Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 04:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
af3f9fe73ffde1c212d3b9e97d9dfca0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
af3f9fe73ffde1c212d3b9e97d9dfca0_NeikiAnalytics.exe
-
Size
75KB
-
MD5
af3f9fe73ffde1c212d3b9e97d9dfca0
-
SHA1
f8d889d826850105eab691d9f1b56fd614dec0e9
-
SHA256
4ee6d8a86cc4b97c2d86a5023c645942765498471e5e8eb129e20e3134b17772
-
SHA512
2b450eaf012dbb9570cede1d1303d8e361b6fec365ebdbfd004ed52b7681b57a1e3f4593fdf71d74abaa4714627a05b5b9d61fed3aab212d23ee45602e777500
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIoAh2QpUnX1AL:ymb3NkkiQ3mdBjFIsIVbpUa
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral2/memory/216-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2152-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3216-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4332-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1776-35-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4884-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1776-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1112-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2196-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3240-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1068-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/888-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4080-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1772-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3432-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4132-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3960-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3536-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3340-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2912-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3348-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
i466884.exec244088.exe662226.exe3jjvp.exedpjjj.exellxxfff.exefxlrxlx.exe222228.exepjppj.exetnbnnn.exejppjd.exeddjdj.exe228668.exe3vjvp.exe6804046.exebtbntb.exe24802.exe5nbtth.exe22608.exevpjdd.exe0022402.exe6460004.exe24262.exedvjdp.exe620022.exek84602.exepjjjd.exe868280.exe62604.exe44402.exerrflfxl.exeflrfrxr.exe60002.exetbnhtb.exe2448226.exe4608826.exe406288.exe0828606.exem6822.exerxrlxff.exe5lfxrlf.exelrrllfx.exe9rxxfxx.exe5xxlfff.exehntttt.exe9nnhbt.exenbbbnn.exe20022.exe9vjjj.exetbtbbt.exek42640.exe48404.exe428200.exe4244226.exerllrlfl.exexrffrrl.exe44260.exelxrlrxx.exejvjjv.exerffxfrx.exew88222.exe84264.exe202284.exedppdv.exepid process 2152 i466884.exe 3216 c244088.exe 4332 662226.exe 1776 3jjvp.exe 4484 dpjjj.exe 4884 llxxfff.exe 2820 fxlrxlx.exe 3348 222228.exe 1112 pjppj.exe 1472 tnbnnn.exe 2196 