Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 18:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
148223f808abdea8245e486204abaa70_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
148223f808abdea8245e486204abaa70_NeikiAnalytics.exe
-
Size
370KB
-
MD5
148223f808abdea8245e486204abaa70
-
SHA1
bc102b829d7fa1ffdf1cb8e2f60ac5e756ef1935
-
SHA256
9a6dd4ac3e9ad5a5d058fc7d6bd120b0ab9c5a74cd5245c97b6f86904d5dbf99
-
SHA512
bffc4464a3a02138b3b3114c25be9b5c1abfb8391ea8570c5bcbe48fbf997eb07759237181407880826d22d9a99fc343dbded6a1b968b68701632c63a5e59d96
-
SSDEEP
6144:n3C9BRIG0asYFm71mJl3/X8mak5gNv9rC8IwLaYNUvtTxTKMM4:n3C9uYA7i3/stR9HGYyvtTxTKMt
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/2348-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1696-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1796-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3040-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1636-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1008-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/548-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2288-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/332-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1544-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/904-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ffxrlrr.exejdjvj.exebbbnbb.exeppjjv.exelfxlxxr.exehhbnbn.exe7xffrlx.exebbhbth.exellxflrf.exelfllrrr.exedvddd.exexrrxlrl.exebntnth.exedvpvp.exenhbnbh.exejdppd.exexlfffxr.exehhbhnt.exefxrlxrf.exebtnthn.exevvdvd.exexxffrxl.exejjpdp.exefxrlfxx.exe5tnnbb.exevpjdp.exe5xrrxfl.exenhbbhh.exerfrrflr.exejjvpj.exerlfrfrf.exenbtbhn.exerlfrrxx.exexrflfrl.exehtnhnt.exe9jpvj.exevpjjp.exerfflrxf.exenhbhtb.exehbthbb.exevdjdv.exelfxrrrx.exe9xrrffl.exebtnnbb.exedpjvd.exelrxlfxx.exelfrxlxf.exe9tnntt.exevppvd.exevpjpp.exefxflxfr.exehbttbb.exe1tnhtn.exevdjpv.exejdvjv.exerlfxxlr.exennbnbn.exeppvdj.exepjdjd.exelfllrrf.exetnhhnt.exe7nhttt.exepdppj.exefxrrxfr.exepid process 1696 ffxrlrr.exe 1796 jdjvj.exe 3040 bbbnbb.exe 1636 ppjjv.exe 2780 lfxlxxr.exe 2648 hhbnbn.exe 2552 7xffrlx.exe 2652 bbhbth.exe 2536 llxflrf.exe 2976 lfllrrr.exe 2428 dvddd.exe 1668 xrrxlrl.exe 1944 bntnth.exe 1008 dvpvp.exe 1948 nhbnbh.exe 2576 jdppd.exe 772 xlfffxr.exe 548 hhbhnt.exe 2840 fxrlxrf.exe 2288 btnthn.exe 2440 vvdvd.exe 332 xxffrxl.exe 580 jjpdp.exe 1756 fxrlfxx.exe 1544 5tnnbb.exe 1996 vpjdp.exe 968 5xrrxfl.exe 1168 nhbbhh.exe 2616 rfrrflr.exe 2444 jjvpj.exe 904 rlfrfrf.exe 1536 nbtbhn.exe 1604 rlfrrxx.exe 2264 xrflfrl.exe 