Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 21:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0651852c0373060e36078b06dcf80a30_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0651852c0373060e36078b06dcf80a30_NeikiAnalytics.exe
-
Size
64KB
-
MD5
0651852c0373060e36078b06dcf80a30
-
SHA1
c375e8b0cadffc7d58baf8bb7e08763467d51bf5
-
SHA256
3469cc45353e56ce90c4d3ed02788998b05e9edf42ee8c5541755bb8598970df
-
SHA512
de803a3a9c8084c77b6f06f97d04db7e4304c60dae22299ac33afefbd7981b29d6c177569a7b4be1fd8a05e8e9c03fb4cb584541c3a8e841e52a000e7d7c2972
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIhJm/wn:ymb3NkkiQ3mdBjFILmM
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral1/memory/2336-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2252-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2092-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2452-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1916-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1316-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/540-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1468-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/840-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1640-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/768-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/908-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1252-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
hhnntt.exe6240624.exe9vddv.exem4628.exebhtnth.exe3bhbhn.exexlxrflr.exebthnbh.exenbhbbn.exec600040.exexrllrrx.exe2640268.exebtbntn.exei864242.exetnbhtb.exenntbnh.exe5jvvd.exe2868242.exedvpdp.exerlfxlrf.exew02646.exebbnnbh.exenhtbnn.exepvpvj.exevppvp.exevpdvd.exei086880.exe7dvpd.exe60840.exehbthtb.exe022444.exe08680.exe8624008.exe88466.exerxlfrrl.exehbnntb.exe7btbnn.exe42064.exe0484408.exe1jjpd.exe864622.exebthhtn.exe4244020.exe1thhnn.exe60880.exe9hbtbh.exe40040.exe60840.exe6848626.exe8244020.exe5dppd.exexrlxxxf.exe4620666.exepjppd.exe60886.exe628248.exe3pppp.exejvpdj.exerlxxxlx.exe3pddj.exe480626.exebnhhhb.exe08060.exevvvjj.exepid process 2252 hhnntt.exe 2092 6240624.exe 2168 9vddv.exe 2692 m4628.exe 2624 bhtnth.exe 1664 3bhbhn.exe 2600 xlxrflr.exe 2452 bthnbh.exe 1240 nbhbbn.exe 2408 c600040.exe 2852 xrllrrx.exe 3012 2640268.exe 1932 btbntn.exe 2656 i864242.exe 1916 tnbhtb.exe 1948 nntbnh.exe 1392 5jvvd.exe 1316 2868242.exe 2672 dvpdp.exe 540 rlfxlrf.exe 1468 w02646.exe 840 bbnnbh.exe 1640 nhtbnn.exe 2296 pvpvj.exe 768 vppvp.exe 332 vpdvd.exe 1036 i086880.exe 908 7dvpd.exe 1252 60840.exe 