Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 15:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e1fa155c3352e29647152e034457b3c0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
e1fa155c3352e29647152e034457b3c0_NeikiAnalytics.exe
-
Size
361KB
-
MD5
e1fa155c3352e29647152e034457b3c0
-
SHA1
7639db5185c441eb05f8ff95000a78cbf9bf3f40
-
SHA256
b267cdb74b959a89b3372e13240a0f725b857b09f96bd9976c08b9bee6b4921f
-
SHA512
86e36bd5e0891253db484fb9c52af50f6a64c0c17362649ef13a8cb18e9f64c78453829b01c438a87f62fe809a48266940337b2767d7e7aef681698a5e90657f
-
SSDEEP
6144:n3C9BRo7tvnJ9oH0IRgZvjD8296gnzeZhBuU:n3C9ytvngQj429nnzeZhBJ
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/2372-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1704-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2252-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1484-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2256-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1712-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1768-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1044-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1452-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/560-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/876-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1628-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
hbbbbt.exe9ntntt.exe5ppjj.exejjvdv.exerlxlxxf.exenbbnth.exevvjjv.exellfrfrl.exe9vppj.exe9pvdj.exebthhnn.exe1htnnn.exe9lfxfxf.exerlrrxlr.exepjpvd.exexxfrxfl.exebtnnbh.exepjjdv.exe1fllrrf.exethntbh.exepjvdj.exexrxffxx.exethtbbb.exejjvjv.exelfrxffr.exe1nthbb.exexfxfxfr.exe3hnbbt.exejjvdj.exeppdjp.exehhbntb.exebtbtbb.exedjvdj.exerrlxlfr.exe5bnttt.exethnhhb.exeddjpp.exerflffrx.exeffxflxl.exetnttbb.exe7tnhtn.exevpjjp.exeppdvd.exe1fxxfff.exettnbnt.exetnbbnt.exepjpvd.exe5lflxxf.exelfxfllf.exebnbhnn.exedvppv.exepdpjj.exelllrrxr.exe3xfflxx.exehtbnbt.exedjpvd.exevpvdj.exelfrlflx.exerlffxxf.exe7nbbhn.exevppdj.exepdddp.exefffrffr.exefxffflf.exepid process 2528 hbbbbt.exe 1704 9ntntt.exe 2252 5ppjj.exe 2664 jjvdv.exe 2696 rlxlxxf.exe 2748 nbbnth.exe 2616 vvjjv.exe 2480 llfrfrl.exe 2948 9vppj.exe 2968 9pvdj.exe 2832 bthhnn.exe 1948 1htnnn.exe 1484 9lfxfxf.exe 2436 rlrrxlr.exe 2816 pjpvd.exe 848 xxfrxfl.exe 1652 btnnbh.exe 2256 pjjdv.exe 1712 1fllrrf.exe 1768 thntbh.exe 1044 pjvdj.exe 1452 xrxffxx.exe 560 thtbbb.exe 616 jjvjv.exe 876 lfrxffr.exe 284 1nthbb.exe 904 xfxfxfr.exe 2200 3hnbbt.exe 1016 jjvdj.exe 3036 ppdjp.exe 1628 hhbntb.exe 2896 btbtbb.exe 1600 djvdj.exe 2912 