Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 06:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8b97f12daa4ad04b4d163f33f394e940_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
8b97f12daa4ad04b4d163f33f394e940_NeikiAnalytics.exe
-
Size
277KB
-
MD5
8b97f12daa4ad04b4d163f33f394e940
-
SHA1
ed4b257919f5016a178dfa0064b3f6de44550a97
-
SHA256
955fe9f6c0f20fb3b48fe874416cdac75b2558ff52615edaf57bc9dae4707071
-
SHA512
07fd9074161a1e25bf10cdc4a585e9331955e71e5ca094d821177242ae5aa3f77db8deb685cb39b107c96f313fe24cd480663a8f4c665d8c33d89850367ff1e6
-
SSDEEP
6144:n3C9BRIG0asYFm71m8+GdkB9yMu7VvemA:n3C9uYA71kSMuW
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral1/memory/848-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1068-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2396-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/628-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1628-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2224-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1404-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2376-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1912-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/320-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1700-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1604-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1752-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lfrxlrl.exexxrxlxl.exe3btbnh.exe3pdpp.exellfxfxl.exebtnnbh.exe1ppdv.exe5xxxflx.exedvpdp.exefxrxffr.exennhnbn.exepddjd.exelrlxlxl.exepdjvp.exexfflllf.exetbhhbt.exejdppj.exexlfllff.exettnntb.exe9ppjp.exelxfffxf.exe9pdpd.exe1xlrxfr.exe3thtbn.exeddvpv.exexlflxlx.exe9vdpd.exeffxlxfr.exetnhbnn.exepppvj.exexxlrfrx.exebbtbhn.exe3jvdp.exellxflrl.exexrrxlrf.exenhhbnt.exe3ppvp.exexrlrlfr.exellxxlrf.exe5hbntb.exevpdjv.exevvjvd.exelfxxflr.exerlrxfrx.exenhbhtt.exepppjj.exeddjdd.exexrflxlx.exe9xxfrxl.exe7nnbtn.exepdddv.exedjpjv.exerffrfrf.exe3hhnbb.exe5tnbht.exe1jvjd.exerrrfrxr.exerllfflx.exetnhnbh.exevvvvd.exe1vjvj.exe9lxxrrf.exexxllxfr.exethttbb.exepid process 1716 lfrxlrl.exe 2712 xxrxlxl.exe 2440 3btbnh.exe 2732 3pdpp.exe 3028 llfxfxl.exe 2820 btnnbh.exe 2468 1ppdv.exe 2572 5xxxflx.exe 1068 dvpdp.exe 2396 fxrxffr.exe 628 nnhnbn.exe 2600 pddjd.exe 2428 lrlxlxl.exe 1628 pdjvp.exe 2224 xfflllf.exe 2036 tbhhbt.exe 1920 jdppj.exe 1404 xlfllff.exe 2376 ttnntb.exe 1912 9ppjp.exe 2872 lxfffxf.exe 320 9pdpd.exe 1036 1xlrxfr.exe 1700 3thtbn.exe 1804 ddvpv.exe 1604 xlflxlx.exe 352 9vdpd.exe 1944 ffxlxfr.exe 2892 tnhbnn.exe 1048 