Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 18:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
148223f808abdea8245e486204abaa70_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
148223f808abdea8245e486204abaa70_NeikiAnalytics.exe
-
Size
370KB
-
MD5
148223f808abdea8245e486204abaa70
-
SHA1
bc102b829d7fa1ffdf1cb8e2f60ac5e756ef1935
-
SHA256
9a6dd4ac3e9ad5a5d058fc7d6bd120b0ab9c5a74cd5245c97b6f86904d5dbf99
-
SHA512
bffc4464a3a02138b3b3114c25be9b5c1abfb8391ea8570c5bcbe48fbf997eb07759237181407880826d22d9a99fc343dbded6a1b968b68701632c63a5e59d96
-
SSDEEP
6144:n3C9BRIG0asYFm71mJl3/X8mak5gNv9rC8IwLaYNUvtTxTKMM4:n3C9uYA7i3/stR9HGYyvtTxTKMt
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral2/memory/1800-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3292-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3284-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1096-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/676-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1616-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2912-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1048-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4212-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2644-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1928-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2164-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2936-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4676-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4228-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3112-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
1airll.exeixrm71.exe31f5mg.exeno085.exei60w5.exe71ro8e.exe7k0c06.exehiu8v5.exelpn76.exe6c0337e.exe6t4uc8a.exe19x1g35.execajej.exehwnua.exeac3b9tn.exebppg31.exe835p673.exel8bhn2.exe9790h.exetgj0m.exe5wh2sde.exe02oh4x3.exesodh4p.exeti837.exea4d2ru6.exep9h5v.exe15d75.exer3vgw7b.exek4f1g3.exe25x4x5.exee88d7.exeni3e85.exe3b935.exe8gm0o2.exegnkim.exeteusk6.exe197qx.exeeanxn2x.exe2565v.exeos4k7.exea7n4497.exe19m1921.exe3d3ft9.exesd9ii4.exeaq799da.exeqfcjqn.exe7s5k1t.exe6a2saj9.exe2450p7v.exepalhm9.exe07188u.exe23111f7.exevqkno05.exe236119s.exe00n9i.exe4nkoaa7.exe74t42v9.exes68hnt5.exe6b4ccgk.exep62wecj.exes1e93b9.exegb4w0b.exei039uin.exeeji2q26.exepid process 3292 1airll.exe 3284 ixrm71.exe 676 31f5mg.exe 1096 no085.exe 4348 i60w5.exe 1616 71ro8e.exe 2912 7k0c06.exe 4604 hiu8v5.exe 3596 lpn76.exe 2344 6c0337e.exe 1048 6t4uc8a.exe 3760 19x1g35.exe 4212 cajej.exe 2644 hwnua.exe 1928 ac3b9tn.exe 3516 bppg31.exe 2164 835p673.exe 4480 l8bhn2.exe 4428 9790h.exe 2936 tgj0m.exe 3988 5wh2sde.exe 232 02oh4x3.exe 2120 sodh4p.exe 4528 ti837.exe 