Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 17:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
207d8ca67164cef29cfa5c69097d4d80_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
207d8ca67164cef29cfa5c69097d4d80_NeikiAnalytics.exe
-
Size
335KB
-
MD5
207d8ca67164cef29cfa5c69097d4d80
-
SHA1
6b2ca4a131ce1d8728a06f2d4065c87e8e06b226
-
SHA256
03aa75289f7ac11f50304de19ed58cfa67ee7afcc1253e1f2371beb17396d6b0
-
SHA512
13db6af9349d8e8b4e63a79c79235be9d158db45edb0d64002629547c0734c2c3a40d4491d5709221e2344b571f8814d6e0b227941c1bce87ada8c4ea536cc1c
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp99zm+/KZBHqnuOeHzmB600TUA6Z7zupc+BT:n3C9BRo7tvnJ99T/KZEuOod00TG+BT
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/2040-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2292-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1164-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1972-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1656-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1976-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/668-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/600-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2104-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1644-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1352-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1044-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
frllffr.exethntbh.exerlfrxfl.exehbnnbb.exejddjv.exelfrrxxl.exeppppp.exepdppv.exetthnth.exedvjjj.exe5rrxlxl.exettbthn.exepvvdv.exe9rrxxxx.exebntnnt.exethnhhn.exe5rxrlxl.exebtnhtn.exedvpvv.exe1frlfll.exethnnnt.exe1btbtb.exexrrfxlr.exexllrllr.exehbbbnt.exepdppv.exe3hbthh.exepjvdd.exerxrflxf.exebthnbb.exejdpvj.exe3lrlffr.exenhhtbb.exe7jppp.exefxlxfll.exe1flllll.exenbhhhh.exejdvvd.exepjppv.exexxxlrxl.exe5bhhtt.exenbhhhn.exejdvdp.exelfrlrxf.exebtnthn.exevvdpd.exepdjpd.exe7fxlxxl.exe1ttnbb.exejdjpv.exe3llrlrl.exerrfxrfr.exennbhnt.exevvjvp.exe3xxflrf.exe3lfrxlx.exenhbhnb.exe9thtbn.exedjvdd.exelrrfllf.exerllxrxl.exe5htbhb.exejvpjp.exe7rlffxl.exepid process 3028 frllffr.exe 2724 thntbh.exe 2664 rlfrxfl.exe 2292 hbnnbb.exe 1164 jddjv.exe 2620 lfrrxxl.exe 2708 ppppp.exe 2564 pdppv.exe 2908 tthnth.exe 2512 dvjjj.exe 2744 5rrxlxl.exe 1972 ttbthn.exe 1796 pvvdv.exe 1656 9rrxxxx.exe 1976 bntnnt.exe 2172 thnhhn.exe 668 5rxrlxl.exe 636 btnhtn.exe 2272 dvpvv.exe 1952 1frlfll.exe 2424 thnnnt.exe 600 1btbtb.exe 1496 xrrfxlr.exe 2104 xllrllr.exe 1644 hbbbnt.exe 1352 pdppv.exe 1044 3hbthh.exe 572 pjvdd.exe 2156 rxrflxf.exe 2184 bthnbb.exe 876 