Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 19:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1f1bf278207e145dac5d03b1c89651e0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
General
-
Target
1f1bf278207e145dac5d03b1c89651e0_NeikiAnalytics.exe
-
Size
179KB
-
MD5
1f1bf278207e145dac5d03b1c89651e0
-
SHA1
fd5b55be1bb1e777d6ed2b3a901a9a887b362e70
-
SHA256
ce35691196646771998ae93aae2f0b1e435c31c03f5cc7d43100d2f8856d5df9
-
SHA512
ffdbfba7f4e121c280f4ed0643c6a91fda3ecc58f2b6331ca014adeade96e0a0fdc3a997477d6b2236229a6fd814674429ab437c82809abe811b822e33d6413e
-
SSDEEP
3072:AhOmTsF93UYfwC6GIoutQ6M/Fpi8rY9AABa1YRMxgRP5ZXuxF:Acm4FmowdHoSCddWhR/Z+H
Malware Config
Signatures
-
Detect Blackmoon payload 40 IoCs
Processes:
resource yara_rule behavioral1/memory/3044-1-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/1952-10-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2152-19-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2708-45-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/1944-54-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2540-75-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2836-71-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2308-94-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2568-91-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2940-127-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2956-135-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/464-148-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2748-169-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/3028-187-0x0000000000260000-0x0000000000291000-memory.dmp family_blackmoon behavioral1/memory/2272-213-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/1472-224-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2232-233-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/956-263-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/1824-272-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/896-281-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2164-296-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2220-316-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2052-325-0x00000000771E0000-0x00000000772FF000-memory.dmp family_blackmoon behavioral1/memory/2268-346-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2716-348-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2716-354-0x00000000002D0000-0x0000000000301000-memory.dmp family_blackmoon behavioral1/memory/2612-362-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2600-394-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2600-432-0x0000000000220000-0x0000000000251000-memory.dmp family_blackmoon