Analysis
-
max time kernel
150s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 06:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f2c61a1f8a30f431647dfdb46d858fa0_NEIKI.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
f2c61a1f8a30f431647dfdb46d858fa0_NEIKI.exe
-
Size
61KB
-
MD5
f2c61a1f8a30f431647dfdb46d858fa0
-
SHA1
40014712723c88a334baa37960620c96b55a23d9
-
SHA256
c45cb58127c01c256110542325203e3aed84cd7c7e0f8b157f679a5b7084855d
-
SHA512
13624dfba08436d86c99da8a56f5e6755eb833335c7a8ff889ce2809b5bf31299e48dfbe198a4ce1d08e322e00652e27f3841ea6f3fea5de9406b1914ab1a419
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDII9ZvHKEn:ymb3NkkiQ3mdBjFII9ZvHKEn
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/1556-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/760-13-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/760-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4716-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3532-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2576-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/936-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1948-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2168-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1436-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2560-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1104-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3284-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3932-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1936-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2160-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2152-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2972-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3164-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4928-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3160-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1648-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/836-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3468-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 760 rxxxrrr.exe 4716 5lxxxxf.exe 3532 hnhbbt.exe 2576 jjpjj.exe 936 ffxfxrl.exe 1948 rllfxxr.exe 2168 bnbbtt.exe 1436 1pjdp.exe 2560 jjjdv.exe 1104 5llllrl.exe 4284 hthnnb.exe 1000 9ttnnh.exe 5116 vpvdp.exe 3284 xxrlffx.exe 3932 tnnnhh.exe 1936 btbbnn.exe 2160 9vdvv.exe 4960 lxrlffx.exe 4692 btnhbh.exe 2152 ttbttt.exe 2972 ppjdp.exe 3164 9dddv.exe 4928 fxfxrlf.exe 1680 tbbbtt.exe 3160 ddjvj.exe 1648 llxxrrl.exe 1004 tthhhh.exe 836 1thbhb.exe 3468 1vpvj.exe 4076 lfrlfll.exe 3212 lllfrlr.exe 3356 3tbttb.exe 220 pdvvp.exe 3756 djdpj.exe 2492 rxrlllx.exe 1464 1tnnnn.exe 4460 bnbtnn.exe 1900 dpjdp.exe 1588 rfrrlfx.exe 1296 fxfxxxx.exe 424 tnhtbt.exe 1864 3hbtnh.exe 3648 vjvvj.exe 2576 rxfxrfx.exe 3884 1rlxrlf.exe 1304 pvddd.exe 4996 ppppd.exe 1064 5flffll.exe 3624 frxxfll.exe 1624 ntbbbb.exe 4116 jjvpp.exe 4284 jvvpj.exe 3580 1lrxxxf.exe 4484 1thbtt.exe 2516 bbtbht.exe 4112 rxxxrxx.exe 4044 3frrrrx.exe 4848 hntthh.exe 4340 bhnttt.exe 1788 9jddp.exe 2700 vdppv.exe 2152 rxffflf.exe 2972 xrxxffx.exe 4736 1flffrl.exe -
