Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 22:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4f5778f2e51e8200e8b6985289bf7dd0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4f5778f2e51e8200e8b6985289bf7dd0_NeikiAnalytics.exe
-
Size
92KB
-
MD5
4f5778f2e51e8200e8b6985289bf7dd0
-
SHA1
f4e7b5c0d4d1e6efb51dddb23844f575c96d800c
-
SHA256
57217b70b8f28cb03b8940935b8b208c53131a4df6166bec13d2e3f1dcdbf4b2
-
SHA512
e7b4ca7b2deb486ebd2ecbbc008b43b1bba6b294c5196ffd33d9850ec8ca9fe54d318136819bd9aaf9dba3be846953da5861f09cdd773b12f1a19333ae16de37
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIQIDyviFxx2hCtgIMLP9rBZaRBm:ymb3NkkiQ3mdBjFIVLd2hWZGreRCUlbO
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/3048-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/644-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1488-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1896-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1684-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/312-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1128-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2376-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1616-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1252-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
7vddj.exe9lxrxfl.exebnbtbt.exedpvjd.exedpvvp.exelfxxxxx.exefrrfrxf.exebbhbhh.exeppdjv.exevpvpv.exexrxrxxf.exeththnh.exe3ntbht.exevdjvv.exedvjvd.exe3xfllrr.exetnntbb.exenbhnnt.exe5pdjv.exevpdvj.exe9rlxllr.exerlflxff.exennhbhh.exetnbhnn.exevpdvd.exe5ppdd.exelffxffl.exehtnthn.exethnbhn.exe7jpvd.exerrrlfrx.exerlxxfrx.exehbbhbt.exejjdvj.exeppdjd.exelfllxfx.exevpvvj.exe9xfxxxf.exenhnbhh.exevvpvj.exelxflxfl.exe1nbtbt.exevpvvp.exeffxfrrl.exe1nhnbh.exejdvdj.exeppdvd.exe1xxrflf.exehbhnnn.exehtbhhn.exedpddv.exedvpdj.exefrrlllr.exetnttbh.exehbnthn.exe1dpvp.exedvjpv.exe1xlrrrx.exexrflxrl.exeffrflrf.exethtbbh.exebnttbb.exedpddp.exe5dpdj.exepid process 3048 7vddj.exe 2620 9lxrxfl.exe 2560 bnbtbt.exe 2628 dpvjd.exe 2580 dpvvp.exe 2408 lfxxxxx.exe 2820 frrfrxf.exe 2156 bbhbhh.exe 644 ppdjv.exe 1252 vpvpv.exe 1240 xrxrxxf.exe 1716 ththnh.exe 1488 3ntbht.exe 1480 vdjvv.exe 1896 dvjvd.exe 1220 3xfllrr.exe 2716 tnntbb.exe 1616 nbhnnt.exe 2376 5pdjv.exe 2928 vpdvj.exe 488 9rlxllr.exe 1128 rlflxff.exe 312 nnhbhh.exe 1940 tnbhnn.exe 1172 vpdvd.exe 1684 5ppdd.exe 924 lffxffl.exe 2060 htnthn.exe 1620 thnbhn.exe 2100 7jpvd.exe 1904 rrrlfrx.exe 1668 rlxxfrx.exe 2900 hbbhbt.exe 1536 jjdvj.exe 2652 ppdjd.exe 2648 lfllxfx.exe 2748 