Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 14:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d36e8ab87b3fa7fb41c38c33f135aae0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
d36e8ab87b3fa7fb41c38c33f135aae0_NeikiAnalytics.exe
-
Size
275KB
-
MD5
d36e8ab87b3fa7fb41c38c33f135aae0
-
SHA1
6d2f61fc8e960d208d9b17c522e79be40e0ae64f
-
SHA256
05978b63e4a00262e78b5b9fe6d332405487bd179029a943e94de6f2374a0e56
-
SHA512
d1c44329d74fbbb0daf87cf4ccdbf95a093086fa52d4287df12403eb9efa5b854c82adb818b159609f46b19a98bd80559119473f7dc16ef84c686c780aaa3da9
-
SSDEEP
6144:n3C9BRIG0asYFm71m8+GdkB9yMu7Vvemo:n3C9uYA71kSMue
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral2/memory/2196-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/744-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2664-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2644-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4500-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1012-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2604-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1408-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2236-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4920-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4640-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2180-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1132-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4276-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5028-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3512-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4472-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1688-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1628-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4120-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2560-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
dpppj.exelxfxrrl.exeppvpv.exevjppv.exerflfffx.exetnnhnh.exefxxrrxx.exetthbbt.exenhhhbt.exejvddd.exerllllxl.exehbhhbt.exebnnbhb.exehnnhhh.exevvppd.exe5nttnt.exevpvvv.exe1xlffll.exehhnntn.exe3pvvp.exe7ttnhh.exepjppj.exeddvvv.exellrrrxl.exejdjdd.exedvvdp.exe5bhthb.exejjjdj.exerlfrfxr.exeffllffx.exe3nhbbh.exelxfxrrr.exe3bbbbb.exevppvv.exe7rlfxfx.exelfffrrl.exebthhhb.exevjjdv.exerffrxxx.exebtbnhh.exejpddd.exe3djjj.exelxfrlfr.exexrxrxxf.exetbhbbh.exe1pvpp.exejdddd.exe7lfxxxr.exexxfffll.exebbhbtn.exevpvpp.exerxxxrrl.exennbthb.exepjddv.exepvjjv.exerrllfff.exehtnnhh.exepddjv.exe1dpdj.exexrrlfff.exelfrrxxf.exe5vddv.exe7jjdv.exefxlffff.exepid process 744 dpppj.exe 2664 lxfxrrl.exe 1012 ppvpv.exe 2644 vjppv.exe 4500 rflfffx.exe 2604 tnnhnh.exe 4920 fxxrrxx.exe 1408 