Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 22:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0da4288da9f1c8257778e968818ec610_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0da4288da9f1c8257778e968818ec610_NeikiAnalytics.exe
-
Size
345KB
-
MD5
0da4288da9f1c8257778e968818ec610
-
SHA1
261af25f6ed285feaa981012834ec7a3fbe23f05
-
SHA256
a3fb3dc5ed74a1a0d45b526b59916a828be118ea28ac3c8a30bffcddb5caf050
-
SHA512
cf6f4401ff53583d9f9d51cab0f9b68bbccbd3a6974b91f3a18798e5dc05057bd77b33058b7c9f0459d67b008919b82a8580de3edb36bebd808438325e2b1f8e
-
SSDEEP
6144:n3C9BRo/AIX2MUXownfWQkyCpxwJz9e0pQowLh3EhToK9cT085mnFhXjmnwJQyII:n3C9uDnUXoSWlnwJv90aKToFqwfIBO
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/2804-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2240-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3056-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2400-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2360-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1856-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1640-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1036-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2984-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/596-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/692-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1204-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/968-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bfndvj.exepfjjlpl.exefjxrtdl.exejbjrtp.exehttppjd.exebhhjllp.exevpvtxx.exebnfrb.exextnvf.exepptxjp.exethrjdr.exefvhlxd.exexbddd.exethlhbv.exetnlhblf.exevhrft.exeftbht.exefxfxtxl.exepphvrd.exeblbvttb.exefrxfnp.exerfhdn.exepjrpx.exetdddfxn.exebnrrrjb.exebxjxj.exentbbtd.exejxlbvp.exebtbjlvv.exentlhhh.exebpddxvn.exefjffdvb.exeftvbbvd.exenxllxpb.exerdbtfd.exefhfhft.exeprvvdx.exebvtlpbv.exenfnldx.exejlhnr.exextjfvjj.exebhvrv.exehflbr.exejhdrtt.exetdhbl.exenptjfbp.exenjjnn.exenntndd.exevtphd.exexrbllj.exefdvlttp.exenhlnltd.exerfpbldt.exehllnndh.exebtrttd.exertfth.exetlfjx.exetxbdtp.exerhjpn.exejfnjj.exetrnhdj.exedtdlv.exedffpx.exepndxd.exepid process 2240 bfndvj.exe 3056 pfjjlpl.exe 2912 fjxrtdl.exe 2588 jbjrtp.exe 2700 httppjd.exe 2400 bhhjllp.exe 2360 vpvtxx.exe 2192 bnfrb.exe 2188 xtnvf.exe 1856 pptxjp.exe 1640 thrjdr.exe 2552 fvhlxd.exe 2984 xbddd.exe 2328 thlhbv.exe 1036 tnlhblf.exe 2016 vhrft.exe 1728 ftbht.exe 2884 fxfxtxl.exe 1528 pphvrd.exe 596 blbvttb.exe 1172 frxfnp.exe 576 rfhdn.exe 2724 pjrpx.exe 2540 tdddfxn.exe 952 bnrrrjb.exe 692 bxjxj.exe 1204 