Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 04:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
77f805c529905017f9f36ca773e4d940_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
77f805c529905017f9f36ca773e4d940_NeikiAnalytics.exe
-
Size
54KB
-
MD5
77f805c529905017f9f36ca773e4d940
-
SHA1
cc9cfa00dfc59e383ac8adf67bb3d00ff3efe2ae
-
SHA256
87a3964856dc460ec147cec15bf20bab1e62c80f79650b1d1594cbdd597ccc95
-
SHA512
ddff896254cdb55df2de6ecfb1c10179a9382ed130576c56bf3a78787f4dca7c34e216d65f813e9c2a96adecbedc91e2141f31fa2799b67d7bbea7d6c196500f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFT:ymb3NkkiQ3mdBjFIFT
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral2/memory/3228-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4248-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4148-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3988-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2844-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4160-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1188-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1472-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2492-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4140-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2584-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3680-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4644-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2088-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1544-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3040-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5092-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/904-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4104-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
48048.exe6860408.exe1xxrllf.exe46226.exepjpjv.exenbnhbb.exe7ppjv.exerflfrfx.exefxxrllf.exelfxxrll.exe80002.exe7jjjd.exe0848286.exe5tttnt.exetbnnnb.exe606062.exepjdvp.exe06820.exexxxxlfx.exe46482.exexrlfxlf.exe0664240.exedjjpj.exethntnn.exennnnhb.exethhnbh.exe5nthbb.exe1hnhtt.exe04024.exew84860.exe1xffllr.exe64020.exe806862.exepdjdv.exe06488.exe5ffxrlf.exehbbbtt.exeu682660.exe2684882.exe822600.exedjjvp.exeo044800.exevvddj.exexxxlffx.exe0680462.exe26422.exetthtnh.exe7ntnbh.exe1rrrffr.exew40002.exe68206.exe808200.exelfffrlf.exehbtnnn.exevdvjj.exec086262.exejdpjp.exe6284422.exefxfxrrr.exerllflfl.exe20826.exexrlxrlx.exebnnhbb.exe228246.exepid process 5008 48048.exe 4248 6860408.exe 4148 1xxrllf.exe 3988 46226.exe 2844 pjpjv.exe 2280 nbnhbb.exe 4160 7ppjv.exe 1268 rflfrfx.exe 1188 fxxrllf.exe 1472 lfxxrll.exe 2492 80002.exe 4140 7jjjd.exe 2584 0848286.exe 220 5tttnt.exe 3680 tbnnnb.exe 4644 606062.exe 