resource yara_rule behavioral2/memory/1556-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/760-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4716-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3532-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2576-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/936-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1948-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2168-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1436-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2560-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2560-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2560-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3284-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3932-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1936-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2160-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2152-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2972-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3164-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1648-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/836-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1556 wrote to memory of 760 1556 f2c61a1f8a30f431647dfdb46d858fa0_NEIKI.exe 82 PID 1556 wrote to memory of 760 1556 f2c61a1f8a30f431647dfdb46d858fa0_NEIKI.exe 82 PID 1556 wrote to memory of 760 1556 f2c61a1f8a30f431647dfdb46d858fa0_NEIKI.exe 82 PID 760 wrote to memory of 4716 760 rxxxrrr.exe 83 PID 760 wrote to memory of 4716 760 rxxxrrr.exe 83 PID 760 wrote to memory of 4716 760 rxxxrrr.exe 83 PID 4716 wrote to memory of 3532 4716 5lxxxxf.exe 84 PID 4716 wrote to memory of 3532 4716 5lxxxxf.exe 84 PID 4716 wrote to memory of 3532 4716 5lxxxxf.exe 84 PID 3532 wrote to memory of 2576 3532 hnhbbt.exe 85 PID 3532 wrote to memory of 2576 3532 hnhbbt.exe 85 PID 3532 wrote to memory of 2576 3532 hnhbbt.exe 85 PID 2576 wrote to memory of 936 2576 jjpjj.exe 86 PID 2576 wrote to memory of 936 2576 jjpjj.exe 86 PID 2576 wrote to memory of 936 2576 jjpjj.exe 86 PID 936 wrote to memory of 1948 936 ffxfxrl.exe 87 PID 936 wrote to memory of 1948 936 ffxfxrl.exe 87 PID 936 wrote to memory of 1948 936 ffxfxrl.exe 87 PID 1948 wrote to memory of 2168 1948 rllfxxr.exe 88 PID 1948 wrote to memory of 2168 1948 rllfxxr.exe 88 PID 1948 wrote to memory of 2168 1948 rllfxxr.exe 88 PID 2168 wrote to memory of 1436 2168 bnbbtt.exe 89 PID 2168 wrote to memory of 1436 2168 bnbbtt.exe 89 PID 2168 wrote to memory of 1436 2168 bnbbtt.exe 89 PID 1436 wrote to memory of 2560 1436 1pjdp.exe 90 PID 1436 wrote to memory of 2560 1436 1pjdp.exe 90 PID 1436 wrote to memory of 2560 1436 1pjdp.exe 90 PID 2560 wrote to memory of 1104 2560 jjjdv.exe 91 PID 2560 wrote to memory of 1104 2560 jjjdv.exe 91 PID 2560 wrote to memory of 1104 