Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 14:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dc0018c41ea3ce2c9021763b07c36500_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
dc0018c41ea3ce2c9021763b07c36500_NeikiAnalytics.exe
-
Size
232KB
-
MD5
dc0018c41ea3ce2c9021763b07c36500
-
SHA1
2a3d7d7b061361aa8f80daa79a927c2050ccb060
-
SHA256
5ad8ed8f3c8a611d4fec318690bccffe3e4ede31d6b56acf3e4e573fcbb132a8
-
SHA512
b0c68ecf41ef36c50ef3a995ab0fa5f04aa032a6d535e2673fc4a5f4f2ddb5e2f4a2c6b24b9d93b1f06d1ba3e7b327a143eba78bf38b9725f5b6876bf7b78ae8
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo7LAIRUohTF/SjSrbzLAuBjfwFOmoFzMvUpGqC5n+Ngs:n3C9BRo/AIuuFSjA8uBjwI7FjpjC5+Ks
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/2860-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1968-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1356-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1768-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1196-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/572-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1076-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/952-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1572-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1944-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
7ppjp.exedvjvd.exedvpvd.exelfllllr.exe7xxxffl.exevpdjd.exe9rrrlfl.exehnnnnb.exe7jvdp.exeflfxlrl.exehhtbth.exe7ddjv.exerlflrrf.exe9htbhn.exeppvdv.exe5lxflrf.exehbtbtt.exennhnht.exexlfffll.exelxfxlfx.exe7vvjp.exerfrrfff.exehhntbn.exevvvpd.exelflfxfl.exenhtbtb.exeddpvp.exexffxrfx.exevpdvd.exerlffrlf.exehnttnb.exevpvvp.exexxllxlf.exehnttbt.exebthnbb.exe5dvjp.exe1rffffl.exe5nhhtn.exe3jvjp.exejjdpd.exerxfrffx.exettnbnn.exeppjvd.exe7pdvd.exelllrflx.exe5bbbbb.exebbnhtn.exepjpvj.exerxlrxxr.exe7fxflrr.exebthntb.exeppdpv.exe7pjpd.exerrflflr.exe3hthtb.exenhhtbh.exeppjpp.exe9fxrrxf.exefxlrxxl.exebhbhtt.exebththb.exeppjvj.exexflrffr.exe3lxxxfl.exepid process 2860 7ppjp.exe 2584 dvjvd.exe 2652 dvpvd.exe 2572 lfllllr.exe 2476 7xxxffl.exe 2744 vpdjd.exe 2532 9rrrlfl.exe 2016 hnnnnb.exe 1356 7jvdp.exe 2640 flfxlrl.exe 2828 hhtbth.exe 1768 7ddjv.exe 2148 rlflrrf.exe 348 9htbhn.exe 1196 ppvdv.exe 2796 5lxflrf.exe 2024 hbtbtt.exe 2944 nnhnht.exe 2152 xlfffll.exe 1412 lxfxlfx.exe 572 7vvjp.exe 1076 rfrrfff.exe 2328 hhntbn.exe 824 vvvpd.exe 1824 lflfxfl.exe 952 nhtbtb.exe 784 ddpvp.exe 1572 xffxrfx.exe 1904 vpdvd.exe 936 rlffrlf.exe 1944 hnttnb.exe 880 vpvvp.exe 1960 xxllxlf.exe 1980 hnttbt.exe 1520 bthnbb.exe 2612 5dvjp.exe 