2904 a4d2ru6.exe 4676 p9h5v.exe 2088 15d75.exe 4228 r3vgw7b.exe 3112 k4f1g3.exe 4308 25x4x5.exe 1844 e88d7.exe 4948 ni3e85.exe 4972 3b935.exe 1280 8gm0o2.exe 224 gnkim.exe 3296 teusk6.exe 3836 197qx.exe 3580 eanxn2x.exe 4940 2565v.exe 944 os4k7.exe 3232 a7n4497.exe 2932 19m1921.exe 3660 3d3ft9.exe 4828 sd9ii4.exe 1460 aq799da.exe 3596 qfcjqn.exe 3792 7s5k1t.exe 4064 6a2saj9.exe 2996 2450p7v.exe 3708 palhm9.exe 3760 07188u.exe 1988 23111f7.exe 5012 vqkno05.exe 2488 236119s.exe 1928 00n9i.exe 1920 4nkoaa7.exe 1408 74t42v9.exe 2916 s68hnt5.exe 3080 6b4ccgk.exe 4428 p62wecj.exe 2652 s1e93b9.exe 3988 gb4w0b.exe 4420 i039uin.exe 2872 eji2q26.exe -
Processes:
resource yara_rule behavioral2/memory/1800-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3292-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3284-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/676-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/676-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/676-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1096-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/676-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1616-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2912-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3596-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1048-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4212-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2644-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1928-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2164-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2936-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4676-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4228-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3112-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-199-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
148223f808abdea8245e486204abaa70_NeikiAnalytics.exe1airll.exeixrm71.exe31f5mg.exeno085.exei60w5.exe71ro8e.exe7k0c06.exehiu8v5.exelpn76.exe6c0337e.exe6t4uc8a.exe19x1g35.execajej.exehwnua.exeac3b9tn.exebppg31.exe835p673.exel8bhn2.exe9790h.exetgj0m.exe5wh2sde.exedescription pid process target process PID 1800 wrote to memory of 3292 1800 148223f808abdea8245e486204abaa70_NeikiAnalytics.exe 1airll.exe PID 1800 wrote to memory of 3292 1800 148223f808abdea8245e486204abaa70_NeikiAnalytics.exe 1airll.exe PID 1800 wrote to memory of 3292 1800 148223f808abdea8245e486204abaa70_NeikiAnalytics.exe 1airll.exe PID 3292 wrote to memory of 3284 3292 1airll.exe ixrm71.exe PID 3292 wrote to memory of 3284 3292 1airll.exe ixrm71.exe PID 3292 wrote to memory of 3284 3292 1airll.exe