Analysis
- max time kernel
150s - max time network
128s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
18/05/2024, 01:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
714c40528343351a03ab0f05d0720120_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
- Target 714c40528343351a03ab0f05d0720120_NeikiAnalytics.exe
- Size 63KB
- Sample240518-cd1yhsfa27
- SHA256 2f023acfb75011d8696b1e827e326c25c9c157fafe3e45eb600c68f6fab8e345
- MD5 714c40528343351a03ab0f05d0720120
- SHA1 7f7a9668ca198c8524175a3feb08ebd4f5f1db1d
- SHA512 6e7833583c27b2627eb0c4ed8990623731962d6263320a257df0d48bda1cdaa3ad129fc6563684d92756cc7e9fbd496c0664ba769a55d331f37817be1dd37ced
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIhJm/wg:ymb3NkkiQ3mdBjFILm3
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/1720-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1656-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1040-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1120-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/916-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2244-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2328-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1628-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1736-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3064-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1396-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/776-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1616-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 2124 rnxpn.exe 2900 lxbpdpn.exe 2576 lfjfbj.exe 1656 tvjlf.exe 2408 ttxxbtn.exe 2428 xvhjb.exe 2412 rfvvvn.exe 2988 hnxbpn.exe 1040 rbtjr.exe 2652 vbvvlld.exe 2724 lldhxp.exe 1120 rhrfj.exe 916 trjbdht.exe 2244 pfftx.exe 2328 bxptbnt.exe 1628 vtftttp.exe 3000 xltftvr.exe 1736 xjtbv.exe 1956 hxdhph.exe 524 xjxxbb.exe 3064 fprnlnp.exe 620 dhlhbl.exe 2952 xlflbtd.exe 1396 dnbbfpt.exe 776 tbbhdj.exe 2232 pljbv.exe 2104 pfhnftt.exe 1056 lnftrhh.exe 1312 bjpvjxb.exe 1616 vnlnlhd.exe 864 jtfljnd.exe 2968 fjbldtr.exe 2248 vxprn.exe 1588 xbnfxd.exe 2732 jxndt.exe 2148 pbvfbf.exe 2672 bblbjtv.exe 2536 htddfp.exe 2500 vljvp.exe 1656 bxlxrlx.exe 2600 nftxr.exe 2556 tpdbn.exe 2392 ldjblh.exe 2444 rbjxh.exe 3044 vfhfrpj.exe 1440 lhrrnjr.exe 1640 dfjvxt.exe 1404 nbdhlvl.exe 2288 bdxjxrn.exe 2804 vjjlnlp.exe 1924 hjlrbpt.exe 2204 xthbjbv.exe 928 nxxjjnv.exe 2292 pxdjhb.exe 2852 dfnfn.exe 1628 rdxdvxl.exe 820 dbffdjp.exe 2068 xhfxtpp.exe 1972 xtdxnv.exe 2764 nhdjb.exe 2892 fjjjxd.exe 1960 jdrxh.exe 2956 tdfpf.exe 1272 lhdvhv.exe -
