Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 02:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4e5572d04fdc8a387c8808ac49e5b550_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4e5572d04fdc8a387c8808ac49e5b550_NeikiAnalytics.exe
-
Size
84KB
-
MD5
4e5572d04fdc8a387c8808ac49e5b550
-
SHA1
7da259d92e350fd64b2766f38ccb868982535379
-
SHA256
88b58cc8fbbae05951894e63220ac8cd5cffe1665306c757fea5aed122e0d6ef
-
SHA512
31412abb4dea7f3c6bca8d0774becd880db4b5d9743ea5fb26621613a7234b8830a111524c2ebbb188eb7969ca5b8d47c166a796549c7c8932352908d9829745
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIgt7WxZKmNDnX77lY8/X5Qgrcin:ymb3NkkiQ3mdBjFIgte0mNb77Bptfz
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/1648-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2352-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3064-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2972-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1284-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1884-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1548-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1748-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/536-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/340-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3020-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2140-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/848-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
5pddj.exexrlxlrx.exehhbtnb.exejdppd.exefxffffl.exe9xrxxff.exenhbbtt.exeppjvp.exexxlxflx.exebbntbb.exevvpdp.exepdppv.exexxrrxxl.exebtnntt.exennbhnt.exejjddd.exexrlxffr.exe3rrfrxr.exe3lflrxf.exe1tbnhh.exepjvjv.exefxxflrx.exetnhtbh.exe3hhnbb.exe9vppj.exeddpvp.exefxflrrf.exe5hhtbh.exedpdvd.exedvjjj.exexrllxfr.exefxxxlrf.exe7hhnbh.exedvddj.exepdvpp.exelfrlxxf.exexxxlfxl.exetnnbnh.exenhbntb.exe1dppp.exedvjvd.exelflrfxr.exefflrffr.exebtbbhn.exe7bnthn.exevdjpj.exe3jjjp.exexrxxflr.exerlffrxr.exebhbntn.exennhnbh.exepvvdp.exepdppv.exerrrrflx.exexxflxfr.exehbnbnn.exeddjpd.exepdpjp.exerlrrflx.exexrllrrf.exehhnnbh.exehbhttt.exejjvdp.exevppvj.exepid process 2352 5pddj.exe 2692 xrlxlrx.exe 2204 hhbtnb.exe 3064 jdppd.exe 2848 fxffffl.exe 2732 9xrxxff.exe 2612 nhbbtt.exe 2972 ppjvp.exe 2552 xxlxflx.exe 2804 bbntbb.exe 1284 vvpdp.exe 1356 pdppv.exe 1896 xxrrxxl.exe 1884 btnntt.exe 1204 nnbhnt.exe 2980 jjddd.exe 1788 xrlxffr.exe 1548 3rrfrxr.exe 1748 3lflrxf.exe 2776 1tbnhh.exe 536 pjvjv.exe 1416 fxxflrx.exe 1952 tnhtbh.exe 340 3hhnbb.exe 2084 9vppj.exe 1576 ddpvp.exe 3020 fxflrrf.exe 2140 