Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 06:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
90b90256780e8fd7f0a3729f546a4a00_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
90b90256780e8fd7f0a3729f546a4a00_NeikiAnalytics.exe
-
Size
65KB
-
MD5
90b90256780e8fd7f0a3729f546a4a00
-
SHA1
9b97685544ce7bd3a8d179ae5194acd2045c6d64
-
SHA256
35b07735f815ba3990fbff3f93eeb91a4a408d6388dc33aeb4eb59f59ff16393
-
SHA512
5e27a9aefa58720a7d3d7b4469dc661ff35b681c363eaaf1f45967be0e8d76ff5875b3b59ebf76e1cb3e385b49d42e5ff8e84feedc572ec97dc64243e94dc7f9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfDK:ymb3NkkiQ3mdBjFI4VC
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral1/memory/1648-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2072-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-51-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2656-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-79-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2624-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1808-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1796-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1256-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/812-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/616-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/624-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1060-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1764-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
1xxlxfr.exe5hnbbb.exennhtnt.exejjjvj.exebthnbh.exettnthh.exevpdvd.exe9jddj.exeflrrfrr.exebbhhnb.exeddvdj.exedvpvj.exelfrlrfl.exehbnbnn.exedvvvj.exevjpdj.exelflllrl.exenhnbnt.exeppdvp.exelfxxlxl.exexrflrff.exetthhtt.exepdvjp.exepjpvj.exerrllfxr.exethhntn.exetnbhbt.exepvvpp.exe7tbhtn.exejpvpv.exe1llxffx.exe3fxlxfl.exennbtht.exeddvdj.exerrlxlxf.exe9nbbtt.exe1hhnbh.exedpdjp.exe9jjvj.exevvpvp.exexxrfrxr.exebtbtnt.exehhbnbh.exepjvdv.exevpjvv.exe5xrlrlf.exerlfxlxl.exettnbnt.exepdpjp.exejpdjp.exexxfxllr.exelfxflrx.exe1thbhh.exeddjjp.exeppjvp.exexxxxffl.exefrflxxl.exenbbhnn.exehtbnnb.exexrfrrrr.exehbtbnn.exebtbbnt.exevvpdp.exe9ddjd.exepid process 2204 1xxlxfr.exe 2828 5hnbbb.exe 2072 nnhtnt.exe 2712 jjjvj.exe 2656 bthnbh.exe 2076 ttnthh.exe 2624 vpdvd.exe 2528 9jddj.exe 1808 flrrfrr.exe 1796 bbhhnb.exe 2912 ddvdj.exe 1256 dvpvj.exe 2772 lfrlrfl.exe 1272 hbnbnn.exe 2568 dvvvj.exe 2596 vjpdj.exe 2924 lflllrl.exe 812 nhnbnt.exe 1952 ppdvp.exe 1816 lfxxlxl.exe 2464 xrflrff.exe 616 tthhtt.exe 624 pdvjp.exe 1060 pjpvj.exe 328 rrllfxr.exe 