Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 17:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
194b2a684f3f440fcb70ebb8db52ca40_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
194b2a684f3f440fcb70ebb8db52ca40_NeikiAnalytics.exe
-
Size
244KB
-
MD5
194b2a684f3f440fcb70ebb8db52ca40
-
SHA1
09b152d2400d251b64e87b468e4d4bcfe7412a54
-
SHA256
bd9dc7b03ffe1e75895f5e7c8d345a9834f3daa8a87f5d0043b7cd0008afa03b
-
SHA512
8343b3c0285fb49467dccc2dc43e0fce13a1b0f3453cb6b295f736761634354e285fe32d7f624c178448754643fd055a09600fae5bad5918300ab40ce2cbee15
-
SSDEEP
6144:n3C9BRo/AIX27NHWpU00VIxas1oa3YiFR2:n3C9uD6AUDCa4NYmR2
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral1/memory/2028-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2980-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/360-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2308-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1624-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1844-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2076-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1148-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/352-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1540-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1688-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
nhnbnt.exe5dpdp.exellfrlxl.exerlffrrf.exenhntbh.exe7pvdj.exefxlflrl.exe1pddp.exedvjvj.exexrxxllr.exe7tntbb.exejdppd.exelfrxflx.exe5nhntb.exebhntbb.exe1pdjp.exefxllxlx.exerlxflrf.exentnhnh.exe5jpvv.exeddvdp.exe9rlrfll.exe7vppp.exellflxxl.exerlrlrrx.exethnttt.exe7djvd.exe9xflxxx.exe5tbhnh.exepdjjv.exedpjdp.exe9rxrrrr.exebtbbtt.exevpdvv.exedpvvd.exexxxlrxr.exerlxflll.exehbtbtb.exehttnnn.exejdvvj.exepjpdj.exefrxrffl.exenbnnnn.exe7vjjj.exe5vdvj.exerrlrflr.exenhbhbb.exebntntn.exedjjdj.exepdjdp.exerflfxfl.exe1bnthn.exebbtbht.exe7dpjj.exejdppv.exerrlxlrx.exe5fxfxfl.exennnhbh.exe5ntbhn.exejdvjv.exevvjjj.exe5xlrflx.exefxxfxxl.exetbthth.exepid process 2860 nhnbnt.exe 2016 5dpdp.exe 2652 llfrlxl.exe 2712 rlffrrf.exe 2684 nhntbh.exe 2428 7pvdj.exe 2460 fxlflrl.exe 2980 1pddp.exe 360 dvjvj.exe 2356 xrxxllr.exe 2308 7tntbb.exe 2180 jdppd.exe 1588 lfrxflx.exe 1624 5nhntb.exe 1732 bhntbb.exe 2176 1pdjp.exe 1552 fxllxlx.exe 1952 rlxflrf.exe 1844 ntnhnh.exe 2560 5jpvv.exe 2076 ddvdp.exe 1148 9rlrfll.exe 352 7vppp.exe 2220 llflxxl.exe 2764 rlrlrrx.exe 1540 thnttt.exe 1688 7djvd.exe 3032 9xflxxx.exe 2940 5tbhnh.exe 984 pdjjv.exe 2928 dpjdp.exe 1000 9rxrrrr.exe 2028 btbbtt.exe 3060 vpdvv.exe 2900 dpvvd.exe 1528 xxxlrxr.exe 