Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 12:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b9d1674e4b9e06cefaaa86ee35c9e0b0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
b9d1674e4b9e06cefaaa86ee35c9e0b0_NeikiAnalytics.exe
-
Size
76KB
-
MD5
b9d1674e4b9e06cefaaa86ee35c9e0b0
-
SHA1
8ff79d37730ef34c36168f5f9886ca9dfb842d01
-
SHA256
b7cd41758d07cf1b25af8aed65ce1be8bf7e9f8610c597750bd1f83e3ba92d97
-
SHA512
55011ad562b00a6b8ceea7fbd976a795651a66551623daa755e8fb25719442cf0986867cf4d00e678465eace9de83bf5e31c8f1aa2875c087bc9714e2985998f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA0:ymb3NkkiQ3mdBjFIIp9L9QrrA0
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/2072-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-30-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2316-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1744-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2356-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2364-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/568-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1656-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1972-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2020-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1780-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
tlnnp.exetfrntp.exenfbrv.exevnpjvp.exednvrfvr.exethddpp.exerdfrbf.exepjdhjt.exevvnhfjj.exetdpvjdj.exehhdllx.exepxxtnpv.exexbpvlr.exenrjnbvv.exeltnjhv.exehpvtvp.exenfrft.exedndvv.exenfbxrb.exelfflbfd.exexxxjl.exelrdpndl.exedbvdv.exevvpft.exeltdfhpt.exefrpxt.exetxrbhjh.exenbfffxr.exexftvxtx.exehpvbjd.exexxlnvh.exehxvvn.exeplfxjp.exeffdtr.exentvhx.exexbxdnt.exeppjxnrd.exetxlhlb.exetttffhd.exetjrdr.exevxvtdr.exenjhxlt.exefbxlht.exevdrrfj.exedbbphrv.exejbxrfx.exehdxndj.exexhxdn.exexbpjfn.exedhfxft.exedfdfr.exerdtllt.exetjfjt.exenhhvfpb.exerfljx.exevxpprjd.exepjftpl.exerbfjl.exexxbfd.exehtflh.exedftnnv.exeljblp.exelflrfd.exehtffpnb.exepid process 2176 tlnnp.exe 2316 tfrntp.exe 2016 nfbrv.exe 1744 vnpjvp.exe 2616 dnvrfvr.exe 2356 thddpp.exe 2524 rdfrbf.exe 2364 pjdhjt.exe 2800 vvnhfjj.exe 1212 tdpvjdj.exe 1480 hhdllx.exe 568 pxxtnpv.exe 1656 xbpvlr.exe 2204 nrjnbvv.exe 2312 ltnjhv.exe 944 hpvtvp.exe 1972 nfrft.exe 2056 dndvv.exe 1612 nfbxrb.exe 1648 lfflbfd.exe 2960 xxxjl.exe 2020 lrdpndl.exe 596 dbvdv.exe 2720 vvpft.exe 1992 ltdfhpt.exe 1620 frpxt.exe 1836 txrbhjh.exe 1780 nbfffxr.exe 2972 xftvxtx.exe 2856 hpvbjd.exe 2748 xxlnvh.exe 1240 hxvvn.exe 1540 plfxjp.exe 2072 ffdtr.exe 2308 ntvhx.exe 2012 