Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 21:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3be462088e11d1e869b355f05ace8940_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
3be462088e11d1e869b355f05ace8940_NeikiAnalytics.exe
-
Size
389KB
-
MD5
3be462088e11d1e869b355f05ace8940
-
SHA1
526463e43ceb8357827f531308cc2927ad2d8900
-
SHA256
8e5b51e59463be1f46a438fddfe9077fc3bd19dabc5de2d64b195ded216956c3
-
SHA512
421fabba0fa571ec349c7747d68093b63378ba09f2fcfa2726c981c58fe7d77f2590d0559615731a933b770f6a6bdb2b928799c5ee7de00d0307deeb8af29c2f
-
SSDEEP
12288:n3C9ytvngQjpUXoSWlnwJv90aKToFqwfC:SgdnJVU4TlnwJ6Gor
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/3012-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/380-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/972-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2008-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1120-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1316-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/932-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2936-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1072-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1700-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
tvtnrjd.exexthbp.exeljdfdjf.exevdfxnhb.exepbxhlr.exevtjtlr.exetfpljx.exedxlrdtp.exevjnlp.exelnxpv.exejrlhjl.exennljl.exevlblld.exexvldld.exetlndxxn.exetjvnfb.exerjrjhfj.exefbbdfj.exevlhfxpn.exelpnfxth.exelvddb.exehlllhbx.exefrjljh.exeljtvlnn.exexjptp.exexjttjbf.exelnxxb.exernnllfj.exenlrtjp.exexlnbfp.exeppvnbd.exexxdpn.exejfrxjbb.exefjhtdh.exejjhbr.exedrltv.exelfnvftj.exenxdjtrr.exevxtflnt.exelhxlfp.exepflthr.exehhbbn.exerdvrldl.exefvrrnpj.exexfthdj.exevxbrppd.exetfhtjfd.exehjphxl.exeddbfh.exedvftrn.exebppnx.exeljvhthj.exejnfbdrb.exefpdfl.exejpnnp.exehnnrjp.exehnvbxhp.exelrldtdb.exepprxtb.exerfrtx.exepxdjnx.exelbfprld.exevnhbp.exevpfbbpp.exepid process 2148 tvtnrjd.exe 2564 xthbp.exe 2768 ljdfdjf.exe 2524 vdfxnhb.exe 2884 pbxhlr.exe 2436 vtjtlr.exe 3024 tfpljx.exe 380 dxlrdtp.exe 972 vjnlp.exe 1584 lnxpv.exe 2856 jrlhjl.exe 1452 nnljl.exe 2008 vlblld.exe 2252 xvldld.exe 1120 tlndxxn.exe 1988 tjvnfb.exe 2668 rjrjhfj.exe 2348 fbbdfj.exe 1316 vlhfxpn.exe 932 lpnfxth.exe 2936 lvddb.exe 2052 hlllhbx.exe 2776 frjljh.exe 1072 ljtvlnn.exe 1700 xjptp.exe 1332 xjttjbf.exe 1788 lnxxb.exe 1872 rnnllfj.exe 2036 nlrtjp.exe 3068 xlnbfp.exe 2016 ppvnbd.exe 1744 xxdpn.exe 888 jfrxjbb.exe 2332 fjhtdh.exe 2996 jjhbr.exe 2604 drltv.exe 2564 lfnvftj.exe 1612 nxdjtrr.exe 2688 vxtflnt.exe 2720 