Analysis
-
max time kernel
150s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
08-05-2024 09:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4171835f7db51b82965ac2fb82fb8d60_NEIKI.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4171835f7db51b82965ac2fb82fb8d60_NEIKI.exe
-
Size
135KB
-
MD5
4171835f7db51b82965ac2fb82fb8d60
-
SHA1
1b0a7345f56eb710d7d4ac5fb0c88e0ce4fd3885
-
SHA256
49a5d99c281d4b1bb4a32f00ce36fe31fe3d417b49ccfe9fb2fea3915ccc6ae8
-
SHA512
62bd3ff663622d35349af16cdfc8a9cfe68ce4634c4b451b50c398306dc8924482971070f8b78adbac6678ea3d18be142ebf77a2dfafaae3b3e150ca944f91fd
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afoHVpx+dGoEjZeiV:n3C9BRW0j/1px+dG3FV
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/3420-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3680-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3704-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3848-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1916-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1028-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4256-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2744-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3492-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2968-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4300-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4540-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2336-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3604-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/764-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2112-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1208-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4360-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2808-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1336-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3396-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2236-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3428-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3336-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4108-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2252-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3680 5vppj.exe 3704 flrlfff.exe 3848 httnnn.exe 1916 hhnhtt.exe 1028 vpddd.exe 4256 bbnhth.exe 2744 dpjvj.exe 4496 rlffflf.exe 3492 nhttbb.exe 2968 bhthtb.exe 4300 dvvpv.exe 4540 jddpd.exe 2336 hthbbb.exe 3604 jddvp.exe 764 lxlfllx.exe 3200 llxrllf.exe 2112 dddjj.exe 4592 rfrllfr.exe 1208 thhbtt.exe 4360 pjjjd.exe 2808 jpvpp.exe 1336 lfffxxr.exe 3396 7pddv.exe 3220 7xllrrx.exe 2236 bhnbhn.exe 3972 3thbhb.exe 3428 7bhhnt.exe 3336 xrrffxr.exe 4108 thnnnn.exe 2252 vdjpj.exe 2752 5jjdp.exe 1400 3lfxllr.exe 3624 bnhnhb.exe 2208 3bhbbh.exe 3012 7pvvj.exe 4316 vjddd.exe 888 xlxxfxl.exe 1720 btnttb.exe 2456 ddvpp.exe 2080 jjppj.exe 2844 1jvdd.exe 4800 fllfxrf.exe 2408 btnttb.exe 3048 nttnbt.exe 4580 djdvp.exe 4552 dvpjd.exe 1988 fxfxrrr.exe 4944 xlrlxrr.exe 1000 bbbhhn.exe 4232 bbttbb.exe 1848 pdjpp.exe 4880 vpjjd.exe 2012 5lxrlll.exe 3280 xflrxff.exe 2336 bhbbbb.exe 2380 nhhhbb.exe 4376 9pjjp.exe 1080 lrrxrrr.exe 3200 3lxlrff.exe 3820 nnhbbb.exe 3876 bnbnbh.exe 3104 jvvdv.exe 4712 ppdjj.exe 2412 fxlrrxx.exe -
