Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 06:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8e88a18128b197533de31b961a56cc10_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
8e88a18128b197533de31b961a56cc10_NeikiAnalytics.exe
-
Size
75KB
-
MD5
8e88a18128b197533de31b961a56cc10
-
SHA1
5951543af24e3d6036b8abec6a52e63b9c0d2828
-
SHA256
904fdcfa4c8f441b2153f8a90fd917f2693165915301054af88a5e12cbbb08ee
-
SHA512
bb2a5fd562a7b624d607718802ac3711abb6b75cc0081103bf36297aa406b4a6b99940ca29366867871429962b54e0ef9984c3d92d786b5027cd815d0e39b7fb
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5f:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCx
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral1/memory/1752-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1212-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1212-21-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2460-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2004-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/572-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1060-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1480-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1984-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1672-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1776-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/820-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1248-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1104-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1404-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1656-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2092-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1212 vnrfjb.exe 2460 nxvblv.exe 2584 pnrjhn.exe 2516 xdnnrl.exe 2380 jplntj.exe 2004 lrfvv.exe 2476 dbbdxh.exe 572 xhlxpnt.exe 1060 nrphjvn.exe 2456 rrfvnhd.exe 2688 hjrvpv.exe 2224 bxfdn.exe 1480 dldxt.exe 1984 ndfvnd.exe 1960 xphbhdj.exe 1672 hpfvf.exe 1660 pbplbb.exe 1776 tndljh.exe 1208 ljxtb.exe 468 rblrtln.exe 3016 dbhbr.exe 820 btrhl.exe 1248 fjplp.exe 1104 jrhxjhh.exe 1404 hbnrdb.exe 1072 rtdrr.exe 1656 ffplxph.exe 3000 rxbdvll.exe 2092 drtnh.exe 2748 bvpdp.exe 2240 htdrjh.exe 1748 lhhtf.exe 1752 jfbpj.exe 1628 ptxxnx.exe 1212 nnfnxn.exe 1720 bxbrn.exe 2604 vbfnhb.exe 2888 jptfl.exe 2552 jtfpf.exe 2660 hrjjhd.exe 2412 brltlr.exe 2372 xjrxbt.exe 2432 jxvvhp.exe 1760 llrvrbj.exe 1664 fldhvxf.exe 1980 prxvldt.exe 648 hbfbvdv.exe 2640 nvhfv.exe 1880 hbbvv.exe 2696 npdnl.exe 1824 hddvbx.exe 1968 hxxjflp.exe 2236 dnxvxj.exe 3040 xjfjlfh.exe 2192 pfdxd.exe 1680 tvtplxt.exe 1644 nhddf.exe 1112 nnnjrf.exe 2540 bpltnjn.exe 2940 rlrhjfp.exe 604 vhlnx.exe 600 txnhb.exe 2964 pxlrj.exe 1392 xxvlfrl.exe -
