Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 17:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fc4f5c3efed453004a0cbe612d698e20_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
fc4f5c3efed453004a0cbe612d698e20_NeikiAnalytics.exe
-
Size
493KB
-
MD5
fc4f5c3efed453004a0cbe612d698e20
-
SHA1
60069f1ce8e51f2ce760533c5ef1bbcd0a5f8df8
-
SHA256
497aaf00ac7919f1b0c2a8a4ea6894cf3e55f8af9bae8095ebbdc608a6b43437
-
SHA512
6f7c0e6d61ceeebb4044196b1ba69a7f55c475ab52c1e066470a4badc9d09bc45a631e5ca5d35bc8b723387b61eb86f3be69653578fc9a9a0f20a95a3b08739e
-
SSDEEP
6144:n3C9BRo7MlrWKo+lS0Le4xRSAoq78yoyfx93svqTbWL5wEpOQ9DRRK:n3C9yMo+S0L9xRnoq7H9QYcmeN9DS
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral1/memory/1988-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2376-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1184-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1360-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1676-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1820-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/856-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/556-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1100-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/768-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/820-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/980-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ppjdd.exehbttbh.exe7xxxlxl.exebthtnh.exe1dppp.exefxllxlx.exehttbnt.exepvvjv.exelrllxxl.exexxrfllf.exetntbtb.exejdpvj.exettntbh.exejdjpd.exerfffrxl.exehtbbnn.exerffflxr.exe3thnbt.exepvppd.exexfxfrxr.exehhtbhh.exe7dpdp.exefffxlfx.exehbntbn.exedpjpd.exerrlxlrr.exepjddp.exejdvdp.exellxflrl.exethhhbt.exexlfrrfl.exethhtbh.exevjpdj.exe3jvvv.exetthtnt.exennthtb.exe7dddp.exe7dpdj.exexxrfrxf.exehthnnt.exetthhtn.exe3vjdd.exerlfflrf.exexlllrrr.exepjvvv.exebbnntt.exevjppp.exeflxlxxr.exejvpdp.exelfrxffr.exehtbnbb.exevjpjp.exerlxlxff.exe9rrfffl.exebnbbhn.exe3jdjj.exelfxxlrf.exerllrllf.exehbtntn.exedpvpv.exe7rllxxl.exerllxllx.exe5bbbnn.exedpjpv.exepid process 2520 ppjdd.exe 2712 hbttbh.exe 2376 7xxxlxl.exe 2580 bthtnh.exe 2872 1dppp.exe 1184 fxllxlx.exe 2728 httbnt.exe 1360 pvvjv.exe 2512 lrllxxl.exe 1676 xxrfllf.exe 1820 tntbtb.exe 2828 jdpvj.exe 856 ttntbh.exe 2776 jdjpd.exe 2772 rfffrxl.exe 2816 htbbnn.exe 556 rffflxr.exe 768 3thnbt.exe 2388 pvppd.exe 1100 xfxfrxr.exe 1976 hhtbhh.exe 1600 7dpdp.exe 820 fffxlfx.exe 2876 hbntbn.exe 1792 dpjpd.exe 980 rrlxlrr.exe 1324 pjddp.exe 984 jdvdp.exe 2896 llxflrl.exe 3052 thhhbt.exe 2300 xlfrrfl.exe 3064 