Analysis
-
max time kernel
146s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 00:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
387fb2e71b8084639e29bd9afaafa240_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
387fb2e71b8084639e29bd9afaafa240_NeikiAnalytics.exe
-
Size
247KB
-
MD5
387fb2e71b8084639e29bd9afaafa240
-
SHA1
e23e3eba0a63f2a30b729994fcc3988a5ffad799
-
SHA256
6cfddcd650d5bf13b9a3dd4b1d5e0d19da6e9d314c882de3ecdfed9953f0337b
-
SHA512
30f74ed3310ffefa2a697c5a37822467d35537a4ba7ddde018fdff7826e84dc991d088f8d79e9decb131ebad3255e2693a9653c803a1c8018ec3fffeed621b62
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4MAWvGjR15:n3C9BRo7MlrWKo+lxtvGt15
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/2984-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1588-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1864-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1756-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1260-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2060-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/536-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/692-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1124-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pjvpp.exehbnbht.exedpvjj.exexllfxfl.exe1bnnbh.exe9jjjp.exerffflrr.exenhbhtb.exennthnb.exevpvpv.exedjjpd.exellrxllx.exe9nnbnt.exebtbhhn.exejdddp.exe9fllrrx.exelfrxllr.exehbthtt.exe5vvvv.exerfrffxf.exe9lxlxfr.exe3nhttb.exeddpvd.exeppjpd.exerxrllxr.exe5btbtb.exedjpjj.exettntht.exebtbbbh.exedvjjv.exejdvjp.exefrfflrx.exenthbnn.exehbnbnb.exejdjjp.exerlxfrrf.exerlxlxlx.exetnthnh.exehhbhbh.exejdvjj.exe3jvvd.exexrxrlrx.exerfrrxll.exerrrxrfx.exe9hbttb.exevjvpp.exe5hntbb.exedvjvd.exefrlrfxr.exenbbnbn.exe7djpv.exe1rxrxxx.exe9tnbbb.exejdjdj.exejdvvd.exexrfrrxl.exe9htbnt.exe9bthnt.exepdpdv.exexlxxflr.exerlrrxrf.exebtttnt.exe7hbbnt.exejjddj.exepid process 2592 pjvpp.exe 2596 hbnbht.exe 2944 dpvjj.exe 3032 xllfxfl.exe 2696 1bnnbh.exe 2888 9jjjp.exe 2448 rffflrr.exe 2216 nhbhtb.exe 2492 nnthnb.exe 1588 vpvpv.exe 2736 djjpd.exe 2484 llrxllx.exe 1864 9nnbnt.exe 1756 btbhhn.exe 1660 jdddp.exe 2540 9fllrrx.exe 2368 lfrxllr.exe 1260 hbthtt.exe 2060 5vvvv.exe 2784 rfrffxf.exe 2688 9lxlxfr.exe 536 3nhttb.exe 692 ddpvd.exe 3068 ppjpd.exe 2316 rxrllxr.exe 780 5btbtb.exe 700 djpjj.exe 2128 ttntht.exe 2832 btbbbh.exe 2348 dvjjv.exe 1124 jdvjp.exe 2884 frfflrx.exe 1720 nthbnn.exe 2552 hbnbnb.exe 2568 jdjjp.exe 2908 rlxfrrf.exe 3028 rlxlxlx.exe 2716 tnthnh.exe 3040 hhbhbh.exe 2612 jdvjj.exe 