Analysis
-
max time kernel
150s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 18:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2acf457af28a5aaf9f196d4871692910_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
2acf457af28a5aaf9f196d4871692910_NeikiAnalytics.exe
-
Size
92KB
-
MD5
2acf457af28a5aaf9f196d4871692910
-
SHA1
f3f1008ea93d1004652ef69b87a682cfb04ad578
-
SHA256
b9119989d3255cfd812bac4d259d0eeb59a1bc85cee9be2e167c38d2acbd201b
-
SHA512
28eda542f7081d2edf3feff8d4f5b3ad6a289492046ced2a397d98bc65c2d543508e542f057a331fa90e6e05693a989b8160d6c50a0eb08230e3ee36c4718b56
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxS1rj/21k:ymb3NkkiQ3mdBjFo73PYP1lri3K8Ga
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral2/memory/2256-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3916-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1080-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1256-54-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1636-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1232-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2572-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3028-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1016-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/744-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4120-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3528-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3656-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3176-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2692-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/920-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3724-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
hhnhbt.exejdjdv.exelxflffl.exenbhbtt.exebntnnt.exejpdjj.exepjvvj.exe3ffxrrl.exehbttht.exe5nttnn.exe5vjvj.exexxxxxff.exe5thhbb.exejvvvp.exe7lrlllr.exe9lrlfff.exetnnhbn.exepdvvd.exe5nhbtb.exe5jvdd.exe9ddvp.exerrfffff.exenhhbbt.exerxfrfrl.exevpvvp.exerfffffl.exefxlrlrr.exehtttnn.exe3jppp.exe7xfxffl.exehhntnh.exepjjvp.exerxxfxfl.exehbbbbb.exedvddj.exe1pvpv.exelrrllxr.exe9ntbbn.exe3llfffx.exexfrlfrx.exehthbbt.exedjvvv.exepjjjd.exe5frllrr.exevdddv.exe3dvvp.exefxffrrl.exejjvpd.exe7pvpp.exelffxllr.exe1bbhbb.exerffxrrx.exebthhhb.exexrllrlf.exennbhnb.exelfrlfxx.exerrlfxxx.exehtbbnh.exeddjdp.exepjpjd.exerlxrxxl.exexrrxllr.exebhttnn.exevpjjp.exepid process 3916 hhnhbt.exe 892 jdjdv.exe 2572 lxflffl.exe 4428 nbhbtt.exe 1232 bntnnt.exe 1636 jpdjj.exe 1256 pjvvj.exe 1080 3ffxrrl.exe 3120 hbttht.exe 3028 5nttnn.exe 1016 5vjvj.exe 744 xxxxxff.exe 1672 5thhbb.exe 4480 jvvvp.exe 4544 7lrlllr.exe 4944 