3040 hbthtb.exe 992 022444.exe 3052 08680.exe 2220 8624008.exe 2020 88466.exe 2404 rxlfrrl.exe 1244 hbnntb.exe 2092 7btbnn.exe 2572 42064.exe 2708 0484408.exe 1100 1jjpd.exe 2560 864622.exe 2824 bthhtn.exe 1664 4244020.exe 2476 1thhnn.exe 2428 60880.exe 2988 9hbtbh.exe 2812 40040.exe 2520 60840.exe 3008 6848626.exe 2932 8244020.exe 2752 5dppd.exe 2636 xrlxxxf.exe 2656 4620666.exe 2840 pjppd.exe 1752 60886.exe 2760 628248.exe 1984 3pppp.exe 2900 jvpdj.exe 268 rlxxxlx.exe 660 3pddj.exe 2260 480626.exe 616 bnhhhb.exe 2388 08060.exe 2160 vvvjj.exe -
Processes:
resource yara_rule behavioral1/memory/2336-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2252-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1916-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1316-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/540-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1468-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/768-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/908-275-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1252-284-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0651852c0373060e36078b06dcf80a30_NeikiAnalytics.exehhnntt.exe6240624.exe9vddv.exem4628.exebhtnth.exe3bhbhn.exexlxrflr.exebthnbh.exenbhbbn.exec600040.exexrllrrx.exe2640268.exebtbntn.exei864242.exetnbhtb.exedescription pid process target process PID 2336 wrote to memory of 2252 2336 0651852c0373060e36078b06dcf80a30_NeikiAnalytics.exe hhnntt.exe PID 2336 wrote to memory of 2252 2336 0651852c0373060e36078b06dcf80a30_NeikiAnalytics.exe hhnntt.exe PID 2336 wrote to memory of 2252 2336 0651852c0373060e36078b06dcf80a30_NeikiAnalytics.exe hhnntt.exe PID 2336 wrote to memory of 2252 2336 0651852c0373060e36078b06dcf80a30_NeikiAnalytics.exe hhnntt.exe PID 2252 wrote to memory of 2092 2252 hhnntt.exe 6240624.exe PID 2252 wrote to memory of 2092 2252 hhnntt.exe 6240624.exe PID 2252 wrote to memory of 2092 2252 hhnntt.exe 6240624.exe PID 2252 wrote to memory of 2092 2252 hhnntt.exe 6240624.exe PID 2092 wrote to memory of 2168 2092 6240624.exe 9vddv.exe PID 2092 wrote to memory of 2168 2092 6240624.exe 9vddv.exe PID 2092 wrote to memory of 2168 2092 6240624.exe 9vddv.exe PID 2092 wrote to memory of 2168 2092 6240624.exe 9vddv.exe PID 2168 wrote to memory of 2692 2168 9vddv.exe m4628.exe PID 2168 wrote to memory of 2692 2168 9vddv.exe m4628.exe PID 2168 wrote to memory of 2692 2168 9vddv.exe m4628.exe PID 2168 wrote to memory of 2692 2168 9vddv.exe m4628.exe PID 2692 wrote to memory of 2624 2692 m4628.exe bhtnth.exe PID 2692 