Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 03:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5fa1a1b4221ee7c0daf3581b60811db0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
5fa1a1b4221ee7c0daf3581b60811db0_NeikiAnalytics.exe
-
Size
100KB
-
MD5
5fa1a1b4221ee7c0daf3581b60811db0
-
SHA1
3aa678f0ff63d2ab2fab3d33baf3a7eba38c2a81
-
SHA256
c7d1269f74d9f35812b6e916a035012bd2a8638abcfe50abc56eb0ce773a35e3
-
SHA512
c403805063c385d1a745fde7e9ba14b3fc2e4ccfd25c1dde4b0f77a7d0ccf36843eef1e0e5b0301fd741bcb55e44f563860c866cb63c13b3a6fc9327d5f381b5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDodtzn6zDaE0R59l:ymb3NkkiQ3mdBjFodt2zE3L
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/1760-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2360-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1316-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2328-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2092-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1596-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1504-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/572-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1256-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xxlrffl.exe1hbntt.exe9ppdj.exexxrxlxf.exelfflrxf.exebbntbh.exedpdpj.exerfrflrf.exerrffrxf.exetnbbtt.exevpddj.exelfllxfl.exerlxxffl.exehhbntn.exejvvpj.exeffrxlrx.exellfxflf.exe1nbhnt.exetnbnhn.exe7xrrflf.exexrffrff.exehbhhnn.exedvvjp.exedjpdd.exelflrfrf.exe9bhnbb.exenbhbnb.exejdvvv.exellxfxxl.exenhtnbh.exeddppp.exellllrlx.exe5xlxrxl.exennbhhh.exetbnbbn.exe7pdjp.exe3vvjj.exe3fflrxl.exerrfxlxf.exe3rrlrxl.exehbntbt.exennthbn.exejvpvj.exejjjvv.exe5lffrxx.exe5rxxffx.exehhbnnb.exettnthn.exeppddj.exexxrrrxf.exefxrrflx.exetnntbh.exe9btbnn.exebbthth.exejdjdj.exedvpvj.exe7llxrrx.exeffxxfll.exeththtt.exennhhnt.exejjdpj.exevppvj.exerlrrxxl.exeffxxflr.exepid process 2476 xxlrffl.exe 2744 1hbntt.exe 2360 9ppdj.exe 2788 xxrxlxf.exe 1316 lfflrxf.exe 2844 bbntbh.exe 2668 dpdpj.exe 2604 rfrflrf.exe 2328 rrffrxf.exe 1520 tnbbtt.exe 2092 vpddj.exe 1596 lfllxfl.exe 2936 rlxxffl.exe 2616 hhbntn.exe 2824 jvvpj.exe 2812 ffrxlrx.exe 2952 llfxflf.exe 1504 1nbhnt.exe 572 tnbnhn.exe 1256 7xrrflf.exe 816 xrffrff.exe 2352 hbhhnn.exe 2028 dvvjp.exe 1108 djpdd.exe 1376 lflrfrf.exe 1544 9bhnbb.exe 1252 nbhbnb.exe 1796 jdvvv.exe 3028 llxfxxl.exe 1964 nhtnbh.exe 1580 ddppp.exe 2284 llllrlx.exe 1760 5xlxrxl.exe 808 nnbhhh.exe 3036 tbnbbn.exe 2292 7pdjp.exe 2412 3vvjj.exe 2772 3fflrxl.exe 2992 rrfxlxf.exe 2672 