Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 16:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f52588c0cb01474ff861e542cdbd6420_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
f52588c0cb01474ff861e542cdbd6420_NeikiAnalytics.exe
-
Size
415KB
-
MD5
f52588c0cb01474ff861e542cdbd6420
-
SHA1
b34470ea39d4aafa98ea346b23240fe9ad83a002
-
SHA256
4750e5f09f460c66f44b018c6452d5f89e4f1d7433ef4410496cd935707d9e57
-
SHA512
b285bca58c69bcaf5e607635fd3e07fc6028e828ac291ad6266cce666bfe718f0cfcee3727625fd18e8d72d6493fc3bad3a897e9b271c4bc4f394d33bd2a7a1a
-
SSDEEP
12288:n3C9ytvngQj4DtvnV9wLn9UTfC8eieJNBNIsYPE:SgdnJUdnV9k
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/2656-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2136-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1296-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/240-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1476-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/704-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1100-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2236-266-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2364-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1560-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1636-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vvpvnd.exejptbp.exenbxlth.exehtflnlt.exefbrrxbj.exenpnnt.exelnlhd.exejpdtb.exexhvvppp.exenxbvb.exepvjljjl.exexrttfp.exedxvhv.exenhxvnhl.exedphxt.exedvrtp.exernxphp.exevbfdjpp.exebvbplh.exevlnjrrp.exehbjdl.exexbrxd.exehxvfb.exevhvnbb.exerjpdplh.exepbndtl.exepxvxdd.exexblvj.exehpbjxbv.exejvtrlt.exehnnft.exelrplbx.exexxtxfb.exejhfbd.exelvvdbh.exellfjvb.exeprdhbx.exefhbrf.exejdlnb.exelljhp.exehxthhv.exejjrpth.exexttxdtl.exebtjnf.exepxbtrrx.exerhdvbb.exethhbdht.exedxfpn.exehjrlj.exetbddx.exelbtprlh.exejdxnx.exehxnvjdn.exelvvjhld.exelpdfj.exefjhdrh.exelplpl.exebhhvnh.exehxpht.exefjtlrp.exelflxp.exefvjtd.exerfpnjpn.exepfpvh.exepid process 2136 vvpvnd.exe 2640 jptbp.exe 3064 nbxlth.exe 2760 htflnlt.exe 2616 fbrrxbj.exe 2416 npnnt.exe 2836 lnlhd.exe 596 jpdtb.exe 1296 xhvvppp.exe 240 nxbvb.exe 2512 pvjljjl.exe 2304 xrttfp.exe 2348 dxvhv.exe 1236 nhxvnhl.exe 1476 dphxt.exe 1620 dvrtp.exe 1100 rnxphp.exe 704 vbfdjpp.exe 1636 bvbplh.exe 2920 vlnjrrp.exe 3036 hbjdl.exe 2976 xbrxd.exe 1892 hxvfb.exe 1496 vhvnbb.exe 1560 rjpdplh.exe 2900 pbndtl.exe 2236 pxvxdd.exe 2036 xblvj.exe 2364 hpbjxbv.exe 2108 jvtrlt.exe 2968 hnnft.exe 1748 lrplbx.exe 2912 xxtxfb.exe 2744 jhfbd.exe 2668 lvvdbh.exe 2556 llfjvb.exe 2664 prdhbx.exe 2636 fhbrf.exe 2700 jdlnb.exe 