Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 07:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9e406eca242d3fb52fc1742291ce6af0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
9e406eca242d3fb52fc1742291ce6af0_NeikiAnalytics.exe
-
Size
75KB
-
MD5
9e406eca242d3fb52fc1742291ce6af0
-
SHA1
2ee94824eaa219888275e2ac962884c79b2101bc
-
SHA256
1f85db2b769b1577051d156e6fe0c8b13b48f32ebc980dfbdf1f643d1db1d7d9
-
SHA512
97e1261f12730b9095e8d813411888f3d2701ba482e8753170941114a78655f5f74198754bfc09baa790558a90a2f71c8d762ec712ed0941b4ceb14a80a6d328
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5Q:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCK
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/2360-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/772-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/772-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1972-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2472-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2340-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1456-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1988-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1744-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1860-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1976-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/640-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1232-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1016-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pppvd.exe5rllflx.exejvdvd.exeffrrlxl.exelxlfllx.exehhbhbt.exeddppj.exelflrfrf.exexflxlfr.exennbhtb.exeppvpp.exe1vpjv.exerxlxfrr.exehhbbnt.exenbnbbb.exevvpdd.exelrrffff.exehbthth.exevpddp.exevpddj.exelfxlrxl.exehbnntt.exepjdjv.exepjdvj.exelfrxffr.exenbnnhb.exebbntbh.exe5pjjp.exelxflxfr.exexlrrfxx.exebtbbht.exevpdjj.exepvjvp.exerflflfr.exebhhnbb.exetnbhnn.exeddvjd.exe5jdvd.exe1xxflxl.exexlxfrxx.exennttht.exeppvdj.exevpvvv.exeflfffxx.exetthhbt.exepvdvv.exexlrxffr.exe9rxfllr.exebbtbhn.exe3btthn.exe9vvdd.exerrrflxr.exefxrfrfr.exelxlrffl.exehhtbtt.exeppjvj.exe7jvpp.exe7rflxxf.exebbthbh.exeppddp.exeddpvd.exexrlxfxl.exe3xxfrfr.exenbntbb.exepid process 2988 pppvd.exe 772 5rllflx.exe 1972 jvdvd.exe 2660 ffrrlxl.exe 2600 lxlfllx.exe 2492 hhbhbt.exe 2740 ddppj.exe 2472 lflrfrf.exe 2900 xflxlfr.exe 2340 nnbhtb.exe 2632 ppvpp.exe 2444 1vpjv.exe 2824 rxlxfrr.exe 1456 hhbbnt.exe 2864 nbnbbb.exe 1988 vvpdd.exe 2820 lrrffff.exe 2120 hbthth.exe 1744 vpddp.exe 1860 vpddj.exe 1976 lfxlrxl.exe 600 hbnntt.exe 640 pjdjv.exe 1840 pjdvj.exe 344 lfrxffr.exe 