Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 00:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
30d89bd6bf9c6c985d54deac59b13950_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
30d89bd6bf9c6c985d54deac59b13950_NeikiAnalytics.exe
-
Size
64KB
-
MD5
30d89bd6bf9c6c985d54deac59b13950
-
SHA1
6f548cd8c4373f1d8f909ad0d484bc65042a1253
-
SHA256
0b91f75a39428b6cd766f2daab2f881e85a11aea61a6999e210587e808aee546
-
SHA512
0985759885199a86b56f732d55f342b782114402ebe7e05c6f30b0b3577da7fcc19ca1c97d15de26d6f4e27137a03289e7d157d7556204103496504c06b29dae
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6Mu/ePS3AM:ymb3NkkiQ3mdBjFI46TQM
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/2924-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-85-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2500-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1136-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2276-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/960-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1768-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/888-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/324-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1192-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1668-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1068-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
nnhnbt.exe1dpvv.exelfrlxfl.exebthnbh.exevjjvd.exejdvpp.exexxxflll.exehbnbht.exeppjpd.exevdvdv.exexxfllfl.exerfrrxxl.exebtntbn.exejddjv.exe5vpdj.exerrlrlxf.exenhtbtn.exenhbhhh.exevdppd.exexxxrxfl.exe9fxlrxf.exetbhtth.exetnhntt.exeddpvv.exe3fffxlx.exelfxxlxf.exe9tnnbt.exebtbbhn.exevddjd.exerxlfrxl.exelrrlrll.exe7httnb.exebthnbh.exedpvvd.exevppdp.exefflllxx.exefxlrxxf.exe1vdjv.exevjvdd.exeflxxxfl.exe1flxlrx.exetnthnn.exebbbtnt.exe9jvvv.exepjvjv.exe9lfrflx.exebbthth.exebthhnn.exedvjdv.exe7jjdd.exexrffxrf.exerlxlrxl.exetntnbb.exebbnbbh.exevjvvp.exe5ppvd.exelfrrxrl.exe3rxffrx.exebtnbhn.exebtnbhn.exeppjvj.exe5vjdd.exe1dvjj.exerlxxfxr.exepid process 2656 nnhnbt.exe 2268 1dpvv.exe 2672 lfrlxfl.exe 2592 bthnbh.exe 2504 vjjvd.exe 2632 jdvpp.exe 2500 xxxflll.exe 2520 hbnbht.exe 1740 ppjpd.exe 2724 vdvdv.exe 1136 xxfllfl.exe 2908 rfrrxxl.exe 2800 btntbn.exe 2988 jddjv.exe 2276 5vpdj.exe 960 rrlrlxf.exe 1768 nhtbtn.exe 888 nhbhhh.exe 1708 vdppd.exe 324 xxxrxfl.exe 1192 9fxlrxf.exe 2452 tbhtth.exe 1668 tnhntt.exe 1140 ddpvv.exe 1528 3fffxlx.exe 2004 lfxxlxf.exe 1068 9tnnbt.exe 2424 btbbhn.exe 2648 vddjd.exe 1536 rxlfrxl.exe 1936 lrrlrll.exe 2352 7httnb.exe 2972 bthnbh.exe 