Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 06:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
94bd7e6fde6f46a398f0daa563f7d010_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
94bd7e6fde6f46a398f0daa563f7d010_NeikiAnalytics.exe
-
Size
200KB
-
MD5
94bd7e6fde6f46a398f0daa563f7d010
-
SHA1
1281107cf29978dd9ed18b6ca52c65a08419a2f2
-
SHA256
00aeeb078bf345b552d4562116fc756edfbb32071a1a8219ec46d21b1b727fd6
-
SHA512
1f5acf27c6723c1612ce285320757e91b6edb6ef321d1ebbf12646e471c033438a67b19192a9aad8a5fd54dcc9237167ec389bbbc74577cce595be4130c7127e
-
SSDEEP
3072:ymb3NkkiQ3mdBjFIi/0RU6QeYQsm71vPmc51+GqekBJCvr6zJBUt6id:n3C9BRIG0asYFm71m8+GdkB9k
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/2508-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2452-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2212-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1204-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2268-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/808-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/584-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1036-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1544-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/648-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2068-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
tjdtnjh.exefhxlbrj.exexlfbx.exeplhpfr.exerbjrb.exejtvdtr.exettnvlft.exehjbpht.exebdpjbrn.exevjhjtl.exebfhxdb.exehdfbxfj.exerltxr.exettnvb.exejhtvpff.exeljfhdr.exexnvrj.exexppxb.exexrtxjfp.exejnhvb.exenrjnhhn.exeblnphp.exervhbbpn.exebxbpxtv.exethpbjx.exerhvbr.exennjjf.exetbrfv.exedbdld.exedljhbn.exehvbrdfp.exejbrtp.exertpnn.exevflpnd.exetdhbld.exepjtdvl.exelvjvpjd.exepfvhfvp.exevpbvvxh.exebptbpvh.exefpnrr.exevdbdv.exelhbvdnf.exervfjlx.exefbtdrpr.exefbfbjb.exefbnvtf.exejdvjdvr.exefdbxf.exebhhpnv.exennhxpx.exebtrvbn.exelhtnpfv.exebtvjpjn.exetndbl.exetxbtth.exebjrlf.exevrpnn.exebbvnfx.exednfrnnf.exehblbbbv.exedddbb.exenrtdrr.exevjtfvbd.exepid process 2824 tjdtnjh.exe 2760 fhxlbrj.exe 2960 xlfbx.exe 2648 plhpfr.exe 2556 rbjrb.exe 2452 jtvdtr.exe 2428 ttnvlft.exe 2864 hjbpht.exe 1480 bdpjbrn.exe 840 vjhjtl.exe 2708 bfhxdb.exe 2872 hdfbxfj.exe 2212 rltxr.exe 1204 ttnvb.exe 2352 jhtvpff.exe 1940 ljfhdr.exe 2000 xnvrj.exe 1912 xppxb.exe 2116 xrtxjfp.exe 2268 jnhvb.exe 808 nrjnhhn.exe 584 blnphp.exe 1036 rvhbbpn.exe 1068 bxbpxtv.exe 1544 thpbjx.exe 648 rhvbr.exe 1840 nnjjf.exe 1424 tbrfv.exe 1736 dbdld.exe 2152 dljhbn.exe 2068 hvbrdfp.exe 2108 jbrtp.exe 1696 rtpnn.exe 1728 vflpnd.exe 1612 tdhbld.exe 