Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 06:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
12b53603144c5858323205a8cbe61a07253711e0084d887dc51f22c8039d1941_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
12b53603144c5858323205a8cbe61a07253711e0084d887dc51f22c8039d1941_NeikiAnalytics.exe
-
Size
65KB
-
MD5
b83177cbe184cd37d0fcaf63d3364fc0
-
SHA1
07fe15936bfb3315cef956b717bad97363a881de
-
SHA256
12b53603144c5858323205a8cbe61a07253711e0084d887dc51f22c8039d1941
-
SHA512
45c7e3474f00a8107c5c328bf2fdd1895d8eeca9e7a442790ede149b54fd908ac24af6d4201d4b5e845f704d7bcab2a6c6997ccb5719198f4fb88653e4d2a7a3
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6Mu/ePS3AyXmPH:ymb3NkkiQ3mdBjFI46TQyXmPH
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/2240-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/384-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1908-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1916-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/320-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1488-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/532-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2248-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1272-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/928-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
hhnntt.exe9vpdv.exeffrlrrf.exefrxrrlf.exebnbbbb.exenhbnnt.exe5vvjv.exefflrlrl.exehbhthn.exe1bttnb.exedvjjv.exefxrrflx.exexlxrflf.exehbnbnh.exe3jppd.exe9vjjj.exelrlxflr.exe5nhhnn.exenbnbhb.exe5vjpp.exe9xrxllr.exerlxlllr.exe3hbbbh.exe9nntbt.exedvvvd.exevppvd.exelfxlxfx.exennhbnn.exejdvvd.exejvdjp.exeffxrxxf.exerlxxlrf.exenhbbnn.exe9bbhbb.exejdvdv.exerfrrxrf.exefrrxflr.exetbbbbn.exenthhnh.exedpdvv.exepvddp.exe5vvjv.exerflxlrf.exe5lxfllr.exennhhnn.exe5ntbnt.exevpjvj.exepdpdv.exerfrrlff.exe1tbhnt.exe3jvjd.exepjdvd.exelxxlfrf.exerlxrflr.exerrrfrfr.exenhbnhh.exepvdjj.exeddvpp.exejdvjp.exe7rlllrf.exebttthn.exebntnnn.exe5jvvv.exevvdpp.exepid process 384 hhnntt.exe 2952 9vpdv.exe 2596 ffrlrrf.exe 2628 frxrrlf.exe 2656 bnbbbb.exe 2552 nhbnnt.exe 2388 5vvjv.exe 2884 fflrlrl.exe 1908 hbhthn.exe 2724 1bttnb.exe 2756 dvjjv.exe 2672 fxrrflx.exe 1916 xlxrflf.exe 320 hbnbnh.exe 2428 3jppd.exe 2120 9vjjj.exe 1488 lrlxflr.exe 1996 5nhhnn.exe 2164 nbnbhb.exe 2748 5vjpp.exe 1940 9xrxllr.exe 532 rlxlllr.exe 1420 3hbbbh.exe 2248 9nntbt.exe 1272 dvvvd.exe 928 vppvd.exe 2916 lfxlxfx.exe 1960 nnhbnn.exe 2100 jdvvd.exe 2232 jvdjp.exe 2144 ffxrxxf.exe 1552 rlxxlrf.exe 1656 nhbbnn.exe 2560 9bbhbb.exe 2568 jdvdv.exe 2632 rfrrxrf.exe 