Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 04:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
78cce327146adf3d7ee8a87313d0e0e0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
78cce327146adf3d7ee8a87313d0e0e0_NeikiAnalytics.exe
-
Size
77KB
-
MD5
78cce327146adf3d7ee8a87313d0e0e0
-
SHA1
7c08b4dbc154ff47d71c44005ec8463baa555101
-
SHA256
f0a5087ea5d51ffce6ee6aa0e4e14166d9197958965d20c450a7a1f3dc9df172
-
SHA512
d754621aa7eae148b9fa96d2bd38761e5dcde8f32b037382b2563e2d55da2710519375db307abfd8cbc8b57e902d3067ddbe72c85885dac40bb631c4a33c34b8
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAX8YieVIJclPvPJtcdcI:ymb3NkkiQ3mdBjFo68YBVIJc9JtxI
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/1716-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1688-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2160-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-39-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-79-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2512-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1552-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2420-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1304-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1076-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/264-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/816-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/108-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1812-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/492-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pjvdj.exevjpjd.exelfrxffr.exe3dddj.exe1jvdj.exe5vjdj.exefxlrfxr.exenhnttt.exehbttbt.exe5xrrrlf.exe3frrrxl.exennhhtb.exepdvjj.exevjdvv.exexrfxffl.exehbttnn.exethnntn.exejdvjd.exerrfffrl.exefxrrffx.exe1tnhtt.exevvpvd.exedvjjp.exe9lxxlrx.exe5ffrxxx.exe7fxxflx.exettbtbn.exe7pvjp.exelfrlxrf.exe1hbbnn.exehthttb.exepjdpd.exedppjv.exelxrrxxf.exexrllrrf.exehbnnbh.exe1hhnhn.exedpddj.exejvjdj.exelfxxlfr.exefxllrfx.exetntbnn.exenhttbb.exeddddj.exepjdvv.exellfrxrf.exelfrxlrx.exe7nnnbh.exepjjjj.exedpvvj.exelfxxxxl.exerlfrflx.exenhhtbn.exevpvvj.exevppjj.exexxxllrr.exexlrlrrf.exeffrxffr.exehbnthn.exethbbbb.exedpdjv.exe5vpdp.exerfxrrlr.exellffllr.exepid process 1688 pjvdj.exe 2160 vjpjd.exe 2764 lfrxffr.exe 2640 3dddj.exe 2544 1jvdj.exe 2672 5vjdj.exe 2512 fxlrfxr.exe 2196 nhnttt.exe 2192 hbttbt.exe 2568 5xrrrlf.exe 2684 3frrrxl.exe 1552 nnhhtb.exe 2420 pdvjj.exe 1304 vjdvv.exe 1808 xrfxffl.exe 1076 hbttnn.exe 264 thnntn.exe 996 jdvjd.exe 2884 rrfffrl.exe 816 fxrrffx.exe 3012 1tnhtt.exe 2928 vvpvd.exe 