Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 04:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a76bb8dcd9ebab2e23f5b61957e01340_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
a76bb8dcd9ebab2e23f5b61957e01340_NeikiAnalytics.exe
-
Size
104KB
-
MD5
a76bb8dcd9ebab2e23f5b61957e01340
-
SHA1
6921794cc030afb738d92a706721051bc1920b7e
-
SHA256
35fbc3a397571ce1941140801b9a02d6104d1423640f88f1ced7421b0147b058
-
SHA512
dfcf6c49ed2e5a90b7823f985992c4880099d4f1a8c8b26dc0a1fc04235b09c3b802f9386405857b5bf8c6c4c499b2dd9506cb9e829153645752aa5c23ee2ea5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoTNKDeS98hPUdHV7RNzfnLnN3oW:ymb3NkkiQ3mdBjFo5KDe88g1fR88
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral1/memory/2140-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2392-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-68-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1636-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2376-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1972-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/784-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/780-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/352-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/608-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1628-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/856-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/280-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bthhnt.exe3nbbnt.exepjppj.exelfrrlfx.exe9hbnhh.exepdjjv.exelfflrrr.exe7vjpv.exevvdjp.exettnnbh.exe1ddpp.exe3rfxlfr.exerxfrrfl.exe5jppd.exevdjpj.exe7tntnn.exe7tbntt.exerrrrfxr.exe1rllllr.exetnhhnh.exe3jjvp.exellxlfrx.exexxxxfrf.exetnbbtt.exejjvjd.exefxrfrxl.exexrxxxrf.exenhnbtb.exejdvdp.exe1lxflll.exelxrfffr.exetthnhn.exepdpvp.exevppvv.exeflrrfrf.exethbbhn.exe1htbnt.exeppppp.exejdpdp.exerlflrrf.exebtntbb.exetnhnnn.exejdpvv.exeddvvd.exexffrrxx.exexrrxflr.exettnhhh.exetbnbnh.exedpddv.exejvdvj.exe3rxxllx.exe5hhtbh.exetnhhtt.exevvpdd.exexxxlxfx.exerfxxllf.exenbnnhn.exehhnhhh.exeppvdv.exelffrlll.exerlfflxl.exehhtthn.exe9vjjj.exevdddd.exepid process 2392 bthhnt.exe 2628 3nbbnt.exe 2732 pjppj.exe 2692 lfrrlfx.exe 2812 9hbnhh.exe 2556 pdjjv.exe 2652 lfflrrr.exe 2232 7vjpv.exe 1636 vvdjp.exe 2716 ttnnbh.exe 2848 1ddpp.exe 2376 3rfxlfr.exe 1972 rxfrrfl.exe 784 5jppd.exe 780 vdjpj.exe 352 7tntnn.exe 1664 7tbntt.exe 2100 rrrrfxr.exe 2096 1rllllr.exe 2852 tnhhnh.exe 1104 3jjvp.exe 608 llxlfrx.exe 1628 xxxxfrf.exe 856 tnbbtt.exe 1524 jjvjd.exe 280 fxrfrxl.exe 1820 