Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 14:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d1c47fc558fe02d5330c3e87b01ad8d0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
d1c47fc558fe02d5330c3e87b01ad8d0_NeikiAnalytics.exe
-
Size
387KB
-
MD5
d1c47fc558fe02d5330c3e87b01ad8d0
-
SHA1
bf2fa577a27ecaeb12e05418bd497cb456a17f6c
-
SHA256
805d03d1a99a61954bfb8e80ba22f4b49bda9e07d708d38c39aaa84bafa135c3
-
SHA512
f82a1a5dc1f12f5fb0ec67407f6f2a4a8720b9d7f3b1201b783ec57634b13fad212dec5ebc7920032efb27046c652324ff85324ff2a9e16017d1d68591bab0a4
-
SSDEEP
12288:n3C9ytvngQjpUXoSWlnwJv90aKToFqwf1:SgdnJVU4TlnwJ6GoI
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/1280-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1924-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2968-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2308-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1256-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1752-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/548-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/912-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1724-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
dvjpv.exe3rxxxxr.exehbnbnb.exe5rfrfrx.exe1pvpp.exehbtbnt.exeddvdp.exehbtbhh.exe3pjpv.exexrllxrf.exehbtbhh.exedvdjv.exe7xlfllr.exehtbttn.exefxllffr.exenhtbhn.exevpjpd.exe5rffrrr.exetnbntt.exevvjpv.exe9rxrrrx.exenbbnnn.exejdppv.exe9lxffxf.exeppdpv.exe5xllrxl.exeddvdv.exe9rllflx.exehbtbnt.exedvjvp.exe1hbhhh.exepjddp.exenbtthn.exe9djpv.exe9xlrffr.exefxrxlrf.exebthnbb.exedpdvd.exexlxxxfr.exe7fxlflr.exebbtbtb.exeddvdd.exexxrrxxx.exe5frxrxx.exe7htnhb.exe3ppdj.exe7lxrffr.exexxfllfx.exennbthn.exevdvdj.exe5jjjd.exelfrrxxf.exe3thhnn.exenhbbbb.exejvjvd.exe1rllxrf.exe7nhntb.exehhbbnn.exevpjpp.exelrlflxl.exe1xlrxfl.exetbtbnn.exevjpjj.exevpddj.exepid process 2124 dvjpv.exe 3032 3rxxxxr.exe 2600 hbnbnb.exe 2648 5rfrfrx.exe 2764 1pvpp.exe 2520 hbtbnt.exe 2516 ddvdp.exe 2772 hbtbhh.exe 1924 3pjpv.exe 2748 xrllxrf.exe 2920 hbtbhh.exe 2968 dvdjv.exe 2308 7xlfllr.exe 1820 htbttn.exe 2044 fxllffr.exe 1256 nhtbhn.exe 2584 vpjpd.exe 1748 5rffrrr.exe 1752 tnbntt.exe 1600 vvjpv.exe 1776 9rxrrrx.exe 2264 nbbnnn.exe 548 jdppv.exe 1108 9lxffxf.exe 1276 ppdpv.exe 2372 5xllrxl.exe 912 ddvdv.exe 2220 9rllflx.exe 1724 hbtbnt.exe 2900 dvjvp.exe 1620 1hbhhh.exe 2984 pjddp.exe 1680 nbtthn.exe 3068 9djpv.exe 2680 9xlrffr.exe 2712 fxrxlrf.exe 2848 bthnbb.exe 2644 dpdvd.exe 2816 xlxxxfr.exe 2544 7fxlflr.exe 2508 bbtbtb.exe 2192 ddvdd.exe 1524 xxrrxxx.exe 1220 5frxrxx.exe 2904 7htnhb.exe 2932 3ppdj.exe 2920 7lxrffr.exe 564 xxfllfx.exe 2024 nnbthn.exe 1976 vdvdj.exe 1608 5jjjd.exe 2044 lfrrxxf.exe 316 3thhnn.exe 2564 nhbbbb.exe 236 jvjvd.exe 2252 1rllxrf.exe 2268 7nhntb.exe 1988 hhbbnn.exe 1780 vpjpp.exe 672 lrlflxl.exe 1040 1xlrxfl.exe 580 tbtbnn.exe 2872 vjpjj.exe 304 vpddj.exe -
