Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 15:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e26007e4db2359cc2a4e052765839f70_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
e26007e4db2359cc2a4e052765839f70_NeikiAnalytics.exe
-
Size
65KB
-
MD5
e26007e4db2359cc2a4e052765839f70
-
SHA1
f32cb25597a63e106df79d3fe0b37cbcac00ea2c
-
SHA256
603cccfe76c4f9bd06a8cee8289a76480a84f54401c0e9fd74e23080dc737d81
-
SHA512
0716768eed2e0ab87f8abf7ab0d19807fae32ba9b9a757a473dd0ffecdafb11532325d67ad3c14be71298f8d9314f5690a772673afc3a1cbcbd3690c062eb796
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfc:ymb3NkkiQ3mdBjFI4V4
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/2104-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2140-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1968-49-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1968-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-87-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3004-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1784-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2112-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1548-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1828-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1584-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1156-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1308-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2216-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
tntthh.exepjpvd.exejvppd.exefxfxxfl.exepjdjv.exedvvvp.exefxrrxfl.exerlfrxlr.exethnntb.exe9djvd.exe5xllllx.exelxlflfl.exe3ttbhn.exe9bnbhn.exe1jvvj.exexrxflrf.exerlflrrf.exetnbnth.exebthhtb.exevvpvd.exejddjp.exexrrrffr.exe7lfflrf.exebthhnn.exebnbbbb.exedvjpd.exelxllllr.exefrrllll.exe7hbtbt.exevpdjp.exe7jjjd.exe9xllfxf.exe1xlllrx.exehbhnnn.exevjppp.exejvjdd.exerfrxffl.exerxfrlll.exetnbbhb.exebthbbb.exe5btnbb.exedvjdp.exedvpdp.exelfrrxxf.exe5lxxrrx.exehtbttt.exe9bnthh.exepdjpp.exevjjdd.exefrrrxrx.exe1xxffff.exexlrllfl.exebthhnh.exethbthh.exepjvpv.exe7pddd.exe1flxxrx.exe3lxfxfr.exenbbttt.exenbthtt.exe7httbn.exeppvvv.exedjjjv.exelxllxfr.exepid process 2140 tntthh.exe 2612 pjpvd.exe 2740 jvppd.exe 1968 fxfxxfl.exe 2648 pjdjv.exe 2692 dvvvp.exe 2476 fxrrxfl.exe 3004 rlfrxlr.exe 1784 thnntb.exe 2860 9djvd.exe 2664 5xllllx.exe 1512 lxlflfl.exe 2112 3ttbhn.exe 1548 9bnbhn.exe 1828 1jvvj.exe 976 xrxflrf.exe 2556 rlflrrf.exe 1584 tnbnth.exe 1156 bthhtb.exe 1976 vvpvd.exe 1948 jddjp.exe 1696 xrrrffr.exe 2056 7lfflrf.exe 2136 bthhnn.exe 2092 bnbbbb.exe 1308 dvjpd.exe 