thhtbh.exe 1716 vjpdj.exe 1940 3jvvv.exe 1388 tthtnt.exe 3044 nnthtb.exe 3048 7dddp.exe 1428 7dpdj.exe 2784 xxrfrxf.exe 2676 hthnnt.exe 2596 tthhtn.exe 3024 3vjdd.exe 2128 rlfflrf.exe 2536 xlllrrr.exe 2948 pjvvv.exe 2232 bbnntt.exe 1676 vjppp.exe 1820 flxlxxr.exe 1936 jvpdp.exe 2752 lfrxffr.exe 2040 htbnbb.exe 2808 vjpjp.exe 2772 rlxlxff.exe 2916 9rrfffl.exe 672 bnbbhn.exe 1528 3jdjj.exe 580 lfxxlrf.exe 624 rllrllf.exe 1100 hbtntn.exe 532 dpvpv.exe 1508 7rllxxl.exe 2888 rllxllx.exe 2884 5bbbnn.exe 332 dpjpv.exe -
Processes:
resource yara_rule behavioral1/memory/1988-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1184-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1360-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1676-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1820-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/856-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/556-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1100-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/768-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/820-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/980-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-296-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
fc4f5c3efed453004a0cbe612d698e20_NeikiAnalytics.exeppjdd.exehbttbh.exe7xxxlxl.exebthtnh.exe1dppp.exefxllxlx.exehttbnt.exepvvjv.exelrllxxl.exexxrfllf.exetntbtb.exejdpvj.exettntbh.exejdjpd.exerfffrxl.exedescription pid process target process PID 1988 wrote to memory of 2520 1988 fc4f5c3efed453004a0cbe612d698e20_NeikiAnalytics.exe ppjdd.exe PID 1988 wrote to memory of 2520 1988 fc4f5c3efed453004a0cbe612d698e20_NeikiAnalytics.exe ppjdd.exe PID 1988 wrote to memory of 2520 1988 fc4f5c3efed453004a0cbe612d698e20_NeikiAnalytics.exe ppjdd.exe PID 1988 wrote to memory of 2520 1988 fc4f5c3efed453004a0cbe612d698e20_NeikiAnalytics.exe ppjdd.exe PID 2520 wrote to memory of 2712 2520 ppjdd.exe hbttbh.exe PID 2520 wrote to memory of 2712 2520 ppjdd.exe hbttbh.exe PID 2520 wrote to memory of 2712 2520 ppjdd.exe hbttbh.exe PID 2520 wrote to memory of 2712 2520 ppjdd.exe hbttbh.exe PID 2712 wrote to memory of 2376 2712 hbttbh.exe 7xxxlxl.exe PID 2712 wrote to memory of 2376 2712 hbttbh.exe 7xxxlxl.exe PID 2712 wrote to memory of 2376 2712 hbttbh.exe 7xxxlxl.exe PID 2712 wrote to memory of 2376 2712 hbttbh.exe 7xxxlxl.exe PID 2376 wrote to memory of 2580 2376 7xxxlxl.exe bthtnh.exe PID 2376 wrote to memory of 2580 2376 7xxxlxl.exe bthtnh.exe PID 2376 wrote to memory of 2580 2376 7xxxlxl.exe bthtnh.exe PID 2376 