Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 09:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e1b8c1e240162dee6c143cd563b22210_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
e1b8c1e240162dee6c143cd563b22210_NeikiAnalytics.exe
-
Size
213KB
-
MD5
e1b8c1e240162dee6c143cd563b22210
-
SHA1
830a4ce28c031e3b5033f8f7c5cfaab7f7e671b3
-
SHA256
fc75cec9080cf75174a4395e139e37f12bd391b9592f2e66d7d56a9d60e9ab13
-
SHA512
bcac50eb65f7327c9bc6361d71e9d2e0df2b10b786b119f733f49d1fd402c5900813b3b2ebfb66785bfc86934a3f2103ecd2cb7281e187ba4ec90d61308f67be
-
SSDEEP
3072:ymb3NkkiQ3mdBjFIi/0RU6QeYQsm71vPmc51+GqekBJCvr6zJBUmABvP:n3C9BRIG0asYFm71m8+GdkB9EBX
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/1976-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2508-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1252-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1612-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1752-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1184-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1032-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1780-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2164-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/988-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1684-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1580-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1480-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1460-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1912-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vjvdj.exedvdpv.exe1xlrlfl.exetthhnt.exenbntnt.exe7fxrffr.exetnhbbb.exepvjdd.exerlxrxlx.exe1nnbhn.exedvdjp.exexffxlrx.exettthht.exejjddv.exerrfrffr.exebhnhhb.exejpvvd.exerlrrffr.exexxlrrxl.exepjdjv.exefxrflrx.exetbnhbt.exejdvjp.exefrfxxxl.exebhbbhh.exe3lxxflr.exelllxxrf.exebbbhht.exejvjjj.exe9xxlxlx.exe9pvjv.exefxlrfrx.exettttht.exe9nhhnt.exedpddp.exevjppd.exefrrfrlr.exebhtbbb.exebtnhnn.exe5jvjd.exe9jpdd.exe3fxfrxf.exerllxrlf.exettnhtb.exepdvdp.exedvpdj.exelfrxllx.exehbnttt.exebntnht.exe1vvdp.exellffrrx.exerlxrllx.exehthhtt.exe1hhttt.exe3jdjj.exeflffrrr.exellffflx.exenhtbhn.exedvjpj.exejvjvd.exeflrfxrl.exehhbtbn.exetbbttn.exevvvdj.exepid process 2752 vjvdj.exe 2584 dvdpv.exe 2740 1xlrlfl.exe 2464 tthhnt.exe 2484 nbntnt.exe 1736 7fxrffr.exe 1716 tnhbbb.exe 2508 pvjdd.exe 1244 rlxrxlx.exe 1252 1nnbhn.exe 2644 dvdjp.exe 1456 xffxlrx.exe 2360 ttthht.exe 1612 jjddv.exe 1752 rrfrffr.exe 796 bhnhhb.exe 1184 jpvvd.exe 1692 rlrrffr.exe 2640 xxlrrxl.exe 1032 pjdjv.exe 1780 fxrflrx.exe 2164 tbnhbt.exe 988 jdvjp.exe 