jdpvj.exe 2340 3lrlffr.exe 1700 nhhtbb.exe 1728 7jppp.exe 2584 fxlxfll.exe 2648 1flllll.exe 2596 nbhhhh.exe 2548 jdvvd.exe 2452 pjppv.exe 2472 xxxlrxl.exe 2780 5bhhtt.exe 2456 nbhhhn.exe 2708 jdvdp.exe 2032 lfrlrxf.exe 1904 btnthn.exe 2668 vvdpd.exe 2760 pdjpd.exe 2884 7fxlxxl.exe 1712 1ttnbb.exe 816 jdjpv.exe 1892 3llrlrl.exe 2324 rrfxrfr.exe 1588 nnbhnt.exe 1628 vvjvp.exe 1528 3xxflrf.exe 1772 3lfrxlx.exe 2108 nhbhnb.exe 2260 9thtbn.exe 2840 djvdd.exe 2376 lrrfllf.exe 336 rllxrxl.exe 588 5htbhb.exe 644 jvpjp.exe 1480 7rlffxl.exe -
Processes:
resource yara_rule behavioral1/memory/2040-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1164-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1972-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1656-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/668-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/600-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2104-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1644-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1352-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1044-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-282-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
207d8ca67164cef29cfa5c69097d4d80_NeikiAnalytics.exefrllffr.exethntbh.exerlfrxfl.exehbnnbb.exejddjv.exelfrrxxl.exeppppp.exepdppv.exetthnth.exedvjjj.exe5rrxlxl.exettbthn.exepvvdv.exe9rrxxxx.exebntnnt.exedescription pid process target process PID 2040 wrote to memory of 3028 2040 207d8ca67164cef29cfa5c69097d4d80_NeikiAnalytics.exe frllffr.exe PID 2040 wrote to memory of 3028 2040 207d8ca67164cef29cfa5c69097d4d80_NeikiAnalytics.exe frllffr.exe PID 2040 wrote to memory of 3028 2040 207d8ca67164cef29cfa5c69097d4d80_NeikiAnalytics.exe frllffr.exe PID 2040 wrote to memory of 3028 2040 207d8ca67164cef29cfa5c69097d4d80_NeikiAnalytics.exe frllffr.exe PID 3028 wrote to memory of 2724 3028 frllffr.exe thntbh.exe PID 3028 wrote to memory of 2724 3028 frllffr.exe thntbh.exe PID 3028 wrote to memory of 2724 3028 frllffr.exe thntbh.exe PID 3028 wrote to memory of 2724 3028 frllffr.exe thntbh.exe PID 2724 wrote to memory of 2664 2724 thntbh.exe rlfrxfl.exe PID 2724 wrote to memory of 2664 2724 thntbh.exe rlfrxfl.exe PID 2724 wrote to memory of 2664 2724 thntbh.exe rlfrxfl.exe PID 2724 wrote to memory of 2664 2724 thntbh.exe rlfrxfl.exe PID 2664 wrote to memory of 2292 2664 rlfrxfl.exe hbnnbb.exe PID 2664 wrote to memory of 2292 2664 rlfrxfl.exe hbnnbb.exe PID 2664 wrote to memory of 2292 2664 rlfrxfl.exe hbnnbb.exe PID 2664 wrote to memory