Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 13:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cc52a3035d9ca90f37f132fecb377dd0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
cc52a3035d9ca90f37f132fecb377dd0_NeikiAnalytics.exe
-
Size
77KB
-
MD5
cc52a3035d9ca90f37f132fecb377dd0
-
SHA1
c5e2d2d660ed13d746fc0ae4becfa0e17fa41c1d
-
SHA256
540430fc01961d14776753abd313eb49e45130603a3192de798e8c0d842d2ff4
-
SHA512
b23cb46ab8be3428f012b1b8922dc2e109bc56e3283d2b589af7fc6386c18ab374911a4b9e79b2e34bf81a0a12423989075e213596207a835aeb2450f7105e28
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo7xCkTsIwtOa2dOYz:ymb3NkkiQ3mdBjFo7LAIbTz
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/2328-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1840-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1208-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2004-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1684-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/932-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1424-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1836-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
djjdd.exefffllll.exentthth.exedjpdd.exerlxflrf.exe9xxfrlx.exe1thntb.exe5jjpv.exe9vvdp.exe9xffrfl.exetntnbt.exebnbbnt.exepdjpv.exedvjvv.exerlfxxxf.exe9rxfllr.exe3nbbhn.exe7vjvj.exevpjpd.exe1xrxllx.exe1frflrf.exettnbnb.exe9vvjv.exe9xrrrxl.exexxrxllx.exe1hthnn.exejjdpv.exevpvpp.exellfflrf.exetnbhtb.exenhtbnn.exe5jvvv.exevjvvd.exelxlxxlf.exettnthn.exebthttb.exeppvdp.exedpjpv.exelfxrlfr.exebtnnbn.exenhtbnt.exebthntt.exedpddv.exelxlffxf.exe3rrxfrf.exehtbntt.exehtbttt.exejvvvp.exefxrrfrr.exerflrrxf.exennnnbt.exettnbtb.exejvjjp.exevjdvv.exe7flfffl.exerfrrlfl.exe1hbhhh.exehthhnn.exedpddj.exepvddp.exerlfrxfr.exefxfrxrx.exebntbbt.exenbnnbh.exepid process 1740 djjdd.exe 2836 fffllll.exe 1840 ntthth.exe 2572 djpdd.exe 2788 rlxflrf.exe 2540 9xxfrlx.exe 2664 1thntb.exe 2440 5jjpv.exe 2872 9vvdp.exe 2204 9xffrfl.exe 1208 tntnbt.exe 2004 bnbbnt.exe 1572 pdjpv.exe 1684 dvjvv.exe 932 rlfxxxf.exe 2708 9rxfllr.exe 2856 3nbbhn.exe 2000 7vjvj.exe 2068 vpjpd.exe 1932 1xrxllx.exe 2016 1frflrf.exe 2600 ttnbnb.exe 1424 9vvjv.exe 1836 9xrrrxl.exe 1152 xxrxllx.exe 1540 1hthnn.exe 376 jjdpv.exe 604 vpvpp.exe 2932 llfflrf.exe 2012 tnbhtb.exe 3060 nhtbnn.exe 1728 5jvvv.exe 2332 vjvvd.exe 2852 lxlxxlf.exe 1664 ttnthn.exe 2144 bthttb.exe 2820 ppvdp.exe 2116 dpjpv.exe 2636 lfxrlfr.exe 2616 btnnbn.exe 2576 nhtbnt.exe 2684 bthntt.exe 2592 dpddv.exe 2408 lxlffxf.exe 1660 3rrxfrf.exe 2440 htbntt.exe 2864 htbttt.exe 1320 jvvvp.exe 2676 fxrrfrr.exe 1748 rflrrxf.exe 1612 nnnnbt.exe 1944 ttnbtb.exe 1684 jvjjp.exe 1668 vjdvv.exe 2712 7flfffl.exe 1244 rfrrlfl.exe 2856 1hbhhh.exe 2064 hthhnn.exe 1984 dpddj.exe 2008 pvddp.exe 768 rlfrxfr.exe 868 fxfrxrx.exe 1416 bntbbt.exe 1148 nbnnbh.exe -
