Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 20:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
011b8cdb25e85ea6efce0efdd83e7890_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
011b8cdb25e85ea6efce0efdd83e7890_NeikiAnalytics.exe
-
Size
68KB
-
MD5
011b8cdb25e85ea6efce0efdd83e7890
-
SHA1
7a34c4f3782121274953d04dbf44cd1ece395871
-
SHA256
78ccee4dcf732c616fc707ed30ca20a8f0a5d0a36c8f49bbaaf6d91ba6dab386
-
SHA512
1ca4b19f25ca31f29265b6b4e36504b0addae2ae98615487a4322c3df01d1013fc4bd2244a31eb804777184c1f209588aaf4359ac16c059b0778c7eb633bc2f3
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIJ/RWPqBjfjW:ymb3NkkiQ3mdBjFIqsjC
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2184-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1072-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1920-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2324-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2292-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2352-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1268-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2004-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3020-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1788-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2684 jxjbjhf.exe 1072 rfxfbjx.exe 2584 lpvvvbh.exe 2388 hftjfnv.exe 2604 brbjphl.exe 2552 hrvdfb.exe 2424 jnlflnf.exe 2668 rfjfl.exe 1716 xdhdjj.exe 1016 dtbntt.exe 2704 nrtbvvp.exe 2128 tdtnb.exe 1920 xrxdjnj.exe 2324 rlnlxj.exe 2292 lbllljp.exe 2352 pnbbrdd.exe 1268 rxxttj.exe 2004 frrlr.exe 1972 tnntdpp.exe 2764 rrbnx.exe 2896 fdptdtv.exe 1952 bjrjrbr.exe 3020 tdjrrbj.exe 1800 jbxhjxv.exe 1168 fjxlj.exe 960 fbfvn.exe 1788 nxjlrl.exe 888 vxhtrbr.exe 2976 pvjtd.exe 1652 ndtdfxj.exe 2904 nhdvl.exe 1752 lhxhd.exe 600 blpbl.exe 2012 xfbrjv.exe 1588 tpdvtr.exe 2932 prrrl.exe 2148 vvrnbnh.exe 2608 rxjtfd.exe 2508 fnvpnrx.exe 2816 dfhfvdf.exe 2680 hjndvd.exe 2420 prxvnv.exe 2380 brhjf.exe 1948 hnbtx.exe 2400 lrptxn.exe 560 xnxxtl.exe 1568 jfnxll.exe 1636 nfvnjb.exe 2720 ltrdrrn.exe 2916 nlvxl.exe 1124 btrhrf.exe 1472 nxlnr.exe 2356 bndtdh.exe 2016 nhhbj.exe 1628 vphrtlj.exe 1388 thtltjj.exe 612 djvhj.exe 824 lxdbnhf.exe 1740 pfjnbtp.exe 2228 hlpnnj.exe 2980 nllhrvv.exe 2924 jrbntd.exe 3028 lhllnv.exe 832 xxddn.exe -
resource yara_rule behavioral1/memory/2184-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1072-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1920-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2324-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2352-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1268-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2004-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1788-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-294-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2684 