Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 14:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d61f08af2d97ebbe050d232a48b53000_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
d61f08af2d97ebbe050d232a48b53000_NeikiAnalytics.exe
-
Size
122KB
-
MD5
d61f08af2d97ebbe050d232a48b53000
-
SHA1
a94b5e063b2c5d312c3df62f0a581719c0749c7c
-
SHA256
4a915a222cf3bb2201e3cd7402cde4d6e7dd2fc6ac9647fba22115c7b3d472d9
-
SHA512
58ab0d686255321083b75a2c1d96fde81cec88189445ad9472eb579fe0edae903cc0b3c367511f8e7c44ad5c476ab4439970fa2f71918dec65e5046ea47251d2
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo7LAIRUohDLSULrCimBaH8UH30w07:n3C9BRo/AIuunSppaH8m3DM
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/3056-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1016-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/812-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-62-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2896-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2968-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/760-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2112-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1328-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/696-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1444-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bbbbnn.exerlxlxll.exennhthn.exepvddj.exexfxxlrx.exetnbbtt.exe5vpvd.exejvppd.exexxrxrrl.exe1bthbn.exennnhbn.exe9ddjp.exefxxlxfr.exe7ttbhh.exejjjvj.exerfxlrxf.exelfrxlrx.exehtnntt.exejjddp.exejdjvp.exellxflrx.exebhthtt.exejjjjd.exexflfflf.exe3bnhnt.exehhhtnt.exe7vvdd.exeddvpj.exennhtht.exejjvpd.exeffxlxlf.exelfxlrrl.exe7bbtbb.exepvpjv.exe5jpjp.exelxlrffl.exexlflxfl.exenntnth.exe5btnnb.exetnbnhh.exevpjpv.exefrffrxr.exerlllxff.exenhbtbh.exe9btbbb.exejddjj.exe3ppvj.exe9frxlxf.exennhnhn.exebhtnth.exe7jjvv.exelrlrxlx.exe7rrfflf.exebhhtht.exenhhtth.exe7dvvj.exe5fflrrf.exexrflrrx.exe3nnttn.exethtbnn.exe7jvvv.exepdvvd.exerrrxlxf.exeffxfxxr.exepid process 1016 bbbbnn.exe 812 rlxlxll.exe 2148 nnhthn.exe 2724 pvddj.exe 2816 xfxxlrx.exe 2896 tnbbtt.exe 3060 5vpvd.exe 2540 jvppd.exe 3000 xxrxrrl.exe 1928 1bthbn.exe 2968 nnnhbn.exe 3012 9ddjp.exe 2416 fxxlxfr.exe 2156 7ttbhh.exe 1552 jjjvj.exe 352 rfxlrxf.exe 2620 lfrxlrx.exe 824 htnntt.exe 1316 jjddp.exe 2092 jdjvp.exe 760 llxflrx.exe 2056 bhthtt.exe 2112 jjjjd.exe 1620 xflfflf.exe 2628 3bnhnt.exe 952 hhhtnt.exe 1328 7vvdd.exe 696 ddvpj.exe 1444 nnhtht.exe 1800 jjvpd.exe 1940 ffxlxlf.exe 2224 lfxlrrl.exe 2948 7bbtbb.exe 2420 pvpjv.exe 1016 