1780 thhntn.exe 1868 tnbhbt.exe 3028 pvvpp.exe 1452 7tbhtn.exe 1764 jpvpv.exe 2440 1llxffx.exe 2416 3fxlxfl.exe 3040 nnbtht.exe 2408 ddvdj.exe 1196 rrlxlxf.exe 2300 9nbbtt.exe 2828 1hhnbh.exe 2704 dpdjp.exe 2664 9jjvj.exe 2876 vvpvp.exe 1552 xxrfrxr.exe 2536 btbtnt.exe 2524 hhbnbh.exe 2680 pjvdv.exe 2260 vpjvv.exe 2780 5xrlrlf.exe 2928 rlfxlxl.exe 3064 ttnbnt.exe 1820 pdpjp.exe 1972 jpdjp.exe 2748 xxfxllr.exe 2484 lfxflrx.exe 2784 1thbhh.exe 2868 ddjjp.exe 1232 ppjvp.exe 372 xxxxffl.exe 812 frflxxl.exe 1952 nbbhnn.exe 1912 htbnnb.exe 3012 xrfrrrr.exe 660 hbtbnn.exe 352 btbbnt.exe 624 vvpdp.exe 1480 9ddjd.exe -
Processes:
resource yara_rule behavioral1/memory/1648-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1808-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1256-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/812-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/616-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/624-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1060-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1764-287-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
90b90256780e8fd7f0a3729f546a4a00_NeikiAnalytics.exe1xxlxfr.exe5hnbbb.exennhtnt.exejjjvj.exebthnbh.exettnthh.exevpdvd.exe9jddj.exeflrrfrr.exebbhhnb.exeddvdj.exedvpvj.exelfrlrfl.exehbnbnn.exedvvvj.exedescription pid process target process PID 1648 wrote to memory of 2204 1648 90b90256780e8fd7f0a3729f546a4a00_NeikiAnalytics.exe 1xxlxfr.exe PID 1648 wrote to memory of 2204 1648 90b90256780e8fd7f0a3729f546a4a00_NeikiAnalytics.exe 1xxlxfr.exe PID 1648 wrote to memory of 2204 1648 90b90256780e8fd7f0a3729f546a4a00_NeikiAnalytics.exe 1xxlxfr.exe PID 1648 wrote to memory of 2204 1648 90b90256780e8fd7f0a3729f546a4a00_NeikiAnalytics.exe 1xxlxfr.exe PID 2204 wrote to memory of 2828 2204 1xxlxfr.exe 5hnbbb.exe PID 2204 wrote to memory of 2828 2204 1xxlxfr.exe 5hnbbb.exe PID 2204 wrote to memory of 2828 2204 1xxlxfr.exe 5hnbbb.exe PID 2204 wrote to memory of 2828 2204 1xxlxfr.exe 5hnbbb.exe PID 2828 wrote to memory of 2072 2828 5hnbbb.exe nnhtnt.exe PID 2828 wrote to memory of 2072 2828 5hnbbb.exe nnhtnt.exe PID 2828 wrote to memory of 2072 2828 5hnbbb.exe nnhtnt.exe PID 2828 wrote to memory of 2072 2828 5hnbbb.exe nnhtnt.exe PID 2072 wrote to memory of 2712 2072 nnhtnt.exe jjjvj.exe PID 2072 wrote to memory of 2712 2072 nnhtnt.exe jjjvj.exe PID 2072 wrote to memory of 2712 2072 nnhtnt.exe jjjvj.exe PID 2072 wrote to memory of 2712 2072 nnhtnt.exe jjjvj.exe PID 2712 wrote to memory of 2656 2712 jjjvj.exe