Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 19:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3b77d5e7c7a53fa6483990d1ff5b5fe0_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
3b77d5e7c7a53fa6483990d1ff5b5fe0_NeikiAnalytics.exe
-
Size
65KB
-
MD5
3b77d5e7c7a53fa6483990d1ff5b5fe0
-
SHA1
d907ff036204cceda2cf715fbeac9dd292cf6d83
-
SHA256
f8a695be1b4265999812e5998eb3be0216df18428af46f4473c4972f439c2ed3
-
SHA512
ea23f6849655529184e90fafdf5ee32eb985e8a61368fe384d6b59c922f5971ff21f99572bb4c0d985dd4563a43d4df382f24cbb463edd4c49859daffb14c7ea
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfMu+:ymb3NkkiQ3mdBjFI4V4u+
Malware Config
Signatures
-
Detect Blackmoon payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/1432-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2324-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2472-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-69-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1616-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1696-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1692-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1516-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
1ffrffr.exe7hhtht.exenhbnbn.exepjvjv.exexrxxffl.exebthhnh.exevjdpv.exexxrfrxl.exenhbbht.exejdjpd.exe9fxffxf.exexxlxfrx.exebtntbh.exe7djpd.exepjvvj.exelfxfrxr.exe5bhthb.exejjdjd.exeddvjv.exefxfrfxr.exexxrrfxl.exe3bbnnt.exehnthtb.exe3jjdv.exe9xfrrlf.exexlrrrfr.exenntnnt.exejdppp.exelxrlxxl.exeflxffrx.exetnbhtt.exepvdvv.exefxrfrrf.exerlrfrxl.exehhbhth.exebbtbnt.exerlxfrrl.exe5fxlffx.exebtntbb.exehhbhnb.exedvjpd.exevjvpd.exerlxxllx.exexxrlrxl.exebnbtnt.exehhhtbb.exe5pjpd.exedjjpd.exexrxlfrx.exefffflrf.exe1tntnt.exe1jdjp.exevvpvj.exelfxllxf.exellfxflx.exe9hbntb.exe7thnnt.exepjvvj.exe7pjpp.exepjvdv.exerxfxlfx.exerrfrxfx.exettnhtb.exe5bbhbn.exepid process 2176 1ffrffr.exe 2932 7hhtht.exe 2324 nhbnbn.exe 2688 pjvjv.exe 2472 xrxxffl.exe 2768 bthhnh.exe 2628 vjdpv.exe 2480 xxrfrxl.exe 3028 nhbbht.exe 1616 jdjpd.exe 2868 9fxffxf.exe 2876 xxlxfrx.exe 2928 btntbh.exe 1696 7djpd.exe 1692 pjvvj.exe 2740 lfxfrxr.exe 2828 5bhthb.exe 1740 jjdjd.exe 748 ddvjv.exe 1772 fxfrfxr.exe 2316 xxrrfxl.exe 2208 3bbnnt.exe 1468 hnthtb.exe 1408 3jjdv.exe 900 9xfrrlf.exe 1516 xlrrrfr.exe 1720 nntnnt.exe 884 jdppp.exe 1316 lxrlxxl.exe 860 flxffrx.exe 556 tnbhtt.exe 2024 pvdvv.exe 2364 fxrfrrf.exe 2176 rlrfrxl.exe 1060 hhbhth.exe 2120 bbtbnt.exe 2960 rlxfrrl.exe 1556 5fxlffx.exe 2700 btntbb.exe 2624 hhbhnb.exe 