2212 nbnnhb.exe 1076 bbntbh.exe 1232 5pjjp.exe 108 lxflxfr.exe 1016 xlrrfxx.exe 1692 btbbht.exe 1992 vpdjj.exe 2992 pvjvp.exe 1568 rflflfr.exe 3064 bhhnbb.exe 2324 tnbhnn.exe 1972 ddvjd.exe 2612 5jdvd.exe 1132 1xxflxl.exe 2692 xlxfrxx.exe 2492 nnttht.exe 2456 ppvdj.exe 2532 vpvvv.exe 3024 flfffxx.exe 2924 tthhbt.exe 2796 pvdvv.exe 2860 xlrxffr.exe 2884 9rxfllr.exe 2444 bbtbhn.exe 2348 3btthn.exe 2544 9vvdd.exe 2816 rrrflxr.exe 2888 fxrfrfr.exe 1272 lxlrffl.exe 2156 hhtbtt.exe 2908 ppjvj.exe 1300 7jvpp.exe 1748 7rflxxf.exe 696 bbthbh.exe 488 ppddp.exe 600 ddpvd.exe 1460 xrlxfxl.exe 1804 3xxfrfr.exe 1148 nbntbb.exe -
Processes:
resource yara_rule behavioral1/memory/2360-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/772-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/772-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1972-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1456-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1988-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1744-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1860-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/640-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1232-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1016-291-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9e406eca242d3fb52fc1742291ce6af0_NeikiAnalytics.exepppvd.exe5rllflx.exejvdvd.exeffrrlxl.exelxlfllx.exehhbhbt.exeddppj.exelflrfrf.exexflxlfr.exennbhtb.exeppvpp.exe1vpjv.exerxlxfrr.exehhbbnt.exenbnbbb.exedescription pid process target process PID 2360 wrote to memory of 2988 2360 9e406eca242d3fb52fc1742291ce6af0_NeikiAnalytics.exe pppvd.exe PID 2360 wrote to memory of 2988 2360 9e406eca242d3fb52fc1742291ce6af0_NeikiAnalytics.exe pppvd.exe PID 2360 wrote to memory of 2988 2360 9e406eca242d3fb52fc1742291ce6af0_NeikiAnalytics.exe pppvd.exe PID 2360 wrote to memory of 2988 2360 9e406eca242d3fb52fc1742291ce6af0_NeikiAnalytics.exe pppvd.exe PID 2988 wrote to memory of 772 2988 pppvd.exe 5rllflx.exe PID 2988 wrote to memory of 772 2988 pppvd.exe 5rllflx.exe PID 2988 wrote to memory of 772 2988 pppvd.exe 5rllflx.exe PID 2988 wrote to memory of 772 2988 pppvd.exe 5rllflx.exe PID 772 wrote to memory of 1972 772 5rllflx.exe jvdvd.exe PID 772 wrote to memory of 1972 772 5rllflx.exe jvdvd.exe PID 772 wrote to memory of 1972 772 5rllflx.exe jvdvd.exe PID 772 wrote to memory of 1972 772 5rllflx.exe jvdvd.exe PID 1972 wrote to memory of 2660 1972 jvdvd.exe ffrrlxl.exe PID 1972 wrote to memory of 2660 1972 jvdvd.exe ffrrlxl.exe PID 1972 wrote to memory of 2660 1972 jvdvd.exe