Analysis
-
max time kernel
26s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 00:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a9003ddb718372ea09a5419ffa788170_NEIKI.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
a9003ddb718372ea09a5419ffa788170_NEIKI.exe
-
Size
67KB
-
MD5
a9003ddb718372ea09a5419ffa788170
-
SHA1
0a15e1ff9e3dfcdacea507b5cce75f54a36d0ba7
-
SHA256
63a2b182d7a57f96cee0819447e322318382e738e8ca1133e02d0744c126f1c5
-
SHA512
168c00bf6eb54472ce94a5ca03923127ac8e3277d2b404f0248686212c86000f60a1ca48198539eb0904bde8a8b7f07012eebe384d0fd0326375d4ee643e7b0b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIrmCeRMKB:ymb3NkkiQ3mdBjFIjeL
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/2100-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3528-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2840-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1480-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4920-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2060-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1844-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4256-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3048-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/664-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2820-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3956-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2372-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2632-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2464-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1432-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2840-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4316-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3996-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3900-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3508-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1744-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2540-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2540 ttttnn.exe 1744 3jjdp.exe 5108 fxxrrxx.exe 3508 xflffxr.exe 3900 hbhbhh.exe 3528 ddppj.exe 3996 djjdv.exe 2952 flrlxxx.exe 4316 3bbtht.exe 2840 tnttnb.exe 1432 dvpvj.exe 1480 ffxrfff.exe 2544 lfrrrxf.exe 2028 bnhhbb.exe 2464 tbbtnh.exe 2632 pjvjd.exe 2372 jvpjd.exe 2308 jvdvp.exe 3956 xrxrllf.exe 4632 hnnnhb.exe 2820 ntnhbh.exe 5064 vjjjd.exe 4608 7llfxxr.exe 4920 xrffxlf.exe 664 ntbtnn.exe 4412 hhbthb.exe 2060 jdjdj.exe 3048 jdpjv.exe 4256 xlfrllf.exe 1844 rfrfffl.exe 4936 ntnnhh.exe 516 bnnhbb.exe 4120 pvpjj.exe 468 djdpd.exe 4668 xrrlfxx.exe 4372 rrxrlll.exe 4332 hbbbbb.exe 1220 bnnnbh.exe 864 7djdp.exe 3940 jvdvp.exe 1448 pdjvp.exe 3572 llrrrxx.exe 4152 xxrfxxr.exe 2256 9nnbth.exe 1580 bnnbtt.exe 368 7jjjd.exe 2452 pjdvp.exe 2480 vjvpj.exe 2124 xlllfff.exe 1948 xrffxxr.exe 1160 bnnnhn.exe 3720 5nhbnh.exe 2120 bnhnth.exe 2392 5dvpd.exe 2572 jjpjd.exe 3224 xflflxl.exe 1256 lflfrlx.exe 2408 frrlxxr.exe 3956 5hnhbh.exe 1228 bttnhb.exe 1384 ttttnt.exe 548 dvjdv.exe 1124 djjdv.exe 3764 xxrxxxx.exe -
resource yara_rule behavioral2/memory/2100-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3528-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3528-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3528-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3528-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2840-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1480-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4920-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2060-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1844-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4256-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3