Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 02:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ae3455fac489b6042975ca6b3ec2eee0_NEIKI.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
ae3455fac489b6042975ca6b3ec2eee0_NEIKI.exe
-
Size
59KB
-
MD5
ae3455fac489b6042975ca6b3ec2eee0
-
SHA1
c9f142391df2a202da460897e7a1c08188f48bb4
-
SHA256
d22503964f19b9909bf9e42362a6c70ea13d37498720189cb81e75387f51b081
-
SHA512
e9dd0ff3305287ba1bf0229aa33e64737ae03959df98963392cd639ad0724e477794e4f468a2c48b151d5fe4e633963b260248f0c604f411b4927328aa239e13
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+j:ymb3NkkiQ3mdBjF0y7j
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2968-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1880-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/380-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1896-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/308-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/788-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1696-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/596-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1684-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/716-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-8327-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2996 9dpdj.exe 1880 xxxfxff.exe 2572 ddjpp.exe 2808 dvppp.exe 2448 9frxllr.exe 2424 nbnnnh.exe 3000 vpdvj.exe 2900 3jvdd.exe 2668 rxlfffl.exe 2760 rlfllrx.exe 1720 7thhnn.exe 2040 jjjvd.exe 380 jdpjj.exe 1896 7frflrr.exe 308 tntbhb.exe 788 nhnttb.exe 1696 djvvp.exe 1464 jpjdd.exe 1748 lrrlxlf.exe 2400 rlxrrlr.exe 596 5htnnt.exe 328 vpjdd.exe 1408 1pdvv.exe 1916 pjvvd.exe 1684 rllrfxf.exe 1744 5thbbb.exe 1908 htttbb.exe 716 9djjp.exe 2160 rlxxflx.exe 1656 lflrffr.exe 2200 nhthnn.exe 2292 btnbbb.exe 2612 vjvdd.exe 1516 dvvvp.exe 2640 frfxxrf.exe 2632 xrllrrl.exe 2580 9xrflrx.exe 2544 tnbhtb.exe 2728 nbntbb.exe 2432 7vdjp.exe 2440 vpjvv.exe 2424 lfrllfl.exe 2904 7lllrlr.exe 2892 7lxxxxr.exe 2764 tbhntb.exe 2792 vjvvd.exe 2776 dvdpd.exe 1360 frfllfl.exe 2044 ffrfxxr.exe 2304 3bhbtt.exe 1876 bnhnnn.exe 1356 thttnh.exe 1204 5pjpj.exe 1700 pjvdv.exe 2244 rfrxlrx.exe 2256 3frxllr.exe 1364 nhbbbt.exe 2404 7httbb.exe 604 pjvvv.exe 560 vjvdj.exe 808 pdvpp.exe 832 5xxxffr.exe 1136 tnbntb.exe 1448 nbnthh.exe -
resource yara_rule behavioral1/memory/2968-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1880-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1880-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1880-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/380-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1896-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/308-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/788-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/596-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1684-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/716-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-299-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-8327-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2968 