336 lxllllr.exe 556 frrllll.exe 2552 7hbtbt.exe 2216 vpdjp.exe 1652 7jjjd.exe 2372 9xllfxf.exe 2652 1xlllrx.exe 2124 hbhnnn.exe 2712 vjppp.exe 2736 jvjdd.exe 1508 rfrxffl.exe 2572 rxfrlll.exe 1968 tnbbhb.exe 2632 bthbbb.exe 2604 5btnbb.exe 2532 dvjdp.exe 3000 dvpdp.exe 3048 lfrrxxf.exe 2804 5lxxrrx.exe 2840 htbttt.exe 2980 9bnthh.exe 836 pdjpp.exe 1644 vjjdd.exe 2452 frrrxrx.exe 2112 1xxffff.exe 316 xlrllfl.exe 2528 bthhnh.exe 3032 thbthh.exe 584 pjvpv.exe 2028 7pddd.exe 1172 1flxxrx.exe 1156 3lxfxfr.exe 3020 nbbttt.exe 2800 nbthtt.exe 1992 7httbn.exe 2920 ppvvv.exe 2348 djjjv.exe 1944 lxllxfr.exe -
Processes:
resource yara_rule behavioral1/memory/2104-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1968-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1784-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2112-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1548-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1828-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1584-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1156-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1308-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-285-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e26007e4db2359cc2a4e052765839f70_NeikiAnalytics.exetntthh.exepjpvd.exejvppd.exefxfxxfl.exepjdjv.exedvvvp.exefxrrxfl.exerlfrxlr.exethnntb.exe9djvd.exe5xllllx.exelxlflfl.exe3ttbhn.exe9bnbhn.exe1jvvj.exedescription pid process target process PID 2104 wrote to memory of 2140 2104 e26007e4db2359cc2a4e052765839f70_NeikiAnalytics.exe tntthh.exe PID 2104 wrote to memory of 2140 2104 e26007e4db2359cc2a4e052765839f70_NeikiAnalytics.exe tntthh.exe PID 2104 wrote to memory of 2140 2104 e26007e4db2359cc2a4e052765839f70_NeikiAnalytics.exe tntthh.exe PID 2104 wrote to memory of 2140 2104 e26007e4db2359cc2a4e052765839f70_NeikiAnalytics.exe tntthh.exe PID 2140 wrote to memory of 2612 2140 tntthh.exe pjpvd.exe PID 2140 wrote to memory of 2612 2140 tntthh.exe pjpvd.exe PID 2140 wrote to memory of 2612 2140 tntthh.exe pjpvd.exe PID 2140 wrote to memory of 2612 2140 tntthh.exe pjpvd.exe PID 2612 wrote to memory of 2740 2612 pjpvd.exe jvppd.exe PID 2612 wrote to memory of 2740 2612 pjpvd.exe jvppd.exe PID 2612 wrote to memory of 2740 2612 pjpvd.exe jvppd.exe PID 2612 wrote to memory of 2740 2612 pjpvd.exe jvppd.exe PID 2740 wrote to memory of 1968 2740 jvppd.exe fxfxxfl.exe PID 2740 wrote to memory of 1968 2740 jvppd.exe fxfxxfl.exe PID 2740 wrote to memory of 1968 2740 jvppd.exe fxfxxfl.exe PID 2740 wrote to memory of 1968 2740 jvppd.exe