Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 00:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4df61ff4fc8ee33e6178abd7db6faa60_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
4df61ff4fc8ee33e6178abd7db6faa60_NeikiAnalytics.exe
-
Size
64KB
-
MD5
4df61ff4fc8ee33e6178abd7db6faa60
-
SHA1
e5cb51e8858db49826564a62ecc983c035340c7f
-
SHA256
c516f31f5d1c788407f1565b1800080e9ff193b5e0f53d52b70c3c49ad63ab1e
-
SHA512
ad4265cd2642a74795be30c1683889e98a23b95325f46157ba8feda9020ea32d97e23a1adfb54604ee100c892adbfe5e1a671eb0f9d4b5eb050880828c9ec75d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfF:ymb3NkkiQ3mdBjFI4VB
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/1336-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1520-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2420-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2420-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1796-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2228-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/952-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1552-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2160-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1696-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1852-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/564-309-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2016 ndvfddl.exe 2884 frrfj.exe 2608 hdlxdfv.exe 1520 dhxhv.exe 2652 xdxbp.exe 2524 ljhdfdb.exe 2420 pbrtxvr.exe 1784 txjjdx.exe 2336 rxdvtt.exe 2424 phxtpj.exe 2672 bxxfnj.exe 808 lrhdtlr.exe 1796 htlxj.exe 2312 lpnpbtj.exe 2228 xpdjdd.exe 952 njbhb.exe 1652 xlrxxl.exe 1552 dlntp.exe 2096 xjdld.exe 2160 hdhfh.exe 1696 rtjbdbp.exe 2156 lrfnfnp.exe 3056 nxtbhx.exe 1856 vdfvth.exe 988 rhjtjj.exe 1852 jrblrfp.exe 1844 jrldf.exe 568 jbdbtj.exe 2708 ddlrprx.exe 2332 fhtbbt.exe 564 ftppp.exe 1676 djrtlnr.exe 1752 hlfxvxl.exe 1952 llljj.exe 2448 vfvnjx.exe 2860 htfdlh.exe 2600 hdbtlr.exe 2364 xrdnr.exe 2516 pvvhvht.exe 2660 drhjnl.exe 2528 prfxr.exe 2520 lvhfbb.exe 2388 fnpll.exe 3020 thdvh.exe 1032 vbvxfb.exe 1532 vrhrjt.exe 2456 lbpdndb.exe 372 dflvlvp.exe 2424 ldnrvpb.exe 1828 btvdfp.exe 1040 rfvvdjx.exe 1964 ftjtbhn.exe 2208 hnfxb.exe 2216 tfxdprf.exe 2180 rrpvbdd.exe 2972 ptvldx.exe 1588 dnttnhh.exe 1288 jvphb.exe 528 vththp.exe 1988 tdjvd.exe 336 blbvj.exe 1144 frdlrbd.exe 436 fblttfv.exe 1104 jvvnxx.exe -
