Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 02:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
52bc9a720150b31b54507e6e1ff53870_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
52bc9a720150b31b54507e6e1ff53870_NeikiAnalytics.exe
-
Size
93KB
-
MD5
52bc9a720150b31b54507e6e1ff53870
-
SHA1
125c2090cc51b06b2b696897b222c61258526eda
-
SHA256
2513d1c12104c89c18494b5b41858a8462e743cd092d69af1fce6c7726619ecf
-
SHA512
f179a59b5566858b9790e31476cfd1c1a427ec9f622bd502613362563332a8b1b332351dd93589b5c22fd9ab992c7e18a20313cf9f4e3aea62e3281f9f8d73a7
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo7NANTBuQG1np24+2OXA:ymb3NkkiQ3mdBjFo7NguQG1n0USA
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral1/memory/1488-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2008-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2008-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-65-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2500-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-85-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2484-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1852-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/316-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1988-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1180-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/780-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1800-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/340-266-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1244-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pjdjd.exebtnthn.exepjvdp.exepjjjp.exerlxflxl.exebnnttb.exe9jvvd.exelfxxllx.exellffrxl.exetntbbb.exepjdpj.exelxxfrxl.exelfxxffr.exehhbhtb.exevpdpv.exepjddv.exe5rflrff.exettbbnt.exepjdjd.exevpjvd.exerfrrxxf.exerlxxrrx.exebthtbn.exejvjjp.exejdjjv.exe7xrrfxl.exefxflxxf.exe5pvdp.exe5frrxxl.exelxrrflr.exenbtbhn.exe9htbtt.exejdpvd.exefxllllx.exeffrrxxl.exennntbn.exehthhtb.exe3pppv.exerlrlrrf.exe5fffxrx.exehbbnbb.exenbttbh.exevvddp.exe7vvvv.exe9xffllr.exebnbhnn.exe5tthnt.exe3nbtnn.exedppdv.exe9dddp.exe5fxrllx.exefxrfflr.exenhtbnt.exe7thbhh.exedpjvd.exerlxxlrx.exerfxxllr.exetnbhtt.exetntbnn.exe5pdjd.exedvvpd.exefxxfllx.exerlffrlr.exe9hnntb.exepid process 2008 pjdjd.exe 2604 btnthn.exe 2680 pjvdp.exe 2596 pjjjp.exe 2500 rlxflxl.exe 2600 bnnttb.exe 2484 9jvvd.exe 2920 lfxxllx.exe 1868 llffrxl.exe 2440 tntbbb.exe 2648 pjdpj.exe 372 lxxfrxl.exe 1852 lfxxffr.exe 316 hhbhtb.exe 1988 vpdpv.exe 1908 pjddv.exe 1520 5rflrff.exe 1180 ttbbnt.exe 2944 pjdjd.exe 2304 vpjvd.exe 2772 rfrrxxf.exe 