Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 17:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1e76bdd34c2c5cdb856f553a5e94ab20_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
1e76bdd34c2c5cdb856f553a5e94ab20_NeikiAnalytics.exe
-
Size
73KB
-
MD5
1e76bdd34c2c5cdb856f553a5e94ab20
-
SHA1
430da44c0565658f5afc6925e5ad5ba17a82af54
-
SHA256
facc18ccdbdb9f07703e246b04f55320d53caa593132bde21758d3c0b6da330d
-
SHA512
2f23036eab7b9948517fa080f0ec5f29d908ae58d0f48c7e8ffebc1511438a18fe7d7da5c1fb79a36d329b53461d45ce7927e3423f5c0fb59e30151ebe9c7eff
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIJSsD+cGUFzJI:ymb3NkkiQ3mdBjFIwsDhbNG
Malware Config
Signatures
-
Detect Blackmoon payload 17 IoCs
Processes:
resource yara_rule behavioral1/memory/1848-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2212-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1968-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1744-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1516-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1508-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/628-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
btbhtt.exe7pdpv.exe9lfllrf.exehtnbbt.exe3djdd.exe1rfxxlx.exetnttbb.exedjvvd.exefrxflfr.exebnhbnn.exetnbhtn.exejddjv.exe5rfrxll.exe1rfrrfx.exebnbhhn.exejvpvd.exelxllrrx.exeffrxxfl.exethnbbb.exetnbttb.exe9pdjv.exejdvjd.exe5xrrrrl.exe9lffrrx.exehbnhnt.exe3jvpd.exe5lrxlrx.exexlrlllr.exennhnbn.exepdvvv.exejdvjp.exexrflrll.exebbhhbh.exe5bntbt.exedvjpv.exedpvdd.exefxlfffl.exe9htbht.exehtbtbt.exe3djjd.exevjvjj.exelfrrrrx.exefxxlxlx.exenbhhnn.exebnbhtn.exepjpvv.exe9llxllr.exerfrrrrx.exehbhthn.exenbnhhh.exe5jvjj.exejjjpj.exexrflxfl.exerrlxfrl.exehbthth.exe7ntttb.exevpdpp.exedvjjv.exerfxxxxx.exerrlxxfl.exetnbnbn.exe3thntn.exeddjjd.exe1vjjd.exepid process 2596 btbhtt.exe 856 7pdpv.exe 2640 9lfllrf.exe 2912 htnbbt.exe 2900 3djdd.exe 2760 1rfxxlx.exe 2560 tnttbb.exe 2544 djvvd.exe 2212 frxflfr.exe 2600 bnhbnn.exe 2840 tnbhtn.exe 1060 jddjv.exe 1968 5rfrxll.exe 1664 1rfrrfx.exe 1888 bnbhhn.exe 2152 jvpvd.exe 1976 lxllrrx.exe 1744 ffrxxfl.exe 2320 thnbbb.exe 2496 tnbttb.exe 2692 9pdjv.exe 2236 jdvjd.exe 1476 5xrrrrl.exe 980 9lffrrx.exe 1516 hbnhnt.exe 1804 3jvpd.exe 1952 5lrxlrx.exe 1892 xlrlllr.exe 1508 nnhnbn.exe 628 pdvvv.exe 2360 jdvjp.exe 2288 xrflrll.exe 2412 bbhhbh.exe 1552 5bntbt.exe 2700 dvjpv.exe 2232 dpvdd.exe 2704 fxlfffl.exe 2668 9htbht.exe 2764 htbtbt.exe 1656 3djjd.exe 3064 vjvjj.exe 2568 lfrrrrx.exe 2532 fxxlxlx.exe 3000 nbhhnn.exe 3016 bnbhtn.exe 2816 pjpvv.exe 2612 9llxllr.exe 2844 rfrrrrx.exe 2876 hbhthn.exe 1096 nbnhhh.exe 1052 5jvjj.exe 2192 jjjpj.exe 952 xrflxfl.exe 1432 rrlxfrl.exe 2404 hbthth.exe 1724 7ntttb.exe 3040 vpdpp.exe 308 dvjjv.exe 1256 rfxxxxx.exe 2920 rrlxxfl.exe 2916 tnbnbn.exe 264 3thntn.exe 1660 ddjjd.exe 1092 1vjjd.exe -