lhxlfp.exe 2432 pflthr.exe 2636 hhbbn.exe 2476 rdvrldl.exe 2448 fvrrnpj.exe 1716 xfthdj.exe 2876 vxbrppd.exe 1040 tfhtjfd.exe 676 hjphxl.exe 1568 ddbfh.exe 2840 dvftrn.exe 2864 bppnx.exe 1452 ljvhthj.exe 1960 jnfbdrb.exe 1852 fpdfl.exe 1084 jpnnp.exe 1120 hnnrjp.exe 656 hnvbxhp.exe 2344 lrldtdb.exe 1108 pprxtb.exe 1476 rfrtx.exe 1316 pxdjnx.exe 1748 lbfprld.exe 2116 vnhbp.exe 2764 vpfbbpp.exe -
Processes:
resource yara_rule behavioral1/memory/3012-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/380-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/380-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/380-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/972-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1120-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1316-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/932-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1072-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1700-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-293-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3be462088e11d1e869b355f05ace8940_NeikiAnalytics.exetvtnrjd.exexthbp.exeljdfdjf.exevdfxnhb.exepbxhlr.exevtjtlr.exetfpljx.exedxlrdtp.exevjnlp.exelnxpv.exejrlhjl.exennljl.exevlblld.exexvldld.exetlndxxn.exedescription pid process target process PID 3012 wrote to memory of 2148 3012 3be462088e11d1e869b355f05ace8940_NeikiAnalytics.exe tvtnrjd.exe PID 3012 wrote to memory of 2148 3012 3be462088e11d1e869b355f05ace8940_NeikiAnalytics.exe tvtnrjd.exe PID 3012 wrote to memory of 2148 3012 3be462088e11d1e869b355f05ace8940_NeikiAnalytics.exe tvtnrjd.exe PID 3012 wrote to memory of 2148 3012 3be462088e11d1e869b355f05ace8940_NeikiAnalytics.exe tvtnrjd.exe PID 2148 wrote to memory of 2564 2148 tvtnrjd.exe xthbp.exe PID 2148 wrote to memory of 2564 2148 tvtnrjd.exe xthbp.exe PID 2148 wrote to memory of 2564 2148 tvtnrjd.exe xthbp.exe PID 2148 wrote to memory of 2564 2148 tvtnrjd.exe xthbp.exe PID 2564 wrote to memory of 2768 2564 xthbp.exe ljdfdjf.exe PID 2564 wrote to memory of 2768 2564 xthbp.exe ljdfdjf.exe PID 2564 wrote to memory of 2768 2564 xthbp.exe ljdfdjf.exe PID 2564 wrote to memory of 2768 2564 xthbp.exe ljdfdjf.exe PID 2768 wrote to memory of 2524 2768 ljdfdjf.exe vdfxnhb.exe PID 2768 wrote to memory of 2524 2768 ljdfdjf.exe vdfxnhb.exe PID 2768 wrote to memory of 2524 2768 ljdfdjf.exe vdfxnhb.exe PID 2768 wrote to memory of 2524 2768 ljdfdjf.exe vdfxnhb.exe PID 2524 wrote to memory of 2884 2524 vdfxnhb.exe pbxhlr.exe PID 2524 wrote to memory of 