780 rlxxrrx.exe 1632 bthtbn.exe 1800 jvjjp.exe 1036 jdjjv.exe 1088 7xrrfxl.exe 340 fxflxxf.exe 1244 5pvdp.exe 624 5frrxxl.exe 2348 lxrrflr.exe 884 nbtbhn.exe 2892 9htbtt.exe 1588 jdpvd.exe 3020 fxllllx.exe 2312 ffrrxxl.exe 2612 nnntbn.exe 2608 hthhtb.exe 2588 3pppv.exe 2844 rlrlrrf.exe 2596 5fffxrx.exe 2512 hbbnbb.exe 2460 nbttbh.exe 2484 vvddp.exe 2712 7vvvv.exe 1040 9xffllr.exe 760 bnbhnn.exe 2752 5tthnt.exe 1664 3nbtnn.exe 2104 dppdv.exe 2024 9dddp.exe 1288 5fxrllx.exe 1980 fxrfflr.exe 2272 nhtbnt.exe 1968 7thbhh.exe 2112 dpjvd.exe 1748 rlxxlrx.exe 2300 rfxxllr.exe 1948 tnbhtt.exe 2872 tntbnn.exe 2304 5pdjd.exe 2772 dvvpd.exe 1484 fxxfllx.exe 2796 rlffrlr.exe 648 9hnntb.exe -
Processes:
resource yara_rule behavioral1/memory/1488-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1488-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1852-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/316-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1988-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1180-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/780-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1800-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/340-266-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1244-275-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-293-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
52bc9a720150b31b54507e6e1ff53870_NeikiAnalytics.exepjdjd.exebtnthn.exepjvdp.exepjjjp.exerlxflxl.exebnnttb.exe9jvvd.exelfxxllx.exellffrxl.exetntbbb.exepjdpj.exelxxfrxl.exelfxxffr.exehhbhtb.exevpdpv.exedescription pid process target process PID 1488 wrote to memory of 2008 1488 52bc9a720150b31b54507e6e1ff53870_NeikiAnalytics.exe pjdjd.exe PID 1488 wrote to memory of 2008 1488 52bc9a720150b31b54507e6e1ff53870_NeikiAnalytics.exe pjdjd.exe PID 1488 wrote to memory of 2008 1488 52bc9a720150b31b54507e6e1ff53870_NeikiAnalytics.exe pjdjd.exe PID 1488 wrote to memory of 2008 1488 52bc9a720150b31b54507e6e1ff53870_NeikiAnalytics.exe pjdjd.exe PID 2008 wrote to memory of 2604 2008 pjdjd.exe btnthn.exe PID 2008 wrote to memory of 2604 2008 pjdjd.exe btnthn.exe PID 2008 wrote to memory of 2604 2008 pjdjd.exe btnthn.exe PID 2008 wrote to memory of 2604 2008 pjdjd.exe btnthn.exe PID 2604 wrote to memory of 2680 2604 btnthn.exe pjvdp.exe PID 2604 wrote to memory of 2680 2604 btnthn.exe pjvdp.exe PID 2604 wrote to memory of 2680 2604 btnthn.exe pjvdp.exe PID 2604 wrote to memory of 2680 2604 btnthn.exe pjvdp.exe PID 2680 wrote to memory of 2596 2680 pjvdp.exe pjjjp.exe PID 2680 wrote to memory of 2596 2680 