Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 14:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
da9b679931245e958b7c20a842936df0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
da9b679931245e958b7c20a842936df0_NeikiAnalytics.exe
-
Size
227KB
-
MD5
da9b679931245e958b7c20a842936df0
-
SHA1
4414c89866c81ca3332fb7da0dc10a222eb5bfdc
-
SHA256
1cfcf2e75b09d0dc7cc0614accc57fdee5cbf461baf206bc248b85e77d94babb
-
SHA512
5eb3fcfc36eef79750f9db9485940233b58a5c3e3717de768febc445429d94d03cea0c19164a7b9af04400acfdd273150c716c640d10908539109b681d5e72c2
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xLn/c1V:n3C9BRo7MlrWKo+lxKk1V
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/2860-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1556-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1408-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1268-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2244-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1940-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2068-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1472-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1012-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
tnnnbh.exe3nhtbt.exelfxxlrf.exehbhhnb.exeddpvj.exe5jdvd.exenhttbb.exe5vpvp.exe5rflrxx.exeffxfxlx.exetnbbhh.exebthhnn.exeddvjp.exexlxflrx.exe9nnhbt.exejjvdp.exexrllxrf.exehhbthn.exejjvdd.exe7dvjp.exerllxrxl.exe9tntnh.exedjvdd.exe9lxflxx.exe3nnnnt.exennhhtt.exexrxfrrx.exe5frxflx.exe3jvpd.exejvvpp.exefflrrlf.exethnbnn.exepvjvj.exejpvdj.exefrxfllr.exehbbthn.exe3bhnnn.exejvjdj.exevjddd.exefxfrflr.exe5fllfxx.exethnnnh.exebthhnn.exeddjdd.exepdpjj.exerflxflr.exe9nhtbb.exe5nhnbt.exe1pddj.exedjjvv.exefxlfllr.exexlxflff.exe3nbttt.exenhhnbb.exevpjvj.exerlrrfff.exexrxlxxl.exe1bbtbn.exehbtbbb.exepvjvd.exe1jdpp.exefxlxrxr.exexrfrlxl.exe1nhnhh.exepid process 2316 tnnnbh.exe 2976 3nhtbt.exe 2608 lfxxlrf.exe 1948 hbhhnb.exe 2696 ddpvj.exe 2564 5jdvd.exe 2416 nhttbb.exe 2888 5vpvp.exe 1556 5rflrxx.exe 2676 ffxfxlx.exe 2764 tnbbhh.exe 2284 bthhnn.exe 832 ddvjp.exe 1504 xlxflrx.exe 1408 9nnhbt.exe 1268 jjvdp.exe 2040 xrllxrf.exe 2244 hhbthn.exe 1940 jjvdd.exe 2352 7dvjp.exe 2064 rllxrxl.exe 972 9tntnh.exe 2068 djvdd.exe 1972 9lxflxx.exe 1472 3nnnnt.exe 1776 nnhhtt.exe 1012 xrxfrrx.exe 2072 5frxflx.exe 2844 3jvpd.exe 2816 jvvpp.exe 1208 fflrrlf.exe 1916 thnbnn.exe 2912 pvjvj.exe 2508 jpvdj.exe 2540 frxfllr.exe 2604 hbbthn.exe 2820 3bhnnn.exe 2532 jvjdj.exe 2692 vjddd.exe 2964 fxfrflr.exe 2728 5fllfxx.exe 2460 thnnnh.exe 1780 bthhnn.exe 1588 ddjdd.exe 2668 pdpjj.exe 1556 rflxflr.exe 2780 9nhtbb.exe 2744 5nhnbt.exe 1536 1pddj.exe 1736 djjvv.exe 1004 fxlfllr.exe 2372 xlxflff.exe 1352 3nbttt.exe 2016 nhhnbb.exe 2176 vpjvj.exe 2004 rlrrfff.exe 2496 xrxlxxl.exe 1240 1bbtbn.exe 2240 hbtbbb.exe 1820 pvjvd.exe 1052 1jdpp.exe 1396 fxlxrxr.exe 1768 xrfrlxl.exe 2360 1nhnhh.exe -
