Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 03:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a334b6c11b40069df84f62bd0586d700_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
a334b6c11b40069df84f62bd0586d700_NeikiAnalytics.exe
-
Size
247KB
-
MD5
a334b6c11b40069df84f62bd0586d700
-
SHA1
65b328694de18521249d38d0c730637d575623a4
-
SHA256
6f5ebee944ceaa4f17651f22bc916c592f59f53eea3c46eac3a9331f3c2fadae
-
SHA512
e9cdb0382e6ac0181a7625829ffffef1ab9fa21f146430816daf1d466bcd0c0139c8c09e889aa4dbe0b33788d3109f268cac4e661e844e38b1f3f60cba9038f9
-
SSDEEP
6144:n3C9BRo/AIX27NHWpU00VIxas1oa3YiFRV68:n3C9uD6AUDCa4NYmR/
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/2196-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1556-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1888-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/760-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2452-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1264-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/696-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/836-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/344-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ttnbbt.exeddppj.exe5htnth.exeffxxfrf.exentbttn.exerlfrxrf.exe9llllrl.exehbnnbb.exe9lfxrff.exe7jddp.exexxrfxxl.exebbnthn.exedjpjd.exe9hbbnh.exe3nthth.exefxrxlrl.exehhnbtt.exeppddj.exefxllfxl.exe5tbhtb.exejdvjv.exetnnbtb.exe1vdpv.exentthhh.exevdjjd.exebhnbbt.exejvvjv.exelfxxllx.exennnbnt.exevjjvp.exelfrxlrr.exedppjv.exexxlxlxf.exehhthhn.exebtnhth.exevvvdp.exellfrlxl.exehnthbn.exe3httnn.exejpvpp.exevpvdd.exelrfrrfl.exehhhnbn.exepvpjv.exe1fflrlx.exexffxrxx.exenbttnn.exeppppp.exepjdpv.exellrxrxf.exebtntbh.exe1pjjp.exejjvpp.exefllrfrl.exennnhtb.exe7hbthh.exejdppv.exelxxrffx.exeflfrflf.exenthntn.exepjdvj.exelrlrxfl.exeffxflrx.exetnnnhn.exepid process 2348 ttnbbt.exe 2624 ddppj.exe 2632 5htnth.exe 1260 ffxxfrf.exe 2664 ntbttn.exe 2772 rlfrxrf.exe 2540 9llllrl.exe 2988 hbnnbb.exe 2576 9lfxrff.exe 2784 7jddp.exe 1556 xxrfxxl.exe 1888 bbnthn.exe 760 djpjd.exe 1664 9hbbnh.exe 2452 3nthth.exe 1060 fxrxlrl.exe 1264 hhnbtt.exe 1028 ppddj.exe 2276 fxllfxl.exe 1840 5tbhtb.exe 696 jdvjv.exe 288 tnnbtb.exe 836 1vdpv.exe 3032 ntthhh.exe 1684 vdjjd.exe 2228 bhnbbt.exe 344 jvvjv.exe 2416 lfxxllx.exe 2024 nnnbnt.exe 1784 vjjvp.exe 2460 lfrxlrr.exe 1728 dppjv.exe 2092 xxlxlxf.exe 2736 hhthhn.exe 1668 btnhth.exe 2796 vvvdp.exe 2724 llfrlxl.exe 2868 hnthbn.exe 2512 3httnn.exe 2644 jpvpp.exe 2480 vpvdd.exe 2524 lrfrrfl.exe 2952 hhhnbn.exe 1184 pvpjv.exe 2692 1fflrlx.exe 2652 xffxrxx.exe 1584 nbttnn.exe 2964 ppppp.exe 1644 pjdpv.exe 2160 llrxrxf.exe 760 btntbh.exe 1540 1pjjp.exe 2392 jjvpp.exe 2976 fllrfrl.exe 1352 nnnhtb.exe 1264 7hbthh.exe 2272 jdppv.exe 2256 lxxrffx.exe 348 flfrflf.exe 440 nthntn.exe 2104 pjdvj.exe 692 lrlrxfl.exe 1196 ffxflrx.exe 1208 tnnnhn.exe -