pjvdp.exe pjjjp.exe PID 2680 wrote to memory of 2596 2680 pjvdp.exe pjjjp.exe PID 2680 wrote to memory of 2596 2680 pjvdp.exe pjjjp.exe PID 2596 wrote to memory of 2500 2596 pjjjp.exe rlxflxl.exe PID 2596 wrote to memory of 2500 2596 pjjjp.exe rlxflxl.exe PID 2596 wrote to memory of 2500 2596 pjjjp.exe rlxflxl.exe PID 2596 wrote to memory of 2500 2596 pjjjp.exe rlxflxl.exe PID 2500 wrote to memory of 2600 2500 rlxflxl.exe bnnttb.exe PID 2500 wrote to memory of 2600 2500 rlxflxl.exe bnnttb.exe PID 2500 wrote to memory of 2600 2500 rlxflxl.exe bnnttb.exe PID 2500 wrote to memory of 2600 2500 rlxflxl.exe bnnttb.exe PID 2600 wrote to memory of 2484 2600 bnnttb.exe 9jvvd.exe PID 2600 wrote to memory of 2484 2600 bnnttb.exe 9jvvd.exe PID 2600 wrote to memory of 2484 2600 bnnttb.exe 9jvvd.exe PID 2600 wrote to memory of 2484 2600 bnnttb.exe 9jvvd.exe PID 2484 wrote to memory of 2920 2484 9jvvd.exe lfxxllx.exe PID 2484 wrote to memory of 2920 2484 9jvvd.exe lfxxllx.exe PID 2484 wrote to memory of 2920 2484 9jvvd.exe lfxxllx.exe PID 2484 wrote to memory of 2920 2484 9jvvd.exe lfxxllx.exe PID 2920 wrote to memory of 1868 2920 lfxxllx.exe llffrxl.exe PID 2920 wrote to memory of 1868 2920 lfxxllx.exe llffrxl.exe PID 2920 wrote to memory of 1868 2920 lfxxllx.exe llffrxl.exe PID 2920 wrote to memory of 1868 2920 lfxxllx.exe llffrxl.exe PID 1868 wrote to memory of 2440 1868 llffrxl.exe tntbbb.exe PID 1868 wrote to memory of 2440 1868 llffrxl.exe tntbbb.exe PID 1868 wrote to memory of 2440 1868 llffrxl.exe tntbbb.exe PID 1868 wrote to memory of 2440 1868 llffrxl.exe tntbbb.exe PID 2440 wrote to memory of 2648 2440 tntbbb.exe pjdpj.exe PID 2440 wrote to memory of 2648 2440 tntbbb.exe pjdpj.exe PID 2440 wrote to memory of 2648 2440 tntbbb.exe pjdpj.exe PID 2440 wrote to memory of 2648 2440 tntbbb.exe pjdpj.exe PID 2648 wrote to memory of 372 2648 pjdpj.exe lxxfrxl.exe PID 2648 wrote to memory of 372 2648 pjdpj.exe lxxfrxl.exe PID 2648 wrote to memory of 372 2648 pjdpj.exe lxxfrxl.exe PID 2648 wrote to memory of 372 2648 pjdpj.exe lxxfrxl.exe PID 372 wrote to memory of 1852 372 lxxfrxl.exe lfxxffr.exe PID 372 wrote to memory of 1852 372 lxxfrxl.exe lfxxffr.exe PID 372 wrote to memory of 1852 372 lxxfrxl.exe lfxxffr.exe PID 372 wrote to memory of 1852 372 lxxfrxl.exe lfxxffr.exe PID 1852 wrote to memory of 316 1852 lfxxffr.exe hhbhtb.exe PID 1852 wrote to memory of 316 1852 lfxxffr.exe hhbhtb.exe PID 1852 wrote to memory of 316 1852 lfxxffr.exe hhbhtb.exe PID 1852 wrote to memory of 316 1852 lfxxffr.exe hhbhtb.exe PID 316 wrote to memory of 1988 316 hhbhtb.exe