Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 04:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aaf060dff37c9a7d6f83d6c40c40b7e0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
aaf060dff37c9a7d6f83d6c40c40b7e0_NeikiAnalytics.exe
-
Size
83KB
-
MD5
aaf060dff37c9a7d6f83d6c40c40b7e0
-
SHA1
16355dbc3d842e99cc93eb0a9ecbac51073352c4
-
SHA256
d584d78b811f0fb073202659f7487222275daa294123738baaaea20134fc3ed7
-
SHA512
966e3ab8f0b36e49ecfa65fd85bfb7b119dd441ff96c6bbb38ae089d4289deef258570562152c10a4986a62ffc83027541170a44380041edb09bf9de83a7a0ef
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73yqKH/KjvHo+WdNI:ymb3NkkiQ3mdBjFo73yX+vI+qm
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/2984-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3056-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1152-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1048-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1916-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1124-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1056-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1444-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2080-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2044-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1008-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/688-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1072-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/296-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xrxfrxl.exetnbhbh.exedvvjv.exettnthh.exevpjpj.exejdpjd.exeflflxlx.exe1nnnbn.exehbbnht.exe7vvdd.exerlxrlrf.exebtnntn.exejjdpd.exejjvdd.exe9lxxffl.exehhnthn.exetnthnt.exevvdpp.exefxrxrxl.exehnbbhb.exepvpjp.exe7vpdj.exe5lxxxff.exebtnnnt.exe7dppp.exe9dppp.exetnnbht.exevpjjd.exe1ddjd.exerrlrfrl.exettthtt.exepjpvd.exe9vvdd.exefrflxfr.exelfrflfr.exe7tbhnn.exehbhnbh.exevvpjv.exe5rlxlrf.exellfrlrx.exe1bbbtt.exepjpjp.exevpddp.exe3fxxxxf.exexrrrrxr.exebthhnt.exebtntbh.exepppvj.exe9rrxrrf.exe9rrfllr.exe9htbtb.exehtnnbb.exepjvpd.exerrlxfrf.exelflxlrx.exebnhhnh.exebtnttt.exe7dpjv.exevpjvp.exelrxrxlx.exennhnbb.exe5thnbb.exe7vjdj.exevpvdd.exepid process 3056 xrxfrxl.exe 1152 tnbhbh.exe 2732 dvvjv.exe 2656 ttnthh.exe 2788 vpjpj.exe 2696 jdpjd.exe 2540 flflxlx.exe 1048 1nnnbn.exe 1916 hbbnht.exe 2824 7vvdd.exe 2900 rlxrlrf.exe 1620 btnntn.exe 1124 jjdpd.exe 1056 jjvdd.exe 1760 9lxxffl.exe 1444 hhnthn.exe 3012 tnthnt.exe 2056 vvdpp.exe 2080 fxrxrxl.exe 2952 hnbbhb.exe 2044 pvpjp.exe 1008 7vpdj.exe 604 5lxxxff.exe 576 btnnnt.exe 688 7dppp.exe 1072 9dppp.exe 900 tnnbht.exe 296 