rrlxlfr.exe 2836 5bnttt.exe 2260 thnhhb.exe 2656 ddjpp.exe 2604 rflffrx.exe 2580 ffxflxl.exe 804 tnttbb.exe 2560 7tnhtn.exe 2748 vpjjp.exe 2512 ppdvd.exe 2944 1fxxfff.exe 2284 ttnbnt.exe 320 tnbbnt.exe 2924 pjpvd.exe 1688 5lflxxf.exe 1528 lfxfllf.exe 1480 bnbhnn.exe 2000 dvppv.exe 2796 pdpjj.exe 2908 lllrrxr.exe 1616 3xfflxx.exe 1652 htbnbt.exe 2936 djpvd.exe 1972 vpvdj.exe 1880 lfrlflx.exe 2056 rlffxxf.exe 288 7nbbhn.exe 1444 vppdj.exe 864 pdddp.exe 1816 fffrffr.exe 1728 fxffflf.exe -
Processes:
resource yara_rule behavioral1/memory/2372-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1704-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2252-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1484-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1712-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1768-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1044-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1452-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/560-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/876-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-299-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e1fa155c3352e29647152e034457b3c0_NeikiAnalytics.exehbbbbt.exe9ntntt.exe5ppjj.exejjvdv.exerlxlxxf.exenbbnth.exevvjjv.exellfrfrl.exe9vppj.exe9pvdj.exebthhnn.exe1htnnn.exe9lfxfxf.exerlrrxlr.exepjpvd.exedescription pid process target process PID 2372 wrote to memory of 2528 2372 e1fa155c3352e29647152e034457b3c0_NeikiAnalytics.exe hbbbbt.exe PID 2372 wrote to memory of 2528 2372 e1fa155c3352e29647152e034457b3c0_NeikiAnalytics.exe hbbbbt.exe PID 2372 wrote to memory of 2528 2372 e1fa155c3352e29647152e034457b3c0_NeikiAnalytics.exe hbbbbt.exe PID 2372 wrote to memory of 2528 2372 e1fa155c3352e29647152e034457b3c0_NeikiAnalytics.exe hbbbbt.exe PID 2528 wrote to memory of 1704 2528 hbbbbt.exe 9ntntt.exe PID 2528 wrote to memory of 1704 2528 hbbbbt.exe 9ntntt.exe PID 2528 wrote to memory of 1704 2528 hbbbbt.exe 9ntntt.exe PID 2528 wrote to memory of 1704 2528 hbbbbt.exe 9ntntt.exe PID 1704 wrote to memory of 2252 1704 9ntntt.exe 5ppjj.exe PID 1704 wrote to memory of 2252 1704 9ntntt.exe 5ppjj.exe PID 1704 wrote to memory of 2252 1704 9ntntt.exe 5ppjj.exe PID 1704 wrote to memory of 2252 1704 9ntntt.exe 5ppjj.exe PID 2252 wrote to memory of 2664 2252 5ppjj.exe jjvdv.exe PID 2252 wrote to memory of 2664 2252 5ppjj.exe jjvdv.exe PID 2252 wrote to memory of 2664 2252 5ppjj.exe jjvdv.exe PID 2252 wrote to memory of 2664 2252 5ppjj.exe jjvdv.exe PID 2664 wrote to memory of 2696 