vpdpv.exe PID 316 wrote to memory of 1988 316 hhbhtb.exe vpdpv.exe PID 316 wrote to memory of 1988 316 hhbhtb.exe vpdpv.exe PID 316 wrote to memory of 1988 316 hhbhtb.exe vpdpv.exe PID 1988 wrote to memory of 1908 1988 vpdpv.exe pjddv.exe PID 1988 wrote to memory of 1908 1988 vpdpv.exe pjddv.exe PID 1988 wrote to memory of 1908 1988 vpdpv.exe pjddv.exe PID 1988 wrote to memory of 1908 1988 vpdpv.exe pjddv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\52bc9a720150b31b54507e6e1ff53870_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\52bc9a720150b31b54507e6e1ff53870_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\pjdjd.exec:\pjdjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\btnthn.exec:\btnthn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\pjvdp.exec:\pjvdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\pjjjp.exec:\pjjjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\rlxflxl.exec:\rlxflxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\bnnttb.exec:\bnnttb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\9jvvd.exec:\9jvvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\lfxxllx.exec:\lfxxllx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\llffrxl.exec:\llffrxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\tntbbb.exec:\tntbbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\pjdpj.exec:\pjdpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\lxxfrxl.exec:\lxxfrxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\lfxxffr.exec:\lfxxffr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\hhbhtb.exec:\hhbhtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\vpdpv.exec:\vpdpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\pjddv.exec:\pjddv.exe17⤵
- Executes dropped EXE
PID:1908 -
\??\c:\5rflrff.exec:\5rflrff.exe18⤵
- Executes dropped EXE
PID:1520 -
\??\c:\ttbbnt.exec:\ttbbnt.exe19⤵
- Executes dropped EXE
PID:1180 -
\??\c:\pjdjd.exec:\pjdjd.exe20⤵
- Executes dropped EXE
PID:2944 -
\??\c:\vpjvd.exec:\vpjvd.exe21⤵
- Executes dropped EXE
PID:2304 -
\??\c:\rfrrxxf.exec:\rfrrxxf.exe22⤵
- Executes dropped EXE
PID:2772 -
\??\c:\rlxxrrx.exec:\rlxxrrx.exe23⤵
- Executes dropped EXE
PID:780 -
\??\c:\bthtbn.exec:\bthtbn.exe24⤵
- Executes dropped EXE
PID:1632 -
\??\c:\jvjjp.exec:\jvjjp.exe25⤵
- Executes dropped EXE
PID:1800 -
\??\c:\jdjjv.exec:\jdjjv.exe26⤵
- Executes dropped EXE
PID:1036 -
\??\c:\7xrrfxl.exec:\7xrrfxl.exe27⤵
- Executes dropped EXE
PID:1088 -
\??\c:\fxflxxf.exec:\fxflxxf.exe28⤵
- Executes dropped EXE
PID:340 -
\??\c:\5pvdp.exec:\5pvdp.exe29⤵
- Executes dropped EXE
PID:1244 -