2492 dvjpd.exe 2632 vjvpd.exe 2476 rlxxllx.exe 2508 xxrlrxl.exe 1836 bnbtnt.exe 3028 hhhtbb.exe 2856 5pjpd.exe 2892 djjpd.exe 2716 xrxlfrx.exe 744 fffflrf.exe 1656 1tntnt.exe 1984 1jdjp.exe 2728 vvpvj.exe 2792 lfxllxf.exe 768 llfxflx.exe 1828 9hbntb.exe 1280 7thnnt.exe 748 pjvvj.exe 2504 7pjpp.exe 1604 pjvdv.exe 1220 rxfxlfx.exe 2956 rrfrxfx.exe 2204 ttnhtb.exe 1408 5bbhbn.exe -
Processes:
resource yara_rule behavioral1/memory/1432-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2324-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1616-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1692-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1516-250-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3b77d5e7c7a53fa6483990d1ff5b5fe0_NeikiAnalytics.exe1ffrffr.exe7hhtht.exenhbnbn.exepjvjv.exexrxxffl.exebthhnh.exevjdpv.exexxrfrxl.exenhbbht.exejdjpd.exe9fxffxf.exexxlxfrx.exebtntbh.exe7djpd.exepjvvj.exedescription pid process target process PID 1432 wrote to memory of 2176 1432 3b77d5e7c7a53fa6483990d1ff5b5fe0_NeikiAnalytics.exe 1ffrffr.exe PID 1432 wrote to memory of 2176 1432 3b77d5e7c7a53fa6483990d1ff5b5fe0_NeikiAnalytics.exe 1ffrffr.exe PID 1432 wrote to memory of 2176 1432 3b77d5e7c7a53fa6483990d1ff5b5fe0_NeikiAnalytics.exe 1ffrffr.exe PID 1432 wrote to memory of 2176 1432 3b77d5e7c7a53fa6483990d1ff5b5fe0_NeikiAnalytics.exe 1ffrffr.exe PID 2176 wrote to memory of 2932 2176 1ffrffr.exe 7hhtht.exe PID 2176 wrote to memory of 2932 2176 1ffrffr.exe 7hhtht.exe PID 2176 wrote to memory of 2932 2176 1ffrffr.exe 7hhtht.exe PID 2176 wrote to memory of 2932 2176 1ffrffr.exe 7hhtht.exe PID 2932 wrote to memory of 2324 2932 7hhtht.exe nhbnbn.exe PID 2932 wrote to memory of 2324 2932 7hhtht.exe nhbnbn.exe PID 2932 wrote to memory of 2324 2932 7hhtht.exe nhbnbn.exe PID 2932 wrote to memory of 2324 2932 7hhtht.exe nhbnbn.exe PID 2324 wrote to memory of 2688 2324 nhbnbn.exe pjvjv.exe PID 2324 wrote to memory of 2688 2324 nhbnbn.exe pjvjv.exe PID 2324 wrote to memory of 2688 2324 nhbnbn.exe pjvjv.exe PID 2324 wrote to memory of 2688 2324 nhbnbn.exe pjvjv.exe PID 2688 wrote to memory of 2472 2688 pjvjv.exe xrxxffl.exe PID 2688 wrote to memory of 2472 2688 pjvjv.exe xrxxffl.exe PID 2688 wrote to memory of 2472 2688 pjvjv.exe xrxxffl.exe PID 2688 wrote to memory of 2472 2688 pjvjv.exe xrxxffl.exe PID 2472 wrote to memory of 2768 2472 xrxxffl.exe bthhnh.exe PID 2472 wrote to memory of 2768 2472 xrxxffl.exe bthhnh.exe PID 2472 wrote to memory of 2768 2472 