Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 22:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
162dd95e1a00653dcebaf8613d39c6e0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
162dd95e1a00653dcebaf8613d39c6e0_NeikiAnalytics.exe
-
Size
87KB
-
MD5
162dd95e1a00653dcebaf8613d39c6e0
-
SHA1
301b523e943c9c42f41a3d2658ccfef35cf13307
-
SHA256
5775e276c321c39710cc5fc9b16678b99fb62aa7f382b3c3c3d23dedc5869447
-
SHA512
f5c97c667ea65d68c6c42157f294fea5a9880131a59a651ff4a19900db3492bcd8ebdb50fcb1e9570782f0d7e2675fb0b61f6310455207faf16dcdf5edd14239
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2wV3jaCJ5jH3en:ymb3NkkiQ3mdBjF+3TU2K3bJZX6
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/3004-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1668-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1528-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1660-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/668-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1704-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1492-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/692-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2136-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1656-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1064-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2044-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1840-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1512-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
9djpv.exelxlffrx.exexrrlflx.exehbhhnn.exebtntnb.exenbtbbb.exeppjpj.exepjjvp.exe9xrxlrx.exebtbnht.exe3hbbhn.exevvppd.exepdvvj.exeflfxlxl.exefffxlfx.exe9htbnh.exenbnnbb.exevjjjv.exe9jdjj.exe7rrrxxf.exe9xlrlrf.exe7lflfxf.exennbhtt.exehhbnnt.exevjjvj.exerxffffr.exellxlrfl.exe5xlrxxx.exehbhthn.exetnbnth.exejjpvd.exedvdvd.exe7frrrxf.exexrlrxlx.exe5nbtbb.exethhtbh.exevpdjp.exedpjjj.exepdpvv.exelflxfll.exerlxfflr.exefflflll.exenbhbhn.exerlrlxlx.exexrlfxxf.exellflxlx.exentthbn.exentntnb.exe3dvdv.exepppdv.exe9rrxflx.exelfllllr.exehhhnbh.exehbhtbb.exe1vjvj.exedjjpj.exe5xflfrl.exe1xxfxlx.exelxffrlx.exenbhhtt.exevddvp.exepjvpd.exerxxrrfx.exexxfxxfx.exepid process 1512 9djpv.exe 2196 lxlffrx.exe 2688 xrrlflx.exe 3004 hbhhnn.exe 2732 btntnb.exe 2484 nbtbbb.exe 2476 ppjpj.exe 2912 pjjvp.exe 1840 9xrxlrx.exe 2756 btbnht.exe 2548 3hbbhn.exe 1668 vvppd.exe 2044 pdvvj.exe 1064 flfxlxl.exe 1716 fffxlfx.exe 828 9htbnh.exe 1656 nbnnbb.exe 2264 vjjjv.exe 2300 9jdjj.exe 2284 7rrrxxf.exe 2136 9xlrlrf.exe 692 7lflfxf.exe 1492 nnbhtt.exe 1704 hhbnnt.exe 1568 vjjvj.exe 668 rxffffr.exe 1660 llxlrfl.exe 