2884 pjtdvl.exe 2688 lvjvpjd.exe 2568 pfvhfvp.exe 3028 vpbvvxh.exe 2580 bptbpvh.exe 2584 fpnrr.exe 2548 vdbdv.exe 2756 lhbvdnf.exe 2444 rvfjlx.exe 2500 fbtdrpr.exe 2544 fbfbjb.exe 1040 fbnvtf.exe 1916 jdvjdvr.exe 2728 fdbxf.exe 2616 bhhpnv.exe 2328 nnhxpx.exe 2872 btrvbn.exe 2212 lhtnpfv.exe 1204 btvjpjn.exe 2360 tndbl.exe 2972 txbtth.exe 2348 bjrlf.exe 1924 vrpnn.exe 1912 bbvnfx.exe 1096 dnfrnnf.exe 1048 hblbbbv.exe 464 dddbb.exe 568 nrtdrr.exe 432 vjtfvbd.exe -
Processes:
resource yara_rule behavioral1/memory/2508-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1204-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2268-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/808-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/584-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1036-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1544-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/648-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-296-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-304-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
94bd7e6fde6f46a398f0daa563f7d010_NeikiAnalytics.exetjdtnjh.exefhxlbrj.exexlfbx.exeplhpfr.exerbjrb.exejtvdtr.exettnvlft.exehjbpht.exebdpjbrn.exevjhjtl.exebfhxdb.exehdfbxfj.exerltxr.exettnvb.exejhtvpff.exedescription pid process target process PID 2508 wrote to memory of 2824 2508 94bd7e6fde6f46a398f0daa563f7d010_NeikiAnalytics.exe tjdtnjh.exe PID 2508 wrote to memory of 2824 2508 94bd7e6fde6f46a398f0daa563f7d010_NeikiAnalytics.exe tjdtnjh.exe PID 2508 wrote to memory of 2824 2508 94bd7e6fde6f46a398f0daa563f7d010_NeikiAnalytics.exe tjdtnjh.exe PID 2508 wrote to memory of 2824 2508 94bd7e6fde6f46a398f0daa563f7d010_NeikiAnalytics.exe tjdtnjh.exe PID 2824 wrote to memory of 2760 2824 tjdtnjh.exe fhxlbrj.exe PID 2824 wrote to memory of 2760 2824 tjdtnjh.exe fhxlbrj.exe PID 2824 wrote to memory of 2760 2824 tjdtnjh.exe fhxlbrj.exe PID 2824 wrote to memory of 2760 2824 tjdtnjh.exe fhxlbrj.exe PID 2760 wrote to memory of 2960 2760 fhxlbrj.exe xlfbx.exe PID 2760 wrote to memory of 2960 2760 fhxlbrj.exe xlfbx.exe PID 2760 wrote to memory of 2960 2760 fhxlbrj.exe xlfbx.exe PID 2760 wrote to memory of 2960 2760 fhxlbrj.exe xlfbx.exe PID 2960 wrote to memory of 2648 2960 xlfbx.exe plhpfr.exe PID 2960 wrote to memory of 2648 2960 xlfbx.exe plhpfr.exe PID 2960 wrote to memory of 2648 2960 xlfbx.exe plhpfr.exe PID 2960 wrote to memory of 2648 2960 xlfbx.exe plhpfr.exe PID 2648 wrote to memory of 2556 2648 plhpfr.exe rbjrb.exe PID 2648 wrote to memory