Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 23:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5e5fa6abb78b337db014c67da8007de0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
5e5fa6abb78b337db014c67da8007de0_NeikiAnalytics.exe
-
Size
74KB
-
MD5
5e5fa6abb78b337db014c67da8007de0
-
SHA1
68301dca22e9872c85d616a1a1ed0f172d952974
-
SHA256
0e3f42e05bc777b2cab3d1fa3e69979d290b05c6644aff549276e991bfe8df3f
-
SHA512
548a68fdf1994dada640e75fd0fe6c373f9328eba14dc777fb882cf09c72af65979bc5e1306252db61ad976c57c00a34e8f0175e379a6eba55795496fdc72005
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqK2:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqK2
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/804-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1356-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4356-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3000-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4356-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3348-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4264-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3132-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2316-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2316-57-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1352-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/792-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4552-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4160-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4140-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4740-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3688-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1332-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3364-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1068-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4920-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4984-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2300-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1928-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ttnbbh.exem4020.exe7vpjd.exe9nnbtt.exe42466.exe20842.exe6662806.exe480060.exevpdvp.exehbbnbb.exe842862.exe002868.exeflrrlfx.exe06822.exe8604226.exe062600.exenthhtt.exelxxxfll.exejvddd.exe20826.exe284444.exefllfxrr.exelxlfxxr.exeg4882.exehbtttt.exe0008260.exexrrlfxr.exerxfxrrl.exeppjjd.exe0448444.exe0688222.exepdjdv.exebttnbb.exe040804.exe0022668.exepdppp.exelxrrrrr.exe7xfxrlf.exevjdvp.exe9rfrfrf.exe8266882.exefxxxrrl.exejdpjp.exenhhhnh.exe6680820.exe6682600.exe44086.exe3ddvv.exenbbnnn.exe842266.exe240248.exe02800.exe6460882.exenhnhbt.exes6668.exe3fffxff.exeo666660.exeo244282.exe3xlfxxf.exetnbnhn.exew02828.exe844260.exe22600.exefxrrlll.exepid