Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 05:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b94bf585f972e9e808660ae114423980_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
b94bf585f972e9e808660ae114423980_NeikiAnalytics.exe
-
Size
61KB
-
MD5
b94bf585f972e9e808660ae114423980
-
SHA1
73d248d5887ae2b66d80d43dd4320218eba1aa7c
-
SHA256
1fceafedcc5f34c28e5eebefa1621f8ea3c812d90fa45799b4107429e23d79ac
-
SHA512
a01730f76f875bdfff991e3ee1b7ea2fb48b4349aaad992317761cacf974c7492a14f32e1513cd4d7ea4a913d70957dfa3550297980ef35309cba4000f61684d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvAEaFJLC:ymb3NkkiQ3mdBjFIvAvC
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/3020-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2980-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-80-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2356-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1484-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1896-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2420-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/544-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1872-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1144-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1432-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2012-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1172-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1452-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3064-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1556-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1268-3218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
nnbtbb.exedvddj.exeflflxfr.exevvjdj.exedjjvd.exelfffrxf.exehnbnhb.exe9htbhh.exepjjpv.exe3xrxffl.exenbthnh.exettbbhh.exepdppd.exe9pjdv.exexrffxfr.exe5htbhh.exedvddj.exepjjdj.exefxrfrxr.exetnbthn.exe9htttt.exevppdj.exerllxflx.exerlxfrrx.exebttbhh.exe5hbhtt.exedpddj.exepjdjj.exe9rxlrxf.exe5htbhh.exejdvdd.exejdvdd.exejdvvd.exe7xlrxfr.exenbnhhb.exe1thhhn.exejjpjj.exe3lfxllr.exelfxflrx.exe5hbthh.exedvppp.exe5vjpd.exexrrrffr.exelfrxffr.exenhbhtb.exethbhnn.exevppdp.exe3vpvv.exexlflxfl.exe1hbntn.exenhbbhh.exejdpjj.exerlffffr.exentbtnb.exebtnttb.exe9pjjd.exepjddd.exerfxxxxf.exefrflrrx.exe5htbbb.exeddvjp.exe5ppdp.exerxlrrfr.exe5rxxxrx.exepid process 1268 nnbtbb.exe 2980 dvddj.exe 2672 flflxfr.exe 2468 vvjdj.exe 2680 djjvd.exe 2576 lfffrxf.exe 2492 hnbnhb.exe 2528 9htbhh.exe 2356 pjjpv.exe 1484 3xrxffl.exe 2448 nbthnh.exe 1896 ttbbhh.exe 2420 pdppd.exe 544 9pjdv.exe 1872 xrffxfr.exe 1600 5htbhh.exe 1144 dvddj.exe 