Processes:
resource yara_rule behavioral1/memory/2328-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1840-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1208-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2004-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1684-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/932-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1424-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1836-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-303-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cc52a3035d9ca90f37f132fecb377dd0_NeikiAnalytics.exedjjdd.exefffllll.exentthth.exedjpdd.exerlxflrf.exe9xxfrlx.exe1thntb.exe5jjpv.exe9vvdp.exe9xffrfl.exetntnbt.exebnbbnt.exepdjpv.exedvjvv.exerlfxxxf.exedescription pid process target process PID 2328 wrote to memory of 1740 2328 cc52a3035d9ca90f37f132fecb377dd0_NeikiAnalytics.exe djjdd.exe PID 2328 wrote to memory of 1740 2328 cc52a3035d9ca90f37f132fecb377dd0_NeikiAnalytics.exe djjdd.exe PID 2328 wrote to memory of 1740 2328 cc52a3035d9ca90f37f132fecb377dd0_NeikiAnalytics.exe djjdd.exe PID 2328 wrote to memory of 1740 2328 cc52a3035d9ca90f37f132fecb377dd0_NeikiAnalytics.exe djjdd.exe PID 1740 wrote to memory of 2836 1740 djjdd.exe fffllll.exe PID 1740 wrote to memory of 2836 1740 djjdd.exe fffllll.exe PID 1740 wrote to memory of 2836 1740 djjdd.exe fffllll.exe PID 1740 wrote to memory of 2836 1740 djjdd.exe fffllll.exe PID 2836 wrote to memory of 1840 2836 fffllll.exe ntthth.exe PID 2836 wrote to memory of 1840 2836 fffllll.exe ntthth.exe PID 2836 wrote to memory of 1840 2836 fffllll.exe ntthth.exe PID 2836 wrote to memory of 1840 2836 fffllll.exe ntthth.exe PID 1840 wrote to memory of 2572 1840 ntthth.exe djpdd.exe PID 1840 wrote to memory of 2572 1840 ntthth.exe djpdd.exe PID 1840 wrote to memory of 2572 1840 ntthth.exe djpdd.exe PID 1840 wrote to memory of 2572 1840 ntthth.exe djpdd.exe PID 2572 wrote to memory of 2788 2572 djpdd.exe rlxflrf.exe PID 2572 wrote to memory of 2788 2572 djpdd.exe rlxflrf.exe PID 2572 wrote to memory of 2788 2572 djpdd.exe rlxflrf.exe PID 2572 wrote to memory of 2788 2572 djpdd.exe rlxflrf.exe PID 2788 wrote to memory of 