048-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/664-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2820-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3956-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2632-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2464-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1432-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2840-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4316-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3996-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3900-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3508-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1744-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1744-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1744-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1744-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2540-11-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2540 2100 a9003ddb718372ea09a5419ffa788170_NEIKI.exe 420 PID 2100 wrote to memory of 2540 2100 a9003ddb718372ea09a5419ffa788170_NEIKI.exe 420 PID 2100 wrote to memory of 2540 2100 a9003ddb718372ea09a5419ffa788170_NEIKI.exe 420 PID 2540 wrote to memory of 1744 2540 ttttnn.exe 86 PID 2540 wrote to memory of 1744 2540 ttttnn.exe 86 PID 2540 wrote to memory of 1744 2540 ttttnn.exe 86 PID 1744 wrote to memory of 5108 1744 3jjdp.exe 87 PID 1744 wrote to memory of 5108 1744 3jjdp.exe 87 PID 1744 wrote to memory of 5108 1744 3jjdp.exe 87 PID 5108 wrote to memory of 3508 5108 fxxrrxx.exe 88 PID 5108 wrote to memory of 3508 5108 fxxrrxx.exe 88 PID 5108 wrote to memory of 3508 5108 fxxrrxx.exe 88 PID 3508 wrote to memory of 3900 3508 xflffxr.exe 89 PID 3508 wrote to memory of 3900 3508 xflffxr.exe 89 PID 3508 wrote to memory of 3900 3508 xflffxr.exe 89 PID 3900 wrote to memory of 3528 3900 hbhbhh.exe 90 PID 3900 wrote to memory of 3528 3900 hbhbhh.exe 90 PID 3900 wrote to memory of 3528 3900 hbhbhh.exe 90 PID 3528 wrote to memory of 3996 3528 ddppj.exe 91 PID 3528 wrote to memory of 3996 3528 ddppj.exe 91 PID 3528 wrote to memory of 3996 3528 ddppj.exe 91 PID 3996 wrote to memory of 2952 3996 djjdv.exe 92 PID 3996 wrote to memory of 2952 3996 djjdv.exe 92 PID 3996 wrote to memory of 2952 3996 djjdv.exe 92 PID 2952 wrote to memory of 4316 2952 flrlxxx.exe 93 PID 2952 wrote to memory of 4316 2952 flrlxxx.exe 93 PID 2952 wrote to memory of 4316 2952 flrlxxx.exe 93 PID 4316 wrote to memory of 2840 4316 3bbtht.exe 94 PID 4316 wrote to memory of 2840 4316 3bbtht.exe 94 PID 4316 wrote to memory of 2840 4316 3bbtht.exe 94 PID 2840 wrote to memory of 1432 2840 tnttnb.exe 95 PID 2840 wrote to memory of 1432 2840 tnttnb.exe 95 PID 2840 wrote to memory of 1432 2840 tnttnb.exe 95 PID 1432 wrote to memory of 1480 1432 dvpvj.exe 96 PID 1432 wrote to memory of 1480 1432 dvpvj.exe 96 PID 1432 wrote to memory of 1480 1432 dvpvj.exe 96 PID 1480 wrote to memory of 2544 1480 ffxrfff.exe 97 PID 1480 wrote to memory of 2544 1480 ffxrfff.exe 97 PID 1480 wrote to memory of 2544 1480 ffxrfff.exe 97 PID 2544 wrote to memory of 2028 2544 lfrrrxf.exe 98 PID 2544 wrote to memory of 2028 2544 lfrrrxf.exe 98 PID 2544 wrote to memory of 2028 2544 lfrrrxf.exe 98 PID 2028 wrote to memory of 2464 2028 bnhhbb.exe 2012 PID 2028 wrote to memory of 2464 2028 bnhhbb.exe 2012 PID 2028 wrote to memory of 2464 2028 bnhhbb.exe 2012 PID 2464 wrote to memory of 2632 2464 tbbtnh.exe 100 PID 2464 wrote to memory of 2632 2464 tbbtnh.exe 100 PID 2464 wrote to memory of 2632 2464 tbbtnh.exe 100 PID 2632 wrote to memory of 2372 2632 pjvjd.exe 102 PID 2632 wrote to memory of 2372 2632 pjvjd.exe 102 PID 2632 wrote to memory of 2372 2632 pjvjd.exe 102 PID 2372 wrote to memory of 