Processes:
resource yara_rule behavioral1/memory/1848-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1968-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1744-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1516-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1508-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/628-290-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1e76bdd34c2c5cdb856f553a5e94ab20_NeikiAnalytics.exebtbhtt.exe7pdpv.exe9lfllrf.exehtnbbt.exe3djdd.exe1rfxxlx.exetnttbb.exedjvvd.exefrxflfr.exebnhbnn.exetnbhtn.exejddjv.exe5rfrxll.exe1rfrrfx.exebnbhhn.exedescription pid process target process PID 1848 wrote to memory of 2596 1848 1e76bdd34c2c5cdb856f553a5e94ab20_NeikiAnalytics.exe btbhtt.exe PID 1848 wrote to memory of 2596 1848 1e76bdd34c2c5cdb856f553a5e94ab20_NeikiAnalytics.exe btbhtt.exe PID 1848 wrote to memory of 2596 1848 1e76bdd34c2c5cdb856f553a5e94ab20_NeikiAnalytics.exe btbhtt.exe PID 1848 wrote to memory of 2596 1848 1e76bdd34c2c5cdb856f553a5e94ab20_NeikiAnalytics.exe btbhtt.exe PID 2596 wrote to memory of 856 2596 btbhtt.exe 7pdpv.exe PID 2596 wrote to memory of 856 2596 btbhtt.exe 7pdpv.exe PID 2596 wrote to memory of 856 2596 btbhtt.exe 7pdpv.exe PID 2596 wrote to memory of 856 2596 btbhtt.exe 7pdpv.exe PID 856 wrote to memory of 2640 856 7pdpv.exe 9lfllrf.exe PID 856 wrote to memory of 2640 856 7pdpv.exe 9lfllrf.exe PID 856 wrote to memory of 2640 856 7pdpv.exe 9lfllrf.exe PID 856 wrote to memory of 2640 856 7pdpv.exe 9lfllrf.exe PID 2640 wrote to memory of 2912 2640 9lfllrf.exe htnbbt.exe PID 2640 wrote to memory of 2912 2640 9lfllrf.exe htnbbt.exe PID 2640 wrote to memory of 2912 2640 9lfllrf.exe htnbbt.exe PID 2640 wrote to memory of 2912 2640 9lfllrf.exe htnbbt.exe PID 2912 wrote to memory of 2900 2912 htnbbt.exe 3djdd.exe PID 2912 wrote to memory of 2900 2912 htnbbt.exe 3djdd.exe PID 2912 wrote to memory of 2900 2912 htnbbt.exe 3djdd.exe PID 2912 wrote to memory of 2900 2912 htnbbt.exe 3djdd.exe PID 2900 wrote to memory of 2760 2900 3djdd.exe 1rfxxlx.exe PID 2900 wrote to memory of 2760 2900 3djdd.exe 1rfxxlx.exe PID 2900 wrote to memory of 2760 2900 3djdd.exe 