Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 21:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3cd22027ffacbd5314c1cfc65c654930_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
3cd22027ffacbd5314c1cfc65c654930_NeikiAnalytics.exe
-
Size
79KB
-
MD5
3cd22027ffacbd5314c1cfc65c654930
-
SHA1
fc165859ee79d09e83d4e9a98b294e5048da7c80
-
SHA256
ec65aea2d1c57d693cc39b9658f44fa3e507f5099ce2d7a5ae63aa8648707ca8
-
SHA512
c288659a13c57065a62cab294740f715aaae9aa7c5ee6edd74dc7d3cd48b67889484d36a4f138e867adedb22f27a1c189c02692f5fd25eed74a7588ac6e055b8
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDWiekja1br3GGBxfot3e2ke:ymb3NkkiQ3mdBjFWXkj7afoI2r
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/1152-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2332-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2216-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2376-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1108-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1436-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1592-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1536-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1656-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1384-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/960-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1560-266-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1784-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1248-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2216 vffht.exe 2332 ptptdd.exe 2880 phfdxhl.exe 2888 tbpnnt.exe 2912 tldnnpv.exe 2160 dhffxdp.exe 2528 rjlnpd.exe 2624 vfpxjb.exe 2676 ftxvnt.exe 2376 pflvrbt.exe 2456 blbrb.exe 1108 lrdth.exe 1436 nvlrhp.exe 1592 vxltl.exe 1536 pltbdvj.exe 1656 xlbvt.exe 1384 xvrnv.exe 2364 jlhtp.exe 2700 xfhthnn.exe 2720 jnjjj.exe 2672 pnndt.exe 2792 pthtxb.exe 1056 vjrflp.exe 952 tppth.exe 960 lpbxvb.exe 1560 prnffpn.exe 1784 vjhhlj.exe 1456 jdxfnb.exe 2920 bhtrlfp.exe 1248 nppxhr.exe 976 fdddht.exe 1984 fnrrhj.exe 1772 fjhvppv.exe 1884 dbnpdjn.exe 2192 dnxrpp.exe 2816 lvxfv.exe 2232 tphlnn.exe 1680 fhvxnxp.exe 2464 fdlfrbh.exe 2472 hpxrlb.exe 2908 rxbxf.exe 2524 plfxbl.exe 2484 ddhjlp.exe 2628 vlxvn.exe 2612 lxrdjd.exe 2868 vfltjx.exe 2600 pvfnbl.exe 2392 bnxrhnj.exe 2056 hpnpxj.exe 2852 jprdp.exe 2036 vrdtvld.exe 1520 bpjxl.exe 1920 hnhlt.exe 944 bvfjt.exe 2340 bhbph.exe 2328 dftttdx.exe 2448 flpptp.exe 676 dxtvthx.exe 2748 nxtnjxn.exe 2700 vxfpprf.exe 2708 ddnln.exe 2664 hdxbvnn.exe 2264 nldxtlp.exe 1800 tpxdhx.exe -
