Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 19:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3a18372857c57e4b21fd07438f106a80_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
3a18372857c57e4b21fd07438f106a80_NeikiAnalytics.exe
-
Size
118KB
-
MD5
3a18372857c57e4b21fd07438f106a80
-
SHA1
6f4f1dcf85f19a440ab59255c7b458e0091236c9
-
SHA256
8df7874c5d2b927771b9d0761b160fa20b8f5c200b2a63e426be494cf622f57c
-
SHA512
253b73d8030492cbdbe4f0989d300dbd8937dc7aad06b0c8b0331f980fc0002acb0600b2fa10a0c52aa4a5ff271b3aa08171f545a40430366152df99e438ca86
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDomRGApSuLAR2yPBCQ1nDFu1Q8sI:ymb3NkkiQ3mdBjFomR7UsyJC+n0GsgcX
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/2148-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2392-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/856-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/808-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1888-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1556-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2060-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/332-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/840-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1640-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2112-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rrffrxl.exe7pjpv.exe7hbhnt.exetnbhnt.exevvppd.exellrxlxr.exebtbhth.exepppjv.exe5lfrflf.exebhbnbb.exe7ppvd.exepjvdv.exellfrxlx.exetnhnbn.exe1jvjp.exe1frrxxl.exehhbnbb.exettbntb.exejjdjj.exe9xrrllx.exebtnhnt.exehbthth.exejdpvj.exefrlrffl.exe5nntht.exe3vpdj.exerlxxflx.exexxrflfr.exevvvpd.exe1dvvv.exellxrxxl.exennbhbh.exeddvdv.exepvjvv.exeffxxllr.exe9hhbhh.exetnbhtb.exejjdpp.exeddvdp.exefxrrffr.exe5lxlrrf.exethntbb.exejjddp.exe1vddd.exe5frrxxl.exe9rrfflx.exethbhhh.exe3dpjp.exevpvvd.exe7rfrflx.exelffrxxl.exe9hbhth.exetnhntb.exeppjpp.exe5fxrxxl.exexxrxxfr.exebtnnbh.exe3nnnbn.exedpdvd.exerlrrfxf.exe5rrxxxl.exe9hntbn.exe5nbhhh.exepjddp.exepid process 2468 rrffrxl.exe 2392 7pjpv.exe 2736 7hbhnt.exe 2632 tnbhnt.exe 2688 vvppd.exe 2424 llrxlxr.exe 2540 btbhth.exe 3008 pppjv.exe 856 5lfrflf.exe 2780 bhbnbb.exe 2852 7ppvd.exe 808 pjvdv.exe 1888 llfrxlx.exe 1884 tnhnbn.exe 1876 1jvjp.exe 2176 1frrxxl.exe 1556 hhbnbb.exe 1564 ttbntb.exe 2076 jjdjj.exe 2060 9xrrllx.exe 2104 btnhnt.exe 332 hbthth.exe 592 jdpvj.exe 840 frlrffl.exe 1312 5nntht.exe 1640 3vpdj.exe 912 rlxxflx.exe 1224 xxrflfr.exe 2112 vvvpd.exe 2224 1dvvv.exe 1696 llxrxxl.exe 2400 nnbhbh.exe 