1252 5xlrxxx.exe 1528 hbhthn.exe 1928 tnbnth.exe 2944 jjpvd.exe 1408 dvdvd.exe 1200 7frrrxf.exe 1592 xrlrxlx.exe 2552 5nbtbb.exe 2696 thhtbh.exe 2708 vpdjp.exe 2368 dpjjj.exe 2492 pdpvv.exe 2904 lflxfll.exe 2192 rlxfflr.exe 1720 fflflll.exe 2744 nbhbhn.exe 2280 rlrlxlx.exe 2616 xrlfxxf.exe 2004 llflxlx.exe 1828 ntthbn.exe 2000 ntntnb.exe 2572 3dvdv.exe 2528 pppdv.exe 2224 9rrxflx.exe 1692 lfllllr.exe 1600 hhhnbh.exe 2080 hbhtbb.exe 2180 1vjvj.exe 876 djjpj.exe 604 5xflfrl.exe 1496 1xxfxlx.exe 1868 lxffrlx.exe 1796 nbhhtt.exe 1004 vddvp.exe 3000 pjvpd.exe 1992 rxxrrfx.exe 984 xxfxxfx.exe -
Processes:
resource yara_rule behavioral1/memory/3004-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1668-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1528-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/668-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1704-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1492-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/692-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2136-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1656-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1064-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1840-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1512-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-8-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
162dd95e1a00653dcebaf8613d39c6e0_NeikiAnalytics.exe9djpv.exelxlffrx.exexrrlflx.exehbhhnn.exebtntnb.exenbtbbb.exeppjpj.exepjjvp.exe9xrxlrx.exebtbnht.exe3hbbhn.exevvppd.exepdvvj.exeflfxlxl.exefffxlfx.exedescription pid process target process PID 2120 wrote to memory of 1512 2120 162dd95e1a00653dcebaf8613d39c6e0_NeikiAnalytics.exe 9djpv.exe PID 2120 wrote to memory of 1512 2120 162dd95e1a00653dcebaf8613d39c6e0_NeikiAnalytics.exe 9djpv.exe PID 2120 wrote to memory of 1512 2120 162dd95e1a00653dcebaf8613d39c6e0_NeikiAnalytics.exe 9djpv.exe PID 2120 wrote to memory of 1512 2120 162dd95e1a00653dcebaf8613d39c6e0_NeikiAnalytics.exe 9djpv.exe PID 1512 wrote to memory of 2196 1512 9djpv.exe lxlffrx.exe PID 1512 wrote to memory of 2196 1512 9djpv.exe lxlffrx.exe PID 1512 wrote to memory of 2196 1512 9djpv.exe lxlffrx.exe PID 1512 wrote to memory of 2196 1512 9djpv.exe lxlffrx.exe PID 2196 wrote to memory of 2688 2196 lxlffrx.exe xrrlflx.exe PID 2196 wrote to memory of 2688 2196 lxlffrx.exe xrrlflx.exe PID 2196 wrote to memory of 2688 2196 lxlffrx.exe xrrlflx.exe PID 2196 wrote to memory of 2688 2196 lxlffrx.exe xrrlflx.exe PID 2688 wrote to memory of 3004 2688 xrrlflx.exe hbhhnn.exe PID 2688 wrote to memory of 