2664 jjvdv.exe rlxlxxf.exe PID 2664 wrote to memory of 2696 2664 jjvdv.exe rlxlxxf.exe PID 2664 wrote to memory of 2696 2664 jjvdv.exe rlxlxxf.exe PID 2664 wrote to memory of 2696 2664 jjvdv.exe rlxlxxf.exe PID 2696 wrote to memory of 2748 2696 rlxlxxf.exe nbbnth.exe PID 2696 wrote to memory of 2748 2696 rlxlxxf.exe nbbnth.exe PID 2696 wrote to memory of 2748 2696 rlxlxxf.exe nbbnth.exe PID 2696 wrote to memory of 2748 2696 rlxlxxf.exe nbbnth.exe PID 2748 wrote to memory of 2616 2748 nbbnth.exe vvjjv.exe PID 2748 wrote to memory of 2616 2748 nbbnth.exe vvjjv.exe PID 2748 wrote to memory of 2616 2748 nbbnth.exe vvjjv.exe PID 2748 wrote to memory of 2616 2748 nbbnth.exe vvjjv.exe PID 2616 wrote to memory of 2480 2616 vvjjv.exe llfrfrl.exe PID 2616 wrote to memory of 2480 2616 vvjjv.exe llfrfrl.exe PID 2616 wrote to memory of 2480 2616 vvjjv.exe llfrfrl.exe PID 2616 wrote to memory of 2480 2616 vvjjv.exe llfrfrl.exe PID 2480 wrote to memory of 2948 2480 llfrfrl.exe 9vppj.exe PID 2480 wrote to memory of 2948 2480 llfrfrl.exe 9vppj.exe PID 2480 wrote to memory of 2948 2480 llfrfrl.exe 9vppj.exe PID 2480 wrote to memory of 2948 2480 llfrfrl.exe 9vppj.exe PID 2948 wrote to memory of 2968 2948 9vppj.exe 9pvdj.exe PID 2948 wrote to memory of 2968 2948 9vppj.exe 9pvdj.exe PID 2948 wrote to memory of 2968 2948 9vppj.exe 9pvdj.exe PID 2948 wrote to memory of 2968 2948 9vppj.exe 9pvdj.exe PID 2968 wrote to memory of 2832 2968 9pvdj.exe bthhnn.exe PID 2968 wrote to memory of 2832 2968 9pvdj.exe bthhnn.exe PID 2968 wrote to memory of 2832 2968 9pvdj.exe bthhnn.exe PID 2968 wrote to memory of 2832 2968 9pvdj.exe bthhnn.exe PID 2832 wrote to memory of 1948 2832 bthhnn.exe 1htnnn.exe PID 2832 wrote to memory of 1948 2832 bthhnn.exe 1htnnn.exe PID 2832 wrote to memory of 1948 2832 bthhnn.exe 1htnnn.exe PID 2832 wrote to memory of 1948 2832 bthhnn.exe 1htnnn.exe PID 1948 wrote to memory of 1484 1948 1htnnn.exe 9lfxfxf.exe PID 1948 wrote to memory of 1484 1948 1htnnn.exe 9lfxfxf.exe PID 1948 wrote to memory of 1484 1948 1htnnn.exe 9lfxfxf.exe PID 1948 wrote to memory of 1484 1948 1htnnn.exe 9lfxfxf.exe PID 1484 wrote to memory of 2436 1484 9lfxfxf.exe rlrrxlr.exe PID 1484 wrote to memory of 2436 1484 9lfxfxf.exe rlrrxlr.exe PID 1484 wrote to memory of 2436 1484 9lfxfxf.exe rlrrxlr.exe PID 1484 wrote to memory of 2436 1484 9lfxfxf.exe rlrrxlr.exe PID 2436 wrote to memory of 2816 2436 rlrrxlr.exe pjpvd.exe PID 2436 wrote to memory of 2816 2436 rlrrxlr.exe pjpvd.exe PID 2436 wrote to memory of 2816 2436 rlrrxlr.exe pjpvd.exe PID 2436 wrote