process 1356 ttnbbh.exe 4356 m4020.exe 3000 7vpjd.exe 3348 9nnbtt.exe 4264 42466.exe 3132 20842.exe 2316 6662806.exe 1352 480060.exe 4536 vpdvp.exe 792 hbbnbb.exe 4988 842862.exe 1412 002868.exe 4936 flrrlfx.exe 4468 06822.exe 4552 8604226.exe 4160 062600.exe 4140 nthhtt.exe 4740 lxxxfll.exe 3688 jvddd.exe 2744 20826.exe 1332 284444.exe 2992 fllfxrr.exe 3364 lxlfxxr.exe 4020 g4882.exe 4312 hbtttt.exe 3584 0008260.exe 1068 xrrlfxr.exe 4920 rxfxrrl.exe 4984 ppjjd.exe 2300 0448444.exe 1928 0688222.exe 436 pdjdv.exe 4056 bttnbb.exe 1032 040804.exe 4644 0022668.exe 5064 pdppp.exe 2732 lxrrrrr.exe 4220 7xfxrlf.exe 2688 vjdvp.exe 4420 9rfrfrf.exe 2996 8266882.exe 1076 fxxxrrl.exe 2488 jdpjp.exe 1072 nhhhnh.exe 4604 6680820.exe 3132 6682600.exe 4728 44086.exe 2540 3ddvv.exe 5044 nbbnnn.exe 3088 842266.exe 4036 240248.exe 4464 02800.exe 4872 6460882.exe 244 nhnhbt.exe 2924 s6668.exe 3016 3fffxff.exe 232 o666660.exe 4396 o244282.exe 3872 3xlfxxf.exe 4588 tnbnhn.exe 4140 w02828.exe 2628 844260.exe 3748 22600.exe 4300 fxrrlll.exe -
Processes:
resource yara_rule behavioral2/memory/804-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1356-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3000-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3348-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4264-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3132-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2316-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1352-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/792-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4552-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4160-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4140-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4740-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1332-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3364-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1068-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4920-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4984-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2300-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1928-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5e5fa6abb78b337db014c67da8007de0_NeikiAnalytics.exettnbbh.exem4020.exe7vpjd.exe9nnbtt.exe42466.exe20842.exe6662806.exe480060.exevpdvp.exehbbnbb.exe842862.exe002868.exeflrrlfx.exe06822.exe8604226.exe062600.exenthhtt.exelxxxfll.exejvddd.exe20826.exe284444.exedescription pid process target process PID 804 wrote to memory of 1356 804 5e5fa6abb78b337db014c67da8007de0_NeikiAnalytics.exe ttnbbh.exe PID 804 wrote to memory of 1356 804 