Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 03:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5eef8191e12bcea07d3af23002803010_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
5eef8191e12bcea07d3af23002803010_NeikiAnalytics.exe
-
Size
56KB
-
MD5
5eef8191e12bcea07d3af23002803010
-
SHA1
9b0756d39b9fb400f971a5ca17488197cdb5b81c
-
SHA256
d6f093f86d3408033cfad63d4ee610b773ed0db4d3c2cc278fa451d1554bcb80
-
SHA512
c9a5c3edb2d1c116029bfa6635d00e45d255e038a0d49fda311e7eae215526daf557d8fc02f8cf4291d173ba747e6d9f5f08bd0a6aa35e954e37abfbf33dea8e
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0chVnEz:ymb3NkkiQ3mdBjF0crEz
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/2936-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2868-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2280-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2288-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1988-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1912-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2020-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2160-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/320-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2984-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1404-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2396-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ffxlflx.exehnbtht.exe7jdjd.exe7djpd.exe3hbhnt.exetntbtb.exe7pvdj.exevvpdp.exefffxflr.exebtbhbn.exe7tnbtb.exepdpdp.exerlrflxl.exe1rfrrrr.exe3bhhhh.exedvpvj.exe5lxrxfl.exerrlfxxr.exebbbnhb.exebbtbtt.exevppjp.exexlxlxlx.exethhhtb.exebtnttb.exe9ppdj.exejpdjj.exeflflxfl.exettnnhb.exe9vppv.exevpppd.exellffrrl.exerxrxllx.exehhbhnh.exehnttbt.exevjjvd.exeffxrrrf.exerlrrffr.exenthbbh.exe1ppdp.exepjvdd.exe9rlrxfl.exeffrfrfr.exebntbhn.exe1tbhhh.exevjjjd.exevpjjp.exefxllrfl.exellxlxfr.exe7bbbhn.exevpjjp.exe5jdvd.exe1rxlfrx.exettnbth.exevppvv.exe1fxxllf.exenbhnbb.exehbtbnt.exeppdpj.exejjddv.exexrllrfr.exexxxlfrx.exe3nbntn.exevvvjj.exedjdvp.exepid process 2792 ffxlflx.exe 2868 hnbtht.exe 2524 7jdjd.exe 2644 7djpd.exe 2280 3hbhnt.exe 2684 tntbtb.exe 2692 7pvdj.exe 2464 vvpdp.exe 2484 fffxflr.exe 2288 btbhbn.exe 1988 7tnbtb.exe 1912 pdpdp.exe 2020 rlrflxl.exe 1648 1rfrrrr.exe 2160 3bhhhh.exe 2180 dvpvj.exe 320 5lxrxfl.exe 2984 rrlfxxr.exe 1404 bbbnhb.exe 2388 bbtbtt.exe 2880 vppjp.exe 668 xlxlxlx.exe 2532 thhhtb.exe 1296 btnttb.exe 2396 9ppdj.exe 2220 jpdjj.exe 1656 flflxfl.exe 2088 ttnnhb.exe 3024 9vppv.exe 1016 vpppd.exe 2104 llffrrl.exe 