Processes:
resource yara_rule behavioral1/memory/2196-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1888-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/760-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1264-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/696-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/836-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/344-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-295-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a334b6c11b40069df84f62bd0586d700_NeikiAnalytics.exettnbbt.exeddppj.exe5htnth.exeffxxfrf.exentbttn.exerlfrxrf.exe9llllrl.exehbnnbb.exe9lfxrff.exe7jddp.exexxrfxxl.exebbnthn.exedjpjd.exe9hbbnh.exe3nthth.exedescription pid process target process PID 2196 wrote to memory of 2348 2196 a334b6c11b40069df84f62bd0586d700_NeikiAnalytics.exe ttnbbt.exe PID 2196 wrote to memory of 2348 2196 a334b6c11b40069df84f62bd0586d700_NeikiAnalytics.exe ttnbbt.exe PID 2196 wrote to memory of 2348 2196 a334b6c11b40069df84f62bd0586d700_NeikiAnalytics.exe ttnbbt.exe PID 2196 wrote to memory of 2348 2196 a334b6c11b40069df84f62bd0586d700_NeikiAnalytics.exe ttnbbt.exe PID 2348 wrote to memory of 2624 2348 ttnbbt.exe ddppj.exe PID 2348 wrote to memory of 2624 2348 ttnbbt.exe ddppj.exe PID 2348 wrote to memory of 2624 2348 ttnbbt.exe ddppj.exe PID 2348 wrote to memory of 2624 2348 ttnbbt.exe ddppj.exe PID 2624 wrote to memory of 2632 2624 ddppj.exe 5htnth.exe PID 2624 wrote to memory of 2632 2624 ddppj.exe 5htnth.exe PID 2624 wrote to memory of 2632 2624 ddppj.exe 5htnth.exe PID 2624 wrote to memory of 2632 2624 ddppj.exe 5htnth.exe PID 2632 wrote to memory of 1260 2632 5htnth.exe ffxxfrf.exe PID 2632 wrote to memory of 1260 2632 5htnth.exe ffxxfrf.exe PID 2632 wrote to memory of 1260 2632 5htnth.exe ffxxfrf.exe PID 2632 wrote to memory of 1260 2632 5htnth.exe ffxxfrf.exe PID 1260 wrote to memory of 2664 1260 ffxxfrf.exe ntbttn.exe PID 1260 wrote to memory of 2664 1260 ffxxfrf.exe ntbttn.exe PID 1260 wrote to memory of 2664 1260 ffxxfrf.exe ntbttn.exe PID 1260 wrote to memory of 2664 1260 ffxxfrf.exe ntbttn.exe PID 2664 wrote to memory of 2772 2664 ntbttn.exe