Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 05:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b50aeca915993f27cd725896006ef060_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
b50aeca915993f27cd725896006ef060_NeikiAnalytics.exe
-
Size
116KB
-
MD5
b50aeca915993f27cd725896006ef060
-
SHA1
a65a9a91e3a059165b3587b2a7a788e499c0ecb4
-
SHA256
bf55fcae6f921d5c384ad6483e308369bfbba4ee16d5ea8c70346116e8c60727
-
SHA512
46810ccbaa28443fba7d03d734b9c7876fdeb5a8307f886c830f0c433c6f165ea38df9d00b144d56fa094ced12afe0352a7167383932a525890227511f58092b
-
SSDEEP
3072:ymb3NkkiQ3mdBjFosxXGPXbXQMFHLgDWSmjlkF0:n3C9BRosxW8MFHLMWvl3
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/3032-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2044-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2044-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2308-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1660-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1188-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1788-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1564-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/272-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1040-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1156-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/324-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/320-266-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rrflfxf.exejdddj.exelxffxfr.exebhnbtn.exejjdpd.exexlxlfxr.exehhhnhb.exejvvvp.exefxfxxff.exehtthnb.exe9jdjp.exexfrxffx.exefxlfrrx.exehbnntt.exe1pjvj.exejdjvp.exerrlfxfr.exe1lrfffx.exehbnttt.exevvpvj.exejjdvd.exefxffffl.exefrllxrr.exehttnth.exe1pdvd.exellxxrlx.exe3bnntt.exevdjpd.exejjjvp.exerxxfllr.exe7bhbhn.exetthhhn.exedpdjd.exeffxxrlr.exerlrrfxl.exe3hbbnn.exedvdpv.exepppjd.exe1rllflr.exe9frrxfr.exe9hbnbb.exetbtnnh.exexxlrflf.exebbhntb.exettnbnb.exedpppv.exe1jjpd.exexrlxflx.exe3rfxrfr.exehnnnnh.exe1hbhbb.exedpvvj.exedddjv.exellrrfrx.exe3xxffxl.exe7hbtbh.exettnhht.exe5jdvj.exe9fxrxfl.exenhnntn.exehtbnhn.exejdvpd.exerlxffrf.exe9hthtb.exepid process 2556 rrflfxf.exe 2044 jdddj.exe 2568 lxffxfr.exe 2560 bhnbtn.exe 2584 jjdpd.exe 2380 xlxlfxr.exe 2308 hhhnhb.exe 1660 jvvvp.exe 1428 fxfxxff.exe 1188 htthnb.exe 1788 9jdjp.exe 1564 xfrxffx.exe 272 fxlfrrx.exe 1904 hbnntt.exe 1808 1pjvj.exe 844 jdjvp.exe 1040 rrlfxfr.exe 2688 1lrfffx.exe 2192 hbnttt.exe 1156 vvpvj.exe 324 jjdvd.exe 592 fxffffl.exe 1620 frllxrr.exe 1104 httnth.exe 2204 1pdvd.exe 1804 llxxrlx.exe 320 3bnntt.exe 2060 vdjpd.exe 2840 jjjvp.exe 2232 