Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 16:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e8d37fc84202ec304a88862cb98f5d10_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
e8d37fc84202ec304a88862cb98f5d10_NeikiAnalytics.exe
-
Size
226KB
-
MD5
e8d37fc84202ec304a88862cb98f5d10
-
SHA1
d3e44ba24ec427a3e0f31f3141f8deb9f24857b4
-
SHA256
0c55bf5f9f120e45485acecbb7184aee674d1a8eb9399994f0c7bf5e6c4cd3e7
-
SHA512
5080594617e046566307d12b0bea5d435c8b4627459b8ee66f20d807a962106f4203d82ec14bd85a760a8512b67d3eba7fca7a8363af7a2c4f147b7c7ea1fe63
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x47WBd:n3C9BRo7MlrWKo+lxd
Malware Config
Signatures
-
Detect Blackmoon payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/1444-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2452-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2108-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2108-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2140-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/344-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/380-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2160-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/840-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2308-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/952-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2076-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bhbbbn.exeddpvj.exenbhnbt.exefffffrf.exetnbntb.exe1btbnt.exellfrflr.exefrrlfrf.exejvdjv.exe3xlxflr.exehtnhtt.exehhtbnn.exexrlxllx.exerrflxrf.exetnbhbt.exejdvdj.exelflllrf.exe9hbhnb.exevjvjp.exepjdvd.exexlxfrxf.exejdddp.exexrfxffr.exettnnhn.exevpjjv.exexlxflfl.exebbntbh.exe7dvvd.exejjvjv.exexxrxffr.exe7hhhnn.exepjjdp.exerrlrflf.exetnbhnt.exejdvvp.exevvjpj.exerlrrffr.exetnbtbh.exehbhhnt.exe3jvdd.exe1jdvv.exelllxrxf.exenbnntn.exebthhhn.exevvddj.exedvvvp.exe9fflrrl.exe5bntbh.exe3htbnt.exevjdpv.exeppjjp.exefxllrxx.exetnnbhh.exebtthtt.exevjvjj.exevppjd.exexrllrrx.exefxffxxl.exetnnnhn.exevjvdv.exe3dppp.exeffrrxxf.exerxfllfr.exe7tntbt.exepid process 2452 bhbbbn.exe 2108 ddpvj.exe 2336 nbhnbt.exe 2744 fffffrf.exe 3036 tnbntb.exe 2840 1btbnt.exe 2740 llfrflr.exe 2556 frrlfrf.exe 2140 jvdjv.exe 1652 3xlxflr.exe 2772 htnhtt.exe 2844 hhtbnn.exe 344 xrlxllx.exe 752 rrflxrf.exe 2204 tnbhbt.exe 2212 jdvdj.exe 380 lflllrf.exe 2160 9hbhnb.exe 840 vjvjp.exe 2308 pjdvd.exe 2272 xlxfrxf.exe 2724 jdddp.exe 1856 xrfxffr.exe 1568 ttnnhn.exe 468 vpjjv.exe 1368 xlxflfl.exe 944 bbntbh.exe 952 7dvvd.exe 2100 jjvjv.exe 