Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 04:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
74e18181a7192929a1e1da44f6469640_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
74e18181a7192929a1e1da44f6469640_NeikiAnalytics.exe
-
Size
95KB
-
MD5
74e18181a7192929a1e1da44f6469640
-
SHA1
90ef0cf4f13bf029ed41dd02553876a9ac6b8a9d
-
SHA256
24e66f8d839426aed193eecae78300733d0174c6d9f2a2a3f6abfcf28f5f5d72
-
SHA512
ec244925d39e39df4ed6c271537d5498281006aee05552c59b005305965fa7e015ef12c9f0a8217349179971a51aae947b877ab222e8347a20fd2dbeeba52391
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qP1hvZo66Ox4oq2SQwfTQM:ymb3NkkiQ3mdBjFIj+qNhvZuHQY0M
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/1752-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3056-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/944-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1436-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1760-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1932-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/884-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/956-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/916-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
dvddp.exerrfrxfl.exelfrxfxf.exenhhntb.exe7jdjp.exexxrxlrf.exehbtbnt.exe9hhtht.exevdpjj.exe3rffllr.exexrflrrx.exebthhnt.exe3pvvd.exevvdjd.exerrllffx.exe3xlxllx.exetnnnhn.exevvvpv.exedvvdp.exe3xrfrxf.exennbbhn.exehbtntb.exevdjvj.exevppvj.exe1lflrxl.exehbhhnb.exeddjvd.exe1dvvj.exexffrrlr.exethbhhn.exe1vjjp.exeppdpv.exe7rlllrx.exefxrfllr.exe3ttnbh.exe1hnhhb.exe5ppdp.exejvjdd.exefrlfllx.exexxrlrrf.exetthntt.exe1hbnbn.exedvppd.exevpddp.exexlrllxx.exefxflxfr.exehhnhhn.exetnbnbh.exennthtt.exe1vvvd.exevpjjp.exefrffflx.exexrlxrrx.exebtnbtb.exe7bbtbh.exedvvjd.exevpjjv.exefxxlrrf.exelrlrxlx.exefllxrfx.exetthtnt.exebhtttt.exedpvpd.exellxflxl.exepid process 2628 dvddp.exe 3056 rrfrxfl.exe 2788 lfrxfxf.exe 2668 nhhntb.exe 2704 7jdjp.exe 2272 xxrxlrf.exe 2620 hbtbnt.exe 2460 9hhtht.exe 2952 vdpjj.exe 1632 3rffllr.exe 944 xrflrrx.exe 1436 bthhnt.exe 2756 3pvvd.exe 1760 vvdjd.exe 2800 rrllffx.exe 1932 3xlxllx.exe 1080 tnnnhn.exe 2032 vvvpv.exe 1964 dvvdp.exe 1952 3xrfrxf.exe 540 nnbbhn.exe 884 hbtntb.exe 2424 vdjvj.exe 2100 vppvj.exe 1324 1lflrxl.exe 956 hbhhnb.exe 916 ddjvd.exe 2864 1dvvj.exe 2264 xffrrlr.exe 2128 thbhhn.exe 1616 1vjjp.exe 2052 ppdpv.exe 2344 7rlllrx.exe 2160 fxrfllr.exe 1600 3ttnbh.exe 2152 1hnhhb.exe 2576 5ppdp.exe 2552 jvjdd.exe 2668 frlfllx.exe 3040 xxrlrrf.exe 