vpjjd.exe 1776 1ddjd.exe 2980 rrlrfrl.exe 876 ttthtt.exe 2460 pjpvd.exe 3004 9vvdd.exe 1588 frflxfr.exe 1088 lfrflfr.exe 2616 7tbhnn.exe 2664 hbhnbh.exe 2940 vvpjv.exe 2804 5rlxlrf.exe 2528 llfrlrx.exe 2708 1bbbtt.exe 2688 pjpjp.exe 2516 vpddp.exe 2208 3fxxxxf.exe 2844 xrrrrxr.exe 2856 bthhnt.exe 2624 btntbh.exe 2176 pppvj.exe 1956 9rrxrrf.exe 1736 9rrfllr.exe 1124 9htbtb.exe 1240 htnnbb.exe 1672 pjvpd.exe 2612 rrlxfrf.exe 1444 lflxlrx.exe 2052 bnhhnh.exe 2268 btnttt.exe 1200 7dpjv.exe 2876 vpjvp.exe 2968 lrxrxlx.exe 988 nnhnbb.exe 1472 5thnbb.exe 1816 7vjdj.exe 1492 vpvdd.exe -
Processes:
resource yara_rule behavioral1/memory/2984-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1152-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1152-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1152-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1048-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1916-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1124-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1056-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1444-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1008-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/688-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1072-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/296-275-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
aaf060dff37c9a7d6f83d6c40c40b7e0_NeikiAnalytics.exexrxfrxl.exetnbhbh.exedvvjv.exettnthh.exevpjpj.exejdpjd.exeflflxlx.exe1nnnbn.exehbbnht.exe7vvdd.exerlxrlrf.exebtnntn.exejjdpd.exejjvdd.exe9lxxffl.exedescription pid process target process PID 2984 wrote to memory of 3056 2984 aaf060dff37c9a7d6f83d6c40c40b7e0_NeikiAnalytics.exe xrxfrxl.exe PID 2984 wrote to memory of 3056 2984 aaf060dff37c9a7d6f83d6c40c40b7e0_NeikiAnalytics.exe xrxfrxl.exe PID 2984 wrote to memory of 3056 2984 aaf060dff37c9a7d6f83d6c40c40b7e0_NeikiAnalytics.exe xrxfrxl.exe PID 2984 wrote to memory of 3056 2984 aaf060dff37c9a7d6f83d6c40c40b7e0_NeikiAnalytics.exe xrxfrxl.exe PID 3056 wrote to memory of 1152 3056 xrxfrxl.exe tnbhbh.exe PID 3056 wrote to memory of 1152 3056 xrxfrxl.exe tnbhbh.exe PID 3056 wrote to memory of 1152 3056 xrxfrxl.exe tnbhbh.exe PID 3056 wrote to memory of 1152 3056 xrxfrxl.exe tnbhbh.exe PID 1152 wrote to memory of 2732 1152 tnbhbh.exe dvvjv.exe PID 1152 wrote to memory of 2732 1152 tnbhbh.exe dvvjv.exe PID 1152 wrote to memory of 2732 1152 tnbhbh.exe dvvjv.exe PID 1152 wrote to memory of 2732 1152 tnbhbh.exe dvvjv.exe PID 2732 wrote to memory of 2656 2732 dvvjv.exe ttnthh.exe PID 2732 wrote