2472 3jvvd.exe 2508 xrxrlrx.exe 2892 rfrrxll.exe 1664 rrrxrfx.exe 2420 9hbttb.exe 2532 vjvpp.exe 1912 5hntbb.exe 1704 dvjvd.exe 2836 frlrfxr.exe 2840 nbbnbn.exe 1952 7djpv.exe 308 1rxrxxx.exe 2372 9tnbbb.exe 1596 jdjdj.exe 2264 jdvvd.exe 2056 xrfrrxl.exe 1568 9htbnt.exe 2784 9bthnt.exe 2688 pdpdv.exe 1500 xlxxflr.exe 1856 rlrrxrf.exe 616 btttnt.exe 452 7hbbnt.exe 936 jjddj.exe -
Processes:
resource yara_rule behavioral1/memory/2984-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1588-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1864-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1756-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1260-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/536-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/692-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1124-296-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-269-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
387fb2e71b8084639e29bd9afaafa240_NeikiAnalytics.exepjvpp.exehbnbht.exedpvjj.exexllfxfl.exe1bnnbh.exe9jjjp.exerffflrr.exenhbhtb.exennthnb.exevpvpv.exedjjpd.exellrxllx.exe9nnbnt.exebtbhhn.exejdddp.exedescription pid process target process PID 2984 wrote to memory of 2592 2984 387fb2e71b8084639e29bd9afaafa240_NeikiAnalytics.exe pjvpp.exe PID 2984 wrote to memory of 2592 2984 387fb2e71b8084639e29bd9afaafa240_NeikiAnalytics.exe pjvpp.exe PID 2984 wrote to memory of 2592 2984 387fb2e71b8084639e29bd9afaafa240_NeikiAnalytics.exe pjvpp.exe PID 2984 wrote to memory of 2592 2984 387fb2e71b8084639e29bd9afaafa240_NeikiAnalytics.exe pjvpp.exe PID 2592 wrote to memory of 2596 2592 pjvpp.exe hbnbht.exe PID 2592 wrote to memory of 2596 2592 pjvpp.exe hbnbht.exe PID 2592 wrote to memory of 2596 2592 pjvpp.exe hbnbht.exe PID 2592 wrote to memory of 2596 2592 pjvpp.exe hbnbht.exe PID 2596 wrote to memory of 2944 2596 hbnbht.exe dpvjj.exe PID 2596 wrote to memory of 2944 2596 hbnbht.exe dpvjj.exe PID 2596 wrote to memory of 2944 2596 hbnbht.exe dpvjj.exe PID 2596 wrote to memory of 2944 2596 hbnbht.exe dpvjj.exe PID 2944 wrote to memory of 3032 2944 dpvjj.exe xllfxfl.exe PID 2944 wrote to memory of 3032 2944 dpvjj.exe xllfxfl.exe PID 2944 wrote to memory of 3032 2944 dpvjj.exe xllfxfl.exe PID 2944 wrote to memory of 3032 2944 dpvjj.exe xllfxfl.exe PID 3032 wrote to memory of 2696 3032 xllfxfl.exe 1bnnbh.exe PID 3032 wrote to memory of 2696 3032 xllfxfl.exe 1bnnbh.exe PID 3032 wrote to memory of 2696 3032 xllfxfl.exe 1bnnbh.exe PID 3032 wrote to memory of 2696 3032 