xrxxxrf.exe 1160 nhnbtb.exe 1572 jdvdp.exe 2912 1lxflll.exe 904 lxrfffr.exe 2068 tthnhn.exe 2892 pdpvp.exe 2680 vppvv.exe 2280 flrrfrf.exe 2908 thbbhn.exe 1700 1htbnt.exe 1544 ppppp.exe 2916 jdpdp.exe 2560 rlflrrf.exe 2712 btntbb.exe 2536 tnhnnn.exe 2600 jdpvv.exe 2348 ddvvd.exe 1852 xffrrxx.exe 2768 xrrxflr.exe 2864 ttnhhh.exe 2964 tbnbnh.exe 2420 dpddv.exe 1940 jvdvj.exe 1188 3rxxllx.exe 2012 5hhtbh.exe 1764 tnhhtt.exe 2452 vvpdd.exe 352 xxxlxfx.exe 1664 rfxxllf.exe 2308 nbnnhn.exe 2260 hhnhhh.exe 2168 ppvdv.exe 2512 lffrlll.exe 544 rlfflxl.exe 608 hhtthn.exe 1860 9vjjj.exe 1100 vdddd.exe -
Processes:
resource yara_rule behavioral1/memory/2140-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1636-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1972-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/784-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/780-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/352-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/608-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/856-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/280-253-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a76bb8dcd9ebab2e23f5b61957e01340_NeikiAnalytics.exebthhnt.exe3nbbnt.exepjppj.exelfrrlfx.exe9hbnhh.exepdjjv.exelfflrrr.exe7vjpv.exevvdjp.exettnnbh.exe1ddpp.exe3rfxlfr.exerxfrrfl.exe5jppd.exevdjpj.exedescription pid process target process PID 2140 wrote to memory of 2392 2140 a76bb8dcd9ebab2e23f5b61957e01340_NeikiAnalytics.exe bthhnt.exe PID 2140 wrote to memory of 2392 2140 a76bb8dcd9ebab2e23f5b61957e01340_NeikiAnalytics.exe bthhnt.exe PID 2140 wrote to memory of 2392 2140 a76bb8dcd9ebab2e23f5b61957e01340_NeikiAnalytics.exe bthhnt.exe PID 2140 wrote to memory of 2392 2140 a76bb8dcd9ebab2e23f5b61957e01340_NeikiAnalytics.exe bthhnt.exe PID 2392 wrote to memory of 2628 2392 bthhnt.exe 3nbbnt.exe PID 2392 wrote to memory of 2628 2392 bthhnt.exe 3nbbnt.exe PID 2392 wrote to memory of 2628 2392 bthhnt.exe 3nbbnt.exe PID 2392 wrote to memory of 2628 2392 bthhnt.exe 3nbbnt.exe PID 2628 wrote to memory of 2732 2628 3nbbnt.exe pjppj.exe PID 2628 wrote to memory of 2732 2628 3nbbnt.exe pjppj.exe PID 2628 wrote to memory of 2732 2628 3nbbnt.exe pjppj.exe PID 2628 wrote to memory of 2732 2628 3nbbnt.exe pjppj.exe PID 2732 wrote to memory of 2692 2732 pjppj.exe lfrrlfx.exe PID 2732 wrote to memory of 2692 2732 pjppj.exe lfrrlfx.exe PID 2732 wrote to memory of 2692 2732 pjppj.exe lfrrlfx.exe PID 2732 wrote to memory of 2692 2732 pjppj.exe lfrrlfx.exe PID 2692 wrote to memory of 