to memory of 2656 2732 dvvjv.exe ttnthh.exe PID 2732 wrote to memory of 2656 2732 dvvjv.exe ttnthh.exe PID 2732 wrote to memory of 2656 2732 dvvjv.exe ttnthh.exe PID 2656 wrote to memory of 2788 2656 ttnthh.exe vpjpj.exe PID 2656 wrote to memory of 2788 2656 ttnthh.exe vpjpj.exe PID 2656 wrote to memory of 2788 2656 ttnthh.exe vpjpj.exe PID 2656 wrote to memory of 2788 2656 ttnthh.exe vpjpj.exe PID 2788 wrote to memory of 2696 2788 vpjpj.exe jdpjd.exe PID 2788 wrote to memory of 2696 2788 vpjpj.exe jdpjd.exe PID 2788 wrote to memory of 2696 2788 vpjpj.exe jdpjd.exe PID 2788 wrote to memory of 2696 2788 vpjpj.exe jdpjd.exe PID 2696 wrote to memory of 2540 2696 jdpjd.exe flflxlx.exe PID 2696 wrote to memory of 2540 2696 jdpjd.exe flflxlx.exe PID 2696 wrote to memory of 2540 2696 jdpjd.exe flflxlx.exe PID 2696 wrote to memory of 2540 2696 jdpjd.exe flflxlx.exe PID 2540 wrote to memory of 1048 2540 flflxlx.exe 1nnnbn.exe PID 2540 wrote to memory of 1048 2540 flflxlx.exe 1nnnbn.exe PID 2540 wrote to memory of 1048 2540 flflxlx.exe 1nnnbn.exe PID 2540 wrote to memory of 1048 2540 flflxlx.exe 1nnnbn.exe PID 1048 wrote to memory of 1916 1048 1nnnbn.exe hbbnht.exe PID 1048 wrote to memory of 1916 1048 1nnnbn.exe hbbnht.exe PID 1048 wrote to memory of 1916 1048 1nnnbn.exe hbbnht.exe PID 1048 wrote to memory of 1916 1048 1nnnbn.exe hbbnht.exe PID 1916 wrote to memory of 2824 1916 hbbnht.exe 7vvdd.exe PID 1916 wrote to memory of 2824 1916 hbbnht.exe 7vvdd.exe PID 1916 wrote to memory of 2824 1916 hbbnht.exe 7vvdd.exe PID 1916 wrote to memory of 2824 1916 hbbnht.exe 7vvdd.exe PID 2824 wrote to memory of 2900 2824 7vvdd.exe rlxrlrf.exe PID 2824 wrote to memory of 2900 2824 7vvdd.exe rlxrlrf.exe PID 2824 wrote to memory of 2900 2824 7vvdd.exe rlxrlrf.exe PID 2824 wrote to memory of 2900 2824 7vvdd.exe rlxrlrf.exe PID 2900 wrote to memory of 1620 2900 rlxrlrf.exe btnntn.exe PID 2900 wrote to memory of 1620 2900 rlxrlrf.exe btnntn.exe PID 2900 wrote to memory of 1620 2900 rlxrlrf.exe btnntn.exe PID 2900 wrote to memory of 1620 2900 rlxrlrf.exe btnntn.exe PID 1620 wrote to memory of 1124 1620 btnntn.exe jjdpd.exe PID 1620 wrote to memory of 1124 1620 btnntn.exe jjdpd.exe PID 1620 wrote to memory of 1124 1620 btnntn.exe jjdpd.exe PID 1620 wrote to memory of 1124 1620 btnntn.exe jjdpd.exe PID 1124 wrote to memory of 1056 1124 jjdpd.exe jjvdd.exe PID 1124 wrote to memory of 1056 1124 jjdpd.exe jjvdd.exe PID 1124 wrote to memory of 1056 1124 jjdpd.exe jjvdd.exe PID 1124 wrote to memory of 1056 1124 jjdpd.exe jjvdd.exe PID 1056 wrote to memory of 1760 1056 jjvdd.exe 