Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 04:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ea2c66a10180b08d0d45a46cea1919a0_NEIKI.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
ea2c66a10180b08d0d45a46cea1919a0_NEIKI.exe
-
Size
86KB
-
MD5
ea2c66a10180b08d0d45a46cea1919a0
-
SHA1
c1cb5b936c46556408177dbd06277d497622df75
-
SHA256
ac67b343d1222556336ac1ee1f57052cebc131ca9ea860df005e8b57b4098757
-
SHA512
ecb76bf0854405fd605035d7883dc620052a65edd4e374f1af40e0ad20b4dadc3e6bd79a852d1180ae449fa0087c7e44cd4be4f738afd10256064aa90563c7d7
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDodtzac0Hobv0byLufTJD:ymb3NkkiQ3mdBjFodt27HobvcyLufND
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2072-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2092-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2132-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1616-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/828-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1576-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1268-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3000 rrfrllx.exe 2092 btnntb.exe 3036 1llxlfr.exe 2704 tthhnn.exe 2716 pvjvd.exe 2516 jdddj.exe 2536 3btbhh.exe 2556 ppvdv.exe 2132 vvpdv.exe 1616 lxfrxff.exe 2548 bhntbh.exe 2776 htnbnn.exe 1740 ddvdj.exe 2416 5flrxrx.exe 1868 hbnbnb.exe 1892 thhnnn.exe 756 vpdvj.exe 828 jjdpp.exe 2212 1ffxrfr.exe 2032 1nbbhh.exe 2844 nnhntb.exe 2848 pdpvd.exe 908 fxllxfl.exe 1340 3ffxlrl.exe 1576 nnnbbh.exe 1328 vvjdj.exe 1268 xrlflrf.exe 940 3hbhnn.exe 2036 hbhhnn.exe 2948 7pjvd.exe 2992 ffxxrrl.exe 2560 bbtbhh.exe 2268 bbnthh.exe 3004 vpdpv.exe 1592 9xrrxfl.exe 3012 3rrxlrx.exe 2624 tnhntb.exe 2680 btnthn.exe 2636 5jjvd.exe 2704 pjdvj.exe 2640 llfrflx.exe 2616 rrrfxlf.exe 2652 tthbnn.exe 2544 3bnnbb.exe 2908 jjvvd.exe 2932 ddjjp.exe 1408 rlxxfff.exe 1824 xrfrxrr.exe 2756 1llxllr.exe 2380 tthbnt.exe 1500 nhnbnt.exe 2392 jjpvj.exe 2416 1ppjp.exe 1868 7xrxlxl.exe 1620 xrlrxfl.exe 1284 9hhbnt.exe 1260 thtnth.exe 2372 vjvvv.exe 2212 dpdvv.exe 2836 ffffxfx.exe 1216 vvpdj.exe 476 jdpjj.exe 580 7rxflrx.exe 1460 3lfflrf.exe -
resource yara_rule behavioral1/memory/2072-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2132-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1616-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/828-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1576-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1268-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-303-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2072 wrote to memory of 3000 2072 ea2c66a10180b08d0d45a46cea1919a0_NEIKI.exe 