Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 06:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
93cf62c1ae7f3060b75b0638c8c9f810_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
93cf62c1ae7f3060b75b0638c8c9f810_NeikiAnalytics.exe
-
Size
54KB
-
MD5
93cf62c1ae7f3060b75b0638c8c9f810
-
SHA1
fea26c173bfd9f0d6b40b0bd3bb80fceca8e9216
-
SHA256
2d7dc3bbea6200b0f18dda11e8a39dc090c7efdd785d3261cd55147917c8e9ca
-
SHA512
9bf1080eab50230e0aebd6e728f75f01ad919dbf70008622ff55453d8ff3564ec5b54efed008da4c131065e3164b6a300e4bf92f2e7f52e757e8a0c382dcd656
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFE:ymb3NkkiQ3mdBjFIFE
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/1332-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/340-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2184-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2396-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1940-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/264-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1608-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/832-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/776-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/848-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
tntbhn.exejdpvp.exefxlrxlx.exe3nhhnn.exejjvjp.exe7xrxlll.exerrlxflx.exebththh.exevvpdp.exepjvjj.exeffrlflx.exetntnth.exebhhntn.exevpppj.exelxxxxxl.exexrxllrr.exenhbhbh.exe3nbhnt.exevpjvp.exepjpvj.exexflxflr.exe7llrffx.exehhbnhb.exetntbhh.exedvpvd.exerllrffr.exenhnthn.exettnttt.exepjdpj.exefrfflrx.exelfxrfrx.exenhbhht.exe9vjpj.exeddvvv.exedvjpv.exelfflflx.exetnhhnn.exettnthn.exepjvjv.exepjdpj.exe1fxlfrf.exe5rfflrx.exebbthtb.exenhtbnn.exevpvpd.exevvdjp.exe3rlxrff.exelffxfff.exenhhhnn.exehhntbh.exeppvvv.exevvdjp.exe5rlfllx.exelfrfrxl.exe3tntbn.exe5btbbb.exe7pddj.exe1pjvd.exexrlrffl.exebnbntb.exenbnhnn.exe7jvjv.exevpddd.exe3xfxxrr.exepid process 1332 tntbhn.exe 2948 jdpvp.exe 340 fxlrxlx.exe 2748 3nhhnn.exe 2832 jjvjp.exe 2536 7xrxlll.exe 2184 rrlxflx.exe 2584 bththh.exe 2332 vvpdp.exe 2396 pjvjj.exe 1940 ffrlflx.exe 2804 tntnth.exe 2416 bhhntn.exe 2008 vpppj.exe 1592 lxxxxxl.exe 2552 xrxllrr.exe 1616 nhbhbh.exe 1036 3nbhnt.exe 2276 vpjvp.exe 2388 pjpvj.exe 2860 xflxflr.exe 264 7llrffx.exe 1608 hhbnhb.exe 1852 tntbhh.exe 2468 dvpvd.exe 832 rllrffr.exe 2956 nhnthn.exe 776 ttnttt.exe 2120 pjdpj.exe 1708 frfflrx.exe 848 lfxrfrx.exe 2940 nhbhht.exe 316 9vjpj.exe 2976 ddvvv.exe 3036 dvjpv.exe 2716 lfflflx.exe 340 tnhhnn.exe 2344 ttnthn.exe 2780 