1rfxxlx.exe PID 2900 wrote to memory of 2760 2900 3djdd.exe 1rfxxlx.exe PID 2760 wrote to memory of 2560 2760 1rfxxlx.exe tnttbb.exe PID 2760 wrote to memory of 2560 2760 1rfxxlx.exe tnttbb.exe PID 2760 wrote to memory of 2560 2760 1rfxxlx.exe tnttbb.exe PID 2760 wrote to memory of 2560 2760 1rfxxlx.exe tnttbb.exe PID 2560 wrote to memory of 2544 2560 tnttbb.exe djvvd.exe PID 2560 wrote to memory of 2544 2560 tnttbb.exe djvvd.exe PID 2560 wrote to memory of 2544 2560 tnttbb.exe djvvd.exe PID 2560 wrote to memory of 2544 2560 tnttbb.exe djvvd.exe PID 2544 wrote to memory of 2212 2544 djvvd.exe frxflfr.exe PID 2544 wrote to memory of 2212 2544 djvvd.exe frxflfr.exe PID 2544 wrote to memory of 2212 2544 djvvd.exe frxflfr.exe PID 2544 wrote to memory of 2212 2544 djvvd.exe frxflfr.exe PID 2212 wrote to memory of 2600 2212 frxflfr.exe bnhbnn.exe PID 2212 wrote to memory of 2600 2212 frxflfr.exe bnhbnn.exe PID 2212 wrote to memory of 2600 2212 frxflfr.exe bnhbnn.exe PID 2212 wrote to memory of 2600 2212 frxflfr.exe bnhbnn.exe PID 2600 wrote to memory of 2840 2600 bnhbnn.exe tnbhtn.exe PID 2600 wrote to memory of 2840 2600 bnhbnn.exe tnbhtn.exe PID 2600 wrote to memory of 2840 2600 bnhbnn.exe tnbhtn.exe PID 2600 wrote to memory of 2840 2600 bnhbnn.exe tnbhtn.exe PID 2840 wrote to memory of 1060 2840 tnbhtn.exe jddjv.exe PID 2840 wrote to memory of 1060 2840 tnbhtn.exe jddjv.exe PID 2840 wrote to memory of 1060 2840 tnbhtn.exe jddjv.exe PID 2840 wrote to memory of 1060 2840 tnbhtn.exe jddjv.exe PID 1060 wrote to memory of 1968 1060 jddjv.exe 5rfrxll.exe PID 1060 wrote to memory of 1968 1060 jddjv.exe 5rfrxll.exe PID 1060 wrote to memory of 1968 1060 jddjv.exe 5rfrxll.exe PID 1060 wrote to memory of 1968 1060 jddjv.exe 5rfrxll.exe PID 1968 wrote to memory of 1664 1968 5rfrxll.exe 1rfrrfx.exe PID 1968 wrote to memory of 1664 1968 5rfrxll.exe 1rfrrfx.exe PID 1968 wrote to memory of 1664 1968 5rfrxll.exe 1rfrrfx.exe PID 1968 wrote to memory of 1664 1968 5rfrxll.exe 1rfrrfx.exe PID 1664 wrote to memory of 1888 1664 1rfrrfx.exe bnbhhn.exe PID 1664 wrote to memory of 1888 1664 1rfrrfx.exe bnbhhn.exe PID 1664 wrote to memory of 1888 1664 1rfrrfx.exe bnbhhn.exe PID 1664 wrote to memory of 1888 1664 1rfrrfx.exe bnbhhn.exe PID 1888 wrote to memory of 2152 1888 bnbhhn.exe jvpvd.exe PID 1888 wrote to memory of 2152 1888 bnbhhn.exe jvpvd.exe PID 1888 wrote to memory of 2152 1888 bnbhhn.exe jvpvd.exe PID 1888 wrote to memory of 2152 1888 bnbhhn.exe