Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 23:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
24ac2341375c9550d2984281bcf9b990_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
24ac2341375c9550d2984281bcf9b990_NeikiAnalytics.exe
-
Size
68KB
-
MD5
24ac2341375c9550d2984281bcf9b990
-
SHA1
0e668d664789425b19ca905fe6032c55649938c2
-
SHA256
f94084549bd8f903a0a2f65cd9b20dfcf6d7cf0b2a611a37e721d16aae58d912
-
SHA512
f502e52e898f1d4086892c0b73d120f579eacef148a086f1d43ed72f5680708b033bb2ebe63c182b88ad616384807d9a9e120232c088c191d2b833ab81eec3e5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLA89r:ymb3NkkiQ3mdBjFIvl358nLA89r
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral1/memory/2236-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-89-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1212-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1536-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1644-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/756-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1556-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2000-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1980-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1304-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2404-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
3fxfflr.exehhttbt.exepjvpv.exetbhhtt.exebbnnbb.exexxrrlrf.exe1llrfff.exehhbbhb.exedjpvv.exe5jjpj.exexlrrrrf.exebhtnhh.exepdpvd.exeddjpv.exexxlrffr.exebthhnn.exe3dpjp.exejdvjp.exerlfrxfx.exe1bbbtt.exe9vjjp.exevvddd.exe3rlxxfr.exettntbh.exehbhnnn.exevvpjv.exefrlfrfr.exe3hnbnn.exe7djdv.exelfrflxf.exe7rfrffx.exe9bntbh.exedpvvd.exe1xrxxxl.exehntnhh.exe7hbnhn.exetttntb.exepjvjv.exelflrxxl.exe7frxxfl.exebhbhbn.exehhtbhn.exe7jdpd.exeddjpj.exerrxxxfl.exellxlxlx.exehtbbbb.exehhthtb.exepjvvj.exepjdjd.exerrllflr.exe3lrrxxf.exettnhbn.exethhhhb.exejpjvp.exedvdpj.exexfrflll.exellrxflr.exebhbbnn.exebthhhn.exejdpvj.exeflrfrxl.exelfxfxfr.exennnbnt.exepid process 2372 3fxfflr.exe 2888 hhttbt.exe 2704 pjvpv.exe 2752 tbhhtt.exe 2564 bbnnbb.exe 2744 xxrrlrf.exe 2608 1llrfff.exe 2600 hhbbhb.exe 1212 djpvv.exe 1536 5jjpj.exe 2812 xlrrrrf.exe 2928 bhtnhh.exe 2356 pdpvd.exe 1040 ddjpv.exe 1644 xxlrffr.exe 1052 bthhnn.exe 1908 3dpjp.exe 756 jdvjp.exe 1556 rlfrxfx.exe 2272 1bbbtt.exe 3000 9vjjp.exe 2152 vvddd.exe 776 3rlxxfr.exe 1488 ttntbh.exe 1808 hbhnnn.exe 2000 vvpjv.exe 1980 frlfrfr.exe 900 3hnbnn.exe 2100 7djdv.exe 1304 lfrflxf.exe 2404 7rfrffx.exe 1716 9bntbh.exe 3040 dpvvd.exe 1880 1xrxxxl.exe 2368 