Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 05:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
85e6475cd9899438fc683e6de457afc0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
85e6475cd9899438fc683e6de457afc0_NeikiAnalytics.exe
-
Size
965KB
-
MD5
85e6475cd9899438fc683e6de457afc0
-
SHA1
1ff8198f934cc0590cabe0f7ae54df71d6d805a3
-
SHA256
cefc746af8cddddaf957c263871dab613d8d3cfae1f86209029fa94dd4bebbb8
-
SHA512
f5efacaffccbdbec9b3ff5588ff42a5c4a29053908480b3b848049c9223833753bb89666ba7a3c763a41ebb079339cc36e9979f213c99aa53b7b2635a1e0d92e
-
SSDEEP
12288:n3C9ytvngQjy3C9I3YEWpYe+GalTLfOX+I3C9S3C9ytvngQj65syLr9fuWpI:SgdnJVwLgdnJq9fu7
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/2056-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2024-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2072-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1996-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1376-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1748-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2216-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1416-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/584-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2184-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/832-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
htnbbn.exepdvvp.exejjjvp.exerflffff.exebthnbn.exedvpvv.exe7tnntn.exexxflxxx.exebnnbbh.exe7frxrxf.exethhhbt.exeddpvj.exetnthbh.exe9vvjv.exehhnbth.exexxllxfl.exexlflffr.exejdvvj.exejvvdj.exe9hhhnb.exelfxlffx.exe1hnnnt.exe5httth.exe5xllflx.exe7nbhnn.exeddvvp.exepjvdp.exe7tnttn.exelfrrfrf.exe9nbnhn.exejdvdp.exerrlxlfx.exerlrxrlx.exenhnthh.exerlllxfr.exentnhth.exejjjjd.exe3hnhhb.exe7jpdp.exexxxfrfl.exebhnnhb.exedpdjp.exerlflrll.exehbhttt.exe3dppj.exe7xrrffr.exennhhbb.exepjppd.exexrfxfff.exenhtbnn.exepjddj.exeflxrxxf.exetnhbtt.exe7djvv.exerlfffff.exebtnbnb.exejjvvp.exerllfflx.exetnbhbn.exevjpvj.exerlrlrrx.exe9bthtt.exevjvdj.exexrxlflf.exepid process 2024 htnbbn.exe 2072 pdvvp.exe 1996 jjjvp.exe 2760 rflffff.exe 2508 bthnbn.exe 2784 dvpvv.exe 2792 7tnntn.exe 2512 xxflxxx.exe 2932 bnnbbh.exe 1376 7frxrxf.exe 1748 thhhbt.exe 2732 ddpvj.exe 2216 tnthbh.exe 1416 9vvjv.exe 2196 hhnbth.exe 1684 xxllxfl.exe 584 xlflffr.exe 2184 jdvvj.exe 1224 jvvdj.exe 2380 9hhhnb.exe 1976 lfxlffx.exe 2484 1hnnnt.exe 824 5httth.exe 904 5xllflx.exe 2456 7nbhnn.exe 696 ddvvp.exe 1548 pjvdp.exe 372 7tnttn.exe 832 lfrrfrf.exe 756 9nbnhn.exe 2280 jdvdp.exe 580 rrlxlfx.exe 2416 rlrxrlx.exe 492 