Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08-05-2024 09:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4171835f7db51b82965ac2fb82fb8d60_NEIKI.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4171835f7db51b82965ac2fb82fb8d60_NEIKI.exe
-
Size
135KB
-
MD5
4171835f7db51b82965ac2fb82fb8d60
-
SHA1
1b0a7345f56eb710d7d4ac5fb0c88e0ce4fd3885
-
SHA256
49a5d99c281d4b1bb4a32f00ce36fe31fe3d417b49ccfe9fb2fea3915ccc6ae8
-
SHA512
62bd3ff663622d35349af16cdfc8a9cfe68ce4634c4b451b50c398306dc8924482971070f8b78adbac6678ea3d18be142ebf77a2dfafaae3b3e150ca944f91fd
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afoHVpx+dGoEjZeiV:n3C9BRW0j/1px+dG3FV
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/3000-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/108-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2276-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1808-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2184-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/860-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2164-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1688-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/772-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1744-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/920-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1636-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/640-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 108 fxllrlr.exe 2952 nhnttn.exe 2592 7jvpj.exe 2504 xlxrlxx.exe 2420 thhbnt.exe 2644 1pdjp.exe 2416 3jddj.exe 2436 xlrxffx.exe 1984 htnhnn.exe 2684 hbhnbh.exe 2736 pjddp.exe 2276 pdvvp.exe 1808 rfrxfff.exe 2184 bbnntb.exe 860 nhtthb.exe 2164 jdpvj.exe 1688 5lxrfrr.exe 772 bthbhb.exe 1744 nnthbt.exe 2780 1dvjv.exe 380 fxrrffl.exe 756 fxrrffr.exe 1600 hbnttn.exe 2764 7pdpp.exe 3060 fllrxrf.exe 808 fxxfrfl.exe 920 vjvpv.exe 2844 1pjvj.exe 1636 rrlrrll.exe 640 hbtbnn.exe 624 nhnhnn.exe 1528 pjvjp.exe 2668 jdjdj.exe 2528 5rrflrl.exe 1812 frfrfrl.exe 2520 hntbhb.exe 3036 jdpjp.exe 2672 ddddv.exe 2640 1jvdj.exe 2660 frxrxll.exe 2396 xrfllrf.exe 2644 tnntbb.exe 1856 hbtttt.exe 2880 dpdvd.exe 2560 dpppv.exe 2472 vvvvj.exe 2696 lflfllr.exe 844 llrxrfl.exe 1236 nhhhhh.exe 1960 tnnhbb.exe 2024 bnnnnn.exe 1256 vpdvd.exe 292 vjppp.exe 1652 5xxxllx.exe 2556 3fxlrrx.exe 1752 fxlxflr.exe 2084 3tnbhn.exe 2328 nhhntb.exe 536 nhthbh.exe 404 jdvdp.exe 1444 dvddj.exe 1432 dvpvv.exe 1156 fxllrrx.exe 964 hbhnnt.exe -