resource yara_rule behavioral1/memory/1720-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1656-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1656-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1040-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1120-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/916-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2244-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1736-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3064-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1396-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/776-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1616-296-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1720 wrote to memory of 2124 1720 714c40528343351a03ab0f05d0720120_NeikiAnalytics.exe 28 PID 1720 wrote to memory of 2124 1720 714c40528343351a03ab0f05d0720120_NeikiAnalytics.exe 28 PID 1720 wrote to memory of 2124 1720 714c40528343351a03ab0f05d0720120_NeikiAnalytics.exe 28 PID 1720 wrote to memory of 2124 1720 714c40528343351a03ab0f05d0720120_NeikiAnalytics.exe 28 PID 2124 wrote to memory of 2900 2124 rnxpn.exe 29 PID 2124 wrote to memory of 2900 2124 rnxpn.exe 29 PID 2124 wrote to memory of 2900 2124 rnxpn.exe 29 PID 2124 wrote to memory of 2900 2124 rnxpn.exe 29 PID 2900 wrote to memory of 2576 2900 lxbpdpn.exe 30 PID 2900 wrote to memory of 2576 2900 lxbpdpn.exe 30 PID 2900 wrote to memory of 2576 2900 lxbpdpn.exe 30 PID 2900 wrote to memory of 2576 2900 lxbpdpn.exe 30 PID 2576 wrote to memory of 1656 2576 lfjfbj.exe 31 PID 2576 wrote to memory of 1656 2576 lfjfbj.exe 31 PID 2576 wrote to memory of 1656 2576 lfjfbj.exe 31 PID 2576 wrote to memory of 1656 2576 lfjfbj.exe 31 PID 1656 wrote to memory of 2408 1656 tvjlf.exe 32 PID 1656 wrote to memory of 2408 1656 tvjlf.exe 32 PID 1656 wrote to memory of 2408 1656 tvjlf.exe 32 PID 1656 wrote to memory of 2408 1656 tvjlf.exe 32 PID 2408 wrote to memory of 2428 2408 ttxxbtn.exe 33 PID 2408 wrote to memory of 2428 2408 ttxxbtn.exe 33 PID 2408 wrote to memory of 2428 2408 ttxxbtn.exe 33 PID 2408 wrote to memory of 2428 2408 ttxxbtn.exe 33 PID 2428 wrote to memory of 2412 2428 xvhjb.exe 34 PID 2428 wrote to memory of 2412 2428 xvhjb.exe 34 PID 2428 wrote to memory of 2412 2428 xvhjb.exe 34 PID 2428 wrote to memory of 2412 2428 xvhjb.exe 34 PID 2412 wrote to memory of 2988 2412 rfvvvn.exe 35 PID 2412 wrote to memory of 2988 2412 rfvvvn.exe 35 PID 2412 wrote to memory of 2988 2412 rfvvvn.exe 35 PID 2412 wrote to memory of 2988 2412 rfvvvn.exe 35 PID 2988 wrote to memory of 1040 2988 hnxbpn.exe 36 PID 2988 wrote to memory of 1040 2988 hnxbpn.exe 36 PID 2988 wrote to memory of 1040 2988 hnxbpn.exe 36 PID 2988 wrote to memory of 1040 2988 hnxbpn.exe 36 PID 1040 wrote to memory of 2652 1040 rbtjr.exe 37 PID 1040 wrote to memory of 2652 1040 rbtjr.exe 37 PID 1040 wrote to memory of 2652 1040 rbtjr.exe 37 PID 1040 wrote to memory of 2652 1040 rbtjr.exe 37 PID 2652 wrote to memory of 2724 2652 vbvvlld.exe 38 PID 2652 