2512 rlxflll.exe 2880 hbtbtb.exe 2516 httnnn.exe 1268 jdvvj.exe 2624 pjpdj.exe 2612 frxrffl.exe 2448 nbnnnn.exe 1608 7vjjj.exe 1712 5vdvj.exe 1740 rrlrflr.exe 2632 nhbhbb.exe 764 bntntn.exe 2188 djjdj.exe 1636 pdjdp.exe 1748 rflfxfl.exe 768 1bnthn.exe 1864 bbtbht.exe 2172 7dpjj.exe 1508 jdppv.exe 1968 rrlxlrx.exe 2120 5fxfxfl.exe 1084 nnnhbh.exe 1928 5ntbhn.exe 324 jdvjv.exe 296 vvjjj.exe 1148 5xlrflx.exe 564 fxxfxxl.exe 1684 tbthth.exe -
Processes:
resource yara_rule behavioral1/memory/2028-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/360-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2308-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1624-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1844-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2076-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1148-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/352-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1540-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1688-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-298-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
194b2a684f3f440fcb70ebb8db52ca40_NeikiAnalytics.exenhnbnt.exe5dpdp.exellfrlxl.exerlffrrf.exenhntbh.exe7pvdj.exefxlflrl.exe1pddp.exedvjvj.exexrxxllr.exe7tntbb.exejdppd.exelfrxflx.exe5nhntb.exebhntbb.exedescription pid process target process PID 2028 wrote to memory of 2860 2028 194b2a684f3f440fcb70ebb8db52ca40_NeikiAnalytics.exe nhnbnt.exe PID 2028 wrote to memory of 2860 2028 194b2a684f3f440fcb70ebb8db52ca40_NeikiAnalytics.exe nhnbnt.exe PID 2028 wrote to memory of 2860 2028 194b2a684f3f440fcb70ebb8db52ca40_NeikiAnalytics.exe nhnbnt.exe PID 2028 wrote to memory of 2860 2028 194b2a684f3f440fcb70ebb8db52ca40_NeikiAnalytics.exe nhnbnt.exe PID 2860 wrote to memory of 2016 2860 nhnbnt.exe 5dpdp.exe PID 2860 wrote to memory of 2016 2860 nhnbnt.exe 5dpdp.exe PID 2860 wrote to memory of 2016 2860 nhnbnt.exe 5dpdp.exe PID 2860 wrote to memory of 2016 2860 nhnbnt.exe 5dpdp.exe PID 2016 wrote to memory of 2652 2016 5dpdp.exe llfrlxl.exe PID 2016 wrote to memory of 2652 2016 5dpdp.exe llfrlxl.exe PID 2016 wrote to memory of 2652 2016 5dpdp.exe llfrlxl.exe PID 2016 wrote to memory of 2652 2016 5dpdp.exe llfrlxl.exe PID 2652 wrote to memory of 2712 2652 llfrlxl.exe rlffrrf.exe PID 2652 wrote to memory of 2712 2652 llfrlxl.exe rlffrrf.exe PID 2652 wrote to memory of 2712 2652 llfrlxl.exe rlffrrf.exe PID 2652 wrote to memory of 2712 2652 llfrlxl.exe rlffrrf.exe PID 2712 wrote to memory of 2684 2712 rlffrrf.exe nhntbh.exe