Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 04:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
af3f9fe73ffde1c212d3b9e97d9dfca0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
af3f9fe73ffde1c212d3b9e97d9dfca0_NeikiAnalytics.exe
-
Size
75KB
-
MD5
af3f9fe73ffde1c212d3b9e97d9dfca0
-
SHA1
f8d889d826850105eab691d9f1b56fd614dec0e9
-
SHA256
4ee6d8a86cc4b97c2d86a5023c645942765498471e5e8eb129e20e3134b17772
-
SHA512
2b450eaf012dbb9570cede1d1303d8e361b6fec365ebdbfd004ed52b7681b57a1e3f4593fdf71d74abaa4714627a05b5b9d61fed3aab212d23ee45602e777500
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIoAh2QpUnX1AL:ymb3NkkiQ3mdBjFIsIVbpUa
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/2888-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1776-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/280-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1608-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2144-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/608-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2984-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1660-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1828-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rddtf.exerddvjdf.exelrjhd.exebdppxn.exenfjlnh.exeffbvb.exexdbpn.exernhnhrd.exejlrbllv.exehvbdhln.exevdtbx.exefjrnvj.exebdphp.exebrhxb.exendhnxh.exetffflnr.exervlhj.exevvxph.exenjfxrvt.exefxdjlj.exefttpxbv.exehdvljl.exevnfttn.exeprfld.exevjljtx.exephxnbv.exetxpdvrr.exelblhxlb.exefjddnx.exejlvbhbn.exeddfxp.exelnjblr.exevtbvpfj.exepbvbjb.exettltlbb.exehjptbn.exetdrnr.exenddhxt.exernhff.exebfnjjt.exejprbjj.exetfxtld.exehfhph.exelhhrdlh.exexdfpf.exefjxpnpp.exejhndll.exerhjhlx.exejlpfp.exefxxlxrr.exentvpbpr.exedldnlx.exevbhpvvv.exefnrnj.exexpvnpd.exejfftjn.exehdpnr.exelhxlfhj.exexfbjxlp.exexrbbrp.exexvdlx.exevfrbd.exenltxbtj.exenjfvtrd.exepid process 3016 rddtf.exe 2856 rddvjdf.exe 2572 lrjhd.exe 2624 bdppxn.exe 2536 nfjlnh.exe 1776 ffbvb.exe 2784 xdbpn.exe 280 rnhnhrd.exe 940 jlrbllv.exe 1552 hvbdhln.exe 2672 vdtbx.exe 1948 fjrnvj.exe 1800 bdphp.exe 2312 brhxb.exe 1608 ndhnxh.exe 2144 tffflnr.exe 1252 rvlhj.exe 608 vvxph.exe 2240 njfxrvt.exe 2984 fxdjlj.exe 2116 fttpxbv.exe 2988 hdvljl.exe 2968 vnfttn.exe 2196 prfld.exe 1660 vjljtx.exe 684 phxnbv.exe 1828 txpdvrr.exe 620 lblhxlb.exe 2336 fjddnx.exe 2168 jlvbhbn.exe 2752 ddfxp.exe 868 lnjblr.exe 2036 vtbvpfj.exe 3032 pbvbjb.exe 2452 ttltlbb.exe 3016 hjptbn.exe 2856 tdrnr.exe 2616 nddhxt.exe 2572 rnhff.exe 2596 bfnjjt.exe 2592 jprbjj.exe 2428 tfxtld.exe 2556 hfhph.exe 2384 lhhrdlh.exe 800 xdfpf.exe 588 fjxpnpp.exe 2180 jhndll.exe 1500 rhjhlx.exe 1196 jlpfp.exe 2280 fxxlxrr.exe 2296 ntvpbpr.exe 1936 dldnlx.exe 784 vbhpvvv.exe 1952 fnrnj.exe 2896 xpvnpd.exe 1492 jfftjn.exe 1520 hdpnr.exe 1860 lhxlfhj.exe 608 xfbjxlp.exe 2060 xrbbrp.exe 472 xvdlx.exe 672 vfrbd.exe 276 nltxbtj.exe 3056 njfvtrd.exe -
