Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 19:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1e10e90fc9d132c6122b095d0a05f6b0_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
1e10e90fc9d132c6122b095d0a05f6b0_NeikiAnalytics.exe
-
Size
64KB
-
MD5
1e10e90fc9d132c6122b095d0a05f6b0
-
SHA1
eeeb35c18a18f25203006f325637222606236319
-
SHA256
21e282b7686b5f3a68476b84a594406417bf73e9f8db6d846ea2c1e98e1da692
-
SHA512
01e30fd2c67326322efd2d637f79c8fa49a80c3bd9be0c643080d8aa0d7f14bb31039333b44faab5553cdda7dca02e763e2b85819586bda6030ba5b51df4c770
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8+Luvq:ymb3NkkiQ3mdBjF0yMl9
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/2468-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2360-81-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2360-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1864-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1308-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/468-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2288-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2284-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1044-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1384-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/268-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1148-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
fxrfxff.exe7nbhtb.exellflxxl.exerrflrxf.exe9thhbt.exejjdjv.exerlxxxfr.exe3ffflrx.exejdvdp.exe5jdvd.exellfrlrx.exehnbtnn.exebtnthn.exe1pjvj.exeflfrrfx.exe3fxlrxf.exebthntt.exe3jddp.exedvjpd.exelfxfllr.exefxflxfl.exetttbht.exebtbbtt.exevpvdp.exefxlrxlr.exebbhhtb.exe7bhtbb.exejdjpj.exejjjpd.exelfxxlxl.exebhnntn.exebbbnbn.exevpddp.exellflrxf.exexrfrlfx.exe7bntbb.exehnhnhh.exe3jdjd.exepppvj.exexrlfllr.exettnttb.exenhtnbh.exeddvvj.exevvddj.exe9xrxffl.exelxlxflf.exe3btnth.exepvppd.exeppjpv.exerlrrflr.exehbhntt.exe1bnbhn.exejdvvj.exe9pjvv.exerxrxfrr.exelfrxflx.exe7fxxflx.exe9btbnh.exebthnbb.exe7vpvj.exejdvvj.exexxlflrf.exe9tnntt.exetthbhb.exepid process 2468 fxrfxff.exe 2776 7nbhtb.exe 2040 llflxxl.exe 2748 rrflrxf.exe 2856 9thhbt.exe 2668 jjdjv.exe 2360 rlxxxfr.exe 2504 3ffflrx.exe 1704 jdvdp.exe 2164 5jdvd.exe 2496 llfrlrx.exe 2608 hnbtnn.exe 1864 btnthn.exe 1308 1pjvj.exe 1968 flfrrfx.exe 2932 3fxlrxf.exe 2204 bthntt.exe 468 3jddp.exe 3044 dvjpd.exe 2288 lfxfllr.exe 2284 fxflxfl.exe 532 tttbht.exe 1044 btbbtt.exe 1484 vpvdp.exe 300 fxlrxlr.exe 1384 bbhhtb.exe 1532 7bhtbb.exe 740 jdjpj.exe 268 jjjpd.exe 1148 lfxxlxl.exe 872 bhnntn.exe 2904 