Analysis
-
max time kernel
148s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 04:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d7565fe4f5b5d69738574f0029e66580_NEIKI.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
d7565fe4f5b5d69738574f0029e66580_NEIKI.exe
-
Size
101KB
-
MD5
d7565fe4f5b5d69738574f0029e66580
-
SHA1
aca4fd9c7e8ba772c8f1aa8ed9c0be6a5543d3b1
-
SHA256
572cbd118a18df73c75b7822546f3c2bbc022241ec166f065386588e89376d0d
-
SHA512
ad2b1fa7e695558d0624b2aa7501b60d8b34bf0ad4a1e0945be6cef7f82c902649694c33f6855c13244e32802f880b682c65747ca720e478a09ad166485851fa
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KVT+buwUGu3P3CW:n3C9BRo7MlrWKVT+buBGu3Px
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2764-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2936-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1660-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1256-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1032-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1644-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2184-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1764-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1556-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/996-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2836 xxffllx.exe 2852 1hhhhn.exe 2632 3djpv.exe 2592 1llrrlx.exe 2776 1hnntb.exe 2688 jdddp.exe 2936 jdvdd.exe 2556 7fllffl.exe 2872 thnntt.exe 1660 bttbhh.exe 1256 pdppd.exe 1032 jpjvv.exe 1644 xrfrxfr.exe 2184 fxlrxxl.exe 2004 tbntnh.exe 1444 7pdjj.exe 784 pdvvj.exe 1648 frfflfl.exe 1764 lfxlrrx.exe 2968 thnthh.exe 2612 dvjpj.exe 2100 1vjpv.exe 1636 rflrxxf.exe 1904 9fxflrf.exe 1556 hbhnhh.exe 1804 nhthnt.exe 3036 vdvdj.exe 1736 xxlrffr.exe 996 hbhnbb.exe 2188 nntnbh.exe 2820 9vppv.exe 1604 lfflllf.exe 2836 btbhbh.exe 2060 9bhntt.exe 2544 9vjvd.exe 2560 pjpjd.exe 2592 5pjpv.exe 2192 fxlllff.exe 2524 xrllflr.exe 2700 tnhtbb.exe 2492 dvpvp.exe 2944 vpppj.exe 296 dpddj.exe 2872 5lfxflf.exe 2000 1lrrxfl.exe 816 thhnht.exe 1980 nbnthh.exe 2232 jdjpd.exe 2348 vpdpd.exe 2184 lfxfrrl.exe 2344 3lflxxl.exe 692 bhnbbn.exe 1168 nhnnbh.exe 1708 djdjv.exe 964 vppdp.exe 284 rfrrrlr.exe 2620 xxllrxf.exe 2312 xllxxxf.exe 2788 3thhhn.exe 2628 jjjpj.exe 2952 jjvpd.exe 1868 rfrxrrr.exe 804 3lxfffl.exe 1968 1bhntn.exe -
