Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 07:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cf8c775c71330833a17d8026ccec2a30_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
cf8c775c71330833a17d8026ccec2a30_NeikiAnalytics.exe
-
Size
224KB
-
MD5
cf8c775c71330833a17d8026ccec2a30
-
SHA1
63d5bf17e5cacd3a4ef39c7b1ea84919bb11a401
-
SHA256
d0a741fb253c21975be756eb5e65dcd000c8697b6c67faf0cbea8548ab0d6586
-
SHA512
015e5f52f1c819fd8253b1d55895c0f4be730ea4b39b189745aaeccf94a2a2f5251dafabd13ff665f9e97d5cce93ed2a7a95cd4833d7e6eaddaedd8c3cf5830d
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31QNVrVc:n3C9BRo7MlrWKo+l0rVc
Malware Config
Signatures
-
Detect Blackmoon payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/1640-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1320-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2488-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2392-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/280-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1244-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1556-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2252-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1264-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/384-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1292-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1444-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
1rlfxlf.exetnbbbb.exejdjpp.exexlrllfl.exe7tnbbn.exe1vvdv.exefxlxfrr.exelflfxxx.exebtntbn.exe7ddvd.exe9rlfxxx.exenhbbnt.exevpvpj.exerlllflx.exetnntnb.exe7vjdj.exeffrrffr.exebbtbth.exebtbhtb.exejdpdp.exebntbhn.exevjddv.exepjvdp.exe3rrlxrl.exevppdv.exepjppv.exethtbbt.exeppdjv.exerfxxllf.exerlxfrrf.exebtntbn.exe9pvvj.exexxrfrrf.exenhthnt.exevdppd.exe7rflrxl.exeffxlrxl.exe7nhhtn.exedpdjd.exe9jpdv.exe1tnnbh.exepjdvp.exe9pjvd.exerrxlxfr.exe5bntbb.exettnhtb.exedpjjd.exelfxfrxr.exerrlrlrl.exe3nhttt.exebtnntb.exejpjdd.exexrrrxrl.exe1rrxllx.exe1thnhn.exedpvdp.exexlxfllx.exefxrxxfl.exe9nbbnh.exenbnntb.exejpdpj.exe7rxfrrx.exe1xrrflr.exe7nhtht.exepid process 1320 1rlfxlf.exe 2368 tnbbbb.exe 2672 jdjpp.exe 2736 xlrllfl.exe 2560 7tnbbn.exe 2440 1vvdv.exe 2728 fxlxfrr.exe 2488 lflfxxx.exe 2920 btntbn.exe 2392 7ddvd.exe 2504 9rlfxxx.exe 2312 nhbbnt.exe 1884 vpvpj.exe 1988 rlllflx.exe 280 tnntnb.exe 1244 7vjdj.exe 2180 ffrrffr.exe 1556 bbtbth.exe 2632 btbhtb.exe 2252 jdpdp.exe 1264 bntbhn.exe 384 vjddv.exe 1056 pjvdp.exe 2788 3rrlxrl.exe 1468 vppdv.exe 1292 pjppv.exe 1856 thtbbt.exe 1444 ppdjv.exe 1908 rfxxllf.exe 1424 