Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 14:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d337b7e036a7071d1b2c8aff039f54d0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
d337b7e036a7071d1b2c8aff039f54d0_NeikiAnalytics.exe
-
Size
372KB
-
MD5
d337b7e036a7071d1b2c8aff039f54d0
-
SHA1
27cf33225a48b7d0987568c5625fe41c35082057
-
SHA256
f4aed443666b24ed01fe22fc1b7dc8590082fc6e2e7f7335c58aeeeec35f9c31
-
SHA512
a8858ef73d7d6a16365b47649bc36c1941b9807ceb79ba21cf83f3001aab0d06e38a7d196c4c44124ccb665bb3ab0476263de2f925c1c32c580b849204df2008
-
SSDEEP
6144:n3C9BRIG0asYFm71mJl3/X8mak5gNv9rC8IwLaYNUvtTxTKMMP:n3C9uYA7i3/stR9HGYyvtTxTKMQ
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral2/memory/1216-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3748-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/700-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3484-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4024-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1584-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1068-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1220-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3692-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4228-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1476-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4772-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5072-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/432-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3844-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4352-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1052-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xxxlfrl.exethnbth.exedvvvv.exerrrllrx.exellxrllf.exebtnhnn.exedvdvp.exexflfxxf.exexxrlfff.exebthbtn.exevdpjj.exexrxrxxf.exe9xxrrrl.exebbhbnn.exerfrlfxr.exe5ttnnn.exexxrlffx.exehhhbtt.exejdvpd.exelrffllx.exe9jpdd.exe1rlrfrl.exe5nhbhn.exehhhbnn.exejdddv.exerrrrrrr.exehtbtnh.exenbtbnb.exerffxllf.exe9httnn.exevjpjd.exe5hbbnn.exevddvp.exebhttnn.exennbbhh.exedvjdv.exerlxrllr.exe3ntttt.exehbhbbn.exe3dvpj.exexfrlllr.exenhnhtt.exejjjdp.exe9rlllll.exehhbtnh.exevdjjd.exevvdjj.exefxrlfrl.exenhhbtt.exe3pjdv.exexlrrrfx.exexxxxrrf.exetnbtnh.exevvpjj.exevpvpp.exe1flfrrl.exennbbbb.exe5thbhb.exe7dppd.exelffxfxf.exerxxrrll.exentnnhh.exedjvpj.exellrrllf.exepid process 3748 xxxlfrl.exe 700 thnbth.exe 3484 dvvvv.exe 1220 rrrllrx.exe 1068 llxrllf.exe 1584 btnhnn.exe 4024 dvdvp.exe 1064 xflfxxf.exe 5056 xxrlfff.exe 2076 bthbtn.exe 3692 vdpjj.exe 2028 xrxrxxf.exe 4228 9xxrrrl.exe 1476 bbhbnn.exe 4460 rfrlfxr.exe 4768 5ttnnn.exe 2252 xxrlffx.exe 4772 hhhbtt.exe 2764 jdvpd.exe 2932 