Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 18:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c205ae01cc24cbd5218cf960b890eee0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
c205ae01cc24cbd5218cf960b890eee0_NeikiAnalytics.exe
-
Size
76KB
-
MD5
c205ae01cc24cbd5218cf960b890eee0
-
SHA1
3eb1dbbfc856c3c13f5f51aaed77afedeac0310b
-
SHA256
fb4c841826d11974d0cfbfb7ee41ccbd8ee532cb722fb3e0ea79f41473979f08
-
SHA512
026db2d2984c467f8c76081d065a21c958bf370d26e21764661e7ee5581f7192657ba82a3a44a97ac39b2fb79beb1cb9dd2f137687901f5b9dcfadc6fbe9024a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrAn:ymb3NkkiQ3mdBjFIIp9L9QrrAn
Malware Config
Signatures
-
Detect Blackmoon payload 17 IoCs
resource yara_rule behavioral1/memory/3036-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1984-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-43-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2608-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1920-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1520-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1520-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1468-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1460-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1340-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1984 jnbnntb.exe 2628 vxbplb.exe 2544 hdhlbt.exe 2608 tltph.exe 1920 xjvlv.exe 2532 lhhjb.exe 652 txbhppv.exe 1520 ttlfrn.exe 1468 xtpdh.exe 2820 ttxxpp.exe 2972 vhptfx.exe 2284 drjlfjx.exe 1460 hphvndv.exe 2680 htfvhh.exe 1588 fbnbrll.exe 824 xvdxbn.exe 2816 tnvntpb.exe 1904 rpbjp.exe 1340 ttndnh.exe 1744 rxbtb.exe 1200 jvvxrtf.exe 2080 rjftdl.exe 2384 jrrfbjr.exe 1928 bnxjbx.exe 1036 bjnfnn.exe 1692 jbffnbb.exe 788 rjdrr.exe 596 nvltrxb.exe 964 lvljjj.exe 2880 phnrn.exe 1992 fvpxff.exe 2340 rlnbhbl.exe 1704 rpbxbl.exe 2184 hrhdj.exe 1600 njtbp.exe 3032 jrfrbn.exe 2640 vxpnhjx.exe 2888 vpnhr.exe 2688 bprxn.exe 2696 tjjhdhh.exe 1952 bddnnd.exe 2424 xbfrvpl.exe 2580 xrbxn.exe 268 fltvxr.exe 760 jnxhfp.exe 764 hxlxh.exe 672 hdljbh.exe 1356 pvhdn.exe 1276 fdfjj.exe 2844 rvxpd.exe 2004 jdrpdp.exe 928 xdfbv.exe 2664 nllhrh.exe 2780 pjpnlnf.exe 2712 jbrrn.exe 2800 xnlprfn.exe 2760 bpvxbv.exe 852 rnpftn.exe 1328 hnljf.exe 1748 hrbrnbv.exe 2288 jbphjp.exe 2020 xrtdvf.exe 1968 ltdlbj.exe 2060 fnfll.exe -
