Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 22:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
194b2a684f3f440fcb70ebb8db52ca40_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
194b2a684f3f440fcb70ebb8db52ca40_NeikiAnalytics.exe
-
Size
244KB
-
MD5
194b2a684f3f440fcb70ebb8db52ca40
-
SHA1
09b152d2400d251b64e87b468e4d4bcfe7412a54
-
SHA256
bd9dc7b03ffe1e75895f5e7c8d345a9834f3daa8a87f5d0043b7cd0008afa03b
-
SHA512
8343b3c0285fb49467dccc2dc43e0fce13a1b0f3453cb6b295f736761634354e285fe32d7f624c178448754643fd055a09600fae5bad5918300ab40ce2cbee15
-
SSDEEP
6144:n3C9BRo/AIX27NHWpU00VIxas1oa3YiFR2:n3C9uD6AUDCa4NYmR2
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral1/memory/1728-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2076-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2260-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/928-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1684-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1956-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1896-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/484-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2868-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2012-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2360-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2276-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2272-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1584-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-1444-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
llrxrrr.exe9tbbhn.exevpvdp.exerllflfr.exelxrfflr.exe5tbhhh.exepjvpv.exelllrlrf.exefxlrxfr.exehbnbnh.exevjppd.exefflfllx.exe7rxrffr.exe5nnnbn.exepdppv.exellfrfrf.exefrxxffx.exenhthtb.exe9llrxfr.exerlxflxl.exe3thnnn.exe3vjjv.exexlxfffr.exe1xxrxrx.exe3hbhhh.exevpjpv.exelxlrfxf.exenbbhht.exe9dppv.exerlxxflr.exehbhnbh.exenhtbhh.exejvddj.exe1llxxll.exexrllxfx.exebtbbhb.exebtbttt.exeppjvp.exepjvdj.exefxfxlrr.exehhthnn.exebtnhnn.exe1thttt.exe3dpvd.exepdjpd.exe7rfxfxf.exe3xlrrxf.exenhnntt.exe3ntthb.exepdjdj.exevpddp.exe5xrxffl.exexxrlfrf.exehbnbbh.exebnnbbh.exe3djjd.exevjppp.exexlxlxrx.exerlfllrf.exetbbhhb.exe3hbnhn.exe3pvjj.exe5jjjj.exe7llrfrf.exepid process 2468 llrxrrr.exe 2076 9tbbhn.exe 2600 vpvdp.exe 2520 rllflfr.exe 2260 lxrfflr.exe 2552 5tbhhh.exe 2400 pjvpv.exe 2848 lllrlrf.exe 1584 fxlrxfr.exe 2612 hbnbnh.exe 2700 vjppd.exe 2272 fflfllx.exe 928 7rxrffr.exe 2276 5nnnbn.exe 2180 pdppv.exe 2360 llfrfrf.exe 2012 frxxffx.exe 1684 nhthtb.exe 2868 9llrxfr.exe 1956 rlxflxl.exe 2480 3thnnn.exe 484 3vjjv.exe 2728 xlxfffr.exe 2704 1xxrxrx.exe 