Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 07:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a1cda3272c40ec2ae25d40be4579fdb0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
a1cda3272c40ec2ae25d40be4579fdb0_NeikiAnalytics.exe
-
Size
141KB
-
MD5
a1cda3272c40ec2ae25d40be4579fdb0
-
SHA1
89a3e6faac3cb51d6095fa1c387ee11fc371c045
-
SHA256
d3fad1a77d4983e464767926057db7c0c369de4ec3df0c4defef8e60cc0d21d5
-
SHA512
39902eae41b9369bb694ba1a87457fb047896027de3ba88b6ede850e9596f937533a53a54393bbb9e7c9223b6a6fcd8d768f103af8c5e9d1d880a43a53a0fe9f
-
SSDEEP
3072:ymb3NkkiQ3mdBjFomR7UsyJC+n0Gsgyek1q:n3C9BRomRph+0GsgyeYq
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral1/memory/2044-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1468-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1468-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3012-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1684-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1228-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/112-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2132-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1764-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1448-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1256-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1888-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-94-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2376-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2376-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lrxllfl.exehtbbbt.exe9httbt.exevpdjp.exejpvvv.exefxfllff.exe7rllxxr.exebnnnnh.exethbbbt.exe3dddd.exe1djvv.exexlrllll.exelxlxfxx.exe5bbhbh.exetntnnt.exenthttn.exejpvvj.exedpdvv.exelxxxxxf.exe5frlrlr.exe3httbn.exenbhbbb.exebnbhht.exejvddv.exevjjjv.exelrrrlff.exe7xxrxrf.exe5nttnt.exehntttt.exevjpjp.exe1pppp.exedjvpp.exelxfffxf.exefrlrrfl.exethbbhh.exebhnbtn.exetnbttb.exe7jvpv.exe5djpv.exe9vdvd.exerrlrfrx.exe1lxxfxl.exe5rxffff.exehntnbt.exenbnttn.exe7thttn.exejdjjj.exe1pdvv.exejvjjj.exefrrllfx.exe9frffff.exefxfxffl.exefxfflrf.exe1nhbbt.exebtttnn.exenhnhht.exe5jpdv.exejvdjp.exefxllfxx.exe9xxlfff.exerlrlxrx.exenbttnn.exe1nhhht.exejvjpv.exepid process 1468 lrxllfl.exe 2376 htbbbt.exe 2660 9httbt.exe 2588 vpdjp.exe 2884 jpvvv.exe 3012 fxfllff.exe 2520 7rllxxr.exe 2480 bnnnnh.exe 2600 thbbbt.exe 2204 3dddd.exe 2812 1djvv.exe 2824 xlrllll.exe 1888 lxlxfxx.exe 1256 5bbhbh.exe 1448 tntnnt.exe 2816 nthttn.exe 1648 jpvvj.exe 1764 dpdvv.exe 2852 lxxxxxf.exe 2132 5frlrlr.exe 2312 3httbn.exe 584 nbhbbb.exe 112 bnbhht.exe 1816 