Analysis
-
max time kernel
151s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03-06-2024 13:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a51478a253606bfc805b40f17fb5dc30_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
a51478a253606bfc805b40f17fb5dc30_NeikiAnalytics.exe
-
Size
116KB
-
MD5
a51478a253606bfc805b40f17fb5dc30
-
SHA1
cf77c9027979b4fc4ca34e5967d833212bdd1491
-
SHA256
a91a69f7a43cdb18d829a5a1d0559712052c93bde345bdffd5de8dacfdbd569e
-
SHA512
c6a89e0f828cd8b94e2c895ea69b6d9f8d9ae8a4cea188adf149e373ce29d3cb3233069cc874395845f9ac7839d27dc7aec1bf2884f5409e14d663d1eaba8097
-
SSDEEP
3072:ymb3NkkiQ3mdBjFosxXGPXbXQMFHLgDWSmjlkFn:n3C9BRosxW8MFHLMWvlO
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/1336-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2364-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1820-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2216-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1992-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/712-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1884-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1940-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/908-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1756-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1272-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-306-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2620 pvvdp.exe 2884 xpdfhj.exe 2588 tlxpn.exe 2364 ffjxhf.exe 2564 tptjl.exe 2368 bvftdr.exe 2404 hftplf.exe 240 rfljfl.exe 1664 rrrxptn.exe 1820 dtvvvnt.exe 2656 jrxbbf.exe 2784 vrhnbvj.exe 1076 xdfhlxb.exe 1976 ttdnfht.exe 2204 rrfvn.exe 2216 nndhdt.exe 816 vdntfx.exe 1640 tnrrtlf.exe 1992 ltxfljr.exe 2452 hhblf.exe 712 rdrxpp.exe 2080 nnxbxdt.exe 272 bttdd.exe 2964 hfxbpvl.exe 1884 fnlbl.exe 2572 fhfbjx.exe 1940 dhjprlf.exe 908 ppdbv.exe 1756 bplvjl.exe 1272 bvrrjf.exe 2948 hhhlv.exe 2840 ffjvb.exe 1936 nrnhh.exe 1620 nldljl.exe 2808 lxvjjd.exe 2936 xbnpvx.exe 2484 rljtnl.exe 2580 lpjrv.exe 2628 dtrhjp.exe 2264 fnhdnnj.exe 2492 hbnrfv.exe 2352 fhxnhbt.exe 2476 vddfvvf.exe 2800 ttlbtrp.exe 1512 rlfrnr.exe 584 dnrjtx.exe 1060 jvbvnn.exe 1664 flvffhn.exe 2648 xnxrvnh.exe 2696 vtxxjrv.exe 2168 hprdrfr.exe 916 vbbvvpl.exe 1964 frnljb.exe 1484 drthfbx.exe 2228 hbptpj.exe 2176 fpldj.exe 2972 fxtlxfp.exe 816 tnpvnxv.exe 3044 pfdnrb.exe 1112 tvtlfrp.exe 2540 nnxjbtx.exe 1324 pnlpdl.exe 2724 rvtnn.exe 604 dfrrhj.exe -
