Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
08-05-2024 02:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a12074f8e97a865af036978b96d2a5a0_NEIKI.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
a12074f8e97a865af036978b96d2a5a0_NEIKI.exe
-
Size
73KB
-
MD5
a12074f8e97a865af036978b96d2a5a0
-
SHA1
3d9203d641333c995eb23f0dcb702ce715edf16e
-
SHA256
b043b00b525f363755f1a6e5d98ddef8e01156cbf1c88b76072c65b772db42c2
-
SHA512
7023104acc6bd05acf174e4a6542c49b05f799ee37ea1ef360a20e472ae490a98bb42cfb4b65ffd8ff01f0dc4226e140d37108a10e243b4dbec64165be5b0364
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIjaQkPcy8WTeAw4Pt:ymb3NkkiQ3mdBjFIpkPcy8qs4Pt
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral1/memory/2236-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2236-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2108-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-79-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2464-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1500-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2364-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1312-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1116-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/840-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2092-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2284-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2304-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1432-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/792-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/684-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3020-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2320-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1932-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2108 tnbhnh.exe 3028 rlxxlrx.exe 2716 nnbbnt.exe 2460 bhhttn.exe 1936 vpjpd.exe 2620 xrfrxxl.exe 2464 xlflrxf.exe 2952 nnhhth.exe 1596 pjvvj.exe 2700 fflrfrf.exe 2764 xlxfrxf.exe 2340 5bnntt.exe 1500 jdppv.exe 2364 7ddpj.exe 1312 rlxxflx.exe 1116 tntthh.exe 840 9pddp.exe 2092 jvppv.exe 2932 fxflrxl.exe 2284 tnbbnn.exe 2304 tthtbn.exe 2892 vdjvp.exe 948 lxllxxx.exe 1720 llllffr.exe 1432 hbbhtb.exe 792 jjpvj.exe 684 xrffrrx.exe 3020 fflfxrl.exe 1680 nhbhbh.exe 2320 7jppd.exe 1932 vvpdj.exe 1208 lrxrrll.exe 1988 hbhntn.exe 2636 jdjjp.exe 2264 pjdjp.exe 2584 xrrxffl.exe 3056 fxrrxxl.exe 2876 bbtbhh.exe 2752 tntbbh.exe 2544 5jdjj.exe 1936 5ddpd.exe 2472 rfxfffl.exe 2528 xxflxfr.exe 2968 ttbbtt.exe 1120 3hhthh.exe 2684 jdpvj.exe 2756 pdvvv.exe 1340 rrlrxxl.exe 1768 xrlxfrx.exe 2340 tnbnth.exe 1452 nntthh.exe 1504 7nhhbb.exe 616 dvjjp.exe 2380 jdvjp.exe 1236 1flrffr.exe 2964 rlrrffr.exe 2180 hbnthh.exe 2208 1hthhn.exe 1728 5tnbnn.exe 320 5pjjv.exe 488 9dvdp.exe 2420 xrrrxxf.exe 1812 3fxrflr.exe 1096 bbthth.exe -