2812 2692 lfrrlfx.exe 9hbnhh.exe PID 2692 wrote to memory of 2812 2692 lfrrlfx.exe 9hbnhh.exe PID 2692 wrote to memory of 2812 2692 lfrrlfx.exe 9hbnhh.exe PID 2692 wrote to memory of 2812 2692 lfrrlfx.exe 9hbnhh.exe PID 2812 wrote to memory of 2556 2812 9hbnhh.exe pdjjv.exe PID 2812 wrote to memory of 2556 2812 9hbnhh.exe pdjjv.exe PID 2812 wrote to memory of 2556 2812 9hbnhh.exe pdjjv.exe PID 2812 wrote to memory of 2556 2812 9hbnhh.exe pdjjv.exe PID 2556 wrote to memory of 2652 2556 pdjjv.exe lfflrrr.exe PID 2556 wrote to memory of 2652 2556 pdjjv.exe lfflrrr.exe PID 2556 wrote to memory of 2652 2556 pdjjv.exe lfflrrr.exe PID 2556 wrote to memory of 2652 2556 pdjjv.exe lfflrrr.exe PID 2652 wrote to memory of 2232 2652 lfflrrr.exe 7vjpv.exe PID 2652 wrote to memory of 2232 2652 lfflrrr.exe 7vjpv.exe PID 2652 wrote to memory of 2232 2652 lfflrrr.exe 7vjpv.exe PID 2652 wrote to memory of 2232 2652 lfflrrr.exe 7vjpv.exe PID 2232 wrote to memory of 1636 2232 7vjpv.exe vvdjp.exe PID 2232 wrote to memory of 1636 2232 7vjpv.exe vvdjp.exe PID 2232 wrote to memory of 1636 2232 7vjpv.exe vvdjp.exe PID 2232 wrote to memory of 1636 2232 7vjpv.exe vvdjp.exe PID 1636 wrote to memory of 2716 1636 vvdjp.exe ttnnbh.exe PID 1636 wrote to memory of 2716 1636 vvdjp.exe ttnnbh.exe PID 1636 wrote to memory of 2716 1636 vvdjp.exe ttnnbh.exe PID 1636 wrote to memory of 2716 1636 vvdjp.exe ttnnbh.exe PID 2716 wrote to memory of 2848 2716 ttnnbh.exe 1ddpp.exe PID 2716 wrote to memory of 2848 2716 ttnnbh.exe 1ddpp.exe PID 2716 wrote to memory of 2848 2716 ttnnbh.exe 1ddpp.exe PID 2716 wrote to memory of 2848 2716 ttnnbh.exe 1ddpp.exe PID 2848 wrote to memory of 2376 2848 1ddpp.exe 3rfxlfr.exe PID 2848 wrote to memory of 2376 2848 1ddpp.exe 3rfxlfr.exe PID 2848 wrote to memory of 2376 2848 1ddpp.exe 3rfxlfr.exe PID 2848 wrote to memory of 2376 2848 1ddpp.exe 3rfxlfr.exe PID 2376 wrote to memory of 1972 2376 3rfxlfr.exe rxfrrfl.exe PID 2376 wrote to memory of 1972 2376 3rfxlfr.exe rxfrrfl.exe PID 2376 wrote to memory of 1972 2376 3rfxlfr.exe rxfrrfl.exe PID 2376 wrote to memory of 1972 2376 3rfxlfr.exe rxfrrfl.exe PID 1972 wrote to memory of 784 1972 rxfrrfl.exe 5jppd.exe PID 1972 wrote to memory of 784 1972 rxfrrfl.exe 5jppd.exe PID 1972 wrote to memory of 784 1972 rxfrrfl.exe 5jppd.exe PID 1972 wrote to memory of 784 1972 rxfrrfl.exe 5jppd.exe PID 784 wrote to memory of 780 784 5jppd.exe vdjpj.exe PID 784 wrote to memory of 780 784 5jppd.exe vdjpj.exe PID 784 wrote to memory of 780 784 5jppd.exe vdjpj.exe PID 784 wrote to memory of 780 