2088 pjdvp.exe 3748 06820.exe 2508 xxxxlfx.exe 4532 46482.exe 1544 xrlfxlf.exe 2108 0664240.exe 3040 djjpj.exe 4428 thntnn.exe 5092 nnnnhb.exe 2640 thhnbh.exe 1608 5nthbb.exe 1152 1hnhtt.exe 904 04024.exe 4956 w84860.exe 4104 1xffllr.exe 3684 64020.exe 2988 806862.exe 4180 pdjdv.exe 4980 06488.exe 2824 5ffxrlf.exe 3192 hbbbtt.exe 4328 u682660.exe 4536 2684882.exe 3212 822600.exe 116 djjvp.exe 1468 o044800.exe 3400 vvddj.exe 4148 xxxlffx.exe 2036 0680462.exe 4736 26422.exe 4044 tthtnh.exe 2380 7ntnbh.exe 5020 1rrrffr.exe 3136 w40002.exe 5040 68206.exe 1756 808200.exe 1472 lfffrlf.exe 2104 hbtnnn.exe 4724 vdvjj.exe 2584 c086262.exe 2496 jdpjp.exe 4288 6284422.exe 1220 fxfxrrr.exe 920 rllflfl.exe 2088 20826.exe 1896 xrlxrlx.exe 4260 bnnhbb.exe 4212 228246.exe -
Processes:
resource yara_rule behavioral2/memory/3228-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4248-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4148-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3988-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2844-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2844-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4160-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1268-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1268-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1268-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1188-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1472-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2492-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4140-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2584-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3680-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4644-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2088-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1544-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3040-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4428-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/904-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4104-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
77f805c529905017f9f36ca773e4d940_NeikiAnalytics.exe48048.exe6860408.exe1xxrllf.exe46226.exepjpjv.exenbnhbb.exe7ppjv.exerflfrfx.exefxxrllf.exelfxxrll.exe80002.exe7jjjd.exe0848286.exe5tttnt.exetbnnnb.exe606062.exepjdvp.exe06820.exexxxxlfx.exe46482.exexrlfxlf.exedescription pid process target process PID 3228 wrote to memory of 5008 3228 77f805c529905017f9f36ca773e4d940_NeikiAnalytics.exe 48048.exe PID 3228 wrote to memory of 5008 3228 77f805c529905017f9f36ca773e4d940_NeikiAnalytics.exe 48048.exe PID 3228 wrote to memory of 5008 3228 77f805c529905017f9f36ca773e4d940_NeikiAnalytics.exe 