ntbbtd.exe 1788 jxlbvp.exe 968 btbjlvv.exe 2304 ntlhhh.exe 560 bpddxvn.exe 1996 fjffdvb.exe 2200 ftvbbvd.exe 2812 nxllxpb.exe 2816 rdbtfd.exe 2868 fhfhft.exe 3052 prvvdx.exe 2960 bvtlpbv.exe 2560 nfnldx.exe 2512 jlhnr.exe 2628 xtjfvjj.exe 2448 bhvrv.exe 2532 hflbr.exe 2412 jhdrtt.exe 2360 tdhbl.exe 2480 nptjfbp.exe 2336 njjnn.exe 2796 nntndd.exe 1856 vtphd.exe 1704 xrbllj.exe 2536 fdvlttp.exe 1044 nhlnltd.exe 2084 rfpbldt.exe 1668 hllnndh.exe 1736 btrttd.exe 944 rtfth.exe 1680 tlfjx.exe 1336 txbdtp.exe 1320 rhjpn.exe 788 jfnjj.exe 596 trnhdj.exe 568 dtdlv.exe 1160 dffpx.exe 476 pndxd.exe -
Processes:
resource yara_rule behavioral1/memory/2804-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1856-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1036-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/596-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/692-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1204-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/968-282-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0da4288da9f1c8257778e968818ec610_NeikiAnalytics.exebfndvj.exepfjjlpl.exefjxrtdl.exejbjrtp.exehttppjd.exebhhjllp.exevpvtxx.exebnfrb.exextnvf.exepptxjp.exethrjdr.exefvhlxd.exexbddd.exethlhbv.exetnlhblf.exedescription pid process target process PID 2804 wrote to memory of 2240 2804 0da4288da9f1c8257778e968818ec610_NeikiAnalytics.exe bfndvj.exe PID 2804 wrote to memory of 2240 2804 0da4288da9f1c8257778e968818ec610_NeikiAnalytics.exe bfndvj.exe PID 2804 wrote to memory of 2240 2804 0da4288da9f1c8257778e968818ec610_NeikiAnalytics.exe bfndvj.exe PID 2804 wrote to memory of 2240 2804 0da4288da9f1c8257778e968818ec610_NeikiAnalytics.exe bfndvj.exe PID 2240 wrote to memory of 3056 2240 bfndvj.exe pfjjlpl.exe PID 2240 wrote to memory of 3056 2240 bfndvj.exe pfjjlpl.exe PID 2240 wrote to memory of 3056 2240 bfndvj.exe pfjjlpl.exe PID 2240 wrote to memory of 3056 2240 bfndvj.exe pfjjlpl.exe PID 3056 wrote to memory of 2912 3056 pfjjlpl.exe fjxrtdl.exe PID 3056 wrote to memory of 2912 3056 pfjjlpl.exe fjxrtdl.exe PID 3056 wrote to memory of 2912 3056 pfjjlpl.exe fjxrtdl.exe PID 3056 wrote to memory of 2912 3056 pfjjlpl.exe fjxrtdl.exe PID 2912 wrote to memory of 2588 2912 fjxrtdl.exe jbjrtp.exe PID 2912 wrote to memory of 2588 2912 fjxrtdl.exe jbjrtp.exe PID 2912 wrote to memory of 2588 2912 fjxrtdl.exe jbjrtp.exe PID 2912 wrote to memory of 2588 2912 fjxrtdl.exe jbjrtp.exe PID 2588 wrote to memory of 2700 2588 jbjrtp.exe httppjd.exe PID 2588 wrote to memory of 2700 2588 jbjrtp.exe