2068 htnhnt.exe 2248 9jpvj.exe 2072 vpjjp.exe 3036 rfflrxf.exe 2776 nhbhtb.exe 2620 hbthbb.exe 2632 vdjdv.exe 2524 lfxrrrx.exe 2996 9xrrffl.exe 2688 btnnbb.exe 2636 dpjvd.exe 2568 lrxlfxx.exe 2040 lfrxlxf.exe 1316 9tnntt.exe 1072 vppvd.exe 1952 vpjpp.exe 1068 fxflxfr.exe 1328 hbttbb.exe 2732 1tnhtn.exe 1660 vdjpv.exe 316 jdvjv.exe 2948 rlfxxlr.exe 2852 nnbnbn.exe 2312 ppvdj.exe 1584 pjdjd.exe 536 lfllrrf.exe 1108 tnhhnt.exe 332 7nhttt.exe 580 pdppj.exe 1036 fxrrxfr.exe -
Processes:
resource yara_rule behavioral1/memory/2348-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1636-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1008-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/548-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/332-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1544-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-283-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/904-301-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
148223f808abdea8245e486204abaa70_NeikiAnalytics.exeffxrlrr.exejdjvj.exebbbnbb.exeppjjv.exelfxlxxr.exehhbnbn.exe7xffrlx.exebbhbth.exellxflrf.exelfllrrr.exedvddd.exexrrxlrl.exebntnth.exedvpvp.exenhbnbh.exedescription pid process target process PID 2348 wrote to memory of 1696 2348 148223f808abdea8245e486204abaa70_NeikiAnalytics.exe ffxrlrr.exe PID 2348 wrote to memory of 1696 2348 148223f808abdea8245e486204abaa70_NeikiAnalytics.exe ffxrlrr.exe PID 2348 wrote to memory of 1696 2348 148223f808abdea8245e486204abaa70_NeikiAnalytics.exe ffxrlrr.exe PID 2348 wrote to memory of 1696 2348 148223f808abdea8245e486204abaa70_NeikiAnalytics.exe ffxrlrr.exe PID 1696 wrote to memory of 1796 1696 ffxrlrr.exe jdjvj.exe PID 1696 wrote to memory of 1796 1696 ffxrlrr.exe jdjvj.exe PID 1696 wrote to memory of 1796 1696 ffxrlrr.exe jdjvj.exe PID 1696 wrote to memory of 1796 1696 ffxrlrr.exe jdjvj.exe PID 1796 wrote to memory of 3040 1796 jdjvj.exe bbbnbb.exe PID 1796 wrote to memory of 3040 1796 jdjvj.exe bbbnbb.exe PID 1796 wrote to memory of 3040 1796 jdjvj.exe bbbnbb.exe PID 1796 wrote to memory of 3040 1796 jdjvj.exe bbbnbb.exe PID 3040 wrote to memory of 1636 3040 bbbnbb.exe ppjjv.exe PID 3040 wrote to memory of 1636 3040 bbbnbb.exe ppjjv.exe PID 3040 wrote to memory of 1636 3040 bbbnbb.exe ppjjv.exe PID 3040 wrote to memory of 1636 3040 bbbnbb.exe ppjjv.exe PID 1636 wrote to memory of 2780 1636 ppjjv.exe lfxlxxr.exe PID 1636 wrote to memory of 2780 1636 ppjjv.exe lfxlxxr.exe PID 1636 wrote to memory of 2780 1636 ppjjv.exe lfxlxxr.exe