1432 pjjdj.exe 1520 fxrfrxr.exe 2012 tnbthn.exe 2032 9htttt.exe 320 vppdj.exe 912 rllxflx.exe 1720 rlxfrrx.exe 1172 bttbhh.exe 1452 5hbhtt.exe 812 dpddj.exe 3064 pjdjj.exe 1556 9rxlrxf.exe 2864 5htbhh.exe 1412 jdvdd.exe 1620 jdvdd.exe 1704 jdvvd.exe 2312 7xlrxfr.exe 1208 nbnhhb.exe 1588 1thhhn.exe 2080 jjpjj.exe 2980 3lfxllr.exe 2976 lfxflrx.exe 2772 5hbthh.exe 2468 dvppp.exe 2752 5vjpd.exe 2476 xrrrffr.exe 2524 lfrxffr.exe 2924 nhbhtb.exe 2528 thbhnn.exe 1488 vppdp.exe 2692 3vpvv.exe 2532 xlflxfl.exe 2388 1hbntn.exe 2368 nhbbhh.exe 348 jdpjj.exe 1892 rlffffr.exe 1888 ntbtnb.exe 2684 btnttb.exe 1396 9pjjd.exe 2916 pjddd.exe 3016 rfxxxxf.exe 2640 frflrrx.exe 2240 5htbbb.exe 2184 ddvjp.exe 576 5ppdp.exe 2844 rxlrrfr.exe 1768 5rxxxrx.exe -
Processes:
resource yara_rule behavioral1/memory/3020-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1484-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1896-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/544-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1872-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1144-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1432-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2012-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1172-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1452-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3064-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1268-3218-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b94bf585f972e9e808660ae114423980_NeikiAnalytics.exennbtbb.exedvddj.exeflflxfr.exevvjdj.exedjjvd.exelfffrxf.exehnbnhb.exe9htbhh.exepjjpv.exe3xrxffl.exenbthnh.exettbbhh.exepdppd.exe9pjdv.exexrffxfr.exedescription pid process target process PID 3020 wrote to memory of 1268 3020 b94bf585f972e9e808660ae114423980_NeikiAnalytics.exe nnbtbb.exe PID 3020 wrote to memory of 1268 3020 b94bf585f972e9e808660ae114423980_NeikiAnalytics.exe nnbtbb.exe PID 3020 wrote to memory of 1268 3020 b94bf585f972e9e808660ae114423980_NeikiAnalytics.exe nnbtbb.exe PID 3020 wrote to memory of 1268 3020 b94bf585f972e9e808660ae114423980_NeikiAnalytics.exe nnbtbb.exe PID 1268 wrote to memory of 2980 1268 nnbtbb.exe dvddj.exe PID 1268 wrote to memory of 2980 1268 nnbtbb.exe dvddj.exe PID 1268 wrote to memory of 2980 1268 nnbtbb.exe dvddj.exe PID 1268 wrote to memory of 2980 1268 nnbtbb.exe dvddj.exe PID 2980 wrote to memory of 2672 2980 dvddj.exe flflxfr.exe PID 2980 wrote to memory of 2672 2980 dvddj.exe flflxfr.exe PID 2980 wrote to memory of 2672 2980 dvddj.exe flflxfr.exe PID 2980 wrote to memory of 2672 2980 dvddj.exe