Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 18:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
18144e103e775e56884312eda2167950_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
18144e103e775e56884312eda2167950_NeikiAnalytics.exe
-
Size
62KB
-
MD5
18144e103e775e56884312eda2167950
-
SHA1
49915d38a1c1044b88ce7b18e8832c0a154ca66d
-
SHA256
7e4a438753c2f5c2d0ed898823744aea98dcab116951756e0f3e2346483d4700
-
SHA512
a63fdb41d8f76a1a4f112ce110ab9285383eb688b79328ec2848c2fe8f80201c9b3e834eaf9401fa31737a150d31ad09471328a0112c96d72ae39a0adf5d494e
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIug6b9FFl:ymb3NkkiQ3mdBjFIugqr
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral2/memory/624-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4156-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2792-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1432-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4628-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4628-35-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3928-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3080-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3948-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5088-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2236-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2816-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4984-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4032-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/656-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1548-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1952-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3464-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2584-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xlrrxxr.exebtthtt.exepdjjj.exe1ppvv.exeflrrrrl.exefflfffx.exehtbbhh.exepvdpp.exejdvvp.exerlrffxr.exexfrrrlf.exe3nnnhn.exepjddd.exelffrrll.exe3bhhhh.exetnnnnn.exedpvvd.exexfrrllf.exettbtnb.exebtnnnt.exevjppd.exe7jppj.exe9llfxxr.exehhhhtt.exevdjjd.exerllfxxr.exenhhbbb.exe1bbthh.exe5vddp.exedvvpp.exerrlffxr.exe3vvpp.exejdjdv.exe7llfxfl.exehthhbh.exebtnnnn.exedvddv.exedpvvj.exefxffllf.exelfffxxr.exe3hbtnn.exepvpjv.exe5jddd.exebnthbt.exepvdvp.exedpvvp.exeflrlfrr.exenhntnt.exe1tnhnn.exejpvvj.exe1rlxrrl.exerffxxrr.exenttthh.exenhnhhh.exejjppp.exevppjv.exepppjd.exerrrlxxx.exelxllrrr.exebhnhbn.exebtnnbb.exedjdvv.exepdjdv.exe5lrrlff.exepid process 1432 xlrrxxr.exe 4156 btthtt.exe 2792 pdjjj.exe 4628 1ppvv.exe 3928 flrrrrl.exe 4992 fflfffx.exe 3080 htbbhh.exe 2236 pvdpp.exe 3948 jdvvp.exe 5088 rlrffxr.exe 4536 xfrrrlf.exe 3984 