2484 tthntt.exe 2676 1hbnbn.exe 2440 dvppd.exe 2464 vpddp.exe 1524 xlrllxx.exe 2804 fxflxfr.exe 2168 hhnhhn.exe 1396 tnbnbh.exe 2184 nnthtt.exe 2020 1vvvd.exe 2432 vpjjp.exe 1760 frffflx.exe 1136 xrlxrrx.exe 860 btnbtb.exe 1088 7bbtbh.exe 1648 dvvjd.exe 2000 vpjjv.exe 1888 fxxlrrf.exe 600 lrlrxlx.exe 1012 fllxrfx.exe 788 tthtnt.exe 108 bhtttt.exe 2036 dpvpd.exe 2100 llxflxl.exe -
Processes:
resource yara_rule behavioral1/memory/1752-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/944-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1436-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1760-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1932-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/884-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/956-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/916-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-283-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
74e18181a7192929a1e1da44f6469640_NeikiAnalytics.exedvddp.exerrfrxfl.exelfrxfxf.exenhhntb.exe7jdjp.exexxrxlrf.exehbtbnt.exe9hhtht.exevdpjj.exe3rffllr.exexrflrrx.exebthhnt.exe3pvvd.exevvdjd.exerrllffx.exedescription pid process target process PID 1752 wrote to memory of 2628 1752 74e18181a7192929a1e1da44f6469640_NeikiAnalytics.exe dvddp.exe PID 1752 wrote to memory of 2628 1752 74e18181a7192929a1e1da44f6469640_NeikiAnalytics.exe dvddp.exe PID 1752 wrote to memory of 2628 1752 74e18181a7192929a1e1da44f6469640_NeikiAnalytics.exe dvddp.exe PID 1752 wrote to memory of 2628 1752 74e18181a7192929a1e1da44f6469640_NeikiAnalytics.exe dvddp.exe PID 2628 wrote to memory of 3056 2628 dvddp.exe rrfrxfl.exe PID 2628 wrote to memory of 3056 2628 dvddp.exe rrfrxfl.exe PID 2628 wrote to memory of 3056 2628 dvddp.exe rrfrxfl.exe PID 2628 wrote to memory of 3056 2628 dvddp.exe rrfrxfl.exe PID 3056 wrote to memory of 2788 3056 rrfrxfl.exe lfrxfxf.exe PID 3056 wrote to memory of 2788 3056 rrfrxfl.exe lfrxfxf.exe PID 3056 wrote to memory of 2788 3056 rrfrxfl.exe lfrxfxf.exe PID 3056 wrote to memory of 2788 3056 rrfrxfl.exe lfrxfxf.exe PID 2788 wrote to memory of 2668 2788 lfrxfxf.exe nhhntb.exe PID 2788 wrote to memory of 2668 2788 lfrxfxf.exe nhhntb.exe PID 2788 wrote to memory of 2668 2788 lfrxfxf.exe nhhntb.exe PID 2788 wrote to memory of 2668 2788 lfrxfxf.exe nhhntb.exe PID 2668 wrote to memory of 2704 2668 nhhntb.exe 7jdjp.exe PID 2668 wrote to memory of 2704 2668 nhhntb.exe 7jdjp.exe PID 2668 wrote to memory of 2704 2668 nhhntb.exe 7jdjp.exe PID 2668 wrote to memory