pjvjv.exe 2832 pjdpj.exe 2536 1fxlfrf.exe 2576 5rfflrx.exe 1696 bbthtb.exe 2220 nhtbnn.exe 1968 vpvpd.exe 1948 vvdjp.exe 2580 3rlxrff.exe 2000 lffxfff.exe 1976 nhhhnn.exe 2188 hhntbh.exe 1816 ppvvv.exe 1468 vvdjp.exe 1788 5rlfllx.exe 1580 lfrfrxl.exe 684 3tntbn.exe 304 5btbbb.exe 2496 7pddj.exe 2372 1pjvd.exe 2308 xrlrffl.exe 588 bnbntb.exe 264 nbnhnn.exe 1608 7jvjv.exe 1132 vpddd.exe 2340 3xfxxrr.exe -
Processes:
resource yara_rule behavioral1/memory/1332-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/340-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1940-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/264-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1608-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/832-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/776-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/848-303-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
93cf62c1ae7f3060b75b0638c8c9f810_NeikiAnalytics.exetntbhn.exejdpvp.exefxlrxlx.exe3nhhnn.exejjvjp.exe7xrxlll.exerrlxflx.exebththh.exevvpdp.exepjvjj.exeffrlflx.exetntnth.exebhhntn.exevpppj.exelxxxxxl.exedescription pid process target process PID 2900 wrote to memory of 1332 2900 93cf62c1ae7f3060b75b0638c8c9f810_NeikiAnalytics.exe tntbhn.exe PID 2900 wrote to memory of 1332 2900 93cf62c1ae7f3060b75b0638c8c9f810_NeikiAnalytics.exe tntbhn.exe PID 2900 wrote to memory of 1332 2900 93cf62c1ae7f3060b75b0638c8c9f810_NeikiAnalytics.exe tntbhn.exe PID 2900 wrote to memory of 1332 2900 93cf62c1ae7f3060b75b0638c8c9f810_NeikiAnalytics.exe tntbhn.exe PID 1332 wrote to memory of 2948 1332 tntbhn.exe jdpvp.exe PID 1332 wrote to memory of 2948 1332 tntbhn.exe jdpvp.exe PID 1332 wrote to memory of 2948 1332 tntbhn.exe jdpvp.exe PID 1332 wrote to memory of 2948 1332 tntbhn.exe jdpvp.exe PID 2948 wrote to memory of 340 2948 jdpvp.exe fxlrxlx.exe PID 2948 wrote to memory of 340 2948 jdpvp.exe fxlrxlx.exe PID 2948 wrote to memory of 340 2948 jdpvp.exe fxlrxlx.exe PID 2948 wrote to memory of 340 2948 jdpvp.exe fxlrxlx.exe PID 340 wrote to memory of 2748 340 fxlrxlx.exe 3nhhnn.exe PID 340 wrote to memory of 2748 340 fxlrxlx.exe 3nhhnn.exe PID 340 wrote to memory of 2748 340 fxlrxlx.exe 3nhhnn.exe PID 340 wrote to memory of 2748 340 fxlrxlx.exe 3nhhnn.exe PID 2748 wrote to memory of 2832 2748 3nhhnn.exe jjvjp.exe PID 2748 wrote to memory of 2832 2748 3nhhnn.exe jjvjp.exe PID 2748 wrote to memory of 2832 2748 3nhhnn.exe jjvjp.exe PID 2748 wrote to memory of 2832 2748 3nhhnn.exe jjvjp.exe PID 2832 wrote to