3004 2688 xrrlflx.exe hbhhnn.exe PID 2688 wrote to memory of 3004 2688 xrrlflx.exe hbhhnn.exe PID 2688 wrote to memory of 3004 2688 xrrlflx.exe hbhhnn.exe PID 3004 wrote to memory of 2732 3004 hbhhnn.exe btntnb.exe PID 3004 wrote to memory of 2732 3004 hbhhnn.exe btntnb.exe PID 3004 wrote to memory of 2732 3004 hbhhnn.exe btntnb.exe PID 3004 wrote to memory of 2732 3004 hbhhnn.exe btntnb.exe PID 2732 wrote to memory of 2484 2732 btntnb.exe nbtbbb.exe PID 2732 wrote to memory of 2484 2732 btntnb.exe nbtbbb.exe PID 2732 wrote to memory of 2484 2732 btntnb.exe nbtbbb.exe PID 2732 wrote to memory of 2484 2732 btntnb.exe nbtbbb.exe PID 2484 wrote to memory of 2476 2484 nbtbbb.exe ppjpj.exe PID 2484 wrote to memory of 2476 2484 nbtbbb.exe ppjpj.exe PID 2484 wrote to memory of 2476 2484 nbtbbb.exe ppjpj.exe PID 2484 wrote to memory of 2476 2484 nbtbbb.exe ppjpj.exe PID 2476 wrote to memory of 2912 2476 ppjpj.exe pjjvp.exe PID 2476 wrote to memory of 2912 2476 ppjpj.exe pjjvp.exe PID 2476 wrote to memory of 2912 2476 ppjpj.exe pjjvp.exe PID 2476 wrote to memory of 2912 2476 ppjpj.exe pjjvp.exe PID 2912 wrote to memory of 1840 2912 pjjvp.exe 9xrxlrx.exe PID 2912 wrote to memory of 1840 2912 pjjvp.exe 9xrxlrx.exe PID 2912 wrote to memory of 1840 2912 pjjvp.exe 9xrxlrx.exe PID 2912 wrote to memory of 1840 2912 pjjvp.exe 9xrxlrx.exe PID 1840 wrote to memory of 2756 1840 9xrxlrx.exe btbnht.exe PID 1840 wrote to memory of 2756 1840 9xrxlrx.exe btbnht.exe PID 1840 wrote to memory of 2756 1840 9xrxlrx.exe btbnht.exe PID 1840 wrote to memory of 2756 1840 9xrxlrx.exe btbnht.exe PID 2756 wrote to memory of 2548 2756 btbnht.exe 3hbbhn.exe PID 2756 wrote to memory of 2548 2756 btbnht.exe 3hbbhn.exe PID 2756 wrote to memory of 2548 2756 btbnht.exe 3hbbhn.exe PID 2756 wrote to memory of 2548 2756 btbnht.exe 3hbbhn.exe PID 2548 wrote to memory of 1668 2548 3hbbhn.exe vvppd.exe PID 2548 wrote to memory of 1668 2548 3hbbhn.exe vvppd.exe PID 2548 wrote to memory of 1668 2548 3hbbhn.exe vvppd.exe PID 2548 wrote to memory of 1668 2548 3hbbhn.exe vvppd.exe PID 1668 wrote to memory of 2044 1668 vvppd.exe pdvvj.exe PID 1668 wrote to memory of 2044 1668 vvppd.exe pdvvj.exe PID 1668 wrote to memory of 2044 1668 vvppd.exe pdvvj.exe PID 1668 wrote to memory of 2044 1668 vvppd.exe pdvvj.exe PID 2044 wrote to memory of 1064 2044 pdvvj.exe flfxlxl.exe PID 2044 wrote to memory of 1064 2044 pdvvj.exe flfxlxl.exe PID 2044 wrote to memory of 1064 2044 pdvvj.exe flfxlxl.exe PID 2044 wrote to memory of 1064 2044 pdvvj.exe flfxlxl.exe PID 1064 wrote to memory of 1716 1064 flfxlxl.exe fffxlfx.exe PID 1064 wrote