3052 dvjjp.exe 108 9lxxlrx.exe 1804 5ffrxxx.exe 1812 7fxxflx.exe 2476 ttbtbn.exe 1632 7pvjp.exe 2912 lfrlxrf.exe 492 1hbbnn.exe 2460 hthttb.exe 1980 pjdpd.exe 1932 dppjv.exe 2612 lxrrxxf.exe 2300 xrllrrf.exe 1708 hbnnbh.exe 2920 1hhnhn.exe 2768 dpddj.exe 2640 jvjdj.exe 2536 lfxxlfr.exe 2744 fxllrfx.exe 2520 tntbnn.exe 2628 nhttbb.exe 2172 ddddj.exe 1968 pjdvv.exe 2736 llfrxrf.exe 2608 lfrxlrx.exe 2848 7nnnbh.exe 1244 pjjjj.exe 1196 dpvvj.exe 2224 lfxxxxl.exe 1940 rlfrflx.exe 2880 nhhtbn.exe 592 vpvvj.exe 824 vppjj.exe 1636 xxxllrr.exe 2412 xlrlrrf.exe 892 ffrxffr.exe 2360 hbnthn.exe 580 thbbbb.exe 2492 dpdjv.exe 1648 5vpdp.exe 1308 rfxrrlr.exe 2852 llffllr.exe -
Processes:
resource yara_rule behavioral1/memory/1716-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1688-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2160-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1552-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1304-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1076-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/264-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/816-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/108-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1812-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/492-286-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
78cce327146adf3d7ee8a87313d0e0e0_NeikiAnalytics.exepjvdj.exevjpjd.exelfrxffr.exe3dddj.exe1jvdj.exe5vjdj.exefxlrfxr.exenhnttt.exehbttbt.exe5xrrrlf.exe3frrrxl.exennhhtb.exepdvjj.exevjdvv.exexrfxffl.exedescription pid process target process PID 1716 wrote to memory of 1688 1716 78cce327146adf3d7ee8a87313d0e0e0_NeikiAnalytics.exe pjvdj.exe PID 1716 wrote to memory of 1688 1716 78cce327146adf3d7ee8a87313d0e0e0_NeikiAnalytics.exe pjvdj.exe PID 1716 wrote to memory of 1688 1716 78cce327146adf3d7ee8a87313d0e0e0_NeikiAnalytics.exe pjvdj.exe PID 1716 wrote to memory of 1688 1716 78cce327146adf3d7ee8a87313d0e0e0_NeikiAnalytics.exe pjvdj.exe PID 1688 wrote to memory of 2160 1688 pjvdj.exe vjpjd.exe PID 1688 wrote to memory of 2160 1688 pjvdj.exe vjpjd.exe PID 1688 wrote to memory of 2160 1688 pjvdj.exe vjpjd.exe PID 1688 wrote to memory of 2160 1688 pjvdj.exe vjpjd.exe PID 2160 wrote to memory of 2764 2160 vjpjd.exe lfrxffr.exe PID 2160 wrote to memory of 2764 2160 vjpjd.exe lfrxffr.exe PID 2160 wrote to memory of 2764 2160 vjpjd.exe lfrxffr.exe PID 2160 wrote to memory of 2764 2160 vjpjd.exe lfrxffr.exe PID 2764 wrote to memory of 2640 2764 lfrxffr.exe 3dddj.exe PID 2764 wrote to memory of 2640 2764 lfrxffr.exe 