3nnnhn.exe 3564 pjddd.exe 2816 lffrrll.exe 4984 3bhhhh.exe 2368 tnnnnn.exe 3740 dpvvd.exe 4032 xfrrllf.exe 3440 ttbtnb.exe 656 btnnnt.exe 3192 vjppd.exe 4240 7jppj.exe 1284 9llfxxr.exe 1996 hhhhtt.exe 2380 vdjjd.exe 1548 rllfxxr.exe 1952 nhhbbb.exe 3464 1bbthh.exe 4824 5vddp.exe 2584 dvvpp.exe 4596 rrlffxr.exe 628 3vvpp.exe 4628 jdjdv.exe 3928 7llfxfl.exe 4060 hthhbh.exe 3784 btnnnn.exe 2388 dvddv.exe 4580 dpvvj.exe 4200 fxffllf.exe 2852 lfffxxr.exe 2908 3hbtnn.exe 844 pvpjv.exe 3984 5jddd.exe 4148 bnthbt.exe 1684 pvdvp.exe 3660 dpvvp.exe 2156 flrlfrr.exe 1648 nhntnt.exe 1624 1tnhnn.exe 384 jpvvj.exe 4236 1rlxrrl.exe 4760 rffxxrr.exe 656 nttthh.exe 1748 nhnhhh.exe 820 jjppp.exe 2092 vppjv.exe 1444 pppjd.exe 1976 rrrlxxx.exe 2380 lxllrrr.exe 4660 bhnhbn.exe 2836 btnnbb.exe 3124 djdvv.exe 3152 pdjdv.exe 4980 5lrrlff.exe -
Processes:
resource yara_rule behavioral2/memory/624-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4156-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2792-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1432-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4628-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3928-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3080-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3948-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5088-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4984-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/656-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1952-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3464-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2584-196-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
18144e103e775e56884312eda2167950_NeikiAnalytics.exexlrrxxr.exebtthtt.exepdjjj.exe1ppvv.exeflrrrrl.exefflfffx.exehtbbhh.exepvdpp.exejdvvp.exerlrffxr.exexfrrrlf.exe3nnnhn.exepjddd.exelffrrll.exe3bhhhh.exetnnnnn.exedpvvd.exexfrrllf.exettbtnb.exebtnnnt.exevjppd.exedescription pid process target process PID 624 wrote to memory of 1432 624 18144e103e775e56884312eda2167950_NeikiAnalytics.exe xlrrxxr.exe PID 624 wrote to memory of 1432 624 18144e103e775e56884312eda2167950_NeikiAnalytics.exe xlrrxxr.exe PID 624 wrote to memory of 1432 624 18144e103e775e56884312eda2167950_NeikiAnalytics.exe xlrrxxr.exe PID 1432 wrote to memory of 4156 1432 xlrrxxr.exe btthtt.exe PID 1432 wrote to memory of 4156 1432 xlrrxxr.exe btthtt.exe PID 1432 wrote to memory of 4156 1432 xlrrxxr.exe btthtt.exe PID 4156 wrote to memory of 2792 4156 btthtt.exe pdjjj.exe PID 4156 wrote to memory of 2792 4156 btthtt.exe pdjjj.exe PID 4156 wrote to memory of 2792 4156 btthtt.exe