Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 23:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2963ed62e8506848012aeca7bbb9b4b0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
2963ed62e8506848012aeca7bbb9b4b0_NeikiAnalytics.exe
-
Size
244KB
-
MD5
2963ed62e8506848012aeca7bbb9b4b0
-
SHA1
336f5346d76edbae51577b72b11386348335328d
-
SHA256
bc671f9b02fc13da178dda77874e283d4804c0380a733d4ed984c8c6a970a98c
-
SHA512
a405ff885a9ed5a27c299a787713c9156f043af57381a78eadff29f8c088ec9d78d5aca4e433eea631b9204bb256835132dad76be4e9b0eb71f3de2082a8ca62
-
SSDEEP
6144:n3C9BRo/AIX27NHWpU00VIxas1oa3YiFRX:n3C9uD6AUDCa4NYmRX
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/2972-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1992-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1520-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/380-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/996-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/772-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1336-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2332-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2236-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1072-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2136-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2404-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1508-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
frfxfxl.exebbhnnh.exedvppv.exebtntbn.exevpdjd.exejddpd.exefxrfxxl.exethtbhh.exe3hnttt.exepjddp.exelxllrlr.exeffrfrxl.exehbhbbt.exeddppj.exepjdjv.exexrfrxll.exetnnbnb.exehhthtb.exejjdpv.exe9lflxlx.exe1htttt.exevjvdd.exexlrllxx.exelfxxfll.exebbnbbb.exe5jjpp.exe1lrlrrx.exenbhhnn.exepjjdj.exexllrlfl.exerrffxll.exebtnhbn.exethtbbb.exenhtntt.exe9pjdj.exe9ddjj.exeffflxrf.exelfrxfrl.exenhnbnt.exe7hbnbn.exe7vppp.exevvjjp.exevpdpd.exerrlrffx.exe9bbnbn.exenhtbnn.exevpjdv.exefrrfrfx.exennhtth.exebntnhb.exepvpdj.exe5llfllr.exeffxlxfr.exebbbbnt.exe5hbbhn.exepdppv.exexxrlrxr.exexrlxllr.exe3ththt.exe1dvjp.exevvpjd.exefxffxlr.exebthtnt.exepdvdp.exepid process 1992 frfxfxl.exe 2520 bbhnnh.exe 2652 dvppv.exe 2552 btntbn.exe 2700 vpdjd.exe 2464 jddpd.exe 2424 fxrfxxl.exe 1608 thtbhh.exe 2856 3hnttt.exe 1620 pjddp.exe 1508 lxllrlr.exe 2736 ffrfrxl.exe 1520 hbhbbt.exe 380 ddppj.exe 2160 pjdjv.exe 996 xrfrxll.exe 2380 tnnbnb.exe 632 hhthtb.exe 2072 jjdpv.exe 2404 9lflxlx.exe 2136 1htttt.exe 336 vjvdd.exe 772 xlrllxx.exe 1160 lfxxfll.exe 904 bbnbbb.exe 1336 5jjpp.exe 1072 1lrlrrx.exe 2236 nbhhnn.exe 2272 pjjdj.exe 812 xllrlfl.exe 2332 