Analysis
-
max time kernel
150s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 21:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
52165ccb36a7ea9eb447d5afa6401040_NEIKI.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
52165ccb36a7ea9eb447d5afa6401040_NEIKI.exe
-
Size
63KB
-
MD5
52165ccb36a7ea9eb447d5afa6401040
-
SHA1
c2882c50fbf45e59cc38a04b13ef0bc863ffa858
-
SHA256
a1bfa1a37223786a8d651980d578fdf5fef0cc7595f5832687c4cc442c00a96a
-
SHA512
2e008bcdf55d48b2d81022c5203fd5018214f89014d56b53ff31a9af2bd9f48948fe18ead953e691022d0323d8bc2ba75c88415289a01684284e43f03fc7b0fc
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4ReSI:ymb3NkkiQ3mdBjFIsIpZ+R4ReSI
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/4056-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4052-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1344-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3408-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3464-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3880-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3732-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3816-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1676-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2884-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3364-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1840-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4500-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2936-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4052-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2992-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3036-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3888-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2572-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3960-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2908-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-14-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4328-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3972 nhtnhh.exe 2908 hhbbbb.exe 3960 ddjjp.exe 2572 pdjjj.exe 3888 ffxlfxl.exe 3036 hhnnnn.exe 2992 nnhhhn.exe 4056 jvdvp.exe 4052 jpdvv.exe 2936 xrrrrlf.exe 1344 httntt.exe 4500 nnnnhh.exe 392 dpppp.exe 1840 jvdvp.exe 4204 rffxlfx.exe 3364 7bhhht.exe 4584 bttbtt.exe 3576 9dvvp.exe 2884 vvppp.exe 2128 3fxxffl.exe 5056 thbthh.exe 1412 btnbtt.exe 3408 tnhbnh.exe 1676 vjpjp.exe 2976 1jjjv.exe 840 xxlrrrr.exe 3464 xrflfrl.exe 3816 tnnbbt.exe 3732 pjvvv.exe 3432 pvpjj.exe 3880 fxxrlfx.exe 224 fxxffrx.exe 1524 xlflxrr.exe 3964 bththn.exe 4280 1ttbnb.exe 444 vppjv.exe 1640 3ppjv.exe 1784 5xxrllr.exe 4188 rlffrll.exe 1960 bhhhth.exe 4536 nhnbnt.exe 1904 pddvj.exe 3036 pdddp.exe 1472 rrxrxll.exe 1068 5rfxlfx.exe 2916 nbtnbb.exe 3904 bhbnbt.exe 3000 pvjvj.exe 2816 jvjvd.exe 4500 lllxfxf.exe 1780 rllfxxl.exe 4452 3ntnhn.exe 3148 5nhbnh.exe 4260 vdjdp.exe 3552 pjjvd.exe 2480 lfrlxrl.exe 4584 3xfxlff.exe 3444 1ttbtn.exe 2800 ntbnbb.exe 4972 ttnbht.exe 3436 pdvjv.exe 2356 pppjd.exe 4388 fxlflxf.exe 1244 frlfxrl.exe -