jppjd.exe 3240 ddjdj.exe 4944 228668.exe 1068 3vjvp.exe 1144 6804046.exe 888 btbntb.exe 3604 24802.exe 1896 5nbtth.exe 4080 22608.exe 2912 vpjdd.exe 640 0022402.exe 420 6460004.exe 1708 24262.exe 1772 dvjdp.exe 4132 620022.exe 3432 k84602.exe 1608 pjjjd.exe 3960 868280.exe 3536 62604.exe 3340 44402.exe 3856 rrflfxl.exe 4948 flrfrxr.exe 1700 60002.exe 4608 tbnhtb.exe 4892 2448226.exe 4984 4608826.exe 2972 406288.exe 4356 0828606.exe 224 m6822.exe 2976 rxrlxff.exe 2152 5lfxrlf.exe 1840 lrrllfx.exe 1520 9rxxfxx.exe 3988 5xxlfff.exe 1776 hntttt.exe 1140 9nnhbt.exe 996 nbbbnn.exe 3028 20022.exe 2708 9vjjj.exe 3348 tbtbbt.exe 1756 k42640.exe 2960 48404.exe 4284 428200.exe 2736 4244226.exe 4708 rllrlfl.exe 1072 xrffrrl.exe 2416 44260.exe 5044 lxrlrxx.exe 4124 jvjjv.exe 4812 rffxfrx.exe 1916 w88222.exe 1968 84264.exe 4980 202284.exe 2392 dppdv.exe -
Processes:
resource yara_rule behavioral2/memory/216-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2152-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2152-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3216-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4332-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4884-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1776-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1112-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1472-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1472-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2196-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1472-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3240-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1068-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/888-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4080-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1772-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3432-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4132-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3960-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3536-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3340-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2912-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3348-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3348-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3348-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3348-59-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