3dddj.exe PID 2764 wrote to memory of 2640 2764 lfrxffr.exe 3dddj.exe PID 2764 wrote to memory of 2640 2764 lfrxffr.exe 3dddj.exe PID 2640 wrote to memory of 2544 2640 3dddj.exe 1jvdj.exe PID 2640 wrote to memory of 2544 2640 3dddj.exe 1jvdj.exe PID 2640 wrote to memory of 2544 2640 3dddj.exe 1jvdj.exe PID 2640 wrote to memory of 2544 2640 3dddj.exe 1jvdj.exe PID 2544 wrote to memory of 2672 2544 1jvdj.exe 5vjdj.exe PID 2544 wrote to memory of 2672 2544 1jvdj.exe 5vjdj.exe PID 2544 wrote to memory of 2672 2544 1jvdj.exe 5vjdj.exe PID 2544 wrote to memory of 2672 2544 1jvdj.exe 5vjdj.exe PID 2672 wrote to memory of 2512 2672 5vjdj.exe fxlrfxr.exe PID 2672 wrote to memory of 2512 2672 5vjdj.exe fxlrfxr.exe PID 2672 wrote to memory of 2512 2672 5vjdj.exe fxlrfxr.exe PID 2672 wrote to memory of 2512 2672 5vjdj.exe fxlrfxr.exe PID 2512 wrote to memory of 2196 2512 fxlrfxr.exe nhnttt.exe PID 2512 wrote to memory of 2196 2512 fxlrfxr.exe nhnttt.exe PID 2512 wrote to memory of 2196 2512 fxlrfxr.exe nhnttt.exe PID 2512 wrote to memory of 2196 2512 fxlrfxr.exe nhnttt.exe PID 2196 wrote to memory of 2192 2196 nhnttt.exe hbttbt.exe PID 2196 wrote to memory of 2192 2196 nhnttt.exe hbttbt.exe PID 2196 wrote to memory of 2192 2196 nhnttt.exe hbttbt.exe PID 2196 wrote to memory of 2192 2196 nhnttt.exe hbttbt.exe PID 2192 wrote to memory of 2568 2192 hbttbt.exe 5xrrrlf.exe PID 2192 wrote to memory of 2568 2192 hbttbt.exe 5xrrrlf.exe PID 2192 wrote to memory of 2568 2192 hbttbt.exe 5xrrrlf.exe PID 2192 wrote to memory of 2568 2192 hbttbt.exe 5xrrrlf.exe PID 2568 wrote to memory of 2684 2568 5xrrrlf.exe 3frrrxl.exe PID 2568 wrote to memory of 2684 2568 5xrrrlf.exe 3frrrxl.exe PID 2568 wrote to memory of 2684 2568 5xrrrlf.exe 3frrrxl.exe PID 2568 wrote to memory of 2684 2568 5xrrrlf.exe 3frrrxl.exe PID 2684 wrote to memory of 1552 2684 3frrrxl.exe nnhhtb.exe PID 2684 wrote to memory of 1552 2684 3frrrxl.exe nnhhtb.exe PID 2684 wrote to memory of 1552 2684 3frrrxl.exe nnhhtb.exe PID 2684 wrote to memory of 1552 2684 3frrrxl.exe nnhhtb.exe PID 1552 wrote to memory of 2420 1552 nnhhtb.exe pdvjj.exe PID 1552 wrote to memory of 2420 1552 nnhhtb.exe pdvjj.exe PID 1552 wrote to memory of 2420 1552 nnhhtb.exe pdvjj.exe PID 1552 wrote to memory of 2420 1552 nnhhtb.exe pdvjj.exe PID 2420 wrote to memory of 1304 2420 pdvjj.exe vjdvv.exe PID 2420 wrote to memory of 1304 2420 pdvjj.exe vjdvv.exe PID 2420 wrote to memory of 1304 2420 pdvjj.exe vjdvv.exe PID 2420 wrote to memory of 1304 2420 pdvjj.exe vjdvv.exe PID 1304 wrote to memory of 1808 1304 vjdvv.exe xrfxffl.exe PID 1304 