rrffxll.exe 2112 btnhbn.exe 2036 thtbbb.exe 2532 nhtntt.exe 2888 9pjdj.exe 2784 9ddjj.exe 2640 ffflxrf.exe 2776 lfrxfrl.exe 2448 nhnbnt.exe 2680 7hbnbn.exe 2476 7vppp.exe 2908 vvjjp.exe 2352 vpdpd.exe 1616 rrlrffx.exe 2456 9bbnbn.exe 2732 nhtbnn.exe 1704 vpjdv.exe 1676 frrfrfx.exe 2208 nnhtth.exe 2600 bntnhb.exe 2316 pvpdj.exe 2844 5llfllr.exe 2344 ffxlxfr.exe 2120 bbbbnt.exe 2848 5hbbhn.exe 1688 pdppv.exe 1784 xxrlrxr.exe 888 xrlxllr.exe 776 3ththt.exe 1480 1dvjp.exe 1440 vvpjd.exe 1812 fxffxlr.exe 2124 bthtnt.exe 496 pdvdp.exe -
Processes:
resource yara_rule behavioral1/memory/2972-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1992-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/380-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/996-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/772-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1336-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-295-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1072-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2136-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2404-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1508-116-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2963ed62e8506848012aeca7bbb9b4b0_NeikiAnalytics.exefrfxfxl.exebbhnnh.exedvppv.exebtntbn.exevpdjd.exejddpd.exefxrfxxl.exethtbhh.exe3hnttt.exepjddp.exelxllrlr.exeffrfrxl.exehbhbbt.exeddppj.exepjdjv.exedescription pid process target process PID 2972 wrote to memory of 1992 2972 2963ed62e8506848012aeca7bbb9b4b0_NeikiAnalytics.exe frfxfxl.exe PID 2972 wrote to memory of 1992 2972 2963ed62e8506848012aeca7bbb9b4b0_NeikiAnalytics.exe frfxfxl.exe PID 2972 wrote to memory of 1992 2972 2963ed62e8506848012aeca7bbb9b4b0_NeikiAnalytics.exe frfxfxl.exe PID 2972 wrote to memory of 1992 2972 2963ed62e8506848012aeca7bbb9b4b0_NeikiAnalytics.exe frfxfxl.exe PID 1992 wrote to memory of 2520 1992 frfxfxl.exe bbhnnh.exe PID 1992 wrote to memory of 2520 1992 frfxfxl.exe bbhnnh.exe PID 1992 wrote to memory of 2520 1992 frfxfxl.exe bbhnnh.exe PID 1992 wrote to memory of 2520 1992 frfxfxl.exe bbhnnh.exe PID 2520 wrote to memory of 2652 2520 bbhnnh.exe dvppv.exe PID 2520 wrote to memory of 2652 2520 bbhnnh.exe dvppv.exe PID 2520 wrote to memory of 2652 2520 bbhnnh.exe dvppv.exe PID 2520 wrote to memory of 2652 2520 bbhnnh.exe dvppv.exe PID 2652 wrote to memory of 2552 2652 dvppv.exe btntbn.exe PID 2652 wrote to memory of 2552 2652 dvppv.exe btntbn.exe PID 2652 wrote to memory of 2552 2652 dvppv.exe btntbn.exe PID 2652 wrote to memory of 2552 2652 