2328 frfxxxl.exe 876 bhbbhh.exe 1300 3lxxflr.exe 1684 lllxxrf.exe 1580 bbbhht.exe 1480 jvjjj.exe 1460 9xxlxlx.exe 1912 9pvjv.exe 2540 fxlrfrx.exe 2880 ttttht.exe 1904 9nhhnt.exe 1548 dpddp.exe 2324 vjppd.exe 2712 frrfrlr.exe 2600 bhtbbb.exe 2992 btnhnn.exe 2464 5jvjd.exe 2624 9jpdd.exe 2456 3fxfrxf.exe 2532 rllxrlf.exe 2488 ttnhtb.exe 2508 pdvdp.exe 1328 dvpdj.exe 1636 lfrxllx.exe 2728 hbnttt.exe 2652 bntnht.exe 2184 1vvdp.exe 2348 llffrrx.exe 1452 rlxrllx.exe 2188 hthhtt.exe 1752 1hhttt.exe 1100 3jdjj.exe 2800 flffrrr.exe 2816 llffflx.exe 2216 nhtbhn.exe 960 dvjpj.exe 1412 jvjvd.exe 1108 flrfxrl.exe 3020 hhbtbn.exe 2164 tbbttn.exe 988 vvvdj.exe -
Processes:
resource yara_rule behavioral1/memory/1976-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1252-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1612-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1184-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1032-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1780-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2164-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/988-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1684-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1580-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1480-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1460-286-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1912-295-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e1b8c1e240162dee6c143cd563b22210_NeikiAnalytics.exevjvdj.exedvdpv.exe1xlrlfl.exetthhnt.exenbntnt.exe7fxrffr.exetnhbbb.exepvjdd.exerlxrxlx.exe1nnbhn.exedvdjp.exexffxlrx.exettthht.exejjddv.exerrfrffr.exedescription pid process target process PID 1976 wrote to memory of 2752 1976 e1b8c1e240162dee6c143cd563b22210_NeikiAnalytics.exe vjvdj.exe PID 1976 wrote to memory of 2752 1976 e1b8c1e240162dee6c143cd563b22210_NeikiAnalytics.exe vjvdj.exe PID 1976 wrote to memory of 2752 1976 e1b8c1e240162dee6c143cd563b22210_NeikiAnalytics.exe vjvdj.exe PID 1976 wrote to memory of 2752 1976 e1b8c1e240162dee6c143cd563b22210_NeikiAnalytics.exe vjvdj.exe PID 2752 wrote to memory of 2584 2752 vjvdj.exe dvdpv.exe PID 2752 wrote to memory of 2584 2752 vjvdj.exe dvdpv.exe PID 2752 wrote to memory of 2584 2752 vjvdj.exe dvdpv.exe PID 2752 wrote to memory of 2584 2752 vjvdj.exe dvdpv.exe PID 2584 wrote to memory of 2740 2584 dvdpv.exe 1xlrlfl.exe PID 2584 wrote to memory of 2740 2584 dvdpv.exe 1xlrlfl.exe PID 2584 wrote to memory of 2740 2584 dvdpv.exe 1xlrlfl.exe PID 2584 wrote to memory of 2740 2584 dvdpv.exe 1xlrlfl.exe PID 2740 wrote to memory of 