1612 ddvdv.exe 2612 pvjvv.exe 3028 ffxxllr.exe 2740 9hhbhh.exe 2676 tnbhtb.exe 2772 jjdpp.exe 2560 ddvdp.exe 2692 fxrrffr.exe 2524 5lxlrrf.exe 2424 thntbb.exe 2544 jjddp.exe 1812 1vddd.exe 2020 5frrxxl.exe 856 9rrfflx.exe 2824 thbhhh.exe 2564 3dpjp.exe 2456 vpvvd.exe 2328 7rfrflx.exe 1988 lffrxxl.exe 1884 9hbhth.exe 1420 tnhntb.exe 1624 ppjpp.exe 1540 5fxrxxl.exe 1188 xxrxxfr.exe 1252 btnnbh.exe 2072 3nnnbn.exe 2892 dpdvd.exe 264 rlrrfxf.exe 1152 5rrxxxl.exe 332 9hntbn.exe 592 5nbhhh.exe 2384 pjddp.exe -
Processes:
resource yara_rule behavioral1/memory/2148-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/856-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/808-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1888-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/332-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2112-284-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3a18372857c57e4b21fd07438f106a80_NeikiAnalytics.exerrffrxl.exe7pjpv.exe7hbhnt.exetnbhnt.exevvppd.exellrxlxr.exebtbhth.exepppjv.exe5lfrflf.exebhbnbb.exe7ppvd.exepjvdv.exellfrxlx.exetnhnbn.exe1jvjp.exedescription pid process target process PID 2148 wrote to memory of 2468 2148 3a18372857c57e4b21fd07438f106a80_NeikiAnalytics.exe rrffrxl.exe PID 2148 wrote to memory of 2468 2148 3a18372857c57e4b21fd07438f106a80_NeikiAnalytics.exe rrffrxl.exe PID 2148 wrote to memory of 2468 2148 3a18372857c57e4b21fd07438f106a80_NeikiAnalytics.exe rrffrxl.exe PID 2148 wrote to memory of 2468 2148 3a18372857c57e4b21fd07438f106a80_NeikiAnalytics.exe rrffrxl.exe PID 2468 wrote to memory of 2392 2468 rrffrxl.exe 7pjpv.exe PID 2468 wrote to memory of 2392 2468 rrffrxl.exe 7pjpv.exe PID 2468 wrote to memory of 2392 2468 rrffrxl.exe 7pjpv.exe PID 2468 wrote to memory of 2392 2468 rrffrxl.exe 7pjpv.exe PID 2392 wrote to memory of 2736 2392 7pjpv.exe 7hbhnt.exe PID 2392 wrote to memory of 2736 2392 7pjpv.exe 7hbhnt.exe PID 2392 wrote to memory of 2736 2392 7pjpv.exe 7hbhnt.exe PID 2392 wrote to memory of 2736 2392 7pjpv.exe 7hbhnt.exe PID 2736 wrote to memory of 2632 2736 7hbhnt.exe tnbhnt.exe PID 2736 wrote to memory of 2632 2736 7hbhnt.exe tnbhnt.exe PID 2736 wrote to memory of 2632 2736 7hbhnt.exe tnbhnt.exe PID 2736 wrote to memory of 2632 2736 7hbhnt.exe tnbhnt.exe PID 2632 wrote to memory of 2688 2632 tnbhnt.exe vvppd.exe PID 2632 wrote to memory of 2688 2632 tnbhnt.exe vvppd.exe PID 2632 wrote to memory of 2688 2632 tnbhnt.exe vvppd.exe PID 2632 wrote to memory of 2688 2632 tnbhnt.exe vvppd.exe PID 2688 