Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 03:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7de60b5e7b88211a00e69a09585b4950_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
7de60b5e7b88211a00e69a09585b4950_NeikiAnalytics.exe
-
Size
965KB
-
MD5
7de60b5e7b88211a00e69a09585b4950
-
SHA1
00dea446b2aa84ce0478d394f7c813c74f8bb76e
-
SHA256
9976bb75ff6a7815946aef4e4b625285545373fd96da73973d47b6b63e9468e6
-
SHA512
3a9d77616068edf5b10f943023aa7673dd3b5689197993680b3e65eda6647183a49ba2429090d896d9fa33085a0bd37aa68b229f43c5a052377294de9320ba9c
-
SSDEEP
12288:n3C9yMo+S0L9xRnoq7H9xqYL04iVypNKvzcMwdBS3b3aoqYveXVadBlHD+CURPO6:SgD4bhoqLDqYLagB6Wj1+Cysn
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral1/memory/1632-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2164-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1496-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/352-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2112-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1564-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2376-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1324-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2236-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/840-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1572-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/808-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2020-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
hnnnth.exefflxrxf.exetnbbnn.exe3jjjv.exehhtbbt.exe5xrlflr.exe5hnnbb.exe5tnttb.exedvvpd.exe5lllrrr.exevpjjd.exennhnbh.exedjjvd.exenhhtbt.exelllrflr.exedvvdp.exennhthn.exejdppv.exettbbnh.exexrrlrfl.exe3ppvp.exennnnnt.exehhnnbb.exerlxffrf.exe1djjd.exerlflxff.exeffxlfrf.exejjpdp.exepjjjd.exe5rxllfl.exexrlxlrx.exe1bhhnt.exe3htbnb.exeddpjj.exellffrxf.exenbbnth.exe1jjpv.exetnhhnt.exevpdjj.exe9rrfxrf.exebtntth.exejjjjj.exe3lrrllx.exenhhnbt.exevdppv.exe9fxfrfl.exe3nnnth.exepdddj.exe5lxfllr.exe9hhnnn.exe9ddjj.exefxxxxrf.exebtttnt.exejvdjp.exelxflrlx.exebtttnn.exe7dppd.exelflrflr.exebttbtb.exedvjjd.exexrrxflr.exehnhthh.exennbnbh.exe3fxfllx.exepid process 2632 hnnnth.exe 2592 fflxrxf.exe 2800 tnbbnn.exe 3004 3jjjv.exe 2476 hhtbbt.exe 2712 5xrlflr.exe 2528 5hnnbb.exe 2164 5tnttb.exe 1496 dvvpd.exe 1364 5lllrrr.exe 352 vpjjd.exe 2112 nnhnbh.exe 1564 djjvd.exe 2376 nhhtbt.exe 1720 lllrflr.exe 1132 dvvdp.exe 1324 nnhthn.exe 2872 jdppv.exe 684 ttbbnh.exe 2812 xrrlrfl.exe 1724 3ppvp.exe 2236 nnnnnt.exe 2072 hhnnbb.exe 840 rlxffrf.exe 2980 1djjd.exe 1572 rlflxff.exe 808 ffxlfrf.exe 