pdjjj.exe PID 2792 wrote to memory of 4628 2792 pdjjj.exe 1ppvv.exe PID 2792 wrote to memory of 4628 2792 pdjjj.exe 1ppvv.exe PID 2792 wrote to memory of 4628 2792 pdjjj.exe 1ppvv.exe PID 4628 wrote to memory of 3928 4628 1ppvv.exe flrrrrl.exe PID 4628 wrote to memory of 3928 4628 1ppvv.exe flrrrrl.exe PID 4628 wrote to memory of 3928 4628 1ppvv.exe flrrrrl.exe PID 3928 wrote to memory of 4992 3928 flrrrrl.exe fflfffx.exe PID 3928 wrote to memory of 4992 3928 flrrrrl.exe fflfffx.exe PID 3928 wrote to memory of 4992 3928 flrrrrl.exe fflfffx.exe PID 4992 wrote to memory of 3080 4992 fflfffx.exe htbbhh.exe PID 4992 wrote to memory of 3080 4992 fflfffx.exe htbbhh.exe PID 4992 wrote to memory of 3080 4992 fflfffx.exe htbbhh.exe PID 3080 wrote to memory of 2236 3080 htbbhh.exe pvdpp.exe PID 3080 wrote to memory of 2236 3080 htbbhh.exe pvdpp.exe PID 3080 wrote to memory of 2236 3080 htbbhh.exe pvdpp.exe PID 2236 wrote to memory of 3948 2236 pvdpp.exe jdvvp.exe PID 2236 wrote to memory of 3948 2236 pvdpp.exe jdvvp.exe PID 2236 wrote to memory of 3948 2236 pvdpp.exe jdvvp.exe PID 3948 wrote to memory of 5088 3948 jdvvp.exe rlrffxr.exe PID 3948 wrote to memory of 5088 3948 jdvvp.exe rlrffxr.exe PID 3948 wrote to memory of 5088 3948 jdvvp.exe rlrffxr.exe PID 5088 wrote to memory of 4536 5088 rlrffxr.exe xfrrrlf.exe PID 5088 wrote to memory of 4536 5088 rlrffxr.exe xfrrrlf.exe PID 5088 wrote to memory of 4536 5088 rlrffxr.exe xfrrrlf.exe PID 4536 wrote to memory of 3984 4536 xfrrrlf.exe 3nnnhn.exe PID 4536 wrote to memory of 3984 4536 xfrrrlf.exe 3nnnhn.exe PID 4536 wrote to memory of 3984 4536 xfrrrlf.exe 3nnnhn.exe PID 3984 wrote to memory of 3564 3984 3nnnhn.exe pjddd.exe PID 3984 wrote to memory of 3564 3984 3nnnhn.exe pjddd.exe PID 3984 wrote to memory of 3564 3984 3nnnhn.exe pjddd.exe PID 3564 wrote to memory of 2816 3564 pjddd.exe lffrrll.exe PID 3564 wrote to memory of 2816 3564 pjddd.exe lffrrll.exe PID 3564 wrote to memory of 2816 3564 pjddd.exe lffrrll.exe PID 2816 wrote to memory of 4984 2816 lffrrll.exe 3bhhhh.exe PID 2816 wrote to memory of 4984 2816 lffrrll.exe 3bhhhh.exe PID 2816 wrote to memory of 4984 2816 lffrrll.exe 3bhhhh.exe PID 4984 wrote to memory of 2368 4984 3bhhhh.exe tnnnnn.exe PID 4984 wrote to memory of 2368 4984 3bhhhh.exe tnnnnn.exe PID 4984 wrote to memory of 2368 4984 3bhhhh.exe tnnnnn.exe PID 2368 wrote to memory of 3740 2368 tnnnnn.exe dpvvd.exe PID 2368 wrote to memory of 3740 2368 tnnnnn.exe dpvvd.exe PID 2368 wrote to memory of 3740 2368 tnnnnn.exe dpvvd.exe PID 3740 wrote to memory of 4032 3740 dpvvd.exe xfrrllf.exe PID 3740 wrote to memory of 4032 3740 dpvvd.exe xfrrllf.exe