behavioral1/memory/1420-457-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/1276-476-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/1320-526-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/1992-752-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/1576-924-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2268-937-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2620-950-0x0000000000220000-0x0000000000251000-memory.dmp family_blackmoon behavioral1/memory/2508-982-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2844-1013-0x0000000000220000-0x0000000000251000-memory.dmp family_blackmoon behavioral1/memory/2420-1028-0x0000000000220000-0x0000000000251000-memory.dmp family_blackmoon behavioral1/memory/1336-1137-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jjdjv.exeppjpd.exexlxxffr.exedvpdd.exexlffrlr.exellflrxl.exeththht.exevvvvd.exejdpjv.exe9tnnnh.exe5ddjj.exetbhthb.exehhtthn.exellxlrxl.exexrlrlrf.exejdpvj.exevpjpv.exetnbbtn.exehbnhnn.exeddjdv.exexrllrrf.exe5bthth.exepjdjp.exexxfrfrf.exeffrrrrx.exe7ttbbh.exe1ddjv.exe7thnbn.exebnhnbh.exe9pjpv.exerlfrxff.exe5dppj.exefxrxfrx.exe9flxlxl.exenbtnnb.exerxffllx.exelxrfxfr.exenhnntt.exehhnhhb.exejddpd.exepjvdj.exelffrflr.exe9btbhn.exebtbnnt.exedvjpv.exepjppv.exerlrxflx.exe9hnnbb.exehhbnhn.exevpdjd.exevvdjp.exe1rxrrrf.exebnhnbb.exenhtbbb.exepjpvv.exe9flrrxf.exe5rrxffl.exebbhnhn.exebhntnt.exedvpdj.exe9dddp.exefxlxlxl.exennhttt.exenhhbbh.exepid process 1952 jjdjv.exe 2152 ppjpd.exe 1180 xlxxffr.exe 2704 dvpdd.exe 2708 xlffrlr.exe 1944 llflrxl.exe 2836 ththht.exe 2540 vvvvd.exe 2568 jdpjv.exe 2308 9tnnnh.exe 2764 5ddjj.exe 2832 tbhthb.exe 2940 hhtthn.exe 2956 llxlrxl.exe 2196 xrlrlrf.exe 464 jdpvj.exe 2148 vpjpv.exe 2748 tnbbtn.exe 1312 hbnhnn.exe 3028 ddjdv.exe 3012 xrllrrf.exe 2448 5bthth.exe 2272 pjdjp.exe 264 xxfrfrf.exe 1472 ffrrrrx.exe 2232 7ttbbh.exe 2112 1ddjv.exe 1780 7thnbn.exe 956 bnhnbh.exe 1824 9pjpv.exe 896 rlfrxff.exe 1532 5dppj.exe 1596 fxrxfrx.exe 2164 9flxlxl.exe 1740 nbtnnb.exe 2220 rxffllx.exe 1936 lxrfxfr.exe 2052 nhnntt.exe 1572 hhnhhb.exe 2268 jddpd.exe 2716 pjvdj.exe 2612 lffrflr.exe 2784 9btbhn.exe 2528 btbnnt.exe 2180 dvjpv.exe 2492 pjppv.exe 2600 rlrxflx.exe 2772 9hnnbb.exe 688 hhbnhn.exe 2804 vpdjd.exe 2824 vvdjp.exe 2968 1rxrrrf.exe 2948 bnhnbb.exe 1676 nhtbbb.exe 2956 pjpvv.exe 544 9flrrxf.exe 1992 5rrxffl.exe 1420 bbhnhn.exe 2148 bhntnt.exe 3004 dvpdj.exe 1276 9dddp.exe 1372 fxlxlxl.exe 2068 nnhttt.exe 2900 nhhbbh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1f1bf278207e145dac5d03b1c89651e0_NeikiAnalytics.exejjdjv.exeppjpd.exexlxxffr.exedvpdd.exexlffrlr.exellflrxl.exeththht.exevvvvd.exejdpjv.exe9tnnnh.exe5ddjj.exetbhthb.exehhtthn.exellxlrxl.exexrlrlrf.exedescription pid process target process PID 3044 wrote to memory of 1952 3044 