to memory of 2816 2436 rlrrxlr.exe pjpvd.exe PID 2816 wrote to memory of 848 2816 pjpvd.exe xxfrxfl.exe PID 2816 wrote to memory of 848 2816 pjpvd.exe xxfrxfl.exe PID 2816 wrote to memory of 848 2816 pjpvd.exe xxfrxfl.exe PID 2816 wrote to memory of 848 2816 pjpvd.exe xxfrxfl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1fa155c3352e29647152e034457b3c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e1fa155c3352e29647152e034457b3c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\hbbbbt.exec:\hbbbbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\9ntntt.exec:\9ntntt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\5ppjj.exec:\5ppjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\jjvdv.exec:\jjvdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\rlxlxxf.exec:\rlxlxxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\nbbnth.exec:\nbbnth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\vvjjv.exec:\vvjjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\llfrfrl.exec:\llfrfrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\9vppj.exec:\9vppj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\9pvdj.exec:\9pvdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\bthhnn.exec:\bthhnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\1htnnn.exec:\1htnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\9lfxfxf.exec:\9lfxfxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\rlrrxlr.exec:\rlrrxlr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\pjpvd.exec:\pjpvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\xxfrxfl.exec:\xxfrxfl.exe17⤵
- Executes dropped EXE
PID:848 -
\??\c:\btnnbh.exec:\btnnbh.exe18⤵
- Executes dropped EXE
PID:1652 -
\??\c:\pjjdv.exec:\pjjdv.exe19⤵
- Executes dropped EXE
PID:2256 -
\??\c:\1fllrrf.exec:\1fllrrf.exe20⤵
- Executes dropped EXE
PID:1712 -
\??\c:\thntbh.exec:\thntbh.exe21⤵
- Executes dropped EXE
PID:1768 -
\??\c:\pjvdj.exec:\pjvdj.exe22⤵
- Executes dropped EXE
PID:1044 -
\??\c:\xrxffxx.exec:\xrxffxx.exe23⤵
- Executes dropped EXE
PID:1452 -
\??\c:\thtbbb.exec:\thtbbb.exe24⤵
- Executes dropped EXE
PID:560 -
\??\c:\jjvjv.exec:\jjvjv.exe25⤵
- Executes dropped EXE
PID:616 -
\??\c:\lfrxffr.exec:\lfrxffr.exe26⤵
- Executes dropped EXE
PID:876 -
\??\c:\1nthbb.exec:\1nthbb.exe27⤵
- Executes dropped EXE
PID:284 -
\??\c:\xfxfxfr.exec:\xfxfxfr.exe28⤵
- Executes dropped EXE
PID:904 -
\??\c:\3hnbbt.exec:\3hnbbt.exe29⤵
- Executes dropped EXE
PID:2200 -
\??\c:\jjvdj.exec:\jjvdj.exe30⤵
- Executes dropped EXE
PID:1016 -
\??\c:\ppdjp.exec:\ppdjp.exe31⤵
