Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 06:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
91830d201985557fde2087a57907a600_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
91830d201985557fde2087a57907a600_NeikiAnalytics.exe
-
Size
67KB
-
MD5
91830d201985557fde2087a57907a600
-
SHA1
5bb4fdfaafdcb5085c564b548eab1577128ade3e
-
SHA256
9904addaaf653d3f5cf8db1a2fdf63e74beacc5f3f8182ac06c0e7772e7ae5e5
-
SHA512
b975a47318da6c50fc00675805308fd62c0a92d920813636c9e8fa20cea2db50d624b53307394a81405d2aa1f3160ae27ea2acd90c2418097dcd1cbbdb3b628d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8+LuvPrgpXn6G:ymb3NkkiQ3mdBjF0yMlwrbG
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/2128-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2328-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2400-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2136-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1628-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1404-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1260-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2212-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1756-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1596-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
djjdj.exellxrflf.exe1vjvj.exe9frxffl.exettbhbb.exe9bthtb.exellxrxfr.exexrlxflx.exetthntb.exevpjjv.exexxrxffl.exerrxllxx.exetnnthh.exejvjpv.exe5xlxffr.exenhbbnn.exehbnbnh.exejdvdj.exe5fxrfxf.exe7xrfrrx.exe5tntbn.exetnbbnt.exevvpvj.exe9pdpv.exe7xxlxxf.exe1tnhtt.exepjdvj.exe3llrflf.exebtnntt.exebthntn.exevpdpd.exexrrxflr.exelxflxxl.exebntnth.exenhtbbb.exeddvjp.exe3ddjj.exefxrxlrx.exerlxflrx.exehbthnt.exepdpvp.exerllrrrr.exelxlxflr.exelflflff.exetntbhh.exenhthhn.exevpddd.exelrrlxlx.exellxfrrx.exetntthn.exebtnnnn.exe1nhbhh.exedvjpp.exejdpvp.exefrlrflx.exellxxffr.exehbnbhb.exe9vdvj.exevvjjv.exe9lxrxxl.exelxllrrx.exe3lrxxxl.exe7hbnhn.exetnhhnt.exepid process 2328 djjdj.exe 2724 llxrflf.exe 2520 1vjvj.exe 2564 9frxffl.exe 2728 ttbhbb.exe 3000 9bthtb.exe 2400 llxrxfr.exe 2580 xrlxflx.exe 1572 tthntb.exe 2508 vpjjv.exe 2768 xxrxffl.exe 2136 rrxllxx.exe 1628 tnnthh.exe 1404 jvjpv.exe 2372 5xlxffr.exe 1260 nhbbnn.exe 2952 hbnbnh.exe 3064 jdvdj.exe 2940 5fxrfxf.exe 2212 7xrfrrx.exe 2504 5tntbn.exe 1392 tnbbnt.exe 1756 vvpvj.exe 1596 9pdpv.exe 404 7xxlxxf.exe 2036 1tnhtt.exe 676 pjdvj.exe 1980 3llrflf.exe 1968 btnntt.exe 2096 bthntn.exe 1468 vpdpd.exe 2720 xrrxflr.exe 2308 lxflxxl.exe 1972 bntnth.exe 2188 nhtbbb.exe 2600 ddvjp.exe 2596 