2600 1rffffl.exe 2564 5nhhtn.exe 2652 3jvjp.exe 2788 jjdpd.exe 2780 rxfrffx.exe 2436 ttnbnn.exe 2516 ppjvd.exe 3000 7pdvd.exe 1700 lllrflx.exe 2016 5bbbbb.exe 2428 bbnhtn.exe 2812 pjpvj.exe 2800 rxlrxxr.exe 1776 7fxflrr.exe 2116 bthntb.exe 2244 ppdpv.exe 2808 7pjpd.exe 2384 rrflflr.exe 1148 3hthtb.exe 2020 nhhtbh.exe 2856 ppjpp.exe 1612 9fxrrxf.exe 764 fxlrxxl.exe 1568 bhbhtt.exe 2824 bththb.exe 572 ppjvj.exe 832 xflrffr.exe 556 3lxxxfl.exe -
Processes:
resource yara_rule behavioral1/memory/1968-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1968-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1356-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1768-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1196-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/572-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1076-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/952-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1572-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1944-298-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
dc0018c41ea3ce2c9021763b07c36500_NeikiAnalytics.exe7ppjp.exedvjvd.exedvpvd.exelfllllr.exe7xxxffl.exevpdjd.exe9rrrlfl.exehnnnnb.exe7jvdp.exeflfxlrl.exehhtbth.exe7ddjv.exerlflrrf.exe9htbhn.exeppvdv.exedescription pid process target process PID 1968 wrote to memory of 2860 1968 dc0018c41ea3ce2c9021763b07c36500_NeikiAnalytics.exe 7ppjp.exe PID 1968 wrote to memory of 2860 1968 dc0018c41ea3ce2c9021763b07c36500_NeikiAnalytics.exe 7ppjp.exe PID 1968 wrote to memory of 2860 1968 dc0018c41ea3ce2c9021763b07c36500_NeikiAnalytics.exe 7ppjp.exe PID 1968 wrote to memory of 2860 1968 dc0018c41ea3ce2c9021763b07c36500_NeikiAnalytics.exe 7ppjp.exe PID 2860 wrote to memory of 2584 2860 7ppjp.exe dvjvd.exe PID 2860 wrote to memory of 2584 2860 7ppjp.exe dvjvd.exe PID 2860 wrote to memory of 2584 2860 7ppjp.exe dvjvd.exe PID 2860 wrote to memory of 2584 2860 7ppjp.exe dvjvd.exe PID 2584 wrote to memory of 2652 2584 dvjvd.exe dvpvd.exe PID 2584 wrote to memory of 2652 2584 dvjvd.exe dvpvd.exe PID 2584 wrote to memory of 2652 2584 dvjvd.exe dvpvd.exe PID 2584 wrote to memory of 2652 2584 dvjvd.exe dvpvd.exe PID 2652 wrote to memory of 2572 2652 dvpvd.exe lfllllr.exe PID 2652 wrote to memory of 2572 2652 dvpvd.exe lfllllr.exe PID 2652 wrote to memory of 2572 2652 dvpvd.exe lfllllr.exe PID 2652 wrote to memory of 2572 2652 dvpvd.exe lfllllr.exe PID 2572 wrote to memory of 2476 2572 lfllllr.exe 7xxxffl.exe PID 2572 wrote to memory of 2476 2572 lfllllr.exe 7xxxffl.exe