ffrrlxl.exe PID 1972 wrote to memory of 2660 1972 jvdvd.exe ffrrlxl.exe PID 2660 wrote to memory of 2600 2660 ffrrlxl.exe lxlfllx.exe PID 2660 wrote to memory of 2600 2660 ffrrlxl.exe lxlfllx.exe PID 2660 wrote to memory of 2600 2660 ffrrlxl.exe lxlfllx.exe PID 2660 wrote to memory of 2600 2660 ffrrlxl.exe lxlfllx.exe PID 2600 wrote to memory of 2492 2600 lxlfllx.exe hhbhbt.exe PID 2600 wrote to memory of 2492 2600 lxlfllx.exe hhbhbt.exe PID 2600 wrote to memory of 2492 2600 lxlfllx.exe hhbhbt.exe PID 2600 wrote to memory of 2492 2600 lxlfllx.exe hhbhbt.exe PID 2492 wrote to memory of 2740 2492 hhbhbt.exe ddppj.exe PID 2492 wrote to memory of 2740 2492 hhbhbt.exe ddppj.exe PID 2492 wrote to memory of 2740 2492 hhbhbt.exe ddppj.exe PID 2492 wrote to memory of 2740 2492 hhbhbt.exe ddppj.exe PID 2740 wrote to memory of 2472 2740 ddppj.exe lflrfrf.exe PID 2740 wrote to memory of 2472 2740 ddppj.exe lflrfrf.exe PID 2740 wrote to memory of 2472 2740 ddppj.exe lflrfrf.exe PID 2740 wrote to memory of 2472 2740 ddppj.exe lflrfrf.exe PID 2472 wrote to memory of 2900 2472 lflrfrf.exe xflxlfr.exe PID 2472 wrote to memory of 2900 2472 lflrfrf.exe xflxlfr.exe PID 2472 wrote to memory of 2900 2472 lflrfrf.exe xflxlfr.exe PID 2472 wrote to memory of 2900 2472 lflrfrf.exe xflxlfr.exe PID 2900 wrote to memory of 2340 2900 xflxlfr.exe nnbhtb.exe PID 2900 wrote to memory of 2340 2900 xflxlfr.exe nnbhtb.exe PID 2900 wrote to memory of 2340 2900 xflxlfr.exe nnbhtb.exe PID 2900 wrote to memory of 2340 2900 xflxlfr.exe nnbhtb.exe PID 2340 wrote to memory of 2632 2340 nnbhtb.exe ppvpp.exe PID 2340 wrote to memory of 2632 2340 nnbhtb.exe ppvpp.exe PID 2340 wrote to memory of 2632 2340 nnbhtb.exe ppvpp.exe PID 2340 wrote to memory of 2632 2340 nnbhtb.exe ppvpp.exe PID 2632 wrote to memory of 2444 2632 ppvpp.exe 1vpjv.exe PID 2632 wrote to memory of 2444 2632 ppvpp.exe 1vpjv.exe PID 2632 wrote to memory of 2444 2632 ppvpp.exe 1vpjv.exe PID 2632 wrote to memory of 2444 2632 ppvpp.exe 1vpjv.exe PID 2444 wrote to memory of 2824 2444 1vpjv.exe rxlxfrr.exe PID 2444 wrote to memory of 2824 2444 1vpjv.exe rxlxfrr.exe PID 2444 wrote to memory of 2824 2444 1vpjv.exe rxlxfrr.exe PID 2444 wrote to memory of 2824 2444 1vpjv.exe rxlxfrr.exe PID 2824 wrote to memory of 1456 2824 rxlxfrr.exe hhbbnt.exe PID 2824 wrote to memory of 1456 2824 rxlxfrr.exe hhbbnt.exe PID 2824 wrote to memory of 1456 2824 rxlxfrr.exe hhbbnt.exe PID 2824 wrote to memory of 1456 2824 rxlxfrr.exe hhbbnt.exe PID 1456 wrote to memory of 2864 1456 hhbbnt.exe nbnbbb.exe PID 1456 wrote to memory of 2864 1456 