Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 03:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a68e71b20f2fd2a0d7bc9640836d53e0_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
a68e71b20f2fd2a0d7bc9640836d53e0_NeikiAnalytics.exe
-
Size
78KB
-
MD5
a68e71b20f2fd2a0d7bc9640836d53e0
-
SHA1
f70fca93b089b0501d3734827f73719ba890e4d7
-
SHA256
c23ebfec6170552dec707cb1ea250fbbe97b7bbe79dada655efee925d409aeff
-
SHA512
602e91bf031303e4927435850544150af7fc039bc43fe856a549ef5ba18026e74a4afbc952a8ba9559b9a8bb7bdcaa726bd70a62dd33bba8814af8c5eb2403a6
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2wVEJjOBof:ymb3NkkiQ3mdBjF+3TU2KEJjEE
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral1/memory/2460-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2460-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1440-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-62-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2528-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2180-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/792-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1732-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2276-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2244-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/984-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2252-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/836-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/608-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xlxfrxf.exeppdpd.exerlxxlrx.exetttttn.exedvddd.exedvpvj.exerlxrxfr.exepvjdp.exevjdpp.exehtttht.exebbnthn.exe3lxrrxx.exebhbhnn.exevdvdv.exe3jjpd.exerrlxxfl.exebthhtb.exeppppd.exe7pjpd.exe7lrlxff.exehhbnbn.exejdpjv.exejvpjp.exelffxrfx.exebntnht.exepjdjj.exelxlfflf.exe9hbtnn.exepvjdd.exelrlffxf.exebhbhtb.exe1tnthh.exedjvjv.exexxxlxrf.exefxxlrff.exebbtbnt.exebhttnt.exe7jjvp.exe5rflrfl.exe3rlrrrf.exettnthn.exehbnnbh.exejjdvp.exepvvpj.exe5ffrxfr.exerlfxxfx.exe3tnnbh.exe9vvjv.exejjpdd.exefxflxlx.exexflrrll.exentnnht.exennnbht.exe3jdjv.exedddvp.exerrrrxfr.exenhtthn.exebbnbth.exepdvvv.exejdjjv.exelfrxflx.exeffxflrf.exebthbnt.exejppdj.exepid process 1440 xlxfrxf.exe 2900 ppdpd.exe 2632 rlxxlrx.exe 2656 tttttn.exe 2760 dvddd.exe 2528 dvpvj.exe 2816 rlxrxfr.exe 2568 pvjdp.exe 2364 vjdpp.exe 2744 htttht.exe 2848 bbnthn.exe 2896 3lxrrxx.exe 2180 bhbhnn.exe 792 vdvdv.exe 1760 3jjpd.exe 2412 rrlxxfl.exe 2432 bthhtb.exe 1448 ppppd.exe 1732 7pjpd.exe 2044 7lrlxff.exe 2276 hhbnbn.exe 2244 jdpjv.exe 984 jvpjp.exe 1488 lffxrfx.exe 1824 bntnht.exe 660 