Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 02:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5461b932108bbf636aec0a1df98f1750_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
5461b932108bbf636aec0a1df98f1750_NeikiAnalytics.exe
-
Size
66KB
-
MD5
5461b932108bbf636aec0a1df98f1750
-
SHA1
29a7cad50fc731b4b21e8640f35ffe94bfe21ed5
-
SHA256
9c24e0e54b8d1ef996abc0ec41811f6502b1be4a2b2b9ed7dd23eadd898dc961
-
SHA512
30b776aa44207df2fe564740fcca944a0a684a907b7c239ee5d97be6646916059ae0e02f6b38742d8a7f512af4cfed1741d8a3ba21a9cc39743ad5396dcdaab2
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFdJUDbAIe:ymb3NkkiQ3mdBjFIFdJ8bW
Malware Config
Signatures
-
Detect Blackmoon payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/2084-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-66-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1344-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/356-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1612-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/664-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1992-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1460-305-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vpjjd.exerfrrxrx.exetnhnhh.exeppdpv.exelfffllr.exe3xrxxlr.exetnhntb.exevpppv.exepjjpp.exelflrlrf.exe5tthnt.exe5bntth.exejppvd.exexrrrfll.exefrlflrx.exehthhht.exeppvdp.exevjdvd.exexflrlfl.exefrxxffr.exe1hhhhb.exejjdjd.exedvpvd.exerlfllrx.exebntbtt.exehhbbht.exevjvpp.exevvvpv.exexlfffrr.exefrflrrx.exetnbhnt.exe9htbbh.exevvjpp.exe5dvpd.exefrllfxx.exe1rflrxf.exe3btnbt.exe9hbbnn.exepdvpp.exeppvvd.exejdddv.exelxlfxxl.exe1lxfffx.exe3ttbbb.exehtttnn.exepdjdv.exedvpjd.exe7xlfffl.exe5rlrxxl.exexrlrrrx.exe3bnnnn.exe1pjdj.exedvjjj.exe1fxrxxx.exexlxrrrx.exetnbbhn.exe9vvdj.exe9lllrrf.exefxfflfl.exebtnhhb.exe5htnbb.exedvpvd.exevjvdj.exe7xffxfl.exepid process 2992 vpjjd.exe 2996 rfrrxrx.exe 2684 tnhnhh.exe 2544 ppdpv.exe 2696 lfffllr.exe 2608 3xrxxlr.exe 2456 tnhntb.exe 2692 vpppv.exe 1344 pjjpp.exe 2716 lflrlrf.exe 2792 5tthnt.exe 2332 5bntth.exe 356 jppvd.exe 1776 xrrrfll.exe 1200 frlflrx.exe 2788 hthhht.exe 824 ppvdp.exe 2908 vjdvd.exe 2260 xflrlfl.exe 1612 frxxffr.exe 664 1hhhhb.exe 468 jjdjd.exe 1824 dvpvd.exe 1608 rlfllrx.exe 3040 bntbtt.exe 1016 hhbbht.exe 240 vjvpp.exe 2008 vvvpv.exe 1992 xlfffrr.exe 2024 frflrrx.exe 1460 tnbhnt.exe 2280 9htbbh.exe 1520 vvjpp.exe 2092 5dvpd.exe 3000 frllfxx.exe 2640 1rflrxf.exe 2536 3btnbt.exe 2820 9hbbnn.exe 2528 pdvpp.exe 2576 ppvvd.exe 2400 jdddv.exe 2532 lxlfxxl.exe 2124 1lxfffx.exe 1032 3ttbbb.exe 2660 htttnn.exe 1444 pdjdv.exe 2724 dvpjd.exe 1804 7xlfffl.exe 2156 5rlrxxl.exe 2300 xrlrrrx.exe 1584 3bnnnn.exe 2380 1pjdj.exe 1008 dvjjj.exe 616 1fxrxxx.exe 2936 xlxrrrx.exe 2892 tnbbhn.exe 2932 9vvdj.exe 1956 9lllrrf.exe 2184 fxfflfl.exe 948 btnhhb.exe 764 5htnbb.exe 556 dvpvd.exe 840 vjvdj.exe 2060 7xffxfl.exe -
