Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 17:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ff88982d0f9494ca5f821811c8d342e0_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
ff88982d0f9494ca5f821811c8d342e0_NeikiAnalytics.exe
-
Size
94KB
-
MD5
ff88982d0f9494ca5f821811c8d342e0
-
SHA1
8d30de1b04b92dd19ccdcb4697cd492b08cbfedd
-
SHA256
2d2575e63a4bd45de05aeccea8c58b92079dee2c33c7ff59eb50e14a58780cb0
-
SHA512
8e77573cd3b5d01bcb6307822175373980a487e8f803b700ecc40e0f010fab023c538c4e091e252182b1522deaace92ebcf36d0d04d7f9269f06e5f9b16ffa5d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxEPOfPrAg:ymb3NkkiQ3mdBjFo73PYP1lri3KuOnrJ
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral1/memory/2272-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/856-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/856-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1036-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1600-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1784-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1264-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/716-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1432-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1712-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/700-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1884-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/112-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/868-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1016-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
7rlflll.exennhhnn.exedpddd.exerlxxffl.exethnhhh.exepjvdv.exelfrfflr.exetnhntt.exehbnhnn.exe9jjjj.exe5lxxrrf.exe9fxfrrf.exenhntbn.exentttnn.exe5djjp.exe5flllll.exe5frfflr.exerlrxfxf.exebttbth.exevpdvv.exevppvd.exe9xrrxxf.exe9xlrfxf.exetntbbh.exevddjd.exe5vpjp.exe9lllxrx.exe1bhnnb.exeppvdj.exe9rllrrx.exexffxfxf.exe5thbbb.exethttbb.exe9pjdd.exevpjjj.exerfrrlll.exe9rlffxf.exethnnhn.exenbnhnh.exepdvvv.exedpjdv.exelfxfxxx.exe9rlrfxf.exe1nhntt.exevpvpp.exedppvj.exepjdvv.exe3fflffl.exefxfflff.exetnbhtt.exebtbbhb.exedvddv.exe1dppp.exexlxxffl.exe9fxfffl.exebnbttt.exebhbhht.exe1bthnt.exe5pddv.exejvpdd.exe7fxrrrx.exefrxrrll.exexllffff.exetnbhnb.exepid process 2056 7rlflll.exe 856 nnhhnn.exe 3024 dpddd.exe 2556 rlxxffl.exe 2552 thnhhh.exe 2568 pjvdv.exe 2544 lfrfflr.exe 2408 tnhntt.exe 1036 hbnhnn.exe 2808 9jjjj.exe 1892 5lxxrrf.exe 1600 9fxfrrf.exe 1784 nhntbn.exe 2024 ntttnn.exe 708 5djjp.exe 1264 5flllll.exe 1704 5frfflr.exe 2300 rlrxfxf.exe 2508 bttbth.exe 1028 vpdvv.exe 716 vppvd.exe 1432 9xrrxxf.exe 1712 9xlrfxf.exe 1744 tntbbh.exe 