resource yara_rule behavioral1/memory/1752-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1212-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2004-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2004-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/572-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/572-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/572-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/572-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1060-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1480-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1984-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1776-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/820-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1248-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1104-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1404-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1656-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-299-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1752 wrote to memory of 1212 1752 8e88a18128b197533de31b961a56cc10_NeikiAnalytics.exe 28 PID 1752 wrote to memory of 1212 1752 8e88a18128b197533de31b961a56cc10_NeikiAnalytics.exe 28 PID 1752 wrote to memory of 1212 1752 8e88a18128b197533de31b961a56cc10_NeikiAnalytics.exe 28 PID 1752 wrote to memory of 1212 1752 8e88a18128b197533de31b961a56cc10_NeikiAnalytics.exe 28 PID 1212 wrote to memory of 2460 1212 vnrfjb.exe 29 PID 1212 wrote to memory of 2460 1212 vnrfjb.exe 29 PID 1212 wrote to memory of 2460 1212 vnrfjb.exe 29 PID 1212 wrote to memory of 2460 1212 vnrfjb.exe 29 PID 2460 wrote to memory of 2584 2460 nxvblv.exe 30 PID 2460 wrote to memory of 2584 2460 nxvblv.exe 30 PID 2460 wrote to memory of 2584 2460 nxvblv.exe 30 PID 2460 wrote to memory of 2584 2460 nxvblv.exe 30 PID 2584 wrote to memory of 2516 2584 pnrjhn.exe 31 PID 2584 wrote to memory of 2516 2584 pnrjhn.exe 31 PID 2584 wrote to memory of 2516 2584 pnrjhn.exe 31 PID 2584 wrote to memory of 2516 2584 pnrjhn.exe 31 PID 2516 wrote to memory of 2380 2516 xdnnrl.exe 32 PID 2516 wrote to memory of 2380 2516 xdnnrl.exe 32 PID 2516 wrote to memory of 2380 2516 xdnnrl.exe 32 PID 2516 wrote to memory of 2380 2516 xdnnrl.exe 32 PID 2380 wrote to memory of 2004 2380 jplntj.exe 33 PID 2380 wrote to memory of 2004 2380 jplntj.exe 33 PID 2380 wrote to memory of 2004 2380 jplntj.exe 33 PID 2380 wrote to memory of 2004 2380 jplntj.exe 33 PID 2004 wrote to memory of 2476 2004 lrfvv.exe 34 PID 2004 wrote to memory of 2476 2004 lrfvv.exe 34 PID 2004 wrote to memory of 2476 2004 lrfvv.exe 34 PID 2004 wrote to memory of 2476 2004 lrfvv.exe 34 PID 2476 wrote to memory of 572 2476 dbbdxh.exe 35 PID 2476 wrote to memory of 572 2476 dbbdxh.exe 35 PID 2476 wrote to memory of 572 2476 dbbdxh.exe 35 PID 2476 wrote to memory of 572 2476 dbbdxh.exe 35 PID 572 wrote to memory of 1060 572 xhlxpnt.exe 36 PID 572 wrote to memory of 1060 572 xhlxpnt.exe 36 PID 572 wrote to memory of 1060 572 xhlxpnt.exe 36 