784 5jppd.exe vdjpj.exe PID 780 wrote to memory of 352 780 vdjpj.exe 7tntnn.exe PID 780 wrote to memory of 352 780 vdjpj.exe 7tntnn.exe PID 780 wrote to memory of 352 780 vdjpj.exe 7tntnn.exe PID 780 wrote to memory of 352 780 vdjpj.exe 7tntnn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a76bb8dcd9ebab2e23f5b61957e01340_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a76bb8dcd9ebab2e23f5b61957e01340_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\bthhnt.exec:\bthhnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\3nbbnt.exec:\3nbbnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\pjppj.exec:\pjppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\lfrrlfx.exec:\lfrrlfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\9hbnhh.exec:\9hbnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\pdjjv.exec:\pdjjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\lfflrrr.exec:\lfflrrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\7vjpv.exec:\7vjpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\vvdjp.exec:\vvdjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\ttnnbh.exec:\ttnnbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\1ddpp.exec:\1ddpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\3rfxlfr.exec:\3rfxlfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\rxfrrfl.exec:\rxfrrfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\5jppd.exec:\5jppd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
\??\c:\vdjpj.exec:\vdjpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
\??\c:\7tntnn.exec:\7tntnn.exe17⤵
- Executes dropped EXE
PID:352 -
\??\c:\7tbntt.exec:\7tbntt.exe18⤵
- Executes dropped EXE
PID:1664 -
\??\c:\rrrrfxr.exec:\rrrrfxr.exe19⤵
- Executes dropped EXE
PID:2100 -
\??\c:\1rllllr.exec:\1rllllr.exe20⤵
- Executes dropped EXE
PID:2096 -
\??\c:\tnhhnh.exec:\tnhhnh.exe21⤵
- Executes dropped EXE
PID:2852 -
\??\c:\3jjvp.exec:\3jjvp.exe22⤵
- Executes dropped EXE
PID:1104 -
\??\c:\llxlfrx.exec:\llxlfrx.exe23⤵
- Executes dropped EXE
PID:608 -
\??\c:\xxxxfrf.exec:\xxxxfrf.exe24⤵
- Executes dropped EXE
PID:1628 -
\??\c:\tnbbtt.exec:\tnbbtt.exe25⤵
- Executes dropped EXE
PID:856 -
\??\c:\jjvjd.exec:\jjvjd.exe26⤵
- Executes dropped EXE
PID:1524 -
\??\c:\fxrfrxl.exec:\fxrfrxl.exe27⤵
- Executes dropped EXE
PID:280 -
\??\c:\xrxxxrf.exec:\xrxxxrf.exe28⤵
- Executes dropped EXE
PID:1820 -
\??\c:\nhnbtb.exec:\nhnbtb.exe29⤵
- Executes dropped EXE
PID:1160 -
\??\c:\jdvdp.exec:\jdvdp.exe30⤵
- Executes dropped EXE
PID:1572 -
\??\c:\1lxflll.exec:\1lxflll.exe31⤵
- Executes dropped EXE