3rrlrxl.exe 2880 hbntbt.exe 2844 nnthbn.exe 2720 jvpvj.exe 2668 jjjvv.exe 2608 5lffrxx.exe 1668 5rxxffx.exe 2964 hhbnnb.exe 2008 ttnthn.exe 2396 ppddj.exe 2136 xxrrrxf.exe 308 fxrrflx.exe 2816 tnntbh.exe 2736 9btbnn.exe 1320 bbthth.exe 1812 jdjdj.exe 1512 dvpvj.exe 1280 7llxrrx.exe 2152 ffxxfll.exe 672 ththtt.exe 2536 nnhhnt.exe 2060 jjdpj.exe 1720 vppvj.exe 576 rlrrxxl.exe 1780 ffxxflr.exe -
Processes:
resource yara_rule behavioral1/memory/1760-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1316-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1596-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1504-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/572-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1256-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-279-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5fa1a1b4221ee7c0daf3581b60811db0_NeikiAnalytics.exexxlrffl.exe1hbntt.exe9ppdj.exexxrxlxf.exelfflrxf.exebbntbh.exedpdpj.exerfrflrf.exerrffrxf.exetnbbtt.exevpddj.exelfllxfl.exerlxxffl.exehhbntn.exejvvpj.exedescription pid process target process PID 1760 wrote to memory of 2476 1760 5fa1a1b4221ee7c0daf3581b60811db0_NeikiAnalytics.exe xxlrffl.exe PID 1760 wrote to memory of 2476 1760 5fa1a1b4221ee7c0daf3581b60811db0_NeikiAnalytics.exe xxlrffl.exe PID 1760 wrote to memory of 2476 1760 5fa1a1b4221ee7c0daf3581b60811db0_NeikiAnalytics.exe xxlrffl.exe PID 1760 wrote to memory of 2476 1760 5fa1a1b4221ee7c0daf3581b60811db0_NeikiAnalytics.exe xxlrffl.exe PID 2476 wrote to memory of 2744 2476 xxlrffl.exe 1hbntt.exe PID 2476 wrote to memory of 2744 2476 xxlrffl.exe 1hbntt.exe PID 2476 wrote to memory of 2744 2476 xxlrffl.exe 1hbntt.exe PID 2476 wrote to memory of 2744 2476 xxlrffl.exe 1hbntt.exe PID 2744 wrote to memory of 2360 2744 1hbntt.exe 9ppdj.exe PID 2744 wrote to memory of 2360 2744 1hbntt.exe 9ppdj.exe PID 2744 wrote to memory of 2360 2744 1hbntt.exe 9ppdj.exe PID 2744 wrote to memory of 2360 2744 1hbntt.exe 9ppdj.exe PID 2360 wrote to memory of 2788 2360 9ppdj.exe xxrxlxf.exe PID 2360 wrote to memory of 2788 2360 9ppdj.exe xxrxlxf.exe PID 2360 wrote to memory of 2788 2360 9ppdj.exe xxrxlxf.exe PID 2360 wrote to memory of 2788 2360 9ppdj.exe xxrxlxf.exe PID 2788 wrote to memory of 1316 2788 xxrxlxf.exe lfflrxf.exe PID 2788 wrote to memory of 1316 2788 xxrxlxf.exe lfflrxf.exe PID 2788 wrote to memory of 1316 2788 xxrxlxf.exe lfflrxf.exe PID 2788 wrote to memory of 1316 2788 xxrxlxf.exe lfflrxf.exe PID 1316 wrote to memory of 2844 1316 lfflrxf.exe bbntbh.exe