PID 1636 wrote to memory of 2780 1636 ppjjv.exe lfxlxxr.exe PID 2780 wrote to memory of 2648 2780 lfxlxxr.exe hhbnbn.exe PID 2780 wrote to memory of 2648 2780 lfxlxxr.exe hhbnbn.exe PID 2780 wrote to memory of 2648 2780 lfxlxxr.exe hhbnbn.exe PID 2780 wrote to memory of 2648 2780 lfxlxxr.exe hhbnbn.exe PID 2648 wrote to memory of 2552 2648 hhbnbn.exe 7xffrlx.exe PID 2648 wrote to memory of 2552 2648 hhbnbn.exe 7xffrlx.exe PID 2648 wrote to memory of 2552 2648 hhbnbn.exe 7xffrlx.exe PID 2648 wrote to memory of 2552 2648 hhbnbn.exe 7xffrlx.exe PID 2552 wrote to memory of 2652 2552 7xffrlx.exe bbhbth.exe PID 2552 wrote to memory of 2652 2552 7xffrlx.exe bbhbth.exe PID 2552 wrote to memory of 2652 2552 7xffrlx.exe bbhbth.exe PID 2552 wrote to memory of 2652 2552 7xffrlx.exe bbhbth.exe PID 2652 wrote to memory of 2536 2652 bbhbth.exe llxflrf.exe PID 2652 wrote to memory of 2536 2652 bbhbth.exe llxflrf.exe PID 2652 wrote to memory of 2536 2652 bbhbth.exe llxflrf.exe PID 2652 wrote to memory of 2536 2652 bbhbth.exe llxflrf.exe PID 2536 wrote to memory of 2976 2536 llxflrf.exe lfllrrr.exe PID 2536 wrote to memory of 2976 2536 llxflrf.exe lfllrrr.exe PID 2536 wrote to memory of 2976 2536 llxflrf.exe lfllrrr.exe PID 2536 wrote to memory of 2976 2536 llxflrf.exe lfllrrr.exe PID 2976 wrote to memory of 2428 2976 lfllrrr.exe dvddd.exe PID 2976 wrote to memory of 2428 2976 lfllrrr.exe dvddd.exe PID 2976 wrote to memory of 2428 2976 lfllrrr.exe dvddd.exe PID 2976 wrote to memory of 2428 2976 lfllrrr.exe dvddd.exe PID 2428 wrote to memory of 1668 2428 dvddd.exe xrrxlrl.exe PID 2428 wrote to memory of 1668 2428 dvddd.exe xrrxlrl.exe PID 2428 wrote to memory of 1668 2428 dvddd.exe xrrxlrl.exe PID 2428 wrote to memory of 1668 2428 dvddd.exe xrrxlrl.exe PID 1668 wrote to memory of 1944 1668 xrrxlrl.exe bntnth.exe PID 1668 wrote to memory of 1944 1668 xrrxlrl.exe bntnth.exe PID 1668 wrote to memory of 1944 1668 xrrxlrl.exe bntnth.exe PID 1668 wrote to memory of 1944 1668 xrrxlrl.exe bntnth.exe PID 1944 wrote to memory of 1008 1944 bntnth.exe dvpvp.exe PID 1944 wrote to memory of 1008 1944 bntnth.exe dvpvp.exe PID 1944 wrote to memory of 1008 1944 bntnth.exe dvpvp.exe PID 1944 wrote to memory of 1008 1944 bntnth.exe dvpvp.exe PID 1008 wrote to memory of 1948 1008 dvpvp.exe nhbnbh.exe PID 1008 wrote to memory of 1948 1008 dvpvp.exe nhbnbh.exe PID 1008 wrote to memory of 1948 1008 dvpvp.exe nhbnbh.exe PID 1008 wrote to memory of 1948 1008 dvpvp.exe nhbnbh.exe PID 1948 wrote to memory of 2576 1948 nhbnbh.exe jdppd.exe PID 