resource yara_rule behavioral1/memory/3000-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/108-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2276-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1808-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/860-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2164-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1688-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/772-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1744-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/920-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1636-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/640-288-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3000 wrote to memory of 108 3000 4171835f7db51b82965ac2fb82fb8d60_NEIKI.exe 28 PID 3000 wrote to memory of 108 3000 4171835f7db51b82965ac2fb82fb8d60_NEIKI.exe 28 PID 3000 wrote to memory of 108 3000 4171835f7db51b82965ac2fb82fb8d60_NEIKI.exe 28 PID 3000 wrote to memory of 108 3000 4171835f7db51b82965ac2fb82fb8d60_NEIKI.exe 28 PID 108 wrote to memory of 2952 108 fxllrlr.exe 29 PID 108 wrote to memory of 2952 108 fxllrlr.exe 29 PID 108 wrote to memory of 2952 108 fxllrlr.exe 29 PID 108 wrote to memory of 2952 108 fxllrlr.exe 29 PID 2952 wrote to memory of 2592 2952 nhnttn.exe 30 PID 2952 wrote to memory of 2592 2952 nhnttn.exe 30 PID 2952 wrote to memory of 2592 2952 nhnttn.exe 30 PID 2952 wrote to memory of 2592 2952 nhnttn.exe 30 PID 2592 wrote to memory of 2504 2592 7jvpj.exe 31 PID 2592 wrote to memory of 2504 2592 7jvpj.exe 31 PID 2592 wrote to memory of 2504 2592 7jvpj.exe 31 PID 2592 wrote to memory of 2504 2592 7jvpj.exe 31 PID 2504 wrote to memory of 2420 2504 xlxrlxx.exe 32 PID 2504 wrote to memory of 2420 2504 xlxrlxx.exe 32 PID 2504 wrote to memory of 2420 2504 xlxrlxx.exe 32 PID 2504 wrote to memory of 2420 2504 xlxrlxx.exe 32 PID 2420 wrote to memory of 2644 2420 thhbnt.exe 33 PID 2420 wrote to memory of 2644 2420 thhbnt.exe 33 PID 2420 wrote to memory of 2644 2420 thhbnt.exe 33 PID 2420 wrote to memory of 2644 2420 thhbnt.exe 33 PID 2644 wrote to memory of 2416 2644 1pdjp.exe 34 PID 2644 wrote to memory of 2416 2644 1pdjp.exe 34 PID 2644 wrote to memory of 2416 2644 1pdjp.exe 34 PID 2644 wrote to memory of 2416 2644 1pdjp.exe 34 PID 2416 wrote to memory of 2436 2416 3jddj.exe 35 PID 2416 wrote to memory of 2436 2416 3jddj.exe 35 PID 2416 wrote to memory of 2436 2416 3jddj.exe 35 PID 2416 wrote to memory of 2436 2416 3jddj.exe 35 PID 2436 wrote to memory of 1984 2436 xlrxffx.exe 36 PID 2436 wrote to memory of 1984 2436 xlrxffx.exe 36 PID 2436 wrote to memory of 1984 2436 xlrxffx.exe 36 PID 2436 wrote to memory of 1984 2436 xlrxffx.exe 36 PID 1984 wrote to memory of 2684 1984 htnhnn.exe 37 PID 1984 wrote to memory of 2684 1984 htnhnn.exe 37 PID 1984 wrote to memory of 2684 1984 htnhnn.exe 37 PID 1984 wrote to memory of 2684 1984 htnhnn.exe 37 PID 2684 wrote to memory of 2736 2684 hbhnbh.exe 38 PID 2684 wrote to memory of 2736 2684 hbhnbh.exe 38 PID 2684 wrote to memory