Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 03:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9b80ac1ee16f657875d37d5fa186d160_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
9b80ac1ee16f657875d37d5fa186d160_NeikiAnalytics.exe
-
Size
128KB
-
MD5
9b80ac1ee16f657875d37d5fa186d160
-
SHA1
902ff5c0fdf372ca4e184ba2b88dc2ce3d836d83
-
SHA256
28100da958eba1071676042e3cbbe2af7320c2fcc772714ff4da79b3f54eb9b5
-
SHA512
e503c3028e29161a4bd419a804b84248a5a46d0b2bdba38685766158376a45a6ea7767b959d4bbf8cb54d26bae561222a0b580b131e74efc603ae7bd61b79c8b
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afoHvmQ+EZMYX/x6gtd:n3C9BRW0j/uVEZFJvb
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral2/memory/4996-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4436-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1424-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3828-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3536-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4872-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2892-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3456-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4796-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2376-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4220-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1492-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3584-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4640-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/552-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2332-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1084-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3580-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/940-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vjpjj.exerlrrrrx.exebttnnn.exetnhhtt.exevvdvv.exerxflfxr.exenhhhhn.exe5dpvv.exerlllllf.exefxfxxxx.exenhtttb.exevpvpd.exerffxrrl.exe9nhbtb.exejjddv.exexfrfffx.exennbbht.exebttbbb.exe7ppjj.exellxrrrr.exetnhhhb.exevppjd.exe1rfrrxx.exehhhnnt.exevdpvj.exefrxxllf.exehnnnhh.exevpvpp.exerrxfxfl.exennnntb.exepvdvp.exejdddv.exelrffrlr.exe9tbtnh.exeddddv.exexrlfxxr.exefrxxrxr.exebhttbt.exedjvvp.exeflxrlrl.exehbhtbh.exedvvpj.exelfxxllf.exehhntbn.exedjdvp.exevpvpp.exexlxlrlf.exebthnbn.exetttnhb.exejvjpp.exetnnhth.exe3tntnt.exedvvvp.exeddddd.exefxxrllx.exe9tttnn.exebnbbnh.exevvjjd.exeppppj.exexrxrllf.exebbbbbb.exehhttnn.exevdvdj.exexfxxxxr.exepid process 4436 vjpjj.exe 3828 rlrrrrx.exe 1424 bttnnn.exe 4956 tnhhtt.exe 3536 vvdvv.exe 2556 rxflfxr.exe 4872 nhhhhn.exe 2892 5dpvv.exe 3692 rlllllf.exe 3984 fxfxxxx.exe 3456 nhtttb.exe 4796 vpvpd.exe 4420 rffxrrl.exe 