1948 wrote to memory of 2576 1948 nhbnbh.exe jdppd.exe PID 1948 wrote to memory of 2576 1948 nhbnbh.exe jdppd.exe PID 1948 wrote to memory of 2576 1948 nhbnbh.exe jdppd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\148223f808abdea8245e486204abaa70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\148223f808abdea8245e486204abaa70_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\ffxrlrr.exec:\ffxrlrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\jdjvj.exec:\jdjvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\bbbnbb.exec:\bbbnbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\ppjjv.exec:\ppjjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\lfxlxxr.exec:\lfxlxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\hhbnbn.exec:\hhbnbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\7xffrlx.exec:\7xffrlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\bbhbth.exec:\bbhbth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\llxflrf.exec:\llxflrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\lfllrrr.exec:\lfllrrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\dvddd.exec:\dvddd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\xrrxlrl.exec:\xrrxlrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\bntnth.exec:\bntnth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\dvpvp.exec:\dvpvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\nhbnbh.exec:\nhbnbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\jdppd.exec:\jdppd.exe17⤵
- Executes dropped EXE
PID:2576 -
\??\c:\xlfffxr.exec:\xlfffxr.exe18⤵
- Executes dropped EXE
PID:772 -
\??\c:\hhbhnt.exec:\hhbhnt.exe19⤵
- Executes dropped EXE
PID:548 -
\??\c:\fxrlxrf.exec:\fxrlxrf.exe20⤵
- Executes dropped EXE
PID:2840 -
\??\c:\btnthn.exec:\btnthn.exe21⤵
- Executes dropped EXE
PID:2288 -
\??\c:\vvdvd.exec:\vvdvd.exe22⤵
- Executes dropped EXE
PID:2440 -
\??\c:\xxffrxl.exec:\xxffrxl.exe23⤵
- Executes dropped EXE
PID:332 -
\??\c:\jjpdp.exec:\jjpdp.exe24⤵
- Executes dropped EXE
PID:580 -
\??\c:\fxrlfxx.exec:\fxrlfxx.exe25⤵
- Executes dropped EXE
PID:1756 -
\??\c:\5tnnbb.exec:\5tnnbb.exe26⤵
- Executes dropped EXE
PID:1544 -
\??\c:\vpjdp.exec:\vpjdp.exe27⤵
- Executes dropped EXE
PID:1996 -
\??\c:\5xrrxfl.exec:\5xrrxfl.exe28⤵
- Executes dropped EXE
PID:968 -
\??\c:\nhbbhh.exec:\nhbbhh.exe29⤵
- Executes dropped EXE
PID:1168 -
\??\c:\rfrrflr.exec:\rfrrflr.exe30⤵
- Executes dropped EXE
PID:2616 -
\??\c:\jjvpj.exec:\jjvpj.exe31⤵
- Executes dropped EXE
PID:2444 -
\??\c:\rlfrfrf.exec:\rlfrfrf.exe32⤵
- Executes dropped EXE
