Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 21:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
016b4780ce21e159c54f8105c6a3b8a0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
016b4780ce21e159c54f8105c6a3b8a0_NeikiAnalytics.exe
-
Size
54KB
-
MD5
016b4780ce21e159c54f8105c6a3b8a0
-
SHA1
2930be7948378c9d75d6678ef7214ac5eead133a
-
SHA256
0d91655b7895e4f473846a2918f1d89aad678da4919c23e5cb33ff60cef22f68
-
SHA512
ac412bf3d3dac0e5c380fc34eb54229871d37dab44835a71dc169491ccbe6e2d597cf23b8b87fdae074fd6c6b4a9873aaa1b414c586a2aa18c05255ba6229408
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFz:ymb3NkkiQ3mdBjFIFz
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/2192-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1436-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1396-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1800-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1508-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2340-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vvjjv.exebtbtnn.exebnbbbn.exevddvv.exe3thtbt.exepvpdd.exe5llffxx.exexrlxflr.exe3tthbt.exeddvvj.exedvjdj.exexxrlfrl.exe7tbbhh.exehhnbbb.exevpvdp.exe1rrlxxf.exelfrxlrf.exetbnbtb.exedvvjd.exevdddp.exerlflxlx.exerxlfllf.exebbtbtt.exedvpdj.exejvvvj.exerfxlrfl.exentnnbt.exebhhtnb.exepvpjv.exe3lxxfrf.exe7httnh.exehnhnbb.exe9vjpv.exe9xrfllx.exefxlrfrf.exehbttnt.exettbttt.exe1vdpv.exepjdjv.exefflxrrf.exexxlrflr.exe3fxxffl.exetbthnh.exejjjjp.exejddjd.exerfrfrrx.exefxlrflr.exettbnnb.exevpddj.exedvdvd.exe7fxffxf.exe7bnttt.exethbhtb.exedjppp.exe5fxrrrf.exefrflxfr.exebbbhbn.exe9bhtnn.exedjddv.exe5xlfllr.exeflrrxrx.exennthbt.exevjvjd.exevppdv.exepid process 1648 vvjjv.exe 1720 btbtnn.exe 2536 bnbbbn.exe 2660 vddvv.exe 2704 3thtbt.exe 2696 pvpdd.exe 2604 5llffxx.exe 2552 xrlxflr.exe 2380 3tthbt.exe 2832 ddvvj.exe 2920 dvjdj.exe 2220 xxrlfrl.exe 1824 7tbbhh.exe 2776 hhnbbb.exe 1436 vpvdp.exe 2744 1rrlxxf.exe 1192 lfrxlrf.exe 1444 tbnbtb.exe 2080 dvvjd.exe 2416 vdddp.exe 2876 rlflxlx.exe 1396 rxlfllf.exe 576 bbtbtt.exe 620 dvpdj.exe 1796 jvvvj.exe 2908 rfxlrfl.exe 2388 ntnnbt.exe 1800 bhhtnb.exe 3032 pvpjv.exe 1508 3lxxfrf.exe 2340 7httnh.exe 2196 hnhnbb.exe 2612 9vjpv.exe 2344 9xrfllx.exe 1716 fxlrfrf.exe 2648 hbttnt.exe 2628 ttbttt.exe 2660 1vdpv.exe 2460 pjdjv.exe 2568 fflxrrf.exe 2456 xxlrflr.exe 2504 3fxxffl.exe 2496 tbthnh.exe 2320 jjjjp.exe 2820 jddjd.exe 2812 rfrfrrx.exe 2920 fxlrflr.exe 1124 ttbnnb.exe 1920 vpddj.exe 1752 dvdvd.exe 1868 7fxffxf.exe 1432 7bnttt.exe 1312 thbhtb.exe 1500 djppp.exe 2284 5fxrrrf.exe 1248 frflxfr.exe 2248 bbbhbn.exe 2892 9bhtnn.exe 2000 djddv.exe 772 5xlfllr.exe 480 flrrxrx.exe 692 nnthbt.exe 2276 vjvjd.exe 1952 vppdv.exe -