1896 3hbhhh.exe 1304 vpjpv.exe 1588 lxlrfxf.exe 1708 nbbhht.exe 2356 9dppv.exe 2052 rlxxflr.exe 2264 hbhnbh.exe 2120 nhtbhh.exe 2188 jvddj.exe 2292 1llxxll.exe 2516 xrllxfx.exe 2652 btbbhb.exe 2392 btbttt.exe 2596 ppjvp.exe 2932 pjvdj.exe 2560 fxfxlrr.exe 2436 hhthnn.exe 2404 btnhnn.exe 776 1thttt.exe 2432 3dpvd.exe 2388 pdjpd.exe 2612 7rfxfxf.exe 2844 3xlrrxf.exe 1748 nhnntt.exe 2836 3ntthb.exe 2308 pdjdj.exe 2832 vpddp.exe 2020 5xrxffl.exe 240 xxrlfrf.exe 1580 hbnbbh.exe 2804 bnnbbh.exe 1952 3djjd.exe 1840 vjppp.exe 2196 xlxlxrx.exe 580 rlfllrf.exe 1592 tbbhhb.exe 1740 3hbnhn.exe 1620 3pvjj.exe 2884 5jjjj.exe 1792 7llrfrf.exe -
Processes:
resource yara_rule behavioral1/memory/1728-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1728-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2076-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2260-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/928-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1684-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-297-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1896-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/484-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2012-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2276-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1584-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-1444-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
194b2a684f3f440fcb70ebb8db52ca40_NeikiAnalytics.exellrxrrr.exe9tbbhn.exevpvdp.exerllflfr.exelxrfflr.exe5tbhhh.exepjvpv.exelllrlrf.exefxlrxfr.exehbnbnh.exevjppd.exefflfllx.exe7rxrffr.exe5nnnbn.exepdppv.exedescription pid process target process PID 1728 wrote to memory of 2468 1728 194b2a684f3f440fcb70ebb8db52ca40_NeikiAnalytics.exe llrxrrr.exe PID 1728 wrote to memory of 2468 1728 194b2a684f3f440fcb70ebb8db52ca40_NeikiAnalytics.exe llrxrrr.exe PID 1728 wrote to memory of 2468 1728 194b2a684f3f440fcb70ebb8db52ca40_NeikiAnalytics.exe llrxrrr.exe PID 1728 wrote to memory of 2468 1728 194b2a684f3f440fcb70ebb8db52ca40_NeikiAnalytics.exe llrxrrr.exe PID 2468 wrote to memory of 2076 2468 llrxrrr.exe 9tbbhn.exe PID 2468 wrote to memory of 2076 2468 llrxrrr.exe 9tbbhn.exe PID 2468 wrote to memory of 2076 2468 llrxrrr.exe 9tbbhn.exe PID 2468 wrote to memory of 2076 2468 llrxrrr.exe 9tbbhn.exe PID 2076 wrote to memory of 2600 2076 9tbbhn.exe vpvdp.exe PID 2076 wrote to memory of 2600 2076 9tbbhn.exe vpvdp.exe PID 2076 wrote to memory of 2600 2076 9tbbhn.exe vpvdp.exe PID 2076 wrote to memory of 2600 2076 9tbbhn.exe vpvdp.exe PID 2600 wrote to memory of 2520 