resource yara_rule behavioral1/memory/2236-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1500-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2364-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1312-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1116-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1432-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/792-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/684-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2320-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1932-296-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2108 2236 a12074f8e97a865af036978b96d2a5a0_NEIKI.exe 28 PID 2236 wrote to memory of 2108 2236 a12074f8e97a865af036978b96d2a5a0_NEIKI.exe 28 PID 2236 wrote to memory of 2108 2236 a12074f8e97a865af036978b96d2a5a0_NEIKI.exe 28 PID 2236 wrote to memory of 2108 2236 a12074f8e97a865af036978b96d2a5a0_NEIKI.exe 28 PID 2108 wrote to memory of 3028 2108 tnbhnh.exe 29 PID 2108 wrote to memory of 3028 2108 tnbhnh.exe 29 PID 2108 wrote to memory of 3028 2108 tnbhnh.exe 29 PID 2108 wrote to memory of 3028 2108 tnbhnh.exe 29 PID 3028 wrote to memory of 2716 3028 rlxxlrx.exe 30 PID 3028 wrote to memory of 2716 3028 rlxxlrx.exe 30 PID 3028 wrote to memory of 2716 3028 rlxxlrx.exe 30 PID 3028 wrote to memory of 2716 3028 rlxxlrx.exe 30 PID 2716 wrote to memory of 2460 2716 nnbbnt.exe 31 PID 2716 wrote to memory of 2460 2716 nnbbnt.exe 31 PID 2716 wrote to memory of 2460 2716 nnbbnt.exe 31 PID 2716 wrote to memory of 2460 2716 nnbbnt.exe 31 PID 2460 wrote to memory of 1936 2460 bhhttn.exe 32 PID 2460 wrote to memory of 1936 2460 bhhttn.exe 32 PID 2460 wrote to memory of 1936 2460 bhhttn.exe 32 PID 2460 wrote to memory of 1936 2460 bhhttn.exe 32 PID 1936 wrote to memory of 2620 1936 vpjpd.exe 33 PID 1936 wrote to memory of 2620 1936 vpjpd.exe 33 PID 1936 wrote to memory of 2620 1936 vpjpd.exe 33 PID 1936 wrote to memory of 2620 1936 vpjpd.exe 33 PID 2620 wrote to memory of 2464 2620 xrfrxxl.exe 34 PID 2620 wrote to memory of 2464 2620 xrfrxxl.exe 34 PID 2620 wrote to memory of 2464 2620 xrfrxxl.exe 34 PID 2620 wrote to memory of 2464 2620 xrfrxxl.exe 34 PID 2464 wrote to memory of 2952 2464 xlflrxf.exe 35 PID 2464 wrote to memory of 2952 2464 xlflrxf.exe 35 PID 2464 wrote to memory of 2952 2464 xlflrxf.exe 35 PID 2464 wrote to memory of 2952 2464 xlflrxf.exe 35 PID 2952 wrote to memory of 1596 2952 nnhhth.exe 36 PID 2952 wrote to memory of 1596 2952 nnhhth.exe 36 PID 2952 wrote to memory of 1596 2952 nnhhth.exe 36 PID 2952 wrote to memory of 1596 2952 nnhhth.exe 36 PID 1596 wrote to memory of 2700 1596 pjvvj.exe 37 PID 1596 wrote to memory of 2700 1596 pjvvj.exe 37 PID 1596 wrote to memory of 2700 1596 pjvvj.exe 37 PID 1596 wrote to memory of 2700 