Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 05:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
82d9ff044607ab08cd9caa8f648cdaf0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
82d9ff044607ab08cd9caa8f648cdaf0_NeikiAnalytics.exe
-
Size
75KB
-
MD5
82d9ff044607ab08cd9caa8f648cdaf0
-
SHA1
e38e326ace6122f28bfd4eef4acea927560522d3
-
SHA256
54397f2ac55c25e942e25dc4974a07123f24e8cbb58640ca2aff14252e649264
-
SHA512
650b26529bc407a29377b1a8d6c0a29d54e6cc1b2348282d374615d924a39aedd781696d215660fc84b7a5198dad28341723800009c52f2e4a20db5c209ee9a3
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5A:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCa
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/2208-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2120-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2108-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/464-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1496-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/528-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1444-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/620-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1856-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1788-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1728-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
trjbb.exevdtxpd.exerdftnv.exefhdtnp.exettvtr.exerrhrfbr.exenlvbrbl.exevxnrfnb.exedftbx.exevxjrlnl.exelvpfxpx.exepdfxppf.exehlvdfx.exehbldv.exefvllv.exehttrp.exefhbbptv.exexfftdb.exefrbjf.exenvbtxx.exebjfhp.exenbldn.exethjfpl.exepxhlpp.exetlxnpv.exelfvjvvx.exefttvhph.exerpflxtb.exenffpjp.exebhdvplf.exevxbndf.exevtnppxx.exejflbxnj.exeplbnrf.exejfdhlln.exeffppd.exebvbplr.exebbhvpvl.exefpjrlj.exebndht.exenvrnj.exehfflrt.exebltplt.exehtdnbnx.exevpjhx.exexnhtrph.exexdfljv.exejjxfd.exehphppf.exedhnfh.exelbtnhxn.exelfdbp.exerxlbtp.exerhrbfdh.exeddxxdx.exelxtpd.exehdrtx.exevpjjxxl.exeltxjf.exexdnvjtf.exeffhdv.exetxdvdt.exetfvdvrt.exehldxhj.exepid process 2780 trjbb.exe 2120 vdtxpd.exe 2620 rdftnv.exe 2108 fhdtnp.exe 2596 ttvtr.exe 2748 rrhrfbr.exe 2448 nlvbrbl.exe 2520 vxnrfnb.exe 2384 dftbx.exe 464 vxjrlnl.exe 1496 lvpfxpx.exe 2688 pdfxppf.exe 2752 hlvdfx.exe 528 hbldv.exe 1652 fvllv.exe 1844 httrp.exe 1664 fhbbptv.exe 1444 xfftdb.exe 2824 frbjf.exe 2156 nvbtxx.exe 2088 bjfhp.exe 620 nbldn.exe 2076 thjfpl.exe 2692 pxhlpp.exe 1052 tlxnpv.exe 1856 lfvjvvx.exe 1788 fttvhph.exe 1212 rpflxtb.exe 1264 nffpjp.exe 1728 bhdvplf.exe 876 vxbndf.exe 2180 vtnppxx.exe 1784 jflbxnj.exe 2312 