bbbnbn.exe 2056 vpddp.exe 1588 llflrxf.exe 1648 xrfrlfx.exe 2340 7bntbb.exe 2636 hnhnhh.exe 2040 3jdjd.exe 1396 pppvj.exe 2736 xrlfllr.exe 2816 ttnttb.exe 2668 nhtnbh.exe 2360 ddvvj.exe 2580 vvddj.exe 2388 9xrxffl.exe 1836 lxlxflf.exe 2604 3btnth.exe 2700 pvppd.exe 2244 ppjpv.exe 2012 rlrrflr.exe 2400 hbhntt.exe 1284 1bnbhn.exe 344 jdvvj.exe 1056 9pjvv.exe 744 rxrxfrr.exe 296 lfrxflx.exe 468 7fxxflx.exe 2988 9btbnh.exe 2804 bthnbb.exe 1152 7vpvj.exe 608 jdvvj.exe 1500 xxlflrf.exe 1372 9tnntt.exe 1848 tthbhb.exe -
Processes:
resource yara_rule behavioral1/memory/2436-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1864-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1308-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/468-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1044-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1384-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/268-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1148-289-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1e10e90fc9d132c6122b095d0a05f6b0_NeikiAnalytics.exefxrfxff.exe7nbhtb.exellflxxl.exerrflrxf.exe9thhbt.exejjdjv.exerlxxxfr.exe3ffflrx.exejdvdp.exe5jdvd.exellfrlrx.exehnbtnn.exebtnthn.exe1pjvj.exeflfrrfx.exedescription pid process target process PID 2436 wrote to memory of 2468 2436 1e10e90fc9d132c6122b095d0a05f6b0_NeikiAnalytics.exe fxrfxff.exe PID 2436 wrote to memory of 2468 2436 1e10e90fc9d132c6122b095d0a05f6b0_NeikiAnalytics.exe fxrfxff.exe PID 2436 wrote to memory of 2468 2436 1e10e90fc9d132c6122b095d0a05f6b0_NeikiAnalytics.exe fxrfxff.exe PID 2436 wrote to memory of 2468 2436 1e10e90fc9d132c6122b095d0a05f6b0_NeikiAnalytics.exe fxrfxff.exe PID 2468 wrote to memory of 2776 2468 fxrfxff.exe 7nbhtb.exe PID 2468 wrote to memory of 2776 2468 fxrfxff.exe 7nbhtb.exe PID 2468 wrote to memory of 2776 2468 fxrfxff.exe 7nbhtb.exe PID 2468 wrote to memory of 2776 2468 fxrfxff.exe 7nbhtb.exe PID 2776 wrote to memory of 2040 2776 7nbhtb.exe llflxxl.exe PID 2776 wrote to memory of 2040 2776 7nbhtb.exe llflxxl.exe PID 2776 wrote to memory of 2040 2776 7nbhtb.exe llflxxl.exe PID 2776 wrote to memory of 2040 2776 7nbhtb.exe llflxxl.exe PID 2040 wrote to memory of 2748 2040 llflxxl.exe rrflrxf.exe PID 2040 wrote to memory of 2748 2040 llflxxl.exe rrflrxf.exe PID 2040 wrote to memory of 2748 2040 llflxxl.exe rrflrxf.exe PID 2040 wrote to memory of 2748 2040 llflxxl.exe rrflrxf.exe PID 2748 wrote to memory of 2856 2748 rrflrxf.exe 9thhbt.exe PID 2748 wrote to memory of 2856 2748 rrflrxf.exe 9thhbt.exe PID 