Analysis
-
max time kernel
148s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-06-2024 05:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3e8c3c536d1fb5ef4d506c5acc8b8420_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
3e8c3c536d1fb5ef4d506c5acc8b8420_NeikiAnalytics.exe
-
Size
95KB
-
MD5
3e8c3c536d1fb5ef4d506c5acc8b8420
-
SHA1
b347039daa84ead5787f3d4d85e5bbc33416d2ad
-
SHA256
296b1b0a81575db2b7277b23ad109a16330e30c52aeddf10c274c9ab093c6644
-
SHA512
7b0924a3c1a1b865f7bc8ff76552270b3e2077a9a212ac871dc786a12c9835c72b4afe36fa33bff5714c403efa79de3ca042adf0bc34c3e3517ccd25b6519bed
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxEPOfPrAW:ymb3NkkiQ3mdBjFo73PYP1lri3KuOnrR
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/2804-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2052-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2080-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1540-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2364-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2364-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/324-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/576-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1192-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1704-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1832-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1368-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2020-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/764-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1592-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2320-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3020-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2052 jjxvnb.exe 2080 tlnjvpb.exe 2128 vttlnd.exe 2536 dtrhrv.exe 2560 rrlptbr.exe 1540 llbpd.exe 2496 lnlrj.exe 2364 dllnfvr.exe 2188 rltfxpl.exe 324 nnphj.exe 576 lxvnnlv.exe 1192 xrvvj.exe 1704 tfprv.exe 1832 lnrtb.exe 1368 txxvbhl.exe 2020 fbfnjxt.exe 764 vhxbx.exe 1592 tfdlt.exe 2320 lthrb.exe 3020 jbbbb.exe 2720 tphdjt.exe 2724 jvrtrx.exe 2916 fdbbf.exe 1816 thnvpd.exe 2884 djpnvfd.exe 1700 ldlrnxh.exe 2984 ffvnbbx.exe 1072 xtptlp.exe 1676 pvnjf.exe 2272 nrbpjf.exe 2728 xlddll.exe 880 xjbrl.exe 2092 tpntldp.exe 1896 jpvtlh.exe 2816 rbddt.exe 1716 dhjfnph.exe 2080 tddjt.exe 2844 fhhldp.exe 2532 flxpt.exe 2544 xfdtp.exe 2456 vjbfdp.exe 2560 bbbrbfr.exe 2500 rftvjfb.exe 2468 dnlxr.exe 2408 xpdthj.exe 2388 pvdbb.exe 2772 lblvn.exe 564 fnhdt.exe 1848 dhdbnr.exe 460 dplhb.exe 1252 xjrpfj.exe 2304 llvffp.exe 2024 vfltdp.exe 2136 lxplppp.exe 1656 bnlldjr.exe 2308 hdjlf.exe 936 ffxjljx.exe 2580 dvjhnlx.exe 2592 txvft.exe 2796 txxfdl.exe 2256 rnxxnx.exe 2576 hxrndh.exe 1064 thnfp.exe 2028 vbvtlrr.exe -