rlfrxrf.exe PID 2664 wrote to memory of 2772 2664 ntbttn.exe rlfrxrf.exe PID 2664 wrote to memory of 2772 2664 ntbttn.exe rlfrxrf.exe PID 2664 wrote to memory of 2772 2664 ntbttn.exe rlfrxrf.exe PID 2772 wrote to memory of 2540 2772 rlfrxrf.exe 9llllrl.exe PID 2772 wrote to memory of 2540 2772 rlfrxrf.exe 9llllrl.exe PID 2772 wrote to memory of 2540 2772 rlfrxrf.exe 9llllrl.exe PID 2772 wrote to memory of 2540 2772 rlfrxrf.exe 9llllrl.exe PID 2540 wrote to memory of 2988 2540 9llllrl.exe hbnnbb.exe PID 2540 wrote to memory of 2988 2540 9llllrl.exe hbnnbb.exe PID 2540 wrote to memory of 2988 2540 9llllrl.exe hbnnbb.exe PID 2540 wrote to memory of 2988 2540 9llllrl.exe hbnnbb.exe PID 2988 wrote to memory of 2576 2988 hbnnbb.exe 9lfxrff.exe PID 2988 wrote to memory of 2576 2988 hbnnbb.exe 9lfxrff.exe PID 2988 wrote to memory of 2576 2988 hbnnbb.exe 9lfxrff.exe PID 2988 wrote to memory of 2576 2988 hbnnbb.exe 9lfxrff.exe PID 2576 wrote to memory of 2784 2576 9lfxrff.exe 7jddp.exe PID 2576 wrote to memory of 2784 2576 9lfxrff.exe 7jddp.exe PID 2576 wrote to memory of 2784 2576 9lfxrff.exe 7jddp.exe PID 2576 wrote to memory of 2784 2576 9lfxrff.exe 7jddp.exe PID 2784 wrote to memory of 1556 2784 7jddp.exe xxrfxxl.exe PID 2784 wrote to memory of 1556 2784 7jddp.exe xxrfxxl.exe PID 2784 wrote to memory of 1556 2784 7jddp.exe xxrfxxl.exe PID 2784 wrote to memory of 1556 2784 7jddp.exe xxrfxxl.exe PID 1556 wrote to memory of 1888 1556 xxrfxxl.exe bbnthn.exe PID 1556 wrote to memory of 1888 1556 xxrfxxl.exe bbnthn.exe PID 1556 wrote to memory of 1888 1556 xxrfxxl.exe bbnthn.exe PID 1556 wrote to memory of 1888 1556 xxrfxxl.exe bbnthn.exe PID 1888 wrote to memory of 760 1888 bbnthn.exe djpjd.exe PID 1888 wrote to memory of 760 1888 bbnthn.exe djpjd.exe PID 1888 wrote to memory of 760 1888 bbnthn.exe djpjd.exe PID 1888 wrote to memory of 760 1888 bbnthn.exe djpjd.exe PID 760 wrote to memory of 1664 760 djpjd.exe 9hbbnh.exe PID 760 wrote to memory of 1664 760 djpjd.exe 9hbbnh.exe PID 760 wrote to memory of 1664 760 djpjd.exe 9hbbnh.exe PID 760 wrote to memory of 1664 760 djpjd.exe 9hbbnh.exe PID 1664 wrote to memory of 2452 1664 9hbbnh.exe 3nthth.exe PID 1664 wrote to memory of 2452 1664 9hbbnh.exe 3nthth.exe PID 1664 wrote to memory of 2452 1664 9hbbnh.exe 3nthth.exe PID 1664 wrote to memory of 2452 1664 9hbbnh.exe 3nthth.exe PID 2452 wrote to memory of 1060 2452 3nthth.exe fxrxlrl.exe PID 2452 wrote to memory of 1060 2452 3nthth.exe fxrxlrl.exe PID 2452 wrote to memory of 1060 2452 3nthth.exe