PID:904 -
\??\c:\nbtbhn.exec:\nbtbhn.exe33⤵
- Executes dropped EXE
PID:1536 -
\??\c:\rlfrrxx.exec:\rlfrrxx.exe34⤵
- Executes dropped EXE
PID:1604 -
\??\c:\xrflfrl.exec:\xrflfrl.exe35⤵
- Executes dropped EXE
PID:2264 -
\??\c:\htnhnt.exec:\htnhnt.exe36⤵
- Executes dropped EXE
PID:2068 -
\??\c:\9jpvj.exec:\9jpvj.exe37⤵
- Executes dropped EXE
PID:2248 -
\??\c:\vpjjp.exec:\vpjjp.exe38⤵
- Executes dropped EXE
PID:2072 -
\??\c:\rfflrxf.exec:\rfflrxf.exe39⤵
- Executes dropped EXE
PID:3036 -
\??\c:\nhbhtb.exec:\nhbhtb.exe40⤵
- Executes dropped EXE
PID:2776 -
\??\c:\hbthbb.exec:\hbthbb.exe41⤵
- Executes dropped EXE
PID:2620 -
\??\c:\vdjdv.exec:\vdjdv.exe42⤵
- Executes dropped EXE
PID:2632 -
\??\c:\lfxrrrx.exec:\lfxrrrx.exe43⤵
- Executes dropped EXE
PID:2524 -
\??\c:\9xrrffl.exec:\9xrrffl.exe44⤵
- Executes dropped EXE
PID:2996 -
\??\c:\btnnbb.exec:\btnnbb.exe45⤵
- Executes dropped EXE
PID:2688 -
\??\c:\dpjvd.exec:\dpjvd.exe46⤵
- Executes dropped EXE
PID:2636 -
\??\c:\lrxlfxx.exec:\lrxlfxx.exe47⤵
- Executes dropped EXE
PID:2568 -
\??\c:\lfrxlxf.exec:\lfrxlxf.exe48⤵
- Executes dropped EXE
PID:2040 -
\??\c:\9tnntt.exec:\9tnntt.exe49⤵
- Executes dropped EXE
PID:1316 -
\??\c:\vppvd.exec:\vppvd.exe50⤵
- Executes dropped EXE
PID:1072 -
\??\c:\vpjpp.exec:\vpjpp.exe51⤵
- Executes dropped EXE
PID:1952 -
\??\c:\fxflxfr.exec:\fxflxfr.exe52⤵
- Executes dropped EXE
PID:1068 -
\??\c:\hbttbb.exec:\hbttbb.exe53⤵
- Executes dropped EXE
PID:1328 -
\??\c:\1tnhtn.exec:\1tnhtn.exe54⤵
- Executes dropped EXE
PID:2732 -
\??\c:\vdjpv.exec:\vdjpv.exe55⤵
- Executes dropped EXE
PID:1660 -
\??\c:\jdvjv.exec:\jdvjv.exe56⤵
- Executes dropped EXE
PID:316 -
\??\c:\rlfxxlr.exec:\rlfxxlr.exe57⤵
- Executes dropped EXE
PID:2948 -
\??\c:\nnbnbn.exec:\nnbnbn.exe58⤵
- Executes dropped EXE
PID:2852 -
\??\c:\ppvdj.exec:\ppvdj.exe59⤵
- Executes dropped EXE
PID:2312 -
\??\c:\pjdjd.exec:\pjdjd.exe60⤵
- Executes dropped EXE
PID:1584 -
\??\c:\lfllrrf.exec:\lfllrrf.exe61⤵
- Executes dropped EXE
PID:536 -
\??\c:\tnhhnt.exec:\tnhhnt.exe62⤵
- Executes dropped EXE
PID:1108 -
\??\c:\7nhttt.exec:\7nhttt.exe63⤵
- Executes dropped EXE
PID:332 -
\??\c:\pdppj.exec:\pdppj.exe64⤵
- Executes dropped EXE
PID:580 -
\??\c:\fxrrxfr.exec:\fxrrxfr.exe65⤵
- Executes dropped EXE
PID:1036 -
\??\c:\rlxflfl.exec:\rlxflfl.exe66⤵PID:2920
-
\??\c:\1bbnbn.exec:\1bbnbn.exe67⤵PID:1632
-
\??\c:\btnthn.exec:\btnthn.exe68⤵PID:1996
-
\??\c:\vddjp.exec:\vddjp.exe69⤵PID:2884
-
\??\c:\rlfrxfr.exec:\rlfrxfr.exe70⤵PID:1676
-
\??\c:\fxrrrrx.exec:\fxrrrrx.exe71⤵PID:292
-