resource yara_rule behavioral1/memory/1336-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2364-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2364-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2364-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/240-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/240-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1820-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1992-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/712-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1884-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1940-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/908-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1756-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1272-298-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-306-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1336 wrote to memory of 2620 1336 a51478a253606bfc805b40f17fb5dc30_NeikiAnalytics.exe 28 PID 1336 wrote to memory of 2620 1336 a51478a253606bfc805b40f17fb5dc30_NeikiAnalytics.exe 28 PID 1336 wrote to memory of 2620 1336 a51478a253606bfc805b40f17fb5dc30_NeikiAnalytics.exe 28 PID 1336 wrote to memory of 2620 1336 a51478a253606bfc805b40f17fb5dc30_NeikiAnalytics.exe 28 PID 2620 wrote to memory of 2884 2620 pvvdp.exe 29 PID 2620 wrote to memory of 2884 2620 pvvdp.exe 29 PID 2620 wrote to memory of 2884 2620 pvvdp.exe 29 PID 2620 wrote to memory of 2884 2620 pvvdp.exe 29 PID 2884 wrote to memory of 2588 2884 xpdfhj.exe 30 PID 2884 wrote to memory of 2588 2884 xpdfhj.exe 30 PID 2884 wrote to memory of 2588 2884 xpdfhj.exe 30 PID 2884 wrote to memory of 2588 2884 xpdfhj.exe 30 PID 2588 wrote to memory of 2364 2588 tlxpn.exe 31 PID 2588 wrote to memory of 2364 2588 tlxpn.exe 31 PID 2588 wrote to memory of 2364 2588 tlxpn.exe 31 PID 2588 wrote to memory of 2364 2588 tlxpn.exe 31 PID 2364 wrote to memory of 2564 2364 ffjxhf.exe 32 PID 2364 wrote to memory of 2564 2364 ffjxhf.exe 32 PID 2364 wrote to memory of 2564 2364 ffjxhf.exe 32 PID 2364 wrote to memory of 2564 2364 ffjxhf.exe 32 PID 2564 wrote to memory of 2368 2564 tptjl.exe 33 PID 2564 wrote to memory of 2368 2564 tptjl.exe 33 PID 2564 wrote to memory of 2368 2564 tptjl.exe 33 PID 2564 wrote to memory of 2368 2564 tptjl.exe 33 PID 2368 wrote to memory of 2404 2368 bvftdr.exe 34 PID 2368 wrote to memory of 2404 2368 bvftdr.exe 34 PID 2368 wrote to memory of 2404 2368 bvftdr.exe 34 PID 2368 wrote to memory of 2404 2368 bvftdr.exe 34 PID 2404 wrote to memory of 240 2404 hftplf.exe 35 PID 2404 wrote to memory of 240 2404 hftplf.exe 35 PID 2404 wrote to memory of 240 2404 hftplf.exe 35 PID 2404 wrote to memory of 240 2404 hftplf.exe 35 PID 240 wrote to memory of 1664 240 rfljfl.exe 36 PID 240 wrote to memory of 1664 240 rfljfl.exe 36 PID 240 wrote to memory of 1664 240 rfljfl.exe 36 PID 240 wrote to memory of 1664 240 rfljfl.exe 36 PID 1664 wrote to memory of 1820 1664 rrrxptn.exe 37 PID 1664 wrote to memory of 1820 1664 rrrxptn.exe 37 PID 1664 wrote to memory of 1820 1664 rrrxptn.exe 37 PID 1664 wrote to memory of 1820 1664 rrrxptn.exe 37 PID 1820 wrote to memory of 2656 1820 