PID 1316 wrote to memory of 2844 1316 lfflrxf.exe bbntbh.exe PID 1316 wrote to memory of 2844 1316 lfflrxf.exe bbntbh.exe PID 1316 wrote to memory of 2844 1316 lfflrxf.exe bbntbh.exe PID 2844 wrote to memory of 2668 2844 bbntbh.exe dpdpj.exe PID 2844 wrote to memory of 2668 2844 bbntbh.exe dpdpj.exe PID 2844 wrote to memory of 2668 2844 bbntbh.exe dpdpj.exe PID 2844 wrote to memory of 2668 2844 bbntbh.exe dpdpj.exe PID 2668 wrote to memory of 2604 2668 dpdpj.exe rfrflrf.exe PID 2668 wrote to memory of 2604 2668 dpdpj.exe rfrflrf.exe PID 2668 wrote to memory of 2604 2668 dpdpj.exe rfrflrf.exe PID 2668 wrote to memory of 2604 2668 dpdpj.exe rfrflrf.exe PID 2604 wrote to memory of 2328 2604 rfrflrf.exe rrffrxf.exe PID 2604 wrote to memory of 2328 2604 rfrflrf.exe rrffrxf.exe PID 2604 wrote to memory of 2328 2604 rfrflrf.exe rrffrxf.exe PID 2604 wrote to memory of 2328 2604 rfrflrf.exe rrffrxf.exe PID 2328 wrote to memory of 1520 2328 rrffrxf.exe tnbbtt.exe PID 2328 wrote to memory of 1520 2328 rrffrxf.exe tnbbtt.exe PID 2328 wrote to memory of 1520 2328 rrffrxf.exe tnbbtt.exe PID 2328 wrote to memory of 1520 2328 rrffrxf.exe tnbbtt.exe PID 1520 wrote to memory of 2092 1520 tnbbtt.exe vpddj.exe PID 1520 wrote to memory of 2092 1520 tnbbtt.exe vpddj.exe PID 1520 wrote to memory of 2092 1520 tnbbtt.exe vpddj.exe PID 1520 wrote to memory of 2092 1520 tnbbtt.exe vpddj.exe PID 2092 wrote to memory of 1596 2092 vpddj.exe lfllxfl.exe PID 2092 wrote to memory of 1596 2092 vpddj.exe lfllxfl.exe PID 2092 wrote to memory of 1596 2092 vpddj.exe lfllxfl.exe PID 2092 wrote to memory of 1596 2092 vpddj.exe lfllxfl.exe PID 1596 wrote to memory of 2936 1596 lfllxfl.exe rlxxffl.exe PID 1596 wrote to memory of 2936 1596 lfllxfl.exe rlxxffl.exe PID 1596 wrote to memory of 2936 1596 lfllxfl.exe rlxxffl.exe PID 1596 wrote to memory of 2936 1596 lfllxfl.exe rlxxffl.exe PID 2936 wrote to memory of 2616 2936 rlxxffl.exe hhbntn.exe PID 2936 wrote to memory of 2616 2936 rlxxffl.exe hhbntn.exe PID 2936 wrote to memory of 2616 2936 rlxxffl.exe hhbntn.exe PID 2936 wrote to memory of 2616 2936 rlxxffl.exe hhbntn.exe PID 2616 wrote to memory of 2824 2616 hhbntn.exe jvvpj.exe PID 2616 wrote to memory of 2824 2616 hhbntn.exe jvvpj.exe PID 2616 wrote to memory of 2824 2616 hhbntn.exe jvvpj.exe PID 2616 wrote to memory of 2824 2616 hhbntn.exe jvvpj.exe PID 2824 wrote to memory of 2812 2824 jvvpj.exe ffrxlrx.exe PID 2824 wrote to memory of 2812 2824 jvvpj.exe ffrxlrx.exe PID 2824 wrote to memory of 2812 2824 jvvpj.exe