xllfxfl.exe 1bnnbh.exe PID 2696 wrote to memory of 2888 2696 1bnnbh.exe 9jjjp.exe PID 2696 wrote to memory of 2888 2696 1bnnbh.exe 9jjjp.exe PID 2696 wrote to memory of 2888 2696 1bnnbh.exe 9jjjp.exe PID 2696 wrote to memory of 2888 2696 1bnnbh.exe 9jjjp.exe PID 2888 wrote to memory of 2448 2888 9jjjp.exe rffflrr.exe PID 2888 wrote to memory of 2448 2888 9jjjp.exe rffflrr.exe PID 2888 wrote to memory of 2448 2888 9jjjp.exe rffflrr.exe PID 2888 wrote to memory of 2448 2888 9jjjp.exe rffflrr.exe PID 2448 wrote to memory of 2216 2448 rffflrr.exe nhbhtb.exe PID 2448 wrote to memory of 2216 2448 rffflrr.exe nhbhtb.exe PID 2448 wrote to memory of 2216 2448 rffflrr.exe nhbhtb.exe PID 2448 wrote to memory of 2216 2448 rffflrr.exe nhbhtb.exe PID 2216 wrote to memory of 2492 2216 nhbhtb.exe nnthnb.exe PID 2216 wrote to memory of 2492 2216 nhbhtb.exe nnthnb.exe PID 2216 wrote to memory of 2492 2216 nhbhtb.exe nnthnb.exe PID 2216 wrote to memory of 2492 2216 nhbhtb.exe nnthnb.exe PID 2492 wrote to memory of 1588 2492 nnthnb.exe vpvpv.exe PID 2492 wrote to memory of 1588 2492 nnthnb.exe vpvpv.exe PID 2492 wrote to memory of 1588 2492 nnthnb.exe vpvpv.exe PID 2492 wrote to memory of 1588 2492 nnthnb.exe vpvpv.exe PID 1588 wrote to memory of 2736 1588 vpvpv.exe djjpd.exe PID 1588 wrote to memory of 2736 1588 vpvpv.exe djjpd.exe PID 1588 wrote to memory of 2736 1588 vpvpv.exe djjpd.exe PID 1588 wrote to memory of 2736 1588 vpvpv.exe djjpd.exe PID 2736 wrote to memory of 2484 2736 djjpd.exe llrxllx.exe PID 2736 wrote to memory of 2484 2736 djjpd.exe llrxllx.exe PID 2736 wrote to memory of 2484 2736 djjpd.exe llrxllx.exe PID 2736 wrote to memory of 2484 2736 djjpd.exe llrxllx.exe PID 2484 wrote to memory of 1864 2484 llrxllx.exe 9nnbnt.exe PID 2484 wrote to memory of 1864 2484 llrxllx.exe 9nnbnt.exe PID 2484 wrote to memory of 1864 2484 llrxllx.exe 9nnbnt.exe PID 2484 wrote to memory of 1864 2484 llrxllx.exe 9nnbnt.exe PID 1864 wrote to memory of 1756 1864 9nnbnt.exe btbhhn.exe PID 1864 wrote to memory of 1756 1864 9nnbnt.exe btbhhn.exe PID 1864 wrote to memory of 1756 1864 9nnbnt.exe btbhhn.exe PID 1864 wrote to memory of 1756 1864 9nnbnt.exe btbhhn.exe PID 1756 wrote to memory of 1660 1756 btbhhn.exe jdddp.exe PID 1756 wrote to memory of 1660 1756 btbhhn.exe jdddp.exe PID 1756 wrote to memory of 1660 1756 btbhhn.exe jdddp.exe PID 1756 wrote to memory of 1660 1756 btbhhn.exe jdddp.exe PID 1660 wrote to memory of 2540 1660 jdddp.exe 9fllrrx.exe PID 1660 wrote to memory of 2540 1660 jdddp.exe 9fllrrx.exe PID 1660 