Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 17:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
09c9fbfe87d9137bb06a270c30d328f0_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
09c9fbfe87d9137bb06a270c30d328f0_NeikiAnalytics.exe
-
Size
78KB
-
MD5
09c9fbfe87d9137bb06a270c30d328f0
-
SHA1
21d45091f67d923d58da20c0b8dd0315e8437dba
-
SHA256
d314c3dd04d179cd85b33bc53b0348ba09c5334c7b884d25d28fd6dd2ab80d56
-
SHA512
6c968cf95686881f0e884bfab9a7083e754d4d074080a1d7957552d60c6b72eabe264728a3c470061798347ec33463e1877a9970c728c3f980dfb1475da19b1e
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAX8YieVIJclPvPJtcdcv:ymb3NkkiQ3mdBjFo68YBVIJc9Jtxv
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/2824-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2260-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1624-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1028-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1840-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/868-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/288-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1744-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1712-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1432-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/716-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2024-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1784-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1600-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1892-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
hbnbbt.exebnttbt.exe3jddd.exexrfflxf.exenhttbn.exebnbbht.exevpvpd.exevjvvj.exepppvj.exe7lrrllf.exexrxffff.exehttthn.exethbhhb.exejdpjd.exe5vpvp.exepdpjp.exerlrffrf.exe5fllrrx.exe7bhhhh.exebntbhh.exehhhnht.exe5vvdv.exejdjvj.exexrrffxx.exerfllrll.exerfrxllr.exe1ttbbh.exevpddv.exevjvpp.exejvdpp.exerxfllll.exe5ffxllx.exebthhnh.exenhtthn.exe7thhbb.exepddpj.exejvddd.exerlxrxfl.exelflflff.exe5xrlllr.exetnttbb.exenbbnht.exenhntbt.exejvvvv.exe3pvjj.exejvddd.exefrfrlff.exefrfffff.exerfffxrr.exetbtnbt.exethhhbt.exe1ntnhh.exejvvdd.exe9pdjd.exe5jvvj.exe7lrffxx.exerlrrxfl.exebtbhnt.exe3bhhnt.exe5hnnnn.exehtbnnn.exepjvvd.exepjjvv.exe9jpjp.exepid process 2260 hbnbbt.exe 2700 bnttbt.exe 1624 3jddd.exe 2536 xrfflxf.exe 2732 nhttbn.exe 1620 bnbbht.exe 2696 vpvpd.exe 2520 vjvvj.exe 2528 pppvj.exe 2808 7lrrllf.exe 1892 xrxffff.exe 1600 httthn.exe 1784 thbhhb.exe 2024 jdpjd.exe 708 5vpvp.exe 1264 pdpjp.exe 1704 rlrffrf.exe 2300 5fllrrx.exe 2508 7bhhhh.exe 1028 bntbhh.exe 716 hhhnht.exe 1432 5vvdv.exe 1712 jdjvj.exe 1744 xrrffxx.exe 700 rfllrll.exe 