9lrlfff.exe 4284 tnnhbn.exe 1964 pdvvd.exe 4656 5nhbtb.exe 4120 5jvdd.exe 3528 9ddvp.exe 3656 rrfffff.exe 1548 nhhbbt.exe 3176 rxfrfrl.exe 4568 vpvvp.exe 1528 rfffffl.exe 1588 fxlrlrr.exe 2692 htttnn.exe 920 3jppp.exe 3724 7xfxffl.exe 5112 hhntnh.exe 4104 pjjvp.exe 3476 rxxfxfl.exe 2756 hbbbbb.exe 1852 dvddj.exe 4228 1pvpv.exe 1944 lrrllxr.exe 4844 9ntbbn.exe 4960 3llfffx.exe 4592 xfrlfrx.exe 4356 hthbbt.exe 4460 djvvv.exe 3988 pjjjd.exe 3916 5frllrr.exe 436 vdddv.exe 4148 3dvvp.exe 772 fxffrrl.exe 3112 jjvpd.exe 3748 7pvpp.exe 2532 lffxllr.exe 4108 1bbhbb.exe 4920 rffxrrx.exe 4144 bthhhb.exe 3888 xrllrlf.exe 2396 nnbhnb.exe 3808 lfrlfxx.exe 1716 rrlfxxx.exe 344 htbbnh.exe 3660 ddjdp.exe 2672 pjpjd.exe 568 rlxrxxl.exe 4736 xrrxllr.exe 4796 bhttnn.exe 2908 vpjjp.exe -
Processes:
resource yara_rule behavioral2/memory/2256-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3916-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1080-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1636-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1232-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4428-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2572-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3028-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/744-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3528-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3176-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2692-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/920-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3724-194-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2acf457af28a5aaf9f196d4871692910_NeikiAnalytics.exehhnhbt.exejdjdv.exelxflffl.exenbhbtt.exebntnnt.exejpdjj.exepjvvj.exe3ffxrrl.exehbttht.exe5nttnn.exe5vjvj.exexxxxxff.exe5thhbb.exejvvvp.exe7lrlllr.exe9lrlfff.exetnnhbn.exepdvvd.exe5nhbtb.exe5jvdd.exe9ddvp.exedescription pid process target process PID 2256 wrote to memory of 3916 2256 2acf457af28a5aaf9f196d4871692910_NeikiAnalytics.exe hhnhbt.exe PID 2256 wrote to memory of 3916 2256 2acf457af28a5aaf9f196d4871692910_NeikiAnalytics.exe hhnhbt.exe PID 2256 wrote to memory of 3916 2256 2acf457af28a5aaf9f196d4871692910_NeikiAnalytics.exe hhnhbt.exe PID 3916 wrote to memory of 892 3916 hhnhbt.exe jdjdv.exe PID 3916 wrote to memory of 892 3916 hhnhbt.exe jdjdv.exe PID 3916 wrote to memory of 892 3916 hhnhbt.exe jdjdv.exe PID 892 wrote to memory of 2572 892 jdjdv.exe lxflffl.exe PID 892 wrote to memory of 2572 892 jdjdv.exe lxflffl.exe PID 892 wrote to memory of 2572 892 jdjdv.exe lxflffl.exe PID 2572 wrote to memory of 4428 2572 lxflffl.exe