Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 17:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1f90e1ef7c3edcb1d265cff7bad29450_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
1f90e1ef7c3edcb1d265cff7bad29450_NeikiAnalytics.exe
-
Size
361KB
-
MD5
1f90e1ef7c3edcb1d265cff7bad29450
-
SHA1
88c1a1b14fe6afd34dac05349844b42beb0f58b1
-
SHA256
f4d64914326bc7951b179c515497186a6f9136e21eb4597918dcabe896b7db5d
-
SHA512
07cd2636d3a7107d9e6eb3c19bb3b0be76b1cea4f3557855548aeedfb1e44fb08c2259d830d3d6c9291106cec3b92d44a346be73d555d23ee5df0d9ceae49319
-
SSDEEP
6144:n3C9BRIG0asYFm71m8+GdkB9yMu7N+8px7O/:n3C9uYA71kSMu08px7g
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/2268-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2268-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1884-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2272-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2272-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2868-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1632-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1960-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/772-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1748-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1108-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/804-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2384-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1764-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1204-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2260-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
thttnh.exe3hhbtt.exefxlrffl.exethtbbt.exevjvjp.exexrxfffl.exenbhbhb.exejvddv.exefrrfllr.exehbnbnh.exedvjjj.exefxrxflr.exe7pdvd.exe7lrlfff.exebtbttn.exehnttbt.exefrffrxl.exenbnntb.exejjpdd.exexxrxrxl.exe3hbhnb.exe7jvjp.exelfrxlrl.exethbbbb.exe5vdjj.exelxrrrrr.exehbhbbt.exedvppv.exelfrrffl.exevjdjv.exevjvvv.exe7thttt.exevjdjp.exeffxfxrl.exexllrxrf.exe3thhbb.exedpdvv.exe9jvpp.exe7xllflr.exe3bbbbh.exehbnttt.exevjppj.exe3rfflfr.exelffxxrf.exenhbtbb.exebhhtnn.exepdppv.exefxlllrr.exelrxllll.exe3bbtbb.exevpvpv.exedvjjj.exe5xffrrr.exerfrrffl.exebtbbnn.exe7pppd.exe7vdpj.exelxllllf.exerflllxx.exehntnnb.exehbnntn.exevpdpp.exe7xlffff.exe9fxxxxf.exepid process 1884 thttnh.exe 2272 3hhbtt.exe 2620 fxlrffl.exe 2540 thtbbt.exe 2644 vjvjp.exe 2652 xrxfffl.exe 2428 nbhbhb.exe 2868 jvddv.exe 2840 frrfllr.exe 2300 hbnbnh.exe 1632 dvjjj.exe 1960 fxrxflr.exe 2324 7pdvd.exe 2308 7lrlfff.exe 772 btbttn.exe 1756 hnttbt.exe 1748 frffrxl.exe 860 nbnntb.exe 2928 jjpdd.exe 2516 xxrxrxl.exe 2748 3hbhnb.exe 