xrxxffl.exe bthhnh.exe PID 2472 wrote to memory of 2768 2472 xrxxffl.exe bthhnh.exe PID 2768 wrote to memory of 2628 2768 bthhnh.exe vjdpv.exe PID 2768 wrote to memory of 2628 2768 bthhnh.exe vjdpv.exe PID 2768 wrote to memory of 2628 2768 bthhnh.exe vjdpv.exe PID 2768 wrote to memory of 2628 2768 bthhnh.exe vjdpv.exe PID 2628 wrote to memory of 2480 2628 vjdpv.exe xxrfrxl.exe PID 2628 wrote to memory of 2480 2628 vjdpv.exe xxrfrxl.exe PID 2628 wrote to memory of 2480 2628 vjdpv.exe xxrfrxl.exe PID 2628 wrote to memory of 2480 2628 vjdpv.exe xxrfrxl.exe PID 2480 wrote to memory of 3028 2480 xxrfrxl.exe nhbbht.exe PID 2480 wrote to memory of 3028 2480 xxrfrxl.exe nhbbht.exe PID 2480 wrote to memory of 3028 2480 xxrfrxl.exe nhbbht.exe PID 2480 wrote to memory of 3028 2480 xxrfrxl.exe nhbbht.exe PID 3028 wrote to memory of 1616 3028 nhbbht.exe jdjpd.exe PID 3028 wrote to memory of 1616 3028 nhbbht.exe jdjpd.exe PID 3028 wrote to memory of 1616 3028 nhbbht.exe jdjpd.exe PID 3028 wrote to memory of 1616 3028 nhbbht.exe jdjpd.exe PID 1616 wrote to memory of 2868 1616 jdjpd.exe 9fxffxf.exe PID 1616 wrote to memory of 2868 1616 jdjpd.exe 9fxffxf.exe PID 1616 wrote to memory of 2868 1616 jdjpd.exe 9fxffxf.exe PID 1616 wrote to memory of 2868 1616 jdjpd.exe 9fxffxf.exe PID 2868 wrote to memory of 2876 2868 9fxffxf.exe xxlxfrx.exe PID 2868 wrote to memory of 2876 2868 9fxffxf.exe xxlxfrx.exe PID 2868 wrote to memory of 2876 2868 9fxffxf.exe xxlxfrx.exe PID 2868 wrote to memory of 2876 2868 9fxffxf.exe xxlxfrx.exe PID 2876 wrote to memory of 2928 2876 xxlxfrx.exe btntbh.exe PID 2876 wrote to memory of 2928 2876 xxlxfrx.exe btntbh.exe PID 2876 wrote to memory of 2928 2876 xxlxfrx.exe btntbh.exe PID 2876 wrote to memory of 2928 2876 xxlxfrx.exe btntbh.exe PID 2928 wrote to memory of 1696 2928 btntbh.exe 7djpd.exe PID 2928 wrote to memory of 1696 2928 btntbh.exe 7djpd.exe PID 2928 wrote to memory of 1696 2928 btntbh.exe 7djpd.exe PID 2928 wrote to memory of 1696 2928 btntbh.exe 7djpd.exe PID 1696 wrote to memory of 1692 1696 7djpd.exe pjvvj.exe PID 1696 wrote to memory of 1692 1696 7djpd.exe pjvvj.exe PID 1696 wrote to memory of 1692 1696 7djpd.exe pjvvj.exe PID 1696 wrote to memory of 1692 1696 7djpd.exe pjvvj.exe PID 1692 wrote to memory of 2740 1692 pjvvj.exe lfxfrxr.exe PID 1692 wrote to memory of 2740 1692 pjvvj.exe lfxfrxr.exe PID 1692 wrote to memory of 2740 1692 pjvvj.exe lfxfrxr.exe PID 1692 wrote to memory of 2740 1692 pjvvj.exe