of 2556 2648 plhpfr.exe rbjrb.exe PID 2648 wrote to memory of 2556 2648 plhpfr.exe rbjrb.exe PID 2648 wrote to memory of 2556 2648 plhpfr.exe rbjrb.exe PID 2556 wrote to memory of 2452 2556 rbjrb.exe jtvdtr.exe PID 2556 wrote to memory of 2452 2556 rbjrb.exe jtvdtr.exe PID 2556 wrote to memory of 2452 2556 rbjrb.exe jtvdtr.exe PID 2556 wrote to memory of 2452 2556 rbjrb.exe jtvdtr.exe PID 2452 wrote to memory of 2428 2452 jtvdtr.exe ttnvlft.exe PID 2452 wrote to memory of 2428 2452 jtvdtr.exe ttnvlft.exe PID 2452 wrote to memory of 2428 2452 jtvdtr.exe ttnvlft.exe PID 2452 wrote to memory of 2428 2452 jtvdtr.exe ttnvlft.exe PID 2428 wrote to memory of 2864 2428 ttnvlft.exe hjbpht.exe PID 2428 wrote to memory of 2864 2428 ttnvlft.exe hjbpht.exe PID 2428 wrote to memory of 2864 2428 ttnvlft.exe hjbpht.exe PID 2428 wrote to memory of 2864 2428 ttnvlft.exe hjbpht.exe PID 2864 wrote to memory of 1480 2864 hjbpht.exe bdpjbrn.exe PID 2864 wrote to memory of 1480 2864 hjbpht.exe bdpjbrn.exe PID 2864 wrote to memory of 1480 2864 hjbpht.exe bdpjbrn.exe PID 2864 wrote to memory of 1480 2864 hjbpht.exe bdpjbrn.exe PID 1480 wrote to memory of 840 1480 bdpjbrn.exe vjhjtl.exe PID 1480 wrote to memory of 840 1480 bdpjbrn.exe vjhjtl.exe PID 1480 wrote to memory of 840 1480 bdpjbrn.exe vjhjtl.exe PID 1480 wrote to memory of 840 1480 bdpjbrn.exe vjhjtl.exe PID 840 wrote to memory of 2708 840 vjhjtl.exe bfhxdb.exe PID 840 wrote to memory of 2708 840 vjhjtl.exe bfhxdb.exe PID 840 wrote to memory of 2708 840 vjhjtl.exe bfhxdb.exe PID 840 wrote to memory of 2708 840 vjhjtl.exe bfhxdb.exe PID 2708 wrote to memory of 2872 2708 bfhxdb.exe hdfbxfj.exe PID 2708 wrote to memory of 2872 2708 bfhxdb.exe hdfbxfj.exe PID 2708 wrote to memory of 2872 2708 bfhxdb.exe hdfbxfj.exe PID 2708 wrote to memory of 2872 2708 bfhxdb.exe hdfbxfj.exe PID 2872 wrote to memory of 2212 2872 hdfbxfj.exe rltxr.exe PID 2872 wrote to memory of 2212 2872 hdfbxfj.exe rltxr.exe PID 2872 wrote to memory of 2212 2872 hdfbxfj.exe rltxr.exe PID 2872 wrote to memory of 2212 2872 hdfbxfj.exe rltxr.exe PID 2212 wrote to memory of 1204 2212 rltxr.exe ttnvb.exe PID 2212 wrote to memory of 1204 2212 rltxr.exe ttnvb.exe PID 2212 wrote to memory of 1204 2212 rltxr.exe ttnvb.exe PID 2212 wrote to memory of 1204 2212 rltxr.exe ttnvb.exe PID 1204 wrote to memory of 2352 1204 ttnvb.exe jhtvpff.exe PID 1204 wrote to memory of 2352 1204 ttnvb.exe jhtvpff.exe PID 1204 wrote to memory of 2352 1204 ttnvb.exe jhtvpff.exe PID 1204 wrote to memory of 2352 1204 ttnvb.exe jhtvpff.exe PID 2352 