Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 18:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2acf457af28a5aaf9f196d4871692910_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
2acf457af28a5aaf9f196d4871692910_NeikiAnalytics.exe
-
Size
92KB
-
MD5
2acf457af28a5aaf9f196d4871692910
-
SHA1
f3f1008ea93d1004652ef69b87a682cfb04ad578
-
SHA256
b9119989d3255cfd812bac4d259d0eeb59a1bc85cee9be2e167c38d2acbd201b
-
SHA512
28eda542f7081d2edf3feff8d4f5b3ad6a289492046ced2a397d98bc65c2d543508e542f057a331fa90e6e05693a989b8160d6c50a0eb08230e3ee36c4718b56
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxS1rj/21k:ymb3NkkiQ3mdBjFo73PYP1lri3K8Ga
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/1636-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2256-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2024-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1992-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2972-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2180-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1936-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1052-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2052-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1100-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/900-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1708-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1804-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
7hhbhh.exe3ppvj.exedvvdj.exefxlrxxl.exenbnnnn.exevjpvd.exedpvjd.exelxlrxxx.exehbnnnt.exetnnnnt.exepjdjv.exefxfflrx.exe3thhhn.exehtbhhh.exe1jjpv.exejvdjv.exe7rxxffl.exe7flrxfr.exe3tbnnn.exe9pjvj.exe3dvpv.exelfrxllr.exebnbbhh.exebnbbbh.exe1pvpv.exelxxxxfl.exefxflxrx.exetbhhbh.exennnnth.exe7jdjv.exelfrxllf.exefrffrrx.exennthnb.exevpvdv.exejdpvv.exerlrrffr.exehbhbbh.exetnhbtb.exedpddd.exedvjjd.exevpjjv.exe5rffffl.exe5lflxxf.exetbbbhn.exevpvjv.exe1ppvj.exerlxxllr.exe7rfxxxf.exe7thbnn.exenhnhhh.exe7dvdp.exedvjpd.exerlffllr.exe5flrflr.exehbnnhh.exe3tthtt.exejvjdp.exejvdjp.exexlxxffl.exerlrrxxr.exebntthh.exe5bbhnn.exevjddp.exe5dppv.exepid process 1636 7hhbhh.exe 2256 3ppvj.exe 2656 dvvdj.exe 2580 fxlrxxl.exe 2864 nbnnnn.exe 2024 vjpvd.exe 2456 dpvjd.exe 1992 lxlrxxx.exe 2972 hbnnnt.exe 2848 tnnnnt.exe 2180 pjdjv.exe 2692 fxfflrx.exe 1936 3thhhn.exe 836 htbhhh.exe 2636 1jjpv.exe 2556 jvdjv.exe 1052 7rxxffl.exe 1724 7flrxfr.exe 2052 3tbnnn.exe 1100 9pjvj.exe 1760 3dvpv.exe 788 lfrxllr.exe 576 bnbbhh.exe 1648 bnbbbh.exe 2336 1pvpv.exe 1880 lxxxxfl.exe 900 fxflxrx.exe 1708 tbhhbh.exe 