2512 rxrxllx.exe 2156 hhbhnh.exe 1584 hnttbt.exe 2168 vjjvd.exe 2868 ffxrrrf.exe 2796 rlrrffr.exe 2440 nthbbh.exe 2564 1ppdp.exe 2280 pjvdd.exe 768 9rlrxfl.exe 2544 ffrfrfr.exe 2604 bntbhn.exe 2480 1tbhhh.exe 2484 vjjjd.exe 952 vpjjp.exe 2320 fxllrfl.exe 1932 llxlxfr.exe 944 7bbbhn.exe 2344 vpjjp.exe 1712 5jdvd.exe 808 1rxlfrx.exe 2492 ttnbth.exe 1664 vppvv.exe 2764 1fxxllf.exe 2728 nbhnbb.exe 2084 hbtbnt.exe 2096 ppdpj.exe 268 jjddv.exe 656 xrllrfr.exe 640 xxxlfrx.exe 560 3nbntn.exe 1496 vvvjj.exe 2340 djdvp.exe -
Processes:
resource yara_rule behavioral1/memory/2936-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1988-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1912-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2160-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/320-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1404-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-271-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5eef8191e12bcea07d3af23002803010_NeikiAnalytics.exeffxlflx.exehnbtht.exe7jdjd.exe7djpd.exe3hbhnt.exetntbtb.exe7pvdj.exevvpdp.exefffxflr.exebtbhbn.exe7tnbtb.exepdpdp.exerlrflxl.exe1rfrrrr.exe3bhhhh.exedescription pid process target process PID 2936 wrote to memory of 2792 2936 5eef8191e12bcea07d3af23002803010_NeikiAnalytics.exe ffxlflx.exe PID 2936 wrote to memory of 2792 2936 5eef8191e12bcea07d3af23002803010_NeikiAnalytics.exe ffxlflx.exe PID 2936 wrote to memory of 2792 2936 5eef8191e12bcea07d3af23002803010_NeikiAnalytics.exe ffxlflx.exe PID 2936 wrote to memory of 2792 2936 5eef8191e12bcea07d3af23002803010_NeikiAnalytics.exe ffxlflx.exe PID 2792 wrote to memory of 2868 2792 ffxlflx.exe hnbtht.exe PID 2792 wrote to memory of 2868 2792 ffxlflx.exe hnbtht.exe PID 2792 wrote to memory of 2868 2792 ffxlflx.exe hnbtht.exe PID 2792 wrote to memory of 2868 2792 ffxlflx.exe hnbtht.exe PID 2868 wrote to memory of 2524 2868 hnbtht.exe 7jdjd.exe PID 2868 wrote to memory of 2524 2868 hnbtht.exe 7jdjd.exe PID 2868 wrote to memory of 2524 2868 hnbtht.exe 7jdjd.exe PID 2868 wrote to memory of 2524 2868 hnbtht.exe 7jdjd.exe PID 2524 wrote to memory of 2644 2524 7jdjd.exe 7djpd.exe PID 2524 wrote to memory of 2644 2524 7jdjd.exe 7djpd.exe PID 2524 wrote to memory of 2644 2524 7jdjd.exe 7djpd.exe PID 2524 wrote to memory of 2644 2524 7jdjd.exe 7djpd.exe PID 2644 wrote to memory of 2280 2644 7djpd.exe 3hbhnt.exe PID 2644 wrote to memory of 2280 2644 7djpd.exe 3hbhnt.exe PID 2644 wrote to memory of 2280 2644 7djpd.exe 3hbhnt.exe PID 2644 wrote to