Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 13:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
516dfbd0eddc02ecafcec50af6ccee4204afa9e0e29db79c70f83ff9f2e4f43e_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
516dfbd0eddc02ecafcec50af6ccee4204afa9e0e29db79c70f83ff9f2e4f43e_NeikiAnalytics.exe
-
Size
130KB
-
MD5
272dfb049c9fe4fa9c0d382c14bc5e00
-
SHA1
b9542b1d2e2dc2521387f84bf28b0e3a9670ab78
-
SHA256
516dfbd0eddc02ecafcec50af6ccee4204afa9e0e29db79c70f83ff9f2e4f43e
-
SHA512
e3693ef4acad5ba6e273f0b3d95ca3940302ec94e2f56bc0b9203493e49b45035aafe4ab4b1313e1a3dcec775489f20a7e98371e0a180c72915739148079d924
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afoHVpx+dGoXVS:n3C9BRW0j/1px+dG4VS
Malware Config
Signatures
-
Detect Blackmoon payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/2304-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2416-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2404-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1884-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1992-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1176-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2064-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1404-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1788-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1660-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
fvnjhv.exetpxdhnt.exehvhjhfv.exexttfxv.exefnjlhl.exejhnbvl.exenftvlxh.exevdbhpfd.exetdldnrt.exebtdfrvf.exejvhvp.exenhxdjn.exepnjjdv.exerntjx.exepththv.exervdrl.exetfhvtfd.exedlrtfb.exevfbdjjv.exepfblr.exednvtl.exehfjlxj.exebvvxndt.exebttpd.exertlrjrj.exevfxjj.exerbhbr.exenfbxprv.exefvbdlh.exetrldbl.exervdxt.exepbrpn.exexnjlt.exefjvhvtb.exelbjdnj.exejnfjhp.exeljjlf.exepdbbf.exexdrjvnp.exehjjfh.exeftfnhtt.exenfrfjx.exepjxfnf.exeljlrxtt.exenvrftxl.exepflfjn.exexrvvr.exevjtrpnv.exefpxvj.exejfvnv.exetvnnp.exefpptxv.exeljvrnx.exexhxxt.exexdxfbr.exebjtdlnh.exentxftjn.exehxlprxn.exedhtpdl.exedjbdxb.exerxjprf.exethhxn.exepfxdbj.exedpnjxn.exepid process 2416 fvnjhv.exe 2620 tpxdhnt.exe 2528 hvhjhfv.exe 2436 xttfxv.exe 2580 fnjlhl.exe 2596 jhnbvl.exe 2380 nftvlxh.exe 2404 vdbhpfd.exe 1884 tdldnrt.exe 1372 btdfrvf.exe 2684 jvhvp.exe 2832 nhxdjn.exe 2584 pnjjdv.exe 1992 rntjx.exe 1688 pththv.exe 2392 rvdrl.exe 2656 tfhvtfd.exe 1176 dlrtfb.exe 1720 vfbdjjv.exe 2064 pfblr.exe 336 dnvtl.exe 524 hfjlxj.exe 1404 bvvxndt.exe 1576 bttpd.exe 1788 rtlrjrj.exe 1536 vfxjj.exe 1828 rbhbr.exe 1832 nfbxprv.exe 980 fvbdlh.exe 2112 trldbl.exe 1660 rvdxt.exe 1556 pbrpn.exe 1204 xnjlt.exe 