48048.exe PID 5008 wrote to memory of 4248 5008 48048.exe 6860408.exe PID 5008 wrote to memory of 4248 5008 48048.exe 6860408.exe PID 5008 wrote to memory of 4248 5008 48048.exe 6860408.exe PID 4248 wrote to memory of 4148 4248 6860408.exe 1xxrllf.exe PID 4248 wrote to memory of 4148 4248 6860408.exe 1xxrllf.exe PID 4248 wrote to memory of 4148 4248 6860408.exe 1xxrllf.exe PID 4148 wrote to memory of 3988 4148 1xxrllf.exe 46226.exe PID 4148 wrote to memory of 3988 4148 1xxrllf.exe 46226.exe PID 4148 wrote to memory of 3988 4148 1xxrllf.exe 46226.exe PID 3988 wrote to memory of 2844 3988 46226.exe pjpjv.exe PID 3988 wrote to memory of 2844 3988 46226.exe pjpjv.exe PID 3988 wrote to memory of 2844 3988 46226.exe pjpjv.exe PID 2844 wrote to memory of 2280 2844 pjpjv.exe nbnhbb.exe PID 2844 wrote to memory of 2280 2844 pjpjv.exe nbnhbb.exe PID 2844 wrote to memory of 2280 2844 pjpjv.exe nbnhbb.exe PID 2280 wrote to memory of 4160 2280 nbnhbb.exe 7ppjv.exe PID 2280 wrote to memory of 4160 2280 nbnhbb.exe 7ppjv.exe PID 2280 wrote to memory of 4160 2280 nbnhbb.exe 7ppjv.exe PID 4160 wrote to memory of 1268 4160 7ppjv.exe rflfrfx.exe PID 4160 wrote to memory of 1268 4160 7ppjv.exe rflfrfx.exe PID 4160 wrote to memory of 1268 4160 7ppjv.exe rflfrfx.exe PID 1268 wrote to memory of 1188 1268 rflfrfx.exe fxxrllf.exe PID 1268 wrote to memory of 1188 1268 rflfrfx.exe fxxrllf.exe PID 1268 wrote to memory of 1188 1268 rflfrfx.exe fxxrllf.exe PID 1188 wrote to memory of 1472 1188 fxxrllf.exe lfxxrll.exe PID 1188 wrote to memory of 1472 1188 fxxrllf.exe lfxxrll.exe PID 1188 wrote to memory of 1472 1188 fxxrllf.exe lfxxrll.exe PID 1472 wrote to memory of 2492 1472 lfxxrll.exe 80002.exe PID 1472 wrote to memory of 2492 1472 lfxxrll.exe 80002.exe PID 1472 wrote to memory of 2492 1472 lfxxrll.exe 80002.exe PID 2492 wrote to memory of 4140 2492 80002.exe 7jjjd.exe PID 2492 wrote to memory of 4140 2492 80002.exe 7jjjd.exe PID 2492 wrote to memory of 4140 2492 80002.exe 7jjjd.exe PID 4140 wrote to memory of 2584 4140 7jjjd.exe 0848286.exe PID 4140 wrote to memory of 2584 4140 7jjjd.exe 0848286.exe PID 4140 wrote to memory of 2584 4140 7jjjd.exe 0848286.exe PID 2584 wrote to memory of 220 2584 0848286.exe 5tttnt.exe PID 2584 wrote to memory of 220 2584 0848286.exe 5tttnt.exe PID 2584 wrote to memory of 220 2584 0848286.exe 5tttnt.exe PID 220 wrote to memory of 3680 220 5tttnt.exe tbnnnb.exe PID 220 wrote to memory of 3680 220 5tttnt.exe tbnnnb.exe PID 220 wrote to memory of 3680 220 5tttnt.exe tbnnnb.exe PID 3680 wrote to memory of 4644 3680 tbnnnb.exe 606062.exe PID 3680 wrote to memory of 4644 3680 tbnnnb.exe 606062.exe PID 3680 wrote to memory of 4644 3680 tbnnnb.exe 