Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 10:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ed389828d584d8b00ac04e71ff9efc40_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
ed389828d584d8b00ac04e71ff9efc40_NeikiAnalytics.exe
-
Size
60KB
-
MD5
ed389828d584d8b00ac04e71ff9efc40
-
SHA1
a898114cef5b207db06ac2f88834077a9c0d2f99
-
SHA256
b906f67e16be1b9008eacf806273c816b7cf1747aefd742c9bdf086dd04b6e53
-
SHA512
d5ef4d28cff7d3eec46ff08671c8f8ab6d99ba8bb2039be646a5aa88e613fe4a0b0496da865796d15d32e054b7bdd6f77bec6eb625fa62045dd2c055582e048f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk9UWy:ymb3NkkiQ3mdBjFIvlqP
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral1/memory/1936-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2936-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1936-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-44-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2556-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2472-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2904-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2340-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1848-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1508-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1536-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1260-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2304-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1888-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/668-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/692-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/296-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vpdpv.exexxrxlfl.exe5pdvd.exeddvdj.exelfrxllx.exehthnbh.exeddppj.exevdjdp.exe7rxfxll.exebtnhtb.exe9dpvj.exe5jvjj.exe9lxxflx.exebtthtt.exetnhthn.exejdvjv.exerrlxfrx.exennnbtb.exe7bnntb.exevpdpp.exerrrfxfr.exe1fflllr.exennhbnb.exevvvvp.exejdvjp.exe7xxfrxr.exerflxfxf.exenhtthh.exepjdpd.exerlfflrx.exelfxfrxf.exetnhtnn.exevvpdj.exefxrxffr.exe9hntnn.exe3bnttb.exeddpvj.exevppdv.exeffxrlxl.exerxllxrx.exenhbhbh.exehnhbnh.exejddpv.exe7dddp.exerllfrrf.exelflxlrx.exebbtbtb.exehbbhhn.exedpjpd.exe7llrlxr.exerlxrfrx.exetnhthh.exehbhhtb.exedvppd.exedvppv.exexlfrfxl.exebhntnb.exebtttnn.exenhhtnn.exevpddp.exerxflrxl.exelfxxfrx.exehbttnn.exe5bttbh.exepid process 1936 vpdpv.exe 2652 xxrxlfl.exe 2556 5pdvd.exe 2716 ddvdj.exe 2472 lfrxllx.exe 2448 hthnbh.exe 2524 ddppj.exe 2904 vdjdp.exe 2684 7rxfxll.exe 2772 btnhtb.exe 2340 9dpvj.exe 1848 5jvjj.exe 1508 9lxxflx.exe 1536 btthtt.exe 236 tnhthn.exe 2188 jdvjv.exe 1260 rrlxfrx.exe 2304 