2600 vpvdp.exe rllflfr.exe PID 2600 wrote to memory of 2520 2600 vpvdp.exe rllflfr.exe PID 2600 wrote to memory of 2520 2600 vpvdp.exe rllflfr.exe PID 2600 wrote to memory of 2520 2600 vpvdp.exe rllflfr.exe PID 2520 wrote to memory of 2260 2520 rllflfr.exe lxrfflr.exe PID 2520 wrote to memory of 2260 2520 rllflfr.exe lxrfflr.exe PID 2520 wrote to memory of 2260 2520 rllflfr.exe lxrfflr.exe PID 2520 wrote to memory of 2260 2520 rllflfr.exe lxrfflr.exe PID 2260 wrote to memory of 2552 2260 lxrfflr.exe 5tbhhh.exe PID 2260 wrote to memory of 2552 2260 lxrfflr.exe 5tbhhh.exe PID 2260 wrote to memory of 2552 2260 lxrfflr.exe 5tbhhh.exe PID 2260 wrote to memory of 2552 2260 lxrfflr.exe 5tbhhh.exe PID 2552 wrote to memory of 2400 2552 5tbhhh.exe pjvpv.exe PID 2552 wrote to memory of 2400 2552 5tbhhh.exe pjvpv.exe PID 2552 wrote to memory of 2400 2552 5tbhhh.exe pjvpv.exe PID 2552 wrote to memory of 2400 2552 5tbhhh.exe pjvpv.exe PID 2400 wrote to memory of 2848 2400 pjvpv.exe lllrlrf.exe PID 2400 wrote to memory of 2848 2400 pjvpv.exe lllrlrf.exe PID 2400 wrote to memory of 2848 2400 pjvpv.exe lllrlrf.exe PID 2400 wrote to memory of 2848 2400 pjvpv.exe lllrlrf.exe PID 2848 wrote to memory of 1584 2848 lllrlrf.exe fxlrxfr.exe PID 2848 wrote to memory of 1584 2848 lllrlrf.exe fxlrxfr.exe PID 2848 wrote to memory of 1584 2848 lllrlrf.exe fxlrxfr.exe PID 2848 wrote to memory of 1584 2848 lllrlrf.exe fxlrxfr.exe PID 1584 wrote to memory of 2612 1584 fxlrxfr.exe hbnbnh.exe PID 1584 wrote to memory of 2612 1584 fxlrxfr.exe hbnbnh.exe PID 1584 wrote to memory of 2612 1584 fxlrxfr.exe hbnbnh.exe PID 1584 wrote to memory of 2612 1584 fxlrxfr.exe hbnbnh.exe PID 2612 wrote to memory of 2700 2612 hbnbnh.exe vjppd.exe PID 2612 wrote to memory of 2700 2612 hbnbnh.exe vjppd.exe PID 2612 wrote to memory of 2700 2612 hbnbnh.exe vjppd.exe PID 2612 wrote to memory of 2700 2612 hbnbnh.exe vjppd.exe PID 2700 wrote to memory of 2272 2700 vjppd.exe fflfllx.exe PID 2700 wrote to memory of 2272 2700 vjppd.exe fflfllx.exe PID 2700 wrote to memory of 2272 2700 vjppd.exe fflfllx.exe PID 2700 wrote to memory of 2272 2700 vjppd.exe fflfllx.exe PID 2272 wrote to memory of 928 2272 fflfllx.exe 7rxrffr.exe PID 2272 wrote to memory of 928 2272 fflfllx.exe 7rxrffr.exe PID 2272 wrote to memory of 928 2272 fflfllx.exe 7rxrffr.exe PID 2272 wrote to memory of 928 2272 fflfllx.exe 7rxrffr.exe PID 928 wrote to memory of 2276 928 7rxrffr.exe 5nnnbn.exe PID 928 wrote to memory of 2276 928 7rxrffr.exe 5nnnbn.exe PID 928 wrote to memory of 2276 928 7rxrffr.exe 5nnnbn.exe PID 928 wrote to memory of 2276 928 7rxrffr.exe 