Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 20:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4d80bf26a8ae547018e5c490af88de90_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4d80bf26a8ae547018e5c490af88de90_NeikiAnalytics.exe
-
Size
64KB
-
MD5
4d80bf26a8ae547018e5c490af88de90
-
SHA1
f422ccb67549a6b09c231a9dd1976b155f769b29
-
SHA256
9434a81b9e30ac69a3a97272fb7951c58e1a327b833945a7711fccbf523fba7f
-
SHA512
a8b56f797ecb7885d21422dafbc184a7b3cde0841d25bb387e19163631d0a01585aa3f9919a64146b89cd96a36f9944c244644ce514827757ce8ed37c2443982
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8+LuvdK:ymb3NkkiQ3mdBjF0yMlv
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral1/memory/2372-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/348-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/348-21-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2392-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1972-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1976-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2020-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1396-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1288-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2304-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/556-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/644-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1732-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/960-266-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2272-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/292-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bnbbhn.exeppjpv.exe3nnbtn.exepvvdv.exedjpvj.exe3tthtn.exebtntbh.exejpdjp.exe1xlxxxx.exenhtbtt.exepdvdp.exe9fxfrxr.exelfflrfx.exe9hbtbn.exevdvpd.exedvjpj.exe1rrxlxr.exebhtnnh.exejvvvj.exejjpdd.exeflxllfr.exehnttbt.exevvdvj.exelfxxfxf.exellrrxll.exehbhttb.exexrllxff.exelfrxflr.exettntnb.exedddjd.exelxrrrrx.exetnhbnn.exedvpvj.exe5jddd.exerlfflrx.exe3bhnth.exetnbttn.exejjjvv.exe7pvdj.exexrrxffl.exeflllrxl.exebthnnb.exepdjjj.exerrlfflx.exeffrxllf.exe5ttttb.exenhthhh.exepjjjj.exe3dvdd.exefrfxlfl.exe3xfrlrx.exebttbtb.exe7jpdj.exevvdjv.exelflxllr.exefxflrxf.exehhhtth.exehhtbth.exejdpvp.exexfxfrlr.exerlfxxlr.exennhttb.exedvjvp.exevpjjp.exepid process 348 bnbbhn.exe 2392 ppjpv.exe 2636 3nnbtn.exe 1972 pvvdv.exe 2660 djpvj.exe 2464 3tthtn.exe 2552 btntbh.exe 2512 jpdjp.exe 1716 1xlxxxx.exe 2992 nhtbtt.exe 1976 pdvdp.exe 2020 9fxfrxr.exe 2332 lfflrfx.exe 1756 9hbtbn.exe 2628 vdvpd.exe 2936 dvjpj.exe 1396 1rrxlxr.exe 1288 bhtnnh.exe 2304 