1832 jjpdp.exe 2316 pjjjd.exe 2020 5rxllfl.exe 2944 xrlxlrx.exe 3056 1bhhnt.exe 2940 3htbnb.exe 1844 ddpjj.exe 2988 llffrxf.exe 1272 nbbnth.exe 2580 1jjpv.exe 2596 tnhhnt.exe 2792 vpdjj.exe 1944 9rrfxrf.exe 2744 btntth.exe 2444 jjjjj.exe 2508 3lrrllx.exe 2960 nhhnbt.exe 992 vdppv.exe 1548 9fxfrfl.exe 1368 3nnnth.exe 1924 pdddj.exe 2128 5lxfllr.exe 2408 9hhnnn.exe 1856 9ddjj.exe 1564 fxxxxrf.exe 1848 btttnt.exe 1912 jvdjp.exe 1420 lxflrlx.exe 2924 btttnn.exe 2864 7dppd.exe 2968 lflrflr.exe 568 bttbtb.exe 300 dvjjd.exe 1468 xrrxflr.exe 1312 hnhthh.exe 2364 nnbnbh.exe 2312 3fxfllx.exe -
Processes:
resource yara_rule behavioral1/memory/1632-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2164-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1496-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/352-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2112-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1564-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1324-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1572-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/808-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-299-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7de60b5e7b88211a00e69a09585b4950_NeikiAnalytics.exehnnnth.exefflxrxf.exetnbbnn.exe3jjjv.exehhtbbt.exe5xrlflr.exe5hnnbb.exe5tnttb.exedvvpd.exe5lllrrr.exevpjjd.exennhnbh.exedjjvd.exenhhtbt.exelllrflr.exedescription pid process target process PID 1632 wrote to memory of 2632 1632 7de60b5e7b88211a00e69a09585b4950_NeikiAnalytics.exe hnnnth.exe PID 1632 wrote to memory of 2632 1632 7de60b5e7b88211a00e69a09585b4950_NeikiAnalytics.exe hnnnth.exe PID 1632 wrote to memory of 2632 1632 7de60b5e7b88211a00e69a09585b4950_NeikiAnalytics.exe hnnnth.exe PID 1632 wrote to memory of 2632 1632 7de60b5e7b88211a00e69a09585b4950_NeikiAnalytics.exe hnnnth.exe PID 2632 wrote to memory of 2592 2632 hnnnth.exe fflxrxf.exe PID 2632 wrote to memory of 2592 2632 hnnnth.exe fflxrxf.exe PID 2632 wrote to memory of 2592 2632 hnnnth.exe fflxrxf.exe PID 2632 wrote to memory of 2592 2632 hnnnth.exe fflxrxf.exe PID 2592 wrote to memory of 2800 2592 fflxrxf.exe tnbbnn.exe PID 2592 wrote to memory of 2800 2592 fflxrxf.exe tnbbnn.exe PID 2592 wrote to memory of 2800 2592 fflxrxf.exe tnbbnn.exe PID 2592 wrote to memory of 2800 2592 fflxrxf.exe tnbbnn.exe PID 2800 wrote to memory of 3004 2800 tnbbnn.exe 3jjjv.exe PID 2800 wrote to memory of 3004 2800 tnbbnn.exe 3jjjv.exe PID 2800 wrote to memory of 3004 2800 tnbbnn.exe 3jjjv.exe PID 2800 wrote to memory of 3004 