rlxfrrf.exe 2108 btntbn.exe 880 9pvvj.exe 1452 xxrfrrf.exe 2964 nhthnt.exe 2996 vdppd.exe 2544 7rflrxl.exe 2564 ffxlrxl.exe 2672 7nhhtn.exe 2840 dpdjd.exe 2616 9jpdv.exe 2460 1tnnbh.exe 2440 pjdvp.exe 2728 9pjvd.exe 2948 rrxlxfr.exe 1992 5bntbb.exe 2656 ttnhtb.exe 2620 dpjjd.exe 2592 lfxfrxr.exe 1952 rrlrlrl.exe 1756 3nhttt.exe 1588 btnntb.exe 1652 jpjdd.exe 2316 xrrrxrl.exe 1244 1rrxllx.exe 2800 1thnhn.exe 836 dpvdp.exe 2808 xlxfllx.exe 2820 fxrxxfl.exe 2116 9nbbnh.exe 772 nbnntb.exe 1568 jpdpj.exe 984 7rxfrrx.exe 1748 1xrrflr.exe 3000 7nhtht.exe -
Processes:
resource yara_rule behavioral1/memory/1640-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1320-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/280-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1244-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2252-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1264-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/384-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1292-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1444-267-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cf8c775c71330833a17d8026ccec2a30_NeikiAnalytics.exe1rlfxlf.exetnbbbb.exejdjpp.exexlrllfl.exe7tnbbn.exe1vvdv.exefxlxfrr.exelflfxxx.exebtntbn.exe7ddvd.exe9rlfxxx.exenhbbnt.exevpvpj.exerlllflx.exetnntnb.exedescription pid process target process PID 1640 wrote to memory of 1320 1640 cf8c775c71330833a17d8026ccec2a30_NeikiAnalytics.exe 1rlfxlf.exe PID 1640 wrote to memory of 1320 1640 cf8c775c71330833a17d8026ccec2a30_NeikiAnalytics.exe 1rlfxlf.exe PID 1640 wrote to memory of 1320 1640 cf8c775c71330833a17d8026ccec2a30_NeikiAnalytics.exe 1rlfxlf.exe PID 1640 wrote to memory of 1320 1640 cf8c775c71330833a17d8026ccec2a30_NeikiAnalytics.exe 1rlfxlf.exe PID 1320 wrote to memory of 2368 1320 1rlfxlf.exe tnbbbb.exe PID 1320 wrote to memory of 2368 1320 1rlfxlf.exe tnbbbb.exe PID 1320 wrote to memory of 2368 1320 1rlfxlf.exe tnbbbb.exe PID 1320 wrote to memory of 2368 1320 1rlfxlf.exe tnbbbb.exe PID 2368 wrote to memory of 2672 2368 tnbbbb.exe jdjpp.exe PID 2368 wrote to memory of 2672 2368 tnbbbb.exe jdjpp.exe PID 2368 wrote to memory of 2672 2368 tnbbbb.exe jdjpp.exe PID 2368 wrote to memory of 2672 2368 tnbbbb.exe jdjpp.exe PID 2672 wrote to memory of 2736 2672 jdjpp.exe xlrllfl.exe PID 2672 wrote to memory of 2736 2672 jdjpp.exe xlrllfl.exe PID 2672 wrote to memory of 2736 2672 jdjpp.exe xlrllfl.exe PID 2672 wrote to memory of 2736 2672 jdjpp.exe xlrllfl.exe PID 2736 wrote to memory of 2560 2736 xlrllfl.exe 7tnbbn.exe