dtvvvnt.exe 38 PID 1820 wrote to memory of 2656 1820 dtvvvnt.exe 38 PID 1820 wrote to memory of 2656 1820 dtvvvnt.exe 38 PID 1820 wrote to memory of 2656 1820 dtvvvnt.exe 38 PID 2656 wrote to memory of 2784 2656 jrxbbf.exe 39 PID 2656 wrote to memory of 2784 2656 jrxbbf.exe 39 PID 2656 wrote to memory of 2784 2656 jrxbbf.exe 39 PID 2656 wrote to memory of 2784 2656 jrxbbf.exe 39 PID 2784 wrote to memory of 1076 2784 vrhnbvj.exe 40 PID 2784 wrote to memory of 1076 2784 vrhnbvj.exe 40 PID 2784 wrote to memory of 1076 2784 vrhnbvj.exe 40 PID 2784 wrote to memory of 1076 2784 vrhnbvj.exe 40 PID 1076 wrote to memory of 1976 1076 xdfhlxb.exe 41 PID 1076 wrote to memory of 1976 1076 xdfhlxb.exe 41 PID 1076 wrote to memory of 1976 1076 xdfhlxb.exe 41 PID 1076 wrote to memory of 1976 1076 xdfhlxb.exe 41 PID 1976 wrote to memory of 2204 1976 ttdnfht.exe 42 PID 1976 wrote to memory of 2204 1976 ttdnfht.exe 42 PID 1976 wrote to memory of 2204 1976 ttdnfht.exe 42 PID 1976 wrote to memory of 2204 1976 ttdnfht.exe 42 PID 2204 wrote to memory of 2216 2204 rrfvn.exe 43 PID 2204 wrote to memory of 2216 2204 rrfvn.exe 43 PID 2204 wrote to memory of 2216 2204 rrfvn.exe 43 PID 2204 wrote to memory of 2216 2204 rrfvn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\a51478a253606bfc805b40f17fb5dc30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a51478a253606bfc805b40f17fb5dc30_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\pvvdp.exec:\pvvdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\xpdfhj.exec:\xpdfhj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\tlxpn.exec:\tlxpn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\ffjxhf.exec:\ffjxhf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\tptjl.exec:\tptjl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\bvftdr.exec:\bvftdr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\hftplf.exec:\hftplf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\rfljfl.exec:\rfljfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
\??\c:\rrrxptn.exec:\rrrxptn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\dtvvvnt.exec:\dtvvvnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\jrxbbf.exec:\jrxbbf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\vrhnbvj.exec:\vrhnbvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\xdfhlxb.exec:\xdfhlxb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\ttdnfht.exec:\ttdnfht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\rrfvn.exec:\rrfvn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\nndhdt.exec:\nndhdt.exe17⤵
- Executes dropped EXE
PID:2216 -
\??\c:\vdntfx.exec:\vdntfx.exe18⤵
- Executes dropped EXE
PID:816 -
\??\c:\tnrrtlf.exec:\tnrrtlf.exe19⤵
- Executes dropped EXE
PID:1640 -
\??\c:\ltxfljr.exec:\ltxfljr.exe20⤵
- Executes dropped EXE
PID:1992 -