jvpvd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e76bdd34c2c5cdb856f553a5e94ab20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1e76bdd34c2c5cdb856f553a5e94ab20_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\btbhtt.exec:\btbhtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\7pdpv.exec:\7pdpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\9lfllrf.exec:\9lfllrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\htnbbt.exec:\htnbbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\3djdd.exec:\3djdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\1rfxxlx.exec:\1rfxxlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\tnttbb.exec:\tnttbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\djvvd.exec:\djvvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\frxflfr.exec:\frxflfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\bnhbnn.exec:\bnhbnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\tnbhtn.exec:\tnbhtn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\jddjv.exec:\jddjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\5rfrxll.exec:\5rfrxll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\1rfrrfx.exec:\1rfrrfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\bnbhhn.exec:\bnbhhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\jvpvd.exec:\jvpvd.exe17⤵
- Executes dropped EXE
PID:2152 -
\??\c:\lxllrrx.exec:\lxllrrx.exe18⤵
- Executes dropped EXE
PID:1976 -
\??\c:\ffrxxfl.exec:\ffrxxfl.exe19⤵
- Executes dropped EXE
PID:1744 -
\??\c:\thnbbb.exec:\thnbbb.exe20⤵
- Executes dropped EXE
PID:2320 -
\??\c:\tnbttb.exec:\tnbttb.exe21⤵
- Executes dropped EXE
PID:2496 -
\??\c:\9pdjv.exec:\9pdjv.exe22⤵
- Executes dropped EXE
PID:2692 -
\??\c:\jdvjd.exec:\jdvjd.exe23⤵
- Executes dropped EXE
PID:2236 -
\??\c:\5xrrrrl.exec:\5xrrrrl.exe24⤵
- Executes dropped EXE
PID:1476 -
\??\c:\9lffrrx.exec:\9lffrrx.exe25⤵
- Executes dropped EXE
PID:980 -
\??\c:\hbnhnt.exec:\hbnhnt.exe26⤵
- Executes dropped EXE
PID:1516 -
\??\c:\3jvpd.exec:\3jvpd.exe27⤵
- Executes dropped EXE
PID:1804 -
\??\c:\5lrxlrx.exec:\5lrxlrx.exe28⤵
- Executes dropped EXE
PID:1952 -
\??\c:\xlrlllr.exec:\xlrlllr.exe29⤵
- Executes dropped EXE
PID:1892 -
\??\c:\nnhnbn.exec:\nnhnbn.exe30⤵
- Executes dropped EXE
PID:1508 -
\??\c:\pdvvv.exec:\pdvvv.exe31⤵
- Executes dropped EXE
PID:628 -
\??\c:\jdvjp.exec:\jdvjp.exe32⤵
- Executes dropped EXE
PID:2360 -
\??\c:\xrflrll.exec:\xrflrll.exe33⤵
- Executes dropped EXE
PID:2288 -
\??\c:\bbhhbh.exec:\bbhhbh.exe34⤵
- Executes dropped EXE
PID:2412 -