of 2704 2668 nhhntb.exe 7jdjp.exe PID 2704 wrote to memory of 2272 2704 7jdjp.exe xxrxlrf.exe PID 2704 wrote to memory of 2272 2704 7jdjp.exe xxrxlrf.exe PID 2704 wrote to memory of 2272 2704 7jdjp.exe xxrxlrf.exe PID 2704 wrote to memory of 2272 2704 7jdjp.exe xxrxlrf.exe PID 2272 wrote to memory of 2620 2272 xxrxlrf.exe hbtbnt.exe PID 2272 wrote to memory of 2620 2272 xxrxlrf.exe hbtbnt.exe PID 2272 wrote to memory of 2620 2272 xxrxlrf.exe hbtbnt.exe PID 2272 wrote to memory of 2620 2272 xxrxlrf.exe hbtbnt.exe PID 2620 wrote to memory of 2460 2620 hbtbnt.exe 9hhtht.exe PID 2620 wrote to memory of 2460 2620 hbtbnt.exe 9hhtht.exe PID 2620 wrote to memory of 2460 2620 hbtbnt.exe 9hhtht.exe PID 2620 wrote to memory of 2460 2620 hbtbnt.exe 9hhtht.exe PID 2460 wrote to memory of 2952 2460 9hhtht.exe vdpjj.exe PID 2460 wrote to memory of 2952 2460 9hhtht.exe vdpjj.exe PID 2460 wrote to memory of 2952 2460 9hhtht.exe vdpjj.exe PID 2460 wrote to memory of 2952 2460 9hhtht.exe vdpjj.exe PID 2952 wrote to memory of 1632 2952 vdpjj.exe 3rffllr.exe PID 2952 wrote to memory of 1632 2952 vdpjj.exe 3rffllr.exe PID 2952 wrote to memory of 1632 2952 vdpjj.exe 3rffllr.exe PID 2952 wrote to memory of 1632 2952 vdpjj.exe 3rffllr.exe PID 1632 wrote to memory of 944 1632 3rffllr.exe xrflrrx.exe PID 1632 wrote to memory of 944 1632 3rffllr.exe xrflrrx.exe PID 1632 wrote to memory of 944 1632 3rffllr.exe xrflrrx.exe PID 1632 wrote to memory of 944 1632 3rffllr.exe xrflrrx.exe PID 944 wrote to memory of 1436 944 xrflrrx.exe bthhnt.exe PID 944 wrote to memory of 1436 944 xrflrrx.exe bthhnt.exe PID 944 wrote to memory of 1436 944 xrflrrx.exe bthhnt.exe PID 944 wrote to memory of 1436 944 xrflrrx.exe bthhnt.exe PID 1436 wrote to memory of 2756 1436 bthhnt.exe 3pvvd.exe PID 1436 wrote to memory of 2756 1436 bthhnt.exe 3pvvd.exe PID 1436 wrote to memory of 2756 1436 bthhnt.exe 3pvvd.exe PID 1436 wrote to memory of 2756 1436 bthhnt.exe 3pvvd.exe PID 2756 wrote to memory of 1760 2756 3pvvd.exe vvdjd.exe PID 2756 wrote to memory of 1760 2756 3pvvd.exe vvdjd.exe PID 2756 wrote to memory of 1760 2756 3pvvd.exe vvdjd.exe PID 2756 wrote to memory of 1760 2756 3pvvd.exe vvdjd.exe PID 1760 wrote to memory of 2800 1760 vvdjd.exe rrllffx.exe PID 1760 wrote to memory of 2800 1760 vvdjd.exe rrllffx.exe PID 1760 wrote to memory of 2800 1760 vvdjd.exe rrllffx.exe PID 1760 wrote to memory of 2800 1760 vvdjd.exe rrllffx.exe PID 2800 wrote to memory of 1932 2800 rrllffx.exe 3xlxllx.exe PID 2800 wrote to memory of 1932 2800 rrllffx.exe 