wrote to memory of 2996 2968 ae3455fac489b6042975ca6b3ec2eee0_NEIKI.exe 28 PID 2968 wrote to memory of 2996 2968 ae3455fac489b6042975ca6b3ec2eee0_NEIKI.exe 28 PID 2968 wrote to memory of 2996 2968 ae3455fac489b6042975ca6b3ec2eee0_NEIKI.exe 28 PID 2968 wrote to memory of 2996 2968 ae3455fac489b6042975ca6b3ec2eee0_NEIKI.exe 28 PID 2996 wrote to memory of 1880 2996 9dpdj.exe 29 PID 2996 wrote to memory of 1880 2996 9dpdj.exe 29 PID 2996 wrote to memory of 1880 2996 9dpdj.exe 29 PID 2996 wrote to memory of 1880 2996 9dpdj.exe 29 PID 1880 wrote to memory of 2572 1880 xxxfxff.exe 30 PID 1880 wrote to memory of 2572 1880 xxxfxff.exe 30 PID 1880 wrote to memory of 2572 1880 xxxfxff.exe 30 PID 1880 wrote to memory of 2572 1880 xxxfxff.exe 30 PID 2572 wrote to memory of 2808 2572 ddjpp.exe 31 PID 2572 wrote to memory of 2808 2572 ddjpp.exe 31 PID 2572 wrote to memory of 2808 2572 ddjpp.exe 31 PID 2572 wrote to memory of 2808 2572 ddjpp.exe 31 PID 2808 wrote to memory of 2448 2808 dvppp.exe 32 PID 2808 wrote to memory of 2448 2808 dvppp.exe 32 PID 2808 wrote to memory of 2448 2808 dvppp.exe 32 PID 2808 wrote to memory of 2448 2808 dvppp.exe 32 PID 2448 wrote to memory of 2424 2448 9frxllr.exe 33 PID 2448 wrote to memory of 2424 2448 9frxllr.exe 33 PID 2448 wrote to memory of 2424 2448 9frxllr.exe 33 PID 2448 wrote to memory of 2424 2448 9frxllr.exe 33 PID 2424 wrote to memory of 3000 2424 nbnnnh.exe 34 PID 2424 wrote to memory of 3000 2424 nbnnnh.exe 34 PID 2424 wrote to memory of 3000 2424 nbnnnh.exe 34 PID 2424 wrote to memory of 3000 2424 nbnnnh.exe 34 PID 3000 wrote to memory of 2900 3000 vpdvj.exe 35 PID 3000 wrote to memory of 2900 3000 vpdvj.exe 35 PID 3000 wrote to memory of 2900 3000 vpdvj.exe 35 PID 3000 wrote to memory of 2900 3000 vpdvj.exe 35 PID 2900 wrote to memory of 2668 2900 3jvdd.exe 36 PID 2900 wrote to memory of 2668 2900 3jvdd.exe 36 PID 2900 wrote to memory of 2668 2900 3jvdd.exe 36 PID 2900 wrote to memory of 2668 2900 3jvdd.exe 36 PID 2668 wrote to memory of 2760 2668 rxlfffl.exe 37 PID 2668 wrote to memory of 2760 2668 rxlfffl.exe 37 PID 2668 wrote to memory of 2760 2668 rxlfffl.exe 37 PID 2668 wrote to memory of 2760 2668 rxlfffl.exe 37 PID 2760 wrote to memory of 1720 2760 rlfllrx.exe 38 PID 2760 wrote to memory of 1720 2760 rlfllrx.exe 38 PID 2760 wrote to memory of 1720 2760 rlfllrx.exe 38 PID 2760 wrote to memory