Processes:
resource yara_rule behavioral1/memory/2084-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1344-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/356-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1612-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/664-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1992-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1460-305-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5461b932108bbf636aec0a1df98f1750_NeikiAnalytics.exevpjjd.exerfrrxrx.exetnhnhh.exeppdpv.exelfffllr.exe3xrxxlr.exetnhntb.exevpppv.exepjjpp.exelflrlrf.exe5tthnt.exe5bntth.exejppvd.exexrrrfll.exefrlflrx.exedescription pid process target process PID 2084 wrote to memory of 2992 2084 5461b932108bbf636aec0a1df98f1750_NeikiAnalytics.exe vpjjd.exe PID 2084 wrote to memory of 2992 2084 5461b932108bbf636aec0a1df98f1750_NeikiAnalytics.exe vpjjd.exe PID 2084 wrote to memory of 2992 2084 5461b932108bbf636aec0a1df98f1750_NeikiAnalytics.exe vpjjd.exe PID 2084 wrote to memory of 2992 2084 5461b932108bbf636aec0a1df98f1750_NeikiAnalytics.exe vpjjd.exe PID 2992 wrote to memory of 2996 2992 vpjjd.exe rfrrxrx.exe PID 2992 wrote to memory of 2996 2992 vpjjd.exe rfrrxrx.exe PID 2992 wrote to memory of 2996 2992 vpjjd.exe rfrrxrx.exe PID 2992 wrote to memory of 2996 2992 vpjjd.exe rfrrxrx.exe PID 2996 wrote to memory of 2684 2996 rfrrxrx.exe tnhnhh.exe PID 2996 wrote to memory of 2684 2996 rfrrxrx.exe tnhnhh.exe PID 2996 wrote to memory of 2684 2996 rfrrxrx.exe tnhnhh.exe PID 2996 wrote to memory of 2684 2996 rfrrxrx.exe tnhnhh.exe PID 2684 wrote to memory of 2544 2684 tnhnhh.exe ppdpv.exe PID 2684 wrote to memory of 2544 2684 tnhnhh.exe ppdpv.exe PID 2684 wrote to memory of 2544 2684 tnhnhh.exe ppdpv.exe PID 2684 wrote to memory of 2544 2684 tnhnhh.exe ppdpv.exe PID 2544 wrote to memory of 2696 2544 ppdpv.exe lfffllr.exe PID 2544 wrote to memory of 2696 2544 ppdpv.exe lfffllr.exe PID 2544 wrote to memory of 2696 2544 ppdpv.exe lfffllr.exe PID 2544 wrote to memory of 2696 2544 ppdpv.exe lfffllr.exe PID 2696 wrote to memory of 2608 2696 lfffllr.exe 3xrxxlr.exe PID 2696 wrote to memory