resource yara_rule behavioral1/memory/1152-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2160-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2160-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1108-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1436-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1592-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1536-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1656-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1384-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/960-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1560-266-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1784-275-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1248-302-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1152 wrote to memory of 2216 1152 3cd22027ffacbd5314c1cfc65c654930_NeikiAnalytics.exe 28 PID 1152 wrote to memory of 2216 1152 3cd22027ffacbd5314c1cfc65c654930_NeikiAnalytics.exe 28 PID 1152 wrote to memory of 2216 1152 3cd22027ffacbd5314c1cfc65c654930_NeikiAnalytics.exe 28 PID 1152 wrote to memory of 2216 1152 3cd22027ffacbd5314c1cfc65c654930_NeikiAnalytics.exe 28 PID 2216 wrote to memory of 2332 2216 vffht.exe 29 PID 2216 wrote to memory of 2332 2216 vffht.exe 29 PID 2216 wrote to memory of 2332 2216 vffht.exe 29 PID 2216 wrote to memory of 2332 2216 vffht.exe 29 PID 2332 wrote to memory of 2880 2332 ptptdd.exe 30 PID 2332 wrote to memory of 2880 2332 ptptdd.exe 30 PID 2332 wrote to memory of 2880 2332 ptptdd.exe 30 PID 2332 wrote to memory of 2880 2332 ptptdd.exe 30 PID 2880 wrote to memory of 2888 2880 phfdxhl.exe 31 PID 2880 wrote to memory of 2888 2880 phfdxhl.exe 31 PID 2880 wrote to memory of 2888 2880 phfdxhl.exe 31 PID 2880 wrote to memory of 2888 2880 phfdxhl.exe 31 PID 2888 wrote to memory of 2912 2888 tbpnnt.exe 32 PID 2888 wrote to memory of 2912 2888 tbpnnt.exe 32 PID 2888 wrote to memory of 2912 2888 tbpnnt.exe 32 PID 2888 wrote to memory of 2912 2888 tbpnnt.exe 32 PID 2912 wrote to memory of 2160 2912 tldnnpv.exe 33 PID 2912 wrote to memory of 2160 2912 tldnnpv.exe 33 PID 2912 wrote to memory of 2160 2912 tldnnpv.exe 33 PID 2912 wrote to memory of 2160 2912 tldnnpv.exe 33 PID 2160 wrote to memory of 2528 2160 dhffxdp.exe 34 PID 2160 wrote to memory of 2528 2160 dhffxdp.exe 34 PID 2160 wrote to memory of 2528 2160 dhffxdp.exe 34 PID 2160 wrote to memory of 2528 2160 dhffxdp.exe 34 PID 2528 wrote to memory of 2624 2528 rjlnpd.exe 35 PID 2528 wrote to memory of 2624 2528 rjlnpd.exe 35 PID 2528 wrote to memory of 2624 2528 rjlnpd.exe 35 PID 2528 wrote to memory of 2624 2528 rjlnpd.exe 35 PID 2624 wrote to memory of 2676 2624 vfpxjb.exe 36 PID 2624 wrote to memory of 2676 2624 vfpxjb.exe 36 PID 2624 wrote to memory of 2676 2624 vfpxjb.exe 36 PID 2624 wrote to memory of 2676 2624 vfpxjb.exe 36 PID 2676 wrote to memory of 2376 2676 ftxvnt.exe 37 PID 2676 wrote to memory of 2376 2676 ftxvnt.exe 37 PID 2676 wrote to memory of 2376 2676 ftxvnt.exe 37 PID 2676 wrote to memory of 2376 2676 ftxvnt.exe 37 PID 2376 wrote to