resource yara_rule behavioral1/memory/2804-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1540-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2364-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2364-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/324-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/576-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1192-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1704-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1832-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1368-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/764-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1592-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2320-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-303-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2804 wrote to memory of 2052 2804 3e8c3c536d1fb5ef4d506c5acc8b8420_NeikiAnalytics.exe 28 PID 2804 wrote to memory of 2052 2804 3e8c3c536d1fb5ef4d506c5acc8b8420_NeikiAnalytics.exe 28 PID 2804 wrote to memory of 2052 2804 3e8c3c536d1fb5ef4d506c5acc8b8420_NeikiAnalytics.exe 28 PID 2804 wrote to memory of 2052 2804 3e8c3c536d1fb5ef4d506c5acc8b8420_NeikiAnalytics.exe 28 PID 2052 wrote to memory of 2080 2052 jjxvnb.exe 29 PID 2052 wrote to memory of 2080 2052 jjxvnb.exe 29 PID 2052 wrote to memory of 2080 2052 jjxvnb.exe 29 PID 2052 wrote to memory of 2080 2052 jjxvnb.exe 29 PID 2080 wrote to memory of 2128 2080 tlnjvpb.exe 30 PID 2080 wrote to memory of 2128 2080 tlnjvpb.exe 30 PID 2080 wrote to memory of 2128 2080 tlnjvpb.exe 30 PID 2080 wrote to memory of 2128 2080 tlnjvpb.exe 30 PID 2128 wrote to memory of 2536 2128 vttlnd.exe 31 PID 2128 wrote to memory of 2536 2128 vttlnd.exe 31 PID 2128 wrote to memory of 2536 2128 vttlnd.exe 31 PID 2128 wrote to memory of 2536 2128 vttlnd.exe 31 PID 2536 wrote to memory of 2560 2536 dtrhrv.exe 32 PID 2536 wrote to memory of 2560 2536 dtrhrv.exe 32 PID 2536 wrote to memory of 2560 2536 dtrhrv.exe 32 PID 2536 wrote to memory of 2560 2536 dtrhrv.exe 32 PID 2560 wrote to memory of 1540 2560 rrlptbr.exe 33 PID 2560 wrote to memory of 1540 2560 rrlptbr.exe 33 PID 2560 wrote to memory of 1540 2560 rrlptbr.exe 33 PID 2560 wrote to memory of 1540 2560 rrlptbr.exe 33 PID 1540 wrote to memory of 2496 1540 llbpd.exe 34 PID 1540 wrote to memory of 2496 1540 llbpd.exe 34 PID 1540 wrote to memory of 2496 1540 llbpd.exe 34 PID 1540 wrote to memory of 2496 1540 llbpd.exe 34 PID 2496 wrote to memory of 2364 2496 lnlrj.exe 35 PID 2496 wrote to memory of 2364 2496 lnlrj.exe 35 PID 2496 wrote to memory of 2364 2496 lnlrj.exe 35 PID 2496 wrote to memory of 2364 2496 lnlrj.exe 35 PID 2364 wrote to memory of 2188 2364 dllnfvr.exe 36 PID 2364 wrote to memory of 2188 2364 dllnfvr.exe 36 PID 2364 wrote to memory of 2188 2364 dllnfvr.exe 36 PID 2364 wrote to memory of 2188 2364 dllnfvr.exe 36 PID 2188 wrote to memory of 324 2188 rltfxpl.exe 37 PID 2188 wrote to