PID 3740 wrote to memory of 4032 3740 dpvvd.exe xfrrllf.exe PID 4032 wrote to memory of 3440 4032 xfrrllf.exe ttbtnb.exe PID 4032 wrote to memory of 3440 4032 xfrrllf.exe ttbtnb.exe PID 4032 wrote to memory of 3440 4032 xfrrllf.exe ttbtnb.exe PID 3440 wrote to memory of 656 3440 ttbtnb.exe btnnnt.exe PID 3440 wrote to memory of 656 3440 ttbtnb.exe btnnnt.exe PID 3440 wrote to memory of 656 3440 ttbtnb.exe btnnnt.exe PID 656 wrote to memory of 3192 656 btnnnt.exe vjppd.exe PID 656 wrote to memory of 3192 656 btnnnt.exe vjppd.exe PID 656 wrote to memory of 3192 656 btnnnt.exe vjppd.exe PID 3192 wrote to memory of 4240 3192 vjppd.exe 7jppj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\18144e103e775e56884312eda2167950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18144e103e775e56884312eda2167950_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\xlrrxxr.exec:\xlrrxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\btthtt.exec:\btthtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\pdjjj.exec:\pdjjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\1ppvv.exec:\1ppvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\flrrrrl.exec:\flrrrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
\??\c:\fflfffx.exec:\fflfffx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\htbbhh.exec:\htbbhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\pvdpp.exec:\pvdpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\jdvvp.exec:\jdvvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\rlrffxr.exec:\rlrffxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\xfrrrlf.exec:\xfrrrlf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\3nnnhn.exec:\3nnnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\pjddd.exec:\pjddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
\??\c:\lffrrll.exec:\lffrrll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\3bhhhh.exec:\3bhhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\tnnnnn.exec:\tnnnnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\dpvvd.exec:\dpvvd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\xfrrllf.exec:\xfrrllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\ttbtnb.exec:\ttbtnb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\btnnnt.exec:\btnnnt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:656 -
\??\c:\vjppd.exec:\vjppd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\7jppj.exec:\7jppj.exe23⤵
- Executes dropped EXE
PID:4240 -
\??\c:\9llfxxr.exec:\9llfxxr.exe24⤵
- Executes dropped EXE
PID:1284 -
\??\c:\hhhhtt.exec:\hhhhtt.exe25⤵
- Executes dropped EXE
PID:1996 -
\??\c:\vdjjd.exec:\vdjjd.exe26⤵