672 7jvjp.exe 1108 lfrxlrl.exe 804 thbbbb.exe 2384 5vdjj.exe 880 lxrrrrr.exe 1624 hbhbbt.exe 1764 dvppv.exe 540 lfrrffl.exe 1204 vjdjv.exe 2260 vjvvv.exe 1620 7thttt.exe 2284 vjdjp.exe 2892 ffxfxrl.exe 2972 xllrxrf.exe 2564 3thhbb.exe 2568 dpdvv.exe 2648 9jvpp.exe 2452 7xllflr.exe 2468 3bbbbh.exe 2480 hbnttt.exe 2488 vjppj.exe 2868 3rfflfr.exe 2840 lffxxrf.exe 1636 nhbtbb.exe 1436 bhhtnn.exe 348 pdppv.exe 1960 fxlllrr.exe 2324 lrxllll.exe 376 3bbtbb.exe 1828 vpvpv.exe 320 dvjjj.exe 1452 5xffrrr.exe 2864 rfrrffl.exe 3064 btbbnn.exe 2756 7pppd.exe 2760 7vdpj.exe 2516 lxllllf.exe 2748 rflllxx.exe 1172 hntnnb.exe 2932 hbnntn.exe 1496 vpdpp.exe 908 7xlffff.exe 1524 9fxxxxf.exe -
Processes:
resource yara_rule behavioral1/memory/2268-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2268-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1884-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1632-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1960-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/772-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1748-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1108-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/804-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1764-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1204-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2260-297-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1f90e1ef7c3edcb1d265cff7bad29450_NeikiAnalytics.exethttnh.exe3hhbtt.exefxlrffl.exethtbbt.exevjvjp.exexrxfffl.exenbhbhb.exejvddv.exefrrfllr.exehbnbnh.exedvjjj.exefxrxflr.exe7pdvd.exe7lrlfff.exebtbttn.exedescription pid process target process PID 2268 wrote to memory of 1884 2268 1f90e1ef7c3edcb1d265cff7bad29450_NeikiAnalytics.exe thttnh.exe PID 2268 wrote to memory of 1884 2268 1f90e1ef7c3edcb1d265cff7bad29450_NeikiAnalytics.exe thttnh.exe PID 2268 wrote to memory of 1884 2268 1f90e1ef7c3edcb1d265cff7bad29450_NeikiAnalytics.exe thttnh.exe PID 2268 wrote to memory of 1884 2268 1f90e1ef7c3edcb1d265cff7bad29450_NeikiAnalytics.exe thttnh.exe PID 1884 wrote to memory of 2272 1884 thttnh.exe 3hhbtt.exe PID 1884 wrote to memory of 2272 1884 thttnh.exe 3hhbtt.exe PID 1884 wrote to memory of 2272 1884 thttnh.exe 3hhbtt.exe PID 1884 wrote to memory of 2272 1884 thttnh.exe 3hhbtt.exe PID 2272 wrote to memory of 2620 2272 3hhbtt.exe fxlrffl.exe PID 2272 wrote to memory of 2620 2272 3hhbtt.exe fxlrffl.exe PID 2272 wrote to memory of 2620 2272 3hhbtt.exe fxlrffl.exe PID 2272 wrote to memory of 2620 2272 3hhbtt.exe fxlrffl.exe PID 2620 wrote to memory of 2540 2620 