2560 jjjdv.exe 91 PID 1104 wrote to memory of 4284 1104 5llllrl.exe 92 PID 1104 wrote to memory of 4284 1104 5llllrl.exe 92 PID 1104 wrote to memory of 4284 1104 5llllrl.exe 92 PID 4284 wrote to memory of 1000 4284 hthnnb.exe 93 PID 4284 wrote to memory of 1000 4284 hthnnb.exe 93 PID 4284 wrote to memory of 1000 4284 hthnnb.exe 93 PID 1000 wrote to memory of 5116 1000 9ttnnh.exe 94 PID 1000 wrote to memory of 5116 1000 9ttnnh.exe 94 PID 1000 wrote to memory of 5116 1000 9ttnnh.exe 94 PID 5116 wrote to memory of 3284 5116 vpvdp.exe 95 PID 5116 wrote to memory of 3284 5116 vpvdp.exe 95 PID 5116 wrote to memory of 3284 5116 vpvdp.exe 95 PID 3284 wrote to memory of 3932 3284 xxrlffx.exe 96 PID 3284 wrote to memory of 3932 3284 xxrlffx.exe 96 PID 3284 wrote to memory of 3932 3284 xxrlffx.exe 96 PID 3932 wrote to memory of 1936 3932 tnnnhh.exe 98 PID 3932 wrote to memory of 1936 3932 tnnnhh.exe 98 PID 3932 wrote to memory of 1936 3932 tnnnhh.exe 98 PID 1936 wrote to memory of 2160 1936 btbbnn.exe 99 PID 1936 wrote to memory of 2160 1936 btbbnn.exe 99 PID 1936 wrote to memory of 2160 1936 btbbnn.exe 99 PID 2160 wrote to memory of 4960 2160 9vdvv.exe 100 PID 2160 wrote to memory of 4960 2160 9vdvv.exe 100 PID 2160 wrote to memory of 4960 2160 9vdvv.exe 100 PID 4960 wrote to memory of 4692 4960 lxrlffx.exe 101 PID 4960 wrote to memory of 4692 4960 lxrlffx.exe 101 PID 4960 wrote to memory of 4692 4960 lxrlffx.exe 101 PID 4692 wrote to memory of 2152 4692 btnhbh.exe 102 PID 4692 wrote to memory of 2152 4692 btnhbh.exe 102 PID 4692 wrote to memory of 2152 4692 btnhbh.exe 102 PID 2152 wrote to memory of 2972 2152 ttbttt.exe 103 PID 2152 wrote to memory of 2972 2152 ttbttt.exe 103 PID 2152 wrote to memory of 2972 2152 ttbttt.exe 103 PID 2972 wrote to memory of 3164 2972 ppjdp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2c61a1f8a30f431647dfdb46d858fa0_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\f2c61a1f8a30f431647dfdb46d858fa0_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\rxxxrrr.exec:\rxxxrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\5lxxxxf.exec:\5lxxxxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\hnhbbt.exec:\hnhbbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\jjpjj.exec:\jjpjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\ffxfxrl.exec:\ffxfxrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
\??\c:\rllfxxr.exec:\rllfxxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\bnbbtt.exec:\bnbbtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\1pjdp.exec:\1pjdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\jjjdv.exec:\jjjdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\5llllrl.exec:\5llllrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\hthnnb.exec:\hthnnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\9ttnnh.exec:\9ttnnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
\??\c:\vpvdp.exec:\vpvdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\xxrlffx.exec:\xxrlffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
