Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 05:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b5046a0e00a97218c248624cd6b18d00_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
b5046a0e00a97218c248624cd6b18d00_NeikiAnalytics.exe
-
Size
64KB
-
MD5
b5046a0e00a97218c248624cd6b18d00
-
SHA1
77b7e062965acbd3da8dd4288ca665c9e3481e9e
-
SHA256
46245924ee91216c1e2f71c928f1f64ce8bef3b34804d22788de1cc4be20d96b
-
SHA512
c9da62acdfd02bed7fbbacebf45799b71cc0aa6d288915d82176144ed8931ffa25997cf81bcfc2bbebc51300f0ac6c003afba7d03cf10203bcc0e9e226bdc8f8
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFdJULh12+:ymb3NkkiQ3mdBjFIFdJm5
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/2932-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2164-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1580-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2288-43-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2288-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1432-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1640-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2084-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1848-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1036-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-305-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jjjjp.exerrflrxl.exebthbnt.exepddjp.exepvpdj.exexxrxffr.exebbbbhh.exe1thnhh.exe7djjj.exelllxlfl.exexrllrxl.exehbtbhh.exepdvvj.exejdvjj.exelfrlxxl.exelxxlxfl.exetnbhnt.exe7bhhnb.exejjdjv.exedvpvj.exelrffxrx.exehbbhnn.exebtbhnt.exepdjdp.exe9dpjv.exexrlxrff.exebtbttt.exennbhth.exevjvpj.exellfxlll.exebnthhh.exe1nnbtb.exejvjjd.exedjjvj.exerfrlrrr.exe7xlllfl.exetnbbhn.exehbthtt.exevvdpd.exexrllllr.exexxlxxrr.exethtthh.exe5tntbb.exejjvpv.exeddvvp.exexlrfllx.exerfllllr.exebtbbhb.exetntbnt.exe7vppd.exe5djdj.exellfllxf.exexrlrxxf.exetnbnbh.exehtbtbt.exevvvdj.exepdjjj.exelllflrx.exexxxxxfl.exetnbnbb.exebnbbhn.exeddjvv.exevvjvd.exefrxrlrl.exepid process 2164 jjjjp.exe 1580 rrflrxl.exe 2288 bthbnt.exe 2640 pddjp.exe 2572 pvpdj.exe 2624 xxrxffr.exe 2484 bbbbhh.exe 2468 1thnhh.exe 2088 7djjj.exe 1432 lllxlfl.exe 3016 xrllrxl.exe 2784 hbtbhh.exe 1640 pdvvj.exe 1752 jdvjj.exe 2716 lfrlxxl.exe 2724 lxxlxfl.exe 2412 tnbhnt.exe 1520 7bhhnb.exe 2084 jjdjv.exe 2180 dvpvj.exe 2416 lrffxrx.exe 2920 hbbhnn.exe 1488 btbhnt.exe 1848 pdjdp.exe 640 9dpjv.exe 1736 xrlxrff.exe 2316 btbttt.exe 1036 nnbhth.exe 1964 vjvpj.exe 1992 llfxlll.exe 1948 bnthhh.exe 1592 1nnbtb.exe 3064 jvjjd.exe 2652 djjvj.exe 2076 rfrlrrr.exe 1720 