memory of 2280 2644 7djpd.exe 3hbhnt.exe PID 2280 wrote to memory of 2684 2280 3hbhnt.exe tntbtb.exe PID 2280 wrote to memory of 2684 2280 3hbhnt.exe tntbtb.exe PID 2280 wrote to memory of 2684 2280 3hbhnt.exe tntbtb.exe PID 2280 wrote to memory of 2684 2280 3hbhnt.exe tntbtb.exe PID 2684 wrote to memory of 2692 2684 tntbtb.exe 7pvdj.exe PID 2684 wrote to memory of 2692 2684 tntbtb.exe 7pvdj.exe PID 2684 wrote to memory of 2692 2684 tntbtb.exe 7pvdj.exe PID 2684 wrote to memory of 2692 2684 tntbtb.exe 7pvdj.exe PID 2692 wrote to memory of 2464 2692 7pvdj.exe vvpdp.exe PID 2692 wrote to memory of 2464 2692 7pvdj.exe vvpdp.exe PID 2692 wrote to memory of 2464 2692 7pvdj.exe vvpdp.exe PID 2692 wrote to memory of 2464 2692 7pvdj.exe vvpdp.exe PID 2464 wrote to memory of 2484 2464 vvpdp.exe fffxflr.exe PID 2464 wrote to memory of 2484 2464 vvpdp.exe fffxflr.exe PID 2464 wrote to memory of 2484 2464 vvpdp.exe fffxflr.exe PID 2464 wrote to memory of 2484 2464 vvpdp.exe fffxflr.exe PID 2484 wrote to memory of 2288 2484 fffxflr.exe btbhbn.exe PID 2484 wrote to memory of 2288 2484 fffxflr.exe btbhbn.exe PID 2484 wrote to memory of 2288 2484 fffxflr.exe btbhbn.exe PID 2484 wrote to memory of 2288 2484 fffxflr.exe btbhbn.exe PID 2288 wrote to memory of 1988 2288 btbhbn.exe 7tnbtb.exe PID 2288 wrote to memory of 1988 2288 btbhbn.exe 7tnbtb.exe PID 2288 wrote to memory of 1988 2288 btbhbn.exe 7tnbtb.exe PID 2288 wrote to memory of 1988 2288 btbhbn.exe 7tnbtb.exe PID 1988 wrote to memory of 1912 1988 7tnbtb.exe pdpdp.exe PID 1988 wrote to memory of 1912 1988 7tnbtb.exe pdpdp.exe PID 1988 wrote to memory of 1912 1988 7tnbtb.exe pdpdp.exe PID 1988 wrote to memory of 1912 1988 7tnbtb.exe pdpdp.exe PID 1912 wrote to memory of 2020 1912 pdpdp.exe rlrflxl.exe PID 1912 wrote to memory of 2020 1912 pdpdp.exe rlrflxl.exe PID 1912 wrote to memory of 2020 1912 pdpdp.exe rlrflxl.exe PID 1912 wrote to memory of 2020 1912 pdpdp.exe rlrflxl.exe PID 2020 wrote to memory of 1648 2020 rlrflxl.exe 1rfrrrr.exe PID 2020 wrote to memory of 1648 2020 rlrflxl.exe 1rfrrrr.exe PID 2020 wrote to memory of 1648 2020 rlrflxl.exe 1rfrrrr.exe PID 2020 wrote to memory of 1648 2020 rlrflxl.exe 1rfrrrr.exe PID 1648 wrote to memory of 2160 1648 1rfrrrr.exe 3bhhhh.exe PID 1648 wrote to memory of 2160 1648 1rfrrrr.exe 3bhhhh.exe PID 1648 wrote to memory of 2160 1648 1rfrrrr.exe 3bhhhh.exe PID 1648 wrote to memory of 2160 1648 1rfrrrr.exe 3bhhhh.exe PID 2160 wrote to memory of 2180 2160 3bhhhh.exe dvpvj.exe PID 2160 wrote to memory of 2180 2160 