Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 04:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
abf693acc328443d7e069af63f5f6a10_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
abf693acc328443d7e069af63f5f6a10_NeikiAnalytics.exe
-
Size
64KB
-
MD5
abf693acc328443d7e069af63f5f6a10
-
SHA1
1df4ed518b156dd72a911eb8c59341c4b6691a8d
-
SHA256
f27f58fe56639ff9633879a9c390b97d46e4dc5d0b02ecd65298ed1410caf7b8
-
SHA512
41a6ec58ce2bddb89bd034a3c59d5c2cfb1e8749975689bb1d67cdeb690e7aa8b7de5db0ef55543ec162028e627c5cef0caa93c3f5e861a7086ecb9cdb658ba6
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFdJULh126:ymb3NkkiQ3mdBjFIFdJmN
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/2244-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1844-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/848-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/848-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3064-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3064-54-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2488-82-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/876-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/324-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1164-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/844-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/840-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1732-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
3htbhh.exepjdjp.exe5fflxrf.exehthbhb.exenhbhnb.exevpvvv.exedjjjp.exexrxlfxl.exe3fllxff.exehbbnnn.exentbbtt.exepdppp.exejvjvv.exejdjpv.exe7flrfff.exe5nttbt.exennhbth.exedjvpj.exe5vvdd.exexrxxflr.exelxrflrx.exebbbtnt.exe1bbttt.exedvdvv.exe9jjdj.exerfrlfxl.exefxxrlll.exehnnntb.exebthnhh.exenhtbtb.exedvpdj.exepdjjv.exefrxrlfl.exe9ffrrrr.exehttbtt.exe7bnnnn.exevjddj.exelxlllll.exennhhnn.exehnnhnb.exejppjp.exefrrxllr.exehtbtbt.exepjdpv.exehtnnnh.exedppvv.exejdpvv.exefrxrxxx.exe9hnntt.exe5hntnh.exejvdjj.exeddpdv.exe3xrrfff.exehthnbb.exehhhnbh.exejdjpj.exexlfxffl.exe3lfrffl.exe3lrllfl.exebnnthh.exe7btttt.exejvjdj.exe1xllxxf.exe5xlxxfl.exepid process 1844 3htbhh.exe 848 pjdjp.exe 2720 5fflxrf.exe 3064 hthbhb.exe 2080 nhbhnb.exe 2644 vpvvv.exe 2488 djjjp.exe 2520 xrxlfxl.exe 3000 3fllxff.exe 2712 hbbnnn.exe 856 ntbbtt.exe 1716 pdppp.exe 2192 jvjvv.exe 2792 jdjpv.exe 876 7flrfff.exe 1548 5nttbt.exe 2016 nnhbth.exe 1224 djvpj.exe 2456 5vvdd.exe 324 xrxxflr.exe 1164 lxrflrx.exe 1520 bbbtnt.exe 844 1bbttt.exe 1056 dvdvv.exe 840 9jjdj.exe 1632 rfrlfxl.exe 1676 fxxrlll.exe 1180 hnnntb.exe 2424 bthnhh.exe 1732 nhtbtb.exe 3020 