Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 23:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2acf457af28a5aaf9f196d4871692910_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
2acf457af28a5aaf9f196d4871692910_NeikiAnalytics.exe
-
Size
92KB
-
MD5
2acf457af28a5aaf9f196d4871692910
-
SHA1
f3f1008ea93d1004652ef69b87a682cfb04ad578
-
SHA256
b9119989d3255cfd812bac4d259d0eeb59a1bc85cee9be2e167c38d2acbd201b
-
SHA512
28eda542f7081d2edf3feff8d4f5b3ad6a289492046ced2a397d98bc65c2d543508e542f057a331fa90e6e05693a989b8160d6c50a0eb08230e3ee36c4718b56
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxS1rj/21k:ymb3NkkiQ3mdBjFo73PYP1lri3K8Ga
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/2968-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/624-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2068-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/992-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1872-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/816-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2292-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1532-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1188-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1556-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
1thhht.exe9btbnt.exelfrxflr.exe3xfrfxr.exetnthhn.exevjvpv.exepdppp.exerrlrxxf.exe3xflllx.exe9hnhhn.exebntbhn.exepjvvd.exe9vjjp.exexrflffr.exe9rllxfr.exerflrfxf.exe5hnthb.exetnbhbb.exevvvdd.exexxfrxfx.exe3llxlfl.exe9frxxxf.exebntthn.exehtbbhh.exe3vddd.exe9dvpj.exefxffffl.exe9hnnnn.exehthnth.exedvjvp.exexrxffrr.exerrlflll.exehbntbh.exennnnnb.exebthnbh.exe7ppvj.exe7jvdp.exelxrrflr.exeffrfrrx.exe9bbhnn.exehbthbh.exedvvjj.exe7rfflll.exelfrxrrf.exe7xlrflx.exebhtnht.exetnbtbt.exepddpv.exerrxrxlr.exetbbbnt.exevjpdj.exelfrfxrl.exedvvdd.exepjvdj.exerxfllrx.exelrrrxrx.exe7ppjd.exerfffflx.exepdpjj.exefrxrxxr.exerfrrrrr.exenbntbb.exe3hbtbt.exe7djdv.exepid process 2988 1thhht.exe 2976 9btbnt.exe 2544 lfrxflr.exe 2156 3xfrfxr.exe 2500 tnthhn.exe 2504 vjvpv.exe 2336 pdppp.exe 2816 rrlrxxf.exe 1556 3xflllx.exe 2236 9hnhhn.exe 624 bntbhn.exe 384 pjvvd.exe 1188 9vjjp.exe 2068 xrflffr.exe 2240 9rllxfr.exe 1532 rflrfxf.exe 868 5hnthb.exe 2688 tnbhbb.exe 2524 vvvdd.exe 2148 xxfrxfx.exe 3044 3llxlfl.exe 692 9frxxxf.exe 1624 bntthn.exe 1708 htbbhh.exe 2292 3vddd.exe 816 9dvpj.exe 360 fxffffl.exe 3060 9hnnnn.exe 1872 hthnth.exe 988 dvjvp.exe 992 xrxffrr.exe 2136 rrlflll.exe 2704 hbntbh.exe 1632 nnnnnb.exe 2844 bthnbh.exe 2852 7ppvj.exe 2976 7jvdp.exe 