wrote to memory of 2580 2376 7xxxlxl.exe bthtnh.exe PID 2580 wrote to memory of 2872 2580 bthtnh.exe 1dppp.exe PID 2580 wrote to memory of 2872 2580 bthtnh.exe 1dppp.exe PID 2580 wrote to memory of 2872 2580 bthtnh.exe 1dppp.exe PID 2580 wrote to memory of 2872 2580 bthtnh.exe 1dppp.exe PID 2872 wrote to memory of 1184 2872 1dppp.exe fxllxlx.exe PID 2872 wrote to memory of 1184 2872 1dppp.exe fxllxlx.exe PID 2872 wrote to memory of 1184 2872 1dppp.exe fxllxlx.exe PID 2872 wrote to memory of 1184 2872 1dppp.exe fxllxlx.exe PID 1184 wrote to memory of 2728 1184 fxllxlx.exe httbnt.exe PID 1184 wrote to memory of 2728 1184 fxllxlx.exe httbnt.exe PID 1184 wrote to memory of 2728 1184 fxllxlx.exe httbnt.exe PID 1184 wrote to memory of 2728 1184 fxllxlx.exe httbnt.exe PID 2728 wrote to memory of 1360 2728 httbnt.exe pvvjv.exe PID 2728 wrote to memory of 1360 2728 httbnt.exe pvvjv.exe PID 2728 wrote to memory of 1360 2728 httbnt.exe pvvjv.exe PID 2728 wrote to memory of 1360 2728 httbnt.exe pvvjv.exe PID 1360 wrote to memory of 2512 1360 pvvjv.exe lrllxxl.exe PID 1360 wrote to memory of 2512 1360 pvvjv.exe lrllxxl.exe PID 1360 wrote to memory of 2512 1360 pvvjv.exe lrllxxl.exe PID 1360 wrote to memory of 2512 1360 pvvjv.exe lrllxxl.exe PID 2512 wrote to memory of 1676 2512 lrllxxl.exe xxrfllf.exe PID 2512 wrote to memory of 1676 2512 lrllxxl.exe xxrfllf.exe PID 2512 wrote to memory of 1676 2512 lrllxxl.exe xxrfllf.exe PID 2512 wrote to memory of 1676 2512 lrllxxl.exe xxrfllf.exe PID 1676 wrote to memory of 1820 1676 xxrfllf.exe tntbtb.exe PID 1676 wrote to memory of 1820 1676 xxrfllf.exe tntbtb.exe PID 1676 wrote to memory of 1820 1676 xxrfllf.exe tntbtb.exe PID 1676 wrote to memory of 1820 1676 xxrfllf.exe tntbtb.exe PID 1820 wrote to memory of 2828 1820 tntbtb.exe jdpvj.exe PID 1820 wrote to memory of 2828 1820 tntbtb.exe jdpvj.exe PID 1820 wrote to memory of 2828 1820 tntbtb.exe jdpvj.exe PID 1820 wrote to memory of 2828 1820 tntbtb.exe jdpvj.exe PID 2828 wrote to memory of 856 2828 jdpvj.exe ttntbh.exe PID 2828 wrote to memory of 856 2828 jdpvj.exe ttntbh.exe PID 2828 wrote to memory of 856 2828 jdpvj.exe ttntbh.exe PID 2828 wrote to memory of 856 2828 jdpvj.exe ttntbh.exe PID 856 wrote to memory of 2776 856 ttntbh.exe jdjpd.exe PID 856 wrote to memory of 2776 856 ttntbh.exe jdjpd.exe PID 856 wrote to memory of 2776 856 ttntbh.exe jdjpd.exe PID 856 wrote to memory of 2776 856 ttntbh.exe jdjpd.exe PID 2776 wrote to memory of 2772 2776 jdjpd.exe rfffrxl.exe PID 2776 wrote to memory of 2772 2776 jdjpd.exe rfffrxl.exe PID 2776 wrote