resource yara_rule behavioral1/memory/3036-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1984-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1920-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1468-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1460-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1340-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-295-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3036 wrote to memory of 1984 3036 c205ae01cc24cbd5218cf960b890eee0_NeikiAnalytics.exe 28 PID 3036 wrote to memory of 1984 3036 c205ae01cc24cbd5218cf960b890eee0_NeikiAnalytics.exe 28 PID 3036 wrote to memory of 1984 3036 c205ae01cc24cbd5218cf960b890eee0_NeikiAnalytics.exe 28 PID 3036 wrote to memory of 1984 3036 c205ae01cc24cbd5218cf960b890eee0_NeikiAnalytics.exe 28 PID 1984 wrote to memory of 2628 1984 jnbnntb.exe 29 PID 1984 wrote to memory of 2628 1984 jnbnntb.exe 29 PID 1984 wrote to memory of 2628 1984 jnbnntb.exe 29 PID 1984 wrote to memory of 2628 1984 jnbnntb.exe 29 PID 2628 wrote to memory of 2544 2628 vxbplb.exe 30 PID 2628 wrote to memory of 2544 2628 vxbplb.exe 30 PID 2628 wrote to memory of 2544 2628 vxbplb.exe 30 PID 2628 wrote to memory of 2544 2628 vxbplb.exe 30 PID 2544 wrote to memory of 2608 2544 hdhlbt.exe 31 PID 2544 wrote to memory of 2608 2544 hdhlbt.exe 31 PID 2544 wrote to memory of 2608 2544 hdhlbt.exe 31 PID 2544 wrote to memory of 2608 2544 hdhlbt.exe 31 PID 2608 wrote to memory of 1920 2608 tltph.exe 32 PID 2608 wrote to memory of 1920 2608 tltph.exe 32 PID 2608 wrote to memory of 1920 2608 tltph.exe 32 PID 2608 wrote to memory of 1920 2608 tltph.exe 32 PID 1920 wrote to memory of 2532 1920 xjvlv.exe 33 PID 1920 wrote to memory of 2532 1920 xjvlv.exe 33 PID 1920 wrote to memory of 2532 1920 xjvlv.exe 33 PID 1920 wrote to memory of 2532 1920 xjvlv.exe 33 PID 2532 wrote to memory of 652 2532 lhhjb.exe 34 PID 2532 wrote to memory of 652 2532 lhhjb.exe 34 PID 2532 wrote to memory of 652 2532 lhhjb.exe 34 PID 2532 wrote to memory of 652 2532 lhhjb.exe 34 PID 652 wrote to memory of 1520 652 txbhppv.exe 35 PID 652 wrote to memory of 1520 652 txbhppv.exe 35 PID 652 wrote to memory of 1520 652 txbhppv.exe 35 PID 652 wrote to memory of 1520 652 txbhppv.exe 35 PID 1520 wrote to memory of 1468 1520 ttlfrn.exe 36 PID 1520 wrote to memory of 1468 1520 ttlfrn.exe 36 PID 1520 wrote to memory of 1468 1520 ttlfrn.exe 36 PID 1520 wrote to memory of 1468 1520 ttlfrn.exe 36 PID 1468 wrote to memory of 2820 1468 xtpdh.exe 37 PID 1468 wrote to memory of 2820 1468 xtpdh.exe 37 PID 1468 wrote to memory of 2820 1468 xtpdh.exe 37 PID 1468 wrote to memory of 2820 1468 xtpdh.exe 37 PID 2820 wrote to memory of 2972 2820 ttxxpp.exe 38 PID 2820 wrote to memory of 2972 2820 ttxxpp.exe 38 PID 2820 wrote to memory of 2972 2820 ttxxpp.exe 38 PID 2820 wrote to memory of 2972 2820 ttxxpp.exe 38 PID 2972 wrote to memory of 2284 2972 vhptfx.exe 39 PID 2972 wrote to memory of 2284 2972 vhptfx.exe 39 PID 2972 wrote to memory of 2284 2972 vhptfx.exe 39 PID 2972 wrote to memory