5hhtbh.exe 2348 dpdvd.exe 848 dvjjj.exe 1740 xrllxfr.exe 2768 fxxxlrf.exe 2696 7hhnbh.exe 2640 dvddj.exe 2724 pdvpp.exe 2692 lfrlxxf.exe 2608 xxxlfxl.exe 2516 tnnbnh.exe 2536 nhbntb.exe 2500 1dppp.exe 2412 dvjvd.exe 2108 lflrfxr.exe 1324 fflrffr.exe 2972 btbbhn.exe 2560 7bnthn.exe 1836 vdjpj.exe 2816 3jjjp.exe 1248 xrxxflr.exe 1356 rlffrxr.exe 1896 bhbntn.exe 1148 nnhnbh.exe 2164 pvvdp.exe 352 pdppv.exe 2980 rrrrflx.exe 2364 xxflxfr.exe 1456 hbnbnn.exe 2836 ddjpd.exe 1776 pdpjp.exe 2336 rlrrflx.exe 536 xrllrrf.exe 592 hhnnbh.exe 2372 hbhttt.exe 2104 jjvdp.exe 656 vppvj.exe -
Processes:
resource yara_rule behavioral1/memory/1648-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2352-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3064-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1284-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1884-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1548-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1748-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/536-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/340-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/848-290-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4e5572d04fdc8a387c8808ac49e5b550_NeikiAnalytics.exe5pddj.exexrlxlrx.exehhbtnb.exejdppd.exefxffffl.exe9xrxxff.exenhbbtt.exeppjvp.exexxlxflx.exebbntbb.exevvpdp.exepdppv.exexxrrxxl.exebtnntt.exennbhnt.exedescription pid process target process PID 1648 wrote to memory of 2352 1648 4e5572d04fdc8a387c8808ac49e5b550_NeikiAnalytics.exe 5pddj.exe PID 1648 wrote to memory of 2352 1648 4e5572d04fdc8a387c8808ac49e5b550_NeikiAnalytics.exe 5pddj.exe PID 1648 wrote to memory of 2352 1648 4e5572d04fdc8a387c8808ac49e5b550_NeikiAnalytics.exe 5pddj.exe PID 1648 wrote to memory of 2352 1648 4e5572d04fdc8a387c8808ac49e5b550_NeikiAnalytics.exe 5pddj.exe PID 2352 wrote to memory of 2692 2352 5pddj.exe xrlxlrx.exe PID 2352 wrote to memory of 2692 2352 5pddj.exe xrlxlrx.exe PID 2352 wrote to memory of 2692 2352 5pddj.exe xrlxlrx.exe PID 2352 wrote to memory of 2692 2352 5pddj.exe xrlxlrx.exe PID 2692 wrote to memory of 2204 2692 xrlxlrx.exe hhbtnb.exe PID 2692 wrote to memory of 2204 2692 xrlxlrx.exe hhbtnb.exe PID 2692 wrote to memory of 2204 2692 xrlxlrx.exe hhbtnb.exe PID 2692 wrote to memory of 2204 2692 xrlxlrx.exe hhbtnb.exe PID 2204 wrote to memory of 3064 2204 hhbtnb.exe jdppd.exe PID 2204 wrote to memory of 3064 2204 hhbtnb.exe jdppd.exe PID 2204 wrote to memory of 3064 2204 hhbtnb.exe jdppd.exe PID 2204 wrote to memory of 3064 2204 hhbtnb.exe jdppd.exe