of 2292 2664 rlfrxfl.exe hbnnbb.exe PID 2292 wrote to memory of 1164 2292 hbnnbb.exe jddjv.exe PID 2292 wrote to memory of 1164 2292 hbnnbb.exe jddjv.exe PID 2292 wrote to memory of 1164 2292 hbnnbb.exe jddjv.exe PID 2292 wrote to memory of 1164 2292 hbnnbb.exe jddjv.exe PID 1164 wrote to memory of 2620 1164 jddjv.exe lfrrxxl.exe PID 1164 wrote to memory of 2620 1164 jddjv.exe lfrrxxl.exe PID 1164 wrote to memory of 2620 1164 jddjv.exe lfrrxxl.exe PID 1164 wrote to memory of 2620 1164 jddjv.exe lfrrxxl.exe PID 2620 wrote to memory of 2708 2620 lfrrxxl.exe ppppp.exe PID 2620 wrote to memory of 2708 2620 lfrrxxl.exe ppppp.exe PID 2620 wrote to memory of 2708 2620 lfrrxxl.exe ppppp.exe PID 2620 wrote to memory of 2708 2620 lfrrxxl.exe ppppp.exe PID 2708 wrote to memory of 2564 2708 ppppp.exe pdppv.exe PID 2708 wrote to memory of 2564 2708 ppppp.exe pdppv.exe PID 2708 wrote to memory of 2564 2708 ppppp.exe pdppv.exe PID 2708 wrote to memory of 2564 2708 ppppp.exe pdppv.exe PID 2564 wrote to memory of 2908 2564 pdppv.exe tthnth.exe PID 2564 wrote to memory of 2908 2564 pdppv.exe tthnth.exe PID 2564 wrote to memory of 2908 2564 pdppv.exe tthnth.exe PID 2564 wrote to memory of 2908 2564 pdppv.exe tthnth.exe PID 2908 wrote to memory of 2512 2908 tthnth.exe dvjjj.exe PID 2908 wrote to memory of 2512 2908 tthnth.exe dvjjj.exe PID 2908 wrote to memory of 2512 2908 tthnth.exe dvjjj.exe PID 2908 wrote to memory of 2512 2908 tthnth.exe dvjjj.exe PID 2512 wrote to memory of 2744 2512 dvjjj.exe 5rrxlxl.exe PID 2512 wrote to memory of 2744 2512 dvjjj.exe 5rrxlxl.exe PID 2512 wrote to memory of 2744 2512 dvjjj.exe 5rrxlxl.exe PID 2512 wrote to memory of 2744 2512 dvjjj.exe 5rrxlxl.exe PID 2744 wrote to memory of 1972 2744 5rrxlxl.exe ttbthn.exe PID 2744 wrote to memory of 1972 2744 5rrxlxl.exe ttbthn.exe PID 2744 wrote to memory of 1972 2744 5rrxlxl.exe ttbthn.exe PID 2744 wrote to memory of 1972 2744 5rrxlxl.exe ttbthn.exe PID 1972 wrote to memory of 1796 1972 ttbthn.exe pvvdv.exe PID 1972 wrote to memory of 1796 1972 ttbthn.exe pvvdv.exe PID 1972 wrote to memory of 1796 1972 ttbthn.exe pvvdv.exe PID 1972 wrote to memory of 1796 1972 ttbthn.exe pvvdv.exe PID 1796 wrote to memory of 1656 1796 pvvdv.exe 9rrxxxx.exe PID 1796 wrote to memory of 1656 1796 pvvdv.exe 9rrxxxx.exe PID 1796 wrote to memory of 1656 1796 pvvdv.exe 9rrxxxx.exe PID 1796 wrote to memory of 1656 1796 pvvdv.exe 9rrxxxx.exe PID 1656 wrote to memory of 1976 1656 9rrxxxx.exe bntnnt.exe PID 1656 wrote to memory of 1976 1656 9rrxxxx.exe bntnnt.exe PID 1656 wrote to memory of 1976 