Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 22:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
17a8bca640313961bbba298b73eb2a70_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
17a8bca640313961bbba298b73eb2a70_NeikiAnalytics.exe
-
Size
393KB
-
MD5
17a8bca640313961bbba298b73eb2a70
-
SHA1
85e3006daf2f89773cdb7dec7d4a86d2e8e24ced
-
SHA256
b828ffdfb27b47247674c5cfb1bf7be82e86b234ba16ca6c3cda3b69d53c0c65
-
SHA512
95bb9d9deea91279ef84570e82b23a29c296625e178286997a53ada83bcb67cc9e2842e2408fb4da9d35661939f1a29b832cd2d4cb282fcdd81af8b0223610d3
-
SSDEEP
6144:n3C9BRo7tvnJ9oH0IRgZvjkobjcSbcY+CaQdaFOY4iGFYtRdu/i:n3C9ytvngQjZbz+xt4vFBq
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/1664-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/564-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2328-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1084-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2000-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/540-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/880-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1560-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/920-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pnxxxpf.exexjdtp.exepvjthbh.exedfnjxl.exetrdnj.exeptnbpb.exevtfln.exedfbtht.exeprbhvx.exevxpdjr.exeljtdnhd.exerrtnnpt.exedvbhp.exetrrvpfp.exefpvdhdr.exetxdnnxf.exefrnpf.exertnfdpf.exenvthnb.exenpljv.exetprjnh.exebnhbn.exexvfrbn.exefjfrr.exeprptn.exedrvjrtp.exehvvflh.exetpltrfd.exednbrhff.exellrrxd.exextldf.exeddlpxnb.exerbbll.exevdrjprx.exehjbnjb.exelljxft.exelpdtdp.exebtbpnv.exefhjdpj.exethjfb.exetjrlr.exerpbxfj.exexhtph.exetvjvfx.exefndpx.exefxnfhld.exerthtp.exedprdj.exehnhtxtf.exenblrp.exeppnbh.exexvnxh.exethbfxlx.exefbbhf.exebxvhpd.exevjrfhb.exepdtnh.exefnthljx.exelvfptf.exepxlrdv.exerlvljpf.exenhrnb.exenrplr.exexlpblht.exepid process 2632 pnxxxpf.exe 2916 xjdtp.exe 2548 pvjthbh.exe 2468 dfnjxl.exe 2376 trdnj.exe 2344 ptnbpb.exe 2056 vtfln.exe 564 dfbtht.exe 2328 prbhvx.exe 1760 vxpdjr.exe 2448 ljtdnhd.exe 2792 rrtnnpt.exe 1084 dvbhp.exe 2000 trrvpfp.exe 1252 fpvdhdr.exe 2016 txdnnxf.exe 540 frnpf.exe 880 rtnfdpf.exe 1704 nvthnb.exe 2264 npljv.exe 2724 tprjnh.exe 2860 bnhbn.exe 2984 xvfrbn.exe 2148 fjfrr.exe 1560 prptn.exe 1660 drvjrtp.exe 1540 hvvflh.exe 2528 tpltrfd.exe 368 dnbrhff.exe 2196 llrrxd.exe 920 xtldf.exe 1504 ddlpxnb.exe 2296 rbbll.exe 1956 vdrjprx.exe 1604 hjbnjb.exe 2460 lljxft.exe 2552 lpdtdp.exe 2708 btbpnv.exe 2084 fhjdpj.exe 2660 thjfb.exe 2468 tjrlr.exe 2340 rpbxfj.exe 2420 xhtph.exe 2392 tvjvfx.exe 2804 fndpx.exe 1476 fxnfhld.exe 2020 rthtp.exe 2328 dprdj.exe 1760 hnhtxtf.exe 2648 nblrp.exe 1856 ppnbh.exe 1808 xvnxh.exe 1228 thbfxlx.exe 2000 fbbhf.exe 1068 bxvhpd.exe 1812 vjrfhb.exe 804 pdtnh.exe 924 fnthljx.exe 1344 lvfptf.exe 2144 pxlrdv.exe 772 rlvljpf.exe 2896 nhrnb.exe 2932 nrplr.exe 436 xlpblht.exe -