wrote to memory of 2424 2688 vvppd.exe llrxlxr.exe PID 2688 wrote to memory of 2424 2688 vvppd.exe llrxlxr.exe PID 2688 wrote to memory of 2424 2688 vvppd.exe llrxlxr.exe PID 2688 wrote to memory of 2424 2688 vvppd.exe llrxlxr.exe PID 2424 wrote to memory of 2540 2424 llrxlxr.exe btbhth.exe PID 2424 wrote to memory of 2540 2424 llrxlxr.exe btbhth.exe PID 2424 wrote to memory of 2540 2424 llrxlxr.exe btbhth.exe PID 2424 wrote to memory of 2540 2424 llrxlxr.exe btbhth.exe PID 2540 wrote to memory of 3008 2540 btbhth.exe pppjv.exe PID 2540 wrote to memory of 3008 2540 btbhth.exe pppjv.exe PID 2540 wrote to memory of 3008 2540 btbhth.exe pppjv.exe PID 2540 wrote to memory of 3008 2540 btbhth.exe pppjv.exe PID 3008 wrote to memory of 856 3008 pppjv.exe 5lfrflf.exe PID 3008 wrote to memory of 856 3008 pppjv.exe 5lfrflf.exe PID 3008 wrote to memory of 856 3008 pppjv.exe 5lfrflf.exe PID 3008 wrote to memory of 856 3008 pppjv.exe 5lfrflf.exe PID 856 wrote to memory of 2780 856 5lfrflf.exe bhbnbb.exe PID 856 wrote to memory of 2780 856 5lfrflf.exe bhbnbb.exe PID 856 wrote to memory of 2780 856 5lfrflf.exe bhbnbb.exe PID 856 wrote to memory of 2780 856 5lfrflf.exe bhbnbb.exe PID 2780 wrote to memory of 2852 2780 bhbnbb.exe 7ppvd.exe PID 2780 wrote to memory of 2852 2780 bhbnbb.exe 7ppvd.exe PID 2780 wrote to memory of 2852 2780 bhbnbb.exe 7ppvd.exe PID 2780 wrote to memory of 2852 2780 bhbnbb.exe 7ppvd.exe PID 2852 wrote to memory of 808 2852 7ppvd.exe pjvdv.exe PID 2852 wrote to memory of 808 2852 7ppvd.exe pjvdv.exe PID 2852 wrote to memory of 808 2852 7ppvd.exe pjvdv.exe PID 2852 wrote to memory of 808 2852 7ppvd.exe pjvdv.exe PID 808 wrote to memory of 1888 808 pjvdv.exe llfrxlx.exe PID 808 wrote to memory of 1888 808 pjvdv.exe llfrxlx.exe PID 808 wrote to memory of 1888 808 pjvdv.exe llfrxlx.exe PID 808 wrote to memory of 1888 808 pjvdv.exe llfrxlx.exe PID 1888 wrote to memory of 1884 1888 llfrxlx.exe tnhnbn.exe PID 1888 wrote to memory of 1884 1888 llfrxlx.exe tnhnbn.exe PID 1888 wrote to memory of 1884 1888 llfrxlx.exe tnhnbn.exe PID 1888 wrote to memory of 1884 1888 llfrxlx.exe tnhnbn.exe PID 1884 wrote to memory of 1876 1884 tnhnbn.exe 1jvjp.exe PID 1884 wrote to memory of 1876 1884 tnhnbn.exe 1jvjp.exe PID 1884 wrote to memory of 1876 1884 tnhnbn.exe 1jvjp.exe PID 1884 wrote to memory of 1876 1884 tnhnbn.exe 1jvjp.exe PID 1876 wrote to memory of 2176 1876 1jvjp.exe 1frrxxl.exe PID 1876 wrote to memory of 2176 1876 1jvjp.exe 1frrxxl.exe PID 1876 wrote to memory of 2176 1876 