vpvvj.exe 2612 9xfxxxf.exe 2656 nhnbhh.exe 2464 vvpvj.exe 1744 lxflxfl.exe 2124 1nbtbt.exe 2820 vpvvp.exe 2160 ffxfrrl.exe 1368 1nhnbh.exe 1260 jdvdj.exe 1252 ppdvd.exe 2328 1xxrflf.exe 2388 hbhnnn.exe 500 htbhhn.exe 2132 dpddv.exe 2484 dvpdj.exe 2032 frrlllr.exe 2644 tnttbh.exe 2188 hbnthn.exe 1052 1dpvp.exe 1592 dvjpv.exe 540 1xlrrrx.exe 2712 xrflxrl.exe 580 ffrflrf.exe 328 thtbbh.exe 556 bnttbb.exe 2904 dpddp.exe 1928 5dpdj.exe -
Processes:
resource yara_rule behavioral1/memory/2856-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/644-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1488-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1896-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1684-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/312-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1128-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1616-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1252-115-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4f5778f2e51e8200e8b6985289bf7dd0_NeikiAnalytics.exe7vddj.exe9lxrxfl.exebnbtbt.exedpvjd.exedpvvp.exelfxxxxx.exefrrfrxf.exebbhbhh.exeppdjv.exevpvpv.exexrxrxxf.exeththnh.exe3ntbht.exevdjvv.exedvjvd.exedescription pid process target process PID 2856 wrote to memory of 3048 2856 4f5778f2e51e8200e8b6985289bf7dd0_NeikiAnalytics.exe 7vddj.exe PID 2856 wrote to memory of 3048 2856 4f5778f2e51e8200e8b6985289bf7dd0_NeikiAnalytics.exe 7vddj.exe PID 2856 wrote to memory of 3048 2856 4f5778f2e51e8200e8b6985289bf7dd0_NeikiAnalytics.exe 7vddj.exe PID 2856 wrote to memory of 3048 2856 4f5778f2e51e8200e8b6985289bf7dd0_NeikiAnalytics.exe 7vddj.exe PID 3048 wrote to memory of 2620 3048 7vddj.exe 9lxrxfl.exe PID 3048 wrote to memory of 2620 3048 7vddj.exe 9lxrxfl.exe PID 3048 wrote to memory of 2620 3048 7vddj.exe 9lxrxfl.exe PID 3048 wrote to memory of 2620 3048 7vddj.exe 9lxrxfl.exe PID 2620 wrote to memory of 2560 2620 9lxrxfl.exe bnbtbt.exe PID 2620 wrote to memory of 2560 2620 9lxrxfl.exe bnbtbt.exe PID 2620 wrote to memory of 2560 2620 9lxrxfl.exe bnbtbt.exe PID 2620 wrote to memory of 2560 2620 9lxrxfl.exe bnbtbt.exe PID 2560 wrote to memory of 2628 2560 bnbtbt.exe dpvjd.exe PID 2560 wrote to memory of 2628 2560 bnbtbt.exe dpvjd.exe PID 2560 wrote to memory of 2628 2560 bnbtbt.exe dpvjd.exe PID 2560 wrote to memory of 2628 2560 bnbtbt.exe dpvjd.exe PID 2628 wrote to memory of 2580 2628 dpvjd.exe dpvvp.exe PID 2628 wrote to memory of 2580 2628 dpvjd.exe dpvvp.exe PID 2628 wrote to memory of 2580 2628 dpvjd.exe