Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 23:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5ed5faa5e06c443cb04922533aa97e30_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
5ed5faa5e06c443cb04922533aa97e30_NeikiAnalytics.exe
-
Size
62KB
-
MD5
5ed5faa5e06c443cb04922533aa97e30
-
SHA1
9b08027795dceafaa9c0c8ee0445fc12c96008af
-
SHA256
61a73a14f47b2be2d62dd1bba92293e9d18e525ee971b9ea45fa9226559c1bbb
-
SHA512
f278b8ea3fd55ca30d35dbf7482fe711d9aacab94872d037487a50bb94e823ed20425418a13f6cb31690b3845982f5e1d56add0d7f397b5df2fbaa060e914aa8
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDISoFGDw27:ymb3NkkiQ3mdBjFIk17
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/1784-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-31-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2996-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1384-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1384-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2064-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1804-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1276-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1484-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1360-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2284-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1724-266-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1772-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1628-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-1257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
tdhvnr.exevdbbth.exebbnjndt.exepddvbxp.exejjhtfpf.exenhntvph.exebxjxr.exejjljtj.exerjtbnxr.exetjrpd.exexjdnhv.exexdlfhlx.exenftjb.exejvdrvp.exehfjdvf.exexrvtx.exeltplddx.exehnfnnpr.exennfvx.exeftxfr.exetxjvh.exejnxvt.exefpxvpf.exenrnpl.exetprlb.exevlnnxv.exejtbfdn.exettfhhlr.exenpfrtxj.exehnhjlvt.exevpvth.exelflnf.exerbdtt.exejfjrn.exetbfljb.exenttbrdn.exethhpv.exebjfndpn.exeprrxhb.exedhjhp.exebpflx.exehxvrlbv.exexxrvf.exelprpfv.exetvdnl.exejrvvpx.exejlrbdlb.exedbrpx.exevlplnr.exefvjtpj.exeltfvt.exefbxlxt.exefbhffft.exebrfrj.exedbjvd.exevjnvlh.exenhvvx.exevpbddt.exetbvfjpx.exehjvbxpj.exentlbxrh.exenxfll.exennbhvdj.exeltvvrnh.exepid process 1384 tdhvnr.exe 2996 vdbbth.exe 2664 bbnjndt.exe 2064 pddvbxp.exe 2644 jjhtfpf.exe 1804 nhntvph.exe 2432 bxjxr.exe 1276 jjljtj.exe 1484 rjtbnxr.exe 2656 tjrpd.exe 1360 xjdnhv.exe 2852 xdlfhlx.exe 2032 nftjb.exe 2040 jvdrvp.exe 796 hfjdvf.exe 788 xrvtx.exe 1720 ltplddx.exe 1612 hnfnnpr.exe 2104 nnfvx.exe 3004 ftxfr.exe 2284 txjvh.exe 3028 jnxvt.exe 