2076 xxrxffr.exe 2056 7hhhnn.exe 2096 pjjdp.exe 2988 rrlrflf.exe 2008 tnbhnt.exe 1964 jdvvp.exe 2444 vvjpj.exe 2620 rlrrffr.exe 2716 tnbtbh.exe 2704 hbhhnt.exe 2628 3jvdd.exe 2868 1jdvv.exe 2648 lllxrxf.exe 3032 nbnntn.exe 2532 bthhhn.exe 2956 vvddj.exe 2528 dvvvp.exe 2140 9fflrrl.exe 2808 5bntbh.exe 2760 3htbnt.exe 2244 vjdpv.exe 1860 ppjjp.exe 1980 fxllrxx.exe 1956 tnnbhh.exe 2204 btthtt.exe 1684 vjvjj.exe 556 vppjd.exe 1196 xrllrrx.exe 2160 fxffxxl.exe 624 tnnnhn.exe 2900 vjvdv.exe 1624 3dppp.exe 1816 ffrrxxf.exe 3052 rxfllfr.exe 1856 7tntbt.exe -
Processes:
resource yara_rule behavioral1/memory/1444-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/344-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/380-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2160-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2308-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/952-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2076-291-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e8d37fc84202ec304a88862cb98f5d10_NeikiAnalytics.exebhbbbn.exeddpvj.exenbhnbt.exefffffrf.exetnbntb.exe1btbnt.exellfrflr.exefrrlfrf.exejvdjv.exe3xlxflr.exehtnhtt.exehhtbnn.exexrlxllx.exerrflxrf.exetnbhbt.exedescription pid process target process PID 1444 wrote to memory of 2452 1444 e8d37fc84202ec304a88862cb98f5d10_NeikiAnalytics.exe bhbbbn.exe PID 1444 wrote to memory of 2452 1444 e8d37fc84202ec304a88862cb98f5d10_NeikiAnalytics.exe bhbbbn.exe PID 1444 wrote to memory of 2452 1444 e8d37fc84202ec304a88862cb98f5d10_NeikiAnalytics.exe bhbbbn.exe PID 1444 wrote to memory of 2452 1444 e8d37fc84202ec304a88862cb98f5d10_NeikiAnalytics.exe bhbbbn.exe PID 2452 wrote to memory of 2108 2452 bhbbbn.exe ddpvj.exe PID 2452 wrote to memory of 2108 2452 bhbbbn.exe ddpvj.exe PID 2452 wrote to memory of 2108 2452 bhbbbn.exe ddpvj.exe PID 2452 wrote to memory of 2108 2452 bhbbbn.exe ddpvj.exe PID 2108 wrote to memory of 2336 2108 ddpvj.exe nbhnbt.exe PID 2108 wrote to memory of 2336 2108 ddpvj.exe nbhnbt.exe PID 2108 wrote to memory of 2336 2108 ddpvj.exe nbhnbt.exe PID 2108 wrote to memory of 2336 2108 ddpvj.exe nbhnbt.exe PID 2336 wrote to memory of 2744 2336 nbhnbt.exe fffffrf.exe PID 2336 wrote to memory of 2744 2336 nbhnbt.exe fffffrf.exe PID 2336 wrote to memory of 2744 2336 nbhnbt.exe fffffrf.exe PID 2336 wrote to memory of 2744 2336 nbhnbt.exe fffffrf.exe PID 2744 wrote to memory of 3036 2744 fffffrf.exe tnbntb.exe PID 2744 wrote to memory of 3036 2744 fffffrf.exe tnbntb.exe PID 2744 wrote to memory of 3036 2744 