resource yara_rule behavioral1/memory/2764-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1256-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1032-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1644-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1764-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/996-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-300-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2764 wrote to memory of 2836 2764 d7565fe4f5b5d69738574f0029e66580_NEIKI.exe 28 PID 2764 wrote to memory of 2836 2764 d7565fe4f5b5d69738574f0029e66580_NEIKI.exe 28 PID 2764 wrote to memory of 2836 2764 d7565fe4f5b5d69738574f0029e66580_NEIKI.exe 28 PID 2764 wrote to memory of 2836 2764 d7565fe4f5b5d69738574f0029e66580_NEIKI.exe 28 PID 2836 wrote to memory of 2852 2836 xxffllx.exe 29 PID 2836 wrote to memory of 2852 2836 xxffllx.exe 29 PID 2836 wrote to memory of 2852 2836 xxffllx.exe 29 PID 2836 wrote to memory of 2852 2836 xxffllx.exe 29 PID 2852 wrote to memory of 2632 2852 1hhhhn.exe 30 PID 2852 wrote to memory of 2632 2852 1hhhhn.exe 30 PID 2852 wrote to memory of 2632 2852 1hhhhn.exe 30 PID 2852 wrote to memory of 2632 2852 1hhhhn.exe 30 PID 2632 wrote to memory of 2592 2632 3djpv.exe 31 PID 2632 wrote to memory of 2592 2632 3djpv.exe 31 PID 2632 wrote to memory of 2592 2632 3djpv.exe 31 PID 2632 wrote to memory of 2592 2632 3djpv.exe 31 PID 2592 wrote to memory of 2776 2592 1llrrlx.exe 32 PID 2592 wrote to memory of 2776 2592 1llrrlx.exe 32 PID 2592 wrote to memory of 2776 2592 1llrrlx.exe 32 PID 2592 wrote to memory of 2776 2592 1llrrlx.exe 32 PID 2776 wrote to memory of 2688 2776 1hnntb.exe 33 PID 2776 wrote to memory of 2688 2776 1hnntb.exe 33 PID 2776 wrote to memory of 2688 2776 1hnntb.exe 33 PID 2776 wrote to memory of 2688 2776 1hnntb.exe 33 PID 2688 wrote to memory of 2936 2688 jdddp.exe 34 PID 2688 wrote to memory of 2936 2688 jdddp.exe 34 PID 2688 wrote to memory of 2936 2688 jdddp.exe 34 PID 2688 wrote to memory of 2936 2688 jdddp.exe 34 PID 2936 wrote to memory of 2556 2936 jdvdd.exe 35 PID 2936 wrote to memory of 2556 2936 jdvdd.exe 35 PID 2936 wrote to memory of 2556 2936 jdvdd.exe 35 PID 2936 wrote to memory of 2556 2936 jdvdd.exe 35 PID 2556 wrote to memory of 2872 2556 7fllffl.exe 36 PID 2556 wrote to memory of 2872 2556 7fllffl.exe 36 PID 2556 wrote to memory of 2872 2556 7fllffl.exe 36 PID 2556 wrote to memory of 2872 2556 7fllffl.exe 36 PID 2872 wrote to memory of 1660 2872 thnntt.exe 37 PID 2872 wrote to memory of 1660 2872 thnntt.exe 37 PID 2872 wrote to memory of 1660 2872 thnntt.exe 37 PID 2872 wrote to memory of 1660 2872 thnntt.exe 37 PID 1660 wrote to memory of 1256 1660 bttbhh.exe 38 PID 1660 wrote to memory of 1256 1660 bttbhh.exe 38 PID 1660 wrote to memory of 1256 1660 bttbhh.exe 38 PID 1660 wrote to memory of 1256 1660 bttbhh.exe 38 PID 1256 wrote to memory of 1032 1256 pdppd.exe 39 PID 1256 wrote to memory of 1032 1256 pdppd.exe 39 PID 1256 wrote to memory of 1032 1256 pdppd.exe 39 PID 1256 wrote to memory of 