dvpdj.exe 2172 pdjjv.exe 2352 frxrlfl.exe 2408 9ffrrrr.exe 1844 httbtt.exe 2388 7bnnnn.exe 2628 vjddj.exe 2892 lxlllll.exe 2660 nnhhnn.exe 2516 hnnhnb.exe 2148 jppjp.exe 2544 frrxllr.exe 2492 htbtbt.exe 1956 pjdpv.exe 2548 htnnnh.exe 1944 dppvv.exe 1416 jdpvv.exe 856 frxrxxx.exe 1656 9hnntt.exe 2784 5hntnh.exe 1648 jvdjj.exe 1324 ddpdv.exe 2988 3xrrfff.exe 2836 hthnbb.exe 2876 hhhnbh.exe 1884 jdjpj.exe 2068 xlfxffl.exe 2828 3lfrffl.exe 1020 3lrllfl.exe 1664 bnnthh.exe 560 7btttt.exe 2400 jvjdj.exe 2112 1xllxxf.exe 1780 5xlxxfl.exe -
Processes:
resource yara_rule behavioral1/memory/2244-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2244-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1844-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/848-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/848-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/848-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/848-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3064-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/876-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/324-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1164-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/844-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1732-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-100-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
abf693acc328443d7e069af63f5f6a10_NeikiAnalytics.exe3htbhh.exepjdjp.exe5fflxrf.exehthbhb.exenhbhnb.exevpvvv.exedjjjp.exexrxlfxl.exe3fllxff.exehbbnnn.exentbbtt.exepdppp.exejvjvv.exejdjpv.exe7flrfff.exedescription pid process target process PID 2244 wrote to memory of 1844 2244 abf693acc328443d7e069af63f5f6a10_NeikiAnalytics.exe 3htbhh.exe PID 2244 wrote to memory of 1844 2244 abf693acc328443d7e069af63f5f6a10_NeikiAnalytics.exe 3htbhh.exe PID 2244 wrote to memory of 1844 2244 abf693acc328443d7e069af63f5f6a10_NeikiAnalytics.exe 3htbhh.exe PID 2244 wrote to memory of 1844 2244 abf693acc328443d7e069af63f5f6a10_NeikiAnalytics.exe 3htbhh.exe PID 1844 wrote to memory of 848 1844 3htbhh.exe pjdjp.exe PID 1844 wrote to memory of 848 1844 3htbhh.exe pjdjp.exe PID 1844 wrote to memory of 848 1844 3htbhh.exe pjdjp.exe PID 1844 wrote to memory of 848 1844 3htbhh.exe pjdjp.exe PID 848 wrote to memory of 2720 848 pjdjp.exe 5fflxrf.exe PID 848 wrote to memory of 2720 848 pjdjp.exe 5fflxrf.exe PID 848 wrote to memory of 2720 848 pjdjp.exe 5fflxrf.exe PID 848 wrote to memory of 2720 848 pjdjp.exe 5fflxrf.exe PID 2720 wrote to memory of 3064 2720 5fflxrf.exe hthbhb.exe PID 2720 wrote to