1656 9rrxxxx.exe bntnnt.exe PID 1656 wrote to memory of 1976 1656 9rrxxxx.exe bntnnt.exe PID 1976 wrote to memory of 2172 1976 bntnnt.exe thnhhn.exe PID 1976 wrote to memory of 2172 1976 bntnnt.exe thnhhn.exe PID 1976 wrote to memory of 2172 1976 bntnnt.exe thnhhn.exe PID 1976 wrote to memory of 2172 1976 bntnnt.exe thnhhn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\207d8ca67164cef29cfa5c69097d4d80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\207d8ca67164cef29cfa5c69097d4d80_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\frllffr.exec:\frllffr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\thntbh.exec:\thntbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\rlfrxfl.exec:\rlfrxfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\hbnnbb.exec:\hbnnbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\jddjv.exec:\jddjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\lfrrxxl.exec:\lfrrxxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\ppppp.exec:\ppppp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\pdppv.exec:\pdppv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\tthnth.exec:\tthnth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\dvjjj.exec:\dvjjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\5rrxlxl.exec:\5rrxlxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\ttbthn.exec:\ttbthn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\pvvdv.exec:\pvvdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\9rrxxxx.exec:\9rrxxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\bntnnt.exec:\bntnnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\thnhhn.exec:\thnhhn.exe17⤵
- Executes dropped EXE
PID:2172 -
\??\c:\5rxrlxl.exec:\5rxrlxl.exe18⤵
- Executes dropped EXE
PID:668 -
\??\c:\btnhtn.exec:\btnhtn.exe19⤵
- Executes dropped EXE
PID:636 -
\??\c:\dvpvv.exec:\dvpvv.exe20⤵
- Executes dropped EXE
PID:2272 -
\??\c:\1frlfll.exec:\1frlfll.exe21⤵
- Executes dropped EXE
PID:1952 -
\??\c:\thnnnt.exec:\thnnnt.exe22⤵
- Executes dropped EXE
PID:2424 -
\??\c:\1btbtb.exec:\1btbtb.exe23⤵
- Executes dropped EXE
PID:600 -
\??\c:\xrrfxlr.exec:\xrrfxlr.exe24⤵
- Executes dropped EXE
PID:1496 -
\??\c:\xllrllr.exec:\xllrllr.exe25⤵
- Executes dropped EXE
PID:2104 -
\??\c:\hbbbnt.exec:\hbbbnt.exe26⤵
- Executes dropped EXE
PID:1644 -
\??\c:\pdppv.exec:\pdppv.exe27⤵
- Executes dropped EXE
PID:1352 -
\??\c:\3hbthh.exec:\3hbthh.exe28⤵
- Executes dropped EXE
PID:1044 -
\??\c:\pjvdd.exec:\pjvdd.exe29⤵
- Executes dropped EXE
PID:572 -
\??\c:\rxrflxf.exec:\rxrflxf.exe30⤵
- Executes dropped EXE