2532 frrxflr.exe 2644 tbbbbn.exe 2420 nthhnh.exe 2372 dpdvv.exe 2436 pvddp.exe 2056 5vvjv.exe 2932 rflxlrf.exe 784 5lxfllr.exe 2676 nnhhnn.exe 2556 5ntbnt.exe 2764 vpjvj.exe 780 pdpdv.exe 1212 rfrrlff.exe 1652 1tbhnt.exe 1568 3jvjd.exe 1456 pjdvd.exe 820 lxxlfrf.exe 2892 rlxrflr.exe 2152 rrrfrfr.exe 1996 nhbnhh.exe 2164 pvdjj.exe 2580 ddvpp.exe 488 jdvjp.exe 608 7rlllrf.exe 2480 bttthn.exe 2344 bntnnn.exe 844 5jvvv.exe 2968 vvdpp.exe -
Processes:
resource yara_rule behavioral1/memory/2240-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/384-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1908-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1916-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/320-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1488-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/532-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2248-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1272-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/928-254-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
12b53603144c5858323205a8cbe61a07253711e0084d887dc51f22c8039d1941_NeikiAnalytics.exehhnntt.exe9vpdv.exeffrlrrf.exefrxrrlf.exebnbbbb.exenhbnnt.exe5vvjv.exefflrlrl.exehbhthn.exe1bttnb.exedvjjv.exefxrrflx.exexlxrflf.exehbnbnh.exe3jppd.exedescription pid process target process PID 2240 wrote to memory of 384 2240 12b53603144c5858323205a8cbe61a07253711e0084d887dc51f22c8039d1941_NeikiAnalytics.exe hhnntt.exe PID 2240 wrote to memory of 384 2240 12b53603144c5858323205a8cbe61a07253711e0084d887dc51f22c8039d1941_NeikiAnalytics.exe hhnntt.exe PID 2240 wrote to memory of 384 2240 12b53603144c5858323205a8cbe61a07253711e0084d887dc51f22c8039d1941_NeikiAnalytics.exe hhnntt.exe PID 2240 wrote to memory of 384 2240 12b53603144c5858323205a8cbe61a07253711e0084d887dc51f22c8039d1941_NeikiAnalytics.exe hhnntt.exe PID 384 wrote to memory of 2952 384 hhnntt.exe 9vpdv.exe PID 384 wrote to memory of 2952 384 hhnntt.exe 9vpdv.exe PID 384 wrote to memory of 2952 384 hhnntt.exe 9vpdv.exe PID 384 wrote to memory of 2952 384 hhnntt.exe 9vpdv.exe PID 2952 wrote to memory of 2596 2952 9vpdv.exe ffrlrrf.exe PID 2952 wrote to memory of 2596 2952 9vpdv.exe ffrlrrf.exe PID 2952 wrote to memory of 2596 2952 9vpdv.exe ffrlrrf.exe PID 2952 wrote to memory of 2596 2952 9vpdv.exe ffrlrrf.exe PID 2596 wrote to memory of 2628 2596 ffrlrrf.exe frxrrlf.exe PID 2596 wrote to memory of 2628 2596 ffrlrrf.exe frxrrlf.exe PID 2596 wrote to memory of 2628 2596 ffrlrrf.exe frxrrlf.exe PID 2596 wrote to memory of 2628 2596 ffrlrrf.exe