- Executes dropped EXE
PID:2380 -
\??\c:\rllfxxr.exec:\rllfxxr.exe27⤵
- Executes dropped EXE
PID:1548 -
\??\c:\nhhbbb.exec:\nhhbbb.exe28⤵
- Executes dropped EXE
PID:1952 -
\??\c:\1bbthh.exec:\1bbthh.exe29⤵
- Executes dropped EXE
PID:3464 -
\??\c:\5vddp.exec:\5vddp.exe30⤵
- Executes dropped EXE
PID:4824 -
\??\c:\dvvpp.exec:\dvvpp.exe31⤵
- Executes dropped EXE
PID:2584 -
\??\c:\rrlffxr.exec:\rrlffxr.exe32⤵
- Executes dropped EXE
PID:4596 -
\??\c:\3vvpp.exec:\3vvpp.exe33⤵
- Executes dropped EXE
PID:628 -
\??\c:\jdjdv.exec:\jdjdv.exe34⤵
- Executes dropped EXE
PID:4628 -
\??\c:\7llfxfl.exec:\7llfxfl.exe35⤵
- Executes dropped EXE
PID:3928 -
\??\c:\hthhbh.exec:\hthhbh.exe36⤵
- Executes dropped EXE
PID:4060 -
\??\c:\btnnnn.exec:\btnnnn.exe37⤵
- Executes dropped EXE
PID:3784 -
\??\c:\dvddv.exec:\dvddv.exe38⤵
- Executes dropped EXE
PID:2388 -
\??\c:\dpvvj.exec:\dpvvj.exe39⤵
- Executes dropped EXE
PID:4580 -
\??\c:\fxffllf.exec:\fxffllf.exe40⤵
- Executes dropped EXE
PID:4200 -
\??\c:\lfffxxr.exec:\lfffxxr.exe41⤵
- Executes dropped EXE
PID:2852 -
\??\c:\3hbtnn.exec:\3hbtnn.exe42⤵
- Executes dropped EXE
PID:2908 -
\??\c:\pvpjv.exec:\pvpjv.exe43⤵
- Executes dropped EXE
PID:844 -
\??\c:\5jddd.exec:\5jddd.exe44⤵
- Executes dropped EXE
PID:3984 -
\??\c:\bnthbt.exec:\bnthbt.exe45⤵
- Executes dropped EXE
PID:4148 -
\??\c:\pvdvp.exec:\pvdvp.exe46⤵
- Executes dropped EXE
PID:1684 -
\??\c:\dpvvp.exec:\dpvvp.exe47⤵
- Executes dropped EXE
PID:3660 -
\??\c:\flrlfrr.exec:\flrlfrr.exe48⤵
- Executes dropped EXE
PID:2156 -
\??\c:\nhntnt.exec:\nhntnt.exe49⤵
- Executes dropped EXE
PID:1648 -
\??\c:\1tnhnn.exec:\1tnhnn.exe50⤵
- Executes dropped EXE
PID:1624 -
\??\c:\jpvvj.exec:\jpvvj.exe51⤵
- Executes dropped EXE
PID:384 -
\??\c:\1rlxrrl.exec:\1rlxrrl.exe52⤵
- Executes dropped EXE
PID:4236 -
\??\c:\rffxxrr.exec:\rffxxrr.exe53⤵
- Executes dropped EXE
PID:4760 -
\??\c:\nttthh.exec:\nttthh.exe54⤵
- Executes dropped EXE
PID:656 -
\??\c:\nhnhhh.exec:\nhnhhh.exe55⤵
- Executes dropped EXE
PID:1748 -
\??\c:\jjppp.exec:\jjppp.exe56⤵
- Executes dropped EXE
PID:820 -
\??\c:\vppjv.exec:\vppjv.exe57⤵
- Executes dropped EXE
PID:2092 -
\??\c:\pppjd.exec:\pppjd.exe58⤵
- Executes dropped EXE
PID:1444 -
\??\c:\rrrlxxx.exec:\rrrlxxx.exe59⤵
- Executes dropped EXE
PID:1976 -
\??\c:\lxllrrr.exec:\lxllrrr.exe60⤵
- Executes dropped EXE
PID:2380 -
\??\c:\bhnhbn.exec:\bhnhbn.exe61⤵
- Executes dropped EXE
PID:4660 -
\??\c:\btnnbb.exec:\btnnbb.exe62⤵
- Executes dropped EXE
PID:2836 -
\??\c:\djdvv.exec:\djdvv.exe63⤵
- Executes dropped EXE
PID:3124 -
\??\c:\pdjdv.exec:\pdjdv.exe64⤵
- Executes dropped EXE
PID:3152 -
\??\c:\5lrrlff.exec:\5lrrlff.exe65⤵
- Executes dropped EXE