ixrm71.exe PID 3284 wrote to memory of 676 3284 ixrm71.exe 31f5mg.exe PID 3284 wrote to memory of 676 3284 ixrm71.exe 31f5mg.exe PID 3284 wrote to memory of 676 3284 ixrm71.exe 31f5mg.exe PID 676 wrote to memory of 1096 676 31f5mg.exe no085.exe PID 676 wrote to memory of 1096 676 31f5mg.exe no085.exe PID 676 wrote to memory of 1096 676 31f5mg.exe no085.exe PID 1096 wrote to memory of 4348 1096 no085.exe i60w5.exe PID 1096 wrote to memory of 4348 1096 no085.exe i60w5.exe PID 1096 wrote to memory of 4348 1096 no085.exe i60w5.exe PID 4348 wrote to memory of 1616 4348 i60w5.exe 71ro8e.exe PID 4348 wrote to memory of 1616 4348 i60w5.exe 71ro8e.exe PID 4348 wrote to memory of 1616 4348 i60w5.exe 71ro8e.exe PID 1616 wrote to memory of 2912 1616 71ro8e.exe 7k0c06.exe PID 1616 wrote to memory of 2912 1616 71ro8e.exe 7k0c06.exe PID 1616 wrote to memory of 2912 1616 71ro8e.exe 7k0c06.exe PID 2912 wrote to memory of 4604 2912 7k0c06.exe hiu8v5.exe PID 2912 wrote to memory of 4604 2912 7k0c06.exe hiu8v5.exe PID 2912 wrote to memory of 4604 2912 7k0c06.exe hiu8v5.exe PID 4604 wrote to memory of 3596 4604 hiu8v5.exe lpn76.exe PID 4604 wrote to memory of 3596 4604 hiu8v5.exe lpn76.exe PID 4604 wrote to memory of 3596 4604 hiu8v5.exe lpn76.exe PID 3596 wrote to memory of 2344 3596 lpn76.exe 6c0337e.exe PID 3596 wrote to memory of 2344 3596 lpn76.exe 6c0337e.exe PID 3596 wrote to memory of 2344 3596 lpn76.exe 6c0337e.exe PID 2344 wrote to memory of 1048 2344 6c0337e.exe 6t4uc8a.exe PID 2344 wrote to memory of 1048 2344 6c0337e.exe 6t4uc8a.exe PID 2344 wrote to memory of 1048 2344 6c0337e.exe 6t4uc8a.exe PID 1048 wrote to memory of 3760 1048 6t4uc8a.exe 19x1g35.exe PID 1048 wrote to memory of 3760 1048 6t4uc8a.exe 19x1g35.exe PID 1048 wrote to memory of 3760 1048 6t4uc8a.exe 19x1g35.exe PID 3760 wrote to memory of 4212 3760 19x1g35.exe cajej.exe PID 3760 wrote to memory of 4212 3760 19x1g35.exe cajej.exe PID 3760 wrote to memory of 4212 3760 19x1g35.exe cajej.exe PID 4212 wrote to memory of 2644 4212 cajej.exe hwnua.exe PID 4212 wrote to memory of 2644 4212 cajej.exe hwnua.exe PID 4212 wrote to memory of 2644 4212 cajej.exe hwnua.exe PID 2644 wrote to memory of 1928 2644 hwnua.exe ac3b9tn.exe PID 2644 wrote to memory of 1928 2644 hwnua.exe ac3b9tn.exe PID 2644 wrote to memory of 1928 2644 hwnua.exe ac3b9tn.exe PID 1928 wrote to memory of 3516 1928 ac3b9tn.exe bppg31.exe PID 1928 wrote to memory of 3516 1928 ac3b9tn.exe bppg31.exe PID 1928 wrote to memory of 3516 1928 ac3b9tn.exe bppg31.exe PID 3516 wrote to memory of 2164 3516 bppg31.exe 835p673.exe PID 3516 wrote to memory of 2164 3516 bppg31.exe 835p673.exe PID 3516 wrote to memory of 2164 3516 bppg31.exe 