5e5fa6abb78b337db014c67da8007de0_NeikiAnalytics.exe ttnbbh.exe PID 804 wrote to memory of 1356 804 5e5fa6abb78b337db014c67da8007de0_NeikiAnalytics.exe ttnbbh.exe PID 1356 wrote to memory of 4356 1356 ttnbbh.exe m4020.exe PID 1356 wrote to memory of 4356 1356 ttnbbh.exe m4020.exe PID 1356 wrote to memory of 4356 1356 ttnbbh.exe m4020.exe PID 4356 wrote to memory of 3000 4356 m4020.exe 7vpjd.exe PID 4356 wrote to memory of 3000 4356 m4020.exe 7vpjd.exe PID 4356 wrote to memory of 3000 4356 m4020.exe 7vpjd.exe PID 3000 wrote to memory of 3348 3000 7vpjd.exe 9nnbtt.exe PID 3000 wrote to memory of 3348 3000 7vpjd.exe 9nnbtt.exe PID 3000 wrote to memory of 3348 3000 7vpjd.exe 9nnbtt.exe PID 3348 wrote to memory of 4264 3348 9nnbtt.exe 42466.exe PID 3348 wrote to memory of 4264 3348 9nnbtt.exe 42466.exe PID 3348 wrote to memory of 4264 3348 9nnbtt.exe 42466.exe PID 4264 wrote to memory of 3132 4264 42466.exe 20842.exe PID 4264 wrote to memory of 3132 4264 42466.exe 20842.exe PID 4264 wrote to memory of 3132 4264 42466.exe 20842.exe PID 3132 wrote to memory of 2316 3132 20842.exe 6662806.exe PID 3132 wrote to memory of 2316 3132 20842.exe 6662806.exe PID 3132 wrote to memory of 2316 3132 20842.exe 6662806.exe PID 2316 wrote to memory of 1352 2316 6662806.exe 480060.exe PID 2316 wrote to memory of 1352 2316 6662806.exe 480060.exe PID 2316 wrote to memory of 1352 2316 6662806.exe 480060.exe PID 1352 wrote to memory of 4536 1352 480060.exe vpdvp.exe PID 1352 wrote to memory of 4536 1352 480060.exe vpdvp.exe PID 1352 wrote to memory of 4536 1352 480060.exe vpdvp.exe PID 4536 wrote to memory of 792 4536 vpdvp.exe hbbnbb.exe PID 4536 wrote to memory of 792 4536 vpdvp.exe hbbnbb.exe PID 4536 wrote to memory of 792 4536 vpdvp.exe hbbnbb.exe PID 792 wrote to memory of 4988 792 hbbnbb.exe 842862.exe PID 792 wrote to memory of 4988 792 hbbnbb.exe 842862.exe PID 792 wrote to memory of 4988 792 hbbnbb.exe 842862.exe PID 4988 wrote to memory of 1412 4988 842862.exe 002868.exe PID 4988 wrote to memory of 1412 4988 842862.exe 002868.exe PID 4988 wrote to memory of 1412 4988 842862.exe 002868.exe PID 1412 wrote to memory of 4936 1412 002868.exe flrrlfx.exe PID 1412 wrote to memory of 4936 1412 002868.exe flrrlfx.exe PID 1412 wrote to memory of 4936 1412 002868.exe flrrlfx.exe PID 4936 wrote to memory of 4468 4936 flrrlfx.exe 06822.exe PID 4936 wrote to memory of 4468 4936 flrrlfx.exe 06822.exe PID 4936 wrote to memory of 4468 4936 flrrlfx.exe 06822.exe PID 4468 wrote to memory of 4552 4468 06822.exe 8604226.exe PID 4468 wrote to memory of 4552 4468 06822.exe 8604226.exe PID 4468 wrote to memory of 4552 4468 06822.exe 8604226.exe PID 4552 wrote to memory of 4160 4552 8604226.exe 062600.exe PID 4552 wrote to memory of 4160 4552 