memory of 2536 2832 jjvjp.exe 7xrxlll.exe PID 2832 wrote to memory of 2536 2832 jjvjp.exe 7xrxlll.exe PID 2832 wrote to memory of 2536 2832 jjvjp.exe 7xrxlll.exe PID 2832 wrote to memory of 2536 2832 jjvjp.exe 7xrxlll.exe PID 2536 wrote to memory of 2184 2536 7xrxlll.exe rrlxflx.exe PID 2536 wrote to memory of 2184 2536 7xrxlll.exe rrlxflx.exe PID 2536 wrote to memory of 2184 2536 7xrxlll.exe rrlxflx.exe PID 2536 wrote to memory of 2184 2536 7xrxlll.exe rrlxflx.exe PID 2184 wrote to memory of 2584 2184 rrlxflx.exe bththh.exe PID 2184 wrote to memory of 2584 2184 rrlxflx.exe bththh.exe PID 2184 wrote to memory of 2584 2184 rrlxflx.exe bththh.exe PID 2184 wrote to memory of 2584 2184 rrlxflx.exe bththh.exe PID 2584 wrote to memory of 2332 2584 bththh.exe vvpdp.exe PID 2584 wrote to memory of 2332 2584 bththh.exe vvpdp.exe PID 2584 wrote to memory of 2332 2584 bththh.exe vvpdp.exe PID 2584 wrote to memory of 2332 2584 bththh.exe vvpdp.exe PID 2332 wrote to memory of 2396 2332 vvpdp.exe pjvjj.exe PID 2332 wrote to memory of 2396 2332 vvpdp.exe pjvjj.exe PID 2332 wrote to memory of 2396 2332 vvpdp.exe pjvjj.exe PID 2332 wrote to memory of 2396 2332 vvpdp.exe pjvjj.exe PID 2396 wrote to memory of 1940 2396 pjvjj.exe ffrlflx.exe PID 2396 wrote to memory of 1940 2396 pjvjj.exe ffrlflx.exe PID 2396 wrote to memory of 1940 2396 pjvjj.exe ffrlflx.exe PID 2396 wrote to memory of 1940 2396 pjvjj.exe ffrlflx.exe PID 1940 wrote to memory of 2804 1940 ffrlflx.exe tntnth.exe PID 1940 wrote to memory of 2804 1940 ffrlflx.exe tntnth.exe PID 1940 wrote to memory of 2804 1940 ffrlflx.exe tntnth.exe PID 1940 wrote to memory of 2804 1940 ffrlflx.exe tntnth.exe PID 2804 wrote to memory of 2416 2804 tntnth.exe bhhntn.exe PID 2804 wrote to memory of 2416 2804 tntnth.exe bhhntn.exe PID 2804 wrote to memory of 2416 2804 tntnth.exe bhhntn.exe PID 2804 wrote to memory of 2416 2804 tntnth.exe bhhntn.exe PID 2416 wrote to memory of 2008 2416 bhhntn.exe vpppj.exe PID 2416 wrote to memory of 2008 2416 bhhntn.exe vpppj.exe PID 2416 wrote to memory of 2008 2416 bhhntn.exe vpppj.exe PID 2416 wrote to memory of 2008 2416 bhhntn.exe vpppj.exe PID 2008 wrote to memory of 1592 2008 vpppj.exe lxxxxxl.exe PID 2008 wrote to memory of 1592 2008 vpppj.exe lxxxxxl.exe PID 2008 wrote to memory of 1592 2008 vpppj.exe lxxxxxl.exe PID 2008 wrote to memory of 1592 2008 vpppj.exe lxxxxxl.exe PID 1592 wrote to memory of 2552 1592 lxxxxxl.exe xrxllrr.exe PID 1592 wrote to memory of 2552 1592 lxxxxxl.exe xrxllrr.exe PID 1592 wrote to memory