3bhhhh.exe dvpvj.exe PID 2160 wrote to memory of 2180 2160 3bhhhh.exe dvpvj.exe PID 2160 wrote to memory of 2180 2160 3bhhhh.exe dvpvj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5eef8191e12bcea07d3af23002803010_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5eef8191e12bcea07d3af23002803010_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\ffxlflx.exec:\ffxlflx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\hnbtht.exec:\hnbtht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\7jdjd.exec:\7jdjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\7djpd.exec:\7djpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\3hbhnt.exec:\3hbhnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\tntbtb.exec:\tntbtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\7pvdj.exec:\7pvdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\vvpdp.exec:\vvpdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\fffxflr.exec:\fffxflr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\btbhbn.exec:\btbhbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\7tnbtb.exec:\7tnbtb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\pdpdp.exec:\pdpdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\rlrflxl.exec:\rlrflxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\1rfrrrr.exec:\1rfrrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\3bhhhh.exec:\3bhhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\dvpvj.exec:\dvpvj.exe17⤵
- Executes dropped EXE
PID:2180 -
\??\c:\5lxrxfl.exec:\5lxrxfl.exe18⤵
- Executes dropped EXE
PID:320 -
\??\c:\rrlfxxr.exec:\rrlfxxr.exe19⤵
- Executes dropped EXE
PID:2984 -
\??\c:\bbbnhb.exec:\bbbnhb.exe20⤵
- Executes dropped EXE
PID:1404 -
\??\c:\bbtbtt.exec:\bbtbtt.exe21⤵
- Executes dropped EXE
PID:2388 -
\??\c:\vppjp.exec:\vppjp.exe22⤵
- Executes dropped EXE
PID:2880 -
\??\c:\xlxlxlx.exec:\xlxlxlx.exe23⤵
- Executes dropped EXE
PID:668 -
\??\c:\thhhtb.exec:\thhhtb.exe24⤵
- Executes dropped EXE
PID:2532 -
\??\c:\btnttb.exec:\btnttb.exe25⤵
- Executes dropped EXE
PID:1296 -
\??\c:\9ppdj.exec:\9ppdj.exe26⤵
- Executes dropped EXE
PID:2396 -
\??\c:\jpdjj.exec:\jpdjj.exe27⤵
- Executes dropped EXE
PID:2220 -
\??\c:\flflxfl.exec:\flflxfl.exe28⤵
- Executes dropped EXE
PID:1656 -
\??\c:\ttnnhb.exec:\ttnnhb.exe29⤵
- Executes dropped EXE
PID:2088 -
\??\c:\9vppv.exec:\9vppv.exe30⤵
- Executes dropped EXE
PID:3024 -
\??\c:\vpppd.exec:\vpppd.exe31⤵
- Executes dropped EXE
PID:1016 -
\??\c:\llffrrl.exec:\llffrrl.exe32⤵
- Executes dropped EXE
PID:2104 -