dvppv.exe btntbn.exe PID 2552 wrote to memory of 2700 2552 btntbn.exe vpdjd.exe PID 2552 wrote to memory of 2700 2552 btntbn.exe vpdjd.exe PID 2552 wrote to memory of 2700 2552 btntbn.exe vpdjd.exe PID 2552 wrote to memory of 2700 2552 btntbn.exe vpdjd.exe PID 2700 wrote to memory of 2464 2700 vpdjd.exe jddpd.exe PID 2700 wrote to memory of 2464 2700 vpdjd.exe jddpd.exe PID 2700 wrote to memory of 2464 2700 vpdjd.exe jddpd.exe PID 2700 wrote to memory of 2464 2700 vpdjd.exe jddpd.exe PID 2464 wrote to memory of 2424 2464 jddpd.exe fxrfxxl.exe PID 2464 wrote to memory of 2424 2464 jddpd.exe fxrfxxl.exe PID 2464 wrote to memory of 2424 2464 jddpd.exe fxrfxxl.exe PID 2464 wrote to memory of 2424 2464 jddpd.exe fxrfxxl.exe PID 2424 wrote to memory of 1608 2424 fxrfxxl.exe thtbhh.exe PID 2424 wrote to memory of 1608 2424 fxrfxxl.exe thtbhh.exe PID 2424 wrote to memory of 1608 2424 fxrfxxl.exe thtbhh.exe PID 2424 wrote to memory of 1608 2424 fxrfxxl.exe thtbhh.exe PID 1608 wrote to memory of 2856 1608 thtbhh.exe 3hnttt.exe PID 1608 wrote to memory of 2856 1608 thtbhh.exe 3hnttt.exe PID 1608 wrote to memory of 2856 1608 thtbhh.exe 3hnttt.exe PID 1608 wrote to memory of 2856 1608 thtbhh.exe 3hnttt.exe PID 2856 wrote to memory of 1620 2856 3hnttt.exe pjddp.exe PID 2856 wrote to memory of 1620 2856 3hnttt.exe pjddp.exe PID 2856 wrote to memory of 1620 2856 3hnttt.exe pjddp.exe PID 2856 wrote to memory of 1620 2856 3hnttt.exe pjddp.exe PID 1620 wrote to memory of 1508 1620 pjddp.exe lxllrlr.exe PID 1620 wrote to memory of 1508 1620 pjddp.exe lxllrlr.exe PID 1620 wrote to memory of 1508 1620 pjddp.exe lxllrlr.exe PID 1620 wrote to memory of 1508 1620 pjddp.exe lxllrlr.exe PID 1508 wrote to memory of 2736 1508 lxllrlr.exe ffrfrxl.exe PID 1508 wrote to memory of 2736 1508 lxllrlr.exe ffrfrxl.exe PID 1508 wrote to memory of 2736 1508 lxllrlr.exe ffrfrxl.exe PID 1508 wrote to memory of 2736 1508 lxllrlr.exe ffrfrxl.exe PID 2736 wrote to memory of 1520 2736 ffrfrxl.exe hbhbbt.exe PID 2736 wrote to memory of 1520 2736 ffrfrxl.exe hbhbbt.exe PID 2736 wrote to memory of 1520 2736 ffrfrxl.exe hbhbbt.exe PID 2736 wrote to memory of 1520 2736 ffrfrxl.exe hbhbbt.exe PID 1520 wrote to memory of 380 1520 hbhbbt.exe ddppj.exe PID 1520 wrote to memory of 380 1520 hbhbbt.exe ddppj.exe PID 1520 wrote to memory of 380 1520 hbhbbt.exe ddppj.exe PID 1520 wrote to memory of 380 1520 hbhbbt.exe ddppj.exe PID 380 wrote to memory of 2160 380 ddppj.exe pjdjv.exe PID 380 wrote to memory of 2160 380 ddppj.exe pjdjv.exe PID 380 wrote to memory of 2160 380 ddppj.exe pjdjv.exe PID 380 wrote to memory of 2160 380 ddppj.exe pjdjv.exe PID 2160 wrote to memory of 996 2160 pjdjv.exe xrfrxll.exe PID 2160 wrote to memory of 996 2160 pjdjv.exe xrfrxll.exe PID 2160 wrote to memory of 996 2160 pjdjv.exe xrfrxll.exe PID 2160 wrote to memory of 996 2160 pjdjv.exe xrfrxll.