nhnthh.exe 1580 rlllxfr.exe 2900 ntnhth.exe 3004 jjjjd.exe 2968 3hnhhb.exe 1996 7jpdp.exe 2656 xxxfrfl.exe 2620 bhnnhb.exe 2708 dpdjp.exe 2668 rlflrll.exe 2504 hbhttt.exe 2568 3dppj.exe 2516 7xrrffr.exe 1808 nnhhbb.exe 1392 pjppd.exe 2572 xrfxfff.exe 2736 nhtbnn.exe 2732 pjddj.exe 1932 flxrxxf.exe 1944 tnhbtt.exe 1588 7djvv.exe 2196 rlfffff.exe 1684 btnbnb.exe 656 jjvvp.exe 1304 rllfflx.exe 2092 tnbhbn.exe 2268 vjpvj.exe 2276 rlrlrrx.exe 1976 9bthtt.exe 548 vjvdj.exe 2716 xrxlflf.exe -
Processes:
resource yara_rule behavioral1/memory/2056-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1996-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1376-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1748-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1416-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/584-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/832-280-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
85e6475cd9899438fc683e6de457afc0_NeikiAnalytics.exehtnbbn.exepdvvp.exejjjvp.exerflffff.exebthnbn.exedvpvv.exe7tnntn.exexxflxxx.exebnnbbh.exe7frxrxf.exethhhbt.exeddpvj.exetnthbh.exe9vvjv.exehhnbth.exedescription pid process target process PID 2056 wrote to memory of 2024 2056 85e6475cd9899438fc683e6de457afc0_NeikiAnalytics.exe htnbbn.exe PID 2056 wrote to memory of 2024 2056 85e6475cd9899438fc683e6de457afc0_NeikiAnalytics.exe htnbbn.exe PID 2056 wrote to memory of 2024 2056 85e6475cd9899438fc683e6de457afc0_NeikiAnalytics.exe htnbbn.exe PID 2056 wrote to memory of 2024 2056 85e6475cd9899438fc683e6de457afc0_NeikiAnalytics.exe htnbbn.exe PID 2024 wrote to memory of 2072 2024 htnbbn.exe pdvvp.exe PID 2024 wrote to memory of 2072 2024 htnbbn.exe pdvvp.exe PID 2024 wrote to memory of 2072 2024 htnbbn.exe pdvvp.exe PID 2024 wrote to memory of 2072 2024 htnbbn.exe pdvvp.exe PID 2072 wrote to memory of 1996 2072 pdvvp.exe jjjvp.exe PID 2072 wrote to memory of 1996 2072 pdvvp.exe jjjvp.exe PID 2072 wrote to memory of 1996 2072 pdvvp.exe jjjvp.exe PID 2072 wrote to memory of 1996 2072 pdvvp.exe jjjvp.exe PID 1996 wrote to memory of 2760 1996 jjjvp.exe rflffff.exe PID 1996 wrote to memory of 2760 1996 jjjvp.exe rflffff.exe PID 1996 wrote to memory of 2760 1996 jjjvp.exe rflffff.exe PID 1996 wrote to memory of 2760 1996 jjjvp.exe rflffff.exe PID 2760 wrote to memory of 2508 2760 rflffff.exe bthnbn.exe PID 2760 wrote to memory of 2508 2760 rflffff.exe bthnbn.exe PID 2760 wrote to memory of 2508 2760 rflffff.exe bthnbn.exe PID 2760 wrote to memory of 2508 2760 rflffff.exe