8604226.exe 062600.exe PID 4552 wrote to memory of 4160 4552 8604226.exe 062600.exe PID 4160 wrote to memory of 4140 4160 062600.exe nthhtt.exe PID 4160 wrote to memory of 4140 4160 062600.exe nthhtt.exe PID 4160 wrote to memory of 4140 4160 062600.exe nthhtt.exe PID 4140 wrote to memory of 4740 4140 nthhtt.exe lxxxfll.exe PID 4140 wrote to memory of 4740 4140 nthhtt.exe lxxxfll.exe PID 4140 wrote to memory of 4740 4140 nthhtt.exe lxxxfll.exe PID 4740 wrote to memory of 3688 4740 lxxxfll.exe jvddd.exe PID 4740 wrote to memory of 3688 4740 lxxxfll.exe jvddd.exe PID 4740 wrote to memory of 3688 4740 lxxxfll.exe jvddd.exe PID 3688 wrote to memory of 2744 3688 jvddd.exe 20826.exe PID 3688 wrote to memory of 2744 3688 jvddd.exe 20826.exe PID 3688 wrote to memory of 2744 3688 jvddd.exe 20826.exe PID 2744 wrote to memory of 1332 2744 20826.exe 284444.exe PID 2744 wrote to memory of 1332 2744 20826.exe 284444.exe PID 2744 wrote to memory of 1332 2744 20826.exe 284444.exe PID 1332 wrote to memory of 2992 1332 284444.exe fllfxrr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e5fa6abb78b337db014c67da8007de0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5e5fa6abb78b337db014c67da8007de0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:804 -
\??\c:\ttnbbh.exec:\ttnbbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\m4020.exec:\m4020.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\7vpjd.exec:\7vpjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\9nnbtt.exec:\9nnbtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\42466.exec:\42466.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
\??\c:\20842.exec:\20842.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\6662806.exec:\6662806.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\480060.exec:\480060.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\vpdvp.exec:\vpdvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\hbbnbb.exec:\hbbnbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\842862.exec:\842862.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\002868.exec:\002868.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\flrrlfx.exec:\flrrlfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\06822.exec:\06822.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\8604226.exec:\8604226.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\062600.exec:\062600.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\nthhtt.exec:\nthhtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\lxxxfll.exec:\lxxxfll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
\??\c:\jvddd.exec:\jvddd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\20826.exec:\20826.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\284444.exec:\284444.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\fllfxrr.exec:\fllfxrr.exe23⤵