fffffrf.exe tnbntb.exe PID 2744 wrote to memory of 3036 2744 fffffrf.exe tnbntb.exe PID 3036 wrote to memory of 2840 3036 tnbntb.exe 1btbnt.exe PID 3036 wrote to memory of 2840 3036 tnbntb.exe 1btbnt.exe PID 3036 wrote to memory of 2840 3036 tnbntb.exe 1btbnt.exe PID 3036 wrote to memory of 2840 3036 tnbntb.exe 1btbnt.exe PID 2840 wrote to memory of 2740 2840 1btbnt.exe llfrflr.exe PID 2840 wrote to memory of 2740 2840 1btbnt.exe llfrflr.exe PID 2840 wrote to memory of 2740 2840 1btbnt.exe llfrflr.exe PID 2840 wrote to memory of 2740 2840 1btbnt.exe llfrflr.exe PID 2740 wrote to memory of 2556 2740 llfrflr.exe frrlfrf.exe PID 2740 wrote to memory of 2556 2740 llfrflr.exe frrlfrf.exe PID 2740 wrote to memory of 2556 2740 llfrflr.exe frrlfrf.exe PID 2740 wrote to memory of 2556 2740 llfrflr.exe frrlfrf.exe PID 2556 wrote to memory of 2140 2556 frrlfrf.exe jvdjv.exe PID 2556 wrote to memory of 2140 2556 frrlfrf.exe jvdjv.exe PID 2556 wrote to memory of 2140 2556 frrlfrf.exe jvdjv.exe PID 2556 wrote to memory of 2140 2556 frrlfrf.exe jvdjv.exe PID 2140 wrote to memory of 1652 2140 jvdjv.exe 3xlxflr.exe PID 2140 wrote to memory of 1652 2140 jvdjv.exe 3xlxflr.exe PID 2140 wrote to memory of 1652 2140 jvdjv.exe 3xlxflr.exe PID 2140 wrote to memory of 1652 2140 jvdjv.exe 3xlxflr.exe PID 1652 wrote to memory of 2772 1652 3xlxflr.exe htnhtt.exe PID 1652 wrote to memory of 2772 1652 3xlxflr.exe htnhtt.exe PID 1652 wrote to memory of 2772 1652 3xlxflr.exe htnhtt.exe PID 1652 wrote to memory of 2772 1652 3xlxflr.exe htnhtt.exe PID 2772 wrote to memory of 2844 2772 htnhtt.exe hhtbnn.exe PID 2772 wrote to memory of 2844 2772 htnhtt.exe hhtbnn.exe PID 2772 wrote to memory of 2844 2772 htnhtt.exe hhtbnn.exe PID 2772 wrote to memory of 2844 2772 htnhtt.exe hhtbnn.exe PID 2844 wrote to memory of 344 2844 hhtbnn.exe xrlxllx.exe PID 2844 wrote to memory of 344 2844 hhtbnn.exe xrlxllx.exe PID 2844 wrote to memory of 344 2844 hhtbnn.exe xrlxllx.exe PID 2844 wrote to memory of 344 2844 hhtbnn.exe xrlxllx.exe PID 344 wrote to memory of 752 344 xrlxllx.exe rrflxrf.exe PID 344 wrote to memory of 752 344 xrlxllx.exe rrflxrf.exe PID 344 wrote to memory of 752 344 xrlxllx.exe rrflxrf.exe PID 344 wrote to memory of 752 344 xrlxllx.exe rrflxrf.exe PID 752 wrote to memory of 2204 752 rrflxrf.exe tnbhbt.exe PID 752 wrote to memory of 2204 752 rrflxrf.exe tnbhbt.exe PID 752 wrote to memory of 2204 752 rrflxrf.exe tnbhbt.exe PID 752 wrote to memory of 2204 752 rrflxrf.exe tnbhbt.exe PID 2204 wrote to memory of 2212 2204 tnbhbt.exe jdvdj.exe