3xlxllx.exe PID 2800 wrote to memory of 1932 2800 rrllffx.exe 3xlxllx.exe PID 2800 wrote to memory of 1932 2800 rrllffx.exe 3xlxllx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\74e18181a7192929a1e1da44f6469640_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\74e18181a7192929a1e1da44f6469640_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\dvddp.exec:\dvddp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\rrfrxfl.exec:\rrfrxfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\lfrxfxf.exec:\lfrxfxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\nhhntb.exec:\nhhntb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\7jdjp.exec:\7jdjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\xxrxlrf.exec:\xxrxlrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\hbtbnt.exec:\hbtbnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\9hhtht.exec:\9hhtht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\vdpjj.exec:\vdpjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\3rffllr.exec:\3rffllr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\xrflrrx.exec:\xrflrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\bthhnt.exec:\bthhnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\3pvvd.exec:\3pvvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\vvdjd.exec:\vvdjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\rrllffx.exec:\rrllffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\3xlxllx.exec:\3xlxllx.exe17⤵
- Executes dropped EXE
PID:1932 -
\??\c:\tnnnhn.exec:\tnnnhn.exe18⤵
- Executes dropped EXE
PID:1080 -
\??\c:\vvvpv.exec:\vvvpv.exe19⤵
- Executes dropped EXE
PID:2032 -
\??\c:\dvvdp.exec:\dvvdp.exe20⤵
- Executes dropped EXE
PID:1964 -
\??\c:\3xrfrxf.exec:\3xrfrxf.exe21⤵
- Executes dropped EXE
PID:1952 -
\??\c:\nnbbhn.exec:\nnbbhn.exe22⤵
- Executes dropped EXE
PID:540 -
\??\c:\hbtntb.exec:\hbtntb.exe23⤵
- Executes dropped EXE
PID:884 -
\??\c:\vdjvj.exec:\vdjvj.exe24⤵
- Executes dropped EXE
PID:2424 -
\??\c:\vppvj.exec:\vppvj.exe25⤵
- Executes dropped EXE
PID:2100 -
\??\c:\1lflrxl.exec:\1lflrxl.exe26⤵
- Executes dropped EXE
PID:1324 -
\??\c:\hbhhnb.exec:\hbhhnb.exe27⤵
- Executes dropped EXE
PID:956 -
\??\c:\ddjvd.exec:\ddjvd.exe28⤵
- Executes dropped EXE
PID:916 -
\??\c:\1dvvj.exec:\1dvvj.exe29⤵
- Executes dropped EXE
PID:2864 -
\??\c:\xffrrlr.exec:\xffrrlr.exe30⤵
- Executes dropped EXE
PID:2264 -
\??\c:\thbhhn.exec:\thbhhn.exe31⤵
- Executes dropped EXE
PID:2128 -
\??\c:\1vjjp.exec:\1vjjp.exe32⤵
- Executes dropped EXE
PID:1616 -