\??\c:\hhblf.exec:\hhblf.exe21⤵
- Executes dropped EXE
PID:2452 -
\??\c:\rdrxpp.exec:\rdrxpp.exe22⤵
- Executes dropped EXE
PID:712 -
\??\c:\nnxbxdt.exec:\nnxbxdt.exe23⤵
- Executes dropped EXE
PID:2080 -
\??\c:\bttdd.exec:\bttdd.exe24⤵
- Executes dropped EXE
PID:272 -
\??\c:\hfxbpvl.exec:\hfxbpvl.exe25⤵
- Executes dropped EXE
PID:2964 -
\??\c:\fnlbl.exec:\fnlbl.exe26⤵
- Executes dropped EXE
PID:1884 -
\??\c:\fhfbjx.exec:\fhfbjx.exe27⤵
- Executes dropped EXE
PID:2572 -
\??\c:\dhjprlf.exec:\dhjprlf.exe28⤵
- Executes dropped EXE
PID:1940 -
\??\c:\ppdbv.exec:\ppdbv.exe29⤵
- Executes dropped EXE
PID:908 -
\??\c:\bplvjl.exec:\bplvjl.exe30⤵
- Executes dropped EXE
PID:1756 -
\??\c:\bvrrjf.exec:\bvrrjf.exe31⤵
- Executes dropped EXE
PID:1272 -
\??\c:\hhhlv.exec:\hhhlv.exe32⤵
- Executes dropped EXE
PID:2948 -
\??\c:\ffjvb.exec:\ffjvb.exe33⤵
- Executes dropped EXE
PID:2840 -
\??\c:\nrnhh.exec:\nrnhh.exe34⤵
- Executes dropped EXE
PID:1936 -
\??\c:\nldljl.exec:\nldljl.exe35⤵
- Executes dropped EXE
PID:1620 -
\??\c:\lxvjjd.exec:\lxvjjd.exe36⤵
- Executes dropped EXE
PID:2808 -
\??\c:\xbnpvx.exec:\xbnpvx.exe37⤵
- Executes dropped EXE
PID:2936 -
\??\c:\rljtnl.exec:\rljtnl.exe38⤵
- Executes dropped EXE
PID:2484 -
\??\c:\lpjrv.exec:\lpjrv.exe39⤵
- Executes dropped EXE
PID:2580 -
\??\c:\dtrhjp.exec:\dtrhjp.exe40⤵
- Executes dropped EXE
PID:2628 -
\??\c:\fnhdnnj.exec:\fnhdnnj.exe41⤵
- Executes dropped EXE
PID:2264 -
\??\c:\hbnrfv.exec:\hbnrfv.exe42⤵
- Executes dropped EXE
PID:2492 -
\??\c:\fhxnhbt.exec:\fhxnhbt.exe43⤵
- Executes dropped EXE
PID:2352 -
\??\c:\vddfvvf.exec:\vddfvvf.exe44⤵
- Executes dropped EXE
PID:2476 -
\??\c:\ttlbtrp.exec:\ttlbtrp.exe45⤵
- Executes dropped EXE
PID:2800 -
\??\c:\rlfrnr.exec:\rlfrnr.exe46⤵
- Executes dropped EXE
PID:1512 -
\??\c:\dnrjtx.exec:\dnrjtx.exe47⤵
- Executes dropped EXE
PID:584 -
\??\c:\jvbvnn.exec:\jvbvnn.exe48⤵
- Executes dropped EXE
PID:1060 -
\??\c:\flvffhn.exec:\flvffhn.exe49⤵
- Executes dropped EXE
PID:1664 -
\??\c:\xnxrvnh.exec:\xnxrvnh.exe50⤵
- Executes dropped EXE
PID:2648 -
\??\c:\vtxxjrv.exec:\vtxxjrv.exe51⤵
- Executes dropped EXE
PID:2696 -
\??\c:\hprdrfr.exec:\hprdrfr.exe52⤵
- Executes dropped EXE
PID:2168 -
\??\c:\vbbvvpl.exec:\vbbvvpl.exe53⤵
- Executes dropped EXE
PID:916 -
\??\c:\frnljb.exec:\frnljb.exe54⤵
- Executes dropped EXE
PID:1964 -
\??\c:\drthfbx.exec:\drthfbx.exe55⤵
- Executes dropped EXE
PID:1484 -
\??\c:\hbptpj.exec:\hbptpj.exe56⤵
- Executes dropped EXE
PID:2228 -
\??\c:\fpldj.exec:\fpldj.exe57⤵
- Executes dropped EXE
PID:2176 -
\??\c:\fxtlxfp.exec:\fxtlxfp.exe58⤵
- Executes dropped EXE
PID:2972 -
\??\c:\tnpvnxv.exec:\tnpvnxv.exe59⤵
- Executes dropped EXE
PID:816 -
\??\c:\pfdnrb.exec:\pfdnrb.exe60⤵
- Executes dropped EXE
PID:3044 -
\??\c:\tvtlfrp.exec:\tvtlfrp.exe61⤵
- Executes dropped EXE
PID:1112 -
\??\c:\nnxjbtx.exec:\nnxjbtx.exe62⤵