resource yara_rule behavioral2/memory/2572-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2992-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2992-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4056-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4052-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1344-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3408-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3464-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3880-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3732-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3816-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1676-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2884-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3364-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1840-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2936-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4052-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2992-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2992-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3888-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3888-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3888-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2572-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2572-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2572-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3960-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2908-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4328-4-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4328 wrote to memory of 3972 4328 52165ccb36a7ea9eb447d5afa6401040_NEIKI.exe 83 PID 4328 wrote to memory of 3972 4328 52165ccb36a7ea9eb447d5afa6401040_NEIKI.exe 83 PID 4328 wrote to memory of 3972 4328 52165ccb36a7ea9eb447d5afa6401040_NEIKI.exe 83 PID 3972 wrote to memory of 2908 3972 nhtnhh.exe 84 PID 3972 wrote to memory of 2908 3972 nhtnhh.exe 84 PID 3972 wrote to memory of 2908 3972 nhtnhh.exe 84 PID 2908 wrote to memory of 3960 2908 hhbbbb.exe 85 PID 2908 wrote to memory of 3960 2908 hhbbbb.exe 85 PID 2908 wrote to memory of 3960 2908 hhbbbb.exe 85 PID 3960 wrote to memory of 2572 3960 ddjjp.exe 86 PID 3960 wrote to memory of 2572 3960 ddjjp.exe 86 PID 3960 wrote to memory of 2572 3960 ddjjp.exe 86 PID 2572 wrote to memory of 3888 2572 pdjjj.exe 87 PID 2572 wrote to memory of 3888 2572 pdjjj.exe 87 PID 2572 wrote to memory of 3888 2572 pdjjj.exe 87 PID 3888 wrote to memory of 3036 3888 ffxlfxl.exe 88 PID 3888 wrote to memory of 3036 3888 ffxlfxl.exe 88 PID 3888 wrote to memory of 3036 3888 ffxlfxl.exe 88 PID 3036 wrote to memory of 2992 3036 hhnnnn.exe 89 PID 3036 wrote to memory of 2992 3036 hhnnnn.exe 89 PID 3036 wrote to memory of 2992 3036 hhnnnn.exe 89 PID 2992 wrote to memory of 4056 2992 nnhhhn.exe 90 PID 2992 wrote to memory of 4056 2992 nnhhhn.exe 90 PID 2992 wrote to memory of 4056 2992 nnhhhn.exe 90 PID 4056 wrote to memory of 4052 4056 jvdvp.exe 91 PID 4056 wrote to memory