Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 15:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e3dacc19ed3055db861e1d434e271b00_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
e3dacc19ed3055db861e1d434e271b00_NeikiAnalytics.exe
-
Size
140KB
-
MD5
e3dacc19ed3055db861e1d434e271b00
-
SHA1
8d3bb19eeef76fa112ff562a205745c9bb47be0b
-
SHA256
5a96dfe9c324fab00ea6a92f61aa8cb99ec3b3b8e6547c9cc6c60e6e47bfabaa
-
SHA512
44132fadb49d55b67abcb9c0c301c833cb1291dc6a82826407973fb692b98bfc40b85249f49713fe9561c1c9981a7ca2c175e8d4d93bd91c88563864eb3ca03a
-
SSDEEP
3072:ymb3NkkiQ3mdBjFomR7UsyJC+n0Gsgyek10:n3C9BRomRph+0GsgyeY0
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral1/memory/2424-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1508-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-49-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/304-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/912-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/800-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1660-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2984-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/484-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1988-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1792-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2244-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1492-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
dddpd.exerfrlrxl.exe7xllxlr.exe1jvjv.exejvjjp.exe5rrrffx.exebntthb.exevpvvd.exexrfrffl.exe1llrrrf.exetnhthn.exeppvjj.exe3fxrfrl.exenhnnnn.exehbhthn.exe3jpvd.exe1flrffl.exennhhnn.exe9thttt.exedvdjv.exefxflrxl.exethtbnn.exe5bnhhh.exe1pvdp.exedvdvp.exeffxlfrf.exenhbhtt.exehththt.exeddjvj.exerffrxrr.exehbhntt.exe1vddj.exeffrxrrf.exe7lxxlll.exebththn.exetnttbb.exevpjpp.exe9pjjj.exelxlrfll.exelxrrxfl.exe3bnhnn.exe5dpvd.exe3pjvj.exexrfflrx.exerlxrffr.exe7bbbhn.exehbhnbb.exe5vdvd.exedpdpp.exelfxxrrf.exe7xllrrf.exehthhnn.exe7hnhhn.exevpjjj.exe3jddv.exexrffrrx.exerlrxflx.exe1tbbhh.exe3bbbnt.exeddjjp.exelfllxxl.exexlllrxl.exebnbtbb.exetntbhh.exepid process 1508 dddpd.exe 2612 rfrlrxl.exe 2812 7xllxlr.exe 2628 1jvjv.exe 2840 jvjjp.exe 304 5rrrffx.exe 2524 bntthb.exe 2692 vpvvd.exe 2088 xrfrffl.exe 2860 1llrrrf.exe 2940 tnhthn.exe 2728 ppvjj.exe 2408 3fxrfrl.exe 912 nhnnnn.exe 800 hbhthn.exe 2896 3jpvd.exe 280 1flrffl.exe 1660 nnhhnn.exe 3020 9thttt.exe 2504 dvdjv.exe 2984 fxflrxl.exe 484 thtbnn.exe 684 5bnhhh.exe 2384 1pvdp.exe 1816 dvdvp.exe 1988 ffxlfrf.exe 1792 nhbhtt.exe 3000 hththt.exe 1720 ddjvj.exe 