hntnhh.exe 2244 7hbnhn.exe 2768 tttntb.exe 2664 pjvjv.exe 2900 lflrxxl.exe 2584 7frxxfl.exe 2940 bhbhbn.exe 2560 hhtbhn.exe 2612 7jdpd.exe 3068 ddjpj.exe 1708 rrxxxfl.exe 2824 llxlxlx.exe 2932 htbbbb.exe 2812 hhthtb.exe 1068 pjvvj.exe 1072 pjdjd.exe 1892 rrllflr.exe 1464 3lrrxxf.exe 2624 ttnhbn.exe 1052 thhhhb.exe 1160 jpjvp.exe 1768 dvdpj.exe 2324 xfrflll.exe 1936 llrxflr.exe 3008 bhbbnn.exe 264 bthhhn.exe 484 jdpvj.exe 1340 flrfrxl.exe 1636 lfxfxfr.exe 852 nnnbnt.exe -
Processes:
resource yara_rule behavioral1/memory/2236-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1212-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1536-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1644-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/756-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2000-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1980-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1304-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2404-297-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
24ac2341375c9550d2984281bcf9b990_NeikiAnalytics.exe3fxfflr.exehhttbt.exepjvpv.exetbhhtt.exebbnnbb.exexxrrlrf.exe1llrfff.exehhbbhb.exedjpvv.exe5jjpj.exexlrrrrf.exebhtnhh.exepdpvd.exeddjpv.exexxlrffr.exedescription pid process target process PID 2236 wrote to memory of 2372 2236 24ac2341375c9550d2984281bcf9b990_NeikiAnalytics.exe 3fxfflr.exe PID 2236 wrote to memory of 2372 2236 24ac2341375c9550d2984281bcf9b990_NeikiAnalytics.exe 3fxfflr.exe PID 2236 wrote to memory of 2372 2236 24ac2341375c9550d2984281bcf9b990_NeikiAnalytics.exe 3fxfflr.exe PID 2236 wrote to memory of 2372 2236 24ac2341375c9550d2984281bcf9b990_NeikiAnalytics.exe 3fxfflr.exe PID 2372 wrote to memory of 2888 2372 3fxfflr.exe hhttbt.exe PID 2372 wrote to memory of 2888 2372 3fxfflr.exe hhttbt.exe PID 2372 wrote to memory of 2888 2372 3fxfflr.exe hhttbt.exe PID 2372 wrote to memory of 2888 2372 3fxfflr.exe hhttbt.exe PID 2888 wrote to memory of 2704 2888 hhttbt.exe pjvpv.exe PID 2888 wrote to memory of 2704 2888 hhttbt.exe pjvpv.exe PID 2888 wrote to memory of 2704 2888 hhttbt.exe pjvpv.exe PID 2888 wrote to memory of 2704 2888 hhttbt.exe pjvpv.exe PID 2704 wrote to memory of 2752 2704 pjvpv.exe tbhhtt.exe PID 2704 wrote to memory of 2752 2704 pjvpv.exe tbhhtt.exe PID 2704 wrote to memory of 2752 2704 pjvpv.exe tbhhtt.exe PID 2704 wrote to memory of 2752 2704 pjvpv.exe tbhhtt.exe PID 2752 wrote to memory of 2564 2752 tbhhtt.exe bbnnbb.exe PID 2752 wrote to memory of 2564 2752 tbhhtt.exe bbnnbb.exe PID 2752 