1jvjp.exe 1frrxxl.exe PID 1876 wrote to memory of 2176 1876 1jvjp.exe 1frrxxl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a18372857c57e4b21fd07438f106a80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3a18372857c57e4b21fd07438f106a80_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\rrffrxl.exec:\rrffrxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\7pjpv.exec:\7pjpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\7hbhnt.exec:\7hbhnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\tnbhnt.exec:\tnbhnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\vvppd.exec:\vvppd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\llrxlxr.exec:\llrxlxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\btbhth.exec:\btbhth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\pppjv.exec:\pppjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\5lfrflf.exec:\5lfrflf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\bhbnbb.exec:\bhbnbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\7ppvd.exec:\7ppvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\pjvdv.exec:\pjvdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\llfrxlx.exec:\llfrxlx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\tnhnbn.exec:\tnhnbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\1jvjp.exec:\1jvjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\1frrxxl.exec:\1frrxxl.exe17⤵
- Executes dropped EXE
PID:2176 -
\??\c:\hhbnbb.exec:\hhbnbb.exe18⤵
- Executes dropped EXE
PID:1556 -
\??\c:\ttbntb.exec:\ttbntb.exe19⤵
- Executes dropped EXE
PID:1564 -
\??\c:\jjdjj.exec:\jjdjj.exe20⤵
- Executes dropped EXE
PID:2076 -
\??\c:\9xrrllx.exec:\9xrrllx.exe21⤵
- Executes dropped EXE
PID:2060 -
\??\c:\btnhnt.exec:\btnhnt.exe22⤵
- Executes dropped EXE
PID:2104 -
\??\c:\hbthth.exec:\hbthth.exe23⤵
- Executes dropped EXE
PID:332 -
\??\c:\jdpvj.exec:\jdpvj.exe24⤵
- Executes dropped EXE
PID:592 -
\??\c:\frlrffl.exec:\frlrffl.exe25⤵
- Executes dropped EXE
PID:840 -
\??\c:\5nntht.exec:\5nntht.exe26⤵
- Executes dropped EXE
PID:1312 -
\??\c:\3vpdj.exec:\3vpdj.exe27⤵
- Executes dropped EXE
PID:1640 -
\??\c:\rlxxflx.exec:\rlxxflx.exe28⤵
- Executes dropped EXE
PID:912 -
\??\c:\xxrflfr.exec:\xxrflfr.exe29⤵
- Executes dropped EXE
PID:1224 -
\??\c:\vvvpd.exec:\vvvpd.exe30⤵
- Executes dropped EXE
PID:2112 -
\??\c:\1dvvv.exec:\1dvvv.exe31⤵
- Executes dropped EXE
PID:2224 -
\??\c:\llxrxxl.exec:\llxrxxl.exe32⤵
- Executes dropped EXE
PID:1696 -
\??\c:\nnbhbh.exec:\nnbhbh.exe33⤵
- Executes dropped EXE