tthbbt.exe 2236 nhhhbt.exe 4608 jvddd.exe 4640 rllllxl.exe 2344 hbhhbt.exe 2220 bnnbhb.exe 2180 hnnhhh.exe 1132 vvppd.exe 4116 5nttnt.exe 5056 vpvvv.exe 4276 1xlffll.exe 4288 hhnntn.exe 5028 3pvvp.exe 3512 7ttnhh.exe 4472 pjppj.exe 2596 ddvvv.exe 1688 llrrrxl.exe 1628 jdjdd.exe 632 dvvdp.exe 3628 5bhthb.exe 4684 jjjdj.exe 4120 rlfrfxr.exe 2560 ffllffx.exe 2516 3nhbbh.exe 2808 lxfxrrr.exe 2420 3bbbbb.exe 3504 vppvv.exe 4608 7rlfxfx.exe 2588 lfffrrl.exe 4104 bthhhb.exe 2220 vjjdv.exe 844 rffrxxx.exe 4864 btbnhh.exe 2980 jpddd.exe 1732 3djjj.exe 2896 lxfrlfr.exe 2684 xrxrxxf.exe 2388 tbhbbh.exe 396 1pvpp.exe 1100 jdddd.exe 5028 7lfxxxr.exe 4108 xxfffll.exe 3500 bbhbtn.exe 672 vpvpp.exe 4676 rxxxrrl.exe 4624 nnbthb.exe 1472 pjddv.exe 1384 pvjjv.exe 4636 rrllfff.exe 4988 htnnhh.exe 3268 pddjv.exe 3300 1dpdj.exe 5044 xrrlfff.exe 2560 lfrrxxf.exe 1408 5vddv.exe 4520 7jjdv.exe 1064 fxlffff.exe -
Processes:
resource yara_rule behavioral2/memory/2196-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/744-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2664-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2644-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1012-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1408-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4920-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2180-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1132-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4276-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5028-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3512-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4472-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1688-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1628-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2560-196-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d36e8ab87b3fa7fb41c38c33f135aae0_NeikiAnalytics.exedpppj.exelxfxrrl.exeppvpv.exevjppv.exerflfffx.exetnnhnh.exefxxrrxx.exetthbbt.exenhhhbt.exejvddd.exerllllxl.exehbhhbt.exebnnbhb.exehnnhhh.exevvppd.exe5nttnt.exevpvvv.exe1xlffll.exehhnntn.exe3pvvp.exe7ttnhh.exedescription pid process target process PID 2196 wrote to memory of 744 2196 d36e8ab87b3fa7fb41c38c33f135aae0_NeikiAnalytics.exe dpppj.exe PID 2196 wrote to memory of 744 2196 d36e8ab87b3fa7fb41c38c33f135aae0_NeikiAnalytics.exe dpppj.exe PID 2196 wrote to memory of 744 2196 d36e8ab87b3fa7fb41c38c33f135aae0_NeikiAnalytics.exe dpppj.exe PID 744 wrote to memory of 2664 744 dpppj.exe lxfxrrl.exe PID 744 wrote to memory of 2664 744 dpppj.exe lxfxrrl.exe PID 744 wrote to memory of 2664 744 dpppj.exe lxfxrrl.exe PID 2664 wrote