5jpjp.exe 2144 lxlrffl.exe 2672 xlflxfl.exe 2788 nntnth.exe 2732 5btnnb.exe 2692 tnbnhh.exe 2704 vpjpv.exe 2696 frffrxr.exe 2276 rlllxff.exe 2652 nhbtbh.exe 3044 9btbbb.exe 2768 jddjj.exe 1928 3ppvj.exe 3028 9frxlxf.exe 1288 nnhnhn.exe 296 bhtnth.exe 1652 7jjvv.exe 2156 lrlrxlx.exe 2516 7rrfflf.exe 2772 bhhtht.exe 1916 nhhtth.exe 1488 7dvvj.exe 684 5fflrrf.exe 1260 xrflrrx.exe 468 3nnttn.exe 1776 thtbnn.exe 2928 7jvvv.exe 1248 pdvvd.exe 1084 rrrxlxf.exe 1472 ffxfxxr.exe -
Processes:
resource yara_rule behavioral1/memory/3056-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1016-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1016-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1016-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1016-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/812-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/760-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2112-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1328-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/696-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1444-282-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d61f08af2d97ebbe050d232a48b53000_NeikiAnalytics.exebbbbnn.exerlxlxll.exennhthn.exepvddj.exexfxxlrx.exetnbbtt.exe5vpvd.exejvppd.exexxrxrrl.exe1bthbn.exennnhbn.exe9ddjp.exefxxlxfr.exe7ttbhh.exejjjvj.exedescription pid process target process PID 3056 wrote to memory of 1016 3056 d61f08af2d97ebbe050d232a48b53000_NeikiAnalytics.exe bbbbnn.exe PID 3056 wrote to memory of 1016 3056 d61f08af2d97ebbe050d232a48b53000_NeikiAnalytics.exe bbbbnn.exe PID 3056 wrote to memory of 1016 3056 d61f08af2d97ebbe050d232a48b53000_NeikiAnalytics.exe bbbbnn.exe PID 3056 wrote to memory of 1016 3056 d61f08af2d97ebbe050d232a48b53000_NeikiAnalytics.exe bbbbnn.exe PID 1016 wrote to memory of 812 1016 bbbbnn.exe rlxlxll.exe PID 1016 wrote to memory of 812 1016 bbbbnn.exe rlxlxll.exe PID 1016 wrote to memory of 812 1016 bbbbnn.exe rlxlxll.exe PID 1016 wrote to memory of 812 1016 bbbbnn.exe rlxlxll.exe PID 812 wrote to memory of 2148 812 rlxlxll.exe nnhthn.exe PID 812 wrote to memory of 2148 812 rlxlxll.exe nnhthn.exe PID 812 wrote to memory of 2148 812 rlxlxll.exe nnhthn.exe PID 812 wrote to memory of 2148 812 rlxlxll.exe nnhthn.exe PID 2148 wrote to memory of 2724 2148 nnhthn.exe pvddj.exe PID 2148 wrote to memory of 2724 2148 nnhthn.exe pvddj.exe PID 2148 wrote to memory of 2724 2148 nnhthn.exe pvddj.exe PID 2148 wrote to memory of 2724 2148 nnhthn.exe pvddj.exe PID 2724 wrote to memory of 2816 2724 