plbnrf.exe 2508 jfdhlln.exe 2996 ffppd.exe 2672 bvbplr.exe 2600 bbhvpvl.exe 2552 fpjrlj.exe 2428 bndht.exe 2572 nvrnj.exe 2396 hfflrt.exe 2512 bltplt.exe 3044 htdnbnx.exe 2224 vpjhx.exe 1192 xnhtrph.exe 792 xdfljv.exe 2660 jjxfd.exe 2488 hphppf.exe 2592 dhnfh.exe 2760 lbtnhxn.exe 2032 lfdbp.exe 1816 rxlbtp.exe 1796 rhrbfdh.exe 1640 ddxxdx.exe 1664 lxtpd.exe 1444 hdrtx.exe 1488 vpjjxxl.exe 2072 ltxjf.exe 1976 xdnvjtf.exe 824 ffhdv.exe 2060 txdvdt.exe 1364 tfvdvrt.exe 1548 hldxhj.exe -
Processes:
resource yara_rule behavioral1/memory/2208-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/464-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1496-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/528-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1444-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/620-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1856-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1788-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1728-289-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
82d9ff044607ab08cd9caa8f648cdaf0_NeikiAnalytics.exetrjbb.exevdtxpd.exerdftnv.exefhdtnp.exettvtr.exerrhrfbr.exenlvbrbl.exevxnrfnb.exedftbx.exevxjrlnl.exelvpfxpx.exepdfxppf.exehlvdfx.exehbldv.exefvllv.exedescription pid process target process PID 2208 wrote to memory of 2780 2208 82d9ff044607ab08cd9caa8f648cdaf0_NeikiAnalytics.exe trjbb.exe PID 2208 wrote to memory of 2780 2208 82d9ff044607ab08cd9caa8f648cdaf0_NeikiAnalytics.exe trjbb.exe PID 2208 wrote to memory of 2780 2208 82d9ff044607ab08cd9caa8f648cdaf0_NeikiAnalytics.exe trjbb.exe PID 2208 wrote to memory of 2780 2208 82d9ff044607ab08cd9caa8f648cdaf0_NeikiAnalytics.exe trjbb.exe PID 2780 wrote to memory of 2120 2780 trjbb.exe vdtxpd.exe PID 2780 wrote to memory of 2120 2780 trjbb.exe vdtxpd.exe PID 2780 wrote to memory of 2120 2780 trjbb.exe vdtxpd.exe PID 2780 wrote to memory of 2120 2780 trjbb.exe vdtxpd.exe PID 2120 wrote to memory of 2620 2120 vdtxpd.exe rdftnv.exe PID 2120 wrote to memory of 2620 2120 vdtxpd.exe rdftnv.exe PID 2120 wrote to memory of 2620 2120 vdtxpd.exe rdftnv.exe PID 2120 wrote to memory of 2620 2120 vdtxpd.exe rdftnv.exe PID 2620 wrote to memory of 2108 2620 rdftnv.exe fhdtnp.exe PID 2620 wrote to memory of 2108 2620 rdftnv.exe fhdtnp.exe PID 2620 wrote to memory of 2108 2620 rdftnv.exe fhdtnp.exe PID 2620 wrote to memory of 2108 2620 rdftnv.exe fhdtnp.exe PID 2108 wrote to memory of 2596 2108 fhdtnp.exe ttvtr.exe PID 2108 wrote to memory of 2596 2108 fhdtnp.exe ttvtr.exe PID 2108 