjp.exe9rxxxxx.exellxrxlx.exejvjpv.exeppvvd.exellfrfxr.exehbnthh.exebttbtb.exejvppd.exe9frxlfl.exefxlfrfl.exenbnntb.exeppdjv.exe5rrxlrl.exe3lxfxfr.exe5nbnhn.exedvjjp.exepjdpd.exefxrlrxl.exe5tnhtt.exebtttth.exepjvdv.exerflrflx.exetnbnnn.exe5hhntt.exe5pjdj.exexrfrllr.exelflrxxl.exe9htthh.exe7vvdj.exe1jvvp.exe3flflrx.exelxfflll.exebnbnnh.exepdjpd.exevjddp.exexfxlfxf.exe1frlrxf.exehtbtnt.exejdvdj.exevpvdv.exenhttnn.exethhbhn.exe1jvjv.exexxxlxfr.exerxffrff.exebttbbh.exeddvvp.exe9vpvj.exexllfrll.exefrlrflr.exe9hbnhh.exe5pddp.exedpdvp.exerrlrlfr.exerllrrfx.exehbhntb.exevpdvp.exe1vvdj.exelfrflxf.exefrlfxlr.exepid process 2424 nnbbtb.exe 2192 7jpvd.exe 2620 tnbnbh.exe 2896 dvdjp.exe 3060 9rxxxxx.exe 2840 llxrxlx.exe 2708 jvjpv.exe 2564 ppvvd.exe 2344 llfrfxr.exe 2864 hbnthh.exe 2988 bttbtb.exe 2588 jvppd.exe 1184 9frxlfl.exe 1348 fxlfrfl.exe 1300 nbnntb.exe 2820 ppdjv.exe 2228 5rrxlrl.exe 2044 3lxfxfr.exe 1984 5nbnhn.exe 2016 dvjjp.exe 2476 pjdpd.exe 668 fxrlrxl.exe 656 5tnhtt.exe 2348 btttth.exe 1512 pjvdv.exe 932 rflrflx.exe 348 tnbnnn.exe 1632 5hhntt.exe 2204 5pjdj.exe 3028 xrfrllr.exe 3024 lflrxxl.exe 3020 9htthh.exe 352 7vvdj.exe 2576 1jvvp.exe 2676 3flflrx.exe 1680 lxfflll.exe 2192 bnbnnh.exe 2712 pdjpd.exe 2740 vjddp.exe 2652 xfxlfxf.exe 3060 1frlrxf.exe 2604 htbtnt.exe 2488 jdvdj.exe 2660 vpvdv.exe 2568 nhttnn.exe 2828 thhbhn.exe 2940 1jvjv.exe 2112 xxxlxfr.exe 2724 rxffrff.exe 1920 bttbbh.exe 556 ddvvp.exe 1244 9vpvj.exe 292 xllfrll.exe 2824 frlrflr.exe 2784 9hbnhh.exe 2228 5pddp.exe 2004 dpdvp.exe 1928 rrlrlfr.exe 2064 rllrrfx.exe 2856 hbhntb.exe 264 vpdvp.exe 1036 1vvdj.exe 580 lfrflxf.exe 1972 frlfxlr.exe -
Processes:
resource yara_rule behavioral1/memory/2212-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1984-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/668-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1512-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/932-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1632-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-291-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5e444a7286f7b6f237208e1ca46dab40_NeikiAnalytics.exennbbtb.exe7jpvd.exetnbnbh.exedvdjp.exe9rxxxxx.exellxrxlx.exejvjpv.exeppvvd.exellfrfxr.exehbnthh.exebttbtb.exejvppd.exe9frxlfl.exefxlfrfl.exenbnntb.exedescription pid process target process PID 2212 wrote to memory