\??\c:\rxrxllx.exec:\rxrxllx.exe33⤵
- Executes dropped EXE
PID:2512 -
\??\c:\hhbhnh.exec:\hhbhnh.exe34⤵
- Executes dropped EXE
PID:2156 -
\??\c:\hnttbt.exec:\hnttbt.exe35⤵
- Executes dropped EXE
PID:1584 -
\??\c:\vjjvd.exec:\vjjvd.exe36⤵
- Executes dropped EXE
PID:2168 -
\??\c:\ffxrrrf.exec:\ffxrrrf.exe37⤵
- Executes dropped EXE
PID:2868 -
\??\c:\rlrrffr.exec:\rlrrffr.exe38⤵
- Executes dropped EXE
PID:2796 -
\??\c:\nthbbh.exec:\nthbbh.exe39⤵
- Executes dropped EXE
PID:2440 -
\??\c:\1ppdp.exec:\1ppdp.exe40⤵
- Executes dropped EXE
PID:2564 -
\??\c:\pjvdd.exec:\pjvdd.exe41⤵
- Executes dropped EXE
PID:2280 -
\??\c:\9rlrxfl.exec:\9rlrxfl.exe42⤵
- Executes dropped EXE
PID:768 -
\??\c:\ffrfrfr.exec:\ffrfrfr.exe43⤵
- Executes dropped EXE
PID:2544 -
\??\c:\bntbhn.exec:\bntbhn.exe44⤵
- Executes dropped EXE
PID:2604 -
\??\c:\1tbhhh.exec:\1tbhhh.exe45⤵
- Executes dropped EXE
PID:2480 -
\??\c:\vjjjd.exec:\vjjjd.exe46⤵
- Executes dropped EXE
PID:2484 -
\??\c:\vpjjp.exec:\vpjjp.exe47⤵
- Executes dropped EXE
PID:952 -
\??\c:\fxllrfl.exec:\fxllrfl.exe48⤵
- Executes dropped EXE
PID:2320 -
\??\c:\llxlxfr.exec:\llxlxfr.exe49⤵
- Executes dropped EXE
PID:1932 -
\??\c:\7bbbhn.exec:\7bbbhn.exe50⤵
- Executes dropped EXE
PID:944 -
\??\c:\vpjjp.exec:\vpjjp.exe51⤵
- Executes dropped EXE
PID:2344 -
\??\c:\5jdvd.exec:\5jdvd.exe52⤵
- Executes dropped EXE
PID:1712 -
\??\c:\1rxlfrx.exec:\1rxlfrx.exe53⤵
- Executes dropped EXE
PID:808 -
\??\c:\ttnbth.exec:\ttnbth.exe54⤵
- Executes dropped EXE
PID:2492 -
\??\c:\vppvv.exec:\vppvv.exe55⤵
- Executes dropped EXE
PID:1664 -
\??\c:\1fxxllf.exec:\1fxxllf.exe56⤵
- Executes dropped EXE
PID:2764 -
\??\c:\nbhnbb.exec:\nbhnbb.exe57⤵
- Executes dropped EXE
PID:2728 -
\??\c:\hbtbnt.exec:\hbtbnt.exe58⤵
- Executes dropped EXE
PID:2084 -
\??\c:\ppdpj.exec:\ppdpj.exe59⤵
- Executes dropped EXE
PID:2096 -
\??\c:\jjddv.exec:\jjddv.exe60⤵
- Executes dropped EXE
PID:268 -
\??\c:\xrllrfr.exec:\xrllrfr.exe61⤵
- Executes dropped EXE
PID:656 -
\??\c:\xxxlfrx.exec:\xxxlfrx.exe62⤵
- Executes dropped EXE
PID:640 -
\??\c:\3nbntn.exec:\3nbntn.exe63⤵
- Executes dropped EXE
PID:560 -
\??\c:\vvvjj.exec:\vvvjj.exe64⤵
- Executes dropped EXE
PID:1496 -
\??\c:\djdvp.exec:\djdvp.exe65⤵
- Executes dropped EXE
PID:2340 -
\??\c:\7lflxrf.exec:\7lflxrf.exe66⤵PID:1816
-
\??\c:\9xrflrf.exec:\9xrflrf.exe67⤵PID:2416
-
\??\c:\hbnnbh.exec:\hbnnbh.exe68⤵PID:1656
-
\??\c:\nbhttb.exec:\nbhttb.exe69⤵PID:3008
-
\??\c:\dvjdj.exec:\dvjdj.exe70⤵PID:2996
-
\??\c:\dpjdd.exec:\dpjdd.exe71⤵PID:2072
-
\??\c:\rrrlffl.exec:\rrrlffl.exe72⤵PID:2172
-