ffrxlrx.exe PID 2824 wrote to memory of 2812 2824 jvvpj.exe ffrxlrx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5fa1a1b4221ee7c0daf3581b60811db0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5fa1a1b4221ee7c0daf3581b60811db0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\xxlrffl.exec:\xxlrffl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\1hbntt.exec:\1hbntt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\9ppdj.exec:\9ppdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\xxrxlxf.exec:\xxrxlxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\lfflrxf.exec:\lfflrxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\bbntbh.exec:\bbntbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\dpdpj.exec:\dpdpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\rfrflrf.exec:\rfrflrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\rrffrxf.exec:\rrffrxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\tnbbtt.exec:\tnbbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\vpddj.exec:\vpddj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\lfllxfl.exec:\lfllxfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\rlxxffl.exec:\rlxxffl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\hhbntn.exec:\hhbntn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\jvvpj.exec:\jvvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\ffrxlrx.exec:\ffrxlrx.exe17⤵
- Executes dropped EXE
PID:2812 -
\??\c:\llfxflf.exec:\llfxflf.exe18⤵
- Executes dropped EXE
PID:2952 -
\??\c:\1nbhnt.exec:\1nbhnt.exe19⤵
- Executes dropped EXE
PID:1504 -
\??\c:\tnbnhn.exec:\tnbnhn.exe20⤵
- Executes dropped EXE
PID:572 -
\??\c:\7xrrflf.exec:\7xrrflf.exe21⤵
- Executes dropped EXE
PID:1256 -
\??\c:\xrffrff.exec:\xrffrff.exe22⤵
- Executes dropped EXE
PID:816 -
\??\c:\hbhhnn.exec:\hbhhnn.exe23⤵
- Executes dropped EXE
PID:2352 -
\??\c:\dvvjp.exec:\dvvjp.exe24⤵
- Executes dropped EXE
PID:2028 -
\??\c:\djpdd.exec:\djpdd.exe25⤵
- Executes dropped EXE
PID:1108 -
\??\c:\lflrfrf.exec:\lflrfrf.exe26⤵
- Executes dropped EXE
PID:1376 -
\??\c:\9bhnbb.exec:\9bhnbb.exe27⤵
- Executes dropped EXE
PID:1544 -
\??\c:\nbhbnb.exec:\nbhbnb.exe28⤵
- Executes dropped EXE
PID:1252 -
\??\c:\jdvvv.exec:\jdvvv.exe29⤵
- Executes dropped EXE
PID:1796 -
\??\c:\llxfxxl.exec:\llxfxxl.exe30⤵
- Executes dropped EXE
PID:3028 -
\??\c:\nhtnbh.exec:\nhtnbh.exe31⤵
- Executes dropped EXE
PID:1964 -
\??\c:\ddppp.exec:\ddppp.exe32⤵
- Executes dropped EXE
PID:1580 -
\??\c:\llllrlx.exec:\llllrlx.exe33⤵
- Executes dropped EXE
PID:2284 -