PID 2204 wrote to memory of 2212 2204 tnbhbt.exe jdvdj.exe PID 2204 wrote to memory of 2212 2204 tnbhbt.exe jdvdj.exe PID 2204 wrote to memory of 2212 2204 tnbhbt.exe jdvdj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8d37fc84202ec304a88862cb98f5d10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e8d37fc84202ec304a88862cb98f5d10_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\bhbbbn.exec:\bhbbbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\ddpvj.exec:\ddpvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\nbhnbt.exec:\nbhnbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\fffffrf.exec:\fffffrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\tnbntb.exec:\tnbntb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\1btbnt.exec:\1btbnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\llfrflr.exec:\llfrflr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\frrlfrf.exec:\frrlfrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\jvdjv.exec:\jvdjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\3xlxflr.exec:\3xlxflr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\htnhtt.exec:\htnhtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\hhtbnn.exec:\hhtbnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\xrlxllx.exec:\xrlxllx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
\??\c:\rrflxrf.exec:\rrflxrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\tnbhbt.exec:\tnbhbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\jdvdj.exec:\jdvdj.exe17⤵
- Executes dropped EXE
PID:2212 -
\??\c:\lflllrf.exec:\lflllrf.exe18⤵
- Executes dropped EXE
PID:380 -
\??\c:\9hbhnb.exec:\9hbhnb.exe19⤵
- Executes dropped EXE
PID:2160 -
\??\c:\vjvjp.exec:\vjvjp.exe20⤵
- Executes dropped EXE
PID:840 -
\??\c:\pjdvd.exec:\pjdvd.exe21⤵
- Executes dropped EXE
PID:2308 -
\??\c:\xlxfrxf.exec:\xlxfrxf.exe22⤵
- Executes dropped EXE
PID:2272 -
\??\c:\jdddp.exec:\jdddp.exe23⤵
- Executes dropped EXE
PID:2724 -
\??\c:\xrfxffr.exec:\xrfxffr.exe24⤵
- Executes dropped EXE
PID:1856 -
\??\c:\ttnnhn.exec:\ttnnhn.exe25⤵
- Executes dropped EXE
PID:1568 -
\??\c:\vpjjv.exec:\vpjjv.exe26⤵
- Executes dropped EXE
PID:468 -
\??\c:\xlxflfl.exec:\xlxflfl.exe27⤵
- Executes dropped EXE
PID:1368 -
\??\c:\bbntbh.exec:\bbntbh.exe28⤵
- Executes dropped EXE
PID:944 -
\??\c:\7dvvd.exec:\7dvvd.exe29⤵
- Executes dropped EXE
PID:952 -
\??\c:\jjvjv.exec:\jjvjv.exe30⤵
- Executes dropped EXE
PID:2100 -
\??\c:\xxrxffr.exec:\xxrxffr.exe31⤵
- Executes dropped EXE
PID:2076 -
\??\c:\7hhhnn.exec:\7hhhnn.exe32⤵