PID 2572 wrote to memory of 2476 2572 lfllllr.exe 7xxxffl.exe PID 2572 wrote to memory of 2476 2572 lfllllr.exe 7xxxffl.exe PID 2476 wrote to memory of 2744 2476 7xxxffl.exe vpdjd.exe PID 2476 wrote to memory of 2744 2476 7xxxffl.exe vpdjd.exe PID 2476 wrote to memory of 2744 2476 7xxxffl.exe vpdjd.exe PID 2476 wrote to memory of 2744 2476 7xxxffl.exe vpdjd.exe PID 2744 wrote to memory of 2532 2744 vpdjd.exe 9rrrlfl.exe PID 2744 wrote to memory of 2532 2744 vpdjd.exe 9rrrlfl.exe PID 2744 wrote to memory of 2532 2744 vpdjd.exe 9rrrlfl.exe PID 2744 wrote to memory of 2532 2744 vpdjd.exe 9rrrlfl.exe PID 2532 wrote to memory of 2016 2532 9rrrlfl.exe hnnnnb.exe PID 2532 wrote to memory of 2016 2532 9rrrlfl.exe hnnnnb.exe PID 2532 wrote to memory of 2016 2532 9rrrlfl.exe hnnnnb.exe PID 2532 wrote to memory of 2016 2532 9rrrlfl.exe hnnnnb.exe PID 2016 wrote to memory of 1356 2016 hnnnnb.exe 7jvdp.exe PID 2016 wrote to memory of 1356 2016 hnnnnb.exe 7jvdp.exe PID 2016 wrote to memory of 1356 2016 hnnnnb.exe 7jvdp.exe PID 2016 wrote to memory of 1356 2016 hnnnnb.exe 7jvdp.exe PID 1356 wrote to memory of 2640 1356 7jvdp.exe flfxlrl.exe PID 1356 wrote to memory of 2640 1356 7jvdp.exe flfxlrl.exe PID 1356 wrote to memory of 2640 1356 7jvdp.exe flfxlrl.exe PID 1356 wrote to memory of 2640 1356 7jvdp.exe flfxlrl.exe PID 2640 wrote to memory of 2828 2640 flfxlrl.exe hhtbth.exe PID 2640 wrote to memory of 2828 2640 flfxlrl.exe hhtbth.exe PID 2640 wrote to memory of 2828 2640 flfxlrl.exe hhtbth.exe PID 2640 wrote to memory of 2828 2640 flfxlrl.exe hhtbth.exe PID 2828 wrote to memory of 1768 2828 hhtbth.exe 7ddjv.exe PID 2828 wrote to memory of 1768 2828 hhtbth.exe 7ddjv.exe PID 2828 wrote to memory of 1768 2828 hhtbth.exe 7ddjv.exe PID 2828 wrote to memory of 1768 2828 hhtbth.exe 7ddjv.exe PID 1768 wrote to memory of 2148 1768 7ddjv.exe rlflrrf.exe PID 1768 wrote to memory of 2148 1768 7ddjv.exe rlflrrf.exe PID 1768 wrote to memory of 2148 1768 7ddjv.exe rlflrrf.exe PID 1768 wrote to memory of 2148 1768 7ddjv.exe rlflrrf.exe PID 2148 wrote to memory of 348 2148 rlflrrf.exe 9htbhn.exe PID 2148 wrote to memory of 348 2148 rlflrrf.exe 9htbhn.exe PID 2148 wrote to memory of 348 2148 rlflrrf.exe 9htbhn.exe PID 2148 wrote to memory of 348 2148 rlflrrf.exe 9htbhn.exe PID 348 wrote to memory of 1196 348 9htbhn.exe ppvdv.exe PID 348 wrote to memory of 1196 348 9htbhn.exe ppvdv.exe PID 348 wrote to memory of 1196 348 9htbhn.exe ppvdv.exe PID 348 wrote to memory of 1196 348 9htbhn.exe ppvdv.exe PID 1196 wrote to memory of 2796 