2364 9nhbtb.exe 2376 jjddv.exe 4220 xfrfffx.exe 1492 nnbbht.exe 3224 bttbbb.exe 3584 7ppjj.exe 4396 llxrrrr.exe 4640 tnhhhb.exe 4988 vppjd.exe 1720 1rfrrxx.exe 552 hhhnnt.exe 2332 vdpvj.exe 1084 frxxllf.exe 3580 hnnnhh.exe 4244 vpvpp.exe 1632 rrxfxfl.exe 940 nnnntb.exe 4876 pvdvp.exe 2932 jdddv.exe 4824 lrffrlr.exe 2000 9tbtnh.exe 1628 ddddv.exe 1612 xrlfxxr.exe 4908 frxxrxr.exe 216 bhttbt.exe 4656 djvvp.exe 4996 flxrlrl.exe 4196 hbhtbh.exe 408 dvvpj.exe 3592 lfxxllf.exe 1424 hhntbn.exe 996 djdvp.exe 1640 vpvpp.exe 4884 xlxlrlf.exe 2924 bthnbn.exe 512 tttnhb.exe 2720 jvjpp.exe 2008 tnnhth.exe 1012 3tntnt.exe 4000 dvvvp.exe 3272 ddddd.exe 1016 fxxrllx.exe 2532 9tttnn.exe 892 bnbbnh.exe 3964 vvjjd.exe 5028 ppppj.exe 2520 xrxrllf.exe 4364 bbbbbb.exe 4204 hhttnn.exe 1252 vdvdj.exe 3436 xfxxxxr.exe -
Processes:
resource yara_rule behavioral2/memory/4996-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4436-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1424-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3828-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3536-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4872-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2892-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3456-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4796-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2376-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4220-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1492-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3584-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/552-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2332-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1084-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3580-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/940-194-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9b80ac1ee16f657875d37d5fa186d160_NeikiAnalytics.exevjpjj.exerlrrrrx.exebttnnn.exetnhhtt.exevvdvv.exerxflfxr.exenhhhhn.exe5dpvv.exerlllllf.exefxfxxxx.exenhtttb.exevpvpd.exerffxrrl.exe9nhbtb.exejjddv.exexfrfffx.exennbbht.exebttbbb.exe7ppjj.exellxrrrr.exetnhhhb.exedescription pid process target process PID 4996 wrote to memory of 4436 4996 9b80ac1ee16f657875d37d5fa186d160_NeikiAnalytics.exe vjpjj.exe PID 4996 wrote to memory of 4436 4996 9b80ac1ee16f657875d37d5fa186d160_NeikiAnalytics.exe vjpjj.exe PID 4996 wrote to memory of 4436 4996 9b80ac1ee16f657875d37d5fa186d160_NeikiAnalytics.exe vjpjj.exe PID 4436 wrote to memory of 3828 4436 vjpjj.exe rlrrrrx.exe PID 4436 wrote to memory of 3828 4436 vjpjj.exe rlrrrrx.exe PID 4436 wrote to memory of 3828 4436 vjpjj.exe