7xlllfl.exe 2568 tnbbhn.exe 2740 hbthtt.exe 2572 vvdpd.exe 2460 xrllllr.exe 2440 xxlxxrr.exe 2512 thtthh.exe 2448 5tntbb.exe 2088 jjvpv.exe 2700 ddvvp.exe 2864 xlrfllx.exe 2772 rfllllr.exe 2024 btbbhb.exe 2328 tntbnt.exe 1524 7vppd.exe 2540 5djdj.exe 2832 llfllxf.exe 2816 xrlrxxf.exe 2824 tnbnbh.exe 1760 htbtbt.exe 1724 vvvdj.exe 2192 pdjjj.exe 2908 lllflrx.exe 1780 xxxxxfl.exe 488 tnbnbb.exe 1648 bnbbhn.exe 1056 ddjvv.exe 344 vvjvd.exe 2404 frxrlrl.exe -
Processes:
resource yara_rule behavioral1/memory/2932-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2164-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2164-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2164-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2164-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1580-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1432-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1848-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1036-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-305-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b5046a0e00a97218c248624cd6b18d00_NeikiAnalytics.exejjjjp.exerrflrxl.exebthbnt.exepddjp.exepvpdj.exexxrxffr.exebbbbhh.exe1thnhh.exe7djjj.exelllxlfl.exexrllrxl.exehbtbhh.exepdvvj.exejdvjj.exelfrlxxl.exedescription pid process target process PID 2932 wrote to memory of 2164 2932 b5046a0e00a97218c248624cd6b18d00_NeikiAnalytics.exe jjjjp.exe PID 2932 wrote to memory of 2164 2932 b5046a0e00a97218c248624cd6b18d00_NeikiAnalytics.exe jjjjp.exe PID 2932 wrote to memory of 2164 2932 b5046a0e00a97218c248624cd6b18d00_NeikiAnalytics.exe jjjjp.exe PID 2932 wrote to memory of 2164 2932 b5046a0e00a97218c248624cd6b18d00_NeikiAnalytics.exe jjjjp.exe PID 2164 wrote to memory of 1580 2164 jjjjp.exe rrflrxl.exe PID 2164 wrote to memory of 1580 2164 jjjjp.exe rrflrxl.exe PID 2164 wrote to memory of 1580 2164 jjjjp.exe rrflrxl.exe PID 2164 wrote to memory of 1580 2164 jjjjp.exe rrflrxl.exe PID 1580 wrote to memory of 2288 1580 rrflrxl.exe bthbnt.exe PID 1580 wrote to memory of 2288 1580 rrflrxl.exe bthbnt.exe PID 1580 wrote to memory of 2288 1580 rrflrxl.exe bthbnt.exe PID 1580 wrote to memory of 2288 1580 rrflrxl.exe bthbnt.exe PID 2288 wrote to memory of 2640 2288 bthbnt.exe pddjp.exe PID 2288 wrote to memory of 2640 2288 bthbnt.exe pddjp.exe PID 2288 wrote to memory of 2640 2288 bthbnt.exe pddjp.exe PID 2288 wrote to memory of 2640 2288 bthbnt.exe pddjp.exe PID 2640 wrote to memory of 2572 2640 pddjp.exe pvpdj.exe PID 2640 wrote to memory of 2572 2640 pddjp.exe