606062.exe PID 4644 wrote to memory of 2088 4644 606062.exe pjdvp.exe PID 4644 wrote to memory of 2088 4644 606062.exe pjdvp.exe PID 4644 wrote to memory of 2088 4644 606062.exe pjdvp.exe PID 2088 wrote to memory of 3748 2088 pjdvp.exe 06820.exe PID 2088 wrote to memory of 3748 2088 pjdvp.exe 06820.exe PID 2088 wrote to memory of 3748 2088 pjdvp.exe 06820.exe PID 3748 wrote to memory of 2508 3748 06820.exe xxxxlfx.exe PID 3748 wrote to memory of 2508 3748 06820.exe xxxxlfx.exe PID 3748 wrote to memory of 2508 3748 06820.exe xxxxlfx.exe PID 2508 wrote to memory of 4532 2508 xxxxlfx.exe 46482.exe PID 2508 wrote to memory of 4532 2508 xxxxlfx.exe 46482.exe PID 2508 wrote to memory of 4532 2508 xxxxlfx.exe 46482.exe PID 4532 wrote to memory of 1544 4532 46482.exe xrlfxlf.exe PID 4532 wrote to memory of 1544 4532 46482.exe xrlfxlf.exe PID 4532 wrote to memory of 1544 4532 46482.exe xrlfxlf.exe PID 1544 wrote to memory of 2108 1544 xrlfxlf.exe 0664240.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\77f805c529905017f9f36ca773e4d940_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\77f805c529905017f9f36ca773e4d940_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\48048.exec:\48048.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\6860408.exec:\6860408.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\1xxrllf.exec:\1xxrllf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\46226.exec:\46226.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\pjpjv.exec:\pjpjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\nbnhbb.exec:\nbnhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\7ppjv.exec:\7ppjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\rflfrfx.exec:\rflfrfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\fxxrllf.exec:\fxxrllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\lfxxrll.exec:\lfxxrll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\80002.exec:\80002.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\7jjjd.exec:\7jjjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\0848286.exec:\0848286.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\5tttnt.exec:\5tttnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\tbnnnb.exec:\tbnnnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
\??\c:\606062.exec:\606062.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
\??\c:\pjdvp.exec:\pjdvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\06820.exec:\06820.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\xxxxlfx.exec:\xxxxlfx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\46482.exec:\46482.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\xrlfxlf.exec:\xrlfxlf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\0664240.exec:\0664240.exe23⤵
