Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 06:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
133721ca53f1013993a379769f651505a3086ca1e84fb66cd938200d43db15c2_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
133721ca53f1013993a379769f651505a3086ca1e84fb66cd938200d43db15c2_NeikiAnalytics.exe
-
Size
54KB
-
MD5
74ac72b9e3ebbe8f09f5426003c02740
-
SHA1
7f7e86452159d38df1387ac3286b483dcf0e203b
-
SHA256
133721ca53f1013993a379769f651505a3086ca1e84fb66cd938200d43db15c2
-
SHA512
12cd480fb7d4331ee4db7f8d22ebf57703c6f724daf65c330bfc473b9d62298eed4e8e5dda5f007936fd215760ba2295d439d04ed0870491da82f041581f52c5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFag:ymb3NkkiQ3mdBjFIFB
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral1/memory/2980-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2980-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1932-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1932-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-82-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/112-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/328-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2160-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/552-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1116-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/936-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/616-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
1rlrxff.exethntbb.exejvdjd.exe9jvpp.exe9rlrlxf.exejdppp.exepjppj.exe9rxflfx.exexrlrffl.exe5tbbhh.exevjdjd.exe3pjvd.exe1xfxrff.exe3hhnbh.exejpvjj.exepjdjd.exellxrxlr.exe9bnnhh.exenhttbt.exe1ppvd.exerfrllll.exefrxlrxx.exehhbnbh.exeppvpd.exejvpjd.exefxfflrf.exebhnntn.exettnttn.exedvddj.exevddvj.exe9xrxflr.exe9bbnbn.exe3jdpj.exeddjjj.exexlxxfxf.exexrxxllf.exenhhhnn.exennhbtb.exepdpjj.exedjvvv.exexlxllfr.exelxfffxf.exebnhntb.exe3thhtt.exejvddp.exe7vjjp.exerrllrxf.exexrxlflx.exehbtbhn.exebbbnbb.exejdvvd.exepjvvv.exe3rfxxfr.exexxrrxrf.exe3thhtb.exebtnbhh.exepjddd.exeddjdj.exexrfxxxl.exehhnhtb.exennnbhn.exedpvdj.exe9jdvd.exe3fxlrxx.exepid process 2536 1rlrxff.exe 1932 thntbb.exe 2688 jvdjd.exe 2864 9jvpp.exe 2652 9rlrlxf.exe 2628 jdppp.exe 2476 pjppj.exe 2948 9rxflfx.exe 112 xrlrffl.exe 2640 5tbbhh.exe 2632 vjdjd.exe 2816 3pjvd.exe 328 1xfxrff.exe 2148 3hhnbh.exe 2160 jpvjj.exe 552 pjdjd.exe 752 llxrxlr.exe 2708 9bnnhh.exe 2960 nhttbt.exe 2804 1ppvd.exe 2256 rfrllll.exe 1116 frxlrxx.exe 1772 hhbnbh.exe 1092 ppvpd.exe 2316 jvpjd.exe 936 fxfflrf.exe 1004 bhnntn.exe 1276 ttnttn.exe 1708 dvddj.exe 616 vddvj.exe 1968 