fxfxxfl.exe PID 1968 wrote to memory of 2648 1968 fxfxxfl.exe pjdjv.exe PID 1968 wrote to memory of 2648 1968 fxfxxfl.exe pjdjv.exe PID 1968 wrote to memory of 2648 1968 fxfxxfl.exe pjdjv.exe PID 1968 wrote to memory of 2648 1968 fxfxxfl.exe pjdjv.exe PID 2648 wrote to memory of 2692 2648 pjdjv.exe dvvvp.exe PID 2648 wrote to memory of 2692 2648 pjdjv.exe dvvvp.exe PID 2648 wrote to memory of 2692 2648 pjdjv.exe dvvvp.exe PID 2648 wrote to memory of 2692 2648 pjdjv.exe dvvvp.exe PID 2692 wrote to memory of 2476 2692 dvvvp.exe fxrrxfl.exe PID 2692 wrote to memory of 2476 2692 dvvvp.exe fxrrxfl.exe PID 2692 wrote to memory of 2476 2692 dvvvp.exe fxrrxfl.exe PID 2692 wrote to memory of 2476 2692 dvvvp.exe fxrrxfl.exe PID 2476 wrote to memory of 3004 2476 fxrrxfl.exe rlfrxlr.exe PID 2476 wrote to memory of 3004 2476 fxrrxfl.exe rlfrxlr.exe PID 2476 wrote to memory of 3004 2476 fxrrxfl.exe rlfrxlr.exe PID 2476 wrote to memory of 3004 2476 fxrrxfl.exe rlfrxlr.exe PID 3004 wrote to memory of 1784 3004 rlfrxlr.exe thnntb.exe PID 3004 wrote to memory of 1784 3004 rlfrxlr.exe thnntb.exe PID 3004 wrote to memory of 1784 3004 rlfrxlr.exe thnntb.exe PID 3004 wrote to memory of 1784 3004 rlfrxlr.exe thnntb.exe PID 1784 wrote to memory of 2860 1784 thnntb.exe 9djvd.exe PID 1784 wrote to memory of 2860 1784 thnntb.exe 9djvd.exe PID 1784 wrote to memory of 2860 1784 thnntb.exe 9djvd.exe PID 1784 wrote to memory of 2860 1784 thnntb.exe 9djvd.exe PID 2860 wrote to memory of 2664 2860 9djvd.exe 5xllllx.exe PID 2860 wrote to memory of 2664 2860 9djvd.exe 5xllllx.exe PID 2860 wrote to memory of 2664 2860 9djvd.exe 5xllllx.exe PID 2860 wrote to memory of 2664 2860 9djvd.exe 5xllllx.exe PID 2664 wrote to memory of 1512 2664 5xllllx.exe lxlflfl.exe PID 2664 wrote to memory of 1512 2664 5xllllx.exe lxlflfl.exe PID 2664 wrote to memory of 1512 2664 5xllllx.exe lxlflfl.exe PID 2664 wrote to memory of 1512 2664 5xllllx.exe lxlflfl.exe PID 1512 wrote to memory of 2112 1512 lxlflfl.exe 3ttbhn.exe PID 1512 wrote to memory of 2112 1512 lxlflfl.exe 3ttbhn.exe PID 1512 wrote to memory of 2112 1512 lxlflfl.exe 3ttbhn.exe PID 1512 wrote to memory of 2112 1512 lxlflfl.exe 3ttbhn.exe PID 2112 wrote to memory of 1548 2112 3ttbhn.exe 9bnbhn.exe PID 2112 wrote to memory of 1548 2112 3ttbhn.exe 9bnbhn.exe PID 2112 wrote to memory of 1548 2112 3ttbhn.exe 9bnbhn.exe PID 2112 wrote to memory of 1548 2112 3ttbhn.exe 9bnbhn.exe PID 1548 wrote to memory of 1828 1548 9bnbhn.exe 1jvvj.exe PID 1548 wrote to memory of 1828 1548 9bnbhn.exe 1jvvj.exe PID 1548 wrote to memory of 1828 1548 