\??\c:\5frrxxl.exec:\5frrxxl.exe30⤵
- Executes dropped EXE
PID:624 -
\??\c:\lxrrflr.exec:\lxrrflr.exe31⤵
- Executes dropped EXE
PID:2348 -
\??\c:\nbtbhn.exec:\nbtbhn.exe32⤵
- Executes dropped EXE
PID:884 -
\??\c:\9htbtt.exec:\9htbtt.exe33⤵
- Executes dropped EXE
PID:2892 -
\??\c:\jdpvd.exec:\jdpvd.exe34⤵
- Executes dropped EXE
PID:1588 -
\??\c:\fxllllx.exec:\fxllllx.exe35⤵
- Executes dropped EXE
PID:3020 -
\??\c:\ffrrxxl.exec:\ffrrxxl.exe36⤵
- Executes dropped EXE
PID:2312 -
\??\c:\nnntbn.exec:\nnntbn.exe37⤵
- Executes dropped EXE
PID:2612 -
\??\c:\hthhtb.exec:\hthhtb.exe38⤵
- Executes dropped EXE
PID:2608 -
\??\c:\3pppv.exec:\3pppv.exe39⤵
- Executes dropped EXE
PID:2588 -
\??\c:\rlrlrrf.exec:\rlrlrrf.exe40⤵
- Executes dropped EXE
PID:2844 -
\??\c:\5fffxrx.exec:\5fffxrx.exe41⤵
- Executes dropped EXE
PID:2596 -
\??\c:\hbbnbb.exec:\hbbnbb.exe42⤵
- Executes dropped EXE
PID:2512 -
\??\c:\nbttbh.exec:\nbttbh.exe43⤵
- Executes dropped EXE
PID:2460 -
\??\c:\vvddp.exec:\vvddp.exe44⤵
- Executes dropped EXE
PID:2484 -
\??\c:\7vvvv.exec:\7vvvv.exe45⤵
- Executes dropped EXE
PID:2712 -
\??\c:\9xffllr.exec:\9xffllr.exe46⤵
- Executes dropped EXE
PID:1040 -
\??\c:\bnbhnn.exec:\bnbhnn.exe47⤵
- Executes dropped EXE
PID:760 -
\??\c:\5tthnt.exec:\5tthnt.exe48⤵
- Executes dropped EXE
PID:2752 -
\??\c:\3nbtnn.exec:\3nbtnn.exe49⤵
- Executes dropped EXE
PID:1664 -
\??\c:\dppdv.exec:\dppdv.exe50⤵
- Executes dropped EXE
PID:2104 -
\??\c:\9dddp.exec:\9dddp.exe51⤵
- Executes dropped EXE
PID:2024 -
\??\c:\5fxrllx.exec:\5fxrllx.exe52⤵
- Executes dropped EXE
PID:1288 -
\??\c:\fxrfflr.exec:\fxrfflr.exe53⤵
- Executes dropped EXE
PID:1980 -
\??\c:\nhtbnt.exec:\nhtbnt.exe54⤵
- Executes dropped EXE
PID:2272 -
\??\c:\7thbhh.exec:\7thbhh.exe55⤵
- Executes dropped EXE
PID:1968 -
\??\c:\dpjvd.exec:\dpjvd.exe56⤵
- Executes dropped EXE
PID:2112 -
\??\c:\rlxxlrx.exec:\rlxxlrx.exe57⤵
- Executes dropped EXE
PID:1748 -
\??\c:\rfxxllr.exec:\rfxxllr.exe58⤵
- Executes dropped EXE
PID:2300 -
\??\c:\tnbhtt.exec:\tnbhtt.exe59⤵
- Executes dropped EXE
PID:1948 -
\??\c:\tntbnn.exec:\tntbnn.exe60⤵
- Executes dropped EXE
PID:2872 -
\??\c:\5pdjd.exec:\5pdjd.exe61⤵
- Executes dropped EXE
PID:2304 -
\??\c:\dvvpd.exec:\dvvpd.exe62⤵
- Executes dropped EXE
PID:2772 -
\??\c:\fxxfllx.exec:\fxxfllx.exe63⤵
- Executes dropped EXE
PID:1484 -
\??\c:\rlffrlr.exec:\rlffrlr.exe64⤵
- Executes dropped EXE
PID:2796 -
\??\c:\9hnntb.exec:\9hnntb.exe65⤵
- Executes dropped EXE
PID:648 -
\??\c:\9nhtnn.exec:\9nhtnn.exe66⤵PID:824
-
\??\c:\3hhntb.exec:\3hhntb.exe67⤵PID:2184
-
\??\c:\pjpvj.exec:\pjpvj.exe68⤵PID:892
-
