Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 14:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d337b7e036a7071d1b2c8aff039f54d0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
d337b7e036a7071d1b2c8aff039f54d0_NeikiAnalytics.exe
-
Size
372KB
-
MD5
d337b7e036a7071d1b2c8aff039f54d0
-
SHA1
27cf33225a48b7d0987568c5625fe41c35082057
-
SHA256
f4aed443666b24ed01fe22fc1b7dc8590082fc6e2e7f7335c58aeeeec35f9c31
-
SHA512
a8858ef73d7d6a16365b47649bc36c1941b9807ceb79ba21cf83f3001aab0d06e38a7d196c4c44124ccb665bb3ab0476263de2f925c1c32c580b849204df2008
-
SSDEEP
6144:n3C9BRIG0asYFm71mJl3/X8mak5gNv9rC8IwLaYNUvtTxTKMMP:n3C9uYA7i3/stR9HGYyvtTxTKMQ
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/2104-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2488-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1836-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1196-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/272-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/344-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1364-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1976-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bnhhtt.exejdppp.exedvpvj.exefxflrll.exe9hbhnh.exepjvpp.exe7rfrfrx.exe1hbbbb.exeflxxfxf.exerrfxxfl.exepdjdj.exerflxxrx.exetnbbhb.exe1pddd.exe7flrxfl.exe9thhtt.exe3jvpp.exeffrrxrx.exevpvdj.exe1rllrlx.exe5hbntb.exe7lxrxfr.exehhnttb.exe5dvvd.exeflxrrrx.exevpvdj.exexxlfrfx.exe1tbbbb.exejvvjp.exexffrlrf.exetnhntb.exe7rflllx.exenhtbhh.exe3jpvv.exepjvpv.exe7xrxxxf.exetnbbhh.exe3pjjp.exevppjj.exe7xllrrx.exehbnbhh.exehbnnhh.exe1pdjj.exelflllfl.exexrflxfl.exettbbhh.exe3jjpd.exellxfllr.exe9lflxfl.exe1nttnn.exetntnnt.exejddvp.exelfrlllr.exetththn.exenhbhtt.exevpdjv.exedpvjp.exe7fllrfl.exetnhtbb.exeddpdj.exe7djdd.exe9xrxxxf.exe1nbtbb.exenhhhnt.exepid process 2488 bnhhtt.exe 2612 jdppp.exe 2716 dvpvj.exe 2648 fxflrll.exe 2776 9hbhnh.exe 2808 pjvpp.exe 2580 7rfrfrx.exe 2572 1hbbbb.exe 2156 flxxfxf.exe 1836 rrfxxfl.exe 1952 pdjdj.exe 2816 rflxxrx.exe 2440 tnbbhb.exe 2044 1pddd.exe 2192 7flrxfl.exe 1196 9thhtt.exe 2492 3jvpp.exe 268 ffrrxrx.exe 272 vpvdj.exe 2696 1rllrlx.exe 2712 5hbntb.exe 1688 7lxrxfr.exe 1812 hhnttb.exe 2296 5dvvd.exe 2372 flxrrrx.exe 344 vpvdj.exe 1364 xxlfrfx.exe 1976 1tbbbb.exe 2280 jvvjp.exe 1728 xffrlrf.exe 2928 tnhntb.exe 2068 7rflllx.exe 2112 nhtbhh.exe 2024 3jpvv.exe 2704 pjvpv.exe 2980 7xrxxxf.exe 1732 tnbbhh.exe 2732 3pjjp.exe 2672 vppjj.exe 2524 7xllrrx.exe 2636 hbnbhh.exe 2540 hbnnhh.exe 2420 1pdjj.exe 2528 lflllfl.exe 1616 xrflxfl.exe 2924 ttbbhh.exe 1940 3jjpd.exe 696 llxfllr.exe 2588 9lflxfl.exe 1300 1nttnn.exe 2816 tntnnt.exe 1996 jddvp.exe 1824 lfrlllr.exe 2416 tththn.exe 808 nhbhtt.exe 1196 vpdjv.exe 1720 dpvjp.exe 2196 7fllrfl.exe 2480 tnhtbb.exe 2324 ddpdj.exe 2696 7djdd.exe 2844 9xrxxxf.exe 2996 1nbtbb.exe 1544 nhhhnt.exe -