852 fpxvpf.exe 2264 nrnpl.exe 1140 tprlb.exe 2328 vlnnxv.exe 1724 jtbfdn.exe 1772 ttfhhlr.exe 2988 npfrtxj.exe 1628 hnhjlvt.exe 1992 vpvth.exe 1728 lflnf.exe 2916 rbdtt.exe 1784 jfjrn.exe 1540 tbfljb.exe 1568 nttbrdn.exe 2864 thhpv.exe 2528 bjfndpn.exe 2504 prrxhb.exe 2560 dhjhp.exe 2064 bpflx.exe 2564 hxvrlbv.exe 2944 xxrvf.exe 2476 lprpfv.exe 2444 tvdnl.exe 2224 jrvvpx.exe 1276 jlrbdlb.exe 2680 dbrpx.exe 2756 vlplnr.exe 1904 fvjtpj.exe 2144 ltfvt.exe 2332 fbxlxt.exe 1604 fbhffft.exe 1656 brfrj.exe 1844 dbjvd.exe 2684 vjnvlh.exe 1168 nhvvx.exe 1720 vpbddt.exe 2100 tbvfjpx.exe 2824 hjvbxpj.exe 2296 ntlbxrh.exe 1248 nxfll.exe 2052 nnbhvdj.exe 1092 ltvvrnh.exe -
Processes:
resource yara_rule behavioral1/memory/1784-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1384-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1804-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1276-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1484-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1360-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1724-266-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1772-275-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-1257-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5ed5faa5e06c443cb04922533aa97e30_NeikiAnalytics.exetdhvnr.exevdbbth.exebbnjndt.exepddvbxp.exejjhtfpf.exenhntvph.exebxjxr.exejjljtj.exerjtbnxr.exetjrpd.exexjdnhv.exexdlfhlx.exenftjb.exejvdrvp.exehfjdvf.exedescription pid process target process PID 1784 wrote to memory of 1384 1784 5ed5faa5e06c443cb04922533aa97e30_NeikiAnalytics.exe tdhvnr.exe PID 1784 wrote to memory of 1384 1784 5ed5faa5e06c443cb04922533aa97e30_NeikiAnalytics.exe tdhvnr.exe PID 1784 wrote to memory of 1384 1784 5ed5faa5e06c443cb04922533aa97e30_NeikiAnalytics.exe tdhvnr.exe PID 1784 wrote to memory of 1384 1784 5ed5faa5e06c443cb04922533aa97e30_NeikiAnalytics.exe tdhvnr.exe PID 1384 wrote to memory of 2996 1384 tdhvnr.exe vdbbth.exe PID 1384 wrote to memory of 2996 1384 tdhvnr.exe vdbbth.exe PID 1384 wrote to memory of 2996 1384 tdhvnr.exe vdbbth.exe PID 1384 wrote to memory of 2996 1384 tdhvnr.exe vdbbth.exe PID 2996 wrote to memory of 2664 2996 vdbbth.exe bbnjndt.exe PID 2996 wrote to memory of 2664 2996 vdbbth.exe bbnjndt.exe PID 2996 wrote to memory of 2664 2996 vdbbth.exe bbnjndt.exe PID 2996 wrote to memory of 2664 2996 vdbbth.exe bbnjndt.exe PID 2664 wrote to memory of 2064 2664 bbnjndt.exe pddvbxp.exe PID 2664 wrote to memory of 2064 2664 bbnjndt.exe pddvbxp.exe PID 2664 wrote to memory of 2064 2664 bbnjndt.exe pddvbxp.exe PID 2664 