jvddv.exe 1228 vjjjv.exe 1684 lrrrlff.exe 1120 7xxrxrf.exe 2408 5nttnt.exe 2016 hntttt.exe 2128 vjpjp.exe 2084 1pppp.exe 2264 djvpp.exe 1472 lxfffxf.exe 2024 frlrrfl.exe 1604 thbbhh.exe 2672 bhnbtn.exe 2756 tnbttb.exe 2752 7jvpv.exe 2504 5djpv.exe 2572 9vdvd.exe 2544 rrlrfrx.exe 3060 1lxxfxl.exe 1988 5rxffff.exe 2204 hntnbt.exe 2812 nbnttn.exe 2456 7thttn.exe 2552 jdjjj.exe 936 1pdvv.exe 2784 jvjjj.exe 1448 frrllfx.exe 2780 9frffff.exe 2948 fxfxffl.exe 1580 fxfflrf.exe 2416 1nhbbt.exe 2096 btttnn.exe 2104 nhnhht.exe 588 5jpdv.exe 660 jvdjp.exe 828 fxllfxx.exe 1696 9xxlfff.exe 1192 rlrlxrx.exe 1952 nbttnn.exe 1676 1nhhht.exe 2020 jvjpv.exe -
Processes:
resource yara_rule behavioral1/memory/2044-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1468-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1684-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1228-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/112-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2132-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1764-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1448-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1256-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1888-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-30-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a1cda3272c40ec2ae25d40be4579fdb0_NeikiAnalytics.exelrxllfl.exehtbbbt.exe9httbt.exevpdjp.exejpvvv.exefxfllff.exe7rllxxr.exebnnnnh.exethbbbt.exe3dddd.exe1djvv.exexlrllll.exelxlxfxx.exe5bbhbh.exetntnnt.exedescription pid process target process PID 2044 wrote to memory of 1468 2044 a1cda3272c40ec2ae25d40be4579fdb0_NeikiAnalytics.exe fxlrffl.exe PID 2044 wrote to memory of 1468 2044 a1cda3272c40ec2ae25d40be4579fdb0_NeikiAnalytics.exe fxlrffl.exe PID 2044 wrote to memory of 1468 2044 a1cda3272c40ec2ae25d40be4579fdb0_NeikiAnalytics.exe fxlrffl.exe PID 2044 wrote to memory of 1468 2044 a1cda3272c40ec2ae25d40be4579fdb0_NeikiAnalytics.exe fxlrffl.exe PID 1468 wrote to memory of 2376 1468 lrxllfl.exe htbbbt.exe PID 1468 wrote to memory of 2376 1468 lrxllfl.exe htbbbt.exe PID 1468 wrote to memory of 2376 1468 lrxllfl.exe htbbbt.exe PID 1468 wrote to memory of 2376 1468 lrxllfl.exe htbbbt.exe PID 2376 wrote to memory of 2660 2376 htbbbt.exe 9httbt.exe PID 2376 wrote to memory of 2660 2376 htbbbt.exe 9httbt.exe PID 2376 wrote to memory of 2660 2376 htbbbt.exe 9httbt.exe PID 2376 wrote to memory of 2660 2376 htbbbt.exe 9httbt.exe PID 2660 wrote to memory of 2588 2660 9httbt.exe vpdjp.exe PID 2660 wrote to memory of 2588 2660 9httbt.exe vpdjp.exe PID 