jvvvj.exe 2212 jjpdd.exe 2884 flxllfr.exe 556 hnttbt.exe 644 vvdvj.exe 1732 lfxxfxf.exe 1644 llrrxll.exe 2344 hbhttb.exe 960 xrllxff.exe 2860 lfrxflr.exe 2272 ttntnb.exe 3056 dddjd.exe 292 lxrrrrx.exe 500 tnhbnn.exe 3040 dvpvj.exe 1604 5jddd.exe 2340 rlfflrx.exe 2652 3bhnth.exe 2636 tnbttn.exe 2668 jjjvv.exe 2756 7pvdj.exe 1936 xrrxffl.exe 2792 flllrxl.exe 2460 bthnnb.exe 2552 pdjjj.exe 1940 rrlfflx.exe 2728 ffrxllf.exe 2952 5ttttb.exe 2536 nhthhh.exe 1976 pjjjj.exe 2740 3dvdd.exe 2508 frfxlfl.exe 1632 3xfrlrx.exe 2804 bttbtb.exe 2948 7jpdj.exe 2844 vvdjv.exe 1396 lflxllr.exe 2300 fxflrxf.exe 2040 hhhtth.exe 2188 hhtbth.exe 2896 jdpvp.exe 2420 xfxfrlr.exe 1028 rlfxxlr.exe 1648 nnhttb.exe 1800 dvjvp.exe 1776 vpjjp.exe -
Processes:
resource yara_rule behavioral1/memory/2372-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/348-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1972-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1396-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1288-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/556-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/644-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1732-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/960-266-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/292-302-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4d80bf26a8ae547018e5c490af88de90_NeikiAnalytics.exebnbbhn.exeppjpv.exe3nnbtn.exepvvdv.exedjpvj.exe3tthtn.exebtntbh.exejpdjp.exe1xlxxxx.exenhtbtt.exepdvdp.exe9fxfrxr.exelfflrfx.exe9hbtbn.exevdvpd.exedescription pid process target process PID 2372 wrote to memory of 348 2372 4d80bf26a8ae547018e5c490af88de90_NeikiAnalytics.exe bnbbhn.exe PID 2372 wrote to memory of 348 2372 4d80bf26a8ae547018e5c490af88de90_NeikiAnalytics.exe bnbbhn.exe PID 2372 wrote to memory of 348 2372 4d80bf26a8ae547018e5c490af88de90_NeikiAnalytics.exe bnbbhn.exe PID 2372 wrote to memory of 348 2372 4d80bf26a8ae547018e5c490af88de90_NeikiAnalytics.exe bnbbhn.exe PID 348 wrote to memory of 2392 348 bnbbhn.exe ppjpv.exe PID 348 wrote to memory of 2392 348 bnbbhn.exe ppjpv.exe PID 348 wrote to memory of 2392 348 bnbbhn.exe ppjpv.exe PID 348 wrote to memory of 2392 348 bnbbhn.exe ppjpv.exe PID 2392 wrote to memory of 2636 2392 ppjpv.exe 3nnbtn.exe PID 2392 wrote to memory of 2636 2392 ppjpv.exe 3nnbtn.exe PID 2392 wrote to memory of 2636 2392 ppjpv.exe 3nnbtn.exe PID 2392 wrote to memory of 2636 2392 ppjpv.exe 3nnbtn.exe PID 2636 wrote to memory of 1972 2636 3nnbtn.exe pvvdv.exe PID 2636 wrote to memory of 1972 2636 3nnbtn.exe pvvdv.exe