1608 fjvhvtb.exe 1596 lbjdnj.exe 2144 jnfjhp.exe 2956 ljjlf.exe 2540 pdbbf.exe 2440 xdrjvnp.exe 2472 hjjfh.exe 2228 ftfnhtt.exe 2448 nfrfjx.exe 2336 pjxfnf.exe 2012 ljlrxtt.exe 2804 nvrftxl.exe 1236 pflfjn.exe 564 xrvvr.exe 1904 vjtrpnv.exe 2812 fpxvj.exe 2372 jfvnv.exe 2832 tvnnp.exe 1888 fpptxv.exe 1088 ljvrnx.exe 1540 xhxxt.exe 2632 xdxfbr.exe 1896 bjtdlnh.exe 2628 ntxftjn.exe 2272 hxlprxn.exe 1996 dhtpdl.exe 780 djbdxb.exe 2724 rxjprf.exe 336 thhxn.exe 2084 pfxdbj.exe 3068 dpnjxn.exe -
Processes:
resource yara_rule behavioral1/memory/2304-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2404-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1884-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1992-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1176-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1404-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1788-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-298-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
516dfbd0eddc02ecafcec50af6ccee4204afa9e0e29db79c70f83ff9f2e4f43e_NeikiAnalytics.exefvnjhv.exetpxdhnt.exehvhjhfv.exexttfxv.exefnjlhl.exejhnbvl.exenftvlxh.exevdbhpfd.exetdldnrt.exebtdfrvf.exejvhvp.exenhxdjn.exepnjjdv.exerntjx.exepththv.exedescription pid process target process PID 2304 wrote to memory of 2416 2304 516dfbd0eddc02ecafcec50af6ccee4204afa9e0e29db79c70f83ff9f2e4f43e_NeikiAnalytics.exe fvnjhv.exe PID 2304 wrote to memory of 2416 2304 516dfbd0eddc02ecafcec50af6ccee4204afa9e0e29db79c70f83ff9f2e4f43e_NeikiAnalytics.exe fvnjhv.exe PID 2304 wrote to memory of 2416 2304 516dfbd0eddc02ecafcec50af6ccee4204afa9e0e29db79c70f83ff9f2e4f43e_NeikiAnalytics.exe fvnjhv.exe PID 2304 wrote to memory of 2416 2304 516dfbd0eddc02ecafcec50af6ccee4204afa9e0e29db79c70f83ff9f2e4f43e_NeikiAnalytics.exe fvnjhv.exe PID 2416 wrote to memory of 2620 2416 fvnjhv.exe tpxdhnt.exe PID 2416 wrote to memory of 2620 2416 fvnjhv.exe tpxdhnt.exe PID 2416 wrote to memory of 2620 2416 fvnjhv.exe tpxdhnt.exe PID 2416 wrote to memory of 2620 2416 fvnjhv.exe tpxdhnt.exe PID 2620 wrote to memory of 2528 2620 tpxdhnt.exe hvhjhfv.exe PID 2620 wrote to memory of 2528 2620 tpxdhnt.exe hvhjhfv.exe PID 2620 wrote to memory of 2528 2620 tpxdhnt.exe hvhjhfv.exe PID 2620 wrote to memory of 2528 2620 tpxdhnt.exe hvhjhfv.exe PID 2528 wrote to memory of 2436 2528 hvhjhfv.exe xttfxv.exe PID 2528 wrote to memory of 2436 2528 hvhjhfv.exe xttfxv.exe PID 2528 wrote to memory of 2436 2528 hvhjhfv.exe xttfxv.exe PID 2528 wrote to memory of 2436 2528 hvhjhfv.exe xttfxv.exe PID 2436 wrote to memory