Analysis
-
max time kernel
149s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 11:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9a200a940b1c076af869e77932b4f0e0_NEIKI.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
9a200a940b1c076af869e77932b4f0e0_NEIKI.exe
-
Size
74KB
-
MD5
9a200a940b1c076af869e77932b4f0e0
-
SHA1
57fdedc7747e3262ed38b2a0c2fe5428697904ce
-
SHA256
838bf3eb80e203a354dcec37e82f1b3e1eeb3cbbf9a8aab46eb20c5c5247dd41
-
SHA512
64d6c21e6e15373ca387a2ae7a7a3985c877b1870ea768baebc88fac1792d31202d36c7c91d7a487d346a677dc0e224952ecbf4bb09714a4835cfd28b8cff213
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIrmCeRMKeWqNSZ7:ymb3NkkiQ3mdBjFIjek5o
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/1252-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1252-5-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5108-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2496-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3120-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4252-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/908-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/912-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4552-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4092-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1536-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4048-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3432-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3484-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4228-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2596-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1584-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/980-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4744-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2104-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2352-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3696-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3176-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1640-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3424-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2792-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5108 3flxrrl.exe 2496 ddjpv.exe 3120 pjppd.exe 4252 1fxrrrr.exe 908 lfrrlfr.exe 912 bntntn.exe 5100 lrfrfxr.exe 4552 lrrlxrl.exe 4092 1bbtnh.exe 1536 vpjdj.exe 4048 bbhbhh.exe 2812 nhnhbh.exe 3432 djdvj.exe 3372 frlxlfx.exe 3484 thnhbt.exe 2488 jppjv.exe 1576 xrlfrfx.exe 4228 5rxfrfx.exe 2596 hntnbt.exe 1584 vjdpd.exe 980 1fllffx.exe 4744 nhnnnh.exe 2104 7dpjd.exe 2352 9pdvp.exe 3696 flfxlfx.exe 3176 hbnhnh.exe 1640 9ppdp.exe 3424 rrrlfff.exe 3924 lrrlffx.exe 4220 tnnbtb.exe 2792 pdvvp.exe 828 vdpjp.exe 1688 rrllfxr.exe 2440 nbbhtt.exe 1284 vdvpd.exe 60 dvdvp.exe 2496 flrlffx.exe 1008 htnbnn.exe 4252 thtnhh.exe 4756 9dpdp.exe 836 3jvvj.exe 4028 5fxlxrr.exe 4576 3ffrlfx.exe 4588 1nhtnn.exe 4552 vdvjv.exe 3536 pjdpv.exe 4064 rffrfxr.exe 2648 rflffxl.exe 4928 tnhbtn.exe 548 vdjdp.exe 2368 lfrfrrl.exe 4648 fxxrfxr.exe 3124 bntnnh.exe 4820 pdjdj.exe 932 jjdvj.exe 2232 9xlxlfx.exe 4548 rrxrrrx.exe 4228 1bbhhh.exe 1948 bbnhtn.exe 2968 jvvjv.exe 1300 vddvj.exe 4476 lxfrfxf.exe 2240 1hhtnh.exe 1808 nhnntn.exe -