rxxfllr.exe 2116 7bhbhn.exe 2208 tthhhn.exe 1932 dpdjd.exe 2556 ffxxrlr.exe 2580 rlrrfxl.exe 2592 3hbbnn.exe 2620 dvdpv.exe 2616 pppjd.exe 2708 1rllflr.exe 2424 9frrxfr.exe 2584 9hbnbb.exe 2452 tbtnnh.exe 2448 xxlrflf.exe 1608 bbhntb.exe 1660 ttnbnb.exe 1492 dpppv.exe 2612 1jjpd.exe 2444 xrlxflx.exe 1888 3rfxrfr.exe 1552 hnnnnh.exe 1868 1hbhbb.exe 1740 dpvvj.exe 2700 dddjv.exe 864 llrrfrx.exe 2416 3xxffxl.exe 2588 7hbtbh.exe 2792 ttnhht.exe 540 5jdvj.exe 3068 9fxrxfl.exe 556 nhnntn.exe 544 htbnhn.exe 2672 jdvpd.exe 1080 rlxffrf.exe 1284 9hthtb.exe -
Processes:
resource yara_rule behavioral1/memory/3032-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2308-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1188-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1788-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1564-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/272-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1040-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1156-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/324-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/320-266-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-284-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b50aeca915993f27cd725896006ef060_NeikiAnalytics.exerrflfxf.exejdddj.exelxffxfr.exebhnbtn.exejjdpd.exexlxlfxr.exehhhnhb.exejvvvp.exefxfxxff.exehtthnb.exe9jdjp.exexfrxffx.exefxlfrrx.exehbnntt.exe1pjvj.exedescription pid process target process PID 3032 wrote to memory of 2556 3032 b50aeca915993f27cd725896006ef060_NeikiAnalytics.exe rrflfxf.exe PID 3032 wrote to memory of 2556 3032 b50aeca915993f27cd725896006ef060_NeikiAnalytics.exe rrflfxf.exe PID 3032 wrote to memory of 2556 3032 b50aeca915993f27cd725896006ef060_NeikiAnalytics.exe rrflfxf.exe PID 3032 wrote to memory of 2556 3032 b50aeca915993f27cd725896006ef060_NeikiAnalytics.exe rrflfxf.exe PID 2556 wrote to memory of 2044 2556 rrflfxf.exe jdddj.exe PID 2556 wrote to memory of 2044 2556 rrflfxf.exe jdddj.exe PID 2556 wrote to memory of 2044 2556 rrflfxf.exe jdddj.exe PID 2556 wrote to memory of 2044 2556 rrflfxf.exe jdddj.exe PID 2044 wrote to memory of 2568 2044 jdddj.exe lxffxfr.exe PID 2044 wrote to memory of 2568 2044 jdddj.exe lxffxfr.exe PID 2044 wrote to memory of 2568 2044 jdddj.exe lxffxfr.exe PID 2044 wrote to memory of 2568 2044 jdddj.exe lxffxfr.exe PID 2568 wrote to memory of 2560 2568 lxffxfr.exe bhnbtn.exe PID 2568 wrote to memory of 2560 2568 lxffxfr.exe bhnbtn.exe PID 2568 wrote to memory of 2560 2568 lxffxfr.exe bhnbtn.exe PID 2568 wrote to