2464 2740 1xlrlfl.exe tthhnt.exe PID 2740 wrote to memory of 2464 2740 1xlrlfl.exe tthhnt.exe PID 2740 wrote to memory of 2464 2740 1xlrlfl.exe tthhnt.exe PID 2740 wrote to memory of 2464 2740 1xlrlfl.exe tthhnt.exe PID 2464 wrote to memory of 2484 2464 tthhnt.exe nbntnt.exe PID 2464 wrote to memory of 2484 2464 tthhnt.exe nbntnt.exe PID 2464 wrote to memory of 2484 2464 tthhnt.exe nbntnt.exe PID 2464 wrote to memory of 2484 2464 tthhnt.exe nbntnt.exe PID 2484 wrote to memory of 1736 2484 nbntnt.exe 7fxrffr.exe PID 2484 wrote to memory of 1736 2484 nbntnt.exe 7fxrffr.exe PID 2484 wrote to memory of 1736 2484 nbntnt.exe 7fxrffr.exe PID 2484 wrote to memory of 1736 2484 nbntnt.exe 7fxrffr.exe PID 1736 wrote to memory of 1716 1736 7fxrffr.exe tnhbbb.exe PID 1736 wrote to memory of 1716 1736 7fxrffr.exe tnhbbb.exe PID 1736 wrote to memory of 1716 1736 7fxrffr.exe tnhbbb.exe PID 1736 wrote to memory of 1716 1736 7fxrffr.exe tnhbbb.exe PID 1716 wrote to memory of 2508 1716 tnhbbb.exe pvjdd.exe PID 1716 wrote to memory of 2508 1716 tnhbbb.exe pvjdd.exe PID 1716 wrote to memory of 2508 1716 tnhbbb.exe pvjdd.exe PID 1716 wrote to memory of 2508 1716 tnhbbb.exe pvjdd.exe PID 2508 wrote to memory of 1244 2508 pvjdd.exe rlxrxlx.exe PID 2508 wrote to memory of 1244 2508 pvjdd.exe rlxrxlx.exe PID 2508 wrote to memory of 1244 2508 pvjdd.exe rlxrxlx.exe PID 2508 wrote to memory of 1244 2508 pvjdd.exe rlxrxlx.exe PID 1244 wrote to memory of 1252 1244 rlxrxlx.exe 1nnbhn.exe PID 1244 wrote to memory of 1252 1244 rlxrxlx.exe 1nnbhn.exe PID 1244 wrote to memory of 1252 1244 rlxrxlx.exe 1nnbhn.exe PID 1244 wrote to memory of 1252 1244 rlxrxlx.exe 1nnbhn.exe PID 1252 wrote to memory of 2644 1252 1nnbhn.exe dvdjp.exe PID 1252 wrote to memory of 2644 1252 1nnbhn.exe dvdjp.exe PID 1252 wrote to memory of 2644 1252 1nnbhn.exe dvdjp.exe PID 1252 wrote to memory of 2644 1252 1nnbhn.exe dvdjp.exe PID 2644 wrote to memory of 1456 2644 dvdjp.exe xffxlrx.exe PID 2644 wrote to memory of 1456 2644 dvdjp.exe xffxlrx.exe PID 2644 wrote to memory of 1456 2644 dvdjp.exe xffxlrx.exe PID 2644 wrote to memory of 1456 2644 dvdjp.exe xffxlrx.exe PID 1456 wrote to memory of 2360 1456 xffxlrx.exe ttthht.exe PID 1456 wrote to memory of 2360 1456 xffxlrx.exe ttthht.exe PID 1456 wrote to memory of 2360 1456 xffxlrx.exe ttthht.exe PID 1456 wrote to memory of 2360 1456 xffxlrx.exe ttthht.exe PID 2360 wrote to memory of 1612 2360 ttthht.exe jjddv.exe PID 2360 wrote to memory of 1612 2360 ttthht.exe jjddv.exe PID 2360 wrote to memory of 1612 2360 ttthht.exe jjddv.exe PID 2360 wrote to memory of 1612 2360 