- Executes dropped EXE
PID:3036 -
\??\c:\hhbntb.exec:\hhbntb.exe32⤵
- Executes dropped EXE
PID:1628 -
\??\c:\btbtbb.exec:\btbtbb.exe33⤵
- Executes dropped EXE
PID:2896 -
\??\c:\djvdj.exec:\djvdj.exe34⤵
- Executes dropped EXE
PID:1600 -
\??\c:\rrlxlfr.exec:\rrlxlfr.exe35⤵
- Executes dropped EXE
PID:2912 -
\??\c:\5bnttt.exec:\5bnttt.exe36⤵
- Executes dropped EXE
PID:2836 -
\??\c:\thnhhb.exec:\thnhhb.exe37⤵
- Executes dropped EXE
PID:2260 -
\??\c:\ddjpp.exec:\ddjpp.exe38⤵
- Executes dropped EXE
PID:2656 -
\??\c:\rflffrx.exec:\rflffrx.exe39⤵
- Executes dropped EXE
PID:2604 -
\??\c:\ffxflxl.exec:\ffxflxl.exe40⤵
- Executes dropped EXE
PID:2580 -
\??\c:\tnttbb.exec:\tnttbb.exe41⤵
- Executes dropped EXE
PID:804 -
\??\c:\7tnhtn.exec:\7tnhtn.exe42⤵
- Executes dropped EXE
PID:2560 -
\??\c:\vpjjp.exec:\vpjjp.exe43⤵
- Executes dropped EXE
PID:2748 -
\??\c:\ppdvd.exec:\ppdvd.exe44⤵
- Executes dropped EXE
PID:2512 -
\??\c:\1fxxfff.exec:\1fxxfff.exe45⤵
- Executes dropped EXE
PID:2944 -
\??\c:\ttnbnt.exec:\ttnbnt.exe46⤵
- Executes dropped EXE
PID:2284 -
\??\c:\tnbbnt.exec:\tnbbnt.exe47⤵
- Executes dropped EXE
PID:320 -
\??\c:\pjpvd.exec:\pjpvd.exe48⤵
- Executes dropped EXE
PID:2924 -
\??\c:\5lflxxf.exec:\5lflxxf.exe49⤵
- Executes dropped EXE
PID:1688 -
\??\c:\lfxfllf.exec:\lfxfllf.exe50⤵
- Executes dropped EXE
PID:1528 -
\??\c:\bnbhnn.exec:\bnbhnn.exe51⤵
- Executes dropped EXE
PID:1480 -
\??\c:\dvppv.exec:\dvppv.exe52⤵
- Executes dropped EXE
PID:2000 -
\??\c:\pdpjj.exec:\pdpjj.exe53⤵
- Executes dropped EXE
PID:2796 -
\??\c:\lllrrxr.exec:\lllrrxr.exe54⤵
- Executes dropped EXE
PID:2908 -
\??\c:\3xfflxx.exec:\3xfflxx.exe55⤵
- Executes dropped EXE
PID:1616 -
\??\c:\htbnbt.exec:\htbnbt.exe56⤵
- Executes dropped EXE
PID:1652 -
\??\c:\djpvd.exec:\djpvd.exe57⤵
- Executes dropped EXE
PID:2936 -
\??\c:\vpvdj.exec:\vpvdj.exe58⤵
- Executes dropped EXE
PID:1972 -
\??\c:\lfrlflx.exec:\lfrlflx.exe59⤵
- Executes dropped EXE
PID:1880 -
\??\c:\rlffxxf.exec:\rlffxxf.exe60⤵
- Executes dropped EXE
PID:2056 -
\??\c:\7nbbhn.exec:\7nbbhn.exe61⤵
- Executes dropped EXE
PID:288 -
\??\c:\vppdj.exec:\vppdj.exe62⤵
- Executes dropped EXE
PID:1444 -
\??\c:\pdddp.exec:\pdddp.exe63⤵
- Executes dropped EXE
PID:864 -
\??\c:\fffrffr.exec:\fffrffr.exe64⤵
- Executes dropped EXE
PID:1816 -
\??\c:\fxffflf.exec:\fxffflf.exe65⤵
- Executes dropped EXE
PID:1728 -
\??\c:\bthbtn.exec:\bthbtn.exe66⤵PID:668
-
\??\c:\vvpvd.exec:\vvpvd.exe67⤵PID:2992
-
\??\c:\vjjjd.exec:\vjjjd.exe68⤵PID:1884
-
\??\c:\xrflrrr.exec:\xrflrrr.exe69⤵PID:1432
-
\??\c:\tnbbnt.exec:\tnbbnt.exe70⤵PID:768
-