memory of 3064 2720 5fflxrf.exe hthbhb.exe PID 2720 wrote to memory of 3064 2720 5fflxrf.exe hthbhb.exe PID 2720 wrote to memory of 3064 2720 5fflxrf.exe hthbhb.exe PID 3064 wrote to memory of 2080 3064 hthbhb.exe nhbhnb.exe PID 3064 wrote to memory of 2080 3064 hthbhb.exe nhbhnb.exe PID 3064 wrote to memory of 2080 3064 hthbhb.exe nhbhnb.exe PID 3064 wrote to memory of 2080 3064 hthbhb.exe nhbhnb.exe PID 2080 wrote to memory of 2644 2080 nhbhnb.exe vpvvv.exe PID 2080 wrote to memory of 2644 2080 nhbhnb.exe vpvvv.exe PID 2080 wrote to memory of 2644 2080 nhbhnb.exe vpvvv.exe PID 2080 wrote to memory of 2644 2080 nhbhnb.exe vpvvv.exe PID 2644 wrote to memory of 2488 2644 vpvvv.exe djjjp.exe PID 2644 wrote to memory of 2488 2644 vpvvv.exe djjjp.exe PID 2644 wrote to memory of 2488 2644 vpvvv.exe djjjp.exe PID 2644 wrote to memory of 2488 2644 vpvvv.exe djjjp.exe PID 2488 wrote to memory of 2520 2488 djjjp.exe xrxlfxl.exe PID 2488 wrote to memory of 2520 2488 djjjp.exe xrxlfxl.exe PID 2488 wrote to memory of 2520 2488 djjjp.exe xrxlfxl.exe PID 2488 wrote to memory of 2520 2488 djjjp.exe xrxlfxl.exe PID 2520 wrote to memory of 3000 2520 xrxlfxl.exe 3fllxff.exe PID 2520 wrote to memory of 3000 2520 xrxlfxl.exe 3fllxff.exe PID 2520 wrote to memory of 3000 2520 xrxlfxl.exe 3fllxff.exe PID 2520 wrote to memory of 3000 2520 xrxlfxl.exe 3fllxff.exe PID 3000 wrote to memory of 2712 3000 3fllxff.exe hbbnnn.exe PID 3000 wrote to memory of 2712 3000 3fllxff.exe hbbnnn.exe PID 3000 wrote to memory of 2712 3000 3fllxff.exe hbbnnn.exe PID 3000 wrote to memory of 2712 3000 3fllxff.exe hbbnnn.exe PID 2712 wrote to memory of 856 2712 hbbnnn.exe ntbbtt.exe PID 2712 wrote to memory of 856 2712 hbbnnn.exe ntbbtt.exe PID 2712 wrote to memory of 856 2712 hbbnnn.exe ntbbtt.exe PID 2712 wrote to memory of 856 2712 hbbnnn.exe ntbbtt.exe PID 856 wrote to memory of 1716 856 ntbbtt.exe pdppp.exe PID 856 wrote to memory of 1716 856 ntbbtt.exe pdppp.exe PID 856 wrote to memory of 1716 856 ntbbtt.exe pdppp.exe PID 856 wrote to memory of 1716 856 ntbbtt.exe pdppp.exe PID 1716 wrote to memory of 2192 1716 pdppp.exe jvjvv.exe PID 1716 wrote to memory of 2192 1716 pdppp.exe jvjvv.exe PID 1716 wrote to memory of 2192 1716 pdppp.exe jvjvv.exe PID 1716 wrote to memory of 2192 1716 pdppp.exe jvjvv.exe PID 2192 wrote to memory of 2792 2192 jvjvv.exe jdjpv.exe PID 2192 wrote to memory of 2792 2192 jvjvv.exe jdjpv.exe PID 2192 wrote to memory of 2792 2192 jvjvv.exe jdjpv.exe PID 2192 wrote to memory of 2792 2192 jvjvv.exe jdjpv.exe PID 2792 wrote to memory of 876 2792 jdjpv.exe 7flrfff.exe