2540 2788 rlxflrf.exe 9xxfrlx.exe PID 2788 wrote to memory of 2540 2788 rlxflrf.exe 9xxfrlx.exe PID 2788 wrote to memory of 2540 2788 rlxflrf.exe 9xxfrlx.exe PID 2788 wrote to memory of 2540 2788 rlxflrf.exe 9xxfrlx.exe PID 2540 wrote to memory of 2664 2540 9xxfrlx.exe 1thntb.exe PID 2540 wrote to memory of 2664 2540 9xxfrlx.exe 1thntb.exe PID 2540 wrote to memory of 2664 2540 9xxfrlx.exe 1thntb.exe PID 2540 wrote to memory of 2664 2540 9xxfrlx.exe 1thntb.exe PID 2664 wrote to memory of 2440 2664 1thntb.exe 5jjpv.exe PID 2664 wrote to memory of 2440 2664 1thntb.exe 5jjpv.exe PID 2664 wrote to memory of 2440 2664 1thntb.exe 5jjpv.exe PID 2664 wrote to memory of 2440 2664 1thntb.exe 5jjpv.exe PID 2440 wrote to memory of 2872 2440 5jjpv.exe 9vvdp.exe PID 2440 wrote to memory of 2872 2440 5jjpv.exe 9vvdp.exe PID 2440 wrote to memory of 2872 2440 5jjpv.exe 9vvdp.exe PID 2440 wrote to memory of 2872 2440 5jjpv.exe 9vvdp.exe PID 2872 wrote to memory of 2204 2872 9vvdp.exe 9xffrfl.exe PID 2872 wrote to memory of 2204 2872 9vvdp.exe 9xffrfl.exe PID 2872 wrote to memory of 2204 2872 9vvdp.exe 9xffrfl.exe PID 2872 wrote to memory of 2204 2872 9vvdp.exe 9xffrfl.exe PID 2204 wrote to memory of 1208 2204 9xffrfl.exe tntnbt.exe PID 2204 wrote to memory of 1208 2204 9xffrfl.exe tntnbt.exe PID 2204 wrote to memory of 1208 2204 9xffrfl.exe tntnbt.exe PID 2204 wrote to memory of 1208 2204 9xffrfl.exe tntnbt.exe PID 1208 wrote to memory of 2004 1208 tntnbt.exe bnbbnt.exe PID 1208 wrote to memory of 2004 1208 tntnbt.exe bnbbnt.exe PID 1208 wrote to memory of 2004 1208 tntnbt.exe bnbbnt.exe PID 1208 wrote to memory of 2004 1208 tntnbt.exe bnbbnt.exe PID 2004 wrote to memory of 1572 2004 bnbbnt.exe pdjpv.exe PID 2004 wrote to memory of 1572 2004 bnbbnt.exe pdjpv.exe PID 2004 wrote to memory of 1572 2004 bnbbnt.exe pdjpv.exe PID 2004 wrote to memory of 1572 2004 bnbbnt.exe pdjpv.exe PID 1572 wrote to memory of 1684 1572 pdjpv.exe dvjvv.exe PID 1572 wrote to memory of 1684 1572 pdjpv.exe dvjvv.exe PID 1572 wrote to memory of 1684 1572 pdjpv.exe dvjvv.exe PID 1572 wrote to memory of 1684 1572 pdjpv.exe dvjvv.exe PID 1684 wrote to memory of 932 1684 dvjvv.exe rlfxxxf.exe PID 1684 wrote to memory of 932 1684 dvjvv.exe rlfxxxf.exe PID 1684 wrote to memory of 932 1684 dvjvv.exe rlfxxxf.exe PID 1684 wrote to memory of 932 1684 dvjvv.exe rlfxxxf.exe PID 932 wrote to memory of 2708 932 rlfxxxf.exe 9rxfllr.exe PID 932 wrote to memory of 2708 932 rlfxxxf.exe 9rxfllr.exe PID 932 wrote to memory of 2708 932 