PID:2912 -
\??\c:\lxrfffr.exec:\lxrfffr.exe32⤵
- Executes dropped EXE
PID:904 -
\??\c:\tthnhn.exec:\tthnhn.exe33⤵
- Executes dropped EXE
PID:2068 -
\??\c:\pdpvp.exec:\pdpvp.exe34⤵
- Executes dropped EXE
PID:2892 -
\??\c:\vppvv.exec:\vppvv.exe35⤵
- Executes dropped EXE
PID:2680 -
\??\c:\flrrfrf.exec:\flrrfrf.exe36⤵
- Executes dropped EXE
PID:2280 -
\??\c:\thbbhn.exec:\thbbhn.exe37⤵
- Executes dropped EXE
PID:2908 -
\??\c:\1htbnt.exec:\1htbnt.exe38⤵
- Executes dropped EXE
PID:1700 -
\??\c:\ppppp.exec:\ppppp.exe39⤵
- Executes dropped EXE
PID:1544 -
\??\c:\jdpdp.exec:\jdpdp.exe40⤵
- Executes dropped EXE
PID:2916 -
\??\c:\rlflrrf.exec:\rlflrrf.exe41⤵
- Executes dropped EXE
PID:2560 -
\??\c:\btntbb.exec:\btntbb.exe42⤵
- Executes dropped EXE
PID:2712 -
\??\c:\tnhnnn.exec:\tnhnnn.exe43⤵
- Executes dropped EXE
PID:2536 -
\??\c:\jdpvv.exec:\jdpvv.exe44⤵
- Executes dropped EXE
PID:2600 -
\??\c:\ddvvd.exec:\ddvvd.exe45⤵
- Executes dropped EXE
PID:2348 -
\??\c:\xffrrxx.exec:\xffrrxx.exe46⤵
- Executes dropped EXE
PID:1852 -
\??\c:\xrrxflr.exec:\xrrxflr.exe47⤵
- Executes dropped EXE
PID:2768 -
\??\c:\ttnhhh.exec:\ttnhhh.exe48⤵
- Executes dropped EXE
PID:2864 -
\??\c:\tbnbnh.exec:\tbnbnh.exe49⤵
- Executes dropped EXE
PID:2964 -
\??\c:\dpddv.exec:\dpddv.exe50⤵
- Executes dropped EXE
PID:2420 -
\??\c:\jvdvj.exec:\jvdvj.exe51⤵
- Executes dropped EXE
PID:1940 -
\??\c:\3rxxllx.exec:\3rxxllx.exe52⤵
- Executes dropped EXE
PID:1188 -
\??\c:\5hhtbh.exec:\5hhtbh.exe53⤵
- Executes dropped EXE
PID:2012 -
\??\c:\tnhhtt.exec:\tnhhtt.exe54⤵
- Executes dropped EXE
PID:1764 -
\??\c:\vvpdd.exec:\vvpdd.exe55⤵
- Executes dropped EXE
PID:2452 -
\??\c:\xxxlxfx.exec:\xxxlxfx.exe56⤵
- Executes dropped EXE
PID:352 -
\??\c:\rfxxllf.exec:\rfxxllf.exe57⤵
- Executes dropped EXE
PID:1664 -
\??\c:\nbnnhn.exec:\nbnnhn.exe58⤵
- Executes dropped EXE
PID:2308 -
\??\c:\hhnhhh.exec:\hhnhhh.exe59⤵
- Executes dropped EXE
PID:2260 -
\??\c:\ppvdv.exec:\ppvdv.exe60⤵
- Executes dropped EXE
PID:2168 -
\??\c:\lffrlll.exec:\lffrlll.exe61⤵
- Executes dropped EXE
PID:2512 -
\??\c:\rlfflxl.exec:\rlfflxl.exe62⤵
- Executes dropped EXE
PID:544 -
\??\c:\hhtthn.exec:\hhtthn.exe63⤵
- Executes dropped EXE
PID:608 -
\??\c:\9vjjj.exec:\9vjjj.exe64⤵
- Executes dropped EXE
PID:1860 -
\??\c:\vdddd.exec:\vdddd.exe65⤵
- Executes dropped EXE
PID:1100 -
\??\c:\rllfllr.exec:\rllfllr.exe66⤵PID:708
-
\??\c:\rxlffxr.exec:\rxlffxr.exe67⤵PID:772
-
\??\c:\tnbhbn.exec:\tnbhbn.exe68⤵PID:2468
-
\??\c:\5jdjv.exec:\5jdjv.exe69⤵PID:948
-
\??\c:\pdjvd.exec:\pdjvd.exe70⤵PID:2900
-