of 2424 2212 5e444a7286f7b6f237208e1ca46dab40_NeikiAnalytics.exe nnbbtb.exe PID 2212 wrote to memory of 2424 2212 5e444a7286f7b6f237208e1ca46dab40_NeikiAnalytics.exe nnbbtb.exe PID 2212 wrote to memory of 2424 2212 5e444a7286f7b6f237208e1ca46dab40_NeikiAnalytics.exe nnbbtb.exe PID 2212 wrote to memory of 2424 2212 5e444a7286f7b6f237208e1ca46dab40_NeikiAnalytics.exe nnbbtb.exe PID 2424 wrote to memory of 2192 2424 nnbbtb.exe 7jpvd.exe PID 2424 wrote to memory of 2192 2424 nnbbtb.exe 7jpvd.exe PID 2424 wrote to memory of 2192 2424 nnbbtb.exe 7jpvd.exe PID 2424 wrote to memory of 2192 2424 nnbbtb.exe 7jpvd.exe PID 2192 wrote to memory of 2620 2192 7jpvd.exe tnbnbh.exe PID 2192 wrote to memory of 2620 2192 7jpvd.exe tnbnbh.exe PID 2192 wrote to memory of 2620 2192 7jpvd.exe tnbnbh.exe PID 2192 wrote to memory of 2620 2192 7jpvd.exe tnbnbh.exe PID 2620 wrote to memory of 2896 2620 tnbnbh.exe dvdjp.exe PID 2620 wrote to memory of 2896 2620 tnbnbh.exe dvdjp.exe PID 2620 wrote to memory of 2896 2620 tnbnbh.exe dvdjp.exe PID 2620 wrote to memory of 2896 2620 tnbnbh.exe dvdjp.exe PID 2896 wrote to memory of 3060 2896 dvdjp.exe 9rxxxxx.exe PID 2896 wrote to memory of 3060 2896 dvdjp.exe 9rxxxxx.exe PID 2896 wrote to memory of 3060 2896 dvdjp.exe 9rxxxxx.exe PID 2896 wrote to memory of 3060 2896 dvdjp.exe 9rxxxxx.exe PID 3060 wrote to memory of 2840 3060 9rxxxxx.exe llxrxlx.exe PID 3060 wrote to memory of 2840 3060 9rxxxxx.exe llxrxlx.exe PID 3060 wrote to memory of 2840 3060 9rxxxxx.exe llxrxlx.exe PID 3060 wrote to memory of 2840 3060 9rxxxxx.exe llxrxlx.exe PID 2840 wrote to memory of 2708 2840 llxrxlx.exe jvjpv.exe PID 2840 wrote to memory of 2708 2840 llxrxlx.exe jvjpv.exe PID 2840 wrote to memory of 2708 2840 llxrxlx.exe jvjpv.exe PID 2840 wrote to memory of 2708 2840 llxrxlx.exe jvjpv.exe PID 2708 wrote to memory of 2564 2708 jvjpv.exe ppvvd.exe PID 2708 wrote to memory of 2564 2708 jvjpv.exe ppvvd.exe PID 2708 wrote to memory of 2564 2708 jvjpv.exe ppvvd.exe PID 2708 wrote to memory of 2564 2708 jvjpv.exe ppvvd.exe PID 2564 wrote to memory of 2344 2564 ppvvd.exe llfrfxr.exe PID 2564 wrote to memory of 2344 2564 ppvvd.exe llfrfxr.exe PID 2564 wrote to memory of 2344 2564 ppvvd.exe llfrfxr.exe PID 2564 wrote to memory of 2344 2564 ppvvd.exe llfrfxr.exe PID 2344 wrote to memory of 2864 2344 llfrfxr.exe hbnthh.exe PID 