memory of 2560 2568 lxffxfr.exe bhnbtn.exe PID 2560 wrote to memory of 2584 2560 bhnbtn.exe jjdpd.exe PID 2560 wrote to memory of 2584 2560 bhnbtn.exe jjdpd.exe PID 2560 wrote to memory of 2584 2560 bhnbtn.exe jjdpd.exe PID 2560 wrote to memory of 2584 2560 bhnbtn.exe jjdpd.exe PID 2584 wrote to memory of 2380 2584 jjdpd.exe xlxlfxr.exe PID 2584 wrote to memory of 2380 2584 jjdpd.exe xlxlfxr.exe PID 2584 wrote to memory of 2380 2584 jjdpd.exe xlxlfxr.exe PID 2584 wrote to memory of 2380 2584 jjdpd.exe xlxlfxr.exe PID 2380 wrote to memory of 2308 2380 xlxlfxr.exe hhhnhb.exe PID 2380 wrote to memory of 2308 2380 xlxlfxr.exe hhhnhb.exe PID 2380 wrote to memory of 2308 2380 xlxlfxr.exe hhhnhb.exe PID 2380 wrote to memory of 2308 2380 xlxlfxr.exe hhhnhb.exe PID 2308 wrote to memory of 1660 2308 hhhnhb.exe jvvvp.exe PID 2308 wrote to memory of 1660 2308 hhhnhb.exe jvvvp.exe PID 2308 wrote to memory of 1660 2308 hhhnhb.exe jvvvp.exe PID 2308 wrote to memory of 1660 2308 hhhnhb.exe jvvvp.exe PID 1660 wrote to memory of 1428 1660 jvvvp.exe fxfxxff.exe PID 1660 wrote to memory of 1428 1660 jvvvp.exe fxfxxff.exe PID 1660 wrote to memory of 1428 1660 jvvvp.exe fxfxxff.exe PID 1660 wrote to memory of 1428 1660 jvvvp.exe fxfxxff.exe PID 1428 wrote to memory of 1188 1428 fxfxxff.exe htthnb.exe PID 1428 wrote to memory of 1188 1428 fxfxxff.exe htthnb.exe PID 1428 wrote to memory of 1188 1428 fxfxxff.exe htthnb.exe PID 1428 wrote to memory of 1188 1428 fxfxxff.exe htthnb.exe PID 1188 wrote to memory of 1788 1188 htthnb.exe 9jdjp.exe PID 1188 wrote to memory of 1788 1188 htthnb.exe 9jdjp.exe PID 1188 wrote to memory of 1788 1188 htthnb.exe 9jdjp.exe PID 1188 wrote to memory of 1788 1188 htthnb.exe 9jdjp.exe PID 1788 wrote to memory of 1564 1788 9jdjp.exe xfrxffx.exe PID 1788 wrote to memory of 1564 1788 9jdjp.exe xfrxffx.exe PID 1788 wrote to memory of 1564 1788 9jdjp.exe xfrxffx.exe PID 1788 wrote to memory of 1564 1788 9jdjp.exe xfrxffx.exe PID 1564 wrote to memory of 272 1564 xfrxffx.exe fxlfrrx.exe PID 1564 wrote to memory of 272 1564 xfrxffx.exe fxlfrrx.exe PID 1564 wrote to memory of 272 1564 xfrxffx.exe fxlfrrx.exe PID 1564 wrote to memory of 272 1564 xfrxffx.exe fxlfrrx.exe PID 272 wrote to memory of 1904 272 fxlfrrx.exe hbnntt.exe PID 272 wrote to memory of 1904 272 fxlfrrx.exe hbnntt.exe PID 272 wrote to memory of 1904 272 fxlfrrx.exe hbnntt.exe PID 272 wrote to memory of 1904 272 fxlfrrx.exe hbnntt.exe PID 1904 wrote to memory of 1808 1904 hbnntt.exe 1pjvj.exe PID 1904 wrote to memory of 1808 1904 hbnntt.exe 1pjvj.exe PID 1904 wrote