Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 20:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
01fc11a317e4ff7f6c1bb9522739d310_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
01fc11a317e4ff7f6c1bb9522739d310_NeikiAnalytics.exe
-
Size
392KB
-
MD5
01fc11a317e4ff7f6c1bb9522739d310
-
SHA1
2fa3a3b38f0448850425f6bdeac401d7150c4a1a
-
SHA256
27cec1de18331ab45a1176542d437d9fe9ea60412e3bc57c4c6ef1997d733acb
-
SHA512
3f2710e9e5e04623c9889b037c4dd9d7f505e6b723440721c2de489ab363305dfde405c45b4ac05ac864b6b8ee689cc995d8eff6ddfffa25e83875c1ba4e751e
-
SSDEEP
6144:n3C9BRo7tvnJ9oH0IRgZvjkIfzBgZJmAhc:n3C9ytvngQj1fz6ZJmAW
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2492-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2392-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2392-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1428-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1644-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1912-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/864-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1140-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2280-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1848-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1624-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2212-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1124-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2744 nljrjfx.exe 2632 lxjdlpv.exe 2568 xxphntj.exe 2596 fjjjx.exe 2736 xhtlldx.exe 2524 hjlfh.exe 2612 rxdlp.exe 2392 xjbbrtr.exe 1428 dtndn.exe 340 xfpjp.exe 2728 flpbb.exe 864 rbtrrtv.exe 1600 ldhtt.exe 1644 brxbpfx.exe 1912 lttvx.exe 1140 phtjbx.exe 2280 jtlvvvj.exe 2072 ltjbrd.exe 2100 jtvfhx.exe 1836 nlpdh.exe 3052 bvvbdtt.exe 2780 bddtpt.exe 440 dbvdv.exe 1248 rvbbb.exe 1124 vjtltpb.exe 1168 dhldnfl.exe 1848 lfvrd.exe 2244 tbfrbnt.exe 1624 dlvrhlb.exe 2220 jddfd.exe 2212 fnxpj.exe 2124 tjfdl.exe 2112 pbtfdx.exe 2832 fblhd.exe 2136 ltjvd.exe 2912 rljnp.exe 2688 rbrhtf.exe 3064 xflfjjn.exe 2940 jlbtjf.exe 2448 nptthbt.exe 2580 nlbjvpp.exe 2440 pnxfvnx.exe 2484 rntxjpj.exe 528 xdjxdf.exe 3032 ddddttt.exe 292 nvbfltt.exe 1120 fxlpnhj.exe 2720 hfbvp.exe 2856 btnnvl.exe 1208 tpxxfdt.exe 2140 tvtxdn.exe 1988 tdtxtvl.exe 1520 rthpr.exe 2452 lthbftr.exe 1828 pxvxpn.exe 1712 nplnp.exe 1792 lvpfphh.exe 772 lpdlrdp.exe 1732 dttlf.exe 2588 dlnjrtb.exe 1836 rdjnr.exe 2936 lxplt.exe 1692 pxbfpj.exe 840 plbttd.exe -