lfxfrxr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b77d5e7c7a53fa6483990d1ff5b5fe0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3b77d5e7c7a53fa6483990d1ff5b5fe0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\1ffrffr.exec:\1ffrffr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\7hhtht.exec:\7hhtht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\nhbnbn.exec:\nhbnbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\pjvjv.exec:\pjvjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\xrxxffl.exec:\xrxxffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\bthhnh.exec:\bthhnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\vjdpv.exec:\vjdpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\xxrfrxl.exec:\xxrfrxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\nhbbht.exec:\nhbbht.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\jdjpd.exec:\jdjpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\9fxffxf.exec:\9fxffxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\xxlxfrx.exec:\xxlxfrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\btntbh.exec:\btntbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\7djpd.exec:\7djpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\pjvvj.exec:\pjvvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\lfxfrxr.exec:\lfxfrxr.exe17⤵
- Executes dropped EXE
PID:2740 -
\??\c:\5bhthb.exec:\5bhthb.exe18⤵
- Executes dropped EXE
PID:2828 -
\??\c:\jjdjd.exec:\jjdjd.exe19⤵
- Executes dropped EXE
PID:1740 -
\??\c:\ddvjv.exec:\ddvjv.exe20⤵
- Executes dropped EXE
PID:748 -
\??\c:\fxfrfxr.exec:\fxfrfxr.exe21⤵
- Executes dropped EXE
PID:1772 -
\??\c:\xxrrfxl.exec:\xxrrfxl.exe22⤵
- Executes dropped EXE
PID:2316 -
\??\c:\3bbnnt.exec:\3bbnnt.exe23⤵
- Executes dropped EXE
PID:2208 -
\??\c:\hnthtb.exec:\hnthtb.exe24⤵
- Executes dropped EXE
PID:1468 -
\??\c:\3jjdv.exec:\3jjdv.exe25⤵
- Executes dropped EXE
PID:1408 -
\??\c:\9xfrrlf.exec:\9xfrrlf.exe26⤵
- Executes dropped EXE
PID:900 -
\??\c:\xlrrrfr.exec:\xlrrrfr.exe27⤵
- Executes dropped EXE
PID:1516 -
\??\c:\nntnnt.exec:\nntnnt.exe28⤵
- Executes dropped EXE
PID:1720 -
\??\c:\jdppp.exec:\jdppp.exe29⤵
- Executes dropped EXE
PID:884 -
\??\c:\lxrlxxl.exec:\lxrlxxl.exe30⤵
- Executes dropped EXE
PID:1316 -
\??\c:\flxffrx.exec:\flxffrx.exe31⤵
- Executes dropped EXE
PID:860 -
\??\c:\tnbhtt.exec:\tnbhtt.exe32⤵
- Executes dropped EXE
PID:556 -
\??\c:\pvdvv.exec:\pvdvv.exe33⤵
- Executes dropped EXE
PID:2024 -
\??\c:\fxrfrrf.exec:\fxrfrrf.exe34⤵
- Executes dropped EXE
PID:2364 -