Processes:
resource yara_rule behavioral1/memory/2860-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1408-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1268-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2244-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1940-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1472-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1012-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-291-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
da9b679931245e958b7c20a842936df0_NeikiAnalytics.exetnnnbh.exe3nhtbt.exelfxxlrf.exehbhhnb.exeddpvj.exe5jdvd.exenhttbb.exe5vpvp.exe5rflrxx.exeffxfxlx.exetnbbhh.exebthhnn.exeddvjp.exexlxflrx.exe9nnhbt.exedescription pid process target process PID 2860 wrote to memory of 2316 2860 da9b679931245e958b7c20a842936df0_NeikiAnalytics.exe tnnnbh.exe PID 2860 wrote to memory of 2316 2860 da9b679931245e958b7c20a842936df0_NeikiAnalytics.exe tnnnbh.exe PID 2860 wrote to memory of 2316 2860 da9b679931245e958b7c20a842936df0_NeikiAnalytics.exe tnnnbh.exe PID 2860 wrote to memory of 2316 2860 da9b679931245e958b7c20a842936df0_NeikiAnalytics.exe tnnnbh.exe PID 2316 wrote to memory of 2976 2316 tnnnbh.exe 3nhtbt.exe PID 2316 wrote to memory of 2976 2316 tnnnbh.exe 3nhtbt.exe PID 2316 wrote to memory of 2976 2316 tnnnbh.exe 3nhtbt.exe PID 2316 wrote to memory of 2976 2316 tnnnbh.exe 3nhtbt.exe PID 2976 wrote to memory of 2608 2976 3nhtbt.exe lfxxlrf.exe PID 2976 wrote to memory of 2608 2976 3nhtbt.exe lfxxlrf.exe PID 2976 wrote to memory of 2608 2976 3nhtbt.exe lfxxlrf.exe PID 2976 wrote to memory of 2608 2976 3nhtbt.exe lfxxlrf.exe PID 2608 wrote to memory of 1948 2608 lfxxlrf.exe hbhhnb.exe PID 2608 wrote to memory of 1948 2608 lfxxlrf.exe hbhhnb.exe PID 2608 wrote to memory of 1948 2608 lfxxlrf.exe hbhhnb.exe PID 2608 wrote to memory of 1948 2608 lfxxlrf.exe hbhhnb.exe PID 1948 wrote to memory of 2696 1948 hbhhnb.exe ddpvj.exe PID 1948 wrote to memory of 2696 1948 hbhhnb.exe ddpvj.exe PID 1948 wrote to memory of 2696 1948 hbhhnb.exe ddpvj.exe PID 1948 wrote to memory of 2696 1948 hbhhnb.exe ddpvj.exe PID 2696 wrote to memory