\??\c:\5bntbt.exec:\5bntbt.exe35⤵
- Executes dropped EXE
PID:1552 -
\??\c:\dvjpv.exec:\dvjpv.exe36⤵
- Executes dropped EXE
PID:2700 -
\??\c:\dpvdd.exec:\dpvdd.exe37⤵
- Executes dropped EXE
PID:2232 -
\??\c:\fxlfffl.exec:\fxlfffl.exe38⤵
- Executes dropped EXE
PID:2704 -
\??\c:\9htbht.exec:\9htbht.exe39⤵
- Executes dropped EXE
PID:2668 -
\??\c:\htbtbt.exec:\htbtbt.exe40⤵
- Executes dropped EXE
PID:2764 -
\??\c:\3djjd.exec:\3djjd.exe41⤵
- Executes dropped EXE
PID:1656 -
\??\c:\vjvjj.exec:\vjvjj.exe42⤵
- Executes dropped EXE
PID:3064 -
\??\c:\lfrrrrx.exec:\lfrrrrx.exe43⤵
- Executes dropped EXE
PID:2568 -
\??\c:\fxxlxlx.exec:\fxxlxlx.exe44⤵
- Executes dropped EXE
PID:2532 -
\??\c:\nbhhnn.exec:\nbhhnn.exe45⤵
- Executes dropped EXE
PID:3000 -
\??\c:\bnbhtn.exec:\bnbhtn.exe46⤵
- Executes dropped EXE
PID:3016 -
\??\c:\pjpvv.exec:\pjpvv.exe47⤵
- Executes dropped EXE
PID:2816 -
\??\c:\9llxllr.exec:\9llxllr.exe48⤵
- Executes dropped EXE
PID:2612 -
\??\c:\rfrrrrx.exec:\rfrrrrx.exe49⤵
- Executes dropped EXE
PID:2844 -
\??\c:\hbhthn.exec:\hbhthn.exe50⤵
- Executes dropped EXE
PID:2876 -
\??\c:\nbnhhh.exec:\nbnhhh.exe51⤵
- Executes dropped EXE
PID:1096 -
\??\c:\5jvjj.exec:\5jvjj.exe52⤵
- Executes dropped EXE
PID:1052 -
\??\c:\jjjpj.exec:\jjjpj.exe53⤵
- Executes dropped EXE
PID:2192 -
\??\c:\xrflxfl.exec:\xrflxfl.exe54⤵
- Executes dropped EXE
PID:952 -
\??\c:\rrlxfrl.exec:\rrlxfrl.exe55⤵
- Executes dropped EXE
PID:1432 -
\??\c:\hbthth.exec:\hbthth.exe56⤵
- Executes dropped EXE
PID:2404 -
\??\c:\7ntttb.exec:\7ntttb.exe57⤵
- Executes dropped EXE
PID:1724 -
\??\c:\vpdpp.exec:\vpdpp.exe58⤵
- Executes dropped EXE
PID:3040 -
\??\c:\dvjjv.exec:\dvjjv.exe59⤵
- Executes dropped EXE
PID:308 -
\??\c:\rfxxxxx.exec:\rfxxxxx.exe60⤵
- Executes dropped EXE
PID:1256 -
\??\c:\rrlxxfl.exec:\rrlxxfl.exe61⤵
- Executes dropped EXE
PID:2920 -
\??\c:\tnbnbn.exec:\tnbnbn.exe62⤵
- Executes dropped EXE
PID:2916 -
\??\c:\3thntn.exec:\3thntn.exe63⤵
- Executes dropped EXE
PID:264 -
\??\c:\ddjjd.exec:\ddjjd.exe64⤵
- Executes dropped EXE
PID:1660 -
\??\c:\1vjjd.exec:\1vjjd.exe65⤵
- Executes dropped EXE
PID:1092 -
\??\c:\1lllfll.exec:\1lllfll.exe66⤵PID:2484
-
\??\c:\1nbhnn.exec:\1nbhnn.exe67⤵PID:2964
-
\??\c:\hbhnhn.exec:\hbhnhn.exe68⤵PID:556
-
\??\c:\jjpdp.exec:\jjpdp.exe69⤵PID:2328
-
\??\c:\dpvvj.exec:\dpvvj.exe70⤵PID:1564
-
\??\c:\fxllxxf.exec:\fxllxxf.exe71⤵PID:2128
-
\??\c:\xxlxrfl.exec:\xxlxrfl.exe72⤵PID:3060
-
\??\c:\bntbhb.exec:\bntbhb.exe73⤵PID:892
-
\??\c:\tnnntt.exec:\tnnntt.exe74⤵PID:1684
-