2640 lxrrflr.exe 2376 ffrfrrx.exe 2348 9bbhnn.exe 1928 hbthbh.exe 2404 dvvjj.exe 2352 7rfflll.exe 1920 lfrxrrf.exe 2636 7xlrflx.exe 1348 bhtnht.exe 2416 tnbtbt.exe 2260 pddpv.exe 2060 rrxrxlr.exe 1188 tbbbnt.exe 2068 vjpdj.exe 1644 lfrfxrl.exe 2072 dvvdd.exe 2588 pjvdj.exe 2564 rxfllrx.exe 2288 lrrrxrx.exe 3052 7ppjd.exe 2200 rfffflx.exe 1788 pdpjj.exe 2040 frxrxxr.exe 1456 rfrrrrr.exe 1624 nbntbb.exe 1708 3hbtbt.exe 3028 7djdv.exe -
Processes:
resource yara_rule behavioral1/memory/2968-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/624-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/992-300-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1872-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/816-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1532-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1188-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-87-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2acf457af28a5aaf9f196d4871692910_NeikiAnalytics.exe1thhht.exe9btbnt.exelfrxflr.exe3xfrfxr.exetnthhn.exevjvpv.exepdppp.exerrlrxxf.exe3xflllx.exe9hnhhn.exebntbhn.exepjvvd.exe9vjjp.exexrflffr.exe9rllxfr.exedescription pid process target process PID 2968 wrote to memory of 2988 2968 2acf457af28a5aaf9f196d4871692910_NeikiAnalytics.exe 1thhht.exe PID 2968 wrote to memory of 2988 2968 2acf457af28a5aaf9f196d4871692910_NeikiAnalytics.exe 1thhht.exe PID 2968 wrote to memory of 2988 2968 2acf457af28a5aaf9f196d4871692910_NeikiAnalytics.exe 1thhht.exe PID 2968 wrote to memory of 2988 2968 2acf457af28a5aaf9f196d4871692910_NeikiAnalytics.exe 1thhht.exe PID 2988 wrote to memory of 2976 2988 1thhht.exe 9btbnt.exe PID 2988 wrote to memory of 2976 2988 1thhht.exe 9btbnt.exe PID 2988 wrote to memory of 2976 2988 1thhht.exe 9btbnt.exe PID 2988 wrote to memory of 2976 2988 1thhht.exe 9btbnt.exe PID 2976 wrote to memory of 2544 2976 9btbnt.exe lfrxflr.exe PID 2976 wrote to memory of 2544 2976 9btbnt.exe lfrxflr.exe PID 2976 wrote to memory of 2544 2976 9btbnt.exe lfrxflr.exe PID 2976 wrote to memory of 2544 2976 9btbnt.exe lfrxflr.exe PID 2544 wrote to memory of 2156 2544 lfrxflr.exe 3xfrfxr.exe PID 2544 wrote to memory of 2156 2544 lfrxflr.exe 3xfrfxr.exe PID 2544 wrote to memory of 2156 2544 lfrxflr.exe 3xfrfxr.exe PID 2544 wrote to memory of 2156 2544 lfrxflr.exe 3xfrfxr.exe PID 2156 wrote to memory of 2500 2156 3xfrfxr.exe tnthhn.exe PID 2156 wrote to memory of 2500 2156 3xfrfxr.exe tnthhn.exe PID 2156 wrote to memory of 2500 2156 3xfrfxr.exe tnthhn.exe PID 2156 wrote to