of 2564 2696 ddpvj.exe 5jdvd.exe PID 2696 wrote to memory of 2564 2696 ddpvj.exe 5jdvd.exe PID 2696 wrote to memory of 2564 2696 ddpvj.exe 5jdvd.exe PID 2696 wrote to memory of 2564 2696 ddpvj.exe 5jdvd.exe PID 2564 wrote to memory of 2416 2564 5jdvd.exe nhttbb.exe PID 2564 wrote to memory of 2416 2564 5jdvd.exe nhttbb.exe PID 2564 wrote to memory of 2416 2564 5jdvd.exe nhttbb.exe PID 2564 wrote to memory of 2416 2564 5jdvd.exe nhttbb.exe PID 2416 wrote to memory of 2888 2416 nhttbb.exe 5vpvp.exe PID 2416 wrote to memory of 2888 2416 nhttbb.exe 5vpvp.exe PID 2416 wrote to memory of 2888 2416 nhttbb.exe 5vpvp.exe PID 2416 wrote to memory of 2888 2416 nhttbb.exe 5vpvp.exe PID 2888 wrote to memory of 1556 2888 5vpvp.exe 5rflrxx.exe PID 2888 wrote to memory of 1556 2888 5vpvp.exe 5rflrxx.exe PID 2888 wrote to memory of 1556 2888 5vpvp.exe 5rflrxx.exe PID 2888 wrote to memory of 1556 2888 5vpvp.exe 5rflrxx.exe PID 1556 wrote to memory of 2676 1556 5rflrxx.exe ffxfxlx.exe PID 1556 wrote to memory of 2676 1556 5rflrxx.exe ffxfxlx.exe PID 1556 wrote to memory of 2676 1556 5rflrxx.exe ffxfxlx.exe PID 1556 wrote to memory of 2676 1556 5rflrxx.exe ffxfxlx.exe PID 2676 wrote to memory of 2764 2676 ffxfxlx.exe tnbbhh.exe PID 2676 wrote to memory of 2764 2676 ffxfxlx.exe tnbbhh.exe PID 2676 wrote to memory of 2764 2676 ffxfxlx.exe tnbbhh.exe PID 2676 wrote to memory of 2764 2676 ffxfxlx.exe tnbbhh.exe PID 2764 wrote to memory of 2284 2764 tnbbhh.exe bthhnn.exe PID 2764 wrote to memory of 2284 2764 tnbbhh.exe bthhnn.exe PID 2764 wrote to memory of 2284 2764 tnbbhh.exe bthhnn.exe PID 2764 wrote to memory of 2284 2764 tnbbhh.exe bthhnn.exe PID 2284 wrote to memory of 832 2284 bthhnn.exe ddvjp.exe PID 2284 wrote to memory of 832 2284 bthhnn.exe ddvjp.exe PID 2284 wrote to memory of 832 2284 bthhnn.exe ddvjp.exe PID 2284 wrote to memory of 832 2284 bthhnn.exe ddvjp.exe PID 832 wrote to memory of 1504 832 ddvjp.exe xlxflrx.exe PID 832 wrote to memory of 1504 832 ddvjp.exe xlxflrx.exe PID 832 wrote to memory of 1504 832 ddvjp.exe xlxflrx.exe PID 832 wrote to memory of 1504 832 ddvjp.exe xlxflrx.exe PID 1504 wrote to memory of 1408 1504 xlxflrx.exe 9nnhbt.exe PID 1504 wrote to memory of 1408 1504 xlxflrx.exe 9nnhbt.exe PID 1504 wrote to memory of 1408 1504 xlxflrx.exe 9nnhbt.exe PID 1504 wrote to memory of 1408 1504 xlxflrx.exe 9nnhbt.exe PID 1408 wrote to memory of 1268 1408 9nnhbt.exe jjvdp.exe PID 1408 wrote to memory of 1268 1408 9nnhbt.exe jjvdp.exe PID 1408 wrote to memory of 1268 1408 