Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 06:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9448833fb3ab713aa4fe30a9a4828a10_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
9448833fb3ab713aa4fe30a9a4828a10_NeikiAnalytics.exe
-
Size
56KB
-
MD5
9448833fb3ab713aa4fe30a9a4828a10
-
SHA1
f78e6b13ee73b04841c9f0c41a1259c589246a08
-
SHA256
3b3b0530b797a4f151d6ee60015dcef055722627218265e8cbd8d8382f4ffdfe
-
SHA512
b48d977166f052f0db0534e1194f8ea349d38859fa56dbe2c62e3a6dcee20677d756fa874e60cef94bf1190e38eda20b3c8f5bf87a674e604cb3397f72f92cc2
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0chVno:ymb3NkkiQ3mdBjF0cro
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/2184-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2384-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-49-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/276-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1120-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/916-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2328-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1628-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1736-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/432-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/832-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2332-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-935-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xhxpvvh.exepfjlf.exehvnhx.exelpvfjtd.exeltbhvd.exeppllbxj.exedfbpf.exenvvtv.exepvhjr.exedpvrljr.exevnxvd.exeftnhnfx.exennnbllh.exejjjhh.exenrbtln.exefpbfd.exehdhjfpb.exehfdbj.exenhxhx.exejvbff.exehdhlnj.exepdltn.exeprttpbn.exebvxdlv.exeddbvhtv.exelnjfrrx.exexpxtn.exerxlxph.exehvnhnll.exebjflnnx.exevbnnv.exebfffj.exexntdln.exextpnj.exejvftr.exejtvtpf.exetnjtj.exedrtntd.exepjtbt.exeljfrfn.exelrfpt.exebbtdr.exenfldvj.exexrvlbb.exenvvhx.exevxbpdr.exefvltbt.exejhprn.exevtpvtt.exerpbdfb.exevphthtp.exelrrphxx.exetxlthpd.exejjnvtnf.exexlpjl.exebvtblb.exebxhdp.exevbttb.exennhtr.exetrjndhf.exedpbbhp.exedvvnddl.exejpvvntr.exelnvbnt.exepid process 2684 xhxpvvh.exe 2940 pfjlf.exe 2576 hvnhx.exe 2516 lpvfjtd.exe 2620 ltbhvd.exe 2520 ppllbxj.exe 2384 dfbpf.exe 1948 nvvtv.exe 836 pvhjr.exe 276 dpvrljr.exe 1176 vnxvd.exe 2652 ftnhnfx.exe 2724 nnnbllh.exe 1120 jjjhh.exe 916 nrbtln.exe 2244 fpbfd.exe 2328 hdhjfpb.exe 1628 hfdbj.exe 3000 nhxhx.exe 1736 jvbff.exe 2896 hdhlnj.exe 432 pdltn.exe 832 prttpbn.exe 692 bvxdlv.exe 1600 ddbvhtv.exe 1480 lnjfrrx.exe 1088 xpxtn.exe 3068 rxlxph.exe 2332 