bthnbh.exe PID 2712 wrote to memory of 2656 2712 jjjvj.exe bthnbh.exe PID 2712 wrote to memory of 2656 2712 jjjvj.exe bthnbh.exe PID 2712 wrote to memory of 2656 2712 jjjvj.exe bthnbh.exe PID 2656 wrote to memory of 2076 2656 bthnbh.exe ttnthh.exe PID 2656 wrote to memory of 2076 2656 bthnbh.exe ttnthh.exe PID 2656 wrote to memory of 2076 2656 bthnbh.exe ttnthh.exe PID 2656 wrote to memory of 2076 2656 bthnbh.exe ttnthh.exe PID 2076 wrote to memory of 2624 2076 ttnthh.exe vpdvd.exe PID 2076 wrote to memory of 2624 2076 ttnthh.exe vpdvd.exe PID 2076 wrote to memory of 2624 2076 ttnthh.exe vpdvd.exe PID 2076 wrote to memory of 2624 2076 ttnthh.exe vpdvd.exe PID 2624 wrote to memory of 2528 2624 vpdvd.exe 9jddj.exe PID 2624 wrote to memory of 2528 2624 vpdvd.exe 9jddj.exe PID 2624 wrote to memory of 2528 2624 vpdvd.exe 9jddj.exe PID 2624 wrote to memory of 2528 2624 vpdvd.exe 9jddj.exe PID 2528 wrote to memory of 1808 2528 9jddj.exe flrrfrr.exe PID 2528 wrote to memory of 1808 2528 9jddj.exe flrrfrr.exe PID 2528 wrote to memory of 1808 2528 9jddj.exe flrrfrr.exe PID 2528 wrote to memory of 1808 2528 9jddj.exe flrrfrr.exe PID 1808 wrote to memory of 1796 1808 flrrfrr.exe bbhhnb.exe PID 1808 wrote to memory of 1796 1808 flrrfrr.exe bbhhnb.exe PID 1808 wrote to memory of 1796 1808 flrrfrr.exe bbhhnb.exe PID 1808 wrote to memory of 1796 1808 flrrfrr.exe bbhhnb.exe PID 1796 wrote to memory of 2912 1796 bbhhnb.exe ddvdj.exe PID 1796 wrote to memory of 2912 1796 bbhhnb.exe ddvdj.exe PID 1796 wrote to memory of 2912 1796 bbhhnb.exe ddvdj.exe PID 1796 wrote to memory of 2912 1796 bbhhnb.exe ddvdj.exe PID 2912 wrote to memory of 1256 2912 ddvdj.exe dvpvj.exe PID 2912 wrote to memory of 1256 2912 ddvdj.exe dvpvj.exe PID 2912 wrote to memory of 1256 2912 ddvdj.exe dvpvj.exe PID 2912 wrote to memory of 1256 2912 ddvdj.exe dvpvj.exe PID 1256 wrote to memory of 2772 1256 dvpvj.exe lfrlrfl.exe PID 1256 wrote to memory of 2772 1256 dvpvj.exe lfrlrfl.exe PID 1256 wrote to memory of 2772 1256 dvpvj.exe lfrlrfl.exe PID 1256 wrote to memory of 2772 1256 dvpvj.exe lfrlrfl.exe PID 2772 wrote to memory of 1272 2772 lfrlrfl.exe hbnbnn.exe PID 2772 wrote to memory of 1272 2772 lfrlrfl.exe hbnbnn.exe PID 2772 wrote to memory of 1272 2772 lfrlrfl.exe hbnbnn.exe PID 2772 wrote to memory of 1272 2772 lfrlrfl.exe hbnbnn.exe PID 1272 wrote to memory of 2568 1272 hbnbnn.exe dvvvj.exe PID 1272 wrote to memory of 2568 1272 hbnbnn.exe dvvvj.exe PID 1272 wrote to memory of 2568 1272 hbnbnn.exe dvvvj.exe PID 1272 wrote to memory of 2568 1272 hbnbnn.exe