pvddj.exe xfxxlrx.exe PID 2724 wrote to memory of 2816 2724 pvddj.exe xfxxlrx.exe PID 2724 wrote to memory of 2816 2724 pvddj.exe xfxxlrx.exe PID 2724 wrote to memory of 2816 2724 pvddj.exe xfxxlrx.exe PID 2816 wrote to memory of 2896 2816 xfxxlrx.exe tnbbtt.exe PID 2816 wrote to memory of 2896 2816 xfxxlrx.exe tnbbtt.exe PID 2816 wrote to memory of 2896 2816 xfxxlrx.exe tnbbtt.exe PID 2816 wrote to memory of 2896 2816 xfxxlrx.exe tnbbtt.exe PID 2896 wrote to memory of 3060 2896 tnbbtt.exe 5vpvd.exe PID 2896 wrote to memory of 3060 2896 tnbbtt.exe 5vpvd.exe PID 2896 wrote to memory of 3060 2896 tnbbtt.exe 5vpvd.exe PID 2896 wrote to memory of 3060 2896 tnbbtt.exe 5vpvd.exe PID 3060 wrote to memory of 2540 3060 5vpvd.exe jvppd.exe PID 3060 wrote to memory of 2540 3060 5vpvd.exe jvppd.exe PID 3060 wrote to memory of 2540 3060 5vpvd.exe jvppd.exe PID 3060 wrote to memory of 2540 3060 5vpvd.exe jvppd.exe PID 2540 wrote to memory of 3000 2540 jvppd.exe xxrxrrl.exe PID 2540 wrote to memory of 3000 2540 jvppd.exe xxrxrrl.exe PID 2540 wrote to memory of 3000 2540 jvppd.exe xxrxrrl.exe PID 2540 wrote to memory of 3000 2540 jvppd.exe xxrxrrl.exe PID 3000 wrote to memory of 1928 3000 xxrxrrl.exe 1bthbn.exe PID 3000 wrote to memory of 1928 3000 xxrxrrl.exe 1bthbn.exe PID 3000 wrote to memory of 1928 3000 xxrxrrl.exe 1bthbn.exe PID 3000 wrote to memory of 1928 3000 xxrxrrl.exe 1bthbn.exe PID 1928 wrote to memory of 2968 1928 1bthbn.exe nnnhbn.exe PID 1928 wrote to memory of 2968 1928 1bthbn.exe nnnhbn.exe PID 1928 wrote to memory of 2968 1928 1bthbn.exe nnnhbn.exe PID 1928 wrote to memory of 2968 1928 1bthbn.exe nnnhbn.exe PID 2968 wrote to memory of 3012 2968 nnnhbn.exe 9ddjp.exe PID 2968 wrote to memory of 3012 2968 nnnhbn.exe 9ddjp.exe PID 2968 wrote to memory of 3012 2968 nnnhbn.exe 9ddjp.exe PID 2968 wrote to memory of 3012 2968 nnnhbn.exe 9ddjp.exe PID 3012 wrote to memory of 2416 3012 9ddjp.exe fxxlxfr.exe PID 3012 wrote to memory of 2416 3012 9ddjp.exe fxxlxfr.exe PID 3012 wrote to memory of 2416 3012 9ddjp.exe fxxlxfr.exe PID 3012 wrote to memory of 2416 3012 9ddjp.exe fxxlxfr.exe PID 2416 wrote to memory of 2156 2416 fxxlxfr.exe 7ttbhh.exe PID 2416 wrote to memory of 2156 2416 fxxlxfr.exe 7ttbhh.exe PID 2416 wrote to memory of 2156 2416 fxxlxfr.exe 7ttbhh.exe PID 2416 wrote to memory of 2156 2416 fxxlxfr.exe 7ttbhh.exe PID 2156 wrote to memory of 1552 2156 7ttbhh.exe jjjvj.exe PID 2156 wrote to memory of 1552 2156 7ttbhh.exe jjjvj.exe PID 2156 wrote to memory of 1552 2156 7ttbhh.exe jjjvj.exe PID 2156 wrote to memory