of 1720 2760 rlfllrx.exe 38 PID 1720 wrote to memory of 2040 1720 7thhnn.exe 39 PID 1720 wrote to memory of 2040 1720 7thhnn.exe 39 PID 1720 wrote to memory of 2040 1720 7thhnn.exe 39 PID 1720 wrote to memory of 2040 1720 7thhnn.exe 39 PID 2040 wrote to memory of 380 2040 jjjvd.exe 40 PID 2040 wrote to memory of 380 2040 jjjvd.exe 40 PID 2040 wrote to memory of 380 2040 jjjvd.exe 40 PID 2040 wrote to memory of 380 2040 jjjvd.exe 40 PID 380 wrote to memory of 1896 380 jdpjj.exe 41 PID 380 wrote to memory of 1896 380 jdpjj.exe 41 PID 380 wrote to memory of 1896 380 jdpjj.exe 41 PID 380 wrote to memory of 1896 380 jdpjj.exe 41 PID 1896 wrote to memory of 308 1896 7frflrr.exe 42 PID 1896 wrote to memory of 308 1896 7frflrr.exe 42 PID 1896 wrote to memory of 308 1896 7frflrr.exe 42 PID 1896 wrote to memory of 308 1896 7frflrr.exe 42 PID 308 wrote to memory of 788 308 tntbhb.exe 43 PID 308 wrote to memory of 788 308 tntbhb.exe 43 PID 308 wrote to memory of 788 308 tntbhb.exe 43 PID 308 wrote to memory of 788 308 tntbhb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae3455fac489b6042975ca6b3ec2eee0_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\ae3455fac489b6042975ca6b3ec2eee0_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\9dpdj.exec:\9dpdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\xxxfxff.exec:\xxxfxff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\ddjpp.exec:\ddjpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\dvppp.exec:\dvppp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\9frxllr.exec:\9frxllr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\nbnnnh.exec:\nbnnnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\vpdvj.exec:\vpdvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\3jvdd.exec:\3jvdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\rxlfffl.exec:\rxlfffl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\rlfllrx.exec:\rlfllrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\7thhnn.exec:\7thhnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\jjjvd.exec:\jjjvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\jdpjj.exec:\jdpjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\7frflrr.exec:\7frflrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\tntbhb.exec:\tntbhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:308 -
\??\c:\nhnttb.exec:\nhnttb.exe17⤵
- Executes dropped EXE
PID:788 -
\??\c:\djvvp.exec:\djvvp.exe18⤵
- Executes dropped EXE
PID:1696 -
\??\c:\jpjdd.exec:\jpjdd.exe19⤵
- Executes dropped EXE
PID:1464 -
\??\c:\lrrlxlf.exec:\lrrlxlf.exe20⤵
- Executes dropped EXE
PID:1748 -
\??\c:\rlxrrlr.exec:\rlxrrlr.exe21⤵
- Executes dropped EXE
PID:2400 -
\??\c:\5htnnt.exec:\5htnnt.exe22⤵
- Executes dropped EXE
PID:596 -