memory of 324 2188 rltfxpl.exe 37 PID 2188 wrote to memory of 324 2188 rltfxpl.exe 37 PID 2188 wrote to memory of 324 2188 rltfxpl.exe 37 PID 324 wrote to memory of 576 324 nnphj.exe 38 PID 324 wrote to memory of 576 324 nnphj.exe 38 PID 324 wrote to memory of 576 324 nnphj.exe 38 PID 324 wrote to memory of 576 324 nnphj.exe 38 PID 576 wrote to memory of 1192 576 lxvnnlv.exe 39 PID 576 wrote to memory of 1192 576 lxvnnlv.exe 39 PID 576 wrote to memory of 1192 576 lxvnnlv.exe 39 PID 576 wrote to memory of 1192 576 lxvnnlv.exe 39 PID 1192 wrote to memory of 1704 1192 xrvvj.exe 40 PID 1192 wrote to memory of 1704 1192 xrvvj.exe 40 PID 1192 wrote to memory of 1704 1192 xrvvj.exe 40 PID 1192 wrote to memory of 1704 1192 xrvvj.exe 40 PID 1704 wrote to memory of 1832 1704 tfprv.exe 41 PID 1704 wrote to memory of 1832 1704 tfprv.exe 41 PID 1704 wrote to memory of 1832 1704 tfprv.exe 41 PID 1704 wrote to memory of 1832 1704 tfprv.exe 41 PID 1832 wrote to memory of 1368 1832 lnrtb.exe 42 PID 1832 wrote to memory of 1368 1832 lnrtb.exe 42 PID 1832 wrote to memory of 1368 1832 lnrtb.exe 42 PID 1832 wrote to memory of 1368 1832 lnrtb.exe 42 PID 1368 wrote to memory of 2020 1368 txxvbhl.exe 43 PID 1368 wrote to memory of 2020 1368 txxvbhl.exe 43 PID 1368 wrote to memory of 2020 1368 txxvbhl.exe 43 PID 1368 wrote to memory of 2020 1368 txxvbhl.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e8c3c536d1fb5ef4d506c5acc8b8420_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3e8c3c536d1fb5ef4d506c5acc8b8420_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\jjxvnb.exec:\jjxvnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\tlnjvpb.exec:\tlnjvpb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\vttlnd.exec:\vttlnd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\dtrhrv.exec:\dtrhrv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\rrlptbr.exec:\rrlptbr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\llbpd.exec:\llbpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\lnlrj.exec:\lnlrj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\dllnfvr.exec:\dllnfvr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\rltfxpl.exec:\rltfxpl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\nnphj.exec:\nnphj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:324 -
\??\c:\lxvnnlv.exec:\lxvnnlv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\xrvvj.exec:\xrvvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\tfprv.exec:\tfprv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\lnrtb.exec:\lnrtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\txxvbhl.exec:\txxvbhl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\fbfnjxt.exec:\fbfnjxt.exe17⤵
- Executes dropped EXE
PID:2020 -
\??\c:\vhxbx.exec:\vhxbx.exe18⤵
- Executes dropped EXE
PID:764 -
\??\c:\tfdlt.exec:\tfdlt.exe19⤵
- Executes dropped EXE