9lxxffl.exe PID 1056 wrote to memory of 1760 1056 jjvdd.exe 9lxxffl.exe PID 1056 wrote to memory of 1760 1056 jjvdd.exe 9lxxffl.exe PID 1056 wrote to memory of 1760 1056 jjvdd.exe 9lxxffl.exe PID 1760 wrote to memory of 1444 1760 9lxxffl.exe hhnthn.exe PID 1760 wrote to memory of 1444 1760 9lxxffl.exe hhnthn.exe PID 1760 wrote to memory of 1444 1760 9lxxffl.exe hhnthn.exe PID 1760 wrote to memory of 1444 1760 9lxxffl.exe hhnthn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aaf060dff37c9a7d6f83d6c40c40b7e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\aaf060dff37c9a7d6f83d6c40c40b7e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\xrxfrxl.exec:\xrxfrxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\tnbhbh.exec:\tnbhbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\dvvjv.exec:\dvvjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\ttnthh.exec:\ttnthh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\vpjpj.exec:\vpjpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\jdpjd.exec:\jdpjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\flflxlx.exec:\flflxlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\1nnnbn.exec:\1nnnbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\hbbnht.exec:\hbbnht.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\7vvdd.exec:\7vvdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\rlxrlrf.exec:\rlxrlrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\btnntn.exec:\btnntn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\jjdpd.exec:\jjdpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
\??\c:\jjvdd.exec:\jjvdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\9lxxffl.exec:\9lxxffl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\hhnthn.exec:\hhnthn.exe17⤵
- Executes dropped EXE
PID:1444 -
\??\c:\tnthnt.exec:\tnthnt.exe18⤵
- Executes dropped EXE
PID:3012 -
\??\c:\vvdpp.exec:\vvdpp.exe19⤵
- Executes dropped EXE
PID:2056 -
\??\c:\fxrxrxl.exec:\fxrxrxl.exe20⤵
- Executes dropped EXE
PID:2080 -
\??\c:\hnbbhb.exec:\hnbbhb.exe21⤵
- Executes dropped EXE
PID:2952 -
\??\c:\pvpjp.exec:\pvpjp.exe22⤵
- Executes dropped EXE
PID:2044 -
\??\c:\7vpdj.exec:\7vpdj.exe23⤵
- Executes dropped EXE
PID:1008 -
\??\c:\5lxxxff.exec:\5lxxxff.exe24⤵
- Executes dropped EXE
PID:604 -
\??\c:\btnnnt.exec:\btnnnt.exe25⤵
- Executes dropped EXE
PID:576 -
\??\c:\7dppp.exec:\7dppp.exe26⤵
- Executes dropped EXE
PID:688 -
\??\c:\9dppp.exec:\9dppp.exe27⤵
- Executes dropped EXE
PID:1072 -
\??\c:\tnnbht.exec:\tnnbht.exe28⤵
- Executes dropped EXE
PID:900 -
\??\c:\vpjjd.exec:\vpjjd.exe29⤵
- Executes dropped EXE