PID 3064 wrote to memory of 2848 3064 jdppd.exe fxffffl.exe PID 3064 wrote to memory of 2848 3064 jdppd.exe fxffffl.exe PID 3064 wrote to memory of 2848 3064 jdppd.exe fxffffl.exe PID 3064 wrote to memory of 2848 3064 jdppd.exe fxffffl.exe PID 2848 wrote to memory of 2732 2848 fxffffl.exe 9xrxxff.exe PID 2848 wrote to memory of 2732 2848 fxffffl.exe 9xrxxff.exe PID 2848 wrote to memory of 2732 2848 fxffffl.exe 9xrxxff.exe PID 2848 wrote to memory of 2732 2848 fxffffl.exe 9xrxxff.exe PID 2732 wrote to memory of 2612 2732 9xrxxff.exe nhbbtt.exe PID 2732 wrote to memory of 2612 2732 9xrxxff.exe nhbbtt.exe PID 2732 wrote to memory of 2612 2732 9xrxxff.exe nhbbtt.exe PID 2732 wrote to memory of 2612 2732 9xrxxff.exe nhbbtt.exe PID 2612 wrote to memory of 2972 2612 nhbbtt.exe ppjvp.exe PID 2612 wrote to memory of 2972 2612 nhbbtt.exe ppjvp.exe PID 2612 wrote to memory of 2972 2612 nhbbtt.exe ppjvp.exe PID 2612 wrote to memory of 2972 2612 nhbbtt.exe ppjvp.exe PID 2972 wrote to memory of 2552 2972 ppjvp.exe xxlxflx.exe PID 2972 wrote to memory of 2552 2972 ppjvp.exe xxlxflx.exe PID 2972 wrote to memory of 2552 2972 ppjvp.exe xxlxflx.exe PID 2972 wrote to memory of 2552 2972 ppjvp.exe xxlxflx.exe PID 2552 wrote to memory of 2804 2552 xxlxflx.exe bbntbb.exe PID 2552 wrote to memory of 2804 2552 xxlxflx.exe bbntbb.exe PID 2552 wrote to memory of 2804 2552 xxlxflx.exe bbntbb.exe PID 2552 wrote to memory of 2804 2552 xxlxflx.exe bbntbb.exe PID 2804 wrote to memory of 1284 2804 bbntbb.exe vvpdp.exe PID 2804 wrote to memory of 1284 2804 bbntbb.exe vvpdp.exe PID 2804 wrote to memory of 1284 2804 bbntbb.exe vvpdp.exe PID 2804 wrote to memory of 1284 2804 bbntbb.exe vvpdp.exe PID 1284 wrote to memory of 1356 1284 vvpdp.exe pdppv.exe PID 1284 wrote to memory of 1356 1284 vvpdp.exe pdppv.exe PID 1284 wrote to memory of 1356 1284 vvpdp.exe pdppv.exe PID 1284 wrote to memory of 1356 1284 vvpdp.exe pdppv.exe PID 1356 wrote to memory of 1896 1356 pdppv.exe xxrrxxl.exe PID 1356 wrote to memory of 1896 1356 pdppv.exe xxrrxxl.exe PID 1356 wrote to memory of 1896 1356 pdppv.exe xxrrxxl.exe PID 1356 wrote to memory of 1896 1356 pdppv.exe xxrrxxl.exe PID 1896 wrote to memory of 1884 1896 xxrrxxl.exe btnntt.exe PID 1896 wrote to memory of 1884 1896 xxrrxxl.exe btnntt.exe PID 1896 wrote to memory of 1884 1896 xxrrxxl.exe btnntt.exe PID 1896 wrote to memory of 1884 1896 xxrrxxl.exe btnntt.exe PID 1884 wrote to memory of 1204 1884 btnntt.exe nnbhnt.exe PID 1884 wrote to memory of 1204 1884 btnntt.exe nnbhnt.exe PID 1884 wrote to memory of 1204 1884 btnntt.exe