2748 wrote to memory of 2856 2748 rrflrxf.exe 9thhbt.exe PID 2748 wrote to memory of 2856 2748 rrflrxf.exe 9thhbt.exe PID 2856 wrote to memory of 2668 2856 9thhbt.exe jjdjv.exe PID 2856 wrote to memory of 2668 2856 9thhbt.exe jjdjv.exe PID 2856 wrote to memory of 2668 2856 9thhbt.exe jjdjv.exe PID 2856 wrote to memory of 2668 2856 9thhbt.exe jjdjv.exe PID 2668 wrote to memory of 2360 2668 jjdjv.exe rlxxxfr.exe PID 2668 wrote to memory of 2360 2668 jjdjv.exe rlxxxfr.exe PID 2668 wrote to memory of 2360 2668 jjdjv.exe rlxxxfr.exe PID 2668 wrote to memory of 2360 2668 jjdjv.exe rlxxxfr.exe PID 2360 wrote to memory of 2504 2360 rlxxxfr.exe 3ffflrx.exe PID 2360 wrote to memory of 2504 2360 rlxxxfr.exe 3ffflrx.exe PID 2360 wrote to memory of 2504 2360 rlxxxfr.exe 3ffflrx.exe PID 2360 wrote to memory of 2504 2360 rlxxxfr.exe 3ffflrx.exe PID 2504 wrote to memory of 1704 2504 3ffflrx.exe jdvdp.exe PID 2504 wrote to memory of 1704 2504 3ffflrx.exe jdvdp.exe PID 2504 wrote to memory of 1704 2504 3ffflrx.exe jdvdp.exe PID 2504 wrote to memory of 1704 2504 3ffflrx.exe jdvdp.exe PID 1704 wrote to memory of 2164 1704 jdvdp.exe 5jdvd.exe PID 1704 wrote to memory of 2164 1704 jdvdp.exe 5jdvd.exe PID 1704 wrote to memory of 2164 1704 jdvdp.exe 5jdvd.exe PID 1704 wrote to memory of 2164 1704 jdvdp.exe 5jdvd.exe PID 2164 wrote to memory of 2496 2164 5jdvd.exe llfrlrx.exe PID 2164 wrote to memory of 2496 2164 5jdvd.exe llfrlrx.exe PID 2164 wrote to memory of 2496 2164 5jdvd.exe llfrlrx.exe PID 2164 wrote to memory of 2496 2164 5jdvd.exe llfrlrx.exe PID 2496 wrote to memory of 2608 2496 llfrlrx.exe hnbtnn.exe PID 2496 wrote to memory of 2608 2496 llfrlrx.exe hnbtnn.exe PID 2496 wrote to memory of 2608 2496 llfrlrx.exe hnbtnn.exe PID 2496 wrote to memory of 2608 2496 llfrlrx.exe hnbtnn.exe PID 2608 wrote to memory of 1864 2608 hnbtnn.exe btnthn.exe PID 2608 wrote to memory of 1864 2608 hnbtnn.exe btnthn.exe PID 2608 wrote to memory of 1864 2608 hnbtnn.exe btnthn.exe PID 2608 wrote to memory of 1864 2608 hnbtnn.exe btnthn.exe PID 1864 wrote to memory of 1308 1864 btnthn.exe 1pjvj.exe PID 1864 wrote to memory of 1308 1864 btnthn.exe 1pjvj.exe PID 1864 wrote to memory of 1308 1864 btnthn.exe 1pjvj.exe PID 1864 wrote to memory of 1308 1864 btnthn.exe 1pjvj.exe PID 1308 wrote to memory of 1968 1308 1pjvj.exe flfrrfx.exe PID 1308 wrote to memory of 1968 1308 1pjvj.exe flfrrfx.exe PID 1308 wrote to memory of 1968 1308 1pjvj.exe flfrrfx.exe PID 1308 wrote to memory of 1968 1308 1pjvj.exe flfrrfx.exe PID 1968 wrote to memory of 2932 