hvnhnll.exe 2808 bjflnnx.exe 1752 vbnnv.exe 2968 bfffj.exe 2248 xntdln.exe 2472 xtpnj.exe 2900 jvftr.exe 2172 jtvtpf.exe 1880 tnjtj.exe 2624 drtntd.exe 2560 pjtbt.exe 2748 ljfrfn.exe 2556 lrfpt.exe 2424 bbtdr.exe 2820 nfldvj.exe 2836 xrvlbb.exe 1716 nvvhx.exe 560 vxbpdr.exe 1812 fvltbt.exe 2656 jhprn.exe 2708 vtpvtt.exe 1408 rpbdfb.exe 1904 vphthtp.exe 1892 lrrphxx.exe 2316 txlthpd.exe 1124 jjnvtnf.exe 1648 xlpjl.exe 2292 bvtblb.exe 2352 bxhdp.exe 2304 vbttb.exe 1740 nnhtr.exe 2096 trjndhf.exe 544 dpbbhp.exe 3032 dvvnddl.exe 1152 jpvvntr.exe 1800 lnvbnt.exe -
Processes:
resource yara_rule behavioral1/memory/2184-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/276-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1120-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/916-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1736-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/432-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/832-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-935-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9448833fb3ab713aa4fe30a9a4828a10_NeikiAnalytics.exexhxpvvh.exepfjlf.exehvnhx.exelpvfjtd.exeltbhvd.exeppllbxj.exedfbpf.exenvvtv.exepvhjr.exedpvrljr.exevnxvd.exeftnhnfx.exennnbllh.exejjjhh.exenrbtln.exedescription pid process target process PID 2184 wrote to memory of 2684 2184 9448833fb3ab713aa4fe30a9a4828a10_NeikiAnalytics.exe xhxpvvh.exe PID 2184 wrote to memory of 2684 2184 9448833fb3ab713aa4fe30a9a4828a10_NeikiAnalytics.exe xhxpvvh.exe PID 2184 wrote to memory of 2684 2184 9448833fb3ab713aa4fe30a9a4828a10_NeikiAnalytics.exe xhxpvvh.exe PID 2184 wrote to memory of 2684 2184 9448833fb3ab713aa4fe30a9a4828a10_NeikiAnalytics.exe xhxpvvh.exe PID 2684 wrote to memory of 2940 2684 xhxpvvh.exe vxjft.exe PID 2684 wrote to memory of 2940 2684 xhxpvvh.exe vxjft.exe PID 2684 wrote to memory of 2940 2684 xhxpvvh.exe vxjft.exe PID 2684 wrote to memory of 2940 2684 xhxpvvh.exe vxjft.exe PID 2940 wrote to memory of 2576 2940 pfjlf.exe pnpxltv.exe PID 2940 wrote to memory of 2576 2940 pfjlf.exe pnpxltv.exe PID 2940 wrote to memory of 2576 2940 pfjlf.exe pnpxltv.exe PID 2940 wrote to memory of 2576 2940 pfjlf.exe pnpxltv.exe PID 2576 wrote to memory of 2516 2576 hvnhx.exe xjpfbt.exe PID 2576 wrote to memory of 2516 2576 hvnhx.exe xjpfbt.exe PID 2576 wrote to memory of 2516 2576 hvnhx.exe xjpfbt.exe PID 2576 wrote to memory of 2516 2576 hvnhx.exe xjpfbt.exe PID 2516 wrote to memory of 2620 2516 lpvfjtd.exe jfdrf.exe PID 2516 wrote to memory of 2620 2516 