835p673.exe PID 2164 wrote to memory of 4480 2164 835p673.exe l8bhn2.exe PID 2164 wrote to memory of 4480 2164 835p673.exe l8bhn2.exe PID 2164 wrote to memory of 4480 2164 835p673.exe l8bhn2.exe PID 4480 wrote to memory of 4428 4480 l8bhn2.exe 9790h.exe PID 4480 wrote to memory of 4428 4480 l8bhn2.exe 9790h.exe PID 4480 wrote to memory of 4428 4480 l8bhn2.exe 9790h.exe PID 4428 wrote to memory of 2936 4428 9790h.exe tgj0m.exe PID 4428 wrote to memory of 2936 4428 9790h.exe tgj0m.exe PID 4428 wrote to memory of 2936 4428 9790h.exe tgj0m.exe PID 2936 wrote to memory of 3988 2936 tgj0m.exe 5wh2sde.exe PID 2936 wrote to memory of 3988 2936 tgj0m.exe 5wh2sde.exe PID 2936 wrote to memory of 3988 2936 tgj0m.exe 5wh2sde.exe PID 3988 wrote to memory of 232 3988 5wh2sde.exe 02oh4x3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\148223f808abdea8245e486204abaa70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\148223f808abdea8245e486204abaa70_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\1airll.exec:\1airll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\ixrm71.exec:\ixrm71.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
\??\c:\31f5mg.exec:\31f5mg.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
\??\c:\no085.exec:\no085.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\i60w5.exec:\i60w5.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\71ro8e.exec:\71ro8e.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\7k0c06.exec:\7k0c06.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\hiu8v5.exec:\hiu8v5.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\lpn76.exec:\lpn76.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\6c0337e.exec:\6c0337e.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\6t4uc8a.exec:\6t4uc8a.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\19x1g35.exec:\19x1g35.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\cajej.exec:\cajej.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\hwnua.exec:\hwnua.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\ac3b9tn.exec:\ac3b9tn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\bppg31.exec:\bppg31.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\835p673.exec:\835p673.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\l8bhn2.exec:\l8bhn2.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\9790h.exec:\9790h.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\tgj0m.exec:\tgj0m.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\5wh2sde.exec:\5wh2sde.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\02oh4x3.exec:\02oh4x3.exe23⤵
- Executes dropped EXE
PID:232 -
\??\c:\sodh4p.exec:\sodh4p.exe24⤵
- Executes dropped EXE