nnnbtb.exe 1888 7bnntb.exe 1872 vpdpp.exe 668 rrrfxfr.exe 632 1fflllr.exe 692 nnhbnb.exe 2420 vvvvp.exe 2984 jdvjp.exe 1652 7xxfrxr.exe 656 rflxfxf.exe 2008 nhtthh.exe 1928 pjdpd.exe 296 rlfflrx.exe 1416 lfxfrxf.exe 1664 tnhtnn.exe 1520 vvpdj.exe 2968 fxrxffr.exe 2656 9hntnn.exe 2644 3bnttb.exe 2992 ddpvj.exe 2484 vppdv.exe 2720 ffxrlxl.exe 2620 rxllxrx.exe 2468 nhbhbh.exe 2452 hnhbnh.exe 1996 jddpv.exe 1704 7dddp.exe 2536 rllfrrf.exe 2684 lflxlrx.exe 3008 bbtbtb.exe 1860 hbbhhn.exe 2068 dpjpd.exe 1848 7llrlxr.exe 2120 rlxrfrx.exe 2412 tnhthh.exe 1580 hbhhtb.exe 824 dvppd.exe 1200 dvppv.exe 2292 xlfrfxl.exe 2400 bhntnb.exe 2256 btttnn.exe 380 nhhtnn.exe 580 vpddp.exe 1392 rxflrxl.exe 2308 lfxxfrx.exe 692 hbttnn.exe 2996 5bttbh.exe -
Processes:
resource yara_rule behavioral1/memory/2936-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1936-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1936-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1936-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1936-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1848-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1508-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1536-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1260-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1888-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/668-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/692-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/296-291-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ed389828d584d8b00ac04e71ff9efc40_NeikiAnalytics.exevpdpv.exexxrxlfl.exe5pdvd.exeddvdj.exelfrxllx.exehthnbh.exeddppj.exevdjdp.exe7rxfxll.exebtnhtb.exe9dpvj.exe5jvjj.exe9lxxflx.exebtthtt.exetnhthn.exedescription pid process target process PID 2936 wrote to memory of 1936 2936 ed389828d584d8b00ac04e71ff9efc40_NeikiAnalytics.exe vpdpv.exe PID 2936 wrote to memory of 1936 2936 ed389828d584d8b00ac04e71ff9efc40_NeikiAnalytics.exe vpdpv.exe PID 2936 wrote to memory of 1936 2936 ed389828d584d8b00ac04e71ff9efc40_NeikiAnalytics.exe vpdpv.exe PID 2936 wrote to memory of 1936 2936 ed389828d584d8b00ac04e71ff9efc40_NeikiAnalytics.exe vpdpv.exe PID 1936 wrote to memory of 2652 1936 vpdpv.exe xxrxlfl.exe PID 1936 wrote to memory of 2652 1936 vpdpv.exe xxrxlfl.exe PID 1936 wrote to memory of 2652 1936 vpdpv.exe xxrxlfl.exe PID 1936 wrote to memory of 2652 1936 vpdpv.exe xxrxlfl.exe PID 2652 wrote to memory of 2556 2652 xxrxlfl.exe 5pdvd.exe PID 2652 wrote to memory of 2556 2652 xxrxlfl.exe 5pdvd.exe PID 2652 wrote to memory of 2556 2652 xxrxlfl.exe 5pdvd.exe PID 2652 