Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 14:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
59c3c5d1e02ece2a51a51bcbfd150f20_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
59c3c5d1e02ece2a51a51bcbfd150f20_NeikiAnalytics.exe
-
Size
467KB
-
MD5
59c3c5d1e02ece2a51a51bcbfd150f20
-
SHA1
93db7cf039e13452bf0850645a0123433f01c062
-
SHA256
8966dfba3b7116eb9b2fd6d0812940d604be70c5436c6ec1b4d61a86139de204
-
SHA512
b2dd728b3ca91cd2196aff073a55c050f0a59cf570044db69dd627346c7f6b6a48619581fbd548983cf0f88445a06b6c87dfce598ac3610529f7cfcb1b622322
-
SSDEEP
6144:n3C9BRo7MlrWKo+lS0Le4xRSAoq78yoyfx93sEqkeGLedW0A8hho:n3C9yMo+S0L9xRnoq7H9xqYLed35hG
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2656-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2136-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/788-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1208-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2452-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1520-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2020-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1916-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2472-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2384-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2904-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2116-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2136 dxpltj.exe 2640 jxhrttj.exe 2536 jxnnt.exe 2704 bhlntl.exe 2576 xbpnn.exe 2456 hnjnxx.exe 2128 xfbnb.exe 788 bbbdntl.exe 1304 hrjlbjd.exe 1208 hvbvtpv.exe 2712 fjbrj.exe 2452 brxxb.exe 1520 nlfxlv.exe 2020 rhvpr.exe 1916 trxjfl.exe 1844 llxbvl.exe 2472 pxbdht.exe 1764 djrtlp.exe 1732 xtxbn.exe 2088 htfpj.exe 2588 ljxhv.exe 2952 pbnpljf.exe 580 thpdrx.exe 3004 vvphvdv.exe 2384 plfvbhh.exe 792 hddpvf.exe 2904 rtbjv.exe 1540 jlnbrhd.exe 1056 jttjrft.exe 2056 lpfhjt.exe 2116 rvfhxpn.exe 1536 tdnnbn.exe 1736 rrxrx.exe 2660 fftll.exe 1616 lpjjp.exe 2692 lvjvnrx.exe 2540 frfxn.exe 2644 nrptr.exe 2420 fhfdn.exe 2580 thlxlj.exe 936 ltljtp.exe 2488 bdjddf.exe 2456 phlxhnh.exe 2876 dxfhvx.exe 2032 xldbbh.exe 488 bdfpdfx.exe 572 dbfxxfd.exe 960 fbnnl.exe 1420 tjljhb.exe 2672 hhfhb.exe 2452 dfllpt.exe 1852 plbbx.exe 2348 tldfdd.exe 1960 lrptx.exe 1828 xtrfnxb.exe 1936 flfdp.exe 1132 xrbhpb.exe 1760 vlbnf.exe 1632 dntnlv.exe 1656 bprxlj.exe 2792 lphjbx.exe 2956 tvjllv.exe 2144 dtxnt.exe 2996 rjjpvrp.exe -