PID:296 -
\??\c:\1ddjd.exec:\1ddjd.exe30⤵
- Executes dropped EXE
PID:1776 -
\??\c:\rrlrfrl.exec:\rrlrfrl.exe31⤵
- Executes dropped EXE
PID:2980 -
\??\c:\ttthtt.exec:\ttthtt.exe32⤵
- Executes dropped EXE
PID:876 -
\??\c:\pjpvd.exec:\pjpvd.exe33⤵
- Executes dropped EXE
PID:2460 -
\??\c:\9vvdd.exec:\9vvdd.exe34⤵
- Executes dropped EXE
PID:3004 -
\??\c:\frflxfr.exec:\frflxfr.exe35⤵
- Executes dropped EXE
PID:1588 -
\??\c:\lfrflfr.exec:\lfrflfr.exe36⤵
- Executes dropped EXE
PID:1088 -
\??\c:\7tbhnn.exec:\7tbhnn.exe37⤵
- Executes dropped EXE
PID:2616 -
\??\c:\hbhnbh.exec:\hbhnbh.exe38⤵
- Executes dropped EXE
PID:2664 -
\??\c:\vvpjv.exec:\vvpjv.exe39⤵
- Executes dropped EXE
PID:2940 -
\??\c:\5rlxlrf.exec:\5rlxlrf.exe40⤵
- Executes dropped EXE
PID:2804 -
\??\c:\llfrlrx.exec:\llfrlrx.exe41⤵
- Executes dropped EXE
PID:2528 -
\??\c:\1bbbtt.exec:\1bbbtt.exe42⤵
- Executes dropped EXE
PID:2708 -
\??\c:\pjpjp.exec:\pjpjp.exe43⤵
- Executes dropped EXE
PID:2688 -
\??\c:\vpddp.exec:\vpddp.exe44⤵
- Executes dropped EXE
PID:2516 -
\??\c:\3fxxxxf.exec:\3fxxxxf.exe45⤵
- Executes dropped EXE
PID:2208 -
\??\c:\xrrrrxr.exec:\xrrrrxr.exe46⤵
- Executes dropped EXE
PID:2844 -
\??\c:\bthhnt.exec:\bthhnt.exe47⤵
- Executes dropped EXE
PID:2856 -
\??\c:\btntbh.exec:\btntbh.exe48⤵
- Executes dropped EXE
PID:2624 -
\??\c:\pppvj.exec:\pppvj.exe49⤵
- Executes dropped EXE
PID:2176 -
\??\c:\9rrxrrf.exec:\9rrxrrf.exe50⤵
- Executes dropped EXE
PID:1956 -
\??\c:\9rrfllr.exec:\9rrfllr.exe51⤵
- Executes dropped EXE
PID:1736 -
\??\c:\9htbtb.exec:\9htbtb.exe52⤵
- Executes dropped EXE
PID:1124 -
\??\c:\htnnbb.exec:\htnnbb.exe53⤵
- Executes dropped EXE
PID:1240 -
\??\c:\pjvpd.exec:\pjvpd.exe54⤵
- Executes dropped EXE
PID:1672 -
\??\c:\rrlxfrf.exec:\rrlxfrf.exe55⤵
- Executes dropped EXE
PID:2612 -
\??\c:\lflxlrx.exec:\lflxlrx.exe56⤵
- Executes dropped EXE
PID:1444 -
\??\c:\bnhhnh.exec:\bnhhnh.exe57⤵
- Executes dropped EXE
PID:2052 -
\??\c:\btnttt.exec:\btnttt.exe58⤵
- Executes dropped EXE
PID:2268 -
\??\c:\7dpjv.exec:\7dpjv.exe59⤵
- Executes dropped EXE
PID:1200 -
\??\c:\vpjvp.exec:\vpjvp.exe60⤵
- Executes dropped EXE
PID:2876 -
\??\c:\lrxrxlx.exec:\lrxrxlx.exe61⤵
- Executes dropped EXE
PID:2968 -
\??\c:\nnhnbb.exec:\nnhnbb.exe62⤵
- Executes dropped EXE
PID:988 -
\??\c:\5thnbb.exec:\5thnbb.exe63⤵
- Executes dropped EXE
PID:1472 -
\??\c:\7vjdj.exec:\7vjdj.exe64⤵
- Executes dropped EXE
PID:1816 -
\??\c:\vpvdd.exec:\vpvdd.exe65⤵
- Executes dropped EXE
PID:1492 -
\??\c:\xxrxxfx.exec:\xxrxxfx.exe66⤵PID:2364
-
\??\c:\xrlxffx.exec:\xrlxffx.exe67⤵PID:1820
-
\??\c:\7hntnn.exec:\7hntnn.exe68⤵PID:1084
-