pjdjj.exe 2252 lxlfflf.exe 836 9hbtnn.exe 2904 pvjdd.exe 608 lrlffxf.exe 2088 bhbhtb.exe 2200 1tnthh.exe 2460 djvjv.exe 1616 xxxlxrf.exe 3048 fxxlrff.exe 2296 bbtbnt.exe 2776 bhttnt.exe 2860 7jjvp.exe 2508 5rflrfl.exe 3016 3rlrrrf.exe 2664 ttnthn.exe 2504 hbnnbh.exe 2704 jjdvp.exe 2992 pvvpj.exe 3012 5ffrxfr.exe 2720 rlfxxfx.exe 2732 3tnnbh.exe 2868 9vvjv.exe 2848 jjpdd.exe 1808 fxflxlx.exe 288 xflrrll.exe 792 ntnnht.exe 1636 nnnbht.exe 2488 3jdjv.exe 2428 dddvp.exe 1668 rrrrxfr.exe 2600 nhtthn.exe 2280 bbnbth.exe 2044 pdvvv.exe 2888 jdjjv.exe 2276 lfrxflx.exe 1040 ffxflrf.exe 1484 bthbnt.exe 808 jppdj.exe -
Processes:
resource yara_rule behavioral1/memory/2460-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1440-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2180-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/792-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1732-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2276-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2244-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/984-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2252-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/836-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/608-288-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a68e71b20f2fd2a0d7bc9640836d53e0_NeikiAnalytics.exexlxfrxf.exeppdpd.exerlxxlrx.exetttttn.exedvddd.exedvpvj.exerlxrxfr.exepvjdp.exevjdpp.exehtttht.exebbnthn.exe3lxrrxx.exebhbhnn.exevdvdv.exe3jjpd.exedescription pid process target process PID 2460 wrote to memory of 1440 2460 a68e71b20f2fd2a0d7bc9640836d53e0_NeikiAnalytics.exe xlxfrxf.exe PID 2460 wrote to memory of 1440 2460 a68e71b20f2fd2a0d7bc9640836d53e0_NeikiAnalytics.exe xlxfrxf.exe PID 2460 wrote to memory of 1440 2460 a68e71b20f2fd2a0d7bc9640836d53e0_NeikiAnalytics.exe xlxfrxf.exe PID 2460 wrote to memory of 1440 2460 a68e71b20f2fd2a0d7bc9640836d53e0_NeikiAnalytics.exe xlxfrxf.exe PID 1440 wrote to memory of 2900 1440 xlxfrxf.exe ppdpd.exe PID 1440 wrote to memory of 2900 1440 xlxfrxf.exe ppdpd.exe PID 1440 wrote to memory of 2900 1440 xlxfrxf.exe ppdpd.exe PID 1440 wrote to memory of 2900 1440 xlxfrxf.exe ppdpd.exe PID 2900 wrote to memory of 2632 2900 ppdpd.exe rlxxlrx.exe PID 2900 wrote to memory of 2632 2900 ppdpd.exe rlxxlrx.exe PID 2900 wrote to memory of 2632 2900 ppdpd.exe rlxxlrx.exe PID 2900 wrote to memory of 2632 2900 ppdpd.exe rlxxlrx.exe PID 2632 wrote to memory of 2656 2632 rlxxlrx.exe tttttn.exe PID 2632 wrote to memory of 2656 2632 rlxxlrx.exe tttttn.exe PID 2632 wrote to memory