pvpdj.exe PID 2640 wrote to memory of 2572 2640 pddjp.exe pvpdj.exe PID 2640 wrote to memory of 2572 2640 pddjp.exe pvpdj.exe PID 2572 wrote to memory of 2624 2572 pvpdj.exe xxrxffr.exe PID 2572 wrote to memory of 2624 2572 pvpdj.exe xxrxffr.exe PID 2572 wrote to memory of 2624 2572 pvpdj.exe xxrxffr.exe PID 2572 wrote to memory of 2624 2572 pvpdj.exe xxrxffr.exe PID 2624 wrote to memory of 2484 2624 xxrxffr.exe bbbbhh.exe PID 2624 wrote to memory of 2484 2624 xxrxffr.exe bbbbhh.exe PID 2624 wrote to memory of 2484 2624 xxrxffr.exe bbbbhh.exe PID 2624 wrote to memory of 2484 2624 xxrxffr.exe bbbbhh.exe PID 2484 wrote to memory of 2468 2484 bbbbhh.exe 1thnhh.exe PID 2484 wrote to memory of 2468 2484 bbbbhh.exe 1thnhh.exe PID 2484 wrote to memory of 2468 2484 bbbbhh.exe 1thnhh.exe PID 2484 wrote to memory of 2468 2484 bbbbhh.exe 1thnhh.exe PID 2468 wrote to memory of 2088 2468 1thnhh.exe 7djjj.exe PID 2468 wrote to memory of 2088 2468 1thnhh.exe 7djjj.exe PID 2468 wrote to memory of 2088 2468 1thnhh.exe 7djjj.exe PID 2468 wrote to memory of 2088 2468 1thnhh.exe 7djjj.exe PID 2088 wrote to memory of 1432 2088 7djjj.exe lllxlfl.exe PID 2088 wrote to memory of 1432 2088 7djjj.exe lllxlfl.exe PID 2088 wrote to memory of 1432 2088 7djjj.exe lllxlfl.exe PID 2088 wrote to memory of 1432 2088 7djjj.exe lllxlfl.exe PID 1432 wrote to memory of 3016 1432 lllxlfl.exe xrllrxl.exe PID 1432 wrote to memory of 3016 1432 lllxlfl.exe xrllrxl.exe PID 1432 wrote to memory of 3016 1432 lllxlfl.exe xrllrxl.exe PID 1432 wrote to memory of 3016 1432 lllxlfl.exe xrllrxl.exe PID 3016 wrote to memory of 2784 3016 xrllrxl.exe hbtbhh.exe PID 3016 wrote to memory of 2784 3016 xrllrxl.exe hbtbhh.exe PID 3016 wrote to memory of 2784 3016 xrllrxl.exe hbtbhh.exe PID 3016 wrote to memory of 2784 3016 xrllrxl.exe hbtbhh.exe PID 2784 wrote to memory of 1640 2784 hbtbhh.exe pdvvj.exe PID 2784 wrote to memory of 1640 2784 hbtbhh.exe pdvvj.exe PID 2784 wrote to memory of 1640 2784 hbtbhh.exe pdvvj.exe PID 2784 wrote to memory of 1640 2784 hbtbhh.exe pdvvj.exe PID 1640 wrote to memory of 1752 1640 pdvvj.exe jdvjj.exe PID 1640 wrote to memory of 1752 1640 pdvvj.exe jdvjj.exe PID 1640 wrote to memory of 1752 1640 pdvvj.exe jdvjj.exe PID 1640 wrote to memory of 1752 1640 pdvvj.exe jdvjj.exe PID 1752 wrote to memory of 2716 1752 jdvjj.exe lfrlxxl.exe PID 1752 wrote to memory of 2716 1752 jdvjj.exe lfrlxxl.exe PID 1752 wrote to memory of 2716 1752 jdvjj.exe lfrlxxl.exe PID 1752 wrote to memory of 2716 1752 jdvjj.exe lfrlxxl.exe PID 2716 wrote to