Processes:
resource yara_rule behavioral1/memory/2192-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1436-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1396-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1800-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1508-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-299-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
016b4780ce21e159c54f8105c6a3b8a0_NeikiAnalytics.exevvjjv.exebtbtnn.exebnbbbn.exevddvv.exe3thtbt.exepvpdd.exe5llffxx.exexrlxflr.exe3tthbt.exeddvvj.exedvjdj.exexxrlfrl.exe7tbbhh.exehhnbbb.exevpvdp.exedescription pid process target process PID 2192 wrote to memory of 1648 2192 016b4780ce21e159c54f8105c6a3b8a0_NeikiAnalytics.exe vvjjv.exe PID 2192 wrote to memory of 1648 2192 016b4780ce21e159c54f8105c6a3b8a0_NeikiAnalytics.exe vvjjv.exe PID 2192 wrote to memory of 1648 2192 016b4780ce21e159c54f8105c6a3b8a0_NeikiAnalytics.exe vvjjv.exe PID 2192 wrote to memory of 1648 2192 016b4780ce21e159c54f8105c6a3b8a0_NeikiAnalytics.exe vvjjv.exe PID 1648 wrote to memory of 1720 1648 vvjjv.exe btbtnn.exe PID 1648 wrote to memory of 1720 1648 vvjjv.exe btbtnn.exe PID 1648 wrote to memory of 1720 1648 vvjjv.exe btbtnn.exe PID 1648 wrote to memory of 1720 1648 vvjjv.exe btbtnn.exe PID 1720 wrote to memory of 2536 1720 btbtnn.exe bnbbbn.exe PID 1720 wrote to memory of 2536 1720 btbtnn.exe bnbbbn.exe PID 1720 wrote to memory of 2536 1720 btbtnn.exe bnbbbn.exe PID 1720 wrote to memory of 2536 1720 btbtnn.exe bnbbbn.exe PID 2536 wrote to memory of 2660 2536 bnbbbn.exe vddvv.exe PID 2536 wrote to memory of 2660 2536 bnbbbn.exe vddvv.exe PID 2536 wrote to memory of 2660 2536 bnbbbn.exe vddvv.exe PID 2536 wrote to memory of 2660 2536 bnbbbn.exe vddvv.exe PID 2660 wrote to memory of 2704 2660 vddvv.exe 3thtbt.exe PID 2660 wrote to memory of 2704 2660 vddvv.exe 3thtbt.exe PID 2660 wrote to memory of 2704 2660 vddvv.exe 3thtbt.exe PID 2660 wrote to memory of 2704 2660 vddvv.exe 3thtbt.exe PID 2704 wrote to memory of 2696 2704 3thtbt.exe pvpdd.exe PID 2704 wrote to memory of 2696 2704 3thtbt.exe pvpdd.exe PID 2704 wrote to memory of 2696 2704 3thtbt.exe pvpdd.exe PID 2704 wrote to memory of 2696 2704 3thtbt.exe pvpdd.exe PID 2696 wrote to memory of 2604 2696 