dvvvj.exe PID 2568 wrote to memory of 2596 2568 dvvvj.exe vjpdj.exe PID 2568 wrote to memory of 2596 2568 dvvvj.exe vjpdj.exe PID 2568 wrote to memory of 2596 2568 dvvvj.exe vjpdj.exe PID 2568 wrote to memory of 2596 2568 dvvvj.exe vjpdj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\90b90256780e8fd7f0a3729f546a4a00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\90b90256780e8fd7f0a3729f546a4a00_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\1xxlxfr.exec:\1xxlxfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\5hnbbb.exec:\5hnbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\nnhtnt.exec:\nnhtnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\jjjvj.exec:\jjjvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\bthnbh.exec:\bthnbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\ttnthh.exec:\ttnthh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\vpdvd.exec:\vpdvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\9jddj.exec:\9jddj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\flrrfrr.exec:\flrrfrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\bbhhnb.exec:\bbhhnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\ddvdj.exec:\ddvdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\dvpvj.exec:\dvpvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\lfrlrfl.exec:\lfrlrfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\hbnbnn.exec:\hbnbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\dvvvj.exec:\dvvvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\vjpdj.exec:\vjpdj.exe17⤵
- Executes dropped EXE
PID:2596 -
\??\c:\lflllrl.exec:\lflllrl.exe18⤵
- Executes dropped EXE
PID:2924 -
\??\c:\nhnbnt.exec:\nhnbnt.exe19⤵
- Executes dropped EXE
PID:812 -
\??\c:\ppdvp.exec:\ppdvp.exe20⤵
- Executes dropped EXE
PID:1952 -
\??\c:\lfxxlxl.exec:\lfxxlxl.exe21⤵
- Executes dropped EXE
PID:1816 -
\??\c:\xrflrff.exec:\xrflrff.exe22⤵
- Executes dropped EXE
PID:2464 -
\??\c:\tthhtt.exec:\tthhtt.exe23⤵
- Executes dropped EXE
PID:616 -
\??\c:\pdvjp.exec:\pdvjp.exe24⤵
- Executes dropped EXE
PID:624 -
\??\c:\pjpvj.exec:\pjpvj.exe25⤵
- Executes dropped EXE
PID:1060 -
\??\c:\rrllfxr.exec:\rrllfxr.exe26⤵
- Executes dropped EXE
PID:328 -
\??\c:\thhntn.exec:\thhntn.exe27⤵
- Executes dropped EXE
PID:1780 -
\??\c:\tnbhbt.exec:\tnbhbt.exe28⤵
- Executes dropped EXE
PID:1868 -
\??\c:\pvvpp.exec:\pvvpp.exe29⤵
- Executes dropped EXE
PID:3028 -
\??\c:\7tbhtn.exec:\7tbhtn.exe30⤵
- Executes dropped EXE
PID:1452 -
\??\c:\jpvpv.exec:\jpvpv.exe31⤵
- Executes dropped EXE
PID:1764 -