1196 ppvdv.exe 5lxflrf.exe PID 1196 wrote to memory of 2796 1196 ppvdv.exe 5lxflrf.exe PID 1196 wrote to memory of 2796 1196 ppvdv.exe 5lxflrf.exe PID 1196 wrote to memory of 2796 1196 ppvdv.exe 5lxflrf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc0018c41ea3ce2c9021763b07c36500_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\dc0018c41ea3ce2c9021763b07c36500_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\7ppjp.exec:\7ppjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\dvjvd.exec:\dvjvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\dvpvd.exec:\dvpvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\lfllllr.exec:\lfllllr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\7xxxffl.exec:\7xxxffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\vpdjd.exec:\vpdjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\9rrrlfl.exec:\9rrrlfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\hnnnnb.exec:\hnnnnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\7jvdp.exec:\7jvdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\flfxlrl.exec:\flfxlrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\hhtbth.exec:\hhtbth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\7ddjv.exec:\7ddjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\rlflrrf.exec:\rlflrrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\9htbhn.exec:\9htbhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\ppvdv.exec:\ppvdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\5lxflrf.exec:\5lxflrf.exe17⤵
- Executes dropped EXE
PID:2796 -
\??\c:\hbtbtt.exec:\hbtbtt.exe18⤵
- Executes dropped EXE
PID:2024 -
\??\c:\nnhnht.exec:\nnhnht.exe19⤵
- Executes dropped EXE
PID:2944 -
\??\c:\xlfffll.exec:\xlfffll.exe20⤵
- Executes dropped EXE
PID:2152 -
\??\c:\lxfxlfx.exec:\lxfxlfx.exe21⤵
- Executes dropped EXE
PID:1412 -
\??\c:\7vvjp.exec:\7vvjp.exe22⤵
- Executes dropped EXE
PID:572 -
\??\c:\rfrrfff.exec:\rfrrfff.exe23⤵
- Executes dropped EXE
PID:1076 -
\??\c:\hhntbn.exec:\hhntbn.exe24⤵
- Executes dropped EXE
PID:2328 -
\??\c:\vvvpd.exec:\vvvpd.exe25⤵
- Executes dropped EXE
PID:824 -
\??\c:\lflfxfl.exec:\lflfxfl.exe26⤵
- Executes dropped EXE
PID:1824 -
\??\c:\nhtbtb.exec:\nhtbtb.exe27⤵
- Executes dropped EXE
PID:952 -
\??\c:\ddpvp.exec:\ddpvp.exe28⤵
- Executes dropped EXE
PID:784 -
\??\c:\xffxrfx.exec:\xffxrfx.exe29⤵
- Executes dropped EXE
PID:1572 -
\??\c:\vpdvd.exec:\vpdvd.exe30⤵
- Executes dropped EXE
PID:1904 -
\??\c:\rlffrlf.exec:\rlffrlf.exe31⤵
- Executes dropped EXE
PID:936 -
\??\c:\hnttnb.exec:\hnttnb.exe32⤵