Processes:
resource yara_rule behavioral1/memory/1280-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2308-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1256-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/548-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/912-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1724-279-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d1c47fc558fe02d5330c3e87b01ad8d0_NeikiAnalytics.exedvjpv.exe3rxxxxr.exehbnbnb.exe5rfrfrx.exe1pvpp.exehbtbnt.exeddvdp.exehbtbhh.exe3pjpv.exexrllxrf.exehbtbhh.exedvdjv.exe7xlfllr.exehtbttn.exefxllffr.exedescription pid process target process PID 1280 wrote to memory of 2124 1280 d1c47fc558fe02d5330c3e87b01ad8d0_NeikiAnalytics.exe dvjpv.exe PID 1280 wrote to memory of 2124 1280 d1c47fc558fe02d5330c3e87b01ad8d0_NeikiAnalytics.exe dvjpv.exe PID 1280 wrote to memory of 2124 1280 d1c47fc558fe02d5330c3e87b01ad8d0_NeikiAnalytics.exe dvjpv.exe PID 1280 wrote to memory of 2124 1280 d1c47fc558fe02d5330c3e87b01ad8d0_NeikiAnalytics.exe dvjpv.exe PID 2124 wrote to memory of 3032 2124 dvjpv.exe 3rxxxxr.exe PID 2124 wrote to memory of 3032 2124 dvjpv.exe 3rxxxxr.exe PID 2124 wrote to memory of 3032 2124 dvjpv.exe 3rxxxxr.exe PID 2124 wrote to memory of 3032 2124 dvjpv.exe 3rxxxxr.exe PID 3032 wrote to memory of 2600 3032 3rxxxxr.exe hbnbnb.exe PID 3032 wrote to memory of 2600 3032 3rxxxxr.exe hbnbnb.exe PID 3032 wrote to memory of 2600 3032 3rxxxxr.exe hbnbnb.exe PID 3032 wrote to memory of 2600 3032 3rxxxxr.exe hbnbnb.exe PID 2600 wrote to memory of 2648 2600 hbnbnb.exe 5rfrfrx.exe PID 2600 wrote to memory of 2648 2600 hbnbnb.exe 5rfrfrx.exe PID 2600 wrote to memory of 2648 2600 hbnbnb.exe 5rfrfrx.exe PID 2600 wrote to memory of 2648 2600 hbnbnb.exe 5rfrfrx.exe PID 2648 wrote to memory of 2764 2648 5rfrfrx.exe 1pvpp.exe PID 2648 wrote to memory of 2764 2648 5rfrfrx.exe 1pvpp.exe PID 2648 wrote to memory of 2764 2648 5rfrfrx.exe 1pvpp.exe PID 2648 wrote to memory of 2764 2648 5rfrfrx.exe 1pvpp.exe PID 2764 wrote to memory of 2520 2764 1pvpp.exe hbtbnt.exe PID 2764 wrote to memory of 2520 2764 1pvpp.exe hbtbnt.exe PID 2764 