3ddjj.exe 2412 fxrxlrx.exe 2708 rlxflrx.exe 2440 hbthnt.exe 2696 pdpvp.exe 1696 rllrrrr.exe 2416 lxlxflr.exe 1884 lflflff.exe 2588 tntbhh.exe 1548 nhthhn.exe 2784 vpddd.exe 1436 lrrlxlx.exe 1808 llxfrrx.exe 2292 tntthn.exe 2060 btnnnn.exe 1248 1nhbhh.exe 2512 dvjpp.exe 1112 jdpvp.exe 2032 frlrflx.exe 2880 llxxffr.exe 3064 hbnbhb.exe 1600 9vdvj.exe 2352 vvjjv.exe 1936 9lxrxxl.exe 580 lxllrrx.exe 1048 3lrxxxl.exe 808 7hbnhn.exe 688 tnhhnt.exe -
Processes:
resource yara_rule behavioral1/memory/2128-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2136-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1404-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1260-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1756-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1596-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-297-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
91830d201985557fde2087a57907a600_NeikiAnalytics.exedjjdj.exellxrflf.exe1vjvj.exe9frxffl.exettbhbb.exe9bthtb.exellxrxfr.exexrlxflx.exetthntb.exevpjjv.exexxrxffl.exerrxllxx.exetnnthh.exejvjpv.exe5xlxffr.exedescription pid process target process PID 2128 wrote to memory of 2328 2128 91830d201985557fde2087a57907a600_NeikiAnalytics.exe djjdj.exe PID 2128 wrote to memory of 2328 2128 91830d201985557fde2087a57907a600_NeikiAnalytics.exe djjdj.exe PID 2128 wrote to memory of 2328 2128 91830d201985557fde2087a57907a600_NeikiAnalytics.exe djjdj.exe PID 2128 wrote to memory of 2328 2128 91830d201985557fde2087a57907a600_NeikiAnalytics.exe djjdj.exe PID 2328 wrote to memory of 2724 2328 djjdj.exe llxrflf.exe PID 2328 wrote to memory of 2724 2328 djjdj.exe llxrflf.exe PID 2328 wrote to memory of 2724 2328 djjdj.exe llxrflf.exe PID 2328 wrote to memory of 2724 2328 djjdj.exe llxrflf.exe PID 2724 wrote to memory of 2520 2724 llxrflf.exe 1vjvj.exe PID 2724 wrote to memory of 2520 2724 llxrflf.exe 1vjvj.exe PID 2724 wrote to memory of 2520 2724 llxrflf.exe 1vjvj.exe PID 2724 wrote to memory of 2520 2724 llxrflf.exe 1vjvj.exe PID 2520 wrote to memory of 2564 2520 1vjvj.exe 9frxffl.exe PID 2520 wrote to memory of 2564 2520 1vjvj.exe 9frxffl.exe PID 2520 wrote to memory of 2564 2520 1vjvj.exe 9frxffl.exe PID 2520 wrote to memory of 2564 2520 1vjvj.exe 9frxffl.exe PID 2564 wrote to memory of 2728 2564 9frxffl.exe ttbhbb.exe PID 2564 wrote to memory of 2728 2564 9frxffl.exe ttbhbb.exe PID 2564 wrote to memory of 2728 2564 9frxffl.exe ttbhbb.exe PID 2564 wrote to memory of 2728 2564 9frxffl.exe ttbhbb.exe PID 2728 wrote to memory