2184 011b8cdb25e85ea6efce0efdd83e7890_NeikiAnalytics.exe 28 PID 2184 wrote to memory of 2684 2184 011b8cdb25e85ea6efce0efdd83e7890_NeikiAnalytics.exe 28 PID 2184 wrote to memory of 2684 2184 011b8cdb25e85ea6efce0efdd83e7890_NeikiAnalytics.exe 28 PID 2184 wrote to memory of 2684 2184 011b8cdb25e85ea6efce0efdd83e7890_NeikiAnalytics.exe 28 PID 2684 wrote to memory of 1072 2684 jxjbjhf.exe 29 PID 2684 wrote to memory of 1072 2684 jxjbjhf.exe 29 PID 2684 wrote to memory of 1072 2684 jxjbjhf.exe 29 PID 2684 wrote to memory of 1072 2684 jxjbjhf.exe 29 PID 1072 wrote to memory of 2584 1072 rfxfbjx.exe 30 PID 1072 wrote to memory of 2584 1072 rfxfbjx.exe 30 PID 1072 wrote to memory of 2584 1072 rfxfbjx.exe 30 PID 1072 wrote to memory of 2584 1072 rfxfbjx.exe 30 PID 2584 wrote to memory of 2388 2584 lpvvvbh.exe 31 PID 2584 wrote to memory of 2388 2584 lpvvvbh.exe 31 PID 2584 wrote to memory of 2388 2584 lpvvvbh.exe 31 PID 2584 wrote to memory of 2388 2584 lpvvvbh.exe 31 PID 2388 wrote to memory of 2604 2388 hftjfnv.exe 32 PID 2388 wrote to memory of 2604 2388 hftjfnv.exe 32 PID 2388 wrote to memory of 2604 2388 hftjfnv.exe 32 PID 2388 wrote to memory of 2604 2388 hftjfnv.exe 32 PID 2604 wrote to memory of 2552 2604 brbjphl.exe 33 PID 2604 wrote to memory of 2552 2604 brbjphl.exe 33 PID 2604 wrote to memory of 2552 2604 brbjphl.exe 33 PID 2604 wrote to memory of 2552 2604 brbjphl.exe 33 PID 2552 wrote to memory of 2424 2552 hrvdfb.exe 34 PID 2552 wrote to memory of 2424 2552 hrvdfb.exe 34 PID 2552 wrote to memory of 2424 2552 hrvdfb.exe 34 PID 2552 wrote to memory of 2424 2552 hrvdfb.exe 34 PID 2424 wrote to memory of 2668 2424 jnlflnf.exe 35 PID 2424 wrote to memory of 2668 2424 jnlflnf.exe 35 PID 2424 wrote to memory of 2668 2424 jnlflnf.exe 35 PID 2424 wrote to memory of 2668 2424 jnlflnf.exe 35 PID 2668 wrote to memory of 1716 2668 rfjfl.exe 36 PID 2668 wrote to memory of 1716 2668 rfjfl.exe 36 PID 2668 wrote to memory of 1716 2668 rfjfl.exe 36 PID 2668 wrote to memory of 1716 2668 rfjfl.exe 36 PID 1716 wrote to memory of 1016 1716 xdhdjj.exe 37 PID 1716 wrote to memory of 1016 1716 xdhdjj.exe 37 PID 1716 wrote to memory of 1016 1716 xdhdjj.exe 37 PID 1716 wrote to memory of 1016 1716 xdhdjj.exe 37 PID 1016 wrote to memory of 2704 1016 dtbntt.exe 38 PID 1016 wrote to memory of 2704 1016 dtbntt.exe 38 PID 1016 wrote to memory of 2704 1016 dtbntt.exe 38 PID 1016 wrote to memory of 2704 1016 dtbntt.exe 38 PID 2704 wrote to memory of 2128 2704 nrtbvvp.exe 39 PID 2704 wrote to memory of 2128 2704 nrtbvvp.exe 39 PID 2704 wrote