wrote to memory of 2064 2664 bbnjndt.exe pddvbxp.exe PID 2064 wrote to memory of 2644 2064 pddvbxp.exe jjhtfpf.exe PID 2064 wrote to memory of 2644 2064 pddvbxp.exe jjhtfpf.exe PID 2064 wrote to memory of 2644 2064 pddvbxp.exe jjhtfpf.exe PID 2064 wrote to memory of 2644 2064 pddvbxp.exe jjhtfpf.exe PID 2644 wrote to memory of 1804 2644 jjhtfpf.exe nhntvph.exe PID 2644 wrote to memory of 1804 2644 jjhtfpf.exe nhntvph.exe PID 2644 wrote to memory of 1804 2644 jjhtfpf.exe nhntvph.exe PID 2644 wrote to memory of 1804 2644 jjhtfpf.exe nhntvph.exe PID 1804 wrote to memory of 2432 1804 nhntvph.exe bxjxr.exe PID 1804 wrote to memory of 2432 1804 nhntvph.exe bxjxr.exe PID 1804 wrote to memory of 2432 1804 nhntvph.exe bxjxr.exe PID 1804 wrote to memory of 2432 1804 nhntvph.exe bxjxr.exe PID 2432 wrote to memory of 1276 2432 bxjxr.exe jjljtj.exe PID 2432 wrote to memory of 1276 2432 bxjxr.exe jjljtj.exe PID 2432 wrote to memory of 1276 2432 bxjxr.exe jjljtj.exe PID 2432 wrote to memory of 1276 2432 bxjxr.exe jjljtj.exe PID 1276 wrote to memory of 1484 1276 jjljtj.exe rjtbnxr.exe PID 1276 wrote to memory of 1484 1276 jjljtj.exe rjtbnxr.exe PID 1276 wrote to memory of 1484 1276 jjljtj.exe rjtbnxr.exe PID 1276 wrote to memory of 1484 1276 jjljtj.exe rjtbnxr.exe PID 1484 wrote to memory of 2656 1484 rjtbnxr.exe tjrpd.exe PID 1484 wrote to memory of 2656 1484 rjtbnxr.exe tjrpd.exe PID 1484 wrote to memory of 2656 1484 rjtbnxr.exe tjrpd.exe PID 1484 wrote to memory of 2656 1484 rjtbnxr.exe tjrpd.exe PID 2656 wrote to memory of 1360 2656 tjrpd.exe xjdnhv.exe PID 2656 wrote to memory of 1360 2656 tjrpd.exe xjdnhv.exe PID 2656 wrote to memory of 1360 2656 tjrpd.exe xjdnhv.exe PID 2656 wrote to memory of 1360 2656 tjrpd.exe xjdnhv.exe PID 1360 wrote to memory of 2852 1360 xjdnhv.exe xdlfhlx.exe PID 1360 wrote to memory of 2852 1360 xjdnhv.exe xdlfhlx.exe PID 1360 wrote to memory of 2852 1360 xjdnhv.exe xdlfhlx.exe PID 1360 wrote to memory of 2852 1360 xjdnhv.exe xdlfhlx.exe PID 2852 wrote to memory of 2032 2852 xdlfhlx.exe nftjb.exe PID 2852 wrote to memory of 2032 2852 xdlfhlx.exe nftjb.exe PID 2852 wrote to memory of 2032 2852 xdlfhlx.exe nftjb.exe PID 2852 wrote to memory of 2032 2852 xdlfhlx.exe nftjb.exe PID 2032 wrote to memory of 2040 2032 nftjb.exe jvdrvp.exe PID 2032 wrote to memory of 2040 2032 nftjb.exe jvdrvp.exe PID 2032 wrote to memory of 2040 2032 nftjb.exe jvdrvp.exe PID 2032 wrote to memory of 2040 2032 nftjb.exe jvdrvp.exe PID 2040 wrote to memory of 796 2040 jvdrvp.exe hfjdvf.exe PID 2040 wrote to memory of 796 2040 jvdrvp.exe