Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 02:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aeebd387ddb82597cc5d8de63b776ae0_NEIKI.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
aeebd387ddb82597cc5d8de63b776ae0_NEIKI.exe
-
Size
471KB
-
MD5
aeebd387ddb82597cc5d8de63b776ae0
-
SHA1
3287004472dd61d4fc267f70e5c4bcf19f56faba
-
SHA256
b1ad523cb637ac508fdaa5f3ae9cefdeb53d841dd3063ee04058195ab4c76aa7
-
SHA512
e0afdd3c79df40fc9eeb9a020ae482f64f29d8f550633953743178e7c7a0704bc17677b4450e0fb6718291ac90c532dcf7e6c194842fd7b096b3c60e979e4ebf
-
SSDEEP
6144:n3C9BRo7MlrWKo+lS0Le4xRSAoq78yoyfx93sY0AJq4mZAx5t:n3C9yMo+S0L9xRnoq7H9pmoV
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/2264-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2144-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3048-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/468-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1184-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2012-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/308-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1264-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2604 xrfxllr.exe 2144 lfxlxfx.exe 2668 7hnthb.exe 2720 pjjpj.exe 2804 nhhnbt.exe 2544 3jpvj.exe 2632 9hbnbt.exe 2592 vdvpd.exe 3040 tnhhnn.exe 2620 frllxfx.exe 2864 1btbnt.exe 3060 7pdvd.exe 2308 3ffrlxx.exe 1620 1tnttb.exe 1832 9rflrfl.exe 3048 7pvpj.exe 468 fxflxfx.exe 1184 hhhnbt.exe 2012 rrrrrff.exe 2892 htthbh.exe 2952 jdvdd.exe 2028 1rrxlxr.exe 1384 3httbb.exe 1644 vppvp.exe 2384 nhbhnn.exe 2152 5djpj.exe 308 btnnbh.exe 1692 vddpj.exe 1804 xxxlflx.exe 1264 hnbnnt.exe 888 bbbntb.exe 2996 jdpvj.exe 1604 9tthtt.exe 2600 jdvjp.exe 2476 1xlfxxf.exe 2744 rrflrxf.exe 2668 hhbbth.exe 2672 pjppd.exe 1288 xrlxxfl.exe 2692 5xxflrx.exe 2524 tntbnn.exe 2640 dvppd.exe 2480 xrflrfl.exe 1060 3lxxffr.exe 2876 hhbbnt.exe 2888 jvpvd.exe 1456 frffllf.exe 1256 lfflxfr.exe 1632 hbttbt.exe 1648 dvppd.exe 1452 fxrxxfx.exe 1832 rxlrfrf.exe 1896 3nbnnn.exe 1500 dpjjd.exe 2100 xrlrffr.exe 840 1frxffr.exe 2848 hbthnt.exe 2500 ppjvd.exe 2952 fxrflrl.exe 2080 rlxlxxl.exe 580 9bhnnt.exe 3004 1vddv.exe 1644 vpdjd.exe 2392 9fxxffl.exe -
resource yara_rule behavioral1/memory/2264-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2144-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/468-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1184-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2012-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/308-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1264-287-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2264 wrote to memory of 