Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 14:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
da5699edeb93f7e8aaf571b69eb53400_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
da5699edeb93f7e8aaf571b69eb53400_NeikiAnalytics.exe
-
Size
966KB
-
MD5
da5699edeb93f7e8aaf571b69eb53400
-
SHA1
af6962ee16b5b76154e3768a97a96de049eb5be8
-
SHA256
5e50836ba5b9b2a6c9ff6face60107c5d419f433d0473742fd023ab233066806
-
SHA512
814b37604b55481c39a21b6b138b111007b488eeba6c8aedd93834e604488147b793b9dcefa7f9a8a42f7d8cd6cdcea97efdf533b5397bc038a628e17c22ea74
-
SSDEEP
12288:n3C9yMo+S0L9xRnoq7H9xqYL04iVypNKvzcMwdBS3b3aoqYveXVadBlHD+CURPO0:SgD4bhoqLDqYLagB6Wj1+CysF
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/2168-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2248-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2252-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2384-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2076-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1432-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2344-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1824-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1752-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/804-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2132-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/112-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2356-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2980-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
hbntht.exefrlfxrf.exejdvdp.exefxllffr.exe7lxfrxf.exebtbhhn.exe5hhntt.exe3djdd.exenbhttb.exepjvjj.exe5nbhnn.exejvdjv.exe5pdjp.exe1nnnbt.exe3lrxxxl.exe3tntnt.exelxxxrxx.exehhttbt.exefllllrl.exehnhnbh.exe5rfrxff.exebtbbtt.exefxxffff.exe7thbtb.exelxllflr.exehbtbnn.exettbbbb.exerflllrl.exetbtnbb.exepppjp.exefrrxllf.exe1hbbtb.exebnhbtn.exejjvdd.exexlllrlr.exebnbhtn.exehthhnn.exepjppp.exefrllxrr.exenbnhht.exevpdvp.exerlxxxlr.exentttbt.exe1bnhth.exejvppp.exe5xlflrx.exehbnnbh.exe7dpjd.exe1lfffff.exe3thnbh.exe1dvvv.exevpjvd.exexrxxxxx.exehbnnbt.exepdppp.exexrfxffr.exelxxxfrr.exethnnhb.exedpvdd.exe7xlllxx.exenbttbn.exejpjjv.exe9xrrlrf.exe7fflrrx.exepid process 2248 hbntht.exe 2932 frlfxrf.exe 2252 jdvdp.exe 2672 fxllffr.exe 2588 7lxfrxf.exe 2384 btbhhn.exe 2620 5hhntt.exe 2468 3djdd.exe 2520 nbhttb.exe 2076 pjvjj.exe 1432 5nbhnn.exe 2056 jvdjv.exe 2344 5pdjp.exe 1824 1nnnbt.exe 1752 3lrxxxl.exe 804 3tntnt.exe 2440 lxxxrxx.exe 2784 hhttbt.exe 2412 fllllrl.exe 1964 hnhnbh.exe 1112 5rfrxff.exe 1912 btbbtt.exe 360 fxxffff.exe 2920 7thbtb.exe 