2344 wrote to memory of 2864 2344 llfrfxr.exe hbnthh.exe PID 2344 wrote to memory of 2864 2344 llfrfxr.exe hbnthh.exe PID 2344 wrote to memory of 2864 2344 llfrfxr.exe hbnthh.exe PID 2864 wrote to memory of 2988 2864 hbnthh.exe bttbtb.exe PID 2864 wrote to memory of 2988 2864 hbnthh.exe bttbtb.exe PID 2864 wrote to memory of 2988 2864 hbnthh.exe bttbtb.exe PID 2864 wrote to memory of 2988 2864 hbnthh.exe bttbtb.exe PID 2988 wrote to memory of 2588 2988 bttbtb.exe jvppd.exe PID 2988 wrote to memory of 2588 2988 bttbtb.exe jvppd.exe PID 2988 wrote to memory of 2588 2988 bttbtb.exe jvppd.exe PID 2988 wrote to memory of 2588 2988 bttbtb.exe jvppd.exe PID 2588 wrote to memory of 1184 2588 jvppd.exe 9frxlfl.exe PID 2588 wrote to memory of 1184 2588 jvppd.exe 9frxlfl.exe PID 2588 wrote to memory of 1184 2588 jvppd.exe 9frxlfl.exe PID 2588 wrote to memory of 1184 2588 jvppd.exe 9frxlfl.exe PID 1184 wrote to memory of 1348 1184 9frxlfl.exe fxlfrfl.exe PID 1184 wrote to memory of 1348 1184 9frxlfl.exe fxlfrfl.exe PID 1184 wrote to memory of 1348 1184 9frxlfl.exe fxlfrfl.exe PID 1184 wrote to memory of 1348 1184 9frxlfl.exe fxlfrfl.exe PID 1348 wrote to memory of 1300 1348 fxlfrfl.exe nbnntb.exe PID 1348 wrote to memory of 1300 1348 fxlfrfl.exe nbnntb.exe PID 1348 wrote to memory of 1300 1348 fxlfrfl.exe nbnntb.exe PID 1348 wrote to memory of 1300 1348 fxlfrfl.exe nbnntb.exe PID 1300 wrote to memory of 2820 1300 nbnntb.exe ppdjv.exe PID 1300 wrote to memory of 2820 1300 nbnntb.exe ppdjv.exe PID 1300 wrote to memory of 2820 1300 nbnntb.exe ppdjv.exe PID 1300 wrote to memory of 2820 1300 nbnntb.exe ppdjv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e444a7286f7b6f237208e1ca46dab40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5e444a7286f7b6f237208e1ca46dab40_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\nnbbtb.exec:\nnbbtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\7jpvd.exec:\7jpvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\tnbnbh.exec:\tnbnbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\dvdjp.exec:\dvdjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\9rxxxxx.exec:\9rxxxxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\llxrxlx.exec:\llxrxlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\jvjpv.exec:\jvjpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\ppvvd.exec:\ppvvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\llfrfxr.exec:\llfrfxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\hbnthh.exec:\hbnthh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\bttbtb.exec:\bttbtb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\jvppd.exec:\jvppd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\9frxlfl.exec:\9frxlfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\fxlfrfl.exec:\fxlfrfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\nbnntb.exec:\nbnntb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\ppdjv.exec:\ppdjv.exe17⤵
- Executes dropped EXE
PID:2820 -
\??\c:\5rrxlrl.exec:\5rrxlrl.exe18⤵
- Executes dropped EXE
PID:2228 -
\??\c:\3lxfxfr.exec:\3lxfxfr.exe19⤵
- Executes dropped EXE
PID:2044 -
\??\c:\5nbnhn.exec:\5nbnhn.exe20⤵
- Executes dropped EXE
PID:1984 -
\??\c:\dvjjp.exec:\dvjjp.exe21⤵
- Executes dropped EXE
PID:2016 -
\??\c:\pjdpd.exec:\pjdpd.exe22⤵
- Executes dropped EXE
PID:2476 -
\??\c:\fxrlrxl.exec:\fxrlrxl.exe23⤵
- Executes dropped EXE
PID:668 -
\??\c:\5tnhtt.exec:\5tnhtt.exe24⤵
- Executes dropped EXE
PID:656 -
\??\c:\btttth.exec:\btttth.exe25⤵
- Executes dropped EXE
PID:2348 -
\??\c:\pjvdv.exec:\pjvdv.exe26⤵
- Executes dropped EXE
PID:1512 -
\??\c:\rflrflx.exec:\rflrflx.exe27⤵
- Executes dropped EXE
PID:932 -
\??\c:\tnbnnn.exec:\tnbnnn.exe28⤵
- Executes dropped EXE
PID:348 -
\??\c:\5hhntt.exec:\5hhntt.exe29⤵
- Executes dropped EXE
PID:1632 -
\??\c:\5pjdj.exec:\5pjdj.exe30⤵
- Executes dropped EXE
PID:2204 -
\??\c:\xrfrllr.exec:\xrfrllr.exe31⤵
- Executes dropped EXE
PID:3028 -
\??\c:\lflrxxl.exec:\lflrxxl.exe32⤵
- Executes dropped EXE
PID:3024 -
\??\c:\9htthh.exec:\9htthh.exe33⤵
- Executes dropped EXE
PID:3020 -
\??\c:\7vvdj.exec:\7vvdj.exe34⤵
- Executes dropped EXE
PID:352 -
\??\c:\1jvvp.exec:\1jvvp.exe35⤵
- Executes dropped EXE
PID:2576 -
\??\c:\3flflrx.exec:\3flflrx.exe36⤵
- Executes dropped EXE
PID:2676 -
\??\c:\lxfflll.exec:\lxfflll.exe37⤵
- Executes dropped EXE
PID:1680 -
\??\c:\bnbnnh.exec:\bnbnnh.exe38⤵
- Executes dropped EXE
PID:2192 -
\??\c:\pdjpd.exec:\pdjpd.exe39⤵
- Executes dropped EXE
PID:2712 -
\??\c:\vjddp.exec:\vjddp.exe40⤵
- Executes dropped EXE
PID:2740 -
\??\c:\xfxlfxf.exec:\xfxlfxf.exe41⤵
- Executes dropped EXE
PID:2652 -
\??\c:\1frlrxf.exec:\1frlrxf.exe42⤵
- Executes dropped EXE
PID:3060 -
\??\c:\htbtnt.exec:\htbtnt.exe43⤵