of 2552 1592 lxxxxxl.exe xrxllrr.exe PID 1592 wrote to memory of 2552 1592 lxxxxxl.exe xrxllrr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\93cf62c1ae7f3060b75b0638c8c9f810_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\93cf62c1ae7f3060b75b0638c8c9f810_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\tntbhn.exec:\tntbhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\jdpvp.exec:\jdpvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\fxlrxlx.exec:\fxlrxlx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:340 -
\??\c:\3nhhnn.exec:\3nhhnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\jjvjp.exec:\jjvjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\7xrxlll.exec:\7xrxlll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\rrlxflx.exec:\rrlxflx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\bththh.exec:\bththh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\vvpdp.exec:\vvpdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\pjvjj.exec:\pjvjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\ffrlflx.exec:\ffrlflx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\tntnth.exec:\tntnth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\bhhntn.exec:\bhhntn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\vpppj.exec:\vpppj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\lxxxxxl.exec:\lxxxxxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\xrxllrr.exec:\xrxllrr.exe17⤵
- Executes dropped EXE
PID:2552 -
\??\c:\nhbhbh.exec:\nhbhbh.exe18⤵
- Executes dropped EXE
PID:1616 -
\??\c:\3nbhnt.exec:\3nbhnt.exe19⤵
- Executes dropped EXE
PID:1036 -
\??\c:\vpjvp.exec:\vpjvp.exe20⤵
- Executes dropped EXE
PID:2276 -
\??\c:\pjpvj.exec:\pjpvj.exe21⤵
- Executes dropped EXE
PID:2388 -
\??\c:\xflxflr.exec:\xflxflr.exe22⤵
- Executes dropped EXE
PID:2860 -
\??\c:\7llrffx.exec:\7llrffx.exe23⤵
- Executes dropped EXE
PID:264 -
\??\c:\hhbnhb.exec:\hhbnhb.exe24⤵
- Executes dropped EXE
PID:1608 -
\??\c:\tntbhh.exec:\tntbhh.exe25⤵
- Executes dropped EXE
PID:1852 -
\??\c:\dvpvd.exec:\dvpvd.exe26⤵
- Executes dropped EXE
PID:2468 -
\??\c:\rllrffr.exec:\rllrffr.exe27⤵
- Executes dropped EXE
PID:832 -
\??\c:\nhnthn.exec:\nhnthn.exe28⤵
- Executes dropped EXE
PID:2956 -
\??\c:\ttnttt.exec:\ttnttt.exe29⤵
- Executes dropped EXE
PID:776 -
\??\c:\pjdpj.exec:\pjdpj.exe30⤵
- Executes dropped EXE
PID:2120 -
\??\c:\frfflrx.exec:\frfflrx.exe31⤵
- Executes dropped EXE
PID:1708 -
\??\c:\lfxrfrx.exec:\lfxrfrx.exe32⤵
- Executes dropped EXE
PID:848 -
\??\c:\nhbhht.exec:\nhbhht.exe33⤵