PID:2120 -
\??\c:\ti837.exec:\ti837.exe25⤵
- Executes dropped EXE
PID:4528 -
\??\c:\a4d2ru6.exec:\a4d2ru6.exe26⤵
- Executes dropped EXE
PID:2904 -
\??\c:\p9h5v.exec:\p9h5v.exe27⤵
- Executes dropped EXE
PID:4676 -
\??\c:\15d75.exec:\15d75.exe28⤵
- Executes dropped EXE
PID:2088 -
\??\c:\r3vgw7b.exec:\r3vgw7b.exe29⤵
- Executes dropped EXE
PID:4228 -
\??\c:\k4f1g3.exec:\k4f1g3.exe30⤵
- Executes dropped EXE
PID:3112 -
\??\c:\25x4x5.exec:\25x4x5.exe31⤵
- Executes dropped EXE
PID:4308 -
\??\c:\e88d7.exec:\e88d7.exe32⤵
- Executes dropped EXE
PID:1844 -
\??\c:\ni3e85.exec:\ni3e85.exe33⤵
- Executes dropped EXE
PID:4948 -
\??\c:\3b935.exec:\3b935.exe34⤵
- Executes dropped EXE
PID:4972 -
\??\c:\8gm0o2.exec:\8gm0o2.exe35⤵
- Executes dropped EXE
PID:1280 -
\??\c:\gnkim.exec:\gnkim.exe36⤵
- Executes dropped EXE
PID:224 -
\??\c:\teusk6.exec:\teusk6.exe37⤵
- Executes dropped EXE
PID:3296 -
\??\c:\197qx.exec:\197qx.exe38⤵
- Executes dropped EXE
PID:3836 -
\??\c:\eanxn2x.exec:\eanxn2x.exe39⤵
- Executes dropped EXE
PID:3580 -
\??\c:\2565v.exec:\2565v.exe40⤵
- Executes dropped EXE
PID:4940 -
\??\c:\os4k7.exec:\os4k7.exe41⤵
- Executes dropped EXE
PID:944 -
\??\c:\a7n4497.exec:\a7n4497.exe42⤵
- Executes dropped EXE
PID:3232 -
\??\c:\19m1921.exec:\19m1921.exe43⤵
- Executes dropped EXE
PID:2932 -
\??\c:\3d3ft9.exec:\3d3ft9.exe44⤵
- Executes dropped EXE
PID:3660 -
\??\c:\sd9ii4.exec:\sd9ii4.exe45⤵
- Executes dropped EXE
PID:4828 -
\??\c:\aq799da.exec:\aq799da.exe46⤵
- Executes dropped EXE
PID:1460 -
\??\c:\qfcjqn.exec:\qfcjqn.exe47⤵
- Executes dropped EXE
PID:3596 -
\??\c:\7s5k1t.exec:\7s5k1t.exe48⤵
- Executes dropped EXE
PID:3792 -
\??\c:\6a2saj9.exec:\6a2saj9.exe49⤵
- Executes dropped EXE
PID:4064 -
\??\c:\2450p7v.exec:\2450p7v.exe50⤵
- Executes dropped EXE
PID:2996 -
\??\c:\palhm9.exec:\palhm9.exe51⤵
- Executes dropped EXE
PID:3708 -
\??\c:\07188u.exec:\07188u.exe52⤵
- Executes dropped EXE
PID:3760 -
\??\c:\23111f7.exec:\23111f7.exe53⤵
- Executes dropped EXE
PID:1988 -
\??\c:\vqkno05.exec:\vqkno05.exe54⤵
- Executes dropped EXE
PID:5012 -
\??\c:\236119s.exec:\236119s.exe55⤵
- Executes dropped EXE
PID:2488 -
\??\c:\00n9i.exec:\00n9i.exe56⤵
- Executes dropped EXE
PID:1928 -
\??\c:\4nkoaa7.exec:\4nkoaa7.exe57⤵
- Executes dropped EXE
PID:1920 -
\??\c:\74t42v9.exec:\74t42v9.exe58⤵
- Executes dropped EXE
PID:1408 -
\??\c:\s68hnt5.exec:\s68hnt5.exe59⤵
- Executes dropped EXE
PID:2916 -
\??\c:\6b4ccgk.exec:\6b4ccgk.exe60⤵
- Executes dropped EXE
PID:3080 -
\??\c:\p62wecj.exec:\p62wecj.exe61⤵
- Executes dropped EXE
PID:4428 -
\??\c:\s1e93b9.exec:\s1e93b9.exe62⤵
- Executes dropped EXE
PID:2652 -
\??\c:\gb4w0b.exec:\gb4w0b.exe63⤵
- Executes dropped EXE
PID:3988 -