1f1bf278207e145dac5d03b1c89651e0_NeikiAnalytics.exe jjdjv.exe PID 3044 wrote to memory of 1952 3044 1f1bf278207e145dac5d03b1c89651e0_NeikiAnalytics.exe jjdjv.exe PID 3044 wrote to memory of 1952 3044 1f1bf278207e145dac5d03b1c89651e0_NeikiAnalytics.exe jjdjv.exe PID 3044 wrote to memory of 1952 3044 1f1bf278207e145dac5d03b1c89651e0_NeikiAnalytics.exe jjdjv.exe PID 1952 wrote to memory of 2152 1952 jjdjv.exe ppjpd.exe PID 1952 wrote to memory of 2152 1952 jjdjv.exe ppjpd.exe PID 1952 wrote to memory of 2152 1952 jjdjv.exe ppjpd.exe PID 1952 wrote to memory of 2152 1952 jjdjv.exe ppjpd.exe PID 2152 wrote to memory of 1180 2152 ppjpd.exe xlxxffr.exe PID 2152 wrote to memory of 1180 2152 ppjpd.exe xlxxffr.exe PID 2152 wrote to memory of 1180 2152 ppjpd.exe xlxxffr.exe PID 2152 wrote to memory of 1180 2152 ppjpd.exe xlxxffr.exe PID 1180 wrote to memory of 2704 1180 xlxxffr.exe dvpdd.exe PID 1180 wrote to memory of 2704 1180 xlxxffr.exe dvpdd.exe PID 1180 wrote to memory of 2704 1180 xlxxffr.exe dvpdd.exe PID 1180 wrote to memory of 2704 1180 xlxxffr.exe dvpdd.exe PID 2704 wrote to memory of 2708 2704 dvpdd.exe xlffrlr.exe PID 2704 wrote to memory of 2708 2704 dvpdd.exe xlffrlr.exe PID 2704 wrote to memory of 2708 2704 dvpdd.exe xlffrlr.exe PID 2704 wrote to memory of 2708 2704 dvpdd.exe xlffrlr.exe PID 2708 wrote to memory of 1944 2708 xlffrlr.exe llflrxl.exe PID 2708 wrote to memory of 1944 2708 xlffrlr.exe llflrxl.exe PID 2708 wrote to memory of 1944 2708 xlffrlr.exe llflrxl.exe PID 2708 wrote to memory of 1944 2708 xlffrlr.exe llflrxl.exe PID 1944 wrote to memory of 2836 1944 llflrxl.exe ththht.exe PID 1944 wrote to memory of 2836 1944 llflrxl.exe ththht.exe PID 1944 wrote to memory of 2836 1944 llflrxl.exe ththht.exe PID 1944 wrote to memory of 2836 1944 llflrxl.exe ththht.exe PID 2836 wrote to memory of 2540 2836 ththht.exe vvvvd.exe PID 2836 wrote to memory of 2540 2836 ththht.exe vvvvd.exe PID 2836 wrote to memory of 2540 2836 ththht.exe vvvvd.exe PID 2836 wrote to memory of 2540 2836 ththht.exe vvvvd.exe PID 2540 wrote to memory of 2568 2540 vvvvd.exe jdpjv.exe PID 2540 wrote to memory of 2568 2540 vvvvd.exe jdpjv.exe PID 2540 wrote to memory of 2568 2540 vvvvd.exe jdpjv.exe PID 2540 wrote to memory of 2568 2540 vvvvd.exe jdpjv.exe PID 2568 wrote to memory of 2308 2568 jdpjv.exe 9tnnnh.exe PID 2568 wrote to memory of 2308 2568 jdpjv.exe 9tnnnh.exe PID 2568 wrote to memory of 2308 2568 jdpjv.exe 9tnnnh.exe PID 2568 wrote to memory of 2308 2568 jdpjv.exe 9tnnnh.exe PID 2308 wrote to memory of 2764 2308 9tnnnh.exe 5ddjj.exe PID 2308 wrote to memory of 2764 2308 9tnnnh.exe 5ddjj.exe PID 2308 wrote to memory of 2764 2308 9tnnnh.exe 5ddjj.exe PID 2308 wrote to memory of 2764 2308 9tnnnh.exe 5ddjj.exe PID 2764 wrote