xbxdnt.exe 2632 ppjxnrd.exe 1632 txlhlb.exe 2876 tttffhd.exe 2456 tjrdr.exe 2596 vxvtdr.exe 2612 njhxlt.exe 2536 fbxlht.exe 2404 vdrrfj.exe 2360 dbbphrv.exe 2472 jbxrfx.exe 2776 hdxndj.exe 920 xhxdn.exe 1200 xbpjfn.exe 2104 dhfxft.exe 1516 dfdfr.exe 1940 rdtllt.exe 1776 tjfjt.exe 1132 nhhvfpb.exe 1452 rfljx.exe 952 vxpprjd.exe 2212 pjftpl.exe 1900 rbfjl.exe 2644 xxbfd.exe 2168 htflh.exe 3032 dftnnv.exe 528 ljblp.exe 1296 lflrfd.exe 2336 htffpnb.exe -
Processes:
resource yara_rule behavioral1/memory/2072-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1744-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2364-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2364-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2364-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/568-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1656-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1972-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1780-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-300-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b9d1674e4b9e06cefaaa86ee35c9e0b0_NeikiAnalytics.exetlnnp.exetfrntp.exenfbrv.exevnpjvp.exednvrfvr.exethddpp.exerdfrbf.exepjdhjt.exevvnhfjj.exetdpvjdj.exehhdllx.exepxxtnpv.exexbpvlr.exenrjnbvv.exeltnjhv.exedescription pid process target process PID 2072 wrote to memory of 2176 2072 b9d1674e4b9e06cefaaa86ee35c9e0b0_NeikiAnalytics.exe tlnnp.exe PID 2072 wrote to memory of 2176 2072 b9d1674e4b9e06cefaaa86ee35c9e0b0_NeikiAnalytics.exe tlnnp.exe PID 2072 wrote to memory of 2176 2072 b9d1674e4b9e06cefaaa86ee35c9e0b0_NeikiAnalytics.exe tlnnp.exe PID 2072 wrote to memory of 2176 2072 b9d1674e4b9e06cefaaa86ee35c9e0b0_NeikiAnalytics.exe tlnnp.exe PID 2176 wrote to memory of 2316 2176 tlnnp.exe tfrntp.exe PID 2176 wrote to memory of 2316 2176 tlnnp.exe tfrntp.exe PID 2176 wrote to memory of 2316 2176 tlnnp.exe tfrntp.exe PID 2176 wrote to memory of 2316 2176 tlnnp.exe tfrntp.exe PID 2316 wrote to memory of 2016 2316 tfrntp.exe nfbrv.exe PID 2316 wrote to memory of 2016 2316 tfrntp.exe nfbrv.exe PID 2316 wrote to memory of 2016 2316 tfrntp.exe nfbrv.exe PID 2316 wrote to memory of 2016 2316 tfrntp.exe nfbrv.exe PID 2016 wrote to memory of 1744 2016 nfbrv.exe vnpjvp.exe PID 2016 wrote to memory of 1744 2016 nfbrv.exe vnpjvp.exe PID 2016 wrote to memory of 1744 2016 nfbrv.exe vnpjvp.exe PID 2016 wrote to memory of 1744 2016 nfbrv.exe vnpjvp.exe PID 1744 wrote to memory of 2616 1744 vnpjvp.exe dnvrfvr.exe PID 1744 wrote to memory of 2616 1744 vnpjvp.exe