nnbhnt.exe PID 1884 wrote to memory of 1204 1884 btnntt.exe nnbhnt.exe PID 1204 wrote to memory of 2980 1204 nnbhnt.exe jjddd.exe PID 1204 wrote to memory of 2980 1204 nnbhnt.exe jjddd.exe PID 1204 wrote to memory of 2980 1204 nnbhnt.exe jjddd.exe PID 1204 wrote to memory of 2980 1204 nnbhnt.exe jjddd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e5572d04fdc8a387c8808ac49e5b550_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4e5572d04fdc8a387c8808ac49e5b550_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\5pddj.exec:\5pddj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\xrlxlrx.exec:\xrlxlrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\hhbtnb.exec:\hhbtnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\jdppd.exec:\jdppd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\fxffffl.exec:\fxffffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\9xrxxff.exec:\9xrxxff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\nhbbtt.exec:\nhbbtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\ppjvp.exec:\ppjvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\xxlxflx.exec:\xxlxflx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\bbntbb.exec:\bbntbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\vvpdp.exec:\vvpdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\pdppv.exec:\pdppv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\xxrrxxl.exec:\xxrrxxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\btnntt.exec:\btnntt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\nnbhnt.exec:\nnbhnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\jjddd.exec:\jjddd.exe17⤵
- Executes dropped EXE
PID:2980 -
\??\c:\xrlxffr.exec:\xrlxffr.exe18⤵
- Executes dropped EXE
PID:1788 -
\??\c:\3rrfrxr.exec:\3rrfrxr.exe19⤵
- Executes dropped EXE
PID:1548 -
\??\c:\3lflrxf.exec:\3lflrxf.exe20⤵
- Executes dropped EXE
PID:1748 -
\??\c:\1tbnhh.exec:\1tbnhh.exe21⤵
- Executes dropped EXE
PID:2776 -
\??\c:\pjvjv.exec:\pjvjv.exe22⤵
- Executes dropped EXE
PID:536 -
\??\c:\fxxflrx.exec:\fxxflrx.exe23⤵
- Executes dropped EXE
PID:1416 -
\??\c:\tnhtbh.exec:\tnhtbh.exe24⤵
- Executes dropped EXE
PID:1952 -
\??\c:\3hhnbb.exec:\3hhnbb.exe25⤵
- Executes dropped EXE
PID:340 -
\??\c:\9vppj.exec:\9vppj.exe26⤵
- Executes dropped EXE
PID:2084 -
\??\c:\ddpvp.exec:\ddpvp.exe27⤵
- Executes dropped EXE
PID:1576 -
\??\c:\fxflrrf.exec:\fxflrrf.exe28⤵
- Executes dropped EXE
PID:3020 -
\??\c:\5hhtbh.exec:\5hhtbh.exe29⤵
- Executes dropped EXE
PID:2140 -
\??\c:\dpdvd.exec:\dpdvd.exe30⤵
- Executes dropped EXE
PID:2348 -