9nnhbt.exe jjvdp.exe PID 1408 wrote to memory of 1268 1408 9nnhbt.exe jjvdp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\da9b679931245e958b7c20a842936df0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\da9b679931245e958b7c20a842936df0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\tnnnbh.exec:\tnnnbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\3nhtbt.exec:\3nhtbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\lfxxlrf.exec:\lfxxlrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\hbhhnb.exec:\hbhhnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\ddpvj.exec:\ddpvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\5jdvd.exec:\5jdvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\nhttbb.exec:\nhttbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\5vpvp.exec:\5vpvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\5rflrxx.exec:\5rflrxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\ffxfxlx.exec:\ffxfxlx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\tnbbhh.exec:\tnbbhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\bthhnn.exec:\bthhnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\ddvjp.exec:\ddvjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\xlxflrx.exec:\xlxflrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\9nnhbt.exec:\9nnhbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\jjvdp.exec:\jjvdp.exe17⤵
- Executes dropped EXE
PID:1268 -
\??\c:\xrllxrf.exec:\xrllxrf.exe18⤵
- Executes dropped EXE
PID:2040 -
\??\c:\hhbthn.exec:\hhbthn.exe19⤵
- Executes dropped EXE
PID:2244 -
\??\c:\jjvdd.exec:\jjvdd.exe20⤵
- Executes dropped EXE
PID:1940 -
\??\c:\7dvjp.exec:\7dvjp.exe21⤵
- Executes dropped EXE
PID:2352 -
\??\c:\rllxrxl.exec:\rllxrxl.exe22⤵
- Executes dropped EXE
PID:2064 -
\??\c:\9tntnh.exec:\9tntnh.exe23⤵
- Executes dropped EXE
PID:972 -
\??\c:\djvdd.exec:\djvdd.exe24⤵
- Executes dropped EXE
PID:2068 -
\??\c:\9lxflxx.exec:\9lxflxx.exe25⤵
- Executes dropped EXE
PID:1972 -
\??\c:\3nnnnt.exec:\3nnnnt.exe26⤵
- Executes dropped EXE
PID:1472 -
\??\c:\nnhhtt.exec:\nnhhtt.exe27⤵
- Executes dropped EXE
PID:1776 -
\??\c:\xrxfrrx.exec:\xrxfrrx.exe28⤵
- Executes dropped EXE
PID:1012 -
\??\c:\5frxflx.exec:\5frxflx.exe29⤵
- Executes dropped EXE
PID:2072 -
\??\c:\3jvpd.exec:\3jvpd.exe30⤵
- Executes dropped EXE
PID:2844 -
\??\c:\jvvpp.exec:\jvvpp.exe31⤵
- Executes dropped EXE
PID:2816 -
\??\c:\fflrrlf.exec:\fflrrlf.exe32⤵
- Executes dropped EXE
PID:1208 -
\??\c:\thnbnn.exec:\thnbnn.exe33⤵
- Executes dropped EXE