288 rfrxllr.exe 720 1ttbbh.exe 868 vpddv.exe 1840 vjvpp.exe 1444 jvdpp.exe 2724 rxfllll.exe 2216 5ffxllx.exe 2240 bthhnh.exe 2220 nhtthn.exe 2800 7thhbb.exe 2548 pddpj.exe 2632 jvddd.exe 2720 rlxrxfl.exe 2876 lflflff.exe 1296 5xrlllr.exe 2412 tnttbb.exe 2840 nbbnht.exe 2984 nhntbt.exe 1832 jvvvv.exe 2168 3pvjj.exe 2544 jvddd.exe 2132 frfrlff.exe 1916 frfffff.exe 2328 rfffxrr.exe 1756 tbtnbt.exe 1032 thhhbt.exe 2476 1ntnhh.exe 2864 jvvdd.exe 3068 9pdjd.exe 1368 5jvvj.exe 532 7lrffxx.exe 2440 rlrrxfl.exe 328 btbhnt.exe 272 3bhhnt.exe 1824 5hnnnn.exe 1204 htbnnn.exe 2032 pjvvd.exe 2956 pjjvv.exe 2896 9jpjp.exe -
Processes:
resource yara_rule behavioral1/memory/2824-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2260-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1624-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1624-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1624-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1028-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1840-283-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/868-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/288-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1744-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1712-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1432-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/716-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1784-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1600-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1892-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-45-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
09c9fbfe87d9137bb06a270c30d328f0_NeikiAnalytics.exehbnbbt.exebnttbt.exe3jddd.exexrfflxf.exenhttbn.exebnbbht.exevpvpd.exevjvvj.exepppvj.exe7lrrllf.exexrxffff.exehttthn.exethbhhb.exejdpjd.exe5vpvp.exedescription pid process target process PID 2824 wrote to memory of 2260 2824 09c9fbfe87d9137bb06a270c30d328f0_NeikiAnalytics.exe hbnbbt.exe PID 2824 wrote to memory of 2260 2824 09c9fbfe87d9137bb06a270c30d328f0_NeikiAnalytics.exe hbnbbt.exe PID 2824 wrote to memory of 2260 2824 09c9fbfe87d9137bb06a270c30d328f0_NeikiAnalytics.exe hbnbbt.exe PID 2824 wrote to memory of 2260 2824 09c9fbfe87d9137bb06a270c30d328f0_NeikiAnalytics.exe hbnbbt.exe PID 2260 wrote to memory of 2700 2260 hbnbbt.exe bnttbt.exe PID 2260 wrote to memory of 2700 2260 hbnbbt.exe bnttbt.exe PID 2260 wrote to memory of 2700 2260 hbnbbt.exe bnttbt.exe PID 2260 wrote to memory of 2700 2260 hbnbbt.exe bnttbt.exe PID 2700 wrote to memory of 1624 2700 bnttbt.exe 3jddd.exe PID 2700 wrote to memory