2660 wrote to memory of 2588 2660 9httbt.exe vpdjp.exe PID 2660 wrote to memory of 2588 2660 9httbt.exe vpdjp.exe PID 2588 wrote to memory of 2884 2588 vpdjp.exe jpvvv.exe PID 2588 wrote to memory of 2884 2588 vpdjp.exe jpvvv.exe PID 2588 wrote to memory of 2884 2588 vpdjp.exe jpvvv.exe PID 2588 wrote to memory of 2884 2588 vpdjp.exe jpvvv.exe PID 2884 wrote to memory of 3012 2884 jpvvv.exe fxfllff.exe PID 2884 wrote to memory of 3012 2884 jpvvv.exe fxfllff.exe PID 2884 wrote to memory of 3012 2884 jpvvv.exe fxfllff.exe PID 2884 wrote to memory of 3012 2884 jpvvv.exe fxfllff.exe PID 3012 wrote to memory of 2520 3012 fxfllff.exe 7rllxxr.exe PID 3012 wrote to memory of 2520 3012 fxfllff.exe 7rllxxr.exe PID 3012 wrote to memory of 2520 3012 fxfllff.exe 7rllxxr.exe PID 3012 wrote to memory of 2520 3012 fxfllff.exe 7rllxxr.exe PID 2520 wrote to memory of 2480 2520 7rllxxr.exe bnnnnh.exe PID 2520 wrote to memory of 2480 2520 7rllxxr.exe bnnnnh.exe PID 2520 wrote to memory of 2480 2520 7rllxxr.exe bnnnnh.exe PID 2520 wrote to memory of 2480 2520 7rllxxr.exe bnnnnh.exe PID 2480 wrote to memory of 2600 2480 bnnnnh.exe thbbbt.exe PID 2480 wrote to memory of 2600 2480 bnnnnh.exe thbbbt.exe PID 2480 wrote to memory of 2600 2480 bnnnnh.exe thbbbt.exe PID 2480 wrote to memory of 2600 2480 bnnnnh.exe thbbbt.exe PID 2600 wrote to memory of 2204 2600 thbbbt.exe 3dddd.exe PID 2600 wrote to memory of 2204 2600 thbbbt.exe 3dddd.exe PID 2600 wrote to memory of 2204 2600 thbbbt.exe 3dddd.exe PID 2600 wrote to memory of 2204 2600 thbbbt.exe 3dddd.exe PID 2204 wrote to memory of 2812 2204 3dddd.exe 1djvv.exe PID 2204 wrote to memory of 2812 2204 3dddd.exe 1djvv.exe PID 2204 wrote to memory of 2812 2204 3dddd.exe 1djvv.exe PID 2204 wrote to memory of 2812 2204 3dddd.exe 1djvv.exe PID 2812 wrote to memory of 2824 2812 1djvv.exe xlrllll.exe PID 2812 wrote to memory of 2824 2812 1djvv.exe xlrllll.exe PID 2812 wrote to memory of 2824 2812 1djvv.exe xlrllll.exe PID 2812 wrote to memory of 2824 2812 1djvv.exe xlrllll.exe PID 2824 wrote to memory of 1888 2824 xlrllll.exe lxlxfxx.exe PID 2824 wrote to memory of 1888 2824 xlrllll.exe lxlxfxx.exe PID 2824 wrote to memory of 1888 2824 xlrllll.exe lxlxfxx.exe PID 2824 wrote to memory of 1888 2824 xlrllll.exe lxlxfxx.exe PID 1888 wrote to memory of 1256 1888 lxlxfxx.exe 5bbhbh.exe PID 1888 wrote to memory of 1256 1888 lxlxfxx.exe 5bbhbh.exe PID 1888 wrote to memory of 1256 1888 lxlxfxx.exe 5bbhbh.exe PID 1888 wrote to memory of 1256 1888 lxlxfxx.exe 5bbhbh.exe PID 1256 wrote to memory of 1448 1256 5bbhbh.exe tntnnt.exe PID 1256 