to memory of 1716 1064 flfxlxl.exe fffxlfx.exe PID 1064 wrote to memory of 1716 1064 flfxlxl.exe fffxlfx.exe PID 1064 wrote to memory of 1716 1064 flfxlxl.exe fffxlfx.exe PID 1716 wrote to memory of 828 1716 fffxlfx.exe 9htbnh.exe PID 1716 wrote to memory of 828 1716 fffxlfx.exe 9htbnh.exe PID 1716 wrote to memory of 828 1716 fffxlfx.exe 9htbnh.exe PID 1716 wrote to memory of 828 1716 fffxlfx.exe 9htbnh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\187829366\zmstage.exeC:\Users\Admin\AppData\Local\Temp\187829366\zmstage.exe1⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\162dd95e1a00653dcebaf8613d39c6e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\162dd95e1a00653dcebaf8613d39c6e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\9djpv.exec:\9djpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\lxlffrx.exec:\lxlffrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\xrrlflx.exec:\xrrlflx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\hbhhnn.exec:\hbhhnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\btntnb.exec:\btntnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\nbtbbb.exec:\nbtbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\ppjpj.exec:\ppjpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\pjjvp.exec:\pjjvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\9xrxlrx.exec:\9xrxlrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\btbnht.exec:\btbnht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\3hbbhn.exec:\3hbbhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\vvppd.exec:\vvppd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\pdvvj.exec:\pdvvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\flfxlxl.exec:\flfxlxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\fffxlfx.exec:\fffxlfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\9htbnh.exec:\9htbnh.exe17⤵
- Executes dropped EXE
PID:828 -
\??\c:\nbnnbb.exec:\nbnnbb.exe18⤵
- Executes dropped EXE
PID:1656 -
\??\c:\vjjjv.exec:\vjjjv.exe19⤵
- Executes dropped EXE
PID:2264 -
\??\c:\9jdjj.exec:\9jdjj.exe20⤵
- Executes dropped EXE
PID:2300 -
\??\c:\7rrrxxf.exec:\7rrrxxf.exe21⤵
- Executes dropped EXE
PID:2284 -
\??\c:\9xlrlrf.exec:\9xlrlrf.exe22⤵
- Executes dropped EXE
PID:2136 -
\??\c:\7lflfxf.exec:\7lflfxf.exe23⤵
- Executes dropped EXE
PID:692 -
\??\c:\nnbhtt.exec:\nnbhtt.exe24⤵
- Executes dropped EXE
PID:1492 -
\??\c:\hhbnnt.exec:\hhbnnt.exe25⤵
- Executes dropped EXE
PID:1704 -
\??\c:\vjjvj.exec:\vjjvj.exe26⤵
- Executes dropped EXE
PID:1568 -
\??\c:\rxffffr.exec:\rxffffr.exe27⤵
- Executes dropped EXE
PID:668 -
\??\c:\llxlrfl.exec:\llxlrfl.exe28⤵