PID:4980 -
\??\c:\1flfxxr.exec:\1flfxxr.exe66⤵PID:3456
-
\??\c:\ntbtbt.exec:\ntbtbt.exe67⤵PID:4724
-
\??\c:\1hnhhh.exec:\1hnhhh.exe68⤵PID:1476
-
\??\c:\3vdvp.exec:\3vdvp.exe69⤵PID:2788
-
\??\c:\xllfrrr.exec:\xllfrrr.exe70⤵PID:4628
-
\??\c:\fxffxxx.exec:\fxffxxx.exe71⤵PID:4992
-
\??\c:\hnnnhh.exec:\hnnnhh.exe72⤵PID:4060
-
\??\c:\jdjjd.exec:\jdjjd.exe73⤵PID:3784
-
\??\c:\vvvpd.exec:\vvvpd.exe74⤵PID:540
-
\??\c:\xlrlfff.exec:\xlrlfff.exe75⤵PID:5028
-
\??\c:\9hbbtt.exec:\9hbbtt.exe76⤵PID:3924
-
\??\c:\hbhhhh.exec:\hbhhhh.exe77⤵PID:2852
-
\??\c:\jdvdv.exec:\jdvdv.exe78⤵PID:2908
-
\??\c:\xrxrxxx.exec:\xrxrxxx.exe79⤵PID:844
-
\??\c:\hbbbtb.exec:\hbbbtb.exe80⤵PID:3984
-
\??\c:\dpjjd.exec:\dpjjd.exe81⤵PID:2252
-
\??\c:\nntnnt.exec:\nntnnt.exe82⤵PID:3712
-
\??\c:\tnhbtt.exec:\tnhbtt.exe83⤵PID:4512
-
\??\c:\pvppp.exec:\pvppp.exe84⤵PID:956
-
\??\c:\1pppd.exec:\1pppd.exe85⤵PID:932
-
\??\c:\flrlxxr.exec:\flrlxxr.exe86⤵PID:4944
-
\??\c:\hbbtnn.exec:\hbbtnn.exe87⤵PID:4396
-
\??\c:\dpvpj.exec:\dpvpj.exe88⤵PID:4672
-
\??\c:\lrffrrr.exec:\lrffrrr.exe89⤵PID:3020
-
\??\c:\tnbtnn.exec:\tnbtnn.exe90⤵PID:4240
-
\??\c:\fxlllll.exec:\fxlllll.exe91⤵PID:2188
-
\??\c:\dvppj.exec:\dvppj.exe92⤵PID:1440
-
\??\c:\vjjdv.exec:\vjjdv.exe93⤵PID:1444
-
\??\c:\9xfxrxx.exec:\9xfxrxx.exe94⤵PID:2192
-
\??\c:\fllfxxl.exec:\fllfxxl.exe95⤵PID:3380
-
\??\c:\hhhbbb.exec:\hhhbbb.exe96⤵PID:4404
-
\??\c:\hbttnn.exec:\hbttnn.exe97⤵PID:2892
-
\??\c:\1dddp.exec:\1dddp.exe98⤵PID:3152
-
\??\c:\pjpdv.exec:\pjpdv.exe99⤵PID:2584
-
\??\c:\rrrrrff.exec:\rrrrrff.exe100⤵PID:3216
-
\??\c:\hnhbtt.exec:\hnhbtt.exe101⤵PID:212
-
\??\c:\vpvpj.exec:\vpvpj.exe102⤵PID:4332
-
\??\c:\bnbttt.exec:\bnbttt.exe103⤵PID:644
-
\??\c:\jpppj.exec:\jpppj.exe104⤵PID:4628
-
\??\c:\7dvvd.exec:\7dvvd.exe105⤵PID:3080
-
\??\c:\fxlflll.exec:\fxlflll.exe106⤵PID:1884
-
\??\c:\rllrlrl.exec:\rllrlrl.exe107⤵PID:3008
-
\??\c:\xrrrlll.exec:\xrrrlll.exe108⤵PID:4808
-
\??\c:\nnhnht.exec:\nnhnht.exe109⤵PID:2844
-
\??\c:\tthhtt.exec:\tthhtt.exe110⤵PID:1680
-
\??\c:\9jjdv.exec:\9jjdv.exe111⤵PID:2856
-
\??\c:\pjpjd.exec:\pjpjd.exe112⤵PID:3644
-
\??\c:\ddjdd.exec:\ddjdd.exe113⤵PID:880
-
\??\c:\lfxxrrr.exec:\lfxxrrr.exe114⤵PID:1684
-
\??\c:\fxxrrrx.exec:\fxxrrrx.exe115⤵PID:556
-
\??\c:\bnnnnn.exec:\bnnnnn.exe116⤵PID:2156
-
\??\c:\vjdvv.exec:\vjdvv.exe117⤵PID:1648
-
\??\c:\dvvpv.exec:\dvvpv.exe118⤵PID:4132
-
\??\c:\jdvdp.exec:\jdvdp.exe119⤵PID:3916
-
\??\c:\lfrllrl.exec:\lfrllrl.exe120⤵PID:2172
-
\??\c:\1lrrrrx.exec:\1lrrrrx.exe121⤵PID:4492
-
\??\c:\nnnhhn.exec:\nnnhhn.exe122⤵PID:3168
-
\??\c:\1hhhbb.exec:\1hhhbb.exe123⤵PID:3020
-
\??\c:\vpvpv.exec:\vpvpv.exe124⤵PID:2648
-
\??\c:\dppjv.exec:\dppjv.exe125⤵PID:2188