- Executes dropped EXE
PID:2992 -
\??\c:\lxlfxxr.exec:\lxlfxxr.exe24⤵
- Executes dropped EXE
PID:3364 -
\??\c:\g4882.exec:\g4882.exe25⤵
- Executes dropped EXE
PID:4020 -
\??\c:\hbtttt.exec:\hbtttt.exe26⤵
- Executes dropped EXE
PID:4312 -
\??\c:\0008260.exec:\0008260.exe27⤵
- Executes dropped EXE
PID:3584 -
\??\c:\xrrlfxr.exec:\xrrlfxr.exe28⤵
- Executes dropped EXE
PID:1068 -
\??\c:\rxfxrrl.exec:\rxfxrrl.exe29⤵
- Executes dropped EXE
PID:4920 -
\??\c:\ppjjd.exec:\ppjjd.exe30⤵
- Executes dropped EXE
PID:4984 -
\??\c:\0448444.exec:\0448444.exe31⤵
- Executes dropped EXE
PID:2300 -
\??\c:\0688222.exec:\0688222.exe32⤵
- Executes dropped EXE
PID:1928 -
\??\c:\pdjdv.exec:\pdjdv.exe33⤵
- Executes dropped EXE
PID:436 -
\??\c:\bttnbb.exec:\bttnbb.exe34⤵
- Executes dropped EXE
PID:4056 -
\??\c:\040804.exec:\040804.exe35⤵
- Executes dropped EXE
PID:1032 -
\??\c:\0022668.exec:\0022668.exe36⤵
- Executes dropped EXE
PID:4644 -
\??\c:\pdppp.exec:\pdppp.exe37⤵
- Executes dropped EXE
PID:5064 -
\??\c:\lxrrrrr.exec:\lxrrrrr.exe38⤵
- Executes dropped EXE
PID:2732 -
\??\c:\7xfxrlf.exec:\7xfxrlf.exe39⤵
- Executes dropped EXE
PID:4220 -
\??\c:\vjdvp.exec:\vjdvp.exe40⤵
- Executes dropped EXE
PID:2688 -
\??\c:\9rfrfrf.exec:\9rfrfrf.exe41⤵
- Executes dropped EXE
PID:4420 -
\??\c:\8266882.exec:\8266882.exe42⤵
- Executes dropped EXE
PID:2996 -
\??\c:\fxxxrrl.exec:\fxxxrrl.exe43⤵
- Executes dropped EXE
PID:1076 -
\??\c:\jdpjp.exec:\jdpjp.exe44⤵
- Executes dropped EXE
PID:2488 -
\??\c:\nhhhnh.exec:\nhhhnh.exe45⤵
- Executes dropped EXE
PID:1072 -
\??\c:\6680820.exec:\6680820.exe46⤵
- Executes dropped EXE
PID:4604 -
\??\c:\6682600.exec:\6682600.exe47⤵
- Executes dropped EXE
PID:3132 -
\??\c:\44086.exec:\44086.exe48⤵
- Executes dropped EXE
PID:4728 -
\??\c:\3ddvv.exec:\3ddvv.exe49⤵
- Executes dropped EXE
PID:2540 -
\??\c:\nbbnnn.exec:\nbbnnn.exe50⤵
- Executes dropped EXE
PID:5044 -
\??\c:\842266.exec:\842266.exe51⤵
- Executes dropped EXE
PID:3088 -
\??\c:\240248.exec:\240248.exe52⤵
- Executes dropped EXE
PID:4036 -
\??\c:\02800.exec:\02800.exe53⤵
- Executes dropped EXE
PID:4464 -
\??\c:\6460882.exec:\6460882.exe54⤵
- Executes dropped EXE
PID:4872 -
\??\c:\nhnhbt.exec:\nhnhbt.exe55⤵
- Executes dropped EXE
PID:244 -
\??\c:\s6668.exec:\s6668.exe56⤵
- Executes dropped EXE
PID:2924 -
\??\c:\3fffxff.exec:\3fffxff.exe57⤵
- Executes dropped EXE
PID:3016 -
\??\c:\o666660.exec:\o666660.exe58⤵
- Executes dropped EXE
PID:232 -
\??\c:\o244282.exec:\o244282.exe59⤵
- Executes dropped EXE
PID:4396 -
\??\c:\3xlfxxf.exec:\3xlfxxf.exe60⤵
- Executes dropped EXE
PID:3872 -
\??\c:\tnbnhn.exec:\tnbnhn.exe61⤵
- Executes dropped EXE