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2963ed62e8506848012aeca7bbb9b4b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2963ed62e8506848012aeca7bbb9b4b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\frfxfxl.exec:\frfxfxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\bbhnnh.exec:\bbhnnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\dvppv.exec:\dvppv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\btntbn.exec:\btntbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\vpdjd.exec:\vpdjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\jddpd.exec:\jddpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\fxrfxxl.exec:\fxrfxxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\thtbhh.exec:\thtbhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\3hnttt.exec:\3hnttt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\pjddp.exec:\pjddp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\lxllrlr.exec:\lxllrlr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\ffrfrxl.exec:\ffrfrxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\hbhbbt.exec:\hbhbbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\ddppj.exec:\ddppj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\pjdjv.exec:\pjdjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\xrfrxll.exec:\xrfrxll.exe17⤵
- Executes dropped EXE
PID:996 -
\??\c:\tnnbnb.exec:\tnnbnb.exe18⤵
- Executes dropped EXE
PID:2380 -
\??\c:\hhthtb.exec:\hhthtb.exe19⤵
- Executes dropped EXE
PID:632 -
\??\c:\jjdpv.exec:\jjdpv.exe20⤵
- Executes dropped EXE
PID:2072 -
\??\c:\9lflxlx.exec:\9lflxlx.exe21⤵
- Executes dropped EXE
PID:2404 -
\??\c:\1htttt.exec:\1htttt.exe22⤵
- Executes dropped EXE
PID:2136 -
\??\c:\vjvdd.exec:\vjvdd.exe23⤵
- Executes dropped EXE
PID:336 -
\??\c:\xlrllxx.exec:\xlrllxx.exe24⤵
- Executes dropped EXE
PID:772 -
\??\c:\lfxxfll.exec:\lfxxfll.exe25⤵
- Executes dropped EXE
PID:1160 -
\??\c:\bbnbbb.exec:\bbnbbb.exe26⤵
- Executes dropped EXE
PID:904 -
\??\c:\5jjpp.exec:\5jjpp.exe27⤵
- Executes dropped EXE
PID:1336 -
\??\c:\1lrlrrx.exec:\1lrlrrx.exe28⤵
- Executes dropped EXE
PID:1072 -
\??\c:\nbhhnn.exec:\nbhhnn.exe29⤵
- Executes dropped EXE
PID:2236 -
\??\c:\pjjdj.exec:\pjjdj.exe30⤵
- Executes dropped EXE
PID:2272 -
\??\c:\xllrlfl.exec:\xllrlfl.exe31⤵