of 2608 2696 lfffllr.exe 3xrxxlr.exe PID 2696 wrote to memory of 2608 2696 lfffllr.exe 3xrxxlr.exe PID 2696 wrote to memory of 2608 2696 lfffllr.exe 3xrxxlr.exe PID 2608 wrote to memory of 2456 2608 3xrxxlr.exe tnhntb.exe PID 2608 wrote to memory of 2456 2608 3xrxxlr.exe tnhntb.exe PID 2608 wrote to memory of 2456 2608 3xrxxlr.exe tnhntb.exe PID 2608 wrote to memory of 2456 2608 3xrxxlr.exe tnhntb.exe PID 2456 wrote to memory of 2692 2456 tnhntb.exe vpppv.exe PID 2456 wrote to memory of 2692 2456 tnhntb.exe vpppv.exe PID 2456 wrote to memory of 2692 2456 tnhntb.exe vpppv.exe PID 2456 wrote to memory of 2692 2456 tnhntb.exe vpppv.exe PID 2692 wrote to memory of 1344 2692 vpppv.exe pjjpp.exe PID 2692 wrote to memory of 1344 2692 vpppv.exe pjjpp.exe PID 2692 wrote to memory of 1344 2692 vpppv.exe pjjpp.exe PID 2692 wrote to memory of 1344 2692 vpppv.exe pjjpp.exe PID 1344 wrote to memory of 2716 1344 pjjpp.exe lflrlrf.exe PID 1344 wrote to memory of 2716 1344 pjjpp.exe lflrlrf.exe PID 1344 wrote to memory of 2716 1344 pjjpp.exe lflrlrf.exe PID 1344 wrote to memory of 2716 1344 pjjpp.exe lflrlrf.exe PID 2716 wrote to memory of 2792 2716 lflrlrf.exe 5tthnt.exe PID 2716 wrote to memory of 2792 2716 lflrlrf.exe 5tthnt.exe PID 2716 wrote to memory of 2792 2716 lflrlrf.exe 5tthnt.exe PID 2716 wrote to memory of 2792 2716 lflrlrf.exe 5tthnt.exe PID 2792 wrote to memory of 2332 2792 5tthnt.exe 5bntth.exe PID 2792 wrote to memory of 2332 2792 5tthnt.exe 5bntth.exe PID 2792 wrote to memory of 2332 2792 5tthnt.exe 5bntth.exe PID 2792 wrote to memory of 2332 2792 5tthnt.exe 5bntth.exe PID 2332 wrote to memory of 356 2332 5bntth.exe jppvd.exe PID 2332 wrote to memory of 356 2332 5bntth.exe jppvd.exe PID 2332 wrote to memory of 356 2332 5bntth.exe jppvd.exe PID 2332 wrote to memory of 356 2332 5bntth.exe jppvd.exe PID 356 wrote to memory of 1776 356 jppvd.exe xrrrfll.exe PID 356 wrote to memory of 1776 356 jppvd.exe xrrrfll.exe PID 356 wrote to memory of 1776 356 jppvd.exe xrrrfll.exe PID 356 wrote to memory of 1776 356 jppvd.exe xrrrfll.exe PID 1776 wrote to memory of 1200 1776 xrrrfll.exe frlflrx.exe PID 1776 wrote to memory of 1200 1776 xrrrfll.exe frlflrx.exe PID 1776 wrote to memory of 1200 1776 xrrrfll.exe frlflrx.exe PID 1776 wrote to memory of 1200 1776 xrrrfll.exe frlflrx.exe PID 1200 wrote to memory of 2788 1200 frlflrx.exe hthhht.exe PID 1200 wrote to memory of 2788 1200 frlflrx.exe hthhht.exe PID 1200 wrote to memory of 2788 1200 frlflrx.exe hthhht.exe PID 1200 wrote to memory of 2788 1200 frlflrx.exe hthhht.