of 2736 2684 hbhnbh.exe 38 PID 2684 wrote to memory of 2736 2684 hbhnbh.exe 38 PID 2736 wrote to memory of 2276 2736 pjddp.exe 39 PID 2736 wrote to memory of 2276 2736 pjddp.exe 39 PID 2736 wrote to memory of 2276 2736 pjddp.exe 39 PID 2736 wrote to memory of 2276 2736 pjddp.exe 39 PID 2276 wrote to memory of 1808 2276 pdvvp.exe 40 PID 2276 wrote to memory of 1808 2276 pdvvp.exe 40 PID 2276 wrote to memory of 1808 2276 pdvvp.exe 40 PID 2276 wrote to memory of 1808 2276 pdvvp.exe 40 PID 1808 wrote to memory of 2184 1808 rfrxfff.exe 41 PID 1808 wrote to memory of 2184 1808 rfrxfff.exe 41 PID 1808 wrote to memory of 2184 1808 rfrxfff.exe 41 PID 1808 wrote to memory of 2184 1808 rfrxfff.exe 41 PID 2184 wrote to memory of 860 2184 bbnntb.exe 42 PID 2184 wrote to memory of 860 2184 bbnntb.exe 42 PID 2184 wrote to memory of 860 2184 bbnntb.exe 42 PID 2184 wrote to memory of 860 2184 bbnntb.exe 42 PID 860 wrote to memory of 2164 860 nhtthb.exe 43 PID 860 wrote to memory of 2164 860 nhtthb.exe 43 PID 860 wrote to memory of 2164 860 nhtthb.exe 43 PID 860 wrote to memory of 2164 860 nhtthb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\4171835f7db51b82965ac2fb82fb8d60_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\4171835f7db51b82965ac2fb82fb8d60_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\fxllrlr.exec:\fxllrlr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:108 -
\??\c:\nhnttn.exec:\nhnttn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\7jvpj.exec:\7jvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\xlxrlxx.exec:\xlxrlxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\thhbnt.exec:\thhbnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\1pdjp.exec:\1pdjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\3jddj.exec:\3jddj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\xlrxffx.exec:\xlrxffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\htnhnn.exec:\htnhnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\hbhnbh.exec:\hbhnbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\pjddp.exec:\pjddp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\pdvvp.exec:\pdvvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\rfrxfff.exec:\rfrxfff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\bbnntb.exec:\bbnntb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\nhtthb.exec:\nhtthb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\jdpvj.exec:\jdpvj.exe17⤵
- Executes dropped EXE
PID:2164 -
\??\c:\5lxrfrr.exec:\5lxrfrr.exe18⤵
- Executes dropped EXE
PID:1688 -
\??\c:\bthbhb.exec:\bthbhb.exe19⤵
- Executes dropped EXE
PID:772 -
\??\c:\nnthbt.exec:\nnthbt.exe20⤵
- Executes dropped EXE
PID:1744 -
\??\c:\1dvjv.exec:\1dvjv.exe21⤵
- Executes dropped EXE
PID:2780 -