2884 2524 vdfxnhb.exe pbxhlr.exe PID 2524 wrote to memory of 2884 2524 vdfxnhb.exe pbxhlr.exe PID 2524 wrote to memory of 2884 2524 vdfxnhb.exe pbxhlr.exe PID 2884 wrote to memory of 2436 2884 pbxhlr.exe vtjtlr.exe PID 2884 wrote to memory of 2436 2884 pbxhlr.exe vtjtlr.exe PID 2884 wrote to memory of 2436 2884 pbxhlr.exe vtjtlr.exe PID 2884 wrote to memory of 2436 2884 pbxhlr.exe vtjtlr.exe PID 2436 wrote to memory of 3024 2436 vtjtlr.exe tfpljx.exe PID 2436 wrote to memory of 3024 2436 vtjtlr.exe tfpljx.exe PID 2436 wrote to memory of 3024 2436 vtjtlr.exe tfpljx.exe PID 2436 wrote to memory of 3024 2436 vtjtlr.exe tfpljx.exe PID 3024 wrote to memory of 380 3024 tfpljx.exe dxlrdtp.exe PID 3024 wrote to memory of 380 3024 tfpljx.exe dxlrdtp.exe PID 3024 wrote to memory of 380 3024 tfpljx.exe dxlrdtp.exe PID 3024 wrote to memory of 380 3024 tfpljx.exe dxlrdtp.exe PID 380 wrote to memory of 972 380 dxlrdtp.exe vjnlp.exe PID 380 wrote to memory of 972 380 dxlrdtp.exe vjnlp.exe PID 380 wrote to memory of 972 380 dxlrdtp.exe vjnlp.exe PID 380 wrote to memory of 972 380 dxlrdtp.exe vjnlp.exe PID 972 wrote to memory of 1584 972 vjnlp.exe lnxpv.exe PID 972 wrote to memory of 1584 972 vjnlp.exe lnxpv.exe PID 972 wrote to memory of 1584 972 vjnlp.exe lnxpv.exe PID 972 wrote to memory of 1584 972 vjnlp.exe lnxpv.exe PID 1584 wrote to memory of 2856 1584 lnxpv.exe jrlhjl.exe PID 1584 wrote to memory of 2856 1584 lnxpv.exe jrlhjl.exe PID 1584 wrote to memory of 2856 1584 lnxpv.exe jrlhjl.exe PID 1584 wrote to memory of 2856 1584 lnxpv.exe jrlhjl.exe PID 2856 wrote to memory of 1452 2856 jrlhjl.exe nnljl.exe PID 2856 wrote to memory of 1452 2856 jrlhjl.exe nnljl.exe PID 2856 wrote to memory of 1452 2856 jrlhjl.exe nnljl.exe PID 2856 wrote to memory of 1452 2856 jrlhjl.exe nnljl.exe PID 1452 wrote to memory of 2008 1452 nnljl.exe vlblld.exe PID 1452 wrote to memory of 2008 1452 nnljl.exe vlblld.exe PID 1452 wrote to memory of 2008 1452 nnljl.exe vlblld.exe PID 1452 wrote to memory of 2008 1452 nnljl.exe vlblld.exe PID 2008 wrote to memory of 2252 2008 vlblld.exe xvldld.exe PID 2008 wrote to memory of 2252 2008 vlblld.exe xvldld.exe PID 2008 wrote to memory of 2252 2008 vlblld.exe xvldld.exe PID 2008 wrote to memory of 2252 2008 vlblld.exe xvldld.exe PID 2252 wrote to memory of 1120 2252 xvldld.exe tlndxxn.exe PID 2252 wrote to memory of 1120 2252 xvldld.exe tlndxxn.exe PID 2252 wrote to memory of 1120 2252 xvldld.exe tlndxxn.exe PID 2252 wrote to memory of 1120 2252 xvldld.exe tlndxxn.exe PID 1120 wrote to memory of 1988 1120 