lpvfjtd.exe jfdrf.exe PID 2516 wrote to memory of 2620 2516 lpvfjtd.exe jfdrf.exe PID 2516 wrote to memory of 2620 2516 lpvfjtd.exe jfdrf.exe PID 2620 wrote to memory of 2520 2620 ltbhvd.exe lxtfjfv.exe PID 2620 wrote to memory of 2520 2620 ltbhvd.exe lxtfjfv.exe PID 2620 wrote to memory of 2520 2620 ltbhvd.exe lxtfjfv.exe PID 2620 wrote to memory of 2520 2620 ltbhvd.exe lxtfjfv.exe PID 2520 wrote to memory of 2384 2520 ppllbxj.exe lntfh.exe PID 2520 wrote to memory of 2384 2520 ppllbxj.exe lntfh.exe PID 2520 wrote to memory of 2384 2520 ppllbxj.exe lntfh.exe PID 2520 wrote to memory of 2384 2520 ppllbxj.exe lntfh.exe PID 2384 wrote to memory of 1948 2384 dfbpf.exe hnndn.exe PID 2384 wrote to memory of 1948 2384 dfbpf.exe hnndn.exe PID 2384 wrote to memory of 1948 2384 dfbpf.exe hnndn.exe PID 2384 wrote to memory of 1948 2384 dfbpf.exe hnndn.exe PID 1948 wrote to memory of 836 1948 nvvtv.exe pvhjr.exe PID 1948 wrote to memory of 836 1948 nvvtv.exe pvhjr.exe PID 1948 wrote to memory of 836 1948 nvvtv.exe pvhjr.exe PID 1948 wrote to memory of 836 1948 nvvtv.exe pvhjr.exe PID 836 wrote to memory of 276 836 pvhjr.exe tlnpdpj.exe PID 836 wrote to memory of 276 836 pvhjr.exe tlnpdpj.exe PID 836 wrote to memory of 276 836 pvhjr.exe tlnpdpj.exe PID 836 wrote to memory of 276 836 pvhjr.exe tlnpdpj.exe PID 276 wrote to memory of 1176 276 dpvrljr.exe jhdhj.exe PID 276 wrote to memory of 1176 276 dpvrljr.exe jhdhj.exe PID 276 wrote to memory of 1176 276 dpvrljr.exe jhdhj.exe PID 276 wrote to memory of 1176 276 dpvrljr.exe jhdhj.exe PID 1176 wrote to memory of 2652 1176 vnxvd.exe rjnltnt.exe PID 1176 wrote to memory of 2652 1176 vnxvd.exe rjnltnt.exe PID 1176 wrote to memory of 2652 1176 vnxvd.exe rjnltnt.exe PID 1176 wrote to memory of 2652 1176 vnxvd.exe rjnltnt.exe PID 2652 wrote to memory of 2724 2652 ftnhnfx.exe nnnbllh.exe PID 2652 wrote to memory of 2724 2652 ftnhnfx.exe nnnbllh.exe PID 2652 wrote to memory of 2724 2652 ftnhnfx.exe nnnbllh.exe PID 2652 wrote to memory of 2724 2652 ftnhnfx.exe nnnbllh.exe PID 2724 wrote to memory of 1120 2724 nnnbllh.exe jjjhh.exe PID 2724 wrote to memory of 1120 2724 nnnbllh.exe jjjhh.exe PID 2724 wrote to memory of 1120 2724 nnnbllh.exe jjjhh.exe PID 2724 wrote to memory of 1120 2724 nnnbllh.exe jjjhh.exe PID 1120 wrote to memory of 916 1120 jjjhh.exe jbvntx.exe PID 1120 wrote to memory of 916 1120 jjjhh.exe jbvntx.exe PID 1120 wrote to memory of 916 1120 jjjhh.exe jbvntx.exe PID 1120 wrote to memory of 916 1120 jjjhh.exe jbvntx.exe PID 916 wrote to memory of 2244 916 