httppjd.exe PID 2588 wrote to memory of 2700 2588 jbjrtp.exe httppjd.exe PID 2588 wrote to memory of 2700 2588 jbjrtp.exe httppjd.exe PID 2700 wrote to memory of 2400 2700 httppjd.exe bhhjllp.exe PID 2700 wrote to memory of 2400 2700 httppjd.exe bhhjllp.exe PID 2700 wrote to memory of 2400 2700 httppjd.exe bhhjllp.exe PID 2700 wrote to memory of 2400 2700 httppjd.exe bhhjllp.exe PID 2400 wrote to memory of 2360 2400 bhhjllp.exe vpvtxx.exe PID 2400 wrote to memory of 2360 2400 bhhjllp.exe vpvtxx.exe PID 2400 wrote to memory of 2360 2400 bhhjllp.exe vpvtxx.exe PID 2400 wrote to memory of 2360 2400 bhhjllp.exe vpvtxx.exe PID 2360 wrote to memory of 2192 2360 vpvtxx.exe bnfrb.exe PID 2360 wrote to memory of 2192 2360 vpvtxx.exe bnfrb.exe PID 2360 wrote to memory of 2192 2360 vpvtxx.exe bnfrb.exe PID 2360 wrote to memory of 2192 2360 vpvtxx.exe bnfrb.exe PID 2192 wrote to memory of 2188 2192 bnfrb.exe xtnvf.exe PID 2192 wrote to memory of 2188 2192 bnfrb.exe xtnvf.exe PID 2192 wrote to memory of 2188 2192 bnfrb.exe xtnvf.exe PID 2192 wrote to memory of 2188 2192 bnfrb.exe xtnvf.exe PID 2188 wrote to memory of 1856 2188 xtnvf.exe pptxjp.exe PID 2188 wrote to memory of 1856 2188 xtnvf.exe pptxjp.exe PID 2188 wrote to memory of 1856 2188 xtnvf.exe pptxjp.exe PID 2188 wrote to memory of 1856 2188 xtnvf.exe pptxjp.exe PID 1856 wrote to memory of 1640 1856 pptxjp.exe thrjdr.exe PID 1856 wrote to memory of 1640 1856 pptxjp.exe thrjdr.exe PID 1856 wrote to memory of 1640 1856 pptxjp.exe thrjdr.exe PID 1856 wrote to memory of 1640 1856 pptxjp.exe thrjdr.exe PID 1640 wrote to memory of 2552 1640 thrjdr.exe fvhlxd.exe PID 1640 wrote to memory of 2552 1640 thrjdr.exe fvhlxd.exe PID 1640 wrote to memory of 2552 1640 thrjdr.exe fvhlxd.exe PID 1640 wrote to memory of 2552 1640 thrjdr.exe fvhlxd.exe PID 2552 wrote to memory of 2984 2552 fvhlxd.exe xbddd.exe PID 2552 wrote to memory of 2984 2552 fvhlxd.exe xbddd.exe PID 2552 wrote to memory of 2984 2552 fvhlxd.exe xbddd.exe PID 2552 wrote to memory of 2984 2552 fvhlxd.exe xbddd.exe PID 2984 wrote to memory of 2328 2984 xbddd.exe thlhbv.exe PID 2984 wrote to memory of 2328 2984 xbddd.exe thlhbv.exe PID 2984 wrote to memory of 2328 2984 xbddd.exe thlhbv.exe PID 2984 wrote to memory of 2328 2984 xbddd.exe thlhbv.exe PID 2328 wrote to memory of 1036 2328 thlhbv.exe tnlhblf.exe PID 2328 wrote to memory of 1036 2328 thlhbv.exe tnlhblf.exe PID 2328 wrote to memory of 1036 2328 thlhbv.exe tnlhblf.exe PID 2328 wrote to memory of 1036 2328 thlhbv.exe tnlhblf.exe PID 1036 wrote to memory of 2016 1036 tnlhblf.exe vhrft.exe PID 1036 wrote to memory of 2016 1036 tnlhblf.exe vhrft.exe PID 1036 wrote to memory of 2016 1036 tnlhblf.exe vhrft.exe PID 1036 wrote to memory of 2016 1036 tnlhblf.exe vhrft.