of 4052 4056 jvdvp.exe 91 PID 4056 wrote to memory of 4052 4056 jvdvp.exe 91 PID 4052 wrote to memory of 2936 4052 jpdvv.exe 92 PID 4052 wrote to memory of 2936 4052 jpdvv.exe 92 PID 4052 wrote to memory of 2936 4052 jpdvv.exe 92 PID 2936 wrote to memory of 1344 2936 xrrrrlf.exe 94 PID 2936 wrote to memory of 1344 2936 xrrrrlf.exe 94 PID 2936 wrote to memory of 1344 2936 xrrrrlf.exe 94 PID 1344 wrote to memory of 4500 1344 httntt.exe 95 PID 1344 wrote to memory of 4500 1344 httntt.exe 95 PID 1344 wrote to memory of 4500 1344 httntt.exe 95 PID 4500 wrote to memory of 392 4500 nnnnhh.exe 96 PID 4500 wrote to memory of 392 4500 nnnnhh.exe 96 PID 4500 wrote to memory of 392 4500 nnnnhh.exe 96 PID 392 wrote to memory of 1840 392 dpppp.exe 97 PID 392 wrote to memory of 1840 392 dpppp.exe 97 PID 392 wrote to memory of 1840 392 dpppp.exe 97 PID 1840 wrote to memory of 4204 1840 jvdvp.exe 99 PID 1840 wrote to memory of 4204 1840 jvdvp.exe 99 PID 1840 wrote to memory of 4204 1840 jvdvp.exe 99 PID 4204 wrote to memory of 3364 4204 rffxlfx.exe 100 PID 4204 wrote to memory of 3364 4204 rffxlfx.exe 100 PID 4204 wrote to memory of 3364 4204 rffxlfx.exe 100 PID 3364 wrote to memory of 4584 3364 7bhhht.exe 101 PID 3364 wrote to memory of 4584 3364 7bhhht.exe 101 PID 3364 wrote to memory of 4584 3364 7bhhht.exe 101 PID 4584 wrote to memory of 3576 4584 bttbtt.exe 102 PID 4584 wrote to memory of 3576 4584 bttbtt.exe 102 PID 4584 wrote to memory of 3576 4584 bttbtt.exe 102 PID 3576 wrote to memory of 2884 3576 9dvvp.exe 235 PID 3576 wrote to memory of 2884 3576 9dvvp.exe 235 PID 3576 wrote to memory of 2884 3576 9dvvp.exe 235 PID 2884 wrote to memory of 2128 2884 vvppp.exe 321 PID 2884 wrote to memory of 2128 2884 vvppp.exe 321 PID 2884 wrote to memory of 2128 2884 vvppp.exe 321 PID 2128 wrote to memory of 5056 2128 3fxxffl.exe 106 PID 2128 wrote to memory of 5056 2128 3fxxffl.exe 106 PID 2128 wrote to memory of 5056 2128 3fxxffl.exe 106 PID 5056 wrote to memory of 1412 5056 thbthh.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\52165ccb36a7ea9eb447d5afa6401040_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\52165ccb36a7ea9eb447d5afa6401040_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\nhtnhh.exec:\nhtnhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\hhbbbb.exec:\hhbbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\ddjjp.exec:\ddjjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\pdjjj.exec:\pdjjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\ffxlfxl.exec:\ffxlfxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\hhnnnn.exec:\hhnnnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\nnhhhn.exec:\nnhhhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\jvdvp.exec:\jvdvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\jpdvv.exec:\jpdvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\xrrrrlf.exec:\xrrrrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\httntt.exec:\httntt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\nnnnhh.exec:\nnnnhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\dpppp.exec:\dpppp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\jvdvp.exec:\jvdvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\rffxlfx.exec:\rffxlfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