2528 lljhp.exe 2428 hxthhv.exe 2876 jjrpth.exe 2128 xttxdtl.exe 1084 btjnf.exe 1420 pxbtrrx.exe 684 rhdvbb.exe 2712 thhbdht.exe 240 dxfpn.exe 2732 hjrlj.exe 2248 tbddx.exe 2140 lbtprlh.exe 1952 jdxnx.exe 1844 hxnvjdn.exe 2472 lvvjhld.exe 1804 lpdfj.exe 1116 fjhdrh.exe 1724 lplpl.exe 1792 bhhvnh.exe 2980 hxpht.exe 2920 fjtlrp.exe 3060 lflxp.exe 2916 fvjtd.exe 1248 rfpnjpn.exe 2188 pfpvh.exe -
Processes:
resource yara_rule behavioral1/memory/2656-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2136-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/596-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1296-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/240-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/596-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1476-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/704-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1100-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-266-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2364-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1560-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1636-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-34-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f52588c0cb01474ff861e542cdbd6420_NeikiAnalytics.exevvpvnd.exejptbp.exenbxlth.exehtflnlt.exefbrrxbj.exenpnnt.exelnlhd.exejpdtb.exexhvvppp.exenxbvb.exepvjljjl.exexrttfp.exedxvhv.exenhxvnhl.exedphxt.exedescription pid process target process PID 2656 wrote to memory of 2136 2656 f52588c0cb01474ff861e542cdbd6420_NeikiAnalytics.exe tbndft.exe PID 2656 wrote to memory of 2136 2656 f52588c0cb01474ff861e542cdbd6420_NeikiAnalytics.exe tbndft.exe PID 2656 wrote to memory of 2136 2656 f52588c0cb01474ff861e542cdbd6420_NeikiAnalytics.exe tbndft.exe PID 2656 wrote to memory of 2136 2656 f52588c0cb01474ff861e542cdbd6420_NeikiAnalytics.exe tbndft.exe PID 2136 wrote to memory of 2640 2136 vvpvnd.exe jptbp.exe PID 2136 wrote to memory of 2640 2136 vvpvnd.exe jptbp.exe PID 2136 wrote to memory of 2640 2136 vvpvnd.exe jptbp.exe PID 2136 wrote to memory of 2640 2136 vvpvnd.exe jptbp.exe PID 2640 wrote to memory of 3064 2640 jptbp.exe nbxlth.exe PID 2640 wrote to memory of 3064 2640 jptbp.exe nbxlth.exe PID 2640 wrote to memory of 3064 2640 jptbp.exe nbxlth.exe PID 2640 wrote to memory of 3064 2640 jptbp.exe nbxlth.exe PID 3064 wrote to memory of 2760 3064 nbxlth.exe pdfhphd.exe PID 3064 wrote to memory of 2760 3064 nbxlth.exe pdfhphd.exe PID 3064 wrote to memory of 2760 3064 nbxlth.exe pdfhphd.exe PID 3064 wrote to