2296 dpvvd.exe 2056 vppdp.exe 2020 fflllxx.exe 2268 fxlrxxf.exe 1764 1vdjv.exe 2804 vjvdd.exe 2868 flxxxfl.exe 1940 1flxlrx.exe 2780 tnthnn.exe 2468 bbbtnt.exe 1112 9jvvv.exe 1096 pjvjv.exe 3064 9lfrflx.exe 2568 bbthth.exe 1332 bthhnn.exe 2740 dvjdv.exe 2752 7jjdd.exe 2800 xrffxrf.exe 2880 rlxlrxl.exe 3048 tntnbb.exe 844 bbnbbh.exe 3060 vjvvp.exe 1584 5ppvd.exe 2356 lfrrxrl.exe 580 3rxffrx.exe 1976 btnbhn.exe 1452 btnbhn.exe 1216 ppjvj.exe 1916 5vjdd.exe 668 1dvjj.exe 452 rlxxfxr.exe -
Processes:
resource yara_rule behavioral1/memory/2924-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2268-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1136-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2276-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/960-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1768-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/888-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/324-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1192-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1668-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1068-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-274-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
30d89bd6bf9c6c985d54deac59b13950_NeikiAnalytics.exennhnbt.exe1dpvv.exelfrlxfl.exebthnbh.exevjjvd.exejdvpp.exexxxflll.exehbnbht.exeppjpd.exevdvdv.exexxfllfl.exerfrrxxl.exebtntbn.exejddjv.exe5vpdj.exedescription pid process target process PID 2924 wrote to memory of 2656 2924 30d89bd6bf9c6c985d54deac59b13950_NeikiAnalytics.exe nnhnbt.exe PID 2924 wrote to memory of 2656 2924 30d89bd6bf9c6c985d54deac59b13950_NeikiAnalytics.exe nnhnbt.exe PID 2924 wrote to memory of 2656 2924 30d89bd6bf9c6c985d54deac59b13950_NeikiAnalytics.exe nnhnbt.exe PID 2924 wrote to memory of 2656 2924 30d89bd6bf9c6c985d54deac59b13950_NeikiAnalytics.exe nnhnbt.exe PID 2656 wrote to memory of 2268 2656 nnhnbt.exe 1dpvv.exe PID 2656 wrote to memory of 2268 2656 nnhnbt.exe 1dpvv.exe PID 2656 wrote to memory of 2268 2656 nnhnbt.exe 1dpvv.exe PID 2656 wrote to memory of 2268 2656 nnhnbt.exe 1dpvv.exe PID 2268 wrote to memory of 2672 2268 1dpvv.exe lfrlxfl.exe PID 2268 wrote to memory of 2672 2268 1dpvv.exe lfrlxfl.exe PID 2268 wrote to memory of 2672 2268 1dpvv.exe lfrlxfl.exe PID 2268 wrote to memory of 2672 2268 1dpvv.exe lfrlxfl.exe PID 2672 wrote to memory of 2592 2672 lfrlxfl.exe bthnbh.exe PID 2672 wrote to memory of 2592 2672 lfrlxfl.exe bthnbh.exe PID 2672 wrote to memory of 2592 2672 lfrlxfl.exe bthnbh.exe PID 2672 wrote to memory of 