2800 tnbbnn.exe 3jjjv.exe PID 3004 wrote to memory of 2476 3004 3jjjv.exe hhtbbt.exe PID 3004 wrote to memory of 2476 3004 3jjjv.exe hhtbbt.exe PID 3004 wrote to memory of 2476 3004 3jjjv.exe hhtbbt.exe PID 3004 wrote to memory of 2476 3004 3jjjv.exe hhtbbt.exe PID 2476 wrote to memory of 2712 2476 hhtbbt.exe 5xrlflr.exe PID 2476 wrote to memory of 2712 2476 hhtbbt.exe 5xrlflr.exe PID 2476 wrote to memory of 2712 2476 hhtbbt.exe 5xrlflr.exe PID 2476 wrote to memory of 2712 2476 hhtbbt.exe 5xrlflr.exe PID 2712 wrote to memory of 2528 2712 5xrlflr.exe 5hnnbb.exe PID 2712 wrote to memory of 2528 2712 5xrlflr.exe 5hnnbb.exe PID 2712 wrote to memory of 2528 2712 5xrlflr.exe 5hnnbb.exe PID 2712 wrote to memory of 2528 2712 5xrlflr.exe 5hnnbb.exe PID 2528 wrote to memory of 2164 2528 5hnnbb.exe 5tnttb.exe PID 2528 wrote to memory of 2164 2528 5hnnbb.exe 5tnttb.exe PID 2528 wrote to memory of 2164 2528 5hnnbb.exe 5tnttb.exe PID 2528 wrote to memory of 2164 2528 5hnnbb.exe 5tnttb.exe PID 2164 wrote to memory of 1496 2164 5tnttb.exe dvvpd.exe PID 2164 wrote to memory of 1496 2164 5tnttb.exe dvvpd.exe PID 2164 wrote to memory of 1496 2164 5tnttb.exe dvvpd.exe PID 2164 wrote to memory of 1496 2164 5tnttb.exe dvvpd.exe PID 1496 wrote to memory of 1364 1496 dvvpd.exe 5lllrrr.exe PID 1496 wrote to memory of 1364 1496 dvvpd.exe 5lllrrr.exe PID 1496 wrote to memory of 1364 1496 dvvpd.exe 5lllrrr.exe PID 1496 wrote to memory of 1364 1496 dvvpd.exe 5lllrrr.exe PID 1364 wrote to memory of 352 1364 5lllrrr.exe vpjjd.exe PID 1364 wrote to memory of 352 1364 5lllrrr.exe vpjjd.exe PID 1364 wrote to memory of 352 1364 5lllrrr.exe vpjjd.exe PID 1364 wrote to memory of 352 1364 5lllrrr.exe vpjjd.exe PID 352 wrote to memory of 2112 352 vpjjd.exe nnhnbh.exe PID 352 wrote to memory of 2112 352 vpjjd.exe nnhnbh.exe PID 352 wrote to memory of 2112 352 vpjjd.exe nnhnbh.exe PID 352 wrote to memory of 2112 352 vpjjd.exe nnhnbh.exe PID 2112 wrote to memory of 1564 2112 nnhnbh.exe djjvd.exe PID 2112 wrote to memory of 1564 2112 nnhnbh.exe djjvd.exe PID 2112 wrote to memory of 1564 2112 nnhnbh.exe djjvd.exe PID 2112 wrote to memory of 1564 2112 nnhnbh.exe djjvd.exe PID 1564 wrote to memory of 2376 1564 djjvd.exe nhhtbt.exe PID 1564 wrote to memory of 2376 1564 djjvd.exe nhhtbt.exe PID 1564 wrote to memory of 2376 1564 djjvd.exe nhhtbt.exe PID 1564 wrote to memory of 2376 1564 djjvd.exe nhhtbt.exe PID 2376 wrote to memory of 1720 2376 nhhtbt.exe lllrflr.exe PID 2376 wrote to memory of 1720 2376 nhhtbt.exe lllrflr.exe PID 2376 wrote to memory of 1720 2376 