to memory of 1808 1904 hbnntt.exe 1pjvj.exe PID 1904 wrote to memory of 1808 1904 hbnntt.exe 1pjvj.exe PID 1808 wrote to memory of 844 1808 1pjvj.exe jdjvp.exe PID 1808 wrote to memory of 844 1808 1pjvj.exe jdjvp.exe PID 1808 wrote to memory of 844 1808 1pjvj.exe jdjvp.exe PID 1808 wrote to memory of 844 1808 1pjvj.exe jdjvp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b50aeca915993f27cd725896006ef060_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b50aeca915993f27cd725896006ef060_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\rrflfxf.exec:\rrflfxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\jdddj.exec:\jdddj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\lxffxfr.exec:\lxffxfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\bhnbtn.exec:\bhnbtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\jjdpd.exec:\jjdpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\xlxlfxr.exec:\xlxlfxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\hhhnhb.exec:\hhhnhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\jvvvp.exec:\jvvvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\fxfxxff.exec:\fxfxxff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\htthnb.exec:\htthnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\9jdjp.exec:\9jdjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\xfrxffx.exec:\xfrxffx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\fxlfrrx.exec:\fxlfrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:272 -
\??\c:\hbnntt.exec:\hbnntt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\1pjvj.exec:\1pjvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\jdjvp.exec:\jdjvp.exe17⤵
- Executes dropped EXE
PID:844 -
\??\c:\rrlfxfr.exec:\rrlfxfr.exe18⤵
- Executes dropped EXE
PID:1040 -
\??\c:\1lrfffx.exec:\1lrfffx.exe19⤵
- Executes dropped EXE
PID:2688 -
\??\c:\hbnttt.exec:\hbnttt.exe20⤵
- Executes dropped EXE
PID:2192 -
\??\c:\vvpvj.exec:\vvpvj.exe21⤵
- Executes dropped EXE
PID:1156 -
\??\c:\jjdvd.exec:\jjdvd.exe22⤵
- Executes dropped EXE
PID:324 -
\??\c:\fxffffl.exec:\fxffffl.exe23⤵
- Executes dropped EXE
PID:592 -
\??\c:\frllxrr.exec:\frllxrr.exe24⤵
- Executes dropped EXE
PID:1620 -
\??\c:\httnth.exec:\httnth.exe25⤵
- Executes dropped EXE
PID:1104 -
\??\c:\1pdvd.exec:\1pdvd.exe26⤵
- Executes dropped EXE
PID:2204 -
\??\c:\llxxrlx.exec:\llxxrlx.exe27⤵
- Executes dropped EXE
PID:1804 -
\??\c:\3bnntt.exec:\3bnntt.exe28⤵
- Executes dropped EXE
PID:320 -
\??\c:\vdjpd.exec:\vdjpd.exe29⤵
- Executes dropped EXE
PID:2060 -
\??\c:\jjjvp.exec:\jjjvp.exe30⤵
- Executes dropped EXE
