Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 15:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
df3f24b88f7ef9941c0cb88ef9045ef0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
df3f24b88f7ef9941c0cb88ef9045ef0_NeikiAnalytics.exe
-
Size
96KB
-
MD5
df3f24b88f7ef9941c0cb88ef9045ef0
-
SHA1
8c643e54716ee36a19613496d97e1642959f9ea3
-
SHA256
a53e574b28d6b828dd518a1cad3e5fc83d15b7a45372ed94360c1555a2041c9b
-
SHA512
a38bd8064662a8118816f4fcbeee271747e4d5d5216c9979ba0fcba905a82bf488f752f6306495feed2743945bdf6edc2c6a29add2b1b1108b7de1d0f14ccf90
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIS7/b9EUeWpEC3alBlwtn8BLnnR:ymb3NkkiQ3mdBjFIi/REUZnKlbnvJ
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/1612-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1224-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2452-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3048-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1032-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1084-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1876-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2180-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2248-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2280-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1712-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1960-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3020-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
phvhb.exehjpxn.exejjvld.exenbpvlr.exefnvlxjj.exexjfbt.exenbxfhd.exetbrbdlb.exevthrx.exerntxlfv.exejxpdnj.exenrhfdj.exehhddxt.exedtjfdpj.exetjdfdrh.exejxflrjj.exepjrtbd.exedlfxr.exenpdvthl.exerfnvbp.exedrjfdpr.exednlvbb.exelbtbx.exervfdpth.exetvdrd.exerrhlp.exerhldn.exerxjvb.exerrrhvp.exepplvvln.exevffvp.exehhxvh.exeldtjh.exedldbt.exedfjntnx.exenbhhnth.exentprl.exehrxjxr.exevfjbb.exefhnndr.exefjjjx.exelftndtf.exexnvbbjn.exebxfjptl.exexhvvxt.exehhltt.exetjftx.exepvbrd.exepbbflx.exexrxjf.exepfblvr.exeldrnd.exevdnrnj.exeflbxx.exeldflh.exepvjffpn.exehvpnhvr.exefrtlp.exejrhnnv.exetpfffh.exefxdhpt.exefljvvft.exebnrjbtn.exebtlrbj.exepid process 1224 phvhb.exe 2864 hjpxn.exe 2580 jjvld.exe 2576 nbpvlr.exe 2156 fnvlxjj.exe 2452 xjfbt.exe 2536 nbxfhd.exe 2500 tbrbdlb.exe 3048 vthrx.exe 1032 rntxlfv.exe 1084 jxpdnj.exe 1876 nrhfdj.exe 2512 hhddxt.exe 2816 dtjfdpj.exe 2052 tjdfdrh.exe 2180 jxflrjj.exe 2248 pjrtbd.exe 1692 dlfxr.exe 2280 npdvthl.exe 324 rfnvbp.exe 592 drjfdpr.exe 1712 dnlvbb.exe 276 lbtbx.exe 2972 rvfdpth.exe 1960 tvdrd.exe 1884 rrhlp.exe 2992 rhldn.exe 908 rxjvb.exe 