wrote to memory of 1808 1304 vjdvv.exe xrfxffl.exe PID 1304 wrote to memory of 1808 1304 vjdvv.exe xrfxffl.exe PID 1304 wrote to memory of 1808 1304 vjdvv.exe xrfxffl.exe PID 1808 wrote to memory of 1076 1808 xrfxffl.exe hbttnn.exe PID 1808 wrote to memory of 1076 1808 xrfxffl.exe hbttnn.exe PID 1808 wrote to memory of 1076 1808 xrfxffl.exe hbttnn.exe PID 1808 wrote to memory of 1076 1808 xrfxffl.exe hbttnn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\78cce327146adf3d7ee8a87313d0e0e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\78cce327146adf3d7ee8a87313d0e0e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\pjvdj.exec:\pjvdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\vjpjd.exec:\vjpjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\lfrxffr.exec:\lfrxffr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\3dddj.exec:\3dddj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\1jvdj.exec:\1jvdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\5vjdj.exec:\5vjdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\fxlrfxr.exec:\fxlrfxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\nhnttt.exec:\nhnttt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\hbttbt.exec:\hbttbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\5xrrrlf.exec:\5xrrrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\3frrrxl.exec:\3frrrxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\nnhhtb.exec:\nnhhtb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\pdvjj.exec:\pdvjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\vjdvv.exec:\vjdvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\xrfxffl.exec:\xrfxffl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\hbttnn.exec:\hbttnn.exe17⤵
- Executes dropped EXE
PID:1076 -
\??\c:\thnntn.exec:\thnntn.exe18⤵
- Executes dropped EXE
PID:264 -
\??\c:\jdvjd.exec:\jdvjd.exe19⤵
- Executes dropped EXE
PID:996 -
\??\c:\rrfffrl.exec:\rrfffrl.exe20⤵
- Executes dropped EXE
PID:2884 -
\??\c:\fxrrffx.exec:\fxrrffx.exe21⤵
- Executes dropped EXE
PID:816 -
\??\c:\1tnhtt.exec:\1tnhtt.exe22⤵
- Executes dropped EXE
PID:3012 -
\??\c:\vvpvd.exec:\vvpvd.exe23⤵
- Executes dropped EXE
PID:2928 -
\??\c:\dvjjp.exec:\dvjjp.exe24⤵
- Executes dropped EXE
PID:3052 -
\??\c:\9lxxlrx.exec:\9lxxlrx.exe25⤵
- Executes dropped EXE
PID:108 -
\??\c:\5ffrxxx.exec:\5ffrxxx.exe26⤵
- Executes dropped EXE
PID:1804 -
\??\c:\7fxxflx.exec:\7fxxflx.exe27⤵
- Executes dropped EXE
PID:1812 -
\??\c:\ttbtbn.exec:\ttbtbn.exe28⤵
- Executes dropped EXE
PID:2476 -
\??\c:\7pvjp.exec:\7pvjp.exe29⤵
- Executes dropped EXE
PID:1632 -