2308 2372 jvpjd.exe 103 PID 2372 wrote to memory of 2308 2372 jvpjd.exe 103 PID 2372 wrote to memory of 2308 2372 jvpjd.exe 103 PID 2308 wrote to memory of 3956 2308 jvdvp.exe 104 PID 2308 wrote to memory of 3956 2308 jvdvp.exe 104 PID 2308 wrote to memory of 3956 2308 jvdvp.exe 104 PID 3956 wrote to memory of 4632 3956 xrxrllf.exe 344 PID 3956 wrote to memory of 4632 3956 xrxrllf.exe 344 PID 3956 wrote to memory of 4632 3956 xrxrllf.exe 344 PID 4632 wrote to memory of 2820 4632 hnnnhb.exe 106 PID 4632 wrote to memory of 2820 4632 hnnnhb.exe 106 PID 4632 wrote to memory of 2820 4632 hnnnhb.exe 106 PID 2820 wrote to memory of 5064 2820 ntnhbh.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\4156190539\zmstage.exeC:\Users\Admin\AppData\Local\Temp\4156190539\zmstage.exe1⤵PID:3476
-
C:\Windows\system32\usoclient.exeC:\Windows\system32\usoclient.exe StartScan1⤵PID:4784
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe1⤵PID:1680
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\a9003ddb718372ea09a5419ffa788170_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\a9003ddb718372ea09a5419ffa788170_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\ttttnn.exec:\ttttnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\3jjdp.exec:\3jjdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\fxxrrxx.exec:\fxxrrxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\xflffxr.exec:\xflffxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\hbhbhh.exec:\hbhbhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\ddppj.exec:\ddppj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\djjdv.exec:\djjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\flrlxxx.exec:\flrlxxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\3bbtht.exec:\3bbtht.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\tnttnb.exec:\tnttnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\dvpvj.exec:\dvpvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\ffxrfff.exec:\ffxrfff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\lfrrrxf.exec:\lfrrrxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\bnhhbb.exec:\bnhhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\tbbtnh.exec:\tbbtnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\pjvjd.exec:\pjvjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\jvpjd.exec:\jvpjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\jvdvp.exec:\jvdvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\xrxrllf.exec:\xrxrllf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\hnnnhb.exec:\hnnnhb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\ntnhbh.exec:\ntnhbh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\vjjjd.exec:\vjjjd.exe23⤵
- Executes dropped EXE
PID:5064 -
\??\c:\7llfxxr.exec:\7llfxxr.exe24⤵
- Executes dropped EXE
PID:4608 -
\??\c:\xrffxlf.exec:\xrffxlf.exe25⤵
- Executes dropped EXE
PID:4920 -
\??\c:\ntbtnn.exec:\ntbtnn.exe26⤵
- Executes dropped EXE
PID:664 -
\??\c:\hhbthb.exec:\hhbthb.exe27⤵
- Executes dropped EXE
PID:4412 -
\??\c:\jdjdj.exec:\jdjdj.exe28⤵
- Executes dropped EXE
PID:2060 -
\??\c:\jdpjv.exec:\jdpjv.exe29⤵
- Executes dropped EXE
PID:3048 -
\??\c:\xlfrllf.exec:\xlfrllf.exe30⤵
- Executes dropped EXE
PID:4256 -
\??\c:\rfrfffl.exec:\rfrfffl.exe31⤵
- Executes dropped EXE
PID:1844 -
\??\c:\ntnnhh.exec:\ntnnhh.exe32⤵
- Executes dropped EXE
PID:4936 -
\??\c:\bnnhbb.exec:\bnnhbb.exe33⤵
- Executes dropped EXE
PID:516 -
\??\c:\pvpjj.exec:\pvpjj.exe34⤵
- Executes dropped EXE
PID:4120 -
\??\c:\djdpd.exec:\djdpd.exe35⤵
- Executes dropped EXE
PID:468 -
\??\c:\xrrlfxx.exec:\xrrlfxx.exe36⤵
- Executes dropped EXE
PID:4668 -
\??\c:\rrxrlll.exec:\rrxrlll.exe37⤵
- Executes dropped EXE
PID:4372 -
\??\c:\hbbbbb.exec:\hbbbbb.exe38⤵
- Executes dropped EXE