resource yara_rule behavioral2/memory/3420-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3680-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3704-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3848-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1028-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4256-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2744-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3492-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4300-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4540-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2336-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3604-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/764-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2112-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1208-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4360-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2808-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1336-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3396-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3428-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3336-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4108-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2252-197-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3420 wrote to memory of 3680 3420 4171835f7db51b82965ac2fb82fb8d60_NEIKI.exe 83 PID 3420 wrote to memory of 3680 3420 4171835f7db51b82965ac2fb82fb8d60_NEIKI.exe 83 PID 3420 wrote to memory of 3680 3420 4171835f7db51b82965ac2fb82fb8d60_NEIKI.exe 83 PID 3680 wrote to memory of 3704 3680 5vppj.exe 84 PID 3680 wrote to memory of 3704 3680 5vppj.exe 84 PID 3680 wrote to memory of 3704 3680 5vppj.exe 84 PID 3704 wrote to memory of 3848 3704 flrlfff.exe 85 PID 3704 wrote to memory of 3848 3704 flrlfff.exe 85 PID 3704 wrote to memory of 3848 3704 flrlfff.exe 85 PID 3848 wrote to memory of 1916 3848 httnnn.exe 86 PID 3848 wrote to memory of 1916 3848 httnnn.exe 86 PID 3848 wrote to memory of 1916 3848 httnnn.exe 86 PID 1916 wrote to memory of 1028 1916 hhnhtt.exe 87 PID 1916 wrote to memory of 1028 1916 hhnhtt.exe 87 PID 1916 wrote to memory of 1028 1916 hhnhtt.exe 87 PID 1028 wrote to memory of 4256 1028 vpddd.exe 88 PID 1028 wrote to memory of 4256 1028 vpddd.exe 88 PID 1028 wrote to memory of 4256 1028 vpddd.exe 88 PID 4256 wrote to memory of 2744 4256 bbnhth.exe 89 PID 4256 wrote to memory of 2744 4256 bbnhth.exe 89 PID 4256 wrote to memory of 2744 4256 bbnhth.exe 89 PID 2744 wrote to memory of 4496 2744 dpjvj.exe 90 PID 2744 wrote to memory of 4496 2744 dpjvj.exe 90 PID 2744 wrote to memory of 4496 2744 dpjvj.exe 90 PID 4496 wrote to memory of 3492 4496 rlffflf.exe 91 PID 4496 wrote to memory of 3492 4496 rlffflf.exe 91 PID 4496 wrote to memory of 3492 4496 rlffflf.exe 