\??\c:\dvppp.exec:\dvppp.exe75⤵PID:1992
-
\??\c:\jvjjp.exec:\jvjjp.exe76⤵PID:1688
-
\??\c:\xlllllr.exec:\xlllllr.exe77⤵PID:1372
-
\??\c:\bntbht.exec:\bntbht.exe78⤵PID:2172
-
\??\c:\3tbbhn.exec:\3tbbhn.exe79⤵PID:2280
-
\??\c:\pjpvv.exec:\pjpvv.exe80⤵PID:2732
-
\??\c:\dpddd.exec:\dpddd.exe81⤵PID:2644
-
\??\c:\1rfrrrr.exec:\1rfrrrr.exe82⤵PID:2776
-
\??\c:\fxflxxf.exec:\fxflxxf.exe83⤵PID:2848
-
\??\c:\fxxxffl.exec:\fxxxffl.exe84⤵PID:2744
-
\??\c:\nbnbnt.exec:\nbnbnt.exe85⤵PID:2516
-
\??\c:\hbtbbb.exec:\hbtbbb.exe86⤵PID:2588
-
\??\c:\jvjdj.exec:\jvjdj.exe87⤵PID:2428
-
\??\c:\1vpvd.exec:\1vpvd.exe88⤵PID:1960
-
\??\c:\xrxxlll.exec:\xrxxlll.exe89⤵PID:2696
-
\??\c:\1lrxllx.exec:\1lrxllx.exe90⤵PID:2600
-
\??\c:\7ttbnn.exec:\7ttbnn.exe91⤵PID:2840
-
\??\c:\tbbntt.exec:\tbbntt.exe92⤵PID:2012
-
\??\c:\jpvjj.exec:\jpvjj.exe93⤵PID:2044
-
\??\c:\frxflrf.exec:\frxflrf.exe94⤵PID:2196
-
\??\c:\1httbb.exec:\1httbb.exe95⤵PID:1616
-
\??\c:\pjvpp.exec:\pjvpp.exe96⤵PID:2140
-
\??\c:\rflfflr.exec:\rflfflr.exe97⤵PID:2488
-
\??\c:\xlrflrf.exec:\xlrflrf.exe98⤵PID:2988
-
\??\c:\bbbbbt.exec:\bbbbbt.exe99⤵PID:2252
-
\??\c:\hbtbbn.exec:\hbtbbn.exe100⤵PID:2960
-
\??\c:\1jdjp.exec:\1jdjp.exe101⤵PID:3024
-
\??\c:\3jpdj.exec:\3jpdj.exe102⤵PID:2932
-
\??\c:\xrfrrxf.exec:\xrfrrxf.exe103⤵PID:536
-
\??\c:\xllrfxr.exec:\xllrfxr.exe104⤵PID:1012
-
\??\c:\9rxfrfl.exec:\9rxfrfl.exe105⤵PID:1468
-
\??\c:\1hhtnh.exec:\1hhtnh.exe106⤵PID:2004
-
\??\c:\vdppp.exec:\vdppp.exe107⤵PID:980
-
\??\c:\7jjvd.exec:\7jjvd.exe108⤵PID:2480
-
\??\c:\xxflfll.exec:\xxflfll.exe109⤵PID:3056
-
\??\c:\fffrfff.exec:\fffrfff.exe110⤵PID:908
-
\??\c:\nhbthb.exec:\nhbthb.exe111⤵PID:2184
-
\??\c:\hbttbh.exec:\hbttbh.exe112⤵PID:1216
-
\??\c:\htbttb.exec:\htbttb.exe113⤵PID:2292
-
\??\c:\dvjjv.exec:\dvjjv.exe114⤵PID:1608
-
\??\c:\dpvpv.exec:\dpvpv.exe115⤵PID:1736
-
\??\c:\5rfxrll.exec:\5rfxrll.exe116⤵PID:2244
-
\??\c:\3flllrf.exec:\3flllrf.exe117⤵PID:1684
-
\??\c:\tnnthb.exec:\tnnthb.exe118⤵PID:2592
-
\??\c:\btttbb.exec:\btttbb.exe119⤵PID:2780
-
\??\c:\nnbhtb.exec:\nnbhtb.exe120⤵PID:2652
-
\??\c:\dvvdv.exec:\dvvdv.exe121⤵PID:1504
-
\??\c:\vvvpp.exec:\vvvpp.exe122⤵PID:2616
-
\??\c:\1frxxxx.exec:\1frxxxx.exe123⤵PID:2628
-
\??\c:\lffrlxf.exec:\lffrlxf.exe124⤵PID:2728
-
\??\c:\tthhnt.exec:\tthhnt.exe125⤵PID:2648
-
\??\c:\thbhbb.exec:\thbhbb.exe126⤵PID:2512
-
\??\c:\djpjj.exec:\djpjj.exe127⤵PID:2176
-
\??\c:\ddjvp.exec:\ddjvp.exe128⤵PID:2516
-
\??\c:\xrlfrrx.exec:\xrlfrrx.exe129⤵PID:1964
-
\??\c:\xrxfxfl.exec:\xrxfxfl.exe130⤵PID:2212
-