wrote to memory of 2556 2652 xxrxlfl.exe 5pdvd.exe PID 2556 wrote to memory of 2716 2556 5pdvd.exe ddvdj.exe PID 2556 wrote to memory of 2716 2556 5pdvd.exe ddvdj.exe PID 2556 wrote to memory of 2716 2556 5pdvd.exe ddvdj.exe PID 2556 wrote to memory of 2716 2556 5pdvd.exe ddvdj.exe PID 2716 wrote to memory of 2472 2716 ddvdj.exe lfrxllx.exe PID 2716 wrote to memory of 2472 2716 ddvdj.exe lfrxllx.exe PID 2716 wrote to memory of 2472 2716 ddvdj.exe lfrxllx.exe PID 2716 wrote to memory of 2472 2716 ddvdj.exe lfrxllx.exe PID 2472 wrote to memory of 2448 2472 lfrxllx.exe hthnbh.exe PID 2472 wrote to memory of 2448 2472 lfrxllx.exe hthnbh.exe PID 2472 wrote to memory of 2448 2472 lfrxllx.exe hthnbh.exe PID 2472 wrote to memory of 2448 2472 lfrxllx.exe hthnbh.exe PID 2448 wrote to memory of 2524 2448 hthnbh.exe ddppj.exe PID 2448 wrote to memory of 2524 2448 hthnbh.exe ddppj.exe PID 2448 wrote to memory of 2524 2448 hthnbh.exe ddppj.exe PID 2448 wrote to memory of 2524 2448 hthnbh.exe ddppj.exe PID 2524 wrote to memory of 2904 2524 ddppj.exe vdjdp.exe PID 2524 wrote to memory of 2904 2524 ddppj.exe vdjdp.exe PID 2524 wrote to memory of 2904 2524 ddppj.exe vdjdp.exe PID 2524 wrote to memory of 2904 2524 ddppj.exe vdjdp.exe PID 2904 wrote to memory of 2684 2904 vdjdp.exe 7rxfxll.exe PID 2904 wrote to memory of 2684 2904 vdjdp.exe 7rxfxll.exe PID 2904 wrote to memory of 2684 2904 vdjdp.exe 7rxfxll.exe PID 2904 wrote to memory of 2684 2904 vdjdp.exe 7rxfxll.exe PID 2684 wrote to memory of 2772 2684 7rxfxll.exe btnhtb.exe PID 2684 wrote to memory of 2772 2684 7rxfxll.exe btnhtb.exe PID 2684 wrote to memory of 2772 2684 7rxfxll.exe btnhtb.exe PID 2684 wrote to memory of 2772 2684 7rxfxll.exe btnhtb.exe PID 2772 wrote to memory of 2340 2772 btnhtb.exe 9dpvj.exe PID 2772 wrote to memory of 2340 2772 btnhtb.exe 9dpvj.exe PID 2772 wrote to memory of 2340 2772 btnhtb.exe 9dpvj.exe PID 2772 wrote to memory of 2340 2772 btnhtb.exe 9dpvj.exe PID 2340 wrote to memory of 1848 2340 9dpvj.exe 5jvjj.exe PID 2340 wrote to memory of 1848 2340 9dpvj.exe 5jvjj.exe PID 2340 wrote to memory of 1848 2340 9dpvj.exe 5jvjj.exe PID 2340 wrote to memory of 1848 2340 9dpvj.exe 5jvjj.exe PID 1848 wrote to memory of 1508 1848 5jvjj.exe 9lxxflx.exe PID 1848 wrote to memory of 1508 1848 5jvjj.exe 9lxxflx.exe PID 1848 wrote to memory of 1508 1848 5jvjj.exe 9lxxflx.exe PID 1848 wrote to memory of 1508 1848 5jvjj.exe 9lxxflx.exe PID 1508 wrote to memory of 1536 1508 9lxxflx.exe btthtt.exe PID 1508 wrote to memory of 1536 1508 9lxxflx.exe btthtt.exe PID 1508 wrote to memory of 1536 1508 9lxxflx.exe btthtt.exe PID 