1308 nnnnth.exe 2124 7jdjv.exe 1804 lfrxllf.exe 1296 frffrrx.exe 2128 nnthnb.exe 1608 vpvdv.exe 2724 jdpvv.exe 2540 rlrrffr.exe 2868 hbhbbh.exe 3044 tnhbtb.exe 2676 dpddd.exe 2620 dvjjd.exe 2628 vpjjv.exe 2508 5rffffl.exe 2452 5lflxxf.exe 1992 tbbbhn.exe 2972 vpvjv.exe 2280 1ppvj.exe 2268 rlxxllr.exe 556 7rfxxxf.exe 1540 7thbnn.exe 1400 nhnhhh.exe 2772 7dvdp.exe 2812 dvjpd.exe 2808 rlffllr.exe 2060 5flrflr.exe 1032 hbnnhh.exe 1656 3tthtt.exe 892 jvjdp.exe 2888 jvdjp.exe 2876 xlxxffl.exe 488 rlrrxxr.exe 796 bntthh.exe 584 5bbhnn.exe 2328 vjddp.exe 1092 5dppv.exe -
Processes:
resource yara_rule behavioral1/memory/1636-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1992-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2180-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1936-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1052-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1100-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/900-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1804-299-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2acf457af28a5aaf9f196d4871692910_NeikiAnalytics.exe7hhbhh.exe3ppvj.exedvvdj.exefxlrxxl.exenbnnnn.exevjpvd.exedpvjd.exelxlrxxx.exehbnnnt.exetnnnnt.exepjdjv.exefxfflrx.exe3thhhn.exehtbhhh.exe1jjpv.exedescription pid process target process PID 2976 wrote to memory of 1636 2976 2acf457af28a5aaf9f196d4871692910_NeikiAnalytics.exe 7hhbhh.exe PID 2976 wrote to memory of 1636 2976 2acf457af28a5aaf9f196d4871692910_NeikiAnalytics.exe 7hhbhh.exe PID 2976 wrote to memory of 1636 2976 2acf457af28a5aaf9f196d4871692910_NeikiAnalytics.exe 7hhbhh.exe PID 2976 wrote to memory of 1636 2976 2acf457af28a5aaf9f196d4871692910_NeikiAnalytics.exe 7hhbhh.exe PID 1636 wrote to memory of 2256 1636 7hhbhh.exe 3ppvj.exe PID 1636 wrote to memory of 2256 1636 7hhbhh.exe 3ppvj.exe PID 1636 wrote to memory of 2256 1636 7hhbhh.exe 3ppvj.exe PID 1636 wrote to memory of 2256 1636 7hhbhh.exe 3ppvj.exe PID 2256 wrote to memory of 2656 2256 3ppvj.exe dvvdj.exe PID 2256 wrote to memory of 2656 2256 3ppvj.exe dvvdj.exe PID 2256 wrote to memory of 2656 2256 3ppvj.exe dvvdj.exe PID 2256 wrote to memory of 2656 2256 3ppvj.exe dvvdj.exe PID 2656 wrote to memory of 2580 2656 dvvdj.exe fxlrxxl.exe PID 2656 wrote to memory of 2580 2656 dvvdj.exe fxlrxxl.exe PID 2656 wrote to memory of 2580 2656 dvvdj.exe fxlrxxl.exe PID 2656 wrote to memory of 2580 2656 dvvdj.exe fxlrxxl.exe PID 2580 wrote to memory of 2864 2580 fxlrxxl.exe nbnnnn.exe PID 2580 wrote to memory of 2864 2580 fxlrxxl.exe