PID 2792 wrote to memory of 876 2792 jdjpv.exe 7flrfff.exe PID 2792 wrote to memory of 876 2792 jdjpv.exe 7flrfff.exe PID 2792 wrote to memory of 876 2792 jdjpv.exe 7flrfff.exe PID 876 wrote to memory of 1548 876 7flrfff.exe 5nttbt.exe PID 876 wrote to memory of 1548 876 7flrfff.exe 5nttbt.exe PID 876 wrote to memory of 1548 876 7flrfff.exe 5nttbt.exe PID 876 wrote to memory of 1548 876 7flrfff.exe 5nttbt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\abf693acc328443d7e069af63f5f6a10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\abf693acc328443d7e069af63f5f6a10_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\3htbhh.exec:\3htbhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\pjdjp.exec:\pjdjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\5fflxrf.exec:\5fflxrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\hthbhb.exec:\hthbhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\nhbhnb.exec:\nhbhnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\vpvvv.exec:\vpvvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\djjjp.exec:\djjjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\xrxlfxl.exec:\xrxlfxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\3fllxff.exec:\3fllxff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\hbbnnn.exec:\hbbnnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\ntbbtt.exec:\ntbbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\pdppp.exec:\pdppp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\jvjvv.exec:\jvjvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\jdjpv.exec:\jdjpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\7flrfff.exec:\7flrfff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\5nttbt.exec:\5nttbt.exe17⤵
- Executes dropped EXE
PID:1548 -
\??\c:\nnhbth.exec:\nnhbth.exe18⤵
- Executes dropped EXE
PID:2016 -
\??\c:\djvpj.exec:\djvpj.exe19⤵
- Executes dropped EXE
PID:1224 -
\??\c:\5vvdd.exec:\5vvdd.exe20⤵
- Executes dropped EXE
PID:2456 -
\??\c:\xrxxflr.exec:\xrxxflr.exe21⤵
- Executes dropped EXE
PID:324 -
\??\c:\lxrflrx.exec:\lxrflrx.exe22⤵
- Executes dropped EXE
PID:1164 -
\??\c:\bbbtnt.exec:\bbbtnt.exe23⤵
- Executes dropped EXE
PID:1520 -
\??\c:\1bbttt.exec:\1bbttt.exe24⤵
- Executes dropped EXE
PID:844 -
\??\c:\dvdvv.exec:\dvdvv.exe25⤵
- Executes dropped EXE
PID:1056 -
\??\c:\9jjdj.exec:\9jjdj.exe26⤵
- Executes dropped EXE
PID:840 -
\??\c:\rfrlfxl.exec:\rfrlfxl.exe27⤵
- Executes dropped EXE
PID:1632 -
\??\c:\fxxrlll.exec:\fxxrlll.exe28⤵
- Executes dropped EXE
PID:1676 -
\??\c:\hnnntb.exec:\hnnntb.exe29⤵
- Executes dropped EXE
PID:1180 -