Processes:
resource yara_rule behavioral1/memory/2104-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2104-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1836-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1196-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/272-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/344-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1364-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-296-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d337b7e036a7071d1b2c8aff039f54d0_NeikiAnalytics.exebnhhtt.exejdppp.exedvpvj.exefxflrll.exe9hbhnh.exepjvpp.exe7rfrfrx.exe1hbbbb.exeflxxfxf.exerrfxxfl.exepdjdj.exerflxxrx.exetnbbhb.exe1pddd.exe7flrxfl.exedescription pid process target process PID 2104 wrote to memory of 2488 2104 d337b7e036a7071d1b2c8aff039f54d0_NeikiAnalytics.exe bnhhtt.exe PID 2104 wrote to memory of 2488 2104 d337b7e036a7071d1b2c8aff039f54d0_NeikiAnalytics.exe bnhhtt.exe PID 2104 wrote to memory of 2488 2104 d337b7e036a7071d1b2c8aff039f54d0_NeikiAnalytics.exe bnhhtt.exe PID 2104 wrote to memory of 2488 2104 d337b7e036a7071d1b2c8aff039f54d0_NeikiAnalytics.exe bnhhtt.exe PID 2488 wrote to memory of 2612 2488 bnhhtt.exe jdppp.exe PID 2488 wrote to memory of 2612 2488 bnhhtt.exe jdppp.exe PID 2488 wrote to memory of 2612 2488 bnhhtt.exe jdppp.exe PID 2488 wrote to memory of 2612 2488 bnhhtt.exe jdppp.exe PID 2612 wrote to memory of 2716 2612 jdppp.exe dvpvj.exe PID 2612 wrote to memory of 2716 2612 jdppp.exe dvpvj.exe PID 2612 wrote to memory of 2716 2612 jdppp.exe dvpvj.exe PID 2612 wrote to memory of 2716 2612 jdppp.exe dvpvj.exe PID 2716 wrote to memory of 2648 2716 dvpvj.exe fxflrll.exe PID 2716 wrote to memory of 2648 2716 dvpvj.exe fxflrll.exe PID 2716 wrote to memory of 2648 2716 dvpvj.exe fxflrll.exe PID 2716 wrote to memory of 2648 2716 dvpvj.exe fxflrll.exe PID 2648 wrote to memory of 2776 2648 fxflrll.exe 9hbhnh.exe PID 2648 wrote to memory of 2776 2648 fxflrll.exe 9hbhnh.exe PID 2648 wrote to memory of 2776 2648 fxflrll.exe 9hbhnh.exe PID 2648 wrote to memory of 2776 2648 fxflrll.exe 9hbhnh.exe PID 2776 wrote to memory of 2808 2776 9hbhnh.exe pjvpp.exe PID 2776 wrote to