PID:2840 -
\??\c:\rxxfllr.exec:\rxxfllr.exe31⤵
- Executes dropped EXE
PID:2232 -
\??\c:\7bhbhn.exec:\7bhbhn.exe32⤵
- Executes dropped EXE
PID:2116 -
\??\c:\tthhhn.exec:\tthhhn.exe33⤵
- Executes dropped EXE
PID:2208 -
\??\c:\dpdjd.exec:\dpdjd.exe34⤵
- Executes dropped EXE
PID:1932 -
\??\c:\ffxxrlr.exec:\ffxxrlr.exe35⤵
- Executes dropped EXE
PID:2556 -
\??\c:\rlrrfxl.exec:\rlrrfxl.exe36⤵
- Executes dropped EXE
PID:2580 -
\??\c:\3hbbnn.exec:\3hbbnn.exe37⤵
- Executes dropped EXE
PID:2592 -
\??\c:\dvdpv.exec:\dvdpv.exe38⤵
- Executes dropped EXE
PID:2620 -
\??\c:\pppjd.exec:\pppjd.exe39⤵
- Executes dropped EXE
PID:2616 -
\??\c:\1rllflr.exec:\1rllflr.exe40⤵
- Executes dropped EXE
PID:2708 -
\??\c:\9frrxfr.exec:\9frrxfr.exe41⤵
- Executes dropped EXE
PID:2424 -
\??\c:\9hbnbb.exec:\9hbnbb.exe42⤵
- Executes dropped EXE
PID:2584 -
\??\c:\tbtnnh.exec:\tbtnnh.exe43⤵
- Executes dropped EXE
PID:2452 -
\??\c:\xxlrflf.exec:\xxlrflf.exe44⤵
- Executes dropped EXE
PID:2448 -
\??\c:\bbhntb.exec:\bbhntb.exe45⤵
- Executes dropped EXE
PID:1608 -
\??\c:\ttnbnb.exec:\ttnbnb.exe46⤵
- Executes dropped EXE
PID:1660 -
\??\c:\dpppv.exec:\dpppv.exe47⤵
- Executes dropped EXE
PID:1492 -
\??\c:\1jjpd.exec:\1jjpd.exe48⤵
- Executes dropped EXE
PID:2612 -
\??\c:\xrlxflx.exec:\xrlxflx.exe49⤵
- Executes dropped EXE
PID:2444 -
\??\c:\3rfxrfr.exec:\3rfxrfr.exe50⤵
- Executes dropped EXE
PID:1888 -
\??\c:\hnnnnh.exec:\hnnnnh.exe51⤵
- Executes dropped EXE
PID:1552 -
\??\c:\1hbhbb.exec:\1hbhbb.exe52⤵
- Executes dropped EXE
PID:1868 -
\??\c:\dpvvj.exec:\dpvvj.exe53⤵
- Executes dropped EXE
PID:1740 -
\??\c:\dddjv.exec:\dddjv.exe54⤵
- Executes dropped EXE
PID:2700 -
\??\c:\llrrfrx.exec:\llrrfrx.exe55⤵
- Executes dropped EXE
PID:864 -
\??\c:\3xxffxl.exec:\3xxffxl.exe56⤵
- Executes dropped EXE
PID:2416 -
\??\c:\7hbtbh.exec:\7hbtbh.exe57⤵
- Executes dropped EXE
PID:2588 -
\??\c:\ttnhht.exec:\ttnhht.exe58⤵
- Executes dropped EXE
PID:2792 -
\??\c:\5jdvj.exec:\5jdvj.exe59⤵
- Executes dropped EXE
PID:540 -
\??\c:\9fxrxfl.exec:\9fxrxfl.exe60⤵
- Executes dropped EXE
PID:3068 -
\??\c:\nhnntn.exec:\nhnntn.exe61⤵
- Executes dropped EXE
PID:556 -
\??\c:\htbnhn.exec:\htbnhn.exe62⤵
- Executes dropped EXE
PID:544 -
\??\c:\jdvpd.exec:\jdvpd.exe63⤵
- Executes dropped EXE
PID:2672 -
\??\c:\rlxffrf.exec:\rlxffrf.exe64⤵
- Executes dropped EXE
PID:1080 -
\??\c:\9hthtb.exec:\9hthtb.exe65⤵
- Executes dropped EXE
PID:1284 -
\??\c:\djpjj.exec:\djpjj.exe66⤵PID:1884
-
\??\c:\dvdvd.exec:\dvdvd.exe67⤵PID:1280
-
\??\c:\5llffxx.exec:\5llffxx.exe68⤵PID:1804
-
\??\c:\ffllfxx.exec:\ffllfxx.exe69⤵PID:2064