resource yara_rule behavioral1/memory/1336-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/952-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1552-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2160-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1852-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/564-309-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1336 wrote to memory of 2016 1336 4df61ff4fc8ee33e6178abd7db6faa60_NeikiAnalytics.exe 28 PID 1336 wrote to memory of 2016 1336 4df61ff4fc8ee33e6178abd7db6faa60_NeikiAnalytics.exe 28 PID 1336 wrote to memory of 2016 1336 4df61ff4fc8ee33e6178abd7db6faa60_NeikiAnalytics.exe 28 PID 1336 wrote to memory of 2016 1336 4df61ff4fc8ee33e6178abd7db6faa60_NeikiAnalytics.exe 28 PID 2016 wrote to memory of 2884 2016 ndvfddl.exe 29 PID 2016 wrote to memory of 2884 2016 ndvfddl.exe 29 PID 2016 wrote to memory of 2884 2016 ndvfddl.exe 29 PID 2016 wrote to memory of 2884 2016 ndvfddl.exe 29 PID 2884 wrote to memory of 2608 2884 frrfj.exe 30 PID 2884 wrote to memory of 2608 2884 frrfj.exe 30 PID 2884 wrote to memory of 2608 2884 frrfj.exe 30 PID 2884 wrote to memory of 2608 2884 frrfj.exe 30 PID 2608 wrote to memory of 1520 2608 hdlxdfv.exe 31 PID 2608 wrote to memory of 1520 2608 hdlxdfv.exe 31 PID 2608 wrote to memory of 1520 2608 hdlxdfv.exe 31 PID 2608 wrote to memory of 1520 2608 hdlxdfv.exe 31 PID 1520 wrote to memory of 2652 1520 dhxhv.exe 32 PID 1520 wrote to memory of 2652 1520 dhxhv.exe 32 PID 1520 wrote to memory of 2652 1520 dhxhv.exe 32 PID 1520 wrote to memory of 2652 1520 dhxhv.exe 32 PID 2652 wrote to memory of 2524 2652 xdxbp.exe 33 PID 2652 wrote to memory of 2524 2652 xdxbp.exe 33 PID 2652 wrote to memory of 2524 2652 xdxbp.exe 33 PID 2652 wrote to memory of 2524 2652 xdxbp.exe 33 PID 2524 wrote to memory of 2420 2524 ljhdfdb.exe 34 PID 2524 wrote to memory of 2420 2524 ljhdfdb.exe 34 PID 2524 wrote to memory of 2420 2524 ljhdfdb.exe 34 PID 2524 wrote to memory of 2420 2524 ljhdfdb.exe 34 PID 2420 wrote to memory of 1784 2420 pbrtxvr.exe 35 PID 2420 wrote to memory of 1784 2420 pbrtxvr.exe 35 PID 2420 wrote to memory of 1784 2420 pbrtxvr.exe 35 PID 2420 wrote to memory of 1784 2420 pbrtxvr.exe 35 PID 1784 wrote to memory of 2336 1784 txjjdx.exe 36 PID 1784 wrote to memory of 2336 1784 txjjdx.exe 36 PID 1784 wrote to memory of 2336 1784 txjjdx.exe 36 PID 1784 wrote to memory of 2336 1784 txjjdx.exe 36 PID 2336 wrote to memory of 2424 2336 rxdvtt.exe 37 PID 2336 wrote to memory of 2424 2336 rxdvtt.exe 37 PID 2336 wrote to memory of 2424 2336 rxdvtt.exe 37 PID 2336 wrote to memory of 2424 2336 rxdvtt.exe 37 PID 2424 wrote to memory of 2672 2424 phxtpj.exe 38 PID 2424 wrote to memory of 2672 2424 phxtpj.exe 38 PID 2424 wrote to memory of 2672 2424 phxtpj.exe 38 PID 2424 wrote to memory of 2672 2424 phxtpj.exe 38 PID 2672 wrote to memory of 808 2672 bxxfnj.exe 39 PID 2672 wrote to memory of 808 2672 bxxfnj.exe 39 PID 2672 wrote to memory of 808 2672 