wrote to memory of 2624 2692 m4628.exe bhtnth.exe PID 2692 wrote to memory of 2624 2692 m4628.exe bhtnth.exe PID 2692 wrote to memory of 2624 2692 m4628.exe bhtnth.exe PID 2624 wrote to memory of 1664 2624 bhtnth.exe 3bhbhn.exe PID 2624 wrote to memory of 1664 2624 bhtnth.exe 3bhbhn.exe PID 2624 wrote to memory of 1664 2624 bhtnth.exe 3bhbhn.exe PID 2624 wrote to memory of 1664 2624 bhtnth.exe 3bhbhn.exe PID 1664 wrote to memory of 2600 1664 3bhbhn.exe xlxrflr.exe PID 1664 wrote to memory of 2600 1664 3bhbhn.exe xlxrflr.exe PID 1664 wrote to memory of 2600 1664 3bhbhn.exe xlxrflr.exe PID 1664 wrote to memory of 2600 1664 3bhbhn.exe xlxrflr.exe PID 2600 wrote to memory of 2452 2600 xlxrflr.exe bthnbh.exe PID 2600 wrote to memory of 2452 2600 xlxrflr.exe bthnbh.exe PID 2600 wrote to memory of 2452 2600 xlxrflr.exe bthnbh.exe PID 2600 wrote to memory of 2452 2600 xlxrflr.exe bthnbh.exe PID 2452 wrote to memory of 1240 2452 bthnbh.exe nbhbbn.exe PID 2452 wrote to memory of 1240 2452 bthnbh.exe nbhbbn.exe PID 2452 wrote to memory of 1240 2452 bthnbh.exe nbhbbn.exe PID 2452 wrote to memory of 1240 2452 bthnbh.exe nbhbbn.exe PID 1240 wrote to memory of 2408 1240 nbhbbn.exe c600040.exe PID 1240 wrote to memory of 2408 1240 nbhbbn.exe c600040.exe PID 1240 wrote to memory of 2408 1240 nbhbbn.exe c600040.exe PID 1240 wrote to memory of 2408 1240 nbhbbn.exe c600040.exe PID 2408 wrote to memory of 2852 2408 c600040.exe xrllrrx.exe PID 2408 wrote to memory of 2852 2408 c600040.exe xrllrrx.exe PID 2408 wrote to memory of 2852 2408 c600040.exe xrllrrx.exe PID 2408 wrote to memory of 2852 2408 c600040.exe xrllrrx.exe PID 2852 wrote to memory of 3012 2852 xrllrrx.exe 2640268.exe PID 2852 wrote to memory of 3012 2852 xrllrrx.exe 2640268.exe PID 2852 wrote to memory of 3012 2852 xrllrrx.exe 2640268.exe PID 2852 wrote to memory of 3012 2852 xrllrrx.exe 2640268.exe PID 3012 wrote to memory of 1932 3012 2640268.exe btbntn.exe PID 3012 wrote to memory of 1932 3012 2640268.exe btbntn.exe PID 3012 wrote to memory of 1932 3012 2640268.exe btbntn.exe PID 3012 wrote to memory of 1932 3012 2640268.exe btbntn.exe PID 1932 wrote to memory of 2656 1932 btbntn.exe i864242.exe PID 1932 wrote to memory of 2656 1932 btbntn.exe i864242.exe PID 1932 wrote to memory of 2656 1932 btbntn.exe i864242.exe PID 1932 wrote to memory of 2656 1932 btbntn.exe i864242.exe PID 2656 wrote to memory of 1916 2656 i864242.exe tnbhtb.exe PID 2656 wrote to memory of 1916 2656 i864242.exe tnbhtb.exe PID 2656 wrote to memory of 1916 2656 i864242.exe tnbhtb.exe PID 2656 wrote to