dnvrfvr.exe PID 1744 wrote to memory of 2616 1744 vnpjvp.exe dnvrfvr.exe PID 1744 wrote to memory of 2616 1744 vnpjvp.exe dnvrfvr.exe PID 2616 wrote to memory of 2356 2616 dnvrfvr.exe thddpp.exe PID 2616 wrote to memory of 2356 2616 dnvrfvr.exe thddpp.exe PID 2616 wrote to memory of 2356 2616 dnvrfvr.exe thddpp.exe PID 2616 wrote to memory of 2356 2616 dnvrfvr.exe thddpp.exe PID 2356 wrote to memory of 2524 2356 thddpp.exe rdfrbf.exe PID 2356 wrote to memory of 2524 2356 thddpp.exe rdfrbf.exe PID 2356 wrote to memory of 2524 2356 thddpp.exe rdfrbf.exe PID 2356 wrote to memory of 2524 2356 thddpp.exe rdfrbf.exe PID 2524 wrote to memory of 2364 2524 rdfrbf.exe pjdhjt.exe PID 2524 wrote to memory of 2364 2524 rdfrbf.exe pjdhjt.exe PID 2524 wrote to memory of 2364 2524 rdfrbf.exe pjdhjt.exe PID 2524 wrote to memory of 2364 2524 rdfrbf.exe pjdhjt.exe PID 2364 wrote to memory of 2800 2364 pjdhjt.exe vvnhfjj.exe PID 2364 wrote to memory of 2800 2364 pjdhjt.exe vvnhfjj.exe PID 2364 wrote to memory of 2800 2364 pjdhjt.exe vvnhfjj.exe PID 2364 wrote to memory of 2800 2364 pjdhjt.exe vvnhfjj.exe PID 2800 wrote to memory of 1212 2800 vvnhfjj.exe tdpvjdj.exe PID 2800 wrote to memory of 1212 2800 vvnhfjj.exe tdpvjdj.exe PID 2800 wrote to memory of 1212 2800 vvnhfjj.exe tdpvjdj.exe PID 2800 wrote to memory of 1212 2800 vvnhfjj.exe tdpvjdj.exe PID 1212 wrote to memory of 1480 1212 tdpvjdj.exe hhdllx.exe PID 1212 wrote to memory of 1480 1212 tdpvjdj.exe hhdllx.exe PID 1212 wrote to memory of 1480 1212 tdpvjdj.exe hhdllx.exe PID 1212 wrote to memory of 1480 1212 tdpvjdj.exe hhdllx.exe PID 1480 wrote to memory of 568 1480 hhdllx.exe pxxtnpv.exe PID 1480 wrote to memory of 568 1480 hhdllx.exe pxxtnpv.exe PID 1480 wrote to memory of 568 1480 hhdllx.exe pxxtnpv.exe PID 1480 wrote to memory of 568 1480 hhdllx.exe pxxtnpv.exe PID 568 wrote to memory of 1656 568 pxxtnpv.exe xbpvlr.exe PID 568 wrote to memory of 1656 568 pxxtnpv.exe xbpvlr.exe PID 568 wrote to memory of 1656 568 pxxtnpv.exe xbpvlr.exe PID 568 wrote to memory of 1656 568 pxxtnpv.exe xbpvlr.exe PID 1656 wrote to memory of 2204 1656 xbpvlr.exe nrjnbvv.exe PID 1656 wrote to memory of 2204 1656 xbpvlr.exe nrjnbvv.exe PID 1656 wrote to memory of 2204 1656 xbpvlr.exe nrjnbvv.exe PID 1656 wrote to memory of 2204 1656 xbpvlr.exe nrjnbvv.exe PID 2204 wrote to memory of 2312 2204 nrjnbvv.exe ltnjhv.exe PID 2204 wrote to memory of 2312 2204 nrjnbvv.exe ltnjhv.exe PID 2204 wrote to memory of 2312 2204 nrjnbvv.exe ltnjhv.exe PID 2204 wrote to memory of 2312 2204 nrjnbvv.exe ltnjhv.exe