PID 2636 wrote to memory of 1972 2636 3nnbtn.exe pvvdv.exe PID 2636 wrote to memory of 1972 2636 3nnbtn.exe pvvdv.exe PID 1972 wrote to memory of 2660 1972 pvvdv.exe djpvj.exe PID 1972 wrote to memory of 2660 1972 pvvdv.exe djpvj.exe PID 1972 wrote to memory of 2660 1972 pvvdv.exe djpvj.exe PID 1972 wrote to memory of 2660 1972 pvvdv.exe djpvj.exe PID 2660 wrote to memory of 2464 2660 djpvj.exe 3tthtn.exe PID 2660 wrote to memory of 2464 2660 djpvj.exe 3tthtn.exe PID 2660 wrote to memory of 2464 2660 djpvj.exe 3tthtn.exe PID 2660 wrote to memory of 2464 2660 djpvj.exe 3tthtn.exe PID 2464 wrote to memory of 2552 2464 3tthtn.exe btntbh.exe PID 2464 wrote to memory of 2552 2464 3tthtn.exe btntbh.exe PID 2464 wrote to memory of 2552 2464 3tthtn.exe btntbh.exe PID 2464 wrote to memory of 2552 2464 3tthtn.exe btntbh.exe PID 2552 wrote to memory of 2512 2552 btntbh.exe jpdjp.exe PID 2552 wrote to memory of 2512 2552 btntbh.exe jpdjp.exe PID 2552 wrote to memory of 2512 2552 btntbh.exe jpdjp.exe PID 2552 wrote to memory of 2512 2552 btntbh.exe jpdjp.exe PID 2512 wrote to memory of 1716 2512 jpdjp.exe 1xlxxxx.exe PID 2512 wrote to memory of 1716 2512 jpdjp.exe 1xlxxxx.exe PID 2512 wrote to memory of 1716 2512 jpdjp.exe 1xlxxxx.exe PID 2512 wrote to memory of 1716 2512 jpdjp.exe 1xlxxxx.exe PID 1716 wrote to memory of 2992 1716 1xlxxxx.exe nhtbtt.exe PID 1716 wrote to memory of 2992 1716 1xlxxxx.exe nhtbtt.exe PID 1716 wrote to memory of 2992 1716 1xlxxxx.exe nhtbtt.exe PID 1716 wrote to memory of 2992 1716 1xlxxxx.exe nhtbtt.exe PID 2992 wrote to memory of 1976 2992 nhtbtt.exe pdvdp.exe PID 2992 wrote to memory of 1976 2992 nhtbtt.exe pdvdp.exe PID 2992 wrote to memory of 1976 2992 nhtbtt.exe pdvdp.exe PID 2992 wrote to memory of 1976 2992 nhtbtt.exe pdvdp.exe PID 1976 wrote to memory of 2020 1976 pdvdp.exe 9fxfrxr.exe PID 1976 wrote to memory of 2020 1976 pdvdp.exe 9fxfrxr.exe PID 1976 wrote to memory of 2020 1976 pdvdp.exe 9fxfrxr.exe PID 1976 wrote to memory of 2020 1976 pdvdp.exe 9fxfrxr.exe PID 2020 wrote to memory of 2332 2020 9fxfrxr.exe lfflrfx.exe PID 2020 wrote to memory of 2332 2020 9fxfrxr.exe lfflrfx.exe PID 2020 wrote to memory of 2332 2020 9fxfrxr.exe lfflrfx.exe PID 2020 wrote to memory of 2332 2020 9fxfrxr.exe lfflrfx.exe PID 2332 wrote to memory of 1756 2332 lfflrfx.exe 9hbtbn.exe PID 2332 wrote to memory of 1756 2332 lfflrfx.exe 9hbtbn.exe PID 2332 wrote to memory of 1756 2332 lfflrfx.exe 9hbtbn.exe PID 2332 wrote to memory of 1756 2332 lfflrfx.exe 9hbtbn.exe PID 1756 wrote to memory of 2628 1756 9hbtbn.exe vdvpd.exe PID 1756 