Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 03:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
605ed75d864e9beff80679b360b2fa60_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
605ed75d864e9beff80679b360b2fa60_NeikiAnalytics.exe
-
Size
64KB
-
MD5
605ed75d864e9beff80679b360b2fa60
-
SHA1
5eb95d6bdb3d038b062ee70238638ab36aaa1100
-
SHA256
b222d5bd53c509091f47b70e8d102c5e47a002e0c932dc1af762c5f1da57d6d4
-
SHA512
7ef8e6c5a60fcae7e05316e605fa4e1586c6ce165e77918c155ce582807faf72c5a461bd7d99dbe567ab24336624379aa0fa8eacff0749eee8e31e9b606f95d1
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8+Luv2xj:ymb3NkkiQ3mdBjF0yMlDxj
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/780-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2936-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-60-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2488-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3056-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/956-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1704-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1728-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1136-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2008-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
nhbhtt.exebntttt.exevvpvp.exexxxrrfx.exerflllff.exenthhnh.exejpvvp.exepjpjd.exerfllrrr.exe7hnnnt.exehntjjj.exe3vjjp.exerlxfffl.exelfflxxl.exentbttb.exe1tbntt.exejvvdp.exevdpjj.exe1lrlfff.exe7frfflr.exe7bbtbh.exebtbhtb.exevpddp.exepvddj.exexrffrxf.exefrffrlr.exe3jvdj.exevpvpd.exefrffllx.exefrfflll.exebtbbhb.exepjpvd.exejdpdj.exeffxllrl.exelflffff.exehthbbb.exetnbtbt.exe9ddvd.exepdvjj.exefxflllr.exellrrxrx.exebnnhht.exebthbbb.exejdpjj.exeddjvp.exefxlxxxf.exelrxxxrx.exe3hnnbh.exejddjv.exedpdpp.exe9rrxxxf.exe3frxlfl.exe7htbtb.exebtbtbt.exejjdvd.exefrffxrx.exehbnbtt.exebtnbnt.exe3dvvd.exedpdvd.exe1xlrxxr.exellfflrx.exennbbhh.exe9pjdd.exepid process 2412 nhbhtt.exe 2552 bntttt.exe 2936 vvpvp.exe 2744 xxxrrfx.exe 2824 rflllff.exe 2628 nthhnh.exe 2636 jpvvp.exe 2488 pjpjd.exe 3056 rfllrrr.exe 2536 7hnnnt.exe 2888 hntjjj.exe 2800 3vjjp.exe 2816 rlxfffl.exe 2820 lfflxxl.exe 2912 ntbttb.exe 956 1tbntt.exe 1704 jvvdp.exe 1728 vdpjj.exe 2376 1lrlfff.exe 1112 7frfflr.exe 692 7bbtbh.exe 1236 btbhtb.exe 652 vpddp.exe 2092 pvddj.exe 1136 xrffrxf.exe 2008 frffrlr.exe 1972 3jvdj.exe 1080 vpvpd.exe 2372 frffllx.exe 1376 frfflll.exe 1884 btbbhb.exe 884 pjpvd.exe 780 jdpdj.exe 2136 ffxllrl.exe 1848 lflffff.exe 1856 hthbbb.exe 2668 tnbtbt.exe 