memory of 2808 2776 9hbhnh.exe pjvpp.exe PID 2776 wrote to memory of 2808 2776 9hbhnh.exe pjvpp.exe PID 2776 wrote to memory of 2808 2776 9hbhnh.exe pjvpp.exe PID 2808 wrote to memory of 2580 2808 pjvpp.exe 7rfrfrx.exe PID 2808 wrote to memory of 2580 2808 pjvpp.exe 7rfrfrx.exe PID 2808 wrote to memory of 2580 2808 pjvpp.exe 7rfrfrx.exe PID 2808 wrote to memory of 2580 2808 pjvpp.exe 7rfrfrx.exe PID 2580 wrote to memory of 2572 2580 7rfrfrx.exe 1hbbbb.exe PID 2580 wrote to memory of 2572 2580 7rfrfrx.exe 1hbbbb.exe PID 2580 wrote to memory of 2572 2580 7rfrfrx.exe 1hbbbb.exe PID 2580 wrote to memory of 2572 2580 7rfrfrx.exe 1hbbbb.exe PID 2572 wrote to memory of 2156 2572 1hbbbb.exe flxxfxf.exe PID 2572 wrote to memory of 2156 2572 1hbbbb.exe flxxfxf.exe PID 2572 wrote to memory of 2156 2572 1hbbbb.exe flxxfxf.exe PID 2572 wrote to memory of 2156 2572 1hbbbb.exe flxxfxf.exe PID 2156 wrote to memory of 1836 2156 flxxfxf.exe rrfxxfl.exe PID 2156 wrote to memory of 1836 2156 flxxfxf.exe rrfxxfl.exe PID 2156 wrote to memory of 1836 2156 flxxfxf.exe rrfxxfl.exe PID 2156 wrote to memory of 1836 2156 flxxfxf.exe rrfxxfl.exe PID 1836 wrote to memory of 1952 1836 rrfxxfl.exe pdjdj.exe PID 1836 wrote to memory of 1952 1836 rrfxxfl.exe pdjdj.exe PID 1836 wrote to memory of 1952 1836 rrfxxfl.exe pdjdj.exe PID 1836 wrote to memory of 1952 1836 rrfxxfl.exe pdjdj.exe PID 1952 wrote to memory of 2816 1952 pdjdj.exe rflxxrx.exe PID 1952 wrote to memory of 2816 1952 pdjdj.exe rflxxrx.exe PID 1952 wrote to memory of 2816 1952 pdjdj.exe rflxxrx.exe PID 1952 wrote to memory of 2816 1952 pdjdj.exe rflxxrx.exe PID 2816 wrote to memory of 2440 2816 rflxxrx.exe tnbbhb.exe PID 2816 wrote to memory of 2440 2816 rflxxrx.exe tnbbhb.exe PID 2816 wrote to memory of 2440 2816 rflxxrx.exe tnbbhb.exe PID 2816 wrote to memory of 2440 2816 rflxxrx.exe tnbbhb.exe PID 2440 wrote to memory of 2044 2440 tnbbhb.exe 1pddd.exe PID 2440 wrote to memory of 2044 2440 tnbbhb.exe 1pddd.exe PID 2440 wrote to memory of 2044 2440 tnbbhb.exe 1pddd.exe PID 2440 wrote to memory of 2044 2440 tnbbhb.exe 1pddd.exe PID 2044 wrote to memory of 2192 2044 1pddd.exe 7flrxfl.exe PID 2044 wrote to memory of 2192 2044 1pddd.exe 7flrxfl.exe PID 2044 wrote to memory of 2192 2044 1pddd.exe 7flrxfl.exe PID 2044 wrote to memory of 2192 2044 1pddd.exe 7flrxfl.exe PID 2192 wrote to memory of 1196 2192 7flrxfl.exe 9thhtt.exe PID 2192 wrote to memory of 1196 2192 7flrxfl.exe 9thhtt.exe PID 2192 wrote to memory of 1196 2192 7flrxfl.exe 9thhtt.exe