wrote to memory of 2540 1660 jdddp.exe 9fllrrx.exe PID 1660 wrote to memory of 2540 1660 jdddp.exe 9fllrrx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\387fb2e71b8084639e29bd9afaafa240_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\387fb2e71b8084639e29bd9afaafa240_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\pjvpp.exec:\pjvpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\hbnbht.exec:\hbnbht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\dpvjj.exec:\dpvjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\xllfxfl.exec:\xllfxfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\1bnnbh.exec:\1bnnbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\9jjjp.exec:\9jjjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\rffflrr.exec:\rffflrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\nhbhtb.exec:\nhbhtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\nnthnb.exec:\nnthnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\vpvpv.exec:\vpvpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\djjpd.exec:\djjpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\llrxllx.exec:\llrxllx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\9nnbnt.exec:\9nnbnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\btbhhn.exec:\btbhhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\jdddp.exec:\jdddp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\9fllrrx.exec:\9fllrrx.exe17⤵
- Executes dropped EXE
PID:2540 -
\??\c:\lfrxllr.exec:\lfrxllr.exe18⤵
- Executes dropped EXE
PID:2368 -
\??\c:\hbthtt.exec:\hbthtt.exe19⤵
- Executes dropped EXE
PID:1260 -
\??\c:\5vvvv.exec:\5vvvv.exe20⤵
- Executes dropped EXE
PID:2060 -
\??\c:\rfrffxf.exec:\rfrffxf.exe21⤵
- Executes dropped EXE
PID:2784 -
\??\c:\9lxlxfr.exec:\9lxlxfr.exe22⤵
- Executes dropped EXE
PID:2688 -
\??\c:\3nhttb.exec:\3nhttb.exe23⤵
- Executes dropped EXE
PID:536 -
\??\c:\ddpvd.exec:\ddpvd.exe24⤵
- Executes dropped EXE
PID:692 -
\??\c:\ppjpd.exec:\ppjpd.exe25⤵
- Executes dropped EXE
PID:3068 -
\??\c:\rxrllxr.exec:\rxrllxr.exe26⤵
- Executes dropped EXE
PID:2316 -
\??\c:\5btbtb.exec:\5btbtb.exe27⤵
- Executes dropped EXE
PID:780 -
\??\c:\djpjj.exec:\djpjj.exe28⤵
- Executes dropped EXE
PID:700 -
\??\c:\ttntht.exec:\ttntht.exe29⤵
- Executes dropped EXE
PID:2128 -
\??\c:\btbbbh.exec:\btbbbh.exe30⤵
- Executes dropped EXE
PID:2832 -
\??\c:\dvjjv.exec:\dvjjv.exe31⤵
- Executes dropped EXE
PID:2348 -
\??\c:\jdvjp.exec:\jdvjp.exe32⤵
- Executes dropped EXE
PID:1124 -
\??\c:\frfflrx.exec:\frfflrx.exe33⤵
- Executes dropped EXE