fxlrffl.exe thtbbt.exe PID 2620 wrote to memory of 2540 2620 fxlrffl.exe thtbbt.exe PID 2620 wrote to memory of 2540 2620 fxlrffl.exe thtbbt.exe PID 2620 wrote to memory of 2540 2620 fxlrffl.exe thtbbt.exe PID 2540 wrote to memory of 2644 2540 thtbbt.exe vjvjp.exe PID 2540 wrote to memory of 2644 2540 thtbbt.exe vjvjp.exe PID 2540 wrote to memory of 2644 2540 thtbbt.exe vjvjp.exe PID 2540 wrote to memory of 2644 2540 thtbbt.exe vjvjp.exe PID 2644 wrote to memory of 2652 2644 vjvjp.exe xrxfffl.exe PID 2644 wrote to memory of 2652 2644 vjvjp.exe xrxfffl.exe PID 2644 wrote to memory of 2652 2644 vjvjp.exe xrxfffl.exe PID 2644 wrote to memory of 2652 2644 vjvjp.exe xrxfffl.exe PID 2652 wrote to memory of 2428 2652 xrxfffl.exe nbhbhb.exe PID 2652 wrote to memory of 2428 2652 xrxfffl.exe nbhbhb.exe PID 2652 wrote to memory of 2428 2652 xrxfffl.exe nbhbhb.exe PID 2652 wrote to memory of 2428 2652 xrxfffl.exe nbhbhb.exe PID 2428 wrote to memory of 2868 2428 nbhbhb.exe jvddv.exe PID 2428 wrote to memory of 2868 2428 nbhbhb.exe jvddv.exe PID 2428 wrote to memory of 2868 2428 nbhbhb.exe jvddv.exe PID 2428 wrote to memory of 2868 2428 nbhbhb.exe jvddv.exe PID 2868 wrote to memory of 2840 2868 jvddv.exe frrfllr.exe PID 2868 wrote to memory of 2840 2868 jvddv.exe frrfllr.exe PID 2868 wrote to memory of 2840 2868 jvddv.exe frrfllr.exe PID 2868 wrote to memory of 2840 2868 jvddv.exe frrfllr.exe PID 2840 wrote to memory of 2300 2840 frrfllr.exe hbnbnh.exe PID 2840 wrote to memory of 2300 2840 frrfllr.exe hbnbnh.exe PID 2840 wrote to memory of 2300 2840 frrfllr.exe hbnbnh.exe PID 2840 wrote to memory of 2300 2840 frrfllr.exe hbnbnh.exe PID 2300 wrote to memory of 1632 2300 hbnbnh.exe dvjjj.exe PID 2300 wrote to memory of 1632 2300 hbnbnh.exe dvjjj.exe PID 2300 wrote to memory of 1632 2300 hbnbnh.exe dvjjj.exe PID 2300 wrote to memory of 1632 2300 hbnbnh.exe dvjjj.exe PID 1632 wrote to memory of 1960 1632 dvjjj.exe fxrxflr.exe PID 1632 wrote to memory of 1960 1632 dvjjj.exe fxrxflr.exe PID 1632 wrote to memory of 1960 1632 dvjjj.exe fxrxflr.exe PID 1632 wrote to memory of 1960 1632 dvjjj.exe fxrxflr.exe PID 1960 wrote to memory of 2324 1960 fxrxflr.exe 7pdvd.exe PID 1960 wrote to memory of 2324 1960 fxrxflr.exe 7pdvd.exe PID 1960 wrote to memory of 2324 1960 fxrxflr.exe 7pdvd.exe PID 1960 wrote to memory of 2324 1960 fxrxflr.exe 7pdvd.exe PID 2324 wrote to memory of 2308 2324 7pdvd.exe 7lrlfff.exe PID 2324 wrote to memory of 2308 2324 7pdvd.exe 7lrlfff.exe PID 2324 wrote to memory of 2308 2324 7pdvd.exe 7lrlfff.exe PID 2324 wrote to memory of 2308 2324 7pdvd.exe 7lrlfff.exe