- Executes dropped EXE
PID:2604 -
\??\c:\jdvdj.exec:\jdvdj.exe44⤵
- Executes dropped EXE
PID:2488 -
\??\c:\vpvdv.exec:\vpvdv.exe45⤵
- Executes dropped EXE
PID:2660 -
\??\c:\nhttnn.exec:\nhttnn.exe46⤵
- Executes dropped EXE
PID:2568 -
\??\c:\thhbhn.exec:\thhbhn.exe47⤵
- Executes dropped EXE
PID:2828 -
\??\c:\1jvjv.exec:\1jvjv.exe48⤵
- Executes dropped EXE
PID:2940 -
\??\c:\xxxlxfr.exec:\xxxlxfr.exe49⤵
- Executes dropped EXE
PID:2112 -
\??\c:\rxffrff.exec:\rxffrff.exe50⤵
- Executes dropped EXE
PID:2724 -
\??\c:\bttbbh.exec:\bttbbh.exe51⤵
- Executes dropped EXE
PID:1920 -
\??\c:\ddvvp.exec:\ddvvp.exe52⤵
- Executes dropped EXE
PID:556 -
\??\c:\9vpvj.exec:\9vpvj.exe53⤵
- Executes dropped EXE
PID:1244 -
\??\c:\xllfrll.exec:\xllfrll.exe54⤵
- Executes dropped EXE
PID:292 -
\??\c:\frlrflr.exec:\frlrflr.exe55⤵
- Executes dropped EXE
PID:2824 -
\??\c:\9hbnhh.exec:\9hbnhh.exe56⤵
- Executes dropped EXE
PID:2784 -
\??\c:\5pddp.exec:\5pddp.exe57⤵
- Executes dropped EXE
PID:2228 -
\??\c:\dpdvp.exec:\dpdvp.exe58⤵
- Executes dropped EXE
PID:2004 -
\??\c:\rrlrlfr.exec:\rrlrlfr.exe59⤵
- Executes dropped EXE
PID:1928 -
\??\c:\rllrrfx.exec:\rllrrfx.exe60⤵
- Executes dropped EXE
PID:2064 -
\??\c:\hbhntb.exec:\hbhntb.exe61⤵
- Executes dropped EXE
PID:2856 -
\??\c:\vpdvp.exec:\vpdvp.exe62⤵
- Executes dropped EXE
PID:264 -
\??\c:\1vvdj.exec:\1vvdj.exe63⤵
- Executes dropped EXE
PID:1036 -
\??\c:\lfrflxf.exec:\lfrflxf.exe64⤵
- Executes dropped EXE
PID:580 -
\??\c:\frlfxlr.exec:\frlfxlr.exe65⤵
- Executes dropped EXE
PID:1972 -
\??\c:\tntbnt.exec:\tntbnt.exe66⤵PID:684
-
\??\c:\nbthht.exec:\nbthht.exe67⤵PID:1276
-
\??\c:\vjvdv.exec:\vjvdv.exe68⤵PID:372
-
\??\c:\7frlfrl.exec:\7frlfrl.exe69⤵PID:604
-
\??\c:\rlxfrrr.exec:\rlxfrrr.exe70⤵PID:1536
-
\??\c:\hbnbtb.exec:\hbnbtb.exe71⤵PID:2456
-
\??\c:\bnthtt.exec:\bnthtt.exe72⤵PID:2204
-
\??\c:\3vjvj.exec:\3vjvj.exe73⤵PID:2172
-
\??\c:\5pdjd.exec:\5pdjd.exe74⤵PID:2948
-
\??\c:\rrrffxx.exec:\rrrffxx.exe75⤵PID:2176
-
\??\c:\1nhhnb.exec:\1nhhnb.exe76⤵PID:2424
-
\??\c:\7hbhtb.exec:\7hbhtb.exe77⤵PID:1684
-
\??\c:\pppdd.exec:\pppdd.exe78⤵PID:2464
-
\??\c:\1rfrffr.exec:\1rfrffr.exe79⤵PID:2436
-
\??\c:\rrrxrrf.exec:\rrrxrrf.exe80⤵PID:2700
-
\??\c:\xxrflrf.exec:\xxrflrf.exe81⤵PID:2596
-
\??\c:\5nbbnt.exec:\5nbbnt.exe82⤵PID:2752
-
\??\c:\ddjjv.exec:\ddjjv.exe83⤵PID:2088
-
\??\c:\jdvjv.exec:\jdvjv.exe84⤵PID:3016