flflxfr.exe PID 2672 wrote to memory of 2468 2672 flflxfr.exe vvjdj.exe PID 2672 wrote to memory of 2468 2672 flflxfr.exe vvjdj.exe PID 2672 wrote to memory of 2468 2672 flflxfr.exe vvjdj.exe PID 2672 wrote to memory of 2468 2672 flflxfr.exe vvjdj.exe PID 2468 wrote to memory of 2680 2468 vvjdj.exe djjvd.exe PID 2468 wrote to memory of 2680 2468 vvjdj.exe djjvd.exe PID 2468 wrote to memory of 2680 2468 vvjdj.exe djjvd.exe PID 2468 wrote to memory of 2680 2468 vvjdj.exe djjvd.exe PID 2680 wrote to memory of 2576 2680 djjvd.exe lfffrxf.exe PID 2680 wrote to memory of 2576 2680 djjvd.exe lfffrxf.exe PID 2680 wrote to memory of 2576 2680 djjvd.exe lfffrxf.exe PID 2680 wrote to memory of 2576 2680 djjvd.exe lfffrxf.exe PID 2576 wrote to memory of 2492 2576 lfffrxf.exe hnbnhb.exe PID 2576 wrote to memory of 2492 2576 lfffrxf.exe hnbnhb.exe PID 2576 wrote to memory of 2492 2576 lfffrxf.exe hnbnhb.exe PID 2576 wrote to memory of 2492 2576 lfffrxf.exe hnbnhb.exe PID 2492 wrote to memory of 2528 2492 hnbnhb.exe 9htbhh.exe PID 2492 wrote to memory of 2528 2492 hnbnhb.exe 9htbhh.exe PID 2492 wrote to memory of 2528 2492 hnbnhb.exe 9htbhh.exe PID 2492 wrote to memory of 2528 2492 hnbnhb.exe 9htbhh.exe PID 2528 wrote to memory of 2356 2528 9htbhh.exe pjjpv.exe PID 2528 wrote to memory of 2356 2528 9htbhh.exe pjjpv.exe PID 2528 wrote to memory of 2356 2528 9htbhh.exe pjjpv.exe PID 2528 wrote to memory of 2356 2528 9htbhh.exe pjjpv.exe PID 2356 wrote to memory of 1484 2356 pjjpv.exe 3xrxffl.exe PID 2356 wrote to memory of 1484 2356 pjjpv.exe 3xrxffl.exe PID 2356 wrote to memory of 1484 2356 pjjpv.exe 3xrxffl.exe PID 2356 wrote to memory of 1484 2356 pjjpv.exe 3xrxffl.exe PID 1484 wrote to memory of 2448 1484 3xrxffl.exe nbthnh.exe PID 1484 wrote to memory of 2448 1484 3xrxffl.exe nbthnh.exe PID 1484 wrote to memory of 2448 1484 3xrxffl.exe nbthnh.exe PID 1484 wrote to memory of 2448 1484 3xrxffl.exe nbthnh.exe PID 2448 wrote to memory of 1896 2448 nbthnh.exe ttbbhh.exe PID 2448 wrote to memory of 1896 2448 nbthnh.exe ttbbhh.exe PID 2448 wrote to memory of 1896 2448 nbthnh.exe ttbbhh.exe PID 2448 wrote to memory of 1896 2448 nbthnh.exe ttbbhh.exe PID 1896 wrote to memory of 2420 1896 ttbbhh.exe pdppd.exe PID 1896 wrote to memory of 2420 1896 ttbbhh.exe pdppd.exe PID 1896 wrote to memory of 2420 1896 ttbbhh.exe pdppd.exe PID 1896 wrote to memory of 2420 1896 ttbbhh.exe pdppd.exe PID 2420 wrote to memory of 544 2420 pdppd.exe 9pjdv.exe PID 2420 wrote to memory of 544 2420 pdppd.exe 9pjdv.exe PID 2420 wrote to memory of 544 2420 pdppd.exe 9pjdv.exe PID 2420 wrote to memory of 544 