PID 2308 wrote to memory of 772 2308 7lrlfff.exe btbttn.exe PID 2308 wrote to memory of 772 2308 7lrlfff.exe btbttn.exe PID 2308 wrote to memory of 772 2308 7lrlfff.exe btbttn.exe PID 2308 wrote to memory of 772 2308 7lrlfff.exe btbttn.exe PID 772 wrote to memory of 1756 772 btbttn.exe hnttbt.exe PID 772 wrote to memory of 1756 772 btbttn.exe hnttbt.exe PID 772 wrote to memory of 1756 772 btbttn.exe hnttbt.exe PID 772 wrote to memory of 1756 772 btbttn.exe hnttbt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f90e1ef7c3edcb1d265cff7bad29450_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1f90e1ef7c3edcb1d265cff7bad29450_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\thttnh.exec:\thttnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\3hhbtt.exec:\3hhbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\fxlrffl.exec:\fxlrffl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\thtbbt.exec:\thtbbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\vjvjp.exec:\vjvjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\xrxfffl.exec:\xrxfffl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\nbhbhb.exec:\nbhbhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\jvddv.exec:\jvddv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\frrfllr.exec:\frrfllr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\hbnbnh.exec:\hbnbnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\dvjjj.exec:\dvjjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\fxrxflr.exec:\fxrxflr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\7pdvd.exec:\7pdvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\7lrlfff.exec:\7lrlfff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\btbttn.exec:\btbttn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\hnttbt.exec:\hnttbt.exe17⤵
- Executes dropped EXE
PID:1756 -
\??\c:\frffrxl.exec:\frffrxl.exe18⤵
- Executes dropped EXE
PID:1748 -
\??\c:\nbnntb.exec:\nbnntb.exe19⤵
- Executes dropped EXE
PID:860 -
\??\c:\jjpdd.exec:\jjpdd.exe20⤵
- Executes dropped EXE
PID:2928 -
\??\c:\xxrxrxl.exec:\xxrxrxl.exe21⤵
- Executes dropped EXE
PID:2516 -
\??\c:\3hbhnb.exec:\3hbhnb.exe22⤵
- Executes dropped EXE
PID:2748 -
\??\c:\7jvjp.exec:\7jvjp.exe23⤵
- Executes dropped EXE
PID:672 -
\??\c:\lfrxlrl.exec:\lfrxlrl.exe24⤵
- Executes dropped EXE
PID:1108 -
\??\c:\thbbbb.exec:\thbbbb.exe25⤵
- Executes dropped EXE
PID:804 -
\??\c:\5vdjj.exec:\5vdjj.exe26⤵
- Executes dropped EXE
PID:2384 -
\??\c:\lxrrrrr.exec:\lxrrrrr.exe27⤵
- Executes dropped EXE
PID:880 -
\??\c:\hbhbbt.exec:\hbhbbt.exe28⤵
- Executes dropped EXE
PID:1624 -
\??\c:\dvppv.exec:\dvppv.exe29⤵