\??\c:\tbtbth.exec:\tbtbth.exe131⤵PID:2808
-
\??\c:\tthnnt.exec:\tthnnt.exe132⤵PID:2688
-
\??\c:\vvjjj.exec:\vvjjj.exe133⤵PID:1604
-
\??\c:\5jvvv.exec:\5jvvv.exe134⤵PID:1884
-
\??\c:\rfxlflr.exec:\rfxlflr.exe135⤵PID:1096
-
\??\c:\7lffrlr.exec:\7lffrlr.exe136⤵PID:1052
-
\??\c:\1nbnbh.exec:\1nbnbh.exe137⤵PID:1984
-
\??\c:\5nbbhh.exec:\5nbbhh.exe138⤵PID:756
-
\??\c:\5dpvd.exec:\5dpvd.exe139⤵PID:236
-
\??\c:\pdjjj.exec:\pdjjj.exe140⤵PID:792
-
\??\c:\pvjpp.exec:\pvjpp.exe141⤵PID:1744
-
\??\c:\9rfrrxl.exec:\9rfrrxl.exe142⤵PID:1236
-
\??\c:\frrfrrx.exec:\frrfrrx.exe143⤵PID:2856
-
\??\c:\thtttn.exec:\thtttn.exe144⤵PID:2064
-
\??\c:\nhbttt.exec:\nhbttt.exe145⤵PID:2016
-
\??\c:\jvjvd.exec:\jvjvd.exe146⤵PID:1620
-
\??\c:\dvdvd.exec:\dvdvd.exe147⤵PID:1028
-
\??\c:\frrflxf.exec:\frrflxf.exe148⤵PID:3020
-
\??\c:\3lflxlx.exec:\3lflxlx.exe149⤵PID:1344
-
\??\c:\nnhnnn.exec:\nnhnnn.exe150⤵PID:1360
-
\??\c:\1hnhhb.exec:\1hnhhb.exe151⤵PID:764
-
\??\c:\vpjjv.exec:\vpjjv.exe152⤵PID:3056
-
\??\c:\3pppp.exec:\3pppp.exe153⤵PID:1084
-
\??\c:\vvjpd.exec:\vvjpd.exe154⤵PID:2164
-
\??\c:\lfllflr.exec:\lfllflr.exe155⤵PID:2168
-
\??\c:\7rrlxxl.exec:\7rrlxxl.exe156⤵PID:984
-
\??\c:\3hhnhn.exec:\3hhnhn.exe157⤵PID:1868
-
\??\c:\1hbtbb.exec:\1hbtbb.exe158⤵PID:2288
-
\??\c:\vpdpv.exec:\vpdpv.exe159⤵PID:1692
-
\??\c:\jpdpv.exec:\jpdpv.exe160⤵PID:2412
-
\??\c:\1djdj.exec:\1djdj.exe161⤵PID:2376
-
\??\c:\lfrlrxf.exec:\lfrlrxf.exe162⤵PID:2712
-
\??\c:\9lxfflr.exec:\9lxfflr.exe163⤵PID:2664
-
\??\c:\nthbbn.exec:\nthbbn.exe164⤵PID:2772
-
\??\c:\hhbhht.exec:\hhbhht.exe165⤵PID:2672
-
\??\c:\9jdpd.exec:\9jdpd.exe166⤵PID:2764
-
\??\c:\dpddd.exec:\dpddd.exe167⤵PID:2624
-
\??\c:\fflrrfl.exec:\fflrrfl.exe168⤵PID:1324
-
\??\c:\rxllrxr.exec:\rxllrxr.exe169⤵PID:3008
-
\??\c:\bbthth.exec:\bbthth.exe170⤵PID:2336
-
\??\c:\bbtnbn.exec:\bbtnbn.exe171⤵PID:2040
-
\??\c:\9dddd.exec:\9dddd.exe172⤵PID:2832
-
\??\c:\vpjvj.exec:\vpjvj.exe173⤵PID:2852
-
\??\c:\rrxfxfr.exec:\rrxfxfr.exe174⤵PID:2800
-
\??\c:\rflxfff.exec:\rflxfff.exe175⤵PID:1060
-
\??\c:\bbbtbt.exec:\bbbtbt.exe176⤵PID:2312
-
\??\c:\bnbttt.exec:\bnbttt.exe177⤵PID:2208
-
\??\c:\9jdjp.exec:\9jdjp.exe178⤵PID:2396
-
\??\c:\dpvpp.exec:\dpvpp.exe179⤵PID:1192
-
\??\c:\ppdvd.exec:\ppdvd.exe180⤵PID:832
-
\??\c:\fxllrff.exec:\fxllrff.exe181⤵PID:1976
-
\??\c:\frrrfll.exec:\frrrfll.exe182⤵PID:276
-
\??\c:\nhthnn.exec:\nhthnn.exe183⤵PID:2608
-
\??\c:\5hthnt.exec:\5hthnt.exe184⤵PID:2320
-
\??\c:\pdppp.exec:\pdppp.exe185⤵PID:2928
-
\??\c:\dvdjj.exec:\dvdjj.exe186⤵PID:2088
-