PID 2192 wrote to memory of 1196 2192 7flrxfl.exe 9thhtt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d337b7e036a7071d1b2c8aff039f54d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d337b7e036a7071d1b2c8aff039f54d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\bnhhtt.exec:\bnhhtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\jdppp.exec:\jdppp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\dvpvj.exec:\dvpvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\fxflrll.exec:\fxflrll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\9hbhnh.exec:\9hbhnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\pjvpp.exec:\pjvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\7rfrfrx.exec:\7rfrfrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\1hbbbb.exec:\1hbbbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\flxxfxf.exec:\flxxfxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\rrfxxfl.exec:\rrfxxfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\pdjdj.exec:\pdjdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\rflxxrx.exec:\rflxxrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\tnbbhb.exec:\tnbbhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\1pddd.exec:\1pddd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\7flrxfl.exec:\7flrxfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\9thhtt.exec:\9thhtt.exe17⤵
- Executes dropped EXE
PID:1196 -
\??\c:\3jvpp.exec:\3jvpp.exe18⤵
- Executes dropped EXE
PID:2492 -
\??\c:\ffrrxrx.exec:\ffrrxrx.exe19⤵
- Executes dropped EXE
PID:268 -
\??\c:\vpvdj.exec:\vpvdj.exe20⤵
- Executes dropped EXE
PID:272 -
\??\c:\1rllrlx.exec:\1rllrlx.exe21⤵
- Executes dropped EXE
PID:2696 -
\??\c:\5hbntb.exec:\5hbntb.exe22⤵
- Executes dropped EXE
PID:2712 -
\??\c:\7lxrxfr.exec:\7lxrxfr.exe23⤵
- Executes dropped EXE
PID:1688 -
\??\c:\hhnttb.exec:\hhnttb.exe24⤵
- Executes dropped EXE
PID:1812 -
\??\c:\5dvvd.exec:\5dvvd.exe25⤵
- Executes dropped EXE
PID:2296 -
\??\c:\flxrrrx.exec:\flxrrrx.exe26⤵
- Executes dropped EXE
PID:2372 -
\??\c:\vpvdj.exec:\vpvdj.exe27⤵
- Executes dropped EXE
PID:344 -
\??\c:\xxlfrfx.exec:\xxlfrfx.exe28⤵
- Executes dropped EXE
PID:1364 -
\??\c:\1tbbbb.exec:\1tbbbb.exe29⤵
- Executes dropped EXE
PID:1976 -
\??\c:\jvvjp.exec:\jvvjp.exe30⤵
- Executes dropped EXE
PID:2280 -
\??\c:\xffrlrf.exec:\xffrlrf.exe31⤵
- Executes dropped EXE
PID:1728 -
\??\c:\tnhntb.exec:\tnhntb.exe32⤵
- Executes dropped EXE
PID:2928 -
\??\c:\7rflllx.exec:\7rflllx.exe33⤵
- Executes dropped EXE
PID:2068 -