2592 2672 lfrlxfl.exe bthnbh.exe PID 2592 wrote to memory of 2504 2592 bthnbh.exe vjjvd.exe PID 2592 wrote to memory of 2504 2592 bthnbh.exe vjjvd.exe PID 2592 wrote to memory of 2504 2592 bthnbh.exe vjjvd.exe PID 2592 wrote to memory of 2504 2592 bthnbh.exe vjjvd.exe PID 2504 wrote to memory of 2632 2504 vjjvd.exe jdvpp.exe PID 2504 wrote to memory of 2632 2504 vjjvd.exe jdvpp.exe PID 2504 wrote to memory of 2632 2504 vjjvd.exe jdvpp.exe PID 2504 wrote to memory of 2632 2504 vjjvd.exe jdvpp.exe PID 2632 wrote to memory of 2500 2632 jdvpp.exe xxxflll.exe PID 2632 wrote to memory of 2500 2632 jdvpp.exe xxxflll.exe PID 2632 wrote to memory of 2500 2632 jdvpp.exe xxxflll.exe PID 2632 wrote to memory of 2500 2632 jdvpp.exe xxxflll.exe PID 2500 wrote to memory of 2520 2500 xxxflll.exe hbnbht.exe PID 2500 wrote to memory of 2520 2500 xxxflll.exe hbnbht.exe PID 2500 wrote to memory of 2520 2500 xxxflll.exe hbnbht.exe PID 2500 wrote to memory of 2520 2500 xxxflll.exe hbnbht.exe PID 2520 wrote to memory of 1740 2520 hbnbht.exe ppjpd.exe PID 2520 wrote to memory of 1740 2520 hbnbht.exe ppjpd.exe PID 2520 wrote to memory of 1740 2520 hbnbht.exe ppjpd.exe PID 2520 wrote to memory of 1740 2520 hbnbht.exe ppjpd.exe PID 1740 wrote to memory of 2724 1740 ppjpd.exe vdvdv.exe PID 1740 wrote to memory of 2724 1740 ppjpd.exe vdvdv.exe PID 1740 wrote to memory of 2724 1740 ppjpd.exe vdvdv.exe PID 1740 wrote to memory of 2724 1740 ppjpd.exe vdvdv.exe PID 2724 wrote to memory of 1136 2724 vdvdv.exe xxfllfl.exe PID 2724 wrote to memory of 1136 2724 vdvdv.exe xxfllfl.exe PID 2724 wrote to memory of 1136 2724 vdvdv.exe xxfllfl.exe PID 2724 wrote to memory of 1136 2724 vdvdv.exe xxfllfl.exe PID 1136 wrote to memory of 2908 1136 xxfllfl.exe rfrrxxl.exe PID 1136 wrote to memory of 2908 1136 xxfllfl.exe rfrrxxl.exe PID 1136 wrote to memory of 2908 1136 xxfllfl.exe rfrrxxl.exe PID 1136 wrote to memory of 2908 1136 xxfllfl.exe rfrrxxl.exe PID 2908 wrote to memory of 2800 2908 rfrrxxl.exe btntbn.exe PID 2908 wrote to memory of 2800 2908 rfrrxxl.exe btntbn.exe PID 2908 wrote to memory of 2800 2908 rfrrxxl.exe btntbn.exe PID 2908 wrote to memory of 2800 2908 rfrrxxl.exe btntbn.exe PID 2800 wrote to memory of 2988 2800 btntbn.exe jddjv.exe PID 2800 wrote to memory of 2988 2800 btntbn.exe jddjv.exe PID 2800 wrote to memory of 2988 2800 btntbn.exe jddjv.exe PID 2800 wrote to memory of 2988 2800 btntbn.exe jddjv.exe PID 2988 wrote to memory of 2276 2988 jddjv.exe 5vpdj.exe PID 2988 wrote to memory of 2276 2988 jddjv.exe 5vpdj.exe PID 2988 wrote to memory of 