PID:2884 -
\??\c:\nthbnn.exec:\nthbnn.exe34⤵
- Executes dropped EXE
PID:1720 -
\??\c:\hbnbnb.exec:\hbnbnb.exe35⤵
- Executes dropped EXE
PID:2552 -
\??\c:\jdjjp.exec:\jdjjp.exe36⤵
- Executes dropped EXE
PID:2568 -
\??\c:\rlxfrrf.exec:\rlxfrrf.exe37⤵
- Executes dropped EXE
PID:2908 -
\??\c:\rlxlxlx.exec:\rlxlxlx.exe38⤵
- Executes dropped EXE
PID:3028 -
\??\c:\tnthnh.exec:\tnthnh.exe39⤵
- Executes dropped EXE
PID:2716 -
\??\c:\hhbhbh.exec:\hhbhbh.exe40⤵
- Executes dropped EXE
PID:3040 -
\??\c:\jdvjj.exec:\jdvjj.exe41⤵
- Executes dropped EXE
PID:2612 -
\??\c:\3jvvd.exec:\3jvvd.exe42⤵
- Executes dropped EXE
PID:2472 -
\??\c:\xrxrlrx.exec:\xrxrlrx.exe43⤵
- Executes dropped EXE
PID:2508 -
\??\c:\rfrrxll.exec:\rfrrxll.exe44⤵
- Executes dropped EXE
PID:2892 -
\??\c:\rrrxrfx.exec:\rrrxrfx.exe45⤵
- Executes dropped EXE
PID:1664 -
\??\c:\9hbttb.exec:\9hbttb.exe46⤵
- Executes dropped EXE
PID:2420 -
\??\c:\vjvpp.exec:\vjvpp.exe47⤵
- Executes dropped EXE
PID:2532 -
\??\c:\5hntbb.exec:\5hntbb.exe48⤵
- Executes dropped EXE
PID:1912 -
\??\c:\dvjvd.exec:\dvjvd.exe49⤵
- Executes dropped EXE
PID:1704 -
\??\c:\frlrfxr.exec:\frlrfxr.exe50⤵
- Executes dropped EXE
PID:2836 -
\??\c:\nbbnbn.exec:\nbbnbn.exe51⤵
- Executes dropped EXE
PID:2840 -
\??\c:\7djpv.exec:\7djpv.exe52⤵
- Executes dropped EXE
PID:1952 -
\??\c:\1rxrxxx.exec:\1rxrxxx.exe53⤵
- Executes dropped EXE
PID:308 -
\??\c:\9tnbbb.exec:\9tnbbb.exe54⤵
- Executes dropped EXE
PID:2372 -
\??\c:\jdjdj.exec:\jdjdj.exe55⤵
- Executes dropped EXE
PID:1596 -
\??\c:\jdvvd.exec:\jdvvd.exe56⤵
- Executes dropped EXE
PID:2264 -
\??\c:\xrfrrxl.exec:\xrfrrxl.exe57⤵
- Executes dropped EXE
PID:2056 -
\??\c:\9htbnt.exec:\9htbnt.exe58⤵
- Executes dropped EXE
PID:1568 -
\??\c:\9bthnt.exec:\9bthnt.exe59⤵
- Executes dropped EXE
PID:2784 -
\??\c:\pdpdv.exec:\pdpdv.exe60⤵
- Executes dropped EXE
PID:2688 -
\??\c:\xlxxflr.exec:\xlxxflr.exe61⤵
- Executes dropped EXE
PID:1500 -
\??\c:\rlrrxrf.exec:\rlrrxrf.exe62⤵
- Executes dropped EXE
PID:1856 -
\??\c:\btttnt.exec:\btttnt.exe63⤵
- Executes dropped EXE
PID:616 -
\??\c:\7hbbnt.exec:\7hbbnt.exe64⤵
- Executes dropped EXE
PID:452 -
\??\c:\jjddj.exec:\jjddj.exe65⤵
- Executes dropped EXE
PID:936 -
\??\c:\xfrrlrf.exec:\xfrrlrf.exe66⤵PID:1828
-
\??\c:\lxllxxl.exec:\lxllxxl.exe67⤵PID:908
-
\??\c:\bthhbh.exec:\bthhbh.exe68⤵PID:700
-
\??\c:\thnhtt.exec:\thnhtt.exe69⤵PID:848
-
\??\c:\7pvvv.exec:\7pvvv.exe70⤵PID:2156
-
\??\c:\rlrfxfx.exec:\rlrfxfx.exe71⤵PID:2992
-
\??\c:\fxrflrx.exec:\fxrflrx.exe72⤵PID:2880
-
\??\c:\hnbbhh.exec:\hnbbhh.exe73⤵PID:3008