\??\c:\bthnhh.exec:\bthnhh.exe30⤵
- Executes dropped EXE
PID:2424 -
\??\c:\nhtbtb.exec:\nhtbtb.exe31⤵
- Executes dropped EXE
PID:1732 -
\??\c:\dvpdj.exec:\dvpdj.exe32⤵
- Executes dropped EXE
PID:3020 -
\??\c:\pdjjv.exec:\pdjjv.exe33⤵
- Executes dropped EXE
PID:2172 -
\??\c:\frxrlfl.exec:\frxrlfl.exe34⤵
- Executes dropped EXE
PID:2352 -
\??\c:\9ffrrrr.exec:\9ffrrrr.exe35⤵
- Executes dropped EXE
PID:2408 -
\??\c:\httbtt.exec:\httbtt.exe36⤵
- Executes dropped EXE
PID:1844 -
\??\c:\7bnnnn.exec:\7bnnnn.exe37⤵
- Executes dropped EXE
PID:2388 -
\??\c:\vjddj.exec:\vjddj.exe38⤵
- Executes dropped EXE
PID:2628 -
\??\c:\lxlllll.exec:\lxlllll.exe39⤵
- Executes dropped EXE
PID:2892 -
\??\c:\nnhhnn.exec:\nnhhnn.exe40⤵
- Executes dropped EXE
PID:2660 -
\??\c:\hnnhnb.exec:\hnnhnb.exe41⤵
- Executes dropped EXE
PID:2516 -
\??\c:\jppjp.exec:\jppjp.exe42⤵
- Executes dropped EXE
PID:2148 -
\??\c:\frrxllr.exec:\frrxllr.exe43⤵
- Executes dropped EXE
PID:2544 -
\??\c:\htbtbt.exec:\htbtbt.exe44⤵
- Executes dropped EXE
PID:2492 -
\??\c:\pjdpv.exec:\pjdpv.exe45⤵
- Executes dropped EXE
PID:1956 -
\??\c:\htnnnh.exec:\htnnnh.exe46⤵
- Executes dropped EXE
PID:2548 -
\??\c:\dppvv.exec:\dppvv.exe47⤵
- Executes dropped EXE
PID:1944 -
\??\c:\jdpvv.exec:\jdpvv.exe48⤵
- Executes dropped EXE
PID:1416 -
\??\c:\frxrxxx.exec:\frxrxxx.exe49⤵
- Executes dropped EXE
PID:856 -
\??\c:\9hnntt.exec:\9hnntt.exe50⤵
- Executes dropped EXE
PID:1656 -
\??\c:\5hntnh.exec:\5hntnh.exe51⤵
- Executes dropped EXE
PID:2784 -
\??\c:\jvdjj.exec:\jvdjj.exe52⤵
- Executes dropped EXE
PID:1648 -
\??\c:\ddpdv.exec:\ddpdv.exe53⤵
- Executes dropped EXE
PID:1324 -
\??\c:\3xrrfff.exec:\3xrrfff.exe54⤵
- Executes dropped EXE
PID:2988 -
\??\c:\hthnbb.exec:\hthnbb.exe55⤵
- Executes dropped EXE
PID:2836 -
\??\c:\hhhnbh.exec:\hhhnbh.exe56⤵
- Executes dropped EXE
PID:2876 -
\??\c:\jdjpj.exec:\jdjpj.exe57⤵
- Executes dropped EXE
PID:1884 -
\??\c:\xlfxffl.exec:\xlfxffl.exe58⤵
- Executes dropped EXE
PID:2068 -
\??\c:\3lfrffl.exec:\3lfrffl.exe59⤵
- Executes dropped EXE
PID:2828 -
\??\c:\3lrllfl.exec:\3lrllfl.exe60⤵
- Executes dropped EXE
PID:1020 -
\??\c:\bnnthh.exec:\bnnthh.exe61⤵
- Executes dropped EXE
PID:1664 -
\??\c:\7btttt.exec:\7btttt.exe62⤵
- Executes dropped EXE
PID:560 -
\??\c:\jvjdj.exec:\jvjdj.exe63⤵
- Executes dropped EXE
PID:2400 -
\??\c:\1xllxxf.exec:\1xllxxf.exe64⤵
- Executes dropped EXE
PID:2112 -
\??\c:\5xlxxfl.exec:\5xlxxfl.exe65⤵
- Executes dropped EXE
PID:1780 -
\??\c:\tnnthh.exec:\tnnthh.exe66⤵PID:1836
-
\??\c:\ttthnh.exec:\ttthnh.exe67⤵PID:1800
-
\??\c:\ppjvj.exec:\ppjvj.exe68⤵PID:1764
-