nbhbtt.exe PID 2572 wrote to memory of 4428 2572 lxflffl.exe nbhbtt.exe PID 2572 wrote to memory of 4428 2572 lxflffl.exe nbhbtt.exe PID 4428 wrote to memory of 1232 4428 nbhbtt.exe bntnnt.exe PID 4428 wrote to memory of 1232 4428 nbhbtt.exe bntnnt.exe PID 4428 wrote to memory of 1232 4428 nbhbtt.exe bntnnt.exe PID 1232 wrote to memory of 1636 1232 bntnnt.exe jpdjj.exe PID 1232 wrote to memory of 1636 1232 bntnnt.exe jpdjj.exe PID 1232 wrote to memory of 1636 1232 bntnnt.exe jpdjj.exe PID 1636 wrote to memory of 1256 1636 jpdjj.exe pjvvj.exe PID 1636 wrote to memory of 1256 1636 jpdjj.exe pjvvj.exe PID 1636 wrote to memory of 1256 1636 jpdjj.exe pjvvj.exe PID 1256 wrote to memory of 1080 1256 pjvvj.exe 3ffxrrl.exe PID 1256 wrote to memory of 1080 1256 pjvvj.exe 3ffxrrl.exe PID 1256 wrote to memory of 1080 1256 pjvvj.exe 3ffxrrl.exe PID 1080 wrote to memory of 3120 1080 3ffxrrl.exe hbttht.exe PID 1080 wrote to memory of 3120 1080 3ffxrrl.exe hbttht.exe PID 1080 wrote to memory of 3120 1080 3ffxrrl.exe hbttht.exe PID 3120 wrote to memory of 3028 3120 hbttht.exe 5nttnn.exe PID 3120 wrote to memory of 3028 3120 hbttht.exe 5nttnn.exe PID 3120 wrote to memory of 3028 3120 hbttht.exe 5nttnn.exe PID 3028 wrote to memory of 1016 3028 5nttnn.exe 5vjvj.exe PID 3028 wrote to memory of 1016 3028 5nttnn.exe 5vjvj.exe PID 3028 wrote to memory of 1016 3028 5nttnn.exe 5vjvj.exe PID 1016 wrote to memory of 744 1016 5vjvj.exe xxxxxff.exe PID 1016 wrote to memory of 744 1016 5vjvj.exe xxxxxff.exe PID 1016 wrote to memory of 744 1016 5vjvj.exe xxxxxff.exe PID 744 wrote to memory of 1672 744 xxxxxff.exe 5thhbb.exe PID 744 wrote to memory of 1672 744 xxxxxff.exe 5thhbb.exe PID 744 wrote to memory of 1672 744 xxxxxff.exe 5thhbb.exe PID 1672 wrote to memory of 4480 1672 5thhbb.exe jvvvp.exe PID 1672 wrote to memory of 4480 1672 5thhbb.exe jvvvp.exe PID 1672 wrote to memory of 4480 1672 5thhbb.exe jvvvp.exe PID 4480 wrote to memory of 4544 4480 jvvvp.exe 7lrlllr.exe PID 4480 wrote to memory of 4544 4480 jvvvp.exe 7lrlllr.exe PID 4480 wrote to memory of 4544 4480 jvvvp.exe 7lrlllr.exe PID 4544 wrote to memory of 4944 4544 7lrlllr.exe 9lrlfff.exe PID 4544 wrote to memory of 4944 4544 7lrlllr.exe 9lrlfff.exe PID 4544 wrote to memory of 4944 4544 7lrlllr.exe 9lrlfff.exe PID 4944 wrote to memory of 4284 4944 9lrlfff.exe tnnhbn.exe PID 4944 wrote to memory of 4284 4944 9lrlfff.exe tnnhbn.exe PID 4944 wrote to memory of 4284 4944 9lrlfff.exe tnnhbn.exe PID 4284 wrote to memory of 1964 4284 tnnhbn.exe pdvvd.exe PID 4284 wrote to memory of 1964 4284 tnnhbn.exe pdvvd.exe PID 4284 wrote to memory of 1964 4284 tnnhbn.exe pdvvd.exe