pppvj.exe 1752 xxlrfrx.exe 1736 bbtbhn.exe 2068 3jvdp.exe 1696 llxflrl.exe 2248 xrrxlrf.exe 3052 nhhbnt.exe 2648 3ppvp.exe 2604 xrlrlfr.exe 2632 llxxlrf.exe 2752 5hbntb.exe 2528 vpdjv.exe 2748 vvjvd.exe 2512 lfxxflr.exe 2976 rlrxfrx.exe 2572 nhbhtt.exe 2936 pppjj.exe 1512 ddjdd.exe 2568 xrflxlx.exe 2796 9xxfrxl.exe 1608 7nnbtn.exe 2428 pdddv.exe 2416 djpjv.exe 2176 rffrfrf.exe 1924 3hhnbb.exe 2916 5tnbht.exe 2412 1jvjd.exe 2252 rrrfrxr.exe 2904 rllfflx.exe 2292 tnhnbh.exe 2812 vvvvd.exe 2872 1vjvj.exe 652 9lxxrrf.exe 1852 xxllxfr.exe 636 thttbb.exe -
Processes:
resource yara_rule behavioral1/memory/848-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1068-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/628-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2224-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1404-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1912-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/320-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1700-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1604-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-298-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8b97f12daa4ad04b4d163f33f394e940_NeikiAnalytics.exelfrxlrl.exexxrxlxl.exe3btbnh.exe3pdpp.exellfxfxl.exebtnnbh.exe1ppdv.exe5xxxflx.exedvpdp.exefxrxffr.exennhnbn.exepddjd.exelrlxlxl.exepdjvp.exexfflllf.exedescription pid process target process PID 848 wrote to memory of 1716 848 8b97f12daa4ad04b4d163f33f394e940_NeikiAnalytics.exe lfrxlrl.exe PID 848 wrote to memory of 1716 848 8b97f12daa4ad04b4d163f33f394e940_NeikiAnalytics.exe lfrxlrl.exe PID 848 wrote to memory of 1716 848 8b97f12daa4ad04b4d163f33f394e940_NeikiAnalytics.exe lfrxlrl.exe PID 848 wrote to memory of 1716 848 8b97f12daa4ad04b4d163f33f394e940_NeikiAnalytics.exe lfrxlrl.exe PID 1716 wrote to memory of 2712 1716 lfrxlrl.exe xxrxlxl.exe PID 1716 wrote to memory of 2712 1716 lfrxlrl.exe xxrxlxl.exe PID 1716 wrote to memory of 2712 1716 lfrxlrl.exe xxrxlxl.exe PID 1716 wrote to memory of 2712 1716 lfrxlrl.exe xxrxlxl.exe PID 2712 wrote to memory of 2440 2712 xxrxlxl.exe 3btbnh.exe PID 2712 wrote to memory of 2440 2712 xxrxlxl.exe 3btbnh.exe PID 2712 wrote to memory of 2440 2712 xxrxlxl.exe 3btbnh.exe PID 2712 wrote to memory of 2440 2712 xxrxlxl.exe 3btbnh.exe PID 2440 wrote to memory of 2732 2440 3btbnh.exe 3pdpp.exe PID 2440 wrote to memory of 2732 2440 3btbnh.exe 3pdpp.exe PID 2440 wrote to memory of 2732 2440 3btbnh.exe 3pdpp.exe PID 2440 wrote to memory of 2732 2440 3btbnh.exe 3pdpp.exe PID 2732 wrote