nrbtln.exe fpbfd.exe PID 916 wrote to memory of 2244 916 nrbtln.exe fpbfd.exe PID 916 wrote to memory of 2244 916 nrbtln.exe fpbfd.exe PID 916 wrote to memory of 2244 916 nrbtln.exe fpbfd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9448833fb3ab713aa4fe30a9a4828a10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9448833fb3ab713aa4fe30a9a4828a10_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\xhxpvvh.exec:\xhxpvvh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\pfjlf.exec:\pfjlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\hvnhx.exec:\hvnhx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\lpvfjtd.exec:\lpvfjtd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\ltbhvd.exec:\ltbhvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\ppllbxj.exec:\ppllbxj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\dfbpf.exec:\dfbpf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\nvvtv.exec:\nvvtv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\pvhjr.exec:\pvhjr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\dpvrljr.exec:\dpvrljr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:276 -
\??\c:\vnxvd.exec:\vnxvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
\??\c:\ftnhnfx.exec:\ftnhnfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\nnnbllh.exec:\nnnbllh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\jjjhh.exec:\jjjhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\nrbtln.exec:\nrbtln.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
\??\c:\fpbfd.exec:\fpbfd.exe17⤵
- Executes dropped EXE
PID:2244 -
\??\c:\hdhjfpb.exec:\hdhjfpb.exe18⤵
- Executes dropped EXE
PID:2328 -
\??\c:\hfdbj.exec:\hfdbj.exe19⤵
- Executes dropped EXE
PID:1628 -
\??\c:\nhxhx.exec:\nhxhx.exe20⤵
- Executes dropped EXE
PID:3000 -
\??\c:\jvbff.exec:\jvbff.exe21⤵
- Executes dropped EXE
PID:1736 -
\??\c:\hdhlnj.exec:\hdhlnj.exe22⤵
- Executes dropped EXE
PID:2896 -
\??\c:\pdltn.exec:\pdltn.exe23⤵
- Executes dropped EXE
PID:432 -
\??\c:\prttpbn.exec:\prttpbn.exe24⤵
- Executes dropped EXE
PID:832 -
\??\c:\bvxdlv.exec:\bvxdlv.exe25⤵
- Executes dropped EXE
PID:692 -
\??\c:\ddbvhtv.exec:\ddbvhtv.exe26⤵
- Executes dropped EXE
PID:1600 -
\??\c:\lnjfrrx.exec:\lnjfrrx.exe27⤵
- Executes dropped EXE
PID:1480 -
\??\c:\xpxtn.exec:\xpxtn.exe28⤵
- Executes dropped EXE
PID:1088 -
\??\c:\rxlxph.exec:\rxlxph.exe29⤵
- Executes dropped EXE
PID:3068 -
\??\c:\hvnhnll.exec:\hvnhnll.exe30⤵
- Executes dropped EXE
PID:2332 -
\??\c:\bjflnnx.exec:\bjflnnx.exe31⤵
- Executes dropped EXE
PID:2808 -