2276 2988 jddjv.exe 5vpdj.exe PID 2988 wrote to memory of 2276 2988 jddjv.exe 5vpdj.exe PID 2276 wrote to memory of 960 2276 5vpdj.exe rrlrlxf.exe PID 2276 wrote to memory of 960 2276 5vpdj.exe rrlrlxf.exe PID 2276 wrote to memory of 960 2276 5vpdj.exe rrlrlxf.exe PID 2276 wrote to memory of 960 2276 5vpdj.exe rrlrlxf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\30d89bd6bf9c6c985d54deac59b13950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\30d89bd6bf9c6c985d54deac59b13950_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\nnhnbt.exec:\nnhnbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\1dpvv.exec:\1dpvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\lfrlxfl.exec:\lfrlxfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\bthnbh.exec:\bthnbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\vjjvd.exec:\vjjvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\jdvpp.exec:\jdvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\xxxflll.exec:\xxxflll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\hbnbht.exec:\hbnbht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\ppjpd.exec:\ppjpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\vdvdv.exec:\vdvdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\xxfllfl.exec:\xxfllfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\rfrrxxl.exec:\rfrrxxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\btntbn.exec:\btntbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\jddjv.exec:\jddjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\5vpdj.exec:\5vpdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\rrlrlxf.exec:\rrlrlxf.exe17⤵
- Executes dropped EXE
PID:960 -
\??\c:\nhtbtn.exec:\nhtbtn.exe18⤵
- Executes dropped EXE
PID:1768 -
\??\c:\nhbhhh.exec:\nhbhhh.exe19⤵
- Executes dropped EXE
PID:888 -
\??\c:\vdppd.exec:\vdppd.exe20⤵
- Executes dropped EXE
PID:1708 -
\??\c:\xxxrxfl.exec:\xxxrxfl.exe21⤵
- Executes dropped EXE
PID:324 -
\??\c:\9fxlrxf.exec:\9fxlrxf.exe22⤵
- Executes dropped EXE
PID:1192 -
\??\c:\tbhtth.exec:\tbhtth.exe23⤵
- Executes dropped EXE
PID:2452 -
\??\c:\tnhntt.exec:\tnhntt.exe24⤵
- Executes dropped EXE
PID:1668 -
\??\c:\ddpvv.exec:\ddpvv.exe25⤵
- Executes dropped EXE
PID:1140 -
\??\c:\3fffxlx.exec:\3fffxlx.exe26⤵
- Executes dropped EXE
PID:1528 -
\??\c:\lfxxlxf.exec:\lfxxlxf.exe27⤵
- Executes dropped EXE
PID:2004 -
\??\c:\9tnnbt.exec:\9tnnbt.exe28⤵
- Executes dropped EXE
PID:1068 -
\??\c:\btbbhn.exec:\btbbhn.exe29⤵
- Executes dropped EXE
PID:2424 -
\??\c:\vddjd.exec:\vddjd.exe30⤵
- Executes dropped EXE
PID:2648 -
