Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 06:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f2c61a1f8a30f431647dfdb46d858fa0_NEIKI.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
f2c61a1f8a30f431647dfdb46d858fa0_NEIKI.exe
-
Size
61KB
-
MD5
f2c61a1f8a30f431647dfdb46d858fa0
-
SHA1
40014712723c88a334baa37960620c96b55a23d9
-
SHA256
c45cb58127c01c256110542325203e3aed84cd7c7e0f8b157f679a5b7084855d
-
SHA512
13624dfba08436d86c99da8a56f5e6755eb833335c7a8ff889ce2809b5bf31299e48dfbe198a4ce1d08e322e00652e27f3841ea6f3fea5de9406b1914ab1a419
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDII9ZvHKEn:ymb3NkkiQ3mdBjFII9ZvHKEn
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/1824-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1732-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3044-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3044-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-86-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2508-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1752-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1108-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1596-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2268-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1880-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2160-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1732 nhnthn.exe 3044 pjppd.exe 2708 9xrxrrf.exe 2600 1bttbn.exe 2736 9pvvj.exe 2640 5rlxxxx.exe 2516 hbnntt.exe 2508 nbnntt.exe 2524 dvvdv.exe 2800 1frflfl.exe 2552 bnbbtb.exe 1752 3httbb.exe 1536 jdjpd.exe 2440 vpdvp.exe 2388 fxrrfxf.exe 1020 rfxxlll.exe 1108 nhtbhh.exe 2232 dvdjp.exe 1596 rlffllx.exe 2268 xrrllrx.exe 1880 nhttbb.exe 1032 thnntt.exe 1396 jjpdp.exe 2360 rlxxfxl.exe 2320 rlfflxl.exe 956 1nnnnh.exe 344 bttbhh.exe 2120 dvjjp.exe 1700 rxrrxxx.exe 2160 9rllxfr.exe 3052 nhtttt.exe 1856 nbhhhh.exe 1444 pdjjj.exe 1520 dpvvv.exe 2572 rfrxrrx.exe 3044 1hbhnn.exe 2896 1pddj.exe 2892 ppddd.exe 2600 rlxfrxf.exe 2408 xlrlrrf.exe 2476 nhttbb.exe 2636 1ntbhh.exe 2288 9htbbb.exe 1256 pjpvj.exe 2720 jdpvj.exe 2796 xrfflfx.exe 1572 lxllxff.exe 2552 7hbbhn.exe 1664 tnhntt.exe 1268 pddvj.exe 1112 jdpdj.exe 1196 lfflrlx.exe 856 lflrrxf.exe 2020 hbtbnt.exe 2316 hbhthn.exe 2964 vjvvj.exe 2000 vjddp.exe 1952 xlrflfl.exe 1924 lfrxxrx.exe 476 7nnnnn.exe 1048 nbntbh.exe 1808 bthhtn.exe 2660 7jjvd.exe 1920 dvddd.exe -