of 1624 2700 bnttbt.exe 3jddd.exe PID 2700 wrote to memory of 1624 2700 bnttbt.exe 3jddd.exe PID 2700 wrote to memory of 1624 2700 bnttbt.exe 3jddd.exe PID 1624 wrote to memory of 2536 1624 3jddd.exe xrfflxf.exe PID 1624 wrote to memory of 2536 1624 3jddd.exe xrfflxf.exe PID 1624 wrote to memory of 2536 1624 3jddd.exe xrfflxf.exe PID 1624 wrote to memory of 2536 1624 3jddd.exe xrfflxf.exe PID 2536 wrote to memory of 2732 2536 xrfflxf.exe nhttbn.exe PID 2536 wrote to memory of 2732 2536 xrfflxf.exe nhttbn.exe PID 2536 wrote to memory of 2732 2536 xrfflxf.exe nhttbn.exe PID 2536 wrote to memory of 2732 2536 xrfflxf.exe nhttbn.exe PID 2732 wrote to memory of 1620 2732 nhttbn.exe bnbbht.exe PID 2732 wrote to memory of 1620 2732 nhttbn.exe bnbbht.exe PID 2732 wrote to memory of 1620 2732 nhttbn.exe bnbbht.exe PID 2732 wrote to memory of 1620 2732 nhttbn.exe bnbbht.exe PID 1620 wrote to memory of 2696 1620 bnbbht.exe vpvpd.exe PID 1620 wrote to memory of 2696 1620 bnbbht.exe vpvpd.exe PID 1620 wrote to memory of 2696 1620 bnbbht.exe vpvpd.exe PID 1620 wrote to memory of 2696 1620 bnbbht.exe vpvpd.exe PID 2696 wrote to memory of 2520 2696 vpvpd.exe vjvvj.exe PID 2696 wrote to memory of 2520 2696 vpvpd.exe vjvvj.exe PID 2696 wrote to memory of 2520 2696 vpvpd.exe vjvvj.exe PID 2696 wrote to memory of 2520 2696 vpvpd.exe vjvvj.exe PID 2520 wrote to memory of 2528 2520 vjvvj.exe pppvj.exe PID 2520 wrote to memory of 2528 2520 vjvvj.exe pppvj.exe PID 2520 wrote to memory of 2528 2520 vjvvj.exe pppvj.exe PID 2520 wrote to memory of 2528 2520 vjvvj.exe pppvj.exe PID 2528 wrote to memory of 2808 2528 pppvj.exe 7lrrllf.exe PID 2528 wrote to memory of 2808 2528 pppvj.exe 7lrrllf.exe PID 2528 wrote to memory of 2808 2528 pppvj.exe 7lrrllf.exe PID 2528 wrote to memory of 2808 2528 pppvj.exe 7lrrllf.exe PID 2808 wrote to memory of 1892 2808 7lrrllf.exe xrxffff.exe PID 2808 wrote to memory of 1892 2808 7lrrllf.exe xrxffff.exe PID 2808 wrote to memory of 1892 2808 7lrrllf.exe xrxffff.exe PID 2808 wrote to memory of 1892 2808 7lrrllf.exe xrxffff.exe PID 1892 wrote to memory of 1600 1892 xrxffff.exe httthn.exe PID 1892 wrote to memory of 1600 1892 xrxffff.exe httthn.exe PID 1892 wrote to memory of 1600 1892 xrxffff.exe httthn.exe PID 1892 wrote to memory of 1600 1892 xrxffff.exe httthn.exe PID 1600 wrote to memory of 1784 1600 httthn.exe thbhhb.exe PID 1600 wrote to memory of 1784 1600 httthn.exe thbhhb.exe PID 1600 wrote to memory of 1784 1600 httthn.exe thbhhb.exe PID 1600 wrote to memory of 1784 1600 httthn.exe thbhhb.exe PID 1784 wrote to memory of 2024 1784 thbhhb.exe jdpjd.exe PID 1784 wrote to