Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 18:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2963ed62e8506848012aeca7bbb9b4b0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
2963ed62e8506848012aeca7bbb9b4b0_NeikiAnalytics.exe
-
Size
244KB
-
MD5
2963ed62e8506848012aeca7bbb9b4b0
-
SHA1
336f5346d76edbae51577b72b11386348335328d
-
SHA256
bc671f9b02fc13da178dda77874e283d4804c0380a733d4ed984c8c6a970a98c
-
SHA512
a405ff885a9ed5a27c299a787713c9156f043af57381a78eadff29f8c088ec9d78d5aca4e433eea631b9204bb256835132dad76be4e9b0eb71f3de2082a8ca62
-
SSDEEP
6144:n3C9BRo/AIX27NHWpU00VIxas1oa3YiFRX:n3C9uD6AUDCa4NYmRX
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/1232-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2144-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2240-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1032-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1256-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1396-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1444-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2280-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1896-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/636-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/992-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vpjvj.exejjpjd.exe7fflfrx.exehhbntt.exefrfxfxx.exe3hhntt.exelllxrxr.exerlfxlrx.exejjvpd.exeddjpd.exebbhbth.exepjdpd.exerxllxrr.exebbhbbb.exedpvpj.exettnbhn.exetththh.exe5vjpj.exennbbht.exebthbbn.exexrffrrf.exe7bthnn.exevppdj.exexrlxlrf.exehbhhbh.exe9pdjp.exehhbtht.exepjvdv.exe1xxlxlf.exebntttb.exerlfrlrl.exe9hnbtt.exejjppp.exellxxfxr.exetntnhn.exebtnbnt.exe1pjpj.exe9xxlxrl.exelllrxfr.exehnnbbh.exedvvvj.exedddvd.exelfxlxfl.exe7ttbhn.exebbnbht.exevdjdp.exelxrfflx.exetbtbbb.exennbntt.exejpvpp.exexxrlfrx.exexxxrrrr.exe3nnbnb.exeddppd.exeflffrrl.exefrlrxrf.exehhnthn.exebttbhn.exejdvdj.exelllxlll.exelflxxff.exehbhnbh.exe3jdjp.exe3vvdj.exepid process 2144 vpjvj.exe 2824 jjpjd.exe 2240 7fflfrx.exe 2752 hhbntt.exe 2820 frfxfxx.exe 2460 3hhntt.exe 2520 lllxrxr.exe 3000 rlfxlrx.exe 2556 jjvpd.exe 2744 ddjpd.exe 2864 bbhbth.exe 1032 pjdpd.exe 1256 rxllxrr.exe 1396 bbhbbb.exe 1444 dpvpj.exe 2576 ttnbhn.exe 772 tththh.exe 804 5vjpj.exe 2280 nnbbht.exe 1896 bthbbn.exe 2940 xrffrrf.exe 332 7bthnn.exe 1480 vppdj.exe 3016 xrlxlrf.exe 636 hbhhbh.exe 992 9pdjp.exe 1992 hhbtht.exe 2092 pjvdv.exe 2064 1xxlxlf.exe 2328 bntttb.exe 876 rlfrlrl.exe 572 9hnbtt.exe 1580 jjppp.exe 2372 llxxfxr.exe 2600 tntnhn.exe 2652 btnbnt.exe 2772 1pjpj.exe 