- Executes dropped EXE
PID:2108 -
\??\c:\djjpj.exec:\djjpj.exe24⤵
- Executes dropped EXE
PID:3040 -
\??\c:\thntnn.exec:\thntnn.exe25⤵
- Executes dropped EXE
PID:4428 -
\??\c:\nnnnhb.exec:\nnnnhb.exe26⤵
- Executes dropped EXE
PID:5092 -
\??\c:\thhnbh.exec:\thhnbh.exe27⤵
- Executes dropped EXE
PID:2640 -
\??\c:\5nthbb.exec:\5nthbb.exe28⤵
- Executes dropped EXE
PID:1608 -
\??\c:\1hnhtt.exec:\1hnhtt.exe29⤵
- Executes dropped EXE
PID:1152 -
\??\c:\04024.exec:\04024.exe30⤵
- Executes dropped EXE
PID:904 -
\??\c:\w84860.exec:\w84860.exe31⤵
- Executes dropped EXE
PID:4956 -
\??\c:\1xffllr.exec:\1xffllr.exe32⤵
- Executes dropped EXE
PID:4104 -
\??\c:\64020.exec:\64020.exe33⤵
- Executes dropped EXE
PID:3684 -
\??\c:\806862.exec:\806862.exe34⤵
- Executes dropped EXE
PID:2988 -
\??\c:\pdjdv.exec:\pdjdv.exe35⤵
- Executes dropped EXE
PID:4180 -
\??\c:\06488.exec:\06488.exe36⤵
- Executes dropped EXE
PID:4980 -
\??\c:\5ffxrlf.exec:\5ffxrlf.exe37⤵
- Executes dropped EXE
PID:2824 -
\??\c:\hbbbtt.exec:\hbbbtt.exe38⤵
- Executes dropped EXE
PID:3192 -
\??\c:\u682660.exec:\u682660.exe39⤵
- Executes dropped EXE
PID:4328 -
\??\c:\2684882.exec:\2684882.exe40⤵
- Executes dropped EXE
PID:4536 -
\??\c:\822600.exec:\822600.exe41⤵
- Executes dropped EXE
PID:3212 -
\??\c:\djjvp.exec:\djjvp.exe42⤵
- Executes dropped EXE
PID:116 -
\??\c:\o044800.exec:\o044800.exe43⤵
- Executes dropped EXE
PID:1468 -
\??\c:\vvddj.exec:\vvddj.exe44⤵
- Executes dropped EXE
PID:3400 -
\??\c:\xxxlffx.exec:\xxxlffx.exe45⤵
- Executes dropped EXE
PID:4148 -
\??\c:\0680462.exec:\0680462.exe46⤵
- Executes dropped EXE
PID:2036 -
\??\c:\26422.exec:\26422.exe47⤵
- Executes dropped EXE
PID:4736 -
\??\c:\tthtnh.exec:\tthtnh.exe48⤵
- Executes dropped EXE
PID:4044 -
\??\c:\7ntnbh.exec:\7ntnbh.exe49⤵
- Executes dropped EXE
PID:2380 -
\??\c:\1rrrffr.exec:\1rrrffr.exe50⤵
- Executes dropped EXE
PID:5020 -
\??\c:\w40002.exec:\w40002.exe51⤵
- Executes dropped EXE
PID:3136 -
\??\c:\68206.exec:\68206.exe52⤵
- Executes dropped EXE
PID:5040 -
\??\c:\808200.exec:\808200.exe53⤵
- Executes dropped EXE
PID:1756 -
\??\c:\lfffrlf.exec:\lfffrlf.exe54⤵
- Executes dropped EXE
PID:1472 -
\??\c:\hbtnnn.exec:\hbtnnn.exe55⤵
- Executes dropped EXE
PID:2104 -
\??\c:\vdvjj.exec:\vdvjj.exe56⤵
- Executes dropped EXE
PID:4724 -
\??\c:\c086262.exec:\c086262.exe57⤵
- Executes dropped EXE
PID:2584 -
\??\c:\jdpjp.exec:\jdpjp.exe58⤵
- Executes dropped EXE
PID:2496 -
\??\c:\6284422.exec:\6284422.exe59⤵
- Executes dropped EXE
PID:4288 -
\??\c:\fxfxrrr.exec:\fxfxrrr.exe60⤵
- Executes dropped EXE
PID:1220 -
\??\c:\rllflfl.exec:\rllflfl.exe61⤵
- Executes dropped EXE
PID:920 -
\??\c:\20826.exec:\20826.exe62⤵
- Executes dropped EXE