Processes:
resource yara_rule behavioral1/memory/1664-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/564-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1084-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2000-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/540-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/880-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1560-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-295-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/920-304-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
17a8bca640313961bbba298b73eb2a70_NeikiAnalytics.exepnxxxpf.exexjdtp.exepvjthbh.exedfnjxl.exetrdnj.exeptnbpb.exevtfln.exedfbtht.exeprbhvx.exevxpdjr.exeljtdnhd.exerrtnnpt.exedvbhp.exetrrvpfp.exefpvdhdr.exedescription pid process target process PID 1664 wrote to memory of 2632 1664 17a8bca640313961bbba298b73eb2a70_NeikiAnalytics.exe pnxxxpf.exe PID 1664 wrote to memory of 2632 1664 17a8bca640313961bbba298b73eb2a70_NeikiAnalytics.exe pnxxxpf.exe PID 1664 wrote to memory of 2632 1664 17a8bca640313961bbba298b73eb2a70_NeikiAnalytics.exe pnxxxpf.exe PID 1664 wrote to memory of 2632 1664 17a8bca640313961bbba298b73eb2a70_NeikiAnalytics.exe pnxxxpf.exe PID 2632 wrote to memory of 2916 2632 pnxxxpf.exe xjdtp.exe PID 2632 wrote to memory of 2916 2632 pnxxxpf.exe xjdtp.exe PID 2632 wrote to memory of 2916 2632 pnxxxpf.exe xjdtp.exe PID 2632 wrote to memory of 2916 2632 pnxxxpf.exe xjdtp.exe PID 2916 wrote to memory of 2548 2916 xjdtp.exe pvjthbh.exe PID 2916 wrote to memory of 2548 2916 xjdtp.exe pvjthbh.exe PID 2916 wrote to memory of 2548 2916 xjdtp.exe pvjthbh.exe PID 2916 wrote to memory of 2548 2916 xjdtp.exe pvjthbh.exe PID 2548 wrote to memory of 2468 2548 pvjthbh.exe dfnjxl.exe PID 2548 wrote to memory of 2468 2548 pvjthbh.exe dfnjxl.exe PID 2548 wrote to memory of 2468 2548 pvjthbh.exe dfnjxl.exe PID 2548 wrote to memory of 2468 2548 pvjthbh.exe dfnjxl.exe PID 2468 wrote to memory of 2376 2468 dfnjxl.exe trdnj.exe PID 2468 wrote to memory of 2376 2468 dfnjxl.exe trdnj.exe PID 2468 wrote to memory of 2376 2468 dfnjxl.exe trdnj.exe PID 2468 wrote to memory of 2376 2468 dfnjxl.exe trdnj.exe