memory of 2456 2376 pflvrbt.exe 38 PID 2376 wrote to memory of 2456 2376 pflvrbt.exe 38 PID 2376 wrote to memory of 2456 2376 pflvrbt.exe 38 PID 2376 wrote to memory of 2456 2376 pflvrbt.exe 38 PID 2456 wrote to memory of 1108 2456 blbrb.exe 39 PID 2456 wrote to memory of 1108 2456 blbrb.exe 39 PID 2456 wrote to memory of 1108 2456 blbrb.exe 39 PID 2456 wrote to memory of 1108 2456 blbrb.exe 39 PID 1108 wrote to memory of 1436 1108 lrdth.exe 40 PID 1108 wrote to memory of 1436 1108 lrdth.exe 40 PID 1108 wrote to memory of 1436 1108 lrdth.exe 40 PID 1108 wrote to memory of 1436 1108 lrdth.exe 40 PID 1436 wrote to memory of 1592 1436 nvlrhp.exe 41 PID 1436 wrote to memory of 1592 1436 nvlrhp.exe 41 PID 1436 wrote to memory of 1592 1436 nvlrhp.exe 41 PID 1436 wrote to memory of 1592 1436 nvlrhp.exe 41 PID 1592 wrote to memory of 1536 1592 vxltl.exe 42 PID 1592 wrote to memory of 1536 1592 vxltl.exe 42 PID 1592 wrote to memory of 1536 1592 vxltl.exe 42 PID 1592 wrote to memory of 1536 1592 vxltl.exe 42 PID 1536 wrote to memory of 1656 1536 pltbdvj.exe 43 PID 1536 wrote to memory of 1656 1536 pltbdvj.exe 43 PID 1536 wrote to memory of 1656 1536 pltbdvj.exe 43 PID 1536 wrote to memory of 1656 1536 pltbdvj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\3cd22027ffacbd5314c1cfc65c654930_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3cd22027ffacbd5314c1cfc65c654930_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\vffht.exec:\vffht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\ptptdd.exec:\ptptdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\phfdxhl.exec:\phfdxhl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\tbpnnt.exec:\tbpnnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\tldnnpv.exec:\tldnnpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\dhffxdp.exec:\dhffxdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\rjlnpd.exec:\rjlnpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\vfpxjb.exec:\vfpxjb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\ftxvnt.exec:\ftxvnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\pflvrbt.exec:\pflvrbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\blbrb.exec:\blbrb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\lrdth.exec:\lrdth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\nvlrhp.exec:\nvlrhp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\vxltl.exec:\vxltl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\pltbdvj.exec:\pltbdvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\xlbvt.exec:\xlbvt.exe17⤵
- Executes dropped EXE
PID:1656 -
\??\c:\xvrnv.exec:\xvrnv.exe18⤵
- Executes dropped EXE
PID:1384 -
\??\c:\jlhtp.exec:\jlhtp.exe19⤵
- Executes dropped EXE
PID:2364 -
\??\c:\xfhthnn.exec:\xfhthnn.exe20⤵
- Executes dropped EXE
PID:2700 -
\??\c:\jnjjj.exec:\jnjjj.exe21⤵