af3f9fe73ffde1c212d3b9e97d9dfca0_NeikiAnalytics.exei466884.exec244088.exe662226.exe3jjvp.exedpjjj.exellxxfff.exefxlrxlx.exe222228.exepjppj.exetnbnnn.exejppjd.exeddjdj.exe228668.exe3vjvp.exe6804046.exebtbntb.exe24802.exe5nbtth.exe22608.exevpjdd.exe0022402.exedescription pid process target process PID 216 wrote to memory of 2152 216 af3f9fe73ffde1c212d3b9e97d9dfca0_NeikiAnalytics.exe i466884.exe PID 216 wrote to memory of 2152 216 af3f9fe73ffde1c212d3b9e97d9dfca0_NeikiAnalytics.exe i466884.exe PID 216 wrote to memory of 2152 216 af3f9fe73ffde1c212d3b9e97d9dfca0_NeikiAnalytics.exe i466884.exe PID 2152 wrote to memory of 3216 2152 i466884.exe c244088.exe PID 2152 wrote to memory of 3216 2152 i466884.exe c244088.exe PID 2152 wrote to memory of 3216 2152 i466884.exe c244088.exe PID 3216 wrote to memory of 4332 3216 c244088.exe 662226.exe PID 3216 wrote to memory of 4332 3216 c244088.exe 662226.exe PID 3216 wrote to memory of 4332 3216 c244088.exe 662226.exe PID 4332 wrote to memory of 1776 4332 662226.exe 3jjvp.exe PID 4332 wrote to memory of 1776 4332 662226.exe 3jjvp.exe PID 4332 wrote to memory of 1776 4332 662226.exe 3jjvp.exe PID 1776 wrote to memory of 4484 1776 3jjvp.exe dpjjj.exe PID 1776 wrote to memory of 4484 1776 3jjvp.exe dpjjj.exe PID 1776 wrote to memory of 4484 1776 3jjvp.exe dpjjj.exe PID 4484 wrote to memory of 4884 4484 dpjjj.exe llxxfff.exe PID 4484 wrote to memory of 4884 4484 dpjjj.exe llxxfff.exe PID 4484 wrote to memory of 4884 4484 dpjjj.exe llxxfff.exe PID 4884 wrote to memory of 2820 4884 llxxfff.exe fxlrxlx.exe PID 4884 wrote to memory of 2820 4884 llxxfff.exe fxlrxlx.exe PID 4884 wrote to memory of 2820 4884 llxxfff.exe fxlrxlx.exe PID 2820 wrote to memory of 3348 2820 fxlrxlx.exe tbtbbt.exe PID 2820 wrote to memory of 3348 2820 fxlrxlx.exe tbtbbt.exe PID 2820 wrote to memory of 3348 2820 fxlrxlx.exe tbtbbt.exe PID 3348 wrote to memory of 1112 3348 222228.exe pjppj.exe PID 3348 wrote to memory of 1112 3348 222228.exe pjppj.exe PID 3348 wrote to memory of 1112 3348 222228.exe pjppj.exe PID 1112 wrote to memory of 1472 1112 pjppj.exe tnbnnn.exe PID 1112 wrote to memory of 1472 1112 pjppj.exe tnbnnn.exe PID 1112 wrote to memory of 1472 1112 pjppj.exe tnbnnn.exe PID 1472 wrote to memory of 2196 1472 tnbnnn.exe jppjd.exe PID 1472 wrote to memory of 2196 1472 tnbnnn.exe jppjd.exe PID 1472 wrote to memory of 2196 1472 tnbnnn.exe jppjd.exe PID 2196 wrote to memory of 3240 2196 jppjd.exe ddjdj.exe PID 2196 wrote to memory of 3240 2196 jppjd.exe ddjdj.exe PID 2196 wrote to memory of 3240 2196 jppjd.exe ddjdj.exe PID 3240 wrote to memory of 4944 3240 ddjdj.exe 228668.exe PID 3240 wrote to memory of 4944 3240 ddjdj.exe 228668.exe PID 3240 wrote to memory of 4944 3240 ddjdj.exe 228668.exe PID 4944 wrote to memory of 1068 4944 228668.exe 3vjvp.exe PID 4944 wrote to memory of 1068 4944 228668.exe 3vjvp.exe PID 4944 wrote to memory of 1068 4944 228668.exe 3vjvp.exe PID 1068 wrote to memory of 1144 1068 3vjvp.exe 6804046.exe PID 1068 wrote to memory of 1144 1068 3vjvp.exe 