-
\??\c:\lfllffr.exec:\lfllffr.exe85⤵PID:2580
-
\??\c:\nnhthh.exec:\nnhthh.exe86⤵PID:2556
-
\??\c:\5thbnt.exec:\5thbnt.exe87⤵PID:3032
-
\??\c:\vvvjj.exec:\vvvjj.exe88⤵PID:3004
-
\??\c:\vpjjp.exec:\vpjjp.exe89⤵PID:2852
-
\??\c:\llrrxrr.exec:\llrrxrr.exe90⤵PID:2984
-
\??\c:\7frxlrf.exec:\7frxlrf.exe91⤵PID:2976
-
\??\c:\hhbnnb.exec:\hhbnnb.exe92⤵PID:1320
-
\??\c:\nnbttb.exec:\nnbttb.exe93⤵PID:1628
-
\??\c:\pjjpd.exec:\pjjpd.exe94⤵PID:1420
-
\??\c:\5vjvp.exec:\5vjvp.exe95⤵PID:2756
-
\??\c:\1xfxxxl.exec:\1xfxxxl.exe96⤵PID:872
-
\??\c:\5fxrfrl.exec:\5fxrfrl.exe97⤵PID:1552
-
\??\c:\tnbhnn.exec:\tnbhnn.exe98⤵PID:1200
-
\??\c:\hbthbb.exec:\hbthbb.exe99⤵PID:2028
-
\??\c:\5vppd.exec:\5vppd.exe100⤵PID:848
-
\??\c:\xxlrxfl.exec:\xxlrxfl.exe101⤵PID:1720
-
\??\c:\fxlrffl.exec:\fxlrffl.exe102⤵PID:2900
-
\??\c:\tnnhbb.exec:\tnnhbb.exe103⤵PID:1936
-
\??\c:\thbhtt.exec:\thbhtt.exe104⤵PID:576
-
\??\c:\jjvdp.exec:\jjvdp.exe105⤵PID:944
-
\??\c:\ddjvd.exec:\ddjvd.exe106⤵PID:1036
-
\??\c:\xrflrxf.exec:\xrflrxf.exe107⤵PID:836
-
\??\c:\1hthnn.exec:\1hthnn.exe108⤵PID:1800
-
\??\c:\thbbnn.exec:\thbbnn.exe109⤵PID:792
-
\??\c:\7vpvj.exec:\7vpvj.exe110⤵PID:1672
-
\??\c:\vjvpd.exec:\vjvpd.exe111⤵PID:632
-
\??\c:\9lfrfxl.exec:\9lfrfxl.exe112⤵PID:1924
-
\??\c:\xxfrlff.exec:\xxfrlff.exe113⤵PID:2304
-
\??\c:\nhhtnb.exec:\nhhtnb.exe114⤵PID:980
-
\??\c:\tnttnn.exec:\tnttnn.exe115⤵PID:1736
-
\??\c:\ddvdv.exec:\ddvdv.exe116⤵PID:2208
-
\??\c:\5ppdj.exec:\5ppdj.exe117⤵PID:2408
-
\??\c:\3rxrlrf.exec:\3rxrlrf.exe118⤵PID:1700
-
\??\c:\1htnhh.exec:\1htnhh.exe119⤵PID:2996
-
\??\c:\9nthtt.exec:\9nthtt.exe120⤵PID:3056
-
\??\c:\ppjpj.exec:\ppjpj.exe121⤵PID:2132
-
\??\c:\xxlrllx.exec:\xxlrllx.exe122⤵PID:2620
-
\??\c:\bthhtt.exec:\bthhtt.exe123⤵PID:2500
-
\??\c:\9btbtb.exec:\9btbtb.exe124⤵PID:2772
-
\??\c:\jdddj.exec:\jdddj.exe125⤵PID:2608
-
\??\c:\dvpdj.exec:\dvpdj.exe126⤵PID:2664
-
\??\c:\9lllxfr.exec:\9lllxfr.exe127⤵PID:1732
-
\??\c:\rfxrxrr.exec:\rfxrxrr.exe128⤵PID:2964
-
\??\c:\hbnttt.exec:\hbnttt.exe129⤵PID:2956
-
\??\c:\hbtthh.exec:\hbtthh.exe130⤵PID:1344
-
\??\c:\pjvvd.exec:\pjvvd.exe131⤵PID:2352
-
\??\c:\vjdjp.exec:\vjdjp.exe132⤵PID:2532
-
\??\c:\xrflxrx.exec:\xrflxrx.exe133⤵PID:2372
-
\??\c:\lllxlrf.exec:\lllxlrf.exe134⤵PID:2724
-
\??\c:\btnbhh.exec:\btnbhh.exe135⤵PID:2256
-
\??\c:\bttnbb.exec:\bttnbb.exe136⤵PID:2768
-
\??\c:\djpvv.exec:\djpvv.exe137⤵PID:1604