wrote to memory of 1448 1256 5bbhbh.exe tntnnt.exe PID 1256 wrote to memory of 1448 1256 5bbhbh.exe tntnnt.exe PID 1256 wrote to memory of 1448 1256 5bbhbh.exe tntnnt.exe PID 1448 wrote to memory of 2816 1448 tntnnt.exe nthttn.exe PID 1448 wrote to memory of 2816 1448 tntnnt.exe nthttn.exe PID 1448 wrote to memory of 2816 1448 tntnnt.exe nthttn.exe PID 1448 wrote to memory of 2816 1448 tntnnt.exe nthttn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1cda3272c40ec2ae25d40be4579fdb0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a1cda3272c40ec2ae25d40be4579fdb0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\lrxllfl.exec:\lrxllfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\htbbbt.exec:\htbbbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\9httbt.exec:\9httbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\vpdjp.exec:\vpdjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\jpvvv.exec:\jpvvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\fxfllff.exec:\fxfllff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\7rllxxr.exec:\7rllxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\bnnnnh.exec:\bnnnnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\thbbbt.exec:\thbbbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\3dddd.exec:\3dddd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\1djvv.exec:\1djvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\xlrllll.exec:\xlrllll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\lxlxfxx.exec:\lxlxfxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\5bbhbh.exec:\5bbhbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\tntnnt.exec:\tntnnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\nthttn.exec:\nthttn.exe17⤵
- Executes dropped EXE
PID:2816 -
\??\c:\jpvvj.exec:\jpvvj.exe18⤵
- Executes dropped EXE
PID:1648 -
\??\c:\dpdvv.exec:\dpdvv.exe19⤵
- Executes dropped EXE
PID:1764 -
\??\c:\lxxxxxf.exec:\lxxxxxf.exe20⤵
- Executes dropped EXE
PID:2852 -
\??\c:\5frlrlr.exec:\5frlrlr.exe21⤵
- Executes dropped EXE
PID:2132 -
\??\c:\3httbn.exec:\3httbn.exe22⤵
- Executes dropped EXE
PID:2312 -
\??\c:\nbhbbb.exec:\nbhbbb.exe23⤵
- Executes dropped EXE
PID:584 -
\??\c:\bnbhht.exec:\bnbhht.exe24⤵
- Executes dropped EXE
PID:112 -
\??\c:\jvddv.exec:\jvddv.exe25⤵
- Executes dropped EXE
PID:1816 -
\??\c:\vjjjv.exec:\vjjjv.exe26⤵
- Executes dropped EXE
PID:1228 -
\??\c:\lrrrlff.exec:\lrrrlff.exe27⤵
- Executes dropped EXE
PID:1684 -
\??\c:\7xxrxrf.exec:\7xxrxrf.exe28⤵
- Executes dropped EXE
PID:1120 -
\??\c:\5nttnt.exec:\5nttnt.exe29⤵
- Executes dropped EXE
PID:2408 -