2132 lxllflr.exe 984 hbtbnn.exe 3040 ttbbbb.exe 112 rflllrl.exe 2356 tbtnbb.exe 2980 pppjp.exe 2976 frrxllf.exe 1876 1hbbtb.exe 1608 bnhbtn.exe 1812 jjvdd.exe 2248 xlllrlr.exe 2908 bnbhtn.exe 2932 hthhnn.exe 2696 pjppp.exe 2612 frllxrr.exe 2712 nbnhht.exe 2476 vpdvp.exe 2568 rlxxxlr.exe 2496 ntttbt.exe 2456 1bnhth.exe 2468 jvppp.exe 2388 5xlflrx.exe 2020 hbnnbh.exe 1616 7dpjd.exe 2188 1lfffff.exe 2056 3thnbh.exe 1092 1dvvv.exe 1080 vpjvd.exe 936 xrxxxxx.exe 1636 hbnnbt.exe 804 pdppp.exe 2544 xrfxffr.exe 2396 lxxxfrr.exe 2492 thnnhb.exe 488 dpvdd.exe 1112 7xlllxx.exe 1284 nbttbn.exe 2336 jpjjv.exe 1528 9xrrlrf.exe 2208 7fflrrx.exe -
Processes:
resource yara_rule behavioral1/memory/2168-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2248-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2252-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2076-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1432-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1824-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/804-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2132-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/112-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-288-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
da5699edeb93f7e8aaf571b69eb53400_NeikiAnalytics.exehbntht.exefrlfxrf.exejdvdp.exefxllffr.exe7lxfrxf.exebtbhhn.exe5hhntt.exe3djdd.exenbhttb.exepjvjj.exe5nbhnn.exejvdjv.exe5pdjp.exe1nnnbt.exe3lrxxxl.exedescription pid process target process PID 2168 wrote to memory of 2248 2168 da5699edeb93f7e8aaf571b69eb53400_NeikiAnalytics.exe hbntht.exe PID 2168 wrote to memory of 2248 2168 da5699edeb93f7e8aaf571b69eb53400_NeikiAnalytics.exe hbntht.exe PID 2168 wrote to memory of 2248 2168 da5699edeb93f7e8aaf571b69eb53400_NeikiAnalytics.exe hbntht.exe PID 2168 wrote to memory of 2248 2168 da5699edeb93f7e8aaf571b69eb53400_NeikiAnalytics.exe hbntht.exe PID 2248 wrote to memory of 2932 2248 hbntht.exe frlfxrf.exe PID 2248 wrote to memory of 2932 2248 hbntht.exe frlfxrf.exe PID 2248 wrote to memory of 2932 2248 hbntht.exe frlfxrf.exe PID 2248 wrote to memory of 2932 2248 hbntht.exe frlfxrf.exe PID 2932 wrote to memory of 2252 2932 frlfxrf.exe jdvdp.exe PID 2932 wrote to memory of 2252 2932 frlfxrf.exe jdvdp.exe PID 2932 wrote to memory of 2252 2932 frlfxrf.exe jdvdp.exe PID 2932 wrote to memory of 2252 2932 frlfxrf.exe jdvdp.exe PID 2252 wrote to memory of 2672 2252 jdvdp.exe fxllffr.exe PID 2252 wrote to memory of 2672 2252 jdvdp.exe fxllffr.exe PID 2252 wrote to memory of 2672 2252 jdvdp.exe fxllffr.exe PID 