hfjdvf.exe PID 2040 wrote to memory of 796 2040 jvdrvp.exe hfjdvf.exe PID 2040 wrote to memory of 796 2040 jvdrvp.exe hfjdvf.exe PID 796 wrote to memory of 788 796 hfjdvf.exe xrvtx.exe PID 796 wrote to memory of 788 796 hfjdvf.exe xrvtx.exe PID 796 wrote to memory of 788 796 hfjdvf.exe xrvtx.exe PID 796 wrote to memory of 788 796 hfjdvf.exe xrvtx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ed5faa5e06c443cb04922533aa97e30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5ed5faa5e06c443cb04922533aa97e30_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\tdhvnr.exec:\tdhvnr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\vdbbth.exec:\vdbbth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\bbnjndt.exec:\bbnjndt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\pddvbxp.exec:\pddvbxp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\jjhtfpf.exec:\jjhtfpf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\nhntvph.exec:\nhntvph.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\bxjxr.exec:\bxjxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\jjljtj.exec:\jjljtj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\rjtbnxr.exec:\rjtbnxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\tjrpd.exec:\tjrpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\xjdnhv.exec:\xjdnhv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\xdlfhlx.exec:\xdlfhlx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\nftjb.exec:\nftjb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\jvdrvp.exec:\jvdrvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\hfjdvf.exec:\hfjdvf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
\??\c:\xrvtx.exec:\xrvtx.exe17⤵
- Executes dropped EXE
PID:788 -
\??\c:\ltplddx.exec:\ltplddx.exe18⤵
- Executes dropped EXE
PID:1720 -
\??\c:\hnfnnpr.exec:\hnfnnpr.exe19⤵
- Executes dropped EXE
PID:1612 -
\??\c:\nnfvx.exec:\nnfvx.exe20⤵
- Executes dropped EXE
PID:2104 -
\??\c:\ftxfr.exec:\ftxfr.exe21⤵
- Executes dropped EXE
PID:3004 -
\??\c:\txjvh.exec:\txjvh.exe22⤵
- Executes dropped EXE
PID:2284 -
\??\c:\jnxvt.exec:\jnxvt.exe23⤵
- Executes dropped EXE
PID:3028 -
\??\c:\fpxvpf.exec:\fpxvpf.exe24⤵
- Executes dropped EXE
PID:852 -
\??\c:\nrnpl.exec:\nrnpl.exe25⤵
- Executes dropped EXE
PID:2264 -
\??\c:\tprlb.exec:\tprlb.exe26⤵
- Executes dropped EXE
PID:1140 -
\??\c:\vlnnxv.exec:\vlnnxv.exe27⤵
- Executes dropped EXE
PID:2328 -
\??\c:\jtbfdn.exec:\jtbfdn.exe28⤵
- Executes dropped EXE
PID:1724 -
\??\c:\ttfhhlr.exec:\ttfhhlr.exe29⤵
- Executes dropped EXE
PID:1772 -
\??\c:\npfrtxj.exec:\npfrtxj.exe30⤵