bthnbn.exe PID 2508 wrote to memory of 2784 2508 bthnbn.exe dvpvv.exe PID 2508 wrote to memory of 2784 2508 bthnbn.exe dvpvv.exe PID 2508 wrote to memory of 2784 2508 bthnbn.exe dvpvv.exe PID 2508 wrote to memory of 2784 2508 bthnbn.exe dvpvv.exe PID 2784 wrote to memory of 2792 2784 dvpvv.exe 7tnntn.exe PID 2784 wrote to memory of 2792 2784 dvpvv.exe 7tnntn.exe PID 2784 wrote to memory of 2792 2784 dvpvv.exe 7tnntn.exe PID 2784 wrote to memory of 2792 2784 dvpvv.exe 7tnntn.exe PID 2792 wrote to memory of 2512 2792 7tnntn.exe xxflxxx.exe PID 2792 wrote to memory of 2512 2792 7tnntn.exe xxflxxx.exe PID 2792 wrote to memory of 2512 2792 7tnntn.exe xxflxxx.exe PID 2792 wrote to memory of 2512 2792 7tnntn.exe xxflxxx.exe PID 2512 wrote to memory of 2932 2512 xxflxxx.exe bnnbbh.exe PID 2512 wrote to memory of 2932 2512 xxflxxx.exe bnnbbh.exe PID 2512 wrote to memory of 2932 2512 xxflxxx.exe bnnbbh.exe PID 2512 wrote to memory of 2932 2512 xxflxxx.exe bnnbbh.exe PID 2932 wrote to memory of 1376 2932 bnnbbh.exe 7frxrxf.exe PID 2932 wrote to memory of 1376 2932 bnnbbh.exe 7frxrxf.exe PID 2932 wrote to memory of 1376 2932 bnnbbh.exe 7frxrxf.exe PID 2932 wrote to memory of 1376 2932 bnnbbh.exe 7frxrxf.exe PID 1376 wrote to memory of 1748 1376 7frxrxf.exe thhhbt.exe PID 1376 wrote to memory of 1748 1376 7frxrxf.exe thhhbt.exe PID 1376 wrote to memory of 1748 1376 7frxrxf.exe thhhbt.exe PID 1376 wrote to memory of 1748 1376 7frxrxf.exe thhhbt.exe PID 1748 wrote to memory of 2732 1748 thhhbt.exe ddpvj.exe PID 1748 wrote to memory of 2732 1748 thhhbt.exe ddpvj.exe PID 1748 wrote to memory of 2732 1748 thhhbt.exe ddpvj.exe PID 1748 wrote to memory of 2732 1748 thhhbt.exe ddpvj.exe PID 2732 wrote to memory of 2216 2732 ddpvj.exe tnthbh.exe PID 2732 wrote to memory of 2216 2732 ddpvj.exe tnthbh.exe PID 2732 wrote to memory of 2216 2732 ddpvj.exe tnthbh.exe PID 2732 wrote to memory of 2216 2732 ddpvj.exe tnthbh.exe PID 2216 wrote to memory of 1416 2216 tnthbh.exe 9vvjv.exe PID 2216 wrote to memory of 1416 2216 tnthbh.exe 9vvjv.exe PID 2216 wrote to memory of 1416 2216 tnthbh.exe 9vvjv.exe PID 2216 wrote to memory of 1416 2216 tnthbh.exe 9vvjv.exe PID 1416 wrote to memory of 2196 1416 9vvjv.exe hhnbth.exe PID 1416 wrote to memory of 2196 1416 9vvjv.exe hhnbth.exe PID 1416 wrote to memory of 2196 1416 9vvjv.exe hhnbth.exe PID 1416 wrote to memory of 2196 1416 9vvjv.exe hhnbth.exe PID 2196 wrote to memory of 1684 2196 hhnbth.exe xxllxfl.exe PID 2196 wrote to memory of 1684 2196 hhnbth.exe xxllxfl.exe