PID:2400 -
\??\c:\ddvdv.exec:\ddvdv.exe34⤵
- Executes dropped EXE
PID:1612 -
\??\c:\pvjvv.exec:\pvjvv.exe35⤵
- Executes dropped EXE
PID:2612 -
\??\c:\ffxxllr.exec:\ffxxllr.exe36⤵
- Executes dropped EXE
PID:3028 -
\??\c:\9hhbhh.exec:\9hhbhh.exe37⤵
- Executes dropped EXE
PID:2740 -
\??\c:\tnbhtb.exec:\tnbhtb.exe38⤵
- Executes dropped EXE
PID:2676 -
\??\c:\jjdpp.exec:\jjdpp.exe39⤵
- Executes dropped EXE
PID:2772 -
\??\c:\ddvdp.exec:\ddvdp.exe40⤵
- Executes dropped EXE
PID:2560 -
\??\c:\fxrrffr.exec:\fxrrffr.exe41⤵
- Executes dropped EXE
PID:2692 -
\??\c:\5lxlrrf.exec:\5lxlrrf.exe42⤵
- Executes dropped EXE
PID:2524 -
\??\c:\thntbb.exec:\thntbb.exe43⤵
- Executes dropped EXE
PID:2424 -
\??\c:\jjddp.exec:\jjddp.exe44⤵
- Executes dropped EXE
PID:2544 -
\??\c:\1vddd.exec:\1vddd.exe45⤵
- Executes dropped EXE
PID:1812 -
\??\c:\5frrxxl.exec:\5frrxxl.exe46⤵
- Executes dropped EXE
PID:2020 -
\??\c:\9rrfflx.exec:\9rrfflx.exe47⤵
- Executes dropped EXE
PID:856 -
\??\c:\thbhhh.exec:\thbhhh.exe48⤵
- Executes dropped EXE
PID:2824 -
\??\c:\3dpjp.exec:\3dpjp.exe49⤵
- Executes dropped EXE
PID:2564 -
\??\c:\vpvvd.exec:\vpvvd.exe50⤵
- Executes dropped EXE
PID:2456 -
\??\c:\7rfrflx.exec:\7rfrflx.exe51⤵
- Executes dropped EXE
PID:2328 -
\??\c:\lffrxxl.exec:\lffrxxl.exe52⤵
- Executes dropped EXE
PID:1988 -
\??\c:\9hbhth.exec:\9hbhth.exe53⤵
- Executes dropped EXE
PID:1884 -
\??\c:\tnhntb.exec:\tnhntb.exe54⤵
- Executes dropped EXE
PID:1420 -
\??\c:\ppjpp.exec:\ppjpp.exe55⤵
- Executes dropped EXE
PID:1624 -
\??\c:\5fxrxxl.exec:\5fxrxxl.exe56⤵
- Executes dropped EXE
PID:1540 -
\??\c:\xxrxxfr.exec:\xxrxxfr.exe57⤵
- Executes dropped EXE
PID:1188 -
\??\c:\btnnbh.exec:\btnnbh.exe58⤵
- Executes dropped EXE
PID:1252 -
\??\c:\3nnnbn.exec:\3nnnbn.exe59⤵
- Executes dropped EXE
PID:2072 -
\??\c:\dpdvd.exec:\dpdvd.exe60⤵
- Executes dropped EXE
PID:2892 -
\??\c:\rlrrfxf.exec:\rlrrfxf.exe61⤵
- Executes dropped EXE
PID:264 -
\??\c:\5rrxxxl.exec:\5rrxxxl.exe62⤵
- Executes dropped EXE
PID:1152 -
\??\c:\9hntbn.exec:\9hntbn.exe63⤵
- Executes dropped EXE
PID:332 -
\??\c:\5nbhhh.exec:\5nbhhh.exe64⤵
- Executes dropped EXE
PID:592 -
\??\c:\pjddp.exec:\pjddp.exe65⤵
- Executes dropped EXE
PID:2384 -
\??\c:\jvppv.exec:\jvppv.exe66⤵PID:1924
-
\??\c:\5rfflrl.exec:\5rfflrl.exe67⤵PID:2484
-
\??\c:\1llrxfl.exec:\1llrxfl.exe68⤵PID:912
-
\??\c:\1thhnt.exec:\1thhnt.exe69⤵PID:1432
-
\??\c:\5htttn.exec:\5htttn.exe70⤵PID:2136
-
\??\c:\pvppd.exec:\pvppd.exe71⤵PID:1228
-
\??\c:\jvjjv.exec:\jvjjv.exe72⤵PID:1512
-
\??\c:\rrlrffr.exec:\rrlrffr.exe73⤵PID:628