dpvvp.exe PID 2628 wrote to memory of 2580 2628 dpvjd.exe dpvvp.exe PID 2580 wrote to memory of 2408 2580 dpvvp.exe lfxxxxx.exe PID 2580 wrote to memory of 2408 2580 dpvvp.exe lfxxxxx.exe PID 2580 wrote to memory of 2408 2580 dpvvp.exe lfxxxxx.exe PID 2580 wrote to memory of 2408 2580 dpvvp.exe lfxxxxx.exe PID 2408 wrote to memory of 2820 2408 lfxxxxx.exe frrfrxf.exe PID 2408 wrote to memory of 2820 2408 lfxxxxx.exe frrfrxf.exe PID 2408 wrote to memory of 2820 2408 lfxxxxx.exe frrfrxf.exe PID 2408 wrote to memory of 2820 2408 lfxxxxx.exe frrfrxf.exe PID 2820 wrote to memory of 2156 2820 frrfrxf.exe bbhbhh.exe PID 2820 wrote to memory of 2156 2820 frrfrxf.exe bbhbhh.exe PID 2820 wrote to memory of 2156 2820 frrfrxf.exe bbhbhh.exe PID 2820 wrote to memory of 2156 2820 frrfrxf.exe bbhbhh.exe PID 2156 wrote to memory of 644 2156 bbhbhh.exe ppdjv.exe PID 2156 wrote to memory of 644 2156 bbhbhh.exe ppdjv.exe PID 2156 wrote to memory of 644 2156 bbhbhh.exe ppdjv.exe PID 2156 wrote to memory of 644 2156 bbhbhh.exe ppdjv.exe PID 644 wrote to memory of 1252 644 ppdjv.exe vpvpv.exe PID 644 wrote to memory of 1252 644 ppdjv.exe vpvpv.exe PID 644 wrote to memory of 1252 644 ppdjv.exe vpvpv.exe PID 644 wrote to memory of 1252 644 ppdjv.exe vpvpv.exe PID 1252 wrote to memory of 1240 1252 vpvpv.exe xrxrxxf.exe PID 1252 wrote to memory of 1240 1252 vpvpv.exe xrxrxxf.exe PID 1252 wrote to memory of 1240 1252 vpvpv.exe xrxrxxf.exe PID 1252 wrote to memory of 1240 1252 vpvpv.exe xrxrxxf.exe PID 1240 wrote to memory of 1716 1240 xrxrxxf.exe ththnh.exe PID 1240 wrote to memory of 1716 1240 xrxrxxf.exe ththnh.exe PID 1240 wrote to memory of 1716 1240 xrxrxxf.exe ththnh.exe PID 1240 wrote to memory of 1716 1240 xrxrxxf.exe ththnh.exe PID 1716 wrote to memory of 1488 1716 ththnh.exe 3ntbht.exe PID 1716 wrote to memory of 1488 1716 ththnh.exe 3ntbht.exe PID 1716 wrote to memory of 1488 1716 ththnh.exe 3ntbht.exe PID 1716 wrote to memory of 1488 1716 ththnh.exe 3ntbht.exe PID 1488 wrote to memory of 1480 1488 3ntbht.exe vdjvv.exe PID 1488 wrote to memory of 1480 1488 3ntbht.exe vdjvv.exe PID 1488 wrote to memory of 1480 1488 3ntbht.exe vdjvv.exe PID 1488 wrote to memory of 1480 1488 3ntbht.exe vdjvv.exe PID 1480 wrote to memory of 1896 1480 vdjvv.exe dvjvd.exe PID 1480 wrote to memory of 1896 1480 vdjvv.exe dvjvd.exe PID 1480 wrote to memory of 1896 1480 vdjvv.exe dvjvd.exe PID 1480 wrote to memory of 1896 1480 vdjvv.exe dvjvd.exe PID 1896 wrote to memory of 1220 1896 dvjvd.exe 3xfllrr.exe PID 1896 wrote to memory