Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 15:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dfb7a7fa0e66ab11b997243f04a907c0_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
dfb7a7fa0e66ab11b997243f04a907c0_NeikiAnalytics.exe
-
Size
83KB
-
MD5
dfb7a7fa0e66ab11b997243f04a907c0
-
SHA1
5aa5ebf2d74892f135b48df022b6867e4c389118
-
SHA256
6b08410a148132d98a424c6b5668570c89c5ef79731fae23e39fa5cff422af20
-
SHA512
464049e17c792e107213030ea8cf3088dcec8181f311774ce080d2fa15f54ab84411de9903650096bc9210ebef2f92290fa602e9ec33814f67ca2ed64b65e891
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAXPfgr2hKmdbcPi2vK:ymb3NkkiQ3mdBjFo6Pfgy3dbc/K
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/2700-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2624-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2132-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1572-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/284-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/240-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1808-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1044-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1416-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/328-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1640-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2228-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lxffxrr.exe7bbhbh.exeththht.exepjpvj.exexxxxrrf.exenhhnhb.exethnnnb.exejvpvv.exelfrrxxl.exexrlxxrx.exehbttbh.exejdjpv.exejpdjd.exelfrfrrf.exe9hbbnn.exehbhhtt.exepdvdp.exerrlxlrf.exexlxfffl.exe5btbhh.exepvjdj.exe1jjvv.exellfffll.exenbnthn.exe9nbhtt.exe7jddj.exerfxxrxl.exetbnnbh.exennttth.exevvpjj.exelfrflxl.exebbthnn.exennhnbb.exe9pddj.exe7dddd.exe9xxrxlx.exexrrxrrx.exenbnntt.exejjvdd.exefxrfllr.exe1btbnt.exe7bnttt.exevpddp.exepjvvd.exe5frlrrx.exe9rxxrll.exe7nbbbb.exe9hbbnt.exeddpdp.exevjpjp.exexrflxxf.exe1rffrrf.exe7hbbnb.exebntntt.exe7dvdd.exedpppd.exeflflxrl.exelrffrll.exebnhhnh.exeppddj.exevvddp.exelfrxfxl.exelfxxfxx.exelfffrrf.exepid process 3068 lxffxrr.exe 2624 7bbhbh.exe 2536 ththht.exe 2752 pjpvj.exe 2872 xxxxrrf.exe 2044 nhhnhb.exe 2504 thnnnb.exe 3060 jvpvv.exe 2132 lfrrxxl.exe 1572 xrlxxrx.exe 2328 hbttbh.exe 284 jdjpv.exe 1792 jpdjd.exe 240 lfrfrrf.exe 1808 9hbbnn.exe 2492 hbhhtt.exe 1044 pdvdp.exe 2656 rrlxlrf.exe 2128 xlxfffl.exe 2036 5btbhh.exe 596 pvjdj.exe 1416 1jjvv.exe 1772 llfffll.exe 2316 nbnthn.exe 328 9nbhtt.exe 552 7jddj.exe 912 rfxxrxl.exe 3052 tbnnbh.exe 1640 nnttth.exe 2228 vvpjj.exe 2012 lfrflxl.exe 1748 