1736 9ddvd.exe 2836 pdvjj.exe 1928 fxflllr.exe 2676 llrrxrx.exe 2524 bnnhht.exe 2500 bthbbb.exe 2588 jdpjj.exe 2264 ddjvp.exe 2520 fxlxxxf.exe 1212 lrxxxrx.exe 1920 3hnnbh.exe 2568 jddjv.exe 1204 dpdpp.exe 1096 9rrxxxf.exe 944 3frxlfl.exe 948 7htbtb.exe 1764 btbtbt.exe 1788 jjdvd.exe 1548 frffxrx.exe 1056 hbnbtt.exe 2960 btnbnt.exe 540 3dvvd.exe 564 dpdvd.exe 1344 1xlrxxr.exe 1464 llfflrx.exe 1072 nnbbhh.exe 668 9pjdd.exe -
Processes:
resource yara_rule behavioral1/memory/780-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/956-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1704-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1728-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1136-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-281-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
605ed75d864e9beff80679b360b2fa60_NeikiAnalytics.exenhbhtt.exebntttt.exevvpvp.exexxxrrfx.exerflllff.exenthhnh.exejpvvp.exepjpjd.exerfllrrr.exe7hnnnt.exehntjjj.exe3vjjp.exerlxfffl.exelfflxxl.exentbttb.exedescription pid process target process PID 780 wrote to memory of 2412 780 605ed75d864e9beff80679b360b2fa60_NeikiAnalytics.exe nhbhtt.exe PID 780 wrote to memory of 2412 780 605ed75d864e9beff80679b360b2fa60_NeikiAnalytics.exe nhbhtt.exe PID 780 wrote to memory of 2412 780 605ed75d864e9beff80679b360b2fa60_NeikiAnalytics.exe nhbhtt.exe PID 780 wrote to memory of 2412 780 605ed75d864e9beff80679b360b2fa60_NeikiAnalytics.exe nhbhtt.exe PID 2412 wrote to memory of 2552 2412 nhbhtt.exe bntttt.exe PID 2412 wrote to memory of 2552 2412 nhbhtt.exe bntttt.exe PID 2412 wrote to memory of 2552 2412 nhbhtt.exe bntttt.exe PID 2412 wrote to memory of 2552 2412 nhbhtt.exe bntttt.exe PID 2552 wrote to memory of 2936 2552 bntttt.exe vvpvp.exe PID 2552 wrote to memory of 2936 2552 bntttt.exe vvpvp.exe PID 2552 wrote to memory of 2936 2552 bntttt.exe vvpvp.exe PID 2552 wrote to memory of 2936 2552 bntttt.exe vvpvp.exe PID 2936 wrote to memory of 2744 2936 vvpvp.exe xxxrrfx.exe PID 2936 wrote to memory of 2744 2936 vvpvp.exe xxxrrfx.exe PID 2936 wrote to memory of 2744 2936 vvpvp.exe xxxrrfx.exe PID 2936 wrote to memory of 2744 2936 vvpvp.exe xxxrrfx.exe PID 2744 wrote to memory of 2824 2744 xxxrrfx.exe rflllff.exe PID 2744 wrote to memory of 2824 2744 xxxrrfx.exe rflllff.exe PID 2744 wrote to memory of 2824 2744 xxxrrfx.exe rflllff.exe PID 2744 wrote to memory of 2824 2744 xxxrrfx.exe rflllff.exe PID 2824 wrote to memory of 2628 2824 rflllff.exe nthhnh.exe PID 2824 wrote to memory of 