PID:4588 -
\??\c:\w02828.exec:\w02828.exe62⤵
- Executes dropped EXE
PID:4140 -
\??\c:\844260.exec:\844260.exe63⤵
- Executes dropped EXE
PID:2628 -
\??\c:\22600.exec:\22600.exe64⤵
- Executes dropped EXE
PID:3748 -
\??\c:\fxrrlll.exec:\fxrrlll.exe65⤵
- Executes dropped EXE
PID:4300 -
\??\c:\btbbtt.exec:\btbbtt.exe66⤵PID:4144
-
\??\c:\hhtthn.exec:\hhtthn.exe67⤵PID:316
-
\??\c:\60488.exec:\60488.exe68⤵PID:2992
-
\??\c:\4282684.exec:\4282684.exe69⤵PID:4188
-
\??\c:\662808.exec:\662808.exe70⤵PID:1224
-
\??\c:\pppjd.exec:\pppjd.exe71⤵PID:3596
-
\??\c:\804826.exec:\804826.exe72⤵PID:1792
-
\??\c:\lfrxffr.exec:\lfrxffr.exe73⤵PID:2548
-
\??\c:\428888.exec:\428888.exe74⤵PID:1068
-
\??\c:\444006.exec:\444006.exe75⤵PID:460
-
\??\c:\s0000.exec:\s0000.exe76⤵PID:2652
-
\??\c:\1nttnn.exec:\1nttnn.exe77⤵PID:4848
-
\??\c:\ffxfxll.exec:\ffxfxll.exe78⤵PID:1632
-
\??\c:\tbntbn.exec:\tbntbn.exe79⤵PID:4904
-
\??\c:\0482060.exec:\0482060.exe80⤵PID:3200
-
\??\c:\626684.exec:\626684.exe81⤵PID:1544
-
\??\c:\vjddd.exec:\vjddd.exe82⤵PID:116
-
\??\c:\9rrlfff.exec:\9rrlfff.exe83⤵PID:3456
-
\??\c:\5dvjj.exec:\5dvjj.exe84⤵PID:4636
-
\??\c:\nbbbtt.exec:\nbbbtt.exe85⤵PID:400
-
\??\c:\q88822.exec:\q88822.exe86⤵PID:4324
-
\??\c:\hbhnhn.exec:\hbhnhn.exe87⤵PID:2732
-
\??\c:\06626.exec:\06626.exe88⤵PID:2804
-
\??\c:\hhbnhn.exec:\hhbnhn.exe89⤵PID:3040
-
\??\c:\w88260.exec:\w88260.exe90⤵PID:4196
-
\??\c:\jjjdv.exec:\jjjdv.exe91⤵PID:2988
-
\??\c:\jpvpd.exec:\jpvpd.exe92⤵PID:216
-
\??\c:\1jpjp.exec:\1jpjp.exe93⤵PID:4136
-
\??\c:\g4004.exec:\g4004.exe94⤵PID:744
-
\??\c:\442262.exec:\442262.exe95⤵PID:3132
-
\??\c:\pjdvp.exec:\pjdvp.exe96⤵PID:3776
-
\??\c:\bhbbtn.exec:\bhbbtn.exe97⤵PID:3940
-
\??\c:\42888.exec:\42888.exe98⤵PID:5044
-
\??\c:\9btnhb.exec:\9btnhb.exe99⤵PID:1608
-
\??\c:\rlxrllf.exec:\rlxrllf.exe100⤵PID:3936
-
\??\c:\9nbhnb.exec:\9nbhnb.exe101⤵PID:5060
-
\??\c:\60426.exec:\60426.exe102⤵PID:2288
-
\??\c:\pdppj.exec:\pdppj.exe103⤵PID:3408
-
\??\c:\vpdvd.exec:\vpdvd.exe104⤵PID:1756
-
\??\c:\868442.exec:\868442.exe105⤵PID:408
-
\??\c:\a0642.exec:\a0642.exe106⤵PID:2908
-
\??\c:\4022004.exec:\4022004.exe107⤵PID:3332
-
\??\c:\640846.exec:\640846.exe108⤵PID:1436
-
\??\c:\628266.exec:\628266.exe109⤵PID:4244
-
\??\c:\6084666.exec:\6084666.exe110⤵PID:3152
-
\??\c:\frxxrrr.exec:\frxxrrr.exe111⤵PID:3928
-
\??\c:\lxlrfxr.exec:\lxlrfxr.exe112⤵PID:4808
-
\??\c:\dpdvv.exec:\dpdvv.exe113⤵PID:2444
-
\??\c:\0660226.exec:\0660226.exe114⤵PID:1984
-
\??\c:\xrxxllf.exec:\xrxxllf.exe115⤵PID:4600
-
\??\c:\c664688.exec:\c664688.exe116⤵PID:3436
-
\??\c:\tnnnnn.exec:\tnnnnn.exe117⤵PID:2140
-
\??\c:\nnnhbt.exec:\nnnhbt.exe118⤵PID:3120
-
\??\c:\040422.exec:\040422.exe119⤵PID:1300
-
\??\c:\060682.exec:\060682.exe120⤵PID:3656
-
\??\c:\nbhbtb.exec:\nbhbtb.exe121⤵PID:3352