nhhtbt.exe lllrflr.exe PID 2376 wrote to memory of 1720 2376 nhhtbt.exe lllrflr.exe PID 1720 wrote to memory of 1132 1720 lllrflr.exe dvvdp.exe PID 1720 wrote to memory of 1132 1720 lllrflr.exe dvvdp.exe PID 1720 wrote to memory of 1132 1720 lllrflr.exe dvvdp.exe PID 1720 wrote to memory of 1132 1720 lllrflr.exe dvvdp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7de60b5e7b88211a00e69a09585b4950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7de60b5e7b88211a00e69a09585b4950_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\hnnnth.exec:\hnnnth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\fflxrxf.exec:\fflxrxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\tnbbnn.exec:\tnbbnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\3jjjv.exec:\3jjjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\hhtbbt.exec:\hhtbbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\5xrlflr.exec:\5xrlflr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\5hnnbb.exec:\5hnnbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\5tnttb.exec:\5tnttb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\dvvpd.exec:\dvvpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\5lllrrr.exec:\5lllrrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\vpjjd.exec:\vpjjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:352 -
\??\c:\nnhnbh.exec:\nnhnbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\djjvd.exec:\djjvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\nhhtbt.exec:\nhhtbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\lllrflr.exec:\lllrflr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\dvvdp.exec:\dvvdp.exe17⤵
- Executes dropped EXE
PID:1132 -
\??\c:\nnhthn.exec:\nnhthn.exe18⤵
- Executes dropped EXE
PID:1324 -
\??\c:\jdppv.exec:\jdppv.exe19⤵
- Executes dropped EXE
PID:2872 -
\??\c:\ttbbnh.exec:\ttbbnh.exe20⤵
- Executes dropped EXE
PID:684 -
\??\c:\xrrlrfl.exec:\xrrlrfl.exe21⤵
- Executes dropped EXE
PID:2812 -
\??\c:\3ppvp.exec:\3ppvp.exe22⤵
- Executes dropped EXE
PID:1724 -
\??\c:\nnnnnt.exec:\nnnnnt.exe23⤵
- Executes dropped EXE
PID:2236 -
\??\c:\hhnnbb.exec:\hhnnbb.exe24⤵
- Executes dropped EXE
PID:2072 -
\??\c:\rlxffrf.exec:\rlxffrf.exe25⤵
- Executes dropped EXE
PID:840 -
\??\c:\1djjd.exec:\1djjd.exe26⤵
- Executes dropped EXE
PID:2980 -
\??\c:\rlflxff.exec:\rlflxff.exe27⤵
- Executes dropped EXE
PID:1572 -
\??\c:\ffxlfrf.exec:\ffxlfrf.exe28⤵
- Executes dropped EXE
PID:808 -
\??\c:\jjpdp.exec:\jjpdp.exe29⤵
- Executes dropped EXE
PID:1832 -
\??\c:\pjjjd.exec:\pjjjd.exe30⤵
- Executes dropped EXE