- Executes dropped EXE
PID:1660 -
\??\c:\5xlrxxx.exec:\5xlrxxx.exe29⤵
- Executes dropped EXE
PID:1252 -
\??\c:\hbhthn.exec:\hbhthn.exe30⤵
- Executes dropped EXE
PID:1528 -
\??\c:\tnbnth.exec:\tnbnth.exe31⤵
- Executes dropped EXE
PID:1928 -
\??\c:\jjpvd.exec:\jjpvd.exe32⤵
- Executes dropped EXE
PID:2944 -
\??\c:\dvdvd.exec:\dvdvd.exe33⤵
- Executes dropped EXE
PID:1408 -
\??\c:\7frrrxf.exec:\7frrrxf.exe34⤵
- Executes dropped EXE
PID:1200 -
\??\c:\xrlrxlx.exec:\xrlrxlx.exe35⤵
- Executes dropped EXE
PID:1592 -
\??\c:\5nbtbb.exec:\5nbtbb.exe36⤵
- Executes dropped EXE
PID:2552 -
\??\c:\thhtbh.exec:\thhtbh.exe37⤵
- Executes dropped EXE
PID:2696 -
\??\c:\vpdjp.exec:\vpdjp.exe38⤵
- Executes dropped EXE
PID:2708 -
\??\c:\dpjjj.exec:\dpjjj.exe39⤵
- Executes dropped EXE
PID:2368 -
\??\c:\pdpvv.exec:\pdpvv.exe40⤵
- Executes dropped EXE
PID:2492 -
\??\c:\lflxfll.exec:\lflxfll.exe41⤵
- Executes dropped EXE
PID:2904 -
\??\c:\rlxfflr.exec:\rlxfflr.exe42⤵
- Executes dropped EXE
PID:2192 -
\??\c:\fflflll.exec:\fflflll.exe43⤵
- Executes dropped EXE
PID:1720 -
\??\c:\nbhbhn.exec:\nbhbhn.exe44⤵
- Executes dropped EXE
PID:2744 -
\??\c:\rlrlxlx.exec:\rlrlxlx.exe45⤵
- Executes dropped EXE
PID:2280 -
\??\c:\xrlfxxf.exec:\xrlfxxf.exe46⤵
- Executes dropped EXE
PID:2616 -
\??\c:\llflxlx.exec:\llflxlx.exe47⤵
- Executes dropped EXE
PID:2004 -
\??\c:\ntthbn.exec:\ntthbn.exe48⤵
- Executes dropped EXE
PID:1828 -
\??\c:\ntntnb.exec:\ntntnb.exe49⤵
- Executes dropped EXE
PID:2000 -
\??\c:\3dvdv.exec:\3dvdv.exe50⤵
- Executes dropped EXE
PID:2572 -
\??\c:\pppdv.exec:\pppdv.exe51⤵
- Executes dropped EXE
PID:2528 -
\??\c:\9rrxflx.exec:\9rrxflx.exe52⤵
- Executes dropped EXE
PID:2224 -
\??\c:\lfllllr.exec:\lfllllr.exe53⤵
- Executes dropped EXE
PID:1692 -
\??\c:\hhhnbh.exec:\hhhnbh.exe54⤵
- Executes dropped EXE
PID:1600 -
\??\c:\hbhtbb.exec:\hbhtbb.exe55⤵
- Executes dropped EXE
PID:2080 -
\??\c:\1vjvj.exec:\1vjvj.exe56⤵
- Executes dropped EXE
PID:2180 -
\??\c:\djjpj.exec:\djjpj.exe57⤵
- Executes dropped EXE
PID:876 -
\??\c:\5xflfrl.exec:\5xflfrl.exe58⤵
- Executes dropped EXE
PID:604 -
\??\c:\1xxfxlx.exec:\1xxfxlx.exe59⤵
- Executes dropped EXE
PID:1496 -
\??\c:\lxffrlx.exec:\lxffrlx.exe60⤵
- Executes dropped EXE
PID:1868 -
\??\c:\nbhhtt.exec:\nbhhtt.exe61⤵
- Executes dropped EXE
PID:1796 -
\??\c:\vddvp.exec:\vddvp.exe62⤵
- Executes dropped EXE
PID:1004 -
\??\c:\pjvpd.exec:\pjvpd.exe63⤵
- Executes dropped EXE
PID:3000 -
\??\c:\rxxrrfx.exec:\rxxrrfx.exe64⤵
- Executes dropped EXE
PID:1992 -
\??\c:\xxfxxfx.exec:\xxfxxfx.exe65⤵
- Executes dropped EXE
PID:984 -
\??\c:\frflrff.exec:\frflrff.exe66⤵PID:3016
-