\??\c:\hntttt.exec:\hntttt.exe30⤵
- Executes dropped EXE
PID:2016 -
\??\c:\vjpjp.exec:\vjpjp.exe31⤵
- Executes dropped EXE
PID:2128 -
\??\c:\1pppp.exec:\1pppp.exe32⤵
- Executes dropped EXE
PID:2084 -
\??\c:\djvpp.exec:\djvpp.exe33⤵
- Executes dropped EXE
PID:2264 -
\??\c:\lxfffxf.exec:\lxfffxf.exe34⤵
- Executes dropped EXE
PID:1472 -
\??\c:\frlrrfl.exec:\frlrrfl.exe35⤵
- Executes dropped EXE
PID:2024 -
\??\c:\thbbhh.exec:\thbbhh.exe36⤵
- Executes dropped EXE
PID:1604 -
\??\c:\bhnbtn.exec:\bhnbtn.exe37⤵
- Executes dropped EXE
PID:2672 -
\??\c:\tnbttb.exec:\tnbttb.exe38⤵
- Executes dropped EXE
PID:2756 -
\??\c:\7jvpv.exec:\7jvpv.exe39⤵
- Executes dropped EXE
PID:2752 -
\??\c:\5djpv.exec:\5djpv.exe40⤵
- Executes dropped EXE
PID:2504 -
\??\c:\9vdvd.exec:\9vdvd.exe41⤵
- Executes dropped EXE
PID:2572 -
\??\c:\rrlrfrx.exec:\rrlrfrx.exe42⤵
- Executes dropped EXE
PID:2544 -
\??\c:\1lxxfxl.exec:\1lxxfxl.exe43⤵
- Executes dropped EXE
PID:3060 -
\??\c:\5rxffff.exec:\5rxffff.exe44⤵
- Executes dropped EXE
PID:1988 -
\??\c:\hntnbt.exec:\hntnbt.exe45⤵
- Executes dropped EXE
PID:2204 -
\??\c:\nbnttn.exec:\nbnttn.exe46⤵
- Executes dropped EXE
PID:2812 -
\??\c:\7thttn.exec:\7thttn.exe47⤵
- Executes dropped EXE
PID:2456 -
\??\c:\jdjjj.exec:\jdjjj.exe48⤵
- Executes dropped EXE
PID:2552 -
\??\c:\1pdvv.exec:\1pdvv.exe49⤵
- Executes dropped EXE
PID:936 -
\??\c:\jvjjj.exec:\jvjjj.exe50⤵
- Executes dropped EXE
PID:2784 -
\??\c:\frrllfx.exec:\frrllfx.exe51⤵
- Executes dropped EXE
PID:1448 -
\??\c:\9frffff.exec:\9frffff.exe52⤵
- Executes dropped EXE
PID:2780 -
\??\c:\fxfxffl.exec:\fxfxffl.exe53⤵
- Executes dropped EXE
PID:2948 -
\??\c:\fxfflrf.exec:\fxfflrf.exe54⤵
- Executes dropped EXE
PID:1580 -
\??\c:\1nhbbt.exec:\1nhbbt.exe55⤵
- Executes dropped EXE
PID:2416 -
\??\c:\btttnn.exec:\btttnn.exe56⤵
- Executes dropped EXE
PID:2096 -
\??\c:\nhnhht.exec:\nhnhht.exe57⤵
- Executes dropped EXE
PID:2104 -
\??\c:\5jpdv.exec:\5jpdv.exe58⤵
- Executes dropped EXE
PID:588 -
\??\c:\jvdjp.exec:\jvdjp.exe59⤵
- Executes dropped EXE
PID:660 -
\??\c:\fxllfxx.exec:\fxllfxx.exe60⤵
- Executes dropped EXE
PID:828 -
\??\c:\9xxlfff.exec:\9xxlfff.exe61⤵
- Executes dropped EXE
PID:1696 -
\??\c:\rlrlxrx.exec:\rlrlxrx.exe62⤵
- Executes dropped EXE
PID:1192 -
\??\c:\nbttnn.exec:\nbttnn.exe63⤵
- Executes dropped EXE
PID:1952 -
\??\c:\1nhhht.exec:\1nhhht.exe64⤵
- Executes dropped EXE
PID:1676 -
\??\c:\jvjpv.exec:\jvjpv.exe65⤵
- Executes dropped EXE
PID:2020 -
\??\c:\5pdvv.exec:\5pdvv.exe66⤵PID:2916
-
\??\c:\vjvpv.exec:\vjvpv.exe67⤵PID:2148
-
\??\c:\frxxfff.exec:\frxxfff.exe68⤵PID:2076
-