PID 2376 wrote to memory of 2344 2376 trdnj.exe ptnbpb.exe PID 2376 wrote to memory of 2344 2376 trdnj.exe ptnbpb.exe PID 2376 wrote to memory of 2344 2376 trdnj.exe ptnbpb.exe PID 2376 wrote to memory of 2344 2376 trdnj.exe ptnbpb.exe PID 2344 wrote to memory of 2056 2344 ptnbpb.exe vtfln.exe PID 2344 wrote to memory of 2056 2344 ptnbpb.exe vtfln.exe PID 2344 wrote to memory of 2056 2344 ptnbpb.exe vtfln.exe PID 2344 wrote to memory of 2056 2344 ptnbpb.exe vtfln.exe PID 2056 wrote to memory of 564 2056 vtfln.exe dfbtht.exe PID 2056 wrote to memory of 564 2056 vtfln.exe dfbtht.exe PID 2056 wrote to memory of 564 2056 vtfln.exe dfbtht.exe PID 2056 wrote to memory of 564 2056 vtfln.exe dfbtht.exe PID 564 wrote to memory of 2328 564 dfbtht.exe prbhvx.exe PID 564 wrote to memory of 2328 564 dfbtht.exe prbhvx.exe PID 564 wrote to memory of 2328 564 dfbtht.exe prbhvx.exe PID 564 wrote to memory of 2328 564 dfbtht.exe prbhvx.exe PID 2328 wrote to memory of 1760 2328 prbhvx.exe vxpdjr.exe PID 2328 wrote to memory of 1760 2328 prbhvx.exe vxpdjr.exe PID 2328 wrote to memory of 1760 2328 prbhvx.exe vxpdjr.exe PID 2328 wrote to memory of 1760 2328 prbhvx.exe vxpdjr.exe PID 1760 wrote to memory of 2448 1760 vxpdjr.exe ljtdnhd.exe PID 1760 wrote to memory of 2448 1760 vxpdjr.exe ljtdnhd.exe PID 1760 wrote to memory of 2448 1760 vxpdjr.exe ljtdnhd.exe PID 1760 wrote to memory of 2448 1760 vxpdjr.exe ljtdnhd.exe PID 2448 wrote to memory of 2792 2448 ljtdnhd.exe rrtnnpt.exe PID 2448 wrote to memory of 2792 2448 ljtdnhd.exe rrtnnpt.exe PID 2448 wrote to memory of 2792 2448 ljtdnhd.exe rrtnnpt.exe PID 2448 wrote to memory of 2792 2448 ljtdnhd.exe rrtnnpt.exe PID 2792 wrote to memory of 1084 2792 rrtnnpt.exe dvbhp.exe PID 2792 wrote to memory of 1084 2792 rrtnnpt.exe dvbhp.exe PID 2792 wrote to memory of 1084 2792 rrtnnpt.exe dvbhp.exe PID 2792 wrote to memory of 1084 2792 rrtnnpt.exe dvbhp.exe PID 1084 wrote to memory of 2000 1084 dvbhp.exe trrvpfp.exe PID 1084 wrote to memory of 2000 1084 dvbhp.exe trrvpfp.exe PID 1084 wrote to memory of 2000 1084 dvbhp.exe trrvpfp.exe PID 1084 wrote to memory of 2000 1084 dvbhp.exe trrvpfp.exe PID 2000 wrote to memory of 1252 2000 trrvpfp.exe fpvdhdr.exe PID 2000 wrote to memory of 1252 2000 trrvpfp.exe fpvdhdr.exe PID 2000 wrote to memory of 1252 2000 trrvpfp.exe fpvdhdr.exe PID 2000 wrote to memory of 1252 2000 trrvpfp.exe fpvdhdr.exe PID 1252 wrote to memory of 2016 1252 fpvdhdr.exe txdnnxf.exe PID 1252 wrote to memory of 2016 1252 fpvdhdr.exe txdnnxf.exe PID 1252 