memory of 1916 2656 i864242.exe tnbhtb.exe PID 1916 wrote to memory of 1948 1916 tnbhtb.exe nntbnh.exe PID 1916 wrote to memory of 1948 1916 tnbhtb.exe nntbnh.exe PID 1916 wrote to memory of 1948 1916 tnbhtb.exe nntbnh.exe PID 1916 wrote to memory of 1948 1916 tnbhtb.exe nntbnh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0651852c0373060e36078b06dcf80a30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0651852c0373060e36078b06dcf80a30_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\hhnntt.exec:\hhnntt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\6240624.exec:\6240624.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\9vddv.exec:\9vddv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\m4628.exec:\m4628.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\bhtnth.exec:\bhtnth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\3bhbhn.exec:\3bhbhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\xlxrflr.exec:\xlxrflr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\bthnbh.exec:\bthnbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\nbhbbn.exec:\nbhbbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\c600040.exec:\c600040.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\xrllrrx.exec:\xrllrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\2640268.exec:\2640268.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\btbntn.exec:\btbntn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\i864242.exec:\i864242.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\tnbhtb.exec:\tnbhtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\nntbnh.exec:\nntbnh.exe17⤵
- Executes dropped EXE
PID:1948 -
\??\c:\5jvvd.exec:\5jvvd.exe18⤵
- Executes dropped EXE
PID:1392 -
\??\c:\2868242.exec:\2868242.exe19⤵
- Executes dropped EXE
PID:1316 -
\??\c:\dvpdp.exec:\dvpdp.exe20⤵
- Executes dropped EXE
PID:2672 -
\??\c:\rlfxlrf.exec:\rlfxlrf.exe21⤵
- Executes dropped EXE
PID:540 -
\??\c:\w02646.exec:\w02646.exe22⤵
- Executes dropped EXE
PID:1468 -
\??\c:\bbnnbh.exec:\bbnnbh.exe23⤵
- Executes dropped EXE
PID:840 -
\??\c:\nhtbnn.exec:\nhtbnn.exe24⤵
- Executes dropped EXE
PID:1640 -
\??\c:\pvpvj.exec:\pvpvj.exe25⤵
- Executes dropped EXE
PID:2296 -
\??\c:\vppvp.exec:\vppvp.exe26⤵
- Executes dropped EXE
PID:768 -
\??\c:\vpdvd.exec:\vpdvd.exe27⤵
- Executes dropped EXE
PID:332 -
\??\c:\i086880.exec:\i086880.exe28⤵
- Executes dropped EXE
PID:1036 -
\??\c:\7dvpd.exec:\7dvpd.exe29⤵
- Executes dropped EXE
PID:908 -
\??\c:\60840.exec:\60840.exe30⤵
- Executes dropped EXE
PID:1252 -
\??\c:\hbthtb.exec:\hbthtb.exe31⤵