PID:1916 -
\??\c:\pvjvj.exec:\pvjvj.exe34⤵
- Executes dropped EXE
PID:2912 -
\??\c:\jpvdj.exec:\jpvdj.exe35⤵
- Executes dropped EXE
PID:2508 -
\??\c:\frxfllr.exec:\frxfllr.exe36⤵
- Executes dropped EXE
PID:2540 -
\??\c:\hbbthn.exec:\hbbthn.exe37⤵
- Executes dropped EXE
PID:2604 -
\??\c:\3bhnnn.exec:\3bhnnn.exe38⤵
- Executes dropped EXE
PID:2820 -
\??\c:\jvjdj.exec:\jvjdj.exe39⤵
- Executes dropped EXE
PID:2532 -
\??\c:\vjddd.exec:\vjddd.exe40⤵
- Executes dropped EXE
PID:2692 -
\??\c:\fxfrflr.exec:\fxfrflr.exe41⤵
- Executes dropped EXE
PID:2964 -
\??\c:\5fllfxx.exec:\5fllfxx.exe42⤵
- Executes dropped EXE
PID:2728 -
\??\c:\thnnnh.exec:\thnnnh.exe43⤵
- Executes dropped EXE
PID:2460 -
\??\c:\bthhnn.exec:\bthhnn.exe44⤵
- Executes dropped EXE
PID:1780 -
\??\c:\ddjdd.exec:\ddjdd.exe45⤵
- Executes dropped EXE
PID:1588 -
\??\c:\pdpjj.exec:\pdpjj.exe46⤵
- Executes dropped EXE
PID:2668 -
\??\c:\rflxflr.exec:\rflxflr.exe47⤵
- Executes dropped EXE
PID:1556 -
\??\c:\9nhtbb.exec:\9nhtbb.exe48⤵
- Executes dropped EXE
PID:2780 -
\??\c:\5nhnbt.exec:\5nhnbt.exe49⤵
- Executes dropped EXE
PID:2744 -
\??\c:\1pddj.exec:\1pddj.exe50⤵
- Executes dropped EXE
PID:1536 -
\??\c:\djjvv.exec:\djjvv.exe51⤵
- Executes dropped EXE
PID:1736 -
\??\c:\fxlfllr.exec:\fxlfllr.exe52⤵
- Executes dropped EXE
PID:1004 -
\??\c:\xlxflff.exec:\xlxflff.exe53⤵
- Executes dropped EXE
PID:2372 -
\??\c:\3nbttt.exec:\3nbttt.exe54⤵
- Executes dropped EXE
PID:1352 -
\??\c:\nhhnbb.exec:\nhhnbb.exe55⤵
- Executes dropped EXE
PID:2016 -
\??\c:\vpjvj.exec:\vpjvj.exe56⤵
- Executes dropped EXE
PID:2176 -
\??\c:\rlrrfff.exec:\rlrrfff.exe57⤵
- Executes dropped EXE
PID:2004 -
\??\c:\xrxlxxl.exec:\xrxlxxl.exe58⤵
- Executes dropped EXE
PID:2496 -
\??\c:\1bbtbn.exec:\1bbtbn.exe59⤵
- Executes dropped EXE
PID:1240 -
\??\c:\hbtbbb.exec:\hbtbbb.exe60⤵
- Executes dropped EXE
PID:2240 -
\??\c:\pvjvd.exec:\pvjvd.exe61⤵
- Executes dropped EXE
PID:1820 -
\??\c:\1jdpp.exec:\1jdpp.exe62⤵
- Executes dropped EXE
PID:1052 -
\??\c:\fxlxrxr.exec:\fxlxrxr.exe63⤵
- Executes dropped EXE
PID:1396 -
\??\c:\xrfrlxl.exec:\xrfrlxl.exe64⤵
- Executes dropped EXE
PID:1768 -
\??\c:\1nhnhh.exec:\1nhnhh.exe65⤵
- Executes dropped EXE
PID:2360 -
\??\c:\7bhttt.exec:\7bhttt.exe66⤵PID:1908
-
\??\c:\7jdpv.exec:\7jdpv.exe67⤵PID:616
-
\??\c:\vjjjv.exec:\vjjjv.exe68⤵PID:880
-
\??\c:\1xrfrxr.exec:\1xrfrxr.exe69⤵PID:1912
-
\??\c:\xlrrrrx.exec:\xlrrrrx.exe70⤵PID:1936
-
\??\c:\btbbnt.exec:\btbbnt.exe71⤵PID:2480
-
\??\c:\hbtthn.exec:\hbtthn.exe72⤵PID:572
-
\??\c:\vdpvj.exec:\vdpvj.exe73⤵PID:2488
