Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 20:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4d88a72974b14e91ddc32395ac2d1aa0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4d88a72974b14e91ddc32395ac2d1aa0_NeikiAnalytics.exe
-
Size
95KB
-
MD5
4d88a72974b14e91ddc32395ac2d1aa0
-
SHA1
20de311c0c078372f1e1dcc81e4f57f06a0385bc
-
SHA256
fa01885804d6bec09be3d4102951ef487b6fdfe83a1a166c0dc2bc6d2956ba0c
-
SHA512
d98bff9325391cf3369a5992a4e5805a8f91211fb396ac958a2cd46d4b649e2094256a07e9659662ca2817592ed0a7adb1b593403f3cee8a77bb94dd2cb1ecf0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qP1hvZo66Ox4oq2SQwfTQk:ymb3NkkiQ3mdBjFIj+qNhvZuHQY0k
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral1/memory/2608-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2488-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1768-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1944-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2236-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1284-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1048-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1636-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/480-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2328-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1548-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2344-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1892-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-78-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2572-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1144-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1144-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jddjd.exexfxfflr.exe3rrrflf.exeththhn.exepjvpv.exevvvpd.exexxrxrxr.exelrrlxxl.exehthttt.exehthntn.exedvjjv.exevdjpv.exeddvdv.exefxlrllf.exexxrrflr.exehhhtnn.exehhbnbh.exe9ddjv.exedvdjv.exelxrxflf.exerxlrlrl.exe1flrlrf.exehbnntb.exebtnbbn.exevdddd.exe3jdjd.exellxxlxr.exe5rlrxrx.exe3hhbtt.exetnbhhn.exejvdvd.exejddvj.exexfrxllx.exe3bthht.exebthhbh.exepjjvj.exejvdvp.exelffrfxx.exelxrrrfx.exehbhhhb.exebnnnht.exetthbbb.exeppvjv.exexrxxlrf.exefrfllxx.exebhtthh.exetbtbtb.exejdpjv.exejvpjv.exexlrlflx.exelfxfrlx.exentnhhh.exetttnnt.exevpdvp.exejpvpp.exedpdpv.exerflxfxf.exe9rfrxlr.exe5ffxlfr.exennbnnb.exebbntth.exennhnbh.exeddjvp.exevjvjp.exepid process 1144 jddjd.exe 2640 xfxfflr.exe 2608 3rrrflf.exe 2660 ththhn.exe 2876 pjvpv.exe 2488 vvvpd.exe 2572 xxrxrxr.exe 1892 lrrlxxl.exe 2960 hthttt.exe 2560 hthntn.exe 308 dvjjv.exe 2124 vdjpv.exe 2764 ddvdv.exe 2776 fxlrllf.exe 2816 xxrrflr.exe 