wrote to memory of 1940 2352 jhtvpff.exe ljfhdr.exe PID 2352 wrote to memory of 1940 2352 jhtvpff.exe ljfhdr.exe PID 2352 wrote to memory of 1940 2352 jhtvpff.exe ljfhdr.exe PID 2352 wrote to memory of 1940 2352 jhtvpff.exe ljfhdr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\94bd7e6fde6f46a398f0daa563f7d010_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\94bd7e6fde6f46a398f0daa563f7d010_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\tjdtnjh.exec:\tjdtnjh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\fhxlbrj.exec:\fhxlbrj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\xlfbx.exec:\xlfbx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\plhpfr.exec:\plhpfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\rbjrb.exec:\rbjrb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\jtvdtr.exec:\jtvdtr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\ttnvlft.exec:\ttnvlft.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\hjbpht.exec:\hjbpht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\bdpjbrn.exec:\bdpjbrn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\vjhjtl.exec:\vjhjtl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\bfhxdb.exec:\bfhxdb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\hdfbxfj.exec:\hdfbxfj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\rltxr.exec:\rltxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\ttnvb.exec:\ttnvb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\jhtvpff.exec:\jhtvpff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\ljfhdr.exec:\ljfhdr.exe17⤵
- Executes dropped EXE
PID:1940 -
\??\c:\xnvrj.exec:\xnvrj.exe18⤵
- Executes dropped EXE
PID:2000 -
\??\c:\xppxb.exec:\xppxb.exe19⤵
- Executes dropped EXE
PID:1912 -
\??\c:\xrtxjfp.exec:\xrtxjfp.exe20⤵
- Executes dropped EXE
PID:2116 -
\??\c:\jnhvb.exec:\jnhvb.exe21⤵
- Executes dropped EXE
PID:2268 -
\??\c:\nrjnhhn.exec:\nrjnhhn.exe22⤵
- Executes dropped EXE
PID:808 -
\??\c:\blnphp.exec:\blnphp.exe23⤵
- Executes dropped EXE
PID:584 -
\??\c:\rvhbbpn.exec:\rvhbbpn.exe24⤵
- Executes dropped EXE
PID:1036 -
\??\c:\bxbpxtv.exec:\bxbpxtv.exe25⤵
- Executes dropped EXE
PID:1068 -
\??\c:\thpbjx.exec:\thpbjx.exe26⤵
- Executes dropped EXE
PID:1544 -
\??\c:\rhvbr.exec:\rhvbr.exe27⤵
- Executes dropped EXE
PID:648 -
\??\c:\nnjjf.exec:\nnjjf.exe28⤵
- Executes dropped EXE
PID:1840 -
\??\c:\tbrfv.exec:\tbrfv.exe29⤵
- Executes dropped EXE
PID:1424 -
\??\c:\dbdld.exec:\dbdld.exe30⤵
- Executes dropped EXE
PID:1736 -
\??\c:\dljhbn.exec:\dljhbn.exe31⤵
- Executes dropped EXE
PID:2152 -