to memory of 3028 2732 3pdpp.exe llfxfxl.exe PID 2732 wrote to memory of 3028 2732 3pdpp.exe llfxfxl.exe PID 2732 wrote to memory of 3028 2732 3pdpp.exe llfxfxl.exe PID 2732 wrote to memory of 3028 2732 3pdpp.exe llfxfxl.exe PID 3028 wrote to memory of 2820 3028 llfxfxl.exe btnnbh.exe PID 3028 wrote to memory of 2820 3028 llfxfxl.exe btnnbh.exe PID 3028 wrote to memory of 2820 3028 llfxfxl.exe btnnbh.exe PID 3028 wrote to memory of 2820 3028 llfxfxl.exe btnnbh.exe PID 2820 wrote to memory of 2468 2820 btnnbh.exe 1ppdv.exe PID 2820 wrote to memory of 2468 2820 btnnbh.exe 1ppdv.exe PID 2820 wrote to memory of 2468 2820 btnnbh.exe 1ppdv.exe PID 2820 wrote to memory of 2468 2820 btnnbh.exe 1ppdv.exe PID 2468 wrote to memory of 2572 2468 1ppdv.exe 5xxxflx.exe PID 2468 wrote to memory of 2572 2468 1ppdv.exe 5xxxflx.exe PID 2468 wrote to memory of 2572 2468 1ppdv.exe 5xxxflx.exe PID 2468 wrote to memory of 2572 2468 1ppdv.exe 5xxxflx.exe PID 2572 wrote to memory of 1068 2572 5xxxflx.exe dvpdp.exe PID 2572 wrote to memory of 1068 2572 5xxxflx.exe dvpdp.exe PID 2572 wrote to memory of 1068 2572 5xxxflx.exe dvpdp.exe PID 2572 wrote to memory of 1068 2572 5xxxflx.exe dvpdp.exe PID 1068 wrote to memory of 2396 1068 dvpdp.exe fxrxffr.exe PID 1068 wrote to memory of 2396 1068 dvpdp.exe fxrxffr.exe PID 1068 wrote to memory of 2396 1068 dvpdp.exe fxrxffr.exe PID 1068 wrote to memory of 2396 1068 dvpdp.exe fxrxffr.exe PID 2396 wrote to memory of 628 2396 fxrxffr.exe nnhnbn.exe PID 2396 wrote to memory of 628 2396 fxrxffr.exe nnhnbn.exe PID 2396 wrote to memory of 628 2396 fxrxffr.exe nnhnbn.exe PID 2396 wrote to memory of 628 2396 fxrxffr.exe nnhnbn.exe PID 628 wrote to memory of 2600 628 nnhnbn.exe pddjd.exe PID 628 wrote to memory of 2600 628 nnhnbn.exe pddjd.exe PID 628 wrote to memory of 2600 628 nnhnbn.exe pddjd.exe PID 628 wrote to memory of 2600 628 nnhnbn.exe pddjd.exe PID 2600 wrote to memory of 2428 2600 pddjd.exe lrlxlxl.exe PID 2600 wrote to memory of 2428 2600 pddjd.exe lrlxlxl.exe PID 2600 wrote to memory of 2428 2600 pddjd.exe lrlxlxl.exe PID 2600 wrote to memory of 2428 2600 pddjd.exe lrlxlxl.exe PID 2428 wrote to memory of 1628 2428 lrlxlxl.exe pdjvp.exe PID 2428 wrote to memory of 1628 2428 lrlxlxl.exe pdjvp.exe PID 2428 wrote to memory of 1628 2428 lrlxlxl.exe pdjvp.exe PID 2428 wrote to memory of 1628 2428 lrlxlxl.exe pdjvp.exe PID 1628 wrote to memory of 2224 1628 pdjvp.exe xfflllf.exe PID 1628 wrote to memory of 2224 1628 pdjvp.exe xfflllf.exe PID 1628 wrote to memory of 2224 1628 pdjvp.exe xfflllf.exe PID 1628 