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5461b932108bbf636aec0a1df98f1750_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5461b932108bbf636aec0a1df98f1750_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\vpjjd.exec:\vpjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\rfrrxrx.exec:\rfrrxrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\tnhnhh.exec:\tnhnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\ppdpv.exec:\ppdpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\lfffllr.exec:\lfffllr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\3xrxxlr.exec:\3xrxxlr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\tnhntb.exec:\tnhntb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\vpppv.exec:\vpppv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\pjjpp.exec:\pjjpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\lflrlrf.exec:\lflrlrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\5tthnt.exec:\5tthnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\5bntth.exec:\5bntth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\jppvd.exec:\jppvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:356 -
\??\c:\xrrrfll.exec:\xrrrfll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\frlflrx.exec:\frlflrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\hthhht.exec:\hthhht.exe17⤵
- Executes dropped EXE
PID:2788 -
\??\c:\ppvdp.exec:\ppvdp.exe18⤵
- Executes dropped EXE
PID:824 -
\??\c:\vjdvd.exec:\vjdvd.exe19⤵
- Executes dropped EXE
PID:2908 -
\??\c:\xflrlfl.exec:\xflrlfl.exe20⤵
- Executes dropped EXE
PID:2260 -
\??\c:\frxxffr.exec:\frxxffr.exe21⤵
- Executes dropped EXE
PID:1612 -
\??\c:\1hhhhb.exec:\1hhhhb.exe22⤵
- Executes dropped EXE
PID:664 -
\??\c:\jjdjd.exec:\jjdjd.exe23⤵
- Executes dropped EXE
PID:468 -
\??\c:\dvpvd.exec:\dvpvd.exe24⤵
- Executes dropped EXE
PID:1824 -
\??\c:\rlfllrx.exec:\rlfllrx.exe25⤵
- Executes dropped EXE
PID:1608 -
\??\c:\bntbtt.exec:\bntbtt.exe26⤵
- Executes dropped EXE
PID:3040 -
\??\c:\hhbbht.exec:\hhbbht.exe27⤵
- Executes dropped EXE
PID:1016 -
\??\c:\vjvpp.exec:\vjvpp.exe28⤵
- Executes dropped EXE
PID:240 -
\??\c:\vvvpv.exec:\vvvpv.exe29⤵
- Executes dropped EXE
PID:2008 -
\??\c:\xlfffrr.exec:\xlfffrr.exe30⤵
- Executes dropped EXE
PID:1992 -
\??\c:\frflrrx.exec:\frflrrx.exe31⤵
- Executes dropped EXE
PID:2024 -
\??\c:\tnbhnt.exec:\tnbhnt.exe32⤵
- Executes dropped EXE
PID:1460 -
\??\c:\9htbbh.exec:\9htbbh.exe33⤵
- Executes dropped EXE
PID:2280 -