6804046.exe PID 1068 wrote to memory of 1144 1068 3vjvp.exe 6804046.exe PID 1144 wrote to memory of 888 1144 6804046.exe btbntb.exe PID 1144 wrote to memory of 888 1144 6804046.exe btbntb.exe PID 1144 wrote to memory of 888 1144 6804046.exe btbntb.exe PID 888 wrote to memory of 3604 888 btbntb.exe 24802.exe PID 888 wrote to memory of 3604 888 btbntb.exe 24802.exe PID 888 wrote to memory of 3604 888 btbntb.exe 24802.exe PID 3604 wrote to memory of 1896 3604 24802.exe 5nbtth.exe PID 3604 wrote to memory of 1896 3604 24802.exe 5nbtth.exe PID 3604 wrote to memory of 1896 3604 24802.exe 5nbtth.exe PID 1896 wrote to memory of 4080 1896 5nbtth.exe 22608.exe PID 1896 wrote to memory of 4080 1896 5nbtth.exe 22608.exe PID 1896 wrote to memory of 4080 1896 5nbtth.exe 22608.exe PID 4080 wrote to memory of 2912 4080 22608.exe vpjdd.exe PID 4080 wrote to memory of 2912 4080 22608.exe vpjdd.exe PID 4080 wrote to memory of 2912 4080 22608.exe vpjdd.exe PID 2912 wrote to memory of 640 2912 vpjdd.exe 0022402.exe PID 2912 wrote to memory of 640 2912 vpjdd.exe 0022402.exe PID 2912 wrote to memory of 640 2912 vpjdd.exe 0022402.exe PID 640 wrote to memory of 420 640 0022402.exe 6460004.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\af3f9fe73ffde1c212d3b9e97d9dfca0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\af3f9fe73ffde1c212d3b9e97d9dfca0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\i466884.exec:\i466884.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\c244088.exec:\c244088.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\662226.exec:\662226.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
\??\c:\3jjvp.exec:\3jjvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\dpjjj.exec:\dpjjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\llxxfff.exec:\llxxfff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\fxlrxlx.exec:\fxlrxlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\222228.exec:\222228.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\pjppj.exec:\pjppj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\tnbnnn.exec:\tnbnnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\jppjd.exec:\jppjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\ddjdj.exec:\ddjdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
\??\c:\228668.exec:\228668.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\3vjvp.exec:\3vjvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\6804046.exec:\6804046.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\btbntb.exec:\btbntb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\24802.exec:\24802.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\5nbtth.exec:\5nbtth.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\22608.exec:\22608.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\vpjdd.exec:\vpjdd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\0022402.exec:\0022402.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\6460004.exec:\6460004.exe23⤵