wrote to memory of 2016 1252 fpvdhdr.exe txdnnxf.exe PID 1252 wrote to memory of 2016 1252 fpvdhdr.exe txdnnxf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\17a8bca640313961bbba298b73eb2a70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17a8bca640313961bbba298b73eb2a70_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\pnxxxpf.exec:\pnxxxpf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\xjdtp.exec:\xjdtp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\pvjthbh.exec:\pvjthbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\dfnjxl.exec:\dfnjxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\trdnj.exec:\trdnj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\ptnbpb.exec:\ptnbpb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\vtfln.exec:\vtfln.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\dfbtht.exec:\dfbtht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
\??\c:\prbhvx.exec:\prbhvx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\vxpdjr.exec:\vxpdjr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\ljtdnhd.exec:\ljtdnhd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\rrtnnpt.exec:\rrtnnpt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\dvbhp.exec:\dvbhp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\trrvpfp.exec:\trrvpfp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\fpvdhdr.exec:\fpvdhdr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\txdnnxf.exec:\txdnnxf.exe17⤵
- Executes dropped EXE
PID:2016 -
\??\c:\frnpf.exec:\frnpf.exe18⤵
- Executes dropped EXE
PID:540 -
\??\c:\rtnfdpf.exec:\rtnfdpf.exe19⤵
- Executes dropped EXE
PID:880 -
\??\c:\nvthnb.exec:\nvthnb.exe20⤵
- Executes dropped EXE
PID:1704 -
\??\c:\npljv.exec:\npljv.exe21⤵
- Executes dropped EXE
PID:2264 -
\??\c:\tprjnh.exec:\tprjnh.exe22⤵
- Executes dropped EXE
PID:2724 -
\??\c:\bnhbn.exec:\bnhbn.exe23⤵
- Executes dropped EXE
PID:2860 -
\??\c:\xvfrbn.exec:\xvfrbn.exe24⤵
- Executes dropped EXE
PID:2984 -
\??\c:\fjfrr.exec:\fjfrr.exe25⤵
- Executes dropped EXE
PID:2148 -
\??\c:\prptn.exec:\prptn.exe26⤵
- Executes dropped EXE
PID:1560 -
\??\c:\drvjrtp.exec:\drvjrtp.exe27⤵
- Executes dropped EXE
PID:1660 -
\??\c:\hvvflh.exec:\hvvflh.exe28⤵
- Executes dropped EXE
PID:1540 -
\??\c:\tpltrfd.exec:\tpltrfd.exe29⤵
- Executes dropped EXE
PID:2528 -
\??\c:\dnbrhff.exec:\dnbrhff.exe30⤵
- Executes dropped EXE
PID:368 -
\??\c:\llrrxd.exec:\llrrxd.exe31⤵
- Executes dropped EXE
PID:2196 -
\??\c:\xtldf.exec:\xtldf.exe32⤵
- Executes dropped EXE
PID:920 -
\??\c:\ddlpxnb.exec:\ddlpxnb.exe33⤵