wrote to memory of 2596 2108 fhdtnp.exe ttvtr.exe PID 2108 wrote to memory of 2596 2108 fhdtnp.exe ttvtr.exe PID 2596 wrote to memory of 2748 2596 ttvtr.exe rrhrfbr.exe PID 2596 wrote to memory of 2748 2596 ttvtr.exe rrhrfbr.exe PID 2596 wrote to memory of 2748 2596 ttvtr.exe rrhrfbr.exe PID 2596 wrote to memory of 2748 2596 ttvtr.exe rrhrfbr.exe PID 2748 wrote to memory of 2448 2748 rrhrfbr.exe nlvbrbl.exe PID 2748 wrote to memory of 2448 2748 rrhrfbr.exe nlvbrbl.exe PID 2748 wrote to memory of 2448 2748 rrhrfbr.exe nlvbrbl.exe PID 2748 wrote to memory of 2448 2748 rrhrfbr.exe nlvbrbl.exe PID 2448 wrote to memory of 2520 2448 nlvbrbl.exe vxnrfnb.exe PID 2448 wrote to memory of 2520 2448 nlvbrbl.exe vxnrfnb.exe PID 2448 wrote to memory of 2520 2448 nlvbrbl.exe vxnrfnb.exe PID 2448 wrote to memory of 2520 2448 nlvbrbl.exe vxnrfnb.exe PID 2520 wrote to memory of 2384 2520 vxnrfnb.exe dftbx.exe PID 2520 wrote to memory of 2384 2520 vxnrfnb.exe dftbx.exe PID 2520 wrote to memory of 2384 2520 vxnrfnb.exe dftbx.exe PID 2520 wrote to memory of 2384 2520 vxnrfnb.exe dftbx.exe PID 2384 wrote to memory of 464 2384 dftbx.exe vxjrlnl.exe PID 2384 wrote to memory of 464 2384 dftbx.exe vxjrlnl.exe PID 2384 wrote to memory of 464 2384 dftbx.exe vxjrlnl.exe PID 2384 wrote to memory of 464 2384 dftbx.exe vxjrlnl.exe PID 464 wrote to memory of 1496 464 vxjrlnl.exe lvpfxpx.exe PID 464 wrote to memory of 1496 464 vxjrlnl.exe lvpfxpx.exe PID 464 wrote to memory of 1496 464 vxjrlnl.exe lvpfxpx.exe PID 464 wrote to memory of 1496 464 vxjrlnl.exe lvpfxpx.exe PID 1496 wrote to memory of 2688 1496 lvpfxpx.exe pdfxppf.exe PID 1496 wrote to memory of 2688 1496 lvpfxpx.exe pdfxppf.exe PID 1496 wrote to memory of 2688 1496 lvpfxpx.exe pdfxppf.exe PID 1496 wrote to memory of 2688 1496 lvpfxpx.exe pdfxppf.exe PID 2688 wrote to memory of 2752 2688 pdfxppf.exe hlvdfx.exe PID 2688 wrote to memory of 2752 2688 pdfxppf.exe hlvdfx.exe PID 2688 wrote to memory of 2752 2688 pdfxppf.exe hlvdfx.exe PID 2688 wrote to memory of 2752 2688 pdfxppf.exe hlvdfx.exe PID 2752 wrote to memory of 528 2752 hlvdfx.exe hbldv.exe PID 2752 wrote to memory of 528 2752 hlvdfx.exe hbldv.exe PID 2752 wrote to memory of 528 2752 hlvdfx.exe hbldv.exe PID 2752 wrote to memory of 528 2752 hlvdfx.exe hbldv.exe PID 528 wrote to memory of 1652 528 hbldv.exe fvllv.exe PID 528 wrote to memory of 1652 528 hbldv.exe fvllv.exe PID 528 wrote to memory of 1652 528 hbldv.exe fvllv.exe PID 528 wrote to memory of 1652 528 hbldv.exe fvllv.exe PID 1652 wrote to memory of 1844 1652 fvllv.exe