2252 wrote to memory of 2672 2252 jdvdp.exe fxllffr.exe PID 2672 wrote to memory of 2588 2672 fxllffr.exe 7lxfrxf.exe PID 2672 wrote to memory of 2588 2672 fxllffr.exe 7lxfrxf.exe PID 2672 wrote to memory of 2588 2672 fxllffr.exe 7lxfrxf.exe PID 2672 wrote to memory of 2588 2672 fxllffr.exe 7lxfrxf.exe PID 2588 wrote to memory of 2384 2588 7lxfrxf.exe btbhhn.exe PID 2588 wrote to memory of 2384 2588 7lxfrxf.exe btbhhn.exe PID 2588 wrote to memory of 2384 2588 7lxfrxf.exe btbhhn.exe PID 2588 wrote to memory of 2384 2588 7lxfrxf.exe btbhhn.exe PID 2384 wrote to memory of 2620 2384 btbhhn.exe 5hhntt.exe PID 2384 wrote to memory of 2620 2384 btbhhn.exe 5hhntt.exe PID 2384 wrote to memory of 2620 2384 btbhhn.exe 5hhntt.exe PID 2384 wrote to memory of 2620 2384 btbhhn.exe 5hhntt.exe PID 2620 wrote to memory of 2468 2620 5hhntt.exe 3djdd.exe PID 2620 wrote to memory of 2468 2620 5hhntt.exe 3djdd.exe PID 2620 wrote to memory of 2468 2620 5hhntt.exe 3djdd.exe PID 2620 wrote to memory of 2468 2620 5hhntt.exe 3djdd.exe PID 2468 wrote to memory of 2520 2468 3djdd.exe nbhttb.exe PID 2468 wrote to memory of 2520 2468 3djdd.exe nbhttb.exe PID 2468 wrote to memory of 2520 2468 3djdd.exe nbhttb.exe PID 2468 wrote to memory of 2520 2468 3djdd.exe nbhttb.exe PID 2520 wrote to memory of 2076 2520 nbhttb.exe pjvjj.exe PID 2520 wrote to memory of 2076 2520 nbhttb.exe pjvjj.exe PID 2520 wrote to memory of 2076 2520 nbhttb.exe pjvjj.exe PID 2520 wrote to memory of 2076 2520 nbhttb.exe pjvjj.exe PID 2076 wrote to memory of 1432 2076 pjvjj.exe 5nbhnn.exe PID 2076 wrote to memory of 1432 2076 pjvjj.exe 5nbhnn.exe PID 2076 wrote to memory of 1432 2076 pjvjj.exe 5nbhnn.exe PID 2076 wrote to memory of 1432 2076 pjvjj.exe 5nbhnn.exe PID 1432 wrote to memory of 2056 1432 5nbhnn.exe jvdjv.exe PID 1432 wrote to memory of 2056 1432 5nbhnn.exe jvdjv.exe PID 1432 wrote to memory of 2056 1432 5nbhnn.exe jvdjv.exe PID 1432 wrote to memory of 2056 1432 5nbhnn.exe jvdjv.exe PID 2056 wrote to memory of 2344 2056 jvdjv.exe 5pdjp.exe PID 2056 wrote to memory of 2344 2056 jvdjv.exe 5pdjp.exe PID 2056 wrote to memory of 2344 2056 jvdjv.exe 5pdjp.exe PID 2056 wrote to memory of 2344 2056 jvdjv.exe 5pdjp.exe PID 2344 wrote to memory of 1824 2344 5pdjp.exe 1nnnbt.exe PID 2344 wrote to memory of 1824 2344 5pdjp.exe 1nnnbt.exe PID 2344 wrote to memory of 1824 2344 5pdjp.exe 1nnnbt.exe PID 2344 wrote to memory of 1824 2344 5pdjp.exe 1nnnbt.exe PID 1824 wrote to memory of 1752 1824 1nnnbt.exe 3lrxxxl.exe PID 1824 wrote to memory of 1752 1824 1nnnbt.exe 3lrxxxl.exe PID 1824 wrote to