Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 00:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
668c716ee0b7aacde10c15a87e28a830_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
668c716ee0b7aacde10c15a87e28a830_NeikiAnalytics.exe
-
Size
67KB
-
MD5
668c716ee0b7aacde10c15a87e28a830
-
SHA1
d896a2eae9ff4bfc8de86bf87bbd4c4c1fb481ac
-
SHA256
04076b629cf599646aa48c9f4ec2af403369e66e902891a9e0b2dc3960dae3b9
-
SHA512
70b60dde2518372baa4c54add73342f1a4b52af3a14645facdb02253678d52c6af4fa928284341ae1852fd82d5dd2c1af340f9ed6725f3fd6c5a6f87f66df6d0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFdJUDbAIVZ:ymb3NkkiQ3mdBjFIFdJ8bf
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/2824-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2260-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1992-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2136-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/380-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/308-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2376-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
frrfxlx.exetnbtbb.exevpjjv.exe7rllllr.exettbbhn.exebttttt.exepjvvj.exelfxlfll.exexxxlfxl.exebhnnbt.exehbthbh.exe7pjjd.exe9flrxrx.exehttttb.exe1hbthn.exejjdpd.exe9xflrxx.exelxfxxrx.exe1ntntt.exepjpvv.exejjdjp.exelxxrlff.exethtbhn.exe1bntbb.exedpppp.exeppjpp.exexrxxxfl.exexlxfllr.exehbnhtb.exe9jdpp.exeppdpd.exefrlflff.exe7btbhn.exe3tbhhh.exepvjdp.exe7xrrxfl.exelfrfrfr.exennbttb.exenbnntb.exejdvpv.exe9pdvp.exefxxrxrr.exerrllxfr.exebtbhtt.exethttbh.exevpdjv.exejjvvv.exedvpvd.exe7xlxxfx.exefxflrxf.exetnhnbb.exe1dvpd.exevdvvd.exelrrlfxx.exexxrxllr.exe7hbntt.exe9tthth.exepjvpd.exeppjpj.exerrlrxrl.exe9flxxfr.exe7tnnbb.exebbntnn.exedvjjd.exepid process 2260 frrfxlx.exe 2700 tnbtbb.exe 2860 vpjjv.exe 2512 7rllllr.exe 2596 ttbbhn.exe 2652 bttttt.exe 2432 pjvvj.exe 2520 lfxlfll.exe 2456 xxxlfxl.exe 2952 bhnnbt.exe 1992 hbthbh.exe 2336 7pjjd.exe 2136 9flrxrx.exe 1824 httttb.exe 2032 1hbthn.exe 380 jjdpd.exe 308 9xflrxx.exe 300 lxfxxrx.exe 2772 1ntntt.exe 2504 pjpvv.exe 604 jjdjp.exe 1424 lxxrlff.exe 1900 thtbhn.exe 2376 1bntbb.exe 2052 dpppp.exe 1912 ppjpp.exe 932 xrxxxfl.exe 720 xlxfllr.exe 384 hbnhtb.exe 3040 9jdpp.exe 2124 ppdpd.exe 1700 frlflff.exe 1540 7btbhn.exe 2056 3tbhhh.exe 2084 pvjdp.exe 2260 7xrrxfl.exe 2500 lfrfrfr.exe 2600 nnbttb.exe 2548 nbnntb.exe 2668 jdvpv.exe 2620 9pdvp.exe 2876 fxxrxrr.exe 2684 rrllxfr.exe 2404 btbhtt.exe 2528 thttbh.exe 2456 vpdjv.exe 1908 jjvvv.exe 1832 dvpvd.exe 2036 7xlxxfx.exe 2336 fxflrxf.exe 2020 tnhnbb.exe 2004 1dvpd.exe 1916 vdvvd.exe 1828 lrrlfxx.exe 2332 xxrxllr.exe 2384 7hbntt.exe 2476 9tthth.exe 2356 pjvpd.exe 324 ppjpj.exe 540 rrlrxrl.exe 976 9flxxfr.exe 328 7tnnbb.exe 872 bbntnn.exe 1200 dvjjd.exe -