of 1552 2156 7ttbhh.exe jjjvj.exe PID 1552 wrote to memory of 352 1552 jjjvj.exe rfxlrxf.exe PID 1552 wrote to memory of 352 1552 jjjvj.exe rfxlrxf.exe PID 1552 wrote to memory of 352 1552 jjjvj.exe rfxlrxf.exe PID 1552 wrote to memory of 352 1552 jjjvj.exe rfxlrxf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d61f08af2d97ebbe050d232a48b53000_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d61f08af2d97ebbe050d232a48b53000_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\bbbbnn.exec:\bbbbnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\rlxlxll.exec:\rlxlxll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\nnhthn.exec:\nnhthn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\pvddj.exec:\pvddj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\xfxxlrx.exec:\xfxxlrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\tnbbtt.exec:\tnbbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\5vpvd.exec:\5vpvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\jvppd.exec:\jvppd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\xxrxrrl.exec:\xxrxrrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\1bthbn.exec:\1bthbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\nnnhbn.exec:\nnnhbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\9ddjp.exec:\9ddjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\fxxlxfr.exec:\fxxlxfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\7ttbhh.exec:\7ttbhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\jjjvj.exec:\jjjvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\rfxlrxf.exec:\rfxlrxf.exe17⤵
- Executes dropped EXE
PID:352 -
\??\c:\lfrxlrx.exec:\lfrxlrx.exe18⤵
- Executes dropped EXE
PID:2620 -
\??\c:\htnntt.exec:\htnntt.exe19⤵
- Executes dropped EXE
PID:824 -
\??\c:\jjddp.exec:\jjddp.exe20⤵
- Executes dropped EXE
PID:1316 -
\??\c:\jdjvp.exec:\jdjvp.exe21⤵
- Executes dropped EXE
PID:2092 -
\??\c:\llxflrx.exec:\llxflrx.exe22⤵
- Executes dropped EXE
PID:760 -
\??\c:\bhthtt.exec:\bhthtt.exe23⤵
- Executes dropped EXE
PID:2056 -
\??\c:\jjjjd.exec:\jjjjd.exe24⤵
- Executes dropped EXE
PID:2112 -
\??\c:\xflfflf.exec:\xflfflf.exe25⤵
- Executes dropped EXE
PID:1620 -
\??\c:\3bnhnt.exec:\3bnhnt.exe26⤵
- Executes dropped EXE
PID:2628 -
\??\c:\hhhtnt.exec:\hhhtnt.exe27⤵
- Executes dropped EXE
PID:952 -
\??\c:\7vvdd.exec:\7vvdd.exe28⤵
- Executes dropped EXE
PID:1328 -
\??\c:\ddvpj.exec:\ddvpj.exe29⤵
- Executes dropped EXE
PID:696 -
\??\c:\nnhtht.exec:\nnhtht.exe30⤵
- Executes dropped EXE
PID:1444 -
\??\c:\jjvpd.exec:\jjvpd.exe31⤵
- Executes dropped EXE