2244 rffrxrr.exe 1492 hbhntt.exe 2420 1vddj.exe 2212 ffrxrrf.exe 1732 7lxxlll.exe 2820 bththn.exe 2656 tnttbb.exe 1572 vpjpp.exe 1736 9pjjj.exe 1712 lxlrfll.exe 2544 lxrrxfl.exe 2576 3bnhnn.exe 2768 5dpvd.exe 988 3pjvj.exe 1284 xrfflrx.exe 2852 rlxrffr.exe 2908 7bbbhn.exe 3060 hbhnbb.exe 2740 5vdvd.exe 624 dpdpp.exe 1964 lfxxrrf.exe 2496 7xllrrf.exe 1836 hthhnn.exe 2580 7hnhhn.exe 2008 vpjjj.exe 1696 3jddv.exe 2128 xrffrrx.exe 2980 rlrxflx.exe 2064 1tbbhh.exe 2456 3bbbnt.exe 572 ddjjp.exe 484 lfllxxl.exe 1688 xlllrxl.exe 2056 bnbtbb.exe 1516 tntbhh.exe -
Processes:
resource yara_rule behavioral1/memory/2424-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1508-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/304-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/912-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/800-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/484-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1988-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2244-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1492-296-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e3dacc19ed3055db861e1d434e271b00_NeikiAnalytics.exedddpd.exerfrlrxl.exe7xllxlr.exe1jvjv.exejvjjp.exe5rrrffx.exebntthb.exevpvvd.exexrfrffl.exe1llrrrf.exetnhthn.exeppvjj.exe3fxrfrl.exenhnnnn.exehbhthn.exedescription pid process target process PID 2424 wrote to memory of 1508 2424 e3dacc19ed3055db861e1d434e271b00_NeikiAnalytics.exe dddpd.exe PID 2424 wrote to memory of 1508 2424 e3dacc19ed3055db861e1d434e271b00_NeikiAnalytics.exe dddpd.exe PID 2424 wrote to memory of 1508 2424 e3dacc19ed3055db861e1d434e271b00_NeikiAnalytics.exe dddpd.exe PID 2424 wrote to memory of 1508 2424 e3dacc19ed3055db861e1d434e271b00_NeikiAnalytics.exe dddpd.exe PID 1508 wrote to memory of 2612 1508 dddpd.exe rfrlrxl.exe PID 1508 wrote to memory of 2612 1508 dddpd.exe rfrlrxl.exe PID 1508 wrote to memory of 2612 1508 dddpd.exe rfrlrxl.exe PID 1508 wrote to memory of 2612 1508 dddpd.exe rfrlrxl.exe PID 2612 wrote to memory of 2812 2612 rfrlrxl.exe 7xllxlr.exe PID 2612 wrote to memory of 2812 2612 rfrlrxl.exe 7xllxlr.exe PID 2612 wrote to memory of 2812 2612 rfrlrxl.exe 7xllxlr.exe PID 2612 wrote to memory of 2812 2612 rfrlrxl.exe 7xllxlr.exe PID 2812 wrote to memory of 2628 2812 7xllxlr.exe 1jvjv.exe PID 2812 wrote to memory of 2628 2812 7xllxlr.exe 1jvjv.exe PID 2812 wrote to memory of 2628 2812 7xllxlr.exe 1jvjv.exe PID 2812 wrote to memory of 2628 2812 7xllxlr.exe 1jvjv.exe PID 2628 wrote to memory of 2840 2628 1jvjv.exe