\??\c:\7bhhht.exec:\7bhhht.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
\??\c:\bttbtt.exec:\bttbtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\9dvvp.exec:\9dvvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\vvppp.exec:\vvppp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\3fxxffl.exec:\3fxxffl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\thbthh.exec:\thbthh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\btnbtt.exec:\btnbtt.exe23⤵
- Executes dropped EXE
PID:1412 -
\??\c:\tnhbnh.exec:\tnhbnh.exe24⤵
- Executes dropped EXE
PID:3408 -
\??\c:\vjpjp.exec:\vjpjp.exe25⤵
- Executes dropped EXE
PID:1676 -
\??\c:\1jjjv.exec:\1jjjv.exe26⤵
- Executes dropped EXE
PID:2976 -
\??\c:\xxlrrrr.exec:\xxlrrrr.exe27⤵
- Executes dropped EXE
PID:840 -
\??\c:\xrflfrl.exec:\xrflfrl.exe28⤵
- Executes dropped EXE
PID:3464 -
\??\c:\tnnbbt.exec:\tnnbbt.exe29⤵
- Executes dropped EXE
PID:3816 -
\??\c:\pjvvv.exec:\pjvvv.exe30⤵
- Executes dropped EXE
PID:3732 -
\??\c:\pvpjj.exec:\pvpjj.exe31⤵
- Executes dropped EXE
PID:3432 -
\??\c:\fxxrlfx.exec:\fxxrlfx.exe32⤵
- Executes dropped EXE
PID:3880 -
\??\c:\fxxffrx.exec:\fxxffrx.exe33⤵
- Executes dropped EXE
PID:224 -
\??\c:\xlflxrr.exec:\xlflxrr.exe34⤵
- Executes dropped EXE
PID:1524 -
\??\c:\bththn.exec:\bththn.exe35⤵
- Executes dropped EXE
PID:3964 -
\??\c:\1ttbnb.exec:\1ttbnb.exe36⤵
- Executes dropped EXE
PID:4280 -
\??\c:\vppjv.exec:\vppjv.exe37⤵
- Executes dropped EXE
PID:444 -
\??\c:\3ppjv.exec:\3ppjv.exe38⤵
- Executes dropped EXE
PID:1640 -
\??\c:\5xxrllr.exec:\5xxrllr.exe39⤵
- Executes dropped EXE
PID:1784 -
\??\c:\rlffrll.exec:\rlffrll.exe40⤵
- Executes dropped EXE
PID:4188 -
\??\c:\bhhhth.exec:\bhhhth.exe41⤵
- Executes dropped EXE
PID:1960 -
\??\c:\nhnbnt.exec:\nhnbnt.exe42⤵
- Executes dropped EXE
PID:4536 -
\??\c:\pddvj.exec:\pddvj.exe43⤵
- Executes dropped EXE
PID:1904 -
\??\c:\pdddp.exec:\pdddp.exe44⤵
- Executes dropped EXE
PID:3036 -
\??\c:\rrxrxll.exec:\rrxrxll.exe45⤵
- Executes dropped EXE
PID:1472 -
\??\c:\5rfxlfx.exec:\5rfxlfx.exe46⤵
- Executes dropped EXE
PID:1068 -
\??\c:\nbtnbb.exec:\nbtnbb.exe47⤵
- Executes dropped EXE
PID:2916 -
\??\c:\bhbnbt.exec:\bhbnbt.exe48⤵
- Executes dropped EXE
PID:3904 -
\??\c:\pvjvj.exec:\pvjvj.exe49⤵
- Executes dropped EXE
PID:3000 -
\??\c:\jvjvd.exec:\jvjvd.exe50⤵
- Executes dropped EXE
PID:2816 -
\??\c:\lllxfxf.exec:\lllxfxf.exe51⤵
- Executes dropped EXE
PID:4500 -
\??\c:\rllfxxl.exec:\rllfxxl.exe52⤵
- Executes dropped EXE
PID:1780 -
\??\c:\3ntnhn.exec:\3ntnhn.exe53⤵
- Executes dropped EXE
PID:4452 -
\??\c:\5nhbnh.exec:\5nhbnh.exe54⤵
- Executes dropped EXE
PID:3148 -
\??\c:\vdjdp.exec:\vdjdp.exe55⤵
- Executes dropped EXE
PID:4260 -
\??\c:\pjjvd.exec:\pjjvd.exe56⤵
- Executes dropped EXE
PID:3552 -
\??\c:\lfrlxrl.exec:\lfrlxrl.exe57⤵
- Executes dropped EXE
PID:2480 -
\??\c:\3xfxlff.exec:\3xfxlff.exe58⤵