rlfxxxf.exe 9rxfllr.exe PID 932 wrote to memory of 2708 932 rlfxxxf.exe 9rxfllr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc52a3035d9ca90f37f132fecb377dd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\cc52a3035d9ca90f37f132fecb377dd0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\djjdd.exec:\djjdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\fffllll.exec:\fffllll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\ntthth.exec:\ntthth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\djpdd.exec:\djpdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\rlxflrf.exec:\rlxflrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\9xxfrlx.exec:\9xxfrlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\1thntb.exec:\1thntb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\5jjpv.exec:\5jjpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\9vvdp.exec:\9vvdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\9xffrfl.exec:\9xffrfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\tntnbt.exec:\tntnbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\bnbbnt.exec:\bnbbnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\pdjpv.exec:\pdjpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\dvjvv.exec:\dvjvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\rlfxxxf.exec:\rlfxxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
\??\c:\9rxfllr.exec:\9rxfllr.exe17⤵
- Executes dropped EXE
PID:2708 -
\??\c:\3nbbhn.exec:\3nbbhn.exe18⤵
- Executes dropped EXE
PID:2856 -
\??\c:\7vjvj.exec:\7vjvj.exe19⤵
- Executes dropped EXE
PID:2000 -
\??\c:\vpjpd.exec:\vpjpd.exe20⤵
- Executes dropped EXE
PID:2068 -
\??\c:\1xrxllx.exec:\1xrxllx.exe21⤵
- Executes dropped EXE
PID:1932 -
\??\c:\1frflrf.exec:\1frflrf.exe22⤵
- Executes dropped EXE
PID:2016 -
\??\c:\ttnbnb.exec:\ttnbnb.exe23⤵
- Executes dropped EXE
PID:2600 -
\??\c:\9vvjv.exec:\9vvjv.exe24⤵
- Executes dropped EXE
PID:1424 -
\??\c:\9xrrrxl.exec:\9xrrrxl.exe25⤵
- Executes dropped EXE
PID:1836 -
\??\c:\xxrxllx.exec:\xxrxllx.exe26⤵
- Executes dropped EXE
PID:1152 -
\??\c:\1hthnn.exec:\1hthnn.exe27⤵
- Executes dropped EXE
PID:1540 -
\??\c:\jjdpv.exec:\jjdpv.exe28⤵
- Executes dropped EXE
PID:376 -
\??\c:\vpvpp.exec:\vpvpp.exe29⤵
- Executes dropped EXE
PID:604 -
\??\c:\llfflrf.exec:\llfflrf.exe30⤵
- Executes dropped EXE
PID:2932 -
\??\c:\tnbhtb.exec:\tnbhtb.exe31⤵
- Executes dropped EXE
PID:2012 -
\??\c:\nhtbnn.exec:\nhtbnn.exe32⤵
- Executes dropped EXE
PID:3060 -
\??\c:\5jvvv.exec:\5jvvv.exe33⤵
- Executes dropped EXE