\??\c:\9thhht.exec:\9thhht.exe69⤵PID:900
-
\??\c:\5vvjv.exec:\5vvjv.exe70⤵PID:2976
-
\??\c:\dpdpv.exec:\dpdpv.exe71⤵PID:1172
-
\??\c:\rrlxrxl.exec:\rrlxrxl.exe72⤵PID:1232
-
\??\c:\nnbhbb.exec:\nnbhbb.exe73⤵PID:2228
-
\??\c:\1nbntn.exec:\1nbntn.exe74⤵PID:876
-
\??\c:\5nhbth.exec:\5nhbth.exe75⤵PID:1748
-
\??\c:\dvjpd.exec:\dvjpd.exe76⤵PID:2172
-
\??\c:\9rflllr.exec:\9rflllr.exe77⤵PID:1716
-
\??\c:\rrlrlxf.exec:\rrlrlxf.exe78⤵PID:2724
-
\??\c:\hbnthb.exec:\hbnthb.exe79⤵PID:2632
-
\??\c:\9nbnbh.exec:\9nbnbh.exe80⤵PID:2628
-
\??\c:\vpddd.exec:\vpddd.exe81⤵PID:2648
-
\??\c:\frlfllx.exec:\frlfllx.exe82⤵PID:2752
-
\??\c:\fxlrffr.exec:\fxlrffr.exe83⤵PID:2660
-
\??\c:\bthntb.exec:\bthntb.exe84⤵PID:2636
-
\??\c:\bttbnt.exec:\bttbnt.exe85⤵PID:3024
-
\??\c:\pjvdp.exec:\pjvdp.exe86⤵PID:3060
-
\??\c:\1pvpp.exec:\1pvpp.exe87⤵PID:3028
-
\??\c:\rlfrxfr.exec:\rlfrxfr.exe88⤵PID:2816
-
\??\c:\rlllrrf.exec:\rlllrrf.exe89⤵PID:2800
-
\??\c:\hbhntt.exec:\hbhntt.exe90⤵PID:2824
-
\??\c:\tnhnnn.exec:\tnhnnn.exe91⤵PID:1616
-
\??\c:\5btbnt.exec:\5btbnt.exe92⤵PID:1440
-
\??\c:\pvjjv.exec:\pvjjv.exe93⤵PID:1756
-
\??\c:\jjdjd.exec:\jjdjd.exe94⤵PID:764
-
\??\c:\xlxffxf.exec:\xlxffxf.exe95⤵PID:316
-
\??\c:\xrrfrxf.exec:\xrrfrxf.exe96⤵PID:1568
-
\??\c:\5tbnnn.exec:\5tbnnn.exe97⤵PID:1524
-
\??\c:\1btbtt.exec:\1btbtt.exe98⤵PID:2288
-
\??\c:\3djjd.exec:\3djjd.exe99⤵PID:1428
-
\??\c:\vpdjj.exec:\vpdjj.exe100⤵PID:1332
-
\??\c:\xlfxrrx.exec:\xlfxrrx.exe101⤵PID:2504
-
\??\c:\3rfflrx.exec:\3rfflrx.exe102⤵PID:2780
-
\??\c:\rxxrrlx.exec:\rxxrrlx.exe103⤵PID:1092
-
\??\c:\tthhtt.exec:\tthhtt.exe104⤵PID:1160
-
\??\c:\tnnbhh.exec:\tnnbhh.exe105⤵PID:1824
-
\??\c:\9pddp.exec:\9pddp.exe106⤵PID:604
-
\??\c:\7vjpv.exec:\7vjpv.exe107⤵PID:2404
-
\??\c:\frfflrl.exec:\frfflrl.exe108⤵PID:1344
-
\??\c:\3tnbhh.exec:\3tnbhh.exe109⤵PID:1060
-
\??\c:\ttbbnn.exec:\ttbbnn.exe110⤵PID:1636
-
\??\c:\dvjpp.exec:\dvjpp.exe111⤵PID:2104
-
\??\c:\xxxffrx.exec:\xxxffrx.exe112⤵PID:296
-
\??\c:\9thhtn.exec:\9thhtn.exe113⤵PID:2040
-
\??\c:\9thnnb.exec:\9thnnb.exe114⤵PID:1180
-
\??\c:\jvvvd.exec:\jvvvd.exe115⤵PID:2400
-
\??\c:\9jdvd.exec:\9jdvd.exe116⤵PID:2984
-
\??\c:\9xxrxlf.exec:\9xxrxlf.exe117⤵PID:2192
-
\??\c:\rfrxflr.exec:\rfrxflr.exe118⤵PID:1592
-
\??\c:\tttbnh.exec:\tttbnh.exe119⤵PID:1588
-
\??\c:\btbttt.exec:\btbttt.exe120⤵PID:2776
-
\??\c:\vpjvp.exec:\vpjvp.exe121⤵PID:2720
-
\??\c:\7fffffr.exec:\7fffffr.exe122⤵PID:2672
-
\??\c:\3fflrxl.exec:\3fflrxl.exe123⤵PID:2556
-
\??\c:\tntbhh.exec:\tntbhh.exe124⤵PID:2768
-
\??\c:\7bnhht.exec:\7bnhht.exe125⤵PID:2528
-
\??\c:\jjdpp.exec:\jjdpp.exe126⤵PID:2588
-
\??\c:\3pvdj.exec:\3pvdj.exe127⤵PID:2688