- Executes dropped EXE
PID:1504 -
\??\c:\rbbll.exec:\rbbll.exe34⤵
- Executes dropped EXE
PID:2296 -
\??\c:\vdrjprx.exec:\vdrjprx.exe35⤵
- Executes dropped EXE
PID:1956 -
\??\c:\hjbnjb.exec:\hjbnjb.exe36⤵
- Executes dropped EXE
PID:1604 -
\??\c:\lljxft.exec:\lljxft.exe37⤵
- Executes dropped EXE
PID:2460 -
\??\c:\lpdtdp.exec:\lpdtdp.exe38⤵
- Executes dropped EXE
PID:2552 -
\??\c:\btbpnv.exec:\btbpnv.exe39⤵
- Executes dropped EXE
PID:2708 -
\??\c:\fhjdpj.exec:\fhjdpj.exe40⤵
- Executes dropped EXE
PID:2084 -
\??\c:\thjfb.exec:\thjfb.exe41⤵
- Executes dropped EXE
PID:2660 -
\??\c:\tjrlr.exec:\tjrlr.exe42⤵
- Executes dropped EXE
PID:2468 -
\??\c:\rpbxfj.exec:\rpbxfj.exe43⤵
- Executes dropped EXE
PID:2340 -
\??\c:\xhtph.exec:\xhtph.exe44⤵
- Executes dropped EXE
PID:2420 -
\??\c:\tvjvfx.exec:\tvjvfx.exe45⤵
- Executes dropped EXE
PID:2392 -
\??\c:\fndpx.exec:\fndpx.exe46⤵
- Executes dropped EXE
PID:2804 -
\??\c:\fxnfhld.exec:\fxnfhld.exe47⤵
- Executes dropped EXE
PID:1476 -
\??\c:\rthtp.exec:\rthtp.exe48⤵
- Executes dropped EXE
PID:2020 -
\??\c:\dprdj.exec:\dprdj.exe49⤵
- Executes dropped EXE
PID:2328 -
\??\c:\hnhtxtf.exec:\hnhtxtf.exe50⤵
- Executes dropped EXE
PID:1760 -
\??\c:\nblrp.exec:\nblrp.exe51⤵
- Executes dropped EXE
PID:2648 -
\??\c:\ppnbh.exec:\ppnbh.exe52⤵
- Executes dropped EXE
PID:1856 -
\??\c:\xvnxh.exec:\xvnxh.exe53⤵
- Executes dropped EXE
PID:1808 -
\??\c:\thbfxlx.exec:\thbfxlx.exe54⤵
- Executes dropped EXE
PID:1228 -
\??\c:\fbbhf.exec:\fbbhf.exe55⤵
- Executes dropped EXE
PID:2000 -
\??\c:\bxvhpd.exec:\bxvhpd.exe56⤵
- Executes dropped EXE
PID:1068 -
\??\c:\vjrfhb.exec:\vjrfhb.exe57⤵
- Executes dropped EXE
PID:1812 -
\??\c:\pdtnh.exec:\pdtnh.exe58⤵
- Executes dropped EXE
PID:804 -
\??\c:\fnthljx.exec:\fnthljx.exe59⤵
- Executes dropped EXE
PID:924 -
\??\c:\lvfptf.exec:\lvfptf.exe60⤵
- Executes dropped EXE
PID:1344 -
\??\c:\pxlrdv.exec:\pxlrdv.exe61⤵
- Executes dropped EXE
PID:2144 -
\??\c:\rlvljpf.exec:\rlvljpf.exe62⤵
- Executes dropped EXE
PID:772 -
\??\c:\nhrnb.exec:\nhrnb.exe63⤵
- Executes dropped EXE
PID:2896 -
\??\c:\nrplr.exec:\nrplr.exe64⤵
- Executes dropped EXE
PID:2932 -
\??\c:\xlpblht.exec:\xlpblht.exe65⤵
- Executes dropped EXE
PID:436 -
\??\c:\bhhrxr.exec:\bhhrxr.exe66⤵PID:1144
-
\??\c:\rtltl.exec:\rtltl.exe67⤵PID:2268
-
\??\c:\vhtntvh.exec:\vhtntvh.exe68⤵PID:1324
-
\??\c:\rjrvr.exec:\rjrvr.exe69⤵PID:1784
-
\??\c:\ddhflxx.exec:\ddhflxx.exe70⤵PID:1980
-
\??\c:\flpbp.exec:\flpbp.exe71⤵PID:888
-
\??\c:\vtrxdl.exec:\vtrxdl.exe72⤵PID:600
-