- Executes dropped EXE
PID:1944 -
\??\c:\vpvvp.exec:\vpvvp.exe33⤵
- Executes dropped EXE
PID:880 -
\??\c:\xxllxlf.exec:\xxllxlf.exe34⤵
- Executes dropped EXE
PID:1960 -
\??\c:\hnttbt.exec:\hnttbt.exe35⤵
- Executes dropped EXE
PID:1980 -
\??\c:\bthnbb.exec:\bthnbb.exe36⤵
- Executes dropped EXE
PID:1520 -
\??\c:\5dvjp.exec:\5dvjp.exe37⤵
- Executes dropped EXE
PID:2612 -
\??\c:\1rffffl.exec:\1rffffl.exe38⤵
- Executes dropped EXE
PID:2600 -
\??\c:\5nhhtn.exec:\5nhhtn.exe39⤵
- Executes dropped EXE
PID:2564 -
\??\c:\3jvjp.exec:\3jvjp.exe40⤵
- Executes dropped EXE
PID:2652 -
\??\c:\jjdpd.exec:\jjdpd.exe41⤵
- Executes dropped EXE
PID:2788 -
\??\c:\rxfrffx.exec:\rxfrffx.exe42⤵
- Executes dropped EXE
PID:2780 -
\??\c:\ttnbnn.exec:\ttnbnn.exe43⤵
- Executes dropped EXE
PID:2436 -
\??\c:\ppjvd.exec:\ppjvd.exe44⤵
- Executes dropped EXE
PID:2516 -
\??\c:\7pdvd.exec:\7pdvd.exe45⤵
- Executes dropped EXE
PID:3000 -
\??\c:\lllrflx.exec:\lllrflx.exe46⤵
- Executes dropped EXE
PID:1700 -
\??\c:\5bbbbb.exec:\5bbbbb.exe47⤵
- Executes dropped EXE
PID:2016 -
\??\c:\bbnhtn.exec:\bbnhtn.exe48⤵
- Executes dropped EXE
PID:2428 -
\??\c:\pjpvj.exec:\pjpvj.exe49⤵
- Executes dropped EXE
PID:2812 -
\??\c:\rxlrxxr.exec:\rxlrxxr.exe50⤵
- Executes dropped EXE
PID:2800 -
\??\c:\7fxflrr.exec:\7fxflrr.exe51⤵
- Executes dropped EXE
PID:1776 -
\??\c:\bthntb.exec:\bthntb.exe52⤵
- Executes dropped EXE
PID:2116 -
\??\c:\ppdpv.exec:\ppdpv.exe53⤵
- Executes dropped EXE
PID:2244 -
\??\c:\7pjpd.exec:\7pjpd.exe54⤵
- Executes dropped EXE
PID:2808 -
\??\c:\rrflflr.exec:\rrflflr.exe55⤵
- Executes dropped EXE
PID:2384 -
\??\c:\3hthtb.exec:\3hthtb.exe56⤵
- Executes dropped EXE
PID:1148 -
\??\c:\nhhtbh.exec:\nhhtbh.exe57⤵
- Executes dropped EXE
PID:2020 -
\??\c:\ppjpp.exec:\ppjpp.exe58⤵
- Executes dropped EXE
PID:2856 -
\??\c:\9fxrrxf.exec:\9fxrrxf.exe59⤵
- Executes dropped EXE
PID:1612 -
\??\c:\fxlrxxl.exec:\fxlrxxl.exe60⤵
- Executes dropped EXE
PID:764 -
\??\c:\bhbhtt.exec:\bhbhtt.exe61⤵
- Executes dropped EXE
PID:1568 -
\??\c:\bththb.exec:\bththb.exe62⤵
- Executes dropped EXE
PID:2824 -
\??\c:\ppjvj.exec:\ppjvj.exe63⤵
- Executes dropped EXE
PID:572 -
\??\c:\xflrffr.exec:\xflrffr.exe64⤵
- Executes dropped EXE
PID:832 -
\??\c:\3lxxxfl.exec:\3lxxxfl.exe65⤵
- Executes dropped EXE
PID:556 -
\??\c:\tthnbb.exec:\tthnbb.exe66⤵PID:2888
-
\??\c:\jjvdp.exec:\jjvdp.exe67⤵PID:1692
-
\??\c:\pjddp.exec:\pjddp.exe68⤵PID:1040
-
\??\c:\9lffrxl.exec:\9lffrxl.exe69⤵PID:2000
-
\??\c:\xxlxffl.exec:\xxlxffl.exe70⤵PID:744
-
\??\c:\hbbbtn.exec:\hbbbtn.exe71⤵PID:1564
-