- Executes dropped EXE
PID:3040 -
\??\c:\022444.exec:\022444.exe32⤵
- Executes dropped EXE
PID:992 -
\??\c:\08680.exec:\08680.exe33⤵
- Executes dropped EXE
PID:3052 -
\??\c:\8624008.exec:\8624008.exe34⤵
- Executes dropped EXE
PID:2220 -
\??\c:\88466.exec:\88466.exe35⤵
- Executes dropped EXE
PID:2020 -
\??\c:\rxlfrrl.exec:\rxlfrrl.exe36⤵
- Executes dropped EXE
PID:2404 -
\??\c:\hbnntb.exec:\hbnntb.exe37⤵
- Executes dropped EXE
PID:1244 -
\??\c:\7btbnn.exec:\7btbnn.exe38⤵
- Executes dropped EXE
PID:2092 -
\??\c:\42064.exec:\42064.exe39⤵
- Executes dropped EXE
PID:2572 -
\??\c:\0484408.exec:\0484408.exe40⤵
- Executes dropped EXE
PID:2708 -
\??\c:\1jjpd.exec:\1jjpd.exe41⤵
- Executes dropped EXE
PID:1100 -
\??\c:\864622.exec:\864622.exe42⤵
- Executes dropped EXE
PID:2560 -
\??\c:\bthhtn.exec:\bthhtn.exe43⤵
- Executes dropped EXE
PID:2824 -
\??\c:\4244020.exec:\4244020.exe44⤵
- Executes dropped EXE
PID:1664 -
\??\c:\1thhnn.exec:\1thhnn.exe45⤵
- Executes dropped EXE
PID:2476 -
\??\c:\60880.exec:\60880.exe46⤵
- Executes dropped EXE
PID:2428 -
\??\c:\9hbtbh.exec:\9hbtbh.exe47⤵
- Executes dropped EXE
PID:2988 -
\??\c:\40040.exec:\40040.exe48⤵
- Executes dropped EXE
PID:2812 -
\??\c:\60840.exec:\60840.exe49⤵
- Executes dropped EXE
PID:2520 -
\??\c:\6848626.exec:\6848626.exe50⤵
- Executes dropped EXE
PID:3008 -
\??\c:\8244020.exec:\8244020.exe51⤵
- Executes dropped EXE
PID:2932 -
\??\c:\5dppd.exec:\5dppd.exe52⤵
- Executes dropped EXE
PID:2752 -
\??\c:\xrlxxxf.exec:\xrlxxxf.exe53⤵
- Executes dropped EXE
PID:2636 -
\??\c:\4620666.exec:\4620666.exe54⤵
- Executes dropped EXE
PID:2656 -
\??\c:\pjppd.exec:\pjppd.exe55⤵
- Executes dropped EXE
PID:2840 -
\??\c:\60886.exec:\60886.exe56⤵
- Executes dropped EXE
PID:1752 -
\??\c:\628248.exec:\628248.exe57⤵
- Executes dropped EXE
PID:2760 -
\??\c:\3pppp.exec:\3pppp.exe58⤵
- Executes dropped EXE
PID:1984 -
\??\c:\jvpdj.exec:\jvpdj.exe59⤵
- Executes dropped EXE
PID:2900 -
\??\c:\rlxxxlx.exec:\rlxxxlx.exe60⤵
- Executes dropped EXE
PID:268 -
\??\c:\3pddj.exec:\3pddj.exe61⤵
- Executes dropped EXE
PID:660 -
\??\c:\480626.exec:\480626.exe62⤵
- Executes dropped EXE
PID:2260 -
\??\c:\bnhhhb.exec:\bnhhhb.exe63⤵
- Executes dropped EXE
PID:616 -
\??\c:\08060.exec:\08060.exe64⤵
- Executes dropped EXE
PID:2388 -
\??\c:\vvvjj.exec:\vvvjj.exe65⤵
- Executes dropped EXE
PID:2160 -
\??\c:\g2444.exec:\g2444.exe66⤵PID:1380
-
\??\c:\fxflxfr.exec:\fxflxfr.exe67⤵PID:1356
-
\??\c:\606284.exec:\606284.exe68⤵PID:2884
-
\??\c:\llffffr.exec:\llffffr.exe69⤵PID:844
-
\??\c:\pu608.exec:\pu608.exe70⤵PID:1616
-