\??\c:\ppdpv.exec:\ppdpv.exe33⤵
- Executes dropped EXE
PID:2052 -
\??\c:\7rlllrx.exec:\7rlllrx.exe34⤵
- Executes dropped EXE
PID:2344 -
\??\c:\fxrfllr.exec:\fxrfllr.exe35⤵
- Executes dropped EXE
PID:2160 -
\??\c:\3ttnbh.exec:\3ttnbh.exe36⤵
- Executes dropped EXE
PID:1600 -
\??\c:\1hnhhb.exec:\1hnhhb.exe37⤵
- Executes dropped EXE
PID:2152 -
\??\c:\5ppdp.exec:\5ppdp.exe38⤵
- Executes dropped EXE
PID:2576 -
\??\c:\jvjdd.exec:\jvjdd.exe39⤵
- Executes dropped EXE
PID:2552 -
\??\c:\frlfllx.exec:\frlfllx.exe40⤵
- Executes dropped EXE
PID:2668 -
\??\c:\xxrlrrf.exec:\xxrlrrf.exe41⤵
- Executes dropped EXE
PID:3040 -
\??\c:\tthntt.exec:\tthntt.exe42⤵
- Executes dropped EXE
PID:2484 -
\??\c:\1hbnbn.exec:\1hbnbn.exe43⤵
- Executes dropped EXE
PID:2676 -
\??\c:\dvppd.exec:\dvppd.exe44⤵
- Executes dropped EXE
PID:2440 -
\??\c:\vpddp.exec:\vpddp.exe45⤵
- Executes dropped EXE
PID:2464 -
\??\c:\xlrllxx.exec:\xlrllxx.exe46⤵
- Executes dropped EXE
PID:1524 -
\??\c:\fxflxfr.exec:\fxflxfr.exe47⤵
- Executes dropped EXE
PID:2804 -
\??\c:\hhnhhn.exec:\hhnhhn.exe48⤵
- Executes dropped EXE
PID:2168 -
\??\c:\tnbnbh.exec:\tnbnbh.exe49⤵
- Executes dropped EXE
PID:1396 -
\??\c:\nnthtt.exec:\nnthtt.exe50⤵
- Executes dropped EXE
PID:2184 -
\??\c:\1vvvd.exec:\1vvvd.exe51⤵
- Executes dropped EXE
PID:2020 -
\??\c:\vpjjp.exec:\vpjjp.exe52⤵
- Executes dropped EXE
PID:2432 -
\??\c:\frffflx.exec:\frffflx.exe53⤵
- Executes dropped EXE
PID:1760 -
\??\c:\xrlxrrx.exec:\xrlxrrx.exe54⤵
- Executes dropped EXE
PID:1136 -
\??\c:\btnbtb.exec:\btnbtb.exe55⤵
- Executes dropped EXE
PID:860 -
\??\c:\7bbtbh.exec:\7bbtbh.exe56⤵
- Executes dropped EXE
PID:1088 -
\??\c:\dvvjd.exec:\dvvjd.exe57⤵
- Executes dropped EXE
PID:1648 -
\??\c:\vpjjv.exec:\vpjjv.exe58⤵
- Executes dropped EXE
PID:2000 -
\??\c:\fxxlrrf.exec:\fxxlrrf.exe59⤵
- Executes dropped EXE
PID:1888 -
\??\c:\lrlrxlx.exec:\lrlrxlx.exe60⤵
- Executes dropped EXE
PID:600 -
\??\c:\fllxrfx.exec:\fllxrfx.exe61⤵
- Executes dropped EXE
PID:1012 -
\??\c:\tthtnt.exec:\tthtnt.exe62⤵
- Executes dropped EXE
PID:788 -
\??\c:\bhtttt.exec:\bhtttt.exe63⤵
- Executes dropped EXE
PID:108 -
\??\c:\dpvpd.exec:\dpvpd.exe64⤵
- Executes dropped EXE
PID:2036 -
\??\c:\llxflxl.exec:\llxflxl.exe65⤵
- Executes dropped EXE
PID:2100 -
\??\c:\hthntt.exec:\hthntt.exe66⤵PID:2940
-
\??\c:\pjjjd.exec:\pjjjd.exe67⤵PID:2292
-
\??\c:\5djjp.exec:\5djjp.exe68⤵PID:968
-
\??\c:\vddjp.exec:\vddjp.exe69⤵PID:916
-
\??\c:\xrxxrll.exec:\xrxxrll.exe70⤵PID:2864
-
\??\c:\lffrrxf.exec:\lffrrxf.exe71⤵PID:2996
-
\??\c:\thtthb.exec:\thtthb.exe72⤵PID:1240