1032 1256 pdppd.exe 39 PID 1032 wrote to memory of 1644 1032 jpjvv.exe 40 PID 1032 wrote to memory of 1644 1032 jpjvv.exe 40 PID 1032 wrote to memory of 1644 1032 jpjvv.exe 40 PID 1032 wrote to memory of 1644 1032 jpjvv.exe 40 PID 1644 wrote to memory of 2184 1644 xrfrxfr.exe 41 PID 1644 wrote to memory of 2184 1644 xrfrxfr.exe 41 PID 1644 wrote to memory of 2184 1644 xrfrxfr.exe 41 PID 1644 wrote to memory of 2184 1644 xrfrxfr.exe 41 PID 2184 wrote to memory of 2004 2184 fxlrxxl.exe 42 PID 2184 wrote to memory of 2004 2184 fxlrxxl.exe 42 PID 2184 wrote to memory of 2004 2184 fxlrxxl.exe 42 PID 2184 wrote to memory of 2004 2184 fxlrxxl.exe 42 PID 2004 wrote to memory of 1444 2004 tbntnh.exe 43 PID 2004 wrote to memory of 1444 2004 tbntnh.exe 43 PID 2004 wrote to memory of 1444 2004 tbntnh.exe 43 PID 2004 wrote to memory of 1444 2004 tbntnh.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7565fe4f5b5d69738574f0029e66580_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\d7565fe4f5b5d69738574f0029e66580_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\xxffllx.exec:\xxffllx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\1hhhhn.exec:\1hhhhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\3djpv.exec:\3djpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\1llrrlx.exec:\1llrrlx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\1hnntb.exec:\1hnntb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\jdddp.exec:\jdddp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\jdvdd.exec:\jdvdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\7fllffl.exec:\7fllffl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\thnntt.exec:\thnntt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\bttbhh.exec:\bttbhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\pdppd.exec:\pdppd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\jpjvv.exec:\jpjvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\xrfrxfr.exec:\xrfrxfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\fxlrxxl.exec:\fxlrxxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\tbntnh.exec:\tbntnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\7pdjj.exec:\7pdjj.exe17⤵
- Executes dropped EXE
PID:1444 -
\??\c:\pdvvj.exec:\pdvvj.exe18⤵
- Executes dropped EXE
PID:784 -
\??\c:\frfflfl.exec:\frfflfl.exe19⤵
- Executes dropped EXE
PID:1648 -
\??\c:\lfxlrrx.exec:\lfxlrrx.exe20⤵
- Executes dropped EXE
PID:1764 -
\??\c:\thnthh.exec:\thnthh.exe21⤵
- Executes dropped EXE
PID:2968 -
\??\c:\dvjpj.exec:\dvjpj.exe22⤵
- Executes dropped EXE
PID:2612 -
\??\c:\1vjpv.exec:\1vjpv.exe23⤵
- Executes dropped EXE
PID:2100 -
\??\c:\rflrxxf.exec:\rflrxxf.exe24⤵
- Executes dropped EXE