\??\c:\lfrlxrf.exec:\lfrlxrf.exe30⤵
- Executes dropped EXE
PID:2912 -
\??\c:\1hbbnn.exec:\1hbbnn.exe31⤵
- Executes dropped EXE
PID:492 -
\??\c:\hthttb.exec:\hthttb.exe32⤵
- Executes dropped EXE
PID:2460 -
\??\c:\pjdpd.exec:\pjdpd.exe33⤵
- Executes dropped EXE
PID:1980 -
\??\c:\dppjv.exec:\dppjv.exe34⤵
- Executes dropped EXE
PID:1932 -
\??\c:\lxrrxxf.exec:\lxrrxxf.exe35⤵
- Executes dropped EXE
PID:2612 -
\??\c:\xrllrrf.exec:\xrllrrf.exe36⤵
- Executes dropped EXE
PID:2300 -
\??\c:\hbnnbh.exec:\hbnnbh.exe37⤵
- Executes dropped EXE
PID:1708 -
\??\c:\1hhnhn.exec:\1hhnhn.exe38⤵
- Executes dropped EXE
PID:2920 -
\??\c:\dpddj.exec:\dpddj.exe39⤵
- Executes dropped EXE
PID:2768 -
\??\c:\jvjdj.exec:\jvjdj.exe40⤵
- Executes dropped EXE
PID:2640 -
\??\c:\lfxxlfr.exec:\lfxxlfr.exe41⤵
- Executes dropped EXE
PID:2536 -
\??\c:\fxllrfx.exec:\fxllrfx.exe42⤵
- Executes dropped EXE
PID:2744 -
\??\c:\tntbnn.exec:\tntbnn.exe43⤵
- Executes dropped EXE
PID:2520 -
\??\c:\nhttbb.exec:\nhttbb.exe44⤵
- Executes dropped EXE
PID:2628 -
\??\c:\ddddj.exec:\ddddj.exe45⤵
- Executes dropped EXE
PID:2172 -
\??\c:\pjdvv.exec:\pjdvv.exe46⤵
- Executes dropped EXE
PID:1968 -
\??\c:\llfrxrf.exec:\llfrxrf.exe47⤵
- Executes dropped EXE
PID:2736 -
\??\c:\lfrxlrx.exec:\lfrxlrx.exe48⤵
- Executes dropped EXE
PID:2608 -
\??\c:\7nnnbh.exec:\7nnnbh.exe49⤵
- Executes dropped EXE
PID:2848 -
\??\c:\pjjjj.exec:\pjjjj.exe50⤵
- Executes dropped EXE
PID:1244 -
\??\c:\dpvvj.exec:\dpvvj.exe51⤵
- Executes dropped EXE
PID:1196 -
\??\c:\lfxxxxl.exec:\lfxxxxl.exe52⤵
- Executes dropped EXE
PID:2224 -
\??\c:\rlfrflx.exec:\rlfrflx.exe53⤵
- Executes dropped EXE
PID:1940 -
\??\c:\nhhtbn.exec:\nhhtbn.exe54⤵
- Executes dropped EXE
PID:2880 -
\??\c:\vpvvj.exec:\vpvvj.exe55⤵
- Executes dropped EXE
PID:592 -
\??\c:\vppjj.exec:\vppjj.exe56⤵
- Executes dropped EXE
PID:824 -
\??\c:\xxxllrr.exec:\xxxllrr.exe57⤵
- Executes dropped EXE
PID:1636 -
\??\c:\xlrlrrf.exec:\xlrlrrf.exe58⤵
- Executes dropped EXE
PID:2412 -
\??\c:\ffrxffr.exec:\ffrxffr.exe59⤵
- Executes dropped EXE
PID:892 -
\??\c:\hbnthn.exec:\hbnthn.exe60⤵
- Executes dropped EXE
PID:2360 -
\??\c:\thbbbb.exec:\thbbbb.exe61⤵
- Executes dropped EXE
PID:580 -
\??\c:\dpdjv.exec:\dpdjv.exe62⤵
- Executes dropped EXE
PID:2492 -
\??\c:\5vpdp.exec:\5vpdp.exe63⤵
- Executes dropped EXE
PID:1648 -
\??\c:\rfxrrlr.exec:\rfxrrlr.exe64⤵
- Executes dropped EXE
PID:1308 -
\??\c:\llffllr.exec:\llffllr.exe65⤵
- Executes dropped EXE
PID:2852 -
\??\c:\htbhnn.exec:\htbhnn.exe66⤵PID:848
-
\??\c:\tnnthn.exec:\tnnthn.exe67⤵PID:440
-
\??\c:\dddpv.exec:\dddpv.exe68⤵PID:1996
-