- Executes dropped EXE
PID:812 -
\??\c:\rrffxll.exec:\rrffxll.exe32⤵
- Executes dropped EXE
PID:2332 -
\??\c:\btnhbn.exec:\btnhbn.exe33⤵
- Executes dropped EXE
PID:2112 -
\??\c:\thtbbb.exec:\thtbbb.exe34⤵
- Executes dropped EXE
PID:2036 -
\??\c:\nhtntt.exec:\nhtntt.exe35⤵
- Executes dropped EXE
PID:2532 -
\??\c:\9pjdj.exec:\9pjdj.exe36⤵
- Executes dropped EXE
PID:2888 -
\??\c:\9ddjj.exec:\9ddjj.exe37⤵
- Executes dropped EXE
PID:2784 -
\??\c:\ffflxrf.exec:\ffflxrf.exe38⤵
- Executes dropped EXE
PID:2640 -
\??\c:\lfrxfrl.exec:\lfrxfrl.exe39⤵
- Executes dropped EXE
PID:2776 -
\??\c:\nhnbnt.exec:\nhnbnt.exe40⤵
- Executes dropped EXE
PID:2448 -
\??\c:\7hbnbn.exec:\7hbnbn.exe41⤵
- Executes dropped EXE
PID:2680 -
\??\c:\7vppp.exec:\7vppp.exe42⤵
- Executes dropped EXE
PID:2476 -
\??\c:\vvjjp.exec:\vvjjp.exe43⤵
- Executes dropped EXE
PID:2908 -
\??\c:\vpdpd.exec:\vpdpd.exe44⤵
- Executes dropped EXE
PID:2352 -
\??\c:\rrlrffx.exec:\rrlrffx.exe45⤵
- Executes dropped EXE
PID:1616 -
\??\c:\9bbnbn.exec:\9bbnbn.exe46⤵
- Executes dropped EXE
PID:2456 -
\??\c:\nhtbnn.exec:\nhtbnn.exe47⤵
- Executes dropped EXE
PID:2732 -
\??\c:\vpjdv.exec:\vpjdv.exe48⤵
- Executes dropped EXE
PID:1704 -
\??\c:\frrfrfx.exec:\frrfrfx.exe49⤵
- Executes dropped EXE
PID:1676 -
\??\c:\nnhtth.exec:\nnhtth.exe50⤵
- Executes dropped EXE
PID:2208 -
\??\c:\bntnhb.exec:\bntnhb.exe51⤵
- Executes dropped EXE
PID:2600 -
\??\c:\pvpdj.exec:\pvpdj.exe52⤵
- Executes dropped EXE
PID:2316 -
\??\c:\5llfllr.exec:\5llfllr.exe53⤵
- Executes dropped EXE
PID:2844 -
\??\c:\ffxlxfr.exec:\ffxlxfr.exe54⤵
- Executes dropped EXE
PID:2344 -
\??\c:\bbbbnt.exec:\bbbbnt.exe55⤵
- Executes dropped EXE
PID:2120 -
\??\c:\5hbbhn.exec:\5hbbhn.exe56⤵
- Executes dropped EXE
PID:2848 -
\??\c:\pdppv.exec:\pdppv.exe57⤵
- Executes dropped EXE
PID:1688 -
\??\c:\xxrlrxr.exec:\xxrlrxr.exe58⤵
- Executes dropped EXE
PID:1784 -
\??\c:\xrlxllr.exec:\xrlxllr.exe59⤵
- Executes dropped EXE
PID:888 -
\??\c:\3ththt.exec:\3ththt.exe60⤵
- Executes dropped EXE
PID:776 -
\??\c:\1dvjp.exec:\1dvjp.exe61⤵
- Executes dropped EXE
PID:1480 -
\??\c:\vvpjd.exec:\vvpjd.exe62⤵
- Executes dropped EXE
PID:1440 -
\??\c:\fxffxlr.exec:\fxffxlr.exe63⤵
- Executes dropped EXE
PID:1812 -
\??\c:\bthtnt.exec:\bthtnt.exe64⤵
- Executes dropped EXE
PID:2124 -
\??\c:\pdvdp.exec:\pdvdp.exe65⤵
- Executes dropped EXE
PID:496 -
\??\c:\3rllxxf.exec:\3rllxxf.exe66⤵PID:2028
-
\??\c:\nnhnbb.exec:\nnhnbb.exe67⤵PID:2116
-
\??\c:\1nhnhn.exec:\1nhnhn.exe68⤵PID:2176
-
\??\c:\5jvvd.exec:\5jvvd.exe69⤵PID:3000
-
\??\c:\jpppv.exec:\jpppv.exe70⤵PID:1952