memory of 2024 1784 thbhhb.exe jdpjd.exe PID 1784 wrote to memory of 2024 1784 thbhhb.exe jdpjd.exe PID 1784 wrote to memory of 2024 1784 thbhhb.exe jdpjd.exe PID 2024 wrote to memory of 708 2024 jdpjd.exe 5vpvp.exe PID 2024 wrote to memory of 708 2024 jdpjd.exe 5vpvp.exe PID 2024 wrote to memory of 708 2024 jdpjd.exe 5vpvp.exe PID 2024 wrote to memory of 708 2024 jdpjd.exe 5vpvp.exe PID 708 wrote to memory of 1264 708 5vpvp.exe pdpjp.exe PID 708 wrote to memory of 1264 708 5vpvp.exe pdpjp.exe PID 708 wrote to memory of 1264 708 5vpvp.exe pdpjp.exe PID 708 wrote to memory of 1264 708 5vpvp.exe pdpjp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\09c9fbfe87d9137bb06a270c30d328f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\09c9fbfe87d9137bb06a270c30d328f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\hbnbbt.exec:\hbnbbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\bnttbt.exec:\bnttbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\3jddd.exec:\3jddd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\xrfflxf.exec:\xrfflxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\nhttbn.exec:\nhttbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\bnbbht.exec:\bnbbht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\vpvpd.exec:\vpvpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\vjvvj.exec:\vjvvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\pppvj.exec:\pppvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\7lrrllf.exec:\7lrrllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\xrxffff.exec:\xrxffff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\httthn.exec:\httthn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\thbhhb.exec:\thbhhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\jdpjd.exec:\jdpjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\5vpvp.exec:\5vpvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
\??\c:\pdpjp.exec:\pdpjp.exe17⤵
- Executes dropped EXE
PID:1264 -
\??\c:\rlrffrf.exec:\rlrffrf.exe18⤵
- Executes dropped EXE
PID:1704 -
\??\c:\5fllrrx.exec:\5fllrrx.exe19⤵
- Executes dropped EXE
PID:2300 -
\??\c:\7bhhhh.exec:\7bhhhh.exe20⤵
- Executes dropped EXE
PID:2508 -
\??\c:\bntbhh.exec:\bntbhh.exe21⤵
- Executes dropped EXE
PID:1028 -
\??\c:\hhhnht.exec:\hhhnht.exe22⤵
- Executes dropped EXE
PID:716 -
\??\c:\5vvdv.exec:\5vvdv.exe23⤵
- Executes dropped EXE
PID:1432 -
\??\c:\jdjvj.exec:\jdjvj.exe24⤵
- Executes dropped EXE
PID:1712 -
\??\c:\xrrffxx.exec:\xrrffxx.exe25⤵
- Executes dropped EXE
PID:1744 -
\??\c:\rfllrll.exec:\rfllrll.exe26⤵
- Executes dropped EXE
PID:700 -
\??\c:\rfrxllr.exec:\rfrxllr.exe27⤵