frxrrlf.exe PID 2628 wrote to memory of 2656 2628 frxrrlf.exe bnbbbb.exe PID 2628 wrote to memory of 2656 2628 frxrrlf.exe bnbbbb.exe PID 2628 wrote to memory of 2656 2628 frxrrlf.exe bnbbbb.exe PID 2628 wrote to memory of 2656 2628 frxrrlf.exe bnbbbb.exe PID 2656 wrote to memory of 2552 2656 bnbbbb.exe nhbnnt.exe PID 2656 wrote to memory of 2552 2656 bnbbbb.exe nhbnnt.exe PID 2656 wrote to memory of 2552 2656 bnbbbb.exe nhbnnt.exe PID 2656 wrote to memory of 2552 2656 bnbbbb.exe nhbnnt.exe PID 2552 wrote to memory of 2388 2552 nhbnnt.exe 5vvjv.exe PID 2552 wrote to memory of 2388 2552 nhbnnt.exe 5vvjv.exe PID 2552 wrote to memory of 2388 2552 nhbnnt.exe 5vvjv.exe PID 2552 wrote to memory of 2388 2552 nhbnnt.exe 5vvjv.exe PID 2388 wrote to memory of 2884 2388 5vvjv.exe fflrlrl.exe PID 2388 wrote to memory of 2884 2388 5vvjv.exe fflrlrl.exe PID 2388 wrote to memory of 2884 2388 5vvjv.exe fflrlrl.exe PID 2388 wrote to memory of 2884 2388 5vvjv.exe fflrlrl.exe PID 2884 wrote to memory of 1908 2884 fflrlrl.exe hbhthn.exe PID 2884 wrote to memory of 1908 2884 fflrlrl.exe hbhthn.exe PID 2884 wrote to memory of 1908 2884 fflrlrl.exe hbhthn.exe PID 2884 wrote to memory of 1908 2884 fflrlrl.exe hbhthn.exe PID 1908 wrote to memory of 2724 1908 hbhthn.exe 1bttnb.exe PID 1908 wrote to memory of 2724 1908 hbhthn.exe 1bttnb.exe PID 1908 wrote to memory of 2724 1908 hbhthn.exe 1bttnb.exe PID 1908 wrote to memory of 2724 1908 hbhthn.exe 1bttnb.exe PID 2724 wrote to memory of 2756 2724 1bttnb.exe dvjjv.exe PID 2724 wrote to memory of 2756 2724 1bttnb.exe dvjjv.exe PID 2724 wrote to memory of 2756 2724 1bttnb.exe dvjjv.exe PID 2724 wrote to memory of 2756 2724 1bttnb.exe dvjjv.exe PID 2756 wrote to memory of 2672 2756 dvjjv.exe fxrrflx.exe PID 2756 wrote to memory of 2672 2756 dvjjv.exe fxrrflx.exe PID 2756 wrote to memory of 2672 2756 dvjjv.exe fxrrflx.exe PID 2756 wrote to memory of 2672 2756 dvjjv.exe fxrrflx.exe PID 2672 wrote to memory of 1916 2672 fxrrflx.exe xlxrflf.exe PID 2672 wrote to memory of 1916 2672 fxrrflx.exe xlxrflf.exe PID 2672 wrote to memory of 1916 2672 fxrrflx.exe xlxrflf.exe PID 2672 wrote to memory of 1916 2672 fxrrflx.exe xlxrflf.exe PID 1916 wrote to memory of 320 1916 xlxrflf.exe hbnbnh.exe PID 1916 wrote to memory of 320 1916 xlxrflf.exe hbnbnh.exe PID 1916 wrote to memory of 320 1916 xlxrflf.exe hbnbnh.exe PID 1916 wrote to memory of 320 1916 xlxrflf.exe hbnbnh.exe PID 320 wrote to memory of 2428 320 hbnbnh.exe 3jppd.exe PID 320 wrote to memory of 2428 320 hbnbnh.exe 3jppd.exe PID 320 wrote to memory of 2428 320 hbnbnh.exe 