PID:1636 -
\??\c:\9fxflrf.exec:\9fxflrf.exe25⤵
- Executes dropped EXE
PID:1904 -
\??\c:\hbhnhh.exec:\hbhnhh.exe26⤵
- Executes dropped EXE
PID:1556 -
\??\c:\nhthnt.exec:\nhthnt.exe27⤵
- Executes dropped EXE
PID:1804 -
\??\c:\vdvdj.exec:\vdvdj.exe28⤵
- Executes dropped EXE
PID:3036 -
\??\c:\xxlrffr.exec:\xxlrffr.exe29⤵
- Executes dropped EXE
PID:1736 -
\??\c:\hbhnbb.exec:\hbhnbb.exe30⤵
- Executes dropped EXE
PID:996 -
\??\c:\nntnbh.exec:\nntnbh.exe31⤵
- Executes dropped EXE
PID:2188 -
\??\c:\9vppv.exec:\9vppv.exe32⤵
- Executes dropped EXE
PID:2820 -
\??\c:\lfflllf.exec:\lfflllf.exe33⤵
- Executes dropped EXE
PID:1604 -
\??\c:\btbhbh.exec:\btbhbh.exe34⤵
- Executes dropped EXE
PID:2836 -
\??\c:\9bhntt.exec:\9bhntt.exe35⤵
- Executes dropped EXE
PID:2060 -
\??\c:\9vjvd.exec:\9vjvd.exe36⤵
- Executes dropped EXE
PID:2544 -
\??\c:\pjpjd.exec:\pjpjd.exe37⤵
- Executes dropped EXE
PID:2560 -
\??\c:\5pjpv.exec:\5pjpv.exe38⤵
- Executes dropped EXE
PID:2592 -
\??\c:\fxlllff.exec:\fxlllff.exe39⤵
- Executes dropped EXE
PID:2192 -
\??\c:\xrllflr.exec:\xrllflr.exe40⤵
- Executes dropped EXE
PID:2524 -
\??\c:\tnhtbb.exec:\tnhtbb.exe41⤵
- Executes dropped EXE
PID:2700 -
\??\c:\dvpvp.exec:\dvpvp.exe42⤵
- Executes dropped EXE
PID:2492 -
\??\c:\vpppj.exec:\vpppj.exe43⤵
- Executes dropped EXE
PID:2944 -
\??\c:\dpddj.exec:\dpddj.exe44⤵
- Executes dropped EXE
PID:296 -
\??\c:\5lfxflf.exec:\5lfxflf.exe45⤵
- Executes dropped EXE
PID:2872 -
\??\c:\1lrrxfl.exec:\1lrrxfl.exe46⤵
- Executes dropped EXE
PID:2000 -
\??\c:\thhnht.exec:\thhnht.exe47⤵
- Executes dropped EXE
PID:816 -
\??\c:\nbnthh.exec:\nbnthh.exe48⤵
- Executes dropped EXE
PID:1980 -
\??\c:\jdjpd.exec:\jdjpd.exe49⤵
- Executes dropped EXE
PID:2232 -
\??\c:\vpdpd.exec:\vpdpd.exe50⤵
- Executes dropped EXE
PID:2348 -
\??\c:\lfxfrrl.exec:\lfxfrrl.exe51⤵
- Executes dropped EXE
PID:2184 -
\??\c:\3lflxxl.exec:\3lflxxl.exe52⤵
- Executes dropped EXE
PID:2344 -
\??\c:\bhnbbn.exec:\bhnbbn.exe53⤵
- Executes dropped EXE
PID:692 -
\??\c:\nhnnbh.exec:\nhnnbh.exe54⤵
- Executes dropped EXE
PID:1168 -
\??\c:\djdjv.exec:\djdjv.exe55⤵
- Executes dropped EXE
PID:1708 -
\??\c:\vppdp.exec:\vppdp.exe56⤵
- Executes dropped EXE
PID:964 -
\??\c:\rfrrrlr.exec:\rfrrrlr.exe57⤵
- Executes dropped EXE
PID:284 -
\??\c:\xxllrxf.exec:\xxllrxf.exe58⤵
- Executes dropped EXE
PID:2620 -
\??\c:\xllxxxf.exec:\xllxxxf.exe59⤵
- Executes dropped EXE
PID:2312 -
\??\c:\3thhhn.exec:\3thhhn.exe60⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jjjpj.exec:\jjjpj.exe61⤵
- Executes dropped EXE
PID:2628 -
\??\c:\jjvpd.exec:\jjvpd.exe62⤵
- Executes dropped EXE
PID:2952 -
\??\c:\rfrxrrr.exec:\rfrxrrr.exe63⤵
- Executes dropped EXE
PID:1868 -
\??\c:\3lxfffl.exec:\3lxfffl.exe64⤵