- Executes dropped EXE
PID:420 -
\??\c:\24262.exec:\24262.exe24⤵
- Executes dropped EXE
PID:1708 -
\??\c:\dvjdp.exec:\dvjdp.exe25⤵
- Executes dropped EXE
PID:1772 -
\??\c:\620022.exec:\620022.exe26⤵
- Executes dropped EXE
PID:4132 -
\??\c:\k84602.exec:\k84602.exe27⤵
- Executes dropped EXE
PID:3432 -
\??\c:\pjjjd.exec:\pjjjd.exe28⤵
- Executes dropped EXE
PID:1608 -
\??\c:\868280.exec:\868280.exe29⤵
- Executes dropped EXE
PID:3960 -
\??\c:\62604.exec:\62604.exe30⤵
- Executes dropped EXE
PID:3536 -
\??\c:\44402.exec:\44402.exe31⤵
- Executes dropped EXE
PID:3340 -
\??\c:\rrflfxl.exec:\rrflfxl.exe32⤵
- Executes dropped EXE
PID:3856 -
\??\c:\flrfrxr.exec:\flrfrxr.exe33⤵
- Executes dropped EXE
PID:4948 -
\??\c:\60002.exec:\60002.exe34⤵
- Executes dropped EXE
PID:1700 -
\??\c:\tbnhtb.exec:\tbnhtb.exe35⤵
- Executes dropped EXE
PID:4608 -
\??\c:\2448226.exec:\2448226.exe36⤵
- Executes dropped EXE
PID:4892 -
\??\c:\4608826.exec:\4608826.exe37⤵
- Executes dropped EXE
PID:4984 -
\??\c:\406288.exec:\406288.exe38⤵
- Executes dropped EXE
PID:2972 -
\??\c:\0828606.exec:\0828606.exe39⤵
- Executes dropped EXE
PID:4356 -
\??\c:\m6822.exec:\m6822.exe40⤵
- Executes dropped EXE
PID:224 -
\??\c:\rxrlxff.exec:\rxrlxff.exe41⤵
- Executes dropped EXE
PID:2976 -
\??\c:\5lfxrlf.exec:\5lfxrlf.exe42⤵
- Executes dropped EXE
PID:2152 -
\??\c:\lrrllfx.exec:\lrrllfx.exe43⤵
- Executes dropped EXE
PID:1840 -
\??\c:\9rxxfxx.exec:\9rxxfxx.exe44⤵
- Executes dropped EXE
PID:1520 -
\??\c:\5xxlfff.exec:\5xxlfff.exe45⤵
- Executes dropped EXE
PID:3988 -
\??\c:\hntttt.exec:\hntttt.exe46⤵
- Executes dropped EXE
PID:1776 -
\??\c:\9nnhbt.exec:\9nnhbt.exe47⤵
- Executes dropped EXE
PID:1140 -
\??\c:\nbbbnn.exec:\nbbbnn.exe48⤵
- Executes dropped EXE
PID:996 -
\??\c:\20022.exec:\20022.exe49⤵
- Executes dropped EXE
PID:3028 -
\??\c:\9vjjj.exec:\9vjjj.exe50⤵
- Executes dropped EXE
PID:2708 -
\??\c:\tbtbbt.exec:\tbtbbt.exe51⤵
- Executes dropped EXE
PID:3348 -
\??\c:\k42640.exec:\k42640.exe52⤵
- Executes dropped EXE
PID:1756 -
\??\c:\48404.exec:\48404.exe53⤵
- Executes dropped EXE
PID:2960 -
\??\c:\428200.exec:\428200.exe54⤵
- Executes dropped EXE
PID:4284 -
\??\c:\4244226.exec:\4244226.exe55⤵
- Executes dropped EXE
PID:2736 -
\??\c:\rllrlfl.exec:\rllrlfl.exe56⤵
- Executes dropped EXE
PID:4708 -
\??\c:\xrffrrl.exec:\xrffrrl.exe57⤵
- Executes dropped EXE
PID:1072 -
\??\c:\44260.exec:\44260.exe58⤵
- Executes dropped EXE
PID:2416 -
\??\c:\lxrlrxx.exec:\lxrlrxx.exe59⤵
- Executes dropped EXE
PID:5044 -
\??\c:\jvjjv.exec:\jvjjv.exe60⤵