2628 2824 rflllff.exe nthhnh.exe PID 2824 wrote to memory of 2628 2824 rflllff.exe nthhnh.exe PID 2824 wrote to memory of 2628 2824 rflllff.exe nthhnh.exe PID 2628 wrote to memory of 2636 2628 nthhnh.exe jpvvp.exe PID 2628 wrote to memory of 2636 2628 nthhnh.exe jpvvp.exe PID 2628 wrote to memory of 2636 2628 nthhnh.exe jpvvp.exe PID 2628 wrote to memory of 2636 2628 nthhnh.exe jpvvp.exe PID 2636 wrote to memory of 2488 2636 jpvvp.exe pjpjd.exe PID 2636 wrote to memory of 2488 2636 jpvvp.exe pjpjd.exe PID 2636 wrote to memory of 2488 2636 jpvvp.exe pjpjd.exe PID 2636 wrote to memory of 2488 2636 jpvvp.exe pjpjd.exe PID 2488 wrote to memory of 3056 2488 pjpjd.exe rfllrrr.exe PID 2488 wrote to memory of 3056 2488 pjpjd.exe rfllrrr.exe PID 2488 wrote to memory of 3056 2488 pjpjd.exe rfllrrr.exe PID 2488 wrote to memory of 3056 2488 pjpjd.exe rfllrrr.exe PID 3056 wrote to memory of 2536 3056 rfllrrr.exe 7hnnnt.exe PID 3056 wrote to memory of 2536 3056 rfllrrr.exe 7hnnnt.exe PID 3056 wrote to memory of 2536 3056 rfllrrr.exe 7hnnnt.exe PID 3056 wrote to memory of 2536 3056 rfllrrr.exe 7hnnnt.exe PID 2536 wrote to memory of 2888 2536 7hnnnt.exe hntjjj.exe PID 2536 wrote to memory of 2888 2536 7hnnnt.exe hntjjj.exe PID 2536 wrote to memory of 2888 2536 7hnnnt.exe hntjjj.exe PID 2536 wrote to memory of 2888 2536 7hnnnt.exe hntjjj.exe PID 2888 wrote to memory of 2800 2888 hntjjj.exe 3vjjp.exe PID 2888 wrote to memory of 2800 2888 hntjjj.exe 3vjjp.exe PID 2888 wrote to memory of 2800 2888 hntjjj.exe 3vjjp.exe PID 2888 wrote to memory of 2800 2888 hntjjj.exe 3vjjp.exe PID 2800 wrote to memory of 2816 2800 3vjjp.exe rlxfffl.exe PID 2800 wrote to memory of 2816 2800 3vjjp.exe rlxfffl.exe PID 2800 wrote to memory of 2816 2800 3vjjp.exe rlxfffl.exe PID 2800 wrote to memory of 2816 2800 3vjjp.exe rlxfffl.exe PID 2816 wrote to memory of 2820 2816 rlxfffl.exe lfflxxl.exe PID 2816 wrote to memory of 2820 2816 rlxfffl.exe lfflxxl.exe PID 2816 wrote to memory of 2820 2816 rlxfffl.exe lfflxxl.exe PID 2816 wrote to memory of 2820 2816 rlxfffl.exe lfflxxl.exe PID 2820 wrote to memory of 2912 2820 lfflxxl.exe ntbttb.exe PID 2820 wrote to memory of 2912 2820 lfflxxl.exe ntbttb.exe PID 2820 wrote to memory of 2912 2820 lfflxxl.exe ntbttb.exe PID 2820 wrote to memory of 2912 2820 lfflxxl.exe ntbttb.exe PID 2912 wrote to memory of 956 2912 ntbttb.exe 1tbntt.exe PID 2912 wrote to memory of 956 2912 ntbttb.exe 1tbntt.exe PID 2912 wrote to memory of 956 2912 ntbttb.exe 1tbntt.exe PID 2912 wrote to memory of 956 2912 ntbttb.exe 1tbntt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\605ed75d864e9beff80679b360b2fa60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\605ed75d864e9beff80679b360b2fa60_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:780 -