\??\c:\hvbrdfp.exec:\hvbrdfp.exe32⤵
- Executes dropped EXE
PID:2068 -
\??\c:\jbrtp.exec:\jbrtp.exe33⤵
- Executes dropped EXE
PID:2108 -
\??\c:\rtpnn.exec:\rtpnn.exe34⤵
- Executes dropped EXE
PID:1696 -
\??\c:\vflpnd.exec:\vflpnd.exe35⤵
- Executes dropped EXE
PID:1728 -
\??\c:\tdhbld.exec:\tdhbld.exe36⤵
- Executes dropped EXE
PID:1612 -
\??\c:\pjtdvl.exec:\pjtdvl.exe37⤵
- Executes dropped EXE
PID:2884 -
\??\c:\lvjvpjd.exec:\lvjvpjd.exe38⤵
- Executes dropped EXE
PID:2688 -
\??\c:\pfvhfvp.exec:\pfvhfvp.exe39⤵
- Executes dropped EXE
PID:2568 -
\??\c:\vpbvvxh.exec:\vpbvvxh.exe40⤵
- Executes dropped EXE
PID:3028 -
\??\c:\bptbpvh.exec:\bptbpvh.exe41⤵
- Executes dropped EXE
PID:2580 -
\??\c:\fpnrr.exec:\fpnrr.exe42⤵
- Executes dropped EXE
PID:2584 -
\??\c:\vdbdv.exec:\vdbdv.exe43⤵
- Executes dropped EXE
PID:2548 -
\??\c:\lhbvdnf.exec:\lhbvdnf.exe44⤵
- Executes dropped EXE
PID:2756 -
\??\c:\rvfjlx.exec:\rvfjlx.exe45⤵
- Executes dropped EXE
PID:2444 -
\??\c:\fbtdrpr.exec:\fbtdrpr.exe46⤵
- Executes dropped EXE
PID:2500 -
\??\c:\fbfbjb.exec:\fbfbjb.exe47⤵
- Executes dropped EXE
PID:2544 -
\??\c:\fbnvtf.exec:\fbnvtf.exe48⤵
- Executes dropped EXE
PID:1040 -
\??\c:\jdvjdvr.exec:\jdvjdvr.exe49⤵
- Executes dropped EXE
PID:1916 -
\??\c:\fdbxf.exec:\fdbxf.exe50⤵
- Executes dropped EXE
PID:2728 -
\??\c:\bhhpnv.exec:\bhhpnv.exe51⤵
- Executes dropped EXE
PID:2616 -
\??\c:\nnhxpx.exec:\nnhxpx.exe52⤵
- Executes dropped EXE
PID:2328 -
\??\c:\btrvbn.exec:\btrvbn.exe53⤵
- Executes dropped EXE
PID:2872 -
\??\c:\lhtnpfv.exec:\lhtnpfv.exe54⤵
- Executes dropped EXE
PID:2212 -
\??\c:\btvjpjn.exec:\btvjpjn.exe55⤵
- Executes dropped EXE
PID:1204 -
\??\c:\tndbl.exec:\tndbl.exe56⤵
- Executes dropped EXE
PID:2360 -
\??\c:\txbtth.exec:\txbtth.exe57⤵
- Executes dropped EXE
PID:2972 -
\??\c:\bjrlf.exec:\bjrlf.exe58⤵
- Executes dropped EXE
PID:2348 -
\??\c:\vrpnn.exec:\vrpnn.exe59⤵
- Executes dropped EXE
PID:1924 -
\??\c:\bbvnfx.exec:\bbvnfx.exe60⤵
- Executes dropped EXE
PID:1912 -
\??\c:\dnfrnnf.exec:\dnfrnnf.exe61⤵
- Executes dropped EXE
PID:1096 -
\??\c:\hblbbbv.exec:\hblbbbv.exe62⤵
- Executes dropped EXE
PID:1048 -
\??\c:\dddbb.exec:\dddbb.exe63⤵
- Executes dropped EXE
PID:464 -
\??\c:\nrtdrr.exec:\nrtdrr.exe64⤵
- Executes dropped EXE
PID:568 -
\??\c:\vjtfvbd.exec:\vjtfvbd.exe65⤵
- Executes dropped EXE
PID:432 -
\??\c:\xfpdp.exec:\xfpdp.exe66⤵PID:1720
-
\??\c:\nxvjv.exec:\nxvjv.exe67⤵PID:2256
-
\??\c:\brhrh.exec:\brhrh.exe68⤵PID:1308
-
\??\c:\jlbfrv.exec:\jlbfrv.exe69⤵PID:1012
-
\??\c:\dhjjbb.exec:\dhjjbb.exe70⤵PID:2392
-
\??\c:\blfbtt.exec:\blfbtt.exe71⤵PID:1832