- Executes dropped EXE
PID:1764 -
\??\c:\lfrrffl.exec:\lfrrffl.exe30⤵
- Executes dropped EXE
PID:540 -
\??\c:\vjdjv.exec:\vjdjv.exe31⤵
- Executes dropped EXE
PID:1204 -
\??\c:\vjvvv.exec:\vjvvv.exe32⤵
- Executes dropped EXE
PID:2260 -
\??\c:\7thttt.exec:\7thttt.exe33⤵
- Executes dropped EXE
PID:1620 -
\??\c:\vjdjp.exec:\vjdjp.exe34⤵
- Executes dropped EXE
PID:2284 -
\??\c:\ffxfxrl.exec:\ffxfxrl.exe35⤵
- Executes dropped EXE
PID:2892 -
\??\c:\xllrxrf.exec:\xllrxrf.exe36⤵
- Executes dropped EXE
PID:2972 -
\??\c:\3thhbb.exec:\3thhbb.exe37⤵
- Executes dropped EXE
PID:2564 -
\??\c:\dpdvv.exec:\dpdvv.exe38⤵
- Executes dropped EXE
PID:2568 -
\??\c:\9jvpp.exec:\9jvpp.exe39⤵
- Executes dropped EXE
PID:2648 -
\??\c:\7xllflr.exec:\7xllflr.exe40⤵
- Executes dropped EXE
PID:2452 -
\??\c:\3bbbbh.exec:\3bbbbh.exe41⤵
- Executes dropped EXE
PID:2468 -
\??\c:\hbnttt.exec:\hbnttt.exe42⤵
- Executes dropped EXE
PID:2480 -
\??\c:\vjppj.exec:\vjppj.exe43⤵
- Executes dropped EXE
PID:2488 -
\??\c:\3rfflfr.exec:\3rfflfr.exe44⤵
- Executes dropped EXE
PID:2868 -
\??\c:\lffxxrf.exec:\lffxxrf.exe45⤵
- Executes dropped EXE
PID:2840 -
\??\c:\nhbtbb.exec:\nhbtbb.exe46⤵
- Executes dropped EXE
PID:1636 -
\??\c:\bhhtnn.exec:\bhhtnn.exe47⤵
- Executes dropped EXE
PID:1436 -
\??\c:\pdppv.exec:\pdppv.exe48⤵
- Executes dropped EXE
PID:348 -
\??\c:\fxlllrr.exec:\fxlllrr.exe49⤵
- Executes dropped EXE
PID:1960 -
\??\c:\lrxllll.exec:\lrxllll.exe50⤵
- Executes dropped EXE
PID:2324 -
\??\c:\3bbtbb.exec:\3bbtbb.exe51⤵
- Executes dropped EXE
PID:376 -
\??\c:\vpvpv.exec:\vpvpv.exe52⤵
- Executes dropped EXE
PID:1828 -
\??\c:\dvjjj.exec:\dvjjj.exe53⤵
- Executes dropped EXE
PID:320 -
\??\c:\5xffrrr.exec:\5xffrrr.exe54⤵
- Executes dropped EXE
PID:1452 -
\??\c:\rfrrffl.exec:\rfrrffl.exe55⤵
- Executes dropped EXE
PID:2864 -
\??\c:\btbbnn.exec:\btbbnn.exe56⤵
- Executes dropped EXE
PID:3064 -
\??\c:\7pppd.exec:\7pppd.exe57⤵
- Executes dropped EXE
PID:2756 -
\??\c:\7vdpj.exec:\7vdpj.exe58⤵
- Executes dropped EXE
PID:2760 -
\??\c:\lxllllf.exec:\lxllllf.exe59⤵
- Executes dropped EXE
PID:2516 -
\??\c:\rflllxx.exec:\rflllxx.exe60⤵
- Executes dropped EXE
PID:2748 -
\??\c:\hntnnb.exec:\hntnnb.exe61⤵
- Executes dropped EXE
PID:1172 -
\??\c:\hbnntn.exec:\hbnntn.exe62⤵
- Executes dropped EXE
PID:2932 -
\??\c:\vpdpp.exec:\vpdpp.exe63⤵
- Executes dropped EXE
PID:1496 -
\??\c:\7xlffff.exec:\7xlffff.exe64⤵
- Executes dropped EXE
PID:908 -
\??\c:\9fxxxxf.exec:\9fxxxxf.exe65⤵
- Executes dropped EXE
PID:1524 -
\??\c:\tbbbhh.exec:\tbbbhh.exe66⤵PID:840
-
\??\c:\nhnhnh.exec:\nhnhnh.exe67⤵PID:2700
-
\??\c:\pdvvd.exec:\pdvvd.exe68⤵PID:2068