PID 2736 wrote to memory of 2560 2736 xlrllfl.exe 7tnbbn.exe PID 2736 wrote to memory of 2560 2736 xlrllfl.exe 7tnbbn.exe PID 2736 wrote to memory of 2560 2736 xlrllfl.exe 7tnbbn.exe PID 2560 wrote to memory of 2440 2560 7tnbbn.exe 1vvdv.exe PID 2560 wrote to memory of 2440 2560 7tnbbn.exe 1vvdv.exe PID 2560 wrote to memory of 2440 2560 7tnbbn.exe 1vvdv.exe PID 2560 wrote to memory of 2440 2560 7tnbbn.exe 1vvdv.exe PID 2440 wrote to memory of 2728 2440 1vvdv.exe fxlxfrr.exe PID 2440 wrote to memory of 2728 2440 1vvdv.exe fxlxfrr.exe PID 2440 wrote to memory of 2728 2440 1vvdv.exe fxlxfrr.exe PID 2440 wrote to memory of 2728 2440 1vvdv.exe fxlxfrr.exe PID 2728 wrote to memory of 2488 2728 fxlxfrr.exe lflfxxx.exe PID 2728 wrote to memory of 2488 2728 fxlxfrr.exe lflfxxx.exe PID 2728 wrote to memory of 2488 2728 fxlxfrr.exe lflfxxx.exe PID 2728 wrote to memory of 2488 2728 fxlxfrr.exe lflfxxx.exe PID 2488 wrote to memory of 2920 2488 lflfxxx.exe btntbn.exe PID 2488 wrote to memory of 2920 2488 lflfxxx.exe btntbn.exe PID 2488 wrote to memory of 2920 2488 lflfxxx.exe btntbn.exe PID 2488 wrote to memory of 2920 2488 lflfxxx.exe btntbn.exe PID 2920 wrote to memory of 2392 2920 btntbn.exe 7ddvd.exe PID 2920 wrote to memory of 2392 2920 btntbn.exe 7ddvd.exe PID 2920 wrote to memory of 2392 2920 btntbn.exe 7ddvd.exe PID 2920 wrote to memory of 2392 2920 btntbn.exe 7ddvd.exe PID 2392 wrote to memory of 2504 2392 7ddvd.exe 9rlfxxx.exe PID 2392 wrote to memory of 2504 2392 7ddvd.exe 9rlfxxx.exe PID 2392 wrote to memory of 2504 2392 7ddvd.exe 9rlfxxx.exe PID 2392 wrote to memory of 2504 2392 7ddvd.exe 9rlfxxx.exe PID 2504 wrote to memory of 2312 2504 9rlfxxx.exe nhbbnt.exe PID 2504 wrote to memory of 2312 2504 9rlfxxx.exe nhbbnt.exe PID 2504 wrote to memory of 2312 2504 9rlfxxx.exe nhbbnt.exe PID 2504 wrote to memory of 2312 2504 9rlfxxx.exe nhbbnt.exe PID 2312 wrote to memory of 1884 2312 nhbbnt.exe vpvpj.exe PID 2312 wrote to memory of 1884 2312 nhbbnt.exe vpvpj.exe PID 2312 wrote to memory of 1884 2312 nhbbnt.exe vpvpj.exe PID 2312 wrote to memory of 1884 2312 nhbbnt.exe vpvpj.exe PID 1884 wrote to memory of 1988 1884 vpvpj.exe rlllflx.exe PID 1884 wrote to memory of 1988 1884 vpvpj.exe rlllflx.exe PID 1884 wrote to memory of 1988 1884 vpvpj.exe rlllflx.exe PID 1884 wrote to memory of 1988 1884 vpvpj.exe rlllflx.exe PID 1988 wrote to memory of 280 1988 rlllflx.exe tnntnb.exe PID 1988 wrote to memory of 280 1988 rlllflx.exe tnntnb.exe PID 1988 wrote to memory of 280 1988 rlllflx.exe tnntnb.exe PID 1988 wrote to memory of 