PID:1728 -
\??\c:\vjvvd.exec:\vjvvd.exe34⤵
- Executes dropped EXE
PID:2332 -
\??\c:\lxlxxlf.exec:\lxlxxlf.exe35⤵
- Executes dropped EXE
PID:2852 -
\??\c:\ttnthn.exec:\ttnthn.exe36⤵
- Executes dropped EXE
PID:1664 -
\??\c:\bthttb.exec:\bthttb.exe37⤵
- Executes dropped EXE
PID:2144 -
\??\c:\ppvdp.exec:\ppvdp.exe38⤵
- Executes dropped EXE
PID:2820 -
\??\c:\dpjpv.exec:\dpjpv.exe39⤵
- Executes dropped EXE
PID:2116 -
\??\c:\lfxrlfr.exec:\lfxrlfr.exe40⤵
- Executes dropped EXE
PID:2636 -
\??\c:\btnnbn.exec:\btnnbn.exe41⤵
- Executes dropped EXE
PID:2616 -
\??\c:\nhtbnt.exec:\nhtbnt.exe42⤵
- Executes dropped EXE
PID:2576 -
\??\c:\bthntt.exec:\bthntt.exe43⤵
- Executes dropped EXE
PID:2684 -
\??\c:\dpddv.exec:\dpddv.exe44⤵
- Executes dropped EXE
PID:2592 -
\??\c:\lxlffxf.exec:\lxlffxf.exe45⤵
- Executes dropped EXE
PID:2408 -
\??\c:\3rrxfrf.exec:\3rrxfrf.exe46⤵
- Executes dropped EXE
PID:1660 -
\??\c:\htbntt.exec:\htbntt.exe47⤵
- Executes dropped EXE
PID:2440 -
\??\c:\htbttt.exec:\htbttt.exe48⤵
- Executes dropped EXE
PID:2864 -
\??\c:\jvvvp.exec:\jvvvp.exe49⤵
- Executes dropped EXE
PID:1320 -
\??\c:\fxrrfrr.exec:\fxrrfrr.exe50⤵
- Executes dropped EXE
PID:2676 -
\??\c:\rflrrxf.exec:\rflrrxf.exe51⤵
- Executes dropped EXE
PID:1748 -
\??\c:\nnnnbt.exec:\nnnnbt.exe52⤵
- Executes dropped EXE
PID:1612 -
\??\c:\ttnbtb.exec:\ttnbtb.exe53⤵
- Executes dropped EXE
PID:1944 -
\??\c:\jvjjp.exec:\jvjjp.exe54⤵
- Executes dropped EXE
PID:1684 -
\??\c:\vjdvv.exec:\vjdvv.exe55⤵
- Executes dropped EXE
PID:1668 -
\??\c:\7flfffl.exec:\7flfffl.exe56⤵
- Executes dropped EXE
PID:2712 -
\??\c:\rfrrlfl.exec:\rfrrlfl.exe57⤵
- Executes dropped EXE
PID:1244 -
\??\c:\1hbhhh.exec:\1hbhhh.exe58⤵
- Executes dropped EXE
PID:2856 -
\??\c:\hthhnn.exec:\hthhnn.exe59⤵
- Executes dropped EXE
PID:2064 -
\??\c:\dpddj.exec:\dpddj.exe60⤵
- Executes dropped EXE
PID:1984 -
\??\c:\pvddp.exec:\pvddp.exe61⤵
- Executes dropped EXE
PID:2008 -
\??\c:\rlfrxfr.exec:\rlfrxfr.exe62⤵
- Executes dropped EXE
PID:768 -
\??\c:\fxfrxrx.exec:\fxfrxrx.exe63⤵
- Executes dropped EXE
PID:868 -
\??\c:\bntbbt.exec:\bntbbt.exe64⤵
- Executes dropped EXE
PID:1416 -
\??\c:\nbnnbh.exec:\nbnnbh.exe65⤵
- Executes dropped EXE
PID:1148 -
\??\c:\3thnnt.exec:\3thnnt.exe66⤵PID:696
-
\??\c:\1vvvp.exec:\1vvvp.exe67⤵PID:2356
-
\??\c:\dpjpd.exec:\dpjpd.exe68⤵PID:1956
-
\??\c:\rflffff.exec:\rflffff.exe69⤵PID:1784
-
\??\c:\xrfxrlr.exec:\xrfxrlr.exe70⤵PID:1880
-
\??\c:\bhbbbt.exec:\bhbbbt.exe71⤵PID:1604
-
\??\c:\9thnbn.exec:\9thnbn.exe72⤵PID:3024
-
\??\c:\djddd.exec:\djddd.exe73⤵PID:2924