\??\c:\tnnnhh.exec:\tnnnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\btbbnn.exec:\btbbnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\9vdvv.exec:\9vdvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\lxrlffx.exec:\lxrlffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\btnhbh.exec:\btnhbh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\ttbttt.exec:\ttbttt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\ppjdp.exec:\ppjdp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\9dddv.exec:\9dddv.exe23⤵
- Executes dropped EXE
PID:3164 -
\??\c:\fxfxrlf.exec:\fxfxrlf.exe24⤵
- Executes dropped EXE
PID:4928 -
\??\c:\tbbbtt.exec:\tbbbtt.exe25⤵
- Executes dropped EXE
PID:1680 -
\??\c:\ddjvj.exec:\ddjvj.exe26⤵
- Executes dropped EXE
PID:3160 -
\??\c:\llxxrrl.exec:\llxxrrl.exe27⤵
- Executes dropped EXE
PID:1648 -
\??\c:\tthhhh.exec:\tthhhh.exe28⤵
- Executes dropped EXE
PID:1004 -
\??\c:\1thbhb.exec:\1thbhb.exe29⤵
- Executes dropped EXE
PID:836 -
\??\c:\1vpvj.exec:\1vpvj.exe30⤵
- Executes dropped EXE
PID:3468 -
\??\c:\lfrlfll.exec:\lfrlfll.exe31⤵
- Executes dropped EXE
PID:4076 -
\??\c:\lllfrlr.exec:\lllfrlr.exe32⤵
- Executes dropped EXE
PID:3212 -
\??\c:\3tbttb.exec:\3tbttb.exe33⤵
- Executes dropped EXE
PID:3356 -
\??\c:\pdvvp.exec:\pdvvp.exe34⤵
- Executes dropped EXE
PID:220 -
\??\c:\djdpj.exec:\djdpj.exe35⤵
- Executes dropped EXE
PID:3756 -
\??\c:\rxrlllx.exec:\rxrlllx.exe36⤵
- Executes dropped EXE
PID:2492 -
\??\c:\1tnnnn.exec:\1tnnnn.exe37⤵
- Executes dropped EXE
PID:1464 -
\??\c:\bnbtnn.exec:\bnbtnn.exe38⤵
- Executes dropped EXE
PID:4460 -
\??\c:\dpjdp.exec:\dpjdp.exe39⤵
- Executes dropped EXE
PID:1900 -
\??\c:\rfrrlfx.exec:\rfrrlfx.exe40⤵
- Executes dropped EXE
PID:1588 -
\??\c:\fxfxxxx.exec:\fxfxxxx.exe41⤵
- Executes dropped EXE
PID:1296 -
\??\c:\tnhtbt.exec:\tnhtbt.exe42⤵
- Executes dropped EXE
PID:424 -
\??\c:\3hbtnh.exec:\3hbtnh.exe43⤵
- Executes dropped EXE
PID:1864 -
\??\c:\vjvvj.exec:\vjvvj.exe44⤵
- Executes dropped EXE
PID:3648 -
\??\c:\rxfxrfx.exec:\rxfxrfx.exe45⤵
- Executes dropped EXE
PID:2576 -
\??\c:\1rlxrlf.exec:\1rlxrlf.exe46⤵
- Executes dropped EXE
PID:3884 -
\??\c:\pvddd.exec:\pvddd.exe47⤵
- Executes dropped EXE
PID:1304 -
\??\c:\ppppd.exec:\ppppd.exe48⤵
- Executes dropped EXE
PID:4996 -
\??\c:\5flffll.exec:\5flffll.exe49⤵
- Executes dropped EXE
PID:1064 -
\??\c:\frxxfll.exec:\frxxfll.exe50⤵
- Executes dropped EXE
PID:3624 -
\??\c:\ntbbbb.exec:\ntbbbb.exe51⤵
- Executes dropped EXE
PID:1624 -
\??\c:\jjvpp.exec:\jjvpp.exe52⤵
- Executes dropped EXE
PID:4116 -
\??\c:\jvvpj.exec:\jvvpj.exe53⤵
- Executes dropped EXE
PID:4284 -
\??\c:\1lrxxxf.exec:\1lrxxxf.exe54⤵
- Executes dropped EXE
PID:3580 -
\??\c:\1thbtt.exec:\1thbtt.exe55⤵
- Executes dropped EXE
PID:4484 -
\??\c:\bbtbht.exec:\bbtbht.exe56⤵
- Executes dropped EXE
PID:2516 -
\??\c:\rxxxrxx.exec:\rxxxrxx.exe57⤵
- Executes dropped EXE
PID:4112 -
\??\c:\3frrrrx.exec:\3frrrrx.exe58⤵
- Executes dropped EXE
PID:4044 -
\??\c:\hntthh.exec:\hntthh.exe59⤵