hhbbnt.exe nbnbbb.exe PID 1456 wrote to memory of 2864 1456 hhbbnt.exe nbnbbb.exe PID 1456 wrote to memory of 2864 1456 hhbbnt.exe nbnbbb.exe PID 2864 wrote to memory of 1988 2864 nbnbbb.exe vvpdd.exe PID 2864 wrote to memory of 1988 2864 nbnbbb.exe vvpdd.exe PID 2864 wrote to memory of 1988 2864 nbnbbb.exe vvpdd.exe PID 2864 wrote to memory of 1988 2864 nbnbbb.exe vvpdd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e406eca242d3fb52fc1742291ce6af0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9e406eca242d3fb52fc1742291ce6af0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\pppvd.exec:\pppvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\5rllflx.exec:\5rllflx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\jvdvd.exec:\jvdvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\ffrrlxl.exec:\ffrrlxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\lxlfllx.exec:\lxlfllx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\hhbhbt.exec:\hhbhbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\ddppj.exec:\ddppj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\lflrfrf.exec:\lflrfrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\xflxlfr.exec:\xflxlfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\nnbhtb.exec:\nnbhtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\ppvpp.exec:\ppvpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\1vpjv.exec:\1vpjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\rxlxfrr.exec:\rxlxfrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\hhbbnt.exec:\hhbbnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\nbnbbb.exec:\nbnbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\vvpdd.exec:\vvpdd.exe17⤵
- Executes dropped EXE
PID:1988 -
\??\c:\lrrffff.exec:\lrrffff.exe18⤵
- Executes dropped EXE
PID:2820 -
\??\c:\hbthth.exec:\hbthth.exe19⤵
- Executes dropped EXE
PID:2120 -
\??\c:\vpddp.exec:\vpddp.exe20⤵
- Executes dropped EXE
PID:1744 -
\??\c:\vpddj.exec:\vpddj.exe21⤵
- Executes dropped EXE
PID:1860 -
\??\c:\lfxlrxl.exec:\lfxlrxl.exe22⤵
- Executes dropped EXE
PID:1976 -
\??\c:\hbnntt.exec:\hbnntt.exe23⤵
- Executes dropped EXE
PID:600 -
\??\c:\pjdjv.exec:\pjdjv.exe24⤵
- Executes dropped EXE
PID:640 -
\??\c:\pjdvj.exec:\pjdvj.exe25⤵
- Executes dropped EXE
PID:1840 -
\??\c:\lfrxffr.exec:\lfrxffr.exe26⤵
- Executes dropped EXE
PID:344 -
\??\c:\nbnnhb.exec:\nbnnhb.exe27⤵
- Executes dropped EXE
PID:2212 -
\??\c:\bbntbh.exec:\bbntbh.exe28⤵
- Executes dropped EXE
PID:1076 -
\??\c:\5pjjp.exec:\5pjjp.exe29⤵
- Executes dropped EXE
PID:1232 -
\??\c:\lxflxfr.exec:\lxflxfr.exe30⤵