wrote to memory of 2224 1628 pdjvp.exe xfflllf.exe PID 2224 wrote to memory of 2036 2224 xfflllf.exe tbhhbt.exe PID 2224 wrote to memory of 2036 2224 xfflllf.exe tbhhbt.exe PID 2224 wrote to memory of 2036 2224 xfflllf.exe tbhhbt.exe PID 2224 wrote to memory of 2036 2224 xfflllf.exe tbhhbt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b97f12daa4ad04b4d163f33f394e940_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8b97f12daa4ad04b4d163f33f394e940_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\lfrxlrl.exec:\lfrxlrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\xxrxlxl.exec:\xxrxlxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\3btbnh.exec:\3btbnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\3pdpp.exec:\3pdpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\llfxfxl.exec:\llfxfxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\btnnbh.exec:\btnnbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\1ppdv.exec:\1ppdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\5xxxflx.exec:\5xxxflx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\dvpdp.exec:\dvpdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\fxrxffr.exec:\fxrxffr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\nnhnbn.exec:\nnhnbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\pddjd.exec:\pddjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\lrlxlxl.exec:\lrlxlxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\pdjvp.exec:\pdjvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\xfflllf.exec:\xfflllf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\tbhhbt.exec:\tbhhbt.exe17⤵
- Executes dropped EXE
PID:2036 -
\??\c:\jdppj.exec:\jdppj.exe18⤵
- Executes dropped EXE
PID:1920 -
\??\c:\xlfllff.exec:\xlfllff.exe19⤵
- Executes dropped EXE
PID:1404 -
\??\c:\ttnntb.exec:\ttnntb.exe20⤵
- Executes dropped EXE
PID:2376 -
\??\c:\9ppjp.exec:\9ppjp.exe21⤵
- Executes dropped EXE
PID:1912 -
\??\c:\lxfffxf.exec:\lxfffxf.exe22⤵
- Executes dropped EXE
PID:2872 -
\??\c:\9pdpd.exec:\9pdpd.exe23⤵
- Executes dropped EXE
PID:320 -
\??\c:\1xlrxfr.exec:\1xlrxfr.exe24⤵
- Executes dropped EXE
PID:1036 -
\??\c:\3thtbn.exec:\3thtbn.exe25⤵
- Executes dropped EXE
PID:1700 -
\??\c:\ddvpv.exec:\ddvpv.exe26⤵
- Executes dropped EXE
PID:1804 -
\??\c:\xlflxlx.exec:\xlflxlx.exe27⤵
- Executes dropped EXE
PID:1604 -
\??\c:\9vdpd.exec:\9vdpd.exe28⤵
- Executes dropped EXE
PID:352 -
\??\c:\ffxlxfr.exec:\ffxlxfr.exe29⤵
- Executes dropped EXE
PID:1944 -
\??\c:\tnhbnn.exec:\tnhbnn.exe30⤵
- Executes dropped EXE
PID:2892 -
\??\c:\pppvj.exec:\pppvj.exe31⤵
