Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 13:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fff1a7f0fb125a75c84bc2ab6dc418d0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
fff1a7f0fb125a75c84bc2ab6dc418d0_NeikiAnalytics.exe
-
Size
366KB
-
MD5
fff1a7f0fb125a75c84bc2ab6dc418d0
-
SHA1
a6039cf66d2b80404c59d080f69a867a8cbdb1c3
-
SHA256
3d8f2d8fe716643635ffdd15b40b6b050157d200277e969d22b4f68c8348ea2f
-
SHA512
ac78d35ab88a27cc4031a6e3be2a6bee38beb1305307337dec4c7b873fe65d5b786201ea108bf8d8fc92f13616550584a959333fa84092f7f389e48b89335d0e
-
SSDEEP
6144:n3C9BRo7tvnJ99T/KZEL3RUXownfWQkyCpxwJz9e0pQowLh3EhToK9cT085mnFhw:n3C9ytvnVXFUXoSWlnwJv90aKToFqwfe
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/856-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/856-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1676-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1172-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2224-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2256-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2080-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/676-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/916-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1808-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1564-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1888-266-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1832-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1676 hlplpvh.exe 2916 fxrfx.exe 2580 drbhdp.exe 2624 dbftbvd.exe 2432 vhfdrjf.exe 2720 fjldnhr.exe 2176 tnjbbb.exe 2496 pntdtbx.exe 3016 dplfrn.exe 584 fdbdbvn.exe 2492 hvffjhn.exe 2856 pxftf.exe 1172 nxvfxnr.exe 1444 djvdrh.exe 2224 lrplbbx.exe 2256 bpfbn.exe 948 bdjffhv.exe 2216 hpfnxtt.exe 1780 jlxhbv.exe 2080 pdrvrv.exe 676 bppvb.exe 3004 rrjdbbj.exe 916 brbpfph.exe 2128 vfvnvjn.exe 1808 tpdrdjp.exe 1564 fbjpn.exe 1888 pppjjjj.exe 1832 dlfnjd.exe 2820 vnbbx.exe 2768 xdhjnp.exe 2868 nfbprvp.exe 2400 ldjffjr.exe 2364 lrnhx.exe 3012 bthlfvt.exe 2504 bdfvxpl.exe 2700 rhjvn.exe 2628 fnhxhb.exe 2684 tjbjhhn.exe 2688 hhbvdj.exe 2616 fnptnb.exe 2540 dflpfb.exe 2468 jjxjjtn.exe 2828 brrvfbf.exe 2488 xxxlbv.exe 2840 rjfpfv.exe 520 xpnbrfv.exe 572 bnjjxpv.exe 836 tfxvrnh.exe 2708 vrhhr.exe 2212 phxfhhb.exe 2856 fnvhf.exe 1500 fltbdjx.exe 2232 pjphft.exe 1152 pjvrjvv.exe 1368 vrbxd.exe 1580 jjvfnnl.exe 2328 xjlxh.exe 2216 bdjvplv.exe 2296 nffnnfj.exe 596 vdhpp.exe 336 rnvpjtb.exe 1712 dhbhpdd.exe 276 jpfnvb.exe 1688 vvdpv.exe -