\??\c:\480600.exec:\480600.exe71⤵PID:916
-
\??\c:\6462006.exec:\6462006.exe72⤵PID:1344
-
\??\c:\hnbtnh.exec:\hnbtnh.exe73⤵PID:1712
-
\??\c:\824084.exec:\824084.exe74⤵PID:1552
-
\??\c:\824084.exec:\824084.exe75⤵PID:2136
-
\??\c:\6042446.exec:\6042446.exe76⤵PID:2272
-
\??\c:\3jddj.exec:\3jddj.exe77⤵PID:1556
-
\??\c:\rrxrxxl.exec:\rrxrxxl.exe78⤵PID:2236
-
\??\c:\2848040.exec:\2848040.exe79⤵PID:2056
-
\??\c:\6044006.exec:\6044006.exe80⤵PID:1668
-
\??\c:\6084242.exec:\6084242.exe81⤵PID:2108
-
\??\c:\fffrfrl.exec:\fffrfrl.exe82⤵PID:2524
-
\??\c:\frrrxrx.exec:\frrrxrx.exe83⤵PID:2684
-
\??\c:\220646.exec:\220646.exe84⤵PID:2156
-
\??\c:\rxxfxrf.exec:\rxxfxrf.exe85⤵PID:2564
-
\??\c:\hbntbn.exec:\hbntbn.exe86⤵PID:308
-
\??\c:\6826620.exec:\6826620.exe87⤵PID:1952
-
\??\c:\48844.exec:\48844.exe88⤵PID:2600
-
\??\c:\22282.exec:\22282.exe89⤵PID:2476
-
\??\c:\680484.exec:\680484.exe90⤵PID:2976
-
\??\c:\7jvpv.exec:\7jvpv.exe91⤵PID:2820
-
\??\c:\fxrrffl.exec:\fxrrffl.exe92⤵PID:2804
-
\??\c:\42440.exec:\42440.exe93⤵PID:2660
-
\??\c:\lfrrlxl.exec:\lfrrlxl.exe94⤵PID:3012
-
\??\c:\q46682.exec:\q46682.exe95⤵PID:2628
-
\??\c:\6220000.exec:\6220000.exe96⤵PID:2764
-
\??\c:\8262860.exec:\8262860.exe97⤵PID:1688
-
\??\c:\bnhbhn.exec:\bnhbhn.exe98⤵PID:2396
-
\??\c:\tnhttn.exec:\tnhttn.exe99⤵PID:1948
-
\??\c:\xrllxxl.exec:\xrllxxl.exe100⤵PID:1780
-
\??\c:\s2024.exec:\s2024.exe101⤵PID:2040
-
\??\c:\lfrrrxl.exec:\lfrrrxl.exe102⤵PID:2416
-
\??\c:\pdpvj.exec:\pdpvj.exe103⤵PID:784
-
\??\c:\ppjjp.exec:\ppjjp.exe104⤵PID:1472
-
\??\c:\pjdvj.exec:\pjdvj.exe105⤵PID:580
-
\??\c:\pdpvd.exec:\pdpvd.exe106⤵PID:3064
-
\??\c:\22862.exec:\22862.exe107⤵PID:1840
-
\??\c:\vjvdd.exec:\vjvdd.exe108⤵PID:2124
-
\??\c:\4866628.exec:\4866628.exe109⤵PID:2208
-
\??\c:\bbthbn.exec:\bbthbn.exe110⤵PID:1136
-
\??\c:\lfxlxfr.exec:\lfxlxfr.exe111⤵PID:1656
-
\??\c:\s0802.exec:\s0802.exe112⤵PID:884
-
\??\c:\s6462.exec:\s6462.exe113⤵PID:700
-
\??\c:\xrllrrx.exec:\xrllrrx.exe114⤵PID:2332
-
\??\c:\868400.exec:\868400.exe115⤵PID:2940
-
\??\c:\btbhth.exec:\btbhth.exe116⤵PID:896
-
\??\c:\62484.exec:\62484.exe117⤵PID:2364
-
\??\c:\646244.exec:\646244.exe118⤵PID:1544
-
\??\c:\60840.exec:\60840.exe119⤵PID:1576
-
\??\c:\xfrfflx.exec:\xfrfflx.exe120⤵PID:2248
-
\??\c:\jddvj.exec:\jddvj.exe121⤵PID:2172
-
\??\c:\7xfrffl.exec:\7xfrffl.exe122⤵PID:2404
-
\??\c:\vdppv.exec:\vdppv.exe123⤵PID:2116
-
\??\c:\1rfxflr.exec:\1rfxflr.exe124⤵PID:2376
-
\??\c:\ttnbbt.exec:\ttnbbt.exe125⤵PID:2092
-
\??\c:\rlfxffl.exec:\rlfxffl.exe126⤵PID:2708
-
\??\c:\488462.exec:\488462.exe127⤵PID:1100
-
\??\c:\k26206.exec:\k26206.exe128⤵PID:2560