1968 flfrrfx.exe 3fxlrxf.exe PID 1968 wrote to memory of 2932 1968 flfrrfx.exe 3fxlrxf.exe PID 1968 wrote to memory of 2932 1968 flfrrfx.exe 3fxlrxf.exe PID 1968 wrote to memory of 2932 1968 flfrrfx.exe 3fxlrxf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e10e90fc9d132c6122b095d0a05f6b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1e10e90fc9d132c6122b095d0a05f6b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\fxrfxff.exec:\fxrfxff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\7nbhtb.exec:\7nbhtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\llflxxl.exec:\llflxxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\rrflrxf.exec:\rrflrxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\9thhbt.exec:\9thhbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\jjdjv.exec:\jjdjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\rlxxxfr.exec:\rlxxxfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\3ffflrx.exec:\3ffflrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\jdvdp.exec:\jdvdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\5jdvd.exec:\5jdvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\llfrlrx.exec:\llfrlrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\hnbtnn.exec:\hnbtnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\btnthn.exec:\btnthn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\1pjvj.exec:\1pjvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\flfrrfx.exec:\flfrrfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\3fxlrxf.exec:\3fxlrxf.exe17⤵
- Executes dropped EXE
PID:2932 -
\??\c:\bthntt.exec:\bthntt.exe18⤵
- Executes dropped EXE
PID:2204 -
\??\c:\3jddp.exec:\3jddp.exe19⤵
- Executes dropped EXE
PID:468 -
\??\c:\dvjpd.exec:\dvjpd.exe20⤵
- Executes dropped EXE
PID:3044 -
\??\c:\lfxfllr.exec:\lfxfllr.exe21⤵
- Executes dropped EXE
PID:2288 -
\??\c:\fxflxfl.exec:\fxflxfl.exe22⤵
- Executes dropped EXE
PID:2284 -
\??\c:\tttbht.exec:\tttbht.exe23⤵
- Executes dropped EXE
PID:532 -
\??\c:\btbbtt.exec:\btbbtt.exe24⤵
- Executes dropped EXE
PID:1044 -
\??\c:\vpvdp.exec:\vpvdp.exe25⤵
- Executes dropped EXE
PID:1484 -
\??\c:\fxlrxlr.exec:\fxlrxlr.exe26⤵
- Executes dropped EXE
PID:300 -
\??\c:\bbhhtb.exec:\bbhhtb.exe27⤵
- Executes dropped EXE
PID:1384 -
\??\c:\7bhtbb.exec:\7bhtbb.exe28⤵
- Executes dropped EXE
PID:1532 -
\??\c:\jdjpj.exec:\jdjpj.exe29⤵
- Executes dropped EXE
PID:740 -
\??\c:\jjjpd.exec:\jjjpd.exe30⤵
- Executes dropped EXE
PID:268 -
\??\c:\lfxxlxl.exec:\lfxxlxl.exe31⤵
- Executes dropped EXE
PID:1148 -
\??\c:\bhnntn.exec:\bhnntn.exe32⤵