fxrxlrl.exe PID 2452 wrote to memory of 1060 2452 3nthth.exe fxrxlrl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a334b6c11b40069df84f62bd0586d700_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a334b6c11b40069df84f62bd0586d700_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\ttnbbt.exec:\ttnbbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\ddppj.exec:\ddppj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\5htnth.exec:\5htnth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\ffxxfrf.exec:\ffxxfrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\ntbttn.exec:\ntbttn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\rlfrxrf.exec:\rlfrxrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\9llllrl.exec:\9llllrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\hbnnbb.exec:\hbnnbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\9lfxrff.exec:\9lfxrff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\7jddp.exec:\7jddp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\xxrfxxl.exec:\xxrfxxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\bbnthn.exec:\bbnthn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\djpjd.exec:\djpjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\9hbbnh.exec:\9hbbnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\3nthth.exec:\3nthth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\fxrxlrl.exec:\fxrxlrl.exe17⤵
- Executes dropped EXE
PID:1060 -
\??\c:\hhnbtt.exec:\hhnbtt.exe18⤵
- Executes dropped EXE
PID:1264 -
\??\c:\ppddj.exec:\ppddj.exe19⤵
- Executes dropped EXE
PID:1028 -
\??\c:\fxllfxl.exec:\fxllfxl.exe20⤵
- Executes dropped EXE
PID:2276 -
\??\c:\5tbhtb.exec:\5tbhtb.exe21⤵
- Executes dropped EXE
PID:1840 -
\??\c:\jdvjv.exec:\jdvjv.exe22⤵
- Executes dropped EXE
PID:696 -
\??\c:\tnnbtb.exec:\tnnbtb.exe23⤵
- Executes dropped EXE
PID:288 -
\??\c:\1vdpv.exec:\1vdpv.exe24⤵
- Executes dropped EXE
PID:836 -
\??\c:\ntthhh.exec:\ntthhh.exe25⤵
- Executes dropped EXE
PID:3032 -
\??\c:\vdjjd.exec:\vdjjd.exe26⤵
- Executes dropped EXE
PID:1684 -
\??\c:\bhnbbt.exec:\bhnbbt.exe27⤵
- Executes dropped EXE
PID:2228 -
\??\c:\jvvjv.exec:\jvvjv.exe28⤵
- Executes dropped EXE
PID:344 -
\??\c:\lfxxllx.exec:\lfxxllx.exe29⤵
- Executes dropped EXE
PID:2416 -
\??\c:\nnnbnt.exec:\nnnbnt.exe30⤵
- Executes dropped EXE
PID:2024 -
\??\c:\vjjvp.exec:\vjjvp.exe31⤵
- Executes dropped EXE
PID:1784 -
\??\c:\lfrxlrr.exec:\lfrxlrr.exe32⤵
- Executes dropped EXE
PID:2460 -
\??\c:\dppjv.exec:\dppjv.exe33⤵
- Executes dropped EXE