3jppd.exe PID 320 wrote to memory of 2428 320 hbnbnh.exe 3jppd.exe PID 2428 wrote to memory of 2120 2428 3jppd.exe 9vjjj.exe PID 2428 wrote to memory of 2120 2428 3jppd.exe 9vjjj.exe PID 2428 wrote to memory of 2120 2428 3jppd.exe 9vjjj.exe PID 2428 wrote to memory of 2120 2428 3jppd.exe 9vjjj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\12b53603144c5858323205a8cbe61a07253711e0084d887dc51f22c8039d1941_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\12b53603144c5858323205a8cbe61a07253711e0084d887dc51f22c8039d1941_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\hhnntt.exec:\hhnntt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\9vpdv.exec:\9vpdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\ffrlrrf.exec:\ffrlrrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\frxrrlf.exec:\frxrrlf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\bnbbbb.exec:\bnbbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\nhbnnt.exec:\nhbnnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\5vvjv.exec:\5vvjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\fflrlrl.exec:\fflrlrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\hbhthn.exec:\hbhthn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\1bttnb.exec:\1bttnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\dvjjv.exec:\dvjjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\fxrrflx.exec:\fxrrflx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\xlxrflf.exec:\xlxrflf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\hbnbnh.exec:\hbnbnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\3jppd.exec:\3jppd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\9vjjj.exec:\9vjjj.exe17⤵
- Executes dropped EXE
PID:2120 -
\??\c:\lrlxflr.exec:\lrlxflr.exe18⤵
- Executes dropped EXE
PID:1488 -
\??\c:\5nhhnn.exec:\5nhhnn.exe19⤵
- Executes dropped EXE
PID:1996 -
\??\c:\nbnbhb.exec:\nbnbhb.exe20⤵
- Executes dropped EXE
PID:2164 -
\??\c:\5vjpp.exec:\5vjpp.exe21⤵
- Executes dropped EXE
PID:2748 -
\??\c:\9xrxllr.exec:\9xrxllr.exe22⤵
- Executes dropped EXE
PID:1940 -
\??\c:\rlxlllr.exec:\rlxlllr.exe23⤵
- Executes dropped EXE
PID:532 -
\??\c:\3hbbbh.exec:\3hbbbh.exe24⤵
- Executes dropped EXE
PID:1420 -
\??\c:\9nntbt.exec:\9nntbt.exe25⤵
- Executes dropped EXE
PID:2248 -
\??\c:\dvvvd.exec:\dvvvd.exe26⤵
- Executes dropped EXE
PID:1272 -
\??\c:\vppvd.exec:\vppvd.exe27⤵
- Executes dropped EXE
PID:928 -
\??\c:\lfxlxfx.exec:\lfxlxfx.exe28⤵
- Executes dropped EXE
PID:2916 -
\??\c:\nnhbnn.exec:\nnhbnn.exe29⤵
- Executes dropped EXE
PID:1960 -
\??\c:\jdvvd.exec:\jdvvd.exe30⤵