tlndxxn.exe tjvnfb.exe PID 1120 wrote to memory of 1988 1120 tlndxxn.exe tjvnfb.exe PID 1120 wrote to memory of 1988 1120 tlndxxn.exe tjvnfb.exe PID 1120 wrote to memory of 1988 1120 tlndxxn.exe tjvnfb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3be462088e11d1e869b355f05ace8940_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3be462088e11d1e869b355f05ace8940_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\tvtnrjd.exec:\tvtnrjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\xthbp.exec:\xthbp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\ljdfdjf.exec:\ljdfdjf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\vdfxnhb.exec:\vdfxnhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\pbxhlr.exec:\pbxhlr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\vtjtlr.exec:\vtjtlr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\tfpljx.exec:\tfpljx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\dxlrdtp.exec:\dxlrdtp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\vjnlp.exec:\vjnlp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\lnxpv.exec:\lnxpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\jrlhjl.exec:\jrlhjl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\nnljl.exec:\nnljl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\vlblld.exec:\vlblld.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\xvldld.exec:\xvldld.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\tlndxxn.exec:\tlndxxn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\tjvnfb.exec:\tjvnfb.exe17⤵
- Executes dropped EXE
PID:1988 -
\??\c:\rjrjhfj.exec:\rjrjhfj.exe18⤵
- Executes dropped EXE
PID:2668 -
\??\c:\fbbdfj.exec:\fbbdfj.exe19⤵
- Executes dropped EXE
PID:2348 -
\??\c:\vlhfxpn.exec:\vlhfxpn.exe20⤵
- Executes dropped EXE
PID:1316 -
\??\c:\lpnfxth.exec:\lpnfxth.exe21⤵
- Executes dropped EXE
PID:932 -
\??\c:\lvddb.exec:\lvddb.exe22⤵
- Executes dropped EXE
PID:2936 -
\??\c:\hlllhbx.exec:\hlllhbx.exe23⤵
- Executes dropped EXE
PID:2052 -
\??\c:\frjljh.exec:\frjljh.exe24⤵
- Executes dropped EXE
PID:2776 -
\??\c:\ljtvlnn.exec:\ljtvlnn.exe25⤵
- Executes dropped EXE
PID:1072 -
\??\c:\xjptp.exec:\xjptp.exe26⤵
- Executes dropped EXE
PID:1700 -
\??\c:\xjttjbf.exec:\xjttjbf.exe27⤵
- Executes dropped EXE
PID:1332 -
\??\c:\lnxxb.exec:\lnxxb.exe28⤵
- Executes dropped EXE
PID:1788 -
\??\c:\rnnllfj.exec:\rnnllfj.exe29⤵
- Executes dropped EXE
PID:1872 -
\??\c:\nlrtjp.exec:\nlrtjp.exe30⤵
- Executes dropped EXE
PID:2036 -
\??\c:\xlnbfp.exec:\xlnbfp.exe31⤵
- Executes dropped EXE
PID:3068 -