ttthht.exe jjddv.exe PID 1612 wrote to memory of 1752 1612 jjddv.exe rrfrffr.exe PID 1612 wrote to memory of 1752 1612 jjddv.exe rrfrffr.exe PID 1612 wrote to memory of 1752 1612 jjddv.exe rrfrffr.exe PID 1612 wrote to memory of 1752 1612 jjddv.exe rrfrffr.exe PID 1752 wrote to memory of 796 1752 rrfrffr.exe bhnhhb.exe PID 1752 wrote to memory of 796 1752 rrfrffr.exe bhnhhb.exe PID 1752 wrote to memory of 796 1752 rrfrffr.exe bhnhhb.exe PID 1752 wrote to memory of 796 1752 rrfrffr.exe bhnhhb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1b8c1e240162dee6c143cd563b22210_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e1b8c1e240162dee6c143cd563b22210_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\vjvdj.exec:\vjvdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\dvdpv.exec:\dvdpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\1xlrlfl.exec:\1xlrlfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\tthhnt.exec:\tthhnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\nbntnt.exec:\nbntnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\7fxrffr.exec:\7fxrffr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\tnhbbb.exec:\tnhbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\pvjdd.exec:\pvjdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\rlxrxlx.exec:\rlxrxlx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\1nnbhn.exec:\1nnbhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\dvdjp.exec:\dvdjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\xffxlrx.exec:\xffxlrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\ttthht.exec:\ttthht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\jjddv.exec:\jjddv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\rrfrffr.exec:\rrfrffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\bhnhhb.exec:\bhnhhb.exe17⤵
- Executes dropped EXE
PID:796 -
\??\c:\jpvvd.exec:\jpvvd.exe18⤵
- Executes dropped EXE
PID:1184 -
\??\c:\rlrrffr.exec:\rlrrffr.exe19⤵
- Executes dropped EXE
PID:1692 -
\??\c:\xxlrrxl.exec:\xxlrrxl.exe20⤵
- Executes dropped EXE
PID:2640 -
\??\c:\pjdjv.exec:\pjdjv.exe21⤵
- Executes dropped EXE
PID:1032 -
\??\c:\fxrflrx.exec:\fxrflrx.exe22⤵
- Executes dropped EXE
PID:1780 -
\??\c:\tbnhbt.exec:\tbnhbt.exe23⤵
- Executes dropped EXE
PID:2164 -
\??\c:\jdvjp.exec:\jdvjp.exe24⤵
- Executes dropped EXE
PID:988 -
\??\c:\frfxxxl.exec:\frfxxxl.exe25⤵
- Executes dropped EXE
PID:2328 -
\??\c:\bhbbhh.exec:\bhbbhh.exe26⤵
- Executes dropped EXE
PID:876 -
\??\c:\3lxxflr.exec:\3lxxflr.exe27⤵
- Executes dropped EXE
PID:1300 -
\??\c:\lllxxrf.exec:\lllxxrf.exe28⤵
- Executes dropped EXE