lrffllx.exe 1856 9jpdd.exe 5072 1rlrfrl.exe 432 5nhbhn.exe 764 hhhbnn.exe 3844 jdddv.exe 4308 rrrrrrr.exe 4296 htbtnh.exe 4128 nbtbnb.exe 4352 rffxllf.exe 4020 9httnn.exe 1052 vjpjd.exe 4208 5hbbnn.exe 1992 vddvp.exe 2132 bhttnn.exe 372 nnbbhh.exe 4396 dvjdv.exe 1676 rlxrllr.exe 4148 3ntttt.exe 656 hbhbbn.exe 3052 3dvpj.exe 5088 xfrlllr.exe 3448 nhnhtt.exe 4788 jjjdp.exe 3056 9rlllll.exe 4928 hhbtnh.exe 772 vdjjd.exe 4648 vvdjj.exe 5000 fxrlfrl.exe 3720 nhhbtt.exe 4044 3pjdv.exe 1980 xlrrrfx.exe 4728 xxxxrrf.exe 3472 tnbtnh.exe 380 vvpjj.exe 2740 vpvpp.exe 3956 1flfrrl.exe 4880 nnbbbb.exe 1900 5thbhb.exe 1492 7dppd.exe 4772 lffxfxf.exe 2716 rxxrrll.exe 2640 ntnnhh.exe 3608 djvpj.exe 4632 llrrllf.exe -
Processes:
resource yara_rule behavioral2/memory/1216-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3748-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3748-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/700-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3484-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4024-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1584-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1068-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1220-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3692-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4228-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1476-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4768-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4772-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5072-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/432-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3844-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4352-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1052-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d337b7e036a7071d1b2c8aff039f54d0_NeikiAnalytics.exexxxlfrl.exethnbth.exedvvvv.exerrrllrx.exellxrllf.exebtnhnn.exedvdvp.exexflfxxf.exexxrlfff.exebthbtn.exevdpjj.exexrxrxxf.exe9xxrrrl.exebbhbnn.exerfrlfxr.exe5ttnnn.exexxrlffx.exehhhbtt.exejdvpd.exelrffllx.exe9jpdd.exedescription pid process target process PID 1216 wrote to memory of 3748 1216 d337b7e036a7071d1b2c8aff039f54d0_NeikiAnalytics.exe xxxlfrl.exe PID 1216 wrote to memory of 3748 1216 d337b7e036a7071d1b2c8aff039f54d0_NeikiAnalytics.exe xxxlfrl.exe PID 1216 wrote to memory of 3748 1216 d337b7e036a7071d1b2c8aff039f54d0_NeikiAnalytics.exe xxxlfrl.exe PID 3748 wrote to memory of 700 3748 xxxlfrl.exe thnbth.exe PID 3748 wrote to memory of 700 3748 xxxlfrl.exe thnbth.exe PID 3748 wrote to memory of 700 3748 xxxlfrl.exe thnbth.exe PID 700 wrote to memory