\??\c:\vvjpp.exec:\vvjpp.exe34⤵
- Executes dropped EXE
PID:1520 -
\??\c:\5dvpd.exec:\5dvpd.exe35⤵
- Executes dropped EXE
PID:2092 -
\??\c:\frllfxx.exec:\frllfxx.exe36⤵
- Executes dropped EXE
PID:3000 -
\??\c:\1rflrxf.exec:\1rflrxf.exe37⤵
- Executes dropped EXE
PID:2640 -
\??\c:\3btnbt.exec:\3btnbt.exe38⤵
- Executes dropped EXE
PID:2536 -
\??\c:\9hbbnn.exec:\9hbbnn.exe39⤵
- Executes dropped EXE
PID:2820 -
\??\c:\pdvpp.exec:\pdvpp.exe40⤵
- Executes dropped EXE
PID:2528 -
\??\c:\ppvvd.exec:\ppvvd.exe41⤵
- Executes dropped EXE
PID:2576 -
\??\c:\jdddv.exec:\jdddv.exe42⤵
- Executes dropped EXE
PID:2400 -
\??\c:\lxlfxxl.exec:\lxlfxxl.exe43⤵
- Executes dropped EXE
PID:2532 -
\??\c:\1lxfffx.exec:\1lxfffx.exe44⤵
- Executes dropped EXE
PID:2124 -
\??\c:\3ttbbb.exec:\3ttbbb.exe45⤵
- Executes dropped EXE
PID:1032 -
\??\c:\htttnn.exec:\htttnn.exe46⤵
- Executes dropped EXE
PID:2660 -
\??\c:\pdjdv.exec:\pdjdv.exe47⤵
- Executes dropped EXE
PID:1444 -
\??\c:\dvpjd.exec:\dvpjd.exe48⤵
- Executes dropped EXE
PID:2724 -
\??\c:\7xlfffl.exec:\7xlfffl.exe49⤵
- Executes dropped EXE
PID:1804 -
\??\c:\5rlrxxl.exec:\5rlrxxl.exe50⤵
- Executes dropped EXE
PID:2156 -
\??\c:\xrlrrrx.exec:\xrlrrrx.exe51⤵
- Executes dropped EXE
PID:2300 -
\??\c:\3bnnnn.exec:\3bnnnn.exe52⤵
- Executes dropped EXE
PID:1584 -
\??\c:\1pjdj.exec:\1pjdj.exe53⤵
- Executes dropped EXE
PID:2380 -
\??\c:\dvjjj.exec:\dvjjj.exe54⤵
- Executes dropped EXE
PID:1008 -
\??\c:\1fxrxxx.exec:\1fxrxxx.exe55⤵
- Executes dropped EXE
PID:616 -
\??\c:\xlxrrrx.exec:\xlxrrrx.exe56⤵
- Executes dropped EXE
PID:2936 -
\??\c:\tnbbhn.exec:\tnbbhn.exe57⤵
- Executes dropped EXE
PID:2892 -
\??\c:\9vvdj.exec:\9vvdj.exe58⤵
- Executes dropped EXE
PID:2932 -
\??\c:\9lllrrf.exec:\9lllrrf.exe59⤵
- Executes dropped EXE
PID:1956 -
\??\c:\fxfflfl.exec:\fxfflfl.exe60⤵
- Executes dropped EXE
PID:2184 -
\??\c:\btnhhb.exec:\btnhhb.exe61⤵
- Executes dropped EXE
PID:948 -
\??\c:\5htnbb.exec:\5htnbb.exe62⤵
- Executes dropped EXE
PID:764 -
\??\c:\dvpvd.exec:\dvpvd.exe63⤵
- Executes dropped EXE
PID:556 -
\??\c:\vjvdj.exec:\vjvdj.exe64⤵
- Executes dropped EXE
PID:840 -
\??\c:\7xffxfl.exec:\7xffxfl.exe65⤵
- Executes dropped EXE
PID:2060 -
\??\c:\9lfrflf.exec:\9lfrflf.exe66⤵PID:1152
-
\??\c:\hbnhhn.exec:\hbnhhn.exe67⤵PID:1736
-
\??\c:\7ttttn.exec:\7ttttn.exe68⤵PID:240
-
\??\c:\bnhhbb.exec:\bnhhbb.exe69⤵PID:2320
-
\??\c:\1dddj.exec:\1dddj.exe70⤵PID:696
-
\??\c:\pjvvd.exec:\pjvvd.exe71⤵PID:2020
-
\??\c:\3lxxrxx.exec:\3lxxrxx.exe72⤵PID:2876
-
\??\c:\hthnhn.exec:\hthnhn.exe73⤵PID:1460
-