rlrrrrx.exe PID 3828 wrote to memory of 1424 3828 rlrrrrx.exe bttnnn.exe PID 3828 wrote to memory of 1424 3828 rlrrrrx.exe bttnnn.exe PID 3828 wrote to memory of 1424 3828 rlrrrrx.exe bttnnn.exe PID 1424 wrote to memory of 4956 1424 bttnnn.exe tnhhtt.exe PID 1424 wrote to memory of 4956 1424 bttnnn.exe tnhhtt.exe PID 1424 wrote to memory of 4956 1424 bttnnn.exe tnhhtt.exe PID 4956 wrote to memory of 3536 4956 tnhhtt.exe vvdvv.exe PID 4956 wrote to memory of 3536 4956 tnhhtt.exe vvdvv.exe PID 4956 wrote to memory of 3536 4956 tnhhtt.exe vvdvv.exe PID 3536 wrote to memory of 2556 3536 vvdvv.exe rxflfxr.exe PID 3536 wrote to memory of 2556 3536 vvdvv.exe rxflfxr.exe PID 3536 wrote to memory of 2556 3536 vvdvv.exe rxflfxr.exe PID 2556 wrote to memory of 4872 2556 rxflfxr.exe nhhhhn.exe PID 2556 wrote to memory of 4872 2556 rxflfxr.exe nhhhhn.exe PID 2556 wrote to memory of 4872 2556 rxflfxr.exe nhhhhn.exe PID 4872 wrote to memory of 2892 4872 nhhhhn.exe 5dpvv.exe PID 4872 wrote to memory of 2892 4872 nhhhhn.exe 5dpvv.exe PID 4872 wrote to memory of 2892 4872 nhhhhn.exe 5dpvv.exe PID 2892 wrote to memory of 3692 2892 5dpvv.exe rlllllf.exe PID 2892 wrote to memory of 3692 2892 5dpvv.exe rlllllf.exe PID 2892 wrote to memory of 3692 2892 5dpvv.exe rlllllf.exe PID 3692 wrote to memory of 3984 3692 rlllllf.exe fxfxxxx.exe PID 3692 wrote to memory of 3984 3692 rlllllf.exe fxfxxxx.exe PID 3692 wrote to memory of 3984 3692 rlllllf.exe fxfxxxx.exe PID 3984 wrote to memory of 3456 3984 fxfxxxx.exe nhtttb.exe PID 3984 wrote to memory of 3456 3984 fxfxxxx.exe nhtttb.exe PID 3984 wrote to memory of 3456 3984 fxfxxxx.exe nhtttb.exe PID 3456 wrote to memory of 4796 3456 nhtttb.exe vpvpd.exe PID 3456 wrote to memory of 4796 3456 nhtttb.exe vpvpd.exe PID 3456 wrote to memory of 4796 3456 nhtttb.exe vpvpd.exe PID 4796 wrote to memory of 4420 4796 vpvpd.exe rffxrrl.exe PID 4796 wrote to memory of 4420 4796 vpvpd.exe rffxrrl.exe PID 4796 wrote to memory of 4420 4796 vpvpd.exe rffxrrl.exe PID 4420 wrote to memory of 2364 4420 rffxrrl.exe 9nhbtb.exe PID 4420 wrote to memory of 2364 4420 rffxrrl.exe 9nhbtb.exe PID 4420 wrote to memory of 2364 4420 rffxrrl.exe 9nhbtb.exe PID 2364 wrote to memory of 2376 2364 9nhbtb.exe jjddv.exe PID 2364 wrote to memory of 2376 2364 9nhbtb.exe jjddv.exe PID 2364 wrote to memory of 2376 2364 9nhbtb.exe jjddv.exe PID 2376 wrote to memory of 4220 2376 jjddv.exe xfrfffx.exe PID 2376 wrote to memory of 4220 2376 jjddv.exe xfrfffx.exe PID 2376 wrote to memory of 4220 2376 jjddv.exe xfrfffx.exe PID 4220 wrote to memory of 1492 4220 xfrfffx.exe nnbbht.exe PID 4220 wrote to memory of 1492 4220 xfrfffx.exe nnbbht.exe PID 4220 wrote to