-
\??\c:\djdpv.exec:\djdpv.exe73⤵PID:2208
-
\??\c:\9djpp.exec:\9djpp.exe74⤵PID:1244
-
\??\c:\lfrxxfl.exec:\lfrxxfl.exe75⤵PID:1580
-
\??\c:\rrrflxl.exec:\rrrflxl.exe76⤵PID:2384
-
\??\c:\tnbhtt.exec:\tnbhtt.exe77⤵PID:3044
-
\??\c:\3hhbhh.exec:\3hhbhh.exe78⤵PID:1596
-
\??\c:\nnhbhn.exec:\nnhbhn.exe79⤵PID:2596
-
\??\c:\jdppp.exec:\jdppp.exe80⤵PID:2600
-
\??\c:\dvpdp.exec:\dvpdp.exe81⤵PID:2672
-
\??\c:\1fxflrx.exec:\1fxflrx.exe82⤵PID:2608
-
\??\c:\rfxxrxf.exec:\rfxxrxf.exe83⤵PID:2724
-
\??\c:\nhthtt.exec:\nhthtt.exe84⤵PID:2272
-
\??\c:\nnhnbb.exec:\nnhnbb.exe85⤵PID:2620
-
\??\c:\9pdjv.exec:\9pdjv.exe86⤵PID:3028
-
\??\c:\vpjjv.exec:\vpjjv.exe87⤵PID:2796
-
\??\c:\rlrrxxf.exec:\rlrrxxf.exe88⤵PID:2952
-
\??\c:\xxxxflx.exec:\xxxxflx.exe89⤵PID:1632
-
\??\c:\hthhhh.exec:\hthhhh.exe90⤵PID:1276
-
\??\c:\9jjvp.exec:\9jjvp.exe91⤵PID:2732
-
\??\c:\ppddp.exec:\ppddp.exe92⤵PID:2420
-
\??\c:\vjvdj.exec:\vjvdj.exe93⤵PID:1756
-
\??\c:\flxxlxr.exec:\flxxlxr.exe94⤵PID:1448
-
\??\c:\9lrxlff.exec:\9lrxlff.exe95⤵PID:1640
-
\??\c:\thbnhh.exec:\thbnhh.exe96⤵PID:2824
-
\??\c:\ntnthn.exec:\ntnthn.exe97⤵PID:1984
-
\??\c:\pdpvd.exec:\pdpvd.exe98⤵PID:2944
-
\??\c:\3vvpp.exec:\3vvpp.exe99⤵PID:2032
-
\??\c:\rxxlffr.exec:\rxxlffr.exe100⤵PID:1964
-
\??\c:\rfrrxrx.exec:\rfrrxrx.exe101⤵PID:268
-
\??\c:\7bnnbh.exec:\7bnnbh.exe102⤵PID:1744
-
\??\c:\nnntnt.exec:\nnntnt.exe103⤵PID:488
-
\??\c:\jjjdp.exec:\jjjdp.exe104⤵PID:1368
-
\??\c:\pvdvp.exec:\pvdvp.exe105⤵PID:1188
-
\??\c:\lfrxfxf.exec:\lfrxfxf.exe106⤵PID:1536
-
\??\c:\hbhbhb.exec:\hbhbhb.exe107⤵PID:1260
-
\??\c:\nhnthh.exec:\nhnthh.exe108⤵PID:2936
-
\??\c:\jjvdp.exec:\jjvdp.exe109⤵PID:1332
-
\??\c:\vpjpp.exec:\vpjpp.exe110⤵PID:1172
-
\??\c:\1lxxlfl.exec:\1lxxlfl.exe111⤵PID:2868
-
\??\c:\7fxxflx.exec:\7fxxflx.exe112⤵PID:2904
-
\??\c:\btnthh.exec:\btnthh.exe113⤵PID:1684
-
\??\c:\tbbtnh.exec:\tbbtnh.exe114⤵PID:2328
-
\??\c:\vjdvj.exec:\vjdvj.exe115⤵PID:1752
-
\??\c:\pjvjv.exec:\pjvjv.exe116⤵PID:2860
-
\??\c:\xxrfrrl.exec:\xxrfrrl.exe117⤵PID:2528
-
\??\c:\fxllffr.exec:\fxllffr.exe118⤵PID:1568
-
\??\c:\9nhbbh.exec:\9nhbbh.exe119⤵PID:3004
-
\??\c:\dpvpv.exec:\dpvpv.exe120⤵PID:2644
-
\??\c:\dvjpv.exec:\dvjpv.exe121⤵PID:2556
-
\??\c:\vdjjp.exec:\vdjjp.exe122⤵PID:2580
-
\??\c:\xlrxlrr.exec:\xlrxlrr.exe123⤵PID:2700
-
\??\c:\nnbbnt.exec:\nnbbnt.exe124⤵PID:2696
-
\??\c:\thbtbh.exec:\thbtbh.exe125⤵PID:2480
-
\??\c:\ppjvj.exec:\ppjvj.exe126⤵PID:2616
-
\??\c:\pjvjv.exec:\pjvjv.exe127⤵PID:2960
-
\??\c:\1ppdj.exec:\1ppdj.exe128⤵PID:2848
-
\??\c:\xrxrflf.exec:\xrxrflf.exe129⤵PID:2956
-