PID 572 wrote to memory of 1060 572 xhlxpnt.exe 36 PID 1060 wrote to memory of 2456 1060 nrphjvn.exe 37 PID 1060 wrote to memory of 2456 1060 nrphjvn.exe 37 PID 1060 wrote to memory of 2456 1060 nrphjvn.exe 37 PID 1060 wrote to memory of 2456 1060 nrphjvn.exe 37 PID 2456 wrote to memory of 2688 2456 rrfvnhd.exe 38 PID 2456 wrote to memory of 2688 2456 rrfvnhd.exe 38 PID 2456 wrote to memory of 2688 2456 rrfvnhd.exe 38 PID 2456 wrote to memory of 2688 2456 rrfvnhd.exe 38 PID 2688 wrote to memory of 2224 2688 hjrvpv.exe 39 PID 2688 wrote to memory of 2224 2688 hjrvpv.exe 39 PID 2688 wrote to memory of 2224 2688 hjrvpv.exe 39 PID 2688 wrote to memory of 2224 2688 hjrvpv.exe 39 PID 2224 wrote to memory of 1480 2224 bxfdn.exe 40 PID 2224 wrote to memory of 1480 2224 bxfdn.exe 40 PID 2224 wrote to memory of 1480 2224 bxfdn.exe 40 PID 2224 wrote to memory of 1480 2224 bxfdn.exe 40 PID 1480 wrote to memory of 1984 1480 dldxt.exe 41 PID 1480 wrote to memory of 1984 1480 dldxt.exe 41 PID 1480 wrote to memory of 1984 1480 dldxt.exe 41 PID 1480 wrote to memory of 1984 1480 dldxt.exe 41 PID 1984 wrote to memory of 1960 1984 ndfvnd.exe 42 PID 1984 wrote to memory of 1960 1984 ndfvnd.exe 42 PID 1984 wrote to memory of 1960 1984 ndfvnd.exe 42 PID 1984 wrote to memory of 1960 1984 ndfvnd.exe 42 PID 1960 wrote to memory of 1672 1960 xphbhdj.exe 43 PID 1960 wrote to memory of 1672 1960 xphbhdj.exe 43 PID 1960 wrote to memory of 1672 1960 xphbhdj.exe 43 PID 1960 wrote to memory of 1672 1960 xphbhdj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e88a18128b197533de31b961a56cc10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8e88a18128b197533de31b961a56cc10_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\vnrfjb.exec:\vnrfjb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\nxvblv.exec:\nxvblv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\pnrjhn.exec:\pnrjhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\xdnnrl.exec:\xdnnrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\jplntj.exec:\jplntj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\lrfvv.exec:\lrfvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\dbbdxh.exec:\dbbdxh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\xhlxpnt.exec:\xhlxpnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
\??\c:\nrphjvn.exec:\nrphjvn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\rrfvnhd.exec:\rrfvnhd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\hjrvpv.exec:\hjrvpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\bxfdn.exec:\bxfdn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\dldxt.exec:\dldxt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\ndfvnd.exec:\ndfvnd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\xphbhdj.exec:\xphbhdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\hpfvf.exec:\hpfvf.exe17⤵
- Executes dropped EXE
PID:1672 -