9xrxflr.exe 2132 9bbnbn.exe 2752 3jdpj.exe 1932 ddjjj.exe 1476 xlxxfxf.exe 3024 xrxxllf.exe 1200 nhhhnn.exe 2688 nnhbtb.exe 2492 pdpjj.exe 2992 djvvv.exe 2512 xlxllfr.exe 2520 lxfffxf.exe 3036 bnhntb.exe 2508 3thhtt.exe 848 jvddp.exe 2760 7vjjp.exe 2544 rrllrxf.exe 1640 xrxlflx.exe 768 hbtbhn.exe 1592 bbbnbb.exe 1492 jdvvd.exe 1328 pjvvv.exe 584 3rfxxfr.exe 352 xxrrxrf.exe 1860 3thhtb.exe 2012 btnbhh.exe 2956 pjddd.exe 816 ddjdj.exe 1972 xrfxxxl.exe 2552 hhnhtb.exe 580 nnnbhn.exe 1116 dpvdj.exe 1772 9jdvd.exe 1844 3fxlrxx.exe -
Processes:
resource yara_rule behavioral1/memory/2980-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1932-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/112-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/328-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2160-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/552-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1116-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/936-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/616-289-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
133721ca53f1013993a379769f651505a3086ca1e84fb66cd938200d43db15c2_NeikiAnalytics.exe1rlrxff.exethntbb.exejvdjd.exe9jvpp.exe9rlrlxf.exejdppp.exepjppj.exe9rxflfx.exexrlrffl.exe5tbbhh.exevjdjd.exe3pjvd.exe1xfxrff.exe3hhnbh.exejpvjj.exedescription pid process target process PID 2980 wrote to memory of 2536 2980 133721ca53f1013993a379769f651505a3086ca1e84fb66cd938200d43db15c2_NeikiAnalytics.exe 1rlrxff.exe PID 2980 wrote to memory of 2536 2980 133721ca53f1013993a379769f651505a3086ca1e84fb66cd938200d43db15c2_NeikiAnalytics.exe 1rlrxff.exe PID 2980 wrote to memory of 2536 2980 133721ca53f1013993a379769f651505a3086ca1e84fb66cd938200d43db15c2_NeikiAnalytics.exe 1rlrxff.exe PID 2980 wrote to memory of 2536 2980 133721ca53f1013993a379769f651505a3086ca1e84fb66cd938200d43db15c2_NeikiAnalytics.exe 1rlrxff.exe PID 2536 wrote to memory of 1932 2536 1rlrxff.exe thntbb.exe PID 2536 wrote to memory of 1932 2536 1rlrxff.exe thntbb.exe PID 2536 wrote to memory of 1932 2536 1rlrxff.exe thntbb.exe PID 2536 wrote to memory of 1932 2536 1rlrxff.exe thntbb.exe PID 1932 wrote to memory of 2688 1932 thntbb.exe jvdjd.exe PID 1932 wrote to memory of 2688 1932 thntbb.exe jvdjd.exe PID 1932 wrote to memory of 2688 1932 thntbb.exe jvdjd.exe PID 1932 wrote to memory of 2688 1932 thntbb.exe jvdjd.exe PID 2688 wrote to memory of 2864 2688 jvdjd.exe 9jvpp.exe PID 2688 wrote to memory of 2864 2688 jvdjd.exe 9jvpp.exe PID 2688 wrote to memory of 2864 2688 jvdjd.exe 9jvpp.exe PID 2688 