-
\??\c:\nhhhbt.exec:\nhhhbt.exe74⤵PID:1752
-
\??\c:\ddvvj.exec:\ddvvj.exe75⤵PID:1720
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe76⤵PID:2932
-
\??\c:\9lllxxf.exec:\9lllxxf.exe77⤵PID:2452
-
\??\c:\nnhthn.exec:\nnhthn.exe78⤵PID:3024
-
\??\c:\vpddp.exec:\vpddp.exe79⤵PID:2560
-
\??\c:\pjdvj.exec:\pjdvj.exe80⤵PID:3020
-
\??\c:\lrxfffr.exec:\lrxfffr.exe81⤵PID:2708
-
\??\c:\7hbbnh.exec:\7hbbnh.exe82⤵PID:2544
-
\??\c:\tnbhnb.exec:\tnbhnb.exe83⤵PID:2580
-
\??\c:\1vjvj.exec:\1vjvj.exe84⤵PID:2448
-
\??\c:\lfxrflf.exec:\lfxrflf.exe85⤵PID:2216
-
\??\c:\lxxfxlr.exec:\lxxfxlr.exe86⤵PID:2516
-
\??\c:\tnbbtb.exec:\tnbbtb.exe87⤵PID:2856
-
\??\c:\hhbthn.exec:\hhbthn.exe88⤵PID:2748
-
\??\c:\5pjpp.exec:\5pjpp.exe89⤵PID:2532
-
\??\c:\xxlxrrx.exec:\xxlxrrx.exe90⤵PID:2484
-
\??\c:\tbhhhh.exec:\tbhhhh.exe91⤵PID:2408
-
\??\c:\bttbnn.exec:\bttbnn.exe92⤵PID:1668
-
\??\c:\ddpjp.exec:\ddpjp.exe93⤵PID:1932
-
\??\c:\1fflxfl.exec:\1fflxfl.exe94⤵PID:320
-
\??\c:\ffxlflr.exec:\ffxlflr.exe95⤵PID:2540
-
\??\c:\hhbthn.exec:\hhbthn.exe96⤵PID:2372
-
\??\c:\nnbbhb.exec:\nnbbhb.exe97⤵PID:2068
-
\??\c:\ddjpd.exec:\ddjpd.exe98⤵PID:1684
-
\??\c:\jjddv.exec:\jjddv.exe99⤵PID:2084
-
\??\c:\7frfxxl.exec:\7frfxxl.exe100⤵PID:2072
-
\??\c:\fflrxfl.exec:\fflrxfl.exe101⤵PID:796
-
\??\c:\bhbbht.exec:\bhbbht.exe102⤵PID:1096
-
\??\c:\nnhnbn.exec:\nnhnbn.exe103⤵PID:852
-
\??\c:\vpdjp.exec:\vpdjp.exe104⤵PID:828
-
\??\c:\dvjdv.exec:\dvjdv.exe105⤵PID:1044
-
\??\c:\xxllrrl.exec:\xxllrrl.exe106⤵PID:2316
-
\??\c:\9rrrflx.exec:\9rrrflx.exe107⤵PID:1800
-
\??\c:\hhnbbn.exec:\hhnbbn.exe108⤵PID:1736
-
\??\c:\jppvv.exec:\jppvv.exe109⤵PID:2024
-
\??\c:\vpppv.exec:\vpppv.exe110⤵PID:2128
-
\??\c:\vvjpj.exec:\vvjpj.exe111⤵PID:2832
-
\??\c:\7xrrllf.exec:\7xrrllf.exe112⤵PID:2348
-
\??\c:\lxrrffr.exec:\lxrrffr.exe113⤵PID:2108
-
\??\c:\tbbhbn.exec:\tbbhbn.exe114⤵PID:1580
-
\??\c:\hhtbbn.exec:\hhtbbn.exe115⤵PID:2668
-
\??\c:\jvjdv.exec:\jvjdv.exe116⤵PID:2652
-
\??\c:\jdvjd.exec:\jdvjd.exe117⤵PID:2312
-
\??\c:\xlxxrrx.exec:\xlxxrrx.exe118⤵PID:2932
-
\??\c:\tbttbh.exec:\tbttbh.exe119⤵PID:2596
-
\??\c:\nnhtnt.exec:\nnhtnt.exe120⤵PID:2940
-
\??\c:\dddvj.exec:\dddvj.exe121⤵PID:3016
-
\??\c:\lfxfrrf.exec:\lfxfrrf.exe122⤵PID:3020
-
\??\c:\lxffffr.exec:\lxffffr.exe123⤵PID:2468
-
\??\c:\nbhbtn.exec:\nbhbtn.exe124⤵PID:2488
-
\??\c:\tnthtb.exec:\tnthtb.exe125⤵PID:2848
-
\??\c:\jdpvd.exec:\jdpvd.exe126⤵PID:2564
-
\??\c:\jvddd.exec:\jvddd.exe127⤵PID:2860
-
\??\c:\rlxffrx.exec:\rlxffrx.exe128⤵PID:2516
-
\??\c:\bntttt.exec:\bntttt.exe129⤵PID:2504
-