of 2284 2972 vhptfx.exe 39 PID 2284 wrote to memory of 1460 2284 drjlfjx.exe 40 PID 2284 wrote to memory of 1460 2284 drjlfjx.exe 40 PID 2284 wrote to memory of 1460 2284 drjlfjx.exe 40 PID 2284 wrote to memory of 1460 2284 drjlfjx.exe 40 PID 1460 wrote to memory of 2680 1460 hphvndv.exe 41 PID 1460 wrote to memory of 2680 1460 hphvndv.exe 41 PID 1460 wrote to memory of 2680 1460 hphvndv.exe 41 PID 1460 wrote to memory of 2680 1460 hphvndv.exe 41 PID 2680 wrote to memory of 1588 2680 htfvhh.exe 42 PID 2680 wrote to memory of 1588 2680 htfvhh.exe 42 PID 2680 wrote to memory of 1588 2680 htfvhh.exe 42 PID 2680 wrote to memory of 1588 2680 htfvhh.exe 42 PID 1588 wrote to memory of 824 1588 fbnbrll.exe 43 PID 1588 wrote to memory of 824 1588 fbnbrll.exe 43 PID 1588 wrote to memory of 824 1588 fbnbrll.exe 43 PID 1588 wrote to memory of 824 1588 fbnbrll.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\c205ae01cc24cbd5218cf960b890eee0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\c205ae01cc24cbd5218cf960b890eee0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\jnbnntb.exec:\jnbnntb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\vxbplb.exec:\vxbplb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\hdhlbt.exec:\hdhlbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\tltph.exec:\tltph.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\xjvlv.exec:\xjvlv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\lhhjb.exec:\lhhjb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\txbhppv.exec:\txbhppv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
\??\c:\ttlfrn.exec:\ttlfrn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\xtpdh.exec:\xtpdh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\ttxxpp.exec:\ttxxpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\vhptfx.exec:\vhptfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\drjlfjx.exec:\drjlfjx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\hphvndv.exec:\hphvndv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\htfvhh.exec:\htfvhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\fbnbrll.exec:\fbnbrll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\xvdxbn.exec:\xvdxbn.exe17⤵
- Executes dropped EXE
PID:824 -
\??\c:\tnvntpb.exec:\tnvntpb.exe18⤵
- Executes dropped EXE
PID:2816 -
\??\c:\rpbjp.exec:\rpbjp.exe19⤵
- Executes dropped EXE
PID:1904 -
\??\c:\ttndnh.exec:\ttndnh.exe20⤵
- Executes dropped EXE
PID:1340 -
\??\c:\rxbtb.exec:\rxbtb.exe21⤵
- Executes dropped EXE
PID:1744 -
\??\c:\jvvxrtf.exec:\jvvxrtf.exe22⤵
- Executes dropped EXE
PID:1200 -
\??\c:\rjftdl.exec:\rjftdl.exe23⤵
- Executes dropped EXE
PID:2080 -
\??\c:\jrrfbjr.exec:\jrrfbjr.exe24⤵