2344 hhhtnn.exe 2996 hhbnbh.exe 1548 9ddjv.exe 2328 dvdjv.exe 1768 lxrxflf.exe 2404 rxlrlrl.exe 1944 1flrlrf.exe 480 hbnntb.exe 2136 btnbbn.exe 2236 vdddd.exe 1636 3jdjd.exe 1048 llxxlxr.exe 896 5rlrxrx.exe 816 3hhbtt.exe 2928 tnbhhn.exe 1284 jvdvd.exe 2204 jddvj.exe 1296 xfrxllx.exe 1632 3bthht.exe 2672 bthhbh.exe 1724 pjjvj.exe 2584 jvdvp.exe 2660 lffrfxx.exe 2576 lxrrrfx.exe 2588 hbhhhb.exe 2568 bnnnht.exe 2572 tthbbb.exe 2492 ppvjv.exe 2988 xrxxlrf.exe 2680 frfllxx.exe 2068 bhtthh.exe 2800 tbtbtb.exe 1980 jdpjv.exe 776 jvpjv.exe 2808 xlrlflx.exe 2748 lfxfrlx.exe 2528 ntnhhh.exe 1444 tttnnt.exe 2848 vpdvp.exe 2348 jpvpp.exe 2388 dpdpv.exe 1940 rflxfxf.exe 2324 9rfrxlr.exe 604 5ffxlfr.exe 452 nnbnnb.exe 572 bbntth.exe 2136 nnhnbh.exe 1764 ddjvp.exe 1096 vjvjp.exe -
Processes:
resource yara_rule behavioral1/memory/2608-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1768-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1944-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1284-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1048-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1636-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/480-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1548-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1892-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1144-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-4-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4d88a72974b14e91ddc32395ac2d1aa0_NeikiAnalytics.exejddjd.exexfxfflr.exe3rrrflf.exeththhn.exepjvpv.exevvvpd.exexxrxrxr.exelrrlxxl.exehthttt.exehthntn.exedvjjv.exevdjpv.exeddvdv.exefxlrllf.exexxrrflr.exedescription pid process target process PID 2300 wrote to memory of 1144 2300 4d88a72974b14e91ddc32395ac2d1aa0_NeikiAnalytics.exe pjdjj.exe PID 2300 wrote to memory of 1144 2300 4d88a72974b14e91ddc32395ac2d1aa0_NeikiAnalytics.exe pjdjj.exe PID 2300 wrote to memory of 1144 2300 4d88a72974b14e91ddc32395ac2d1aa0_NeikiAnalytics.exe pjdjj.exe PID 2300 wrote to memory of 1144 2300 4d88a72974b14e91ddc32395ac2d1aa0_NeikiAnalytics.exe pjdjj.exe PID 1144 wrote to memory of 2640 1144 jddjd.exe bbbbnn.exe PID 1144 wrote to memory of 2640 1144 jddjd.exe bbbbnn.exe PID 1144 wrote to memory of 2640 1144 jddjd.exe bbbbnn.exe PID 1144 wrote to memory of 2640 1144 jddjd.exe bbbbnn.exe PID 2640 wrote to memory of 2608 2640 xfxfflr.exe 3rrrflf.exe PID 2640 wrote to memory of 2608 2640 xfxfflr.exe 3rrrflf.exe PID 2640 wrote to memory of 2608 2640 xfxfflr.exe 3rrrflf.exe PID 2640 wrote to memory of 2608 2640 xfxfflr.exe 3rrrflf.exe PID 2608 wrote to