- Executes dropped EXE
PID:2940 -
\??\c:\9vjpj.exec:\9vjpj.exe34⤵
- Executes dropped EXE
PID:316 -
\??\c:\ddvvv.exec:\ddvvv.exe35⤵
- Executes dropped EXE
PID:2976 -
\??\c:\dvjpv.exec:\dvjpv.exe36⤵
- Executes dropped EXE
PID:3036 -
\??\c:\lfflflx.exec:\lfflflx.exe37⤵
- Executes dropped EXE
PID:2716 -
\??\c:\tnhhnn.exec:\tnhhnn.exe38⤵
- Executes dropped EXE
PID:340 -
\??\c:\ttnthn.exec:\ttnthn.exe39⤵
- Executes dropped EXE
PID:2344 -
\??\c:\pjvjv.exec:\pjvjv.exe40⤵
- Executes dropped EXE
PID:2780 -
\??\c:\pjdpj.exec:\pjdpj.exe41⤵
- Executes dropped EXE
PID:2832 -
\??\c:\1fxlfrf.exec:\1fxlfrf.exe42⤵
- Executes dropped EXE
PID:2536 -
\??\c:\5rfflrx.exec:\5rfflrx.exe43⤵
- Executes dropped EXE
PID:2576 -
\??\c:\bbthtb.exec:\bbthtb.exe44⤵
- Executes dropped EXE
PID:1696 -
\??\c:\nhtbnn.exec:\nhtbnn.exe45⤵
- Executes dropped EXE
PID:2220 -
\??\c:\vpvpd.exec:\vpvpd.exe46⤵
- Executes dropped EXE
PID:1968 -
\??\c:\vvdjp.exec:\vvdjp.exe47⤵
- Executes dropped EXE
PID:1948 -
\??\c:\3rlxrff.exec:\3rlxrff.exe48⤵
- Executes dropped EXE
PID:2580 -
\??\c:\lffxfff.exec:\lffxfff.exe49⤵
- Executes dropped EXE
PID:2000 -
\??\c:\nhhhnn.exec:\nhhhnn.exe50⤵
- Executes dropped EXE
PID:1976 -
\??\c:\hhntbh.exec:\hhntbh.exe51⤵
- Executes dropped EXE
PID:2188 -
\??\c:\ppvvv.exec:\ppvvv.exe52⤵
- Executes dropped EXE
PID:1816 -
\??\c:\vvdjp.exec:\vvdjp.exe53⤵
- Executes dropped EXE
PID:1468 -
\??\c:\5rlfllx.exec:\5rlfllx.exe54⤵
- Executes dropped EXE
PID:1788 -
\??\c:\lfrfrxl.exec:\lfrfrxl.exe55⤵
- Executes dropped EXE
PID:1580 -
\??\c:\3tntbn.exec:\3tntbn.exe56⤵
- Executes dropped EXE
PID:684 -
\??\c:\5btbbb.exec:\5btbbb.exe57⤵
- Executes dropped EXE
PID:304 -
\??\c:\7pddj.exec:\7pddj.exe58⤵
- Executes dropped EXE
PID:2496 -
\??\c:\1pjvd.exec:\1pjvd.exe59⤵
- Executes dropped EXE
PID:2372 -
\??\c:\xrlrffl.exec:\xrlrffl.exe60⤵
- Executes dropped EXE
PID:2308 -
\??\c:\bnbntb.exec:\bnbntb.exe61⤵
- Executes dropped EXE
PID:588 -
\??\c:\nbnhnn.exec:\nbnhnn.exe62⤵
- Executes dropped EXE
PID:264 -
\??\c:\7jvjv.exec:\7jvjv.exe63⤵
- Executes dropped EXE
PID:1608 -
\??\c:\vpddd.exec:\vpddd.exe64⤵
- Executes dropped EXE
PID:1132 -
\??\c:\3xfxxrr.exec:\3xfxxrr.exe65⤵
- Executes dropped EXE
PID:2340 -
\??\c:\7fxlxlx.exec:\7fxlxlx.exe66⤵PID:548
-
\??\c:\7htnbn.exec:\7htnbn.exe67⤵PID:832
-
\??\c:\ttnbhn.exec:\ttnbhn.exe68⤵PID:1284
-
\??\c:\jjjvp.exec:\jjjvp.exe69⤵PID:1248
-
\??\c:\lfrllrx.exec:\lfrllrx.exe70⤵PID:1752
-
\??\c:\llfrfll.exec:\llfrfll.exe71⤵PID:1656
-
\??\c:\9nbntb.exec:\9nbntb.exe72⤵PID:2900
-