\??\c:\1nntht.exec:\1nntht.exe72⤵PID:1004
-
\??\c:\dddpj.exec:\dddpj.exe73⤵PID:1816
-
\??\c:\fxrlxfr.exec:\fxrlxfr.exe74⤵PID:1740
-
\??\c:\hbttbb.exec:\hbttbb.exe75⤵PID:1424
-
\??\c:\ppddp.exec:\ppddp.exe76⤵PID:1208
-
\??\c:\ffflxrf.exec:\ffflxrf.exe77⤵PID:2864
-
\??\c:\hhbhbh.exec:\hhbhbh.exe78⤵PID:3008
-
\??\c:\tnhnth.exec:\tnhnth.exe79⤵PID:1528
-
\??\c:\vpjjv.exec:\vpjjv.exe80⤵PID:2316
-
\??\c:\rlxflrl.exec:\rlxflrl.exe81⤵PID:2404
-
\??\c:\flfrfrx.exec:\flfrfrx.exe82⤵PID:1648
-
\??\c:\hbnntb.exec:\hbnntb.exe83⤵PID:2792
-
\??\c:\vvpvd.exec:\vvpvd.exe84⤵PID:2308
-
\??\c:\ppjjp.exec:\ppjjp.exe85⤵PID:2440
-
\??\c:\7xflrxf.exec:\7xflrxf.exe86⤵PID:2472
-
\??\c:\xlxxlll.exec:\xlxxlll.exe87⤵PID:2624
-
\??\c:\btntbh.exec:\btntbh.exe88⤵PID:2504
-
\??\c:\jjvdv.exec:\jjvdv.exe89⤵PID:1756
-
\??\c:\jjdjd.exec:\jjdjd.exe90⤵PID:2684
-
\??\c:\rrlxrxf.exec:\rrlxrxf.exe91⤵PID:2756
-
\??\c:\httttn.exec:\httttn.exe92⤵PID:1752
-
\??\c:\hbntnt.exec:\hbntnt.exe93⤵PID:1584
-
\??\c:\pdpvj.exec:\pdpvj.exe94⤵PID:1908
-
\??\c:\fxlfllr.exec:\fxlfllr.exe95⤵PID:1676
-
\??\c:\xlfxlrx.exec:\xlfxlrx.exe96⤵PID:1604
-
\??\c:\nntnnt.exec:\nntnnt.exe97⤵PID:1244
-
\??\c:\pjvdp.exec:\pjvdp.exe98⤵PID:2036
-
\??\c:\lxffllr.exec:\lxffllr.exe99⤵PID:1228
-
\??\c:\llxlxrl.exec:\llxlxrl.exe100⤵PID:2040
-
\??\c:\ttnbhh.exec:\ttnbhh.exe101⤵PID:2020
-
\??\c:\5ddjj.exec:\5ddjj.exe102⤵PID:320
-
\??\c:\1vjpv.exec:\1vjpv.exe103⤵PID:1612
-
\??\c:\xrllrrf.exec:\xrllrrf.exe104⤵PID:568
-
\??\c:\hhbnhh.exec:\hhbnhh.exe105⤵PID:1652
-
\??\c:\tnbhtb.exec:\tnbhtb.exe106⤵PID:1016
-
\??\c:\vddpj.exec:\vddpj.exe107⤵PID:2408
-
\??\c:\ffxrflx.exec:\ffxrflx.exe108⤵PID:2124
-
\??\c:\fflrfxx.exec:\fflrfxx.exe109⤵PID:1144
-
\??\c:\1hbnnb.exec:\1hbnnb.exe110⤵PID:1240
-
\??\c:\tttbtb.exec:\tttbtb.exe111⤵PID:748
-
\??\c:\jddpd.exec:\jddpd.exe112⤵PID:376
-
\??\c:\vpddj.exec:\vpddj.exe113⤵PID:2896
-
\??\c:\3lflrxl.exec:\3lflrxl.exe114⤵PID:1572
-
\??\c:\tbhhbt.exec:\tbhhbt.exe115⤵PID:940
-
\??\c:\bbnnbh.exec:\bbnnbh.exe116⤵PID:2320
-
\??\c:\pvpvj.exec:\pvpvj.exe117⤵PID:1900
-
\??\c:\llfxffr.exec:\llfxffr.exe118⤵PID:2076
-
\??\c:\rlrfxfl.exec:\rlrfxfl.exe119⤵PID:2096
-
\??\c:\1tbnbn.exec:\1tbnbn.exe120⤵PID:2860
-
\??\c:\htbnht.exec:\htbnht.exe121⤵PID:1800
-
\??\c:\dvpvj.exec:\dvpvj.exe122⤵PID:2664
-
\??\c:\lfxffrx.exec:\lfxffrx.exe123⤵PID:2716
-
\??\c:\9rrrflr.exec:\9rrrflr.exe124⤵PID:3056
-
\??\c:\5tbnnh.exec:\5tbnnh.exe125⤵PID:2564
-
\??\c:\nnhbhn.exec:\nnhbhn.exe126⤵PID:2544
-
\??\c:\pdjjd.exec:\pdjjd.exe127⤵PID:2788
-
\??\c:\5jdpp.exec:\5jdpp.exe128⤵PID:2464
-