-
\??\c:\vjvvp.exec:\vjvvp.exe74⤵PID:1136
-
\??\c:\jpdvp.exec:\jpdvp.exe75⤵PID:1724
-
\??\c:\rlxrrrx.exec:\rlxrrrx.exe76⤵PID:2296
-
\??\c:\rlxrxxr.exec:\rlxrxxr.exe77⤵PID:1692
-
\??\c:\thtttt.exec:\thtttt.exe78⤵PID:2896
-
\??\c:\nbnbbb.exec:\nbnbbb.exe79⤵PID:1028
-
\??\c:\djdjp.exec:\djdjp.exe80⤵PID:2900
-
\??\c:\3jjjj.exec:\3jjjj.exe81⤵PID:2916
-
\??\c:\lfrxxfx.exec:\lfrxxfx.exe82⤵PID:1688
-
\??\c:\rlxxfxx.exec:\rlxxfxx.exe83⤵PID:2652
-
\??\c:\nbhhhh.exec:\nbhhhh.exe84⤵PID:2620
-
\??\c:\tnbttb.exec:\tnbttb.exe85⤵PID:2788
-
\??\c:\7jdvd.exec:\7jdvd.exe86⤵PID:2560
-
\??\c:\pdjpv.exec:\pdjpv.exe87⤵PID:2388
-
\??\c:\rllrxxf.exec:\rllrxxf.exe88⤵PID:2588
-
\??\c:\fxrxlll.exec:\fxrxlll.exe89⤵PID:2432
-
\??\c:\nhthhn.exec:\nhthhn.exe90⤵PID:2880
-
\??\c:\9hhbht.exec:\9hhbht.exe91⤵PID:1856
-
\??\c:\7bbbth.exec:\7bbbth.exe92⤵PID:2436
-
\??\c:\jjvjv.exec:\jjvjv.exe93⤵PID:1452
-
\??\c:\ppjvd.exec:\ppjvd.exe94⤵PID:1496
-
\??\c:\rfxxffr.exec:\rfxxffr.exe95⤵PID:1620
-
\??\c:\5lfrffr.exec:\5lfrffr.exe96⤵PID:1352
-
\??\c:\7nhbbb.exec:\7nhbbb.exe97⤵PID:1512
-
\??\c:\bnbttt.exec:\bnbttt.exe98⤵PID:2876
-
\??\c:\dvppd.exec:\dvppd.exe99⤵PID:1180
-
\??\c:\ddjvp.exec:\ddjvp.exe100⤵PID:1392
-
\??\c:\dvddj.exec:\dvddj.exe101⤵PID:1752
-
\??\c:\lxrrllr.exec:\lxrrllr.exe102⤵PID:1172
-
\??\c:\lflrrrf.exec:\lflrrrf.exe103⤵PID:2088
-
\??\c:\nbhhtt.exec:\nbhhtt.exe104⤵PID:484
-
\??\c:\tnbtbt.exec:\tnbtbt.exe105⤵PID:1108
-
\??\c:\vvpjd.exec:\vvpjd.exe106⤵PID:1632
-
\??\c:\9jjpd.exec:\9jjpd.exe107⤵PID:644
-
\??\c:\vvppd.exec:\vvppd.exe108⤵PID:1868
-
\??\c:\xrlrrrf.exec:\xrlrrrf.exe109⤵PID:780
-
\??\c:\rlflxxl.exec:\rlflxxl.exe110⤵PID:2920
-
\??\c:\nhbnbh.exec:\nhbnbh.exe111⤵PID:1060
-
\??\c:\5tnhnt.exec:\5tnhnt.exe112⤵PID:1124
-
\??\c:\dvpdv.exec:\dvpdv.exe113⤵PID:3036
-
\??\c:\dvpdj.exec:\dvpdj.exe114⤵PID:3068
-
\??\c:\fxxfrlr.exec:\fxxfrlr.exe115⤵PID:564
-
\??\c:\lxllrrf.exec:\lxllrrf.exe116⤵PID:2956
-
\??\c:\5htttb.exec:\5htttb.exe117⤵PID:880
-
\??\c:\hthtbt.exec:\hthtbt.exe118⤵PID:3032
-
\??\c:\7pvvv.exec:\7pvvv.exe119⤵PID:2992
-
\??\c:\jpdvv.exec:\jpdvv.exe120⤵PID:2332
-
\??\c:\3fflrrx.exec:\3fflrrx.exe121⤵PID:2340
-
\??\c:\fxllrfr.exec:\fxllrfr.exe122⤵PID:1664
-
\??\c:\bnhhhh.exec:\bnhhhh.exe123⤵PID:2892
-
\??\c:\hbnbth.exec:\hbnbth.exe124⤵PID:2624
-
\??\c:\tthhbn.exec:\tthhbn.exe125⤵PID:2528
-
\??\c:\ddpdp.exec:\ddpdp.exe126⤵PID:2556
-
\??\c:\5vpjp.exec:\5vpjp.exe127⤵PID:2660
-
\??\c:\lflxflr.exec:\lflxflr.exe128⤵PID:2576
-
\??\c:\xrfxxrr.exec:\xrfxxrr.exe129⤵PID:2684
-
\??\c:\3tnhnb.exec:\3tnhnb.exe130⤵PID:2592