wrote to memory of 2724 2652 vbvvlld.exe 38 PID 2652 wrote to memory of 2724 2652 vbvvlld.exe 38 PID 2652 wrote to memory of 2724 2652 vbvvlld.exe 38 PID 2724 wrote to memory of 1120 2724 lldhxp.exe 39 PID 2724 wrote to memory of 1120 2724 lldhxp.exe 39 PID 2724 wrote to memory of 1120 2724 lldhxp.exe 39 PID 2724 wrote to memory of 1120 2724 lldhxp.exe 39 PID 1120 wrote to memory of 916 1120 rhrfj.exe 40 PID 1120 wrote to memory of 916 1120 rhrfj.exe 40 PID 1120 wrote to memory of 916 1120 rhrfj.exe 40 PID 1120 wrote to memory of 916 1120 rhrfj.exe 40 PID 916 wrote to memory of 2244 916 trjbdht.exe 41 PID 916 wrote to memory of 2244 916 trjbdht.exe 41 PID 916 wrote to memory of 2244 916 trjbdht.exe 41 PID 916 wrote to memory of 2244 916 trjbdht.exe 41 PID 2244 wrote to memory of 2328 2244 pfftx.exe 42 PID 2244 wrote to memory of 2328 2244 pfftx.exe 42 PID 2244 wrote to memory of 2328 2244 pfftx.exe 42 PID 2244 wrote to memory of 2328 2244 pfftx.exe 42 PID 2328 wrote to memory of 1628 2328 bxptbnt.exe 43 PID 2328 wrote to memory of 1628 2328 bxptbnt.exe 43 PID 2328 wrote to memory of 1628 2328 bxptbnt.exe 43 PID 2328 wrote to memory of 1628 2328 bxptbnt.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\714c40528343351a03ab0f05d0720120_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\714c40528343351a03ab0f05d0720120_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\rnxpn.exec:\rnxpn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\lxbpdpn.exec:\lxbpdpn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\lfjfbj.exec:\lfjfbj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\tvjlf.exec:\tvjlf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\ttxxbtn.exec:\ttxxbtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\xvhjb.exec:\xvhjb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\rfvvvn.exec:\rfvvvn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\hnxbpn.exec:\hnxbpn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\rbtjr.exec:\rbtjr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\vbvvlld.exec:\vbvvlld.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\lldhxp.exec:\lldhxp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\rhrfj.exec:\rhrfj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\trjbdht.exec:\trjbdht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
\??\c:\pfftx.exec:\pfftx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\bxptbnt.exec:\bxptbnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\vtftttp.exec:\vtftttp.exe17⤵
- Executes dropped EXE
PID:1628 -
\??\c:\xltftvr.exec:\xltftvr.exe18⤵
- Executes dropped EXE
PID:3000 -
\??\c:\xjtbv.exec:\xjtbv.exe19⤵
- Executes dropped EXE
PID:1736 -
\??\c:\hxdhph.exec:\hxdhph.exe20⤵
- Executes dropped EXE
PID:1956 -
\??\c:\xjxxbb.exec:\xjxxbb.exe21⤵