\??\c:\xrfrrrx.exec:\xrfrrrx.exe73⤵PID:3064
-
\??\c:\nhntbt.exec:\nhntbt.exe74⤵PID:1716
-
\??\c:\dpddj.exec:\dpddj.exe75⤵PID:2948
-
\??\c:\7dvdp.exec:\7dvdp.exe76⤵PID:2156
-
\??\c:\dppvj.exec:\dppvj.exe77⤵PID:1584
-
\??\c:\lfxflrf.exec:\lfxflrf.exe78⤵PID:2632
-
\??\c:\7thnbt.exec:\7thnbt.exe79⤵PID:2868
-
\??\c:\nnhttb.exec:\nnhttb.exe80⤵PID:2804
-
\??\c:\dvjpp.exec:\dvjpp.exe81⤵PID:2556
-
\??\c:\dppjp.exec:\dppjp.exe82⤵PID:2700
-
\??\c:\lxlrrff.exec:\lxlrrff.exe83⤵PID:2280
-
\??\c:\ffrfrlf.exec:\ffrfrlf.exe84⤵PID:2692
-
\??\c:\nhnthh.exec:\nhnthh.exe85⤵PID:2544
-
\??\c:\djpjp.exec:\djpjp.exe86⤵PID:3004
-
\??\c:\dpvvd.exec:\dpvvd.exe87⤵PID:2480
-
\??\c:\3frxflr.exec:\3frxflr.exe88⤵PID:1768
-
\??\c:\rllxlrl.exec:\rllxlrl.exe89⤵PID:2024
-
\??\c:\hhbnht.exec:\hhbnht.exe90⤵PID:2004
-
\??\c:\tnntbb.exec:\tnntbb.exe91⤵PID:1932
-
\??\c:\pjvdp.exec:\pjvdp.exe92⤵PID:948
-
\??\c:\9vvpv.exec:\9vvpv.exe93⤵PID:2344
-
\??\c:\lxffflr.exec:\lxffflr.exe94⤵PID:1712
-
\??\c:\lxfflfr.exec:\lxfflfr.exe95⤵PID:808
-
\??\c:\1nnbnn.exec:\1nnbnn.exe96⤵PID:2740
-
\??\c:\nhhtbt.exec:\nhhtbt.exe97⤵PID:1664
-
\??\c:\9bnntt.exec:\9bnntt.exe98⤵PID:2756
-
\??\c:\pvvpp.exec:\pvvpp.exe99⤵PID:2728
-
\??\c:\5vjpv.exec:\5vjpv.exe100⤵PID:600
-
\??\c:\xllxlrx.exec:\xllxlrx.exe101⤵PID:2096
-
\??\c:\lxrxxxf.exec:\lxrxxxf.exe102⤵PID:268
-
\??\c:\thnnhh.exec:\thnnhh.exe103⤵PID:656
-
\??\c:\tnhnhh.exec:\tnhnhh.exe104⤵PID:640
-
\??\c:\9jvvd.exec:\9jvvd.exe105⤵PID:560
-
\??\c:\3vjpp.exec:\3vjpp.exe106⤵PID:2400
-
\??\c:\9xlfrll.exec:\9xlfrll.exe107⤵PID:2340
-
\??\c:\fxxlfll.exec:\fxxlfll.exe108⤵PID:3000
-
\??\c:\nbhbnn.exec:\nbhbnn.exe109⤵PID:2416
-
\??\c:\7bntnn.exec:\7bntnn.exe110⤵PID:1656
-
\??\c:\1jdvp.exec:\1jdvp.exe111⤵PID:3008
-
\??\c:\5pjpv.exec:\5pjpv.exe112⤵PID:2980
-
\??\c:\lxlrxfr.exec:\lxlrxfr.exe113⤵PID:2072
-
\??\c:\lxlrfxf.exec:\lxlrfxf.exe114⤵PID:2712
-
\??\c:\tbtbnt.exec:\tbtbnt.exe115⤵PID:3064
-
\??\c:\tnbhhn.exec:\tnbhhn.exe116⤵PID:2848
-
\??\c:\ppjdv.exec:\ppjdv.exe117⤵PID:2384
-
\??\c:\9pjvj.exec:\9pjvj.exe118⤵PID:2572
-
\??\c:\rxxflrf.exec:\rxxflrf.exe119⤵PID:2656
-
\??\c:\9xfrxrf.exec:\9xfrxrf.exe120⤵PID:2640
-
\??\c:\7bntnb.exec:\7bntnb.exe121⤵PID:2588
-
\??\c:\1bbnht.exec:\1bbnht.exe122⤵PID:2456
-
\??\c:\jdddp.exec:\jdddp.exe123⤵PID:2676
-
\??\c:\pjvjd.exec:\pjvjd.exe124⤵PID:2432
-
\??\c:\lxrxxxr.exec:\lxrxxxr.exe125⤵PID:2508
-
\??\c:\xrlrxfl.exec:\xrlrxfl.exe126⤵PID:2888
-
\??\c:\btbbtb.exec:\btbbtb.exe127⤵PID:2900
-
\??\c:\tnbbhh.exec:\tnbbhh.exe128⤵PID:1896
-
\??\c:\7ddpp.exec:\7ddpp.exe129⤵PID:2288
-