-
\??\c:\1nhbnh.exec:\1nhbnh.exe131⤵PID:2376
-
\??\c:\vpjjp.exec:\vpjjp.exe132⤵PID:2472
-
\??\c:\dvpvv.exec:\dvpvv.exe133⤵PID:2764
-
\??\c:\rlflrrf.exec:\rlflrrf.exe134⤵PID:2864
-
\??\c:\xrllxxl.exec:\xrllxxl.exe135⤵PID:1504
-
\??\c:\thtthb.exec:\thtthb.exe136⤵PID:1272
-
\??\c:\7nbttn.exec:\7nbttn.exe137⤵PID:2484
-
\??\c:\5dvdj.exec:\5dvdj.exe138⤵PID:1628
-
\??\c:\5lfxffl.exec:\5lfxffl.exe139⤵PID:1944
-
\??\c:\rxxlxrf.exec:\rxxlxrf.exe140⤵PID:1848
-
\??\c:\nhttbb.exec:\nhttbb.exe141⤵PID:620
-
\??\c:\bbnnnb.exec:\bbnnnb.exe142⤵PID:2756
-
\??\c:\jddvj.exec:\jddvj.exe143⤵PID:848
-
\??\c:\3pddd.exec:\3pddd.exe144⤵PID:3052
-
\??\c:\fxfxxxf.exec:\fxfxxxf.exe145⤵PID:2124
-
\??\c:\3rlrxxr.exec:\3rlrxxr.exe146⤵PID:536
-
\??\c:\bnttbb.exec:\bnttbb.exe147⤵PID:688
-
\??\c:\nhntth.exec:\nhntth.exe148⤵PID:2096
-
\??\c:\djddp.exec:\djddp.exe149⤵PID:1436
-
\??\c:\pjddj.exec:\pjddj.exe150⤵PID:2396
-
\??\c:\5xfxxxl.exec:\5xfxxxl.exe151⤵PID:1516
-
\??\c:\1rflrxf.exec:\1rflrxf.exe152⤵PID:1656
-
\??\c:\7llrfll.exec:\7llrfll.exe153⤵PID:2416
-
\??\c:\nbhhbn.exec:\nbhhbn.exe154⤵PID:496
-
\??\c:\nhhnth.exec:\nhhnth.exe155⤵PID:376
-
\??\c:\ddpjj.exec:\ddpjj.exe156⤵PID:952
-
\??\c:\dpvdd.exec:\dpvdd.exe157⤵PID:1308
-
\??\c:\rllxxxx.exec:\rllxxxx.exe158⤵PID:2040
-
\??\c:\frfrfff.exec:\frfrfff.exe159⤵PID:2032
-
\??\c:\hbthnn.exec:\hbthnn.exe160⤵PID:2288
-
\??\c:\5nbhhh.exec:\5nbhhh.exe161⤵PID:1876
-
\??\c:\ddvdj.exec:\ddvdj.exe162⤵PID:2328
-
\??\c:\pjpjj.exec:\pjpjj.exe163⤵PID:1692
-
\??\c:\fxfxxxl.exec:\fxfxxxl.exe164⤵PID:1708
-
\??\c:\fxlxfrx.exec:\fxlxfrx.exe165⤵PID:1588
-
\??\c:\xxxxlrx.exec:\xxxxlrx.exe166⤵PID:2900
-
\??\c:\7tnbnt.exec:\7tnbnt.exe167⤵PID:2112
-
\??\c:\bnbbbb.exec:\bnbbbb.exe168⤵PID:2628
-
\??\c:\9pjvv.exec:\9pjvv.exe169⤵PID:2636
-
\??\c:\jvjpv.exec:\jvjpv.exe170⤵PID:2456
-
\??\c:\fxffxxf.exec:\fxffxxf.exe171⤵PID:2696
-
\??\c:\rrlfxxf.exec:\rrlfxxf.exe172⤵PID:2560
-
\??\c:\lfrxlrr.exec:\lfrxlrr.exe173⤵PID:2488
-
\??\c:\tnhtnt.exec:\tnhtnt.exe174⤵PID:2496
-
\??\c:\tnnttn.exec:\tnnttn.exe175⤵PID:2984
-
\??\c:\vpdvd.exec:\vpdvd.exe176⤵PID:1640
-
\??\c:\dvjjp.exec:\dvjjp.exe177⤵PID:2108
-
\??\c:\rlffffl.exec:\rlffffl.exe178⤵PID:2760
-
\??\c:\fxrfrxl.exec:\fxrfrxl.exe179⤵PID:2308
-
\??\c:\nhhhtb.exec:\nhhhtb.exe180⤵PID:884
-
\??\c:\hbhhhn.exec:\hbhhhn.exe181⤵PID:1620
-
\??\c:\tnhntt.exec:\tnhntt.exe182⤵PID:2716
-
\??\c:\7dvvv.exec:\7dvvv.exe183⤵PID:2728
-
\??\c:\jvddv.exec:\jvddv.exe184⤵PID:1296
-
\??\c:\5rxrxrf.exec:\5rxrxrf.exe185⤵PID:1508
-
\??\c:\rlxxxfl.exec:\rlxxxfl.exe186⤵PID:1392