nbnnnn.exe PID 2580 wrote to memory of 2864 2580 fxlrxxl.exe nbnnnn.exe PID 2580 wrote to memory of 2864 2580 fxlrxxl.exe nbnnnn.exe PID 2864 wrote to memory of 2024 2864 nbnnnn.exe vjpvd.exe PID 2864 wrote to memory of 2024 2864 nbnnnn.exe vjpvd.exe PID 2864 wrote to memory of 2024 2864 nbnnnn.exe vjpvd.exe PID 2864 wrote to memory of 2024 2864 nbnnnn.exe vjpvd.exe PID 2024 wrote to memory of 2456 2024 vjpvd.exe dpvjd.exe PID 2024 wrote to memory of 2456 2024 vjpvd.exe dpvjd.exe PID 2024 wrote to memory of 2456 2024 vjpvd.exe dpvjd.exe PID 2024 wrote to memory of 2456 2024 vjpvd.exe dpvjd.exe PID 2456 wrote to memory of 1992 2456 dpvjd.exe lxlrxxx.exe PID 2456 wrote to memory of 1992 2456 dpvjd.exe lxlrxxx.exe PID 2456 wrote to memory of 1992 2456 dpvjd.exe lxlrxxx.exe PID 2456 wrote to memory of 1992 2456 dpvjd.exe lxlrxxx.exe PID 1992 wrote to memory of 2972 1992 lxlrxxx.exe hbnnnt.exe PID 1992 wrote to memory of 2972 1992 lxlrxxx.exe hbnnnt.exe PID 1992 wrote to memory of 2972 1992 lxlrxxx.exe hbnnnt.exe PID 1992 wrote to memory of 2972 1992 lxlrxxx.exe hbnnnt.exe PID 2972 wrote to memory of 2848 2972 hbnnnt.exe tnnnnt.exe PID 2972 wrote to memory of 2848 2972 hbnnnt.exe tnnnnt.exe PID 2972 wrote to memory of 2848 2972 hbnnnt.exe tnnnnt.exe PID 2972 wrote to memory of 2848 2972 hbnnnt.exe tnnnnt.exe PID 2848 wrote to memory of 2180 2848 tnnnnt.exe pjdjv.exe PID 2848 wrote to memory of 2180 2848 tnnnnt.exe pjdjv.exe PID 2848 wrote to memory of 2180 2848 tnnnnt.exe pjdjv.exe PID 2848 wrote to memory of 2180 2848 tnnnnt.exe pjdjv.exe PID 2180 wrote to memory of 2692 2180 pjdjv.exe fxfflrx.exe PID 2180 wrote to memory of 2692 2180 pjdjv.exe fxfflrx.exe PID 2180 wrote to memory of 2692 2180 pjdjv.exe fxfflrx.exe PID 2180 wrote to memory of 2692 2180 pjdjv.exe fxfflrx.exe PID 2692 wrote to memory of 1936 2692 fxfflrx.exe 3thhhn.exe PID 2692 wrote to memory of 1936 2692 fxfflrx.exe 3thhhn.exe PID 2692 wrote to memory of 1936 2692 fxfflrx.exe 3thhhn.exe PID 2692 wrote to memory of 1936 2692 fxfflrx.exe 3thhhn.exe PID 1936 wrote to memory of 836 1936 3thhhn.exe htbhhh.exe PID 1936 wrote to memory of 836 1936 3thhhn.exe htbhhh.exe PID 1936 wrote to memory of 836 1936 3thhhn.exe htbhhh.exe PID 1936 wrote to memory of 836 1936 3thhhn.exe htbhhh.exe PID 836 wrote to memory of 2636 836 htbhhh.exe 1jjpv.exe PID 836 wrote to memory of 2636 836 htbhhh.exe 1jjpv.exe PID 836 wrote to memory of 2636 836 htbhhh.exe 1jjpv.exe PID 836 wrote to memory of 2636 836 htbhhh.exe 1jjpv.exe PID 2636 wrote to memory of 2556 