2420 pdppd.exe 9pjdv.exe PID 544 wrote to memory of 1872 544 9pjdv.exe xrffxfr.exe PID 544 wrote to memory of 1872 544 9pjdv.exe xrffxfr.exe PID 544 wrote to memory of 1872 544 9pjdv.exe xrffxfr.exe PID 544 wrote to memory of 1872 544 9pjdv.exe xrffxfr.exe PID 1872 wrote to memory of 1600 1872 xrffxfr.exe 5htbhh.exe PID 1872 wrote to memory of 1600 1872 xrffxfr.exe 5htbhh.exe PID 1872 wrote to memory of 1600 1872 xrffxfr.exe 5htbhh.exe PID 1872 wrote to memory of 1600 1872 xrffxfr.exe 5htbhh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b94bf585f972e9e808660ae114423980_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b94bf585f972e9e808660ae114423980_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\nnbtbb.exec:\nnbtbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\dvddj.exec:\dvddj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\flflxfr.exec:\flflxfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\vvjdj.exec:\vvjdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\djjvd.exec:\djjvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\lfffrxf.exec:\lfffrxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\hnbnhb.exec:\hnbnhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\9htbhh.exec:\9htbhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\pjjpv.exec:\pjjpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\3xrxffl.exec:\3xrxffl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\nbthnh.exec:\nbthnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\ttbbhh.exec:\ttbbhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\pdppd.exec:\pdppd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\9pjdv.exec:\9pjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\xrffxfr.exec:\xrffxfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\5htbhh.exec:\5htbhh.exe17⤵
- Executes dropped EXE
PID:1600 -
\??\c:\dvddj.exec:\dvddj.exe18⤵
- Executes dropped EXE
PID:1144 -
\??\c:\pjjdj.exec:\pjjdj.exe19⤵
- Executes dropped EXE
PID:1432 -
\??\c:\fxrfrxr.exec:\fxrfrxr.exe20⤵
- Executes dropped EXE
PID:1520 -
\??\c:\tnbthn.exec:\tnbthn.exe21⤵
- Executes dropped EXE
PID:2012 -
\??\c:\9htttt.exec:\9htttt.exe22⤵
- Executes dropped EXE
PID:2032 -
\??\c:\vppdj.exec:\vppdj.exe23⤵
- Executes dropped EXE
PID:320 -
\??\c:\rllxflx.exec:\rllxflx.exe24⤵
- Executes dropped EXE
PID:912 -
\??\c:\rlxfrrx.exec:\rlxfrrx.exe25⤵
- Executes dropped EXE
PID:1720 -
\??\c:\bttbhh.exec:\bttbhh.exe26⤵
- Executes dropped EXE
PID:1172 -
\??\c:\5hbhtt.exec:\5hbhtt.exe27⤵
- Executes dropped EXE
PID:1452 -
\??\c:\dpddj.exec:\dpddj.exe28⤵
- Executes dropped EXE
PID:812 -