pvpdd.exe 5llffxx.exe PID 2696 wrote to memory of 2604 2696 pvpdd.exe 5llffxx.exe PID 2696 wrote to memory of 2604 2696 pvpdd.exe 5llffxx.exe PID 2696 wrote to memory of 2604 2696 pvpdd.exe 5llffxx.exe PID 2604 wrote to memory of 2552 2604 5llffxx.exe xrlxflr.exe PID 2604 wrote to memory of 2552 2604 5llffxx.exe xrlxflr.exe PID 2604 wrote to memory of 2552 2604 5llffxx.exe xrlxflr.exe PID 2604 wrote to memory of 2552 2604 5llffxx.exe xrlxflr.exe PID 2552 wrote to memory of 2380 2552 xrlxflr.exe 3tthbt.exe PID 2552 wrote to memory of 2380 2552 xrlxflr.exe 3tthbt.exe PID 2552 wrote to memory of 2380 2552 xrlxflr.exe 3tthbt.exe PID 2552 wrote to memory of 2380 2552 xrlxflr.exe 3tthbt.exe PID 2380 wrote to memory of 2832 2380 3tthbt.exe ddvvj.exe PID 2380 wrote to memory of 2832 2380 3tthbt.exe ddvvj.exe PID 2380 wrote to memory of 2832 2380 3tthbt.exe ddvvj.exe PID 2380 wrote to memory of 2832 2380 3tthbt.exe ddvvj.exe PID 2832 wrote to memory of 2920 2832 ddvvj.exe dvjdj.exe PID 2832 wrote to memory of 2920 2832 ddvvj.exe dvjdj.exe PID 2832 wrote to memory of 2920 2832 ddvvj.exe dvjdj.exe PID 2832 wrote to memory of 2920 2832 ddvvj.exe dvjdj.exe PID 2920 wrote to memory of 2220 2920 dvjdj.exe xxrlfrl.exe PID 2920 wrote to memory of 2220 2920 dvjdj.exe xxrlfrl.exe PID 2920 wrote to memory of 2220 2920 dvjdj.exe xxrlfrl.exe PID 2920 wrote to memory of 2220 2920 dvjdj.exe xxrlfrl.exe PID 2220 wrote to memory of 1824 2220 xxrlfrl.exe 7tbbhh.exe PID 2220 wrote to memory of 1824 2220 xxrlfrl.exe 7tbbhh.exe PID 2220 wrote to memory of 1824 2220 xxrlfrl.exe 7tbbhh.exe PID 2220 wrote to memory of 1824 2220 xxrlfrl.exe 7tbbhh.exe PID 1824 wrote to memory of 2776 1824 7tbbhh.exe hhnbbb.exe PID 1824 wrote to memory of 2776 1824 7tbbhh.exe hhnbbb.exe PID 1824 wrote to memory of 2776 1824 7tbbhh.exe hhnbbb.exe PID 1824 wrote to memory of 2776 1824 7tbbhh.exe hhnbbb.exe PID 2776 wrote to memory of 1436 2776 hhnbbb.exe vpvdp.exe PID 2776 wrote to memory of 1436 2776 hhnbbb.exe vpvdp.exe PID 2776 wrote to memory of 1436 2776 hhnbbb.exe vpvdp.exe PID 2776 wrote to memory of 1436 2776 hhnbbb.exe vpvdp.exe PID 1436 wrote to memory of 2744 1436 vpvdp.exe 1rrlxxf.exe PID 1436 wrote to memory of 2744 1436 vpvdp.exe 1rrlxxf.exe PID 1436 wrote to memory of 2744 1436 vpvdp.exe 1rrlxxf.exe PID 1436 wrote to memory of 2744 1436 vpvdp.exe 