PID:1800 -
\??\c:\ffxlxlf.exec:\ffxlxlf.exe32⤵
- Executes dropped EXE
PID:1940 -
\??\c:\lfxlrrl.exec:\lfxlrrl.exe33⤵
- Executes dropped EXE
PID:2224 -
\??\c:\7bbtbb.exec:\7bbtbb.exe34⤵
- Executes dropped EXE
PID:2948 -
\??\c:\pvpjv.exec:\pvpjv.exe35⤵
- Executes dropped EXE
PID:2420 -
\??\c:\5jpjp.exec:\5jpjp.exe36⤵
- Executes dropped EXE
PID:1016 -
\??\c:\lxlrffl.exec:\lxlrffl.exe37⤵
- Executes dropped EXE
PID:2144 -
\??\c:\xlflxfl.exec:\xlflxfl.exe38⤵
- Executes dropped EXE
PID:2672 -
\??\c:\nntnth.exec:\nntnth.exe39⤵
- Executes dropped EXE
PID:2788 -
\??\c:\5btnnb.exec:\5btnnb.exe40⤵
- Executes dropped EXE
PID:2732 -
\??\c:\tnbnhh.exec:\tnbnhh.exe41⤵
- Executes dropped EXE
PID:2692 -
\??\c:\vpjpv.exec:\vpjpv.exe42⤵
- Executes dropped EXE
PID:2704 -
\??\c:\frffrxr.exec:\frffrxr.exe43⤵
- Executes dropped EXE
PID:2696 -
\??\c:\rlllxff.exec:\rlllxff.exe44⤵
- Executes dropped EXE
PID:2276 -
\??\c:\nhbtbh.exec:\nhbtbh.exe45⤵
- Executes dropped EXE
PID:2652 -
\??\c:\9btbbb.exec:\9btbbb.exe46⤵
- Executes dropped EXE
PID:3044 -
\??\c:\jddjj.exec:\jddjj.exe47⤵
- Executes dropped EXE
PID:2768 -
\??\c:\3ppvj.exec:\3ppvj.exe48⤵
- Executes dropped EXE
PID:1928 -
\??\c:\9frxlxf.exec:\9frxlxf.exe49⤵
- Executes dropped EXE
PID:3028 -
\??\c:\nnhnhn.exec:\nnhnhn.exe50⤵
- Executes dropped EXE
PID:1288 -
\??\c:\bhtnth.exec:\bhtnth.exe51⤵
- Executes dropped EXE
PID:296 -
\??\c:\7jjvv.exec:\7jjvv.exe52⤵
- Executes dropped EXE
PID:1652 -
\??\c:\lrlrxlx.exec:\lrlrxlx.exe53⤵
- Executes dropped EXE
PID:2156 -
\??\c:\7rrfflf.exec:\7rrfflf.exe54⤵
- Executes dropped EXE
PID:2516 -
\??\c:\bhhtht.exec:\bhhtht.exe55⤵
- Executes dropped EXE
PID:2772 -
\??\c:\nhhtth.exec:\nhhtth.exe56⤵
- Executes dropped EXE
PID:1916 -
\??\c:\7dvvj.exec:\7dvvj.exe57⤵
- Executes dropped EXE
PID:1488 -
\??\c:\5fflrrf.exec:\5fflrrf.exe58⤵
- Executes dropped EXE
PID:684 -
\??\c:\xrflrrx.exec:\xrflrrx.exe59⤵
- Executes dropped EXE
PID:1260 -
\??\c:\3nnttn.exec:\3nnttn.exe60⤵
- Executes dropped EXE
PID:468 -
\??\c:\thtbnn.exec:\thtbnn.exe61⤵
- Executes dropped EXE
PID:1776 -
\??\c:\7jvvv.exec:\7jvvv.exe62⤵
- Executes dropped EXE
PID:2928 -
\??\c:\pdvvd.exec:\pdvvd.exe63⤵
- Executes dropped EXE
PID:1248 -
\??\c:\rrrxlxf.exec:\rrrxlxf.exe64⤵
- Executes dropped EXE
PID:1084 -
\??\c:\ffxfxxr.exec:\ffxfxxr.exe65⤵
- Executes dropped EXE
PID:1472 -
\??\c:\hhthtt.exec:\hhthtt.exe66⤵PID:948
-
\??\c:\hhhnhn.exec:\hhhnhn.exe67⤵PID:2124
-
\??\c:\ddpjd.exec:\ddpjd.exe68⤵PID:752
-
\??\c:\xxlrxxl.exec:\xxlrxxl.exe69⤵PID:1328
-
\??\c:\ffrxlrf.exec:\ffrxlrf.exe70⤵PID:780
-