5nnnbn.exe PID 2276 wrote to memory of 2180 2276 5nnnbn.exe pdppv.exe PID 2276 wrote to memory of 2180 2276 5nnnbn.exe pdppv.exe PID 2276 wrote to memory of 2180 2276 5nnnbn.exe pdppv.exe PID 2276 wrote to memory of 2180 2276 5nnnbn.exe pdppv.exe PID 2180 wrote to memory of 2360 2180 pdppv.exe llfrfrf.exe PID 2180 wrote to memory of 2360 2180 pdppv.exe llfrfrf.exe PID 2180 wrote to memory of 2360 2180 pdppv.exe llfrfrf.exe PID 2180 wrote to memory of 2360 2180 pdppv.exe llfrfrf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\194b2a684f3f440fcb70ebb8db52ca40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\194b2a684f3f440fcb70ebb8db52ca40_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\llrxrrr.exec:\llrxrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\9tbbhn.exec:\9tbbhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\vpvdp.exec:\vpvdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\rllflfr.exec:\rllflfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\lxrfflr.exec:\lxrfflr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\5tbhhh.exec:\5tbhhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\pjvpv.exec:\pjvpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\lllrlrf.exec:\lllrlrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\fxlrxfr.exec:\fxlrxfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\hbnbnh.exec:\hbnbnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\vjppd.exec:\vjppd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\fflfllx.exec:\fflfllx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\7rxrffr.exec:\7rxrffr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
\??\c:\5nnnbn.exec:\5nnnbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\pdppv.exec:\pdppv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\llfrfrf.exec:\llfrfrf.exe17⤵
- Executes dropped EXE
PID:2360 -
\??\c:\frxxffx.exec:\frxxffx.exe18⤵
- Executes dropped EXE
PID:2012 -
\??\c:\nhthtb.exec:\nhthtb.exe19⤵
- Executes dropped EXE
PID:1684 -
\??\c:\9llrxfr.exec:\9llrxfr.exe20⤵
- Executes dropped EXE
PID:2868 -
\??\c:\rlxflxl.exec:\rlxflxl.exe21⤵
- Executes dropped EXE
PID:1956 -
\??\c:\3thnnn.exec:\3thnnn.exe22⤵
- Executes dropped EXE
PID:2480 -
\??\c:\3vjjv.exec:\3vjjv.exe23⤵
- Executes dropped EXE
PID:484 -
\??\c:\xlxfffr.exec:\xlxfffr.exe24⤵
- Executes dropped EXE
PID:2728 -
\??\c:\1xxrxrx.exec:\1xxrxrx.exe25⤵
- Executes dropped EXE
PID:2704 -
\??\c:\3hbhhh.exec:\3hbhhh.exe26⤵
- Executes dropped EXE
PID:1896 -
\??\c:\vpjpv.exec:\vpjpv.exe27⤵
- Executes dropped EXE
PID:1304 -
\??\c:\lxlrfxf.exec:\lxlrfxf.exe28⤵
- Executes dropped EXE