wrote to memory of 2520 2764 1pvpp.exe hbtbnt.exe PID 2764 wrote to memory of 2520 2764 1pvpp.exe hbtbnt.exe PID 2520 wrote to memory of 2516 2520 hbtbnt.exe ddvdp.exe PID 2520 wrote to memory of 2516 2520 hbtbnt.exe ddvdp.exe PID 2520 wrote to memory of 2516 2520 hbtbnt.exe ddvdp.exe PID 2520 wrote to memory of 2516 2520 hbtbnt.exe ddvdp.exe PID 2516 wrote to memory of 2772 2516 ddvdp.exe hbtbhh.exe PID 2516 wrote to memory of 2772 2516 ddvdp.exe hbtbhh.exe PID 2516 wrote to memory of 2772 2516 ddvdp.exe hbtbhh.exe PID 2516 wrote to memory of 2772 2516 ddvdp.exe hbtbhh.exe PID 2772 wrote to memory of 1924 2772 hbtbhh.exe 3pjpv.exe PID 2772 wrote to memory of 1924 2772 hbtbhh.exe 3pjpv.exe PID 2772 wrote to memory of 1924 2772 hbtbhh.exe 3pjpv.exe PID 2772 wrote to memory of 1924 2772 hbtbhh.exe 3pjpv.exe PID 1924 wrote to memory of 2748 1924 3pjpv.exe xrllxrf.exe PID 1924 wrote to memory of 2748 1924 3pjpv.exe xrllxrf.exe PID 1924 wrote to memory of 2748 1924 3pjpv.exe xrllxrf.exe PID 1924 wrote to memory of 2748 1924 3pjpv.exe xrllxrf.exe PID 2748 wrote to memory of 2920 2748 xrllxrf.exe hbtbhh.exe PID 2748 wrote to memory of 2920 2748 xrllxrf.exe hbtbhh.exe PID 2748 wrote to memory of 2920 2748 xrllxrf.exe hbtbhh.exe PID 2748 wrote to memory of 2920 2748 xrllxrf.exe hbtbhh.exe PID 2920 wrote to memory of 2968 2920 hbtbhh.exe dvdjv.exe PID 2920 wrote to memory of 2968 2920 hbtbhh.exe dvdjv.exe PID 2920 wrote to memory of 2968 2920 hbtbhh.exe dvdjv.exe PID 2920 wrote to memory of 2968 2920 hbtbhh.exe dvdjv.exe PID 2968 wrote to memory of 2308 2968 dvdjv.exe 7xlfllr.exe PID 2968 wrote to memory of 2308 2968 dvdjv.exe 7xlfllr.exe PID 2968 wrote to memory of 2308 2968 dvdjv.exe 7xlfllr.exe PID 2968 wrote to memory of 2308 2968 dvdjv.exe 7xlfllr.exe PID 2308 wrote to memory of 1820 2308 7xlfllr.exe htbttn.exe PID 2308 wrote to memory of 1820 2308 7xlfllr.exe htbttn.exe PID 2308 wrote to memory of 1820 2308 7xlfllr.exe htbttn.exe PID 2308 wrote to memory of 1820 2308 7xlfllr.exe htbttn.exe PID 1820 wrote to memory of 2044 1820 htbttn.exe fxllffr.exe PID 1820 wrote to memory of 2044 1820 htbttn.exe fxllffr.exe PID 1820 wrote to memory of 2044 1820 htbttn.exe fxllffr.exe PID 1820 wrote to memory of 2044 1820 htbttn.exe fxllffr.exe PID 2044 wrote to memory of 1256 2044 fxllffr.exe nhtbhn.exe PID 2044 wrote to memory of 1256 2044 fxllffr.exe nhtbhn.exe PID 2044 wrote to memory of 1256 2044 fxllffr.exe nhtbhn.exe PID 2044 wrote to memory of 1256 2044 fxllffr.exe