of 3484 700 thnbth.exe dvvvv.exe PID 700 wrote to memory of 3484 700 thnbth.exe dvvvv.exe PID 700 wrote to memory of 3484 700 thnbth.exe dvvvv.exe PID 3484 wrote to memory of 1220 3484 dvvvv.exe rrrllrx.exe PID 3484 wrote to memory of 1220 3484 dvvvv.exe rrrllrx.exe PID 3484 wrote to memory of 1220 3484 dvvvv.exe rrrllrx.exe PID 1220 wrote to memory of 1068 1220 rrrllrx.exe llxrllf.exe PID 1220 wrote to memory of 1068 1220 rrrllrx.exe llxrllf.exe PID 1220 wrote to memory of 1068 1220 rrrllrx.exe llxrllf.exe PID 1068 wrote to memory of 1584 1068 llxrllf.exe btnhnn.exe PID 1068 wrote to memory of 1584 1068 llxrllf.exe btnhnn.exe PID 1068 wrote to memory of 1584 1068 llxrllf.exe btnhnn.exe PID 1584 wrote to memory of 4024 1584 btnhnn.exe dvdvp.exe PID 1584 wrote to memory of 4024 1584 btnhnn.exe dvdvp.exe PID 1584 wrote to memory of 4024 1584 btnhnn.exe dvdvp.exe PID 4024 wrote to memory of 1064 4024 dvdvp.exe xflfxxf.exe PID 4024 wrote to memory of 1064 4024 dvdvp.exe xflfxxf.exe PID 4024 wrote to memory of 1064 4024 dvdvp.exe xflfxxf.exe PID 1064 wrote to memory of 5056 1064 xflfxxf.exe xxrlfff.exe PID 1064 wrote to memory of 5056 1064 xflfxxf.exe xxrlfff.exe PID 1064 wrote to memory of 5056 1064 xflfxxf.exe xxrlfff.exe PID 5056 wrote to memory of 2076 5056 xxrlfff.exe bthbtn.exe PID 5056 wrote to memory of 2076 5056 xxrlfff.exe bthbtn.exe PID 5056 wrote to memory of 2076 5056 xxrlfff.exe bthbtn.exe PID 2076 wrote to memory of 3692 2076 bthbtn.exe vdpjj.exe PID 2076 wrote to memory of 3692 2076 bthbtn.exe vdpjj.exe PID 2076 wrote to memory of 3692 2076 bthbtn.exe vdpjj.exe PID 3692 wrote to memory of 2028 3692 vdpjj.exe xrxrxxf.exe PID 3692 wrote to memory of 2028 3692 vdpjj.exe xrxrxxf.exe PID 3692 wrote to memory of 2028 3692 vdpjj.exe xrxrxxf.exe PID 2028 wrote to memory of 4228 2028 xrxrxxf.exe 9xxrrrl.exe PID 2028 wrote to memory of 4228 2028 xrxrxxf.exe 9xxrrrl.exe PID 2028 wrote to memory of 4228 2028 xrxrxxf.exe 9xxrrrl.exe PID 4228 wrote to memory of 1476 4228 9xxrrrl.exe bbhbnn.exe PID 4228 wrote to memory of 1476 4228 9xxrrrl.exe bbhbnn.exe PID 4228 wrote to memory of 1476 4228 9xxrrrl.exe bbhbnn.exe PID 1476 wrote to memory of 4460 1476 bbhbnn.exe rfrlfxr.exe PID 1476 wrote to memory of 4460 1476 bbhbnn.exe rfrlfxr.exe PID 1476 wrote to memory of 4460 1476 bbhbnn.exe rfrlfxr.exe PID 4460 wrote to memory of 4768 4460 rfrlfxr.exe 5ttnnn.exe PID 4460 wrote to memory of 4768 4460 rfrlfxr.exe 5ttnnn.exe PID 4460 wrote to memory of 4768 4460 rfrlfxr.exe 5ttnnn.exe PID 4768 wrote to memory of 2252 4768 5ttnnn.exe xxrlffx.exe PID 4768 wrote to memory of 2252 4768 5ttnnn.exe xxrlffx.exe PID 4768 wrote to memory of 2252 4768 