bbthnn.exe 2376 nnhnbb.exe 2648 9pddj.exe 1532 7dddd.exe 2756 9xxrxlx.exe 2436 xrrxrrx.exe 2688 nbnntt.exe 2284 jjvdd.exe 2672 fxrfllr.exe 2420 1btbnt.exe 2832 7bnttt.exe 2444 vpddp.exe 1896 pjvvd.exe 1884 5frlrrx.exe 1464 9rxxrll.exe 1516 7nbbbb.exe 2324 9hbbnt.exe 2380 ddpdp.exe 1428 vjpjp.exe 636 xrflxxf.exe 1040 1rffrrf.exe 1324 7hbbnb.exe 1368 bntntt.exe 2500 7dvdd.exe 2468 dpppd.exe 1964 flflxrl.exe 2040 lrffrll.exe 2036 bnhhnh.exe 596 ppddj.exe 1020 vvddp.exe 584 lfrxfxl.exe 1692 lfxxfxx.exe 2316 lfffrrf.exe -
Processes:
resource yara_rule behavioral1/memory/2700-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2132-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1572-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/284-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/240-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1808-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1044-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1416-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/328-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-285-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
dfb7a7fa0e66ab11b997243f04a907c0_NeikiAnalytics.exelxffxrr.exe7bbhbh.exeththht.exepjpvj.exexxxxrrf.exenhhnhb.exethnnnb.exejvpvv.exelfrrxxl.exexrlxxrx.exehbttbh.exejdjpv.exejpdjd.exelfrfrrf.exe9hbbnn.exedescription pid process target process PID 2700 wrote to memory of 3068 2700 dfb7a7fa0e66ab11b997243f04a907c0_NeikiAnalytics.exe lxffxrr.exe PID 2700 wrote to memory of 3068 2700 dfb7a7fa0e66ab11b997243f04a907c0_NeikiAnalytics.exe lxffxrr.exe PID 2700 wrote to memory of 3068 2700 dfb7a7fa0e66ab11b997243f04a907c0_NeikiAnalytics.exe lxffxrr.exe PID 2700 wrote to memory of 3068 2700 dfb7a7fa0e66ab11b997243f04a907c0_NeikiAnalytics.exe lxffxrr.exe PID 3068 wrote to memory of 2624 3068 lxffxrr.exe 7bbhbh.exe PID 3068 wrote to memory of 2624 3068 lxffxrr.exe 7bbhbh.exe PID 3068 wrote to memory of 2624 3068 lxffxrr.exe 7bbhbh.exe PID 3068 wrote to memory of 2624 3068 lxffxrr.exe 7bbhbh.exe PID 2624 wrote to memory of 2536 2624 7bbhbh.exe ththht.exe PID 2624 wrote to memory of 2536 2624 7bbhbh.exe ththht.exe PID 2624 wrote to memory of 2536 2624 7bbhbh.exe ththht.exe PID 2624 wrote to memory of 2536 2624 7bbhbh.exe ththht.exe PID 2536 wrote to memory of 2752 2536 ththht.exe pjpvj.exe PID 2536 wrote to memory of 2752 2536 ththht.exe pjpvj.exe PID 2536 wrote to memory of 2752 2536 ththht.exe pjpvj.exe PID 2536 wrote to memory of 2752 2536 ththht.exe pjpvj.exe PID 2752 wrote to memory of 2872 2752 pjpvj.exe