PID:2088 -
\??\c:\xrlxrlx.exec:\xrlxrlx.exe63⤵
- Executes dropped EXE
PID:1896 -
\??\c:\bnnhbb.exec:\bnnhbb.exe64⤵
- Executes dropped EXE
PID:4260 -
\??\c:\228246.exec:\228246.exe65⤵
- Executes dropped EXE
PID:4212 -
\??\c:\0404200.exec:\0404200.exe66⤵PID:640
-
\??\c:\dpjpd.exec:\dpjpd.exe67⤵PID:1336
-
\??\c:\7jpvv.exec:\7jpvv.exe68⤵PID:2528
-
\??\c:\vjddd.exec:\vjddd.exe69⤵PID:2372
-
\??\c:\xrxrrrx.exec:\xrxrrrx.exe70⤵PID:2272
-
\??\c:\628260.exec:\628260.exe71⤵PID:4672
-
\??\c:\7dvvp.exec:\7dvvp.exe72⤵PID:1180
-
\??\c:\o604824.exec:\o604824.exe73⤵PID:3196
-
\??\c:\w84822.exec:\w84822.exe74⤵PID:3260
-
\??\c:\jjppd.exec:\jjppd.exe75⤵PID:4880
-
\??\c:\46882.exec:\46882.exe76⤵PID:904
-
\??\c:\pjjdj.exec:\pjjdj.exe77⤵PID:4956
-
\??\c:\7xrfrrl.exec:\7xrfrrl.exe78⤵PID:1712
-
\??\c:\rxffffx.exec:\rxffffx.exe79⤵PID:1976
-
\??\c:\24420.exec:\24420.exe80⤵PID:3200
-
\??\c:\0226604.exec:\0226604.exe81⤵PID:3900
-
\??\c:\1vvjv.exec:\1vvjv.exe82⤵PID:3420
-
\??\c:\bhhbnh.exec:\bhhbnh.exe83⤵PID:3804
-
\??\c:\5hhnnt.exec:\5hhnnt.exe84⤵PID:3720
-
\??\c:\6804888.exec:\6804888.exe85⤵PID:4360
-
\??\c:\6042828.exec:\6042828.exe86⤵PID:3228
-
\??\c:\nnnnnn.exec:\nnnnnn.exe87⤵PID:3120
-
\??\c:\8082226.exec:\8082226.exe88⤵PID:1016
-
\??\c:\frrllrl.exec:\frrllrl.exe89⤵PID:3292
-
\??\c:\fxrxffl.exec:\fxrxffl.exe90⤵PID:1776
-
\??\c:\0684882.exec:\0684882.exe91⤵PID:4652
-
\??\c:\tbtbnt.exec:\tbtbnt.exe92⤵PID:4888
-
\??\c:\dppjj.exec:\dppjj.exe93⤵PID:4156
-
\??\c:\668440.exec:\668440.exe94⤵PID:4804
-
\??\c:\xfrlffx.exec:\xfrlffx.exe95⤵PID:2280
-
\??\c:\1jfrl.exec:\1jfrl.exe96⤵PID:5096
-
\??\c:\8248226.exec:\8248226.exe97⤵PID:4756
-
\??\c:\a8042.exec:\a8042.exe98⤵PID:1924
-
\??\c:\lrlfxxr.exec:\lrlfxxr.exe99⤵PID:1112
-
\??\c:\242026.exec:\242026.exe100⤵PID:472
-
\??\c:\440866.exec:\440866.exe101⤵PID:556
-
\??\c:\rlrflxf.exec:\rlrflxf.exe102⤵PID:2960
-
\??\c:\42260.exec:\42260.exe103⤵PID:4208
-
\??\c:\2680600.exec:\2680600.exe104⤵PID:3928
-
\??\c:\4826264.exec:\4826264.exe105⤵PID:2920
-
\??\c:\624440.exec:\624440.exe106⤵PID:220
-
\??\c:\bnnhbt.exec:\bnnhbt.exe107⤵PID:3680
-
\??\c:\200848.exec:\200848.exe108⤵PID:4316
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe109⤵PID:3888
-
\??\c:\0404488.exec:\0404488.exe110⤵PID:2940
-
\??\c:\djdvp.exec:\djdvp.exe111⤵PID:4260
-
\??\c:\tttnnt.exec:\tttnnt.exe112⤵PID:1544
-
\??\c:\xrxrllf.exec:\xrxrllf.exe113⤵PID:640
-
\??\c:\20826.exec:\20826.exe114⤵PID:1336
-
\??\c:\c004044.exec:\c004044.exe115⤵PID:2944
-
\??\c:\rrflfrf.exec:\rrflfrf.exe116⤵PID:2324
-
\??\c:\9nttbb.exec:\9nttbb.exe117⤵PID:2180
-
\??\c:\httthh.exec:\httthh.exe118⤵PID:768
-
\??\c:\484826.exec:\484826.exe119⤵PID:2864
-
\??\c:\828266.exec:\828266.exe120⤵PID:4704
-