bxxfnj.exe 39 PID 2672 wrote to memory of 808 2672 bxxfnj.exe 39 PID 808 wrote to memory of 1796 808 lrhdtlr.exe 40 PID 808 wrote to memory of 1796 808 lrhdtlr.exe 40 PID 808 wrote to memory of 1796 808 lrhdtlr.exe 40 PID 808 wrote to memory of 1796 808 lrhdtlr.exe 40 PID 1796 wrote to memory of 2312 1796 htlxj.exe 41 PID 1796 wrote to memory of 2312 1796 htlxj.exe 41 PID 1796 wrote to memory of 2312 1796 htlxj.exe 41 PID 1796 wrote to memory of 2312 1796 htlxj.exe 41 PID 2312 wrote to memory of 2228 2312 lpnpbtj.exe 42 PID 2312 wrote to memory of 2228 2312 lpnpbtj.exe 42 PID 2312 wrote to memory of 2228 2312 lpnpbtj.exe 42 PID 2312 wrote to memory of 2228 2312 lpnpbtj.exe 42 PID 2228 wrote to memory of 952 2228 xpdjdd.exe 43 PID 2228 wrote to memory of 952 2228 xpdjdd.exe 43 PID 2228 wrote to memory of 952 2228 xpdjdd.exe 43 PID 2228 wrote to memory of 952 2228 xpdjdd.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\4df61ff4fc8ee33e6178abd7db6faa60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4df61ff4fc8ee33e6178abd7db6faa60_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\ndvfddl.exec:\ndvfddl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\frrfj.exec:\frrfj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\hdlxdfv.exec:\hdlxdfv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\dhxhv.exec:\dhxhv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\xdxbp.exec:\xdxbp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\ljhdfdb.exec:\ljhdfdb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\pbrtxvr.exec:\pbrtxvr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\txjjdx.exec:\txjjdx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\rxdvtt.exec:\rxdvtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\phxtpj.exec:\phxtpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\bxxfnj.exec:\bxxfnj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\lrhdtlr.exec:\lrhdtlr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\htlxj.exec:\htlxj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\lpnpbtj.exec:\lpnpbtj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\xpdjdd.exec:\xpdjdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\njbhb.exec:\njbhb.exe17⤵
- Executes dropped EXE
PID:952 -
\??\c:\xlrxxl.exec:\xlrxxl.exe18⤵
- Executes dropped EXE
PID:1652 -
\??\c:\dlntp.exec:\dlntp.exe19⤵
- Executes dropped EXE
PID:1552 -
\??\c:\xjdld.exec:\xjdld.exe20⤵
- Executes dropped EXE
PID:2096 -
\??\c:\hdhfh.exec:\hdhfh.exe21⤵
- Executes dropped EXE
PID:2160 -
\??\c:\rtjbdbp.exec:\rtjbdbp.exe22⤵
- Executes dropped EXE
PID:1696 -
\??\c:\lrfnfnp.exec:\lrfnfnp.exe23⤵
- Executes dropped EXE
PID:2156 -
\??\c:\nxtbhx.exec:\nxtbhx.exe24⤵