2168 rrrhvp.exe 3020 pplvvln.exe 1708 vffvp.exe 2140 hhxvh.exe 1440 ldtjh.exe 1676 dldbt.exe 1596 dfjntnx.exe 2984 nbhhnth.exe 2864 ntprl.exe 2764 hrxjxr.exe 2620 vfjbb.exe 2540 fhnndr.exe 2936 fjjjx.exe 2424 lftndtf.exe 2724 xnvbbjn.exe 2060 bxfjptl.exe 3016 xhvvxt.exe 1060 hhltt.exe 1324 tjftx.exe 824 pvbrd.exe 1336 pbbflx.exe 1880 xrxjf.exe 2712 pfblvr.exe 1512 ldrnd.exe 2604 vdnrnj.exe 2032 flbxx.exe 2000 ldflh.exe 2240 pvjffpn.exe 1700 hvpnhvr.exe 2308 frtlp.exe 2320 jrhnnv.exe 324 tpfffh.exe 3004 fxdhpt.exe 916 fljvvft.exe 2316 bnrjbtn.exe 2044 btlrbj.exe -
Processes:
resource yara_rule behavioral1/memory/1612-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1224-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1032-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1084-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1876-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2180-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2248-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1712-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1960-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-289-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
df3f24b88f7ef9941c0cb88ef9045ef0_NeikiAnalytics.exephvhb.exehjpxn.exejjvld.exenbpvlr.exefnvlxjj.exexjfbt.exenbxfhd.exetbrbdlb.exevthrx.exerntxlfv.exejxpdnj.exenrhfdj.exehhddxt.exedtjfdpj.exetjdfdrh.exedescription pid process target process PID 1612 wrote to memory of 1224 1612 df3f24b88f7ef9941c0cb88ef9045ef0_NeikiAnalytics.exe phvhb.exe PID 1612 wrote to memory of 1224 1612 df3f24b88f7ef9941c0cb88ef9045ef0_NeikiAnalytics.exe phvhb.exe PID 1612 wrote to memory of 1224 1612 df3f24b88f7ef9941c0cb88ef9045ef0_NeikiAnalytics.exe phvhb.exe PID 1612 wrote to memory of 1224 1612 df3f24b88f7ef9941c0cb88ef9045ef0_NeikiAnalytics.exe phvhb.exe PID 1224 wrote to memory of 2864 1224 phvhb.exe hjpxn.exe PID 1224 wrote to memory of 2864 1224 phvhb.exe hjpxn.exe PID 1224 wrote to memory of 2864 1224 phvhb.exe hjpxn.exe PID 1224 wrote to memory of 2864 1224 phvhb.exe hjpxn.exe PID 2864 wrote to memory of 2580 2864 hjpxn.exe jjvld.exe PID 2864 wrote to memory of 2580 2864 hjpxn.exe jjvld.exe PID 2864 wrote to memory of 2580 2864 hjpxn.exe jjvld.exe PID 2864 wrote to memory of 2580 2864 hjpxn.exe jjvld.exe PID 2580 wrote to memory of 2576 2580 jjvld.exe nbpvlr.exe PID 2580 wrote to memory of 2576 2580 jjvld.exe nbpvlr.exe PID 2580 wrote to memory of 2576 2580 jjvld.exe nbpvlr.exe PID 2580 wrote to memory of 2576 2580 jjvld.exe nbpvlr.exe PID 2576 wrote to memory of 