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0da4288da9f1c8257778e968818ec610_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0da4288da9f1c8257778e968818ec610_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\bfndvj.exec:\bfndvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\pfjjlpl.exec:\pfjjlpl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\fjxrtdl.exec:\fjxrtdl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\jbjrtp.exec:\jbjrtp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\httppjd.exec:\httppjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\bhhjllp.exec:\bhhjllp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\vpvtxx.exec:\vpvtxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\bnfrb.exec:\bnfrb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\xtnvf.exec:\xtnvf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\pptxjp.exec:\pptxjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\thrjdr.exec:\thrjdr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\fvhlxd.exec:\fvhlxd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\xbddd.exec:\xbddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\thlhbv.exec:\thlhbv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\tnlhblf.exec:\tnlhblf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\vhrft.exec:\vhrft.exe17⤵
- Executes dropped EXE
PID:2016 -
\??\c:\ftbht.exec:\ftbht.exe18⤵
- Executes dropped EXE
PID:1728 -
\??\c:\fxfxtxl.exec:\fxfxtxl.exe19⤵
- Executes dropped EXE
PID:2884 -
\??\c:\pphvrd.exec:\pphvrd.exe20⤵
- Executes dropped EXE
PID:1528 -
\??\c:\blbvttb.exec:\blbvttb.exe21⤵
- Executes dropped EXE
PID:596 -
\??\c:\frxfnp.exec:\frxfnp.exe22⤵
- Executes dropped EXE
PID:1172 -
\??\c:\rfhdn.exec:\rfhdn.exe23⤵
- Executes dropped EXE
PID:576 -
\??\c:\pjrpx.exec:\pjrpx.exe24⤵
- Executes dropped EXE
PID:2724 -
\??\c:\tdddfxn.exec:\tdddfxn.exe25⤵
- Executes dropped EXE
PID:2540 -
\??\c:\bnrrrjb.exec:\bnrrrjb.exe26⤵
- Executes dropped EXE
PID:952 -
\??\c:\bxjxj.exec:\bxjxj.exe27⤵
- Executes dropped EXE
PID:692 -
\??\c:\ntbbtd.exec:\ntbbtd.exe28⤵
- Executes dropped EXE
PID:1204 -
\??\c:\jxlbvp.exec:\jxlbvp.exe29⤵
- Executes dropped EXE
PID:1788 -
\??\c:\btbjlvv.exec:\btbjlvv.exe30⤵
- Executes dropped EXE
PID:968 -
\??\c:\ntlhhh.exec:\ntlhhh.exe31⤵
- Executes dropped EXE
PID:2304 -