-
\??\c:\thtthb.exec:\thtthb.exe70⤵PID:2804
-
\??\c:\vvpjv.exec:\vvpjv.exe71⤵PID:3004
-
\??\c:\7dvvj.exec:\7dvvj.exe72⤵PID:2796
-
\??\c:\5xrxxfl.exec:\5xrxxfl.exe73⤵PID:2780
-
\??\c:\lxrxxfl.exec:\lxrxxfl.exe74⤵PID:2200
-
\??\c:\hhbtnn.exec:\hhbtnn.exe75⤵PID:2660
-
\??\c:\tthtbn.exec:\tthtbn.exe76⤵PID:2892
-
\??\c:\jvpdj.exec:\jvpdj.exe77⤵PID:2872
-
\??\c:\vvpvj.exec:\vvpvj.exe78⤵PID:1532
-
\??\c:\frxfxxl.exec:\frxfxxl.exe79⤵PID:2536
-
\??\c:\xrfrlfr.exec:\xrfrlfr.exe80⤵PID:2632
-
\??\c:\tnntnb.exec:\tnntnb.exe81⤵PID:2496
-
\??\c:\vdvpj.exec:\vdvpj.exe82⤵PID:2516
-
\??\c:\pjdpd.exec:\pjdpd.exe83⤵PID:2692
-
\??\c:\9lflffl.exec:\9lflffl.exe84⤵PID:2396
-
\??\c:\5llrllr.exec:\5llrllr.exe85⤵PID:2808
-
\??\c:\tbnhnt.exec:\tbnhnt.exe86⤵PID:2828
-
\??\c:\hhnnbh.exec:\hhnnbh.exe87⤵PID:280
-
\??\c:\7dvvj.exec:\7dvvj.exe88⤵PID:1524
-
\??\c:\djdjd.exec:\djdjd.exe89⤵PID:1476
-
\??\c:\rlrrrfl.exec:\rlrrrfl.exe90⤵PID:1612
-
\??\c:\hhnntb.exec:\hhnntb.exe91⤵PID:328
-
\??\c:\nhttth.exec:\nhttth.exe92⤵PID:1560
-
\??\c:\vvdvv.exec:\vvdvv.exe93⤵PID:824
-
\??\c:\7jdvd.exec:\7jdvd.exe94⤵PID:272
-
\??\c:\9fxlrxl.exec:\9fxlrxl.exe95⤵PID:1904
-
\??\c:\xxrfxlx.exec:\xxrfxlx.exe96⤵PID:1856
-
\??\c:\ttnhnb.exec:\ttnhnb.exe97⤵PID:844
-
\??\c:\tnhbbn.exec:\tnhbbn.exe98⤵PID:3056
-
\??\c:\jjjdp.exec:\jjjdp.exe99⤵PID:1040
-
\??\c:\vjpdv.exec:\vjpdv.exe100⤵PID:1968
-
\??\c:\lfxlxrr.exec:\lfxlxrr.exe101⤵PID:2136
-
\??\c:\llxlxlr.exec:\llxlxlr.exe102⤵PID:2320
-
\??\c:\bhhtht.exec:\bhhtht.exe103⤵PID:1412
-
\??\c:\bbbbbb.exec:\bbbbbb.exe104⤵PID:1572
-
\??\c:\jvvjp.exec:\jvvjp.exe105⤵PID:1916
-
\??\c:\pjpdv.exec:\pjpdv.exe106⤵PID:1732
-
\??\c:\xllrxxl.exec:\xllrxxl.exe107⤵PID:1108
-
\??\c:\3ththt.exec:\3ththt.exe108⤵PID:2976
-
\??\c:\btntht.exec:\btntht.exe109⤵PID:1224
-
\??\c:\dvjpd.exec:\dvjpd.exe110⤵PID:924
-
\??\c:\pdvpp.exec:\pdvpp.exe111⤵PID:320
-
\??\c:\5xfrfff.exec:\5xfrfff.exe112⤵PID:2788
-
\??\c:\xrllxfr.exec:\xrllxfr.exe113⤵PID:2344
-
\??\c:\bnbnnn.exec:\bnbnnn.exe114⤵PID:2140
-
\??\c:\ppddp.exec:\ppddp.exe115⤵PID:2340
-
\??\c:\dvjdd.exec:\dvjdd.exe116⤵PID:1952
-
\??\c:\rrfrxlx.exec:\rrfrxlx.exe117⤵PID:2200
-
\??\c:\9ffxxxf.exec:\9ffxxxf.exe118⤵PID:3032
-
\??\c:\5tbnht.exec:\5tbnht.exe119⤵PID:2484
-
\??\c:\vvjpd.exec:\vvjpd.exe120⤵PID:2876
-
\??\c:\9ppvj.exec:\9ppvj.exe121⤵PID:2044
-
\??\c:\7rffrrf.exec:\7rffrrf.exe122⤵PID:2512
-
\??\c:\lrxfrll.exec:\lrxfrll.exe123⤵PID:2384
-
\??\c:\bthhnb.exec:\bthhnb.exe124⤵PID:2412
-
\??\c:\bbtbnt.exec:\bbtbnt.exe125⤵PID:2376
-
\??\c:\vjdpv.exec:\vjdpv.exe126⤵PID:2440
-
\??\c:\pvpdj.exec:\pvpdj.exe127⤵PID:2428
-