PID:1728 -
\??\c:\xxlxlxf.exec:\xxlxlxf.exe34⤵
- Executes dropped EXE
PID:2092 -
\??\c:\hhthhn.exec:\hhthhn.exe35⤵
- Executes dropped EXE
PID:2736 -
\??\c:\btnhth.exec:\btnhth.exe36⤵
- Executes dropped EXE
PID:1668 -
\??\c:\vvvdp.exec:\vvvdp.exe37⤵
- Executes dropped EXE
PID:2796 -
\??\c:\llfrlxl.exec:\llfrlxl.exe38⤵
- Executes dropped EXE
PID:2724 -
\??\c:\hnthbn.exec:\hnthbn.exe39⤵
- Executes dropped EXE
PID:2868 -
\??\c:\3httnn.exec:\3httnn.exe40⤵
- Executes dropped EXE
PID:2512 -
\??\c:\jpvpp.exec:\jpvpp.exe41⤵
- Executes dropped EXE
PID:2644 -
\??\c:\vpvdd.exec:\vpvdd.exe42⤵
- Executes dropped EXE
PID:2480 -
\??\c:\lrfrrfl.exec:\lrfrrfl.exe43⤵
- Executes dropped EXE
PID:2524 -
\??\c:\hhhnbn.exec:\hhhnbn.exe44⤵
- Executes dropped EXE
PID:2952 -
\??\c:\pvpjv.exec:\pvpjv.exe45⤵
- Executes dropped EXE
PID:1184 -
\??\c:\1fflrlx.exec:\1fflrlx.exe46⤵
- Executes dropped EXE
PID:2692 -
\??\c:\xffxrxx.exec:\xffxrxx.exe47⤵
- Executes dropped EXE
PID:2652 -
\??\c:\nbttnn.exec:\nbttnn.exe48⤵
- Executes dropped EXE
PID:1584 -
\??\c:\ppppp.exec:\ppppp.exe49⤵
- Executes dropped EXE
PID:2964 -
\??\c:\pjdpv.exec:\pjdpv.exe50⤵
- Executes dropped EXE
PID:1644 -
\??\c:\llrxrxf.exec:\llrxrxf.exe51⤵
- Executes dropped EXE
PID:2160 -
\??\c:\btntbh.exec:\btntbh.exe52⤵
- Executes dropped EXE
PID:760 -
\??\c:\1pjjp.exec:\1pjjp.exe53⤵
- Executes dropped EXE
PID:1540 -
\??\c:\jjvpp.exec:\jjvpp.exe54⤵
- Executes dropped EXE
PID:2392 -
\??\c:\fllrfrl.exec:\fllrfrl.exe55⤵
- Executes dropped EXE
PID:2976 -
\??\c:\nnnhtb.exec:\nnnhtb.exe56⤵
- Executes dropped EXE
PID:1352 -
\??\c:\7hbthh.exec:\7hbthh.exe57⤵
- Executes dropped EXE
PID:1264 -
\??\c:\jdppv.exec:\jdppv.exe58⤵
- Executes dropped EXE
PID:2272 -
\??\c:\lxxrffx.exec:\lxxrffx.exe59⤵
- Executes dropped EXE
PID:2256 -
\??\c:\flfrflf.exec:\flfrflf.exe60⤵
- Executes dropped EXE
PID:348 -
\??\c:\nthntn.exec:\nthntn.exe61⤵
- Executes dropped EXE
PID:440 -
\??\c:\pjdvj.exec:\pjdvj.exe62⤵
- Executes dropped EXE
PID:2104 -
\??\c:\lrlrxfl.exec:\lrlrxfl.exe63⤵
- Executes dropped EXE
PID:692 -
\??\c:\ffxflrx.exec:\ffxflrx.exe64⤵
- Executes dropped EXE
PID:1196 -
\??\c:\tnnnhn.exec:\tnnnhn.exe65⤵
- Executes dropped EXE
PID:1208 -
\??\c:\vvpdd.exec:\vvpdd.exe66⤵PID:1004
-
\??\c:\9pjpd.exec:\9pjpd.exe67⤵PID:340
-
\??\c:\xxlrlrx.exec:\xxlrlrx.exe68⤵PID:576
-
\??\c:\bhttth.exec:\bhttth.exe69⤵PID:2224
-
\??\c:\nhhnnt.exec:\nhhnnt.exe70⤵PID:2116
-
\??\c:\vdvjd.exec:\vdvjd.exe71⤵PID:1940
-
\??\c:\9lflllf.exec:\9lflllf.exe72⤵PID:2232
-
\??\c:\9lrxrll.exec:\9lrxrll.exe73⤵PID:2384