wrote to memory of 2564 2752 tbhhtt.exe bbnnbb.exe PID 2752 wrote to memory of 2564 2752 tbhhtt.exe bbnnbb.exe PID 2564 wrote to memory of 2744 2564 bbnnbb.exe xxrrlrf.exe PID 2564 wrote to memory of 2744 2564 bbnnbb.exe xxrrlrf.exe PID 2564 wrote to memory of 2744 2564 bbnnbb.exe xxrrlrf.exe PID 2564 wrote to memory of 2744 2564 bbnnbb.exe xxrrlrf.exe PID 2744 wrote to memory of 2608 2744 xxrrlrf.exe 1llrfff.exe PID 2744 wrote to memory of 2608 2744 xxrrlrf.exe 1llrfff.exe PID 2744 wrote to memory of 2608 2744 xxrrlrf.exe 1llrfff.exe PID 2744 wrote to memory of 2608 2744 xxrrlrf.exe 1llrfff.exe PID 2608 wrote to memory of 2600 2608 1llrfff.exe hhbbhb.exe PID 2608 wrote to memory of 2600 2608 1llrfff.exe hhbbhb.exe PID 2608 wrote to memory of 2600 2608 1llrfff.exe hhbbhb.exe PID 2608 wrote to memory of 2600 2608 1llrfff.exe hhbbhb.exe PID 2600 wrote to memory of 1212 2600 hhbbhb.exe djpvv.exe PID 2600 wrote to memory of 1212 2600 hhbbhb.exe djpvv.exe PID 2600 wrote to memory of 1212 2600 hhbbhb.exe djpvv.exe PID 2600 wrote to memory of 1212 2600 hhbbhb.exe djpvv.exe PID 1212 wrote to memory of 1536 1212 djpvv.exe 5jjpj.exe PID 1212 wrote to memory of 1536 1212 djpvv.exe 5jjpj.exe PID 1212 wrote to memory of 1536 1212 djpvv.exe 5jjpj.exe PID 1212 wrote to memory of 1536 1212 djpvv.exe 5jjpj.exe PID 1536 wrote to memory of 2812 1536 5jjpj.exe xlrrrrf.exe PID 1536 wrote to memory of 2812 1536 5jjpj.exe xlrrrrf.exe PID 1536 wrote to memory of 2812 1536 5jjpj.exe xlrrrrf.exe PID 1536 wrote to memory of 2812 1536 5jjpj.exe xlrrrrf.exe PID 2812 wrote to memory of 2928 2812 xlrrrrf.exe bhtnhh.exe PID 2812 wrote to memory of 2928 2812 xlrrrrf.exe bhtnhh.exe PID 2812 wrote to memory of 2928 2812 xlrrrrf.exe bhtnhh.exe PID 2812 wrote to memory of 2928 2812 xlrrrrf.exe bhtnhh.exe PID 2928 wrote to memory of 2356 2928 bhtnhh.exe pdpvd.exe PID 2928 wrote to memory of 2356 2928 bhtnhh.exe pdpvd.exe PID 2928 wrote to memory of 2356 2928 bhtnhh.exe pdpvd.exe PID 2928 wrote to memory of 2356 2928 bhtnhh.exe pdpvd.exe PID 2356 wrote to memory of 1040 2356 pdpvd.exe ddjpv.exe PID 2356 wrote to memory of 1040 2356 pdpvd.exe ddjpv.exe PID 2356 wrote to memory of 1040 2356 pdpvd.exe ddjpv.exe PID 2356 wrote to memory of 1040 2356 pdpvd.exe ddjpv.exe PID 1040 wrote to memory of 1644 1040 ddjpv.exe xxlrffr.exe PID 1040 wrote to memory of 1644 1040 ddjpv.exe xxlrffr.exe PID 1040 wrote to memory of 1644 1040 ddjpv.exe xxlrffr.exe PID 1040 wrote to memory of 1644 1040 ddjpv.exe xxlrffr.exe PID 1644 wrote to memory of 1052 1644 