\??\c:\rlrfrxl.exec:\rlrfrxl.exe35⤵
- Executes dropped EXE
PID:2176 -
\??\c:\hhbhth.exec:\hhbhth.exe36⤵
- Executes dropped EXE
PID:1060 -
\??\c:\bbtbnt.exec:\bbtbnt.exe37⤵
- Executes dropped EXE
PID:2120 -
\??\c:\9jdvj.exec:\9jdvj.exe38⤵PID:2668
-
\??\c:\rlxfrrl.exec:\rlxfrrl.exe39⤵
- Executes dropped EXE
PID:2960 -
\??\c:\5fxlffx.exec:\5fxlffx.exe40⤵
- Executes dropped EXE
PID:1556 -
\??\c:\btntbb.exec:\btntbb.exe41⤵
- Executes dropped EXE
PID:2700 -
\??\c:\hhbhnb.exec:\hhbhnb.exe42⤵
- Executes dropped EXE
PID:2624 -
\??\c:\dvjpd.exec:\dvjpd.exe43⤵
- Executes dropped EXE
PID:2492 -
\??\c:\vjvpd.exec:\vjvpd.exe44⤵
- Executes dropped EXE
PID:2632 -
\??\c:\rlxxllx.exec:\rlxxllx.exe45⤵
- Executes dropped EXE
PID:2476 -
\??\c:\xxrlrxl.exec:\xxrlrxl.exe46⤵
- Executes dropped EXE
PID:2508 -
\??\c:\bnbtnt.exec:\bnbtnt.exe47⤵
- Executes dropped EXE
PID:1836 -
\??\c:\hhhtbb.exec:\hhhtbb.exe48⤵
- Executes dropped EXE
PID:3028 -
\??\c:\5pjpd.exec:\5pjpd.exe49⤵
- Executes dropped EXE
PID:2856 -
\??\c:\djjpd.exec:\djjpd.exe50⤵
- Executes dropped EXE
PID:2892 -
\??\c:\xrxlfrx.exec:\xrxlfrx.exe51⤵
- Executes dropped EXE
PID:2716 -
\??\c:\fffflrf.exec:\fffflrf.exe52⤵
- Executes dropped EXE
PID:744 -
\??\c:\1tntnt.exec:\1tntnt.exe53⤵
- Executes dropped EXE
PID:1656 -
\??\c:\1jdjp.exec:\1jdjp.exe54⤵
- Executes dropped EXE
PID:1984 -
\??\c:\vvpvj.exec:\vvpvj.exe55⤵
- Executes dropped EXE
PID:2728 -
\??\c:\lfxllxf.exec:\lfxllxf.exe56⤵
- Executes dropped EXE
PID:2792 -
\??\c:\llfxflx.exec:\llfxflx.exe57⤵
- Executes dropped EXE
PID:768 -
\??\c:\9hbntb.exec:\9hbntb.exe58⤵
- Executes dropped EXE
PID:1828 -
\??\c:\7thnnt.exec:\7thnnt.exe59⤵
- Executes dropped EXE
PID:1280 -
\??\c:\pjvvj.exec:\pjvvj.exe60⤵
- Executes dropped EXE
PID:748 -
\??\c:\7pjpp.exec:\7pjpp.exe61⤵
- Executes dropped EXE
PID:2504 -
\??\c:\pjvdv.exec:\pjvdv.exe62⤵
- Executes dropped EXE
PID:1604 -
\??\c:\rxfxlfx.exec:\rxfxlfx.exe63⤵
- Executes dropped EXE
PID:1220 -
\??\c:\rrfrxfx.exec:\rrfrxfx.exe64⤵
- Executes dropped EXE
PID:2956 -
\??\c:\ttnhtb.exec:\ttnhtb.exe65⤵
- Executes dropped EXE
PID:2204 -
\??\c:\5bbhbn.exec:\5bbhbn.exe66⤵
- Executes dropped EXE
PID:1408 -
\??\c:\vvvpd.exec:\vvvpd.exe67⤵PID:900
-
\??\c:\jdjpj.exec:\jdjpj.exe68⤵PID:1940
-
\??\c:\xfrflxr.exec:\xfrflxr.exe69⤵PID:2116
-
\??\c:\rlflrfr.exec:\rlflrfr.exe70⤵PID:952
-
\??\c:\bbnthh.exec:\bbnthh.exe71⤵PID:884
-
\??\c:\djjvv.exec:\djjvv.exe72⤵PID:2392
-
\??\c:\9jjvv.exec:\9jjvv.exe73⤵PID:1544
-
\??\c:\lxllflr.exec:\lxllflr.exe74⤵PID:2280
-