2156 2576 nbpvlr.exe fnvlxjj.exe PID 2576 wrote to memory of 2156 2576 nbpvlr.exe fnvlxjj.exe PID 2576 wrote to memory of 2156 2576 nbpvlr.exe fnvlxjj.exe PID 2576 wrote to memory of 2156 2576 nbpvlr.exe fnvlxjj.exe PID 2156 wrote to memory of 2452 2156 fnvlxjj.exe xjfbt.exe PID 2156 wrote to memory of 2452 2156 fnvlxjj.exe xjfbt.exe PID 2156 wrote to memory of 2452 2156 fnvlxjj.exe xjfbt.exe PID 2156 wrote to memory of 2452 2156 fnvlxjj.exe xjfbt.exe PID 2452 wrote to memory of 2536 2452 xjfbt.exe nbxfhd.exe PID 2452 wrote to memory of 2536 2452 xjfbt.exe nbxfhd.exe PID 2452 wrote to memory of 2536 2452 xjfbt.exe nbxfhd.exe PID 2452 wrote to memory of 2536 2452 xjfbt.exe nbxfhd.exe PID 2536 wrote to memory of 2500 2536 nbxfhd.exe tbrbdlb.exe PID 2536 wrote to memory of 2500 2536 nbxfhd.exe tbrbdlb.exe PID 2536 wrote to memory of 2500 2536 nbxfhd.exe tbrbdlb.exe PID 2536 wrote to memory of 2500 2536 nbxfhd.exe tbrbdlb.exe PID 2500 wrote to memory of 3048 2500 tbrbdlb.exe vthrx.exe PID 2500 wrote to memory of 3048 2500 tbrbdlb.exe vthrx.exe PID 2500 wrote to memory of 3048 2500 tbrbdlb.exe vthrx.exe PID 2500 wrote to memory of 3048 2500 tbrbdlb.exe vthrx.exe PID 3048 wrote to memory of 1032 3048 vthrx.exe rntxlfv.exe PID 3048 wrote to memory of 1032 3048 vthrx.exe rntxlfv.exe PID 3048 wrote to memory of 1032 3048 vthrx.exe rntxlfv.exe PID 3048 wrote to memory of 1032 3048 vthrx.exe rntxlfv.exe PID 1032 wrote to memory of 1084 1032 rntxlfv.exe jxpdnj.exe PID 1032 wrote to memory of 1084 1032 rntxlfv.exe jxpdnj.exe PID 1032 wrote to memory of 1084 1032 rntxlfv.exe jxpdnj.exe PID 1032 wrote to memory of 1084 1032 rntxlfv.exe jxpdnj.exe PID 1084 wrote to memory of 1876 1084 jxpdnj.exe nrhfdj.exe PID 1084 wrote to memory of 1876 1084 jxpdnj.exe nrhfdj.exe PID 1084 wrote to memory of 1876 1084 jxpdnj.exe nrhfdj.exe PID 1084 wrote to memory of 1876 1084 jxpdnj.exe nrhfdj.exe PID 1876 wrote to memory of 2512 1876 nrhfdj.exe hhddxt.exe PID 1876 wrote to memory of 2512 1876 nrhfdj.exe hhddxt.exe PID 1876 wrote to memory of 2512 1876 nrhfdj.exe hhddxt.exe PID 1876 wrote to memory of 2512 1876 nrhfdj.exe hhddxt.exe PID 2512 wrote to memory of 2816 2512 hhddxt.exe dtjfdpj.exe PID 2512 wrote to memory of 2816 2512 hhddxt.exe dtjfdpj.exe PID 2512 wrote to memory of 2816 2512 hhddxt.exe dtjfdpj.exe PID 2512 wrote to memory of 2816 2512 hhddxt.exe dtjfdpj.exe PID 2816 wrote to memory of 2052 2816 dtjfdpj.exe tjdfdrh.exe PID 2816 wrote to memory of 2052 2816 dtjfdpj.exe tjdfdrh.exe PID 2816 wrote to memory of 2052 2816 dtjfdpj.exe tjdfdrh.exe