of 1220 1896 dvjvd.exe 3xfllrr.exe PID 1896 wrote to memory of 1220 1896 dvjvd.exe 3xfllrr.exe PID 1896 wrote to memory of 1220 1896 dvjvd.exe 3xfllrr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f5778f2e51e8200e8b6985289bf7dd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4f5778f2e51e8200e8b6985289bf7dd0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\7vddj.exec:\7vddj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\9lxrxfl.exec:\9lxrxfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\bnbtbt.exec:\bnbtbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\dpvjd.exec:\dpvjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\dpvvp.exec:\dpvvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\lfxxxxx.exec:\lfxxxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\frrfrxf.exec:\frrfrxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\bbhbhh.exec:\bbhbhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\ppdjv.exec:\ppdjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\vpvpv.exec:\vpvpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\xrxrxxf.exec:\xrxrxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\ththnh.exec:\ththnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\3ntbht.exec:\3ntbht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\vdjvv.exec:\vdjvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\dvjvd.exec:\dvjvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\3xfllrr.exec:\3xfllrr.exe17⤵
- Executes dropped EXE
PID:1220 -
\??\c:\tnntbb.exec:\tnntbb.exe18⤵
- Executes dropped EXE
PID:2716 -
\??\c:\nbhnnt.exec:\nbhnnt.exe19⤵
- Executes dropped EXE
PID:1616 -
\??\c:\5pdjv.exec:\5pdjv.exe20⤵
- Executes dropped EXE
PID:2376 -
\??\c:\vpdvj.exec:\vpdvj.exe21⤵
- Executes dropped EXE
PID:2928 -
\??\c:\9rlxllr.exec:\9rlxllr.exe22⤵
- Executes dropped EXE
PID:488 -
\??\c:\rlflxff.exec:\rlflxff.exe23⤵
- Executes dropped EXE
PID:1128 -
\??\c:\nnhbhh.exec:\nnhbhh.exe24⤵
- Executes dropped EXE
PID:312 -
\??\c:\tnbhnn.exec:\tnbhnn.exe25⤵
- Executes dropped EXE
PID:1940 -
\??\c:\vpdvd.exec:\vpdvd.exe26⤵
- Executes dropped EXE
PID:1172 -
\??\c:\5ppdd.exec:\5ppdd.exe27⤵
- Executes dropped EXE
PID:1684 -
\??\c:\lffxffl.exec:\lffxffl.exe28⤵
- Executes dropped EXE
PID:924 -
\??\c:\htnthn.exec:\htnthn.exe29⤵
- Executes dropped EXE
PID:2060 -
\??\c:\thnbhn.exec:\thnbhn.exe30⤵
- Executes dropped EXE
PID:1620 -
\??\c:\7jpvd.exec:\7jpvd.exe31⤵
- Executes dropped EXE
PID:2100 -
\??\c:\rrrlfrx.exec:\rrrlfrx.exe32⤵
- Executes dropped EXE
PID:1904 -