Processes:
resource yara_rule behavioral1/memory/2888-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1776-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1776-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1776-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1776-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/280-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/280-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1608-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2144-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/608-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1828-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-288-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
af3f9fe73ffde1c212d3b9e97d9dfca0_NeikiAnalytics.exerddtf.exerddvjdf.exelrjhd.exebdppxn.exenfjlnh.exeffbvb.exexdbpn.exernhnhrd.exejlrbllv.exehvbdhln.exevdtbx.exefjrnvj.exebdphp.exebrhxb.exendhnxh.exedescription pid process target process PID 2888 wrote to memory of 3016 2888 af3f9fe73ffde1c212d3b9e97d9dfca0_NeikiAnalytics.exe rddtf.exe PID 2888 wrote to memory of 3016 2888 af3f9fe73ffde1c212d3b9e97d9dfca0_NeikiAnalytics.exe rddtf.exe PID 2888 wrote to memory of 3016 2888 af3f9fe73ffde1c212d3b9e97d9dfca0_NeikiAnalytics.exe rddtf.exe PID 2888 wrote to memory of 3016 2888 af3f9fe73ffde1c212d3b9e97d9dfca0_NeikiAnalytics.exe rddtf.exe PID 3016 wrote to memory of 2856 3016 rddtf.exe rddvjdf.exe PID 3016 wrote to memory of 2856 3016 rddtf.exe rddvjdf.exe PID 3016 wrote to memory of 2856 3016 rddtf.exe rddvjdf.exe PID 3016 wrote to memory of 2856 3016 rddtf.exe rddvjdf.exe PID 2856 wrote to memory of 2572 2856 rddvjdf.exe lrjhd.exe PID 2856 wrote to memory of 2572 2856 rddvjdf.exe lrjhd.exe PID 2856 wrote to memory of 2572 2856 rddvjdf.exe lrjhd.exe PID 2856 wrote to memory of 2572 2856 rddvjdf.exe lrjhd.exe PID 2572 wrote to memory of 2624 2572 lrjhd.exe bdppxn.exe PID 2572 wrote to memory of 2624 2572 lrjhd.exe bdppxn.exe PID 2572 wrote to memory of 2624 2572 lrjhd.exe bdppxn.exe PID 2572 wrote to memory of 2624 2572 lrjhd.exe bdppxn.exe PID 2624 wrote to memory of 2536 2624 bdppxn.exe nfjlnh.exe PID 2624 wrote to memory of 2536 2624 bdppxn.exe