memory of 1752 1824 1nnnbt.exe 3lrxxxl.exe PID 1824 wrote to memory of 1752 1824 1nnnbt.exe 3lrxxxl.exe PID 1752 wrote to memory of 804 1752 3lrxxxl.exe 3tntnt.exe PID 1752 wrote to memory of 804 1752 3lrxxxl.exe 3tntnt.exe PID 1752 wrote to memory of 804 1752 3lrxxxl.exe 3tntnt.exe PID 1752 wrote to memory of 804 1752 3lrxxxl.exe 3tntnt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\da5699edeb93f7e8aaf571b69eb53400_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\da5699edeb93f7e8aaf571b69eb53400_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\hbntht.exec:\hbntht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\frlfxrf.exec:\frlfxrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\jdvdp.exec:\jdvdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\fxllffr.exec:\fxllffr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\7lxfrxf.exec:\7lxfrxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\btbhhn.exec:\btbhhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\5hhntt.exec:\5hhntt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\3djdd.exec:\3djdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\nbhttb.exec:\nbhttb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\pjvjj.exec:\pjvjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\5nbhnn.exec:\5nbhnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\jvdjv.exec:\jvdjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\5pdjp.exec:\5pdjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\1nnnbt.exec:\1nnnbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\3lrxxxl.exec:\3lrxxxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\3tntnt.exec:\3tntnt.exe17⤵
- Executes dropped EXE
PID:804 -
\??\c:\lxxxrxx.exec:\lxxxrxx.exe18⤵
- Executes dropped EXE
PID:2440 -
\??\c:\hhttbt.exec:\hhttbt.exe19⤵
- Executes dropped EXE
PID:2784 -
\??\c:\fllllrl.exec:\fllllrl.exe20⤵
- Executes dropped EXE
PID:2412 -
\??\c:\hnhnbh.exec:\hnhnbh.exe21⤵
- Executes dropped EXE
PID:1964 -
\??\c:\5rfrxff.exec:\5rfrxff.exe22⤵
- Executes dropped EXE
PID:1112 -
\??\c:\btbbtt.exec:\btbbtt.exe23⤵
- Executes dropped EXE
PID:1912 -
\??\c:\fxxffff.exec:\fxxffff.exe24⤵
- Executes dropped EXE
PID:360 -
\??\c:\7thbtb.exec:\7thbtb.exe25⤵
- Executes dropped EXE
PID:2920 -
\??\c:\lxllflr.exec:\lxllflr.exe26⤵
- Executes dropped EXE
PID:2132 -
\??\c:\hbtbnn.exec:\hbtbnn.exe27⤵
- Executes dropped EXE
PID:984 -
\??\c:\ttbbbb.exec:\ttbbbb.exe28⤵
- Executes dropped EXE
PID:3040 -
\??\c:\rflllrl.exec:\rflllrl.exe29⤵
- Executes dropped EXE
PID:112 -
\??\c:\tbtnbb.exec:\tbtnbb.exe30⤵
- Executes dropped EXE