9bnbhn.exe 1jvvj.exe PID 1548 wrote to memory of 1828 1548 9bnbhn.exe 1jvvj.exe PID 1828 wrote to memory of 976 1828 1jvvj.exe xrxflrf.exe PID 1828 wrote to memory of 976 1828 1jvvj.exe xrxflrf.exe PID 1828 wrote to memory of 976 1828 1jvvj.exe xrxflrf.exe PID 1828 wrote to memory of 976 1828 1jvvj.exe xrxflrf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e26007e4db2359cc2a4e052765839f70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e26007e4db2359cc2a4e052765839f70_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\tntthh.exec:\tntthh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\pjpvd.exec:\pjpvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\jvppd.exec:\jvppd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\fxfxxfl.exec:\fxfxxfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\pjdjv.exec:\pjdjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\dvvvp.exec:\dvvvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\fxrrxfl.exec:\fxrrxfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\rlfrxlr.exec:\rlfrxlr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\thnntb.exec:\thnntb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\9djvd.exec:\9djvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\5xllllx.exec:\5xllllx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\lxlflfl.exec:\lxlflfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\3ttbhn.exec:\3ttbhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\9bnbhn.exec:\9bnbhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\1jvvj.exec:\1jvvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\xrxflrf.exec:\xrxflrf.exe17⤵
- Executes dropped EXE
PID:976 -
\??\c:\rlflrrf.exec:\rlflrrf.exe18⤵
- Executes dropped EXE
PID:2556 -
\??\c:\tnbnth.exec:\tnbnth.exe19⤵
- Executes dropped EXE
PID:1584 -
\??\c:\bthhtb.exec:\bthhtb.exe20⤵
- Executes dropped EXE
PID:1156 -
\??\c:\vvpvd.exec:\vvpvd.exe21⤵
- Executes dropped EXE
PID:1976 -
\??\c:\jddjp.exec:\jddjp.exe22⤵
- Executes dropped EXE
PID:1948 -
\??\c:\xrrrffr.exec:\xrrrffr.exe23⤵
- Executes dropped EXE
PID:1696 -
\??\c:\7lfflrf.exec:\7lfflrf.exe24⤵
- Executes dropped EXE
PID:2056 -
\??\c:\bthhnn.exec:\bthhnn.exe25⤵
- Executes dropped EXE
PID:2136 -
\??\c:\bnbbbb.exec:\bnbbbb.exe26⤵
- Executes dropped EXE
PID:2092 -
\??\c:\dvjpd.exec:\dvjpd.exe27⤵
- Executes dropped EXE
PID:1308 -
\??\c:\lxllllr.exec:\lxllllr.exe28⤵
- Executes dropped EXE
PID:336 -
\??\c:\frrllll.exec:\frrllll.exe29⤵
- Executes dropped EXE
PID:556 -
\??\c:\7hbtbt.exec:\7hbtbt.exe30⤵
- Executes dropped EXE
PID:2552 -