nfjlnh.exe PID 2624 wrote to memory of 2536 2624 bdppxn.exe nfjlnh.exe PID 2624 wrote to memory of 2536 2624 bdppxn.exe nfjlnh.exe PID 2536 wrote to memory of 1776 2536 nfjlnh.exe ffbvb.exe PID 2536 wrote to memory of 1776 2536 nfjlnh.exe ffbvb.exe PID 2536 wrote to memory of 1776 2536 nfjlnh.exe ffbvb.exe PID 2536 wrote to memory of 1776 2536 nfjlnh.exe ffbvb.exe PID 1776 wrote to memory of 2784 1776 ffbvb.exe xdbpn.exe PID 1776 wrote to memory of 2784 1776 ffbvb.exe xdbpn.exe PID 1776 wrote to memory of 2784 1776 ffbvb.exe xdbpn.exe PID 1776 wrote to memory of 2784 1776 ffbvb.exe xdbpn.exe PID 2784 wrote to memory of 280 2784 xdbpn.exe rnhnhrd.exe PID 2784 wrote to memory of 280 2784 xdbpn.exe rnhnhrd.exe PID 2784 wrote to memory of 280 2784 xdbpn.exe rnhnhrd.exe PID 2784 wrote to memory of 280 2784 xdbpn.exe rnhnhrd.exe PID 280 wrote to memory of 940 280 rnhnhrd.exe jlrbllv.exe PID 280 wrote to memory of 940 280 rnhnhrd.exe jlrbllv.exe PID 280 wrote to memory of 940 280 rnhnhrd.exe jlrbllv.exe PID 280 wrote to memory of 940 280 rnhnhrd.exe jlrbllv.exe PID 940 wrote to memory of 1552 940 jlrbllv.exe hvbdhln.exe PID 940 wrote to memory of 1552 940 jlrbllv.exe hvbdhln.exe PID 940 wrote to memory of 1552 940 jlrbllv.exe hvbdhln.exe PID 940 wrote to memory of 1552 940 jlrbllv.exe hvbdhln.exe PID 1552 wrote to memory of 2672 1552 hvbdhln.exe vdtbx.exe PID 1552 wrote to memory of 2672 1552 hvbdhln.exe vdtbx.exe PID 1552 wrote to memory of 2672 1552 hvbdhln.exe vdtbx.exe PID 1552 wrote to memory of 2672 1552 hvbdhln.exe vdtbx.exe PID 2672 wrote to memory of 1948 2672 vdtbx.exe fjrnvj.exe PID 2672 wrote to memory of 1948 2672 vdtbx.exe fjrnvj.exe PID 2672 wrote to memory of 1948 2672 vdtbx.exe fjrnvj.exe PID 2672 wrote to memory of 1948 2672 vdtbx.exe fjrnvj.exe PID 1948 wrote to memory of 1800 1948 fjrnvj.exe bdphp.exe PID 1948 wrote to memory of 1800 1948 fjrnvj.exe bdphp.exe PID 1948 wrote to memory of 1800 1948 fjrnvj.exe bdphp.exe PID 1948 wrote to memory of 1800 1948 fjrnvj.exe bdphp.exe PID 1800 wrote to memory of 2312 1800 bdphp.exe brhxb.exe PID 1800 wrote to memory of 2312 1800 bdphp.exe brhxb.exe PID 1800 wrote to memory of 2312 1800 bdphp.exe brhxb.exe PID 1800 wrote to memory of 2312 1800 bdphp.exe brhxb.exe PID 2312 wrote to memory of 1608 2312 brhxb.exe ndhnxh.exe PID 2312 wrote to memory of 1608 2312 brhxb.exe ndhnxh.exe PID 2312 wrote to memory of 1608 2312 brhxb.exe ndhnxh.exe PID 2312 wrote to memory of 1608 2312 brhxb.exe ndhnxh.exe PID 1608 wrote to memory of 2144 1608 ndhnxh.exe tffflnr.exe