\??\c:\jdjjp.exec:\jdjjp.exe69⤵PID:864
-
\??\c:\xrxfxfl.exec:\xrxfxfl.exe70⤵PID:2960
-
\??\c:\rlxfflx.exec:\rlxfflx.exe71⤵PID:112
-
\??\c:\7nbbhh.exec:\7nbbhh.exe72⤵PID:2036
-
\??\c:\nhnnnn.exec:\nhnnnn.exe73⤵PID:2312
-
\??\c:\vpdjv.exec:\vpdjv.exe74⤵PID:2968
-
\??\c:\jjjjd.exec:\jjjjd.exe75⤵PID:1980
-
\??\c:\5xrrlrf.exec:\5xrrlrf.exe76⤵PID:2600
-
\??\c:\3xrxffl.exec:\3xrxffl.exe77⤵PID:3060
-
\??\c:\1bnhnt.exec:\1bnhnt.exe78⤵PID:1724
-
\??\c:\1bntnn.exec:\1bntnn.exe79⤵PID:2704
-
\??\c:\vpddp.exec:\vpddp.exe80⤵PID:2908
-
\??\c:\pjvvd.exec:\pjvvd.exe81⤵PID:2516
-
\??\c:\xrxfffx.exec:\xrxfffx.exe82⤵PID:2976
-
\??\c:\xxrrxxl.exec:\xxrrxxl.exe83⤵PID:876
-
\??\c:\5hbbhb.exec:\5hbbhb.exe84⤵PID:2672
-
\??\c:\nnbhht.exec:\nnbhht.exe85⤵PID:2540
-
\??\c:\pvdvv.exec:\pvdvv.exe86⤵PID:1740
-
\??\c:\pjjjp.exec:\pjjjp.exe87⤵PID:1272
-
\??\c:\lfxfllx.exec:\lfxfllx.exe88⤵PID:288
-
\??\c:\lfffllx.exec:\lfffllx.exe89⤵PID:2568
-
\??\c:\bntnnb.exec:\bntnnb.exe90⤵PID:2792
-
\??\c:\hnhhtn.exec:\hnhhtn.exe91⤵PID:2684
-
\??\c:\hbnnbb.exec:\hbnnbb.exe92⤵PID:1800
-
\??\c:\pjddj.exec:\pjddj.exe93⤵PID:1288
-
\??\c:\ddvdp.exec:\ddvdp.exe94⤵PID:1304
-
\??\c:\xxfllff.exec:\xxfllff.exe95⤵PID:2436
-
\??\c:\frllrrx.exec:\frllrrx.exe96⤵PID:1212
-
\??\c:\bnttbh.exec:\bnttbh.exe97⤵PID:804
-
\??\c:\nhnhnn.exec:\nhnhnn.exe98⤵PID:480
-
\??\c:\nhbnnt.exec:\nhbnnt.exe99⤵PID:304
-
\??\c:\vvpvd.exec:\vvpvd.exe100⤵PID:308
-
\??\c:\jdjjj.exec:\jdjjj.exe101⤵PID:2340
-
\??\c:\1lffrxf.exec:\1lffrxf.exe102⤵PID:1792
-
\??\c:\lxxfllx.exec:\lxxfllx.exe103⤵PID:2812
-
\??\c:\tnbhhh.exec:\tnbhhh.exe104⤵PID:676
-
\??\c:\9tntnt.exec:\9tntnt.exe105⤵PID:1200
-
\??\c:\jdvpv.exec:\jdvpv.exe106⤵PID:108
-
\??\c:\5dvvd.exec:\5dvvd.exe107⤵PID:404
-
\??\c:\7pjvd.exec:\7pjvd.exe108⤵PID:1604
-
\??\c:\3rllxfl.exec:\3rllxfl.exe109⤵PID:3044
-
\??\c:\rlxfllf.exec:\rlxfllf.exe110⤵PID:924
-
\??\c:\nhhhhb.exec:\nhhhhb.exe111⤵PID:1632
-
\??\c:\bntnbb.exec:\bntnbb.exe112⤵PID:1784
-
\??\c:\7jvvv.exec:\7jvvv.exe113⤵PID:2324
-
\??\c:\1pjpp.exec:\1pjpp.exe114⤵PID:2480
-
\??\c:\7djpv.exec:\7djpv.exe115⤵PID:2312
-
\??\c:\lfxfflr.exec:\lfxfflr.exe116⤵PID:1512
-
\??\c:\xlrrrrx.exec:\xlrrrrx.exe117⤵PID:3064
-
\??\c:\frfllrx.exec:\frfllrx.exe118⤵PID:2636
-
\??\c:\htttbb.exec:\htttbb.exe119⤵PID:1592
-
\??\c:\tntbhn.exec:\tntbhn.exe120⤵PID:2772
-
\??\c:\jvvvv.exec:\jvvvv.exe121⤵PID:2648
-
\??\c:\pjjpj.exec:\pjjpj.exe122⤵PID:2904
-
\??\c:\rlffrrx.exec:\rlffrrx.exe123⤵PID:2864
-
\??\c:\fxflrrx.exec:\fxflrrx.exe124⤵PID:1156
-
\??\c:\nnnbnb.exec:\nnnbnb.exe125⤵PID:2556
-
\??\c:\1thbbh.exec:\1thbbh.exe126⤵PID:2700
-
\??\c:\3pdvv.exec:\3pdvv.exe127⤵PID:3040