to memory of 1012 2664 lxfxrrl.exe ppvpv.exe PID 2664 wrote to memory of 1012 2664 lxfxrrl.exe ppvpv.exe PID 2664 wrote to memory of 1012 2664 lxfxrrl.exe ppvpv.exe PID 1012 wrote to memory of 2644 1012 ppvpv.exe vjppv.exe PID 1012 wrote to memory of 2644 1012 ppvpv.exe vjppv.exe PID 1012 wrote to memory of 2644 1012 ppvpv.exe vjppv.exe PID 2644 wrote to memory of 4500 2644 vjppv.exe rflfffx.exe PID 2644 wrote to memory of 4500 2644 vjppv.exe rflfffx.exe PID 2644 wrote to memory of 4500 2644 vjppv.exe rflfffx.exe PID 4500 wrote to memory of 2604 4500 rflfffx.exe tnnhnh.exe PID 4500 wrote to memory of 2604 4500 rflfffx.exe tnnhnh.exe PID 4500 wrote to memory of 2604 4500 rflfffx.exe tnnhnh.exe PID 2604 wrote to memory of 4920 2604 tnnhnh.exe fxxrrxx.exe PID 2604 wrote to memory of 4920 2604 tnnhnh.exe fxxrrxx.exe PID 2604 wrote to memory of 4920 2604 tnnhnh.exe fxxrrxx.exe PID 4920 wrote to memory of 1408 4920 fxxrrxx.exe tthbbt.exe PID 4920 wrote to memory of 1408 4920 fxxrrxx.exe tthbbt.exe PID 4920 wrote to memory of 1408 4920 fxxrrxx.exe tthbbt.exe PID 1408 wrote to memory of 2236 1408 tthbbt.exe nhhhbt.exe PID 1408 wrote to memory of 2236 1408 tthbbt.exe nhhhbt.exe PID 1408 wrote to memory of 2236 1408 tthbbt.exe nhhhbt.exe PID 2236 wrote to memory of 4608 2236 nhhhbt.exe 7rlfxfx.exe PID 2236 wrote to memory of 4608 2236 nhhhbt.exe 7rlfxfx.exe PID 2236 wrote to memory of 4608 2236 nhhhbt.exe 7rlfxfx.exe PID 4608 wrote to memory of 4640 4608 jvddd.exe rllllxl.exe PID 4608 wrote to memory of 4640 4608 jvddd.exe rllllxl.exe PID 4608 wrote to memory of 4640 4608 jvddd.exe rllllxl.exe PID 4640 wrote to memory of 2344 4640 rllllxl.exe hbhhbt.exe PID 4640 wrote to memory of 2344 4640 rllllxl.exe hbhhbt.exe PID 4640 wrote to memory of 2344 4640 rllllxl.exe hbhhbt.exe PID 2344 wrote to memory of 2220 2344 hbhhbt.exe vjjdv.exe PID 2344 wrote to memory of 2220 2344 hbhhbt.exe vjjdv.exe PID 2344 wrote to memory of 2220 2344 hbhhbt.exe vjjdv.exe PID 2220 wrote to memory of 2180 2220 bnnbhb.exe hnnhhh.exe PID 2220 wrote to memory of 2180 2220 bnnbhb.exe hnnhhh.exe PID 2220 wrote to memory of 2180 2220 bnnbhb.exe hnnhhh.exe PID 2180 wrote to memory of 1132 2180 hnnhhh.exe vvppd.exe PID 2180 wrote to memory of 1132 2180 hnnhhh.exe vvppd.exe PID 2180 wrote to memory of 1132 2180 hnnhhh.exe vvppd.exe PID 1132 wrote to memory of 4116 1132 vvppd.exe 5nttnt.exe PID 1132 wrote to memory of 4116 1132 vvppd.exe 5nttnt.exe PID 1132 wrote to memory of 4116 1132 vvppd.exe 5nttnt.exe PID 4116 wrote to memory of 5056 4116 5nttnt.exe vpvvv.exe PID 4116 wrote to memory of 5056 4116 5nttnt.exe vpvvv.exe PID 4116 wrote to memory of 5056 4116 5nttnt.exe