\??\c:\vpdjp.exec:\vpdjp.exe31⤵
- Executes dropped EXE
PID:2216 -
\??\c:\7jjjd.exec:\7jjjd.exe32⤵
- Executes dropped EXE
PID:1652 -
\??\c:\9xllfxf.exec:\9xllfxf.exe33⤵
- Executes dropped EXE
PID:2372 -
\??\c:\1xlllrx.exec:\1xlllrx.exe34⤵
- Executes dropped EXE
PID:2652 -
\??\c:\hbhnnn.exec:\hbhnnn.exe35⤵
- Executes dropped EXE
PID:2124 -
\??\c:\vjppp.exec:\vjppp.exe36⤵
- Executes dropped EXE
PID:2712 -
\??\c:\jvjdd.exec:\jvjdd.exe37⤵
- Executes dropped EXE
PID:2736 -
\??\c:\rfrxffl.exec:\rfrxffl.exe38⤵
- Executes dropped EXE
PID:1508 -
\??\c:\rxfrlll.exec:\rxfrlll.exe39⤵
- Executes dropped EXE
PID:2572 -
\??\c:\tnbbhb.exec:\tnbbhb.exe40⤵
- Executes dropped EXE
PID:1968 -
\??\c:\bthbbb.exec:\bthbbb.exe41⤵
- Executes dropped EXE
PID:2632 -
\??\c:\5btnbb.exec:\5btnbb.exe42⤵
- Executes dropped EXE
PID:2604 -
\??\c:\dvjdp.exec:\dvjdp.exe43⤵
- Executes dropped EXE
PID:2532 -
\??\c:\dvpdp.exec:\dvpdp.exe44⤵
- Executes dropped EXE
PID:3000 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe45⤵
- Executes dropped EXE
PID:3048 -
\??\c:\5lxxrrx.exec:\5lxxrrx.exe46⤵
- Executes dropped EXE
PID:2804 -
\??\c:\htbttt.exec:\htbttt.exe47⤵
- Executes dropped EXE
PID:2840 -
\??\c:\9bnthh.exec:\9bnthh.exe48⤵
- Executes dropped EXE
PID:2980 -
\??\c:\pdjpp.exec:\pdjpp.exe49⤵
- Executes dropped EXE
PID:836 -
\??\c:\vjjdd.exec:\vjjdd.exe50⤵
- Executes dropped EXE
PID:1644 -
\??\c:\frrrxrx.exec:\frrrxrx.exe51⤵
- Executes dropped EXE
PID:2452 -
\??\c:\1xxffff.exec:\1xxffff.exe52⤵
- Executes dropped EXE
PID:2112 -
\??\c:\xlrllfl.exec:\xlrllfl.exe53⤵
- Executes dropped EXE
PID:316 -
\??\c:\bthhnh.exec:\bthhnh.exe54⤵
- Executes dropped EXE
PID:2528 -
\??\c:\thbthh.exec:\thbthh.exe55⤵
- Executes dropped EXE
PID:3032 -
\??\c:\pjvpv.exec:\pjvpv.exe56⤵
- Executes dropped EXE
PID:584 -
\??\c:\7pddd.exec:\7pddd.exe57⤵
- Executes dropped EXE
PID:2028 -
\??\c:\1flxxrx.exec:\1flxxrx.exe58⤵
- Executes dropped EXE
PID:1172 -
\??\c:\3lxfxfr.exec:\3lxfxfr.exe59⤵
- Executes dropped EXE
PID:1156 -
\??\c:\nbbttt.exec:\nbbttt.exe60⤵
- Executes dropped EXE
PID:3020 -
\??\c:\nbthtt.exec:\nbthtt.exe61⤵
- Executes dropped EXE
PID:2800 -
\??\c:\7httbn.exec:\7httbn.exe62⤵
- Executes dropped EXE
PID:1992 -
\??\c:\ppvvv.exec:\ppvvv.exe63⤵
- Executes dropped EXE
PID:2920 -
\??\c:\djjjv.exec:\djjjv.exe64⤵
- Executes dropped EXE
PID:2348 -
\??\c:\lxllxfr.exec:\lxllxfr.exe65⤵
- Executes dropped EXE
PID:1944 -
\??\c:\frrrxff.exec:\frrrxff.exe66⤵PID:2092
-
\??\c:\tntbnn.exec:\tntbnn.exe67⤵PID:1672
-
\??\c:\ttbbhh.exec:\ttbbhh.exe68⤵PID:916
-
\??\c:\vpdjv.exec:\vpdjv.exe69⤵PID:336
-