2604 2264 aeebd387ddb82597cc5d8de63b776ae0_NEIKI.exe 28 PID 2264 wrote to memory of 2604 2264 aeebd387ddb82597cc5d8de63b776ae0_NEIKI.exe 28 PID 2264 wrote to memory of 2604 2264 aeebd387ddb82597cc5d8de63b776ae0_NEIKI.exe 28 PID 2264 wrote to memory of 2604 2264 aeebd387ddb82597cc5d8de63b776ae0_NEIKI.exe 28 PID 2604 wrote to memory of 2144 2604 xrfxllr.exe 29 PID 2604 wrote to memory of 2144 2604 xrfxllr.exe 29 PID 2604 wrote to memory of 2144 2604 xrfxllr.exe 29 PID 2604 wrote to memory of 2144 2604 xrfxllr.exe 29 PID 2144 wrote to memory of 2668 2144 lfxlxfx.exe 30 PID 2144 wrote to memory of 2668 2144 lfxlxfx.exe 30 PID 2144 wrote to memory of 2668 2144 lfxlxfx.exe 30 PID 2144 wrote to memory of 2668 2144 lfxlxfx.exe 30 PID 2668 wrote to memory of 2720 2668 7hnthb.exe 31 PID 2668 wrote to memory of 2720 2668 7hnthb.exe 31 PID 2668 wrote to memory of 2720 2668 7hnthb.exe 31 PID 2668 wrote to memory of 2720 2668 7hnthb.exe 31 PID 2720 wrote to memory of 2804 2720 pjjpj.exe 32 PID 2720 wrote to memory of 2804 2720 pjjpj.exe 32 PID 2720 wrote to memory of 2804 2720 pjjpj.exe 32 PID 2720 wrote to memory of 2804 2720 pjjpj.exe 32 PID 2804 wrote to memory of 2544 2804 nhhnbt.exe 33 PID 2804 wrote to memory of 2544 2804 nhhnbt.exe 33 PID 2804 wrote to memory of 2544 2804 nhhnbt.exe 33 PID 2804 wrote to memory of 2544 2804 nhhnbt.exe 33 PID 2544 wrote to memory of 2632 2544 3jpvj.exe 34 PID 2544 wrote to memory of 2632 2544 3jpvj.exe 34 PID 2544 wrote to memory of 2632 2544 3jpvj.exe 34 PID 2544 wrote to memory of 2632 2544 3jpvj.exe 34 PID 2632 wrote to memory of 2592 2632 9hbnbt.exe 35 PID 2632 wrote to memory of 2592 2632 9hbnbt.exe 35 PID 2632 wrote to memory of 2592 2632 9hbnbt.exe 35 PID 2632 wrote to memory of 2592 2632 9hbnbt.exe 35 PID 2592 wrote to memory of 3040 2592 vdvpd.exe 36 PID 2592 wrote to memory of 3040 2592 vdvpd.exe 36 PID 2592 wrote to memory of 3040 2592 vdvpd.exe 36 PID 2592 wrote to memory of 3040 2592 vdvpd.exe 36 PID 3040 wrote to memory of 2620 3040 tnhhnn.exe 37 PID 3040 wrote to memory of 2620 3040 tnhhnn.exe 37 PID 3040 wrote to memory of 2620 3040 tnhhnn.exe 37 PID 3040 wrote to memory of 2620 3040 tnhhnn.exe 37 PID 2620 wrote to memory of 2864 2620 frllxfx.exe 38 PID 2620 wrote to memory of 2864 2620 frllxfx.exe 38 PID 2620 wrote to memory of 2864 2620 frllxfx.exe 38 PID 2620 wrote to memory of 2864 2620 frllxfx.exe 38 PID 2864 wrote to memory of 3060 2864 1btbnt.exe 39 PID 2864 wrote to memory of 3060 2864 1btbnt.exe 39 PID 2864 wrote to memory of 3060 2864 1btbnt.exe 39 PID 2864 wrote to memory of 3060 2864 1btbnt.exe 39 PID 3060 wrote to memory of 2308 3060 7pdvd.exe 40 PID 3060 wrote