\??\c:\pjdjj.exec:\pjdjj.exe29⤵
- Executes dropped EXE
PID:3064 -
\??\c:\9rxlrxf.exec:\9rxlrxf.exe30⤵
- Executes dropped EXE
PID:1556 -
\??\c:\5htbhh.exec:\5htbhh.exe31⤵
- Executes dropped EXE
PID:2864 -
\??\c:\jdvdd.exec:\jdvdd.exe32⤵
- Executes dropped EXE
PID:1412 -
\??\c:\jdvdd.exec:\jdvdd.exe33⤵
- Executes dropped EXE
PID:1620 -
\??\c:\jdvvd.exec:\jdvvd.exe34⤵
- Executes dropped EXE
PID:1704 -
\??\c:\7xlrxfr.exec:\7xlrxfr.exe35⤵
- Executes dropped EXE
PID:2312 -
\??\c:\nbnhhb.exec:\nbnhhb.exe36⤵
- Executes dropped EXE
PID:1208 -
\??\c:\1thhhn.exec:\1thhhn.exe37⤵
- Executes dropped EXE
PID:1588 -
\??\c:\jjpjj.exec:\jjpjj.exe38⤵
- Executes dropped EXE
PID:2080 -
\??\c:\3lfxllr.exec:\3lfxllr.exe39⤵
- Executes dropped EXE
PID:2980 -
\??\c:\lfxflrx.exec:\lfxflrx.exe40⤵
- Executes dropped EXE
PID:2976 -
\??\c:\5hbthh.exec:\5hbthh.exe41⤵
- Executes dropped EXE
PID:2772 -
\??\c:\dvppp.exec:\dvppp.exe42⤵
- Executes dropped EXE
PID:2468 -
\??\c:\5vjpd.exec:\5vjpd.exe43⤵
- Executes dropped EXE
PID:2752 -
\??\c:\xrrrffr.exec:\xrrrffr.exe44⤵
- Executes dropped EXE
PID:2476 -
\??\c:\lfrxffr.exec:\lfrxffr.exe45⤵
- Executes dropped EXE
PID:2524 -
\??\c:\nhbhtb.exec:\nhbhtb.exe46⤵
- Executes dropped EXE
PID:2924 -
\??\c:\thbhnn.exec:\thbhnn.exe47⤵
- Executes dropped EXE
PID:2528 -
\??\c:\vppdp.exec:\vppdp.exe48⤵
- Executes dropped EXE
PID:1488 -
\??\c:\3vpvv.exec:\3vpvv.exe49⤵
- Executes dropped EXE
PID:2692 -
\??\c:\xlflxfl.exec:\xlflxfl.exe50⤵
- Executes dropped EXE
PID:2532 -
\??\c:\1hbntn.exec:\1hbntn.exe51⤵
- Executes dropped EXE
PID:2388 -
\??\c:\nhbbhh.exec:\nhbbhh.exe52⤵
- Executes dropped EXE
PID:2368 -
\??\c:\jdpjj.exec:\jdpjj.exe53⤵
- Executes dropped EXE
PID:348 -
\??\c:\rlffffr.exec:\rlffffr.exe54⤵
- Executes dropped EXE
PID:1892 -
\??\c:\ntbtnb.exec:\ntbtnb.exe55⤵
- Executes dropped EXE
PID:1888 -
\??\c:\btnttb.exec:\btnttb.exe56⤵
- Executes dropped EXE
PID:2684 -
\??\c:\9pjjd.exec:\9pjjd.exe57⤵
- Executes dropped EXE
PID:1396 -
\??\c:\pjddd.exec:\pjddd.exe58⤵
- Executes dropped EXE
PID:2916 -
\??\c:\rfxxxxf.exec:\rfxxxxf.exe59⤵
- Executes dropped EXE
PID:3016 -
\??\c:\frflrrx.exec:\frflrrx.exe60⤵
- Executes dropped EXE
PID:2640 -
\??\c:\5htbbb.exec:\5htbbb.exe61⤵
- Executes dropped EXE
PID:2240 -
\??\c:\ddvjp.exec:\ddvjp.exe62⤵
- Executes dropped EXE
PID:2184 -
\??\c:\5ppdp.exec:\5ppdp.exe63⤵
- Executes dropped EXE
PID:576 -
\??\c:\rxlrrfr.exec:\rxlrrfr.exe64⤵
- Executes dropped EXE
PID:2844 -
\??\c:\5rxxxrx.exec:\5rxxxrx.exe65⤵
- Executes dropped EXE
PID:1768 -
\??\c:\bthnhh.exec:\bthnhh.exe66⤵PID:584
-
\??\c:\nhhttt.exec:\nhhttt.exe67⤵PID:1456
-