PID 1608 wrote to memory of 2144 1608 ndhnxh.exe tffflnr.exe PID 1608 wrote to memory of 2144 1608 ndhnxh.exe tffflnr.exe PID 1608 wrote to memory of 2144 1608 ndhnxh.exe tffflnr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\af3f9fe73ffde1c212d3b9e97d9dfca0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\af3f9fe73ffde1c212d3b9e97d9dfca0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\rddtf.exec:\rddtf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\rddvjdf.exec:\rddvjdf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\lrjhd.exec:\lrjhd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\bdppxn.exec:\bdppxn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\nfjlnh.exec:\nfjlnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\ffbvb.exec:\ffbvb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\xdbpn.exec:\xdbpn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\rnhnhrd.exec:\rnhnhrd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:280 -
\??\c:\jlrbllv.exec:\jlrbllv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\hvbdhln.exec:\hvbdhln.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\vdtbx.exec:\vdtbx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\fjrnvj.exec:\fjrnvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\bdphp.exec:\bdphp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\brhxb.exec:\brhxb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\ndhnxh.exec:\ndhnxh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\tffflnr.exec:\tffflnr.exe17⤵
- Executes dropped EXE
PID:2144 -
\??\c:\rvlhj.exec:\rvlhj.exe18⤵
- Executes dropped EXE
PID:1252 -
\??\c:\vvxph.exec:\vvxph.exe19⤵
- Executes dropped EXE
PID:608 -
\??\c:\njfxrvt.exec:\njfxrvt.exe20⤵
- Executes dropped EXE
PID:2240 -
\??\c:\fxdjlj.exec:\fxdjlj.exe21⤵
- Executes dropped EXE
PID:2984 -
\??\c:\fttpxbv.exec:\fttpxbv.exe22⤵
- Executes dropped EXE
PID:2116 -
\??\c:\hdvljl.exec:\hdvljl.exe23⤵
- Executes dropped EXE
PID:2988 -
\??\c:\vnfttn.exec:\vnfttn.exe24⤵
- Executes dropped EXE
PID:2968 -
\??\c:\prfld.exec:\prfld.exe25⤵
- Executes dropped EXE
PID:2196 -
\??\c:\vjljtx.exec:\vjljtx.exe26⤵
- Executes dropped EXE
PID:1660 -
\??\c:\phxnbv.exec:\phxnbv.exe27⤵
- Executes dropped EXE
PID:684 -
\??\c:\txpdvrr.exec:\txpdvrr.exe28⤵
- Executes dropped EXE
PID:1828 -
\??\c:\lblhxlb.exec:\lblhxlb.exe29⤵
- Executes dropped EXE
PID:620 -
\??\c:\fjddnx.exec:\fjddnx.exe30⤵
- Executes dropped EXE
PID:2336 -
\??\c:\jlvbhbn.exec:\jlvbhbn.exe31⤵
- Executes dropped EXE
PID:2168 -
\??\c:\ddfxp.exec:\ddfxp.exe32⤵