1rrlxxf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\016b4780ce21e159c54f8105c6a3b8a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\016b4780ce21e159c54f8105c6a3b8a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\vvjjv.exec:\vvjjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\btbtnn.exec:\btbtnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\bnbbbn.exec:\bnbbbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\vddvv.exec:\vddvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\3thtbt.exec:\3thtbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\pvpdd.exec:\pvpdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\5llffxx.exec:\5llffxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\xrlxflr.exec:\xrlxflr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\3tthbt.exec:\3tthbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\ddvvj.exec:\ddvvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\dvjdj.exec:\dvjdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\xxrlfrl.exec:\xxrlfrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\7tbbhh.exec:\7tbbhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\hhnbbb.exec:\hhnbbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\vpvdp.exec:\vpvdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\1rrlxxf.exec:\1rrlxxf.exe17⤵
- Executes dropped EXE
PID:2744 -
\??\c:\lfrxlrf.exec:\lfrxlrf.exe18⤵
- Executes dropped EXE
PID:1192 -
\??\c:\tbnbtb.exec:\tbnbtb.exe19⤵
- Executes dropped EXE
PID:1444 -
\??\c:\dvvjd.exec:\dvvjd.exe20⤵
- Executes dropped EXE
PID:2080 -
\??\c:\vdddp.exec:\vdddp.exe21⤵
- Executes dropped EXE
PID:2416 -
\??\c:\rlflxlx.exec:\rlflxlx.exe22⤵
- Executes dropped EXE
PID:2876 -
\??\c:\rxlfllf.exec:\rxlfllf.exe23⤵
- Executes dropped EXE
PID:1396 -
\??\c:\bbtbtt.exec:\bbtbtt.exe24⤵
- Executes dropped EXE
PID:576 -
\??\c:\dvpdj.exec:\dvpdj.exe25⤵
- Executes dropped EXE
PID:620 -
\??\c:\jvvvj.exec:\jvvvj.exe26⤵
- Executes dropped EXE
PID:1796 -
\??\c:\rfxlrfl.exec:\rfxlrfl.exe27⤵
- Executes dropped EXE
PID:2908 -
\??\c:\ntnnbt.exec:\ntnnbt.exe28⤵
- Executes dropped EXE
PID:2388 -
\??\c:\bhhtnb.exec:\bhhtnb.exe29⤵
- Executes dropped EXE
PID:1800 -
\??\c:\pvpjv.exec:\pvpjv.exe30⤵
- Executes dropped EXE
PID:3032 -
\??\c:\3lxxfrf.exec:\3lxxfrf.exe31⤵
- Executes dropped EXE
PID:1508 -
\??\c:\7httnh.exec:\7httnh.exe32⤵
- Executes dropped EXE
PID:2340 -
\??\c:\hnhnbb.exec:\hnhnbb.exe33⤵
- Executes dropped EXE
PID:2196 -
\??\c:\9vjpv.exec:\9vjpv.exe34⤵
- Executes dropped EXE
PID:2612 -
\??\c:\9xrfllx.exec:\9xrfllx.exe35⤵
- Executes dropped EXE
PID:2344 -
\??\c:\fxlrfrf.exec:\fxlrfrf.exe36⤵