1596 pjvvj.exe 37 PID 2700 wrote to memory of 2764 2700 fflrfrf.exe 38 PID 2700 wrote to memory of 2764 2700 fflrfrf.exe 38 PID 2700 wrote to memory of 2764 2700 fflrfrf.exe 38 PID 2700 wrote to memory of 2764 2700 fflrfrf.exe 38 PID 2764 wrote to memory of 2340 2764 xlxfrxf.exe 39 PID 2764 wrote to memory of 2340 2764 xlxfrxf.exe 39 PID 2764 wrote to memory of 2340 2764 xlxfrxf.exe 39 PID 2764 wrote to memory of 2340 2764 xlxfrxf.exe 39 PID 2340 wrote to memory of 1500 2340 5bnntt.exe 40 PID 2340 wrote to memory of 1500 2340 5bnntt.exe 40 PID 2340 wrote to memory of 1500 2340 5bnntt.exe 40 PID 2340 wrote to memory of 1500 2340 5bnntt.exe 40 PID 1500 wrote to memory of 2364 1500 jdppv.exe 41 PID 1500 wrote to memory of 2364 1500 jdppv.exe 41 PID 1500 wrote to memory of 2364 1500 jdppv.exe 41 PID 1500 wrote to memory of 2364 1500 jdppv.exe 41 PID 2364 wrote to memory of 1312 2364 7ddpj.exe 42 PID 2364 wrote to memory of 1312 2364 7ddpj.exe 42 PID 2364 wrote to memory of 1312 2364 7ddpj.exe 42 PID 2364 wrote to memory of 1312 2364 7ddpj.exe 42 PID 1312 wrote to memory of 1116 1312 rlxxflx.exe 43 PID 1312 wrote to memory of 1116 1312 rlxxflx.exe 43 PID 1312 wrote to memory of 1116 1312 rlxxflx.exe 43 PID 1312 wrote to memory of 1116 1312 rlxxflx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\a12074f8e97a865af036978b96d2a5a0_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\a12074f8e97a865af036978b96d2a5a0_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\tnbhnh.exec:\tnbhnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\rlxxlrx.exec:\rlxxlrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\nnbbnt.exec:\nnbbnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\bhhttn.exec:\bhhttn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\vpjpd.exec:\vpjpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\xrfrxxl.exec:\xrfrxxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\xlflrxf.exec:\xlflrxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\nnhhth.exec:\nnhhth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\pjvvj.exec:\pjvvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\fflrfrf.exec:\fflrfrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\xlxfrxf.exec:\xlxfrxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\5bnntt.exec:\5bnntt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\jdppv.exec:\jdppv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\7ddpj.exec:\7ddpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\rlxxflx.exec:\rlxxflx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\tntthh.exec:\tntthh.exe17⤵
- Executes dropped EXE
PID:1116 -
\??\c:\9pddp.exec:\9pddp.exe18⤵
- Executes dropped EXE
PID:840 -
\??\c:\jvppv.exec:\jvppv.exe19⤵
- Executes dropped EXE
PID:2092 -
\??\c:\fxflrxl.exec:\fxflrxl.exe20⤵
- Executes dropped EXE