\??\c:\llfxflh.exec:\llfxflh.exe73⤵PID:2716
-
\??\c:\jbxndvn.exec:\jbxndvn.exe74⤵PID:1940
-
\??\c:\jjnvpbh.exec:\jjnvpbh.exe75⤵PID:2124
-
\??\c:\rxpdtl.exec:\rxpdtl.exe76⤵PID:1336
-
\??\c:\xrptj.exec:\xrptj.exe77⤵PID:1700
-
\??\c:\tlhplfx.exec:\tlhplfx.exe78⤵PID:2316
-
\??\c:\hhdph.exec:\hhdph.exe79⤵PID:2212
-
\??\c:\xtjddjv.exec:\xtjddjv.exe80⤵PID:2688
-
\??\c:\njjxhnl.exec:\njjxhnl.exe81⤵PID:2220
-
\??\c:\tpdbjdh.exec:\tpdbjdh.exe82⤵PID:2500
-
\??\c:\dvxvd.exec:\dvxvd.exe83⤵PID:2712
-
\??\c:\tdjpvdv.exec:\tdjpvdv.exe84⤵PID:2584
-
\??\c:\lrrdl.exec:\lrrdl.exe85⤵PID:2548
-
\??\c:\vphtjd.exec:\vphtjd.exe86⤵PID:2672
-
\??\c:\hfvvhdv.exec:\hfvvhdv.exe87⤵PID:2524
-
\??\c:\dddplfl.exec:\dddplfl.exe88⤵PID:2464
-
\??\c:\ptfpb.exec:\ptfpb.exe89⤵PID:2424
-
\??\c:\djfhtdv.exec:\djfhtdv.exe90⤵PID:2156
-
\??\c:\fnbxj.exec:\fnbxj.exe91⤵PID:856
-
\??\c:\nxtnht.exec:\nxtnht.exe92⤵PID:1108
-
\??\c:\jppnh.exec:\jppnh.exe93⤵PID:1392
-
\??\c:\tdtdllx.exec:\tdtdllx.exe94⤵PID:756
-
\??\c:\lvhbxhp.exec:\lvhbxhp.exe95⤵PID:2668
-
\??\c:\phlll.exec:\phlll.exe96⤵PID:1760
-
\??\c:\dvvbvb.exec:\dvvbvb.exe97⤵PID:2648
-
\??\c:\hppbht.exec:\hppbht.exe98⤵PID:1460
-
\??\c:\tlnflfl.exec:\tlnflfl.exe99⤵PID:1132
-
\??\c:\tpjfd.exec:\tpjfd.exe100⤵PID:1620
-
\??\c:\hnnfpxx.exec:\hnnfpxx.exe101⤵PID:1776
-
\??\c:\xhxbrxv.exec:\xhxbrxv.exe102⤵PID:1748
-
\??\c:\bnnbpd.exec:\bnnbpd.exe103⤵PID:1936
-
\??\c:\ljfbhv.exec:\ljfbhv.exe104⤵PID:2260
-
\??\c:\rlnhndx.exec:\rlnhndx.exe105⤵PID:1704
-
\??\c:\tftxf.exec:\tftxf.exe106⤵PID:1552
-
\??\c:\rdftft.exec:\rdftft.exe107⤵PID:2072
-
\??\c:\vxhftx.exec:\vxhftx.exe108⤵PID:2252
-
\??\c:\lxhvh.exec:\lxhvh.exe109⤵PID:940
-
\??\c:\drfdv.exec:\drfdv.exe110⤵PID:1144
-
\??\c:\lndpj.exec:\lndpj.exe111⤵PID:1632
-
\??\c:\ljhnvn.exec:\ljhnvn.exe112⤵PID:2996
-
\??\c:\txrlhj.exec:\txrlhj.exe113⤵PID:2824
-
\??\c:\drjxlpj.exec:\drjxlpj.exe114⤵PID:888
-
\??\c:\tppxlxv.exec:\tppxlxv.exe115⤵PID:2256
-
\??\c:\bjtvx.exec:\bjtvx.exe116⤵PID:1816
-
\??\c:\rhtptbf.exec:\rhtptbf.exe117⤵PID:2028
-
\??\c:\tnvljlp.exec:\tnvljlp.exe118⤵PID:1076
-
\??\c:\hvjrfht.exec:\hvjrfht.exe119⤵PID:1336
-
\??\c:\njrrh.exec:\njrrh.exe120⤵PID:1700
-
\??\c:\htbjrhv.exec:\htbjrhv.exe121⤵PID:1724
-
\??\c:\tprxp.exec:\tprxp.exe122⤵PID:2212
-
\??\c:\ltfpv.exec:\ltfpv.exe123⤵PID:2440
-
\??\c:\jtlhh.exec:\jtlhh.exe124⤵PID:2560
-
\??\c:\lxnpl.exec:\lxnpl.exe125⤵PID:3024
-
\??\c:\vtlhp.exec:\vtlhp.exe126⤵PID:2712
-
\??\c:\bhbnthx.exec:\bhbnthx.exe127⤵PID:2584
-
\??\c:\bntjj.exec:\bntjj.exe128⤵PID:2704
-
\??\c:\rhrhhbt.exec:\rhrhhbt.exe129⤵PID:2672
-