-
\??\c:\bdbbrrp.exec:\bdbbrrp.exe72⤵PID:948
-
\??\c:\xjhdx.exec:\xjhdx.exe73⤵PID:2280
-
\??\c:\hbhrr.exec:\hbhrr.exe74⤵PID:1340
-
\??\c:\lnpdhdf.exec:\lnpdhdf.exe75⤵PID:2060
-
\??\c:\vfjjv.exec:\vfjjv.exe76⤵PID:1796
-
\??\c:\txhbjtp.exec:\txhbjtp.exe77⤵PID:1760
-
\??\c:\bbhllx.exec:\bbhllx.exe78⤵PID:924
-
\??\c:\nlndph.exec:\nlndph.exe79⤵PID:1620
-
\??\c:\xrjtjjd.exec:\xrjtjjd.exe80⤵PID:2824
-
\??\c:\drrrff.exec:\drrrff.exe81⤵PID:2612
-
\??\c:\rppph.exec:\rppph.exe82⤵PID:2528
-
\??\c:\bjfjrp.exec:\bjfjrp.exe83⤵PID:2792
-
\??\c:\hpnhhxj.exec:\hpnhhxj.exe84⤵PID:2080
-
\??\c:\bxxrr.exec:\bxxrr.exe85⤵PID:2580
-
\??\c:\rdrfp.exec:\rdrfp.exe86⤵PID:2964
-
\??\c:\thjjnbj.exec:\thjjnbj.exe87⤵PID:2548
-
\??\c:\hxfprbf.exec:\hxfprbf.exe88⤵PID:2460
-
\??\c:\pnvbbrd.exec:\pnvbbrd.exe89⤵PID:2496
-
\??\c:\rtxfvnd.exec:\rtxfvnd.exe90⤵PID:2420
-
\??\c:\hlrrff.exec:\hlrrff.exe91⤵PID:2404
-
\??\c:\nxnlnvd.exec:\nxnlnvd.exe92⤵PID:1376
-
\??\c:\nhbvxtb.exec:\nhbvxtb.exe93⤵PID:560
-
\??\c:\bjbbndn.exec:\bjbbndn.exe94⤵PID:1200
-
\??\c:\xbhrh.exec:\xbhrh.exe95⤵PID:2692
-
\??\c:\phltfl.exec:\phltfl.exe96⤵PID:2492
-
\??\c:\jbbrpn.exec:\jbbrpn.exe97⤵PID:1140
-
\??\c:\lhbdh.exec:\lhbdh.exe98⤵PID:2324
-
\??\c:\jxhlfdj.exec:\jxhlfdj.exe99⤵PID:832
-
\??\c:\vbtnjd.exec:\vbtnjd.exe100⤵PID:936
-
\??\c:\nvhdpr.exec:\nvhdpr.exe101⤵PID:1272
-
\??\c:\jltljtd.exec:\jltljtd.exe102⤵PID:2020
-
\??\c:\lphjrtl.exec:\lphjrtl.exe103⤵PID:2000
-
\??\c:\lbnjhjb.exec:\lbnjhjb.exe104⤵PID:2076
-
\??\c:\prfnj.exec:\prfnj.exe105⤵PID:2136
-
\??\c:\dljxln.exec:\dljxln.exe106⤵PID:940
-
\??\c:\vxbxbnx.exec:\vxbxbnx.exe107⤵PID:2796
-
\??\c:\ldnvn.exec:\ldnvn.exe108⤵PID:2140
-
\??\c:\xbphh.exec:\xbphh.exe109⤵PID:768
-
\??\c:\jfpbp.exec:\jfpbp.exe110⤵PID:672
-
\??\c:\ftdhpv.exec:\ftdhpv.exe111⤵PID:1536
-
\??\c:\vjjpj.exec:\vjjpj.exe112⤵PID:688
-
\??\c:\bblvjd.exec:\bblvjd.exe113⤵PID:2788
-
\??\c:\bhrvtl.exec:\bhrvtl.exe114⤵PID:868
-
\??\c:\hbrprr.exec:\hbrprr.exe115⤵PID:1500
-
\??\c:\vjnxb.exec:\vjnxb.exe116⤵PID:3016
-
\??\c:\vhbndv.exec:\vhbndv.exe117⤵PID:2184
-
\??\c:\hpxdfxn.exec:\hpxdfxn.exe118⤵PID:2484
-
\??\c:\xrnnf.exec:\xrnnf.exe119⤵PID:2204
-
\??\c:\rbjpb.exec:\rbjpb.exe120⤵PID:1780
-
\??\c:\dxnbhjf.exec:\dxnbhjf.exe121⤵PID:1184
-
\??\c:\ntvdh.exec:\ntvdh.exe122⤵PID:2832
-
\??\c:\lfhrr.exec:\lfhrr.exe123⤵PID:1608
-
\??\c:\jlhlpvd.exec:\jlhlpvd.exe124⤵PID:2892
-
\??\c:\rhnddxt.exec:\rhnddxt.exe125⤵PID:2884
-
\??\c:\tlvdxp.exec:\tlvdxp.exe126⤵PID:2688
-
\??\c:\tplnlrt.exec:\tplnlrt.exe127⤵PID:2552
-
\??\c:\jvxbr.exec:\jvxbr.exe128⤵PID:2792
-