-
\??\c:\7dpvd.exec:\7dpvd.exe74⤵PID:2320
-
\??\c:\llxfllx.exec:\llxfllx.exe75⤵PID:1532
-
\??\c:\7nbhnt.exec:\7nbhnt.exe76⤵PID:3016
-
\??\c:\1bthhh.exec:\1bthhh.exe77⤵PID:1512
-
\??\c:\pjdpv.exec:\pjdpv.exe78⤵PID:2492
-
\??\c:\lffxrlx.exec:\lffxrlx.exe79⤵PID:2628
-
\??\c:\xlxfxfr.exec:\xlxfxfr.exe80⤵PID:2548
-
\??\c:\nhtbhn.exec:\nhtbhn.exe81⤵PID:2560
-
\??\c:\3thtbh.exec:\3thtbh.exe82⤵PID:2688
-
\??\c:\dvpjv.exec:\dvpjv.exe83⤵PID:2168
-
\??\c:\9pjpv.exec:\9pjpv.exe84⤵PID:2444
-
\??\c:\rlxlflx.exec:\rlxlflx.exe85⤵PID:2564
-
\??\c:\tntbhn.exec:\tntbhn.exe86⤵PID:1944
-
\??\c:\nnbhbb.exec:\nnbhbb.exe87⤵PID:2672
-
\??\c:\vvpvp.exec:\vvpvp.exe88⤵PID:2720
-
\??\c:\ppjvj.exec:\ppjvj.exe89⤵PID:2644
-
\??\c:\ffxxxxf.exec:\ffxxxxf.exe90⤵PID:2756
-
\??\c:\lfxlrxl.exec:\lfxlrxl.exe91⤵PID:1360
-
\??\c:\7bhhtb.exec:\7bhhtb.exe92⤵PID:2752
-
\??\c:\7jjjj.exec:\7jjjj.exe93⤵PID:1344
-
\??\c:\vpddp.exec:\vpddp.exe94⤵PID:2132
-
\??\c:\rlxrlrx.exec:\rlxrlrx.exe95⤵PID:1192
-
\??\c:\ffflrrf.exec:\ffflrrf.exe96⤵PID:2188
-
\??\c:\9bthtb.exec:\9bthtb.exe97⤵PID:2012
-
\??\c:\pjppv.exec:\pjppv.exe98⤵PID:2028
-
\??\c:\vvvjj.exec:\vvvjj.exe99⤵PID:1668
-
\??\c:\pjvdd.exec:\pjvdd.exe100⤵PID:2220
-
\??\c:\xrllrxf.exec:\xrllrxf.exe101⤵PID:1904
-
\??\c:\5thtbt.exec:\5thtbt.exe102⤵PID:2136
-
\??\c:\1bttbb.exec:\1bttbb.exe103⤵PID:336
-
\??\c:\7vdjj.exec:\7vdjj.exe104⤵PID:2748
-
\??\c:\rrllrxx.exec:\rrllrxx.exe105⤵PID:1388
-
\??\c:\fxlrffr.exec:\fxlrffr.exe106⤵PID:2364
-
\??\c:\9ntbtn.exec:\9ntbtn.exe107⤵PID:2944
-
\??\c:\hbbbhh.exec:\hbbbhh.exe108⤵PID:1284
-
\??\c:\pjvjv.exec:\pjvjv.exe109⤵PID:2276
-
\??\c:\pdddv.exec:\pdddv.exe110⤵PID:2108
-
\??\c:\3xlrflr.exec:\3xlrflr.exe111⤵PID:1492
-
\??\c:\bbtbnt.exec:\bbtbnt.exe112⤵PID:976
-
\??\c:\hbbhnh.exec:\hbbhnh.exe113⤵PID:3024
-
\??\c:\9vvjp.exec:\9vvjp.exe114⤵PID:1184
-
\??\c:\1jvdv.exec:\1jvdv.exe115⤵PID:1876
-
\??\c:\fxfxrxl.exec:\fxfxrxl.exe116⤵PID:1080
-
\??\c:\llxxlrr.exec:\llxxlrr.exe117⤵PID:2952
-
\??\c:\bthttb.exec:\bthttb.exe118⤵PID:1624
-
\??\c:\pdjjv.exec:\pdjjv.exe119⤵PID:2588
-
\??\c:\dvpdj.exec:\dvpdj.exe120⤵PID:2624
-
\??\c:\rlflrxf.exec:\rlflrxf.exe121⤵PID:2808
-
\??\c:\rfrxffl.exec:\rfrxffl.exe122⤵PID:2504
-
\??\c:\3hhhbb.exec:\3hhhbb.exe123⤵PID:2532
-
\??\c:\bthntb.exec:\bthntb.exe124⤵PID:2568
-
\??\c:\vvddj.exec:\vvddj.exe125⤵PID:2964
-
\??\c:\1xxrlff.exec:\1xxrlff.exe126⤵PID:2168
-
\??\c:\ffxrxxl.exec:\ffxrxxl.exe127⤵PID:2396
-
\??\c:\hbnntt.exec:\hbnntt.exe128⤵PID:2468
-
\??\c:\9bhhbt.exec:\9bhhbt.exe129⤵PID:2896
-
\??\c:\pjddj.exec:\pjddj.exe130⤵PID:2668