wrote to memory of 2628 1756 9hbtbn.exe vdvpd.exe PID 1756 wrote to memory of 2628 1756 9hbtbn.exe vdvpd.exe PID 1756 wrote to memory of 2628 1756 9hbtbn.exe vdvpd.exe PID 2628 wrote to memory of 2936 2628 vdvpd.exe dvjpj.exe PID 2628 wrote to memory of 2936 2628 vdvpd.exe dvjpj.exe PID 2628 wrote to memory of 2936 2628 vdvpd.exe dvjpj.exe PID 2628 wrote to memory of 2936 2628 vdvpd.exe dvjpj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d80bf26a8ae547018e5c490af88de90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4d80bf26a8ae547018e5c490af88de90_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\bnbbhn.exec:\bnbbhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\ppjpv.exec:\ppjpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\3nnbtn.exec:\3nnbtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\pvvdv.exec:\pvvdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\djpvj.exec:\djpvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\3tthtn.exec:\3tthtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\btntbh.exec:\btntbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\jpdjp.exec:\jpdjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\1xlxxxx.exec:\1xlxxxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\nhtbtt.exec:\nhtbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\pdvdp.exec:\pdvdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\9fxfrxr.exec:\9fxfrxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\lfflrfx.exec:\lfflrfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\9hbtbn.exec:\9hbtbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\vdvpd.exec:\vdvpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\dvjpj.exec:\dvjpj.exe17⤵
- Executes dropped EXE
PID:2936 -
\??\c:\1rrxlxr.exec:\1rrxlxr.exe18⤵
- Executes dropped EXE
PID:1396 -
\??\c:\bhtnnh.exec:\bhtnnh.exe19⤵
- Executes dropped EXE
PID:1288 -
\??\c:\jvvvj.exec:\jvvvj.exe20⤵
- Executes dropped EXE
PID:2304 -
\??\c:\jjpdd.exec:\jjpdd.exe21⤵
- Executes dropped EXE
PID:2212 -
\??\c:\flxllfr.exec:\flxllfr.exe22⤵
- Executes dropped EXE
PID:2884 -
\??\c:\hnttbt.exec:\hnttbt.exe23⤵
- Executes dropped EXE
PID:556 -
\??\c:\vvdvj.exec:\vvdvj.exe24⤵
- Executes dropped EXE
PID:644 -
\??\c:\lfxxfxf.exec:\lfxxfxf.exe25⤵
- Executes dropped EXE
PID:1732 -
\??\c:\llrrxll.exec:\llrrxll.exe26⤵
- Executes dropped EXE
PID:1644 -
\??\c:\hbhttb.exec:\hbhttb.exe27⤵
- Executes dropped EXE
PID:2344 -
\??\c:\xrllxff.exec:\xrllxff.exe28⤵
- Executes dropped EXE
PID:960 -
\??\c:\lfrxflr.exec:\lfrxflr.exe29⤵
- Executes dropped EXE
PID:2860 -