\??\c:\tbnbhn.exec:\tbnbhn.exe73⤵PID:848
-
\??\c:\vvvpv.exec:\vvvpv.exe74⤵PID:2064
-
\??\c:\7vvvd.exec:\7vvvd.exe75⤵PID:1808
-
\??\c:\3flxffr.exec:\3flxffr.exe76⤵PID:352
-
\??\c:\9frfxrl.exec:\9frfxrl.exe77⤵PID:2708
-
\??\c:\bhtbhh.exec:\bhtbhh.exe78⤵PID:2712
-
\??\c:\9thhtt.exec:\9thhtt.exe79⤵PID:2836
-
\??\c:\pjvjp.exec:\pjvjp.exe80⤵PID:2752
-
\??\c:\1xfxffl.exec:\1xfxffl.exe81⤵PID:2704
-
\??\c:\3xxxlxl.exec:\3xxxlxl.exe82⤵PID:2744
-
\??\c:\nnbhhn.exec:\nnbhhn.exe83⤵PID:2544
-
\??\c:\7thntt.exec:\7thntt.exe84⤵PID:2904
-
\??\c:\dpjdd.exec:\dpjdd.exe85⤵PID:2588
-
\??\c:\pjvjv.exec:\pjvjv.exe86⤵PID:2004
-
\??\c:\xlflxxx.exec:\xlflxxx.exe87⤵PID:1960
-
\??\c:\7xxfrrr.exec:\7xxfrrr.exe88⤵PID:2500
-
\??\c:\7bhbnb.exec:\7bhbnb.exe89⤵PID:1940
-
\??\c:\1hbbnn.exec:\1hbbnn.exe90⤵PID:2804
-
\??\c:\7dpdj.exec:\7dpdj.exe91⤵PID:2416
-
\??\c:\djvpj.exec:\djvpj.exe92⤵PID:1444
-
\??\c:\lxxrrrr.exec:\lxxrrrr.exe93⤵PID:1296
-
\??\c:\1xlfllx.exec:\1xlfllx.exe94⤵PID:2392
-
\??\c:\5bnthn.exec:\5bnthn.exe95⤵PID:1624
-
\??\c:\nbnntb.exec:\nbnntb.exe96⤵PID:2404
-
\??\c:\vpdpp.exec:\vpdpp.exe97⤵PID:2272
-
\??\c:\ddpjv.exec:\ddpjv.exe98⤵PID:2608
-
\??\c:\fxflxxl.exec:\fxflxxl.exe99⤵PID:2700
-
\??\c:\7xllxff.exec:\7xllxff.exe100⤵PID:2304
-
\??\c:\nhhthh.exec:\nhhthh.exe101⤵PID:764
-
\??\c:\hthhnt.exec:\hthhnt.exe102⤵PID:1096
-
\??\c:\tnnntb.exec:\tnnntb.exe103⤵PID:1856
-
\??\c:\ppddd.exec:\ppddd.exe104⤵PID:1804
-
\??\c:\jdjjd.exec:\jdjjd.exe105⤵PID:860
-
\??\c:\1fffrxf.exec:\1fffrxf.exe106⤵PID:892
-
\??\c:\fxrxxxx.exec:\fxrxxxx.exe107⤵PID:2960
-
\??\c:\hbhtth.exec:\hbhtth.exe108⤵PID:1348
-
\??\c:\nnbbnt.exec:\nnbbnt.exe109⤵PID:1992
-
\??\c:\vvpvv.exec:\vvpvv.exe110⤵PID:492
-
\??\c:\vvpvv.exec:\vvpvv.exe111⤵PID:2120
-
\??\c:\pjjpj.exec:\pjjpj.exe112⤵PID:1196
-
\??\c:\7xrrxxl.exec:\7xrrxxl.exe113⤵PID:1668
-
\??\c:\ffllffr.exec:\ffllffr.exe114⤵PID:1244
-
\??\c:\hhhhtt.exec:\hhhhtt.exe115⤵PID:2100
-
\??\c:\nnbhtt.exec:\nnbhtt.exe116⤵PID:2084
-
\??\c:\jjvdj.exec:\jjvdj.exe117⤵PID:2356
-
\??\c:\jdppj.exec:\jdppj.exe118⤵PID:2640
-
\??\c:\rlxflxx.exec:\rlxflxx.exe119⤵PID:2840
-
\??\c:\1rrfrrl.exec:\1rrfrrl.exe120⤵PID:2636
-
\??\c:\tthnnn.exec:\tthnnn.exe121⤵PID:2548
-
\??\c:\btnnbb.exec:\btnnbb.exe122⤵PID:2796
-
\??\c:\hbnntn.exec:\hbnntn.exe123⤵PID:2624
-
\??\c:\vvpdd.exec:\vvpdd.exe124⤵PID:2512
-
\??\c:\ddvdj.exec:\ddvdj.exe125⤵PID:2564
-
\??\c:\lxlllrf.exec:\lxlllrf.exe126⤵PID:2556
-
\??\c:\7xllxxl.exec:\7xllxxl.exe127⤵PID:2040
-
\??\c:\nhbhtb.exec:\nhbhtb.exe128⤵PID:1972
-
\??\c:\tbnbbh.exec:\tbnbbh.exe129⤵PID:1916
-