\??\c:\vbnnv.exec:\vbnnv.exe32⤵
- Executes dropped EXE
PID:1752 -
\??\c:\bfffj.exec:\bfffj.exe33⤵
- Executes dropped EXE
PID:2968 -
\??\c:\xntdln.exec:\xntdln.exe34⤵
- Executes dropped EXE
PID:2248 -
\??\c:\xtpnj.exec:\xtpnj.exe35⤵
- Executes dropped EXE
PID:2472 -
\??\c:\jvftr.exec:\jvftr.exe36⤵
- Executes dropped EXE
PID:2900 -
\??\c:\jtvtpf.exec:\jtvtpf.exe37⤵
- Executes dropped EXE
PID:2172 -
\??\c:\tnjtj.exec:\tnjtj.exe38⤵
- Executes dropped EXE
PID:1880 -
\??\c:\drtntd.exec:\drtntd.exe39⤵
- Executes dropped EXE
PID:2624 -
\??\c:\pjtbt.exec:\pjtbt.exe40⤵
- Executes dropped EXE
PID:2560 -
\??\c:\ljfrfn.exec:\ljfrfn.exe41⤵
- Executes dropped EXE
PID:2748 -
\??\c:\lrfpt.exec:\lrfpt.exe42⤵
- Executes dropped EXE
PID:2556 -
\??\c:\bbtdr.exec:\bbtdr.exe43⤵
- Executes dropped EXE
PID:2424 -
\??\c:\nfldvj.exec:\nfldvj.exe44⤵
- Executes dropped EXE
PID:2820 -
\??\c:\xrvlbb.exec:\xrvlbb.exe45⤵
- Executes dropped EXE
PID:2836 -
\??\c:\nvvhx.exec:\nvvhx.exe46⤵
- Executes dropped EXE
PID:1716 -
\??\c:\vxbpdr.exec:\vxbpdr.exe47⤵
- Executes dropped EXE
PID:560 -
\??\c:\fvltbt.exec:\fvltbt.exe48⤵
- Executes dropped EXE
PID:1812 -
\??\c:\jhprn.exec:\jhprn.exe49⤵
- Executes dropped EXE
PID:2656 -
\??\c:\vtpvtt.exec:\vtpvtt.exe50⤵
- Executes dropped EXE
PID:2708 -
\??\c:\rpbdfb.exec:\rpbdfb.exe51⤵
- Executes dropped EXE
PID:1408 -
\??\c:\vphthtp.exec:\vphthtp.exe52⤵
- Executes dropped EXE
PID:1904 -
\??\c:\lrrphxx.exec:\lrrphxx.exe53⤵
- Executes dropped EXE
PID:1892 -
\??\c:\txlthpd.exec:\txlthpd.exe54⤵
- Executes dropped EXE
PID:2316 -
\??\c:\jjnvtnf.exec:\jjnvtnf.exe55⤵
- Executes dropped EXE
PID:1124 -
\??\c:\xlpjl.exec:\xlpjl.exe56⤵
- Executes dropped EXE
PID:1648 -
\??\c:\bvtblb.exec:\bvtblb.exe57⤵
- Executes dropped EXE
PID:2292 -
\??\c:\bxhdp.exec:\bxhdp.exe58⤵
- Executes dropped EXE
PID:2352 -
\??\c:\vbttb.exec:\vbttb.exe59⤵
- Executes dropped EXE
PID:2304 -
\??\c:\nnhtr.exec:\nnhtr.exe60⤵
- Executes dropped EXE
PID:1740 -
\??\c:\trjndhf.exec:\trjndhf.exe61⤵
- Executes dropped EXE
PID:2096 -
\??\c:\dpbbhp.exec:\dpbbhp.exe62⤵
- Executes dropped EXE
PID:544 -
\??\c:\dvvnddl.exec:\dvvnddl.exe63⤵
- Executes dropped EXE
PID:3032 -
\??\c:\jpvvntr.exec:\jpvvntr.exe64⤵
- Executes dropped EXE
PID:1152 -
\??\c:\lnvbnt.exec:\lnvbnt.exe65⤵
- Executes dropped EXE
PID:1800 -
\??\c:\lbhrnnv.exec:\lbhrnnv.exe66⤵PID:3016
-
\??\c:\trbbv.exec:\trbbv.exe67⤵PID:752
-
\??\c:\lnrxdx.exec:\lnrxdx.exe68⤵PID:2348
-
\??\c:\dlrvttx.exec:\dlrvttx.exe69⤵PID:1056
-
\??\c:\hldjhf.exec:\hldjhf.exe70⤵PID:2628
-
\??\c:\pdtnh.exec:\pdtnh.exe71⤵PID:1980