\??\c:\hbnnbt.exec:\hbnnbt.exe130⤵PID:2748
-
\??\c:\pvjvj.exec:\pvjvj.exe131⤵PID:2736
-
\??\c:\9pdjp.exec:\9pdjp.exe132⤵PID:1936
-
\??\c:\1lflflx.exec:\1lflflx.exe133⤵PID:1760
-
\??\c:\hnbthh.exec:\hnbthh.exe134⤵PID:1924
-
\??\c:\hbhntt.exec:\hbhntt.exe135⤵PID:332
-
\??\c:\vvjvj.exec:\vvjvj.exe136⤵PID:320
-
\??\c:\rfrxfxl.exec:\rfrxfxl.exe137⤵PID:1508
-
\??\c:\rlfrfrr.exec:\rlfrfrr.exe138⤵PID:1156
-
\??\c:\9nnhnt.exec:\9nnhnt.exe139⤵PID:1536
-
\??\c:\hbhntt.exec:\hbhntt.exe140⤵PID:2428
-
\??\c:\7vpdp.exec:\7vpdp.exe141⤵PID:592
-
\??\c:\pjvpv.exec:\pjvpv.exe142⤵PID:324
-
\??\c:\9ffflrf.exec:\9ffflrf.exe143⤵PID:2792
-
\??\c:\htbbbh.exec:\htbbbh.exe144⤵PID:1860
-
\??\c:\nnnhhh.exec:\nnnhhh.exe145⤵PID:692
-
\??\c:\vvppp.exec:\vvppp.exe146⤵PID:2036
-
\??\c:\1jjpv.exec:\1jjpv.exe147⤵PID:1492
-
\??\c:\xrflflf.exec:\xrflflf.exe148⤵PID:2316
-
\??\c:\5fllxfl.exec:\5fllxfl.exe149⤵PID:1800
-
\??\c:\5tbbnn.exec:\5tbbnn.exe150⤵PID:1736
-
\??\c:\vjvdj.exec:\vjvdj.exe151⤵PID:956
-
\??\c:\jpvdp.exec:\jpvdp.exe152⤵PID:2128
-
\??\c:\lrxfrxr.exec:\lrxfrxr.exe153⤵PID:764
-
\??\c:\3lfrlxr.exec:\3lfrlxr.exe154⤵PID:884
-
\??\c:\htnbnn.exec:\htnbnn.exe155⤵PID:2880
-
\??\c:\bhbhtb.exec:\bhbhtb.exe156⤵PID:2928
-
\??\c:\vpvvj.exec:\vpvvj.exe157⤵PID:2236
-
\??\c:\frffrrf.exec:\frffrrf.exe158⤵PID:2768
-
\??\c:\xrffllx.exec:\xrffllx.exe159⤵PID:2936
-
\??\c:\9hbbbb.exec:\9hbbbb.exe160⤵PID:2908
-
\??\c:\thhhbn.exec:\thhhbn.exe161⤵PID:2576
-
\??\c:\5vdpv.exec:\5vdpv.exe162⤵PID:2716
-
\??\c:\jjdpv.exec:\jjdpv.exe163⤵PID:3036
-
\??\c:\9lxxxff.exec:\9lxxxff.exe164⤵PID:2196
-
\??\c:\lxllrxf.exec:\lxllrxf.exe165⤵PID:2440
-
\??\c:\nnbhnt.exec:\nnbhnt.exe166⤵PID:3048
-
\??\c:\vpddj.exec:\vpddj.exe167⤵PID:2172
-
\??\c:\xfxrxff.exec:\xfxrxff.exe168⤵PID:2404
-
\??\c:\xrxffrr.exec:\xrxffrr.exe169⤵PID:2420
-
\??\c:\nhttbb.exec:\nhttbb.exe170⤵PID:2628
-
\??\c:\7djjp.exec:\7djjp.exe171⤵PID:1628
-
\??\c:\1jvvv.exec:\1jvvv.exe172⤵PID:1704
-
\??\c:\1lxfrlr.exec:\1lxfrlr.exe173⤵PID:812
-
\??\c:\frfxllr.exec:\frfxllr.exe174⤵PID:2484
-
\??\c:\nhttbb.exec:\nhttbb.exe175⤵PID:2332
-
\??\c:\bnbttn.exec:\bnbttn.exe176⤵PID:2328
-
\??\c:\vpvpj.exec:\vpvpj.exe177⤵PID:1416
-
\??\c:\9dddp.exec:\9dddp.exe178⤵PID:1764
-
\??\c:\lfxxffl.exec:\lfxxffl.exe179⤵PID:1260
-
\??\c:\nbbhnn.exec:\nbbhnn.exe180⤵PID:2060
-
\??\c:\9nhthn.exec:\9nhthn.exe181⤵PID:2284
-
\??\c:\3jpjj.exec:\3jpjj.exe182⤵PID:480
-
\??\c:\1jdjp.exec:\1jdjp.exe183⤵PID:676
-
\??\c:\7lxxrrr.exec:\7lxxrrr.exe184⤵PID:584
-
\??\c:\frlrffr.exec:\frlrffr.exe185⤵PID:2092
-
\??\c:\nbnttt.exec:\nbnttt.exe186⤵PID:1148