28 PID 2072 wrote to memory of 3000 2072 ea2c66a10180b08d0d45a46cea1919a0_NEIKI.exe 28 PID 2072 wrote to memory of 3000 2072 ea2c66a10180b08d0d45a46cea1919a0_NEIKI.exe 28 PID 2072 wrote to memory of 3000 2072 ea2c66a10180b08d0d45a46cea1919a0_NEIKI.exe 28 PID 3000 wrote to memory of 2092 3000 rrfrllx.exe 29 PID 3000 wrote to memory of 2092 3000 rrfrllx.exe 29 PID 3000 wrote to memory of 2092 3000 rrfrllx.exe 29 PID 3000 wrote to memory of 2092 3000 rrfrllx.exe 29 PID 2092 wrote to memory of 3036 2092 btnntb.exe 30 PID 2092 wrote to memory of 3036 2092 btnntb.exe 30 PID 2092 wrote to memory of 3036 2092 btnntb.exe 30 PID 2092 wrote to memory of 3036 2092 btnntb.exe 30 PID 3036 wrote to memory of 2704 3036 1llxlfr.exe 31 PID 3036 wrote to memory of 2704 3036 1llxlfr.exe 31 PID 3036 wrote to memory of 2704 3036 1llxlfr.exe 31 PID 3036 wrote to memory of 2704 3036 1llxlfr.exe 31 PID 2704 wrote to memory of 2716 2704 tthhnn.exe 32 PID 2704 wrote to memory of 2716 2704 tthhnn.exe 32 PID 2704 wrote to memory of 2716 2704 tthhnn.exe 32 PID 2704 wrote to memory of 2716 2704 tthhnn.exe 32 PID 2716 wrote to memory of 2516 2716 pvjvd.exe 33 PID 2716 wrote to memory of 2516 2716 pvjvd.exe 33 PID 2716 wrote to memory of 2516 2716 pvjvd.exe 33 PID 2716 wrote to memory of 2516 2716 pvjvd.exe 33 PID 2516 wrote to memory of 2536 2516 jdddj.exe 34 PID 2516 wrote to memory of 2536 2516 jdddj.exe 34 PID 2516 wrote to memory of 2536 2516 jdddj.exe 34 PID 2516 wrote to memory of 2536 2516 jdddj.exe 34 PID 2536 wrote to memory of 2556 2536 3btbhh.exe 35 PID 2536 wrote to memory of 2556 2536 3btbhh.exe 35 PID 2536 wrote to memory of 2556 2536 3btbhh.exe 35 PID 2536 wrote to memory of 2556 2536 3btbhh.exe 35 PID 2556 wrote to memory of 2132 2556 ppvdv.exe 36 PID 2556 wrote to memory of 2132 2556 ppvdv.exe 36 PID 2556 wrote to memory of 2132 2556 ppvdv.exe 36 PID 2556 wrote to memory of 2132 2556 ppvdv.exe 36 PID 2132 wrote to memory of 1616 2132 vvpdv.exe 37 PID 2132 wrote to memory of 1616 2132 vvpdv.exe 37 PID 2132 wrote to memory of 1616 2132 vvpdv.exe 37 PID 2132 wrote to memory of 1616 2132 vvpdv.exe 37 PID 1616 wrote to memory of 2548 1616 lxfrxff.exe 38 PID 1616 wrote to memory of 2548 1616 lxfrxff.exe 38 PID 1616 wrote to memory of 2548 1616 lxfrxff.exe 38 PID 1616 wrote to memory of 2548 1616 lxfrxff.exe 38 PID 2548 wrote to memory of 2776 2548 bhntbh.exe 39 PID 2548 wrote to memory of 2776 2548 bhntbh.exe 39 PID 2548 wrote to memory of 2776 2548 bhntbh.exe 39 PID 2548 wrote to memory of 2776 2548 bhntbh.exe 39 PID 2776 wrote to memory of 1740 2776 htnbnn.exe 40 PID 2776 wrote to memory of 1740 2776 