PID 2712 wrote to memory of 2684 2712 rlffrrf.exe nhntbh.exe PID 2712 wrote to memory of 2684 2712 rlffrrf.exe nhntbh.exe PID 2712 wrote to memory of 2684 2712 rlffrrf.exe nhntbh.exe PID 2684 wrote to memory of 2428 2684 nhntbh.exe 7pvdj.exe PID 2684 wrote to memory of 2428 2684 nhntbh.exe 7pvdj.exe PID 2684 wrote to memory of 2428 2684 nhntbh.exe 7pvdj.exe PID 2684 wrote to memory of 2428 2684 nhntbh.exe 7pvdj.exe PID 2428 wrote to memory of 2460 2428 7pvdj.exe fxlflrl.exe PID 2428 wrote to memory of 2460 2428 7pvdj.exe fxlflrl.exe PID 2428 wrote to memory of 2460 2428 7pvdj.exe fxlflrl.exe PID 2428 wrote to memory of 2460 2428 7pvdj.exe fxlflrl.exe PID 2460 wrote to memory of 2980 2460 fxlflrl.exe 1pddp.exe PID 2460 wrote to memory of 2980 2460 fxlflrl.exe 1pddp.exe PID 2460 wrote to memory of 2980 2460 fxlflrl.exe 1pddp.exe PID 2460 wrote to memory of 2980 2460 fxlflrl.exe 1pddp.exe PID 2980 wrote to memory of 360 2980 1pddp.exe dvjvj.exe PID 2980 wrote to memory of 360 2980 1pddp.exe dvjvj.exe PID 2980 wrote to memory of 360 2980 1pddp.exe dvjvj.exe PID 2980 wrote to memory of 360 2980 1pddp.exe dvjvj.exe PID 360 wrote to memory of 2356 360 dvjvj.exe xrxxllr.exe PID 360 wrote to memory of 2356 360 dvjvj.exe xrxxllr.exe PID 360 wrote to memory of 2356 360 dvjvj.exe xrxxllr.exe PID 360 wrote to memory of 2356 360 dvjvj.exe xrxxllr.exe PID 2356 wrote to memory of 2308 2356 xrxxllr.exe 7tntbb.exe PID 2356 wrote to memory of 2308 2356 xrxxllr.exe 7tntbb.exe PID 2356 wrote to memory of 2308 2356 xrxxllr.exe 7tntbb.exe PID 2356 wrote to memory of 2308 2356 xrxxllr.exe 7tntbb.exe PID 2308 wrote to memory of 2180 2308 7tntbb.exe jdppd.exe PID 2308 wrote to memory of 2180 2308 7tntbb.exe jdppd.exe PID 2308 wrote to memory of 2180 2308 7tntbb.exe jdppd.exe PID 2308 wrote to memory of 2180 2308 7tntbb.exe jdppd.exe PID 2180 wrote to memory of 1588 2180 jdppd.exe lfrxflx.exe PID 2180 wrote to memory of 1588 2180 jdppd.exe lfrxflx.exe PID 2180 wrote to memory of 1588 2180 jdppd.exe lfrxflx.exe PID 2180 wrote to memory of 1588 2180 jdppd.exe lfrxflx.exe PID 1588 wrote to memory of 1624 1588 lfrxflx.exe 5nhntb.exe PID 1588 wrote to memory of 1624 1588 lfrxflx.exe 5nhntb.exe PID 1588 wrote to memory of 1624 1588 lfrxflx.exe 5nhntb.exe PID 1588 wrote to memory of 1624 1588 lfrxflx.exe 5nhntb.exe PID 1624 wrote to memory of 1732 1624 5nhntb.exe bhntbb.exe PID 1624 wrote to memory of 1732 1624 5nhntb.exe bhntbb.exe PID 1624 wrote to memory of 1732 1624 5nhntb.exe bhntbb.exe PID 1624 wrote to memory of 1732 1624 5nhntb.exe