resource yara_rule behavioral2/memory/1252-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2496-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3120-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4252-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/908-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/908-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/912-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4552-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4092-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4092-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1536-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4048-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3432-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3484-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4228-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2596-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1584-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/980-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4744-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2352-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3176-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1640-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3424-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2792-208-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1252 wrote to memory of 5108 1252 9a200a940b1c076af869e77932b4f0e0_NEIKI.exe 84 PID 1252 wrote to memory of 5108 1252 9a200a940b1c076af869e77932b4f0e0_NEIKI.exe 84 PID 1252 wrote to memory of 5108 1252 9a200a940b1c076af869e77932b4f0e0_NEIKI.exe 84 PID 5108 wrote to memory of 2496 5108 3flxrrl.exe 85 PID 5108 wrote to memory of 2496 5108 3flxrrl.exe 85 PID 5108 wrote to memory of 2496 5108 3flxrrl.exe 85 PID 2496 wrote to memory of 3120 2496 ddjpv.exe 86 PID 2496 wrote to memory of 3120 2496 ddjpv.exe 86 PID 2496 wrote to memory of 3120 2496 ddjpv.exe 86 PID 3120 wrote to memory of 4252 3120 pjppd.exe 87 PID 3120 wrote to memory of 4252 3120 pjppd.exe 87 PID 3120 wrote to memory of 4252 3120 pjppd.exe 87 PID 4252 wrote to memory of 908 4252 1fxrrrr.exe 88 PID 4252 wrote to memory of 908 4252 1fxrrrr.exe 88 PID 4252 wrote to memory of 908 4252 1fxrrrr.exe 88 PID 908 wrote to memory of 912 908 lfrrlfr.exe 89 PID 908 wrote to memory of 912 908 lfrrlfr.exe 89 PID 908 wrote to memory of 912 908 lfrrlfr.exe 89 PID 912 wrote to memory of 5100 912 bntntn.exe 90 PID 912 wrote to memory of 5100 912 bntntn.exe 90 PID 912 wrote to memory of 5100 912 bntntn.exe 90 PID 5100 wrote to memory of 4552 5100 lrfrfxr.exe 91 PID 5100 wrote to memory of 4552 5100 lrfrfxr.exe 91 PID 5100 wrote to memory of 4552 5100 lrfrfxr.exe 91 PID 4552 wrote to memory of 4092 4552 lrrlxrl.exe 92 PID 4552 wrote to memory of 4092 4552 lrrlxrl.exe 92 PID 4552 