700 vddjd.exe 1884 5vpjp.exe 1084 9lllxrx.exe 112 1bhnnb.exe 3060 ppvdj.exe 868 9rllrrx.exe 1016 xffxfxf.exe 1444 5thbbb.exe 2080 thttbb.exe 2260 9pjdd.exe 1548 vpjjj.exe 2244 rfrrlll.exe 2240 9rlffxf.exe 2884 thnnhn.exe 2856 nbnhnh.exe 2536 pdvvv.exe 2540 dpjdv.exe 2444 lfxfxxx.exe 2876 9rlrfxf.exe 2520 1nhntt.exe 2424 vpvpp.exe 2420 dppvj.exe 2952 pjdvv.exe 2864 3fflffl.exe 1636 fxfflff.exe 2180 tnbhtt.exe 1836 btbbhb.exe 1880 dvddv.exe 1824 1dppp.exe 2032 xlxxffl.exe 1756 9fxfffl.exe 2128 bnbttt.exe 2296 bhbhht.exe 300 1bthnt.exe 2896 5pddv.exe 540 jvpdd.exe 532 7fxrrrx.exe 800 frxrrll.exe 328 xllffff.exe 472 tnbhnb.exe -
Processes:
resource yara_rule behavioral1/memory/2272-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/856-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/856-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/856-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/856-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1036-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1600-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1784-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1264-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/716-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1432-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1712-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/700-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1884-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/112-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/868-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1016-300-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ff88982d0f9494ca5f821811c8d342e0_NeikiAnalytics.exe7rlflll.exennhhnn.exedpddd.exerlxxffl.exethnhhh.exepjvdv.exelfrfflr.exetnhntt.exehbnhnn.exe9jjjj.exe5lxxrrf.exe9fxfrrf.exenhntbn.exentttnn.exe5djjp.exedescription pid process target process PID 2272 wrote to memory of 2056 2272 ff88982d0f9494ca5f821811c8d342e0_NeikiAnalytics.exe 7rlflll.exe PID 2272 wrote to memory of 2056 2272 ff88982d0f9494ca5f821811c8d342e0_NeikiAnalytics.exe 7rlflll.exe PID 2272 wrote to memory of 2056 2272 ff88982d0f9494ca5f821811c8d342e0_NeikiAnalytics.exe 7rlflll.exe PID 2272 wrote to memory of 2056 2272 ff88982d0f9494ca5f821811c8d342e0_NeikiAnalytics.exe 7rlflll.exe PID 2056 wrote to memory of 856 2056 7rlflll.exe nnhhnn.exe PID 2056 wrote to memory of 856 2056 7rlflll.exe nnhhnn.exe PID 2056 wrote to memory of 856 2056 7rlflll.exe nnhhnn.exe PID 2056 wrote to memory of 856 2056 7rlflll.exe nnhhnn.exe PID 856 wrote to memory of 3024 856 nnhhnn.exe dpddd.exe PID 856 wrote