- Executes dropped EXE
PID:804 -
\??\c:\1bhntn.exec:\1bhntn.exe65⤵
- Executes dropped EXE
PID:1968 -
\??\c:\nhhhtn.exec:\nhhhtn.exe66⤵PID:2376
-
\??\c:\vpddd.exec:\vpddd.exe67⤵PID:2208
-
\??\c:\vpdvj.exec:\vpdvj.exe68⤵PID:1728
-
\??\c:\vpppj.exec:\vpppj.exe69⤵PID:904
-
\??\c:\lxxllff.exec:\lxxllff.exe70⤵PID:1508
-
\??\c:\lxrrrrx.exec:\lxrrrrx.exe71⤵PID:2408
-
\??\c:\hhhnnb.exec:\hhhnnb.exe72⤵PID:2764
-
\??\c:\ntbbhh.exec:\ntbbhh.exe73⤵PID:1608
-
\??\c:\tntnnn.exec:\tntnnn.exe74⤵PID:2616
-
\??\c:\vpjvj.exec:\vpjvj.exe75⤵PID:2528
-
\??\c:\jdjpv.exec:\jdjpv.exe76⤵PID:2584
-
\??\c:\7rflllx.exec:\7rflllx.exe77⤵PID:2724
-
\??\c:\1lrrrrl.exec:\1lrrrrl.exe78⤵PID:2596
-
\??\c:\hbnnbh.exec:\hbnnbh.exe79⤵PID:2592
-
\??\c:\ttthth.exec:\ttthth.exe80⤵PID:2484
-
\??\c:\jddjv.exec:\jddjv.exe81⤵PID:2604
-
\??\c:\dpvvj.exec:\dpvvj.exe82⤵PID:2856
-
\??\c:\jvdpj.exec:\jvdpj.exe83⤵PID:2016
-
\??\c:\1xfxxrx.exec:\1xfxxrx.exe84⤵PID:856
-
\??\c:\7lxfrrx.exec:\7lxfrrx.exe85⤵PID:2196
-
\??\c:\nhtnnn.exec:\nhtnnn.exe86⤵PID:1880
-
\??\c:\thtbbb.exec:\thtbbb.exe87⤵PID:2040
-
\??\c:\vdjjp.exec:\vdjjp.exe88⤵PID:1656
-
\??\c:\vpvvd.exec:\vpvvd.exe89⤵PID:1872
-
\??\c:\rfffxxl.exec:\rfffxxl.exe90⤵PID:2248
-
\??\c:\fxllxfx.exec:\fxllxfx.exe91⤵PID:1960
-
\??\c:\3htbbt.exec:\3htbbt.exe92⤵PID:2004
-
\??\c:\hbnthn.exec:\hbnthn.exe93⤵PID:2028
-
\??\c:\nttttt.exec:\nttttt.exe94⤵PID:336
-
\??\c:\dpddj.exec:\dpddj.exe95⤵PID:576
-
\??\c:\3djdd.exec:\3djdd.exe96⤵PID:1712
-
\??\c:\xrxffxf.exec:\xrxffxf.exe97⤵PID:2684
-
\??\c:\5lfffrr.exec:\5lfffrr.exe98⤵PID:2968
-
\??\c:\btnbhh.exec:\btnbhh.exe99⤵PID:2748
-
\??\c:\tbhbtn.exec:\tbhbtn.exe100⤵PID:2312
-
\??\c:\nhthth.exec:\nhthth.exe101⤵PID:584
-
\??\c:\pdvvv.exec:\pdvvv.exe102⤵PID:1104
-
\??\c:\3jppp.exec:\3jppp.exe103⤵PID:2504
-
\??\c:\rrflxxr.exec:\rrflxxr.exe104⤵PID:1984
-
\??\c:\lrllxfx.exec:\lrllxfx.exe105⤵PID:804
-
\??\c:\tnbtbb.exec:\tnbtbb.exe106⤵PID:1740
-
\??\c:\hbhbth.exec:\hbhbth.exe107⤵PID:3000
-
\??\c:\7pdjv.exec:\7pdjv.exe108⤵PID:1736
-
\??\c:\dvpvj.exec:\dvpvj.exe109⤵PID:788
-
\??\c:\3jvdj.exec:\3jvdj.exe110⤵PID:2368
-
\??\c:\lfllrrf.exec:\lfllrrf.exe111⤵PID:1276
-
\??\c:\fxlrrrr.exec:\fxlrrrr.exe112⤵PID:1640
-
\??\c:\bhthhh.exec:\bhthhh.exe113⤵PID:2916
-
\??\c:\btnthn.exec:\btnthn.exe114⤵PID:2540
-
\??\c:\tnhnbb.exec:\tnhnbb.exe115⤵PID:2616
-
\??\c:\vjppv.exec:\vjppv.exe116⤵PID:2580
-
\??\c:\9djdd.exec:\9djdd.exe117⤵PID:2640
-
\??\c:\rlrxxxf.exec:\rlrxxxf.exe118⤵PID:2708
-
\??\c:\fxffllx.exec:\fxffllx.exe119⤵PID:2596
-
\??\c:\nbnthb.exec:\nbnthb.exe120⤵PID:2440
-
\??\c:\3hbhnt.exec:\3hbhnt.exe121⤵PID:2432
-
\??\c:\bnntbt.exec:\bnntbt.exe122⤵PID:2860
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-