PID:1684 -
\??\c:\bbbhht.exec:\bbbhht.exe29⤵
- Executes dropped EXE
PID:1580 -
\??\c:\jvjjj.exec:\jvjjj.exe30⤵
- Executes dropped EXE
PID:1480 -
\??\c:\9xxlxlx.exec:\9xxlxlx.exe31⤵
- Executes dropped EXE
PID:1460 -
\??\c:\9pvjv.exec:\9pvjv.exe32⤵
- Executes dropped EXE
PID:1912 -
\??\c:\fxlrfrx.exec:\fxlrfrx.exe33⤵
- Executes dropped EXE
PID:2540 -
\??\c:\ttttht.exec:\ttttht.exe34⤵
- Executes dropped EXE
PID:2880 -
\??\c:\9nhhnt.exec:\9nhhnt.exe35⤵
- Executes dropped EXE
PID:1904 -
\??\c:\dpddp.exec:\dpddp.exe36⤵
- Executes dropped EXE
PID:1548 -
\??\c:\vjppd.exec:\vjppd.exe37⤵
- Executes dropped EXE
PID:2324 -
\??\c:\frrfrlr.exec:\frrfrlr.exe38⤵
- Executes dropped EXE
PID:2712 -
\??\c:\bhtbbb.exec:\bhtbbb.exe39⤵
- Executes dropped EXE
PID:2600 -
\??\c:\btnhnn.exec:\btnhnn.exe40⤵
- Executes dropped EXE
PID:2992 -
\??\c:\5jvjd.exec:\5jvjd.exe41⤵
- Executes dropped EXE
PID:2464 -
\??\c:\9jpdd.exec:\9jpdd.exe42⤵
- Executes dropped EXE
PID:2624 -
\??\c:\3fxfrxf.exec:\3fxfrxf.exe43⤵
- Executes dropped EXE
PID:2456 -
\??\c:\rllxrlf.exec:\rllxrlf.exe44⤵
- Executes dropped EXE
PID:2532 -
\??\c:\ttnhtb.exec:\ttnhtb.exe45⤵
- Executes dropped EXE
PID:2488 -
\??\c:\pdvdp.exec:\pdvdp.exe46⤵
- Executes dropped EXE
PID:2508 -
\??\c:\dvpdj.exec:\dvpdj.exe47⤵
- Executes dropped EXE
PID:1328 -
\??\c:\lfrxllx.exec:\lfrxllx.exe48⤵
- Executes dropped EXE
PID:1636 -
\??\c:\hbnttt.exec:\hbnttt.exe49⤵
- Executes dropped EXE
PID:2728 -
\??\c:\bntnht.exec:\bntnht.exe50⤵
- Executes dropped EXE
PID:2652 -
\??\c:\1vvdp.exec:\1vvdp.exe51⤵
- Executes dropped EXE
PID:2184 -
\??\c:\llffrrx.exec:\llffrrx.exe52⤵
- Executes dropped EXE
PID:2348 -
\??\c:\rlxrllx.exec:\rlxrllx.exe53⤵
- Executes dropped EXE
PID:1452 -
\??\c:\hthhtt.exec:\hthhtt.exe54⤵
- Executes dropped EXE
PID:2188 -
\??\c:\1hhttt.exec:\1hhttt.exe55⤵
- Executes dropped EXE
PID:1752 -
\??\c:\3jdjj.exec:\3jdjj.exe56⤵
- Executes dropped EXE
PID:1100 -
\??\c:\flffrrr.exec:\flffrrr.exe57⤵
- Executes dropped EXE
PID:2800 -
\??\c:\llffflx.exec:\llffflx.exe58⤵
- Executes dropped EXE
PID:2816 -
\??\c:\nhtbhn.exec:\nhtbhn.exe59⤵
- Executes dropped EXE
PID:2216 -
\??\c:\dvjpj.exec:\dvjpj.exe60⤵
- Executes dropped EXE
PID:960 -
\??\c:\jvjvd.exec:\jvjvd.exe61⤵
- Executes dropped EXE
PID:1412 -
\??\c:\flrfxrl.exec:\flrfxrl.exe62⤵
- Executes dropped EXE
PID:1108 -
\??\c:\hhbtbn.exec:\hhbtbn.exe63⤵
- Executes dropped EXE
PID:3020 -
\??\c:\tbbttn.exec:\tbbttn.exe64⤵
- Executes dropped EXE
PID:2164 -
\??\c:\vvvdj.exec:\vvvdj.exe65⤵
- Executes dropped EXE
PID:988 -
\??\c:\xlrlxfl.exec:\xlrlxfl.exe66⤵PID:2440
-
\??\c:\rrflxfr.exec:\rrflxfr.exe67⤵PID:792