of 2580 2436 xttfxv.exe fnjlhl.exe PID 2436 wrote to memory of 2580 2436 xttfxv.exe fnjlhl.exe PID 2436 wrote to memory of 2580 2436 xttfxv.exe fnjlhl.exe PID 2436 wrote to memory of 2580 2436 xttfxv.exe fnjlhl.exe PID 2580 wrote to memory of 2596 2580 fnjlhl.exe jhnbvl.exe PID 2580 wrote to memory of 2596 2580 fnjlhl.exe jhnbvl.exe PID 2580 wrote to memory of 2596 2580 fnjlhl.exe jhnbvl.exe PID 2580 wrote to memory of 2596 2580 fnjlhl.exe jhnbvl.exe PID 2596 wrote to memory of 2380 2596 jhnbvl.exe nftvlxh.exe PID 2596 wrote to memory of 2380 2596 jhnbvl.exe nftvlxh.exe PID 2596 wrote to memory of 2380 2596 jhnbvl.exe nftvlxh.exe PID 2596 wrote to memory of 2380 2596 jhnbvl.exe nftvlxh.exe PID 2380 wrote to memory of 2404 2380 nftvlxh.exe vdbhpfd.exe PID 2380 wrote to memory of 2404 2380 nftvlxh.exe vdbhpfd.exe PID 2380 wrote to memory of 2404 2380 nftvlxh.exe vdbhpfd.exe PID 2380 wrote to memory of 2404 2380 nftvlxh.exe vdbhpfd.exe PID 2404 wrote to memory of 1884 2404 vdbhpfd.exe tdldnrt.exe PID 2404 wrote to memory of 1884 2404 vdbhpfd.exe tdldnrt.exe PID 2404 wrote to memory of 1884 2404 vdbhpfd.exe tdldnrt.exe PID 2404 wrote to memory of 1884 2404 vdbhpfd.exe tdldnrt.exe PID 1884 wrote to memory of 1372 1884 tdldnrt.exe btdfrvf.exe PID 1884 wrote to memory of 1372 1884 tdldnrt.exe btdfrvf.exe PID 1884 wrote to memory of 1372 1884 tdldnrt.exe btdfrvf.exe PID 1884 wrote to memory of 1372 1884 tdldnrt.exe btdfrvf.exe PID 1372 wrote to memory of 2684 1372 btdfrvf.exe jvhvp.exe PID 1372 wrote to memory of 2684 1372 btdfrvf.exe jvhvp.exe PID 1372 wrote to memory of 2684 1372 btdfrvf.exe jvhvp.exe PID 1372 wrote to memory of 2684 1372 btdfrvf.exe jvhvp.exe PID 2684 wrote to memory of 2832 2684 jvhvp.exe nhxdjn.exe PID 2684 wrote to memory of 2832 2684 jvhvp.exe nhxdjn.exe PID 2684 wrote to memory of 2832 2684 jvhvp.exe nhxdjn.exe PID 2684 wrote to memory of 2832 2684 jvhvp.exe nhxdjn.exe PID 2832 wrote to memory of 2584 2832 nhxdjn.exe pnjjdv.exe PID 2832 wrote to memory of 2584 2832 nhxdjn.exe pnjjdv.exe PID 2832 wrote to memory of 2584 2832 nhxdjn.exe pnjjdv.exe PID 2832 wrote to memory of 2584 2832 nhxdjn.exe pnjjdv.exe PID 2584 wrote to memory of 1992 2584 pnjjdv.exe rntjx.exe PID 2584 wrote to memory of 1992 2584 pnjjdv.exe rntjx.exe PID 2584 wrote to memory of 1992 2584 pnjjdv.exe rntjx.exe PID 2584 wrote to memory of 1992 2584 pnjjdv.exe rntjx.exe PID 1992 wrote to memory of 1688 1992 rntjx.exe pththv.exe PID 1992 wrote to memory of 1688 1992 rntjx.exe pththv.exe PID 1992 wrote to memory of 1688 1992 rntjx.exe pththv.exe PID 