\??\c:\nhbhtt.exec:\nhbhtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\bntttt.exec:\bntttt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\vvpvp.exec:\vvpvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\xxxrrfx.exec:\xxxrrfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\rflllff.exec:\rflllff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\nthhnh.exec:\nthhnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\jpvvp.exec:\jpvvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\pjpjd.exec:\pjpjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\rfllrrr.exec:\rfllrrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\7hnnnt.exec:\7hnnnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\hntjjj.exec:\hntjjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\3vjjp.exec:\3vjjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\rlxfffl.exec:\rlxfffl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\lfflxxl.exec:\lfflxxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\ntbttb.exec:\ntbttb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\1tbntt.exec:\1tbntt.exe17⤵
- Executes dropped EXE
PID:956 -
\??\c:\jvvdp.exec:\jvvdp.exe18⤵
- Executes dropped EXE
PID:1704 -
\??\c:\vdpjj.exec:\vdpjj.exe19⤵
- Executes dropped EXE
PID:1728 -
\??\c:\1lrlfff.exec:\1lrlfff.exe20⤵
- Executes dropped EXE
PID:2376 -
\??\c:\7frfflr.exec:\7frfflr.exe21⤵
- Executes dropped EXE
PID:1112 -
\??\c:\7bbtbh.exec:\7bbtbh.exe22⤵
- Executes dropped EXE
PID:692 -
\??\c:\btbhtb.exec:\btbhtb.exe23⤵
- Executes dropped EXE
PID:1236 -
\??\c:\vpddp.exec:\vpddp.exe24⤵
- Executes dropped EXE
PID:652 -
\??\c:\pvddj.exec:\pvddj.exe25⤵
- Executes dropped EXE
PID:2092 -
\??\c:\xrffrxf.exec:\xrffrxf.exe26⤵
- Executes dropped EXE
PID:1136 -
\??\c:\frffrlr.exec:\frffrlr.exe27⤵
- Executes dropped EXE
PID:2008 -
\??\c:\3jvdj.exec:\3jvdj.exe28⤵
- Executes dropped EXE
PID:1972 -
\??\c:\vpvpd.exec:\vpvpd.exe29⤵
- Executes dropped EXE
PID:1080 -
\??\c:\frffllx.exec:\frffllx.exe30⤵
- Executes dropped EXE
PID:2372 -
\??\c:\frfflll.exec:\frfflll.exe31⤵
- Executes dropped EXE
PID:1376 -
\??\c:\btbbhb.exec:\btbbhb.exe32⤵
- Executes dropped EXE
PID:1884 -
\??\c:\pjpvd.exec:\pjpvd.exe33⤵
- Executes dropped EXE
PID:884 -
\??\c:\jdpdj.exec:\jdpdj.exe34⤵