1508 wrote to memory of 1536 1508 9lxxflx.exe btthtt.exe PID 1536 wrote to memory of 236 1536 btthtt.exe tnhthn.exe PID 1536 wrote to memory of 236 1536 btthtt.exe tnhthn.exe PID 1536 wrote to memory of 236 1536 btthtt.exe tnhthn.exe PID 1536 wrote to memory of 236 1536 btthtt.exe tnhthn.exe PID 236 wrote to memory of 2188 236 tnhthn.exe jdvjv.exe PID 236 wrote to memory of 2188 236 tnhthn.exe jdvjv.exe PID 236 wrote to memory of 2188 236 tnhthn.exe jdvjv.exe PID 236 wrote to memory of 2188 236 tnhthn.exe jdvjv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed389828d584d8b00ac04e71ff9efc40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ed389828d584d8b00ac04e71ff9efc40_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\vpdpv.exec:\vpdpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\xxrxlfl.exec:\xxrxlfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\5pdvd.exec:\5pdvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\ddvdj.exec:\ddvdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\lfrxllx.exec:\lfrxllx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\hthnbh.exec:\hthnbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\ddppj.exec:\ddppj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\vdjdp.exec:\vdjdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\7rxfxll.exec:\7rxfxll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\btnhtb.exec:\btnhtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\9dpvj.exec:\9dpvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\5jvjj.exec:\5jvjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\9lxxflx.exec:\9lxxflx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\btthtt.exec:\btthtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\tnhthn.exec:\tnhthn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:236 -
\??\c:\jdvjv.exec:\jdvjv.exe17⤵
- Executes dropped EXE
PID:2188 -
\??\c:\rrlxfrx.exec:\rrlxfrx.exe18⤵
- Executes dropped EXE
PID:1260 -
\??\c:\nnnbtb.exec:\nnnbtb.exe19⤵
- Executes dropped EXE
PID:2304 -
\??\c:\7bnntb.exec:\7bnntb.exe20⤵
- Executes dropped EXE
PID:1888 -
\??\c:\vpdpp.exec:\vpdpp.exe21⤵
- Executes dropped EXE
PID:1872 -
\??\c:\rrrfxfr.exec:\rrrfxfr.exe22⤵
- Executes dropped EXE
PID:668 -
\??\c:\1fflllr.exec:\1fflllr.exe23⤵
- Executes dropped EXE
PID:632 -
\??\c:\nnhbnb.exec:\nnhbnb.exe24⤵
- Executes dropped EXE
PID:692 -
\??\c:\vvvvp.exec:\vvvvp.exe25⤵
- Executes dropped EXE
PID:2420 -
\??\c:\jdvjp.exec:\jdvjp.exe26⤵
- Executes dropped EXE
PID:2984 -
\??\c:\7xxfrxr.exec:\7xxfrxr.exe27⤵
- Executes dropped EXE
PID:1652 -
\??\c:\rflxfxf.exec:\rflxfxf.exe28⤵