\??\c:\xfrlllx.exec:\xfrlllx.exe71⤵PID:840
-
\??\c:\llxlffx.exec:\llxlffx.exe72⤵PID:2476
-
\??\c:\bttntt.exec:\bttntt.exe73⤵PID:2912
-
\??\c:\djpdp.exec:\djpdp.exe74⤵PID:2432
-
\??\c:\7dvvj.exec:\7dvvj.exe75⤵PID:3016
-
\??\c:\xrrxxfr.exec:\xrrxxfr.exe76⤵PID:3064
-
\??\c:\xrllflr.exec:\xrllflr.exe77⤵PID:2428
-
\??\c:\nnntnh.exec:\nnntnh.exe78⤵PID:2684
-
\??\c:\tttbbt.exec:\tttbbt.exe79⤵PID:2780
-
\??\c:\jdjpj.exec:\jdjpj.exe80⤵PID:1588
-
\??\c:\xrrrrrf.exec:\xrrrrrf.exe81⤵PID:2700
-
\??\c:\5rrxrxr.exec:\5rrxrxr.exe82⤵PID:2692
-
\??\c:\nhnnnb.exec:\nhnnnb.exe83⤵PID:2756
-
\??\c:\nhnnbh.exec:\nhnnbh.exe84⤵PID:3004
-
\??\c:\vdjvv.exec:\vdjvv.exe85⤵PID:2548
-
\??\c:\ffxlffl.exec:\ffxlffl.exe86⤵PID:2976
-
\??\c:\fxrxlrf.exec:\fxrxlrf.exe87⤵PID:2992
-
\??\c:\bnbbnn.exec:\bnbbnn.exe88⤵PID:2988
-
\??\c:\nnnnth.exec:\nnnnth.exe89⤵PID:1636
-
\??\c:\5ppvj.exec:\5ppvj.exe90⤵PID:2876
-
\??\c:\xrfxlrf.exec:\xrfxlrf.exe91⤵PID:824
-
\??\c:\xxrrxfr.exec:\xxrrxfr.exe92⤵PID:1984
-
\??\c:\bbnttb.exec:\bbnttb.exe93⤵PID:2332
-
\??\c:\tnhthn.exec:\tnhthn.exe94⤵PID:2464
-
\??\c:\3jddj.exec:\3jddj.exe95⤵PID:2180
-
\??\c:\1vvvj.exec:\1vvvj.exe96⤵PID:780
-
\??\c:\7rffllx.exec:\7rffllx.exe97⤵PID:1560
-
\??\c:\9rllffl.exec:\9rllffl.exe98⤵PID:1660
-
\??\c:\1hnnbh.exec:\1hnnbh.exe99⤵PID:2248
-
\??\c:\jpvvd.exec:\jpvvd.exe100⤵PID:2328
-
\??\c:\dpdpv.exec:\dpdpv.exe101⤵PID:2052
-
\??\c:\lxxrxrr.exec:\lxxrxrr.exe102⤵PID:2928
-
\??\c:\thtnhh.exec:\thtnhh.exe103⤵PID:2168
-
\??\c:\hhbthb.exec:\hhbthb.exe104⤵PID:1008
-
\??\c:\ddpdp.exec:\ddpdp.exe105⤵PID:544
-
\??\c:\lfllrrx.exec:\lfllrrx.exe106⤵PID:580
-
\??\c:\5lfrffl.exec:\5lfrffl.exe107⤵PID:1288
-
\??\c:\9tnbht.exec:\9tnbht.exe108⤵PID:668
-
\??\c:\thbnbt.exec:\thbnbt.exe109⤵PID:1872
-
\??\c:\3pddv.exec:\3pddv.exe110⤵PID:1868
-
\??\c:\jdvdp.exec:\jdvdp.exe111⤵PID:2616
-
\??\c:\xrrrxfl.exec:\xrrrxfl.exe112⤵PID:1160
-
\??\c:\7frxrxf.exec:\7frxrxf.exe113⤵PID:1248
-
\??\c:\nbbbnn.exec:\nbbbnn.exe114⤵PID:1684
-
\??\c:\nnbtht.exec:\nnbtht.exe115⤵PID:2184
-
\??\c:\3vddp.exec:\3vddp.exe116⤵PID:2216
-
\??\c:\xrfxxrx.exec:\xrfxxrx.exe117⤵PID:1712
-
\??\c:\rrllfrf.exec:\rrllfrf.exe118⤵PID:1276
-
\??\c:\1ttnth.exec:\1ttnth.exe119⤵PID:2896
-
\??\c:\nhbhtt.exec:\nhbhtt.exe120⤵PID:2752
-
\??\c:\9pddj.exec:\9pddj.exe121⤵PID:2800
-
\??\c:\ddvvd.exec:\ddvvd.exe122⤵PID:2784
-
\??\c:\fxflxfl.exec:\fxflxfl.exe123⤵PID:2656
-
\??\c:\hhntnn.exec:\hhntnn.exe124⤵PID:2772
-
\??\c:\tnbbnt.exec:\tnbbnt.exe125⤵PID:2676
-
\??\c:\vvpvd.exec:\vvpvd.exe126⤵PID:2532
-
\??\c:\5vvpd.exec:\5vvpd.exe127⤵PID:2608
-
\??\c:\3xflrxr.exec:\3xflrxr.exe128⤵PID:2288