\??\c:\ttntnb.exec:\ttntnb.exe30⤵
- Executes dropped EXE
PID:2272 -
\??\c:\dddjd.exec:\dddjd.exe31⤵
- Executes dropped EXE
PID:3056 -
\??\c:\lxrrrrx.exec:\lxrrrrx.exe32⤵
- Executes dropped EXE
PID:292 -
\??\c:\tnhbnn.exec:\tnhbnn.exe33⤵
- Executes dropped EXE
PID:500 -
\??\c:\dvpvj.exec:\dvpvj.exe34⤵
- Executes dropped EXE
PID:3040 -
\??\c:\5jddd.exec:\5jddd.exe35⤵
- Executes dropped EXE
PID:1604 -
\??\c:\rlfflrx.exec:\rlfflrx.exe36⤵
- Executes dropped EXE
PID:2340 -
\??\c:\3bhnth.exec:\3bhnth.exe37⤵
- Executes dropped EXE
PID:2652 -
\??\c:\tnbttn.exec:\tnbttn.exe38⤵
- Executes dropped EXE
PID:2636 -
\??\c:\jjjvv.exec:\jjjvv.exe39⤵
- Executes dropped EXE
PID:2668 -
\??\c:\7pvdj.exec:\7pvdj.exe40⤵
- Executes dropped EXE
PID:2756 -
\??\c:\xrrxffl.exec:\xrrxffl.exe41⤵
- Executes dropped EXE
PID:1936 -
\??\c:\flllrxl.exec:\flllrxl.exe42⤵
- Executes dropped EXE
PID:2792 -
\??\c:\bthnnb.exec:\bthnnb.exe43⤵
- Executes dropped EXE
PID:2460 -
\??\c:\pdjjj.exec:\pdjjj.exe44⤵
- Executes dropped EXE
PID:2552 -
\??\c:\rrlfflx.exec:\rrlfflx.exe45⤵
- Executes dropped EXE
PID:1940 -
\??\c:\ffrxllf.exec:\ffrxllf.exe46⤵
- Executes dropped EXE
PID:2728 -
\??\c:\5ttttb.exec:\5ttttb.exe47⤵
- Executes dropped EXE
PID:2952 -
\??\c:\nhthhh.exec:\nhthhh.exe48⤵
- Executes dropped EXE
PID:2536 -
\??\c:\pjjjj.exec:\pjjjj.exe49⤵
- Executes dropped EXE
PID:1976 -
\??\c:\3dvdd.exec:\3dvdd.exe50⤵
- Executes dropped EXE
PID:2740 -
\??\c:\frfxlfl.exec:\frfxlfl.exe51⤵
- Executes dropped EXE
PID:2508 -
\??\c:\3xfrlrx.exec:\3xfrlrx.exe52⤵
- Executes dropped EXE
PID:1632 -
\??\c:\bttbtb.exec:\bttbtb.exe53⤵
- Executes dropped EXE
PID:2804 -
\??\c:\7jpdj.exec:\7jpdj.exe54⤵
- Executes dropped EXE
PID:2948 -
\??\c:\vvdjv.exec:\vvdjv.exe55⤵
- Executes dropped EXE
PID:2844 -
\??\c:\lflxllr.exec:\lflxllr.exe56⤵
- Executes dropped EXE
PID:1396 -
\??\c:\fxflrxf.exec:\fxflrxf.exe57⤵
- Executes dropped EXE
PID:2300 -
\??\c:\hhhtth.exec:\hhhtth.exe58⤵
- Executes dropped EXE
PID:2040 -
\??\c:\hhtbth.exec:\hhtbth.exe59⤵
- Executes dropped EXE
PID:2188 -
\??\c:\jdpvp.exec:\jdpvp.exe60⤵
- Executes dropped EXE
PID:2896 -
\??\c:\xfxfrlr.exec:\xfxfrlr.exe61⤵
- Executes dropped EXE
PID:2420 -
\??\c:\rlfxxlr.exec:\rlfxxlr.exe62⤵
- Executes dropped EXE
PID:1028 -
\??\c:\nnhttb.exec:\nnhttb.exe63⤵
- Executes dropped EXE
PID:1648 -
\??\c:\dvjvp.exec:\dvjvp.exe64⤵
- Executes dropped EXE
PID:1800 -
\??\c:\vpjjp.exec:\vpjjp.exe65⤵
- Executes dropped EXE
PID:1776 -
\??\c:\vpjdd.exec:\vpjdd.exe66⤵PID:1224
-
\??\c:\rlflxrf.exec:\rlflxrf.exe67⤵PID:904
-
\??\c:\ttnthh.exec:\ttnthh.exe68⤵PID:2064
-
\??\c:\9hbbhn.exec:\9hbbhn.exe69⤵PID:672