- Executes dropped EXE
PID:1048 -
\??\c:\xxlrfrx.exec:\xxlrfrx.exe32⤵
- Executes dropped EXE
PID:1752 -
\??\c:\bbtbhn.exec:\bbtbhn.exe33⤵
- Executes dropped EXE
PID:1736 -
\??\c:\3jvdp.exec:\3jvdp.exe34⤵
- Executes dropped EXE
PID:2068 -
\??\c:\llxflrl.exec:\llxflrl.exe35⤵
- Executes dropped EXE
PID:1696 -
\??\c:\xrrxlrf.exec:\xrrxlrf.exe36⤵
- Executes dropped EXE
PID:2248 -
\??\c:\nhhbnt.exec:\nhhbnt.exe37⤵
- Executes dropped EXE
PID:3052 -
\??\c:\3ppvp.exec:\3ppvp.exe38⤵
- Executes dropped EXE
PID:2648 -
\??\c:\xrlrlfr.exec:\xrlrlfr.exe39⤵
- Executes dropped EXE
PID:2604 -
\??\c:\llxxlrf.exec:\llxxlrf.exe40⤵
- Executes dropped EXE
PID:2632 -
\??\c:\5hbntb.exec:\5hbntb.exe41⤵
- Executes dropped EXE
PID:2752 -
\??\c:\vpdjv.exec:\vpdjv.exe42⤵
- Executes dropped EXE
PID:2528 -
\??\c:\vvjvd.exec:\vvjvd.exe43⤵
- Executes dropped EXE
PID:2748 -
\??\c:\lfxxflr.exec:\lfxxflr.exe44⤵
- Executes dropped EXE
PID:2512 -
\??\c:\rlrxfrx.exec:\rlrxfrx.exe45⤵
- Executes dropped EXE
PID:2976 -
\??\c:\nhbhtt.exec:\nhbhtt.exe46⤵
- Executes dropped EXE
PID:2572 -
\??\c:\pppjj.exec:\pppjj.exe47⤵
- Executes dropped EXE
PID:2936 -
\??\c:\ddjdd.exec:\ddjdd.exe48⤵
- Executes dropped EXE
PID:1512 -
\??\c:\xrflxlx.exec:\xrflxlx.exe49⤵
- Executes dropped EXE
PID:2568 -
\??\c:\9xxfrxl.exec:\9xxfrxl.exe50⤵
- Executes dropped EXE
PID:2796 -
\??\c:\7nnbtn.exec:\7nnbtn.exe51⤵
- Executes dropped EXE
PID:1608 -
\??\c:\pdddv.exec:\pdddv.exe52⤵
- Executes dropped EXE
PID:2428 -
\??\c:\djpjv.exec:\djpjv.exe53⤵
- Executes dropped EXE
PID:2416 -
\??\c:\rffrfrf.exec:\rffrfrf.exe54⤵
- Executes dropped EXE
PID:2176 -
\??\c:\3hhnbb.exec:\3hhnbb.exe55⤵
- Executes dropped EXE
PID:1924 -
\??\c:\5tnbht.exec:\5tnbht.exe56⤵
- Executes dropped EXE
PID:2916 -
\??\c:\1jvjd.exec:\1jvjd.exe57⤵
- Executes dropped EXE
PID:2412 -
\??\c:\rrrfrxr.exec:\rrrfrxr.exe58⤵
- Executes dropped EXE
PID:2252 -
\??\c:\rllfflx.exec:\rllfflx.exe59⤵
- Executes dropped EXE
PID:2904 -
\??\c:\tnhnbh.exec:\tnhnbh.exe60⤵
- Executes dropped EXE
PID:2292 -
\??\c:\vvvvd.exec:\vvvvd.exe61⤵
- Executes dropped EXE
PID:2812 -
\??\c:\1vjvj.exec:\1vjvj.exe62⤵
- Executes dropped EXE
PID:2872 -
\??\c:\9lxxrrf.exec:\9lxxrrf.exe63⤵
- Executes dropped EXE
PID:652 -
\??\c:\xxllxfr.exec:\xxllxfr.exe64⤵
- Executes dropped EXE
PID:1852 -
\??\c:\thttbb.exec:\thttbb.exe65⤵
- Executes dropped EXE
PID:636 -
\??\c:\7hbntb.exec:\7hbntb.exe66⤵PID:1500
-
\??\c:\1dppv.exec:\1dppv.exe67⤵PID:1864
-
\??\c:\ffxlxlf.exec:\ffxlxlf.exe68⤵PID:1320
-
\??\c:\fxxfxfr.exec:\fxxfxfr.exe69⤵PID:2360
-
\??\c:\hhbhth.exec:\hhbhth.exe70⤵PID:1960