- Executes dropped EXE
PID:2988 -
\??\c:\hnhjlvt.exec:\hnhjlvt.exe31⤵
- Executes dropped EXE
PID:1628 -
\??\c:\vpvth.exec:\vpvth.exe32⤵
- Executes dropped EXE
PID:1992 -
\??\c:\lflnf.exec:\lflnf.exe33⤵
- Executes dropped EXE
PID:1728 -
\??\c:\rbdtt.exec:\rbdtt.exe34⤵
- Executes dropped EXE
PID:2916 -
\??\c:\jfjrn.exec:\jfjrn.exe35⤵
- Executes dropped EXE
PID:1784 -
\??\c:\tbfljb.exec:\tbfljb.exe36⤵
- Executes dropped EXE
PID:1540 -
\??\c:\nttbrdn.exec:\nttbrdn.exe37⤵
- Executes dropped EXE
PID:1568 -
\??\c:\thhpv.exec:\thhpv.exe38⤵
- Executes dropped EXE
PID:2864 -
\??\c:\bjfndpn.exec:\bjfndpn.exe39⤵
- Executes dropped EXE
PID:2528 -
\??\c:\prrxhb.exec:\prrxhb.exe40⤵
- Executes dropped EXE
PID:2504 -
\??\c:\dhjhp.exec:\dhjhp.exe41⤵
- Executes dropped EXE
PID:2560 -
\??\c:\bpflx.exec:\bpflx.exe42⤵
- Executes dropped EXE
PID:2064 -
\??\c:\hxvrlbv.exec:\hxvrlbv.exe43⤵
- Executes dropped EXE
PID:2564 -
\??\c:\xxrvf.exec:\xxrvf.exe44⤵
- Executes dropped EXE
PID:2944 -
\??\c:\lprpfv.exec:\lprpfv.exe45⤵
- Executes dropped EXE
PID:2476 -
\??\c:\tvdnl.exec:\tvdnl.exe46⤵
- Executes dropped EXE
PID:2444 -
\??\c:\jrvvpx.exec:\jrvvpx.exe47⤵
- Executes dropped EXE
PID:2224 -
\??\c:\jlrbdlb.exec:\jlrbdlb.exe48⤵
- Executes dropped EXE
PID:1276 -
\??\c:\dbrpx.exec:\dbrpx.exe49⤵
- Executes dropped EXE
PID:2680 -
\??\c:\vlplnr.exec:\vlplnr.exe50⤵
- Executes dropped EXE
PID:2756 -
\??\c:\fvjtpj.exec:\fvjtpj.exe51⤵
- Executes dropped EXE
PID:1904 -
\??\c:\ltfvt.exec:\ltfvt.exe52⤵
- Executes dropped EXE
PID:2144 -
\??\c:\fbxlxt.exec:\fbxlxt.exe53⤵
- Executes dropped EXE
PID:2332 -
\??\c:\fbhffft.exec:\fbhffft.exe54⤵
- Executes dropped EXE
PID:1604 -
\??\c:\brfrj.exec:\brfrj.exe55⤵
- Executes dropped EXE
PID:1656 -
\??\c:\dbjvd.exec:\dbjvd.exe56⤵
- Executes dropped EXE
PID:1844 -
\??\c:\vjnvlh.exec:\vjnvlh.exe57⤵
- Executes dropped EXE
PID:2684 -
\??\c:\nhvvx.exec:\nhvvx.exe58⤵
- Executes dropped EXE
PID:1168 -
\??\c:\vpbddt.exec:\vpbddt.exe59⤵
- Executes dropped EXE
PID:1720 -
\??\c:\tbvfjpx.exec:\tbvfjpx.exe60⤵
- Executes dropped EXE
PID:2100 -
\??\c:\hjvbxpj.exec:\hjvbxpj.exe61⤵
- Executes dropped EXE
PID:2824 -
\??\c:\ntlbxrh.exec:\ntlbxrh.exe62⤵
- Executes dropped EXE
PID:2296 -
\??\c:\nxfll.exec:\nxfll.exe63⤵
- Executes dropped EXE
PID:1248 -
\??\c:\nnbhvdj.exec:\nnbhvdj.exe64⤵
- Executes dropped EXE
PID:2052 -
\??\c:\ltvvrnh.exec:\ltvvrnh.exe65⤵
- Executes dropped EXE
PID:1092 -
\??\c:\xjxdlt.exec:\xjxdlt.exe66⤵PID:2272
-
\??\c:\hllxf.exec:\hllxf.exe67⤵PID:1556
-
\??\c:\jvntphb.exec:\jvntphb.exe68⤵PID:1040
-
\??\c:\xvdjlt.exec:\xvdjlt.exe69⤵PID:1328