- Executes dropped EXE
PID:4124 -
\??\c:\rffxfrx.exec:\rffxfrx.exe61⤵
- Executes dropped EXE
PID:4812 -
\??\c:\w88222.exec:\w88222.exe62⤵
- Executes dropped EXE
PID:1916 -
\??\c:\84264.exec:\84264.exe63⤵
- Executes dropped EXE
PID:1968 -
\??\c:\202284.exec:\202284.exe64⤵
- Executes dropped EXE
PID:4980 -
\??\c:\dppdv.exec:\dppdv.exe65⤵
- Executes dropped EXE
PID:2392 -
\??\c:\06260.exec:\06260.exe66⤵PID:3916
-
\??\c:\6440882.exec:\6440882.exe67⤵PID:4212
-
\??\c:\pjvjd.exec:\pjvjd.exe68⤵PID:3312
-
\??\c:\4804040.exec:\4804040.exe69⤵PID:5092
-
\??\c:\jjdpp.exec:\jjdpp.exe70⤵PID:4700
-
\??\c:\k06060.exec:\k06060.exe71⤵PID:1148
-
\??\c:\66004.exec:\66004.exe72⤵PID:2944
-
\??\c:\2068284.exec:\2068284.exe73⤵PID:4004
-
\??\c:\20480.exec:\20480.exe74⤵PID:3960
-
\??\c:\2428882.exec:\2428882.exe75⤵PID:4568
-
\??\c:\66282.exec:\66282.exe76⤵PID:4540
-
\??\c:\jjpjv.exec:\jjpjv.exe77⤵PID:2624
-
\??\c:\8268664.exec:\8268664.exe78⤵PID:4560
-
\??\c:\hbhtbn.exec:\hbhtbn.exe79⤵PID:3260
-
\??\c:\o242660.exec:\o242660.exe80⤵PID:3564
-
\??\c:\rlxrlff.exec:\rlxrlff.exe81⤵PID:3524
-
\??\c:\pjppj.exec:\pjppj.exe82⤵PID:4608
-
\??\c:\rllxrxr.exec:\rllxrxr.exe83⤵PID:4240
-
\??\c:\jpddv.exec:\jpddv.exe84⤵PID:2616
-
\??\c:\rffxrlf.exec:\rffxrlf.exe85⤵PID:3600
-
\??\c:\28048.exec:\28048.exe86⤵PID:3948
-
\??\c:\o682222.exec:\o682222.exe87⤵PID:224
-
\??\c:\5rfxrxr.exec:\5rfxrxr.exe88⤵PID:2976
-
\??\c:\024444.exec:\024444.exe89⤵PID:1944
-
\??\c:\nhtntt.exec:\nhtntt.exe90⤵PID:1476
-
\??\c:\bbnhnt.exec:\bbnhnt.exe91⤵PID:3148
-
\??\c:\66042.exec:\66042.exe92⤵PID:1876
-
\??\c:\rllfllr.exec:\rllfllr.exe93⤵PID:3488
-
\??\c:\9xffxxr.exec:\9xffxxr.exe94⤵PID:4160
-
\??\c:\nnnbtt.exec:\nnnbtt.exe95⤵PID:2580
-
\??\c:\ppjvv.exec:\ppjvv.exe96⤵PID:4044
-
\??\c:\88424.exec:\88424.exe97⤵PID:1188
-
\??\c:\1jdvv.exec:\1jdvv.exe98⤵PID:4140
-
\??\c:\688204.exec:\688204.exe99⤵PID:1472
-
\??\c:\0404440.exec:\0404440.exe100⤵PID:4516
-
\??\c:\0688226.exec:\0688226.exe101⤵PID:3216
-
\??\c:\g2204.exec:\g2204.exe102⤵PID:2124
-
\??\c:\k44888.exec:\k44888.exe103⤵PID:3240
-
\??\c:\62226.exec:\62226.exe104⤵PID:4708
-
\??\c:\24004.exec:\24004.exe105⤵PID:1220
-
\??\c:\ddpjj.exec:\ddpjj.exe106⤵PID:668
-
\??\c:\bnhnbb.exec:\bnhnbb.exe107⤵PID:5044
-
\??\c:\880666.exec:\880666.exe108⤵PID:1268
-
\??\c:\htnhbb.exec:\htnhbb.exe109⤵PID:1548
-
\??\c:\4860022.exec:\4860022.exe110⤵PID:400
-
\??\c:\vppdv.exec:\vppdv.exe111⤵PID:552
-
\??\c:\nnnbtn.exec:\nnnbtn.exe112⤵PID:4980
-
\??\c:\vvddv.exec:\vvddv.exe113⤵PID:2392
-
\??\c:\1fxrflf.exec:\1fxrflf.exe114⤵PID:3916
-
\??\c:\08826.exec:\08826.exe115⤵PID:4120
-
\??\c:\e68260.exec:\e68260.exe116⤵PID:3312
-
\??\c:\688608.exec:\688608.exe117⤵PID:1924
-
\??\c:\680828.exec:\680828.exe118⤵PID:1260
-
\??\c:\8020064.exec:\8020064.exe119⤵PID:2192