\??\c:\jvpvj.exec:\jvpvj.exe68⤵PID:1280
-
\??\c:\vpjvd.exec:\vpjvd.exe69⤵PID:848
-
\??\c:\7vppv.exec:\7vppv.exe70⤵PID:568
-
\??\c:\lfxlxlx.exec:\lfxlxlx.exe71⤵PID:2544
-
\??\c:\3fffllr.exec:\3fffllr.exe72⤵PID:1840
-
\??\c:\tbnhnb.exec:\tbnhnb.exe73⤵PID:1908
-
\??\c:\hhtbbb.exec:\hhtbbb.exe74⤵PID:892
-
\??\c:\vpddj.exec:\vpddj.exe75⤵PID:1400
-
\??\c:\pdvvv.exec:\pdvvv.exe76⤵PID:2100
-
\??\c:\vpjjp.exec:\vpjjp.exe77⤵PID:2556
-
\??\c:\xrffllr.exec:\xrffllr.exe78⤵PID:1912
-
\??\c:\rlflxrf.exec:\rlflxrf.exe79⤵PID:2244
-
\??\c:\ttbnbb.exec:\ttbnbb.exe80⤵PID:3032
-
\??\c:\btbhtb.exec:\btbhtb.exe81⤵PID:2672
-
\??\c:\pdjpp.exec:\pdjpp.exe82⤵PID:2624
-
\??\c:\jjpvv.exec:\jjpvv.exe83⤵PID:2768
-
\??\c:\fxxflrf.exec:\fxxflrf.exe84⤵PID:2680
-
\??\c:\9lfxlfl.exec:\9lfxlfl.exe85⤵PID:2480
-
\??\c:\nnhnbh.exec:\nnhnbh.exe86⤵PID:2912
-
\??\c:\ddvdv.exec:\ddvdv.exe87⤵PID:2632
-
\??\c:\vpjvj.exec:\vpjvj.exe88⤵PID:2092
-
\??\c:\fxlrffr.exec:\fxlrffr.exe89⤵PID:2112
-
\??\c:\hthbnn.exec:\hthbnn.exe90⤵PID:2520
-
\??\c:\tnhhbh.exec:\tnhhbh.exe91⤵PID:1884
-
\??\c:\ddvdj.exec:\ddvdj.exe92⤵PID:1856
-
\??\c:\pdpvd.exec:\pdpvd.exe93⤵PID:1868
-
\??\c:\xrllrxf.exec:\xrllrxf.exe94⤵PID:1564
-
\??\c:\9llxlrx.exec:\9llxlrx.exe95⤵PID:352
-
\??\c:\xrflflr.exec:\xrflflr.exe96⤵PID:1924
-
\??\c:\thtbhh.exec:\thtbhh.exe97⤵PID:1424
-
\??\c:\vpvjd.exec:\vpvjd.exe98⤵PID:2116
-
\??\c:\vjdjp.exec:\vjdjp.exe99⤵PID:1460
-
\??\c:\frlrrrx.exec:\frlrrrx.exe100⤵PID:2220
-
\??\c:\1frffxx.exec:\1frffxx.exe101⤵PID:1820
-
\??\c:\bhtnth.exec:\bhtnth.exe102⤵PID:2012
-
\??\c:\tbbnhb.exec:\tbbnhb.exe103⤵PID:840
-
\??\c:\dpjvj.exec:\dpjvj.exe104⤵PID:688
-
\??\c:\vpvvj.exec:\vpvvj.exe105⤵PID:1068
-
\??\c:\lfrfxxx.exec:\lfrfxxx.exe106⤵PID:2704
-
\??\c:\xxxffxx.exec:\xxxffxx.exe107⤵PID:1532
-
\??\c:\hbbhnh.exec:\hbbhnh.exe108⤵PID:1680
-
\??\c:\5hnhtt.exec:\5hnhtt.exe109⤵PID:1452
-
\??\c:\pjjvd.exec:\pjjvd.exe110⤵PID:1736
-
\??\c:\1dpvp.exec:\1dpvp.exe111⤵PID:2956
-
\??\c:\rlxlrxl.exec:\rlxlrxl.exe112⤵PID:2052
-
\??\c:\rlrrffr.exec:\rlrrffr.exe113⤵PID:2072
-
\??\c:\nbhnhh.exec:\nbhnhh.exe114⤵PID:3040
-
\??\c:\tnbbhh.exec:\tnbbhh.exe115⤵PID:1412
-
\??\c:\1pjvd.exec:\1pjvd.exe116⤵PID:2892
-
\??\c:\vdppv.exec:\vdppv.exe117⤵PID:1828
-
\??\c:\fxxflll.exec:\fxxflll.exe118⤵PID:2984
-
\??\c:\lfllxxl.exec:\lfllxxl.exe119⤵PID:1508
-
\??\c:\nhntnn.exec:\nhntnn.exe120⤵PID:2612
-
\??\c:\hbtbtb.exec:\hbtbtb.exe121⤵PID:2736
-
\??\c:\jpvvd.exec:\jpvvd.exe122⤵PID:2668
-
\??\c:\jdpdd.exec:\jdpdd.exe123⤵PID:2588
-
\??\c:\vjvpv.exec:\vjvpv.exe124⤵PID:1716
-
\??\c:\rllrxxf.exec:\rllrxxf.exe125⤵PID:2804
-
\??\c:\ffrrfff.exec:\ffrrfff.exe126⤵PID:2472