jvjjp.exe PID 2628 wrote to memory of 2840 2628 1jvjv.exe jvjjp.exe PID 2628 wrote to memory of 2840 2628 1jvjv.exe jvjjp.exe PID 2628 wrote to memory of 2840 2628 1jvjv.exe jvjjp.exe PID 2840 wrote to memory of 304 2840 jvjjp.exe 5rrrffx.exe PID 2840 wrote to memory of 304 2840 jvjjp.exe 5rrrffx.exe PID 2840 wrote to memory of 304 2840 jvjjp.exe 5rrrffx.exe PID 2840 wrote to memory of 304 2840 jvjjp.exe 5rrrffx.exe PID 304 wrote to memory of 2524 304 5rrrffx.exe bntthb.exe PID 304 wrote to memory of 2524 304 5rrrffx.exe bntthb.exe PID 304 wrote to memory of 2524 304 5rrrffx.exe bntthb.exe PID 304 wrote to memory of 2524 304 5rrrffx.exe bntthb.exe PID 2524 wrote to memory of 2692 2524 bntthb.exe vpvvd.exe PID 2524 wrote to memory of 2692 2524 bntthb.exe vpvvd.exe PID 2524 wrote to memory of 2692 2524 bntthb.exe vpvvd.exe PID 2524 wrote to memory of 2692 2524 bntthb.exe vpvvd.exe PID 2692 wrote to memory of 2088 2692 vpvvd.exe xrfrffl.exe PID 2692 wrote to memory of 2088 2692 vpvvd.exe xrfrffl.exe PID 2692 wrote to memory of 2088 2692 vpvvd.exe xrfrffl.exe PID 2692 wrote to memory of 2088 2692 vpvvd.exe xrfrffl.exe PID 2088 wrote to memory of 2860 2088 xrfrffl.exe 1llrrrf.exe PID 2088 wrote to memory of 2860 2088 xrfrffl.exe 1llrrrf.exe PID 2088 wrote to memory of 2860 2088 xrfrffl.exe 1llrrrf.exe PID 2088 wrote to memory of 2860 2088 xrfrffl.exe 1llrrrf.exe PID 2860 wrote to memory of 2940 2860 1llrrrf.exe tnhthn.exe PID 2860 wrote to memory of 2940 2860 1llrrrf.exe tnhthn.exe PID 2860 wrote to memory of 2940 2860 1llrrrf.exe tnhthn.exe PID 2860 wrote to memory of 2940 2860 1llrrrf.exe tnhthn.exe PID 2940 wrote to memory of 2728 2940 tnhthn.exe ppvjj.exe PID 2940 wrote to memory of 2728 2940 tnhthn.exe ppvjj.exe PID 2940 wrote to memory of 2728 2940 tnhthn.exe ppvjj.exe PID 2940 wrote to memory of 2728 2940 tnhthn.exe ppvjj.exe PID 2728 wrote to memory of 2408 2728 ppvjj.exe 3fxrfrl.exe PID 2728 wrote to memory of 2408 2728 ppvjj.exe 3fxrfrl.exe PID 2728 wrote to memory of 2408 2728 ppvjj.exe 3fxrfrl.exe PID 2728 wrote to memory of 2408 2728 ppvjj.exe 3fxrfrl.exe PID 2408 wrote to memory of 912 2408 3fxrfrl.exe nhnnnn.exe PID 2408 wrote to memory of 912 2408 3fxrfrl.exe nhnnnn.exe PID 2408 wrote to memory of 912 2408 3fxrfrl.exe nhnnnn.exe PID 2408 wrote to memory of 912 2408 3fxrfrl.exe nhnnnn.exe PID 912 wrote to memory of 800 912 nhnnnn.exe hbhthn.exe PID 912 wrote to memory of 800 912 nhnnnn.exe hbhthn.exe PID 912 wrote to memory of 800 912 nhnnnn.exe hbhthn.exe PID 912 wrote to memory of 800 912 nhnnnn.exe hbhthn.exe