resource yara_rule behavioral1/memory/1824-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1824-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1732-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1108-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1596-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2268-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1880-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2160-294-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1824 wrote to memory of 1732 1824 f2c61a1f8a30f431647dfdb46d858fa0_NEIKI.exe 28 PID 1824 wrote to memory of 1732 1824 f2c61a1f8a30f431647dfdb46d858fa0_NEIKI.exe 28 PID 1824 wrote to memory of 1732 1824 f2c61a1f8a30f431647dfdb46d858fa0_NEIKI.exe 28 PID 1824 wrote to memory of 1732 1824 f2c61a1f8a30f431647dfdb46d858fa0_NEIKI.exe 28 PID 1732 wrote to memory of 3044 1732 nhnthn.exe 29 PID 1732 wrote to memory of 3044 1732 nhnthn.exe 29 PID 1732 wrote to memory of 3044 1732 nhnthn.exe 29 PID 1732 wrote to memory of 3044 1732 nhnthn.exe 29 PID 3044 wrote to memory of 2708 3044 pjppd.exe 30 PID 3044 wrote to memory of 2708 3044 pjppd.exe 30 PID 3044 wrote to memory of 2708 3044 pjppd.exe 30 PID 3044 wrote to memory of 2708 3044 pjppd.exe 30 PID 2708 wrote to memory of 2600 2708 9xrxrrf.exe 31 PID 2708 wrote to memory of 2600 2708 9xrxrrf.exe 31 PID 2708 wrote to memory of 2600 2708 9xrxrrf.exe 31 PID 2708 wrote to memory of 2600 2708 9xrxrrf.exe 31 PID 2600 wrote to memory of 2736 2600 1bttbn.exe 32 PID 2600 wrote to memory of 2736 2600 1bttbn.exe 32 PID 2600 wrote to memory of 2736 2600 1bttbn.exe 32 PID 2600 wrote to memory of 2736 2600 1bttbn.exe 32 PID 2736 wrote to memory of 2640 2736 9pvvj.exe 33 PID 2736 wrote to memory of 2640 2736 9pvvj.exe 33 PID 2736 wrote to memory of 2640 2736 9pvvj.exe 33 PID 2736 wrote to memory of 2640 2736 9pvvj.exe 33 PID 2640 wrote to memory of 2516 2640 5rlxxxx.exe 34 PID 2640 wrote to memory of 2516 2640 5rlxxxx.exe 34 PID 2640 wrote to memory of 2516 2640 5rlxxxx.exe 34 PID 2640 wrote to memory of 2516 2640 5rlxxxx.exe 34 PID 2516 wrote to memory of 2508 2516 hbnntt.exe 35 PID 2516 wrote to memory of 2508 2516 hbnntt.exe 35 PID 2516 wrote to memory of 2508 2516 hbnntt.exe 35 PID 2516 wrote to memory of 2508 2516 hbnntt.exe 35 PID 2508 wrote to memory of 2524 2508 nbnntt.exe 36 PID 2508 wrote to memory of 2524 2508 nbnntt.exe 36 PID 2508 wrote to memory of 2524 2508 nbnntt.exe 36 PID 2508 wrote to memory of 2524 2508 nbnntt.exe 36 PID 2524 wrote to memory of 2800 2524 dvvdv.exe 37 PID 2524 wrote to memory of 2800 2524 dvvdv.exe 37 PID 2524 wrote to memory of 2800 2524 dvvdv.exe 37 PID 2524 wrote to memory of 2800 2524 dvvdv.exe 37 PID 2800 wrote to memory of 2552 2800 1frflfl.exe 38 PID 2800 wrote to memory of 2552 2800 1frflfl.exe 38 PID 2800 wrote to memory of 2552 2800 1frflfl.exe 38 PID 2800 wrote to memory of 2552 2800 1frflfl.exe 38 PID 2552 wrote to memory of 1752 2552 bnbbtb.exe 39 PID 2552 wrote to memory of 1752 2552 