- Executes dropped EXE
PID:2384 -
\??\c:\bnxjbx.exec:\bnxjbx.exe25⤵
- Executes dropped EXE
PID:1928 -
\??\c:\bjnfnn.exec:\bjnfnn.exe26⤵
- Executes dropped EXE
PID:1036 -
\??\c:\jbffnbb.exec:\jbffnbb.exe27⤵
- Executes dropped EXE
PID:1692 -
\??\c:\rjdrr.exec:\rjdrr.exe28⤵
- Executes dropped EXE
PID:788 -
\??\c:\nvltrxb.exec:\nvltrxb.exe29⤵
- Executes dropped EXE
PID:596 -
\??\c:\lvljjj.exec:\lvljjj.exe30⤵
- Executes dropped EXE
PID:964 -
\??\c:\phnrn.exec:\phnrn.exe31⤵
- Executes dropped EXE
PID:2880 -
\??\c:\fvpxff.exec:\fvpxff.exe32⤵
- Executes dropped EXE
PID:1992 -
\??\c:\rlnbhbl.exec:\rlnbhbl.exe33⤵
- Executes dropped EXE
PID:2340 -
\??\c:\rpbxbl.exec:\rpbxbl.exe34⤵
- Executes dropped EXE
PID:1704 -
\??\c:\hrhdj.exec:\hrhdj.exe35⤵
- Executes dropped EXE
PID:2184 -
\??\c:\njtbp.exec:\njtbp.exe36⤵
- Executes dropped EXE
PID:1600 -
\??\c:\jrfrbn.exec:\jrfrbn.exe37⤵
- Executes dropped EXE
PID:3032 -
\??\c:\vxpnhjx.exec:\vxpnhjx.exe38⤵
- Executes dropped EXE
PID:2640 -
\??\c:\vpnhr.exec:\vpnhr.exe39⤵
- Executes dropped EXE
PID:2888 -
\??\c:\bprxn.exec:\bprxn.exe40⤵
- Executes dropped EXE
PID:2688 -
\??\c:\tjjhdhh.exec:\tjjhdhh.exe41⤵
- Executes dropped EXE
PID:2696 -
\??\c:\bddnnd.exec:\bddnnd.exe42⤵
- Executes dropped EXE
PID:1952 -
\??\c:\xbfrvpl.exec:\xbfrvpl.exe43⤵
- Executes dropped EXE
PID:2424 -
\??\c:\xrbxn.exec:\xrbxn.exe44⤵
- Executes dropped EXE
PID:2580 -
\??\c:\fltvxr.exec:\fltvxr.exe45⤵
- Executes dropped EXE
PID:268 -
\??\c:\jnxhfp.exec:\jnxhfp.exe46⤵
- Executes dropped EXE
PID:760 -
\??\c:\hxlxh.exec:\hxlxh.exe47⤵
- Executes dropped EXE
PID:764 -
\??\c:\hdljbh.exec:\hdljbh.exe48⤵
- Executes dropped EXE
PID:672 -
\??\c:\pvhdn.exec:\pvhdn.exe49⤵
- Executes dropped EXE
PID:1356 -
\??\c:\fdfjj.exec:\fdfjj.exe50⤵
- Executes dropped EXE
PID:1276 -
\??\c:\rvxpd.exec:\rvxpd.exe51⤵
- Executes dropped EXE
PID:2844 -
\??\c:\jdrpdp.exec:\jdrpdp.exe52⤵
- Executes dropped EXE
PID:2004 -
\??\c:\xdfbv.exec:\xdfbv.exe53⤵
- Executes dropped EXE
PID:928 -
\??\c:\nllhrh.exec:\nllhrh.exe54⤵
- Executes dropped EXE
PID:2664 -
\??\c:\pjpnlnf.exec:\pjpnlnf.exe55⤵
- Executes dropped EXE
PID:2780 -
\??\c:\jbrrn.exec:\jbrrn.exe56⤵
- Executes dropped EXE
PID:2712 -
\??\c:\xnlprfn.exec:\xnlprfn.exe57⤵
- Executes dropped EXE
PID:2800 -
\??\c:\bpvxbv.exec:\bpvxbv.exe58⤵
- Executes dropped EXE
PID:2760 -
\??\c:\rnpftn.exec:\rnpftn.exe59⤵
- Executes dropped EXE
PID:852 -
\??\c:\hnljf.exec:\hnljf.exe60⤵
- Executes dropped EXE
PID:1328 -
\??\c:\hrbrnbv.exec:\hrbrnbv.exe61⤵
- Executes dropped EXE
PID:1748 -
\??\c:\jbphjp.exec:\jbphjp.exe62⤵
- Executes dropped EXE
PID:2288 -
\??\c:\xrtdvf.exec:\xrtdvf.exe63⤵
- Executes dropped EXE
PID:2020 -
\??\c:\ltdlbj.exec:\ltdlbj.exe64⤵