\??\c:\frxxrrr.exec:\frxxrrr.exe121⤵PID:1152
-
\??\c:\s2882.exec:\s2882.exe122⤵PID:2268
-
\??\c:\02260.exec:\02260.exe123⤵PID:4448
-
\??\c:\2842660.exec:\2842660.exe124⤵PID:5076
-
\??\c:\hhhbtt.exec:\hhhbtt.exe125⤵PID:1660
-
\??\c:\1xrlllx.exec:\1xrlllx.exe126⤵PID:452
-
\??\c:\m8022.exec:\m8022.exe127⤵PID:2800
-
\??\c:\tnhbnn.exec:\tnhbnn.exe128⤵PID:5084
-
\??\c:\240088.exec:\240088.exe129⤵PID:3840
-
\??\c:\3xfxlrx.exec:\3xfxlrx.exe130⤵PID:1620
-
\??\c:\tbhbhb.exec:\tbhbhb.exe131⤵PID:4364
-
\??\c:\4026444.exec:\4026444.exe132⤵PID:940
-
\??\c:\2460808.exec:\2460808.exe133⤵PID:1328
-
\??\c:\646088.exec:\646088.exe134⤵PID:116
-
\??\c:\lfrfffr.exec:\lfrfffr.exe135⤵PID:4932
-
\??\c:\w06088.exec:\w06088.exe136⤵PID:4616
-
\??\c:\1pdjd.exec:\1pdjd.exe137⤵PID:4736
-
\??\c:\26648.exec:\26648.exe138⤵PID:2804
-
\??\c:\flxxlrf.exec:\flxxlrf.exe139⤵PID:3488
-
\??\c:\602282.exec:\602282.exe140⤵PID:3028
-
\??\c:\thhbnt.exec:\thhbnt.exe141⤵PID:3316
-
\??\c:\8626044.exec:\8626044.exe142⤵PID:1188
-
\??\c:\02840.exec:\02840.exe143⤵PID:3648
-
\??\c:\vdddp.exec:\vdddp.exe144⤵PID:4000
-
\??\c:\480480.exec:\480480.exe145⤵PID:60
-
\??\c:\86000.exec:\86000.exe146⤵PID:1072
-
\??\c:\ddvvd.exec:\ddvvd.exe147⤵PID:3604
-
\??\c:\vvdvv.exec:\vvdvv.exe148⤵PID:5088
-
\??\c:\ffrlfrr.exec:\ffrlfrr.exe149⤵PID:2508
-
\??\c:\82488.exec:\82488.exe150⤵PID:2480
-
\??\c:\40022.exec:\40022.exe151⤵PID:2936
-
\??\c:\bbhbbt.exec:\bbhbbt.exe152⤵PID:1720
-
\??\c:\rlxrllf.exec:\rlxrllf.exe153⤵PID:640
-
\??\c:\u848222.exec:\u848222.exe154⤵PID:4428
-
\??\c:\lxrrlrx.exec:\lxrrlrx.exe155⤵PID:4684
-
\??\c:\84660.exec:\84660.exe156⤵PID:3960
-
\??\c:\bbhbbh.exec:\bbhbbh.exe157⤵PID:1608
-
\??\c:\jjjdd.exec:\jjjdd.exe158⤵PID:624
-
\??\c:\s6422.exec:\s6422.exe159⤵PID:2316
-
\??\c:\fxffxxx.exec:\fxffxxx.exe160⤵PID:3308
-
\??\c:\84648.exec:\84648.exe161⤵PID:3564
-
\??\c:\9rrlflf.exec:\9rrlflf.exe162⤵PID:3508
-
\??\c:\rfllfff.exec:\rfllfff.exe163⤵PID:4544
-
\??\c:\3rfxffl.exec:\3rfxffl.exe164⤵PID:1700
-
\??\c:\662488.exec:\662488.exe165⤵PID:4608
-
\??\c:\840488.exec:\840488.exe166⤵PID:3796
-
\??\c:\4060660.exec:\4060660.exe167⤵PID:3420
-
\??\c:\800044.exec:\800044.exe168⤵PID:1176
-
\??\c:\020422.exec:\020422.exe169⤵PID:1944
-
\??\c:\m4002.exec:\m4002.exe170⤵PID:4364
-
\??\c:\26228.exec:\26228.exe171⤵PID:2884
-
\??\c:\60004.exec:\60004.exe172⤵PID:3148
-
\??\c:\rfrxlll.exec:\rfrxlll.exe173⤵PID:2648
-
\??\c:\7vvvv.exec:\7vvvv.exe174⤵PID:1876
-
\??\c:\vpvpd.exec:\vpvpd.exe175⤵PID:2148
-
\??\c:\1hbtnn.exec:\1hbtnn.exe176⤵PID:3728
-
\??\c:\ppvjj.exec:\ppvjj.exe177⤵PID:5020
-
\??\c:\5hhbnh.exec:\5hhbnh.exe178⤵PID:4452
-
\??\c:\i202688.exec:\i202688.exe179⤵PID:5040
-
\??\c:\flllfll.exec:\flllfll.exe180⤵PID:4620
-
\??\c:\4262406.exec:\4262406.exe181⤵PID:4732