- Executes dropped EXE
PID:1716 -
\??\c:\hbttnt.exec:\hbttnt.exe37⤵
- Executes dropped EXE
PID:2648 -
\??\c:\ttbttt.exec:\ttbttt.exe38⤵
- Executes dropped EXE
PID:2628 -
\??\c:\1vdpv.exec:\1vdpv.exe39⤵
- Executes dropped EXE
PID:2660 -
\??\c:\pjdjv.exec:\pjdjv.exe40⤵
- Executes dropped EXE
PID:2460 -
\??\c:\fflxrrf.exec:\fflxrrf.exe41⤵
- Executes dropped EXE
PID:2568 -
\??\c:\xxlrflr.exec:\xxlrflr.exe42⤵
- Executes dropped EXE
PID:2456 -
\??\c:\3fxxffl.exec:\3fxxffl.exe43⤵
- Executes dropped EXE
PID:2504 -
\??\c:\tbthnh.exec:\tbthnh.exe44⤵
- Executes dropped EXE
PID:2496 -
\??\c:\jjjjp.exec:\jjjjp.exe45⤵
- Executes dropped EXE
PID:2320 -
\??\c:\jddjd.exec:\jddjd.exe46⤵
- Executes dropped EXE
PID:2820 -
\??\c:\rfrfrrx.exec:\rfrfrrx.exe47⤵
- Executes dropped EXE
PID:2812 -
\??\c:\fxlrflr.exec:\fxlrflr.exe48⤵
- Executes dropped EXE
PID:2920 -
\??\c:\ttbnnb.exec:\ttbnnb.exe49⤵
- Executes dropped EXE
PID:1124 -
\??\c:\vpddj.exec:\vpddj.exe50⤵
- Executes dropped EXE
PID:1920 -
\??\c:\dvdvd.exec:\dvdvd.exe51⤵
- Executes dropped EXE
PID:1752 -
\??\c:\7fxffxf.exec:\7fxffxf.exe52⤵
- Executes dropped EXE
PID:1868 -
\??\c:\7bnttt.exec:\7bnttt.exe53⤵
- Executes dropped EXE
PID:1432 -
\??\c:\thbhtb.exec:\thbhtb.exe54⤵
- Executes dropped EXE
PID:1312 -
\??\c:\djppp.exec:\djppp.exe55⤵
- Executes dropped EXE
PID:1500 -
\??\c:\5fxrrrf.exec:\5fxrrrf.exe56⤵
- Executes dropped EXE
PID:2284 -
\??\c:\frflxfr.exec:\frflxfr.exe57⤵
- Executes dropped EXE
PID:1248 -
\??\c:\bbbhbn.exec:\bbbhbn.exe58⤵
- Executes dropped EXE
PID:2248 -
\??\c:\9bhtnn.exec:\9bhtnn.exe59⤵
- Executes dropped EXE
PID:2892 -
\??\c:\djddv.exec:\djddv.exe60⤵
- Executes dropped EXE
PID:2000 -
\??\c:\5xlfllr.exec:\5xlfllr.exe61⤵
- Executes dropped EXE
PID:772 -
\??\c:\flrrxrx.exec:\flrrxrx.exe62⤵
- Executes dropped EXE
PID:480 -
\??\c:\nnthbt.exec:\nnthbt.exe63⤵
- Executes dropped EXE
PID:692 -
\??\c:\vjvjd.exec:\vjvjd.exe64⤵
- Executes dropped EXE
PID:2276 -
\??\c:\vppdv.exec:\vppdv.exe65⤵
- Executes dropped EXE
PID:1952 -
\??\c:\xrxlxxl.exec:\xrxlxxl.exe66⤵PID:1976
-
\??\c:\xlxfrrl.exec:\xlxfrrl.exe67⤵PID:1880
-
\??\c:\btbntb.exec:\btbntb.exe68⤵PID:792
-
\??\c:\jdjjj.exec:\jdjjj.exe69⤵PID:3052
-
\??\c:\dpdvj.exec:\dpdvj.exe70⤵PID:896
-
\??\c:\xflfrlf.exec:\xflfrlf.exe71⤵PID:2976
-
\??\c:\dvppd.exec:\dvppd.exe72⤵PID:2296
-
\??\c:\xxlrxfl.exec:\xxlrxfl.exe73⤵PID:2352
-
\??\c:\fxlrflf.exec:\fxlrflf.exe74⤵PID:2712
-
\??\c:\nhtnbh.exec:\nhtnbh.exe75⤵PID:2612
-
\??\c:\pdpdp.exec:\pdpdp.exe76⤵PID:1608