htnbnn.exe 40 PID 2776 wrote to memory of 1740 2776 htnbnn.exe 40 PID 2776 wrote to memory of 1740 2776 htnbnn.exe 40 PID 1740 wrote to memory of 2416 1740 ddvdj.exe 41 PID 1740 wrote to memory of 2416 1740 ddvdj.exe 41 PID 1740 wrote to memory of 2416 1740 ddvdj.exe 41 PID 1740 wrote to memory of 2416 1740 ddvdj.exe 41 PID 2416 wrote to memory of 1868 2416 5flrxrx.exe 42 PID 2416 wrote to memory of 1868 2416 5flrxrx.exe 42 PID 2416 wrote to memory of 1868 2416 5flrxrx.exe 42 PID 2416 wrote to memory of 1868 2416 5flrxrx.exe 42 PID 1868 wrote to memory of 1892 1868 hbnbnb.exe 43 PID 1868 wrote to memory of 1892 1868 hbnbnb.exe 43 PID 1868 wrote to memory of 1892 1868 hbnbnb.exe 43 PID 1868 wrote to memory of 1892 1868 hbnbnb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea2c66a10180b08d0d45a46cea1919a0_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\ea2c66a10180b08d0d45a46cea1919a0_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\rrfrllx.exec:\rrfrllx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\btnntb.exec:\btnntb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\1llxlfr.exec:\1llxlfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\tthhnn.exec:\tthhnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\pvjvd.exec:\pvjvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\jdddj.exec:\jdddj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\3btbhh.exec:\3btbhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\ppvdv.exec:\ppvdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\vvpdv.exec:\vvpdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\lxfrxff.exec:\lxfrxff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\bhntbh.exec:\bhntbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\htnbnn.exec:\htnbnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\ddvdj.exec:\ddvdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\5flrxrx.exec:\5flrxrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\hbnbnb.exec:\hbnbnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\thhnnn.exec:\thhnnn.exe17⤵
- Executes dropped EXE
PID:1892 -
\??\c:\vpdvj.exec:\vpdvj.exe18⤵
- Executes dropped EXE
PID:756 -
\??\c:\jjdpp.exec:\jjdpp.exe19⤵
- Executes dropped EXE
PID:828 -
\??\c:\1ffxrfr.exec:\1ffxrfr.exe20⤵
- Executes dropped EXE
PID:2212 -
\??\c:\1nbbhh.exec:\1nbbhh.exe21⤵
- Executes dropped EXE
PID:2032 -
\??\c:\nnhntb.exec:\nnhntb.exe22⤵
- Executes dropped EXE
PID:2844 -
\??\c:\pdpvd.exec:\pdpvd.exe23⤵
- Executes dropped EXE
PID:2848 -
\??\c:\fxllxfl.exec:\fxllxfl.exe24⤵
- Executes dropped EXE
PID:908 -
\??\c:\3ffxlrl.exec:\3ffxlrl.exe25⤵
- Executes dropped EXE
PID:1340 -