xxxxrrf.exe PID 2752 wrote to memory of 2872 2752 pjpvj.exe xxxxrrf.exe PID 2752 wrote to memory of 2872 2752 pjpvj.exe xxxxrrf.exe PID 2752 wrote to memory of 2872 2752 pjpvj.exe xxxxrrf.exe PID 2872 wrote to memory of 2044 2872 xxxxrrf.exe nhhnhb.exe PID 2872 wrote to memory of 2044 2872 xxxxrrf.exe nhhnhb.exe PID 2872 wrote to memory of 2044 2872 xxxxrrf.exe nhhnhb.exe PID 2872 wrote to memory of 2044 2872 xxxxrrf.exe nhhnhb.exe PID 2044 wrote to memory of 2504 2044 nhhnhb.exe thnnnb.exe PID 2044 wrote to memory of 2504 2044 nhhnhb.exe thnnnb.exe PID 2044 wrote to memory of 2504 2044 nhhnhb.exe thnnnb.exe PID 2044 wrote to memory of 2504 2044 nhhnhb.exe thnnnb.exe PID 2504 wrote to memory of 3060 2504 thnnnb.exe jvpvv.exe PID 2504 wrote to memory of 3060 2504 thnnnb.exe jvpvv.exe PID 2504 wrote to memory of 3060 2504 thnnnb.exe jvpvv.exe PID 2504 wrote to memory of 3060 2504 thnnnb.exe jvpvv.exe PID 3060 wrote to memory of 2132 3060 jvpvv.exe lfrrxxl.exe PID 3060 wrote to memory of 2132 3060 jvpvv.exe lfrrxxl.exe PID 3060 wrote to memory of 2132 3060 jvpvv.exe lfrrxxl.exe PID 3060 wrote to memory of 2132 3060 jvpvv.exe lfrrxxl.exe PID 2132 wrote to memory of 1572 2132 lfrrxxl.exe xrlxxrx.exe PID 2132 wrote to memory of 1572 2132 lfrrxxl.exe xrlxxrx.exe PID 2132 wrote to memory of 1572 2132 lfrrxxl.exe xrlxxrx.exe PID 2132 wrote to memory of 1572 2132 lfrrxxl.exe xrlxxrx.exe PID 1572 wrote to memory of 2328 1572 xrlxxrx.exe hbttbh.exe PID 1572 wrote to memory of 2328 1572 xrlxxrx.exe hbttbh.exe PID 1572 wrote to memory of 2328 1572 xrlxxrx.exe hbttbh.exe PID 1572 wrote to memory of 2328 1572 xrlxxrx.exe hbttbh.exe PID 2328 wrote to memory of 284 2328 hbttbh.exe jdjpv.exe PID 2328 wrote to memory of 284 2328 hbttbh.exe jdjpv.exe PID 2328 wrote to memory of 284 2328 hbttbh.exe jdjpv.exe PID 2328 wrote to memory of 284 2328 hbttbh.exe jdjpv.exe PID 284 wrote to memory of 1792 284 jdjpv.exe jpdjd.exe PID 284 wrote to memory of 1792 284 jdjpv.exe jpdjd.exe PID 284 wrote to memory of 1792 284 jdjpv.exe jpdjd.exe PID 284 wrote to memory of 1792 284 jdjpv.exe jpdjd.exe PID 1792 wrote to memory of 240 1792 jpdjd.exe lfrfrrf.exe PID 1792 wrote to memory of 240 1792 jpdjd.exe lfrfrrf.exe PID 1792 wrote to memory of 240 1792 jpdjd.exe lfrfrrf.exe PID 1792 wrote to memory of 240 1792 jpdjd.exe lfrfrrf.exe PID 240 wrote to memory of 1808 240 lfrfrrf.exe 9hbbnn.exe PID 240 wrote to memory of 1808 240 lfrfrrf.exe 9hbbnn.exe PID 240 wrote to memory of 1808 240 lfrfrrf.exe 9hbbnn.exe PID 240 wrote to memory of 1808 240 lfrfrrf.exe 