wrote to memory of 2864 2688 jvdjd.exe 9jvpp.exe PID 2864 wrote to memory of 2652 2864 9jvpp.exe 9rlrlxf.exe PID 2864 wrote to memory of 2652 2864 9jvpp.exe 9rlrlxf.exe PID 2864 wrote to memory of 2652 2864 9jvpp.exe 9rlrlxf.exe PID 2864 wrote to memory of 2652 2864 9jvpp.exe 9rlrlxf.exe PID 2652 wrote to memory of 2628 2652 9rlrlxf.exe jdppp.exe PID 2652 wrote to memory of 2628 2652 9rlrlxf.exe jdppp.exe PID 2652 wrote to memory of 2628 2652 9rlrlxf.exe jdppp.exe PID 2652 wrote to memory of 2628 2652 9rlrlxf.exe jdppp.exe PID 2628 wrote to memory of 2476 2628 jdppp.exe pjppj.exe PID 2628 wrote to memory of 2476 2628 jdppp.exe pjppj.exe PID 2628 wrote to memory of 2476 2628 jdppp.exe pjppj.exe PID 2628 wrote to memory of 2476 2628 jdppp.exe pjppj.exe PID 2476 wrote to memory of 2948 2476 pjppj.exe 9rxflfx.exe PID 2476 wrote to memory of 2948 2476 pjppj.exe 9rxflfx.exe PID 2476 wrote to memory of 2948 2476 pjppj.exe 9rxflfx.exe PID 2476 wrote to memory of 2948 2476 pjppj.exe 9rxflfx.exe PID 2948 wrote to memory of 112 2948 9rxflfx.exe xrlrffl.exe PID 2948 wrote to memory of 112 2948 9rxflfx.exe xrlrffl.exe PID 2948 wrote to memory of 112 2948 9rxflfx.exe xrlrffl.exe PID 2948 wrote to memory of 112 2948 9rxflfx.exe xrlrffl.exe PID 112 wrote to memory of 2640 112 xrlrffl.exe 5tbbhh.exe PID 112 wrote to memory of 2640 112 xrlrffl.exe 5tbbhh.exe PID 112 wrote to memory of 2640 112 xrlrffl.exe 5tbbhh.exe PID 112 wrote to memory of 2640 112 xrlrffl.exe 5tbbhh.exe PID 2640 wrote to memory of 2632 2640 5tbbhh.exe vjdjd.exe PID 2640 wrote to memory of 2632 2640 5tbbhh.exe vjdjd.exe PID 2640 wrote to memory of 2632 2640 5tbbhh.exe vjdjd.exe PID 2640 wrote to memory of 2632 2640 5tbbhh.exe vjdjd.exe PID 2632 wrote to memory of 2816 2632 vjdjd.exe 3pjvd.exe PID 2632 wrote to memory of 2816 2632 vjdjd.exe 3pjvd.exe PID 2632 wrote to memory of 2816 2632 vjdjd.exe 3pjvd.exe PID 2632 wrote to memory of 2816 2632 vjdjd.exe 3pjvd.exe PID 2816 wrote to memory of 328 2816 3pjvd.exe 1xfxrff.exe PID 2816 wrote to memory of 328 2816 3pjvd.exe 1xfxrff.exe PID 2816 wrote to memory of 328 2816 3pjvd.exe 1xfxrff.exe PID 2816 wrote to memory of 328 2816 3pjvd.exe 1xfxrff.exe PID 328 wrote to memory of 2148 328 1xfxrff.exe 3hhnbh.exe PID 328 wrote to memory of 2148 328 1xfxrff.exe 3hhnbh.exe PID 328 wrote to memory of 2148 328 1xfxrff.exe 3hhnbh.exe PID 328 wrote to memory of 2148 328 1xfxrff.exe 3hhnbh.exe PID 2148 wrote to memory of 2160 2148 3hhnbh.exe jpvjj.exe PID 2148 wrote to memory of 2160 2148 3hhnbh.exe jpvjj.exe PID 2148 wrote to memory of 2160 2148 3hhnbh.exe