PID 2196 wrote to memory of 1684 2196 hhnbth.exe xxllxfl.exe PID 2196 wrote to memory of 1684 2196 hhnbth.exe xxllxfl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\85e6475cd9899438fc683e6de457afc0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\85e6475cd9899438fc683e6de457afc0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\htnbbn.exec:\htnbbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\pdvvp.exec:\pdvvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\jjjvp.exec:\jjjvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\rflffff.exec:\rflffff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\bthnbn.exec:\bthnbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\dvpvv.exec:\dvpvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\7tnntn.exec:\7tnntn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\xxflxxx.exec:\xxflxxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\bnnbbh.exec:\bnnbbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\7frxrxf.exec:\7frxrxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\thhhbt.exec:\thhhbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\ddpvj.exec:\ddpvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\tnthbh.exec:\tnthbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\9vvjv.exec:\9vvjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\hhnbth.exec:\hhnbth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\xxllxfl.exec:\xxllxfl.exe17⤵
- Executes dropped EXE
PID:1684 -
\??\c:\xlflffr.exec:\xlflffr.exe18⤵
- Executes dropped EXE
PID:584 -
\??\c:\jdvvj.exec:\jdvvj.exe19⤵
- Executes dropped EXE
PID:2184 -
\??\c:\jvvdj.exec:\jvvdj.exe20⤵
- Executes dropped EXE
PID:1224 -
\??\c:\9hhhnb.exec:\9hhhnb.exe21⤵
- Executes dropped EXE
PID:2380 -
\??\c:\lfxlffx.exec:\lfxlffx.exe22⤵
- Executes dropped EXE
PID:1976 -
\??\c:\1hnnnt.exec:\1hnnnt.exe23⤵
- Executes dropped EXE
PID:2484 -
\??\c:\5httth.exec:\5httth.exe24⤵
- Executes dropped EXE
PID:824 -
\??\c:\5xllflx.exec:\5xllflx.exe25⤵
- Executes dropped EXE
PID:904 -
\??\c:\7nbhnn.exec:\7nbhnn.exe26⤵
- Executes dropped EXE
PID:2456 -
\??\c:\ddvvp.exec:\ddvvp.exe27⤵
- Executes dropped EXE
PID:696 -
\??\c:\pjvdp.exec:\pjvdp.exe28⤵
- Executes dropped EXE
PID:1548 -
\??\c:\7tnttn.exec:\7tnttn.exe29⤵
- Executes dropped EXE
PID:372 -
\??\c:\lfrrfrf.exec:\lfrrfrf.exe30⤵
- Executes dropped EXE
PID:832 -
\??\c:\9nbnhn.exec:\9nbnhn.exe31⤵
- Executes dropped EXE
PID:756 -
\??\c:\jdvdp.exec:\jdvdp.exe32⤵
- Executes dropped EXE
PID:2280 -
\??\c:\rrlxlfx.exec:\rrlxlfx.exe33⤵