memory of 1492 4220 xfrfffx.exe nnbbht.exe PID 1492 wrote to memory of 3224 1492 nnbbht.exe bttbbb.exe PID 1492 wrote to memory of 3224 1492 nnbbht.exe bttbbb.exe PID 1492 wrote to memory of 3224 1492 nnbbht.exe bttbbb.exe PID 3224 wrote to memory of 3584 3224 bttbbb.exe 7ppjj.exe PID 3224 wrote to memory of 3584 3224 bttbbb.exe 7ppjj.exe PID 3224 wrote to memory of 3584 3224 bttbbb.exe 7ppjj.exe PID 3584 wrote to memory of 4396 3584 7ppjj.exe llxrrrr.exe PID 3584 wrote to memory of 4396 3584 7ppjj.exe llxrrrr.exe PID 3584 wrote to memory of 4396 3584 7ppjj.exe llxrrrr.exe PID 4396 wrote to memory of 4640 4396 llxrrrr.exe tnhhhb.exe PID 4396 wrote to memory of 4640 4396 llxrrrr.exe tnhhhb.exe PID 4396 wrote to memory of 4640 4396 llxrrrr.exe tnhhhb.exe PID 4640 wrote to memory of 4988 4640 tnhhhb.exe vppjd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b80ac1ee16f657875d37d5fa186d160_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9b80ac1ee16f657875d37d5fa186d160_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\vjpjj.exec:\vjpjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\rlrrrrx.exec:\rlrrrrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\bttnnn.exec:\bttnnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\tnhhtt.exec:\tnhhtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\vvdvv.exec:\vvdvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\rxflfxr.exec:\rxflfxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\nhhhhn.exec:\nhhhhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\5dpvv.exec:\5dpvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\rlllllf.exec:\rlllllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\fxfxxxx.exec:\fxfxxxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\nhtttb.exec:\nhtttb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\vpvpd.exec:\vpvpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\rffxrrl.exec:\rffxrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\9nhbtb.exec:\9nhbtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\jjddv.exec:\jjddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\xfrfffx.exec:\xfrfffx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\nnbbht.exec:\nnbbht.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\bttbbb.exec:\bttbbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\7ppjj.exec:\7ppjj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\llxrrrr.exec:\llxrrrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\tnhhhb.exec:\tnhhhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\vppjd.exec:\vppjd.exe23⤵
- Executes dropped EXE
PID:4988 -
\??\c:\1rfrrxx.exec:\1rfrrxx.exe24⤵
- Executes dropped EXE
