Analysis
-
max time kernel
151s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
31/05/2024, 22:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
832fa94d0295471aa27c9de0920dcad0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
832fa94d0295471aa27c9de0920dcad0_NeikiAnalytics.exe
-
Size
71KB
-
MD5
832fa94d0295471aa27c9de0920dcad0
-
SHA1
14f22152dd6f12d8976efb957cccd61f030c09da
-
SHA256
be7fc41357a7cce1659f787a9d17bac9a5a7290eaca2d3b779fa1ee9947445d6
-
SHA512
c499a68a8780d97b042b222322d176efb8460007829d703d4e31df749fee2f8fcda53ab3a8e9bfb4b51e3f16a8bb3b6208f5585dcb0582b759164c5ebc6976dd
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb7GTi3ldf:ymb3NkkiQ3mdBjFIWY1
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/1776-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1328-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1204-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1288-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1276-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1964-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/704-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/884-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1868-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1044-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1840-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1768-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-305-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1328 phjbjb.exe 1204 nrbpnhr.exe 1288 blpvtn.exe 1276 drvrpn.exe 1964 pjxjlbd.exe 704 hrtjt.exe 884 jlhbpd.exe 2408 nhphbfb.exe 2596 tbvrfrj.exe 2480 njlnj.exe 2552 dfjnt.exe 2528 bfhtdjj.exe 2856 bnbjtvt.exe 2680 dfrllbd.exe 1868 vtpxh.exe 1828 jjbjnbb.exe 1780 nnftlb.exe 2908 xhlvjtr.exe 3012 rdbll.exe 3060 vbvjpf.exe 1512 nrndbn.exe 908 vbhph.exe 2816 fbhlnrl.exe 1044 rtplhrp.exe 632 brdfp.exe 2084 xfbhjl.exe 2844 ffhfdln.exe 1840 bnhtnx.exe 2120 jljbdr.exe 1768 vlbpj.exe 2128 vpjtdnr.exe 2300 lhljjrf.exe 1036 vpnvn.exe 1988 frnxjvb.exe 1692 plxvdfj.exe 1268 dxpxj.exe 1980 rvttlh.exe 948 fpvxv.exe 1236 rbfrbf.exe 2176 jthtvfl.exe 1164 xdfxpb.exe 1168 brrdb.exe 2412 dxhfj.exe 1844 jvvxn.exe 2660 lplvp.exe 1676 jftbv.exe 1100 nbrbfv.exe 2396 dxfrtrn.exe 2552 ffxvf.exe 2544 jlptv.exe 2656 fvllvdx.exe 2852 jpbtldp.exe 2680 hbxbtv.exe 1824 bljbdn.exe 2944 bxndn.exe 2928 rxtlfj.exe 3024 npthd.exe 1648 hpnhrxx.exe 2976 blvvfx.exe 984 hljhvbv.exe 864 ftdxflt.exe 308 fdlhl.exe 796 ljpjd.exe 1528 xttxjd.exe -