\??\c:\1llxffx.exec:\1llxffx.exe32⤵
- Executes dropped EXE
PID:2440 -
\??\c:\3fxlxfl.exec:\3fxlxfl.exe33⤵
- Executes dropped EXE
PID:2416 -
\??\c:\nnbtht.exec:\nnbtht.exe34⤵
- Executes dropped EXE
PID:3040 -
\??\c:\3vpvd.exec:\3vpvd.exe35⤵PID:1648
-
\??\c:\ddvdj.exec:\ddvdj.exe36⤵
- Executes dropped EXE
PID:2408 -
\??\c:\rrlxlxf.exec:\rrlxlxf.exe37⤵
- Executes dropped EXE
PID:1196 -
\??\c:\9nbbtt.exec:\9nbbtt.exe38⤵
- Executes dropped EXE
PID:2300 -
\??\c:\1hhnbh.exec:\1hhnbh.exe39⤵
- Executes dropped EXE
PID:2828 -
\??\c:\dpdjp.exec:\dpdjp.exe40⤵
- Executes dropped EXE
PID:2704 -
\??\c:\9jjvj.exec:\9jjvj.exe41⤵
- Executes dropped EXE
PID:2664 -
\??\c:\vvpvp.exec:\vvpvp.exe42⤵
- Executes dropped EXE
PID:2876 -
\??\c:\xxrfrxr.exec:\xxrfrxr.exe43⤵
- Executes dropped EXE
PID:1552 -
\??\c:\btbtnt.exec:\btbtnt.exe44⤵
- Executes dropped EXE
PID:2536 -
\??\c:\hhbnbh.exec:\hhbnbh.exe45⤵
- Executes dropped EXE
PID:2524 -
\??\c:\pjvdv.exec:\pjvdv.exe46⤵
- Executes dropped EXE
PID:2680 -
\??\c:\vpjvv.exec:\vpjvv.exe47⤵
- Executes dropped EXE
PID:2260 -
\??\c:\5xrlrlf.exec:\5xrlrlf.exe48⤵
- Executes dropped EXE
PID:2780 -
\??\c:\rlfxlxl.exec:\rlfxlxl.exe49⤵
- Executes dropped EXE
PID:2928 -
\??\c:\ttnbnt.exec:\ttnbnt.exe50⤵
- Executes dropped EXE
PID:3064 -
\??\c:\pdpjp.exec:\pdpjp.exe51⤵
- Executes dropped EXE
PID:1820 -
\??\c:\jpdjp.exec:\jpdjp.exe52⤵
- Executes dropped EXE
PID:1972 -
\??\c:\xxfxllr.exec:\xxfxllr.exe53⤵
- Executes dropped EXE
PID:2748 -
\??\c:\lfxflrx.exec:\lfxflrx.exe54⤵
- Executes dropped EXE
PID:2484 -
\??\c:\1thbhh.exec:\1thbhh.exe55⤵
- Executes dropped EXE
PID:2784 -
\??\c:\ddjjp.exec:\ddjjp.exe56⤵
- Executes dropped EXE
PID:2868 -
\??\c:\ppjvp.exec:\ppjvp.exe57⤵
- Executes dropped EXE
PID:1232 -
\??\c:\xxxxffl.exec:\xxxxffl.exe58⤵
- Executes dropped EXE
PID:372 -
\??\c:\frflxxl.exec:\frflxxl.exe59⤵
- Executes dropped EXE
PID:812 -
\??\c:\nbbhnn.exec:\nbbhnn.exe60⤵
- Executes dropped EXE
PID:1952 -
\??\c:\htbnnb.exec:\htbnnb.exe61⤵
- Executes dropped EXE
PID:1912 -
\??\c:\xrfrrrr.exec:\xrfrrrr.exe62⤵
- Executes dropped EXE
PID:3012 -
\??\c:\hbtbnn.exec:\hbtbnn.exe63⤵
- Executes dropped EXE
PID:660 -
\??\c:\btbbnt.exec:\btbbnt.exe64⤵
- Executes dropped EXE
PID:352 -
\??\c:\vvpdp.exec:\vvpdp.exe65⤵
- Executes dropped EXE
PID:624 -
\??\c:\9ddjd.exec:\9ddjd.exe66⤵
- Executes dropped EXE
PID:1480 -
\??\c:\xxrrxxl.exec:\xxrrxxl.exe67⤵PID:836
-
\??\c:\7xrlrrr.exec:\7xrlrrr.exe68⤵PID:1560
-
\??\c:\hthbtt.exec:\hthbtt.exe69⤵PID:988
-
\??\c:\7tnnhn.exec:\7tnnhn.exe70⤵PID:928
-
\??\c:\3jjpv.exec:\3jjpv.exe71⤵PID:868