- Executes dropped EXE
PID:780 -
\??\c:\ffxllrl.exec:\ffxllrl.exe35⤵
- Executes dropped EXE
PID:2136 -
\??\c:\lflffff.exec:\lflffff.exe36⤵
- Executes dropped EXE
PID:1848 -
\??\c:\hthbbb.exec:\hthbbb.exe37⤵
- Executes dropped EXE
PID:1856 -
\??\c:\tnbtbt.exec:\tnbtbt.exe38⤵
- Executes dropped EXE
PID:2668 -
\??\c:\9ddvd.exec:\9ddvd.exe39⤵
- Executes dropped EXE
PID:1736 -
\??\c:\pdvjj.exec:\pdvjj.exe40⤵
- Executes dropped EXE
PID:2836 -
\??\c:\fxflllr.exec:\fxflllr.exe41⤵
- Executes dropped EXE
PID:1928 -
\??\c:\llrrxrx.exec:\llrrxrx.exe42⤵
- Executes dropped EXE
PID:2676 -
\??\c:\bnnhht.exec:\bnnhht.exe43⤵
- Executes dropped EXE
PID:2524 -
\??\c:\bthbbb.exec:\bthbbb.exe44⤵
- Executes dropped EXE
PID:2500 -
\??\c:\jdpjj.exec:\jdpjj.exe45⤵
- Executes dropped EXE
PID:2588 -
\??\c:\ddjvp.exec:\ddjvp.exe46⤵
- Executes dropped EXE
PID:2264 -
\??\c:\fxlxxxf.exec:\fxlxxxf.exe47⤵
- Executes dropped EXE
PID:2520 -
\??\c:\lrxxxrx.exec:\lrxxxrx.exe48⤵
- Executes dropped EXE
PID:1212 -
\??\c:\3hnnbh.exec:\3hnnbh.exe49⤵
- Executes dropped EXE
PID:1920 -
\??\c:\jddjv.exec:\jddjv.exe50⤵
- Executes dropped EXE
PID:2568 -
\??\c:\dpdpp.exec:\dpdpp.exe51⤵
- Executes dropped EXE
PID:1204 -
\??\c:\9rrxxxf.exec:\9rrxxxf.exe52⤵
- Executes dropped EXE
PID:1096 -
\??\c:\3frxlfl.exec:\3frxlfl.exe53⤵
- Executes dropped EXE
PID:944 -
\??\c:\7htbtb.exec:\7htbtb.exe54⤵
- Executes dropped EXE
PID:948 -
\??\c:\btbtbt.exec:\btbtbt.exe55⤵
- Executes dropped EXE
PID:1764 -
\??\c:\jjdvd.exec:\jjdvd.exe56⤵
- Executes dropped EXE
PID:1788 -
\??\c:\frffxrx.exec:\frffxrx.exe57⤵
- Executes dropped EXE
PID:1548 -
\??\c:\hbnbtt.exec:\hbnbtt.exe58⤵
- Executes dropped EXE
PID:1056 -
\??\c:\btnbnt.exec:\btnbnt.exe59⤵
- Executes dropped EXE
PID:2960 -
\??\c:\3dvvd.exec:\3dvvd.exe60⤵
- Executes dropped EXE
PID:540 -
\??\c:\dpdvd.exec:\dpdvd.exe61⤵
- Executes dropped EXE
PID:564 -
\??\c:\1xlrxxr.exec:\1xlrxxr.exe62⤵
- Executes dropped EXE
PID:1344 -
\??\c:\llfflrx.exec:\llfflrx.exe63⤵
- Executes dropped EXE
PID:1464 -
\??\c:\nnbbhh.exec:\nnbbhh.exe64⤵
- Executes dropped EXE
PID:1072 -
\??\c:\9pjdd.exec:\9pjdd.exe65⤵
- Executes dropped EXE
PID:668 -
\??\c:\ppjpd.exec:\ppjpd.exe66⤵PID:708
-
\??\c:\vjvvd.exec:\vjvvd.exe67⤵PID:1692
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe68⤵PID:1984
-
\??\c:\lllfrrr.exec:\lllfrrr.exe69⤵PID:1964
-
\??\c:\nnhnbn.exec:\nnhnbn.exe70⤵PID:2084
-
\??\c:\bbbhtn.exec:\bbbhtn.exe71⤵PID:1960
-
\??\c:\1dddd.exec:\1dddd.exe72⤵PID:2388
-
\??\c:\vjdvv.exec:\vjdvv.exe73⤵PID:2208
-