memory of 2724 2716 lfrlxxl.exe lxxlxfl.exe PID 2716 wrote to memory of 2724 2716 lfrlxxl.exe lxxlxfl.exe PID 2716 wrote to memory of 2724 2716 lfrlxxl.exe lxxlxfl.exe PID 2716 wrote to memory of 2724 2716 lfrlxxl.exe lxxlxfl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5046a0e00a97218c248624cd6b18d00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b5046a0e00a97218c248624cd6b18d00_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\jjjjp.exec:\jjjjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\rrflrxl.exec:\rrflrxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\bthbnt.exec:\bthbnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\pddjp.exec:\pddjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\pvpdj.exec:\pvpdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\xxrxffr.exec:\xxrxffr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\bbbbhh.exec:\bbbbhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\1thnhh.exec:\1thnhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\7djjj.exec:\7djjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\lllxlfl.exec:\lllxlfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\xrllrxl.exec:\xrllrxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\hbtbhh.exec:\hbtbhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\pdvvj.exec:\pdvvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\jdvjj.exec:\jdvjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\lfrlxxl.exec:\lfrlxxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\lxxlxfl.exec:\lxxlxfl.exe17⤵
- Executes dropped EXE
PID:2724 -
\??\c:\tnbhnt.exec:\tnbhnt.exe18⤵
- Executes dropped EXE
PID:2412 -
\??\c:\7bhhnb.exec:\7bhhnb.exe19⤵
- Executes dropped EXE
PID:1520 -
\??\c:\jjdjv.exec:\jjdjv.exe20⤵
- Executes dropped EXE
PID:2084 -
\??\c:\dvpvj.exec:\dvpvj.exe21⤵
- Executes dropped EXE
PID:2180 -
\??\c:\lrffxrx.exec:\lrffxrx.exe22⤵
- Executes dropped EXE
PID:2416 -
\??\c:\hbbhnn.exec:\hbbhnn.exe23⤵
- Executes dropped EXE
PID:2920 -
\??\c:\btbhnt.exec:\btbhnt.exe24⤵
- Executes dropped EXE
PID:1488 -
\??\c:\pdjdp.exec:\pdjdp.exe25⤵
- Executes dropped EXE
PID:1848 -
\??\c:\9dpjv.exec:\9dpjv.exe26⤵
- Executes dropped EXE
PID:640 -
\??\c:\xrlxrff.exec:\xrlxrff.exe27⤵
- Executes dropped EXE
PID:1736 -
\??\c:\btbttt.exec:\btbttt.exe28⤵
- Executes dropped EXE
PID:2316 -
\??\c:\nnbhth.exec:\nnbhth.exe29⤵
- Executes dropped EXE
PID:1036 -
\??\c:\vjvpj.exec:\vjvpj.exe30⤵
- Executes dropped EXE
PID:1964 -
\??\c:\llfxlll.exec:\llfxlll.exe31⤵
- Executes dropped EXE
PID:1992 -