Processes:
resource yara_rule behavioral1/memory/2824-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2260-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1992-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2136-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/380-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/308-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-236-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
668c716ee0b7aacde10c15a87e28a830_NeikiAnalytics.exefrrfxlx.exetnbtbb.exevpjjv.exe7rllllr.exettbbhn.exebttttt.exepjvvj.exelfxlfll.exexxxlfxl.exebhnnbt.exehbthbh.exe7pjjd.exe9flrxrx.exehttttb.exe1hbthn.exedescription pid process target process PID 2824 wrote to memory of 2260 2824 668c716ee0b7aacde10c15a87e28a830_NeikiAnalytics.exe frrfxlx.exe PID 2824 wrote to memory of 2260 2824 668c716ee0b7aacde10c15a87e28a830_NeikiAnalytics.exe frrfxlx.exe PID 2824 wrote to memory of 2260 2824 668c716ee0b7aacde10c15a87e28a830_NeikiAnalytics.exe frrfxlx.exe PID 2824 wrote to memory of 2260 2824 668c716ee0b7aacde10c15a87e28a830_NeikiAnalytics.exe frrfxlx.exe PID 2260 wrote to memory of 2700 2260 frrfxlx.exe tnbtbb.exe PID 2260 wrote to memory of 2700 2260 frrfxlx.exe tnbtbb.exe PID 2260 wrote to memory of 2700 2260 frrfxlx.exe tnbtbb.exe PID 2260 wrote to memory of 2700 2260 frrfxlx.exe tnbtbb.exe PID 2700 wrote to memory of 2860 2700 tnbtbb.exe vpjjv.exe PID 2700 wrote to memory of 2860 2700 tnbtbb.exe vpjjv.exe PID 2700 wrote to memory of 2860 2700 tnbtbb.exe vpjjv.exe PID 2700 wrote to memory of 2860 2700 tnbtbb.exe vpjjv.exe PID 2860 wrote to memory of 2512 2860 vpjjv.exe 7rllllr.exe PID 2860 wrote to memory of 2512 2860 vpjjv.exe 7rllllr.exe PID 2860 wrote to memory of 2512 2860 vpjjv.exe 7rllllr.exe PID 2860 wrote to memory of 2512 2860 vpjjv.exe 7rllllr.exe PID 2512 wrote to memory of 2596 2512 7rllllr.exe ttbbhn.exe PID 2512 wrote to memory of 2596 2512 7rllllr.exe ttbbhn.exe PID 2512 wrote to memory of 2596 2512 7rllllr.exe ttbbhn.exe PID 2512 wrote to memory of 2596 2512 7rllllr.exe ttbbhn.exe PID 2596 wrote to memory of 2652 2596 ttbbhn.exe bttttt.exe PID 2596 wrote to memory of 2652 2596 ttbbhn.exe bttttt.exe PID 2596 wrote to memory of 2652 2596 