-
\??\c:\jdpvj.exec:\jdpvj.exe77⤵PID:2572
-
\??\c:\rffxffl.exec:\rffxffl.exe78⤵PID:2440
-
\??\c:\rfxrxfl.exec:\rfxrxfl.exe79⤵PID:2468
-
\??\c:\hthhtt.exec:\hthhtt.exe80⤵PID:2792
-
\??\c:\nnnbhn.exec:\nnnbhn.exe81⤵PID:2460
-
\??\c:\jppjv.exec:\jppjv.exe82⤵PID:2568
-
\??\c:\rxlxxlr.exec:\rxlxxlr.exe83⤵PID:2604
-
\??\c:\xfrflrl.exec:\xfrflrl.exe84⤵PID:1936
-
\??\c:\nbbnbh.exec:\nbbnbh.exe85⤵PID:1564
-
\??\c:\jpddp.exec:\jpddp.exe86⤵PID:2316
-
\??\c:\ddjpp.exec:\ddjpp.exe87⤵PID:2816
-
\??\c:\rrlxrxx.exec:\rrlxrxx.exe88⤵PID:1912
-
\??\c:\llflxfr.exec:\llflxfr.exe89⤵PID:2532
-
\??\c:\ntnhhb.exec:\ntnhhb.exe90⤵PID:2740
-
\??\c:\bnbbnn.exec:\bnbbnn.exe91⤵PID:1824
-
\??\c:\pjddj.exec:\pjddj.exe92⤵PID:1532
-
\??\c:\vpppd.exec:\vpppd.exe93⤵PID:2788
-
\??\c:\rrlxlrf.exec:\rrlxlrf.exe94⤵PID:2780
-
\??\c:\fxxllrl.exec:\fxxllrl.exe95⤵PID:632
-
\??\c:\nnhbhb.exec:\nnhbhb.exe96⤵PID:2228
-
\??\c:\tnbbtb.exec:\tnbbtb.exe97⤵PID:1780
-
\??\c:\pdjdd.exec:\pdjdd.exe98⤵PID:2724
-
\??\c:\vdjdj.exec:\vdjdj.exe99⤵PID:2880
-
\??\c:\xxrfrxr.exec:\xxrfrxr.exe100⤵PID:540
-
\??\c:\lxrlrll.exec:\lxrlrll.exe101⤵PID:1252
-
\??\c:\3tnthh.exec:\3tnthh.exe102⤵PID:288
-
\??\c:\nhhthh.exec:\nhhthh.exe103⤵PID:588
-
\??\c:\dpppv.exec:\dpppv.exe104⤵PID:620
-
\??\c:\5pvdj.exec:\5pvdj.exe105⤵PID:1796
-
\??\c:\fxlrrrx.exec:\fxlrrrx.exe106⤵PID:2140
-
\??\c:\xrfrllx.exec:\xrfrllx.exe107⤵PID:320
-
\??\c:\ntbnhn.exec:\ntbnhn.exe108⤵PID:2308
-
\??\c:\nbnbnt.exec:\nbnbnt.exe109⤵PID:1800
-
\??\c:\vpjjp.exec:\vpjjp.exe110⤵PID:1664
-
\??\c:\xxffrfr.exec:\xxffrfr.exe111⤵PID:892
-
\??\c:\xrfrlxf.exec:\xrfrlxf.exe112⤵PID:1232
-
\??\c:\nttnnh.exec:\nttnnh.exe113⤵PID:1592
-
\??\c:\btbbnn.exec:\btbbnn.exe114⤵PID:2032
-
\??\c:\jdpvv.exec:\jdpvv.exe115⤵PID:2356
-
\??\c:\pddjj.exec:\pddjj.exe116⤵PID:2344
-
\??\c:\rrfrxrf.exec:\rrfrxrf.exe117⤵PID:1716
-
\??\c:\ffxlrxl.exec:\ffxlrxl.exe118⤵PID:2648
-
\??\c:\hbnntn.exec:\hbnntn.exe119⤵PID:2868
-
\??\c:\3pjdd.exec:\3pjdd.exe120⤵PID:2660
-
\??\c:\pjppj.exec:\pjppj.exe121⤵PID:2796
-
\??\c:\rllxfrx.exec:\rllxfrx.exe122⤵PID:2448
-
\??\c:\rrxfrfl.exec:\rrxfrfl.exe123⤵PID:2696
-
\??\c:\hhtbht.exec:\hhtbht.exe124⤵PID:2952
-
\??\c:\hbbnhn.exec:\hbbnhn.exe125⤵PID:2496
-
\??\c:\ddpjp.exec:\ddpjp.exe126⤵PID:2320
-
\??\c:\rfxrlxr.exec:\rfxrlxr.exe127⤵PID:2820
-
\??\c:\fxlrlrf.exec:\fxlrlrf.exe128⤵PID:2840
-
\??\c:\xxlrflr.exec:\xxlrflr.exe129⤵PID:2920
-
\??\c:\nnbtbb.exec:\nnbtbb.exe130⤵PID:1124
-
\??\c:\1tbtth.exec:\1tbtth.exe131⤵PID:1916
-