-
\??\c:\bbbtnn.exec:\bbbtnn.exe122⤵PID:3904
-
\??\c:\80026.exec:\80026.exe123⤵PID:3228
-
\??\c:\bnbtnt.exec:\bnbtnt.exe124⤵PID:3460
-
\??\c:\1frrllf.exec:\1frrllf.exe125⤵PID:4752
-
\??\c:\a2884.exec:\a2884.exe126⤵PID:1544
-
\??\c:\htnhhb.exec:\htnhhb.exe127⤵PID:4644
-
\??\c:\tnhhtt.exec:\tnhhtt.exe128⤵PID:4636
-
\??\c:\pvvvp.exec:\pvvvp.exe129⤵PID:3192
-
\??\c:\2882660.exec:\2882660.exe130⤵PID:2688
-
\??\c:\rxrfffx.exec:\rxrfffx.exe131⤵PID:3232
-
\??\c:\btttnn.exec:\btttnn.exe132⤵PID:3912
-
\??\c:\80208.exec:\80208.exe133⤵PID:1908
-
\??\c:\4886420.exec:\4886420.exe134⤵PID:1152
-
\??\c:\u400444.exec:\u400444.exe135⤵PID:4524
-
\??\c:\lxffxxx.exec:\lxffxxx.exe136⤵PID:4800
-
\??\c:\xxllrrr.exec:\xxllrrr.exe137⤵PID:3132
-
\??\c:\nbthbt.exec:\nbthbt.exe138⤵PID:3776
-
\??\c:\dddvp.exec:\dddvp.exe139⤵PID:1468
-
\??\c:\9ntnhh.exec:\9ntnhh.exe140⤵PID:4164
-
\??\c:\688800.exec:\688800.exe141⤵PID:1412
-
\??\c:\g4460.exec:\g4460.exe142⤵PID:4116
-
\??\c:\m8822.exec:\m8822.exe143⤵PID:2120
-
\??\c:\8268080.exec:\8268080.exe144⤵PID:3032
-
\??\c:\rxllffx.exec:\rxllffx.exe145⤵PID:3900
-
\??\c:\ttbbhh.exec:\ttbbhh.exe146⤵PID:5032
-
\??\c:\s6266.exec:\s6266.exe147⤵PID:3680
-
\??\c:\48226.exec:\48226.exe148⤵PID:3332
-
\??\c:\nnhbbt.exec:\nnhbbt.exe149⤵PID:5000
-
\??\c:\3hhhtt.exec:\3hhhtt.exe150⤵PID:5056
-
\??\c:\4800062.exec:\4800062.exe151⤵PID:4376
-
\??\c:\rfxlfll.exec:\rfxlfll.exe152⤵PID:4384
-
\??\c:\60008.exec:\60008.exe153⤵PID:3320
-
\??\c:\rffxrrl.exec:\rffxrrl.exe154⤵PID:5052
-
\??\c:\q20884.exec:\q20884.exe155⤵PID:4020
-
\??\c:\66462.exec:\66462.exe156⤵PID:2620
-
\??\c:\i404860.exec:\i404860.exe157⤵PID:2440
-
\??\c:\rlllffl.exec:\rlllffl.exe158⤵PID:4940
-
\??\c:\pdpdj.exec:\pdpdj.exe159⤵PID:4416
-
\??\c:\9lxxrrr.exec:\9lxxrrr.exe160⤵PID:4732
-
\??\c:\2400000.exec:\2400000.exe161⤵PID:1404
-
\??\c:\026688.exec:\026688.exe162⤵PID:2652
-
\??\c:\6228888.exec:\6228888.exe163⤵PID:4888
-
\??\c:\9bhbhh.exec:\9bhbhh.exe164⤵PID:3460
-
\??\c:\rfllxlr.exec:\rfllxlr.exe165⤵PID:4752
-
\??\c:\q66682.exec:\q66682.exe166⤵PID:2904
-
\??\c:\484646.exec:\484646.exe167⤵PID:3004
-
\??\c:\tnhnhb.exec:\tnhnhb.exe168⤵PID:4232
-
\??\c:\a2204.exec:\a2204.exe169⤵PID:688
-
\??\c:\668860.exec:\668860.exe170⤵PID:2136
-
\??\c:\pjpdv.exec:\pjpdv.exe171⤵PID:3232
-
\??\c:\vjpjd.exec:\vjpjd.exe172⤵PID:224
-
\??\c:\20260.exec:\20260.exe173⤵PID:216
-
\??\c:\rlxxrxl.exec:\rlxxrxl.exe174⤵PID:1152
-
\??\c:\640444.exec:\640444.exe175⤵PID:1352
-
\??\c:\3vpjd.exec:\3vpjd.exe176⤵PID:2540
-
\??\c:\0260222.exec:\0260222.exe177⤵PID:4952
-
\??\c:\bbnnhh.exec:\bbnnhh.exe178⤵PID:3776
-
\??\c:\6888006.exec:\6888006.exe179⤵PID:904
-
\??\c:\rllffff.exec:\rllffff.exe180⤵PID:4872
-
\??\c:\284044.exec:\284044.exe181⤵PID:5060
-