\??\c:\ppvnbd.exec:\ppvnbd.exe32⤵
- Executes dropped EXE
PID:2016 -
\??\c:\xxdpn.exec:\xxdpn.exe33⤵
- Executes dropped EXE
PID:1744 -
\??\c:\jfrxjbb.exec:\jfrxjbb.exe34⤵
- Executes dropped EXE
PID:888 -
\??\c:\fjhtdh.exec:\fjhtdh.exe35⤵
- Executes dropped EXE
PID:2332 -
\??\c:\jjhbr.exec:\jjhbr.exe36⤵
- Executes dropped EXE
PID:2996 -
\??\c:\drltv.exec:\drltv.exe37⤵
- Executes dropped EXE
PID:2604 -
\??\c:\lfnvftj.exec:\lfnvftj.exe38⤵
- Executes dropped EXE
PID:2564 -
\??\c:\nxdjtrr.exec:\nxdjtrr.exe39⤵
- Executes dropped EXE
PID:1612 -
\??\c:\vxtflnt.exec:\vxtflnt.exe40⤵
- Executes dropped EXE
PID:2688 -
\??\c:\lhxlfp.exec:\lhxlfp.exe41⤵
- Executes dropped EXE
PID:2720 -
\??\c:\pflthr.exec:\pflthr.exe42⤵
- Executes dropped EXE
PID:2432 -
\??\c:\hhbbn.exec:\hhbbn.exe43⤵
- Executes dropped EXE
PID:2636 -
\??\c:\rdvrldl.exec:\rdvrldl.exe44⤵
- Executes dropped EXE
PID:2476 -
\??\c:\fvrrnpj.exec:\fvrrnpj.exe45⤵
- Executes dropped EXE
PID:2448 -
\??\c:\xfthdj.exec:\xfthdj.exe46⤵
- Executes dropped EXE
PID:1716 -
\??\c:\vxbrppd.exec:\vxbrppd.exe47⤵
- Executes dropped EXE
PID:2876 -
\??\c:\tfhtjfd.exec:\tfhtjfd.exe48⤵
- Executes dropped EXE
PID:1040 -
\??\c:\hjphxl.exec:\hjphxl.exe49⤵
- Executes dropped EXE
PID:676 -
\??\c:\ddbfh.exec:\ddbfh.exe50⤵
- Executes dropped EXE
PID:1568 -
\??\c:\dvftrn.exec:\dvftrn.exe51⤵
- Executes dropped EXE
PID:2840 -
\??\c:\bppnx.exec:\bppnx.exe52⤵
- Executes dropped EXE
PID:2864 -
\??\c:\ljvhthj.exec:\ljvhthj.exe53⤵
- Executes dropped EXE
PID:1452 -
\??\c:\jnfbdrb.exec:\jnfbdrb.exe54⤵
- Executes dropped EXE
PID:1960 -
\??\c:\fpdfl.exec:\fpdfl.exe55⤵
- Executes dropped EXE
PID:1852 -
\??\c:\jpnnp.exec:\jpnnp.exe56⤵
- Executes dropped EXE
PID:1084 -
\??\c:\hnnrjp.exec:\hnnrjp.exe57⤵
- Executes dropped EXE
PID:1120 -
\??\c:\hnvbxhp.exec:\hnvbxhp.exe58⤵
- Executes dropped EXE
PID:656 -
\??\c:\lrldtdb.exec:\lrldtdb.exe59⤵
- Executes dropped EXE
PID:2344 -
\??\c:\pprxtb.exec:\pprxtb.exe60⤵
- Executes dropped EXE
PID:1108 -
\??\c:\rfrtx.exec:\rfrtx.exe61⤵
- Executes dropped EXE
PID:1476 -
\??\c:\pxdjnx.exec:\pxdjnx.exe62⤵
- Executes dropped EXE
PID:1316 -
\??\c:\lbfprld.exec:\lbfprld.exe63⤵
- Executes dropped EXE
PID:1748 -
\??\c:\vnhbp.exec:\vnhbp.exe64⤵
- Executes dropped EXE
PID:2116 -
\??\c:\vpfbbpp.exec:\vpfbbpp.exe65⤵
- Executes dropped EXE
PID:2764 -
\??\c:\jrjjttb.exec:\jrjjttb.exe66⤵PID:1812
-
\??\c:\ltnbpln.exec:\ltnbpln.exe67⤵PID:436
-
\??\c:\bvpvlht.exec:\bvpvlht.exe68⤵PID:2272
-
\??\c:\rxlbdnn.exec:\rxlbdnn.exe69⤵PID:2044
-
\??\c:\rrlrfh.exec:\rrlrfh.exe70⤵PID:1036
-
\??\c:\rjtnp.exec:\rjtnp.exe71⤵PID:1328