xxlrffr.exe bthhnn.exe PID 1644 wrote to memory of 1052 1644 xxlrffr.exe bthhnn.exe PID 1644 wrote to memory of 1052 1644 xxlrffr.exe bthhnn.exe PID 1644 wrote to memory of 1052 1644 xxlrffr.exe bthhnn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\24ac2341375c9550d2984281bcf9b990_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\24ac2341375c9550d2984281bcf9b990_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\3fxfflr.exec:\3fxfflr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\hhttbt.exec:\hhttbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\pjvpv.exec:\pjvpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\tbhhtt.exec:\tbhhtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\bbnnbb.exec:\bbnnbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\xxrrlrf.exec:\xxrrlrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\1llrfff.exec:\1llrfff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\hhbbhb.exec:\hhbbhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\djpvv.exec:\djpvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\5jjpj.exec:\5jjpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\xlrrrrf.exec:\xlrrrrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\bhtnhh.exec:\bhtnhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\pdpvd.exec:\pdpvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\ddjpv.exec:\ddjpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\xxlrffr.exec:\xxlrffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\bthhnn.exec:\bthhnn.exe17⤵
- Executes dropped EXE
PID:1052 -
\??\c:\3dpjp.exec:\3dpjp.exe18⤵
- Executes dropped EXE
PID:1908 -
\??\c:\jdvjp.exec:\jdvjp.exe19⤵
- Executes dropped EXE
PID:756 -
\??\c:\rlfrxfx.exec:\rlfrxfx.exe20⤵
- Executes dropped EXE
PID:1556 -
\??\c:\1bbbtt.exec:\1bbbtt.exe21⤵
- Executes dropped EXE
PID:2272 -
\??\c:\9vjjp.exec:\9vjjp.exe22⤵
- Executes dropped EXE
PID:3000 -
\??\c:\vvddd.exec:\vvddd.exe23⤵
- Executes dropped EXE
PID:2152 -
\??\c:\3rlxxfr.exec:\3rlxxfr.exe24⤵
- Executes dropped EXE
PID:776 -
\??\c:\ttntbh.exec:\ttntbh.exe25⤵
- Executes dropped EXE
PID:1488 -
\??\c:\hbhnnn.exec:\hbhnnn.exe26⤵
- Executes dropped EXE
PID:1808 -
\??\c:\vvpjv.exec:\vvpjv.exe27⤵
- Executes dropped EXE
PID:2000 -
\??\c:\frlfrfr.exec:\frlfrfr.exe28⤵
- Executes dropped EXE
PID:1980 -
\??\c:\3hnbnn.exec:\3hnbnn.exe29⤵
- Executes dropped EXE
PID:900 -
\??\c:\7djdv.exec:\7djdv.exe30⤵
- Executes dropped EXE
PID:2100 -
\??\c:\lfrflxf.exec:\lfrflxf.exe31⤵
- Executes dropped EXE
PID:1304 -
\??\c:\7rfrffx.exec:\7rfrffx.exe32⤵