- Executes dropped EXE
PID:2720 -
\??\c:\pnndt.exec:\pnndt.exe22⤵
- Executes dropped EXE
PID:2672 -
\??\c:\pthtxb.exec:\pthtxb.exe23⤵
- Executes dropped EXE
PID:2792 -
\??\c:\vjrflp.exec:\vjrflp.exe24⤵
- Executes dropped EXE
PID:1056 -
\??\c:\tppth.exec:\tppth.exe25⤵
- Executes dropped EXE
PID:952 -
\??\c:\lpbxvb.exec:\lpbxvb.exe26⤵
- Executes dropped EXE
PID:960 -
\??\c:\prnffpn.exec:\prnffpn.exe27⤵
- Executes dropped EXE
PID:1560 -
\??\c:\vjhhlj.exec:\vjhhlj.exe28⤵
- Executes dropped EXE
PID:1784 -
\??\c:\jdxfnb.exec:\jdxfnb.exe29⤵
- Executes dropped EXE
PID:1456 -
\??\c:\bhtrlfp.exec:\bhtrlfp.exe30⤵
- Executes dropped EXE
PID:2920 -
\??\c:\nppxhr.exec:\nppxhr.exe31⤵
- Executes dropped EXE
PID:1248 -
\??\c:\fdddht.exec:\fdddht.exe32⤵
- Executes dropped EXE
PID:976 -
\??\c:\fnrrhj.exec:\fnrrhj.exe33⤵
- Executes dropped EXE
PID:1984 -
\??\c:\fjhvppv.exec:\fjhvppv.exe34⤵
- Executes dropped EXE
PID:1772 -
\??\c:\dbnpdjn.exec:\dbnpdjn.exe35⤵
- Executes dropped EXE
PID:1884 -
\??\c:\dnxrpp.exec:\dnxrpp.exe36⤵
- Executes dropped EXE
PID:2192 -
\??\c:\lvxfv.exec:\lvxfv.exe37⤵
- Executes dropped EXE
PID:2816 -
\??\c:\tphlnn.exec:\tphlnn.exe38⤵
- Executes dropped EXE
PID:2232 -
\??\c:\fhvxnxp.exec:\fhvxnxp.exe39⤵
- Executes dropped EXE
PID:1680 -
\??\c:\fdlfrbh.exec:\fdlfrbh.exe40⤵
- Executes dropped EXE
PID:2464 -
\??\c:\hpxrlb.exec:\hpxrlb.exe41⤵
- Executes dropped EXE
PID:2472 -
\??\c:\rxbxf.exec:\rxbxf.exe42⤵
- Executes dropped EXE
PID:2908 -
\??\c:\plfxbl.exec:\plfxbl.exe43⤵
- Executes dropped EXE
PID:2524 -
\??\c:\ddhjlp.exec:\ddhjlp.exe44⤵
- Executes dropped EXE
PID:2484 -
\??\c:\vlxvn.exec:\vlxvn.exe45⤵
- Executes dropped EXE
PID:2628 -
\??\c:\lxrdjd.exec:\lxrdjd.exe46⤵
- Executes dropped EXE
PID:2612 -
\??\c:\vfltjx.exec:\vfltjx.exe47⤵
- Executes dropped EXE
PID:2868 -
\??\c:\pvfnbl.exec:\pvfnbl.exe48⤵
- Executes dropped EXE
PID:2600 -
\??\c:\bnxrhnj.exec:\bnxrhnj.exe49⤵
- Executes dropped EXE
PID:2392 -
\??\c:\hpnpxj.exec:\hpnpxj.exe50⤵
- Executes dropped EXE
PID:2056 -
\??\c:\jprdp.exec:\jprdp.exe51⤵
- Executes dropped EXE
PID:2852 -
\??\c:\vrdtvld.exec:\vrdtvld.exe52⤵
- Executes dropped EXE
PID:2036 -
\??\c:\bpjxl.exec:\bpjxl.exe53⤵
- Executes dropped EXE
PID:1520 -
\??\c:\hnhlt.exec:\hnhlt.exe54⤵
- Executes dropped EXE
PID:1920 -
\??\c:\bvfjt.exec:\bvfjt.exe55⤵
- Executes dropped EXE
PID:944 -
\??\c:\bhbph.exec:\bhbph.exe56⤵
- Executes dropped EXE
PID:2340 -
\??\c:\dftttdx.exec:\dftttdx.exe57⤵
- Executes dropped EXE
PID:2328 -
\??\c:\flpptp.exec:\flpptp.exe58⤵
- Executes dropped EXE
PID:2448 -
\??\c:\dxtvthx.exec:\dxtvthx.exe59⤵
- Executes dropped EXE
PID:676 -
\??\c:\nxtnjxn.exec:\nxtnjxn.exe60⤵
- Executes dropped EXE
PID:2748 -
\??\c:\vxfpprf.exec:\vxfpprf.exe61⤵
- Executes dropped EXE
PID:2700 -
\??\c:\ddnln.exec:\ddnln.exe62⤵
- Executes dropped EXE