PID:1720 -
\??\c:\hhhnnt.exec:\hhhnnt.exe25⤵
- Executes dropped EXE
PID:552 -
\??\c:\vdpvj.exec:\vdpvj.exe26⤵
- Executes dropped EXE
PID:2332 -
\??\c:\frxxllf.exec:\frxxllf.exe27⤵
- Executes dropped EXE
PID:1084 -
\??\c:\hnnnhh.exec:\hnnnhh.exe28⤵
- Executes dropped EXE
PID:3580 -
\??\c:\vpvpp.exec:\vpvpp.exe29⤵
- Executes dropped EXE
PID:4244 -
\??\c:\rrxfxfl.exec:\rrxfxfl.exe30⤵
- Executes dropped EXE
PID:1632 -
\??\c:\nnnntb.exec:\nnnntb.exe31⤵
- Executes dropped EXE
PID:940 -
\??\c:\pvdvp.exec:\pvdvp.exe32⤵
- Executes dropped EXE
PID:4876 -
\??\c:\jdddv.exec:\jdddv.exe33⤵
- Executes dropped EXE
PID:2932 -
\??\c:\lrffrlr.exec:\lrffrlr.exe34⤵
- Executes dropped EXE
PID:4824 -
\??\c:\9tbtnh.exec:\9tbtnh.exe35⤵
- Executes dropped EXE
PID:2000 -
\??\c:\ddddv.exec:\ddddv.exe36⤵
- Executes dropped EXE
PID:1628 -
\??\c:\xrlfxxr.exec:\xrlfxxr.exe37⤵
- Executes dropped EXE
PID:1612 -
\??\c:\frxxrxr.exec:\frxxrxr.exe38⤵
- Executes dropped EXE
PID:4908 -
\??\c:\bhttbt.exec:\bhttbt.exe39⤵
- Executes dropped EXE
PID:216 -
\??\c:\djvvp.exec:\djvvp.exe40⤵
- Executes dropped EXE
PID:4656 -
\??\c:\1rrllxr.exec:\1rrllxr.exe41⤵PID:4544
-
\??\c:\flxrlrl.exec:\flxrlrl.exe42⤵
- Executes dropped EXE
PID:4996 -
\??\c:\hbhtbh.exec:\hbhtbh.exe43⤵
- Executes dropped EXE
PID:4196 -
\??\c:\dvvpj.exec:\dvvpj.exe44⤵
- Executes dropped EXE
PID:408 -
\??\c:\lfxxllf.exec:\lfxxllf.exe45⤵
- Executes dropped EXE
PID:3592 -
\??\c:\hhntbn.exec:\hhntbn.exe46⤵
- Executes dropped EXE
PID:1424 -
\??\c:\djdvp.exec:\djdvp.exe47⤵
- Executes dropped EXE
PID:996 -
\??\c:\vpvpp.exec:\vpvpp.exe48⤵
- Executes dropped EXE
PID:1640 -
\??\c:\xlxlrlf.exec:\xlxlrlf.exe49⤵
- Executes dropped EXE
PID:4884 -
\??\c:\bthnbn.exec:\bthnbn.exe50⤵
- Executes dropped EXE
PID:2924 -
\??\c:\tttnhb.exec:\tttnhb.exe51⤵
- Executes dropped EXE
PID:512 -
\??\c:\jvjpp.exec:\jvjpp.exe52⤵
- Executes dropped EXE
PID:2720 -
\??\c:\tnnhth.exec:\tnnhth.exe53⤵
- Executes dropped EXE
PID:2008 -
\??\c:\3tntnt.exec:\3tntnt.exe54⤵
- Executes dropped EXE
PID:1012 -
\??\c:\dvvvp.exec:\dvvvp.exe55⤵
- Executes dropped EXE
PID:4000 -
\??\c:\ddddd.exec:\ddddd.exe56⤵
- Executes dropped EXE
PID:3272 -
\??\c:\fxxrllx.exec:\fxxrllx.exe57⤵
- Executes dropped EXE
PID:1016 -
\??\c:\9tttnn.exec:\9tttnn.exe58⤵
- Executes dropped EXE
PID:2532 -
\??\c:\bnbbnh.exec:\bnbbnh.exe59⤵
- Executes dropped EXE
PID:892 -
\??\c:\vvjjd.exec:\vvjjd.exe60⤵
- Executes dropped EXE
PID:3964 -
\??\c:\ppppj.exec:\ppppj.exe61⤵
- Executes dropped EXE
PID:5028 -
\??\c:\xrxrllf.exec:\xrxrllf.exe62⤵
- Executes dropped EXE
PID:2520 -
\??\c:\bbbbbb.exec:\bbbbbb.exe63⤵
- Executes dropped EXE
PID:4364 -
\??\c:\hhttnn.exec:\hhttnn.exe64⤵
- Executes dropped EXE