-
\??\c:\dvjpp.exec:\dvjpp.exe72⤵PID:1792
-
\??\c:\xlrxrrf.exec:\xlrxrrf.exe73⤵PID:1120
-
\??\c:\tththn.exec:\tththn.exe74⤵PID:1396
-
\??\c:\bhhtth.exec:\bhhtth.exe75⤵PID:1536
-
\??\c:\nhttnt.exec:\nhttnt.exe76⤵PID:2352
-
\??\c:\9djpd.exec:\9djpd.exe77⤵PID:3040
-
\??\c:\jddpj.exec:\jddpj.exe78⤵PID:2468
-
\??\c:\5rfxfrl.exec:\5rfxfrl.exe79⤵PID:1616
-
\??\c:\lfxflrx.exec:\lfxflrx.exe80⤵PID:1268
-
\??\c:\thbhnt.exec:\thbhnt.exe81⤵PID:1632
-
\??\c:\bthnbb.exec:\bthnbb.exe82⤵PID:2716
-
\??\c:\9vjpd.exec:\9vjpd.exe83⤵PID:2700
-
\??\c:\rlxlflx.exec:\rlxlflx.exe84⤵PID:2796
-
\??\c:\7xrxfxl.exec:\7xrxfxl.exe85⤵PID:2832
-
\??\c:\7hnbbb.exec:\7hnbbb.exe86⤵PID:1276
-
\??\c:\nnhtnb.exec:\nnhtnb.exe87⤵PID:2508
-
\??\c:\7dvjv.exec:\7dvjv.exe88⤵PID:2632
-
\??\c:\pdvjv.exec:\pdvjv.exe89⤵PID:2528
-
\??\c:\lfrfllx.exec:\lfrfllx.exe90⤵PID:1808
-
\??\c:\7lffflr.exec:\7lffflr.exe91⤵PID:2896
-
\??\c:\bthnbh.exec:\bthnbh.exe92⤵PID:3052
-
\??\c:\bnhnbb.exec:\bnhnbb.exe93⤵PID:2864
-
\??\c:\9vpvd.exec:\9vpvd.exe94⤵PID:2148
-
\??\c:\5dvdj.exec:\5dvdj.exe95⤵PID:2308
-
\??\c:\9lrxxxf.exec:\9lrxxxf.exe96⤵PID:2764
-
\??\c:\9lfrffr.exec:\9lfrffr.exe97⤵PID:2768
-
\??\c:\bnbntb.exec:\bnbntb.exe98⤵PID:2004
-
\??\c:\vvvjp.exec:\vvvjp.exe99⤵PID:2140
-
\??\c:\jdppd.exec:\jdppd.exe100⤵PID:1752
-
\??\c:\3xrffff.exec:\3xrffff.exe101⤵PID:1704
-
\??\c:\3rlxffr.exec:\3rlxffr.exe102⤵PID:2120
-
\??\c:\hnbbht.exec:\hnbbht.exe103⤵PID:2428
-
\??\c:\hbttbh.exec:\hbttbh.exe104⤵PID:3020
-
\??\c:\jdjjv.exec:\jdjjv.exe105⤵PID:532
-
\??\c:\vpjpd.exec:\vpjpd.exe106⤵PID:616
-
\??\c:\xrflffr.exec:\xrflffr.exe107⤵PID:756
-
\??\c:\thbhtn.exec:\thbhtn.exe108⤵PID:1856
-
\??\c:\bhbhbn.exec:\bhbhbn.exe109⤵PID:1784
-
\??\c:\pjdpd.exec:\pjdpd.exe110⤵PID:1548
-
\??\c:\1jdjv.exec:\1jdjv.exe111⤵PID:1780
-
\??\c:\lflrflr.exec:\lflrflr.exe112⤵PID:1960
-
\??\c:\xrflrrl.exec:\xrflrrl.exe113⤵PID:1596
-
\??\c:\tnhtnn.exec:\tnhtnn.exe114⤵PID:2344
-
\??\c:\jdppd.exec:\jdppd.exe115⤵PID:1712
-
\??\c:\vpvvd.exec:\vpvvd.exe116⤵PID:1764
-
\??\c:\7rllrrx.exec:\7rllrrx.exe117⤵PID:880
-
\??\c:\7frfrxf.exec:\7frfrxf.exe118⤵PID:2592
-
\??\c:\thtbhn.exec:\thtbhn.exe119⤵PID:2032
-
\??\c:\7pdpd.exec:\7pdpd.exe120⤵PID:3040
-
\??\c:\jjvvd.exec:\jjvvd.exe121⤵PID:2408
-
\??\c:\dvjdp.exec:\dvjdp.exe122⤵PID:2372
-
\??\c:\rllxrlx.exec:\rllxrlx.exe123⤵PID:2384
-
\??\c:\ffflfxr.exec:\ffflfxr.exe124⤵PID:2660
-
\??\c:\3tnntb.exec:\3tnntb.exe125⤵PID:2728
-
\??\c:\7nnnhh.exec:\7nnnhh.exe126⤵PID:2812
-
\??\c:\vjvdj.exec:\vjvdj.exe127⤵PID:2692
-
\??\c:\jvjjv.exec:\jvjjv.exe128⤵PID:2676
-