- Executes dropped EXE
PID:288 -
\??\c:\1ttbbh.exec:\1ttbbh.exe28⤵
- Executes dropped EXE
PID:720 -
\??\c:\vpddv.exec:\vpddv.exe29⤵
- Executes dropped EXE
PID:868 -
\??\c:\vjvpp.exec:\vjvpp.exe30⤵
- Executes dropped EXE
PID:1840 -
\??\c:\jvdpp.exec:\jvdpp.exe31⤵
- Executes dropped EXE
PID:1444 -
\??\c:\rxfllll.exec:\rxfllll.exe32⤵
- Executes dropped EXE
PID:2724 -
\??\c:\5ffxllx.exec:\5ffxllx.exe33⤵
- Executes dropped EXE
PID:2216 -
\??\c:\bthhnh.exec:\bthhnh.exe34⤵
- Executes dropped EXE
PID:2240 -
\??\c:\nhtthn.exec:\nhtthn.exe35⤵
- Executes dropped EXE
PID:2220 -
\??\c:\7thhbb.exec:\7thhbb.exe36⤵
- Executes dropped EXE
PID:2800 -
\??\c:\pddpj.exec:\pddpj.exe37⤵
- Executes dropped EXE
PID:2548 -
\??\c:\jvddd.exec:\jvddd.exe38⤵
- Executes dropped EXE
PID:2632 -
\??\c:\rlxrxfl.exec:\rlxrxfl.exe39⤵
- Executes dropped EXE
PID:2720 -
\??\c:\lflflff.exec:\lflflff.exe40⤵
- Executes dropped EXE
PID:2876 -
\??\c:\5xrlllr.exec:\5xrlllr.exe41⤵
- Executes dropped EXE
PID:1296 -
\??\c:\tnttbb.exec:\tnttbb.exe42⤵
- Executes dropped EXE
PID:2412 -
\??\c:\nbbnht.exec:\nbbnht.exe43⤵
- Executes dropped EXE
PID:2840 -
\??\c:\nhntbt.exec:\nhntbt.exe44⤵
- Executes dropped EXE
PID:2984 -
\??\c:\jvvvv.exec:\jvvvv.exe45⤵
- Executes dropped EXE
PID:1832 -
\??\c:\3pvjj.exec:\3pvjj.exe46⤵
- Executes dropped EXE
PID:2168 -
\??\c:\jvddd.exec:\jvddd.exe47⤵
- Executes dropped EXE
PID:2544 -
\??\c:\frfrlff.exec:\frfrlff.exe48⤵
- Executes dropped EXE
PID:2132 -
\??\c:\frfffff.exec:\frfffff.exe49⤵
- Executes dropped EXE
PID:1916 -
\??\c:\rfffxrr.exec:\rfffxrr.exe50⤵
- Executes dropped EXE
PID:2328 -
\??\c:\tbtnbt.exec:\tbtnbt.exe51⤵
- Executes dropped EXE
PID:1756 -
\??\c:\thhhbt.exec:\thhhbt.exe52⤵
- Executes dropped EXE
PID:1032 -
\??\c:\1ntnhh.exec:\1ntnhh.exe53⤵
- Executes dropped EXE
PID:2476 -
\??\c:\jvvdd.exec:\jvvdd.exe54⤵
- Executes dropped EXE
PID:2864 -
\??\c:\9pdjd.exec:\9pdjd.exe55⤵
- Executes dropped EXE
PID:3068 -
\??\c:\5jvvj.exec:\5jvvj.exe56⤵
- Executes dropped EXE
PID:1368 -
\??\c:\7lrffxx.exec:\7lrffxx.exe57⤵
- Executes dropped EXE
PID:532 -
\??\c:\rlrrxfl.exec:\rlrrxfl.exe58⤵
- Executes dropped EXE
PID:2440 -
\??\c:\btbhnt.exec:\btbhnt.exe59⤵
- Executes dropped EXE
PID:328 -
\??\c:\3bhhnt.exec:\3bhhnt.exe60⤵
- Executes dropped EXE
PID:272 -
\??\c:\5hnnnn.exec:\5hnnnn.exe61⤵
- Executes dropped EXE
PID:1824 -
\??\c:\htbnnn.exec:\htbnnn.exe62⤵
- Executes dropped EXE
PID:1204 -
\??\c:\pjvvd.exec:\pjvvd.exe63⤵
- Executes dropped EXE
PID:2032 -
\??\c:\pjjvv.exec:\pjjvv.exe64⤵
- Executes dropped EXE
PID:2956 -
\??\c:\9jpjp.exec:\9jpjp.exe65⤵
- Executes dropped EXE
PID:2896 -
\??\c:\9lxxrrx.exec:\9lxxrrx.exe66⤵PID:2236