bhntbb.exe PID 1732 wrote to memory of 2176 1732 bhntbb.exe 1pdjp.exe PID 1732 wrote to memory of 2176 1732 bhntbb.exe 1pdjp.exe PID 1732 wrote to memory of 2176 1732 bhntbb.exe 1pdjp.exe PID 1732 wrote to memory of 2176 1732 bhntbb.exe 1pdjp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\194b2a684f3f440fcb70ebb8db52ca40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\194b2a684f3f440fcb70ebb8db52ca40_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\nhnbnt.exec:\nhnbnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\5dpdp.exec:\5dpdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\llfrlxl.exec:\llfrlxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\rlffrrf.exec:\rlffrrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\nhntbh.exec:\nhntbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\7pvdj.exec:\7pvdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\fxlflrl.exec:\fxlflrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\1pddp.exec:\1pddp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\dvjvj.exec:\dvjvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:360 -
\??\c:\xrxxllr.exec:\xrxxllr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\7tntbb.exec:\7tntbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\jdppd.exec:\jdppd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\lfrxflx.exec:\lfrxflx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\5nhntb.exec:\5nhntb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\bhntbb.exec:\bhntbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\1pdjp.exec:\1pdjp.exe17⤵
- Executes dropped EXE
PID:2176 -
\??\c:\fxllxlx.exec:\fxllxlx.exe18⤵
- Executes dropped EXE
PID:1552 -
\??\c:\rlxflrf.exec:\rlxflrf.exe19⤵
- Executes dropped EXE
PID:1952 -
\??\c:\ntnhnh.exec:\ntnhnh.exe20⤵
- Executes dropped EXE
PID:1844 -
\??\c:\5jpvv.exec:\5jpvv.exe21⤵
- Executes dropped EXE
PID:2560 -
\??\c:\ddvdp.exec:\ddvdp.exe22⤵
- Executes dropped EXE
PID:2076 -
\??\c:\9rlrfll.exec:\9rlrfll.exe23⤵
- Executes dropped EXE
PID:1148 -
\??\c:\7vppp.exec:\7vppp.exe24⤵
- Executes dropped EXE
PID:352 -
\??\c:\llflxxl.exec:\llflxxl.exe25⤵
- Executes dropped EXE
PID:2220 -
\??\c:\rlrlrrx.exec:\rlrlrrx.exe26⤵
- Executes dropped EXE
PID:2764 -
\??\c:\thnttt.exec:\thnttt.exe27⤵
- Executes dropped EXE
PID:1540 -
\??\c:\7djvd.exec:\7djvd.exe28⤵
- Executes dropped EXE
PID:1688 -
\??\c:\9xflxxx.exec:\9xflxxx.exe29⤵
- Executes dropped EXE
PID:3032 -
\??\c:\5tbhnh.exec:\5tbhnh.exe30⤵
- Executes dropped EXE
PID:2940 -
\??\c:\pdjjv.exec:\pdjjv.exe31⤵
- Executes dropped EXE