\??\c:\bpddxvn.exec:\bpddxvn.exe32⤵
- Executes dropped EXE
PID:560 -
\??\c:\fjffdvb.exec:\fjffdvb.exe33⤵
- Executes dropped EXE
PID:1996 -
\??\c:\ftvbbvd.exec:\ftvbbvd.exe34⤵
- Executes dropped EXE
PID:2200 -
\??\c:\nxllxpb.exec:\nxllxpb.exe35⤵
- Executes dropped EXE
PID:2812 -
\??\c:\rdbtfd.exec:\rdbtfd.exe36⤵
- Executes dropped EXE
PID:2816 -
\??\c:\fhfhft.exec:\fhfhft.exe37⤵
- Executes dropped EXE
PID:2868 -
\??\c:\prvvdx.exec:\prvvdx.exe38⤵
- Executes dropped EXE
PID:3052 -
\??\c:\bvtlpbv.exec:\bvtlpbv.exe39⤵
- Executes dropped EXE
PID:2960 -
\??\c:\nfnldx.exec:\nfnldx.exe40⤵
- Executes dropped EXE
PID:2560 -
\??\c:\jlhnr.exec:\jlhnr.exe41⤵
- Executes dropped EXE
PID:2512 -
\??\c:\xtjfvjj.exec:\xtjfvjj.exe42⤵
- Executes dropped EXE
PID:2628 -
\??\c:\bhvrv.exec:\bhvrv.exe43⤵
- Executes dropped EXE
PID:2448 -
\??\c:\hflbr.exec:\hflbr.exe44⤵
- Executes dropped EXE
PID:2532 -
\??\c:\jhdrtt.exec:\jhdrtt.exe45⤵
- Executes dropped EXE
PID:2412 -
\??\c:\tdhbl.exec:\tdhbl.exe46⤵
- Executes dropped EXE
PID:2360 -
\??\c:\nptjfbp.exec:\nptjfbp.exe47⤵
- Executes dropped EXE
PID:2480 -
\??\c:\njjnn.exec:\njjnn.exe48⤵
- Executes dropped EXE
PID:2336 -
\??\c:\nntndd.exec:\nntndd.exe49⤵
- Executes dropped EXE
PID:2796 -
\??\c:\vtphd.exec:\vtphd.exe50⤵
- Executes dropped EXE
PID:1856 -
\??\c:\xrbllj.exec:\xrbllj.exe51⤵
- Executes dropped EXE
PID:1704 -
\??\c:\fdvlttp.exec:\fdvlttp.exe52⤵
- Executes dropped EXE
PID:2536 -
\??\c:\nhlnltd.exec:\nhlnltd.exe53⤵
- Executes dropped EXE
PID:1044 -
\??\c:\rfpbldt.exec:\rfpbldt.exe54⤵
- Executes dropped EXE
PID:2084 -
\??\c:\hllnndh.exec:\hllnndh.exe55⤵
- Executes dropped EXE
PID:1668 -
\??\c:\btrttd.exec:\btrttd.exe56⤵
- Executes dropped EXE
PID:1736 -
\??\c:\rtfth.exec:\rtfth.exe57⤵
- Executes dropped EXE
PID:944 -
\??\c:\tlfjx.exec:\tlfjx.exe58⤵
- Executes dropped EXE
PID:1680 -
\??\c:\txbdtp.exec:\txbdtp.exe59⤵
- Executes dropped EXE
PID:1336 -
\??\c:\rhjpn.exec:\rhjpn.exe60⤵
- Executes dropped EXE
PID:1320 -
\??\c:\jfnjj.exec:\jfnjj.exe61⤵
- Executes dropped EXE
PID:788 -
\??\c:\trnhdj.exec:\trnhdj.exe62⤵
- Executes dropped EXE
PID:596 -
\??\c:\dtdlv.exec:\dtdlv.exe63⤵
- Executes dropped EXE
PID:568 -
\??\c:\dffpx.exec:\dffpx.exe64⤵
- Executes dropped EXE
PID:1160 -
\??\c:\pndxd.exec:\pndxd.exe65⤵
- Executes dropped EXE
PID:476 -
\??\c:\lvhljl.exec:\lvhljl.exe66⤵PID:2712
-
\??\c:\trbpntf.exec:\trbpntf.exe67⤵PID:2916
-
\??\c:\nffhb.exec:\nffhb.exe68⤵PID:1832
-
\??\c:\bddhb.exec:\bddhb.exe69⤵PID:1656
-
\??\c:\bfphr.exec:\bfphr.exe70⤵PID:1864
-
\??\c:\nftlnf.exec:\nftlnf.exe71⤵PID:1984