-
\??\c:\bbbnbh.exec:\bbbnbh.exe68⤵PID:1628
-
\??\c:\bhntnb.exec:\bhntnb.exe69⤵PID:112
-
\??\c:\jddjv.exec:\jddjv.exe70⤵PID:1684
-
\??\c:\xrflffr.exec:\xrflffr.exe71⤵PID:2272
-
\??\c:\nhnnhh.exec:\nhnnhh.exe72⤵PID:300
-
\??\c:\1tbnbb.exec:\1tbnbb.exe73⤵PID:1940
-
\??\c:\vpjpd.exec:\vpjpd.exe74⤵PID:2996
-
\??\c:\pjjpj.exec:\pjjpj.exe75⤵PID:1872
-
\??\c:\xrflxfr.exec:\xrflxfr.exe76⤵PID:2540
-
\??\c:\bbthtb.exec:\bbthtb.exe77⤵PID:2880
-
\??\c:\tbtbnt.exec:\tbtbnt.exe78⤵PID:1640
-
\??\c:\dddpd.exec:\dddpd.exe79⤵PID:1540
-
\??\c:\dvpvp.exec:\dvpvp.exe80⤵PID:2324
-
\??\c:\xxrxlrx.exec:\xxrxlrx.exe81⤵PID:2580
-
\??\c:\3nbnbn.exec:\3nbnbn.exe82⤵PID:2600
-
\??\c:\1btthh.exec:\1btthh.exe83⤵PID:2636
-
\??\c:\jjdpj.exec:\jjdpj.exe84⤵PID:2620
-
\??\c:\lrxxffr.exec:\lrxxffr.exe85⤵PID:2476
-
\??\c:\fxxxlxx.exec:\fxxxlxx.exe86⤵PID:2456
-
\??\c:\tnnthn.exec:\tnnthn.exe87⤵PID:2532
-
\??\c:\pjpvp.exec:\pjpvp.exe88⤵PID:2488
-
\??\c:\jjdjd.exec:\jjdjd.exe89⤵PID:2508
-
\??\c:\fxffrfr.exec:\fxffrfr.exe90⤵PID:1328
-
\??\c:\frrflfl.exec:\frrflfl.exe91⤵PID:2516
-
\??\c:\ttntnb.exec:\ttntnb.exe92⤵PID:2728
-
\??\c:\ppdpp.exec:\ppdpp.exe93⤵PID:2652
-
\??\c:\ppdpj.exec:\ppdpj.exe94⤵PID:2360
-
\??\c:\1rrfrfx.exec:\1rrfrfx.exe95⤵PID:2348
-
\??\c:\hhbbnn.exec:\hhbbnn.exe96⤵PID:1920
-
\??\c:\bbntht.exec:\bbntht.exe97⤵PID:2772
-
\??\c:\pjdpd.exec:\pjdpd.exe98⤵PID:1752
-
\??\c:\5jpdd.exec:\5jpdd.exe99⤵PID:1100
-
\??\c:\3lflrxr.exec:\3lflrxr.exe100⤵PID:2808
-
\??\c:\ffrfrll.exec:\ffrfrll.exe101⤵PID:2816
-
\??\c:\hbtbbn.exec:\hbtbbn.exe102⤵PID:2792
-
\??\c:\hnntnt.exec:\hnntnt.exe103⤵PID:960
-
\??\c:\9jdvd.exec:\9jdvd.exe104⤵PID:1704
-
\??\c:\rlxlffx.exec:\rlxlffx.exe105⤵PID:1108
-
\??\c:\5rllflr.exec:\5rllflr.exe106⤵PID:2412
-
\??\c:\nhtbnt.exec:\nhtbnt.exe107⤵PID:2164
-
\??\c:\3dpvj.exec:\3dpvj.exe108⤵PID:624
-
\??\c:\3jdpv.exec:\3jdpv.exe109⤵PID:876
-
\??\c:\rlxfxfr.exec:\rlxfxfr.exe110⤵PID:2428
-
\??\c:\fxfxlxf.exec:\fxfxlxf.exe111⤵PID:1628
-
\??\c:\3tnbht.exec:\3tnbht.exe112⤵PID:112
-
\??\c:\tntbhn.exec:\tntbhn.exe113⤵PID:2852
-
\??\c:\ppjvj.exec:\ppjvj.exe114⤵PID:1708
-
\??\c:\9xlrfxl.exec:\9xlrfxl.exe115⤵PID:300
-
\??\c:\fxrlxlx.exec:\fxrlxlx.exe116⤵PID:1968
-
\??\c:\nhhnhn.exec:\nhhnhn.exe117⤵PID:2996
-
\??\c:\5nnttb.exec:\5nnttb.exe118⤵PID:2124
-
\??\c:\7jppp.exec:\7jppp.exe119⤵PID:2540
-
\??\c:\xxfllrr.exec:\xxfllrr.exe120⤵PID:1544
-
\??\c:\hbbhtt.exec:\hbbhtt.exe121⤵PID:1640
-
\??\c:\hnnhtb.exec:\hnnhtb.exe122⤵PID:1540
-
\??\c:\1pjvj.exec:\1pjvj.exe123⤵PID:2324
-
\??\c:\ddjjp.exec:\ddjjp.exe124⤵PID:2580
-
\??\c:\llxlfxr.exec:\llxlfxr.exe125⤵PID:2600
-
\??\c:\hbbnhn.exec:\hbbnhn.exe126⤵PID:2820