- Executes dropped EXE
PID:2404 -
\??\c:\9bntbh.exec:\9bntbh.exe33⤵
- Executes dropped EXE
PID:1716 -
\??\c:\dpvvd.exec:\dpvvd.exe34⤵
- Executes dropped EXE
PID:3040 -
\??\c:\7dvdj.exec:\7dvdj.exe35⤵PID:2208
-
\??\c:\1xrxxxl.exec:\1xrxxxl.exe36⤵
- Executes dropped EXE
PID:1880 -
\??\c:\hntnhh.exec:\hntnhh.exe37⤵
- Executes dropped EXE
PID:2368 -
\??\c:\7hbnhn.exec:\7hbnhn.exe38⤵
- Executes dropped EXE
PID:2244 -
\??\c:\tttntb.exec:\tttntb.exe39⤵
- Executes dropped EXE
PID:2768 -
\??\c:\pjvjv.exec:\pjvjv.exe40⤵
- Executes dropped EXE
PID:2664 -
\??\c:\lflrxxl.exec:\lflrxxl.exe41⤵
- Executes dropped EXE
PID:2900 -
\??\c:\7frxxfl.exec:\7frxxfl.exe42⤵
- Executes dropped EXE
PID:2584 -
\??\c:\bhbhbn.exec:\bhbhbn.exe43⤵
- Executes dropped EXE
PID:2940 -
\??\c:\hhtbhn.exec:\hhtbhn.exe44⤵
- Executes dropped EXE
PID:2560 -
\??\c:\7jdpd.exec:\7jdpd.exe45⤵
- Executes dropped EXE
PID:2612 -
\??\c:\ddjpj.exec:\ddjpj.exe46⤵
- Executes dropped EXE
PID:3068 -
\??\c:\rrxxxfl.exec:\rrxxxfl.exe47⤵
- Executes dropped EXE
PID:1708 -
\??\c:\llxlxlx.exec:\llxlxlx.exe48⤵
- Executes dropped EXE
PID:2824 -
\??\c:\htbbbb.exec:\htbbbb.exe49⤵
- Executes dropped EXE
PID:2932 -
\??\c:\hhthtb.exec:\hhthtb.exe50⤵
- Executes dropped EXE
PID:2812 -
\??\c:\pjvvj.exec:\pjvvj.exe51⤵
- Executes dropped EXE
PID:1068 -
\??\c:\pjdjd.exec:\pjdjd.exe52⤵
- Executes dropped EXE
PID:1072 -
\??\c:\rrllflr.exec:\rrllflr.exe53⤵
- Executes dropped EXE
PID:1892 -
\??\c:\3lrrxxf.exec:\3lrrxxf.exe54⤵
- Executes dropped EXE
PID:1464 -
\??\c:\ttnhbn.exec:\ttnhbn.exe55⤵
- Executes dropped EXE
PID:2624 -
\??\c:\thhhhb.exec:\thhhhb.exe56⤵
- Executes dropped EXE
PID:1052 -
\??\c:\jpjvp.exec:\jpjvp.exe57⤵
- Executes dropped EXE
PID:1160 -
\??\c:\dvdpj.exec:\dvdpj.exe58⤵
- Executes dropped EXE
PID:1768 -
\??\c:\xfrflll.exec:\xfrflll.exe59⤵
- Executes dropped EXE
PID:2324 -
\??\c:\llrxflr.exec:\llrxflr.exe60⤵
- Executes dropped EXE
PID:1936 -
\??\c:\bhbbnn.exec:\bhbbnn.exe61⤵
- Executes dropped EXE
PID:3008 -
\??\c:\bthhhn.exec:\bthhhn.exe62⤵
- Executes dropped EXE
PID:264 -
\??\c:\jdpvj.exec:\jdpvj.exe63⤵
- Executes dropped EXE
PID:484 -
\??\c:\flrfrxl.exec:\flrfrxl.exe64⤵
- Executes dropped EXE
PID:1340 -
\??\c:\lfxfxfr.exec:\lfxfxfr.exe65⤵
- Executes dropped EXE
PID:1636 -
\??\c:\nnnbnt.exec:\nnnbnt.exe66⤵
- Executes dropped EXE
PID:852 -
\??\c:\bbhtnn.exec:\bbhtnn.exe67⤵PID:1548
-
\??\c:\vvjpd.exec:\vvjpd.exe68⤵PID:1820
-
\??\c:\jdjpv.exec:\jdjpv.exe69⤵PID:1640
-
\??\c:\lfrxlrf.exec:\lfrxlrf.exe70⤵PID:568
-
\??\c:\xfxrffr.exec:\xfxrffr.exe71⤵PID:2252