bnbbtb.exe 39 PID 2552 wrote to memory of 1752 2552 bnbbtb.exe 39 PID 2552 wrote to memory of 1752 2552 bnbbtb.exe 39 PID 1752 wrote to memory of 1536 1752 3httbb.exe 40 PID 1752 wrote to memory of 1536 1752 3httbb.exe 40 PID 1752 wrote to memory of 1536 1752 3httbb.exe 40 PID 1752 wrote to memory of 1536 1752 3httbb.exe 40 PID 1536 wrote to memory of 2440 1536 jdjpd.exe 41 PID 1536 wrote to memory of 2440 1536 jdjpd.exe 41 PID 1536 wrote to memory of 2440 1536 jdjpd.exe 41 PID 1536 wrote to memory of 2440 1536 jdjpd.exe 41 PID 2440 wrote to memory of 2388 2440 vpdvp.exe 42 PID 2440 wrote to memory of 2388 2440 vpdvp.exe 42 PID 2440 wrote to memory of 2388 2440 vpdvp.exe 42 PID 2440 wrote to memory of 2388 2440 vpdvp.exe 42 PID 2388 wrote to memory of 1020 2388 fxrrfxf.exe 43 PID 2388 wrote to memory of 1020 2388 fxrrfxf.exe 43 PID 2388 wrote to memory of 1020 2388 fxrrfxf.exe 43 PID 2388 wrote to memory of 1020 2388 fxrrfxf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2c61a1f8a30f431647dfdb46d858fa0_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\f2c61a1f8a30f431647dfdb46d858fa0_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\nhnthn.exec:\nhnthn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\pjppd.exec:\pjppd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\9xrxrrf.exec:\9xrxrrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\1bttbn.exec:\1bttbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\9pvvj.exec:\9pvvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\5rlxxxx.exec:\5rlxxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\hbnntt.exec:\hbnntt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\nbnntt.exec:\nbnntt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\dvvdv.exec:\dvvdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\1frflfl.exec:\1frflfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\bnbbtb.exec:\bnbbtb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\3httbb.exec:\3httbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\jdjpd.exec:\jdjpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\vpdvp.exec:\vpdvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\fxrrfxf.exec:\fxrrfxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\rfxxlll.exec:\rfxxlll.exe17⤵
- Executes dropped EXE
PID:1020 -
\??\c:\nhtbhh.exec:\nhtbhh.exe18⤵
- Executes dropped EXE
PID:1108 -
\??\c:\dvdjp.exec:\dvdjp.exe19⤵
- Executes dropped EXE
PID:2232 -
\??\c:\rlffllx.exec:\rlffllx.exe20⤵
- Executes dropped EXE
PID:1596 -
\??\c:\xrrllrx.exec:\xrrllrx.exe21⤵
- Executes dropped EXE
PID:2268 -
\??\c:\nhttbb.exec:\nhttbb.exe22⤵
- Executes dropped EXE
PID:1880 -
\??\c:\thnntt.exec:\thnntt.exe23⤵
- Executes dropped EXE
PID:1032 -