-
\??\c:\tnbnbb.exec:\tnbnbb.exe127⤵PID:1984
-
\??\c:\tntbhh.exec:\tntbhh.exe128⤵PID:2636
-
\??\c:\5dpdp.exec:\5dpdp.exe129⤵PID:1512
-
\??\c:\pdppj.exec:\pdppj.exe130⤵PID:2356
-
\??\c:\9frrllx.exec:\9frrllx.exe131⤵PID:1348
-
\??\c:\flfrfxf.exec:\flfrfxf.exe132⤵PID:1852
-
\??\c:\hhntth.exec:\hhntth.exe133⤵PID:2412
-
\??\c:\nhntnt.exec:\nhntnt.exe134⤵PID:1896
-
\??\c:\dvpdp.exec:\dvpdp.exe135⤵PID:1608
-
\??\c:\jdjvp.exec:\jdjvp.exe136⤵PID:1876
-
\??\c:\lrxflxx.exec:\lrxflxx.exe137⤵PID:2728
-
\??\c:\xxrrffl.exec:\xxrrffl.exe138⤵PID:2156
-
\??\c:\3nnnbb.exec:\3nnnbb.exe139⤵PID:1144
-
\??\c:\nhtntt.exec:\nhtntt.exe140⤵PID:2900
-
\??\c:\jdvvj.exec:\jdvvj.exe141⤵PID:1672
-
\??\c:\1pjjp.exec:\1pjjp.exe142⤵PID:1204
-
\??\c:\7xllxxl.exec:\7xllxxl.exe143⤵PID:2204
-
\??\c:\xlxxlrx.exec:\xlxxlrx.exe144⤵PID:672
-
\??\c:\hthhnn.exec:\hthhnn.exe145⤵PID:332
-
\??\c:\9nbtht.exec:\9nbtht.exe146⤵PID:580
-
\??\c:\dvpvj.exec:\dvpvj.exe147⤵PID:2696
-
\??\c:\vpdpj.exec:\vpdpj.exe148⤵PID:2136
-
\??\c:\rfffrff.exec:\rfffrff.exe149⤵PID:1172
-
\??\c:\fxrxfxl.exec:\fxrxfxl.exe150⤵PID:1236
-
\??\c:\bnhnbb.exec:\bnhnbb.exe151⤵PID:956
-
\??\c:\3hbhhh.exec:\3hbhhh.exe152⤵PID:1736
-
\??\c:\vjjpj.exec:\vjjpj.exe153⤵PID:3064
-
\??\c:\dvdvd.exec:\dvdvd.exe154⤵PID:1556
-
\??\c:\jjddp.exec:\jjddp.exe155⤵PID:1140
-
\??\c:\rlfflrx.exec:\rlfflrx.exe156⤵PID:2944
-
\??\c:\lfrfrxf.exec:\lfrfrxf.exe157⤵PID:2392
-
\??\c:\bttbhn.exec:\bttbhn.exe158⤵PID:3028
-
\??\c:\bnbbhh.exec:\bnbbhh.exe159⤵PID:2644
-
\??\c:\vpdpj.exec:\vpdpj.exe160⤵PID:1956
-
\??\c:\jdppv.exec:\jdppv.exe161⤵PID:2592
-
\??\c:\lfxfrlx.exec:\lfxfrlx.exe162⤵PID:2732
-
\??\c:\frllxrx.exec:\frllxrx.exe163⤵PID:2340
-
\??\c:\5hthnn.exec:\5hthnn.exe164⤵PID:2616
-
\??\c:\bnnnbb.exec:\bnnnbb.exe165⤵PID:2484
-
\??\c:\5dpvd.exec:\5dpvd.exe166⤵PID:2516
-
\??\c:\jdvjd.exec:\jdvjd.exe167⤵PID:2460
-
\??\c:\fxllxfr.exec:\fxllxfr.exe168⤵PID:2904
-
\??\c:\5ffxflx.exec:\5ffxflx.exe169⤵PID:1696
-
\??\c:\nhbbhh.exec:\nhbbhh.exe170⤵PID:884
-
\??\c:\bnbhnn.exec:\bnbhnn.exe171⤵PID:112
-
\??\c:\ddppj.exec:\ddppj.exe172⤵PID:2436
-
\??\c:\pjdjj.exec:\pjdjj.exe173⤵PID:2716
-
\??\c:\rlfrxff.exec:\rlfrxff.exe174⤵PID:2688
-
\??\c:\7lffflr.exec:\7lffflr.exe175⤵PID:1780
-
\??\c:\9ffrrll.exec:\9ffrrll.exe176⤵PID:1896
-
\??\c:\hhbhbt.exec:\hhbhbt.exe177⤵PID:1756
-
\??\c:\hbbhhn.exec:\hbbhhn.exe178⤵PID:1664
-
\??\c:\vvdvj.exec:\vvdvj.exe179⤵PID:1860
-
\??\c:\dpdjj.exec:\dpdjj.exe180⤵PID:1428
-
\??\c:\flrllxf.exec:\flrllxf.exe181⤵PID:2928
-
\??\c:\xxxxllf.exec:\xxxxllf.exe182⤵PID:2808
-
\??\c:\tnbbbt.exec:\tnbbbt.exe183⤵PID:2212
-
\??\c:\hbbhnb.exec:\hbbhnb.exe184⤵PID:2196