\??\c:\bntthh.exec:\bntthh.exe71⤵PID:2224
-
\??\c:\3pdjj.exec:\3pdjj.exe72⤵PID:1632
-
\??\c:\xrrllxx.exec:\xrrllxx.exe73⤵PID:2208
-
\??\c:\3lrrxfr.exec:\3lrrxfr.exe74⤵PID:2160
-
\??\c:\7thnnt.exec:\7thnnt.exe75⤵PID:1964
-
\??\c:\ttnhtb.exec:\ttnhtb.exe76⤵PID:1600
-
\??\c:\pvvdj.exec:\pvvdj.exe77⤵PID:2912
-
\??\c:\ddvdd.exec:\ddvdd.exe78⤵PID:1704
-
\??\c:\1rxlrrx.exec:\1rxlrrx.exe79⤵PID:2260
-
\??\c:\5fxfxxf.exec:\5fxfxxf.exe80⤵PID:2852
-
\??\c:\htbhnh.exec:\htbhnh.exe81⤵PID:2588
-
\??\c:\9dpdp.exec:\9dpdp.exe82⤵PID:2088
-
\??\c:\dpjpp.exec:\dpjpp.exe83⤵PID:804
-
\??\c:\xrflxxl.exec:\xrflxxl.exe84⤵PID:2460
-
\??\c:\5bnnbh.exec:\5bnnbh.exe85⤵PID:2748
-
\??\c:\thbtbh.exec:\thbtbh.exe86⤵PID:1784
-
\??\c:\jvjdj.exec:\jvjdj.exe87⤵PID:2744
-
\??\c:\rlrfxxr.exec:\rlrfxxr.exe88⤵PID:1916
-
\??\c:\lfrxfff.exec:\lfrxfff.exe89⤵PID:1536
-
\??\c:\hbhhnn.exec:\hbhhnn.exe90⤵PID:1932
-
\??\c:\5djjp.exec:\5djjp.exe91⤵PID:1688
-
\??\c:\vjvvp.exec:\vjvvp.exe92⤵PID:2624
-
\??\c:\3lllxxx.exec:\3lllxxx.exe93⤵PID:1480
-
\??\c:\hhttbn.exec:\hhttbn.exe94⤵PID:2824
-
\??\c:\nnbtbn.exec:\nnbtbn.exe95⤵PID:2796
-
\??\c:\5vjpv.exec:\5vjpv.exe96⤵PID:2952
-
\??\c:\dvjpv.exec:\dvjpv.exe97⤵PID:1616
-
\??\c:\9lxxxxf.exec:\9lxxxxf.exe98⤵PID:2076
-
\??\c:\5bnhtn.exec:\5bnhtn.exe99⤵PID:2936
-
\??\c:\hthnnn.exec:\hthnnn.exe100⤵PID:1676
-
\??\c:\vjpjp.exec:\vjpjp.exe101⤵PID:1880
-
\??\c:\7xlrfxl.exec:\7xlrfxl.exe102⤵PID:656
-
\??\c:\nhbhnt.exec:\nhbhnt.exe103⤵PID:288
-
\??\c:\nhhtnn.exec:\nhhtnn.exe104⤵PID:560
-
\??\c:\jpppd.exec:\jpppd.exe105⤵PID:864
-
\??\c:\ddvdj.exec:\ddvdj.exe106⤵PID:1816
-
\??\c:\xrrfrxl.exec:\xrrfrxl.exe107⤵PID:1728
-
\??\c:\fxlxflf.exec:\fxlxflf.exe108⤵PID:668
-
\??\c:\btbhtn.exec:\btbhtn.exe109⤵PID:1212
-
\??\c:\jvdvd.exec:\jvdvd.exe110⤵PID:1884
-
\??\c:\1djdd.exec:\1djdd.exe111⤵PID:1432
-
\??\c:\xxrxflr.exec:\xxrxflr.exe112⤵PID:1136
-
\??\c:\nnnntb.exec:\nnnntb.exe113⤵PID:2224
-
\??\c:\tnhttb.exec:\tnhttb.exe114⤵PID:1628
-
\??\c:\dvdpd.exec:\dvdpd.exe115⤵PID:2208
-
\??\c:\xlxfrrx.exec:\xlxfrrx.exe116⤵PID:2356
-
\??\c:\xrflrrx.exec:\xrflrrx.exe117⤵PID:1964
-
\??\c:\tnhhbn.exec:\tnhhbn.exe118⤵PID:1600
-
\??\c:\3dpvj.exec:\3dpvj.exe119⤵PID:2912
-
\??\c:\vvvjj.exec:\vvvjj.exe120⤵PID:2556
-
\??\c:\lxlrffr.exec:\lxlrffr.exe121⤵PID:2664
-
\??\c:\tttthn.exec:\tttthn.exe122⤵PID:2608
-
\??\c:\nnbnnn.exec:\nnbnnn.exe123⤵PID:2588
-
\??\c:\9vppd.exec:\9vppd.exe124⤵PID:2612
-
\??\c:\xxxfrfx.exec:\xxxfrfx.exe125⤵PID:2716
-
\??\c:\llflfrf.exec:\llflfrf.exe126⤵PID:2444
-
\??\c:\hbnbhh.exec:\hbnbhh.exe127⤵PID:2748
-
\??\c:\bhbhth.exec:\bhbhth.exe128⤵PID:1520