\??\c:\bbtbnt.exec:\bbtbnt.exe130⤵PID:1908
-
\??\c:\ttnhtb.exec:\ttnhtb.exe131⤵PID:2808
-
\??\c:\9tnbtb.exec:\9tnbtb.exe132⤵PID:1248
-
\??\c:\vddvv.exec:\vddvv.exe133⤵PID:636
-
\??\c:\jvpvp.exec:\jvpvp.exe134⤵PID:1516
-
\??\c:\5rlrfrx.exec:\5rlrfrx.exe135⤵PID:2044
-
\??\c:\xxxrrrl.exec:\xxxrrrl.exe136⤵PID:1448
-
\??\c:\nhthtb.exec:\nhthtb.exe137⤵PID:1932
-
\??\c:\vvvdd.exec:\vvvdd.exe138⤵PID:856
-
\??\c:\ppjpd.exec:\ppjpd.exe139⤵PID:1748
-
\??\c:\pjdvd.exec:\pjdvd.exe140⤵PID:1768
-
\??\c:\xrfxfrf.exec:\xrfxfrf.exe141⤵PID:2000
-
\??\c:\hhbtbh.exec:\hhbtbh.exe142⤵PID:2300
-
\??\c:\tnntbh.exec:\tnntbh.exe143⤵PID:1896
-
\??\c:\hhbnbh.exec:\hhbnbh.exe144⤵PID:1636
-
\??\c:\dvpdp.exec:\dvpdp.exe145⤵PID:788
-
\??\c:\dpjvd.exec:\dpjvd.exe146⤵PID:584
-
\??\c:\rrrfrxl.exec:\rrrfrxl.exe147⤵PID:700
-
\??\c:\rlrrffr.exec:\rlrrffr.exe148⤵PID:448
-
\??\c:\hhbnbb.exec:\hhbnbb.exe149⤵PID:960
-
\??\c:\hhtbtb.exec:\hhtbtb.exe150⤵PID:904
-
\??\c:\dvpdv.exec:\dvpdv.exe151⤵PID:588
-
\??\c:\fxrlxff.exec:\fxrlxff.exe152⤵PID:2836
-
\??\c:\xxfllrx.exec:\xxfllrx.exe153⤵PID:2864
-
\??\c:\hhbthn.exec:\hhbthn.exe154⤵PID:2896
-
\??\c:\bththt.exec:\bththt.exe155⤵PID:1240
-
\??\c:\ppvvj.exec:\ppvvj.exe156⤵PID:1688
-
\??\c:\vjdpj.exec:\vjdpj.exe157⤵PID:2744
-
\??\c:\1lfllrx.exec:\1lfllrx.exe158⤵PID:2236
-
\??\c:\rfrflrx.exec:\rfrflrx.exe159⤵PID:2344
-
\??\c:\hbntbb.exec:\hbntbb.exe160⤵PID:3056
-
\??\c:\btnbtb.exec:\btnbtb.exe161⤵PID:1596
-
\??\c:\9pvjv.exec:\9pvjv.exe162⤵PID:2540
-
\??\c:\pvvdj.exec:\pvvdj.exe163⤵PID:2652
-
\??\c:\1lflrxf.exec:\1lflrxf.exe164⤵PID:2664
-
\??\c:\xxrfxfx.exec:\xxrfxfx.exe165⤵PID:2276
-
\??\c:\1bbnnn.exec:\1bbnnn.exe166⤵PID:2444
-
\??\c:\7hthtb.exec:\7hthtb.exe167⤵PID:2568
-
\??\c:\bbhnnt.exec:\bbhnnt.exe168⤵PID:2096
-
\??\c:\dvppd.exec:\dvppd.exe169⤵PID:2508
-
\??\c:\jvjdd.exec:\jvjdd.exe170⤵PID:2460
-
\??\c:\5lllrfx.exec:\5lllrfx.exe171⤵PID:2952
-
\??\c:\5fxflrx.exec:\5fxflrx.exe172⤵PID:948
-
\??\c:\bthnhh.exec:\bthnhh.exe173⤵PID:1276
-
\??\c:\nnhnnt.exec:\nnhnnt.exe174⤵PID:2756
-
\??\c:\1bnnhn.exec:\1bnnhn.exe175⤵PID:1436
-
\??\c:\1pdjp.exec:\1pdjp.exe176⤵PID:2764
-
\??\c:\pddpp.exec:\pddpp.exe177⤵PID:1160
-
\??\c:\ffxxllx.exec:\ffxxllx.exe178⤵PID:2760
-
\??\c:\rrflxfr.exec:\rrflxfr.exe179⤵PID:2800
-
\??\c:\htbhnh.exec:\htbhnh.exe180⤵PID:2832
-
\??\c:\bbnhtb.exec:\bbnhtb.exe181⤵PID:2372
-
\??\c:\jjvvd.exec:\jjvvd.exe182⤵PID:1740
-
\??\c:\jjdpd.exec:\jjdpd.exe183⤵PID:1256
-
\??\c:\rlrrxfr.exec:\rlrrxfr.exe184⤵PID:1964
-
\??\c:\xrxllxl.exec:\xrxllxl.exe185⤵PID:616
-
\??\c:\rrlfrrf.exec:\rrlfrrf.exe186⤵PID:1120