to memory of 3024 856 nnhhnn.exe dpddd.exe PID 856 wrote to memory of 3024 856 nnhhnn.exe dpddd.exe PID 856 wrote to memory of 3024 856 nnhhnn.exe dpddd.exe PID 3024 wrote to memory of 2556 3024 dpddd.exe rlxxffl.exe PID 3024 wrote to memory of 2556 3024 dpddd.exe rlxxffl.exe PID 3024 wrote to memory of 2556 3024 dpddd.exe rlxxffl.exe PID 3024 wrote to memory of 2556 3024 dpddd.exe rlxxffl.exe PID 2556 wrote to memory of 2552 2556 rlxxffl.exe thnhhh.exe PID 2556 wrote to memory of 2552 2556 rlxxffl.exe thnhhh.exe PID 2556 wrote to memory of 2552 2556 rlxxffl.exe thnhhh.exe PID 2556 wrote to memory of 2552 2556 rlxxffl.exe thnhhh.exe PID 2552 wrote to memory of 2568 2552 thnhhh.exe pjvdv.exe PID 2552 wrote to memory of 2568 2552 thnhhh.exe pjvdv.exe PID 2552 wrote to memory of 2568 2552 thnhhh.exe pjvdv.exe PID 2552 wrote to memory of 2568 2552 thnhhh.exe pjvdv.exe PID 2568 wrote to memory of 2544 2568 pjvdv.exe lfrfflr.exe PID 2568 wrote to memory of 2544 2568 pjvdv.exe lfrfflr.exe PID 2568 wrote to memory of 2544 2568 pjvdv.exe lfrfflr.exe PID 2568 wrote to memory of 2544 2568 pjvdv.exe lfrfflr.exe PID 2544 wrote to memory of 2408 2544 lfrfflr.exe tnhntt.exe PID 2544 wrote to memory of 2408 2544 lfrfflr.exe tnhntt.exe PID 2544 wrote to memory of 2408 2544 lfrfflr.exe tnhntt.exe PID 2544 wrote to memory of 2408 2544 lfrfflr.exe tnhntt.exe PID 2408 wrote to memory of 1036 2408 tnhntt.exe hbnhnn.exe PID 2408 wrote to memory of 1036 2408 tnhntt.exe hbnhnn.exe PID 2408 wrote to memory of 1036 2408 tnhntt.exe hbnhnn.exe PID 2408 wrote to memory of 1036 2408 tnhntt.exe hbnhnn.exe PID 1036 wrote to memory of 2808 1036 hbnhnn.exe 9jjjj.exe PID 1036 wrote to memory of 2808 1036 hbnhnn.exe 9jjjj.exe PID 1036 wrote to memory of 2808 1036 hbnhnn.exe 9jjjj.exe PID 1036 wrote to memory of 2808 1036 hbnhnn.exe 9jjjj.exe PID 2808 wrote to memory of 1892 2808 9jjjj.exe 5lxxrrf.exe PID 2808 wrote to memory of 1892 2808 9jjjj.exe 5lxxrrf.exe PID 2808 wrote to memory of 1892 2808 9jjjj.exe 5lxxrrf.exe PID 2808 wrote to memory of 1892 2808 9jjjj.exe 5lxxrrf.exe PID 1892 wrote to memory of 1600 1892 5lxxrrf.exe 9fxfrrf.exe PID 1892 wrote to memory of 1600 1892 5lxxrrf.exe 9fxfrrf.exe PID 1892 wrote to memory of 1600 1892 5lxxrrf.exe 9fxfrrf.exe PID 1892 wrote to memory of 1600 1892 5lxxrrf.exe 9fxfrrf.exe PID 1600 wrote to memory of 1784 1600 9fxfrrf.exe nhntbn.exe PID 1600 wrote to memory of 1784 1600 9fxfrrf.exe nhntbn.exe PID 1600 wrote to memory of 1784 1600 9fxfrrf.exe nhntbn.exe PID 1600 wrote to memory of 1784 1600 9fxfrrf.exe nhntbn.exe PID 1784 wrote to memory of 2024 1784 nhntbn.exe ntttnn.exe PID 