PID 2816 wrote to memory of 2052 2816 dtjfdpj.exe tjdfdrh.exe PID 2052 wrote to memory of 2180 2052 tjdfdrh.exe jxflrjj.exe PID 2052 wrote to memory of 2180 2052 tjdfdrh.exe jxflrjj.exe PID 2052 wrote to memory of 2180 2052 tjdfdrh.exe jxflrjj.exe PID 2052 wrote to memory of 2180 2052 tjdfdrh.exe jxflrjj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\df3f24b88f7ef9941c0cb88ef9045ef0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\df3f24b88f7ef9941c0cb88ef9045ef0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\phvhb.exec:\phvhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\hjpxn.exec:\hjpxn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\jjvld.exec:\jjvld.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\nbpvlr.exec:\nbpvlr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\fnvlxjj.exec:\fnvlxjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\xjfbt.exec:\xjfbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\nbxfhd.exec:\nbxfhd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\tbrbdlb.exec:\tbrbdlb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\vthrx.exec:\vthrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\rntxlfv.exec:\rntxlfv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\jxpdnj.exec:\jxpdnj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\nrhfdj.exec:\nrhfdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\hhddxt.exec:\hhddxt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\dtjfdpj.exec:\dtjfdpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\tjdfdrh.exec:\tjdfdrh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\jxflrjj.exec:\jxflrjj.exe17⤵
- Executes dropped EXE
PID:2180 -
\??\c:\pjrtbd.exec:\pjrtbd.exe18⤵
- Executes dropped EXE
PID:2248 -
\??\c:\dlfxr.exec:\dlfxr.exe19⤵
- Executes dropped EXE
PID:1692 -
\??\c:\npdvthl.exec:\npdvthl.exe20⤵
- Executes dropped EXE
PID:2280 -
\??\c:\rfnvbp.exec:\rfnvbp.exe21⤵
- Executes dropped EXE
PID:324 -
\??\c:\drjfdpr.exec:\drjfdpr.exe22⤵
- Executes dropped EXE
PID:592 -
\??\c:\dnlvbb.exec:\dnlvbb.exe23⤵
- Executes dropped EXE
PID:1712 -
\??\c:\lbtbx.exec:\lbtbx.exe24⤵
- Executes dropped EXE
PID:276 -
\??\c:\rvfdpth.exec:\rvfdpth.exe25⤵
- Executes dropped EXE
PID:2972 -
\??\c:\tvdrd.exec:\tvdrd.exe26⤵
- Executes dropped EXE
PID:1960 -
\??\c:\rrhlp.exec:\rrhlp.exe27⤵
- Executes dropped EXE
PID:1884 -
\??\c:\rhldn.exec:\rhldn.exe28⤵
- Executes dropped EXE
PID:2992 -
\??\c:\rxjvb.exec:\rxjvb.exe29⤵
- Executes dropped EXE
PID:908 -
\??\c:\rrrhvp.exec:\rrrhvp.exe30⤵
- Executes dropped EXE
PID:2168 -