- Executes dropped EXE
PID:656 -
\??\c:\nhtthh.exec:\nhtthh.exe29⤵
- Executes dropped EXE
PID:2008 -
\??\c:\pjdpd.exec:\pjdpd.exe30⤵
- Executes dropped EXE
PID:1928 -
\??\c:\rlfflrx.exec:\rlfflrx.exe31⤵
- Executes dropped EXE
PID:296 -
\??\c:\lfxfrxf.exec:\lfxfrxf.exe32⤵
- Executes dropped EXE
PID:1416 -
\??\c:\tnhtnn.exec:\tnhtnn.exe33⤵
- Executes dropped EXE
PID:1664 -
\??\c:\vvpdj.exec:\vvpdj.exe34⤵
- Executes dropped EXE
PID:1520 -
\??\c:\fxrxffr.exec:\fxrxffr.exe35⤵
- Executes dropped EXE
PID:2968 -
\??\c:\9hntnn.exec:\9hntnn.exe36⤵
- Executes dropped EXE
PID:2656 -
\??\c:\3bnttb.exec:\3bnttb.exe37⤵
- Executes dropped EXE
PID:2644 -
\??\c:\ddpvj.exec:\ddpvj.exe38⤵
- Executes dropped EXE
PID:2992 -
\??\c:\vppdv.exec:\vppdv.exe39⤵
- Executes dropped EXE
PID:2484 -
\??\c:\ffxrlxl.exec:\ffxrlxl.exe40⤵
- Executes dropped EXE
PID:2720 -
\??\c:\rxllxrx.exec:\rxllxrx.exe41⤵
- Executes dropped EXE
PID:2620 -
\??\c:\nhbhbh.exec:\nhbhbh.exe42⤵
- Executes dropped EXE
PID:2468 -
\??\c:\hnhbnh.exec:\hnhbnh.exe43⤵
- Executes dropped EXE
PID:2452 -
\??\c:\jddpv.exec:\jddpv.exe44⤵
- Executes dropped EXE
PID:1996 -
\??\c:\7dddp.exec:\7dddp.exe45⤵
- Executes dropped EXE
PID:1704 -
\??\c:\rllfrrf.exec:\rllfrrf.exe46⤵
- Executes dropped EXE
PID:2536 -
\??\c:\lflxlrx.exec:\lflxlrx.exe47⤵
- Executes dropped EXE
PID:2684 -
\??\c:\bbtbtb.exec:\bbtbtb.exe48⤵
- Executes dropped EXE
PID:3008 -
\??\c:\hbbhhn.exec:\hbbhhn.exe49⤵
- Executes dropped EXE
PID:1860 -
\??\c:\dpjpd.exec:\dpjpd.exe50⤵
- Executes dropped EXE
PID:2068 -
\??\c:\7llrlxr.exec:\7llrlxr.exe51⤵
- Executes dropped EXE
PID:1848 -
\??\c:\rlxrfrx.exec:\rlxrfrx.exe52⤵
- Executes dropped EXE
PID:2120 -
\??\c:\tnhthh.exec:\tnhthh.exe53⤵
- Executes dropped EXE
PID:2412 -
\??\c:\hbhhtb.exec:\hbhhtb.exe54⤵
- Executes dropped EXE
PID:1580 -
\??\c:\dvppd.exec:\dvppd.exe55⤵
- Executes dropped EXE
PID:824 -
\??\c:\dvppv.exec:\dvppv.exe56⤵
- Executes dropped EXE
PID:1200 -
\??\c:\xlfrfxl.exec:\xlfrfxl.exe57⤵
- Executes dropped EXE
PID:2292 -
\??\c:\bhntnb.exec:\bhntnb.exe58⤵
- Executes dropped EXE
PID:2400 -
\??\c:\btttnn.exec:\btttnn.exe59⤵
- Executes dropped EXE
PID:2256 -
\??\c:\nhhtnn.exec:\nhhtnn.exe60⤵
- Executes dropped EXE
PID:380 -
\??\c:\vpddp.exec:\vpddp.exe61⤵
- Executes dropped EXE
PID:580 -
\??\c:\rxflrxl.exec:\rxflrxl.exe62⤵
- Executes dropped EXE
PID:1392 -
\??\c:\lfxxfrx.exec:\lfxxfrx.exe63⤵
- Executes dropped EXE
PID:2308 -
\??\c:\hbttnn.exec:\hbttnn.exe64⤵
- Executes dropped EXE
PID:692 -
\??\c:\5bttbh.exec:\5bttbh.exe65⤵
- Executes dropped EXE
PID:2996 -
\??\c:\vpddp.exec:\vpddp.exe66⤵PID:3044
-
\??\c:\vvjpj.exec:\vvjpj.exe67⤵PID:848