of 2656 2632 rlxxlrx.exe tttttn.exe PID 2632 wrote to memory of 2656 2632 rlxxlrx.exe tttttn.exe PID 2656 wrote to memory of 2760 2656 tttttn.exe dvddd.exe PID 2656 wrote to memory of 2760 2656 tttttn.exe dvddd.exe PID 2656 wrote to memory of 2760 2656 tttttn.exe dvddd.exe PID 2656 wrote to memory of 2760 2656 tttttn.exe dvddd.exe PID 2760 wrote to memory of 2528 2760 dvddd.exe dvpvj.exe PID 2760 wrote to memory of 2528 2760 dvddd.exe dvpvj.exe PID 2760 wrote to memory of 2528 2760 dvddd.exe dvpvj.exe PID 2760 wrote to memory of 2528 2760 dvddd.exe dvpvj.exe PID 2528 wrote to memory of 2816 2528 dvpvj.exe rlxrxfr.exe PID 2528 wrote to memory of 2816 2528 dvpvj.exe rlxrxfr.exe PID 2528 wrote to memory of 2816 2528 dvpvj.exe rlxrxfr.exe PID 2528 wrote to memory of 2816 2528 dvpvj.exe rlxrxfr.exe PID 2816 wrote to memory of 2568 2816 rlxrxfr.exe pvjdp.exe PID 2816 wrote to memory of 2568 2816 rlxrxfr.exe pvjdp.exe PID 2816 wrote to memory of 2568 2816 rlxrxfr.exe pvjdp.exe PID 2816 wrote to memory of 2568 2816 rlxrxfr.exe pvjdp.exe PID 2568 wrote to memory of 2364 2568 pvjdp.exe vjdpp.exe PID 2568 wrote to memory of 2364 2568 pvjdp.exe vjdpp.exe PID 2568 wrote to memory of 2364 2568 pvjdp.exe vjdpp.exe PID 2568 wrote to memory of 2364 2568 pvjdp.exe vjdpp.exe PID 2364 wrote to memory of 2744 2364 vjdpp.exe htttht.exe PID 2364 wrote to memory of 2744 2364 vjdpp.exe htttht.exe PID 2364 wrote to memory of 2744 2364 vjdpp.exe htttht.exe PID 2364 wrote to memory of 2744 2364 vjdpp.exe htttht.exe PID 2744 wrote to memory of 2848 2744 htttht.exe bbnthn.exe PID 2744 wrote to memory of 2848 2744 htttht.exe bbnthn.exe PID 2744 wrote to memory of 2848 2744 htttht.exe bbnthn.exe PID 2744 wrote to memory of 2848 2744 htttht.exe bbnthn.exe PID 2848 wrote to memory of 2896 2848 bbnthn.exe 3lxrrxx.exe PID 2848 wrote to memory of 2896 2848 bbnthn.exe 3lxrrxx.exe PID 2848 wrote to memory of 2896 2848 bbnthn.exe 3lxrrxx.exe PID 2848 wrote to memory of 2896 2848 bbnthn.exe 3lxrrxx.exe PID 2896 wrote to memory of 2180 2896 3lxrrxx.exe bhbhnn.exe PID 2896 wrote to memory of 2180 2896 3lxrrxx.exe bhbhnn.exe PID 2896 wrote to memory of 2180 2896 3lxrrxx.exe bhbhnn.exe PID 2896 wrote to memory of 2180 2896 3lxrrxx.exe bhbhnn.exe PID 2180 wrote to memory of 792 2180 bhbhnn.exe vdvdv.exe PID 2180 wrote to memory of 792 2180 bhbhnn.exe vdvdv.exe PID 2180 wrote to memory of 792 2180 bhbhnn.exe vdvdv.exe PID 2180 wrote to memory of 792 2180 bhbhnn.exe vdvdv.exe PID 792 wrote to memory of 1760 792 vdvdv.exe 3jjpd.exe PID 792 wrote to memory of 1760 792 vdvdv.exe 