of 3000 2728 ttbhbb.exe 9bthtb.exe PID 2728 wrote to memory of 3000 2728 ttbhbb.exe 9bthtb.exe PID 2728 wrote to memory of 3000 2728 ttbhbb.exe 9bthtb.exe PID 2728 wrote to memory of 3000 2728 ttbhbb.exe 9bthtb.exe PID 3000 wrote to memory of 2400 3000 9bthtb.exe llxrxfr.exe PID 3000 wrote to memory of 2400 3000 9bthtb.exe llxrxfr.exe PID 3000 wrote to memory of 2400 3000 9bthtb.exe llxrxfr.exe PID 3000 wrote to memory of 2400 3000 9bthtb.exe llxrxfr.exe PID 2400 wrote to memory of 2580 2400 llxrxfr.exe xrlxflx.exe PID 2400 wrote to memory of 2580 2400 llxrxfr.exe xrlxflx.exe PID 2400 wrote to memory of 2580 2400 llxrxfr.exe xrlxflx.exe PID 2400 wrote to memory of 2580 2400 llxrxfr.exe xrlxflx.exe PID 2580 wrote to memory of 1572 2580 xrlxflx.exe tthntb.exe PID 2580 wrote to memory of 1572 2580 xrlxflx.exe tthntb.exe PID 2580 wrote to memory of 1572 2580 xrlxflx.exe tthntb.exe PID 2580 wrote to memory of 1572 2580 xrlxflx.exe tthntb.exe PID 1572 wrote to memory of 2508 1572 tthntb.exe vpjjv.exe PID 1572 wrote to memory of 2508 1572 tthntb.exe vpjjv.exe PID 1572 wrote to memory of 2508 1572 tthntb.exe vpjjv.exe PID 1572 wrote to memory of 2508 1572 tthntb.exe vpjjv.exe PID 2508 wrote to memory of 2768 2508 vpjjv.exe xxrxffl.exe PID 2508 wrote to memory of 2768 2508 vpjjv.exe xxrxffl.exe PID 2508 wrote to memory of 2768 2508 vpjjv.exe xxrxffl.exe PID 2508 wrote to memory of 2768 2508 vpjjv.exe xxrxffl.exe PID 2768 wrote to memory of 2136 2768 xxrxffl.exe rrxllxx.exe PID 2768 wrote to memory of 2136 2768 xxrxffl.exe rrxllxx.exe PID 2768 wrote to memory of 2136 2768 xxrxffl.exe rrxllxx.exe PID 2768 wrote to memory of 2136 2768 xxrxffl.exe rrxllxx.exe PID 2136 wrote to memory of 1628 2136 rrxllxx.exe tnnthh.exe PID 2136 wrote to memory of 1628 2136 rrxllxx.exe tnnthh.exe PID 2136 wrote to memory of 1628 2136 rrxllxx.exe tnnthh.exe PID 2136 wrote to memory of 1628 2136 rrxllxx.exe tnnthh.exe PID 1628 wrote to memory of 1404 1628 tnnthh.exe jvjpv.exe PID 1628 wrote to memory of 1404 1628 tnnthh.exe jvjpv.exe PID 1628 wrote to memory of 1404 1628 tnnthh.exe jvjpv.exe PID 1628 wrote to memory of 1404 1628 tnnthh.exe jvjpv.exe PID 1404 wrote to memory of 2372 1404 jvjpv.exe 5xlxffr.exe PID 1404 wrote to memory of 2372 1404 jvjpv.exe 5xlxffr.exe PID 1404 wrote to memory of 2372 1404 jvjpv.exe 5xlxffr.exe PID 1404 wrote to memory of 2372 1404 jvjpv.exe 5xlxffr.exe PID 2372 wrote to memory of 1260 2372 5xlxffr.exe nhbbnn.exe PID 2372 wrote to memory of 1260 2372 5xlxffr.exe nhbbnn.exe PID 2372 