-
\??\c:\lflrl.exec:\lflrl.exe72⤵PID:2864
-
\??\c:\tfjjhrp.exec:\tfjjhrp.exe73⤵PID:2808
-
\??\c:\fftbtj.exec:\fftbtj.exe74⤵PID:936
-
\??\c:\hxthn.exec:\hxthn.exe75⤵PID:1164
-
\??\c:\prjbfj.exec:\prjbfj.exe76⤵PID:1564
-
\??\c:\vjpvtjj.exec:\vjpvtjj.exe77⤵PID:2148
-
\??\c:\fxxfth.exec:\fxxfth.exe78⤵PID:2168
-
\??\c:\jxfxx.exec:\jxfxx.exe79⤵PID:2264
-
\??\c:\rnpdfnl.exec:\rnpdfnl.exe80⤵PID:2536
-
\??\c:\jfrnp.exec:\jfrnp.exe81⤵PID:2052
-
\??\c:\lffff.exec:\lffff.exe82⤵PID:2408
-
\??\c:\nfdjh.exec:\nfdjh.exe83⤵PID:2532
-
\??\c:\hxhxb.exec:\hxhxb.exe84⤵PID:2680
-
\??\c:\tdjnnb.exec:\tdjnnb.exe85⤵PID:2500
-
\??\c:\jbrrf.exec:\jbrrf.exe86⤵PID:2444
-
\??\c:\dlrrhh.exec:\dlrrhh.exe87⤵PID:2856
-
\??\c:\vjtljh.exec:\vjtljh.exe88⤵PID:1344
-
\??\c:\nnjjh.exec:\nnjjh.exe89⤵PID:1440
-
\??\c:\jtblbp.exec:\jtblbp.exe90⤵PID:1332
-
\??\c:\nrnrjrb.exec:\nrnrjrb.exe91⤵PID:2636
-
\??\c:\rdjdbd.exec:\rdjdbd.exe92⤵PID:1908
-
\??\c:\brptrh.exec:\brptrh.exe93⤵PID:2712
-
\??\c:\ljltj.exec:\ljltj.exe94⤵PID:1128
-
\??\c:\nhrrhxf.exec:\nhrrhxf.exe95⤵PID:2128
-
\??\c:\tdhjttn.exec:\tdhjttn.exe96⤵PID:1916
-
\??\c:\dpnttx.exec:\dpnttx.exe97⤵PID:1744
-
\??\c:\fnbxv.exec:\fnbxv.exe98⤵PID:1680
-
\??\c:\frjvthj.exec:\frjvthj.exe99⤵PID:760
-
\??\c:\dvtvx.exec:\dvtvx.exe100⤵PID:2292
-
\??\c:\djfxvf.exec:\djfxvf.exe101⤵PID:2352
-
\??\c:\rpdvhn.exec:\rpdvhn.exe102⤵PID:2304
-
\??\c:\frlxhl.exec:\frlxhl.exe103⤵PID:1740
-
\??\c:\tlhpdn.exec:\tlhpdn.exe104⤵PID:2096
-
\??\c:\tbrlttf.exec:\tbrlttf.exe105⤵PID:2892
-
\??\c:\vnfbrln.exec:\vnfbrln.exe106⤵PID:3032
-
\??\c:\xblhr.exec:\xblhr.exe107⤵PID:1152
-
\??\c:\xlxjt.exec:\xlxjt.exe108⤵PID:2232
-
\??\c:\nprrfr.exec:\nprrfr.exe109⤵PID:3016
-
\??\c:\jvxpp.exec:\jvxpp.exe110⤵PID:752
-
\??\c:\xtdfn.exec:\xtdfn.exe111⤵PID:2800
-
\??\c:\hfnnn.exec:\hfnnn.exe112⤵PID:1056
-
\??\c:\bpvhl.exec:\bpvhl.exe113⤵PID:2628
-
\??\c:\pnbtbf.exec:\pnbtbf.exe114⤵PID:1980
-
\??\c:\hndtd.exec:\hndtd.exe115⤵PID:2864
-
\??\c:\nvbljh.exec:\nvbljh.exe116⤵PID:1752
-
\??\c:\bvbxl.exec:\bvbxl.exe117⤵PID:936
-
\??\c:\tjfndh.exec:\tjfndh.exe118⤵PID:2932
-
\??\c:\xhxbtj.exec:\xhxbtj.exe119⤵PID:2492
-
\??\c:\ltnvr.exec:\ltnvr.exe120⤵PID:1588
-
\??\c:\brvrtr.exec:\brvrtr.exe121⤵PID:2672
-
\??\c:\vlrnlpr.exec:\vlrnlpr.exe122⤵PID:2172
-
\??\c:\jjnfb.exec:\jjnfb.exe123⤵PID:2516
-
\??\c:\hvrjvr.exec:\hvrjvr.exe124⤵PID:924
-
\??\c:\dbvjr.exec:\dbvjr.exe125⤵PID:2600
-
\??\c:\ptnndt.exec:\ptnndt.exe126⤵PID:2552
-
\??\c:\hdtndv.exec:\hdtndv.exe127⤵PID:2400
-
\??\c:\ffpfrbd.exec:\ffpfrbd.exe128⤵PID:2436
-