\??\c:\rxlfrxl.exec:\rxlfrxl.exe31⤵
- Executes dropped EXE
PID:1536 -
\??\c:\lrrlrll.exec:\lrrlrll.exe32⤵
- Executes dropped EXE
PID:1936 -
\??\c:\7httnb.exec:\7httnb.exe33⤵
- Executes dropped EXE
PID:2352 -
\??\c:\bthnbh.exec:\bthnbh.exe34⤵
- Executes dropped EXE
PID:2972 -
\??\c:\dpvvd.exec:\dpvvd.exe35⤵
- Executes dropped EXE
PID:2296 -
\??\c:\vppdp.exec:\vppdp.exe36⤵
- Executes dropped EXE
PID:2056 -
\??\c:\fflllxx.exec:\fflllxx.exe37⤵
- Executes dropped EXE
PID:2020 -
\??\c:\fxlrxxf.exec:\fxlrxxf.exe38⤵
- Executes dropped EXE
PID:2268 -
\??\c:\1vdjv.exec:\1vdjv.exe39⤵
- Executes dropped EXE
PID:1764 -
\??\c:\vjvdd.exec:\vjvdd.exe40⤵
- Executes dropped EXE
PID:2804 -
\??\c:\flxxxfl.exec:\flxxxfl.exe41⤵
- Executes dropped EXE
PID:2868 -
\??\c:\1flxlrx.exec:\1flxlrx.exe42⤵
- Executes dropped EXE
PID:1940 -
\??\c:\tnthnn.exec:\tnthnn.exe43⤵
- Executes dropped EXE
PID:2780 -
\??\c:\bbbtnt.exec:\bbbtnt.exe44⤵
- Executes dropped EXE
PID:2468 -
\??\c:\9jvvv.exec:\9jvvv.exe45⤵
- Executes dropped EXE
PID:1112 -
\??\c:\pjvjv.exec:\pjvjv.exe46⤵
- Executes dropped EXE
PID:1096 -
\??\c:\9lfrflx.exec:\9lfrflx.exe47⤵
- Executes dropped EXE
PID:3064 -
\??\c:\bbthth.exec:\bbthth.exe48⤵
- Executes dropped EXE
PID:2568 -
\??\c:\bthhnn.exec:\bthhnn.exe49⤵
- Executes dropped EXE
PID:1332 -
\??\c:\dvjdv.exec:\dvjdv.exe50⤵
- Executes dropped EXE
PID:2740 -
\??\c:\7jjdd.exec:\7jjdd.exe51⤵
- Executes dropped EXE
PID:2752 -
\??\c:\xrffxrf.exec:\xrffxrf.exe52⤵
- Executes dropped EXE
PID:2800 -
\??\c:\rlxlrxl.exec:\rlxlrxl.exe53⤵
- Executes dropped EXE
PID:2880 -
\??\c:\tntnbb.exec:\tntnbb.exe54⤵
- Executes dropped EXE
PID:3048 -
\??\c:\bbnbbh.exec:\bbnbbh.exe55⤵
- Executes dropped EXE
PID:844 -
\??\c:\vjvvp.exec:\vjvvp.exe56⤵
- Executes dropped EXE
PID:3060 -
\??\c:\5ppvd.exec:\5ppvd.exe57⤵
- Executes dropped EXE
PID:1584 -
\??\c:\lfrrxrl.exec:\lfrrxrl.exe58⤵
- Executes dropped EXE
PID:2356 -
\??\c:\3rxffrx.exec:\3rxffrx.exe59⤵
- Executes dropped EXE
PID:580 -
\??\c:\btnbhn.exec:\btnbhn.exe60⤵
- Executes dropped EXE
PID:1976 -
\??\c:\btnbhn.exec:\btnbhn.exe61⤵
- Executes dropped EXE
PID:1452 -
\??\c:\ppjvj.exec:\ppjvj.exe62⤵
- Executes dropped EXE
PID:1216 -
\??\c:\5vjdd.exec:\5vjdd.exe63⤵
- Executes dropped EXE
PID:1916 -
\??\c:\1dvjj.exec:\1dvjj.exe64⤵
- Executes dropped EXE
PID:668 -
\??\c:\rlxxfxr.exec:\rlxxfxr.exe65⤵
- Executes dropped EXE
PID:452 -
\??\c:\xlxfffx.exec:\xlxfffx.exe66⤵PID:2180
-
\??\c:\7tbtnh.exec:\7tbtnh.exe67⤵PID:1528
-
\??\c:\pjddd.exec:\pjddd.exe68⤵PID:920
-
\??\c:\vjppp.exec:\vjppp.exe69⤵PID:2080
-
\??\c:\lflfrxr.exec:\lflfrxr.exe70⤵PID:1340