PID 800 wrote to memory of 2896 800 hbhthn.exe 3jpvd.exe PID 800 wrote to memory of 2896 800 hbhthn.exe 3jpvd.exe PID 800 wrote to memory of 2896 800 hbhthn.exe 3jpvd.exe PID 800 wrote to memory of 2896 800 hbhthn.exe 3jpvd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3dacc19ed3055db861e1d434e271b00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e3dacc19ed3055db861e1d434e271b00_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\dddpd.exec:\dddpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\rfrlrxl.exec:\rfrlrxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\7xllxlr.exec:\7xllxlr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\1jvjv.exec:\1jvjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\jvjjp.exec:\jvjjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\5rrrffx.exec:\5rrrffx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:304 -
\??\c:\bntthb.exec:\bntthb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\vpvvd.exec:\vpvvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\xrfrffl.exec:\xrfrffl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\1llrrrf.exec:\1llrrrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\tnhthn.exec:\tnhthn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\ppvjj.exec:\ppvjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\3fxrfrl.exec:\3fxrfrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\nhnnnn.exec:\nhnnnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\hbhthn.exec:\hbhthn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
\??\c:\3jpvd.exec:\3jpvd.exe17⤵
- Executes dropped EXE
PID:2896 -
\??\c:\1flrffl.exec:\1flrffl.exe18⤵
- Executes dropped EXE
PID:280 -
\??\c:\nnhhnn.exec:\nnhhnn.exe19⤵
- Executes dropped EXE
PID:1660 -
\??\c:\9thttt.exec:\9thttt.exe20⤵
- Executes dropped EXE
PID:3020 -
\??\c:\dvdjv.exec:\dvdjv.exe21⤵
- Executes dropped EXE
PID:2504 -
\??\c:\fxflrxl.exec:\fxflrxl.exe22⤵
- Executes dropped EXE
PID:2984 -
\??\c:\thtbnn.exec:\thtbnn.exe23⤵
- Executes dropped EXE
PID:484 -
\??\c:\5bnhhh.exec:\5bnhhh.exe24⤵
- Executes dropped EXE
PID:684 -
\??\c:\1pvdp.exec:\1pvdp.exe25⤵
- Executes dropped EXE
PID:2384 -
\??\c:\dvdvp.exec:\dvdvp.exe26⤵
- Executes dropped EXE
PID:1816 -
\??\c:\ffxlfrf.exec:\ffxlfrf.exe27⤵
- Executes dropped EXE
PID:1988 -
\??\c:\nhbhtt.exec:\nhbhtt.exe28⤵
- Executes dropped EXE
PID:1792 -
\??\c:\hththt.exec:\hththt.exe29⤵
- Executes dropped EXE
PID:3000 -
\??\c:\ddjvj.exec:\ddjvj.exe30⤵
- Executes dropped EXE
PID:1720 -
\??\c:\rffrxrr.exec:\rffrxrr.exe31⤵
- Executes dropped EXE