nhtbhn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1c47fc558fe02d5330c3e87b01ad8d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d1c47fc558fe02d5330c3e87b01ad8d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\dvjpv.exec:\dvjpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\3rxxxxr.exec:\3rxxxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\hbnbnb.exec:\hbnbnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\5rfrfrx.exec:\5rfrfrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\1pvpp.exec:\1pvpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\hbtbnt.exec:\hbtbnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\ddvdp.exec:\ddvdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\hbtbhh.exec:\hbtbhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\3pjpv.exec:\3pjpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\xrllxrf.exec:\xrllxrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\hbtbhh.exec:\hbtbhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\dvdjv.exec:\dvdjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\7xlfllr.exec:\7xlfllr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\htbttn.exec:\htbttn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\fxllffr.exec:\fxllffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\nhtbhn.exec:\nhtbhn.exe17⤵
- Executes dropped EXE
PID:1256 -
\??\c:\vpjpd.exec:\vpjpd.exe18⤵
- Executes dropped EXE
PID:2584 -
\??\c:\5rffrrr.exec:\5rffrrr.exe19⤵
- Executes dropped EXE
PID:1748 -
\??\c:\tnbntt.exec:\tnbntt.exe20⤵
- Executes dropped EXE
PID:1752 -
\??\c:\vvjpv.exec:\vvjpv.exe21⤵
- Executes dropped EXE
PID:1600 -
\??\c:\9rxrrrx.exec:\9rxrrrx.exe22⤵
- Executes dropped EXE
PID:1776 -
\??\c:\nbbnnn.exec:\nbbnnn.exe23⤵
- Executes dropped EXE
PID:2264 -
\??\c:\jdppv.exec:\jdppv.exe24⤵
- Executes dropped EXE
PID:548 -
\??\c:\9lxffxf.exec:\9lxffxf.exe25⤵
- Executes dropped EXE
PID:1108 -
\??\c:\ppdpv.exec:\ppdpv.exe26⤵
- Executes dropped EXE
PID:1276 -
\??\c:\5xllrxl.exec:\5xllrxl.exe27⤵
- Executes dropped EXE
PID:2372 -
\??\c:\ddvdv.exec:\ddvdv.exe28⤵
- Executes dropped EXE
PID:912 -
\??\c:\9rllflx.exec:\9rllflx.exe29⤵
- Executes dropped EXE
PID:2220 -
\??\c:\hbtbnt.exec:\hbtbnt.exe30⤵
- Executes dropped EXE
PID:1724 -
\??\c:\dvjvp.exec:\dvjvp.exe31⤵
- Executes dropped EXE
PID:2900 -
\??\c:\1hbhhh.exec:\1hbhhh.exe32⤵
- Executes dropped EXE
PID:1620 -
\??\c:\pjddp.exec:\pjddp.exe33⤵
- Executes dropped EXE
PID:2984 -
\??\c:\5xxxfxf.exec:\5xxxfxf.exe34⤵PID:2332
-
\??\c:\nbtthn.exec:\nbtthn.exe35⤵