PID:984 -
\??\c:\dpjdp.exec:\dpjdp.exe32⤵
- Executes dropped EXE
PID:2928 -
\??\c:\9rxrrrr.exec:\9rxrrrr.exe33⤵
- Executes dropped EXE
PID:1000 -
\??\c:\btbbtt.exec:\btbbtt.exe34⤵
- Executes dropped EXE
PID:2028 -
\??\c:\vpdvv.exec:\vpdvv.exe35⤵
- Executes dropped EXE
PID:3060 -
\??\c:\dpvvd.exec:\dpvvd.exe36⤵
- Executes dropped EXE
PID:2900 -
\??\c:\xxxlrxr.exec:\xxxlrxr.exe37⤵
- Executes dropped EXE
PID:1528 -
\??\c:\rlxflll.exec:\rlxflll.exe38⤵
- Executes dropped EXE
PID:2512 -
\??\c:\hbtbtb.exec:\hbtbtb.exe39⤵
- Executes dropped EXE
PID:2880 -
\??\c:\httnnn.exec:\httnnn.exe40⤵
- Executes dropped EXE
PID:2516 -
\??\c:\jdvvj.exec:\jdvvj.exe41⤵
- Executes dropped EXE
PID:1268 -
\??\c:\pjpdj.exec:\pjpdj.exe42⤵
- Executes dropped EXE
PID:2624 -
\??\c:\frxrffl.exec:\frxrffl.exe43⤵
- Executes dropped EXE
PID:2612 -
\??\c:\nbnnnn.exec:\nbnnnn.exe44⤵
- Executes dropped EXE
PID:2448 -
\??\c:\7vjjj.exec:\7vjjj.exe45⤵
- Executes dropped EXE
PID:1608 -
\??\c:\5vdvj.exec:\5vdvj.exe46⤵
- Executes dropped EXE
PID:1712 -
\??\c:\rrlrflr.exec:\rrlrflr.exe47⤵
- Executes dropped EXE
PID:1740 -
\??\c:\nhbhbb.exec:\nhbhbb.exe48⤵
- Executes dropped EXE
PID:2632 -
\??\c:\bntntn.exec:\bntntn.exe49⤵
- Executes dropped EXE
PID:764 -
\??\c:\djjdj.exec:\djjdj.exe50⤵
- Executes dropped EXE
PID:2188 -
\??\c:\pdjdp.exec:\pdjdp.exe51⤵
- Executes dropped EXE
PID:1636 -
\??\c:\rflfxfl.exec:\rflfxfl.exe52⤵
- Executes dropped EXE
PID:1748 -
\??\c:\1bnthn.exec:\1bnthn.exe53⤵
- Executes dropped EXE
PID:768 -
\??\c:\bbtbht.exec:\bbtbht.exe54⤵
- Executes dropped EXE
PID:1864 -
\??\c:\7dpjj.exec:\7dpjj.exe55⤵
- Executes dropped EXE
PID:2172 -
\??\c:\jdppv.exec:\jdppv.exe56⤵
- Executes dropped EXE
PID:1508 -
\??\c:\rrlxlrx.exec:\rrlxlrx.exe57⤵
- Executes dropped EXE
PID:1968 -
\??\c:\5fxfxfl.exec:\5fxfxfl.exe58⤵
- Executes dropped EXE
PID:2120 -
\??\c:\nnnhbh.exec:\nnnhbh.exe59⤵
- Executes dropped EXE
PID:1084 -
\??\c:\5ntbhn.exec:\5ntbhn.exe60⤵
- Executes dropped EXE
PID:1928 -
\??\c:\jdvjv.exec:\jdvjv.exe61⤵
- Executes dropped EXE
PID:324 -
\??\c:\vvjjj.exec:\vvjjj.exe62⤵
- Executes dropped EXE
PID:296 -
\??\c:\5xlrflx.exec:\5xlrflx.exe63⤵
- Executes dropped EXE
PID:1148 -
\??\c:\fxxfxxl.exec:\fxxfxxl.exe64⤵
- Executes dropped EXE
PID:564 -
\??\c:\tbthth.exec:\tbthth.exe65⤵
- Executes dropped EXE
PID:1684 -
\??\c:\dvjjv.exec:\dvjjv.exe66⤵PID:652
-
\??\c:\1vjpd.exec:\1vjpd.exe67⤵PID:1752
-
\??\c:\7xrxllx.exec:\7xrxllx.exe68⤵PID:3036
-
\??\c:\fxflrxl.exec:\fxflrxl.exe69⤵PID:1680
-
\??\c:\tnhnbh.exec:\tnhnbh.exe70⤵PID:2340
-