- Executes dropped EXE
PID:2752 -
\??\c:\lnjblr.exec:\lnjblr.exe33⤵
- Executes dropped EXE
PID:868 -
\??\c:\vtbvpfj.exec:\vtbvpfj.exe34⤵
- Executes dropped EXE
PID:2036 -
\??\c:\pbvbjb.exec:\pbvbjb.exe35⤵
- Executes dropped EXE
PID:3032 -
\??\c:\ttltlbb.exec:\ttltlbb.exe36⤵
- Executes dropped EXE
PID:2452 -
\??\c:\hjptbn.exec:\hjptbn.exe37⤵
- Executes dropped EXE
PID:3016 -
\??\c:\tdrnr.exec:\tdrnr.exe38⤵
- Executes dropped EXE
PID:2856 -
\??\c:\nddhxt.exec:\nddhxt.exe39⤵
- Executes dropped EXE
PID:2616 -
\??\c:\rnhff.exec:\rnhff.exe40⤵
- Executes dropped EXE
PID:2572 -
\??\c:\bfnjjt.exec:\bfnjjt.exe41⤵
- Executes dropped EXE
PID:2596 -
\??\c:\jprbjj.exec:\jprbjj.exe42⤵
- Executes dropped EXE
PID:2592 -
\??\c:\tfxtld.exec:\tfxtld.exe43⤵
- Executes dropped EXE
PID:2428 -
\??\c:\hfhph.exec:\hfhph.exe44⤵
- Executes dropped EXE
PID:2556 -
\??\c:\lhhrdlh.exec:\lhhrdlh.exe45⤵
- Executes dropped EXE
PID:2384 -
\??\c:\xdfpf.exec:\xdfpf.exe46⤵
- Executes dropped EXE
PID:800 -
\??\c:\fjxpnpp.exec:\fjxpnpp.exe47⤵
- Executes dropped EXE
PID:588 -
\??\c:\jhndll.exec:\jhndll.exe48⤵
- Executes dropped EXE
PID:2180 -
\??\c:\rhjhlx.exec:\rhjhlx.exe49⤵
- Executes dropped EXE
PID:1500 -
\??\c:\jlpfp.exec:\jlpfp.exe50⤵
- Executes dropped EXE
PID:1196 -
\??\c:\fxxlxrr.exec:\fxxlxrr.exe51⤵
- Executes dropped EXE
PID:2280 -
\??\c:\ntvpbpr.exec:\ntvpbpr.exe52⤵
- Executes dropped EXE
PID:2296 -
\??\c:\dldnlx.exec:\dldnlx.exe53⤵
- Executes dropped EXE
PID:1936 -
\??\c:\vbhpvvv.exec:\vbhpvvv.exe54⤵
- Executes dropped EXE
PID:784 -
\??\c:\fnrnj.exec:\fnrnj.exe55⤵
- Executes dropped EXE
PID:1952 -
\??\c:\xpvnpd.exec:\xpvnpd.exe56⤵
- Executes dropped EXE
PID:2896 -
\??\c:\jfftjn.exec:\jfftjn.exe57⤵
- Executes dropped EXE
PID:1492 -
\??\c:\hdpnr.exec:\hdpnr.exe58⤵
- Executes dropped EXE
PID:1520 -
\??\c:\lhxlfhj.exec:\lhxlfhj.exe59⤵
- Executes dropped EXE
PID:1860 -
\??\c:\xfbjxlp.exec:\xfbjxlp.exe60⤵
- Executes dropped EXE
PID:608 -
\??\c:\xrbbrp.exec:\xrbbrp.exe61⤵
- Executes dropped EXE
PID:2060 -
\??\c:\xvdlx.exec:\xvdlx.exe62⤵
- Executes dropped EXE
PID:472 -
\??\c:\vfrbd.exec:\vfrbd.exe63⤵
- Executes dropped EXE
PID:672 -
\??\c:\nltxbtj.exec:\nltxbtj.exe64⤵
- Executes dropped EXE
PID:276 -
\??\c:\njfvtrd.exec:\njfvtrd.exe65⤵
- Executes dropped EXE
PID:3056 -
\??\c:\xfvdj.exec:\xfvdj.exe66⤵PID:1988
-
\??\c:\tjxpp.exec:\tjxpp.exe67⤵PID:928
-
\??\c:\rvdtff.exec:\rvdtff.exe68⤵PID:1308
-
\??\c:\jvrpvnd.exec:\jvrpvnd.exe69⤵PID:1072
-
\??\c:\xbplr.exec:\xbplr.exe70⤵PID:1068
-
\??\c:\npnhrll.exec:\npnhrll.exe71⤵PID:2908
-