-
\??\c:\ffrxxfl.exec:\ffrxxfl.exe71⤵PID:1684
-
\??\c:\thhbbb.exec:\thhbbb.exe72⤵PID:2040
-
\??\c:\7nhtbb.exec:\7nhtbb.exe73⤵PID:2228
-
\??\c:\5jpdp.exec:\5jpdp.exe74⤵PID:2360
-
\??\c:\jvvpp.exec:\jvvpp.exe75⤵PID:2912
-
\??\c:\fxrlxlx.exec:\fxrlxlx.exe76⤵PID:2348
-
\??\c:\7frlffx.exec:\7frlffx.exe77⤵PID:1636
-
\??\c:\hnttbn.exec:\hnttbn.exe78⤵PID:2060
-
\??\c:\hnthbb.exec:\hnthbb.exe79⤵PID:2036
-
\??\c:\pjdjj.exec:\pjdjj.exe80⤵PID:2664
-
\??\c:\5vjpv.exec:\5vjpv.exe81⤵PID:2680
-
\??\c:\rlxxxrx.exec:\rlxxxrx.exe82⤵PID:2592
-
\??\c:\lfxfllx.exec:\lfxfllx.exe83⤵PID:2580
-
\??\c:\ttnbnn.exec:\ttnbnn.exe84⤵PID:2292
-
\??\c:\hbnntt.exec:\hbnntt.exe85⤵PID:2636
-
\??\c:\5vvdj.exec:\5vvdj.exe86⤵PID:3024
-
\??\c:\jdvvj.exec:\jdvvj.exe87⤵PID:2484
-
\??\c:\pjdjp.exec:\pjdjp.exe88⤵PID:2128
-
\??\c:\1rrxxlx.exec:\1rrxxlx.exe89⤵PID:2732
-
\??\c:\rrrrfxl.exec:\rrrrfxl.exe90⤵PID:2644
-
\??\c:\nnhbhb.exec:\nnhbhb.exe91⤵PID:3004
-
\??\c:\9nhthn.exec:\9nhthn.exe92⤵PID:2828
-
\??\c:\dvjjv.exec:\dvjjv.exe93⤵PID:2748
-
\??\c:\1jjvj.exec:\1jjvj.exe94⤵PID:1376
-
\??\c:\rfflffr.exec:\rfflffr.exe95⤵PID:2704
-
\??\c:\fxrxfrx.exec:\fxrxfrx.exe96⤵PID:2276
-
\??\c:\7ntbnb.exec:\7ntbnb.exe97⤵PID:776
-
\??\c:\bbtntb.exec:\bbtntb.exe98⤵PID:3068
-
\??\c:\1pppp.exec:\1pppp.exe99⤵PID:2708
-
\??\c:\vpjpv.exec:\vpjpv.exe100⤵PID:1616
-
\??\c:\ddddp.exec:\ddddp.exe101⤵PID:596
-
\??\c:\xllxrfl.exec:\xllxrfl.exe102⤵PID:1264
-
\??\c:\ffxlrrf.exec:\ffxlrrf.exe103⤵PID:1192
-
\??\c:\nnhnbh.exec:\nnhnbh.exe104⤵PID:2408
-
\??\c:\3tbbhh.exec:\3tbbhh.exe105⤵PID:2952
-
\??\c:\hbnhhn.exec:\hbnhhn.exe106⤵PID:1492
-
\??\c:\vpdpd.exec:\vpdpd.exe107⤵PID:1140
-
\??\c:\jdvvp.exec:\jdvvp.exe108⤵PID:1076
-
\??\c:\ffflxxf.exec:\ffflxxf.exe109⤵PID:1996
-
\??\c:\7llrxrf.exec:\7llrxrf.exe110⤵PID:644
-
\??\c:\bthntb.exec:\bthntb.exe111⤵PID:604
-
\??\c:\5tnntt.exec:\5tnntt.exe112⤵PID:2260
-
\??\c:\vpjjd.exec:\vpjjd.exe113⤵PID:2076
-
\??\c:\vvjpd.exec:\vvjpd.exe114⤵PID:1536
-
\??\c:\3jvvd.exec:\3jvvd.exe115⤵PID:904
-
\??\c:\5xfflrf.exec:\5xfflrf.exe116⤵PID:1848
-
\??\c:\lfrrxfl.exec:\lfrrxfl.exe117⤵PID:2104
-
\??\c:\nhnbbb.exec:\nhnbbb.exe118⤵PID:2656
-
\??\c:\7nntbb.exec:\7nntbb.exe119⤵PID:2596
-
\??\c:\7vvjj.exec:\7vvjj.exe120⤵PID:2612
-
\??\c:\dvvdv.exec:\dvvdv.exe121⤵PID:2940
-
\??\c:\3vpvd.exec:\3vpvd.exe122⤵PID:2584
-
\??\c:\7xllrfr.exec:\7xllrfr.exe123⤵PID:2600
-
\??\c:\5rrrxfl.exec:\5rrrxfl.exe124⤵PID:2604
-
\??\c:\5tnhbb.exec:\5tnhbb.exe125⤵PID:2768
-
\??\c:\bnthtb.exec:\bnthtb.exe126⤵PID:2524
-
\??\c:\pdddj.exec:\pdddj.exe127⤵PID:2500
-
\??\c:\vpjjp.exec:\vpjjp.exe128⤵PID:2064