\??\c:\i039uin.exec:\i039uin.exe64⤵
- Executes dropped EXE
PID:4420 -
\??\c:\eji2q26.exec:\eji2q26.exe65⤵
- Executes dropped EXE
PID:2872 -
\??\c:\nq4kc.exec:\nq4kc.exe66⤵PID:4240
-
\??\c:\pgm6813.exec:\pgm6813.exe67⤵PID:1288
-
\??\c:\q8321.exec:\q8321.exe68⤵PID:2220
-
\??\c:\vs8wb9r.exec:\vs8wb9r.exe69⤵PID:4676
-
\??\c:\n3qtql8.exec:\n3qtql8.exe70⤵PID:1708
-
\??\c:\rvwf6g.exec:\rvwf6g.exe71⤵PID:1568
-
\??\c:\7g99aig.exec:\7g99aig.exe72⤵PID:4292
-
\??\c:\0pv1twl.exec:\0pv1twl.exe73⤵PID:3276
-
\??\c:\ubbo7.exec:\ubbo7.exe74⤵PID:3620
-
\??\c:\5v002.exec:\5v002.exe75⤵PID:2172
-
\??\c:\9ta7m6.exec:\9ta7m6.exe76⤵PID:2348
-
\??\c:\d843a.exec:\d843a.exe77⤵PID:4492
-
\??\c:\5bawl9.exec:\5bawl9.exe78⤵PID:3192
-
\??\c:\u48a11q.exec:\u48a11q.exe79⤵PID:3108
-
\??\c:\838942.exec:\838942.exe80⤵PID:3296
-
\??\c:\i6fmt1o.exec:\i6fmt1o.exe81⤵PID:1156
-
\??\c:\5sq14wh.exec:\5sq14wh.exe82⤵PID:4416
-
\??\c:\ikqu9o8.exec:\ikqu9o8.exe83⤵PID:1548
-
\??\c:\mq3514.exec:\mq3514.exe84⤵PID:1804
-
\??\c:\58g56.exec:\58g56.exe85⤵PID:4692
-
\??\c:\uh5r0n.exec:\uh5r0n.exe86⤵PID:2160
-
\??\c:\911qe8k.exec:\911qe8k.exe87⤵PID:1256
-
\??\c:\iiora.exec:\iiora.exe88⤵PID:452
-
\??\c:\5ormb.exec:\5ormb.exe89⤵PID:3816
-
\??\c:\q37jppm.exec:\q37jppm.exe90⤵PID:864
-
\??\c:\xdxhlp.exec:\xdxhlp.exe91⤵PID:5024
-
\??\c:\3b652g.exec:\3b652g.exe92⤵PID:4064
-
\??\c:\05q198.exec:\05q198.exe93⤵PID:2500
-
\??\c:\xm3d644.exec:\xm3d644.exe94⤵PID:1648
-
\??\c:\8ptbrm.exec:\8ptbrm.exe95⤵PID:3696
-
\??\c:\7jr56b.exec:\7jr56b.exe96⤵PID:2644
-
\??\c:\ioimv.exec:\ioimv.exe97⤵PID:3628
-
\??\c:\3c5tw.exec:\3c5tw.exe98⤵PID:1432
-
\??\c:\h7so55.exec:\h7so55.exe99⤵PID:2920
-
\??\c:\8et729n.exec:\8et729n.exe100⤵PID:1920
-
\??\c:\rdaee6.exec:\rdaee6.exe101⤵PID:4320
-
\??\c:\q2eq94.exec:\q2eq94.exe102⤵PID:2916
-
\??\c:\5v6cf.exec:\5v6cf.exe103⤵PID:916
-
\??\c:\h1am9.exec:\h1am9.exe104⤵PID:3164
-
\??\c:\hinv3.exec:\hinv3.exe105⤵PID:3560
-
\??\c:\29191.exec:\29191.exe106⤵PID:4004
-
\??\c:\b3794k3.exec:\b3794k3.exe107⤵PID:4700
-
\??\c:\3010cv.exec:\3010cv.exe108⤵PID:4924
-
\??\c:\6mt115.exec:\6mt115.exe109⤵PID:2884
-
\??\c:\245a6k.exec:\245a6k.exe110⤵PID:5016
-
\??\c:\s589352.exec:\s589352.exe111⤵PID:1656
-
\??\c:\8s0w87.exec:\8s0w87.exe112⤵PID:4140
-
\??\c:\s1k69i.exec:\s1k69i.exe113⤵PID:4036
-
\??\c:\k31nw7.exec:\k31nw7.exe114⤵PID:3644
-
\??\c:\4lign7.exec:\4lign7.exe115⤵PID:4292
-
\??\c:\h3r06.exec:\h3r06.exe116⤵PID:3100
-
\??\c:\l4181tq.exec:\l4181tq.exe117⤵PID:3916
-
\??\c:\8fi0s62.exec:\8fi0s62.exe118⤵PID:4948
-
\??\c:\g2jp150.exec:\g2jp150.exe119⤵PID:2348
-
\??\c:\5e21k8.exec:\5e21k8.exe120⤵PID:4856
-
\??\c:\rp1g569.exec:\rp1g569.exe121⤵PID:576
-
\??\c:\g4gak3.exec:\g4gak3.exe122⤵PID:3296
-