jpvjj.exe PID 2148 wrote to memory of 2160 2148 3hhnbh.exe jpvjj.exe PID 2160 wrote to memory of 552 2160 jpvjj.exe pjdjd.exe PID 2160 wrote to memory of 552 2160 jpvjj.exe pjdjd.exe PID 2160 wrote to memory of 552 2160 jpvjj.exe pjdjd.exe PID 2160 wrote to memory of 552 2160 jpvjj.exe pjdjd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\133721ca53f1013993a379769f651505a3086ca1e84fb66cd938200d43db15c2_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\133721ca53f1013993a379769f651505a3086ca1e84fb66cd938200d43db15c2_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\1rlrxff.exec:\1rlrxff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\thntbb.exec:\thntbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\jvdjd.exec:\jvdjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\9jvpp.exec:\9jvpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\9rlrlxf.exec:\9rlrlxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\jdppp.exec:\jdppp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\pjppj.exec:\pjppj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\9rxflfx.exec:\9rxflfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\xrlrffl.exec:\xrlrffl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
\??\c:\5tbbhh.exec:\5tbbhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\vjdjd.exec:\vjdjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\3pjvd.exec:\3pjvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\1xfxrff.exec:\1xfxrff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:328 -
\??\c:\3hhnbh.exec:\3hhnbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\jpvjj.exec:\jpvjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\pjdjd.exec:\pjdjd.exe17⤵
- Executes dropped EXE
PID:552 -
\??\c:\llxrxlr.exec:\llxrxlr.exe18⤵
- Executes dropped EXE
PID:752 -
\??\c:\9bnnhh.exec:\9bnnhh.exe19⤵
- Executes dropped EXE
PID:2708 -
\??\c:\nhttbt.exec:\nhttbt.exe20⤵
- Executes dropped EXE
PID:2960 -
\??\c:\1ppvd.exec:\1ppvd.exe21⤵
- Executes dropped EXE
PID:2804 -
\??\c:\rfrllll.exec:\rfrllll.exe22⤵
- Executes dropped EXE
PID:2256 -
\??\c:\frxlrxx.exec:\frxlrxx.exe23⤵
- Executes dropped EXE
PID:1116 -
\??\c:\hhbnbh.exec:\hhbnbh.exe24⤵
- Executes dropped EXE
PID:1772 -
\??\c:\ppvpd.exec:\ppvpd.exe25⤵
- Executes dropped EXE
PID:1092 -
\??\c:\jvpjd.exec:\jvpjd.exe26⤵
- Executes dropped EXE
PID:2316 -
\??\c:\fxfflrf.exec:\fxfflrf.exe27⤵
- Executes dropped EXE
PID:936 -
\??\c:\bhnntn.exec:\bhnntn.exe28⤵
- Executes dropped EXE
PID:1004 -
\??\c:\ttnttn.exec:\ttnttn.exe29⤵
- Executes dropped EXE
PID:1276 -
\??\c:\dvddj.exec:\dvddj.exe30⤵