PID:2708 -
\??\c:\hdxbvnn.exec:\hdxbvnn.exe63⤵
- Executes dropped EXE
PID:2664 -
\??\c:\nldxtlp.exec:\nldxtlp.exe64⤵
- Executes dropped EXE
PID:2264 -
\??\c:\tpxdhx.exec:\tpxdhx.exe65⤵
- Executes dropped EXE
PID:1800 -
\??\c:\nddtnx.exec:\nddtnx.exe66⤵PID:1056
-
\??\c:\hvbpvx.exec:\hvbpvx.exe67⤵PID:1116
-
\??\c:\ddbjx.exec:\ddbjx.exe68⤵PID:3012
-
\??\c:\rfrlf.exec:\rfrlf.exe69⤵PID:1012
-
\??\c:\tdpdrrl.exec:\tdpdrrl.exe70⤵PID:276
-
\??\c:\phfthf.exec:\phfthf.exe71⤵PID:688
-
\??\c:\tnlnbfj.exec:\tnlnbfj.exe72⤵PID:1268
-
\??\c:\rbjnbj.exec:\rbjnbj.exe73⤵PID:2268
-
\??\c:\lvbld.exec:\lvbld.exe74⤵PID:2164
-
\??\c:\hvbvdf.exec:\hvbvdf.exe75⤵PID:876
-
\??\c:\plxfxvh.exec:\plxfxvh.exe76⤵PID:2136
-
\??\c:\jhphlhl.exec:\jhphlhl.exe77⤵PID:1984
-
\??\c:\lptxfjn.exec:\lptxfjn.exe78⤵PID:2776
-
\??\c:\vpvrnjn.exec:\vpvrnjn.exe79⤵PID:2172
-
\??\c:\vxfftjn.exec:\vxfftjn.exe80⤵PID:1604
-
\??\c:\nlfpbrp.exec:\nlfpbrp.exe81⤵PID:2816
-
\??\c:\hhfbhv.exec:\hhfbhv.exe82⤵PID:2876
-
\??\c:\jdhbd.exec:\jdhbd.exe83⤵PID:1680
-
\??\c:\hvndpt.exec:\hvndpt.exe84⤵PID:2756
-
\??\c:\prntjnd.exec:\prntjnd.exe85⤵PID:2472
-
\??\c:\htlpnd.exec:\htlpnd.exe86⤵PID:2908
-
\??\c:\pnbbnrp.exec:\pnbbnrp.exe87⤵PID:2524
-
\??\c:\llhhh.exec:\llhhh.exe88⤵PID:2484
-
\??\c:\fflrb.exec:\fflrb.exe89⤵PID:2628
-
\??\c:\dxlttbb.exec:\dxlttbb.exe90⤵PID:2612
-
\??\c:\nhvpxvn.exec:\nhvpxvn.exe91⤵PID:2868
-
\??\c:\vppxdh.exec:\vppxdh.exe92⤵PID:2676
-
\??\c:\jtdbj.exec:\jtdbj.exe93⤵PID:2392
-
\??\c:\rtnxpj.exec:\rtnxpj.exe94⤵PID:2012
-
\??\c:\rbbfx.exec:\rbbfx.exe95⤵PID:1432
-
\??\c:\hnxftf.exec:\hnxftf.exe96⤵PID:948
-
\??\c:\thpdbh.exec:\thpdbh.exe97⤵PID:2896
-
\??\c:\jnnjxnr.exec:\jnnjxnr.exe98⤵PID:2168
-
\??\c:\frlfnf.exec:\frlfnf.exe99⤵PID:1640
-
\??\c:\ptxdpl.exec:\ptxdpl.exe100⤵PID:564
-
\??\c:\dpfbl.exec:\dpfbl.exe101⤵PID:1380
-
\??\c:\lxlrjnt.exec:\lxlrjnt.exe102⤵PID:1384
-
\??\c:\jvhrjl.exec:\jvhrjl.exe103⤵PID:2696
-
\??\c:\hpttt.exec:\hpttt.exe104⤵PID:676
-
\??\c:\vtlll.exec:\vtlll.exe105⤵PID:2740
-
\??\c:\nhdfhrp.exec:\nhdfhrp.exe106⤵PID:336
-
\??\c:\xpdfrft.exec:\xpdfrft.exe107⤵PID:2096
-
\??\c:\rxlhddl.exec:\rxlhddl.exe108⤵PID:1224
-
\??\c:\blnnn.exec:\blnnn.exe109⤵PID:272
-
\??\c:\vhbhjrj.exec:\vhbhjrj.exe110⤵PID:1552
-
\??\c:\dnndt.exec:\dnndt.exe111⤵PID:1700
-
\??\c:\jxhtvfp.exec:\jxhtvfp.exe112⤵PID:1796
-
\??\c:\lxxrbjl.exec:\lxxrbjl.exe113⤵PID:2016
-
\??\c:\jhvvtd.exec:\jhvvtd.exe114⤵PID:2976
-
\??\c:\nfthtft.exec:\nfthtft.exe115⤵PID:2788
-
\??\c:\hdltj.exec:\hdltj.exe116⤵PID:904
-
\??\c:\bfrtdf.exec:\bfrtdf.exe117⤵PID:2844
-
\??\c:\vlhpt.exec:\vlhpt.exe118⤵PID:2952
-
\??\c:\hfbxxl.exec:\hfbxxl.exe119⤵PID:2828
-
\??\c:\bfjdpx.exec:\bfjdpx.exe120⤵PID:2184
-
\??\c:\nthjdpt.exec:\nthjdpt.exe121⤵PID:2008
-
\??\c:\ndxtf.exec:\ndxtf.exe122⤵PID:2224
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-