\??\c:\nhtbhh.exec:\nhtbhh.exe34⤵
- Executes dropped EXE
PID:2112 -
\??\c:\3jpvv.exec:\3jpvv.exe35⤵
- Executes dropped EXE
PID:2024 -
\??\c:\pjvpv.exec:\pjvpv.exe36⤵
- Executes dropped EXE
PID:2704 -
\??\c:\7xrxxxf.exec:\7xrxxxf.exe37⤵
- Executes dropped EXE
PID:2980 -
\??\c:\tnbbhh.exec:\tnbbhh.exe38⤵
- Executes dropped EXE
PID:1732 -
\??\c:\3pjjp.exec:\3pjjp.exe39⤵
- Executes dropped EXE
PID:2732 -
\??\c:\vppjj.exec:\vppjj.exe40⤵
- Executes dropped EXE
PID:2672 -
\??\c:\7xllrrx.exec:\7xllrrx.exe41⤵
- Executes dropped EXE
PID:2524 -
\??\c:\hbnbhh.exec:\hbnbhh.exe42⤵
- Executes dropped EXE
PID:2636 -
\??\c:\hbnnhh.exec:\hbnnhh.exe43⤵
- Executes dropped EXE
PID:2540 -
\??\c:\1pdjj.exec:\1pdjj.exe44⤵
- Executes dropped EXE
PID:2420 -
\??\c:\lflllfl.exec:\lflllfl.exe45⤵
- Executes dropped EXE
PID:2528 -
\??\c:\xrflxfl.exec:\xrflxfl.exe46⤵
- Executes dropped EXE
PID:1616 -
\??\c:\ttbbhh.exec:\ttbbhh.exe47⤵
- Executes dropped EXE
PID:2924 -
\??\c:\3jjpd.exec:\3jjpd.exe48⤵
- Executes dropped EXE
PID:1940 -
\??\c:\llxfllr.exec:\llxfllr.exe49⤵
- Executes dropped EXE
PID:696 -
\??\c:\9lflxfl.exec:\9lflxfl.exe50⤵
- Executes dropped EXE
PID:2588 -
\??\c:\1nttnn.exec:\1nttnn.exe51⤵
- Executes dropped EXE
PID:1300 -
\??\c:\tntnnt.exec:\tntnnt.exe52⤵
- Executes dropped EXE
PID:2816 -
\??\c:\jddvp.exec:\jddvp.exe53⤵
- Executes dropped EXE
PID:1996 -
\??\c:\lfrlllr.exec:\lfrlllr.exe54⤵
- Executes dropped EXE
PID:1824 -
\??\c:\tththn.exec:\tththn.exe55⤵
- Executes dropped EXE
PID:2416 -
\??\c:\nhbhtt.exec:\nhbhtt.exe56⤵
- Executes dropped EXE
PID:808 -
\??\c:\vpdjv.exec:\vpdjv.exe57⤵
- Executes dropped EXE
PID:1196 -
\??\c:\dpvjp.exec:\dpvjp.exe58⤵
- Executes dropped EXE
PID:1720 -
\??\c:\7fllrfl.exec:\7fllrfl.exe59⤵
- Executes dropped EXE
PID:2196 -
\??\c:\tnhtbb.exec:\tnhtbb.exe60⤵
- Executes dropped EXE
PID:2480 -
\??\c:\ddpdj.exec:\ddpdj.exe61⤵
- Executes dropped EXE
PID:2324 -
\??\c:\7djdd.exec:\7djdd.exe62⤵
- Executes dropped EXE
PID:2696 -
\??\c:\9xrxxxf.exec:\9xrxxxf.exe63⤵
- Executes dropped EXE
PID:2844 -
\??\c:\1nbtbb.exec:\1nbtbb.exe64⤵
- Executes dropped EXE
PID:2996 -
\??\c:\nhhhnt.exec:\nhhhnt.exe65⤵
- Executes dropped EXE
PID:1544 -
\??\c:\pdjjp.exec:\pdjjp.exe66⤵PID:2472
-
\??\c:\jdvvj.exec:\jdvvj.exe67⤵PID:3060
-
\??\c:\lfrxfll.exec:\lfrxfll.exe68⤵PID:2360
-
\??\c:\hbhhhn.exec:\hbhhhn.exe69⤵PID:1336
-
\??\c:\nhtbbn.exec:\nhtbbn.exe70⤵PID:3036
-
\??\c:\ddpvd.exec:\ddpvd.exe71⤵PID:1020
-
\??\c:\lrfxfxr.exec:\lrfxfxr.exe72⤵PID:1004
-
\??\c:\5frffrl.exec:\5frffrl.exe73⤵PID:3040
-