- Executes dropped EXE
PID:872 -
\??\c:\bbbnbn.exec:\bbbnbn.exe33⤵
- Executes dropped EXE
PID:2904 -
\??\c:\vpddp.exec:\vpddp.exe34⤵
- Executes dropped EXE
PID:2056 -
\??\c:\llflrxf.exec:\llflrxf.exe35⤵
- Executes dropped EXE
PID:1588 -
\??\c:\xrfrlfx.exec:\xrfrlfx.exe36⤵
- Executes dropped EXE
PID:1648 -
\??\c:\7bntbb.exec:\7bntbb.exe37⤵
- Executes dropped EXE
PID:2340 -
\??\c:\hnhnhh.exec:\hnhnhh.exe38⤵
- Executes dropped EXE
PID:2636 -
\??\c:\3jdjd.exec:\3jdjd.exe39⤵
- Executes dropped EXE
PID:2040 -
\??\c:\pppvj.exec:\pppvj.exe40⤵
- Executes dropped EXE
PID:1396 -
\??\c:\xrlfllr.exec:\xrlfllr.exe41⤵
- Executes dropped EXE
PID:2736 -
\??\c:\ttnttb.exec:\ttnttb.exe42⤵
- Executes dropped EXE
PID:2816 -
\??\c:\nhtnbh.exec:\nhtnbh.exe43⤵
- Executes dropped EXE
PID:2668 -
\??\c:\ddvvj.exec:\ddvvj.exe44⤵
- Executes dropped EXE
PID:2360 -
\??\c:\vvddj.exec:\vvddj.exe45⤵
- Executes dropped EXE
PID:2580 -
\??\c:\9xrxffl.exec:\9xrxffl.exe46⤵
- Executes dropped EXE
PID:2388 -
\??\c:\lxlxflf.exec:\lxlxflf.exe47⤵
- Executes dropped EXE
PID:1836 -
\??\c:\3btnth.exec:\3btnth.exe48⤵
- Executes dropped EXE
PID:2604 -
\??\c:\pvppd.exec:\pvppd.exe49⤵
- Executes dropped EXE
PID:2700 -
\??\c:\ppjpv.exec:\ppjpv.exe50⤵
- Executes dropped EXE
PID:2244 -
\??\c:\rlrrflr.exec:\rlrrflr.exe51⤵
- Executes dropped EXE
PID:2012 -
\??\c:\hbhntt.exec:\hbhntt.exe52⤵
- Executes dropped EXE
PID:2400 -
\??\c:\1bnbhn.exec:\1bnbhn.exe53⤵
- Executes dropped EXE
PID:1284 -
\??\c:\jdvvj.exec:\jdvvj.exe54⤵
- Executes dropped EXE
PID:344 -
\??\c:\9pjvv.exec:\9pjvv.exe55⤵
- Executes dropped EXE
PID:1056 -
\??\c:\rxrxfrr.exec:\rxrxfrr.exe56⤵
- Executes dropped EXE
PID:744 -
\??\c:\lfrxflx.exec:\lfrxflx.exe57⤵
- Executes dropped EXE
PID:296 -
\??\c:\7fxxflx.exec:\7fxxflx.exe58⤵
- Executes dropped EXE
PID:468 -
\??\c:\9btbnh.exec:\9btbnh.exe59⤵
- Executes dropped EXE
PID:2988 -
\??\c:\bthnbb.exec:\bthnbb.exe60⤵
- Executes dropped EXE
PID:2804 -
\??\c:\7vpvj.exec:\7vpvj.exe61⤵
- Executes dropped EXE
PID:1152 -
\??\c:\jdvvj.exec:\jdvvj.exe62⤵
- Executes dropped EXE
PID:608 -
\??\c:\xxlflrf.exec:\xxlflrf.exe63⤵
- Executes dropped EXE
PID:1500 -
\??\c:\9tnntt.exec:\9tnntt.exe64⤵
- Executes dropped EXE
PID:1372 -
\??\c:\tthbhb.exec:\tthbhb.exe65⤵
- Executes dropped EXE
PID:1848 -
\??\c:\pjppd.exec:\pjppd.exe66⤵PID:556
-
\??\c:\pjvvd.exec:\pjvvd.exe67⤵PID:976
-
\??\c:\xxrxxxf.exec:\xxrxxxf.exe68⤵PID:1976
-
\??\c:\rrllxfl.exec:\rrllxfl.exe69⤵PID:840
-
\??\c:\nnnttt.exec:\nnnttt.exe70⤵PID:3064
-
\??\c:\vvddp.exec:\vvddp.exe71⤵PID:1504
-