-
\??\c:\ttnbhn.exec:\ttnbhn.exe127⤵PID:2620
-
\??\c:\1jjvj.exec:\1jjvj.exe128⤵PID:2476
-
\??\c:\3vjpd.exec:\3vjpd.exe129⤵PID:2456
-
\??\c:\ffxfrrl.exec:\ffxfrrl.exe130⤵PID:2344
-
\??\c:\xxlrffl.exec:\xxlrffl.exe131⤵PID:1260
-
\??\c:\nnhnbh.exec:\nnhnbh.exe132⤵PID:2556
-
\??\c:\jdpdd.exec:\jdpdd.exe133⤵PID:1328
-
\??\c:\vjvjj.exec:\vjvjj.exe134⤵PID:1636
-
\??\c:\rlrlffx.exec:\rlrlffx.exe135⤵PID:2728
-
\??\c:\3tbtnn.exec:\3tbtnn.exe136⤵PID:2652
-
\??\c:\tnbbht.exec:\tnbbht.exe137⤵PID:2360
-
\??\c:\dvvdp.exec:\dvvdp.exe138⤵PID:2348
-
\??\c:\dvpvv.exec:\dvpvv.exe139⤵PID:1920
-
\??\c:\fxrrffl.exec:\fxrrffl.exe140⤵PID:2020
-
\??\c:\bhbtbb.exec:\bhbtbb.exe141⤵PID:1752
-
\??\c:\nhbtht.exec:\nhbtht.exe142⤵PID:2800
-
\??\c:\1vpjv.exec:\1vpjv.exe143⤵PID:2808
-
\??\c:\rrrrflx.exec:\rrrrflx.exe144⤵PID:2816
-
\??\c:\fxrxlxl.exec:\fxrxlxl.exe145⤵PID:2792
-
\??\c:\ntnbbb.exec:\ntnbbb.exe146⤵PID:960
-
\??\c:\bthnhn.exec:\bthnhn.exe147⤵PID:1704
-
\??\c:\vvpdp.exec:\vvpdp.exe148⤵PID:1108
-
\??\c:\xxxxlfr.exec:\xxxxlfr.exe149⤵PID:376
-
\??\c:\frfflff.exec:\frfflff.exe150⤵PID:2164
-
\??\c:\jjjpd.exec:\jjjpd.exe151⤵PID:624
-
\??\c:\jjdjv.exec:\jjdjv.exe152⤵PID:876
-
\??\c:\7xlrffr.exec:\7xlrffr.exe153⤵PID:108
-
\??\c:\xxlrxxl.exec:\xxlrxxl.exe154⤵PID:1628
-
\??\c:\tnnbht.exec:\tnnbht.exe155⤵PID:112
-
\??\c:\jpddd.exec:\jpddd.exe156⤵PID:2852
-
\??\c:\jdpjp.exec:\jdpjp.exe157⤵PID:1680
-
\??\c:\lfrfrfl.exec:\lfrfrfl.exe158⤵PID:884
-
\??\c:\fxxrfff.exec:\fxxrfff.exe159⤵PID:1968
-
\??\c:\hhhbbn.exec:\hhhbbn.exe160⤵PID:2884
-
\??\c:\vpjjv.exec:\vpjjv.exe161⤵PID:1904
-
\??\c:\vjvdp.exec:\vjvdp.exe162⤵PID:1512
-
\??\c:\rlxxxrx.exec:\rlxxxrx.exe163⤵PID:2604
-
\??\c:\tttbbb.exec:\tttbbb.exe164⤵PID:2712
-
\??\c:\nnhtbh.exec:\nnhtbh.exe165⤵PID:2844
-
\??\c:\jjjvd.exec:\jjjvd.exe166⤵PID:2660
-
\??\c:\7dpdj.exec:\7dpdj.exe167⤵PID:2464
-
\??\c:\ffxfrxr.exec:\ffxfrxr.exe168⤵PID:2492
-
\??\c:\rlfrrfl.exec:\rlfrrfl.exe169⤵PID:2520
-
\??\c:\hnhthn.exec:\hnhthn.exe170⤵PID:2004
-
\??\c:\hbntht.exec:\hbntht.exe171⤵PID:2924
-
\??\c:\7vvvj.exec:\7vvvj.exe172⤵PID:1376
-
\??\c:\jvvjd.exec:\jvvjd.exe173⤵PID:848
-
\??\c:\llxlrfl.exec:\llxlrfl.exe174⤵PID:1252
-
\??\c:\5ttnbt.exec:\5ttnbt.exe175⤵PID:1728
-
\??\c:\7hbhtt.exec:\7hbhtt.exe176⤵PID:2796
-
\??\c:\vjjpj.exec:\vjjpj.exe177⤵PID:2368
-
\??\c:\lrrrlfr.exec:\lrrrlfr.exe178⤵PID:1520
-
\??\c:\rllfllf.exec:\rllfllf.exe179⤵PID:236
-
\??\c:\ttthbh.exec:\ttthbh.exe180⤵PID:2360
-
\??\c:\tnhtbb.exec:\tnhtbb.exe181⤵PID:1880
-
\??\c:\7dpvv.exec:\7dpvv.exe182⤵PID:2032
-
\??\c:\vpjdv.exec:\vpjdv.exe183⤵PID:2768
-
\??\c:\xxrxlrf.exec:\xxrxlrf.exe184⤵PID:2276