memory of 2660 2608 3rrrflf.exe jjpdp.exe PID 2608 wrote to memory of 2660 2608 3rrrflf.exe jjpdp.exe PID 2608 wrote to memory of 2660 2608 3rrrflf.exe jjpdp.exe PID 2608 wrote to memory of 2660 2608 3rrrflf.exe jjpdp.exe PID 2660 wrote to memory of 2876 2660 ththhn.exe pjvpv.exe PID 2660 wrote to memory of 2876 2660 ththhn.exe pjvpv.exe PID 2660 wrote to memory of 2876 2660 ththhn.exe pjvpv.exe PID 2660 wrote to memory of 2876 2660 ththhn.exe pjvpv.exe PID 2876 wrote to memory of 2488 2876 pjvpv.exe vvjpv.exe PID 2876 wrote to memory of 2488 2876 pjvpv.exe vvjpv.exe PID 2876 wrote to memory of 2488 2876 pjvpv.exe vvjpv.exe PID 2876 wrote to memory of 2488 2876 pjvpv.exe vvjpv.exe PID 2488 wrote to memory of 2572 2488 vvvpd.exe xxrxrxr.exe PID 2488 wrote to memory of 2572 2488 vvvpd.exe xxrxrxr.exe PID 2488 wrote to memory of 2572 2488 vvvpd.exe xxrxrxr.exe PID 2488 wrote to memory of 2572 2488 vvvpd.exe xxrxrxr.exe PID 2572 wrote to memory of 1892 2572 xxrxrxr.exe lrrlxxl.exe PID 2572 wrote to memory of 1892 2572 xxrxrxr.exe lrrlxxl.exe PID 2572 wrote to memory of 1892 2572 xxrxrxr.exe lrrlxxl.exe PID 2572 wrote to memory of 1892 2572 xxrxrxr.exe lrrlxxl.exe PID 1892 wrote to memory of 2960 1892 lrrlxxl.exe dpdpd.exe PID 1892 wrote to memory of 2960 1892 lrrlxxl.exe dpdpd.exe PID 1892 wrote to memory of 2960 1892 lrrlxxl.exe dpdpd.exe PID 1892 wrote to memory of 2960 1892 lrrlxxl.exe dpdpd.exe PID 2960 wrote to memory of 2560 2960 hthttt.exe hthntn.exe PID 2960 wrote to memory of 2560 2960 hthttt.exe hthntn.exe PID 2960 wrote to memory of 2560 2960 hthttt.exe hthntn.exe PID 2960 wrote to memory of 2560 2960 hthttt.exe hthntn.exe PID 2560 wrote to memory of 308 2560 hthntn.exe tbtntn.exe PID 2560 wrote to memory of 308 2560 hthntn.exe tbtntn.exe PID 2560 wrote to memory of 308 2560 hthntn.exe tbtntn.exe PID 2560 wrote to memory of 308 2560 hthntn.exe tbtntn.exe PID 308 wrote to memory of 2124 308 dvjjv.exe jdjvd.exe PID 308 wrote to memory of 2124 308 dvjjv.exe jdjvd.exe PID 308 wrote to memory of 2124 308 dvjjv.exe jdjvd.exe PID 308 wrote to memory of 2124 308 dvjjv.exe jdjvd.exe PID 2124 wrote to memory of 2764 2124 vdjpv.exe vjvvd.exe PID 2124 wrote to memory of 2764 2124 vdjpv.exe vjvvd.exe PID 2124 wrote to memory of 2764 2124 vdjpv.exe vjvvd.exe PID 2124 wrote to memory of 2764 2124 vdjpv.exe vjvvd.exe PID 2764 wrote to memory of 2776 2764 ddvdv.exe fxlrllf.exe PID 2764 wrote to memory of 2776 2764 ddvdv.exe fxlrllf.exe PID 2764 wrote to memory of 2776 2764 ddvdv.exe fxlrllf.exe PID 2764 wrote to memory of 2776 2764 ddvdv.exe fxlrllf.exe PID 2776 wrote