PID:4204 -
\??\c:\vdvdj.exec:\vdvdj.exe65⤵
- Executes dropped EXE
PID:1252 -
\??\c:\xfxxxxr.exec:\xfxxxxr.exe66⤵
- Executes dropped EXE
PID:3436 -
\??\c:\ffrrflx.exec:\ffrrflx.exe67⤵PID:4132
-
\??\c:\hnbbnn.exec:\hnbbnn.exe68⤵PID:1844
-
\??\c:\dppjd.exec:\dppjd.exe69⤵PID:4256
-
\??\c:\flrllll.exec:\flrllll.exe70⤵PID:4932
-
\??\c:\nhnnnn.exec:\nhnnnn.exe71⤵PID:1720
-
\??\c:\5vppj.exec:\5vppj.exe72⤵PID:452
-
\??\c:\lfrrffl.exec:\lfrrffl.exe73⤵PID:3508
-
\??\c:\rllllrr.exec:\rllllrr.exe74⤵PID:4836
-
\??\c:\hhbbnt.exec:\hhbbnt.exe75⤵PID:4228
-
\??\c:\jjvvp.exec:\jjvvp.exe76⤵PID:2760
-
\??\c:\frxxxxx.exec:\frxxxxx.exe77⤵PID:4900
-
\??\c:\lllfflf.exec:\lllfflf.exe78⤵PID:3416
-
\??\c:\ddvvp.exec:\ddvvp.exe79⤵PID:940
-
\??\c:\xxxrflf.exec:\xxxrflf.exe80⤵PID:2288
-
\??\c:\xlrllrx.exec:\xlrllrx.exe81⤵PID:3556
-
\??\c:\vjvjj.exec:\vjvjj.exe82⤵PID:4564
-
\??\c:\ffxfllr.exec:\ffxfllr.exe83⤵PID:2956
-
\??\c:\hthhbh.exec:\hthhbh.exe84⤵PID:1628
-
\??\c:\tnthbt.exec:\tnthbt.exe85⤵PID:3332
-
\??\c:\dpvdd.exec:\dpvdd.exe86⤵PID:1680
-
\??\c:\1rlfrxr.exec:\1rlfrxr.exe87⤵PID:2580
-
\??\c:\btbttt.exec:\btbttt.exe88⤵PID:4468
-
\??\c:\3ddvp.exec:\3ddvp.exe89⤵PID:2064
-
\??\c:\vvppj.exec:\vvppj.exe90⤵PID:2280
-
\??\c:\fxllllx.exec:\fxllllx.exe91⤵PID:4812
-
\??\c:\3tbbbh.exec:\3tbbbh.exe92⤵PID:3920
-
\??\c:\jjjpv.exec:\jjjpv.exe93⤵PID:1112
-
\??\c:\lxrxlxl.exec:\lxrxlxl.exe94⤵PID:4956
-
\??\c:\lfflxrx.exec:\lfflxrx.exe95⤵PID:3536
-
\??\c:\bhhbbn.exec:\bhhbbn.exe96⤵PID:2556
-
\??\c:\ntbttn.exec:\ntbttn.exe97⤵PID:3552
-
\??\c:\9pvpv.exec:\9pvpv.exe98⤵PID:4664
-
\??\c:\rlllfff.exec:\rlllfff.exe99⤵PID:4868
-
\??\c:\flxrllf.exec:\flxrllf.exe100⤵PID:5116
-
\??\c:\3btnnn.exec:\3btnnn.exe101⤵PID:60
-
\??\c:\thtnnh.exec:\thtnnh.exe102⤵PID:2168
-
\??\c:\jppvp.exec:\jppvp.exe103⤵PID:5080
-
\??\c:\lflfxff.exec:\lflfxff.exe104⤵PID:3132
-
\??\c:\tntnhn.exec:\tntnhn.exe105⤵PID:1552
-
\??\c:\vvvvp.exec:\vvvvp.exe106⤵PID:3636
-
\??\c:\bbbnnt.exec:\bbbnnt.exe107⤵PID:2680
-
\??\c:\httnnn.exec:\httnnn.exe108⤵PID:3080
-
\??\c:\jddvd.exec:\jddvd.exe109⤵PID:2756
-
\??\c:\xxxrlll.exec:\xxxrlll.exe110⤵PID:4356
-
\??\c:\bbnhht.exec:\bbnhht.exe111⤵PID:4376
-
\??\c:\dvvvv.exec:\dvvvv.exe112⤵PID:2356
-
\??\c:\rffxrrf.exec:\rffxrrf.exe113⤵PID:2616
-
\??\c:\xxllrxx.exec:\xxllrxx.exe114⤵PID:4640
-
\??\c:\thnhbb.exec:\thnhbb.exe115⤵PID:224
-
\??\c:\djpvv.exec:\djpvv.exe116⤵PID:4352
-
\??\c:\vpvpd.exec:\vpvpd.exe117⤵PID:4808
-
\??\c:\rlxlflf.exec:\rlxlflf.exe118⤵PID:1308
-
\??\c:\tnnnhh.exec:\tnnnhh.exe119⤵PID:1496
-
\??\c:\hhnbhn.exec:\hhnbhn.exe120⤵PID:3580
-
\??\c:\vdpvj.exec:\vdpvj.exe121⤵PID:2928
-
\??\c:\xlrrlrr.exec:\xlrrlrr.exe122⤵PID:2304
-
\??\c:\5ffxxxr.exec:\5ffxxxr.exe123⤵PID:2840