-
\??\c:\btnnbb.exec:\btnnbb.exe72⤵PID:988
-
\??\c:\ppdvj.exec:\ppdvj.exe73⤵PID:1348
-
\??\c:\dpdvv.exec:\dpdvv.exe74⤵PID:876
-
\??\c:\ffrfxxl.exec:\ffrfxxl.exe75⤵PID:1572
-
\??\c:\rrlxrrx.exec:\rrlxrrx.exe76⤵PID:1672
-
\??\c:\ttnthh.exec:\ttnthh.exe77⤵PID:1236
-
\??\c:\bbhbhb.exec:\bbhbhb.exe78⤵PID:2500
-
\??\c:\ppjvv.exec:\ppjvv.exe79⤵PID:1596
-
\??\c:\vpvdp.exec:\vpvdp.exe80⤵PID:2756
-
\??\c:\lrxlrlx.exec:\lrxlrlx.exe81⤵PID:2992
-
\??\c:\fxrrrrx.exec:\fxrrrrx.exe82⤵PID:2684
-
\??\c:\bnntbb.exec:\bnntbb.exe83⤵PID:2864
-
\??\c:\3dppv.exec:\3dppv.exe84⤵PID:2328
-
\??\c:\dpjdj.exec:\dpjdj.exe85⤵PID:2724
-
\??\c:\rrrxflx.exec:\rrrxflx.exe86⤵PID:2628
-
\??\c:\btnthn.exec:\btnthn.exe87⤵PID:1356
-
\??\c:\nhbnnh.exec:\nhbnnh.exe88⤵PID:2020
-
\??\c:\ppvvd.exec:\ppvvd.exe89⤵PID:2656
-
\??\c:\jdjjv.exec:\jdjjv.exe90⤵PID:2916
-
\??\c:\rfflxfr.exec:\rfflxfr.exe91⤵PID:2832
-
\??\c:\bttbtb.exec:\bttbtb.exe92⤵PID:2952
-
\??\c:\ttnhbb.exec:\ttnhbb.exe93⤵PID:1904
-
\??\c:\pdjjp.exec:\pdjjp.exe94⤵PID:1516
-
\??\c:\djdpp.exec:\djdpp.exe95⤵PID:2004
-
\??\c:\frllflx.exec:\frllflx.exe96⤵PID:3044
-
\??\c:\1frfrfr.exec:\1frfrfr.exe97⤵PID:2644
-
\??\c:\7nthbh.exec:\7nthbh.exe98⤵PID:752
-
\??\c:\nnnhht.exec:\nnnhht.exe99⤵PID:884
-
\??\c:\ddvjv.exec:\ddvjv.exe100⤵PID:2652
-
\??\c:\ddvvp.exec:\ddvvp.exe101⤵PID:2072
-
\??\c:\rrffrxf.exec:\rrffrxf.exe102⤵PID:3016
-
\??\c:\9htbtn.exec:\9htbtn.exe103⤵PID:2148
-
\??\c:\hntbbn.exec:\hntbbn.exe104⤵PID:544
-
\??\c:\vpvvd.exec:\vpvvd.exe105⤵PID:300
-
\??\c:\ppvdj.exec:\ppvdj.exe106⤵PID:776
-
\??\c:\ffflfrf.exec:\ffflfrf.exe107⤵PID:1488
-
\??\c:\5btbnt.exec:\5btbnt.exe108⤵PID:1952
-
\??\c:\tttbhh.exec:\tttbhh.exe109⤵PID:1968
-
\??\c:\jdjvd.exec:\jdjvd.exe110⤵PID:928
-
\??\c:\ffrxxfl.exec:\ffrxxfl.exe111⤵PID:2108
-
\??\c:\frlfflr.exec:\frlfflr.exe112⤵PID:1860
-
\??\c:\1htbhh.exec:\1htbhh.exe113⤵PID:2160
-
\??\c:\tntthh.exec:\tntthh.exe114⤵PID:1172
-
\??\c:\pjvvj.exec:\pjvvj.exe115⤵PID:1748
-
\??\c:\5pjpv.exec:\5pjpv.exe116⤵PID:3048
-
\??\c:\jvjdv.exec:\jvjdv.exe117⤵PID:1716
-
\??\c:\rxlflfr.exec:\rxlflfr.exe118⤵PID:1332
-
\??\c:\llrflrx.exec:\llrflrx.exe119⤵PID:2196
-
\??\c:\btttnn.exec:\btttnn.exe120⤵PID:1344
-
\??\c:\hhthnt.exec:\hhthnt.exe121⤵PID:2700
-
\??\c:\djpjp.exec:\djpjp.exe122⤵PID:1256
-
\??\c:\fxrlrrx.exec:\fxrlrrx.exe123⤵PID:2752
-
\??\c:\3lxfrrr.exec:\3lxfrrr.exe124⤵PID:2720
-
\??\c:\nhnthh.exec:\nhnthh.exe125⤵PID:2564
-
\??\c:\tnnhnh.exec:\tnnhnh.exe126⤵PID:2672
-
\??\c:\pdpjj.exec:\pdpjj.exe127⤵PID:2744
-
\??\c:\5jvjd.exec:\5jvjd.exe128⤵PID:2620
-
\??\c:\7xllrxl.exec:\7xllrxl.exe129⤵PID:2092