\??\c:\5dvdj.exec:\5dvdj.exe72⤵PID:2248
-
\??\c:\frrlxff.exec:\frrlxff.exe73⤵PID:2052
-
\??\c:\xxlrfrf.exec:\xxlrfrf.exe74⤵PID:1652
-
\??\c:\bttthb.exec:\bttthb.exe75⤵PID:2464
-
\??\c:\tntthh.exec:\tntthh.exe76⤵PID:1712
-
\??\c:\ppvjp.exec:\ppvjp.exe77⤵PID:2408
-
\??\c:\ddjjv.exec:\ddjjv.exe78⤵PID:3012
-
\??\c:\xrxxlfr.exec:\xrxxlfr.exe79⤵PID:2648
-
\??\c:\7flrxfr.exec:\7flrxfr.exe80⤵PID:1680
-
\??\c:\nhtthh.exec:\nhtthh.exe81⤵PID:2632
-
\??\c:\bnttht.exec:\bnttht.exe82⤵PID:3020
-
\??\c:\pvvpj.exec:\pvvpj.exe83⤵PID:2856
-
\??\c:\jdvdp.exec:\jdvdp.exe84⤵PID:2536
-
\??\c:\xxrfrrf.exec:\xxrfrrf.exe85⤵PID:2644
-
\??\c:\fxffrrf.exec:\fxffrrf.exe86⤵PID:2512
-
\??\c:\9nhnbh.exec:\9nhnbh.exe87⤵PID:2504
-
\??\c:\pdjdj.exec:\pdjdj.exe88⤵PID:2388
-
\??\c:\1vpdp.exec:\1vpdp.exe89⤵PID:1252
-
\??\c:\1xrfrlf.exec:\1xrfrlf.exe90⤵PID:2800
-
\??\c:\rrxrflr.exec:\rrxrflr.exe91⤵PID:2240
-
\??\c:\9hbntt.exec:\9hbntt.exe92⤵PID:1264
-
\??\c:\hhtbnt.exec:\hhtbnt.exe93⤵PID:1916
-
\??\c:\ppjvj.exec:\ppjvj.exe94⤵PID:2000
-
\??\c:\lrxlflf.exec:\lrxlflf.exe95⤵PID:2232
-
\??\c:\fxrxlrx.exec:\fxrxlrx.exe96⤵PID:1032
-
\??\c:\nhtnhh.exec:\nhtnhh.exe97⤵PID:372
-
\??\c:\9nbtnn.exec:\9nbtnn.exe98⤵PID:1752
-
\??\c:\pjjjd.exec:\pjjjd.exe99⤵PID:888
-
\??\c:\7vjpv.exec:\7vjpv.exe100⤵PID:3044
-
\??\c:\5lrlxfl.exec:\5lrlxfl.exe101⤵PID:2812
-
\??\c:\ffxxllr.exec:\ffxxllr.exe102⤵PID:1560
-
\??\c:\bttbnt.exec:\bttbnt.exe103⤵PID:484
-
\??\c:\vpjpp.exec:\vpjpp.exe104⤵PID:532
-
\??\c:\7ddvj.exec:\7ddvj.exe105⤵PID:2872
-
\??\c:\xxlrrxl.exec:\xxlrrxl.exe106⤵PID:1792
-
\??\c:\lffxlrr.exec:\lffxlrr.exe107⤵PID:1312
-
\??\c:\tbthtt.exec:\tbthtt.exe108⤵PID:556
-
\??\c:\btbhnt.exec:\btbhnt.exe109⤵PID:1384
-
\??\c:\vjppd.exec:\vjppd.exe110⤵PID:1992
-
\??\c:\3dpvj.exec:\3dpvj.exe111⤵PID:3028
-
\??\c:\fxrfllx.exec:\fxrfllx.exe112⤵PID:2392
-
\??\c:\lfrflxf.exec:\lfrflxf.exe113⤵PID:1608
-
\??\c:\btnnbb.exec:\btnnbb.exe114⤵PID:1148
-
\??\c:\tbnbhh.exec:\tbnbhh.exe115⤵PID:2912
-
\??\c:\7vddp.exec:\7vddp.exe116⤵PID:2436
-
\??\c:\7jpvd.exec:\7jpvd.exe117⤵PID:1604
-
\??\c:\rxffrlr.exec:\rxffrlr.exe118⤵PID:2412
-
\??\c:\1xfrlrx.exec:\1xfrlrx.exe119⤵PID:2772
-
\??\c:\3nbntn.exec:\3nbntn.exe120⤵PID:2616
-
\??\c:\bthnbb.exec:\bthnbb.exe121⤵PID:2732
-
\??\c:\5vjjv.exec:\5vjjv.exe122⤵PID:2612
-
\??\c:\ppjdv.exec:\ppjdv.exe123⤵PID:2516
-
\??\c:\rrxfrxr.exec:\rrxfrxr.exe124⤵PID:2784
-
\??\c:\lfrxrrl.exec:\lfrxrrl.exe125⤵PID:2684
-
\??\c:\tnbhnn.exec:\tnbhnn.exe126⤵PID:2168
-
\??\c:\hhbhbh.exec:\hhbhbh.exe127⤵PID:2584
-
\??\c:\jdvdj.exec:\jdvdj.exe128⤵PID:2520
-