PID:2356 -
\??\c:\pppjp.exec:\pppjp.exe31⤵
- Executes dropped EXE
PID:2980 -
\??\c:\frrxllf.exec:\frrxllf.exe32⤵
- Executes dropped EXE
PID:2976 -
\??\c:\1hbbtb.exec:\1hbbtb.exe33⤵
- Executes dropped EXE
PID:1876 -
\??\c:\bnhbtn.exec:\bnhbtn.exe34⤵
- Executes dropped EXE
PID:1608 -
\??\c:\jjvdd.exec:\jjvdd.exe35⤵
- Executes dropped EXE
PID:1812 -
\??\c:\xlllrlr.exec:\xlllrlr.exe36⤵
- Executes dropped EXE
PID:2248 -
\??\c:\bnbhtn.exec:\bnbhtn.exe37⤵
- Executes dropped EXE
PID:2908 -
\??\c:\hthhnn.exec:\hthhnn.exe38⤵
- Executes dropped EXE
PID:2932 -
\??\c:\pjppp.exec:\pjppp.exe39⤵
- Executes dropped EXE
PID:2696 -
\??\c:\frllxrr.exec:\frllxrr.exe40⤵
- Executes dropped EXE
PID:2612 -
\??\c:\nbnhht.exec:\nbnhht.exe41⤵
- Executes dropped EXE
PID:2712 -
\??\c:\vpdvp.exec:\vpdvp.exe42⤵
- Executes dropped EXE
PID:2476 -
\??\c:\rlxxxlr.exec:\rlxxxlr.exe43⤵
- Executes dropped EXE
PID:2568 -
\??\c:\ntttbt.exec:\ntttbt.exe44⤵
- Executes dropped EXE
PID:2496 -
\??\c:\1bnhth.exec:\1bnhth.exe45⤵
- Executes dropped EXE
PID:2456 -
\??\c:\jvppp.exec:\jvppp.exe46⤵
- Executes dropped EXE
PID:2468 -
\??\c:\5xlflrx.exec:\5xlflrx.exe47⤵
- Executes dropped EXE
PID:2388 -
\??\c:\hbnnbh.exec:\hbnnbh.exe48⤵
- Executes dropped EXE
PID:2020 -
\??\c:\7dpjd.exec:\7dpjd.exe49⤵
- Executes dropped EXE
PID:1616 -
\??\c:\1lfffff.exec:\1lfffff.exe50⤵
- Executes dropped EXE
PID:2188 -
\??\c:\3thnbh.exec:\3thnbh.exe51⤵
- Executes dropped EXE
PID:2056 -
\??\c:\1dvvv.exec:\1dvvv.exe52⤵
- Executes dropped EXE
PID:1092 -
\??\c:\vpjvd.exec:\vpjvd.exe53⤵
- Executes dropped EXE
PID:1080 -
\??\c:\xrxxxxx.exec:\xrxxxxx.exe54⤵
- Executes dropped EXE
PID:936 -
\??\c:\hbnnbt.exec:\hbnnbt.exe55⤵
- Executes dropped EXE
PID:1636 -
\??\c:\pdppp.exec:\pdppp.exe56⤵
- Executes dropped EXE
PID:804 -
\??\c:\xrfxffr.exec:\xrfxffr.exe57⤵
- Executes dropped EXE
PID:2544 -
\??\c:\lxxxfrr.exec:\lxxxfrr.exe58⤵
- Executes dropped EXE
PID:2396 -
\??\c:\thnnhb.exec:\thnnhb.exe59⤵
- Executes dropped EXE
PID:2492 -
\??\c:\dpvdd.exec:\dpvdd.exe60⤵
- Executes dropped EXE
PID:488 -
\??\c:\7xlllxx.exec:\7xlllxx.exe61⤵
- Executes dropped EXE
PID:1112 -
\??\c:\nbttbn.exec:\nbttbn.exe62⤵
- Executes dropped EXE
PID:1284 -
\??\c:\jpjjv.exec:\jpjjv.exe63⤵
- Executes dropped EXE
PID:2336 -
\??\c:\9xrrlrf.exec:\9xrrlrf.exe64⤵
- Executes dropped EXE
PID:1528 -
\??\c:\7fflrrx.exec:\7fflrrx.exe65⤵
- Executes dropped EXE
PID:2208 -
\??\c:\hthttt.exec:\hthttt.exe66⤵PID:1588
-
\??\c:\dppdd.exec:\dppdd.exe67⤵PID:1108
-
\??\c:\9fxrxlf.exec:\9fxrxlf.exe68⤵PID:1860
-
\??\c:\ttnnbt.exec:\ttnnbt.exe69⤵PID:1852
-