- Executes dropped EXE
PID:524 -
\??\c:\fprnlnp.exec:\fprnlnp.exe22⤵
- Executes dropped EXE
PID:3064 -
\??\c:\dhlhbl.exec:\dhlhbl.exe23⤵
- Executes dropped EXE
PID:620 -
\??\c:\xlflbtd.exec:\xlflbtd.exe24⤵
- Executes dropped EXE
PID:2952 -
\??\c:\dnbbfpt.exec:\dnbbfpt.exe25⤵
- Executes dropped EXE
PID:1396 -
\??\c:\tbbhdj.exec:\tbbhdj.exe26⤵
- Executes dropped EXE
PID:776 -
\??\c:\pljbv.exec:\pljbv.exe27⤵
- Executes dropped EXE
PID:2232 -
\??\c:\pfhnftt.exec:\pfhnftt.exe28⤵
- Executes dropped EXE
PID:2104 -
\??\c:\lnftrhh.exec:\lnftrhh.exe29⤵
- Executes dropped EXE
PID:1056 -
\??\c:\bjpvjxb.exec:\bjpvjxb.exe30⤵
- Executes dropped EXE
PID:1312 -
\??\c:\vnlnlhd.exec:\vnlnlhd.exe31⤵
- Executes dropped EXE
PID:1616 -
\??\c:\jtfljnd.exec:\jtfljnd.exe32⤵
- Executes dropped EXE
PID:864 -
\??\c:\fjbldtr.exec:\fjbldtr.exe33⤵
- Executes dropped EXE
PID:2968 -
\??\c:\vxprn.exec:\vxprn.exe34⤵
- Executes dropped EXE
PID:2248 -
\??\c:\xbnfxd.exec:\xbnfxd.exe35⤵
- Executes dropped EXE
PID:1588 -
\??\c:\jxndt.exec:\jxndt.exe36⤵
- Executes dropped EXE
PID:2732 -
\??\c:\pbvfbf.exec:\pbvfbf.exe37⤵
- Executes dropped EXE
PID:2148 -
\??\c:\bblbjtv.exec:\bblbjtv.exe38⤵
- Executes dropped EXE
PID:2672 -
\??\c:\htddfp.exec:\htddfp.exe39⤵
- Executes dropped EXE
PID:2536 -
\??\c:\vljvp.exec:\vljvp.exe40⤵
- Executes dropped EXE
PID:2500 -
\??\c:\bxlxrlx.exec:\bxlxrlx.exe41⤵
- Executes dropped EXE
PID:1656 -
\??\c:\nftxr.exec:\nftxr.exe42⤵
- Executes dropped EXE
PID:2600 -
\??\c:\tpdbn.exec:\tpdbn.exe43⤵
- Executes dropped EXE
PID:2556 -
\??\c:\ldjblh.exec:\ldjblh.exe44⤵
- Executes dropped EXE
PID:2392 -
\??\c:\rbjxh.exec:\rbjxh.exe45⤵
- Executes dropped EXE
PID:2444 -
\??\c:\vfhfrpj.exec:\vfhfrpj.exe46⤵
- Executes dropped EXE
PID:3044 -
\??\c:\lhrrnjr.exec:\lhrrnjr.exe47⤵
- Executes dropped EXE
PID:1440 -
\??\c:\dfjvxt.exec:\dfjvxt.exe48⤵
- Executes dropped EXE
PID:1640 -
\??\c:\nbdhlvl.exec:\nbdhlvl.exe49⤵
- Executes dropped EXE
PID:1404 -
\??\c:\bdxjxrn.exec:\bdxjxrn.exe50⤵
- Executes dropped EXE
PID:2288 -
\??\c:\vjjlnlp.exec:\vjjlnlp.exe51⤵
- Executes dropped EXE
PID:2804 -
\??\c:\hjlrbpt.exec:\hjlrbpt.exe52⤵
- Executes dropped EXE
PID:1924 -
\??\c:\xthbjbv.exec:\xthbjbv.exe53⤵
- Executes dropped EXE
PID:2204 -
\??\c:\nxxjjnv.exec:\nxxjjnv.exe54⤵
- Executes dropped EXE
PID:928 -
\??\c:\pxdjhb.exec:\pxdjhb.exe55⤵
- Executes dropped EXE
PID:2292 -
\??\c:\dfnfn.exec:\dfnfn.exe56⤵
- Executes dropped EXE
PID:2852 -
\??\c:\rdxdvxl.exec:\rdxdvxl.exe57⤵
- Executes dropped EXE
PID:1628 -
\??\c:\dbffdjp.exec:\dbffdjp.exe58⤵
- Executes dropped EXE
PID:820 -
\??\c:\xhfxtpp.exec:\xhfxtpp.exe59⤵
- Executes dropped EXE
PID:2068 -
\??\c:\xtdxnv.exec:\xtdxnv.exe60⤵
- Executes dropped EXE
PID:1972 -
\??\c:\nhdjb.exec:\nhdjb.exe61⤵
- Executes dropped EXE
PID:2764 -
\??\c:\fjjjxd.exec:\fjjjxd.exe62⤵
- Executes dropped EXE