to memory of 2772 2776 jdjpd.exe rfffrxl.exe PID 2776 wrote to memory of 2772 2776 jdjpd.exe rfffrxl.exe PID 2772 wrote to memory of 2816 2772 rfffrxl.exe htbbnn.exe PID 2772 wrote to memory of 2816 2772 rfffrxl.exe htbbnn.exe PID 2772 wrote to memory of 2816 2772 rfffrxl.exe htbbnn.exe PID 2772 wrote to memory of 2816 2772 rfffrxl.exe htbbnn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc4f5c3efed453004a0cbe612d698e20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\fc4f5c3efed453004a0cbe612d698e20_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\ppjdd.exec:\ppjdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\hbttbh.exec:\hbttbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\7xxxlxl.exec:\7xxxlxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\bthtnh.exec:\bthtnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\1dppp.exec:\1dppp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\fxllxlx.exec:\fxllxlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\httbnt.exec:\httbnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\pvvjv.exec:\pvvjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\lrllxxl.exec:\lrllxxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\xxrfllf.exec:\xxrfllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\tntbtb.exec:\tntbtb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\jdpvj.exec:\jdpvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\ttntbh.exec:\ttntbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\jdjpd.exec:\jdjpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\rfffrxl.exec:\rfffrxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\htbbnn.exec:\htbbnn.exe17⤵
- Executes dropped EXE
PID:2816 -
\??\c:\rffflxr.exec:\rffflxr.exe18⤵
- Executes dropped EXE
PID:556 -
\??\c:\3thnbt.exec:\3thnbt.exe19⤵
- Executes dropped EXE
PID:768 -
\??\c:\pvppd.exec:\pvppd.exe20⤵
- Executes dropped EXE
PID:2388 -
\??\c:\xfxfrxr.exec:\xfxfrxr.exe21⤵
- Executes dropped EXE
PID:1100 -
\??\c:\hhtbhh.exec:\hhtbhh.exe22⤵
- Executes dropped EXE
PID:1976 -
\??\c:\7dpdp.exec:\7dpdp.exe23⤵
- Executes dropped EXE
PID:1600 -
\??\c:\fffxlfx.exec:\fffxlfx.exe24⤵
- Executes dropped EXE
PID:820 -
\??\c:\hbntbn.exec:\hbntbn.exe25⤵
- Executes dropped EXE
PID:2876 -
\??\c:\dpjpd.exec:\dpjpd.exe26⤵
- Executes dropped EXE
PID:1792 -
\??\c:\rrlxlrr.exec:\rrlxlrr.exe27⤵
- Executes dropped EXE
PID:980 -
\??\c:\pjddp.exec:\pjddp.exe28⤵
- Executes dropped EXE
PID:1324 -
\??\c:\jdvdp.exec:\jdvdp.exe29⤵
- Executes dropped EXE
PID:984 -
\??\c:\llxflrl.exec:\llxflrl.exe30⤵
- Executes dropped EXE