-
\??\c:\jdddj.exec:\jdddj.exe131⤵PID:1556
-
\??\c:\frfxffl.exec:\frfxffl.exe132⤵PID:2780
-
\??\c:\3xlrxrr.exec:\3xlrxrr.exe133⤵PID:296
-
\??\c:\1htbnt.exec:\1htbnt.exe134⤵PID:2280
-
\??\c:\hbnhbh.exec:\hbnhbh.exe135⤵PID:1584
-
\??\c:\pjppv.exec:\pjppv.exe136⤵PID:1504
-
\??\c:\7jdpv.exec:\7jdpv.exe137⤵PID:2372
-
\??\c:\xrxrrlr.exec:\xrxrrlr.exe138⤵PID:872
-
\??\c:\bttthn.exec:\bttthn.exe139⤵PID:2216
-
\??\c:\1htthn.exec:\1htthn.exe140⤵PID:3040
-
\??\c:\ppddv.exec:\ppddv.exe141⤵PID:1988
-
\??\c:\9vddd.exec:\9vddd.exe142⤵PID:2260
-
\??\c:\xlflrrx.exec:\xlflrrx.exe143⤵PID:1240
-
\??\c:\fffflxr.exec:\fffflxr.exe144⤵PID:276
-
\??\c:\nhbhth.exec:\nhbhth.exe145⤵PID:1704
-
\??\c:\dvjvp.exec:\dvjvp.exe146⤵PID:1548
-
\??\c:\vjvpj.exec:\vjvpj.exe147⤵PID:2092
-
\??\c:\xrxfrlf.exec:\xrxfrlf.exe148⤵PID:1768
-
\??\c:\lflrxfx.exec:\lflrxfx.exe149⤵PID:2360
-
\??\c:\thntbb.exec:\thntbb.exe150⤵PID:2824
-
\??\c:\5nhbtt.exec:\5nhbtt.exe151⤵PID:3048
-
\??\c:\vvdjp.exec:\vvdjp.exe152⤵PID:1012
-
\??\c:\pvpjj.exec:\pvpjj.exe153⤵PID:2836
-
\??\c:\lrxflfl.exec:\lrxflfl.exe154⤵PID:1936
-
\??\c:\xrrxlfr.exec:\xrrxlfr.exe155⤵PID:2380
-
\??\c:\hthbtt.exec:\hthbtt.exe156⤵PID:2088
-
\??\c:\nthhnh.exec:\nthhnh.exe157⤵PID:2488
-
\??\c:\vvjvd.exec:\vvjvd.exe158⤵PID:2320
-
\??\c:\dvjvd.exec:\dvjvd.exe159⤵PID:1928
-
\??\c:\rflfrll.exec:\rflfrll.exe160⤵PID:2952
-
\??\c:\7lrrrrr.exec:\7lrrrrr.exe161⤵PID:2600
-
\??\c:\thhhnh.exec:\thhhnh.exe162⤵PID:2616
-
\??\c:\3nttnh.exec:\3nttnh.exe163⤵PID:2620
-
\??\c:\7vvpv.exec:\7vvpv.exe164⤵PID:2432
-
\??\c:\jdppv.exec:\jdppv.exe165⤵PID:2804
-
\??\c:\rfllllr.exec:\rfllllr.exe166⤵PID:2688
-
\??\c:\5flxlrf.exec:\5flxlrf.exe167⤵PID:2452
-
\??\c:\nhbhnt.exec:\nhbhnt.exe168⤵PID:2428
-
\??\c:\jpdvd.exec:\jpdvd.exe169⤵PID:2564
-
\??\c:\3dvdp.exec:\3dvdp.exe170⤵PID:2640
-
\??\c:\1rflxlx.exec:\1rflxlx.exe171⤵PID:2732
-
\??\c:\rllrxfl.exec:\rllrxfl.exe172⤵PID:2716
-
\??\c:\hhnhhb.exec:\hhnhhb.exe173⤵PID:2740
-
\??\c:\jjjpp.exec:\jjjpp.exe174⤵PID:1300
-
\??\c:\vpdpd.exec:\vpdpd.exe175⤵PID:328
-
\??\c:\rrxxflr.exec:\rrxxflr.exe176⤵PID:2752
-
\??\c:\rxxfrfl.exec:\rxxfrfl.exe177⤵PID:828
-
\??\c:\ntbbbt.exec:\ntbbbt.exe178⤵PID:1248
-
\??\c:\1nhbnh.exec:\1nhbnh.exe179⤵PID:1352
-
\??\c:\pdjjp.exec:\pdjjp.exe180⤵PID:2180
-
\??\c:\9rllffr.exec:\9rllffr.exe181⤵PID:1760
-
\??\c:\tnbhnt.exec:\tnbhnt.exe182⤵PID:1896
-
\??\c:\thtbbh.exec:\thtbbh.exe183⤵PID:1924
-
\??\c:\jvpvj.exec:\jvpvj.exe184⤵PID:2052
-
\??\c:\vpvdj.exec:\vpvdj.exe185⤵PID:2240
-
\??\c:\frlrrxr.exec:\frlrrxr.exe186⤵PID:1932