- Executes dropped EXE
PID:3056 -
\??\c:\vdfvth.exec:\vdfvth.exe25⤵
- Executes dropped EXE
PID:1856 -
\??\c:\rhjtjj.exec:\rhjtjj.exe26⤵
- Executes dropped EXE
PID:988 -
\??\c:\jrblrfp.exec:\jrblrfp.exe27⤵
- Executes dropped EXE
PID:1852 -
\??\c:\jrldf.exec:\jrldf.exe28⤵
- Executes dropped EXE
PID:1844 -
\??\c:\jbdbtj.exec:\jbdbtj.exe29⤵
- Executes dropped EXE
PID:568 -
\??\c:\ddlrprx.exec:\ddlrprx.exe30⤵
- Executes dropped EXE
PID:2708 -
\??\c:\fhtbbt.exec:\fhtbbt.exe31⤵
- Executes dropped EXE
PID:2332 -
\??\c:\ftppp.exec:\ftppp.exe32⤵
- Executes dropped EXE
PID:564 -
\??\c:\djrtlnr.exec:\djrtlnr.exe33⤵
- Executes dropped EXE
PID:1676 -
\??\c:\hlfxvxl.exec:\hlfxvxl.exe34⤵
- Executes dropped EXE
PID:1752 -
\??\c:\llljj.exec:\llljj.exe35⤵
- Executes dropped EXE
PID:1952 -
\??\c:\vfvnjx.exec:\vfvnjx.exe36⤵
- Executes dropped EXE
PID:2448 -
\??\c:\htfdlh.exec:\htfdlh.exe37⤵
- Executes dropped EXE
PID:2860 -
\??\c:\hdbtlr.exec:\hdbtlr.exe38⤵
- Executes dropped EXE
PID:2600 -
\??\c:\xrdnr.exec:\xrdnr.exe39⤵
- Executes dropped EXE
PID:2364 -
\??\c:\pvvhvht.exec:\pvvhvht.exe40⤵
- Executes dropped EXE
PID:2516 -
\??\c:\drhjnl.exec:\drhjnl.exe41⤵
- Executes dropped EXE
PID:2660 -
\??\c:\prfxr.exec:\prfxr.exe42⤵
- Executes dropped EXE
PID:2528 -
\??\c:\lvhfbb.exec:\lvhfbb.exe43⤵
- Executes dropped EXE
PID:2520 -
\??\c:\fnpll.exec:\fnpll.exe44⤵
- Executes dropped EXE
PID:2388 -
\??\c:\thdvh.exec:\thdvh.exe45⤵
- Executes dropped EXE
PID:3020 -
\??\c:\vbvxfb.exec:\vbvxfb.exe46⤵
- Executes dropped EXE
PID:1032 -
\??\c:\vrhrjt.exec:\vrhrjt.exe47⤵
- Executes dropped EXE
PID:1532 -
\??\c:\lbpdndb.exec:\lbpdndb.exe48⤵
- Executes dropped EXE
PID:2456 -
\??\c:\dflvlvp.exec:\dflvlvp.exe49⤵
- Executes dropped EXE
PID:372 -
\??\c:\ldnrvpb.exec:\ldnrvpb.exe50⤵
- Executes dropped EXE
PID:2424 -
\??\c:\btvdfp.exec:\btvdfp.exe51⤵
- Executes dropped EXE
PID:1828 -
\??\c:\rfvvdjx.exec:\rfvvdjx.exe52⤵
- Executes dropped EXE
PID:1040 -
\??\c:\ftjtbhn.exec:\ftjtbhn.exe53⤵
- Executes dropped EXE
PID:1964 -
\??\c:\hnfxb.exec:\hnfxb.exe54⤵
- Executes dropped EXE
PID:2208 -
\??\c:\tfxdprf.exec:\tfxdprf.exe55⤵
- Executes dropped EXE
PID:2216 -
\??\c:\rrpvbdd.exec:\rrpvbdd.exe56⤵
- Executes dropped EXE
PID:2180 -
\??\c:\ptvldx.exec:\ptvldx.exe57⤵
- Executes dropped EXE
PID:2972 -
\??\c:\dnttnhh.exec:\dnttnhh.exe58⤵
- Executes dropped EXE
PID:1588 -
\??\c:\jvphb.exec:\jvphb.exe59⤵
- Executes dropped EXE
PID:1288 -
\??\c:\vththp.exec:\vththp.exe60⤵
- Executes dropped EXE
PID:528 -
\??\c:\tdjvd.exec:\tdjvd.exe61⤵
- Executes dropped EXE
PID:1988 -
\??\c:\blbvj.exec:\blbvj.exe62⤵
- Executes dropped EXE
PID:336 -
\??\c:\frdlrbd.exec:\frdlrbd.exe63⤵
- Executes dropped EXE
PID:1144 -