\??\c:\bnthhh.exec:\bnthhh.exe32⤵
- Executes dropped EXE
PID:1948 -
\??\c:\1nnbtb.exec:\1nnbtb.exe33⤵
- Executes dropped EXE
PID:1592 -
\??\c:\jvjjd.exec:\jvjjd.exe34⤵
- Executes dropped EXE
PID:3064 -
\??\c:\djjvj.exec:\djjvj.exe35⤵
- Executes dropped EXE
PID:2652 -
\??\c:\rfrlrrr.exec:\rfrlrrr.exe36⤵
- Executes dropped EXE
PID:2076 -
\??\c:\7xlllfl.exec:\7xlllfl.exe37⤵
- Executes dropped EXE
PID:1720 -
\??\c:\tnbbhn.exec:\tnbbhn.exe38⤵
- Executes dropped EXE
PID:2568 -
\??\c:\hbthtt.exec:\hbthtt.exe39⤵
- Executes dropped EXE
PID:2740 -
\??\c:\vvdpd.exec:\vvdpd.exe40⤵
- Executes dropped EXE
PID:2572 -
\??\c:\xrllllr.exec:\xrllllr.exe41⤵
- Executes dropped EXE
PID:2460 -
\??\c:\xxlxxrr.exec:\xxlxxrr.exe42⤵
- Executes dropped EXE
PID:2440 -
\??\c:\thtthh.exec:\thtthh.exe43⤵
- Executes dropped EXE
PID:2512 -
\??\c:\5tntbb.exec:\5tntbb.exe44⤵
- Executes dropped EXE
PID:2448 -
\??\c:\jjvpv.exec:\jjvpv.exe45⤵
- Executes dropped EXE
PID:2088 -
\??\c:\ddvvp.exec:\ddvvp.exe46⤵
- Executes dropped EXE
PID:2700 -
\??\c:\xlrfllx.exec:\xlrfllx.exe47⤵
- Executes dropped EXE
PID:2864 -
\??\c:\rfllllr.exec:\rfllllr.exe48⤵
- Executes dropped EXE
PID:2772 -
\??\c:\btbbhb.exec:\btbbhb.exe49⤵
- Executes dropped EXE
PID:2024 -
\??\c:\tntbnt.exec:\tntbnt.exe50⤵
- Executes dropped EXE
PID:2328 -
\??\c:\7vppd.exec:\7vppd.exe51⤵
- Executes dropped EXE
PID:1524 -
\??\c:\5djdj.exec:\5djdj.exe52⤵
- Executes dropped EXE
PID:2540 -
\??\c:\llfllxf.exec:\llfllxf.exe53⤵
- Executes dropped EXE
PID:2832 -
\??\c:\xrlrxxf.exec:\xrlrxxf.exe54⤵
- Executes dropped EXE
PID:2816 -
\??\c:\tnbnbh.exec:\tnbnbh.exe55⤵
- Executes dropped EXE
PID:2824 -
\??\c:\htbtbt.exec:\htbtbt.exe56⤵
- Executes dropped EXE
PID:1760 -
\??\c:\vvvdj.exec:\vvvdj.exe57⤵
- Executes dropped EXE
PID:1724 -
\??\c:\pdjjj.exec:\pdjjj.exe58⤵
- Executes dropped EXE
PID:2192 -
\??\c:\lllflrx.exec:\lllflrx.exe59⤵
- Executes dropped EXE
PID:2908 -
\??\c:\xxxxxfl.exec:\xxxxxfl.exe60⤵
- Executes dropped EXE
PID:1780 -
\??\c:\tnbnbb.exec:\tnbnbb.exe61⤵
- Executes dropped EXE
PID:488 -
\??\c:\bnbbhn.exec:\bnbbhn.exe62⤵
- Executes dropped EXE
PID:1648 -
\??\c:\ddjvv.exec:\ddjvv.exe63⤵
- Executes dropped EXE
PID:1056 -
\??\c:\vvjvd.exec:\vvjvd.exe64⤵
- Executes dropped EXE
PID:344 -
\??\c:\frxrlrl.exec:\frxrlrl.exe65⤵
- Executes dropped EXE
PID:2404 -
\??\c:\xlrfxxx.exec:\xlrfxxx.exe66⤵PID:916
-
\??\c:\hnttnn.exec:\hnttnn.exe67⤵PID:1736
-
\??\c:\7hbbbt.exec:\7hbbbt.exe68⤵PID:872
-
\??\c:\pdjjd.exec:\pdjjd.exe69⤵PID:2188
-
\??\c:\djdvv.exec:\djdvv.exe70⤵PID:1496
-
\??\c:\1lxrfxl.exec:\1lxrfxl.exe71⤵PID:1492