wrote to memory of 1260 2372 5xlxffr.exe nhbbnn.exe PID 2372 wrote to memory of 1260 2372 5xlxffr.exe nhbbnn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\91830d201985557fde2087a57907a600_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\91830d201985557fde2087a57907a600_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\djjdj.exec:\djjdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\llxrflf.exec:\llxrflf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\1vjvj.exec:\1vjvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\9frxffl.exec:\9frxffl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\ttbhbb.exec:\ttbhbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\9bthtb.exec:\9bthtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\llxrxfr.exec:\llxrxfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\xrlxflx.exec:\xrlxflx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\tthntb.exec:\tthntb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\vpjjv.exec:\vpjjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\xxrxffl.exec:\xxrxffl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\rrxllxx.exec:\rrxllxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\tnnthh.exec:\tnnthh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\jvjpv.exec:\jvjpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\5xlxffr.exec:\5xlxffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\nhbbnn.exec:\nhbbnn.exe17⤵
- Executes dropped EXE
PID:1260 -
\??\c:\hbnbnh.exec:\hbnbnh.exe18⤵
- Executes dropped EXE
PID:2952 -
\??\c:\jdvdj.exec:\jdvdj.exe19⤵
- Executes dropped EXE
PID:3064 -
\??\c:\5fxrfxf.exec:\5fxrfxf.exe20⤵
- Executes dropped EXE
PID:2940 -
\??\c:\7xrfrrx.exec:\7xrfrrx.exe21⤵
- Executes dropped EXE
PID:2212 -
\??\c:\5tntbn.exec:\5tntbn.exe22⤵
- Executes dropped EXE
PID:2504 -
\??\c:\tnbbnt.exec:\tnbbnt.exe23⤵
- Executes dropped EXE
PID:1392 -
\??\c:\vvpvj.exec:\vvpvj.exe24⤵
- Executes dropped EXE
PID:1756 -
\??\c:\9pdpv.exec:\9pdpv.exe25⤵
- Executes dropped EXE
PID:1596 -
\??\c:\7xxlxxf.exec:\7xxlxxf.exe26⤵
- Executes dropped EXE
PID:404 -
\??\c:\1tnhtt.exec:\1tnhtt.exe27⤵
- Executes dropped EXE
PID:2036 -
\??\c:\pjdvj.exec:\pjdvj.exe28⤵
- Executes dropped EXE
PID:676 -
\??\c:\3llrflf.exec:\3llrflf.exe29⤵
- Executes dropped EXE
PID:1980 -
\??\c:\btnntt.exec:\btnntt.exe30⤵
- Executes dropped EXE
PID:1968 -
\??\c:\bthntn.exec:\bthntn.exe31⤵
- Executes dropped EXE
PID:2096 -
\??\c:\vpdpd.exec:\vpdpd.exe32⤵
- Executes dropped EXE
PID:1468 -
\??\c:\xrrxflr.exec:\xrrxflr.exe33⤵