\??\c:\dlxxvnf.exec:\dlxxvnf.exe130⤵PID:2524
-
\??\c:\rpfdhnf.exec:\rpfdhnf.exe131⤵PID:2228
-
\??\c:\dblvff.exec:\dblvff.exe132⤵PID:2424
-
\??\c:\dnthhp.exec:\dnthhp.exe133⤵PID:2156
-
\??\c:\thrnr.exec:\thrnr.exe134⤵PID:1236
-
\??\c:\jlxxlh.exec:\jlxxlh.exe135⤵PID:832
-
\??\c:\fpblfp.exec:\fpblfp.exe136⤵PID:1852
-
\??\c:\vnbhpd.exec:\vnbhpd.exe137⤵PID:1508
-
\??\c:\njhxlfh.exec:\njhxlfh.exe138⤵PID:2684
-
\??\c:\pbpvfhl.exec:\pbpvfhl.exe139⤵PID:2968
-
\??\c:\djjvt.exec:\djjvt.exe140⤵PID:1572
-
\??\c:\llttfnr.exec:\llttfnr.exe141⤵PID:1428
-
\??\c:\hvbjt.exec:\hvbjt.exe142⤵PID:1252
-
\??\c:\bbfrptp.exec:\bbfrptp.exe143⤵PID:1804
-
\??\c:\llnpbv.exec:\llnpbv.exe144⤵PID:1948
-
\??\c:\nndnrdp.exec:\nndnrdp.exe145⤵PID:816
-
\??\c:\vnrrhjj.exec:\vnrrhjj.exe146⤵PID:2320
-
\??\c:\jjvljvd.exec:\jjvljvd.exe147⤵PID:1204
-
\??\c:\pdbfnt.exec:\pdbfnt.exe148⤵PID:2720
-
\??\c:\tdnffn.exec:\tdnffn.exe149⤵PID:324
-
\??\c:\hlhdxv.exec:\hlhdxv.exe150⤵PID:2896
-
\??\c:\xrpdf.exec:\xrpdf.exe151⤵PID:3012
-
\??\c:\djbpxh.exec:\djbpxh.exe152⤵PID:1148
-
\??\c:\dnvtb.exec:\dnvtb.exe153⤵PID:1612
-
\??\c:\httljhd.exec:\httljhd.exe154⤵PID:1984
-
\??\c:\pvxjtft.exec:\pvxjtft.exe155⤵PID:2812
-
\??\c:\bfpdpp.exec:\bfpdpp.exe156⤵PID:2528
-
\??\c:\drblbnx.exec:\drblbnx.exe157⤵PID:2696
-
\??\c:\jldjx.exec:\jldjx.exe158⤵PID:2760
-
\??\c:\dprhxjt.exec:\dprhxjt.exe159⤵PID:2940
-
\??\c:\thddpd.exec:\thddpd.exe160⤵PID:2128
-
\??\c:\ffxpbv.exec:\ffxpbv.exe161⤵PID:2756
-
\??\c:\tbrlhhj.exec:\tbrlhhj.exe162⤵PID:1500
-
\??\c:\xhlhl.exec:\xhlhl.exe163⤵PID:2532
-
\??\c:\hdxjhv.exec:\hdxjhv.exe164⤵PID:2296
-
\??\c:\dxpxrpv.exec:\dxpxrpv.exe165⤵PID:2432
-
\??\c:\hxfhjrn.exec:\hxfhjrn.exe166⤵PID:2944
-
\??\c:\ltpvr.exec:\ltpvr.exe167⤵PID:2916
-
\??\c:\dxtdnt.exec:\dxtdnt.exe168⤵PID:2876
-
\??\c:\hrprx.exec:\hrprx.exe169⤵PID:2436
-
\??\c:\jxlfxn.exec:\jxlfxn.exe170⤵PID:2516
-
\??\c:\rtxbh.exec:\rtxbh.exe171⤵PID:2200
-
\??\c:\lvxvv.exec:\lvxvv.exe172⤵PID:2412
-
\??\c:\rjpfh.exec:\rjpfh.exe173⤵PID:2780
-
\??\c:\jbvvdl.exec:\jbvvdl.exe174⤵PID:2060
-
\??\c:\vlntt.exec:\vlntt.exe175⤵PID:1412
-
\??\c:\xtpvxh.exec:\xtpvxh.exe176⤵PID:1876
-
\??\c:\rfdrrd.exec:\rfdrrd.exe177⤵PID:536
-
\??\c:\hhjjbp.exec:\hhjjbp.exe178⤵PID:2020
-
\??\c:\rntndp.exec:\rntndp.exe179⤵PID:2328
-
\??\c:\bltfhlh.exec:\bltfhlh.exe180⤵PID:2656
-
\??\c:\rdxjh.exec:\rdxjh.exe181⤵PID:2448
-
\??\c:\bdvvfft.exec:\bdvvfft.exe182⤵PID:1996
-
\??\c:\jhvnll.exec:\jhvnll.exe183⤵PID:1196
-
\??\c:\vrtjxvr.exec:\vrtjxvr.exe184⤵PID:1424
-
\??\c:\hrppbhf.exec:\hrppbhf.exe185⤵PID:1168
-