\??\c:\ffxxfrx.exec:\ffxxfrx.exe75⤵PID:556
-
\??\c:\nnbhbn.exec:\nnbhbn.exe76⤵PID:1520
-
\??\c:\bnnnhh.exec:\bnnnhh.exe77⤵PID:1240
-
\??\c:\1vpjv.exec:\1vpjv.exe78⤵PID:2556
-
\??\c:\jvppj.exec:\jvppj.exe79⤵PID:2760
-
\??\c:\xlxxfff.exec:\xlxxfff.exe80⤵PID:2936
-
\??\c:\9rlxrxl.exec:\9rlxrxl.exe81⤵PID:2616
-
\??\c:\bthbhn.exec:\bthbhn.exe82⤵PID:1684
-
\??\c:\1bthhh.exec:\1bthhh.exe83⤵PID:2596
-
\??\c:\5dppv.exec:\5dppv.exe84⤵PID:2788
-
\??\c:\5lflfxr.exec:\5lflfxr.exe85⤵PID:2600
-
\??\c:\3fxxxxf.exec:\3fxxxxf.exe86⤵PID:2752
-
\??\c:\nnthbh.exec:\nnthbh.exe87⤵PID:2516
-
\??\c:\thbbbh.exec:\thbbbh.exe88⤵PID:1192
-
\??\c:\vpvvj.exec:\vpvvj.exe89⤵PID:1888
-
\??\c:\vddvp.exec:\vddvp.exe90⤵PID:2844
-
\??\c:\9lxrxlx.exec:\9lxrxlx.exe91⤵PID:2864
-
\??\c:\1xrrrrr.exec:\1xrrrrr.exe92⤵PID:1120
-
\??\c:\hhhnbn.exec:\hhhnbn.exe93⤵PID:2564
-
\??\c:\hhhhhn.exec:\hhhhhn.exe94⤵PID:1824
-
\??\c:\vpdpd.exec:\vpdpd.exe95⤵PID:1696
-
\??\c:\jddjp.exec:\jddjp.exe96⤵PID:2148
-
\??\c:\xrrlxlr.exec:\xrrlxlr.exe97⤵PID:2808
-
\??\c:\rxrrlfr.exec:\rxrrlfr.exe98⤵PID:380
-
\??\c:\9hbhtb.exec:\9hbhtb.exe99⤵PID:1032
-
\??\c:\bbthnb.exec:\bbthnb.exe100⤵PID:2140
-
\??\c:\jjjpd.exec:\jjjpd.exe101⤵PID:3060
-
\??\c:\5lrxlxl.exec:\5lrxlxl.exe102⤵PID:3064
-
\??\c:\lrlxxll.exec:\lrlxxll.exe103⤵PID:2068
-
\??\c:\rfxxfff.exec:\rfxxfff.exe104⤵PID:1584
-
\??\c:\bbtnht.exec:\bbtnht.exe105⤵PID:584
-
\??\c:\tnhhbn.exec:\tnhhbn.exe106⤵PID:1196
-
\??\c:\vjdjv.exec:\vjdjv.exe107⤵PID:1928
-
\??\c:\ffxxxxl.exec:\ffxxxxl.exe108⤵PID:628
-
\??\c:\3rxfrff.exec:\3rxfrff.exe109⤵PID:1624
-
\??\c:\hbntht.exec:\hbntht.exe110⤵PID:1096
-
\??\c:\hhhtth.exec:\hhhtth.exe111⤵PID:1732
-
\??\c:\vpddp.exec:\vpddp.exe112⤵PID:600
-
\??\c:\pjddv.exec:\pjddv.exe113⤵PID:300
-
\??\c:\7llllrr.exec:\7llllrr.exe114⤵PID:832
-
\??\c:\xlrrxfl.exec:\xlrrxfl.exe115⤵PID:708
-
\??\c:\bbtnht.exec:\bbtnht.exe116⤵PID:2992
-
\??\c:\hhtbnn.exec:\hhtbnn.exe117⤵PID:2104
-
\??\c:\jjvpj.exec:\jjvpj.exe118⤵PID:2180
-
\??\c:\jpddp.exec:\jpddp.exe119⤵PID:2176
-
\??\c:\3lfrflr.exec:\3lfrflr.exe120⤵PID:1628
-
\??\c:\xxlxllr.exec:\xxlxllr.exe121⤵PID:2604
-
\??\c:\3bntnn.exec:\3bntnn.exe122⤵PID:2748
-
\??\c:\nnbnbh.exec:\nnbnbh.exe123⤵PID:1536
-
\??\c:\jjpjv.exec:\jjpjv.exe124⤵PID:2588
-
\??\c:\pjjpv.exec:\pjjpv.exe125⤵PID:2756
-
\??\c:\3lffllx.exec:\3lffllx.exe126⤵PID:2472
-
\??\c:\3xxlxfl.exec:\3xxlxfl.exe127⤵PID:1488
-
\??\c:\hbbbhh.exec:\hbbbhh.exe128⤵PID:2468
-
\??\c:\tnbtbb.exec:\tnbtbb.exe129⤵PID:2476
-
\??\c:\9vpvd.exec:\9vpvd.exe130⤵PID:2216
-