ttbbhn.exe bttttt.exe PID 2596 wrote to memory of 2652 2596 ttbbhn.exe bttttt.exe PID 2652 wrote to memory of 2432 2652 bttttt.exe pjvvj.exe PID 2652 wrote to memory of 2432 2652 bttttt.exe pjvvj.exe PID 2652 wrote to memory of 2432 2652 bttttt.exe pjvvj.exe PID 2652 wrote to memory of 2432 2652 bttttt.exe pjvvj.exe PID 2432 wrote to memory of 2520 2432 pjvvj.exe lfxlfll.exe PID 2432 wrote to memory of 2520 2432 pjvvj.exe lfxlfll.exe PID 2432 wrote to memory of 2520 2432 pjvvj.exe lfxlfll.exe PID 2432 wrote to memory of 2520 2432 pjvvj.exe lfxlfll.exe PID 2520 wrote to memory of 2456 2520 lfxlfll.exe xxxlfxl.exe PID 2520 wrote to memory of 2456 2520 lfxlfll.exe xxxlfxl.exe PID 2520 wrote to memory of 2456 2520 lfxlfll.exe xxxlfxl.exe PID 2520 wrote to memory of 2456 2520 lfxlfll.exe xxxlfxl.exe PID 2456 wrote to memory of 2952 2456 xxxlfxl.exe bhnnbt.exe PID 2456 wrote to memory of 2952 2456 xxxlfxl.exe bhnnbt.exe PID 2456 wrote to memory of 2952 2456 xxxlfxl.exe bhnnbt.exe PID 2456 wrote to memory of 2952 2456 xxxlfxl.exe bhnnbt.exe PID 2952 wrote to memory of 1992 2952 bhnnbt.exe hbthbh.exe PID 2952 wrote to memory of 1992 2952 bhnnbt.exe hbthbh.exe PID 2952 wrote to memory of 1992 2952 bhnnbt.exe hbthbh.exe PID 2952 wrote to memory of 1992 2952 bhnnbt.exe hbthbh.exe PID 1992 wrote to memory of 2336 1992 hbthbh.exe 7pjjd.exe PID 1992 wrote to memory of 2336 1992 hbthbh.exe 7pjjd.exe PID 1992 wrote to memory of 2336 1992 hbthbh.exe 7pjjd.exe PID 1992 wrote to memory of 2336 1992 hbthbh.exe 7pjjd.exe PID 2336 wrote to memory of 2136 2336 7pjjd.exe 9flrxrx.exe PID 2336 wrote to memory of 2136 2336 7pjjd.exe 9flrxrx.exe PID 2336 wrote to memory of 2136 2336 7pjjd.exe 9flrxrx.exe PID 2336 wrote to memory of 2136 2336 7pjjd.exe 9flrxrx.exe PID 2136 wrote to memory of 1824 2136 9flrxrx.exe httttb.exe PID 2136 wrote to memory of 1824 2136 9flrxrx.exe httttb.exe PID 2136 wrote to memory of 1824 2136 9flrxrx.exe httttb.exe PID 2136 wrote to memory of 1824 2136 9flrxrx.exe httttb.exe PID 1824 wrote to memory of 2032 1824 httttb.exe 1hbthn.exe PID 1824 wrote to memory of 2032 1824 httttb.exe 1hbthn.exe PID 1824 wrote to memory of 2032 1824 httttb.exe 1hbthn.exe PID 1824 wrote to memory of 2032 1824 httttb.exe 1hbthn.exe PID 2032 wrote to memory of 380 2032 1hbthn.exe jjdpd.exe PID 2032 wrote to memory of 380 2032 1hbthn.exe jjdpd.exe PID 2032 wrote to memory of 380 2032 1hbthn.exe jjdpd.exe PID 2032 wrote to memory of 380 2032 1hbthn.exe