\??\c:\dppjp.exec:\dppjp.exe130⤵PID:2008
-
\??\c:\xxlrxlr.exec:\xxlrxlr.exe131⤵PID:1204
-
\??\c:\1rfflfr.exec:\1rfflfr.exe132⤵PID:2360
-
\??\c:\nbnnnt.exec:\nbnnnt.exe133⤵PID:2212
-
\??\c:\htnbnt.exec:\htnbnt.exe134⤵PID:956
-
\??\c:\vvjdj.exec:\vvjdj.exe135⤵PID:2732
-
\??\c:\djpvp.exec:\djpvp.exe136⤵PID:2180
-
\??\c:\9rxrllx.exec:\9rxrllx.exe137⤵PID:320
-
\??\c:\lrlrrxx.exec:\lrlrrxx.exe138⤵PID:2720
-
\??\c:\ntnnhb.exec:\ntnnhb.exe139⤵PID:2052
-
\??\c:\9pjjp.exec:\9pjjp.exe140⤵PID:2056
-
\??\c:\vddjv.exec:\vddjv.exe141⤵PID:596
-
\??\c:\flrrfrl.exec:\flrrfrl.exe142⤵PID:2880
-
\??\c:\ffxlrxr.exec:\ffxlrxr.exe143⤵PID:584
-
\??\c:\nbhhnb.exec:\nbhhnb.exe144⤵PID:400
-
\??\c:\bthhth.exec:\bthhth.exe145⤵PID:1528
-
\??\c:\3vppp.exec:\3vppp.exe146⤵PID:2828
-
\??\c:\5dvvd.exec:\5dvvd.exe147⤵PID:2404
-
\??\c:\1xxxrrx.exec:\1xxxrrx.exe148⤵PID:1792
-
\??\c:\rfxfxlr.exec:\rfxfxlr.exe149⤵PID:3060
-
\??\c:\hnbhnh.exec:\hnbhnh.exe150⤵PID:2412
-
\??\c:\nhhbhb.exec:\nhhbhb.exe151⤵PID:1132
-
\??\c:\1pddv.exec:\1pddv.exe152⤵PID:3024
-
\??\c:\vpdjv.exec:\vpdjv.exe153⤵PID:2972
-
\??\c:\ffxfrxr.exec:\ffxfrxr.exe154⤵PID:2516
-
\??\c:\lrrxlxr.exec:\lrrxlxr.exe155⤵PID:2300
-
\??\c:\xxrrxlr.exec:\xxrrxlr.exe156⤵PID:2852
-
\??\c:\nhhnbb.exec:\nhhnbb.exe157⤵PID:1700
-
\??\c:\bbtbbn.exec:\bbtbbn.exe158⤵PID:1592
-
\??\c:\vpdjd.exec:\vpdjd.exe159⤵PID:2744
-
\??\c:\1jvvv.exec:\1jvvv.exe160⤵PID:2632
-
\??\c:\xrxxrxf.exec:\xrxxrxf.exe161⤵PID:2560
-
\??\c:\fxxfflf.exec:\fxxfflf.exe162⤵PID:2804
-
\??\c:\nhthtb.exec:\nhthtb.exe163⤵PID:2568
-
\??\c:\tthtbt.exec:\tthtbt.exe164⤵PID:2700
-
\??\c:\1dppd.exec:\1dppd.exe165⤵PID:2280
-
\??\c:\jvppd.exec:\jvppd.exe166⤵PID:2692
-
\??\c:\xlfxrll.exec:\xlfxrll.exe167⤵PID:2080
-
\??\c:\fxlrrxl.exec:\fxlrrxl.exe168⤵PID:1632
-
\??\c:\3bhnbb.exec:\3bhnbb.exe169⤵PID:1200
-
\??\c:\btthnt.exec:\btthnt.exe170⤵PID:1996
-
\??\c:\vjvvj.exec:\vjvvj.exe171⤵PID:1748
-
\??\c:\vpvdd.exec:\vpvdd.exe172⤵PID:2004
-
\??\c:\1frrfff.exec:\1frrfff.exe173⤵PID:2204
-
\??\c:\lxlrrll.exec:\lxlrrll.exe174⤵PID:948
-
\??\c:\hbtbbb.exec:\hbtbbb.exe175⤵PID:852
-
\??\c:\bbtbbn.exec:\bbtbbn.exe176⤵PID:1536
-
\??\c:\5pdpj.exec:\5pdpj.exe177⤵PID:2780
-
\??\c:\vpjpp.exec:\vpjpp.exe178⤵PID:1756
-
\??\c:\vpjvd.exec:\vpjvd.exe179⤵PID:2984
-
\??\c:\7rflflr.exec:\7rflflr.exe180⤵PID:2764
-
\??\c:\9rffrrr.exec:\9rffrrr.exe181⤵PID:2216
-
\??\c:\ttbnhn.exec:\ttbnhn.exe182⤵PID:1948
-
\??\c:\bttbbh.exec:\bttbbh.exe183⤵PID:536
-
\??\c:\vpvvd.exec:\vpvvd.exe184⤵PID:1804
-
\??\c:\vdpdj.exec:\vdpdj.exe185⤵PID:1236
-
\??\c:\ffxfrxx.exec:\ffxfrxx.exe186⤵PID:640