\??\c:\5xrflrl.exec:\5xrflrl.exe129⤵PID:2520
-
\??\c:\9xxxlrr.exec:\9xxxlrr.exe130⤵PID:2580
-
\??\c:\nhbnhh.exec:\nhbnhh.exe131⤵PID:1080
-
\??\c:\btbbhh.exec:\btbbhh.exe132⤵PID:1692
-
\??\c:\pdvdj.exec:\pdvdj.exe133⤵PID:2972
-
\??\c:\3djjp.exec:\3djjp.exe134⤵PID:2976
-
\??\c:\9rllxfr.exec:\9rllxfr.exe135⤵PID:1364
-
\??\c:\9rrxrlx.exec:\9rrxrlx.exe136⤵PID:2756
-
\??\c:\tnntnn.exec:\tnntnn.exe137⤵PID:2312
-
\??\c:\nbtthb.exec:\nbtthb.exe138⤵PID:1448
-
\??\c:\5djpj.exec:\5djpj.exe139⤵PID:2760
-
\??\c:\vpjdd.exec:\vpjdd.exe140⤵PID:2880
-
\??\c:\7lfxrrx.exec:\7lfxrrx.exe141⤵PID:1824
-
\??\c:\rlxlrrr.exec:\rlxlrrr.exe142⤵PID:2924
-
\??\c:\hbbntb.exec:\hbbntb.exe143⤵PID:2060
-
\??\c:\hbbbhn.exec:\hbbbhn.exe144⤵PID:2456
-
\??\c:\hbnthn.exec:\hbnthn.exe145⤵PID:2404
-
\??\c:\1dvvp.exec:\1dvvp.exe146⤵PID:2488
-
\??\c:\9ddpj.exec:\9ddpj.exe147⤵PID:1724
-
\??\c:\xllrrrx.exec:\xllrrrx.exe148⤵PID:1720
-
\??\c:\ffrfxfr.exec:\ffrfxfr.exe149⤵PID:1496
-
\??\c:\hbbthn.exec:\hbbthn.exe150⤵PID:1392
-
\??\c:\ttnthn.exec:\ttnthn.exe151⤵PID:2348
-
\??\c:\ppvdj.exec:\ppvdj.exe152⤵PID:1776
-
\??\c:\jvddd.exec:\jvddd.exe153⤵PID:1284
-
\??\c:\9flrrfx.exec:\9flrrfx.exe154⤵PID:1936
-
\??\c:\thtbnt.exec:\thtbnt.exe155⤵PID:840
-
\??\c:\hbnnnn.exec:\hbnnnn.exe156⤵PID:2192
-
\??\c:\jvpdp.exec:\jvpdp.exe157⤵PID:3036
-
\??\c:\ppjpd.exec:\ppjpd.exe158⤵PID:556
-
\??\c:\rlxlxxf.exec:\rlxlxxf.exe159⤵PID:1512
-
\??\c:\frfffrx.exec:\frfffrx.exe160⤵PID:3044
-
\??\c:\btntbb.exec:\btntbb.exe161⤵PID:2220
-
\??\c:\bbthnn.exec:\bbthnn.exe162⤵PID:2420
-
\??\c:\vppjp.exec:\vppjp.exe163⤵PID:3040
-
\??\c:\7vjpd.exec:\7vjpd.exe164⤵PID:1196
-
\??\c:\dvjpp.exec:\dvjpp.exe165⤵PID:2372
-
\??\c:\rlrxfxl.exec:\rlrxfxl.exe166⤵PID:2696
-
\??\c:\fxlrxlx.exec:\fxlrxlx.exe167⤵PID:2072
-
\??\c:\hhbthn.exec:\hhbthn.exe168⤵PID:2712
-
\??\c:\7thntb.exec:\7thntb.exe169⤵PID:2672
-
\??\c:\vvpdv.exec:\vvpdv.exe170⤵PID:2556
-
\??\c:\jppvv.exec:\jppvv.exe171⤵PID:2564
-
\??\c:\5rxrlrf.exec:\5rxrlrf.exe172⤵PID:2584
-
\??\c:\lfxfrff.exec:\lfxfrff.exe173⤵PID:2816
-
\??\c:\ttbttb.exec:\ttbttb.exe174⤵PID:2168
-
\??\c:\1tbntt.exec:\1tbntt.exe175⤵PID:2940
-
\??\c:\dvjjp.exec:\dvjjp.exe176⤵PID:2952
-
\??\c:\9pjvv.exec:\9pjvv.exe177⤵PID:1524
-
\??\c:\frlrflr.exec:\frlrflr.exe178⤵PID:2840
-
\??\c:\xlxfrxf.exec:\xlxfrxf.exe179⤵PID:2776
-
\??\c:\btbbnn.exec:\btbbnn.exe180⤵PID:744
-
\??\c:\bthntb.exec:\bthntb.exe181⤵PID:2744
-
\??\c:\1vvvp.exec:\1vvvp.exe182⤵PID:2852
-
\??\c:\pdvvd.exec:\pdvvd.exe183⤵PID:2880
-
\??\c:\lffrrxf.exec:\lffrrxf.exe184⤵PID:296
-
\??\c:\rrlxffl.exec:\rrlxffl.exe185⤵PID:268
-