PID:1592 -
\??\c:\lthrb.exec:\lthrb.exe20⤵
- Executes dropped EXE
PID:2320 -
\??\c:\jbbbb.exec:\jbbbb.exe21⤵
- Executes dropped EXE
PID:3020 -
\??\c:\tphdjt.exec:\tphdjt.exe22⤵
- Executes dropped EXE
PID:2720 -
\??\c:\jvrtrx.exec:\jvrtrx.exe23⤵
- Executes dropped EXE
PID:2724 -
\??\c:\fdbbf.exec:\fdbbf.exe24⤵
- Executes dropped EXE
PID:2916 -
\??\c:\thnvpd.exec:\thnvpd.exe25⤵
- Executes dropped EXE
PID:1816 -
\??\c:\djpnvfd.exec:\djpnvfd.exe26⤵
- Executes dropped EXE
PID:2884 -
\??\c:\ldlrnxh.exec:\ldlrnxh.exe27⤵
- Executes dropped EXE
PID:1700 -
\??\c:\ffvnbbx.exec:\ffvnbbx.exe28⤵
- Executes dropped EXE
PID:2984 -
\??\c:\xtptlp.exec:\xtptlp.exe29⤵
- Executes dropped EXE
PID:1072 -
\??\c:\pvnjf.exec:\pvnjf.exe30⤵
- Executes dropped EXE
PID:1676 -
\??\c:\nrbpjf.exec:\nrbpjf.exe31⤵
- Executes dropped EXE
PID:2272 -
\??\c:\xlddll.exec:\xlddll.exe32⤵
- Executes dropped EXE
PID:2728 -
\??\c:\xjbrl.exec:\xjbrl.exe33⤵
- Executes dropped EXE
PID:880 -
\??\c:\tpntldp.exec:\tpntldp.exe34⤵
- Executes dropped EXE
PID:2092 -
\??\c:\jpvtlh.exec:\jpvtlh.exe35⤵
- Executes dropped EXE
PID:1896 -
\??\c:\rbddt.exec:\rbddt.exe36⤵
- Executes dropped EXE
PID:2816 -
\??\c:\dhjfnph.exec:\dhjfnph.exe37⤵
- Executes dropped EXE
PID:1716 -
\??\c:\tddjt.exec:\tddjt.exe38⤵
- Executes dropped EXE
PID:2080 -
\??\c:\fhhldp.exec:\fhhldp.exe39⤵
- Executes dropped EXE
PID:2844 -
\??\c:\flxpt.exec:\flxpt.exe40⤵
- Executes dropped EXE
PID:2532 -
\??\c:\xfdtp.exec:\xfdtp.exe41⤵
- Executes dropped EXE
PID:2544 -
\??\c:\vjbfdp.exec:\vjbfdp.exe42⤵
- Executes dropped EXE
PID:2456 -
\??\c:\bbbrbfr.exec:\bbbrbfr.exe43⤵
- Executes dropped EXE
PID:2560 -
\??\c:\rftvjfb.exec:\rftvjfb.exe44⤵
- Executes dropped EXE
PID:2500 -
\??\c:\dnlxr.exec:\dnlxr.exe45⤵
- Executes dropped EXE
PID:2468 -
\??\c:\xpdthj.exec:\xpdthj.exe46⤵
- Executes dropped EXE
PID:2408 -
\??\c:\pvdbb.exec:\pvdbb.exe47⤵
- Executes dropped EXE
PID:2388 -
\??\c:\lblvn.exec:\lblvn.exe48⤵
- Executes dropped EXE
PID:2772 -
\??\c:\fnhdt.exec:\fnhdt.exe49⤵
- Executes dropped EXE
PID:564 -
\??\c:\dhdbnr.exec:\dhdbnr.exe50⤵
- Executes dropped EXE
PID:1848 -
\??\c:\dplhb.exec:\dplhb.exe51⤵
- Executes dropped EXE
PID:460 -
\??\c:\xjrpfj.exec:\xjrpfj.exe52⤵
- Executes dropped EXE
PID:1252 -
\??\c:\llvffp.exec:\llvffp.exe53⤵
- Executes dropped EXE
PID:2304 -
\??\c:\vfltdp.exec:\vfltdp.exe54⤵
- Executes dropped EXE
PID:2024 -
\??\c:\lxplppp.exec:\lxplppp.exe55⤵
- Executes dropped EXE
PID:2136 -
\??\c:\bnlldjr.exec:\bnlldjr.exe56⤵
- Executes dropped EXE
PID:1656 -
\??\c:\hdjlf.exec:\hdjlf.exe57⤵
- Executes dropped EXE
PID:2308 -
\??\c:\ffxjljx.exec:\ffxjljx.exe58⤵
- Executes dropped EXE
PID:936 -
\??\c:\dvjhnlx.exec:\dvjhnlx.exe59⤵
- Executes dropped EXE
PID:2580 -
\??\c:\txvft.exec:\txvft.exe60⤵
- Executes dropped EXE
PID:2592 -
\??\c:\txxfdl.exec:\txxfdl.exe61⤵
- Executes dropped EXE