9hbbnn.exe PID 1808 wrote to memory of 2492 1808 9hbbnn.exe hbhhtt.exe PID 1808 wrote to memory of 2492 1808 9hbbnn.exe hbhhtt.exe PID 1808 wrote to memory of 2492 1808 9hbbnn.exe hbhhtt.exe PID 1808 wrote to memory of 2492 1808 9hbbnn.exe hbhhtt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfb7a7fa0e66ab11b997243f04a907c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\dfb7a7fa0e66ab11b997243f04a907c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\lxffxrr.exec:\lxffxrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\7bbhbh.exec:\7bbhbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\ththht.exec:\ththht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\pjpvj.exec:\pjpvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\xxxxrrf.exec:\xxxxrrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\nhhnhb.exec:\nhhnhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\thnnnb.exec:\thnnnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\jvpvv.exec:\jvpvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\lfrrxxl.exec:\lfrrxxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\xrlxxrx.exec:\xrlxxrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\hbttbh.exec:\hbttbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\jdjpv.exec:\jdjpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:284 -
\??\c:\jpdjd.exec:\jpdjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\lfrfrrf.exec:\lfrfrrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
\??\c:\9hbbnn.exec:\9hbbnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\hbhhtt.exec:\hbhhtt.exe17⤵
- Executes dropped EXE
PID:2492 -
\??\c:\pdvdp.exec:\pdvdp.exe18⤵
- Executes dropped EXE
PID:1044 -
\??\c:\rrlxlrf.exec:\rrlxlrf.exe19⤵
- Executes dropped EXE
PID:2656 -
\??\c:\xlxfffl.exec:\xlxfffl.exe20⤵
- Executes dropped EXE
PID:2128 -
\??\c:\5btbhh.exec:\5btbhh.exe21⤵
- Executes dropped EXE
PID:2036 -
\??\c:\pvjdj.exec:\pvjdj.exe22⤵
- Executes dropped EXE
PID:596 -
\??\c:\1jjvv.exec:\1jjvv.exe23⤵
- Executes dropped EXE
PID:1416 -
\??\c:\llfffll.exec:\llfffll.exe24⤵
- Executes dropped EXE
PID:1772 -
\??\c:\nbnthn.exec:\nbnthn.exe25⤵
- Executes dropped EXE
PID:2316 -
\??\c:\9nbhtt.exec:\9nbhtt.exe26⤵
- Executes dropped EXE
PID:328 -
\??\c:\7jddj.exec:\7jddj.exe27⤵
- Executes dropped EXE
PID:552 -
\??\c:\rfxxrxl.exec:\rfxxrxl.exe28⤵
- Executes dropped EXE
PID:912 -
\??\c:\tbnnbh.exec:\tbnnbh.exe29⤵
- Executes dropped EXE
PID:3052 -
\??\c:\nnttth.exec:\nnttth.exe30⤵
- Executes dropped EXE
PID:1640 -
\??\c:\vvpjj.exec:\vvpjj.exe31⤵
- Executes dropped EXE