-
\??\c:\llffrlx.exec:\llffrlx.exe71⤵PID:2400
-
\??\c:\hbnbhn.exec:\hbnbhn.exe72⤵PID:2960
-
\??\c:\btnbbb.exec:\btnbbb.exe73⤵PID:2568
-
\??\c:\ddjdj.exec:\ddjdj.exe74⤵PID:1928
-
\??\c:\lxllxll.exec:\lxllxll.exe75⤵PID:1568
-
\??\c:\lfxlxxf.exec:\lfxlxxf.exe76⤵PID:1600
-
\??\c:\nbtbnt.exec:\nbtbnt.exe77⤵PID:1588
-
\??\c:\1hbbnn.exec:\1hbbnn.exe78⤵PID:2628
-
\??\c:\7pdvj.exec:\7pdvj.exe79⤵PID:2376
-
\??\c:\9djjp.exec:\9djjp.exe80⤵PID:2608
-
\??\c:\lfxxfrf.exec:\lfxxfrf.exe81⤵PID:1320
-
\??\c:\ttnhtt.exec:\ttnhtt.exe82⤵PID:2632
-
\??\c:\tnbnbb.exec:\tnbnbb.exe83⤵PID:2424
-
\??\c:\dvpdj.exec:\dvpdj.exe84⤵PID:2880
-
\??\c:\ffxrffr.exec:\ffxrffr.exe85⤵PID:2500
-
\??\c:\7xrrxxr.exec:\7xrrxxr.exe86⤵PID:1220
-
\??\c:\htbhht.exec:\htbhht.exe87⤵PID:2516
-
\??\c:\tnbbnn.exec:\tnbbnn.exe88⤵PID:916
-
\??\c:\ddvvd.exec:\ddvvd.exe89⤵PID:1672
-
\??\c:\rrlxllf.exec:\rrlxllf.exe90⤵PID:1848
-
\??\c:\xrfflxf.exec:\xrfflxf.exe91⤵PID:2388
-
\??\c:\hbhnbb.exec:\hbhnbb.exe92⤵PID:696
-
\??\c:\pjdjj.exec:\pjdjj.exe93⤵PID:296
-
\??\c:\vjvpp.exec:\vjvpp.exe94⤵PID:2748
-
\??\c:\fxllrrr.exec:\fxllrrr.exe95⤵PID:1200
-
\??\c:\frfrrxr.exec:\frfrrxr.exe96⤵PID:2524
-
\??\c:\3nhtbh.exec:\3nhtbh.exe97⤵PID:2756
-
\??\c:\pjvvd.exec:\pjvvd.exe98⤵PID:1916
-
\??\c:\pjvvj.exec:\pjvvj.exe99⤵PID:2308
-
\??\c:\7frxxfr.exec:\7frxxfr.exe100⤵PID:840
-
\??\c:\3tbtht.exec:\3tbtht.exe101⤵PID:1640
-
\??\c:\hbhnbt.exec:\hbhnbt.exe102⤵PID:772
-
\??\c:\ppvdp.exec:\ppvdp.exe103⤵PID:2360
-
\??\c:\ddpdv.exec:\ddpdv.exe104⤵PID:1160
-
\??\c:\rlxlxfl.exec:\rlxlxfl.exe105⤵PID:1816
-
\??\c:\hhbnbn.exec:\hhbnbn.exe106⤵PID:900
-
\??\c:\nhtthh.exec:\nhtthh.exe107⤵PID:1752
-
\??\c:\7pjdp.exec:\7pjdp.exe108⤵PID:1072
-
\??\c:\dvjjp.exec:\dvjjp.exe109⤵PID:1792
-
\??\c:\xrlrffl.exec:\xrlrffl.exe110⤵PID:2824
-
\??\c:\7lrrxxf.exec:\7lrrxxf.exe111⤵PID:2980
-
\??\c:\3tnntt.exec:\3tnntt.exe112⤵PID:2000
-
\??\c:\vpjpv.exec:\vpjpv.exe113⤵PID:2112
-
\??\c:\vpjdp.exec:\vpjdp.exe114⤵PID:2872
-
\??\c:\5frrxfl.exec:\5frrxfl.exe115⤵PID:2584
-
\??\c:\xrlxflf.exec:\xrlxflf.exe116⤵PID:2096
-
\??\c:\ttbbhh.exec:\ttbbhh.exe117⤵PID:2688
-
\??\c:\jdjvv.exec:\jdjvv.exe118⤵PID:2556
-
\??\c:\7lrlrrx.exec:\7lrlrrx.exe119⤵PID:2100
-
\??\c:\hbhnbn.exec:\hbhnbn.exe120⤵PID:2696
-
\??\c:\nhttht.exec:\nhttht.exe121⤵PID:2472
-
\??\c:\pjvvj.exec:\pjvvj.exe122⤵PID:2448
-
\??\c:\jdvdp.exec:\jdvdp.exe123⤵PID:2852
-
\??\c:\lfrlflf.exec:\lfrlflf.exe124⤵PID:2476
-
\??\c:\rlxrllx.exec:\rlxrllx.exe125⤵PID:2324
-
\??\c:\bnhttt.exec:\bnhttt.exe126⤵PID:2468
-
\??\c:\7dppd.exec:\7dppd.exe127⤵PID:1616
-
\??\c:\7jvdp.exec:\7jvdp.exe128⤵PID:1508