\??\c:\pplvvln.exec:\pplvvln.exe31⤵
- Executes dropped EXE
PID:3020 -
\??\c:\vffvp.exec:\vffvp.exe32⤵
- Executes dropped EXE
PID:1708 -
\??\c:\hhxvh.exec:\hhxvh.exe33⤵
- Executes dropped EXE
PID:2140 -
\??\c:\ldtjh.exec:\ldtjh.exe34⤵
- Executes dropped EXE
PID:1440 -
\??\c:\dldbt.exec:\dldbt.exe35⤵
- Executes dropped EXE
PID:1676 -
\??\c:\dfjntnx.exec:\dfjntnx.exe36⤵
- Executes dropped EXE
PID:1596 -
\??\c:\nbhhnth.exec:\nbhhnth.exe37⤵
- Executes dropped EXE
PID:2984 -
\??\c:\ntprl.exec:\ntprl.exe38⤵
- Executes dropped EXE
PID:2864 -
\??\c:\hrxjxr.exec:\hrxjxr.exe39⤵
- Executes dropped EXE
PID:2764 -
\??\c:\vfjbb.exec:\vfjbb.exe40⤵
- Executes dropped EXE
PID:2620 -
\??\c:\fhnndr.exec:\fhnndr.exe41⤵
- Executes dropped EXE
PID:2540 -
\??\c:\fjjjx.exec:\fjjjx.exe42⤵
- Executes dropped EXE
PID:2936 -
\??\c:\lftndtf.exec:\lftndtf.exe43⤵
- Executes dropped EXE
PID:2424 -
\??\c:\xnvbbjn.exec:\xnvbbjn.exe44⤵
- Executes dropped EXE
PID:2724 -
\??\c:\bxfjptl.exec:\bxfjptl.exe45⤵
- Executes dropped EXE
PID:2060 -
\??\c:\xhvvxt.exec:\xhvvxt.exe46⤵
- Executes dropped EXE
PID:3016 -
\??\c:\hhltt.exec:\hhltt.exe47⤵
- Executes dropped EXE
PID:1060 -
\??\c:\tjftx.exec:\tjftx.exe48⤵
- Executes dropped EXE
PID:1324 -
\??\c:\pvbrd.exec:\pvbrd.exe49⤵
- Executes dropped EXE
PID:824 -
\??\c:\pbbflx.exec:\pbbflx.exe50⤵
- Executes dropped EXE
PID:1336 -
\??\c:\xrxjf.exec:\xrxjf.exe51⤵
- Executes dropped EXE
PID:1880 -
\??\c:\pfblvr.exec:\pfblvr.exe52⤵
- Executes dropped EXE
PID:2712 -
\??\c:\ldrnd.exec:\ldrnd.exe53⤵
- Executes dropped EXE
PID:1512 -
\??\c:\vdnrnj.exec:\vdnrnj.exe54⤵
- Executes dropped EXE
PID:2604 -
\??\c:\flbxx.exec:\flbxx.exe55⤵
- Executes dropped EXE
PID:2032 -
\??\c:\ldflh.exec:\ldflh.exe56⤵
- Executes dropped EXE
PID:2000 -
\??\c:\pvjffpn.exec:\pvjffpn.exe57⤵
- Executes dropped EXE
PID:2240 -
\??\c:\hvpnhvr.exec:\hvpnhvr.exe58⤵
- Executes dropped EXE
PID:1700 -
\??\c:\frtlp.exec:\frtlp.exe59⤵
- Executes dropped EXE
PID:2308 -
\??\c:\jrhnnv.exec:\jrhnnv.exe60⤵
- Executes dropped EXE
PID:2320 -
\??\c:\tpfffh.exec:\tpfffh.exe61⤵
- Executes dropped EXE
PID:324 -
\??\c:\fxdhpt.exec:\fxdhpt.exe62⤵
- Executes dropped EXE
PID:3004 -
\??\c:\fljvvft.exec:\fljvvft.exe63⤵
- Executes dropped EXE
PID:916 -
\??\c:\bnrjbtn.exec:\bnrjbtn.exe64⤵
- Executes dropped EXE
PID:2316 -
\??\c:\btlrbj.exec:\btlrbj.exe65⤵
- Executes dropped EXE
PID:2044 -
\??\c:\ddflt.exec:\ddflt.exe66⤵PID:2972
-
\??\c:\pjbxjjt.exec:\pjbxjjt.exe67⤵PID:1392
-
\??\c:\pddxpd.exec:\pddxpd.exe68⤵PID:2196
-
\??\c:\rlftphp.exec:\rlftphp.exe69⤵PID:1800
-
\??\c:\bfrfj.exec:\bfrfj.exe70⤵PID:640