-
\??\c:\xllfxrl.exec:\xllfxrl.exe72⤵PID:2932
-
\??\c:\hnnntt.exec:\hnnntt.exe73⤵PID:1708
-
\??\c:\btntbb.exec:\btntbb.exe74⤵PID:1600
-
\??\c:\hbbbbn.exec:\hbbbbn.exe75⤵PID:2020
-
\??\c:\dvjdj.exec:\dvjdj.exe76⤵PID:1032
-
\??\c:\dvpjv.exec:\dvpjv.exe77⤵PID:2580
-
\??\c:\fxrxffl.exec:\fxrxffl.exe78⤵PID:2732
-
\??\c:\frflllx.exec:\frflllx.exe79⤵PID:2904
-
\??\c:\hbttbb.exec:\hbttbb.exe80⤵PID:2596
-
\??\c:\thnttb.exec:\thnttb.exe81⤵PID:2828
-
\??\c:\9tnnnn.exec:\9tnnnn.exe82⤵PID:2624
-
\??\c:\vpvdd.exec:\vpvdd.exe83⤵PID:2576
-
\??\c:\9vpvv.exec:\9vpvv.exe84⤵PID:3052
-
\??\c:\xxflfll.exec:\xxflfll.exe85⤵PID:2468
-
\??\c:\xrxffll.exec:\xrxffll.exe86⤵PID:2612
-
\??\c:\tbnhbb.exec:\tbnhbb.exe87⤵PID:1796
-
\??\c:\pddjp.exec:\pddjp.exe88⤵PID:2948
-
\??\c:\jdjdj.exec:\jdjdj.exe89⤵PID:2768
-
\??\c:\dddvd.exec:\dddvd.exe90⤵PID:2676
-
\??\c:\1fflllr.exec:\1fflllr.exe91⤵PID:1840
-
\??\c:\bhtnhb.exec:\bhtnhb.exe92⤵PID:3028
-
\??\c:\hbntth.exec:\hbntth.exe93⤵PID:2820
-
\??\c:\jvjjv.exec:\jvjjv.exe94⤵PID:2800
-
\??\c:\dpdjp.exec:\dpdjp.exe95⤵PID:1428
-
\??\c:\lfrrrrr.exec:\lfrrrrr.exe96⤵PID:1352
-
\??\c:\bnbhnb.exec:\bnbhnb.exe97⤵PID:1792
-
\??\c:\tnbhhn.exec:\tnbhhn.exe98⤵PID:1860
-
\??\c:\tnttnt.exec:\tnttnt.exe99⤵PID:2236
-
\??\c:\7vddj.exec:\7vddj.exe100⤵PID:1696
-
\??\c:\pjpvj.exec:\pjpvj.exe101⤵PID:2416
-
\??\c:\3frrxfl.exec:\3frrxfl.exe102⤵PID:1644
-
\??\c:\bttthh.exec:\bttthh.exe103⤵PID:2052
-
\??\c:\nbntnh.exec:\nbntnh.exe104⤵PID:816
-
\??\c:\1tbhnh.exec:\1tbhnh.exe105⤵PID:1048
-
\??\c:\ddjpj.exec:\ddjpj.exe106⤵PID:920
-
\??\c:\3pjpv.exec:\3pjpv.exe107⤵PID:844
-
\??\c:\3llrrxf.exec:\3llrrxf.exe108⤵PID:1508
-
\??\c:\fxrxlxx.exec:\fxrxlxx.exe109⤵PID:992
-
\??\c:\5tttbh.exec:\5tttbh.exe110⤵PID:2360
-
\??\c:\btnthn.exec:\btnthn.exe111⤵PID:1272
-
\??\c:\1tnnhh.exec:\1tnnhh.exe112⤵PID:1304
-
\??\c:\pjppv.exec:\pjppv.exe113⤵PID:1712
-
\??\c:\5jdpp.exec:\5jdpp.exe114⤵PID:552
-
\??\c:\fxflxxx.exec:\fxflxxx.exe115⤵PID:2764
-
\??\c:\ffxflrr.exec:\ffxflrr.exe116⤵PID:2532
-
\??\c:\1xxfrxr.exec:\1xxfrxr.exe117⤵PID:2584
-
\??\c:\hhnnnn.exec:\hhnnnn.exe118⤵PID:2664
-
\??\c:\1jjjv.exec:\1jjjv.exe119⤵PID:2640
-
\??\c:\jdjjj.exec:\jdjjj.exe120⤵PID:2556
-
\??\c:\ppdpp.exec:\ppdpp.exe121⤵PID:2804
-
\??\c:\xrfxflr.exec:\xrfxflr.exe122⤵PID:2812
-
\??\c:\xrrrflx.exec:\xrrrflx.exe123⤵PID:896
-
\??\c:\1hhbtb.exec:\1hhbtb.exe124⤵PID:2560
-
\??\c:\nhhhth.exec:\nhhhth.exe125⤵PID:2996
-
\??\c:\dvjdj.exec:\dvjdj.exe126⤵PID:2992
-
\??\c:\vpdpd.exec:\vpdpd.exe127⤵PID:2968
-
\??\c:\ffxxllx.exec:\ffxxllx.exe128⤵PID:2964
-