280 1988 rlllflx.exe tnntnb.exe PID 280 wrote to memory of 1244 280 tnntnb.exe 7vjdj.exe PID 280 wrote to memory of 1244 280 tnntnb.exe 7vjdj.exe PID 280 wrote to memory of 1244 280 tnntnb.exe 7vjdj.exe PID 280 wrote to memory of 1244 280 tnntnb.exe 7vjdj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf8c775c71330833a17d8026ccec2a30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\cf8c775c71330833a17d8026ccec2a30_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\1rlfxlf.exec:\1rlfxlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\tnbbbb.exec:\tnbbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\jdjpp.exec:\jdjpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\xlrllfl.exec:\xlrllfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\7tnbbn.exec:\7tnbbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\1vvdv.exec:\1vvdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\fxlxfrr.exec:\fxlxfrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\lflfxxx.exec:\lflfxxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\btntbn.exec:\btntbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\7ddvd.exec:\7ddvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\9rlfxxx.exec:\9rlfxxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\nhbbnt.exec:\nhbbnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\vpvpj.exec:\vpvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\rlllflx.exec:\rlllflx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\tnntnb.exec:\tnntnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:280 -
\??\c:\7vjdj.exec:\7vjdj.exe17⤵
- Executes dropped EXE
PID:1244 -
\??\c:\ffrrffr.exec:\ffrrffr.exe18⤵
- Executes dropped EXE
PID:2180 -
\??\c:\bbtbth.exec:\bbtbth.exe19⤵
- Executes dropped EXE
PID:1556 -
\??\c:\btbhtb.exec:\btbhtb.exe20⤵
- Executes dropped EXE
PID:2632 -
\??\c:\jdpdp.exec:\jdpdp.exe21⤵
- Executes dropped EXE
PID:2252 -
\??\c:\bntbhn.exec:\bntbhn.exe22⤵
- Executes dropped EXE
PID:1264 -
\??\c:\vjddv.exec:\vjddv.exe23⤵
- Executes dropped EXE
PID:384 -
\??\c:\pjvdp.exec:\pjvdp.exe24⤵
- Executes dropped EXE
PID:1056 -
\??\c:\3rrlxrl.exec:\3rrlxrl.exe25⤵
- Executes dropped EXE
PID:2788 -
\??\c:\vppdv.exec:\vppdv.exe26⤵
- Executes dropped EXE
PID:1468 -
\??\c:\pjppv.exec:\pjppv.exe27⤵
- Executes dropped EXE
PID:1292 -
\??\c:\thtbbt.exec:\thtbbt.exe28⤵
- Executes dropped EXE
PID:1856 -
\??\c:\ppdjv.exec:\ppdjv.exe29⤵
- Executes dropped EXE
PID:1444 -
\??\c:\rfxxllf.exec:\rfxxllf.exe30⤵
- Executes dropped EXE
PID:1908 -
\??\c:\rlxfrrf.exec:\rlxfrrf.exe31⤵
- Executes dropped EXE