resource yara_rule behavioral1/memory/1776-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1328-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1204-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1288-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1276-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1964-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1964-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1964-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1964-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/704-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/884-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/884-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/884-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1868-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1044-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1840-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1768-296-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-305-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1776 wrote to memory of 1328 1776 832fa94d0295471aa27c9de0920dcad0_NeikiAnalytics.exe 30 PID 1776 wrote to memory of 1328 1776 832fa94d0295471aa27c9de0920dcad0_NeikiAnalytics.exe 30 PID 1776 wrote to memory of 1328 1776 832fa94d0295471aa27c9de0920dcad0_NeikiAnalytics.exe 30 PID 1776 wrote to memory of 1328 1776 832fa94d0295471aa27c9de0920dcad0_NeikiAnalytics.exe 30 PID 1328 wrote to memory of 1204 1328 phjbjb.exe 31 PID 1328 wrote to memory of 1204 1328 phjbjb.exe 31 PID 1328 wrote to memory of 1204 1328 phjbjb.exe 31 PID 1328 wrote to memory of 1204 1328 phjbjb.exe 31 PID 1204 wrote to memory of 1288 1204 nrbpnhr.exe 32 PID 1204 wrote to memory of 1288 1204 nrbpnhr.exe 32 PID 1204 wrote to memory of 1288 1204 nrbpnhr.exe 32 PID 1204 wrote to memory of 1288 1204 nrbpnhr.exe 32 PID 1288 wrote to memory of 1276 1288 blpvtn.exe 33 PID 1288 wrote to memory of 1276 1288 blpvtn.exe 33 PID 1288 wrote to memory of 1276 1288 blpvtn.exe 33 PID 1288 wrote to memory of 1276 1288 blpvtn.exe 33 PID 1276 wrote to memory of 1964 1276 drvrpn.exe 34 PID 1276 wrote to memory of 1964 1276 drvrpn.exe 34 PID 1276 wrote to memory of 1964 1276 drvrpn.exe 34 PID 1276 wrote to memory of 1964 1276 drvrpn.exe 34 PID 1964 wrote to memory of 704 1964 pjxjlbd.exe 35 PID 1964 wrote to memory of 704 1964 pjxjlbd.exe 35 PID 1964 wrote to memory of 704 1964 pjxjlbd.exe 35 PID 1964 wrote to memory of 704 1964 pjxjlbd.exe 35 PID 704 wrote to memory of 884 704 hrtjt.exe 36 PID 704 wrote to memory of 884 704 hrtjt.exe 36 PID 704 wrote to memory of 884 704 hrtjt.exe 36 PID 704 wrote to memory of 884 704 hrtjt.exe 36 PID 884 wrote to memory of 2408 884 jlhbpd.exe 37 PID 884 wrote to memory of 2408 884 jlhbpd.exe 37 PID 884 wrote to memory of 2408 884 jlhbpd.exe 37 PID 884 wrote to memory of 2408 884 jlhbpd.exe 37 PID 2408 wrote to memory of 2596 2408 nhphbfb.exe 38 PID 2408 wrote to memory of 2596 2408 nhphbfb.exe 38 PID 2408 wrote to memory of 2596 2408 nhphbfb.exe 38 PID 2408 wrote to memory of 2596 2408 nhphbfb.exe 38 PID 2596 wrote to memory of 2480 2596 tbvrfrj.exe 39 PID 2596 wrote to memory of 2480 2596 tbvrfrj.exe 