\??\c:\3vppv.exec:\3vppv.exe70⤵PID:1144
-
\??\c:\rxlfrlr.exec:\rxlfrlr.exe71⤵PID:572
-
\??\c:\1rfxlff.exec:\1rfxlff.exe72⤵PID:2760
-
\??\c:\tnbtbb.exec:\tnbtbb.exe73⤵PID:2376
-
\??\c:\dvjjp.exec:\dvjjp.exe74⤵PID:2536
-
\??\c:\1rfxxxr.exec:\1rfxxxr.exe75⤵PID:1568
-
\??\c:\nbnhbh.exec:\nbnhbh.exe76⤵PID:548
-
\??\c:\1jddd.exec:\1jddd.exe77⤵PID:2168
-
\??\c:\7lrrrrl.exec:\7lrrrrl.exe78⤵PID:2276
-
\??\c:\frffrrr.exec:\frffrrr.exe79⤵PID:1916
-
\??\c:\1hnntt.exec:\1hnntt.exe80⤵PID:2652
-
\??\c:\dvjjp.exec:\dvjjp.exe81⤵PID:2656
-
\??\c:\llrlfrx.exec:\llrlfrx.exe82⤵PID:2720
-
\??\c:\ntbtbt.exec:\ntbtbt.exe83⤵PID:2788
-
\??\c:\9pjdd.exec:\9pjdd.exe84⤵PID:2480
-
\??\c:\9frrlfx.exec:\9frrlfx.exe85⤵PID:2700
-
\??\c:\nhbbhn.exec:\nhbbhn.exe86⤵PID:2528
-
\??\c:\3nbbbh.exec:\3nbbbh.exe87⤵PID:2888
-
\??\c:\pjvpp.exec:\pjvpp.exe88⤵PID:2520
-
\??\c:\rlxxxfx.exec:\rlxxxfx.exe89⤵PID:1892
-
\??\c:\thnntt.exec:\thnntt.exe90⤵PID:2352
-
\??\c:\vjddj.exec:\vjddj.exe91⤵PID:308
-
\??\c:\vpddj.exec:\vpddj.exe92⤵PID:764
-
\??\c:\lxlrxll.exec:\lxlrxll.exe93⤵PID:2012
-
\??\c:\hbnhtt.exec:\hbnhtt.exe94⤵PID:1992
-
\??\c:\3vdpp.exec:\3vdpp.exe95⤵PID:1824
-
\??\c:\thnnnn.exec:\thnnnn.exe96⤵PID:1444
-
\??\c:\ppddj.exec:\ppddj.exe97⤵PID:1680
-
\??\c:\dvjpj.exec:\dvjpj.exe98⤵PID:2440
-
\??\c:\5rxrrxx.exec:\5rxrrxx.exe99⤵PID:2740
-
\??\c:\nbtthb.exec:\nbtthb.exe100⤵PID:684
-
\??\c:\pjvpv.exec:\pjvpv.exe101⤵PID:760
-
\??\c:\3lrffrx.exec:\3lrffrx.exe102⤵PID:1488
-
\??\c:\3htttn.exec:\3htttn.exe103⤵PID:328
-
\??\c:\vjvpv.exec:\vjvpv.exe104⤵PID:956
-
\??\c:\lfllrxf.exec:\lfllrxf.exe105⤵PID:1164
-
\??\c:\1rxxlfl.exec:\1rxxlfl.exe106⤵PID:3008
-
\??\c:\9bnntn.exec:\9bnntn.exe107⤵PID:1076
-
\??\c:\pdjjj.exec:\pdjjj.exe108⤵PID:1280
-
\??\c:\7xlllfl.exec:\7xlllfl.exe109⤵PID:1864
-
\??\c:\nbnnbt.exec:\nbnnbt.exe110⤵PID:1832
-
\??\c:\dppjj.exec:\dppjj.exe111⤵PID:2280
-
\??\c:\xllxfxl.exec:\xllxfxl.exe112⤵PID:2312
-
\??\c:\hbntbb.exec:\hbntbb.exe113⤵PID:656
-
\??\c:\nbnnnh.exec:\nbnnnh.exe114⤵PID:3004
-
\??\c:\jdjdd.exec:\jdjdd.exe115⤵PID:2636
-
\??\c:\xllffff.exec:\xllffff.exe116⤵PID:2300
-
\??\c:\tttbtb.exec:\tttbtb.exe117⤵PID:1712
-
\??\c:\dpddj.exec:\dpddj.exe118⤵PID:2320
-
\??\c:\1fxxrxx.exec:\1fxxrxx.exe119⤵PID:1996
-
\??\c:\1bhhht.exec:\1bhhht.exe120⤵PID:2804
-
\??\c:\1pjjd.exec:\1pjjd.exe121⤵PID:2748
-
\??\c:\1flrrff.exec:\1flrrff.exe122⤵PID:2600
-
\??\c:\rrllrlr.exec:\rrllrlr.exe123⤵PID:2284
-
\??\c:\nhtbnn.exec:\nhtbnn.exe124⤵PID:2736
-
\??\c:\rfrlrll.exec:\rfrlrll.exe125⤵PID:2724
-
\??\c:\htnntt.exec:\htnntt.exe126⤵PID:2704
-
\??\c:\jdvvj.exec:\jdvvj.exe127⤵PID:2516
-