91 PID 3492 wrote to memory of 2968 3492 nhttbb.exe 92 PID 3492 wrote to memory of 2968 3492 nhttbb.exe 92 PID 3492 wrote to memory of 2968 3492 nhttbb.exe 92 PID 2968 wrote to memory of 4300 2968 bhthtb.exe 93 PID 2968 wrote to memory of 4300 2968 bhthtb.exe 93 PID 2968 wrote to memory of 4300 2968 bhthtb.exe 93 PID 4300 wrote to memory of 4540 4300 dvvpv.exe 95 PID 4300 wrote to memory of 4540 4300 dvvpv.exe 95 PID 4300 wrote to memory of 4540 4300 dvvpv.exe 95 PID 4540 wrote to memory of 2336 4540 jddpd.exe 96 PID 4540 wrote to memory of 2336 4540 jddpd.exe 96 PID 4540 wrote to memory of 2336 4540 jddpd.exe 96 PID 2336 wrote to memory of 3604 2336 hthbbb.exe 97 PID 2336 wrote to memory of 3604 2336 hthbbb.exe 97 PID 2336 wrote to memory of 3604 2336 hthbbb.exe 97 PID 3604 wrote to memory of 764 3604 jddvp.exe 99 PID 3604 wrote to memory of 764 3604 jddvp.exe 99 PID 3604 wrote to memory of 764 3604 jddvp.exe 99 PID 764 wrote to memory of 3200 764 lxlfllx.exe 100 PID 764 wrote to memory of 3200 764 lxlfllx.exe 100 PID 764 wrote to memory of 3200 764 lxlfllx.exe 100 PID 3200 wrote to memory of 2112 3200 llxrllf.exe 101 PID 3200 wrote to memory of 2112 3200 llxrllf.exe 101 PID 3200 wrote to memory of 2112 3200 llxrllf.exe 101 PID 2112 wrote to memory of 4592 2112 dddjj.exe 102 PID 2112 wrote to memory of 4592 2112 dddjj.exe 102 PID 2112 wrote to memory of 4592 2112 dddjj.exe 102 PID 4592 wrote to memory of 1208 4592 rfrllfr.exe 103 PID 4592 wrote to memory of 1208 4592 rfrllfr.exe 103 PID 4592 wrote to memory of 1208 4592 rfrllfr.exe 103 PID 1208 wrote to memory of 4360 1208 thhbtt.exe 104 PID 1208 wrote to memory of 4360 1208 thhbtt.exe 104 PID 1208 wrote to memory of 4360 1208 thhbtt.exe 104 PID 4360 wrote to memory of 2808 4360 pjjjd.exe 106 PID 4360 wrote to memory of 2808 4360 pjjjd.exe 106 PID 4360 wrote to memory of 2808 4360 pjjjd.exe 106 PID 2808 wrote to memory of 1336 2808 jpvpp.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\4171835f7db51b82965ac2fb82fb8d60_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\4171835f7db51b82965ac2fb82fb8d60_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3420 -
\??\c:\5vppj.exec:\5vppj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
\??\c:\flrlfff.exec:\flrlfff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\httnnn.exec:\httnnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
\??\c:\hhnhtt.exec:\hhnhtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\vpddd.exec:\vpddd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\bbnhth.exec:\bbnhth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