- Executes dropped EXE
PID:108 -
\??\c:\xlrrfxx.exec:\xlrrfxx.exe31⤵
- Executes dropped EXE
PID:1016 -
\??\c:\btbbht.exec:\btbbht.exe32⤵
- Executes dropped EXE
PID:1692 -
\??\c:\vpdjj.exec:\vpdjj.exe33⤵
- Executes dropped EXE
PID:1992 -
\??\c:\pvjvp.exec:\pvjvp.exe34⤵
- Executes dropped EXE
PID:2992 -
\??\c:\rflflfr.exec:\rflflfr.exe35⤵
- Executes dropped EXE
PID:1568 -
\??\c:\bhhnbb.exec:\bhhnbb.exe36⤵
- Executes dropped EXE
PID:3064 -
\??\c:\tnbhnn.exec:\tnbhnn.exe37⤵
- Executes dropped EXE
PID:2324 -
\??\c:\ddvjd.exec:\ddvjd.exe38⤵
- Executes dropped EXE
PID:1972 -
\??\c:\5jdvd.exec:\5jdvd.exe39⤵
- Executes dropped EXE
PID:2612 -
\??\c:\1xxflxl.exec:\1xxflxl.exe40⤵
- Executes dropped EXE
PID:1132 -
\??\c:\xlxfrxx.exec:\xlxfrxx.exe41⤵
- Executes dropped EXE
PID:2692 -
\??\c:\nnttht.exec:\nnttht.exe42⤵
- Executes dropped EXE
PID:2492 -
\??\c:\ppvdj.exec:\ppvdj.exe43⤵
- Executes dropped EXE
PID:2456 -
\??\c:\vpvvv.exec:\vpvvv.exe44⤵
- Executes dropped EXE
PID:2532 -
\??\c:\flfffxx.exec:\flfffxx.exe45⤵
- Executes dropped EXE
PID:3024 -
\??\c:\tthhbt.exec:\tthhbt.exe46⤵
- Executes dropped EXE
PID:2924 -
\??\c:\pvdvv.exec:\pvdvv.exe47⤵
- Executes dropped EXE
PID:2796 -
\??\c:\xlrxffr.exec:\xlrxffr.exe48⤵
- Executes dropped EXE
PID:2860 -
\??\c:\9rxfllr.exec:\9rxfllr.exe49⤵
- Executes dropped EXE
PID:2884 -
\??\c:\bbtbhn.exec:\bbtbhn.exe50⤵
- Executes dropped EXE
PID:2444 -
\??\c:\3btthn.exec:\3btthn.exe51⤵
- Executes dropped EXE
PID:2348 -
\??\c:\9vvdd.exec:\9vvdd.exe52⤵
- Executes dropped EXE
PID:2544 -
\??\c:\rrrflxr.exec:\rrrflxr.exe53⤵
- Executes dropped EXE
PID:2816 -
\??\c:\fxrfrfr.exec:\fxrfrfr.exe54⤵
- Executes dropped EXE
PID:2888 -
\??\c:\lxlrffl.exec:\lxlrffl.exe55⤵
- Executes dropped EXE
PID:1272 -
\??\c:\hhtbtt.exec:\hhtbtt.exe56⤵
- Executes dropped EXE
PID:2156 -
\??\c:\ppjvj.exec:\ppjvj.exe57⤵
- Executes dropped EXE
PID:2908 -
\??\c:\7jvpp.exec:\7jvpp.exe58⤵
- Executes dropped EXE
PID:1300 -
\??\c:\7rflxxf.exec:\7rflxxf.exe59⤵
- Executes dropped EXE
PID:1748 -
\??\c:\bbthbh.exec:\bbthbh.exe60⤵
- Executes dropped EXE
PID:696 -
\??\c:\ppddp.exec:\ppddp.exe61⤵
- Executes dropped EXE
PID:488 -
\??\c:\ddpvd.exec:\ddpvd.exe62⤵
- Executes dropped EXE
PID:600 -
\??\c:\xrlxfxl.exec:\xrlxfxl.exe63⤵
- Executes dropped EXE
PID:1460 -
\??\c:\3xxfrfr.exec:\3xxfrfr.exe64⤵
- Executes dropped EXE
PID:1804 -
\??\c:\nbntbb.exec:\nbntbb.exe65⤵
- Executes dropped EXE
PID:1148 -
\??\c:\1btnhn.exec:\1btnhn.exe66⤵PID:344
-
\??\c:\jvjpp.exec:\jvjpp.exe67⤵PID:1876
-
\??\c:\flfrfff.exec:\flfrfff.exe68⤵PID:2236
-
\??\c:\xrflxfl.exec:\xrflxfl.exe69⤵PID:1680
-