-
\??\c:\pjvvj.exec:\pjvvj.exe70⤵PID:2860
-
\??\c:\7fxfxrf.exec:\7fxfxrf.exe71⤵PID:2272
-
\??\c:\1lxxxfl.exec:\1lxxxfl.exe72⤵PID:1512
-
\??\c:\7tnthh.exec:\7tnthh.exe73⤵PID:2168
-
\??\c:\1tbthh.exec:\1tbthh.exe74⤵PID:2620
-
\??\c:\5jddp.exec:\5jddp.exe75⤵PID:1592
-
\??\c:\5pdpp.exec:\5pdpp.exe76⤵PID:1712
-
\??\c:\rrllfrx.exec:\rrllfrx.exe77⤵PID:1596
-
\??\c:\nbnbhh.exec:\nbnbhh.exe78⤵PID:2880
-
\??\c:\1thtbb.exec:\1thtbb.exe79⤵PID:2652
-
\??\c:\pddpv.exec:\pddpv.exe80⤵PID:2720
-
\??\c:\jdppd.exec:\jdppd.exe81⤵PID:2240
-
\??\c:\frffflr.exec:\frffflr.exe82⤵PID:2680
-
\??\c:\3hbhnh.exec:\3hbhnh.exe83⤵PID:2444
-
\??\c:\tntbbb.exec:\tntbbb.exe84⤵PID:2792
-
\??\c:\jpdpv.exec:\jpdpv.exe85⤵PID:2504
-
\??\c:\ddppv.exec:\ddppv.exe86⤵PID:2516
-
\??\c:\5flfffr.exec:\5flfffr.exe87⤵PID:2708
-
\??\c:\1lffxrf.exec:\1lffxrf.exe88⤵PID:2136
-
\??\c:\bttbtb.exec:\bttbtb.exe89⤵PID:2952
-
\??\c:\dpddd.exec:\dpddd.exe90⤵PID:1964
-
\??\c:\jdvpv.exec:\jdvpv.exe91⤵PID:1976
-
\??\c:\xxrffff.exec:\xxrffff.exe92⤵PID:2808
-
\??\c:\fflrlxx.exec:\fflrlxx.exe93⤵PID:2508
-
\??\c:\btbhth.exec:\btbhth.exe94⤵PID:2224
-
\??\c:\bntnbt.exec:\bntnbt.exe95⤵PID:2804
-
\??\c:\lflflrl.exec:\lflflrl.exe96⤵PID:848
-
\??\c:\lrrflfr.exec:\lrrflfr.exe97⤵PID:1728
-
\??\c:\thbhnh.exec:\thbhnh.exe98⤵PID:1288
-
\??\c:\5tntbn.exec:\5tntbn.exe99⤵PID:2300
-
\??\c:\jjjjp.exec:\jjjjp.exe100⤵PID:2888
-
\??\c:\flxxffx.exec:\flxxffx.exe101⤵PID:2188
-
\??\c:\flrlffr.exec:\flrlffr.exe102⤵PID:756
-
\??\c:\bbnhtn.exec:\bbnhtn.exe103⤵PID:2420
-
\??\c:\jdpdv.exec:\jdpdv.exe104⤵PID:1076
-
\??\c:\lfxxxxx.exec:\lfxxxxx.exe105⤵PID:1648
-
\??\c:\3tbnbh.exec:\3tbnbh.exe106⤵PID:1228
-
\??\c:\nhtbht.exec:\nhtbht.exe107⤵PID:1776
-
\??\c:\jdpvp.exec:\jdpvp.exe108⤵PID:768
-
\??\c:\pddpv.exec:\pddpv.exe109⤵PID:904
-
\??\c:\xffrrlr.exec:\xffrrlr.exe110⤵PID:2008
-
\??\c:\hbhnhb.exec:\hbhnhb.exe111⤵PID:672
-
\??\c:\ddvdd.exec:\ddvdd.exe112⤵PID:1812
-
\??\c:\ppvjv.exec:\ppvjv.exe113⤵PID:2272
-
\??\c:\xrlxlrf.exec:\xrlxlrf.exe114⤵PID:1512
-
\??\c:\5thhhh.exec:\5thhhh.exe115⤵PID:2168
-
\??\c:\jdvjp.exec:\jdvjp.exe116⤵PID:1576
-
\??\c:\1ddjp.exec:\1ddjp.exe117⤵PID:1592
-
\??\c:\xrxlrff.exec:\xrxlrff.exe118⤵PID:2596
-
\??\c:\5tnbhh.exec:\5tnbhh.exe119⤵PID:1596
-
\??\c:\bbtbhh.exec:\bbtbhh.exe120⤵PID:2568
-
\??\c:\dvjjd.exec:\dvjjd.exe121⤵PID:2588
-
\??\c:\vvdvd.exec:\vvdvd.exe122⤵PID:2720
-
\??\c:\xlfflrx.exec:\xlfflrx.exe123⤵PID:2240
-
\??\c:\rrflfxx.exec:\rrflfxx.exe124⤵PID:2680
-
\??\c:\bnbbhn.exec:\bnbbhn.exe125⤵PID:2444
-
\??\c:\nhtbtb.exec:\nhtbtb.exe126⤵PID:2792
-
\??\c:\pjvdd.exec:\pjvdd.exe127⤵PID:2504