1784 wrote to memory of 2024 1784 nhntbn.exe ntttnn.exe PID 1784 wrote to memory of 2024 1784 nhntbn.exe ntttnn.exe PID 1784 wrote to memory of 2024 1784 nhntbn.exe ntttnn.exe PID 2024 wrote to memory of 708 2024 ntttnn.exe 5djjp.exe PID 2024 wrote to memory of 708 2024 ntttnn.exe 5djjp.exe PID 2024 wrote to memory of 708 2024 ntttnn.exe 5djjp.exe PID 2024 wrote to memory of 708 2024 ntttnn.exe 5djjp.exe PID 708 wrote to memory of 1264 708 5djjp.exe 5flllll.exe PID 708 wrote to memory of 1264 708 5djjp.exe 5flllll.exe PID 708 wrote to memory of 1264 708 5djjp.exe 5flllll.exe PID 708 wrote to memory of 1264 708 5djjp.exe 5flllll.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff88982d0f9494ca5f821811c8d342e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ff88982d0f9494ca5f821811c8d342e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\7rlflll.exec:\7rlflll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\nnhhnn.exec:\nnhhnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\dpddd.exec:\dpddd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\rlxxffl.exec:\rlxxffl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\thnhhh.exec:\thnhhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\pjvdv.exec:\pjvdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\lfrfflr.exec:\lfrfflr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\tnhntt.exec:\tnhntt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\hbnhnn.exec:\hbnhnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\9jjjj.exec:\9jjjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\5lxxrrf.exec:\5lxxrrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\9fxfrrf.exec:\9fxfrrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\nhntbn.exec:\nhntbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\ntttnn.exec:\ntttnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\5djjp.exec:\5djjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
\??\c:\5flllll.exec:\5flllll.exe17⤵
- Executes dropped EXE
PID:1264 -
\??\c:\5frfflr.exec:\5frfflr.exe18⤵
- Executes dropped EXE
PID:1704 -
\??\c:\rlrxfxf.exec:\rlrxfxf.exe19⤵
- Executes dropped EXE
PID:2300 -
\??\c:\bttbth.exec:\bttbth.exe20⤵
- Executes dropped EXE
PID:2508 -
\??\c:\vpdvv.exec:\vpdvv.exe21⤵
- Executes dropped EXE
PID:1028 -
\??\c:\vppvd.exec:\vppvd.exe22⤵
- Executes dropped EXE
PID:716 -
\??\c:\9xrrxxf.exec:\9xrrxxf.exe23⤵
- Executes dropped EXE
PID:1432 -
\??\c:\9xlrfxf.exec:\9xlrfxf.exe24⤵
- Executes dropped EXE
PID:1712 -
\??\c:\tntbbh.exec:\tntbbh.exe25⤵
- Executes dropped EXE
PID:1744 -
\??\c:\vddjd.exec:\vddjd.exe26⤵
- Executes dropped EXE
PID:700 -