\??\c:\bbthth.exec:\bbthth.exe71⤵PID:1556
-
\??\c:\vpvdp.exec:\vpvdp.exe72⤵PID:2932
-
\??\c:\ddvpj.exec:\ddvpj.exe73⤵PID:2984
-
\??\c:\lllxlrx.exec:\lllxlrx.exe74⤵PID:2740
-
\??\c:\nnntbn.exec:\nnntbn.exe75⤵PID:2468
-
\??\c:\7hhbhh.exec:\7hhbhh.exe76⤵PID:2968
-
\??\c:\vpvdp.exec:\vpvdp.exe77⤵PID:2524
-
\??\c:\pjjjv.exec:\pjjjv.exe78⤵PID:1524
-
\??\c:\3xrlrrx.exec:\3xrlrrx.exe79⤵PID:2584
-
\??\c:\lrfrffr.exec:\lrfrffr.exe80⤵PID:2492
-
\??\c:\7hhtbh.exec:\7hhtbh.exe81⤵PID:2660
-
\??\c:\1dvdj.exec:\1dvdj.exe82⤵PID:2656
-
\??\c:\jdvdp.exec:\jdvdp.exe83⤵PID:2412
-
\??\c:\fxrrlrf.exec:\fxrrlrf.exe84⤵PID:2164
-
\??\c:\9bhtbh.exec:\9bhtbh.exe85⤵PID:2624
-
\??\c:\nhtnbb.exec:\nhtnbb.exe86⤵PID:2792
-
\??\c:\jpdvv.exec:\jpdvv.exe87⤵PID:2448
-
\??\c:\dddvd.exec:\dddvd.exe88⤵PID:1716
-
\??\c:\ddpvd.exec:\ddpvd.exe89⤵PID:1504
-
\??\c:\llflrlx.exec:\llflrlx.exe90⤵PID:1576
-
\??\c:\ffflflf.exec:\ffflflf.exe91⤵PID:2484
-
\??\c:\nnhnbn.exec:\nnhnbn.exe92⤵PID:1592
-
\??\c:\btbhhh.exec:\btbhhh.exe93⤵PID:1224
-
\??\c:\pjpjp.exec:\pjpjp.exe94⤵PID:2300
-
\??\c:\3rxfllf.exec:\3rxfllf.exe95⤵PID:1820
-
\??\c:\xrflffr.exec:\xrflffr.exe96⤵PID:2184
-
\??\c:\hbnttn.exec:\hbnttn.exe97⤵PID:2176
-
\??\c:\7ntnnn.exec:\7ntnnn.exe98⤵PID:1720
-
\??\c:\dvjpp.exec:\dvjpp.exe99⤵PID:1552
-
\??\c:\vvppd.exec:\vvppd.exe100⤵PID:2236
-
\??\c:\rlfrlrl.exec:\rlfrlrl.exe101⤵PID:3024
-
\??\c:\frxxfff.exec:\frxxfff.exe102⤵PID:2676
-
\??\c:\nbbbhh.exec:\nbbbhh.exe103⤵PID:480
-
\??\c:\jdvjd.exec:\jdvjd.exe104⤵PID:1040
-
\??\c:\vvvvj.exec:\vvvvj.exe105⤵PID:2744
-
\??\c:\fxrxrrx.exec:\fxrxrrx.exe106⤵PID:1876
-
\??\c:\rlxlxlr.exec:\rlxlxlr.exe107⤵PID:2220
-
\??\c:\tttttb.exec:\tttttb.exe108⤵PID:696
-
\??\c:\nbhhhh.exec:\nbhhhh.exe109⤵PID:784
-
\??\c:\pjvdp.exec:\pjvdp.exe110⤵PID:664
-
\??\c:\3frffff.exec:\3frffff.exe111⤵PID:1688
-
\??\c:\rfxxlfl.exec:\rfxxlfl.exe112⤵PID:2952
-
\??\c:\tnhnbb.exec:\tnhnbb.exe113⤵PID:2000
-
\??\c:\5thntb.exec:\5thntb.exe114⤵PID:2260
-
\??\c:\jvjdd.exec:\jvjdd.exe115⤵PID:1776
-
\??\c:\vvjpv.exec:\vvjpv.exe116⤵PID:2984
-
\??\c:\9lrfxxf.exec:\9lrfxxf.exe117⤵PID:560
-
\??\c:\5xrflrx.exec:\5xrflrx.exe118⤵PID:1796
-
\??\c:\9thbhb.exec:\9thbhb.exe119⤵PID:1420
-
\??\c:\hbhhtb.exec:\hbhhtb.exe120⤵PID:1496
-
\??\c:\pjvpv.exec:\pjvpv.exe121⤵PID:2856
-
\??\c:\9lffflr.exec:\9lffflr.exe122⤵PID:2652
-
\??\c:\3lrxxxf.exec:\3lrxxxf.exe123⤵PID:2628
-
\??\c:\hbtbbb.exec:\hbtbbb.exe124⤵PID:2096
-
\??\c:\hbnhnh.exec:\hbnhnh.exe125⤵PID:2656
-
\??\c:\jddjv.exec:\jddjv.exe126⤵PID:2664
-
\??\c:\7vjjp.exec:\7vjjp.exe127⤵PID:2404
-
\??\c:\9fxflrx.exec:\9fxflrx.exe128⤵PID:2624