to memory of 2128 2704 nrtbvvp.exe 39 PID 2704 wrote to memory of 2128 2704 nrtbvvp.exe 39 PID 2128 wrote to memory of 1920 2128 tdtnb.exe 40 PID 2128 wrote to memory of 1920 2128 tdtnb.exe 40 PID 2128 wrote to memory of 1920 2128 tdtnb.exe 40 PID 2128 wrote to memory of 1920 2128 tdtnb.exe 40 PID 1920 wrote to memory of 2324 1920 xrxdjnj.exe 41 PID 1920 wrote to memory of 2324 1920 xrxdjnj.exe 41 PID 1920 wrote to memory of 2324 1920 xrxdjnj.exe 41 PID 1920 wrote to memory of 2324 1920 xrxdjnj.exe 41 PID 2324 wrote to memory of 2292 2324 rlnlxj.exe 42 PID 2324 wrote to memory of 2292 2324 rlnlxj.exe 42 PID 2324 wrote to memory of 2292 2324 rlnlxj.exe 42 PID 2324 wrote to memory of 2292 2324 rlnlxj.exe 42 PID 2292 wrote to memory of 2352 2292 lbllljp.exe 43 PID 2292 wrote to memory of 2352 2292 lbllljp.exe 43 PID 2292 wrote to memory of 2352 2292 lbllljp.exe 43 PID 2292 wrote to memory of 2352 2292 lbllljp.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\011b8cdb25e85ea6efce0efdd83e7890_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\011b8cdb25e85ea6efce0efdd83e7890_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\jxjbjhf.exec:\jxjbjhf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\rfxfbjx.exec:\rfxfbjx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\lpvvvbh.exec:\lpvvvbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\hftjfnv.exec:\hftjfnv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\brbjphl.exec:\brbjphl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\hrvdfb.exec:\hrvdfb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\jnlflnf.exec:\jnlflnf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\rfjfl.exec:\rfjfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\xdhdjj.exec:\xdhdjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\dtbntt.exec:\dtbntt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\nrtbvvp.exec:\nrtbvvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\tdtnb.exec:\tdtnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\xrxdjnj.exec:\xrxdjnj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\rlnlxj.exec:\rlnlxj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\lbllljp.exec:\lbllljp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\pnbbrdd.exec:\pnbbrdd.exe17⤵
- Executes dropped EXE
PID:2352 -
\??\c:\rxxttj.exec:\rxxttj.exe18⤵
- Executes dropped EXE
PID:1268 -
\??\c:\frrlr.exec:\frrlr.exe19⤵
- Executes dropped EXE
PID:2004 -
\??\c:\tnntdpp.exec:\tnntdpp.exe20⤵
- Executes dropped EXE
PID:1972 -
\??\c:\rrbnx.exec:\rrbnx.exe21⤵
- Executes dropped EXE
PID:2764 -
\??\c:\fdptdtv.exec:\fdptdtv.exe22⤵
- Executes dropped EXE
PID:2896 -
\??\c:\bjrjrbr.exec:\bjrjrbr.exe23⤵
- Executes dropped EXE