PID:2316 -
\??\c:\5rxllfl.exec:\5rxllfl.exe31⤵
- Executes dropped EXE
PID:2020 -
\??\c:\xrlxlrx.exec:\xrlxlrx.exe32⤵
- Executes dropped EXE
PID:2944 -
\??\c:\1bhhnt.exec:\1bhhnt.exe33⤵
- Executes dropped EXE
PID:3056 -
\??\c:\3htbnb.exec:\3htbnb.exe34⤵
- Executes dropped EXE
PID:2940 -
\??\c:\ddpjj.exec:\ddpjj.exe35⤵
- Executes dropped EXE
PID:1844 -
\??\c:\llffrxf.exec:\llffrxf.exe36⤵
- Executes dropped EXE
PID:2988 -
\??\c:\nbbnth.exec:\nbbnth.exe37⤵
- Executes dropped EXE
PID:1272 -
\??\c:\1jjpv.exec:\1jjpv.exe38⤵
- Executes dropped EXE
PID:2580 -
\??\c:\tnhhnt.exec:\tnhhnt.exe39⤵
- Executes dropped EXE
PID:2596 -
\??\c:\vpdjj.exec:\vpdjj.exe40⤵
- Executes dropped EXE
PID:2792 -
\??\c:\9rrfxrf.exec:\9rrfxrf.exe41⤵
- Executes dropped EXE
PID:1944 -
\??\c:\btntth.exec:\btntth.exe42⤵
- Executes dropped EXE
PID:2744 -
\??\c:\jjjjj.exec:\jjjjj.exe43⤵
- Executes dropped EXE
PID:2444 -
\??\c:\3lrrllx.exec:\3lrrllx.exe44⤵
- Executes dropped EXE
PID:2508 -
\??\c:\nhhnbt.exec:\nhhnbt.exe45⤵
- Executes dropped EXE
PID:2960 -
\??\c:\vdppv.exec:\vdppv.exe46⤵
- Executes dropped EXE
PID:992 -
\??\c:\9fxfrfl.exec:\9fxfrfl.exe47⤵
- Executes dropped EXE
PID:1548 -
\??\c:\3nnnth.exec:\3nnnth.exe48⤵
- Executes dropped EXE
PID:1368 -
\??\c:\pdddj.exec:\pdddj.exe49⤵
- Executes dropped EXE
PID:1924 -
\??\c:\5lxfllr.exec:\5lxfllr.exe50⤵
- Executes dropped EXE
PID:2128 -
\??\c:\9hhnnn.exec:\9hhnnn.exe51⤵
- Executes dropped EXE
PID:2408 -
\??\c:\9ddjj.exec:\9ddjj.exe52⤵
- Executes dropped EXE
PID:1856 -
\??\c:\fxxxxrf.exec:\fxxxxrf.exe53⤵
- Executes dropped EXE
PID:1564 -
\??\c:\btttnt.exec:\btttnt.exe54⤵
- Executes dropped EXE
PID:1848 -
\??\c:\jvdjp.exec:\jvdjp.exe55⤵
- Executes dropped EXE
PID:1912 -
\??\c:\lxflrlx.exec:\lxflrlx.exe56⤵
- Executes dropped EXE
PID:1420 -
\??\c:\btttnn.exec:\btttnn.exe57⤵
- Executes dropped EXE
PID:2924 -
\??\c:\7dppd.exec:\7dppd.exe58⤵
- Executes dropped EXE
PID:2864 -
\??\c:\lflrflr.exec:\lflrflr.exe59⤵
- Executes dropped EXE
PID:2968 -
\??\c:\bttbtb.exec:\bttbtb.exe60⤵
- Executes dropped EXE
PID:568 -
\??\c:\dvjjd.exec:\dvjjd.exe61⤵
- Executes dropped EXE
PID:300 -
\??\c:\xrrxflr.exec:\xrrxflr.exe62⤵
- Executes dropped EXE
PID:1468 -
\??\c:\hnhthh.exec:\hnhthh.exe63⤵
- Executes dropped EXE
PID:1312 -
\??\c:\nnbnbh.exec:\nnbnbh.exe64⤵
- Executes dropped EXE
PID:2364 -
\??\c:\3fxfllx.exec:\3fxfllx.exe65⤵
- Executes dropped EXE
PID:2312 -
\??\c:\rrlxllf.exec:\rrlxllf.exe66⤵PID:2100
-
\??\c:\btnntb.exec:\btnntb.exe67⤵PID:840
-
\??\c:\3dpvj.exec:\3dpvj.exe68⤵PID:696
-
\??\c:\3xlrrxf.exec:\3xlrrxf.exe69⤵PID:1520