wrote to memory of 4092 4552 lrrlxrl.exe 92 PID 4092 wrote to memory of 1536 4092 1bbtnh.exe 93 PID 4092 wrote to memory of 1536 4092 1bbtnh.exe 93 PID 4092 wrote to memory of 1536 4092 1bbtnh.exe 93 PID 1536 wrote to memory of 4048 1536 vpjdj.exe 94 PID 1536 wrote to memory of 4048 1536 vpjdj.exe 94 PID 1536 wrote to memory of 4048 1536 vpjdj.exe 94 PID 4048 wrote to memory of 2812 4048 bbhbhh.exe 95 PID 4048 wrote to memory of 2812 4048 bbhbhh.exe 95 PID 4048 wrote to memory of 2812 4048 bbhbhh.exe 95 PID 2812 wrote to memory of 3432 2812 nhnhbh.exe 96 PID 2812 wrote to memory of 3432 2812 nhnhbh.exe 96 PID 2812 wrote to memory of 3432 2812 nhnhbh.exe 96 PID 3432 wrote to memory of 3372 3432 djdvj.exe 97 PID 3432 wrote to memory of 3372 3432 djdvj.exe 97 PID 3432 wrote to memory of 3372 3432 djdvj.exe 97 PID 3372 wrote to memory of 3484 3372 frlxlfx.exe 98 PID 3372 wrote to memory of 3484 3372 frlxlfx.exe 98 PID 3372 wrote to memory of 3484 3372 frlxlfx.exe 98 PID 3484 wrote to memory of 2488 3484 thnhbt.exe 99 PID 3484 wrote to memory of 2488 3484 thnhbt.exe 99 PID 3484 wrote to memory of 2488 3484 thnhbt.exe 99 PID 2488 wrote to memory of 1576 2488 jppjv.exe 100 PID 2488 wrote to memory of 1576 2488 jppjv.exe 100 PID 2488 wrote to memory of 1576 2488 jppjv.exe 100 PID 1576 wrote to memory of 4228 1576 xrlfrfx.exe 101 PID 1576 wrote to memory of 4228 1576 xrlfrfx.exe 101 PID 1576 wrote to memory of 4228 1576 xrlfrfx.exe 101 PID 4228 wrote to memory of 2596 4228 5rxfrfx.exe 102 PID 4228 wrote to memory of 2596 4228 5rxfrfx.exe 102 PID 4228 wrote to memory of 2596 4228 5rxfrfx.exe 102 PID 2596 wrote to memory of 1584 2596 hntnbt.exe 103 PID 2596 wrote to memory of 1584 2596 hntnbt.exe 103 PID 2596 wrote to memory of 1584 2596 hntnbt.exe 103 PID 1584 wrote to memory of 980 1584 vjdpd.exe 104 PID 1584 wrote to memory of 980 1584 vjdpd.exe 104 PID 1584 wrote to memory of 980 1584 vjdpd.exe 104 PID 980 wrote to memory of 4744 980 1fllffx.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a200a940b1c076af869e77932b4f0e0_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\9a200a940b1c076af869e77932b4f0e0_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\3flxrrl.exec:\3flxrrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\ddjpv.exec:\ddjpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\pjppd.exec:\pjppd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\1fxrrrr.exec:\1fxrrrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\lfrrlfr.exec:\lfrrlfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
\??\c:\bntntn.exec:\bntntn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\lrfrfxr.exec:\lrfrfxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\lrrlxrl.exec:\lrrlxrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\1bbtnh.exec:\1bbtnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\vpjdj.exec:\vpjdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\bbhbhh.exec:\bbhbhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\nhnhbh.exec:\nhnhbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