resource yara_rule behavioral1/memory/856-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/856-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1676-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1172-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2224-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/676-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/916-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1808-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1564-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1888-266-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1832-276-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 856 wrote to memory of 1676 856 fff1a7f0fb125a75c84bc2ab6dc418d0_NeikiAnalytics.exe 28 PID 856 wrote to memory of 1676 856 fff1a7f0fb125a75c84bc2ab6dc418d0_NeikiAnalytics.exe 28 PID 856 wrote to memory of 1676 856 fff1a7f0fb125a75c84bc2ab6dc418d0_NeikiAnalytics.exe 28 PID 856 wrote to memory of 1676 856 fff1a7f0fb125a75c84bc2ab6dc418d0_NeikiAnalytics.exe 28 PID 1676 wrote to memory of 2916 1676 hlplpvh.exe 29 PID 1676 wrote to memory of 2916 1676 hlplpvh.exe 29 PID 1676 wrote to memory of 2916 1676 hlplpvh.exe 29 PID 1676 wrote to memory of 2916 1676 hlplpvh.exe 29 PID 2916 wrote to memory of 2580 2916 fxrfx.exe 30 PID 2916 wrote to memory of 2580 2916 fxrfx.exe 30 PID 2916 wrote to memory of 2580 2916 fxrfx.exe 30 PID 2916 wrote to memory of 2580 2916 fxrfx.exe 30 PID 2580 wrote to memory of 2624 2580 drbhdp.exe 31 PID 2580 wrote to memory of 2624 2580 drbhdp.exe 31 PID 2580 wrote to memory of 2624 2580 drbhdp.exe 31 PID 2580 wrote to memory of 2624 2580 drbhdp.exe 31 PID 2624 wrote to memory of 2432 2624 dbftbvd.exe 32 PID 2624 wrote to memory of 2432 2624 dbftbvd.exe 32 PID 2624 wrote to memory of 2432 2624 dbftbvd.exe 32 PID 2624 wrote to memory of 2432 2624 dbftbvd.exe 32 PID 2432 wrote to memory of 2720 2432 vhfdrjf.exe 33 PID 2432 wrote to memory of 2720 2432 vhfdrjf.exe 33 PID 2432 wrote to memory of 2720 2432 vhfdrjf.exe 33 PID 2432 wrote to memory of 2720 2432 vhfdrjf.exe 33 PID 2720 wrote to memory of 2176 2720 fjldnhr.exe 34 PID 2720 wrote to memory of 2176 2720 fjldnhr.exe 34 PID 2720 wrote to memory of 2176 2720 fjldnhr.exe 34 PID 2720 wrote to memory of 2176 2720 fjldnhr.exe 34 PID 2176 wrote to memory of 2496 2176 tnjbbb.exe 35 PID 2176 wrote to memory of 2496 2176 tnjbbb.exe 35 PID 2176 wrote to memory of 2496 2176 tnjbbb.exe 35 PID 2176 wrote to memory of 2496 2176 tnjbbb.exe 35 PID 2496 wrote to memory of 3016 2496 pntdtbx.exe 36 PID 2496 wrote to memory of 3016 2496 pntdtbx.exe 36 PID 2496 wrote to memory of 3016 2496 pntdtbx.exe 36 PID 2496 wrote to memory of 3016 2496 pntdtbx.exe 36 PID 3016 wrote to memory of 584 3016 dplfrn.exe 37 PID 3016 wrote to memory of 584 3016 dplfrn.exe 37 PID 3016 wrote to memory of 584 3016 dplfrn.exe 37 PID 3016 wrote to memory of 584 3016 dplfrn.exe 37 PID 584 wrote to memory of 2492 584 fdbdbvn.exe 38 PID 584 wrote to memory of 2492 584 fdbdbvn.exe 38 PID 584 wrote to