memory of 2500 2156 3xfrfxr.exe tnthhn.exe PID 2500 wrote to memory of 2504 2500 tnthhn.exe vjvpv.exe PID 2500 wrote to memory of 2504 2500 tnthhn.exe vjvpv.exe PID 2500 wrote to memory of 2504 2500 tnthhn.exe vjvpv.exe PID 2500 wrote to memory of 2504 2500 tnthhn.exe vjvpv.exe PID 2504 wrote to memory of 2336 2504 vjvpv.exe pdppp.exe PID 2504 wrote to memory of 2336 2504 vjvpv.exe pdppp.exe PID 2504 wrote to memory of 2336 2504 vjvpv.exe pdppp.exe PID 2504 wrote to memory of 2336 2504 vjvpv.exe pdppp.exe PID 2336 wrote to memory of 2816 2336 pdppp.exe rrlrxxf.exe PID 2336 wrote to memory of 2816 2336 pdppp.exe rrlrxxf.exe PID 2336 wrote to memory of 2816 2336 pdppp.exe rrlrxxf.exe PID 2336 wrote to memory of 2816 2336 pdppp.exe rrlrxxf.exe PID 2816 wrote to memory of 1556 2816 rrlrxxf.exe 3xflllx.exe PID 2816 wrote to memory of 1556 2816 rrlrxxf.exe 3xflllx.exe PID 2816 wrote to memory of 1556 2816 rrlrxxf.exe 3xflllx.exe PID 2816 wrote to memory of 1556 2816 rrlrxxf.exe 3xflllx.exe PID 1556 wrote to memory of 2236 1556 3xflllx.exe 9hnhhn.exe PID 1556 wrote to memory of 2236 1556 3xflllx.exe 9hnhhn.exe PID 1556 wrote to memory of 2236 1556 3xflllx.exe 9hnhhn.exe PID 1556 wrote to memory of 2236 1556 3xflllx.exe 9hnhhn.exe PID 2236 wrote to memory of 624 2236 9hnhhn.exe bntbhn.exe PID 2236 wrote to memory of 624 2236 9hnhhn.exe bntbhn.exe PID 2236 wrote to memory of 624 2236 9hnhhn.exe bntbhn.exe PID 2236 wrote to memory of 624 2236 9hnhhn.exe bntbhn.exe PID 624 wrote to memory of 384 624 bntbhn.exe pjvvd.exe PID 624 wrote to memory of 384 624 bntbhn.exe pjvvd.exe PID 624 wrote to memory of 384 624 bntbhn.exe pjvvd.exe PID 624 wrote to memory of 384 624 bntbhn.exe pjvvd.exe PID 384 wrote to memory of 1188 384 pjvvd.exe tbbbnt.exe PID 384 wrote to memory of 1188 384 pjvvd.exe tbbbnt.exe PID 384 wrote to memory of 1188 384 pjvvd.exe tbbbnt.exe PID 384 wrote to memory of 1188 384 pjvvd.exe tbbbnt.exe PID 1188 wrote to memory of 2068 1188 9vjjp.exe xrflffr.exe PID 1188 wrote to memory of 2068 1188 9vjjp.exe xrflffr.exe PID 1188 wrote to memory of 2068 1188 9vjjp.exe xrflffr.exe PID 1188 wrote to memory of 2068 1188 9vjjp.exe xrflffr.exe PID 2068 wrote to memory of 2240 2068 xrflffr.exe 9rllxfr.exe PID 2068 wrote to memory of 2240 2068 xrflffr.exe 9rllxfr.exe PID 2068 wrote to memory of 2240 2068 xrflffr.exe 9rllxfr.exe PID 2068 wrote to memory of 2240 2068 xrflffr.exe 9rllxfr.exe PID 2240 wrote to memory of 1532 2240 9rllxfr.exe rflrfxf.exe PID 2240 wrote to memory of 1532 2240 9rllxfr.exe