to memory of 2308 3060 7pdvd.exe 40 PID 3060 wrote to memory of 2308 3060 7pdvd.exe 40 PID 3060 wrote to memory of 2308 3060 7pdvd.exe 40 PID 2308 wrote to memory of 1620 2308 3ffrlxx.exe 41 PID 2308 wrote to memory of 1620 2308 3ffrlxx.exe 41 PID 2308 wrote to memory of 1620 2308 3ffrlxx.exe 41 PID 2308 wrote to memory of 1620 2308 3ffrlxx.exe 41 PID 1620 wrote to memory of 1832 1620 1tnttb.exe 42 PID 1620 wrote to memory of 1832 1620 1tnttb.exe 42 PID 1620 wrote to memory of 1832 1620 1tnttb.exe 42 PID 1620 wrote to memory of 1832 1620 1tnttb.exe 42 PID 1832 wrote to memory of 3048 1832 9rflrfl.exe 43 PID 1832 wrote to memory of 3048 1832 9rflrfl.exe 43 PID 1832 wrote to memory of 3048 1832 9rflrfl.exe 43 PID 1832 wrote to memory of 3048 1832 9rflrfl.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\aeebd387ddb82597cc5d8de63b776ae0_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\aeebd387ddb82597cc5d8de63b776ae0_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\xrfxllr.exec:\xrfxllr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\lfxlxfx.exec:\lfxlxfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\7hnthb.exec:\7hnthb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\pjjpj.exec:\pjjpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\nhhnbt.exec:\nhhnbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\3jpvj.exec:\3jpvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\9hbnbt.exec:\9hbnbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\vdvpd.exec:\vdvpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\tnhhnn.exec:\tnhhnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\frllxfx.exec:\frllxfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\1btbnt.exec:\1btbnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\7pdvd.exec:\7pdvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\3ffrlxx.exec:\3ffrlxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\1tnttb.exec:\1tnttb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\9rflrfl.exec:\9rflrfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\7pvpj.exec:\7pvpj.exe17⤵
- Executes dropped EXE
PID:3048 -
\??\c:\fxflxfx.exec:\fxflxfx.exe18⤵
- Executes dropped EXE
PID:468 -
\??\c:\hhhnbt.exec:\hhhnbt.exe19⤵
- Executes dropped EXE
PID:1184 -
\??\c:\rrrrrff.exec:\rrrrrff.exe20⤵
- Executes dropped EXE
PID:2012 -
\??\c:\htthbh.exec:\htthbh.exe21⤵
- Executes dropped EXE
PID:2892 -
\??\c:\jdvdd.exec:\jdvdd.exe22⤵
- Executes dropped EXE
PID:2952 -
\??\c:\1rrxlxr.exec:\1rrxlxr.exe23⤵
- Executes dropped EXE
PID:2028 -
\??\c:\3httbb.exec:\3httbb.exe24⤵
- Executes dropped EXE
PID:1384 -
\??\c:\vppvp.exec:\vppvp.exe25⤵
- Executes dropped EXE