PID:1424 -
\??\c:\btntbn.exec:\btntbn.exe32⤵
- Executes dropped EXE
PID:2108 -
\??\c:\9pvvj.exec:\9pvvj.exe33⤵
- Executes dropped EXE
PID:880 -
\??\c:\xxrfrrf.exec:\xxrfrrf.exe34⤵
- Executes dropped EXE
PID:1452 -
\??\c:\hhttht.exec:\hhttht.exe35⤵PID:1636
-
\??\c:\nhthnt.exec:\nhthnt.exe36⤵
- Executes dropped EXE
PID:2964 -
\??\c:\vdppd.exec:\vdppd.exe37⤵
- Executes dropped EXE
PID:2996 -
\??\c:\7rflrxl.exec:\7rflrxl.exe38⤵
- Executes dropped EXE
PID:2544 -
\??\c:\ffxlrxl.exec:\ffxlrxl.exe39⤵
- Executes dropped EXE
PID:2564 -
\??\c:\7nhhtn.exec:\7nhhtn.exe40⤵
- Executes dropped EXE
PID:2672 -
\??\c:\dpdjd.exec:\dpdjd.exe41⤵
- Executes dropped EXE
PID:2840 -
\??\c:\9jpdv.exec:\9jpdv.exe42⤵
- Executes dropped EXE
PID:2616 -
\??\c:\1tnnbh.exec:\1tnnbh.exe43⤵
- Executes dropped EXE
PID:2460 -
\??\c:\pjdvp.exec:\pjdvp.exe44⤵
- Executes dropped EXE
PID:2440 -
\??\c:\9pjvd.exec:\9pjvd.exe45⤵
- Executes dropped EXE
PID:2728 -
\??\c:\rrxlxfr.exec:\rrxlxfr.exe46⤵
- Executes dropped EXE
PID:2948 -
\??\c:\5bntbb.exec:\5bntbb.exe47⤵
- Executes dropped EXE
PID:1992 -
\??\c:\ttnhtb.exec:\ttnhtb.exe48⤵
- Executes dropped EXE
PID:2656 -
\??\c:\dpjjd.exec:\dpjjd.exe49⤵
- Executes dropped EXE
PID:2620 -
\??\c:\lfxfrxr.exec:\lfxfrxr.exe50⤵
- Executes dropped EXE
PID:2592 -
\??\c:\rrlrlrl.exec:\rrlrlrl.exe51⤵
- Executes dropped EXE
PID:1952 -
\??\c:\3nhttt.exec:\3nhttt.exe52⤵
- Executes dropped EXE
PID:1756 -
\??\c:\btnntb.exec:\btnntb.exe53⤵
- Executes dropped EXE
PID:1588 -
\??\c:\jpjdd.exec:\jpjdd.exe54⤵
- Executes dropped EXE
PID:1652 -
\??\c:\xrrrxrl.exec:\xrrrxrl.exe55⤵
- Executes dropped EXE
PID:2316 -
\??\c:\1rrxllx.exec:\1rrxllx.exe56⤵
- Executes dropped EXE
PID:1244 -
\??\c:\1thnhn.exec:\1thnhn.exe57⤵
- Executes dropped EXE
PID:2800 -
\??\c:\dpvdp.exec:\dpvdp.exe58⤵
- Executes dropped EXE
PID:836 -
\??\c:\xlxfllx.exec:\xlxfllx.exe59⤵
- Executes dropped EXE
PID:2808 -
\??\c:\fxrxxfl.exec:\fxrxxfl.exe60⤵
- Executes dropped EXE
PID:2820 -
\??\c:\9nbbnh.exec:\9nbbnh.exe61⤵
- Executes dropped EXE
PID:2116 -
\??\c:\nbnntb.exec:\nbnntb.exe62⤵
- Executes dropped EXE
PID:772 -
\??\c:\jpdpj.exec:\jpdpj.exe63⤵
- Executes dropped EXE
PID:1568 -
\??\c:\7rxfrrx.exec:\7rxfrrx.exe64⤵
- Executes dropped EXE
PID:984 -
\??\c:\1xrrflr.exec:\1xrrflr.exe65⤵
- Executes dropped EXE
PID:1748 -
\??\c:\7nhtht.exec:\7nhtht.exe66⤵
- Executes dropped EXE
PID:3000 -
\??\c:\httnnh.exec:\httnnh.exe67⤵PID:2036
-
\??\c:\3pjpj.exec:\3pjpj.exe68⤵PID:3064
-
\??\c:\1jdjd.exec:\1jdjd.exe69⤵PID:1796
-
\??\c:\ffxlflf.exec:\ffxlflf.exe70⤵PID:1712
-