-
\??\c:\hnntnh.exec:\hnntnh.exe129⤵PID:3056
-
\??\c:\6084400.exec:\6084400.exe130⤵PID:2596
-
\??\c:\64204.exec:\64204.exe131⤵PID:2504
-
\??\c:\226080.exec:\226080.exe132⤵PID:1240
-
\??\c:\64040.exec:\64040.exe133⤵PID:2988
-
\??\c:\608400.exec:\608400.exe134⤵PID:2972
-
\??\c:\00482.exec:\00482.exe135⤵PID:2520
-
\??\c:\u088040.exec:\u088040.exe136⤵PID:3008
-
\??\c:\u886444.exec:\u886444.exe137⤵PID:2932
-
\??\c:\m8628.exec:\m8628.exe138⤵PID:2752
-
\??\c:\26406.exec:\26406.exe139⤵PID:2636
-
\??\c:\7hhnhn.exec:\7hhnhn.exe140⤵PID:2792
-
\??\c:\ppjjd.exec:\ppjjd.exe141⤵PID:2840
-
\??\c:\hnthnb.exec:\hnthnb.exe142⤵PID:1752
-
\??\c:\rllfrxl.exec:\rllfrxl.exe143⤵PID:2000
-
\??\c:\ppvjv.exec:\ppvjv.exe144⤵PID:2816
-
\??\c:\286426.exec:\286426.exe145⤵PID:2148
-
\??\c:\tntttt.exec:\tntttt.exe146⤵PID:596
-
\??\c:\jpvjj.exec:\jpvjj.exe147⤵PID:2068
-
\??\c:\xlrrrxx.exec:\xlrrrxx.exe148⤵PID:2260
-
\??\c:\bnnhnt.exec:\bnnhnt.exe149⤵PID:864
-
\??\c:\0804606.exec:\0804606.exe150⤵PID:2144
-
\??\c:\c606464.exec:\c606464.exe151⤵PID:1772
-
\??\c:\s2682.exec:\s2682.exe152⤵PID:2384
-
\??\c:\thbhbt.exec:\thbhbt.exe153⤵PID:820
-
\??\c:\9jdpv.exec:\9jdpv.exe154⤵PID:108
-
\??\c:\20600.exec:\20600.exe155⤵PID:3048
-
\??\c:\1jvvv.exec:\1jvvv.exe156⤵PID:2340
-
\??\c:\3djjp.exec:\3djjp.exe157⤵PID:2256
-
\??\c:\1rllrlx.exec:\1rllrlx.exe158⤵PID:1928
-
\??\c:\604682.exec:\604682.exe159⤵PID:2516
-
\??\c:\8440860.exec:\8440860.exe160⤵PID:1648
-
\??\c:\46884.exec:\46884.exe161⤵PID:2272
-
\??\c:\0428400.exec:\0428400.exe162⤵PID:1284
-
\??\c:\64800.exec:\64800.exe163⤵PID:2128
-
\??\c:\468006.exec:\468006.exe164⤵PID:2140
-
\??\c:\e04400.exec:\e04400.exe165⤵PID:2620
-
\??\c:\u606404.exec:\u606404.exe166⤵PID:2536
-
\??\c:\04280.exec:\04280.exe167⤵PID:2688
-
\??\c:\8288684.exec:\8288684.exe168⤵PID:2716
-
\??\c:\60462.exec:\60462.exe169⤵PID:2740
-
\??\c:\rllfxxr.exec:\rllfxxr.exe170⤵PID:2592
-
\??\c:\lfxxfll.exec:\lfxxfll.exe171⤵PID:2712
-
\??\c:\vvvpp.exec:\vvvpp.exe172⤵PID:3056
-
\??\c:\0484808.exec:\0484808.exe173⤵PID:2508
-
\??\c:\5btthn.exec:\5btthn.exe174⤵PID:2464
-
\??\c:\06644.exec:\06644.exe175⤵PID:2848
-
\??\c:\48628.exec:\48628.exe176⤵PID:1588
-
\??\c:\o264440.exec:\o264440.exe177⤵PID:2944
-
\??\c:\5vjdd.exec:\5vjdd.exe178⤵PID:2812
-
\??\c:\6804660.exec:\6804660.exe179⤵PID:1500
-
\??\c:\nbtthb.exec:\nbtthb.exe180⤵PID:1932
-
\??\c:\86466.exec:\86466.exe181⤵PID:2752
-
\??\c:\jdjpv.exec:\jdjpv.exe182⤵PID:1940
-
\??\c:\hbbhnb.exec:\hbbhnb.exe183⤵PID:1272
-
\??\c:\lfrlrxr.exec:\lfrlrxr.exe184⤵PID:1692
-
\??\c:\9bnhtb.exec:\9bnhtb.exe185⤵PID:2192
-