memory of 2492 584 fdbdbvn.exe 38 PID 584 wrote to memory of 2492 584 fdbdbvn.exe 38 PID 2492 wrote to memory of 2856 2492 hvffjhn.exe 39 PID 2492 wrote to memory of 2856 2492 hvffjhn.exe 39 PID 2492 wrote to memory of 2856 2492 hvffjhn.exe 39 PID 2492 wrote to memory of 2856 2492 hvffjhn.exe 39 PID 2856 wrote to memory of 1172 2856 pxftf.exe 40 PID 2856 wrote to memory of 1172 2856 pxftf.exe 40 PID 2856 wrote to memory of 1172 2856 pxftf.exe 40 PID 2856 wrote to memory of 1172 2856 pxftf.exe 40 PID 1172 wrote to memory of 1444 1172 nxvfxnr.exe 41 PID 1172 wrote to memory of 1444 1172 nxvfxnr.exe 41 PID 1172 wrote to memory of 1444 1172 nxvfxnr.exe 41 PID 1172 wrote to memory of 1444 1172 nxvfxnr.exe 41 PID 1444 wrote to memory of 2224 1444 djvdrh.exe 42 PID 1444 wrote to memory of 2224 1444 djvdrh.exe 42 PID 1444 wrote to memory of 2224 1444 djvdrh.exe 42 PID 1444 wrote to memory of 2224 1444 djvdrh.exe 42 PID 2224 wrote to memory of 2256 2224 lrplbbx.exe 43 PID 2224 wrote to memory of 2256 2224 lrplbbx.exe 43 PID 2224 wrote to memory of 2256 2224 lrplbbx.exe 43 PID 2224 wrote to memory of 2256 2224 lrplbbx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\fff1a7f0fb125a75c84bc2ab6dc418d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\fff1a7f0fb125a75c84bc2ab6dc418d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\hlplpvh.exec:\hlplpvh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\fxrfx.exec:\fxrfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\drbhdp.exec:\drbhdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\dbftbvd.exec:\dbftbvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\vhfdrjf.exec:\vhfdrjf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\fjldnhr.exec:\fjldnhr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\tnjbbb.exec:\tnjbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\pntdtbx.exec:\pntdtbx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\dplfrn.exec:\dplfrn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\fdbdbvn.exec:\fdbdbvn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:584 -
\??\c:\hvffjhn.exec:\hvffjhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\pxftf.exec:\pxftf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\nxvfxnr.exec:\nxvfxnr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\djvdrh.exec:\djvdrh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\lrplbbx.exec:\lrplbbx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\bpfbn.exec:\bpfbn.exe17⤵
- Executes dropped EXE
PID:2256 -
\??\c:\bdjffhv.exec:\bdjffhv.exe18⤵
- Executes dropped EXE
PID:948 -
\??\c:\hpfnxtt.exec:\hpfnxtt.exe19⤵
- Executes dropped EXE
PID:2216 -
\??\c:\jlxhbv.exec:\jlxhbv.exe20⤵
- Executes dropped EXE
PID:1780 -
\??\c:\pdrvrv.exec:\pdrvrv.exe21⤵
- Executes dropped EXE