\??\c:\7xrrxlr.exec:\7xrrxlr.exe74⤵PID:3032
-
\??\c:\rfxxxxf.exec:\rfxxxxf.exe75⤵PID:1588
-
\??\c:\hbnhhh.exec:\hbnhhh.exe76⤵PID:2284
-
\??\c:\5thttn.exec:\5thttn.exe77⤵PID:1756
-
\??\c:\vdpjd.exec:\vdpjd.exe78⤵PID:2136
-
\??\c:\9djvd.exec:\9djvd.exe79⤵PID:1848
-
\??\c:\xxlxffx.exec:\xxlxffx.exe80⤵PID:1856
-
\??\c:\fxrxflr.exec:\fxrxflr.exe81⤵PID:2668
-
\??\c:\nhnhtt.exec:\nhnhtt.exe82⤵PID:2744
-
\??\c:\tbnttb.exec:\tbnttb.exe83⤵PID:2836
-
\??\c:\7nhthh.exec:\7nhthh.exe84⤵PID:2584
-
\??\c:\dvpvd.exec:\dvpvd.exe85⤵PID:2676
-
\??\c:\vjvvv.exec:\vjvvv.exe86⤵PID:2764
-
\??\c:\rfrfxff.exec:\rfrfxff.exe87⤵PID:2500
-
\??\c:\lfllffr.exec:\lfllffr.exe88⤵PID:2604
-
\??\c:\tntbbh.exec:\tntbbh.exe89⤵PID:2148
-
\??\c:\btnthn.exec:\btnthn.exe90⤵PID:2940
-
\??\c:\ppdjv.exec:\ppdjv.exe91⤵PID:2112
-
\??\c:\vpjdj.exec:\vpjdj.exe92⤵PID:2692
-
\??\c:\dvpvp.exec:\dvpvp.exe93⤵PID:2568
-
\??\c:\1xfxrll.exec:\1xfxrll.exe94⤵PID:2180
-
\??\c:\rlrrrrx.exec:\rlrrrrx.exe95⤵PID:1096
-
\??\c:\hbnbbb.exec:\hbnbbb.exe96⤵PID:472
-
\??\c:\5nhtnn.exec:\5nhtnn.exe97⤵PID:948
-
\??\c:\9jjjv.exec:\9jjjv.exe98⤵PID:3068
-
\??\c:\dvddd.exec:\dvddd.exe99⤵PID:1428
-
\??\c:\ffrrxxx.exec:\ffrrxxx.exe100⤵PID:1704
-
\??\c:\frxxlrx.exec:\frxxlrx.exe101⤵PID:1056
-
\??\c:\bntntt.exec:\bntntt.exe102⤵PID:2400
-
\??\c:\bthbhn.exec:\bthbhn.exe103⤵PID:784
-
\??\c:\1ddjv.exec:\1ddjv.exe104⤵PID:2340
-
\??\c:\9dvdj.exec:\9dvdj.exe105⤵PID:324
-
\??\c:\lfrxxfr.exec:\lfrxxfr.exe106⤵PID:3008
-
\??\c:\9fxrrlx.exec:\9fxrrlx.exe107⤵PID:1072
-
\??\c:\1tbhtb.exec:\1tbhtb.exe108⤵PID:2128
-
\??\c:\1bnbhh.exec:\1bnbhh.exe109⤵PID:708
-
\??\c:\btbnnt.exec:\btbnnt.exe110⤵PID:1692
-
\??\c:\dvdjv.exec:\dvdjv.exe111⤵PID:1984
-
\??\c:\djpjd.exec:\djpjd.exe112⤵PID:1636
-
\??\c:\lxrrrlx.exec:\lxrrrlx.exe113⤵PID:2084
-
\??\c:\9llxllr.exec:\9llxllr.exe114⤵PID:3040
-
\??\c:\3tttbt.exec:\3tttbt.exe115⤵PID:2388
-
\??\c:\hhbntb.exec:\hhbntb.exe116⤵PID:1560
-
\??\c:\vjvpd.exec:\vjvpd.exe117⤵PID:3032
-
\??\c:\dvpdj.exec:\dvpdj.exe118⤵PID:320
-
\??\c:\xxxrflr.exec:\xxxrflr.exe119⤵PID:2284
-
\??\c:\rlxfflx.exec:\rlxfflx.exe120⤵PID:2348
-
\??\c:\rlrllll.exec:\rlrllll.exe121⤵PID:2136
-
\??\c:\1nnbht.exec:\1nnbht.exe122⤵PID:2572
-
\??\c:\hhtthn.exec:\hhtthn.exe123⤵PID:1856
-
\??\c:\vvjpv.exec:\vvjpv.exe124⤵PID:2756
-
\??\c:\1jvpp.exec:\1jvpp.exe125⤵PID:2744
-
\??\c:\3fxfxfl.exec:\3fxfxfl.exe126⤵PID:2848
-
\??\c:\9llxlll.exec:\9llxlll.exe127⤵PID:2584
-
\??\c:\xxxlxfl.exec:\xxxlxfl.exe128⤵PID:2580
-
\??\c:\bnttbt.exec:\bnttbt.exe129⤵PID:2764
-
\??\c:\nhhbhn.exec:\nhhbhn.exe130⤵PID:2500