\??\c:\bbnnbh.exec:\bbnnbh.exe71⤵PID:2932
-
\??\c:\tthbhh.exec:\tthbhh.exe72⤵PID:2380
-
\??\c:\7vvdj.exec:\7vvdj.exe73⤵PID:1716
-
\??\c:\5ppdj.exec:\5ppdj.exe74⤵PID:3068
-
\??\c:\3xllrxf.exec:\3xllrxf.exe75⤵PID:1836
-
\??\c:\rflfllr.exec:\rflfllr.exe76⤵PID:2616
-
\??\c:\hhbnbn.exec:\hhbnbn.exe77⤵PID:1272
-
\??\c:\3httbb.exec:\3httbb.exe78⤵PID:1276
-
\??\c:\vpdpd.exec:\vpdpd.exe79⤵PID:2332
-
\??\c:\3jppj.exec:\3jppj.exe80⤵PID:2900
-
\??\c:\lxfxllx.exec:\lxfxllx.exe81⤵PID:2788
-
\??\c:\rlfxffl.exec:\rlfxffl.exe82⤵PID:1580
-
\??\c:\5tnbhn.exec:\5tnbhn.exe83⤵PID:2068
-
\??\c:\bttnnt.exec:\bttnnt.exe84⤵PID:2584
-
\??\c:\9jjvj.exec:\9jjvj.exe85⤵PID:888
-
\??\c:\jdppp.exec:\jdppp.exe86⤵PID:3060
-
\??\c:\rlrrflx.exec:\rlrrflx.exe87⤵PID:1948
-
\??\c:\llxlxrl.exec:\llxlxrl.exe88⤵PID:3044
-
\??\c:\3bthtb.exec:\3bthtb.exe89⤵PID:2856
-
\??\c:\nhhhnt.exec:\nhhhnt.exe90⤵PID:3008
-
\??\c:\vvjjv.exec:\vvjjv.exe91⤵PID:3036
-
\??\c:\dpjvv.exec:\dpjvv.exe92⤵PID:1496
-
\??\c:\llfrxxx.exec:\llfrxxx.exe93⤵PID:1684
-
\??\c:\7xxllxf.exec:\7xxllxf.exe94⤵PID:1976
-
\??\c:\1ttnhn.exec:\1ttnhn.exe95⤵PID:2588
-
\??\c:\7dvjd.exec:\7dvjd.exe96⤵PID:1552
-
\??\c:\dvjpv.exec:\dvjpv.exe97⤵PID:2756
-
\??\c:\7rlflrx.exec:\7rlflrx.exe98⤵PID:852
-
\??\c:\lflrrxl.exec:\lflrrxl.exe99⤵PID:1412
-
\??\c:\ththnb.exec:\ththnb.exe100⤵PID:1240
-
\??\c:\tnbhtb.exec:\tnbhtb.exe101⤵PID:672
-
\??\c:\jvjpp.exec:\jvjpp.exe102⤵PID:1220
-
\??\c:\jddpp.exec:\jddpp.exe103⤵PID:2404
-
\??\c:\7lflxrx.exec:\7lflxrx.exe104⤵PID:1044
-
\??\c:\lxrrxxf.exec:\lxrrxxf.exe105⤵PID:828
-
\??\c:\bbttnn.exec:\bbttnn.exe106⤵PID:1084
-
\??\c:\btthtn.exec:\btthtn.exe107⤵PID:1620
-
\??\c:\7ddpp.exec:\7ddpp.exe108⤵PID:1820
-
\??\c:\dvvjv.exec:\dvvjv.exe109⤵PID:1332
-
\??\c:\9llxffr.exec:\9llxffr.exe110⤵PID:752
-
\??\c:\5hntbb.exec:\5hntbb.exe111⤵PID:1328
-
\??\c:\1btbbb.exec:\1btbbb.exe112⤵PID:2392
-
\??\c:\7jdpp.exec:\7jdpp.exe113⤵PID:316
-
\??\c:\dvddp.exec:\dvddp.exe114⤵PID:1672
-
\??\c:\3xrxflx.exec:\3xrxflx.exe115⤵PID:1720
-
\??\c:\rlfllrf.exec:\rlfllrf.exe116⤵PID:3068
-
\??\c:\1hbhnt.exec:\1hbhnt.exe117⤵PID:1836
-
\??\c:\pjdpp.exec:\pjdpp.exe118⤵PID:1692
-
\??\c:\3ddjp.exec:\3ddjp.exe119⤵PID:2420
-
\??\c:\3fllxxr.exec:\3fllxxr.exe120⤵PID:2272
-
\??\c:\lxrlfxx.exec:\lxrlfxx.exe121⤵PID:2144
-
\??\c:\hhtntb.exec:\hhtntb.exe122⤵PID:2900
-
\??\c:\vvdvd.exec:\vvdvd.exe123⤵PID:2812
-
\??\c:\vjdpv.exec:\vjdpv.exe124⤵PID:2840
-
\??\c:\rrfrlll.exec:\rrfrlll.exe125⤵PID:2692
-
\??\c:\fxrrffl.exec:\fxrrffl.exe126⤵PID:2584
-
\??\c:\nhhhnt.exec:\nhhhnt.exe127⤵PID:2696
-
\??\c:\7hnbnn.exec:\7hnbnn.exe128⤵PID:2276