- Executes dropped EXE
PID:2100 -
\??\c:\jvdjp.exec:\jvdjp.exe31⤵
- Executes dropped EXE
PID:2232 -
\??\c:\ffxrxxf.exec:\ffxrxxf.exe32⤵
- Executes dropped EXE
PID:2144 -
\??\c:\rlxxlrf.exec:\rlxxlrf.exe33⤵
- Executes dropped EXE
PID:1552 -
\??\c:\nhbbnn.exec:\nhbbnn.exe34⤵
- Executes dropped EXE
PID:1656 -
\??\c:\9bbhbb.exec:\9bbhbb.exe35⤵
- Executes dropped EXE
PID:2560 -
\??\c:\jdvdv.exec:\jdvdv.exe36⤵
- Executes dropped EXE
PID:2568 -
\??\c:\rfrrxrf.exec:\rfrrxrf.exe37⤵
- Executes dropped EXE
PID:2632 -
\??\c:\frrxflr.exec:\frrxflr.exe38⤵
- Executes dropped EXE
PID:2532 -
\??\c:\tbbbbn.exec:\tbbbbn.exe39⤵
- Executes dropped EXE
PID:2644 -
\??\c:\nthhnh.exec:\nthhnh.exe40⤵
- Executes dropped EXE
PID:2420 -
\??\c:\dpdvv.exec:\dpdvv.exe41⤵
- Executes dropped EXE
PID:2372 -
\??\c:\pvddp.exec:\pvddp.exe42⤵
- Executes dropped EXE
PID:2436 -
\??\c:\5vvjv.exec:\5vvjv.exe43⤵
- Executes dropped EXE
PID:2056 -
\??\c:\rflxlrf.exec:\rflxlrf.exe44⤵
- Executes dropped EXE
PID:2932 -
\??\c:\5lxfllr.exec:\5lxfllr.exe45⤵
- Executes dropped EXE
PID:784 -
\??\c:\nnhhnn.exec:\nnhhnn.exe46⤵
- Executes dropped EXE
PID:2676 -
\??\c:\5ntbnt.exec:\5ntbnt.exe47⤵
- Executes dropped EXE
PID:2556 -
\??\c:\vpjvj.exec:\vpjvj.exe48⤵
- Executes dropped EXE
PID:2764 -
\??\c:\pdpdv.exec:\pdpdv.exe49⤵
- Executes dropped EXE
PID:780 -
\??\c:\rfrrlff.exec:\rfrrlff.exe50⤵
- Executes dropped EXE
PID:1212 -
\??\c:\1tbhnt.exec:\1tbhnt.exe51⤵
- Executes dropped EXE
PID:1652 -
\??\c:\3jvjd.exec:\3jvjd.exe52⤵
- Executes dropped EXE
PID:1568 -
\??\c:\pjdvd.exec:\pjdvd.exe53⤵
- Executes dropped EXE
PID:1456 -
\??\c:\lxxlfrf.exec:\lxxlfrf.exe54⤵
- Executes dropped EXE
PID:820 -
\??\c:\rlxrflr.exec:\rlxrflr.exe55⤵
- Executes dropped EXE
PID:2892 -
\??\c:\rrrfrfr.exec:\rrrfrfr.exe56⤵
- Executes dropped EXE
PID:2152 -
\??\c:\nhbnhh.exec:\nhbnhh.exe57⤵
- Executes dropped EXE
PID:1996 -
\??\c:\pvdjj.exec:\pvdjj.exe58⤵
- Executes dropped EXE
PID:2164 -
\??\c:\ddvpp.exec:\ddvpp.exe59⤵
- Executes dropped EXE
PID:2580 -
\??\c:\jdvjp.exec:\jdvjp.exe60⤵
- Executes dropped EXE
PID:488 -
\??\c:\7rlllrf.exec:\7rlllrf.exe61⤵
- Executes dropped EXE
PID:608 -
\??\c:\bttthn.exec:\bttthn.exe62⤵
- Executes dropped EXE
PID:2480 -
\??\c:\bntnnn.exec:\bntnnn.exe63⤵
- Executes dropped EXE
PID:2344 -
\??\c:\5jvvv.exec:\5jvvv.exe64⤵
- Executes dropped EXE
PID:844 -
\??\c:\vvdpp.exec:\vvdpp.exe65⤵
- Executes dropped EXE
PID:2968 -
\??\c:\llflxfx.exec:\llflxfx.exe66⤵PID:976
-
\??\c:\1lrflxf.exec:\1lrflxf.exe67⤵PID:1744
-
\??\c:\9bhhbb.exec:\9bhhbb.exe68⤵PID:1012
-
\??\c:\bhthht.exec:\bhthht.exe69⤵PID:2648