jjdpd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\668c716ee0b7aacde10c15a87e28a830_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\668c716ee0b7aacde10c15a87e28a830_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\frrfxlx.exec:\frrfxlx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\tnbtbb.exec:\tnbtbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\vpjjv.exec:\vpjjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\7rllllr.exec:\7rllllr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\ttbbhn.exec:\ttbbhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\bttttt.exec:\bttttt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\pjvvj.exec:\pjvvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\lfxlfll.exec:\lfxlfll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\xxxlfxl.exec:\xxxlfxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\bhnnbt.exec:\bhnnbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\hbthbh.exec:\hbthbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\7pjjd.exec:\7pjjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\9flrxrx.exec:\9flrxrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\httttb.exec:\httttb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\1hbthn.exec:\1hbthn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\jjdpd.exec:\jjdpd.exe17⤵
- Executes dropped EXE
PID:380 -
\??\c:\9xflrxx.exec:\9xflrxx.exe18⤵
- Executes dropped EXE
PID:308 -
\??\c:\lxfxxrx.exec:\lxfxxrx.exe19⤵
- Executes dropped EXE
PID:300 -
\??\c:\1ntntt.exec:\1ntntt.exe20⤵
- Executes dropped EXE
PID:2772 -
\??\c:\pjpvv.exec:\pjpvv.exe21⤵
- Executes dropped EXE
PID:2504 -
\??\c:\jjdjp.exec:\jjdjp.exe22⤵
- Executes dropped EXE
PID:604 -
\??\c:\lxxrlff.exec:\lxxrlff.exe23⤵
- Executes dropped EXE
PID:1424 -
\??\c:\thtbhn.exec:\thtbhn.exe24⤵
- Executes dropped EXE
PID:1900 -
\??\c:\1bntbb.exec:\1bntbb.exe25⤵
- Executes dropped EXE
PID:2376 -
\??\c:\dpppp.exec:\dpppp.exe26⤵
- Executes dropped EXE
PID:2052 -
\??\c:\ppjpp.exec:\ppjpp.exe27⤵
- Executes dropped EXE
PID:1912 -
\??\c:\xrxxxfl.exec:\xrxxxfl.exe28⤵
- Executes dropped EXE
PID:932 -
\??\c:\xlxfllr.exec:\xlxfllr.exe29⤵
- Executes dropped EXE
PID:720 -
\??\c:\hbnhtb.exec:\hbnhtb.exe30⤵
- Executes dropped EXE
PID:384 -
\??\c:\9jdpp.exec:\9jdpp.exe31⤵
- Executes dropped EXE
PID:3040 -
\??\c:\ppdpd.exec:\ppdpd.exe32⤵
- Executes dropped EXE
PID:2124 -
\??\c:\frlflff.exec:\frlflff.exe33⤵
- Executes dropped EXE
PID:1700 -
\??\c:\7btbhn.exec:\7btbhn.exe34⤵
- Executes dropped EXE
PID:1540 -