- Executes dropped EXE
PID:1680 -
\??\c:\9djpv.exec:\9djpv.exe36⤵
- Executes dropped EXE
PID:3068 -
\??\c:\9xlrffr.exec:\9xlrffr.exe37⤵
- Executes dropped EXE
PID:2680 -
\??\c:\fxrxlrf.exec:\fxrxlrf.exe38⤵
- Executes dropped EXE
PID:2712 -
\??\c:\bthnbb.exec:\bthnbb.exe39⤵
- Executes dropped EXE
PID:2848 -
\??\c:\dpdvd.exec:\dpdvd.exe40⤵
- Executes dropped EXE
PID:2644 -
\??\c:\xlxxxfr.exec:\xlxxxfr.exe41⤵
- Executes dropped EXE
PID:2816 -
\??\c:\7fxlflr.exec:\7fxlflr.exe42⤵
- Executes dropped EXE
PID:2544 -
\??\c:\bbtbtb.exec:\bbtbtb.exe43⤵
- Executes dropped EXE
PID:2508 -
\??\c:\ddvdd.exec:\ddvdd.exe44⤵
- Executes dropped EXE
PID:2192 -
\??\c:\xxrrxxx.exec:\xxrrxxx.exe45⤵
- Executes dropped EXE
PID:1524 -
\??\c:\5frxrxx.exec:\5frxrxx.exe46⤵
- Executes dropped EXE
PID:1220 -
\??\c:\7htnhb.exec:\7htnhb.exe47⤵
- Executes dropped EXE
PID:2904 -
\??\c:\3ppdj.exec:\3ppdj.exe48⤵
- Executes dropped EXE
PID:2932 -
\??\c:\7lxrffr.exec:\7lxrffr.exe49⤵
- Executes dropped EXE
PID:2920 -
\??\c:\xxfllfx.exec:\xxfllfx.exe50⤵
- Executes dropped EXE
PID:564 -
\??\c:\nnbthn.exec:\nnbthn.exe51⤵
- Executes dropped EXE
PID:2024 -
\??\c:\vdvdj.exec:\vdvdj.exe52⤵
- Executes dropped EXE
PID:1976 -
\??\c:\5jjjd.exec:\5jjjd.exe53⤵
- Executes dropped EXE
PID:1608 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe54⤵
- Executes dropped EXE
PID:2044 -
\??\c:\3thhnn.exec:\3thhnn.exe55⤵
- Executes dropped EXE
PID:316 -
\??\c:\nhbbbb.exec:\nhbbbb.exe56⤵
- Executes dropped EXE
PID:2564 -
\??\c:\jvjvd.exec:\jvjvd.exe57⤵
- Executes dropped EXE
PID:236 -
\??\c:\1rllxrf.exec:\1rllxrf.exe58⤵
- Executes dropped EXE
PID:2252 -
\??\c:\7nhntb.exec:\7nhntb.exe59⤵
- Executes dropped EXE
PID:2268 -
\??\c:\hhbbnn.exec:\hhbbnn.exe60⤵
- Executes dropped EXE
PID:1988 -
\??\c:\vpjpp.exec:\vpjpp.exe61⤵
- Executes dropped EXE
PID:1780 -
\??\c:\lrlflxl.exec:\lrlflxl.exe62⤵
- Executes dropped EXE
PID:672 -
\??\c:\1xlrxfl.exec:\1xlrxfl.exe63⤵
- Executes dropped EXE
PID:1040 -
\??\c:\tbtbnn.exec:\tbtbnn.exe64⤵
- Executes dropped EXE
PID:580 -
\??\c:\vjpjj.exec:\vjpjj.exe65⤵
- Executes dropped EXE
PID:2872 -
\??\c:\vpddj.exec:\vpddj.exe66⤵
- Executes dropped EXE
PID:304 -
\??\c:\rlxxffr.exec:\rlxxffr.exe67⤵PID:1948
-
\??\c:\7thnnt.exec:\7thnnt.exe68⤵PID:2224
-
\??\c:\vpdjv.exec:\vpdjv.exe69⤵PID:1800
-
\??\c:\5djdd.exec:\5djdd.exe70⤵PID:1340
-
\??\c:\llrrxxl.exec:\llrrxxl.exe71⤵PID:2908
-
\??\c:\bhbtht.exec:\bhbtht.exe72⤵PID:1448
-
\??\c:\jjppj.exec:\jjppj.exe73⤵PID:3000
-
\??\c:\1jddp.exec:\1jddp.exe74⤵PID:2128