\??\c:\tnttnt.exec:\tnttnt.exe71⤵PID:2936
-
\??\c:\ttthbn.exec:\ttthbn.exe72⤵PID:2880
-
\??\c:\djdjv.exec:\djdjv.exe73⤵PID:1660
-
\??\c:\jjjpd.exec:\jjjpd.exe74⤵PID:2992
-
\??\c:\flffxlf.exec:\flffxlf.exe75⤵PID:1436
-
\??\c:\rrrlfxl.exec:\rrrlfxl.exe76⤵PID:1864
-
\??\c:\7tthtt.exec:\7tthtt.exe77⤵PID:1648
-
\??\c:\9vvjv.exec:\9vvjv.exe78⤵PID:2016
-
\??\c:\ppddp.exec:\ppddp.exe79⤵PID:2980
-
\??\c:\xfrrfxx.exec:\xfrrfxx.exe80⤵PID:2368
-
\??\c:\nnttnn.exec:\nnttnn.exe81⤵PID:2224
-
\??\c:\5htbtt.exec:\5htbtt.exe82⤵PID:2716
-
\??\c:\vpjjv.exec:\vpjjv.exe83⤵PID:2576
-
\??\c:\rllrlxl.exec:\rllrlxl.exe84⤵PID:2588
-
\??\c:\xxxxlxl.exec:\xxxxlxl.exe85⤵PID:2580
-
\??\c:\hhttbb.exec:\hhttbb.exe86⤵PID:2528
-
\??\c:\bthntt.exec:\bthntt.exe87⤵PID:2440
-
\??\c:\3vjpv.exec:\3vjpv.exe88⤵PID:2132
-
\??\c:\lrxlxrx.exec:\lrxlxrx.exe89⤵PID:1684
-
\??\c:\5xffffl.exec:\5xffffl.exe90⤵PID:2596
-
\??\c:\nhnbht.exec:\nhnbht.exe91⤵PID:2664
-
\??\c:\nbnbbb.exec:\nbnbbb.exe92⤵PID:2644
-
\??\c:\vppjd.exec:\vppjd.exe93⤵PID:1944
-
\??\c:\lxxrlfl.exec:\lxxrlfl.exe94⤵PID:2308
-
\??\c:\lflrrxl.exec:\lflrrxl.exe95⤵PID:2188
-
\??\c:\tbbnnh.exec:\tbbnnh.exe96⤵PID:2152
-
\??\c:\nnbnbt.exec:\nnbnbt.exe97⤵PID:2352
-
\??\c:\5vjpv.exec:\5vjpv.exe98⤵PID:2316
-
\??\c:\lxllfff.exec:\lxllfff.exe99⤵PID:1244
-
\??\c:\rlfrxfl.exec:\rlfrxfl.exe100⤵PID:1580
-
\??\c:\nttthh.exec:\nttthh.exe101⤵PID:2220
-
\??\c:\jdvdj.exec:\jdvdj.exe102⤵PID:1116
-
\??\c:\3ddvp.exec:\3ddvp.exe103⤵PID:2164
-
\??\c:\ffxxlff.exec:\ffxxlff.exe104⤵PID:756
-
\??\c:\rlflrrf.exec:\rlflrrf.exe105⤵PID:772
-
\??\c:\ttthnh.exec:\ttthnh.exe106⤵PID:1604
-
\??\c:\pjppp.exec:\pjppp.exe107⤵PID:1408
-
\??\c:\llxlrxf.exec:\llxlrxf.exe108⤵PID:452
-
\??\c:\rrxfffr.exec:\rrxfffr.exe109⤵PID:1800
-
\??\c:\hbtnth.exec:\hbtnth.exe110⤵PID:1860
-
\??\c:\tthhnh.exec:\tthhnh.exe111⤵PID:1848
-
\??\c:\vpdjv.exec:\vpdjv.exe112⤵PID:2884
-
\??\c:\5lrlrrf.exec:\5lrlrrf.exe113⤵PID:844
-
\??\c:\5flrxrf.exec:\5flrxrf.exe114⤵PID:3060
-
\??\c:\bnnhnb.exec:\bnnhnb.exe115⤵PID:1424
-
\??\c:\pjpvj.exec:\pjpvj.exe116⤵PID:2832
-
\??\c:\1pjpj.exec:\1pjpj.exe117⤵PID:2992
-
\??\c:\xlrlxll.exec:\xlrlxll.exe118⤵PID:1536
-
\??\c:\ffrfrxr.exec:\ffrfrxr.exe119⤵PID:1640
-
\??\c:\3thbbt.exec:\3thbbt.exe120⤵PID:3036
-
\??\c:\jvvdd.exec:\jvvdd.exe121⤵PID:2120
-
\??\c:\7dvdp.exec:\7dvdp.exe122⤵PID:2692
-
\??\c:\7rfflrr.exec:\7rfflrr.exe123⤵PID:2548
-
\??\c:\bnttbb.exec:\bnttbb.exe124⤵PID:2848
-
\??\c:\5hntht.exec:\5hntht.exe125⤵PID:2836
-
\??\c:\vvpvj.exec:\vvpvj.exe126⤵PID:2324
-
\??\c:\vdppd.exec:\vdppd.exe127⤵PID:2940
-
\??\c:\xrlxfll.exec:\xrlxfll.exe128⤵PID:2416