\??\c:\k06600.exec:\k06600.exe182⤵PID:3740
-
\??\c:\804866.exec:\804866.exe183⤵PID:4640
-
\??\c:\9bhbtt.exec:\9bhbtt.exe184⤵PID:1756
-
\??\c:\xlflrlx.exec:\xlflrlx.exe185⤵PID:2908
-
\??\c:\tnhhhh.exec:\tnhhhh.exe186⤵PID:3020
-
\??\c:\g6826.exec:\g6826.exe187⤵PID:1436
-
\??\c:\4066000.exec:\4066000.exe188⤵PID:4628
-
\??\c:\thhbtt.exec:\thhbtt.exe189⤵PID:4440
-
\??\c:\688826.exec:\688826.exe190⤵PID:1948
-
\??\c:\206820.exec:\206820.exe191⤵PID:4808
-
\??\c:\jjddd.exec:\jjddd.exe192⤵PID:1228
-
\??\c:\vjpjd.exec:\vjpjd.exe193⤵PID:4528
-
\??\c:\hbnhhn.exec:\hbnhhn.exe194⤵PID:4188
-
\??\c:\44022.exec:\44022.exe195⤵PID:3596
-
\??\c:\4648222.exec:\4648222.exe196⤵PID:2480
-
\??\c:\806644.exec:\806644.exe197⤵PID:396
-
\??\c:\hnhbhb.exec:\hnhbhb.exe198⤵PID:1300
-
\??\c:\nntnnn.exec:\nntnnn.exe199⤵PID:3352
-
\??\c:\4688000.exec:\4688000.exe200⤵PID:4076
-
\??\c:\640086.exec:\640086.exe201⤵PID:3988
-
\??\c:\fllfxxr.exec:\fllfxxr.exe202⤵PID:4332
-
\??\c:\800482.exec:\800482.exe203⤵PID:3100
-
\??\c:\22000.exec:\22000.exe204⤵PID:2588
-
\??\c:\lrrlxrl.exec:\lrrlxrl.exe205⤵PID:3580
-
\??\c:\tnttnn.exec:\tnttnn.exe206⤵PID:5064
-
\??\c:\q60668.exec:\q60668.exe207⤵PID:4232
-
\??\c:\0840402.exec:\0840402.exe208⤵PID:2688
-
\??\c:\48444.exec:\48444.exe209⤵PID:4196
-
\??\c:\0826264.exec:\0826264.exe210⤵PID:1052
-
\??\c:\vpvpp.exec:\vpvpp.exe211⤵PID:4604
-
\??\c:\6880264.exec:\6880264.exe212⤵PID:1280
-
\??\c:\httnhb.exec:\httnhb.exe213⤵PID:3064
-
\??\c:\ddvvp.exec:\ddvvp.exe214⤵PID:864
-
\??\c:\262644.exec:\262644.exe215⤵PID:1752
-
\??\c:\g8482.exec:\g8482.exe216⤵PID:3936
-
\??\c:\tbbntt.exec:\tbbntt.exe217⤵PID:1796
-
\??\c:\4042020.exec:\4042020.exe218⤵PID:2924
-
\??\c:\26260.exec:\26260.exe219⤵PID:4116
-
\??\c:\60066.exec:\60066.exe220⤵PID:3740
-
\??\c:\4620648.exec:\4620648.exe221⤵PID:3872
-
\??\c:\bnnttn.exec:\bnnttn.exe222⤵PID:2908
-
\??\c:\u008428.exec:\u008428.exe223⤵PID:3020
-
\??\c:\rflxffl.exec:\rflxffl.exe224⤵PID:1196
-
\??\c:\880048.exec:\880048.exe225⤵PID:4628
-
\??\c:\640048.exec:\640048.exe226⤵PID:4440
-
\??\c:\vjppj.exec:\vjppj.exe227⤵PID:4048
-
\??\c:\xrrllfx.exec:\xrrllfx.exe228⤵PID:3320
-
\??\c:\82484.exec:\82484.exe229⤵PID:1228
-
\??\c:\hnntnh.exec:\hnntnh.exe230⤵PID:1632
-
\??\c:\86844.exec:\86844.exe231⤵PID:2768
-
\??\c:\jdvpp.exec:\jdvpp.exe232⤵PID:3144
-
\??\c:\08006.exec:\08006.exe233⤵PID:2844
-
\??\c:\222464.exec:\222464.exe234⤵PID:4932
-
\??\c:\2204226.exec:\2204226.exe235⤵PID:2584
-
\??\c:\0864024.exec:\0864024.exe236⤵PID:2300
-
\??\c:\hnhtbn.exec:\hnhtbn.exe237⤵PID:4504
-
\??\c:\80664.exec:\80664.exe238⤵PID:4448
-
\??\c:\vdjjj.exec:\vdjjj.exe239⤵PID:4752
-
\??\c:\hhhbbt.exec:\hhhbbt.exe240⤵PID:1544
-
\??\c:\802266.exec:\802266.exe241⤵PID:2732
-
\??\c:\flllrfl.exec:\flllrfl.exe242⤵PID:5064