-
\??\c:\nhttnt.exec:\nhttnt.exe70⤵PID:1752
-
\??\c:\vpppd.exec:\vpppd.exe71⤵PID:1008
-
\??\c:\xxxfrfl.exec:\xxxfrfl.exe72⤵PID:1928
-
\??\c:\nntbtb.exec:\nntbtb.exe73⤵PID:1560
-
\??\c:\lfllrrx.exec:\lfllrrx.exe74⤵PID:2532
-
\??\c:\nhnbtb.exec:\nhnbtb.exe75⤵PID:1452
-
\??\c:\ddpjv.exec:\ddpjv.exe76⤵PID:2400
-
\??\c:\lfrfxlr.exec:\lfrfxlr.exe77⤵PID:1680
-
\??\c:\vvvdv.exec:\vvvdv.exe78⤵PID:1932
-
\??\c:\7xrxrrl.exec:\7xrxrrl.exe79⤵PID:2280
-
\??\c:\ntbbhn.exec:\ntbbhn.exe80⤵PID:2680
-
\??\c:\jjpdd.exec:\jjpdd.exe81⤵PID:2720
-
\??\c:\fxxxrfr.exec:\fxxxrfr.exe82⤵PID:2672
-
\??\c:\btbhtb.exec:\btbhtb.exe83⤵PID:2576
-
\??\c:\jvvdj.exec:\jvvdj.exe84⤵PID:2652
-
\??\c:\fxlrxfr.exec:\fxlrxfr.exe85⤵PID:2476
-
\??\c:\1btbnt.exec:\1btbnt.exe86⤵PID:2492
-
\??\c:\1vpvd.exec:\1vpvd.exe87⤵PID:1992
-
\??\c:\fxrfrfl.exec:\fxrfrfl.exe88⤵PID:2904
-
\??\c:\tnbntb.exec:\tnbntb.exe89⤵PID:1884
-
\??\c:\9pjjp.exec:\9pjjp.exe90⤵PID:2088
-
\??\c:\7xxrxxr.exec:\7xxrxxr.exe91⤵PID:1524
-
\??\c:\bttttb.exec:\bttttb.exe92⤵PID:1880
-
\??\c:\7ddjp.exec:\7ddjp.exe93⤵PID:2104
-
\??\c:\lxlrrfx.exec:\lxlrrfx.exe94⤵PID:1556
-
\??\c:\nhhthn.exec:\nhhthn.exe95⤵PID:800
-
\??\c:\jddvv.exec:\jddvv.exe96⤵PID:2120
-
\??\c:\rxxlxrl.exec:\rxxlxrl.exe97⤵PID:2248
-
\??\c:\1nnnhb.exec:\1nnnhb.exe98⤵PID:2868
-
\??\c:\7vvjj.exec:\7vvjj.exe99⤵PID:1256
-
\??\c:\lrlfxlf.exec:\lrlfxlf.exe100⤵PID:3044
-
\??\c:\thhnhh.exec:\thhnhh.exe101⤵PID:2916
-
\??\c:\pjpjv.exec:\pjpjv.exe102⤵PID:2872
-
\??\c:\xrffffl.exec:\xrffffl.exe103⤵PID:1668
-
\??\c:\5hbnbb.exec:\5hbnbb.exe104⤵PID:2820
-
\??\c:\dvjpd.exec:\dvjpd.exe105⤵PID:2552
-
\??\c:\3lllrxr.exec:\3lllrxr.exe106⤵PID:1728
-
\??\c:\hhttbb.exec:\hhttbb.exe107⤵PID:2416
-
\??\c:\vppjj.exec:\vppjj.exe108⤵PID:2072
-
\??\c:\bbbhth.exec:\bbbhth.exe109⤵PID:3040
-
\??\c:\dvdvj.exec:\dvdvj.exe110⤵PID:1464
-
\??\c:\ffflflf.exec:\ffflflf.exe111⤵PID:2816
-
\??\c:\nbhntt.exec:\nbhntt.exe112⤵PID:948
-
\??\c:\dppvj.exec:\dppvj.exe113⤵PID:1712
-
\??\c:\9rrrlrf.exec:\9rrrlrf.exe114⤵PID:680
-
\??\c:\nntbnb.exec:\nntbnb.exe115⤵PID:1968
-
\??\c:\ddddd.exec:\ddddd.exe116⤵PID:2180
-
\??\c:\xrllrrr.exec:\xrllrrr.exe117⤵PID:824
-
\??\c:\btntnt.exec:\btntnt.exe118⤵PID:888
-
\??\c:\3jddj.exec:\3jddj.exe119⤵PID:2784
-
\??\c:\xxxxflr.exec:\xxxxflr.exe120⤵PID:2356
-
\??\c:\bbbnbb.exec:\bbbnbb.exe121⤵PID:2964
-
\??\c:\vpjpd.exec:\vpjpd.exe122⤵PID:2732
-
\??\c:\3frxrrx.exec:\3frxrrx.exe123⤵PID:2668
-
\??\c:\nntbtb.exec:\nntbtb.exe124⤵PID:1088
-
\??\c:\jjpdv.exec:\jjpdv.exe125⤵PID:2600
-
\??\c:\lllrrxr.exec:\lllrrxr.exe126⤵PID:2596
-
\??\c:\1hnbth.exec:\1hnbth.exe127⤵PID:2664