3jjpd.exe PID 792 wrote to memory of 1760 792 vdvdv.exe 3jjpd.exe PID 792 wrote to memory of 1760 792 vdvdv.exe 3jjpd.exe PID 1760 wrote to memory of 2412 1760 3jjpd.exe rrlxxfl.exe PID 1760 wrote to memory of 2412 1760 3jjpd.exe rrlxxfl.exe PID 1760 wrote to memory of 2412 1760 3jjpd.exe rrlxxfl.exe PID 1760 wrote to memory of 2412 1760 3jjpd.exe rrlxxfl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a68e71b20f2fd2a0d7bc9640836d53e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a68e71b20f2fd2a0d7bc9640836d53e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\xlxfrxf.exec:\xlxfrxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\ppdpd.exec:\ppdpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\rlxxlrx.exec:\rlxxlrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\tttttn.exec:\tttttn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\dvddd.exec:\dvddd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\dvpvj.exec:\dvpvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\rlxrxfr.exec:\rlxrxfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\pvjdp.exec:\pvjdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\vjdpp.exec:\vjdpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\htttht.exec:\htttht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\bbnthn.exec:\bbnthn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\3lxrrxx.exec:\3lxrrxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\bhbhnn.exec:\bhbhnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\vdvdv.exec:\vdvdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\3jjpd.exec:\3jjpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\rrlxxfl.exec:\rrlxxfl.exe17⤵
- Executes dropped EXE
PID:2412 -
\??\c:\bthhtb.exec:\bthhtb.exe18⤵
- Executes dropped EXE
PID:2432 -
\??\c:\ppppd.exec:\ppppd.exe19⤵
- Executes dropped EXE
PID:1448 -
\??\c:\7pjpd.exec:\7pjpd.exe20⤵
- Executes dropped EXE
PID:1732 -
\??\c:\7lrlxff.exec:\7lrlxff.exe21⤵
- Executes dropped EXE
PID:2044 -
\??\c:\hhbnbn.exec:\hhbnbn.exe22⤵
- Executes dropped EXE
PID:2276 -
\??\c:\jdpjv.exec:\jdpjv.exe23⤵
- Executes dropped EXE
PID:2244 -
\??\c:\jvpjp.exec:\jvpjp.exe24⤵
- Executes dropped EXE
PID:984 -
\??\c:\lffxrfx.exec:\lffxrfx.exe25⤵
- Executes dropped EXE
PID:1488 -
\??\c:\bntnht.exec:\bntnht.exe26⤵
- Executes dropped EXE
PID:1824 -
\??\c:\pjdjj.exec:\pjdjj.exe27⤵
- Executes dropped EXE
PID:660 -
\??\c:\lxlfflf.exec:\lxlfflf.exe28⤵
- Executes dropped EXE
PID:2252 -
\??\c:\9hbtnn.exec:\9hbtnn.exe29⤵
- Executes dropped EXE
PID:836 -
\??\c:\pvjdd.exec:\pvjdd.exe30⤵
- Executes dropped EXE