-
\??\c:\nntbtb.exec:\nntbtb.exe74⤵PID:1844
-
\??\c:\dvpvd.exec:\dvpvd.exe75⤵PID:3040
-
\??\c:\dpdvv.exec:\dpdvv.exe76⤵PID:2584
-
\??\c:\fllfxxr.exec:\fllfxxr.exe77⤵PID:2752
-
\??\c:\hnhnbb.exec:\hnhnbb.exe78⤵PID:1516
-
\??\c:\ppvdv.exec:\ppvdv.exe79⤵PID:2740
-
\??\c:\rlllxfr.exec:\rlllxfr.exe80⤵PID:2872
-
\??\c:\lrxxflx.exec:\lrxxflx.exe81⤵PID:2484
-
\??\c:\hhhtbt.exec:\hhhtbt.exe82⤵PID:2372
-
\??\c:\ddpdd.exec:\ddpdd.exe83⤵PID:2500
-
\??\c:\vdvdv.exec:\vdvdv.exe84⤵PID:2772
-
\??\c:\7frrxxx.exec:\7frrxxx.exe85⤵PID:2596
-
\??\c:\tthhtb.exec:\tthhtb.exe86⤵PID:2156
-
\??\c:\jddpv.exec:\jddpv.exe87⤵PID:2676
-
\??\c:\ppjdp.exec:\ppjdp.exe88⤵PID:2776
-
\??\c:\9fxlxfr.exec:\9fxlxfr.exe89⤵PID:2784
-
\??\c:\ttbnhn.exec:\ttbnhn.exe90⤵PID:824
-
\??\c:\ppvvj.exec:\ppvvj.exe91⤵PID:1552
-
\??\c:\jpjpj.exec:\jpjpj.exe92⤵PID:1888
-
\??\c:\5xlrfrx.exec:\5xlrfrx.exe93⤵PID:316
-
\??\c:\xxrrxfr.exec:\xxrrxfr.exe94⤵PID:1612
-
\??\c:\3btbnn.exec:\3btbnn.exe95⤵PID:2216
-
\??\c:\pvvpd.exec:\pvvpd.exe96⤵PID:1432
-
\??\c:\vdddj.exec:\vdddj.exe97⤵PID:2360
-
\??\c:\xrrxfrx.exec:\xrrxfrx.exe98⤵PID:2660
-
\??\c:\hhnbnb.exec:\hhnbnb.exe99⤵PID:2000
-
\??\c:\hbtntt.exec:\hbtntt.exe100⤵PID:2680
-
\??\c:\dpddp.exec:\dpddp.exe101⤵PID:1652
-
\??\c:\lllrfxl.exec:\lllrfxl.exe102⤵PID:772
-
\??\c:\tbbthb.exec:\tbbthb.exe103⤵PID:1408
-
\??\c:\7hhntb.exec:\7hhntb.exe104⤵PID:640
-
\??\c:\ppdvj.exec:\ppdvj.exe105⤵PID:3064
-
\??\c:\frrllff.exec:\frrllff.exe106⤵PID:980
-
\??\c:\tbtthh.exec:\tbtthh.exe107⤵PID:1956
-
\??\c:\pjjdp.exec:\pjjdp.exe108⤵PID:1460
-
\??\c:\3vpjd.exec:\3vpjd.exe109⤵PID:2072
-
\??\c:\xxxfrfr.exec:\xxxfrfr.exe110⤵PID:2340
-
\??\c:\tbnbnn.exec:\tbnbnn.exe111⤵PID:2376
-
\??\c:\bbtntt.exec:\bbtntt.exe112⤵PID:1472
-
\??\c:\9jvpv.exec:\9jvpv.exe113⤵PID:1820
-
\??\c:\fxfrlfx.exec:\fxfrlfx.exe114⤵PID:2268
-
\??\c:\3bhhhb.exec:\3bhhhb.exe115⤵PID:1568
-
\??\c:\pvpvd.exec:\pvpvd.exe116⤵PID:2196
-
\??\c:\ppjdv.exec:\ppjdv.exe117⤵PID:2032
-
\??\c:\xrlxlrf.exec:\xrlxlrf.exe118⤵PID:2620
-
\??\c:\rlrrxxl.exec:\rlrrxxl.exe119⤵PID:1508
-
\??\c:\bbthbh.exec:\bbthbh.exe120⤵PID:2876
-
\??\c:\pjvpj.exec:\pjvpj.exe121⤵PID:2812
-
\??\c:\frrxxff.exec:\frrxxff.exe122⤵PID:2720
-
\??\c:\ththtt.exec:\ththtt.exe123⤵PID:2504
-
\??\c:\5ntbht.exec:\5ntbht.exe124⤵PID:2588
-
\??\c:\5pjpd.exec:\5pjpd.exe125⤵PID:2552
-
\??\c:\9xrxrrl.exec:\9xrxrrl.exe126⤵PID:2528
-
\??\c:\hnntnt.exec:\hnntnt.exe127⤵PID:1592
-
\??\c:\pdjjj.exec:\pdjjj.exe128⤵PID:2992
-
\??\c:\3rfrrrr.exec:\3rfrrrr.exe129⤵PID:2732
-
\??\c:\rlxfrxr.exec:\rlxfrxr.exe130⤵PID:2940