vpvvv.exe PID 5056 wrote to memory of 4276 5056 vpvvv.exe 1xlffll.exe PID 5056 wrote to memory of 4276 5056 vpvvv.exe 1xlffll.exe PID 5056 wrote to memory of 4276 5056 vpvvv.exe 1xlffll.exe PID 4276 wrote to memory of 4288 4276 1xlffll.exe hhnntn.exe PID 4276 wrote to memory of 4288 4276 1xlffll.exe hhnntn.exe PID 4276 wrote to memory of 4288 4276 1xlffll.exe hhnntn.exe PID 4288 wrote to memory of 5028 4288 hhnntn.exe 3pvvp.exe PID 4288 wrote to memory of 5028 4288 hhnntn.exe 3pvvp.exe PID 4288 wrote to memory of 5028 4288 hhnntn.exe 3pvvp.exe PID 5028 wrote to memory of 3512 5028 3pvvp.exe 7ttnhh.exe PID 5028 wrote to memory of 3512 5028 3pvvp.exe 7ttnhh.exe PID 5028 wrote to memory of 3512 5028 3pvvp.exe 7ttnhh.exe PID 3512 wrote to memory of 4472 3512 7ttnhh.exe pjppj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d36e8ab87b3fa7fb41c38c33f135aae0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d36e8ab87b3fa7fb41c38c33f135aae0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\dpppj.exec:\dpppj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\ppvpv.exec:\ppvpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\vjppv.exec:\vjppv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\rflfffx.exec:\rflfffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\tnnhnh.exec:\tnnhnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\fxxrrxx.exec:\fxxrrxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\tthbbt.exec:\tthbbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\nhhhbt.exec:\nhhhbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\jvddd.exec:\jvddd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\rllllxl.exec:\rllllxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\hbhhbt.exec:\hbhhbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\bnnbhb.exec:\bnnbhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\hnnhhh.exec:\hnnhhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\vvppd.exec:\vvppd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\5nttnt.exec:\5nttnt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\vpvvv.exec:\vpvvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\1xlffll.exec:\1xlffll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\hhnntn.exec:\hhnntn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
\??\c:\3pvvp.exec:\3pvvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\7ttnhh.exec:\7ttnhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\pjppj.exec:\pjppj.exe23⤵
- Executes dropped EXE
PID:4472 -
\??\c:\ddvvv.exec:\ddvvv.exe24⤵
- Executes dropped EXE
PID:2596 -
\??\c:\llrrrxl.exec:\llrrrxl.exe25⤵
- Executes dropped EXE
PID:1688 -
\??\c:\jdjdd.exec:\jdjdd.exe26⤵