2776 9xxlxrl.exe 2804 lllrxfr.exe 2808 hnnbbh.exe 3040 dvvvj.exe 2540 dddvd.exe 2208 lfxlxfl.exe 2200 7ttbhn.exe 3000 bbnbht.exe 1936 vdjdp.exe 2856 lxrfflx.exe 2904 tbtbbb.exe 956 nnbntt.exe 1032 jpvpp.exe 1256 xxrlfrx.exe 1628 xxxrrrr.exe 2724 3nnbnb.exe 2472 ddppd.exe 1156 flffrrl.exe 772 frlrxrf.exe 624 hhnthn.exe 2604 bttbhn.exe 2936 jdvdj.exe 2492 lllxlll.exe 776 lflxxff.exe 484 hbhnbh.exe 584 3jdjp.exe 1088 3vvdj.exe -
Processes:
resource yara_rule behavioral1/memory/1232-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1232-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2144-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1032-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1256-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1396-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1444-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1896-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/636-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/992-258-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2963ed62e8506848012aeca7bbb9b4b0_NeikiAnalytics.exevpjvj.exejjpjd.exe7fflfrx.exehhbntt.exefrfxfxx.exe3hhntt.exelllxrxr.exerlfxlrx.exejjvpd.exeddjpd.exebbhbth.exepjdpd.exerxllxrr.exebbhbbb.exedpvpj.exedescription pid process target process PID 1232 wrote to memory of 2144 1232 2963ed62e8506848012aeca7bbb9b4b0_NeikiAnalytics.exe vpjvj.exe PID 1232 wrote to memory of 2144 1232 2963ed62e8506848012aeca7bbb9b4b0_NeikiAnalytics.exe vpjvj.exe PID 1232 wrote to memory of 2144 1232 2963ed62e8506848012aeca7bbb9b4b0_NeikiAnalytics.exe vpjvj.exe PID 1232 wrote to memory of 2144 1232 2963ed62e8506848012aeca7bbb9b4b0_NeikiAnalytics.exe vpjvj.exe PID 2144 wrote to memory of 2824 2144 vpjvj.exe jjpjd.exe PID 2144 wrote to memory of 2824 2144 vpjvj.exe jjpjd.exe PID 2144 wrote to memory of 2824 2144 vpjvj.exe jjpjd.exe PID 2144 wrote to memory of 2824 2144 vpjvj.exe jjpjd.exe PID 2824 wrote to memory of 2240 2824 jjpjd.exe 7fflfrx.exe PID 2824 wrote to memory of 2240 2824 jjpjd.exe 7fflfrx.exe PID 2824 wrote to memory of 2240 2824 jjpjd.exe 7fflfrx.exe PID 2824 wrote to memory of 2240 2824 jjpjd.exe 7fflfrx.exe PID 2240 wrote to memory of 2752 2240 7fflfrx.exe hhbntt.exe PID 2240 wrote to memory of 2752 2240 7fflfrx.exe hhbntt.exe PID 2240 wrote to memory of 2752 2240 7fflfrx.exe hhbntt.exe PID 2240 wrote to memory of 2752 2240 7fflfrx.exe hhbntt.exe PID 2752 wrote to memory of 2820 2752 hhbntt.exe frfxfxx.exe PID 2752 wrote to memory of 2820 2752 hhbntt.exe frfxfxx.exe PID 2752 