\??\c:\5vpjp.exec:\5vpjp.exe27⤵
- Executes dropped EXE
PID:1884 -
\??\c:\9lllxrx.exec:\9lllxrx.exe28⤵
- Executes dropped EXE
PID:1084 -
\??\c:\1bhnnb.exec:\1bhnnb.exe29⤵
- Executes dropped EXE
PID:112 -
\??\c:\ppvdj.exec:\ppvdj.exe30⤵
- Executes dropped EXE
PID:3060 -
\??\c:\9rllrrx.exec:\9rllrrx.exe31⤵
- Executes dropped EXE
PID:868 -
\??\c:\xffxfxf.exec:\xffxfxf.exe32⤵
- Executes dropped EXE
PID:1016 -
\??\c:\5thbbb.exec:\5thbbb.exe33⤵
- Executes dropped EXE
PID:1444 -
\??\c:\thttbb.exec:\thttbb.exe34⤵
- Executes dropped EXE
PID:2080 -
\??\c:\9pjdd.exec:\9pjdd.exe35⤵
- Executes dropped EXE
PID:2260 -
\??\c:\vpjjj.exec:\vpjjj.exe36⤵
- Executes dropped EXE
PID:1548 -
\??\c:\rfrrlll.exec:\rfrrlll.exe37⤵
- Executes dropped EXE
PID:2244 -
\??\c:\9rlffxf.exec:\9rlffxf.exe38⤵
- Executes dropped EXE
PID:2240 -
\??\c:\thnnhn.exec:\thnnhn.exe39⤵
- Executes dropped EXE
PID:2884 -
\??\c:\nbnhnh.exec:\nbnhnh.exe40⤵
- Executes dropped EXE
PID:2856 -
\??\c:\pdvvv.exec:\pdvvv.exe41⤵
- Executes dropped EXE
PID:2536 -
\??\c:\dpjdv.exec:\dpjdv.exe42⤵
- Executes dropped EXE
PID:2540 -
\??\c:\lfxfxxx.exec:\lfxfxxx.exe43⤵
- Executes dropped EXE
PID:2444 -
\??\c:\9rlrfxf.exec:\9rlrfxf.exe44⤵
- Executes dropped EXE
PID:2876 -
\??\c:\1nhntt.exec:\1nhntt.exe45⤵
- Executes dropped EXE
PID:2520 -
\??\c:\vpvpp.exec:\vpvpp.exe46⤵
- Executes dropped EXE
PID:2424 -
\??\c:\dppvj.exec:\dppvj.exe47⤵
- Executes dropped EXE
PID:2420 -
\??\c:\pjdvv.exec:\pjdvv.exe48⤵
- Executes dropped EXE
PID:2952 -
\??\c:\3fflffl.exec:\3fflffl.exe49⤵
- Executes dropped EXE
PID:2864 -
\??\c:\fxfflff.exec:\fxfflff.exe50⤵
- Executes dropped EXE
PID:1636 -
\??\c:\tnbhtt.exec:\tnbhtt.exe51⤵
- Executes dropped EXE
PID:2180 -
\??\c:\btbbhb.exec:\btbbhb.exe52⤵
- Executes dropped EXE
PID:1836 -
\??\c:\dvddv.exec:\dvddv.exe53⤵
- Executes dropped EXE
PID:1880 -
\??\c:\1dppp.exec:\1dppp.exe54⤵
- Executes dropped EXE
PID:1824 -
\??\c:\xlxxffl.exec:\xlxxffl.exe55⤵
- Executes dropped EXE
PID:2032 -
\??\c:\9fxfffl.exec:\9fxfffl.exe56⤵
- Executes dropped EXE
PID:1756 -
\??\c:\bnbttt.exec:\bnbttt.exe57⤵
- Executes dropped EXE
PID:2128 -
\??\c:\bhbhht.exec:\bhbhht.exe58⤵
- Executes dropped EXE
PID:2296 -
\??\c:\1bthnt.exec:\1bthnt.exe59⤵
- Executes dropped EXE
PID:300 -
\??\c:\5pddv.exec:\5pddv.exe60⤵
- Executes dropped EXE
PID:2896 -
\??\c:\jvpdd.exec:\jvpdd.exe61⤵
- Executes dropped EXE
PID:540 -
\??\c:\7fxrrrx.exec:\7fxrrrx.exe62⤵
- Executes dropped EXE
PID:532 -
\??\c:\frxrrll.exec:\frxrrll.exe63⤵
- Executes dropped EXE
PID:800 -
\??\c:\xllffff.exec:\xllffff.exe64⤵
- Executes dropped EXE
PID:328 -
\??\c:\tnbhnb.exec:\tnbhnb.exe65⤵
- Executes dropped EXE