-
\??\c:\llxrfxf.exec:\llxrfxf.exe128⤵PID:2516
-
\??\c:\3bnthh.exec:\3bnthh.exe129⤵PID:2708
-
\??\c:\jdppv.exec:\jdppv.exe130⤵PID:2816
-
\??\c:\llxrfrx.exec:\llxrfrx.exe131⤵PID:2952
-
\??\c:\lfrrxxr.exec:\lfrrxxr.exe132⤵PID:1964
-
\??\c:\5htthb.exec:\5htthb.exe133⤵PID:1976
-
\??\c:\jjpvj.exec:\jjpvj.exe134⤵PID:1532
-
\??\c:\ppdjp.exec:\ppdjp.exe135⤵PID:2508
-
\??\c:\7xxflrf.exec:\7xxflrf.exe136⤵PID:2428
-
\??\c:\xrlrlxl.exec:\xrlrlxl.exe137⤵PID:864
-
\??\c:\tntnnt.exec:\tntnnt.exe138⤵PID:1804
-
\??\c:\bbbthh.exec:\bbbthh.exe139⤵PID:1728
-
\??\c:\vjpvp.exec:\vjpvp.exe140⤵PID:1288
-
\??\c:\rllxflr.exec:\rllxflr.exe141⤵PID:2300
-
\??\c:\rrllxfl.exec:\rrllxfl.exe142⤵PID:1788
-
\??\c:\nnthbh.exec:\nnthbh.exe143⤵PID:2188
-
\??\c:\btbbnt.exec:\btbbnt.exe144⤵PID:756
-
\??\c:\9pjvp.exec:\9pjvp.exe145⤵PID:2420
-
\??\c:\vpjdv.exec:\vpjdv.exe146⤵PID:1028
-
\??\c:\xlxrfrl.exec:\xlxrfrl.exe147⤵PID:1648
-
\??\c:\rrxflrx.exec:\rrxflrx.exe148⤵PID:1228
-
\??\c:\hnthtb.exec:\hnthtb.exe149⤵PID:696
-
\??\c:\tnbhtb.exec:\tnbhtb.exe150⤵PID:576
-
\??\c:\pjddv.exec:\pjddv.exe151⤵PID:904
-
\??\c:\ffrlrll.exec:\ffrlrll.exe152⤵PID:1828
-
\??\c:\llrlfll.exec:\llrlfll.exe153⤵PID:672
-
\??\c:\tnhnbb.exec:\tnhnbb.exe154⤵PID:1812
-
\??\c:\tbhnnh.exec:\tbhnnh.exe155⤵PID:2272
-
\??\c:\dvjjv.exec:\dvjjv.exe156⤵PID:1708
-
\??\c:\jdpdp.exec:\jdpdp.exe157⤵PID:2168
-
\??\c:\9rrxlrl.exec:\9rrxlrl.exe158⤵PID:1576
-
\??\c:\fffxxfr.exec:\fffxxfr.exe159⤵PID:1592
-
\??\c:\1hnntt.exec:\1hnntt.exe160⤵PID:2544
-
\??\c:\vvpvv.exec:\vvpvv.exe161⤵PID:1596
-
\??\c:\ppppd.exec:\ppppd.exe162⤵PID:2568
-
\??\c:\xflrllr.exec:\xflrllr.exe163⤵PID:2692
-
\??\c:\ddjdj.exec:\ddjdj.exe164⤵PID:2608
-
\??\c:\pdpjv.exec:\pdpjv.exe165⤵PID:2240
-
\??\c:\5llfrfr.exec:\5llfrfr.exe166⤵PID:2496
-
\??\c:\bnhbnh.exec:\bnhbnh.exe167⤵PID:2444
-
\??\c:\hnthnn.exec:\hnthnn.exe168⤵PID:2500
-
\??\c:\ddpvj.exec:\ddpvj.exe169⤵PID:3000
-
\??\c:\xxflxfr.exec:\xxflxfr.exe170⤵PID:2980
-
\??\c:\lrrfffx.exec:\lrrfffx.exe171⤵PID:2776
-
\??\c:\hhbnbn.exec:\hhbnbn.exe172⤵PID:1444
-
\??\c:\bhhttb.exec:\bhhttb.exe173⤵PID:2032
-
\??\c:\pjvdp.exec:\pjvdp.exe174⤵PID:2812
-
\??\c:\vjvpp.exec:\vjvpp.exe175⤵PID:2840
-
\??\c:\rlflxxl.exec:\rlflxxl.exe176⤵PID:2628
-
\??\c:\xlllrrr.exec:\xlllrrr.exe177⤵PID:1248
-
\??\c:\hhtbhn.exec:\hhtbhn.exe178⤵PID:1408
-
\??\c:\tbhttt.exec:\tbhttt.exe179⤵PID:2312
-
\??\c:\vpddd.exec:\vpddd.exe180⤵PID:2396
-
\??\c:\5vdvp.exec:\5vdvp.exe181⤵PID:2104
-
\??\c:\rlfrfxr.exec:\rlfrfxr.exe182⤵PID:2700
-
\??\c:\bhbnnb.exec:\bhbnnb.exe183⤵PID:2284
-
\??\c:\djvpv.exec:\djvpv.exe184⤵PID:604
-