-
\??\c:\ffrxfxf.exec:\ffrxfxf.exe129⤵PID:2468
-
\??\c:\3tbttn.exec:\3tbttn.exe130⤵PID:1584
-
\??\c:\ttbntt.exec:\ttbntt.exe131⤵PID:796
-
\??\c:\ppddv.exec:\ppddv.exe132⤵PID:2600
-
\??\c:\9vjdv.exec:\9vjdv.exe133⤵PID:1592
-
\??\c:\3rllllr.exec:\3rllllr.exe134⤵PID:1932
-
\??\c:\ttbhht.exec:\ttbhht.exe135⤵PID:2644
-
\??\c:\bbnbth.exec:\bbnbth.exe136⤵PID:1936
-
\??\c:\dddpv.exec:\dddpv.exe137⤵PID:1988
-
\??\c:\xlxfxlx.exec:\xlxfxlx.exe138⤵PID:1012
-
\??\c:\3bnhnt.exec:\3bnhnt.exe139⤵PID:356
-
\??\c:\5nbbnt.exec:\5nbbnt.exe140⤵PID:1688
-
\??\c:\vjppp.exec:\vjppp.exe141⤵PID:1008
-
\??\c:\dvdjp.exec:\dvdjp.exe142⤵PID:2816
-
\??\c:\lfrrfxx.exec:\lfrrfxx.exe143⤵PID:2064
-
\??\c:\nbbhnt.exec:\nbbhnt.exe144⤵PID:2632
-
\??\c:\bbtbht.exec:\bbtbht.exe145⤵PID:1264
-
\??\c:\3jddp.exec:\3jddp.exe146⤵PID:588
-
\??\c:\1ffxxrl.exec:\1ffxxrl.exe147⤵PID:1180
-
\??\c:\7fllrrx.exec:\7fllrrx.exe148⤵PID:1464
-
\??\c:\tnhhtb.exec:\tnhhtb.exe149⤵PID:1604
-
\??\c:\hbntbh.exec:\hbntbh.exe150⤵PID:2388
-
\??\c:\jvddv.exec:\jvddv.exe151⤵PID:824
-
\??\c:\ppddj.exec:\ppddj.exe152⤵PID:1880
-
\??\c:\9rxxlrx.exec:\9rxxlrx.exe153⤵PID:572
-
\??\c:\tnbhbb.exec:\tnbhbb.exe154⤵PID:1444
-
\??\c:\bnhhnn.exec:\bnhhnn.exe155⤵PID:2884
-
\??\c:\pjpvj.exec:\pjpvj.exe156⤵PID:2880
-
\??\c:\fxlxxxr.exec:\fxlxxxr.exe157⤵PID:3060
-
\??\c:\hhtbbn.exec:\hhtbbn.exe158⤵PID:2108
-
\??\c:\3jjvd.exec:\3jjvd.exe159⤵PID:2844
-
\??\c:\jjpjd.exec:\jjpjd.exe160⤵PID:2824
-
\??\c:\lrrrffl.exec:\lrrrffl.exe161⤵PID:2508
-
\??\c:\9tthth.exec:\9tthth.exe162⤵PID:2608
-
\??\c:\1vpjj.exec:\1vpjj.exe163⤵PID:2688
-
\??\c:\fxlflxr.exec:\fxlflxr.exe164⤵PID:2676
-
\??\c:\rlfxlrf.exec:\rlfxlrf.exe165⤵PID:2224
-
\??\c:\nhbttb.exec:\nhbttb.exe166⤵PID:2716
-
\??\c:\dpvvj.exec:\dpvvj.exe167⤵PID:3004
-
\??\c:\ppvdp.exec:\ppvdp.exe168⤵PID:2176
-
\??\c:\7rflrfl.exec:\7rflrfl.exe169⤵PID:2624
-
\??\c:\bbthtb.exec:\bbthtb.exe170⤵PID:2432
-
\??\c:\3ttnbh.exec:\3ttnbh.exe171⤵PID:1596
-
\??\c:\ppvjd.exec:\ppvjd.exe172⤵PID:2924
-
\??\c:\1vvjd.exec:\1vvjd.exe173⤵PID:352
-
\??\c:\ffrrffr.exec:\ffrrffr.exe174⤵PID:2724
-
\??\c:\xxrfxfr.exec:\xxrfxfr.exe175⤵PID:2636
-
\??\c:\bbtbtt.exec:\bbtbtt.exe176⤵PID:1192
-
\??\c:\hbbbbt.exec:\hbbbbt.exe177⤵PID:2008
-
\??\c:\ddvvp.exec:\ddvvp.exe178⤵PID:1888
-
\??\c:\fxxlrxf.exec:\fxxlrxf.exe179⤵PID:272
-
\??\c:\ffxrfrx.exec:\ffxrfrx.exe180⤵PID:1336
-
\??\c:\tnbntt.exec:\tnbntt.exe181⤵PID:2604
-
\??\c:\1ttbhn.exec:\1ttbhn.exe182⤵PID:2364
-
\??\c:\ddpdp.exec:\ddpdp.exe183⤵PID:2796
-
\??\c:\ffxlrfx.exec:\ffxlrfx.exe184⤵PID:1556
-
\??\c:\lfrrflr.exec:\lfrrflr.exe185⤵PID:1984