\??\c:\tnhph.exec:\tnhph.exe72⤵PID:620
-
\??\c:\thdjtx.exec:\thdjtx.exe73⤵PID:616
-
\??\c:\rjvvf.exec:\rjvvf.exe74⤵PID:2212
-
\??\c:\lbvjbbd.exec:\lbvjbbd.exe75⤵PID:748
-
\??\c:\nbfjpjv.exec:\nbfjpjv.exe76⤵PID:1292
-
\??\c:\bnhdr.exec:\bnhdr.exe77⤵PID:2096
-
\??\c:\njlnbdf.exec:\njlnbdf.exe78⤵PID:2036
-
\??\c:\nfdhbp.exec:\nfdhbp.exe79⤵PID:3032
-
\??\c:\lhjnnl.exec:\lhjnnl.exe80⤵PID:2452
-
\??\c:\bdbfpfn.exec:\bdbfpfn.exe81⤵PID:3016
-
\??\c:\dvhnhf.exec:\dvhnhf.exe82⤵PID:2856
-
\??\c:\rlnhh.exec:\rlnhh.exe83⤵PID:2644
-
\??\c:\btbxtnj.exec:\btbxtnj.exe84⤵PID:2572
-
\??\c:\lprbf.exec:\lprbf.exe85⤵PID:2624
-
\??\c:\tvvxlb.exec:\tvvxlb.exe86⤵PID:2592
-
\??\c:\lrtpnrj.exec:\lrtpnrj.exe87⤵PID:1696
-
\??\c:\pvdhvj.exec:\pvdhvj.exe88⤵PID:2556
-
\??\c:\xxtrr.exec:\xxtrr.exe89⤵PID:2784
-
\??\c:\nbhfbfh.exec:\nbhfbfh.exe90⤵PID:800
-
\??\c:\rjpjvrb.exec:\rjpjvrb.exe91⤵PID:588
-
\??\c:\fftjv.exec:\fftjv.exe92⤵PID:2440
-
\??\c:\pnnphrv.exec:\pnnphrv.exe93⤵PID:2696
-
\??\c:\hjjxjjp.exec:\hjjxjjp.exe94⤵PID:2672
-
\??\c:\jjjttp.exec:\jjjttp.exe95⤵PID:2280
-
\??\c:\jpbhb.exec:\jpbhb.exe96⤵PID:1972
-
\??\c:\jtxdtv.exec:\jtxdtv.exe97⤵PID:1848
-
\??\c:\lvbtrn.exec:\lvbtrn.exe98⤵PID:784
-
\??\c:\blvfxr.exec:\blvfxr.exe99⤵PID:1656
-
\??\c:\htrbvvj.exec:\htrbvvj.exe100⤵PID:1680
-
\??\c:\hdhvx.exec:\hdhvx.exe101⤵PID:1492
-
\??\c:\hxxbxdp.exec:\hxxbxdp.exe102⤵PID:1396
-
\??\c:\bppjn.exec:\bppjn.exe103⤵PID:2016
-
\??\c:\bdfbvhb.exec:\bdfbvhb.exe104⤵PID:608
-
\??\c:\xpbbtp.exec:\xpbbtp.exe105⤵PID:2060
-
\??\c:\jhltbv.exec:\jhltbv.exe106⤵PID:1436
-
\??\c:\vttlv.exec:\vttlv.exe107⤵PID:1752
-
\??\c:\jvjrd.exec:\jvjrd.exe108⤵PID:2188
-
\??\c:\bhppvb.exec:\bhppvb.exe109⤵PID:1844
-
\??\c:\bjvxf.exec:\bjvxf.exe110⤵PID:2196
-
\??\c:\jvbvtf.exec:\jvbvtf.exe111⤵PID:928
-
\??\c:\jjflhdr.exec:\jjflhdr.exe112⤵PID:1924
-
\??\c:\vbrvlx.exec:\vbrvlx.exe113⤵PID:1868
-
\??\c:\jlnxtfj.exec:\jlnxtfj.exe114⤵PID:740
-
\??\c:\xddhxnh.exec:\xddhxnh.exe115⤵PID:2924
-
\??\c:\pdrvpj.exec:\pdrvpj.exe116⤵PID:2708
-
\??\c:\fdttdv.exec:\fdttdv.exe117⤵PID:2740
-
\??\c:\dtnbvr.exec:\dtnbvr.exe118⤵PID:1304
-
\??\c:\lldpjh.exec:\lldpjh.exe119⤵PID:2832
-
\??\c:\jblfblb.exec:\jblfblb.exe120⤵PID:1164
-
\??\c:\ndfjj.exec:\ndfjj.exe121⤵PID:3040
-
\??\c:\ddtfjtr.exec:\ddtfjtr.exe122⤵PID:1572
-
\??\c:\fpxnxh.exec:\fpxnxh.exe123⤵PID:3028
-
\??\c:\jrhvnnl.exec:\jrhvnnl.exe124⤵PID:2524
-
\??\c:\djhlpnp.exec:\djhlpnp.exe125⤵PID:2576
-
\??\c:\fpjrlv.exec:\fpjrlv.exe126⤵PID:3016
-
\??\c:\tblrfd.exec:\tblrfd.exe127⤵PID:3048
-
\??\c:\tljrvb.exec:\tljrvb.exe128⤵PID:2544
-
\??\c:\ptffx.exec:\ptffx.exe129⤵PID:2536