\??\c:\vpjdp.exec:\vpjdp.exe132⤵PID:1752
-
\??\c:\dvdjv.exec:\dvdjv.exe133⤵PID:1868
-
\??\c:\1lffxlx.exec:\1lffxlx.exe134⤵PID:1432
-
\??\c:\frrxlrx.exec:\frrxlrx.exe135⤵PID:1192
-
\??\c:\rrrffrl.exec:\rrrffrl.exe136⤵PID:1500
-
\??\c:\ttbbbt.exec:\ttbbbt.exe137⤵PID:2616
-
\??\c:\hbnbnn.exec:\hbnbnn.exe138⤵PID:1692
-
\??\c:\vppdd.exec:\vppdd.exe139⤵PID:2248
-
\??\c:\pvvpp.exec:\pvvpp.exe140⤵PID:2892
-
\??\c:\fxlllxf.exec:\fxlllxf.exe141⤵PID:1496
-
\??\c:\lrxllff.exec:\lrxllff.exe142⤵PID:772
-
\??\c:\nhtbhn.exec:\nhtbhn.exe143⤵PID:2252
-
\??\c:\bntbbh.exec:\bntbbh.exe144⤵PID:692
-
\??\c:\pjvdj.exec:\pjvdj.exe145⤵PID:2276
-
\??\c:\9djvv.exec:\9djvv.exe146⤵PID:1952
-
\??\c:\1lxllfr.exec:\1lxllfr.exe147⤵PID:1976
-
\??\c:\xffxxrl.exec:\xffxxrl.exe148⤵PID:2360
-
\??\c:\ntbttn.exec:\ntbttn.exe149⤵PID:792
-
\??\c:\bhhntn.exec:\bhhntn.exe150⤵PID:3052
-
\??\c:\dvddd.exec:\dvddd.exe151⤵PID:2984
-
\??\c:\jdvdp.exec:\jdvdp.exe152⤵PID:2976
-
\??\c:\frrlrlr.exec:\frrlrlr.exe153⤵PID:2192
-
\??\c:\xxffxxf.exec:\xxffxxf.exe154⤵PID:2352
-
\??\c:\bthnth.exec:\bthnth.exe155⤵PID:2560
-
\??\c:\djvvd.exec:\djvvd.exe156⤵PID:2612
-
\??\c:\jvppj.exec:\jvppj.exe157⤵PID:2624
-
\??\c:\1rrlrfr.exec:\1rrlrfr.exe158⤵PID:2572
-
\??\c:\fxffrll.exec:\fxffrll.exe159⤵PID:2628
-
\??\c:\nbnnth.exec:\nbnnth.exe160⤵PID:2468
-
\??\c:\9hhnnb.exec:\9hhnnb.exe161⤵PID:2632
-
\??\c:\jjdvj.exec:\jjdvj.exe162⤵PID:2460
-
\??\c:\9vjjp.exec:\9vjjp.exe163⤵PID:2568
-
\??\c:\flrffrx.exec:\flrffrx.exe164⤵PID:2504
-
\??\c:\9xxlrlx.exec:\9xxlrlx.exe165⤵PID:1936
-
\??\c:\tthbbb.exec:\tthbbb.exe166⤵PID:1564
-
\??\c:\ntnbht.exec:\ntnbht.exe167⤵PID:2316
-
\??\c:\vdpdd.exec:\vdpdd.exe168⤵PID:2720
-
\??\c:\7ddpv.exec:\7ddpv.exe169⤵PID:2220
-
\??\c:\lxrlffr.exec:\lxrlffr.exe170⤵PID:2532
-
\??\c:\3xlfllx.exec:\3xlfllx.exe171⤵PID:1920
-
\??\c:\tnnntt.exec:\tnnntt.exe172⤵PID:1824
-
\??\c:\vvppj.exec:\vvppj.exe173⤵PID:1532
-
\??\c:\rlxfrrf.exec:\rlxfrrf.exe174⤵PID:2788
-
\??\c:\rxlxfxl.exec:\rxlxfxl.exe175⤵PID:2672
-
\??\c:\thbtth.exec:\thbtth.exe176⤵PID:632
-
\??\c:\bbbntn.exec:\bbbntn.exe177⤵PID:820
-
\??\c:\3tbnbn.exec:\3tbnbn.exe178⤵PID:1248
-
\??\c:\vvjpp.exec:\vvjpp.exe179⤵PID:2724
-
\??\c:\rlxrflr.exec:\rlxrflr.exe180⤵PID:2880
-
\??\c:\llflxlx.exec:\llflxlx.exe181⤵PID:540
-
\??\c:\lfrlxfr.exec:\lfrlxfr.exe182⤵PID:324
-
\??\c:\bbnnbt.exec:\bbnnbt.exe183⤵PID:1104
-
\??\c:\nthhnn.exec:\nthhnn.exe184⤵PID:588
-
\??\c:\pdjpp.exec:\pdjpp.exe185⤵PID:620
-
\??\c:\1lfxfff.exec:\1lfxfff.exe186⤵PID:1796
-