PID:1588 -
\??\c:\nbbhht.exec:\nbbhht.exe29⤵
- Executes dropped EXE
PID:1708 -
\??\c:\9dppv.exec:\9dppv.exe30⤵
- Executes dropped EXE
PID:2356 -
\??\c:\rlxxflr.exec:\rlxxflr.exe31⤵
- Executes dropped EXE
PID:2052 -
\??\c:\hbhnbh.exec:\hbhnbh.exe32⤵
- Executes dropped EXE
PID:2264 -
\??\c:\nhtbhh.exec:\nhtbhh.exe33⤵
- Executes dropped EXE
PID:2120 -
\??\c:\jvddj.exec:\jvddj.exe34⤵
- Executes dropped EXE
PID:2188 -
\??\c:\1llxxll.exec:\1llxxll.exe35⤵
- Executes dropped EXE
PID:2292 -
\??\c:\xrllxfx.exec:\xrllxfx.exe36⤵
- Executes dropped EXE
PID:2516 -
\??\c:\btbbhb.exec:\btbbhb.exe37⤵
- Executes dropped EXE
PID:2652 -
\??\c:\btbttt.exec:\btbttt.exe38⤵
- Executes dropped EXE
PID:2392 -
\??\c:\ppjvp.exec:\ppjvp.exe39⤵
- Executes dropped EXE
PID:2596 -
\??\c:\pjvdj.exec:\pjvdj.exe40⤵
- Executes dropped EXE
PID:2932 -
\??\c:\fxfxlrr.exec:\fxfxlrr.exe41⤵
- Executes dropped EXE
PID:2560 -
\??\c:\hhthnn.exec:\hhthnn.exe42⤵
- Executes dropped EXE
PID:2436 -
\??\c:\btnhnn.exec:\btnhnn.exe43⤵
- Executes dropped EXE
PID:2404 -
\??\c:\1thttt.exec:\1thttt.exe44⤵
- Executes dropped EXE
PID:776 -
\??\c:\3dpvd.exec:\3dpvd.exe45⤵
- Executes dropped EXE
PID:2432 -
\??\c:\pdjpd.exec:\pdjpd.exe46⤵
- Executes dropped EXE
PID:2388 -
\??\c:\7rfxfxf.exec:\7rfxfxf.exe47⤵
- Executes dropped EXE
PID:2612 -
\??\c:\3xlrrxf.exec:\3xlrrxf.exe48⤵
- Executes dropped EXE
PID:2844 -
\??\c:\nhnntt.exec:\nhnntt.exe49⤵
- Executes dropped EXE
PID:1748 -
\??\c:\3ntthb.exec:\3ntthb.exe50⤵
- Executes dropped EXE
PID:2836 -
\??\c:\pdjdj.exec:\pdjdj.exe51⤵
- Executes dropped EXE
PID:2308 -
\??\c:\vpddp.exec:\vpddp.exe52⤵
- Executes dropped EXE
PID:2832 -
\??\c:\5xrxffl.exec:\5xrxffl.exe53⤵
- Executes dropped EXE
PID:2020 -
\??\c:\xxrlfrf.exec:\xxrlfrf.exe54⤵
- Executes dropped EXE
PID:240 -
\??\c:\hbnbbh.exec:\hbnbbh.exe55⤵
- Executes dropped EXE
PID:1580 -
\??\c:\bnnbbh.exec:\bnnbbh.exe56⤵
- Executes dropped EXE
PID:2804 -
\??\c:\3djjd.exec:\3djjd.exe57⤵
- Executes dropped EXE
PID:1952 -
\??\c:\vjppp.exec:\vjppp.exe58⤵
- Executes dropped EXE
PID:1840 -
\??\c:\xlxlxrx.exec:\xlxlxrx.exe59⤵
- Executes dropped EXE
PID:2196 -
\??\c:\rlfllrf.exec:\rlfllrf.exe60⤵
- Executes dropped EXE
PID:580 -
\??\c:\tbbhhb.exec:\tbbhhb.exe61⤵
- Executes dropped EXE
PID:1592 -
\??\c:\3hbnhn.exec:\3hbnhn.exe62⤵
- Executes dropped EXE
PID:1740 -
\??\c:\3pvjj.exec:\3pvjj.exe63⤵
- Executes dropped EXE
PID:1620 -
\??\c:\5jjjj.exec:\5jjjj.exe64⤵
- Executes dropped EXE
PID:2884 -
\??\c:\7llrfrf.exec:\7llrfrf.exe65⤵
- Executes dropped EXE
PID:1792 -
\??\c:\fxllflx.exec:\fxllflx.exe66⤵PID:800
-
\??\c:\bntbnn.exec:\bntbnn.exe67⤵PID:3048
-