to memory of 2816 2776 fxlrllf.exe xxrrflr.exe PID 2776 wrote to memory of 2816 2776 fxlrllf.exe xxrrflr.exe PID 2776 wrote to memory of 2816 2776 fxlrllf.exe xxrrflr.exe PID 2776 wrote to memory of 2816 2776 fxlrllf.exe xxrrflr.exe PID 2816 wrote to memory of 2344 2816 xxrrflr.exe hhhtnn.exe PID 2816 wrote to memory of 2344 2816 xxrrflr.exe hhhtnn.exe PID 2816 wrote to memory of 2344 2816 xxrrflr.exe hhhtnn.exe PID 2816 wrote to memory of 2344 2816 xxrrflr.exe hhhtnn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d88a72974b14e91ddc32395ac2d1aa0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4d88a72974b14e91ddc32395ac2d1aa0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\jddjd.exec:\jddjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\xfxfflr.exec:\xfxfflr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\3rrrflf.exec:\3rrrflf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\ththhn.exec:\ththhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\pjvpv.exec:\pjvpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\vvvpd.exec:\vvvpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\xxrxrxr.exec:\xxrxrxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\lrrlxxl.exec:\lrrlxxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\hthttt.exec:\hthttt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\hthntn.exec:\hthntn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\dvjjv.exec:\dvjjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:308 -
\??\c:\vdjpv.exec:\vdjpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\ddvdv.exec:\ddvdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\fxlrllf.exec:\fxlrllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\xxrrflr.exec:\xxrrflr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\hhhtnn.exec:\hhhtnn.exe17⤵
- Executes dropped EXE
PID:2344 -
\??\c:\hhbnbh.exec:\hhbnbh.exe18⤵
- Executes dropped EXE
PID:2996 -
\??\c:\9ddjv.exec:\9ddjv.exe19⤵
- Executes dropped EXE
PID:1548 -
\??\c:\dvdjv.exec:\dvdjv.exe20⤵
- Executes dropped EXE
PID:2328 -
\??\c:\lxrxflf.exec:\lxrxflf.exe21⤵
- Executes dropped EXE
PID:1768 -
\??\c:\rxlrlrl.exec:\rxlrlrl.exe22⤵
- Executes dropped EXE
PID:2404 -
\??\c:\1flrlrf.exec:\1flrlrf.exe23⤵
- Executes dropped EXE
PID:1944 -
\??\c:\hbnntb.exec:\hbnntb.exe24⤵
- Executes dropped EXE
PID:480 -
\??\c:\btnbbn.exec:\btnbbn.exe25⤵
- Executes dropped EXE
PID:2136 -
\??\c:\vdddd.exec:\vdddd.exe26⤵
- Executes dropped EXE
PID:2236 -
\??\c:\3jdjd.exec:\3jdjd.exe27⤵
- Executes dropped EXE
PID:1636 -
\??\c:\llxxlxr.exec:\llxxlxr.exe28⤵
- Executes dropped EXE
PID:1048 -