PID 2312 wrote to memory of 944 2312 ltnjhv.exe hpvtvp.exe PID 2312 wrote to memory of 944 2312 ltnjhv.exe hpvtvp.exe PID 2312 wrote to memory of 944 2312 ltnjhv.exe hpvtvp.exe PID 2312 wrote to memory of 944 2312 ltnjhv.exe hpvtvp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9d1674e4b9e06cefaaa86ee35c9e0b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b9d1674e4b9e06cefaaa86ee35c9e0b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\tlnnp.exec:\tlnnp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\tfrntp.exec:\tfrntp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\nfbrv.exec:\nfbrv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\vnpjvp.exec:\vnpjvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\dnvrfvr.exec:\dnvrfvr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\thddpp.exec:\thddpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\rdfrbf.exec:\rdfrbf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\pjdhjt.exec:\pjdhjt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\vvnhfjj.exec:\vvnhfjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\tdpvjdj.exec:\tdpvjdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\hhdllx.exec:\hhdllx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\pxxtnpv.exec:\pxxtnpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\xbpvlr.exec:\xbpvlr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\nrjnbvv.exec:\nrjnbvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\ltnjhv.exec:\ltnjhv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\hpvtvp.exec:\hpvtvp.exe17⤵
- Executes dropped EXE
PID:944 -
\??\c:\nfrft.exec:\nfrft.exe18⤵
- Executes dropped EXE
PID:1972 -
\??\c:\dndvv.exec:\dndvv.exe19⤵
- Executes dropped EXE
PID:2056 -
\??\c:\nfbxrb.exec:\nfbxrb.exe20⤵
- Executes dropped EXE
PID:1612 -
\??\c:\lfflbfd.exec:\lfflbfd.exe21⤵
- Executes dropped EXE
PID:1648 -
\??\c:\xxxjl.exec:\xxxjl.exe22⤵
- Executes dropped EXE
PID:2960 -
\??\c:\lrdpndl.exec:\lrdpndl.exe23⤵
- Executes dropped EXE
PID:2020 -
\??\c:\dbvdv.exec:\dbvdv.exe24⤵
- Executes dropped EXE
PID:596 -
\??\c:\vvpft.exec:\vvpft.exe25⤵
- Executes dropped EXE
PID:2720 -
\??\c:\ltdfhpt.exec:\ltdfhpt.exe26⤵
- Executes dropped EXE
PID:1992 -
\??\c:\frpxt.exec:\frpxt.exe27⤵
- Executes dropped EXE
PID:1620 -
\??\c:\txrbhjh.exec:\txrbhjh.exe28⤵
- Executes dropped EXE
PID:1836 -
\??\c:\nbfffxr.exec:\nbfffxr.exe29⤵
- Executes dropped EXE
PID:1780 -
\??\c:\xftvxtx.exec:\xftvxtx.exe30⤵
- Executes dropped EXE
PID:2972 -
\??\c:\hpvbjd.exec:\hpvbjd.exe31⤵
- Executes dropped EXE