- Executes dropped EXE
PID:580 -
\??\c:\rlrxrlx.exec:\rlrxrlx.exe34⤵
- Executes dropped EXE
PID:2416 -
\??\c:\nhnthh.exec:\nhnthh.exe35⤵
- Executes dropped EXE
PID:492 -
\??\c:\vpjpd.exec:\vpjpd.exe36⤵PID:1968
-
\??\c:\rlllxfr.exec:\rlllxfr.exe37⤵
- Executes dropped EXE
PID:1580 -
\??\c:\ntnhth.exec:\ntnhth.exe38⤵
- Executes dropped EXE
PID:2900 -
\??\c:\jjjjd.exec:\jjjjd.exe39⤵
- Executes dropped EXE
PID:3004 -
\??\c:\3hnhhb.exec:\3hnhhb.exe40⤵
- Executes dropped EXE
PID:2968 -
\??\c:\7jpdp.exec:\7jpdp.exe41⤵
- Executes dropped EXE
PID:1996 -
\??\c:\xxxfrfl.exec:\xxxfrfl.exe42⤵
- Executes dropped EXE
PID:2656 -
\??\c:\bhnnhb.exec:\bhnnhb.exe43⤵
- Executes dropped EXE
PID:2620 -
\??\c:\dpdjp.exec:\dpdjp.exe44⤵
- Executes dropped EXE
PID:2708 -
\??\c:\rlflrll.exec:\rlflrll.exe45⤵
- Executes dropped EXE
PID:2668 -
\??\c:\hbhttt.exec:\hbhttt.exe46⤵
- Executes dropped EXE
PID:2504 -
\??\c:\3dppj.exec:\3dppj.exe47⤵
- Executes dropped EXE
PID:2568 -
\??\c:\7xrrffr.exec:\7xrrffr.exe48⤵
- Executes dropped EXE
PID:2516 -
\??\c:\nnhhbb.exec:\nnhhbb.exe49⤵
- Executes dropped EXE
PID:1808 -
\??\c:\pjppd.exec:\pjppd.exe50⤵
- Executes dropped EXE
PID:1392 -
\??\c:\xrfxfff.exec:\xrfxfff.exe51⤵
- Executes dropped EXE
PID:2572 -
\??\c:\nhtbnn.exec:\nhtbnn.exe52⤵
- Executes dropped EXE
PID:2736 -
\??\c:\pjddj.exec:\pjddj.exe53⤵
- Executes dropped EXE
PID:2732 -
\??\c:\flxrxxf.exec:\flxrxxf.exe54⤵
- Executes dropped EXE
PID:1932 -
\??\c:\tnhbtt.exec:\tnhbtt.exe55⤵
- Executes dropped EXE
PID:1944 -
\??\c:\7djvv.exec:\7djvv.exe56⤵
- Executes dropped EXE
PID:1588 -
\??\c:\rlfffff.exec:\rlfffff.exe57⤵
- Executes dropped EXE
PID:2196 -
\??\c:\btnbnb.exec:\btnbnb.exe58⤵
- Executes dropped EXE
PID:1684 -
\??\c:\jjvvp.exec:\jjvvp.exe59⤵
- Executes dropped EXE
PID:656 -
\??\c:\rllfflx.exec:\rllfflx.exe60⤵
- Executes dropped EXE
PID:1304 -
\??\c:\tnbhbn.exec:\tnbhbn.exe61⤵
- Executes dropped EXE
PID:2092 -
\??\c:\vjpvj.exec:\vjpvj.exe62⤵
- Executes dropped EXE
PID:2268 -
\??\c:\rlrlrrx.exec:\rlrlrrx.exe63⤵
- Executes dropped EXE
PID:2276 -
\??\c:\9bthtt.exec:\9bthtt.exe64⤵
- Executes dropped EXE
PID:1976 -
\??\c:\vjvdj.exec:\vjvdj.exe65⤵
- Executes dropped EXE
PID:548 -
\??\c:\xrxlflf.exec:\xrxlflf.exe66⤵
- Executes dropped EXE
PID:2716 -
\??\c:\ttnhht.exec:\ttnhht.exe67⤵PID:444
-
\??\c:\7dppd.exec:\7dppd.exe68⤵PID:3016
-
\??\c:\1xrxflx.exec:\1xrxflx.exe69⤵PID:2460
-
\??\c:\3hbbtb.exec:\3hbbtb.exe70⤵PID:944
-
\??\c:\pvvvp.exec:\pvvvp.exe71⤵PID:2984
-
\??\c:\lfffrrf.exec:\lfffrrf.exe72⤵PID:816
-