wrote to memory of 2820 2752 hhbntt.exe frfxfxx.exe PID 2752 wrote to memory of 2820 2752 hhbntt.exe frfxfxx.exe PID 2820 wrote to memory of 2460 2820 frfxfxx.exe 3hhntt.exe PID 2820 wrote to memory of 2460 2820 frfxfxx.exe 3hhntt.exe PID 2820 wrote to memory of 2460 2820 frfxfxx.exe 3hhntt.exe PID 2820 wrote to memory of 2460 2820 frfxfxx.exe 3hhntt.exe PID 2460 wrote to memory of 2520 2460 3hhntt.exe lllxrxr.exe PID 2460 wrote to memory of 2520 2460 3hhntt.exe lllxrxr.exe PID 2460 wrote to memory of 2520 2460 3hhntt.exe lllxrxr.exe PID 2460 wrote to memory of 2520 2460 3hhntt.exe lllxrxr.exe PID 2520 wrote to memory of 3000 2520 lllxrxr.exe rlfxlrx.exe PID 2520 wrote to memory of 3000 2520 lllxrxr.exe rlfxlrx.exe PID 2520 wrote to memory of 3000 2520 lllxrxr.exe rlfxlrx.exe PID 2520 wrote to memory of 3000 2520 lllxrxr.exe rlfxlrx.exe PID 3000 wrote to memory of 2556 3000 rlfxlrx.exe jjvpd.exe PID 3000 wrote to memory of 2556 3000 rlfxlrx.exe jjvpd.exe PID 3000 wrote to memory of 2556 3000 rlfxlrx.exe jjvpd.exe PID 3000 wrote to memory of 2556 3000 rlfxlrx.exe jjvpd.exe PID 2556 wrote to memory of 2744 2556 jjvpd.exe ddjpd.exe PID 2556 wrote to memory of 2744 2556 jjvpd.exe ddjpd.exe PID 2556 wrote to memory of 2744 2556 jjvpd.exe ddjpd.exe PID 2556 wrote to memory of 2744 2556 jjvpd.exe ddjpd.exe PID 2744 wrote to memory of 2864 2744 ddjpd.exe bbhbth.exe PID 2744 wrote to memory of 2864 2744 ddjpd.exe bbhbth.exe PID 2744 wrote to memory of 2864 2744 ddjpd.exe bbhbth.exe PID 2744 wrote to memory of 2864 2744 ddjpd.exe bbhbth.exe PID 2864 wrote to memory of 1032 2864 bbhbth.exe pjdpd.exe PID 2864 wrote to memory of 1032 2864 bbhbth.exe pjdpd.exe PID 2864 wrote to memory of 1032 2864 bbhbth.exe pjdpd.exe PID 2864 wrote to memory of 1032 2864 bbhbth.exe pjdpd.exe PID 1032 wrote to memory of 1256 1032 pjdpd.exe rxllxrr.exe PID 1032 wrote to memory of 1256 1032 pjdpd.exe rxllxrr.exe PID 1032 wrote to memory of 1256 1032 pjdpd.exe rxllxrr.exe PID 1032 wrote to memory of 1256 1032 pjdpd.exe rxllxrr.exe PID 1256 wrote to memory of 1396 1256 rxllxrr.exe bbhbbb.exe PID 1256 wrote to memory of 1396 1256 rxllxrr.exe bbhbbb.exe PID 1256 wrote to memory of 1396 1256 rxllxrr.exe bbhbbb.exe PID 1256 wrote to memory of 1396 1256 rxllxrr.exe bbhbbb.exe PID 1396 wrote to memory of 1444 1396 bbhbbb.exe dpvpj.exe PID 1396 wrote to memory of 1444 1396 bbhbbb.exe dpvpj.exe PID 1396 wrote to memory of 1444 1396 bbhbbb.exe dpvpj.exe PID 1396 wrote to memory of 1444 1396 bbhbbb.exe dpvpj.exe PID 1444 wrote to memory of 2576 1444 