\??\c:\5rlrxrx.exec:\5rlrxrx.exe29⤵
- Executes dropped EXE
PID:896 -
\??\c:\3hhbtt.exec:\3hhbtt.exe30⤵
- Executes dropped EXE
PID:816 -
\??\c:\tnbhhn.exec:\tnbhhn.exe31⤵
- Executes dropped EXE
PID:2928 -
\??\c:\jvdvd.exec:\jvdvd.exe32⤵
- Executes dropped EXE
PID:1284 -
\??\c:\jddvj.exec:\jddvj.exe33⤵
- Executes dropped EXE
PID:2204 -
\??\c:\xfrxllx.exec:\xfrxllx.exe34⤵
- Executes dropped EXE
PID:1296 -
\??\c:\3bthht.exec:\3bthht.exe35⤵
- Executes dropped EXE
PID:1632 -
\??\c:\bthhbh.exec:\bthhbh.exe36⤵
- Executes dropped EXE
PID:2672 -
\??\c:\pjjvj.exec:\pjjvj.exe37⤵
- Executes dropped EXE
PID:1724 -
\??\c:\jvdvp.exec:\jvdvp.exe38⤵
- Executes dropped EXE
PID:2584 -
\??\c:\lffrfxx.exec:\lffrfxx.exe39⤵
- Executes dropped EXE
PID:2660 -
\??\c:\lxrrrfx.exec:\lxrrrfx.exe40⤵
- Executes dropped EXE
PID:2576 -
\??\c:\hbhhhb.exec:\hbhhhb.exe41⤵
- Executes dropped EXE
PID:2588 -
\??\c:\bnnnht.exec:\bnnnht.exe42⤵
- Executes dropped EXE
PID:2568 -
\??\c:\tthbbb.exec:\tthbbb.exe43⤵
- Executes dropped EXE
PID:2572 -
\??\c:\ppvjv.exec:\ppvjv.exe44⤵
- Executes dropped EXE
PID:2492 -
\??\c:\xrxxlrf.exec:\xrxxlrf.exe45⤵
- Executes dropped EXE
PID:2988 -
\??\c:\frfllxx.exec:\frfllxx.exe46⤵
- Executes dropped EXE
PID:2680 -
\??\c:\bhtthh.exec:\bhtthh.exe47⤵
- Executes dropped EXE
PID:2068 -
\??\c:\tbtbtb.exec:\tbtbtb.exe48⤵
- Executes dropped EXE
PID:2800 -
\??\c:\jdpjv.exec:\jdpjv.exe49⤵
- Executes dropped EXE
PID:1980 -
\??\c:\jvpjv.exec:\jvpjv.exe50⤵
- Executes dropped EXE
PID:776 -
\??\c:\xlrlflx.exec:\xlrlflx.exe51⤵
- Executes dropped EXE
PID:2808 -
\??\c:\lfxfrlx.exec:\lfxfrlx.exe52⤵
- Executes dropped EXE
PID:2748 -
\??\c:\ntnhhh.exec:\ntnhhh.exe53⤵
- Executes dropped EXE
PID:2528 -
\??\c:\tttnnt.exec:\tttnnt.exe54⤵
- Executes dropped EXE
PID:1444 -
\??\c:\vpdvp.exec:\vpdvp.exe55⤵
- Executes dropped EXE
PID:2848 -
\??\c:\jpvpp.exec:\jpvpp.exe56⤵
- Executes dropped EXE
PID:2348 -
\??\c:\dpdpv.exec:\dpdpv.exe57⤵
- Executes dropped EXE
PID:2388 -
\??\c:\rflxfxf.exec:\rflxfxf.exe58⤵
- Executes dropped EXE
PID:1940 -
\??\c:\9rfrxlr.exec:\9rfrxlr.exe59⤵
- Executes dropped EXE
PID:2324 -
\??\c:\5ffxlfr.exec:\5ffxlfr.exe60⤵
- Executes dropped EXE
PID:604 -
\??\c:\nnbnnb.exec:\nnbnnb.exe61⤵
- Executes dropped EXE
PID:452 -
\??\c:\bbntth.exec:\bbntth.exe62⤵
- Executes dropped EXE
PID:572 -
\??\c:\nnhnbh.exec:\nnhnbh.exe63⤵
- Executes dropped EXE
PID:2136 -
\??\c:\ddjvp.exec:\ddjvp.exe64⤵
- Executes dropped EXE
PID:1764 -
\??\c:\vjvjp.exec:\vjvjp.exe65⤵
- Executes dropped EXE
PID:1096 -
\??\c:\7jdjd.exec:\7jdjd.exe66⤵PID:1032
-
\??\c:\rrxrlxx.exec:\rrxrlxx.exe67⤵PID:2908
-