\??\c:\vppvp.exec:\vppvp.exe73⤵PID:2008
-
\??\c:\thbnhn.exec:\thbnhn.exe74⤵PID:2996
-
\??\c:\vvjdv.exec:\vvjdv.exe75⤵PID:1876
-
\??\c:\fxrlxfl.exec:\fxrlxfl.exe76⤵PID:2280
-
\??\c:\tthnht.exec:\tthnht.exe77⤵PID:1952
-
\??\c:\xxrrlxf.exec:\xxrrlxf.exe78⤵PID:2220
-
\??\c:\1btnbn.exec:\1btnbn.exe79⤵PID:1744
-
\??\c:\jdvvv.exec:\jdvvv.exe80⤵PID:1968
-
\??\c:\rrxxlrl.exec:\rrxxlrl.exe81⤵PID:2896
-
\??\c:\bhbthb.exec:\bhbthb.exe82⤵PID:2960
-
\??\c:\7dpvd.exec:\7dpvd.exe83⤵PID:2684
-
\??\c:\rllrllf.exec:\rllrllf.exe84⤵PID:2968
-
\??\c:\rrrfxrl.exec:\rrrfxrl.exe85⤵PID:2632
-
\??\c:\ppdjp.exec:\ppdjp.exe86⤵PID:2796
-
\??\c:\fxrxflf.exec:\fxrxflf.exe87⤵PID:2804
-
\??\c:\5nbtnb.exec:\5nbtnb.exe88⤵PID:2708
-
\??\c:\ppjjv.exec:\ppjjv.exe89⤵PID:2696
-
\??\c:\5xlxfrl.exec:\5xlxfrl.exe90⤵PID:2500
-
\??\c:\xrrxrxr.exec:\xrrxrxr.exe91⤵PID:2624
-
\??\c:\jjjvj.exec:\jjjvj.exe92⤵PID:2516
-
\??\c:\9lflfxf.exec:\9lflfxf.exe93⤵PID:620
-
\??\c:\hthhnt.exec:\hthhnt.exe94⤵PID:1392
-
\??\c:\7vjpp.exec:\7vjpp.exe95⤵PID:2572
-
\??\c:\xrfllfl.exec:\xrfllfl.exe96⤵PID:344
-
\??\c:\tnhbnn.exec:\tnhbnn.exe97⤵PID:2732
-
\??\c:\3pppp.exec:\3pppp.exe98⤵PID:1924
-
\??\c:\frfflfr.exec:\frfflfr.exe99⤵PID:1944
-
\??\c:\7ntnhh.exec:\7ntnhh.exe100⤵PID:1588
-
\??\c:\vdvjd.exec:\vdvjd.exe101⤵PID:2196
-
\??\c:\1lfxfrf.exec:\1lfxfrf.exe102⤵PID:2540
-
\??\c:\htttbt.exec:\htttbt.exe103⤵PID:1280
-
\??\c:\pddpj.exec:\pddpj.exe104⤵PID:1224
-
\??\c:\nnthbh.exec:\nnthbh.exe105⤵PID:2324
-
\??\c:\pdjvv.exec:\pdjvv.exe106⤵PID:2824
-
\??\c:\xfrllxl.exec:\xfrllxl.exe107⤵PID:1960
-
\??\c:\tbbtnb.exec:\tbbtnb.exe108⤵PID:2484
-
\??\c:\7vjjj.exec:\7vjjj.exe109⤵PID:912
-
\??\c:\9xflrxl.exec:\9xflrxl.exe110⤵PID:1920
-
\??\c:\thtntn.exec:\thtntn.exe111⤵PID:1464
-
\??\c:\dvjvd.exec:\dvjvd.exe112⤵PID:1804
-
\??\c:\llflflr.exec:\llflflr.exe113⤵PID:2460
-
\??\c:\9bhhbt.exec:\9bhhbt.exe114⤵PID:828
-
\??\c:\dvddv.exec:\dvddv.exe115⤵PID:940
-
\??\c:\rrflfrf.exec:\rrflfrf.exe116⤵PID:856
-
\??\c:\hhbthn.exec:\hhbthn.exe117⤵PID:1780
-
\??\c:\llflfrr.exec:\llflfrr.exe118⤵PID:2476
-
\??\c:\hbbnnn.exec:\hbbnnn.exe119⤵PID:2040
-
\??\c:\pjjvd.exec:\pjjvd.exe120⤵PID:1508
-
\??\c:\lrlrfrf.exec:\lrlrfrf.exe121⤵PID:2816
-
\??\c:\tbthhb.exec:\tbthhb.exe122⤵PID:1756
-
\??\c:\jdvjp.exec:\jdvjp.exe123⤵PID:1712
-
\??\c:\llrlxxx.exec:\llrlxxx.exe124⤵PID:2904
-
\??\c:\tnnbnh.exec:\tnnbnh.exe125⤵PID:2840
-
\??\c:\dvpvd.exec:\dvpvd.exe126⤵PID:3068
-
\??\c:\xrrlrrl.exec:\xrrlrrl.exe127⤵PID:2852
-
\??\c:\nnntth.exec:\nnntth.exe128⤵PID:2860
-
\??\c:\llflffr.exec:\llflffr.exe129⤵PID:2764
-