-
\??\c:\lfxrxxf.exec:\lfxrxxf.exe74⤵PID:3064
-
\??\c:\hhbbhh.exec:\hhbbhh.exe75⤵PID:2412
-
\??\c:\hbtthb.exec:\hbtthb.exe76⤵PID:1704
-
\??\c:\vpvdj.exec:\vpvdj.exe77⤵PID:2260
-
\??\c:\dvpdj.exec:\dvpdj.exe78⤵PID:2668
-
\??\c:\xlxrxxf.exec:\xlxrxxf.exe79⤵PID:2884
-
\??\c:\hbthhh.exec:\hbthhh.exe80⤵PID:2724
-
\??\c:\htthhb.exec:\htthhb.exe81⤵PID:2644
-
\??\c:\vvjjp.exec:\vvjjp.exe82⤵PID:2784
-
\??\c:\pjvvd.exec:\pjvvd.exe83⤵PID:2792
-
\??\c:\3lfrxxl.exec:\3lfrxxl.exe84⤵PID:2568
-
\??\c:\btbhnn.exec:\btbhnn.exe85⤵PID:2436
-
\??\c:\bhbtnt.exec:\bhbtnt.exe86⤵PID:2144
-
\??\c:\ppjjp.exec:\ppjjp.exe87⤵PID:2008
-
\??\c:\jpdjp.exec:\jpdjp.exe88⤵PID:2512
-
\??\c:\ffrflfr.exec:\ffrflfr.exe89⤵PID:2836
-
\??\c:\lfxrxxf.exec:\lfxrxxf.exe90⤵PID:2972
-
\??\c:\bbtttb.exec:\bbtttb.exe91⤵PID:1344
-
\??\c:\1jddj.exec:\1jddj.exe92⤵PID:2168
-
\??\c:\pjvdp.exec:\pjvdp.exe93⤵PID:1896
-
\??\c:\lllrrlr.exec:\lllrrlr.exe94⤵PID:1400
-
\??\c:\ffllxfl.exec:\ffllxfl.exe95⤵PID:1752
-
\??\c:\btbhbb.exec:\btbhbb.exe96⤵PID:1200
-
\??\c:\nhhnbb.exec:\nhhnbb.exe97⤵PID:2176
-
\??\c:\dppvj.exec:\dppvj.exe98⤵PID:2276
-
\??\c:\jdjvd.exec:\jdjvd.exe99⤵PID:2068
-
\??\c:\ffxffrf.exec:\ffxffrf.exe100⤵PID:2108
-
\??\c:\tnhbhn.exec:\tnhbhn.exe101⤵PID:2896
-
\??\c:\bnbntb.exec:\bnbntb.exe102⤵PID:2072
-
\??\c:\vvjpd.exec:\vvjpd.exe103⤵PID:580
-
\??\c:\3jjpv.exec:\3jjpv.exe104⤵PID:612
-
\??\c:\rrrflfr.exec:\rrrflfr.exe105⤵PID:1916
-
\??\c:\rrfflrf.exec:\rrfflrf.exe106⤵PID:1804
-
\??\c:\tnbbhn.exec:\tnbbhn.exe107⤵PID:932
-
\??\c:\7ddjp.exec:\7ddjp.exe108⤵PID:2120
-
\??\c:\jvvdj.exec:\jvvdj.exe109⤵PID:1156
-
\??\c:\1fxfrxf.exec:\1fxfrxf.exe110⤵PID:1904
-
\??\c:\hbntbh.exec:\hbntbh.exe111⤵PID:788
-
\??\c:\9hbbnt.exec:\9hbbnt.exe112⤵PID:652
-
\??\c:\9dpvd.exec:\9dpvd.exe113⤵PID:2096
-
\??\c:\5vpjv.exec:\5vpjv.exe114⤵PID:2444
-
\??\c:\rfxfffx.exec:\rfxfffx.exe115⤵PID:1796
-
\??\c:\tnbhhn.exec:\tnbhhn.exe116⤵PID:2204
-
\??\c:\nnhnhh.exec:\nnhnhh.exe117⤵PID:2712
-
\??\c:\7jppd.exec:\7jppd.exe118⤵PID:3060
-
\??\c:\vpdjj.exec:\vpdjj.exe119⤵PID:2728
-
\??\c:\xrllxlx.exec:\xrllxlx.exe120⤵PID:2680
-
\??\c:\rrflrlx.exec:\rrflrlx.exe121⤵PID:2676
-
\??\c:\9ntnhh.exec:\9ntnhh.exe122⤵PID:2708
-
\??\c:\nhbhtt.exec:\nhbhtt.exe123⤵PID:2548
-
\??\c:\5jpjv.exec:\5jpjv.exe124⤵PID:3004
-
\??\c:\rfxfrxf.exec:\rfxfrxf.exe125⤵PID:2664
-
\??\c:\frffrxl.exec:\frffrxl.exe126⤵PID:2584
-
\??\c:\7nhhnn.exec:\7nhhnn.exe127⤵PID:2976
-
\??\c:\3vdjj.exec:\3vdjj.exe128⤵PID:340
-
\??\c:\llrrxfl.exec:\llrrxfl.exe129⤵PID:1856
-
\??\c:\tnhhtb.exec:\tnhhtb.exe130⤵PID:2816