memory of 2760 3064 nbxlth.exe pdfhphd.exe PID 2760 wrote to memory of 2616 2760 htflnlt.exe fbrrxbj.exe PID 2760 wrote to memory of 2616 2760 htflnlt.exe fbrrxbj.exe PID 2760 wrote to memory of 2616 2760 htflnlt.exe fbrrxbj.exe PID 2760 wrote to memory of 2616 2760 htflnlt.exe fbrrxbj.exe PID 2616 wrote to memory of 2416 2616 fbrrxbj.exe tvrln.exe PID 2616 wrote to memory of 2416 2616 fbrrxbj.exe tvrln.exe PID 2616 wrote to memory of 2416 2616 fbrrxbj.exe tvrln.exe PID 2616 wrote to memory of 2416 2616 fbrrxbj.exe tvrln.exe PID 2416 wrote to memory of 2836 2416 npnnt.exe lnlhd.exe PID 2416 wrote to memory of 2836 2416 npnnt.exe lnlhd.exe PID 2416 wrote to memory of 2836 2416 npnnt.exe lnlhd.exe PID 2416 wrote to memory of 2836 2416 npnnt.exe lnlhd.exe PID 2836 wrote to memory of 596 2836 lnlhd.exe rhhnj.exe PID 2836 wrote to memory of 596 2836 lnlhd.exe rhhnj.exe PID 2836 wrote to memory of 596 2836 lnlhd.exe rhhnj.exe PID 2836 wrote to memory of 596 2836 lnlhd.exe rhhnj.exe PID 596 wrote to memory of 1296 596 jpdtb.exe tfvxj.exe PID 596 wrote to memory of 1296 596 jpdtb.exe tfvxj.exe PID 596 wrote to memory of 1296 596 jpdtb.exe tfvxj.exe PID 596 wrote to memory of 1296 596 jpdtb.exe tfvxj.exe PID 1296 wrote to memory of 240 1296 xhvvppp.exe dxfpn.exe PID 1296 wrote to memory of 240 1296 xhvvppp.exe dxfpn.exe PID 1296 wrote to memory of 240 1296 xhvvppp.exe dxfpn.exe PID 1296 wrote to memory of 240 1296 xhvvppp.exe dxfpn.exe PID 240 wrote to memory of 2512 240 nxbvb.exe lthljbh.exe PID 240 wrote to memory of 2512 240 nxbvb.exe lthljbh.exe PID 240 wrote to memory of 2512 240 nxbvb.exe lthljbh.exe PID 240 wrote to memory of 2512 240 nxbvb.exe lthljbh.exe PID 2512 wrote to memory of 2304 2512 pvjljjl.exe pnhdvf.exe PID 2512 wrote to memory of 2304 2512 pvjljjl.exe pnhdvf.exe PID 2512 wrote to memory of 2304 2512 pvjljjl.exe pnhdvf.exe PID 2512 wrote to memory of 2304 2512 pvjljjl.exe pnhdvf.exe PID 2304 wrote to memory of 2348 2304 xrttfp.exe dxvhv.exe PID 2304 wrote to memory of 2348 2304 xrttfp.exe dxvhv.exe PID 2304 wrote to memory of 2348 2304 xrttfp.exe dxvhv.exe PID 2304 wrote to memory of 2348 2304 xrttfp.exe dxvhv.exe PID 2348 wrote to memory of 1236 2348 dxvhv.exe nhxvnhl.exe PID 2348 wrote to memory of 1236 2348 dxvhv.exe nhxvnhl.exe PID 2348 wrote to memory of 1236 2348 dxvhv.exe nhxvnhl.exe PID 2348 wrote to memory of 1236 2348 dxvhv.exe nhxvnhl.exe PID 1236 wrote to memory of 1476 1236 nhxvnhl.exe dphxt.exe PID 1236 wrote to memory of 1476 1236 nhxvnhl.exe dphxt.exe PID 1236 wrote to memory of 1476 1236 nhxvnhl.exe