\??\c:\dvjjj.exec:\dvjjj.exe31⤵
- Executes dropped EXE
PID:848 -
\??\c:\xrllxfr.exec:\xrllxfr.exe32⤵
- Executes dropped EXE
PID:1740 -
\??\c:\fxxxlrf.exec:\fxxxlrf.exe33⤵
- Executes dropped EXE
PID:2768 -
\??\c:\7hhnbh.exec:\7hhnbh.exe34⤵
- Executes dropped EXE
PID:2696 -
\??\c:\dvddj.exec:\dvddj.exe35⤵
- Executes dropped EXE
PID:2640 -
\??\c:\pdvpp.exec:\pdvpp.exe36⤵
- Executes dropped EXE
PID:2724 -
\??\c:\lfrlxxf.exec:\lfrlxxf.exe37⤵
- Executes dropped EXE
PID:2692 -
\??\c:\xxxlfxl.exec:\xxxlfxl.exe38⤵
- Executes dropped EXE
PID:2608 -
\??\c:\tnnbnh.exec:\tnnbnh.exe39⤵
- Executes dropped EXE
PID:2516 -
\??\c:\nhbntb.exec:\nhbntb.exe40⤵
- Executes dropped EXE
PID:2536 -
\??\c:\1dppp.exec:\1dppp.exe41⤵
- Executes dropped EXE
PID:2500 -
\??\c:\dvjvd.exec:\dvjvd.exe42⤵
- Executes dropped EXE
PID:2412 -
\??\c:\lflrfxr.exec:\lflrfxr.exe43⤵
- Executes dropped EXE
PID:2108 -
\??\c:\fflrffr.exec:\fflrffr.exe44⤵
- Executes dropped EXE
PID:1324 -
\??\c:\btbbhn.exec:\btbbhn.exe45⤵
- Executes dropped EXE
PID:2972 -
\??\c:\7bnthn.exec:\7bnthn.exe46⤵
- Executes dropped EXE
PID:2560 -
\??\c:\vdjpj.exec:\vdjpj.exe47⤵
- Executes dropped EXE
PID:1836 -
\??\c:\3jjjp.exec:\3jjjp.exe48⤵
- Executes dropped EXE
PID:2816 -
\??\c:\xrxxflr.exec:\xrxxflr.exe49⤵
- Executes dropped EXE
PID:1248 -
\??\c:\rlffrxr.exec:\rlffrxr.exe50⤵
- Executes dropped EXE
PID:1356 -
\??\c:\bhbntn.exec:\bhbntn.exe51⤵
- Executes dropped EXE
PID:1896 -
\??\c:\nnhnbh.exec:\nnhnbh.exe52⤵
- Executes dropped EXE
PID:1148 -
\??\c:\pvvdp.exec:\pvvdp.exe53⤵
- Executes dropped EXE
PID:2164 -
\??\c:\pdppv.exec:\pdppv.exe54⤵
- Executes dropped EXE
PID:352 -
\??\c:\rrrrflx.exec:\rrrrflx.exe55⤵
- Executes dropped EXE
PID:2980 -
\??\c:\xxflxfr.exec:\xxflxfr.exe56⤵
- Executes dropped EXE
PID:2364 -
\??\c:\hbnbnn.exec:\hbnbnn.exe57⤵
- Executes dropped EXE
PID:1456 -
\??\c:\ddjpd.exec:\ddjpd.exe58⤵
- Executes dropped EXE
PID:2836 -
\??\c:\pdpjp.exec:\pdpjp.exe59⤵
- Executes dropped EXE
PID:1776 -
\??\c:\rlrrflx.exec:\rlrrflx.exe60⤵
- Executes dropped EXE
PID:2336 -
\??\c:\xrllrrf.exec:\xrllrrf.exe61⤵
- Executes dropped EXE
PID:536 -
\??\c:\hhnnbh.exec:\hhnnbh.exe62⤵
- Executes dropped EXE
PID:592 -
\??\c:\hbhttt.exec:\hbhttt.exe63⤵
- Executes dropped EXE
PID:2372 -
\??\c:\jjvdp.exec:\jjvdp.exe64⤵
- Executes dropped EXE
PID:2104 -
\??\c:\vppvj.exec:\vppvj.exe65⤵
- Executes dropped EXE
PID:656 -
\??\c:\xrffllx.exec:\xrffllx.exe66⤵PID:752
-
\??\c:\lflrxfr.exec:\lflrxfr.exe67⤵PID:1580
-
\??\c:\btbtnn.exec:\btbtnn.exe68⤵PID:2268
-
\??\c:\nhnbhh.exec:\nhnbhh.exe69⤵PID:876
-
\??\c:\vppdj.exec:\vppdj.exe70⤵PID:2392