5ttnnn.exe xxrlffx.exe PID 2252 wrote to memory of 4772 2252 xxrlffx.exe hhhbtt.exe PID 2252 wrote to memory of 4772 2252 xxrlffx.exe hhhbtt.exe PID 2252 wrote to memory of 4772 2252 xxrlffx.exe hhhbtt.exe PID 4772 wrote to memory of 2764 4772 hhhbtt.exe jdvpd.exe PID 4772 wrote to memory of 2764 4772 hhhbtt.exe jdvpd.exe PID 4772 wrote to memory of 2764 4772 hhhbtt.exe jdvpd.exe PID 2764 wrote to memory of 2932 2764 jdvpd.exe lrffllx.exe PID 2764 wrote to memory of 2932 2764 jdvpd.exe lrffllx.exe PID 2764 wrote to memory of 2932 2764 jdvpd.exe lrffllx.exe PID 2932 wrote to memory of 1856 2932 lrffllx.exe 9jpdd.exe PID 2932 wrote to memory of 1856 2932 lrffllx.exe 9jpdd.exe PID 2932 wrote to memory of 1856 2932 lrffllx.exe 9jpdd.exe PID 1856 wrote to memory of 5072 1856 9jpdd.exe 1rlrfrl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d337b7e036a7071d1b2c8aff039f54d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d337b7e036a7071d1b2c8aff039f54d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\xxxlfrl.exec:\xxxlfrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\thnbth.exec:\thnbth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
\??\c:\dvvvv.exec:\dvvvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\rrrllrx.exec:\rrrllrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\llxrllf.exec:\llxrllf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\btnhnn.exec:\btnhnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\dvdvp.exec:\dvdvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\xflfxxf.exec:\xflfxxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\xxrlfff.exec:\xxrlfff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\bthbtn.exec:\bthbtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\vdpjj.exec:\vdpjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\xrxrxxf.exec:\xrxrxxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\9xxrrrl.exec:\9xxrrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\bbhbnn.exec:\bbhbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\rfrlfxr.exec:\rfrlfxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\5ttnnn.exec:\5ttnnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\xxrlffx.exec:\xxrlffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\hhhbtt.exec:\hhhbtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\jdvpd.exec:\jdvpd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\lrffllx.exec:\lrffllx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\9jpdd.exec:\9jpdd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\1rlrfrl.exec:\1rlrfrl.exe23⤵
- Executes dropped EXE
PID:5072 -
\??\c:\5nhbhn.exec:\5nhbhn.exe24⤵
- Executes dropped EXE