-
\??\c:\xfhxx.exec:\xfhxx.exe70⤵PID:3012
-
\??\c:\vbtxf.exec:\vbtxf.exe71⤵PID:1956
-
\??\c:\lvpvn.exec:\lvpvn.exe72⤵PID:1772
-
\??\c:\lbnlll.exec:\lbnlll.exe73⤵PID:2232
-
\??\c:\jdfrpj.exec:\jdfrpj.exe74⤵PID:820
-
\??\c:\hxhjhx.exec:\hxhjhx.exe75⤵PID:1340
-
\??\c:\bbjtxb.exec:\bbjtxb.exe76⤵PID:1992
-
\??\c:\hjrtd.exec:\hjrtd.exe77⤵PID:2192
-
\??\c:\jhfprhl.exec:\jhfprhl.exe78⤵PID:3036
-
\??\c:\hrdfn.exec:\hrdfn.exe79⤵PID:2056
-
\??\c:\nrrrfvf.exec:\nrrrfvf.exe80⤵PID:1704
-
\??\c:\fjbhh.exec:\fjbhh.exe81⤵PID:2632
-
\??\c:\jfxrd.exec:\jfxrd.exe82⤵PID:2672
-
\??\c:\nfldhp.exec:\nfldhp.exe83⤵PID:2408
-
\??\c:\ndvxvf.exec:\ndvxvf.exe84⤵PID:2792
-
\??\c:\ndxtx.exec:\ndxtx.exe85⤵PID:2748
-
\??\c:\pbdjjln.exec:\pbdjjln.exe86⤵PID:2448
-
\??\c:\thrpt.exec:\thrpt.exe87⤵PID:2536
-
\??\c:\brflhpd.exec:\brflhpd.exe88⤵PID:2608
-
\??\c:\vddjt.exec:\vddjt.exe89⤵PID:2520
-
\??\c:\prxbfh.exec:\prxbfh.exe90⤵PID:2432
-
\??\c:\lbfdfnb.exec:\lbfdfnb.exe91⤵PID:792
-
\??\c:\xfjtpp.exec:\xfjtpp.exe92⤵PID:1688
-
\??\c:\fpbjb.exec:\fpbjb.exe93⤵PID:2760
-
\??\c:\ppbbjrx.exec:\ppbbjrx.exe94⤵PID:2728
-
\??\c:\jnbvb.exec:\jnbvb.exe95⤵PID:2012
-
\??\c:\vfhfvv.exec:\vfhfvv.exe96⤵PID:1232
-
\??\c:\dnpfbh.exec:\dnpfbh.exe97⤵PID:924
-
\??\c:\ljbvv.exec:\ljbvv.exe98⤵PID:1604
-
\??\c:\jtbht.exec:\jtbht.exe99⤵PID:480
-
\??\c:\jprff.exec:\jprff.exe100⤵PID:2652
-
\??\c:\bplhnl.exec:\bplhnl.exe101⤵PID:2136
-
\??\c:\tvjpb.exec:\tvjpb.exe102⤵PID:2676
-
\??\c:\nhnjpdd.exec:\nhnjpdd.exe103⤵PID:920
-
\??\c:\vbfrh.exec:\vbfrh.exe104⤵PID:2496
-
\??\c:\ftpvlbf.exec:\ftpvlbf.exe105⤵PID:1996
-
\??\c:\jfrhlt.exec:\jfrhlt.exe106⤵PID:3048
-
\??\c:\pnfprn.exec:\pnfprn.exe107⤵PID:1488
-
\??\c:\pvftvxj.exec:\pvftvxj.exe108⤵PID:1248
-
\??\c:\htfptld.exec:\htfptld.exe109⤵PID:1976
-
\??\c:\ffxhfjv.exec:\ffxhfjv.exe110⤵PID:2948
-
\??\c:\dppndtr.exec:\dppndtr.exe111⤵PID:1960
-
\??\c:\lxfbpdt.exec:\lxfbpdt.exe112⤵PID:1052
-
\??\c:\nhjhdb.exec:\nhjhdb.exe113⤵PID:1040
-
\??\c:\xvddnh.exec:\xvddnh.exe114⤵PID:1328
-
\??\c:\rrdbhl.exec:\rrdbhl.exe115⤵PID:596
-
\??\c:\xvjhbn.exec:\xvjhbn.exe116⤵PID:1956
-
\??\c:\bxnpj.exec:\bxnpj.exe117⤵PID:1772
-
\??\c:\rnddrfj.exec:\rnddrfj.exe118⤵PID:2232
-
\??\c:\tjxjd.exec:\tjxjd.exe119⤵PID:820
-
\??\c:\xlpnjvp.exec:\xlpnjvp.exe120⤵PID:1524
-
\??\c:\dxdvhlh.exec:\dxdvhlh.exe121⤵PID:1992
-
\??\c:\ntjfp.exec:\ntjfp.exe122⤵PID:2184
-
\??\c:\pnvtr.exec:\pnvtr.exe123⤵PID:3036
-
\??\c:\trdfhjd.exec:\trdfhjd.exe124⤵PID:2056
-
\??\c:\dhlfhb.exec:\dhlfhb.exe125⤵PID:1704
-
\??\c:\bhvrdj.exec:\bhvrdj.exe126⤵PID:2632
-
\??\c:\ppffl.exec:\ppffl.exe127⤵PID:2492