- Executes dropped EXE
PID:1708 -
\??\c:\vddvj.exec:\vddvj.exe31⤵
- Executes dropped EXE
PID:616 -
\??\c:\9xrxflr.exec:\9xrxflr.exe32⤵
- Executes dropped EXE
PID:1968 -
\??\c:\9bbnbn.exec:\9bbnbn.exe33⤵
- Executes dropped EXE
PID:2132 -
\??\c:\3jdpj.exec:\3jdpj.exe34⤵
- Executes dropped EXE
PID:2752 -
\??\c:\ddjjj.exec:\ddjjj.exe35⤵
- Executes dropped EXE
PID:1932 -
\??\c:\xlxxfxf.exec:\xlxxfxf.exe36⤵
- Executes dropped EXE
PID:1476 -
\??\c:\xrxxllf.exec:\xrxxllf.exe37⤵
- Executes dropped EXE
PID:3024 -
\??\c:\nhhhnn.exec:\nhhhnn.exe38⤵
- Executes dropped EXE
PID:1200 -
\??\c:\nnhbtb.exec:\nnhbtb.exe39⤵
- Executes dropped EXE
PID:2688 -
\??\c:\pdpjj.exec:\pdpjj.exe40⤵
- Executes dropped EXE
PID:2492 -
\??\c:\djvvv.exec:\djvvv.exe41⤵
- Executes dropped EXE
PID:2992 -
\??\c:\xlxllfr.exec:\xlxllfr.exe42⤵
- Executes dropped EXE
PID:2512 -
\??\c:\lxfffxf.exec:\lxfffxf.exe43⤵
- Executes dropped EXE
PID:2520 -
\??\c:\bnhntb.exec:\bnhntb.exe44⤵
- Executes dropped EXE
PID:3036 -
\??\c:\3thhtt.exec:\3thhtt.exe45⤵
- Executes dropped EXE
PID:2508 -
\??\c:\jvddp.exec:\jvddp.exe46⤵
- Executes dropped EXE
PID:848 -
\??\c:\7vjjp.exec:\7vjjp.exe47⤵
- Executes dropped EXE
PID:2760 -
\??\c:\rrllrxf.exec:\rrllrxf.exe48⤵
- Executes dropped EXE
PID:2544 -
\??\c:\xrxlflx.exec:\xrxlflx.exe49⤵
- Executes dropped EXE
PID:1640 -
\??\c:\hbtbhn.exec:\hbtbhn.exe50⤵
- Executes dropped EXE
PID:768 -
\??\c:\bbbnbb.exec:\bbbnbb.exe51⤵
- Executes dropped EXE
PID:1592 -
\??\c:\jdvvd.exec:\jdvvd.exe52⤵
- Executes dropped EXE
PID:1492 -
\??\c:\pjvvv.exec:\pjvvv.exe53⤵
- Executes dropped EXE
PID:1328 -
\??\c:\3rfxxfr.exec:\3rfxxfr.exe54⤵
- Executes dropped EXE
PID:584 -
\??\c:\xxrrxrf.exec:\xxrrxrf.exe55⤵
- Executes dropped EXE
PID:352 -
\??\c:\3thhtb.exec:\3thhtb.exe56⤵
- Executes dropped EXE
PID:1860 -
\??\c:\btnbhh.exec:\btnbhh.exe57⤵
- Executes dropped EXE
PID:2012 -
\??\c:\pjddd.exec:\pjddd.exe58⤵
- Executes dropped EXE
PID:2956 -
\??\c:\ddjdj.exec:\ddjdj.exe59⤵
- Executes dropped EXE
PID:816 -
\??\c:\xrfxxxl.exec:\xrfxxxl.exe60⤵
- Executes dropped EXE
PID:1972 -
\??\c:\hhnhtb.exec:\hhnhtb.exe61⤵
- Executes dropped EXE
PID:2552 -
\??\c:\nnnbhn.exec:\nnnbhn.exe62⤵
- Executes dropped EXE
PID:580 -
\??\c:\dpvdj.exec:\dpvdj.exe63⤵
- Executes dropped EXE
PID:1116 -
\??\c:\9jdvd.exec:\9jdvd.exe64⤵
- Executes dropped EXE
PID:1772 -
\??\c:\3fxlrxx.exec:\3fxlrxx.exe65⤵
- Executes dropped EXE
PID:1844 -
\??\c:\rlrflrf.exec:\rlrflrf.exe66⤵PID:2416
-
\??\c:\tnbnbb.exec:\tnbnbb.exe67⤵PID:764
-
\??\c:\7bnhnh.exec:\7bnhnh.exe68⤵PID:1940
-
\??\c:\vjvjv.exec:\vjvjv.exe69⤵PID:1984