PID:472 -
\??\c:\bnnntt.exec:\bnnntt.exe66⤵PID:2376
-
\??\c:\dvpvv.exec:\dvpvv.exe67⤵PID:1744
-
\??\c:\jvjpv.exec:\jvjpv.exe68⤵PID:1380
-
\??\c:\lflfflr.exec:\lflfflr.exe69⤵PID:356
-
\??\c:\3lffrrl.exec:\3lffrrl.exe70⤵PID:1888
-
\??\c:\1tnnhh.exec:\1tnnhh.exe71⤵PID:1152
-
\??\c:\1tnhbn.exec:\1tnhbn.exe72⤵PID:112
-
\??\c:\vpppp.exec:\vpppp.exe73⤵PID:3060
-
\??\c:\dpvpv.exec:\dpvpv.exe74⤵PID:384
-
\??\c:\3jvpv.exec:\3jvpv.exe75⤵PID:1840
-
\??\c:\1rfrrll.exec:\1rfrrll.exe76⤵PID:1020
-
\??\c:\rllffxf.exec:\rllffxf.exe77⤵PID:2228
-
\??\c:\tnbhnt.exec:\tnbhnt.exe78⤵PID:2080
-
\??\c:\nhnbhb.exec:\nhnbhb.exe79⤵PID:1504
-
\??\c:\vpjvd.exec:\vpjvd.exe80⤵PID:2208
-
\??\c:\vpdpj.exec:\vpdpj.exe81⤵PID:2872
-
\??\c:\7vjjj.exec:\7vjjj.exe82⤵PID:2800
-
\??\c:\7frxxrx.exec:\7frxxrx.exe83⤵PID:2844
-
\??\c:\fxrxllx.exec:\fxrxllx.exe84⤵PID:2600
-
\??\c:\ttbnbh.exec:\ttbnbh.exe85⤵PID:2644
-
\??\c:\thbttb.exec:\thbttb.exe86⤵PID:2648
-
\??\c:\hbnhtb.exec:\hbnhtb.exe87⤵PID:1560
-
\??\c:\dpdjj.exec:\dpdjj.exe88⤵PID:2876
-
\??\c:\7pdjj.exec:\7pdjj.exe89⤵PID:2688
-
\??\c:\ffrxffx.exec:\ffrxffx.exe90⤵PID:2528
-
\??\c:\rfrflrr.exec:\rfrflrr.exe91⤵PID:1568
-
\??\c:\btbhnn.exec:\btbhnn.exe92⤵PID:2788
-
\??\c:\3bnnnn.exec:\3bnnnn.exe93⤵PID:1908
-
\??\c:\3vddd.exec:\3vddd.exe94⤵PID:1992
-
\??\c:\dvpdv.exec:\dvpdv.exe95⤵PID:1848
-
\??\c:\xllllrx.exec:\xllllrx.exe96⤵PID:1852
-
\??\c:\rflffxf.exec:\rflffxf.exe97⤵PID:1788
-
\??\c:\xxlxflx.exec:\xxlxflx.exe98⤵PID:1796
-
\??\c:\tntbnt.exec:\tntbnt.exe99⤵PID:2344
-
\??\c:\hbhhhb.exec:\hbhhhb.exe100⤵PID:1756
-
\??\c:\7rfflll.exec:\7rfflll.exe101⤵PID:1592
-
\??\c:\5nhhtt.exec:\5nhhtt.exe102⤵PID:2704
-
\??\c:\nhttbb.exec:\nhttbb.exe103⤵PID:1584
-
\??\c:\dpjpd.exec:\dpjpd.exe104⤵PID:2504
-
\??\c:\vpvvv.exec:\vpvvv.exe105⤵PID:596
-
\??\c:\9dddj.exec:\9dddj.exe106⤵PID:2584
-
\??\c:\9fxlrxl.exec:\9fxlrxl.exe107⤵PID:716
-
\??\c:\rfxxfll.exec:\rfxxfll.exe108⤵PID:652
-
\??\c:\tnnnnh.exec:\tnnnnh.exe109⤵PID:1148
-
\??\c:\btnhbh.exec:\btnhbh.exe110⤵PID:1452
-
\??\c:\7vpjj.exec:\7vpjj.exe111⤵PID:2104
-
\??\c:\pjpjj.exec:\pjpjj.exe112⤵PID:1856
-
\??\c:\9lrfllr.exec:\9lrfllr.exe113⤵PID:1564
-
\??\c:\lxffrfr.exec:\lxffrfr.exe114⤵PID:932
-
\??\c:\bthntt.exec:\bthntt.exe115⤵PID:2740
-
\??\c:\pjjpp.exec:\pjjpp.exe116⤵PID:112
-
\??\c:\dvdpd.exec:\dvdpd.exe117⤵PID:2108
-
\??\c:\xlrrxrx.exec:\xlrrxrx.exe118⤵PID:384
-
\??\c:\xrxrrlr.exec:\xrxrrlr.exe119⤵PID:2124
-
\??\c:\nhtttn.exec:\nhtttn.exe120⤵PID:1020
-
\??\c:\thnhnh.exec:\thnhnh.exe121⤵PID:2724
-
\??\c:\vdddj.exec:\vdddj.exe122⤵PID:2212
-
\??\c:\9vdvv.exec:\9vdvv.exe123⤵PID:2216
-
\??\c:\7rllfxx.exec:\7rllfxx.exe124⤵PID:2208
-