httrp.exe PID 1652 wrote to memory of 1844 1652 fvllv.exe httrp.exe PID 1652 wrote to memory of 1844 1652 fvllv.exe httrp.exe PID 1652 wrote to memory of 1844 1652 fvllv.exe httrp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\82d9ff044607ab08cd9caa8f648cdaf0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\82d9ff044607ab08cd9caa8f648cdaf0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\trjbb.exec:\trjbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\vdtxpd.exec:\vdtxpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\rdftnv.exec:\rdftnv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\fhdtnp.exec:\fhdtnp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\ttvtr.exec:\ttvtr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\rrhrfbr.exec:\rrhrfbr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\nlvbrbl.exec:\nlvbrbl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\vxnrfnb.exec:\vxnrfnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\dftbx.exec:\dftbx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\vxjrlnl.exec:\vxjrlnl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\lvpfxpx.exec:\lvpfxpx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\pdfxppf.exec:\pdfxppf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\hlvdfx.exec:\hlvdfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\hbldv.exec:\hbldv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
\??\c:\fvllv.exec:\fvllv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\httrp.exec:\httrp.exe17⤵
- Executes dropped EXE
PID:1844 -
\??\c:\fhbbptv.exec:\fhbbptv.exe18⤵
- Executes dropped EXE
PID:1664 -
\??\c:\xfftdb.exec:\xfftdb.exe19⤵
- Executes dropped EXE
PID:1444 -
\??\c:\frbjf.exec:\frbjf.exe20⤵
- Executes dropped EXE
PID:2824 -
\??\c:\nvbtxx.exec:\nvbtxx.exe21⤵
- Executes dropped EXE
PID:2156 -
\??\c:\bjfhp.exec:\bjfhp.exe22⤵
- Executes dropped EXE
PID:2088 -
\??\c:\nbldn.exec:\nbldn.exe23⤵
- Executes dropped EXE
PID:620 -
\??\c:\thjfpl.exec:\thjfpl.exe24⤵
- Executes dropped EXE
PID:2076 -
\??\c:\pxhlpp.exec:\pxhlpp.exe25⤵
- Executes dropped EXE
PID:2692 -
\??\c:\tlxnpv.exec:\tlxnpv.exe26⤵
- Executes dropped EXE
PID:1052 -
\??\c:\lfvjvvx.exec:\lfvjvvx.exe27⤵
- Executes dropped EXE
PID:1856 -
\??\c:\fttvhph.exec:\fttvhph.exe28⤵
- Executes dropped EXE
PID:1788 -
\??\c:\rpflxtb.exec:\rpflxtb.exe29⤵
- Executes dropped EXE
PID:1212 -
\??\c:\nffpjp.exec:\nffpjp.exe30⤵
- Executes dropped EXE
PID:1264 -
\??\c:\bhdvplf.exec:\bhdvplf.exe31⤵
- Executes dropped EXE
PID:1728 -
\??\c:\vxbndf.exec:\vxbndf.exe32⤵