-
\??\c:\9jvpp.exec:\9jvpp.exe131⤵PID:2604
-
\??\c:\pdvvj.exec:\pdvvj.exe132⤵PID:3056
-
\??\c:\frxxxrx.exec:\frxxxrx.exe133⤵PID:2940
-
\??\c:\1xrrxfl.exec:\1xrrxfl.exe134⤵PID:1212
-
\??\c:\nnbbhh.exec:\nnbbhh.exe135⤵PID:2692
-
\??\c:\tthhhh.exec:\tthhhh.exe136⤵PID:776
-
\??\c:\vpddv.exec:\vpddv.exe137⤵PID:2180
-
\??\c:\jjjvp.exec:\jjjvp.exe138⤵PID:548
-
\??\c:\1llrxxf.exec:\1llrxxf.exe139⤵PID:472
-
\??\c:\frffllr.exec:\frffllr.exe140⤵PID:808
-
\??\c:\llfrllx.exec:\llfrllx.exe141⤵PID:3068
-
\??\c:\5ntbnt.exec:\5ntbnt.exe142⤵PID:2448
-
\??\c:\nhnbbn.exec:\nhnbbn.exe143⤵PID:2312
-
\??\c:\7ddjd.exec:\7ddjd.exe144⤵PID:2376
-
\??\c:\dvjpp.exec:\dvjpp.exe145⤵PID:2960
-
\??\c:\fllxrlf.exec:\fllxrlf.exe146⤵PID:2384
-
\??\c:\1lfrlxr.exec:\1lfrlxr.exe147⤵PID:2340
-
\??\c:\rlfllrr.exec:\rlfllrr.exe148⤵PID:1668
-
\??\c:\tbhbtn.exec:\tbhbtn.exe149⤵PID:704
-
\??\c:\bbthtb.exec:\bbthtb.exe150⤵PID:844
-
\??\c:\vdpdd.exec:\vdpdd.exe151⤵PID:848
-
\??\c:\xrlxxlf.exec:\xrlxxlf.exe152⤵PID:1168
-
\??\c:\5llrrff.exec:\5llrrff.exe153⤵PID:1972
-
\??\c:\bhhtnt.exec:\bhhtnt.exe154⤵PID:1976
-
\??\c:\thtbtt.exec:\thtbtt.exe155⤵PID:1636
-
\??\c:\5pvjd.exec:\5pvjd.exe156⤵PID:2396
-
\??\c:\jdvdd.exec:\jdvdd.exe157⤵PID:1960
-
\??\c:\5rrrflr.exec:\5rrrflr.exe158⤵PID:1768
-
\??\c:\rrlrxfr.exec:\rrlrxfr.exe159⤵PID:2208
-
\??\c:\llrxfrf.exec:\llrxfrf.exe160⤵PID:3032
-
\??\c:\ttthtb.exec:\ttthtb.exe161⤵PID:1588
-
\??\c:\nnhnhh.exec:\nnhnhh.exe162⤵PID:2548
-
\??\c:\3vppd.exec:\3vppd.exe163⤵PID:2664
-
\??\c:\djpvp.exec:\djpvp.exe164⤵PID:2612
-
\??\c:\vdvdp.exec:\vdvdp.exe165⤵PID:2620
-
\??\c:\llrffrl.exec:\llrffrl.exe166⤵PID:2752
-
\??\c:\flflffx.exec:\flflffx.exe167⤵PID:2668
-
\??\c:\btnttb.exec:\btnttb.exe168⤵PID:2744
-
\??\c:\tnbntb.exec:\tnbntb.exe169⤵PID:2848
-
\??\c:\pjdvp.exec:\pjdvp.exe170⤵PID:2600
-
\??\c:\vpddp.exec:\vpddp.exe171⤵PID:2580
-
\??\c:\xrflrfl.exec:\xrflrfl.exe172⤵PID:2468
-
\??\c:\rrlrllx.exec:\rrlrllx.exe173⤵PID:2500
-
\??\c:\llrfrxf.exec:\llrfrxf.exe174⤵PID:2512
-
\??\c:\bbbnhh.exec:\bbbnhh.exe175⤵PID:3056
-
\??\c:\tnhhtb.exec:\tnhhtb.exe176⤵PID:2648
-
\??\c:\ttnbht.exec:\ttnbht.exe177⤵PID:1212
-
\??\c:\pjpvd.exec:\pjpvd.exe178⤵PID:2808
-
\??\c:\vjdjj.exec:\vjdjj.exe179⤵PID:776
-
\??\c:\xrfxxfr.exec:\xrfxxfr.exe180⤵PID:2896
-
\??\c:\xrxfxlr.exec:\xrxfxlr.exe181⤵PID:1096
-
\??\c:\9rfrflr.exec:\9rfrflr.exe182⤵PID:2928
-
\??\c:\hbtbnn.exec:\hbtbnn.exe183⤵PID:808
-
\??\c:\bbntbb.exec:\bbntbb.exe184⤵PID:956
-
\??\c:\9hnttt.exec:\9hnttt.exe185⤵PID:2448
-
\??\c:\jjjdp.exec:\jjjdp.exe186⤵PID:2316