\??\c:\3dpdv.exec:\3dpdv.exe130⤵PID:1964
-
\??\c:\vpddj.exec:\vpddj.exe131⤵PID:2792
-
\??\c:\fxrrxfl.exec:\fxrrxfl.exe132⤵PID:1996
-
\??\c:\fxllrrf.exec:\fxllrrf.exe133⤵PID:1488
-
\??\c:\tnbbhh.exec:\tnbbhh.exe134⤵PID:2440
-
\??\c:\bthtbb.exec:\bthtbb.exe135⤵PID:1592
-
\??\c:\5pjdj.exec:\5pjdj.exe136⤵PID:2552
-
\??\c:\5jdpv.exec:\5jdpv.exe137⤵PID:1632
-
\??\c:\7rrxffx.exec:\7rrxffx.exe138⤵PID:2380
-
\??\c:\xrlxxlr.exec:\xrlxxlr.exe139⤵PID:2296
-
\??\c:\tntnbh.exec:\tntnbh.exe140⤵PID:392
-
\??\c:\bbnnbb.exec:\bbnnbb.exe141⤵PID:2388
-
\??\c:\vjvjj.exec:\vjvjj.exe142⤵PID:2244
-
\??\c:\3vjdj.exec:\3vjdj.exe143⤵PID:944
-
\??\c:\rlxrrlx.exec:\rlxrrlx.exe144⤵PID:1896
-
\??\c:\1frxlfx.exec:\1frxlfx.exe145⤵PID:1780
-
\??\c:\tnnbhn.exec:\tnnbhn.exe146⤵PID:1852
-
\??\c:\9ttntt.exec:\9ttntt.exe147⤵PID:948
-
\??\c:\ddvvd.exec:\ddvvd.exe148⤵PID:3012
-
\??\c:\ffrfrrr.exec:\ffrfrrr.exe149⤵PID:2868
-
\??\c:\lfxfxxx.exec:\lfxfxxx.exe150⤵PID:3028
-
\??\c:\tnhbhn.exec:\tnhbhn.exe151⤵PID:1748
-
\??\c:\tthhbb.exec:\tthhbb.exe152⤵PID:2228
-
\??\c:\dvddd.exec:\dvddd.exe153⤵PID:2932
-
\??\c:\pdjdd.exec:\pdjdd.exe154⤵PID:1576
-
\??\c:\xxrxflr.exec:\xxrxflr.exe155⤵PID:2096
-
\??\c:\5xlrxxl.exec:\5xlrxxl.exe156⤵PID:1728
-
\??\c:\hbnthh.exec:\hbnthh.exe157⤵PID:2604
-
\??\c:\hbnhnn.exec:\hbnhnn.exe158⤵PID:2976
-
\??\c:\dpddd.exec:\dpddd.exe159⤵PID:2652
-
\??\c:\vvppv.exec:\vvppv.exe160⤵PID:2644
-
\??\c:\xlxlxxx.exec:\xlxlxxx.exe161⤵PID:2776
-
\??\c:\fxrxffl.exec:\fxrxffl.exe162⤵PID:1784
-
\??\c:\nnthbb.exec:\nnthbb.exe163⤵PID:2560
-
\??\c:\ttnnnh.exec:\ttnnnh.exe164⤵PID:2508
-
\??\c:\3jvpd.exec:\3jvpd.exe165⤵PID:2680
-
\??\c:\7vvpv.exec:\7vvpv.exe166⤵PID:2532
-
\??\c:\lfrxlfx.exec:\lfrxlfx.exe167⤵PID:1696
-
\??\c:\rrrfxrl.exec:\rrrfxrl.exe168⤵PID:1936
-
\??\c:\bttthn.exec:\bttthn.exe169⤵PID:1912
-
\??\c:\bbhnbn.exec:\bbhnbn.exe170⤵PID:2488
-
\??\c:\pjvdd.exec:\pjvdd.exe171⤵PID:2012
-
\??\c:\1pdvj.exec:\1pdvj.exe172⤵PID:2432
-
\??\c:\dpvdd.exec:\dpvdd.exe173⤵PID:1516
-
\??\c:\xffrlxl.exec:\xffrlxl.exe174⤵PID:1492
-
\??\c:\xxrxllr.exec:\xxrxllr.exe175⤵PID:2236
-
\??\c:\bnbhbb.exec:\bnbhbb.exe176⤵PID:2420
-
\??\c:\tnbntb.exec:\tnbntb.exe177⤵PID:1868
-
\??\c:\dpvdd.exec:\dpvdd.exe178⤵PID:1152
-
\??\c:\vpvvp.exec:\vpvvp.exe179⤵PID:2264
-
\??\c:\jdddj.exec:\jdddj.exe180⤵PID:1724
-
\??\c:\lffflxf.exec:\lffflxf.exe181⤵PID:1928
-
\??\c:\fxflxxf.exec:\fxflxxf.exe182⤵PID:532
-
\??\c:\tnhhnn.exec:\tnhhnn.exe183⤵PID:992
-
\??\c:\nhtnhn.exec:\nhtnhn.exe184⤵PID:2132
-
\??\c:\djpdv.exec:\djpdv.exe185⤵PID:2124
-
\??\c:\7jdpv.exec:\7jdpv.exe186⤵PID:852