PID:2156 -
\??\c:\bthnbb.exec:\bthnbb.exe31⤵
- Executes dropped EXE
PID:2184 -
\??\c:\jdpvj.exec:\jdpvj.exe32⤵
- Executes dropped EXE
PID:876 -
\??\c:\3lrlffr.exec:\3lrlffr.exe33⤵
- Executes dropped EXE
PID:2340 -
\??\c:\nhhtbb.exec:\nhhtbb.exe34⤵
- Executes dropped EXE
PID:1700 -
\??\c:\7jppp.exec:\7jppp.exe35⤵
- Executes dropped EXE
PID:1728 -
\??\c:\fxlxfll.exec:\fxlxfll.exe36⤵
- Executes dropped EXE
PID:2584 -
\??\c:\1flllll.exec:\1flllll.exe37⤵
- Executes dropped EXE
PID:2648 -
\??\c:\nbhhhh.exec:\nbhhhh.exe38⤵
- Executes dropped EXE
PID:2596 -
\??\c:\jdvvd.exec:\jdvvd.exe39⤵
- Executes dropped EXE
PID:2548 -
\??\c:\pjppv.exec:\pjppv.exe40⤵
- Executes dropped EXE
PID:2452 -
\??\c:\xxxlrxl.exec:\xxxlrxl.exe41⤵
- Executes dropped EXE
PID:2472 -
\??\c:\5bhhtt.exec:\5bhhtt.exe42⤵
- Executes dropped EXE
PID:2780 -
\??\c:\nbhhhn.exec:\nbhhhn.exe43⤵
- Executes dropped EXE
PID:2456 -
\??\c:\jdvdp.exec:\jdvdp.exe44⤵
- Executes dropped EXE
PID:2708 -
\??\c:\lfrlrxf.exec:\lfrlrxf.exe45⤵
- Executes dropped EXE
PID:2032 -
\??\c:\btnthn.exec:\btnthn.exe46⤵
- Executes dropped EXE
PID:1904 -
\??\c:\vvdpd.exec:\vvdpd.exe47⤵
- Executes dropped EXE
PID:2668 -
\??\c:\pdjpd.exec:\pdjpd.exe48⤵
- Executes dropped EXE
PID:2760 -
\??\c:\7fxlxxl.exec:\7fxlxxl.exe49⤵
- Executes dropped EXE
PID:2884 -
\??\c:\1ttnbb.exec:\1ttnbb.exe50⤵
- Executes dropped EXE
PID:1712 -
\??\c:\jdjpv.exec:\jdjpv.exe51⤵
- Executes dropped EXE
PID:816 -
\??\c:\3llrlrl.exec:\3llrlrl.exe52⤵
- Executes dropped EXE
PID:1892 -
\??\c:\rrfxrfr.exec:\rrfxrfr.exe53⤵
- Executes dropped EXE
PID:2324 -
\??\c:\nnbhnt.exec:\nnbhnt.exe54⤵
- Executes dropped EXE
PID:1588 -
\??\c:\vvjvp.exec:\vvjvp.exe55⤵
- Executes dropped EXE
PID:1628 -
\??\c:\3xxflrf.exec:\3xxflrf.exe56⤵
- Executes dropped EXE
PID:1528 -
\??\c:\3lfrxlx.exec:\3lfrxlx.exe57⤵
- Executes dropped EXE
PID:1772 -
\??\c:\nhbhnb.exec:\nhbhnb.exe58⤵
- Executes dropped EXE
PID:2108 -
\??\c:\9thtbn.exec:\9thtbn.exe59⤵
- Executes dropped EXE
PID:2260 -
\??\c:\djvdd.exec:\djvdd.exe60⤵
- Executes dropped EXE
PID:2840 -
\??\c:\lrrfllf.exec:\lrrfllf.exe61⤵
- Executes dropped EXE
PID:2376 -
\??\c:\rllxrxl.exec:\rllxrxl.exe62⤵
- Executes dropped EXE
PID:336 -
\??\c:\5htbhb.exec:\5htbhb.exe63⤵
- Executes dropped EXE
PID:588 -
\??\c:\jvpjp.exec:\jvpjp.exe64⤵
- Executes dropped EXE
PID:644 -
\??\c:\7rlffxl.exec:\7rlffxl.exe65⤵
- Executes dropped EXE
PID:1480 -
\??\c:\fflflrr.exec:\fflflrr.exe66⤵PID:776
-
\??\c:\btnbnb.exec:\btnbnb.exe67⤵PID:2128
-
\??\c:\vpvjd.exec:\vpvjd.exe68⤵PID:1640
-
\??\c:\ppdpd.exec:\ppdpd.exe69⤵PID:908
-