\??\c:\jvvpp.exec:\jvvpp.exe69⤵PID:1892
-
\??\c:\7frrxfr.exec:\7frrxfr.exe70⤵PID:1064
-
\??\c:\nttnbh.exec:\nttnbh.exe71⤵PID:3012
-
\??\c:\hbhnnn.exec:\hbhnnn.exe72⤵PID:2428
-
\??\c:\9pddv.exec:\9pddv.exe73⤵PID:904
-
\??\c:\7pvjd.exec:\7pvjd.exe74⤵PID:2244
-
\??\c:\vjpjp.exec:\vjpjp.exe75⤵PID:1720
-
\??\c:\9flrffr.exec:\9flrffr.exe76⤵PID:2376
-
\??\c:\frffflf.exec:\frffflf.exe77⤵PID:2044
-
\??\c:\3hhnbt.exec:\3hhnbt.exe78⤵PID:2248
-
\??\c:\htnnbb.exec:\htnnbb.exe79⤵PID:2576
-
\??\c:\jjpvd.exec:\jjpvd.exe80⤵PID:2724
-
\??\c:\ppdpv.exec:\ppdpv.exe81⤵PID:2756
-
\??\c:\rrflxfr.exec:\rrflxfr.exe82⤵PID:2624
-
\??\c:\lxxrxrx.exec:\lxxrxrx.exe83⤵PID:2528
-
\??\c:\nbhhtn.exec:\nbhhtn.exe84⤵PID:2644
-
\??\c:\9jpvv.exec:\9jpvv.exe85⤵PID:2872
-
\??\c:\vvppp.exec:\vvppp.exe86⤵PID:2636
-
\??\c:\ffrxffl.exec:\ffrxffl.exe87⤵PID:2496
-
\??\c:\rfrrfll.exec:\rfrrfll.exe88⤵PID:1592
-
\??\c:\bhnbhb.exec:\bhnbhb.exe89⤵PID:2156
-
\??\c:\tnbntt.exec:\tnbntt.exe90⤵PID:1928
-
\??\c:\jvjpj.exec:\jvjpj.exe91⤵PID:2704
-
\??\c:\ppdjv.exec:\ppdjv.exe92⤵PID:1564
-
\??\c:\pjjpv.exec:\pjjpv.exe93⤵PID:2808
-
\??\c:\lfxrxxf.exec:\lfxrxxf.exe94⤵PID:2792
-
\??\c:\7nbnnn.exec:\7nbnnn.exe95⤵PID:1468
-
\??\c:\5tttbb.exec:\5tttbb.exe96⤵PID:2864
-
\??\c:\hhbnht.exec:\hhbnht.exe97⤵PID:1604
-
\??\c:\jvddp.exec:\jvddp.exe98⤵PID:2912
-
\??\c:\9ddjp.exec:\9ddjp.exe99⤵PID:2652
-
\??\c:\xrfflrf.exec:\xrfflrf.exe100⤵PID:2804
-
\??\c:\5lfffff.exec:\5lfffff.exe101⤵PID:784
-
\??\c:\5tntnt.exec:\5tntnt.exe102⤵PID:2920
-
\??\c:\bbtnnb.exec:\bbtnnb.exe103⤵PID:2964
-
\??\c:\vjpvp.exec:\vjpvp.exe104⤵PID:2568
-
\??\c:\7pjjj.exec:\7pjjj.exe105⤵PID:600
-
\??\c:\3rxrrfr.exec:\3rxrrfr.exe106⤵PID:2856
-
\??\c:\lfllxfr.exec:\lfllxfr.exe107⤵PID:1208
-
\??\c:\7hbthn.exec:\7hbthn.exe108⤵PID:1092
-
\??\c:\bhbhbn.exec:\bhbhbn.exe109⤵PID:1628
-
\??\c:\7jdjp.exec:\7jdjp.exe110⤵PID:2324
-
\??\c:\pvjvv.exec:\pvjvv.exe111⤵PID:2284
-
\??\c:\5lflrxx.exec:\5lflrxx.exe112⤵PID:2152
-
\??\c:\fxfxxxl.exec:\fxfxxxl.exe113⤵PID:1428
-
\??\c:\tnbhnb.exec:\tnbhnb.exe114⤵PID:1776
-
\??\c:\hbntnt.exec:\hbntnt.exe115⤵PID:2940
-
\??\c:\ddpvp.exec:\ddpvp.exe116⤵PID:2172
-
\??\c:\vpjvj.exec:\vpjvj.exe117⤵PID:1472
-
\??\c:\lxlfllr.exec:\lxlfllr.exe118⤵PID:2380
-
\??\c:\lflxrxr.exec:\lflxrxr.exe119⤵PID:2564
-
\??\c:\hbnbtb.exec:\hbnbtb.exe120⤵PID:2280
-
\??\c:\tnbbhh.exec:\tnbbhh.exe121⤵PID:2248
-
\??\c:\3pvpj.exec:\3pvpj.exe122⤵PID:2684
-
\??\c:\3jpvv.exec:\3jpvv.exe123⤵PID:2892
-
\??\c:\lfxfxfr.exec:\lfxfxfr.exe124⤵PID:2080
-
\??\c:\xlrfxlr.exec:\xlrfxlr.exe125⤵PID:2484
-
\??\c:\thbhnn.exec:\thbhnn.exe126⤵PID:2976
-
\??\c:\ttnbnn.exec:\ttnbnn.exe127⤵PID:2644