- Executes dropped EXE
PID:2720 -
\??\c:\lxflxxl.exec:\lxflxxl.exe34⤵
- Executes dropped EXE
PID:2308 -
\??\c:\bntnth.exec:\bntnth.exe35⤵
- Executes dropped EXE
PID:1972 -
\??\c:\nhtbbb.exec:\nhtbbb.exe36⤵
- Executes dropped EXE
PID:2188 -
\??\c:\ddvjp.exec:\ddvjp.exe37⤵
- Executes dropped EXE
PID:2600 -
\??\c:\3ddjj.exec:\3ddjj.exe38⤵
- Executes dropped EXE
PID:2596 -
\??\c:\fxrxlrx.exec:\fxrxlrx.exe39⤵
- Executes dropped EXE
PID:2412 -
\??\c:\rlxflrx.exec:\rlxflrx.exe40⤵
- Executes dropped EXE
PID:2708 -
\??\c:\hbthnt.exec:\hbthnt.exe41⤵
- Executes dropped EXE
PID:2440 -
\??\c:\pdpvp.exec:\pdpvp.exe42⤵
- Executes dropped EXE
PID:2696 -
\??\c:\rllrrrr.exec:\rllrrrr.exe43⤵
- Executes dropped EXE
PID:1696 -
\??\c:\lxlxflr.exec:\lxlxflr.exe44⤵
- Executes dropped EXE
PID:2416 -
\??\c:\lflflff.exec:\lflflff.exe45⤵
- Executes dropped EXE
PID:1884 -
\??\c:\tntbhh.exec:\tntbhh.exe46⤵
- Executes dropped EXE
PID:2588 -
\??\c:\nhthhn.exec:\nhthhn.exe47⤵
- Executes dropped EXE
PID:1548 -
\??\c:\vpddd.exec:\vpddd.exe48⤵
- Executes dropped EXE
PID:2784 -
\??\c:\lrrlxlx.exec:\lrrlxlx.exe49⤵
- Executes dropped EXE
PID:1436 -
\??\c:\llxfrrx.exec:\llxfrrx.exe50⤵
- Executes dropped EXE
PID:1808 -
\??\c:\tntthn.exec:\tntthn.exe51⤵
- Executes dropped EXE
PID:2292 -
\??\c:\btnnnn.exec:\btnnnn.exe52⤵
- Executes dropped EXE
PID:2060 -
\??\c:\1nhbhh.exec:\1nhbhh.exe53⤵
- Executes dropped EXE
PID:1248 -
\??\c:\dvjpp.exec:\dvjpp.exe54⤵
- Executes dropped EXE
PID:2512 -
\??\c:\jdpvp.exec:\jdpvp.exe55⤵
- Executes dropped EXE
PID:1112 -
\??\c:\frlrflx.exec:\frlrflx.exe56⤵
- Executes dropped EXE
PID:2032 -
\??\c:\llxxffr.exec:\llxxffr.exe57⤵
- Executes dropped EXE
PID:2880 -
\??\c:\hbnbhb.exec:\hbnbhb.exe58⤵
- Executes dropped EXE
PID:3064 -
\??\c:\9vdvj.exec:\9vdvj.exe59⤵
- Executes dropped EXE
PID:1600 -
\??\c:\vvjjv.exec:\vvjjv.exe60⤵
- Executes dropped EXE
PID:2352 -
\??\c:\9lxrxxl.exec:\9lxrxxl.exe61⤵
- Executes dropped EXE
PID:1936 -
\??\c:\lxllrrx.exec:\lxllrrx.exe62⤵
- Executes dropped EXE
PID:580 -
\??\c:\3lrxxxl.exec:\3lrxxxl.exe63⤵
- Executes dropped EXE
PID:1048 -
\??\c:\7hbnhn.exec:\7hbnhn.exe64⤵
- Executes dropped EXE
PID:808 -
\??\c:\tnhhnt.exec:\tnhhnt.exe65⤵
- Executes dropped EXE
PID:688 -
\??\c:\jdvjp.exec:\jdvjp.exe66⤵PID:404
-
\??\c:\pjdjj.exec:\pjdjj.exe67⤵PID:900
-
\??\c:\lfrxffr.exec:\lfrxffr.exe68⤵PID:1444
-
\??\c:\rlxlrrx.exec:\rlxlrrx.exe69⤵PID:676
-
\??\c:\3rffrrf.exec:\3rffrrf.exe70⤵PID:2284
-
\??\c:\hhthth.exec:\hhthth.exe71⤵PID:532
-
\??\c:\9jdvd.exec:\9jdvd.exe72⤵PID:1692
-