-
\??\c:\fflrrrr.exec:\fflrrrr.exe128⤵PID:344
-
\??\c:\1lfflrx.exec:\1lfflrx.exe129⤵PID:2200
-
\??\c:\lfrffrx.exec:\lfrffrx.exe130⤵PID:2852
-
\??\c:\9nnbnt.exec:\9nnbnt.exe131⤵PID:2888
-
\??\c:\btnthn.exec:\btnthn.exe132⤵PID:2908
-
\??\c:\jvjpp.exec:\jvjpp.exe133⤵PID:2176
-
\??\c:\jdvdj.exec:\jdvdj.exe134⤵PID:1612
-
\??\c:\llxrflx.exec:\llxrflx.exe135⤵PID:1936
-
\??\c:\lfxrxfl.exec:\lfxrxfl.exe136⤵PID:1664
-
\??\c:\ttthnh.exec:\ttthnh.exe137⤵PID:3036
-
\??\c:\hbthnt.exec:\hbthnt.exe138⤵PID:1516
-
\??\c:\pvvjv.exec:\pvvjv.exe139⤵PID:2132
-
\??\c:\1jdjv.exec:\1jdjv.exe140⤵PID:1444
-
\??\c:\lfrfrrf.exec:\lfrfrrf.exe141⤵PID:2072
-
\??\c:\fxlrfrf.exec:\fxlrfrf.exe142⤵PID:2500
-
\??\c:\hthhbh.exec:\hthhbh.exe143⤵PID:536
-
\??\c:\nhbhnn.exec:\nhbhnn.exe144⤵PID:2780
-
\??\c:\pvdvv.exec:\pvdvv.exe145⤵PID:1484
-
\??\c:\1ddvp.exec:\1ddvp.exe146⤵PID:1100
-
\??\c:\rllrxrf.exec:\rllrxrf.exe147⤵PID:1040
-
\??\c:\7fxrfxf.exec:\7fxrfxf.exe148⤵PID:912
-
\??\c:\tnhnbh.exec:\tnhnbh.exe149⤵PID:2356
-
\??\c:\3hbtnb.exec:\3hbtnb.exe150⤵PID:2992
-
\??\c:\7jjjp.exec:\7jjjp.exe151⤵PID:1788
-
\??\c:\jjjvp.exec:\jjjvp.exe152⤵PID:700
-
\??\c:\rlffflx.exec:\rlffflx.exe153⤵PID:1276
-
\??\c:\fxrfllx.exec:\fxrfllx.exe154⤵PID:1292
-
\??\c:\5hnntb.exec:\5hnntb.exe155⤵PID:992
-
\??\c:\1nbhtt.exec:\1nbhtt.exe156⤵PID:2040
-
\??\c:\3dvdp.exec:\3dvdp.exe157⤵PID:2204
-
\??\c:\jjvpd.exec:\jjvpd.exe158⤵PID:3040
-
\??\c:\rfrxfrr.exec:\rfrxfrr.exe159⤵PID:2996
-
\??\c:\xrrxflx.exec:\xrrxflx.exe160⤵PID:1732
-
\??\c:\hhtbtn.exec:\hhtbtn.exe161⤵PID:2760
-
\??\c:\bbntbh.exec:\bbntbh.exe162⤵PID:2748
-
\??\c:\jjvjp.exec:\jjvjp.exe163⤵PID:2684
-
\??\c:\llflllr.exec:\llflllr.exe164⤵PID:2628
-
\??\c:\xrffrxx.exec:\xrffrxx.exe165⤵PID:2772
-
\??\c:\9lllxxx.exec:\9lllxxx.exe166⤵PID:1668
-
\??\c:\btbnbh.exec:\btbnbh.exe167⤵PID:2788
-
\??\c:\tthnhb.exec:\tthnhb.exe168⤵PID:2408
-
\??\c:\1djpp.exec:\1djpp.exe169⤵PID:3032
-
\??\c:\vpvdd.exec:\vpvdd.exe170⤵PID:3064
-
\??\c:\3fxlrrf.exec:\3fxlrrf.exe171⤵PID:2844
-
\??\c:\rfrxlrf.exec:\rfrxlrf.exe172⤵PID:1928
-
\??\c:\bbbnth.exec:\bbbnth.exe173⤵PID:2900
-
\??\c:\hhhnbh.exec:\hhhnbh.exe174⤵PID:1780
-
\??\c:\1jjvj.exec:\1jjvj.exe175⤵PID:1580
-
\??\c:\dvpdj.exec:\dvpdj.exe176⤵PID:1628
-
\??\c:\rlllflr.exec:\rlllflr.exe177⤵PID:2592
-
\??\c:\5xlxxxl.exec:\5xlxxxl.exe178⤵PID:1124
-
\??\c:\nnnbth.exec:\nnnbth.exe179⤵PID:316
-
\??\c:\hhnbht.exec:\hhnbht.exe180⤵PID:1396
-
\??\c:\vpjdj.exec:\vpjdj.exe181⤵PID:1228
-
\??\c:\llflrrx.exec:\llflrrx.exe182⤵PID:2056
-
\??\c:\9fxfxlx.exec:\9fxfxlx.exe183⤵PID:2004
-
\??\c:\7bbnnb.exec:\7bbnnb.exe184⤵PID:1332
-