-
\??\c:\vpdjv.exec:\vpdjv.exe187⤵PID:2376
-
\??\c:\9rlrxfx.exec:\9rlrxfx.exe188⤵PID:2400
-
\??\c:\1rrrxlr.exec:\1rrrxlr.exe189⤵PID:2384
-
\??\c:\fxxlxfl.exec:\fxxlxfl.exe190⤵PID:920
-
\??\c:\hbbhnh.exec:\hbbhnh.exe191⤵PID:1668
-
\??\c:\7hbhtb.exec:\7hbhtb.exe192⤵PID:1144
-
\??\c:\pdpvd.exec:\pdpvd.exe193⤵PID:844
-
\??\c:\jdvjj.exec:\jdvjj.exe194⤵PID:1644
-
\??\c:\3ffllrf.exec:\3ffllrf.exe195⤵PID:2280
-
\??\c:\1rffrxf.exec:\1rffrxf.exe196⤵PID:600
-
\??\c:\bbbtnt.exec:\bbbtnt.exe197⤵PID:908
-
\??\c:\hhnhhh.exec:\hhnhhh.exe198⤵PID:1460
-
\??\c:\dvvvd.exec:\dvvvd.exe199⤵PID:2396
-
\??\c:\jjjpd.exec:\jjjpd.exe200⤵PID:3040
-
\??\c:\pjvjv.exec:\pjvjv.exe201⤵PID:1768
-
\??\c:\lfffllf.exec:\lfffllf.exe202⤵PID:1560
-
\??\c:\lfrflrr.exec:\lfrflrr.exe203⤵PID:2036
-
\??\c:\hhtthh.exec:\hhtthh.exe204⤵PID:320
-
\??\c:\hbbhhn.exec:\hbbhhn.exe205⤵PID:2548
-
\??\c:\5jpvj.exec:\5jpvj.exe206⤵PID:2844
-
\??\c:\7vpvd.exec:\7vpvd.exe207⤵PID:2572
-
\??\c:\ppdjj.exec:\ppdjj.exe208⤵PID:2624
-
\??\c:\xrlrxfr.exec:\xrlrxfr.exe209⤵PID:2752
-
\??\c:\llffxfl.exec:\llffxfl.exe210⤵PID:2756
-
\??\c:\tnbnth.exec:\tnbnth.exe211⤵PID:2464
-
\??\c:\nnhbbb.exec:\nnhbbb.exe212⤵PID:2472
-
\??\c:\9nhthn.exec:\9nhthn.exe213⤵PID:2584
-
\??\c:\vdvjp.exec:\vdvjp.exe214⤵PID:820
-
\??\c:\djjjd.exec:\djjjd.exe215⤵PID:2764
-
\??\c:\frfrrfr.exec:\frfrrfr.exe216⤵PID:2264
-
\??\c:\rrrfrrr.exec:\rrrfrrr.exe217⤵PID:2148
-
\??\c:\ttnbnn.exec:\ttnbnn.exe218⤵PID:2908
-
\??\c:\ttnnnn.exec:\ttnnnn.exe219⤵PID:2648
-
\??\c:\hbtbtb.exec:\hbtbtb.exe220⤵PID:1212
-
\??\c:\pjvdj.exec:\pjvdj.exe221⤵PID:2808
-
\??\c:\ddvjp.exec:\ddvjp.exe222⤵PID:2904
-
\??\c:\3llxllx.exec:\3llxllx.exe223⤵PID:1796
-
\??\c:\frxrflr.exec:\frxrflr.exe224⤵PID:548
-
\??\c:\9btbbt.exec:\9btbbt.exe225⤵PID:2072
-
\??\c:\hbnnbb.exec:\hbnnbb.exe226⤵PID:1788
-
\??\c:\ppdpj.exec:\ppdpj.exe227⤵PID:3068
-
\??\c:\djjjd.exec:\djjjd.exe228⤵PID:1548
-
\??\c:\5lrfrxf.exec:\5lrfrxf.exe229⤵PID:2316
-
\??\c:\7hhbnn.exec:\7hhbnn.exe230⤵PID:1228
-
\??\c:\hbnhtb.exec:\hbnhtb.exe231⤵PID:1472
-
\??\c:\dvjjj.exec:\dvjjj.exe232⤵PID:2384
-
\??\c:\vpjjp.exec:\vpjjp.exe233⤵PID:2092
-
\??\c:\3lxxflr.exec:\3lxxflr.exe234⤵PID:1668
-
\??\c:\lfrrllx.exec:\lfrrllx.exe235⤵PID:1052
-
\??\c:\rrrlrfx.exec:\rrrlrfx.exe236⤵PID:844
-
\??\c:\hbnttb.exec:\hbnttb.exe237⤵PID:2008
-
\??\c:\7tntbb.exec:\7tntbb.exe238⤵PID:2280
-
\??\c:\5dvvd.exec:\5dvvd.exe239⤵PID:600
-
\??\c:\9ddjv.exec:\9ddjv.exe240⤵PID:908
-
\??\c:\5jjpd.exec:\5jjpd.exe241⤵PID:2328
-
\??\c:\5flflxf.exec:\5flflxf.exe242⤵PID:2396