-
\??\c:\xnphfpn.exec:\xnphfpn.exe71⤵PID:2900
-
\??\c:\xdjjfn.exec:\xdjjfn.exe72⤵PID:3000
-
\??\c:\rdnpb.exec:\rdnpb.exe73⤵PID:2784
-
\??\c:\ltbfjph.exec:\ltbfjph.exe74⤵PID:1760
-
\??\c:\dhvhrjd.exec:\dhvhrjd.exe75⤵PID:2340
-
\??\c:\pxtnx.exec:\pxtnx.exe76⤵PID:3012
-
\??\c:\bxrxfp.exec:\bxrxfp.exe77⤵PID:1672
-
\??\c:\lnjdj.exec:\lnjdj.exe78⤵PID:2116
-
\??\c:\dhfnrtp.exec:\dhfnrtp.exe79⤵PID:2980
-
\??\c:\fvrhb.exec:\fvrhb.exe80⤵PID:2984
-
\??\c:\hhjdpf.exec:\hhjdpf.exe81⤵PID:2624
-
\??\c:\btrrbb.exec:\btrrbb.exe82⤵PID:2756
-
\??\c:\tpvfdhh.exec:\tpvfdhh.exe83⤵PID:2704
-
\??\c:\ffjdh.exec:\ffjdh.exe84⤵PID:2460
-
\??\c:\lntjd.exec:\lntjd.exe85⤵PID:2452
-
\??\c:\vldvtlt.exec:\vldvtlt.exe86⤵PID:2480
-
\??\c:\jlhlxj.exec:\jlhlxj.exe87⤵PID:2840
-
\??\c:\trdlxrr.exec:\trdlxrr.exe88⤵PID:2544
-
\??\c:\rvjnj.exec:\rvjnj.exe89⤵PID:776
-
\??\c:\rjnxfj.exec:\rjnxfj.exe90⤵PID:584
-
\??\c:\pfflv.exec:\pfflv.exe91⤵PID:1740
-
\??\c:\hdntnb.exec:\hdntnb.exe92⤵PID:1868
-
\??\c:\vhvdv.exec:\vhvdv.exe93⤵PID:2740
-
\??\c:\jppxbfb.exec:\jppxbfb.exe94⤵PID:2736
-
\??\c:\jlpdnnr.exec:\jlpdnnr.exe95⤵PID:1372
-
\??\c:\plvxnl.exec:\plvxnl.exe96⤵PID:1444
-
\??\c:\ddptxnb.exec:\ddptxnb.exe97⤵PID:1232
-
\??\c:\jpvdbjr.exec:\jpvdbjr.exe98⤵PID:2180
-
\??\c:\prvlhhr.exec:\prvlhhr.exe99⤵PID:2216
-
\??\c:\nljvh.exec:\nljvh.exe100⤵PID:1836
-
\??\c:\hjptbtl.exec:\hjptbtl.exe101⤵PID:2152
-
\??\c:\jfbplrn.exec:\jfbplrn.exe102⤵PID:676
-
\??\c:\lfrvdj.exec:\lfrvdj.exe103⤵PID:1936
-
\??\c:\bbphvr.exec:\bbphvr.exe104⤵PID:3064
-
\??\c:\jjppjxh.exec:\jjppjxh.exe105⤵PID:2392
-
\??\c:\plrdtdp.exec:\plrdtdp.exe106⤵PID:436
-
\??\c:\nbpppj.exec:\nbpppj.exe107⤵PID:1296
-
\??\c:\dntpdtx.exec:\dntpdtx.exe108⤵PID:1292
-
\??\c:\vrjdv.exec:\vrjdv.exe109⤵PID:1564
-
\??\c:\rrfph.exec:\rrfph.exe110⤵PID:1360
-
\??\c:\nlfpbrh.exec:\nlfpbrh.exe111⤵PID:1288
-
\??\c:\tvnvlfp.exec:\tvnvlfp.exe112⤵PID:992
-
\??\c:\xvbpr.exec:\xvbpr.exe113⤵PID:924
-
\??\c:\vrhpnvp.exec:\vrhpnvp.exe114⤵PID:2900
-
\??\c:\vbfxlfr.exec:\vbfxlfr.exe115⤵PID:2908
-
\??\c:\jphdttv.exec:\jphdttv.exe116⤵PID:1768
-
\??\c:\djlhjl.exec:\djlhjl.exe117⤵PID:2364
-
\??\c:\drbvr.exec:\drbvr.exe118⤵PID:2140
-
\??\c:\drlbvt.exec:\drlbvt.exe119⤵PID:1612
-
\??\c:\xnxvl.exec:\xnxvl.exe120⤵PID:872
-
\??\c:\fdvdjvv.exec:\fdvdjvv.exe121⤵PID:1596
-
\??\c:\pfrjxx.exec:\pfrjxx.exe122⤵PID:2648
-
\??\c:\tjlbdh.exec:\tjlbdh.exe123⤵PID:2864
-
\??\c:\bpdxdfv.exec:\bpdxdfv.exe124⤵PID:2664
-
\??\c:\frftp.exec:\frftp.exe125⤵PID:2584
-
\??\c:\ftlttxf.exec:\ftlttxf.exe126⤵PID:2540
-
\??\c:\ltdbphd.exec:\ltdbphd.exe127⤵PID:2436
-