-
\??\c:\lrxxxfr.exec:\lrxxxfr.exe129⤵PID:2024
-
\??\c:\ttnthn.exec:\ttnthn.exe130⤵PID:2208
-
\??\c:\hhhbbh.exec:\hhhbbh.exe131⤵PID:2716
-
\??\c:\5pppd.exec:\5pppd.exe132⤵PID:1036
-
\??\c:\xrlrflr.exec:\xrlrflr.exe133⤵PID:2336
-
\??\c:\rlxfllr.exec:\rlxfllr.exe134⤵PID:1316
-
\??\c:\btbhbh.exec:\btbhbh.exe135⤵PID:1280
-
\??\c:\vvjjv.exec:\vvjjv.exe136⤵PID:784
-
\??\c:\9vppv.exec:\9vppv.exe137⤵PID:316
-
\??\c:\fxlfllr.exec:\fxlfllr.exe138⤵PID:1564
-
\??\c:\bbhnhn.exec:\bbhnhn.exe139⤵PID:1560
-
\??\c:\7tnhnn.exec:\7tnhnn.exe140⤵PID:2128
-
\??\c:\9dvpv.exec:\9dvpv.exe141⤵PID:2276
-
\??\c:\vvvdp.exec:\vvvdp.exe142⤵PID:1920
-
\??\c:\fxlrxfl.exec:\fxlrxfl.exe143⤵PID:2112
-
\??\c:\lfxfllx.exec:\lfxfllx.exe144⤵PID:2088
-
\??\c:\btntth.exec:\btntth.exe145⤵PID:1104
-
\??\c:\pdpvj.exec:\pdpvj.exe146⤵PID:1736
-
\??\c:\7vjvv.exec:\7vjvv.exe147⤵PID:1788
-
\??\c:\lfxxrxf.exec:\lfxxrxf.exe148⤵PID:1532
-
\??\c:\rlffrrl.exec:\rlffrrl.exe149⤵PID:1568
-
\??\c:\3bbhth.exec:\3bbhth.exe150⤵PID:1524
-
\??\c:\bbtbhh.exec:\bbtbhh.exe151⤵PID:772
-
\??\c:\pdvvd.exec:\pdvvd.exe152⤵PID:572
-
\??\c:\jjvvj.exec:\jjvvj.exe153⤵PID:724
-
\??\c:\rlflrfx.exec:\rlflrfx.exe154⤵PID:1632
-
\??\c:\rrffrxf.exec:\rrffrxf.exe155⤵PID:1264
-
\??\c:\hhtbnt.exec:\hhtbnt.exe156⤵PID:896
-
\??\c:\vpjjd.exec:\vpjjd.exe157⤵PID:1996
-
\??\c:\dpvpd.exec:\dpvpd.exe158⤵PID:2488
-
\??\c:\vpvdj.exec:\vpvdj.exe159⤵PID:1692
-
\??\c:\lfrrffr.exec:\lfrrffr.exe160⤵PID:3028
-
\??\c:\httnhh.exec:\httnhh.exe161⤵PID:2428
-
\??\c:\bttbbb.exec:\bttbbb.exe162⤵PID:2344
-
\??\c:\vvddj.exec:\vvddj.exe163⤵PID:2672
-
\??\c:\pdjpj.exec:\pdjpj.exe164⤵PID:2732
-
\??\c:\rrffllx.exec:\rrffllx.exe165⤵PID:2904
-
\??\c:\ntntbn.exec:\ntntbn.exe166⤵PID:1396
-
\??\c:\tthtnt.exec:\tthtnt.exe167⤵PID:2756
-
\??\c:\1dvjv.exec:\1dvjv.exe168⤵PID:2552
-
\??\c:\jvppd.exec:\jvppd.exe169⤵PID:2984
-
\??\c:\xxfxfll.exec:\xxfxfll.exe170⤵PID:2592
-
\??\c:\nhhtnn.exec:\nhhtnn.exe171⤵PID:2364
-
\??\c:\jdvjv.exec:\jdvjv.exe172⤵PID:1960
-
\??\c:\lfxflrr.exec:\lfxflrr.exe173⤵PID:2840
-
\??\c:\rrlrflx.exec:\rrlrflx.exe174⤵PID:2856
-
\??\c:\nbnntb.exec:\nbnntb.exe175⤵PID:824
-
\??\c:\nhbnhn.exec:\nhbnhn.exe176⤵PID:2036
-
\??\c:\7vvvv.exec:\7vvvv.exe177⤵PID:2016
-
\??\c:\frxfrff.exec:\frxfrff.exe178⤵PID:1292
-
\??\c:\fxxxllr.exec:\fxxxllr.exe179⤵PID:2180
-
\??\c:\ttnnbb.exec:\ttnnbb.exe180⤵PID:2188
-
\??\c:\1hbtnn.exec:\1hbtnn.exe181⤵PID:1604
-
\??\c:\dvjpd.exec:\dvjpd.exe182⤵PID:2116
-
\??\c:\1rrxffr.exec:\1rrxffr.exe183⤵PID:2248
-
\??\c:\9lffrrf.exec:\9lffrrf.exe184⤵PID:2328
-
\??\c:\5nhnhn.exec:\5nhnhn.exe185⤵PID:2852