PID 1964 wrote to memory of 4656 1964 pdvvd.exe 5nhbtb.exe PID 1964 wrote to memory of 4656 1964 pdvvd.exe 5nhbtb.exe PID 1964 wrote to memory of 4656 1964 pdvvd.exe 5nhbtb.exe PID 4656 wrote to memory of 4120 4656 5nhbtb.exe 5jvdd.exe PID 4656 wrote to memory of 4120 4656 5nhbtb.exe 5jvdd.exe PID 4656 wrote to memory of 4120 4656 5nhbtb.exe 5jvdd.exe PID 4120 wrote to memory of 3528 4120 5jvdd.exe 9ddvp.exe PID 4120 wrote to memory of 3528 4120 5jvdd.exe 9ddvp.exe PID 4120 wrote to memory of 3528 4120 5jvdd.exe 9ddvp.exe PID 3528 wrote to memory of 3656 3528 9ddvp.exe rrfffff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2acf457af28a5aaf9f196d4871692910_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2acf457af28a5aaf9f196d4871692910_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\hhnhbt.exec:\hhnhbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\jdjdv.exec:\jdjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
\??\c:\lxflffl.exec:\lxflffl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\nbhbtt.exec:\nbhbtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\bntnnt.exec:\bntnnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\jpdjj.exec:\jpdjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\pjvvj.exec:\pjvvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\3ffxrrl.exec:\3ffxrrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\hbttht.exec:\hbttht.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\5nttnn.exec:\5nttnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\5vjvj.exec:\5vjvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\xxxxxff.exec:\xxxxxff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\5thhbb.exec:\5thhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\jvvvp.exec:\jvvvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\7lrlllr.exec:\7lrlllr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\9lrlfff.exec:\9lrlfff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\tnnhbn.exec:\tnnhbn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\pdvvd.exec:\pdvvd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\5nhbtb.exec:\5nhbtb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\5jvdd.exec:\5jvdd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\9ddvp.exec:\9ddvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\rrfffff.exec:\rrfffff.exe23⤵
- Executes dropped EXE
PID:3656 -
\??\c:\nhhbbt.exec:\nhhbbt.exe24⤵
- Executes dropped EXE
PID:1548 -
\??\c:\rxfrfrl.exec:\rxfrfrl.exe25⤵
- Executes dropped EXE
PID:3176 -
\??\c:\vpvvp.exec:\vpvvp.exe26⤵
- Executes dropped EXE
PID:4568 -
\??\c:\rfffffl.exec:\rfffffl.exe27⤵