- Executes dropped EXE
PID:876 -
\??\c:\vtnppxx.exec:\vtnppxx.exe33⤵
- Executes dropped EXE
PID:2180 -
\??\c:\jflbxnj.exec:\jflbxnj.exe34⤵
- Executes dropped EXE
PID:1784 -
\??\c:\plbnrf.exec:\plbnrf.exe35⤵
- Executes dropped EXE
PID:2312 -
\??\c:\jfdhlln.exec:\jfdhlln.exe36⤵
- Executes dropped EXE
PID:2508 -
\??\c:\ffppd.exec:\ffppd.exe37⤵
- Executes dropped EXE
PID:2996 -
\??\c:\bvbplr.exec:\bvbplr.exe38⤵
- Executes dropped EXE
PID:2672 -
\??\c:\bbhvpvl.exec:\bbhvpvl.exe39⤵
- Executes dropped EXE
PID:2600 -
\??\c:\fpjrlj.exec:\fpjrlj.exe40⤵
- Executes dropped EXE
PID:2552 -
\??\c:\bndht.exec:\bndht.exe41⤵
- Executes dropped EXE
PID:2428 -
\??\c:\nvrnj.exec:\nvrnj.exe42⤵
- Executes dropped EXE
PID:2572 -
\??\c:\hfflrt.exec:\hfflrt.exe43⤵
- Executes dropped EXE
PID:2396 -
\??\c:\bltplt.exec:\bltplt.exe44⤵
- Executes dropped EXE
PID:2512 -
\??\c:\htdnbnx.exec:\htdnbnx.exe45⤵
- Executes dropped EXE
PID:3044 -
\??\c:\vpjhx.exec:\vpjhx.exe46⤵
- Executes dropped EXE
PID:2224 -
\??\c:\xnhtrph.exec:\xnhtrph.exe47⤵
- Executes dropped EXE
PID:1192 -
\??\c:\xdfljv.exec:\xdfljv.exe48⤵
- Executes dropped EXE
PID:792 -
\??\c:\jjxfd.exec:\jjxfd.exe49⤵
- Executes dropped EXE
PID:2660 -
\??\c:\hphppf.exec:\hphppf.exe50⤵
- Executes dropped EXE
PID:2488 -
\??\c:\dhnfh.exec:\dhnfh.exe51⤵
- Executes dropped EXE
PID:2592 -
\??\c:\lbtnhxn.exec:\lbtnhxn.exe52⤵
- Executes dropped EXE
PID:2760 -
\??\c:\lfdbp.exec:\lfdbp.exe53⤵
- Executes dropped EXE
PID:2032 -
\??\c:\rxlbtp.exec:\rxlbtp.exe54⤵
- Executes dropped EXE
PID:1816 -
\??\c:\rhrbfdh.exec:\rhrbfdh.exe55⤵
- Executes dropped EXE
PID:1796 -
\??\c:\ddxxdx.exec:\ddxxdx.exe56⤵
- Executes dropped EXE
PID:1640 -
\??\c:\lxtpd.exec:\lxtpd.exe57⤵
- Executes dropped EXE
PID:1664 -
\??\c:\hdrtx.exec:\hdrtx.exe58⤵
- Executes dropped EXE
PID:1444 -
\??\c:\vpjjxxl.exec:\vpjjxxl.exe59⤵
- Executes dropped EXE
PID:1488 -
\??\c:\ltxjf.exec:\ltxjf.exe60⤵
- Executes dropped EXE
PID:2072 -
\??\c:\xdnvjtf.exec:\xdnvjtf.exe61⤵
- Executes dropped EXE
PID:1976 -
\??\c:\ffhdv.exec:\ffhdv.exe62⤵
- Executes dropped EXE
PID:824 -
\??\c:\txdvdt.exec:\txdvdt.exe63⤵
- Executes dropped EXE
PID:2060 -
\??\c:\tfvdvrt.exec:\tfvdvrt.exe64⤵
- Executes dropped EXE
PID:1364 -
\??\c:\hldxhj.exec:\hldxhj.exe65⤵
- Executes dropped EXE
PID:1548 -
\??\c:\jbpftjl.exec:\jbpftjl.exe66⤵PID:2000
-
\??\c:\hrpvllr.exec:\hrpvllr.exe67⤵PID:1792
-
\??\c:\ntrhd.exec:\ntrhd.exe68⤵PID:1856
-
\??\c:\vdhxvhh.exec:\vdhxvhh.exe69⤵PID:1532
-
\??\c:\prhnxd.exec:\prhnxd.exe70⤵PID:2232
-
\??\c:\hnrprn.exec:\hnrprn.exe71⤵PID:2252
-