\??\c:\nnnbbh.exec:\nnnbbh.exe26⤵
- Executes dropped EXE
PID:1576 -
\??\c:\vvjdj.exec:\vvjdj.exe27⤵
- Executes dropped EXE
PID:1328 -
\??\c:\xrlflrf.exec:\xrlflrf.exe28⤵
- Executes dropped EXE
PID:1268 -
\??\c:\3hbhnn.exec:\3hbhnn.exe29⤵
- Executes dropped EXE
PID:940 -
\??\c:\hbhhnn.exec:\hbhhnn.exe30⤵
- Executes dropped EXE
PID:2036 -
\??\c:\7pjvd.exec:\7pjvd.exe31⤵
- Executes dropped EXE
PID:2948 -
\??\c:\ffxxrrl.exec:\ffxxrrl.exe32⤵
- Executes dropped EXE
PID:2992 -
\??\c:\bbtbhh.exec:\bbtbhh.exe33⤵
- Executes dropped EXE
PID:2560 -
\??\c:\bbnthh.exec:\bbnthh.exe34⤵
- Executes dropped EXE
PID:2268 -
\??\c:\vpdpv.exec:\vpdpv.exe35⤵
- Executes dropped EXE
PID:3004 -
\??\c:\9xrrxfl.exec:\9xrrxfl.exe36⤵
- Executes dropped EXE
PID:1592 -
\??\c:\3rrxlrx.exec:\3rrxlrx.exe37⤵
- Executes dropped EXE
PID:3012 -
\??\c:\tnhntb.exec:\tnhntb.exe38⤵
- Executes dropped EXE
PID:2624 -
\??\c:\btnthn.exec:\btnthn.exe39⤵
- Executes dropped EXE
PID:2680 -
\??\c:\5jjvd.exec:\5jjvd.exe40⤵
- Executes dropped EXE
PID:2636 -
\??\c:\pjdvj.exec:\pjdvj.exe41⤵
- Executes dropped EXE
PID:2704 -
\??\c:\llfrflx.exec:\llfrflx.exe42⤵
- Executes dropped EXE
PID:2640 -
\??\c:\rrrfxlf.exec:\rrrfxlf.exe43⤵
- Executes dropped EXE
PID:2616 -
\??\c:\tthbnn.exec:\tthbnn.exe44⤵
- Executes dropped EXE
PID:2652 -
\??\c:\3bnnbb.exec:\3bnnbb.exe45⤵
- Executes dropped EXE
PID:2544 -
\??\c:\jjvvd.exec:\jjvvd.exe46⤵
- Executes dropped EXE
PID:2908 -
\??\c:\ddjjp.exec:\ddjjp.exe47⤵
- Executes dropped EXE
PID:2932 -
\??\c:\rlxxfff.exec:\rlxxfff.exe48⤵
- Executes dropped EXE
PID:1408 -
\??\c:\xrfrxrr.exec:\xrfrxrr.exe49⤵
- Executes dropped EXE
PID:1824 -
\??\c:\1llxllr.exec:\1llxllr.exe50⤵
- Executes dropped EXE
PID:2756 -
\??\c:\tthbnt.exec:\tthbnt.exe51⤵
- Executes dropped EXE
PID:2380 -
\??\c:\nhnbnt.exec:\nhnbnt.exe52⤵
- Executes dropped EXE
PID:1500 -
\??\c:\jjpvj.exec:\jjpvj.exe53⤵
- Executes dropped EXE
PID:2392 -
\??\c:\1ppjp.exec:\1ppjp.exe54⤵
- Executes dropped EXE
PID:2416 -
\??\c:\7xrxlxl.exec:\7xrxlxl.exe55⤵
- Executes dropped EXE
PID:1868 -
\??\c:\xrlrxfl.exec:\xrlrxfl.exe56⤵
- Executes dropped EXE
PID:1620 -
\??\c:\9hhbnt.exec:\9hhbnt.exe57⤵
- Executes dropped EXE
PID:1284 -
\??\c:\thtnth.exec:\thtnth.exe58⤵
- Executes dropped EXE
PID:1260 -
\??\c:\vjvvv.exec:\vjvvv.exe59⤵
- Executes dropped EXE
PID:2372 -
\??\c:\dpdvv.exec:\dpdvv.exe60⤵
- Executes dropped EXE
PID:2212 -
\??\c:\ffffxfx.exec:\ffffxfx.exe61⤵
- Executes dropped EXE
PID:2836 -
\??\c:\vvpdj.exec:\vvpdj.exe62⤵
- Executes dropped EXE
PID:1216 -
\??\c:\jdpjj.exec:\jdpjj.exe63⤵
- Executes dropped EXE
PID:476 -
\??\c:\7rxflrx.exec:\7rxflrx.exe64⤵
- Executes dropped EXE
PID:580 -