\??\c:\hbbhhh.exec:\hbbhhh.exe74⤵PID:2972
-
\??\c:\jdvdd.exec:\jdvdd.exe75⤵PID:3032
-
\??\c:\fxrrlll.exec:\fxrrlll.exe76⤵PID:880
-
\??\c:\xlflrrx.exec:\xlflrrx.exe77⤵PID:1924
-
\??\c:\btnhhb.exec:\btnhhb.exe78⤵PID:2088
-
\??\c:\dvjjv.exec:\dvjjv.exe79⤵PID:2488
-
\??\c:\3pjjv.exec:\3pjjv.exe80⤵PID:2628
-
\??\c:\frfflfl.exec:\frfflfl.exe81⤵PID:1436
-
\??\c:\9bhnbt.exec:\9bhnbt.exe82⤵PID:2764
-
\??\c:\tthhtt.exec:\tthhtt.exe83⤵PID:2724
-
\??\c:\ppddj.exec:\ppddj.exe84⤵PID:2744
-
\??\c:\rlxfllr.exec:\rlxfllr.exe85⤵PID:2364
-
\??\c:\rlxfllr.exec:\rlxfllr.exe86⤵PID:2636
-
\??\c:\7htttt.exec:\7htttt.exe87⤵PID:2692
-
\??\c:\btbhnt.exec:\btbhnt.exe88⤵PID:2780
-
\??\c:\jvvpd.exec:\jvvpd.exe89⤵PID:2640
-
\??\c:\vpvdd.exec:\vpvdd.exe90⤵PID:2904
-
\??\c:\7lfxxrx.exec:\7lfxxrx.exe91⤵PID:1644
-
\??\c:\3nnttb.exec:\3nnttb.exe92⤵PID:1932
-
\??\c:\tthtbh.exec:\tthtbh.exe93⤵PID:1936
-
\??\c:\vpdvv.exec:\vpdvv.exe94⤵PID:2752
-
\??\c:\9lxxxxx.exec:\9lxxxxx.exe95⤵PID:1000
-
\??\c:\7rfxxrr.exec:\7rfxxrr.exe96⤵PID:1928
-
\??\c:\hbttnn.exec:\hbttnn.exe97⤵PID:2256
-
\??\c:\pjddv.exec:\pjddv.exe98⤵PID:1632
-
\??\c:\pdppd.exec:\pdppd.exe99⤵PID:984
-
\??\c:\lxlfllr.exec:\lxlfllr.exe100⤵PID:1180
-
\??\c:\1bbbbb.exec:\1bbbbb.exe101⤵PID:620
-
\??\c:\nbhhnn.exec:\nbhhnn.exe102⤵PID:1252
-
\??\c:\dvddj.exec:\dvddj.exe103⤵PID:936
-
\??\c:\rfxllll.exec:\rfxllll.exe104⤵PID:1516
-
\??\c:\frxxfxx.exec:\frxxfxx.exe105⤵PID:2860
-
\??\c:\hthhbb.exec:\hthhbb.exe106⤵PID:2864
-
\??\c:\vpdjv.exec:\vpdjv.exe107⤵PID:2616
-
\??\c:\jvjjj.exec:\jvjjj.exe108⤵PID:3000
-
\??\c:\5llxxxx.exec:\5llxxxx.exe109⤵PID:700
-
\??\c:\7flffll.exec:\7flffll.exe110⤵PID:996
-
\??\c:\btbbhh.exec:\btbbhh.exe111⤵PID:1536
-
\??\c:\3vdjj.exec:\3vdjj.exe112⤵PID:2372
-
\??\c:\5jvdj.exec:\5jvdj.exe113⤵PID:1960
-
\??\c:\frxxrrx.exec:\frxxrrx.exe114⤵PID:236
-
\??\c:\9lrfxrr.exec:\9lrfxrr.exe115⤵PID:2840
-
\??\c:\7bnttt.exec:\7bnttt.exe116⤵PID:1012
-
\??\c:\pjvvd.exec:\pjvvd.exe117⤵PID:2900
-
\??\c:\jvppv.exec:\jvppv.exe118⤵PID:1728
-
\??\c:\ffrfllx.exec:\ffrfllx.exe119⤵PID:1744
-
\??\c:\rfxxfff.exec:\rfxxfff.exe120⤵PID:1524
-
\??\c:\thtntn.exec:\thtntn.exe121⤵PID:1316
-
\??\c:\ddppv.exec:\ddppv.exe122⤵PID:2104
-
\??\c:\7pddj.exec:\7pddj.exe123⤵PID:1568
-
\??\c:\7lrlfxr.exec:\7lrlfxr.exe124⤵PID:1588
-
\??\c:\lflrxrx.exec:\lflrxrx.exe125⤵PID:2768
-
\??\c:\thntth.exec:\thntth.exe126⤵PID:2756
-
\??\c:\pjddj.exec:\pjddj.exe127⤵PID:2624
-
\??\c:\pdddj.exec:\pdddj.exe128⤵PID:2680
-
\??\c:\lfxxffl.exec:\lfxxffl.exe129⤵PID:2364
-
\??\c:\lfxxflr.exec:\lfxxflr.exe130⤵PID:2516