- Executes dropped EXE
PID:4584 -
\??\c:\1ttbtn.exec:\1ttbtn.exe59⤵
- Executes dropped EXE
PID:3444 -
\??\c:\ntbnbb.exec:\ntbnbb.exe60⤵
- Executes dropped EXE
PID:2800 -
\??\c:\ttnbht.exec:\ttnbht.exe61⤵
- Executes dropped EXE
PID:4972 -
\??\c:\pdvjv.exec:\pdvjv.exe62⤵
- Executes dropped EXE
PID:3436 -
\??\c:\pppjd.exec:\pppjd.exe63⤵
- Executes dropped EXE
PID:2356 -
\??\c:\fxlflxf.exec:\fxlflxf.exe64⤵
- Executes dropped EXE
PID:4388 -
\??\c:\frlfxrl.exec:\frlfxrl.exe65⤵
- Executes dropped EXE
PID:1244 -
\??\c:\3hnhnn.exec:\3hnhnn.exe66⤵PID:4804
-
\??\c:\hthhnb.exec:\hthhnb.exe67⤵PID:4312
-
\??\c:\pdjjv.exec:\pdjjv.exe68⤵PID:2000
-
\??\c:\dppvj.exec:\dppvj.exe69⤵PID:4828
-
\??\c:\xrlrfxr.exec:\xrlrfxr.exe70⤵PID:2620
-
\??\c:\xxrlffx.exec:\xxrlffx.exe71⤵PID:1996
-
\??\c:\bbtntn.exec:\bbtntn.exe72⤵PID:2924
-
\??\c:\hbntbn.exec:\hbntbn.exe73⤵PID:4932
-
\??\c:\nnthbb.exec:\nnthbb.exe74⤵PID:1528
-
\??\c:\9dvvj.exec:\9dvvj.exe75⤵PID:2716
-
\??\c:\pvpdj.exec:\pvpdj.exe76⤵PID:3780
-
\??\c:\llfxlfr.exec:\llfxlfr.exe77⤵PID:4268
-
\??\c:\llfrlfr.exec:\llfrlfr.exe78⤵PID:3616
-
\??\c:\lflxrlf.exec:\lflxrlf.exe79⤵PID:2952
-
\??\c:\httnhb.exec:\httnhb.exe80⤵PID:4424
-
\??\c:\hhbhnb.exec:\hhbhnb.exe81⤵PID:2364
-
\??\c:\9pjdp.exec:\9pjdp.exe82⤵PID:4280
-
\??\c:\vppdv.exec:\vppdv.exe83⤵PID:2080
-
\??\c:\jppjp.exec:\jppjp.exe84⤵PID:5028
-
\??\c:\7fflffx.exec:\7fflffx.exe85⤵PID:4988
-
\??\c:\rfxxrrl.exec:\rfxxrrl.exe86⤵PID:3892
-
\??\c:\btnhbb.exec:\btnhbb.exe87⤵PID:1480
-
\??\c:\hhthtb.exec:\hhthtb.exe88⤵PID:1532
-
\??\c:\ddjvj.exec:\ddjvj.exe89⤵PID:780
-
\??\c:\7dpvp.exec:\7dpvp.exe90⤵PID:4472
-
\??\c:\ppjdp.exec:\ppjdp.exe91⤵PID:3664
-
\??\c:\xrrrrlr.exec:\xrrrrlr.exe92⤵PID:1292
-
\??\c:\rflllll.exec:\rflllll.exe93⤵PID:752
-
\??\c:\bbhbbh.exec:\bbhbbh.exe94⤵PID:2916
-
\??\c:\7nbnbh.exec:\7nbnbh.exe95⤵PID:3104
-
\??\c:\9ddpd.exec:\9ddpd.exe96⤵PID:3980
-
\??\c:\dpdjp.exec:\dpdjp.exe97⤵PID:2816
-
\??\c:\xflxrlf.exec:\xflxrlf.exe98⤵PID:4464
-
\??\c:\7lrxfxr.exec:\7lrxfxr.exe99⤵PID:1808
-
\??\c:\rfrlxfx.exec:\rfrlxfx.exe100⤵PID:2772
-
\??\c:\thnhbn.exec:\thnhbn.exe101⤵PID:960
-
\??\c:\vpdvv.exec:\vpdvv.exe102⤵PID:4060
-
\??\c:\vpvvv.exec:\vpvvv.exe103⤵PID:3340
-
\??\c:\7jddp.exec:\7jddp.exe104⤵PID:860
-
\??\c:\1llffrx.exec:\1llffrx.exe105⤵PID:5084
-
\??\c:\lxrrllf.exec:\lxrrllf.exe106⤵PID:1912
-
\??\c:\ntntnh.exec:\ntntnh.exe107⤵PID:1684
-
\??\c:\ffflllx.exec:\ffflllx.exe108⤵PID:4880
-
\??\c:\nbnbtn.exec:\nbnbtn.exe109⤵PID:3436
-
\??\c:\thnnbb.exec:\thnnbb.exe110⤵PID:4232
-
\??\c:\hhnbnh.exec:\hhnbnh.exe111⤵PID:4388
-
\??\c:\pdpdj.exec:\pdpdj.exe112⤵PID:1376
-
\??\c:\pdpjp.exec:\pdpjp.exe113⤵PID:4804
-
\??\c:\xrlxlrx.exec:\xrlxlrx.exe114⤵PID:2980
-
\??\c:\lffxfff.exec:\lffxfff.exe115⤵PID:2000
-
\??\c:\tnbthb.exec:\tnbthb.exe116⤵PID:4828
-
\??\c:\bnhbnn.exec:\bnhbnn.exe117⤵PID:2620
-
\??\c:\9ppdv.exec:\9ppdv.exe118⤵PID:1752
-
\??\c:\dppjv.exec:\dppjv.exe119⤵PID:4036
-
\??\c:\dpdpj.exec:\dpdpj.exe120⤵PID:3432
-
\??\c:\7llxlfx.exec:\7llxlfx.exe121⤵PID:1356
-
\??\c:\xfffrxl.exec:\xfffrxl.exe122⤵PID:1760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-