- Executes dropped EXE
PID:2056 -
\??\c:\pjjdp.exec:\pjjdp.exe33⤵
- Executes dropped EXE
PID:2096 -
\??\c:\rrlrflf.exec:\rrlrflf.exe34⤵
- Executes dropped EXE
PID:2988 -
\??\c:\tnbhnt.exec:\tnbhnt.exe35⤵
- Executes dropped EXE
PID:2008 -
\??\c:\jdvvp.exec:\jdvvp.exe36⤵
- Executes dropped EXE
PID:1964 -
\??\c:\vvjpj.exec:\vvjpj.exe37⤵
- Executes dropped EXE
PID:2444 -
\??\c:\rlrrffr.exec:\rlrrffr.exe38⤵
- Executes dropped EXE
PID:2620 -
\??\c:\tnbtbh.exec:\tnbtbh.exe39⤵
- Executes dropped EXE
PID:2716 -
\??\c:\hbhhnt.exec:\hbhhnt.exe40⤵
- Executes dropped EXE
PID:2704 -
\??\c:\3jvdd.exec:\3jvdd.exe41⤵
- Executes dropped EXE
PID:2628 -
\??\c:\1jdvv.exec:\1jdvv.exe42⤵
- Executes dropped EXE
PID:2868 -
\??\c:\lllxrxf.exec:\lllxrxf.exe43⤵
- Executes dropped EXE
PID:2648 -
\??\c:\nbnntn.exec:\nbnntn.exe44⤵
- Executes dropped EXE
PID:3032 -
\??\c:\bthhhn.exec:\bthhhn.exe45⤵
- Executes dropped EXE
PID:2532 -
\??\c:\vvddj.exec:\vvddj.exe46⤵
- Executes dropped EXE
PID:2956 -
\??\c:\dvvvp.exec:\dvvvp.exe47⤵
- Executes dropped EXE
PID:2528 -
\??\c:\9fflrrl.exec:\9fflrrl.exe48⤵
- Executes dropped EXE
PID:2140 -
\??\c:\5bntbh.exec:\5bntbh.exe49⤵
- Executes dropped EXE
PID:2808 -
\??\c:\3htbnt.exec:\3htbnt.exe50⤵
- Executes dropped EXE
PID:2760 -
\??\c:\vjdpv.exec:\vjdpv.exe51⤵
- Executes dropped EXE
PID:2244 -
\??\c:\ppjjp.exec:\ppjjp.exe52⤵
- Executes dropped EXE
PID:1860 -
\??\c:\fxllrxx.exec:\fxllrxx.exe53⤵
- Executes dropped EXE
PID:1980 -
\??\c:\tnnbhh.exec:\tnnbhh.exe54⤵
- Executes dropped EXE
PID:1956 -
\??\c:\btthtt.exec:\btthtt.exe55⤵
- Executes dropped EXE
PID:2204 -
\??\c:\vjvjj.exec:\vjvjj.exe56⤵
- Executes dropped EXE
PID:1684 -
\??\c:\vppjd.exec:\vppjd.exe57⤵
- Executes dropped EXE
PID:556 -
\??\c:\xrllrrx.exec:\xrllrrx.exe58⤵
- Executes dropped EXE
PID:1196 -
\??\c:\fxffxxl.exec:\fxffxxl.exe59⤵
- Executes dropped EXE
PID:2160 -
\??\c:\tnnnhn.exec:\tnnnhn.exe60⤵
- Executes dropped EXE
PID:624 -
\??\c:\vjvdv.exec:\vjvdv.exe61⤵
- Executes dropped EXE
PID:2900 -
\??\c:\3dppp.exec:\3dppp.exe62⤵
- Executes dropped EXE
PID:1624 -
\??\c:\ffrrxxf.exec:\ffrrxxf.exe63⤵
- Executes dropped EXE
PID:1816 -
\??\c:\rxfllfr.exec:\rxfllfr.exe64⤵
- Executes dropped EXE
PID:3052 -
\??\c:\7tntbt.exec:\7tntbt.exe65⤵
- Executes dropped EXE
PID:1856 -
\??\c:\pjvdd.exec:\pjvdd.exe66⤵PID:1376
-
\??\c:\pjvjv.exec:\pjvjv.exe67⤵PID:1532
-
\??\c:\5rrrrrf.exec:\5rrrrrf.exe68⤵PID:1044
-
\??\c:\lfxxxrx.exec:\lfxxxrx.exe69⤵PID:1368
-
\??\c:\tnbhtb.exec:\tnbhtb.exe70⤵PID:1864
-
\??\c:\1nnthb.exec:\1nnthb.exe71⤵PID:2904
-