\djdvj.exec:\djdvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\frlxlfx.exec:\frlxlfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\thnhbt.exec:\thnhbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\jppjv.exec:\jppjv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\xrlfrfx.exec:\xrlfrfx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\5rxfrfx.exec:\5rxfrfx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\hntnbt.exec:\hntnbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\vjdpd.exec:\vjdpd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\1fllffx.exec:\1fllffx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\nhnnnh.exec:\nhnnnh.exe23⤵
- Executes dropped EXE
PID:4744 -
\??\c:\7dpjd.exec:\7dpjd.exe24⤵
- Executes dropped EXE
PID:2104 -
\??\c:\9pdvp.exec:\9pdvp.exe25⤵
- Executes dropped EXE
PID:2352 -
\??\c:\flfxlfx.exec:\flfxlfx.exe26⤵
- Executes dropped EXE
PID:3696 -
\??\c:\hbnhnh.exec:\hbnhnh.exe27⤵
- Executes dropped EXE
PID:3176 -
\??\c:\9ppdp.exec:\9ppdp.exe28⤵
- Executes dropped EXE
PID:1640 -
\??\c:\rrrlfff.exec:\rrrlfff.exe29⤵
- Executes dropped EXE
PID:3424 -
\??\c:\lrrlffx.exec:\lrrlffx.exe30⤵
- Executes dropped EXE
PID:3924 -
\??\c:\tnnbtb.exec:\tnnbtb.exe31⤵
- Executes dropped EXE
PID:4220 -
\??\c:\pdvvp.exec:\pdvvp.exe32⤵
- Executes dropped EXE
PID:2792 -
\??\c:\vdpjp.exec:\vdpjp.exe33⤵
- Executes dropped EXE
PID:828 -
\??\c:\rrllfxr.exec:\rrllfxr.exe34⤵
- Executes dropped EXE
PID:1688 -
\??\c:\1hhtnh.exec:\1hhtnh.exe35⤵PID:4428
-
\??\c:\nbbhtt.exec:\nbbhtt.exe36⤵
- Executes dropped EXE
PID:2440 -
\??\c:\vdvpd.exec:\vdvpd.exe37⤵
- Executes dropped EXE
PID:1284 -
\??\c:\dvdvp.exec:\dvdvp.exe38⤵
- Executes dropped EXE
PID:60 -
\??\c:\flrlffx.exec:\flrlffx.exe39⤵
- Executes dropped EXE
PID:2496 -
\??\c:\htnbnn.exec:\htnbnn.exe40⤵
- Executes dropped EXE
PID:1008 -
\??\c:\thtnhh.exec:\thtnhh.exe41⤵
- Executes dropped EXE
PID:4252 -
\??\c:\9dpdp.exec:\9dpdp.exe42⤵
- Executes dropped EXE
PID:4756 -
\??\c:\3jvvj.exec:\3jvvj.exe43⤵
- Executes dropped EXE
PID:836 -
\??\c:\5fxlxrr.exec:\5fxlxrr.exe44⤵
- Executes dropped EXE
PID:4028 -
\??\c:\3ffrlfx.exec:\3ffrlfx.exe45⤵
- Executes dropped EXE
PID:4576 -
\??\c:\1nhtnn.exec:\1nhtnn.exe46⤵
- Executes dropped EXE
PID:4588 -
\??\c:\vdvjv.exec:\vdvjv.exe47⤵
- Executes dropped EXE
PID:4552 -
\??\c:\pjdpv.exec:\pjdpv.exe48⤵
- Executes dropped EXE
PID:3536 -
\??\c:\rffrfxr.exec:\rffrfxr.exe49⤵
- Executes dropped EXE
PID:4064 -
\??\c:\rflffxl.exec:\rflffxl.exe50⤵
- Executes dropped EXE
PID:2648 -
\??\c:\tnhbtn.exec:\tnhbtn.exe51⤵
- Executes dropped EXE
PID:4928 -
\??\c:\vdjdp.exec:\vdjdp.exe52⤵
- Executes dropped EXE
PID:548 -
\??\c:\lfrfrrl.exec:\lfrfrrl.exe53⤵
- Executes dropped EXE
PID:2368 -
\??\c:\fxxrfxr.exec:\fxxrfxr.exe54⤵
- Executes dropped EXE
PID:4648 -
\??\c:\bntnnh.exec:\bntnnh.exe55⤵
- Executes dropped EXE
PID:3124 -
\??\c:\pdjdj.exec:\pdjdj.exe56⤵
- Executes dropped EXE
PID:4820 -
\??\c:\jjdvj.exec:\jjdvj.exe57⤵
- Executes dropped EXE
PID:932 -
\??\c:\9xlxlfx.exec:\9xlxlfx.exe58⤵
- Executes dropped EXE
PID:2232 -