-
\??\c:\7fflrlx.exec:\7fflrlx.exe129⤵PID:2332
-
\??\c:\9htbbn.exec:\9htbbn.exe130⤵PID:1628
-
\??\c:\tnhntt.exec:\tnhntt.exe131⤵PID:1716
-
\??\c:\vjdpj.exec:\vjdpj.exe132⤵PID:908
-
\??\c:\3vvpv.exec:\3vvpv.exe133⤵PID:2568
-
\??\c:\xrxfrrf.exec:\xrxfrrf.exe134⤵PID:2192
-
\??\c:\rxfxxrf.exec:\rxfxxrf.exe135⤵PID:1012
-
\??\c:\nhhttb.exec:\nhhttb.exe136⤵PID:1840
-
\??\c:\btbtbh.exec:\btbtbh.exe137⤵PID:1624
-
\??\c:\3jdjp.exec:\3jdjp.exe138⤵PID:2196
-
\??\c:\djjdd.exec:\djjdd.exe139⤵PID:1316
-
\??\c:\lfllrxf.exec:\lfllrxf.exe140⤵PID:1448
-
\??\c:\hthnbt.exec:\hthnbt.exe141⤵PID:1720
-
\??\c:\hnbhhh.exec:\hnbhhh.exe142⤵PID:2248
-
\??\c:\1vpdp.exec:\1vpdp.exe143⤵PID:1844
-
\??\c:\jjvdd.exec:\jjvdd.exe144⤵PID:540
-
\??\c:\9frlllx.exec:\9frlllx.exe145⤵PID:780
-
\??\c:\lfrrflf.exec:\lfrrflf.exe146⤵PID:1416
-
\??\c:\tnhnbt.exec:\tnhnbt.exe147⤵PID:2728
-
\??\c:\tnthth.exec:\tnthth.exe148⤵PID:840
-
\??\c:\dvjjp.exec:\dvjjp.exe149⤵PID:2144
-
\??\c:\9dvdv.exec:\9dvdv.exe150⤵PID:1700
-
\??\c:\rlrxxxx.exec:\rlrxxxx.exe151⤵PID:696
-
\??\c:\xxfrlrx.exec:\xxfrlrx.exe152⤵PID:1664
-
\??\c:\5bhhhb.exec:\5bhhhb.exe153⤵PID:664
-
\??\c:\pjvvd.exec:\pjvvd.exe154⤵PID:1208
-
\??\c:\pjpjp.exec:\pjpjp.exe155⤵PID:1412
-
\??\c:\dvdpd.exec:\dvdpd.exe156⤵PID:3048
-
\??\c:\xrxxrxf.exec:\xrxxrxf.exe157⤵PID:572
-
\??\c:\llrlffx.exec:\llrlffx.exe158⤵PID:2696
-
\??\c:\3bnttn.exec:\3bnttn.exe159⤵PID:2032
-
\??\c:\vpddj.exec:\vpddj.exe160⤵PID:2860
-
\??\c:\jjvjv.exec:\jjvjv.exe161⤵PID:2524
-
\??\c:\rfrrxxx.exec:\rfrrxxx.exe162⤵PID:2488
-
\??\c:\3fllrll.exec:\3fllrll.exe163⤵PID:2536
-
\??\c:\thhhnn.exec:\thhhnn.exe164⤵PID:2636
-
\??\c:\pjjdp.exec:\pjjdp.exe165⤵PID:2880
-
\??\c:\vpjpj.exec:\vpjpj.exe166⤵PID:2572
-
\??\c:\1fxrxxr.exec:\1fxrxxr.exe167⤵PID:2640
-
\??\c:\7rlrxlx.exec:\7rlrxlx.exe168⤵PID:2428
-
\??\c:\thttbt.exec:\thttbt.exe169⤵PID:2664
-
\??\c:\tnbthn.exec:\tnbthn.exe170⤵PID:1772
-
\??\c:\jvvpj.exec:\jvvpj.exe171⤵PID:1608
-
\??\c:\dppvv.exec:\dppvv.exe172⤵PID:344
-
\??\c:\fxrxxxf.exec:\fxrxxxf.exe173⤵PID:2356
-
\??\c:\llxfllx.exec:\llxfllx.exe174⤵PID:2284
-
\??\c:\ttbhnt.exec:\ttbhnt.exe175⤵PID:808
-
\??\c:\nnbhtb.exec:\nnbhtb.exe176⤵PID:2188
-
\??\c:\jjdpd.exec:\jjdpd.exe177⤵PID:1588
-
\??\c:\ddjjp.exec:\ddjjp.exe178⤵PID:1012
-
\??\c:\fxrfrlr.exec:\fxrfrlr.exe179⤵PID:1888
-
\??\c:\rlxxllr.exec:\rlxxllr.exe180⤵PID:1832
-
\??\c:\9hbhhb.exec:\9hbhhb.exe181⤵PID:1604
-
\??\c:\vvpvj.exec:\vvpvj.exe182⤵PID:1508
-
\??\c:\frxxlrx.exec:\frxxlrx.exe183⤵PID:1968
-
\??\c:\fxlrfll.exec:\fxlrfll.exe184⤵PID:2904
-
\??\c:\nbhntt.exec:\nbhntt.exe185⤵PID:2152