-
\??\c:\vpvpp.exec:\vpvpp.exe129⤵PID:2744
-
\??\c:\rfflrrf.exec:\rfflrrf.exe130⤵PID:2348
-
\??\c:\rlxxlrl.exec:\rlxxlrl.exe131⤵PID:1536
-
\??\c:\hbntnb.exec:\hbntnb.exe132⤵PID:1932
-
\??\c:\pdpvv.exec:\pdpvv.exe133⤵PID:1688
-
\??\c:\pdvpp.exec:\pdvpp.exe134⤵PID:2436
-
\??\c:\xlrxxrr.exec:\xlrxxrr.exe135⤵PID:2932
-
\??\c:\thnnnt.exec:\thnnnt.exe136⤵PID:1824
-
\??\c:\ttnnth.exec:\ttnnth.exe137⤵PID:2796
-
\??\c:\7jvvp.exec:\7jvvp.exe138⤵PID:2952
-
\??\c:\1dpvd.exec:\1dpvd.exe139⤵PID:1616
-
\??\c:\5rrrrxf.exec:\5rrrrxf.exe140⤵PID:2236
-
\??\c:\9ntnnh.exec:\9ntnnh.exe141⤵PID:2936
-
\??\c:\hbtbnn.exec:\hbtbnn.exe142⤵PID:1044
-
\??\c:\jvvvd.exec:\jvvvd.exe143⤵PID:1880
-
\??\c:\lffrrrx.exec:\lffrrrx.exe144⤵PID:1472
-
\??\c:\lfrxxxf.exec:\lfrxxxf.exe145⤵PID:288
-
\??\c:\btnnhh.exec:\btnnhh.exe146⤵PID:412
-
\??\c:\jdvvv.exec:\jdvvv.exe147⤵PID:864
-
\??\c:\jjddv.exec:\jjddv.exe148⤵PID:884
-
\??\c:\llxfflr.exec:\llxfflr.exe149⤵PID:1728
-
\??\c:\bhbbnh.exec:\bhbbnh.exe150⤵PID:904
-
\??\c:\vvvvj.exec:\vvvvj.exe151⤵PID:1212
-
\??\c:\rlxfllf.exec:\rlxfllf.exe152⤵PID:564
-
\??\c:\3frlxxl.exec:\3frlxxl.exe153⤵PID:1432
-
\??\c:\hbbtbt.exec:\hbbtbt.exe154⤵PID:896
-
\??\c:\9jvdp.exec:\9jvdp.exe155⤵PID:3056
-
\??\c:\1rlllrf.exec:\1rlllrf.exe156⤵PID:1184
-
\??\c:\bthhtb.exec:\bthhtb.exe157⤵PID:2900
-
\??\c:\vpddj.exec:\vpddj.exe158⤵PID:1608
-
\??\c:\dvppv.exec:\dvppv.exe159⤵PID:1736
-
\??\c:\fxxlxxr.exec:\fxxlxxr.exe160⤵PID:2976
-
\??\c:\bthhhb.exec:\bthhhb.exe161⤵PID:2676
-
\??\c:\9ttbhn.exec:\9ttbhn.exe162⤵PID:2252
-
\??\c:\pdppp.exec:\pdppp.exe163⤵PID:2696
-
\??\c:\dpdjp.exec:\dpdjp.exe164⤵PID:2620
-
\??\c:\lflffff.exec:\lflffff.exe165⤵PID:2584
-
\??\c:\hbnnbh.exec:\hbnnbh.exe166⤵PID:2524
-
\??\c:\bbntbb.exec:\bbntbb.exe167⤵PID:2716
-
\??\c:\dvppd.exec:\dvppd.exe168⤵PID:2772
-
\??\c:\fxxfrrl.exec:\fxxfrrl.exe169⤵PID:2020
-
\??\c:\fxrxrrl.exec:\fxrxrrl.exe170⤵PID:2968
-
\??\c:\bbtnhn.exec:\bbtnhn.exe171⤵PID:1904
-
\??\c:\djvpp.exec:\djvpp.exe172⤵PID:1276
-
\??\c:\9pjdj.exec:\9pjdj.exe173⤵PID:1548
-
\??\c:\rrlfllf.exec:\rrlfllf.exe174⤵PID:2508
-
\??\c:\nhtbnb.exec:\nhtbnb.exe175⤵PID:2788
-
\??\c:\tnhhtt.exec:\tnhhtt.exe176⤵PID:1392
-
\??\c:\1jvdd.exec:\1jvdd.exe177⤵PID:1988
-
\??\c:\1jppv.exec:\1jppv.exe178⤵PID:1892
-
\??\c:\7fxrrrx.exec:\7fxrrrx.exe179⤵PID:2128
-
\??\c:\xrfrflx.exec:\xrfrflx.exe180⤵PID:2952
-
\??\c:\hbtbnt.exec:\hbtbnt.exe181⤵PID:1684
-
\??\c:\dvjjp.exec:\dvjjp.exe182⤵PID:2076
-
\??\c:\9pjpv.exec:\9pjpv.exe183⤵PID:1216
-
\??\c:\5rflxrr.exec:\5rflxrr.exe184⤵PID:2244
-
\??\c:\bbbbnb.exec:\bbbbnb.exe185⤵PID:840
-