\??\c:\fxlrffl.exec:\fxlrffl.exe69⤵PID:1468
-
\??\c:\rxxxrll.exec:\rxxxrll.exe70⤵PID:1336
-
\??\c:\nbnnht.exec:\nbnnht.exe71⤵PID:2728
-
\??\c:\tbbtnb.exec:\tbbtnb.exe72⤵PID:1080
-
\??\c:\3bnhbt.exec:\3bnhbt.exe73⤵PID:2608
-
\??\c:\vjpvv.exec:\vjpvv.exe74⤵PID:2700
-
\??\c:\dpvjd.exec:\dpvjd.exe75⤵PID:2744
-
\??\c:\9xllrrr.exec:\9xllrrr.exe76⤵PID:2596
-
\??\c:\frxrxxf.exec:\frxrxxf.exe77⤵PID:2752
-
\??\c:\lxxxxxr.exec:\lxxxxxr.exe78⤵PID:2244
-
\??\c:\3htntn.exec:\3htntn.exe79⤵PID:2536
-
\??\c:\hbhbhh.exec:\hbhbhh.exe80⤵PID:1576
-
\??\c:\tbnnbt.exec:\tbnnbt.exe81⤵PID:2600
-
\??\c:\jvjdd.exec:\jvjdd.exe82⤵PID:1712
-
\??\c:\3pjdv.exec:\3pjdv.exe83⤵PID:900
-
\??\c:\xlrllll.exec:\xlrllll.exe84⤵PID:2732
-
\??\c:\lrxxllf.exec:\lrxxllf.exe85⤵PID:952
-
\??\c:\nntnnh.exec:\nntnnh.exe86⤵PID:2540
-
\??\c:\bnbttt.exec:\bnbttt.exe87⤵PID:1720
-
\??\c:\vdjdd.exec:\vdjdd.exe88⤵PID:1272
-
\??\c:\lxxxrrf.exec:\lxxxrrf.exe89⤵PID:936
-
\??\c:\rfxxxxf.exec:\rfxxxxf.exe90⤵PID:1904
-
\??\c:\jvdvv.exec:\jvdvv.exe91⤵PID:2708
-
\??\c:\rlxrfff.exec:\rlxrfff.exe92⤵PID:2976
-
\??\c:\ttthtb.exec:\ttthtb.exe93⤵PID:2948
-
\??\c:\pdpdd.exec:\pdpdd.exe94⤵PID:1580
-
\??\c:\3llrfrr.exec:\3llrfrr.exe95⤵PID:1656
-
\??\c:\htbtbt.exec:\htbtbt.exe96⤵PID:1124
-
\??\c:\jvvvj.exec:\jvvvj.exe97⤵PID:976
-
\??\c:\lxfxxll.exec:\lxfxxll.exe98⤵PID:832
-
\??\c:\jvjjp.exec:\jvjjp.exe99⤵PID:452
-
\??\c:\xlrfxfr.exec:\xlrfxfr.exe100⤵PID:1964
-
\??\c:\3nbbbh.exec:\3nbbbh.exe101⤵PID:1616
-
\??\c:\jdjpp.exec:\jdjpp.exe102⤵PID:2320
-
\??\c:\ddvdd.exec:\ddvdd.exe103⤵PID:2324
-
\??\c:\9xfrrlx.exec:\9xfrrlx.exe104⤵PID:1512
-
\??\c:\jvvpp.exec:\jvvpp.exe105⤵PID:2116
-
\??\c:\pdjjj.exec:\pdjjj.exe106⤵PID:1744
-
\??\c:\nhtnnn.exec:\nhtnnn.exe107⤵PID:2304
-
\??\c:\thbbht.exec:\thbbht.exe108⤵PID:1752
-
\??\c:\dpdvd.exec:\dpdvd.exe109⤵PID:3016
-
\??\c:\vjvdd.exec:\vjvdd.exe110⤵PID:1468
-
\??\c:\xlrrlff.exec:\xlrrlff.exe111⤵PID:1336
-
\??\c:\xllffxf.exec:\xllffxf.exe112⤵PID:2728
-
\??\c:\9ntthb.exec:\9ntthb.exe113⤵PID:1080
-
\??\c:\hnthnn.exec:\hnthnn.exe114⤵PID:2588
-
\??\c:\vddvp.exec:\vddvp.exe115⤵PID:2700
-
\??\c:\djjjd.exec:\djjjd.exe116⤵PID:2744
-
\??\c:\lxxlrrx.exec:\lxxlrrx.exe117⤵PID:2648
-
\??\c:\frxxffl.exec:\frxxffl.exe118⤵PID:2512
-
\??\c:\thhbtn.exec:\thhbtn.exe119⤵PID:2480
-
\??\c:\hnbttn.exec:\hnbttn.exe120⤵PID:956
-
\??\c:\vjpvv.exec:\vjpvv.exe121⤵PID:2256
-
\??\c:\dpddd.exec:\dpddd.exe122⤵PID:2476
-
\??\c:\3flrrrr.exec:\3flrrrr.exe123⤵PID:2188
-
\??\c:\5lfffll.exec:\5lfffll.exe124⤵PID:320
-
\??\c:\nhtbbh.exec:\nhtbbh.exe125⤵PID:616
-
\??\c:\btbhbt.exec:\btbhbt.exe126⤵PID:1276
-
\??\c:\ddjjj.exec:\ddjjj.exe127⤵PID:2216