2636 1jjpv.exe jvdjv.exe PID 2636 wrote to memory of 2556 2636 1jjpv.exe jvdjv.exe PID 2636 wrote to memory of 2556 2636 1jjpv.exe jvdjv.exe PID 2636 wrote to memory of 2556 2636 1jjpv.exe jvdjv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2acf457af28a5aaf9f196d4871692910_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2acf457af28a5aaf9f196d4871692910_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\7hhbhh.exec:\7hhbhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\3ppvj.exec:\3ppvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\dvvdj.exec:\dvvdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\fxlrxxl.exec:\fxlrxxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\nbnnnn.exec:\nbnnnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\vjpvd.exec:\vjpvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\dpvjd.exec:\dpvjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\lxlrxxx.exec:\lxlrxxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\hbnnnt.exec:\hbnnnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\tnnnnt.exec:\tnnnnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\pjdjv.exec:\pjdjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\fxfflrx.exec:\fxfflrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\3thhhn.exec:\3thhhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\htbhhh.exec:\htbhhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\1jjpv.exec:\1jjpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\jvdjv.exec:\jvdjv.exe17⤵
- Executes dropped EXE
PID:2556 -
\??\c:\7rxxffl.exec:\7rxxffl.exe18⤵
- Executes dropped EXE
PID:1052 -
\??\c:\7flrxfr.exec:\7flrxfr.exe19⤵
- Executes dropped EXE
PID:1724 -
\??\c:\3tbnnn.exec:\3tbnnn.exe20⤵
- Executes dropped EXE
PID:2052 -
\??\c:\9pjvj.exec:\9pjvj.exe21⤵
- Executes dropped EXE
PID:1100 -
\??\c:\3dvpv.exec:\3dvpv.exe22⤵
- Executes dropped EXE
PID:1760 -
\??\c:\lfrxllr.exec:\lfrxllr.exe23⤵
- Executes dropped EXE
PID:788 -
\??\c:\bnbbhh.exec:\bnbbhh.exe24⤵
- Executes dropped EXE
PID:576 -
\??\c:\bnbbbh.exec:\bnbbbh.exe25⤵
- Executes dropped EXE
PID:1648 -
\??\c:\1pvpv.exec:\1pvpv.exe26⤵
- Executes dropped EXE
PID:2336 -
\??\c:\lxxxxfl.exec:\lxxxxfl.exe27⤵
- Executes dropped EXE
PID:1880 -
\??\c:\fxflxrx.exec:\fxflxrx.exe28⤵
- Executes dropped EXE
PID:900 -
\??\c:\tbhhbh.exec:\tbhhbh.exe29⤵
- Executes dropped EXE
PID:1708 -
\??\c:\nnnnth.exec:\nnnnth.exe30⤵
- Executes dropped EXE
PID:1308 -
\??\c:\7jdjv.exec:\7jdjv.exe31⤵
- Executes dropped EXE
PID:2124 -
\??\c:\lfrxllf.exec:\lfrxllf.exe32⤵