dphxt.exe PID 1236 wrote to memory of 1476 1236 nhxvnhl.exe dphxt.exe PID 1476 wrote to memory of 1620 1476 dphxt.exe dvrtp.exe PID 1476 wrote to memory of 1620 1476 dphxt.exe dvrtp.exe PID 1476 wrote to memory of 1620 1476 dphxt.exe dvrtp.exe PID 1476 wrote to memory of 1620 1476 dphxt.exe dvrtp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f52588c0cb01474ff861e542cdbd6420_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\f52588c0cb01474ff861e542cdbd6420_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\vvpvnd.exec:\vvpvnd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\jptbp.exec:\jptbp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\nbxlth.exec:\nbxlth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\htflnlt.exec:\htflnlt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\fbrrxbj.exec:\fbrrxbj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\npnnt.exec:\npnnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\lnlhd.exec:\lnlhd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\jpdtb.exec:\jpdtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:596 -
\??\c:\xhvvppp.exec:\xhvvppp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\nxbvb.exec:\nxbvb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
\??\c:\pvjljjl.exec:\pvjljjl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\xrttfp.exec:\xrttfp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\dxvhv.exec:\dxvhv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\nhxvnhl.exec:\nhxvnhl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\dphxt.exec:\dphxt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\dvrtp.exec:\dvrtp.exe17⤵
- Executes dropped EXE
PID:1620 -
\??\c:\rnxphp.exec:\rnxphp.exe18⤵
- Executes dropped EXE
PID:1100 -
\??\c:\vbfdjpp.exec:\vbfdjpp.exe19⤵
- Executes dropped EXE
PID:704 -
\??\c:\bvbplh.exec:\bvbplh.exe20⤵
- Executes dropped EXE
PID:1636 -
\??\c:\vlnjrrp.exec:\vlnjrrp.exe21⤵
- Executes dropped EXE
PID:2920 -
\??\c:\hbjdl.exec:\hbjdl.exe22⤵
- Executes dropped EXE
PID:3036 -
\??\c:\xbrxd.exec:\xbrxd.exe23⤵
- Executes dropped EXE
PID:2976 -
\??\c:\hxvfb.exec:\hxvfb.exe24⤵
- Executes dropped EXE
PID:1892 -
\??\c:\vhvnbb.exec:\vhvnbb.exe25⤵
- Executes dropped EXE
PID:1496 -
\??\c:\rjpdplh.exec:\rjpdplh.exe26⤵
- Executes dropped EXE
PID:1560 -
\??\c:\pbndtl.exec:\pbndtl.exe27⤵
- Executes dropped EXE
PID:2900 -
\??\c:\pxvxdd.exec:\pxvxdd.exe28⤵
- Executes dropped EXE
PID:2236 -
\??\c:\xblvj.exec:\xblvj.exe29⤵
- Executes dropped EXE
PID:2036 -
\??\c:\hpbjxbv.exec:\hpbjxbv.exe30⤵
- Executes dropped EXE
PID:2364 -