-
\??\c:\1vpvj.exec:\1vpvj.exe128⤵PID:2548
-
\??\c:\frxrxxl.exec:\frxrxxl.exe129⤵PID:2508
-
\??\c:\lxfrxlr.exec:\lxfrxlr.exe130⤵PID:2624
-
\??\c:\rlffllr.exec:\rlffllr.exe131⤵PID:1628
-
\??\c:\tnbtbt.exec:\tnbtbt.exe132⤵PID:1076
-
\??\c:\hbnttt.exec:\hbnttt.exe133⤵PID:1648
-
\??\c:\vpddd.exec:\vpddd.exe134⤵PID:2976
-
\??\c:\pjvjd.exec:\pjvjd.exe135⤵PID:2300
-
\??\c:\3fxffff.exec:\3fxffff.exe136⤵PID:2516
-
\??\c:\xlrrlrl.exec:\xlrrlrl.exe137⤵PID:2096
-
\??\c:\tbhntn.exec:\tbhntn.exe138⤵PID:2312
-
\??\c:\9nhbhb.exec:\9nhbhb.exe139⤵PID:1328
-
\??\c:\dpvpd.exec:\dpvpd.exe140⤵PID:1816
-
\??\c:\vdpjj.exec:\vdpjj.exe141⤵PID:1228
-
\??\c:\9rrrxfl.exec:\9rrrxfl.exe142⤵PID:2444
-
\??\c:\fxlrxxl.exec:\fxlrxxl.exe143⤵PID:2208
-
\??\c:\thnhbt.exec:\thnhbt.exe144⤵PID:2956
-
\??\c:\nthttn.exec:\nthttn.exe145⤵PID:3020
-
\??\c:\pdpjj.exec:\pdpjj.exe146⤵PID:2116
-
\??\c:\dpvvv.exec:\dpvvv.exe147⤵PID:2356
-
\??\c:\9lrlrlr.exec:\9lrlrlr.exe148⤵PID:2128
-
\??\c:\frfflfr.exec:\frfflfr.exe149⤵PID:2564
-
\??\c:\3flllfl.exec:\3flllfl.exe150⤵PID:2012
-
\??\c:\ttbnnt.exec:\ttbnnt.exe151⤵PID:2180
-
\??\c:\bthnbt.exec:\bthnbt.exe152⤵PID:1596
-
\??\c:\djdjd.exec:\djdjd.exe153⤵PID:3004
-
\??\c:\jdppv.exec:\jdppv.exe154⤵PID:2692
-
\??\c:\rflrxff.exec:\rflrxff.exe155⤵PID:2680
-
\??\c:\lxxrrlf.exec:\lxxrrlf.exe156⤵PID:2884
-
\??\c:\5ttnnt.exec:\5ttnnt.exe157⤵PID:2840
-
\??\c:\bnbbhh.exec:\bnbbhh.exe158⤵PID:3048
-
\??\c:\dvdvd.exec:\dvdvd.exe159⤵PID:1196
-
\??\c:\3djpj.exec:\3djpj.exe160⤵PID:1620
-
\??\c:\5lxrrrf.exec:\5lxrrrf.exe161⤵PID:2572
-
\??\c:\lfrrxrx.exec:\lfrrxrx.exe162⤵PID:1576
-
\??\c:\nhttnh.exec:\nhttnh.exe163⤵PID:2284
-
\??\c:\tntnnb.exec:\tntnnb.exe164⤵PID:2764
-
\??\c:\9pdjd.exec:\9pdjd.exe165⤵PID:2360
-
\??\c:\pdvvv.exec:\pdvvv.exe166⤵PID:1908
-
\??\c:\jdpdd.exec:\jdpdd.exe167⤵PID:1268
-
\??\c:\5lxxxrr.exec:\5lxxxrr.exe168⤵PID:952
-
\??\c:\hbnnnh.exec:\hbnnnh.exe169⤵PID:2804
-
\??\c:\7hnttt.exec:\7hnttt.exe170⤵PID:2612
-
\??\c:\7dppd.exec:\7dppd.exe171⤵PID:2580
-
\??\c:\vvdpd.exec:\vvdpd.exe172⤵PID:2940
-
\??\c:\xlllfxf.exec:\xlllfxf.exe173⤵PID:1524
-
\??\c:\1lxrxrx.exec:\1lxrxrx.exe174⤵PID:2072
-
\??\c:\tnhbtb.exec:\tnhbtb.exe175⤵PID:1764
-
\??\c:\9nbbtt.exec:\9nbbtt.exe176⤵PID:1880
-
\??\c:\5dppp.exec:\5dppp.exe177⤵PID:2416
-
\??\c:\7vjpp.exec:\7vjpp.exe178⤵PID:596
-
\??\c:\1lrflxf.exec:\1lrflxf.exe179⤵PID:976
-
\??\c:\1rrllfl.exec:\1rrllfl.exe180⤵PID:852
-
\??\c:\hnnhnh.exec:\hnnhnh.exe181⤵PID:452
-
\??\c:\nbbnth.exec:\nbbnth.exe182⤵PID:1244
-
\??\c:\hhtttn.exec:\hhtttn.exe183⤵PID:1684
-
\??\c:\5jvdd.exec:\5jvdd.exe184⤵PID:2184
-
\??\c:\jvpjv.exec:\jvpjv.exe185⤵PID:2324