- Executes dropped EXE
PID:1804 -
\??\c:\frffrrx.exec:\frffrrx.exe33⤵
- Executes dropped EXE
PID:1296 -
\??\c:\nnthnb.exec:\nnthnb.exe34⤵
- Executes dropped EXE
PID:2128 -
\??\c:\vpvdv.exec:\vpvdv.exe35⤵
- Executes dropped EXE
PID:1608 -
\??\c:\jdpvv.exec:\jdpvv.exe36⤵
- Executes dropped EXE
PID:2724 -
\??\c:\rlrrffr.exec:\rlrrffr.exe37⤵
- Executes dropped EXE
PID:2540 -
\??\c:\hbhbbh.exec:\hbhbbh.exe38⤵
- Executes dropped EXE
PID:2868 -
\??\c:\tnhbtb.exec:\tnhbtb.exe39⤵
- Executes dropped EXE
PID:3044 -
\??\c:\dpddd.exec:\dpddd.exe40⤵
- Executes dropped EXE
PID:2676 -
\??\c:\dvjjd.exec:\dvjjd.exe41⤵
- Executes dropped EXE
PID:2620 -
\??\c:\vpjjv.exec:\vpjjv.exe42⤵
- Executes dropped EXE
PID:2628 -
\??\c:\5rffffl.exec:\5rffffl.exe43⤵
- Executes dropped EXE
PID:2508 -
\??\c:\5lflxxf.exec:\5lflxxf.exe44⤵
- Executes dropped EXE
PID:2452 -
\??\c:\tbbbhn.exec:\tbbbhn.exe45⤵
- Executes dropped EXE
PID:1992 -
\??\c:\vpvjv.exec:\vpvjv.exe46⤵
- Executes dropped EXE
PID:2972 -
\??\c:\1ppvj.exec:\1ppvj.exe47⤵
- Executes dropped EXE
PID:2280 -
\??\c:\rlxxllr.exec:\rlxxllr.exe48⤵
- Executes dropped EXE
PID:2268 -
\??\c:\7rfxxxf.exec:\7rfxxxf.exe49⤵
- Executes dropped EXE
PID:556 -
\??\c:\7thbnn.exec:\7thbnn.exe50⤵
- Executes dropped EXE
PID:1540 -
\??\c:\nhnhhh.exec:\nhnhhh.exe51⤵
- Executes dropped EXE
PID:1400 -
\??\c:\7dvdp.exec:\7dvdp.exe52⤵
- Executes dropped EXE
PID:2772 -
\??\c:\dvjpd.exec:\dvjpd.exe53⤵
- Executes dropped EXE
PID:2812 -
\??\c:\rlffllr.exec:\rlffllr.exe54⤵
- Executes dropped EXE
PID:2808 -
\??\c:\5flrflr.exec:\5flrflr.exe55⤵
- Executes dropped EXE
PID:2060 -
\??\c:\hbnnhh.exec:\hbnnhh.exe56⤵
- Executes dropped EXE
PID:1032 -
\??\c:\3tthtt.exec:\3tthtt.exe57⤵
- Executes dropped EXE
PID:1656 -
\??\c:\jvjdp.exec:\jvjdp.exe58⤵
- Executes dropped EXE
PID:892 -
\??\c:\jvdjp.exec:\jvdjp.exe59⤵
- Executes dropped EXE
PID:2888 -
\??\c:\xlxxffl.exec:\xlxxffl.exe60⤵
- Executes dropped EXE
PID:2876 -
\??\c:\rlrrxxr.exec:\rlrrxxr.exe61⤵
- Executes dropped EXE
PID:488 -
\??\c:\bntthh.exec:\bntthh.exe62⤵
- Executes dropped EXE
PID:796 -
\??\c:\5bbhnn.exec:\5bbhnn.exe63⤵
- Executes dropped EXE
PID:584 -
\??\c:\vjddp.exec:\vjddp.exe64⤵
- Executes dropped EXE
PID:2328 -
\??\c:\5dppv.exec:\5dppv.exe65⤵
- Executes dropped EXE
PID:1092 -
\??\c:\lfrrfll.exec:\lfrrfll.exe66⤵PID:1136
-
\??\c:\lfllxff.exec:\lfllxff.exe67⤵PID:908
-
\??\c:\hbtbhh.exec:\hbtbhh.exe68⤵PID:1192
-
\??\c:\bbnthb.exec:\bbnthb.exe69⤵PID:988
-
\??\c:\jdddp.exec:\jdddp.exe70⤵PID:3048
-
\??\c:\dvddj.exec:\dvddj.exe71⤵PID:1440
-
\??\c:\rlrxllr.exec:\rlrxllr.exe72⤵PID:1976