-
\??\c:\3xlflrx.exec:\3xlflrx.exe75⤵PID:2008
-
\??\c:\httthh.exec:\httthh.exe76⤵PID:2588
-
\??\c:\1nntnt.exec:\1nntnt.exe77⤵PID:2356
-
\??\c:\1dpjj.exec:\1dpjj.exe78⤵PID:2716
-
\??\c:\pdvdd.exec:\pdvdd.exe79⤵PID:2736
-
\??\c:\rlflrrx.exec:\rlflrrx.exe80⤵PID:2504
-
\??\c:\nhtttb.exec:\nhtttb.exe81⤵PID:1712
-
\??\c:\bnhhhb.exec:\bnhhhb.exe82⤵PID:2752
-
\??\c:\jdvdp.exec:\jdvdp.exe83⤵PID:2496
-
\??\c:\fxrrxxf.exec:\fxrrxxf.exe84⤵PID:2560
-
\??\c:\xrrfllx.exec:\xrrfllx.exe85⤵PID:1808
-
\??\c:\nhttnt.exec:\nhttnt.exe86⤵PID:2192
-
\??\c:\vjddd.exec:\vjddd.exe87⤵PID:2780
-
\??\c:\ddpvd.exec:\ddpvd.exe88⤵PID:2828
-
\??\c:\llxxflr.exec:\llxxflr.exe89⤵PID:2964
-
\??\c:\nbnntb.exec:\nbnntb.exe90⤵PID:2348
-
\??\c:\hbtthh.exec:\hbtthh.exe91⤵PID:1984
-
\??\c:\dvpvd.exec:\dvpvd.exe92⤵PID:2392
-
\??\c:\9dvdj.exec:\9dvdj.exe93⤵PID:1128
-
\??\c:\1frllrr.exec:\1frllrr.exe94⤵PID:2304
-
\??\c:\nthhnn.exec:\nthhnn.exe95⤵PID:1444
-
\??\c:\tbttbb.exec:\tbttbb.exe96⤵PID:2416
-
\??\c:\pjpvd.exec:\pjpvd.exe97⤵PID:1720
-
\??\c:\ddpvv.exec:\ddpvv.exe98⤵PID:2244
-
\??\c:\fxlrxxl.exec:\fxlrxxl.exe99⤵PID:2260
-
\??\c:\5htttb.exec:\5htttb.exe100⤵PID:2688
-
\??\c:\hbtbhn.exec:\hbtbhn.exe101⤵PID:2172
-
\??\c:\vppdv.exec:\vppdv.exe102⤵PID:2108
-
\??\c:\dvppp.exec:\dvppp.exe103⤵PID:2264
-
\??\c:\fxrrffl.exec:\fxrrffl.exe104⤵PID:548
-
\??\c:\ntntnh.exec:\ntntnh.exe105⤵PID:1252
-
\??\c:\vdvjv.exec:\vdvjv.exe106⤵PID:2456
-
\??\c:\ddvjp.exec:\ddvjp.exe107⤵PID:1848
-
\??\c:\rlflrrx.exec:\rlflrrx.exe108⤵PID:1392
-
\??\c:\3rllxfr.exec:\3rllxfr.exe109⤵PID:2296
-
\??\c:\nhntbh.exec:\nhntbh.exe110⤵PID:2168
-
\??\c:\jdjvd.exec:\jdjvd.exe111⤵PID:2000
-
\??\c:\7jvjv.exec:\7jvjv.exe112⤵PID:2156
-
\??\c:\rlxflrf.exec:\rlxflrf.exe113⤵PID:992
-
\??\c:\hthntb.exec:\hthntb.exe114⤵PID:3024
-
\??\c:\9bbbth.exec:\9bbbth.exe115⤵PID:3048
-
\??\c:\ppdpd.exec:\ppdpd.exe116⤵PID:3044
-
\??\c:\lflffxx.exec:\lflffxx.exe117⤵PID:2140
-
\??\c:\ffrxfxl.exec:\ffrxfxl.exe118⤵PID:2700
-
\??\c:\nhtbnn.exec:\nhtbnn.exe119⤵PID:2696
-
\??\c:\pdjvd.exec:\pdjvd.exe120⤵PID:2620
-
\??\c:\vvvdp.exec:\vvvdp.exe121⤵PID:2784
-
\??\c:\1frfffr.exec:\1frfffr.exe122⤵PID:2756
-
\??\c:\3thhnh.exec:\3thhnh.exe123⤵PID:1712
-
\??\c:\ttbbhh.exec:\ttbbhh.exe124⤵PID:2752
-
\??\c:\pjdjp.exec:\pjdjp.exe125⤵PID:2496
-
\??\c:\rlfflrl.exec:\rlfflrl.exe126⤵PID:2320
-
\??\c:\rxrrfxl.exec:\rxrrfxl.exe127⤵PID:1676
-
\??\c:\1nnnbh.exec:\1nnnbh.exe128⤵PID:1924
-
\??\c:\hbthnh.exec:\hbthnh.exe129⤵PID:2804
-
\??\c:\jpdjp.exec:\jpdjp.exe130⤵PID:2928
-