1992 wrote to memory of 1688 1992 rntjx.exe pththv.exe PID 1688 wrote to memory of 2392 1688 pththv.exe rvdrl.exe PID 1688 wrote to memory of 2392 1688 pththv.exe rvdrl.exe PID 1688 wrote to memory of 2392 1688 pththv.exe rvdrl.exe PID 1688 wrote to memory of 2392 1688 pththv.exe rvdrl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\516dfbd0eddc02ecafcec50af6ccee4204afa9e0e29db79c70f83ff9f2e4f43e_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\516dfbd0eddc02ecafcec50af6ccee4204afa9e0e29db79c70f83ff9f2e4f43e_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\fvnjhv.exec:\fvnjhv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\tpxdhnt.exec:\tpxdhnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\hvhjhfv.exec:\hvhjhfv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\xttfxv.exec:\xttfxv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\fnjlhl.exec:\fnjlhl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\jhnbvl.exec:\jhnbvl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\nftvlxh.exec:\nftvlxh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\vdbhpfd.exec:\vdbhpfd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\tdldnrt.exec:\tdldnrt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\btdfrvf.exec:\btdfrvf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\jvhvp.exec:\jvhvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\nhxdjn.exec:\nhxdjn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\pnjjdv.exec:\pnjjdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\rntjx.exec:\rntjx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\pththv.exec:\pththv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\rvdrl.exec:\rvdrl.exe17⤵
- Executes dropped EXE
PID:2392 -
\??\c:\tfhvtfd.exec:\tfhvtfd.exe18⤵
- Executes dropped EXE
PID:2656 -
\??\c:\dlrtfb.exec:\dlrtfb.exe19⤵
- Executes dropped EXE
PID:1176 -
\??\c:\vfbdjjv.exec:\vfbdjjv.exe20⤵
- Executes dropped EXE
PID:1720 -
\??\c:\pfblr.exec:\pfblr.exe21⤵
- Executes dropped EXE
PID:2064 -
\??\c:\dnvtl.exec:\dnvtl.exe22⤵
- Executes dropped EXE
PID:336 -
\??\c:\hfjlxj.exec:\hfjlxj.exe23⤵
- Executes dropped EXE
PID:524 -
\??\c:\bvvxndt.exec:\bvvxndt.exe24⤵
- Executes dropped EXE
PID:1404 -
\??\c:\bttpd.exec:\bttpd.exe25⤵
- Executes dropped EXE
PID:1576 -
\??\c:\rtlrjrj.exec:\rtlrjrj.exe26⤵
- Executes dropped EXE
PID:1788 -
\??\c:\vfxjj.exec:\vfxjj.exe27⤵
- Executes dropped EXE
PID:1536 -
\??\c:\rbhbr.exec:\rbhbr.exe28⤵
- Executes dropped EXE
PID:1828 -
\??\c:\nfbxprv.exec:\nfbxprv.exe29⤵
- Executes dropped EXE
PID:1832 -
\??\c:\fvbdlh.exec:\fvbdlh.exe30⤵