PID:432 -
\??\c:\hhhbnn.exec:\hhhbnn.exe25⤵
- Executes dropped EXE
PID:764 -
\??\c:\jdddv.exec:\jdddv.exe26⤵
- Executes dropped EXE
PID:3844 -
\??\c:\rrrrrrr.exec:\rrrrrrr.exe27⤵
- Executes dropped EXE
PID:4308 -
\??\c:\htbtnh.exec:\htbtnh.exe28⤵
- Executes dropped EXE
PID:4296 -
\??\c:\nbtbnb.exec:\nbtbnb.exe29⤵
- Executes dropped EXE
PID:4128 -
\??\c:\rffxllf.exec:\rffxllf.exe30⤵
- Executes dropped EXE
PID:4352 -
\??\c:\9httnn.exec:\9httnn.exe31⤵
- Executes dropped EXE
PID:4020 -
\??\c:\vjpjd.exec:\vjpjd.exe32⤵
- Executes dropped EXE
PID:1052 -
\??\c:\5hbbnn.exec:\5hbbnn.exe33⤵
- Executes dropped EXE
PID:4208 -
\??\c:\vddvp.exec:\vddvp.exe34⤵
- Executes dropped EXE
PID:1992 -
\??\c:\bhttnn.exec:\bhttnn.exe35⤵
- Executes dropped EXE
PID:2132 -
\??\c:\nnbbhh.exec:\nnbbhh.exe36⤵
- Executes dropped EXE
PID:372 -
\??\c:\dvjdv.exec:\dvjdv.exe37⤵
- Executes dropped EXE
PID:4396 -
\??\c:\rlxrllr.exec:\rlxrllr.exe38⤵
- Executes dropped EXE
PID:1676 -
\??\c:\3ntttt.exec:\3ntttt.exe39⤵
- Executes dropped EXE
PID:4148 -
\??\c:\hbhbbn.exec:\hbhbbn.exe40⤵
- Executes dropped EXE
PID:656 -
\??\c:\3dvpj.exec:\3dvpj.exe41⤵
- Executes dropped EXE
PID:3052 -
\??\c:\xfrlllr.exec:\xfrlllr.exe42⤵
- Executes dropped EXE
PID:5088 -
\??\c:\nhnhtt.exec:\nhnhtt.exe43⤵
- Executes dropped EXE
PID:3448 -
\??\c:\jjjdp.exec:\jjjdp.exe44⤵
- Executes dropped EXE
PID:4788 -
\??\c:\9rlllll.exec:\9rlllll.exe45⤵
- Executes dropped EXE
PID:3056 -
\??\c:\hhbtnh.exec:\hhbtnh.exe46⤵
- Executes dropped EXE
PID:4928 -
\??\c:\vdjjd.exec:\vdjjd.exe47⤵
- Executes dropped EXE
PID:772 -
\??\c:\vvdjj.exec:\vvdjj.exe48⤵
- Executes dropped EXE
PID:4648 -
\??\c:\fxrlfrl.exec:\fxrlfrl.exe49⤵
- Executes dropped EXE
PID:5000 -
\??\c:\nhhbtt.exec:\nhhbtt.exe50⤵
- Executes dropped EXE
PID:3720 -
\??\c:\3pjdv.exec:\3pjdv.exe51⤵
- Executes dropped EXE
PID:4044 -
\??\c:\xlrrrfx.exec:\xlrrrfx.exe52⤵
- Executes dropped EXE
PID:1980 -
\??\c:\xxxxrrf.exec:\xxxxrrf.exe53⤵
- Executes dropped EXE
PID:4728 -
\??\c:\tnbtnh.exec:\tnbtnh.exe54⤵
- Executes dropped EXE
PID:3472 -
\??\c:\vvpjj.exec:\vvpjj.exe55⤵
- Executes dropped EXE
PID:380 -
\??\c:\vpvpp.exec:\vpvpp.exe56⤵
- Executes dropped EXE
PID:2740 -
\??\c:\1flfrrl.exec:\1flfrrl.exe57⤵
- Executes dropped EXE
PID:3956 -
\??\c:\nnbbbb.exec:\nnbbbb.exe58⤵
- Executes dropped EXE
PID:4880 -
\??\c:\5thbhb.exec:\5thbhb.exe59⤵
- Executes dropped EXE
PID:1900 -
\??\c:\7dppd.exec:\7dppd.exe60⤵
- Executes dropped EXE
PID:1492 -
\??\c:\lffxfxf.exec:\lffxfxf.exe61⤵
- Executes dropped EXE
PID:4772 -
\??\c:\rxxrrll.exec:\rxxrrll.exe62⤵
- Executes dropped EXE
PID:2716 -
\??\c:\ntnnhh.exec:\ntnnhh.exe63⤵
- Executes dropped EXE
PID:2640 -
\??\c:\djvpj.exec:\djvpj.exe64⤵