PID:2904 -
\??\c:\lrlffxf.exec:\lrlffxf.exe31⤵
- Executes dropped EXE
PID:608 -
\??\c:\bhbhtb.exec:\bhbhtb.exe32⤵
- Executes dropped EXE
PID:2088 -
\??\c:\1tnthh.exec:\1tnthh.exe33⤵
- Executes dropped EXE
PID:2200 -
\??\c:\djvjv.exec:\djvjv.exe34⤵
- Executes dropped EXE
PID:2460 -
\??\c:\xxxlxrf.exec:\xxxlxrf.exe35⤵
- Executes dropped EXE
PID:1616 -
\??\c:\fxxlrff.exec:\fxxlrff.exe36⤵
- Executes dropped EXE
PID:3048 -
\??\c:\bbtbnt.exec:\bbtbnt.exe37⤵
- Executes dropped EXE
PID:2296 -
\??\c:\bhttnt.exec:\bhttnt.exe38⤵
- Executes dropped EXE
PID:2776 -
\??\c:\7jjvp.exec:\7jjvp.exe39⤵
- Executes dropped EXE
PID:2860 -
\??\c:\5rflrfl.exec:\5rflrfl.exe40⤵
- Executes dropped EXE
PID:2508 -
\??\c:\3rlrrrf.exec:\3rlrrrf.exe41⤵
- Executes dropped EXE
PID:3016 -
\??\c:\ttnthn.exec:\ttnthn.exe42⤵
- Executes dropped EXE
PID:2664 -
\??\c:\hbnnbh.exec:\hbnnbh.exe43⤵
- Executes dropped EXE
PID:2504 -
\??\c:\jjdvp.exec:\jjdvp.exe44⤵
- Executes dropped EXE
PID:2704 -
\??\c:\pvvpj.exec:\pvvpj.exe45⤵
- Executes dropped EXE
PID:2992 -
\??\c:\5ffrxfr.exec:\5ffrxfr.exe46⤵
- Executes dropped EXE
PID:3012 -
\??\c:\rlfxxfx.exec:\rlfxxfx.exe47⤵
- Executes dropped EXE
PID:2720 -
\??\c:\3tnnbh.exec:\3tnnbh.exe48⤵
- Executes dropped EXE
PID:2732 -
\??\c:\9vvjv.exec:\9vvjv.exe49⤵
- Executes dropped EXE
PID:2868 -
\??\c:\jjpdd.exec:\jjpdd.exe50⤵
- Executes dropped EXE
PID:2848 -
\??\c:\fxflxlx.exec:\fxflxlx.exe51⤵
- Executes dropped EXE
PID:1808 -
\??\c:\xflrrll.exec:\xflrrll.exe52⤵
- Executes dropped EXE
PID:288 -
\??\c:\ntnnht.exec:\ntnnht.exe53⤵
- Executes dropped EXE
PID:792 -
\??\c:\nnnbht.exec:\nnnbht.exe54⤵
- Executes dropped EXE
PID:1636 -
\??\c:\3jdjv.exec:\3jdjv.exe55⤵
- Executes dropped EXE
PID:2488 -
\??\c:\dddvp.exec:\dddvp.exe56⤵
- Executes dropped EXE
PID:2428 -
\??\c:\rrrrxfr.exec:\rrrrxfr.exe57⤵
- Executes dropped EXE
PID:1668 -
\??\c:\nhtthn.exec:\nhtthn.exe58⤵
- Executes dropped EXE
PID:2600 -
\??\c:\bbnbth.exec:\bbnbth.exe59⤵
- Executes dropped EXE
PID:2280 -
\??\c:\pdvvv.exec:\pdvvv.exe60⤵
- Executes dropped EXE
PID:2044 -
\??\c:\jdjjv.exec:\jdjjv.exe61⤵
- Executes dropped EXE
PID:2888 -
\??\c:\lfrxflx.exec:\lfrxflx.exe62⤵
- Executes dropped EXE
PID:2276 -
\??\c:\ffxflrf.exec:\ffxflrf.exe63⤵
- Executes dropped EXE
PID:1040 -
\??\c:\bthbnt.exec:\bthbnt.exe64⤵
- Executes dropped EXE
PID:1484 -
\??\c:\jppdj.exec:\jppdj.exe65⤵
- Executes dropped EXE
PID:808 -
\??\c:\ddvvd.exec:\ddvvd.exe66⤵PID:1264
-
\??\c:\llxlxfx.exec:\llxlxfx.exe67⤵PID:764
-
\??\c:\1rrxlrf.exec:\1rrxlrf.exe68⤵PID:1828
-
\??\c:\nhnbnn.exec:\nhnbnn.exe69⤵PID:1304
-