-
\??\c:\lrlxlxx.exec:\lrlxlxx.exe129⤵PID:2736
-
\??\c:\lflrfxx.exec:\lflrfxx.exe130⤵PID:2720
-
\??\c:\nthhbh.exec:\nthhbh.exe131⤵PID:2204
-
\??\c:\tnbtbb.exec:\tnbtbb.exe132⤵PID:2672
-
\??\c:\5vppp.exec:\5vppp.exe133⤵PID:2728
-
\??\c:\llfflfx.exec:\llfflfx.exe134⤵PID:1556
-
\??\c:\rfxxllr.exec:\rfxxllr.exe135⤵PID:848
-
\??\c:\hbtntb.exec:\hbtntb.exe136⤵PID:632
-
\??\c:\vjdjp.exec:\vjdjp.exe137⤵PID:1216
-
\??\c:\dddjd.exec:\dddjd.exe138⤵PID:2088
-
\??\c:\5fllrfr.exec:\5fllrfr.exe139⤵PID:1732
-
\??\c:\1rlfxfr.exec:\1rlfxfr.exe140⤵PID:1784
-
\??\c:\hhthnh.exec:\hhthnh.exe141⤵PID:1488
-
\??\c:\hhbbnn.exec:\hhbbnn.exe142⤵PID:1164
-
\??\c:\1pjpp.exec:\1pjpp.exe143⤵PID:1912
-
\??\c:\9xxlrlx.exec:\9xxlrlx.exe144⤵PID:1012
-
\??\c:\rlxrffl.exec:\rlxrffl.exe145⤵PID:1872
-
\??\c:\7hnnnt.exec:\7hnnnt.exe146⤵PID:936
-
\??\c:\7hbnbb.exec:\7hbnbb.exe147⤵PID:1420
-
\??\c:\1jvdd.exec:\1jvdd.exe148⤵PID:1972
-
\??\c:\llflrfl.exec:\llflrfl.exe149⤵PID:2192
-
\??\c:\btnhtt.exec:\btnhtt.exe150⤵PID:2024
-
\??\c:\nhtbhh.exec:\nhtbhh.exe151⤵PID:2244
-
\??\c:\ddjvp.exec:\ddjvp.exe152⤵PID:2080
-
\??\c:\vvpvp.exec:\vvpvp.exe153⤵PID:920
-
\??\c:\1lxrrxf.exec:\1lxrrxf.exe154⤵PID:2612
-
\??\c:\nnhnbh.exec:\nnhnbh.exe155⤵PID:784
-
\??\c:\7nbnbn.exec:\7nbnbn.exe156⤵PID:892
-
\??\c:\1jpjj.exec:\1jpjj.exe157⤵PID:2532
-
\??\c:\xxxrrll.exec:\xxxrrll.exe158⤵PID:2660
-
\??\c:\hbntnb.exec:\hbntnb.exe159⤵PID:2576
-
\??\c:\5bttbb.exec:\5bttbb.exe160⤵PID:2536
-
\??\c:\pjpdv.exec:\pjpdv.exe161⤵PID:2564
-
\??\c:\xxffllx.exec:\xxffllx.exe162⤵PID:2464
-
\??\c:\lxlfrxf.exec:\lxlfrxf.exe163⤵PID:1656
-
\??\c:\tbhbbb.exec:\tbhbbb.exe164⤵PID:2504
-
\??\c:\nbbtth.exec:\nbbtth.exe165⤵PID:1720
-
\??\c:\1vvjp.exec:\1vvjp.exe166⤵PID:1628
-
\??\c:\rxxxrfx.exec:\rxxxrfx.exe167⤵PID:2668
-
\??\c:\tnbbhh.exec:\tnbbhh.exe168⤵PID:2496
-
\??\c:\hnbhnb.exec:\hnbhnb.exe169⤵PID:1652
-
\??\c:\1pppv.exec:\1pppv.exe170⤵PID:1040
-
\??\c:\vpdjp.exec:\vpdjp.exe171⤵PID:796
-
\??\c:\7lrrrrx.exec:\7lrrrrx.exe172⤵PID:2216
-
\??\c:\nnbnnn.exec:\nnbnnn.exe173⤵PID:1636
-
\??\c:\pjvdv.exec:\pjvdv.exe174⤵PID:860
-
\??\c:\ppddd.exec:\ppddd.exe175⤵PID:1028
-
\??\c:\xxrflrf.exec:\xxrflrf.exe176⤵PID:3048
-
\??\c:\1rlxllf.exec:\1rlxllf.exe177⤵PID:2196
-
\??\c:\1bhnhn.exec:\1bhnhn.exe178⤵PID:1920
-
\??\c:\tthnbb.exec:\tthnbb.exe179⤵PID:2404
-
\??\c:\jjvjp.exec:\jjvjp.exe180⤵PID:676
-
\??\c:\lxflrxx.exec:\lxflrxx.exe181⤵PID:692
-
\??\c:\llffxxx.exec:\llffxxx.exe182⤵PID:1432
-
\??\c:\3hbhtn.exec:\3hbhtn.exe183⤵PID:1860
-
\??\c:\tnhnnh.exec:\tnhnnh.exe184⤵PID:1612
-
\??\c:\dddpv.exec:\dddpv.exe185⤵PID:904