resource yara_rule behavioral1/memory/2656-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2136-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/788-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/788-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1208-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1916-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2116-304-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2656 wrote to memory of 2136 2656 59c3c5d1e02ece2a51a51bcbfd150f20_NeikiAnalytics.exe 28 PID 2656 wrote to memory of 2136 2656 59c3c5d1e02ece2a51a51bcbfd150f20_NeikiAnalytics.exe 28 PID 2656 wrote to memory of 2136 2656 59c3c5d1e02ece2a51a51bcbfd150f20_NeikiAnalytics.exe 28 PID 2656 wrote to memory of 2136 2656 59c3c5d1e02ece2a51a51bcbfd150f20_NeikiAnalytics.exe 28 PID 2136 wrote to memory of 2640 2136 dxpltj.exe 29 PID 2136 wrote to memory of 2640 2136 dxpltj.exe 29 PID 2136 wrote to memory of 2640 2136 dxpltj.exe 29 PID 2136 wrote to memory of 2640 2136 dxpltj.exe 29 PID 2640 wrote to memory of 2536 2640 jxhrttj.exe 30 PID 2640 wrote to memory of 2536 2640 jxhrttj.exe 30 PID 2640 wrote to memory of 2536 2640 jxhrttj.exe 30 PID 2640 wrote to memory of 2536 2640 jxhrttj.exe 30 PID 2536 wrote to memory of 2704 2536 jxnnt.exe 31 PID 2536 wrote to memory of 2704 2536 jxnnt.exe 31 PID 2536 wrote to memory of 2704 2536 jxnnt.exe 31 PID 2536 wrote to memory of 2704 2536 jxnnt.exe 31 PID 2704 wrote to memory of 2576 2704 bhlntl.exe 32 PID 2704 wrote to memory of 2576 2704 bhlntl.exe 32 PID 2704 wrote to memory of 2576 2704 bhlntl.exe 32 PID 2704 wrote to memory of 2576 2704 bhlntl.exe 32 PID 2576 wrote to memory of 2456 2576 xbpnn.exe 33 PID 2576 wrote to memory of 2456 2576 xbpnn.exe 33 PID 2576 wrote to memory of 2456 2576 xbpnn.exe 33 PID 2576 wrote to memory of 2456 2576 xbpnn.exe 33 PID 2456 wrote to memory of 2128 2456 hnjnxx.exe 34 PID 2456 wrote to memory of 2128 2456 hnjnxx.exe 34 PID 2456 wrote to memory of 2128 2456 hnjnxx.exe 34 PID 2456 wrote to memory of 2128 2456 hnjnxx.exe 34 PID 2128 wrote to memory of 788 2128 xfbnb.exe 35 PID 2128 wrote to memory of 788 2128 xfbnb.exe 35 PID 2128 wrote to memory of 788 2128 xfbnb.exe 35 PID 2128 wrote to memory of 788 2128 xfbnb.exe 35 PID 788 wrote to memory of 1304 788 bbbdntl.exe 36 PID 788 wrote to memory of 1304 788 bbbdntl.exe 36 PID 788 wrote to memory of 1304 788 bbbdntl.exe 36 PID 788 wrote to memory of 1304 788 bbbdntl.exe 36 PID 1304 wrote to memory of 1208 1304 hrjlbjd.exe 37 PID 1304 wrote to memory of 1208 1304 hrjlbjd.exe 37 PID 1304 wrote to memory of 1208 1304 hrjlbjd.exe 37 PID 1304 wrote to memory of 1208 1304 hrjlbjd.exe 37 PID 1208 wrote to memory of 2712 1208 hvbvtpv.exe 38 PID 1208 wrote to memory of 2712 1208 hvbvtpv.exe 38 PID 1208 wrote to memory of 2712 1208 hvbvtpv.exe 38 PID 1208 wrote to memory of 2712 1208 hvbvtpv.exe 38 PID 2712 wrote to memory of 2452 2712 fjbrj.exe 39 PID 2712 wrote to memory of 2452 2712 fjbrj.exe 39 PID 2712 