- Executes dropped EXE
PID:3608 -
\??\c:\llrrllf.exec:\llrrllf.exe65⤵
- Executes dropped EXE
PID:4632 -
\??\c:\nntnhb.exec:\nntnhb.exe66⤵PID:5072
-
\??\c:\vvjdv.exec:\vvjdv.exe67⤵PID:1400
-
\??\c:\1vddv.exec:\1vddv.exe68⤵PID:2904
-
\??\c:\rrxrffx.exec:\rrxrffx.exe69⤵PID:740
-
\??\c:\hhhhbb.exec:\hhhhbb.exe70⤵PID:2920
-
\??\c:\pvdpv.exec:\pvdpv.exe71⤵PID:2120
-
\??\c:\9vpjp.exec:\9vpjp.exe72⤵PID:2368
-
\??\c:\3lxrlrr.exec:\3lxrlrr.exe73⤵PID:4464
-
\??\c:\bttntt.exec:\bttntt.exe74⤵PID:428
-
\??\c:\ttnhbb.exec:\ttnhbb.exe75⤵PID:4352
-
\??\c:\pjjvj.exec:\pjjvj.exe76⤵PID:4020
-
\??\c:\rxxrfxr.exec:\rxxrfxr.exe77⤵PID:1248
-
\??\c:\hnhnhn.exec:\hnhnhn.exe78⤵PID:4736
-
\??\c:\5btnhb.exec:\5btnhb.exe79⤵PID:3940
-
\??\c:\3vvpd.exec:\3vvpd.exe80⤵PID:1300
-
\??\c:\xxfxrxf.exec:\xxfxrxf.exe81⤵PID:1992
-
\??\c:\9lllffl.exec:\9lllffl.exe82⤵PID:1480
-
\??\c:\nhtnhh.exec:\nhtnhh.exe83⤵PID:4416
-
\??\c:\bbtbnb.exec:\bbtbnb.exe84⤵PID:4396
-
\??\c:\pdppp.exec:\pdppp.exe85⤵PID:3748
-
\??\c:\lrrlxxr.exec:\lrrlxxr.exe86⤵PID:640
-
\??\c:\9lxxrlf.exec:\9lxxrlf.exe87⤵PID:1580
-
\??\c:\bbbthh.exec:\bbbthh.exe88⤵PID:4168
-
\??\c:\vjpjj.exec:\vjpjj.exe89⤵PID:956
-
\??\c:\5ddvp.exec:\5ddvp.exe90⤵PID:4024
-
\??\c:\3rrfxxl.exec:\3rrfxxl.exe91⤵PID:2332
-
\??\c:\hthbtt.exec:\hthbtt.exe92⤵PID:100
-
\??\c:\jddvv.exec:\jddvv.exe93⤵PID:3064
-
\??\c:\pdjdv.exec:\pdjdv.exe94⤵PID:3692
-
\??\c:\9xrlffx.exec:\9xrlffx.exe95⤵PID:4728
-
\??\c:\nbbbbb.exec:\nbbbbb.exe96⤵PID:3904
-
\??\c:\vjjdp.exec:\vjjdp.exe97⤵PID:1476
-
\??\c:\rfxflxr.exec:\rfxflxr.exe98⤵PID:4476
-
\??\c:\nhtnnb.exec:\nhtnnb.exe99⤵PID:2200
-
\??\c:\tnhtnh.exec:\tnhtnh.exe100⤵PID:8
-
\??\c:\7vppj.exec:\7vppj.exe101⤵PID:2452
-
\??\c:\xlllffx.exec:\xlllffx.exe102⤵PID:5068
-
\??\c:\1htnhb.exec:\1htnhb.exe103⤵PID:2932
-
\??\c:\7jdpj.exec:\7jdpj.exe104⤵PID:2972
-
\??\c:\vvvvd.exec:\vvvvd.exe105⤵PID:3688
-
\??\c:\fxrlffx.exec:\fxrlffx.exe106⤵PID:4548
-
\??\c:\fllfxxr.exec:\fllfxxr.exe107⤵PID:5064
-
\??\c:\7nhnhh.exec:\7nhnhh.exe108⤵PID:4924
-
\??\c:\ddjvd.exec:\ddjvd.exe109⤵PID:2524
-
\??\c:\jvpjd.exec:\jvpjd.exe110⤵PID:3764
-
\??\c:\fxfxffl.exec:\fxfxffl.exe111⤵PID:2748
-
\??\c:\1bhhbn.exec:\1bhhbn.exe112⤵PID:3516
-
\??\c:\thnhhh.exec:\thnhhh.exe113⤵PID:4876
-
\??\c:\9jvpd.exec:\9jvpd.exe114⤵PID:428
-
\??\c:\fxxrxff.exec:\fxxrxff.exe115⤵PID:5028
-
\??\c:\1rrlllf.exec:\1rrlllf.exe116⤵PID:3424
-
\??\c:\btbtnh.exec:\btbtnh.exe117⤵PID:1052
-
\??\c:\jvdvp.exec:\jvdvp.exe118⤵PID:2704
-
\??\c:\fxrrlxr.exec:\fxrrlxr.exe119⤵PID:3440
-
\??\c:\1tnbtn.exec:\1tnbtn.exe120⤵PID:2132
-
\??\c:\vppdj.exec:\vppdj.exe121⤵PID:2348
-
\??\c:\xxxxrxr.exec:\xxxxrxr.exe122⤵PID:2732
-
\??\c:\btbthb.exec:\btbthb.exe123⤵PID:1676