-
\??\c:\httttn.exec:\httttn.exe187⤵PID:2960
-
\??\c:\3bhtbt.exec:\3bhtbt.exe188⤵PID:2100
-
\??\c:\9dvjp.exec:\9dvjp.exe189⤵PID:2292
-
\??\c:\jdvjv.exec:\jdvjv.exe190⤵PID:484
-
\??\c:\xrfllll.exec:\xrfllll.exe191⤵PID:1020
-
\??\c:\9rflllx.exec:\9rflllx.exe192⤵PID:768
-
\??\c:\7bntnt.exec:\7bntnt.exe193⤵PID:808
-
\??\c:\5bbhnn.exec:\5bbhnn.exe194⤵PID:1868
-
\??\c:\vpdjp.exec:\vpdjp.exe195⤵PID:1064
-
\??\c:\jdpjj.exec:\jdpjj.exe196⤵PID:1240
-
\??\c:\7jvvd.exec:\7jvvd.exe197⤵PID:1060
-
\??\c:\lffllrx.exec:\lffllrx.exe198⤵PID:1124
-
\??\c:\lflrxfl.exec:\lflrxfl.exe199⤵PID:3012
-
\??\c:\1nhnbb.exec:\1nhnbb.exe200⤵PID:2504
-
\??\c:\httbht.exec:\httbht.exe201⤵PID:2932
-
\??\c:\dvpvd.exec:\dvpvd.exe202⤵PID:2256
-
\??\c:\jjvjv.exec:\jjvjv.exe203⤵PID:2908
-
\??\c:\lfrxflx.exec:\lfrxflx.exe204⤵PID:3032
-
\??\c:\1lxfffl.exec:\1lxfffl.exe205⤵PID:2036
-
\??\c:\ffxlxlr.exec:\ffxlxlr.exe206⤵PID:2332
-
\??\c:\3hbhtb.exec:\3hbhtb.exe207⤵PID:2944
-
\??\c:\hbbhtb.exec:\hbbhtb.exe208⤵PID:1664
-
\??\c:\7jdvd.exec:\7jdvd.exe209⤵PID:1840
-
\??\c:\jjvdp.exec:\jjvdp.exe210⤵PID:2624
-
\??\c:\3pjjd.exec:\3pjjd.exe211⤵PID:2116
-
\??\c:\frlrxxf.exec:\frlrxxf.exe212⤵PID:2260
-
\??\c:\tnbhhn.exec:\tnbhhn.exe213⤵PID:2660
-
\??\c:\bbtbhn.exec:\bbtbhn.exe214⤵PID:2940
-
\??\c:\jjvdj.exec:\jjvdj.exe215⤵PID:2684
-
\??\c:\dvjdj.exec:\dvjdj.exe216⤵PID:2412
-
\??\c:\7xlxllr.exec:\7xlxllr.exe217⤵PID:2936
-
\??\c:\lfrxflr.exec:\lfrxflr.exe218⤵PID:1660
-
\??\c:\dvjdd.exec:\dvjdd.exe219⤵PID:1644
-
\??\c:\5ddvd.exec:\5ddvd.exe220⤵PID:1720
-
\??\c:\flrxlxf.exec:\flrxlxf.exe221⤵PID:1320
-
\??\c:\1lrrxrx.exec:\1lrrxrx.exe222⤵PID:944
-
\??\c:\nbtthb.exec:\nbtthb.exe223⤵PID:2484
-
\??\c:\9bbbhn.exec:\9bbbhn.exe224⤵PID:1628
-
\??\c:\dvjjj.exec:\dvjjj.exe225⤵PID:2732
-
\??\c:\vvjjj.exec:\vvjjj.exe226⤵PID:1848
-
\??\c:\5xfrxfl.exec:\5xfrxfl.exe227⤵PID:940
-
\??\c:\xrxfrrx.exec:\xrxfrrx.exe228⤵PID:2092
-
\??\c:\nbnthn.exec:\nbnthn.exe229⤵PID:848
-
\??\c:\hhhbnh.exec:\hhhbnh.exe230⤵PID:1096
-
\??\c:\vvjjp.exec:\vvjjp.exe231⤵PID:2124
-
\??\c:\jvjjv.exec:\jvjjv.exe232⤵PID:528
-
\??\c:\3vjvv.exec:\3vjvv.exe233⤵PID:748
-
\??\c:\lflrlrx.exec:\lflrlrx.exe234⤵PID:1052
-
\??\c:\frflllf.exec:\frflllf.exe235⤵PID:1424
-
\??\c:\lflffrr.exec:\lflffrr.exe236⤵PID:448
-
\??\c:\tbnnnb.exec:\tbnnnb.exe237⤵PID:1148
-
\??\c:\btbtbb.exec:\btbtbb.exe238⤵PID:1736
-
\??\c:\3vvvd.exec:\3vvvd.exe239⤵PID:2416
-
\??\c:\pdvvj.exec:\pdvvj.exe240⤵PID:1420
-
\??\c:\frlxxxf.exec:\frlxxxf.exe241⤵PID:1784
-
\??\c:\1lllffl.exec:\1lllffl.exe242⤵PID:2772