-
\??\c:\xfrrlfr.exec:\xfrrlfr.exe187⤵PID:344
-
\??\c:\3xlrxrf.exec:\3xlrxrf.exe188⤵PID:2400
-
\??\c:\1hbhtb.exec:\1hbhtb.exe189⤵PID:568
-
\??\c:\1thtbh.exec:\1thtbh.exe190⤵PID:1816
-
\??\c:\7dppp.exec:\7dppp.exe191⤵PID:1552
-
\??\c:\3jjvj.exec:\3jjvj.exe192⤵PID:1924
-
\??\c:\1rxrxfr.exec:\1rxrxfr.exe193⤵PID:2996
-
\??\c:\frxfrfx.exec:\frxfrfx.exe194⤵PID:892
-
\??\c:\bntnbb.exec:\bntnbb.exe195⤵PID:1516
-
\??\c:\nnhhtb.exec:\nnhhtb.exe196⤵PID:2712
-
\??\c:\5jpvd.exec:\5jpvd.exe197⤵PID:2512
-
\??\c:\vjvvd.exec:\vjvvd.exe198⤵PID:2848
-
\??\c:\pvddv.exec:\pvddv.exe199⤵PID:2924
-
\??\c:\lrxrrlf.exec:\lrxrrlf.exe200⤵PID:2856
-
\??\c:\xxlxfrr.exec:\xxlxfrr.exe201⤵PID:2648
-
\??\c:\hbbnbn.exec:\hbbnbn.exe202⤵PID:2640
-
\??\c:\tthbnb.exec:\tthbnb.exe203⤵PID:2588
-
\??\c:\vdpdd.exec:\vdpdd.exe204⤵PID:2760
-
\??\c:\rxfxrlr.exec:\rxfxrlr.exe205⤵PID:2704
-
\??\c:\xxrlrxr.exec:\xxrlrxr.exe206⤵PID:2600
-
\??\c:\xxfxllx.exec:\xxfxllx.exe207⤵PID:2952
-
\??\c:\7btttt.exec:\7btttt.exe208⤵PID:1192
-
\??\c:\bnbtnn.exec:\bnbtnn.exe209⤵PID:1644
-
\??\c:\vpjjp.exec:\vpjjp.exe210⤵PID:1896
-
\??\c:\pjppj.exec:\pjppj.exe211⤵PID:2288
-
\??\c:\lfxlrxl.exec:\lfxlrxl.exe212⤵PID:2008
-
\??\c:\rffflxx.exec:\rffflxx.exe213⤵PID:1204
-
\??\c:\nhbntb.exec:\nhbntb.exe214⤵PID:772
-
\??\c:\hhhnbn.exec:\hhhnbn.exe215⤵PID:2200
-
\??\c:\vjdjv.exec:\vjdjv.exe216⤵PID:2724
-
\??\c:\1dpdv.exec:\1dpdv.exe217⤵PID:2732
-
\??\c:\7xxlrxl.exec:\7xxlrxl.exe218⤵PID:2776
-
\??\c:\rrflllr.exec:\rrflllr.exe219⤵PID:320
-
\??\c:\xxllxxf.exec:\xxllxxf.exe220⤵PID:2260
-
\??\c:\xrlxxll.exec:\xrlxxll.exe221⤵PID:2052
-
\??\c:\1bhhnh.exec:\1bhhnh.exe222⤵PID:2100
-
\??\c:\ntnthn.exec:\ntnthn.exe223⤵PID:596
-
\??\c:\vdppj.exec:\vdppj.exe224⤵PID:2880
-
\??\c:\vvpjv.exec:\vvpjv.exe225⤵PID:584
-
\??\c:\pvddj.exec:\pvddj.exe226⤵PID:1020
-
\??\c:\5lflxlf.exec:\5lflxlf.exe227⤵PID:1528
-
\??\c:\lflxlxx.exec:\lflxlxx.exe228⤵PID:1964
-
\??\c:\tnbnnt.exec:\tnbnnt.exe229⤵PID:2396
-
\??\c:\bbbbhh.exec:\bbbbhh.exe230⤵PID:1104
-
\??\c:\5dppd.exec:\5dppd.exe231⤵PID:908
-
\??\c:\lfrxffr.exec:\lfrxffr.exe232⤵PID:708
-
\??\c:\xrlxxxf.exec:\xrlxxxf.exe233⤵PID:3008
-
\??\c:\tbnttn.exec:\tbnttn.exe234⤵PID:2988
-
\??\c:\7bhnnt.exec:\7bhnnt.exe235⤵PID:2620
-
\??\c:\nbtnhh.exec:\nbtnhh.exe236⤵PID:2112
-
\??\c:\pvvvv.exec:\pvvvv.exe237⤵PID:2916
-
\??\c:\5dppp.exec:\5dppp.exe238⤵PID:2872
-
\??\c:\lflrrxx.exec:\lflrrxx.exe239⤵PID:2540
-
\??\c:\7lxlflf.exec:\7lxlflf.exe240⤵PID:1592
-
\??\c:\nbnnnn.exec:\nbnnnn.exe241⤵PID:2744
-
\??\c:\thnnnn.exec:\thnnnn.exe242⤵PID:2632