\??\c:\htnntn.exec:\htnntn.exe70⤵PID:1948
-
\??\c:\vpjdp.exec:\vpjdp.exe71⤵PID:2216
-
\??\c:\rrllxlx.exec:\rrllxlx.exe72⤵PID:2904
-
\??\c:\xxrfrxf.exec:\xxrfrxf.exe73⤵PID:1184
-
\??\c:\7nnbtn.exec:\7nnbtn.exe74⤵PID:2232
-
\??\c:\nnhtht.exec:\nnhtht.exe75⤵PID:1740
-
\??\c:\7djjv.exec:\7djjv.exe76⤵PID:1624
-
\??\c:\1dvdj.exec:\1dvdj.exe77⤵PID:2836
-
\??\c:\flxrlxr.exec:\flxrlxr.exe78⤵PID:2864
-
\??\c:\xxfrflx.exec:\xxfrflx.exe79⤵PID:2644
-
\??\c:\nhtbhh.exec:\nhtbhh.exe80⤵PID:2808
-
\??\c:\tbnhnh.exec:\tbnhnh.exe81⤵PID:2768
-
\??\c:\pppvd.exec:\pppvd.exe82⤵PID:2760
-
\??\c:\ddvdp.exec:\ddvdp.exe83⤵PID:2228
-
\??\c:\fflxrxl.exec:\fflxrxl.exe84⤵PID:2748
-
\??\c:\rrrxxfr.exec:\rrrxxfr.exe85⤵PID:2424
-
\??\c:\nnhhtb.exec:\nnhhtb.exe86⤵PID:2564
-
\??\c:\5vpvd.exec:\5vpvd.exe87⤵PID:2996
-
\??\c:\dvpvd.exec:\dvpvd.exe88⤵PID:352
-
\??\c:\lfrfxlx.exec:\lfrfxlx.exe89⤵PID:2300
-
\??\c:\bhbhbh.exec:\bhbhbh.exe90⤵PID:2856
-
\??\c:\tbbbhb.exec:\tbbbhb.exe91⤵PID:2604
-
\??\c:\pjppd.exec:\pjppd.exe92⤵PID:2892
-
\??\c:\ppddp.exec:\ppddp.exe93⤵PID:1256
-
\??\c:\3rrxlrf.exec:\3rrxlrf.exe94⤵PID:1644
-
\??\c:\rfrxxxx.exec:\rfrxxxx.exe95⤵PID:300
-
\??\c:\nbnhnn.exec:\nbnhnn.exe96⤵PID:3004
-
\??\c:\bttnhh.exec:\bttnhh.exe97⤵PID:2376
-
\??\c:\pdvvj.exec:\pdvvj.exe98⤵PID:1456
-
\??\c:\vdpdv.exec:\vdpdv.exe99⤵PID:1400
-
\??\c:\xfffffr.exec:\xfffffr.exe100⤵PID:2016
-
\??\c:\3hnhnb.exec:\3hnhnb.exe101⤵PID:2872
-
\??\c:\nnhnbh.exec:\nnhnbh.exe102⤵PID:2280
-
\??\c:\pvjjd.exec:\pvjjd.exe103⤵PID:2044
-
\??\c:\lxflrxr.exec:\lxflrxr.exe104⤵PID:576
-
\??\c:\rfxfffl.exec:\rfxfffl.exe105⤵PID:1108
-
\??\c:\ntnnnt.exec:\ntnnnt.exe106⤵PID:984
-
\??\c:\7dvdv.exec:\7dvdv.exe107⤵PID:1704
-
\??\c:\jddjv.exec:\jddjv.exe108⤵PID:548
-
\??\c:\3xrrxxf.exec:\3xrrxxf.exe109⤵PID:2956
-
\??\c:\rlxxfrx.exec:\rlxxfrx.exe110⤵PID:1796
-
\??\c:\hnbbhb.exec:\hnbbhb.exe111⤵PID:3020
-
\??\c:\nntnnh.exec:\nntnnh.exe112⤵PID:2420
-
\??\c:\dvpdj.exec:\dvpdj.exe113⤵PID:568
-
\??\c:\llllxrr.exec:\llllxrr.exe114⤵PID:2948
-
\??\c:\rrlxlrf.exec:\rrlxlrf.exe115⤵PID:2904
-
\??\c:\bbbnnt.exec:\bbbnnt.exe116⤵PID:2088
-
\??\c:\bbtbhn.exec:\bbtbhn.exe117⤵PID:1124
-
\??\c:\jdvdd.exec:\jdvdd.exe118⤵PID:1744
-
\??\c:\jpvdv.exec:\jpvdv.exe119⤵PID:1624
-
\??\c:\xflllfl.exec:\xflllfl.exe120⤵PID:1440
-
\??\c:\btntnn.exec:\btntnn.exe121⤵PID:2296
-
\??\c:\nbnnnt.exec:\nbnnnt.exe122⤵PID:2920
-
\??\c:\pjdpd.exec:\pjdpd.exe123⤵PID:2772
-
\??\c:\vdpjp.exec:\vdpjp.exe124⤵PID:2524
-
\??\c:\llfrxfr.exec:\llfrxfr.exe125⤵PID:2828
-
\??\c:\xrflflx.exec:\xrflflx.exe126⤵PID:2500
-
\??\c:\bthntb.exec:\bthntb.exe127⤵PID:2668
-