\??\c:\rrxrrrx.exec:\rrxrrrx.exe59⤵
- Executes dropped EXE
PID:4548 -
\??\c:\1bbhhh.exec:\1bbhhh.exe60⤵
- Executes dropped EXE
PID:4228 -
\??\c:\bbnhtn.exec:\bbnhtn.exe61⤵
- Executes dropped EXE
PID:1948 -
\??\c:\jvvjv.exec:\jvvjv.exe62⤵
- Executes dropped EXE
PID:2968 -
\??\c:\vddvj.exec:\vddvj.exe63⤵
- Executes dropped EXE
PID:1300 -
\??\c:\lxfrfxf.exec:\lxfrfxf.exe64⤵
- Executes dropped EXE
PID:4476 -
\??\c:\1hhtnh.exec:\1hhtnh.exe65⤵
- Executes dropped EXE
PID:2240 -
\??\c:\nhnntn.exec:\nhnntn.exe66⤵
- Executes dropped EXE
PID:1808 -
\??\c:\hbbtht.exec:\hbbtht.exe67⤵PID:1936
-
\??\c:\vvjdv.exec:\vvjdv.exe68⤵PID:4052
-
\??\c:\xlxrfrl.exec:\xlxrfrl.exe69⤵PID:4392
-
\??\c:\fxlfllr.exec:\fxlfllr.exe70⤵PID:3576
-
\??\c:\nttnbt.exec:\nttnbt.exe71⤵PID:3256
-
\??\c:\tttbbh.exec:\tttbbh.exe72⤵PID:5088
-
\??\c:\pddjd.exec:\pddjd.exe73⤵PID:3884
-
\??\c:\jdjdd.exec:\jdjdd.exe74⤵PID:3952
-
\??\c:\frxrxxf.exec:\frxrxxf.exe75⤵PID:3924
-
\??\c:\hbbthh.exec:\hbbthh.exe76⤵PID:4980
-
\??\c:\btbntt.exec:\btbntt.exe77⤵PID:4560
-
\??\c:\dvvjd.exec:\dvvjd.exe78⤵PID:456
-
\??\c:\jpvpj.exec:\jpvpj.exe79⤵PID:4352
-
\??\c:\3lrffxl.exec:\3lrffxl.exe80⤵PID:1252
-
\??\c:\fllxllf.exec:\fllxllf.exe81⤵PID:3172
-
\??\c:\ntbntt.exec:\ntbntt.exe82⤵PID:4568
-
\??\c:\5bthth.exec:\5bthth.exe83⤵PID:1492
-
\??\c:\pvdvj.exec:\pvdvj.exe84⤵PID:1628
-
\??\c:\flxrrrl.exec:\flxrrrl.exe85⤵PID:2496
-
\??\c:\xxlrxfr.exec:\xxlrxfr.exe86⤵PID:956
-
\??\c:\hnhbtn.exec:\hnhbtn.exe87⤵PID:4252
-
\??\c:\nbbttt.exec:\nbbttt.exe88⤵PID:4756
-
\??\c:\vvdpv.exec:\vvdpv.exe89⤵PID:836
-
\??\c:\jpppp.exec:\jpppp.exe90⤵PID:4028
-
\??\c:\xrfxrrf.exec:\xrfxrrf.exe91⤵PID:3844
-
\??\c:\1ntnhh.exec:\1ntnhh.exe92⤵PID:3236
-
\??\c:\thtbtt.exec:\thtbtt.exe93⤵PID:3556
-
\??\c:\1pppp.exec:\1pppp.exe94⤵PID:3048
-
\??\c:\jvjjv.exec:\jvjjv.exe95⤵PID:3772
-
\??\c:\lxfrxxr.exec:\lxfrxxr.exe96⤵PID:2080
-
\??\c:\rxfxrlf.exec:\rxfxrlf.exe97⤵PID:1344
-
\??\c:\hbtbtt.exec:\hbtbtt.exe98⤵PID:3384
-
\??\c:\tbhtnh.exec:\tbhtnh.exe99⤵PID:2372
-
\??\c:\jvddp.exec:\jvddp.exe100⤵PID:1756
-
\??\c:\jdjdj.exec:\jdjdj.exe101⤵PID:4284
-
\??\c:\fffxfxx.exec:\fffxfxx.exe102⤵PID:3580
-
\??\c:\7bnhbb.exec:\7bnhbb.exe103⤵PID:2756
-
\??\c:\vjpdd.exec:\vjpdd.exe104⤵PID:4724
-
\??\c:\dvdvd.exec:\dvdvd.exe105⤵PID:2900
-
\??\c:\xxrlxxr.exec:\xxrlxxr.exe106⤵PID:744
-
\??\c:\hbbthh.exec:\hbbthh.exe107⤵PID:2580
-
\??\c:\hbnbbb.exec:\hbnbbb.exe108⤵PID:1784
-
\??\c:\jvddp.exec:\jvddp.exe109⤵PID:3316
-
\??\c:\djjjj.exec:\djjjj.exe110⤵PID:4736
-
\??\c:\lrffxxx.exec:\lrffxxx.exe111⤵PID:3224
-
\??\c:\hnnnnn.exec:\hnnnnn.exe112⤵PID:1376
-
\??\c:\bbhbbb.exec:\bbhbbb.exe113⤵PID:4952
-
\??\c:\dpdvv.exec:\dpdvv.exe114⤵PID:4392
-
\??\c:\5fxfxlf.exec:\5fxfxlf.exe115⤵PID:3176
-
\??\c:\3lxxrlf.exec:\3lxxrlf.exe116⤵PID:808
-
\??\c:\nhbthh.exec:\nhbthh.exe117⤵PID:2976
-
\??\c:\jppdv.exec:\jppdv.exe118⤵PID:5020
-
\??\c:\fxfrxxx.exec:\fxfrxxx.exe119⤵PID:2016
-
\??\c:\thbnnn.exec:\thbnnn.exe120⤵PID:5112
-
\??\c:\3bbbnn.exec:\3bbbnn.exe121⤵PID:4980
-
\??\c:\jdpjv.exec:\jdpjv.exe122⤵PID:4344
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-