39 PID 2596 wrote to memory of 2480 2596 tbvrfrj.exe 39 PID 2596 wrote to memory of 2480 2596 tbvrfrj.exe 39 PID 2480 wrote to memory of 2552 2480 njlnj.exe 40 PID 2480 wrote to memory of 2552 2480 njlnj.exe 40 PID 2480 wrote to memory of 2552 2480 njlnj.exe 40 PID 2480 wrote to memory of 2552 2480 njlnj.exe 40 PID 2552 wrote to memory of 2528 2552 dfjnt.exe 41 PID 2552 wrote to memory of 2528 2552 dfjnt.exe 41 PID 2552 wrote to memory of 2528 2552 dfjnt.exe 41 PID 2552 wrote to memory of 2528 2552 dfjnt.exe 41 PID 2528 wrote to memory of 2856 2528 bfhtdjj.exe 42 PID 2528 wrote to memory of 2856 2528 bfhtdjj.exe 42 PID 2528 wrote to memory of 2856 2528 bfhtdjj.exe 42 PID 2528 wrote to memory of 2856 2528 bfhtdjj.exe 42 PID 2856 wrote to memory of 2680 2856 bnbjtvt.exe 43 PID 2856 wrote to memory of 2680 2856 bnbjtvt.exe 43 PID 2856 wrote to memory of 2680 2856 bnbjtvt.exe 43 PID 2856 wrote to memory of 2680 2856 bnbjtvt.exe 43 PID 2680 wrote to memory of 1868 2680 dfrllbd.exe 44 PID 2680 wrote to memory of 1868 2680 dfrllbd.exe 44 PID 2680 wrote to memory of 1868 2680 dfrllbd.exe 44 PID 2680 wrote to memory of 1868 2680 dfrllbd.exe 44 PID 1868 wrote to memory of 1828 1868 vtpxh.exe 45 PID 1868 wrote to memory of 1828 1868 vtpxh.exe 45 PID 1868 wrote to memory of 1828 1868 vtpxh.exe 45 PID 1868 wrote to memory of 1828 1868 vtpxh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\832fa94d0295471aa27c9de0920dcad0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\832fa94d0295471aa27c9de0920dcad0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\phjbjb.exec:\phjbjb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\nrbpnhr.exec:\nrbpnhr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\blpvtn.exec:\blpvtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\drvrpn.exec:\drvrpn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\pjxjlbd.exec:\pjxjlbd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\hrtjt.exec:\hrtjt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
\??\c:\jlhbpd.exec:\jlhbpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\nhphbfb.exec:\nhphbfb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\tbvrfrj.exec:\tbvrfrj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\njlnj.exec:\njlnj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\dfjnt.exec:\dfjnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\bfhtdjj.exec:\bfhtdjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\bnbjtvt.exec:\bnbjtvt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\dfrllbd.exec:\dfrllbd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\vtpxh.exec:\vtpxh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\jjbjnbb.exec:\jjbjnbb.exe17⤵
- Executes dropped EXE
PID:1828 -
\??\c:\nnftlb.exec:\nnftlb.exe18⤵
- Executes dropped EXE
PID:1780 -
\??\c:\xhlvjtr.exec:\xhlvjtr.exe19⤵