-
\??\c:\ffrxffl.exec:\ffrxffl.exe68⤵PID:656
-
\??\c:\rlxfxfx.exec:\rlxfxfx.exe69⤵PID:1636
-
\??\c:\1tnthh.exec:\1tnthh.exe70⤵PID:1676
-
\??\c:\bthhbb.exec:\bthhbb.exe71⤵PID:3060
-
\??\c:\3pppv.exec:\3pppv.exe72⤵PID:348
-
\??\c:\vvvjd.exec:\vvvjd.exe73⤵PID:2364
-
\??\c:\fxlrrrx.exec:\fxlrrrx.exe74⤵PID:1416
-
\??\c:\fxlrxfr.exec:\fxlrxfr.exe75⤵PID:2628
-
\??\c:\hthntn.exec:\hthntn.exe76⤵PID:2560
-
\??\c:\bbtntt.exec:\bbtntt.exe77⤵PID:2648
-
\??\c:\dpdvj.exec:\dpdvj.exe78⤵PID:2604
-
\??\c:\vvddv.exec:\vvddv.exe79⤵PID:2284
-
\??\c:\xrlrfff.exec:\xrlrfff.exe80⤵PID:2140
-
\??\c:\rrfllrx.exec:\rrfllrx.exe81⤵PID:2476
-
\??\c:\btthnt.exec:\btthnt.exe82⤵PID:2176
-
\??\c:\hhhnnh.exec:\hhhnnh.exe83⤵PID:2564
-
\??\c:\dvpvj.exec:\dvpvj.exe84⤵PID:2572
-
\??\c:\ppdjv.exec:\ppdjv.exe85⤵PID:2164
-
\??\c:\fxrrfrx.exec:\fxrrfrx.exe86⤵PID:1768
-
\??\c:\rlxrflr.exec:\rlxrflr.exe87⤵PID:2680
-
\??\c:\btbbht.exec:\btbbht.exe88⤵PID:2692
-
\??\c:\nbthbb.exec:\nbthbb.exe89⤵PID:1424
-
\??\c:\pjvjv.exec:\pjvjv.exe90⤵PID:2780
-
\??\c:\pjvjv.exec:\pjvjv.exe91⤵PID:1348
-
\??\c:\3rrxxfr.exec:\3rrxxfr.exe92⤵PID:2172
-
\??\c:\lfllxxf.exec:\lfllxxf.exe93⤵PID:624
-
\??\c:\btbnbb.exec:\btbnbb.exe94⤵PID:2124
-
\??\c:\hbnnhn.exec:\hbnnhn.exe95⤵PID:1140
-
\??\c:\9vvjd.exec:\9vvjd.exe96⤵PID:1196
-
\??\c:\3dddd.exec:\3dddd.exe97⤵PID:1136
-
\??\c:\xrlrflx.exec:\xrlrflx.exe98⤵PID:2328
-
\??\c:\7xrxxfr.exec:\7xrxxfr.exe99⤵PID:2324
-
\??\c:\nhbhnn.exec:\nhbhnn.exe100⤵PID:2240
-
\??\c:\bntbhh.exec:\bntbhh.exe101⤵PID:828
-
\??\c:\vpdjd.exec:\vpdjd.exe102⤵PID:2408
-
\??\c:\lflrllx.exec:\lflrllx.exe103⤵PID:668
-
\??\c:\rlxlxxf.exec:\rlxlxxf.exe104⤵PID:580
-
\??\c:\xxrrxfl.exec:\xxrrxfl.exe105⤵PID:1744
-
\??\c:\9ttnht.exec:\9ttnht.exe106⤵PID:2024
-
\??\c:\vpddj.exec:\vpddj.exe107⤵PID:1096
-
\??\c:\jdpjd.exec:\jdpjd.exe108⤵PID:2996
-
\??\c:\xrxxxff.exec:\xrxxxff.exe109⤵PID:1652
-
\??\c:\1rrrxfr.exec:\1rrrxfr.exe110⤵PID:1804
-
\??\c:\nnhbht.exec:\nnhbht.exe111⤵PID:2136
-
\??\c:\nhthtt.exec:\nhthtt.exe112⤵PID:2008
-
\??\c:\dvjpd.exec:\dvjpd.exe113⤵PID:2200
-
\??\c:\vpjjp.exec:\vpjjp.exe114⤵PID:2028
-
\??\c:\xrrxlrx.exec:\xrrxlrx.exe115⤵PID:2180
-
\??\c:\7rrrffx.exec:\7rrrffx.exe116⤵PID:2804
-
\??\c:\bbbntb.exec:\bbbntb.exe117⤵PID:1664
-
\??\c:\hbnthh.exec:\hbnthh.exe118⤵PID:1520
-
\??\c:\7vpvj.exec:\7vpvj.exe119⤵PID:2968
-
\??\c:\fxrllrx.exec:\fxrllrx.exe120⤵PID:2652
-
\??\c:\xrflxfl.exec:\xrflxfl.exe121⤵PID:2644
-
\??\c:\tbhbbt.exec:\tbhbbt.exe122⤵PID:2992
-
\??\c:\vdjvd.exec:\vdjvd.exe123⤵PID:2484
-
\??\c:\dpjvj.exec:\dpjvj.exe124⤵PID:2460
-
\??\c:\5jdjv.exec:\5jdjv.exe125⤵PID:2620
-
\??\c:\frlxrxf.exec:\frlxrxf.exe126⤵PID:2492