\??\c:\hthxllt.exec:\hthxllt.exe186⤵PID:1088
-
\??\c:\tbrhd.exec:\tbrhd.exe187⤵PID:2408
-
\??\c:\vbfht.exec:\vbfht.exe188⤵PID:1752
-
\??\c:\vrbvd.exec:\vrbvd.exe189⤵PID:1624
-
\??\c:\rxntpt.exec:\rxntpt.exe190⤵PID:1256
-
\??\c:\phbjpx.exec:\phbjpx.exe191⤵PID:2892
-
\??\c:\dxhxl.exec:\dxhxl.exe192⤵PID:1720
-
\??\c:\prnpj.exec:\prnpj.exe193⤵PID:2844
-
\??\c:\tttfb.exec:\tttfb.exe194⤵PID:668
-
\??\c:\hlftjjb.exec:\hlftjjb.exe195⤵PID:964
-
\??\c:\pxbdp.exec:\pxbdp.exe196⤵PID:1452
-
\??\c:\rdnrtjb.exec:\rdnrtjb.exe197⤵PID:1540
-
\??\c:\plnxh.exec:\plnxh.exe198⤵PID:552
-
\??\c:\vpxbd.exec:\vpxbd.exe199⤵PID:1800
-
\??\c:\thtltbl.exec:\thtltbl.exe200⤵PID:2740
-
\??\c:\dtpldl.exec:\dtpldl.exe201⤵PID:1740
-
\??\c:\hhvtb.exec:\hhvtb.exe202⤵PID:2312
-
\??\c:\lpdbnv.exec:\lpdbnv.exe203⤵PID:2044
-
\??\c:\hnnrllv.exec:\hnnrllv.exe204⤵PID:864
-
\??\c:\nljvvpr.exec:\nljvvpr.exe205⤵PID:2428
-
\??\c:\nbtjhh.exec:\nbtjhh.exe206⤵PID:2112
-
\??\c:\xllxrf.exec:\xllxrf.exe207⤵PID:1956
-
\??\c:\nvflp.exec:\nvflp.exe208⤵PID:1604
-
\??\c:\pxrvpxj.exec:\pxrvpxj.exe209⤵PID:2492
-
\??\c:\rltdthv.exec:\rltdthv.exe210⤵PID:2540
-
\??\c:\hfbxt.exec:\hfbxt.exe211⤵PID:2576
-
\??\c:\hvlptrv.exec:\hvlptrv.exe212⤵PID:2828
-
\??\c:\fvpvhv.exec:\fvpvhv.exe213⤵PID:1952
-
\??\c:\pbdphd.exec:\pbdphd.exe214⤵PID:2488
-
\??\c:\brfbh.exec:\brfbh.exe215⤵PID:2360
-
\??\c:\blvfd.exec:\blvfd.exe216⤵PID:2420
-
\??\c:\llhlpb.exec:\llhlpb.exe217⤵PID:2784
-
\??\c:\llbnhp.exec:\llbnhp.exe218⤵PID:564
-
\??\c:\ndfhltx.exec:\ndfhltx.exe219⤵PID:1480
-
\??\c:\pjrfrbd.exec:\pjrfrbd.exe220⤵PID:1188
-
\??\c:\bbpjvrx.exec:\bbpjvrx.exe221⤵PID:588
-
\??\c:\fxhhdpf.exec:\fxhhdpf.exe222⤵PID:2692
-
\??\c:\dfnhdl.exec:\dfnhdl.exe223⤵PID:1508
-
\??\c:\lnxfrr.exec:\lnxfrr.exe224⤵PID:1668
-
\??\c:\xhjxfpp.exec:\xhjxfpp.exe225⤵PID:2008
-
\??\c:\bxbrh.exec:\bxbrh.exe226⤵PID:1192
-
\??\c:\brddxf.exec:\brddxf.exe227⤵PID:1556
-
\??\c:\vxpdft.exec:\vxpdft.exe228⤵PID:1644
-
\??\c:\lfblxrt.exec:\lfblxrt.exe229⤵PID:1812
-
\??\c:\txptddv.exec:\txptddv.exe230⤵PID:1676
-
\??\c:\ndlbpt.exec:\ndlbpt.exe231⤵PID:1680
-
\??\c:\nhdnpd.exec:\nhdnpd.exe232⤵PID:2260
-
\??\c:\hbtdfx.exec:\hbtdfx.exe233⤵PID:664
-
\??\c:\vpfjp.exec:\vpfjp.exe234⤵PID:1728
-
\??\c:\xjdrtb.exec:\xjdrtb.exe235⤵PID:2928
-
\??\c:\lndjh.exec:\lndjh.exe236⤵PID:1308
-
\??\c:\rvbbprl.exec:\rvbbprl.exe237⤵PID:2268
-
\??\c:\dnjnl.exec:\dnjnl.exe238⤵PID:1288
-
\??\c:\vfxnrl.exec:\vfxnrl.exe239⤵PID:1784
-
\??\c:\dvhbr.exec:\dvhbr.exe240⤵PID:748
-
\??\c:\xbxjrrh.exec:\xbxjrrh.exe241⤵PID:1520
-
\??\c:\rjdnnpp.exec:\rjdnnpp.exe242⤵PID:1924