-
\??\c:\rflrlrr.exec:\rflrlrr.exe186⤵PID:3064
-
\??\c:\7frrffl.exec:\7frrffl.exe187⤵PID:2436
-
\??\c:\bnbbhh.exec:\bnbbhh.exe188⤵PID:2228
-
\??\c:\nbnnbt.exec:\nbnnbt.exe189⤵PID:2008
-
\??\c:\nbhhbt.exec:\nbhhbt.exe190⤵PID:2396
-
\??\c:\vdpdv.exec:\vdpdv.exe191⤵PID:1520
-
\??\c:\7jvvd.exec:\7jvvd.exe192⤵PID:2032
-
\??\c:\xlfxrxx.exec:\xlfxrxx.exe193⤵PID:1472
-
\??\c:\1rffffl.exec:\1rffffl.exe194⤵PID:2660
-
\??\c:\tbnbtn.exec:\tbnbtn.exe195⤵PID:2608
-
\??\c:\1tbtbt.exec:\1tbtbt.exe196⤵PID:2140
-
\??\c:\vjpjp.exec:\vjpjp.exe197⤵PID:1396
-
\??\c:\dvjdv.exec:\dvjdv.exe198⤵PID:2596
-
\??\c:\frxrlfl.exec:\frxrlfl.exe199⤵PID:1660
-
\??\c:\1xlrxrr.exec:\1xlrxrr.exe200⤵PID:2244
-
\??\c:\9tnhnh.exec:\9tnhnh.exe201⤵PID:2504
-
\??\c:\tnhbtb.exec:\tnhbtb.exe202⤵PID:2200
-
\??\c:\tnnttt.exec:\tnnttt.exe203⤵PID:940
-
\??\c:\dvddd.exec:\dvddd.exe204⤵PID:1220
-
\??\c:\pdvjp.exec:\pdvjp.exe205⤵PID:2668
-
\??\c:\lxrlrxf.exec:\lxrlrxf.exe206⤵PID:1348
-
\??\c:\lxlllxf.exec:\lxlllxf.exe207⤵PID:2368
-
\??\c:\hthbtn.exec:\hthbtn.exe208⤵PID:1884
-
\??\c:\7ntnnn.exec:\7ntnnn.exe209⤵PID:2552
-
\??\c:\pdppp.exec:\pdppp.exe210⤵PID:1224
-
\??\c:\7lrrflr.exec:\7lrrflr.exe211⤵PID:2788
-
\??\c:\frfxfxx.exec:\frfxfxx.exe212⤵PID:1736
-
\??\c:\fllxlrf.exec:\fllxlrf.exe213⤵PID:2316
-
\??\c:\9httbt.exec:\9httbt.exe214⤵PID:1076
-
\??\c:\7thbbb.exec:\7thbbb.exe215⤵PID:2156
-
\??\c:\dpvpp.exec:\dpvpp.exe216⤵PID:2132
-
\??\c:\rlxrxrr.exec:\rlxrxrr.exe217⤵PID:488
-
\??\c:\bhhhnh.exec:\bhhhnh.exe218⤵PID:2516
-
\??\c:\htttbb.exec:\htttbb.exe219⤵PID:2664
-
\??\c:\bnnhbb.exec:\bnnhbb.exe220⤵PID:2088
-
\??\c:\jvjjj.exec:\jvjjj.exe221⤵PID:1328
-
\??\c:\dpddp.exec:\dpddp.exe222⤵PID:2424
-
\??\c:\rfrrflr.exec:\rfrrflr.exe223⤵PID:2328
-
\??\c:\xlrlrfl.exec:\xlrlrfl.exe224⤵PID:1192
-
\??\c:\1thbbb.exec:\1thbbb.exe225⤵PID:1164
-
\??\c:\tbhbbb.exec:\tbhbbb.exe226⤵PID:1676
-
\??\c:\jvdvv.exec:\jvdvv.exe227⤵PID:1016
-
\??\c:\vvdjv.exec:\vvdjv.exe228⤵PID:2928
-
\??\c:\7xxxfrr.exec:\7xxxfrr.exe229⤵PID:2148
-
\??\c:\xrrrfff.exec:\xrrrfff.exe230⤵PID:2044
-
\??\c:\9nbbtb.exec:\9nbbtb.exe231⤵PID:1972
-
\??\c:\hhbhnt.exec:\hhbhnt.exe232⤵PID:2944
-
\??\c:\5ddjp.exec:\5ddjp.exe233⤵PID:2236
-
\??\c:\jvvdj.exec:\jvvdj.exe234⤵PID:760
-
\??\c:\9lxxfff.exec:\9lxxfff.exe235⤵PID:1604
-
\??\c:\fxfllll.exec:\fxfllll.exe236⤵PID:2772
-
\??\c:\hhtbhn.exec:\hhtbhn.exe237⤵PID:2640
-
\??\c:\ttbbnt.exec:\ttbbnt.exe238⤵PID:2868
-
\??\c:\5dvdp.exec:\5dvdp.exe239⤵PID:2492
-
\??\c:\vjvdd.exec:\vjvdd.exe240⤵PID:2520
-
\??\c:\lfrxflr.exec:\lfrxflr.exe241⤵PID:2484
-
\??\c:\fxrfllr.exec:\fxrfllr.exe242⤵PID:2192