-
\??\c:\3bthbh.exec:\3bthbh.exe71⤵PID:396
-
\??\c:\1jvdp.exec:\1jvdp.exe72⤵PID:2980
-
\??\c:\fxrxxff.exec:\fxrxxff.exe73⤵PID:2840
-
\??\c:\xxxfrxf.exec:\xxxfrxf.exe74⤵PID:3012
-
\??\c:\bbhnhn.exec:\bbhnhn.exe75⤵PID:2084
-
\??\c:\9bttnn.exec:\9bttnn.exe76⤵PID:2240
-
\??\c:\ddvjv.exec:\ddvjv.exe77⤵PID:1780
-
\??\c:\1llrflx.exec:\1llrflx.exe78⤵PID:2592
-
\??\c:\3xfxrrl.exec:\3xfxrrl.exe79⤵PID:2776
-
\??\c:\hbntbh.exec:\hbntbh.exe80⤵PID:2728
-
\??\c:\ddpdp.exec:\ddpdp.exe81⤵PID:2624
-
\??\c:\xrlrlrx.exec:\xrlrlrx.exe82⤵PID:2616
-
\??\c:\ffrfrlx.exec:\ffrfrlx.exe83⤵PID:2800
-
\??\c:\nhnntt.exec:\nhnntt.exe84⤵PID:2664
-
\??\c:\jdvdp.exec:\jdvdp.exe85⤵PID:2588
-
\??\c:\1pvpd.exec:\1pvpd.exe86⤵PID:2544
-
\??\c:\ttbbbb.exec:\ttbbbb.exe87⤵PID:1128
-
\??\c:\pjjjj.exec:\pjjjj.exe88⤵PID:1012
-
\??\c:\dvpvd.exec:\dvpvd.exe89⤵PID:1516
-
\??\c:\fxllxxl.exec:\fxllxxl.exe90⤵PID:2396
-
\??\c:\5tnntt.exec:\5tnntt.exe91⤵PID:2024
-
\??\c:\7ntntn.exec:\7ntntn.exe92⤵PID:1740
-
\??\c:\jdppd.exec:\jdppd.exe93⤵PID:1820
-
\??\c:\lfxfllx.exec:\lfxfllx.exe94⤵PID:1844
-
\??\c:\ffrflrx.exec:\ffrflrx.exe95⤵PID:1632
-
\??\c:\bbttbh.exec:\bbttbh.exe96⤵PID:2224
-
\??\c:\nbtbht.exec:\nbtbht.exe97⤵PID:2816
-
\??\c:\1dvdp.exec:\1dvdp.exe98⤵PID:1312
-
\??\c:\7jdjd.exec:\7jdjd.exe99⤵PID:1308
-
\??\c:\xrlxflr.exec:\xrlxflr.exe100⤵PID:836
-
\??\c:\3tntbh.exec:\3tntbh.exe101⤵PID:2276
-
\??\c:\bthtbb.exec:\bthtbb.exe102⤵PID:2860
-
\??\c:\pdpvp.exec:\pdpvp.exe103⤵PID:2308
-
\??\c:\xrlrflf.exec:\xrlrflf.exe104⤵PID:572
-
\??\c:\lllrffx.exec:\lllrffx.exe105⤵PID:664
-
\??\c:\hbhbbh.exec:\hbhbbh.exe106⤵PID:652
-
\??\c:\pjvjv.exec:\pjvjv.exe107⤵PID:1700
-
\??\c:\vpdpj.exec:\vpdpj.exe108⤵PID:948
-
\??\c:\1lfrrxl.exec:\1lfrrxl.exe109⤵PID:760
-
\??\c:\9ttntt.exec:\9ttntt.exe110⤵PID:2884
-
\??\c:\tntthn.exec:\tntthn.exe111⤵PID:780
-
\??\c:\pjppp.exec:\pjppp.exe112⤵PID:1944
-
\??\c:\dvvdd.exec:\dvvdd.exe113⤵PID:2580
-
\??\c:\lfxxrfr.exec:\lfxxrfr.exe114⤵PID:1984
-
\??\c:\3xlrxfr.exec:\3xlrxfr.exe115⤵PID:1028
-
\??\c:\hbtbtb.exec:\hbtbtb.exe116⤵PID:2096
-
\??\c:\vpjpj.exec:\vpjpj.exe117⤵PID:3012
-
\??\c:\vppdj.exec:\vppdj.exe118⤵PID:2232
-
\??\c:\lfrlrfl.exec:\lfrlrfl.exe119⤵PID:1592
-
\??\c:\1rfxxxf.exec:\1rfxxxf.exe120⤵PID:2608
-
\??\c:\hhnnnb.exec:\hhnnnb.exe121⤵PID:2704
-
\??\c:\vvjpd.exec:\vvjpd.exe122⤵PID:2648
-
\??\c:\xlxrfxf.exec:\xlxrfxf.exe123⤵PID:2764
-
\??\c:\frffxxf.exec:\frffxxf.exe124⤵PID:2844
-
\??\c:\3bthnn.exec:\3bthnn.exe125⤵PID:1724
-
\??\c:\hhbnbt.exec:\hhbnbt.exe126⤵PID:2500
-
\??\c:\7pdjv.exec:\7pdjv.exe127⤵PID:2556
-
\??\c:\xxrrffr.exec:\xxrrffr.exe128⤵PID:2932