-
\??\c:\hbnhnt.exec:\hbnhnt.exe120⤵PID:4424
-
\??\c:\i404840.exec:\i404840.exe121⤵PID:2268
-
\??\c:\a4684.exec:\a4684.exe122⤵PID:4956
-
\??\c:\xxlfxrl.exec:\xxlfxrl.exe123⤵PID:3532
-
\??\c:\ffffxxr.exec:\ffffxxr.exe124⤵PID:3308
-
\??\c:\rfffxxx.exec:\rfffxxx.exe125⤵PID:1320
-
\??\c:\nhhbbb.exec:\nhhbbb.exe126⤵PID:1700
-
\??\c:\lffxrrr.exec:\lffxrrr.exe127⤵PID:1460
-
\??\c:\hhnntt.exec:\hhnntt.exe128⤵PID:4892
-
\??\c:\i084264.exec:\i084264.exe129⤵PID:3804
-
\??\c:\7lllffx.exec:\7lllffx.exe130⤵PID:3212
-
\??\c:\9xfxxxf.exec:\9xfxxxf.exe131⤵PID:1156
-
\??\c:\bbhbtt.exec:\bbhbtt.exe132⤵PID:4348
-
\??\c:\8626448.exec:\8626448.exe133⤵PID:1328
-
\??\c:\jjvvp.exec:\jjvvp.exe134⤵PID:2664
-
\??\c:\26682.exec:\26682.exe135⤵PID:1840
-
\??\c:\9xfxxxr.exec:\9xfxxxr.exe136⤵PID:4932
-
\??\c:\fffxxxx.exec:\fffxxxx.exe137⤵PID:4888
-
\??\c:\htnntb.exec:\htnntb.exe138⤵PID:1200
-
\??\c:\rlllfff.exec:\rlllfff.exe139⤵PID:2036
-
\??\c:\ppddv.exec:\ppddv.exe140⤵PID:1164
-
\??\c:\dpjvp.exec:\dpjvp.exe141⤵PID:1596
-
\??\c:\7tntnn.exec:\7tntnn.exe142⤵PID:4756
-
\??\c:\06446.exec:\06446.exe143⤵PID:2696
-
\??\c:\006686.exec:\006686.exe144⤵PID:4588
-
\??\c:\i626042.exec:\i626042.exe145⤵PID:3928
-
\??\c:\046886.exec:\046886.exe146⤵PID:4516
-
\??\c:\22668.exec:\22668.exe147⤵PID:2076
-
\??\c:\ppvpp.exec:\ppvpp.exe148⤵PID:2124
-
\??\c:\226826.exec:\226826.exe149⤵PID:1072
-
\??\c:\bnbnhn.exec:\bnbnhn.exe150⤵PID:1220
-
\??\c:\lrlfxrl.exec:\lrlfxrl.exe151⤵PID:668
-
\??\c:\08826.exec:\08826.exe152⤵PID:2920
-
\??\c:\04808.exec:\04808.exe153⤵PID:2400
-
\??\c:\2684882.exec:\2684882.exe154⤵PID:1872
-
\??\c:\24048.exec:\24048.exe155⤵PID:640
-
\??\c:\884444.exec:\884444.exe156⤵PID:1940
-
\??\c:\482200.exec:\482200.exe157⤵PID:776
-
\??\c:\llrrlrr.exec:\llrrlrr.exe158⤵PID:3312
-
\??\c:\0446604.exec:\0446604.exe159⤵PID:672
-
\??\c:\llfxxll.exec:\llfxxll.exe160⤵PID:624
-
\??\c:\844448.exec:\844448.exe161⤵PID:4424
-
\??\c:\3nbtht.exec:\3nbtht.exe162⤵PID:2268
-
\??\c:\g6604.exec:\g6604.exe163⤵PID:3508
-
\??\c:\nhnnhh.exec:\nhnnhh.exe164⤵PID:1660
-
\??\c:\s2848.exec:\s2848.exe165⤵PID:1312
-
\??\c:\jvvvp.exec:\jvvvp.exe166⤵PID:2940
-
\??\c:\dvjjd.exec:\dvjjd.exe167⤵PID:3840
-
\??\c:\ttntbb.exec:\ttntbb.exe168⤵PID:4536
-
\??\c:\pdpjv.exec:\pdpjv.exe169⤵PID:2368
-
\??\c:\424866.exec:\424866.exe170⤵PID:5008
-
\??\c:\u848604.exec:\u848604.exe171⤵PID:940
-
\??\c:\ttttbh.exec:\ttttbh.exe172⤵PID:1016
-
\??\c:\g2882.exec:\g2882.exe173⤵PID:2388
-
\??\c:\484026.exec:\484026.exe174⤵PID:3528
-
\??\c:\xlllfff.exec:\xlllfff.exe175⤵PID:5048
-
\??\c:\ppvpv.exec:\ppvpv.exe176⤵PID:4884
-
\??\c:\ttnhtn.exec:\ttnhtn.exe177⤵PID:996
-
\??\c:\s8422.exec:\s8422.exe178⤵PID:2036
-
\??\c:\68442.exec:\68442.exe179⤵PID:1164
-
\??\c:\bbbhht.exec:\bbbhht.exe180⤵PID:2596
-