-
\??\c:\ttthtn.exec:\ttthtn.exe185⤵PID:604
-
\??\c:\nbnnth.exec:\nbnnth.exe186⤵PID:1844
-
\??\c:\pjjjv.exec:\pjjjv.exe187⤵PID:2816
-
\??\c:\1pjpd.exec:\1pjpd.exe188⤵PID:2312
-
\??\c:\rlflxlr.exec:\rlflxlr.exe189⤵PID:2196
-
\??\c:\1rxlflx.exec:\1rxlflx.exe190⤵PID:3044
-
\??\c:\btnhtn.exec:\btnhtn.exe191⤵PID:828
-
\??\c:\ntnbbn.exec:\ntnbbn.exe192⤵PID:1496
-
\??\c:\dpppd.exec:\dpppd.exe193⤵PID:1888
-
\??\c:\dvjvp.exec:\dvjvp.exe194⤵PID:568
-
\??\c:\rrlxfrl.exec:\rrlxfrl.exe195⤵PID:2296
-
\??\c:\rrrxlxr.exec:\rrrxlxr.exe196⤵PID:2064
-
\??\c:\bbbhbh.exec:\bbbhbh.exe197⤵PID:1672
-
\??\c:\3vvvd.exec:\3vvvd.exe198⤵PID:2200
-
\??\c:\jdpvv.exec:\jdpvv.exe199⤵PID:2256
-
\??\c:\lflrxxf.exec:\lflrxxf.exe200⤵PID:300
-
\??\c:\rlflrrx.exec:\rlflrrx.exe201⤵PID:2140
-
\??\c:\nnnthn.exec:\nnnthn.exe202⤵PID:1924
-
\??\c:\5tntbh.exec:\5tntbh.exe203⤵PID:2984
-
\??\c:\1jdvv.exec:\1jdvv.exe204⤵PID:2996
-
\??\c:\dvpjp.exec:\dvpjp.exe205⤵PID:1904
-
\??\c:\rlflrxl.exec:\rlflrxl.exe206⤵PID:1512
-
\??\c:\xrxlflf.exec:\xrxlflf.exe207⤵PID:2604
-
\??\c:\btnnbb.exec:\btnnbb.exe208⤵PID:2720
-
\??\c:\hbnbhn.exec:\hbnbhn.exe209⤵PID:2844
-
\??\c:\dpddj.exec:\dpddj.exe210⤵PID:2616
-
\??\c:\fxxlflf.exec:\fxxlflf.exe211⤵PID:2480
-
\??\c:\rrllxfr.exec:\rrllxfr.exe212⤵PID:2468
-
\??\c:\3htbtb.exec:\3htbtb.exe213⤵PID:2920
-
\??\c:\htbhtt.exec:\htbhtt.exe214⤵PID:2176
-
\??\c:\ppdpp.exec:\ppdpp.exe215⤵PID:3004
-
\??\c:\xxlfrxr.exec:\xxlfrxr.exe216⤵PID:1568
-
\??\c:\lfxxxxl.exec:\lfxxxxl.exe217⤵PID:848
-
\??\c:\9hnttt.exec:\9hnttt.exe218⤵PID:2680
-
\??\c:\7tntht.exec:\7tntht.exe219⤵PID:1728
-
\??\c:\5vpjv.exec:\5vpjv.exe220⤵PID:2796
-
\??\c:\ffxfrlf.exec:\ffxfrlf.exe221⤵PID:2368
-
\??\c:\xrlrlfx.exec:\xrlrlfx.exe222⤵PID:352
-
\??\c:\7htthn.exec:\7htthn.exe223⤵PID:1584
-
\??\c:\hbnbnh.exec:\hbnbnh.exe224⤵PID:1772
-
\??\c:\dvpvj.exec:\dvpvj.exe225⤵PID:1464
-
\??\c:\pjvvj.exec:\pjvvj.exe226⤵PID:2900
-
\??\c:\xxlfrxx.exec:\xxlfrxx.exe227⤵PID:2768
-
\??\c:\hnhhnh.exec:\hnhhnh.exe228⤵PID:2224
-
\??\c:\hnnntn.exec:\hnnntn.exe229⤵PID:2216
-
\??\c:\vvvjj.exec:\vvvjj.exe230⤵PID:1412
-
\??\c:\xlfrrxr.exec:\xlfrrxr.exe231⤵PID:2816
-
\??\c:\flfrfrf.exec:\flfrfrf.exe232⤵PID:2312
-
\??\c:\tthhnt.exec:\tthhnt.exe233⤵PID:3020
-
\??\c:\bbtnbh.exec:\bbtnbh.exe234⤵PID:2180
-
\??\c:\ppjpd.exec:\ppjpd.exe235⤵PID:828
-
\??\c:\dvpvd.exec:\dvpvd.exe236⤵PID:1228
-
\??\c:\rlfllxl.exec:\rlfllxl.exe237⤵PID:2440
-
\??\c:\5hbntt.exec:\5hbntt.exe238⤵PID:580
-
\??\c:\bthbtb.exec:\bthbtb.exe239⤵PID:2296
-
\??\c:\ddvdp.exec:\ddvdp.exe240⤵PID:2064
-
\??\c:\jdvpv.exec:\jdvpv.exe241⤵PID:2316
-
\??\c:\rllxflx.exec:\rllxflx.exe242⤵PID:2200