\??\c:\tttbth.exec:\tttbth.exe130⤵PID:1152
-
\??\c:\ppjjd.exec:\ppjjd.exe131⤵PID:2664
-
\??\c:\lflrxfx.exec:\lflrxfx.exe132⤵PID:2672
-
\??\c:\ffxxlrx.exec:\ffxxlrx.exe133⤵PID:2576
-
\??\c:\hnhtth.exec:\hnhtth.exe134⤵PID:2580
-
\??\c:\jpdpp.exec:\jpdpp.exe135⤵PID:2948
-
\??\c:\3rflfll.exec:\3rflfll.exe136⤵PID:1524
-
\??\c:\hbhnbt.exec:\hbhnbt.exe137⤵PID:848
-
\??\c:\jdpdp.exec:\jdpdp.exe138⤵PID:1748
-
\??\c:\rffffrx.exec:\rffffrx.exe139⤵PID:1868
-
\??\c:\nttbtn.exec:\nttbtn.exe140⤵PID:1652
-
\??\c:\jjpvj.exec:\jjpvj.exe141⤵PID:1896
-
\??\c:\ffxxlrf.exec:\ffxxlrf.exe142⤵PID:684
-
\??\c:\bbthtn.exec:\bbthtn.exe143⤵PID:2392
-
\??\c:\7jjvv.exec:\7jjvv.exe144⤵PID:1488
-
\??\c:\rrrxrrf.exec:\rrrxrrf.exe145⤵PID:1320
-
\??\c:\hhbnbh.exec:\hhbnbh.exe146⤵PID:860
-
\??\c:\5vjdv.exec:\5vjdv.exe147⤵PID:2272
-
\??\c:\xxrrfrf.exec:\xxrrfrf.exe148⤵PID:3040
-
\??\c:\tnthnn.exec:\tnthnn.exe149⤵PID:1992
-
\??\c:\vjdvj.exec:\vjdvj.exe150⤵PID:2600
-
\??\c:\btnhnb.exec:\btnhnb.exe151⤵PID:2692
-
\??\c:\pjddp.exec:\pjddp.exe152⤵PID:1692
-
\??\c:\ffxfrxl.exec:\ffxfrxl.exe153⤵PID:824
-
\??\c:\bttnbn.exec:\bttnbn.exe154⤵PID:1128
-
\??\c:\ppppj.exec:\ppppj.exe155⤵PID:2928
-
\??\c:\1rlffrf.exec:\1rlffrf.exe156⤵PID:1556
-
\??\c:\hhnbth.exec:\hhnbth.exe157⤵PID:292
-
\??\c:\pddpd.exec:\pddpd.exe158⤵PID:768
-
\??\c:\xrffllr.exec:\xrffllr.exe159⤵PID:2356
-
\??\c:\btbtht.exec:\btbtht.exe160⤵PID:1964
-
\??\c:\jvjpv.exec:\jvjpv.exe161⤵PID:1592
-
\??\c:\1xrxrxl.exec:\1xrxrxl.exe162⤵PID:756
-
\??\c:\1tthtb.exec:\1tthtb.exe163⤵PID:2080
-
\??\c:\jjvdv.exec:\jjvdv.exe164⤵PID:2404
-
\??\c:\3rllxfl.exec:\3rllxfl.exe165⤵PID:2812
-
\??\c:\thbtnt.exec:\thbtnt.exe166⤵PID:2060
-
\??\c:\3pjjd.exec:\3pjjd.exe167⤵PID:852
-
\??\c:\llrrlxr.exec:\llrrlxr.exe168⤵PID:2972
-
\??\c:\bbtnhb.exec:\bbtnhb.exe169⤵PID:2320
-
\??\c:\ppdvd.exec:\ppdvd.exe170⤵PID:2608
-
\??\c:\lfxfxll.exec:\lfxfxll.exe171⤵PID:2072
-
\??\c:\thbhbb.exec:\thbhbb.exe172⤵PID:2628
-
\??\c:\ppdjp.exec:\ppdjp.exe173⤵PID:2388
-
\??\c:\lxflrxf.exec:\lxflrxf.exe174⤵PID:2976
-
\??\c:\tttbnb.exec:\tttbnb.exe175⤵PID:2784
-
\??\c:\dvjjv.exec:\dvjjv.exe176⤵PID:2564
-
\??\c:\rlflxxf.exec:\rlflxxf.exe177⤵PID:2676
-
\??\c:\btthbh.exec:\btthbh.exe178⤵PID:2552
-
\??\c:\pjppj.exec:\pjppj.exe179⤵PID:1752
-
\??\c:\xrrrrxl.exec:\xrrrrxl.exe180⤵PID:1248
-
\??\c:\hbtbnn.exec:\hbtbnn.exe181⤵PID:2688
-
\??\c:\jjjvp.exec:\jjjvp.exe182⤵PID:1392
-
\??\c:\7thtbh.exec:\7thtbh.exe183⤵PID:1196
-
\??\c:\dvppj.exec:\dvppj.exe184⤵PID:2856
-
\??\c:\1rrffxr.exec:\1rrffxr.exe185⤵PID:1652
-
\??\c:\btnthn.exec:\btnthn.exe186⤵PID:1564