\??\c:\tdnpb.exec:\tdnpb.exe72⤵PID:2220
-
\??\c:\vthlpdr.exec:\vthlpdr.exe73⤵PID:1924
-
\??\c:\jtvll.exec:\jtvll.exe74⤵PID:1520
-
\??\c:\nvbndx.exec:\nvbndx.exe75⤵PID:2724
-
\??\c:\vxlxldp.exec:\vxlxldp.exe76⤵PID:1592
-
\??\c:\vtdbxf.exec:\vtdbxf.exe77⤵PID:2544
-
\??\c:\ttfrtr.exec:\ttfrtr.exe78⤵PID:2968
-
\??\c:\ffvdh.exec:\ffvdh.exe79⤵PID:2548
-
\??\c:\ljhfvx.exec:\ljhfvx.exe80⤵PID:2504
-
\??\c:\jvhphpn.exec:\jvhphpn.exe81⤵PID:2576
-
\??\c:\lpfrxdp.exec:\lpfrxdp.exe82⤵PID:2424
-
\??\c:\hpdnbpx.exec:\hpdnbpx.exe83⤵PID:2536
-
\??\c:\rhpjrdf.exec:\rhpjrdf.exe84⤵PID:2588
-
\??\c:\pxdflp.exec:\pxdflp.exe85⤵PID:2444
-
\??\c:\ldpxn.exec:\ldpxn.exe86⤵PID:2016
-
\??\c:\fjvxjb.exec:\fjvxjb.exe87⤵PID:2324
-
\??\c:\rlxjp.exec:\rlxjp.exe88⤵PID:436
-
\??\c:\jnhtnt.exec:\jnhtnt.exe89⤵PID:760
-
\??\c:\lthvrt.exec:\lthvrt.exe90⤵PID:2648
-
\??\c:\dtjhh.exec:\dtjhh.exe91⤵PID:2688
-
\??\c:\pvjpd.exec:\pvjpd.exe92⤵PID:1904
-
\??\c:\fppljd.exec:\fppljd.exe93⤵PID:2852
-
\??\c:\nrdpv.exec:\nrdpv.exe94⤵PID:528
-
\??\c:\npnxndl.exec:\npnxndl.exe95⤵PID:1648
-
\??\c:\bbfjr.exec:\bbfjr.exe96⤵PID:2460
-
\??\c:\xjxpp.exec:\xjxpp.exe97⤵PID:1748
-
\??\c:\dtvftn.exec:\dtvftn.exe98⤵PID:1640
-
\??\c:\jhxrfnx.exec:\jhxrfnx.exe99⤵PID:1696
-
\??\c:\ldlpxpf.exec:\ldlpxpf.exe100⤵PID:2296
-
\??\c:\bnvbpp.exec:\bnvbpp.exe101⤵PID:1488
-
\??\c:\vdrfb.exec:\vdrfb.exe102⤵PID:3028
-
\??\c:\rxrhl.exec:\rxrhl.exe103⤵PID:396
-
\??\c:\jddxjbj.exec:\jddxjbj.exe104⤵PID:1716
-
\??\c:\jpbnx.exec:\jpbnx.exe105⤵PID:1680
-
\??\c:\jhnxdxt.exec:\jhnxdxt.exe106⤵PID:1832
-
\??\c:\vdxvtnx.exec:\vdxvtnx.exe107⤵PID:1960
-
\??\c:\vbntrt.exec:\vbntrt.exe108⤵PID:960
-
\??\c:\dnlxhnd.exec:\dnlxhnd.exe109⤵PID:2124
-
\??\c:\dprtj.exec:\dprtj.exe110⤵PID:676
-
\??\c:\jxrlbfp.exec:\jxrlbfp.exe111⤵PID:2136
-
\??\c:\drtvpxx.exec:\drtvpxx.exe112⤵PID:2212
-
\??\c:\bdxrpjf.exec:\bdxrpjf.exe113⤵PID:2956
-
\??\c:\rdppjhh.exec:\rdppjhh.exe114⤵PID:2984
-
\??\c:\jnjfld.exec:\jnjfld.exe115⤵PID:1732
-
\??\c:\nxtftnr.exec:\nxtftnr.exe116⤵PID:868
-
\??\c:\rjvljp.exec:\rjvljp.exe117⤵PID:876
-
\??\c:\vhhxr.exec:\vhhxr.exe118⤵PID:2724
-
\??\c:\bfrvlvd.exec:\bfrvlvd.exe119⤵PID:2628
-
\??\c:\nlflhn.exec:\nlflhn.exe120⤵PID:2540
-
\??\c:\hxnhjn.exec:\hxnhjn.exe121⤵PID:2968
-
\??\c:\pdhjr.exec:\pdhjr.exe122⤵PID:2548
-
\??\c:\brxfpvl.exec:\brxfpvl.exe123⤵PID:2504
-
\??\c:\rpdddt.exec:\rpdddt.exe124⤵PID:2552
-
\??\c:\vbxxnh.exec:\vbxxnh.exe125⤵PID:2424
-
\??\c:\rtnxrrx.exec:\rtnxrrx.exe126⤵PID:2412
-
\??\c:\prlhl.exec:\prlhl.exe127⤵PID:2568
-
\??\c:\hxhrtlv.exec:\hxhrtlv.exe128⤵PID:2512
-