wrote to memory of 2452 2712 fjbrj.exe 39 PID 2712 wrote to memory of 2452 2712 fjbrj.exe 39 PID 2452 wrote to memory of 1520 2452 brxxb.exe 40 PID 2452 wrote to memory of 1520 2452 brxxb.exe 40 PID 2452 wrote to memory of 1520 2452 brxxb.exe 40 PID 2452 wrote to memory of 1520 2452 brxxb.exe 40 PID 1520 wrote to memory of 2020 1520 nlfxlv.exe 41 PID 1520 wrote to memory of 2020 1520 nlfxlv.exe 41 PID 1520 wrote to memory of 2020 1520 nlfxlv.exe 41 PID 1520 wrote to memory of 2020 1520 nlfxlv.exe 41 PID 2020 wrote to memory of 1916 2020 rhvpr.exe 42 PID 2020 wrote to memory of 1916 2020 rhvpr.exe 42 PID 2020 wrote to memory of 1916 2020 rhvpr.exe 42 PID 2020 wrote to memory of 1916 2020 rhvpr.exe 42 PID 1916 wrote to memory of 1844 1916 trxjfl.exe 43 PID 1916 wrote to memory of 1844 1916 trxjfl.exe 43 PID 1916 wrote to memory of 1844 1916 trxjfl.exe 43 PID 1916 wrote to memory of 1844 1916 trxjfl.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\59c3c5d1e02ece2a51a51bcbfd150f20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\59c3c5d1e02ece2a51a51bcbfd150f20_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\dxpltj.exec:\dxpltj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\jxhrttj.exec:\jxhrttj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\jxnnt.exec:\jxnnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\bhlntl.exec:\bhlntl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\xbpnn.exec:\xbpnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\hnjnxx.exec:\hnjnxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\xfbnb.exec:\xfbnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\bbbdntl.exec:\bbbdntl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:788 -
\??\c:\hrjlbjd.exec:\hrjlbjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\hvbvtpv.exec:\hvbvtpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\fjbrj.exec:\fjbrj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\brxxb.exec:\brxxb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\nlfxlv.exec:\nlfxlv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\rhvpr.exec:\rhvpr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\trxjfl.exec:\trxjfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\llxbvl.exec:\llxbvl.exe17⤵
- Executes dropped EXE
PID:1844 -
\??\c:\pxbdht.exec:\pxbdht.exe18⤵
- Executes dropped EXE
PID:2472 -
\??\c:\djrtlp.exec:\djrtlp.exe19⤵
- Executes dropped EXE
PID:1764 -
\??\c:\xtxbn.exec:\xtxbn.exe20⤵
- Executes dropped EXE
PID:1732 -
\??\c:\htfpj.exec:\htfpj.exe21⤵
- Executes dropped EXE
PID:2088 -
\??\c:\ljxhv.exec:\ljxhv.exe22⤵
- Executes dropped EXE
PID:2588 -
\??\c:\pbnpljf.exec:\pbnpljf.exe23⤵
- Executes dropped EXE
PID:2952 -