\??\c:\5xlxrxl.exec:\5xlxrxl.exe34⤵
- Executes dropped EXE
PID:1760 -
\??\c:\nnbhhh.exec:\nnbhhh.exe35⤵
- Executes dropped EXE
PID:808 -
\??\c:\tbnbbn.exec:\tbnbbn.exe36⤵
- Executes dropped EXE
PID:3036 -
\??\c:\7pdjp.exec:\7pdjp.exe37⤵
- Executes dropped EXE
PID:2292 -
\??\c:\3vvjj.exec:\3vvjj.exe38⤵
- Executes dropped EXE
PID:2412 -
\??\c:\3fflrxl.exec:\3fflrxl.exe39⤵
- Executes dropped EXE
PID:2772 -
\??\c:\rrfxlxf.exec:\rrfxlxf.exe40⤵
- Executes dropped EXE
PID:2992 -
\??\c:\3rrlrxl.exec:\3rrlrxl.exe41⤵
- Executes dropped EXE
PID:2672 -
\??\c:\hbntbt.exec:\hbntbt.exe42⤵
- Executes dropped EXE
PID:2880 -
\??\c:\nnthbn.exec:\nnthbn.exe43⤵
- Executes dropped EXE
PID:2844 -
\??\c:\jvpvj.exec:\jvpvj.exe44⤵
- Executes dropped EXE
PID:2720 -
\??\c:\jjjvv.exec:\jjjvv.exe45⤵
- Executes dropped EXE
PID:2668 -
\??\c:\5lffrxx.exec:\5lffrxx.exe46⤵
- Executes dropped EXE
PID:2608 -
\??\c:\5rxxffx.exec:\5rxxffx.exe47⤵
- Executes dropped EXE
PID:1668 -
\??\c:\hhbnnb.exec:\hhbnnb.exe48⤵
- Executes dropped EXE
PID:2964 -
\??\c:\ttnthn.exec:\ttnthn.exe49⤵
- Executes dropped EXE
PID:2008 -
\??\c:\ppddj.exec:\ppddj.exe50⤵
- Executes dropped EXE
PID:2396 -
\??\c:\xxrrrxf.exec:\xxrrrxf.exe51⤵
- Executes dropped EXE
PID:2136 -
\??\c:\fxrrflx.exec:\fxrrflx.exe52⤵
- Executes dropped EXE
PID:308 -
\??\c:\tnntbh.exec:\tnntbh.exe53⤵
- Executes dropped EXE
PID:2816 -
\??\c:\9btbnn.exec:\9btbnn.exe54⤵
- Executes dropped EXE
PID:2736 -
\??\c:\bbthth.exec:\bbthth.exe55⤵
- Executes dropped EXE
PID:1320 -
\??\c:\jdjdj.exec:\jdjdj.exe56⤵
- Executes dropped EXE
PID:1812 -
\??\c:\dvpvj.exec:\dvpvj.exe57⤵
- Executes dropped EXE
PID:1512 -
\??\c:\7llxrrx.exec:\7llxrrx.exe58⤵
- Executes dropped EXE
PID:1280 -
\??\c:\ffxxfll.exec:\ffxxfll.exe59⤵
- Executes dropped EXE
PID:2152 -
\??\c:\ththtt.exec:\ththtt.exe60⤵
- Executes dropped EXE
PID:672 -
\??\c:\nnhhnt.exec:\nnhhnt.exe61⤵
- Executes dropped EXE
PID:2536 -
\??\c:\jjdpj.exec:\jjdpj.exe62⤵
- Executes dropped EXE
PID:2060 -
\??\c:\vppvj.exec:\vppvj.exe63⤵
- Executes dropped EXE
PID:1720 -
\??\c:\rlrrxxl.exec:\rlrrxxl.exe64⤵
- Executes dropped EXE
PID:576 -
\??\c:\ffxxflr.exec:\ffxxflr.exe65⤵
- Executes dropped EXE
PID:1780 -
\??\c:\xlflxfr.exec:\xlflxfr.exe66⤵PID:1820
-
\??\c:\tnbhnt.exec:\tnbhnt.exe67⤵PID:1344
-
\??\c:\nnhhtt.exec:\nnhhtt.exe68⤵PID:1944
-
\??\c:\pvjpv.exec:\pvjpv.exe69⤵PID:2200
-
\??\c:\pddpp.exec:\pddpp.exe70⤵PID:2368
-
\??\c:\rlfflrf.exec:\rlfflrf.exe71⤵PID:2228
-
\??\c:\rfrxlrl.exec:\rfrxlrl.exe72⤵PID:1988
-
\??\c:\nhhnnt.exec:\nhhnnt.exe73⤵PID:2144