-
\??\c:\jdvvd.exec:\jdvvd.exe70⤵PID:2868
-
\??\c:\9rlrflx.exec:\9rlrflx.exe71⤵PID:2244
-
\??\c:\rfrrfff.exec:\rfrrfff.exe72⤵PID:2228
-
\??\c:\hnhttb.exec:\hnhttb.exe73⤵PID:2368
-
\??\c:\bbttbh.exec:\bbttbh.exe74⤵PID:2980
-
\??\c:\vpdpd.exec:\vpdpd.exe75⤵PID:2132
-
\??\c:\vpjpd.exec:\vpjpd.exe76⤵PID:2604
-
\??\c:\xllrlrf.exec:\xllrlrf.exe77⤵PID:1512
-
\??\c:\1nbntn.exec:\1nbntn.exe78⤵PID:2716
-
\??\c:\nhtbbb.exec:\nhtbbb.exe79⤵PID:2612
-
\??\c:\7vjvv.exec:\7vjvv.exe80⤵PID:2744
-
\??\c:\dpdvj.exec:\dpdvj.exe81⤵PID:2840
-
\??\c:\9xrrffx.exec:\9xrrffx.exe82⤵PID:2620
-
\??\c:\3ffrxxf.exec:\3ffrxxf.exe83⤵PID:2460
-
\??\c:\5tttbb.exec:\5tttbb.exe84⤵PID:2528
-
\??\c:\hhnnnt.exec:\hhnnnt.exe85⤵PID:2476
-
\??\c:\ppvpv.exec:\ppvpv.exe86⤵PID:2488
-
\??\c:\pdjpp.exec:\pdjpp.exe87⤵PID:2516
-
\??\c:\frlllll.exec:\frlllll.exe88⤵PID:112
-
\??\c:\9lfrffr.exec:\9lfrffr.exe89⤵PID:2788
-
\??\c:\thtbnh.exec:\thtbnh.exe90⤵PID:772
-
\??\c:\nthbbt.exec:\nthbbt.exe91⤵PID:1212
-
\??\c:\vppdv.exec:\vppdv.exe92⤵PID:1644
-
\??\c:\vppvd.exec:\vppvd.exe93⤵PID:328
-
\??\c:\lxlrxfl.exec:\lxlrxfl.exe94⤵PID:2148
-
\??\c:\7fxfrxr.exec:\7fxfrxr.exe95⤵PID:2156
-
\??\c:\5nnttb.exec:\5nnttb.exe96⤵PID:2140
-
\??\c:\nhnbhn.exec:\nhnbhn.exe97⤵PID:680
-
\??\c:\ppdpd.exec:\ppdpd.exe98⤵PID:2008
-
\??\c:\ddvdj.exec:\ddvdj.exe99⤵PID:2004
-
\??\c:\frfllrx.exec:\frfllrx.exe100⤵PID:2220
-
\??\c:\7frrxxx.exec:\7frrxxx.exe101⤵PID:2804
-
\??\c:\tnbtnt.exec:\tnbtnt.exe102⤵PID:2196
-
\??\c:\9jppv.exec:\9jppv.exe103⤵PID:1728
-
\??\c:\dvppp.exec:\dvppp.exe104⤵PID:1720
-
\??\c:\rllrrrl.exec:\rllrrrl.exe105⤵PID:2644
-
\??\c:\rlrxflr.exec:\rlrxflr.exe106⤵PID:1092
-
\??\c:\hbtthb.exec:\hbtthb.exe107⤵PID:1844
-
\??\c:\htttbt.exec:\htttbt.exe108⤵PID:1660
-
\??\c:\7jvdd.exec:\7jvdd.exe109⤵PID:864
-
\??\c:\pjdpd.exec:\pjdpd.exe110⤵PID:1836
-
\??\c:\lfxlllr.exec:\lfxlllr.exe111⤵PID:1196
-
\??\c:\xrxfrlr.exec:\xrxfrlr.exe112⤵PID:1840
-
\??\c:\nhhnbb.exec:\nhhnbb.exe113⤵PID:1672
-
\??\c:\nhtttn.exec:\nhtttn.exe114⤵PID:2056
-
\??\c:\vjpjp.exec:\vjpjp.exe115⤵PID:2372
-
\??\c:\vjjpp.exec:\vjjpp.exe116⤵PID:2896
-
\??\c:\5frlllx.exec:\5frlllx.exe117⤵PID:2380
-
\??\c:\flrlrlx.exec:\flrlrlx.exe118⤵PID:1932
-
\??\c:\tnnthh.exec:\tnnthh.exe119⤵PID:1476
-
\??\c:\hbbbhb.exec:\hbbbhb.exe120⤵PID:3024
-
\??\c:\jdvvv.exec:\jdvvv.exe121⤵PID:1200
-
\??\c:\pdpdd.exec:\pdpdd.exe122⤵PID:2480
-
\??\c:\lxrrxfl.exec:\lxrrxfl.exe123⤵PID:2820
-
\??\c:\9llrlrr.exec:\9llrlrr.exe124⤵PID:2624
-
\??\c:\btthnt.exec:\btthnt.exe125⤵PID:1176
-
\??\c:\bhbhhn.exec:\bhbhhn.exe126⤵PID:2340
-
\??\c:\pjvdj.exec:\pjvdj.exe127⤵PID:1236
-