\??\c:\ntrpj.exec:\ntrpj.exe129⤵PID:2664
-
\??\c:\xdbjt.exec:\xdbjt.exe130⤵PID:2620
-
\??\c:\drvvd.exec:\drvvd.exe131⤵PID:2584
-
\??\c:\xppdppj.exec:\xppdppj.exe132⤵PID:2724
-
\??\c:\nphthb.exec:\nphthb.exe133⤵PID:2444
-
\??\c:\vxnrjjh.exec:\vxnrjjh.exe134⤵PID:2456
-
\??\c:\tjfxn.exec:\tjfxn.exe135⤵PID:968
-
\??\c:\hbbld.exec:\hbbld.exe136⤵PID:1592
-
\??\c:\hdbhlp.exec:\hdbhlp.exe137⤵PID:1040
-
\??\c:\fvrdhp.exec:\fvrdhp.exe138⤵PID:2880
-
\??\c:\fpnnjp.exec:\fpnnjp.exe139⤵PID:1916
-
\??\c:\hvxtpd.exec:\hvxtpd.exe140⤵PID:1072
-
\??\c:\xjtrrpb.exec:\xjtrrpb.exe141⤵PID:2848
-
\??\c:\lbdvvl.exec:\lbdvvl.exe142⤵PID:1972
-
\??\c:\pvntht.exec:\pvntht.exe143⤵PID:2568
-
\??\c:\dnbrthr.exec:\dnbrthr.exe144⤵PID:1980
-
\??\c:\pjlxlrf.exec:\pjlxlrf.exe145⤵PID:2360
-
\??\c:\brbrr.exec:\brbrr.exe146⤵PID:2972
-
\??\c:\bvpdjhf.exec:\bvpdjhf.exe147⤵PID:2396
-
\??\c:\bjrfvb.exec:\bjrfvb.exe148⤵PID:2024
-
\??\c:\trvfhlb.exec:\trvfhlb.exe149⤵PID:1912
-
\??\c:\hjnrvn.exec:\hjnrvn.exe150⤵PID:1096
-
\??\c:\jlfhv.exec:\jlfhv.exe151⤵PID:588
-
\??\c:\xvrfft.exec:\xvrfft.exe152⤵PID:704
-
\??\c:\jhndl.exec:\jhndl.exe153⤵PID:2944
-
\??\c:\jlxvj.exec:\jlxvj.exe154⤵PID:432
-
\??\c:\jvjvnxp.exec:\jvjvnxp.exe155⤵PID:1720
-
\??\c:\jjttpj.exec:\jjttpj.exe156⤵PID:2036
-
\??\c:\nvvlbph.exec:\nvvlbph.exe157⤵PID:1308
-
\??\c:\xvhjf.exec:\xvhjf.exe158⤵PID:2788
-
\??\c:\rhlrh.exec:\rhlrh.exe159⤵PID:952
-
\??\c:\frlth.exec:\frlth.exe160⤵PID:1428
-
\??\c:\rjdltfd.exec:\rjdltfd.exe161⤵PID:1424
-
\??\c:\fhtdd.exec:\fhtdd.exe162⤵PID:2184
-
\??\c:\ffhnp.exec:\ffhnp.exe163⤵PID:1340
-
\??\c:\hdnfjb.exec:\hdnfjb.exe164⤵PID:2412
-
\??\c:\ptxjrx.exec:\ptxjrx.exe165⤵PID:1796
-
\??\c:\xlnpd.exec:\xlnpd.exe166⤵PID:1760
-
\??\c:\rfjfx.exec:\rfjfx.exe167⤵PID:1696
-
\??\c:\nfldv.exec:\nfldv.exe168⤵PID:1772
-
\??\c:\vpvphjr.exec:\vpvphjr.exe169⤵PID:2824
-
\??\c:\lfxxlp.exec:\lfxxlp.exe170⤵PID:2812
-
\??\c:\tltvhvd.exec:\tltvhvd.exe171⤵PID:2516
-
\??\c:\dldxjd.exec:\dldxjd.exe172⤵PID:2960
-
\??\c:\tvfph.exec:\tvfph.exe173⤵PID:2080
-
\??\c:\pjbpjh.exec:\pjbpjh.exe174⤵PID:2940
-
\??\c:\tvpbvn.exec:\tvpbvn.exe175⤵PID:2776
-
\??\c:\bvtrnv.exec:\bvtrnv.exe176⤵PID:2964
-
\??\c:\rvnvtfj.exec:\rvnvtfj.exe177⤵PID:2684
-
\??\c:\djtjljt.exec:\djtjljt.exe178⤵PID:2756
-
\??\c:\fhtxdlx.exec:\fhtxdlx.exe179⤵PID:2228
-
\??\c:\tllhfp.exec:\tllhfp.exe180⤵PID:1220
-
\??\c:\rfvlvx.exec:\rfvlvx.exe181⤵PID:2400
-
\??\c:\dhbptv.exec:\dhbptv.exe182⤵PID:1944
-
\??\c:\ltvbtd.exec:\ltvbtd.exe183⤵PID:2600
-
\??\c:\rhjvp.exec:\rhjvp.exe184⤵PID:1904
-
\??\c:\jbjtbr.exec:\jbjtbr.exe185⤵PID:2868
-