\??\c:\thtthh.exec:\thtthh.exe70⤵PID:2256
-
\??\c:\thnhnn.exec:\thnhnn.exe71⤵PID:108
-
\??\c:\jjpjj.exec:\jjpjj.exe72⤵PID:2276
-
\??\c:\frfrrxf.exec:\frfrrxf.exe73⤵PID:1372
-
\??\c:\xfrlrll.exec:\xfrlrll.exe74⤵PID:1088
-
\??\c:\bbhthn.exec:\bbhthn.exe75⤵PID:1824
-
\??\c:\hnntth.exec:\hnntth.exe76⤵PID:2992
-
\??\c:\jddpj.exec:\jddpj.exe77⤵PID:3056
-
\??\c:\vjvjj.exec:\vjvjj.exe78⤵PID:3064
-
\??\c:\9lrrxxl.exec:\9lrrxxl.exe79⤵PID:2100
-
\??\c:\rrrfxrl.exec:\rrrfxrl.exe80⤵PID:2704
-
\??\c:\5nbhnn.exec:\5nbhnn.exe81⤵PID:2952
-
\??\c:\hnbnnh.exec:\hnbnnh.exe82⤵PID:2616
-
\??\c:\jpvpp.exec:\jpvpp.exe83⤵PID:2052
-
\??\c:\jjpjj.exec:\jjpjj.exe84⤵PID:1668
-
\??\c:\xrflrlr.exec:\xrflrlr.exe85⤵PID:2468
-
\??\c:\rlxfrlr.exec:\rlxfrlr.exe86⤵PID:2520
-
\??\c:\5hbntb.exec:\5hbntb.exe87⤵PID:320
-
\??\c:\9nbnhh.exec:\9nbnhh.exe88⤵PID:2924
-
\??\c:\3dpvj.exec:\3dpvj.exe89⤵PID:2876
-
\??\c:\xfrllff.exec:\xfrllff.exe90⤵PID:2860
-
\??\c:\rlxlrrx.exec:\rlxlrrx.exe91⤵PID:1632
-
\??\c:\bnnnbb.exec:\bnnnbb.exe92⤵PID:2444
-
\??\c:\bbnbnn.exec:\bbnbnn.exe93⤵PID:2788
-
\??\c:\ddvvd.exec:\ddvvd.exe94⤵PID:2852
-
\??\c:\1jdjj.exec:\1jdjj.exe95⤵PID:2880
-
\??\c:\3ffrlxl.exec:\3ffrlxl.exe96⤵PID:2868
-
\??\c:\lfrfllx.exec:\lfrfllx.exe97⤵PID:1532
-
\??\c:\1btbtb.exec:\1btbtb.exe98⤵PID:2156
-
\??\c:\hhbntn.exec:\hhbntn.exe99⤵PID:2220
-
\??\c:\dvppd.exec:\dvppd.exe100⤵PID:268
-
\??\c:\jjdpj.exec:\jjdpj.exe101⤵PID:1960
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe102⤵PID:1004
-
\??\c:\rrlfllf.exec:\rrlfllf.exe103⤵PID:1168
-
\??\c:\hbtbnh.exec:\hbtbnh.exe104⤵PID:600
-
\??\c:\thhhnh.exec:\thhhnh.exe105⤵PID:960
-
\??\c:\pjvjd.exec:\pjvjd.exe106⤵PID:1804
-
\??\c:\ppddp.exec:\ppddp.exe107⤵PID:412
-
\??\c:\rrlfxfr.exec:\rrlfxfr.exe108⤵PID:344
-
\??\c:\ffffrrf.exec:\ffffrrf.exe109⤵PID:1080
-
\??\c:\7xrlxlr.exec:\7xrlxlr.exe110⤵PID:2236
-
\??\c:\9bbnhn.exec:\9bbnhn.exe111⤵PID:2976
-
\??\c:\bbtbnn.exec:\bbtbnn.exe112⤵PID:332
-
\??\c:\ppjdp.exec:\ppjdp.exe113⤵PID:768
-
\??\c:\5vvjv.exec:\5vvjv.exe114⤵PID:2420
-
\??\c:\llfxxrl.exec:\llfxxrl.exe115⤵PID:1596
-
\??\c:\rxflllx.exec:\rxflllx.exe116⤵PID:1600
-
\??\c:\rrxffrl.exec:\rrxffrl.exe117⤵PID:3052
-
\??\c:\tntthn.exec:\tntthn.exe118⤵PID:2596
-
\??\c:\bbthbh.exec:\bbthbh.exe119⤵PID:2664
-
\??\c:\5pvjj.exec:\5pvjj.exe120⤵PID:2956
-
\??\c:\dvjjv.exec:\dvjjv.exe121⤵PID:2464
-
\??\c:\xlfllxl.exec:\xlfllxl.exe122⤵PID:2732
-
\??\c:\xxrllll.exec:\xxrllll.exe123⤵PID:2592
-
\??\c:\9bnbnt.exec:\9bnbnt.exe124⤵PID:2912
-
\??\c:\1hhbhb.exec:\1hhbhb.exe125⤵PID:2516
-
\??\c:\dpvvd.exec:\dpvvd.exe126⤵PID:2576
-
\??\c:\vdjvv.exec:\vdjvv.exe127⤵PID:2176