PID:2896 -
\??\c:\thhhbt.exec:\thhhbt.exe31⤵
- Executes dropped EXE
PID:3052 -
\??\c:\xlfrrfl.exec:\xlfrrfl.exe32⤵
- Executes dropped EXE
PID:2300 -
\??\c:\thhtbh.exec:\thhtbh.exe33⤵
- Executes dropped EXE
PID:3064 -
\??\c:\vjpdj.exec:\vjpdj.exe34⤵
- Executes dropped EXE
PID:1716 -
\??\c:\3jvvv.exec:\3jvvv.exe35⤵
- Executes dropped EXE
PID:1940 -
\??\c:\tthtnt.exec:\tthtnt.exe36⤵
- Executes dropped EXE
PID:1388 -
\??\c:\nnthtb.exec:\nnthtb.exe37⤵
- Executes dropped EXE
PID:3044 -
\??\c:\7dddp.exec:\7dddp.exe38⤵
- Executes dropped EXE
PID:3048 -
\??\c:\7dpdj.exec:\7dpdj.exe39⤵
- Executes dropped EXE
PID:1428 -
\??\c:\xxrfrxf.exec:\xxrfrxf.exe40⤵
- Executes dropped EXE
PID:2784 -
\??\c:\hthnnt.exec:\hthnnt.exe41⤵
- Executes dropped EXE
PID:2676 -
\??\c:\tthhtn.exec:\tthhtn.exe42⤵
- Executes dropped EXE
PID:2596 -
\??\c:\3vjdd.exec:\3vjdd.exe43⤵
- Executes dropped EXE
PID:3024 -
\??\c:\rlfflrf.exec:\rlfflrf.exe44⤵
- Executes dropped EXE
PID:2128 -
\??\c:\xlllrrr.exec:\xlllrrr.exe45⤵
- Executes dropped EXE
PID:2536 -
\??\c:\pjvvv.exec:\pjvvv.exe46⤵
- Executes dropped EXE
PID:2948 -
\??\c:\bbnntt.exec:\bbnntt.exe47⤵
- Executes dropped EXE
PID:2232 -
\??\c:\vjppp.exec:\vjppp.exe48⤵
- Executes dropped EXE
PID:1676 -
\??\c:\flxlxxr.exec:\flxlxxr.exe49⤵
- Executes dropped EXE
PID:1820 -
\??\c:\jvpdp.exec:\jvpdp.exe50⤵
- Executes dropped EXE
PID:1936 -
\??\c:\lfrxffr.exec:\lfrxffr.exe51⤵
- Executes dropped EXE
PID:2752 -
\??\c:\htbnbb.exec:\htbnbb.exe52⤵
- Executes dropped EXE
PID:2040 -
\??\c:\vjpjp.exec:\vjpjp.exe53⤵
- Executes dropped EXE
PID:2808 -
\??\c:\rlxlxff.exec:\rlxlxff.exe54⤵
- Executes dropped EXE
PID:2772 -
\??\c:\9rrfffl.exec:\9rrfffl.exe55⤵
- Executes dropped EXE
PID:2916 -
\??\c:\bnbbhn.exec:\bnbbhn.exe56⤵
- Executes dropped EXE
PID:672 -
\??\c:\3jdjj.exec:\3jdjj.exe57⤵
- Executes dropped EXE
PID:1528 -
\??\c:\lfxxlrf.exec:\lfxxlrf.exe58⤵
- Executes dropped EXE
PID:580 -
\??\c:\rllrllf.exec:\rllrllf.exe59⤵
- Executes dropped EXE
PID:624 -
\??\c:\hbtntn.exec:\hbtntn.exe60⤵
- Executes dropped EXE
PID:1100 -
\??\c:\dpvpv.exec:\dpvpv.exe61⤵
- Executes dropped EXE
PID:532 -
\??\c:\7rllxxl.exec:\7rllxxl.exe62⤵
- Executes dropped EXE
PID:1508 -
\??\c:\rllxllx.exec:\rllxllx.exe63⤵
- Executes dropped EXE
PID:2888 -
\??\c:\5bbbnn.exec:\5bbbnn.exe64⤵
- Executes dropped EXE
PID:2884 -
\??\c:\dpjpv.exec:\dpjpv.exe65⤵
- Executes dropped EXE
PID:332 -
\??\c:\pjvjp.exec:\pjvjp.exe66⤵PID:1308
-
\??\c:\7xllffr.exec:\7xllffr.exe67⤵PID:1768
-
\??\c:\ttbbbh.exec:\ttbbbh.exe68⤵PID:1992
-
\??\c:\jdvpd.exec:\jdvpd.exe69⤵PID:1216
-