\??\c:\fblttfv.exec:\fblttfv.exe64⤵
- Executes dropped EXE
PID:436 -
\??\c:\jvvnxx.exec:\jvvnxx.exe65⤵
- Executes dropped EXE
PID:1104 -
\??\c:\fvjxbj.exec:\fvjxbj.exe66⤵PID:1840
-
\??\c:\vnvblb.exec:\vnvblb.exe67⤵PID:1392
-
\??\c:\brjvnj.exec:\brjvnj.exe68⤵PID:1364
-
\??\c:\pjvfb.exec:\pjvfb.exe69⤵PID:2828
-
\??\c:\nbvln.exec:\nbvln.exe70⤵PID:276
-
\??\c:\txvvb.exec:\txvvb.exe71⤵PID:2760
-
\??\c:\rjxjj.exec:\rjxjj.exe72⤵PID:1700
-
\??\c:\xbhbvtx.exec:\xbhbvtx.exe73⤵PID:2764
-
\??\c:\nxrtl.exec:\nxrtl.exe74⤵PID:2092
-
\??\c:\vjrxdr.exec:\vjrxdr.exe75⤵PID:1936
-
\??\c:\fxrffj.exec:\fxrffj.exe76⤵PID:3024
-
\??\c:\nvxbt.exec:\nvxbt.exe77⤵PID:1676
-
\??\c:\hnbblx.exec:\hnbblx.exe78⤵PID:1752
-
\??\c:\prbxt.exec:\prbxt.exe79⤵PID:1692
-
\??\c:\fbntrpd.exec:\fbntrpd.exe80⤵PID:2448
-
\??\c:\llxvnft.exec:\llxvnft.exe81⤵PID:2860
-
\??\c:\ptnhlxn.exec:\ptnhlxn.exe82⤵PID:2600
-
\??\c:\bjrrj.exec:\bjrrj.exe83⤵PID:2364
-
\??\c:\hhpfj.exec:\hhpfj.exe84⤵PID:2560
-
\??\c:\pvtrbfj.exec:\pvtrbfj.exe85⤵PID:2660
-
\??\c:\bhnrpb.exec:\bhnrpb.exe86⤵PID:2368
-
\??\c:\lrhtdh.exec:\lrhtdh.exe87⤵PID:2520
-
\??\c:\dprjntt.exec:\dprjntt.exe88⤵PID:2388
-
\??\c:\xhrxtj.exec:\xhrxtj.exe89⤵PID:2404
-
\??\c:\rlxhtb.exec:\rlxhtb.exe90⤵PID:2804
-
\??\c:\dnbjr.exec:\dnbjr.exe91⤵PID:2684
-
\??\c:\ddppnjj.exec:\ddppnjj.exe92⤵PID:2532
-
\??\c:\bjjfxd.exec:\bjjfxd.exe93⤵PID:2224
-
\??\c:\lhdphdj.exec:\lhdphdj.exe94⤵PID:3032
-
\??\c:\nxpnxx.exec:\nxpnxx.exe95⤵PID:808
-
\??\c:\tdrdpx.exec:\tdrdpx.exe96⤵PID:1816
-
\??\c:\vhdntd.exec:\vhdntd.exe97⤵PID:1848
-
\??\c:\nhdjxx.exec:\nhdjxx.exe98⤵PID:2208
-
\??\c:\rfhdh.exec:\rfhdh.exe99⤵PID:2220
-
\??\c:\txjbn.exec:\txjbn.exe100⤵PID:2192
-
\??\c:\rlbrn.exec:\rlbrn.exe101⤵PID:1640
-
\??\c:\dflrxv.exec:\dflrxv.exe102⤵PID:2196
-
\??\c:\ddxflh.exec:\ddxflh.exe103⤵PID:1112
-
\??\c:\fvhrx.exec:\fvhrx.exe104⤵PID:2540
-
\??\c:\thfpt.exec:\thfpt.exe105⤵PID:2920
-
\??\c:\dnpjxbr.exec:\dnpjxbr.exe106⤵PID:2080
-
\??\c:\pfpthpl.exec:\pfpthpl.exe107⤵PID:2132
-
\??\c:\ftntf.exec:\ftntf.exe108⤵PID:2144
-
\??\c:\bpprtnp.exec:\bpprtnp.exe109⤵PID:1884
-
\??\c:\bxhnhx.exec:\bxhnhx.exe110⤵PID:1564
-
\??\c:\ppbtj.exec:\ppbtj.exe111⤵PID:984
-
\??\c:\ldjtvt.exec:\ldjtvt.exe112⤵PID:2956
-
\??\c:\rlpdxn.exec:\rlpdxn.exe113⤵PID:1852
-
\??\c:\nvbvbvf.exec:\nvbvbvf.exe114⤵PID:2828
-
\??\c:\pbthrv.exec:\pbthrv.exe115⤵PID:1744
-
\??\c:\hbrnpvf.exec:\hbrnpvf.exe116⤵PID:1764
-
\??\c:\pjnjx.exec:\pjnjx.exe117⤵PID:2852
-
\??\c:\xvhbl.exec:\xvhbl.exe118⤵PID:892
-
\??\c:\xhfdnd.exec:\xhfdnd.exe119⤵PID:2720
-
\??\c:\bxhrxdr.exec:\bxhrxdr.exe120⤵PID:1748
-
\??\c:\hjrfhrx.exec:\hjrfhrx.exe121⤵PID:1600
-
\??\c:\xrrpnn.exec:\xrrpnn.exe122⤵PID:2936
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-