-
\??\c:\9ppdd.exec:\9ppdd.exe70⤵PID:1604
-
\??\c:\vjdpd.exec:\vjdpd.exe71⤵PID:1440
-
\??\c:\3frrrrx.exec:\3frrrrx.exe72⤵PID:2276
-
\??\c:\3xrrxxf.exec:\3xrrxxf.exe73⤵PID:1672
-
\??\c:\9ttbbn.exec:\9ttbbn.exe74⤵PID:1552
-
\??\c:\bttbnh.exec:\bttbnh.exe75⤵PID:2472
-
\??\c:\vjpjv.exec:\vjpjv.exe76⤵PID:2616
-
\??\c:\vppvp.exec:\vppvp.exe77⤵PID:2596
-
\??\c:\lffxfxl.exec:\lffxfxl.exe78⤵PID:2504
-
\??\c:\tbthhb.exec:\tbthhb.exe79⤵PID:2484
-
\??\c:\nhthhh.exec:\nhthhh.exe80⤵PID:2656
-
\??\c:\3jjjp.exec:\3jjjp.exe81⤵PID:2960
-
\??\c:\vvpvp.exec:\vvpvp.exe82⤵PID:2456
-
\??\c:\xrxfllr.exec:\xrxfllr.exe83⤵PID:2452
-
\??\c:\7rflxfr.exec:\7rflxfr.exe84⤵PID:2692
-
\??\c:\3tbntt.exec:\3tbntt.exe85⤵PID:2080
-
\??\c:\tnbntt.exec:\tnbntt.exe86⤵PID:2688
-
\??\c:\vjppp.exec:\vjppp.exe87⤵PID:1872
-
\??\c:\vjvvj.exec:\vjvvj.exe88⤵PID:1932
-
\??\c:\rrrlfxl.exec:\rrrlfxl.exe89⤵PID:2672
-
\??\c:\7lfrllf.exec:\7lfrllf.exe90⤵PID:2264
-
\??\c:\tthtnb.exec:\tthtnb.exe91⤵PID:2336
-
\??\c:\tthbbh.exec:\tthbbh.exe92⤵PID:1572
-
\??\c:\dvjdj.exec:\dvjdj.exe93⤵PID:2292
-
\??\c:\vpjjp.exec:\vpjjp.exe94⤵PID:2996
-
\??\c:\rrllllf.exec:\rrllllf.exe95⤵PID:2032
-
\??\c:\9rfflrx.exec:\9rfflrx.exe96⤵PID:1976
-
\??\c:\nhtbbb.exec:\nhtbbb.exe97⤵PID:1952
-
\??\c:\tntbnn.exec:\tntbnn.exe98⤵PID:1900
-
\??\c:\vpvdd.exec:\vpvdd.exe99⤵PID:612
-
\??\c:\ddvjv.exec:\ddvjv.exe100⤵PID:1940
-
\??\c:\1rxllfl.exec:\1rxllfl.exe101⤵PID:956
-
\??\c:\xrlrfxx.exec:\xrlrfxx.exe102⤵PID:2820
-
\??\c:\1bbbhb.exec:\1bbbhb.exe103⤵PID:1260
-
\??\c:\bbbtth.exec:\bbbtth.exe104⤵PID:1228
-
\??\c:\pddjj.exec:\pddjj.exe105⤵PID:1016
-
\??\c:\vpvdd.exec:\vpvdd.exe106⤵PID:2908
-
\??\c:\rflxflr.exec:\rflxflr.exe107⤵PID:2040
-
\??\c:\xfxflrx.exec:\xfxflrx.exe108⤵PID:2252
-
\??\c:\ntnbth.exec:\ntnbth.exe109⤵PID:380
-
\??\c:\5htbnn.exec:\5htbnn.exe110⤵PID:2100
-
\??\c:\9ppdj.exec:\9ppdj.exe111⤵PID:1032
-
\??\c:\vjvpj.exec:\vjvpj.exe112⤵PID:2588
-
\??\c:\llflxfl.exec:\llflxfl.exe113⤵PID:2956
-
\??\c:\lfrfffl.exec:\lfrfffl.exe114⤵PID:384
-
\??\c:\tttbtb.exec:\tttbtb.exe115⤵PID:2308
-
\??\c:\hhbnbb.exec:\hhbnbb.exe116⤵PID:2560
-
\??\c:\1ddvv.exec:\1ddvv.exe117⤵PID:2384
-
\??\c:\5jjpp.exec:\5jjpp.exe118⤵PID:2600
-
\??\c:\rfxlffx.exec:\rfxlffx.exe119⤵PID:2868
-
\??\c:\rrxrrfx.exec:\rrxrrfx.exe120⤵PID:2644
-
\??\c:\btnbhb.exec:\btnbhb.exe121⤵PID:2420
-
\??\c:\5tbbhb.exec:\5tbbhb.exe122⤵PID:2372
-
\??\c:\pdjjp.exec:\pdjjp.exe123⤵PID:2500
-
\??\c:\pjvdp.exec:\pjvdp.exe124⤵PID:2056
-
\??\c:\lfrfrrf.exec:\lfrfrrf.exe125⤵PID:2896
-
\??\c:\5nnnnh.exec:\5nnnnh.exe126⤵PID:784
-
\??\c:\9bbbhn.exec:\9bbbhn.exe127⤵PID:2724