\??\c:\lbdppfr.exec:\lbdppfr.exe128⤵PID:2560
-
\??\c:\djdtnr.exec:\djdtnr.exe129⤵PID:2724
-
\??\c:\fpbpt.exec:\fpbpt.exe130⤵PID:2060
-
\??\c:\fdtbdvj.exec:\fdtbdvj.exe131⤵PID:3016
-
\??\c:\plhhp.exec:\plhhp.exe132⤵PID:1060
-
\??\c:\dxtnldx.exec:\dxtnldx.exe133⤵PID:1524
-
\??\c:\vfbhp.exec:\vfbhp.exe134⤵PID:888
-
\??\c:\llbxbpr.exec:\llbxbpr.exe135⤵PID:572
-
\??\c:\rbtrd.exec:\rbtrd.exe136⤵PID:1876
-
\??\c:\dpxvf.exec:\dpxvf.exe137⤵PID:2712
-
\??\c:\xvxbjjp.exec:\xvxbjjp.exe138⤵PID:1512
-
\??\c:\txptr.exec:\txptr.exe139⤵PID:1968
-
\??\c:\drrdjbh.exec:\drrdjbh.exe140⤵PID:1636
-
\??\c:\jtpjhbl.exec:\jtpjhbl.exe141⤵PID:1696
-
\??\c:\dfllxd.exec:\dfllxd.exe142⤵PID:2240
-
\??\c:\vldjnx.exec:\vldjnx.exe143⤵PID:1780
-
\??\c:\rbftp.exec:\rbftp.exe144⤵PID:468
-
\??\c:\rprjjp.exec:\rprjjp.exe145⤵PID:2904
-
\??\c:\frtvrl.exec:\frtvrl.exe146⤵PID:2188
-
\??\c:\pnpxlph.exec:\pnpxlph.exe147⤵PID:1724
-
\??\c:\bbrddjt.exec:\bbrddjt.exe148⤵PID:1712
-
\??\c:\pljlvd.exec:\pljlvd.exe149⤵PID:916
-
\??\c:\dvfbd.exec:\dvfbd.exe150⤵PID:1852
-
\??\c:\tdvxh.exec:\tdvxh.exe151⤵PID:1764
-
\??\c:\fhdrbd.exec:\fhdrbd.exe152⤵PID:1604
-
\??\c:\hdpnp.exec:\hdpnp.exe153⤵PID:792
-
\??\c:\ltpxhp.exec:\ltpxhp.exe154⤵PID:1832
-
\??\c:\ppxtl.exec:\ppxtl.exe155⤵PID:2164
-
\??\c:\rxrxvbp.exec:\rxrxvbp.exe156⤵PID:612
-
\??\c:\jhvplr.exec:\jhvplr.exe157⤵PID:2956
-
\??\c:\nftvfdl.exec:\nftvfdl.exe158⤵PID:2988
-
\??\c:\pdjnl.exec:\pdjnl.exe159⤵PID:1708
-
\??\c:\nxxhnrv.exec:\nxxhnrv.exe160⤵PID:1408
-
\??\c:\jtdvbl.exec:\jtdvbl.exe161⤵PID:2352
-
\??\c:\bdnjdvt.exec:\bdnjdvt.exe162⤵PID:1668
-
\??\c:\lxrlr.exec:\lxrlr.exe163⤵PID:1676
-
\??\c:\frvnbt.exec:\frvnbt.exe164⤵PID:2516
-
\??\c:\npfjf.exec:\npfjf.exe165⤵PID:2572
-
\??\c:\jvjlxxp.exec:\jvjlxxp.exe166⤵PID:2984
-
\??\c:\ljtjv.exec:\ljtjv.exe167⤵PID:2576
-
\??\c:\lhpnxr.exec:\lhpnxr.exe168⤵PID:2568
-
\??\c:\vjllthb.exec:\vjllthb.exe169⤵PID:2704
-
\??\c:\phdvlxx.exec:\phdvlxx.exe170⤵PID:2460
-
\??\c:\htltr.exec:\htltr.exe171⤵PID:2420
-
\??\c:\dhfjhnb.exec:\dhfjhnb.exe172⤵PID:2480
-
\??\c:\tnbtdhj.exec:\tnbtdhj.exe173⤵PID:2932
-
\??\c:\dlhbhlx.exec:\dlhbhlx.exe174⤵PID:2544
-
\??\c:\rtfxr.exec:\rtfxr.exe175⤵PID:776
-
\??\c:\lxbdhf.exec:\lxbdhf.exe176⤵PID:1112
-
\??\c:\fjdbxlj.exec:\fjdbxlj.exe177⤵PID:1180
-
\??\c:\rbrvl.exec:\rbrvl.exe178⤵PID:2728
-
\??\c:\lpjfn.exec:\lpjfn.exe179⤵PID:2708
-
\??\c:\ldtfdht.exec:\ldtfdht.exe180⤵PID:2212
-
\??\c:\xhdhvpd.exec:\xhdhvpd.exe181⤵PID:1996
-
\??\c:\njvxj.exec:\njvxj.exe182⤵PID:1444
-
\??\c:\jvbdfb.exec:\jvbdfb.exe183⤵PID:2000
-
\??\c:\ndrdvb.exec:\ndrdvb.exe184⤵PID:2180
-