-
\??\c:\tnbhbh.exec:\tnbhbh.exe131⤵PID:768
-
\??\c:\3vvdv.exec:\3vvdv.exe132⤵PID:2216
-
\??\c:\vpdvj.exec:\vpdvj.exe133⤵PID:2420
-
\??\c:\7xxxffr.exec:\7xxxffr.exe134⤵PID:2000
-
\??\c:\5hbbnb.exec:\5hbbnb.exe135⤵PID:1996
-
\??\c:\bttbhn.exec:\bttbhn.exe136⤵PID:2332
-
\??\c:\1pjpv.exec:\1pjpv.exe137⤵PID:2196
-
\??\c:\djdvj.exec:\djdvj.exe138⤵PID:1652
-
\??\c:\xxrxffl.exec:\xxrxffl.exe139⤵PID:1556
-
\??\c:\7xrfrrf.exec:\7xrfrrf.exe140⤵PID:1632
-
\??\c:\bhtbhh.exec:\bhtbhh.exe141⤵PID:2352
-
\??\c:\jjjjv.exec:\jjjjv.exe142⤵PID:2900
-
\??\c:\lxrfrxx.exec:\lxrfrxx.exe143⤵PID:2904
-
\??\c:\lxlrfrf.exec:\lxlrfrf.exe144⤵PID:988
-
\??\c:\bbnbtn.exec:\bbnbtn.exe145⤵PID:780
-
\??\c:\hhbnbb.exec:\hhbnbb.exe146⤵PID:1644
-
\??\c:\vvvvd.exec:\vvvvd.exe147⤵PID:1340
-
\??\c:\rlfrxlx.exec:\rlfrxlx.exe148⤵PID:1320
-
\??\c:\ffxflll.exec:\ffxflll.exe149⤵PID:1304
-
\??\c:\btntnn.exec:\btntnn.exe150⤵PID:1648
-
\??\c:\nnhbhh.exec:\nnhbhh.exe151⤵PID:1596
-
\??\c:\ddjdj.exec:\ddjdj.exe152⤵PID:2324
-
\??\c:\fflxffr.exec:\fflxffr.exe153⤵PID:3068
-
\??\c:\1rlrxfr.exec:\1rlrxfr.exe154⤵PID:992
-
\??\c:\hbnntt.exec:\hbnntt.exe155⤵PID:2224
-
\??\c:\vvpvj.exec:\vvpvj.exe156⤵PID:1044
-
\??\c:\jdppd.exec:\jdppd.exe157⤵PID:3064
-
\??\c:\fxrllfr.exec:\fxrllfr.exe158⤵PID:1580
-
\??\c:\llfrlrf.exec:\llfrlrf.exe159⤵PID:1608
-
\??\c:\hbbnnt.exec:\hbbnnt.exe160⤵PID:2672
-
\??\c:\3jpvd.exec:\3jpvd.exe161⤵PID:2392
-
\??\c:\xxrfrlx.exec:\xxrfrlx.exe162⤵PID:2788
-
\??\c:\3ffxlrl.exec:\3ffxlrl.exe163⤵PID:2800
-
\??\c:\nhhhnb.exec:\nhhhnb.exe164⤵PID:2632
-
\??\c:\1jjvp.exec:\1jjvp.exe165⤵PID:2796
-
\??\c:\jjvjv.exec:\jjvjv.exe166⤵PID:2536
-
\??\c:\fxlrfrf.exec:\fxlrfrf.exe167⤵PID:2648
-
\??\c:\tnbtbb.exec:\tnbtbb.exe168⤵PID:2592
-
\??\c:\vjvvd.exec:\vjvvd.exe169⤵PID:2436
-
\??\c:\jjvjv.exec:\jjvjv.exe170⤵PID:2980
-
\??\c:\ffrxffr.exec:\ffrxffr.exe171⤵PID:2768
-
\??\c:\7nbnbb.exec:\7nbnbb.exe172⤵PID:1992
-
\??\c:\bbhhnt.exec:\bbhhnt.exe173⤵PID:2860
-
\??\c:\ppdpv.exec:\ppdpv.exe174⤵PID:1660
-
\??\c:\llxfllf.exec:\llxfllf.exe175⤵PID:1892
-
\??\c:\xxlrxll.exec:\xxlrxll.exe176⤵PID:1864
-
\??\c:\nnttbh.exec:\nnttbh.exe177⤵PID:1532
-
\??\c:\vjddp.exec:\vjddp.exe178⤵PID:1876
-
\??\c:\ppppd.exec:\ppppd.exe179⤵PID:1636
-
\??\c:\rxxxfrf.exec:\rxxxfrf.exe180⤵PID:1628
-
\??\c:\ffxfxfx.exec:\ffxfxfx.exe181⤵PID:2080
-
\??\c:\hhtnth.exec:\hhtnth.exe182⤵PID:2704
-
\??\c:\1pdjv.exec:\1pdjv.exe183⤵PID:2888
-
\??\c:\pjjjv.exec:\pjjjv.exe184⤵PID:2292
-
\??\c:\flxxflr.exec:\flxxflr.exe185⤵PID:2052
-
\??\c:\9hbhth.exec:\9hbhth.exe186⤵PID:576