\??\c:\lxllllf.exec:\lxllllf.exe125⤵PID:2872
-
\??\c:\xlfxxlx.exec:\xlfxxlx.exe126⤵PID:2800
-
\??\c:\nhttnt.exec:\nhttnt.exe127⤵PID:2884
-
\??\c:\5tnhhn.exec:\5tnhhn.exe128⤵PID:2600
-
\??\c:\pjddp.exec:\pjddp.exe129⤵PID:2536
-
\??\c:\vdppp.exec:\vdppp.exe130⤵PID:2648
-
\??\c:\lxxxrlf.exec:\lxxxrlf.exe131⤵PID:2444
-
\??\c:\5lrrxxl.exec:\5lrrxxl.exe132⤵PID:2568
-
\??\c:\thbbhh.exec:\thbbhh.exe133⤵PID:2520
-
\??\c:\nbntth.exec:\nbntth.exe134⤵PID:1660
-
\??\c:\tnhthh.exec:\tnhthh.exe135⤵PID:2484
-
\??\c:\dvvpp.exec:\dvvpp.exe136⤵PID:2788
-
\??\c:\9jpjj.exec:\9jpjj.exe137⤵PID:2168
-
\??\c:\rfflfxx.exec:\rfflfxx.exe138⤵PID:1992
-
\??\c:\rlrxfxl.exec:\rlrxfxl.exe139⤵PID:2180
-
\??\c:\tbbbth.exec:\tbbbth.exe140⤵PID:1836
-
\??\c:\3bbbtt.exec:\3bbbtt.exe141⤵PID:1880
-
\??\c:\vjppp.exec:\vjppp.exe142⤵PID:1796
-
\??\c:\dvdvp.exec:\dvdvp.exe143⤵PID:2032
-
\??\c:\3lffxxl.exec:\3lffxxl.exe144⤵PID:1216
-
\??\c:\5rffrrf.exec:\5rffrrf.exe145⤵PID:2128
-
\??\c:\hthntb.exec:\hthntb.exe146⤵PID:1372
-
\??\c:\9thttn.exec:\9thttn.exe147⤵PID:300
-
\??\c:\5bbnbb.exec:\5bbnbb.exe148⤵PID:2504
-
\??\c:\dvdjp.exec:\dvdjp.exe149⤵PID:540
-
\??\c:\rflllfx.exec:\rflllfx.exe150⤵PID:2584
-
\??\c:\5rxxfff.exec:\5rxxfff.exe151⤵PID:1732
-
\??\c:\bhhhhh.exec:\bhhhhh.exe152⤵PID:328
-
\??\c:\bhnhnh.exec:\bhnhnh.exe153⤵PID:472
-
\??\c:\vvpvp.exec:\vvpvp.exe154⤵PID:1452
-
\??\c:\1djdd.exec:\1djdd.exe155⤵PID:1860
-
\??\c:\vjvpp.exec:\vjvpp.exe156⤵PID:980
-
\??\c:\1lxrrrr.exec:\1lxrrrr.exe157⤵PID:356
-
\??\c:\flfxrlf.exec:\flfxrlf.exe158⤵PID:932
-
\??\c:\tnnttb.exec:\tnnttb.exe159⤵PID:1152
-
\??\c:\thhbhh.exec:\thhbhh.exe160⤵PID:112
-
\??\c:\jdjpd.exec:\jdjpd.exe161⤵PID:3060
-
\??\c:\pjpvd.exec:\pjpvd.exe162⤵PID:384
-
\??\c:\1xfxxxl.exec:\1xfxxxl.exe163⤵PID:1840
-
\??\c:\1xlllll.exec:\1xlllll.exe164⤵PID:2152
-
\??\c:\9btbnn.exec:\9btbnn.exe165⤵PID:2228
-
\??\c:\btbbnn.exec:\btbbnn.exe166⤵PID:2212
-
\??\c:\ddppd.exec:\ddppd.exe167⤵PID:2216
-
\??\c:\xlxrllr.exec:\xlxrllr.exe168⤵PID:2860
-
\??\c:\lfllrrr.exec:\lfllrrr.exe169⤵PID:2624
-
\??\c:\htbhnn.exec:\htbhnn.exe170⤵PID:2800
-
\??\c:\nbhttt.exec:\nbhttt.exe171⤵PID:2844
-
\??\c:\1jvpv.exec:\1jvpv.exe172⤵PID:2600
-
\??\c:\vpvvj.exec:\vpvvj.exe173⤵PID:2692
-
\??\c:\pddvv.exec:\pddvv.exe174⤵PID:2524
-
\??\c:\rrxlflx.exec:\rrxlflx.exe175⤵PID:1560
-
\??\c:\nhnttt.exec:\nhnttt.exe176⤵PID:2876
-
\??\c:\5nhbbt.exec:\5nhbbt.exe177⤵PID:2688
-
\??\c:\1bbbtt.exec:\1bbbtt.exe178⤵PID:2796
-
\??\c:\vjjdp.exec:\vjjdp.exe179⤵PID:1568
-
\??\c:\vpvvv.exec:\vpvvv.exe180⤵PID:2788
-
\??\c:\5rfxrlx.exec:\5rfxrlx.exe181⤵PID:1908
-
\??\c:\lllxxrf.exec:\lllxxrf.exe182⤵PID:1992
-
\??\c:\9bhhhn.exec:\9bhhhn.exe183⤵PID:1848
-