\??\c:\thpdrx.exec:\thpdrx.exe24⤵
- Executes dropped EXE
PID:580 -
\??\c:\vvphvdv.exec:\vvphvdv.exe25⤵
- Executes dropped EXE
PID:3004 -
\??\c:\plfvbhh.exec:\plfvbhh.exe26⤵
- Executes dropped EXE
PID:2384 -
\??\c:\hddpvf.exec:\hddpvf.exe27⤵
- Executes dropped EXE
PID:792 -
\??\c:\rtbjv.exec:\rtbjv.exe28⤵
- Executes dropped EXE
PID:2904 -
\??\c:\jlnbrhd.exec:\jlnbrhd.exe29⤵
- Executes dropped EXE
PID:1540 -
\??\c:\jttjrft.exec:\jttjrft.exe30⤵
- Executes dropped EXE
PID:1056 -
\??\c:\lpfhjt.exec:\lpfhjt.exe31⤵
- Executes dropped EXE
PID:2056 -
\??\c:\rvfhxpn.exec:\rvfhxpn.exe32⤵
- Executes dropped EXE
PID:2116 -
\??\c:\tdnnbn.exec:\tdnnbn.exe33⤵
- Executes dropped EXE
PID:1536 -
\??\c:\rrxrx.exec:\rrxrx.exe34⤵
- Executes dropped EXE
PID:1736 -
\??\c:\fftll.exec:\fftll.exe35⤵
- Executes dropped EXE
PID:2660 -
\??\c:\lpjjp.exec:\lpjjp.exe36⤵
- Executes dropped EXE
PID:1616 -
\??\c:\lvjvnrx.exec:\lvjvnrx.exe37⤵
- Executes dropped EXE
PID:2692 -
\??\c:\frfxn.exec:\frfxn.exe38⤵
- Executes dropped EXE
PID:2540 -
\??\c:\nrptr.exec:\nrptr.exe39⤵
- Executes dropped EXE
PID:2644 -
\??\c:\fhfdn.exec:\fhfdn.exe40⤵
- Executes dropped EXE
PID:2420 -
\??\c:\thlxlj.exec:\thlxlj.exe41⤵
- Executes dropped EXE
PID:2580 -
\??\c:\ltljtp.exec:\ltljtp.exe42⤵
- Executes dropped EXE
PID:936 -
\??\c:\bdjddf.exec:\bdjddf.exe43⤵
- Executes dropped EXE
PID:2488 -
\??\c:\phlxhnh.exec:\phlxhnh.exe44⤵
- Executes dropped EXE
PID:2456 -
\??\c:\dxfhvx.exec:\dxfhvx.exe45⤵
- Executes dropped EXE
PID:2876 -
\??\c:\xldbbh.exec:\xldbbh.exe46⤵
- Executes dropped EXE
PID:2032 -
\??\c:\bdfpdfx.exec:\bdfpdfx.exe47⤵
- Executes dropped EXE
PID:488 -
\??\c:\dbfxxfd.exec:\dbfxxfd.exe48⤵
- Executes dropped EXE
PID:572 -
\??\c:\fbnnl.exec:\fbnnl.exe49⤵
- Executes dropped EXE
PID:960 -
\??\c:\tjljhb.exec:\tjljhb.exe50⤵
- Executes dropped EXE
PID:1420 -
\??\c:\hhfhb.exec:\hhfhb.exe51⤵
- Executes dropped EXE
PID:2672 -
\??\c:\dfllpt.exec:\dfllpt.exe52⤵
- Executes dropped EXE
PID:2452 -
\??\c:\plbbx.exec:\plbbx.exe53⤵
- Executes dropped EXE
PID:1852 -
\??\c:\tldfdd.exec:\tldfdd.exe54⤵
- Executes dropped EXE
PID:2348 -
\??\c:\lrptx.exec:\lrptx.exe55⤵
- Executes dropped EXE
PID:1960 -
\??\c:\xtrfnxb.exec:\xtrfnxb.exe56⤵
- Executes dropped EXE
PID:1828 -
\??\c:\flfdp.exec:\flfdp.exe57⤵
- Executes dropped EXE
PID:1936 -
\??\c:\xrbhpb.exec:\xrbhpb.exe58⤵
- Executes dropped EXE
PID:1132 -
\??\c:\vlbnf.exec:\vlbnf.exe59⤵
- Executes dropped EXE
PID:1760 -
\??\c:\dntnlv.exec:\dntnlv.exe60⤵
- Executes dropped EXE
PID:1632 -
\??\c:\bprxlj.exec:\bprxlj.exe61⤵
- Executes dropped EXE
PID:1656 -
\??\c:\lphjbx.exec:\lphjbx.exe62⤵
- Executes dropped EXE
PID:2792 -
\??\c:\tvjllv.exec:\tvjllv.exe63⤵
- Executes dropped EXE
PID:2956 -