-
\??\c:\dvdpv.exec:\dvdpv.exe129⤵PID:1660
-
\??\c:\3jvdj.exec:\3jvdj.exe130⤵PID:3044
-
\??\c:\xrlflfx.exec:\xrlflfx.exe131⤵PID:2768
-
\??\c:\hhtbhn.exec:\hhtbhn.exe132⤵PID:1928
-
\??\c:\bbbntb.exec:\bbbntb.exe133⤵PID:348
-
\??\c:\3pvpp.exec:\3pvpp.exe134⤵PID:1288
-
\??\c:\lffrxfr.exec:\lffrxfr.exe135⤵PID:296
-
\??\c:\ffflxxf.exec:\ffflxxf.exe136⤵PID:2740
-
\??\c:\tnhtnt.exec:\tnhtnt.exe137⤵PID:2156
-
\??\c:\jdddj.exec:\jdddj.exe138⤵PID:2516
-
\??\c:\dvdjv.exec:\dvdjv.exe139⤵PID:2772
-
\??\c:\xrxxflr.exec:\xrxxflr.exe140⤵PID:1036
-
\??\c:\hhhnnt.exec:\hhhnnt.exe141⤵PID:1488
-
\??\c:\nhntnh.exec:\nhntnh.exe142⤵PID:2240
-
\??\c:\vpjpp.exec:\vpjpp.exe143⤵PID:1260
-
\??\c:\7xrflrx.exec:\7xrflrx.exe144⤵PID:1220
-
\??\c:\9rlrrfl.exec:\9rlrrfl.exe145⤵PID:1776
-
\??\c:\tnbntb.exec:\tnbntb.exe146⤵PID:644
-
\??\c:\1nhntn.exec:\1nhntn.exe147⤵PID:2488
-
\??\c:\jjjvv.exec:\jjjvv.exe148⤵PID:1344
-
\??\c:\vvppp.exec:\vvppp.exe149⤵PID:1472
-
\??\c:\fxlxrrf.exec:\fxlxrrf.exe150⤵PID:2280
-
\??\c:\3tnnhb.exec:\3tnnhb.exe151⤵PID:2428
-
\??\c:\7nhtht.exec:\7nhtht.exe152⤵PID:2424
-
\??\c:\djjdj.exec:\djjdj.exe153⤵PID:696
-
\??\c:\9jvvp.exec:\9jvvp.exe154⤵PID:2120
-
\??\c:\xrrxflx.exec:\xrrxflx.exe155⤵PID:2932
-
\??\c:\flfrrfl.exec:\flfrrfl.exe156⤵PID:1564
-
\??\c:\btbnth.exec:\btbnth.exe157⤵PID:2452
-
\??\c:\bbhtnh.exec:\bbhtnh.exe158⤵PID:1540
-
\??\c:\9ppvj.exec:\9ppvj.exe159⤵PID:2948
-
\??\c:\ddjjp.exec:\ddjjp.exe160⤵PID:1692
-
\??\c:\llxrfxf.exec:\llxrfxf.exe161⤵PID:2176
-
\??\c:\bnttbt.exec:\bnttbt.exe162⤵PID:1276
-
\??\c:\tnhtnt.exec:\tnhtnt.exe163⤵PID:2332
-
\??\c:\9vdjv.exec:\9vdjv.exe164⤵PID:2656
-
\??\c:\jdppv.exec:\jdppv.exe165⤵PID:2700
-
\??\c:\xrrxxlx.exec:\xrrxxlx.exe166⤵PID:1580
-
\??\c:\hhhhnb.exec:\hhhhnb.exe167⤵PID:2068
-
\??\c:\tthbht.exec:\tthbht.exe168⤵PID:2540
-
\??\c:\jvjjj.exec:\jvjjj.exe169⤵PID:888
-
\??\c:\ppjvp.exec:\ppjvp.exe170⤵PID:2872
-
\??\c:\rxrlfrl.exec:\rxrlfrl.exe171⤵PID:1948
-
\??\c:\lllxlxf.exec:\lllxlxf.exe172⤵PID:2976
-
\??\c:\hbthbh.exec:\hbthbh.exe173⤵PID:2856
-
\??\c:\djpdv.exec:\djpdv.exe174⤵PID:3008
-
\??\c:\jppdv.exec:\jppdv.exe175⤵PID:1588
-
\??\c:\lllxrxl.exec:\lllxrxl.exe176⤵PID:1652
-
\??\c:\bbbnbn.exec:\bbbnbn.exe177⤵PID:2752
-
\??\c:\xrlxllx.exec:\xrlxllx.exe178⤵PID:1108
-
\??\c:\bnbtbb.exec:\bnbtbb.exe179⤵PID:2100
-
\??\c:\ddvjd.exec:\ddvjd.exe180⤵PID:320
-
\??\c:\7rxflrf.exec:\7rxflrf.exe181⤵PID:2772
-
\??\c:\xxlrlfr.exec:\xxlrlfr.exe182⤵PID:484
-
\??\c:\nhnbnb.exec:\nhnbnb.exe183⤵PID:2512
-
\??\c:\jvjpj.exec:\jvjpj.exe184⤵PID:292
-
\??\c:\lfrxxfl.exec:\lfrxxfl.exe185⤵PID:996