-
\??\c:\tjllrj.exec:\tjllrj.exe72⤵PID:992
-
\??\c:\fdhbtrd.exec:\fdhbtrd.exe73⤵PID:2908
-
\??\c:\nvxtr.exec:\nvxtr.exe74⤵PID:1256
-
\??\c:\rldhn.exec:\rldhn.exe75⤵PID:832
-
\??\c:\bdxdfjv.exec:\bdxdfjv.exe76⤵PID:884
-
\??\c:\lvrjvp.exec:\lvrjvp.exe77⤵PID:2196
-
\??\c:\rvfljd.exec:\rvfljd.exe78⤵PID:1600
-
\??\c:\vddbxll.exec:\vddbxll.exe79⤵PID:2852
-
\??\c:\vphvjp.exec:\vphvjp.exe80⤵PID:3068
-
\??\c:\thfbp.exec:\thfbp.exe81⤵PID:2548
-
\??\c:\bfflj.exec:\bfflj.exe82⤵PID:2248
-
\??\c:\blnbxrv.exec:\blnbxrv.exe83⤵PID:3052
-
\??\c:\lxfnx.exec:\lxfnx.exe84⤵PID:2960
-
\??\c:\tlbtb.exec:\tlbtb.exe85⤵PID:2568
-
\??\c:\bxbdx.exec:\bxbdx.exe86⤵PID:2520
-
\??\c:\vrbhll.exec:\vrbhll.exe87⤵PID:2476
-
\??\c:\rxnpvjd.exec:\rxnpvjd.exe88⤵PID:2424
-
\??\c:\lfppbj.exec:\lfppbj.exe89⤵PID:2372
-
\??\c:\vfhbbr.exec:\vfhbbr.exe90⤵PID:2436
-
\??\c:\lblllrt.exec:\lblllrt.exe91⤵PID:2824
-
\??\c:\tbldt.exec:\tbldt.exe92⤵PID:2972
-
\??\c:\vvvvl.exec:\vvvvl.exe93⤵PID:1012
-
\??\c:\ffrndd.exec:\ffrndd.exe94⤵PID:2592
-
\??\c:\bndpff.exec:\bndpff.exe95⤵PID:1856
-
\??\c:\hjrpbnv.exec:\hjrpbnv.exe96⤵PID:1704
-
\??\c:\dvttthb.exec:\dvttthb.exe97⤵PID:2552
-
\??\c:\vlpdp.exec:\vlpdp.exe98⤵PID:1044
-
\??\c:\jdrdl.exec:\jdrdl.exe99⤵PID:2084
-
\??\c:\fxpnj.exec:\fxpnj.exe100⤵PID:1668
-
\??\c:\rpjpflv.exec:\rpjpflv.exe101⤵PID:1312
-
\??\c:\xdbddlb.exec:\xdbddlb.exe102⤵PID:948
-
\??\c:\pjdhrv.exec:\pjdhrv.exe103⤵PID:1632
-
\??\c:\ftxfhnn.exec:\ftxfhnn.exe104⤵PID:580
-
\??\c:\rrfxf.exec:\rrfxf.exe105⤵PID:1320
-
\??\c:\rdrlt.exec:\rdrlt.exe106⤵PID:788
-
\??\c:\dlltt.exec:\dlltt.exe107⤵PID:1244
-
\??\c:\pnjbpdv.exec:\pnjbpdv.exe108⤵PID:576
-
\??\c:\ndpdpj.exec:\ndpdpj.exe109⤵PID:2136
-
\??\c:\fvhlllt.exec:\fvhlllt.exe110⤵PID:476
-
\??\c:\pjtpd.exec:\pjtpd.exe111⤵PID:1088
-
\??\c:\jbbhxr.exec:\jbbhxr.exe112⤵PID:2916
-
\??\c:\bljhrpx.exec:\bljhrpx.exe113⤵PID:1020
-
\??\c:\bjrdhdr.exec:\bjrdhdr.exe114⤵PID:900
-
\??\c:\thtjrt.exec:\thtjrt.exe115⤵PID:912
-
\??\c:\dhxdt.exec:\dhxdt.exe116⤵PID:1984
-
\??\c:\jtdvxv.exec:\jtdvxv.exe117⤵PID:2828
-
\??\c:\flltf.exec:\flltf.exe118⤵PID:2012
-
\??\c:\ftrbn.exec:\ftrbn.exe119⤵PID:2324
-
\??\c:\jrdfbb.exec:\jrdfbb.exe120⤵PID:2204
-
\??\c:\hjxvvh.exec:\hjxvvh.exe121⤵PID:1716
-
\??\c:\ndbbp.exec:\ndbbp.exe122⤵PID:2836
-
\??\c:\lbbfvd.exec:\lbbfvd.exe123⤵PID:2804
-
\??\c:\tptrl.exec:\tptrl.exe124⤵PID:2852
-
\??\c:\tljjt.exec:\tljjt.exe125⤵PID:3068
-
\??\c:\njlhvj.exec:\njlhvj.exe126⤵PID:2548
-
\??\c:\fvbff.exec:\fvbff.exe127⤵PID:2872
-
\??\c:\nplpdd.exec:\nplpdd.exe128⤵PID:3052
-