-
\??\c:\rrlflrx.exec:\rrlflrx.exe130⤵PID:1212
-
\??\c:\bbttnn.exec:\bbttnn.exe131⤵PID:2904
-
\??\c:\hhtnht.exec:\hhtnht.exe132⤵PID:2796
-
\??\c:\vvjvd.exec:\vvjvd.exe133⤵PID:1048
-
\??\c:\5vdjd.exec:\5vdjd.exe134⤵PID:1724
-
\??\c:\xrfrffr.exec:\xrfrffr.exe135⤵PID:1068
-
\??\c:\fflllxf.exec:\fflllxf.exe136⤵PID:2212
-
\??\c:\5tnnbh.exec:\5tnnbh.exe137⤵PID:1892
-
\??\c:\5ppjp.exec:\5ppjp.exe138⤵PID:1728
-
\??\c:\rlfffrf.exec:\rlfffrf.exe139⤵PID:2624
-
\??\c:\xlllxxl.exec:\xlllxxl.exe140⤵PID:1764
-
\??\c:\bbthtb.exec:\bbthtb.exe141⤵PID:2268
-
\??\c:\9nnnbh.exec:\9nnnbh.exe142⤵PID:2332
-
\??\c:\vpdpd.exec:\vpdpd.exe143⤵PID:2272
-
\??\c:\rrlxllx.exec:\rrlxllx.exe144⤵PID:2540
-
\??\c:\lrlxxfr.exec:\lrlxxfr.exe145⤵PID:3000
-
\??\c:\bbnnnb.exec:\bbnnnb.exe146⤵PID:3012
-
\??\c:\7jvdj.exec:\7jvdj.exe147⤵PID:1308
-
\??\c:\9vjpd.exec:\9vjpd.exe148⤵PID:3064
-
\??\c:\1fflfll.exec:\1fflfll.exe149⤵PID:1732
-
\??\c:\rfrxffx.exec:\rfrxffx.exe150⤵PID:2000
-
\??\c:\5bnnnn.exec:\5bnnnn.exe151⤵PID:1816
-
\??\c:\tnnbtb.exec:\tnnbtb.exe152⤵PID:832
-
\??\c:\djvvv.exec:\djvvv.exe153⤵PID:1640
-
\??\c:\llxrxxf.exec:\llxrxxf.exe154⤵PID:2256
-
\??\c:\9ffrflf.exec:\9ffrflf.exe155⤵PID:2160
-
\??\c:\tbbtth.exec:\tbbtth.exe156⤵PID:2104
-
\??\c:\vddjd.exec:\vddjd.exe157⤵PID:1992
-
\??\c:\vjdpj.exec:\vjdpj.exe158⤵PID:268
-
\??\c:\flfrflx.exec:\flfrflx.exe159⤵PID:2176
-
\??\c:\xlxfrfr.exec:\xlxfrfr.exe160⤵PID:2372
-
\??\c:\hnnhth.exec:\hnnhth.exe161⤵PID:2668
-
\??\c:\bbbnht.exec:\bbbnht.exe162⤵PID:2500
-
\??\c:\9jjdp.exec:\9jjdp.exe163⤵PID:2244
-
\??\c:\dpppv.exec:\dpppv.exe164⤵PID:2716
-
\??\c:\ffxxrff.exec:\ffxxrff.exe165⤵PID:2688
-
\??\c:\rfxlrfl.exec:\rfxlrfl.exe166⤵PID:2580
-
\??\c:\ntttbb.exec:\ntttbb.exe167⤵PID:2864
-
\??\c:\nbhhtt.exec:\nbhhtt.exe168⤵PID:2940
-
\??\c:\jdpdp.exec:\jdpdp.exe169⤵PID:1668
-
\??\c:\9jvjp.exec:\9jvjp.exe170⤵PID:2608
-
\??\c:\ffrfflx.exec:\ffrfflx.exe171⤵PID:1356
-
\??\c:\lrfxffr.exec:\lrfxffr.exe172⤵PID:1700
-
\??\c:\ttthbh.exec:\ttthbh.exe173⤵PID:2944
-
\??\c:\ttnhtn.exec:\ttnhtn.exe174⤵PID:2804
-
\??\c:\jpvjv.exec:\jpvjv.exe175⤵PID:2832
-
\??\c:\jpdpp.exec:\jpdpp.exe176⤵PID:1900
-
\??\c:\rlxrfrf.exec:\rlxrfrf.exe177⤵PID:1924
-
\??\c:\xrxlflf.exec:\xrxlflf.exe178⤵PID:1896
-
\??\c:\7nnhnb.exec:\7nnhnb.exe179⤵PID:2004
-
\??\c:\ttntbh.exec:\ttntbh.exe180⤵PID:2828
-
\??\c:\vjjdv.exec:\vjjdv.exe181⤵PID:356
-
\??\c:\ppjpv.exec:\ppjpv.exe182⤵PID:804
-
\??\c:\xrrlrxx.exec:\xrrlrxx.exe183⤵PID:2140
-
\??\c:\dvvjd.exec:\dvvjd.exe184⤵PID:2652
-
\??\c:\1pppv.exec:\1pppv.exe185⤵PID:1612
-