-
\??\c:\vvjpv.exec:\vvjpv.exe128⤵PID:2648
-
\??\c:\1fflrxl.exec:\1fflrxl.exe129⤵PID:2468
-
\??\c:\1bhtbh.exec:\1bhtbh.exe130⤵PID:2016
-
\??\c:\vvvpd.exec:\vvvpd.exe131⤵PID:2508
-
\??\c:\9rrxxxf.exec:\9rrxxxf.exe132⤵PID:2960
-
\??\c:\tnntnh.exec:\tnntnh.exe133⤵PID:992
-
\??\c:\pjdjv.exec:\pjdjv.exe134⤵PID:1496
-
\??\c:\llflrfr.exec:\llflrfr.exe135⤵PID:1580
-
\??\c:\htnbtb.exec:\htnbtb.exe136⤵PID:1860
-
\??\c:\ppjpv.exec:\ppjpv.exe137⤵PID:2128
-
\??\c:\tnhhtn.exec:\tnhhtn.exe138⤵PID:2112
-
\??\c:\jjpdd.exec:\jjpdd.exe139⤵PID:1532
-
\??\c:\9rlllrx.exec:\9rlllrx.exe140⤵PID:2756
-
\??\c:\nnhnbn.exec:\nnhnbn.exe141⤵PID:2332
-
\??\c:\ddvdp.exec:\ddvdp.exe142⤵PID:2096
-
\??\c:\frlxffl.exec:\frlxffl.exe143⤵PID:1132
-
\??\c:\bhnhhb.exec:\bhnhhb.exe144⤵PID:2924
-
\??\c:\vvppj.exec:\vvppj.exe145⤵PID:2876
-
\??\c:\xxxfffl.exec:\xxxfffl.exe146⤵PID:264
-
\??\c:\xrxxrrl.exec:\xrxxrrl.exe147⤵PID:628
-
\??\c:\bnnbnn.exec:\bnnbnn.exe148⤵PID:584
-
\??\c:\rlflffr.exec:\rlflffr.exe149⤵PID:1408
-
\??\c:\bththn.exec:\bththn.exe150⤵PID:1312
-
\??\c:\dpvvj.exec:\dpvvj.exe151⤵PID:404
-
\??\c:\rrrfllr.exec:\rrrfllr.exe152⤵PID:3020
-
\??\c:\fxrfrff.exec:\fxrfrff.exe153⤵PID:336
-
\??\c:\htttnt.exec:\htttnt.exe154⤵PID:1016
-
\??\c:\ddvvj.exec:\ddvvj.exe155⤵PID:1572
-
\??\c:\fxxlrfx.exec:\fxxlrfx.exe156⤵PID:2380
-
\??\c:\tnbnth.exec:\tnbnth.exe157⤵PID:2976
-
\??\c:\jjpdp.exec:\jjpdp.exe158⤵PID:2396
-
\??\c:\1rrrrrf.exec:\1rrrrrf.exe159⤵PID:1176
-
\??\c:\ntttnt.exec:\ntttnt.exe160⤵PID:2728
-
\??\c:\7jjjv.exec:\7jjjv.exe161⤵PID:1972
-
\??\c:\fflrxrl.exec:\fflrxrl.exe162⤵PID:1100
-
\??\c:\tnntnn.exec:\tnntnn.exe163⤵PID:2336
-
\??\c:\dpjvv.exec:\dpjvv.exe164⤵PID:1480
-
\??\c:\rllrllr.exec:\rllrllr.exe165⤵PID:1680
-
\??\c:\tnhnbh.exec:\tnhnbh.exe166⤵PID:2908
-
\??\c:\jvppv.exec:\jvppv.exe167⤵PID:2280
-
\??\c:\flrlxxl.exec:\flrlxxl.exe168⤵PID:2556
-
\??\c:\7nhnbh.exec:\7nhnbh.exe169⤵PID:2604
-
\??\c:\ppdpv.exec:\ppdpv.exe170⤵PID:2708
-
\??\c:\lxxlfxf.exec:\lxxlfxf.exe171⤵PID:2484
-
\??\c:\tnnbtt.exec:\tnnbtt.exe172⤵PID:2652
-
\??\c:\dvpvj.exec:\dvpvj.exe173⤵PID:2460
-
\??\c:\xxlrffr.exec:\xxlrffr.exe174⤵PID:2500
-
\??\c:\1fffxlr.exec:\1fffxlr.exe175⤵PID:2124
-
\??\c:\btthnb.exec:\btthnb.exe176⤵PID:2164
-
\??\c:\vvjjv.exec:\vvjjv.exe177⤵PID:2900
-
\??\c:\rllrxfl.exec:\rllrxfl.exe178⤵PID:2512
-
\??\c:\bttbnt.exec:\bttbnt.exe179⤵PID:2748
-
\??\c:\vvvdp.exec:\vvvdp.exe180⤵PID:348
-
\??\c:\xxxxrrr.exec:\xxxxrrr.exe181⤵PID:1676
-
\??\c:\9bthhh.exec:\9bthhh.exe182⤵PID:1872
-
\??\c:\dvpvd.exec:\dvpvd.exe183⤵PID:1564
-
\??\c:\rlxlfrx.exec:\rlxlfrx.exe184⤵PID:276