rflrfxf.exe PID 2240 wrote to memory of 1532 2240 9rllxfr.exe rflrfxf.exe PID 2240 wrote to memory of 1532 2240 9rllxfr.exe rflrfxf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2acf457af28a5aaf9f196d4871692910_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2acf457af28a5aaf9f196d4871692910_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\1thhht.exec:\1thhht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\9btbnt.exec:\9btbnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\lfrxflr.exec:\lfrxflr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\3xfrfxr.exec:\3xfrfxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\tnthhn.exec:\tnthhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\vjvpv.exec:\vjvpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\pdppp.exec:\pdppp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\rrlrxxf.exec:\rrlrxxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\3xflllx.exec:\3xflllx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\9hnhhn.exec:\9hnhhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\bntbhn.exec:\bntbhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\pjvvd.exec:\pjvvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\9vjjp.exec:\9vjjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\xrflffr.exec:\xrflffr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\9rllxfr.exec:\9rllxfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\rflrfxf.exec:\rflrfxf.exe17⤵
- Executes dropped EXE
PID:1532 -
\??\c:\5hnthb.exec:\5hnthb.exe18⤵
- Executes dropped EXE
PID:868 -
\??\c:\tnbhbb.exec:\tnbhbb.exe19⤵
- Executes dropped EXE
PID:2688 -
\??\c:\vvvdd.exec:\vvvdd.exe20⤵
- Executes dropped EXE
PID:2524 -
\??\c:\xxfrxfx.exec:\xxfrxfx.exe21⤵
- Executes dropped EXE
PID:2148 -
\??\c:\3llxlfl.exec:\3llxlfl.exe22⤵
- Executes dropped EXE
PID:3044 -
\??\c:\9frxxxf.exec:\9frxxxf.exe23⤵
- Executes dropped EXE
PID:692 -
\??\c:\bntthn.exec:\bntthn.exe24⤵
- Executes dropped EXE
PID:1624 -
\??\c:\htbbhh.exec:\htbbhh.exe25⤵
- Executes dropped EXE
PID:1708 -
\??\c:\3vddd.exec:\3vddd.exe26⤵
- Executes dropped EXE
PID:2292 -
\??\c:\9dvpj.exec:\9dvpj.exe27⤵
- Executes dropped EXE
PID:816 -
\??\c:\fxffffl.exec:\fxffffl.exe28⤵
- Executes dropped EXE
PID:360 -
\??\c:\9hnnnn.exec:\9hnnnn.exe29⤵
- Executes dropped EXE
PID:3060 -
\??\c:\hthnth.exec:\hthnth.exe30⤵
- Executes dropped EXE
PID:1872 -
\??\c:\dvjvp.exec:\dvjvp.exe31⤵
- Executes dropped EXE
PID:988 -
\??\c:\xrxffrr.exec:\xrxffrr.exe32⤵
- Executes dropped EXE
PID:992 -