\??\c:\9frlrxl.exec:\9frlrxl.exe186⤵PID:536
-
\??\c:\tnnbnt.exec:\tnnbnt.exe187⤵PID:2148
-
\??\c:\hnntbh.exec:\hnntbh.exe188⤵PID:1604
-
\??\c:\vvpdp.exec:\vvpdp.exe189⤵PID:1500
-
\??\c:\djdjj.exec:\djdjj.exe190⤵PID:572
-
\??\c:\5fxlxlx.exec:\5fxlxlx.exe191⤵PID:1140
-
\??\c:\bbntnb.exec:\bbntnb.exe192⤵PID:1548
-
\??\c:\bbtbhn.exec:\bbtbhn.exe193⤵PID:352
-
\??\c:\7jdpv.exec:\7jdpv.exe194⤵PID:1520
-
\??\c:\jjdvp.exec:\jjdvp.exe195⤵PID:1712
-
\??\c:\rrrlrfr.exec:\rrrlrfr.exe196⤵PID:280
-
\??\c:\3flxffl.exec:\3flxffl.exe197⤵PID:1616
-
\??\c:\hbnntt.exec:\hbnntt.exe198⤵PID:2164
-
\??\c:\djjpd.exec:\djjpd.exe199⤵PID:2216
-
\??\c:\pvjdj.exec:\pvjdj.exe200⤵PID:1572
-
\??\c:\xrrrxxl.exec:\xrrrxxl.exe201⤵PID:1672
-
\??\c:\3frfrxr.exec:\3frfrxr.exe202⤵PID:2496
-
\??\c:\bnhnnb.exec:\bnhnnb.exe203⤵PID:1568
-
\??\c:\hbtntt.exec:\hbtntt.exe204⤵PID:2748
-
\??\c:\5ppvp.exec:\5ppvp.exe205⤵PID:2756
-
\??\c:\7jpjp.exec:\7jpjp.exe206⤵PID:2992
-
\??\c:\rlxxxfl.exec:\rlxxxfl.exe207⤵PID:2188
-
\??\c:\xxlrlxl.exec:\xxlrlxl.exe208⤵PID:2696
-
\??\c:\tnbbbb.exec:\tnbbbb.exe209⤵PID:2732
-
\??\c:\httthn.exec:\httthn.exe210⤵PID:2444
-
\??\c:\pdvjj.exec:\pdvjj.exe211⤵PID:2588
-
\??\c:\xrfrflx.exec:\xrfrflx.exe212⤵PID:1756
-
\??\c:\fxfflfx.exec:\fxfflfx.exe213⤵PID:2784
-
\??\c:\nhhhbn.exec:\nhhhbn.exe214⤵PID:1212
-
\??\c:\jjvjj.exec:\jjvjj.exe215⤵PID:2924
-
\??\c:\dpdvj.exec:\dpdvj.exe216⤵PID:1824
-
\??\c:\lllfrff.exec:\lllfrff.exe217⤵PID:2956
-
\??\c:\rxxffrf.exec:\rxxffrf.exe218⤵PID:2440
-
\??\c:\hhhnnt.exec:\hhhnnt.exe219⤵PID:272
-
\??\c:\9hntbh.exec:\9hntbh.exe220⤵PID:2544
-
\??\c:\jjdvd.exec:\jjdvd.exe221⤵PID:1652
-
\??\c:\jjvjj.exec:\jjvjj.exe222⤵PID:2644
-
\??\c:\rrxlxlf.exec:\rrxlxlf.exe223⤵PID:304
-
\??\c:\btnhtt.exec:\btnhtt.exe224⤵PID:468
-
\??\c:\7nbhth.exec:\7nbhth.exe225⤵PID:1376
-
\??\c:\pvdpp.exec:\pvdpp.exe226⤵PID:2072
-
\??\c:\ppjvj.exec:\ppjvj.exe227⤵PID:3016
-
\??\c:\rfrfllr.exec:\rfrfllr.exe228⤵PID:264
-
\??\c:\3lrllrr.exec:\3lrllrr.exe229⤵PID:1888
-
\??\c:\9tnnnt.exec:\9tnnnt.exe230⤵PID:1032
-
\??\c:\9nbtnt.exec:\9nbtnt.exe231⤵PID:720
-
\??\c:\vjpjp.exec:\vjpjp.exe232⤵PID:2436
-
\??\c:\pjdpv.exec:\pjdpv.exe233⤵PID:1488
-
\??\c:\lfffrrx.exec:\lfffrrx.exe234⤵PID:1532
-
\??\c:\llxxllr.exec:\llxxllr.exe235⤵PID:1608
-
\??\c:\nbnhhn.exec:\nbnhhn.exe236⤵PID:1820
-
\??\c:\djvpv.exec:\djvpv.exe237⤵PID:2276
-
\??\c:\pjvdp.exec:\pjvdp.exe238⤵PID:568
-
\??\c:\5lllflr.exec:\5lllflr.exe239⤵PID:2192
-
\??\c:\rrfrlrf.exec:\rrfrlrf.exe240⤵PID:2016
-
\??\c:\nhbntn.exec:\nhbntn.exe241⤵PID:2404
-
\??\c:\vpjjd.exec:\vpjjd.exe242⤵PID:2636