-
\??\c:\7hbhbb.exec:\7hbhbb.exe128⤵PID:1880
-
\??\c:\3ppjv.exec:\3ppjv.exe129⤵PID:1868
-
\??\c:\vjjjj.exec:\vjjjj.exe130⤵PID:1856
-
\??\c:\1lfxxrx.exec:\1lfxxrx.exe131⤵PID:1920
-
\??\c:\lfrrrxf.exec:\lfrrrxf.exe132⤵PID:1652
-
\??\c:\hbntbt.exec:\hbntbt.exe133⤵PID:1432
-
\??\c:\ttbhtt.exec:\ttbhtt.exe134⤵PID:1456
-
\??\c:\vjvvj.exec:\vjvvj.exe135⤵PID:820
-
\??\c:\5ffflrf.exec:\5ffflrf.exe136⤵PID:2236
-
\??\c:\5frlrrx.exec:\5frlrrx.exe137⤵PID:2152
-
\??\c:\frflrxf.exec:\frflrxf.exe138⤵PID:1996
-
\??\c:\5nhnhh.exec:\5nhnhh.exe139⤵PID:2212
-
\??\c:\htbtbb.exec:\htbtbb.exe140⤵PID:2580
-
\??\c:\jvjdj.exec:\jvjdj.exe141⤵PID:2816
-
\??\c:\dvjjv.exec:\dvjjv.exe142⤵PID:608
-
\??\c:\xrxflxf.exec:\xrxflxf.exe143⤵PID:336
-
\??\c:\fxrrffx.exec:\fxrrffx.exe144⤵PID:2344
-
\??\c:\7bbhbt.exec:\7bbhbt.exe145⤵PID:1448
-
\??\c:\tbnntt.exec:\tbnntt.exe146⤵PID:2968
-
\??\c:\1jvpd.exec:\1jvpd.exe147⤵PID:2908
-
\??\c:\pjvvd.exec:\pjvvd.exe148⤵PID:1744
-
\??\c:\xxlxllr.exec:\xxlxllr.exe149⤵PID:1036
-
\??\c:\lllrxxr.exec:\lllrxxr.exe150⤵PID:656
-
\??\c:\nhthnt.exec:\nhthnt.exe151⤵PID:2020
-
\??\c:\nnnbnb.exec:\nnnbnb.exe152⤵PID:2136
-
\??\c:\7nbntb.exec:\7nbntb.exe153⤵PID:1540
-
\??\c:\jdvjj.exec:\jdvjj.exe154⤵PID:1672
-
\??\c:\pjppp.exec:\pjppp.exe155⤵PID:1520
-
\??\c:\lfxflrx.exec:\lfxflrx.exe156⤵PID:2472
-
\??\c:\rfflffl.exec:\rfflffl.exe157⤵PID:2616
-
\??\c:\tnhhhh.exec:\tnhhhh.exe158⤵PID:2596
-
\??\c:\1hthbb.exec:\1hthbb.exe159⤵PID:2512
-
\??\c:\dddjd.exec:\dddjd.exe160⤵PID:2484
-
\??\c:\pjddd.exec:\pjddd.exe161⤵PID:2700
-
\??\c:\7dddp.exec:\7dddp.exe162⤵PID:2960
-
\??\c:\lllxlxr.exec:\lllxlxr.exe163⤵PID:2456
-
\??\c:\lllxxlr.exec:\lllxxlr.exe164⤵PID:2452
-
\??\c:\tnbhnn.exec:\tnbhnn.exe165⤵PID:2436
-
\??\c:\nnhntb.exec:\nnhntb.exe166⤵PID:2080
-
\??\c:\pjpdj.exec:\pjpdj.exe167⤵PID:2736
-
\??\c:\jdvpv.exec:\jdvpv.exe168⤵PID:1872
-
\??\c:\rlllrrr.exec:\rlllrrr.exe169⤵PID:1696
-
\??\c:\5ffflll.exec:\5ffflll.exe170⤵PID:2672
-
\??\c:\ttnthh.exec:\ttnthh.exe171⤵PID:2264
-
\??\c:\nhbbnn.exec:\nhbbnn.exe172⤵PID:1212
-
\??\c:\bbnbnt.exec:\bbnbnt.exe173⤵PID:1572
-
\??\c:\jvdpj.exec:\jvdpj.exe174⤵PID:2292
-
\??\c:\pjdvp.exec:\pjdvp.exe175⤵PID:2996
-
\??\c:\fffxlrx.exec:\fffxlrx.exe176⤵PID:2032
-
\??\c:\nhtbht.exec:\nhtbht.exe177⤵PID:1976
-
\??\c:\htbbhh.exec:\htbbhh.exe178⤵PID:1952
-
\??\c:\tthnbn.exec:\tthnbn.exe179⤵PID:2164
-
\??\c:\vpjvd.exec:\vpjvd.exe180⤵PID:612
-
\??\c:\jvdjj.exec:\jvdjj.exe181⤵PID:1076
-
\??\c:\lxlrrrx.exec:\lxlrrrx.exe182⤵PID:956
-
\??\c:\5fxfffl.exec:\5fxfffl.exe183⤵PID:2480
-
\??\c:\btnhbb.exec:\btnhbb.exe184⤵PID:1260
-