-
\??\c:\rrlxflx.exec:\rrlxflx.exe128⤵PID:3036
-
\??\c:\xrlrlxf.exec:\xrlrlxf.exe129⤵PID:2792
-
\??\c:\nnhbbn.exec:\nnhbbn.exe130⤵PID:2672
-
\??\c:\dddjp.exec:\dddjp.exe131⤵PID:2764
-
\??\c:\1dpdj.exec:\1dpdj.exe132⤵PID:2020
-
\??\c:\pppdv.exec:\pppdv.exe133⤵PID:1816
-
\??\c:\ffrxlrl.exec:\ffrxlrl.exe134⤵PID:2844
-
\??\c:\xrflfrf.exec:\xrflfrf.exe135⤵PID:2864
-
\??\c:\tthtnt.exec:\tthtnt.exe136⤵PID:1592
-
\??\c:\tthhbb.exec:\tthhbb.exe137⤵PID:2820
-
\??\c:\dpjdj.exec:\dpjdj.exe138⤵PID:2296
-
\??\c:\pjpdp.exec:\pjpdp.exe139⤵PID:856
-
\??\c:\xrlxrrx.exec:\xrlxrrx.exe140⤵PID:1956
-
\??\c:\lfrlrxl.exec:\lfrlrxl.exe141⤵PID:1300
-
\??\c:\btbhbn.exec:\btbhbn.exe142⤵PID:2112
-
\??\c:\hhtbhn.exec:\hhtbhn.exe143⤵PID:1656
-
\??\c:\vdppj.exec:\vdppj.exe144⤵PID:1496
-
\??\c:\ppjvd.exec:\ppjvd.exe145⤵PID:1168
-
\??\c:\9pvpj.exec:\9pvpj.exe146⤵PID:384
-
\??\c:\fxxrxrx.exec:\fxxrxrx.exe147⤵PID:2136
-
\??\c:\xflllff.exec:\xflllff.exe148⤵PID:764
-
\??\c:\7nbbbb.exec:\7nbbbb.exe149⤵PID:692
-
\??\c:\nhbhnt.exec:\nhbhnt.exe150⤵PID:2368
-
\??\c:\pjjpd.exec:\pjjpd.exe151⤵PID:2192
-
\??\c:\jvjjv.exec:\jvjjv.exe152⤵PID:2080
-
\??\c:\xrflfrf.exec:\xrflfrf.exe153⤵PID:1776
-
\??\c:\rlxlrfr.exec:\rlxlrfr.exe154⤵PID:1828
-
\??\c:\tnbhth.exec:\tnbhth.exe155⤵PID:2536
-
\??\c:\bnhtth.exec:\bnhtth.exe156⤵PID:2936
-
\??\c:\pvvjp.exec:\pvvjp.exe157⤵PID:1604
-
\??\c:\vvjvj.exec:\vvjvj.exe158⤵PID:2668
-
\??\c:\xrllrrf.exec:\xrllrrf.exe159⤵PID:772
-
\??\c:\rfllrfl.exec:\rfllrfl.exe160⤵PID:2720
-
\??\c:\ntbbtb.exec:\ntbbtb.exe161⤵PID:2708
-
\??\c:\nnhttn.exec:\nnhttn.exe162⤵PID:1972
-
\??\c:\9dvvj.exec:\9dvvj.exe163⤵PID:2748
-
\??\c:\9jvdp.exec:\9jvdp.exe164⤵PID:2496
-
\??\c:\7fxxxxf.exec:\7fxxxxf.exe165⤵PID:2620
-
\??\c:\7frxlxr.exec:\7frxlxr.exe166⤵PID:2460
-
\??\c:\bhbbnh.exec:\bhbbnh.exe167⤵PID:1984
-
\??\c:\vpjjj.exec:\vpjjj.exe168⤵PID:3024
-
\??\c:\frxllfx.exec:\frxllfx.exe169⤵PID:1396
-
\??\c:\tthhth.exec:\tthhth.exe170⤵PID:2872
-
\??\c:\dddjp.exec:\dddjp.exe171⤵PID:2696
-
\??\c:\rflrlxl.exec:\rflrlxl.exe172⤵PID:2780
-
\??\c:\rlrfrxf.exec:\rlrfrxf.exe173⤵PID:2848
-
\??\c:\htttbn.exec:\htttbn.exe174⤵PID:2020
-
\??\c:\thbnnn.exec:\thbnnn.exe175⤵PID:1548
-
\??\c:\1jvvd.exec:\1jvvd.exe176⤵PID:2852
-
\??\c:\vpvvd.exec:\vpvvd.exe177⤵PID:2816
-
\??\c:\fxlxffr.exec:\fxlxffr.exe178⤵PID:3044
-
\??\c:\7lflrxf.exec:\7lflrxf.exe179⤵PID:1272
-
\??\c:\nnnntt.exec:\nnnntt.exe180⤵PID:2908
-
\??\c:\1tntbb.exec:\1tntbb.exe181⤵PID:2316
-
\??\c:\9dppv.exec:\9dppv.exe182⤵PID:1728
-
\??\c:\dpvjd.exec:\dpvjd.exe183⤵PID:1748
-
\??\c:\9xllxxf.exec:\9xllxxf.exe184⤵PID:1004
-