\??\c:\btnnnb.exec:\btnnnb.exe185⤵PID:2504
-
\??\c:\pppvj.exec:\pppvj.exe186⤵PID:1308
-
\??\c:\xxlrffr.exec:\xxlrffr.exe187⤵PID:988
-
\??\c:\bbbhbh.exec:\bbbhbh.exe188⤵PID:1008
-
\??\c:\pjvjd.exec:\pjvjd.exe189⤵PID:1824
-
\??\c:\1pjpj.exec:\1pjpj.exe190⤵PID:2912
-
\??\c:\rlxxflx.exec:\rlxxflx.exe191⤵PID:2364
-
\??\c:\ttnhtn.exec:\ttnhtn.exe192⤵PID:1832
-
\??\c:\ddpdp.exec:\ddpdp.exe193⤵PID:1072
-
\??\c:\lrlxxrl.exec:\lrlxxrl.exe194⤵PID:1636
-
\??\c:\hbhtbb.exec:\hbhtbb.exe195⤵PID:2256
-
\??\c:\bnhhnn.exec:\bnhhnn.exe196⤵PID:2120
-
\??\c:\jjdpv.exec:\jjdpv.exe197⤵PID:1688
-
\??\c:\pdpjp.exec:\pdpjp.exe198⤵PID:2180
-
\??\c:\1fxxlll.exec:\1fxxlll.exe199⤵PID:496
-
\??\c:\nbtbnn.exec:\nbtbnn.exe200⤵PID:2984
-
\??\c:\nhbhnh.exec:\nhbhnh.exe201⤵PID:2172
-
\??\c:\5jpdv.exec:\5jpdv.exe202⤵PID:1720
-
\??\c:\pdpjj.exec:\pdpjj.exe203⤵PID:2736
-
\??\c:\5lxrffl.exec:\5lxrffl.exe204⤵PID:2776
-
\??\c:\xrflrlx.exec:\xrflrlx.exe205⤵PID:2640
-
\??\c:\1bhnnt.exec:\1bhnnt.exe206⤵PID:2344
-
\??\c:\pdvdv.exec:\pdvdv.exe207⤵PID:2752
-
\??\c:\jdddd.exec:\jdddd.exe208⤵PID:2572
-
\??\c:\rfxlrrf.exec:\rfxlrrf.exe209⤵PID:2368
-
\??\c:\rllrflr.exec:\rllrflr.exe210⤵PID:2520
-
\??\c:\9hbhbn.exec:\9hbhbn.exe211⤵PID:2828
-
\??\c:\hbbhnn.exec:\hbbhnn.exe212⤵PID:1048
-
\??\c:\3pjdj.exec:\3pjdj.exe213⤵PID:2864
-
\??\c:\pvpdv.exec:\pvpdv.exe214⤵PID:2892
-
\??\c:\fxxflxl.exec:\fxxflxl.exe215⤵PID:2824
-
\??\c:\nbhntn.exec:\nbhntn.exe216⤵PID:1920
-
\??\c:\httnnh.exec:\httnnh.exe217⤵PID:1440
-
\??\c:\jdpdp.exec:\jdpdp.exe218⤵PID:1940
-
\??\c:\vvpvv.exec:\vvpvv.exe219⤵PID:1944
-
\??\c:\7fxlflr.exec:\7fxlflr.exe220⤵PID:1672
-
\??\c:\fxxflrf.exec:\fxxflrf.exe221⤵PID:1148
-
\??\c:\3bttbb.exec:\3bttbb.exe222⤵PID:1516
-
\??\c:\9jdjv.exec:\9jdjv.exe223⤵PID:1520
-
\??\c:\dpddp.exec:\dpddp.exe224⤵PID:1428
-
\??\c:\1fxxflf.exec:\1fxxflf.exe225⤵PID:2972
-
\??\c:\rfrxxfr.exec:\rfrxxfr.exe226⤵PID:2020
-
\??\c:\bbnthb.exec:\bbnthb.exe227⤵PID:672
-
\??\c:\nnhttb.exec:\nnhttb.exe228⤵PID:1092
-
\??\c:\7pddj.exec:\7pddj.exe229⤵PID:1160
-
\??\c:\dvvvd.exec:\dvvvd.exe230⤵PID:632
-
\??\c:\rlflrxx.exec:\rlflrxx.exe231⤵PID:2412
-
\??\c:\9rlxrxl.exec:\9rlxrxl.exe232⤵PID:2380
-
\??\c:\tthnbn.exec:\tthnbn.exe233⤵PID:1676
-
\??\c:\1nhhnb.exec:\1nhhnb.exe234⤵PID:1052
-
\??\c:\vvvjj.exec:\vvvjj.exe235⤵PID:2028
-
\??\c:\lfrxflx.exec:\lfrxflx.exe236⤵PID:1312
-
\??\c:\9llxxrf.exec:\9llxxrf.exe237⤵PID:2976
-
\??\c:\hthhnt.exec:\hthhnt.exe238⤵PID:2428
-
\??\c:\nhnnbb.exec:\nhnnbb.exe239⤵PID:1232
-
\??\c:\ddvjv.exec:\ddvjv.exe240⤵PID:2424
-
\??\c:\pjppd.exec:\pjppd.exe241⤵PID:2460
-
\??\c:\rlxfxxl.exec:\rlxfxxl.exe242⤵PID:2812