\??\c:\xtjlnh.exec:\xtjlnh.exe129⤵PID:2376
-
\??\c:\fxpjh.exec:\fxpjh.exe130⤵PID:2360
-
\??\c:\jxtjb.exec:\jxtjb.exe131⤵PID:2504
-
\??\c:\vbltrjx.exec:\vbltrjx.exe132⤵PID:2840
-
\??\c:\phnrj.exec:\phnrj.exe133⤵PID:276
-
\??\c:\rjxrvn.exec:\rjxrvn.exe134⤵PID:1176
-
\??\c:\vnbvxdh.exec:\vnbvxdh.exe135⤵PID:2652
-
\??\c:\xdxnrt.exec:\xdxnrt.exe136⤵PID:2596
-
\??\c:\xxlld.exec:\xxlld.exe137⤵PID:1296
-
\??\c:\ffxxjhd.exec:\ffxxjhd.exe138⤵PID:2212
-
\??\c:\hbrxlr.exec:\hbrxlr.exe139⤵PID:2256
-
\??\c:\rljndx.exec:\rljndx.exe140⤵PID:2324
-
\??\c:\ptbjprb.exec:\ptbjprb.exe141⤵PID:2852
-
\??\c:\xhdrlnv.exec:\xhdrlnv.exe142⤵PID:1116
-
\??\c:\rblpj.exec:\rblpj.exe143⤵PID:1456
-
\??\c:\nvfvjb.exec:\nvfvjb.exe144⤵PID:820
-
\??\c:\jbxjvnd.exec:\jbxjvnd.exe145⤵PID:1140
-
\??\c:\xrxvj.exec:\xrxvj.exe146⤵PID:1736
-
\??\c:\rvnlj.exec:\rvnlj.exe147⤵PID:1272
-
\??\c:\lvdjt.exec:\lvdjt.exe148⤵PID:2180
-
\??\c:\dfpjhx.exec:\dfpjhx.exe149⤵PID:3012
-
\??\c:\ddbpjr.exec:\ddbpjr.exe150⤵PID:332
-
\??\c:\lnfdnh.exec:\lnfdnh.exe151⤵PID:388
-
\??\c:\brvnnl.exec:\brvnnl.exe152⤵PID:2796
-
\??\c:\lbhhf.exec:\lbhhf.exe153⤵PID:1500
-
\??\c:\ptbtt.exec:\ptbtt.exe154⤵PID:1312
-
\??\c:\fnjhtjj.exec:\fnjhtjj.exe155⤵PID:1052
-
\??\c:\vldlhn.exec:\vldlhn.exe156⤵PID:2904
-
\??\c:\xlbdvhj.exec:\xlbdvhj.exe157⤵PID:1684
-
\??\c:\rhlhl.exec:\rhlhl.exe158⤵PID:2044
-
\??\c:\njtprlh.exec:\njtprlh.exe159⤵PID:1548
-
\??\c:\fnldtp.exec:\fnldtp.exe160⤵PID:2732
-
\??\c:\jllfj.exec:\jllfj.exe161⤵PID:2512
-
\??\c:\rtnrtdr.exec:\rtnrtdr.exe162⤵PID:1584
-
\??\c:\jlrtb.exec:\jlrtb.exe163⤵PID:2692
-
\??\c:\pnpxltv.exec:\pnpxltv.exe164⤵PID:2576
-
\??\c:\rptfth.exec:\rptfth.exe165⤵PID:1656
-
\??\c:\xhrdbx.exec:\xhrdbx.exe166⤵PID:2780
-
\??\c:\vdfjr.exec:\vdfjr.exe167⤵PID:2420
-
\??\c:\brbvx.exec:\brbvx.exe168⤵PID:1724
-
\??\c:\prbdhxx.exec:\prbdhxx.exe169⤵PID:2392
-
\??\c:\dptbbfv.exec:\dptbbfv.exe170⤵PID:2432
-
\??\c:\bnprj.exec:\bnprj.exe171⤵PID:2564
-
\??\c:\hftbf.exec:\hftbf.exe172⤵PID:2820
-
\??\c:\blfppj.exec:\blfppj.exe173⤵PID:2856
-
\??\c:\jvvjthn.exec:\jvvjthn.exe174⤵PID:1344
-
\??\c:\jnndbd.exec:\jnndbd.exe175⤵PID:1516
-
\??\c:\jjlhxvn.exec:\jjlhxvn.exe176⤵PID:2844
-
\??\c:\pjtdrdp.exec:\pjtdrdp.exe177⤵PID:2716
-
\??\c:\xxllbnb.exec:\xxllbnb.exe178⤵PID:2728
-
\??\c:\rnfjt.exec:\rnfjt.exe179⤵PID:2712
-
\??\c:\njhdx.exec:\njhdx.exe180⤵PID:1476
-
\??\c:\fhtfp.exec:\fhtfp.exe181⤵PID:1672
-
\??\c:\xdtnf.exec:\xdtnf.exe182⤵PID:1916
-
\??\c:\bdxrj.exec:\bdxrj.exe183⤵PID:1612
-
\??\c:\hdfft.exec:\hdfft.exe184⤵PID:1388
-
\??\c:\rhnfrd.exec:\rhnfrd.exe185⤵PID:612
-