-
\??\c:\1ntbhn.exec:\1ntbhn.exe185⤵PID:1428
-
\??\c:\7pjpv.exec:\7pjpv.exe186⤵PID:2772
-
\??\c:\xrlrlrx.exec:\xrlrlrx.exe187⤵PID:1692
-
\??\c:\3nbbhh.exec:\3nbbhh.exe188⤵PID:2208
-
\??\c:\vvpvp.exec:\vvpvp.exe189⤵PID:2916
-
\??\c:\xffxlxl.exec:\xffxlxl.exe190⤵PID:568
-
\??\c:\nhbbtb.exec:\nhbbtb.exe191⤵PID:804
-
\??\c:\jjddv.exec:\jjddv.exe192⤵PID:2812
-
\??\c:\xxlrflr.exec:\xxlrflr.exe193⤵PID:2236
-
\??\c:\btnhbh.exec:\btnhbh.exe194⤵PID:112
-
\??\c:\dvppd.exec:\dvppd.exe195⤵PID:2416
-
\??\c:\ffflrrx.exec:\ffflrrx.exe196⤵PID:1076
-
\??\c:\3bbnnt.exec:\3bbnnt.exe197⤵PID:2224
-
\??\c:\3jpdp.exec:\3jpdp.exe198⤵PID:2980
-
\??\c:\7llrffr.exec:\7llrffr.exe199⤵PID:1016
-
\??\c:\btnnbb.exec:\btnnbb.exe200⤵PID:644
-
\??\c:\3pvjp.exec:\3pvjp.exe201⤵PID:1832
-
\??\c:\3rxflrx.exec:\3rxflrx.exe202⤵PID:1984
-
\??\c:\1hhhth.exec:\1hhhth.exe203⤵PID:776
-
\??\c:\3dvdd.exec:\3dvdd.exe204⤵PID:2180
-
\??\c:\lrfxfrf.exec:\lrfxfrf.exe205⤵PID:824
-
\??\c:\7hbbnt.exec:\7hbbnt.exe206⤵PID:1904
-
\??\c:\dvdpj.exec:\dvdpj.exe207⤵PID:876
-
\??\c:\xxfrfrf.exec:\xxfrfrf.exe208⤵PID:2356
-
\??\c:\tnnthh.exec:\tnnthh.exe209⤵PID:2404
-
\??\c:\jdpvd.exec:\jdpvd.exe210⤵PID:2996
-
\??\c:\xrrfrfx.exec:\xrrfrfx.exe211⤵PID:2668
-
\??\c:\btnntb.exec:\btnntb.exe212⤵PID:2388
-
\??\c:\dvvvj.exec:\dvvvj.exe213⤵PID:2636
-
\??\c:\xfxlrlf.exec:\xfxlrlf.exe214⤵PID:2704
-
\??\c:\1thhtb.exec:\1thhtb.exe215⤵PID:2452
-
\??\c:\vvjjv.exec:\vvjjv.exe216⤵PID:2472
-
\??\c:\pjppd.exec:\pjppd.exe217⤵PID:2620
-
\??\c:\7frrffr.exec:\7frrffr.exe218⤵PID:2896
-
\??\c:\btnnbh.exec:\btnnbh.exe219⤵PID:2888
-
\??\c:\jjjjv.exec:\jjjjv.exe220⤵PID:1484
-
\??\c:\fxrrffr.exec:\fxrrffr.exe221⤵PID:2520
-
\??\c:\1ttbth.exec:\1ttbth.exe222⤵PID:1448
-
\??\c:\1vjvd.exec:\1vjvd.exe223⤵PID:1368
-
\??\c:\llfrflx.exec:\llfrflx.exe224⤵PID:2104
-
\??\c:\tbhtnn.exec:\tbhtnn.exe225⤵PID:1556
-
\??\c:\pdpvp.exec:\pdpvp.exe226⤵PID:1840
-
\??\c:\xxxfxlx.exec:\xxxfxlx.exe227⤵PID:2376
-
\??\c:\1bbnbh.exec:\1bbnbh.exe228⤵PID:344
-
\??\c:\7ppvp.exec:\7ppvp.exe229⤵PID:2092
-
\??\c:\lxllxff.exec:\lxllxff.exe230⤵PID:2932
-
\??\c:\btntnt.exec:\btntnt.exe231⤵PID:1132
-
\??\c:\jjpdd.exec:\jjpdd.exe232⤵PID:2912
-
\??\c:\rrrrxrx.exec:\rrrrxrx.exe233⤵PID:880
-
\??\c:\bnntbn.exec:\bnntbn.exe234⤵PID:1784
-
\??\c:\pjpdj.exec:\pjpdj.exe235⤵PID:1104
-
\??\c:\xxrxrxl.exec:\xxrxrxl.exe236⤵PID:1440
-
\??\c:\bhntnb.exec:\bhntnb.exe237⤵PID:2264
-
\??\c:\dvvdv.exec:\dvvdv.exe238⤵PID:2000
-
\??\c:\fflrflf.exec:\fflrflf.exe239⤵PID:2660
-
\??\c:\7xlrlrx.exec:\7xlrlrx.exe240⤵PID:2368
-
\??\c:\pjddp.exec:\pjddp.exe241⤵PID:1228
-