-
\??\c:\nhthtb.exec:\nhthtb.exe131⤵PID:1504
-
\??\c:\nbbtbh.exec:\nbbtbh.exe132⤵PID:1904
-
\??\c:\ppjpp.exec:\ppjpp.exe133⤵PID:1908
-
\??\c:\1rllrxl.exec:\1rllrxl.exe134⤵PID:792
-
\??\c:\llrfffl.exec:\llrfffl.exe135⤵PID:1712
-
\??\c:\3ttntn.exec:\3ttntn.exe136⤵PID:1532
-
\??\c:\vpppd.exec:\vpppd.exe137⤵PID:1440
-
\??\c:\rlxfrxl.exec:\rlxfrxl.exe138⤵PID:2984
-
\??\c:\5rrxrxf.exec:\5rrxrxf.exe139⤵PID:2088
-
\??\c:\5hnhnn.exec:\5hnhnn.exe140⤵PID:1056
-
\??\c:\7ppvj.exec:\7ppvj.exe141⤵PID:2824
-
\??\c:\9lfxrrf.exec:\9lfxrrf.exe142⤵PID:2284
-
\??\c:\lxlxlrr.exec:\lxlxlrr.exe143⤵PID:1840
-
\??\c:\9httbn.exec:\9httbn.exe144⤵PID:264
-
\??\c:\pjjjp.exec:\pjjjp.exe145⤵PID:1780
-
\??\c:\xxlxfrx.exec:\xxlxfrx.exe146⤵PID:1176
-
\??\c:\fllrrrx.exec:\fllrrrx.exe147⤵PID:836
-
\??\c:\hhtbnn.exec:\hhtbnn.exe148⤵PID:1656
-
\??\c:\hnnhnh.exec:\hnnhnh.exe149⤵PID:1016
-
\??\c:\jvjjv.exec:\jvjjv.exe150⤵PID:880
-
\??\c:\frxxfrf.exec:\frxxfrf.exe151⤵PID:2188
-
\??\c:\nbbtbn.exec:\nbbtbn.exe152⤵PID:2184
-
\??\c:\nnhthn.exec:\nnhthn.exe153⤵PID:2144
-
\??\c:\dvppd.exec:\dvppd.exe154⤵PID:2908
-
\??\c:\ffxllxf.exec:\ffxllxf.exe155⤵PID:1636
-
\??\c:\rxfflxl.exec:\rxfflxl.exe156⤵PID:324
-
\??\c:\ntbnnn.exec:\ntbnnn.exe157⤵PID:1876
-
\??\c:\dvddd.exec:\dvddd.exe158⤵PID:2084
-
\??\c:\xlxrrxf.exec:\xlxrrxf.exe159⤵PID:2744
-
\??\c:\bnnhhh.exec:\bnnhhh.exe160⤵PID:1348
-
\??\c:\nnntbb.exec:\nnntbb.exe161⤵PID:2752
-
\??\c:\dddvp.exec:\dddvp.exe162⤵PID:2796
-
\??\c:\rrlxflx.exec:\rrlxflx.exe163⤵PID:2724
-
\??\c:\rlxfrxl.exec:\rlxfrxl.exe164⤵PID:1260
-
\??\c:\5btbth.exec:\5btbth.exe165⤵PID:2484
-
\??\c:\pvdvv.exec:\pvdvv.exe166⤵PID:2664
-
\??\c:\rrlfrrx.exec:\rrlfrrx.exe167⤵PID:2500
-
\??\c:\flrfflr.exec:\flrfflr.exe168⤵PID:2524
-
\??\c:\9hhnbh.exec:\9hhnbh.exe169⤵PID:2596
-
\??\c:\nbntbh.exec:\nbntbh.exe170⤵PID:1184
-
\??\c:\jdpvj.exec:\jdpvj.exe171⤵PID:2692
-
\??\c:\1lrfflf.exec:\1lrfflf.exe172⤵PID:2652
-
\??\c:\llflxfr.exec:\llflxfr.exe173⤵PID:2784
-
\??\c:\bthbbh.exec:\bthbbh.exe174⤵PID:1708
-
\??\c:\jvpjd.exec:\jvpjd.exe175⤵PID:2368
-
\??\c:\vpjjd.exec:\vpjjd.exe176⤵PID:1968
-
\??\c:\rrrrffl.exec:\rrrrffl.exe177⤵PID:1596
-
\??\c:\7nbtbn.exec:\7nbtbn.exe178⤵PID:296
-
\??\c:\tnhtnt.exec:\tnhtnt.exe179⤵PID:616
-
\??\c:\7dpvp.exec:\7dpvp.exe180⤵PID:860
-
\??\c:\5rrrlrf.exec:\5rrrlrf.exe181⤵PID:2976
-
\??\c:\rxrfxff.exec:\rxrfxff.exe182⤵PID:1860
-
\??\c:\nhthnb.exec:\nhthnb.exe183⤵PID:2056
-
\??\c:\dddjj.exec:\dddjj.exe184⤵PID:2276
-
\??\c:\lrrflrf.exec:\lrrflrf.exe185⤵PID:1864
-
\??\c:\5fflxxr.exec:\5fflxxr.exe186⤵PID:348