\??\c:\ttnhnn.exec:\ttnhnn.exe181⤵PID:4756
-
\??\c:\20266.exec:\20266.exe182⤵PID:2696
-
\??\c:\xflfrlf.exec:\xflfrlf.exe183⤵PID:4588
-
\??\c:\g0048.exec:\g0048.exe184⤵PID:1300
-
\??\c:\644822.exec:\644822.exe185⤵PID:4516
-
\??\c:\246600.exec:\246600.exe186⤵PID:3240
-
\??\c:\20222.exec:\20222.exe187⤵PID:4696
-
\??\c:\thtbth.exec:\thtbth.exe188⤵PID:4468
-
\??\c:\4404882.exec:\4404882.exe189⤵PID:5112
-
\??\c:\dvppd.exec:\dvppd.exe190⤵PID:1548
-
\??\c:\rlxfxxf.exec:\rlxfxxf.exe191⤵PID:1336
-
\??\c:\022426.exec:\022426.exe192⤵PID:2576
-
\??\c:\208468.exec:\208468.exe193⤵PID:3340
-
\??\c:\60228.exec:\60228.exe194⤵PID:4880
-
\??\c:\4800004.exec:\4800004.exe195⤵PID:3308
-
\??\c:\thhbbh.exec:\thhbbh.exe196⤵PID:3016
-
\??\c:\822288.exec:\822288.exe197⤵PID:1312
-
\??\c:\s0686.exec:\s0686.exe198⤵PID:2940
-
\??\c:\84646.exec:\84646.exe199⤵PID:3840
-
\??\c:\6620046.exec:\6620046.exe200⤵PID:3120
-
\??\c:\ppvjp.exec:\ppvjp.exe201⤵PID:3600
-
\??\c:\22842.exec:\22842.exe202⤵PID:3948
-
\??\c:\424866.exec:\424866.exe203⤵PID:940
-
\??\c:\04604.exec:\04604.exe204⤵PID:1016
-
\??\c:\vjjjd.exec:\vjjjd.exe205⤵PID:2844
-
\??\c:\ddjjv.exec:\ddjjv.exe206⤵PID:2280
-
\??\c:\266000.exec:\266000.exe207⤵PID:5048
-
\??\c:\82262.exec:\82262.exe208⤵PID:3488
-
\??\c:\04260.exec:\04260.exe209⤵PID:1592
-
\??\c:\bhnnbt.exec:\bhnnbt.exe210⤵PID:5040
-
\??\c:\m4660.exec:\m4660.exe211⤵PID:1164
-
\??\c:\tttnnn.exec:\tttnnn.exe212⤵PID:2596
-
\??\c:\s4222.exec:\s4222.exe213⤵PID:4632
-
\??\c:\20882.exec:\20882.exe214⤵PID:3928
-
\??\c:\jvdjj.exec:\jvdjj.exe215⤵PID:4284
-
\??\c:\vjvdv.exec:\vjvdv.exe216⤵PID:1300
-
\??\c:\o040484.exec:\o040484.exe217⤵PID:4708
-
\??\c:\80222.exec:\80222.exe218⤵PID:1524
-
\??\c:\622268.exec:\622268.exe219⤵PID:1816
-
\??\c:\6820422.exec:\6820422.exe220⤵PID:4812
-
\??\c:\1ttttt.exec:\1ttttt.exe221⤵PID:3864
-
\??\c:\684624.exec:\684624.exe222⤵PID:1648
-
\??\c:\rflflrx.exec:\rflflrx.exe223⤵PID:1832
-
\??\c:\1xxllxr.exec:\1xxllxr.exe224⤵PID:1192
-
\??\c:\862604.exec:\862604.exe225⤵PID:1772
-
\??\c:\002622.exec:\002622.exe226⤵PID:3040
-
\??\c:\tnhbtt.exec:\tnhbtt.exe227⤵PID:4004
-
\??\c:\4804480.exec:\4804480.exe228⤵PID:628
-
\??\c:\btnnhn.exec:\btnnhn.exe229⤵PID:2200
-
\??\c:\486646.exec:\486646.exe230⤵PID:2576
-
\??\c:\4884262.exec:\4884262.exe231⤵PID:3532
-
\??\c:\rrlfrlf.exec:\rrlfrlf.exe232⤵PID:3564
-
\??\c:\3pjjd.exec:\3pjjd.exe233⤵PID:696
-
\??\c:\046022.exec:\046022.exe234⤵PID:3912
-
\??\c:\84604.exec:\84604.exe235⤵PID:1160
-
\??\c:\djdvp.exec:\djdvp.exe236⤵PID:216
-
\??\c:\48208.exec:\48208.exe237⤵PID:4536
-
\??\c:\nhnhbt.exec:\nhnhbt.exe238⤵PID:5116
-
\??\c:\rffxrrr.exec:\rffxrrr.exe239⤵PID:4148
-
\??\c:\tnhhhh.exec:\tnhhhh.exe240⤵PID:4712
-
\??\c:\xxfxffx.exec:\xxfxffx.exe241⤵PID:3784
-
\??\c:\llxflrx.exec:\llxflrx.exe242⤵PID:4368