-
\??\c:\dhfldl.exec:\dhfldl.exe72⤵PID:1076
-
\??\c:\pnnjl.exec:\pnnjl.exe73⤵PID:616
-
\??\c:\nbjtjrb.exec:\nbjtjrb.exe74⤵PID:956
-
\??\c:\nrnxtd.exec:\nrnxtd.exe75⤵PID:1996
-
\??\c:\nfvdtfn.exec:\nfvdtfn.exe76⤵PID:2788
-
\??\c:\bxlnxrr.exec:\bxlnxrr.exe77⤵PID:884
-
\??\c:\ttdhdlt.exec:\ttdhdlt.exe78⤵PID:1604
-
\??\c:\pxntftl.exec:\pxntftl.exe79⤵PID:2156
-
\??\c:\vldvxrf.exec:\vldvxrf.exe80⤵PID:1256
-
\??\c:\lrbhrrn.exec:\lrbhrrn.exe81⤵PID:2908
-
\??\c:\bvvpl.exec:\bvvpl.exe82⤵PID:2560
-
\??\c:\xtlbpd.exec:\xtlbpd.exe83⤵PID:2604
-
\??\c:\xlnrv.exec:\xlnrv.exe84⤵PID:2564
-
\??\c:\rxvhd.exec:\rxvhd.exe85⤵PID:2412
-
\??\c:\prjnrn.exec:\prjnrn.exe86⤵PID:2580
-
\??\c:\xjjrx.exec:\xjjrx.exe87⤵PID:2568
-
\??\c:\rhrfpdx.exec:\rhrfpdx.exe88⤵PID:2432
-
\??\c:\fptrl.exec:\fptrl.exe89⤵PID:2480
-
\??\c:\txbtbbn.exec:\txbtbbn.exe90⤵PID:1640
-
\??\c:\bxltb.exec:\bxltb.exe91⤵PID:2832
-
\??\c:\nhtjpl.exec:\nhtjpl.exe92⤵PID:584
-
\??\c:\lpxfvp.exec:\lpxfvp.exe93⤵PID:2876
-
\??\c:\htlnlv.exec:\htlnlv.exe94⤵PID:556
-
\??\c:\vbfxfj.exec:\vbfxfj.exe95⤵PID:2536
-
\??\c:\bxlrl.exec:\bxlrl.exe96⤵PID:2724
-
\??\c:\dfdrh.exec:\dfdrh.exe97⤵PID:2840
-
\??\c:\brnlfhx.exec:\brnlfhx.exe98⤵PID:1660
-
\??\c:\vppptvb.exec:\vppptvb.exe99⤵PID:1628
-
\??\c:\ndbfrd.exec:\ndbfrd.exe100⤵PID:1832
-
\??\c:\phljtf.exec:\phljtf.exe101⤵PID:1956
-
\??\c:\plrrj.exec:\plrrj.exe102⤵PID:2708
-
\??\c:\fjfdv.exec:\fjfdv.exe103⤵PID:1820
-
\??\c:\thntbp.exec:\thntbp.exe104⤵PID:656
-
\??\c:\plhdfd.exec:\plhdfd.exe105⤵PID:1104
-
\??\c:\xvlfh.exec:\xvlfh.exe106⤵PID:2296
-
\??\c:\xbhrf.exec:\xbhrf.exe107⤵PID:2188
-
\??\c:\lhdlhpp.exec:\lhdlhpp.exe108⤵PID:2128
-
\??\c:\trndfll.exec:\trndfll.exe109⤵PID:2984
-
\??\c:\hbljprp.exec:\hbljprp.exe110⤵PID:516
-
\??\c:\vbnplpt.exec:\vbnplpt.exe111⤵PID:1560
-
\??\c:\jhtddxh.exec:\jhtddxh.exe112⤵PID:2180
-
\??\c:\jrhbjx.exec:\jrhbjx.exe113⤵PID:1828
-
\??\c:\ttfnp.exec:\ttfnp.exe114⤵PID:2272
-
\??\c:\pdxfljf.exec:\pdxfljf.exe115⤵PID:1520
-
\??\c:\bvbbr.exec:\bvbbr.exe116⤵PID:1152
-
\??\c:\bhrbjht.exec:\bhrbjht.exe117⤵PID:2748
-
\??\c:\tprfdxx.exec:\tprfdxx.exe118⤵PID:1352
-
\??\c:\xppxftd.exec:\xppxftd.exe119⤵PID:1264
-
\??\c:\rxdbt.exec:\rxdbt.exe120⤵PID:3068
-
\??\c:\rpjjvvr.exec:\rpjjvvr.exe121⤵PID:1992
-
\??\c:\ldvlfpd.exec:\ldvlfpd.exe122⤵PID:2788
-
\??\c:\rjxvxd.exec:\rjxvxd.exe123⤵PID:1608
-
\??\c:\njnbvfp.exec:\njnbvfp.exe124⤵PID:2600
-
\??\c:\lhjhpvr.exec:\lhjhpvr.exe125⤵PID:2692
-
\??\c:\bfdjdxt.exec:\bfdjdxt.exe126⤵PID:2996
-
\??\c:\pxhrxj.exec:\pxhrxj.exe127⤵PID:2552
-
\??\c:\rxtpp.exec:\rxtpp.exe128⤵PID:1552