dpvpj.exe ttnbhn.exe PID 1444 wrote to memory of 2576 1444 dpvpj.exe ttnbhn.exe PID 1444 wrote to memory of 2576 1444 dpvpj.exe ttnbhn.exe PID 1444 wrote to memory of 2576 1444 dpvpj.exe ttnbhn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2963ed62e8506848012aeca7bbb9b4b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2963ed62e8506848012aeca7bbb9b4b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\vpjvj.exec:\vpjvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\jjpjd.exec:\jjpjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\7fflfrx.exec:\7fflfrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\hhbntt.exec:\hhbntt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\frfxfxx.exec:\frfxfxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\3hhntt.exec:\3hhntt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\lllxrxr.exec:\lllxrxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\rlfxlrx.exec:\rlfxlrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\jjvpd.exec:\jjvpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\ddjpd.exec:\ddjpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\bbhbth.exec:\bbhbth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\pjdpd.exec:\pjdpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\rxllxrr.exec:\rxllxrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\bbhbbb.exec:\bbhbbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\dpvpj.exec:\dpvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\ttnbhn.exec:\ttnbhn.exe17⤵
- Executes dropped EXE
PID:2576 -
\??\c:\tththh.exec:\tththh.exe18⤵
- Executes dropped EXE
PID:772 -
\??\c:\5vjpj.exec:\5vjpj.exe19⤵
- Executes dropped EXE
PID:804 -
\??\c:\nnbbht.exec:\nnbbht.exe20⤵
- Executes dropped EXE
PID:2280 -
\??\c:\bthbbn.exec:\bthbbn.exe21⤵
- Executes dropped EXE
PID:1896 -
\??\c:\xrffrrf.exec:\xrffrrf.exe22⤵
- Executes dropped EXE
PID:2940 -
\??\c:\7bthnn.exec:\7bthnn.exe23⤵
- Executes dropped EXE
PID:332 -
\??\c:\vppdj.exec:\vppdj.exe24⤵
- Executes dropped EXE
PID:1480 -
\??\c:\xrlxlrf.exec:\xrlxlrf.exe25⤵
- Executes dropped EXE
PID:3016 -
\??\c:\hbhhbh.exec:\hbhhbh.exe26⤵
- Executes dropped EXE
PID:636 -
\??\c:\9pdjp.exec:\9pdjp.exe27⤵
- Executes dropped EXE
PID:992 -
\??\c:\hhbtht.exec:\hhbtht.exe28⤵
- Executes dropped EXE
PID:1992 -
\??\c:\pjvdv.exec:\pjvdv.exe29⤵
- Executes dropped EXE
PID:2092 -
\??\c:\1xxlxlf.exec:\1xxlxlf.exe30⤵
- Executes dropped EXE
PID:2064 -
\??\c:\bntttb.exec:\bntttb.exe31⤵
- Executes dropped EXE
PID:2328 -
\??\c:\rlfrlrl.exec:\rlfrlrl.exe32⤵
- Executes dropped EXE