\??\c:\rrlflll.exec:\rrlflll.exe33⤵
- Executes dropped EXE
PID:2136 -
\??\c:\hbntbh.exec:\hbntbh.exe34⤵
- Executes dropped EXE
PID:2704 -
\??\c:\nnnnnb.exec:\nnnnnb.exe35⤵
- Executes dropped EXE
PID:1632 -
\??\c:\bthnbh.exec:\bthnbh.exe36⤵
- Executes dropped EXE
PID:2844 -
\??\c:\7ppvj.exec:\7ppvj.exe37⤵
- Executes dropped EXE
PID:2852 -
\??\c:\7jvdp.exec:\7jvdp.exe38⤵
- Executes dropped EXE
PID:2976 -
\??\c:\lxrrflr.exec:\lxrrflr.exe39⤵
- Executes dropped EXE
PID:2640 -
\??\c:\ffrfrrx.exec:\ffrfrrx.exe40⤵
- Executes dropped EXE
PID:2376 -
\??\c:\9bbhnn.exec:\9bbhnn.exe41⤵
- Executes dropped EXE
PID:2348 -
\??\c:\hbthbh.exec:\hbthbh.exe42⤵
- Executes dropped EXE
PID:1928 -
\??\c:\dvvjj.exec:\dvvjj.exe43⤵
- Executes dropped EXE
PID:2404 -
\??\c:\7rfflll.exec:\7rfflll.exe44⤵
- Executes dropped EXE
PID:2352 -
\??\c:\lfrxrrf.exec:\lfrxrrf.exe45⤵
- Executes dropped EXE
PID:1920 -
\??\c:\7xlrflx.exec:\7xlrflx.exe46⤵
- Executes dropped EXE
PID:2636 -
\??\c:\bhtnht.exec:\bhtnht.exe47⤵
- Executes dropped EXE
PID:1348 -
\??\c:\tnbtbt.exec:\tnbtbt.exe48⤵
- Executes dropped EXE
PID:2416 -
\??\c:\pddpv.exec:\pddpv.exe49⤵
- Executes dropped EXE
PID:2260 -
\??\c:\rrxrxlr.exec:\rrxrxlr.exe50⤵
- Executes dropped EXE
PID:2060 -
\??\c:\tbbbnt.exec:\tbbbnt.exe51⤵
- Executes dropped EXE
PID:1188 -
\??\c:\vjpdj.exec:\vjpdj.exe52⤵
- Executes dropped EXE
PID:2068 -
\??\c:\lfrfxrl.exec:\lfrfxrl.exe53⤵
- Executes dropped EXE
PID:1644 -
\??\c:\dvvdd.exec:\dvvdd.exe54⤵
- Executes dropped EXE
PID:2072 -
\??\c:\pjvdj.exec:\pjvdj.exe55⤵
- Executes dropped EXE
PID:2588 -
\??\c:\rxfllrx.exec:\rxfllrx.exe56⤵
- Executes dropped EXE
PID:2564 -
\??\c:\lrrrxrx.exec:\lrrrxrx.exe57⤵
- Executes dropped EXE
PID:2288 -
\??\c:\7ppjd.exec:\7ppjd.exe58⤵
- Executes dropped EXE
PID:3052 -
\??\c:\rfffflx.exec:\rfffflx.exe59⤵
- Executes dropped EXE
PID:2200 -
\??\c:\pdpjj.exec:\pdpjj.exe60⤵
- Executes dropped EXE
PID:1788 -
\??\c:\frxrxxr.exec:\frxrxxr.exe61⤵
- Executes dropped EXE
PID:2040 -
\??\c:\rfrrrrr.exec:\rfrrrrr.exe62⤵
- Executes dropped EXE
PID:1456 -
\??\c:\nbntbb.exec:\nbntbb.exe63⤵
- Executes dropped EXE
PID:1624 -
\??\c:\3hbtbt.exec:\3hbtbt.exe64⤵
- Executes dropped EXE
PID:1708 -
\??\c:\7djdv.exec:\7djdv.exe65⤵
- Executes dropped EXE
PID:3028 -
\??\c:\jdpvd.exec:\jdpvd.exe66⤵PID:2056
-
\??\c:\fxrrxfl.exec:\fxrrxfl.exe67⤵PID:908
-
\??\c:\lxlxrlr.exec:\lxlxrlr.exe68⤵PID:788
-
\??\c:\hbhtht.exec:\hbhtht.exe69⤵PID:2008
-
\??\c:\1nbtbh.exec:\1nbtbh.exe70⤵PID:920
-
\??\c:\5pjpd.exec:\5pjpd.exe71⤵PID:2908
-
\??\c:\1ppvd.exec:\1ppvd.exe72⤵PID:1428