-
\??\c:\dvdjp.exec:\dvdjp.exe187⤵PID:828
-
\??\c:\jjvjv.exec:\jjvjv.exe188⤵PID:936
-
\??\c:\fxrlxlx.exec:\fxrlxlx.exe189⤵PID:1820
-
\??\c:\3lflxfx.exec:\3lflxfx.exe190⤵PID:856
-
\??\c:\bbthnt.exec:\bbthnt.exe191⤵PID:1620
-
\??\c:\nhtttt.exec:\nhtttt.exe192⤵PID:2996
-
\??\c:\vpdvv.exec:\vpdvv.exe193⤵PID:2156
-
\??\c:\rrrlfrl.exec:\rrrlfrl.exe194⤵PID:2992
-
\??\c:\llxxfxf.exec:\llxxfxf.exe195⤵PID:2352
-
\??\c:\nhbhnt.exec:\nhbhnt.exe196⤵PID:1580
-
\??\c:\hhhntb.exec:\hhhntb.exe197⤵PID:2640
-
\??\c:\pjvvv.exec:\pjvvv.exe198⤵PID:1752
-
\??\c:\xlrrlfr.exec:\xlrrlfr.exe199⤵PID:1720
-
\??\c:\rflflfl.exec:\rflflfl.exe200⤵PID:2948
-
\??\c:\5thbtb.exec:\5thbtb.exe201⤵PID:2944
-
\??\c:\jjvvd.exec:\jjvvd.exe202⤵PID:2676
-
\??\c:\3dpvv.exec:\3dpvv.exe203⤵PID:2904
-
\??\c:\llxxxxf.exec:\llxxxxf.exe204⤵PID:2616
-
\??\c:\9rlrxxx.exec:\9rlrxxx.exe205⤵PID:2464
-
\??\c:\1tnhnt.exec:\1tnhnt.exe206⤵PID:2580
-
\??\c:\jdppd.exec:\jdppd.exe207⤵PID:1276
-
\??\c:\dvjpp.exec:\dvjpp.exe208⤵PID:1584
-
\??\c:\rflfffl.exec:\rflfffl.exe209⤵PID:2216
-
\??\c:\lfxxfxl.exec:\lfxxfxl.exe210⤵PID:2516
-
\??\c:\nntbbt.exec:\nntbbt.exe211⤵PID:2820
-
\??\c:\pjdjv.exec:\pjdjv.exe212⤵PID:1280
-
\??\c:\3ddvj.exec:\3ddvj.exe213⤵PID:1728
-
\??\c:\7xlllrr.exec:\7xlllrr.exe214⤵PID:2532
-
\??\c:\hbnhhn.exec:\hbnhhn.exe215⤵PID:2840
-
\??\c:\9bhhnn.exec:\9bhhnn.exe216⤵PID:1760
-
\??\c:\jppdd.exec:\jppdd.exe217⤵PID:1652
-
\??\c:\jjpdj.exec:\jjpdj.exe218⤵PID:1532
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe219⤵PID:1528
-
\??\c:\tnbbhh.exec:\tnbbhh.exe220⤵PID:1508
-
\??\c:\nnhnnb.exec:\nnhnnb.exe221⤵PID:2424
-
\??\c:\3jddp.exec:\3jddp.exe222⤵PID:1536
-
\??\c:\3lxxxxf.exec:\3lxxxxf.exe223⤵PID:2428
-
\??\c:\lrxxlrf.exec:\lrxxlrf.exe224⤵PID:536
-
\??\c:\bhbhbb.exec:\bhbhbb.exe225⤵PID:324
-
\??\c:\5tbttn.exec:\5tbttn.exe226⤵PID:1096
-
\??\c:\vpvdp.exec:\vpvdp.exe227⤵PID:1484
-
\??\c:\pdpjj.exec:\pdpjj.exe228⤵PID:1784
-
\??\c:\3rrxffx.exec:\3rrxffx.exe229⤵PID:916
-
\??\c:\9ntbbb.exec:\9ntbbb.exe230⤵PID:780
-
\??\c:\1bnntb.exec:\1bnntb.exe231⤵PID:1624
-
\??\c:\dvpvv.exec:\dvpvv.exe232⤵PID:1800
-
\??\c:\vjppv.exec:\vjppv.exe233⤵PID:2804
-
\??\c:\xrlrxfr.exec:\xrlrxfr.exe234⤵PID:1988
-
\??\c:\9xrxllx.exec:\9xrxllx.exe235⤵PID:2128
-
\??\c:\hhbhbn.exec:\hhbhbn.exe236⤵PID:1656
-
\??\c:\jdpdj.exec:\jdpdj.exe237⤵PID:2636
-
\??\c:\3jjjp.exec:\3jjjp.exe238⤵PID:2880
-
\??\c:\3xlrxrx.exec:\3xlrxrx.exe239⤵PID:2664
-
\??\c:\5rrxrxf.exec:\5rrxrxf.exe240⤵PID:2584
-
\??\c:\1nhtbb.exec:\1nhtbb.exe241⤵PID:2768
-
\??\c:\thtnnn.exec:\thtnnn.exe242⤵PID:2684