- Executes dropped EXE
PID:1528 -
\??\c:\fxlrlrr.exec:\fxlrlrr.exe28⤵
- Executes dropped EXE
PID:1588 -
\??\c:\htttnn.exec:\htttnn.exe29⤵
- Executes dropped EXE
PID:2692 -
\??\c:\3jppp.exec:\3jppp.exe30⤵
- Executes dropped EXE
PID:920 -
\??\c:\7xfxffl.exec:\7xfxffl.exe31⤵
- Executes dropped EXE
PID:3724 -
\??\c:\hhntnh.exec:\hhntnh.exe32⤵
- Executes dropped EXE
PID:5112 -
\??\c:\pjjvp.exec:\pjjvp.exe33⤵
- Executes dropped EXE
PID:4104 -
\??\c:\rxxfxfl.exec:\rxxfxfl.exe34⤵
- Executes dropped EXE
PID:3476 -
\??\c:\hbbbbb.exec:\hbbbbb.exe35⤵
- Executes dropped EXE
PID:2756 -
\??\c:\dvddj.exec:\dvddj.exe36⤵
- Executes dropped EXE
PID:1852 -
\??\c:\1pvpv.exec:\1pvpv.exe37⤵
- Executes dropped EXE
PID:4228 -
\??\c:\lrrllxr.exec:\lrrllxr.exe38⤵
- Executes dropped EXE
PID:1944 -
\??\c:\9ntbbn.exec:\9ntbbn.exe39⤵
- Executes dropped EXE
PID:4844 -
\??\c:\3llfffx.exec:\3llfffx.exe40⤵
- Executes dropped EXE
PID:4960 -
\??\c:\xfrlfrx.exec:\xfrlfrx.exe41⤵
- Executes dropped EXE
PID:4592 -
\??\c:\hthbbt.exec:\hthbbt.exe42⤵
- Executes dropped EXE
PID:4356 -
\??\c:\djvvv.exec:\djvvv.exe43⤵
- Executes dropped EXE
PID:4460 -
\??\c:\pjjjd.exec:\pjjjd.exe44⤵
- Executes dropped EXE
PID:3988 -
\??\c:\5frllrr.exec:\5frllrr.exe45⤵
- Executes dropped EXE
PID:3916 -
\??\c:\vdddv.exec:\vdddv.exe46⤵
- Executes dropped EXE
PID:436 -
\??\c:\3dvvp.exec:\3dvvp.exe47⤵
- Executes dropped EXE
PID:4148 -
\??\c:\fxffrrl.exec:\fxffrrl.exe48⤵
- Executes dropped EXE
PID:772 -
\??\c:\jjvpd.exec:\jjvpd.exe49⤵
- Executes dropped EXE
PID:3112 -
\??\c:\7pvpp.exec:\7pvpp.exe50⤵
- Executes dropped EXE
PID:3748 -
\??\c:\lffxllr.exec:\lffxllr.exe51⤵
- Executes dropped EXE
PID:2532 -
\??\c:\1bbhbb.exec:\1bbhbb.exe52⤵
- Executes dropped EXE
PID:4108 -
\??\c:\rffxrrx.exec:\rffxrrx.exe53⤵
- Executes dropped EXE
PID:4920 -
\??\c:\bthhhb.exec:\bthhhb.exe54⤵
- Executes dropped EXE
PID:4144 -
\??\c:\xrllrlf.exec:\xrllrlf.exe55⤵
- Executes dropped EXE
PID:3888 -
\??\c:\nnbhnb.exec:\nnbhnb.exe56⤵
- Executes dropped EXE
PID:2396 -
\??\c:\lfrlfxx.exec:\lfrlfxx.exe57⤵
- Executes dropped EXE
PID:3808 -
\??\c:\rrlfxxx.exec:\rrlfxxx.exe58⤵
- Executes dropped EXE
PID:1716 -
\??\c:\htbbnh.exec:\htbbnh.exe59⤵
- Executes dropped EXE
PID:344 -
\??\c:\ddjdp.exec:\ddjdp.exe60⤵
- Executes dropped EXE
PID:3660 -
\??\c:\pjpjd.exec:\pjpjd.exe61⤵
- Executes dropped EXE
PID:2672 -
\??\c:\rlxrxxl.exec:\rlxrxxl.exe62⤵
- Executes dropped EXE
PID:568 -
\??\c:\xrrxllr.exec:\xrrxllr.exe63⤵
- Executes dropped EXE
PID:4736 -
\??\c:\bhttnn.exec:\bhttnn.exe64⤵
- Executes dropped EXE
PID:4796 -
\??\c:\vpjjp.exec:\vpjjp.exe65⤵
- Executes dropped EXE
PID:2908 -
\??\c:\fxxrffx.exec:\fxxrffx.exe66⤵PID:1356