\??\c:\7nhhtb.exec:\7nhhtb.exe186⤵PID:2548
-
\??\c:\nnhtbb.exec:\nnhtbb.exe187⤵PID:2456
-
\??\c:\vpdpj.exec:\vpdpj.exe188⤵PID:3016
-
\??\c:\xlxfrrx.exec:\xlxfrrx.exe189⤵PID:3004
-
\??\c:\llllrrl.exec:\llllrrl.exe190⤵PID:708
-
\??\c:\7bbbtn.exec:\7bbbtn.exe191⤵PID:1100
-
\??\c:\7vvjj.exec:\7vvjj.exe192⤵PID:2000
-
\??\c:\vpjpp.exec:\vpjpp.exe193⤵PID:548
-
\??\c:\5rlfrlx.exec:\5rlfrlx.exe194⤵PID:836
-
\??\c:\tnhbbh.exec:\tnhbbh.exe195⤵PID:1548
-
\??\c:\hbthnt.exec:\hbthnt.exe196⤵PID:2132
-
\??\c:\9djvj.exec:\9djvj.exe197⤵PID:2356
-
\??\c:\frxrrlr.exec:\frxrrlr.exe198⤵PID:868
-
\??\c:\tthnbh.exec:\tthnbh.exe199⤵PID:2320
-
\??\c:\nnhthb.exec:\nnhthb.exe200⤵PID:1712
-
\??\c:\1vjdd.exec:\1vjdd.exe201⤵PID:1064
-
\??\c:\dvjjp.exec:\dvjjp.exe202⤵PID:2360
-
\??\c:\lfrxrxl.exec:\lfrxrxl.exe203⤵PID:1536
-
\??\c:\1lxxxlf.exec:\1lxxxlf.exe204⤵PID:1604
-
\??\c:\btnntb.exec:\btnntb.exe205⤵PID:1920
-
\??\c:\5nbhtb.exec:\5nbhtb.exe206⤵PID:1580
-
\??\c:\ppvdj.exec:\ppvdj.exe207⤵PID:2652
-
\??\c:\5pjdj.exec:\5pjdj.exe208⤵PID:2372
-
\??\c:\fffrlfr.exec:\fffrlfr.exe209⤵PID:2640
-
\??\c:\lfrfrfx.exec:\lfrfrfx.exe210⤵PID:2728
-
\??\c:\nnnbbn.exec:\nnnbbn.exe211⤵PID:2796
-
\??\c:\bnhhbh.exec:\bnhhbh.exe212⤵PID:2672
-
\??\c:\vvpvd.exec:\vvpvd.exe213⤵PID:2624
-
\??\c:\vjppd.exec:\vjppd.exe214⤵PID:2524
-
\??\c:\lfxfrrf.exec:\lfxfrrf.exe215⤵PID:1948
-
\??\c:\xrlllfx.exec:\xrlllfx.exe216⤵PID:2964
-
\??\c:\7tbbhh.exec:\7tbbhh.exe217⤵PID:2960
-
\??\c:\btnntb.exec:\btnntb.exe218⤵PID:2928
-
\??\c:\1pvjp.exec:\1pvjp.exe219⤵PID:2912
-
\??\c:\dvdjv.exec:\dvdjv.exe220⤵PID:1364
-
\??\c:\9rlrffl.exec:\9rlrffl.exe221⤵PID:2756
-
\??\c:\xlxlrxx.exec:\xlxlrxx.exe222⤵PID:2312
-
\??\c:\htnnbb.exec:\htnnbb.exe223⤵PID:1448
-
\??\c:\tntnnt.exec:\tntnnt.exe224⤵PID:2760
-
\??\c:\bnhhnt.exec:\bnhhnt.exe225⤵PID:272
-
\??\c:\7ppjj.exec:\7ppjj.exe226⤵PID:2892
-
\??\c:\llflxfr.exec:\llflxfr.exe227⤵PID:2604
-
\??\c:\rrrlxrf.exec:\rrrlxrf.exe228⤵PID:1296
-
\??\c:\1bhbnt.exec:\1bhbnt.exe229⤵PID:2120
-
\??\c:\5hbttb.exec:\5hbttb.exe230⤵PID:2404
-
\??\c:\pvjvd.exec:\pvjvd.exe231⤵PID:264
-
\??\c:\jdjjp.exec:\jdjjp.exe232⤵PID:1724
-
\??\c:\5llfrrf.exec:\5llfrrf.exe233⤵PID:1652
-
\??\c:\rlfxxfl.exec:\rlfxxfl.exe234⤵PID:864
-
\??\c:\bthbhh.exec:\bthbhh.exe235⤵PID:316
-
\??\c:\hbnthh.exec:\hbnthh.exe236⤵PID:1872
-
\??\c:\pjdpd.exec:\pjdpd.exe237⤵PID:596
-
\??\c:\vvjvp.exec:\vvjvp.exe238⤵PID:1480
-
\??\c:\xlxlxxf.exec:\xlxlxxf.exe239⤵PID:1780
-
\??\c:\1frxrfr.exec:\1frxrfr.exe240⤵PID:1956
-
\??\c:\frffrll.exec:\frffrll.exe241⤵PID:2012
-
\??\c:\nhthnn.exec:\nhthnn.exe242⤵PID:1976