-
\??\c:\ttthth.exec:\ttthth.exe124⤵PID:2696
-
\??\c:\dddvv.exec:\dddvv.exe125⤵PID:3960
-
\??\c:\1frlflf.exec:\1frlflf.exe126⤵PID:3740
-
\??\c:\9hnhhh.exec:\9hnhhh.exe127⤵PID:848
-
\??\c:\tnnnht.exec:\tnnnht.exe128⤵PID:772
-
\??\c:\jdpjj.exec:\jdpjj.exe129⤵PID:4024
-
\??\c:\lfrlrrx.exec:\lfrlrrx.exe130⤵PID:2332
-
\??\c:\lrlfrfx.exec:\lrlfrfx.exe131⤵PID:1540
-
\??\c:\bnbbtn.exec:\bnbbtn.exe132⤵PID:1636
-
\??\c:\vvpjd.exec:\vvpjd.exe133⤵PID:812
-
\??\c:\vpdvv.exec:\vpdvv.exe134⤵PID:380
-
\??\c:\xlrlxxr.exec:\xlrlxxr.exe135⤵PID:1060
-
\??\c:\bbnnhh.exec:\bbnnhh.exe136⤵PID:2256
-
\??\c:\pdjvd.exec:\pdjvd.exe137⤵PID:4880
-
\??\c:\ddjvj.exec:\ddjvj.exe138⤵PID:2200
-
\??\c:\7rfffff.exec:\7rfffff.exe139⤵PID:2072
-
\??\c:\tnhhbb.exec:\tnhhbb.exe140⤵PID:1104
-
\??\c:\3jdpd.exec:\3jdpd.exe141⤵PID:716
-
\??\c:\jdddv.exec:\jdddv.exe142⤵PID:1464
-
\??\c:\xxfxllf.exec:\xxfxllf.exe143⤵PID:876
-
\??\c:\nnnhbb.exec:\nnnhbb.exe144⤵PID:3028
-
\??\c:\ttnhhh.exec:\ttnhhh.exe145⤵PID:4528
-
\??\c:\7vjvp.exec:\7vjvp.exe146⤵PID:3832
-
\??\c:\llfxfxr.exec:\llfxfxr.exe147⤵PID:2524
-
\??\c:\rlrfxrl.exec:\rlrfxrl.exe148⤵PID:2368
-
\??\c:\hbnnht.exec:\hbnnht.exe149⤵PID:4064
-
\??\c:\vjpdv.exec:\vjpdv.exe150⤵PID:3516
-
\??\c:\rrllfxr.exec:\rrllfxr.exe151⤵PID:4492
-
\??\c:\bttnhh.exec:\bttnhh.exe152⤵PID:1232
-
\??\c:\jjpjp.exec:\jjpjp.exe153⤵PID:5028
-
\??\c:\vdjjv.exec:\vdjjv.exe154⤵PID:4736
-
\??\c:\rrrlffx.exec:\rrrlffx.exe155⤵PID:1352
-
\??\c:\htbnbb.exec:\htbnbb.exe156⤵PID:1300
-
\??\c:\9hnnhb.exec:\9hnnhb.exe157⤵PID:3440
-
\??\c:\1pvpv.exec:\1pvpv.exe158⤵PID:1988
-
\??\c:\dpvpv.exec:\dpvpv.exe159⤵PID:748
-
\??\c:\ffxrfxf.exec:\ffxrfxf.exe160⤵PID:2732
-
\??\c:\hbhbth.exec:\hbhbth.exe161⤵PID:5088
-
\??\c:\hbbtnn.exec:\hbbtnn.exe162⤵PID:2460
-
\??\c:\jjdpj.exec:\jjdpj.exe163⤵PID:4788
-
\??\c:\rrllffl.exec:\rrllffl.exe164⤵PID:3848
-
\??\c:\5hhbbt.exec:\5hhbbt.exe165⤵PID:3664
-
\??\c:\nnhtnh.exec:\nnhtnh.exe166⤵PID:772
-
\??\c:\dpdvv.exec:\dpdvv.exe167⤵PID:1008
-
\??\c:\rrfxflf.exec:\rrfxflf.exe168⤵PID:1440
-
\??\c:\xrfflrx.exec:\xrfflrx.exe169⤵PID:1540
-
\??\c:\tttnhh.exec:\tttnhh.exe170⤵PID:4728
-
\??\c:\tttnbt.exec:\tttnbt.exe171⤵PID:812
-
\??\c:\dpvdv.exec:\dpvdv.exe172⤵PID:380
-
\??\c:\rfxrrrr.exec:\rfxrrrr.exe173⤵PID:1740
-
\??\c:\5ffxlff.exec:\5ffxlff.exe174⤵PID:5036
-
\??\c:\tbhhtn.exec:\tbhhtn.exe175⤵PID:4772
-
\??\c:\9djdd.exec:\9djdd.exe176⤵PID:3040
-
\??\c:\djvpd.exec:\djvpd.exe177⤵PID:2392
-
\??\c:\xrxxxrx.exec:\xrxxxrx.exe178⤵PID:1680
-
\??\c:\rrllfxx.exec:\rrllfxx.exe179⤵PID:4632
-
\??\c:\hbbtnn.exec:\hbbtnn.exe180⤵PID:4308
-
\??\c:\btnhtt.exec:\btnhtt.exe181⤵PID:3840
-
\??\c:\dvjjd.exec:\dvjjd.exe182⤵PID:4552
-
\??\c:\xflfxxf.exec:\xflfxxf.exe183⤵PID:4744