\??\c:\vppvd.exec:\vppvd.exe73⤵PID:1872
-
\??\c:\xxrxflx.exec:\xxrxflx.exe74⤵PID:1956
-
\??\c:\llffxlx.exec:\llffxlx.exe75⤵PID:1512
-
\??\c:\nhntbh.exec:\nhntbh.exe76⤵PID:2116
-
\??\c:\hbhhhn.exec:\hbhhhn.exe77⤵PID:2500
-
\??\c:\pjddp.exec:\pjddp.exe78⤵PID:2724
-
\??\c:\jdpvd.exec:\jdpvd.exe79⤵PID:2836
-
\??\c:\7llrrff.exec:\7llrrff.exe80⤵PID:2700
-
\??\c:\rlxfrfl.exec:\rlxfrfl.exe81⤵PID:2528
-
\??\c:\1nhttb.exec:\1nhttb.exe82⤵PID:2736
-
\??\c:\hnhthn.exec:\hnhthn.exe83⤵PID:2460
-
\??\c:\ddjjp.exec:\ddjjp.exe84⤵PID:2436
-
\??\c:\ppjjv.exec:\ppjjv.exe85⤵PID:2924
-
\??\c:\fxxxlrr.exec:\fxxxlrr.exe86⤵PID:2180
-
\??\c:\tnhnbn.exec:\tnhnbn.exe87⤵PID:2620
-
\??\c:\1hthnn.exec:\1hthnn.exe88⤵PID:2632
-
\??\c:\vdjpj.exec:\vdjpj.exe89⤵PID:2788
-
\??\c:\5lffflf.exec:\5lffflf.exe90⤵PID:2896
-
\??\c:\xxrflll.exec:\xxrflll.exe91⤵PID:1772
-
\??\c:\bthbtb.exec:\bthbtb.exe92⤵PID:1812
-
\??\c:\hbnbhn.exec:\hbnbhn.exe93⤵PID:868
-
\??\c:\dpjvd.exec:\dpjvd.exe94⤵PID:1500
-
\??\c:\vvjvv.exec:\vvjvv.exe95⤵PID:2464
-
\??\c:\lfxxffx.exec:\lfxxffx.exe96⤵PID:296
-
\??\c:\llxlxlx.exec:\llxlxlx.exe97⤵PID:2044
-
\??\c:\bbbtnh.exec:\bbbtnh.exe98⤵PID:2264
-
\??\c:\7htthh.exec:\7htthh.exe99⤵PID:2444
-
\??\c:\ppdjv.exec:\ppdjv.exe100⤵PID:2020
-
\??\c:\jdvvv.exec:\jdvvv.exe101⤵PID:1976
-
\??\c:\xlxxxxf.exec:\xlxxxxf.exe102⤵PID:2196
-
\??\c:\rfrrllr.exec:\rfrrllr.exe103⤵PID:264
-
\??\c:\tnhtbn.exec:\tnhtbn.exe104⤵PID:2944
-
\??\c:\tntttb.exec:\tntttb.exe105⤵PID:1760
-
\??\c:\dvjjv.exec:\dvjjv.exe106⤵PID:1700
-
\??\c:\jjvdj.exec:\jjvdj.exe107⤵PID:444
-
\??\c:\rrrxlrx.exec:\rrrxlrx.exe108⤵PID:1664
-
\??\c:\lfrxlrx.exec:\lfrxlrx.exe109⤵PID:2036
-
\??\c:\btnthh.exec:\btnthh.exe110⤵PID:1712
-
\??\c:\tnnbtn.exec:\tnnbtn.exe111⤵PID:352
-
\??\c:\tbbhbh.exec:\tbbhbh.exe112⤵PID:2980
-
\??\c:\ppjpv.exec:\ppjpv.exe113⤵PID:888
-
\??\c:\vdjdd.exec:\vdjdd.exe114⤵PID:2096
-
\??\c:\llxrfrx.exec:\llxrfrx.exe115⤵PID:2488
-
\??\c:\xrllxfr.exec:\xrllxfr.exe116⤵PID:1516
-
\??\c:\thnhtt.exec:\thnhtt.exe117⤵PID:2976
-
\??\c:\hbnnbb.exec:\hbnnbb.exe118⤵PID:2184
-
\??\c:\dddjp.exec:\dddjp.exe119⤵PID:3028
-
\??\c:\jddpd.exec:\jddpd.exe120⤵PID:2724
-
\??\c:\lrrxxrx.exec:\lrrxxrx.exe121⤵PID:2544
-
\??\c:\nnnhbh.exec:\nnnhbh.exe122⤵PID:2572
-
\??\c:\hhnnhb.exec:\hhnnhb.exe123⤵PID:2728
-
\??\c:\nnhtbn.exec:\nnhtbn.exe124⤵PID:284
-
\??\c:\dvdjd.exec:\dvdjd.exe125⤵PID:3000
-
\??\c:\vjddj.exec:\vjddj.exe126⤵PID:3004
-
\??\c:\fxrrrxf.exec:\fxrrrxf.exe127⤵PID:2932
-
\??\c:\rlxxlrf.exec:\rlxxlrf.exe128⤵PID:2664
-
\??\c:\nnhnbn.exec:\nnhnbn.exe129⤵PID:2740
-