\??\c:\4st39o.exec:\4st39o.exe123⤵PID:2876
-
\??\c:\uf7ocv.exec:\uf7ocv.exe124⤵PID:2688
-
\??\c:\8s2d1.exec:\8s2d1.exe125⤵PID:1616
-
\??\c:\l5739.exec:\l5739.exe126⤵PID:384
-
\??\c:\no3sw.exec:\no3sw.exe127⤵PID:1072
-
\??\c:\irn09.exec:\irn09.exe128⤵PID:4604
-
\??\c:\7r9nc.exec:\7r9nc.exe129⤵PID:1256
-
\??\c:\4h48knq.exec:\4h48knq.exe130⤵PID:2052
-
\??\c:\pn5f7ap.exec:\pn5f7ap.exe131⤵PID:3816
-
\??\c:\3o3ps9.exec:\3o3ps9.exe132⤵PID:2984
-
\??\c:\18f7s.exec:\18f7s.exe133⤵PID:1048
-
\??\c:\st9ij9k.exec:\st9ij9k.exe134⤵PID:3708
-
\??\c:\r8p7q9.exec:\r8p7q9.exe135⤵PID:1000
-
\??\c:\o9293i.exec:\o9293i.exe136⤵PID:1648
-
\??\c:\d43nn.exec:\d43nn.exe137⤵PID:2272
-
\??\c:\e0tr626.exec:\e0tr626.exe138⤵PID:2644
-
\??\c:\ghr34i0.exec:\ghr34i0.exe139⤵PID:3628
-
\??\c:\k2655.exec:\k2655.exe140⤵PID:2276
-
\??\c:\3v1kk9o.exec:\3v1kk9o.exe141⤵PID:4276
-
\??\c:\l8cpp7.exec:\l8cpp7.exe142⤵PID:2040
-
\??\c:\9v6d1.exec:\9v6d1.exe143⤵PID:2936
-
\??\c:\2qligv.exec:\2qligv.exe144⤵PID:4428
-
\??\c:\8d6004s.exec:\8d6004s.exe145⤵PID:3428
-
\??\c:\09jae.exec:\09jae.exe146⤵PID:3412
-
\??\c:\lfa37.exec:\lfa37.exe147⤵PID:4004
-
\??\c:\9hqjv0.exec:\9hqjv0.exe148⤵PID:4408
-
\??\c:\vk3h4f3.exec:\vk3h4f3.exe149⤵PID:3592
-
\??\c:\2025v.exec:\2025v.exe150⤵PID:2556
-
\??\c:\s9ewc9.exec:\s9ewc9.exe151⤵PID:2412
-
\??\c:\3n9598.exec:\3n9598.exe152⤵PID:4328
-
\??\c:\bq9j52w.exec:\bq9j52w.exe153⤵PID:4308
-
\??\c:\8o53s.exec:\8o53s.exe154⤵PID:1844
-
\??\c:\k393c6l.exec:\k393c6l.exe155⤵PID:3916
-
\??\c:\3i6d9.exec:\3i6d9.exe156⤵PID:568
-
\??\c:\d36sp.exec:\d36sp.exe157⤵PID:224
-
\??\c:\9m5o3.exec:\9m5o3.exe158⤵PID:576
-
\??\c:\b1l4575.exec:\b1l4575.exe159⤵PID:2356
-
\??\c:\c22nkrm.exec:\c22nkrm.exe160⤵PID:4436
-
\??\c:\6uucsk5.exec:\6uucsk5.exe161⤵PID:400
-
\??\c:\47c3jd.exec:\47c3jd.exe162⤵PID:384
-
\??\c:\wbnosmn.exec:\wbnosmn.exe163⤵PID:2160
-
\??\c:\udj8id.exec:\udj8id.exe164⤵PID:1724
-
\??\c:\h4m4cg.exec:\h4m4cg.exe165⤵PID:4552
-
\??\c:\vl3ci1s.exec:\vl3ci1s.exe166⤵PID:3816
-
\??\c:\1whb7og.exec:\1whb7og.exe167⤵PID:3616
-
\??\c:\21550.exec:\21550.exe168⤵PID:1300
-
\??\c:\27g4c5a.exec:\27g4c5a.exe169⤵PID:4504
-
\??\c:\22et4.exec:\22et4.exe170⤵PID:1988
-
\??\c:\9kx2ph6.exec:\9kx2ph6.exe171⤵PID:3568
-
\??\c:\3x441o.exec:\3x441o.exe172⤵PID:3540
-
\??\c:\vppw7.exec:\vppw7.exe173⤵PID:1240
-
\??\c:\vj9655c.exec:\vj9655c.exe174⤵PID:3104
-
\??\c:\m5tvvn.exec:\m5tvvn.exe175⤵PID:3672
-
\??\c:\7460a4g.exec:\7460a4g.exe176⤵PID:4860
-
\??\c:\1b5vo.exec:\1b5vo.exe177⤵PID:808
-
\??\c:\10k50.exec:\10k50.exe178⤵PID:3668
-
\??\c:\a172iov.exec:\a172iov.exe179⤵PID:1484
-
\??\c:\5u5jil.exec:\5u5jil.exe180⤵PID:2872
-
\??\c:\965e7lk.exec:\965e7lk.exe181⤵PID:3604
-
\??\c:\r693el.exec:\r693el.exe182⤵PID:4184
-