\??\c:\frffxrx.exec:\frffxrx.exe128⤵PID:768
-
\??\c:\1bnthn.exec:\1bnthn.exe129⤵PID:3052
-
\??\c:\dvdvv.exec:\dvdvv.exe130⤵PID:3012
-
\??\c:\5lrrrxl.exec:\5lrrrxl.exe131⤵PID:1700
-
\??\c:\hbnnbn.exec:\hbnnbn.exe132⤵PID:1656
-
\??\c:\tbbhbt.exec:\tbbhbt.exe133⤵PID:1896
-
\??\c:\ffflxlr.exec:\ffflxlr.exe134⤵PID:1068
-
\??\c:\frlxllf.exec:\frlxllf.exe135⤵PID:1096
-
\??\c:\hbtthh.exec:\hbtthh.exe136⤵PID:2004
-
\??\c:\vjvvd.exec:\vjvvd.exe137⤵PID:2524
-
\??\c:\7rlffxx.exec:\7rlffxx.exe138⤵PID:1576
-
\??\c:\tnbbhh.exec:\tnbbhh.exe139⤵PID:1556
-
\??\c:\3dpvp.exec:\3dpvp.exe140⤵PID:1168
-
\??\c:\xxllflr.exec:\xxllflr.exe141⤵PID:2632
-
\??\c:\hbttbh.exec:\hbttbh.exe142⤵PID:540
-
\??\c:\vdvdv.exec:\vdvdv.exe143⤵PID:1016
-
\??\c:\rlffxll.exec:\rlffxll.exe144⤵PID:1648
-
\??\c:\5bnbbt.exec:\5bnbbt.exe145⤵PID:1856
-
\??\c:\jjvjv.exec:\jjvjv.exe146⤵PID:1112
-
\??\c:\xrrlrrf.exec:\xrrlrrf.exe147⤵PID:412
-
\??\c:\5nbnbb.exec:\5nbnbb.exe148⤵PID:3020
-
\??\c:\dvddp.exec:\dvddp.exe149⤵PID:1768
-
\??\c:\fxrrfll.exec:\fxrrfll.exe150⤵PID:1672
-
\??\c:\tnthbt.exec:\tnthbt.exe151⤵PID:1620
-
\??\c:\7pdjj.exec:\7pdjj.exe152⤵PID:280
-
\??\c:\lflfxrl.exec:\lflfxrl.exe153⤵PID:2852
-
\??\c:\htnnhb.exec:\htnnhb.exe154⤵PID:1272
-
\??\c:\ddvjd.exec:\ddvjd.exe155⤵PID:2304
-
\??\c:\jdpvd.exec:\jdpvd.exe156⤵PID:1764
-
\??\c:\fxlflll.exec:\fxlflll.exe157⤵PID:896
-
\??\c:\tnhhbt.exec:\tnhhbt.exe158⤵PID:2808
-
\??\c:\ppppj.exec:\ppppj.exe159⤵PID:880
-
\??\c:\llrxxlr.exec:\llrxxlr.exe160⤵PID:1704
-
\??\c:\thttbn.exec:\thttbn.exe161⤵PID:2912
-
\??\c:\jdjvj.exec:\jdjvj.exe162⤵PID:2564
-
\??\c:\jdvvj.exec:\jdvvj.exe163⤵PID:2068
-
\??\c:\9fxfllr.exec:\9fxfllr.exe164⤵PID:2652
-
\??\c:\nhhnnn.exec:\nhhnnn.exe165⤵PID:2252
-
\??\c:\5vjjd.exec:\5vjjd.exe166⤵PID:2720
-
\??\c:\xrlxlxf.exec:\xrlxlxf.exe167⤵PID:2672
-
\??\c:\nttbnt.exec:\nttbnt.exe168⤵PID:2480
-
\??\c:\vpjjd.exec:\vpjjd.exe169⤵PID:2700
-
\??\c:\7rlxffl.exec:\7rlxffl.exe170⤵PID:2528
-
\??\c:\hbtbtt.exec:\hbtbtt.exe171⤵PID:2624
-
\??\c:\tbtbhh.exec:\tbtbhh.exe172⤵PID:1784
-
\??\c:\vjvdp.exec:\vjvdp.exe173⤵PID:1084
-
\??\c:\xxrflrl.exec:\xxrflrl.exe174⤵PID:1748
-
\??\c:\tnhntb.exec:\tnhntb.exe175⤵PID:308
-
\??\c:\ppdjv.exec:\ppdjv.exe176⤵PID:1972
-
\??\c:\rrlrffx.exec:\rrlrffx.exe177⤵PID:940
-
\??\c:\9hhbnh.exec:\9hhbnh.exe178⤵PID:1752
-
\??\c:\7dvjp.exec:\7dvjp.exe179⤵PID:1420
-
\??\c:\1lffxfr.exec:\1lffxfr.exe180⤵PID:1200
-
\??\c:\7hhnnn.exec:\7hhnnn.exe181⤵PID:1576
-
\??\c:\jdpvp.exec:\jdpvp.exe182⤵PID:1536
-
\??\c:\7pdpd.exec:\7pdpd.exe183⤵PID:1168
-
\??\c:\lflrxxr.exec:\lflrxxr.exe184⤵PID:2784
-
\??\c:\tnnnht.exec:\tnnnht.exe185⤵PID:1828