\??\c:\9tthnn.exec:\9tthnn.exe72⤵PID:2152
-
\??\c:\tbnhbh.exec:\tbnhbh.exe73⤵PID:1200
-
\??\c:\pvpdp.exec:\pvpdp.exe74⤵PID:1588
-
\??\c:\rlffflr.exec:\rlffflr.exe75⤵PID:2344
-
\??\c:\xrlxflr.exec:\xrlxflr.exe76⤵PID:2356
-
\??\c:\1tthtb.exec:\1tthtb.exe77⤵PID:2268
-
\??\c:\dvppv.exec:\dvppv.exe78⤵PID:2200
-
\??\c:\pjdjv.exec:\pjdjv.exe79⤵PID:2876
-
\??\c:\rxrrfrx.exec:\rxrrfrx.exe80⤵PID:2608
-
\??\c:\nhhhtt.exec:\nhhhtt.exe81⤵PID:2768
-
\??\c:\hbtbnt.exec:\hbtbnt.exe82⤵PID:2668
-
\??\c:\jddpd.exec:\jddpd.exe83⤵PID:2888
-
\??\c:\llfflrx.exec:\llfflrx.exe84⤵PID:2856
-
\??\c:\rllflfl.exec:\rllflfl.exe85⤵PID:2812
-
\??\c:\1tbnbn.exec:\1tbnbn.exe86⤵PID:2800
-
\??\c:\9bthhn.exec:\9bthhn.exe87⤵PID:2652
-
\??\c:\jjdjv.exec:\jjdjv.exe88⤵PID:2972
-
\??\c:\rrllxxl.exec:\rrllxxl.exe89⤵PID:2592
-
\??\c:\lrlrxfr.exec:\lrlrxfr.exe90⤵PID:2724
-
\??\c:\9nhnbh.exec:\9nhnbh.exe91⤵PID:856
-
\??\c:\jdvvj.exec:\jdvvj.exe92⤵PID:1656
-
\??\c:\3jvvd.exec:\3jvvd.exe93⤵PID:1956
-
\??\c:\fxrrffl.exec:\fxrrffl.exe94⤵PID:1964
-
\??\c:\xlrlrrr.exec:\xlrlrrr.exe95⤵PID:2740
-
\??\c:\bbbbhn.exec:\bbbbhn.exe96⤵PID:1456
-
\??\c:\5dvdj.exec:\5dvdj.exe97⤵PID:1232
-
\??\c:\1dvdj.exec:\1dvdj.exe98⤵PID:1772
-
\??\c:\1xrlxxf.exec:\1xrlxxf.exe99⤵PID:2692
-
\??\c:\nhbhtb.exec:\nhbhtb.exe100⤵PID:2840
-
\??\c:\bbbnbn.exec:\bbbnbn.exe101⤵PID:1740
-
\??\c:\5vvdp.exec:\5vvdp.exe102⤵PID:2988
-
\??\c:\rlxrlfx.exec:\rlxrlfx.exe103⤵PID:716
-
\??\c:\5bhnbh.exec:\5bhnbh.exe104⤵PID:788
-
\??\c:\tthnbh.exec:\tthnbh.exe105⤵PID:1116
-
\??\c:\vvpvp.exec:\vvpvp.exe106⤵PID:2012
-
\??\c:\frfflrx.exec:\frfflrx.exe107⤵PID:1140
-
\??\c:\fxflrrf.exec:\fxflrrf.exe108⤵PID:808
-
\??\c:\7tnhtb.exec:\7tnhtb.exe109⤵PID:964
-
\??\c:\jpjpd.exec:\jpjpd.exe110⤵PID:1380
-
\??\c:\lffrflx.exec:\lffrflx.exe111⤵PID:2924
-
\??\c:\bhthtb.exec:\bhthtb.exe112⤵PID:3052
-
\??\c:\tthbhn.exec:\tthbhn.exe113⤵PID:2616
-
\??\c:\pddpd.exec:\pddpd.exe114⤵PID:2444
-
\??\c:\dvjpd.exec:\dvjpd.exe115⤵PID:1720
-
\??\c:\fllffxx.exec:\fllffxx.exe116⤵PID:2340
-
\??\c:\5hbhht.exec:\5hbhht.exe117⤵PID:1580
-
\??\c:\ddjdv.exec:\ddjdv.exe118⤵PID:2600
-
\??\c:\djjvv.exec:\djjvv.exe119⤵PID:1460
-
\??\c:\lflfllr.exec:\lflfllr.exe120⤵PID:2992
-
\??\c:\bthbnh.exec:\bthbnh.exe121⤵PID:3040
-
\??\c:\jjpvd.exec:\jjpvd.exe122⤵PID:2772
-
\??\c:\ppjpj.exec:\ppjpj.exe123⤵PID:2672
-
\??\c:\llfrflr.exec:\llfrflr.exe124⤵PID:3068
-
\??\c:\lfxffrl.exec:\lfxffrl.exe125⤵PID:2700
-
\??\c:\hhbnbt.exec:\hhbnbt.exe126⤵PID:2552
-
\??\c:\jdvjd.exec:\jdvjd.exe127⤵PID:2960
-
\??\c:\jdpdv.exec:\jdpdv.exe128⤵PID:2680
-
\??\c:\xrffllr.exec:\xrffllr.exe129⤵PID:2968