\??\c:\jvtrlt.exec:\jvtrlt.exe31⤵
- Executes dropped EXE
PID:2108 -
\??\c:\hnnft.exec:\hnnft.exe32⤵
- Executes dropped EXE
PID:2968 -
\??\c:\lrplbx.exec:\lrplbx.exe33⤵
- Executes dropped EXE
PID:1748 -
\??\c:\xxtxfb.exec:\xxtxfb.exe34⤵
- Executes dropped EXE
PID:2912 -
\??\c:\jhfbd.exec:\jhfbd.exe35⤵
- Executes dropped EXE
PID:2744 -
\??\c:\lvvdbh.exec:\lvvdbh.exe36⤵
- Executes dropped EXE
PID:2668 -
\??\c:\llfjvb.exec:\llfjvb.exe37⤵
- Executes dropped EXE
PID:2556 -
\??\c:\prdhbx.exec:\prdhbx.exe38⤵
- Executes dropped EXE
PID:2664 -
\??\c:\fhbrf.exec:\fhbrf.exe39⤵
- Executes dropped EXE
PID:2636 -
\??\c:\jdlnb.exec:\jdlnb.exe40⤵
- Executes dropped EXE
PID:2700 -
\??\c:\lljhp.exec:\lljhp.exe41⤵
- Executes dropped EXE
PID:2528 -
\??\c:\hxthhv.exec:\hxthhv.exe42⤵
- Executes dropped EXE
PID:2428 -
\??\c:\jjrpth.exec:\jjrpth.exe43⤵
- Executes dropped EXE
PID:2876 -
\??\c:\xttxdtl.exec:\xttxdtl.exe44⤵
- Executes dropped EXE
PID:2128 -
\??\c:\btjnf.exec:\btjnf.exe45⤵
- Executes dropped EXE
PID:1084 -
\??\c:\pxbtrrx.exec:\pxbtrrx.exe46⤵
- Executes dropped EXE
PID:1420 -
\??\c:\rhdvbb.exec:\rhdvbb.exe47⤵
- Executes dropped EXE
PID:684 -
\??\c:\thhbdht.exec:\thhbdht.exe48⤵
- Executes dropped EXE
PID:2712 -
\??\c:\dxfpn.exec:\dxfpn.exe49⤵
- Executes dropped EXE
PID:240 -
\??\c:\hjrlj.exec:\hjrlj.exe50⤵
- Executes dropped EXE
PID:2732 -
\??\c:\tbddx.exec:\tbddx.exe51⤵
- Executes dropped EXE
PID:2248 -
\??\c:\lbtprlh.exec:\lbtprlh.exe52⤵
- Executes dropped EXE
PID:2140 -
\??\c:\jdxnx.exec:\jdxnx.exe53⤵
- Executes dropped EXE
PID:1952 -
\??\c:\hxnvjdn.exec:\hxnvjdn.exe54⤵
- Executes dropped EXE
PID:1844 -
\??\c:\lvvjhld.exec:\lvvjhld.exe55⤵
- Executes dropped EXE
PID:2472 -
\??\c:\lpdfj.exec:\lpdfj.exe56⤵
- Executes dropped EXE
PID:1804 -
\??\c:\fjhdrh.exec:\fjhdrh.exe57⤵
- Executes dropped EXE
PID:1116 -
\??\c:\lplpl.exec:\lplpl.exe58⤵
- Executes dropped EXE
PID:1724 -
\??\c:\bhhvnh.exec:\bhhvnh.exe59⤵
- Executes dropped EXE
PID:1792 -
\??\c:\hxpht.exec:\hxpht.exe60⤵
- Executes dropped EXE
PID:2980 -
\??\c:\fjtlrp.exec:\fjtlrp.exe61⤵
- Executes dropped EXE
PID:2920 -
\??\c:\lflxp.exec:\lflxp.exe62⤵
- Executes dropped EXE
PID:3060 -
\??\c:\fvjtd.exec:\fvjtd.exe63⤵
- Executes dropped EXE
PID:2916 -
\??\c:\rfpnjpn.exec:\rfpnjpn.exe64⤵
- Executes dropped EXE
PID:1248 -
\??\c:\pfpvh.exec:\pfpvh.exe65⤵
- Executes dropped EXE
PID:2188 -
\??\c:\rddvp.exec:\rddvp.exe66⤵PID:980
-
\??\c:\nxtdh.exec:\nxtdh.exe67⤵PID:840
-
\??\c:\lvhllf.exec:\lvhllf.exe68⤵PID:2132
-
\??\c:\jlphx.exec:\jlphx.exe69⤵PID:2236
-
\??\c:\xflvn.exec:\xflvn.exe70⤵PID:268
-