- Executes dropped EXE
PID:4848 -
\??\c:\bhnttt.exec:\bhnttt.exe60⤵
- Executes dropped EXE
PID:4340 -
\??\c:\9jddp.exec:\9jddp.exe61⤵
- Executes dropped EXE
PID:1788 -
\??\c:\vdppv.exec:\vdppv.exe62⤵
- Executes dropped EXE
PID:2700 -
\??\c:\rxffflf.exec:\rxffflf.exe63⤵
- Executes dropped EXE
PID:2152 -
\??\c:\xrxxffx.exec:\xrxxffx.exe64⤵
- Executes dropped EXE
PID:2972 -
\??\c:\1flffrl.exec:\1flffrl.exe65⤵
- Executes dropped EXE
PID:4736 -
\??\c:\nbhnhh.exec:\nbhnhh.exe66⤵PID:4212
-
\??\c:\hbbtnt.exec:\hbbtnt.exe67⤵PID:1452
-
\??\c:\jjddp.exec:\jjddp.exe68⤵PID:3632
-
\??\c:\dpvvp.exec:\dpvvp.exe69⤵PID:2928
-
\??\c:\lrxrllf.exec:\lrxrllf.exe70⤵PID:3392
-
\??\c:\5xlfrlf.exec:\5xlfrlf.exe71⤵PID:1548
-
\??\c:\btttbb.exec:\btttbb.exe72⤵PID:2092
-
\??\c:\bhhhbh.exec:\bhhhbh.exe73⤵PID:2956
-
\??\c:\5dpjv.exec:\5dpjv.exe74⤵PID:4980
-
\??\c:\rllffff.exec:\rllffff.exe75⤵PID:4492
-
\??\c:\htnthh.exec:\htnthh.exe76⤵PID:5072
-
\??\c:\3nnnbb.exec:\3nnnbb.exe77⤵PID:2000
-
\??\c:\djvvp.exec:\djvvp.exe78⤵PID:4912
-
\??\c:\frflxlr.exec:\frflxlr.exe79⤵PID:4760
-
\??\c:\nhnhhb.exec:\nhnhhb.exe80⤵PID:3504
-
\??\c:\pdjdv.exec:\pdjdv.exe81⤵PID:4984
-
\??\c:\lllfxxr.exec:\lllfxxr.exe82⤵PID:4452
-
\??\c:\vvvvp.exec:\vvvvp.exe83⤵PID:3316
-
\??\c:\lrflxlx.exec:\lrflxlx.exe84⤵PID:1556
-
\??\c:\rrrlffr.exec:\rrrlffr.exe85⤵PID:1588
-
\??\c:\nbtnnb.exec:\nbtnnb.exe86⤵PID:3460
-
\??\c:\jvvvp.exec:\jvvvp.exe87⤵PID:2340
-
\??\c:\9dppd.exec:\9dppd.exe88⤵PID:2428
-
\??\c:\dpjvj.exec:\dpjvj.exe89⤵PID:2472
-
\??\c:\3rrlffx.exec:\3rrlffx.exe90⤵PID:2704
-
\??\c:\bttnhh.exec:\bttnhh.exe91⤵PID:5048
-
\??\c:\dppjv.exec:\dppjv.exe92⤵PID:4564
-
\??\c:\djpjv.exec:\djpjv.exe93⤵PID:956
-
\??\c:\5jjjv.exec:\5jjjv.exe94⤵PID:1260
-
\??\c:\1xxlffx.exec:\1xxlffx.exe95⤵PID:3808
-
\??\c:\thhtnh.exec:\thhtnh.exe96⤵PID:2560
-
\??\c:\nhhbnb.exec:\nhhbnb.exe97⤵PID:4820
-
\??\c:\pvvjd.exec:\pvvjd.exe98⤵PID:2400
-
\??\c:\jjjjd.exec:\jjjjd.exe99⤵PID:3988
-
\??\c:\pvvvv.exec:\pvvvv.exe100⤵PID:4284
-
\??\c:\rrlxrrx.exec:\rrlxrrx.exe101⤵PID:3580
-
\??\c:\nhnntt.exec:\nhnntt.exe102⤵PID:4484
-
\??\c:\bnbbbb.exec:\bnbbbb.exe103⤵PID:224
-
\??\c:\7djdv.exec:\7djdv.exe104⤵PID:3992
-
\??\c:\ddvvj.exec:\ddvvj.exe105⤵PID:4508
-
\??\c:\lxfxfxf.exec:\lxfxfxf.exe106⤵PID:2544
-
\??\c:\xxrrrrr.exec:\xxrrrrr.exe107⤵PID:4340
-
\??\c:\bnnbtt.exec:\bnnbtt.exe108⤵PID:1788
-
\??\c:\nttnhb.exec:\nttnhb.exe109⤵PID:2992
-
\??\c:\djppd.exec:\djppd.exe110⤵PID:4168
-
\??\c:\fxfffff.exec:\fxfffff.exe111⤵PID:3164
-
\??\c:\lflfxrr.exec:\lflfxrr.exe112⤵PID:4860
-
\??\c:\nttnhb.exec:\nttnhb.exe113⤵PID:4288
-
\??\c:\3hhbnn.exec:\3hhbnn.exe114⤵PID:3776
-
\??\c:\jjjjv.exec:\jjjjv.exe115⤵PID:4364
-
\??\c:\jvdvp.exec:\jvdvp.exe116⤵PID:832
-
\??\c:\rxlfrrl.exec:\rxlfrrl.exe117⤵PID:4296
-
\??\c:\bntttb.exec:\bntttb.exe118⤵PID:1984
-
\??\c:\djppp.exec:\djppp.exe119⤵PID:372
-
\??\c:\jjvpp.exec:\jjvpp.exe120⤵PID:4124
-
\??\c:\1lllfff.exec:\1lllfff.exe121⤵PID:3192
-
\??\c:\rrrrrll.exec:\rrrrrll.exe122⤵PID:4004
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-