\??\c:\pxlvn.exec:\pxlvn.exe185⤵PID:2080
-
\??\c:\rrvtb.exec:\rrvtb.exe186⤵PID:2240
-
\??\c:\ltnxvfr.exec:\ltnxvfr.exe187⤵PID:2924
-
\??\c:\vlbxhr.exec:\vlbxhr.exe188⤵PID:676
-
\??\c:\jlhln.exec:\jlhln.exe189⤵PID:484
-
\??\c:\lrvldf.exec:\lrvldf.exe190⤵PID:2772
-
\??\c:\bxtdldj.exec:\bxtdldj.exe191⤵PID:2312
-
\??\c:\fdrnfb.exec:\fdrnfb.exe192⤵PID:2056
-
\??\c:\hnfdh.exec:\hnfdh.exe193⤵PID:400
-
\??\c:\dphtp.exec:\dphtp.exe194⤵PID:1348
-
\??\c:\hbxdhxf.exec:\hbxdhxf.exe195⤵PID:1828
-
\??\c:\tpltdv.exec:\tpltdv.exe196⤵PID:1972
-
\??\c:\bvdbp.exec:\bvdbp.exe197⤵PID:980
-
\??\c:\prlnl.exec:\prlnl.exe198⤵PID:640
-
\??\c:\llnjtv.exec:\llnjtv.exe199⤵PID:2768
-
\??\c:\xnxtr.exec:\xnxtr.exe200⤵PID:612
-
\??\c:\xxbxnv.exec:\xxbxnv.exe201⤵PID:2908
-
\??\c:\vtxrhh.exec:\vtxrhh.exe202⤵PID:1760
-
\??\c:\ldfxrp.exec:\ldfxrp.exe203⤵PID:2340
-
\??\c:\lrpxtdd.exec:\lrpxtdd.exe204⤵PID:2612
-
\??\c:\xvxvlxf.exec:\xvxvlxf.exe205⤵PID:1672
-
\??\c:\jndpfp.exec:\jndpfp.exe206⤵PID:872
-
\??\c:\pbllbp.exec:\pbllbp.exe207⤵PID:2652
-
\??\c:\hbhvh.exec:\hbhvh.exe208⤵PID:2648
-
\??\c:\bpbdvhh.exec:\bpbdvhh.exe209⤵PID:2660
-
\??\c:\bfrdjj.exec:\bfrdjj.exe210⤵PID:2720
-
\??\c:\hhpvnvd.exec:\hhpvnvd.exe211⤵PID:2596
-
\??\c:\bplbbbd.exec:\bplbbbd.exe212⤵PID:2072
-
\??\c:\bvljrf.exec:\bvljrf.exe213⤵PID:2476
-
\??\c:\drdndr.exec:\drdndr.exe214⤵PID:2176
-
\??\c:\fbljv.exec:\fbljv.exe215⤵PID:2840
-
\??\c:\dxvnx.exec:\dxvnx.exe216⤵PID:2472
-
\??\c:\pjjdjdh.exec:\pjjdjdh.exe217⤵PID:2172
-
\??\c:\lxlrh.exec:\lxlrh.exe218⤵PID:1728
-
\??\c:\xrjxv.exec:\xrjxv.exe219⤵PID:1084
-
\??\c:\rrdtt.exec:\rrdtt.exe220⤵PID:2492
-
\??\c:\jvjnvr.exec:\jvjnvr.exe221⤵PID:1336
-
\??\c:\jbtvnjd.exec:\jbtvnjd.exe222⤵PID:2832
-
\??\c:\trhjb.exec:\trhjb.exe223⤵PID:1372
-
\??\c:\xrpbj.exec:\xrpbj.exe224⤵PID:2028
-
\??\c:\pdbfpj.exec:\pdbfpj.exe225⤵PID:1176
-
\??\c:\xtvrljb.exec:\xtvrljb.exe226⤵PID:1648
-
\??\c:\phbtjv.exec:\phbtjv.exe227⤵PID:1152
-
\??\c:\dlhnd.exec:\dlhnd.exe228⤵PID:2108
-
\??\c:\dprbrh.exec:\dprbrh.exe229⤵PID:2656
-
\??\c:\prttfnn.exec:\prttfnn.exe230⤵PID:2320
-
\??\c:\hbpjl.exec:\hbpjl.exe231⤵PID:692
-
\??\c:\thhxldd.exec:\thhxldd.exe232⤵PID:484
-
\??\c:\djxbpx.exec:\djxbpx.exe233⤵PID:956
-
\??\c:\phppl.exec:\phppl.exe234⤵PID:2372
-
\??\c:\vpbtjn.exec:\vpbtjn.exe235⤵PID:2316
-
\??\c:\vbxpfv.exec:\vbxpfv.exe236⤵PID:2056
-
\??\c:\bnpddnj.exec:\bnpddnj.exe237⤵PID:1532
-
\??\c:\pxxxntp.exec:\pxxxntp.exe238⤵PID:1804
-
\??\c:\djxljxj.exec:\djxljxj.exe239⤵PID:2992
-
\??\c:\nblrjh.exec:\nblrjh.exe240⤵PID:2820
-
\??\c:\txptt.exec:\txptt.exe241⤵PID:2100
-
\??\c:\hfpvn.exec:\hfpvn.exe242⤵PID:564