\??\c:\tnhbnb.exec:\tnhbnb.exe185⤵PID:844
-
\??\c:\dpddj.exec:\dpddj.exe186⤵PID:1016
-
\??\c:\pppdp.exec:\pppdp.exe187⤵PID:2924
-
\??\c:\7fxlllx.exec:\7fxlllx.exe188⤵PID:2040
-
\??\c:\frllxfl.exec:\frllxfl.exe189⤵PID:2252
-
\??\c:\hhhnth.exec:\hhhnth.exe190⤵PID:380
-
\??\c:\hhbtbb.exec:\hhbtbb.exe191⤵PID:1012
-
\??\c:\bntbtb.exec:\bntbtb.exe192⤵PID:1032
-
\??\c:\vvpvd.exec:\vvpvd.exe193⤵PID:568
-
\??\c:\jdvdv.exec:\jdvdv.exe194⤵PID:2956
-
\??\c:\ffrrxlr.exec:\ffrrxlr.exe195⤵PID:1936
-
\??\c:\lrffxlx.exec:\lrffxlx.exe196⤵PID:2308
-
\??\c:\1bttbb.exec:\1bttbb.exe197⤵PID:2300
-
\??\c:\hbnthn.exec:\hbnthn.exe198⤵PID:2384
-
\??\c:\dvvjp.exec:\dvvjp.exe199⤵PID:2596
-
\??\c:\pjvjj.exec:\pjvjj.exe200⤵PID:2868
-
\??\c:\lxlllfr.exec:\lxlllfr.exe201⤵PID:2548
-
\??\c:\ffrlxfr.exec:\ffrlxfr.exe202⤵PID:2420
-
\??\c:\3nhthh.exec:\3nhthh.exe203⤵PID:2408
-
\??\c:\nthnht.exec:\nthnht.exe204⤵PID:2396
-
\??\c:\dvdjp.exec:\dvdjp.exe205⤵PID:2704
-
\??\c:\ppvjd.exec:\ppvjd.exe206⤵PID:2896
-
\??\c:\3vpvj.exec:\3vpvj.exe207⤵PID:2688
-
\??\c:\fffflfl.exec:\fffflfl.exe208⤵PID:2724
-
\??\c:\hbhnbb.exec:\hbhnbb.exe209⤵PID:2260
-
\??\c:\bnbbtt.exec:\bnbbtt.exe210⤵PID:1868
-
\??\c:\7ppjp.exec:\7ppjp.exe211⤵PID:2756
-
\??\c:\fxllrlr.exec:\fxllrlr.exe212⤵PID:1256
-
\??\c:\btnhbh.exec:\btnhbh.exe213⤵PID:284
-
\??\c:\hnbhht.exec:\hnbhht.exe214⤵PID:2448
-
\??\c:\dvpvv.exec:\dvpvv.exe215⤵PID:2292
-
\??\c:\7dvvd.exec:\7dvvd.exe216⤵PID:820
-
\??\c:\lfxrlrf.exec:\lfxrlrf.exe217⤵PID:2032
-
\??\c:\rfxrxxf.exec:\rfxrxxf.exe218⤵PID:2120
-
\??\c:\hbbbtn.exec:\hbbbtn.exe219⤵PID:1952
-
\??\c:\9jjjp.exec:\9jjjp.exe220⤵PID:2172
-
\??\c:\rllrlrf.exec:\rllrlrf.exe221⤵PID:612
-
\??\c:\rlrfffx.exec:\rlrfffx.exe222⤵PID:1904
-
\??\c:\5thhnt.exec:\5thhnt.exe223⤵PID:956
-
\??\c:\nhhnnn.exec:\nhhnnn.exe224⤵PID:280
-
\??\c:\pddjv.exec:\pddjv.exe225⤵PID:1260
-
\??\c:\1pddj.exec:\1pddj.exe226⤵PID:1792
-
\??\c:\5rllxfl.exec:\5rllxfl.exe227⤵PID:1228
-
\??\c:\xfrxlrl.exec:\xfrxlrl.exe228⤵PID:2916
-
\??\c:\hbntbh.exec:\hbntbh.exe229⤵PID:3044
-
\??\c:\3bthbt.exec:\3bthbt.exe230⤵PID:756
-
\??\c:\5dvdj.exec:\5dvdj.exe231⤵PID:380
-
\??\c:\5vjjp.exec:\5vjjp.exe232⤵PID:656
-
\??\c:\fxxxxxr.exec:\fxxxxxr.exe233⤵PID:1032
-
\??\c:\frlfxrf.exec:\frlfxrf.exe234⤵PID:2136
-
\??\c:\nnhtbh.exec:\nnhtbh.exe235⤵PID:872
-
\??\c:\7ttthb.exec:\7ttthb.exe236⤵PID:1672
-
\??\c:\ddpdj.exec:\ddpdj.exe237⤵PID:384
-
\??\c:\vppdp.exec:\vppdp.exe238⤵PID:1552
-
\??\c:\vpvdj.exec:\vpvdj.exe239⤵PID:2384
-
\??\c:\9xlxllx.exec:\9xlxllx.exe240⤵PID:2984
-
\??\c:\rxlrxff.exec:\rxlrxff.exe241⤵PID:2600
-
\??\c:\nhnthh.exec:\nhnthh.exe242⤵PID:2644