\??\c:\jjpjp.exec:\jjpjp.exe70⤵PID:984
-
\??\c:\9xflxfx.exec:\9xflxfx.exe71⤵PID:2928
-
\??\c:\ntthbn.exec:\ntthbn.exe72⤵PID:2000
-
\??\c:\5vjdd.exec:\5vjdd.exe73⤵PID:2364
-
\??\c:\vjpdj.exec:\vjpdj.exe74⤵PID:3056
-
\??\c:\5rflxxr.exec:\5rflxxr.exe75⤵PID:1920
-
\??\c:\hntnbt.exec:\hntnbt.exe76⤵PID:2708
-
\??\c:\hhtttn.exec:\hhtttn.exe77⤵PID:1940
-
\??\c:\jdppj.exec:\jdppj.exe78⤵PID:2996
-
\??\c:\5fxfllx.exec:\5fxfllx.exe79⤵PID:2992
-
\??\c:\5frrxxf.exec:\5frrxxf.exe80⤵PID:2544
-
\??\c:\htbhnh.exec:\htbhnh.exe81⤵PID:2156
-
\??\c:\btnbhh.exec:\btnbhh.exe82⤵PID:2576
-
\??\c:\jvjjp.exec:\jvjjp.exe83⤵PID:2444
-
\??\c:\frlfrrl.exec:\frlfrrl.exe84⤵PID:2704
-
\??\c:\rrfflrr.exec:\rrfflrr.exe85⤵PID:2480
-
\??\c:\nhttbh.exec:\nhttbh.exe86⤵PID:2436
-
\??\c:\nbthtt.exec:\nbthtt.exe87⤵PID:1136
-
\??\c:\5vdvd.exec:\5vdvd.exe88⤵PID:2608
-
\??\c:\rfrxlrf.exec:\rfrxlrf.exe89⤵PID:2456
-
\??\c:\5xllxxf.exec:\5xllxxf.exe90⤵PID:2748
-
\??\c:\ntbbhh.exec:\ntbbhh.exe91⤵PID:1664
-
\??\c:\nntthh.exec:\nntthh.exe92⤵PID:2744
-
\??\c:\pvdpp.exec:\pvdpp.exe93⤵PID:856
-
\??\c:\ppdvd.exec:\ppdvd.exe94⤵PID:2800
-
\??\c:\xflxxrx.exec:\xflxxrx.exe95⤵PID:2812
-
\??\c:\tbbbth.exec:\tbbbth.exe96⤵PID:2288
-
\??\c:\5thhhh.exec:\5thhhh.exe97⤵PID:2816
-
\??\c:\1dvdj.exec:\1dvdj.exe98⤵PID:1188
-
\??\c:\dvdjj.exec:\dvdjj.exe99⤵PID:1728
-
\??\c:\frxfrrx.exec:\frxfrrx.exe100⤵PID:2344
-
\??\c:\hhtbtn.exec:\hhtbtn.exe101⤵PID:1088
-
\??\c:\1ntbbh.exec:\1ntbbh.exe102⤵PID:1488
-
\??\c:\9vddj.exec:\9vddj.exe103⤵PID:1544
-
\??\c:\dvjdp.exec:\dvjdp.exe104⤵PID:1044
-
\??\c:\rxrxllx.exec:\rxrxllx.exe105⤵PID:700
-
\??\c:\llxxflr.exec:\llxxflr.exe106⤵PID:2004
-
\??\c:\hbnhnn.exec:\hbnhnn.exe107⤵PID:1560
-
\??\c:\jdvdp.exec:\jdvdp.exe108⤵PID:1164
-
\??\c:\7jvvd.exec:\7jvvd.exe109⤵PID:980
-
\??\c:\flflxll.exec:\flflxll.exe110⤵PID:1324
-
\??\c:\rlrxfxl.exec:\rlrxfxl.exe111⤵PID:2312
-
\??\c:\nnhnhh.exec:\nnhnhh.exe112⤵PID:2984
-
\??\c:\hhthtn.exec:\hhthtn.exe113⤵PID:2924
-
\??\c:\dvvpd.exec:\dvvpd.exe114⤵PID:1236
-
\??\c:\ppdpd.exec:\ppdpd.exe115⤵PID:2920
-
\??\c:\rrllrfr.exec:\rrllrfr.exe116⤵PID:3064
-
\??\c:\7nnnbb.exec:\7nnnbb.exe117⤵PID:2616
-
\??\c:\btbtth.exec:\btbtth.exe118⤵PID:2840
-
\??\c:\dvpjp.exec:\dvpjp.exe119⤵PID:892
-
\??\c:\jvjpd.exec:\jvjpd.exe120⤵PID:1532
-
\??\c:\xrxfxxf.exec:\xrxfxxf.exe121⤵PID:2072
-
\??\c:\1tnntt.exec:\1tnntt.exe122⤵PID:2280
-
\??\c:\nnnbhh.exec:\nnnbhh.exe123⤵PID:2544
-
\??\c:\5vpvd.exec:\5vpvd.exe124⤵PID:2588
-
\??\c:\pjpvd.exec:\pjpvd.exe125⤵PID:2676
-
\??\c:\fxxfxlr.exec:\fxxfxlr.exe126⤵PID:2548
-
\??\c:\tnbhbb.exec:\tnbhbb.exe127⤵PID:2432
-