to memory of 2832 2764 5ddjj.exe tbhthb.exe PID 2764 wrote to memory of 2832 2764 5ddjj.exe tbhthb.exe PID 2764 wrote to memory of 2832 2764 5ddjj.exe tbhthb.exe PID 2764 wrote to memory of 2832 2764 5ddjj.exe tbhthb.exe PID 2832 wrote to memory of 2940 2832 tbhthb.exe hhtthn.exe PID 2832 wrote to memory of 2940 2832 tbhthb.exe hhtthn.exe PID 2832 wrote to memory of 2940 2832 tbhthb.exe hhtthn.exe PID 2832 wrote to memory of 2940 2832 tbhthb.exe hhtthn.exe PID 2940 wrote to memory of 2956 2940 hhtthn.exe llxlrxl.exe PID 2940 wrote to memory of 2956 2940 hhtthn.exe llxlrxl.exe PID 2940 wrote to memory of 2956 2940 hhtthn.exe llxlrxl.exe PID 2940 wrote to memory of 2956 2940 hhtthn.exe llxlrxl.exe PID 2956 wrote to memory of 2196 2956 llxlrxl.exe xrlrlrf.exe PID 2956 wrote to memory of 2196 2956 llxlrxl.exe xrlrlrf.exe PID 2956 wrote to memory of 2196 2956 llxlrxl.exe xrlrlrf.exe PID 2956 wrote to memory of 2196 2956 llxlrxl.exe xrlrlrf.exe PID 2196 wrote to memory of 464 2196 xrlrlrf.exe jdpvj.exe PID 2196 wrote to memory of 464 2196 xrlrlrf.exe jdpvj.exe PID 2196 wrote to memory of 464 2196 xrlrlrf.exe jdpvj.exe PID 2196 wrote to memory of 464 2196 xrlrlrf.exe jdpvj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f1bf278207e145dac5d03b1c89651e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1f1bf278207e145dac5d03b1c89651e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\jjdjv.exec:\jjdjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\ppjpd.exec:\ppjpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\xlxxffr.exec:\xlxxffr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\dvpdd.exec:\dvpdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\xlffrlr.exec:\xlffrlr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\llflrxl.exec:\llflrxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\ththht.exec:\ththht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\vvvvd.exec:\vvvvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\jdpjv.exec:\jdpjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\9tnnnh.exec:\9tnnnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\5ddjj.exec:\5ddjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\tbhthb.exec:\tbhthb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\hhtthn.exec:\hhtthn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\llxlrxl.exec:\llxlrxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\xrlrlrf.exec:\xrlrlrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\jdpvj.exec:\jdpvj.exe17⤵
- Executes dropped EXE
PID:464 -
\??\c:\vpjpv.exec:\vpjpv.exe18⤵
- Executes dropped EXE
PID:2148 -
\??\c:\tnbbtn.exec:\tnbbtn.exe19⤵
- Executes dropped EXE
PID:2748 -
\??\c:\hbnhnn.exec:\hbnhnn.exe20⤵
- Executes dropped EXE