\??\c:\tjdtppd.exec:\tjdtppd.exe71⤵PID:1380
-
\??\c:\jdrhpx.exec:\jdrhpx.exe72⤵PID:2168
-
\??\c:\vflrffj.exec:\vflrffj.exe73⤵PID:1536
-
\??\c:\xvptnt.exec:\xvptnt.exe74⤵PID:2260
-
\??\c:\jbdfd.exec:\jbdfd.exe75⤵PID:2052
-
\??\c:\hrbjplv.exec:\hrbjplv.exe76⤵PID:1708
-
\??\c:\hhrvvf.exec:\hhrvvf.exe77⤵PID:2560
-
\??\c:\nxlhvdl.exec:\nxlhvdl.exe78⤵PID:2136
-
\??\c:\pbbrpt.exec:\pbbrpt.exe79⤵PID:2552
-
\??\c:\txvbnvt.exec:\txvbnvt.exe80⤵PID:2596
-
\??\c:\rhpnl.exec:\rhpnl.exe81⤵PID:2664
-
\??\c:\ndfjnn.exec:\ndfjnn.exe82⤵PID:2624
-
\??\c:\flpxtxp.exec:\flpxtxp.exe83⤵PID:1996
-
\??\c:\hdppptf.exec:\hdppptf.exe84⤵PID:2464
-
\??\c:\jnbdlv.exec:\jnbdlv.exe85⤵PID:2872
-
\??\c:\tvrln.exec:\tvrln.exe86⤵PID:2416
-
\??\c:\vtrnxdv.exec:\vtrnxdv.exe87⤵PID:2488
-
\??\c:\dvddpd.exec:\dvddpd.exe88⤵PID:884
-
\??\c:\djbthl.exec:\djbthl.exe89⤵PID:1200
-
\??\c:\vjptx.exec:\vjptx.exe90⤵PID:1492
-
\??\c:\nfdjbjd.exec:\nfdjbjd.exe91⤵PID:2672
-
\??\c:\ljrvn.exec:\ljrvn.exe92⤵PID:2856
-
\??\c:\nhrhnbp.exec:\nhrhnbp.exe93⤵PID:1852
-
\??\c:\xppjvf.exec:\xppjvf.exe94⤵PID:2512
-
\??\c:\pnhdvf.exec:\pnhdvf.exe95⤵PID:2304
-
\??\c:\jpnrvx.exec:\jpnrvx.exe96⤵PID:2328
-
\??\c:\bvvdbp.exec:\bvvdbp.exe97⤵PID:1912
-
\??\c:\jrbxx.exec:\jrbxx.exe98⤵PID:1908
-
\??\c:\rbrjl.exec:\rbrjl.exe99⤵PID:2172
-
\??\c:\rtpll.exec:\rtpll.exe100⤵PID:1828
-
\??\c:\xhxrdvf.exec:\xhxrdvf.exe101⤵PID:776
-
\??\c:\rfbfln.exec:\rfbfln.exe102⤵PID:2380
-
\??\c:\vlnbthh.exec:\vlnbthh.exe103⤵PID:2180
-
\??\c:\ftdvrnn.exec:\ftdvrnn.exe104⤵PID:2788
-
\??\c:\thtlxvl.exec:\thtlxvl.exe105⤵PID:2952
-
\??\c:\dfxvrrx.exec:\dfxvrrx.exe106⤵PID:3016
-
\??\c:\rbpjd.exec:\rbpjd.exe107⤵PID:3012
-
\??\c:\pnvjlr.exec:\pnvjlr.exe108⤵PID:1488
-
\??\c:\hxpxb.exec:\hxpxb.exe109⤵PID:1824
-
\??\c:\dlpjjfr.exec:\dlpjjfr.exe110⤵PID:1848
-
\??\c:\xrnvthj.exec:\xrnvthj.exe111⤵PID:1652
-
\??\c:\dbppp.exec:\dbppp.exe112⤵PID:1056
-
\??\c:\fffdh.exec:\fffdh.exe113⤵PID:1468
-
\??\c:\prdjtlt.exec:\prdjtlt.exe114⤵PID:1676
-
\??\c:\vppjh.exec:\vppjh.exe115⤵PID:1776
-
\??\c:\rxthxd.exec:\rxthxd.exe116⤵PID:1592
-
\??\c:\dnrdd.exec:\dnrdd.exe117⤵PID:2124
-
\??\c:\rhhhjv.exec:\rhhhjv.exe118⤵PID:2112
-
\??\c:\nnjtpvv.exec:\nnjtpvv.exe119⤵PID:2816
-
\??\c:\hpbhd.exec:\hpbhd.exe120⤵PID:2832
-
\??\c:\jlnjl.exec:\jlnjl.exe121⤵PID:2560
-
\??\c:\tbndft.exec:\tbndft.exe122⤵PID:2136
-
\??\c:\xxrxr.exec:\xxrxr.exe123⤵PID:2552
-
\??\c:\nxbjhvb.exec:\nxbjhvb.exe124⤵PID:2596
-
\??\c:\rxtnrx.exec:\rxtnrx.exe125⤵PID:2940
-
\??\c:\jltrffh.exec:\jltrffh.exe126⤵PID:2764
-
\??\c:\lfbdj.exec:\lfbdj.exe127⤵PID:2584
-
\??\c:\vtbpxht.exec:\vtbpxht.exe128⤵PID:2448