-
\??\c:\dvdvj.exec:\dvdvj.exe71⤵PID:884
-
\??\c:\lxlrxfr.exec:\lxlrxfr.exe72⤵PID:316
-
\??\c:\xxffllx.exec:\xxffllx.exe73⤵PID:1888
-
\??\c:\btnbbt.exec:\btnbbt.exe74⤵PID:2584
-
\??\c:\nhbbhh.exec:\nhbbhh.exe75⤵PID:2712
-
\??\c:\1pppv.exec:\1pppv.exe76⤵PID:1640
-
\??\c:\jdjvj.exec:\jdjvj.exe77⤵PID:2616
-
\??\c:\1lxflrf.exec:\1lxflrf.exe78⤵PID:2596
-
\??\c:\7nttbh.exec:\7nttbh.exe79⤵PID:304
-
\??\c:\tnbhnb.exec:\tnbhnb.exe80⤵PID:2628
-
\??\c:\dddpv.exec:\dddpv.exe81⤵PID:2488
-
\??\c:\7vppv.exec:\7vppv.exe82⤵PID:2540
-
\??\c:\1fxflrx.exec:\1fxflrx.exe83⤵PID:2664
-
\??\c:\rlxfrxl.exec:\rlxfrxl.exe84⤵PID:1584
-
\??\c:\tnbtbb.exec:\tnbtbb.exe85⤵PID:2668
-
\??\c:\9hbhtt.exec:\9hbhtt.exe86⤵PID:2580
-
\??\c:\dvddj.exec:\dvddj.exe87⤵PID:2592
-
\??\c:\pdddj.exec:\pdddj.exe88⤵PID:2804
-
\??\c:\lfrxlrf.exec:\lfrxlrf.exe89⤵PID:1452
-
\??\c:\xrlrxff.exec:\xrlrxff.exe90⤵PID:1848
-
\??\c:\7xrfrrf.exec:\7xrfrrf.exe91⤵PID:1916
-
\??\c:\btttnn.exec:\btttnn.exe92⤵PID:2380
-
\??\c:\1pjvd.exec:\1pjvd.exe93⤵PID:1348
-
\??\c:\7pddd.exec:\7pddd.exe94⤵PID:1040
-
\??\c:\rlxfrrf.exec:\rlxfrrf.exe95⤵PID:1768
-
\??\c:\xxlrffr.exec:\xxlrffr.exe96⤵PID:2236
-
\??\c:\nhhtbh.exec:\nhhtbh.exe97⤵PID:2936
-
\??\c:\hntnnh.exec:\hntnnh.exe98⤵PID:2896
-
\??\c:\btbbnn.exec:\btbbnn.exe99⤵PID:1456
-
\??\c:\jdvvp.exec:\jdvvp.exe100⤵PID:2004
-
\??\c:\3pppv.exec:\3pppv.exe101⤵PID:1520
-
\??\c:\lfllrlx.exec:\lfllrlx.exe102⤵PID:2852
-
\??\c:\rlflrrl.exec:\rlflrrl.exe103⤵PID:1736
-
\??\c:\3tthnt.exec:\3tthnt.exe104⤵PID:1908
-
\??\c:\hbtbhn.exec:\hbtbhn.exe105⤵PID:692
-
\??\c:\vpdvd.exec:\vpdvd.exe106⤵PID:3052
-
\??\c:\vpdjp.exec:\vpdjp.exe107⤵PID:2248
-
\??\c:\fxflxxl.exec:\fxflxxl.exe108⤵PID:2388
-
\??\c:\xxflxlx.exec:\xxflxlx.exe109⤵PID:284
-
\??\c:\fxlxlrf.exec:\fxlxlrf.exe110⤵PID:1112
-
\??\c:\1tntbh.exec:\1tntbh.exe111⤵PID:3000
-
\??\c:\tntbnn.exec:\tntbnn.exe112⤵PID:2920
-
\??\c:\dvpvd.exec:\dvpvd.exe113⤵PID:1652
-
\??\c:\jdppd.exec:\jdppd.exe114⤵PID:1228
-
\??\c:\xrlrlrx.exec:\xrlrlrx.exe115⤵PID:2148
-
\??\c:\fxxxlrl.exec:\fxxxlrl.exe116⤵PID:1532
-
\??\c:\1bnnbh.exec:\1bnnbh.exe117⤵PID:2620
-
\??\c:\thhtbh.exec:\thhtbh.exe118⤵PID:2624
-
\??\c:\3pddj.exec:\3pddj.exe119⤵PID:2692
-
\??\c:\jdjpv.exec:\jdjpv.exe120⤵PID:2876
-
\??\c:\9lffrrx.exec:\9lffrrx.exe121⤵PID:2544
-
\??\c:\fxrrxxl.exec:\fxrrxxl.exe122⤵PID:2532
-
\??\c:\ttntnn.exec:\ttntnn.exe123⤵PID:2956
-
\??\c:\5nhhnn.exec:\5nhhnn.exe124⤵PID:2612
-
\??\c:\jvvpp.exec:\jvvpp.exe125⤵PID:2332
-
\??\c:\dvdjv.exec:\dvdjv.exe126⤵PID:2780
-
\??\c:\lfrrrxl.exec:\lfrrrxl.exe127⤵PID:2736
-
\??\c:\5bnntt.exec:\5bnntt.exe128⤵PID:2376