-
\??\c:\lflrxrf.exec:\lflrxrf.exe67⤵PID:1612
-
\??\c:\7lxrlff.exec:\7lxrlff.exe68⤵PID:920
-
\??\c:\nbnnnt.exec:\nbnnnt.exe69⤵PID:1728
-
\??\c:\bnbttn.exec:\bnbttn.exe70⤵PID:588
-
\??\c:\3bhntt.exec:\3bhntt.exe71⤵PID:1548
-
\??\c:\5nbnhb.exec:\5nbnhb.exe72⤵PID:2912
-
\??\c:\3jppj.exec:\3jppj.exe73⤵PID:2084
-
\??\c:\1djdp.exec:\1djdp.exe74⤵PID:2860
-
\??\c:\dpvpj.exec:\dpvpj.exe75⤵PID:1888
-
\??\c:\fxfffxx.exec:\fxfffxx.exe76⤵PID:2600
-
\??\c:\1lrlrll.exec:\1lrlrll.exe77⤵PID:2512
-
\??\c:\lfflrll.exec:\lfflrll.exe78⤵PID:1616
-
\??\c:\xlllrrl.exec:\xlllrrl.exe79⤵PID:2668
-
\??\c:\thnhbt.exec:\thnhbt.exe80⤵PID:2716
-
\??\c:\9thhtt.exec:\9thhtt.exe81⤵PID:2852
-
\??\c:\thtttt.exec:\thtttt.exe82⤵PID:2788
-
\??\c:\nhnhth.exec:\nhnhth.exe83⤵PID:2540
-
\??\c:\vpvvv.exec:\vpvvv.exe84⤵PID:1568
-
\??\c:\pdddv.exec:\pdddv.exe85⤵PID:2664
-
\??\c:\3pdjd.exec:\3pdjd.exe86⤵PID:2176
-
\??\c:\djvjd.exec:\djvjd.exe87⤵PID:1436
-
\??\c:\xrxrxrl.exec:\xrxrxrl.exe88⤵PID:2444
-
\??\c:\xllxxrr.exec:\xllxxrr.exe89⤵PID:1880
-
\??\c:\lfrfrrx.exec:\lfrfrrx.exe90⤵PID:2008
-
\??\c:\9lxxlff.exec:\9lxxlff.exe91⤵PID:2332
-
\??\c:\thtthh.exec:\thtthh.exe92⤵PID:308
-
\??\c:\9bnnnh.exec:\9bnnnh.exe93⤵PID:2296
-
\??\c:\7httth.exec:\7httth.exe94⤵PID:1372
-
\??\c:\pdjjd.exec:\pdjjd.exe95⤵PID:1908
-
\??\c:\dpvvp.exec:\dpvvp.exe96⤵PID:540
-
\??\c:\jpvvp.exec:\jpvvp.exe97⤵PID:2136
-
\??\c:\vjvjd.exec:\vjvjd.exe98⤵PID:2336
-
\??\c:\xlrxfff.exec:\xlrxfff.exe99⤵PID:976
-
\??\c:\7xlflxx.exec:\7xlflxx.exe100⤵PID:2848
-
\??\c:\5rrxxxx.exec:\5rrxxxx.exe101⤵PID:2972
-
\??\c:\5xlrlff.exec:\5xlrlff.exe102⤵PID:776
-
\??\c:\5nbhbb.exec:\5nbhbb.exe103⤵PID:1576
-
\??\c:\nbttnh.exec:\nbttnh.exe104⤵PID:276
-
\??\c:\9hthbt.exec:\9hthbt.exe105⤵PID:1584
-
\??\c:\3htttn.exec:\3htttn.exe106⤵PID:2284
-
\??\c:\vjjdv.exec:\vjjdv.exe107⤵PID:2756
-
\??\c:\1jvvv.exec:\1jvvv.exe108⤵PID:1840
-
\??\c:\jvjjp.exec:\jvjjp.exe109⤵PID:2252
-
\??\c:\fxlfxrr.exec:\fxlfxrr.exe110⤵PID:2052
-
\??\c:\frffrlr.exec:\frffrlr.exe111⤵PID:1540
-
\??\c:\xlllffl.exec:\xlllffl.exe112⤵PID:2844
-
\??\c:\frxxxxf.exec:\frxxxxf.exe113⤵PID:2708
-
\??\c:\tbnnhb.exec:\tbnnhb.exe114⤵PID:2572
-
\??\c:\bthtnt.exec:\bthtnt.exe115⤵PID:2500
-
\??\c:\lxflffx.exec:\lxflffx.exe116⤵PID:2592
-
\??\c:\frffxrr.exec:\frffxrr.exe117⤵PID:2548
-
\??\c:\lfrfrrr.exec:\lfrfrrr.exe118⤵PID:2596
-
\??\c:\nbhhhb.exec:\nbhhhb.exe119⤵PID:2376
-
\??\c:\thtnnh.exec:\thtnnh.exe120⤵PID:2436
-
\??\c:\tnhnnn.exec:\tnhnnn.exe121⤵PID:2696
-
\??\c:\pvjdv.exec:\pvjdv.exe122⤵PID:2628
-
\??\c:\jdpvp.exec:\jdpvp.exe123⤵PID:2516
-
\??\c:\dvddd.exec:\dvddd.exe124⤵PID:1476
-
\??\c:\9dpjp.exec:\9dpjp.exe125⤵PID:1552