-
\??\c:\ffxfllx.exec:\ffxfllx.exe129⤵PID:1164
-
\??\c:\xrlxrrx.exec:\xrlxrrx.exe130⤵PID:2336
-
\??\c:\tnbhnb.exec:\tnbhnb.exe131⤵PID:2340
-
\??\c:\vdddv.exec:\vdddv.exe132⤵PID:1540
-
\??\c:\vpjpv.exec:\vpjpv.exe133⤵PID:2556
-
\??\c:\fxrxllx.exec:\fxrxllx.exe134⤵PID:2728
-
\??\c:\rfllllr.exec:\rfllllr.exe135⤵PID:3008
-
\??\c:\bbnttt.exec:\bbnttt.exe136⤵PID:916
-
\??\c:\ttttbb.exec:\ttttbb.exe137⤵PID:2456
-
\??\c:\nhtthh.exec:\nhtthh.exe138⤵PID:828
-
\??\c:\vvpvj.exec:\vvpvj.exe139⤵PID:2200
-
\??\c:\9ddpp.exec:\9ddpp.exe140⤵PID:3060
-
\??\c:\xrlrxlr.exec:\xrlrxlr.exe141⤵PID:2144
-
\??\c:\rfxflrx.exec:\rfxflrx.exe142⤵PID:1900
-
\??\c:\tnhttt.exec:\tnhttt.exe143⤵PID:1128
-
\??\c:\bnbnbb.exec:\bnbnbb.exe144⤵PID:1264
-
\??\c:\hhbbhh.exec:\hhbbhh.exe145⤵PID:1488
-
\??\c:\ppjpv.exec:\ppjpv.exe146⤵PID:1080
-
\??\c:\jvjjv.exec:\jvjjv.exe147⤵PID:412
-
\??\c:\fxrrxxl.exec:\fxrrxxl.exe148⤵PID:1728
-
\??\c:\llfrrxl.exec:\llfrrxl.exe149⤵PID:2308
-
\??\c:\tbnhnn.exec:\tbnhnn.exe150⤵PID:1980
-
\??\c:\hbbhth.exec:\hbbhth.exe151⤵PID:892
-
\??\c:\bnhnnn.exec:\bnhnnn.exe152⤵PID:1052
-
\??\c:\vpvdj.exec:\vpvdj.exe153⤵PID:2424
-
\??\c:\jpdpj.exec:\jpdpj.exe154⤵PID:1340
-
\??\c:\1lrrfrl.exec:\1lrrfrl.exe155⤵PID:900
-
\??\c:\ffrrfrx.exec:\ffrrfrx.exe156⤵PID:2372
-
\??\c:\fflrffx.exec:\fflrffx.exe157⤵PID:2984
-
\??\c:\ttnbtn.exec:\ttnbtn.exe158⤵PID:1736
-
\??\c:\9nbnnt.exec:\9nbnnt.exe159⤵PID:1596
-
\??\c:\ppdjj.exec:\ppdjj.exe160⤵PID:2296
-
\??\c:\ppdjv.exec:\ppdjv.exe161⤵PID:2608
-
\??\c:\lrrxrrx.exec:\lrrxrrx.exe162⤵PID:2020
-
\??\c:\7rffrxf.exec:\7rffrxf.exe163⤵PID:2672
-
\??\c:\rrxxrxl.exec:\rrxxrxl.exe164⤵PID:1764
-
\??\c:\btnbnn.exec:\btnbnn.exe165⤵PID:2640
-
\??\c:\hbnttb.exec:\hbnttb.exe166⤵PID:2868
-
\??\c:\1ppvd.exec:\1ppvd.exe167⤵PID:1940
-
\??\c:\vjvjj.exec:\vjvjj.exe168⤵PID:2780
-
\??\c:\7dvvd.exec:\7dvvd.exe169⤵PID:2468
-
\??\c:\xllxllf.exec:\xllxllf.exe170⤵PID:2852
-
\??\c:\5lfrxfl.exec:\5lfrxfl.exe171⤵PID:1096
-
\??\c:\bbhbnn.exec:\bbhbnn.exe172⤵PID:3064
-
\??\c:\5nbhth.exec:\5nbhth.exe173⤵PID:2872
-
\??\c:\jvjvd.exec:\jvjvd.exe174⤵PID:1332
-
\??\c:\5jpjd.exec:\5jpjd.exe175⤵PID:2864
-
\??\c:\rrflxlf.exec:\rrflxlf.exe176⤵PID:2752
-
\??\c:\ffrrrll.exec:\ffrrrll.exe177⤵PID:2988
-
\??\c:\hbnbhh.exec:\hbnbhh.exe178⤵PID:2880
-
\??\c:\nnhhtt.exec:\nnhhtt.exe179⤵PID:2332
-
\??\c:\7bnnbt.exec:\7bnnbt.exe180⤵PID:844
-
\??\c:\jjdjv.exec:\jjdjv.exe181⤵PID:2044
-
\??\c:\vppvj.exec:\vppvj.exe182⤵PID:1896
-
\??\c:\xrffflx.exec:\xrffflx.exe183⤵PID:608
-
\??\c:\rlfrxfr.exec:\rlfrxfr.exe184⤵PID:580
-
\??\c:\9xxlxfr.exec:\9xxlxfr.exe185⤵PID:540