-
\??\c:\xbbrn.exec:\xbbrn.exe128⤵PID:2704
-
\??\c:\tfphf.exec:\tfphf.exe129⤵PID:2624
-
\??\c:\vjllb.exec:\vjllb.exe130⤵PID:2596
-
\??\c:\vpfttf.exec:\vpfttf.exe131⤵PID:2112
-
\??\c:\dnljrn.exec:\dnljrn.exe132⤵PID:2572
-
\??\c:\vpjlfl.exec:\vpjlfl.exe133⤵PID:2944
-
\??\c:\rvjfpp.exec:\rvjfpp.exe134⤵PID:1496
-
\??\c:\dpbdlv.exec:\dpbdlv.exe135⤵PID:2432
-
\??\c:\njxldhf.exec:\njxldhf.exe136⤵PID:2732
-
\??\c:\hjjflf.exec:\hjjflf.exe137⤵PID:1688
-
\??\c:\fnhlhrh.exec:\fnhlhrh.exe138⤵PID:2760
-
\??\c:\hvllpj.exec:\hvllpj.exe139⤵PID:2728
-
\??\c:\nbntl.exec:\nbntl.exe140⤵PID:2012
-
\??\c:\hdrnxbt.exec:\hdrnxbt.exe141⤵PID:1232
-
\??\c:\vjrfnh.exec:\vjrfnh.exe142⤵PID:364
-
\??\c:\nbfhjll.exec:\nbfhjll.exe143⤵PID:2388
-
\??\c:\rnnplf.exec:\rnnplf.exe144⤵PID:480
-
\??\c:\nrdtf.exec:\nrdtf.exe145⤵PID:2652
-
\??\c:\hlbnv.exec:\hlbnv.exe146⤵PID:1708
-
\??\c:\fdjhx.exec:\fdjhx.exe147⤵PID:2676
-
\??\c:\jnlhxnr.exec:\jnlhxnr.exe148⤵PID:920
-
\??\c:\fbhvx.exec:\fbhvx.exe149⤵PID:1720
-
\??\c:\xtxlx.exec:\xtxlx.exe150⤵PID:1996
-
\??\c:\xdjfdpj.exec:\xdjfdpj.exe151⤵PID:2824
-
\??\c:\vfvjvl.exec:\vfvjvl.exe152⤵PID:836
-
\??\c:\rvxvtd.exec:\rvxvtd.exe153⤵PID:1248
-
\??\c:\fhtbhr.exec:\fhtbhr.exe154⤵PID:1092
-
\??\c:\rvpvlhj.exec:\rvpvlhj.exe155⤵PID:2948
-
\??\c:\tdfxjx.exec:\tdfxjx.exe156⤵PID:1548
-
\??\c:\nbxtfn.exec:\nbxtfn.exe157⤵PID:2328
-
\??\c:\lbtfrhd.exec:\lbtfrhd.exe158⤵PID:1768
-
\??\c:\xvhvx.exec:\xvhvx.exe159⤵PID:1800
-
\??\c:\jbdxhh.exec:\jbdxhh.exe160⤵PID:596
-
\??\c:\nbxlpn.exec:\nbxlpn.exe161⤵PID:1956
-
\??\c:\htbvn.exec:\htbvn.exe162⤵PID:1772
-
\??\c:\pxjrvvt.exec:\pxjrvvt.exe163⤵PID:1132
-
\??\c:\bpnfj.exec:\bpnfj.exe164⤵PID:820
-
\??\c:\lnvfx.exec:\lnvfx.exe165⤵PID:2180
-
\??\c:\vbnrl.exec:\vbnrl.exe166⤵PID:2784
-
\??\c:\xxlfh.exec:\xxlfh.exe167⤵PID:1592
-
\??\c:\npdxn.exec:\npdxn.exe168⤵PID:2996
-
\??\c:\bdxpvlp.exec:\bdxpvlp.exe169⤵PID:2556
-
\??\c:\bflndn.exec:\bflndn.exe170⤵PID:2936
-
\??\c:\ndvjnx.exec:\ndvjnx.exe171⤵PID:2712
-
\??\c:\jxjlvh.exec:\jxjlvh.exe172⤵PID:2744
-
\??\c:\rnrxh.exec:\rnrxh.exe173⤵PID:2896
-
\??\c:\frvxhbh.exec:\frvxhbh.exe174⤵PID:2604
-
\??\c:\ltxxf.exec:\ltxxf.exe175⤵PID:2456
-
\??\c:\ndjxhvt.exec:\ndjxhvt.exe176⤵PID:2420
-
\??\c:\txfrxd.exec:\txfrxd.exe177⤵PID:1192
-
\??\c:\phnhn.exec:\phnhn.exe178⤵PID:2944
-
\??\c:\rjxbdvf.exec:\rjxbdvf.exe179⤵PID:1632
-
\??\c:\vdxdp.exec:\vdxdp.exe180⤵PID:2736
-
\??\c:\vbtjj.exec:\vbtjj.exe181⤵PID:2308
-
\??\c:\xlrtd.exec:\xlrtd.exe182⤵PID:1324
-
\??\c:\vlhbhxt.exec:\vlhbhxt.exe183⤵PID:1952
-
\??\c:\tphrjf.exec:\tphrjf.exe184⤵PID:1936
-