-
\??\c:\5rflffx.exec:\5rflffx.exe184⤵PID:3556
-
\??\c:\tnhbhh.exec:\tnhbhh.exe185⤵PID:4876
-
\??\c:\dvjjv.exec:\dvjjv.exe186⤵PID:4020
-
\??\c:\jpvpd.exec:\jpvpd.exe187⤵PID:1664
-
\??\c:\xlxrrrr.exec:\xlxrrrr.exe188⤵PID:4208
-
\??\c:\hthnnt.exec:\hthnnt.exe189⤵PID:2288
-
\??\c:\thnhhb.exec:\thnhhb.exe190⤵PID:2616
-
\??\c:\vpvpd.exec:\vpvpd.exe191⤵PID:4512
-
\??\c:\frfxffx.exec:\frfxffx.exe192⤵PID:4416
-
\??\c:\rllfrrl.exec:\rllfrrl.exe193⤵PID:4396
-
\??\c:\tbtnhb.exec:\tbtnhb.exe194⤵PID:3484
-
\??\c:\jjvpd.exec:\jjvpd.exe195⤵PID:4168
-
\??\c:\dvvpd.exec:\dvvpd.exe196⤵PID:3916
-
\??\c:\fflffxf.exec:\fflffxf.exe197⤵PID:2620
-
\??\c:\bhhnhh.exec:\bhhnhh.exe198⤵PID:1644
-
\??\c:\5bhbtn.exec:\5bhbtn.exe199⤵PID:3720
-
\??\c:\djddv.exec:\djddv.exe200⤵PID:2028
-
\??\c:\lllfffx.exec:\lllfffx.exe201⤵PID:5076
-
\??\c:\9nnhbb.exec:\9nnhbb.exe202⤵PID:4964
-
\??\c:\3thbtt.exec:\3thbtt.exe203⤵PID:4156
-
\??\c:\5vdvd.exec:\5vdvd.exe204⤵PID:4884
-
\??\c:\ddjvd.exec:\ddjvd.exe205⤵PID:1060
-
\??\c:\flxrrrx.exec:\flxrrrx.exe206⤵PID:4616
-
\??\c:\tnbbbb.exec:\tnbbbb.exe207⤵PID:920
-
\??\c:\1dpjd.exec:\1dpjd.exe208⤵PID:1492
-
\??\c:\frlfrrl.exec:\frlfrrl.exe209⤵PID:2640
-
\??\c:\frxxxff.exec:\frxxxff.exe210⤵PID:1576
-
\??\c:\bbbtnh.exec:\bbbtnh.exe211⤵PID:3844
-
\??\c:\vpjpd.exec:\vpjpd.exe212⤵PID:4548
-
\??\c:\ppppj.exec:\ppppj.exe213⤵PID:3220
-
\??\c:\lxlxlfx.exec:\lxlxlfx.exe214⤵PID:4296
-
\??\c:\ntthtn.exec:\ntthtn.exe215⤵PID:1944
-
\??\c:\pvdvj.exec:\pvdvj.exe216⤵PID:2720
-
\??\c:\lxxfxxx.exec:\lxxfxxx.exe217⤵PID:428
-
\??\c:\rrxrxfl.exec:\rrxrxfl.exe218⤵PID:4600
-
\??\c:\bnnnhh.exec:\bnnnhh.exe219⤵PID:1248
-
\??\c:\ntnhbb.exec:\ntnhbb.exe220⤵PID:3892
-
\??\c:\pjvpp.exec:\pjvpp.exe221⤵PID:2704
-
\??\c:\7rfxxfx.exec:\7rfxxfx.exe222⤵PID:4736
-
\??\c:\xfxxxxr.exec:\xfxxxxr.exe223⤵PID:1480
-
\??\c:\bbbbtt.exec:\bbbbtt.exe224⤵PID:4028
-
\??\c:\dvpvp.exec:\dvpvp.exe225⤵PID:1452
-
\??\c:\xflffxf.exec:\xflffxf.exe226⤵PID:3748
-
\??\c:\xrffxrl.exec:\xrffxrl.exe227⤵PID:1580
-
\??\c:\ttbtbb.exec:\ttbtbb.exe228⤵PID:1096
-
\??\c:\vpjvp.exec:\vpjvp.exe229⤵PID:3740
-
\??\c:\frxlxxf.exec:\frxlxxf.exe230⤵PID:956
-
\??\c:\rllrrrl.exec:\rllrrrl.exe231⤵PID:1708
-
\??\c:\1bbtnn.exec:\1bbtnn.exe232⤵PID:772
-
\??\c:\ttbttn.exec:\ttbttn.exe233⤵PID:3064
-
\??\c:\9vvpj.exec:\9vvpj.exe234⤵PID:3932
-
\??\c:\xlfrfxx.exec:\xlfrfxx.exe235⤵PID:1636
-
\??\c:\fxlfxxr.exec:\fxlfxxr.exe236⤵PID:3956
-
\??\c:\hbnntt.exec:\hbnntt.exe237⤵PID:4116
-
\??\c:\3htnhb.exec:\3htnhb.exe238⤵PID:380
-
\??\c:\ddjdv.exec:\ddjdv.exe239⤵PID:1496
-
\??\c:\lrxfffx.exec:\lrxfffx.exe240⤵PID:2944
-
\??\c:\3bnnhb.exec:\3bnnhb.exe241⤵PID:1492
-
\??\c:\btnnnn.exec:\btnnnn.exe242⤵PID:3608