\??\c:\3llxllx.exec:\3llxllx.exe70⤵PID:2024
-
\??\c:\hbttbh.exec:\hbttbh.exe71⤵PID:2176
-
\??\c:\9djpp.exec:\9djpp.exe72⤵PID:996
-
\??\c:\xrffrxl.exec:\xrffrxl.exe73⤵PID:2184
-
\??\c:\rrrxflx.exec:\rrrxflx.exe74⤵PID:1096
-
\??\c:\1hthth.exec:\1hthth.exe75⤵PID:1736
-
\??\c:\hbtnbn.exec:\hbtnbn.exe76⤵PID:1604
-
\??\c:\jjjdd.exec:\jjjdd.exe77⤵PID:2624
-
\??\c:\lxllrxf.exec:\lxllrxf.exe78⤵PID:2720
-
\??\c:\nbbbhn.exec:\nbbbhn.exe79⤵PID:2724
-
\??\c:\tnbhhn.exec:\tnbhhn.exe80⤵PID:2672
-
\??\c:\dvpjj.exec:\dvpjj.exe81⤵PID:2960
-
\??\c:\pddvv.exec:\pddvv.exe82⤵PID:2716
-
\??\c:\xrfxrrr.exec:\xrfxrrr.exe83⤵PID:2356
-
\??\c:\ttnbhh.exec:\ttnbhh.exe84⤵PID:2468
-
\??\c:\btntbb.exec:\btntbb.exe85⤵PID:2496
-
\??\c:\ppddv.exec:\ppddv.exe86⤵PID:2712
-
\??\c:\1lfrllx.exec:\1lfrllx.exe87⤵PID:2904
-
\??\c:\hhtthb.exec:\hhtthb.exe88⤵PID:1768
-
\??\c:\bththh.exec:\bththh.exe89⤵PID:2504
-
\??\c:\vvpdp.exec:\vvpdp.exe90⤵PID:2792
-
\??\c:\xxxfflr.exec:\xxxfflr.exe91⤵PID:2208
-
\??\c:\tnthnb.exec:\tnthnb.exe92⤵PID:1960
-
\??\c:\hbtbht.exec:\hbtbht.exe93⤵PID:1796
-
\??\c:\7jvvj.exec:\7jvvj.exe94⤵PID:312
-
\??\c:\pjdjv.exec:\pjdjv.exe95⤵PID:1980
-
\??\c:\xrllrxr.exec:\xrllrxr.exe96⤵PID:1716
-
\??\c:\lllxflr.exec:\lllxflr.exe97⤵PID:2396
-
\??\c:\nnnbhn.exec:\nnnbhn.exe98⤵PID:2120
-
\??\c:\pjvdj.exec:\pjvdj.exe99⤵PID:1708
-
\??\c:\pjddd.exec:\pjddd.exe100⤵PID:636
-
\??\c:\fxrrlfl.exec:\fxrrlfl.exe101⤵PID:2828
-
\??\c:\7bntbb.exec:\7bntbb.exe102⤵PID:2076
-
\??\c:\1btbhn.exec:\1btbhn.exe103⤵PID:2844
-
\??\c:\jdjdj.exec:\jdjdj.exe104⤵PID:1172
-
\??\c:\3rlxlrx.exec:\3rlxlrx.exe105⤵PID:1112
-
\??\c:\hbhnnb.exec:\hbhnnb.exe106⤵PID:1660
-
\??\c:\3bhthh.exec:\3bhthh.exe107⤵PID:2104
-
\??\c:\vjvvj.exec:\vjvvj.exe108⤵PID:1644
-
\??\c:\vppdj.exec:\vppdj.exe109⤵PID:1028
-
\??\c:\xrrrffl.exec:\xrrrffl.exe110⤵PID:1048
-
\??\c:\nnbtbh.exec:\nnbtbh.exe111⤵PID:852
-
\??\c:\hbbhtb.exec:\hbbhtb.exe112⤵PID:3040
-
\??\c:\jjjvd.exec:\jjjvd.exe113⤵PID:2312
-
\??\c:\rlfxfff.exec:\rlfxfff.exe114⤵PID:888
-
\??\c:\xlxxrxr.exec:\xlxxrxr.exe115⤵PID:2344
-
\??\c:\tnhntt.exec:\tnhntt.exe116⤵PID:2040
-
\??\c:\1vpjp.exec:\1vpjp.exe117⤵PID:1600
-
\??\c:\7vpjj.exec:\7vpjj.exe118⤵PID:2028
-
\??\c:\9lflflf.exec:\9lflflf.exe119⤵PID:2640
-
\??\c:\tnhnbb.exec:\tnhnbb.exe120⤵PID:2676
-
\??\c:\tbtntt.exec:\tbtntt.exe121⤵PID:2552
-
\??\c:\ddjdj.exec:\ddjdj.exe122⤵PID:2700
-
\??\c:\llxfrxl.exec:\llxfrxl.exe123⤵PID:2816
-
\??\c:\1xfrrlr.exec:\1xfrrlr.exe124⤵PID:1164
-
\??\c:\tnbhhn.exec:\tnbhhn.exe125⤵PID:2608
-
\??\c:\vvjvj.exec:\vvjvj.exe126⤵PID:2360
-
\??\c:\pdjdp.exec:\pdjdp.exe127⤵PID:2940
-