\??\c:\dpdjj.exec:\dpdjj.exe70⤵PID:2388
-
\??\c:\9djdd.exec:\9djdd.exe71⤵PID:2964
-
\??\c:\lfrxrrr.exec:\lfrxrrr.exe72⤵PID:2276
-
\??\c:\rxfxrll.exec:\rxfxrll.exe73⤵PID:1552
-
\??\c:\thtnth.exec:\thtnth.exe74⤵PID:2104
-
\??\c:\nhtbhn.exec:\nhtbhn.exe75⤵PID:2380
-
\??\c:\3dvdj.exec:\3dvdj.exe76⤵PID:2576
-
\??\c:\jdvpv.exec:\jdvpv.exe77⤵PID:2612
-
\??\c:\lxrlrll.exec:\lxrlrll.exe78⤵PID:2712
-
\??\c:\lxxxxrr.exec:\lxxxxrr.exe79⤵PID:2376
-
\??\c:\nhhbhn.exec:\nhhbhn.exe80⤵PID:2600
-
\??\c:\nhbnnt.exec:\nhbnnt.exe81⤵PID:2572
-
\??\c:\nbhttn.exec:\nbhttn.exe82⤵PID:2748
-
\??\c:\1vpjp.exec:\1vpjp.exe83⤵PID:2632
-
\??\c:\dpdvp.exec:\dpdvp.exe84⤵PID:2604
-
\??\c:\lfrrrrx.exec:\lfrrrrx.exe85⤵PID:2532
-
\??\c:\rflllfl.exec:\rflllfl.exe86⤵PID:2480
-
\??\c:\bhtnnh.exec:\bhtnnh.exe87⤵PID:3048
-
\??\c:\nhnntt.exec:\nhnntt.exe88⤵PID:2812
-
\??\c:\pjpjj.exec:\pjpjj.exe89⤵PID:2840
-
\??\c:\3dvjj.exec:\3dvjj.exe90⤵PID:2988
-
\??\c:\9dpdd.exec:\9dpdd.exe91⤵PID:836
-
\??\c:\3fxrllr.exec:\3fxrllr.exe92⤵PID:2188
-
\??\c:\lxllrrr.exec:\lxllrrr.exe93⤵PID:2452
-
\??\c:\7tnhtt.exec:\7tnhtt.exe94⤵PID:1372
-
\??\c:\9ttttt.exec:\9ttttt.exe95⤵PID:316
-
\??\c:\pjvpv.exec:\pjvpv.exe96⤵PID:1828
-
\??\c:\1dppv.exec:\1dppv.exe97⤵PID:3032
-
\??\c:\lxlllll.exec:\lxlllll.exe98⤵PID:1048
-
\??\c:\xrllxfr.exec:\xrllxfr.exe99⤵PID:2028
-
\??\c:\bbhnnn.exec:\bbhnnn.exe100⤵PID:2044
-
\??\c:\5tnnnt.exec:\5tnnnt.exe101⤵PID:1156
-
\??\c:\nhntnh.exec:\nhntnh.exe102⤵PID:1996
-
\??\c:\7vjjj.exec:\7vjjj.exe103⤵PID:2800
-
\??\c:\pdjjj.exec:\pdjjj.exe104⤵PID:1924
-
\??\c:\7lxxxxf.exec:\7lxxxxf.exe105⤵PID:2920
-
\??\c:\xrllxxl.exec:\xrllxxl.exe106⤵PID:2348
-
\??\c:\ffrxxfl.exec:\ffrxxfl.exe107⤵PID:1944
-
\??\c:\thnttb.exec:\thnttb.exe108⤵PID:2924
-
\??\c:\hhtbhh.exec:\hhtbhh.exe109⤵PID:1672
-
\??\c:\hbhnnn.exec:\hbhnnn.exe110⤵PID:944
-
\??\c:\vvjpd.exec:\vvjpd.exe111⤵PID:336
-
\??\c:\jvvpj.exec:\jvvpj.exe112⤵PID:2400
-
\??\c:\fxrxfff.exec:\fxrxfff.exe113⤵PID:2964
-
\??\c:\5xrfllx.exec:\5xrfllx.exe114⤵PID:1884
-
\??\c:\7tthnn.exec:\7tthnn.exe115⤵PID:1552
-
\??\c:\3htttt.exec:\3htttt.exe116⤵PID:2368
-
\??\c:\pjpvj.exec:\pjpvj.exe117⤵PID:2380
-
\??\c:\vjdvv.exec:\vjdvv.exe118⤵PID:1912
-
\??\c:\xrrxxfl.exec:\xrrxxfl.exe119⤵PID:2612
-
\??\c:\xrxxxfx.exec:\xrxxxfx.exe120⤵PID:2700
-
\??\c:\xlxfrrx.exec:\xlxfrrx.exe121⤵PID:2376
-
\??\c:\nhhhht.exec:\nhhhht.exe122⤵PID:1508
-
\??\c:\9nhnbb.exec:\9nhnbb.exe123⤵PID:2572
-
\??\c:\9vvjj.exec:\9vvjj.exe124⤵PID:1968
-
\??\c:\3jdjd.exec:\3jdjd.exe125⤵PID:2632
-
\??\c:\5xfxxrx.exec:\5xfxxrx.exe126⤵PID:2604
-
\??\c:\xxlxlrx.exec:\xxlxlrx.exe127⤵PID:1760
-