PID:2244 -
\??\c:\hbhntt.exec:\hbhntt.exe32⤵
- Executes dropped EXE
PID:1492 -
\??\c:\1vddj.exec:\1vddj.exe33⤵
- Executes dropped EXE
PID:2420 -
\??\c:\ffrxrrf.exec:\ffrxrrf.exe34⤵
- Executes dropped EXE
PID:2212 -
\??\c:\7lxxlll.exec:\7lxxlll.exe35⤵
- Executes dropped EXE
PID:1732 -
\??\c:\bththn.exec:\bththn.exe36⤵
- Executes dropped EXE
PID:2820 -
\??\c:\tnttbb.exec:\tnttbb.exe37⤵
- Executes dropped EXE
PID:2656 -
\??\c:\vpjpp.exec:\vpjpp.exe38⤵
- Executes dropped EXE
PID:1572 -
\??\c:\9pjjj.exec:\9pjjj.exe39⤵
- Executes dropped EXE
PID:1736 -
\??\c:\lxlrfll.exec:\lxlrfll.exe40⤵
- Executes dropped EXE
PID:1712 -
\??\c:\lxrrxfl.exec:\lxrrxfl.exe41⤵
- Executes dropped EXE
PID:2544 -
\??\c:\3bnhnn.exec:\3bnhnn.exe42⤵
- Executes dropped EXE
PID:2576 -
\??\c:\5dpvd.exec:\5dpvd.exe43⤵
- Executes dropped EXE
PID:2768 -
\??\c:\3pjvj.exec:\3pjvj.exe44⤵
- Executes dropped EXE
PID:988 -
\??\c:\xrfflrx.exec:\xrfflrx.exe45⤵
- Executes dropped EXE
PID:1284 -
\??\c:\rlxrffr.exec:\rlxrffr.exe46⤵
- Executes dropped EXE
PID:2852 -
\??\c:\7bbbhn.exec:\7bbbhn.exe47⤵
- Executes dropped EXE
PID:2908 -
\??\c:\hbhnbb.exec:\hbhnbb.exe48⤵
- Executes dropped EXE
PID:3060 -
\??\c:\5vdvd.exec:\5vdvd.exe49⤵
- Executes dropped EXE
PID:2740 -
\??\c:\dpdpp.exec:\dpdpp.exe50⤵
- Executes dropped EXE
PID:624 -
\??\c:\lfxxrrf.exec:\lfxxrrf.exe51⤵
- Executes dropped EXE
PID:1964 -
\??\c:\7xllrrf.exec:\7xllrrf.exe52⤵
- Executes dropped EXE
PID:2496 -
\??\c:\hthhnn.exec:\hthhnn.exe53⤵
- Executes dropped EXE
PID:1836 -
\??\c:\7hnhhn.exec:\7hnhhn.exe54⤵
- Executes dropped EXE
PID:2580 -
\??\c:\vpjjj.exec:\vpjjj.exe55⤵
- Executes dropped EXE
PID:2008 -
\??\c:\3jddv.exec:\3jddv.exe56⤵
- Executes dropped EXE
PID:1696 -
\??\c:\xrffrrx.exec:\xrffrrx.exe57⤵
- Executes dropped EXE
PID:2128 -
\??\c:\rlrxflx.exec:\rlrxflx.exe58⤵
- Executes dropped EXE
PID:2980 -
\??\c:\1tbbhh.exec:\1tbbhh.exe59⤵
- Executes dropped EXE
PID:2064 -
\??\c:\3bbbnt.exec:\3bbbnt.exe60⤵
- Executes dropped EXE
PID:2456 -
\??\c:\ddjjp.exec:\ddjjp.exe61⤵
- Executes dropped EXE
PID:572 -
\??\c:\lfllxxl.exec:\lfllxxl.exe62⤵
- Executes dropped EXE
PID:484 -
\??\c:\xlllrxl.exec:\xlllrxl.exe63⤵
- Executes dropped EXE
PID:1688 -
\??\c:\bnbtbb.exec:\bnbtbb.exe64⤵
- Executes dropped EXE
PID:2056 -
\??\c:\tntbhh.exec:\tntbhh.exe65⤵
- Executes dropped EXE
PID:1516 -
\??\c:\jdjpv.exec:\jdjpv.exe66⤵PID:1768
-
\??\c:\frxxllr.exec:\frxxllr.exe67⤵PID:964
-
\??\c:\xxllxfl.exec:\xxllxfl.exe68⤵PID:856
-
\??\c:\1tntbb.exec:\1tntbb.exe69⤵PID:1632
-
\??\c:\hbntnn.exec:\hbntnn.exe70⤵PID:1664
-