\??\c:\drhrfv.exec:\drhrfv.exe185⤵PID:1100
-
\??\c:\pprph.exec:\pprph.exe186⤵PID:1700
-
\??\c:\tlbhjv.exec:\tlbhjv.exe187⤵PID:2388
-
\??\c:\jbjlpdj.exec:\jbjlpdj.exe188⤵PID:932
-
\??\c:\dpfdbrl.exec:\dpfdbrl.exe189⤵PID:1972
-
\??\c:\dbhvptl.exec:\dbhvptl.exe190⤵PID:1576
-
\??\c:\xtrphn.exec:\xtrphn.exe191⤵PID:1572
-
\??\c:\jdjfxtb.exec:\jdjfxtb.exe192⤵PID:2240
-
\??\c:\hnhhlb.exec:\hnhhlb.exe193⤵PID:612
-
\??\c:\rtdppd.exec:\rtdppd.exe194⤵PID:1308
-
\??\c:\jrlddxn.exec:\jrlddxn.exe195⤵PID:2072
-
\??\c:\nhnpfv.exec:\nhnpfv.exe196⤵PID:3028
-
\??\c:\rbltfh.exec:\rbltfh.exe197⤵PID:1976
-
\??\c:\jtjtt.exec:\jtjtt.exe198⤵PID:852
-
\??\c:\jlfdj.exec:\jlfdj.exe199⤵PID:1584
-
\??\c:\pnfdhp.exec:\pnfdhp.exe200⤵PID:1140
-
\??\c:\jrvtxd.exec:\jrvtxd.exe201⤵PID:1548
-
\??\c:\lndblp.exec:\lndblp.exe202⤵PID:864
-
\??\c:\plnjpl.exec:\plnjpl.exe203⤵PID:1212
-
\??\c:\brnfn.exec:\brnfn.exe204⤵PID:1328
-
\??\c:\xtttr.exec:\xtttr.exe205⤵PID:1756
-
\??\c:\pbbtbbh.exec:\pbbtbbh.exe206⤵PID:1532
-
\??\c:\bhdjb.exec:\bhdjb.exe207⤵PID:1628
-
\??\c:\htnxfpl.exec:\htnxfpl.exe208⤵PID:1132
-
\??\c:\vrbff.exec:\vrbff.exe209⤵PID:868
-
\??\c:\dltfr.exec:\dltfr.exe210⤵PID:1784
-
\??\c:\prlbndr.exec:\prlbndr.exe211⤵PID:2580
-
\??\c:\jfpvxnt.exec:\jfpvxnt.exe212⤵PID:1592
-
\??\c:\djfvj.exec:\djfvj.exe213⤵PID:2940
-
\??\c:\trvjl.exec:\trvjl.exe214⤵PID:2864
-
\??\c:\drvntdr.exec:\drvntdr.exe215⤵PID:2672
-
\??\c:\dvnvhd.exec:\dvnvhd.exe216⤵PID:2576
-
\??\c:\jhplbd.exec:\jhplbd.exe217⤵PID:2428
-
\??\c:\bpjvxrf.exec:\bpjvxrf.exe218⤵PID:2896
-
\??\c:\dvhtn.exec:\dvhtn.exe219⤵PID:2464
-
\??\c:\nthdt.exec:\nthdt.exe220⤵PID:2336
-
\??\c:\htrjpvn.exec:\htrjpvn.exe221⤵PID:2412
-
\??\c:\bjdxp.exec:\bjdxp.exe222⤵PID:3044
-
\??\c:\vdtlx.exec:\vdtlx.exe223⤵PID:1496
-
\??\c:\jjfvxh.exec:\jjfvxh.exe224⤵PID:1484
-
\??\c:\xpdddl.exec:\xpdddl.exe225⤵PID:2732
-
\??\c:\ndrvj.exec:\ndrvj.exe226⤵PID:1968
-
\??\c:\txlvff.exec:\txlvff.exe227⤵PID:896
-
\??\c:\dtxln.exec:\dtxln.exe228⤵PID:2884
-
\??\c:\tttll.exec:\tttll.exe229⤵PID:1964
-
\??\c:\vtvpj.exec:\vtvpj.exe230⤵PID:2040
-
\??\c:\vxtttpv.exec:\vxtttpv.exe231⤵PID:368
-
\??\c:\pbnlvdv.exec:\pbnlvdv.exe232⤵PID:788
-
\??\c:\vpphx.exec:\vpphx.exe233⤵PID:1448
-
\??\c:\xjhtjx.exec:\xjhtjx.exe234⤵PID:1512
-
\??\c:\lvdvpj.exec:\lvdvpj.exe235⤵PID:2268
-
\??\c:\jlllr.exec:\jlllr.exe236⤵PID:2096
-
\??\c:\rtfblll.exec:\rtfblll.exe237⤵PID:2164
-
\??\c:\jnfbt.exec:\jnfbt.exe238⤵PID:2812
-
\??\c:\dnhhftl.exec:\dnhhftl.exe239⤵PID:2300
-
\??\c:\lbvtfb.exec:\lbvtfb.exe240⤵PID:1848
-
\??\c:\nvvrtr.exec:\nvvrtr.exe241⤵PID:2256
-
\??\c:\dfnjhl.exec:\dfnjhl.exe242⤵PID:2264