\??\c:\vpjdd.exec:\vpjdd.exe23⤵
- Executes dropped EXE
PID:328 -
\??\c:\1pdvv.exec:\1pdvv.exe24⤵
- Executes dropped EXE
PID:1408 -
\??\c:\pjvvd.exec:\pjvvd.exe25⤵
- Executes dropped EXE
PID:1916 -
\??\c:\rllrfxf.exec:\rllrfxf.exe26⤵
- Executes dropped EXE
PID:1684 -
\??\c:\5thbbb.exec:\5thbbb.exe27⤵
- Executes dropped EXE
PID:1744 -
\??\c:\htttbb.exec:\htttbb.exe28⤵
- Executes dropped EXE
PID:1908 -
\??\c:\9djjp.exec:\9djjp.exe29⤵
- Executes dropped EXE
PID:716 -
\??\c:\rlxxflx.exec:\rlxxflx.exe30⤵
- Executes dropped EXE
PID:2160 -
\??\c:\lflrffr.exec:\lflrffr.exe31⤵
- Executes dropped EXE
PID:1656 -
\??\c:\nhthnn.exec:\nhthnn.exe32⤵
- Executes dropped EXE
PID:2200 -
\??\c:\btnbbb.exec:\btnbbb.exe33⤵
- Executes dropped EXE
PID:2292 -
\??\c:\vjvdd.exec:\vjvdd.exe34⤵
- Executes dropped EXE
PID:2612 -
\??\c:\dvvvp.exec:\dvvvp.exe35⤵
- Executes dropped EXE
PID:1516 -
\??\c:\frfxxrf.exec:\frfxxrf.exe36⤵
- Executes dropped EXE
PID:2640 -
\??\c:\xrllrrl.exec:\xrllrrl.exe37⤵
- Executes dropped EXE
PID:2632 -
\??\c:\9xrflrx.exec:\9xrflrx.exe38⤵
- Executes dropped EXE
PID:2580 -
\??\c:\tnbhtb.exec:\tnbhtb.exe39⤵
- Executes dropped EXE
PID:2544 -
\??\c:\nbntbb.exec:\nbntbb.exe40⤵
- Executes dropped EXE
PID:2728 -
\??\c:\7vdjp.exec:\7vdjp.exe41⤵
- Executes dropped EXE
PID:2432 -
\??\c:\vpjvv.exec:\vpjvv.exe42⤵
- Executes dropped EXE
PID:2440 -
\??\c:\lfrllfl.exec:\lfrllfl.exe43⤵
- Executes dropped EXE
PID:2424 -
\??\c:\7lllrlr.exec:\7lllrlr.exe44⤵
- Executes dropped EXE
PID:2904 -
\??\c:\7lxxxxr.exec:\7lxxxxr.exe45⤵
- Executes dropped EXE
PID:2892 -
\??\c:\tbhntb.exec:\tbhntb.exe46⤵
- Executes dropped EXE
PID:2764 -
\??\c:\vjvvd.exec:\vjvvd.exe47⤵
- Executes dropped EXE
PID:2792 -
\??\c:\dvdpd.exec:\dvdpd.exe48⤵
- Executes dropped EXE
PID:2776 -
\??\c:\frfllfl.exec:\frfllfl.exe49⤵
- Executes dropped EXE
PID:1360 -
\??\c:\ffrfxxr.exec:\ffrfxxr.exe50⤵
- Executes dropped EXE
PID:2044 -
\??\c:\3bhbtt.exec:\3bhbtt.exe51⤵
- Executes dropped EXE
PID:2304 -
\??\c:\bnhnnn.exec:\bnhnnn.exe52⤵
- Executes dropped EXE
PID:1876 -
\??\c:\thttnh.exec:\thttnh.exe53⤵
- Executes dropped EXE
PID:1356 -
\??\c:\5pjpj.exec:\5pjpj.exe54⤵
- Executes dropped EXE
PID:1204 -
\??\c:\pjvdv.exec:\pjvdv.exe55⤵
- Executes dropped EXE
PID:1700 -
\??\c:\rfrxlrx.exec:\rfrxlrx.exe56⤵
- Executes dropped EXE
PID:2244 -
\??\c:\3frxllr.exec:\3frxllr.exe57⤵
- Executes dropped EXE
PID:2256 -
\??\c:\nhbbbt.exec:\nhbbbt.exe58⤵
- Executes dropped EXE
PID:1364 -
\??\c:\7httbb.exec:\7httbb.exe59⤵
- Executes dropped EXE
PID:2404 -
\??\c:\pjvvv.exec:\pjvvv.exe60⤵
- Executes dropped EXE
PID:604 -
\??\c:\vjvdj.exec:\vjvdj.exe61⤵
- Executes dropped EXE
PID:560 -
\??\c:\pdvpp.exec:\pdvpp.exe62⤵
- Executes dropped EXE
PID:808 -
\??\c:\5xxxffr.exec:\5xxxffr.exe63⤵
- Executes dropped EXE