\??\c:\tnbtbn.exec:\tnbtbn.exe128⤵PID:3000
-
\??\c:\7bttbb.exec:\7bttbb.exe129⤵PID:2828
-
\??\c:\hbhhnh.exec:\hbhhnh.exe130⤵PID:2804
-
\??\c:\vpdjv.exec:\vpdjv.exe131⤵PID:2840
-
\??\c:\dpvjj.exec:\dpvjj.exe132⤵PID:2980
-
\??\c:\xlxxlfr.exec:\xlxxlfr.exe133⤵PID:836
-
\??\c:\xlrlrlx.exec:\xlrlrlx.exe134⤵PID:1644
-
\??\c:\hbnnnn.exec:\hbnnnn.exe135⤵PID:2452
-
\??\c:\1jvvd.exec:\1jvvd.exe136⤵PID:2112
-
\??\c:\rfxfxfl.exec:\rfxfxfl.exe137⤵PID:316
-
\??\c:\frxxlll.exec:\frxxlll.exe138⤵PID:2528
-
\??\c:\fxllllx.exec:\fxllllx.exe139⤵PID:3032
-
\??\c:\1httbh.exec:\1httbh.exe140⤵PID:584
-
\??\c:\hbnnbb.exec:\hbnnbb.exe141⤵PID:2028
-
\??\c:\dpvpd.exec:\dpvpd.exe142⤵PID:1092
-
\??\c:\vjvvj.exec:\vjvvj.exe143⤵PID:2152
-
\??\c:\1rllrrx.exec:\1rllrrx.exe144⤵PID:1852
-
\??\c:\fxllllr.exec:\fxllllr.exe145⤵PID:1736
-
\??\c:\bttntn.exec:\bttntn.exe146⤵PID:896
-
\??\c:\hhthbb.exec:\hhthbb.exe147⤵PID:2352
-
\??\c:\thnhhh.exec:\thnhhh.exe148⤵PID:1072
-
\??\c:\jdjpd.exec:\jdjpd.exe149⤵PID:1944
-
\??\c:\pjvdd.exec:\pjvdd.exe150⤵PID:2924
-
\??\c:\1rrlllx.exec:\1rrlllx.exe151⤵PID:2268
-
\??\c:\rlrxxfl.exec:\rlrxxfl.exe152⤵PID:944
-
\??\c:\rfrrflr.exec:\rfrrflr.exe153⤵PID:632
-
\??\c:\7thnnh.exec:\7thnnh.exe154⤵PID:296
-
\??\c:\tntbnn.exec:\tntbnn.exe155⤵PID:1704
-
\??\c:\5nnhnt.exec:\5nnhnt.exe156⤵PID:2276
-
\??\c:\1pjjv.exec:\1pjjv.exe157⤵PID:1552
-
\??\c:\pdpvj.exec:\pdpvj.exe158⤵PID:2104
-
\??\c:\xrxxxxf.exec:\xrxxxxf.exe159⤵PID:2380
-
\??\c:\rlrxffr.exec:\rlrxffr.exe160⤵PID:2576
-
\??\c:\hhtbnn.exec:\hhtbnn.exe161⤵PID:2472
-
\??\c:\thnbbh.exec:\thnbbh.exe162⤵PID:2712
-
\??\c:\dvddj.exec:\dvddj.exe163⤵PID:2376
-
\??\c:\dvdjp.exec:\dvdjp.exe164⤵PID:2600
-
\??\c:\jdpdj.exec:\jdpdj.exe165⤵PID:2572
-
\??\c:\5rlfflr.exec:\5rlfflr.exe166⤵PID:2748
-
\??\c:\5xrxrrf.exec:\5xrxrrf.exe167⤵PID:2632
-
\??\c:\hbbhnn.exec:\hbbhnn.exe168⤵PID:2476
-
\??\c:\3httbh.exec:\3httbh.exe169⤵PID:1236
-
\??\c:\vpdjj.exec:\vpdjj.exe170⤵PID:2480
-
\??\c:\jdvvv.exec:\jdvvv.exe171⤵PID:2976
-
\??\c:\lxlffxf.exec:\lxlffxf.exe172⤵PID:2812
-
\??\c:\xrxfxxr.exec:\xrxfxxr.exe173⤵PID:2840
-
\??\c:\nhbttn.exec:\nhbttn.exe174⤵PID:2988
-
\??\c:\tnhntt.exec:\tnhntt.exe175⤵PID:1456
-
\??\c:\btbtbh.exec:\btbtbh.exe176⤵PID:2188
-
\??\c:\vpvvd.exec:\vpvvd.exe177⤵PID:2452
-
\??\c:\1pddv.exec:\1pddv.exe178⤵PID:1372
-
\??\c:\rlllrxl.exec:\rlllrxl.exe179⤵PID:316
-
\??\c:\fxlrrxr.exec:\fxlrrxr.exe180⤵PID:1828
-
\??\c:\nhnntt.exec:\nhnntt.exe181⤵PID:3032
-
\??\c:\5nnnnn.exec:\5nnnnn.exe182⤵PID:1976
-
\??\c:\ttthhn.exec:\ttthhn.exe183⤵PID:2028
-
\??\c:\dpddd.exec:\dpddd.exe184⤵PID:1172
-
\??\c:\dpjjp.exec:\dpjjp.exe185⤵PID:1956