- Executes dropped EXE
PID:980 -
\??\c:\trldbl.exec:\trldbl.exe31⤵
- Executes dropped EXE
PID:2112 -
\??\c:\rvdxt.exec:\rvdxt.exe32⤵
- Executes dropped EXE
PID:1660 -
\??\c:\pbrpn.exec:\pbrpn.exe33⤵
- Executes dropped EXE
PID:1556 -
\??\c:\xnjlt.exec:\xnjlt.exe34⤵
- Executes dropped EXE
PID:1204 -
\??\c:\fjvhvtb.exec:\fjvhvtb.exe35⤵
- Executes dropped EXE
PID:1608 -
\??\c:\pnhbv.exec:\pnhbv.exe36⤵PID:2872
-
\??\c:\lbjdnj.exec:\lbjdnj.exe37⤵
- Executes dropped EXE
PID:1596 -
\??\c:\jnfjhp.exec:\jnfjhp.exe38⤵
- Executes dropped EXE
PID:2144 -
\??\c:\ljjlf.exec:\ljjlf.exe39⤵
- Executes dropped EXE
PID:2956 -
\??\c:\pdbbf.exec:\pdbbf.exe40⤵
- Executes dropped EXE
PID:2540 -
\??\c:\xdrjvnp.exec:\xdrjvnp.exe41⤵
- Executes dropped EXE
PID:2440 -
\??\c:\hjjfh.exec:\hjjfh.exe42⤵
- Executes dropped EXE
PID:2472 -
\??\c:\ftfnhtt.exec:\ftfnhtt.exe43⤵
- Executes dropped EXE
PID:2228 -
\??\c:\nfrfjx.exec:\nfrfjx.exe44⤵
- Executes dropped EXE
PID:2448 -
\??\c:\pjxfnf.exec:\pjxfnf.exe45⤵
- Executes dropped EXE
PID:2336 -
\??\c:\ljlrxtt.exec:\ljlrxtt.exe46⤵
- Executes dropped EXE
PID:2012 -
\??\c:\nvrftxl.exec:\nvrftxl.exe47⤵
- Executes dropped EXE
PID:2804 -
\??\c:\pflfjn.exec:\pflfjn.exe48⤵
- Executes dropped EXE
PID:1236 -
\??\c:\xrvvr.exec:\xrvvr.exe49⤵
- Executes dropped EXE
PID:564 -
\??\c:\vjtrpnv.exec:\vjtrpnv.exe50⤵
- Executes dropped EXE
PID:1904 -
\??\c:\fpxvj.exec:\fpxvj.exe51⤵
- Executes dropped EXE
PID:2812 -
\??\c:\jfvnv.exec:\jfvnv.exe52⤵
- Executes dropped EXE
PID:2372 -
\??\c:\tvnnp.exec:\tvnnp.exe53⤵
- Executes dropped EXE
PID:2832 -
\??\c:\fpptxv.exec:\fpptxv.exe54⤵
- Executes dropped EXE
PID:1888 -
\??\c:\ljvrnx.exec:\ljvrnx.exe55⤵
- Executes dropped EXE
PID:1088 -
\??\c:\xhxxt.exec:\xhxxt.exe56⤵
- Executes dropped EXE
PID:1540 -
\??\c:\xdxfbr.exec:\xdxfbr.exe57⤵
- Executes dropped EXE
PID:2632 -
\??\c:\bjtdlnh.exec:\bjtdlnh.exe58⤵
- Executes dropped EXE
PID:1896 -
\??\c:\ntxftjn.exec:\ntxftjn.exe59⤵
- Executes dropped EXE
PID:2628 -
\??\c:\hxlprxn.exec:\hxlprxn.exe60⤵
- Executes dropped EXE
PID:2272 -
\??\c:\dhtpdl.exec:\dhtpdl.exe61⤵
- Executes dropped EXE
PID:1996 -
\??\c:\djbdxb.exec:\djbdxb.exe62⤵
- Executes dropped EXE
PID:780 -
\??\c:\rxjprf.exec:\rxjprf.exe63⤵
- Executes dropped EXE
PID:2724 -
\??\c:\thhxn.exec:\thhxn.exe64⤵
- Executes dropped EXE
PID:336 -
\??\c:\pfxdbj.exec:\pfxdbj.exe65⤵
- Executes dropped EXE
PID:2084 -
\??\c:\dpnjxn.exec:\dpnjxn.exe66⤵
- Executes dropped EXE
PID:3068 -
\??\c:\fnxvf.exec:\fnxvf.exe67⤵PID:1048
-
\??\c:\vpvvfdd.exec:\vpvvfdd.exe68⤵PID:1092
-
\??\c:\nnllrdv.exec:\nnllrdv.exe69⤵PID:1488