\??\c:\vpdvv.exec:\vpdvv.exe187⤵PID:496
-
\??\c:\frffllr.exec:\frffllr.exe188⤵PID:1996
-
\??\c:\5frllfl.exec:\5frllfl.exe189⤵PID:1436
-
\??\c:\thtbnn.exec:\thtbnn.exe190⤵PID:844
-
\??\c:\tnthtt.exec:\tnthtt.exe191⤵PID:396
-
\??\c:\dvvvp.exec:\dvvvp.exe192⤵PID:1932
-
\??\c:\pjvdv.exec:\pjvdv.exe193⤵PID:568
-
\??\c:\pdjjj.exec:\pdjjj.exe194⤵PID:2956
-
\??\c:\flrrxxf.exec:\flrrxxf.exe195⤵PID:2420
-
\??\c:\rlxflfl.exec:\rlxflfl.exe196⤵PID:1564
-
\??\c:\1lxxrxx.exec:\1lxxrxx.exe197⤵PID:2368
-
\??\c:\5hhhnt.exec:\5hhhnt.exe198⤵PID:872
-
\??\c:\bthbnh.exec:\bthbnh.exe199⤵PID:2464
-
\??\c:\3jvdp.exec:\3jvdp.exe200⤵PID:2256
-
\??\c:\vjvvv.exec:\vjvvv.exe201⤵PID:1672
-
\??\c:\5rfflrx.exec:\5rfflrx.exe202⤵PID:2092
-
\??\c:\lfrlrxx.exec:\lfrlrxx.exe203⤵PID:2700
-
\??\c:\5nbnnh.exec:\5nbnnh.exe204⤵PID:2652
-
\??\c:\nnhhnn.exec:\nnhhnn.exe205⤵PID:1504
-
\??\c:\lfrrxfr.exec:\lfrrxfr.exe206⤵PID:2708
-
\??\c:\9hthht.exec:\9hthht.exe207⤵PID:2788
-
\??\c:\7htnhn.exec:\7htnhn.exe208⤵PID:2676
-
\??\c:\ppdvv.exec:\ppdvv.exe209⤵PID:3064
-
\??\c:\djvdd.exec:\djvdd.exe210⤵PID:2584
-
\??\c:\dvpdd.exec:\dvpdd.exe211⤵PID:2556
-
\??\c:\5lflrxx.exec:\5lflrxx.exe212⤵PID:1860
-
\??\c:\frffrrx.exec:\frffrrx.exe213⤵PID:2572
-
\??\c:\hbbtbb.exec:\hbbtbb.exe214⤵PID:2880
-
\??\c:\btthht.exec:\btthht.exe215⤵PID:2612
-
\??\c:\vddvd.exec:\vddvd.exe216⤵PID:2868
-
\??\c:\ppjvv.exec:\ppjvv.exe217⤵PID:1700
-
\??\c:\lfrxlxl.exec:\lfrxlxl.exe218⤵PID:1884
-
\??\c:\xlrrrlr.exec:\xlrrrlr.exe219⤵PID:1972
-
\??\c:\frxxlfr.exec:\frxxlfr.exe220⤵PID:1052
-
\??\c:\3htnbt.exec:\3htnbt.exe221⤵PID:2188
-
\??\c:\nthnht.exec:\nthnht.exe222⤵PID:756
-
\??\c:\jvpvd.exec:\jvpvd.exe223⤵PID:2200
-
\??\c:\pdvpp.exec:\pdvpp.exe224⤵PID:792
-
\??\c:\xllfllr.exec:\xllfllr.exe225⤵PID:3040
-
\??\c:\flrlrrl.exec:\flrlrrl.exe226⤵PID:2496
-
\??\c:\bntntn.exec:\bntntn.exe227⤵PID:2228
-
\??\c:\3nttbh.exec:\3nttbh.exe228⤵PID:2088
-
\??\c:\pdppd.exec:\pdppd.exe229⤵PID:584
-
\??\c:\pjvdd.exec:\pjvdd.exe230⤵PID:644
-
\??\c:\fxfxfxx.exec:\fxfxfxx.exe231⤵PID:912
-
\??\c:\frrrxxr.exec:\frrrxxr.exe232⤵PID:1592
-
\??\c:\frfffff.exec:\frfffff.exe233⤵PID:2136
-
\??\c:\bthbhb.exec:\bthbhb.exe234⤵PID:900
-
\??\c:\hbbbhn.exec:\hbbbhn.exe235⤵PID:1952
-
\??\c:\5jjjj.exec:\5jjjj.exe236⤵PID:1320
-
\??\c:\xffxxlr.exec:\xffxxlr.exe237⤵PID:1728
-
\??\c:\rlrrrlr.exec:\rlrrrlr.exe238⤵PID:2164
-
\??\c:\htbbhn.exec:\htbbhn.exe239⤵PID:2020
-
\??\c:\7hhtbb.exec:\7hhtbb.exe240⤵PID:2892
-
\??\c:\vvjpp.exec:\vvjpp.exe241⤵PID:1848
-
\??\c:\5pddp.exec:\5pddp.exe242⤵PID:3036