\??\c:\fxrxfll.exec:\fxrxfll.exe68⤵PID:684
-
\??\c:\llfxrxl.exec:\llfxrxl.exe69⤵PID:596
-
\??\c:\nhbnhn.exec:\nhbnhn.exe70⤵PID:816
-
\??\c:\5hhhhh.exec:\5hhhhh.exe71⤵PID:1528
-
\??\c:\btnnhn.exec:\btnnhn.exe72⤵PID:2044
-
\??\c:\vpjjv.exec:\vpjjv.exe73⤵PID:1284
-
\??\c:\jjvpv.exec:\jjvpv.exe74⤵PID:2204
-
\??\c:\pdjpd.exec:\pdjpd.exe75⤵PID:2420
-
\??\c:\xrffrxf.exec:\xrffrxf.exe76⤵PID:2004
-
\??\c:\lffrxfr.exec:\lffrxfr.exe77⤵PID:2116
-
\??\c:\tthhnn.exec:\tthhnn.exe78⤵PID:2224
-
\??\c:\nthttn.exec:\nthttn.exe79⤵PID:2112
-
\??\c:\hnhhtn.exec:\hnhhtn.exe80⤵PID:2720
-
\??\c:\vvdjd.exec:\vvdjd.exe81⤵PID:2620
-
\??\c:\pppvp.exec:\pppvp.exe82⤵PID:2876
-
\??\c:\xrflxxx.exec:\xrflxxx.exe83⤵PID:2504
-
\??\c:\9rrlxlf.exec:\9rrlxlf.exe84⤵PID:2472
-
\??\c:\xxlllrl.exec:\xxlllrl.exe85⤵PID:2532
-
\??\c:\nnhbnt.exec:\nnhbnt.exe86⤵PID:1892
-
\??\c:\3ttbbb.exec:\3ttbbb.exe87⤵PID:1448
-
\??\c:\1bnnbt.exec:\1bnnbt.exe88⤵PID:1716
-
\??\c:\ppdjd.exec:\ppdjd.exe89⤵PID:2596
-
\??\c:\jdjvd.exec:\jdjvd.exe90⤵PID:2124
-
\??\c:\jdjpd.exec:\jdjpd.exe91⤵PID:2788
-
\??\c:\rlrxrfl.exec:\rlrxrfl.exe92⤵PID:1420
-
\??\c:\ffxxlrx.exec:\ffxxlrx.exe93⤵PID:2832
-
\??\c:\1rllrff.exec:\1rllrff.exe94⤵PID:2964
-
\??\c:\nnhnbh.exec:\nnhnbh.exe95⤵PID:2340
-
\??\c:\nbttnt.exec:\nbttnt.exe96⤵PID:1536
-
\??\c:\hbnthn.exec:\hbnthn.exe97⤵PID:1808
-
\??\c:\jdvvj.exec:\jdvvj.exe98⤵PID:2896
-
\??\c:\jjvdv.exec:\jjvdv.exe99⤵PID:1872
-
\??\c:\ffxlrlx.exec:\ffxlrlx.exe100⤵PID:1876
-
\??\c:\rfrlrxf.exec:\rfrlrxf.exe101⤵PID:2324
-
\??\c:\frlrfll.exec:\frlrfll.exe102⤵PID:584
-
\??\c:\tnttbb.exec:\tnttbb.exe103⤵PID:480
-
\??\c:\bbntbn.exec:\bbntbn.exe104⤵PID:2836
-
\??\c:\hhnnht.exec:\hhnnht.exe105⤵PID:2120
-
\??\c:\vvddd.exec:\vvddd.exe106⤵PID:1896
-
\??\c:\jjdpd.exec:\jjdpd.exe107⤵PID:2056
-
\??\c:\lffllxl.exec:\lffllxl.exe108⤵PID:1304
-
\??\c:\ffxfxfl.exec:\ffxfxfl.exe109⤵PID:2144
-
\??\c:\xrrrxxr.exec:\xrrrxxr.exe110⤵PID:588
-
\??\c:\bbtbbn.exec:\bbtbbn.exe111⤵PID:1040
-
\??\c:\bnhbnh.exec:\bnhbnh.exe112⤵PID:920
-
\??\c:\bbtbtb.exec:\bbtbtb.exe113⤵PID:1956
-
\??\c:\vjvdj.exec:\vjvdj.exe114⤵PID:2196
-
\??\c:\5vvdd.exec:\5vvdd.exe115⤵PID:2860
-
\??\c:\1frlrlr.exec:\1frlrlr.exe116⤵PID:2380
-
\??\c:\rxxfrxf.exec:\rxxfrxf.exe117⤵PID:568
-
\??\c:\fxlxflr.exec:\fxlxflr.exe118⤵PID:1620
-
\??\c:\nnhntb.exec:\nnhntb.exe119⤵PID:2304
-
\??\c:\tnhnhn.exec:\tnhnhn.exe120⤵PID:2544
-
\??\c:\9tntht.exec:\9tntht.exe121⤵PID:2584
-
\??\c:\3ddjp.exec:\3ddjp.exe122⤵PID:2500
-
\??\c:\1jdpv.exec:\1jdpv.exe123⤵PID:1960
-
\??\c:\7jddd.exec:\7jddd.exe124⤵PID:2508
-
\??\c:\3rflrlf.exec:\3rflrlf.exe125⤵PID:1900
-
\??\c:\ffrrflf.exec:\ffrrflf.exe126⤵PID:2256