-
\??\c:\nnnbth.exec:\nnnbth.exe187⤵PID:1112
-
\??\c:\jjdjv.exec:\jjdjv.exe188⤵PID:2340
-
\??\c:\ppddd.exec:\ppddd.exe189⤵PID:1620
-
\??\c:\llxlxxf.exec:\llxlxxf.exe190⤵PID:1312
-
\??\c:\9hbhbb.exec:\9hbhbb.exe191⤵PID:1664
-
\??\c:\7thtbh.exec:\7thtbh.exe192⤵PID:2988
-
\??\c:\vppvp.exec:\vppvp.exe193⤵PID:2864
-
\??\c:\5vvvj.exec:\5vvvj.exe194⤵PID:1688
-
\??\c:\lllrflx.exec:\lllrflx.exe195⤵PID:1784
-
\??\c:\ttnthh.exec:\ttnthh.exe196⤵PID:2244
-
\??\c:\bnbnnn.exec:\bnbnnn.exe197⤵PID:2408
-
\??\c:\vpjvj.exec:\vpjvj.exe198⤵PID:2280
-
\??\c:\vpjpv.exec:\vpjpv.exe199⤵PID:1696
-
\??\c:\3flllrx.exec:\3flllrx.exe200⤵PID:1580
-
\??\c:\nbnbhb.exec:\nbnbhb.exe201⤵PID:1612
-
\??\c:\bbttht.exec:\bbttht.exe202⤵PID:2672
-
\??\c:\pvdvv.exec:\pvdvv.exe203⤵PID:2752
-
\??\c:\rxxxrxr.exec:\rxxxrxr.exe204⤵PID:2788
-
\??\c:\hhbhbn.exec:\hhbhbn.exe205⤵PID:2800
-
\??\c:\tnhntt.exec:\tnhntt.exe206⤵PID:2632
-
\??\c:\vvjpd.exec:\vvjpd.exe207⤵PID:2640
-
\??\c:\pjpvd.exec:\pjpvd.exe208⤵PID:2960
-
\??\c:\3xrlfxl.exec:\3xrlfxl.exe209⤵PID:2648
-
\??\c:\hhhhnt.exec:\hhhhnt.exe210⤵PID:2592
-
\??\c:\1tntbb.exec:\1tntbb.exe211⤵PID:2436
-
\??\c:\3vppv.exec:\3vppv.exe212⤵PID:2980
-
\??\c:\xlxflxl.exec:\xlxflxl.exe213⤵PID:2092
-
\??\c:\ffxrlxl.exec:\ffxrlxl.exe214⤵PID:2768
-
\??\c:\bhtttb.exec:\bhtttb.exe215⤵PID:2972
-
\??\c:\djpdp.exec:\djpdp.exe216⤵PID:2860
-
\??\c:\9dvvd.exec:\9dvvd.exe217⤵PID:2168
-
\??\c:\3xrflrl.exec:\3xrflrl.exe218⤵PID:1892
-
\??\c:\1xlrrfr.exec:\1xlrrfr.exe219⤵PID:860
-
\??\c:\ttnthn.exec:\ttnthn.exe220⤵PID:1532
-
\??\c:\dvppv.exec:\dvppv.exe221⤵PID:2196
-
\??\c:\jjvpp.exec:\jjvpp.exe222⤵PID:2240
-
\??\c:\9xlxrxr.exec:\9xlxrxr.exe223⤵PID:1736
-
\??\c:\xrlrffr.exec:\xrlrffr.exe224⤵PID:2080
-
\??\c:\ttthnn.exec:\ttthnn.exe225⤵PID:1448
-
\??\c:\thttnn.exec:\thttnn.exe226⤵PID:2760
-
\??\c:\jpddd.exec:\jpddd.exe227⤵PID:2904
-
\??\c:\xxlxrxr.exec:\xxlxrxr.exe228⤵PID:2052
-
\??\c:\3llfrfr.exec:\3llfrfr.exe229⤵PID:780
-
\??\c:\hhnntb.exec:\hhnntb.exe230⤵PID:1112
-
\??\c:\pjvvd.exec:\pjvvd.exe231⤵PID:1804
-
\??\c:\dvppv.exec:\dvppv.exe232⤵PID:1108
-
\??\c:\1rrrxfr.exec:\1rrrxfr.exe233⤵PID:876
-
\??\c:\fffxlxx.exec:\fffxlxx.exe234⤵PID:1664
-
\??\c:\5nntht.exec:\5nntht.exe235⤵PID:1596
-
\??\c:\nbnnhn.exec:\nbnnhn.exe236⤵PID:2864
-
\??\c:\vvpdj.exec:\vvpdj.exe237⤵PID:2356
-
\??\c:\fxfxxrr.exec:\fxfxxrr.exe238⤵PID:1784
-
\??\c:\xxxrfrf.exec:\xxxrfrf.exe239⤵PID:2224
-
\??\c:\hbnnbh.exec:\hbnnbh.exe240⤵PID:2388
-
\??\c:\3hbtnb.exec:\3hbtnb.exe241⤵PID:2164
-
\??\c:\jdvvj.exec:\jdvvj.exe242⤵PID:1696