-
\??\c:\ttbtnb.exec:\ttbtnb.exe186⤵PID:2252
-
\??\c:\tnthtb.exec:\tnthtb.exe187⤵PID:2280
-
\??\c:\dvpdv.exec:\dvpdv.exe188⤵PID:1420
-
\??\c:\llxxlxx.exec:\llxxlxx.exe189⤵PID:1440
-
\??\c:\lxllllr.exec:\lxllllr.exe190⤵PID:2044
-
\??\c:\thhbbb.exec:\thhbbb.exe191⤵PID:952
-
\??\c:\pjvvp.exec:\pjvvp.exe192⤵PID:688
-
\??\c:\5djpp.exec:\5djpp.exe193⤵PID:1300
-
\??\c:\lfrfffr.exec:\lfrfffr.exe194⤵PID:1860
-
\??\c:\btttth.exec:\btttth.exe195⤵PID:912
-
\??\c:\1bbtnt.exec:\1bbtnt.exe196⤵PID:2356
-
\??\c:\djdpv.exec:\djdpv.exe197⤵PID:2936
-
\??\c:\5vjpv.exec:\5vjpv.exe198⤵PID:1432
-
\??\c:\1rxflll.exec:\1rxflll.exe199⤵PID:2880
-
\??\c:\9hnnht.exec:\9hnnht.exe200⤵PID:2496
-
\??\c:\nhtttt.exec:\nhtttt.exe201⤵PID:1924
-
\??\c:\vjppp.exec:\vjppp.exe202⤵PID:1184
-
\??\c:\rlrxffr.exec:\rlrxffr.exe203⤵PID:1644
-
\??\c:\3rllxff.exec:\3rllxff.exe204⤵PID:1640
-
\??\c:\3htbhn.exec:\3htbhn.exe205⤵PID:616
-
\??\c:\thtnbb.exec:\thtnbb.exe206⤵PID:2120
-
\??\c:\vjvpv.exec:\vjvpv.exe207⤵PID:2692
-
\??\c:\dpdvp.exec:\dpdvp.exe208⤵PID:2244
-
\??\c:\lxrrfff.exec:\lxrrfff.exe209⤵PID:2848
-
\??\c:\btbhnn.exec:\btbhnn.exe210⤵PID:2836
-
\??\c:\9bnthb.exec:\9bnthb.exe211⤵PID:2324
-
\??\c:\pjppd.exec:\pjppd.exe212⤵PID:2940
-
\??\c:\vpdjv.exec:\vpdjv.exe213⤵PID:2916
-
\??\c:\lfxlxrf.exec:\lfxlxrf.exe214⤵PID:2476
-
\??\c:\tthtbn.exec:\tthtbn.exe215⤵PID:2516
-
\??\c:\nhbtbb.exec:\nhbtbb.exe216⤵PID:2484
-
\??\c:\vvjjd.exec:\vvjjd.exe217⤵PID:2140
-
\??\c:\lfrrrxf.exec:\lfrrrxf.exe218⤵PID:1928
-
\??\c:\5llrrxf.exec:\5llrrxf.exe219⤵PID:2312
-
\??\c:\7tttbt.exec:\7tttbt.exe220⤵PID:2644
-
\??\c:\9btthn.exec:\9btthn.exe221⤵PID:664
-
\??\c:\pjjjd.exec:\pjjjd.exe222⤵PID:2152
-
\??\c:\ffrxxfr.exec:\ffrxxfr.exe223⤵PID:1012
-
\??\c:\3llrxfl.exec:\3llrxfl.exe224⤵PID:356
-
\??\c:\9nthbh.exec:\9nthbh.exe225⤵PID:1688
-
\??\c:\jdddj.exec:\jdddj.exe226⤵PID:2456
-
\??\c:\djpvv.exec:\djpvv.exe227⤵PID:2816
-
\??\c:\xlrxxrf.exec:\xlrxxrf.exe228⤵PID:1980
-
\??\c:\fxlrffr.exec:\fxlrffr.exe229⤵PID:2260
-
\??\c:\bhbbhb.exec:\bhbbhb.exe230⤵PID:1264
-
\??\c:\ttthbn.exec:\ttthbn.exe231⤵PID:1568
-
\??\c:\3vjpd.exec:\3vjpd.exe232⤵PID:772
-
\??\c:\ddpjv.exec:\ddpjv.exe233⤵PID:1464
-
\??\c:\xxrxlxl.exec:\xxrxlxl.exe234⤵PID:276
-
\??\c:\hbthhn.exec:\hbthhn.exe235⤵PID:2036
-
\??\c:\hhtbhh.exec:\hhtbhh.exe236⤵PID:3064
-
\??\c:\3pdpd.exec:\3pdpd.exe237⤵PID:792
-
\??\c:\vvdpj.exec:\vvdpj.exe238⤵PID:1712
-
\??\c:\lxfllfl.exec:\lxfllfl.exe239⤵PID:2952
-
\??\c:\bbhbbh.exec:\bbhbbh.exe240⤵PID:2888
-
\??\c:\bthhtt.exec:\bthhtt.exe241⤵PID:2944
-
\??\c:\pjjpp.exec:\pjjpp.exe242⤵PID:1916