\??\c:\7pvjd.exec:\7pvjd.exe128⤵PID:2508
-
\??\c:\fxffflr.exec:\fxffflr.exe129⤵PID:2948
-
\??\c:\fxxrrlx.exec:\fxxrrlx.exe130⤵PID:288
-
\??\c:\3nhntb.exec:\3nhntb.exe131⤵PID:2172
-
\??\c:\9htbbh.exec:\9htbbh.exe132⤵PID:1516
-
\??\c:\pjjpp.exec:\pjjpp.exe133⤵PID:2816
-
\??\c:\vjjjj.exec:\vjjjj.exe134⤵PID:1592
-
\??\c:\xrlfffl.exec:\xrlfffl.exe135⤵PID:2192
-
\??\c:\xlrxxfr.exec:\xlrxxfr.exe136⤵PID:2160
-
\??\c:\3nhhnn.exec:\3nhhnn.exe137⤵PID:1328
-
\??\c:\bthnbb.exec:\bthnbb.exe138⤵PID:2040
-
\??\c:\ddjjp.exec:\ddjjp.exe139⤵PID:352
-
\??\c:\9pvvd.exec:\9pvvd.exe140⤵PID:2932
-
\??\c:\fxfllrx.exec:\fxfllrx.exe141⤵PID:2956
-
\??\c:\xrxffxx.exec:\xrxffxx.exe142⤵PID:1292
-
\??\c:\thtbhh.exec:\thtbhh.exe143⤵PID:1972
-
\??\c:\hthhtt.exec:\hthhtt.exe144⤵PID:2800
-
\??\c:\dvpdd.exec:\dvpdd.exe145⤵PID:1960
-
\??\c:\3djdj.exec:\3djdj.exe146⤵PID:2432
-
\??\c:\7llxllr.exec:\7llxllr.exe147⤵PID:1116
-
\??\c:\1hnbht.exec:\1hnbht.exe148⤵PID:1444
-
\??\c:\7nbbhn.exec:\7nbbhn.exe149⤵PID:2416
-
\??\c:\jjjpj.exec:\jjjpj.exe150⤵PID:2320
-
\??\c:\vjdjj.exec:\vjdjj.exe151⤵PID:1940
-
\??\c:\fxrlxff.exec:\fxrlxff.exe152⤵PID:2888
-
\??\c:\frfrlxr.exec:\frfrlxr.exe153⤵PID:1984
-
\??\c:\bnbbnt.exec:\bnbbnt.exe154⤵PID:616
-
\??\c:\dpvdj.exec:\dpvdj.exe155⤵PID:2228
-
\??\c:\frffllr.exec:\frffllr.exe156⤵PID:2084
-
\??\c:\thnnbt.exec:\thnnbt.exe157⤵PID:2748
-
\??\c:\thtthn.exec:\thtthn.exe158⤵PID:3044
-
\??\c:\1vjpv.exec:\1vjpv.exe159⤵PID:2132
-
\??\c:\jdpvj.exec:\jdpvj.exe160⤵PID:1512
-
\??\c:\xlrxfxf.exec:\xlrxfxf.exe161⤵PID:2720
-
\??\c:\rlrfrlf.exec:\rlrfrlf.exe162⤵PID:2860
-
\??\c:\bbbhnh.exec:\bbbhnh.exe163⤵PID:2688
-
\??\c:\hbhhhn.exec:\hbhhhn.exe164⤵PID:2492
-
\??\c:\vpdpd.exec:\vpdpd.exe165⤵PID:2384
-
\??\c:\pvdjd.exec:\pvdjd.exe166⤵PID:2512
-
\??\c:\fxlrrxl.exec:\fxlrrxl.exe167⤵PID:2460
-
\??\c:\1fxfrfr.exec:\1fxfrfr.exe168⤵PID:1256
-
\??\c:\xlfffff.exec:\xlfffff.exe169⤵PID:2968
-
\??\c:\5nhnbh.exec:\5nhnbh.exe170⤵PID:848
-
\??\c:\tnbbnh.exec:\tnbbnh.exe171⤵PID:2516
-
\??\c:\dvdvj.exec:\dvdvj.exe172⤵PID:2640
-
\??\c:\vvddp.exec:\vvddp.exe173⤵PID:1580
-
\??\c:\rfxxlll.exec:\rfxxlll.exe174⤵PID:1524
-
\??\c:\lxfllll.exec:\lxfllll.exe175⤵PID:1536
-
\??\c:\3hntnn.exec:\3hntnn.exe176⤵PID:2188
-
\??\c:\httbhn.exec:\httbhn.exe177⤵PID:844
-
\??\c:\1vvjd.exec:\1vvjd.exe178⤵PID:584
-
\??\c:\dpvdd.exec:\dpvdd.exe179⤵PID:2156
-
\??\c:\fxflrxf.exec:\fxflrxf.exe180⤵PID:1860
-
\??\c:\1rllrxl.exec:\1rllrxl.exe181⤵PID:680
-
\??\c:\bthnnn.exec:\bthnnn.exe182⤵PID:2004
-
\??\c:\nhntbb.exec:\nhntbb.exe183⤵PID:2012
-
\??\c:\3hhhbh.exec:\3hhhbh.exe184⤵PID:2804
-
\??\c:\vvpdj.exec:\vvpdj.exe185⤵PID:856