PID:1312 -
\??\c:\ddjdv.exec:\ddjdv.exe21⤵
- Executes dropped EXE
PID:3028 -
\??\c:\xrllrrf.exec:\xrllrrf.exe22⤵
- Executes dropped EXE
PID:3012 -
\??\c:\5bthth.exec:\5bthth.exe23⤵
- Executes dropped EXE
PID:2448 -
\??\c:\pjdjp.exec:\pjdjp.exe24⤵
- Executes dropped EXE
PID:2272 -
\??\c:\xxfrfrf.exec:\xxfrfrf.exe25⤵
- Executes dropped EXE
PID:264 -
\??\c:\ffrrrrx.exec:\ffrrrrx.exe26⤵
- Executes dropped EXE
PID:1472 -
\??\c:\7ttbbh.exec:\7ttbbh.exe27⤵
- Executes dropped EXE
PID:2232 -
\??\c:\1ddjv.exec:\1ddjv.exe28⤵
- Executes dropped EXE
PID:2112 -
\??\c:\7thnbn.exec:\7thnbn.exe29⤵
- Executes dropped EXE
PID:1780 -
\??\c:\bnhnbh.exec:\bnhnbh.exe30⤵
- Executes dropped EXE
PID:956 -
\??\c:\9pjpv.exec:\9pjpv.exe31⤵
- Executes dropped EXE
PID:1824 -
\??\c:\rlfrxff.exec:\rlfrxff.exe32⤵
- Executes dropped EXE
PID:896 -
\??\c:\5dppj.exec:\5dppj.exe33⤵
- Executes dropped EXE
PID:1532 -
\??\c:\fxrxfrx.exec:\fxrxfrx.exe34⤵
- Executes dropped EXE
PID:1596 -
\??\c:\9flxlxl.exec:\9flxlxl.exe35⤵
- Executes dropped EXE
PID:2164 -
\??\c:\nbtnnb.exec:\nbtnnb.exe36⤵
- Executes dropped EXE
PID:1740 -
\??\c:\rxffllx.exec:\rxffllx.exe37⤵
- Executes dropped EXE
PID:2220 -
\??\c:\lxrfxfr.exec:\lxrfxfr.exe38⤵
- Executes dropped EXE
PID:1936 -
\??\c:\nhnntt.exec:\nhnntt.exe39⤵
- Executes dropped EXE
PID:2052 -
\??\c:\7djjd.exec:\7djjd.exe40⤵PID:1640
-
\??\c:\hhnhhb.exec:\hhnhhb.exe41⤵
- Executes dropped EXE
PID:1572 -
\??\c:\jddpd.exec:\jddpd.exe42⤵
- Executes dropped EXE
PID:2268 -
\??\c:\pjvdj.exec:\pjvdj.exe43⤵
- Executes dropped EXE
PID:2716 -
\??\c:\lffrflr.exec:\lffrflr.exe44⤵
- Executes dropped EXE
PID:2612 -
\??\c:\9btbhn.exec:\9btbhn.exe45⤵
- Executes dropped EXE
PID:2784 -
\??\c:\btbnnt.exec:\btbnnt.exe46⤵
- Executes dropped EXE
PID:2528 -
\??\c:\dvjpv.exec:\dvjpv.exe47⤵
- Executes dropped EXE
PID:2180 -
\??\c:\pjppv.exec:\pjppv.exe48⤵
- Executes dropped EXE
PID:2492 -
\??\c:\rlrxflx.exec:\rlrxflx.exe49⤵
- Executes dropped EXE
PID:2600 -
\??\c:\9hnnbb.exec:\9hnnbb.exe50⤵
- Executes dropped EXE
PID:2772 -
\??\c:\hhbnhn.exec:\hhbnhn.exe51⤵
- Executes dropped EXE
PID:688 -
\??\c:\vpdjd.exec:\vpdjd.exe52⤵
- Executes dropped EXE
PID:2804 -
\??\c:\vvdjp.exec:\vvdjp.exe53⤵
- Executes dropped EXE
PID:2824 -
\??\c:\1rxrrrf.exec:\1rxrrrf.exe54⤵
- Executes dropped EXE
PID:2968 -
\??\c:\bnhnbb.exec:\bnhnbb.exe55⤵
- Executes dropped EXE
PID:2948 -
\??\c:\nhtbbb.exec:\nhtbbb.exe56⤵
- Executes dropped EXE
PID:1676 -
\??\c:\pjpvv.exec:\pjpvv.exe57⤵
- Executes dropped EXE
PID:2956 -
\??\c:\9flrrxf.exec:\9flrrxf.exe58⤵
- Executes dropped EXE
PID:544 -
\??\c:\5rrxffl.exec:\5rrxffl.exe59⤵
- Executes dropped EXE
PID:1992 -
\??\c:\bbhnhn.exec:\bbhnhn.exe60⤵
- Executes dropped EXE
PID:1420 -
\??\c:\bhntnt.exec:\bhntnt.exe61⤵