-
\??\c:\rdxxb.exec:\rdxxb.exe70⤵PID:1536
-
\??\c:\dbjhtx.exec:\dbjhtx.exe71⤵PID:2024
-
\??\c:\ljxjjn.exec:\ljxjjn.exe72⤵PID:2284
-
\??\c:\bpjhnv.exec:\bpjhnv.exe73⤵PID:1616
-
\??\c:\lpntvh.exec:\lpntvh.exe74⤵PID:880
-
\??\c:\hhdbrvv.exec:\hhdbrvv.exe75⤵PID:2060
-
\??\c:\hnnvftb.exec:\hnnvftb.exe76⤵PID:1136
-
\??\c:\hlthh.exec:\hlthh.exe77⤵PID:1556
-
\??\c:\rjjltj.exec:\rjjltj.exe78⤵PID:868
-
\??\c:\llljj.exec:\llljj.exe79⤵PID:1608
-
\??\c:\jtbtvrx.exec:\jtbtvrx.exe80⤵PID:2704
-
\??\c:\rflxd.exec:\rflxd.exe81⤵PID:2180
-
\??\c:\dhlhfnr.exec:\dhlhfnr.exe82⤵PID:2968
-
\??\c:\tddtndn.exec:\tddtndn.exe83⤵PID:2556
-
\??\c:\bhhntdv.exec:\bhhntdv.exe84⤵PID:2716
-
\??\c:\jffbttr.exec:\jffbttr.exe85⤵PID:884
-
\??\c:\lpdnf.exec:\lpdnf.exe86⤵PID:2672
-
\??\c:\jvdxf.exec:\jvdxf.exe87⤵PID:2604
-
\??\c:\xxnlhlf.exec:\xxnlhlf.exe88⤵PID:2388
-
\??\c:\rftdx.exec:\rftdx.exe89⤵PID:2468
-
\??\c:\jflthpp.exec:\jflthpp.exe90⤵PID:2012
-
\??\c:\rfdtb.exec:\rfdtb.exe91⤵PID:556
-
\??\c:\xjbvrdr.exec:\xjbvrdr.exe92⤵PID:3052
-
\??\c:\rjfllnj.exec:\rjfllnj.exe93⤵PID:372
-
\??\c:\xjvjj.exec:\xjvjj.exe94⤵PID:1372
-
\??\c:\thlvptd.exec:\thlvptd.exe95⤵PID:2684
-
\??\c:\jbphh.exec:\jbphh.exe96⤵PID:1400
-
\??\c:\xhxppj.exec:\xhxppj.exe97⤵PID:1340
-
\??\c:\tvjjb.exec:\tvjjb.exe98⤵PID:1888
-
\??\c:\bbrbp.exec:\bbrbp.exe99⤵PID:1088
-
\??\c:\brdtfh.exec:\brdtfh.exe100⤵PID:2592
-
\??\c:\npbtp.exec:\npbtp.exe101⤵PID:2632
-
\??\c:\vbdjpbn.exec:\vbdjpbn.exe102⤵PID:1388
-
\??\c:\jlrttxt.exec:\jlrttxt.exe103⤵PID:2308
-
\??\c:\vnnjj.exec:\vnnjj.exe104⤵PID:2628
-
\??\c:\ptfvj.exec:\ptfvj.exe105⤵PID:952
-
\??\c:\btrvndh.exec:\btrvndh.exe106⤵PID:2256
-
\??\c:\xvtvl.exec:\xvtvl.exe107⤵PID:780
-
\??\c:\nxftlrr.exec:\nxftlrr.exe108⤵PID:592
-
\??\c:\bnxxl.exec:\bnxxl.exe109⤵PID:336
-
\??\c:\jfhnnl.exec:\jfhnnl.exe110⤵PID:2084
-
\??\c:\tpffd.exec:\tpffd.exe111⤵PID:3068
-
\??\c:\rtbxtnb.exec:\rtbxtnb.exe112⤵PID:1048
-
\??\c:\npfrljl.exec:\npfrljl.exe113⤵PID:1092
-
\??\c:\fbpvp.exec:\fbpvp.exe114⤵PID:3016
-
\??\c:\ddvvlf.exec:\ddvvlf.exe115⤵PID:1536
-
\??\c:\plflbj.exec:\plflbj.exe116⤵PID:2024
-
\??\c:\bjjrj.exec:\bjjrj.exe117⤵PID:2284
-
\??\c:\jjrxjd.exec:\jjrxjd.exe118⤵PID:1616
-
\??\c:\hpvvdbp.exec:\hpvvdbp.exe119⤵PID:880
-
\??\c:\jjlvfn.exec:\jjlvfn.exe120⤵PID:2060
-
\??\c:\pxtvj.exec:\pxtvj.exe121⤵PID:1136
-
\??\c:\lhddfr.exec:\lhddfr.exe122⤵PID:1556
-
\??\c:\tbddrfp.exec:\tbddrfp.exe123⤵PID:868
-
\??\c:\plpbldd.exec:\plpbldd.exe124⤵PID:2872
-
\??\c:\hxfvbr.exec:\hxfvbr.exe125⤵PID:2616
-
\??\c:\rntvnft.exec:\rntvnft.exe126⤵PID:2620
-
\??\c:\bxjdpld.exec:\bxjdpld.exe127⤵PID:2956