-
\??\c:\rrrrfxl.exec:\rrrrfxl.exe129⤵PID:2940
-
\??\c:\btnthb.exec:\btnthb.exe130⤵PID:1300
-
\??\c:\hbnnbh.exec:\hbnnbh.exe131⤵PID:1448
-
\??\c:\1pddj.exec:\1pddj.exe132⤵PID:2788
-
\??\c:\dvddj.exec:\dvddj.exe133⤵PID:1600
-
\??\c:\lfxfrxl.exec:\lfxfrxl.exe134⤵PID:2680
-
\??\c:\nhbntb.exec:\nhbntb.exe135⤵PID:1740
-
\??\c:\5htnhh.exec:\5htnhh.exe136⤵PID:1420
-
\??\c:\vpdjj.exec:\vpdjj.exe137⤵PID:2424
-
\??\c:\dvpdj.exec:\dvpdj.exe138⤵PID:1636
-
\??\c:\frxxrff.exec:\frxxrff.exe139⤵PID:1284
-
\??\c:\5llllrf.exec:\5llllrf.exe140⤵PID:2816
-
\??\c:\hbbnhh.exec:\hbbnhh.exe141⤵PID:2332
-
\??\c:\5pjvj.exec:\5pjvj.exe142⤵PID:2596
-
\??\c:\pjdpj.exec:\pjdpj.exe143⤵PID:2268
-
\??\c:\lxffxxf.exec:\lxffxxf.exe144⤵PID:2272
-
\??\c:\tntthh.exec:\tntthh.exe145⤵PID:672
-
\??\c:\pppdp.exec:\pppdp.exe146⤵PID:776
-
\??\c:\hbnbhh.exec:\hbnbhh.exe147⤵PID:1108
-
\??\c:\pvpdv.exec:\pvpdv.exe148⤵PID:2456
-
\??\c:\rfrfrlx.exec:\rfrfrlx.exe149⤵PID:2688
-
\??\c:\lxfllrx.exec:\lxfllrx.exe150⤵PID:1500
-
\??\c:\vpvpj.exec:\vpvpj.exe151⤵PID:1604
-
\??\c:\fxlfffl.exec:\fxlfffl.exe152⤵PID:756
-
\??\c:\rlffxxl.exec:\rlffxxl.exe153⤵PID:2360
-
\??\c:\tbbnnh.exec:\tbbnnh.exe154⤵PID:2020
-
\??\c:\pjjjv.exec:\pjjjv.exe155⤵PID:1732
-
\??\c:\3djjp.exec:\3djjp.exe156⤵PID:1756
-
\??\c:\rlrlfxf.exec:\rlrlfxf.exe157⤵PID:2840
-
\??\c:\lfllrlx.exec:\lfllrlx.exe158⤵PID:848
-
\??\c:\nbhbhh.exec:\nbhbhh.exe159⤵PID:2472
-
\??\c:\pdjjv.exec:\pdjjv.exe160⤵PID:2948
-
\??\c:\jpvvp.exec:\jpvvp.exe161⤵PID:1780
-
\??\c:\7rlxlxr.exec:\7rlxlxr.exe162⤵PID:2592
-
\??\c:\hbntbn.exec:\hbntbn.exe163⤵PID:2712
-
\??\c:\tnhhnh.exec:\tnhhnh.exe164⤵PID:2728
-
\??\c:\vpjvd.exec:\vpjvd.exe165⤵PID:2848
-
\??\c:\jdvjp.exec:\jdvjp.exe166⤵PID:2616
-
\??\c:\7xxlxfl.exec:\7xxlxfl.exe167⤵PID:2716
-
\??\c:\xllllll.exec:\xllllll.exe168⤵PID:2548
-
\??\c:\nhtbht.exec:\nhtbht.exe169⤵PID:2516
-
\??\c:\nhntbt.exec:\nhntbt.exe170⤵PID:2544
-
\??\c:\dvdpd.exec:\dvdpd.exe171⤵PID:2316
-
\??\c:\lfxxlxl.exec:\lfxxlxl.exe172⤵PID:1012
-
\??\c:\xlffllx.exec:\xlffllx.exe173⤵PID:2172
-
\??\c:\bbtbtb.exec:\bbtbtb.exe174⤵PID:628
-
\??\c:\3bbhbn.exec:\3bbhbn.exe175⤵PID:1620
-
\??\c:\pjvvp.exec:\pjvvp.exe176⤵PID:1296
-
\??\c:\lflrxxf.exec:\lflrxxf.exe177⤵PID:1820
-
\??\c:\lxfxxlf.exec:\lxfxxlf.exe178⤵PID:2436
-
\??\c:\tntnbt.exec:\tntnbt.exe179⤵PID:1632
-
\??\c:\dpjpv.exec:\dpjpv.exe180⤵PID:1280
-
\??\c:\jdjdd.exec:\jdjdd.exe181⤵PID:2036
-
\??\c:\lfrlllr.exec:\lfrlllr.exe182⤵PID:2412
-
\??\c:\xrrrxrx.exec:\xrrrxrx.exe183⤵PID:1308
-
\??\c:\htnnbb.exec:\htnnbb.exe184⤵PID:2104
-
\??\c:\hnhhbh.exec:\hnhhbh.exe185⤵PID:2276