-
\??\c:\9xlxllf.exec:\9xlxllf.exe127⤵PID:2960
-
\??\c:\7bbtbn.exec:\7bbtbn.exe128⤵PID:1968
-
\??\c:\9nhthn.exec:\9nhthn.exe129⤵PID:1344
-
\??\c:\1bnnbn.exec:\1bnnbn.exe130⤵PID:2068
-
\??\c:\pjppd.exec:\pjppd.exe131⤵PID:2448
-
\??\c:\pddpd.exec:\pddpd.exe132⤵PID:1980
-
\??\c:\pjjpp.exec:\pjjpp.exe133⤵PID:776
-
\??\c:\fxrrlrl.exec:\fxrrlrl.exe134⤵PID:1172
-
\??\c:\3frxlrf.exec:\3frxlrf.exe135⤵PID:2748
-
\??\c:\1fffrrf.exec:\1fffrrf.exe136⤵PID:2528
-
\??\c:\nttthn.exec:\nttthn.exe137⤵PID:880
-
\??\c:\bthhth.exec:\bthhth.exe138⤵PID:2848
-
\??\c:\hbntbn.exec:\hbntbn.exe139⤵PID:2348
-
\??\c:\ddjjp.exec:\ddjjp.exe140⤵PID:2824
-
\??\c:\jvdpj.exec:\jvdpj.exe141⤵PID:1940
-
\??\c:\3vvjd.exec:\3vvjd.exe142⤵PID:2952
-
\??\c:\xxrrxrf.exec:\xxrrxrf.exe143⤵PID:604
-
\??\c:\rlrxrxr.exec:\rlrxrxr.exe144⤵PID:452
-
\??\c:\hnttnh.exec:\hnttnh.exe145⤵PID:572
-
\??\c:\tnntht.exec:\tnntht.exe146⤵PID:2136
-
\??\c:\hhbnbn.exec:\hhbnbn.exe147⤵PID:1764
-
\??\c:\dvjvd.exec:\dvjvd.exe148⤵PID:1096
-
\??\c:\jdppv.exec:\jdppv.exe149⤵PID:1032
-
\??\c:\dvdpd.exec:\dvdpd.exe150⤵PID:2908
-
\??\c:\rllrlxr.exec:\rllrlxr.exe151⤵PID:684
-
\??\c:\ffflrxf.exec:\ffflrxf.exe152⤵PID:1248
-
\??\c:\tthbtb.exec:\tthbtb.exe153⤵PID:816
-
\??\c:\thtbnt.exec:\thtbnt.exe154⤵PID:1528
-
\??\c:\jpvvj.exec:\jpvvj.exe155⤵PID:2044
-
\??\c:\dvvpj.exec:\dvvpj.exe156⤵PID:1228
-
\??\c:\lfrllll.exec:\lfrllll.exe157⤵PID:2204
-
\??\c:\lfllrrr.exec:\lfllrrr.exe158⤵PID:2420
-
\??\c:\3bhhhh.exec:\3bhhhh.exe159⤵PID:2004
-
\??\c:\bththn.exec:\bththn.exe160⤵PID:2116
-
\??\c:\ddvjv.exec:\ddvjv.exe161⤵PID:2224
-
\??\c:\pjdpv.exec:\pjdpv.exe162⤵PID:2112
-
\??\c:\ffrrrfx.exec:\ffrrrfx.exe163⤵PID:2720
-
\??\c:\tthnhh.exec:\tthnhh.exe164⤵PID:2660
-
\??\c:\tnnbhh.exec:\tnnbhh.exe165⤵PID:2876
-
\??\c:\3jdjp.exec:\3jdjp.exe166⤵PID:2504
-
\??\c:\9jvdj.exec:\9jvdj.exe167⤵PID:2472
-
\??\c:\xrrlrfl.exec:\xrrlrfl.exe168⤵PID:2532
-
\??\c:\9xffllr.exec:\9xffllr.exe169⤵PID:1892
-
\??\c:\nhhhnn.exec:\nhhhnn.exe170⤵PID:1448
-
\??\c:\3nbbhh.exec:\3nbbhh.exe171⤵PID:1716
-
\??\c:\pdvdv.exec:\pdvdv.exe172⤵PID:2596
-
\??\c:\fxxrrfr.exec:\fxxrrfr.exe173⤵PID:2124
-
\??\c:\xxrlffr.exec:\xxrlffr.exe174⤵PID:2788
-
\??\c:\bbttnt.exec:\bbttnt.exe175⤵PID:1420
-
\??\c:\nnhtbb.exec:\nnhtbb.exe176⤵PID:2816
-
\??\c:\3nhbnn.exec:\3nhbnn.exe177⤵PID:2964
-
\??\c:\ppjvp.exec:\ppjvp.exe178⤵PID:2340
-
\??\c:\jdpvp.exec:\jdpvp.exe179⤵PID:1548
-
\??\c:\rxxlxlx.exec:\rxxlxlx.exe180⤵PID:1808
-
\??\c:\lrxflfx.exec:\lrxflfx.exe181⤵PID:2896
-
\??\c:\5xxrflr.exec:\5xxrflr.exe182⤵PID:1872
-
\??\c:\hbnbtt.exec:\hbnbtt.exe183⤵PID:1876
-
\??\c:\hthbbn.exec:\hthbbn.exe184⤵PID:2324