PID:2856 -
\??\c:\xxlnvh.exec:\xxlnvh.exe32⤵
- Executes dropped EXE
PID:2748 -
\??\c:\hxvvn.exec:\hxvvn.exe33⤵
- Executes dropped EXE
PID:1240 -
\??\c:\plfxjp.exec:\plfxjp.exe34⤵
- Executes dropped EXE
PID:1540 -
\??\c:\ffdtr.exec:\ffdtr.exe35⤵
- Executes dropped EXE
PID:2072 -
\??\c:\ntvhx.exec:\ntvhx.exe36⤵
- Executes dropped EXE
PID:2308 -
\??\c:\xbxdnt.exec:\xbxdnt.exe37⤵
- Executes dropped EXE
PID:2012 -
\??\c:\ppjxnrd.exec:\ppjxnrd.exe38⤵
- Executes dropped EXE
PID:2632 -
\??\c:\txlhlb.exec:\txlhlb.exe39⤵
- Executes dropped EXE
PID:1632 -
\??\c:\tttffhd.exec:\tttffhd.exe40⤵
- Executes dropped EXE
PID:2876 -
\??\c:\tjrdr.exec:\tjrdr.exe41⤵
- Executes dropped EXE
PID:2456 -
\??\c:\vxvtdr.exec:\vxvtdr.exe42⤵
- Executes dropped EXE
PID:2596 -
\??\c:\njhxlt.exec:\njhxlt.exe43⤵
- Executes dropped EXE
PID:2612 -
\??\c:\fbxlht.exec:\fbxlht.exe44⤵
- Executes dropped EXE
PID:2536 -
\??\c:\vdrrfj.exec:\vdrrfj.exe45⤵
- Executes dropped EXE
PID:2404 -
\??\c:\dbbphrv.exec:\dbbphrv.exe46⤵
- Executes dropped EXE
PID:2360 -
\??\c:\jbxrfx.exec:\jbxrfx.exe47⤵
- Executes dropped EXE
PID:2472 -
\??\c:\hdxndj.exec:\hdxndj.exe48⤵
- Executes dropped EXE
PID:2776 -
\??\c:\xhxdn.exec:\xhxdn.exe49⤵
- Executes dropped EXE
PID:920 -
\??\c:\xbpjfn.exec:\xbpjfn.exe50⤵
- Executes dropped EXE
PID:1200 -
\??\c:\dhfxft.exec:\dhfxft.exe51⤵
- Executes dropped EXE
PID:2104 -
\??\c:\dfdfr.exec:\dfdfr.exe52⤵
- Executes dropped EXE
PID:1516 -
\??\c:\rdtllt.exec:\rdtllt.exe53⤵
- Executes dropped EXE
PID:1940 -
\??\c:\tjfjt.exec:\tjfjt.exe54⤵
- Executes dropped EXE
PID:1776 -
\??\c:\nhhvfpb.exec:\nhhvfpb.exe55⤵
- Executes dropped EXE
PID:1132 -
\??\c:\rfljx.exec:\rfljx.exe56⤵
- Executes dropped EXE
PID:1452 -
\??\c:\vxpprjd.exec:\vxpprjd.exe57⤵
- Executes dropped EXE
PID:952 -
\??\c:\pjftpl.exec:\pjftpl.exe58⤵
- Executes dropped EXE
PID:2212 -
\??\c:\rbfjl.exec:\rbfjl.exe59⤵
- Executes dropped EXE
PID:1900 -
\??\c:\xxbfd.exec:\xxbfd.exe60⤵
- Executes dropped EXE
PID:2644 -
\??\c:\htflh.exec:\htflh.exe61⤵
- Executes dropped EXE
PID:2168 -
\??\c:\dftnnv.exec:\dftnnv.exe62⤵
- Executes dropped EXE
PID:3032 -
\??\c:\ljblp.exec:\ljblp.exe63⤵
- Executes dropped EXE
PID:528 -
\??\c:\lflrfd.exec:\lflrfd.exe64⤵
- Executes dropped EXE
PID:1296 -
\??\c:\htffpnb.exec:\htffpnb.exe65⤵
- Executes dropped EXE
PID:2336 -
\??\c:\vvxln.exec:\vvxln.exe66⤵PID:692
-
\??\c:\dfhbd.exec:\dfhbd.exe67⤵PID:780
-
\??\c:\lrdnt.exec:\lrdnt.exe68⤵PID:1756
-
\??\c:\jtdvnhl.exec:\jtdvnhl.exe69⤵PID:1644
-
\??\c:\lvnjnnv.exec:\lvnjnnv.exe70⤵PID:2240
-