\??\c:\vpddj.exec:\vpddj.exe71⤵PID:2044
-
\??\c:\3dvvd.exec:\3dvvd.exe72⤵PID:888
-
\??\c:\fxllrrl.exec:\fxllrrl.exe73⤵PID:2188
-
\??\c:\xrxfllx.exec:\xrxfllx.exe74⤵PID:2428
-
\??\c:\btbhbb.exec:\btbhbb.exe75⤵PID:2012
-
\??\c:\hbnthb.exec:\hbnthb.exe76⤵PID:2652
-
\??\c:\jjddv.exec:\jjddv.exe77⤵PID:2632
-
\??\c:\9xxlfxl.exec:\9xxlfxl.exe78⤵PID:2640
-
\??\c:\fxlrxlx.exec:\fxlrxlx.exe79⤵PID:1728
-
\??\c:\5htbnt.exec:\5htbnt.exe80⤵PID:1544
-
\??\c:\tnbbhn.exec:\tnbbhn.exe81⤵PID:2832
-
\??\c:\7jvpv.exec:\7jvpv.exe82⤵PID:304
-
\??\c:\vpvvv.exec:\vpvvv.exe83⤵PID:2540
-
\??\c:\lfrrfrx.exec:\lfrrfrx.exe84⤵PID:2576
-
\??\c:\7thhtt.exec:\7thhtt.exe85⤵PID:2516
-
\??\c:\hbntnt.exec:\hbntnt.exe86⤵PID:2260
-
\??\c:\7dppv.exec:\7dppv.exe87⤵PID:2732
-
\??\c:\7jdpv.exec:\7jdpv.exe88⤵PID:2860
-
\??\c:\rlxxllx.exec:\rlxxllx.exe89⤵PID:3040
-
\??\c:\fxflffr.exec:\fxflffr.exe90⤵PID:2936
-
\??\c:\bbnthn.exec:\bbnthn.exe91⤵PID:2748
-
\??\c:\dvjdp.exec:\dvjdp.exe92⤵PID:1628
-
\??\c:\ddjjj.exec:\ddjjj.exe93⤵PID:2756
-
\??\c:\xlllrrl.exec:\xlllrrl.exe94⤵PID:2752
-
\??\c:\lfrxllx.exec:\lfrxllx.exe95⤵PID:1316
-
\??\c:\9nhnhh.exec:\9nhnhh.exe96⤵PID:1748
-
\??\c:\7nhhtt.exec:\7nhhtt.exe97⤵PID:2312
-
\??\c:\vpddv.exec:\vpddv.exe98⤵PID:1696
-
\??\c:\5lxxxxf.exec:\5lxxxxf.exe99⤵PID:2880
-
\??\c:\5fxlrxr.exec:\5fxlrxr.exe100⤵PID:1864
-
\??\c:\bthhtb.exec:\bthhtb.exe101⤵PID:536
-
\??\c:\1thhnh.exec:\1thhnh.exe102⤵PID:1268
-
\??\c:\3vjvj.exec:\3vjvj.exe103⤵PID:1152
-
\??\c:\rlxlxfx.exec:\rlxlxfx.exe104⤵PID:1668
-
\??\c:\9lflxff.exec:\9lflxff.exe105⤵PID:2464
-
\??\c:\bhttnt.exec:\bhttnt.exe106⤵PID:2300
-
\??\c:\9jpdp.exec:\9jpdp.exe107⤵PID:1388
-
\??\c:\vvvpj.exec:\vvvpj.exe108⤵PID:1976
-
\??\c:\fxllrlr.exec:\fxllrlr.exe109⤵PID:1792
-
\??\c:\3xrrffr.exec:\3xrrffr.exe110⤵PID:2952
-
\??\c:\lfrlxxl.exec:\lfrlxxl.exe111⤵PID:2848
-
\??\c:\bbtnnb.exec:\bbtnnb.exe112⤵PID:2164
-
\??\c:\dvjjp.exec:\dvjjp.exe113⤵PID:1772
-
\??\c:\ddvdj.exec:\ddvdj.exe114⤵PID:888
-
\??\c:\lflffxf.exec:\lflffxf.exe115⤵PID:1888
-
\??\c:\xrrrxfl.exec:\xrrrxfl.exe116⤵PID:1052
-
\??\c:\nhtbnn.exec:\nhtbnn.exe117⤵PID:2224
-
\??\c:\jdppv.exec:\jdppv.exe118⤵PID:2628
-
\??\c:\vvjjv.exec:\vvjjv.exe119⤵PID:2672
-
\??\c:\5ffrxfl.exec:\5ffrxfl.exe120⤵PID:2080
-
\??\c:\fxlrxxl.exec:\fxlrxxl.exe121⤵PID:1576
-
\??\c:\hbtntb.exec:\hbtntb.exe122⤵PID:2764
-
\??\c:\ttnhtn.exec:\ttnhtn.exe123⤵PID:2676
-
\??\c:\ppdpj.exec:\ppdpj.exe124⤵PID:2532
-
\??\c:\9fxxffr.exec:\9fxxffr.exe125⤵PID:2552
-
\??\c:\xrlrlfx.exec:\xrlrlfx.exe126⤵PID:2824
-
\??\c:\9nbbnn.exec:\9nbbnn.exe127⤵PID:2524
-
\??\c:\9pvjv.exec:\9pvjv.exe128⤵PID:1764