\??\c:\bbthbn.exec:\bbthbn.exe186⤵PID:1624
-
\??\c:\vppvd.exec:\vppvd.exe187⤵PID:836
-
\??\c:\vjdjp.exec:\vjdjp.exe188⤵PID:1228
-
\??\c:\5rfxxfl.exec:\5rfxxfl.exe189⤵PID:1060
-
\??\c:\ffxlxfl.exec:\ffxlxfl.exe190⤵PID:284
-
\??\c:\tnhbtn.exec:\tnhbtn.exe191⤵PID:2364
-
\??\c:\bhhhtb.exec:\bhhhtb.exe192⤵PID:2388
-
\??\c:\5pddp.exec:\5pddp.exe193⤵PID:768
-
\??\c:\1rflrxl.exec:\1rflrxl.exe194⤵PID:2172
-
\??\c:\frffrrf.exec:\frffrrf.exe195⤵PID:2168
-
\??\c:\httbnt.exec:\httbnt.exe196⤵PID:2008
-
\??\c:\btntbb.exec:\btntbb.exe197⤵PID:896
-
\??\c:\jdppv.exec:\jdppv.exe198⤵PID:2196
-
\??\c:\xxlrlrf.exec:\xxlrlrf.exe199⤵PID:2896
-
\??\c:\lfrrflr.exec:\lfrrflr.exe200⤵PID:2528
-
\??\c:\tttbhh.exec:\tttbhh.exe201⤵PID:2576
-
\??\c:\pjvjv.exec:\pjvjv.exe202⤵PID:2592
-
\??\c:\pvvpp.exec:\pvvpp.exe203⤵PID:2656
-
\??\c:\rxfxxxf.exec:\rxfxxxf.exe204⤵PID:2852
-
\??\c:\lfxfrxl.exec:\lfxfrxl.exe205⤵PID:2752
-
\??\c:\htbhtb.exec:\htbhtb.exe206⤵PID:2088
-
\??\c:\7jdpd.exec:\7jdpd.exe207⤵PID:2484
-
\??\c:\ppjjp.exec:\ppjjp.exe208⤵PID:2496
-
\??\c:\7rrrrfr.exec:\7rrrrfr.exe209⤵PID:2512
-
\??\c:\thtbhn.exec:\thtbhn.exe210⤵PID:2716
-
\??\c:\nbnntb.exec:\nbnntb.exe211⤵PID:2812
-
\??\c:\7djpd.exec:\7djpd.exe212⤵PID:1348
-
\??\c:\vdjjv.exec:\vdjjv.exe213⤵PID:2968
-
\??\c:\1fxxllr.exec:\1fxxllr.exe214⤵PID:2744
-
\??\c:\bhhnbn.exec:\bhhnbn.exe215⤵PID:1744
-
\??\c:\nbnttb.exec:\nbnttb.exe216⤵PID:2624
-
\??\c:\jvjvj.exec:\jvjvj.exe217⤵PID:2336
-
\??\c:\xrfllfl.exec:\xrfllfl.exe218⤵PID:2828
-
\??\c:\5ffllll.exec:\5ffllll.exe219⤵PID:1204
-
\??\c:\hbtbtb.exec:\hbtbtb.exe220⤵PID:848
-
\??\c:\3ntbht.exec:\3ntbht.exe221⤵PID:1868
-
\??\c:\pjvdj.exec:\pjvdj.exe222⤵PID:1876
-
\??\c:\xxlfllr.exec:\xxlfllr.exe223⤵PID:2248
-
\??\c:\rlllrxl.exec:\rlllrxl.exe224⤵PID:2064
-
\??\c:\nhntbb.exec:\nhntbb.exe225⤵PID:2076
-
\??\c:\nnhnbh.exec:\nnhnbh.exe226⤵PID:1440
-
\??\c:\jddpd.exec:\jddpd.exe227⤵PID:940
-
\??\c:\fxrfllf.exec:\fxrfllf.exe228⤵PID:2004
-
\??\c:\3xrrxfr.exec:\3xrrxfr.exe229⤵PID:1624
-
\??\c:\5tnnhn.exec:\5tnnhn.exe230⤵PID:1404
-
\??\c:\nttnnn.exec:\nttnnn.exe231⤵PID:2332
-
\??\c:\1fxfllr.exec:\1fxfllr.exe232⤵PID:2184
-
\??\c:\5xrrflx.exec:\5xrrflx.exe233⤵PID:1080
-
\??\c:\hbnhtn.exec:\hbnhtn.exe234⤵PID:1752
-
\??\c:\3vddj.exec:\3vddj.exe235⤵PID:2868
-
\??\c:\9jjpj.exec:\9jjpj.exe236⤵PID:1428
-
\??\c:\5rxrfxf.exec:\5rxrfxf.exe237⤵PID:1136
-
\??\c:\nbhhnn.exec:\nbhhnn.exe238⤵PID:1956
-
\??\c:\bthhhh.exec:\bthhhh.exe239⤵PID:2420
-
\??\c:\9jvpp.exec:\9jvpp.exe240⤵PID:1696
-
\??\c:\rlxxffl.exec:\rlxxffl.exe241⤵PID:2972
-
\??\c:\lfrrxfl.exec:\lfrrxfl.exe242⤵PID:2356