-
\??\c:\nntttb.exec:\nntttb.exe128⤵PID:2488
-
\??\c:\jpdvv.exec:\jpdvv.exe129⤵PID:2824
-
\??\c:\djjdd.exec:\djjdd.exe130⤵PID:2468
-
\??\c:\7lfxllf.exec:\7lfxllf.exe131⤵PID:1944
-
\??\c:\rfllxlx.exec:\rfllxlx.exe132⤵PID:1416
-
\??\c:\5htnbh.exec:\5htnbh.exe133⤵PID:1692
-
\??\c:\tttthh.exec:\tttthh.exe134⤵PID:2700
-
\??\c:\jpppp.exec:\jpppp.exe135⤵PID:776
-
\??\c:\jvdjj.exec:\jvdjj.exe136⤵PID:1980
-
\??\c:\fxllxlr.exec:\fxllxlr.exe137⤵PID:2540
-
\??\c:\lllrflx.exec:\lllrflx.exe138⤵PID:2952
-
\??\c:\ntbtnt.exec:\ntbtnt.exe139⤵PID:2836
-
\??\c:\5nhnht.exec:\5nhnht.exe140⤵PID:2992
-
\??\c:\5nbhtb.exec:\5nbhtb.exe141⤵PID:584
-
\??\c:\ddpvv.exec:\ddpvv.exe142⤵PID:2276
-
\??\c:\jvjjv.exec:\jvjjv.exe143⤵PID:2852
-
\??\c:\ffxxrfx.exec:\ffxxrfx.exe144⤵PID:1020
-
\??\c:\lrrfrrx.exec:\lrrfrrx.exe145⤵PID:2908
-
\??\c:\htnhtb.exec:\htnhtb.exe146⤵PID:2972
-
\??\c:\btnthh.exec:\btnthh.exe147⤵PID:2400
-
\??\c:\vdpdj.exec:\vdpdj.exe148⤵PID:1056
-
\??\c:\1jdvd.exec:\1jdvd.exe149⤵PID:1908
-
\??\c:\7xxxxrf.exec:\7xxxxrf.exe150⤵PID:1836
-
\??\c:\rlfllrx.exec:\rlfllrx.exe151⤵PID:2120
-
\??\c:\9tnbhn.exec:\9tnbhn.exe152⤵PID:1044
-
\??\c:\hthhnb.exec:\hthhnb.exe153⤵PID:2928
-
\??\c:\btnhtt.exec:\btnhtt.exe154⤵PID:1332
-
\??\c:\djdvp.exec:\djdvp.exe155⤵PID:1732
-
\??\c:\jjjpp.exec:\jjjpp.exe156⤵PID:2956
-
\??\c:\rfrxflr.exec:\rfrxflr.exe157⤵PID:2392
-
\??\c:\fxxflrf.exec:\fxxflrf.exe158⤵PID:1616
-
\??\c:\fxlxfrl.exec:\fxlxfrl.exe159⤵PID:2084
-
\??\c:\hntnbt.exec:\hntnbt.exe160⤵PID:2408
-
\??\c:\hhthnb.exec:\hhthnb.exe161⤵PID:1320
-
\??\c:\dvpdp.exec:\dvpdp.exe162⤵PID:2732
-
\??\c:\5dpvj.exec:\5dpvj.exe163⤵PID:2772
-
\??\c:\9djvj.exec:\9djvj.exe164⤵PID:2688
-
\??\c:\rlrrffx.exec:\rlrrffx.exe165⤵PID:2660
-
\??\c:\frllfrl.exec:\frllfrl.exe166⤵PID:2632
-
\??\c:\rxrxxlx.exec:\rxrxxlx.exe167⤵PID:2536
-
\??\c:\ffxlflx.exec:\ffxlflx.exe168⤵PID:2984
-
\??\c:\9nntht.exec:\9nntht.exe169⤵PID:2088
-
\??\c:\nbthnb.exec:\nbthnb.exe170⤵PID:2432
-
\??\c:\pjppj.exec:\pjppj.exe171⤵PID:2832
-
\??\c:\jddpd.exec:\jddpd.exe172⤵PID:1236
-
\??\c:\pjjpv.exec:\pjjpv.exe173⤵PID:1124
-
\??\c:\jppvp.exec:\jppvp.exe174⤵PID:2360
-
\??\c:\xfllrrf.exec:\xfllrrf.exe175⤵PID:1768
-
\??\c:\rlrxffr.exec:\rlrxffr.exe176⤵PID:1104
-
\??\c:\ttthtb.exec:\ttthtb.exe177⤵PID:1408
-
\??\c:\bhhttb.exec:\bhhttb.exe178⤵PID:940
-
\??\c:\nbbbnt.exec:\nbbbnt.exe179⤵PID:2860
-
\??\c:\dvjpv.exec:\dvjpv.exe180⤵PID:2064
-
\??\c:\7pjpp.exec:\7pjpp.exe181⤵PID:1220
-
\??\c:\jjddp.exec:\jjddp.exe182⤵PID:2696
-
\??\c:\lxlrrrr.exec:\lxlrrrr.exe183⤵PID:2844
-
\??\c:\rxflrfx.exec:\rxflrfx.exe184⤵PID:2276
-