\??\c:\thnnbt.exec:\thnnbt.exe128⤵PID:2652
-
\??\c:\pddjp.exec:\pddjp.exe129⤵PID:2556
-
\??\c:\jjddj.exec:\jjddj.exe130⤵PID:1804
-
\??\c:\xxfllfx.exec:\xxfllfx.exe131⤵PID:2680
-
\??\c:\bbhhnh.exec:\bbhhnh.exe132⤵PID:2412
-
\??\c:\btnnhh.exec:\btnnhh.exe133⤵PID:2524
-
\??\c:\vjddj.exec:\vjddj.exe134⤵PID:2740
-
\??\c:\3jjjp.exec:\3jjjp.exe135⤵PID:2732
-
\??\c:\xxrxffr.exec:\xxrxffr.exe136⤵PID:1072
-
\??\c:\lfrxxxx.exec:\lfrxxxx.exe137⤵PID:1948
-
\??\c:\3ntnhb.exec:\3ntnhb.exe138⤵PID:2424
-
\??\c:\bntntn.exec:\bntntn.exe139⤵PID:2916
-
\??\c:\jvvjp.exec:\jvvjp.exe140⤵PID:764
-
\??\c:\flxxffl.exec:\flxxffl.exe141⤵PID:1876
-
\??\c:\tnbbhh.exec:\tnbbhh.exe142⤵PID:580
-
\??\c:\5djdd.exec:\5djdd.exe143⤵PID:1500
-
\??\c:\rlxxxxf.exec:\rlxxxxf.exe144⤵PID:1152
-
\??\c:\bhbbnb.exec:\bhbbnb.exe145⤵PID:844
-
\??\c:\vpjjj.exec:\vpjjj.exe146⤵PID:2180
-
\??\c:\lxxlrlx.exec:\lxxlrlx.exe147⤵PID:2324
-
\??\c:\5hthbh.exec:\5hthbh.exe148⤵PID:1828
-
\??\c:\7flffxf.exec:\7flffxf.exe149⤵PID:1620
-
\??\c:\ththhb.exec:\ththhb.exe150⤵PID:2016
-
\??\c:\vvppd.exec:\vvppd.exe151⤵PID:1200
-
\??\c:\7lffllx.exec:\7lffllx.exe152⤵PID:1992
-
\??\c:\pjdjp.exec:\pjdjp.exe153⤵PID:1824
-
\??\c:\7xrlllr.exec:\7xrlllr.exe154⤵PID:2216
-
\??\c:\7hbtbb.exec:\7hbtbb.exe155⤵PID:2192
-
\??\c:\5xrrxrr.exec:\5xrrxrr.exe156⤵PID:2300
-
\??\c:\btbbhh.exec:\btbbhh.exe157⤵PID:1712
-
\??\c:\5vvdp.exec:\5vvdp.exe158⤵PID:1988
-
\??\c:\rfxxffl.exec:\rfxxffl.exe159⤵PID:2900
-
\??\c:\flfrxlx.exec:\flfrxlx.exe160⤵PID:1960
-
\??\c:\thnbht.exec:\thnbht.exe161⤵PID:3016
-
\??\c:\jdjvp.exec:\jdjvp.exe162⤵PID:1580
-
\??\c:\pvpvv.exec:\pvpvv.exe163⤵PID:2628
-
\??\c:\rfrfxxr.exec:\rfrfxxr.exe164⤵PID:1644
-
\??\c:\9nhhnn.exec:\9nhhnn.exe165⤵PID:2872
-
\??\c:\5dvdp.exec:\5dvdp.exe166⤵PID:2632
-
\??\c:\dpvvd.exec:\dpvvd.exe167⤵PID:2596
-
\??\c:\lfrrrfx.exec:\lfrrrfx.exe168⤵PID:1184
-
\??\c:\tnbhtb.exec:\tnbhtb.exe169⤵PID:2684
-
\??\c:\bthntn.exec:\bthntn.exe170⤵PID:2536
-
\??\c:\jvvpp.exec:\jvvpp.exe171⤵PID:2484
-
\??\c:\rrflrrl.exec:\rrflrrl.exe172⤵PID:1616
-
\??\c:\bttbbh.exec:\bttbbh.exe173⤵PID:2532
-
\??\c:\9hnhnh.exec:\9hnhnh.exe174⤵PID:1820
-
\??\c:\vjvpd.exec:\vjvpd.exe175⤵PID:1476
-
\??\c:\xxllrxx.exec:\xxllrxx.exe176⤵PID:2752
-
\??\c:\nbtbhh.exec:\nbtbhh.exe177⤵PID:2796
-
\??\c:\7htttb.exec:\7htttb.exe178⤵PID:2808
-
\??\c:\vdpvv.exec:\vdpvv.exe179⤵PID:1408
-
\??\c:\rlflrlr.exec:\rlflrlr.exe180⤵PID:1584
-
\??\c:\1bhhth.exec:\1bhhth.exe181⤵PID:1076
-
\??\c:\tnhnht.exec:\tnhnht.exe182⤵PID:1404
-
\??\c:\9pdjv.exec:\9pdjv.exe183⤵PID:588
-
\??\c:\llfxrxl.exec:\llfxrxl.exe184⤵PID:1496
-