\??\c:\5jjjv.exec:\5jjjv.exe129⤵PID:2104
-
\??\c:\9xrxflr.exec:\9xrxflr.exe130⤵PID:2568
-
\??\c:\xrrlrrr.exec:\xrrlrrr.exe131⤵PID:2704
-
\??\c:\tnttbh.exec:\tnttbh.exe132⤵PID:2220
-
\??\c:\thttbn.exec:\thttbn.exe133⤵PID:2032
-
\??\c:\dpvdj.exec:\dpvdj.exe134⤵PID:1632
-
\??\c:\vvddj.exec:\vvddj.exe135⤵PID:2208
-
\??\c:\9rxxflx.exec:\9rxxflx.exe136⤵PID:1804
-
\??\c:\rlfrlxr.exec:\rlfrlxr.exe137⤵PID:1812
-
\??\c:\9hhnnn.exec:\9hhnnn.exe138⤵PID:828
-
\??\c:\ntbbtb.exec:\ntbbtb.exe139⤵PID:808
-
\??\c:\nnbbhn.exec:\nnbbhn.exe140⤵PID:2672
-
\??\c:\vpvvd.exec:\vpvvd.exe141⤵PID:2452
-
\??\c:\jdppd.exec:\jdppd.exe142⤵PID:2300
-
\??\c:\xxxlxlx.exec:\xxxlxlx.exe143⤵PID:2288
-
\??\c:\hnbnth.exec:\hnbnth.exe144⤵PID:764
-
\??\c:\btnnbt.exec:\btnnbt.exe145⤵PID:664
-
\??\c:\pdvpv.exec:\pdvpv.exe146⤵PID:1104
-
\??\c:\pjjpd.exec:\pjjpd.exe147⤵PID:2836
-
\??\c:\7rrxllf.exec:\7rrxllf.exe148⤵PID:2144
-
\??\c:\9xrrxrr.exec:\9xrrxrr.exe149⤵PID:300
-
\??\c:\nhbnnt.exec:\nhbnnt.exe150⤵PID:996
-
\??\c:\tttbbb.exec:\tttbbb.exe151⤵PID:892
-
\??\c:\9jjdd.exec:\9jjdd.exe152⤵PID:1744
-
\??\c:\3vppv.exec:\3vppv.exe153⤵PID:2072
-
\??\c:\lfxfflx.exec:\lfxfflx.exe154⤵PID:2848
-
\??\c:\9xxrxxl.exec:\9xxrxxl.exe155⤵PID:2960
-
\??\c:\1btbtt.exec:\1btbtt.exe156⤵PID:2868
-
\??\c:\hhbtbn.exec:\hhbtbn.exe157⤵PID:2036
-
\??\c:\bbthth.exec:\bbthth.exe158⤵PID:1600
-
\??\c:\5pjjv.exec:\5pjjv.exe159⤵PID:2080
-
\??\c:\pjppd.exec:\pjppd.exe160⤵PID:2928
-
\??\c:\xrxxrrr.exec:\xrxxrrr.exe161⤵PID:2776
-
\??\c:\bbhnbb.exec:\bbhnbb.exe162⤵PID:2724
-
\??\c:\nhtbhh.exec:\nhtbhh.exe163⤵PID:2652
-
\??\c:\3pjjp.exec:\3pjjp.exe164⤵PID:2764
-
\??\c:\jdpvd.exec:\jdpvd.exe165⤵PID:2688
-
\??\c:\xrxlrxl.exec:\xrxlrxl.exe166⤵PID:2828
-
\??\c:\rrlxlrf.exec:\rrlxlrf.exe167⤵PID:2564
-
\??\c:\lfxxlfr.exec:\lfxxlfr.exe168⤵PID:2560
-
\??\c:\bnbbhh.exec:\bnbbhh.exe169⤵PID:2572
-
\??\c:\vpjpd.exec:\vpjpd.exe170⤵PID:1944
-
\??\c:\dvddv.exec:\dvddv.exe171⤵PID:1448
-
\??\c:\9xlrxfl.exec:\9xlrxfl.exe172⤵PID:2596
-
\??\c:\llxfrxr.exec:\llxfrxr.exe173⤵PID:1244
-
\??\c:\lfxxflr.exec:\lfxxflr.exe174⤵PID:2020
-
\??\c:\9ntnnn.exec:\9ntnnn.exe175⤵PID:1584
-
\??\c:\3pdpp.exec:\3pdpp.exe176⤵PID:2216
-
\??\c:\djvvd.exec:\djvvd.exe177⤵PID:2236
-
\??\c:\rxllrrf.exec:\rxllrrf.exe178⤵PID:1052
-
\??\c:\5xlxflx.exec:\5xlxflx.exe179⤵PID:2548
-
\??\c:\bnhhtb.exec:\bnhhtb.exe180⤵PID:376
-
\??\c:\hhttnt.exec:\hhttnt.exe181⤵PID:1956
-
\??\c:\9bthnn.exec:\9bthnn.exe182⤵PID:620
-
\??\c:\9djjv.exec:\9djjv.exe183⤵PID:2308
-
\??\c:\lfxxrxr.exec:\lfxxrxr.exe184⤵PID:2460
-
\??\c:\llxfffl.exec:\llxfffl.exe185⤵PID:320
-