-
\??\c:\3jppv.exec:\3jppv.exe186⤵PID:1728
-
\??\c:\xrrxxxf.exec:\xrrxxxf.exe187⤵PID:1716
-
\??\c:\fxlrxxf.exec:\fxlrxxf.exe188⤵PID:1772
-
\??\c:\btthtb.exec:\btthtb.exe189⤵PID:2644
-
\??\c:\bnbhnt.exec:\bnbhnt.exe190⤵PID:1844
-
\??\c:\7jdjv.exec:\7jdjv.exe191⤵PID:2316
-
\??\c:\ddvjv.exec:\ddvjv.exe192⤵PID:864
-
\??\c:\frxrflx.exec:\frxrflx.exe193⤵PID:880
-
\??\c:\fxlrfrx.exec:\fxlrfrx.exe194⤵PID:2868
-
\??\c:\lfxlrxx.exec:\lfxlrxx.exe195⤵PID:1196
-
\??\c:\hhtbbb.exec:\hhtbbb.exe196⤵PID:1672
-
\??\c:\nhtnbb.exec:\nhtnbb.exe197⤵PID:2404
-
\??\c:\vpvdv.exec:\vpvdv.exe198⤵PID:2648
-
\??\c:\ddjdp.exec:\ddjdp.exe199⤵PID:2600
-
\??\c:\xrxlrrf.exec:\xrxlrrf.exe200⤵PID:2604
-
\??\c:\rfrxxff.exec:\rfrxxff.exe201⤵PID:1932
-
\??\c:\xrflffl.exec:\xrflffl.exe202⤵PID:2580
-
\??\c:\hthnbb.exec:\hthnbb.exe203⤵PID:2584
-
\??\c:\pdpvd.exec:\pdpvd.exe204⤵PID:1200
-
\??\c:\rrlfxlr.exec:\rrlfxlr.exe205⤵PID:2740
-
\??\c:\nhnhnn.exec:\nhnhnn.exe206⤵PID:2492
-
\??\c:\thbbtn.exec:\thbbtn.exe207⤵PID:2500
-
\??\c:\5ddjp.exec:\5ddjp.exe208⤵PID:2232
-
\??\c:\vpjpv.exec:\vpjpv.exe209⤵PID:1944
-
\??\c:\rrrrffl.exec:\rrrrffl.exe210⤵PID:2456
-
\??\c:\7xrxlfr.exec:\7xrxlfr.exe211⤵PID:2968
-
\??\c:\rlflxfx.exec:\rlflxfx.exe212⤵PID:848
-
\??\c:\3bbhhh.exec:\3bbhhh.exe213⤵PID:2796
-
\??\c:\5hbhnn.exec:\5hbhnn.exe214⤵PID:2544
-
\??\c:\pdppp.exec:\pdppp.exe215⤵PID:2172
-
\??\c:\pjddv.exec:\pjddv.exe216⤵PID:1516
-
\??\c:\9flxxrr.exec:\9flxxrr.exe217⤵PID:1492
-
\??\c:\rrflxfl.exec:\rrflxfl.exe218⤵PID:2188
-
\??\c:\bnnttb.exec:\bnnttb.exe219⤵PID:780
-
\??\c:\btbhtb.exec:\btbhtb.exe220⤵PID:2140
-
\??\c:\hbhntt.exec:\hbhntt.exe221⤵PID:2156
-
\??\c:\ddpvj.exec:\ddpvj.exe222⤵PID:1860
-
\??\c:\rfxxxxf.exec:\rfxxxxf.exe223⤵PID:680
-
\??\c:\xfrxrxr.exec:\xfrxrxr.exe224⤵PID:2260
-
\??\c:\nbhnnn.exec:\nbhnnn.exe225⤵PID:2012
-
\??\c:\htbbnn.exec:\htbbnn.exe226⤵PID:2804
-
\??\c:\5jdpp.exec:\5jdpp.exe227⤵PID:856
-
\??\c:\ppjpj.exec:\ppjpj.exe228⤵PID:1728
-
\??\c:\lfxrxrr.exec:\lfxrxrr.exe229⤵PID:2284
-
\??\c:\5frrxfl.exec:\5frrxfl.exe230⤵PID:952
-
\??\c:\9xrllfl.exec:\9xrllfl.exe231⤵PID:1116
-
\??\c:\7nhnhh.exec:\7nhnhh.exe232⤵PID:1152
-
\??\c:\ntnnbb.exec:\ntnnbb.exe233⤵PID:2316
-
\??\c:\ddvjv.exec:\ddvjv.exe234⤵PID:1936
-
\??\c:\vpdvj.exec:\vpdvj.exe235⤵PID:1608
-
\??\c:\xrxxrxf.exec:\xrxxrxf.exe236⤵PID:2296
-
\??\c:\rlxrrrr.exec:\rlxrrrr.exe237⤵PID:1984
-
\??\c:\nhnbnt.exec:\nhnbnt.exe238⤵PID:1852
-
\??\c:\btbbnt.exec:\btbbnt.exe239⤵PID:1632
-
\??\c:\9dvdp.exec:\9dvdp.exe240⤵PID:3020
-
\??\c:\jjvjv.exec:\jjvjv.exe241⤵PID:1848
-
\??\c:\dvddv.exec:\dvddv.exe242⤵PID:2656