PID:2228 -
\??\c:\lfrflxl.exec:\lfrflxl.exe32⤵
- Executes dropped EXE
PID:2012 -
\??\c:\bbthnn.exec:\bbthnn.exe33⤵
- Executes dropped EXE
PID:1748 -
\??\c:\nnhnbb.exec:\nnhnbb.exe34⤵
- Executes dropped EXE
PID:2376 -
\??\c:\9pddj.exec:\9pddj.exe35⤵
- Executes dropped EXE
PID:2648 -
\??\c:\7dddd.exec:\7dddd.exe36⤵
- Executes dropped EXE
PID:1532 -
\??\c:\9xxrxlx.exec:\9xxrxlx.exe37⤵
- Executes dropped EXE
PID:2756 -
\??\c:\xrrxrrx.exec:\xrrxrrx.exe38⤵
- Executes dropped EXE
PID:2436 -
\??\c:\nbnntt.exec:\nbnntt.exe39⤵
- Executes dropped EXE
PID:2688 -
\??\c:\jjvdd.exec:\jjvdd.exe40⤵
- Executes dropped EXE
PID:2284 -
\??\c:\fxrfllr.exec:\fxrfllr.exe41⤵
- Executes dropped EXE
PID:2672 -
\??\c:\1btbnt.exec:\1btbnt.exe42⤵
- Executes dropped EXE
PID:2420 -
\??\c:\7bnttt.exec:\7bnttt.exe43⤵
- Executes dropped EXE
PID:2832 -
\??\c:\vpddp.exec:\vpddp.exe44⤵
- Executes dropped EXE
PID:2444 -
\??\c:\pjvvd.exec:\pjvvd.exe45⤵
- Executes dropped EXE
PID:1896 -
\??\c:\5frlrrx.exec:\5frlrrx.exe46⤵
- Executes dropped EXE
PID:1884 -
\??\c:\9rxxrll.exec:\9rxxrll.exe47⤵
- Executes dropped EXE
PID:1464 -
\??\c:\7nbbbb.exec:\7nbbbb.exe48⤵
- Executes dropped EXE
PID:1516 -
\??\c:\9hbbnt.exec:\9hbbnt.exe49⤵
- Executes dropped EXE
PID:2324 -
\??\c:\ddpdp.exec:\ddpdp.exe50⤵
- Executes dropped EXE
PID:2380 -
\??\c:\vjpjp.exec:\vjpjp.exe51⤵
- Executes dropped EXE
PID:1428 -
\??\c:\xrflxxf.exec:\xrflxxf.exe52⤵
- Executes dropped EXE
PID:636 -
\??\c:\1rffrrf.exec:\1rffrrf.exe53⤵
- Executes dropped EXE
PID:1040 -
\??\c:\7hbbnb.exec:\7hbbnb.exe54⤵
- Executes dropped EXE
PID:1324 -
\??\c:\bntntt.exec:\bntntt.exe55⤵
- Executes dropped EXE
PID:1368 -
\??\c:\7dvdd.exec:\7dvdd.exe56⤵
- Executes dropped EXE
PID:2500 -
\??\c:\dpppd.exec:\dpppd.exe57⤵
- Executes dropped EXE
PID:2468 -
\??\c:\flflxrl.exec:\flflxrl.exe58⤵
- Executes dropped EXE
PID:1964 -
\??\c:\lrffrll.exec:\lrffrll.exe59⤵
- Executes dropped EXE
PID:2040 -
\??\c:\bnhhnh.exec:\bnhhnh.exe60⤵
- Executes dropped EXE
PID:2036 -
\??\c:\ppddj.exec:\ppddj.exe61⤵
- Executes dropped EXE
PID:596 -
\??\c:\vvddp.exec:\vvddp.exe62⤵
- Executes dropped EXE
PID:1020 -
\??\c:\lfrxfxl.exec:\lfrxfxl.exe63⤵
- Executes dropped EXE
PID:584 -
\??\c:\lfxxfxx.exec:\lfxxfxx.exe64⤵
- Executes dropped EXE
PID:1692 -
\??\c:\lfffrrf.exec:\lfffrrf.exe65⤵
- Executes dropped EXE
PID:2316 -
\??\c:\hbbthb.exec:\hbbthb.exe66⤵PID:328
-
\??\c:\bnhthh.exec:\bnhthh.exe67⤵PID:1552
-
\??\c:\5dppp.exec:\5dppp.exe68⤵PID:2776
-
\??\c:\7pdjj.exec:\7pdjj.exe69⤵PID:1720
-
\??\c:\xrrxfxl.exec:\xrrxfxl.exe70⤵PID:3052
-