\??\c:\btnbhh.exec:\btnbhh.exe68⤵PID:704
-
\??\c:\dvjvj.exec:\dvjvj.exe69⤵PID:1704
-
\??\c:\lfxxrlx.exec:\lfxxrlx.exe70⤵PID:1700
-
\??\c:\7htthn.exec:\7htthn.exe71⤵PID:2072
-
\??\c:\hthnbb.exec:\hthnbb.exe72⤵PID:1428
-
\??\c:\lflfffr.exec:\lflfffr.exe73⤵PID:1676
-
\??\c:\xrllflx.exec:\xrllflx.exe74⤵PID:1528
-
\??\c:\pjdpd.exec:\pjdpd.exe75⤵PID:1524
-
\??\c:\rllxfrf.exec:\rllxfrf.exe76⤵PID:2292
-
\??\c:\ntthhn.exec:\ntthhn.exe77⤵PID:2756
-
\??\c:\dddvj.exec:\dddvj.exe78⤵PID:2980
-
\??\c:\7llrlxr.exec:\7llrlxr.exe79⤵PID:3008
-
\??\c:\9bnnth.exec:\9bnnth.exe80⤵PID:2408
-
\??\c:\9frrrxf.exec:\9frrrxf.exe81⤵PID:2448
-
\??\c:\7ntbbt.exec:\7ntbbt.exe82⤵PID:2508
-
\??\c:\hbnthn.exec:\hbnthn.exe83⤵PID:2936
-
\??\c:\3vjpv.exec:\3vjpv.exe84⤵PID:2084
-
\??\c:\jdjdv.exec:\jdjdv.exe85⤵PID:2524
-
\??\c:\rrxflrf.exec:\rrxflrf.exe86⤵PID:2628
-
\??\c:\7xrxflr.exec:\7xrxflr.exe87⤵PID:2716
-
\??\c:\3tbttt.exec:\3tbttt.exe88⤵PID:2860
-
\??\c:\nhtthh.exec:\nhtthh.exe89⤵PID:2708
-
\??\c:\9jdjp.exec:\9jdjp.exe90⤵PID:2620
-
\??\c:\xxlrflr.exec:\xxlrflr.exe91⤵PID:2116
-
\??\c:\ffllrxf.exec:\ffllrxf.exe92⤵PID:2836
-
\??\c:\ffxxlrl.exec:\ffxxlrl.exe93⤵PID:1268
-
\??\c:\3thbnb.exec:\3thbnb.exe94⤵PID:1880
-
\??\c:\1nhbhh.exec:\1nhbhh.exe95⤵PID:2040
-
\??\c:\jvpvv.exec:\jvpvv.exe96⤵PID:2900
-
\??\c:\jjjdv.exec:\jjjdv.exe97⤵PID:1580
-
\??\c:\xllrxfr.exec:\xllrxfr.exe98⤵PID:2128
-
\??\c:\rlrlxxf.exec:\rlrlxxf.exe99⤵PID:1952
-
\??\c:\7tbbhh.exec:\7tbbhh.exe100⤵PID:1968
-
\??\c:\pjvpv.exec:\pjvpv.exe101⤵PID:2196
-
\??\c:\3pdjj.exec:\3pdjj.exe102⤵PID:580
-
\??\c:\dpvpp.exec:\dpvpp.exe103⤵PID:1592
-
\??\c:\rfflxlf.exec:\rfflxlf.exe104⤵PID:1740
-
\??\c:\frlrlrx.exec:\frlrlrx.exe105⤵PID:1620
-
\??\c:\tnbnbh.exec:\tnbnbh.exe106⤵PID:2884
-
\??\c:\tnbbhh.exec:\tnbbhh.exe107⤵PID:1792
-
\??\c:\jdjjj.exec:\jdjjj.exe108⤵PID:800
-
\??\c:\7xlrrxx.exec:\7xlrrxx.exe109⤵PID:3048
-
\??\c:\xxflrxf.exec:\xxflrxf.exe110⤵PID:704
-
\??\c:\1rxrxfl.exec:\1rxrxfl.exe111⤵PID:1704
-
\??\c:\5thntt.exec:\5thntt.exe112⤵PID:2052
-
\??\c:\7nbhtn.exec:\7nbhtn.exe113⤵PID:2960
-
\??\c:\dvpdj.exec:\dvpdj.exe114⤵PID:2784
-
\??\c:\djdjj.exec:\djdjj.exe115⤵PID:284
-
\??\c:\5fxfllr.exec:\5fxfllr.exe116⤵PID:1528
-
\??\c:\rlfrfrx.exec:\rlfrfrx.exe117⤵PID:2608
-
\??\c:\nhbbhn.exec:\nhbbhn.exe118⤵PID:2292
-
\??\c:\bnbbhn.exec:\bnbbhn.exe119⤵PID:2688
-
\??\c:\hhbntt.exec:\hhbntt.exe120⤵PID:2680
-
\??\c:\pdvdd.exec:\pdvdd.exe121⤵PID:2596
-
\??\c:\dpvpp.exec:\dpvpp.exe122⤵PID:2408
-
\??\c:\xrflxxl.exec:\xrflxxl.exe123⤵PID:2440
-
\??\c:\7bnthh.exec:\7bnthh.exe124⤵PID:2444
-
\??\c:\bbhtnt.exec:\bbhtnt.exe125⤵PID:1516
-
\??\c:\pjvdj.exec:\pjvdj.exe126⤵PID:1064