\??\c:\tttbbh.exec:\tttbbh.exe74⤵PID:1636
-
\??\c:\9tthhh.exec:\9tthhh.exe75⤵PID:1516
-
\??\c:\ddpvj.exec:\ddpvj.exe76⤵PID:2040
-
\??\c:\9rflrfl.exec:\9rflrfl.exe77⤵PID:2196
-
\??\c:\xxllrfl.exec:\xxllrfl.exe78⤵PID:2644
-
\??\c:\lxxffrr.exec:\lxxffrr.exe79⤵PID:2668
-
\??\c:\hbhhnt.exec:\hbhhnt.exe80⤵PID:2000
-
\??\c:\hbtthn.exec:\hbtthn.exe81⤵PID:2616
-
\??\c:\vvjjd.exec:\vvjjd.exe82⤵PID:2440
-
\??\c:\jvvdd.exec:\jvvdd.exe83⤵PID:2428
-
\??\c:\ffxfxfl.exec:\ffxfxfl.exe84⤵PID:2584
-
\??\c:\frfrrrx.exec:\frfrrrx.exe85⤵PID:2456
-
\??\c:\nhbnth.exec:\nhbnth.exe86⤵PID:2116
-
\??\c:\bthntt.exec:\bthntt.exe87⤵PID:2472
-
\??\c:\pjppv.exec:\pjppv.exe88⤵PID:2500
-
\??\c:\5jdjj.exec:\5jdjj.exe89⤵PID:2784
-
\??\c:\rfrlrlx.exec:\rfrlrlx.exe90⤵PID:2764
-
\??\c:\lfrrxrf.exec:\lfrrxrf.exe91⤵PID:1916
-
\??\c:\7tnbbh.exec:\7tnbbh.exe92⤵PID:2332
-
\??\c:\hbhbhb.exec:\hbhbhb.exe93⤵PID:1500
-
\??\c:\3dpvv.exec:\3dpvv.exe94⤵PID:1512
-
\??\c:\5pppd.exec:\5pppd.exe95⤵PID:2168
-
\??\c:\fxffxxx.exec:\fxffxxx.exe96⤵PID:1432
-
\??\c:\xlrxflr.exec:\xlrxflr.exe97⤵PID:2788
-
\??\c:\1tnntt.exec:\1tnntt.exe98⤵PID:2808
-
\??\c:\vpddp.exec:\vpddp.exe99⤵PID:2244
-
\??\c:\7dppp.exec:\7dppp.exe100⤵PID:2268
-
\??\c:\rlxflrf.exec:\rlxflrf.exe101⤵PID:2508
-
\??\c:\lffrxfr.exec:\lffrxfr.exe102⤵PID:1612
-
\??\c:\nhntbh.exec:\nhntbh.exe103⤵PID:664
-
\??\c:\bnbhhb.exec:\bnbhhb.exe104⤵PID:1828
-
\??\c:\ppjpd.exec:\ppjpd.exe105⤵PID:1168
-
\??\c:\vjvdd.exec:\vjvdd.exe106⤵PID:984
-
\??\c:\rfxxxxf.exec:\rfxxxxf.exe107⤵PID:904
-
\??\c:\xxffrxf.exec:\xxffrxf.exe108⤵PID:2836
-
\??\c:\hbnnnt.exec:\hbnnnt.exe109⤵PID:1260
-
\??\c:\hhbtbb.exec:\hhbtbb.exe110⤵PID:340
-
\??\c:\jdjjj.exec:\jdjjj.exe111⤵PID:2012
-
\??\c:\dvpdp.exec:\dvpdp.exe112⤵PID:1892
-
\??\c:\rrrllrf.exec:\rrrllrf.exe113⤵PID:1164
-
\??\c:\xrllrrr.exec:\xrllrrr.exe114⤵PID:1772
-
\??\c:\hbnnbb.exec:\hbnnbb.exe115⤵PID:880
-
\??\c:\9nhthn.exec:\9nhthn.exe116⤵PID:2356
-
\??\c:\dvppd.exec:\dvppd.exe117⤵PID:1564
-
\??\c:\7vvvd.exec:\7vvvd.exe118⤵PID:2636
-
\??\c:\9rllrrf.exec:\9rllrrf.exe119⤵PID:2236
-
\??\c:\fxllxxl.exec:\fxllxxl.exe120⤵PID:2648
-
\??\c:\tnbbbh.exec:\tnbbbh.exe121⤵PID:2832
-
\??\c:\nhbthh.exec:\nhbthh.exe122⤵PID:2536
-
\??\c:\vvjdv.exec:\vvjdv.exe123⤵PID:2664
-
\??\c:\jdvvj.exec:\jdvvj.exe124⤵PID:2696
-
\??\c:\rlflrxf.exec:\rlflrxf.exe125⤵PID:2480
-
\??\c:\rrfrflx.exec:\rrfrflx.exe126⤵PID:2436
-
\??\c:\nbhhnn.exec:\nbhhnn.exe127⤵PID:1004
-
\??\c:\btnttt.exec:\btnttt.exe128⤵PID:2924
-
\??\c:\jvddd.exec:\jvddd.exe129⤵PID:2588
-
\??\c:\vpjjp.exec:\vpjjp.exe130⤵PID:2768