-
\??\c:\pfdfn.exec:\pfdfn.exe128⤵PID:2572
-
\??\c:\bbfbf.exec:\bbfbf.exe129⤵PID:2340
-
\??\c:\lbnnj.exec:\lbnnj.exe130⤵PID:2356
-
\??\c:\jnndrt.exec:\jnndrt.exe131⤵PID:2504
-
\??\c:\fvnrvr.exec:\fvnrvr.exe132⤵PID:2348
-
\??\c:\hxrllvj.exec:\hxrllvj.exe133⤵PID:2444
-
\??\c:\jllpdhb.exec:\jllpdhb.exe134⤵PID:2408
-
\??\c:\hbxvjb.exec:\hbxvjb.exe135⤵PID:1172
-
\??\c:\lfdhvx.exec:\lfdhvx.exe136⤵PID:840
-
\??\c:\djttx.exec:\djttx.exe137⤵PID:2700
-
\??\c:\pfndbbr.exec:\pfndbbr.exe138⤵PID:2812
-
\??\c:\hfhlxhv.exec:\hfhlxhv.exe139⤵PID:1628
-
\??\c:\vvhfxxd.exec:\vvhfxxd.exe140⤵PID:2832
-
\??\c:\ddvptfn.exec:\ddvptfn.exe141⤵PID:2220
-
\??\c:\pxvnjnv.exec:\pxvnjnv.exe142⤵PID:1644
-
\??\c:\rfbjpr.exec:\rfbjpr.exe143⤵PID:2400
-
\??\c:\jvhxhv.exec:\jvhxhv.exe144⤵PID:1640
-
\??\c:\fxtthvt.exec:\fxtthvt.exe145⤵PID:1164
-
\??\c:\bddnth.exec:\bddnth.exe146⤵PID:2964
-
\??\c:\vhnfd.exec:\vhnfd.exe147⤵PID:1772
-
\??\c:\lbdrlb.exec:\lbdrlb.exe148⤵PID:2248
-
\??\c:\hlrpd.exec:\hlrpd.exe149⤵PID:1720
-
\??\c:\phnxxx.exec:\phnxxx.exe150⤵PID:2124
-
\??\c:\brnxvpp.exec:\brnxvpp.exe151⤵PID:1568
-
\??\c:\pbvrdfx.exec:\pbvrdfx.exe152⤵PID:1472
-
\??\c:\ntdjt.exec:\ntdjt.exe153⤵PID:1080
-
\??\c:\tvpbf.exec:\tvpbf.exe154⤵PID:1316
-
\??\c:\vvfpvhr.exec:\vvfpvhr.exe155⤵PID:2192
-
\??\c:\hdvhrbv.exec:\hdvhrbv.exe156⤵PID:1180
-
\??\c:\jjdrbvr.exec:\jjdrbvr.exe157⤵PID:460
-
\??\c:\trvbbj.exec:\trvbbj.exe158⤵PID:2040
-
\??\c:\hftfbnf.exec:\hftfbnf.exe159⤵PID:1068
-
\??\c:\fbftb.exec:\fbftb.exe160⤵PID:1484
-
\??\c:\njrjrjf.exec:\njrjrjf.exe161⤵PID:2976
-
\??\c:\rjpjvp.exec:\rjpjvp.exe162⤵PID:1384
-
\??\c:\vvfftb.exec:\vvfftb.exe163⤵PID:708
-
\??\c:\lnxnt.exec:\lnxnt.exe164⤵PID:1572
-
\??\c:\bhjbxpf.exec:\bhjbxpf.exe165⤵PID:1684
-
\??\c:\txntfjr.exec:\txntfjr.exe166⤵PID:2168
-
\??\c:\prdbflf.exec:\prdbflf.exe167⤵PID:2868
-
\??\c:\njxld.exec:\njxld.exe168⤵PID:1584
-
\??\c:\tpvlf.exec:\tpvlf.exe169⤵PID:2532
-
\??\c:\tljnh.exec:\tljnh.exe170⤵PID:2460
-
\??\c:\htvvt.exec:\htvvt.exe171⤵PID:2644
-
\??\c:\bbvhfjd.exec:\bbvhfjd.exe172⤵PID:2492
-
\??\c:\hdpttf.exec:\hdpttf.exe173⤵PID:2440
-
\??\c:\rnntvld.exec:\rnntvld.exe174⤵PID:2436
-
\??\c:\vxpfxlt.exec:\vxpfxlt.exe175⤵PID:2604
-
\??\c:\bvlhbln.exec:\bvlhbln.exe176⤵PID:2580
-
\??\c:\pvbrjp.exec:\pvbrjp.exe177⤵PID:2200
-
\??\c:\jtlnj.exec:\jtlnj.exe178⤵PID:2376
-
\??\c:\jbvhrn.exec:\jbvhrn.exe179⤵PID:2176
-
\??\c:\pvjdlpl.exec:\pvjdlpl.exe180⤵PID:2696
-
\??\c:\vvlxbt.exec:\vvlxbt.exe181⤵PID:2808
-
\??\c:\hbxjl.exec:\hbxjl.exe182⤵PID:1636
-
\??\c:\njjjrj.exec:\njjjrj.exe183⤵PID:1984
-
\??\c:\vhbnplh.exec:\vhbnplh.exe184⤵PID:1908