\??\c:\lrlflxf.exec:\lrlflxf.exe185⤵PID:1624
-
\??\c:\bttbhb.exec:\bttbhb.exe186⤵PID:600
-
\??\c:\3hbhbn.exec:\3hbhbn.exe187⤵PID:668
-
\??\c:\7pdjp.exec:\7pdjp.exe188⤵PID:1804
-
\??\c:\jjdjd.exec:\jjdjd.exe189⤵PID:1148
-
\??\c:\rrlxlxr.exec:\rrlxlxr.exe190⤵PID:328
-
\??\c:\7fxrlxr.exec:\7fxrlxr.exe191⤵PID:656
-
\??\c:\tbhbhh.exec:\tbhbhh.exe192⤵PID:2236
-
\??\c:\ntbbhh.exec:\ntbbhh.exe193⤵PID:2976
-
\??\c:\djpvp.exec:\djpvp.exe194⤵PID:332
-
\??\c:\xrrxfrl.exec:\xrrxfrl.exe195⤵PID:768
-
\??\c:\rxfflxr.exec:\rxfflxr.exe196⤵PID:1372
-
\??\c:\nnbhtt.exec:\nnbhtt.exe197⤵PID:472
-
\??\c:\7ntnbh.exec:\7ntnbh.exe198⤵PID:3008
-
\??\c:\pjvdj.exec:\pjvdj.exe199⤵PID:3052
-
\??\c:\1jjvj.exec:\1jjvj.exe200⤵PID:2644
-
\??\c:\9lflrrf.exec:\9lflrrf.exe201⤵PID:2584
-
\??\c:\ffxlfrl.exec:\ffxlfrl.exe202⤵PID:2704
-
\??\c:\ttnnhn.exec:\ttnnhn.exe203⤵PID:2464
-
\??\c:\ttnbhn.exec:\ttnbhn.exe204⤵PID:2732
-
\??\c:\7hhnbn.exec:\7hhnbn.exe205⤵PID:2724
-
\??\c:\ppdjp.exec:\ppdjp.exe206⤵PID:2508
-
\??\c:\9vdjv.exec:\9vdjv.exe207⤵PID:2516
-
\??\c:\lfrlxxr.exec:\lfrlxxr.exe208⤵PID:3032
-
\??\c:\frxffxr.exec:\frxffxr.exe209⤵PID:2176
-
\??\c:\nhntbb.exec:\nhntbb.exe210⤵PID:1208
-
\??\c:\hhttbn.exec:\hhttbn.exe211⤵PID:2792
-
\??\c:\tnthtb.exec:\tnthtb.exe212⤵PID:2672
-
\??\c:\dddpp.exec:\dddpp.exe213⤵PID:2764
-
\??\c:\dpdvd.exec:\dpdvd.exe214⤵PID:1764
-
\??\c:\9rfrlxl.exec:\9rfrlxl.exe215⤵PID:1816
-
\??\c:\9xlxxfx.exec:\9xlxxfx.exe216⤵PID:2020
-
\??\c:\bnbbtb.exec:\bnbbtb.exe217⤵PID:1988
-
\??\c:\nnnthn.exec:\nnnthn.exe218⤵PID:1592
-
\??\c:\jddjv.exec:\jddjv.exe219⤵PID:2820
-
\??\c:\5dvjv.exec:\5dvjv.exe220⤵PID:2184
-
\??\c:\xrlrlrf.exec:\xrlrlrf.exe221⤵PID:856
-
\??\c:\rfrrrff.exec:\rfrrrff.exe222⤵PID:540
-
\??\c:\btntbb.exec:\btntbb.exe223⤵PID:2424
-
\??\c:\3nhtnn.exec:\3nhtnn.exe224⤵PID:2112
-
\??\c:\btbntb.exec:\btbntb.exe225⤵PID:1504
-
\??\c:\5vdvd.exec:\5vdvd.exe226⤵PID:1496
-
\??\c:\vpdjv.exec:\vpdjv.exe227⤵PID:960
-
\??\c:\lfxfrrx.exec:\lfxfrrx.exe228⤵PID:1760
-
\??\c:\rlrlxfl.exec:\rlrlxfl.exe229⤵PID:2136
-
\??\c:\9tnbth.exec:\9tnbth.exe230⤵PID:764
-
\??\c:\nbttht.exec:\nbttht.exe231⤵PID:2356
-
\??\c:\vjpvv.exec:\vjpvv.exe232⤵PID:2212
-
\??\c:\pppjv.exec:\pppjv.exe233⤵PID:1572
-
\??\c:\xlxxlrr.exec:\xlxxlrr.exe234⤵PID:2192
-
\??\c:\llrllrl.exec:\llrllrl.exe235⤵PID:1768
-
\??\c:\hthttt.exec:\hthttt.exe236⤵PID:3000
-
\??\c:\hnbbth.exec:\hnbbth.exe237⤵PID:2276
-
\??\c:\pjdjd.exec:\pjdjd.exe238⤵PID:2988
-
\??\c:\pjpjj.exec:\pjpjj.exe239⤵PID:1660
-
\??\c:\lrrlxrl.exec:\lrrlxrl.exe240⤵PID:1644
-
\??\c:\7lrlflf.exec:\7lrlflf.exe241⤵PID:2564
-
\??\c:\xlxfllr.exec:\xlxfllr.exe242⤵PID:2664