-
\??\c:\ddvdp.exec:\ddvdp.exe187⤵PID:684
-
\??\c:\9fflfrf.exec:\9fflfrf.exe188⤵PID:2152
-
\??\c:\tnbbnb.exec:\tnbbnb.exe189⤵PID:1356
-
\??\c:\vvddj.exec:\vvddj.exe190⤵PID:656
-
\??\c:\ffxxlll.exec:\ffxxlll.exe191⤵PID:1232
-
\??\c:\hnbhbb.exec:\hnbhbb.exe192⤵PID:2000
-
\??\c:\pppdp.exec:\pppdp.exe193⤵PID:2864
-
\??\c:\xrlfxlr.exec:\xrlfxlr.exe194⤵PID:2824
-
\??\c:\btbtnb.exec:\btbtnb.exe195⤵PID:1636
-
\??\c:\vpjjp.exec:\vpjjp.exe196⤵PID:2340
-
\??\c:\xlflxxl.exec:\xlflxxl.exe197⤵PID:2212
-
\??\c:\7htbbh.exec:\7htbbh.exe198⤵PID:444
-
\??\c:\jddjv.exec:\jddjv.exe199⤵PID:1464
-
\??\c:\xxxxlrl.exec:\xxxxlrl.exe200⤵PID:1688
-
\??\c:\hbbnbn.exec:\hbbnbn.exe201⤵PID:2408
-
\??\c:\vppjv.exec:\vppjv.exe202⤵PID:828
-
\??\c:\llllxxr.exec:\llllxxr.exe203⤵PID:1368
-
\??\c:\hhtbbn.exec:\hhtbbn.exe204⤵PID:832
-
\??\c:\pjvdp.exec:\pjvdp.exe205⤵PID:2084
-
\??\c:\1fflxlf.exec:\1fflxlf.exe206⤵PID:2100
-
\??\c:\bthbth.exec:\bthbth.exe207⤵PID:2176
-
\??\c:\vvvpj.exec:\vvvpj.exe208⤵PID:2424
-
\??\c:\xlflxlx.exec:\xlflxlx.exe209⤵PID:1704
-
\??\c:\hhbhth.exec:\hhbhth.exe210⤵PID:1456
-
\??\c:\vpvpd.exec:\vpvpd.exe211⤵PID:2964
-
\??\c:\xlxflrl.exec:\xlxflrl.exe212⤵PID:2924
-
\??\c:\hbthbh.exec:\hbthbh.exe213⤵PID:2896
-
\??\c:\dddpd.exec:\dddpd.exe214⤵PID:2740
-
\??\c:\1flrxrr.exec:\1flrxrr.exe215⤵PID:2800
-
\??\c:\tnbhth.exec:\tnbhth.exe216⤵PID:2744
-
\??\c:\7dpdv.exec:\7dpdv.exe217⤵PID:2632
-
\??\c:\xxxxrrf.exec:\xxxxrrf.exe218⤵PID:2436
-
\??\c:\htntnt.exec:\htntnt.exe219⤵PID:2616
-
\??\c:\jdjdd.exec:\jdjdd.exe220⤵PID:2544
-
\??\c:\1btbhh.exec:\1btbhh.exe221⤵PID:2180
-
\??\c:\bttnbh.exec:\bttnbh.exe222⤵PID:2504
-
\??\c:\jdjdv.exec:\jdjdv.exe223⤵PID:2052
-
\??\c:\lxrxfll.exec:\lxrxfll.exe224⤵PID:1504
-
\??\c:\1tbhnb.exec:\1tbhnb.exe225⤵PID:2728
-
\??\c:\9pdjp.exec:\9pdjp.exe226⤵PID:1748
-
\??\c:\5fxxlfr.exec:\5fxxlfr.exe227⤵PID:2572
-
\??\c:\bnntnb.exec:\bnntnb.exe228⤵PID:1628
-
\??\c:\7dpjp.exec:\7dpjp.exe229⤵PID:1532
-
\??\c:\xrfxrfx.exec:\xrfxrfx.exe230⤵PID:532
-
\??\c:\pdvpv.exec:\pdvpv.exe231⤵PID:1484
-
\??\c:\ffxflxl.exec:\ffxflxl.exe232⤵PID:628
-
\??\c:\3nhbnh.exec:\3nhbnh.exe233⤵PID:2344
-
\??\c:\jdjdj.exec:\jdjdj.exe234⤵PID:1760
-
\??\c:\llrrxfx.exec:\llrrxfx.exe235⤵PID:2288
-
\??\c:\bnbnnh.exec:\bnbnnh.exe236⤵PID:2268
-
\??\c:\3jvdj.exec:\3jvdj.exe237⤵PID:2880
-
\??\c:\fxrxxfx.exec:\fxrxxfx.exe238⤵PID:2600
-
\??\c:\bttnth.exec:\bttnth.exe239⤵PID:784
-
\??\c:\ddppv.exec:\ddppv.exe240⤵PID:1800
-
\??\c:\rlfrflx.exec:\rlfrflx.exe241⤵PID:3044
-
\??\c:\tnttnt.exec:\tnttnt.exe242⤵PID:404