\??\c:\3dddj.exec:\3dddj.exe131⤵PID:3036
-
\??\c:\lfxxflr.exec:\lfxxflr.exe132⤵PID:2860
-
\??\c:\9xlxrfx.exec:\9xlxrfx.exe133⤵PID:2912
-
\??\c:\btntbh.exec:\btntbh.exe134⤵PID:2924
-
\??\c:\7nhntt.exec:\7nhntt.exe135⤵PID:1248
-
\??\c:\dvppv.exec:\dvppv.exe136⤵PID:856
-
\??\c:\pdpdd.exec:\pdpdd.exe137⤵PID:1656
-
\??\c:\7jdpd.exec:\7jdpd.exe138⤵PID:2772
-
\??\c:\xrfrrxl.exec:\xrfrrxl.exe139⤵PID:2800
-
\??\c:\3lfrfxx.exec:\3lfrfxx.exe140⤵PID:692
-
\??\c:\btthnt.exec:\btthnt.exe141⤵PID:1740
-
\??\c:\nhbhtb.exec:\nhbhtb.exe142⤵PID:752
-
\??\c:\vpddj.exec:\vpddj.exe143⤵PID:3068
-
\??\c:\pjjvj.exec:\pjjvj.exe144⤵PID:2084
-
\??\c:\9xlxflr.exec:\9xlxflr.exe145⤵PID:1156
-
\??\c:\3rlxfxf.exec:\3rlxfxf.exe146⤵PID:2056
-
\??\c:\9bnbtb.exec:\9bnbtb.exe147⤵PID:2008
-
\??\c:\tthntb.exec:\tthntb.exe148⤵PID:1468
-
\??\c:\jppvj.exec:\jppvj.exe149⤵PID:540
-
\??\c:\jjdjv.exec:\jjdjv.exe150⤵PID:1244
-
\??\c:\lfxxffr.exec:\lfxxffr.exe151⤵PID:1348
-
\??\c:\lxlrfff.exec:\lxlrfff.exe152⤵PID:1716
-
\??\c:\ttttbh.exec:\ttttbh.exe153⤵PID:2116
-
\??\c:\1tthbn.exec:\1tthbn.exe154⤵PID:840
-
\??\c:\ppdjv.exec:\ppdjv.exe155⤵PID:1564
-
\??\c:\ddppv.exec:\ddppv.exe156⤵PID:2156
-
\??\c:\rrlfflx.exec:\rrlfflx.exe157⤵PID:1252
-
\??\c:\bhhhnn.exec:\bhhhnn.exe158⤵PID:2256
-
\??\c:\hbttbh.exec:\hbttbh.exe159⤵PID:1432
-
\??\c:\pjddd.exec:\pjddd.exe160⤵PID:1484
-
\??\c:\9pjdp.exec:\9pjdp.exe161⤵PID:1240
-
\??\c:\5rflfxf.exec:\5rflfxf.exe162⤵PID:1648
-
\??\c:\xxlxllf.exec:\xxlxllf.exe163⤵PID:2760
-
\??\c:\nbnthb.exec:\nbnthb.exe164⤵PID:2608
-
\??\c:\hhhnbh.exec:\hhhnbh.exe165⤵PID:1536
-
\??\c:\nhthtn.exec:\nhthtn.exe166⤵PID:1556
-
\??\c:\ddvvd.exec:\ddvvd.exe167⤵PID:2596
-
\??\c:\dpvdj.exec:\dpvdj.exe168⤵PID:2664
-
\??\c:\rlxflrx.exec:\rlxflrx.exe169⤵PID:2512
-
\??\c:\lxffrrr.exec:\lxffrrr.exe170⤵PID:1868
-
\??\c:\3nhnhh.exec:\3nhnhh.exe171⤵PID:2516
-
\??\c:\1nbnth.exec:\1nbnth.exe172⤵PID:1660
-
\??\c:\vpddp.exec:\vpddp.exe173⤵PID:2216
-
\??\c:\3jddj.exec:\3jddj.exe174⤵PID:2856
-
\??\c:\rllrfxf.exec:\rllrfxf.exe175⤵PID:2896
-
\??\c:\5lllxfl.exec:\5lllxfl.exe176⤵PID:2712
-
\??\c:\xxfxrll.exec:\xxfxrll.exe177⤵PID:1676
-
\??\c:\1tnthn.exec:\1tnthn.exe178⤵PID:1808
-
\??\c:\3htnbb.exec:\3htnbb.exe179⤵PID:2352
-
\??\c:\1ppjv.exec:\1ppjv.exe180⤵PID:2776
-
\??\c:\dvpvd.exec:\dvpvd.exe181⤵PID:2800
-
\??\c:\jdppp.exec:\jdppp.exe182⤵PID:2828
-
\??\c:\xrlrxrf.exec:\xrlrxrf.exe183⤵PID:1032
-
\??\c:\3xrxlrl.exec:\3xrxlrl.exe184⤵PID:1828
-
\??\c:\3nnnbb.exec:\3nnnbb.exe185⤵PID:316
-
\??\c:\hhttbh.exec:\hhttbh.exe186⤵PID:3056