\??\c:\ttbbth.exec:\ttbbth.exe67⤵PID:596
-
\??\c:\tbhntb.exec:\tbhntb.exe68⤵PID:1196
-
\??\c:\9vpvj.exec:\9vpvj.exe69⤵PID:560
-
\??\c:\9pjvd.exec:\9pjvd.exe70⤵PID:2820
-
\??\c:\5frxllx.exec:\5frxllx.exe71⤵PID:2944
-
\??\c:\llxxlxl.exec:\llxxlxl.exe72⤵PID:1408
-
\??\c:\thtntn.exec:\thtntn.exe73⤵PID:2292
-
\??\c:\tnhhtt.exec:\tnhhtt.exe74⤵PID:2700
-
\??\c:\tnthbh.exec:\tnthbh.exe75⤵PID:2568
-
\??\c:\jdjpd.exec:\jdjpd.exe76⤵PID:2996
-
\??\c:\pjddd.exec:\pjddd.exe77⤵PID:2496
-
\??\c:\ffrfllr.exec:\ffrfllr.exe78⤵PID:1944
-
\??\c:\llxlxfx.exec:\llxlxfx.exe79⤵PID:2512
-
\??\c:\fflxlll.exec:\fflxlll.exe80⤵PID:1448
-
\??\c:\tnbntb.exec:\tnbntb.exe81⤵PID:2704
-
\??\c:\hbnttb.exec:\hbnttb.exe82⤵PID:2232
-
\??\c:\7pjpv.exec:\7pjpv.exe83⤵PID:1956
-
\??\c:\dvvpp.exec:\dvvpp.exe84⤵PID:2776
-
\??\c:\nnbtbb.exec:\nnbtbb.exe85⤵PID:2744
-
\??\c:\ppjvj.exec:\ppjvj.exe86⤵PID:308
-
\??\c:\fxrrxrl.exec:\fxrrxrl.exe87⤵PID:2616
-
\??\c:\xrxlxfr.exec:\xrxlxfr.exe88⤵PID:1948
-
\??\c:\3xrxlrx.exec:\3xrxlrx.exe89⤵PID:320
-
\??\c:\nbtthh.exec:\nbtthh.exe90⤵PID:1108
-
\??\c:\bnthnh.exec:\bnthnh.exe91⤵PID:2888
-
\??\c:\htbhhh.exec:\htbhhh.exe92⤵PID:788
-
\??\c:\5pddp.exec:\5pddp.exe93⤵PID:1700
-
\??\c:\vjppj.exec:\vjppj.exe94⤵PID:1576
-
\??\c:\pjddp.exec:\pjddp.exe95⤵PID:2068
-
\??\c:\fxrfrxl.exec:\fxrfrxl.exe96⤵PID:2992
-
\??\c:\rlfrxlr.exec:\rlfrxlr.exe97⤵PID:2856
-
\??\c:\hbhntb.exec:\hbhntb.exe98⤵PID:608
-
\??\c:\3tbhtt.exec:\3tbhtt.exe99⤵PID:832
-
\??\c:\hbbbbb.exec:\hbbbbb.exe100⤵PID:1664
-
\??\c:\dpvdd.exec:\dpvdd.exe101⤵PID:1492
-
\??\c:\1vpjd.exec:\1vpjd.exe102⤵PID:624
-
\??\c:\jvdjp.exec:\jvdjp.exe103⤵PID:2304
-
\??\c:\flfffxf.exec:\flfffxf.exe104⤵PID:2216
-
\??\c:\btnbnh.exec:\btnbnh.exe105⤵PID:276
-
\??\c:\nhthtn.exec:\nhthtn.exe106⤵PID:2540
-
\??\c:\dpvdj.exec:\dpvdj.exe107⤵PID:2544
-
\??\c:\pjvvd.exec:\pjvvd.exe108⤵PID:1540
-
\??\c:\pvpdp.exec:\pvpdp.exe109⤵PID:2176
-
\??\c:\xxxlflr.exec:\xxxlflr.exe110⤵PID:2444
-
\??\c:\lffllll.exec:\lffllll.exe111⤵PID:2212
-
\??\c:\tttttt.exec:\tttttt.exe112⤵PID:904
-
\??\c:\tnnnbn.exec:\tnnnbn.exe113⤵PID:848
-
\??\c:\thtttt.exec:\thtttt.exe114⤵PID:1616
-
\??\c:\vjvdp.exec:\vjvdp.exe115⤵PID:2660
-
\??\c:\9jjdp.exec:\9jjdp.exe116⤵PID:2468
-
\??\c:\1lffrll.exec:\1lffrll.exe117⤵PID:2688
-
\??\c:\lffrlrl.exec:\lffrlrl.exe118⤵PID:2800
-
\??\c:\ttbnht.exec:\ttbnht.exe119⤵PID:2596
-
\??\c:\bhbttn.exec:\bhbttn.exe120⤵PID:2984
-
\??\c:\nhhthh.exec:\nhhthh.exe121⤵PID:1532
-
\??\c:\ppvdp.exec:\ppvdp.exe122⤵PID:2956
-
\??\c:\pppvv.exec:\pppvv.exe123⤵PID:1036
-
\??\c:\5frrlxf.exec:\5frrlxf.exe124⤵PID:2644
-
\??\c:\9lflxfx.exec:\9lflxfx.exe125⤵PID:1956
-