PID:2932 -
\??\c:\tnbbnn.exec:\tnbbnn.exe21⤵
- Executes dropped EXE
PID:2284 -
\??\c:\tthtbn.exec:\tthtbn.exe22⤵
- Executes dropped EXE
PID:2304 -
\??\c:\vdjvp.exec:\vdjvp.exe23⤵
- Executes dropped EXE
PID:2892 -
\??\c:\lxllxxx.exec:\lxllxxx.exe24⤵
- Executes dropped EXE
PID:948 -
\??\c:\llllffr.exec:\llllffr.exe25⤵
- Executes dropped EXE
PID:1720 -
\??\c:\hbbhtb.exec:\hbbhtb.exe26⤵
- Executes dropped EXE
PID:1432 -
\??\c:\jjpvj.exec:\jjpvj.exe27⤵
- Executes dropped EXE
PID:792 -
\??\c:\xrffrrx.exec:\xrffrrx.exe28⤵
- Executes dropped EXE
PID:684 -
\??\c:\fflfxrl.exec:\fflfxrl.exe29⤵
- Executes dropped EXE
PID:3020 -
\??\c:\nhbhbh.exec:\nhbhbh.exe30⤵
- Executes dropped EXE
PID:1680 -
\??\c:\7jppd.exec:\7jppd.exe31⤵
- Executes dropped EXE
PID:2320 -
\??\c:\vvpdj.exec:\vvpdj.exe32⤵
- Executes dropped EXE
PID:1932 -
\??\c:\lrxrrll.exec:\lrxrrll.exe33⤵
- Executes dropped EXE
PID:1208 -
\??\c:\hbhntn.exec:\hbhntn.exe34⤵
- Executes dropped EXE
PID:1988 -
\??\c:\jdjjp.exec:\jdjjp.exe35⤵
- Executes dropped EXE
PID:2636 -
\??\c:\pjdjp.exec:\pjdjp.exe36⤵
- Executes dropped EXE
PID:2264 -
\??\c:\xrrxffl.exec:\xrrxffl.exe37⤵
- Executes dropped EXE
PID:2584 -
\??\c:\fxrrxxl.exec:\fxrrxxl.exe38⤵
- Executes dropped EXE
PID:3056 -
\??\c:\bbtbhh.exec:\bbtbhh.exe39⤵
- Executes dropped EXE
PID:2876 -
\??\c:\tntbbh.exec:\tntbbh.exe40⤵
- Executes dropped EXE
PID:2752 -
\??\c:\5jdjj.exec:\5jdjj.exe41⤵
- Executes dropped EXE
PID:2544 -
\??\c:\5ddpd.exec:\5ddpd.exe42⤵
- Executes dropped EXE
PID:1936 -
\??\c:\rfxfffl.exec:\rfxfffl.exe43⤵
- Executes dropped EXE
PID:2472 -
\??\c:\xxflxfr.exec:\xxflxfr.exe44⤵
- Executes dropped EXE
PID:2528 -
\??\c:\ttbbtt.exec:\ttbbtt.exe45⤵
- Executes dropped EXE
PID:2968 -
\??\c:\3hhthh.exec:\3hhthh.exe46⤵
- Executes dropped EXE
PID:1120 -
\??\c:\jdpvj.exec:\jdpvj.exe47⤵
- Executes dropped EXE
PID:2684 -
\??\c:\pdvvv.exec:\pdvvv.exe48⤵
- Executes dropped EXE
PID:2756 -
\??\c:\rrlrxxl.exec:\rrlrxxl.exe49⤵
- Executes dropped EXE
PID:1340 -
\??\c:\xrlxfrx.exec:\xrlxfrx.exe50⤵
- Executes dropped EXE
PID:1768 -
\??\c:\tnbnth.exec:\tnbnth.exe51⤵
- Executes dropped EXE
PID:2340 -
\??\c:\nntthh.exec:\nntthh.exe52⤵
- Executes dropped EXE
PID:1452 -
\??\c:\7nhhbb.exec:\7nhhbb.exe53⤵
- Executes dropped EXE
PID:1504 -
\??\c:\dvjjp.exec:\dvjjp.exe54⤵
- Executes dropped EXE
PID:616 -
\??\c:\jdvjp.exec:\jdvjp.exe55⤵
- Executes dropped EXE
PID:2380 -
\??\c:\1flrffr.exec:\1flrffr.exe56⤵
- Executes dropped EXE
PID:1236 -
\??\c:\rlrrffr.exec:\rlrrffr.exe57⤵
- Executes dropped EXE
PID:2964 -
\??\c:\hbnthh.exec:\hbnthh.exe58⤵
- Executes dropped EXE
PID:2180 -
\??\c:\1hthhn.exec:\1hthhn.exe59⤵
- Executes dropped EXE
PID:2208 -
\??\c:\5tnbnn.exec:\5tnbnn.exe60⤵
- Executes dropped EXE
PID:1728 -
\??\c:\5pjjv.exec:\5pjjv.exe61⤵
- Executes dropped EXE
PID:320 -
\??\c:\9dvdp.exec:\9dvdp.exe62⤵