\??\c:\pjvvj.exec:\pjvvj.exe69⤵PID:2992
-
\??\c:\xrfllrx.exec:\xrfllrx.exe70⤵PID:1124
-
\??\c:\5fxfffl.exec:\5fxfffl.exe71⤵PID:2332
-
\??\c:\bbtbhn.exec:\bbtbhn.exe72⤵PID:624
-
\??\c:\tnbhtt.exec:\tnbhtt.exe73⤵PID:2420
-
\??\c:\pjpvd.exec:\pjpvd.exe74⤵PID:1816
-
\??\c:\7jjvj.exec:\7jjvj.exe75⤵PID:1252
-
\??\c:\9frxlll.exec:\9frxlll.exe76⤵PID:1692
-
\??\c:\lflrflx.exec:\lflrflx.exe77⤵PID:1888
-
\??\c:\rlflrrl.exec:\rlflrrl.exe78⤵PID:2556
-
\??\c:\hbnnbn.exec:\hbnnbn.exe79⤵PID:2668
-
\??\c:\9nbhtt.exec:\9nbhtt.exe80⤵PID:2620
-
\??\c:\vvvjp.exec:\vvvjp.exe81⤵PID:2220
-
\??\c:\jdpdj.exec:\jdpdj.exe82⤵PID:1720
-
\??\c:\3rllxxl.exec:\3rllxxl.exe83⤵PID:2500
-
\??\c:\lfrxxlr.exec:\lfrxxlr.exe84⤵PID:840
-
\??\c:\nhttbb.exec:\nhttbb.exe85⤵PID:2496
-
\??\c:\bththn.exec:\bththn.exe86⤵PID:2976
-
\??\c:\7pdjp.exec:\7pdjp.exe87⤵PID:1876
-
\??\c:\3jjjv.exec:\3jjjv.exe88⤵PID:2920
-
\??\c:\5ffxffl.exec:\5ffxffl.exe89⤵PID:1572
-
\??\c:\frfxfxf.exec:\frfxfxf.exe90⤵PID:2800
-
\??\c:\1ttthn.exec:\1ttthn.exe91⤵PID:2276
-
\??\c:\hbtttt.exec:\hbtttt.exe92⤵PID:784
-
\??\c:\3dvvj.exec:\3dvvj.exe93⤵PID:2136
-
\??\c:\9jpjp.exec:\9jpjp.exe94⤵PID:1984
-
\??\c:\9jvdj.exec:\9jvdj.exe95⤵PID:1284
-
\??\c:\fxllxrf.exec:\fxllxrf.exe96⤵PID:304
-
\??\c:\lflxrrf.exec:\lflxrrf.exe97⤵PID:2916
-
\??\c:\thhhtt.exec:\thhhtt.exe98⤵PID:1616
-
\??\c:\ppjdj.exec:\ppjdj.exe99⤵PID:1520
-
\??\c:\3dvvv.exec:\3dvvv.exe100⤵PID:1180
-
\??\c:\3lxfffl.exec:\3lxfffl.exe101⤵PID:2300
-
\??\c:\rlxlxxf.exec:\rlxlxxf.exe102⤵PID:2196
-
\??\c:\bbnbhh.exec:\bbnbhh.exe103⤵PID:2224
-
\??\c:\htntbh.exec:\htntbh.exe104⤵PID:1112
-
\??\c:\jvvpp.exec:\jvvpp.exe105⤵PID:484
-
\??\c:\7dddp.exec:\7dddp.exe106⤵PID:1796
-
\??\c:\rfrxffl.exec:\rfrxffl.exe107⤵PID:2796
-
\??\c:\lxffrxl.exec:\lxffrxl.exe108⤵PID:416
-
\??\c:\1nttbb.exec:\1nttbb.exe109⤵PID:1648
-
\??\c:\bnbbbh.exec:\bnbbbh.exe110⤵PID:660
-
\??\c:\vpvvj.exec:\vpvvj.exe111⤵PID:340
-
\??\c:\5jppj.exec:\5jppj.exe112⤵PID:772
-
\??\c:\ffrrrrf.exec:\ffrrrrf.exe113⤵PID:3012
-
\??\c:\rflrxrx.exec:\rflrxrx.exe114⤵PID:1732
-
\??\c:\tnhnhb.exec:\tnhnhb.exe115⤵PID:1044
-
\??\c:\5btbnn.exec:\5btbnn.exe116⤵PID:1304
-
\??\c:\1hbtbb.exec:\1hbtbb.exe117⤵PID:1488
-
\??\c:\ddpdj.exec:\ddpdj.exe118⤵PID:1564
-
\??\c:\vjvdd.exec:\vjvdd.exe119⤵PID:1692
-
\??\c:\9xrxffx.exec:\9xrxffx.exe120⤵PID:2052
-
\??\c:\xrrllfr.exec:\xrrllfr.exe121⤵PID:2996
-
\??\c:\nhthtt.exec:\nhthtt.exe122⤵PID:2652
-
\??\c:\3tnbhh.exec:\3tnbhh.exe123⤵PID:2620
-
\??\c:\jdppv.exec:\jdppv.exe124⤵PID:3004
-
\??\c:\jdjdd.exec:\jdjdd.exe125⤵PID:2724
-
\??\c:\lxllxxx.exec:\lxllxxx.exe126⤵PID:2676
-