-
\??\c:\9fxlrxx.exec:\9fxlrxx.exe131⤵PID:2756
-
\??\c:\fxfflfr.exec:\fxfflfr.exe132⤵PID:2724
-
\??\c:\1bnntt.exec:\1bnntt.exe133⤵PID:1672
-
\??\c:\7tntbh.exec:\7tntbh.exe134⤵PID:1556
-
\??\c:\vpvdj.exec:\vpvdj.exe135⤵PID:1600
-
\??\c:\3dpvd.exec:\3dpvd.exe136⤵PID:1028
-
\??\c:\ppddv.exec:\ppddv.exe137⤵PID:1412
-
\??\c:\lflfllr.exec:\lflfllr.exe138⤵PID:2900
-
\??\c:\lrflrrx.exec:\lrflrrx.exe139⤵PID:1268
-
\??\c:\bthnbn.exec:\bthnbn.exe140⤵PID:1980
-
\??\c:\nhttnh.exec:\nhttnh.exe141⤵PID:2728
-
\??\c:\vpdpp.exec:\vpdpp.exe142⤵PID:2260
-
\??\c:\dpdpd.exec:\dpdpd.exe143⤵PID:2384
-
\??\c:\rlflxxl.exec:\rlflxxl.exe144⤵PID:580
-
\??\c:\jvppp.exec:\jvppp.exe145⤵PID:1240
-
\??\c:\pvjjj.exec:\pvjjj.exe146⤵PID:1712
-
\??\c:\xrxrfrx.exec:\xrxrfrx.exe147⤵PID:760
-
\??\c:\xlxfrlx.exec:\xlxfrlx.exe148⤵PID:2288
-
\??\c:\5tbnhn.exec:\5tbnhn.exe149⤵PID:3040
-
\??\c:\bbnnbh.exec:\bbnnbh.exe150⤵PID:1016
-
\??\c:\vpddj.exec:\vpddj.exe151⤵PID:3012
-
\??\c:\3pjjj.exec:\3pjjj.exe152⤵PID:848
-
\??\c:\ddvvj.exec:\ddvvj.exe153⤵PID:2216
-
\??\c:\xrxflrf.exec:\xrxflrf.exe154⤵PID:1924
-
\??\c:\rrlrxxf.exec:\rrlrxxf.exe155⤵PID:320
-
\??\c:\bnhnnn.exec:\bnhnnn.exe156⤵PID:2316
-
\??\c:\3nnttb.exec:\3nnttb.exe157⤵PID:1708
-
\??\c:\5dvpv.exec:\5dvpv.exe158⤵PID:1780
-
\??\c:\vjpvd.exec:\vjpvd.exe159⤵PID:2540
-
\??\c:\xrrfrfl.exec:\xrrfrfl.exe160⤵PID:2504
-
\??\c:\rfflffx.exec:\rfflffx.exe161⤵PID:2564
-
\??\c:\3rlrfrl.exec:\3rlrfrl.exe162⤵PID:2592
-
\??\c:\bthnbn.exec:\bthnbn.exe163⤵PID:2632
-
\??\c:\7bhntb.exec:\7bhntb.exe164⤵PID:2820
-
\??\c:\hhntbn.exec:\hhntbn.exe165⤵PID:2432
-
\??\c:\5ddvd.exec:\5ddvd.exe166⤵PID:2576
-
\??\c:\ddvjp.exec:\ddvjp.exe167⤵PID:2424
-
\??\c:\lxlrrfl.exec:\lxlrrfl.exe168⤵PID:2100
-
\??\c:\3lfrxxf.exec:\3lfrxxf.exe169⤵PID:1576
-
\??\c:\btttbb.exec:\btttbb.exe170⤵PID:2392
-
\??\c:\9nhntt.exec:\9nhntt.exe171⤵PID:2460
-
\??\c:\3pjpp.exec:\3pjpp.exe172⤵PID:1464
-
\??\c:\pjdjv.exec:\pjdjv.exe173⤵PID:2120
-
\??\c:\9lfrxlx.exec:\9lfrxlx.exe174⤵PID:376
-
\??\c:\xrxrffl.exec:\xrxrffl.exe175⤵PID:2156
-
\??\c:\tbnbhb.exec:\tbnbhb.exe176⤵PID:2300
-
\??\c:\nnthtb.exec:\nnthtb.exe177⤵PID:1584
-
\??\c:\dvjjp.exec:\dvjjp.exe178⤵PID:1200
-
\??\c:\ddpvd.exec:\ddpvd.exe179⤵PID:1252
-
\??\c:\xrxrrrf.exec:\xrxrrrf.exe180⤵PID:2896
-
\??\c:\fxrxffr.exec:\fxrxffr.exe181⤵PID:2936
-
\??\c:\tntbhn.exec:\tntbhn.exe182⤵PID:2232
-
\??\c:\thnbhb.exec:\thnbhb.exe183⤵PID:1096
-
\??\c:\ddvvd.exec:\ddvvd.exe184⤵PID:2208
-
\??\c:\5jvvj.exec:\5jvvj.exe185⤵PID:532
-
\??\c:\9xxxxxf.exec:\9xxxxxf.exe186⤵PID:2388