-
\??\c:\1jvpv.exec:\1jvpv.exe187⤵PID:2068
-
\??\c:\jdpvp.exec:\jdpvp.exe188⤵PID:1752
-
\??\c:\jvjjv.exec:\jvjjv.exe189⤵PID:1220
-
\??\c:\lflrxxf.exec:\lflrxxf.exe190⤵PID:1652
-
\??\c:\lrrxxlf.exec:\lrrxxlf.exe191⤵PID:1576
-
\??\c:\5nhnnn.exec:\5nhnnn.exe192⤵PID:900
-
\??\c:\hthhnt.exec:\hthhnt.exe193⤵PID:1244
-
\??\c:\jdpvv.exec:\jdpvv.exe194⤵PID:1312
-
\??\c:\vpjpd.exec:\vpjpd.exe195⤵PID:820
-
\??\c:\jvpdp.exec:\jvpdp.exe196⤵PID:1860
-
\??\c:\xllxrrr.exec:\xllxrrr.exe197⤵PID:300
-
\??\c:\frllfff.exec:\frllfff.exe198⤵PID:860
-
\??\c:\nhthtn.exec:\nhthtn.exe199⤵PID:708
-
\??\c:\hbhnbb.exec:\hbhnbb.exe200⤵PID:1872
-
\??\c:\jdjjv.exec:\jdjjv.exe201⤵PID:2104
-
\??\c:\7jjvd.exec:\7jjvd.exe202⤵PID:2660
-
\??\c:\rrlrllx.exec:\rrlrllx.exe203⤵PID:2176
-
\??\c:\nnbthh.exec:\nnbthh.exe204⤵PID:2572
-
\??\c:\7bnnbh.exec:\7bnnbh.exe205⤵PID:2604
-
\??\c:\jdjpd.exec:\jdjpd.exe206⤵PID:2960
-
\??\c:\pvjdp.exec:\pvjdp.exe207⤵PID:2948
-
\??\c:\1xxrxff.exec:\1xxrxff.exe208⤵PID:2704
-
\??\c:\htbttt.exec:\htbttt.exe209⤵PID:2688
-
\??\c:\1jpvv.exec:\1jpvv.exe210⤵PID:2636
-
\??\c:\vddvd.exec:\vddvd.exe211⤵PID:1488
-
\??\c:\xrfrlrf.exec:\xrfrlrf.exe212⤵PID:2496
-
\??\c:\bbttbb.exec:\bbttbb.exe213⤵PID:2228
-
\??\c:\9nnhnb.exec:\9nnhnb.exe214⤵PID:3024
-
\??\c:\btbhnn.exec:\btbhnn.exe215⤵PID:1616
-
\??\c:\9vddp.exec:\9vddp.exe216⤵PID:2920
-
\??\c:\7vpjj.exec:\7vpjj.exe217⤵PID:2868
-
\??\c:\lfrfrrf.exec:\lfrfrrf.exe218⤵PID:2716
-
\??\c:\xrffrff.exec:\xrffrff.exe219⤵PID:2884
-
\??\c:\3ffxfxl.exec:\3ffxfxl.exe220⤵PID:1988
-
\??\c:\7tbbhh.exec:\7tbbhh.exe221⤵PID:1672
-
\??\c:\vpddj.exec:\vpddj.exe222⤵PID:2728
-
\??\c:\dpdvv.exec:\dpdvv.exe223⤵PID:664
-
\??\c:\1fflxxl.exec:\1fflxxl.exe224⤵PID:1596
-
\??\c:\lfrxlfl.exec:\lfrxlfl.exe225⤵PID:340
-
\??\c:\tbhntb.exec:\tbhntb.exe226⤵PID:1284
-
\??\c:\9nhnbh.exec:\9nhnbh.exe227⤵PID:3068
-
\??\c:\djdpj.exec:\djdpj.exe228⤵PID:2124
-
\??\c:\vpvpd.exec:\vpvpd.exe229⤵PID:2096
-
\??\c:\vdjvj.exec:\vdjvj.exe230⤵PID:2448
-
\??\c:\7rllxrf.exec:\7rllxrf.exe231⤵PID:2968
-
\??\c:\9rrxlll.exec:\9rrxlll.exe232⤵PID:2444
-
\??\c:\7tbntt.exec:\7tbntt.exe233⤵PID:540
-
\??\c:\7tbntt.exec:\7tbntt.exe234⤵PID:1088
-
\??\c:\vjjvj.exec:\vjjvj.exe235⤵PID:956
-
\??\c:\3pdvj.exec:\3pdvj.exe236⤵PID:1244
-
\??\c:\ffrlfrl.exec:\ffrlfrl.exe237⤵PID:696
-
\??\c:\bththn.exec:\bththn.exe238⤵PID:1720
-
\??\c:\9tbtnh.exec:\9tbtnh.exe239⤵PID:884
-
\??\c:\ppdjv.exec:\ppdjv.exe240⤵PID:1668
-
\??\c:\vjvpp.exec:\vjvpp.exe241⤵PID:1544
-
\??\c:\rllflfr.exec:\rllflfr.exe242⤵PID:880