- Executes dropped EXE
PID:1968 -
\??\c:\fnfll.exec:\fnfll.exe65⤵
- Executes dropped EXE
PID:2060 -
\??\c:\hnltjx.exec:\hnltjx.exe66⤵PID:944
-
\??\c:\jnthffb.exec:\jnthffb.exe67⤵PID:1476
-
\??\c:\rfdftjx.exec:\rfdftjx.exe68⤵PID:1928
-
\??\c:\vdptnvf.exec:\vdptnvf.exe69⤵PID:1036
-
\??\c:\fjtxr.exec:\fjtxr.exe70⤵PID:1836
-
\??\c:\ftntrj.exec:\ftntrj.exe71⤵PID:1936
-
\??\c:\nfnpb.exec:\nfnpb.exe72⤵PID:888
-
\??\c:\jfrdxd.exec:\jfrdxd.exe73⤵PID:588
-
\??\c:\plhfpdx.exec:\plhfpdx.exe74⤵PID:2136
-
\??\c:\btpfrdb.exec:\btpfrdb.exe75⤵PID:860
-
\??\c:\nhhpjrp.exec:\nhhpjrp.exe76⤵PID:2892
-
\??\c:\djvnp.exec:\djvnp.exe77⤵PID:1688
-
\??\c:\nlxblb.exec:\nlxblb.exe78⤵PID:1652
-
\??\c:\ldpvh.exec:\ldpvh.exe79⤵PID:1572
-
\??\c:\bbdtfn.exec:\bbdtfn.exe80⤵PID:2556
-
\??\c:\rjpjfhb.exec:\rjpjfhb.exe81⤵PID:2520
-
\??\c:\pbfxb.exec:\pbfxb.exe82⤵PID:2724
-
\??\c:\tllnlj.exec:\tllnlj.exe83⤵PID:2624
-
\??\c:\brhvjn.exec:\brhvjn.exe84⤵PID:2544
-
\??\c:\lxrnbl.exec:\lxrnbl.exe85⤵PID:2572
-
\??\c:\rxplnvf.exec:\rxplnvf.exe86⤵PID:2440
-
\??\c:\fvxplr.exec:\fvxplr.exe87⤵PID:2432
-
\??\c:\bffvnf.exec:\bffvnf.exe88⤵PID:3052
-
\??\c:\phdtrj.exec:\phdtrj.exe89⤵PID:524
-
\??\c:\ppdpxx.exec:\ppdpxx.exe90⤵PID:2592
-
\??\c:\vhpbnn.exec:\vhpbnn.exe91⤵PID:568
-
\??\c:\xnfjrtf.exec:\xnfjrtf.exe92⤵PID:1520
-
\??\c:\rtjbpp.exec:\rtjbpp.exe93⤵PID:2836
-
\??\c:\jhtfnr.exec:\jhtfnr.exe94⤵PID:2944
-
\??\c:\hvrhrfp.exec:\hvrhrfp.exe95⤵PID:2452
-
\??\c:\xtllhhp.exec:\xtllhhp.exe96⤵PID:2788
-
\??\c:\bfphl.exec:\bfphl.exe97⤵PID:2668
-
\??\c:\bntvnn.exec:\bntvnn.exe98⤵PID:2756
-
\??\c:\tbvbj.exec:\tbvbj.exe99⤵PID:2680
-
\??\c:\jhjnl.exec:\jhjnl.exe100⤵PID:816
-
\??\c:\njnxv.exec:\njnxv.exe101⤵PID:972
-
\??\c:\jtlbxd.exec:\jtlbxd.exe102⤵PID:824
-
\??\c:\njtdl.exec:\njtdl.exe103⤵PID:1100
-
\??\c:\hdvljt.exec:\hdvljt.exe104⤵PID:2296
-
\??\c:\bpdrf.exec:\bpdrf.exe105⤵PID:2148
-
\??\c:\lrhvbxf.exec:\lrhvbxf.exe106⤵PID:2728
-
\??\c:\dpbrn.exec:\dpbrn.exe107⤵PID:2604
-
\??\c:\fbjbdxv.exec:\fbjbdxv.exe108⤵PID:1784
-
\??\c:\ndhhn.exec:\ndhhn.exe109⤵PID:1960
-
\??\c:\nbxxhv.exec:\nbxxhv.exe110⤵PID:2280
-
\??\c:\fvvrbj.exec:\fvvrbj.exe111⤵PID:592
-
\??\c:\xhttpdf.exec:\xhttpdf.exe112⤵PID:2328
-
\??\c:\tvjth.exec:\tvjth.exe113⤵PID:1548
-
\??\c:\trfnxfl.exec:\trfnxfl.exe114⤵PID:1776
-
\??\c:\dldxdtl.exec:\dldxdtl.exe115⤵PID:2180
-
\??\c:\jjjnn.exec:\jjjnn.exe116⤵PID:932
-
\??\c:\lljdtvt.exec:\lljdtvt.exe117⤵PID:1976
-
\??\c:\jxfrhxv.exec:\jxfrhxv.exe118⤵PID:964
-
\??\c:\xjprddr.exec:\xjprddr.exe119⤵PID:1008
-
\??\c:\dfblxf.exec:\dfblxf.exe120⤵PID:1700
-
\??\c:\bbvthx.exec:\bbvthx.exe121⤵PID:2008
-
\??\c:\ttvthpf.exec:\ttvthpf.exe122⤵PID:2340
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-