-
\??\c:\pdfhphd.exec:\pdfhphd.exe129⤵PID:2760
-
\??\c:\dvhrh.exec:\dvhrh.exe130⤵PID:2432
-
\??\c:\rntpjrl.exec:\rntpjrl.exe131⤵PID:2128
-
\??\c:\vxvjr.exec:\vxvjr.exe132⤵PID:2608
-
\??\c:\njnrxdx.exec:\njnrxdx.exe133⤵PID:1084
-
\??\c:\vhftl.exec:\vhftl.exe134⤵PID:1304
-
\??\c:\htllbb.exec:\htllbb.exe135⤵PID:2576
-
\??\c:\dpjbp.exec:\dpjbp.exe136⤵PID:2080
-
\??\c:\npfdpvh.exec:\npfdpvh.exe137⤵PID:2716
-
\??\c:\lthljbh.exec:\lthljbh.exe138⤵PID:2512
-
\??\c:\blrnppr.exec:\blrnppr.exe139⤵PID:1920
-
\??\c:\rjvbldx.exec:\rjvbldx.exe140⤵PID:2328
-
\??\c:\lprhdr.exec:\lprhdr.exe141⤵PID:2280
-
\??\c:\hrrbjf.exec:\hrrbjf.exe142⤵PID:1908
-
\??\c:\lfnhdfx.exec:\lfnhdfx.exe143⤵PID:2172
-
\??\c:\vdlfvn.exec:\vdlfvn.exe144⤵PID:1828
-
\??\c:\pfnjbvl.exec:\pfnjbvl.exe145⤵PID:776
-
\??\c:\lfjtb.exec:\lfjtb.exe146⤵PID:1724
-
\??\c:\bpdhjvd.exec:\bpdhjvd.exe147⤵PID:1792
-
\??\c:\jtdhrhn.exec:\jtdhrhn.exe148⤵PID:2588
-
\??\c:\dpjdxx.exec:\dpjdxx.exe149⤵PID:2920
-
\??\c:\nrdnbj.exec:\nrdnbj.exe150⤵PID:1892
-
\??\c:\nhxvhlj.exec:\nhxvhlj.exe151⤵PID:2916
-
\??\c:\jxhxbbv.exec:\jxhxbbv.exe152⤵PID:1248
-
\??\c:\jvhhjjj.exec:\jvhhjjj.exe153⤵PID:2188
-
\??\c:\pxhhhx.exec:\pxhhhx.exe154⤵PID:2244
-
\??\c:\nvpjjdh.exec:\nvpjjdh.exe155⤵PID:840
-
\??\c:\lvdlj.exec:\lvdlj.exe156⤵PID:2036
-
\??\c:\hpfhn.exec:\hpfhn.exe157⤵PID:1468
-
\??\c:\ppjjdf.exec:\ppjjdf.exe158⤵PID:1320
-
\??\c:\pdbdr.exec:\pdbdr.exe159⤵PID:2196
-
\??\c:\vbxxvnr.exec:\vbxxvnr.exe160⤵PID:2200
-
\??\c:\lftbrb.exec:\lftbrb.exe161⤵PID:2124
-
\??\c:\jvnfb.exec:\jvnfb.exe162⤵PID:2112
-
\??\c:\hxdxhnr.exec:\hxdxhnr.exe163⤵PID:2052
-
\??\c:\tbbfd.exec:\tbbfd.exe164⤵PID:1708
-
\??\c:\xvftnlr.exec:\xvftnlr.exe165⤵PID:2644
-
\??\c:\tpntnjh.exec:\tpntnjh.exe166⤵PID:2320
-
\??\c:\nbrxtl.exec:\nbrxtl.exe167⤵PID:1736
-
\??\c:\jhhjfp.exec:\jhhjfp.exe168⤵PID:1928
-
\??\c:\hprlbp.exec:\hprlbp.exe169⤵PID:2008
-
\??\c:\htltdft.exec:\htltdft.exe170⤵PID:2624
-
\??\c:\nltftf.exec:\nltftf.exe171⤵PID:1996
-
\??\c:\hftvjn.exec:\hftvjn.exe172⤵PID:2464
-
\??\c:\lvjtdfv.exec:\lvjtdfv.exe173⤵PID:2872
-
\??\c:\bxdvxdx.exec:\bxdvxdx.exe174⤵PID:488
-
\??\c:\lrbhld.exec:\lrbhld.exe175⤵PID:2392
-
\??\c:\tfvxj.exec:\tfvxj.exe176⤵PID:1296
-
\??\c:\xxprpp.exec:\xxprpp.exe177⤵PID:2728
-
\??\c:\nntnxl.exec:\nntnxl.exe178⤵PID:2452
-
\??\c:\hvbjrv.exec:\hvbjrv.exe179⤵PID:788
-
\??\c:\prbhrxf.exec:\prbhrxf.exe180⤵PID:1156
-
\??\c:\hxbfnx.exec:\hxbfnx.exe181⤵PID:2732
-
\??\c:\fjlbrxd.exec:\fjlbrxd.exe182⤵PID:1272
-
\??\c:\xrrtb.exec:\xrrtb.exe183⤵PID:2140
-
\??\c:\jjfbd.exec:\jjfbd.exe184⤵PID:1680
-
\??\c:\dlhbjfb.exec:\dlhbjfb.exe185⤵PID:1844