- Executes dropped EXE
PID:1628 -
\??\c:\dvvdp.exec:\dvvdp.exe27⤵
- Executes dropped EXE
PID:632 -
\??\c:\5bhthb.exec:\5bhthb.exe28⤵
- Executes dropped EXE
PID:3628 -
\??\c:\jjjdj.exec:\jjjdj.exe29⤵
- Executes dropped EXE
PID:4684 -
\??\c:\rlfrfxr.exec:\rlfrfxr.exe30⤵
- Executes dropped EXE
PID:4120 -
\??\c:\ffllffx.exec:\ffllffx.exe31⤵
- Executes dropped EXE
PID:2560 -
\??\c:\3nhbbh.exec:\3nhbbh.exe32⤵
- Executes dropped EXE
PID:2516 -
\??\c:\lxfxrrr.exec:\lxfxrrr.exe33⤵
- Executes dropped EXE
PID:2808 -
\??\c:\3bbbbb.exec:\3bbbbb.exe34⤵
- Executes dropped EXE
PID:2420 -
\??\c:\vppvv.exec:\vppvv.exe35⤵
- Executes dropped EXE
PID:3504 -
\??\c:\7rlfxfx.exec:\7rlfxfx.exe36⤵
- Executes dropped EXE
PID:4608 -
\??\c:\lfffrrl.exec:\lfffrrl.exe37⤵
- Executes dropped EXE
PID:2588 -
\??\c:\bthhhb.exec:\bthhhb.exe38⤵
- Executes dropped EXE
PID:4104 -
\??\c:\vjjdv.exec:\vjjdv.exe39⤵
- Executes dropped EXE
PID:2220 -
\??\c:\rffrxxx.exec:\rffrxxx.exe40⤵
- Executes dropped EXE
PID:844 -
\??\c:\btbnhh.exec:\btbnhh.exe41⤵
- Executes dropped EXE
PID:4864 -
\??\c:\jpddd.exec:\jpddd.exe42⤵
- Executes dropped EXE
PID:2980 -
\??\c:\3djjj.exec:\3djjj.exe43⤵
- Executes dropped EXE
PID:1732 -
\??\c:\lxfrlfr.exec:\lxfrlfr.exe44⤵
- Executes dropped EXE
PID:2896 -
\??\c:\xrxrxxf.exec:\xrxrxxf.exe45⤵
- Executes dropped EXE
PID:2684 -
\??\c:\tbhbbh.exec:\tbhbbh.exe46⤵
- Executes dropped EXE
PID:2388 -
\??\c:\1pvpp.exec:\1pvpp.exe47⤵
- Executes dropped EXE
PID:396 -
\??\c:\jdddd.exec:\jdddd.exe48⤵
- Executes dropped EXE
PID:1100 -
\??\c:\7lfxxxr.exec:\7lfxxxr.exe49⤵
- Executes dropped EXE
PID:5028 -
\??\c:\xxfffll.exec:\xxfffll.exe50⤵
- Executes dropped EXE
PID:4108 -
\??\c:\bbhbtn.exec:\bbhbtn.exe51⤵
- Executes dropped EXE
PID:3500 -
\??\c:\vpvpp.exec:\vpvpp.exe52⤵
- Executes dropped EXE
PID:672 -
\??\c:\rxxxrrl.exec:\rxxxrrl.exe53⤵
- Executes dropped EXE
PID:4676 -
\??\c:\nnbthb.exec:\nnbthb.exe54⤵
- Executes dropped EXE
PID:4624 -
\??\c:\pjddv.exec:\pjddv.exe55⤵
- Executes dropped EXE
PID:1472 -
\??\c:\pvjjv.exec:\pvjjv.exe56⤵
- Executes dropped EXE
PID:1384 -
\??\c:\rrllfff.exec:\rrllfff.exe57⤵
- Executes dropped EXE
PID:4636 -
\??\c:\htnnhh.exec:\htnnhh.exe58⤵
- Executes dropped EXE
PID:4988 -
\??\c:\pddjv.exec:\pddjv.exe59⤵
- Executes dropped EXE
PID:3268 -
\??\c:\1dpdj.exec:\1dpdj.exe60⤵
- Executes dropped EXE
PID:3300 -
\??\c:\xrrlfff.exec:\xrrlfff.exe61⤵
- Executes dropped EXE
PID:5044 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe62⤵
- Executes dropped EXE
PID:2560 -
\??\c:\5vddv.exec:\5vddv.exe63⤵
- Executes dropped EXE
PID:1408 -
\??\c:\7jjdv.exec:\7jjdv.exe64⤵
- Executes dropped EXE
PID:4520 -
\??\c:\fxlffff.exec:\fxlffff.exe65⤵