-
\??\c:\xrffflr.exec:\xrffflr.exe73⤵PID:2536
-
\??\c:\xrllxxf.exec:\xrllxxf.exe74⤵PID:3020
-
\??\c:\nhntbb.exec:\nhntbb.exe75⤵PID:2584
-
\??\c:\nhtthh.exec:\nhtthh.exe76⤵PID:2980
-
\??\c:\pjvpd.exec:\pjvpd.exe77⤵PID:2744
-
\??\c:\pjdjd.exec:\pjdjd.exe78⤵PID:2604
-
\??\c:\xrlxffr.exec:\xrlxffr.exe79⤵PID:2880
-
\??\c:\9rrrfrx.exec:\9rrrfrx.exe80⤵PID:2560
-
\??\c:\hbhtbb.exec:\hbhtbb.exe81⤵PID:2460
-
\??\c:\9bbhnn.exec:\9bbhnn.exe82⤵PID:2676
-
\??\c:\pjdvp.exec:\pjdvp.exe83⤵PID:2468
-
\??\c:\1jvdj.exec:\1jvdj.exe84⤵PID:2968
-
\??\c:\rffllrl.exec:\rffllrl.exe85⤵PID:1948
-
\??\c:\rfrxrrx.exec:\rfrxrrx.exe86⤵PID:2844
-
\??\c:\nbnnhb.exec:\nbnnhb.exe87⤵PID:2956
-
\??\c:\3nbbnn.exec:\3nbbnn.exe88⤵PID:2848
-
\??\c:\jdvjd.exec:\jdvjd.exe89⤵PID:2180
-
\??\c:\pjvvd.exec:\pjvvd.exe90⤵PID:1940
-
\??\c:\lxllllr.exec:\lxllllr.exe91⤵PID:1824
-
\??\c:\lfxflrr.exec:\lfxflrr.exe92⤵PID:2524
-
\??\c:\ttbhnn.exec:\ttbhnn.exe93⤵PID:2780
-
\??\c:\tnbhtt.exec:\tnbhtt.exe94⤵PID:2636
-
\??\c:\7bhhnn.exec:\7bhhnn.exe95⤵PID:1672
-
\??\c:\1dvdd.exec:\1dvdd.exe96⤵PID:2412
-
\??\c:\ppdjp.exec:\ppdjp.exe97⤵PID:1068
-
\??\c:\5rrrxff.exec:\5rrrxff.exe98⤵PID:1920
-
\??\c:\3lfrfll.exec:\3lfrfll.exe99⤵PID:2052
-
\??\c:\llfflrx.exec:\llfflrx.exe100⤵PID:2356
-
\??\c:\9tnntb.exec:\9tnntb.exe101⤵PID:600
-
\??\c:\tnttnn.exec:\tnttnn.exe102⤵PID:540
-
\??\c:\vpjdj.exec:\vpjdj.exe103⤵PID:1492
-
\??\c:\1djpd.exec:\1djpd.exe104⤵PID:1916
-
\??\c:\9fxlrxf.exec:\9fxlrxf.exe105⤵PID:452
-
\??\c:\lffffll.exec:\lffffll.exe106⤵PID:2336
-
\??\c:\tnnthh.exec:\tnnthh.exe107⤵PID:1044
-
\??\c:\nhttbh.exec:\nhttbh.exe108⤵PID:2152
-
\??\c:\3pjjv.exec:\3pjjv.exe109⤵PID:2244
-
\??\c:\9pvvv.exec:\9pvvv.exe110⤵PID:1220
-
\??\c:\rlffrxr.exec:\rlffrxr.exe111⤵PID:2872
-
\??\c:\rlxxlff.exec:\rlxxlff.exe112⤵PID:1956
-
\??\c:\tttbtb.exec:\tttbtb.exe113⤵PID:2000
-
\??\c:\bhhbnb.exec:\bhhbnb.exe114⤵PID:1148
-
\??\c:\jvjjj.exec:\jvjjj.exe115⤵PID:2988
-
\??\c:\9dppp.exec:\9dppp.exe116⤵PID:296
-
\??\c:\7lllrlx.exec:\7lllrlx.exe117⤵PID:1580
-
\??\c:\hbhnbt.exec:\hbhnbt.exe118⤵PID:2964
-
\??\c:\jvjdp.exec:\jvjdp.exe119⤵PID:2564
-
\??\c:\3djvj.exec:\3djvj.exe120⤵PID:2756
-
\??\c:\rrlrxlx.exec:\rrlrxlx.exe121⤵PID:2864
-
\??\c:\lxfxllf.exec:\lxfxllf.exe122⤵PID:2480
-
\??\c:\xlxfrlx.exec:\xlxfrlx.exe123⤵PID:2496
-
\??\c:\htbbhn.exec:\htbbhn.exe124⤵PID:2528
-
\??\c:\vpvpd.exec:\vpvpd.exe125⤵PID:2568
-
\??\c:\dpddj.exec:\dpddj.exe126⤵PID:1428
-
\??\c:\xrxfrff.exec:\xrxfrff.exe127⤵PID:1996
-
\??\c:\rrxlfrl.exec:\rrxlfrl.exe128⤵PID:2924
-
\??\c:\lfrxlxl.exec:\lfrxlxl.exe129⤵PID:2492