\??\c:\rffrxrx.exec:\rffrxrx.exe71⤵PID:2248
-
\??\c:\ttnhtb.exec:\ttnhtb.exe72⤵PID:2212
-
\??\c:\5ppvv.exec:\5ppvv.exe73⤵PID:2076
-
\??\c:\jjjdd.exec:\jjjdd.exe74⤵PID:1788
-
\??\c:\frfrxfl.exec:\frfrxfl.exe75⤵PID:2572
-
\??\c:\xrlrxfr.exec:\xrlrxfr.exe76⤵PID:2376
-
\??\c:\5bnhhb.exec:\5bnhhb.exe77⤵PID:2660
-
\??\c:\tntbnn.exec:\tntbnn.exe78⤵PID:1532
-
\??\c:\hthnbt.exec:\hthnbt.exe79⤵PID:2556
-
\??\c:\ppvvp.exec:\ppvvp.exe80⤵PID:2680
-
\??\c:\9jvdv.exec:\9jvdv.exe81⤵PID:2708
-
\??\c:\lxlxxxf.exec:\lxlxxxf.exe82⤵PID:2596
-
\??\c:\9rlrrxf.exec:\9rlrrxf.exe83⤵PID:2428
-
\??\c:\9nntbh.exec:\9nntbh.exe84⤵PID:2420
-
\??\c:\hbnnbb.exec:\hbnnbb.exe85⤵PID:2888
-
\??\c:\5vpdv.exec:\5vpdv.exe86⤵PID:2360
-
\??\c:\vdppd.exec:\vdppd.exe87⤵PID:3060
-
\??\c:\5jpjj.exec:\5jpjj.exe88⤵PID:1884
-
\??\c:\9xrrxxf.exec:\9xrrxxf.exe89⤵PID:1776
-
\??\c:\5frrflx.exec:\5frrflx.exe90⤵PID:804
-
\??\c:\htbhnh.exec:\htbhnh.exe91⤵PID:2176
-
\??\c:\nhnnnn.exec:\nhnnnn.exe92⤵PID:2380
-
\??\c:\htbtbb.exec:\htbtbb.exe93⤵PID:2196
-
\??\c:\pdjdj.exec:\pdjdj.exe94⤵PID:636
-
\??\c:\dppjj.exec:\dppjj.exe95⤵PID:1592
-
\??\c:\dpvdd.exec:\dpvdd.exe96⤵PID:1324
-
\??\c:\5xrxrxf.exec:\5xrxrxf.exe97⤵PID:2412
-
\??\c:\rfllrrf.exec:\rfllrrf.exe98⤵PID:2500
-
\??\c:\bhbbnn.exec:\bhbbnn.exe99⤵PID:1984
-
\??\c:\bnnntt.exec:\bnnntt.exe100⤵PID:2812
-
\??\c:\hthhtt.exec:\hthhtt.exe101⤵PID:692
-
\??\c:\vpdpd.exec:\vpdpd.exe102⤵PID:2036
-
\??\c:\dvjjd.exec:\dvjjd.exe103⤵PID:644
-
\??\c:\9vjpv.exec:\9vjpv.exe104⤵PID:1020
-
\??\c:\xlxxxrr.exec:\xlxxxrr.exe105⤵PID:1736
-
\??\c:\9ffxlrx.exec:\9ffxlrx.exe106⤵PID:1692
-
\??\c:\bnbhtb.exec:\bnbhtb.exe107⤵PID:452
-
\??\c:\nhnhhb.exec:\nhnhhb.exe108⤵PID:328
-
\??\c:\dpvvj.exec:\dpvvj.exe109⤵PID:924
-
\??\c:\vjdjd.exec:\vjdjd.exe110⤵PID:2776
-
\??\c:\lxrxrrr.exec:\lxrxrrr.exe111⤵PID:2384
-
\??\c:\fffrxlr.exec:\fffrxlr.exe112⤵PID:572
-
\??\c:\llflrxf.exec:\llflrxf.exe113⤵PID:2028
-
\??\c:\thntbb.exec:\thntbb.exe114⤵PID:2212
-
\??\c:\9htbhb.exec:\9htbhb.exe115⤵PID:1976
-
\??\c:\pvvjv.exec:\pvvjv.exe116⤵PID:1788
-
\??\c:\5jdpv.exec:\5jdpv.exe117⤵PID:3008
-
\??\c:\1dpjj.exec:\1dpjj.exe118⤵PID:2376
-
\??\c:\rlxlxfl.exec:\rlxlxfl.exe119⤵PID:2648
-
\??\c:\5xrfrlf.exec:\5xrfrlf.exe120⤵PID:2932
-
\??\c:\bnbbhh.exec:\bnbbhh.exe121⤵PID:2696
-
\??\c:\bnbbhh.exec:\bnbbhh.exe122⤵PID:2436
-
\??\c:\1tbnnn.exec:\1tbnnn.exe123⤵PID:2464
-
\??\c:\jjvdv.exec:\jjvdv.exe124⤵PID:2432
-
\??\c:\jjdjv.exec:\jjdjv.exe125⤵PID:2552
-
\??\c:\rlxxxxx.exec:\rlxxxxx.exe126⤵PID:2488
-
\??\c:\fxlrrxr.exec:\fxlrrxr.exe127⤵PID:2344
-
\??\c:\nhtntn.exec:\nhtntn.exe128⤵PID:3012
-