resource yara_rule behavioral1/memory/2492-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1428-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1644-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1912-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/864-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1140-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1848-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1624-286-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-304-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1124-250-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2492 wrote to memory of 2744 2492 01fc11a317e4ff7f6c1bb9522739d310_NeikiAnalytics.exe 28 PID 2492 wrote to memory of 2744 2492 01fc11a317e4ff7f6c1bb9522739d310_NeikiAnalytics.exe 28 PID 2492 wrote to memory of 2744 2492 01fc11a317e4ff7f6c1bb9522739d310_NeikiAnalytics.exe 28 PID 2492 wrote to memory of 2744 2492 01fc11a317e4ff7f6c1bb9522739d310_NeikiAnalytics.exe 28 PID 2744 wrote to memory of 2632 2744 nljrjfx.exe 29 PID 2744 wrote to memory of 2632 2744 nljrjfx.exe 29 PID 2744 wrote to memory of 2632 2744 nljrjfx.exe 29 PID 2744 wrote to memory of 2632 2744 nljrjfx.exe 29 PID 2632 wrote to memory of 2568 2632 lxjdlpv.exe 30 PID 2632 wrote to memory of 2568 2632 lxjdlpv.exe 30 PID 2632 wrote to memory of 2568 2632 lxjdlpv.exe 30 PID 2632 wrote to memory of 2568 2632 lxjdlpv.exe 30 PID 2568 wrote to memory of 2596 2568 xxphntj.exe 31 PID 2568 wrote to memory of 2596 2568 xxphntj.exe 31 PID 2568 wrote to memory of 2596 2568 xxphntj.exe 31 PID 2568 wrote to memory of 2596 2568 xxphntj.exe 31 PID 2596 wrote to memory of 2736 2596 fjjjx.exe 32 PID 2596 wrote to memory of 2736 2596 fjjjx.exe 32 PID 2596 wrote to memory of 2736 2596 fjjjx.exe 32 PID 2596 wrote to memory of 2736 2596 fjjjx.exe 32 PID 2736 wrote to memory of 2524 2736 xhtlldx.exe 33 PID 2736 wrote to memory of 2524 2736 xhtlldx.exe 33 PID 2736 wrote to memory of 2524 2736 xhtlldx.exe 33 PID 2736 wrote to memory of 2524 2736 xhtlldx.exe 33 PID 2524 wrote to memory of 2612 2524 hjlfh.exe 34 PID 2524 wrote to memory of 2612 2524 hjlfh.exe 34 PID 2524 wrote to memory of 2612 2524 hjlfh.exe 34 PID 2524 wrote to memory of 2612 2524 hjlfh.exe 34 PID 2612 wrote to memory of 2392 2612 rxdlp.exe 35 PID 2612 wrote to memory of 2392 2612 rxdlp.exe 35 PID 2612 wrote to memory of 2392 2612 rxdlp.exe 35 PID 2612 wrote to memory of 2392 2612 rxdlp.exe 35 PID 2392 wrote to memory of 1428 2392 xjbbrtr.exe 36 PID 2392 wrote to memory of 1428 2392 xjbbrtr.exe 36 PID 2392 wrote to memory of 1428 2392 xjbbrtr.exe 36 PID 2392 wrote to memory of 1428 2392 xjbbrtr.exe 36 PID 1428 wrote to memory of 340 1428 dtndn.exe 37 PID 1428 wrote to memory of 340 1428 dtndn.exe 37 PID 1428 wrote to memory of 340 1428 dtndn.exe 37 PID 1428 wrote to memory of 340 1428 dtndn.exe 37 PID 340 wrote to memory of 2728 340 xfpjp.exe 38 PID 340 wrote to memory of 2728 340 xfpjp.exe 38 PID 340 wrote to memory of 2728 340 xfpjp.exe 38 PID 340 wrote to memory of 2728 340 