\??\c:\dpjvj.exec:\dpjvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\rlffflf.exec:\rlffflf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\nhttbb.exec:\nhttbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\bhthtb.exec:\bhthtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\dvvpv.exec:\dvvpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\jddpd.exec:\jddpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\hthbbb.exec:\hthbbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\jddvp.exec:\jddvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\lxlfllx.exec:\lxlfllx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\llxrllf.exec:\llxrllf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\dddjj.exec:\dddjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\rfrllfr.exec:\rfrllfr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\thhbtt.exec:\thhbtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\pjjjd.exec:\pjjjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\jpvpp.exec:\jpvpp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\lfffxxr.exec:\lfffxxr.exe23⤵
- Executes dropped EXE
PID:1336 -
\??\c:\7pddv.exec:\7pddv.exe24⤵
- Executes dropped EXE
PID:3396 -
\??\c:\7xllrrx.exec:\7xllrrx.exe25⤵
- Executes dropped EXE
PID:3220 -
\??\c:\bhnbhn.exec:\bhnbhn.exe26⤵
- Executes dropped EXE
PID:2236 -
\??\c:\3thbhb.exec:\3thbhb.exe27⤵
- Executes dropped EXE
PID:3972 -
\??\c:\7bhhnt.exec:\7bhhnt.exe28⤵
- Executes dropped EXE
PID:3428 -
\??\c:\xrrffxr.exec:\xrrffxr.exe29⤵
- Executes dropped EXE
PID:3336 -
\??\c:\thnnnn.exec:\thnnnn.exe30⤵
- Executes dropped EXE
PID:4108 -
\??\c:\vdjpj.exec:\vdjpj.exe31⤵
- Executes dropped EXE
PID:2252 -
\??\c:\5jjdp.exec:\5jjdp.exe32⤵
- Executes dropped EXE
PID:2752 -
\??\c:\3lfxllr.exec:\3lfxllr.exe33⤵
- Executes dropped EXE
PID:1400 -
\??\c:\bnhnhb.exec:\bnhnhb.exe34⤵
- Executes dropped EXE
PID:3624 -
\??\c:\3bhbbh.exec:\3bhbbh.exe35⤵
- Executes dropped EXE
PID:2208 -
\??\c:\7pvvj.exec:\7pvvj.exe36⤵
- Executes dropped EXE
PID:3012 -
\??\c:\vjddd.exec:\vjddd.exe37⤵
- Executes dropped EXE
PID:4316 -
\??\c:\xlxxfxl.exec:\xlxxfxl.exe38⤵
- Executes dropped EXE
PID:888 -
\??\c:\btnttb.exec:\btnttb.exe39⤵
- Executes dropped EXE
PID:1720 -
\??\c:\ddvpp.exec:\ddvpp.exe40⤵
- Executes dropped EXE
PID:2456 -
\??\c:\jjppj.exec:\jjppj.exe41⤵
- Executes dropped EXE
PID:2080 -
\??\c:\1jvdd.exec:\1jvdd.exe42⤵
- Executes dropped EXE
PID:2844 -
\??\c:\fllfxrf.exec:\fllfxrf.exe43⤵
- Executes dropped EXE
PID:4800 -
\??\c:\btnttb.exec:\btnttb.exe44⤵
- Executes dropped EXE
PID:2408 -
\??\c:\nttnbt.exec:\nttnbt.exe45⤵
- Executes dropped EXE
PID:3048 -
\??\c:\djdvp.exec:\djdvp.exe46⤵
- Executes dropped EXE
PID:4580 -
\??\c:\dvpjd.exec:\dvpjd.exe47⤵
- Executes dropped EXE
PID:4552 -
\??\c:\fxfxrrr.exec:\fxfxrrr.exe48⤵
- Executes dropped EXE
PID:1988 -
\??\c:\xlrlxrr.exec:\xlrlxrr.exe49⤵
- Executes dropped EXE
PID:4944 -
\??\c:\bbbhhn.exec:\bbbhhn.exe50⤵
- Executes dropped EXE
PID:1000 -
\??\c:\bbttbb.exec:\bbttbb.exe51⤵
- Executes dropped EXE
PID:4232 -
\??\c:\pdjpp.exec:\pdjpp.exe52⤵
- Executes dropped EXE
PID:1848 -
\??\c:\vpjjd.exec:\vpjjd.exe53⤵
- Executes dropped EXE
PID:4880 -
\??\c:\5lxrlll.exec:\5lxrlll.exe54⤵
- Executes dropped EXE
PID:2012 -
\??\c:\xflrxff.exec:\xflrxff.exe55⤵
- Executes dropped EXE
PID:3280 -
\??\c:\bhbbbb.exec:\bhbbbb.exe56⤵
- Executes dropped EXE
PID:2336 -
\??\c:\nhhhbb.exec:\nhhhbb.exe57⤵
- Executes dropped EXE
PID:2380 -
\??\c:\9pjjp.exec:\9pjjp.exe58⤵
- Executes dropped EXE
PID:4376 -