\??\c:\5rrfllx.exec:\5rrfllx.exe129⤵PID:2972
-
\??\c:\lfrrffx.exec:\lfrrffx.exe130⤵PID:2000
-
\??\c:\htntnh.exec:\htntnh.exe131⤵PID:2616
-
\??\c:\bthhnt.exec:\bthhnt.exe132⤵PID:2692
-
\??\c:\vpddp.exec:\vpddp.exe133⤵PID:2788
-
\??\c:\vvvdp.exec:\vvvdp.exe134⤵PID:2780
-
\??\c:\fxlrxrx.exec:\fxlrxrx.exe135⤵PID:1812
-
\??\c:\rlxrflx.exec:\rlxrflx.exe136⤵PID:1396
-
\??\c:\tthbhh.exec:\tthbhh.exe137⤵PID:2028
-
\??\c:\nhtbht.exec:\nhtbht.exe138⤵PID:1692
-
\??\c:\9hbbht.exec:\9hbbht.exe139⤵PID:2916
-
\??\c:\9pvpp.exec:\9pvpp.exe140⤵PID:1608
-
\??\c:\ddjjv.exec:\ddjjv.exe141⤵PID:2108
-
\??\c:\xlxxxfl.exec:\xlxxxfl.exe142⤵PID:2920
-
\??\c:\3fffxrf.exec:\3fffxrf.exe143⤵PID:1488
-
\??\c:\bhbttn.exec:\bhbttn.exe144⤵PID:2620
-
\??\c:\hbhtbt.exec:\hbhtbt.exe145⤵PID:1848
-
\??\c:\jjvvd.exec:\jjvvd.exe146⤵PID:908
-
\??\c:\1jvdp.exec:\1jvdp.exe147⤵PID:1784
-
\??\c:\dpddj.exec:\dpddj.exe148⤵PID:2400
-
\??\c:\lfrxffr.exec:\lfrxffr.exe149⤵PID:2312
-
\??\c:\fxllrrf.exec:\fxllrrf.exe150⤵PID:2284
-
\??\c:\tthtbh.exec:\tthtbh.exe151⤵PID:2204
-
\??\c:\3hhhtn.exec:\3hhhtn.exe152⤵PID:1992
-
\??\c:\1dpjj.exec:\1dpjj.exe153⤵PID:1596
-
\??\c:\ppjjp.exec:\ppjjp.exe154⤵PID:2096
-
\??\c:\rlrrxfx.exec:\rlrrxfx.exe155⤵PID:3060
-
\??\c:\1xrxllf.exec:\1xrxllf.exe156⤵PID:284
-
\??\c:\rrflrxf.exec:\rrflrxf.exe157⤵PID:1580
-
\??\c:\1hbnth.exec:\1hbnth.exe158⤵PID:2032
-
\??\c:\tnbhnh.exec:\tnbhnh.exe159⤵PID:2648
-
\??\c:\dpdjj.exec:\dpdjj.exe160⤵PID:2588
-
\??\c:\9lrrrrx.exec:\9lrrrrx.exe161⤵PID:2092
-
\??\c:\lxlrlff.exec:\lxlrlff.exe162⤵PID:2656
-
\??\c:\fflxlxr.exec:\fflxlxr.exe163⤵PID:2852
-
\??\c:\3bnbnn.exec:\3bnbnn.exe164⤵PID:2516
-
\??\c:\tnttbb.exec:\tnttbb.exe165⤵PID:1944
-
\??\c:\3pjjj.exec:\3pjjj.exe166⤵PID:1436
-
\??\c:\9ddjj.exec:\9ddjj.exe167⤵PID:2984
-
\??\c:\pvppj.exec:\pvppj.exe168⤵PID:3032
-
\??\c:\fxfflrx.exec:\fxfflrx.exe169⤵PID:2476
-
\??\c:\9frlrxf.exec:\9frlrxf.exe170⤵PID:2424
-
\??\c:\bthnbb.exec:\bthnbb.exe171⤵PID:1528
-
\??\c:\tnbbhh.exec:\tnbbhh.exe172⤵PID:2672
-
\??\c:\vjjjj.exec:\vjjjj.exe173⤵PID:2696
-
\??\c:\7vjjd.exec:\7vjjd.exe174⤵PID:2688
-
\??\c:\lfrrflr.exec:\lfrrflr.exe175⤵PID:2724
-
\??\c:\xlrxflr.exec:\xlrxflr.exe176⤵PID:1364
-
\??\c:\tnnhhb.exec:\tnnhhb.exe177⤵PID:2304
-
\??\c:\pdjdd.exec:\pdjdd.exe178⤵PID:2104
-
\??\c:\7xrxffr.exec:\7xrxffr.exe179⤵PID:2100
-
\??\c:\lflrrrx.exec:\lflrrrx.exe180⤵PID:2844
-
\??\c:\hbbbbt.exec:\hbbbbt.exe181⤵PID:336
-
\??\c:\bbbbbh.exec:\bbbbbh.exe182⤵PID:324
-
\??\c:\nbhbbh.exec:\nbhbbh.exe183⤵PID:1500
-
\??\c:\vjjdd.exec:\vjjdd.exe184⤵PID:1536
-
\??\c:\ppddj.exec:\ppddj.exe185⤵PID:692
-