\??\c:\ffrxllx.exec:\ffrxllx.exe126⤵PID:2456
-
\??\c:\nnbhbn.exec:\nnbhbn.exe127⤵PID:2744
-
\??\c:\bbnhht.exec:\bbnhht.exe128⤵PID:308
-
\??\c:\vddpj.exec:\vddpj.exe129⤵PID:2616
-
\??\c:\dvjjv.exec:\dvjjv.exe130⤵PID:1948
-
\??\c:\9xxfrlx.exec:\9xxfrlx.exe131⤵PID:1064
-
\??\c:\llfrlxx.exec:\llfrlxx.exe132⤵PID:1108
-
\??\c:\thtntt.exec:\thtntt.exe133⤵PID:2888
-
\??\c:\tnbntb.exec:\tnbntb.exe134⤵PID:788
-
\??\c:\hhtbhh.exec:\hhtbhh.exe135⤵PID:1700
-
\??\c:\7jddp.exec:\7jddp.exe136⤵PID:1576
-
\??\c:\ppdpd.exec:\ppdpd.exe137⤵PID:2068
-
\??\c:\vpjdv.exec:\vpjdv.exe138⤵PID:2968
-
\??\c:\7rrfxfx.exec:\7rrfxfx.exe139⤵PID:2856
-
\??\c:\5llflff.exec:\5llflff.exe140⤵PID:608
-
\??\c:\nbbbbb.exec:\nbbbbb.exe141⤵PID:832
-
\??\c:\hbntnt.exec:\hbntnt.exe142⤵PID:1664
-
\??\c:\5bttnb.exec:\5bttnb.exe143⤵PID:1492
-
\??\c:\vjvdv.exec:\vjvdv.exe144⤵PID:1608
-
\??\c:\lxlfllr.exec:\lxlfllr.exe145⤵PID:2304
-
\??\c:\ffxfrrf.exec:\ffxfrrf.exe146⤵PID:2216
-
\??\c:\xxffrxl.exec:\xxffrxl.exe147⤵PID:276
-
\??\c:\hhhnnb.exec:\hhhnnb.exe148⤵PID:2540
-
\??\c:\1vvjd.exec:\1vvjd.exe149⤵PID:2544
-
\??\c:\9pvpv.exec:\9pvpv.exe150⤵PID:1540
-
\??\c:\1dvvd.exec:\1dvvd.exe151⤵PID:2176
-
\??\c:\xlxrrrf.exec:\xlxrrrf.exe152⤵PID:2444
-
\??\c:\lrxrrlf.exec:\lrxrrlf.exe153⤵PID:2212
-
\??\c:\5httbh.exec:\5httbh.exe154⤵PID:904
-
\??\c:\htnhtt.exec:\htnhtt.exe155⤵PID:848
-
\??\c:\1vdvv.exec:\1vdvv.exe156⤵PID:1616
-
\??\c:\dvppd.exec:\dvppd.exe157⤵PID:2660
-
\??\c:\fxffrrl.exec:\fxffrrl.exe158⤵PID:2468
-
\??\c:\lfllrrx.exec:\lfllrrx.exe159⤵PID:2688
-
\??\c:\lxxrrff.exec:\lxxrrff.exe160⤵PID:2800
-
\??\c:\5nnthn.exec:\5nnthn.exe161⤵PID:2596
-
\??\c:\tbntbh.exec:\tbntbh.exe162⤵PID:2984
-
\??\c:\ppppj.exec:\ppppj.exe163⤵PID:1532
-
\??\c:\5vjjd.exec:\5vjjd.exe164⤵PID:2480
-
\??\c:\jpdpj.exec:\jpdpj.exe165⤵PID:2520
-
\??\c:\9lfxxfx.exec:\9lfxxfx.exe166⤵PID:2796
-
\??\c:\fxffxxf.exec:\fxffxxf.exe167⤵PID:1956
-
\??\c:\7hbhhh.exec:\7hbhhh.exe168⤵PID:2456
-
\??\c:\nnbntb.exec:\nnbntb.exe169⤵PID:2744
-
\??\c:\jjdjd.exec:\jjdjd.exe170⤵PID:2684
-
\??\c:\ppvdj.exec:\ppvdj.exe171⤵PID:2616
-
\??\c:\3xlrxxf.exec:\3xlrxxf.exe172⤵PID:1948
-
\??\c:\llxlxlx.exec:\llxlxlx.exe173⤵PID:1064
-
\??\c:\xfrfxfx.exec:\xfrfxfx.exe174⤵PID:1108
-
\??\c:\ttthbn.exec:\ttthbn.exe175⤵PID:2888
-
\??\c:\3bthhb.exec:\3bthhb.exe176⤵PID:788
-
\??\c:\dvpjv.exec:\dvpjv.exe177⤵PID:2108
-
\??\c:\vvdjd.exec:\vvdjd.exe178⤵PID:2768
-
\??\c:\9fxffxx.exec:\9fxffxx.exe179⤵PID:2180
-
\??\c:\xlrrxxl.exec:\xlrrxxl.exe180⤵PID:2992
-
\??\c:\rlrrrxf.exec:\rlrrrxf.exe181⤵PID:1708
-
\??\c:\tnbnhb.exec:\tnbnhb.exe182⤵PID:716
-
\??\c:\tntbhn.exec:\tntbhn.exe183⤵PID:1824
-
\??\c:\pdppv.exec:\pdppv.exe184⤵PID:1868