-
\??\c:\bbnhbn.exec:\bbnhbn.exe186⤵PID:240
-
\??\c:\7hbbbb.exec:\7hbbbb.exe187⤵PID:1284
-
\??\c:\3jjjd.exec:\3jjjd.exe188⤵PID:2140
-
\??\c:\9vpjj.exec:\9vpjj.exe189⤵PID:2300
-
\??\c:\lfrrflr.exec:\lfrrflr.exe190⤵PID:2436
-
\??\c:\rffflfx.exec:\rffflfx.exe191⤵PID:2012
-
\??\c:\3xxfrrr.exec:\3xxfrrr.exe192⤵PID:1680
-
\??\c:\hbtbnb.exec:\hbtbnb.exe193⤵PID:1068
-
\??\c:\tbnntb.exec:\tbnntb.exe194⤵PID:2088
-
\??\c:\jjdvp.exec:\jjdvp.exe195⤵PID:2288
-
\??\c:\jdvdp.exec:\jdvdp.exe196⤵PID:1952
-
\??\c:\lfxflrf.exec:\lfxflrf.exe197⤵PID:1156
-
\??\c:\xflflxx.exec:\xflflxx.exe198⤵PID:2980
-
\??\c:\9tbbht.exec:\9tbbht.exe199⤵PID:1712
-
\??\c:\hbttbh.exec:\hbttbh.exe200⤵PID:1628
-
\??\c:\dvdjp.exec:\dvdjp.exe201⤵PID:2148
-
\??\c:\ppjjd.exec:\ppjjd.exe202⤵PID:2068
-
\??\c:\fxxrrrf.exec:\fxxrrrf.exe203⤵PID:2560
-
\??\c:\xxrxrxr.exec:\xxrxrxr.exe204⤵PID:2268
-
\??\c:\7fffrrl.exec:\7fffrrl.exe205⤵PID:1420
-
\??\c:\tttbnt.exec:\tttbnt.exe206⤵PID:2804
-
\??\c:\bbtbnt.exec:\bbtbnt.exe207⤵PID:1184
-
\??\c:\ddvjp.exec:\ddvjp.exe208⤵PID:2756
-
\??\c:\9jjvp.exec:\9jjvp.exe209⤵PID:2632
-
\??\c:\1pjvj.exec:\1pjvj.exe210⤵PID:3028
-
\??\c:\3rrlrxl.exec:\3rrlrxl.exe211⤵PID:2856
-
\??\c:\7rxxrfx.exec:\7rxxrfx.exe212⤵PID:1740
-
\??\c:\tbhnhn.exec:\tbhnhn.exe213⤵PID:2900
-
\??\c:\bbtbnt.exec:\bbtbnt.exe214⤵PID:2568
-
\??\c:\1vpvp.exec:\1vpvp.exe215⤵PID:1136
-
\??\c:\dvppv.exec:\dvppv.exe216⤵PID:2740
-
\??\c:\djddj.exec:\djddj.exe217⤵PID:3036
-
\??\c:\xfxxflr.exec:\xfxxflr.exe218⤵PID:2904
-
\??\c:\llfrxfr.exec:\llfrxfr.exe219⤵PID:3016
-
\??\c:\bbhtbh.exec:\bbhtbh.exe220⤵PID:3048
-
\??\c:\hbbhbb.exec:\hbbhbb.exe221⤵PID:1644
-
\??\c:\jjjpj.exec:\jjjpj.exe222⤵PID:1800
-
\??\c:\rxllfxx.exec:\rxllfxx.exe223⤵PID:1276
-
\??\c:\llflxfl.exec:\llflxfl.exe224⤵PID:1456
-
\??\c:\tthnth.exec:\tthnth.exe225⤵PID:588
-
\??\c:\hhtbnb.exec:\hhtbnb.exe226⤵PID:812
-
\??\c:\5nhtbh.exec:\5nhtbh.exe227⤵PID:1476
-
\??\c:\pjdpd.exec:\pjdpd.exe228⤵PID:384
-
\??\c:\jdvdj.exec:\jdvdj.exe229⤵PID:800
-
\??\c:\rrfrlrf.exec:\rrfrlrf.exe230⤵PID:1676
-
\??\c:\3xlrxxx.exec:\3xlrxxx.exe231⤵PID:1728
-
\??\c:\btttbb.exec:\btttbb.exe232⤵PID:668
-
\??\c:\tnttbh.exec:\tnttbh.exe233⤵PID:1980
-
\??\c:\jpdjp.exec:\jpdjp.exe234⤵PID:1528
-
\??\c:\9vdjd.exec:\9vdjd.exe235⤵PID:2160
-
\??\c:\fxrxllr.exec:\fxrxllr.exe236⤵PID:948
-
\??\c:\xlfflll.exec:\xlfflll.exe237⤵PID:2260
-
\??\c:\nhtbhn.exec:\nhtbhn.exe238⤵PID:1732
-
\??\c:\1btbhn.exec:\1btbhn.exe239⤵PID:1664
-
\??\c:\vvpjd.exec:\vvpjd.exe240⤵PID:1936
-
\??\c:\dvpvd.exec:\dvpvd.exe241⤵PID:2912
-
\??\c:\rllxxlr.exec:\rllxxlr.exe242⤵PID:2924