\??\c:\jjpdp.exec:\jjpdp.exe24⤵
- Executes dropped EXE
PID:1396 -
\??\c:\rlxxfxl.exec:\rlxxfxl.exe25⤵
- Executes dropped EXE
PID:2360 -
\??\c:\rlfflxl.exec:\rlfflxl.exe26⤵
- Executes dropped EXE
PID:2320 -
\??\c:\1nnnnh.exec:\1nnnnh.exe27⤵
- Executes dropped EXE
PID:956 -
\??\c:\bttbhh.exec:\bttbhh.exe28⤵
- Executes dropped EXE
PID:344 -
\??\c:\dvjjp.exec:\dvjjp.exe29⤵
- Executes dropped EXE
PID:2120 -
\??\c:\rxrrxxx.exec:\rxrrxxx.exe30⤵
- Executes dropped EXE
PID:1700 -
\??\c:\9rllxfr.exec:\9rllxfr.exe31⤵
- Executes dropped EXE
PID:2160 -
\??\c:\nhtttt.exec:\nhtttt.exe32⤵
- Executes dropped EXE
PID:3052 -
\??\c:\nbhhhh.exec:\nbhhhh.exe33⤵
- Executes dropped EXE
PID:1856 -
\??\c:\pdjjj.exec:\pdjjj.exe34⤵
- Executes dropped EXE
PID:1444 -
\??\c:\dpvvv.exec:\dpvvv.exe35⤵
- Executes dropped EXE
PID:1520 -
\??\c:\rfrxrrx.exec:\rfrxrrx.exe36⤵
- Executes dropped EXE
PID:2572 -
\??\c:\1hbhnn.exec:\1hbhnn.exe37⤵
- Executes dropped EXE
PID:3044 -
\??\c:\1pddj.exec:\1pddj.exe38⤵
- Executes dropped EXE
PID:2896 -
\??\c:\ppddd.exec:\ppddd.exe39⤵
- Executes dropped EXE
PID:2892 -
\??\c:\rlxfrxf.exec:\rlxfrxf.exe40⤵
- Executes dropped EXE
PID:2600 -
\??\c:\xlrlrrf.exec:\xlrlrrf.exe41⤵
- Executes dropped EXE
PID:2408 -
\??\c:\nhttbb.exec:\nhttbb.exe42⤵
- Executes dropped EXE
PID:2476 -
\??\c:\1ntbhh.exec:\1ntbhh.exe43⤵
- Executes dropped EXE
PID:2636 -
\??\c:\9htbbb.exec:\9htbbb.exe44⤵
- Executes dropped EXE
PID:2288 -
\??\c:\pjpvj.exec:\pjpvj.exe45⤵
- Executes dropped EXE
PID:1256 -
\??\c:\jdpvj.exec:\jdpvj.exe46⤵
- Executes dropped EXE
PID:2720 -
\??\c:\xrfflfx.exec:\xrfflfx.exe47⤵
- Executes dropped EXE
PID:2796 -
\??\c:\lxllxff.exec:\lxllxff.exe48⤵
- Executes dropped EXE
PID:1572 -
\??\c:\7hbbhn.exec:\7hbbhn.exe49⤵
- Executes dropped EXE
PID:2552 -
\??\c:\tnhntt.exec:\tnhntt.exe50⤵
- Executes dropped EXE
PID:1664 -
\??\c:\pddvj.exec:\pddvj.exe51⤵
- Executes dropped EXE
PID:1268 -
\??\c:\jdpdj.exec:\jdpdj.exe52⤵
- Executes dropped EXE
PID:1112 -
\??\c:\lfflrlx.exec:\lfflrlx.exe53⤵
- Executes dropped EXE
PID:1196 -
\??\c:\lflrrxf.exec:\lflrrxf.exe54⤵
- Executes dropped EXE
PID:856 -
\??\c:\hbtbnt.exec:\hbtbnt.exe55⤵
- Executes dropped EXE
PID:2020 -
\??\c:\hbhthn.exec:\hbhthn.exe56⤵
- Executes dropped EXE
PID:2316 -
\??\c:\vjvvj.exec:\vjvvj.exe57⤵
- Executes dropped EXE
PID:2964 -
\??\c:\vjddp.exec:\vjddp.exe58⤵
- Executes dropped EXE
PID:2000 -
\??\c:\xlrflfl.exec:\xlrflfl.exe59⤵
- Executes dropped EXE
PID:1952 -
\??\c:\lfrxxrx.exec:\lfrxxrx.exe60⤵
- Executes dropped EXE
PID:1924 -
\??\c:\7nnnnn.exec:\7nnnnn.exe61⤵
- Executes dropped EXE
PID:476 -
\??\c:\nbntbh.exec:\nbntbh.exe62⤵
- Executes dropped EXE
PID:1048 -
\??\c:\bthhtn.exec:\bthhtn.exe63⤵
- Executes dropped EXE