-
\??\c:\3pjjj.exec:\3pjjj.exe185⤵PID:1696
-
\??\c:\1dpdv.exec:\1dpdv.exe186⤵PID:624
-
\??\c:\xrxxffr.exec:\xrxxffr.exe187⤵PID:3040
-
\??\c:\hbhbhh.exec:\hbhbhh.exe188⤵PID:2336
-
\??\c:\htbtbb.exec:\htbtbb.exe189⤵PID:2116
-
\??\c:\bttbtb.exec:\bttbtb.exe190⤵PID:2880
-
\??\c:\7pjjv.exec:\7pjjv.exe191⤵PID:3020
-
\??\c:\vvpvd.exec:\vvpvd.exe192⤵PID:2860
-
\??\c:\dvppj.exec:\dvppj.exe193⤵PID:1740
-
\??\c:\7lrxflx.exec:\7lrxflx.exe194⤵PID:2120
-
\??\c:\ffrfflf.exec:\ffrfflf.exe195⤵PID:2840
-
\??\c:\tnhnht.exec:\tnhnht.exe196⤵PID:1732
-
\??\c:\bbtbtn.exec:\bbtbtn.exe197⤵PID:2676
-
\??\c:\thbbth.exec:\thbbth.exe198⤵PID:1996
-
\??\c:\jpjdp.exec:\jpjdp.exe199⤵PID:2196
-
\??\c:\jppjd.exec:\jppjd.exe200⤵PID:1460
-
\??\c:\flrrfxf.exec:\flrrfxf.exe201⤵PID:2680
-
\??\c:\lxxrfrx.exec:\lxxrfrx.exe202⤵PID:2484
-
\??\c:\xfrlfrf.exec:\xfrlfrf.exe203⤵PID:2504
-
\??\c:\nhhhtb.exec:\nhhhtb.exe204⤵PID:2020
-
\??\c:\thbbnt.exec:\thbbnt.exe205⤵PID:2836
-
\??\c:\jdppp.exec:\jdppp.exe206⤵PID:1036
-
\??\c:\pdvdj.exec:\pdvdj.exe207⤵PID:2644
-
\??\c:\ppvvd.exec:\ppvvd.exe208⤵PID:2920
-
\??\c:\lrflfrf.exec:\lrflfrf.exe209⤵PID:2028
-
\??\c:\lrrrfxf.exec:\lrrrfxf.exe210⤵PID:1668
-
\??\c:\hbnnhb.exec:\hbnnhb.exe211⤵PID:308
-
\??\c:\nnbbht.exec:\nnbbht.exe212⤵PID:1060
-
\??\c:\djdjp.exec:\djdjp.exe213⤵PID:2220
-
\??\c:\jjddj.exec:\jjddj.exe214⤵PID:312
-
\??\c:\1vppp.exec:\1vppp.exe215⤵PID:2528
-
\??\c:\fxfflrx.exec:\fxfflrx.exe216⤵PID:2140
-
\??\c:\7xrrxfl.exec:\7xrrxfl.exe217⤵PID:2556
-
\??\c:\3hhbhn.exec:\3hhbhn.exe218⤵PID:1656
-
\??\c:\tbhbbb.exec:\tbhbbb.exe219⤵PID:1600
-
\??\c:\1djvj.exec:\1djvj.exe220⤵PID:2068
-
\??\c:\9ddjv.exec:\9ddjv.exe221⤵PID:488
-
\??\c:\7jppp.exec:\7jppp.exe222⤵PID:3028
-
\??\c:\5rrrfrx.exec:\5rrrfrx.exe223⤵PID:1496
-
\??\c:\rlflrlx.exec:\rlflrlx.exe224⤵PID:868
-
\??\c:\7rffffl.exec:\7rffffl.exe225⤵PID:2052
-
\??\c:\7bbbbb.exec:\7bbbbb.exe226⤵PID:2312
-
\??\c:\bbbhbn.exec:\bbbhbn.exe227⤵PID:668
-
\??\c:\3vvdp.exec:\3vvdp.exe228⤵PID:1992
-
\??\c:\vdpjp.exec:\vdpjp.exe229⤵PID:984
-
\??\c:\jjdjv.exec:\jjdjv.exe230⤵PID:1364
-
\??\c:\3xrfrxr.exec:\3xrfrxr.exe231⤵PID:3016
-
\??\c:\xxrxfll.exec:\xxrxfll.exe232⤵PID:1224
-
\??\c:\7xllrrl.exec:\7xllrrl.exe233⤵PID:1864
-
\??\c:\bhnbhb.exec:\bhnbhb.exe234⤵PID:2820
-
\??\c:\tttnnh.exec:\tttnnh.exe235⤵PID:2656
-
\??\c:\vjvpd.exec:\vjvpd.exe236⤵PID:1408
-
\??\c:\ddvjv.exec:\ddvjv.exe237⤵PID:2832
-
\??\c:\ddvpp.exec:\ddvpp.exe238⤵PID:2700
-
\??\c:\xrlfffl.exec:\xrlfffl.exe239⤵PID:2568
-
\??\c:\fxrrxxr.exec:\fxrrxxr.exe240⤵PID:2652
-
\??\c:\tnnttt.exec:\tnnttt.exe241⤵PID:3044
-
\??\c:\ttnhtn.exec:\ttnhtn.exe242⤵PID:2952