- Executes dropped EXE
PID:2540 -
\??\c:\pnlpdl.exec:\pnlpdl.exe63⤵
- Executes dropped EXE
PID:1324 -
\??\c:\rvtnn.exec:\rvtnn.exe64⤵
- Executes dropped EXE
PID:2724 -
\??\c:\dfrrhj.exec:\dfrrhj.exe65⤵
- Executes dropped EXE
PID:604 -
\??\c:\ftvfjjf.exec:\ftvfjjf.exe66⤵PID:1248
-
\??\c:\ddtlpvp.exec:\ddtlpvp.exe67⤵PID:780
-
\??\c:\rprfbt.exec:\rprfbt.exe68⤵PID:1364
-
\??\c:\tvtpbvp.exec:\tvtpbvp.exe69⤵PID:1888
-
\??\c:\nbbhfr.exec:\nbbhfr.exe70⤵PID:2836
-
\??\c:\drhntb.exec:\drhntb.exe71⤵PID:1956
-
\??\c:\dbplh.exec:\dbplh.exe72⤵PID:3000
-
\??\c:\dvprhhn.exec:\dvprhhn.exe73⤵PID:2308
-
\??\c:\nfblrxd.exec:\nfblrxd.exe74⤵PID:2928
-
\??\c:\lptdln.exec:\lptdln.exe75⤵PID:1700
-
\??\c:\bfrrft.exec:\bfrrft.exe76⤵PID:2948
-
\??\c:\hrdrr.exec:\hrdrr.exe77⤵PID:2188
-
\??\c:\hvffrvb.exec:\hvffrvb.exe78⤵PID:1628
-
\??\c:\pftnb.exec:\pftnb.exe79⤵PID:640
-
\??\c:\ndvbn.exec:\ndvbn.exe80⤵PID:1720
-
\??\c:\dtpthh.exec:\dtpthh.exe81⤵PID:852
-
\??\c:\pvjpbx.exec:\pvjpbx.exe82⤵PID:1092
-
\??\c:\dvvbdfr.exec:\dvvbdfr.exe83⤵PID:2500
-
\??\c:\frbhr.exec:\frbhr.exe84⤵PID:2712
-
\??\c:\fplrth.exec:\fplrth.exe85⤵PID:2464
-
\??\c:\rhhfrdb.exec:\rhhfrdb.exe86⤵PID:2636
-
\??\c:\rbhtrxh.exec:\rbhtrxh.exe87⤵PID:3028
-
\??\c:\dxjvbd.exec:\dxjvbd.exe88⤵PID:2360
-
\??\c:\hhlrtbd.exec:\hhlrtbd.exe89⤵PID:2804
-
\??\c:\jvrrrdf.exec:\jvrrrdf.exe90⤵PID:1760
-
\??\c:\hlhbvt.exec:\hlhbvt.exe91⤵PID:1784
-
\??\c:\nvvpf.exec:\nvvpf.exe92⤵PID:1124
-
\??\c:\vtxbbx.exec:\vtxbbx.exe93⤵PID:372
-
\??\c:\fdtvn.exec:\fdtvn.exe94⤵PID:964
-
\??\c:\hdrrvb.exec:\hdrrvb.exe95⤵PID:2672
-
\??\c:\dnptf.exec:\dnptf.exe96⤵PID:808
-
\??\c:\tdtjdvd.exec:\tdtjdvd.exe97⤵PID:1836
-
\??\c:\hxrnh.exec:\hxrnh.exe98⤵PID:1480
-
\??\c:\rxhnr.exec:\rxhnr.exe99⤵PID:1976
-
\??\c:\vxjpj.exec:\vxjpj.exe100⤵PID:1812
-
\??\c:\prfvd.exec:\prfvd.exe101⤵PID:2228
-
\??\c:\bddfjr.exec:\bddfjr.exe102⤵PID:1648
-
\??\c:\tdpfrvv.exec:\tdpfrvv.exe103⤵PID:1552
-
\??\c:\tndrtj.exec:\tndrtj.exe104⤵PID:1608
-
\??\c:\lxdndnv.exec:\lxdndnv.exe105⤵PID:2060
-
\??\c:\dvrpxxx.exec:\dvrpxxx.exe106⤵PID:2320
-
\??\c:\bdvnrj.exec:\bdvnrj.exe107⤵PID:2160
-
\??\c:\dtrlbj.exec:\dtrlbj.exe108⤵PID:3016
-
\??\c:\njxbbpj.exec:\njxbbpj.exe109⤵PID:3052
-
\??\c:\dlvlfl.exec:\dlvlfl.exe110⤵PID:2988
-
\??\c:\lfhbf.exec:\lfhbf.exe111⤵PID:1576
-
\??\c:\nlnfb.exec:\nlnfb.exe112⤵PID:1636
-
\??\c:\lhndnj.exec:\lhndnj.exe113⤵PID:1852
-
\??\c:\nrxfh.exec:\nrxfh.exe114⤵PID:2768
-
\??\c:\lpptd.exec:\lpptd.exe115⤵PID:1656
-
\??\c:\hdvlv.exec:\hdvlv.exe116⤵PID:1844
-
\??\c:\lbrlhxx.exec:\lbrlhxx.exe117⤵PID:2760
-
\??\c:\vjlpdf.exec:\vjlpdf.exe118⤵PID:2256
-
\??\c:\phxvtj.exec:\phxvtj.exe119⤵PID:2304
-
\??\c:\lfvxjv.exec:\lfvxjv.exe120⤵PID:2852
-
\??\c:\lxbbj.exec:\lxbbj.exe121⤵PID:884
-
\??\c:\lfxdt.exec:\lfxdt.exe122⤵PID:2732
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-