-
\??\c:\68622.exec:\68622.exe182⤵PID:4548
-
\??\c:\600880.exec:\600880.exe183⤵PID:468
-
\??\c:\jdvjd.exec:\jdvjd.exe184⤵PID:2920
-
\??\c:\4260466.exec:\4260466.exe185⤵PID:3696
-
\??\c:\httttt.exec:\httttt.exe186⤵PID:4800
-
\??\c:\482282.exec:\482282.exe187⤵PID:552
-
\??\c:\hntnhn.exec:\hntnhn.exe188⤵PID:420
-
\??\c:\60888.exec:\60888.exe189⤵PID:2792
-
\??\c:\pdjpp.exec:\pdjpp.exe190⤵PID:1628
-
\??\c:\406666.exec:\406666.exe191⤵PID:3312
-
\??\c:\880882.exec:\880882.exe192⤵PID:4428
-
\??\c:\pvvpj.exec:\pvvpj.exe193⤵PID:544
-
\??\c:\0000428.exec:\0000428.exe194⤵PID:3800
-
\??\c:\8666444.exec:\8666444.exe195⤵PID:4256
-
\??\c:\jdjjd.exec:\jdjjd.exe196⤵PID:3376
-
\??\c:\ppdvv.exec:\ppdvv.exe197⤵PID:624
-
\??\c:\22882.exec:\22882.exe198⤵PID:1152
-
\??\c:\rlfxllx.exec:\rlfxllx.exe199⤵PID:4448
-
\??\c:\60448.exec:\60448.exe200⤵PID:3508
-
\??\c:\lrrrlxr.exec:\lrrrlxr.exe201⤵PID:5076
-
\??\c:\jpjpp.exec:\jpjpp.exe202⤵PID:4408
-
\??\c:\68208.exec:\68208.exe203⤵PID:2884
-
\??\c:\nhhnhb.exec:\nhhnhb.exe204⤵PID:1776
-
\??\c:\446462.exec:\446462.exe205⤵PID:2648
-
\??\c:\bttbbb.exec:\bttbbb.exe206⤵PID:1596
-
\??\c:\2426688.exec:\2426688.exe207⤵PID:2804
-
\??\c:\dpjdj.exec:\dpjdj.exe208⤵PID:4588
-
\??\c:\a6260.exec:\a6260.exe209⤵PID:4756
-
\??\c:\0440680.exec:\0440680.exe210⤵PID:3028
-
\??\c:\9djpj.exec:\9djpj.exe211⤵PID:2364
-
\??\c:\02260.exec:\02260.exe212⤵PID:2104
-
\??\c:\dvvpj.exec:\dvvpj.exe213⤵PID:3928
-
\??\c:\488208.exec:\488208.exe214⤵PID:4808
-
\??\c:\86608.exec:\86608.exe215⤵PID:1816
-
\??\c:\648248.exec:\648248.exe216⤵PID:2400
-
\??\c:\5tbtbb.exec:\5tbtbb.exe217⤵PID:2912
-
\??\c:\5tbthh.exec:\5tbthh.exe218⤵PID:2508
-
\??\c:\02826.exec:\02826.exe219⤵PID:2480
-
\??\c:\9dvpv.exec:\9dvpv.exe220⤵PID:3756
-
\??\c:\q46048.exec:\q46048.exe221⤵PID:640
-
\??\c:\826420.exec:\826420.exe222⤵PID:2944
-
\??\c:\rrlfllr.exec:\rrlfllr.exe223⤵PID:5092
-
\??\c:\6664824.exec:\6664824.exe224⤵PID:2324
-
\??\c:\7dvvj.exec:\7dvvj.exe225⤵PID:4744
-
\??\c:\428600.exec:\428600.exe226⤵PID:4004
-
\??\c:\9lrlfrr.exec:\9lrlfrr.exe227⤵PID:4704
-
\??\c:\7lfrxrf.exec:\7lfrxrf.exe228⤵PID:904
-
\??\c:\xrrxfff.exec:\xrrxfff.exe229⤵PID:2268
-
\??\c:\488488.exec:\488488.exe230⤵PID:2952
-
\??\c:\7ddpd.exec:\7ddpd.exe231⤵PID:1700
-
\??\c:\7nbnht.exec:\7nbnht.exe232⤵PID:1116
-
\??\c:\8206004.exec:\8206004.exe233⤵PID:5008
-
\??\c:\g0048.exec:\g0048.exe234⤵PID:212
-
\??\c:\pjjdv.exec:\pjjdv.exe235⤵PID:4348
-
\??\c:\66808.exec:\66808.exe236⤵PID:3228
-
\??\c:\04048.exec:\04048.exe237⤵PID:3840
-
\??\c:\06842.exec:\06842.exe238⤵PID:2824
-
\??\c:\g2888.exec:\g2888.exe239⤵PID:2844
-
\??\c:\jdjdv.exec:\jdjdv.exe240⤵PID:3400
-
\??\c:\llrrrfr.exec:\llrrrfr.exe241⤵PID:4156
-
\??\c:\6622686.exec:\6622686.exe242⤵PID:4044