\??\c:\fhfvrx.exec:\fhfvrx.exe186⤵PID:2024
-
\??\c:\lhrdvr.exec:\lhrdvr.exe187⤵PID:2260
-
\??\c:\dlhvv.exec:\dlhvv.exe188⤵PID:3028
-
\??\c:\lrrrxv.exec:\lrrrxv.exe189⤵PID:2952
-
\??\c:\vdxdrbv.exec:\vdxdrbv.exe190⤵PID:1396
-
\??\c:\xnjhf.exec:\xnjhf.exe191⤵PID:920
-
\??\c:\djjdrl.exec:\djjdrl.exe192⤵PID:692
-
\??\c:\phbnlrf.exec:\phbnlrf.exe193⤵PID:1180
-
\??\c:\bpjnj.exec:\bpjnj.exe194⤵PID:1524
-
\??\c:\bvfdvnn.exec:\bvfdvnn.exe195⤵PID:888
-
\??\c:\fhlrxh.exec:\fhlrxh.exe196⤵PID:2976
-
\??\c:\htdlltb.exec:\htdlltb.exe197⤵PID:3068
-
\??\c:\nxrnnb.exec:\nxrnnb.exe198⤵PID:624
-
\??\c:\ldntd.exec:\ldntd.exe199⤵PID:2812
-
\??\c:\rjfndpf.exec:\rjfndpf.exe200⤵PID:1616
-
\??\c:\vldbljr.exec:\vldbljr.exe201⤵PID:1512
-
\??\c:\bfxpt.exec:\bfxpt.exe202⤵PID:1164
-
\??\c:\jbpnh.exec:\jbpnh.exe203⤵PID:1692
-
\??\c:\rjbvrv.exec:\rjbvrv.exe204⤵PID:2908
-
\??\c:\lrrrll.exec:\lrrrll.exe205⤵PID:2512
-
\??\c:\nlxvfj.exec:\nlxvfj.exe206⤵PID:1584
-
\??\c:\trrfhrt.exec:\trrfhrt.exe207⤵PID:2900
-
\??\c:\xxdnrvb.exec:\xxdnrvb.exe208⤵PID:2172
-
\??\c:\hbfxnd.exec:\hbfxnd.exe209⤵PID:2540
-
\??\c:\thrvldv.exec:\thrvldv.exe210⤵PID:2780
-
\??\c:\ppvhn.exec:\ppvhn.exe211⤵PID:2600
-
\??\c:\brrbdnf.exec:\brrbdnf.exe212⤵PID:2556
-
\??\c:\vnrjjdv.exec:\vnrjjdv.exe213⤵PID:2400
-
\??\c:\bjhjjvr.exec:\bjhjjvr.exe214⤵PID:2496
-
\??\c:\prxnth.exec:\prxnth.exe215⤵PID:1040
-
\??\c:\xxhdx.exec:\xxhdx.exe216⤵PID:1568
-
\??\c:\rrtnj.exec:\rrtnj.exe217⤵PID:112
-
\??\c:\ffpdv.exec:\ffpdv.exe218⤵PID:576
-
\??\c:\fxfll.exec:\fxfll.exe219⤵PID:276
-
\??\c:\pdfxllh.exec:\pdfxllh.exe220⤵PID:2656
-
\??\c:\nnffh.exec:\nnffh.exe221⤵PID:2708
-
\??\c:\ddfvxj.exec:\ddfvxj.exe222⤵PID:2916
-
\??\c:\bhrfdvp.exec:\bhrfdvp.exe223⤵PID:932
-
\??\c:\nblvvt.exec:\nblvvt.exe224⤵PID:1920
-
\??\c:\fjbrr.exec:\fjbrr.exe225⤵PID:2284
-
\??\c:\xrjhfhh.exec:\xrjhfhh.exe226⤵PID:1124
-
\??\c:\ppbltp.exec:\ppbltp.exe227⤵PID:2852
-
\??\c:\vrhxjdb.exec:\vrhxjdb.exe228⤵PID:1116
-
\??\c:\fvjlr.exec:\fvjlr.exe229⤵PID:2352
-
\??\c:\xlbln.exec:\xlbln.exe230⤵PID:620
-
\??\c:\hphpdtf.exec:\hphpdtf.exe231⤵PID:2948
-
\??\c:\btbpxrh.exec:\btbpxrh.exe232⤵PID:432
-
\??\c:\ltjbr.exec:\ltjbr.exe233⤵PID:1820
-
\??\c:\ttvnfb.exec:\ttvnfb.exe234⤵PID:3032
-
\??\c:\lrnttf.exec:\lrnttf.exe235⤵PID:1152
-
\??\c:\txbfj.exec:\txbfj.exe236⤵PID:1800
-
\??\c:\tbnlr.exec:\tbnlr.exe237⤵PID:1664
-
\??\c:\xlphxht.exec:\xlphxht.exe238⤵PID:2188
-
\??\c:\rpphvb.exec:\rpphvb.exe239⤵PID:684
-
\??\c:\phxbb.exec:\phxbb.exe240⤵PID:2876
-
\??\c:\ljxhl.exec:\ljxhl.exe241⤵PID:3068
-
\??\c:\jlpvn.exec:\jlpvn.exe242⤵PID:2164