\??\c:\lxfxrlx.exec:\lxfxrlx.exe128⤵PID:768
-
\??\c:\7lxxxfl.exec:\7lxxxfl.exe129⤵PID:2420
-
\??\c:\3bnbht.exec:\3bnbht.exe130⤵PID:2544
-
\??\c:\vvvjp.exec:\vvvjp.exe131⤵PID:2512
-
\??\c:\3vdjp.exec:\3vdjp.exe132⤵PID:2872
-
\??\c:\9fxfrxx.exec:\9fxfrxx.exe133⤵PID:2884
-
\??\c:\tttttt.exec:\tttttt.exe134⤵PID:1712
-
\??\c:\bbnntt.exec:\bbnntt.exe135⤵PID:1720
-
\??\c:\5vpjp.exec:\5vpjp.exe136⤵PID:1912
-
\??\c:\1xlrxlx.exec:\1xlrxlx.exe137⤵PID:2164
-
\??\c:\lxflllf.exec:\lxflllf.exe138⤵PID:1204
-
\??\c:\9httbb.exec:\9httbb.exe139⤵PID:820
-
\??\c:\7dvvj.exec:\7dvvj.exe140⤵PID:2236
-
\??\c:\dvjpd.exec:\dvjpd.exe141⤵PID:2280
-
\??\c:\rrlrffr.exec:\rrlrffr.exe142⤵PID:2108
-
\??\c:\tnbhhh.exec:\tnbhhh.exe143⤵PID:1952
-
\??\c:\lxlrxff.exec:\lxlrxff.exe144⤵PID:2424
-
\??\c:\5thnhh.exec:\5thnhh.exe145⤵PID:536
-
\??\c:\vpddp.exec:\vpddp.exe146⤵PID:1104
-
\??\c:\pjdjp.exec:\pjdjp.exe147⤵PID:2484
-
\??\c:\xrxfxfl.exec:\xrxfxfl.exe148⤵PID:2068
-
\??\c:\nttbth.exec:\nttbth.exe149⤵PID:916
-
\??\c:\tnhntn.exec:\tnhntn.exe150⤵PID:1056
-
\??\c:\vdjvd.exec:\vdjvd.exe151⤵PID:2788
-
\??\c:\flrrrrl.exec:\flrrrrl.exe152⤵PID:2868
-
\??\c:\frflxfr.exec:\frflxfr.exe153⤵PID:1424
-
\??\c:\nbhbbh.exec:\nbhbbh.exe154⤵PID:3016
-
\??\c:\pjddv.exec:\pjddv.exe155⤵PID:1392
-
\??\c:\3pdjp.exec:\3pdjp.exe156⤵PID:1400
-
\??\c:\lxrrfff.exec:\lxrrfff.exe157⤵PID:2880
-
\??\c:\9fxlflr.exec:\9fxlflr.exe158⤵PID:2340
-
\??\c:\7nbtbh.exec:\7nbtbh.exe159⤵PID:1584
-
\??\c:\htnthn.exec:\htnthn.exe160⤵PID:1060
-
\??\c:\jpvdj.exec:\jpvdj.exe161⤵PID:2588
-
\??\c:\lfxllrx.exec:\lfxllrx.exe162⤵PID:3060
-
\??\c:\bbhthn.exec:\bbhthn.exe163⤵PID:2576
-
\??\c:\hbntbb.exec:\hbntbb.exe164⤵PID:2980
-
\??\c:\jvjjj.exec:\jvjjj.exe165⤵PID:2452
-
\??\c:\vjdjp.exec:\vjdjp.exe166⤵PID:2628
-
\??\c:\1lfrxlx.exec:\1lfrxlx.exe167⤵PID:2780
-
\??\c:\9nhhnt.exec:\9nhhnt.exe168⤵PID:2492
-
\??\c:\1bthth.exec:\1bthth.exe169⤵PID:2508
-
\??\c:\vpddv.exec:\vpddv.exe170⤵PID:1672
-
\??\c:\llflxfl.exec:\llflxfl.exe171⤵PID:1904
-
\??\c:\1btbtn.exec:\1btbtn.exe172⤵PID:2432
-
\??\c:\9hnnnn.exec:\9hnnnn.exe173⤵PID:2752
-
\??\c:\vjjdv.exec:\vjjdv.exe174⤵PID:2200
-
\??\c:\vdjdv.exec:\vdjdv.exe175⤵PID:1692
-
\??\c:\lxllflf.exec:\lxllflf.exe176⤵PID:332
-
\??\c:\3ffrxlx.exec:\3ffrxlx.exe177⤵PID:2328
-
\??\c:\btnhbn.exec:\btnhbn.exe178⤵PID:2324
-
\??\c:\1pjpv.exec:\1pjpv.exe179⤵PID:1588
-
\??\c:\lxllrlr.exec:\lxllrlr.exe180⤵PID:1628
-
\??\c:\5frxxxr.exec:\5frxxxr.exe181⤵PID:1216
-
\??\c:\tnhnnn.exec:\tnhnnn.exe182⤵PID:2080
-
\??\c:\dpdjp.exec:\dpdjp.exe183⤵PID:2112
-
\??\c:\1pjjp.exec:\1pjjp.exe184⤵PID:2272
-
\??\c:\rxxfrrf.exec:\rxxfrrf.exe185⤵PID:320