\??\c:\nnhbhb.exec:\nnhbhb.exe186⤵PID:580
-
\??\c:\5thnbh.exec:\5thnbh.exe187⤵PID:1624
-
\??\c:\jjdjv.exec:\jjdjv.exe188⤵PID:1488
-
\??\c:\dvddj.exec:\dvddj.exe189⤵PID:3016
-
\??\c:\dvjpd.exec:\dvjpd.exe190⤵PID:1764
-
\??\c:\ffxlrrr.exec:\ffxlrrr.exe191⤵PID:1984
-
\??\c:\rrflxxl.exec:\rrflxxl.exe192⤵PID:1980
-
\??\c:\hhnhhh.exec:\hhnhhh.exe193⤵PID:2148
-
\??\c:\thtbnn.exec:\thtbnn.exe194⤵PID:628
-
\??\c:\ttbhnb.exec:\ttbhnb.exe195⤵PID:268
-
\??\c:\dvdjd.exec:\dvdjd.exe196⤵PID:2396
-
\??\c:\ffxflrr.exec:\ffxflrr.exe197⤵PID:2920
-
\??\c:\xrlrxlr.exec:\xrlrxlr.exe198⤵PID:1148
-
\??\c:\vpjvd.exec:\vpjvd.exe199⤵PID:1596
-
\??\c:\rrrfflx.exec:\rrrfflx.exe200⤵PID:2444
-
\??\c:\rlxlrrx.exec:\rlxlrrx.exe201⤵PID:2024
-
\??\c:\ttnbtb.exec:\ttnbtb.exe202⤵PID:3060
-
\??\c:\btbhnt.exec:\btbhnt.exe203⤵PID:1260
-
\??\c:\vvppd.exec:\vvppd.exe204⤵PID:2636
-
\??\c:\vpvvd.exec:\vpvvd.exe205⤵PID:2712
-
\??\c:\xrfxxlr.exec:\xrfxxlr.exe206⤵PID:2516
-
\??\c:\7lflrrf.exec:\7lflrrf.exe207⤵PID:2856
-
\??\c:\5bnthh.exec:\5bnthh.exe208⤵PID:2624
-
\??\c:\bhbnbb.exec:\bhbnbb.exe209⤵PID:2168
-
\??\c:\7pjjp.exec:\7pjjp.exe210⤵PID:2528
-
\??\c:\vvdjd.exec:\vvdjd.exe211⤵PID:2360
-
\??\c:\lllffxf.exec:\lllffxf.exe212⤵PID:2952
-
\??\c:\1rrlxff.exec:\1rrlxff.exe213⤵PID:2984
-
\??\c:\fxxxllr.exec:\fxxxllr.exe214⤵PID:1952
-
\??\c:\bbhtnt.exec:\bbhtnt.exe215⤵PID:2220
-
\??\c:\ththhn.exec:\ththhn.exe216⤵PID:2576
-
\??\c:\ppvpj.exec:\ppvpj.exe217⤵PID:2908
-
\??\c:\jdpdj.exec:\jdpdj.exe218⤵PID:1864
-
\??\c:\xxxfllr.exec:\xxxfllr.exe219⤵PID:1948
-
\??\c:\xxlfrxf.exec:\xxlfrxf.exe220⤵PID:2212
-
\??\c:\3nbhtt.exec:\3nbhtt.exe221⤵PID:1920
-
\??\c:\hthntb.exec:\hthntb.exe222⤵PID:376
-
\??\c:\dvjpj.exec:\dvjpj.exe223⤵PID:888
-
\??\c:\vjvjp.exec:\vjvjp.exe224⤵PID:2156
-
\??\c:\5fxxrxr.exec:\5fxxrxr.exe225⤵PID:2312
-
\??\c:\rrlrlrf.exec:\rrlrlrf.exe226⤵PID:2812
-
\??\c:\xxrxlrf.exec:\xxrxlrf.exe227⤵PID:764
-
\??\c:\hbtthn.exec:\hbtthn.exe228⤵PID:608
-
\??\c:\9tnnhh.exec:\9tnnhh.exe229⤵PID:980
-
\??\c:\vpddv.exec:\vpddv.exe230⤵PID:2476
-
\??\c:\9jdvd.exec:\9jdvd.exe231⤵PID:2144
-
\??\c:\xrlrfrf.exec:\xrlrfrf.exe232⤵PID:600
-
\??\c:\llrlrrx.exec:\llrlrrx.exe233⤵PID:2440
-
\??\c:\nhtbnb.exec:\nhtbnb.exe234⤵PID:2892
-
\??\c:\hbhnnn.exec:\hbhnnn.exe235⤵PID:936
-
\??\c:\1pjjv.exec:\1pjjv.exe236⤵PID:628
-
\??\c:\vpppv.exec:\vpppv.exe237⤵PID:2392
-
\??\c:\fxxfxrl.exec:\fxxfxrl.exe238⤵PID:1392
-
\??\c:\3rrrrxf.exec:\3rrrrxf.exe239⤵PID:2260
-
\??\c:\nhbbnt.exec:\nhbbnt.exe240⤵PID:1652
-
\??\c:\djvvj.exec:\djvvj.exe241⤵PID:1852
-
\??\c:\vvvpj.exec:\vvvpj.exe242⤵PID:1736