PID:876 -
\??\c:\9hnbtt.exec:\9hnbtt.exe33⤵
- Executes dropped EXE
PID:572 -
\??\c:\jjppp.exec:\jjppp.exe34⤵
- Executes dropped EXE
PID:1580 -
\??\c:\llxxfxr.exec:\llxxfxr.exe35⤵
- Executes dropped EXE
PID:2372 -
\??\c:\tntnhn.exec:\tntnhn.exe36⤵
- Executes dropped EXE
PID:2600 -
\??\c:\btnbnt.exec:\btnbnt.exe37⤵
- Executes dropped EXE
PID:2652 -
\??\c:\1pjpj.exec:\1pjpj.exe38⤵
- Executes dropped EXE
PID:2772 -
\??\c:\9xxlxrl.exec:\9xxlxrl.exe39⤵
- Executes dropped EXE
PID:2776 -
\??\c:\lllrxfr.exec:\lllrxfr.exe40⤵
- Executes dropped EXE
PID:2804 -
\??\c:\hnnbbh.exec:\hnnbbh.exe41⤵
- Executes dropped EXE
PID:2808 -
\??\c:\dvvvj.exec:\dvvvj.exe42⤵
- Executes dropped EXE
PID:3040 -
\??\c:\dddvd.exec:\dddvd.exe43⤵
- Executes dropped EXE
PID:2540 -
\??\c:\lfxlxfl.exec:\lfxlxfl.exe44⤵
- Executes dropped EXE
PID:2208 -
\??\c:\7ttbhn.exec:\7ttbhn.exe45⤵
- Executes dropped EXE
PID:2200 -
\??\c:\bbnbht.exec:\bbnbht.exe46⤵
- Executes dropped EXE
PID:3000 -
\??\c:\vdjdp.exec:\vdjdp.exe47⤵
- Executes dropped EXE
PID:1936 -
\??\c:\lxrfflx.exec:\lxrfflx.exe48⤵
- Executes dropped EXE
PID:2856 -
\??\c:\tbtbbb.exec:\tbtbbb.exe49⤵
- Executes dropped EXE
PID:2904 -
\??\c:\nnbntt.exec:\nnbntt.exe50⤵
- Executes dropped EXE
PID:956 -
\??\c:\jpvpp.exec:\jpvpp.exe51⤵
- Executes dropped EXE
PID:1032 -
\??\c:\xxrlfrx.exec:\xxrlfrx.exe52⤵
- Executes dropped EXE
PID:1256 -
\??\c:\xxxrrrr.exec:\xxxrrrr.exe53⤵
- Executes dropped EXE
PID:1628 -
\??\c:\3nnbnb.exec:\3nnbnb.exe54⤵
- Executes dropped EXE
PID:2724 -
\??\c:\ddppd.exec:\ddppd.exe55⤵
- Executes dropped EXE
PID:2472 -
\??\c:\flffrrl.exec:\flffrrl.exe56⤵
- Executes dropped EXE
PID:1156 -
\??\c:\frlrxrf.exec:\frlrxrf.exe57⤵
- Executes dropped EXE
PID:772 -
\??\c:\hhnthn.exec:\hhnthn.exe58⤵
- Executes dropped EXE
PID:624 -
\??\c:\bttbhn.exec:\bttbhn.exe59⤵
- Executes dropped EXE
PID:2604 -
\??\c:\jdvdj.exec:\jdvdj.exe60⤵
- Executes dropped EXE
PID:2936 -
\??\c:\lllxlll.exec:\lllxlll.exe61⤵
- Executes dropped EXE
PID:2492 -
\??\c:\lflxxff.exec:\lflxxff.exe62⤵
- Executes dropped EXE
PID:776 -
\??\c:\hbhnbh.exec:\hbhnbh.exe63⤵
- Executes dropped EXE
PID:484 -
\??\c:\3jdjp.exec:\3jdjp.exe64⤵
- Executes dropped EXE
PID:584 -
\??\c:\3vvdj.exec:\3vvdj.exe65⤵
- Executes dropped EXE
PID:1088 -
\??\c:\5rflxxf.exec:\5rflxxf.exe66⤵PID:2384
-
\??\c:\ntthbt.exec:\ntthbt.exe67⤵PID:2020
-
\??\c:\7btbtn.exec:\7btbtn.exe68⤵PID:1940
-
\??\c:\1jdpd.exec:\1jdpd.exe69⤵PID:1960
-
\??\c:\vvdpv.exec:\vvdpv.exe70⤵PID:1780
-
\??\c:\xlfffxl.exec:\xlfffxl.exe71⤵PID:1800
-
\??\c:\hhnnbh.exec:\hhnnbh.exe72⤵PID:300