-
\??\c:\hhbtbh.exec:\hhbtbh.exe130⤵PID:2980
-
\??\c:\3djvv.exec:\3djvv.exe131⤵PID:1292
-
\??\c:\5xfxrrf.exec:\5xfxrrf.exe132⤵PID:2720
-
\??\c:\nbtbnn.exec:\nbtbnn.exe133⤵PID:1668
-
\??\c:\vvjjp.exec:\vvjjp.exe134⤵PID:1656
-
\??\c:\7htthn.exec:\7htthn.exe135⤵PID:1068
-
\??\c:\dddjd.exec:\dddjd.exe136⤵PID:1328
-
\??\c:\rfrflrx.exec:\rfrflrx.exe137⤵PID:1048
-
\??\c:\fxrxlrx.exec:\fxrxlrx.exe138⤵PID:1304
-
\??\c:\bbbnhn.exec:\bbbnhn.exe139⤵PID:316
-
\??\c:\vvvdv.exec:\vvvdv.exe140⤵PID:2604
-
\??\c:\pjdpd.exec:\pjdpd.exe141⤵PID:2716
-
\??\c:\lfxfffr.exec:\lfxfffr.exe142⤵PID:2056
-
\??\c:\hhbhtb.exec:\hhbhtb.exe143⤵PID:2292
-
\??\c:\nhtbtb.exec:\nhtbtb.exe144⤵PID:596
-
\??\c:\ppjjp.exec:\ppjjp.exe145⤵PID:1108
-
\??\c:\5rrlfrr.exec:\5rrlfrr.exe146⤵PID:960
-
\??\c:\rrxxlrl.exec:\rrxxlrl.exe147⤵PID:580
-
\??\c:\nnbbnn.exec:\nnbbnn.exe148⤵PID:1324
-
\??\c:\5dpvj.exec:\5dpvj.exe149⤵PID:2920
-
\??\c:\jvdpj.exec:\jvdpj.exe150⤵PID:2164
-
\??\c:\fxlrlxr.exec:\fxlrlxr.exe151⤵PID:1996
-
\??\c:\btthht.exec:\btthht.exe152⤵PID:572
-
\??\c:\ttnnbb.exec:\ttnnbb.exe153⤵PID:848
-
\??\c:\jvpvj.exec:\jvpvj.exe154⤵PID:3052
-
\??\c:\xxfxflx.exec:\xxfxflx.exe155⤵PID:1352
-
\??\c:\fllxffl.exec:\fllxffl.exe156⤵PID:1508
-
\??\c:\hhhnbh.exec:\hhhnbh.exe157⤵PID:1588
-
\??\c:\9pddp.exec:\9pddp.exe158⤵PID:1612
-
\??\c:\dpdjj.exec:\dpdjj.exe159⤵PID:2356
-
\??\c:\rxrxlll.exec:\rxrxlll.exe160⤵PID:2596
-
\??\c:\tbntbn.exec:\tbntbn.exe161⤵PID:2200
-
\??\c:\htnthh.exec:\htnthh.exe162⤵PID:2696
-
\??\c:\dvjjv.exec:\dvjjv.exe163⤵PID:2608
-
\??\c:\rxlffff.exec:\rxlffff.exe164⤵PID:2772
-
\??\c:\xlxfrrl.exec:\xlxfrrl.exe165⤵PID:2660
-
\??\c:\bthntt.exec:\bthntt.exe166⤵PID:3068
-
\??\c:\pjjjj.exec:\pjjjj.exe167⤵PID:2648
-
\??\c:\frxxxlr.exec:\frxxxlr.exe168⤵PID:2552
-
\??\c:\fxlxlrx.exec:\fxlxlrx.exe169⤵PID:2516
-
\??\c:\1bntht.exec:\1bntht.exe170⤵PID:2680
-
\??\c:\7jvvd.exec:\7jvvd.exe171⤵PID:2636
-
\??\c:\dvpdp.exec:\dvpdp.exe172⤵PID:2592
-
\??\c:\7xrfrfx.exec:\7xrfrfx.exe173⤵PID:2040
-
\??\c:\nhntbh.exec:\nhntbh.exe174⤵PID:856
-
\??\c:\jvjjd.exec:\jvjjd.exe175⤵PID:1932
-
\??\c:\dvpvj.exec:\dvpvj.exe176⤵PID:1244
-
\??\c:\llrlrfr.exec:\llrlrfr.exe177⤵PID:1956
-
\??\c:\3hbnbb.exec:\3hbnbb.exe178⤵PID:1008
-
\??\c:\nhnnth.exec:\nhnnth.exe179⤵PID:1328
-
\??\c:\9jjpd.exec:\9jjpd.exe180⤵PID:2740
-
\??\c:\7rlxffr.exec:\7rlxffr.exe181⤵PID:632
-
\??\c:\rxlxrfr.exec:\rxlxrfr.exe182⤵PID:340
-
\??\c:\nbnhhh.exec:\nbnhhh.exe183⤵PID:2948
-
\??\c:\jvpvj.exec:\jvpvj.exe184⤵PID:2852
-
\??\c:\jdpvv.exec:\jdpvv.exe185⤵PID:2312
-