-
\??\c:\1hhbbh.exec:\1hhbbh.exe186⤵PID:2560
-
\??\c:\5vjjp.exec:\5vjjp.exe187⤵PID:576
-
\??\c:\pjvdv.exec:\pjvdv.exe188⤵PID:1400
-
\??\c:\1rxrxrx.exec:\1rxrxrx.exe189⤵PID:868
-
\??\c:\lfxfrxf.exec:\lfxfrxf.exe190⤵PID:1872
-
\??\c:\httnhh.exec:\httnhh.exe191⤵PID:2820
-
\??\c:\9ppdv.exec:\9ppdv.exe192⤵PID:652
-
\??\c:\vvvdp.exec:\vvvdp.exe193⤵PID:1752
-
\??\c:\lxlxxfr.exec:\lxlxxfr.exe194⤵PID:1668
-
\??\c:\lflfffl.exec:\lflfffl.exe195⤵PID:2848
-
\??\c:\bthnhb.exec:\bthnhb.exe196⤵PID:3000
-
\??\c:\nnhbth.exec:\nnhbth.exe197⤵PID:2268
-
\??\c:\jjjvd.exec:\jjjvd.exe198⤵PID:2940
-
\??\c:\xrfxlxx.exec:\xrfxlxx.exe199⤵PID:900
-
\??\c:\fxlxrfr.exec:\fxlxrfr.exe200⤵PID:1780
-
\??\c:\bthhnn.exec:\bthhnn.exe201⤵PID:2468
-
\??\c:\9bnnhh.exec:\9bnnhh.exe202⤵PID:2068
-
\??\c:\dpvdj.exec:\dpvdj.exe203⤵PID:2528
-
\??\c:\jjjdv.exec:\jjjdv.exe204⤵PID:3060
-
\??\c:\lflrrxf.exec:\lflrrxf.exe205⤵PID:2900
-
\??\c:\lxfllff.exec:\lxfllff.exe206⤵PID:2536
-
\??\c:\nbnbbh.exec:\nbnbbh.exe207⤵PID:2636
-
\??\c:\3nhhnn.exec:\3nhhnn.exe208⤵PID:2808
-
\??\c:\vppdv.exec:\vppdv.exe209⤵PID:2412
-
\??\c:\xlrlfll.exec:\xlrlfll.exe210⤵PID:2640
-
\??\c:\frrffff.exec:\frrffff.exe211⤵PID:2428
-
\??\c:\9nbhtn.exec:\9nbhtn.exe212⤵PID:2664
-
\??\c:\1nnhhb.exec:\1nnhhb.exe213⤵PID:2232
-
\??\c:\dppjp.exec:\dppjp.exe214⤵PID:1656
-
\??\c:\vjvvd.exec:\vjvvd.exe215⤵PID:1712
-
\??\c:\1xlfrrf.exec:\1xlfrrf.exe216⤵PID:2356
-
\??\c:\lxrrlrr.exec:\lxrrlrr.exe217⤵PID:1564
-
\??\c:\htnthn.exec:\htnthn.exe218⤵PID:808
-
\??\c:\9vjpv.exec:\9vjpv.exe219⤵PID:1636
-
\??\c:\dvdjd.exec:\dvdjd.exe220⤵PID:1588
-
\??\c:\flxffff.exec:\flxffff.exe221⤵PID:1012
-
\??\c:\xrrfffl.exec:\xrrfffl.exe222⤵PID:1932
-
\??\c:\9ntbnb.exec:\9ntbnb.exe223⤵PID:1864
-
\??\c:\9bhntt.exec:\9bhntt.exe224⤵PID:2944
-
\??\c:\3vvdp.exec:\3vvdp.exe225⤵PID:1444
-
\??\c:\xxlrxfl.exec:\xxlrxfl.exe226⤵PID:628
-
\??\c:\lxxxffl.exec:\lxxxffl.exe227⤵PID:2904
-
\??\c:\thnhhb.exec:\thnhhb.exe228⤵PID:1928
-
\??\c:\bnbttt.exec:\bnbttt.exe229⤵PID:2008
-
\??\c:\9pjjp.exec:\9pjjp.exe230⤵PID:2104
-
\??\c:\1vjjj.exec:\1vjjj.exe231⤵PID:772
-
\??\c:\llflllx.exec:\llflllx.exe232⤵PID:1400
-
\??\c:\llxxlrf.exec:\llxxlrf.exe233⤵PID:868
-
\??\c:\1bhhhh.exec:\1bhhhh.exe234⤵PID:1872
-
\??\c:\9dpvd.exec:\9dpvd.exe235⤵PID:1884
-
\??\c:\jpppp.exec:\jpppp.exe236⤵PID:696
-
\??\c:\rxffxxx.exec:\rxffxxx.exe237⤵PID:1244
-
\??\c:\lflrrrx.exec:\lflrrrx.exe238⤵PID:1668
-
\??\c:\httbtb.exec:\httbtb.exe239⤵PID:2848
-
\??\c:\nbnthh.exec:\nbnthh.exe240⤵PID:3000
-
\??\c:\9jvvv.exec:\9jvvv.exe241⤵PID:2268
-
\??\c:\vpddd.exec:\vpddd.exe242⤵PID:2940