-
\??\c:\5pdjv.exec:\5pdjv.exe127⤵PID:2632
-
\??\c:\dvpdj.exec:\dvpdj.exe128⤵PID:2724
-
\??\c:\xrfrxrr.exec:\xrfrxrr.exe129⤵PID:2164
-
\??\c:\ntnbhn.exec:\ntnbhn.exe130⤵PID:784
-
\??\c:\hbhbhb.exec:\hbhbhb.exe131⤵PID:1572
-
\??\c:\vpvvv.exec:\vpvvv.exe132⤵PID:928
-
\??\c:\jdvjj.exec:\jdvjj.exe133⤵PID:2176
-
\??\c:\xxllrrf.exec:\xxllrrf.exe134⤵PID:2168
-
\??\c:\xrfllrr.exec:\xrfllrr.exe135⤵PID:2044
-
\??\c:\hthnbh.exec:\hthnbh.exe136⤵PID:2024
-
\??\c:\htntbh.exec:\htntbh.exe137⤵PID:3060
-
\??\c:\pjpdp.exec:\pjpdp.exe138⤵PID:2880
-
\??\c:\vpvvj.exec:\vpvvj.exe139⤵PID:2008
-
\??\c:\xrxfflr.exec:\xrxfflr.exe140⤵PID:2868
-
\??\c:\rflffxf.exec:\rflffxf.exe141⤵PID:1996
-
\??\c:\7hbhnh.exec:\7hbhnh.exe142⤵PID:1408
-
\??\c:\7htbhn.exec:\7htbhn.exe143⤵PID:856
-
\??\c:\7nhhtt.exec:\7nhhtt.exe144⤵PID:1144
-
\??\c:\1jvdd.exec:\1jvdd.exe145⤵PID:2332
-
\??\c:\dpjjp.exec:\dpjjp.exe146⤵PID:1544
-
\??\c:\5rxrrlf.exec:\5rxrrlf.exe147⤵PID:1560
-
\??\c:\frfrxxr.exec:\frfrxxr.exe148⤵PID:1900
-
\??\c:\thttbh.exec:\thttbh.exe149⤵PID:2788
-
\??\c:\bnbntb.exec:\bnbntb.exe150⤵PID:1244
-
\??\c:\jdppv.exec:\jdppv.exe151⤵PID:2364
-
\??\c:\vvjpp.exec:\vvjpp.exe152⤵PID:1432
-
\??\c:\xlxxxxf.exec:\xlxxxxf.exe153⤵PID:1732
-
\??\c:\xrxxxfx.exec:\xrxxxfx.exe154⤵PID:1788
-
\??\c:\9ttnth.exec:\9ttnth.exe155⤵PID:2144
-
\??\c:\3hhhnb.exec:\3hhhnb.exe156⤵PID:2532
-
\??\c:\thtntt.exec:\thtntt.exe157⤵PID:284
-
\??\c:\ddvdj.exec:\ddvdj.exe158⤵PID:2908
-
\??\c:\5jpvd.exec:\5jpvd.exe159⤵PID:2544
-
\??\c:\lllrffx.exec:\lllrffx.exe160⤵PID:2756
-
\??\c:\lflrxfr.exec:\lflrxfr.exe161⤵PID:2564
-
\??\c:\btbtnh.exec:\btbtnh.exe162⤵PID:2680
-
\??\c:\thtntn.exec:\thtntn.exe163⤵PID:2396
-
\??\c:\tnhttn.exec:\tnhttn.exe164⤵PID:2552
-
\??\c:\ppjdd.exec:\ppjdd.exe165⤵PID:2428
-
\??\c:\7jddd.exec:\7jddd.exe166⤵PID:2404
-
\??\c:\fxffffr.exec:\fxffffr.exe167⤵PID:2696
-
\??\c:\3rrxflr.exec:\3rrxflr.exe168⤵PID:2640
-
\??\c:\nnbhbh.exec:\nnbhbh.exe169⤵PID:868
-
\??\c:\bnnttt.exec:\bnnttt.exe170⤵PID:2724
-
\??\c:\dvdvd.exec:\dvdvd.exe171⤵PID:2636
-
\??\c:\vpdjj.exec:\vpdjj.exe172⤵PID:1636
-
\??\c:\xlrllfl.exec:\xlrllfl.exe173⤵PID:2484
-
\??\c:\3fffrxx.exec:\3fffrxx.exe174⤵PID:2276
-
\??\c:\tntbhh.exec:\tntbhh.exe175⤵PID:2176
-
\??\c:\bbbnth.exec:\bbbnth.exe176⤵PID:780
-
\??\c:\ppjvj.exec:\ppjvj.exe177⤵PID:2016
-
\??\c:\vdjvd.exec:\vdjvd.exe178⤵PID:2888
-
\??\c:\3lrlxfl.exec:\3lrlxfl.exe179⤵PID:1276
-
\??\c:\xxrxlrf.exec:\xxrxlrf.exe180⤵PID:2740
-
\??\c:\bbtnbb.exec:\bbtnbb.exe181⤵PID:1744
-
\??\c:\tthttb.exec:\tthttb.exe182⤵PID:268
-
\??\c:\vjpvv.exec:\vjpvv.exe183⤵PID:1400
-
\??\c:\jdpvp.exec:\jdpvp.exe184⤵PID:1780
-