\??\c:\5rllrlr.exec:\5rllrlr.exe186⤵PID:560
-
\??\c:\rflflfx.exec:\rflflfx.exe187⤵PID:1876
-
\??\c:\lflrfll.exec:\lflrfll.exe188⤵PID:1308
-
\??\c:\5bthnt.exec:\5bthnt.exe189⤵PID:612
-
\??\c:\3pvpp.exec:\3pvpp.exe190⤵PID:804
-
\??\c:\pvdvj.exec:\pvdvj.exe191⤵PID:1628
-
\??\c:\3ffrffl.exec:\3ffrffl.exe192⤵PID:2392
-
\??\c:\7rlxrlx.exec:\7rlxrlx.exe193⤵PID:1984
-
\??\c:\bhbntt.exec:\bhbntt.exe194⤵PID:2200
-
\??\c:\3bbnhb.exec:\3bbnhb.exe195⤵PID:1568
-
\??\c:\7ntbbt.exec:\7ntbbt.exe196⤵PID:3064
-
\??\c:\pjpdd.exec:\pjpdd.exe197⤵PID:2336
-
\??\c:\5lrxffr.exec:\5lrxffr.exe198⤵PID:2288
-
\??\c:\xrfrxfr.exec:\xrfrxfr.exe199⤵PID:2752
-
\??\c:\7xlfxfr.exec:\7xlfxfr.exe200⤵PID:2888
-
\??\c:\3nhnbb.exec:\3nhnbb.exe201⤵PID:2300
-
\??\c:\nnnnnh.exec:\nnnnnh.exe202⤵PID:1756
-
\??\c:\3jvdp.exec:\3jvdp.exe203⤵PID:2600
-
\??\c:\vjdvv.exec:\vjdvv.exe204⤵PID:2500
-
\??\c:\9xxxxrx.exec:\9xxxxrx.exe205⤵PID:2480
-
\??\c:\lrxfllr.exec:\lrxfllr.exe206⤵PID:3044
-
\??\c:\tthtbb.exec:\tthtbb.exe207⤵PID:2872
-
\??\c:\7ntbbt.exec:\7ntbbt.exe208⤵PID:1432
-
\??\c:\pjvvj.exec:\pjvvj.exe209⤵PID:3016
-
\??\c:\3pjdv.exec:\3pjdv.exe210⤵PID:2496
-
\??\c:\llflflf.exec:\llflflf.exe211⤵PID:2024
-
\??\c:\7rllrrr.exec:\7rllrrr.exe212⤵PID:2684
-
\??\c:\9nnbhn.exec:\9nnbhn.exe213⤵PID:1524
-
\??\c:\hntbhh.exec:\hntbhh.exe214⤵PID:2384
-
\??\c:\pjvjp.exec:\pjvjp.exe215⤵PID:2860
-
\??\c:\9fxxfff.exec:\9fxxfff.exe216⤵PID:1476
-
\??\c:\9ntttb.exec:\9ntttb.exe217⤵PID:1440
-
\??\c:\jvjjj.exec:\jvjjj.exe218⤵PID:2068
-
\??\c:\5vjvv.exec:\5vjvv.exe219⤵PID:1860
-
\??\c:\bnhntb.exec:\bnhntb.exe220⤵PID:1116
-
\??\c:\thntbh.exec:\thntbh.exe221⤵PID:1608
-
\??\c:\ppppd.exec:\ppppd.exe222⤵PID:1780
-
\??\c:\jdpvj.exec:\jdpvj.exe223⤵PID:1644
-
\??\c:\dvppv.exec:\dvppv.exe224⤵PID:576
-
\??\c:\7rlrrlr.exec:\7rlrrlr.exe225⤵PID:1996
-
\??\c:\rrrxfrf.exec:\rrrxfrf.exe226⤵PID:1576
-
\??\c:\bthbtn.exec:\bthbtn.exe227⤵PID:1584
-
\??\c:\5hnbbh.exec:\5hnbbh.exe228⤵PID:2212
-
\??\c:\pjppp.exec:\pjppp.exe229⤵PID:2344
-
\??\c:\7pdvv.exec:\7pdvv.exe230⤵PID:2316
-
\??\c:\vpdjp.exec:\vpdjp.exe231⤵PID:2928
-
\??\c:\flflfrl.exec:\flflfrl.exe232⤵PID:1496
-
\??\c:\rfrxfxf.exec:\rfrxfxf.exe233⤵PID:1992
-
\??\c:\bhnbbh.exec:\bhnbbh.exe234⤵PID:2932
-
\??\c:\tbhbtn.exec:\tbhbtn.exe235⤵PID:2352
-
\??\c:\jdppp.exec:\jdppp.exe236⤵PID:300
-
\??\c:\pdpjj.exec:\pdpjj.exe237⤵PID:2940
-
\??\c:\3fxfxxx.exec:\3fxfxxx.exe238⤵PID:2548
-
\??\c:\7rxxxxf.exec:\7rxxxxf.exe239⤵PID:2032
-
\??\c:\9tnhnn.exec:\9tnhnn.exe240⤵PID:2544
-
\??\c:\bthhbt.exec:\bthhbt.exe241⤵PID:2888
-
\??\c:\9bttbt.exec:\9bttbt.exe242⤵PID:2444