\??\c:\rlxxfrx.exec:\rlxxfrx.exe33⤵
- Executes dropped EXE
PID:1668 -
\??\c:\hbbhbt.exec:\hbbhbt.exe34⤵
- Executes dropped EXE
PID:2900 -
\??\c:\jjdvj.exec:\jjdvj.exe35⤵
- Executes dropped EXE
PID:1536 -
\??\c:\ppdjd.exec:\ppdjd.exe36⤵
- Executes dropped EXE
PID:2652 -
\??\c:\lfllxfx.exec:\lfllxfx.exe37⤵
- Executes dropped EXE
PID:2648 -
\??\c:\vpvvj.exec:\vpvvj.exe38⤵
- Executes dropped EXE
PID:2748 -
\??\c:\9xfxxxf.exec:\9xfxxxf.exe39⤵
- Executes dropped EXE
PID:2612 -
\??\c:\nhnbhh.exec:\nhnbhh.exe40⤵
- Executes dropped EXE
PID:2656 -
\??\c:\vvpvj.exec:\vvpvj.exe41⤵
- Executes dropped EXE
PID:2464 -
\??\c:\lxflxfl.exec:\lxflxfl.exe42⤵
- Executes dropped EXE
PID:1744 -
\??\c:\1nbtbt.exec:\1nbtbt.exe43⤵
- Executes dropped EXE
PID:2124 -
\??\c:\vpvvp.exec:\vpvvp.exe44⤵
- Executes dropped EXE
PID:2820 -
\??\c:\ffxfrrl.exec:\ffxfrrl.exe45⤵
- Executes dropped EXE
PID:2160 -
\??\c:\1nhnbh.exec:\1nhnbh.exe46⤵
- Executes dropped EXE
PID:1368 -
\??\c:\jdvdj.exec:\jdvdj.exe47⤵
- Executes dropped EXE
PID:1260 -
\??\c:\ppdvd.exec:\ppdvd.exe48⤵
- Executes dropped EXE
PID:1252 -
\??\c:\1xxrflf.exec:\1xxrflf.exe49⤵
- Executes dropped EXE
PID:2328 -
\??\c:\hbhnnn.exec:\hbhnnn.exe50⤵
- Executes dropped EXE
PID:2388 -
\??\c:\htbhhn.exec:\htbhhn.exe51⤵
- Executes dropped EXE
PID:500 -
\??\c:\dpddv.exec:\dpddv.exe52⤵
- Executes dropped EXE
PID:2132 -
\??\c:\dvpdj.exec:\dvpdj.exe53⤵
- Executes dropped EXE
PID:2484 -
\??\c:\frrlllr.exec:\frrlllr.exe54⤵
- Executes dropped EXE
PID:2032 -
\??\c:\tnttbh.exec:\tnttbh.exe55⤵
- Executes dropped EXE
PID:2644 -
\??\c:\hbnthn.exec:\hbnthn.exe56⤵
- Executes dropped EXE
PID:2188 -
\??\c:\1dpvp.exec:\1dpvp.exe57⤵
- Executes dropped EXE
PID:1052 -
\??\c:\dvjpv.exec:\dvjpv.exe58⤵
- Executes dropped EXE
PID:1592 -
\??\c:\1xlrrrx.exec:\1xlrrrx.exe59⤵
- Executes dropped EXE
PID:540 -
\??\c:\xrflxrl.exec:\xrflxrl.exe60⤵
- Executes dropped EXE
PID:2712 -
\??\c:\ffrflrf.exec:\ffrflrf.exe61⤵
- Executes dropped EXE
PID:580 -
\??\c:\thtbbh.exec:\thtbbh.exe62⤵
- Executes dropped EXE
PID:328 -
\??\c:\bnttbb.exec:\bnttbb.exe63⤵
- Executes dropped EXE
PID:556 -
\??\c:\dpddp.exec:\dpddp.exe64⤵
- Executes dropped EXE
PID:2904 -
\??\c:\5dpdj.exec:\5dpdj.exe65⤵
- Executes dropped EXE
PID:1928 -
\??\c:\1xrrxxl.exec:\1xrrxxl.exe66⤵PID:2380
-
\??\c:\3frlxxl.exec:\3frlxxl.exe67⤵PID:276
-
\??\c:\3xlrrlr.exec:\3xlrrlr.exe68⤵PID:2908
-
\??\c:\tntnbh.exec:\tntnbh.exe69⤵PID:2004
-
\??\c:\jjvdp.exec:\jjvdp.exe70⤵PID:296
-
\??\c:\vjdvj.exec:\vjdvj.exe71⤵PID:2256
-
\??\c:\vjvpd.exec:\vjvpd.exe72⤵PID:864
-