-
\??\c:\3ppvv.exec:\3ppvv.exe129⤵PID:2884
-
\??\c:\frrrxxl.exec:\frrrxxl.exe130⤵PID:812
-
\??\c:\rfrflrf.exec:\rfrflrf.exe131⤵PID:3048
-
\??\c:\hhhnhn.exec:\hhhnhn.exe132⤵PID:2040
-
\??\c:\jjdjp.exec:\jjdjp.exe133⤵PID:2508
-
\??\c:\jjdjv.exec:\jjdjv.exe134⤵PID:2712
-
\??\c:\7rlrlxl.exec:\7rlrlxl.exe135⤵PID:2704
-
\??\c:\llrlxfr.exec:\llrlxfr.exe136⤵PID:2904
-
\??\c:\nnhhnh.exec:\nnhhnh.exe137⤵PID:656
-
\??\c:\9bthtt.exec:\9bthtt.exe138⤵PID:280
-
\??\c:\ppdjj.exec:\ppdjj.exe139⤵PID:896
-
\??\c:\fxrrfxl.exec:\fxrrfxl.exe140⤵PID:852
-
\??\c:\fxflfrx.exec:\fxflfrx.exe141⤵PID:2888
-
\??\c:\btbhbb.exec:\btbhbb.exe142⤵PID:2280
-
\??\c:\1pdjp.exec:\1pdjp.exe143⤵PID:668
-
\??\c:\ddvvp.exec:\ddvvp.exe144⤵PID:1040
-
\??\c:\rlxfrxf.exec:\rlxfrxf.exe145⤵PID:696
-
\??\c:\9fllffr.exec:\9fllffr.exe146⤵PID:2052
-
\??\c:\bhbhtt.exec:\bhbhtt.exe147⤵PID:2384
-
\??\c:\btnthn.exec:\btnthn.exe148⤵PID:904
-
\??\c:\vvjdp.exec:\vvjdp.exe149⤵PID:1352
-
\??\c:\fxrrxxf.exec:\fxrrxxf.exe150⤵PID:1620
-
\??\c:\rfxxrxx.exec:\rfxxrxx.exe151⤵PID:2472
-
\??\c:\hhbhtt.exec:\hhbhtt.exe152⤵PID:2152
-
\??\c:\btbthh.exec:\btbthh.exe153⤵PID:1608
-
\??\c:\dvjvj.exec:\dvjvj.exe154⤵PID:2024
-
\??\c:\pjvvj.exec:\pjvvj.exe155⤵PID:2236
-
\??\c:\rlrfllr.exec:\rlrfllr.exe156⤵PID:1740
-
\??\c:\7fxrffr.exec:\7fxrffr.exe157⤵PID:2664
-
\??\c:\hthhbb.exec:\hthhbb.exe158⤵PID:2344
-
\??\c:\bbnnbn.exec:\bbnnbn.exe159⤵PID:2648
-
\??\c:\vvpdd.exec:\vvpdd.exe160⤵PID:2808
-
\??\c:\xlffffl.exec:\xlffffl.exe161⤵PID:1580
-
\??\c:\xxxfrfr.exec:\xxxfrfr.exe162⤵PID:2716
-
\??\c:\ttnthn.exec:\ttnthn.exe163⤵PID:2864
-
\??\c:\tthhhb.exec:\tthhhb.exe164⤵PID:2660
-
\??\c:\jpdpp.exec:\jpdpp.exe165⤵PID:2804
-
\??\c:\1vjjj.exec:\1vjjj.exe166⤵PID:2532
-
\??\c:\fflrffr.exec:\fflrffr.exe167⤵PID:2576
-
\??\c:\7lxxlxl.exec:\7lxxlxl.exe168⤵PID:2564
-
\??\c:\ntntnn.exec:\ntntnn.exe169⤵PID:2088
-
\??\c:\hbntnn.exec:\hbntnn.exe170⤵PID:1764
-
\??\c:\ppjpj.exec:\ppjpj.exe171⤵PID:1264
-
\??\c:\xrflrlx.exec:\xrflrlx.exe172⤵PID:1128
-
\??\c:\1rlrflr.exec:\1rlrflr.exe173⤵PID:2720
-
\??\c:\ntbtth.exec:\ntbtth.exe174⤵PID:544
-
\??\c:\hhbnbb.exec:\hhbnbb.exe175⤵PID:748
-
\??\c:\vpjpv.exec:\vpjpv.exe176⤵PID:2920
-
\??\c:\vjddp.exec:\vjddp.exe177⤵PID:2896
-
\??\c:\xxxrfrx.exec:\xxxrfrx.exe178⤵PID:2904
-
\??\c:\nnbbtn.exec:\nnbbtn.exe179⤵PID:884
-
\??\c:\btnttt.exec:\btnttt.exe180⤵PID:2380
-
\??\c:\vvjjv.exec:\vvjjv.exe181⤵PID:3020
-
\??\c:\dddjv.exec:\dddjv.exe182⤵PID:2124
-
\??\c:\lxfxlfr.exec:\lxfxlfr.exe183⤵PID:380
-
\??\c:\fxfrxlx.exec:\fxfrxlx.exe184⤵PID:540
-
\??\c:\hhnhnn.exec:\hhnhnn.exe185⤵PID:584