-
\??\c:\bnbbtt.exec:\bnbbtt.exe124⤵PID:2888
-
\??\c:\djppd.exec:\djppd.exe125⤵PID:4264
-
\??\c:\ddvjj.exec:\ddvjj.exe126⤵PID:2932
-
\??\c:\xrrlrrx.exec:\xrrlrrx.exe127⤵PID:2164
-
\??\c:\1tbbbh.exec:\1tbbbh.exe128⤵PID:2468
-
\??\c:\9nttnt.exec:\9nttnt.exe129⤵PID:1920
-
\??\c:\jjvpj.exec:\jjvpj.exe130⤵PID:4952
-
\??\c:\xffllrr.exec:\xffllrr.exe131⤵PID:3616
-
\??\c:\xffxlrf.exec:\xffxlrf.exe132⤵PID:3252
-
\??\c:\1tbbbb.exec:\1tbbbb.exe133⤵PID:4544
-
\??\c:\1btthb.exec:\1btthb.exe134⤵PID:4268
-
\??\c:\ddjvv.exec:\ddjvv.exe135⤵PID:632
-
\??\c:\rxflrrl.exec:\rxflrrl.exe136⤵PID:2136
-
\??\c:\rxlxfrx.exec:\rxlxfrx.exe137⤵PID:1112
-
\??\c:\nbbbtt.exec:\nbbbtt.exe138⤵PID:2552
-
\??\c:\ttttnt.exec:\ttttnt.exe139⤵PID:996
-
\??\c:\3vddp.exec:\3vddp.exe140⤵PID:4884
-
\??\c:\lflfxll.exec:\lflfxll.exe141⤵PID:2784
-
\??\c:\rrfrfxl.exec:\rrfrfxl.exe142⤵PID:3960
-
\??\c:\hnttnn.exec:\hnttnn.exe143⤵PID:2720
-
\??\c:\pjpjj.exec:\pjpjj.exe144⤵PID:3496
-
\??\c:\xrlfrxf.exec:\xrlfrxf.exe145⤵PID:5000
-
\??\c:\1rxrlrx.exec:\1rxrlrx.exe146⤵PID:3456
-
\??\c:\tthnnn.exec:\tthnnn.exe147⤵PID:5080
-
\??\c:\pdjpj.exec:\pdjpj.exe148⤵PID:5068
-
\??\c:\9vddv.exec:\9vddv.exe149⤵PID:3352
-
\??\c:\xrlfrxl.exec:\xrlfrxl.exe150⤵PID:2680
-
\??\c:\hbtbtb.exec:\hbtbtb.exe151⤵PID:4360
-
\??\c:\hnhtbb.exec:\hnhtbb.exe152⤵PID:4972
-
\??\c:\jvpdv.exec:\jvpdv.exe153⤵PID:4376
-
\??\c:\rrrrffl.exec:\rrrrffl.exe154⤵PID:4384
-
\??\c:\7rfxlll.exec:\7rfxlll.exe155⤵PID:4988
-
\??\c:\bbbnbn.exec:\bbbnbn.exe156⤵PID:4932
-
\??\c:\3vddv.exec:\3vddv.exe157⤵PID:4608
-
\??\c:\jppvv.exec:\jppvv.exe158⤵PID:3200
-
\??\c:\frxrlll.exec:\frxrlll.exe159⤵PID:2340
-
\??\c:\7fxxxxx.exec:\7fxxxxx.exe160⤵PID:768
-
\??\c:\thnnnt.exec:\thnnnt.exe161⤵PID:1040
-
\??\c:\ntbtnh.exec:\ntbtnh.exe162⤵PID:2304
-
\??\c:\5dddd.exec:\5dddd.exe163⤵PID:4168
-
\??\c:\5jppv.exec:\5jppv.exe164⤵PID:4888
-
\??\c:\frfxxxx.exec:\frfxxxx.exe165⤵PID:448
-
\??\c:\nhnnhh.exec:\nhnnhh.exe166⤵PID:3892
-
\??\c:\vpjjj.exec:\vpjjj.exe167⤵PID:1620
-
\??\c:\rxrlxxx.exec:\rxrlxxx.exe168⤵PID:1920
-
\??\c:\tthbhh.exec:\tthbhh.exe169⤵PID:2336
-
\??\c:\bhntnb.exec:\bhntnb.exe170⤵PID:4952
-
\??\c:\vvdvj.exec:\vvdvj.exe171⤵PID:4340
-
\??\c:\jddjj.exec:\jddjj.exe172⤵PID:2096
-
\??\c:\rllfxxx.exec:\rllfxxx.exe173⤵PID:2280
-
\??\c:\9xfxxxl.exec:\9xfxxxl.exe174⤵PID:4812
-
\??\c:\nnbbhh.exec:\nnbbhh.exe175⤵PID:3592
-
\??\c:\jdjjd.exec:\jdjjd.exe176⤵PID:2116
-
\??\c:\frrrrff.exec:\frrrrff.exe177⤵PID:3460
-
\??\c:\rfrlllf.exec:\rfrlllf.exe178⤵PID:1640
-
\??\c:\bnnnnn.exec:\bnnnnn.exe179⤵PID:2920
-
\??\c:\hbhnhh.exec:\hbhnhh.exe180⤵PID:4584
-
\??\c:\pdppv.exec:\pdppv.exe181⤵PID:2784
-
\??\c:\rflffff.exec:\rflffff.exe182⤵PID:2144
-