\??\c:\3hhbbt.exec:\3hhbbt.exe184⤵PID:1836
-
\??\c:\3ppdd.exec:\3ppdd.exe185⤵PID:1788
-
\??\c:\vppvv.exec:\vppvv.exe186⤵PID:1796
-
\??\c:\fxllfxx.exec:\fxllfxx.exe187⤵PID:2344
-
\??\c:\7rlxxrl.exec:\7rlxxrl.exe188⤵PID:1572
-
\??\c:\thtbnt.exec:\thtbnt.exe189⤵PID:1592
-
\??\c:\nhnhhh.exec:\nhnhhh.exe190⤵PID:1372
-
\??\c:\3vvdp.exec:\3vvdp.exe191⤵PID:1584
-
\??\c:\jvjdp.exec:\jvjdp.exe192⤵PID:2504
-
\??\c:\1vpvd.exec:\1vpvd.exe193⤵PID:596
-
\??\c:\rrxxxxf.exec:\rrxxxxf.exe194⤵PID:2584
-
\??\c:\thntnt.exec:\thntnt.exe195⤵PID:1712
-
\??\c:\tnnhhh.exec:\tnnhhh.exe196⤵PID:2888
-
\??\c:\jvdvv.exec:\jvdvv.exe197⤵PID:1148
-
\??\c:\jdvpd.exec:\jdvpd.exe198⤵PID:1884
-
\??\c:\pdjdv.exec:\pdjdv.exe199⤵PID:1744
-
\??\c:\frrfllx.exec:\frrfllx.exe200⤵PID:1856
-
\??\c:\llxxlrf.exec:\llxxlrf.exe201⤵PID:1564
-
\??\c:\hbttbn.exec:\hbttbn.exe202⤵PID:2956
-
\??\c:\9htbbt.exec:\9htbbt.exe203⤵PID:1152
-
\??\c:\5pvvv.exec:\5pvvv.exe204⤵PID:1448
-
\??\c:\vjvpp.exec:\vjvpp.exe205⤵PID:3060
-
\??\c:\fxxlrrf.exec:\fxxlrrf.exe206⤵PID:384
-
\??\c:\hbhnnn.exec:\hbhnnn.exe207⤵PID:1840
-
\??\c:\hbhnbb.exec:\hbhnbb.exe208⤵PID:2948
-
\??\c:\thtnbb.exec:\thtnbb.exe209⤵PID:2228
-
\??\c:\pjvpv.exec:\pjvpv.exe210⤵PID:2212
-
\??\c:\vpddv.exec:\vpddv.exe211⤵PID:1616
-
\??\c:\rrxrrrf.exec:\rrxrrrf.exe212⤵PID:2604
-
\??\c:\5rxxxxf.exec:\5rxxxxf.exe213⤵PID:2624
-
\??\c:\5hnnnn.exec:\5hnnnn.exe214⤵PID:2800
-
\??\c:\httbtn.exec:\httbtn.exe215⤵PID:2844
-
\??\c:\jdjdd.exec:\jdjdd.exe216⤵PID:2576
-
\??\c:\vjddj.exec:\vjddj.exe217⤵PID:2692
-
\??\c:\1xxfffl.exec:\1xxfffl.exe218⤵PID:2472
-
\??\c:\3xrxflx.exec:\3xrxflx.exe219⤵PID:1560
-
\??\c:\9bnbhh.exec:\9bnbhh.exe220⤵PID:1552
-
\??\c:\ntbtbb.exec:\ntbtbb.exe221⤵PID:1964
-
\??\c:\pdjpj.exec:\pdjpj.exe222⤵PID:1660
-
\??\c:\fxrrrrx.exec:\fxrrrrx.exe223⤵PID:2188
-
\??\c:\thnttt.exec:\thnttt.exe224⤵PID:1784
-
\??\c:\9tnntt.exec:\9tnntt.exe225⤵PID:1960
-
\??\c:\9htnbn.exec:\9htnbn.exe226⤵PID:2020
-
\??\c:\jdjdp.exec:\jdjdp.exe227⤵PID:876
-
\??\c:\rlxflrx.exec:\rlxflrx.exe228⤵PID:776
-
\??\c:\rrffrrf.exec:\rrffrrf.exe229⤵PID:2384
-
\??\c:\bnbbth.exec:\bnbbth.exe230⤵PID:1032
-
\??\c:\tnbtbb.exec:\tnbtbb.exe231⤵PID:1756
-
\??\c:\dvdvv.exec:\dvdvv.exe232⤵PID:324
-
\??\c:\1pjpp.exec:\1pjpp.exe233⤵PID:488
-
\??\c:\1pvvv.exec:\1pvvv.exe234⤵PID:580
-
\??\c:\xxxfxxl.exec:\xxxfxxl.exe235⤵PID:1584
-
\??\c:\xflfxrr.exec:\xflfxrr.exe236⤵PID:852
-
\??\c:\ffrrlrr.exec:\ffrrlrr.exe237⤵PID:716
-
\??\c:\tnbbhn.exec:\tnbbhn.exe238⤵PID:1684
-
\??\c:\btbbnn.exec:\btbbnn.exe239⤵PID:328
-
\??\c:\vjppv.exec:\vjppv.exe240⤵PID:1604
-
\??\c:\vpjjj.exec:\vpjjj.exe241⤵PID:288
-
\??\c:\1rffxfl.exec:\1rffxfl.exe242⤵PID:2924