- Executes dropped EXE
PID:2148 -
\??\c:\dvpdj.exec:\dvpdj.exe62⤵
- Executes dropped EXE
PID:3004 -
\??\c:\9dddp.exec:\9dddp.exe63⤵
- Executes dropped EXE
PID:1276 -
\??\c:\fxlxlxl.exec:\fxlxlxl.exe64⤵
- Executes dropped EXE
PID:1372 -
\??\c:\nnhttt.exec:\nnhttt.exe65⤵
- Executes dropped EXE
PID:2068 -
\??\c:\nhhbbh.exec:\nhhbbh.exe66⤵
- Executes dropped EXE
PID:2900 -
\??\c:\9djpj.exec:\9djpj.exe67⤵PID:2668
-
\??\c:\lfffllx.exec:\lfffllx.exe68⤵PID:592
-
\??\c:\1fxxflx.exec:\1fxxflx.exe69⤵PID:1252
-
\??\c:\5tthnb.exec:\5tthnb.exe70⤵PID:1100
-
\??\c:\pdjvd.exec:\pdjvd.exe71⤵PID:1320
-
\??\c:\jvpdd.exec:\jvpdd.exe72⤵PID:1124
-
\??\c:\7lfxffr.exec:\7lfxffr.exe73⤵PID:280
-
\??\c:\tthhtb.exec:\tthhtb.exe74⤵PID:1260
-
\??\c:\tnbttb.exec:\tnbttb.exe75⤵PID:1780
-
\??\c:\1pjpd.exec:\1pjpd.exe76⤵PID:2212
-
\??\c:\5dvvd.exec:\5dvvd.exe77⤵PID:304
-
\??\c:\fxfrrxl.exec:\fxfrrxl.exe78⤵PID:952
-
\??\c:\xrlrxfr.exec:\xrlrxfr.exe79⤵PID:2128
-
\??\c:\btbnhn.exec:\btbnhn.exe80⤵PID:2424
-
\??\c:\nnhtnt.exec:\nnhtnt.exe81⤵PID:3064
-
\??\c:\vpjpd.exec:\vpjpd.exe82⤵PID:1248
-
\??\c:\fxlrrfl.exec:\fxlrrfl.exe83⤵PID:1716
-
\??\c:\9xxflxx.exec:\9xxflxx.exe84⤵PID:1932
-
\??\c:\hbnhnn.exec:\hbnhnn.exe85⤵PID:2260
-
\??\c:\3hhthn.exec:\3hhthn.exe86⤵PID:1600
-
\??\c:\jdjvv.exec:\jdjvv.exe87⤵PID:1568
-
\??\c:\fxflxxl.exec:\fxflxxl.exe88⤵PID:2632
-
\??\c:\rrlrxxf.exec:\rrlrxxf.exe89⤵PID:2720
-
\??\c:\tnnntb.exec:\tnnntb.exe90⤵PID:2884
-
\??\c:\pjjjp.exec:\pjjjp.exe91⤵PID:2688
-
\??\c:\vppdp.exec:\vppdp.exe92⤵PID:2612
-
\??\c:\fxrxfll.exec:\fxrxfll.exe93⤵PID:2204
-
\??\c:\lfllrlx.exec:\lfllrlx.exe94⤵PID:2248
-
\??\c:\hbnthh.exec:\hbnthh.exe95⤵PID:2180
-
\??\c:\bbbnhn.exec:\bbbnhn.exe96⤵PID:2488
-
\??\c:\ppjpd.exec:\ppjpd.exe97⤵PID:2540
-
\??\c:\1xxlxfr.exec:\1xxlxfr.exe98⤵PID:2976
-
\??\c:\3lfxlxr.exec:\3lfxlxr.exe99⤵PID:2308
-
\??\c:\tnhnht.exec:\tnhnht.exe100⤵PID:2804
-
\??\c:\vpddp.exec:\vpddp.exe101⤵PID:2952
-
\??\c:\7dvdj.exec:\7dvdj.exe102⤵PID:2968
-
\??\c:\rlflxfr.exec:\rlflxfr.exe103⤵PID:2948
-
\??\c:\3flflfr.exec:\3flflfr.exe104⤵PID:2452
-
\??\c:\5bbhnt.exec:\5bbhnt.exe105⤵PID:2956
-
\??\c:\jjvjv.exec:\jjvjv.exe106⤵PID:888
-
\??\c:\5vpdd.exec:\5vpdd.exe107⤵PID:1992
-
\??\c:\ffrxffr.exec:\ffrxffr.exe108⤵PID:1976
-
\??\c:\lrxxffl.exec:\lrxxffl.exe109⤵PID:2148
-
\??\c:\hnbhbt.exec:\hnbhbt.exe110⤵PID:2360
-
\??\c:\7jdjj.exec:\7jdjj.exe111⤵PID:1272
-
\??\c:\jjdjj.exec:\jjdjj.exe112⤵PID:1928
-
\??\c:\rrrlxlx.exec:\rrrlxlx.exe113⤵PID:2068
-
\??\c:\rlxxlrf.exec:\rlxxlrf.exe114⤵PID:2880
-
\??\c:\hbnbbn.exec:\hbnbbn.exe115⤵PID:2436
-
\??\c:\5nbhbb.exec:\5nbhbb.exe116⤵PID:532
-
\??\c:\pdjvv.exec:\pdjvv.exe117⤵PID:1252
-
\??\c:\1dpvd.exec:\1dpvd.exe118⤵PID:2996
-
\??\c:\rlllxfr.exec:\rlllxfr.exe119⤵PID:1732
-
\??\c:\ffrflrx.exec:\ffrflrx.exe120⤵PID:2120