-
\??\c:\rlxflrx.exec:\rlxflrx.exe67⤵PID:3360
-
\??\c:\nbhbtt.exec:\nbhbtt.exe68⤵PID:4672
-
\??\c:\vppjd.exec:\vppjd.exe69⤵PID:4072
-
\??\c:\9dddp.exec:\9dddp.exe70⤵PID:4668
-
\??\c:\lllfxxx.exec:\lllfxxx.exe71⤵PID:3448
-
\??\c:\bbhhnn.exec:\bbhhnn.exe72⤵PID:5096
-
\??\c:\1djjd.exec:\1djjd.exe73⤵PID:3884
-
\??\c:\pjpjp.exec:\pjpjp.exe74⤵PID:4628
-
\??\c:\5fllrrr.exec:\5fllrrr.exe75⤵PID:4976
-
\??\c:\tbhbbt.exec:\tbhbbt.exe76⤵PID:1528
-
\??\c:\bhbhtt.exec:\bhbhtt.exe77⤵PID:3092
-
\??\c:\vpvvd.exec:\vpvvd.exe78⤵PID:676
-
\??\c:\frlxxrl.exec:\frlxxrl.exe79⤵PID:2584
-
\??\c:\xxfxrxx.exec:\xxfxrxx.exe80⤵PID:3068
-
\??\c:\7thhbh.exec:\7thhbh.exe81⤵PID:2900
-
\??\c:\vvddd.exec:\vvddd.exe82⤵PID:4104
-
\??\c:\pvvpj.exec:\pvvpj.exe83⤵PID:1992
-
\??\c:\rrxlllf.exec:\rrxlllf.exe84⤵PID:4788
-
\??\c:\ffrrxxf.exec:\ffrrxxf.exe85⤵PID:4036
-
\??\c:\bhnhbb.exec:\bhnhbb.exe86⤵PID:836
-
\??\c:\7djvd.exec:\7djvd.exe87⤵PID:1784
-
\??\c:\rlxxffx.exec:\rlxxffx.exe88⤵PID:1056
-
\??\c:\nnhthb.exec:\nnhthb.exe89⤵PID:1996
-
\??\c:\bthhnh.exec:\bthhnh.exe90⤵PID:1552
-
\??\c:\rffffff.exec:\rffffff.exe91⤵PID:3244
-
\??\c:\nthnhn.exec:\nthnhn.exe92⤵PID:2960
-
\??\c:\nhnhbb.exec:\nhnhbb.exe93⤵PID:436
-
\??\c:\dvvpj.exec:\dvvpj.exe94⤵PID:4148
-
\??\c:\pddvd.exec:\pddvd.exe95⤵PID:1952
-
\??\c:\lrxrfff.exec:\lrxrfff.exe96⤵PID:516
-
\??\c:\ffxrllf.exec:\ffxrllf.exe97⤵PID:3748
-
\??\c:\nthhnt.exec:\nthhnt.exe98⤵PID:3056
-
\??\c:\nbbttt.exec:\nbbttt.exe99⤵PID:4876
-
\??\c:\xrxxfff.exec:\xrxxfff.exe100⤵PID:1348
-
\??\c:\rlxrxfr.exec:\rlxrxfr.exe101⤵PID:2092
-
\??\c:\tbnnnn.exec:\tbnnnn.exe102⤵PID:3772
-
\??\c:\hnnhtt.exec:\hnnhtt.exe103⤵PID:3028
-
\??\c:\pvpdv.exec:\pvpdv.exe104⤵PID:432
-
\??\c:\fxlfrrr.exec:\fxlfrrr.exe105⤵PID:2796
-
\??\c:\1rrxxfl.exec:\1rrxxfl.exe106⤵PID:2852
-
\??\c:\tbbtth.exec:\tbbtth.exe107⤵PID:4760
-
\??\c:\hhbbbh.exec:\hhbbbh.exe108⤵PID:1516
-
\??\c:\pdjdv.exec:\pdjdv.exe109⤵PID:4544
-
\??\c:\rlffrxl.exec:\rlffrxl.exe110⤵PID:404
-
\??\c:\9frrrfr.exec:\9frrrfr.exe111⤵PID:2908
-
\??\c:\nhnnhh.exec:\nhnnhh.exe112⤵PID:2380
-
\??\c:\hhbhtt.exec:\hhbhtt.exe113⤵PID:4264
-
\??\c:\pjppv.exec:\pjppv.exe114⤵PID:4672
-
\??\c:\3xfxxrr.exec:\3xfxxrr.exe115⤵PID:3464
-
\??\c:\lrxxrll.exec:\lrxxrll.exe116⤵PID:448
-
\??\c:\1hbbtt.exec:\1hbbtt.exe117⤵PID:4440
-
\??\c:\tnnhtt.exec:\tnnhtt.exe118⤵PID:396
-
\??\c:\jjvpj.exec:\jjvpj.exe119⤵PID:1488
-
\??\c:\fxfxfff.exec:\fxfxfff.exe120⤵PID:1528
-
\??\c:\lxrlffx.exec:\lxrlffx.exe121⤵PID:3612
-
\??\c:\5tnhhh.exec:\5tnhhh.exe122⤵PID:4116
-
\??\c:\httnhh.exec:\httnhh.exe123⤵PID:3640
-
\??\c:\jppjj.exec:\jppjj.exe124⤵PID:3956
-
\??\c:\vppjd.exec:\vppjd.exe125⤵PID:2788