PID:2796 -
\??\c:\rnxxnx.exec:\rnxxnx.exe62⤵
- Executes dropped EXE
PID:2256 -
\??\c:\hxrndh.exec:\hxrndh.exe63⤵
- Executes dropped EXE
PID:2576 -
\??\c:\thnfp.exec:\thnfp.exe64⤵
- Executes dropped EXE
PID:1064 -
\??\c:\vbvtlrr.exec:\vbvtlrr.exe65⤵
- Executes dropped EXE
PID:2028 -
\??\c:\brvttj.exec:\brvttj.exe66⤵PID:1828
-
\??\c:\jrblp.exec:\jrblp.exe67⤵PID:1564
-
\??\c:\nnxljn.exec:\nnxljn.exe68⤵PID:976
-
\??\c:\ftdnxfr.exec:\ftdnxfr.exe69⤵PID:2512
-
\??\c:\rtpdvnh.exec:\rtpdvnh.exe70⤵PID:1948
-
\??\c:\hdvxdpb.exec:\hdvxdpb.exe71⤵PID:2060
-
\??\c:\ffhhp.exec:\ffhhp.exe72⤵PID:1508
-
\??\c:\pdjtt.exec:\pdjtt.exe73⤵PID:2072
-
\??\c:\lnxxtr.exec:\lnxxtr.exe74⤵PID:1436
-
\??\c:\rbhlt.exec:\rbhlt.exe75⤵PID:2116
-
\??\c:\lbbnpbf.exec:\lbbnpbf.exe76⤵PID:1684
-
\??\c:\rjhpdj.exec:\rjhpdj.exe77⤵PID:2264
-
\??\c:\vlvbbd.exec:\vlvbbd.exe78⤵PID:2084
-
\??\c:\htbbbh.exec:\htbbbh.exe79⤵PID:1612
-
\??\c:\lrxlxv.exec:\lrxlxv.exe80⤵PID:2680
-
\??\c:\vrrbtvt.exec:\vrrbtvt.exe81⤵PID:2440
-
\??\c:\hvxdh.exec:\hvxdh.exe82⤵PID:2540
-
\??\c:\ppdjt.exec:\ppdjt.exe83⤵PID:2572
-
\??\c:\bfpbb.exec:\bfpbb.exe84⤵PID:1556
-
\??\c:\fljtp.exec:\fljtp.exe85⤵PID:2604
-
\??\c:\pjbjrdh.exec:\pjbjrdh.exe86⤵PID:2448
-
\??\c:\fdhdh.exec:\fdhdh.exe87⤵PID:1540
-
\??\c:\tlfdl.exec:\tlfdl.exe88⤵PID:2468
-
\??\c:\jpdbfv.exec:\jpdbfv.exe89⤵PID:2800
-
\??\c:\lpfrdp.exec:\lpfrdp.exe90⤵PID:2096
-
\??\c:\fnddll.exec:\fnddll.exe91⤵PID:2944
-
\??\c:\npltbj.exec:\npltbj.exe92⤵PID:2016
-
\??\c:\ftjvnlp.exec:\ftjvnlp.exe93⤵PID:112
-
\??\c:\bpnbvnp.exec:\bpnbvnp.exe94⤵PID:552
-
\??\c:\prvvthb.exec:\prvvthb.exe95⤵PID:1192
-
\??\c:\fbjdl.exec:\fbjdl.exe96⤵PID:2168
-
\??\c:\lthhlx.exec:\lthhlx.exe97⤵PID:1832
-
\??\c:\fjljrbn.exec:\fjljrbn.exe98⤵PID:2012
-
\??\c:\rlljjp.exec:\rlljjp.exe99⤵PID:1784
-
\??\c:\xjrjf.exec:\xjrjf.exe100⤵PID:2280
-
\??\c:\dxjrrvn.exec:\dxjrrvn.exe101⤵PID:1776
-
\??\c:\tftfnlx.exec:\tftfnlx.exe102⤵PID:2432
-
\??\c:\xbpdbpp.exec:\xbpdbpp.exe103⤵PID:2384
-
\??\c:\dvptd.exec:\dvptd.exe104⤵PID:2428
-
\??\c:\vthpv.exec:\vthpv.exe105⤵PID:2132
-
\??\c:\xlnfj.exec:\xlnfj.exe106⤵PID:2508
-
\??\c:\xvxbll.exec:\xvxbll.exe107⤵PID:1084
-
\??\c:\pphtph.exec:\pphtph.exe108⤵PID:2724
-
\??\c:\xnrnhb.exec:\xnrnhb.exe109⤵PID:1636
-
\??\c:\ddhrx.exec:\ddhrx.exe110⤵PID:1984
-
\??\c:\txdjv.exec:\txdjv.exe111⤵PID:1828
-
\??\c:\phfxj.exec:\phfxj.exe112⤵PID:1580
-
\??\c:\ffvrhdp.exec:\ffvrhdp.exe113⤵PID:1972
-
\??\c:\vhfxbf.exec:\vhfxbf.exe114⤵PID:2984
-
\??\c:\tjlphv.exec:\tjlphv.exe115⤵PID:1072
-
\??\c:\vhbxbb.exec:\vhbxbb.exe116⤵PID:864
-
\??\c:\jpttll.exec:\jpttll.exe117⤵PID:2888
-
\??\c:\nfhntlh.exec:\nfhntlh.exe118⤵PID:2836
-
\??\c:\rhtdjfr.exec:\rhtdjfr.exe119⤵PID:1696
-
\??\c:\xxdll.exec:\xxdll.exe120⤵PID:2892
-
\??\c:\xhvdx.exec:\xhvdx.exe121⤵PID:2092
-
\??\c:\jhvlrh.exec:\jhvlrh.exe122⤵PID:1896
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-