\??\c:\3tbhhh.exec:\3tbhhh.exe35⤵
- Executes dropped EXE
PID:2056 -
\??\c:\pvjdp.exec:\pvjdp.exe36⤵
- Executes dropped EXE
PID:2084 -
\??\c:\7xrrxfl.exec:\7xrrxfl.exe37⤵
- Executes dropped EXE
PID:2260 -
\??\c:\lfrfrfr.exec:\lfrfrfr.exe38⤵
- Executes dropped EXE
PID:2500 -
\??\c:\nnbttb.exec:\nnbttb.exe39⤵
- Executes dropped EXE
PID:2600 -
\??\c:\nbnntb.exec:\nbnntb.exe40⤵
- Executes dropped EXE
PID:2548 -
\??\c:\jdvpv.exec:\jdvpv.exe41⤵
- Executes dropped EXE
PID:2668 -
\??\c:\9pdvp.exec:\9pdvp.exe42⤵
- Executes dropped EXE
PID:2620 -
\??\c:\fxxrxrr.exec:\fxxrxrr.exe43⤵
- Executes dropped EXE
PID:2876 -
\??\c:\rrllxfr.exec:\rrllxfr.exe44⤵
- Executes dropped EXE
PID:2684 -
\??\c:\btbhtt.exec:\btbhtt.exe45⤵
- Executes dropped EXE
PID:2404 -
\??\c:\thttbh.exec:\thttbh.exe46⤵
- Executes dropped EXE
PID:2528 -
\??\c:\vpdjv.exec:\vpdjv.exe47⤵
- Executes dropped EXE
PID:2456 -
\??\c:\jjvvv.exec:\jjvvv.exe48⤵
- Executes dropped EXE
PID:1908 -
\??\c:\dvpvd.exec:\dvpvd.exe49⤵
- Executes dropped EXE
PID:1832 -
\??\c:\7xlxxfx.exec:\7xlxxfx.exe50⤵
- Executes dropped EXE
PID:2036 -
\??\c:\fxflrxf.exec:\fxflrxf.exe51⤵
- Executes dropped EXE
PID:2336 -
\??\c:\tnhnbb.exec:\tnhnbb.exe52⤵
- Executes dropped EXE
PID:2020 -
\??\c:\1dvpd.exec:\1dvpd.exe53⤵
- Executes dropped EXE
PID:2004 -
\??\c:\vdvvd.exec:\vdvvd.exe54⤵
- Executes dropped EXE
PID:1916 -
\??\c:\lrrlfxx.exec:\lrrlfxx.exe55⤵
- Executes dropped EXE
PID:1828 -
\??\c:\xxrxllr.exec:\xxrxllr.exe56⤵
- Executes dropped EXE
PID:2332 -
\??\c:\7hbntt.exec:\7hbntt.exe57⤵
- Executes dropped EXE
PID:2384 -
\??\c:\9tthth.exec:\9tthth.exe58⤵
- Executes dropped EXE
PID:2476 -
\??\c:\pjvpd.exec:\pjvpd.exe59⤵
- Executes dropped EXE
PID:2356 -
\??\c:\ppjpj.exec:\ppjpj.exe60⤵
- Executes dropped EXE
PID:324 -
\??\c:\rrlrxrl.exec:\rrlrxrl.exe61⤵
- Executes dropped EXE
PID:540 -
\??\c:\9flxxfr.exec:\9flxxfr.exe62⤵
- Executes dropped EXE
PID:976 -
\??\c:\7tnnbb.exec:\7tnnbb.exe63⤵
- Executes dropped EXE
PID:328 -
\??\c:\bbntnn.exec:\bbntnn.exe64⤵
- Executes dropped EXE
PID:872 -
\??\c:\dvjjd.exec:\dvjjd.exe65⤵
- Executes dropped EXE
PID:1200 -
\??\c:\dddjv.exec:\dddjv.exe66⤵PID:1500
-
\??\c:\vvjpv.exec:\vvjpv.exe67⤵PID:1084
-
\??\c:\ffxxfrf.exec:\ffxxfrf.exe68⤵PID:1576
-
\??\c:\bthnbn.exec:\bthnbn.exe69⤵PID:3064
-
\??\c:\5tntbh.exec:\5tntbh.exe70⤵PID:2308
-
\??\c:\hhbhht.exec:\hhbhht.exe71⤵PID:572
-
\??\c:\7jddd.exec:\7jddd.exe72⤵PID:2756
-
\??\c:\dvjpd.exec:\dvjpd.exe73⤵PID:2940
-
\??\c:\ffrffrx.exec:\ffrffrx.exe74⤵PID:2852
-