-
\??\c:\1jpjj.exec:\1jpjj.exe69⤵PID:1764
-
\??\c:\9frlrrr.exec:\9frlrrr.exe70⤵PID:1592
-
\??\c:\hthbhn.exec:\hthbhn.exe71⤵PID:876
-
\??\c:\hthhnn.exec:\hthhnn.exe72⤵PID:2860
-
\??\c:\dpvjp.exec:\dpvjp.exe73⤵PID:2072
-
\??\c:\dpvvj.exec:\dpvvj.exe74⤵PID:2948
-
\??\c:\rlrrflr.exec:\rlrrflr.exe75⤵PID:2284
-
\??\c:\rfrrrrx.exec:\rfrrrrx.exe76⤵PID:2752
-
\??\c:\bnnntt.exec:\bnnntt.exe77⤵PID:2548
-
\??\c:\1pvpj.exec:\1pvpj.exe78⤵PID:1800
-
\??\c:\jvddd.exec:\jvddd.exe79⤵PID:2504
-
\??\c:\9xllrrx.exec:\9xllrrx.exe80⤵PID:2144
-
\??\c:\7ffxrlr.exec:\7ffxrlr.exe81⤵PID:2652
-
\??\c:\thnttt.exec:\thnttt.exe82⤵PID:1712
-
\??\c:\nbnhhb.exec:\nbnhhb.exe83⤵PID:3040
-
\??\c:\djjjp.exec:\djjjp.exe84⤵PID:2016
-
\??\c:\1frrrxf.exec:\1frrrxf.exe85⤵PID:1644
-
\??\c:\5xffffl.exec:\5xffffl.exe86⤵PID:2304
-
\??\c:\nhnthb.exec:\nhnthb.exe87⤵PID:1052
-
\??\c:\nbhhhn.exec:\nbhhhn.exe88⤵PID:332
-
\??\c:\vpddd.exec:\vpddd.exe89⤵PID:1816
-
\??\c:\dvpjj.exec:\dvpjj.exe90⤵PID:340
-
\??\c:\lfllfrx.exec:\lfllfrx.exe91⤵PID:2308
-
\??\c:\xfrrfxf.exec:\xfrrfxf.exe92⤵PID:1676
-
\??\c:\nhntbt.exec:\nhntbt.exe93⤵PID:1660
-
\??\c:\jvjjj.exec:\jvjjj.exe94⤵PID:2348
-
\??\c:\pdpjj.exec:\pdpjj.exe95⤵PID:2024
-
\??\c:\3frxrfl.exec:\3frxrfl.exe96⤵PID:2036
-
\??\c:\flxrrlr.exec:\flxrrlr.exe97⤵PID:2928
-
\??\c:\btbbhn.exec:\btbbhn.exe98⤵PID:1160
-
\??\c:\7bhnnh.exec:\7bhnnh.exe99⤵PID:536
-
\??\c:\9djdp.exec:\9djdp.exe100⤵PID:988
-
\??\c:\1lxxxxx.exec:\1lxxxxx.exe101⤵PID:672
-
\??\c:\rlffrxr.exec:\rlffrxr.exe102⤵PID:1868
-
\??\c:\tbtttn.exec:\tbtttn.exe103⤵PID:1788
-
\??\c:\dpvpv.exec:\dpvpv.exe104⤵PID:456
-
\??\c:\dvdpd.exec:\dvdpd.exe105⤵PID:1880
-
\??\c:\frfllff.exec:\frfllff.exe106⤵PID:2384
-
\??\c:\ffxxffr.exec:\ffxxffr.exe107⤵PID:840
-
\??\c:\htttbb.exec:\htttbb.exe108⤵PID:972
-
\??\c:\pdjpv.exec:\pdjpv.exe109⤵PID:1724
-
\??\c:\1vvpj.exec:\1vvpj.exe110⤵PID:2248
-
\??\c:\xrrrfxf.exec:\xrrrfxf.exe111⤵PID:2804
-
\??\c:\frflllr.exec:\frflllr.exe112⤵PID:1716
-
\??\c:\5ntbbb.exec:\5ntbbb.exe113⤵PID:2508
-
\??\c:\5ntttb.exec:\5ntttb.exe114⤵PID:2728
-
\??\c:\ppddj.exec:\ppddj.exe115⤵PID:2948
-
\??\c:\9lrlrxf.exec:\9lrlrxf.exe116⤵PID:2608
-
\??\c:\frffrll.exec:\frffrll.exe117⤵PID:2636
-
\??\c:\7hnnht.exec:\7hnnht.exe118⤵PID:2572
-
\??\c:\3hnhhb.exec:\3hnhhb.exe119⤵PID:2672
-
\??\c:\pdpjj.exec:\pdpjj.exe120⤵PID:2412
-
\??\c:\vjvvd.exec:\vjvvd.exe121⤵PID:2472
-
\??\c:\rxllrrr.exec:\rxllrrr.exe122⤵PID:2480
-
\??\c:\bhnttt.exec:\bhnttt.exe123⤵PID:2824
-
\??\c:\bththn.exec:\bththn.exe124⤵PID:2020
-
\??\c:\7hnnnn.exec:\7hnnnn.exe125⤵PID:380
-
\??\c:\vpvjj.exec:\vpvjj.exe126⤵PID:1440
-