-
\??\c:\3pjpv.exec:\3pjpv.exe186⤵PID:2864
-
\??\c:\vpvvd.exec:\vpvvd.exe187⤵PID:1260
-
\??\c:\rfxxxfl.exec:\rfxxxfl.exe188⤵PID:2188
-
\??\c:\btttbh.exec:\btttbh.exe189⤵PID:1092
-
\??\c:\bbbnnt.exec:\bbbnnt.exe190⤵PID:2808
-
\??\c:\jdvvd.exec:\jdvvd.exe191⤵PID:1532
-
\??\c:\pppvp.exec:\pppvp.exe192⤵PID:1700
-
\??\c:\lflfllx.exec:\lflfllx.exe193⤵PID:948
-
\??\c:\xrfflll.exec:\xrfflll.exe194⤵PID:352
-
\??\c:\9bbbhh.exec:\9bbbhh.exe195⤵PID:608
-
\??\c:\3dppp.exec:\3dppp.exe196⤵PID:1960
-
\??\c:\fxlrrlx.exec:\fxlrrlx.exe197⤵PID:1268
-
\??\c:\xxrffrf.exec:\xxrffrf.exe198⤵PID:872
-
\??\c:\7thhnt.exec:\7thhnt.exe199⤵PID:2076
-
\??\c:\dvjpv.exec:\dvjpv.exe200⤵PID:1788
-
\??\c:\dvpdj.exec:\dvpdj.exe201⤵PID:1584
-
\??\c:\xffxflf.exec:\xffxflf.exe202⤵PID:1808
-
\??\c:\hthtbb.exec:\hthtbb.exe203⤵PID:3000
-
\??\c:\pjdjd.exec:\pjdjd.exe204⤵PID:2640
-
\??\c:\5djjp.exec:\5djjp.exe205⤵PID:2684
-
\??\c:\llllrxr.exec:\llllrxr.exe206⤵PID:2652
-
\??\c:\lrxrrll.exec:\lrxrrll.exe207⤵PID:2288
-
\??\c:\hbhhtb.exec:\hbhhtb.exe208⤵PID:2660
-
\??\c:\btnttt.exec:\btnttt.exe209⤵PID:2636
-
\??\c:\vpjjv.exec:\vpjjv.exe210⤵PID:2520
-
\??\c:\lxlrxxx.exec:\lxlrxxx.exe211⤵PID:1728
-
\??\c:\lfxxllx.exec:\lfxxllx.exe212⤵PID:2552
-
\??\c:\9tntnt.exec:\9tntnt.exe213⤵PID:2976
-
\??\c:\bbtttt.exec:\bbtttt.exe214⤵PID:1580
-
\??\c:\jjvjv.exec:\jjvjv.exe215⤵PID:2488
-
\??\c:\pdvdp.exec:\pdvdp.exe216⤵PID:2396
-
\??\c:\xrxlllx.exec:\xrxlllx.exe217⤵PID:1672
-
\??\c:\thbntt.exec:\thbntt.exe218⤵PID:1008
-
\??\c:\htbthh.exec:\htbthh.exe219⤵PID:1692
-
\??\c:\jpdjv.exec:\jpdjv.exe220⤵PID:1844
-
\??\c:\fxrxflr.exec:\fxrxflr.exe221⤵PID:2432
-
\??\c:\1xfllrx.exec:\1xfllrx.exe222⤵PID:2224
-
\??\c:\nhnhnn.exec:\nhnhnn.exe223⤵PID:1256
-
\??\c:\hnnhbn.exec:\hnnhbn.exe224⤵PID:1228
-
\??\c:\ppdpp.exec:\ppdpp.exe225⤵PID:2344
-
\??\c:\xrflrrl.exec:\xrflrrl.exe226⤵PID:2596
-
\??\c:\flfxflx.exec:\flfxflx.exe227⤵PID:2868
-
\??\c:\5htbtb.exec:\5htbtb.exe228⤵PID:2272
-
\??\c:\vvvvp.exec:\vvvvp.exe229⤵PID:2292
-
\??\c:\jdvdp.exec:\jdvdp.exe230⤵PID:2228
-
\??\c:\fxlxxlx.exec:\fxlxxlx.exe231⤵PID:1980
-
\??\c:\nthnhn.exec:\nthnhn.exe232⤵PID:688
-
\??\c:\ttnhhh.exec:\ttnhhh.exe233⤵PID:1856
-
\??\c:\dpvvd.exec:\dpvvd.exe234⤵PID:636
-
\??\c:\vpppv.exec:\vpppv.exe235⤵PID:1688
-
\??\c:\xrlxllx.exec:\xrlxllx.exe236⤵PID:1864
-
\??\c:\nbntbb.exec:\nbntbb.exe237⤵PID:1320
-
\??\c:\1htbhh.exec:\1htbhh.exe238⤵PID:560
-
\??\c:\1vjdp.exec:\1vjdp.exe239⤵PID:2020
-
\??\c:\pjjdj.exec:\pjjdj.exe240⤵PID:396
-
\??\c:\xxrxlrx.exec:\xxrxlrx.exe241⤵PID:2980
-
\??\c:\hbttbh.exec:\hbttbh.exe242⤵PID:1048