-
\??\c:\tnttbh.exec:\tnttbh.exe130⤵PID:1828
-
\??\c:\nhbhnt.exec:\nhbhnt.exe131⤵PID:2764
-
\??\c:\jvjpv.exec:\jvjpv.exe132⤵PID:1540
-
\??\c:\jjjpd.exec:\jjjpd.exe133⤵PID:1156
-
\??\c:\pdpvd.exec:\pdpvd.exe134⤵PID:1728
-
\??\c:\7lxflrr.exec:\7lxflrr.exe135⤵PID:2820
-
\??\c:\7fxlrrx.exec:\7fxlrrx.exe136⤵PID:1324
-
\??\c:\bnthnh.exec:\bnthnh.exe137⤵PID:1064
-
\??\c:\tntbnh.exec:\tntbnh.exe138⤵PID:1700
-
\??\c:\pddvd.exec:\pddvd.exe139⤵PID:2252
-
\??\c:\jjvvd.exec:\jjvvd.exe140⤵PID:2884
-
\??\c:\fxrrxxf.exec:\fxrrxxf.exe141⤵PID:324
-
\??\c:\fxffrrf.exec:\fxffrrf.exe142⤵PID:2896
-
\??\c:\thbhtb.exec:\thbhtb.exe143⤵PID:928
-
\??\c:\3nbbtt.exec:\3nbbtt.exe144⤵PID:576
-
\??\c:\9thbtt.exec:\9thbtt.exe145⤵PID:1116
-
\??\c:\5vdjp.exec:\5vdjp.exe146⤵PID:472
-
\??\c:\pdpjv.exec:\pdpjv.exe147⤵PID:644
-
\??\c:\rlflllr.exec:\rlflllr.exe148⤵PID:1332
-
\??\c:\5xrlrxl.exec:\5xrlrxl.exe149⤵PID:900
-
\??\c:\thnnnn.exec:\thnnnn.exe150⤵PID:1772
-
\??\c:\bthhtn.exec:\bthhtn.exe151⤵PID:1736
-
\??\c:\dvddv.exec:\dvddv.exe152⤵PID:2184
-
\??\c:\jjpvd.exec:\jjpvd.exe153⤵PID:2020
-
\??\c:\7lxlxxl.exec:\7lxlxxl.exe154⤵PID:2124
-
\??\c:\fxrxlrf.exec:\fxrxlrf.exe155⤵PID:2292
-
\??\c:\htbhnt.exec:\htbhnt.exe156⤵PID:2012
-
\??\c:\bbnhbb.exec:\bbnhbb.exe157⤵PID:2368
-
\??\c:\hbnbtt.exec:\hbnbtt.exe158⤵PID:1612
-
\??\c:\3jvvv.exec:\3jvvv.exe159⤵PID:2664
-
\??\c:\jjjdv.exec:\jjjdv.exe160⤵PID:2612
-
\??\c:\7rxrlll.exec:\7rxrlll.exe161⤵PID:2096
-
\??\c:\fxrlrxf.exec:\fxrlrxf.exe162⤵PID:2672
-
\??\c:\nhbthn.exec:\nhbthn.exe163⤵PID:2996
-
\??\c:\3nbbhb.exec:\3nbbhb.exe164⤵PID:2620
-
\??\c:\pjpjp.exec:\pjpjp.exe165⤵PID:2624
-
\??\c:\5dddj.exec:\5dddj.exe166⤵PID:2576
-
\??\c:\jvpvj.exec:\jvpvj.exe167⤵PID:2532
-
\??\c:\rlxxxxf.exec:\rlxxxxf.exe168⤵PID:2824
-
\??\c:\xrfflfx.exec:\xrfflfx.exe169⤵PID:2836
-
\??\c:\tnhtnb.exec:\tnhtnb.exe170⤵PID:2104
-
\??\c:\tbbtbb.exec:\tbbtbb.exe171⤵PID:2268
-
\??\c:\dvpvj.exec:\dvpvj.exe172⤵PID:556
-
\??\c:\pdvvj.exec:\pdvvj.exe173⤵PID:1448
-
\??\c:\rlrxfrf.exec:\rlrxfrf.exe174⤵PID:1932
-
\??\c:\lrxrxrr.exec:\lrxrxrr.exe175⤵PID:2788
-
\??\c:\thtbtt.exec:\thtbtt.exe176⤵PID:1036
-
\??\c:\bhntnt.exec:\bhntnt.exe177⤵PID:1844
-
\??\c:\pdddp.exec:\pdddp.exe178⤵PID:1072
-
\??\c:\jdpvj.exec:\jdpvj.exe179⤵PID:1724
-
\??\c:\rfxxlrx.exec:\rfxxlrx.exe180⤵PID:1920
-
\??\c:\lfxlxll.exec:\lfxlxll.exe181⤵PID:2376
-
\??\c:\5bntbb.exec:\5bntbb.exe182⤵PID:1100
-
\??\c:\bhhbhh.exec:\bhhbhh.exe183⤵PID:992
-
\??\c:\pjvvp.exec:\pjvvp.exe184⤵PID:1504
-
\??\c:\jjvdj.exec:\jjvdj.exe185⤵PID:1488
-
\??\c:\rlxxxrl.exec:\rlxxxrl.exe186⤵PID:1832