-
\??\c:\3rlrrfl.exec:\3rlrrfl.exe121⤵PID:2132
-
\??\c:\7nthnh.exec:\7nthnh.exe122⤵PID:1548
-
\??\c:\hbnntt.exec:\hbnntt.exe123⤵PID:1868
-
\??\c:\vpdvd.exec:\vpdvd.exe124⤵PID:2236
-
\??\c:\pjdjv.exec:\pjdjv.exe125⤵PID:744
-
\??\c:\5rfllrx.exec:\5rfllrx.exe126⤵PID:2116
-
\??\c:\llxrxxr.exec:\llxrxxr.exe127⤵PID:3060
-
\??\c:\tnhhht.exec:\tnhhht.exe128⤵PID:2864
-
\??\c:\hnbtbh.exec:\hnbtbh.exe129⤵PID:872
-
\??\c:\vjjvp.exec:\vjjvp.exe130⤵PID:1496
-
\??\c:\rlxlxll.exec:\rlxlxll.exe131⤵PID:1940
-
\??\c:\lllflfr.exec:\lllflfr.exe132⤵PID:2388
-
\??\c:\bthbtt.exec:\bthbtt.exe133⤵PID:2444
-
\??\c:\ttthnb.exec:\ttthnb.exe134⤵PID:1632
-
\??\c:\vdppp.exec:\vdppp.exe135⤵PID:1576
-
\??\c:\flrrrrx.exec:\flrrrrx.exe136⤵PID:2636
-
\??\c:\ttbhbh.exec:\ttbhbh.exe137⤵PID:2268
-
\??\c:\nhbbhh.exec:\nhbbhh.exe138⤵PID:2620
-
\??\c:\ppjpv.exec:\ppjpv.exe139⤵PID:2708
-
\??\c:\rrxrflr.exec:\rrxrflr.exe140⤵PID:2516
-
\??\c:\7rflxxl.exec:\7rflxxl.exe141⤵PID:2624
-
\??\c:\nbthtt.exec:\nbthtt.exe142⤵PID:2652
-
\??\c:\hhhhnn.exec:\hhhhnn.exe143⤵PID:2508
-
\??\c:\vpjvd.exec:\vpjvd.exe144⤵PID:2364
-
\??\c:\llrrffr.exec:\llrrffr.exe145⤵PID:2752
-
\??\c:\fxfxfrl.exec:\fxfxfrl.exe146⤵PID:1704
-
\??\c:\3thbnh.exec:\3thbnh.exe147⤵PID:2812
-
\??\c:\5jvvj.exec:\5jvvj.exe148⤵PID:2844
-
\??\c:\vjdvd.exec:\vjdvd.exe149⤵PID:1604
-
\??\c:\3xrxxfr.exec:\3xrxxfr.exe150⤵PID:372
-
\??\c:\lfxfxfl.exec:\lfxfxfl.exe151⤵PID:2420
-
\??\c:\bnhhnn.exec:\bnhhnn.exe152⤵PID:1820
-
\??\c:\dpjdj.exec:\dpjdj.exe153⤵PID:1680
-
\??\c:\ppvdd.exec:\ppvdd.exe154⤵PID:1872
-
\??\c:\7lflrrf.exec:\7lflrrf.exe155⤵PID:1520
-
\??\c:\xrllrrx.exec:\xrllrrx.exe156⤵PID:2404
-
\??\c:\5htbnt.exec:\5htbnt.exe157⤵PID:2748
-
\??\c:\jjdvp.exec:\jjdvp.exe158⤵PID:3020
-
\??\c:\vpddp.exec:\vpddp.exe159⤵PID:1244
-
\??\c:\xxxxlfx.exec:\xxxxlfx.exe160⤵PID:2012
-
\??\c:\3bthhh.exec:\3bthhh.exe161⤵PID:2476
-
\??\c:\hhbnbb.exec:\hhbnbb.exe162⤵PID:696
-
\??\c:\3pjjv.exec:\3pjjv.exe163⤵PID:780
-
\??\c:\pjddv.exec:\pjddv.exe164⤵PID:1028
-
\??\c:\lxfrfxx.exec:\lxfrfxx.exe165⤵PID:1472
-
\??\c:\3ffrxlx.exec:\3ffrxlx.exe166⤵PID:2232
-
\??\c:\tbnbbb.exec:\tbnbbb.exe167⤵PID:1320
-
\??\c:\pjddp.exec:\pjddp.exe168⤵PID:1648
-
\??\c:\pjppv.exec:\pjppv.exe169⤵PID:1336
-
\??\c:\xrxxfrf.exec:\xrxxfrf.exe170⤵PID:1780
-
\??\c:\fxrfxlr.exec:\fxrfxlr.exe171⤵PID:1044
-
\??\c:\hbtttb.exec:\hbtttb.exe172⤵PID:1784
-
\??\c:\nhhntt.exec:\nhhntt.exe173⤵PID:656
-
\??\c:\vvvjv.exec:\vvvjv.exe174⤵PID:2036
-
\??\c:\3pjdp.exec:\3pjdp.exe175⤵PID:2128
-
\??\c:\lfrxffl.exec:\lfrxffl.exe176⤵PID:1948
-
\??\c:\5nhnbh.exec:\5nhnbh.exe177⤵PID:540
-
\??\c:\hbttbh.exec:\hbttbh.exe178⤵PID:1744
-
\??\c:\vpjjj.exec:\vpjjj.exe179⤵PID:2028
-
\??\c:\jvppd.exec:\jvppd.exe180⤵PID:2740
-
\??\c:\rlfxflx.exec:\rlfxflx.exe181⤵PID:1540