-
\??\c:\xlxfrxf.exec:\xlxfrxf.exe187⤵PID:924
-
\??\c:\tntthb.exec:\tntthb.exe188⤵PID:556
-
\??\c:\nhthtb.exec:\nhthtb.exe189⤵PID:692
-
\??\c:\tnbtbb.exec:\tnbtbb.exe190⤵PID:1292
-
\??\c:\5dvpd.exec:\5dvpd.exe191⤵PID:884
-
\??\c:\jdvjp.exec:\jdvjp.exe192⤵PID:1172
-
\??\c:\rxxrrll.exec:\rxxrrll.exe193⤵PID:240
-
\??\c:\rrflllr.exec:\rrflllr.exe194⤵PID:2320
-
\??\c:\nhtthh.exec:\nhtthh.exe195⤵PID:2200
-
\??\c:\nbhnnt.exec:\nbhnnt.exe196⤵PID:1720
-
\??\c:\bthbnh.exec:\bthbnh.exe197⤵PID:2140
-
\??\c:\1vvdj.exec:\1vvdj.exe198⤵PID:1424
-
\??\c:\dvddp.exec:\dvddp.exe199⤵PID:1636
-
\??\c:\rllrffx.exec:\rllrffx.exe200⤵PID:2992
-
\??\c:\fxrfrrx.exec:\fxrfrrx.exe201⤵PID:2976
-
\??\c:\bnhhtt.exec:\bnhhtt.exe202⤵PID:3000
-
\??\c:\hbtbbn.exec:\hbtbbn.exe203⤵PID:2644
-
\??\c:\nnnbht.exec:\nnnbht.exe204⤵PID:2668
-
\??\c:\djddd.exec:\djddd.exe205⤵PID:2760
-
\??\c:\dvvdj.exec:\dvvdj.exe206⤵PID:2312
-
\??\c:\rlxxrfl.exec:\rlxxrfl.exe207⤵PID:2580
-
\??\c:\lfrrxxl.exec:\lfrrxxl.exe208⤵PID:2468
-
\??\c:\hhbbtb.exec:\hhbbtb.exe209⤵PID:2416
-
\??\c:\9hhhtt.exec:\9hhhtt.exe210⤵PID:2916
-
\??\c:\vjdpv.exec:\vjdpv.exe211⤵PID:2116
-
\??\c:\ddpdp.exec:\ddpdp.exe212⤵PID:2748
-
\??\c:\9lxxrxl.exec:\9lxxrxl.exe213⤵PID:1344
-
\??\c:\pjvjd.exec:\pjvjd.exe214⤵PID:2792
-
\??\c:\pppvd.exec:\pppvd.exe215⤵PID:2764
-
\??\c:\lfxrfff.exec:\lfxrfff.exe216⤵PID:1796
-
\??\c:\5lflrrl.exec:\5lflrrl.exe217⤵PID:2332
-
\??\c:\hbtbbb.exec:\hbtbbb.exe218⤵PID:1548
-
\??\c:\thnbhb.exec:\thnbhb.exe219⤵PID:1476
-
\??\c:\btbhnn.exec:\btbhnn.exe220⤵PID:2172
-
\??\c:\dvpjj.exec:\dvpjj.exe221⤵PID:616
-
\??\c:\vpdjp.exec:\vpdjp.exe222⤵PID:2948
-
\??\c:\7rllffl.exec:\7rllffl.exe223⤵PID:2808
-
\??\c:\ffrflxf.exec:\ffrflxf.exe224⤵PID:2932
-
\??\c:\9xlxfll.exec:\9xlxfll.exe225⤵PID:3068
-
\??\c:\hhbthn.exec:\hhbthn.exe226⤵PID:1400
-
\??\c:\ttnhhn.exec:\ttnhhn.exe227⤵PID:1508
-
\??\c:\dvvdd.exec:\dvvdd.exe228⤵PID:468
-
\??\c:\vpvvd.exec:\vpvvd.exe229⤵PID:652
-
\??\c:\lfxxflr.exec:\lfxxflr.exe230⤵PID:840
-
\??\c:\lfrrlxf.exec:\lfrrlxf.exe231⤵PID:984
-
\??\c:\lfxfrfl.exec:\lfxfrfl.exe232⤵PID:992
-
\??\c:\nnbbtt.exec:\nnbbtt.exe233⤵PID:1952
-
\??\c:\3btntn.exec:\3btntn.exe234⤵PID:2348
-
\??\c:\vjjjp.exec:\vjjjp.exe235⤵PID:1840
-
\??\c:\pvvpd.exec:\pvvpd.exe236⤵PID:2276
-
\??\c:\5fxxffl.exec:\5fxxffl.exe237⤵PID:2024
-
\??\c:\xrfrxlr.exec:\xrfrxlr.exe238⤵PID:1808
-
\??\c:\7bntbb.exec:\7bntbb.exe239⤵PID:1908
-
\??\c:\1hhttt.exec:\1hhttt.exe240⤵PID:2596
-
\??\c:\tnnnhh.exec:\tnnnhh.exe241⤵PID:2356
-
\??\c:\vpvjd.exec:\vpvjd.exe242⤵PID:1624