-
\??\c:\bdfrx.exec:\bdfrx.exe185⤵PID:2000
-
\??\c:\lbrvvnv.exec:\lbrvvnv.exe186⤵PID:1468
-
\??\c:\vnthbjt.exec:\vnthbjt.exe187⤵PID:1088
-
\??\c:\jvttdj.exec:\jvttdj.exe188⤵PID:1920
-
\??\c:\vfnjhp.exec:\vfnjhp.exe189⤵PID:2632
-
\??\c:\xjfnh.exec:\xjfnh.exe190⤵PID:1188
-
\??\c:\thnnrnp.exec:\thnnrnp.exe191⤵PID:1176
-
\??\c:\dfrbhp.exec:\dfrbhp.exe192⤵PID:2268
-
\??\c:\phdhndb.exec:\phdhndb.exe193⤵PID:1104
-
\??\c:\htjhrlr.exec:\htjhrlr.exe194⤵PID:1996
-
\??\c:\hjxdj.exec:\hjxdj.exe195⤵PID:780
-
\??\c:\txvndh.exec:\txvndh.exe196⤵PID:3060
-
\??\c:\hftbrxl.exec:\hftbrxl.exe197⤵PID:416
-
\??\c:\lprbb.exec:\lprbb.exe198⤵PID:676
-
\??\c:\lxrpr.exec:\lxrpr.exe199⤵PID:1152
-
\??\c:\dflbr.exec:\dflbr.exe200⤵PID:1156
-
\??\c:\dpllp.exec:\dpllp.exe201⤵PID:2160
-
\??\c:\jrdblt.exec:\jrdblt.exe202⤵PID:888
-
\??\c:\rpvnj.exec:\rpvnj.exe203⤵PID:2944
-
\??\c:\vxrhfxb.exec:\vxrhfxb.exe204⤵PID:1064
-
\??\c:\vjvjpph.exec:\vjvjpph.exe205⤵PID:948
-
\??\c:\njnnll.exec:\njnnll.exe206⤵PID:2880
-
\??\c:\xftnhbl.exec:\xftnhbl.exe207⤵PID:1676
-
\??\c:\fdplbj.exec:\fdplbj.exe208⤵PID:900
-
\??\c:\ntfflfd.exec:\ntfflfd.exe209⤵PID:1752
-
\??\c:\hbdvfdd.exec:\hbdvfdd.exe210⤵PID:2304
-
\??\c:\bbflbxb.exec:\bbflbxb.exe211⤵PID:1776
-
\??\c:\dppxnl.exec:\dppxnl.exe212⤵PID:2992
-
\??\c:\bvbntfn.exec:\bvbntfn.exe213⤵PID:2480
-
\??\c:\xxlbv.exec:\xxlbv.exe214⤵PID:2908
-
\??\c:\bfvfnff.exec:\bfvfnff.exe215⤵PID:2956
-
\??\c:\vrrdx.exec:\vrrdx.exe216⤵PID:2576
-
\??\c:\ljtvx.exec:\ljtvx.exe217⤵PID:2340
-
\??\c:\rbjjbl.exec:\rbjjbl.exe218⤵PID:2560
-
\??\c:\lhdrfvr.exec:\lhdrfvr.exe219⤵PID:2352
-
\??\c:\npxfl.exec:\npxfl.exe220⤵PID:2856
-
\??\c:\frlxn.exec:\frlxn.exe221⤵PID:2380
-
\??\c:\nfpdhjl.exec:\nfpdhjl.exe222⤵PID:1884
-
\??\c:\fnbhrnd.exec:\fnbhrnd.exe223⤵PID:528
-
\??\c:\vbprxf.exec:\vbprxf.exe224⤵PID:2772
-
\??\c:\hhpnv.exec:\hhpnv.exe225⤵PID:2788
-
\??\c:\phvhpx.exec:\phvhpx.exe226⤵PID:1140
-
\??\c:\npnfdb.exec:\npnfdb.exe227⤵PID:3012
-
\??\c:\nfdhx.exec:\nfdhx.exe228⤵PID:2716
-
\??\c:\nfhxlr.exec:\nfhxlr.exe229⤵PID:956
-
\??\c:\xbvhpj.exec:\xbvhpj.exe230⤵PID:2288
-
\??\c:\nffblf.exec:\nffblf.exe231⤵PID:2508
-
\??\c:\nfxlbv.exec:\nfxlbv.exe232⤵PID:1640
-
\??\c:\xnrlhfl.exec:\xnrlhfl.exe233⤵PID:804
-
\??\c:\rhvvvpb.exec:\rhvvvpb.exe234⤵PID:1896
-
\??\c:\dddhpvf.exec:\dddhpvf.exe235⤵PID:2236
-
\??\c:\drxjfv.exec:\drxjfv.exe236⤵PID:2244
-
\??\c:\nvxnl.exec:\nvxnl.exe237⤵PID:2960
-
\??\c:\vxldnhn.exec:\vxldnhn.exe238⤵PID:2544
-
\??\c:\ljvftld.exec:\ljvftld.exe239⤵PID:3000
-
\??\c:\jlvjlv.exec:\jlvjlv.exe240⤵PID:436
-
\??\c:\rjrrlj.exec:\rjrrlj.exe241⤵PID:2292
-