-
\??\c:\htbtbt.exec:\htbtbt.exe131⤵PID:2772
-
\??\c:\3vdpp.exec:\3vdpp.exe132⤵PID:2908
-
\??\c:\dpdvd.exec:\dpdvd.exe133⤵PID:2572
-
\??\c:\lxfflfr.exec:\lxfflfr.exe134⤵PID:1624
-
\??\c:\nhtthn.exec:\nhtthn.exe135⤵PID:752
-
\??\c:\tnhhhh.exec:\tnhhhh.exe136⤵PID:1952
-
\??\c:\vpddd.exec:\vpddd.exe137⤵PID:1508
-
\??\c:\5llrxfl.exec:\5llrxfl.exe138⤵PID:2188
-
\??\c:\rflrrxf.exec:\rflrrxf.exe139⤵PID:1232
-
\??\c:\bnbtbt.exec:\bnbtbt.exe140⤵PID:1032
-
\??\c:\jvjjp.exec:\jvjjp.exe141⤵PID:2412
-
\??\c:\jdvdj.exec:\jdvdj.exe142⤵PID:2432
-
\??\c:\5dvpv.exec:\5dvpv.exe143⤵PID:2400
-
\??\c:\lfrxlrf.exec:\lfrxlrf.exe144⤵PID:792
-
\??\c:\5thhnn.exec:\5thhnn.exe145⤵PID:1764
-
\??\c:\ppjpv.exec:\ppjpv.exe146⤵PID:272
-
\??\c:\ddpjp.exec:\ddpjp.exe147⤵PID:2388
-
\??\c:\fxxxxff.exec:\fxxxxff.exe148⤵PID:2308
-
\??\c:\bbbhtt.exec:\bbbhtt.exe149⤵PID:1684
-
\??\c:\1bbhnh.exec:\1bbhnh.exe150⤵PID:1688
-
\??\c:\pjpdd.exec:\pjpdd.exe151⤵PID:1096
-
\??\c:\9lxfflr.exec:\9lxfflr.exe152⤵PID:1572
-
\??\c:\xffflfl.exec:\xffflfl.exe153⤵PID:840
-
\??\c:\nhbhnb.exec:\nhbhnb.exe154⤵PID:2976
-
\??\c:\9pjdv.exec:\9pjdv.exe155⤵PID:1872
-
\??\c:\5djdv.exec:\5djdv.exe156⤵PID:1992
-
\??\c:\xrllllr.exec:\xrllllr.exe157⤵PID:952
-
\??\c:\7hntbh.exec:\7hntbh.exe158⤵PID:2884
-
\??\c:\hhhnbb.exec:\hhhnbb.exe159⤵PID:1672
-
\??\c:\9jdjp.exec:\9jdjp.exe160⤵PID:2060
-
\??\c:\lflflrr.exec:\lflflrr.exe161⤵PID:2456
-
\??\c:\1fflxfl.exec:\1fflxfl.exe162⤵PID:2068
-
\??\c:\9btnbb.exec:\9btnbb.exe163⤵PID:2268
-
\??\c:\bbntbb.exec:\bbntbb.exe164⤵PID:2024
-
\??\c:\pdpjp.exec:\pdpjp.exe165⤵PID:3024
-
\??\c:\lfxfllx.exec:\lfxfllx.exe166⤵PID:1804
-
\??\c:\7rrrxxl.exec:\7rrrxxl.exe167⤵PID:2612
-
\??\c:\3nhbhb.exec:\3nhbhb.exe168⤵PID:2396
-
\??\c:\5ddjj.exec:\5ddjj.exe169⤵PID:2672
-
\??\c:\dvdvv.exec:\dvdvv.exe170⤵PID:2552
-
\??\c:\fxllxlf.exec:\fxllxlf.exe171⤵PID:2940
-
\??\c:\5bnhhh.exec:\5bnhhh.exe172⤵PID:2708
-
\??\c:\9btbhn.exec:\9btbhn.exe173⤵PID:2548
-
\??\c:\jvjpp.exec:\jvjpp.exe174⤵PID:2536
-
\??\c:\rrffxfl.exec:\rrffxfl.exe175⤵PID:1908
-
\??\c:\5rrrxfr.exec:\5rrrxfr.exe176⤵PID:2184
-
\??\c:\bnhthh.exec:\bnhthh.exe177⤵PID:1836
-
\??\c:\jjvjv.exec:\jjvjv.exe178⤵PID:2800
-
\??\c:\dvjjd.exec:\dvjjd.exe179⤵PID:2556
-
\??\c:\9xrffxx.exec:\9xrffxx.exe180⤵PID:2588
-
\??\c:\xllrxxf.exec:\xllrxxf.exe181⤵PID:836
-
\??\c:\bbnntt.exec:\bbnntt.exe182⤵PID:2044
-
\??\c:\3pjjj.exec:\3pjjj.exe183⤵PID:992
-
\??\c:\jdppp.exec:\jdppp.exe184⤵PID:692
-
\??\c:\xlfxffl.exec:\xlfxffl.exe185⤵PID:2228
-
\??\c:\3bbttt.exec:\3bbttt.exe186⤵PID:756