-
\??\c:\lxxfxxf.exec:\lxxfxxf.exe186⤵PID:3016
-
\??\c:\xrfrxxx.exec:\xrfrxxx.exe187⤵PID:1472
-
\??\c:\9thbhb.exec:\9thbhb.exe188⤵PID:896
-
\??\c:\3hhbhh.exec:\3hhbhh.exe189⤵PID:948
-
\??\c:\jddvv.exec:\jddvv.exe190⤵PID:2348
-
\??\c:\pjjpv.exec:\pjjpv.exe191⤵PID:1944
-
\??\c:\1xfffll.exec:\1xfffll.exe192⤵PID:2240
-
\??\c:\lllrfll.exec:\lllrfll.exe193⤵PID:916
-
\??\c:\lxffffl.exec:\lxffffl.exe194⤵PID:2788
-
\??\c:\hbntbb.exec:\hbntbb.exe195⤵PID:632
-
\??\c:\hbtthh.exec:\hbtthh.exe196⤵PID:1940
-
\??\c:\5pjpd.exec:\5pjpd.exe197⤵PID:2384
-
\??\c:\pddvj.exec:\pddvj.exe198⤵PID:1884
-
\??\c:\frlllxl.exec:\frlllxl.exe199⤵PID:1552
-
\??\c:\lrxxxrl.exec:\lrxxxrl.exe200⤵PID:2368
-
\??\c:\7bntbn.exec:\7bntbn.exe201⤵PID:2380
-
\??\c:\7hbntt.exec:\7hbntt.exe202⤵PID:2592
-
\??\c:\nbhbbb.exec:\nbhbbb.exe203⤵PID:2472
-
\??\c:\dvpdd.exec:\dvpdd.exe204⤵PID:2700
-
\??\c:\1vdvd.exec:\1vdvd.exe205⤵PID:2376
-
\??\c:\xrxxffl.exec:\xrxxffl.exe206⤵PID:1508
-
\??\c:\flxrrrf.exec:\flxrrrf.exe207⤵PID:2572
-
\??\c:\hbntbh.exec:\hbntbh.exe208⤵PID:1968
-
\??\c:\bnbtnn.exec:\bnbtnn.exe209⤵PID:2632
-
\??\c:\hthnnn.exec:\hthnnn.exe210⤵PID:2604
-
\??\c:\7dpvj.exec:\7dpvj.exe211⤵PID:1236
-
\??\c:\pjpjj.exec:\pjpjj.exe212⤵PID:2668
-
\??\c:\rlrrrrx.exec:\rlrrrrx.exe213⤵PID:2976
-
\??\c:\lflrxfl.exec:\lflrxfl.exe214⤵PID:2804
-
\??\c:\hbtbnt.exec:\hbtbnt.exe215⤵PID:2840
-
\??\c:\btbbnn.exec:\btbbnn.exe216⤵PID:2980
-
\??\c:\nhnnnt.exec:\nhnnnt.exe217⤵PID:672
-
\??\c:\pjvpv.exec:\pjvpv.exe218⤵PID:1644
-
\??\c:\dvdjp.exec:\dvdjp.exe219⤵PID:2452
-
\??\c:\7rxxfll.exec:\7rxxfll.exe220⤵PID:2112
-
\??\c:\lrfffxx.exec:\lrfffxx.exe221⤵PID:2772
-
\??\c:\3hnnnh.exec:\3hnnnh.exe222⤵PID:2528
-
\??\c:\ttntbb.exec:\ttntbb.exe223⤵PID:2252
-
\??\c:\dvpvd.exec:\dvpvd.exe224⤵PID:1048
-
\??\c:\dpvvd.exec:\dpvvd.exe225⤵PID:2028
-
\??\c:\lflrflx.exec:\lflrflx.exe226⤵PID:1092
-
\??\c:\fxrxffr.exec:\fxrxffr.exe227⤵PID:1956
-
\??\c:\htbbhh.exec:\htbbhh.exe228⤵PID:3020
-
\??\c:\nhnnbh.exec:\nhnnbh.exe229⤵PID:1472
-
\??\c:\vpjjd.exec:\vpjjd.exe230⤵PID:408
-
\??\c:\rfrrffr.exec:\rfrrffr.exe231⤵PID:948
-
\??\c:\fxffrlr.exec:\fxffrlr.exe232⤵PID:1072
-
\??\c:\7bbtbh.exec:\7bbtbh.exe233⤵PID:1944
-
\??\c:\thbthh.exec:\thbthh.exe234⤵PID:2924
-
\??\c:\vpddp.exec:\vpddp.exe235⤵PID:1556
-
\??\c:\jvdvv.exec:\jvdvv.exe236⤵PID:2788
-
\??\c:\lxxrffr.exec:\lxxrffr.exe237⤵PID:1700
-
\??\c:\rfffffl.exec:\rfffffl.exe238⤵PID:1940
-
\??\c:\bthhnn.exec:\bthhnn.exe239⤵PID:2100
-
\??\c:\bbnhtt.exec:\bbnhtt.exe240⤵PID:2416
-
\??\c:\1hbntt.exec:\1hbntt.exe241⤵PID:2704
-
\??\c:\9pvpp.exec:\9pvpp.exe242⤵PID:2608