\??\c:\frllrrf.exec:\frllrrf.exe183⤵PID:4408
-
\??\c:\jvpjp.exec:\jvpjp.exe184⤵PID:1692
-
\??\c:\ddvjd.exec:\ddvjd.exe185⤵PID:2244
-
\??\c:\frrrrrl.exec:\frrrrrl.exe186⤵PID:4020
-
\??\c:\nntttt.exec:\nntttt.exe187⤵PID:1016
-
\??\c:\jdvvp.exec:\jdvvp.exe188⤵PID:816
-
\??\c:\flxxfff.exec:\flxxfff.exe189⤵PID:1388
-
\??\c:\hbnnnn.exec:\hbnnnn.exe190⤵PID:4276
-
\??\c:\dpddd.exec:\dpddd.exe191⤵PID:4516
-
\??\c:\ttnthn.exec:\ttnthn.exe192⤵PID:1028
-
\??\c:\bhhhhh.exec:\bhhhhh.exe193⤵PID:2152
-
\??\c:\vpvvv.exec:\vpvvv.exe194⤵PID:4384
-
\??\c:\jddvv.exec:\jddvv.exe195⤵PID:4988
-
\??\c:\1ffxllf.exec:\1ffxllf.exe196⤵PID:1688
-
\??\c:\ffffxxr.exec:\ffffxxr.exe197⤵PID:1648
-
\??\c:\bhnnnn.exec:\bhnnnn.exe198⤵PID:4252
-
\??\c:\htttnn.exec:\htttnn.exe199⤵PID:1500
-
\??\c:\djpjj.exec:\djpjj.exe200⤵PID:2800
-
\??\c:\vjppp.exec:\vjppp.exe201⤵PID:3568
-
\??\c:\9rxxxxx.exec:\9rxxxxx.exe202⤵PID:4168
-
\??\c:\lfrlrrl.exec:\lfrlrrl.exe203⤵PID:2952
-
\??\c:\tnbbtb.exec:\tnbbtb.exe204⤵PID:1612
-
\??\c:\nbhhtb.exec:\nbhhtb.exe205⤵PID:1628
-
\??\c:\vpvpj.exec:\vpvpj.exe206⤵PID:1720
-
\??\c:\9dppj.exec:\9dppj.exe207⤵PID:3764
-
\??\c:\5rrlrxr.exec:\5rrlrxr.exe208⤵PID:4656
-
\??\c:\flxxxxx.exec:\flxxxxx.exe209⤵PID:4680
-
\??\c:\tnbbbb.exec:\tnbbbb.exe210⤵PID:4340
-
\??\c:\tbnnhh.exec:\tbnnhh.exe211⤵PID:4544
-
\??\c:\jvdvp.exec:\jvdvp.exe212⤵PID:3360
-
\??\c:\vjjjj.exec:\vjjjj.exe213⤵PID:2208
-
\??\c:\rflfffx.exec:\rflfffx.exe214⤵PID:1748
-
\??\c:\rrrxrll.exec:\rrrxrll.exe215⤵PID:2084
-
\??\c:\hhnntt.exec:\hhnntt.exe216⤵PID:4632
-
\??\c:\3hbbbh.exec:\3hbbbh.exe217⤵PID:2180
-
\??\c:\vpppj.exec:\vpppj.exe218⤵PID:3552
-
\??\c:\jjppj.exec:\jjppj.exe219⤵PID:3036
-
\??\c:\rxfxrxr.exec:\rxfxrxr.exe220⤵PID:1716
-
\??\c:\frrllll.exec:\frrllll.exe221⤵PID:3504
-
\??\c:\ttbhbb.exec:\ttbhbb.exe222⤵PID:3864
-
\??\c:\ppvpj.exec:\ppvpj.exe223⤵PID:4320
-
\??\c:\jdddv.exec:\jdddv.exe224⤵PID:2812
-
\??\c:\fffxxrr.exec:\fffxxrr.exe225⤵PID:1692
-
\??\c:\ffffxfx.exec:\ffffxfx.exe226⤵PID:1132
-
\??\c:\bhhhtb.exec:\bhhhtb.exe227⤵PID:5068
-
\??\c:\vpvpj.exec:\vpvpj.exe228⤵PID:1016
-
\??\c:\3djpj.exec:\3djpj.exe229⤵PID:816
-
\??\c:\1jppj.exec:\1jppj.exe230⤵PID:1388
-
\??\c:\xfrxxlf.exec:\xfrxxlf.exe231⤵PID:3704
-
\??\c:\xrllfff.exec:\xrllfff.exe232⤵PID:4376
-
\??\c:\hntnnn.exec:\hntnnn.exe233⤵PID:4712
-
\??\c:\3vjpp.exec:\3vjpp.exe234⤵PID:2152
-
\??\c:\vjpvv.exec:\vjpvv.exe235⤵PID:4384
-
\??\c:\lflfxlf.exec:\lflfxlf.exe236⤵PID:4608
-
\??\c:\fxllfff.exec:\fxllfff.exe237⤵PID:3200
-
\??\c:\tnnntb.exec:\tnnntb.exe238⤵PID:3852
-
\??\c:\tttttt.exec:\tttttt.exe239⤵PID:4252
-
\??\c:\7pppd.exec:\7pppd.exe240⤵PID:1500
-
\??\c:\3jpdv.exec:\3jpdv.exe241⤵PID:2800
-
\??\c:\lfrrrrx.exec:\lfrrrrx.exe242⤵PID:4264