PID:2080 -
\??\c:\bppvb.exec:\bppvb.exe22⤵
- Executes dropped EXE
PID:676 -
\??\c:\rrjdbbj.exec:\rrjdbbj.exe23⤵
- Executes dropped EXE
PID:3004 -
\??\c:\brbpfph.exec:\brbpfph.exe24⤵
- Executes dropped EXE
PID:916 -
\??\c:\vfvnvjn.exec:\vfvnvjn.exe25⤵
- Executes dropped EXE
PID:2128 -
\??\c:\tpdrdjp.exec:\tpdrdjp.exe26⤵
- Executes dropped EXE
PID:1808 -
\??\c:\fbjpn.exec:\fbjpn.exe27⤵
- Executes dropped EXE
PID:1564 -
\??\c:\pppjjjj.exec:\pppjjjj.exe28⤵
- Executes dropped EXE
PID:1888 -
\??\c:\dlfnjd.exec:\dlfnjd.exe29⤵
- Executes dropped EXE
PID:1832 -
\??\c:\vnbbx.exec:\vnbbx.exe30⤵
- Executes dropped EXE
PID:2820 -
\??\c:\xdhjnp.exec:\xdhjnp.exe31⤵
- Executes dropped EXE
PID:2768 -
\??\c:\nfbprvp.exec:\nfbprvp.exe32⤵
- Executes dropped EXE
PID:2868 -
\??\c:\ldjffjr.exec:\ldjffjr.exe33⤵
- Executes dropped EXE
PID:2400 -
\??\c:\lrnhx.exec:\lrnhx.exe34⤵
- Executes dropped EXE
PID:2364 -
\??\c:\bthlfvt.exec:\bthlfvt.exe35⤵
- Executes dropped EXE
PID:3012 -
\??\c:\bdfvxpl.exec:\bdfvxpl.exe36⤵
- Executes dropped EXE
PID:2504 -
\??\c:\rhjvn.exec:\rhjvn.exe37⤵
- Executes dropped EXE
PID:2700 -
\??\c:\fnhxhb.exec:\fnhxhb.exe38⤵
- Executes dropped EXE
PID:2628 -
\??\c:\tjbjhhn.exec:\tjbjhhn.exe39⤵
- Executes dropped EXE
PID:2684 -
\??\c:\hhbvdj.exec:\hhbvdj.exe40⤵
- Executes dropped EXE
PID:2688 -
\??\c:\fnptnb.exec:\fnptnb.exe41⤵
- Executes dropped EXE
PID:2616 -
\??\c:\dflpfb.exec:\dflpfb.exe42⤵
- Executes dropped EXE
PID:2540 -
\??\c:\jjxjjtn.exec:\jjxjjtn.exe43⤵
- Executes dropped EXE
PID:2468 -
\??\c:\brrvfbf.exec:\brrvfbf.exe44⤵
- Executes dropped EXE
PID:2828 -
\??\c:\xxxlbv.exec:\xxxlbv.exe45⤵
- Executes dropped EXE
PID:2488 -
\??\c:\rjfpfv.exec:\rjfpfv.exe46⤵
- Executes dropped EXE
PID:2840 -
\??\c:\xpnbrfv.exec:\xpnbrfv.exe47⤵
- Executes dropped EXE
PID:520 -
\??\c:\bnjjxpv.exec:\bnjjxpv.exe48⤵
- Executes dropped EXE
PID:572 -
\??\c:\tfxvrnh.exec:\tfxvrnh.exe49⤵
- Executes dropped EXE
PID:836 -
\??\c:\vrhhr.exec:\vrhhr.exe50⤵
- Executes dropped EXE
PID:2708 -
\??\c:\phxfhhb.exec:\phxfhhb.exe51⤵
- Executes dropped EXE
PID:2212 -
\??\c:\fnvhf.exec:\fnvhf.exe52⤵
- Executes dropped EXE
PID:2856 -
\??\c:\fltbdjx.exec:\fltbdjx.exe53⤵
- Executes dropped EXE
PID:1500 -
\??\c:\pjphft.exec:\pjphft.exe54⤵
- Executes dropped EXE
PID:2232 -
\??\c:\pjvrjvv.exec:\pjvrjvv.exe55⤵
- Executes dropped EXE
PID:1152 -
\??\c:\vrbxd.exec:\vrbxd.exe56⤵
- Executes dropped EXE
PID:1368 -
\??\c:\jjvfnnl.exec:\jjvfnnl.exe57⤵
- Executes dropped EXE
PID:1580 -
\??\c:\xjlxh.exec:\xjlxh.exe58⤵
- Executes dropped EXE
PID:2328 -
\??\c:\bdjvplv.exec:\bdjvplv.exe59⤵
- Executes dropped EXE
PID:2216 -
\??\c:\nffnnfj.exec:\nffnnfj.exe60⤵
- Executes dropped EXE
PID:2296 -
\??\c:\vdhpp.exec:\vdhpp.exe61⤵
- Executes dropped EXE
PID:596 -
\??\c:\rnvpjtb.exec:\rnvpjtb.exe62⤵