\??\c:\jfltl.exec:\jfltl.exe71⤵PID:2880
-
\??\c:\xldjj.exec:\xldjj.exe72⤵PID:976
-
\??\c:\lfxbfnl.exec:\lfxbfnl.exe73⤵PID:664
-
\??\c:\frnvxh.exec:\frnvxh.exe74⤵PID:1276
-
\??\c:\pptpnjt.exec:\pptpnjt.exe75⤵PID:2992
-
\??\c:\lvxdpj.exec:\lvxdpj.exe76⤵PID:2748
-
\??\c:\rjhvl.exec:\rjhvl.exe77⤵PID:2304
-
\??\c:\bhjhdhr.exec:\bhjhdhr.exe78⤵PID:3016
-
\??\c:\xnvvp.exec:\xnvvp.exe79⤵PID:1896
-
\??\c:\fhdrl.exec:\fhdrl.exe80⤵PID:2176
-
\??\c:\npnfbht.exec:\npnfbht.exe81⤵PID:2000
-
\??\c:\rdxrd.exec:\rdxrd.exe82⤵PID:1716
-
\??\c:\prntv.exec:\prntv.exe83⤵PID:2436
-
\??\c:\vtlrtv.exec:\vtlrtv.exe84⤵PID:2496
-
\??\c:\bvxhpvf.exec:\bvxhpvf.exe85⤵PID:1744
-
\??\c:\bjhtrrp.exec:\bjhtrrp.exe86⤵PID:2592
-
\??\c:\tvjlbp.exec:\tvjlbp.exe87⤵PID:2612
-
\??\c:\hnbffxl.exec:\hnbffxl.exe88⤵PID:2552
-
\??\c:\jldpt.exec:\jldpt.exe89⤵PID:2348
-
\??\c:\hfxpf.exec:\hfxpf.exe90⤵PID:2416
-
\??\c:\rhbttbj.exec:\rhbttbj.exe91⤵PID:2252
-
\??\c:\vlldjpv.exec:\vlldjpv.exe92⤵PID:552
-
\??\c:\hhtrnx.exec:\hhtrnx.exe93⤵PID:1088
-
\??\c:\hhvrx.exec:\hhvrx.exe94⤵PID:572
-
\??\c:\vfnlpvt.exec:\vfnlpvt.exe95⤵PID:1828
-
\??\c:\lhjrj.exec:\lhjrj.exe96⤵PID:836
-
\??\c:\vrnrfr.exec:\vrnrfr.exe97⤵PID:2324
-
\??\c:\xrpfnbv.exec:\xrpfnbv.exe98⤵PID:2200
-
\??\c:\vrrjffr.exec:\vrrjffr.exe99⤵PID:1112
-
\??\c:\fvjtdjj.exec:\fvjtdjj.exe100⤵PID:1796
-
\??\c:\rvjxfp.exec:\rvjxfp.exe101⤵PID:1784
-
\??\c:\prvfl.exec:\prvfl.exe102⤵PID:1556
-
\??\c:\xdxlh.exec:\xdxlh.exe103⤵PID:1436
-
\??\c:\jjfdfr.exec:\jjfdfr.exe104⤵PID:1696
-
\??\c:\nvpnldb.exec:\nvpnldb.exe105⤵PID:2656
-
\??\c:\drhhjn.exec:\drhhjn.exe106⤵PID:2676
-
\??\c:\frhrjj.exec:\frhrjj.exe107⤵PID:380
-
\??\c:\dvrjtl.exec:\dvrjtl.exe108⤵PID:592
-
\??\c:\frvdlfx.exec:\frvdlfx.exe109⤵PID:2220
-
\??\c:\drtfdjx.exec:\drtfdjx.exe110⤵PID:440
-
\??\c:\bffvvb.exec:\bffvvb.exe111⤵PID:840
-
\??\c:\drtbn.exec:\drtbn.exe112⤵PID:1820
-
\??\c:\dvhlh.exec:\dvhlh.exe113⤵PID:1180
-
\??\c:\jdltnpp.exec:\jdltnpp.exe114⤵PID:1580
-
\??\c:\tnhjjx.exec:\tnhjjx.exe115⤵PID:1116
-
\??\c:\bpvlltp.exec:\bpvlltp.exe116⤵PID:1932
-
\??\c:\lnnjpl.exec:\lnnjpl.exe117⤵PID:2708
-
\??\c:\dfdnhl.exec:\dfdnhl.exe118⤵PID:664
-
\??\c:\xlbtdx.exec:\xlbtdx.exe119⤵PID:2996
-
\??\c:\fhtlh.exec:\fhtlh.exe120⤵PID:2812
-
\??\c:\rprpbnr.exec:\rprpbnr.exe121⤵PID:2224
-
\??\c:\hvxnf.exec:\hvxnf.exe122⤵PID:1100
-
\??\c:\vbthr.exec:\vbthr.exe123⤵PID:3016
-
\??\c:\tjhfxv.exec:\tjhfxv.exe124⤵PID:2032
-
\??\c:\hvnxlb.exec:\hvnxlb.exe125⤵PID:1720
-
\??\c:\nndnh.exec:\nndnh.exe126⤵PID:2684
-
\??\c:\lndtv.exec:\lndtv.exe127⤵PID:2188
-
\??\c:\nbdvpvp.exec:\nbdvpvp.exe128⤵PID:3024