-
\??\c:\rlxfxfr.exec:\rlxfxfr.exe187⤵PID:1052
-
\??\c:\5bnbnn.exec:\5bnbnn.exe188⤵PID:972
-
\??\c:\vpddd.exec:\vpddd.exe189⤵PID:348
-
\??\c:\vjvdp.exec:\vjvdp.exe190⤵PID:2872
-
\??\c:\rlxflrx.exec:\rlxflrx.exe191⤵PID:1120
-
\??\c:\rflffxr.exec:\rflffxr.exe192⤵PID:1008
-
\??\c:\3bnbhn.exec:\3bnbhn.exe193⤵PID:880
-
\??\c:\btbtbt.exec:\btbtbt.exe194⤵PID:1604
-
\??\c:\9dvpp.exec:\9dvpp.exe195⤵PID:2844
-
\??\c:\dvdjp.exec:\dvdjp.exe196⤵PID:2480
-
\??\c:\rxlfrxf.exec:\rxlfrxf.exe197⤵PID:572
-
\??\c:\3lxxflx.exec:\3lxxflx.exe198⤵PID:1568
-
\??\c:\3tbbtt.exec:\3tbbtt.exe199⤵PID:2316
-
\??\c:\btbhtb.exec:\btbhtb.exe200⤵PID:2920
-
\??\c:\5jpvj.exec:\5jpvj.exe201⤵PID:3016
-
\??\c:\jdddd.exec:\jdddd.exe202⤵PID:1512
-
\??\c:\3lxrxff.exec:\3lxrxff.exe203⤵PID:2492
-
\??\c:\lffflff.exec:\lffflff.exe204⤵PID:2628
-
\??\c:\9hnthh.exec:\9hnthh.exe205⤵PID:2708
-
\??\c:\nbbbnn.exec:\nbbbnn.exe206⤵PID:1028
-
\??\c:\9dvjd.exec:\9dvjd.exe207⤵PID:2420
-
\??\c:\1pdjp.exec:\1pdjp.exe208⤵PID:2408
-
\??\c:\rfllllr.exec:\rfllllr.exe209⤵PID:2444
-
\??\c:\flxxfxx.exec:\flxxfxx.exe210⤵PID:2292
-
\??\c:\nhhntn.exec:\nhhntn.exe211⤵PID:3068
-
\??\c:\9bhtht.exec:\9bhtht.exe212⤵PID:2464
-
\??\c:\1vdpp.exec:\1vdpp.exe213⤵PID:2720
-
\??\c:\1vddd.exec:\1vddd.exe214⤵PID:2668
-
\??\c:\5lrxxff.exec:\5lrxxff.exe215⤵PID:1544
-
\??\c:\7lrrffl.exec:\7lrrffl.exe216⤵PID:2124
-
\??\c:\thnhhh.exec:\thnhhh.exe217⤵PID:1260
-
\??\c:\9nhbnn.exec:\9nhbnn.exe218⤵PID:804
-
\??\c:\1dppp.exec:\1dppp.exe219⤵PID:2132
-
\??\c:\9jvvj.exec:\9jvvj.exe220⤵PID:1636
-
\??\c:\frlflrx.exec:\frlflrx.exe221⤵PID:3064
-
\??\c:\lfflrlr.exec:\lfflrlr.exe222⤵PID:2012
-
\??\c:\lfrxffl.exec:\lfrxffl.exe223⤵PID:2344
-
\??\c:\7tbthh.exec:\7tbthh.exe224⤵PID:1488
-
\??\c:\bhbtbh.exec:\bhbtbh.exe225⤵PID:1628
-
\??\c:\3pvvp.exec:\3pvvp.exe226⤵PID:324
-
\??\c:\7rfxflx.exec:\7rfxflx.exe227⤵PID:2060
-
\??\c:\fxrxfll.exec:\fxrxfll.exe228⤵PID:2352
-
\??\c:\htbnnh.exec:\htbnnh.exe229⤵PID:544
-
\??\c:\ntbbtt.exec:\ntbbtt.exe230⤵PID:1396
-
\??\c:\1jddv.exec:\1jddv.exe231⤵PID:2116
-
\??\c:\5vppv.exec:\5vppv.exe232⤵PID:1660
-
\??\c:\9pddj.exec:\9pddj.exe233⤵PID:3028
-
\??\c:\lfrxffr.exec:\lfrxffr.exe234⤵PID:1776
-
\??\c:\7tbtbb.exec:\7tbtbb.exe235⤵PID:844
-
\??\c:\bbnhnn.exec:\bbnhnn.exe236⤵PID:3048
-
\??\c:\vjppj.exec:\vjppj.exe237⤵PID:2156
-
\??\c:\5pjpj.exec:\5pjpj.exe238⤵PID:976
-
\??\c:\pvdpp.exec:\pvdpp.exe239⤵PID:2936
-
\??\c:\rllxlrx.exec:\rllxlrx.exe240⤵PID:1920
-
\??\c:\xxxxfxr.exec:\xxxxfxr.exe241⤵PID:1916
-
\??\c:\tntbnn.exec:\tntbnn.exe242⤵PID:2956