-
\??\c:\lfrxrxr.exec:\lfrxrxr.exe187⤵PID:1612
-
\??\c:\9xxrflr.exec:\9xxrflr.exe188⤵PID:692
-
\??\c:\nnhnbn.exec:\nnhnbn.exe189⤵PID:2080
-
\??\c:\hhthtb.exec:\hhthtb.exe190⤵PID:336
-
\??\c:\3pvvv.exec:\3pvvv.exe191⤵PID:1308
-
\??\c:\5jvpd.exec:\5jvpd.exe192⤵PID:884
-
\??\c:\rrffrlr.exec:\rrffrlr.exe193⤵PID:2120
-
\??\c:\llxlrxx.exec:\llxlrxx.exe194⤵PID:1680
-
\??\c:\xlrrxxl.exec:\xlrrxxl.exe195⤵PID:2444
-
\??\c:\bbtntt.exec:\bbtntt.exe196⤵PID:2820
-
\??\c:\1bhnnb.exec:\1bhnnb.exe197⤵PID:2176
-
\??\c:\dvjjv.exec:\dvjjv.exe198⤵PID:2788
-
\??\c:\vjdjv.exec:\vjdjv.exe199⤵PID:2728
-
\??\c:\xrlrxxf.exec:\xrlrxxf.exe200⤵PID:2716
-
\??\c:\xrxfrxf.exec:\xrxfrxf.exe201⤵PID:2712
-
\??\c:\hbnbbt.exec:\hbnbbt.exe202⤵PID:2612
-
\??\c:\5htbbn.exec:\5htbbn.exe203⤵PID:2756
-
\??\c:\1vjdp.exec:\1vjdp.exe204⤵PID:2648
-
\??\c:\5dpvj.exec:\5dpvj.exe205⤵PID:2928
-
\??\c:\xrxfflr.exec:\xrxfflr.exe206⤵PID:2912
-
\??\c:\rffrffr.exec:\rffrffr.exe207⤵PID:2908
-
\??\c:\bthhhh.exec:\bthhhh.exe208⤵PID:296
-
\??\c:\bbtthn.exec:\bbtthn.exe209⤵PID:1648
-
\??\c:\5jppv.exec:\5jppv.exe210⤵PID:1960
-
\??\c:\3rflrrf.exec:\3rflrrf.exe211⤵PID:2580
-
\??\c:\rrlxxrx.exec:\rrlxxrx.exe212⤵PID:2000
-
\??\c:\1jdvj.exec:\1jdvj.exe213⤵PID:2424
-
\??\c:\pvpjp.exec:\pvpjp.exe214⤵PID:2400
-
\??\c:\1vpvp.exec:\1vpvp.exe215⤵PID:2436
-
\??\c:\3lxfllx.exec:\3lxfllx.exe216⤵PID:1296
-
\??\c:\rlrrffl.exec:\rlrrffl.exe217⤵PID:2360
-
\??\c:\hhtttn.exec:\hhtttn.exe218⤵PID:2324
-
\??\c:\9hbhtn.exec:\9hbhtn.exe219⤵PID:1632
-
\??\c:\1jvdj.exec:\1jvdj.exe220⤵PID:1036
-
\??\c:\jdpvp.exec:\jdpvp.exe221⤵PID:2276
-
\??\c:\lfxlllr.exec:\lfxlllr.exe222⤵PID:2856
-
\??\c:\xrxlllr.exec:\xrxlllr.exe223⤵PID:1008
-
\??\c:\bthnnt.exec:\bthnnt.exe224⤵PID:588
-
\??\c:\ttbhtt.exec:\ttbhtt.exe225⤵PID:828
-
\??\c:\htntnb.exec:\htntnb.exe226⤵PID:1608
-
\??\c:\1vpdj.exec:\1vpdj.exe227⤵PID:1132
-
\??\c:\pjvpv.exec:\pjvpv.exe228⤵PID:1028
-
\??\c:\fxfflrx.exec:\fxfflrx.exe229⤵PID:2456
-
\??\c:\xxrfrxx.exec:\xxrfrxx.exe230⤵PID:832
-
\??\c:\hbbbnn.exec:\hbbbnn.exe231⤵PID:776
-
\??\c:\hhhtbt.exec:\hhhtbt.exe232⤵PID:2148
-
\??\c:\nhtbhb.exec:\nhtbhb.exe233⤵PID:1984
-
\??\c:\dvppv.exec:\dvppv.exe234⤵PID:1196
-
\??\c:\1dpjv.exec:\1dpjv.exe235⤵PID:1796
-
\??\c:\1rxrffx.exec:\1rxrffx.exe236⤵PID:848
-
\??\c:\rfrrxxx.exec:\rfrrxxx.exe237⤵PID:2100
-
\??\c:\nnnbnn.exec:\nnnbnn.exe238⤵PID:1808
-
\??\c:\5bhntb.exec:\5bhntb.exe239⤵PID:2356
-
\??\c:\dpvvj.exec:\dpvvj.exe240⤵PID:2300
-
\??\c:\jdpjp.exec:\jdpjp.exe241⤵PID:2840
-
\??\c:\llxxlll.exec:\llxxlll.exe242⤵PID:2636