-
\??\c:\nrxjrnv.exec:\nrxjrnv.exe186⤵PID:2472
-
\??\c:\dphdnvp.exec:\dphdnvp.exe187⤵PID:1804
-
\??\c:\hnldpn.exec:\hnldpn.exe188⤵PID:1712
-
\??\c:\vvbjh.exec:\vvbjh.exe189⤵PID:3044
-
\??\c:\ltvllld.exec:\ltvllld.exe190⤵PID:2980
-
\??\c:\lbptxb.exec:\lbptxb.exe191⤵PID:2792
-
\??\c:\nbhbj.exec:\nbhbj.exe192⤵PID:3060
-
\??\c:\thjfbhd.exec:\thjfbhd.exe193⤵PID:3024
-
\??\c:\npdfbtt.exec:\npdfbtt.exe194⤵PID:2784
-
\??\c:\bjjjbbf.exec:\bjjjbbf.exe195⤵PID:2276
-
\??\c:\txfnhb.exec:\txfnhb.exe196⤵PID:2904
-
\??\c:\lhxnjp.exec:\lhxnjp.exe197⤵PID:868
-
\??\c:\dvrljnt.exec:\dvrljnt.exe198⤵PID:648
-
\??\c:\frbvl.exec:\frbvl.exe199⤵PID:908
-
\??\c:\rrdnnxr.exec:\rrdnnxr.exe200⤵PID:1780
-
\??\c:\nbtrpxh.exec:\nbtrpxh.exe201⤵PID:1180
-
\??\c:\xlvlv.exec:\xlvlv.exe202⤵PID:1756
-
\??\c:\fndlj.exec:\fndlj.exe203⤵PID:2400
-
\??\c:\hxvlxbn.exec:\hxvlxbn.exe204⤵PID:1536
-
\??\c:\vhjrtn.exec:\vhjrtn.exe205⤵PID:2260
-
\??\c:\hdprt.exec:\hdprt.exe206⤵PID:1020
-
\??\c:\ndxrx.exec:\ndxrx.exe207⤵PID:2520
-
\??\c:\tjpnlvp.exec:\tjpnlvp.exe208⤵PID:2648
-
\??\c:\jjdlrl.exec:\jjdlrl.exe209⤵PID:2628
-
\??\c:\njjrfhr.exec:\njjrfhr.exe210⤵PID:2536
-
\??\c:\vhvlfjx.exec:\vhvlfjx.exe211⤵PID:2664
-
\??\c:\bnhtd.exec:\bnhtd.exe212⤵PID:1976
-
\??\c:\rhhlnt.exec:\rhhlnt.exe213⤵PID:2740
-
\??\c:\bnbdb.exec:\bnbdb.exe214⤵PID:2456
-
\??\c:\tvplpv.exec:\tvplpv.exe215⤵PID:2852
-
\??\c:\phhhdf.exec:\phhhdf.exe216⤵PID:372
-
\??\c:\xbpjjp.exec:\xbpjjp.exe217⤵PID:1000
-
\??\c:\rhhnj.exec:\rhhnj.exe218⤵PID:596
-
\??\c:\drtlnf.exec:\drtlnf.exe219⤵PID:1428
-
\??\c:\pnbvdv.exec:\pnbvdv.exe220⤵PID:2352
-
\??\c:\jrrdfvj.exec:\jrrdfvj.exe221⤵PID:2480
-
\??\c:\vdhjvr.exec:\vdhjvr.exe222⤵PID:2004
-
\??\c:\nbtrt.exec:\nbtrt.exe223⤵PID:1932
-
\??\c:\nplrrpl.exec:\nplrrpl.exe224⤵PID:896
-
\??\c:\hnthjb.exec:\hnthjb.exe225⤵PID:2864
-
\??\c:\xbvdpdx.exec:\xbvdpdx.exe226⤵PID:1936
-
\??\c:\bhvlfp.exec:\bhvlfp.exe227⤵PID:1648
-
\??\c:\lbttt.exec:\lbttt.exe228⤵PID:620
-
\??\c:\ppdlbb.exec:\ppdlbb.exe229⤵PID:1104
-
\??\c:\jbhbv.exec:\jbhbv.exe230⤵PID:2000
-
\??\c:\nvjnb.exec:\nvjnb.exe231⤵PID:2928
-
\??\c:\jpxjnn.exec:\jpxjnn.exe232⤵PID:2508
-
\??\c:\rrlffhh.exec:\rrlffhh.exe233⤵PID:1632
-
\??\c:\jdxblnd.exec:\jdxblnd.exe234⤵PID:1268
-
\??\c:\hflnp.exec:\hflnp.exe235⤵PID:1068
-
\??\c:\ddfnln.exec:\ddfnln.exe236⤵PID:2976
-
\??\c:\ptnjlr.exec:\ptnjlr.exe237⤵PID:1124
-
\??\c:\phhbhx.exec:\phhbhx.exe238⤵PID:844
-
\??\c:\bhftdlx.exec:\bhftdlx.exe239⤵PID:1600
-
\??\c:\bnnvpd.exec:\bnnvpd.exe240⤵PID:1544
-
\??\c:\tdnth.exec:\tdnth.exe241⤵PID:1080
-
\??\c:\rpnhb.exec:\rpnhb.exe242⤵PID:2132