\??\c:\lrlrrrf.exec:\lrlrrrf.exe186⤵PID:2292
-
\??\c:\hbthtb.exec:\hbthtb.exe187⤵PID:320
-
\??\c:\jjdpv.exec:\jjdpv.exe188⤵PID:1160
-
\??\c:\vvppv.exec:\vvppv.exe189⤵PID:332
-
\??\c:\rrlrffr.exec:\rrlrffr.exe190⤵PID:1020
-
\??\c:\nhtnht.exec:\nhtnht.exe191⤵PID:1868
-
\??\c:\vvpvp.exec:\vvpvp.exe192⤵PID:1544
-
\??\c:\7pdvv.exec:\7pdvv.exe193⤵PID:2032
-
\??\c:\xrxxflr.exec:\xrxxflr.exe194⤵PID:356
-
\??\c:\tnbntb.exec:\tnbntb.exe195⤵PID:572
-
\??\c:\jdvpv.exec:\jdvpv.exe196⤵PID:2412
-
\??\c:\xrlrxff.exec:\xrlrxff.exe197⤵PID:3052
-
\??\c:\ffxfrfl.exec:\ffxfrfl.exe198⤵PID:2616
-
\??\c:\hnhtnt.exec:\hnhtnt.exe199⤵PID:1508
-
\??\c:\dpvvd.exec:\dpvvd.exe200⤵PID:2112
-
\??\c:\xxfxrrl.exec:\xxfxrrl.exe201⤵PID:1520
-
\??\c:\nhnbbt.exec:\nhnbbt.exe202⤵PID:2356
-
\??\c:\tbnbht.exec:\tbnbht.exe203⤵PID:2596
-
\??\c:\pdpvv.exec:\pdpvv.exe204⤵PID:2200
-
\??\c:\lflxllx.exec:\lflxllx.exe205⤵PID:3040
-
\??\c:\lfxrfrr.exec:\lfxrfrr.exe206⤵PID:2784
-
\??\c:\nhnhbn.exec:\nhnhbn.exe207⤵PID:2672
-
\??\c:\vjvjp.exec:\vjvjp.exe208⤵PID:2660
-
\??\c:\9ffrlxr.exec:\9ffrlxr.exe209⤵PID:2700
-
\??\c:\xrlrlrf.exec:\xrlrlrf.exe210⤵PID:2648
-
\??\c:\nbthbh.exec:\nbthbh.exe211⤵PID:2552
-
\??\c:\jddpv.exec:\jddpv.exe212⤵PID:2516
-
\??\c:\lflxrrf.exec:\lflxrrf.exe213⤵PID:2680
-
\??\c:\rrfrxfr.exec:\rrfrxfr.exe214⤵PID:2636
-
\??\c:\bbbntb.exec:\bbbntb.exe215⤵PID:2484
-
\??\c:\jjjdv.exec:\jjjdv.exe216⤵PID:2040
-
\??\c:\pjdvj.exec:\pjdvj.exe217⤵PID:1640
-
\??\c:\ffxllrr.exec:\ffxllrr.exe218⤵PID:1952
-
\??\c:\bnbbnn.exec:\bnbbnn.exe219⤵PID:1656
-
\??\c:\bbthtb.exec:\bbthtb.exe220⤵PID:1944
-
\??\c:\9vpdv.exec:\9vpdv.exe221⤵PID:2128
-
\??\c:\rrfrxfl.exec:\rrfrxfl.exe222⤵PID:1992
-
\??\c:\1lxxfrl.exec:\1lxxfrl.exe223⤵PID:1304
-
\??\c:\ttnbtb.exec:\ttnbtb.exe224⤵PID:632
-
\??\c:\dddvv.exec:\dddvv.exe225⤵PID:324
-
\??\c:\pddjv.exec:\pddjv.exe226⤵PID:2948
-
\??\c:\rxrfxrf.exec:\rxrfxrf.exe227⤵PID:2852
-
\??\c:\nnhnbb.exec:\nnhnbb.exe228⤵PID:2312
-
\??\c:\bthtbh.exec:\bthtbh.exe229⤵PID:2292
-
\??\c:\jjdjv.exec:\jjdjv.exe230⤵PID:320
-
\??\c:\lfrxllf.exec:\lfrxllf.exe231⤵PID:668
-
\??\c:\tnbtnn.exec:\tnbtnn.exe232⤵PID:332
-
\??\c:\btnbnn.exec:\btnbnn.exe233⤵PID:1020
-
\??\c:\jpvjp.exec:\jpvjp.exe234⤵PID:1868
-
\??\c:\vvjpj.exec:\vvjpj.exe235⤵PID:1544
-
\??\c:\rlflxlx.exec:\rlflxlx.exe236⤵PID:2164
-
\??\c:\nhbntb.exec:\nhbntb.exe237⤵PID:2304
-
\??\c:\hbhnht.exec:\hbhnht.exe238⤵PID:2936
-
\??\c:\3pjpv.exec:\3pjpv.exe239⤵PID:2412
-
\??\c:\1lfrxfr.exec:\1lfrxfr.exe240⤵PID:2152
-
\??\c:\3xrrflx.exec:\3xrrflx.exe241⤵PID:1352
-
\??\c:\bttnht.exec:\bttnht.exe242⤵PID:1720