-
\??\c:\5rxllfl.exec:\5rxllfl.exe126⤵PID:2036
-
\??\c:\rflllxl.exec:\rflllxl.exe127⤵PID:344
-
\??\c:\3rxlxlx.exec:\3rxlxlx.exe128⤵PID:2184
-
\??\c:\nbhhnt.exec:\nbhhnt.exe129⤵PID:2164
-
\??\c:\nbhntt.exec:\nbhntt.exe130⤵PID:2044
-
\??\c:\9htnhb.exec:\9htnhb.exe131⤵PID:1720
-
\??\c:\dpjjj.exec:\dpjjj.exe132⤵PID:292
-
\??\c:\5vjpv.exec:\5vjpv.exe133⤵PID:2000
-
\??\c:\jvvpp.exec:\jvvpp.exe134⤵PID:2968
-
\??\c:\vjdvv.exec:\vjdvv.exe135⤵PID:1056
-
\??\c:\xrrrfll.exec:\xrrrfll.exe136⤵PID:2468
-
\??\c:\5frxrrr.exec:\5frxrrr.exe137⤵PID:604
-
\??\c:\5xfffff.exec:\5xfffff.exe138⤵PID:1960
-
\??\c:\hnhtth.exec:\hnhtth.exe139⤵PID:800
-
\??\c:\1nbbnn.exec:\1nbbnn.exe140⤵PID:788
-
\??\c:\htbhhh.exec:\htbhhh.exe141⤵PID:2348
-
\??\c:\jvddd.exec:\jvddd.exe142⤵PID:1684
-
\??\c:\vjvvd.exec:\vjvvd.exe143⤵PID:700
-
\??\c:\vjdjj.exec:\vjdjj.exe144⤵PID:928
-
\??\c:\lxffxfr.exec:\lxffxfr.exe145⤵PID:3056
-
\??\c:\xllffxf.exec:\xllffxf.exe146⤵PID:2112
-
\??\c:\5htnnn.exec:\5htnnn.exe147⤵PID:2108
-
\??\c:\vjvvv.exec:\vjvvv.exe148⤵PID:644
-
\??\c:\ffrfllr.exec:\ffrfllr.exe149⤵PID:3048
-
\??\c:\frflflf.exec:\frflflf.exe150⤵PID:1840
-
\??\c:\5nhtnb.exec:\5nhtnb.exe151⤵PID:2252
-
\??\c:\3jvpv.exec:\3jvpv.exe152⤵PID:588
-
\??\c:\jjvvd.exec:\jjvvd.exe153⤵PID:2208
-
\??\c:\xlxfrrf.exec:\xlxfrrf.exe154⤵PID:2844
-
\??\c:\bnhhnt.exec:\bnhhnt.exe155⤵PID:2084
-
\??\c:\9jpjj.exec:\9jpjj.exe156⤵PID:1536
-
\??\c:\jvpjp.exec:\jvpjp.exe157⤵PID:2560
-
\??\c:\9lxfllr.exec:\9lxfllr.exe158⤵PID:1208
-
\??\c:\tnhhhn.exec:\tnhhhn.exe159⤵PID:2568
-
\??\c:\9dppd.exec:\9dppd.exe160⤵PID:2596
-
\??\c:\rlxrxrl.exec:\rlxrxrl.exe161⤵PID:2684
-
\??\c:\nhtbhb.exec:\nhtbhb.exe162⤵PID:2716
-
\??\c:\3vjpv.exec:\3vjpv.exe163⤵PID:1580
-
\??\c:\pdjvv.exec:\pdjvv.exe164⤵PID:2520
-
\??\c:\xflflll.exec:\xflflll.exe165⤵PID:1036
-
\??\c:\ntbttn.exec:\ntbttn.exe166⤵PID:1568
-
\??\c:\7vjvv.exec:\7vjvv.exe167⤵PID:2664
-
\??\c:\1rlfrxr.exec:\1rlfrxr.exe168⤵PID:1284
-
\??\c:\5xlrlrl.exec:\5xlrlrl.exe169⤵PID:2688
-
\??\c:\bbthtt.exec:\bbthtt.exe170⤵PID:2020
-
\??\c:\jvvjj.exec:\jvvjj.exe171⤵PID:1260
-
\??\c:\7rlffrx.exec:\7rlffrx.exe172⤵PID:2044
-
\??\c:\thnhnh.exec:\thnhnh.exe173⤵PID:1592
-
\??\c:\dpddv.exec:\dpddv.exe174⤵PID:1704
-
\??\c:\dvdjv.exec:\dvdjv.exe175⤵PID:3028
-
\??\c:\frffxfl.exec:\frffxfl.exe176⤵PID:1992
-
\??\c:\htbbbb.exec:\htbbbb.exe177⤵PID:3068
-
\??\c:\nbhntt.exec:\nbhntt.exe178⤵PID:488
-
\??\c:\dpvvd.exec:\dpvvd.exe179⤵PID:1416
-
\??\c:\xxllfrl.exec:\xxllfrl.exe180⤵PID:1432
-
\??\c:\bthhnn.exec:\bthhnn.exe181⤵PID:976
-
\??\c:\9hbbbb.exec:\9hbbbb.exe182⤵PID:272
-
\??\c:\pdpjd.exec:\pdpjd.exe183⤵PID:820
-