-
\??\c:\7xlfllx.exec:\7xlfllx.exe187⤵PID:1512
-
\??\c:\bthntb.exec:\bthntb.exe188⤵PID:640
-
\??\c:\bthtnh.exec:\bthtnh.exe189⤵PID:572
-
\??\c:\vpjvv.exec:\vpjvv.exe190⤵PID:2320
-
\??\c:\jvvpp.exec:\jvvpp.exe191⤵PID:2324
-
\??\c:\lffxlff.exec:\lffxlff.exe192⤵PID:612
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe193⤵PID:3048
-
\??\c:\hbnntn.exec:\hbnntn.exe194⤵PID:1956
-
\??\c:\nhtbbh.exec:\nhtbbh.exe195⤵PID:2192
-
\??\c:\bbnthb.exec:\bbnthb.exe196⤵PID:1148
-
\??\c:\jjdjd.exec:\jjdjd.exe197⤵PID:1296
-
\??\c:\jvdjp.exec:\jvdjp.exe198⤵PID:296
-
\??\c:\lxffrxx.exec:\lxffrxx.exe199⤵PID:2712
-
\??\c:\frffxxx.exec:\frffxxx.exe200⤵PID:2964
-
\??\c:\7thhnt.exec:\7thhnt.exe201⤵PID:3024
-
\??\c:\3bhnnt.exec:\3bhnnt.exe202⤵PID:2736
-
\??\c:\jdppp.exec:\jdppp.exe203⤵PID:2080
-
\??\c:\3pvvd.exec:\3pvvd.exe204⤵PID:2472
-
\??\c:\7rllffl.exec:\7rllffl.exe205⤵PID:2628
-
\??\c:\9lxfrxf.exec:\9lxfrxf.exe206⤵PID:2528
-
\??\c:\3lxxfff.exec:\3lxxfff.exe207⤵PID:2944
-
\??\c:\bbthnt.exec:\bbthnt.exe208⤵PID:1428
-
\??\c:\tntbnh.exec:\tntbnh.exe209⤵PID:2972
-
\??\c:\dvjvj.exec:\dvjvj.exe210⤵PID:828
-
\??\c:\1vjpj.exec:\1vjpj.exe211⤵PID:2492
-
\??\c:\xlffrrx.exec:\xlffrrx.exe212⤵PID:2752
-
\??\c:\lflrllr.exec:\lflrllr.exe213⤵PID:1928
-
\??\c:\hbnthh.exec:\hbnthh.exe214⤵PID:1944
-
\??\c:\nhtbnt.exec:\nhtbnt.exe215⤵PID:2504
-
\??\c:\pdjpd.exec:\pdjpd.exe216⤵PID:2784
-
\??\c:\3lxfxfl.exec:\3lxfxfl.exe217⤵PID:2556
-
\??\c:\hnthbh.exec:\hnthbh.exe218⤵PID:1324
-
\??\c:\hbnntb.exec:\hbnntb.exe219⤵PID:1032
-
\??\c:\jdvdj.exec:\jdvdj.exe220⤵PID:1068
-
\??\c:\vjvvv.exec:\vjvvv.exe221⤵PID:1800
-
\??\c:\ffrfllx.exec:\ffrfllx.exe222⤵PID:2800
-
\??\c:\lfrlrrx.exec:\lfrlrrx.exe223⤵PID:2892
-
\??\c:\5htbhh.exec:\5htbhh.exe224⤵PID:488
-
\??\c:\9vpjp.exec:\9vpjp.exe225⤵PID:928
-
\??\c:\pdppd.exec:\pdppd.exe226⤵PID:1688
-
\??\c:\rfxxlfr.exec:\rfxxlfr.exe227⤵PID:952
-
\??\c:\lxlxrrx.exec:\lxlxrrx.exe228⤵PID:700
-
\??\c:\9ttntt.exec:\9ttntt.exe229⤵PID:1136
-
\??\c:\htnttn.exec:\htnttn.exe230⤵PID:1332
-
\??\c:\dvjdp.exec:\dvjdp.exe231⤵PID:900
-
\??\c:\pdvdv.exec:\pdvdv.exe232⤵PID:2196
-
\??\c:\jvppd.exec:\jvppd.exe233⤵PID:1736
-
\??\c:\frlrrfr.exec:\frlrrfr.exe234⤵PID:1696
-
\??\c:\rrfxrlx.exec:\rrfxrlx.exe235⤵PID:2856
-
\??\c:\nhbbhn.exec:\nhbbhn.exe236⤵PID:2300
-
\??\c:\ttntnt.exec:\ttntnt.exe237⤵PID:2992
-
\??\c:\dvvjp.exec:\dvvjp.exe238⤵PID:2584
-
\??\c:\vpddp.exec:\vpddp.exe239⤵PID:2596
-
\??\c:\dvvvj.exec:\dvvvj.exe240⤵PID:2744
-
\??\c:\3rllllr.exec:\3rllllr.exe241⤵PID:2600
-
\??\c:\xrlxxrx.exec:\xrlxxrx.exe242⤵PID:2612