-
\??\c:\hhtntb.exec:\hhtntb.exe186⤵PID:684
-
\??\c:\vpddj.exec:\vpddj.exe187⤵PID:1000
-
\??\c:\flllllf.exec:\flllllf.exe188⤵PID:1652
-
\??\c:\xxlrxfr.exec:\xxlrxfr.exe189⤵PID:1592
-
\??\c:\1nbhnn.exec:\1nbhnn.exe190⤵PID:804
-
\??\c:\bbtthn.exec:\bbtthn.exe191⤵PID:2368
-
\??\c:\7jdjp.exec:\7jdjp.exe192⤵PID:2600
-
\??\c:\ddvdp.exec:\ddvdp.exe193⤵PID:2336
-
\??\c:\llrrffl.exec:\llrrffl.exe194⤵PID:2152
-
\??\c:\fflrxxf.exec:\fflrxxf.exe195⤵PID:2164
-
\??\c:\bttbnh.exec:\bttbnh.exe196⤵PID:2424
-
\??\c:\5htbbh.exec:\5htbbh.exe197⤵PID:2488
-
\??\c:\vpjpj.exec:\vpjpj.exe198⤵PID:1656
-
\??\c:\pdjdj.exec:\pdjdj.exe199⤵PID:1732
-
\??\c:\7rllxrf.exec:\7rllxrf.exe200⤵PID:2796
-
\??\c:\xrfxfxf.exec:\xrfxfxf.exe201⤵PID:2656
-
\??\c:\1hhnbb.exec:\1hhnbb.exe202⤵PID:2068
-
\??\c:\hhbhtb.exec:\hhbhtb.exe203⤵PID:1736
-
\??\c:\pjppd.exec:\pjppd.exe204⤵PID:2688
-
\??\c:\5vpdj.exec:\5vpdj.exe205⤵PID:2560
-
\??\c:\lxrlrlr.exec:\lxrlrlr.exe206⤵PID:2592
-
\??\c:\5xxlxxl.exec:\5xxlxxl.exe207⤵PID:2768
-
\??\c:\1hbttt.exec:\1hbttt.exe208⤵PID:316
-
\??\c:\dvddj.exec:\dvddj.exe209⤵PID:1284
-
\??\c:\jdvdp.exec:\jdvdp.exe210⤵PID:2916
-
\??\c:\7xfffxx.exec:\7xfffxx.exe211⤵PID:2924
-
\??\c:\rlrfllx.exec:\rlrfllx.exe212⤵PID:2940
-
\??\c:\hhbbnt.exec:\hhbbnt.exe213⤵PID:2740
-
\??\c:\btnnhn.exec:\btnnhn.exe214⤵PID:344
-
\??\c:\vjjjp.exec:\vjjjp.exe215⤵PID:2748
-
\??\c:\9vjdj.exec:\9vjdj.exe216⤵PID:2744
-
\??\c:\xxrxxfx.exec:\xxrxxfx.exe217⤵PID:1836
-
\??\c:\lrlrrrl.exec:\lrlrrrl.exe218⤵PID:2580
-
\??\c:\1tnbhh.exec:\1tnbhh.exe219⤵PID:2008
-
\??\c:\dvjdp.exec:\dvjdp.exe220⤵PID:2176
-
\??\c:\1djpv.exec:\1djpv.exe221⤵PID:2500
-
\??\c:\rlxrffl.exec:\rlxrffl.exe222⤵PID:2992
-
\??\c:\frxlxxl.exec:\frxlxxl.exe223⤵PID:1972
-
\??\c:\tnthhh.exec:\tnthhh.exe224⤵PID:1100
-
\??\c:\tnthhh.exec:\tnthhh.exe225⤵PID:572
-
\??\c:\9jpjp.exec:\9jpjp.exe226⤵PID:668
-
\??\c:\9ddjv.exec:\9ddjv.exe227⤵PID:584
-
\??\c:\xrllxxl.exec:\xrllxxl.exe228⤵PID:2184
-
\??\c:\xlxflrl.exec:\xlxflrl.exe229⤵PID:1672
-
\??\c:\hhbhbt.exec:\hhbhbt.exe230⤵PID:1000
-
\??\c:\jdpvp.exec:\jdpvp.exe231⤵PID:836
-
\??\c:\1pjdd.exec:\1pjdd.exe232⤵PID:1592
-
\??\c:\9flrxlr.exec:\9flrxlr.exe233⤵PID:804
-
\??\c:\xrllxfr.exec:\xrllxfr.exe234⤵PID:2368
-
\??\c:\1hbhnt.exec:\1hbhnt.exe235⤵PID:2600
-
\??\c:\bbtthb.exec:\bbtthb.exe236⤵PID:2336
-
\??\c:\ddvdp.exec:\ddvdp.exe237⤵PID:2400
-
\??\c:\lffxrrf.exec:\lffxrrf.exe238⤵PID:2352
-
\??\c:\1lfrrxf.exec:\1lfrrxf.exe239⤵PID:2252
-
\??\c:\7tbbbh.exec:\7tbbbh.exe240⤵PID:2488
-
\??\c:\7tntbh.exec:\7tntbh.exe241⤵PID:2224
-
\??\c:\dvjdv.exec:\dvjdv.exe242⤵PID:1732