-
\??\c:\tnhthh.exec:\tnhthh.exe74⤵PID:904
-
\??\c:\bnhthn.exec:\bnhthn.exe75⤵PID:1864
-
\??\c:\jdvjv.exec:\jdvjv.exe76⤵PID:2260
-
\??\c:\5jvjp.exec:\5jvjp.exe77⤵PID:1564
-
\??\c:\lxflxxl.exec:\lxflxxl.exe78⤵PID:2416
-
\??\c:\llflffx.exec:\llflffx.exe79⤵PID:2744
-
\??\c:\3bhnth.exec:\3bhnth.exe80⤵PID:2704
-
\??\c:\9nbbbn.exec:\9nbbbn.exe81⤵PID:2360
-
\??\c:\7dvvd.exec:\7dvvd.exe82⤵PID:2688
-
\??\c:\dvddp.exec:\dvddp.exe83⤵PID:2096
-
\??\c:\3xrxflx.exec:\3xrxflx.exe84⤵PID:2836
-
\??\c:\xrxrxlx.exec:\xrxrxlx.exe85⤵PID:2692
-
\??\c:\9hthnt.exec:\9hthnt.exe86⤵PID:2576
-
\??\c:\5btbhn.exec:\5btbhn.exe87⤵PID:2620
-
\??\c:\7jvdp.exec:\7jvdp.exe88⤵PID:2168
-
\??\c:\7vpvv.exec:\7vpvv.exe89⤵PID:2608
-
\??\c:\rrxxlxl.exec:\rrxxlxl.exe90⤵PID:2820
-
\??\c:\xrllxfr.exec:\xrllxfr.exe91⤵PID:1996
-
\??\c:\3fxfrfr.exec:\3fxfrfr.exe92⤵PID:2072
-
\??\c:\hhtbnt.exec:\hhtbnt.exe93⤵PID:1616
-
\??\c:\bnhnbh.exec:\bnhnbh.exe94⤵PID:2860
-
\??\c:\ppjjv.exec:\ppjjv.exe95⤵PID:2816
-
\??\c:\1dvpd.exec:\1dvpd.exe96⤵PID:1800
-
\??\c:\lxrxlrf.exec:\lxrxlrf.exe97⤵PID:2968
-
\??\c:\5xrfffl.exec:\5xrfffl.exe98⤵PID:1808
-
\??\c:\bbtnhh.exec:\bbtnhh.exe99⤵PID:1512
-
\??\c:\nbntbh.exec:\nbntbh.exe100⤵PID:2052
-
\??\c:\5btthh.exec:\5btthh.exe101⤵PID:2064
-
\??\c:\vvdvj.exec:\vvdvj.exe102⤵PID:776
-
\??\c:\vjjpd.exec:\vjjpd.exe103⤵PID:2464
-
\??\c:\3rrfllr.exec:\3rrfllr.exe104⤵PID:3008
-
\??\c:\7lflxxl.exec:\7lflxxl.exe105⤵PID:2220
-
\??\c:\nbnntt.exec:\nbnntt.exe106⤵PID:896
-
\??\c:\bthhtt.exec:\bthhtt.exe107⤵PID:848
-
\??\c:\hhtnhn.exec:\hhtnhn.exe108⤵PID:2164
-
\??\c:\pdpjp.exec:\pdpjp.exe109⤵PID:1352
-
\??\c:\dvpjv.exec:\dvpjv.exe110⤵PID:1060
-
\??\c:\xrfxlxl.exec:\xrfxlxl.exe111⤵PID:924
-
\??\c:\5lxffrx.exec:\5lxffrx.exe112⤵PID:2200
-
\??\c:\1hnnbn.exec:\1hnnbn.exe113⤵PID:1732
-
\??\c:\nhthtt.exec:\nhthtt.exe114⤵PID:844
-
\??\c:\nhntbh.exec:\nhntbh.exe115⤵PID:1000
-
\??\c:\jdvjd.exec:\jdvjd.exe116⤵PID:660
-
\??\c:\9ppvd.exec:\9ppvd.exe117⤵PID:2376
-
\??\c:\rlxflxf.exec:\rlxflxf.exe118⤵PID:856
-
\??\c:\llfrlxf.exec:\llfrlxf.exe119⤵PID:1684
-
\??\c:\3nhthn.exec:\3nhthn.exe120⤵PID:2476
-
\??\c:\3bbthh.exec:\3bbthh.exe121⤵PID:2004
-
\??\c:\ppvvp.exec:\ppvvp.exe122⤵PID:2768
-
\??\c:\pjvdj.exec:\pjvdj.exe123⤵PID:2752
-
\??\c:\fxlfrrx.exec:\fxlfrrx.exe124⤵PID:2564
-
\??\c:\lllxlfl.exec:\lllxlfl.exe125⤵PID:1316
-
\??\c:\hbnntb.exec:\hbnntb.exe126⤵PID:2600
-
\??\c:\ddvjp.exec:\ddvjp.exe127⤵PID:2580
-
\??\c:\pjdjv.exec:\pjdjv.exe128⤵PID:2612
-
\??\c:\dvjjd.exec:\dvjjd.exe129⤵PID:2204
-
\??\c:\3lllxxf.exec:\3lllxxf.exe130⤵PID:272