-
\??\c:\hxfft.exec:\hxfft.exe129⤵PID:2624
-
\??\c:\fbndvh.exec:\fbndvh.exe130⤵PID:2684
-
\??\c:\hhtrj.exec:\hhtrj.exe131⤵PID:2720
-
\??\c:\tvlhb.exec:\tvlhb.exe132⤵PID:2416
-
\??\c:\pvhrdfx.exec:\pvhrdfx.exe133⤵PID:2636
-
\??\c:\frbtf.exec:\frbtf.exe134⤵PID:2544
-
\??\c:\vbpftj.exec:\vbpftj.exe135⤵PID:2448
-
\??\c:\vtjnpp.exec:\vtjnpp.exe136⤵PID:2056
-
\??\c:\nxdvxll.exec:\nxdvxll.exe137⤵PID:468
-
\??\c:\dhfprn.exec:\dhfprn.exe138⤵PID:592
-
\??\c:\nvddv.exec:\nvddv.exe139⤵PID:564
-
\??\c:\jxfbjp.exec:\jxfbjp.exe140⤵PID:1360
-
\??\c:\prbfl.exec:\prbfl.exe141⤵PID:3060
-
\??\c:\dxxlpb.exec:\dxxlpb.exe142⤵PID:1636
-
\??\c:\lphfpj.exec:\lphfpj.exe143⤵PID:1664
-
\??\c:\lhfvfxv.exec:\lhfvfxv.exe144⤵PID:944
-
\??\c:\hpltl.exec:\hpltl.exe145⤵PID:2168
-
\??\c:\fnjthhf.exec:\fnjthhf.exe146⤵PID:1084
-
\??\c:\vlbjjj.exec:\vlbjjj.exe147⤵PID:1120
-
\??\c:\bntvhrp.exec:\bntvhrp.exe148⤵PID:2668
-
\??\c:\btrfdr.exec:\btrfdr.exe149⤵PID:2344
-
\??\c:\pjljtlj.exec:\pjljtlj.exe150⤵PID:1108
-
\??\c:\rdtfjpn.exec:\rdtfjpn.exe151⤵PID:1476
-
\??\c:\hnxnxf.exec:\hnxnxf.exe152⤵PID:2328
-
\??\c:\vlxdxr.exec:\vlxdxr.exe153⤵PID:932
-
\??\c:\thxfvv.exec:\thxfvv.exe154⤵PID:2588
-
\??\c:\vdrbnv.exec:\vdrbnv.exe155⤵PID:708
-
\??\c:\dllrbh.exec:\dllrbh.exe156⤵PID:400
-
\??\c:\jjhfl.exec:\jjhfl.exe157⤵PID:1164
-
\??\c:\nvfhxdd.exec:\nvfhxdd.exe158⤵PID:1700
-
\??\c:\bjtpvhj.exec:\bjtpvhj.exe159⤵PID:1784
-
\??\c:\frxxj.exec:\frxxj.exe160⤵PID:1680
-
\??\c:\rrxdd.exec:\rrxdd.exe161⤵PID:2960
-
\??\c:\lbxxndv.exec:\lbxxndv.exe162⤵PID:300
-
\??\c:\ndnpplh.exec:\ndnpplh.exe163⤵PID:2504
-
\??\c:\ppjdbbr.exec:\ppjdbbr.exe164⤵PID:1780
-
\??\c:\jrjlvh.exec:\jrjlvh.exe165⤵PID:1400
-
\??\c:\dtjjnb.exec:\dtjjnb.exe166⤵PID:2184
-
\??\c:\dpvvl.exec:\dpvvl.exe167⤵PID:2916
-
\??\c:\nvlxhl.exec:\nvlxhl.exe168⤵PID:1744
-
\??\c:\vdnvnhl.exec:\vdnvnhl.exe169⤵PID:1976
-
\??\c:\fjprj.exec:\fjprj.exe170⤵PID:2496
-
\??\c:\rrbpx.exec:\rrbpx.exe171⤵PID:2908
-
\??\c:\jvxbtn.exec:\jvxbtn.exe172⤵PID:2628
-
\??\c:\xlntnrb.exec:\xlntnrb.exe173⤵PID:2552
-
\??\c:\fnrnjxr.exec:\fnrnjxr.exe174⤵PID:1552
-
\??\c:\jtjtbbl.exec:\jtjtbbl.exe175⤵PID:1624
-
\??\c:\xllhfj.exec:\xllhfj.exe176⤵PID:2684
-
\??\c:\txhnrl.exec:\txhnrl.exe177⤵PID:2568
-
\??\c:\pvjpb.exec:\pvjpb.exe178⤵PID:2648
-
\??\c:\lhlnt.exec:\lhlnt.exe179⤵PID:2636
-
\??\c:\tfhvx.exec:\tfhvx.exe180⤵PID:1804
-
\??\c:\jxtpnl.exec:\jxtpnl.exe181⤵PID:2448
-
\??\c:\fvtbx.exec:\fvtbx.exe182⤵PID:2056
-
\??\c:\bjpdhrx.exec:\bjpdhrx.exe183⤵PID:1180
-
\??\c:\ftbbn.exec:\ftbbn.exe184⤵PID:592
-
\??\c:\bfrnrr.exec:\bfrnrr.exe185⤵PID:564