\??\c:\rrlfxxl.exec:\rrlfxxl.exe128⤵PID:2300
-
\??\c:\bnttbb.exec:\bnttbb.exe129⤵PID:2828
-
\??\c:\httttb.exec:\httttb.exe130⤵PID:2260
-
\??\c:\jdvdd.exec:\jdvdd.exe131⤵PID:2348
-
\??\c:\vjpjj.exec:\vjpjj.exe132⤵PID:1892
-
\??\c:\lxlllrr.exec:\lxlllrr.exe133⤵PID:1788
-
\??\c:\rfrrflx.exec:\rfrrflx.exe134⤵PID:872
-
\??\c:\tthhtt.exec:\tthhtt.exe135⤵PID:1564
-
\??\c:\ttbhht.exec:\ttbhht.exe136⤵PID:1896
-
\??\c:\pppdd.exec:\pppdd.exe137⤵PID:272
-
\??\c:\9jvpv.exec:\9jvpv.exe138⤵PID:840
-
\??\c:\9xllxfl.exec:\9xllxfl.exe139⤵PID:2824
-
\??\c:\3hbbnn.exec:\3hbbnn.exe140⤵PID:2160
-
\??\c:\btbtbn.exec:\btbtbn.exe141⤵PID:1852
-
\??\c:\5dpvd.exec:\5dpvd.exe142⤵PID:2756
-
\??\c:\ddpdp.exec:\ddpdp.exe143⤵PID:1968
-
\??\c:\rfrxfxx.exec:\rfrxfxx.exe144⤵PID:2924
-
\??\c:\frxfflr.exec:\frxfflr.exe145⤵PID:788
-
\??\c:\9bhhtt.exec:\9bhhtt.exe146⤵PID:592
-
\??\c:\thnntt.exec:\thnntt.exe147⤵PID:1760
-
\??\c:\jjdjp.exec:\jjdjp.exe148⤵PID:928
-
\??\c:\dddvp.exec:\dddvp.exe149⤵PID:1584
-
\??\c:\3frxffl.exec:\3frxffl.exe150⤵PID:2956
-
\??\c:\lxflxxr.exec:\lxflxxr.exe151⤵PID:2224
-
\??\c:\btbhnt.exec:\btbhnt.exe152⤵PID:664
-
\??\c:\vjvpp.exec:\vjvpp.exe153⤵PID:1568
-
\??\c:\7pvdj.exec:\7pvdj.exe154⤵PID:2212
-
\??\c:\rfrxffl.exec:\rfrxffl.exe155⤵PID:2096
-
\??\c:\frxfrfx.exec:\frxfrfx.exe156⤵PID:2912
-
\??\c:\1hnthn.exec:\1hnthn.exe157⤵PID:576
-
\??\c:\nbthnt.exec:\nbthnt.exe158⤵PID:2848
-
\??\c:\7jvdp.exec:\7jvdp.exe159⤵PID:2660
-
\??\c:\pjvvv.exec:\pjvvv.exe160⤵PID:2888
-
\??\c:\5lxfrxl.exec:\5lxfrxl.exe161⤵PID:2904
-
\??\c:\1xfxrrx.exec:\1xfxrrx.exe162⤵PID:1528
-
\??\c:\bbnbnt.exec:\bbnbnt.exe163⤵PID:2536
-
\??\c:\7nttht.exec:\7nttht.exe164⤵PID:2504
-
\??\c:\dvvjd.exec:\dvvjd.exe165⤵PID:2648
-
\??\c:\frfxrlx.exec:\frfxrlx.exe166⤵PID:2548
-
\??\c:\xlxffxx.exec:\xlxffxx.exe167⤵PID:2624
-
\??\c:\rfrllll.exec:\rfrllll.exe168⤵PID:2380
-
\??\c:\bnnthh.exec:\bnnthh.exe169⤵PID:2980
-
\??\c:\1ppvj.exec:\1ppvj.exe170⤵PID:2308
-
\??\c:\9dvvp.exec:\9dvvp.exe171⤵PID:2300
-
\??\c:\7lrxxxf.exec:\7lrxxxf.exe172⤵PID:772
-
\??\c:\ffrflrx.exec:\ffrflrx.exe173⤵PID:1768
-
\??\c:\1nhnhn.exec:\1nhnhn.exe174⤵PID:1928
-
\??\c:\vvjjv.exec:\vvjjv.exe175⤵PID:240
-
\??\c:\jdddp.exec:\jdddp.exe176⤵PID:356
-
\??\c:\dddpp.exec:\dddpp.exe177⤵PID:640
-
\??\c:\frfflrf.exec:\frfflrf.exe178⤵PID:2168
-
\??\c:\ttbhhh.exec:\ttbhhh.exe179⤵PID:1740
-
\??\c:\fflrxrr.exec:\fflrxrr.exe180⤵PID:1240
-
\??\c:\rlflflx.exec:\rlflflx.exe181⤵PID:2820
-
\??\c:\5bbnbt.exec:\5bbnbt.exe182⤵PID:2716
-
\??\c:\bhttnb.exec:\bhttnb.exe183⤵PID:588
-
\??\c:\5ppvv.exec:\5ppvv.exe184⤵PID:2712
-
\??\c:\pvjdv.exec:\pvjdv.exe185⤵PID:1980