-
\??\c:\dpdtbn.exec:\dpdtbn.exe129⤵PID:2568
-
\??\c:\bdnblxr.exec:\bdnblxr.exe130⤵PID:2564
-
\??\c:\rthfdhr.exec:\rthfdhr.exe131⤵PID:2484
-
\??\c:\pvfhl.exec:\pvfhl.exe132⤵PID:2396
-
\??\c:\hrpldn.exec:\hrpldn.exe133⤵PID:2452
-
\??\c:\xvrfbff.exec:\xvrfbff.exe134⤵PID:2524
-
\??\c:\brtdrt.exec:\brtdrt.exe135⤵PID:2428
-
\??\c:\jhlfv.exec:\jhlfv.exe136⤵PID:2780
-
\??\c:\vxpfh.exec:\vxpfh.exe137⤵PID:1256
-
\??\c:\pdjhhj.exec:\pdjhhj.exe138⤵PID:2232
-
\??\c:\nrbtlv.exec:\nrbtlv.exe139⤵PID:1884
-
\??\c:\tlbll.exec:\tlbll.exe140⤵PID:2320
-
\??\c:\tlnfdbl.exec:\tlnfdbl.exe141⤵PID:1152
-
\??\c:\fjdfb.exec:\fjdfb.exe142⤵PID:1284
-
\??\c:\lpbfrfv.exec:\lpbfrfv.exe143⤵PID:1740
-
\??\c:\vlrtvdx.exec:\vlrtvdx.exe144⤵PID:2228
-
\??\c:\jfxdrfp.exec:\jfxdrfp.exe145⤵PID:1908
-
\??\c:\rhbbppd.exec:\rhbbppd.exe146⤵PID:1464
-
\??\c:\hvphd.exec:\hvphd.exe147⤵PID:1552
-
\??\c:\lxxfflf.exec:\lxxfflf.exe148⤵PID:1952
-
\??\c:\bxvnfxn.exec:\bxvnfxn.exe149⤵PID:2652
-
\??\c:\phbxd.exec:\phbxd.exe150⤵PID:2916
-
\??\c:\hltrt.exec:\hltrt.exe151⤵PID:2052
-
\??\c:\xbdrhv.exec:\xbdrhv.exe152⤵PID:380
-
\??\c:\ptvbb.exec:\ptvbb.exe153⤵PID:2724
-
\??\c:\dldfhn.exec:\dldfhn.exe154⤵PID:2096
-
\??\c:\tjjrnxx.exec:\tjjrnxx.exe155⤵PID:844
-
\??\c:\fxnbf.exec:\fxnbf.exe156⤵PID:1880
-
\??\c:\xnnrt.exec:\xnnrt.exe157⤵PID:1996
-
\??\c:\pbvhbdn.exec:\pbvhbdn.exe158⤵PID:2160
-
\??\c:\ddjpx.exec:\ddjpx.exe159⤵PID:1676
-
\??\c:\llptprj.exec:\llptprj.exe160⤵PID:1780
-
\??\c:\lrlxj.exec:\lrlxj.exe161⤵PID:2836
-
\??\c:\jxdfbbt.exec:\jxdfbbt.exe162⤵PID:2736
-
\??\c:\jptxl.exec:\jptxl.exe163⤵PID:3012
-
\??\c:\rtlfn.exec:\rtlfn.exe164⤵PID:1760
-
\??\c:\xnltn.exec:\xnltn.exe165⤵PID:2112
-
\??\c:\pbnjrvn.exec:\pbnjrvn.exe166⤵PID:2784
-
\??\c:\rlfphb.exec:\rlfphb.exe167⤵PID:2884
-
\??\c:\xtlfd.exec:\xtlfd.exe168⤵PID:3016
-
\??\c:\pvjhx.exec:\pvjhx.exe169⤵PID:2280
-
\??\c:\vpprlpr.exec:\vpprlpr.exe170⤵PID:1628
-
\??\c:\jlrvpbr.exec:\jlrvpbr.exe171⤵PID:2632
-
\??\c:\bblltd.exec:\bblltd.exe172⤵PID:2904
-
\??\c:\ndtxp.exec:\ndtxp.exe173⤵PID:2492
-
\??\c:\nfjpb.exec:\nfjpb.exe174⤵PID:2476
-
\??\c:\pnhnt.exec:\pnhnt.exe175⤵PID:2560
-
\??\c:\hfbfl.exec:\hfbfl.exe176⤵PID:2520
-
\??\c:\pvthn.exec:\pvthn.exe177⤵PID:2356
-
\??\c:\xfjfvv.exec:\xfjfvv.exe178⤵PID:2348
-
\??\c:\txltd.exec:\txltd.exe179⤵PID:2368
-
\??\c:\vrhhh.exec:\vrhhh.exe180⤵PID:2764
-
\??\c:\ntnvb.exec:\ntnvb.exe181⤵PID:1212
-
\??\c:\jbrxtb.exec:\jbrxtb.exe182⤵PID:1672
-
\??\c:\xhbll.exec:\xhbll.exe183⤵PID:1480
-
\??\c:\dndlplf.exec:\dndlplf.exe184⤵PID:2104
-
\??\c:\rnlttl.exec:\rnlttl.exe185⤵PID:2248