- Executes dropped EXE
PID:1064 -
\??\c:\tbnnhh.exec:\tbnnhh.exe66⤵PID:1956
-
\??\c:\3bbbtt.exec:\3bbbtt.exe67⤵PID:4456
-
\??\c:\jjjdv.exec:\jjjdv.exe68⤵PID:2272
-
\??\c:\9rlrrrx.exec:\9rlrrrx.exe69⤵PID:3944
-
\??\c:\rfllllf.exec:\rfllllf.exe70⤵PID:2868
-
\??\c:\btthtb.exec:\btthtb.exe71⤵PID:2220
-
\??\c:\vppjd.exec:\vppjd.exe72⤵PID:844
-
\??\c:\dvdvv.exec:\dvdvv.exe73⤵PID:2008
-
\??\c:\xllffff.exec:\xllffff.exe74⤵PID:2980
-
\??\c:\hbbnhh.exec:\hbbnhh.exe75⤵PID:4276
-
\??\c:\bnnhbt.exec:\bnnhbt.exe76⤵PID:2896
-
\??\c:\jddvp.exec:\jddvp.exe77⤵PID:2684
-
\??\c:\vpddv.exec:\vpddv.exe78⤵PID:5112
-
\??\c:\lfllrxr.exec:\lfllrxr.exe79⤵PID:3216
-
\??\c:\vppjd.exec:\vppjd.exe80⤵PID:1204
-
\??\c:\7jjdv.exec:\7jjdv.exe81⤵PID:3120
-
\??\c:\lflfxxx.exec:\lflfxxx.exe82⤵PID:4880
-
\??\c:\tbbtnh.exec:\tbbtnh.exe83⤵PID:4460
-
\??\c:\thtnnb.exec:\thtnnb.exe84⤵PID:4356
-
\??\c:\dvjvd.exec:\dvjvd.exe85⤵PID:1628
-
\??\c:\jjjjd.exec:\jjjjd.exe86⤵PID:3112
-
\??\c:\9xllfff.exec:\9xllfff.exe87⤵PID:1040
-
\??\c:\xrrxrxx.exec:\xrrxrxx.exe88⤵PID:2476
-
\??\c:\ttnnhh.exec:\ttnnhh.exe89⤵PID:4120
-
\??\c:\5vdvd.exec:\5vdvd.exe90⤵PID:5044
-
\??\c:\9jjdv.exec:\9jjdv.exe91⤵PID:2516
-
\??\c:\llrllfx.exec:\llrllfx.exe92⤵PID:1408
-
\??\c:\rflfxxr.exec:\rflfxxr.exe93⤵PID:4660
-
\??\c:\bthbbt.exec:\bthbbt.exe94⤵PID:1648
-
\??\c:\htbtnn.exec:\htbtnn.exe95⤵PID:1588
-
\??\c:\1vdvj.exec:\1vdvj.exe96⤵PID:2888
-
\??\c:\rxxrrlf.exec:\rxxrrlf.exe97⤵PID:4104
-
\??\c:\rrxxxxr.exec:\rrxxxxr.exe98⤵PID:5008
-
\??\c:\bbtnhh.exec:\bbtnhh.exe99⤵PID:2868
-
\??\c:\7hbtnn.exec:\7hbtnn.exe100⤵PID:1360
-
\??\c:\dddvp.exec:\dddvp.exe101⤵PID:4468
-
\??\c:\ddpvp.exec:\ddpvp.exe102⤵PID:1732
-
\??\c:\fxllrxr.exec:\fxllrxr.exe103⤵PID:3012
-
\??\c:\xlllfff.exec:\xlllfff.exe104⤵PID:3024
-
\??\c:\hthhhn.exec:\hthhhn.exe105⤵PID:2740
-
\??\c:\bhntnt.exec:\bhntnt.exe106⤵PID:1268
-
\??\c:\vdjdp.exec:\vdjdp.exe107⤵PID:4700
-
\??\c:\djdjd.exec:\djdjd.exe108⤵PID:3440
-
\??\c:\1xxxxxr.exec:\1xxxxxr.exe109⤵PID:1388
-
\??\c:\nhhbth.exec:\nhhbth.exe110⤵PID:4324
-
\??\c:\hhhtht.exec:\hhhtht.exe111⤵PID:744
-
\??\c:\7dddd.exec:\7dddd.exe112⤵PID:3908
-
\??\c:\pjvvd.exec:\pjvvd.exe113⤵PID:3904
-
\??\c:\xxxrlfx.exec:\xxxrlfx.exe114⤵PID:4164
-
\??\c:\3fllrrf.exec:\3fllrrf.exe115⤵PID:2644
-
\??\c:\hhhhhh.exec:\hhhhhh.exe116⤵PID:5116
-
\??\c:\bnhnhb.exec:\bnhnhb.exe117⤵PID:3888
-
\??\c:\ppppj.exec:\ppppj.exe118⤵PID:2756
-
\??\c:\rflfxxr.exec:\rflfxxr.exe119⤵PID:2800
-
\??\c:\ffffffx.exec:\ffffffx.exe120⤵PID:3504
-
\??\c:\9btttb.exec:\9btttb.exe121⤵PID:1584
-
\??\c:\thhbtt.exec:\thhbtt.exe122⤵PID:2464
-
\??\c:\jdpjp.exec:\jdpjp.exe123⤵PID:2888
-
\??\c:\rxlfrrl.exec:\rxlfrrl.exe124⤵PID:4452
-