xfpjp.exe 38 PID 2728 wrote to memory of 864 2728 flpbb.exe 39 PID 2728 wrote to memory of 864 2728 flpbb.exe 39 PID 2728 wrote to memory of 864 2728 flpbb.exe 39 PID 2728 wrote to memory of 864 2728 flpbb.exe 39 PID 864 wrote to memory of 1600 864 rbtrrtv.exe 40 PID 864 wrote to memory of 1600 864 rbtrrtv.exe 40 PID 864 wrote to memory of 1600 864 rbtrrtv.exe 40 PID 864 wrote to memory of 1600 864 rbtrrtv.exe 40 PID 1600 wrote to memory of 1644 1600 ldhtt.exe 41 PID 1600 wrote to memory of 1644 1600 ldhtt.exe 41 PID 1600 wrote to memory of 1644 1600 ldhtt.exe 41 PID 1600 wrote to memory of 1644 1600 ldhtt.exe 41 PID 1644 wrote to memory of 1912 1644 brxbpfx.exe 42 PID 1644 wrote to memory of 1912 1644 brxbpfx.exe 42 PID 1644 wrote to memory of 1912 1644 brxbpfx.exe 42 PID 1644 wrote to memory of 1912 1644 brxbpfx.exe 42 PID 1912 wrote to memory of 1140 1912 lttvx.exe 43 PID 1912 wrote to memory of 1140 1912 lttvx.exe 43 PID 1912 wrote to memory of 1140 1912 lttvx.exe 43 PID 1912 wrote to memory of 1140 1912 lttvx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\01fc11a317e4ff7f6c1bb9522739d310_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\01fc11a317e4ff7f6c1bb9522739d310_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\nljrjfx.exec:\nljrjfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\lxjdlpv.exec:\lxjdlpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\xxphntj.exec:\xxphntj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\fjjjx.exec:\fjjjx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\xhtlldx.exec:\xhtlldx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\hjlfh.exec:\hjlfh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\rxdlp.exec:\rxdlp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\xjbbrtr.exec:\xjbbrtr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\dtndn.exec:\dtndn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\xfpjp.exec:\xfpjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:340 -
\??\c:\flpbb.exec:\flpbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\rbtrrtv.exec:\rbtrrtv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\ldhtt.exec:\ldhtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\brxbpfx.exec:\brxbpfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\lttvx.exec:\lttvx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\phtjbx.exec:\phtjbx.exe17⤵
- Executes dropped EXE
PID:1140 -
\??\c:\jtlvvvj.exec:\jtlvvvj.exe18⤵
- Executes dropped EXE
PID:2280 -
\??\c:\ltjbrd.exec:\ltjbrd.exe19⤵
- Executes dropped EXE
PID:2072 -
\??\c:\jtvfhx.exec:\jtvfhx.exe20⤵
- Executes dropped EXE
PID:2100 -
\??\c:\nlpdh.exec:\nlpdh.exe21⤵
- Executes dropped EXE
PID:1836 -
\??\c:\bvvbdtt.exec:\bvvbdtt.exe22⤵
- Executes dropped EXE