- Executes dropped EXE
PID:336 -
\??\c:\dhbhpdd.exec:\dhbhpdd.exe63⤵
- Executes dropped EXE
PID:1712 -
\??\c:\jpfnvb.exec:\jpfnvb.exe64⤵
- Executes dropped EXE
PID:276 -
\??\c:\vvdpv.exec:\vvdpv.exe65⤵
- Executes dropped EXE
PID:1688 -
\??\c:\hhxxp.exec:\hhxxp.exe66⤵PID:1540
-
\??\c:\bpdjndv.exec:\bpdjndv.exe67⤵PID:2044
-
\??\c:\lnrxdv.exec:\lnrxdv.exe68⤵PID:1604
-
\??\c:\jtrln.exec:\jtrln.exe69⤵PID:1840
-
\??\c:\fhjlfth.exec:\fhjlfth.exe70⤵PID:908
-
\??\c:\pjflpp.exec:\pjflpp.exe71⤵PID:1832
-
\??\c:\jbdhhfj.exec:\jbdhhfj.exe72⤵PID:968
-
\??\c:\fjxxdj.exec:\fjxxdj.exe73⤵PID:3036
-
\??\c:\bjrlrlp.exec:\bjrlrlp.exe74⤵PID:1760
-
\??\c:\ptjvxr.exec:\ptjvxr.exe75⤵PID:3056
-
\??\c:\hxnlhf.exec:\hxnlhf.exe76⤵PID:2336
-
\??\c:\ppjlr.exec:\ppjlr.exe77⤵PID:1776
-
\??\c:\bjvdhj.exec:\bjvdhj.exe78⤵PID:1588
-
\??\c:\rdtnl.exec:\rdtnl.exe79⤵PID:2352
-
\??\c:\hhjprv.exec:\hhjprv.exe80⤵PID:2984
-
\??\c:\tdxvjj.exec:\tdxvjj.exe81⤵PID:2636
-
\??\c:\bvlbjb.exec:\bvlbjb.exe82⤵PID:2764
-
\??\c:\nbjpb.exec:\nbjpb.exe83⤵PID:2660
-
\??\c:\dlxddh.exec:\dlxddh.exe84⤵PID:2756
-
\??\c:\vtppfbf.exec:\vtppfbf.exe85⤵PID:2600
-
\??\c:\jvxpn.exec:\jvxpn.exe86⤵PID:2560
-
\??\c:\dhbrh.exec:\dhbrh.exe87⤵PID:2420
-
\??\c:\xlvtx.exec:\xlvtx.exe88⤵PID:2068
-
\??\c:\htvhd.exec:\htvhd.exe89⤵PID:580
-
\??\c:\vjnvnr.exec:\vjnvnr.exe90⤵PID:2848
-
\??\c:\bhprb.exec:\bhprb.exe91⤵PID:3016
-
\??\c:\jxtjf.exec:\jxtjf.exe92⤵PID:2608
-
\??\c:\hxpbr.exec:\hxpbr.exe93⤵PID:2712
-
\??\c:\rjnnrx.exec:\rjnnrx.exe94⤵PID:2728
-
\??\c:\rnhfrv.exec:\rnhfrv.exe95⤵PID:2036
-
\??\c:\fftrf.exec:\fftrf.exe96⤵PID:1372
-
\??\c:\nrxdx.exec:\nrxdx.exe97⤵PID:2052
-
\??\c:\vndrp.exec:\vndrp.exe98⤵PID:2180
-
\??\c:\bhlfvx.exec:\bhlfvx.exe99⤵PID:852
-
\??\c:\ljxrpd.exec:\ljxrpd.exe100⤵PID:1692
-
\??\c:\lxrbr.exec:\lxrbr.exe101⤵PID:3032
-
\??\c:\blttj.exec:\blttj.exe102⤵PID:2280
-
\??\c:\ndfjb.exec:\ndfjb.exe103⤵PID:1780
-
\??\c:\blpbbdh.exec:\blpbbdh.exe104⤵PID:2928
-
\??\c:\tbjtlbn.exec:\tbjtlbn.exe105⤵PID:2904
-
\??\c:\bvblj.exec:\bvblj.exe106⤵PID:2188
-
\??\c:\tjvtpf.exec:\tjvtpf.exe107⤵PID:2372
-
\??\c:\bprlv.exec:\bprlv.exe108⤵PID:2316
-
\??\c:\ttllt.exec:\ttllt.exe109⤵PID:3060
-
\??\c:\xnfxft.exec:\xnfxft.exe110⤵PID:1296
-
\??\c:\vdrtpl.exec:\vdrtpl.exe111⤵PID:960
-
\??\c:\jjvvvbl.exec:\jjvvvbl.exe112⤵PID:1764
-
\??\c:\lxfrx.exec:\lxfrx.exe113⤵PID:980
-
\??\c:\njvtpb.exec:\njvtpb.exe114⤵PID:924
-
\??\c:\lhlrrn.exec:\lhlrrn.exe115⤵PID:2164
-
\??\c:\jjrblbb.exec:\jjrblbb.exe116⤵PID:1708
-
\??\c:\jrxxvh.exec:\jrxxvh.exe117⤵PID:2148
-
\??\c:\pbhbjj.exec:\pbhbjj.exe118⤵PID:2868
-
\??\c:\prdhx.exec:\prdhx.exe119⤵PID:2400
-
\??\c:\dvbrv.exec:\dvbrv.exe120⤵PID:484
-
\??\c:\tffjdl.exec:\tffjdl.exe121⤵PID:2364
-
\??\c:\trdtpvh.exec:\trdtpvh.exe122⤵PID:2864
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-