-
\??\c:\lxlrllr.exec:\lxlrllr.exe127⤵PID:2452
-
\??\c:\tnhbtt.exec:\tnhbtt.exe128⤵PID:2436
-
\??\c:\tbhtnh.exec:\tbhtnh.exe129⤵PID:2384
-
\??\c:\dvpjp.exec:\dvpjp.exe130⤵PID:2916
-
\??\c:\xrlrllr.exec:\xrlrllr.exe131⤵PID:2684
-
\??\c:\rrlfflf.exec:\rrlfflf.exe132⤵PID:1784
-
\??\c:\tnhtht.exec:\tnhtht.exe133⤵PID:1860
-
\??\c:\9bbnbn.exec:\9bbnbn.exe134⤵PID:2068
-
\??\c:\jdppj.exec:\jdppj.exe135⤵PID:1848
-
\??\c:\1jdvj.exec:\1jdvj.exe136⤵PID:2424
-
\??\c:\fxrxlrf.exec:\fxrxlrf.exe137⤵PID:2412
-
\??\c:\llxflrx.exec:\llxflrx.exe138⤵PID:1208
-
\??\c:\7nnhhh.exec:\7nnhhh.exe139⤵PID:2212
-
\??\c:\htbthh.exec:\htbthh.exe140⤵PID:2220
-
\??\c:\ddjpv.exec:\ddjpv.exe141⤵PID:2292
-
\??\c:\jdjjd.exec:\jdjjd.exe142⤵PID:1988
-
\??\c:\rlxxffr.exec:\rlxxffr.exe143⤵PID:2256
-
\??\c:\lflxllx.exec:\lflxllx.exe144⤵PID:1044
-
\??\c:\bthtbh.exec:\bthtbh.exe145⤵PID:1396
-
\??\c:\3hhnht.exec:\3hhnht.exe146⤵PID:2280
-
\??\c:\pjpvj.exec:\pjpvj.exe147⤵PID:2308
-
\??\c:\vddvj.exec:\vddvj.exe148⤵PID:1932
-
\??\c:\lflrffr.exec:\lflrffr.exe149⤵PID:3048
-
\??\c:\llxxrrf.exec:\llxxrrf.exe150⤵PID:3044
-
\??\c:\tnbbnt.exec:\tnbbnt.exe151⤵PID:848
-
\??\c:\hhbhbh.exec:\hhbhbh.exe152⤵PID:656
-
\??\c:\1dvdp.exec:\1dvdp.exe153⤵PID:1636
-
\??\c:\5vpjj.exec:\5vpjj.exe154⤵PID:1676
-
\??\c:\fxflxxr.exec:\fxflxxr.exe155⤵PID:3060
-
\??\c:\ffxlffr.exec:\ffxlffr.exe156⤵PID:2104
-
\??\c:\hbhnhn.exec:\hbhnhn.exe157⤵PID:2364
-
\??\c:\7nhhbh.exec:\7nhhbh.exe158⤵PID:2848
-
\??\c:\vvdvv.exec:\vvdvv.exe159⤵PID:1524
-
\??\c:\pjvvp.exec:\pjvvp.exe160⤵PID:2072
-
\??\c:\jvjjp.exec:\jvjjp.exe161⤵PID:2820
-
\??\c:\lxlrxxl.exec:\lxlrxxl.exe162⤵PID:2652
-
\??\c:\nhtbnt.exec:\nhtbnt.exe163⤵PID:2568
-
\??\c:\hbnnhh.exec:\hbnnhh.exe164⤵PID:2760
-
\??\c:\3ttthn.exec:\3ttthn.exe165⤵PID:2624
-
\??\c:\vppvv.exec:\vppvv.exe166⤵PID:2504
-
\??\c:\xrlxlxl.exec:\xrlxlxl.exe167⤵PID:2948
-
\??\c:\rlfrxxf.exec:\rlfrxxf.exe168⤵PID:2228
-
\??\c:\ffrfxlx.exec:\ffrfxlx.exe169⤵PID:1836
-
\??\c:\bbthbh.exec:\bbthbh.exe170⤵PID:2748
-
\??\c:\tbnttb.exec:\tbnttb.exe171⤵PID:2436
-
\??\c:\1vddv.exec:\1vddv.exe172⤵PID:2912
-
\??\c:\pppvj.exec:\pppvj.exe173⤵PID:1600
-
\??\c:\rfxxllx.exec:\rfxxllx.exe174⤵PID:3008
-
\??\c:\xrlffff.exec:\xrlffff.exe175⤵PID:1348
-
\??\c:\hbtbhb.exec:\hbtbhb.exe176⤵PID:1792
-
\??\c:\9hbnhh.exec:\9hbnhh.exe177⤵PID:2320
-
\??\c:\5jvvv.exec:\5jvvv.exe178⤵PID:2348
-
\??\c:\pppdj.exec:\pppdj.exe179⤵PID:2508
-
\??\c:\rrfllff.exec:\rrfllff.exe180⤵PID:1204
-
\??\c:\xxlrrxf.exec:\xxlrrxf.exe181⤵PID:2288
-
\??\c:\5nttbb.exec:\5nttbb.exe182⤵PID:2544
-
\??\c:\9httbb.exec:\9httbb.exe183⤵PID:2304
-
\??\c:\3pvdp.exec:\3pvdp.exe184⤵PID:2332