-
\??\c:\7pdvv.exec:\7pdvv.exe138⤵PID:2480
-
\??\c:\5xrxffl.exec:\5xrxffl.exe139⤵PID:2824
-
\??\c:\ffrxlrx.exec:\ffrxlrx.exe140⤵PID:344
-
\??\c:\5nhttt.exec:\5nhttt.exe141⤵PID:2100
-
\??\c:\nhttnn.exec:\nhttnn.exe142⤵PID:1932
-
\??\c:\dvjjv.exec:\dvjjv.exe143⤵PID:1928
-
\??\c:\jdppd.exec:\jdppd.exe144⤵PID:2272
-
\??\c:\xxlfffl.exec:\xxlfffl.exe145⤵PID:2900
-
\??\c:\rlxlrxf.exec:\rlxlrxf.exe146⤵PID:264
-
\??\c:\bbnthn.exec:\bbnthn.exe147⤵PID:656
-
\??\c:\pjpvv.exec:\pjpvv.exe148⤵PID:1904
-
\??\c:\vjdpd.exec:\vjdpd.exe149⤵PID:2092
-
\??\c:\fxlrffl.exec:\fxlrffl.exe150⤵PID:1028
-
\??\c:\7lfrxff.exec:\7lfrxff.exe151⤵PID:1804
-
\??\c:\nnhttt.exec:\nnhttt.exe152⤵PID:760
-
\??\c:\nbbhhh.exec:\nbbhhh.exe153⤵PID:2920
-
\??\c:\bbbtht.exec:\bbbtht.exe154⤵PID:1536
-
\??\c:\ddvjp.exec:\ddvjp.exe155⤵PID:2456
-
\??\c:\flxflxf.exec:\flxflxf.exe156⤵PID:2204
-
\??\c:\lffrxxf.exec:\lffrxxf.exe157⤵PID:832
-
\??\c:\tnnbhh.exec:\tnnbhh.exe158⤵PID:2948
-
\??\c:\ttthhn.exec:\ttthhn.exe159⤵PID:2400
-
\??\c:\jjjvj.exec:\jjjvj.exe160⤵PID:1504
-
\??\c:\ddddj.exec:\ddddj.exe161⤵PID:2224
-
\??\c:\rlxrxlx.exec:\rlxrxlx.exe162⤵PID:2600
-
\??\c:\7rlrxxl.exec:\7rlrxxl.exe163⤵PID:2696
-
\??\c:\rlxxlfl.exec:\rlxxlfl.exe164⤵PID:2636
-
\??\c:\hbntbb.exec:\hbntbb.exe165⤵PID:2616
-
\??\c:\vpppv.exec:\vpppv.exe166⤵PID:2520
-
\??\c:\ppjpv.exec:\ppjpv.exe167⤵PID:2880
-
\??\c:\vpvjd.exec:\vpvjd.exe168⤵PID:2496
-
\??\c:\rlxflrx.exec:\rlxflrx.exe169⤵PID:2840
-
\??\c:\3rlxfxf.exec:\3rlxfxf.exe170⤵PID:3064
-
\??\c:\3tnthn.exec:\3tnthn.exe171⤵PID:3032
-
\??\c:\nnhttt.exec:\nnhttt.exe172⤵PID:2836
-
\??\c:\vjdpv.exec:\vjdpv.exe173⤵PID:2852
-
\??\c:\1jvdp.exec:\1jvdp.exe174⤵PID:912
-
\??\c:\xrfrxlr.exec:\xrfrxlr.exe175⤵PID:2988
-
\??\c:\lxrxrrf.exec:\lxrxrrf.exe176⤵PID:1992
-
\??\c:\ttnbnn.exec:\ttnbnn.exe177⤵PID:316
-
\??\c:\9btbhh.exec:\9btbhh.exe178⤵PID:300
-
\??\c:\pjvpd.exec:\pjvpd.exe179⤵PID:2756
-
\??\c:\pjdpd.exec:\pjdpd.exe180⤵PID:1212
-
\??\c:\bbtthn.exec:\bbtthn.exe181⤵PID:1240
-
\??\c:\5bnntt.exec:\5bnntt.exe182⤵PID:1200
-
\??\c:\jdjjv.exec:\jdjjv.exe183⤵PID:1748
-
\??\c:\dpjdj.exec:\dpjdj.exe184⤵PID:2044
-
\??\c:\xlxxffl.exec:\xlxxffl.exe185⤵PID:2096
-
\??\c:\9rrlflx.exec:\9rrlflx.exe186⤵PID:2064
-
\??\c:\9nnthn.exec:\9nnthn.exe187⤵PID:1428
-
\??\c:\httbbh.exec:\httbbh.exe188⤵PID:1468
-
\??\c:\pjppd.exec:\pjppd.exe189⤵PID:1472
-