-
\??\c:\bhhnnb.exec:\bhhnnb.exe187⤵PID:1392
-
\??\c:\jpdjd.exec:\jpdjd.exe188⤵PID:924
-
\??\c:\jjdjd.exec:\jjdjd.exe189⤵PID:668
-
\??\c:\lrlllrx.exec:\lrlllrx.exe190⤵PID:1196
-
\??\c:\hhbthn.exec:\hhbthn.exe191⤵PID:980
-
\??\c:\7vvjv.exec:\7vvjv.exe192⤵PID:948
-
\??\c:\xxxrflf.exec:\xxxrflf.exe193⤵PID:840
-
\??\c:\ffrrxrr.exec:\ffrrxrr.exe194⤵PID:2228
-
\??\c:\hhnbnn.exec:\hhnbnn.exe195⤵PID:2224
-
\??\c:\vdppd.exec:\vdppd.exe196⤵PID:2556
-
\??\c:\rrlxlrf.exec:\rrlxlrf.exe197⤵PID:2112
-
\??\c:\flrlfxx.exec:\flrlfxx.exe198⤵PID:2436
-
\??\c:\nbhbbb.exec:\nbhbbb.exe199⤵PID:2384
-
\??\c:\dpdjd.exec:\dpdjd.exe200⤵PID:1964
-
\??\c:\fxrfllx.exec:\fxrfllx.exe201⤵PID:2236
-
\??\c:\ttbnbn.exec:\ttbnbn.exe202⤵PID:2800
-
\??\c:\1hnhtb.exec:\1hnhtb.exe203⤵PID:1620
-
\??\c:\jpppd.exec:\jpppd.exe204⤵PID:2752
-
\??\c:\flflxxl.exec:\flflxxl.exe205⤵PID:2604
-
\??\c:\thtnbh.exec:\thtnbh.exe206⤵PID:2724
-
\??\c:\pdppv.exec:\pdppv.exe207⤵PID:2504
-
\??\c:\pjjvv.exec:\pjjvv.exe208⤵PID:2484
-
\??\c:\xrrxflr.exec:\xrrxflr.exe209⤵PID:2644
-
\??\c:\hhbtbh.exec:\hhbtbh.exe210⤵PID:2500
-
\??\c:\1nhnhn.exec:\1nhnhn.exe211⤵PID:328
-
\??\c:\vvjpv.exec:\vvjpv.exe212⤵PID:2292
-
\??\c:\lrrfrff.exec:\lrrfrff.exe213⤵PID:2780
-
\??\c:\5bhhbh.exec:\5bhhbh.exe214⤵PID:2692
-
\??\c:\jjdjv.exec:\jjdjv.exe215⤵PID:1536
-
\??\c:\1pdjv.exec:\1pdjv.exe216⤵PID:1716
-
\??\c:\llxrfrf.exec:\llxrfrf.exe217⤵PID:268
-
\??\c:\hhtbnn.exec:\hhtbnn.exe218⤵PID:1900
-
\??\c:\ttnbnn.exec:\ttnbnn.exe219⤵PID:1464
-
\??\c:\jpddd.exec:\jpddd.exe220⤵PID:2536
-
\??\c:\9rxlfrx.exec:\9rxlfrx.exe221⤵PID:760
-
\??\c:\ffrrffr.exec:\ffrrffr.exe222⤵PID:1060
-
\??\c:\3thnnh.exec:\3thnnh.exe223⤵PID:2204
-
\??\c:\pvpdp.exec:\pvpdp.exe224⤵PID:2012
-
\??\c:\fxlfrxr.exec:\fxlfrxr.exe225⤵PID:2248
-
\??\c:\bnhbnh.exec:\bnhbnh.exe226⤵PID:2056
-
\??\c:\nhbhtn.exec:\nhbhtn.exe227⤵PID:2272
-
\??\c:\jpppp.exec:\jpppp.exe228⤵PID:2256
-
\??\c:\lxllrxx.exec:\lxllrxx.exe229⤵PID:580
-
\??\c:\nbtnnn.exec:\nbtnnn.exe230⤵PID:2672
-
\??\c:\vpjpv.exec:\vpjpv.exe231⤵PID:3064
-
\??\c:\pjjjj.exec:\pjjjj.exe232⤵PID:1456
-
\??\c:\7xrllfx.exec:\7xrllfx.exe233⤵PID:1212
-
\??\c:\tbntth.exec:\tbntth.exe234⤵PID:988
-
\??\c:\bbhhhn.exec:\bbhhhn.exe235⤵PID:1628
-
\??\c:\pvppd.exec:\pvppd.exe236⤵PID:944
-
\??\c:\ffflxrf.exec:\ffflxrf.exe237⤵PID:780
-
\??\c:\nhtnnn.exec:\nhtnnn.exe238⤵PID:1880
-
\??\c:\ddvdv.exec:\ddvdv.exe239⤵PID:2100
-
\??\c:\vvdjv.exec:\vvdjv.exe240⤵PID:2004
-
\??\c:\3xllrxx.exec:\3xllrxx.exe241⤵PID:876
-
\??\c:\hhhnbt.exec:\hhhnbt.exe242⤵PID:2460