-
\??\c:\nhbbbt.exec:\nhbbbt.exe186⤵PID:2928
-
\??\c:\3ppjj.exec:\3ppjj.exe187⤵PID:2168
-
\??\c:\ppjpd.exec:\ppjpd.exe188⤵PID:1260
-
\??\c:\1frlrrf.exec:\1frlrrf.exe189⤵PID:856
-
\??\c:\frflxxl.exec:\frflxxl.exe190⤵PID:2136
-
\??\c:\tnnnbb.exec:\tnnnbb.exe191⤵PID:1068
-
\??\c:\nhtthn.exec:\nhtthn.exe192⤵PID:1100
-
\??\c:\vpvvp.exec:\vpvvp.exe193⤵PID:1872
-
\??\c:\jdvdp.exec:\jdvdp.exe194⤵PID:2320
-
\??\c:\xxrxflx.exec:\xxrxflx.exe195⤵PID:2616
-
\??\c:\llxxfrr.exec:\llxxfrr.exe196⤵PID:1160
-
\??\c:\bththh.exec:\bththh.exe197⤵PID:1248
-
\??\c:\vpdjp.exec:\vpdjp.exe198⤵PID:3036
-
\??\c:\pdvvv.exec:\pdvvv.exe199⤵PID:2056
-
\??\c:\xrlrflr.exec:\xrlrflr.exe200⤵PID:2216
-
\??\c:\xrflxlr.exec:\xrflxlr.exe201⤵PID:3048
-
\??\c:\9ntbbh.exec:\9ntbbh.exe202⤵PID:2392
-
\??\c:\bbhhht.exec:\bbhhht.exe203⤵PID:1556
-
\??\c:\jdppj.exec:\jdppj.exe204⤵PID:2628
-
\??\c:\lrlrlxr.exec:\lrlrlxr.exe205⤵PID:2800
-
\??\c:\rrlxrxr.exec:\rrlxrxr.exe206⤵PID:1584
-
\??\c:\3nbbtb.exec:\3nbbtb.exe207⤵PID:2788
-
\??\c:\hthbtn.exec:\hthbtn.exe208⤵PID:2772
-
\??\c:\dvjdj.exec:\dvjdj.exe209⤵PID:2676
-
\??\c:\dpvjd.exec:\dpvjd.exe210⤵PID:2708
-
\??\c:\rlxrlrx.exec:\rlxrlrx.exe211⤵PID:2608
-
\??\c:\hnntnt.exec:\hnntnt.exe212⤵PID:2612
-
\??\c:\5nbthh.exec:\5nbthh.exe213⤵PID:2348
-
\??\c:\vvjpp.exec:\vvjpp.exe214⤵PID:2208
-
\??\c:\xrlrrrl.exec:\xrlrrrl.exe215⤵PID:2716
-
\??\c:\ffrxrrf.exec:\ffrxrrf.exe216⤵PID:1036
-
\??\c:\nnnbnb.exec:\nnnbnb.exe217⤵PID:2420
-
\??\c:\5dpvj.exec:\5dpvj.exe218⤵PID:1316
-
\??\c:\vpddd.exec:\vpddd.exe219⤵PID:864
-
\??\c:\9lllxfr.exec:\9lllxfr.exe220⤵PID:1624
-
\??\c:\9nbhtb.exec:\9nbhtb.exe221⤵PID:308
-
\??\c:\btbhbb.exec:\btbhbb.exe222⤵PID:2632
-
\??\c:\dvpjj.exec:\dvpjj.exe223⤵PID:1620
-
\??\c:\ffrlxrf.exec:\ffrlxrf.exe224⤵PID:1660
-
\??\c:\ttbbht.exec:\ttbbht.exe225⤵PID:2128
-
\??\c:\hhbhnt.exec:\hhbhnt.exe226⤵PID:2096
-
\??\c:\pjdvv.exec:\pjdvv.exe227⤵PID:2052
-
\??\c:\lrlxlfr.exec:\lrlxlfr.exe228⤵PID:880
-
\??\c:\hbnnbb.exec:\hbnnbb.exe229⤵PID:1148
-
\??\c:\tbbttb.exec:\tbbttb.exe230⤵PID:644
-
\??\c:\vvjdj.exec:\vvjdj.exe231⤵PID:2500
-
\??\c:\3vjjv.exec:\3vjjv.exe232⤵PID:236
-
\??\c:\3xflxfr.exec:\3xflxfr.exe233⤵PID:652
-
\??\c:\hbnhtn.exec:\hbnhtn.exe234⤵PID:2120
-
\??\c:\tbhhbb.exec:\tbhhbb.exe235⤵PID:1052
-
\??\c:\jvppp.exec:\jvppp.exe236⤵PID:1820
-
\??\c:\9ppdp.exec:\9ppdp.exe237⤵PID:1800
-
\??\c:\xfxllll.exec:\xfxllll.exe238⤵PID:1936
-
\??\c:\ttthnn.exec:\ttthnn.exe239⤵PID:852
-
\??\c:\hnhtnb.exec:\hnhtnb.exe240⤵PID:2492
-
\??\c:\dvjpp.exec:\dvjpp.exe241⤵PID:336
-
\??\c:\xrlrfrf.exec:\xrlrfrf.exe242⤵PID:2912