PID:1952 -
\??\c:\tdjrrbj.exec:\tdjrrbj.exe24⤵
- Executes dropped EXE
PID:3020 -
\??\c:\jbxhjxv.exec:\jbxhjxv.exe25⤵
- Executes dropped EXE
PID:1800 -
\??\c:\fjxlj.exec:\fjxlj.exe26⤵
- Executes dropped EXE
PID:1168 -
\??\c:\fbfvn.exec:\fbfvn.exe27⤵
- Executes dropped EXE
PID:960 -
\??\c:\nxjlrl.exec:\nxjlrl.exe28⤵
- Executes dropped EXE
PID:1788 -
\??\c:\vxhtrbr.exec:\vxhtrbr.exe29⤵
- Executes dropped EXE
PID:888 -
\??\c:\pvjtd.exec:\pvjtd.exe30⤵
- Executes dropped EXE
PID:2976 -
\??\c:\ndtdfxj.exec:\ndtdfxj.exe31⤵
- Executes dropped EXE
PID:1652 -
\??\c:\nhdvl.exec:\nhdvl.exe32⤵
- Executes dropped EXE
PID:2904 -
\??\c:\lhxhd.exec:\lhxhd.exe33⤵
- Executes dropped EXE
PID:1752 -
\??\c:\blpbl.exec:\blpbl.exe34⤵
- Executes dropped EXE
PID:600 -
\??\c:\xfbrjv.exec:\xfbrjv.exe35⤵
- Executes dropped EXE
PID:2012 -
\??\c:\tpdvtr.exec:\tpdvtr.exe36⤵
- Executes dropped EXE
PID:1588 -
\??\c:\prrrl.exec:\prrrl.exe37⤵
- Executes dropped EXE
PID:2932 -
\??\c:\vvrnbnh.exec:\vvrnbnh.exe38⤵
- Executes dropped EXE
PID:2148 -
\??\c:\rxjtfd.exec:\rxjtfd.exe39⤵
- Executes dropped EXE
PID:2608 -
\??\c:\fnvpnrx.exec:\fnvpnrx.exe40⤵
- Executes dropped EXE
PID:2508 -
\??\c:\dfhfvdf.exec:\dfhfvdf.exe41⤵
- Executes dropped EXE
PID:2816 -
\??\c:\hjndvd.exec:\hjndvd.exe42⤵
- Executes dropped EXE
PID:2680 -
\??\c:\prxvnv.exec:\prxvnv.exe43⤵
- Executes dropped EXE
PID:2420 -
\??\c:\brhjf.exec:\brhjf.exe44⤵
- Executes dropped EXE
PID:2380 -
\??\c:\hnbtx.exec:\hnbtx.exe45⤵
- Executes dropped EXE
PID:1948 -
\??\c:\lrptxn.exec:\lrptxn.exe46⤵
- Executes dropped EXE
PID:2400 -
\??\c:\xnxxtl.exec:\xnxxtl.exe47⤵
- Executes dropped EXE
PID:560 -
\??\c:\jfnxll.exec:\jfnxll.exe48⤵
- Executes dropped EXE
PID:1568 -
\??\c:\nfvnjb.exec:\nfvnjb.exe49⤵
- Executes dropped EXE
PID:1636 -
\??\c:\ltrdrrn.exec:\ltrdrrn.exe50⤵
- Executes dropped EXE
PID:2720 -
\??\c:\nlvxl.exec:\nlvxl.exe51⤵
- Executes dropped EXE
PID:2916 -
\??\c:\btrhrf.exec:\btrhrf.exe52⤵
- Executes dropped EXE
PID:1124 -
\??\c:\nxlnr.exec:\nxlnr.exe53⤵
- Executes dropped EXE
PID:1472 -
\??\c:\bndtdh.exec:\bndtdh.exe54⤵
- Executes dropped EXE
PID:2356 -
\??\c:\nhhbj.exec:\nhhbj.exe55⤵
- Executes dropped EXE
PID:2016 -
\??\c:\vphrtlj.exec:\vphrtlj.exe56⤵
- Executes dropped EXE
PID:1628 -
\??\c:\thtltjj.exec:\thtltjj.exe57⤵
- Executes dropped EXE
PID:1388 -
\??\c:\djvhj.exec:\djvhj.exe58⤵
- Executes dropped EXE
PID:612 -
\??\c:\lxdbnhf.exec:\lxdbnhf.exe59⤵
- Executes dropped EXE
PID:824 -
\??\c:\pfjnbtp.exec:\pfjnbtp.exe60⤵
- Executes dropped EXE
PID:1740 -
\??\c:\hlpnnj.exec:\hlpnnj.exe61⤵
- Executes dropped EXE
PID:2228 -
\??\c:\nllhrvv.exec:\nllhrvv.exe62⤵
- Executes dropped EXE
PID:2980 -
\??\c:\jrbntd.exec:\jrbntd.exe63⤵
- Executes dropped EXE