\??\c:\rlrllfl.exec:\rlrllfl.exe73⤵PID:896
-
\??\c:\hbbbhb.exec:\hbbbhb.exe74⤵PID:2956
-
\??\c:\tbtbbb.exec:\tbtbbb.exe75⤵PID:2076
-
\??\c:\jddpd.exec:\jddpd.exe76⤵PID:2632
-
\??\c:\jdjjj.exec:\jdjjj.exe77⤵PID:1644
-
\??\c:\9fxxrxf.exec:\9fxxrxf.exe78⤵PID:2508
-
\??\c:\3lxfrlx.exec:\3lxfrlx.exe79⤵PID:2684
-
\??\c:\5tbbnb.exec:\5tbbnb.exe80⤵PID:2564
-
\??\c:\bnthnt.exec:\bnthnt.exe81⤵PID:2724
-
\??\c:\dvddv.exec:\dvddv.exe82⤵PID:1640
-
\??\c:\jddpj.exec:\jddpj.exe83⤵PID:2416
-
\??\c:\7xlflfr.exec:\7xlflfr.exe84⤵PID:2536
-
\??\c:\3xlrffr.exec:\3xlrffr.exe85⤵PID:2456
-
\??\c:\1thhtt.exec:\1thhtt.exe86⤵PID:1584
-
\??\c:\btbbbh.exec:\btbbbh.exe87⤵PID:1276
-
\??\c:\3jpjd.exec:\3jpjd.exe88⤵PID:2468
-
\??\c:\dpdjj.exec:\dpdjj.exe89⤵PID:1196
-
\??\c:\flllfxl.exec:\flllfxl.exe90⤵PID:1752
-
\??\c:\7llxllr.exec:\7llxllr.exe91⤵PID:2320
-
\??\c:\xlxflrf.exec:\xlxflrf.exe92⤵PID:2176
-
\??\c:\bthtbb.exec:\bthtbb.exe93⤵PID:1044
-
\??\c:\tnbtnh.exec:\tnbtnh.exe94⤵PID:1772
-
\??\c:\dvjjd.exec:\dvjjd.exe95⤵PID:1580
-
\??\c:\pjjpv.exec:\pjjpv.exe96⤵PID:2164
-
\??\c:\xlrlllr.exec:\xlrlllr.exe97⤵PID:3052
-
\??\c:\frfllrf.exec:\frfllrf.exe98⤵PID:1912
-
\??\c:\thnntt.exec:\thnntt.exe99⤵PID:2120
-
\??\c:\9htbbt.exec:\9htbbt.exe100⤵PID:2208
-
\??\c:\jvjjv.exec:\jvjjv.exe101⤵PID:2376
-
\??\c:\1djvv.exec:\1djvv.exe102⤵PID:2640
-
\??\c:\dvjjv.exec:\dvjjv.exe103⤵PID:1076
-
\??\c:\3lrxfrx.exec:\3lrxfrx.exe104⤵PID:656
-
\??\c:\frfffff.exec:\frfffff.exe105⤵PID:1064
-
\??\c:\nhnnbb.exec:\nhnnbb.exe106⤵PID:2112
-
\??\c:\hbnhtn.exec:\hbnhtn.exe107⤵PID:2152
-
\??\c:\vpvdj.exec:\vpvdj.exe108⤵PID:1700
-
\??\c:\pjvvj.exec:\pjvvj.exe109⤵PID:748
-
\??\c:\1flrxfx.exec:\1flrxfx.exe110⤵PID:940
-
\??\c:\rllffxf.exec:\rllffxf.exe111⤵PID:920
-
\??\c:\tnbnnt.exec:\tnbnnt.exe112⤵PID:452
-
\??\c:\7hhhhn.exec:\7hhhhn.exe113⤵PID:2896
-
\??\c:\vpvdj.exec:\vpvdj.exe114⤵PID:1660
-
\??\c:\3pdjv.exec:\3pdjv.exe115⤵PID:1072
-
\??\c:\jdvjp.exec:\jdvjp.exe116⤵PID:2860
-
\??\c:\9rffflr.exec:\9rffflr.exe117⤵PID:2892
-
\??\c:\lfrrxlr.exec:\lfrrxlr.exe118⤵PID:2740
-
\??\c:\hbnntt.exec:\hbnntt.exe119⤵PID:2632
-
\??\c:\nhbtbb.exec:\nhbtbb.exe120⤵PID:1504
-
\??\c:\jjdpp.exec:\jjdpp.exe121⤵PID:2548
-
\??\c:\jvdvd.exec:\jvdvd.exe122⤵PID:2760
-
\??\c:\fflrxxf.exec:\fflrxxf.exe123⤵PID:2564
-
\??\c:\xrllxxl.exec:\xrllxxl.exe124⤵PID:2724
-
\??\c:\nbhntn.exec:\nbhntn.exe125⤵PID:2568
-
\??\c:\hhnbhh.exec:\hhnbhh.exe126⤵PID:2464
-
\??\c:\3vdjj.exec:\3vdjj.exe127⤵PID:3040
-
\??\c:\pjjpj.exec:\pjjpj.exe128⤵PID:2584
-
\??\c:\rlrrflx.exec:\rlrrflx.exe129⤵PID:2820
-