-
\??\c:\vvjpp.exec:\vvjpp.exe73⤵PID:2328
-
\??\c:\vjjvd.exec:\vjjvd.exe74⤵PID:1912
-
\??\c:\fxflffr.exec:\fxflffr.exe75⤵PID:2356
-
\??\c:\ffxfxfr.exec:\ffxfxfr.exe76⤵PID:2360
-
\??\c:\3tttnt.exec:\3tttnt.exe77⤵PID:1064
-
\??\c:\hhttbn.exec:\hhttbn.exe78⤵PID:2616
-
\??\c:\dpjjv.exec:\dpjjv.exe79⤵PID:2764
-
\??\c:\lfxxxfr.exec:\lfxxxfr.exe80⤵PID:2640
-
\??\c:\xxlfxll.exec:\xxlfxll.exe81⤵PID:2668
-
\??\c:\hbnthn.exec:\hbnthn.exe82⤵PID:2080
-
\??\c:\bbbnbh.exec:\bbbnbh.exe83⤵PID:2620
-
\??\c:\dppdj.exec:\dppdj.exe84⤵PID:2512
-
\??\c:\vvpjd.exec:\vvpjd.exe85⤵PID:2524
-
\??\c:\3xflrrf.exec:\3xflrrf.exe86⤵PID:2572
-
\??\c:\rxlffll.exec:\rxlffll.exe87⤵PID:2160
-
\??\c:\nnhhhh.exec:\nnhhhh.exe88⤵PID:2016
-
\??\c:\dvjjj.exec:\dvjjj.exe89⤵PID:2840
-
\??\c:\fxrflrl.exec:\fxrflrl.exe90⤵PID:2992
-
\??\c:\fxlrflx.exec:\fxlrflx.exe91⤵PID:1636
-
\??\c:\bhntnb.exec:\bhntnb.exe92⤵PID:1996
-
\??\c:\pddpd.exec:\pddpd.exe93⤵PID:1808
-
\??\c:\pvpvp.exec:\pvpvp.exe94⤵PID:2404
-
\??\c:\3xlrlrl.exec:\3xlrlrl.exe95⤵PID:1432
-
\??\c:\rrxfrxf.exec:\rrxfrxf.exe96⤵PID:1768
-
\??\c:\tnhtnb.exec:\tnhtnb.exe97⤵PID:1284
-
\??\c:\tnnbtn.exec:\tnnbtn.exe98⤵PID:2068
-
\??\c:\vvpdp.exec:\vvpdp.exe99⤵PID:1740
-
\??\c:\rrflxfr.exec:\rrflxfr.exe100⤵PID:1900
-
\??\c:\fxflflf.exec:\fxflflf.exe101⤵PID:1664
-
\??\c:\9nhnhn.exec:\9nhnhn.exe102⤵PID:2244
-
\??\c:\djvpj.exec:\djvpj.exe103⤵PID:700
-
\??\c:\5ddvd.exec:\5ddvd.exe104⤵PID:948
-
\??\c:\llxfrlx.exec:\llxfrlx.exe105⤵PID:716
-
\??\c:\3hhtbb.exec:\3hhtbb.exe106⤵PID:2100
-
\??\c:\bbnhhb.exec:\bbnhhb.exe107⤵PID:3016
-
\??\c:\ddvdp.exec:\ddvdp.exe108⤵PID:1324
-
\??\c:\rrflxrf.exec:\rrflxrf.exe109⤵PID:1984
-
\??\c:\lfxfrxl.exec:\lfxfrxl.exe110⤵PID:1956
-
\??\c:\hbtbbb.exec:\hbtbbb.exe111⤵PID:2316
-
\??\c:\ddpdv.exec:\ddpdv.exe112⤵PID:1688
-
\??\c:\1jpvv.exec:\1jpvv.exe113⤵PID:2064
-
\??\c:\5lfxllr.exec:\5lfxllr.exe114⤵PID:1908
-
\??\c:\lxfxxrr.exec:\lxfxxrr.exe115⤵PID:2400
-
\??\c:\hbnhhh.exec:\hbnhhh.exe116⤵PID:2128
-
\??\c:\bbbnnb.exec:\bbbnnb.exe117⤵PID:1696
-
\??\c:\ppjpd.exec:\ppjpd.exe118⤵PID:3064
-
\??\c:\3jdjv.exec:\3jdjv.exe119⤵PID:2108
-
\??\c:\5rflfrf.exec:\5rflfrf.exe120⤵PID:2756
-
\??\c:\hnnbtn.exec:\hnnbtn.exe121⤵PID:2636
-
\??\c:\bbtnhb.exec:\bbtnhb.exe122⤵PID:2920
-
\??\c:\ppjdp.exec:\ppjdp.exe123⤵PID:2892
-
\??\c:\3frxrfr.exec:\3frxrfr.exe124⤵PID:2672
-
\??\c:\xrflxlf.exec:\xrflxlf.exe125⤵PID:2800
-
\??\c:\7nbhhn.exec:\7nbhhn.exe126⤵PID:2580
-
\??\c:\jpvdp.exec:\jpvdp.exe127⤵PID:2680
-
\??\c:\vpjpd.exec:\vpjpd.exe128⤵PID:860
-
\??\c:\xrflrrl.exec:\xrflrrl.exe129⤵PID:2852