\??\c:\5rlfflr.exec:\5rlfflr.exe75⤵PID:1384
-
\??\c:\hbnbnh.exec:\hbnbnh.exe76⤵PID:1548
-
\??\c:\9btnbb.exec:\9btnbb.exe77⤵PID:2220
-
\??\c:\1pppp.exec:\1pppp.exe78⤵PID:2204
-
\??\c:\vpddv.exec:\vpddv.exe79⤵PID:1616
-
\??\c:\lfxxffr.exec:\lfxxffr.exe80⤵PID:2708
-
\??\c:\3xlrflx.exec:\3xlrflx.exe81⤵PID:2856
-
\??\c:\xrrxllr.exec:\xrrxllr.exe82⤵PID:2532
-
\??\c:\3tnthn.exec:\3tnthn.exe83⤵PID:2732
-
\??\c:\hhtbnt.exec:\hhtbnt.exe84⤵PID:2444
-
\??\c:\5pjjv.exec:\5pjjv.exe85⤵PID:2580
-
\??\c:\vvjvj.exec:\vvjvj.exe86⤵PID:2316
-
\??\c:\rrlxffl.exec:\rrlxffl.exe87⤵PID:2452
-
\??\c:\rrxlxfr.exec:\rrxlxfr.exe88⤵PID:2460
-
\??\c:\bbbhbb.exec:\bbbhbb.exe89⤵PID:2796
-
\??\c:\xxlrffr.exec:\xxlrffr.exe90⤵PID:2952
-
\??\c:\rlrxlrx.exec:\rlrxlrx.exe91⤵PID:1436
-
\??\c:\9rxlflr.exec:\9rxlflr.exe92⤵PID:1848
-
\??\c:\tnhhnt.exec:\tnhhnt.exe93⤵PID:344
-
\??\c:\1nnthh.exec:\1nnthh.exe94⤵PID:1692
-
\??\c:\vvjdp.exec:\vvjdp.exe95⤵PID:708
-
\??\c:\5vdjj.exec:\5vdjj.exe96⤵PID:876
-
\??\c:\fxlfllx.exec:\fxlfllx.exe97⤵PID:1588
-
\??\c:\ffxrxrf.exec:\ffxrxrf.exe98⤵PID:308
-
\??\c:\1lflxfr.exec:\1lflxfr.exe99⤵PID:1032
-
\??\c:\hbbtbn.exec:\hbbtbn.exe100⤵PID:300
-
\??\c:\9bnntt.exec:\9bnntt.exe101⤵PID:2468
-
\??\c:\vvvjd.exec:\vvvjd.exe102⤵PID:1368
-
\??\c:\1vvdp.exec:\1vvdp.exe103⤵PID:1116
-
\??\c:\rrlrxfr.exec:\rrlrxfr.exe104⤵PID:588
-
\??\c:\xxllflx.exec:\xxllflx.exe105⤵PID:1424
-
\??\c:\lflfllx.exec:\lflfllx.exe106⤵PID:1744
-
\??\c:\3tnbtb.exec:\3tnbtb.exe107⤵PID:452
-
\??\c:\btntbn.exec:\btntbn.exe108⤵PID:1640
-
\??\c:\dpjvp.exec:\dpjvp.exe109⤵PID:1868
-
\??\c:\pjpvj.exec:\pjpvj.exe110⤵PID:2248
-
\??\c:\lfxfllf.exec:\lfxfllf.exe111⤵PID:1988
-
\??\c:\rflfrxr.exec:\rflfrxr.exe112⤵PID:1876
-
\??\c:\bbtbhh.exec:\bbtbhh.exe113⤵PID:2712
-
\??\c:\7nhtbn.exec:\7nhtbn.exe114⤵PID:2068
-
\??\c:\tnbhnn.exec:\tnbhnn.exe115⤵PID:2364
-
\??\c:\3ppjj.exec:\3ppjj.exe116⤵PID:1724
-
\??\c:\jpdpv.exec:\jpdpv.exe117⤵PID:1544
-
\??\c:\rxlrlrx.exec:\rxlrlrx.exe118⤵PID:1524
-
\??\c:\fxrrflf.exec:\fxrrflf.exe119⤵PID:1548
-
\??\c:\hbntnt.exec:\hbntnt.exe120⤵PID:2064
-
\??\c:\nhbhht.exec:\nhbhht.exe121⤵PID:2700
-
\??\c:\tthhnb.exec:\tthhnb.exe122⤵PID:1616
-
\??\c:\vvjpd.exec:\vvjpd.exe123⤵PID:2708
-
\??\c:\vjvdp.exec:\vjvdp.exe124⤵PID:2856
-
\??\c:\ffrxxxr.exec:\ffrxxxr.exe125⤵PID:2596
-
\??\c:\lfrxflr.exec:\lfrxflr.exe126⤵PID:2732
-
\??\c:\tnbbhn.exec:\tnbbhn.exe127⤵PID:2692
-
\??\c:\hhthtt.exec:\hhthtt.exe128⤵PID:2580
-
\??\c:\9vpdp.exec:\9vpdp.exe129⤵PID:2316
-
\??\c:\jjvdv.exec:\jjvdv.exe130⤵PID:2452
-