-
\??\c:\vjpvd.exec:\vjpvd.exe128⤵PID:2472
-
\??\c:\xrfflrx.exec:\xrfflrx.exe129⤵PID:1264
-
\??\c:\xrlrrrx.exec:\xrlrrrx.exe130⤵PID:2496
-
\??\c:\tnhnnb.exec:\tnhnnb.exe131⤵PID:2824
-
\??\c:\tnntbh.exec:\tnntbh.exe132⤵PID:2816
-
\??\c:\dddjj.exec:\dddjj.exe133⤵PID:1552
-
\??\c:\5jjdp.exec:\5jjdp.exe134⤵PID:1820
-
\??\c:\xrffrxl.exec:\xrffrxl.exe135⤵PID:1312
-
\??\c:\xrllxfr.exec:\xrllxfr.exe136⤵PID:2404
-
\??\c:\3nhhhn.exec:\3nhhhn.exe137⤵PID:1028
-
\??\c:\9ththb.exec:\9ththb.exe138⤵PID:700
-
\??\c:\dvpvj.exec:\dvpvj.exe139⤵PID:880
-
\??\c:\3vppd.exec:\3vppd.exe140⤵PID:1816
-
\??\c:\rlfrxrr.exec:\rlfrxrr.exe141⤵PID:1224
-
\??\c:\lfrrffr.exec:\lfrrffr.exe142⤵PID:808
-
\??\c:\3rrxlrx.exec:\3rrxlrx.exe143⤵PID:2984
-
\??\c:\hbtbnt.exec:\hbtbnt.exe144⤵PID:3012
-
\??\c:\pjdjd.exec:\pjdjd.exe145⤵PID:3068
-
\??\c:\9vpvp.exec:\9vpvp.exe146⤵PID:2936
-
\??\c:\3jvpv.exec:\3jvpv.exe147⤵PID:1500
-
\??\c:\lxlrflr.exec:\lxlrflr.exe148⤵PID:2084
-
\??\c:\5ffrflx.exec:\5ffrflx.exe149⤵PID:2008
-
\??\c:\nhbbhh.exec:\nhbbhh.exe150⤵PID:2000
-
\??\c:\nbnhbb.exec:\nbnhbb.exe151⤵PID:1336
-
\??\c:\9vdpp.exec:\9vdpp.exe152⤵PID:940
-
\??\c:\dvvvj.exec:\dvvvj.exe153⤵PID:1516
-
\??\c:\9pddj.exec:\9pddj.exe154⤵PID:2228
-
\??\c:\7xfrxxl.exec:\7xfrxxl.exe155⤵PID:2056
-
\??\c:\hhntbt.exec:\hhntbt.exe156⤵PID:896
-
\??\c:\tttbbb.exec:\tttbbb.exe157⤵PID:2096
-
\??\c:\btbttt.exec:\btbttt.exe158⤵PID:2980
-
\??\c:\dvppd.exec:\dvppd.exe159⤵PID:1512
-
\??\c:\pjpdp.exec:\pjpdp.exe160⤵PID:1588
-
\??\c:\fxlllrf.exec:\fxlllrf.exe161⤵PID:2776
-
\??\c:\3rlxffr.exec:\3rlxffr.exe162⤵PID:2664
-
\??\c:\nhhntb.exec:\nhhntb.exe163⤵PID:2668
-
\??\c:\1btnnn.exec:\1btnnn.exe164⤵PID:2856
-
\??\c:\vpjpp.exec:\vpjpp.exe165⤵PID:2788
-
\??\c:\jjjdv.exec:\jjjdv.exe166⤵PID:2536
-
\??\c:\5jdjv.exec:\5jdjv.exe167⤵PID:2544
-
\??\c:\9fxrlfx.exec:\9fxrlfx.exe168⤵PID:2512
-
\??\c:\ffrxlrf.exec:\ffrxlrf.exe169⤵PID:2024
-
\??\c:\hbtnbn.exec:\hbtnbn.exe170⤵PID:1916
-
\??\c:\nhthhh.exec:\nhthhh.exe171⤵PID:2596
-
\??\c:\pjjpd.exec:\pjjpd.exe172⤵PID:2836
-
\??\c:\ppjpd.exec:\ppjpd.exe173⤵PID:1360
-
\??\c:\1dvdp.exec:\1dvdp.exe174⤵PID:2848
-
\??\c:\lfxflrx.exec:\lfxflrx.exe175⤵PID:1956
-
\??\c:\9xllfll.exec:\9xllfll.exe176⤵PID:1872
-
\??\c:\nbthnn.exec:\nbthnn.exe177⤵PID:1332
-
\??\c:\3tntht.exec:\3tntht.exe178⤵PID:1940
-
\??\c:\3jddd.exec:\3jddd.exe179⤵PID:688
-
\??\c:\1jjvp.exec:\1jjvp.exe180⤵PID:1032
-
\??\c:\rlflffr.exec:\rlflffr.exe181⤵PID:280
-
\??\c:\5lflxfx.exec:\5lflxfx.exe182⤵PID:1228
-
\??\c:\3rlfllx.exec:\3rlfllx.exe183⤵PID:2412
-
\??\c:\tnbnnt.exec:\tnbnnt.exe184⤵PID:2964
-