\??\c:\tflxfrh.exec:\tflxfrh.exe129⤵PID:2508
-
\??\c:\nbbhtxp.exec:\nbbhtxp.exe130⤵PID:2588
-
\??\c:\bnfjnb.exec:\bnfjnb.exe131⤵PID:2660
-
\??\c:\jhlplx.exec:\jhlplx.exe132⤵PID:1252
-
\??\c:\bxhxphf.exec:\bxhxphf.exe133⤵PID:2664
-
\??\c:\hhnjllf.exec:\hhnjllf.exe134⤵PID:2776
-
\??\c:\ljnlr.exec:\ljnlr.exe135⤵PID:2344
-
\??\c:\tnxvd.exec:\tnxvd.exe136⤵PID:1664
-
\??\c:\bvjnvj.exec:\bvjnvj.exe137⤵PID:1884
-
\??\c:\jdbtrd.exec:\jdbtrd.exe138⤵PID:2468
-
\??\c:\nlljfd.exec:\nlljfd.exe139⤵PID:2760
-
\??\c:\xdvltbb.exec:\xdvltbb.exe140⤵PID:2656
-
\??\c:\lflhfpt.exec:\lflhfpt.exe141⤵PID:2228
-
\??\c:\pvhffb.exec:\pvhffb.exe142⤵PID:2552
-
\??\c:\jprdbb.exec:\jprdbb.exe143⤵PID:2328
-
\??\c:\ltxvh.exec:\ltxvh.exe144⤵PID:2084
-
\??\c:\rbljv.exec:\rbljv.exe145⤵PID:1668
-
\??\c:\lllxjvb.exec:\lllxjvb.exe146⤵PID:1312
-
\??\c:\vfnlfd.exec:\vfnlfd.exe147⤵PID:1580
-
\??\c:\hhhrlhr.exec:\hhhrlhr.exe148⤵PID:2172
-
\??\c:\hfrrjv.exec:\hfrrjv.exe149⤵PID:1576
-
\??\c:\bplbrvv.exec:\bplbrvv.exe150⤵PID:1320
-
\??\c:\ltbtj.exec:\ltbtj.exe151⤵PID:788
-
\??\c:\jbxxjtt.exec:\jbxxjtt.exe152⤵PID:1244
-
\??\c:\xltjxfb.exec:\xltjxfb.exe153⤵PID:2728
-
\??\c:\jdrdt.exec:\jdrdt.exe154⤵PID:400
-
\??\c:\xftbxjd.exec:\xftbxjd.exe155⤵PID:1824
-
\??\c:\pprvbr.exec:\pprvbr.exe156⤵PID:1548
-
\??\c:\jtbvr.exec:\jtbvr.exe157⤵PID:952
-
\??\c:\hdptbvh.exec:\hdptbvh.exe158⤵PID:1656
-
\??\c:\fjtbn.exec:\fjtbn.exe159⤵PID:1864
-
\??\c:\xbnhllb.exec:\xbnhllb.exe160⤵PID:1616
-
\??\c:\pbxdlf.exec:\pbxdlf.exe161⤵PID:2156
-
\??\c:\ppdfdh.exec:\ppdfdh.exe162⤵PID:2076
-
\??\c:\hfxjv.exec:\hfxjv.exe163⤵PID:560
-
\??\c:\dvjnxxt.exec:\dvjnxxt.exe164⤵PID:1936
-
\??\c:\vlnndv.exec:\vlnndv.exe165⤵PID:884
-
\??\c:\nhnjddl.exec:\nhnjddl.exe166⤵PID:1708
-
\??\c:\rtldv.exec:\rtldv.exe167⤵PID:2632
-
\??\c:\hbnjnbh.exec:\hbnjnbh.exe168⤵PID:2692
-
\??\c:\fdnblj.exec:\fdnblj.exe169⤵PID:2892
-
\??\c:\fvtlrd.exec:\fvtlrd.exe170⤵PID:2988
-
\??\c:\xjxddx.exec:\xjxddx.exe171⤵PID:2504
-
\??\c:\jbhnrht.exec:\jbhnrht.exe172⤵PID:2516
-
\??\c:\hrnflr.exec:\hrnflr.exe173⤵PID:2512
-
\??\c:\dbrjrx.exec:\dbrjrx.exe174⤵PID:2508
-
\??\c:\phndbxb.exec:\phndbxb.exe175⤵PID:2588
-
\??\c:\lbdrhp.exec:\lbdrhp.exe176⤵PID:2660
-
\??\c:\tjrbp.exec:\tjrbp.exe177⤵PID:1252
-
\??\c:\bdlnlv.exec:\bdlnlv.exe178⤵PID:2664
-
\??\c:\xfhxfd.exec:\xfhxfd.exe179⤵PID:2776
-
\??\c:\bpdxxlf.exec:\bpdxxlf.exe180⤵PID:2344
-
\??\c:\xtfjr.exec:\xtfjr.exe181⤵PID:1804
-
\??\c:\bpxld.exec:\bpxld.exe182⤵PID:2600
-
\??\c:\tthvhhx.exec:\tthvhhx.exe183⤵PID:2236
-
\??\c:\hbfffbh.exec:\hbfffbh.exe184⤵PID:2100
-
\??\c:\tjpnf.exec:\tjpnf.exe185⤵PID:2552