\??\c:\fxrrffl.exec:\fxrrffl.exe22⤵
- Executes dropped EXE
PID:380 -
\??\c:\fxrrffr.exec:\fxrrffr.exe23⤵
- Executes dropped EXE
PID:756 -
\??\c:\hbnttn.exec:\hbnttn.exe24⤵
- Executes dropped EXE
PID:1600 -
\??\c:\7pdpp.exec:\7pdpp.exe25⤵
- Executes dropped EXE
PID:2764 -
\??\c:\fllrxrf.exec:\fllrxrf.exe26⤵
- Executes dropped EXE
PID:3060 -
\??\c:\fxxfrfl.exec:\fxxfrfl.exe27⤵
- Executes dropped EXE
PID:808 -
\??\c:\vjvpv.exec:\vjvpv.exe28⤵
- Executes dropped EXE
PID:920 -
\??\c:\1pjvj.exec:\1pjvj.exe29⤵
- Executes dropped EXE
PID:2844 -
\??\c:\rrlrrll.exec:\rrlrrll.exe30⤵
- Executes dropped EXE
PID:1636 -
\??\c:\hbtbnn.exec:\hbtbnn.exe31⤵
- Executes dropped EXE
PID:640 -
\??\c:\nhnhnn.exec:\nhnhnn.exe32⤵
- Executes dropped EXE
PID:624 -
\??\c:\pjvjp.exec:\pjvjp.exe33⤵
- Executes dropped EXE
PID:1528 -
\??\c:\jdjdj.exec:\jdjdj.exe34⤵
- Executes dropped EXE
PID:2668 -
\??\c:\5rrflrl.exec:\5rrflrl.exe35⤵
- Executes dropped EXE
PID:2528 -
\??\c:\frfrfrl.exec:\frfrfrl.exe36⤵
- Executes dropped EXE
PID:1812 -
\??\c:\hntbhb.exec:\hntbhb.exe37⤵
- Executes dropped EXE
PID:2520 -
\??\c:\jdpjp.exec:\jdpjp.exe38⤵
- Executes dropped EXE
PID:3036 -
\??\c:\ddddv.exec:\ddddv.exe39⤵
- Executes dropped EXE
PID:2672 -
\??\c:\1jvdj.exec:\1jvdj.exe40⤵
- Executes dropped EXE
PID:2640 -
\??\c:\frxrxll.exec:\frxrxll.exe41⤵
- Executes dropped EXE
PID:2660 -
\??\c:\xrfllrf.exec:\xrfllrf.exe42⤵
- Executes dropped EXE
PID:2396 -
\??\c:\tnntbb.exec:\tnntbb.exe43⤵
- Executes dropped EXE
PID:2644 -
\??\c:\hbtttt.exec:\hbtttt.exe44⤵
- Executes dropped EXE
PID:1856 -
\??\c:\dpdvd.exec:\dpdvd.exe45⤵
- Executes dropped EXE
PID:2880 -
\??\c:\dpppv.exec:\dpppv.exe46⤵
- Executes dropped EXE
PID:2560 -
\??\c:\vvvvj.exec:\vvvvj.exe47⤵
- Executes dropped EXE
PID:2472 -
\??\c:\lflfllr.exec:\lflfllr.exe48⤵
- Executes dropped EXE
PID:2696 -
\??\c:\llrxrfl.exec:\llrxrfl.exe49⤵
- Executes dropped EXE
PID:844 -
\??\c:\nhhhhh.exec:\nhhhhh.exe50⤵
- Executes dropped EXE
PID:1236 -
\??\c:\tnnhbb.exec:\tnnhbb.exe51⤵
- Executes dropped EXE
PID:1960 -
\??\c:\bnnnnn.exec:\bnnnnn.exe52⤵
- Executes dropped EXE
PID:2024 -
\??\c:\vpdvd.exec:\vpdvd.exe53⤵
- Executes dropped EXE
PID:1256 -
\??\c:\vjppp.exec:\vjppp.exe54⤵
- Executes dropped EXE
PID:292 -
\??\c:\5xxxllx.exec:\5xxxllx.exe55⤵
- Executes dropped EXE
PID:1652 -
\??\c:\3fxlrrx.exec:\3fxlrrx.exe56⤵
- Executes dropped EXE
PID:2556 -
\??\c:\fxlxflr.exec:\fxlxflr.exe57⤵
- Executes dropped EXE
PID:1752 -
\??\c:\3tnbhn.exec:\3tnbhn.exe58⤵
- Executes dropped EXE
PID:2084 -
\??\c:\nhhntb.exec:\nhhntb.exe59⤵
- Executes dropped EXE
PID:2328 -
\??\c:\nhthbh.exec:\nhthbh.exe60⤵
- Executes dropped EXE
PID:536 -
\??\c:\jdvdp.exec:\jdvdp.exe61⤵
- Executes dropped EXE
PID:404 -
\??\c:\dvddj.exec:\dvddj.exe62⤵
- Executes dropped EXE
PID:1444 -