-
\??\c:\rrlfxfx.exec:\rrlfxfx.exe130⤵PID:2884
-
\??\c:\tnntnt.exec:\tnntnt.exe131⤵PID:2744
-
\??\c:\nnbnth.exec:\nnbnth.exe132⤵PID:1060
-
\??\c:\vdpjj.exec:\vdpjj.exe133⤵PID:1248
-
\??\c:\llfrflr.exec:\llfrflr.exe134⤵PID:1632
-
\??\c:\xxlrfrf.exec:\xxlrfrf.exe135⤵PID:2320
-
\??\c:\nnhnnt.exec:\nnhnnt.exe136⤵PID:1440
-
\??\c:\vvjdv.exec:\vvjdv.exe137⤵PID:1640
-
\??\c:\dpdjp.exec:\dpdjp.exe138⤵PID:2716
-
\??\c:\1rllfxf.exec:\1rllfxf.exe139⤵PID:808
-
\??\c:\ttbbbh.exec:\ttbbbh.exe140⤵PID:1156
-
\??\c:\nnhbth.exec:\nnhbth.exe141⤵PID:2900
-
\??\c:\llflflf.exec:\llflflf.exe142⤵PID:1476
-
\??\c:\lxrrffr.exec:\lxrrffr.exe143⤵PID:1612
-
\??\c:\tthtbh.exec:\tthtbh.exe144⤵PID:784
-
\??\c:\vvjjv.exec:\vvjjv.exe145⤵PID:668
-
\??\c:\vpdjd.exec:\vpdjd.exe146⤵PID:580
-
\??\c:\lffrxfx.exec:\lffrxfx.exe147⤵PID:1784
-
\??\c:\3rflllr.exec:\3rflllr.exe148⤵PID:2312
-
\??\c:\nhbnht.exec:\nhbnht.exe149⤵PID:2004
-
\??\c:\hnhtnt.exec:\hnhtnt.exe150⤵PID:1028
-
\??\c:\ppvvj.exec:\ppvvj.exe151⤵PID:932
-
\??\c:\frlffrx.exec:\frlffrx.exe152⤵PID:2964
-
\??\c:\thnbht.exec:\thnbht.exe153⤵PID:2092
-
\??\c:\ntnbtn.exec:\ntnbtn.exe154⤵PID:1508
-
\??\c:\jvpvv.exec:\jvpvv.exe155⤵PID:2228
-
\??\c:\rrfrffx.exec:\rrfrffx.exe156⤵PID:1544
-
\??\c:\ffxlxrx.exec:\ffxlxrx.exe157⤵PID:1232
-
\??\c:\5tbhbh.exec:\5tbhbh.exe158⤵PID:1584
-
\??\c:\hbtthn.exec:\hbtthn.exe159⤵PID:2184
-
\??\c:\1jjdv.exec:\1jjdv.exe160⤵PID:2372
-
\??\c:\xxrxlrf.exec:\xxrxlrf.exe161⤵PID:2824
-
\??\c:\fxrrllx.exec:\fxrrllx.exe162⤵PID:2768
-
\??\c:\5nhbnb.exec:\5nhbnb.exe163⤵PID:2788
-
\??\c:\hntnnb.exec:\hntnnb.exe164⤵PID:2832
-
\??\c:\jddpd.exec:\jddpd.exe165⤵PID:2792
-
\??\c:\vjvpv.exec:\vjvpv.exe166⤵PID:2508
-
\??\c:\flflxff.exec:\flflxff.exe167⤵PID:2584
-
\??\c:\nhbbbh.exec:\nhbbbh.exe168⤵PID:2336
-
\??\c:\hbbhth.exec:\hbbhth.exe169⤵PID:3004
-
\??\c:\vvjdj.exec:\vvjdj.exe170⤵PID:2200
-
\??\c:\ffxlxfr.exec:\ffxlxfr.exe171⤵PID:2736
-
\??\c:\3nthth.exec:\3nthth.exe172⤵PID:2868
-
\??\c:\9tbhtn.exec:\9tbhtn.exe173⤵PID:2864
-
\??\c:\9vpjj.exec:\9vpjj.exe174⤵PID:1920
-
\??\c:\jjvvj.exec:\jjvvj.exe175⤵PID:1932
-
\??\c:\5nhhbh.exec:\5nhhbh.exe176⤵PID:1300
-
\??\c:\bthhtb.exec:\bthhtb.exe177⤵PID:1256
-
\??\c:\pvdvp.exec:\pvdvp.exe178⤵PID:1704
-
\??\c:\xxfxxll.exec:\xxfxxll.exe179⤵PID:1444
-
\??\c:\7frxlxx.exec:\7frxlxx.exe180⤵PID:1776
-
\??\c:\3xflxlr.exec:\3xflxlr.exe181⤵PID:2068
-
\??\c:\7nnhtb.exec:\7nnhtb.exe182⤵PID:316
-
\??\c:\jddjp.exec:\jddjp.exe183⤵PID:1900
-
\??\c:\1dpdv.exec:\1dpdv.exe184⤵PID:2488
-
\??\c:\7xllrll.exec:\7xllrll.exe185⤵PID:2280
-
\??\c:\5hnbhh.exec:\5hnbhh.exe186⤵PID:784