\??\c:\lrrxrrr.exec:\lrrxrrr.exe59⤵
- Executes dropped EXE
PID:1080 -
\??\c:\3lxlrff.exec:\3lxlrff.exe60⤵
- Executes dropped EXE
PID:3200 -
\??\c:\nnhbbb.exec:\nnhbbb.exe61⤵
- Executes dropped EXE
PID:3820 -
\??\c:\bnbnbh.exec:\bnbnbh.exe62⤵
- Executes dropped EXE
PID:3876 -
\??\c:\jvvdv.exec:\jvvdv.exe63⤵
- Executes dropped EXE
PID:3104 -
\??\c:\ppdjj.exec:\ppdjj.exe64⤵
- Executes dropped EXE
PID:4712 -
\??\c:\fxlrrxx.exec:\fxlrrxx.exe65⤵
- Executes dropped EXE
PID:2412 -
\??\c:\btnhbb.exec:\btnhbb.exe66⤵PID:748
-
\??\c:\bbtbhh.exec:\bbtbhh.exe67⤵PID:2244
-
\??\c:\pdjjd.exec:\pdjjd.exe68⤵PID:4688
-
\??\c:\pdppj.exec:\pdppj.exe69⤵PID:1040
-
\??\c:\1frfffx.exec:\1frfffx.exe70⤵PID:3568
-
\??\c:\nbnhht.exec:\nbnhht.exe71⤵PID:2716
-
\??\c:\djddv.exec:\djddv.exe72⤵PID:2236
-
\??\c:\vpvvd.exec:\vpvvd.exe73⤵PID:3136
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe74⤵PID:876
-
\??\c:\lffxrxx.exec:\lffxrxx.exe75⤵PID:3428
-
\??\c:\nntnbt.exec:\nntnbt.exe76⤵PID:3336
-
\??\c:\1bbttt.exec:\1bbttt.exe77⤵PID:4108
-
\??\c:\pdjvv.exec:\pdjvv.exe78⤵PID:1524
-
\??\c:\rrxrxxl.exec:\rrxrxxl.exe79⤵PID:4604
-
\??\c:\fflrrxr.exec:\fflrrxr.exe80⤵PID:4260
-
\??\c:\tntnnt.exec:\tntnnt.exe81⤵PID:4492
-
\??\c:\ddpdd.exec:\ddpdd.exe82⤵PID:3076
-
\??\c:\pjppp.exec:\pjppp.exe83⤵PID:468
-
\??\c:\lrxrllf.exec:\lrxrllf.exe84⤵PID:4512
-
\??\c:\3lffxxr.exec:\3lffxxr.exe85⤵PID:3496
-
\??\c:\bnhhtt.exec:\bnhhtt.exe86⤵PID:4608
-
\??\c:\pjjdp.exec:\pjjdp.exe87⤵PID:3992
-
\??\c:\3pddv.exec:\3pddv.exe88⤵PID:4628
-
\??\c:\flllxxl.exec:\flllxxl.exe89⤵PID:2348
-
\??\c:\5bhbhh.exec:\5bhbhh.exe90⤵PID:4600
-
\??\c:\hnthbh.exec:\hnthbh.exe91⤵PID:5048
-
\??\c:\pjvpp.exec:\pjvpp.exe92⤵PID:1948
-
\??\c:\vjjjd.exec:\vjjjd.exe93⤵PID:1464
-
\??\c:\rxfxrlx.exec:\rxfxrlx.exe94⤵PID:2996
-
\??\c:\tntbbb.exec:\tntbbb.exe95⤵PID:3868
-
\??\c:\5vddp.exec:\5vddp.exe96⤵PID:4748
-
\??\c:\ppvvd.exec:\ppvvd.exe97⤵PID:2568
-
\??\c:\7lffxxl.exec:\7lffxxl.exe98⤵PID:1836
-
\??\c:\htbbbb.exec:\htbbbb.exe99⤵PID:4052
-
\??\c:\ddvpv.exec:\ddvpv.exe100⤵PID:4056
-
\??\c:\5jppj.exec:\5jppj.exe101⤵PID:2000
-
\??\c:\llllfff.exec:\llllfff.exe102⤵PID:2180
-
\??\c:\9httnn.exec:\9httnn.exe103⤵PID:3976
-
\??\c:\ppppd.exec:\ppppd.exe104⤵PID:4376
-
\??\c:\9ppjj.exec:\9ppjj.exe105⤵PID:3092
-
\??\c:\rflfrll.exec:\rflfrll.exe106⤵PID:2112
-
\??\c:\tbbbbh.exec:\tbbbbh.exe107⤵PID:4592
-
\??\c:\9djdv.exec:\9djdv.exe108⤵PID:2756
-
\??\c:\1jjdv.exec:\1jjdv.exe109⤵PID:2980
-
\??\c:\frxrxxr.exec:\frxrxxr.exe110⤵PID:4324
-
\??\c:\hhtnhh.exec:\hhtnhh.exe111⤵PID:3432
-
\??\c:\hnbbbb.exec:\hnbbbb.exe112⤵PID:3028
-
\??\c:\vdddv.exec:\vdddv.exe113⤵PID:1392
-
\??\c:\7ffxllf.exec:\7ffxllf.exe114⤵PID:3220
-
\??\c:\xxxxrrr.exec:\xxxxrrr.exe115⤵PID:4636
-
\??\c:\5nhbbb.exec:\5nhbbb.exe116⤵PID:2944
-
\??\c:\djpjj.exec:\djpjj.exe117⤵PID:4000
-
\??\c:\lxlrrfr.exec:\lxlrrfr.exe118⤵PID:4272
-
\??\c:\frfxfxr.exec:\frfxfxr.exe119⤵PID:3748
-
\??\c:\9fxrrrx.exec:\9fxrrrx.exe120⤵PID:2732
-
\??\c:\nttntt.exec:\nttntt.exe121⤵PID:4728
-
\??\c:\hnnhbb.exec:\hnnhbb.exe122⤵PID:5076
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-