\??\c:\dvpvv.exec:\dvpvv.exe63⤵
- Executes dropped EXE
PID:1432 -
\??\c:\fxllrrx.exec:\fxllrrx.exe64⤵
- Executes dropped EXE
PID:1156 -
\??\c:\hbhnnt.exec:\hbhnnt.exe65⤵
- Executes dropped EXE
PID:964 -
\??\c:\tnbhnn.exec:\tnbhnn.exe66⤵PID:1304
-
\??\c:\bnhhtt.exec:\bnhhtt.exe67⤵PID:412
-
\??\c:\jjvdd.exec:\jjvdd.exe68⤵PID:1604
-
\??\c:\vjvpv.exec:\vjvpv.exe69⤵PID:920
-
\??\c:\fxxrrrf.exec:\fxxrrrf.exe70⤵PID:2464
-
\??\c:\llrflrx.exec:\llrflrx.exe71⤵PID:2264
-
\??\c:\fxllrxf.exec:\fxllrxf.exe72⤵PID:2092
-
\??\c:\nbbbhn.exec:\nbbbhn.exe73⤵PID:2192
-
\??\c:\btbttb.exec:\btbttb.exe74⤵PID:1692
-
\??\c:\bnntbh.exec:\bnntbh.exe75⤵PID:2488
-
\??\c:\ppddd.exec:\ppddd.exe76⤵PID:3004
-
\??\c:\dvpvp.exec:\dvpvp.exe77⤵PID:1520
-
\??\c:\pjvvv.exec:\pjvvv.exe78⤵PID:2872
-
\??\c:\1xrlrlr.exec:\1xrlrlr.exe79⤵PID:2536
-
\??\c:\rlxlxfl.exec:\rlxlxfl.exe80⤵PID:2636
-
\??\c:\rlffrrf.exec:\rlffrrf.exe81⤵PID:2796
-
\??\c:\bhnhnt.exec:\bhnhnt.exe82⤵PID:2776
-
\??\c:\5vppd.exec:\5vppd.exe83⤵PID:2552
-
\??\c:\jjdpd.exec:\jjdpd.exe84⤵PID:2432
-
\??\c:\vpvvv.exec:\vpvvv.exe85⤵PID:2400
-
\??\c:\xrxfllr.exec:\xrxfllr.exe86⤵PID:2272
-
\??\c:\fxrflrf.exec:\fxrflrf.exe87⤵PID:2896
-
\??\c:\fxllffl.exec:\fxllffl.exe88⤵PID:1984
-
\??\c:\bthbbn.exec:\bthbbn.exe89⤵PID:2608
-
\??\c:\ttntth.exec:\ttntth.exe90⤵PID:2716
-
\??\c:\bhhntt.exec:\bhhntt.exe91⤵PID:840
-
\??\c:\jddpd.exec:\jddpd.exe92⤵PID:1768
-
\??\c:\pjpjp.exec:\pjpjp.exe93⤵PID:2000
-
\??\c:\dppvv.exec:\dppvv.exe94⤵PID:2196
-
\??\c:\1xxxlrx.exec:\1xxxlrx.exe95⤵PID:1028
-
\??\c:\rlfxflf.exec:\rlfxflf.exe96⤵PID:1672
-
\??\c:\rlxxlfr.exec:\rlxxlfr.exe97⤵PID:2164
-
\??\c:\bthhnn.exec:\bthhnn.exe98⤵PID:2996
-
\??\c:\9ntnhn.exec:\9ntnhn.exe99⤵PID:2876
-
\??\c:\pjvvj.exec:\pjvvj.exe100⤵PID:2620
-
\??\c:\jdvdj.exec:\jdvdj.exe101⤵PID:2208
-
\??\c:\vvppv.exec:\vvppv.exe102⤵PID:604
-
\??\c:\xrffrrf.exec:\xrffrrf.exe103⤵PID:1348
-
\??\c:\rlxfllf.exec:\rlxfllf.exe104⤵PID:572
-
\??\c:\fxrrflx.exec:\fxrrflx.exe105⤵PID:1896
-
\??\c:\5nhthh.exec:\5nhthh.exe106⤵PID:1864
-
\??\c:\hthnnt.exec:\hthnnt.exe107⤵PID:776
-
\??\c:\5vjdj.exec:\5vjdj.exe108⤵PID:1712
-
\??\c:\vvppd.exec:\vvppd.exe109⤵PID:1732
-
\??\c:\1pvdj.exec:\1pvdj.exe110⤵PID:748
-
\??\c:\9xrxxfr.exec:\9xrxxfr.exe111⤵PID:1376
-
\??\c:\rxffffl.exec:\rxffffl.exe112⤵PID:2108
-
\??\c:\nbtbhn.exec:\nbtbhn.exe113⤵PID:1636
-
\??\c:\btthbb.exec:\btthbb.exe114⤵PID:904
-
\??\c:\thtnnt.exec:\thtnnt.exe115⤵PID:1100
-
\??\c:\pjppd.exec:\pjppd.exe116⤵PID:1528
-
\??\c:\dvpvp.exec:\dvpvp.exe117⤵PID:108
-
\??\c:\xlxxxfl.exec:\xlxxxfl.exe118⤵PID:280
-
\??\c:\fxlllrf.exec:\fxlllrf.exe119⤵PID:2584
-
\??\c:\tnnntt.exec:\tnnntt.exe120⤵PID:2816
-
\??\c:\nhhttb.exec:\nhhttb.exe121⤵PID:2596
-
\??\c:\jjdpj.exec:\jjdpj.exe122⤵PID:2508
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-