\??\c:\vppvd.exec:\vppvd.exe190⤵PID:1036
-
\??\c:\xrfxllr.exec:\xrfxllr.exe191⤵PID:2348
-
\??\c:\5flllff.exec:\5flllff.exe192⤵PID:2876
-
\??\c:\3tbtbt.exec:\3tbtbt.exe193⤵PID:856
-
\??\c:\1tbhnh.exec:\1tbhnh.exe194⤵PID:1664
-
\??\c:\dvpdj.exec:\dvpdj.exe195⤵PID:760
-
\??\c:\vpjvv.exec:\vpjvv.exe196⤵PID:2396
-
\??\c:\rrrflrf.exec:\rrrflrf.exe197⤵PID:2304
-
\??\c:\3rlxfff.exec:\3rlxfff.exe198⤵PID:2052
-
\??\c:\5bhthh.exec:\5bhthh.exe199⤵PID:1736
-
\??\c:\dpddj.exec:\dpddj.exe200⤵PID:2212
-
\??\c:\vpdjp.exec:\vpdjp.exe201⤵PID:2408
-
\??\c:\vjjjj.exec:\vjjjj.exe202⤵PID:1572
-
\??\c:\fflrrxl.exec:\fflrrxl.exe203⤵PID:2996
-
\??\c:\9rlxxrl.exec:\9rlxxrl.exe204⤵PID:2436
-
\??\c:\btnttb.exec:\btnttb.exe205⤵PID:2716
-
\??\c:\3nntbb.exec:\3nntbb.exe206⤵PID:2712
-
\??\c:\jdvjj.exec:\jdvjj.exe207⤵PID:2500
-
\??\c:\vjjpv.exec:\vjjpv.exe208⤵PID:1500
-
\??\c:\fxlffff.exec:\fxlffff.exe209⤵PID:2504
-
\??\c:\hbtthb.exec:\hbtthb.exe210⤵PID:2708
-
\??\c:\7nnhnb.exec:\7nnhnb.exe211⤵PID:2960
-
\??\c:\bttbhn.exec:\bttbhn.exe212⤵PID:1944
-
\??\c:\djvjd.exec:\djvjd.exe213⤵PID:2792
-
\??\c:\vjvjp.exec:\vjvjp.exe214⤵PID:2992
-
\??\c:\lfxrrfl.exec:\lfxrrfl.exe215⤵PID:2352
-
\??\c:\btntth.exec:\btntth.exe216⤵PID:2532
-
\??\c:\btbbbb.exec:\btbbbb.exe217⤵PID:2372
-
\??\c:\jdppj.exec:\jdppj.exe218⤵PID:2724
-
\??\c:\jdvjj.exec:\jdvjj.exe219⤵PID:2668
-
\??\c:\lffxfrf.exec:\lffxfrf.exe220⤵PID:2768
-
\??\c:\rxrffrr.exec:\rxrffrr.exe221⤵PID:1604
-
\??\c:\nbnbbb.exec:\nbnbbb.exe222⤵PID:1224
-
\??\c:\ttbbnt.exec:\ttbbnt.exe223⤵PID:1176
-
\??\c:\1vppd.exec:\1vppd.exe224⤵PID:2104
-
\??\c:\3ppdj.exec:\3ppdj.exe225⤵PID:1984
-
\??\c:\lxllrrx.exec:\lxllrrx.exe226⤵PID:2240
-
\??\c:\rfllfrx.exec:\rfllfrx.exe227⤵PID:2476
-
\??\c:\tthhth.exec:\tthhth.exe228⤵PID:2272
-
\??\c:\9hhhbh.exec:\9hhhbh.exe229⤵PID:1888
-
\??\c:\jdjdd.exec:\jdjdd.exe230⤵PID:668
-
\??\c:\ppvdj.exec:\ppvdj.exe231⤵PID:944
-
\??\c:\rlxlrxl.exec:\rlxlrxl.exe232⤵PID:888
-
\??\c:\rlfrxlr.exec:\rlfrxlr.exe233⤵PID:1132
-
\??\c:\9tntnb.exec:\9tntnb.exe234⤵PID:2092
-
\??\c:\hntthb.exec:\hntthb.exe235⤵PID:2876
-
\??\c:\jddvd.exec:\jddvd.exe236⤵PID:1728
-
\??\c:\xllrlxx.exec:\xllrlxx.exe237⤵PID:1632
-
\??\c:\xxrfllx.exec:\xxrfllx.exe238⤵PID:1924
-
\??\c:\3tnnhh.exec:\3tnnhh.exe239⤵PID:3048
-
\??\c:\hhttbt.exec:\hhttbt.exe240⤵PID:980
-
\??\c:\vpddp.exec:\vpddp.exe241⤵PID:896
-
\??\c:\vjppv.exec:\vjppv.exe242⤵PID:2164