\??\c:\nbhbbn.exec:\nbhbbn.exe129⤵PID:1460
-
\??\c:\5vpvv.exec:\5vpvv.exe130⤵PID:1456
-
\??\c:\ddjdp.exec:\ddjdp.exe131⤵PID:1268
-
\??\c:\vdjdd.exec:\vdjdd.exe132⤵PID:800
-
\??\c:\9lrrrrx.exec:\9lrrrrx.exe133⤵PID:1768
-
\??\c:\9frfrrf.exec:\9frfrrf.exe134⤵PID:1568
-
\??\c:\nhtttb.exec:\nhtttb.exe135⤵PID:1624
-
\??\c:\bnbbtt.exec:\bnbbtt.exe136⤵PID:1600
-
\??\c:\5fxxffl.exec:\5fxxffl.exe137⤵PID:1180
-
\??\c:\bnhbhn.exec:\bnhbhn.exe138⤵PID:2492
-
\??\c:\bnbnbb.exec:\bnbnbb.exe139⤵PID:2736
-
\??\c:\dpdvv.exec:\dpdvv.exe140⤵PID:2608
-
\??\c:\dvdjp.exec:\dvdjp.exe141⤵PID:3064
-
\??\c:\fxllrrr.exec:\fxllrrr.exe142⤵PID:540
-
\??\c:\1rllrrx.exec:\1rllrrx.exe143⤵PID:1424
-
\??\c:\rfllrrr.exec:\rfllrrr.exe144⤵PID:1220
-
\??\c:\tnntbb.exec:\tnntbb.exe145⤵PID:1064
-
\??\c:\bbttbt.exec:\bbttbt.exe146⤵PID:1052
-
\??\c:\pdpvv.exec:\pdpvv.exe147⤵PID:1440
-
\??\c:\vjvpd.exec:\vjvpd.exe148⤵PID:3028
-
\??\c:\jvddd.exec:\jvddd.exe149⤵PID:2244
-
\??\c:\3lfflfl.exec:\3lfflfl.exe150⤵PID:768
-
\??\c:\frrfllr.exec:\frrfllr.exe151⤵PID:2216
-
\??\c:\nbnhhh.exec:\nbnhhh.exe152⤵PID:2268
-
\??\c:\jvdjd.exec:\jvdjd.exe153⤵PID:2896
-
\??\c:\1jvdj.exec:\1jvdj.exe154⤵PID:1968
-
\??\c:\fxffrrf.exec:\fxffrrf.exe155⤵PID:1436
-
\??\c:\rfrxffl.exec:\rfrxffl.exe156⤵PID:2052
-
\??\c:\5rfffxf.exec:\5rfffxf.exe157⤵PID:1944
-
\??\c:\3nnnnn.exec:\3nnnnn.exe158⤵PID:2524
-
\??\c:\bnhbbt.exec:\bnhbbt.exe159⤵PID:2968
-
\??\c:\pjdpp.exec:\pjdpp.exe160⤵PID:1540
-
\??\c:\3jvvp.exec:\3jvvp.exe161⤵PID:2588
-
\??\c:\xlrxxlx.exec:\xlrxxlx.exe162⤵PID:2760
-
\??\c:\frffllr.exec:\frffllr.exe163⤵PID:2548
-
\??\c:\nhttbt.exec:\nhttbt.exe164⤵PID:2436
-
\??\c:\bthnnn.exec:\bthnnn.exe165⤵PID:2600
-
\??\c:\pjpvp.exec:\pjpvp.exe166⤵PID:2440
-
\??\c:\pjpvj.exec:\pjpvj.exe167⤵PID:2552
-
\??\c:\xrlrflx.exec:\xrlrflx.exe168⤵PID:2308
-
\??\c:\xfflrrx.exec:\xfflrrx.exe169⤵PID:1660
-
\??\c:\dvdpd.exec:\dvdpd.exe170⤵PID:1144
-
\??\c:\1xrxflx.exec:\1xrxflx.exe171⤵PID:1460
-
\??\c:\llxxfrx.exec:\llxxfrx.exe172⤵PID:1456
-
\??\c:\9rrxflr.exec:\9rrxflr.exe173⤵PID:2328
-
\??\c:\ttnbnb.exec:\ttnbnb.exe174⤵PID:800
-
\??\c:\ppjvp.exec:\ppjvp.exe175⤵PID:284
-
\??\c:\vvppv.exec:\vvppv.exe176⤵PID:1620
-
\??\c:\5xlrrfl.exec:\5xlrrfl.exe177⤵PID:1364
-
\??\c:\1rlfllx.exec:\1rlfllx.exe178⤵PID:1600
-
\??\c:\hhnhbn.exec:\hhnhbn.exe179⤵PID:2844
-
\??\c:\nhtbnt.exec:\nhtbnt.exe180⤵PID:1228
-
\??\c:\ddpdp.exec:\ddpdp.exe181⤵PID:2828
-
\??\c:\jdvjv.exec:\jdvjv.exe182⤵PID:2608
-
\??\c:\ffrrrfl.exec:\ffrrrfl.exe183⤵PID:2528
-
\??\c:\xrlxlrx.exec:\xrlxlrx.exe184⤵PID:540
-
\??\c:\3rrfxfr.exec:\3rrfxfr.exe185⤵PID:1408
-