\??\c:\tjlptnh.exec:\tjlptnh.exe129⤵PID:2448
-
\??\c:\rlnfb.exec:\rlnfb.exe130⤵PID:2324
-
\??\c:\fblfv.exec:\fblfv.exe131⤵PID:436
-
\??\c:\tdbbnnp.exec:\tdbbnnp.exe132⤵PID:760
-
\??\c:\rdtbj.exec:\rdtbj.exe133⤵PID:2648
-
\??\c:\jxplb.exec:\jxplb.exe134⤵PID:2688
-
\??\c:\dxxldx.exec:\dxxldx.exe135⤵PID:2680
-
\??\c:\jtxxlr.exec:\jtxxlr.exe136⤵PID:1228
-
\??\c:\prtpxh.exec:\prtpxh.exe137⤵PID:2012
-
\??\c:\xrffphr.exec:\xrffphr.exe138⤵PID:1700
-
\??\c:\lxfbnp.exec:\lxfbnp.exe139⤵PID:1448
-
\??\c:\rvxbxb.exec:\rvxbxb.exe140⤵PID:2268
-
\??\c:\dhljp.exec:\dhljp.exe141⤵PID:2240
-
\??\c:\prxvtl.exec:\prxvtl.exe142⤵PID:1664
-
\??\c:\jvtjpt.exec:\jvtjpt.exe143⤵PID:2296
-
\??\c:\brtnjlh.exec:\brtnjlh.exe144⤵PID:1488
-
\??\c:\pbfvbff.exec:\pbfvbff.exe145⤵PID:3028
-
\??\c:\bvpdjpf.exec:\bvpdjpf.exe146⤵PID:396
-
\??\c:\lfxbdjf.exec:\lfxbdjf.exe147⤵PID:1716
-
\??\c:\bprdx.exec:\bprdx.exe148⤵PID:1680
-
\??\c:\vbfnb.exec:\vbfnb.exe149⤵PID:1832
-
\??\c:\jtfbdp.exec:\jtfbdp.exe150⤵PID:1960
-
\??\c:\dlhfhh.exec:\dlhfhh.exe151⤵PID:960
-
\??\c:\lnbvf.exec:\lnbvf.exe152⤵PID:3000
-
\??\c:\tdnpnn.exec:\tdnpnn.exe153⤵PID:676
-
\??\c:\jxbfplr.exec:\jxbfplr.exe154⤵PID:2136
-
\??\c:\lvnrldd.exec:\lvnrldd.exe155⤵PID:1532
-
\??\c:\bnjhxh.exec:\bnjhxh.exe156⤵PID:1108
-
\??\c:\bhhfrt.exec:\bhhfrt.exe157⤵PID:2252
-
\??\c:\rntlhtl.exec:\rntlhtl.exe158⤵PID:2220
-
\??\c:\fpjlv.exec:\fpjlv.exe159⤵PID:1736
-
\??\c:\rxnpr.exec:\rxnpr.exe160⤵PID:1520
-
\??\c:\jhrdntn.exec:\jhrdntn.exe161⤵PID:1596
-
\??\c:\vtlfd.exec:\vtlfd.exe162⤵PID:2556
-
\??\c:\btplftp.exec:\btplftp.exe163⤵PID:2540
-
\??\c:\ndhtl.exec:\ndhtl.exe164⤵PID:2968
-
\??\c:\rblnbnj.exec:\rblnbnj.exe165⤵PID:2548
-
\??\c:\brhrthj.exec:\brhrthj.exe166⤵PID:2504
-
\??\c:\xpnlrnj.exec:\xpnlrnj.exe167⤵PID:2552
-
\??\c:\jfrlxlj.exec:\jfrlxlj.exe168⤵PID:2536
-
\??\c:\jtxdh.exec:\jtxdh.exe169⤵PID:2412
-
\??\c:\vlpxjj.exec:\vlpxjj.exe170⤵PID:2568
-
\??\c:\bxdbnhd.exec:\bxdbnhd.exe171⤵PID:2520
-
\??\c:\ldrvt.exec:\ldrvt.exe172⤵PID:2448
-
\??\c:\tprhjpn.exec:\tprhjpn.exe173⤵PID:2324
-
\??\c:\ntrljp.exec:\ntrljp.exe174⤵PID:2732
-
\??\c:\trttl.exec:\trttl.exe175⤵PID:2696
-
\??\c:\lhlbth.exec:\lhlbth.exe176⤵PID:2756
-
\??\c:\pdxrnn.exec:\pdxrnn.exe177⤵PID:2688
-
\??\c:\hvhnlb.exec:\hvhnlb.exe178⤵PID:2680
-
\??\c:\nvrvt.exec:\nvrvt.exe179⤵PID:2032
-
\??\c:\ndprxh.exec:\ndprxh.exe180⤵PID:528
-
\??\c:\rljfvt.exec:\rljfvt.exe181⤵PID:1796
-
\??\c:\drdxh.exec:\drdxh.exe182⤵PID:1448
-
\??\c:\pvbvlj.exec:\pvbvlj.exe183⤵PID:2268
-
\??\c:\nxvbbp.exec:\nxvbbp.exe184⤵PID:2240
-
\??\c:\xrtrvf.exec:\xrtrvf.exe185⤵PID:1664
-