- Executes dropped EXE
PID:2908 -
\??\c:\rdbll.exec:\rdbll.exe20⤵
- Executes dropped EXE
PID:3012 -
\??\c:\vbvjpf.exec:\vbvjpf.exe21⤵
- Executes dropped EXE
PID:3060 -
\??\c:\nrndbn.exec:\nrndbn.exe22⤵
- Executes dropped EXE
PID:1512 -
\??\c:\vbhph.exec:\vbhph.exe23⤵
- Executes dropped EXE
PID:908 -
\??\c:\fbhlnrl.exec:\fbhlnrl.exe24⤵
- Executes dropped EXE
PID:2816 -
\??\c:\rtplhrp.exec:\rtplhrp.exe25⤵
- Executes dropped EXE
PID:1044 -
\??\c:\brdfp.exec:\brdfp.exe26⤵
- Executes dropped EXE
PID:632 -
\??\c:\xfbhjl.exec:\xfbhjl.exe27⤵
- Executes dropped EXE
PID:2084 -
\??\c:\ffhfdln.exec:\ffhfdln.exe28⤵
- Executes dropped EXE
PID:2844 -
\??\c:\bnhtnx.exec:\bnhtnx.exe29⤵
- Executes dropped EXE
PID:1840 -
\??\c:\jljbdr.exec:\jljbdr.exe30⤵
- Executes dropped EXE
PID:2120 -
\??\c:\vlbpj.exec:\vlbpj.exe31⤵
- Executes dropped EXE
PID:1768 -
\??\c:\vpjtdnr.exec:\vpjtdnr.exe32⤵
- Executes dropped EXE
PID:2128 -
\??\c:\lhljjrf.exec:\lhljjrf.exe33⤵
- Executes dropped EXE
PID:2300 -
\??\c:\vpnvn.exec:\vpnvn.exe34⤵
- Executes dropped EXE
PID:1036 -
\??\c:\frnxjvb.exec:\frnxjvb.exe35⤵
- Executes dropped EXE
PID:1988 -
\??\c:\plxvdfj.exec:\plxvdfj.exe36⤵
- Executes dropped EXE
PID:1692 -
\??\c:\dxpxj.exec:\dxpxj.exe37⤵
- Executes dropped EXE
PID:1268 -
\??\c:\rvttlh.exec:\rvttlh.exe38⤵
- Executes dropped EXE
PID:1980 -
\??\c:\fpvxv.exec:\fpvxv.exe39⤵
- Executes dropped EXE
PID:948 -
\??\c:\rbfrbf.exec:\rbfrbf.exe40⤵
- Executes dropped EXE
PID:1236 -
\??\c:\jthtvfl.exec:\jthtvfl.exe41⤵
- Executes dropped EXE
PID:2176 -
\??\c:\xdfxpb.exec:\xdfxpb.exe42⤵
- Executes dropped EXE
PID:1164 -
\??\c:\brrdb.exec:\brrdb.exe43⤵
- Executes dropped EXE
PID:1168 -
\??\c:\dxhfj.exec:\dxhfj.exe44⤵
- Executes dropped EXE
PID:2412 -
\??\c:\jvvxn.exec:\jvvxn.exe45⤵
- Executes dropped EXE
PID:1844 -
\??\c:\lplvp.exec:\lplvp.exe46⤵
- Executes dropped EXE
PID:2660 -
\??\c:\jftbv.exec:\jftbv.exe47⤵
- Executes dropped EXE
PID:1676 -
\??\c:\nbrbfv.exec:\nbrbfv.exe48⤵
- Executes dropped EXE
PID:1100 -
\??\c:\dxfrtrn.exec:\dxfrtrn.exe49⤵
- Executes dropped EXE
PID:2396 -
\??\c:\ffxvf.exec:\ffxvf.exe50⤵
- Executes dropped EXE
PID:2552 -
\??\c:\jlptv.exec:\jlptv.exe51⤵
- Executes dropped EXE
PID:2544 -
\??\c:\fvllvdx.exec:\fvllvdx.exe52⤵
- Executes dropped EXE
PID:2656 -
\??\c:\jpbtldp.exec:\jpbtldp.exe53⤵
- Executes dropped EXE
PID:2852 -
\??\c:\hbxbtv.exec:\hbxbtv.exe54⤵
- Executes dropped EXE
PID:2680 -
\??\c:\bljbdn.exec:\bljbdn.exe55⤵
- Executes dropped EXE
PID:1824 -
\??\c:\bxndn.exec:\bxndn.exe56⤵
- Executes dropped EXE
PID:2944 -
\??\c:\rxtlfj.exec:\rxtlfj.exe57⤵
- Executes dropped EXE
PID:2928 -
\??\c:\npthd.exec:\npthd.exe58⤵
- Executes dropped EXE
PID:3024 -
\??\c:\hpnhrxx.exec:\hpnhrxx.exe59⤵
- Executes dropped EXE
PID:1648 -
\??\c:\blvvfx.exec:\blvvfx.exe60⤵
- Executes dropped EXE
PID:2976 -
\??\c:\hljhvbv.exec:\hljhvbv.exe61⤵
- Executes dropped EXE