\??\c:\xrrrrrf.exec:\xrrrrrf.exe131⤵PID:328
-
\??\c:\lfrrxxl.exec:\lfrrxxl.exe132⤵PID:2472
-
\??\c:\3nbhhh.exec:\3nbhhh.exe133⤵PID:1624
-
\??\c:\9jddj.exec:\9jddj.exe134⤵PID:1092
-
\??\c:\rlxrxfl.exec:\rlxrxfl.exe135⤵PID:1292
-
\??\c:\tnbbht.exec:\tnbbht.exe136⤵PID:1912
-
\??\c:\vppjv.exec:\vppjv.exe137⤵PID:1260
-
\??\c:\jjdjp.exec:\jjdjp.exe138⤵PID:2584
-
\??\c:\thbtbh.exec:\thbtbh.exe139⤵PID:1652
-
\??\c:\1vpdd.exec:\1vpdd.exe140⤵PID:2800
-
\??\c:\5dvdj.exec:\5dvdj.exe141⤵PID:1904
-
\??\c:\5xfrrrr.exec:\5xfrrrr.exe142⤵PID:1644
-
\??\c:\3nhhnt.exec:\3nhhnt.exe143⤵PID:596
-
\??\c:\nnhntt.exec:\nnhntt.exe144⤵PID:320
-
\??\c:\9jjpp.exec:\9jjpp.exe145⤵PID:2448
-
\??\c:\7dvvj.exec:\7dvvj.exe146⤵PID:2444
-
\??\c:\xlffrxf.exec:\xlffrxf.exe147⤵PID:1348
-
\??\c:\hthhnh.exec:\hthhnh.exe148⤵PID:1936
-
\??\c:\nbhnnt.exec:\nbhnnt.exe149⤵PID:948
-
\??\c:\3pjpv.exec:\3pjpv.exe150⤵PID:1664
-
\??\c:\lfxxflx.exec:\lfxxflx.exe151⤵PID:2836
-
\??\c:\rxrxllx.exec:\rxrxllx.exe152⤵PID:2220
-
\??\c:\btbntt.exec:\btbntt.exe153⤵PID:2032
-
\??\c:\btbbbt.exec:\btbbbt.exe154⤵PID:1316
-
\??\c:\dvppd.exec:\dvppd.exe155⤵PID:2112
-
\??\c:\lxrllrr.exec:\lxrllrr.exe156⤵PID:2364
-
\??\c:\3xfflrf.exec:\3xfflrf.exe157⤵PID:2332
-
\??\c:\3btbhh.exec:\3btbhh.exe158⤵PID:2376
-
\??\c:\9httnn.exec:\9httnn.exe159⤵PID:2636
-
\??\c:\vjvdj.exec:\vjvdj.exe160⤵PID:2624
-
\??\c:\lfrrflx.exec:\lfrrflx.exe161⤵PID:2768
-
\??\c:\7lflrff.exec:\7lflrff.exe162⤵PID:1152
-
\??\c:\ntnntt.exec:\ntnntt.exe163⤵PID:2524
-
\??\c:\7jddd.exec:\7jddd.exe164⤵PID:2552
-
\??\c:\dvddp.exec:\dvddp.exe165⤵PID:2568
-
\??\c:\frxxffl.exec:\frxxffl.exe166⤵PID:2548
-
\??\c:\3fxrxfr.exec:\3fxrxfr.exe167⤵PID:2976
-
\??\c:\btbhtt.exec:\btbhtt.exe168⤵PID:2980
-
\??\c:\9vdjd.exec:\9vdjd.exe169⤵PID:2824
-
\??\c:\jpdjv.exec:\jpdjv.exe170⤵PID:2828
-
\??\c:\fxfflfl.exec:\fxfflfl.exe171⤵PID:2960
-
\??\c:\rlflxrf.exec:\rlflxrf.exe172⤵PID:2348
-
\??\c:\btbhnt.exec:\btbhnt.exe173⤵PID:2412
-
\??\c:\vpjjj.exec:\vpjjj.exe174⤵PID:2392
-
\??\c:\5ppjj.exec:\5ppjj.exe175⤵PID:1128
-
\??\c:\xrfxffx.exec:\xrfxffx.exe176⤵PID:2304
-
\??\c:\tnbhbb.exec:\tnbhbb.exe177⤵PID:1056
-
\??\c:\tnhntt.exec:\tnhntt.exe178⤵PID:884
-
\??\c:\1pjjp.exec:\1pjjp.exe179⤵PID:2064
-
\??\c:\5frrrxx.exec:\5frrrxx.exe180⤵PID:1720
-
\??\c:\7xrxflr.exec:\7xrxflr.exe181⤵PID:2276
-
\??\c:\bbntbb.exec:\bbntbb.exe182⤵PID:1416
-
\??\c:\1thntb.exec:\1thntb.exe183⤵PID:2868
-
\??\c:\vddvd.exec:\vddvd.exe184⤵PID:380
-
\??\c:\lfxrxfx.exec:\lfxrxfx.exe185⤵PID:376
-
\??\c:\bbntbh.exec:\bbntbh.exe186⤵PID:484