\??\c:\w48442.exec:\w48442.exe186⤵PID:1336
-
\??\c:\rrfrxlx.exec:\rrfrxlx.exe187⤵PID:2328
-
\??\c:\tbbtnh.exec:\tbbtnh.exe188⤵PID:1912
-
\??\c:\3xffrrl.exec:\3xffrrl.exe189⤵PID:2672
-
\??\c:\k68806.exec:\k68806.exe190⤵PID:2104
-
\??\c:\dvppv.exec:\dvppv.exe191⤵PID:412
-
\??\c:\fxxfxlr.exec:\fxxfxlr.exe192⤵PID:3064
-
\??\c:\fxfflfr.exec:\fxfflfr.exe193⤵PID:2304
-
\??\c:\82820.exec:\82820.exe194⤵PID:588
-
\??\c:\846082.exec:\846082.exe195⤵PID:1772
-
\??\c:\jpvpv.exec:\jpvpv.exe196⤵PID:2160
-
\??\c:\824604.exec:\824604.exe197⤵PID:2016
-
\??\c:\nhnnnn.exec:\nhnnnn.exe198⤵PID:1324
-
\??\c:\c428880.exec:\c428880.exe199⤵PID:1436
-
\??\c:\1tthth.exec:\1tthth.exe200⤵PID:2340
-
\??\c:\440866.exec:\440866.exe201⤵PID:2032
-
\??\c:\444628.exec:\444628.exe202⤵PID:2940
-
\??\c:\0802840.exec:\0802840.exe203⤵PID:896
-
\??\c:\rflfllx.exec:\rflfllx.exe204⤵PID:2368
-
\??\c:\868260.exec:\868260.exe205⤵PID:1556
-
\??\c:\flxflrf.exec:\flxflrf.exe206⤵PID:1192
-
\??\c:\2262626.exec:\2262626.exe207⤵PID:2236
-
\??\c:\9rflrrx.exec:\9rflrrx.exe208⤵PID:2140
-
\??\c:\hnhbnh.exec:\hnhbnh.exe209⤵PID:1668
-
\??\c:\jvjjv.exec:\jvjjv.exe210⤵PID:1244
-
\??\c:\bnbntt.exec:\bnbntt.exe211⤵PID:2888
-
\??\c:\48806.exec:\48806.exe212⤵PID:2832
-
\??\c:\402844.exec:\402844.exe213⤵PID:2708
-
\??\c:\80600.exec:\80600.exe214⤵PID:2488
-
\??\c:\jvjdj.exec:\jvjdj.exe215⤵PID:2712
-
\??\c:\4620228.exec:\4620228.exe216⤵PID:2980
-
\??\c:\404844.exec:\404844.exe217⤵PID:2596
-
\??\c:\9tbthb.exec:\9tbthb.exe218⤵PID:2464
-
\??\c:\e62620.exec:\e62620.exe219⤵PID:2988
-
\??\c:\ffrllfl.exec:\ffrllfl.exe220⤵PID:2780
-
\??\c:\26228.exec:\26228.exe221⤵PID:2944
-
\??\c:\2684006.exec:\2684006.exe222⤵PID:2520
-
\??\c:\0206224.exec:\0206224.exe223⤵PID:1500
-
\??\c:\400002.exec:\400002.exe224⤵PID:2644
-
\??\c:\0026462.exec:\0026462.exe225⤵PID:2752
-
\??\c:\06642.exec:\06642.exe226⤵PID:1940
-
\??\c:\pdppd.exec:\pdppd.exe227⤵PID:1948
-
\??\c:\vjvvj.exec:\vjvvj.exe228⤵PID:2840
-
\??\c:\lflxxlf.exec:\lflxxlf.exe229⤵PID:2192
-
\??\c:\5htthn.exec:\5htthn.exe230⤵PID:1336
-
\??\c:\7tnbht.exec:\7tnbht.exe231⤵PID:2328
-
\??\c:\vpddj.exec:\vpddj.exe232⤵PID:2904
-
\??\c:\48624.exec:\48624.exe233⤵PID:2672
-
\??\c:\frxlllx.exec:\frxlllx.exe234⤵PID:2344
-
\??\c:\608466.exec:\608466.exe235⤵PID:412
-
\??\c:\202884.exec:\202884.exe236⤵PID:2288
-
\??\c:\604866.exec:\604866.exe237⤵PID:2304
-
\??\c:\2084662.exec:\2084662.exe238⤵PID:2208
-
\??\c:\dvddp.exec:\dvddp.exe239⤵PID:1772
-
\??\c:\86884.exec:\86884.exe240⤵PID:2160
-
\??\c:\lfrfxfr.exec:\lfrfxfr.exe241⤵PID:2016
-
\??\c:\a8006.exec:\a8006.exe242⤵PID:1324