PID:3052 -
\??\c:\bddtpt.exec:\bddtpt.exe23⤵
- Executes dropped EXE
PID:2780 -
\??\c:\dbvdv.exec:\dbvdv.exe24⤵
- Executes dropped EXE
PID:440 -
\??\c:\rvbbb.exec:\rvbbb.exe25⤵
- Executes dropped EXE
PID:1248 -
\??\c:\vjtltpb.exec:\vjtltpb.exe26⤵
- Executes dropped EXE
PID:1124 -
\??\c:\dhldnfl.exec:\dhldnfl.exe27⤵
- Executes dropped EXE
PID:1168 -
\??\c:\lfvrd.exec:\lfvrd.exe28⤵
- Executes dropped EXE
PID:1848 -
\??\c:\tbfrbnt.exec:\tbfrbnt.exe29⤵
- Executes dropped EXE
PID:2244 -
\??\c:\dlvrhlb.exec:\dlvrhlb.exe30⤵
- Executes dropped EXE
PID:1624 -
\??\c:\jddfd.exec:\jddfd.exe31⤵
- Executes dropped EXE
PID:2220 -
\??\c:\fnxpj.exec:\fnxpj.exe32⤵
- Executes dropped EXE
PID:2212 -
\??\c:\tjfdl.exec:\tjfdl.exe33⤵
- Executes dropped EXE
PID:2124 -
\??\c:\pbtfdx.exec:\pbtfdx.exe34⤵
- Executes dropped EXE
PID:2112 -
\??\c:\fblhd.exec:\fblhd.exe35⤵
- Executes dropped EXE
PID:2832 -
\??\c:\ltjvd.exec:\ltjvd.exe36⤵
- Executes dropped EXE
PID:2136 -
\??\c:\rljnp.exec:\rljnp.exe37⤵
- Executes dropped EXE
PID:2912 -
\??\c:\rbrhtf.exec:\rbrhtf.exe38⤵
- Executes dropped EXE
PID:2688 -
\??\c:\xflfjjn.exec:\xflfjjn.exe39⤵
- Executes dropped EXE
PID:3064 -
\??\c:\jlbtjf.exec:\jlbtjf.exe40⤵
- Executes dropped EXE
PID:2940 -
\??\c:\nptthbt.exec:\nptthbt.exe41⤵
- Executes dropped EXE
PID:2448 -
\??\c:\nlbjvpp.exec:\nlbjvpp.exe42⤵
- Executes dropped EXE
PID:2580 -
\??\c:\pnxfvnx.exec:\pnxfvnx.exe43⤵
- Executes dropped EXE
PID:2440 -
\??\c:\rntxjpj.exec:\rntxjpj.exe44⤵
- Executes dropped EXE
PID:2484 -
\??\c:\xdjxdf.exec:\xdjxdf.exe45⤵
- Executes dropped EXE
PID:528 -
\??\c:\ddddttt.exec:\ddddttt.exe46⤵
- Executes dropped EXE
PID:3032 -
\??\c:\nvbfltt.exec:\nvbfltt.exe47⤵
- Executes dropped EXE
PID:292 -
\??\c:\fxlpnhj.exec:\fxlpnhj.exe48⤵
- Executes dropped EXE
PID:1120 -
\??\c:\hfbvp.exec:\hfbvp.exe49⤵
- Executes dropped EXE
PID:2720 -
\??\c:\btnnvl.exec:\btnnvl.exe50⤵
- Executes dropped EXE
PID:2856 -
\??\c:\tpxxfdt.exec:\tpxxfdt.exe51⤵
- Executes dropped EXE
PID:1208 -
\??\c:\tvtxdn.exec:\tvtxdn.exe52⤵
- Executes dropped EXE
PID:2140 -
\??\c:\tdtxtvl.exec:\tdtxtvl.exe53⤵
- Executes dropped EXE
PID:1988 -
\??\c:\rthpr.exec:\rthpr.exe54⤵
- Executes dropped EXE
PID:1520 -
\??\c:\lthbftr.exec:\lthbftr.exe55⤵
- Executes dropped EXE
PID:2452 -
\??\c:\pxvxpn.exec:\pxvxpn.exe56⤵
- Executes dropped EXE
PID:1828 -
\??\c:\nplnp.exec:\nplnp.exe57⤵
- Executes dropped EXE
PID:1712 -
\??\c:\lvpfphh.exec:\lvpfphh.exe58⤵
- Executes dropped EXE
PID:1792 -
\??\c:\lpdlrdp.exec:\lpdlrdp.exe59⤵
- Executes dropped EXE
PID:772 -
\??\c:\dttlf.exec:\dttlf.exe60⤵
- Executes dropped EXE
PID:1732 -
\??\c:\dlnjrtb.exec:\dlnjrtb.exe61⤵
- Executes dropped EXE
PID:2588 -
\??\c:\rdjnr.exec:\rdjnr.exe62⤵
- Executes dropped EXE
PID:1836 -
\??\c:\lxplt.exec:\lxplt.exe63⤵