\??\c:\jjdpj.exec:\jjdpj.exe131⤵PID:2864
-
\??\c:\rxxllfr.exec:\rxxllfr.exe132⤵PID:1676
-
\??\c:\ffrrrxx.exec:\ffrrrxx.exe133⤵PID:2292
-
\??\c:\ttnbbn.exec:\ttnbbn.exe134⤵PID:1436
-
\??\c:\btbbtb.exec:\btbbtb.exe135⤵PID:1848
-
\??\c:\hbtbht.exec:\hbtbht.exe136⤵PID:344
-
\??\c:\vvdjp.exec:\vvdjp.exe137⤵PID:2320
-
\??\c:\lfxflrf.exec:\lfxflrf.exe138⤵PID:708
-
\??\c:\llxfrrf.exec:\llxfrrf.exe139⤵PID:876
-
\??\c:\1ffrxfr.exec:\1ffrxfr.exe140⤵PID:1588
-
\??\c:\bhbbhh.exec:\bhbbhh.exe141⤵PID:2896
-
\??\c:\tnbhnt.exec:\tnbhnt.exe142⤵PID:1032
-
\??\c:\jjdjv.exec:\jjdjv.exe143⤵PID:1528
-
\??\c:\vvdjp.exec:\vvdjp.exe144⤵PID:2468
-
\??\c:\5fflrrf.exec:\5fflrrf.exe145⤵PID:600
-
\??\c:\xxffrxf.exec:\xxffrxf.exe146⤵PID:1416
-
\??\c:\3thtnb.exec:\3thtnb.exe147⤵PID:588
-
\??\c:\hhtbhn.exec:\hhtbhn.exe148⤵PID:2848
-
\??\c:\tbnbtn.exec:\tbnbtn.exe149⤵PID:2376
-
\??\c:\vpddj.exec:\vpddj.exe150⤵PID:452
-
\??\c:\jdppj.exec:\jdppj.exe151⤵PID:1640
-
\??\c:\xxlfrll.exec:\xxlfrll.exe152⤵PID:1868
-
\??\c:\lllrflx.exec:\lllrflx.exe153⤵PID:1536
-
\??\c:\nntbnt.exec:\nntbnt.exe154⤵PID:1988
-
\??\c:\nnhnnn.exec:\nnhnnn.exe155⤵PID:1016
-
\??\c:\tnbnth.exec:\tnbnth.exe156⤵PID:2712
-
\??\c:\jpdjd.exec:\jpdjd.exe157⤵PID:1444
-
\??\c:\pjddd.exec:\pjddd.exe158⤵PID:2364
-
\??\c:\lxlrxrf.exec:\lxlrxrf.exe159⤵PID:1384
-
\??\c:\rlfrffl.exec:\rlfrffl.exe160⤵PID:2216
-
\??\c:\lfrxllx.exec:\lfrxllx.exe161⤵PID:2912
-
\??\c:\tnhhth.exec:\tnhhth.exe162⤵PID:1996
-
\??\c:\9bnbtt.exec:\9bnbtt.exe163⤵PID:2624
-
\??\c:\jdppv.exec:\jdppv.exe164⤵PID:2860
-
\??\c:\ppjvj.exec:\ppjvj.exe165⤵PID:2512
-
\??\c:\llxffrx.exec:\llxffrx.exe166⤵PID:2644
-
\??\c:\1lflrxl.exec:\1lflrxl.exe167⤵PID:2648
-
\??\c:\1lflrrf.exec:\1lflrrf.exe168⤵PID:2640
-
\??\c:\nnbntb.exec:\nnbntb.exe169⤵PID:2716
-
\??\c:\btnbnn.exec:\btnbnn.exe170⤵PID:2684
-
\??\c:\vpdvj.exec:\vpdvj.exe171⤵PID:2788
-
\??\c:\vvpjp.exec:\vvpjp.exe172⤵PID:2528
-
\??\c:\xrrxflx.exec:\xrrxflx.exe173⤵PID:1892
-
\??\c:\lfrfrrf.exec:\lfrfrrf.exe174⤵PID:1992
-
\??\c:\1lffrxl.exec:\1lffrxl.exe175⤵PID:2028
-
\??\c:\hnbtbh.exec:\hnbtbh.exe176⤵PID:1960
-
\??\c:\5bttbh.exec:\5bttbh.exe177⤵PID:1852
-
\??\c:\jvpvv.exec:\jvpvv.exe178⤵PID:1824
-
\??\c:\jdppv.exec:\jdppv.exe179⤵PID:776
-
\??\c:\llxxfff.exec:\llxxfff.exe180⤵PID:828
-
\??\c:\ffxfrrr.exec:\ffxfrrr.exe181⤵PID:292
-
\??\c:\rrrxfxl.exec:\rrrxfxl.exe182⤵PID:3028
-
\??\c:\bnhttn.exec:\bnhttn.exe183⤵PID:892
-
\??\c:\dpddp.exec:\dpddp.exe184⤵PID:2476
-
\??\c:\pjdjp.exec:\pjdjp.exe185⤵PID:2396
-
\??\c:\dddjv.exec:\dddjv.exe186⤵PID:940
-