\??\c:\jdpdj.exec:\jdpdj.exe185⤵PID:856
-
\??\c:\ffxlfrx.exec:\ffxlfrx.exe186⤵PID:1156
-
\??\c:\nthhbb.exec:\nthhbb.exe187⤵PID:2216
-
\??\c:\9fxfffl.exec:\9fxfffl.exe188⤵PID:2112
-
\??\c:\9bbnht.exec:\9bbnht.exe189⤵PID:1976
-
\??\c:\3btttt.exec:\3btttt.exe190⤵PID:1908
-
\??\c:\tbhtnb.exec:\tbhtnb.exe191⤵PID:628
-
\??\c:\pjvpd.exec:\pjvpd.exe192⤵PID:572
-
\??\c:\xrffrrx.exec:\xrffrrx.exe193⤵PID:2976
-
\??\c:\lfllxxr.exec:\lfllxxr.exe194⤵PID:1948
-
\??\c:\rlxxflx.exec:\rlxxflx.exe195⤵PID:2344
-
\??\c:\1tnbtt.exec:\1tnbtt.exe196⤵PID:2468
-
\??\c:\bnnhbt.exec:\bnnhbt.exe197⤵PID:1640
-
\??\c:\jpdjv.exec:\jpdjv.exe198⤵PID:888
-
\??\c:\dpjdd.exec:\dpjdd.exe199⤵PID:2572
-
\??\c:\vjvdj.exec:\vjvdj.exe200⤵PID:2512
-
\??\c:\lxxxffl.exec:\lxxxffl.exe201⤵PID:2980
-
\??\c:\lxlfxxl.exec:\lxlfxxl.exe202⤵PID:2676
-
\??\c:\5htbbb.exec:\5htbbb.exe203⤵PID:2588
-
\??\c:\nthbbt.exec:\nthbbt.exe204⤵PID:2536
-
\??\c:\dvjpj.exec:\dvjpj.exe205⤵PID:2556
-
\??\c:\dvjdp.exec:\dvjdp.exe206⤵PID:2964
-
\??\c:\1xrllrf.exec:\1xrllrf.exe207⤵PID:2856
-
\??\c:\7fffflr.exec:\7fffflr.exe208⤵PID:1584
-
\??\c:\rlxxffl.exec:\rlxxffl.exe209⤵PID:2628
-
\??\c:\bnbbbb.exec:\bnbbbb.exe210⤵PID:2656
-
\??\c:\tnbnth.exec:\tnbnth.exe211⤵PID:2612
-
\??\c:\pjjpv.exec:\pjjpv.exe212⤵PID:2844
-
\??\c:\vpddd.exec:\vpddd.exe213⤵PID:1748
-
\??\c:\5rfxffl.exec:\5rfxffl.exe214⤵PID:1444
-
\??\c:\1xlfffr.exec:\1xlfffr.exe215⤵PID:2308
-
\??\c:\nbhhhn.exec:\nbhhhn.exe216⤵PID:1268
-
\??\c:\tbnbbt.exec:\tbnbbt.exe217⤵PID:2268
-
\??\c:\3bnttb.exec:\3bnttb.exe218⤵PID:1880
-
\??\c:\dvjdj.exec:\dvjdj.exe219⤵PID:328
-
\??\c:\dvjvp.exec:\dvjvp.exe220⤵PID:2224
-
\??\c:\lffxfxx.exec:\lffxfxx.exe221⤵PID:2128
-
\??\c:\3rfrllx.exec:\3rfrllx.exe222⤵PID:1952
-
\??\c:\bhnbtb.exec:\bhnbtb.exe223⤵PID:1968
-
\??\c:\nbnhhh.exec:\nbnhhh.exe224⤵PID:2196
-
\??\c:\jjjjv.exec:\jjjjv.exe225⤵PID:580
-
\??\c:\rlfrlrx.exec:\rlfrlrx.exe226⤵PID:1780
-
\??\c:\rlllrlf.exec:\rlllrlf.exe227⤵PID:1008
-
\??\c:\bnbhnt.exec:\bnbhnt.exe228⤵PID:1940
-
\??\c:\3djpj.exec:\3djpj.exe229⤵PID:1928
-
\??\c:\rxxfrxf.exec:\rxxfrxf.exe230⤵PID:656
-
\??\c:\hhhhtb.exec:\hhhhtb.exe231⤵PID:944
-
\??\c:\1jvdj.exec:\1jvdj.exe232⤵PID:1716
-
\??\c:\frrrxfl.exec:\frrrxfl.exe233⤵PID:3048
-
\??\c:\9frrxff.exec:\9frrxff.exe234⤵PID:2768
-
\??\c:\hthnhh.exec:\hthnhh.exe235⤵PID:2356
-
\??\c:\jjdjv.exec:\jjdjv.exe236⤵PID:1564
-
\??\c:\pjvdj.exec:\pjvdj.exe237⤵PID:1232
-
\??\c:\llfxrrr.exec:\llfxrrr.exe238⤵PID:2784
-
\??\c:\3btbbt.exec:\3btbbt.exe239⤵PID:2184
-
\??\c:\nhnbbb.exec:\nhnbbb.exe240⤵PID:1528
-
\??\c:\7flrxfl.exec:\7flrxfl.exe241⤵PID:2644
-
\??\c:\fxxlfxf.exec:\fxxlfxf.exe242⤵PID:1036