\??\c:\hhxvxh.exec:\hhxvxh.exe186⤵PID:2296
-
\??\c:\xxhbhvb.exec:\xxhbhvb.exe187⤵PID:620
-
\??\c:\vdfpld.exec:\vdfpld.exe188⤵PID:3028
-
\??\c:\hhjldp.exec:\hhjldp.exe189⤵PID:396
-
\??\c:\nlfvp.exec:\nlfvp.exe190⤵PID:1780
-
\??\c:\dlvltvr.exec:\dlvltvr.exe191⤵PID:1680
-
\??\c:\fxdtt.exec:\fxdtt.exe192⤵PID:644
-
\??\c:\jbnvppx.exec:\jbnvppx.exe193⤵PID:1960
-
\??\c:\rfvbhjb.exec:\rfvbhjb.exe194⤵PID:960
-
\??\c:\bfbxppv.exec:\bfbxppv.exe195⤵PID:3000
-
\??\c:\dbfvn.exec:\dbfvn.exe196⤵PID:1212
-
\??\c:\drlxlfx.exec:\drlxlfx.exe197⤵PID:2136
-
\??\c:\lvjrtt.exec:\lvjrtt.exe198⤵PID:1532
-
\??\c:\xdjxb.exec:\xdjxb.exe199⤵PID:1108
-
\??\c:\pvdnddn.exec:\pvdnddn.exe200⤵PID:2252
-
\??\c:\vlntpp.exec:\vlntpp.exe201⤵PID:1732
-
\??\c:\jjttd.exec:\jjttd.exe202⤵PID:1784
-
\??\c:\pldrfpt.exec:\pldrfpt.exe203⤵PID:876
-
\??\c:\lnhtlr.exec:\lnhtlr.exe204⤵PID:1596
-
\??\c:\rtbbbd.exec:\rtbbbd.exe205⤵PID:2664
-
\??\c:\rhvhl.exec:\rhvhl.exe206⤵PID:2716
-
\??\c:\rfrxf.exec:\rfrxf.exe207⤵PID:2968
-
\??\c:\bhlfdpf.exec:\bhlfdpf.exe208⤵PID:2744
-
\??\c:\nfbhlnf.exec:\nfbhlnf.exe209⤵PID:2504
-
\??\c:\dptjf.exec:\dptjf.exe210⤵PID:2876
-
\??\c:\nvlpf.exec:\nvlpf.exe211⤵PID:2536
-
\??\c:\bvvjtf.exec:\bvvjtf.exe212⤵PID:2444
-
\??\c:\jhdnnp.exec:\jhdnnp.exe213⤵PID:1688
-
\??\c:\tdlnxfh.exec:\tdlnxfh.exe214⤵PID:2380
-
\??\c:\trrhxbd.exec:\trrhxbd.exe215⤵PID:2448
-
\??\c:\frdpbtp.exec:\frdpbtp.exe216⤵PID:2324
-
\??\c:\ffhhb.exec:\ffhhb.exe217⤵PID:2776
-
\??\c:\lrlbtnb.exec:\lrlbtnb.exe218⤵PID:760
-
\??\c:\bfnvnx.exec:\bfnvnx.exe219⤵PID:1232
-
\??\c:\ffxpx.exec:\ffxpx.exe220⤵PID:1968
-
\??\c:\pjrfl.exec:\pjrfl.exe221⤵PID:1644
-
\??\c:\lrntrt.exec:\lrntrt.exe222⤵PID:788
-
\??\c:\xvlnfth.exec:\xvlnfth.exe223⤵PID:1648
-
\??\c:\hnjjnp.exec:\hnjjnp.exe224⤵PID:1512
-
\??\c:\lpbbt.exec:\lpbbt.exe225⤵PID:1996
-
\??\c:\ldbhlh.exec:\ldbhlh.exe226⤵PID:2164
-
\??\c:\hflpl.exec:\hflpl.exe227⤵PID:1696
-
\??\c:\rlldjrf.exec:\rlldjrf.exe228⤵PID:432
-
\??\c:\hrblb.exec:\hrblb.exe229⤵PID:1488
-
\??\c:\lvvxbh.exec:\lvvxbh.exe230⤵PID:1092
-
\??\c:\djfpph.exec:\djfpph.exe231⤵PID:2692
-
\??\c:\hfhvvj.exec:\hfhvvj.exe232⤵PID:396
-
\??\c:\ppbtxt.exec:\ppbtxt.exe233⤵PID:1800
-
\??\c:\fxdttj.exec:\fxdttj.exe234⤵PID:1608
-
\??\c:\tvbxnx.exec:\tvbxnx.exe235⤵PID:1740
-
\??\c:\fpdbp.exec:\fpdbp.exe236⤵PID:3008
-
\??\c:\jprrxr.exec:\jprrxr.exe237⤵PID:2152
-
\??\c:\tltpfl.exec:\tltpfl.exe238⤵PID:1852
-
\??\c:\lphbtb.exec:\lphbtb.exe239⤵PID:1668
-
\??\c:\txbtdjx.exec:\txbtdjx.exe240⤵PID:2136
-
\??\c:\tdpltn.exec:\tdpltn.exe241⤵PID:2232
-
\??\c:\lfbdxfj.exec:\lfbdxfj.exe242⤵PID:2984