\??\c:\1hnbbn.exec:\1hnbbn.exe130⤵PID:2780
-
\??\c:\jjdjp.exec:\jjdjp.exe131⤵PID:2068
-
\??\c:\5pppd.exec:\5pppd.exe132⤵PID:1636
-
\??\c:\xxlrffl.exec:\xxlrffl.exe133⤵PID:1488
-
\??\c:\xxxlrfr.exec:\xxxlrfr.exe134⤵PID:1012
-
\??\c:\bbntnb.exec:\bbntnb.exe135⤵PID:2380
-
\??\c:\bbntbt.exec:\bbntbt.exe136⤵PID:2496
-
\??\c:\dvpdv.exec:\dvpdv.exe137⤵PID:2960
-
\??\c:\ppdpv.exec:\ppdpv.exe138⤵PID:2028
-
\??\c:\xrfflrf.exec:\xrfflrf.exe139⤵PID:2908
-
\??\c:\xxrrrrx.exec:\xxrrrrx.exe140⤵PID:2152
-
\??\c:\bbbnbn.exec:\bbbnbn.exe141⤵PID:2000
-
\??\c:\vpdjp.exec:\vpdjp.exe142⤵PID:2156
-
\??\c:\jdjjd.exec:\jdjjd.exe143⤵PID:764
-
\??\c:\llxlxfr.exec:\llxlxfr.exe144⤵PID:1916
-
\??\c:\xrllffr.exec:\xrllffr.exe145⤵PID:2936
-
\??\c:\3tnntt.exec:\3tnntt.exe146⤵PID:1464
-
\??\c:\nbnnbh.exec:\nbnnbh.exe147⤵PID:3020
-
\??\c:\pdjjj.exec:\pdjjj.exe148⤵PID:988
-
\??\c:\flxlrrf.exec:\flxlrrf.exe149⤵PID:336
-
\??\c:\1lflxfr.exec:\1lflxfr.exe150⤵PID:780
-
\??\c:\7hhbbt.exec:\7hhbbt.exe151⤵PID:2080
-
\??\c:\vpdjv.exec:\vpdjv.exe152⤵PID:824
-
\??\c:\pjdjp.exec:\pjdjp.exe153⤵PID:1612
-
\??\c:\3rlrxrx.exec:\3rlrxrx.exe154⤵PID:2228
-
\??\c:\hthbbt.exec:\hthbbt.exe155⤵PID:1412
-
\??\c:\hbbbnt.exec:\hbbbnt.exe156⤵PID:1640
-
\??\c:\3djvj.exec:\3djvj.exe157⤵PID:1508
-
\??\c:\pjvjp.exec:\pjvjp.exe158⤵PID:2328
-
\??\c:\llxxxxf.exec:\llxxxxf.exe159⤵PID:2616
-
\??\c:\rlxflxl.exec:\rlxflxl.exe160⤵PID:2592
-
\??\c:\bbhnbh.exec:\bbhnbh.exe161⤵PID:2516
-
\??\c:\nhtttb.exec:\nhtttb.exe162⤵PID:2712
-
\??\c:\pjpvd.exec:\pjpvd.exe163⤵PID:2700
-
\??\c:\7pvvv.exec:\7pvvv.exe164⤵PID:2576
-
\??\c:\lfxfrxf.exec:\lfxfrxf.exe165⤵PID:2744
-
\??\c:\fllxxrl.exec:\fllxxrl.exe166⤵PID:2408
-
\??\c:\hnhhnt.exec:\hnhhnt.exe167⤵PID:2532
-
\??\c:\hbnthh.exec:\hbnthh.exe168⤵PID:2928
-
\??\c:\jppvv.exec:\jppvv.exe169⤵PID:2580
-
\??\c:\3vjvj.exec:\3vjvj.exe170⤵PID:1884
-
\??\c:\7ffxflf.exec:\7ffxflf.exe171⤵PID:2772
-
\??\c:\hnbnbb.exec:\hnbnbb.exe172⤵PID:2508
-
\??\c:\ttnnbh.exec:\ttnnbh.exe173⤵PID:1536
-
\??\c:\jddpd.exec:\jddpd.exe174⤵PID:1748
-
\??\c:\vjdjv.exec:\vjdjv.exe175⤵PID:1628
-
\??\c:\flrlfrf.exec:\flrlfrf.exe176⤵PID:1228
-
\??\c:\5nbhtb.exec:\5nbhtb.exe177⤵PID:2912
-
\??\c:\nhbhnt.exec:\nhbhnt.exe178⤵PID:1176
-
\??\c:\dddjd.exec:\dddjd.exe179⤵PID:1244
-
\??\c:\pjpvj.exec:\pjpvj.exe180⤵PID:1240
-
\??\c:\xxrlxrr.exec:\xxrlxrr.exe181⤵PID:2968
-
\??\c:\xrfflrf.exec:\xrfflrf.exe182⤵PID:1924
-
\??\c:\hhbnhh.exec:\hhbnhh.exe183⤵PID:1992
-
\??\c:\1bbbbb.exec:\1bbbbb.exe184⤵PID:528
-
\??\c:\vpdvp.exec:\vpdvp.exe185⤵PID:1400
-
\??\c:\dvppv.exec:\dvppv.exe186⤵PID:1388