-
\??\c:\bbbbtt.exec:\bbbbtt.exe126⤵PID:1976
-
\??\c:\5hnbtt.exec:\5hnbtt.exe127⤵PID:2380
-
\??\c:\lfxrlll.exec:\lfxrlll.exe128⤵PID:1408
-
\??\c:\btbbtt.exec:\btbbtt.exe129⤵PID:3124
-
\??\c:\bnbnnn.exec:\bnbnnn.exe130⤵PID:3276
-
\??\c:\ddjjd.exec:\ddjjd.exe131⤵PID:4592
-
\??\c:\pdjdv.exec:\pdjdv.exe132⤵PID:4724
-
\??\c:\ddvvj.exec:\ddvvj.exe133⤵PID:1396
-
\??\c:\9rrlfff.exec:\9rrlfff.exe134⤵PID:8
-
\??\c:\fxfffff.exec:\fxfffff.exe135⤵PID:788
-
\??\c:\nbnhhh.exec:\nbnhhh.exe136⤵PID:1000
-
\??\c:\hbhthh.exec:\hbhthh.exe137⤵PID:2236
-
\??\c:\vjjjv.exec:\vjjjv.exe138⤵PID:3948
-
\??\c:\jvvpj.exec:\jvvpj.exe139⤵PID:3008
-
\??\c:\rxrlfxx.exec:\rxrlfxx.exe140⤵PID:4808
-
\??\c:\3xlfrxx.exec:\3xlfrxx.exe141⤵PID:3308
-
\??\c:\nhhhhh.exec:\nhhhhh.exe142⤵PID:1680
-
\??\c:\7tbtbb.exec:\7tbtbb.exe143⤵PID:2856
-
\??\c:\httnbh.exec:\httnbh.exe144⤵PID:3644
-
\??\c:\pppjd.exec:\pppjd.exe145⤵PID:2252
-
\??\c:\7djdv.exec:\7djdv.exe146⤵PID:4012
-
\??\c:\rflfxrl.exec:\rflfxrl.exe147⤵PID:1104
-
\??\c:\fxxxllr.exec:\fxxxllr.exe148⤵PID:1784
-
\??\c:\frxrlrx.exec:\frxrlrx.exe149⤵PID:400
-
\??\c:\nbbtbb.exec:\nbbtbb.exe150⤵PID:4236
-
\??\c:\ntbtnn.exec:\ntbtnn.exe151⤵PID:2620
-
\??\c:\dppjd.exec:\dppjd.exe152⤵PID:4672
-
\??\c:\lffxrrr.exec:\lffxrrr.exe153⤵PID:3512
-
\??\c:\htttnn.exec:\htttnn.exe154⤵PID:3288
-
\??\c:\pjjvj.exec:\pjjvj.exe155⤵PID:4240
-
\??\c:\djpdv.exec:\djpdv.exe156⤵PID:4040
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe157⤵PID:4912
-
\??\c:\fxlxrlf.exec:\fxlxrlf.exe158⤵PID:4616
-
\??\c:\ttnntt.exec:\ttnntt.exe159⤵PID:2868
-
\??\c:\bbttnn.exec:\bbttnn.exe160⤵PID:4224
-
\??\c:\vdddd.exec:\vdddd.exe161⤵PID:1432
-
\??\c:\vpvpv.exec:\vpvpv.exe162⤵PID:4704
-
\??\c:\fxxrlrl.exec:\fxxrlrl.exe163⤵PID:4184
-
\??\c:\xlrrrrl.exec:\xlrrrrl.exe164⤵PID:2280
-
\??\c:\htbbhh.exec:\htbbhh.exe165⤵PID:1216
-
\??\c:\nnhhbb.exec:\nnhhbb.exe166⤵PID:4052
-
\??\c:\jjjjp.exec:\jjjjp.exe167⤵PID:4056
-
\??\c:\1jjdp.exec:\1jjdp.exe168⤵PID:5028
-
\??\c:\xllfffx.exec:\xllfffx.exe169⤵PID:4536
-
\??\c:\llrrrrl.exec:\llrrrrl.exe170⤵PID:1312
-
\??\c:\xlxrlll.exec:\xlxrlll.exe171⤵PID:2908
-
\??\c:\nhhbbb.exec:\nhhbbb.exe172⤵PID:844
-
\??\c:\bttttt.exec:\bttttt.exe173⤵PID:3984
-
\??\c:\7jppd.exec:\7jppd.exe174⤵PID:4984
-
\??\c:\5rxxffl.exec:\5rxxffl.exe175⤵PID:1088
-
\??\c:\thnhbb.exec:\thnhbb.exe176⤵PID:516
-
\??\c:\vppjj.exec:\vppjj.exe177⤵PID:408
-
\??\c:\pdjjd.exec:\pdjjd.exe178⤵PID:1784
-
\??\c:\rfxxrrl.exec:\rfxxrrl.exe179⤵PID:2712
-
\??\c:\3rrrlff.exec:\3rrrlff.exe180⤵PID:2172
-
\??\c:\btthnn.exec:\btthnn.exe181⤵PID:1284
-
\??\c:\hbhbbb.exec:\hbhbbb.exe182⤵PID:3684
-
\??\c:\1jdjv.exec:\1jdjv.exe183⤵PID:2364
-