-
\??\c:\tnttbt.exec:\tnttbt.exe187⤵PID:1196
-
\??\c:\jdjjj.exec:\jdjjj.exe188⤵PID:2276
-
\??\c:\dpvdj.exec:\dpvdj.exe189⤵PID:2368
-
\??\c:\rllxlxr.exec:\rllxlxr.exe190⤵PID:2992
-
\??\c:\nnbbnn.exec:\nnbbnn.exe191⤵PID:1148
-
\??\c:\hthntb.exec:\hthntb.exe192⤵PID:812
-
\??\c:\vjvvd.exec:\vjvvd.exe193⤵PID:3004
-
\??\c:\pdvpp.exec:\pdvpp.exe194⤵PID:1812
-
\??\c:\rrlrfxf.exec:\rrlrfxf.exe195⤵PID:3052
-
\??\c:\5htnhb.exec:\5htnhb.exe196⤵PID:1376
-
\??\c:\3thnnn.exec:\3thnnn.exe197⤵PID:2232
-
\??\c:\7vjjj.exec:\7vjjj.exe198⤵PID:344
-
\??\c:\lflxxrx.exec:\lflxxrx.exe199⤵PID:1972
-
\??\c:\rlxxxxl.exec:\rlxxxxl.exe200⤵PID:1976
-
\??\c:\1bbhhh.exec:\1bbhhh.exe201⤵PID:2344
-
\??\c:\hbhntb.exec:\hbhntb.exe202⤵PID:908
-
\??\c:\dvppv.exec:\dvppv.exe203⤵PID:2828
-
\??\c:\1lxllfx.exec:\1lxllfx.exe204⤵PID:2928
-
\??\c:\rlfflff.exec:\rlfflff.exe205⤵PID:2120
-
\??\c:\bnttbb.exec:\bnttbb.exe206⤵PID:1736
-
\??\c:\pjvpd.exec:\pjvpd.exe207⤵PID:1740
-
\??\c:\9jvvj.exec:\9jvvj.exe208⤵PID:2072
-
\??\c:\xrflrrx.exec:\xrflrrx.exe209⤵PID:1600
-
\??\c:\ntnthb.exec:\ntnthb.exe210⤵PID:2796
-
\??\c:\bnbthb.exec:\bnbthb.exe211⤵PID:2760
-
\??\c:\jdpjv.exec:\jdpjv.exe212⤵PID:3012
-
\??\c:\rrfffrr.exec:\rrfffrr.exe213⤵PID:2352
-
\??\c:\rlrffxl.exec:\rlrffxl.exe214⤵PID:1668
-
\??\c:\9bnhhh.exec:\9bnhhh.exe215⤵PID:2684
-
\??\c:\dpvvv.exec:\dpvvv.exe216⤵PID:2740
-
\??\c:\5jdvd.exec:\5jdvd.exe217⤵PID:2912
-
\??\c:\lxrxllx.exec:\lxrxllx.exe218⤵PID:2960
-
\??\c:\7rfffff.exec:\7rfffff.exe219⤵PID:1796
-
\??\c:\bbhhnn.exec:\bbhhnn.exe220⤵PID:1644
-
\??\c:\vpjjp.exec:\vpjjp.exe221⤵PID:1932
-
\??\c:\vpjpp.exec:\vpjpp.exe222⤵PID:1868
-
\??\c:\frllrxl.exec:\frllrxl.exe223⤵PID:1640
-
\??\c:\htbhhn.exec:\htbhhn.exe224⤵PID:1000
-
\??\c:\tntbbh.exec:\tntbbh.exe225⤵PID:1996
-
\??\c:\vvjdv.exec:\vvjdv.exe226⤵PID:2256
-
\??\c:\1dddd.exec:\1dddd.exe227⤵PID:2416
-
\??\c:\rlxfffr.exec:\rlxfffr.exe228⤵PID:1552
-
\??\c:\bthhnt.exec:\bthhnt.exe229⤵PID:984
-
\??\c:\hbtbtb.exec:\hbtbtb.exe230⤵PID:804
-
\??\c:\vjppp.exec:\vjppp.exe231⤵PID:1244
-
\??\c:\7dvpp.exec:\7dvpp.exe232⤵PID:2196
-
\??\c:\3lxlllr.exec:\3lxlllr.exe233⤵PID:936
-
\??\c:\9btbhb.exec:\9btbhb.exe234⤵PID:2852
-
\??\c:\nhttbb.exec:\nhttbb.exe235⤵PID:1488
-
\??\c:\1jvvv.exec:\1jvvv.exe236⤵PID:1112
-
\??\c:\rlffllr.exec:\rlffllr.exe237⤵PID:2220
-
\??\c:\9rrrrrr.exec:\9rrrrrr.exe238⤵PID:1584
-
\??\c:\tnhhnn.exec:\tnhhnn.exe239⤵PID:1704
-
\??\c:\jpdjj.exec:\jpdjj.exe240⤵PID:1548
-
\??\c:\9xxlrff.exec:\9xxlrff.exe241⤵PID:1536
-
\??\c:\rlxlrrl.exec:\rlxlrrl.exe242⤵PID:3020