\??\c:\xxfrfxx.exec:\xxfrfxx.exe187⤵PID:572
-
\??\c:\hbnnhb.exec:\hbnnhb.exe188⤵PID:968
-
\??\c:\vdpdv.exec:\vdpdv.exe189⤵PID:2308
-
\??\c:\pdjvd.exec:\pdjvd.exe190⤵PID:3032
-
\??\c:\lxrxxfr.exec:\lxrxxfr.exe191⤵PID:1664
-
\??\c:\bntnnh.exec:\bntnnh.exe192⤵PID:1696
-
\??\c:\7thbht.exec:\7thbht.exe193⤵PID:896
-
\??\c:\jjdjd.exec:\jjdjd.exe194⤵PID:2012
-
\??\c:\3lrxfff.exec:\3lrxfff.exe195⤵PID:2296
-
\??\c:\bntnbh.exec:\bntnbh.exe196⤵PID:1740
-
\??\c:\htbbtt.exec:\htbbtt.exe197⤵PID:2612
-
\??\c:\vdpjp.exec:\vdpjp.exe198⤵PID:2708
-
\??\c:\dpdpd.exec:\dpdpd.exe199⤵PID:2588
-
\??\c:\flfxrxl.exec:\flfxrxl.exe200⤵PID:2540
-
\??\c:\fffflxl.exec:\fffflxl.exe201⤵PID:2440
-
\??\c:\tbhtth.exec:\tbhtth.exe202⤵PID:2660
-
\??\c:\ttbtbt.exec:\ttbtbt.exe203⤵PID:2460
-
\??\c:\jjvjp.exec:\jjvjp.exe204⤵PID:1684
-
\??\c:\ppddj.exec:\ppddj.exe205⤵PID:2504
-
\??\c:\rxrflrl.exec:\rxrflrl.exe206⤵PID:2520
-
\??\c:\llflfrr.exec:\llflfrr.exe207⤵PID:1564
-
\??\c:\lxrxfrl.exec:\lxrxfrl.exe208⤵PID:2528
-
\??\c:\ttnhnn.exec:\ttnhnn.exe209⤵PID:2720
-
\??\c:\bhbbtt.exec:\bhbbtt.exe210⤵PID:2816
-
\??\c:\jpdvp.exec:\jpdvp.exe211⤵PID:1636
-
\??\c:\vpdjd.exec:\vpdjd.exe212⤵PID:1992
-
\??\c:\fflrfrf.exec:\fflrfrf.exe213⤵PID:2736
-
\??\c:\3hnhbt.exec:\3hnhbt.exe214⤵PID:2256
-
\??\c:\tnhbnt.exec:\tnhbnt.exe215⤵PID:2788
-
\??\c:\jddpj.exec:\jddpj.exe216⤵PID:2776
-
\??\c:\vvvpv.exec:\vvvpv.exe217⤵PID:1732
-
\??\c:\rrlxfxl.exec:\rrlxfxl.exe218⤵PID:384
-
\??\c:\xfxrfff.exec:\xfxrfff.exe219⤵PID:2412
-
\??\c:\tbbtbb.exec:\tbbtbb.exe220⤵PID:1780
-
\??\c:\nbttnb.exec:\nbttnb.exe221⤵PID:2880
-
\??\c:\pddvv.exec:\pddvv.exe222⤵PID:2052
-
\??\c:\jvppj.exec:\jvppj.exe223⤵PID:2888
-
\??\c:\xlrlrrx.exec:\xlrlrrx.exe224⤵PID:700
-
\??\c:\bhtntt.exec:\bhtntt.exe225⤵PID:588
-
\??\c:\bbtnbn.exec:\bbtnbn.exe226⤵PID:480
-
\??\c:\pvddp.exec:\pvddp.exe227⤵PID:2268
-
\??\c:\ddvdp.exec:\ddvdp.exe228⤵PID:572
-
\??\c:\lxrxrrr.exec:\lxrxrrr.exe229⤵PID:2360
-
\??\c:\tnbnbn.exec:\tnbnbn.exe230⤵PID:2308
-
\??\c:\3tntth.exec:\3tntth.exe231⤵PID:2036
-
\??\c:\pjvdj.exec:\pjvdj.exe232⤵PID:1960
-
\??\c:\jvppd.exec:\jvppd.exe233⤵PID:1664
-
\??\c:\lxrrllx.exec:\lxrrllx.exe234⤵PID:2984
-
\??\c:\xrflrfl.exec:\xrflrfl.exe235⤵PID:896
-
\??\c:\hbnbhh.exec:\hbnbhh.exe236⤵PID:2864
-
\??\c:\nbtbnn.exec:\nbtbnn.exe237⤵PID:2296
-
\??\c:\pjvjj.exec:\pjvjj.exe238⤵PID:1740
-
\??\c:\dvjjp.exec:\dvjjp.exe239⤵PID:2612
-
\??\c:\1rlrrxf.exec:\1rlrrxf.exe240⤵PID:2800
-
\??\c:\1flrfff.exec:\1flrfff.exe241⤵PID:2588
-
\??\c:\hnbtbh.exec:\hnbtbh.exe242⤵PID:2540