-
\??\c:\lxxllxf.exec:\lxxllxf.exe186⤵PID:1312
-
\??\c:\1btbnb.exec:\1btbnb.exe187⤵PID:1812
-
\??\c:\1hbnnn.exec:\1hbnnn.exe188⤵PID:1104
-
\??\c:\7vjjp.exec:\7vjjp.exe189⤵PID:1084
-
\??\c:\dvdjp.exec:\dvdjp.exe190⤵PID:892
-
\??\c:\xxrxflr.exec:\xxrxflr.exe191⤵PID:556
-
\??\c:\7nhbnt.exec:\7nhbnt.exe192⤵PID:1820
-
\??\c:\tnhbnt.exec:\tnhbnt.exe193⤵PID:2320
-
\??\c:\ddpdv.exec:\ddpdv.exe194⤵PID:752
-
\??\c:\vpjpj.exec:\vpjpj.exe195⤵PID:1944
-
\??\c:\lfflflr.exec:\lfflflr.exe196⤵PID:2944
-
\??\c:\fxrxrrx.exec:\fxrxrrx.exe197⤵PID:1672
-
\??\c:\bttbbn.exec:\bttbbn.exe198⤵PID:2228
-
\??\c:\5vdjp.exec:\5vdjp.exe199⤵PID:2612
-
\??\c:\jjdvv.exec:\jjdvv.exe200⤵PID:2712
-
\??\c:\7rrxxfx.exec:\7rrxxfx.exe201⤵PID:2636
-
\??\c:\5rxrfrr.exec:\5rxrfrr.exe202⤵PID:2420
-
\??\c:\5bnbhn.exec:\5bnbhn.exe203⤵PID:2720
-
\??\c:\jjvjv.exec:\jjvjv.exe204⤵PID:2272
-
\??\c:\vjdjj.exec:\vjdjj.exe205⤵PID:2556
-
\??\c:\1xrxrrl.exec:\1xrxrrl.exe206⤵PID:2668
-
\??\c:\xlrxlxl.exec:\xlrxlxl.exe207⤵PID:2832
-
\??\c:\ttbnbb.exec:\ttbnbb.exe208⤵PID:2608
-
\??\c:\jjvjd.exec:\jjvjd.exe209⤵PID:2584
-
\??\c:\jjvpj.exec:\jjvpj.exe210⤵PID:2992
-
\??\c:\fxlrffl.exec:\fxlrffl.exe211⤵PID:3016
-
\??\c:\rlllrxl.exec:\rlllrxl.exe212⤵PID:3004
-
\??\c:\bbbntt.exec:\bbbntt.exe213⤵PID:1012
-
\??\c:\7jjpj.exec:\7jjpj.exe214⤵PID:3012
-
\??\c:\jvppd.exec:\jvppd.exe215⤵PID:2232
-
\??\c:\7xxlxrx.exec:\7xxlxrx.exe216⤵PID:3008
-
\??\c:\nbtbnn.exec:\nbtbnn.exe217⤵PID:2632
-
\??\c:\9thbhh.exec:\9thbhh.exe218⤵PID:1652
-
\??\c:\jddvd.exec:\jddvd.exe219⤵PID:756
-
\??\c:\ddjvv.exec:\ddjvv.exe220⤵PID:1932
-
\??\c:\fxxlflr.exec:\fxxlflr.exe221⤵PID:1300
-
\??\c:\3rlxfll.exec:\3rlxfll.exe222⤵PID:776
-
\??\c:\tnhthh.exec:\tnhthh.exe223⤵PID:320
-
\??\c:\tthhnt.exec:\tthhnt.exe224⤵PID:2076
-
\??\c:\jdjpv.exec:\jdjpv.exe225⤵PID:2804
-
\??\c:\lfxfffr.exec:\lfxfffr.exe226⤵PID:2244
-
\??\c:\xxlxrxr.exec:\xxlxrxr.exe227⤵PID:2056
-
\??\c:\bthbnt.exec:\bthbnt.exe228⤵PID:2472
-
\??\c:\hhthbb.exec:\hhthbb.exe229⤵PID:1312
-
\??\c:\dpdpp.exec:\dpdpp.exe230⤵PID:2628
-
\??\c:\5djjj.exec:\5djjj.exe231⤵PID:1104
-
\??\c:\fxlrffl.exec:\fxlrffl.exe232⤵PID:2444
-
\??\c:\frllxrf.exec:\frllxrf.exe233⤵PID:2136
-
\??\c:\9nnnbh.exec:\9nnnbh.exe234⤵PID:1644
-
\??\c:\hthtbt.exec:\hthtbt.exe235⤵PID:1820
-
\??\c:\vpjpd.exec:\vpjpd.exe236⤵PID:780
-
\??\c:\7rfrllr.exec:\7rfrllr.exe237⤵PID:2380
-
\??\c:\5lllrfr.exec:\5lllrfr.exe238⤵PID:2464
-
\??\c:\thtbnt.exec:\thtbnt.exe239⤵PID:1696
-
\??\c:\tnnthh.exec:\tnnthh.exe240⤵PID:2224
-
\??\c:\dddjd.exec:\dddjd.exe241⤵PID:2292
-
\??\c:\ppdvj.exec:\ppdvj.exe242⤵PID:2640