PID:2924 -
\??\c:\lhllnv.exec:\lhllnv.exe64⤵
- Executes dropped EXE
PID:3028 -
\??\c:\xxddn.exec:\xxddn.exe65⤵
- Executes dropped EXE
PID:832 -
\??\c:\lnbbfvj.exec:\lnbbfvj.exe66⤵PID:692
-
\??\c:\tfjnhhj.exec:\tfjnhhj.exe67⤵PID:1800
-
\??\c:\hxpnr.exec:\hxpnr.exe68⤵PID:332
-
\??\c:\bhnrjv.exec:\bhnrjv.exe69⤵PID:2348
-
\??\c:\xlptb.exec:\xlptb.exe70⤵PID:1544
-
\??\c:\jbnbp.exec:\jbnbp.exe71⤵PID:624
-
\??\c:\jbjvprn.exec:\jbjvprn.exe72⤵PID:1700
-
\??\c:\nxvrhx.exec:\nxvrhx.exe73⤵PID:1392
-
\??\c:\pvrjj.exec:\pvrjj.exe74⤵PID:1652
-
\??\c:\tvrhl.exec:\tvrhl.exe75⤵PID:2812
-
\??\c:\prfbv.exec:\prfbv.exe76⤵PID:1564
-
\??\c:\lxdhfx.exec:\lxdhfx.exe77⤵PID:1728
-
\??\c:\hrrxjb.exec:\hrrxjb.exe78⤵PID:1876
-
\??\c:\hjhxj.exec:\hjhxj.exe79⤵PID:1592
-
\??\c:\dlpxjt.exec:\dlpxjt.exe80⤵PID:2684
-
\??\c:\lxbvv.exec:\lxbvv.exe81⤵PID:2492
-
\??\c:\hnjtdt.exec:\hnjtdt.exe82⤵PID:2568
-
\??\c:\rplxl.exec:\rplxl.exe83⤵PID:2584
-
\??\c:\fljhj.exec:\fljhj.exe84⤵PID:2640
-
\??\c:\vlfrtld.exec:\vlfrtld.exe85⤵PID:2592
-
\??\c:\blbbht.exec:\blbbht.exe86⤵PID:2548
-
\??\c:\rjfjn.exec:\rjfjn.exe87⤵PID:2412
-
\??\c:\xrpbjrb.exec:\xrpbjrb.exe88⤵PID:2424
-
\??\c:\pjnxtrv.exec:\pjnxtrv.exe89⤵PID:2780
-
\??\c:\blnlpb.exec:\blnlpb.exe90⤵PID:1004
-
\??\c:\pfrpnl.exec:\pfrpnl.exe91⤵PID:1404
-
\??\c:\jlrjvt.exec:\jlrjvt.exe92⤵PID:1640
-
\??\c:\vvjlht.exec:\vvjlht.exe93⤵PID:2728
-
\??\c:\ndhjl.exec:\ndhjl.exe94⤵PID:2656
-
\??\c:\brxfn.exec:\brxfn.exe95⤵PID:1904
-
\??\c:\dtxrvv.exec:\dtxrvv.exe96⤵PID:2128
-
\??\c:\nrthjpt.exec:\nrthjpt.exe97⤵PID:2284
-
\??\c:\vxtnjt.exec:\vxtnjt.exe98⤵PID:2852
-
\??\c:\rrfbdf.exec:\rrfbdf.exe99⤵PID:1540
-
\??\c:\rvfllt.exec:\rvfllt.exe100⤵PID:2320
-
\??\c:\vdljhj.exec:\vdljhj.exe101⤵PID:1436
-
\??\c:\ldvdh.exec:\ldvdh.exe102⤵PID:1388
-
\??\c:\nnrnnrb.exec:\nnrnnrb.exe103⤵PID:1760
-
\??\c:\bftlvn.exec:\bftlvn.exe104⤵PID:2776
-
\??\c:\xxhjtpb.exec:\xxhjtpb.exe105⤵PID:1780
-
\??\c:\rhjxjnh.exec:\rhjxjnh.exe106⤵PID:2220
-
\??\c:\xrnnjbl.exec:\xrnnjbl.exe107⤵PID:1068
-
\??\c:\jrjrf.exec:\jrjrf.exe108⤵PID:2948
-
\??\c:\vjxdtj.exec:\vjxdtj.exe109⤵PID:1932
-
\??\c:\trfjflp.exec:\trfjflp.exe110⤵PID:968
-
\??\c:\lxhxpj.exec:\lxhxpj.exe111⤵PID:752
-
\??\c:\dnxtd.exec:\dnxtd.exe112⤵PID:1832
-
\??\c:\fxblfvt.exec:\fxblfvt.exe113⤵PID:1088
-
\??\c:\fjdjp.exec:\fjdjp.exe114⤵PID:1092
-
\??\c:\ttjhphn.exec:\ttjhphn.exe115⤵PID:2188
-
\??\c:\thhvhdr.exec:\thhvhdr.exe116⤵PID:624
-
\??\c:\jjrtx.exec:\jjrtx.exe117⤵PID:1632
-
\??\c:\flftlxx.exec:\flftlxx.exe118⤵PID:2868
-
\??\c:\vdvrjvr.exec:\vdvrjvr.exe119⤵PID:2792
-
\??\c:\hffphd.exec:\hffphd.exe120⤵PID:2044
-
\??\c:\fptjlrn.exec:\fptjlrn.exe121⤵PID:2264
-
\??\c:\vrpbx.exec:\vrpbx.exe122⤵PID:1584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-