- Executes dropped EXE
PID:2936 -
\??\c:\pxbfpj.exec:\pxbfpj.exe64⤵
- Executes dropped EXE
PID:1692 -
\??\c:\plbttd.exec:\plbttd.exe65⤵
- Executes dropped EXE
PID:840 -
\??\c:\rldlj.exec:\rldlj.exe66⤵PID:1468
-
\??\c:\rbtfrv.exec:\rbtfrv.exe67⤵PID:3020
-
\??\c:\hnhtbdv.exec:\hnhtbdv.exe68⤵PID:780
-
\??\c:\bbpdp.exec:\bbpdp.exe69⤵PID:1180
-
\??\c:\bbdvlv.exec:\bbdvlv.exe70⤵PID:1564
-
\??\c:\xxtnx.exec:\xxtnx.exe71⤵PID:1652
-
\??\c:\bdxbbpp.exec:\bdxbbpp.exe72⤵PID:1676
-
\??\c:\xfvddf.exec:\xfvddf.exe73⤵PID:1380
-
\??\c:\rptdf.exec:\rptdf.exe74⤵PID:1572
-
\??\c:\bpnhr.exec:\bpnhr.exe75⤵PID:564
-
\??\c:\bvfhv.exec:\bvfhv.exe76⤵PID:1780
-
\??\c:\jxvbfdd.exec:\jxvbfdd.exe77⤵PID:1756
-
\??\c:\blfjdxx.exec:\blfjdxx.exe78⤵PID:1708
-
\??\c:\fjhlphn.exec:\fjhlphn.exe79⤵PID:2832
-
\??\c:\rbrvv.exec:\rbrvv.exe80⤵PID:2136
-
\??\c:\bpnfdtx.exec:\bpnfdtx.exe81⤵PID:2912
-
\??\c:\lfpdtjn.exec:\lfpdtjn.exe82⤵PID:2688
-
\??\c:\vxxjfj.exec:\vxxjfj.exe83⤵PID:2652
-
\??\c:\hdfvfnb.exec:\hdfvfnb.exe84⤵PID:2940
-
\??\c:\jbhnp.exec:\jbhnp.exe85⤵PID:1976
-
\??\c:\jdffxfx.exec:\jdffxfx.exe86⤵PID:2448
-
\??\c:\vjbhdtj.exec:\vjbhdtj.exe87⤵PID:2580
-
\??\c:\hthbbr.exec:\hthbbr.exe88⤵PID:2440
-
\??\c:\pdnblrl.exec:\pdnblrl.exe89⤵PID:2484
-
\??\c:\ljdbb.exec:\ljdbb.exe90⤵PID:1956
-
\??\c:\dxtvx.exec:\dxtvx.exe91⤵PID:572
-
\??\c:\lffbp.exec:\lffbp.exe92⤵PID:292
-
\??\c:\xtrhjl.exec:\xtrhjl.exe93⤵PID:340
-
\??\c:\jhxthl.exec:\jhxthl.exe94⤵PID:808
-
\??\c:\fnvhxdh.exec:\fnvhxdh.exe95⤵PID:2592
-
\??\c:\hlrvb.exec:\hlrvb.exe96⤵PID:1600
-
\??\c:\vjxpl.exec:\vjxpl.exe97⤵PID:2064
-
\??\c:\djxvtp.exec:\djxvtp.exe98⤵PID:1988
-
\??\c:\xrnpr.exec:\xrnpr.exe99⤵PID:1912
-
\??\c:\jllbd.exec:\jllbd.exe100⤵PID:1648
-
\??\c:\hjtbvv.exec:\hjtbvv.exe101⤵PID:1136
-
\??\c:\htblv.exec:\htblv.exe102⤵PID:1908
-
\??\c:\tbrvxbf.exec:\tbrvxbf.exe103⤵PID:944
-
\??\c:\dlxlh.exec:\dlxlh.exe104⤵PID:1632
-
\??\c:\rdfbxdt.exec:\rdfbxdt.exe105⤵PID:1768
-
\??\c:\ftbfjrf.exec:\ftbfjrf.exe106⤵PID:3040
-
\??\c:\bpxjlxr.exec:\bpxjlxr.exe107⤵PID:2092
-
\??\c:\xdrjlp.exec:\xdrjlp.exe108⤵PID:3016
-
\??\c:\rnrtllp.exec:\rnrtllp.exe109⤵PID:1548
-
\??\c:\djrjhvr.exec:\djrjhvr.exe110⤵PID:1248
-
\??\c:\tpjdfb.exec:\tpjdfb.exe111⤵PID:1468
-
\??\c:\vbnfxxp.exec:\vbnfxxp.exe112⤵PID:2900
-
\??\c:\xbjlj.exec:\xbjlj.exe113⤵PID:1080
-
\??\c:\dpbbld.exec:\dpbbld.exe114⤵PID:2036
-
\??\c:\rvfdlj.exec:\rvfdlj.exe115⤵PID:2196
-
\??\c:\djbft.exec:\djbft.exe116⤵PID:2296
-
\??\c:\jdrpld.exec:\jdrpld.exe117⤵PID:1540
-
\??\c:\nfrnlx.exec:\nfrnlx.exe118⤵PID:2356
-
\??\c:\lnfdxnr.exec:\lnfdxnr.exe119⤵PID:2212
-
\??\c:\vxltr.exec:\vxltr.exe120⤵PID:1328
-
\??\c:\vxhftbh.exec:\vxhftbh.exe121⤵PID:1780
-
\??\c:\pltxr.exec:\pltxr.exe122⤵PID:2824
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-