-
\??\c:\xrlxrfr.exec:\xrlxrfr.exe73⤵PID:992
-
\??\c:\bnnntn.exec:\bnnntn.exe74⤵PID:2192
-
\??\c:\nhtbnh.exec:\nhtbnh.exe75⤵PID:1524
-
\??\c:\ppjpp.exec:\ppjpp.exe76⤵PID:2984
-
\??\c:\7ppvj.exec:\7ppvj.exe77⤵PID:2532
-
\??\c:\9lrlxxf.exec:\9lrlxxf.exe78⤵PID:2668
-
\??\c:\9xfrfxl.exec:\9xfrfxl.exe79⤵PID:2852
-
\??\c:\1bhhtb.exec:\1bhhtb.exe80⤵PID:2976
-
\??\c:\hbnbnn.exec:\hbnbnn.exe81⤵PID:2648
-
\??\c:\pjvpv.exec:\pjvpv.exe82⤵PID:2812
-
\??\c:\3jpvd.exec:\3jpvd.exe83⤵PID:2452
-
\??\c:\llfrxll.exec:\llfrxll.exe84⤵PID:2356
-
\??\c:\lrfllll.exec:\lrfllll.exe85⤵PID:2460
-
\??\c:\7nthbt.exec:\7nthbt.exe86⤵PID:1792
-
\??\c:\bbbhbt.exec:\bbbhbt.exe87⤵PID:296
-
\??\c:\djdvp.exec:\djdvp.exe88⤵PID:1556
-
\??\c:\jddjj.exec:\jddjj.exe89⤵PID:1552
-
\??\c:\lfrxrrr.exec:\lfrxrrr.exe90⤵PID:1360
-
\??\c:\ffxlxrx.exec:\ffxlxrx.exe91⤵PID:2396
-
\??\c:\thnntb.exec:\thnntb.exe92⤵PID:1504
-
\??\c:\3bbhbh.exec:\3bbhbh.exe93⤵PID:1736
-
\??\c:\3vjvv.exec:\3vjvv.exe94⤵PID:1740
-
\??\c:\9djjj.exec:\9djjj.exe95⤵PID:2240
-
\??\c:\1xllffl.exec:\1xllffl.exe96⤵PID:1532
-
\??\c:\lxxxxxf.exec:\lxxxxxf.exe97⤵PID:1596
-
\??\c:\hbtbtn.exec:\hbtbtn.exe98⤵PID:2700
-
\??\c:\pvjjd.exec:\pvjjd.exe99⤵PID:1804
-
\??\c:\vpdpp.exec:\vpdpp.exe100⤵PID:2920
-
\??\c:\3rlrxxl.exec:\3rlrxxl.exe101⤵PID:1732
-
\??\c:\lllllrx.exec:\lllllrx.exe102⤵PID:2692
-
\??\c:\nbbhtt.exec:\nbbhtt.exe103⤵PID:1268
-
\??\c:\tnttht.exec:\tnttht.exe104⤵PID:2408
-
\??\c:\dvjpv.exec:\dvjpv.exe105⤵PID:1456
-
\??\c:\jvdvj.exec:\jvdvj.exe106⤵PID:452
-
\??\c:\9rlllrr.exec:\9rlllrr.exe107⤵PID:1924
-
\??\c:\5frflfr.exec:\5frflfr.exe108⤵PID:660
-
\??\c:\1bnbnt.exec:\1bnbnt.exe109⤵PID:844
-
\??\c:\nbhnnn.exec:\nbhnnn.exe110⤵PID:2140
-
\??\c:\7pdjj.exec:\7pdjj.exe111⤵PID:1432
-
\??\c:\dvdpd.exec:\dvdpd.exe112⤵PID:1660
-
\??\c:\5rrrfrx.exec:\5rrrfrx.exe113⤵PID:920
-
\??\c:\xlllxrx.exec:\xlllxrx.exe114⤵PID:1592
-
\??\c:\hbnbhn.exec:\hbnbhn.exe115⤵PID:1892
-
\??\c:\9bnhnn.exec:\9bnhnn.exe116⤵PID:2136
-
\??\c:\5vjpp.exec:\5vjpp.exe117⤵PID:2704
-
\??\c:\7pppv.exec:\7pppv.exe118⤵PID:1524
-
\??\c:\5lxxfxx.exec:\5lxxfxx.exe119⤵PID:2868
-
\??\c:\fxlxllr.exec:\fxlxllr.exe120⤵PID:2536
-
\??\c:\bnbbhn.exec:\bnbbhn.exe121⤵PID:2644
-
\??\c:\3nhttt.exec:\3nhttt.exe122⤵PID:884
-
\??\c:\nnbnht.exec:\nnbnht.exe123⤵PID:2640
-
\??\c:\pjpvv.exec:\pjpvv.exe124⤵PID:2376
-
\??\c:\3dppp.exec:\3dppp.exe125⤵PID:2812
-
\??\c:\lxrfffl.exec:\lxrfffl.exe126⤵PID:2504
-
\??\c:\rlrllff.exec:\rlrllff.exe127⤵PID:2632
-
\??\c:\tnnbtb.exec:\tnnbtb.exe128⤵PID:2272
-
\??\c:\9hbbnt.exec:\9hbbnt.exe129⤵PID:2816
-