-
\??\c:\3jdvd.exec:\3jdvd.exe186⤵PID:760
-
\??\c:\xrlrffr.exec:\xrlrffr.exe187⤵PID:748
-
\??\c:\bbbhtn.exec:\bbbhtn.exe188⤵PID:2348
-
\??\c:\vvpvv.exec:\vvpvv.exe189⤵PID:452
-
\??\c:\pdjjj.exec:\pdjjj.exe190⤵PID:712
-
\??\c:\rlffllr.exec:\rlffllr.exe191⤵PID:1152
-
\??\c:\btttnh.exec:\btttnh.exe192⤵PID:1544
-
\??\c:\3jpvj.exec:\3jpvj.exe193⤵PID:1376
-
\??\c:\7rfxrrx.exec:\7rfxrrx.exe194⤵PID:1864
-
\??\c:\ttnnnh.exec:\ttnnnh.exe195⤵PID:1832
-
\??\c:\ppjpv.exec:\ppjpv.exe196⤵PID:2280
-
\??\c:\7xlrrfl.exec:\7xlrrfl.exe197⤵PID:908
-
\??\c:\nhbhht.exec:\nhbhht.exe198⤵PID:2848
-
\??\c:\dvjjv.exec:\dvjjv.exe199⤵PID:2936
-
\??\c:\7fxfrrx.exec:\7fxfrrx.exe200⤵PID:2636
-
\??\c:\1nbtth.exec:\1nbtth.exe201⤵PID:2944
-
\??\c:\dvjvv.exec:\dvjvv.exe202⤵PID:1712
-
\??\c:\rrrfxxr.exec:\rrrfxxr.exe203⤵PID:2168
-
\??\c:\hbbhbb.exec:\hbbhbb.exe204⤵PID:2880
-
\??\c:\thttnh.exec:\thttnh.exe205⤵PID:2596
-
\??\c:\jdjjp.exec:\jdjjp.exe206⤵PID:2748
-
\??\c:\9xflxlx.exec:\9xflxlx.exe207⤵PID:2664
-
\??\c:\1htthh.exec:\1htthh.exe208⤵PID:2600
-
\??\c:\7jdjj.exec:\7jdjj.exe209⤵PID:2640
-
\??\c:\3frlrxf.exec:\3frlrxf.exe210⤵PID:2736
-
\??\c:\tnbtbt.exec:\tnbtbt.exe211⤵PID:2532
-
\??\c:\vjvvd.exec:\vjvvd.exe212⤵PID:1820
-
\??\c:\xrrrfrf.exec:\xrrrfrf.exe213⤵PID:2528
-
\??\c:\hbhhtb.exec:\hbhhtb.exe214⤵PID:3052
-
\??\c:\ppppj.exec:\ppppj.exe215⤵PID:1520
-
\??\c:\lrrxlrl.exec:\lrrxlrl.exe216⤵PID:1700
-
\??\c:\bbtthn.exec:\bbtthn.exe217⤵PID:1656
-
\??\c:\vdvjd.exec:\vdvjd.exe218⤵PID:764
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe219⤵PID:1896
-
\??\c:\3btbbn.exec:\3btbbn.exe220⤵PID:944
-
\??\c:\jjddj.exec:\jjddj.exe221⤵PID:2244
-
\??\c:\7ffffff.exec:\7ffffff.exe222⤵PID:1724
-
\??\c:\bbbbth.exec:\bbbbth.exe223⤵PID:1580
-
\??\c:\jdvdp.exec:\jdvdp.exe224⤵PID:2540
-
\??\c:\ffllxxr.exec:\ffllxxr.exe225⤵PID:596
-
\??\c:\hnhhtt.exec:\hnhhtt.exe226⤵PID:2088
-
\??\c:\pjvjp.exec:\pjvjp.exe227⤵PID:2632
-
\??\c:\jdpvd.exec:\jdpvd.exe228⤵PID:1016
-
\??\c:\lxlrrrf.exec:\lxlrrrf.exe229⤵PID:780
-
\??\c:\nbhhnn.exec:\nbhhnn.exe230⤵PID:1856
-
\??\c:\vpdvd.exec:\vpdvd.exe231⤵PID:1492
-
\??\c:\fxrfrfl.exec:\fxrfrfl.exe232⤵PID:412
-
\??\c:\1hbbnn.exec:\1hbbnn.exe233⤵PID:1052
-
\??\c:\7pppd.exec:\7pppd.exe234⤵PID:1768
-
\??\c:\fffxffr.exec:\fffxffr.exe235⤵PID:984
-
\??\c:\bttbhn.exec:\bttbhn.exe236⤵PID:1620
-
\??\c:\vpjdp.exec:\vpjdp.exe237⤵PID:1732
-
\??\c:\xrxxfxf.exec:\xrxxfxf.exe238⤵PID:2852
-
\??\c:\ttnbnh.exec:\ttnbnh.exe239⤵PID:2972
-
\??\c:\bhbbtn.exec:\bhbbtn.exe240⤵PID:1272
-
\??\c:\jdddj.exec:\jdddj.exe241⤵PID:2848
-
\??\c:\xllrfrf.exec:\xllrfrf.exe242⤵PID:2128