-
\??\c:\fxrrflx.exec:\fxrrflx.exe131⤵PID:1668
-
\??\c:\hhthnt.exec:\hhthnt.exe132⤵PID:2188
-
\??\c:\tnbhtt.exec:\tnbhtt.exe133⤵PID:1552
-
\??\c:\7vjpd.exec:\7vjpd.exe134⤵PID:1920
-
\??\c:\dvvjv.exec:\dvvjv.exe135⤵PID:1792
-
\??\c:\5fffrrl.exec:\5fffrrl.exe136⤵PID:2800
-
\??\c:\rlflrrf.exec:\rlflrrf.exe137⤵PID:2616
-
\??\c:\btnhth.exec:\btnhth.exe138⤵PID:2908
-
\??\c:\1btttb.exec:\1btttb.exe139⤵PID:2732
-
\??\c:\hbtbnt.exec:\hbtbnt.exe140⤵PID:2952
-
\??\c:\9vppd.exec:\9vppd.exe141⤵PID:1872
-
\??\c:\3vvjp.exec:\3vvjp.exe142⤵PID:1728
-
\??\c:\rrlxfrf.exec:\rrlxfrf.exe143⤵PID:2152
-
\??\c:\lfrxlrx.exec:\lfrxlrx.exe144⤵PID:2104
-
\??\c:\xxlflrf.exec:\xxlflrf.exe145⤵PID:2536
-
\??\c:\bthttb.exec:\bthttb.exe146⤵PID:1680
-
\??\c:\hhttnt.exec:\hhttnt.exe147⤵PID:1300
-
\??\c:\pjvvp.exec:\pjvvp.exe148⤵PID:1980
-
\??\c:\pjjdj.exec:\pjjdj.exe149⤵PID:1624
-
\??\c:\rlfflrx.exec:\rlfflrx.exe150⤵PID:1784
-
\??\c:\rfrxrfr.exec:\rfrxrfr.exe151⤵PID:1344
-
\??\c:\tnbthh.exec:\tnbthh.exe152⤵PID:2540
-
\??\c:\3dppv.exec:\3dppv.exe153⤵PID:2420
-
\??\c:\pjpdv.exec:\pjpdv.exe154⤵PID:924
-
\??\c:\pdjpj.exec:\pdjpj.exe155⤵PID:1188
-
\??\c:\xxrxrxl.exec:\xxrxrxl.exe156⤵PID:1708
-
\??\c:\rlflxfl.exec:\rlflxfl.exe157⤵PID:2144
-
\??\c:\tnbhbt.exec:\tnbhbt.exe158⤵PID:2196
-
\??\c:\btbbnb.exec:\btbbnb.exe159⤵PID:660
-
\??\c:\pjpvd.exec:\pjpvd.exe160⤵PID:2176
-
\??\c:\pjdjv.exec:\pjdjv.exe161⤵PID:1564
-
\??\c:\rrflflx.exec:\rrflflx.exe162⤵PID:2972
-
\??\c:\3fxfflx.exec:\3fxfflx.exe163⤵PID:2700
-
\??\c:\btnbnn.exec:\btnbnn.exe164⤵PID:3000
-
\??\c:\1hbbnb.exec:\1hbbnb.exe165⤵PID:2680
-
\??\c:\1dpvv.exec:\1dpvv.exe166⤵PID:2716
-
\??\c:\jdvjd.exec:\jdvjd.exe167⤵PID:2596
-
\??\c:\1frflrx.exec:\1frflrx.exe168⤵PID:2780
-
\??\c:\nhbtbn.exec:\nhbtbn.exe169⤵PID:2776
-
\??\c:\nhbnbb.exec:\nhbnbb.exe170⤵PID:860
-
\??\c:\vdvjp.exec:\vdvjp.exe171⤵PID:2620
-
\??\c:\dvvdp.exec:\dvvdp.exe172⤵PID:2728
-
\??\c:\fxlrflx.exec:\fxlrflx.exe173⤵PID:1520
-
\??\c:\frlxflx.exec:\frlxflx.exe174⤵PID:2232
-
\??\c:\ttnhtt.exec:\ttnhtt.exe175⤵PID:1996
-
\??\c:\nhtthn.exec:\nhtthn.exe176⤵PID:2396
-
\??\c:\pdpdp.exec:\pdpdp.exe177⤵PID:1616
-
\??\c:\jjjdd.exec:\jjjdd.exe178⤵PID:1608
-
\??\c:\llxlrfr.exec:\llxlrfr.exe179⤵PID:2928
-
\??\c:\lfflxff.exec:\lfflxff.exe180⤵PID:2924
-
\??\c:\bbbhtb.exec:\bbbhtb.exe181⤵PID:1804
-
\??\c:\jdvvv.exec:\jdvvv.exe182⤵PID:532
-
\??\c:\jdpvv.exec:\jdpvv.exe183⤵PID:2036
-
\??\c:\3vjjp.exec:\3vjjp.exe184⤵PID:1280
-
\??\c:\5xxrrrx.exec:\5xxrrrx.exe185⤵PID:684
-
\??\c:\1bbhnb.exec:\1bbhnb.exe186⤵PID:672
-