\??\c:\tttbtb.exec:\tttbtb.exe128⤵PID:3000
-
\??\c:\pdjdj.exec:\pdjdj.exe129⤵PID:2568
-
\??\c:\rlffrrf.exec:\rlffrrf.exe130⤵PID:1196
-
\??\c:\lrrrxrx.exec:\lrrrxrx.exe131⤵PID:2720
-
\??\c:\nhhntb.exec:\nhhntb.exe132⤵PID:2844
-
\??\c:\bnbbhh.exec:\bnbbhh.exe133⤵PID:2972
-
\??\c:\jdjvj.exec:\jdjvj.exe134⤵PID:2688
-
\??\c:\pjddp.exec:\pjddp.exe135⤵PID:2892
-
\??\c:\rrlrllx.exec:\rrlrllx.exe136⤵PID:1632
-
\??\c:\xxlflrl.exec:\xxlflrl.exe137⤵PID:1596
-
\??\c:\nhbnbh.exec:\nhbnbh.exe138⤵PID:1760
-
\??\c:\vvdpp.exec:\vvdpp.exe139⤵PID:2376
-
\??\c:\5dvdp.exec:\5dvdp.exe140⤵PID:880
-
\??\c:\5xxxlrx.exec:\5xxxlrx.exe141⤵PID:2432
-
\??\c:\rlxflrx.exec:\rlxflrx.exe142⤵PID:2080
-
\??\c:\tbtbnh.exec:\tbtbnh.exe143⤵PID:1916
-
\??\c:\nhnbhh.exec:\nhnbhh.exe144⤵PID:2936
-
\??\c:\vjvpv.exec:\vjvpv.exe145⤵PID:2888
-
\??\c:\vvpvj.exec:\vvpvj.exe146⤵PID:2244
-
\??\c:\xfrrlrr.exec:\xfrrlrr.exe147⤵PID:284
-
\??\c:\xxlrlrf.exec:\xxlrlrf.exe148⤵PID:2540
-
\??\c:\hbtbnn.exec:\hbtbnn.exe149⤵PID:808
-
\??\c:\pjdvp.exec:\pjdvp.exe150⤵PID:1872
-
\??\c:\jdvdp.exec:\jdvdp.exe151⤵PID:764
-
\??\c:\5llxfxl.exec:\5llxfxl.exe152⤵PID:2480
-
\??\c:\xxflxrx.exec:\xxflxrx.exe153⤵PID:688
-
\??\c:\tnnbbh.exec:\tnnbbh.exe154⤵PID:1600
-
\??\c:\3tnhbt.exec:\3tnhbt.exe155⤵PID:2144
-
\??\c:\vvpvp.exec:\vvpvp.exe156⤵PID:888
-
\??\c:\jpjvd.exec:\jpjvd.exe157⤵PID:1184
-
\??\c:\5lfrlrf.exec:\5lfrlrf.exe158⤵PID:1812
-
\??\c:\5rffxxf.exec:\5rffxxf.exe159⤵PID:2088
-
\??\c:\bbhbbt.exec:\bbhbbt.exe160⤵PID:2584
-
\??\c:\pjjdp.exec:\pjjdp.exe161⤵PID:2028
-
\??\c:\dvpvv.exec:\dvpvv.exe162⤵PID:2900
-
\??\c:\1xxxffr.exec:\1xxxffr.exe163⤵PID:2804
-
\??\c:\ffxllfx.exec:\ffxllfx.exe164⤵PID:2628
-
\??\c:\hnhhnb.exec:\hnhhnb.exe165⤵PID:2860
-
\??\c:\jvdjp.exec:\jvdjp.exe166⤵PID:2528
-
\??\c:\vdvjd.exec:\vdvjd.exe167⤵PID:2228
-
\??\c:\7llxffr.exec:\7llxffr.exe168⤵PID:2676
-
\??\c:\ntthbn.exec:\ntthbn.exe169⤵PID:2496
-
\??\c:\hbhnhn.exec:\hbhnhn.exe170⤵PID:2704
-
\??\c:\pjdjv.exec:\pjdjv.exe171⤵PID:2992
-
\??\c:\jpjdd.exec:\jpjdd.exe172⤵PID:2700
-
\??\c:\lrrffrl.exec:\lrrffrl.exe173⤵PID:2824
-
\??\c:\9dvdp.exec:\9dvdp.exe174⤵PID:1308
-
\??\c:\rrlrflf.exec:\rrlrflf.exe175⤵PID:2876
-
\??\c:\flllllr.exec:\flllllr.exe176⤵PID:1236
-
\??\c:\hbnntb.exec:\hbnntb.exe177⤵PID:2180
-
\??\c:\7hbbhh.exec:\7hbbhh.exe178⤵PID:2220
-
\??\c:\pdvdj.exec:\pdvdj.exe179⤵PID:792
-
\??\c:\9dvdp.exec:\9dvdp.exe180⤵PID:2392
-
\??\c:\xrflrfx.exec:\xrflrfx.exe181⤵PID:2736
-
\??\c:\3nhnbb.exec:\3nhnbb.exe182⤵PID:2428
-
\??\c:\nhthtb.exec:\nhthtb.exe183⤵PID:2432
-
\??\c:\jjdpv.exec:\jjdpv.exe184⤵PID:2932
-
\??\c:\7vvpj.exec:\7vvpj.exe185⤵PID:2928