\??\c:\jdjjj.exec:\jdjjj.exe185⤵PID:592
-
\??\c:\lrrrrfr.exec:\lrrrrfr.exe186⤵PID:1860
-
\??\c:\rlxxffl.exec:\rlxxffl.exe187⤵PID:1144
-
\??\c:\9hhbth.exec:\9hhbth.exe188⤵PID:2748
-
\??\c:\jddjj.exec:\jddjj.exe189⤵PID:1324
-
\??\c:\flfxrlr.exec:\flfxrlr.exe190⤵PID:320
-
\??\c:\xlrflfr.exec:\xlrflfr.exe191⤵PID:2904
-
\??\c:\nhbhnb.exec:\nhbhnb.exe192⤵PID:1932
-
\??\c:\tbthtt.exec:\tbthtt.exe193⤵PID:896
-
\??\c:\jpvjp.exec:\jpvjp.exe194⤵PID:1504
-
\??\c:\rrxrxxx.exec:\rrxrxxx.exe195⤵PID:560
-
\??\c:\rfrxlfr.exec:\rfrxlfr.exe196⤵PID:1048
-
\??\c:\5nntnt.exec:\5nntnt.exe197⤵PID:2192
-
\??\c:\pvvpj.exec:\pvvpj.exe198⤵PID:1708
-
\??\c:\pdjdd.exec:\pdjdd.exe199⤵PID:1256
-
\??\c:\xfrlxlr.exec:\xfrlxlr.exe200⤵PID:2656
-
\??\c:\llflrll.exec:\llflrll.exe201⤵PID:2672
-
\??\c:\tbhhhb.exec:\tbhhhb.exe202⤵PID:2580
-
\??\c:\tnhhhb.exec:\tnhhhb.exe203⤵PID:2448
-
\??\c:\jdpjp.exec:\jdpjp.exe204⤵PID:2568
-
\??\c:\djjpv.exec:\djjpv.exe205⤵PID:1060
-
\??\c:\lfrfrxl.exec:\lfrfrxl.exe206⤵PID:852
-
\??\c:\bthnhh.exec:\bthnhh.exe207⤵PID:2560
-
\??\c:\tnhbhh.exec:\tnhbhh.exe208⤵PID:2964
-
\??\c:\jvdvd.exec:\jvdvd.exe209⤵PID:2200
-
\??\c:\jpvpp.exec:\jpvpp.exe210⤵PID:2444
-
\??\c:\xrrxlfx.exec:\xrrxlfx.exe211⤵PID:2500
-
\??\c:\frrrxfx.exec:\frrrxfx.exe212⤵PID:3000
-
\??\c:\bbhtbt.exec:\bbhtbt.exe213⤵PID:296
-
\??\c:\bhthhn.exec:\bhthhn.exe214⤵PID:2776
-
\??\c:\vjddj.exec:\vjddj.exe215⤵PID:2540
-
\??\c:\vvvpj.exec:\vvvpj.exe216⤵PID:2624
-
\??\c:\5xxrrll.exec:\5xxrrll.exe217⤵PID:1632
-
\??\c:\lxrxxxr.exec:\lxrxxxr.exe218⤵PID:2224
-
\??\c:\nhhtbh.exec:\nhhtbh.exe219⤵PID:2828
-
\??\c:\5bbbhh.exec:\5bbbhh.exe220⤵PID:1924
-
\??\c:\ddpjj.exec:\ddpjj.exe221⤵PID:2376
-
\??\c:\dvpdv.exec:\dvpdv.exe222⤵PID:2308
-
\??\c:\xlrlrlr.exec:\xlrlrlr.exe223⤵PID:2040
-
\??\c:\fxxxffl.exec:\fxxxffl.exe224⤵PID:2888
-
\??\c:\ttbtnh.exec:\ttbtnh.exe225⤵PID:2896
-
\??\c:\nbnhht.exec:\nbnhht.exe226⤵PID:684
-
\??\c:\pvdjp.exec:\pvdjp.exe227⤵PID:604
-
\??\c:\vppvd.exec:\vppvd.exe228⤵PID:1484
-
\??\c:\xxxrxll.exec:\xxxrxll.exe229⤵PID:1800
-
\??\c:\htntbt.exec:\htntbt.exe230⤵PID:1644
-
\??\c:\thtttt.exec:\thtttt.exe231⤵PID:2344
-
\??\c:\pvjvd.exec:\pvjvd.exe232⤵PID:2156
-
\??\c:\pjpdj.exec:\pjpdj.exe233⤵PID:320
-
\??\c:\fxxrxrl.exec:\fxxrxrl.exe234⤵PID:2236
-
\??\c:\bbnntt.exec:\bbnntt.exe235⤵PID:1968
-
\??\c:\btnhtt.exec:\btnhtt.exe236⤵PID:2860
-
\??\c:\jjdjp.exec:\jjdjp.exe237⤵PID:1848
-
\??\c:\lfrfffx.exec:\lfrfffx.exe238⤵PID:2180
-
\??\c:\llfxxrf.exec:\llfxxrf.exe239⤵PID:1048
-
\??\c:\9thtbn.exec:\9thtbn.exe240⤵PID:2060
-
\??\c:\nnhnbh.exec:\nnhnbh.exe241⤵PID:1696
-
\??\c:\dvpvj.exec:\dvpvj.exe242⤵PID:2596