PID:1644 -
\??\c:\nhbhnn.exec:\nhbhnn.exe26⤵
- Executes dropped EXE
PID:2384 -
\??\c:\5djpj.exec:\5djpj.exe27⤵
- Executes dropped EXE
PID:2152 -
\??\c:\btnnbh.exec:\btnnbh.exe28⤵
- Executes dropped EXE
PID:308 -
\??\c:\vddpj.exec:\vddpj.exe29⤵
- Executes dropped EXE
PID:1692 -
\??\c:\xxxlflx.exec:\xxxlflx.exe30⤵
- Executes dropped EXE
PID:1804 -
\??\c:\hnbnnt.exec:\hnbnnt.exe31⤵
- Executes dropped EXE
PID:1264 -
\??\c:\bbbntb.exec:\bbbntb.exe32⤵
- Executes dropped EXE
PID:888 -
\??\c:\jdpvj.exec:\jdpvj.exe33⤵
- Executes dropped EXE
PID:2996 -
\??\c:\fxllrxf.exec:\fxllrxf.exe34⤵PID:1600
-
\??\c:\9tthtt.exec:\9tthtt.exe35⤵
- Executes dropped EXE
PID:1604 -
\??\c:\jdvjp.exec:\jdvjp.exe36⤵
- Executes dropped EXE
PID:2600 -
\??\c:\1xlfxxf.exec:\1xlfxxf.exe37⤵
- Executes dropped EXE
PID:2476 -
\??\c:\rrflrxf.exec:\rrflrxf.exe38⤵
- Executes dropped EXE
PID:2744 -
\??\c:\hhbbth.exec:\hhbbth.exe39⤵
- Executes dropped EXE
PID:2668 -
\??\c:\pjppd.exec:\pjppd.exe40⤵
- Executes dropped EXE
PID:2672 -
\??\c:\xrlxxfl.exec:\xrlxxfl.exe41⤵
- Executes dropped EXE
PID:1288 -
\??\c:\5xxflrx.exec:\5xxflrx.exe42⤵
- Executes dropped EXE
PID:2692 -
\??\c:\tntbnn.exec:\tntbnn.exe43⤵
- Executes dropped EXE
PID:2524 -
\??\c:\dvppd.exec:\dvppd.exe44⤵
- Executes dropped EXE
PID:2640 -
\??\c:\xrflrfl.exec:\xrflrfl.exe45⤵
- Executes dropped EXE
PID:2480 -
\??\c:\3lxxffr.exec:\3lxxffr.exe46⤵
- Executes dropped EXE
PID:1060 -
\??\c:\hhbbnt.exec:\hhbbnt.exe47⤵
- Executes dropped EXE
PID:2876 -
\??\c:\jvpvd.exec:\jvpvd.exe48⤵
- Executes dropped EXE
PID:2888 -
\??\c:\frffllf.exec:\frffllf.exe49⤵
- Executes dropped EXE
PID:1456 -
\??\c:\lfflxfr.exec:\lfflxfr.exe50⤵
- Executes dropped EXE
PID:1256 -
\??\c:\hbttbt.exec:\hbttbt.exe51⤵
- Executes dropped EXE
PID:1632 -
\??\c:\dvppd.exec:\dvppd.exe52⤵
- Executes dropped EXE
PID:1648 -
\??\c:\fxrxxfx.exec:\fxrxxfx.exe53⤵
- Executes dropped EXE
PID:1452 -
\??\c:\rxlrfrf.exec:\rxlrfrf.exe54⤵
- Executes dropped EXE
PID:1832 -
\??\c:\3nbnnn.exec:\3nbnnn.exe55⤵
- Executes dropped EXE
PID:1896 -
\??\c:\dpjjd.exec:\dpjjd.exe56⤵
- Executes dropped EXE
PID:1500 -
\??\c:\xrlrffr.exec:\xrlrffr.exe57⤵
- Executes dropped EXE
PID:2100 -
\??\c:\1frxffr.exec:\1frxffr.exe58⤵
- Executes dropped EXE
PID:840 -
\??\c:\hbthnt.exec:\hbthnt.exe59⤵
- Executes dropped EXE
PID:2848 -
\??\c:\ppjvd.exec:\ppjvd.exe60⤵
- Executes dropped EXE
PID:2500 -
\??\c:\fxrflrl.exec:\fxrflrl.exe61⤵
- Executes dropped EXE
PID:2952 -
\??\c:\rlxlxxl.exec:\rlxlxxl.exe62⤵
- Executes dropped EXE
PID:2080 -
\??\c:\9bhnnt.exec:\9bhnnt.exe63⤵
- Executes dropped EXE
PID:580 -
\??\c:\1vddv.exec:\1vddv.exe64⤵
- Executes dropped EXE
PID:3004 -