\??\c:\pbplbb.exec:\pbplbb.exe18⤵
- Executes dropped EXE
PID:1660 -
\??\c:\tndljh.exec:\tndljh.exe19⤵
- Executes dropped EXE
PID:1776 -
\??\c:\ljxtb.exec:\ljxtb.exe20⤵
- Executes dropped EXE
PID:1208 -
\??\c:\rblrtln.exec:\rblrtln.exe21⤵
- Executes dropped EXE
PID:468 -
\??\c:\dbhbr.exec:\dbhbr.exe22⤵
- Executes dropped EXE
PID:3016 -
\??\c:\btrhl.exec:\btrhl.exe23⤵
- Executes dropped EXE
PID:820 -
\??\c:\fjplp.exec:\fjplp.exe24⤵
- Executes dropped EXE
PID:1248 -
\??\c:\jrhxjhh.exec:\jrhxjhh.exe25⤵
- Executes dropped EXE
PID:1104 -
\??\c:\hbnrdb.exec:\hbnrdb.exe26⤵
- Executes dropped EXE
PID:1404 -
\??\c:\rtdrr.exec:\rtdrr.exe27⤵
- Executes dropped EXE
PID:1072 -
\??\c:\ffplxph.exec:\ffplxph.exe28⤵
- Executes dropped EXE
PID:1656 -
\??\c:\rxbdvll.exec:\rxbdvll.exe29⤵
- Executes dropped EXE
PID:3000 -
\??\c:\drtnh.exec:\drtnh.exe30⤵
- Executes dropped EXE
PID:2092 -
\??\c:\bvpdp.exec:\bvpdp.exe31⤵
- Executes dropped EXE
PID:2748 -
\??\c:\htdrjh.exec:\htdrjh.exe32⤵
- Executes dropped EXE
PID:2240 -
\??\c:\lhhtf.exec:\lhhtf.exe33⤵
- Executes dropped EXE
PID:1748 -
\??\c:\jfbpj.exec:\jfbpj.exe34⤵
- Executes dropped EXE
PID:1752 -
\??\c:\ptxxnx.exec:\ptxxnx.exe35⤵
- Executes dropped EXE
PID:1628 -
\??\c:\nnfnxn.exec:\nnfnxn.exe36⤵
- Executes dropped EXE
PID:1212 -
\??\c:\bxbrn.exec:\bxbrn.exe37⤵
- Executes dropped EXE
PID:1720 -
\??\c:\vbfnhb.exec:\vbfnhb.exe38⤵
- Executes dropped EXE
PID:2604 -
\??\c:\jptfl.exec:\jptfl.exe39⤵
- Executes dropped EXE
PID:2888 -
\??\c:\jtfpf.exec:\jtfpf.exe40⤵
- Executes dropped EXE
PID:2552 -
\??\c:\hrjjhd.exec:\hrjjhd.exe41⤵
- Executes dropped EXE
PID:2660 -
\??\c:\brltlr.exec:\brltlr.exe42⤵
- Executes dropped EXE
PID:2412 -
\??\c:\xjrxbt.exec:\xjrxbt.exe43⤵
- Executes dropped EXE
PID:2372 -
\??\c:\jxvvhp.exec:\jxvvhp.exe44⤵
- Executes dropped EXE
PID:2432 -
\??\c:\llrvrbj.exec:\llrvrbj.exe45⤵
- Executes dropped EXE
PID:1760 -
\??\c:\fldhvxf.exec:\fldhvxf.exe46⤵
- Executes dropped EXE
PID:1664 -
\??\c:\prxvldt.exec:\prxvldt.exe47⤵
- Executes dropped EXE
PID:1980 -
\??\c:\hbfbvdv.exec:\hbfbvdv.exe48⤵
- Executes dropped EXE
PID:648 -
\??\c:\nvhfv.exec:\nvhfv.exe49⤵
- Executes dropped EXE
PID:2640 -
\??\c:\hbbvv.exec:\hbbvv.exe50⤵
- Executes dropped EXE
PID:1880 -
\??\c:\npdnl.exec:\npdnl.exe51⤵
- Executes dropped EXE
PID:2696 -
\??\c:\hddvbx.exec:\hddvbx.exe52⤵
- Executes dropped EXE
PID:1824 -
\??\c:\hxxjflp.exec:\hxxjflp.exe53⤵
- Executes dropped EXE
PID:1968 -
\??\c:\dnxvxj.exec:\dnxvxj.exe54⤵
- Executes dropped EXE
PID:2236 -
\??\c:\xjfjlfh.exec:\xjfjlfh.exe55⤵
- Executes dropped EXE
PID:3040 -
\??\c:\pfdxd.exec:\pfdxd.exe56⤵
- Executes dropped EXE
PID:2192 -
\??\c:\tvtplxt.exec:\tvtplxt.exe57⤵
- Executes dropped EXE
PID:1680 -
\??\c:\nhddf.exec:\nhddf.exe58⤵
- Executes dropped EXE
PID:1644 -
\??\c:\nnnjrf.exec:\nnnjrf.exe59⤵
- Executes dropped EXE
PID:1112 -
\??\c:\bpltnjn.exec:\bpltnjn.exe60⤵
- Executes dropped EXE
PID:2540 -