-
\??\c:\jpdvd.exec:\jpdvd.exe185⤵PID:2076
-
\??\c:\dvvjv.exec:\dvvjv.exe186⤵PID:776
-
\??\c:\flrlxxx.exec:\flrlxxx.exe187⤵PID:1648
-
\??\c:\lfxfllr.exec:\lfxfllr.exe188⤵PID:980
-
\??\c:\tnnhnb.exec:\tnnhnb.exe189⤵PID:1120
-
\??\c:\btbhtb.exec:\btbhtb.exe190⤵PID:2424
-
\??\c:\dvdpp.exec:\dvdpp.exe191⤵PID:1516
-
\??\c:\pjddj.exec:\pjddj.exe192⤵PID:944
-
\??\c:\pdvdv.exec:\pdvdv.exe193⤵PID:1292
-
\??\c:\xrxxffr.exec:\xrxxffr.exe194⤵PID:2040
-
\??\c:\frrxrxf.exec:\frrxrxf.exe195⤵PID:2860
-
\??\c:\nhbnhn.exec:\nhbnhn.exe196⤵PID:984
-
\??\c:\btbhbb.exec:\btbhbb.exe197⤵PID:992
-
\??\c:\jdvvp.exec:\jdvvp.exe198⤵PID:2140
-
\??\c:\fxrrrrf.exec:\fxrrrrf.exe199⤵PID:3020
-
\??\c:\5xllxfl.exec:\5xllxfl.exe200⤵PID:2780
-
\??\c:\btthtb.exec:\btthtb.exe201⤵PID:1504
-
\??\c:\ddpvp.exec:\ddpvp.exe202⤵PID:2572
-
\??\c:\5jdjv.exec:\5jdjv.exe203⤵PID:2664
-
\??\c:\rfxfxfl.exec:\rfxfxfl.exe204⤵PID:2596
-
\??\c:\frffrlx.exec:\frffrlx.exe205⤵PID:2580
-
\??\c:\htnhnb.exec:\htnhnb.exe206⤵PID:2792
-
\??\c:\1btttt.exec:\1btttt.exe207⤵PID:2284
-
\??\c:\jdpdp.exec:\jdpdp.exe208⤵PID:2764
-
\??\c:\vppdv.exec:\vppdv.exe209⤵PID:2396
-
\??\c:\9fxlfrl.exec:\9fxlfrl.exe210⤵PID:2740
-
\??\c:\rlflflx.exec:\rlflflx.exe211⤵PID:2492
-
\??\c:\bnnbnh.exec:\bnnbnh.exe212⤵PID:2920
-
\??\c:\hhbhnt.exec:\hhbhnt.exe213⤵PID:2356
-
\??\c:\vvjvv.exec:\vvjvv.exe214⤵PID:1632
-
\??\c:\jjpvd.exec:\jjpvd.exe215⤵PID:2520
-
\??\c:\9lxxrrf.exec:\9lxxrrf.exe216⤵PID:2412
-
\??\c:\rlxrxfr.exec:\rlxrxfr.exe217⤵PID:2420
-
\??\c:\nhhnnb.exec:\nhhnnb.exe218⤵PID:2368
-
\??\c:\tnnhbb.exec:\tnnhbb.exe219⤵PID:1876
-
\??\c:\hbnthh.exec:\hbnthh.exe220⤵PID:1216
-
\??\c:\5pjvd.exec:\5pjvd.exe221⤵PID:2156
-
\??\c:\vpdvj.exec:\vpdvj.exe222⤵PID:1544
-
\??\c:\xrffllx.exec:\xrffllx.exe223⤵PID:2116
-
\??\c:\xrxlxfl.exec:\xrxlxfl.exe224⤵PID:1040
-
\??\c:\3tnbnn.exec:\3tnbnn.exe225⤵PID:2552
-
\??\c:\bnhhhn.exec:\bnhhhn.exe226⤵PID:2088
-
\??\c:\jppdv.exec:\jppdv.exe227⤵PID:320
-
\??\c:\lxfxxfr.exec:\lxfxxfr.exe228⤵PID:2184
-
\??\c:\xrffflr.exec:\xrffflr.exe229⤵PID:1068
-
\??\c:\3nntnt.exec:\3nntnt.exe230⤵PID:652
-
\??\c:\ttnttn.exec:\ttnttn.exe231⤵PID:2136
-
\??\c:\jjvjd.exec:\jjvjd.exe232⤵PID:868
-
\??\c:\jvjjv.exec:\jvjjv.exe233⤵PID:1236
-
\??\c:\fxllrrx.exec:\fxllrrx.exe234⤵PID:1720
-
\??\c:\fxlrxfr.exec:\fxlrxfr.exe235⤵PID:2956
-
\??\c:\nnntbb.exec:\nnntbb.exe236⤵PID:2008
-
\??\c:\nnnhnt.exec:\nnnhnt.exe237⤵PID:2072
-
\??\c:\vvpvv.exec:\vvpvv.exe238⤵PID:1708
-
\??\c:\1vvdp.exec:\1vvdp.exe239⤵PID:3040
-
\??\c:\1fffffr.exec:\1fffffr.exe240⤵PID:2872
-
\??\c:\rllrfrx.exec:\rllrfrx.exe241⤵PID:1400
-
\??\c:\nhtbnt.exec:\nhtbnt.exe242⤵PID:2292