\??\c:\llfxrxf.exec:\llfxrxf.exe130⤵PID:1436
-
\??\c:\bbntbh.exec:\bbntbh.exe131⤵PID:1368
-
\??\c:\9thhtb.exec:\9thhtb.exe132⤵PID:2444
-
\??\c:\jdppv.exec:\jdppv.exe133⤵PID:1752
-
\??\c:\3rflffx.exec:\3rflffx.exe134⤵PID:2320
-
\??\c:\5rfxfxf.exec:\5rfxfxf.exe135⤵PID:1032
-
\??\c:\nhnthn.exec:\nhnthn.exe136⤵PID:1568
-
\??\c:\hbhnht.exec:\hbhnht.exe137⤵PID:2400
-
\??\c:\hbhtbn.exec:\hbhtbn.exe138⤵PID:1480
-
\??\c:\5dvvd.exec:\5dvvd.exe139⤵PID:2164
-
\??\c:\vpvjv.exec:\vpvjv.exe140⤵PID:2692
-
\??\c:\1rffxlr.exec:\1rffxlr.exe141⤵PID:1028
-
\??\c:\llrrrrx.exec:\llrrrrx.exe142⤵PID:1824
-
\??\c:\hbnbht.exec:\hbnbht.exe143⤵PID:1592
-
\??\c:\pvpjj.exec:\pvpjj.exe144⤵PID:1596
-
\??\c:\ddjpp.exec:\ddjpp.exe145⤵PID:2640
-
\??\c:\7xxlrrl.exec:\7xxlrrl.exe146⤵PID:1076
-
\??\c:\rfffflr.exec:\rfffflr.exe147⤵PID:656
-
\??\c:\htbnnn.exec:\htbnnn.exe148⤵PID:964
-
\??\c:\btbtbh.exec:\btbtbh.exe149⤵PID:692
-
\??\c:\pjpvj.exec:\pjpvj.exe150⤵PID:1940
-
\??\c:\vpdvd.exec:\vpdvd.exe151⤵PID:1700
-
\??\c:\ddjjp.exec:\ddjjp.exe152⤵PID:1680
-
\??\c:\5flfffl.exec:\5flfffl.exe153⤵PID:940
-
\??\c:\9xrxflr.exec:\9xrxflr.exe154⤵PID:2308
-
\??\c:\nhhnbt.exec:\nhhnbt.exe155⤵PID:452
-
\??\c:\bthtbb.exec:\bthtbb.exe156⤵PID:2960
-
\??\c:\pjjjd.exec:\pjjjd.exe157⤵PID:864
-
\??\c:\dvppd.exec:\dvppd.exe158⤵PID:2100
-
\??\c:\lllxrrx.exec:\lllxrrx.exe159⤵PID:2224
-
\??\c:\5rllrrx.exec:\5rllrrx.exe160⤵PID:2956
-
\??\c:\nbbhtt.exec:\nbbhtt.exe161⤵PID:2556
-
\??\c:\jvddd.exec:\jvddd.exe162⤵PID:2600
-
\??\c:\pjdvd.exec:\pjdvd.exe163⤵PID:2672
-
\??\c:\xlxfrlr.exec:\xlxfrlr.exe164⤵PID:2116
-
\??\c:\bbnbbb.exec:\bbnbbb.exe165⤵PID:2560
-
\??\c:\1thhth.exec:\1thhth.exe166⤵PID:2460
-
\??\c:\9pvvv.exec:\9pvvv.exe167⤵PID:2588
-
\??\c:\lrrxfrx.exec:\lrrxfrx.exe168⤵PID:2576
-
\??\c:\9frrffl.exec:\9frrffl.exe169⤵PID:2824
-
\??\c:\5nbnnn.exec:\5nbnnn.exe170⤵PID:1244
-
\??\c:\9pdpd.exec:\9pdpd.exe171⤵PID:2488
-
\??\c:\ppjpj.exec:\ppjpj.exe172⤵PID:1336
-
\??\c:\9lfllrf.exec:\9lfllrf.exe173⤵PID:2332
-
\??\c:\1hbnbh.exec:\1hbnbh.exe174⤵PID:3012
-
\??\c:\7thntn.exec:\7thntn.exe175⤵PID:1564
-
\??\c:\5pppd.exec:\5pppd.exe176⤵PID:1456
-
\??\c:\vpdjp.exec:\vpdjp.exe177⤵PID:1508
-
\??\c:\lfflrfr.exec:\lfflrfr.exe178⤵PID:1768
-
\??\c:\5hbtbn.exec:\5hbtbn.exe179⤵PID:2044
-
\??\c:\9nhthn.exec:\9nhthn.exe180⤵PID:848
-
\??\c:\dvddv.exec:\dvddv.exe181⤵PID:472
-
\??\c:\pddvp.exec:\pddvp.exe182⤵PID:3044
-
\??\c:\frlrllr.exec:\frlrllr.exe183⤵PID:1512
-
\??\c:\ttbhtt.exec:\ttbhtt.exe184⤵PID:1932
-
\??\c:\bnhhtt.exec:\bnhhtt.exe185⤵PID:2008
-
\??\c:\dpjdj.exec:\dpjdj.exe186⤵PID:1980