\??\c:\dvpvj.exec:\dvpvj.exe72⤵PID:2052
-
\??\c:\frxxxfl.exec:\frxxxfl.exe73⤵PID:2324
-
\??\c:\fxrrxxl.exec:\fxrrxxl.exe74⤵PID:3064
-
\??\c:\3bttbh.exec:\3bttbh.exe75⤵PID:992
-
\??\c:\bnbhbn.exec:\bnbhbn.exe76⤵PID:1064
-
\??\c:\5vjjp.exec:\5vjjp.exe77⤵PID:2932
-
\??\c:\7frlrxf.exec:\7frlrxf.exe78⤵PID:2860
-
\??\c:\lfrrxxx.exec:\lfrrxxx.exe79⤵PID:1588
-
\??\c:\thntbt.exec:\thntbt.exe80⤵PID:1252
-
\??\c:\dvjpd.exec:\dvjpd.exe81⤵PID:2660
-
\??\c:\3vjdd.exec:\3vjdd.exe82⤵PID:2616
-
\??\c:\lxflxrl.exec:\lxflxrl.exe83⤵PID:2636
-
\??\c:\rlrxlrx.exec:\rlrxlrx.exe84⤵PID:2788
-
\??\c:\tnbtbb.exec:\tnbtbb.exe85⤵PID:2536
-
\??\c:\bthhtb.exec:\bthhtb.exe86⤵PID:2560
-
\??\c:\7vjdj.exec:\7vjdj.exe87⤵PID:2512
-
\??\c:\5rxrxxr.exec:\5rxrxxr.exe88⤵PID:2680
-
\??\c:\fxlxlrf.exec:\fxlxlrf.exe89⤵PID:2952
-
\??\c:\5htthb.exec:\5htthb.exe90⤵PID:1596
-
\??\c:\tntntt.exec:\tntntt.exe91⤵PID:2500
-
\??\c:\jvdvd.exec:\jvdvd.exe92⤵PID:2600
-
\??\c:\rfrlrlr.exec:\rfrlrlr.exe93⤵PID:2852
-
\??\c:\rlxfllx.exec:\rlxfllx.exe94⤵PID:2756
-
\??\c:\1htbbb.exec:\1htbbb.exe95⤵PID:1848
-
\??\c:\tnhhtt.exec:\tnhhtt.exe96⤵PID:2240
-
\??\c:\dvddd.exec:\dvddd.exe97⤵PID:1740
-
\??\c:\frfffll.exec:\frfffll.exe98⤵PID:2944
-
\??\c:\lfllrxf.exec:\lfllrxf.exe99⤵PID:2212
-
\??\c:\hbntbt.exec:\hbntbt.exe100⤵PID:492
-
\??\c:\dvddd.exec:\dvddd.exe101⤵PID:1580
-
\??\c:\jdpvj.exec:\jdpvj.exe102⤵PID:1764
-
\??\c:\lfllllx.exec:\lfllllx.exe103⤵PID:1060
-
\??\c:\9llxffr.exec:\9llxffr.exe104⤵PID:2256
-
\??\c:\nhttnh.exec:\nhttnh.exe105⤵PID:580
-
\??\c:\3ttntb.exec:\3ttntb.exe106⤵PID:2964
-
\??\c:\jdppd.exec:\jdppd.exe107⤵PID:912
-
\??\c:\dpdjp.exec:\dpdjp.exe108⤵PID:2400
-
\??\c:\xrxrflx.exec:\xrxrflx.exe109⤵PID:1568
-
\??\c:\1bbhhn.exec:\1bbhhn.exe110⤵PID:1656
-
\??\c:\hnttnh.exec:\hnttnh.exe111⤵PID:764
-
\??\c:\pjvjp.exec:\pjvjp.exe112⤵PID:2356
-
\??\c:\pjvvj.exec:\pjvvj.exe113⤵PID:1048
-
\??\c:\1xlrxlf.exec:\1xlrxlf.exe114⤵PID:2340
-
\??\c:\fllxxlf.exec:\fllxxlf.exe115⤵PID:2068
-
\??\c:\hbbnth.exec:\hbbnth.exe116⤵PID:2768
-
\??\c:\dpvvd.exec:\dpvvd.exe117⤵PID:1752
-
\??\c:\jdddj.exec:\jdddj.exe118⤵PID:2248
-
\??\c:\xrffrrx.exec:\xrffrrx.exe119⤵PID:2096
-
\??\c:\fxrxffl.exec:\fxrxffl.exe120⤵PID:2028
-
\??\c:\hhntbh.exec:\hhntbh.exe121⤵PID:1564
-
\??\c:\pdpjj.exec:\pdpjj.exe122⤵PID:2152
-
\??\c:\ppddp.exec:\ppddp.exe123⤵PID:2656
-
\??\c:\xrxrrlr.exec:\xrxrrlr.exe124⤵PID:2620
-
\??\c:\9rllfff.exec:\9rllfff.exe125⤵PID:2736
-
\??\c:\bthbbb.exec:\bthbbb.exe126⤵PID:2792
-
\??\c:\pjjdp.exec:\pjjdp.exe127⤵PID:2628
-
\??\c:\dvjpd.exec:\dvjpd.exe128⤵PID:2684
-
\??\c:\llxrllr.exec:\llxrllr.exe129⤵PID:2624