-
\??\c:\bnppnhb.exec:\bnppnhb.exe130⤵PID:2444
-
\??\c:\hxbbtr.exec:\hxbbtr.exe131⤵PID:2376
-
\??\c:\rlvxhhh.exec:\rlvxhhh.exe132⤵PID:1016
-
\??\c:\ldtphfr.exec:\ldtphfr.exe133⤵PID:1468
-
\??\c:\xtfvjn.exec:\xtfvjn.exe134⤵PID:1864
-
\??\c:\jbhfthx.exec:\jbhfthx.exe135⤵PID:940
-
\??\c:\hbvlpd.exec:\hbvlpd.exe136⤵PID:2608
-
\??\c:\dnvbldx.exec:\dnvbldx.exe137⤵PID:2440
-
\??\c:\pfrtt.exec:\pfrtt.exe138⤵PID:2768
-
\??\c:\jxtrh.exec:\jxtrh.exe139⤵PID:1948
-
\??\c:\bfhhx.exec:\bfhhx.exe140⤵PID:2280
-
\??\c:\ltrvjln.exec:\ltrvjln.exe141⤵PID:2312
-
\??\c:\jnpjv.exec:\jnpjv.exe142⤵PID:1664
-
\??\c:\jplvr.exec:\jplvr.exe143⤵PID:1676
-
\??\c:\rpddb.exec:\rpddb.exe144⤵PID:1656
-
\??\c:\fttbrh.exec:\fttbrh.exe145⤵PID:1252
-
\??\c:\bllrrx.exec:\bllrrx.exe146⤵PID:1808
-
\??\c:\xlfxndx.exec:\xlfxndx.exe147⤵PID:2044
-
\??\c:\fnvtnvj.exec:\fnvtnvj.exe148⤵PID:2932
-
\??\c:\hxfhl.exec:\hxfhl.exe149⤵PID:2928
-
\??\c:\fhpdddl.exec:\fhpdddl.exe150⤵PID:1060
-
\??\c:\llxbrhx.exec:\llxbrhx.exe151⤵PID:2008
-
\??\c:\vrttn.exec:\vrttn.exe152⤵PID:1140
-
\??\c:\lbdrnr.exec:\lbdrnr.exe153⤵PID:1984
-
\??\c:\hnrrxhh.exec:\hnrrxhh.exe154⤵PID:1844
-
\??\c:\rfxbtj.exec:\rfxbtj.exe155⤵PID:2304
-
\??\c:\ffltjv.exec:\ffltjv.exe156⤵PID:1700
-
\??\c:\vxdnnv.exec:\vxdnnv.exe157⤵PID:1092
-
\??\c:\vhllh.exec:\vhllh.exe158⤵PID:1096
-
\??\c:\pjdjnj.exec:\pjdjnj.exe159⤵PID:624
-
\??\c:\rdxln.exec:\rdxln.exe160⤵PID:1916
-
\??\c:\njvdb.exec:\njvdb.exe161⤵PID:2088
-
\??\c:\drfjv.exec:\drfjv.exe162⤵PID:1632
-
\??\c:\nndflnx.exec:\nndflnx.exe163⤵PID:1504
-
\??\c:\tvjjldn.exec:\tvjjldn.exe164⤵PID:868
-
\??\c:\hlfrxf.exec:\hlfrxf.exe165⤵PID:1592
-
\??\c:\hrpdnbh.exec:\hrpdnbh.exe166⤵PID:3024
-
\??\c:\bptdfx.exec:\bptdfx.exe167⤵PID:1600
-
\??\c:\jplvpdh.exec:\jplvpdh.exe168⤵PID:2604
-
\??\c:\fjvlbtx.exec:\fjvlbtx.exe169⤵PID:2532
-
\??\c:\xvxnj.exec:\xvxnj.exe170⤵PID:2856
-
\??\c:\ffbjptb.exec:\ffbjptb.exe171⤵PID:2644
-
\??\c:\trfhtrh.exec:\trfhtrh.exe172⤵PID:2572
-
\??\c:\rtjfpp.exec:\rtjfpp.exe173⤵PID:2596
-
\??\c:\rhdpjfr.exec:\rhdpjfr.exe174⤵PID:2952
-
\??\c:\jbldfbh.exec:\jbldfbh.exe175⤵PID:1696
-
\??\c:\drfjd.exec:\drfjd.exe176⤵PID:2384
-
\??\c:\xddxvtb.exec:\xddxvtb.exe177⤵PID:280
-
\??\c:\dbrffx.exec:\dbrffx.exe178⤵PID:1200
-
\??\c:\xdvnnlr.exec:\xdvnnlr.exe179⤵PID:2640
-
\??\c:\lrjxnpd.exec:\lrjxnpd.exe180⤵PID:2632
-
\??\c:\rjbxn.exec:\rjbxn.exe181⤵PID:1336
-
\??\c:\pbjnhrl.exec:\pbjnhrl.exe182⤵PID:1940
-
\??\c:\fvflj.exec:\fvflj.exe183⤵PID:752
-
\??\c:\jfnxtr.exec:\jfnxtr.exe184⤵PID:1944
-
\??\c:\ttfdptn.exec:\ttfdptn.exe185⤵PID:1248
-