-
\??\c:\1nnbnt.exec:\1nnbnt.exe129⤵PID:1836
-
\??\c:\pjvvd.exec:\pjvvd.exe130⤵PID:1612
-
\??\c:\vpvdp.exec:\vpvdp.exe131⤵PID:836
-
\??\c:\xxrllrf.exec:\xxrllrf.exe132⤵PID:2292
-
\??\c:\fxllrrf.exec:\fxllrrf.exe133⤵PID:1896
-
\??\c:\hhhhbb.exec:\hhhhbb.exe134⤵PID:1852
-
\??\c:\hhbhbb.exec:\hhbhbb.exe135⤵PID:2164
-
\??\c:\pjdjj.exec:\pjdjj.exe136⤵PID:1796
-
\??\c:\jjppp.exec:\jjppp.exe137⤵PID:1764
-
\??\c:\rfrfllx.exec:\rfrfllx.exe138⤵PID:2360
-
\??\c:\rlxflrf.exec:\rlxflrf.exe139⤵PID:2904
-
\??\c:\tnbhnn.exec:\tnbhnn.exe140⤵PID:388
-
\??\c:\5tbnbh.exec:\5tbnbh.exe141⤵PID:1628
-
\??\c:\vvppd.exec:\vvppd.exe142⤵PID:1400
-
\??\c:\3vvdj.exec:\3vvdj.exe143⤵PID:536
-
\??\c:\1lxxflx.exec:\1lxxflx.exe144⤵PID:1416
-
\??\c:\fxlrffl.exec:\fxlrffl.exe145⤵PID:340
-
\??\c:\tntbhh.exec:\tntbhh.exe146⤵PID:2084
-
\??\c:\bbthhh.exec:\bbthhh.exe147⤵PID:656
-
\??\c:\vpjpv.exec:\vpjpv.exe148⤵PID:2996
-
\??\c:\jdpjv.exec:\jdpjv.exe149⤵PID:1580
-
\??\c:\xxlxffr.exec:\xxlxffr.exe150⤵PID:2268
-
\??\c:\lxrfxxf.exec:\lxrfxxf.exe151⤵PID:2932
-
\??\c:\nnbhnt.exec:\nnbhnt.exe152⤵PID:2284
-
\??\c:\1hnbbb.exec:\1hnbbb.exe153⤵PID:1428
-
\??\c:\bttbbh.exec:\bttbbh.exe154⤵PID:2056
-
\??\c:\7pdpv.exec:\7pdpv.exe155⤵PID:2704
-
\??\c:\rrfllrf.exec:\rrfllrf.exe156⤵PID:1044
-
\??\c:\xrllflx.exec:\xrllflx.exe157⤵PID:2716
-
\??\c:\xxxlxfx.exec:\xxxlxfx.exe158⤵PID:2884
-
\??\c:\nhthbn.exec:\nhthbn.exe159⤵PID:2756
-
\??\c:\7bnnhh.exec:\7bnnhh.exe160⤵PID:2396
-
\??\c:\ddvdv.exec:\ddvdv.exe161⤵PID:304
-
\??\c:\pvjjv.exec:\pvjjv.exe162⤵PID:2156
-
\??\c:\frxxlrf.exec:\frxxlrf.exe163⤵PID:2504
-
\??\c:\3llxflf.exec:\3llxflf.exe164⤵PID:2540
-
\??\c:\3htbhn.exec:\3htbhn.exe165⤵PID:2108
-
\??\c:\tthnbb.exec:\tthnbb.exe166⤵PID:2032
-
\??\c:\vvppd.exec:\vvppd.exe167⤵PID:2476
-
\??\c:\rrffrxl.exec:\rrffrxl.exe168⤵PID:2788
-
\??\c:\7frxflf.exec:\7frxflf.exe169⤵PID:2592
-
\??\c:\7rrflxf.exec:\7rrflxf.exe170⤵PID:1624
-
\??\c:\7bbntt.exec:\7bbntt.exe171⤵PID:1248
-
\??\c:\nhhbhh.exec:\nhhbhh.exe172⤵PID:1844
-
\??\c:\jdpvp.exec:\jdpvp.exe173⤵PID:2012
-
\??\c:\9vpvd.exec:\9vpvd.exe174⤵PID:1804
-
\??\c:\xxlxlxl.exec:\xxlxlxl.exe175⤵PID:1032
-
\??\c:\rlrxlrx.exec:\rlrxlrx.exe176⤵PID:2948
-
\??\c:\hhbbnt.exec:\hhbbnt.exe177⤵PID:2980
-
\??\c:\bhhtth.exec:\bhhtth.exe178⤵PID:2240
-
\??\c:\ppjjp.exec:\ppjjp.exe179⤵PID:308
-
\??\c:\7jjvv.exec:\7jjvv.exe180⤵PID:2836
-
\??\c:\lxrrxrx.exec:\lxrrxrx.exe181⤵PID:1776
-
\??\c:\fxllfxr.exec:\fxllfxr.exe182⤵PID:1568
-
\??\c:\1nnhbh.exec:\1nnhbh.exe183⤵PID:984
-
\??\c:\7tntbh.exec:\7tntbh.exe184⤵PID:1048
-
\??\c:\5dpjv.exec:\5dpjv.exe185⤵PID:2280