\??\c:\4hwb5c5.exec:\4hwb5c5.exe183⤵PID:4796
-
\??\c:\8os5b.exec:\8os5b.exe184⤵PID:4036
-
\??\c:\4b5p9k.exec:\4b5p9k.exe185⤵PID:2880
-
\??\c:\w57t0u5.exec:\w57t0u5.exe186⤵PID:3100
-
\??\c:\6d7jniq.exec:\6d7jniq.exe187⤵PID:1212
-
\??\c:\p7d3a.exec:\p7d3a.exe188⤵PID:4020
-
\??\c:\985n4w.exec:\985n4w.exe189⤵PID:3916
-
\??\c:\p5o8doo.exec:\p5o8doo.exe190⤵PID:4268
-
\??\c:\82bd94.exec:\82bd94.exe191⤵PID:676
-
\??\c:\7900l2.exec:\7900l2.exe192⤵PID:2688
-
\??\c:\457he65.exec:\457he65.exe193⤵PID:1228
-
\??\c:\7s0ks72.exec:\7s0ks72.exe194⤵PID:576
-
\??\c:\2s70x8.exec:\2s70x8.exe195⤵PID:2336
-
\??\c:\3dw3f.exec:\3dw3f.exe196⤵PID:4604
-
\??\c:\38511.exec:\38511.exe197⤵PID:1256
-
\??\c:\8v4sn2s.exec:\8v4sn2s.exe198⤵PID:4576
-
\??\c:\sl178.exec:\sl178.exe199⤵PID:864
-
\??\c:\qr019uc.exec:\qr019uc.exe200⤵PID:2996
-
\??\c:\dv2dnq.exec:\dv2dnq.exe201⤵PID:4064
-
\??\c:\0qcix.exec:\0qcix.exe202⤵PID:3760
-
\??\c:\99a55.exec:\99a55.exe203⤵PID:3932
-
\??\c:\2f1w9.exec:\2f1w9.exe204⤵PID:1776
-
\??\c:\6011ug5.exec:\6011ug5.exe205⤵PID:2272
-
\??\c:\f162l.exec:\f162l.exe206⤵PID:1928
-
\??\c:\8j5r179.exec:\8j5r179.exe207⤵PID:720
-
\??\c:\cff117.exec:\cff117.exe208⤵PID:636
-
\??\c:\06ous.exec:\06ous.exe209⤵PID:2432
-
\??\c:\5jh91.exec:\5jh91.exe210⤵PID:3556
-
\??\c:\v4a9qq6.exec:\v4a9qq6.exe211⤵PID:4120
-
\??\c:\of52qc.exec:\of52qc.exe212⤵PID:1484
-
\??\c:\5jsa7ec.exec:\5jsa7ec.exe213⤵PID:4804
-
\??\c:\18b57.exec:\18b57.exe214⤵PID:388
-
\??\c:\9qjvj4l.exec:\9qjvj4l.exe215⤵PID:4252
-
\??\c:\ow92ig.exec:\ow92ig.exe216⤵PID:1604
-
\??\c:\7ixxs.exec:\7ixxs.exe217⤵PID:2880
-
\??\c:\qqkah28.exec:\qqkah28.exe218⤵PID:4780
-
\??\c:\611dd7w.exec:\611dd7w.exe219⤵PID:4020
-
\??\c:\9r6mp.exec:\9r6mp.exe220⤵PID:3916
-
\??\c:\wsscj.exec:\wsscj.exe221⤵PID:4896
-
\??\c:\n50391r.exec:\n50391r.exe222⤵PID:220
-
\??\c:\t277r7j.exec:\t277r7j.exe223⤵PID:2388
-
\??\c:\43s0e62.exec:\43s0e62.exe224⤵PID:2952
-
\??\c:\7c64793.exec:\7c64793.exe225⤵PID:384
-
\??\c:\x73wn67.exec:\x73wn67.exe226⤵PID:1132
-
\??\c:\05vf3vq.exec:\05vf3vq.exe227⤵PID:3792
-
\??\c:\s7q850g.exec:\s7q850g.exe228⤵PID:1724
-
\??\c:\k892oa.exec:\k892oa.exe229⤵PID:2224
-
\??\c:\10v79.exec:\10v79.exe230⤵PID:4820
-
\??\c:\g4wr6cv.exec:\g4wr6cv.exe231⤵PID:2500
-
\??\c:\1id33g.exec:\1id33g.exe232⤵PID:2940
-
\??\c:\l53ebn.exec:\l53ebn.exe233⤵PID:5012
-
\??\c:\38ris3e.exec:\38ris3e.exe234⤵PID:1712
-
\??\c:\p0w140.exec:\p0w140.exe235⤵PID:4964
-
\??\c:\b8ge8.exec:\b8ge8.exe236⤵PID:4364
-
\??\c:\81kb00.exec:\81kb00.exe237⤵PID:2372
-
\??\c:\14brmh.exec:\14brmh.exe238⤵PID:1408
-
\??\c:\879n23p.exec:\879n23p.exe239⤵PID:916
-
\??\c:\ofplm.exec:\ofplm.exe240⤵PID:808
-
\??\c:\g70tkp.exec:\g70tkp.exe241⤵PID:4120
-
\??\c:\f09695.exec:\f09695.exe242⤵PID:3592