\??\c:\bbnhbh.exec:\bbnhbh.exe185⤵PID:1164
-
\??\c:\nnbtnt.exec:\nnbtnt.exe186⤵PID:2116
-
\??\c:\btbhth.exec:\btbhth.exe187⤵PID:1596
-
\??\c:\5vdjv.exec:\5vdjv.exe188⤵PID:480
-
\??\c:\vpjdv.exec:\vpjdv.exe189⤵PID:1512
-
\??\c:\ddpdp.exec:\ddpdp.exe190⤵PID:572
-
\??\c:\pjddp.exec:\pjddp.exe191⤵PID:1208
-
\??\c:\llxxfrf.exec:\llxxfrf.exe192⤵PID:1248
-
\??\c:\xxrfxlf.exec:\xxrfxlf.exe193⤵PID:3008
-
\??\c:\3bbnth.exec:\3bbnth.exe194⤵PID:1992
-
\??\c:\5bthnt.exec:\5bthnt.exe195⤵PID:1088
-
\??\c:\tntnbb.exec:\tntnbb.exe196⤵PID:2424
-
\??\c:\jvvpp.exec:\jvvpp.exe197⤵PID:3004
-
\??\c:\pjddp.exec:\pjddp.exe198⤵PID:1132
-
\??\c:\dvjvd.exec:\dvjvd.exe199⤵PID:2960
-
\??\c:\xxlrxfr.exec:\xxlrxfr.exe200⤵PID:1280
-
\??\c:\frxlflx.exec:\frxlflx.exe201⤵PID:2260
-
\??\c:\9rllxfl.exec:\9rllxfl.exe202⤵PID:2380
-
\??\c:\xrxlxxf.exec:\xrxlxxf.exe203⤵PID:2564
-
\??\c:\hthnbh.exec:\hthnbh.exe204⤵PID:2280
-
\??\c:\hthtbn.exec:\hthtbn.exe205⤵PID:2248
-
\??\c:\tnbhnt.exec:\tnbhnt.exe206⤵PID:2572
-
\??\c:\thtttt.exec:\thtttt.exe207⤵PID:2812
-
\??\c:\ppdjj.exec:\ppdjj.exe208⤵PID:2080
-
\??\c:\jjvvd.exec:\jjvvd.exe209⤵PID:2472
-
\??\c:\5dpvv.exec:\5dpvv.exe210⤵PID:1704
-
\??\c:\llfrflf.exec:\llfrflf.exe211⤵PID:2644
-
\??\c:\rrfrxll.exec:\rrfrxll.exe212⤵PID:1956
-
\??\c:\3frrxlx.exec:\3frrxlx.exe213⤵PID:2180
-
\??\c:\nhnnhn.exec:\nhnnhn.exe214⤵PID:1696
-
\??\c:\hbtnbb.exec:\hbtnbb.exe215⤵PID:2996
-
\??\c:\hbtbbh.exec:\hbtbbh.exe216⤵PID:2712
-
\??\c:\jdjpj.exec:\jdjpj.exe217⤵PID:2708
-
\??\c:\pjdjd.exec:\pjdjd.exe218⤵PID:2820
-
\??\c:\1jdvp.exec:\1jdvp.exe219⤵PID:2816
-
\??\c:\xfxxlxl.exec:\xfxxlxl.exe220⤵PID:1324
-
\??\c:\lfxrllr.exec:\lfxrllr.exe221⤵PID:2540
-
\??\c:\flrxxxf.exec:\flrxxxf.exe222⤵PID:2788
-
\??\c:\lfxxxfl.exec:\lfxxxfl.exe223⤵PID:640
-
\??\c:\3nhnhh.exec:\3nhnhh.exe224⤵PID:1224
-
\??\c:\bbhthn.exec:\bbhthn.exe225⤵PID:2068
-
\??\c:\ttbthh.exec:\ttbthh.exe226⤵PID:2804
-
\??\c:\pjddp.exec:\pjddp.exe227⤵PID:2828
-
\??\c:\jdvjv.exec:\jdvjv.exe228⤵PID:664
-
\??\c:\ddppd.exec:\ddppd.exe229⤵PID:1436
-
\??\c:\5vvvd.exec:\5vvvd.exe230⤵PID:1740
-
\??\c:\3llrxxl.exec:\3llrxxl.exe231⤵PID:984
-
\??\c:\1rrxffr.exec:\1rrxffr.exe232⤵PID:1680
-
\??\c:\dvjjd.exec:\dvjjd.exe233⤵PID:376
-
\??\c:\rffflrx.exec:\rffflrx.exe234⤵PID:2060
-
\??\c:\nhthbb.exec:\nhthbb.exe235⤵PID:1628
-
\??\c:\hhtbnn.exec:\hhtbnn.exe236⤵PID:2900
-
\??\c:\jdpvd.exec:\jdpvd.exe237⤵PID:2384
-
\??\c:\rfxffxf.exec:\rfxffxf.exe238⤵PID:1996
-
\??\c:\hbhntt.exec:\hbhntt.exe239⤵PID:2948
-
\??\c:\vdvdj.exec:\vdvdj.exe240⤵PID:1112
-
\??\c:\xffrrxf.exec:\xffrrxf.exe241⤵PID:1584
-
\??\c:\lxrxffr.exec:\lxrxffr.exe242⤵PID:2244