\??\c:\htnrjjp.exec:\htnrjjp.exe186⤵PID:1976
-
\??\c:\pfhdth.exec:\pfhdth.exe187⤵PID:1524
-
\??\c:\rnjxlv.exec:\rnjxlv.exe188⤵PID:2336
-
\??\c:\rtlbbf.exec:\rtlbbf.exe189⤵PID:2008
-
\??\c:\xrpvd.exec:\xrpvd.exe190⤵PID:1940
-
\??\c:\pnlnhb.exec:\pnlnhb.exe191⤵PID:2356
-
\??\c:\brtjjht.exec:\brtjjht.exe192⤵PID:1836
-
\??\c:\tpxbj.exec:\tpxbj.exe193⤵PID:1628
-
\??\c:\nttjp.exec:\nttjp.exe194⤵PID:1088
-
\??\c:\ppnld.exec:\ppnld.exe195⤵PID:776
-
\??\c:\xjlvvfl.exec:\xjlvvfl.exe196⤵PID:1048
-
\??\c:\djjtlj.exec:\djjtlj.exe197⤵PID:464
-
\??\c:\jrlhxn.exec:\jrlhxn.exe198⤵PID:3024
-
\??\c:\pxvdthb.exec:\pxvdthb.exe199⤵PID:1892
-
\??\c:\vrftj.exec:\vrftj.exe200⤵PID:1160
-
\??\c:\tvndhn.exec:\tvndhn.exe201⤵PID:1364
-
\??\c:\thtjrjl.exec:\thtjrjl.exe202⤵PID:648
-
\??\c:\jbtbft.exec:\jbtbft.exe203⤵PID:624
-
\??\c:\nnxnj.exec:\nnxnj.exe204⤵PID:1392
-
\??\c:\xlbfdl.exec:\xlbfdl.exe205⤵PID:2968
-
\??\c:\pjrprpr.exec:\pjrprpr.exe206⤵PID:1700
-
\??\c:\bpbxbb.exec:\bpbxbb.exe207⤵PID:1676
-
\??\c:\dvllpv.exec:\dvllpv.exe208⤵PID:1180
-
\??\c:\tdxxfv.exec:\tdxxfv.exe209⤵PID:3008
-
\??\c:\tlpjbxt.exec:\tlpjbxt.exe210⤵PID:1752
-
\??\c:\hjbpprx.exec:\hjbpprx.exe211⤵PID:2844
-
\??\c:\vhbnd.exec:\vhbnd.exe212⤵PID:1728
-
\??\c:\tthnf.exec:\tthnf.exe213⤵PID:1696
-
\??\c:\ljnpjd.exec:\ljnpjd.exe214⤵PID:3068
-
\??\c:\pjtdn.exec:\pjtdn.exe215⤵PID:2824
-
\??\c:\rhtjn.exec:\rhtjn.exe216⤵PID:2720
-
\??\c:\jvrhxx.exec:\jvrhxx.exe217⤵PID:2516
-
\??\c:\vjdljjv.exec:\vjdljjv.exe218⤵PID:2960
-
\??\c:\bpvhdfp.exec:\bpvhdfp.exe219⤵PID:1888
-
\??\c:\rthptpx.exec:\rthptpx.exe220⤵PID:2940
-
\??\c:\pjxpjl.exec:\pjxpjl.exe221⤵PID:2776
-
\??\c:\jxlrnt.exec:\jxlrnt.exe222⤵PID:2680
-
\??\c:\phrbdx.exec:\phrbdx.exe223⤵PID:2408
-
\??\c:\nrxppn.exec:\nrxppn.exe224⤵PID:2456
-
\??\c:\rfrfllh.exec:\rfrfllh.exe225⤵PID:2500
-
\??\c:\xppnvdx.exec:\xppnvdx.exe226⤵PID:1928
-
\??\c:\lxddjpn.exec:\lxddjpn.exe227⤵PID:1040
-
\??\c:\phdlt.exec:\phdlt.exe228⤵PID:2708
-
\??\c:\rhbbfp.exec:\rhbbfp.exe229⤵PID:1212
-
\??\c:\htxjj.exec:\htxjj.exe230⤵PID:1104
-
\??\c:\pfdjp.exec:\pfdjp.exe231⤵PID:2848
-
\??\c:\rvxtpp.exec:\rvxtpp.exe232⤵PID:2344
-
\??\c:\ntthjj.exec:\ntthjj.exe233⤵PID:1648
-
\??\c:\rjbpvvt.exec:\rjbpvvt.exe234⤵PID:1980
-
\??\c:\tdtjdn.exec:\tdtjdn.exe235⤵PID:2360
-
\??\c:\dvfbn.exec:\dvfbn.exe236⤵PID:2972
-
\??\c:\rhtnx.exec:\rhtnx.exe237⤵PID:2356
-
\??\c:\hfhjjnv.exec:\hfhjjnv.exe238⤵PID:2024
-
\??\c:\ndrvtnt.exec:\ndrvtnt.exe239⤵PID:3032
-
\??\c:\dnjtdvv.exec:\dnjtdvv.exe240⤵PID:2316
-
\??\c:\jtphfhb.exec:\jtphfhb.exe241⤵PID:1480
-
\??\c:\hjlffdx.exec:\hjlffdx.exe242⤵PID:1748