\??\c:\rlrhjfp.exec:\rlrhjfp.exe61⤵
- Executes dropped EXE
PID:2940 -
\??\c:\vhlnx.exec:\vhlnx.exe62⤵
- Executes dropped EXE
PID:604 -
\??\c:\txnhb.exec:\txnhb.exe63⤵
- Executes dropped EXE
PID:600 -
\??\c:\pxlrj.exec:\pxlrj.exe64⤵
- Executes dropped EXE
PID:2964 -
\??\c:\xxvlfrl.exec:\xxvlfrl.exe65⤵
- Executes dropped EXE
PID:1392 -
\??\c:\vdjbxjf.exec:\vdjbxjf.exe66⤵PID:1800
-
\??\c:\xdtnv.exec:\xdtnv.exe67⤵PID:2212
-
\??\c:\dlvvrnb.exec:\dlvvrnb.exe68⤵PID:1636
-
\??\c:\hhdtr.exec:\hhdtr.exe69⤵PID:908
-
\??\c:\rbvdnh.exec:\rbvdnh.exe70⤵PID:1656
-
\??\c:\rftpbf.exec:\rftpbf.exe71⤵PID:2036
-
\??\c:\jdnjttr.exec:\jdnjttr.exe72⤵PID:1272
-
\??\c:\lhbrj.exec:\lhbrj.exe73⤵PID:2892
-
\??\c:\hhnnr.exec:\hhnnr.exe74⤵PID:2008
-
\??\c:\fdplf.exec:\fdplf.exe75⤵PID:2732
-
\??\c:\rlfjbth.exec:\rlfjbth.exe76⤵PID:2620
-
\??\c:\tdxth.exec:\tdxth.exe77⤵PID:1620
-
\??\c:\vdthv.exec:\vdthv.exe78⤵PID:3036
-
\??\c:\rvplvn.exec:\rvplvn.exe79⤵PID:2484
-
\??\c:\jljlp.exec:\jljlp.exe80⤵PID:2728
-
\??\c:\trfjr.exec:\trfjr.exe81⤵PID:2464
-
\??\c:\xbtjxv.exec:\xbtjxv.exe82⤵PID:2508
-
\??\c:\xprtnrn.exec:\xprtnrn.exe83⤵PID:2536
-
\??\c:\xtdjnx.exec:\xtdjnx.exe84⤵PID:2528
-
\??\c:\pfxlh.exec:\pfxlh.exe85⤵PID:2376
-
\??\c:\bfxvpjx.exec:\bfxvpjx.exe86⤵PID:2232
-
\??\c:\xpvvt.exec:\xpvvt.exe87⤵PID:2428
-
\??\c:\bbtrh.exec:\bbtrh.exe88⤵PID:1124
-
\??\c:\hflbj.exec:\hflbj.exe89⤵PID:940
-
\??\c:\xdbfdjp.exec:\xdbfdjp.exe90⤵PID:2044
-
\??\c:\pfhhnx.exec:\pfhhnx.exe91⤵PID:2684
-
\??\c:\dxjhlnt.exec:\dxjhlnt.exe92⤵PID:2648
-
\??\c:\ptxnb.exec:\ptxnb.exe93⤵PID:808
-
\??\c:\vdpvbr.exec:\vdpvbr.exe94⤵PID:1040
-
\??\c:\rlpflx.exec:\rlpflx.exe95⤵PID:2324
-
\??\c:\jpjplj.exec:\jpjplj.exe96⤵PID:1044
-
\??\c:\hhvjpj.exec:\hhvjpj.exe97⤵PID:312
-
\??\c:\bbhxt.exec:\bbhxt.exe98⤵PID:1772
-
\??\c:\ldfrvtf.exec:\ldfrvtf.exe99⤵PID:1728
-
\??\c:\jnphrd.exec:\jnphrd.exe100⤵PID:1640
-
\??\c:\lrfnlb.exec:\lrfnlb.exe101⤵PID:1616
-
\??\c:\dxvhfbf.exec:\dxvhfbf.exe102⤵PID:1096
-
\??\c:\nxlnpvl.exec:\nxlnpvl.exe103⤵PID:2736
-
\??\c:\brtpbf.exec:\brtpbf.exe104⤵PID:1208
-
\??\c:\jnnbn.exec:\jnnbn.exe105⤵PID:468
-
\??\c:\vfxvr.exec:\vfxvr.exe106⤵PID:2156
-
\??\c:\hpfdf.exec:\hpfdf.exe107⤵PID:3060
-
\??\c:\dvjrjjv.exec:\dvjrjjv.exe108⤵PID:1856
-
\??\c:\vhfddr.exec:\vhfddr.exe109⤵PID:1804
-
\??\c:\bnrnbn.exec:\bnrnbn.exe110⤵PID:2148
-
\??\c:\nlprh.exec:\nlprh.exe111⤵PID:2140
-
\??\c:\rtrdtv.exec:\rtrdtv.exe112⤵PID:1404
-
\??\c:\tvpxh.exec:\tvpxh.exe113⤵PID:1668
-
\??\c:\fxnhl.exec:\fxnhl.exe114⤵PID:1744
-
\??\c:\tphflj.exec:\tphflj.exe115⤵PID:2284
-
\??\c:\hdrhfr.exec:\hdrhfr.exe116⤵PID:2092
-
\??\c:\jtdhlx.exec:\jtdhlx.exe117⤵PID:892
-
\??\c:\fbfnrl.exec:\fbfnrl.exe118⤵PID:2280
-
\??\c:\vjpfvjr.exec:\vjpfvjr.exe119⤵PID:2808
-
\??\c:\nrbpx.exec:\nrbpx.exe120⤵PID:2860
-
\??\c:\vxbpbd.exec:\vxbpbd.exe121⤵PID:2448
-
\??\c:\jpvfvd.exec:\jpvfvd.exe122⤵PID:2580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-