-
\??\c:\nhnnbh.exec:\nhnnbh.exe187⤵PID:1656
-
\??\c:\pdvvv.exec:\pdvvv.exe188⤵PID:2196
-
\??\c:\dvppv.exec:\dvppv.exe189⤵PID:952
-
\??\c:\lfxxxxr.exec:\lfxxxxr.exe190⤵PID:2372
-
\??\c:\tnttnn.exec:\tnttnn.exe191⤵PID:912
-
\??\c:\hbntnt.exec:\hbntnt.exe192⤵PID:2296
-
\??\c:\vvppj.exec:\vvppj.exe193⤵PID:576
-
\??\c:\rlxfrxl.exec:\rlxfrxl.exe194⤵PID:1728
-
\??\c:\rlrxlrl.exec:\rlrxlrl.exe195⤵PID:2220
-
\??\c:\hbnnnn.exec:\hbnnnn.exe196⤵PID:1620
-
\??\c:\3vppv.exec:\3vppv.exe197⤵PID:3024
-
\??\c:\jjdpv.exec:\jjdpv.exe198⤵PID:3048
-
\??\c:\rflrrlr.exec:\rflrrlr.exe199⤵PID:3044
-
\??\c:\hbthbn.exec:\hbthbn.exe200⤵PID:3068
-
\??\c:\9tbnbh.exec:\9tbnbh.exe201⤵PID:2732
-
\??\c:\9dvvj.exec:\9dvvj.exe202⤵PID:2460
-
\??\c:\llxlrxf.exec:\llxlrxf.exe203⤵PID:2620
-
\??\c:\lrfrrrx.exec:\lrfrrrx.exe204⤵PID:2644
-
\??\c:\hnhbbb.exec:\hnhbbb.exe205⤵PID:2756
-
\??\c:\vppjp.exec:\vppjp.exe206⤵PID:2608
-
\??\c:\1jddj.exec:\1jddj.exe207⤵PID:2540
-
\??\c:\3lxxflx.exec:\3lxxflx.exe208⤵PID:2496
-
\??\c:\thtbnn.exec:\thtbnn.exe209⤵PID:2320
-
\??\c:\pdpjp.exec:\pdpjp.exe210⤵PID:1612
-
\??\c:\pjdjv.exec:\pjdjv.exe211⤵PID:2904
-
\??\c:\ffrrrxf.exec:\ffrrrxf.exe212⤵PID:2016
-
\??\c:\7tbhtt.exec:\7tbhtt.exe213⤵PID:2928
-
\??\c:\nhbbnn.exec:\nhbbnn.exe214⤵PID:2208
-
\??\c:\3pjjj.exec:\3pjjj.exe215⤵PID:1980
-
\??\c:\xrfxflr.exec:\xrfxflr.exe216⤵PID:2152
-
\??\c:\fxrrxfr.exec:\fxrrxfr.exe217⤵PID:2592
-
\??\c:\thtbbt.exec:\thtbbt.exe218⤵PID:2556
-
\??\c:\9pdvd.exec:\9pdvd.exe219⤵PID:544
-
\??\c:\pjppv.exec:\pjppv.exe220⤵PID:856
-
\??\c:\rxffrlx.exec:\rxffrlx.exe221⤵PID:1552
-
\??\c:\1nbhtb.exec:\1nbhtb.exe222⤵PID:2584
-
\??\c:\9pppd.exec:\9pppd.exe223⤵PID:1600
-
\??\c:\vjvpd.exec:\vjvpd.exe224⤵PID:1900
-
\??\c:\xlllrlx.exec:\xlllrlx.exe225⤵PID:2876
-
\??\c:\ffxlxfr.exec:\ffxlxfr.exe226⤵PID:2288
-
\??\c:\9hhnth.exec:\9hhnth.exe227⤵PID:816
-
\??\c:\ddvjv.exec:\ddvjv.exe228⤵PID:548
-
\??\c:\1xllrrl.exec:\1xllrrl.exe229⤵PID:1252
-
\??\c:\9xrrffx.exec:\9xrrffx.exe230⤵PID:2444
-
\??\c:\tnhntb.exec:\tnhntb.exe231⤵PID:1848
-
\??\c:\pjvdj.exec:\pjvdj.exe232⤵PID:1948
-
\??\c:\dpdvj.exec:\dpdvj.exe233⤵PID:2580
-
\??\c:\3xrrrxl.exec:\3xrrrxl.exe234⤵PID:1664
-
\??\c:\nnbntt.exec:\nnbntt.exe235⤵PID:2000
-
\??\c:\5nhnnt.exec:\5nhnnt.exe236⤵PID:2156
-
\??\c:\5jpvv.exec:\5jpvv.exe237⤵PID:2988
-
\??\c:\7xrllll.exec:\7xrllll.exe238⤵PID:2312
-
\??\c:\5rllrfl.exec:\5rllrfl.exe239⤵PID:2324
-
\??\c:\1hbbhn.exec:\1hbbhn.exe240⤵PID:3052
-
\??\c:\jdvvd.exec:\jdvvd.exe241⤵PID:2832
-
\??\c:\jdjdd.exec:\jdjdd.exe242⤵PID:2728