-
\??\c:\pjddd.exec:\pjddd.exe185⤵PID:764
-
\??\c:\flfflfl.exec:\flfflfl.exe186⤵PID:320
-
\??\c:\rlxfxfl.exec:\rlxfxfl.exe187⤵PID:668
-
\??\c:\bbthbh.exec:\bbthbh.exe188⤵PID:284
-
\??\c:\nnntnt.exec:\nnntnt.exe189⤵PID:2964
-
\??\c:\7ddjv.exec:\7ddjv.exe190⤵PID:2024
-
\??\c:\jjdjv.exec:\jjdjv.exe191⤵PID:1096
-
\??\c:\fxrxxxf.exec:\fxrxxxf.exe192⤵PID:1108
-
\??\c:\xfllxlr.exec:\xfllxlr.exe193⤵PID:1976
-
\??\c:\nbbhnt.exec:\nbbhnt.exe194⤵PID:1804
-
\??\c:\ttthbn.exec:\ttthbn.exe195⤵PID:2116
-
\??\c:\jjvdp.exec:\jjvdp.exe196⤵PID:1644
-
\??\c:\7frrllx.exec:\7frrllx.exe197⤵PID:2028
-
\??\c:\lxflllr.exec:\lxflllr.exe198⤵PID:1496
-
\??\c:\tththn.exec:\tththn.exe199⤵PID:2380
-
\??\c:\3nhhbb.exec:\3nhhbb.exe200⤵PID:3028
-
\??\c:\pjvvj.exec:\pjvvj.exe201⤵PID:2640
-
\??\c:\5jddv.exec:\5jddv.exe202⤵PID:2072
-
\??\c:\3llfxxf.exec:\3llfxxf.exe203⤵PID:2456
-
\??\c:\tnbbnt.exec:\tnbbnt.exe204⤵PID:2712
-
\??\c:\hhtthh.exec:\hhtthh.exe205⤵PID:2724
-
\??\c:\dvjpd.exec:\dvjpd.exe206⤵PID:2588
-
\??\c:\jdjpd.exec:\jdjpd.exe207⤵PID:1528
-
\??\c:\lrxrffl.exec:\lrxrffl.exe208⤵PID:2444
-
\??\c:\rlxlflr.exec:\rlxlflr.exe209⤵PID:2020
-
\??\c:\tnnbbn.exec:\tnnbbn.exe210⤵PID:2676
-
\??\c:\nhhttb.exec:\nhhttb.exe211⤵PID:1340
-
\??\c:\1jjjv.exec:\1jjjv.exe212⤵PID:2776
-
\??\c:\ddpdv.exec:\ddpdv.exe213⤵PID:2692
-
\??\c:\fxrrffl.exec:\fxrrffl.exe214⤵PID:2536
-
\??\c:\5rlrflr.exec:\5rlrflr.exe215⤵PID:1596
-
\??\c:\bhbnnn.exec:\bhbnnn.exe216⤵PID:2780
-
\??\c:\tttnbb.exec:\tttnbb.exe217⤵PID:376
-
\??\c:\jvddp.exec:\jvddp.exe218⤵PID:1408
-
\??\c:\ddvdp.exec:\ddvdp.exe219⤵PID:1244
-
\??\c:\xfrrffr.exec:\xfrrffr.exe220⤵PID:2348
-
\??\c:\lxxfllr.exec:\lxxfllr.exe221⤵PID:1248
-
\??\c:\bthnhh.exec:\bthnhh.exe222⤵PID:1680
-
\??\c:\nhthbh.exec:\nhthbh.exe223⤵PID:1668
-
\??\c:\9vpjv.exec:\9vpjv.exe224⤵PID:2260
-
\??\c:\rrrfrxr.exec:\rrrfrxr.exe225⤵PID:2400
-
\??\c:\lfxflrf.exec:\lfxflrf.exe226⤵PID:2432
-
\??\c:\1bthtb.exec:\1bthtb.exe227⤵PID:1564
-
\??\c:\hthhnh.exec:\hthhnh.exe228⤵PID:2832
-
\??\c:\vjpdj.exec:\vjpdj.exe229⤵PID:1732
-
\??\c:\jdpvj.exec:\jdpvj.exe230⤵PID:1112
-
\??\c:\rllrxlr.exec:\rllrxlr.exe231⤵PID:2056
-
\??\c:\7lflrrx.exec:\7lflrrx.exe232⤵PID:2024
-
\??\c:\bnntnn.exec:\bnntnn.exe233⤵PID:2108
-
\??\c:\hbthbb.exec:\hbthbb.exe234⤵PID:2112
-
\??\c:\pjdjp.exec:\pjdjp.exe235⤵PID:1832
-
\??\c:\jdpdp.exec:\jdpdp.exe236⤵PID:2136
-
\??\c:\5frxllr.exec:\5frxllr.exe237⤵PID:2208
-
\??\c:\rlxlxrf.exec:\rlxlxrf.exe238⤵PID:880
-
\??\c:\tnnbtb.exec:\tnnbtb.exe239⤵PID:2372
-
\??\c:\bhtnhn.exec:\bhtnhn.exe240⤵PID:1512
-
\??\c:\ddpdv.exec:\ddpdv.exe241⤵PID:2848
-
\??\c:\vjdjp.exec:\vjdjp.exe242⤵PID:2580