\??\c:\lxfxrrr.exec:\lxfxrrr.exe125⤵PID:1644
-
\??\c:\ttbbtt.exec:\ttbbtt.exe126⤵PID:2036
-
\??\c:\jdjdv.exec:\jdjdv.exe127⤵PID:4744
-
\??\c:\jvjdd.exec:\jvjdd.exe128⤵PID:2896
-
\??\c:\lxxrrrl.exec:\lxxrrrl.exe129⤵PID:2684
-
\??\c:\rxxxfff.exec:\rxxxfff.exe130⤵PID:1368
-
\??\c:\thtnhb.exec:\thtnhb.exe131⤵PID:3120
-
\??\c:\pjppj.exec:\pjppj.exe132⤵PID:2452
-
\??\c:\jjppj.exec:\jjppj.exe133⤵PID:2196
-
\??\c:\flxrllf.exec:\flxrllf.exe134⤵PID:1472
-
\??\c:\tntntn.exec:\tntntn.exe135⤵PID:3112
-
\??\c:\nhnnbb.exec:\nhnnbb.exe136⤵PID:880
-
\??\c:\dddvv.exec:\dddvv.exe137⤵PID:2124
-
\??\c:\rfxlrlf.exec:\rfxlrlf.exe138⤵PID:3452
-
\??\c:\tbhtnn.exec:\tbhtnn.exe139⤵PID:1772
-
\??\c:\1tbhbh.exec:\1tbhbh.exe140⤵PID:1572
-
\??\c:\jvdvj.exec:\jvdvj.exe141⤵PID:3604
-
\??\c:\xlxxfxf.exec:\xlxxfxf.exe142⤵PID:2800
-
\??\c:\rlfxlff.exec:\rlfxlff.exe143⤵PID:3504
-
\??\c:\7thbnn.exec:\7thbnn.exe144⤵PID:460
-
\??\c:\djvvp.exec:\djvvp.exe145⤵PID:5000
-
\??\c:\5xlxlrl.exec:\5xlxlrl.exe146⤵PID:5008
-
\??\c:\hthhhn.exec:\hthhhn.exe147⤵PID:3964
-
\??\c:\3ppdp.exec:\3ppdp.exe148⤵PID:3372
-
\??\c:\rlxrflf.exec:\rlxrflf.exe149⤵PID:1012
-
\??\c:\pvjdd.exec:\pvjdd.exe150⤵PID:4384
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe151⤵PID:4308
-
\??\c:\ttbntt.exec:\ttbntt.exe152⤵PID:2856
-
\??\c:\vddvv.exec:\vddvv.exe153⤵PID:672
-
\??\c:\llfrllf.exec:\llfrllf.exe154⤵PID:4340
-
\??\c:\bthhnh.exec:\bthhnh.exe155⤵PID:1628
-
\??\c:\jdddd.exec:\jdddd.exe156⤵PID:4560
-
\??\c:\lllfffx.exec:\lllfffx.exe157⤵PID:1116
-
\??\c:\lxxfffr.exec:\lxxfffr.exe158⤵PID:1164
-
\??\c:\nnbtnn.exec:\nnbtnn.exe159⤵PID:4120
-
\??\c:\jjddv.exec:\jjddv.exe160⤵PID:3696
-
\??\c:\vjppj.exec:\vjppj.exe161⤵PID:4592
-
\??\c:\lllfrrl.exec:\lllfrrl.exe162⤵PID:2420
-
\??\c:\rlxrxff.exec:\rlxrxff.exe163⤵PID:1856
-
\??\c:\bbttnn.exec:\bbttnn.exe164⤵PID:2588
-
\??\c:\jvvpj.exec:\jvvpj.exe165⤵PID:4300
-
\??\c:\vdjdp.exec:\vdjdp.exe166⤵PID:4172
-
\??\c:\fxlxrff.exec:\fxlxrff.exe167⤵PID:1612
-
\??\c:\vvvvp.exec:\vvvvp.exe168⤵PID:2980
-
\??\c:\pdjdd.exec:\pdjdd.exe169⤵PID:2036
-
\??\c:\fxrlxxx.exec:\fxrlxxx.exe170⤵PID:4824
-
\??\c:\3lrllll.exec:\3lrllll.exe171⤵PID:372
-
\??\c:\hbbtnn.exec:\hbbtnn.exe172⤵PID:5028
-
\??\c:\tntnhn.exec:\tntnhn.exe173⤵PID:3120
-
\??\c:\9dpjp.exec:\9dpjp.exe174⤵PID:1388
-
\??\c:\7dppj.exec:\7dppj.exe175⤵PID:4348
-
\??\c:\lfrrrlf.exec:\lfrrrlf.exe176⤵PID:2280
-
\??\c:\1rfffrl.exec:\1rfffrl.exe177⤵PID:3268
-
\??\c:\htthbn.exec:\htthbn.exe178⤵PID:880
-
\??\c:\pjvpj.exec:\pjvpj.exe179⤵PID:2124
-
\??\c:\ffxxrll.exec:\ffxxrll.exe180⤵PID:4124
-
\??\c:\rfrrlff.exec:\rfrrlff.exe181⤵PID:2756
-
\??\c:\hbbnhh.exec:\hbbnhh.exe182⤵PID:4520
-
\??\c:\bbhbtb.exec:\bbhbtb.exe183⤵PID:4660
-