-
\??\c:\xlxfllx.exec:\xlxfllx.exe186⤵PID:1528
-
\??\c:\bbhtnb.exec:\bbhtnb.exe187⤵PID:576
-
\??\c:\tnhhnt.exec:\tnhhnt.exe188⤵PID:1344
-
\??\c:\ppvvv.exec:\ppvvv.exe189⤵PID:1960
-
\??\c:\fxrxflr.exec:\fxrxflr.exe190⤵PID:1924
-
\??\c:\rlffllx.exec:\rlffllx.exe191⤵PID:1504
-
\??\c:\hbnbnt.exec:\hbnbnt.exe192⤵PID:2264
-
\??\c:\vpdjp.exec:\vpdjp.exe193⤵PID:2816
-
\??\c:\xxlxlxr.exec:\xxlxlxr.exe194⤵PID:2984
-
\??\c:\xfrlrxf.exec:\xfrlrxf.exe195⤵PID:1248
-
\??\c:\btnbhn.exec:\btnbhn.exe196⤵PID:2920
-
\??\c:\1pjjp.exec:\1pjjp.exe197⤵PID:1712
-
\??\c:\7dvjj.exec:\7dvjj.exe198⤵PID:2532
-
\??\c:\5frrxxf.exec:\5frrxxf.exe199⤵PID:2684
-
\??\c:\rlffrxl.exec:\rlffrxl.exe200⤵PID:2220
-
\??\c:\hbnbnn.exec:\hbnbnn.exe201⤵PID:2576
-
\??\c:\jjdjv.exec:\jjdjv.exe202⤵PID:2100
-
\??\c:\jdvvj.exec:\jdvvj.exe203⤵PID:2564
-
\??\c:\fllrxfr.exec:\fllrxfr.exe204⤵PID:2700
-
\??\c:\nnttbb.exec:\nnttbb.exe205⤵PID:1656
-
\??\c:\hhthhn.exec:\hhthhn.exe206⤵PID:2852
-
\??\c:\1dvvp.exec:\1dvvp.exe207⤵PID:1720
-
\??\c:\dvpvj.exec:\dvpvj.exe208⤵PID:2480
-
\??\c:\lfxflrf.exec:\lfxflrf.exe209⤵PID:2668
-
\??\c:\nhntnn.exec:\nhntnn.exe210⤵PID:1616
-
\??\c:\5nbbhn.exec:\5nbbhn.exe211⤵PID:2604
-
\??\c:\vpjpv.exec:\vpjpv.exe212⤵PID:2044
-
\??\c:\7pjdj.exec:\7pjdj.exe213⤵PID:796
-
\??\c:\llffrxf.exec:\llffrxf.exe214⤵PID:2204
-
\??\c:\5lflrlr.exec:\5lflrlr.exe215⤵PID:1636
-
\??\c:\ttbhht.exec:\ttbhht.exe216⤵PID:1516
-
\??\c:\1tnhbt.exec:\1tnhbt.exe217⤵PID:1028
-
\??\c:\7dpvj.exec:\7dpvj.exe218⤵PID:848
-
\??\c:\lxffflr.exec:\lxffflr.exe219⤵PID:2196
-
\??\c:\ffrrffl.exec:\ffrrffl.exe220⤵PID:2724
-
\??\c:\btntbh.exec:\btntbh.exe221⤵PID:2404
-
\??\c:\jvpvd.exec:\jvpvd.exe222⤵PID:2092
-
\??\c:\ppdpv.exec:\ppdpv.exe223⤵PID:692
-
\??\c:\3lfrxlr.exec:\3lfrxlr.exe224⤵PID:1476
-
\??\c:\xxlfflx.exec:\xxlfflx.exe225⤵PID:1860
-
\??\c:\bbtbhn.exec:\bbtbhn.exe226⤵PID:1480
-
\??\c:\dpvjd.exec:\dpvjd.exe227⤵PID:904
-
\??\c:\rrrlflx.exec:\rrrlflx.exe228⤵PID:1872
-
\??\c:\bbtbnt.exec:\bbtbnt.exe229⤵PID:576
-
\??\c:\hhbhtt.exec:\hhbhtt.exe230⤵PID:1344
-
\??\c:\xxrxlrx.exec:\xxrxlrx.exe231⤵PID:1304
-
\??\c:\llrflxx.exec:\llrflxx.exe232⤵PID:1924
-
\??\c:\5tntth.exec:\5tntth.exe233⤵PID:1504
-
\??\c:\vdjvp.exec:\vdjvp.exe234⤵PID:2264
-
\??\c:\vvpjp.exec:\vvpjp.exe235⤵PID:2080
-
\??\c:\rfrflxf.exec:\rfrflxf.exe236⤵PID:2984
-
\??\c:\3thntb.exec:\3thntb.exe237⤵PID:1248
-
\??\c:\bhnhht.exec:\bhnhht.exe238⤵PID:2920
-
\??\c:\jjdjv.exec:\jjdjv.exe239⤵PID:2644
-
\??\c:\3lllxff.exec:\3lllxff.exe240⤵PID:2532
-
\??\c:\1rrxlrl.exec:\1rrxlrl.exe241⤵PID:3016
-
\??\c:\hhbhbh.exec:\hhbhbh.exe242⤵PID:2376