-
\??\c:\rrfxrlf.exec:\rrfxrlf.exe182⤵PID:2124
-
\??\c:\hbttbh.exec:\hbttbh.exe183⤵PID:1688
-
\??\c:\dvjpv.exec:\dvjpv.exe184⤵PID:2732
-
\??\c:\vpjpd.exec:\vpjpd.exe185⤵PID:2724
-
\??\c:\5fflrfr.exec:\5fflrfr.exe186⤵PID:2700
-
\??\c:\3xlrflr.exec:\3xlrflr.exe187⤵PID:2688
-
\??\c:\3nntbb.exec:\3nntbb.exe188⤵PID:2612
-
\??\c:\hhbhtt.exec:\hhbhtt.exe189⤵PID:2204
-
\??\c:\7dvdv.exec:\7dvdv.exe190⤵PID:2496
-
\??\c:\vpdjp.exec:\vpdjp.exe191⤵PID:2192
-
\??\c:\xrlrxrf.exec:\xrlrxrf.exe192⤵PID:2564
-
\??\c:\ffxfxfr.exec:\ffxfxfr.exe193⤵PID:2364
-
\??\c:\nhbbnt.exec:\nhbbnt.exe194⤵PID:2664
-
\??\c:\bbnnnn.exec:\bbnnnn.exe195⤵PID:1704
-
\??\c:\ppjdv.exec:\ppjdv.exe196⤵PID:2812
-
\??\c:\5vpjv.exec:\5vpjv.exe197⤵PID:2844
-
\??\c:\hththb.exec:\hththb.exe198⤵PID:2940
-
\??\c:\nnnhnb.exec:\nnnhnb.exe199⤵PID:372
-
\??\c:\jddjp.exec:\jddjp.exe200⤵PID:2380
-
\??\c:\jddvv.exec:\jddvv.exe201⤵PID:544
-
\??\c:\rllfxfl.exec:\rllfxfl.exe202⤵PID:2044
-
\??\c:\rlfrrrf.exec:\rlfrrrf.exe203⤵PID:1592
-
\??\c:\bbtnbn.exec:\bbtnbn.exe204⤵PID:2408
-
\??\c:\7nttnn.exec:\7nttnn.exe205⤵PID:1300
-
\??\c:\7ppdp.exec:\7ppdp.exe206⤵PID:2432
-
\??\c:\9dppp.exec:\9dppp.exe207⤵PID:3028
-
\??\c:\fxrffrx.exec:\fxrffrx.exe208⤵PID:1912
-
\??\c:\1lrrrxf.exec:\1lrrrxf.exe209⤵PID:2896
-
\??\c:\nhbbnn.exec:\nhbbnn.exe210⤵PID:2448
-
\??\c:\7bthnt.exec:\7bthnt.exe211⤵PID:1804
-
\??\c:\1jjdp.exec:\1jjdp.exe212⤵PID:1752
-
\??\c:\9vpjj.exec:\9vpjj.exe213⤵PID:1500
-
\??\c:\ffxrxfr.exec:\ffxrxfr.exe214⤵PID:928
-
\??\c:\rlxflxx.exec:\rlxflxx.exe215⤵PID:440
-
\??\c:\btntbb.exec:\btntbb.exe216⤵PID:2324
-
\??\c:\tnnthn.exec:\tnnthn.exe217⤵PID:1140
-
\??\c:\jdvvd.exec:\jdvvd.exe218⤵PID:1960
-
\??\c:\jdvdj.exec:\jdvdj.exe219⤵PID:604
-
\??\c:\ddvjd.exec:\ddvjd.exe220⤵PID:1316
-
\??\c:\lxlrrrr.exec:\lxlrrrr.exe221⤵PID:2212
-
\??\c:\fxxlrxl.exec:\fxxlrxl.exe222⤵PID:304
-
\??\c:\ttnnbt.exec:\ttnnbt.exe223⤵PID:1784
-
\??\c:\hbnnbh.exec:\hbnnbh.exe224⤵PID:1532
-
\??\c:\9jjjd.exec:\9jjjd.exe225⤵PID:2304
-
\??\c:\pjddj.exec:\pjddj.exe226⤵PID:2864
-
\??\c:\xffrfxr.exec:\xffrfxr.exe227⤵PID:3044
-
\??\c:\rrlxrfl.exec:\rrlxrfl.exe228⤵PID:1984
-
\??\c:\9hbhnn.exec:\9hbhnn.exe229⤵PID:1932
-
\??\c:\hhtthh.exec:\hhtthh.exe230⤵PID:2260
-
\??\c:\1jjvp.exec:\1jjvp.exe231⤵PID:1600
-
\??\c:\jppvv.exec:\jppvv.exe232⤵PID:1720
-
\??\c:\fxlrxfl.exec:\fxlrxfl.exe233⤵PID:2596
-
\??\c:\7hbbtb.exec:\7hbbtb.exe234⤵PID:2716
-
\??\c:\7tnnhn.exec:\7tnnhn.exe235⤵PID:2268
-
\??\c:\vppvv.exec:\vppvv.exe236⤵PID:2620
-
\??\c:\dvpdp.exec:\dvpdp.exe237⤵PID:2696
-
\??\c:\xrxxllr.exec:\xrxxllr.exe238⤵PID:2736
-
\??\c:\fllxlrl.exec:\fllxlrl.exe239⤵PID:2624
-
\??\c:\1nbhnb.exec:\1nbhnb.exe240⤵PID:2608
-
\??\c:\5hbtbn.exec:\5hbtbn.exe241⤵PID:2536
-
\??\c:\1pjjj.exec:\1pjjj.exe242⤵PID:2184