PID:984 -
\??\c:\ftdxflt.exec:\ftdxflt.exe62⤵
- Executes dropped EXE
PID:864 -
\??\c:\fdlhl.exec:\fdlhl.exe63⤵
- Executes dropped EXE
PID:308 -
\??\c:\ljpjd.exec:\ljpjd.exe64⤵
- Executes dropped EXE
PID:796 -
\??\c:\xttxjd.exec:\xttxjd.exe65⤵
- Executes dropped EXE
PID:1528 -
\??\c:\rthbdd.exec:\rthbdd.exe66⤵PID:2440
-
\??\c:\pnnfht.exec:\pnnfht.exe67⤵PID:632
-
\??\c:\pvhtr.exec:\pvhtr.exe68⤵PID:2776
-
\??\c:\hxtnf.exec:\hxtnf.exe69⤵PID:1784
-
\??\c:\tjxxprn.exec:\tjxxprn.exe70⤵PID:640
-
\??\c:\rlhlxbh.exec:\rlhlxbh.exe71⤵PID:2288
-
\??\c:\fdhjxjn.exec:\fdhjxjn.exe72⤵PID:892
-
\??\c:\ttdvb.exec:\ttdvb.exe73⤵PID:1768
-
\??\c:\dtrnn.exec:\dtrnn.exe74⤵PID:988
-
\??\c:\fndrh.exec:\fndrh.exe75⤵PID:2360
-
\??\c:\nvtlbj.exec:\nvtlbj.exe76⤵PID:1208
-
\??\c:\hvhpnpl.exec:\hvhpnpl.exe77⤵PID:1316
-
\??\c:\vlpxfb.exec:\vlpxfb.exe78⤵PID:1396
-
\??\c:\fjbpx.exec:\fjbpx.exe79⤵PID:1976
-
\??\c:\rhxdxd.exec:\rhxdxd.exe80⤵PID:1272
-
\??\c:\hjffr.exec:\hjffr.exe81⤵PID:2244
-
\??\c:\pdjbrj.exec:\pdjbrj.exe82⤵PID:1320
-
\??\c:\nvpfdv.exec:\nvpfdv.exe83⤵PID:2008
-
\??\c:\hrvlhjp.exec:\hrvlhjp.exe84⤵PID:1388
-
\??\c:\nvjbb.exec:\nvjbb.exe85⤵PID:1736
-
\??\c:\lbjfbrn.exec:\lbjfbrn.exe86⤵PID:840
-
\??\c:\vbxvx.exec:\vbxvx.exe87⤵PID:920
-
\??\c:\vrjbpr.exec:\vrjbpr.exe88⤵PID:2488
-
\??\c:\txpjn.exec:\txpjn.exe89⤵PID:2572
-
\??\c:\prfxf.exec:\prfxf.exe90⤵PID:2468
-
\??\c:\ftdhrpv.exec:\ftdhrpv.exe91⤵PID:1332
-
\??\c:\bbvbrjl.exec:\bbvbrjl.exe92⤵PID:2704
-
\??\c:\hfttrx.exec:\hfttrx.exe93⤵PID:2632
-
\??\c:\vpvrpjv.exec:\vpvrpjv.exe94⤵PID:2528
-
\??\c:\nfjxrvf.exec:\nfjxrvf.exe95⤵PID:2836
-
\??\c:\xtphpb.exec:\xtphpb.exe96⤵PID:2684
-
\??\c:\xjrrxf.exec:\xjrrxf.exe97⤵PID:2860
-
\??\c:\fpdhnvb.exec:\fpdhnvb.exe98⤵PID:1944
-
\??\c:\fnxnv.exec:\fnxnv.exe99⤵PID:2900
-
\??\c:\pxljb.exec:\pxljb.exe100⤵PID:2924
-
\??\c:\ltbnlp.exec:\ltbnlp.exe101⤵PID:2988
-
\??\c:\pxbdhj.exec:\pxbdhj.exe102⤵PID:3008
-
\??\c:\jjxbvr.exec:\jjxbvr.exe103⤵PID:1648
-
\??\c:\vvvrjxj.exec:\vvvrjxj.exe104⤵PID:2992
-
\??\c:\pjvvvdd.exec:\pjvvvdd.exe105⤵PID:1372
-
\??\c:\xpxjx.exec:\xpxjx.exe106⤵PID:2956
-
\??\c:\xnfjbxd.exec:\xnfjbxd.exe107⤵PID:308
-
\??\c:\prrvrjv.exec:\prrvrjv.exe108⤵PID:2160
-
\??\c:\dvhjd.exec:\dvhjd.exe109⤵PID:1432
-
\??\c:\fxrnfv.exec:\fxrnfv.exe110⤵PID:2440
-
\??\c:\jlbpd.exec:\jlbpd.exe111⤵PID:1660
-
\??\c:\nvrnnl.exec:\nvrnnl.exe112⤵PID:2844
-
\??\c:\hrpnhn.exec:\hrpnhn.exe113⤵PID:1784
-
\??\c:\vpbtr.exec:\vpbtr.exe114⤵PID:2140
-
\??\c:\thrxp.exec:\thrxp.exe115⤵PID:2144
-
\??\c:\rpvxblh.exec:\rpvxblh.exe116⤵PID:952
-
\??\c:\npnldpn.exec:\npnldpn.exe117⤵PID:2096
-
\??\c:\fjtfft.exec:\fjtfft.exe118⤵PID:1776
-
\??\c:\rlhlhjr.exec:\rlhlhjr.exe119⤵PID:2364
-
\??\c:\xlvvnt.exec:\xlvvnt.exe120⤵PID:1588
-
\??\c:\frbdtv.exec:\frbdtv.exe121⤵PID:1204
-
\??\c:\pxtrdbr.exec:\pxtrdbr.exe122⤵PID:1968
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-