\??\c:\dtxnt.exec:\dtxnt.exe64⤵
- Executes dropped EXE
PID:2144 -
\??\c:\rjjpvrp.exec:\rjjpvrp.exe65⤵
- Executes dropped EXE
PID:2996 -
\??\c:\ldhtdnt.exec:\ldhtdnt.exe66⤵PID:840
-
\??\c:\ttbtl.exec:\ttbtl.exe67⤵PID:1468
-
\??\c:\xdlrt.exec:\xdlrt.exe68⤵PID:2384
-
\??\c:\pxrxbj.exec:\pxrxbj.exe69⤵PID:2900
-
\??\c:\pxhjrbj.exec:\pxhjrbj.exe70⤵PID:1848
-
\??\c:\vfjhxxv.exec:\vfjhxxv.exe71⤵PID:2244
-
\??\c:\ltdxjbj.exec:\ltdxjbj.exe72⤵PID:1540
-
\??\c:\dldtl.exec:\dldtl.exe73⤵PID:1056
-
\??\c:\vbtjx.exec:\vbtjx.exe74⤵PID:2108
-
\??\c:\nlhtvpv.exec:\nlhtvpv.exe75⤵PID:1592
-
\??\c:\njhvhbp.exec:\njhvhbp.exe76⤵PID:2496
-
\??\c:\dxnjtl.exec:\dxnjtl.exe77⤵PID:1748
-
\??\c:\pdtrv.exec:\pdtrv.exe78⤵PID:1328
-
\??\c:\htflhtj.exec:\htflhtj.exe79⤵PID:2200
-
\??\c:\dtftx.exec:\dtftx.exe80⤵PID:2656
-
\??\c:\rllxnxf.exec:\rllxnxf.exe81⤵PID:1708
-
\??\c:\fpbrbj.exec:\fpbrbj.exe82⤵PID:2772
-
\??\c:\nxrpt.exec:\nxrpt.exe83⤵PID:2640
-
\??\c:\tnnxh.exec:\tnnxh.exe84⤵PID:2536
-
\??\c:\xhjlb.exec:\xhjlb.exe85⤵PID:2596
-
\??\c:\xnbxhjl.exec:\xnbxhjl.exe86⤵PID:2412
-
\??\c:\hnltpl.exec:\hnltpl.exe87⤵PID:2484
-
\??\c:\jvfvt.exec:\jvfvt.exe88⤵PID:2444
-
\??\c:\bdbxnn.exec:\bdbxnn.exe89⤵PID:2836
-
\??\c:\hjxbbtx.exec:\hjxbbtx.exe90⤵PID:552
-
\??\c:\bvtjvnd.exec:\bvtjvnd.exe91⤵PID:1956
-
\??\c:\hpvrlrh.exec:\hpvrlrh.exe92⤵PID:1200
-
\??\c:\rjjtf.exec:\rjjtf.exe93⤵PID:2480
-
\??\c:\xjnhnb.exec:\xjnhnb.exe94⤵PID:2708
-
\??\c:\hbdtxtl.exec:\hbdtxtl.exe95⤵PID:2140
-
\??\c:\xrfjdjr.exec:\xrfjdjr.exe96⤵PID:2676
-
\??\c:\hrvvd.exec:\hrvvd.exe97⤵PID:2820
-
\??\c:\pjlnf.exec:\pjlnf.exe98⤵PID:1952
-
\??\c:\ddtrxf.exec:\ddtrxf.exe99⤵PID:1452
-
\??\c:\hbhxjnj.exec:\hbhxjnj.exe100⤵PID:1236
-
\??\c:\vrbrtjl.exec:\vrbrtjl.exe101⤵PID:872
-
\??\c:\djnvdd.exec:\djnvdd.exe102⤵PID:1844
-
\??\c:\vtlfh.exec:\vtlfh.exe103⤵PID:1128
-
\??\c:\trhhtrb.exec:\trhhtrb.exe104⤵PID:1104
-
\??\c:\hfjnbnf.exec:\hfjnbnf.exe105⤵PID:1636
-
\??\c:\jhfhj.exec:\jhfhj.exe106⤵PID:3060
-
\??\c:\fnvhfnd.exec:\fnvhfnd.exe107⤵PID:804
-
\??\c:\rjrvlvd.exec:\rjrvlvd.exe108⤵PID:2216
-
\??\c:\rdptxd.exec:\rdptxd.exe109⤵PID:2976
-
\??\c:\rffjvh.exec:\rffjvh.exe110⤵PID:3012
-
\??\c:\xpdntjt.exec:\xpdntjt.exe111⤵PID:1248
-
\??\c:\nhrvxpn.exec:\nhrvxpn.exe112⤵PID:1124
-
\??\c:\lfjlt.exec:\lfjlt.exe113⤵PID:780
-
\??\c:\xrnbxd.exec:\xrnbxd.exe114⤵PID:1652
-
\??\c:\bvbhntr.exec:\bvbhntr.exe115⤵PID:2040
-
\??\c:\pvbxth.exec:\pvbxth.exe116⤵PID:1624
-
\??\c:\fjlnft.exec:\fjlnft.exe117⤵PID:2296
-
\??\c:\dfdvv.exec:\dfdvv.exe118⤵PID:948
-
\??\c:\nrvtx.exec:\nrvtx.exe119⤵PID:1380
-
\??\c:\bfhrt.exec:\bfhrt.exe120⤵PID:2356
-
\??\c:\fjnfd.exec:\fjnfd.exe121⤵PID:2324
-
\??\c:\jdhhlth.exec:\jdhhlth.exe122⤵PID:2224
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-