-
\??\c:\xrllflx.exec:\xrllflx.exe187⤵PID:1756
-
\??\c:\3rrfxrl.exec:\3rrfxrl.exe188⤵PID:2236
-
\??\c:\7htbbb.exec:\7htbbb.exe189⤵PID:2844
-
\??\c:\ntnbnb.exec:\ntnbnb.exe190⤵PID:340
-
\??\c:\jdpvp.exec:\jdpvp.exe191⤵PID:2260
-
\??\c:\flfrflx.exec:\flfrflx.exe192⤵PID:2996
-
\??\c:\7fxrxfl.exec:\7fxrxfl.exe193⤵PID:3040
-
\??\c:\9hthtt.exec:\9hthtt.exe194⤵PID:596
-
\??\c:\jjppd.exec:\jjppd.exe195⤵PID:1968
-
\??\c:\pvdvp.exec:\pvdvp.exe196⤵PID:2980
-
\??\c:\hbbhhh.exec:\hbbhhh.exe197⤵PID:2176
-
\??\c:\nhnnnn.exec:\nhnnnn.exe198⤵PID:2096
-
\??\c:\5dppv.exec:\5dppv.exe199⤵PID:2064
-
\??\c:\jdppp.exec:\jdppp.exe200⤵PID:1480
-
\??\c:\3fxxlrf.exec:\3fxxlrf.exe201⤵PID:1972
-
\??\c:\frrrffr.exec:\frrrffr.exe202⤵PID:2592
-
\??\c:\lfxfrlf.exec:\lfxfrlf.exe203⤵PID:2600
-
\??\c:\1bbbtt.exec:\1bbbtt.exe204⤵PID:2568
-
\??\c:\5tthnt.exec:\5tthnt.exe205⤵PID:2704
-
\??\c:\jvppd.exec:\jvppd.exe206⤵PID:2528
-
\??\c:\7jddj.exec:\7jddj.exe207⤵PID:2172
-
\??\c:\fxlrrrx.exec:\fxlrrrx.exe208⤵PID:2480
-
\??\c:\7xxxffl.exec:\7xxxffl.exe209⤵PID:1696
-
\??\c:\nhtbbh.exec:\nhtbbh.exe210⤵PID:2400
-
\??\c:\5nnthh.exec:\5nnthh.exe211⤵PID:2628
-
\??\c:\vvjvj.exec:\vvjvj.exe212⤵PID:2756
-
\??\c:\3dpvp.exec:\3dpvp.exe213⤵PID:2792
-
\??\c:\xrrfrff.exec:\xrrfrff.exe214⤵PID:2768
-
\??\c:\frffrlr.exec:\frffrlr.exe215⤵PID:892
-
\??\c:\bbhnbh.exec:\bbhnbh.exe216⤵PID:1188
-
\??\c:\bbbhbh.exec:\bbbhbh.exe217⤵PID:1424
-
\??\c:\5dddd.exec:\5dddd.exe218⤵PID:868
-
\??\c:\ppjvd.exec:\ppjvd.exe219⤵PID:1248
-
\??\c:\rxrrffl.exec:\rxrrffl.exe220⤵PID:2512
-
\??\c:\flxxfxx.exec:\flxxfxx.exe221⤵PID:2040
-
\??\c:\bbthbh.exec:\bbthbh.exe222⤵PID:1196
-
\??\c:\nnbbnn.exec:\nnbbnn.exe223⤵PID:1932
-
\??\c:\ppdvj.exec:\ppdvj.exe224⤵PID:3064
-
\??\c:\7dvjd.exec:\7dvjd.exe225⤵PID:1960
-
\??\c:\lfffflr.exec:\lfffflr.exe226⤵PID:472
-
\??\c:\lxlfrxf.exec:\lxlfrxf.exe227⤵PID:2504
-
\??\c:\nnhnbh.exec:\nnhnbh.exe228⤵PID:1136
-
\??\c:\nhbhtb.exec:\nhbhtb.exe229⤵PID:2936
-
\??\c:\dvddp.exec:\dvddp.exe230⤵PID:1596
-
\??\c:\3jvdp.exec:\3jvdp.exe231⤵PID:324
-
\??\c:\7rllrrf.exec:\7rllrrf.exe232⤵PID:444
-
\??\c:\rxrxlrf.exec:\rxrxlrf.exe233⤵PID:404
-
\??\c:\nhbbnt.exec:\nhbbnt.exe234⤵PID:2036
-
\??\c:\nnbnbn.exec:\nnbnbn.exe235⤵PID:2860
-
\??\c:\thbhnn.exec:\thbhnn.exe236⤵PID:2088
-
\??\c:\jdpvj.exec:\jdpvj.exe237⤵PID:1232
-
\??\c:\pvdpj.exec:\pvdpj.exe238⤵PID:2868
-
\??\c:\rlfrllf.exec:\rlfrllf.exe239⤵PID:2128
-
\??\c:\1llffxf.exec:\1llffxf.exe240⤵PID:884
-
\??\c:\btntnn.exec:\btntnn.exe241⤵PID:1640
-
\??\c:\hbtbbb.exec:\hbtbbb.exe242⤵PID:2720