-
\??\c:\fllxxrf.exec:\fllxxrf.exe187⤵PID:2928
-
\??\c:\5xrlrrf.exec:\5xrlrrf.exe188⤵PID:1808
-
\??\c:\1bnnbt.exec:\1bnnbt.exe189⤵PID:2052
-
\??\c:\bbnnbb.exec:\bbnnbb.exe190⤵PID:312
-
\??\c:\vdjpv.exec:\vdjpv.exe191⤵PID:2516
-
\??\c:\vjppp.exec:\vjppp.exe192⤵PID:1892
-
\??\c:\nbhbtt.exec:\nbhbtt.exe193⤵PID:1972
-
\??\c:\vpdpv.exec:\vpdpv.exe194⤵PID:2936
-
\??\c:\dvdvj.exec:\dvdvj.exe195⤵PID:3068
-
\??\c:\7xlrxxx.exec:\7xlrxxx.exe196⤵PID:2220
-
\??\c:\hhbhnt.exec:\hhbhnt.exe197⤵PID:2212
-
\??\c:\jdpdv.exec:\jdpdv.exe198⤵PID:1672
-
\??\c:\lfxrllr.exec:\lfxrllr.exe199⤵PID:2084
-
\??\c:\thtnhh.exec:\thtnhh.exe200⤵PID:1764
-
\??\c:\nntbhn.exec:\nntbhn.exe201⤵PID:1668
-
\??\c:\9jdpd.exec:\9jdpd.exe202⤵PID:1532
-
\??\c:\9vvjp.exec:\9vvjp.exe203⤵PID:2956
-
\??\c:\xfxlrfr.exec:\xfxlrfr.exe204⤵PID:2668
-
\??\c:\xxxfrfl.exec:\xxxfrfl.exe205⤵PID:3048
-
\??\c:\hhhhnh.exec:\hhhhnh.exe206⤵PID:2688
-
\??\c:\pdppj.exec:\pdppj.exe207⤵PID:2504
-
\??\c:\5pddv.exec:\5pddv.exe208⤵PID:2680
-
\??\c:\xxxfxxr.exec:\xxxfxxr.exe209⤵PID:2676
-
\??\c:\rrlrfxl.exec:\rrlrfxl.exe210⤵PID:2492
-
\??\c:\hbnttn.exec:\hbnttn.exe211⤵PID:2408
-
\??\c:\thtbnb.exec:\thtbnb.exe212⤵PID:2196
-
\??\c:\pjppp.exec:\pjppp.exe213⤵PID:1576
-
\??\c:\lfxlflx.exec:\lfxlflx.exe214⤵PID:1388
-
\??\c:\rrlxflr.exec:\rrlxflr.exe215⤵PID:320
-
\??\c:\btbhbh.exec:\btbhbh.exe216⤵PID:2836
-
\??\c:\nhtbnh.exec:\nhtbnh.exe217⤵PID:1868
-
\??\c:\dvjjd.exec:\dvjjd.exe218⤵PID:2168
-
\??\c:\fxxfxrl.exec:\fxxfxrl.exe219⤵PID:1464
-
\??\c:\rrlfxxl.exec:\rrlfxxl.exe220⤵PID:1588
-
\??\c:\nhnbhn.exec:\nhnbhn.exe221⤵PID:1872
-
\??\c:\nhbhtt.exec:\nhbhtt.exe222⤵PID:2172
-
\??\c:\jpvdj.exec:\jpvdj.exe223⤵PID:2808
-
\??\c:\vpjjp.exec:\vpjjp.exe224⤵PID:1896
-
\??\c:\xxxxlrx.exec:\xxxxlrx.exe225⤵PID:2732
-
\??\c:\ffrxrfx.exec:\ffrxrfx.exe226⤵PID:2272
-
\??\c:\tthnhh.exec:\tthnhh.exe227⤵PID:2776
-
\??\c:\jdppv.exec:\jdppv.exe228⤵PID:2040
-
\??\c:\vpvpv.exec:\vpvpv.exe229⤵PID:2708
-
\??\c:\frxxrrr.exec:\frxxrrr.exe230⤵PID:1124
-
\??\c:\lxxfrrf.exec:\lxxfrrf.exe231⤵PID:328
-
\??\c:\hhtthb.exec:\hhtthb.exe232⤵PID:1736
-
\??\c:\hthhtt.exec:\hthhtt.exe233⤵PID:1004
-
\??\c:\vvjpv.exec:\vvjpv.exe234⤵PID:3064
-
\??\c:\xrflrxf.exec:\xrflrxf.exe235⤵PID:2380
-
\??\c:\flfxrff.exec:\flfxrff.exe236⤵PID:1684
-
\??\c:\nnbttt.exec:\nnbttt.exe237⤵PID:1296
-
\??\c:\hbbhnb.exec:\hbbhnb.exe238⤵PID:912
-
\??\c:\dpppv.exec:\dpppv.exe239⤵PID:1636
-
\??\c:\vjpvv.exec:\vjpvv.exe240⤵PID:924
-
\??\c:\llrflfx.exec:\llrflfx.exe241⤵PID:2932
-
\??\c:\3bbhnt.exec:\3bbhnt.exe242⤵PID:2384