- Executes dropped EXE
PID:488 -
\??\c:\xrrrxxf.exec:\xrrrxxf.exe63⤵
- Executes dropped EXE
PID:2420 -
\??\c:\3fxrflr.exec:\3fxrflr.exe64⤵
- Executes dropped EXE
PID:1812 -
\??\c:\bbthth.exec:\bbthth.exe65⤵
- Executes dropped EXE
PID:1096 -
\??\c:\nhbbnt.exec:\nhbbnt.exe66⤵PID:3036
-
\??\c:\jdppd.exec:\jdppd.exe67⤵PID:2324
-
\??\c:\vppdp.exec:\vppdp.exe68⤵PID:2296
-
\??\c:\nhbbnt.exec:\nhbbnt.exe69⤵PID:684
-
\??\c:\nbnhhn.exec:\nbnhhn.exe70⤵PID:2216
-
\??\c:\vpdjv.exec:\vpdjv.exe71⤵PID:1976
-
\??\c:\jddjj.exec:\jddjj.exe72⤵PID:1944
-
\??\c:\fxrxllr.exec:\fxrxllr.exe73⤵PID:1816
-
\??\c:\1rfrffx.exec:\1rfrffx.exe74⤵PID:1600
-
\??\c:\3btnnt.exec:\3btnnt.exe75⤵PID:1732
-
\??\c:\bbtbhb.exec:\bbtbhb.exe76⤵PID:1632
-
\??\c:\3jdvj.exec:\3jdvj.exe77⤵PID:2860
-
\??\c:\3ppvd.exec:\3ppvd.exe78⤵PID:2612
-
\??\c:\9ppvp.exec:\9ppvp.exe79⤵PID:2668
-
\??\c:\rllxrfl.exec:\rllxrfl.exe80⤵PID:2604
-
\??\c:\rlxlrxl.exec:\rlxlrxl.exe81⤵PID:2748
-
\??\c:\nbttbn.exec:\nbttbn.exe82⤵PID:1648
-
\??\c:\pvjvp.exec:\pvjvp.exe83⤵PID:2568
-
\??\c:\djdjp.exec:\djdjp.exe84⤵PID:2440
-
\??\c:\7xfrflr.exec:\7xfrflr.exe85⤵PID:2468
-
\??\c:\rfrrrrf.exec:\rfrrrrf.exe86⤵PID:2956
-
\??\c:\hbtbtb.exec:\hbtbtb.exe87⤵PID:884
-
\??\c:\nhtbnn.exec:\nhtbnn.exe88⤵PID:2952
-
\??\c:\pjjpj.exec:\pjjpj.exe89⤵PID:2696
-
\??\c:\7vpdd.exec:\7vpdd.exe90⤵PID:2676
-
\??\c:\xrfrlrx.exec:\xrfrlrx.exe91⤵PID:1752
-
\??\c:\1llrxlr.exec:\1llrxlr.exe92⤵PID:1784
-
\??\c:\htbnnt.exec:\htbnnt.exe93⤵PID:1436
-
\??\c:\tnhnnn.exec:\tnhnnn.exe94⤵PID:1508
-
\??\c:\pjvvd.exec:\pjvvd.exe95⤵PID:1196
-
\??\c:\7jddp.exec:\7jddp.exe96⤵PID:1312
-
\??\c:\rfffrrx.exec:\rfffrrx.exe97⤵PID:1360
-
\??\c:\rfxxfxf.exec:\rfxxfxf.exe98⤵PID:2028
-
\??\c:\9xrxllr.exec:\9xrxllr.exe99⤵PID:1536
-
\??\c:\tbttbb.exec:\tbttbb.exe100⤵PID:2152
-
\??\c:\tntbbh.exec:\tntbbh.exe101⤵PID:2932
-
\??\c:\jdvjv.exec:\jdvjv.exe102⤵PID:2284
-
\??\c:\9vvdd.exec:\9vvdd.exe103⤵PID:2304
-
\??\c:\rlxlxxl.exec:\rlxlxxl.exe104⤵PID:1404
-
\??\c:\xrffllx.exec:\xrffllx.exe105⤵PID:572
-
\??\c:\tnhtbh.exec:\tnhtbh.exe106⤵PID:1652
-
\??\c:\bbtthh.exec:\bbtthh.exe107⤵PID:1720
-
\??\c:\5jjdd.exec:\5jjdd.exe108⤵PID:340
-
\??\c:\3pjpd.exec:\3pjpd.exe109⤵PID:752
-
\??\c:\7rlxxlr.exec:\7rlxxlr.exe110⤵PID:1984
-
\??\c:\fxlrxxx.exec:\fxlrxxx.exe111⤵PID:1712
-
\??\c:\3ntnnh.exec:\3ntnnh.exe112⤵PID:936
-
\??\c:\bthnbh.exec:\bthnbh.exe113⤵PID:1680
-
\??\c:\jdjjp.exec:\jdjjp.exe114⤵PID:596
-
\??\c:\dddpv.exec:\dddpv.exe115⤵PID:880
-
\??\c:\9rfxfxf.exec:\9rfxfxf.exe116⤵PID:2128
-
\??\c:\3fxfrfr.exec:\3fxfrfr.exe117⤵PID:2084
-
\??\c:\tntbnn.exec:\tntbnn.exe118⤵PID:1496
-
\??\c:\1ntbbb.exec:\1ntbbb.exe119⤵PID:2316
-
\??\c:\5jdjp.exec:\5jdjp.exe120⤵PID:2660
-
\??\c:\vpdvd.exec:\vpdvd.exe121⤵PID:2652
-
\??\c:\xlxxrrf.exec:\xlxxrrf.exe122⤵PID:2560
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-