\??\c:\5xrfllf.exec:\5xrfllf.exe127⤵PID:2536
-
\??\c:\btnnhb.exec:\btnnhb.exe128⤵PID:2636
-
\??\c:\htnhbb.exec:\htnhbb.exe129⤵PID:2252
-
\??\c:\1pjdj.exec:\1pjdj.exe130⤵PID:2288
-
\??\c:\vjpvp.exec:\vjpvp.exe131⤵PID:2532
-
\??\c:\1lflxfr.exec:\1lflxfr.exe132⤵PID:2808
-
\??\c:\lrlrrxr.exec:\lrlrrxr.exe133⤵PID:2640
-
\??\c:\tntbnn.exec:\tntbnn.exe134⤵PID:2768
-
\??\c:\thnnnh.exec:\thnnnh.exe135⤵PID:784
-
\??\c:\dpddv.exec:\dpddv.exe136⤵PID:1668
-
\??\c:\3pvvv.exec:\3pvvv.exe137⤵PID:1984
-
\??\c:\ppdjv.exec:\ppdjv.exe138⤵PID:316
-
\??\c:\frfxxrx.exec:\frfxxrx.exe139⤵PID:304
-
\??\c:\fxfllrx.exec:\fxfllrx.exe140⤵PID:1584
-
\??\c:\nhbntn.exec:\nhbntn.exe141⤵PID:1620
-
\??\c:\btntbb.exec:\btntbb.exe142⤵PID:1760
-
\??\c:\vjvjp.exec:\vjvjp.exe143⤵PID:1180
-
\??\c:\3vvdj.exec:\3vvdj.exe144⤵PID:1684
-
\??\c:\xrxfrrx.exec:\xrxfrrx.exe145⤵PID:2196
-
\??\c:\3lrrffl.exec:\3lrrffl.exe146⤵PID:536
-
\??\c:\hhnntt.exec:\hhnntt.exe147⤵PID:1892
-
\??\c:\htbhnb.exec:\htbhnb.exe148⤵PID:1096
-
\??\c:\pjpvd.exec:\pjpvd.exe149⤵PID:1796
-
\??\c:\7pjjp.exec:\7pjjp.exe150⤵PID:444
-
\??\c:\vpjjj.exec:\vpjjj.exe151⤵PID:416
-
\??\c:\frllrrf.exec:\frllrrf.exe152⤵PID:2324
-
\??\c:\1lflxxf.exec:\1lflxxf.exe153⤵PID:2980
-
\??\c:\bntthn.exec:\bntthn.exe154⤵PID:2848
-
\??\c:\nhbntb.exec:\nhbntb.exe155⤵PID:2956
-
\??\c:\9pddj.exec:\9pddj.exe156⤵PID:2964
-
\??\c:\dpdvv.exec:\dpdvv.exe157⤵PID:1732
-
\??\c:\9rfrxxx.exec:\9rfrxxx.exe158⤵PID:872
-
\??\c:\3lrrxxf.exec:\3lrrxxf.exe159⤵PID:2908
-
\??\c:\nhthnn.exec:\nhthnn.exe160⤵PID:1596
-
\??\c:\nhtbht.exec:\nhtbht.exe161⤵PID:1564
-
\??\c:\jjjdj.exec:\jjjdj.exe162⤵PID:2644
-
\??\c:\xrffxxr.exec:\xrffxxr.exe163⤵PID:2052
-
\??\c:\frrrllr.exec:\frrrllr.exe164⤵PID:2680
-
\??\c:\xrflrrx.exec:\xrflrrx.exe165⤵PID:2656
-
\??\c:\1tntbt.exec:\1tntbt.exe166⤵PID:2780
-
\??\c:\nbbtbb.exec:\nbbtbb.exe167⤵PID:2728
-
\??\c:\vpdjd.exec:\vpdjd.exe168⤵PID:2468
-
\??\c:\3lxffll.exec:\3lxffll.exe169⤵PID:2476
-
\??\c:\9frxfff.exec:\9frxfff.exe170⤵PID:2924
-
\??\c:\hthhtt.exec:\hthhtt.exe171⤵PID:2116
-
\??\c:\nbhhnn.exec:\nbhhnn.exe172⤵PID:1832
-
\??\c:\9vddd.exec:\9vddd.exe173⤵PID:1868
-
\??\c:\xlrxlfl.exec:\xlrxlfl.exe174⤵PID:1572
-
\??\c:\5llrxrr.exec:\5llrxrr.exe175⤵PID:1664
-
\??\c:\bththn.exec:\bththn.exe176⤵PID:1972
-
\??\c:\thtbhb.exec:\thtbhb.exe177⤵PID:2132
-
\??\c:\vvjjv.exec:\vvjjv.exe178⤵PID:1960
-
\??\c:\pjdpp.exec:\pjdpp.exe179⤵PID:1980
-
\??\c:\frffffl.exec:\frffffl.exe180⤵PID:2272
-
\??\c:\lflrxfr.exec:\lflrxfr.exe181⤵PID:1608
-
\??\c:\bnbntb.exec:\bnbntb.exe182⤵PID:1908
-
\??\c:\hbtbtn.exec:\hbtbtn.exe183⤵PID:1748
-
\??\c:\pjjjv.exec:\pjjjv.exe184⤵PID:2560
-