\??\c:\pvdjj.exec:\pvdjj.exe130⤵PID:2428
-
\??\c:\5vddp.exec:\5vddp.exe131⤵PID:1464
-
\??\c:\xxrxrrf.exec:\xxrxrrf.exe132⤵PID:900
-
\??\c:\xlxflff.exec:\xlxflff.exe133⤵PID:384
-
\??\c:\nbhhnb.exec:\nbhhnb.exe134⤵PID:2124
-
\??\c:\bhhbnh.exec:\bhhbnh.exe135⤵PID:1780
-
\??\c:\9pjpp.exec:\9pjpp.exe136⤵PID:1568
-
\??\c:\lxrlrrx.exec:\lxrlrrx.exe137⤵PID:1252
-
\??\c:\5xrfrlf.exec:\5xrfrlf.exe138⤵PID:2044
-
\??\c:\5rxflxf.exec:\5rxflxf.exe139⤵PID:1452
-
\??\c:\nhtbhh.exec:\nhtbhh.exe140⤵PID:2160
-
\??\c:\tnhttt.exec:\tnhttt.exe141⤵PID:1980
-
\??\c:\pdjjd.exec:\pdjjd.exe142⤵PID:2112
-
\??\c:\xflllfl.exec:\xflllfl.exe143⤵PID:480
-
\??\c:\xfxlxrx.exec:\xfxlxrx.exe144⤵PID:1732
-
\??\c:\hnbhtt.exec:\hnbhtt.exe145⤵PID:692
-
\??\c:\ttthbh.exec:\ttthbh.exe146⤵PID:1480
-
\??\c:\dpjdp.exec:\dpjdp.exe147⤵PID:1196
-
\??\c:\vjpdv.exec:\vjpdv.exe148⤵PID:1280
-
\??\c:\9xfxffl.exec:\9xfxffl.exe149⤵PID:452
-
\??\c:\rlffrfl.exec:\rlffrfl.exe150⤵PID:916
-
\??\c:\bhnhnn.exec:\bhnhnn.exe151⤵PID:2948
-
\??\c:\tnhttt.exec:\tnhttt.exe152⤵PID:2076
-
\??\c:\vdjpd.exec:\vdjpd.exe153⤵PID:568
-
\??\c:\xxlxrxf.exec:\xxlxrxf.exe154⤵PID:2216
-
\??\c:\xrfflrf.exec:\xrfflrf.exe155⤵PID:1424
-
\??\c:\7ttbtn.exec:\7ttbtn.exe156⤵PID:920
-
\??\c:\1bhnnt.exec:\1bhnnt.exe157⤵PID:2032
-
\??\c:\1vppv.exec:\1vppv.exe158⤵PID:1520
-
\??\c:\dpdvd.exec:\dpdvd.exe159⤵PID:2848
-
\??\c:\7vvpd.exec:\7vvpd.exe160⤵PID:1632
-
\??\c:\5lxlxfx.exec:\5lxlxfx.exe161⤵PID:2656
-
\??\c:\lfxxlxl.exec:\lfxxlxl.exe162⤵PID:2652
-
\??\c:\btnbnt.exec:\btnbnt.exe163⤵PID:2732
-
\??\c:\bbhbbt.exec:\bbhbbt.exe164⤵PID:2444
-
\??\c:\vpjpv.exec:\vpjpv.exe165⤵PID:2464
-
\??\c:\dpvjd.exec:\dpvjd.exe166⤵PID:1656
-
\??\c:\3ddpp.exec:\3ddpp.exe167⤵PID:2348
-
\??\c:\5xflxlr.exec:\5xflxlr.exe168⤵PID:2360
-
\??\c:\5lxxflx.exec:\5lxxflx.exe169⤵PID:2392
-
\??\c:\nnbhnn.exec:\nnbhnn.exe170⤵PID:2352
-
\??\c:\bnhtht.exec:\bnhtht.exe171⤵PID:800
-
\??\c:\3jvdv.exec:\3jvdv.exe172⤵PID:2816
-
\??\c:\pdjpd.exec:\pdjpd.exe173⤵PID:2340
-
\??\c:\pppdp.exec:\pppdp.exe174⤵PID:1464
-
\??\c:\9lffxxl.exec:\9lffxxl.exe175⤵PID:2116
-
\??\c:\fxlrffr.exec:\fxlrffr.exe176⤵PID:808
-
\??\c:\tnnthh.exec:\tnnthh.exe177⤵PID:2608
-
\??\c:\bbthtn.exec:\bbthtn.exe178⤵PID:1444
-
\??\c:\nnntbh.exec:\nnntbh.exe179⤵PID:1256
-
\??\c:\3vpvd.exec:\3vpvd.exe180⤵PID:1800
-
\??\c:\vvvpd.exec:\vvvpd.exe181⤵PID:2092
-
\??\c:\7frrfrf.exec:\7frrfrf.exe182⤵PID:2380
-
\??\c:\rxxlrrr.exec:\rxxlrrr.exe183⤵PID:1200
-
\??\c:\nbttbn.exec:\nbttbn.exe184⤵PID:536
-
\??\c:\dvjvj.exec:\dvjvj.exe185⤵PID:1404
-
\??\c:\5vjjv.exec:\5vjjv.exe186⤵PID:784