-
\??\c:\9rlffrr.exec:\9rlffrr.exe126⤵PID:4036
-
\??\c:\fxllfll.exec:\fxllfll.exe127⤵PID:4436
-
\??\c:\nthntb.exec:\nthntb.exe128⤵PID:4604
-
\??\c:\tthbnh.exec:\tthbnh.exe129⤵PID:4960
-
\??\c:\jdvjd.exec:\jdvjd.exe130⤵PID:4000
-
\??\c:\dvdpp.exec:\dvdpp.exe131⤵PID:3688
-
\??\c:\xlxrlrr.exec:\xlxrlrr.exe132⤵PID:2452
-
\??\c:\bbhbnh.exec:\bbhbnh.exe133⤵PID:3916
-
\??\c:\nnnnht.exec:\nnnnht.exe134⤵PID:2520
-
\??\c:\dvvpp.exec:\dvvpp.exe135⤵PID:2324
-
\??\c:\llrlxxx.exec:\llrlxxx.exe136⤵PID:4428
-
\??\c:\5bhbbt.exec:\5bhbbt.exe137⤵PID:1128
-
\??\c:\9ttnhh.exec:\9ttnhh.exe138⤵PID:116
-
\??\c:\5vjdv.exec:\5vjdv.exe139⤵PID:3264
-
\??\c:\rxlrlfr.exec:\rxlrlfr.exe140⤵PID:1900
-
\??\c:\xrxxrxf.exec:\xrxxrxf.exe141⤵PID:3012
-
\??\c:\bbnttt.exec:\bbnttt.exe142⤵PID:3124
-
\??\c:\lffxrrl.exec:\lffxrrl.exe143⤵PID:3504
-
\??\c:\xfrrrxx.exec:\xfrrrxx.exe144⤵PID:4540
-
\??\c:\nntbnn.exec:\nntbnn.exe145⤵PID:1716
-
\??\c:\pjjvp.exec:\pjjvp.exe146⤵PID:3584
-
\??\c:\pvdvv.exec:\pvdvv.exe147⤵PID:2672
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe148⤵PID:2456
-
\??\c:\frrlfxl.exec:\frrlfxl.exe149⤵PID:3312
-
\??\c:\bbbtbt.exec:\bbbtbt.exe150⤵PID:1632
-
\??\c:\pjvpd.exec:\pjvpd.exe151⤵PID:4284
-
\??\c:\tnbbbb.exec:\tnbbbb.exe152⤵PID:5056
-
\??\c:\vdvpp.exec:\vdvpp.exe153⤵PID:3360
-
\??\c:\lxlfxxx.exec:\lxlfxxx.exe154⤵PID:4656
-
\??\c:\tthttn.exec:\tthttn.exe155⤵PID:3384
-
\??\c:\jvdvv.exec:\jvdvv.exe156⤵PID:1604
-
\??\c:\xlflrxr.exec:\xlflrxr.exe157⤵PID:3448
-
\??\c:\lxxxxff.exec:\lxxxxff.exe158⤵PID:3176
-
\??\c:\tbhbnb.exec:\tbhbnb.exe159⤵PID:2780
-
\??\c:\nttnhb.exec:\nttnhb.exe160⤵PID:2640
-
\??\c:\jjjdd.exec:\jjjdd.exe161⤵PID:920
-
\??\c:\jvvjd.exec:\jvvjd.exe162⤵PID:4660
-
\??\c:\fxrrffl.exec:\fxrrffl.exe163⤵PID:3500
-
\??\c:\3nhhbn.exec:\3nhhbn.exe164⤵PID:4104
-
\??\c:\tbnhhn.exec:\tbnhhn.exe165⤵PID:924
-
\??\c:\1dppj.exec:\1dppj.exe166⤵PID:948
-
\??\c:\jvjjj.exec:\jvjjj.exe167⤵PID:4036
-
\??\c:\llrrrxl.exec:\llrrrxl.exe168⤵PID:3984
-
\??\c:\rlxlllr.exec:\rlxlllr.exe169⤵PID:4372
-
\??\c:\9lrrrff.exec:\9lrrrff.exe170⤵PID:1996
-
\??\c:\nnthtt.exec:\nnthtt.exe171⤵PID:3052
-
\??\c:\nnbbbh.exec:\nnbbbh.exe172⤵PID:3452
-
\??\c:\djjjd.exec:\djjjd.exe173⤵PID:436
-
\??\c:\1jjjd.exec:\1jjjd.exe174⤵PID:3112
-
\??\c:\rlrrlrr.exec:\rlrrlrr.exe175⤵PID:2388
-
\??\c:\xrfffff.exec:\xrfffff.exe176⤵PID:1636
-
\??\c:\1tbbbh.exec:\1tbbbh.exe177⤵PID:4344
-
\??\c:\ttbbnt.exec:\ttbbnt.exe178⤵PID:3264
-
\??\c:\jvjjd.exec:\jvjjd.exe179⤵PID:4872
-
\??\c:\7jvvv.exec:\7jvvv.exe180⤵PID:964
-
\??\c:\9rflrff.exec:\9rflrff.exe181⤵PID:3124
-
\??\c:\7xllrrf.exec:\7xllrrf.exe182⤵PID:3504
-
\??\c:\xlrrrrr.exec:\xlrrrrr.exe183⤵PID:1532
-