\??\c:\rrffflx.exec:\rrffflx.exe129⤵PID:2628
-
\??\c:\7bbbnt.exec:\7bbbnt.exe130⤵PID:2272
-
\??\c:\hhtbhh.exec:\hhtbhh.exe131⤵PID:2520
-
\??\c:\pjvvj.exec:\pjvvj.exe132⤵PID:1700
-
\??\c:\dppjj.exec:\dppjj.exe133⤵PID:2692
-
\??\c:\llxfxff.exec:\llxfxff.exe134⤵PID:2428
-
\??\c:\tbbtnn.exec:\tbbtnn.exe135⤵PID:2756
-
\??\c:\nnnbht.exec:\nnnbht.exe136⤵PID:1176
-
\??\c:\pjdjd.exec:\pjdjd.exe137⤵PID:1776
-
\??\c:\pjjjv.exec:\pjjjv.exe138⤵PID:2240
-
\??\c:\fxrfrrf.exec:\fxrfrrf.exe139⤵PID:2148
-
\??\c:\tnbnhn.exec:\tnbnhn.exe140⤵PID:1416
-
\??\c:\9bhnbb.exec:\9bhnbb.exe141⤵PID:2344
-
\??\c:\dddvj.exec:\dddvj.exe142⤵PID:840
-
\??\c:\7lflxfl.exec:\7lflxfl.exe143⤵PID:2644
-
\??\c:\fxllxfr.exec:\fxllxfr.exe144⤵PID:2852
-
\??\c:\tnbhtt.exec:\tnbhtt.exe145⤵PID:1056
-
\??\c:\bbnthh.exec:\bbnthh.exe146⤵PID:2088
-
\??\c:\vvpdp.exec:\vvpdp.exe147⤵PID:1724
-
\??\c:\lllrfrf.exec:\lllrfrf.exe148⤵PID:2824
-
\??\c:\hbtbhh.exec:\hbtbhh.exe149⤵PID:572
-
\??\c:\hnhbnt.exec:\hnhbnt.exe150⤵PID:1016
-
\??\c:\9jdjv.exec:\9jdjv.exe151⤵PID:556
-
\??\c:\ddppd.exec:\ddppd.exe152⤵PID:316
-
\??\c:\ffxfrrl.exec:\ffxfrrl.exe153⤵PID:1820
-
\??\c:\flfrffx.exec:\flfrffx.exe154⤵PID:892
-
\??\c:\tnbttt.exec:\tnbttt.exe155⤵PID:784
-
\??\c:\tthnht.exec:\tthnht.exe156⤵PID:2248
-
\??\c:\vvdjv.exec:\vvdjv.exe157⤵PID:2232
-
\??\c:\lffrflx.exec:\lffrflx.exe158⤵PID:1976
-
\??\c:\7xxfflx.exec:\7xxfflx.exe159⤵PID:1992
-
\??\c:\hbbbnn.exec:\hbbbnn.exe160⤵PID:868
-
\??\c:\btttnb.exec:\btttnb.exe161⤵PID:1696
-
\??\c:\pvpdv.exec:\pvpdv.exe162⤵PID:1960
-
\??\c:\1xxfrrl.exec:\1xxfrrl.exe163⤵PID:1532
-
\??\c:\rlxflrf.exec:\rlxflrf.exe164⤵PID:1520
-
\??\c:\nthbnt.exec:\nthbnt.exe165⤵PID:2668
-
\??\c:\hbnthn.exec:\hbnthn.exe166⤵PID:2580
-
\??\c:\ppppp.exec:\ppppp.exe167⤵PID:2748
-
\??\c:\pvjpd.exec:\pvjpd.exe168⤵PID:2652
-
\??\c:\xxxrllf.exec:\xxxrllf.exe169⤵PID:2496
-
\??\c:\7rxxfff.exec:\7rxxfff.exe170⤵PID:2780
-
\??\c:\bhhnnn.exec:\bhhnnn.exe171⤵PID:2436
-
\??\c:\pppdp.exec:\pppdp.exe172⤵PID:2516
-
\??\c:\rffflfr.exec:\rffflfr.exe173⤵PID:3000
-
\??\c:\lllrfrl.exec:\lllrfrl.exe174⤵PID:1596
-
\??\c:\7tnhth.exec:\7tnhth.exe175⤵PID:2556
-
\??\c:\5ppdp.exec:\5ppdp.exe176⤵PID:2696
-
\??\c:\3ppjd.exec:\3ppjd.exe177⤵PID:2828
-
\??\c:\flxfflx.exec:\flxfflx.exe178⤵PID:2800
-
\??\c:\5nhhtb.exec:\5nhhtb.exe179⤵PID:1436
-
\??\c:\ddvpd.exec:\ddvpd.exe180⤵PID:1444
-
\??\c:\vdpdp.exec:\vdpdp.exe181⤵PID:616
-
\??\c:\xxrfxfr.exec:\xxrfxfr.exe182⤵PID:2808
-
\??\c:\ntnbnb.exec:\ntnbnb.exe183⤵PID:2028
-
\??\c:\9hnnnb.exec:\9hnnnb.exe184⤵PID:2964
-
\??\c:\5dvvj.exec:\5dvvj.exe185⤵PID:2984
-