\??\c:\bnhntb.exec:\bnhntb.exe186⤵PID:1220
-
\??\c:\bnnbbb.exec:\bnnbbb.exe187⤵PID:1816
-
\??\c:\jjdvj.exec:\jjdvj.exe188⤵PID:2400
-
\??\c:\5ffrrxf.exec:\5ffrrxf.exe189⤵PID:1740
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe190⤵PID:3028
-
\??\c:\1nhnbb.exec:\1nhnbb.exe191⤵PID:2780
-
\??\c:\bthtbh.exec:\bthtbh.exe192⤵PID:768
-
\??\c:\vvppj.exec:\vvppj.exe193⤵PID:920
-
\??\c:\pjvjv.exec:\pjvjv.exe194⤵PID:2268
-
\??\c:\rllfrfr.exec:\rllfrfr.exe195⤵PID:2020
-
\??\c:\xxlflrf.exec:\xxlflrf.exe196⤵PID:1968
-
\??\c:\bhbbtb.exec:\bhbbtb.exe197⤵PID:1280
-
\??\c:\nhhbbn.exec:\nhhbbn.exe198⤵PID:2700
-
\??\c:\dvvvd.exec:\dvvvd.exe199⤵PID:2152
-
\??\c:\rrllrxl.exec:\rrllrxl.exe200⤵PID:2524
-
\??\c:\7xrxlrx.exec:\7xrxlrx.exe201⤵PID:2616
-
\??\c:\nbntbn.exec:\nbntbn.exe202⤵PID:1540
-
\??\c:\1btbnn.exec:\1btbnn.exe203⤵PID:2580
-
\??\c:\bbtnht.exec:\bbtnht.exe204⤵PID:2576
-
\??\c:\5dvjp.exec:\5dvjp.exe205⤵PID:2452
-
\??\c:\ddvpv.exec:\ddvpv.exe206⤵PID:2724
-
\??\c:\llfxxxf.exec:\llfxxxf.exe207⤵PID:2464
-
\??\c:\rrxlxfr.exec:\rrxlxfr.exe208⤵PID:2296
-
\??\c:\tnbhtt.exec:\tnbhtt.exe209⤵PID:2504
-
\??\c:\jvdjd.exec:\jvdjd.exe210⤵PID:2360
-
\??\c:\jddpd.exec:\jddpd.exe211⤵PID:2344
-
\??\c:\fxllxfl.exec:\fxllxfl.exe212⤵PID:2180
-
\??\c:\lfrxffr.exec:\lfrxffr.exe213⤵PID:1460
-
\??\c:\7hhtbh.exec:\7hhtbh.exe214⤵PID:804
-
\??\c:\bthnbn.exec:\bthnbn.exe215⤵PID:2328
-
\??\c:\vvpvj.exec:\vvpvj.exe216⤵PID:1644
-
\??\c:\3vpdd.exec:\3vpdd.exe217⤵PID:284
-
\??\c:\ffrxffr.exec:\ffrxffr.exe218⤵PID:1248
-
\??\c:\rrrxfrx.exec:\rrrxfrx.exe219⤵PID:1624
-
\??\c:\tnhhnh.exec:\tnhhnh.exe220⤵PID:1368
-
\??\c:\bbnnth.exec:\bbnnth.exe221⤵PID:2844
-
\??\c:\3pdjp.exec:\3pdjp.exe222⤵PID:1228
-
\??\c:\7dvdp.exec:\7dvdp.exe223⤵PID:2828
-
\??\c:\xrlrxfx.exec:\xrlrxfx.exe224⤵PID:2040
-
\??\c:\frflrrl.exec:\frflrrl.exe225⤵PID:2528
-
\??\c:\nnthtb.exec:\nnthtb.exe226⤵PID:540
-
\??\c:\bbbbnn.exec:\bbbbnn.exe227⤵PID:1408
-
\??\c:\jddjp.exec:\jddjp.exe228⤵PID:1020
-
\??\c:\pvjjv.exec:\pvjjv.exe229⤵PID:1816
-
\??\c:\7llflrr.exec:\7llflrr.exe230⤵PID:1692
-
\??\c:\3xlfrrr.exec:\3xlfrrr.exe231⤵PID:1740
-
\??\c:\rxxlxxr.exec:\rxxlxxr.exe232⤵PID:552
-
\??\c:\htbthh.exec:\htbthh.exe233⤵PID:2780
-
\??\c:\7bthtb.exec:\7bthtb.exe234⤵PID:768
-
\??\c:\jjdjp.exec:\jjdjp.exe235⤵PID:920
-
\??\c:\pjdpp.exec:\pjdpp.exe236⤵PID:2268
-
\??\c:\1lrrxlx.exec:\1lrrxlx.exe237⤵PID:2020
-
\??\c:\rlflllr.exec:\rlflllr.exe238⤵PID:2560
-
\??\c:\bnbbhh.exec:\bnbbhh.exe239⤵PID:1280
-
\??\c:\ttthbh.exec:\ttthbh.exe240⤵PID:1748
-
\??\c:\vpddp.exec:\vpddp.exe241⤵PID:2152
-
\??\c:\3vvpj.exec:\3vvpj.exe242⤵PID:2524