\??\c:\ldvvpx.exec:\ldvvpx.exe186⤵PID:1608
-
\??\c:\dtfxflf.exec:\dtfxflf.exe187⤵PID:1516
-
\??\c:\nfppn.exec:\nfppn.exe188⤵PID:2332
-
\??\c:\vrrfrrr.exec:\vrrfrrr.exe189⤵PID:2972
-
\??\c:\pnrrn.exec:\pnrrn.exe190⤵PID:2232
-
\??\c:\rfnhldp.exec:\rfnhldp.exe191⤵PID:2736
-
\??\c:\nbbjl.exec:\nbbjl.exe192⤵PID:2132
-
\??\c:\rfnvj.exec:\rfnvj.exe193⤵PID:2060
-
\??\c:\bhbrl.exec:\bhbrl.exe194⤵PID:2988
-
\??\c:\prbnjv.exec:\prbnjv.exe195⤵PID:2112
-
\??\c:\nhpbhjj.exec:\nhpbhjj.exe196⤵PID:1720
-
\??\c:\xvbhvvr.exec:\xvbhvvr.exe197⤵PID:972
-
\??\c:\rxdvhj.exec:\rxdvhj.exe198⤵PID:1544
-
\??\c:\jjnllj.exec:\jjnllj.exe199⤵PID:2948
-
\??\c:\vlbnrpx.exec:\vlbnrpx.exe200⤵PID:1924
-
\??\c:\nxfthfn.exec:\nxfthfn.exe201⤵PID:892
-
\??\c:\hprhltj.exec:\hprhltj.exe202⤵PID:1084
-
\??\c:\lnxfbx.exec:\lnxfbx.exe203⤵PID:2024
-
\??\c:\frpdbtf.exec:\frpdbtf.exe204⤵PID:1816
-
\??\c:\xjjbb.exec:\xjjbb.exe205⤵PID:2740
-
\??\c:\dlnlbp.exec:\dlnlbp.exe206⤵PID:1304
-
\??\c:\xrtnbpf.exec:\xrtnbpf.exe207⤵PID:3004
-
\??\c:\rjpbfn.exec:\rjpbfn.exe208⤵PID:2888
-
\??\c:\dnllj.exec:\dnllj.exe209⤵PID:868
-
\??\c:\vhdfxr.exec:\vhdfxr.exe210⤵PID:2920
-
\??\c:\dbxpxjp.exec:\dbxpxjp.exe211⤵PID:3024
-
\??\c:\jptnl.exec:\jptnl.exe212⤵PID:2516
-
\??\c:\tdttxt.exec:\tdttxt.exe213⤵PID:2380
-
\??\c:\nxhfpd.exec:\nxhfpd.exe214⤵PID:2476
-
\??\c:\lbrbvpx.exec:\lbrbvpx.exe215⤵PID:2408
-
\??\c:\bbrvjxb.exec:\bbrvjxb.exe216⤵PID:2560
-
\??\c:\xnntf.exec:\xnntf.exe217⤵PID:2836
-
\??\c:\frrfld.exec:\frrfld.exe218⤵PID:2800
-
\??\c:\tnfxbt.exec:\tnfxbt.exe219⤵PID:2376
-
\??\c:\xrjdx.exec:\xrjdx.exe220⤵PID:1112
-
\??\c:\dbvhnb.exec:\dbvhnb.exe221⤵PID:1644
-
\??\c:\rrjnp.exec:\rrjnp.exe222⤵PID:1864
-
\??\c:\fljrprj.exec:\fljrprj.exe223⤵PID:1200
-
\??\c:\vtbvtl.exec:\vtbvtl.exe224⤵PID:2640
-
\??\c:\trbfb.exec:\trbfb.exe225⤵PID:2440
-
\??\c:\jjpppf.exec:\jjpppf.exe226⤵PID:1336
-
\??\c:\fdbpj.exec:\fdbpj.exe227⤵PID:1980
-
\??\c:\pjnlxbh.exec:\pjnlxbh.exe228⤵PID:2280
-
\??\c:\dvhpfpn.exec:\dvhpfpn.exe229⤵PID:1972
-
\??\c:\vhdjdh.exec:\vhdjdh.exe230⤵PID:872
-
\??\c:\fpntbx.exec:\fpntbx.exe231⤵PID:784
-
\??\c:\rpbdd.exec:\rpbdd.exe232⤵PID:1576
-
\??\c:\lhbjhj.exec:\lhbjhj.exe233⤵PID:1680
-
\??\c:\trrbpdn.exec:\trrbpdn.exe234⤵PID:2972
-
\??\c:\ftjpfnb.exec:\ftjpfnb.exe235⤵PID:2232
-
\??\c:\tbjth.exec:\tbjth.exe236⤵PID:2744
-
\??\c:\vfvxh.exec:\vfvxh.exe237⤵PID:2132
-
\??\c:\tdjbpr.exec:\tdjbpr.exe238⤵PID:2060
-
\??\c:\bnxxt.exec:\bnxxt.exe239⤵PID:2988
-
\??\c:\tnxpdnx.exec:\tnxpdnx.exe240⤵PID:1368
-
\??\c:\pfhvb.exec:\pfhvb.exe241⤵PID:2188
-
\??\c:\jfpbf.exec:\jfpbf.exe242⤵PID:1104