\??\c:\xlrrxxx.exec:\xlrrxxx.exe127⤵PID:1824
-
\??\c:\xfllllr.exec:\xfllllr.exe128⤵PID:1488
-
\??\c:\5hnhnh.exec:\5hnhnh.exe129⤵PID:2100
-
\??\c:\thhnnh.exec:\thhnnh.exe130⤵PID:896
-
\??\c:\pdpdj.exec:\pdpdj.exe131⤵PID:1048
-
\??\c:\1ffxxxf.exec:\1ffxxxf.exe132⤵PID:1984
-
\??\c:\rlxfllr.exec:\rlxfllr.exe133⤵PID:1756
-
\??\c:\ttnhtn.exec:\ttnhtn.exe134⤵PID:1404
-
\??\c:\5ttnnh.exec:\5ttnnh.exe135⤵PID:2864
-
\??\c:\jdjpd.exec:\jdjpd.exe136⤵PID:2812
-
\??\c:\xxxxrfr.exec:\xxxxrfr.exe137⤵PID:2036
-
\??\c:\xllrxfl.exec:\xllrxfl.exe138⤵PID:2880
-
\??\c:\tnnbbb.exec:\tnnbbb.exe139⤵PID:2768
-
\??\c:\hnbhhb.exec:\hnbhhb.exe140⤵PID:664
-
\??\c:\jvjjp.exec:\jvjjp.exe141⤵PID:1484
-
\??\c:\9ffxrfr.exec:\9ffxrfr.exe142⤵PID:948
-
\??\c:\7xrfxxl.exec:\7xrfxxl.exe143⤵PID:2976
-
\??\c:\1btnhn.exec:\1btnhn.exe144⤵PID:1164
-
\??\c:\jdpvd.exec:\jdpvd.exe145⤵PID:1088
-
\??\c:\dvvdv.exec:\dvvdv.exe146⤵PID:1672
-
\??\c:\xrxfrfl.exec:\xrxfrfl.exe147⤵PID:2032
-
\??\c:\thnnnt.exec:\thnnnt.exe148⤵PID:2068
-
\??\c:\nnnnhn.exec:\nnnnhn.exe149⤵PID:540
-
\??\c:\jdpvj.exec:\jdpvj.exe150⤵PID:1592
-
\??\c:\dpvdj.exec:\dpvdj.exe151⤵PID:2260
-
\??\c:\rrxxxxl.exec:\rrxxxxl.exe152⤵PID:2860
-
\??\c:\frxxlxf.exec:\frxxlxf.exe153⤵PID:2524
-
\??\c:\nhthtb.exec:\nhthtb.exe154⤵PID:1884
-
\??\c:\jdppv.exec:\jdppv.exe155⤵PID:2892
-
\??\c:\dpdjj.exec:\dpdjj.exe156⤵PID:2972
-
\??\c:\flfxflx.exec:\flfxflx.exe157⤵PID:2532
-
\??\c:\1hnhhb.exec:\1hnhhb.exe158⤵PID:1800
-
\??\c:\vvjvj.exec:\vvjvj.exe159⤵PID:2436
-
\??\c:\lxffffl.exec:\lxffffl.exe160⤵PID:2596
-
\??\c:\htnntt.exec:\htnntt.exe161⤵PID:2816
-
\??\c:\jddjj.exec:\jddjj.exe162⤵PID:2536
-
\??\c:\rrfflxl.exec:\rrfflxl.exe163⤵PID:3036
-
\??\c:\frfxffr.exec:\frfxffr.exe164⤵PID:1652
-
\??\c:\ntbttt.exec:\ntbttt.exe165⤵PID:1532
-
\??\c:\nbtbnn.exec:\nbtbnn.exe166⤵PID:2300
-
\??\c:\dppvj.exec:\dppvj.exe167⤵PID:2696
-
\??\c:\rfxfrxf.exec:\rfxfrxf.exe168⤵PID:2148
-
\??\c:\rfrflrf.exec:\rfrflrf.exe169⤵PID:1816
-
\??\c:\bbbbtt.exec:\bbbbtt.exe170⤵PID:1684
-
\??\c:\pjddj.exec:\pjddj.exe171⤵PID:1928
-
\??\c:\pvpvd.exec:\pvpvd.exe172⤵PID:1340
-
\??\c:\1xxxflr.exec:\1xxxflr.exe173⤵PID:1336
-
\??\c:\rlxflxf.exec:\rlxflxf.exe174⤵PID:1444
-
\??\c:\hnnbnn.exec:\hnnbnn.exe175⤵PID:860
-
\??\c:\1jvdv.exec:\1jvdv.exe176⤵PID:1312
-
\??\c:\dvvvd.exec:\dvvvd.exe177⤵PID:2396
-
\??\c:\llllxxr.exec:\llllxxr.exe178⤵PID:2904
-
\??\c:\nhbhth.exec:\nhbhth.exe179⤵PID:1112
-
\??\c:\nnhnbb.exec:\nnhnbb.exe180⤵PID:988
-
\??\c:\1vdjp.exec:\1vdjp.exe181⤵PID:2592
-
\??\c:\pjjpv.exec:\pjjpv.exe182⤵PID:836
-
\??\c:\rlrlllr.exec:\rlrlllr.exe183⤵PID:1628
-
\??\c:\hbtbbb.exec:\hbtbbb.exe184⤵PID:456
-