\??\c:\hbtnhn.exec:\hbtnhn.exe185⤵PID:1100
-
\??\c:\bhnthb.exec:\bhnthb.exe186⤵PID:1288
-
\??\c:\pdppp.exec:\pdppp.exe187⤵PID:2404
-
\??\c:\flfflrf.exec:\flfflrf.exe188⤵PID:112
-
\??\c:\lfrlffr.exec:\lfrlffr.exe189⤵PID:2868
-
\??\c:\hhbntb.exec:\hhbntb.exe190⤵PID:1536
-
\??\c:\vvvdp.exec:\vvvdp.exe191⤵PID:1548
-
\??\c:\ppjvj.exec:\ppjvj.exe192⤵PID:2020
-
\??\c:\flrrlfr.exec:\flrrlfr.exe193⤵PID:1980
-
\??\c:\5hnbhn.exec:\5hnbhn.exe194⤵PID:108
-
\??\c:\9htttn.exec:\9htttn.exe195⤵PID:908
-
\??\c:\pppjp.exec:\pppjp.exe196⤵PID:2420
-
\??\c:\9xlrflx.exec:\9xlrflx.exe197⤵PID:1680
-
\??\c:\7hbhhn.exec:\7hbhhn.exe198⤵PID:2908
-
\??\c:\1nbbtb.exec:\1nbbtb.exe199⤵PID:2864
-
\??\c:\7pddj.exec:\7pddj.exe200⤵PID:1716
-
\??\c:\vjvvp.exec:\vjvvp.exe201⤵PID:1660
-
\??\c:\7lrxfll.exec:\7lrxfll.exe202⤵PID:3004
-
\??\c:\3hhnht.exec:\3hhnht.exe203⤵PID:2708
-
\??\c:\5jvvj.exec:\5jvvj.exe204⤵PID:2712
-
\??\c:\jdjjv.exec:\jdjjv.exe205⤵PID:2528
-
\??\c:\rfrflrx.exec:\rfrflrx.exe206⤵PID:3048
-
\??\c:\3ttnth.exec:\3ttnth.exe207⤵PID:2860
-
\??\c:\9ththh.exec:\9ththh.exe208⤵PID:2724
-
\??\c:\dddpv.exec:\dddpv.exe209⤵PID:2668
-
\??\c:\frfflll.exec:\frfflll.exe210⤵PID:2476
-
\??\c:\hbtbhh.exec:\hbtbhh.exe211⤵PID:2440
-
\??\c:\thtthb.exec:\thtthb.exe212⤵PID:2960
-
\??\c:\7jdpv.exec:\7jdpv.exe213⤵PID:3060
-
\??\c:\jvjpv.exec:\jvjpv.exe214⤵PID:2500
-
\??\c:\fxxflxr.exec:\fxxflxr.exe215⤵PID:2604
-
\??\c:\5tntbh.exec:\5tntbh.exe216⤵PID:1516
-
\??\c:\djjvp.exec:\djjvp.exe217⤵PID:1936
-
\??\c:\1jddd.exec:\1jddd.exe218⤵PID:2764
-
\??\c:\frxrxrx.exec:\frxrxrx.exe219⤵PID:2612
-
\??\c:\hhbhnb.exec:\hhbhnb.exe220⤵PID:2152
-
\??\c:\7pdjj.exec:\7pdjj.exe221⤵PID:2836
-
\??\c:\7vvdj.exec:\7vvdj.exe222⤵PID:2952
-
\??\c:\frfxfxf.exec:\frfxfxf.exe223⤵PID:2052
-
\??\c:\nththn.exec:\nththn.exe224⤵PID:2252
-
\??\c:\bnbhnn.exec:\bnbhnn.exe225⤵PID:324
-
\??\c:\pjvdp.exec:\pjvdp.exe226⤵PID:1700
-
\??\c:\lflfffx.exec:\lflfffx.exe227⤵PID:1944
-
\??\c:\1llfrxf.exec:\1llfrxf.exe228⤵PID:2240
-
\??\c:\nhthnn.exec:\nhthnn.exe229⤵PID:1288
-
\??\c:\pdppv.exec:\pdppv.exe230⤵PID:1600
-
\??\c:\9vvjd.exec:\9vvjd.exe231⤵PID:700
-
\??\c:\rlflrrf.exec:\rlflrrf.exe232⤵PID:2012
-
\??\c:\nnhhbb.exec:\nnhhbb.exe233⤵PID:660
-
\??\c:\tnhntb.exec:\tnhntb.exe234⤵PID:2024
-
\??\c:\vdjvd.exec:\vdjvd.exe235⤵PID:1164
-
\??\c:\lfllflr.exec:\lfllflr.exe236⤵PID:1440
-
\??\c:\7rfrffx.exec:\7rfrffx.exe237⤵PID:2968
-
\??\c:\ttnbnt.exec:\ttnbnt.exe238⤵PID:984
-
\??\c:\vvdpj.exec:\vvdpj.exe239⤵PID:1916
-
\??\c:\3jvjj.exec:\3jvjj.exe240⤵PID:2000
-
\??\c:\flxxffx.exec:\flxxffx.exe241⤵PID:1608
-
\??\c:\tnhhhh.exec:\tnhhhh.exe242⤵PID:2980