PID:1808 -
\??\c:\7jjvd.exec:\7jjvd.exe64⤵
- Executes dropped EXE
PID:2660 -
\??\c:\dvddd.exec:\dvddd.exe65⤵
- Executes dropped EXE
PID:1920 -
\??\c:\rfxxlll.exec:\rfxxlll.exe66⤵PID:752
-
\??\c:\1lllffr.exec:\1lllffr.exe67⤵PID:352
-
\??\c:\hbhntt.exec:\hbhntt.exe68⤵PID:2180
-
\??\c:\hbtthb.exec:\hbtthb.exe69⤵PID:1568
-
\??\c:\9pjjp.exec:\9pjjp.exe70⤵PID:2120
-
\??\c:\vpjpv.exec:\vpjpv.exe71⤵PID:2208
-
\??\c:\lfrxflr.exec:\lfrxflr.exe72⤵PID:1588
-
\??\c:\lxrlrrx.exec:\lxrlrrx.exe73⤵PID:2412
-
\??\c:\tnthnn.exec:\tnthnn.exe74⤵PID:2056
-
\??\c:\nhnntt.exec:\nhnntt.exe75⤵PID:1856
-
\??\c:\1dpvd.exec:\1dpvd.exe76⤵PID:2960
-
\??\c:\dvddj.exec:\dvddj.exe77⤵PID:2700
-
\??\c:\9lflffl.exec:\9lflffl.exe78⤵PID:2760
-
\??\c:\ntbbnn.exec:\ntbbnn.exe79⤵PID:3044
-
\??\c:\thtnnh.exec:\thtnnh.exe80⤵PID:2764
-
\??\c:\pdpjv.exec:\pdpjv.exe81⤵PID:2892
-
\??\c:\pjddp.exec:\pjddp.exe82⤵PID:2512
-
\??\c:\9rrfrrx.exec:\9rrfrrx.exe83⤵PID:2408
-
\??\c:\lfxlxlx.exec:\lfxlxlx.exe84⤵PID:2460
-
\??\c:\hbnnbh.exec:\hbnnbh.exe85⤵PID:2636
-
\??\c:\hhbhnb.exec:\hhbhnb.exe86⤵PID:3056
-
\??\c:\vpjjd.exec:\vpjjd.exe87⤵PID:1640
-
\??\c:\xxxfrrr.exec:\xxxfrrr.exe88⤵PID:2704
-
\??\c:\llrrxfl.exec:\llrrxfl.exe89⤵PID:2796
-
\??\c:\1nnhtb.exec:\1nnhtb.exe90⤵PID:1784
-
\??\c:\nhtntt.exec:\nhtntt.exe91⤵PID:2552
-
\??\c:\7jddp.exec:\7jddp.exe92⤵PID:1664
-
\??\c:\5pjjj.exec:\5pjjj.exe93⤵PID:1268
-
\??\c:\ffrxflr.exec:\ffrxflr.exe94⤵PID:1248
-
\??\c:\3tntbb.exec:\3tntbb.exe95⤵PID:1196
-
\??\c:\3nnhhh.exec:\3nnhhh.exe96⤵PID:1020
-
\??\c:\djvvj.exec:\djvvj.exe97⤵PID:2020
-
\??\c:\jvjpp.exec:\jvjpp.exe98⤵PID:2988
-
\??\c:\xlxxxxf.exec:\xlxxxxf.exe99⤵PID:2964
-
\??\c:\1rfxflr.exec:\1rfxflr.exe100⤵PID:1932
-
\??\c:\thtbhb.exec:\thtbhb.exe101⤵PID:1952
-
\??\c:\tnhhnn.exec:\tnhhnn.exe102⤵PID:584
-
\??\c:\vjjjv.exec:\vjjjv.exe103⤵PID:2816
-
\??\c:\jjddd.exec:\jjddd.exe104⤵PID:1724
-
\??\c:\lfxffxx.exec:\lfxffxx.exe105⤵PID:744
-
\??\c:\lfxrxfr.exec:\lfxrxfr.exe106⤵PID:408
-
\??\c:\nhbbnt.exec:\nhbbnt.exe107⤵PID:2360
-
\??\c:\3bnnnn.exec:\3bnnnn.exe108⤵PID:1888
-
\??\c:\pjvvd.exec:\pjvvd.exe109⤵PID:1512
-
\??\c:\vpjpd.exec:\vpjpd.exe110⤵PID:2060
-
\??\c:\lfflllr.exec:\lfflllr.exe111⤵PID:1568
-
\??\c:\rlfxrxf.exec:\rlfxrxf.exe112⤵PID:2064
-
\??\c:\hbnnbb.exec:\hbnnbb.exe113⤵PID:2208
-
\??\c:\hbntbh.exec:\hbntbh.exe114⤵PID:1864
-
\??\c:\vpdvd.exec:\vpdvd.exe115⤵PID:2772
-
\??\c:\7pjpv.exec:\7pjpv.exe116⤵PID:2248
-
\??\c:\rlxrffl.exec:\rlxrffl.exe117⤵PID:1444
-
\??\c:\lflrflf.exec:\lflrflf.exe118⤵PID:1520
-
\??\c:\nbnnbb.exec:\nbnnbb.exe119⤵PID:2572
-
\??\c:\hthntt.exec:\hthntt.exe120⤵PID:2908
-
\??\c:\vjppp.exec:\vjppp.exe121⤵PID:2896
-
\??\c:\vvjjv.exec:\vvjjv.exe122⤵PID:2652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-