\??\c:\thhbth.exec:\thhbth.exe185⤵PID:3032
-
\??\c:\vvddj.exec:\vvddj.exe186⤵PID:1524
-
\??\c:\xrflfrl.exec:\xrflfrl.exe187⤵PID:2224
-
\??\c:\rllrxrf.exec:\rllrxrf.exe188⤵PID:2984
-
\??\c:\hbnthn.exec:\hbnthn.exe189⤵PID:2256
-
\??\c:\5pddj.exec:\5pddj.exe190⤵PID:2204
-
\??\c:\jdjpv.exec:\jdjpv.exe191⤵PID:2852
-
\??\c:\ffrrflx.exec:\ffrrflx.exe192⤵PID:1716
-
\??\c:\rrlxrrf.exec:\rrlxrrf.exe193⤵PID:2600
-
\??\c:\nbhtbt.exec:\nbhtbt.exe194⤵PID:2856
-
\??\c:\tthnbn.exec:\tthnbn.exe195⤵PID:2272
-
\??\c:\jdppv.exec:\jdppv.exe196⤵PID:2608
-
\??\c:\xrlrffl.exec:\xrlrffl.exe197⤵PID:2636
-
\??\c:\rrlrffx.exec:\rrlrffx.exe198⤵PID:2440
-
\??\c:\ntbbbt.exec:\ntbbbt.exe199⤵PID:2452
-
\??\c:\tnthnn.exec:\tnthnn.exe200⤵PID:2336
-
\??\c:\pdjjv.exec:\pdjjv.exe201⤵PID:2444
-
\??\c:\lflrrxx.exec:\lflrrxx.exe202⤵PID:2472
-
\??\c:\fxrxffl.exec:\fxrxffl.exe203⤵PID:2584
-
\??\c:\bnbhnh.exec:\bnbhnh.exe204⤵PID:1736
-
\??\c:\3vvdj.exec:\3vvdj.exe205⤵PID:2840
-
\??\c:\vpddd.exec:\vpddd.exe206⤵PID:1644
-
\??\c:\rffxxff.exec:\rffxxff.exe207⤵PID:1436
-
\??\c:\hthnnn.exec:\hthnnn.exe208⤵PID:1824
-
\??\c:\9bnttb.exec:\9bnttb.exe209⤵PID:1488
-
\??\c:\dpppj.exec:\dpppj.exe210⤵PID:2136
-
\??\c:\lffrlff.exec:\lffrlff.exe211⤵PID:896
-
\??\c:\llxlxfr.exec:\llxlxfr.exe212⤵PID:1828
-
\??\c:\nbthnt.exec:\nbthnt.exe213⤵PID:1984
-
\??\c:\hbthth.exec:\hbthth.exe214⤵PID:1452
-
\??\c:\vvppv.exec:\vvppv.exe215⤵PID:2512
-
\??\c:\flxrxrx.exec:\flxrxrx.exe216⤵PID:2864
-
\??\c:\lxffllr.exec:\lxffllr.exe217⤵PID:2392
-
\??\c:\5bhnnh.exec:\5bhnnh.exe218⤵PID:2036
-
\??\c:\hnbnhn.exec:\hnbnhn.exe219⤵PID:2708
-
\??\c:\jvjjj.exec:\jvjjj.exe220⤵PID:2768
-
\??\c:\rlflxrx.exec:\rlflxrx.exe221⤵PID:384
-
\??\c:\lflrxxx.exec:\lflrxxx.exe222⤵PID:636
-
\??\c:\hthntt.exec:\hthntt.exe223⤵PID:1808
-
\??\c:\1djpd.exec:\1djpd.exe224⤵PID:2976
-
\??\c:\pjvdj.exec:\pjvdj.exe225⤵PID:2684
-
\??\c:\frxxxxf.exec:\frxxxxf.exe226⤵PID:1088
-
\??\c:\llfrlfx.exec:\llfrlfx.exe227⤵PID:1672
-
\??\c:\5ntnnn.exec:\5ntnnn.exe228⤵PID:756
-
\??\c:\vvvdj.exec:\vvvdj.exe229⤵PID:1692
-
\??\c:\7pjvv.exec:\7pjvv.exe230⤵PID:540
-
\??\c:\rlxrfxf.exec:\rlxrfxf.exe231⤵PID:2060
-
\??\c:\hbnhnt.exec:\hbnhnt.exe232⤵PID:1204
-
\??\c:\thnnbt.exec:\thnnbt.exe233⤵PID:2912
-
\??\c:\3vdvp.exec:\3vdvp.exe234⤵PID:2520
-
\??\c:\dvjpv.exec:\dvjpv.exe235⤵PID:1884
-
\??\c:\frlrxxf.exec:\frlrxxf.exe236⤵PID:2664
-
\??\c:\5hnbbt.exec:\5hnbbt.exe237⤵PID:2568
-
\??\c:\ppddv.exec:\ppddv.exe238⤵PID:2644
-
\??\c:\jvddv.exec:\jvddv.exe239⤵PID:2504
-
\??\c:\xlrrxxr.exec:\xlrrxxr.exe240⤵PID:2140
-
\??\c:\lrxxxxx.exec:\lrxxxxx.exe241⤵PID:2424
-
\??\c:\hbhbhh.exec:\hbhbhh.exe242⤵PID:2428