-
\??\c:\hbbnnb.exec:\hbbnnb.exe187⤵PID:1700
-
\??\c:\5tthtb.exec:\5tthtb.exe188⤵PID:1368
-
\??\c:\7ddjp.exec:\7ddjp.exe189⤵PID:412
-
\??\c:\ppvjd.exec:\ppvjd.exe190⤵PID:1536
-
\??\c:\7frxrrl.exec:\7frxrrl.exe191⤵PID:2292
-
\??\c:\lfrflrf.exec:\lfrflrf.exe192⤵PID:1332
-
\??\c:\5nnbbb.exec:\5nnbbb.exe193⤵PID:1172
-
\??\c:\hhtthn.exec:\hhtthn.exe194⤵PID:2124
-
\??\c:\ddvdv.exec:\ddvdv.exe195⤵PID:892
-
\??\c:\pjdjv.exec:\pjdjv.exe196⤵PID:1684
-
\??\c:\lfxlflr.exec:\lfxlflr.exe197⤵PID:1608
-
\??\c:\rfllffl.exec:\rfllffl.exe198⤵PID:1752
-
\??\c:\nhtbnt.exec:\nhtbnt.exe199⤵PID:1588
-
\??\c:\nbttbt.exec:\nbttbt.exe200⤵PID:1580
-
\??\c:\hhhthn.exec:\hhhthn.exe201⤵PID:3044
-
\??\c:\ddpvj.exec:\ddpvj.exe202⤵PID:2144
-
\??\c:\pjvvd.exec:\pjvvd.exe203⤵PID:3024
-
\??\c:\fxllflx.exec:\fxllflx.exe204⤵PID:2644
-
\??\c:\xrlxflx.exec:\xrlxflx.exe205⤵PID:2580
-
\??\c:\ttntbn.exec:\ttntbn.exe206⤵PID:2700
-
\??\c:\7hnbnn.exec:\7hnbnn.exe207⤵PID:2816
-
\??\c:\tnbbnt.exec:\tnbbnt.exe208⤵PID:2584
-
\??\c:\jdvdp.exec:\jdvdp.exe209⤵PID:2616
-
\??\c:\dpvdd.exec:\dpvdd.exe210⤵PID:2500
-
\??\c:\7xrflrl.exec:\7xrflrl.exe211⤵PID:2280
-
\??\c:\nnhntt.exec:\nnhntt.exe212⤵PID:2848
-
\??\c:\nhtttb.exec:\nhtttb.exe213⤵PID:2512
-
\??\c:\vpvjj.exec:\vpvjj.exe214⤵PID:948
-
\??\c:\7pjvv.exec:\7pjvv.exe215⤵PID:2168
-
\??\c:\dpjjp.exec:\dpjjp.exe216⤵PID:1668
-
\??\c:\lxrrxrf.exec:\lxrrxrf.exe217⤵PID:2184
-
\??\c:\rfrxlrr.exec:\rfrxlrr.exe218⤵PID:1516
-
\??\c:\7nnnbh.exec:\7nnnbh.exe219⤵PID:1756
-
\??\c:\1ttnnh.exec:\1ttnnh.exe220⤵PID:1448
-
\??\c:\pjdjj.exec:\pjdjj.exe221⤵PID:1932
-
\??\c:\pjppp.exec:\pjppp.exe222⤵PID:2832
-
\??\c:\xxxlrfl.exec:\xxxlrfl.exe223⤵PID:1084
-
\??\c:\9lxxfxx.exec:\9lxxfxx.exe224⤵PID:1740
-
\??\c:\nnhtbh.exec:\nnhtbh.exe225⤵PID:1464
-
\??\c:\ddvvp.exec:\ddvvp.exe226⤵PID:848
-
\??\c:\pdvdp.exec:\pdvdp.exe227⤵PID:2240
-
\??\c:\lxflrll.exec:\lxflrll.exe228⤵PID:1120
-
\??\c:\xrllffl.exec:\xrllffl.exe229⤵PID:1992
-
\??\c:\tbhntn.exec:\tbhntn.exe230⤵PID:2660
-
\??\c:\btnttb.exec:\btnttb.exe231⤵PID:2924
-
\??\c:\5vjjp.exec:\5vjjp.exe232⤵PID:1536
-
\??\c:\vvjjp.exec:\vvjjp.exe233⤵PID:864
-
\??\c:\rrlffrr.exec:\rrlffrr.exe234⤵PID:1332
-
\??\c:\1llrxff.exec:\1llrxff.exe235⤵PID:952
-
\??\c:\tthhtb.exec:\tthhtb.exe236⤵PID:2008
-
\??\c:\hbbhnn.exec:\hbbhnn.exe237⤵PID:2104
-
\??\c:\dvjjv.exec:\dvjjv.exe238⤵PID:2060
-
\??\c:\jjjpd.exec:\jjjpd.exe239⤵PID:3060
-
\??\c:\fxxxfrx.exec:\fxxxfrx.exe240⤵PID:2328
-
\??\c:\lxlrrrx.exec:\lxlrrrx.exe241⤵PID:2120
-
\??\c:\bthhtt.exec:\bthhtt.exe242⤵PID:1600