\??\c:\3lfflrf.exec:\3lfflrf.exe65⤵
- Executes dropped EXE
PID:1460 -
\??\c:\3nnntt.exec:\3nnntt.exe66⤵PID:2288
-
\??\c:\3hbttt.exec:\3hbttt.exe67⤵PID:1576
-
\??\c:\5pjjj.exec:\5pjjj.exe68⤵PID:540
-
\??\c:\9jdvv.exec:\9jdvv.exe69⤵PID:300
-
\??\c:\rlfrflr.exec:\rlfrflr.exe70⤵PID:2188
-
\??\c:\xrlrxxf.exec:\xrlrxxf.exe71⤵PID:1720
-
\??\c:\3hhhht.exec:\3hhhht.exe72⤵PID:1464
-
\??\c:\hhbhbb.exec:\hhbhbb.exe73⤵PID:1732
-
\??\c:\jpvpv.exec:\jpvpv.exe74⤵PID:876
-
\??\c:\rlxlllx.exec:\rlxlllx.exe75⤵PID:1700
-
\??\c:\7lfrlxl.exec:\7lfrlxl.exe76⤵PID:2072
-
\??\c:\tnhtbh.exec:\tnhtbh.exe77⤵PID:1180
-
\??\c:\hbntbb.exec:\hbntbb.exe78⤵PID:2272
-
\??\c:\dvddp.exec:\dvddp.exe79⤵PID:2080
-
\??\c:\dvddd.exec:\dvddd.exe80⤵PID:2092
-
\??\c:\xrllrrr.exec:\xrllrrr.exe81⤵PID:2104
-
\??\c:\7frlrfr.exec:\7frlrfr.exe82⤵PID:2732
-
\??\c:\1hbntt.exec:\1hbntt.exe83⤵PID:2628
-
\??\c:\bthntb.exec:\bthntb.exe84⤵PID:2824
-
\??\c:\jjdpj.exec:\jjdpj.exe85⤵PID:2640
-
\??\c:\jjjjv.exec:\jjjjv.exe86⤵PID:2484
-
\??\c:\fxffrrx.exec:\fxffrrx.exe87⤵PID:2120
-
\??\c:\rfrrllr.exec:\rfrrllr.exe88⤵PID:1828
-
\??\c:\bntthh.exec:\bntthh.exe89⤵PID:2532
-
\??\c:\nbnhtt.exec:\nbnhtt.exe90⤵PID:1140
-
\??\c:\7vpdj.exec:\7vpdj.exe91⤵PID:1136
-
\??\c:\7vdvv.exec:\7vdvv.exe92⤵PID:2568
-
\??\c:\lfxllrf.exec:\lfxllrf.exe93⤵PID:1256
-
\??\c:\rlrlxxl.exec:\rlrlxxl.exe94⤵PID:2400
-
\??\c:\nbnhnn.exec:\nbnhnn.exe95⤵PID:996
-
\??\c:\hbhnnn.exec:\hbhnnn.exe96⤵PID:1844
-
\??\c:\pdpjd.exec:\pdpjd.exe97⤵PID:1928
-
\??\c:\vpddp.exec:\vpddp.exe98⤵PID:3008
-
\??\c:\xrllxxl.exec:\xrllxxl.exe99⤵PID:2520
-
\??\c:\fxrxllx.exec:\fxrxllx.exe100⤵PID:1748
-
\??\c:\thttbt.exec:\thttbt.exe101⤵PID:2340
-
\??\c:\hthhtt.exec:\hthhtt.exe102⤵PID:2176
-
\??\c:\vpddp.exec:\vpddp.exe103⤵PID:1800
-
\??\c:\ppjvj.exec:\ppjvj.exe104⤵PID:2844
-
\??\c:\rlxxffl.exec:\rlxxffl.exe105⤵PID:320
-
\??\c:\hbhhnn.exec:\hbhhnn.exe106⤵PID:628
-
\??\c:\tnbthn.exec:\tnbthn.exe107⤵PID:568
-
\??\c:\jdppd.exec:\jdppd.exe108⤵PID:752
-
\??\c:\jjdjp.exec:\jjdjp.exe109⤵PID:304
-
\??\c:\rfrxrrf.exec:\rfrxrrf.exe110⤵PID:1272
-
\??\c:\fxrxllr.exec:\fxrxllr.exe111⤵PID:2888
-
\??\c:\1nbhtt.exec:\1nbhtt.exe112⤵PID:1476
-
\??\c:\hthntt.exec:\hthntt.exe113⤵PID:1032
-
\??\c:\vpdjp.exec:\vpdjp.exe114⤵PID:2864
-
\??\c:\jdvdd.exec:\jdvdd.exe115⤵PID:980
-
\??\c:\lfxllrx.exec:\lfxllrx.exe116⤵PID:2444
-
\??\c:\frflxrx.exec:\frflxrx.exe117⤵PID:1688
-
\??\c:\bttbnt.exec:\bttbnt.exe118⤵PID:2560
-
\??\c:\1jppv.exec:\1jppv.exe119⤵PID:2160
-
\??\c:\5dppd.exec:\5dppd.exe120⤵PID:3004
-
\??\c:\frxxxfl.exec:\frxxxfl.exe121⤵PID:2084
-
\??\c:\xrrxxxr.exec:\xrrxxxr.exe122⤵PID:3012
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-