\??\c:\btnbbn.exec:\btnbbn.exe184⤵PID:2796
-
\??\c:\1tbhhh.exec:\1tbhhh.exe185⤵PID:1616
-
\??\c:\vpdjv.exec:\vpdjv.exe186⤵PID:1404
-
\??\c:\ddddj.exec:\ddddj.exe187⤵PID:2456
-
\??\c:\frxlrrf.exec:\frxlrrf.exe188⤵PID:4544
-
\??\c:\rlfffxf.exec:\rlfffxf.exe189⤵PID:404
-
\??\c:\bhbhnt.exec:\bhbhnt.exe190⤵PID:4784
-
\??\c:\tthhnt.exec:\tthhnt.exe191⤵PID:2380
-
\??\c:\vvddd.exec:\vvddd.exe192⤵PID:4264
-
\??\c:\pvvvv.exec:\pvvvv.exe193⤵PID:4656
-
\??\c:\rrxrlrr.exec:\rrxrlrr.exe194⤵PID:3464
-
\??\c:\7lllllr.exec:\7lllllr.exe195⤵PID:1604
-
\??\c:\nhnnnt.exec:\nhnnnt.exe196⤵PID:3356
-
\??\c:\nhnntb.exec:\nhnntb.exe197⤵PID:1492
-
\??\c:\jdppp.exec:\jdppp.exe198⤵PID:3352
-
\??\c:\ppppd.exec:\ppppd.exe199⤵PID:676
-
\??\c:\1rxxfff.exec:\1rxxfff.exe200⤵PID:544
-
\??\c:\lrrllff.exec:\lrrllff.exe201⤵PID:4660
-
\??\c:\nbhtth.exec:\nbhtth.exe202⤵PID:3500
-
\??\c:\hbbbnn.exec:\hbbbnn.exe203⤵PID:1660
-
\??\c:\pvvjd.exec:\pvvjd.exe204⤵PID:4536
-
\??\c:\rrrrlrr.exec:\rrrrlrr.exe205⤵PID:948
-
\??\c:\tbbnbt.exec:\tbbnbt.exe206⤵PID:2800
-
\??\c:\nhtnnn.exec:\nhtnnn.exe207⤵PID:3984
-
\??\c:\jdvvv.exec:\jdvvv.exe208⤵PID:4372
-
\??\c:\jjddd.exec:\jjddd.exe209⤵PID:1996
-
\??\c:\xrxxrrr.exec:\xrxxrrr.exe210⤵PID:2564
-
\??\c:\rflffll.exec:\rflffll.exe211⤵PID:3480
-
\??\c:\nnnnnn.exec:\nnnnnn.exe212⤵PID:1232
-
\??\c:\nhttbb.exec:\nhttbb.exe213⤵PID:3100
-
\??\c:\vvdjp.exec:\vvdjp.exe214⤵PID:2948
-
\??\c:\7ddjj.exec:\7ddjj.exe215⤵PID:332
-
\??\c:\vpvvv.exec:\vpvvv.exe216⤵PID:3928
-
\??\c:\rlrlflr.exec:\rlrlflr.exe217⤵PID:748
-
\??\c:\1xxrxxf.exec:\1xxrxxf.exe218⤵PID:1080
-
\??\c:\hhhhnn.exec:\hhhhnn.exe219⤵PID:5028
-
\??\c:\7ttttb.exec:\7ttttb.exe220⤵PID:3080
-
\??\c:\1jppv.exec:\1jppv.exe221⤵PID:2540
-
\??\c:\jdjjd.exec:\jdjjd.exe222⤵PID:1532
-
\??\c:\5xffxxl.exec:\5xffxxl.exe223⤵PID:5092
-
\??\c:\xlrrrll.exec:\xlrrrll.exe224⤵PID:1616
-
\??\c:\fxxxxfx.exec:\fxxxxfx.exe225⤵PID:3312
-
\??\c:\bntnnn.exec:\bntnnn.exe226⤵PID:1632
-
\??\c:\hthhtb.exec:\hthhtb.exe227⤵PID:404
-
\??\c:\vpvvd.exec:\vpvvd.exe228⤵PID:4784
-
\??\c:\jjppp.exec:\jjppp.exe229⤵PID:4672
-
\??\c:\fxlllrr.exec:\fxlllrr.exe230⤵PID:4264
-
\??\c:\llxxxfl.exec:\llxxxfl.exe231⤵PID:4656
-
\??\c:\hhntbh.exec:\hhntbh.exe232⤵PID:3448
-
\??\c:\3jjvp.exec:\3jjvp.exe233⤵PID:1604
-
\??\c:\pvjjd.exec:\pvjjd.exe234⤵PID:2780
-
\??\c:\rrrrrxx.exec:\rrrrrxx.exe235⤵PID:2640
-
\??\c:\rlxxxff.exec:\rlxxxff.exe236⤵PID:3612
-
\??\c:\nnthbt.exec:\nnthbt.exe237⤵PID:2900
-
\??\c:\bnbbbb.exec:\bnbbbb.exe238⤵PID:4788
-
\??\c:\ddddd.exec:\ddddd.exe239⤵PID:4104
-
\??\c:\dvdjd.exec:\dvdjd.exe240⤵PID:924
-
\??\c:\pjjpp.exec:\pjjpp.exe241⤵PID:1840
-
\??\c:\frrrrxr.exec:\frrrrxr.exe242⤵PID:4360