-
\??\c:\tnxbl.exec:\tnxbl.exe186⤵PID:1360
-
\??\c:\brdxrd.exec:\brdxrd.exe187⤵PID:2500
-
\??\c:\hlpfn.exec:\hlpfn.exe188⤵PID:1636
-
\??\c:\rjfdp.exec:\rjfdp.exe189⤵PID:1452
-
\??\c:\vflvx.exec:\vflvx.exe190⤵PID:1960
-
\??\c:\fbrpt.exec:\fbrpt.exe191⤵PID:1852
-
\??\c:\jrjlnvn.exec:\jrjlnvn.exe192⤵PID:1084
-
\??\c:\fdhlpjh.exec:\fdhlpjh.exe193⤵PID:2392
-
\??\c:\lftdr.exec:\lftdr.exe194⤵PID:1088
-
\??\c:\pbvxbdh.exec:\pbvxbdh.exe195⤵PID:2276
-
\??\c:\dxthdfv.exec:\dxthdfv.exe196⤵PID:676
-
\??\c:\nbhrt.exec:\nbhrt.exe197⤵PID:2316
-
\??\c:\dftnr.exec:\dftnr.exe198⤵PID:1316
-
\??\c:\lthrr.exec:\lthrr.exe199⤵PID:2116
-
\??\c:\lbptx.exec:\lbptx.exe200⤵PID:2104
-
\??\c:\jhhhnf.exec:\jhhhnf.exe201⤵PID:708
-
\??\c:\lrxlvbb.exec:\lrxlvbb.exe202⤵PID:400
-
\??\c:\hxplx.exec:\hxplx.exe203⤵PID:1072
-
\??\c:\drvpfv.exec:\drvpfv.exe204⤵PID:696
-
\??\c:\fvjjbjp.exec:\fvjjbjp.exe205⤵PID:1784
-
\??\c:\fpdtl.exec:\fpdtl.exe206⤵PID:1324
-
\??\c:\jbfntrn.exec:\jbfntrn.exe207⤵PID:1224
-
\??\c:\pxblft.exec:\pxblft.exe208⤵PID:3032
-
\??\c:\dvrlf.exec:\dvrlf.exe209⤵PID:2080
-
\??\c:\hrrjblj.exec:\hrrjblj.exe210⤵PID:1944
-
\??\c:\plblnjv.exec:\plblnjv.exe211⤵PID:2212
-
\??\c:\pjdpd.exec:\pjdpd.exe212⤵PID:2796
-
\??\c:\frlnlvh.exec:\frlnlvh.exe213⤵PID:1604
-
\??\c:\fjtbllv.exec:\fjtbllv.exe214⤵PID:896
-
\??\c:\njtptff.exec:\njtptff.exe215⤵PID:2152
-
\??\c:\dlxtlb.exec:\dlxtlb.exe216⤵PID:2640
-
\??\c:\rdptj.exec:\rdptj.exe217⤵PID:2556
-
\??\c:\bdbxv.exec:\bdbxv.exe218⤵PID:1616
-
\??\c:\ttxrd.exec:\ttxrd.exe219⤵PID:2564
-
\??\c:\fjpbp.exec:\fjpbp.exe220⤵PID:2752
-
\??\c:\fjxnxl.exec:\fjxnxl.exe221⤵PID:2624
-
\??\c:\hxtxj.exec:\hxtxj.exe222⤵PID:2684
-
\??\c:\jtpndpx.exec:\jtpndpx.exe223⤵PID:3020
-
\??\c:\pdlhx.exec:\pdlhx.exe224⤵PID:2880
-
\??\c:\nljdtr.exec:\nljdtr.exe225⤵PID:524
-
\??\c:\bjfnlft.exec:\bjfnlft.exe226⤵PID:2164
-
\??\c:\llfnj.exec:\llfnj.exe227⤵PID:2948
-
\??\c:\nlbnjvh.exec:\nlbnjvh.exe228⤵PID:2876
-
\??\c:\ttnxxnd.exec:\ttnxxnd.exe229⤵PID:556
-
\??\c:\dlnhbhl.exec:\dlnhbhl.exe230⤵PID:592
-
\??\c:\fdrfpd.exec:\fdrfpd.exe231⤵PID:2076
-
\??\c:\jnbldd.exec:\jnbldd.exe232⤵PID:2724
-
\??\c:\frfddv.exec:\frfddv.exe233⤵PID:2008
-
\??\c:\hdhvrtl.exec:\hdhvrtl.exe234⤵PID:2020
-
\??\c:\bhdxfr.exec:\bhdxfr.exe235⤵PID:1816
-
\??\c:\xxvddb.exec:\xxvddb.exe236⤵PID:1868
-
\??\c:\llhpl.exec:\llhpl.exe237⤵PID:1268
-
\??\c:\vtvjrv.exec:\vtvjrv.exe238⤵PID:1988
-
\??\c:\tlffrv.exec:\tlffrv.exe239⤵PID:768
-
\??\c:\rnxvn.exec:\rnxvn.exe240⤵PID:2344
-
\??\c:\dxhvrb.exec:\dxhvrb.exe241⤵PID:2276
-
\??\c:\vhlxnt.exec:\vhlxnt.exe242⤵PID:1720