\??\c:\vdjjv.exec:\vdjjv.exe185⤵PID:2864
-
\??\c:\rlflxff.exec:\rlflxff.exe186⤵PID:2124
-
\??\c:\9rlrfxx.exec:\9rlrfxx.exe187⤵PID:1788
-
\??\c:\bhnnnt.exec:\bhnnnt.exe188⤵PID:1468
-
\??\c:\btnttn.exec:\btnttn.exe189⤵PID:536
-
\??\c:\pjdjv.exec:\pjdjv.exe190⤵PID:1068
-
\??\c:\9ppdp.exec:\9ppdp.exe191⤵PID:1756
-
\??\c:\xxxlfrf.exec:\xxxlfrf.exe192⤵PID:824
-
\??\c:\nhbhtn.exec:\nhbhtn.exe193⤵PID:764
-
\??\c:\3bthnt.exec:\3bthnt.exe194⤵PID:416
-
\??\c:\pjdjp.exec:\pjdjp.exe195⤵PID:1268
-
\??\c:\jddjv.exec:\jddjv.exe196⤵PID:3052
-
\??\c:\jjpvd.exec:\jjpvd.exe197⤵PID:980
-
\??\c:\frxfllr.exec:\frxfllr.exe198⤵PID:624
-
\??\c:\rflllff.exec:\rflllff.exe199⤵PID:1496
-
\??\c:\btnntt.exec:\btnntt.exe200⤵PID:2056
-
\??\c:\hbttnt.exec:\hbttnt.exe201⤵PID:1252
-
\??\c:\dvddp.exec:\dvddp.exe202⤵PID:3000
-
\??\c:\fxlrxfl.exec:\fxlrxfl.exe203⤵PID:1804
-
\??\c:\1tbhtt.exec:\1tbhtt.exe204⤵PID:2200
-
\??\c:\hthntb.exec:\hthntb.exe205⤵PID:2684
-
\??\c:\jjvjp.exec:\jjvjp.exe206⤵PID:2592
-
\??\c:\jddvp.exec:\jddvp.exe207⤵PID:2840
-
\??\c:\lfrrrrx.exec:\lfrrrrx.exe208⤵PID:2492
-
\??\c:\frxrxrl.exec:\frxrxrl.exe209⤵PID:1720
-
\??\c:\nbttbb.exec:\nbttbb.exe210⤵PID:2676
-
\??\c:\bthhhb.exec:\bthhhb.exe211⤵PID:2536
-
\??\c:\pjdjd.exec:\pjdjd.exe212⤵PID:1992
-
\??\c:\vpvpp.exec:\vpvpp.exe213⤵PID:2252
-
\??\c:\lfxrxfl.exec:\lfxrxfl.exe214⤵PID:2760
-
\??\c:\fxrllrr.exec:\fxrllrr.exe215⤵PID:2532
-
\??\c:\tnhntb.exec:\tnhntb.exe216⤵PID:2152
-
\??\c:\tnhtbb.exec:\tnhtbb.exe217⤵PID:2156
-
\??\c:\7vjpv.exec:\7vjpv.exe218⤵PID:1840
-
\??\c:\dpdjj.exec:\dpdjj.exe219⤵PID:1900
-
\??\c:\rlxxxfr.exec:\rlxxxfr.exe220⤵PID:1740
-
\??\c:\rlxfrfl.exec:\rlxfrfl.exe221⤵PID:1744
-
\??\c:\bthntt.exec:\bthntt.exe222⤵PID:2120
-
\??\c:\bnttbh.exec:\bnttbh.exe223⤵PID:1512
-
\??\c:\jvjjj.exec:\jvjjj.exe224⤵PID:2176
-
\??\c:\vpppp.exec:\vpppp.exe225⤵PID:1520
-
\??\c:\xrffllx.exec:\xrffllx.exe226⤵PID:1952
-
\??\c:\5xllrxx.exec:\5xllrxx.exe227⤵PID:540
-
\??\c:\bbnbnn.exec:\bbnbnn.exe228⤵PID:572
-
\??\c:\9hhbnb.exec:\9hhbnb.exe229⤵PID:380
-
\??\c:\9djpp.exec:\9djpp.exe230⤵PID:2416
-
\??\c:\vpvdd.exec:\vpvdd.exe231⤵PID:1128
-
\??\c:\5xxxrxl.exec:\5xxxrxl.exe232⤵PID:1072
-
\??\c:\9rxflff.exec:\9rxflff.exe233⤵PID:2428
-
\??\c:\nbnntt.exec:\nbnntt.exe234⤵PID:2836
-
\??\c:\btnntb.exec:\btnntb.exe235⤵PID:892
-
\??\c:\dvdjp.exec:\dvdjp.exe236⤵PID:660
-
\??\c:\1vvvd.exec:\1vvvd.exe237⤵PID:868
-
\??\c:\xfrxfxx.exec:\xfrxfxx.exe238⤵PID:340
-
\??\c:\frflxfl.exec:\frflxfl.exe239⤵PID:1292
-
\??\c:\tntbnt.exec:\tntbnt.exe240⤵PID:2244
-
\??\c:\3htbht.exec:\3htbht.exe241⤵PID:1680
-
\??\c:\3jdpd.exec:\3jdpd.exe242⤵PID:1592