\??\c:\rxlffrx.exec:\rxlffrx.exe186⤵PID:2944
-
\??\c:\hbhhbb.exec:\hbhhbb.exe187⤵PID:688
-
\??\c:\hbhtbb.exec:\hbhtbb.exe188⤵PID:764
-
\??\c:\3ddpp.exec:\3ddpp.exe189⤵PID:1812
-
\??\c:\ddvdp.exec:\ddvdp.exe190⤵PID:2452
-
\??\c:\1rrxlrf.exec:\1rrxlrf.exe191⤵PID:1076
-
\??\c:\nhbnbh.exec:\nhbnbh.exe192⤵PID:396
-
\??\c:\nnhtnt.exec:\nnhtnt.exe193⤵PID:2172
-
\??\c:\jdjdj.exec:\jdjdj.exe194⤵PID:2196
-
\??\c:\llrfxlf.exec:\llrfxlf.exe195⤵PID:1892
-
\??\c:\7fxfxlx.exec:\7fxfxlx.exe196⤵PID:1824
-
\??\c:\nttnth.exec:\nttnth.exe197⤵PID:684
-
\??\c:\ddpdp.exec:\ddpdp.exe198⤵PID:2000
-
\??\c:\ddjdv.exec:\ddjdv.exe199⤵PID:1712
-
\??\c:\5rflrrf.exec:\5rflrrf.exe200⤵PID:1564
-
\??\c:\htbnht.exec:\htbnht.exe201⤵PID:2260
-
\??\c:\bbnbth.exec:\bbnbth.exe202⤵PID:2228
-
\??\c:\vdppp.exec:\vdppp.exe203⤵PID:1944
-
\??\c:\fflrrfr.exec:\fflrrfr.exe204⤵PID:2128
-
\??\c:\xxxlrxl.exec:\xxxlrxl.exe205⤵PID:1208
-
\??\c:\hhhttb.exec:\hhhttb.exe206⤵PID:2864
-
\??\c:\ppjvd.exec:\ppjvd.exe207⤵PID:1496
-
\??\c:\vpdjv.exec:\vpdjv.exe208⤵PID:3028
-
\??\c:\llxxrrf.exec:\llxxrrf.exe209⤵PID:2560
-
\??\c:\xxrfrfr.exec:\xxrfrfr.exe210⤵PID:2404
-
\??\c:\btnbnt.exec:\btnbnt.exe211⤵PID:2844
-
\??\c:\7vjjp.exec:\7vjjp.exe212⤵PID:2620
-
\??\c:\xlfrflx.exec:\xlfrflx.exe213⤵PID:2376
-
\??\c:\lxrlxlx.exec:\lxrlxlx.exe214⤵PID:2440
-
\??\c:\nbbbhb.exec:\nbbbhb.exe215⤵PID:2528
-
\??\c:\bbtbnt.exec:\bbtbnt.exe216⤵PID:2300
-
\??\c:\1jdjv.exec:\1jdjv.exe217⤵PID:2700
-
\??\c:\xlxrfrr.exec:\xlxrfrr.exe218⤵PID:2704
-
\??\c:\fffxrxl.exec:\fffxrxl.exe219⤵PID:2676
-
\??\c:\nnhnth.exec:\nnhnth.exe220⤵PID:2820
-
\??\c:\vdvjj.exec:\vdvjj.exe221⤵PID:2340
-
\??\c:\vdvpv.exec:\vdvpv.exe222⤵PID:1620
-
\??\c:\rxfxfxl.exec:\rxfxfxl.exe223⤵PID:1908
-
\??\c:\hhbhtt.exec:\hhbhtt.exe224⤵PID:2244
-
\??\c:\nhtnnh.exec:\nhtnnh.exe225⤵PID:1196
-
\??\c:\9djjp.exec:\9djjp.exe226⤵PID:2384
-
\??\c:\vjdjj.exec:\vjdjj.exe227⤵PID:2092
-
\??\c:\xfllfll.exec:\xfllfll.exe228⤵PID:840
-
\??\c:\fxxxllf.exec:\fxxxllf.exe229⤵PID:2420
-
\??\c:\hnnnht.exec:\hnnnht.exe230⤵PID:532
-
\??\c:\5dppj.exec:\5dppj.exe231⤵PID:1404
-
\??\c:\ddvpj.exec:\ddvpj.exe232⤵PID:2816
-
\??\c:\ffrrxrf.exec:\ffrrxrf.exe233⤵PID:2336
-
\??\c:\tbbnth.exec:\tbbnth.exe234⤵PID:2824
-
\??\c:\1nnhhn.exec:\1nnhhn.exe235⤵PID:572
-
\??\c:\hnthnt.exec:\hnthnt.exe236⤵PID:2348
-
\??\c:\vppdp.exec:\vppdp.exe237⤵PID:1220
-
\??\c:\lrlxlrf.exec:\lrlxlrf.exe238⤵PID:2884
-
\??\c:\rlfrxfx.exec:\rlfrxfx.exe239⤵PID:316
-
\??\c:\tnhtbh.exec:\tnhtbh.exe240⤵PID:1484
-
\??\c:\9jjpj.exec:\9jjpj.exe241⤵PID:892
-
\??\c:\vvpvj.exec:\vvpvj.exe242⤵PID:1984