\??\c:\vdjdp.exec:\vdjdp.exe184⤵PID:2240
-
\??\c:\9ffxfff.exec:\9ffxfff.exe185⤵PID:4040
-
\??\c:\5rxxxxr.exec:\5rxxxxr.exe186⤵PID:1380
-
\??\c:\xrrffrx.exec:\xrrffrx.exe187⤵PID:2308
-
\??\c:\hnnnhh.exec:\hnnnhh.exe188⤵PID:3276
-
\??\c:\7tnntb.exec:\7tnntb.exe189⤵PID:4224
-
\??\c:\djppv.exec:\djppv.exe190⤵PID:1432
-
\??\c:\1jpjd.exec:\1jpjd.exe191⤵PID:2984
-
\??\c:\rflxrlf.exec:\rflxrlf.exe192⤵PID:4184
-
\??\c:\7frlrrf.exec:\7frlrrf.exe193⤵PID:2280
-
\??\c:\9hnhhn.exec:\9hnhhn.exe194⤵PID:1664
-
\??\c:\nhhhbb.exec:\nhhhbb.exe195⤵PID:4052
-
\??\c:\jppjd.exec:\jppjd.exe196⤵PID:988
-
\??\c:\1pvvv.exec:\1pvvv.exe197⤵PID:3664
-
\??\c:\rrffxxr.exec:\rrffxxr.exe198⤵PID:2852
-
\??\c:\5llfxfx.exec:\5llfxfx.exe199⤵PID:3076
-
\??\c:\bnhbtn.exec:\bnhbtn.exe200⤵PID:4336
-
\??\c:\tbhbtt.exec:\tbhbtt.exe201⤵PID:2772
-
\??\c:\jddvv.exec:\jddvv.exe202⤵PID:3660
-
\??\c:\djpjd.exec:\djpjd.exe203⤵PID:3536
-
\??\c:\rffxxrl.exec:\rffxxrl.exe204⤵PID:408
-
\??\c:\rxffxxx.exec:\rxffxxx.exe205⤵PID:4132
-
\??\c:\hhbtnh.exec:\hhbtnh.exe206⤵PID:4672
-
\??\c:\htnhbt.exec:\htnhbt.exe207⤵PID:3020
-
\??\c:\dvppj.exec:\dvppj.exe208⤵PID:3408
-
\??\c:\7ddvj.exec:\7ddvj.exe209⤵PID:2208
-
\??\c:\jddjd.exec:\jddjd.exe210⤵PID:1408
-
\??\c:\lxffxxr.exec:\lxffxxr.exe211⤵PID:4732
-
\??\c:\rxlfxxx.exec:\rxlfxxx.exe212⤵PID:5048
-
\??\c:\bthhbh.exec:\bthhbh.exe213⤵PID:4724
-
\??\c:\3nbtnn.exec:\3nbtnn.exe214⤵PID:212
-
\??\c:\jdddv.exec:\jdddv.exe215⤵PID:3224
-
\??\c:\lfrrflr.exec:\lfrrflr.exe216⤵PID:4080
-
\??\c:\3flffff.exec:\3flffff.exe217⤵PID:3080
-
\??\c:\hhnnnb.exec:\hhnnnb.exe218⤵PID:2444
-
\??\c:\nthhbb.exec:\nthhbb.exe219⤵PID:5088
-
\??\c:\dvjpv.exec:\dvjpv.exe220⤵PID:5028
-
\??\c:\vppjd.exec:\vppjd.exe221⤵PID:2424
-
\??\c:\5xrllff.exec:\5xrllff.exe222⤵PID:2816
-
\??\c:\xfrlfll.exec:\xfrlfll.exe223⤵PID:4336
-
\??\c:\nthnhh.exec:\nthnhh.exe224⤵PID:2940
-
\??\c:\bhnnnt.exec:\bhnnnt.exe225⤵PID:4396
-
\??\c:\hbbtnn.exec:\hbbtnn.exe226⤵PID:4956
-
\??\c:\pdddv.exec:\pdddv.exe227⤵PID:3192
-
\??\c:\5ddvv.exec:\5ddvv.exe228⤵PID:3596
-
\??\c:\frxfrrr.exec:\frxfrrr.exe229⤵PID:4392
-
\??\c:\nntntt.exec:\nntntt.exe230⤵PID:2748
-
\??\c:\nhhhbh.exec:\nhhhbh.exe231⤵PID:3156
-
\??\c:\dvvpp.exec:\dvvpp.exe232⤵PID:4980
-
\??\c:\pjddv.exec:\pjddv.exe233⤵PID:1212
-
\??\c:\3rxfxlf.exec:\3rxfxlf.exe234⤵PID:5048
-
\??\c:\nhhhnn.exec:\nhhhnn.exe235⤵PID:4136
-
\??\c:\tbbtnn.exec:\tbbtnn.exe236⤵PID:880
-
\??\c:\ppppd.exec:\ppppd.exe237⤵PID:2984
-
\??\c:\ppdvd.exec:\ppdvd.exe238⤵PID:4992
-
\??\c:\fffxlxl.exec:\fffxlxl.exe239⤵PID:1216
-
\??\c:\1rrrllf.exec:\1rrrllf.exe240⤵PID:1612
-
\??\c:\3tnnhh.exec:\3tnnhh.exe241⤵PID:2812
-
\??\c:\5thbbn.exec:\5thbbn.exe242⤵PID:4536