-
\??\c:\9jvdv.exec:\9jvdv.exe187⤵PID:1904
-
\??\c:\ppppv.exec:\ppppv.exe188⤵PID:948
-
\??\c:\fxlfxxx.exec:\fxlfxxx.exe189⤵PID:1104
-
\??\c:\btnbnb.exec:\btnbnb.exe190⤵PID:1480
-
\??\c:\1hhtbh.exec:\1hhtbh.exe191⤵PID:2252
-
\??\c:\pjdjj.exec:\pjdjj.exe192⤵PID:2264
-
\??\c:\vjpvv.exec:\vjpvv.exe193⤵PID:2236
-
\??\c:\rllfflx.exec:\rllfflx.exe194⤵PID:1956
-
\??\c:\5hhtht.exec:\5hhtht.exe195⤵PID:1708
-
\??\c:\nnbthh.exec:\nnbthh.exe196⤵PID:2456
-
\??\c:\djjdp.exec:\djjdp.exe197⤵PID:2260
-
\??\c:\ppjpj.exec:\ppjpj.exe198⤵PID:988
-
\??\c:\1llxrxl.exec:\1llxrxl.exe199⤵PID:2400
-
\??\c:\hhtthn.exec:\hhtthn.exe200⤵PID:2128
-
\??\c:\nttnbt.exec:\nttnbt.exe201⤵PID:1588
-
\??\c:\ppjjp.exec:\ppjjp.exe202⤵PID:2284
-
\??\c:\jjdpd.exec:\jjdpd.exe203⤵PID:2072
-
\??\c:\fxrrffr.exec:\fxrrffr.exe204⤵PID:2924
-
\??\c:\rrlxllx.exec:\rrlxllx.exe205⤵PID:2816
-
\??\c:\btnhnn.exec:\btnhnn.exe206⤵PID:2516
-
\??\c:\dvpdj.exec:\dvpdj.exe207⤵PID:2752
-
\??\c:\pjjjd.exec:\pjjjd.exe208⤵PID:2536
-
\??\c:\flxlrxx.exec:\flxlrxx.exe209⤵PID:2504
-
\??\c:\xrxllrf.exec:\xrxllrf.exe210⤵PID:2580
-
\??\c:\hhbhnh.exec:\hhbhnh.exe211⤵PID:2528
-
\??\c:\jdvjj.exec:\jdvjj.exe212⤵PID:2160
-
\??\c:\rlxfrrl.exec:\rlxfrrl.exe213⤵PID:2844
-
\??\c:\nhttbh.exec:\nhttbh.exe214⤵PID:2896
-
\??\c:\ttntnn.exec:\ttntnn.exe215⤵PID:2848
-
\??\c:\djpdp.exec:\djpdp.exe216⤵PID:1060
-
\??\c:\fxrfflf.exec:\fxrfflf.exe217⤵PID:1248
-
\??\c:\7fxfxfr.exec:\7fxfxfr.exe218⤵PID:1632
-
\??\c:\7nhthn.exec:\7nhthn.exe219⤵PID:1924
-
\??\c:\vjdvp.exec:\vjdvp.exe220⤵PID:1056
-
\??\c:\jdjdj.exec:\jdjdj.exe221⤵PID:2576
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe222⤵PID:2248
-
\??\c:\ffxxflr.exec:\ffxxflr.exe223⤵PID:1776
-
\??\c:\tnbhnb.exec:\tnbhnb.exe224⤵PID:1624
-
\??\c:\vvdvv.exec:\vvdvv.exe225⤵PID:1156
-
\??\c:\rrfxflr.exec:\rrfxflr.exe226⤵PID:1608
-
\??\c:\7flxrfr.exec:\7flxrfr.exe227⤵PID:1476
-
\??\c:\bbbnht.exec:\bbbnht.exe228⤵PID:1612
-
\??\c:\vvdpj.exec:\vvdpj.exe229⤵PID:784
-
\??\c:\xlxlfrl.exec:\xlxlfrl.exe230⤵PID:1904
-
\??\c:\ffrlxfl.exec:\ffrlxfl.exe231⤵PID:1036
-
\??\c:\nhhnbh.exec:\nhhnbh.exe232⤵PID:580
-
\??\c:\bbtnnb.exec:\bbtnnb.exe233⤵PID:636
-
\??\c:\5vpdd.exec:\5vpdd.exe234⤵PID:324
-
\??\c:\xxrxxfx.exec:\xxrxxfx.exe235⤵PID:2264
-
\??\c:\ffxlxfx.exec:\ffxlxfx.exe236⤵PID:1028
-
\??\c:\7ttnbb.exec:\7ttnbb.exe237⤵PID:1956
-
\??\c:\hntnbt.exec:\hntnbt.exe238⤵PID:1040
-
\??\c:\ppvjd.exec:\ppvjd.exe239⤵PID:1788
-
\??\c:\ffxlfxr.exec:\ffxlfxr.exe240⤵PID:1508
-
\??\c:\lxllxxf.exec:\lxllxxf.exe241⤵PID:2228
-
\??\c:\nhhbbb.exec:\nhhbbb.exe242⤵PID:2120