-
\??\c:\lfxxlxf.exec:\lfxxlxf.exe130⤵PID:2588
-
\??\c:\hthhnt.exec:\hthhnt.exe131⤵PID:2564
-
\??\c:\vpdpp.exec:\vpdpp.exe132⤵PID:1620
-
\??\c:\dvjdj.exec:\dvjdj.exe133⤵PID:1608
-
\??\c:\llxxlfr.exec:\llxxlfr.exe134⤵PID:2692
-
\??\c:\fxflxfl.exec:\fxflxfl.exe135⤵PID:1644
-
\??\c:\nbhbhh.exec:\nbhbhh.exe136⤵PID:308
-
\??\c:\hhbbnt.exec:\hhbbnt.exe137⤵PID:796
-
\??\c:\vpddj.exec:\vpddj.exe138⤵PID:1972
-
\??\c:\lxlllrr.exec:\lxlllrr.exe139⤵PID:1952
-
\??\c:\7xrfrxx.exec:\7xrfrxx.exe140⤵PID:1660
-
\??\c:\tnbbbb.exec:\tnbbbb.exe141⤵PID:2196
-
\??\c:\7vppv.exec:\7vppv.exe142⤵PID:532
-
\??\c:\1jvvv.exec:\1jvvv.exe143⤵PID:1552
-
\??\c:\9rrlllr.exec:\9rrlllr.exe144⤵PID:2136
-
\??\c:\9rrflfr.exec:\9rrflfr.exe145⤵PID:2360
-
\??\c:\tnnnnn.exec:\tnnnnn.exe146⤵PID:2308
-
\??\c:\9pdjv.exec:\9pdjv.exe147⤵PID:2292
-
\??\c:\jdpvd.exec:\jdpvd.exe148⤵PID:552
-
\??\c:\xrffrxf.exec:\xrffrxf.exe149⤵PID:2216
-
\??\c:\3nbhnh.exec:\3nbhnh.exe150⤵PID:1304
-
\??\c:\3tbbbn.exec:\3tbbbn.exe151⤵PID:1544
-
\??\c:\3djvd.exec:\3djvd.exe152⤵PID:468
-
\??\c:\3djdd.exec:\3djdd.exe153⤵PID:1600
-
\??\c:\7xrrlxl.exec:\7xrrlxl.exe154⤵PID:1028
-
\??\c:\rlxxlrx.exec:\rlxxlrx.exe155⤵PID:908
-
\??\c:\btnhnn.exec:\btnhnn.exe156⤵PID:952
-
\??\c:\vpddp.exec:\vpddp.exe157⤵PID:2100
-
\??\c:\9pdvd.exec:\9pdvd.exe158⤵PID:3008
-
\??\c:\llfflrf.exec:\llfflrf.exe159⤵PID:2088
-
\??\c:\lfrxflf.exec:\lfrxflf.exe160⤵PID:1924
-
\??\c:\tnbhnb.exec:\tnbhnb.exe161⤵PID:1948
-
\??\c:\3vjpv.exec:\3vjpv.exe162⤵PID:1316
-
\??\c:\5xrlrrx.exec:\5xrlrrx.exe163⤵PID:1584
-
\??\c:\1hbtnt.exec:\1hbtnt.exe164⤵PID:2800
-
\??\c:\3hbhtn.exec:\3hbhtn.exe165⤵PID:2152
-
\??\c:\ppdjv.exec:\ppdjv.exe166⤵PID:2652
-
\??\c:\lxlfffr.exec:\lxlfffr.exe167⤵PID:2336
-
\??\c:\9lxxxlr.exec:\9lxxxlr.exe168⤵PID:2644
-
\??\c:\tnbhnn.exec:\tnbhnn.exe169⤵PID:2548
-
\??\c:\vppjj.exec:\vppjj.exe170⤵PID:2796
-
\??\c:\jvjvd.exec:\jvjvd.exe171⤵PID:2560
-
\??\c:\7fxlrrf.exec:\7fxlrrf.exe172⤵PID:2420
-
\??\c:\hbthtb.exec:\hbthtb.exe173⤵PID:2948
-
\??\c:\htbbbt.exec:\htbbbt.exe174⤵PID:2080
-
\??\c:\pjppv.exec:\pjppv.exe175⤵PID:1596
-
\??\c:\ddppv.exec:\ddppv.exe176⤵PID:2780
-
\??\c:\frfrxfr.exec:\frfrxfr.exe177⤵PID:2832
-
\??\c:\7httbt.exec:\7httbt.exe178⤵PID:1976
-
\??\c:\tbbhnt.exec:\tbbhnt.exe179⤵PID:1636
-
\??\c:\1pjvd.exec:\1pjvd.exe180⤵PID:1868
-
\??\c:\7rlrxfr.exec:\7rlrxfr.exe181⤵PID:2236
-
\??\c:\rlxxffl.exec:\rlxxffl.exe182⤵PID:1996
-
\??\c:\btbhtn.exec:\btbhtn.exe183⤵PID:2404
-
\??\c:\bthhnt.exec:\bthhnt.exe184⤵PID:668
-
\??\c:\dvjjj.exec:\dvjjj.exe185⤵PID:1504
-