PID:832 -
\??\c:\tnbntb.exec:\tnbntb.exe64⤵
- Executes dropped EXE
PID:1136 -
\??\c:\nbnthh.exec:\nbnthh.exe65⤵
- Executes dropped EXE
PID:1448 -
\??\c:\3pppv.exec:\3pppv.exe66⤵PID:1996
-
\??\c:\rrrxrfx.exec:\rrrxrfx.exe67⤵PID:856
-
\??\c:\rlrxflx.exec:\rlrxflx.exe68⤵PID:952
-
\??\c:\tnhnbh.exec:\tnhnbh.exe69⤵PID:1908
-
\??\c:\5bnntn.exec:\5bnntn.exe70⤵PID:716
-
\??\c:\jdvvv.exec:\jdvvv.exe71⤵PID:2160
-
\??\c:\jjdjp.exec:\jjdjp.exe72⤵PID:1216
-
\??\c:\xlxrlrr.exec:\xlxrlrr.exe73⤵PID:1984
-
\??\c:\frlrflr.exec:\frlrflr.exe74⤵PID:1232
-
\??\c:\9rffxlf.exec:\9rffxlf.exe75⤵PID:2292
-
\??\c:\nhbtbn.exec:\nhbtbn.exe76⤵PID:2996
-
\??\c:\nhtttn.exec:\nhtttn.exe77⤵PID:2644
-
\??\c:\5dppv.exec:\5dppv.exe78⤵PID:2656
-
\??\c:\9ddvv.exec:\9ddvv.exe79⤵PID:2536
-
\??\c:\1xllxxf.exec:\1xllxxf.exe80⤵PID:2576
-
\??\c:\xrllxrx.exec:\xrllxrx.exe81⤵PID:2688
-
\??\c:\htthnn.exec:\htthnn.exe82⤵PID:2672
-
\??\c:\1tnntt.exec:\1tnntt.exe83⤵PID:2756
-
\??\c:\5dddd.exec:\5dddd.exe84⤵PID:2336
-
\??\c:\3ddvv.exec:\3ddvv.exe85⤵PID:2492
-
\??\c:\rlxxlrf.exec:\rlxxlrf.exe86⤵PID:2468
-
\??\c:\fxfxflx.exec:\fxfxflx.exe87⤵PID:2900
-
\??\c:\fxffxxf.exec:\fxffxxf.exe88⤵PID:2788
-
\??\c:\nnbhht.exec:\nnbhht.exe89⤵PID:2920
-
\??\c:\hbnhhh.exec:\hbnhhh.exe90⤵PID:1116
-
\??\c:\btnbbb.exec:\btnbbb.exe91⤵PID:1868
-
\??\c:\1vvvd.exec:\1vvvd.exe92⤵PID:1760
-
\??\c:\jdjpj.exec:\jdjpj.exe93⤵PID:892
-
\??\c:\9rxfllf.exec:\9rxfllf.exe94⤵PID:288
-
\??\c:\xxfxxlr.exec:\xxfxxlr.exe95⤵PID:2488
-
\??\c:\hnnnbn.exec:\hnnnbn.exe96⤵PID:280
-
\??\c:\hbhhnt.exec:\hbhhnt.exe97⤵PID:2940
-
\??\c:\7jdjj.exec:\7jdjj.exe98⤵PID:3040
-
\??\c:\pjvdp.exec:\pjvdp.exe99⤵PID:2116
-
\??\c:\rxrrfxf.exec:\rxrrfxf.exe100⤵PID:2828
-
\??\c:\xxllfrx.exec:\xxllfrx.exe101⤵PID:2832
-
\??\c:\9bntbb.exec:\9bntbb.exe102⤵PID:336
-
\??\c:\hhtbnt.exec:\hhtbnt.exe103⤵PID:592
-
\??\c:\pjvjv.exec:\pjvjv.exe104⤵PID:2936
-
\??\c:\dvpvj.exec:\dvpvj.exe105⤵PID:1180
-
\??\c:\fxxflrx.exec:\fxxflrx.exe106⤵PID:1020
-
\??\c:\xlrrxrf.exec:\xlrrxrf.exe107⤵PID:452
-
\??\c:\tnbnth.exec:\tnbnth.exe108⤵PID:1920
-
\??\c:\5tnthh.exec:\5tnthh.exe109⤵PID:1648
-
\??\c:\hbhnnn.exec:\hbhnnn.exe110⤵PID:3012
-
\??\c:\vpdjj.exec:\vpdjj.exe111⤵PID:2004
-
\??\c:\pdvvv.exec:\pdvvv.exe112⤵PID:1724
-
\??\c:\3xxflll.exec:\3xxflll.exe113⤵PID:864
-
\??\c:\fxrfrrf.exec:\fxrfrrf.exe114⤵PID:1656
-
\??\c:\hbhnnt.exec:\hbhnnt.exe115⤵PID:916
-
\??\c:\hbtbhh.exec:\hbtbhh.exe116⤵PID:2068
-
\??\c:\nhnhnb.exec:\nhnhnb.exe117⤵PID:2908
-
\??\c:\dvjjv.exec:\dvjjv.exe118⤵PID:2628
-
\??\c:\9ddpv.exec:\9ddpv.exe119⤵PID:2660
-
\??\c:\9rfllll.exec:\9rfllll.exe120⤵PID:3008
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe121⤵PID:2812
-
\??\c:\ffrfllr.exec:\ffrfllr.exe122⤵PID:2732
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-