\??\c:\pdjdv.exec:\pdjdv.exe184⤵PID:1956
-
\??\c:\pvjpj.exec:\pvjpj.exe185⤵PID:4456
-
\??\c:\frlxxxr.exec:\frlxxxr.exe186⤵PID:2868
-
\??\c:\frrlfxr.exec:\frrlfxr.exe187⤵PID:768
-
\??\c:\hbnhnn.exec:\hbnhnn.exe188⤵PID:2804
-
\??\c:\vpdvj.exec:\vpdvj.exe189⤵PID:4744
-
\??\c:\dpvpd.exec:\dpvpd.exe190⤵PID:1080
-
\??\c:\flrrllf.exec:\flrrllf.exe191⤵PID:1204
-
\??\c:\rlrrlrr.exec:\rlrrlrr.exe192⤵PID:4700
-
\??\c:\thnnnn.exec:\thnnnn.exe193⤵PID:4308
-
\??\c:\httnhb.exec:\httnhb.exe194⤵PID:672
-
\??\c:\pvjjd.exec:\pvjjd.exe195⤵PID:1384
-
\??\c:\rlrrlll.exec:\rlrrlll.exe196⤵PID:1040
-
\??\c:\xfllrxr.exec:\xfllrxr.exe197⤵PID:3596
-
\??\c:\nhnhhh.exec:\nhnhhh.exe198⤵PID:3588
-
\??\c:\hthbtt.exec:\hthbtt.exe199⤵PID:3396
-
\??\c:\djpjv.exec:\djpjv.exe200⤵PID:380
-
\??\c:\3xxrllf.exec:\3xxrllf.exe201⤵PID:1800
-
\??\c:\xlrrllf.exec:\xlrrllf.exe202⤵PID:2656
-
\??\c:\5nhhbh.exec:\5nhhbh.exe203⤵PID:2344
-
\??\c:\5bhhbb.exec:\5bhhbb.exe204⤵PID:1584
-
\??\c:\dddvp.exec:\dddvp.exe205⤵PID:4660
-
\??\c:\dpdvp.exec:\dpdvp.exe206⤵PID:3260
-
\??\c:\lxxffll.exec:\lxxffll.exe207⤵PID:4456
-
\??\c:\3bbbbb.exec:\3bbbbb.exe208⤵PID:2868
-
\??\c:\bbbbtt.exec:\bbbbtt.exe209⤵PID:768
-
\??\c:\vpjjj.exec:\vpjjj.exe210⤵PID:2388
-
\??\c:\dvppv.exec:\dvppv.exe211⤵PID:4744
-
\??\c:\xrfxlff.exec:\xrfxlff.exe212⤵PID:3440
-
\??\c:\nthhhn.exec:\nthhhn.exe213⤵PID:1612
-
\??\c:\bbnhbt.exec:\bbnhbt.exe214⤵PID:2448
-
\??\c:\ddjjd.exec:\ddjjd.exe215⤵PID:1688
-
\??\c:\jpvdj.exec:\jpvdj.exe216⤵PID:4308
-
\??\c:\rllffff.exec:\rllffff.exe217⤵PID:2836
-
\??\c:\fxxrrll.exec:\fxxrrll.exe218⤵PID:4684
-
\??\c:\httnhb.exec:\httnhb.exe219⤵PID:5116
-
\??\c:\bbbbtb.exec:\bbbbtb.exe220⤵PID:2516
-
\??\c:\pjddv.exec:\pjddv.exe221⤵PID:3956
-
\??\c:\5vvpv.exec:\5vvpv.exe222⤵PID:1772
-
\??\c:\frffxxx.exec:\frffxxx.exe223⤵PID:380
-
\??\c:\3flfxxx.exec:\3flfxxx.exe224⤵PID:4580
-
\??\c:\5btbnn.exec:\5btbnn.exe225⤵PID:4520
-
\??\c:\pdppj.exec:\pdppj.exe226⤵PID:1856
-
\??\c:\pdppp.exec:\pdppp.exe227⤵PID:3420
-
\??\c:\rrffxxl.exec:\rrffxxl.exe228⤵PID:5008
-
\??\c:\lrrrxfl.exec:\lrrrxfl.exe229⤵PID:4644
-
\??\c:\nbhnnt.exec:\nbhnnt.exe230⤵PID:4168
-
\??\c:\thnhnh.exec:\thnhnh.exe231⤵PID:1012
-
\??\c:\dpvvj.exec:\dpvvj.exe232⤵PID:4384
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe233⤵PID:4116
-
\??\c:\xxfxffl.exec:\xxfxffl.exe234⤵PID:1204
-
\??\c:\hhhhhn.exec:\hhhhhn.exe235⤵PID:4700
-
\??\c:\ddvpp.exec:\ddvpp.exe236⤵PID:2188
-
\??\c:\llllllf.exec:\llllllf.exe237⤵PID:744
-
\??\c:\tnnbhb.exec:\tnnbhb.exe238⤵PID:4536
-
\??\c:\jjppv.exec:\jjppv.exe239⤵PID:3400
-
\??\c:\fxrrfff.exec:\fxrrfff.exe240⤵PID:3664
-
\??\c:\lrxxrrr.exec:\lrxxrrr.exe241⤵PID:2308
-
\??\c:\3hbbbh.exec:\3hbbbh.exe242⤵PID:4552