\??\c:\3rlfllx.exec:\3rlfllx.exe187⤵PID:540
-
\??\c:\fxlrflf.exec:\fxlrflf.exe188⤵PID:652
-
\??\c:\nhbhtt.exec:\nhbhtt.exe189⤵PID:1872
-
\??\c:\9nhtbt.exec:\9nhtbt.exe190⤵PID:1900
-
\??\c:\7vvvp.exec:\7vvvp.exe191⤵PID:2052
-
\??\c:\vdpvp.exec:\vdpvp.exe192⤵PID:1912
-
\??\c:\ffxfllx.exec:\ffxfllx.exe193⤵PID:1084
-
\??\c:\rfxfrxl.exec:\rfxfrxl.exe194⤵PID:2232
-
\??\c:\rxfrlrr.exec:\rxfrlrr.exe195⤵PID:3060
-
\??\c:\hbntnn.exec:\hbntnn.exe196⤵PID:868
-
\??\c:\3hbnnt.exec:\3hbnnt.exe197⤵PID:2752
-
\??\c:\ddvdv.exec:\ddvdv.exe198⤵PID:912
-
\??\c:\jjjjp.exec:\jjjjp.exe199⤵PID:1668
-
\??\c:\llfrflx.exec:\llfrflx.exe200⤵PID:1700
-
\??\c:\xxfflrx.exec:\xxfflrx.exe201⤵PID:1648
-
\??\c:\7tnntb.exec:\7tnntb.exe202⤵PID:2724
-
\??\c:\3ddvj.exec:\3ddvj.exe203⤵PID:2244
-
\??\c:\7jddp.exec:\7jddp.exe204⤵PID:3024
-
\??\c:\lfrrxfr.exec:\lfrrxfr.exe205⤵PID:2980
-
\??\c:\5xlrxlx.exec:\5xlrxlx.exe206⤵PID:2612
-
\??\c:\nnhnbb.exec:\nnhnbb.exe207⤵PID:2708
-
\??\c:\nnbntt.exec:\nnbntt.exe208⤵PID:2856
-
\??\c:\vppdd.exec:\vppdd.exe209⤵PID:2568
-
\??\c:\1jvdd.exec:\1jvdd.exe210⤵PID:2444
-
\??\c:\pjddv.exec:\pjddv.exe211⤵PID:2420
-
\??\c:\rlrrxlr.exec:\rlrrxlr.exe212⤵PID:2520
-
\??\c:\lflrxxl.exec:\lflrxxl.exe213⤵PID:2316
-
\??\c:\tnttnn.exec:\tnttnn.exe214⤵PID:2012
-
\??\c:\nhtbnn.exec:\nhtbnn.exe215⤵PID:2864
-
\??\c:\ddpvj.exec:\ddpvj.exe216⤵PID:1676
-
\??\c:\vpvdd.exec:\vpvdd.exe217⤵PID:1636
-
\??\c:\xrfxrrf.exec:\xrfxrrf.exe218⤵PID:1836
-
\??\c:\xxrlxxl.exec:\xxrlxxl.exe219⤵PID:1848
-
\??\c:\bbttnh.exec:\bbttnh.exe220⤵PID:2008
-
\??\c:\5dvdp.exec:\5dvdp.exe221⤵PID:2320
-
\??\c:\xfllrfl.exec:\xfllrfl.exe222⤵PID:2324
-
\??\c:\ttnbbh.exec:\ttnbbh.exe223⤵PID:876
-
\??\c:\bnttbt.exec:\bnttbt.exe224⤵PID:1056
-
\??\c:\jdpjv.exec:\jdpjv.exe225⤵PID:2812
-
\??\c:\lffxlrx.exec:\lffxlrx.exe226⤵PID:2656
-
\??\c:\btbbbn.exec:\btbbbn.exe227⤵PID:596
-
\??\c:\bthhnn.exec:\bthhnn.exe228⤵PID:336
-
\??\c:\7vdjv.exec:\7vdjv.exe229⤵PID:976
-
\??\c:\dvjpv.exec:\dvjpv.exe230⤵PID:472
-
\??\c:\lflllrl.exec:\lflllrl.exe231⤵PID:2888
-
\??\c:\lfxfflx.exec:\lfxfflx.exe232⤵PID:1532
-
\??\c:\bnttbh.exec:\bnttbh.exe233⤵PID:1164
-
\??\c:\nbnhnn.exec:\nbnhnn.exe234⤵PID:2988
-
\??\c:\7pdjj.exec:\7pdjj.exe235⤵PID:1576
-
\??\c:\5dvvv.exec:\5dvvv.exe236⤵PID:720
-
\??\c:\fxflrlx.exec:\fxflrlx.exe237⤵PID:3004
-
\??\c:\1llrllr.exec:\1llrllr.exe238⤵PID:360
-
\??\c:\bbthtb.exec:\bbthtb.exe239⤵PID:628
-
\??\c:\hbtbbb.exec:\hbtbbb.exe240⤵PID:2764
-
\??\c:\hhtbnn.exec:\hhtbnn.exe241⤵PID:1724
-
\??\c:\vpvvv.exec:\vpvvv.exe242⤵PID:1652