-
\??\c:\1rxlrff.exec:\1rxlrff.exe186⤵PID:1700
-
\??\c:\llxlrxr.exec:\llxlrxr.exe187⤵PID:2096
-
\??\c:\9thbtt.exec:\9thbtt.exe188⤵PID:2276
-
\??\c:\tnhhnn.exec:\tnhhnn.exe189⤵PID:1108
-
\??\c:\9ddpd.exec:\9ddpd.exe190⤵PID:296
-
\??\c:\rrxxflx.exec:\rrxxflx.exe191⤵PID:1168
-
\??\c:\xxrfrlx.exec:\xxrfrlx.exe192⤵PID:1404
-
\??\c:\bbtbhn.exec:\bbtbhn.exe193⤵PID:1680
-
\??\c:\djjpd.exec:\djjpd.exe194⤵PID:2952
-
\??\c:\dpjpv.exec:\dpjpv.exe195⤵PID:836
-
\??\c:\jpjpj.exec:\jpjpj.exe196⤵PID:2172
-
\??\c:\flxfxfx.exec:\flxfxfx.exe197⤵PID:2216
-
\??\c:\tnttnt.exec:\tnttnt.exe198⤵PID:3040
-
\??\c:\bbbhtb.exec:\bbbhtb.exe199⤵PID:2152
-
\??\c:\vvjvj.exec:\vvjvj.exe200⤵PID:1284
-
\??\c:\jjvpd.exec:\jjvpd.exe201⤵PID:2200
-
\??\c:\fffxrxr.exec:\fffxrxr.exe202⤵PID:2456
-
\??\c:\llllxrf.exec:\llllxrf.exe203⤵PID:2596
-
\??\c:\nhthnn.exec:\nhthnn.exe204⤵PID:2052
-
\??\c:\vddpp.exec:\vddpp.exe205⤵PID:2644
-
\??\c:\7ddpd.exec:\7ddpd.exe206⤵PID:2916
-
\??\c:\ffllrrx.exec:\ffllrrx.exe207⤵PID:2768
-
\??\c:\9xlllff.exec:\9xlllff.exe208⤵PID:2660
-
\??\c:\bbtbtb.exec:\bbtbtb.exe209⤵PID:2548
-
\??\c:\3bnhnh.exec:\3bnhnh.exe210⤵PID:2504
-
\??\c:\jdpvp.exec:\jdpvp.exe211⤵PID:2580
-
\??\c:\9pjjv.exec:\9pjjv.exe212⤵PID:2816
-
\??\c:\lrlflff.exec:\lrlflff.exe213⤵PID:2568
-
\??\c:\lrflfrx.exec:\lrflfrx.exe214⤵PID:2832
-
\??\c:\htnnnb.exec:\htnnnb.exe215⤵PID:2852
-
\??\c:\tthhbt.exec:\tthhbt.exe216⤵PID:2744
-
\??\c:\3pjpd.exec:\3pjpd.exe217⤵PID:2972
-
\??\c:\vvvjd.exec:\vvvjd.exe218⤵PID:2896
-
\??\c:\rfxfffr.exec:\rfxfffr.exe219⤵PID:760
-
\??\c:\nnnhnn.exec:\nnnhnn.exe220⤵PID:1756
-
\??\c:\nnhbnn.exec:\nnhbnn.exe221⤵PID:1816
-
\??\c:\vpdpv.exec:\vpdpv.exe222⤵PID:2712
-
\??\c:\xrxlflr.exec:\xrxlflr.exe223⤵PID:2728
-
\??\c:\7xrrlxl.exec:\7xrrlxl.exe224⤵PID:1316
-
\??\c:\lrxrxlr.exec:\lrxrxlr.exe225⤵PID:1436
-
\??\c:\1nbbhn.exec:\1nbbhn.exe226⤵PID:2368
-
\??\c:\3vdvp.exec:\3vdvp.exe227⤵PID:2076
-
\??\c:\ddpdv.exec:\ddpdv.exe228⤵PID:1984
-
\??\c:\ffflflr.exec:\ffflflr.exe229⤵PID:2940
-
\??\c:\ffxfrfr.exec:\ffxfrfr.exe230⤵PID:2888
-
\??\c:\nbbbbt.exec:\nbbbbt.exe231⤵PID:668
-
\??\c:\ttbhhn.exec:\ttbhhn.exe232⤵PID:1716
-
\??\c:\vvjvv.exec:\vvjvv.exe233⤵PID:1820
-
\??\c:\5fxrxrx.exec:\5fxrxrx.exe234⤵PID:2012
-
\??\c:\xrlxlxl.exec:\xrlxlxl.exe235⤵PID:328
-
\??\c:\hnnbbb.exec:\hnnbbb.exe236⤵PID:1252
-
\??\c:\3nhbhh.exec:\3nhbhh.exe237⤵PID:2252
-
\??\c:\vddjd.exec:\vddjd.exe238⤵PID:1304
-
\??\c:\flxxrxl.exec:\flxxrxl.exe239⤵PID:1552
-
\??\c:\lxflflf.exec:\lxflflf.exe240⤵PID:2292
-
\??\c:\bbhbnb.exec:\bbhbnb.exe241⤵PID:2904
-
\??\c:\tnnthn.exec:\tnnthn.exe242⤵PID:1388