-
\??\c:\dvjpd.exec:\dvjpd.exe186⤵PID:3060
-
\??\c:\xrllfrx.exec:\xrllfrx.exe187⤵PID:2232
-
\??\c:\ffxxfxf.exec:\ffxxfxf.exe188⤵PID:3052
-
\??\c:\hbhnbb.exec:\hbhnbb.exe189⤵PID:3020
-
\??\c:\ttnbhn.exec:\ttnbhn.exe190⤵PID:2076
-
\??\c:\jjppv.exec:\jjppv.exe191⤵PID:2448
-
\??\c:\9dvdp.exec:\9dvdp.exe192⤵PID:2392
-
\??\c:\xrxfxrf.exec:\xrxfxrf.exe193⤵PID:2940
-
\??\c:\fxllrrx.exec:\fxllrrx.exe194⤵PID:2060
-
\??\c:\nhttnn.exec:\nhttnn.exe195⤵PID:1652
-
\??\c:\tnhtbb.exec:\tnhtbb.exe196⤵PID:1228
-
\??\c:\3pjjp.exec:\3pjjp.exe197⤵PID:2712
-
\??\c:\pjvvd.exec:\pjvvd.exe198⤵PID:2700
-
\??\c:\frlrflx.exec:\frlrflx.exe199⤵PID:2616
-
\??\c:\lfxfrxr.exec:\lfxfrxr.exe200⤵PID:2840
-
\??\c:\bhnttn.exec:\bhnttn.exe201⤵PID:2604
-
\??\c:\tnnnbh.exec:\tnnnbh.exe202⤵PID:2484
-
\??\c:\3tthth.exec:\3tthth.exe203⤵PID:2492
-
\??\c:\tnttbh.exec:\tnttbh.exe204⤵PID:2960
-
\??\c:\ppjpd.exec:\ppjpd.exe205⤵PID:2412
-
\??\c:\llxrffr.exec:\llxrffr.exe206⤵PID:624
-
\??\c:\5fffrrx.exec:\5fffrrx.exe207⤵PID:2800
-
\??\c:\9btbnn.exec:\9btbnn.exe208⤵PID:2560
-
\??\c:\7ddjp.exec:\7ddjp.exe209⤵PID:1620
-
\??\c:\5lrxxlx.exec:\5lrxxlx.exe210⤵PID:2784
-
\??\c:\xlflllr.exec:\xlflllr.exe211⤵PID:1676
-
\??\c:\5hhhbh.exec:\5hhhbh.exe212⤵PID:1864
-
\??\c:\bbhtbh.exec:\bbhtbh.exe213⤵PID:1916
-
\??\c:\vvpvd.exec:\vvpvd.exe214⤵PID:2844
-
\??\c:\pppdp.exec:\pppdp.exe215⤵PID:1208
-
\??\c:\rlffrfl.exec:\rlffrfl.exe216⤵PID:1040
-
\??\c:\xrrflxf.exec:\xrrflxf.exe217⤵PID:1232
-
\??\c:\9nhbnn.exec:\9nhbnn.exe218⤵PID:2236
-
\??\c:\5btntt.exec:\5btntt.exe219⤵PID:1764
-
\??\c:\pjdjv.exec:\pjdjv.exe220⤵PID:1460
-
\??\c:\7vdjv.exec:\7vdjv.exe221⤵PID:2896
-
\??\c:\llllrfr.exec:\llllrfr.exe222⤵PID:584
-
\??\c:\llxllrl.exec:\llxllrl.exe223⤵PID:1572
-
\??\c:\tntthn.exec:\tntthn.exe224⤵PID:540
-
\??\c:\9thtbb.exec:\9thtbb.exe225⤵PID:2456
-
\??\c:\dvjjj.exec:\dvjjj.exe226⤵PID:1416
-
\??\c:\5jddv.exec:\5jddv.exe227⤵PID:692
-
\??\c:\lfrxxxl.exec:\lfrxxxl.exe228⤵PID:752
-
\??\c:\ffrxfxx.exec:\ffrxfxx.exe229⤵PID:2144
-
\??\c:\hhbhhh.exec:\hhbhhh.exe230⤵PID:1668
-
\??\c:\hhbtbt.exec:\hhbtbt.exe231⤵PID:1664
-
\??\c:\pjvdp.exec:\pjvdp.exe232⤵PID:1112
-
\??\c:\9vppd.exec:\9vppd.exe233⤵PID:2932
-
\??\c:\xrfrxlx.exec:\xrfrxlx.exe234⤵PID:2920
-
\??\c:\llflxfl.exec:\llflxfl.exe235⤵PID:2684
-
\??\c:\bbnbht.exec:\bbnbht.exe236⤵PID:2352
-
\??\c:\nhntnt.exec:\nhntnt.exe237⤵PID:2632
-
\??\c:\1ppdj.exec:\1ppdj.exe238⤵PID:1044
-
\??\c:\flxxfrx.exec:\flxxfrx.exe239⤵PID:2716
-
\??\c:\lfxfrrx.exec:\lfxfrrx.exe240⤵PID:2760
-
\??\c:\bthttt.exec:\bthttt.exe241⤵PID:2756
-
\??\c:\5btbhb.exec:\5btbhb.exe242⤵PID:2876