-
\??\c:\frxrxfx.exec:\frxrxfx.exe186⤵PID:488
-
\??\c:\xfxlflf.exec:\xfxlflf.exe187⤵PID:2764
-
\??\c:\nnnthh.exec:\nnnthh.exe188⤵PID:324
-
\??\c:\htbnhn.exec:\htbnhn.exe189⤵PID:2752
-
\??\c:\jvpjp.exec:\jvpjp.exe190⤵PID:660
-
\??\c:\9jdjv.exec:\9jdjv.exe191⤵PID:1592
-
\??\c:\9rlflrl.exec:\9rlflrl.exe192⤵PID:2952
-
\??\c:\nbbnbh.exec:\nbbnbh.exe193⤵PID:1280
-
\??\c:\3thntt.exec:\3thntt.exe194⤵PID:1220
-
\??\c:\jvvvj.exec:\jvvvj.exe195⤵PID:700
-
\??\c:\ddvdp.exec:\ddvdp.exe196⤵PID:1908
-
\??\c:\rrrxxrf.exec:\rrrxxrf.exe197⤵PID:3004
-
\??\c:\bththt.exec:\bththt.exe198⤵PID:2840
-
\??\c:\thttnt.exec:\thttnt.exe199⤵PID:1432
-
\??\c:\pdjjd.exec:\pdjjd.exe200⤵PID:576
-
\??\c:\vvpvj.exec:\vvpvj.exe201⤵PID:2988
-
\??\c:\llflxfx.exec:\llflxfx.exe202⤵PID:2468
-
\??\c:\xrflxxl.exec:\xrflxxl.exe203⤵PID:1368
-
\??\c:\thbtbb.exec:\thbtbb.exe204⤵PID:2484
-
\??\c:\nbbnnb.exec:\nbbnnb.exe205⤵PID:2580
-
\??\c:\ddvvv.exec:\ddvvv.exe206⤵PID:2536
-
\??\c:\ppjpd.exec:\ppjpd.exe207⤵PID:2044
-
\??\c:\rxrrflf.exec:\rxrrflf.exe208⤵PID:2708
-
\??\c:\rxxfxfx.exec:\rxxfxfx.exe209⤵PID:2548
-
\??\c:\bhhhhh.exec:\bhhhhh.exe210⤵PID:2624
-
\??\c:\tnbthn.exec:\tnbthn.exe211⤵PID:2860
-
\??\c:\dvpvp.exec:\dvpvp.exe212⤵PID:2448
-
\??\c:\dvvvj.exec:\dvvvj.exe213⤵PID:3008
-
\??\c:\fxrfrfx.exec:\fxrfrfx.exe214⤵PID:2276
-
\??\c:\rrlrflx.exec:\rrlrflx.exe215⤵PID:1660
-
\??\c:\nnbnth.exec:\nnbnth.exe216⤵PID:1360
-
\??\c:\hnntbb.exec:\hnntbb.exe217⤵PID:2280
-
\??\c:\ppvpp.exec:\ppvpp.exe218⤵PID:1880
-
\??\c:\vvvdp.exec:\vvvdp.exe219⤵PID:356
-
\??\c:\5rlrfxl.exec:\5rlrfxl.exe220⤵PID:640
-
\??\c:\fxlflfl.exec:\fxlflfl.exe221⤵PID:1752
-
\??\c:\bthbtb.exec:\bthbtb.exe222⤵PID:1236
-
\??\c:\thtnbh.exec:\thtnbh.exe223⤵PID:2704
-
\??\c:\vpjdp.exec:\vpjdp.exe224⤵PID:2684
-
\??\c:\jvvdj.exec:\jvvdj.exe225⤵PID:2820
-
\??\c:\xxflrlx.exec:\xxflrlx.exe226⤵PID:2716
-
\??\c:\3ntbth.exec:\3ntbth.exe227⤵PID:2464
-
\??\c:\3hthnn.exec:\3hthnn.exe228⤵PID:896
-
\??\c:\dpddj.exec:\dpddj.exe229⤵PID:2336
-
\??\c:\flfflrf.exec:\flfflrf.exe230⤵PID:488
-
\??\c:\rxxxffl.exec:\rxxxffl.exe231⤵PID:2764
-
\??\c:\bthtbh.exec:\bthtbh.exe232⤵PID:324
-
\??\c:\tntbbh.exec:\tntbbh.exe233⤵PID:2752
-
\??\c:\jdjpv.exec:\jdjpv.exe234⤵PID:660
-
\??\c:\lrfllrx.exec:\lrfllrx.exe235⤵PID:1592
-
\??\c:\rllxfff.exec:\rllxfff.exe236⤵PID:2952
-
\??\c:\btttth.exec:\btttth.exe237⤵PID:1280
-
\??\c:\3dvdd.exec:\3dvdd.exe238⤵PID:1220
-
\??\c:\pppdv.exec:\pppdv.exe239⤵PID:2804
-
\??\c:\3lfflfr.exec:\3lfflfr.exe240⤵PID:1908
-
\??\c:\1fflrxf.exec:\1fflrxf.exe241⤵PID:2780
-
\??\c:\nhtntn.exec:\nhtntn.exe242⤵PID:2840