-
\??\c:\nhbhtt.exec:\nhbhtt.exe186⤵PID:2268
-
\??\c:\bnnntb.exec:\bnnntb.exe187⤵PID:992
-
\??\c:\3pjpp.exec:\3pjpp.exe188⤵PID:1052
-
\??\c:\1xlrxxx.exec:\1xlrxxx.exe189⤵PID:848
-
\??\c:\rllrrrf.exec:\rllrrrf.exe190⤵PID:644
-
\??\c:\btbhnt.exec:\btbhnt.exe191⤵PID:772
-
\??\c:\jpjjd.exec:\jpjjd.exe192⤵PID:1836
-
\??\c:\vddjv.exec:\vddjv.exe193⤵PID:2248
-
\??\c:\7xrrfll.exec:\7xrrfll.exe194⤵PID:2856
-
\??\c:\htnnhh.exec:\htnnhh.exe195⤵PID:572
-
\??\c:\tbhhhb.exec:\tbhhhb.exe196⤵PID:2932
-
\??\c:\jddjp.exec:\jddjp.exe197⤵PID:2864
-
\??\c:\3frrrrr.exec:\3frrrrr.exe198⤵PID:1764
-
\??\c:\ffxlxfr.exec:\ffxlxfr.exe199⤵PID:1288
-
\??\c:\9hnnbb.exec:\9hnnbb.exe200⤵PID:1096
-
\??\c:\jdpvd.exec:\jdpvd.exe201⤵PID:2528
-
\??\c:\vjvdj.exec:\vjvdj.exe202⤵PID:2592
-
\??\c:\lrllflf.exec:\lrllflf.exe203⤵PID:2652
-
\??\c:\5tbbbh.exec:\5tbbbh.exe204⤵PID:2720
-
\??\c:\5bhhbh.exec:\5bhhbh.exe205⤵PID:2724
-
\??\c:\dvjpv.exec:\dvjpv.exe206⤵PID:2560
-
\??\c:\vpjjj.exec:\vpjjj.exe207⤵PID:2960
-
\??\c:\xlxfrlx.exec:\xlxfrlx.exe208⤵PID:2296
-
\??\c:\lxffrlr.exec:\lxffrlr.exe209⤵PID:2616
-
\??\c:\thnttb.exec:\thnttb.exe210⤵PID:2468
-
\??\c:\pdpvj.exec:\pdpvj.exe211⤵PID:2516
-
\??\c:\vpjjp.exec:\vpjjp.exe212⤵PID:2460
-
\??\c:\xxllrrx.exec:\xxllrrx.exe213⤵PID:2264
-
\??\c:\xxxrrrf.exec:\xxxrrrf.exe214⤵PID:2692
-
\??\c:\3htbbn.exec:\3htbbn.exe215⤵PID:2744
-
\??\c:\1vdjj.exec:\1vdjj.exe216⤵PID:2792
-
\??\c:\vpvdv.exec:\vpvdv.exe217⤵PID:2204
-
\??\c:\9xflxff.exec:\9xflxff.exe218⤵PID:1960
-
\??\c:\lfllxlx.exec:\lfllxlx.exe219⤵PID:1892
-
\??\c:\tnnttt.exec:\tnnttt.exe220⤵PID:1668
-
\??\c:\bntbhh.exec:\bntbhh.exe221⤵PID:1636
-
\??\c:\vpjjv.exec:\vpjjv.exe222⤵PID:2092
-
\??\c:\xlrrxxl.exec:\xlrrxxl.exe223⤵PID:1568
-
\??\c:\9lfxffl.exec:\9lfxffl.exe224⤵PID:2088
-
\??\c:\nbtbhb.exec:\nbtbhb.exe225⤵PID:2252
-
\??\c:\nhnttb.exec:\nhnttb.exe226⤵PID:2704
-
\??\c:\pjvvv.exec:\pjvvv.exe227⤵PID:2408
-
\??\c:\llrrxrx.exec:\llrrxrx.exe228⤵PID:1952
-
\??\c:\1xrlrxf.exec:\1xrlrxf.exe229⤵PID:824
-
\??\c:\hnhhbt.exec:\hnhhbt.exe230⤵PID:696
-
\??\c:\pvjdp.exec:\pvjdp.exe231⤵PID:3020
-
\??\c:\dpvvd.exec:\dpvvd.exe232⤵PID:1660
-
\??\c:\fflrrrf.exec:\fflrrrf.exe233⤵PID:1880
-
\??\c:\hbnnbb.exec:\hbnnbb.exe234⤵PID:2412
-
\??\c:\dvjpp.exec:\dvjpp.exe235⤵PID:1056
-
\??\c:\1ppvv.exec:\1ppvv.exe236⤵PID:920
-
\??\c:\xxxrfrf.exec:\xxxrfrf.exe237⤵PID:2808
-
\??\c:\xrxxfrx.exec:\xrxxfrx.exe238⤵PID:2072
-
\??\c:\hbhnhn.exec:\hbhnhn.exe239⤵PID:3016
-
\??\c:\djjpp.exec:\djjpp.exe240⤵PID:888
-
\??\c:\ppdvp.exec:\ppdvp.exe241⤵PID:1400
-
\??\c:\flrlxll.exec:\flrlxll.exe242⤵PID:1740