\??\c:\vpdjd.exec:\vpdjd.exe65⤵
- Executes dropped EXE
PID:1644 -
\??\c:\9fxxffl.exec:\9fxxffl.exe66⤵
- Executes dropped EXE
PID:2392 -
\??\c:\nhtbnt.exec:\nhtbnt.exe67⤵PID:1240
-
\??\c:\jdvvd.exec:\jdvvd.exe68⤵PID:2396
-
\??\c:\9vpvj.exec:\9vpvj.exe69⤵PID:1580
-
\??\c:\rlfffll.exec:\rlfffll.exe70⤵PID:2444
-
\??\c:\rllrrfx.exec:\rllrrfx.exe71⤵PID:236
-
\??\c:\nhtbhh.exec:\nhtbhh.exe72⤵PID:1504
-
\??\c:\vpvdj.exec:\vpvdj.exe73⤵PID:2984
-
\??\c:\7jjpj.exec:\7jjpj.exe74⤵PID:2060
-
\??\c:\rrlrlrf.exec:\rrlrlrf.exe75⤵PID:1704
-
\??\c:\nhnbhn.exec:\nhnbhn.exe76⤵PID:1224
-
\??\c:\7nbbht.exec:\7nbbht.exe77⤵PID:2628
-
\??\c:\pvvpj.exec:\pvvpj.exe78⤵PID:2144
-
\??\c:\lllxllx.exec:\lllxllx.exe79⤵PID:2676
-
\??\c:\1xrrxfr.exec:\1xrrxfr.exe80⤵PID:2528
-
\??\c:\nhbhnn.exec:\nhbhnn.exe81⤵PID:2636
-
\??\c:\pjddv.exec:\pjddv.exe82⤵PID:2704
-
\??\c:\frlrlrl.exec:\frlrlrl.exe83⤵PID:2792
-
\??\c:\xxxfxfx.exec:\xxxfxfx.exe84⤵PID:2576
-
\??\c:\nnnnht.exec:\nnnnht.exe85⤵PID:1148
-
\??\c:\jvdjp.exec:\jvdjp.exe86⤵PID:1872
-
\??\c:\pjppd.exec:\pjppd.exe87⤵PID:2852
-
\??\c:\lfxlxxr.exec:\lfxlxxr.exe88⤵PID:2908
-
\??\c:\bbthtt.exec:\bbthtt.exe89⤵PID:2912
-
\??\c:\bbnthh.exec:\bbnthh.exe90⤵PID:2808
-
\??\c:\pjjjp.exec:\pjjjp.exe91⤵PID:1684
-
\??\c:\xrflrrf.exec:\xrflrrf.exe92⤵PID:1300
-
\??\c:\xrlxlrf.exec:\xrlxlrf.exe93⤵PID:1976
-
\??\c:\9thntb.exec:\9thntb.exe94⤵PID:2160
-
\??\c:\ppjvp.exec:\ppjvp.exe95⤵PID:2696
-
\??\c:\lrrxlrl.exec:\lrrxlrl.exe96⤵PID:1284
-
\??\c:\3llrfrx.exec:\3llrfrx.exe97⤵PID:2560
-
\??\c:\bnbhnn.exec:\bnbhnn.exe98⤵PID:2248
-
\??\c:\jdvjd.exec:\jdvjd.exe99⤵PID:1728
-
\??\c:\dpjjp.exec:\dpjjp.exe100⤵PID:1844
-
\??\c:\5lxxrxl.exec:\5lxxrxl.exe101⤵PID:2892
-
\??\c:\9hnntb.exec:\9hnntb.exe102⤵PID:2272
-
\??\c:\ppjdp.exec:\ppjdp.exe103⤵PID:768
-
\??\c:\pjvjv.exec:\pjvjv.exe104⤵PID:588
-
\??\c:\lrlrllx.exec:\lrlrllx.exe105⤵PID:1788
-
\??\c:\bbbbtb.exec:\bbbbtb.exe106⤵PID:2064
-
\??\c:\hbtbtb.exec:\hbtbtb.exe107⤵PID:1248
-
\??\c:\pdpvj.exec:\pdpvj.exe108⤵PID:864
-
\??\c:\lfxfrxf.exec:\lfxfrxf.exe109⤵PID:308
-
\??\c:\7fxrflx.exec:\7fxrflx.exe110⤵PID:568
-
\??\c:\thhbnh.exec:\thhbnh.exe111⤵PID:3008
-
\??\c:\9dddd.exec:\9dddd.exe112⤵PID:1228
-
\??\c:\rrllrxx.exec:\rrllrxx.exe113⤵PID:1948
-
\??\c:\7lfflrx.exec:\7lfflrx.exe114⤵PID:2020
-
\??\c:\tnttnn.exec:\tnttnn.exe115⤵PID:2264
-
\??\c:\pdvvj.exec:\pdvvj.exe116⤵PID:2824
-
\??\c:\1jvvv.exec:\1jvvv.exe117⤵PID:2612
-
\??\c:\9lfxrrf.exec:\9lfxrrf.exe118⤵PID:2600
-
\??\c:\7btbnn.exec:\7btbnn.exe119⤵PID:2476
-
\??\c:\btnnhb.exec:\btnnhb.exe120⤵PID:2744
-
\??\c:\jjjdp.exec:\jjjdp.exe121⤵PID:2820
-
\??\c:\rlflffx.exec:\rlflffx.exe122⤵PID:2672
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-