-
\??\c:\5rlrlrx.exec:\5rlrlrx.exe187⤵PID:572
-
\??\c:\xlrxflr.exec:\xlrxflr.exe188⤵PID:836
-
\??\c:\5xlffrx.exec:\5xlffrx.exe189⤵PID:1292
-
\??\c:\3ttbhn.exec:\3ttbhn.exe190⤵PID:1708
-
\??\c:\1hnthh.exec:\1hnthh.exe191⤵PID:1132
-
\??\c:\vdjdd.exec:\vdjdd.exe192⤵PID:816
-
\??\c:\vdpvp.exec:\vdpvp.exe193⤵PID:336
-
\??\c:\3vvdj.exec:\3vvdj.exe194⤵PID:3060
-
\??\c:\rlrrrlr.exec:\rlrrrlr.exe195⤵PID:2008
-
\??\c:\xrffllx.exec:\xrffllx.exe196⤵PID:2280
-
\??\c:\tnthnn.exec:\tnthnn.exe197⤵PID:1828
-
\??\c:\btnnbh.exec:\btnnbh.exe198⤵PID:1608
-
\??\c:\5htbbb.exec:\5htbbb.exe199⤵PID:2144
-
\??\c:\vpjpd.exec:\vpjpd.exe200⤵PID:1528
-
\??\c:\jvddp.exec:\jvddp.exe201⤵PID:2004
-
\??\c:\rlxffll.exec:\rlxffll.exe202⤵PID:2984
-
\??\c:\5flxrrx.exec:\5flxrrx.exe203⤵PID:2532
-
\??\c:\hbhbbb.exec:\hbhbbb.exe204⤵PID:2660
-
\??\c:\thnnnh.exec:\thnnnh.exe205⤵PID:2492
-
\??\c:\lfrxrfl.exec:\lfrxrfl.exe206⤵PID:2680
-
\??\c:\frrlflr.exec:\frrlflr.exe207⤵PID:2156
-
\??\c:\tbhhhh.exec:\tbhhhh.exe208⤵PID:2464
-
\??\c:\pvvpv.exec:\pvvpv.exe209⤵PID:2628
-
\??\c:\dppdp.exec:\dppdp.exe210⤵PID:2864
-
\??\c:\xxlrflf.exec:\xxlrflf.exe211⤵PID:2360
-
\??\c:\rrlfrfx.exec:\rrlfrfx.exe212⤵PID:2576
-
\??\c:\pvvpd.exec:\pvvpd.exe213⤵PID:1516
-
\??\c:\pjvdj.exec:\pjvdj.exe214⤵PID:1260
-
\??\c:\xxrfxlx.exec:\xxrfxlx.exe215⤵PID:1344
-
\??\c:\5frxflx.exec:\5frxflx.exe216⤵PID:1348
-
\??\c:\ffxrlff.exec:\ffxrlff.exe217⤵PID:2416
-
\??\c:\hhtbnb.exec:\hhtbnb.exe218⤵PID:1796
-
\??\c:\hththh.exec:\hththh.exe219⤵PID:1736
-
\??\c:\nbbtnh.exec:\nbbtnh.exe220⤵PID:2516
-
\??\c:\9jdvd.exec:\9jdvd.exe221⤵PID:1644
-
\??\c:\1dpdj.exec:\1dpdj.exe222⤵PID:2072
-
\??\c:\dvjpj.exec:\dvjpj.exe223⤵PID:2684
-
\??\c:\xlfrxxl.exec:\xlfrxxl.exe224⤵PID:2700
-
\??\c:\7fxlxfx.exec:\7fxlxfx.exe225⤵PID:1768
-
\??\c:\nbbbhn.exec:\nbbbhn.exe226⤵PID:1412
-
\??\c:\3nbthb.exec:\3nbthb.exe227⤵PID:536
-
\??\c:\bntbhb.exec:\bntbhb.exe228⤵PID:1812
-
\??\c:\jpdpp.exec:\jpdpp.exe229⤵PID:784
-
\??\c:\vjvdj.exec:\vjvdj.exe230⤵PID:812
-
\??\c:\9dvvv.exec:\9dvvv.exe231⤵PID:2436
-
\??\c:\3rxfxrf.exec:\3rxfxrf.exe232⤵PID:1232
-
\??\c:\xlfflxf.exec:\xlfflxf.exe233⤵PID:1952
-
\??\c:\rlxflrf.exec:\rlxflrf.exe234⤵PID:348
-
\??\c:\3hnntn.exec:\3hnntn.exe235⤵PID:1572
-
\??\c:\bbnbnt.exec:\bbnbnt.exe236⤵PID:1700
-
\??\c:\bttthb.exec:\bttthb.exe237⤵PID:1872
-
\??\c:\1djdv.exec:\1djdv.exe238⤵PID:2132
-
\??\c:\3vpvp.exec:\3vpvp.exe239⤵PID:1932
-
\??\c:\lfrrllx.exec:\lfrrllx.exe240⤵PID:1120
-
\??\c:\xfrrllx.exec:\xfrrllx.exe241⤵PID:1564
-
\??\c:\3xlxfxf.exec:\3xlxfxf.exe242⤵PID:2136