\??\c:\vpdpd.exec:\vpdpd.exe186⤵PID:1344
-
\??\c:\lxllflr.exec:\lxllflr.exe187⤵PID:2036
-
\??\c:\rfrllfl.exec:\rfrllfl.exe188⤵PID:2372
-
\??\c:\tnbbnn.exec:\tnbbnn.exe189⤵PID:2256
-
\??\c:\djjjj.exec:\djjjj.exe190⤵PID:2472
-
\??\c:\vpddp.exec:\vpddp.exe191⤵PID:2964
-
\??\c:\7flxxfl.exec:\7flxxfl.exe192⤵PID:448
-
\??\c:\rfrxlfl.exec:\rfrxlfl.exe193⤵PID:1232
-
\??\c:\htbhnb.exec:\htbhnb.exe194⤵PID:1568
-
\??\c:\bbntbb.exec:\bbntbb.exe195⤵PID:868
-
\??\c:\pjdpd.exec:\pjdpd.exe196⤵PID:764
-
\??\c:\5rfflrf.exec:\5rfflrf.exe197⤵PID:1028
-
\??\c:\7frrxxx.exec:\7frrxxx.exe198⤵PID:1048
-
\??\c:\bthhtt.exec:\bthhtt.exe199⤵PID:952
-
\??\c:\tnbthh.exec:\tnbthh.exe200⤵PID:2100
-
\??\c:\pdppd.exec:\pdppd.exe201⤵PID:2768
-
\??\c:\jdpjp.exec:\jdpjp.exe202⤵PID:872
-
\??\c:\ffrfrrf.exec:\ffrfrrf.exe203⤵PID:1064
-
\??\c:\fxrrxfl.exec:\fxrrxfl.exe204⤵PID:2996
-
\??\c:\btntnn.exec:\btntnn.exe205⤵PID:2008
-
\??\c:\nnhtnn.exec:\nnhtnn.exe206⤵PID:1964
-
\??\c:\1jddj.exec:\1jddj.exe207⤵PID:2476
-
\??\c:\xrfflrf.exec:\xrfflrf.exe208⤵PID:3024
-
\??\c:\fxlrxxf.exec:\fxlrxxf.exe209⤵PID:1916
-
\??\c:\httnbn.exec:\httnbn.exe210⤵PID:2872
-
\??\c:\nhbbhh.exec:\nhbbhh.exe211⤵PID:2672
-
\??\c:\dvjpv.exec:\dvjpv.exe212⤵PID:2748
-
\??\c:\fxrfllx.exec:\fxrfllx.exe213⤵PID:2784
-
\??\c:\5xlxfrx.exec:\5xlxfrx.exe214⤵PID:2648
-
\??\c:\hbtbnb.exec:\hbtbnb.exe215⤵PID:2584
-
\??\c:\7tthhn.exec:\7tthhn.exe216⤵PID:2976
-
\??\c:\dvjpv.exec:\dvjpv.exe217⤵PID:2488
-
\??\c:\vpddp.exec:\vpddp.exe218⤵PID:2572
-
\??\c:\7rlfllx.exec:\7rlfllx.exe219⤵PID:2812
-
\??\c:\3hnntt.exec:\3hnntt.exe220⤵PID:756
-
\??\c:\tntnbb.exec:\tntnbb.exe221⤵PID:2924
-
\??\c:\vdvdp.exec:\vdvdp.exe222⤵PID:344
-
\??\c:\dvjvd.exec:\dvjvd.exe223⤵PID:2000
-
\??\c:\9xffllr.exec:\9xffllr.exe224⤵PID:2228
-
\??\c:\1htthh.exec:\1htthh.exe225⤵PID:1672
-
\??\c:\hbnnnt.exec:\hbnnnt.exe226⤵PID:2208
-
\??\c:\dvjjp.exec:\dvjjp.exe227⤵PID:1684
-
\??\c:\vjdvd.exec:\vjdvd.exe228⤵PID:2960
-
\??\c:\rflffxx.exec:\rflffxx.exe229⤵PID:540
-
\??\c:\5flrrlr.exec:\5flrrlr.exe230⤵PID:2288
-
\??\c:\tnhnnn.exec:\tnhnnn.exe231⤵PID:1192
-
\??\c:\nnttbh.exec:\nnttbh.exe232⤵PID:2900
-
\??\c:\pjpdp.exec:\pjpdp.exe233⤵PID:1728
-
\??\c:\3frflll.exec:\3frflll.exe234⤵PID:1380
-
\??\c:\7rllrxf.exec:\7rllrxf.exe235⤵PID:2376
-
\??\c:\bthhnh.exec:\bthhnh.exe236⤵PID:988
-
\??\c:\thnhhh.exec:\thnhhh.exe237⤵PID:1760
-
\??\c:\vppvd.exec:\vppvd.exe238⤵PID:2352
-
\??\c:\jdvvj.exec:\jdvvj.exe239⤵PID:1100
-
\??\c:\fxlfffl.exec:\fxlfffl.exe240⤵PID:1052
-
\??\c:\lfxfrrx.exec:\lfxfrrx.exe241⤵PID:900
-
\??\c:\7thntt.exec:\7thntt.exe242⤵PID:2348