PID:2892 -
\??\c:\jdrxh.exec:\jdrxh.exe63⤵
- Executes dropped EXE
PID:1960 -
\??\c:\tdfpf.exec:\tdfpf.exe64⤵
- Executes dropped EXE
PID:2956 -
\??\c:\lhdvhv.exec:\lhdvhv.exe65⤵
- Executes dropped EXE
PID:1272 -
\??\c:\bnfhfx.exec:\bnfhfx.exe66⤵PID:1604
-
\??\c:\ldjpj.exec:\ldjpj.exe67⤵PID:1168
-
\??\c:\dvlvtp.exec:\dvlvtp.exe68⤵PID:960
-
\??\c:\rhrrtj.exec:\rhrrtj.exe69⤵PID:2232
-
\??\c:\pxblvxt.exec:\pxblvxt.exe70⤵PID:1064
-
\??\c:\hvjrnt.exec:\hvjrnt.exe71⤵PID:1468
-
\??\c:\rtxxnfh.exec:\rtxxnfh.exe72⤵PID:1676
-
\??\c:\fjfnpx.exec:\fjfnpx.exe73⤵PID:1312
-
\??\c:\rttrp.exec:\rttrp.exe74⤵PID:1616
-
\??\c:\rlvjvlx.exec:\rlvjvlx.exe75⤵PID:936
-
\??\c:\bbjhb.exec:\bbjhb.exe76⤵PID:2176
-
\??\c:\lbjnx.exec:\lbjnx.exe77⤵PID:2196
-
\??\c:\fpvvv.exec:\fpvvv.exe78⤵PID:2084
-
\??\c:\pnxjtp.exec:\pnxjtp.exe79⤵PID:2588
-
\??\c:\djhlxhx.exec:\djhlxhx.exe80⤵PID:2940
-
\??\c:\bblbrp.exec:\bblbrp.exe81⤵PID:2580
-
\??\c:\ddjbbpp.exec:\ddjbbpp.exe82⤵PID:2624
-
\??\c:\hbnjrxn.exec:\hbnjrxn.exe83⤵PID:2532
-
\??\c:\vhjjn.exec:\vhjjn.exe84⤵PID:2648
-
\??\c:\rtbpjp.exec:\rtbpjp.exe85⤵PID:1724
-
\??\c:\fjxjbf.exec:\fjxjbf.exe86⤵PID:2436
-
\??\c:\vdftvdx.exec:\vdftvdx.exe87⤵PID:2452
-
\??\c:\jnftx.exec:\jnftx.exe88⤵PID:2856
-
\??\c:\xxldfb.exec:\xxldfb.exe89⤵PID:1812
-
\??\c:\pvhtlf.exec:\pvhtlf.exe90⤵PID:836
-
\??\c:\vhlhh.exec:\vhlhh.exe91⤵PID:1176
-
\??\c:\nllfdb.exec:\nllfdb.exe92⤵PID:2652
-
\??\c:\hrfjxxp.exec:\hrfjxxp.exe93⤵PID:2128
-
\??\c:\lnlhx.exec:\lnlhx.exe94⤵PID:2288
-
\??\c:\dftlpr.exec:\dftlpr.exe95⤵PID:1472
-
\??\c:\tpjjxt.exec:\tpjjxt.exe96⤵PID:932
-
\??\c:\lndfn.exec:\lndfn.exe97⤵PID:1540
-
\??\c:\bblvnp.exec:\bblvnp.exe98⤵PID:2352
-
\??\c:\prbbpdb.exec:\prbbpdb.exe99⤵PID:1456
-
\??\c:\vblrftj.exec:\vblrftj.exe100⤵PID:1260
-
\??\c:\lrdlhp.exec:\lrdlhp.exe101⤵PID:2024
-
\??\c:\pphjvrf.exec:\pphjvrf.exe102⤵PID:2756
-
\??\c:\dpbdpt.exec:\dpbdpt.exe103⤵PID:2260
-
\??\c:\rnxvpvp.exec:\rnxvpvp.exe104⤵PID:2116
-
\??\c:\bdpjhd.exec:\bdpjhd.exe105⤵PID:2928
-
\??\c:\nbrfdjx.exec:\nbrfdjx.exe106⤵PID:1820
-
\??\c:\xfrnnjx.exec:\xfrnnjx.exe107⤵PID:832
-
\??\c:\dtvldlr.exec:\dtvldlr.exe108⤵PID:3012
-
\??\c:\nhrdrxr.exec:\nhrdrxr.exe109⤵PID:1396
-
\??\c:\nnbfl.exec:\nnbfl.exe110⤵PID:2348
-
\??\c:\hhdbrhr.exec:\hhdbrhr.exe111⤵PID:2800
-
\??\c:\bbjjr.exec:\bbjjr.exe112⤵PID:2796
-
\??\c:\pjhhv.exec:\pjhhv.exe113⤵PID:1508
-
\??\c:\njjlj.exec:\njjlj.exe114⤵PID:2104
-
\??\c:\vdrvv.exec:\vdrvv.exe115⤵PID:1056
-
\??\c:\vtnxp.exec:\vtnxp.exe116⤵PID:1732
-
\??\c:\fjvxlhl.exec:\fjvxlhl.exe117⤵PID:2844
-
\??\c:\lnhjrbn.exec:\lnhjrbn.exe118⤵PID:1564
-
\??\c:\jhndddb.exec:\jhndddb.exe119⤵PID:2072
-
\??\c:\jvnhbxb.exec:\jvnhbxb.exe120⤵PID:1728
-
\??\c:\rtxpb.exec:\rtxpb.exe121⤵PID:2492
-
\??\c:\ffrpnr.exec:\ffrpnr.exe122⤵PID:2908
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-