-
\??\c:\hhvjt.exec:\hhvjt.exe186⤵PID:940
-
\??\c:\xptnjv.exec:\xptnjv.exe187⤵PID:2312
-
\??\c:\pvjxj.exec:\pvjxj.exe188⤵PID:1028
-
\??\c:\dbxhxh.exec:\dbxhxh.exe189⤵PID:1312
-
\??\c:\lfjfr.exec:\lfjfr.exe190⤵PID:1580
-
\??\c:\bbfddh.exec:\bbfddh.exe191⤵PID:1628
-
\??\c:\bptjp.exec:\bptjp.exe192⤵PID:2052
-
\??\c:\bfdphtt.exec:\bfdphtt.exe193⤵PID:812
-
\??\c:\flrfv.exec:\flrfv.exe194⤵PID:980
-
\??\c:\jllttxt.exec:\jllttxt.exe195⤵PID:2992
-
\??\c:\lljhbth.exec:\lljhbth.exe196⤵PID:1348
-
\??\c:\rdtdxh.exec:\rdtdxh.exe197⤵PID:1676
-
\??\c:\xlhdt.exec:\xlhdt.exe198⤵PID:1560
-
\??\c:\pjlnl.exec:\pjlnl.exe199⤵PID:2916
-
\??\c:\hxrddv.exec:\hxrddv.exe200⤵PID:1204
-
\??\c:\rjdnh.exec:\rjdnh.exe201⤵PID:1700
-
\??\c:\fvtfv.exec:\fvtfv.exe202⤵PID:1864
-
\??\c:\nbxdvrx.exec:\nbxdvrx.exe203⤵PID:1056
-
\??\c:\ndtlvtf.exec:\ndtlvtf.exe204⤵PID:2284
-
\??\c:\jbjtbj.exec:\jbjtbj.exe205⤵PID:880
-
\??\c:\tffvnd.exec:\tffvnd.exe206⤵PID:1948
-
\??\c:\ttvbrbt.exec:\ttvbrbt.exe207⤵PID:1660
-
\??\c:\jjhnfr.exec:\jjhnfr.exe208⤵PID:2812
-
\??\c:\prbdf.exec:\prbdf.exe209⤵PID:2876
-
\??\c:\xhhrt.exec:\xhhrt.exe210⤵PID:2804
-
\??\c:\ldpxj.exec:\ldpxj.exe211⤵PID:2240
-
\??\c:\xvxbl.exec:\xvxbl.exe212⤵PID:3068
-
\??\c:\fnbvbx.exec:\fnbvbx.exe213⤵PID:2548
-
\??\c:\jfhxfd.exec:\jfhxfd.exe214⤵PID:2504
-
\??\c:\txjtlpp.exec:\txjtlpp.exe215⤵PID:2516
-
\??\c:\dxtvvl.exec:\dxtvvl.exe216⤵PID:2512
-
\??\c:\fvxhljr.exec:\fvxhljr.exe217⤵PID:2508
-
\??\c:\jnjxnd.exec:\jnjxnd.exe218⤵PID:2588
-
\??\c:\hxnlx.exec:\hxnlx.exe219⤵PID:2660
-
\??\c:\dnxlfrh.exec:\dnxlfrh.exe220⤵PID:1252
-
\??\c:\dhhfd.exec:\dhhfd.exe221⤵PID:2064
-
\??\c:\lllnr.exec:\lllnr.exe222⤵PID:2776
-
\??\c:\lblltt.exec:\lblltt.exe223⤵PID:2344
-
\??\c:\xxdprb.exec:\xxdprb.exe224⤵PID:1804
-
\??\c:\jjjvttb.exec:\jjjvttb.exe225⤵PID:2600
-
\??\c:\xvpld.exec:\xvpld.exe226⤵PID:1284
-
\??\c:\lrxtl.exec:\lrxtl.exe227⤵PID:936
-
\??\c:\dbpdx.exec:\dbpdx.exe228⤵PID:2016
-
\??\c:\trhnp.exec:\trhnp.exe229⤵PID:1816
-
\??\c:\rvjtvp.exec:\rvjtvp.exe230⤵PID:2312
-
\??\c:\tpjth.exec:\tpjth.exe231⤵PID:1400
-
\??\c:\drdtxh.exec:\drdtxh.exe232⤵PID:1312
-
\??\c:\vtxlnh.exec:\vtxlnh.exe233⤵PID:676
-
\??\c:\dvhtlj.exec:\dvhtlj.exe234⤵PID:2036
-
\??\c:\ljvnp.exec:\ljvnp.exe235⤵PID:2052
-
\??\c:\frrnt.exec:\frrnt.exe236⤵PID:812
-
\??\c:\nldhhj.exec:\nldhhj.exe237⤵PID:980
-
\??\c:\jhljbbj.exec:\jhljbbj.exe238⤵PID:2712
-
\??\c:\bnlvpjp.exec:\bnlvpjp.exe239⤵PID:1812
-
\??\c:\pdttdhh.exec:\pdttdhh.exe240⤵PID:1676
-
\??\c:\flfrdpb.exec:\flfrdpb.exe241⤵PID:1552
-
\??\c:\xphdlxh.exec:\xphdlxh.exe242⤵PID:2916