\??\c:\nnbnbb.exec:\nnbnbb.exe185⤵PID:2800
-
\??\c:\jvdpj.exec:\jvdpj.exe186⤵PID:2928
-
\??\c:\1vpdp.exec:\1vpdp.exe187⤵PID:2260
-
\??\c:\fxrrflx.exec:\fxrrflx.exe188⤵PID:1856
-
\??\c:\7lxxlrx.exec:\7lxxlrx.exe189⤵PID:1788
-
\??\c:\fxrxflf.exec:\fxrxflf.exe190⤵PID:2888
-
\??\c:\nhnbnn.exec:\nhnbnn.exe191⤵PID:1812
-
\??\c:\nhtntb.exec:\nhtntb.exe192⤵PID:1984
-
\??\c:\dpjjp.exec:\dpjjp.exe193⤵PID:2004
-
\??\c:\7ppvd.exec:\7ppvd.exe194⤵PID:2972
-
\??\c:\lfxxxxl.exec:\lfxxxxl.exe195⤵PID:844
-
\??\c:\llxlxfl.exec:\llxlxfl.exe196⤵PID:112
-
\??\c:\5hhntb.exec:\5hhntb.exe197⤵PID:1628
-
\??\c:\tnbbhn.exec:\tnbbhn.exe198⤵PID:1728
-
\??\c:\tnhntt.exec:\tnhntt.exe199⤵PID:2296
-
\??\c:\jvdvp.exec:\jvdvp.exe200⤵PID:1696
-
\??\c:\5dvdj.exec:\5dvdj.exe201⤵PID:2748
-
\??\c:\fxlrxfr.exec:\fxlrxfr.exe202⤵PID:2348
-
\??\c:\llxflfl.exec:\llxflfl.exe203⤵PID:2140
-
\??\c:\hbhnhn.exec:\hbhnhn.exe204⤵PID:2756
-
\??\c:\nhttbb.exec:\nhttbb.exe205⤵PID:2796
-
\??\c:\3jddj.exec:\3jddj.exe206⤵PID:2640
-
\??\c:\vpvjp.exec:\vpvjp.exe207⤵PID:2752
-
\??\c:\pjddj.exec:\pjddj.exe208⤵PID:2528
-
\??\c:\fxffllr.exec:\fxffllr.exe209⤵PID:2988
-
\??\c:\rlxxlrf.exec:\rlxxlrf.exe210⤵PID:1864
-
\??\c:\7tthtb.exec:\7tthtb.exe211⤵PID:1912
-
\??\c:\hhtnth.exec:\hhtnth.exe212⤵PID:2780
-
\??\c:\9thnnn.exec:\9thnnn.exe213⤵PID:2808
-
\??\c:\pjvdj.exec:\pjvdj.exe214⤵PID:2248
-
\??\c:\vpvdd.exec:\vpvdd.exe215⤵PID:2684
-
\??\c:\9rlrrxf.exec:\9rlrrxf.exe216⤵PID:1848
-
\??\c:\fxrxfff.exec:\fxrxfff.exe217⤵PID:2168
-
\??\c:\nhbnbh.exec:\nhbnbh.exe218⤵PID:2244
-
\??\c:\hhthtb.exec:\hhthtb.exe219⤵PID:1992
-
\??\c:\btnnnn.exec:\btnnnn.exe220⤵PID:600
-
\??\c:\ddvvj.exec:\ddvvj.exe221⤵PID:1212
-
\??\c:\7vjpv.exec:\7vjpv.exe222⤵PID:2416
-
\??\c:\rlflrrf.exec:\rlflrrf.exe223⤵PID:316
-
\??\c:\rlrrllr.exec:\rlrrllr.exe224⤵PID:1416
-
\??\c:\hbnntb.exec:\hbnntb.exe225⤵PID:1668
-
\??\c:\7vjjp.exec:\7vjjp.exe226⤵PID:2932
-
\??\c:\vvppj.exec:\vvppj.exe227⤵PID:2380
-
\??\c:\1rrxffr.exec:\1rrxffr.exe228⤵PID:3068
-
\??\c:\9rrfllx.exec:\9rrfllx.exe229⤵PID:1860
-
\??\c:\nbhntt.exec:\nbhntt.exe230⤵PID:1500
-
\??\c:\hbtbhn.exec:\hbtbhn.exe231⤵PID:2084
-
\??\c:\hbnthh.exec:\hbnthh.exe232⤵PID:2008
-
\??\c:\dvjjp.exec:\dvjjp.exe233⤵PID:1988
-
\??\c:\ddvjv.exec:\ddvjv.exe234⤵PID:568
-
\??\c:\xrfxxxf.exec:\xrfxxxf.exe235⤵PID:648
-
\??\c:\lxxflrx.exec:\lxxflrx.exe236⤵PID:2912
-
\??\c:\tnttbh.exec:\tnttbh.exe237⤵PID:2180
-
\??\c:\bthhhn.exec:\bthhhn.exe238⤵PID:2056
-
\??\c:\vjddp.exec:\vjddp.exe239⤵PID:492
-
\??\c:\5ddjp.exec:\5ddjp.exe240⤵PID:1728
-
\??\c:\lxrflrx.exec:\lxrflrx.exe241⤵PID:2296
-
\??\c:\fxllflx.exec:\fxllflx.exe242⤵PID:1688