\??\c:\1frrlxr.exec:\1frrlxr.exe184⤵PID:1204
-
\??\c:\rfrlrlr.exec:\rfrlrlr.exe185⤵PID:2032
-
\??\c:\bnbbhh.exec:\bnbbhh.exe186⤵PID:472
-
\??\c:\jvpdj.exec:\jvpdj.exe187⤵PID:720
-
\??\c:\7rxxxxx.exec:\7rxxxxx.exe188⤵PID:2112
-
\??\c:\7xrrxfl.exec:\7xrrxfl.exe189⤵PID:2756
-
\??\c:\hbhhnn.exec:\hbhhnn.exe190⤵PID:2224
-
\??\c:\3vdvp.exec:\3vdvp.exe191⤵PID:1116
-
\??\c:\7rfxllx.exec:\7rfxllx.exe192⤵PID:1336
-
\??\c:\bnbnhb.exec:\bnbnhb.exe193⤵PID:2216
-
\??\c:\dvdvv.exec:\dvdvv.exe194⤵PID:2240
-
\??\c:\pdjjj.exec:\pdjjj.exe195⤵PID:2268
-
\??\c:\lfllxxx.exec:\lfllxxx.exe196⤵PID:2676
-
\??\c:\ffrfrfl.exec:\ffrfrfl.exe197⤵PID:1624
-
\??\c:\1ntttb.exec:\1ntttb.exe198⤵PID:2608
-
\??\c:\pdjjj.exec:\pdjjj.exe199⤵PID:2536
-
\??\c:\1xflffx.exec:\1xflffx.exe200⤵PID:2660
-
\??\c:\9thnhh.exec:\9thnhh.exe201⤵PID:2876
-
\??\c:\jdpvv.exec:\jdpvv.exe202⤵PID:2452
-
\??\c:\pdpjp.exec:\pdpjp.exe203⤵PID:2684
-
\??\c:\fxffllr.exec:\fxffllr.exe204⤵PID:2824
-
\??\c:\lxxrlfl.exec:\lxxrlfl.exe205⤵PID:1652
-
\??\c:\nttttn.exec:\nttttn.exe206⤵PID:1900
-
\??\c:\1pjpj.exec:\1pjpj.exe207⤵PID:1800
-
\??\c:\lrrxfxx.exec:\lrrxfxx.exe208⤵PID:1568
-
\??\c:\3rflrrr.exec:\3rflrrr.exe209⤵PID:2304
-
\??\c:\bnttbt.exec:\bnttbt.exe210⤵PID:1788
-
\??\c:\3vdjj.exec:\3vdjj.exe211⤵PID:2444
-
\??\c:\lrrfxlx.exec:\lrrfxlx.exe212⤵PID:708
-
\??\c:\nbhbth.exec:\nbhbth.exe213⤵PID:1588
-
\??\c:\jdvvd.exec:\jdvvd.exe214⤵PID:1820
-
\??\c:\dvdvv.exec:\dvdvv.exe215⤵PID:1528
-
\??\c:\lflxrlr.exec:\lflxrlr.exe216⤵PID:1704
-
\??\c:\5fffffr.exec:\5fffffr.exe217⤵PID:2704
-
\??\c:\frlffxf.exec:\frlffxf.exe218⤵PID:336
-
\??\c:\5bttnh.exec:\5bttnh.exe219⤵PID:1028
-
\??\c:\tnnthh.exec:\tnnthh.exe220⤵PID:1796
-
\??\c:\dpvvv.exec:\dpvvv.exe221⤵PID:2336
-
\??\c:\pjdjv.exec:\pjdjv.exe222⤵PID:1432
-
\??\c:\3lrrrll.exec:\3lrrrll.exe223⤵PID:976
-
\??\c:\xrfflfl.exec:\xrfflfl.exe224⤵PID:452
-
\??\c:\bnbtbb.exec:\bnbtbb.exe225⤵PID:3016
-
\??\c:\3nthhh.exec:\3nthhh.exe226⤵PID:112
-
\??\c:\pddvd.exec:\pddvd.exe227⤵PID:828
-
\??\c:\3xrxlll.exec:\3xrxlll.exe228⤵PID:596
-
\??\c:\fxrrlrf.exec:\fxrrlrf.exe229⤵PID:836
-
\??\c:\hthnnb.exec:\hthnnb.exe230⤵PID:2424
-
\??\c:\9jdjv.exec:\9jdjv.exe231⤵PID:868
-
\??\c:\7pdvd.exec:\7pdvd.exe232⤵PID:2080
-
\??\c:\5xrrffr.exec:\5xrrffr.exe233⤵PID:2948
-
\??\c:\nhtthn.exec:\nhtthn.exe234⤵PID:2072
-
\??\c:\dpddv.exec:\dpddv.exe235⤵PID:2276
-
\??\c:\pjjdp.exec:\pjjdp.exe236⤵PID:3024
-
\??\c:\rrrxlrx.exec:\rrrxlrx.exe237⤵PID:2860
-
\??\c:\fxllrxf.exec:\fxllrxf.exe238⤵PID:1536
-
\??\c:\hbhnbt.exec:\hbhnbt.exe239⤵PID:2712
-
\??\c:\btnhhn.exec:\btnhhn.exe240⤵PID:2592
-
\??\c:\jjjdj.exec:\jjjdj.exe241⤵PID:1616
-
\??\c:\ddpjd.exec:\ddpjd.exe242⤵PID:2464