-
\??\c:\pbbpjf.exec:\pbbpjf.exe186⤵PID:1940
-
\??\c:\fdffbh.exec:\fdffbh.exe187⤵PID:772
-
\??\c:\nnthxfh.exec:\nnthxfh.exe188⤵PID:1840
-
\??\c:\vldjhbh.exec:\vldjhbh.exe189⤵PID:1912
-
\??\c:\tjjdb.exec:\tjjdb.exe190⤵PID:1344
-
\??\c:\fndxxv.exec:\fndxxv.exe191⤵PID:2056
-
\??\c:\dtxlt.exec:\dtxlt.exe192⤵PID:1900
-
\??\c:\fpjjh.exec:\fpjjh.exe193⤵PID:1612
-
\??\c:\thvrt.exec:\thvrt.exe194⤵PID:2448
-
\??\c:\hdflbdx.exec:\hdflbdx.exe195⤵PID:2960
-
\??\c:\phpjh.exec:\phpjh.exe196⤵PID:1472
-
\??\c:\hdttl.exec:\hdttl.exe197⤵PID:912
-
\??\c:\xfrdbvt.exec:\xfrdbvt.exe198⤵PID:1752
-
\??\c:\fbxnd.exec:\fbxnd.exe199⤵PID:2704
-
\??\c:\xdjnp.exec:\xdjnp.exe200⤵PID:1572
-
\??\c:\hbptbrv.exec:\hbptbrv.exe201⤵PID:1068
-
\??\c:\jhxddj.exec:\jhxddj.exe202⤵PID:1688
-
\??\c:\nhjlnnt.exec:\nhjlnnt.exe203⤵PID:3028
-
\??\c:\vtxvxn.exec:\vtxvxn.exe204⤵PID:1120
-
\??\c:\fdfvh.exec:\fdfvh.exe205⤵PID:2844
-
\??\c:\tjtvf.exec:\tjtvf.exe206⤵PID:2836
-
\??\c:\nfljfx.exec:\nfljfx.exe207⤵PID:2856
-
\??\c:\rflft.exec:\rflft.exe208⤵PID:2080
-
\??\c:\rltxtp.exec:\rltxtp.exe209⤵PID:2756
-
\??\c:\lhfdll.exec:\lhfdll.exe210⤵PID:1512
-
\??\c:\jvrtfxr.exec:\jvrtfxr.exe211⤵PID:2108
-
\??\c:\vftldtd.exec:\vftldtd.exe212⤵PID:2272
-
\??\c:\drvvln.exec:\drvvln.exe213⤵PID:2316
-
\??\c:\fxxrf.exec:\fxxrf.exe214⤵PID:2032
-
\??\c:\rfphxr.exec:\rfphxr.exe215⤵PID:440
-
\??\c:\ndbvhxv.exec:\ndbvhxv.exe216⤵PID:2632
-
\??\c:\jtthjjx.exec:\jtthjjx.exe217⤵PID:2584
-
\??\c:\vfxtjv.exec:\vfxtjv.exe218⤵PID:2480
-
\??\c:\rndnx.exec:\rndnx.exe219⤵PID:2700
-
\??\c:\fvtdtfd.exec:\fvtdtfd.exe220⤵PID:2580
-
\??\c:\pljpj.exec:\pljpj.exe221⤵PID:2396
-
\??\c:\jlxvfjd.exec:\jlxvfjd.exe222⤵PID:1156
-
\??\c:\tntnfp.exec:\tntnfp.exe223⤵PID:2424
-
\??\c:\jlvbhf.exec:\jlvbhf.exe224⤵PID:2368
-
\??\c:\tbrbb.exec:\tbrbb.exe225⤵PID:764
-
\??\c:\djtnfb.exec:\djtnfb.exe226⤵PID:2332
-
\??\c:\jrfjdh.exec:\jrfjdh.exe227⤵PID:2328
-
\??\c:\jrdpr.exec:\jrdpr.exe228⤵PID:572
-
\??\c:\rxfvtf.exec:\rxfvtf.exe229⤵PID:836
-
\??\c:\ndhjn.exec:\ndhjn.exe230⤵PID:1708
-
\??\c:\ppfdfhd.exec:\ppfdfhd.exe231⤵PID:1924
-
\??\c:\xjpldd.exec:\xjpldd.exe232⤵PID:2200
-
\??\c:\jjpnfd.exec:\jjpnfd.exe233⤵PID:1112
-
\??\c:\hbdvt.exec:\hbdvt.exe234⤵PID:952
-
\??\c:\vfprvxj.exec:\vfprvxj.exe235⤵PID:1556
-
\??\c:\jbfdp.exec:\jbfdp.exe236⤵PID:1440
-
\??\c:\xdlrj.exec:\xdlrj.exe237⤵PID:1972
-
\??\c:\tlxfl.exec:\tlxfl.exe238⤵PID:1612
-
\??\c:\frtvn.exec:\frtvn.exe239⤵PID:1948
-
\??\c:\tlbjplj.exec:\tlbjplj.exe240⤵PID:2988
-
\??\c:\xprtvpj.exec:\xprtvpj.exe241⤵PID:1080
-
\??\c:\nhbffnt.exec:\nhbffnt.exe242⤵PID:912