-
\??\c:\dvvjv.exec:\dvvjv.exe185⤵PID:584
-
\??\c:\pjjjj.exec:\pjjjj.exe186⤵PID:480
-
\??\c:\7dvvp.exec:\7dvvp.exe187⤵PID:2836
-
\??\c:\5rflrrf.exec:\5rflrrf.exe188⤵PID:2120
-
\??\c:\lllllrf.exec:\lllllrf.exe189⤵PID:1896
-
\??\c:\ffxlfxl.exec:\ffxlfxl.exe190⤵PID:2056
-
\??\c:\bbtnbh.exec:\bbtnbh.exe191⤵PID:1304
-
\??\c:\btnbhn.exec:\btnbhn.exe192⤵PID:2144
-
\??\c:\nnbthh.exec:\nnbthh.exe193⤵PID:924
-
\??\c:\1pdjj.exec:\1pdjj.exe194⤵PID:1040
-
\??\c:\vvppd.exec:\vvppd.exe195⤵PID:920
-
\??\c:\ddjpv.exec:\ddjpv.exe196⤵PID:1956
-
\??\c:\frxlrll.exec:\frxlrll.exe197⤵PID:1176
-
\??\c:\llxxflx.exec:\llxxflx.exe198⤵PID:2860
-
\??\c:\1hhnbt.exec:\1hhnbt.exe199⤵PID:2380
-
\??\c:\nhhnth.exec:\nhhnth.exe200⤵PID:568
-
\??\c:\nnthnb.exec:\nnthnb.exe201⤵PID:1620
-
\??\c:\pvjpv.exec:\pvjpv.exe202⤵PID:2304
-
\??\c:\ppjdp.exec:\ppjdp.exe203⤵PID:2544
-
\??\c:\9rlxlrx.exec:\9rlxlrx.exe204⤵PID:2584
-
\??\c:\llxrfrl.exec:\llxrfrl.exe205⤵PID:2500
-
\??\c:\lfrrffx.exec:\lfrrffx.exe206⤵PID:1960
-
\??\c:\9tnhbb.exec:\9tnhbb.exe207⤵PID:2508
-
\??\c:\btbnbt.exec:\btbnbt.exe208⤵PID:1900
-
\??\c:\hhtnhn.exec:\hhtnhn.exe209⤵PID:2984
-
\??\c:\dvjvp.exec:\dvjvp.exe210⤵PID:2960
-
\??\c:\dvjdv.exec:\dvjdv.exe211⤵PID:1968
-
\??\c:\fffrxrf.exec:\fffrxrf.exe212⤵PID:1344
-
\??\c:\rllxrxf.exec:\rllxrxf.exe213⤵PID:2680
-
\??\c:\xrlflfl.exec:\xrlflfl.exe214⤵PID:2448
-
\??\c:\btbthb.exec:\btbthb.exe215⤵PID:1980
-
\??\c:\btbthb.exec:\btbthb.exe216⤵PID:2520
-
\??\c:\ttbtnb.exec:\ttbtnb.exe217⤵PID:1700
-
\??\c:\pjpdj.exec:\pjpdj.exe218⤵PID:2804
-
\??\c:\vpjjd.exec:\vpjjd.exe219⤵PID:2636
-
\??\c:\pjjjd.exec:\pjjjd.exe220⤵PID:1784
-
\??\c:\rrlxxfr.exec:\rrlxxfr.exe221⤵PID:1536
-
\??\c:\lxrlrlr.exec:\lxrlrlr.exe222⤵PID:2904
-
\??\c:\nthbtn.exec:\nthbtn.exe223⤵PID:1808
-
\??\c:\httnhb.exec:\httnhb.exe224⤵PID:2824
-
\??\c:\dpvdp.exec:\dpvdp.exe225⤵PID:1872
-
\??\c:\vpddv.exec:\vpddv.exe226⤵PID:1520
-
\??\c:\xflffrr.exec:\xflffrr.exe227⤵PID:1732
-
\??\c:\3rlllxr.exec:\3rlllxr.exe228⤵PID:2000
-
\??\c:\bhnntb.exec:\bhnntb.exe229⤵PID:1748
-
\??\c:\thnntb.exec:\thnntb.exe230⤵PID:1252
-
\??\c:\7hbbhh.exec:\7hbbhh.exe231⤵PID:3028
-
\??\c:\dvjpd.exec:\dvjpd.exe232⤵PID:748
-
\??\c:\dvddv.exec:\dvddv.exe233⤵PID:2888
-
\??\c:\3fflfrf.exec:\3fflfrf.exe234⤵PID:1816
-
\??\c:\xflxrlf.exec:\xflxrlf.exe235⤵PID:2144
-
\??\c:\hnttbh.exec:\hnttbh.exe236⤵PID:2928
-
\??\c:\htthbn.exec:\htthbn.exe237⤵PID:2372
-
\??\c:\bnbthb.exec:\bnbthb.exe238⤵PID:1528
-
\??\c:\djdvd.exec:\djdvd.exe239⤵PID:1284
-
\??\c:\djjvp.exec:\djjvp.exe240⤵PID:1296
-
\??\c:\3xfxxlx.exec:\3xfxxlx.exe241⤵PID:2600
-
\??\c:\9rfrflx.exec:\9rfrflx.exe242⤵PID:1588