\??\c:\hthhnn.exec:\hthhnn.exe187⤵PID:3020
-
\??\c:\vjvvd.exec:\vjvvd.exe188⤵PID:2920
-
\??\c:\7jvdj.exec:\7jvdj.exe189⤵PID:2220
-
\??\c:\rffxfff.exec:\rffxfff.exe190⤵PID:1108
-
\??\c:\lrxxfxx.exec:\lrxxfxx.exe191⤵PID:404
-
\??\c:\ttntbh.exec:\ttntbh.exe192⤵PID:820
-
\??\c:\btthhn.exec:\btthhn.exe193⤵PID:2256
-
\??\c:\1dvjj.exec:\1dvjj.exe194⤵PID:1252
-
\??\c:\3dpvd.exec:\3dpvd.exe195⤵PID:1824
-
\??\c:\9frrffx.exec:\9frrffx.exe196⤵PID:832
-
\??\c:\7llffxr.exec:\7llffxr.exe197⤵PID:2228
-
\??\c:\bntbbt.exec:\bntbbt.exe198⤵PID:2108
-
\??\c:\hbhttt.exec:\hbhttt.exe199⤵PID:1740
-
\??\c:\jvjjp.exec:\jvjjp.exe200⤵PID:2448
-
\??\c:\vjvvv.exec:\vjvvv.exe201⤵PID:2376
-
\??\c:\rlxrrlr.exec:\rlxrrlr.exe202⤵PID:1704
-
\??\c:\rlxlxxl.exec:\rlxlxxl.exe203⤵PID:1676
-
\??\c:\hthbtb.exec:\hthbtb.exe204⤵PID:2384
-
\??\c:\ntbtth.exec:\ntbtth.exe205⤵PID:2760
-
\??\c:\pdjpd.exec:\pdjpd.exe206⤵PID:2764
-
\??\c:\jvvpd.exec:\jvvpd.exe207⤵PID:2704
-
\??\c:\lxfxfff.exec:\lxfxfff.exe208⤵PID:2988
-
\??\c:\jdjpj.exec:\jdjpj.exe209⤵PID:2912
-
\??\c:\9fxflll.exec:\9fxflll.exe210⤵PID:2556
-
\??\c:\9rlxfff.exec:\9rlxfff.exe211⤵PID:2844
-
\??\c:\1hbhtt.exec:\1hbhtt.exe212⤵PID:2676
-
\??\c:\9nhnnb.exec:\9nhnnb.exe213⤵PID:2172
-
\??\c:\3jdvd.exec:\3jdvd.exe214⤵PID:2976
-
\??\c:\dppvd.exec:\dppvd.exe215⤵PID:2956
-
\??\c:\lfffrrf.exec:\lfffrrf.exe216⤵PID:2092
-
\??\c:\xrxlxfl.exec:\xrxlxfl.exe217⤵PID:3044
-
\??\c:\9ttnbh.exec:\9ttnbh.exe218⤵PID:2136
-
\??\c:\7nbbhh.exec:\7nbbhh.exe219⤵PID:1712
-
\??\c:\vjdvd.exec:\vjdvd.exe220⤵PID:2868
-
\??\c:\7dddd.exec:\7dddd.exe221⤵PID:2856
-
\??\c:\3xrxffl.exec:\3xrxffl.exe222⤵PID:2884
-
\??\c:\fxllxxf.exec:\fxllxxf.exe223⤵PID:1916
-
\??\c:\nhnbhb.exec:\nhnbhb.exe224⤵PID:1516
-
\??\c:\nhttbb.exec:\nhttbb.exe225⤵PID:2528
-
\??\c:\dvjpv.exec:\dvjpv.exe226⤵PID:2064
-
\??\c:\9jjvp.exec:\9jjvp.exe227⤵PID:540
-
\??\c:\xrxllrx.exec:\xrxllrx.exe228⤵PID:2740
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe229⤵PID:3016
-
\??\c:\nhttht.exec:\nhttht.exe230⤵PID:3020
-
\??\c:\nthhnn.exec:\nthhnn.exe231⤵PID:2028
-
\??\c:\jjjvd.exec:\jjjvd.exe232⤵PID:1780
-
\??\c:\vjdjp.exec:\vjdjp.exe233⤵PID:848
-
\??\c:\3xflrlx.exec:\3xflrlx.exe234⤵PID:2484
-
\??\c:\rrfrxfl.exec:\rrfrxfl.exe235⤵PID:1868
-
\??\c:\bhnhnh.exec:\bhnhnh.exe236⤵PID:868
-
\??\c:\nnhntb.exec:\nnhntb.exe237⤵PID:3024
-
\??\c:\pjdvp.exec:\pjdvp.exe238⤵PID:3028
-
\??\c:\3xxlrxf.exec:\3xxlrxf.exe239⤵PID:1964
-
\??\c:\1xrrfxf.exec:\1xrrfxf.exe240⤵PID:2012
-
\??\c:\rrllxfl.exec:\rrllxfl.exe241⤵PID:2488
-
\??\c:\tnhhbh.exec:\tnhhbh.exe242⤵PID:2840