PID:4332 -
\??\c:\bnnnbh.exec:\bnnnbh.exe39⤵
- Executes dropped EXE
PID:1220 -
\??\c:\7djdp.exec:\7djdp.exe40⤵
- Executes dropped EXE
PID:864 -
\??\c:\jvdvp.exec:\jvdvp.exe41⤵
- Executes dropped EXE
PID:3940 -
\??\c:\pdjvp.exec:\pdjvp.exe42⤵
- Executes dropped EXE
PID:1448 -
\??\c:\llrrrxx.exec:\llrrrxx.exe43⤵
- Executes dropped EXE
PID:3572 -
\??\c:\xxrfxxr.exec:\xxrfxxr.exe44⤵
- Executes dropped EXE
PID:4152 -
\??\c:\9nnbth.exec:\9nnbth.exe45⤵
- Executes dropped EXE
PID:2256 -
\??\c:\bnnbtt.exec:\bnnbtt.exe46⤵
- Executes dropped EXE
PID:1580 -
\??\c:\7jjjd.exec:\7jjjd.exe47⤵
- Executes dropped EXE
PID:368 -
\??\c:\pjdvp.exec:\pjdvp.exe48⤵
- Executes dropped EXE
PID:2452 -
\??\c:\vjvpj.exec:\vjvpj.exe49⤵
- Executes dropped EXE
PID:2480 -
\??\c:\xlllfff.exec:\xlllfff.exe50⤵
- Executes dropped EXE
PID:2124 -
\??\c:\xrffxxr.exec:\xrffxxr.exe51⤵
- Executes dropped EXE
PID:1948 -
\??\c:\bnnnhn.exec:\bnnnhn.exe52⤵
- Executes dropped EXE
PID:1160 -
\??\c:\5nhbnh.exec:\5nhbnh.exe53⤵
- Executes dropped EXE
PID:3720 -
\??\c:\bnhnth.exec:\bnhnth.exe54⤵
- Executes dropped EXE
PID:2120 -
\??\c:\5dvpd.exec:\5dvpd.exe55⤵
- Executes dropped EXE
PID:2392 -
\??\c:\jjpjd.exec:\jjpjd.exe56⤵
- Executes dropped EXE
PID:2572 -
\??\c:\xflflxl.exec:\xflflxl.exe57⤵
- Executes dropped EXE
PID:3224 -
\??\c:\lflfrlx.exec:\lflfrlx.exe58⤵
- Executes dropped EXE
PID:1256 -
\??\c:\frrlxxr.exec:\frrlxxr.exe59⤵
- Executes dropped EXE
PID:2408 -
\??\c:\5hnhbh.exec:\5hnhbh.exe60⤵
- Executes dropped EXE
PID:3956 -
\??\c:\bttnhb.exec:\bttnhb.exe61⤵
- Executes dropped EXE
PID:1228 -
\??\c:\ttttnt.exec:\ttttnt.exe62⤵
- Executes dropped EXE
PID:1384 -
\??\c:\dvjdv.exec:\dvjdv.exe63⤵
- Executes dropped EXE
PID:548 -
\??\c:\djjdv.exec:\djjdv.exe64⤵
- Executes dropped EXE
PID:1124 -
\??\c:\xxrxxxx.exec:\xxrxxxx.exe65⤵
- Executes dropped EXE
PID:3764 -
\??\c:\lflfffx.exec:\lflfffx.exe66⤵PID:1424
-
\??\c:\rlllfxx.exec:\rlllfxx.exe67⤵PID:1500
-
\??\c:\btttnn.exec:\btttnn.exe68⤵PID:4044
-
\??\c:\hbbtbb.exec:\hbbtbb.exe69⤵PID:2968
-
\??\c:\tnnhhh.exec:\tnnhhh.exe70⤵PID:4028
-
\??\c:\vdpdv.exec:\vdpdv.exe71⤵PID:3788
-
\??\c:\vddvp.exec:\vddvp.exe72⤵PID:2352
-
\??\c:\djjdv.exec:\djjdv.exe73⤵PID:3160
-
\??\c:\fxxrxxx.exec:\fxxrxxx.exe74⤵PID:4204
-
\??\c:\lffxrrl.exec:\lffxrrl.exe75⤵PID:3760
-
\??\c:\rffxxxr.exec:\rffxxxr.exe76⤵PID:1088
-
\??\c:\hnttnn.exec:\hnttnn.exe77⤵PID:3612
-
\??\c:\nbtnnh.exec:\nbtnnh.exe78⤵PID:2596
-
\??\c:\hbbbbb.exec:\hbbbbb.exe79⤵PID:2280
-
\??\c:\ddjvp.exec:\ddjvp.exe80⤵PID:468
-
\??\c:\jppvp.exec:\jppvp.exe81⤵PID:1420
-
\??\c:\5pppj.exec:\5pppj.exe82⤵PID:4144
-
\??\c:\fxfxxrf.exec:\fxfxxrf.exe83⤵PID:1028
-
\??\c:\fxxrxxr.exec:\fxxrxxr.exe84⤵PID:392
-
\??\c:\htnhbb.exec:\htnhbb.exe85⤵PID:3724
-
\??\c:\nhbtnn.exec:\nhbtnn.exe86⤵PID:3136
-
\??\c:\bttnbh.exec:\bttnbh.exe87⤵PID:4296
-
\??\c:\pvvjd.exec:\pvvjd.exe88⤵PID:1964
-
\??\c:\vdvvj.exec:\vdvvj.exe89⤵PID:2948
-
\??\c:\rxfxfxr.exec:\rxfxfxr.exe90⤵PID:4008
-
\??\c:\5fffrxx.exec:\5fffrxx.exe91⤵PID:3572
-
\??\c:\rxffffx.exec:\rxffffx.exe92⤵PID:3192
-
\??\c:\tthhtt.exec:\tthhtt.exe93⤵PID:2024
-
\??\c:\ththnh.exec:\ththnh.exe94⤵PID:432
-
\??\c:\jjjdd.exec:\jjjdd.exe95⤵PID:4108
-
\??\c:\1dvpj.exec:\1dvpj.exe96⤵PID:760
-
\??\c:\xxllrxf.exec:\xxllrxf.exe97⤵PID:3648
-
\??\c:\lrxxxrf.exec:\lrxxxrf.exe98⤵PID:4984
-
\??\c:\frlfxrr.exec:\frlfxrr.exe99⤵PID:2544
-
\??\c:\7hhbtb.exec:\7hhbtb.exe100⤵PID:3732
-
\??\c:\nhhttn.exec:\nhhttn.exe101⤵PID:4364
-
\??\c:\vpjdv.exec:\vpjdv.exe102⤵PID:5028
-
\??\c:\dvdvj.exec:\dvdvj.exe103⤵PID:2924
-
\??\c:\rlfxxxr.exec:\rlfxxxr.exe104⤵PID:2120
-
\??\c:\ffffxfx.exec:\ffffxfx.exe105⤵PID:1276
-
\??\c:\frllflf.exec:\frllflf.exe106⤵PID:952
-
\??\c:\5tbtnn.exec:\5tbtnn.exe107⤵PID:3224
-
\??\c:\nhbtnh.exec:\nhbtnh.exe108⤵PID:1256
-
\??\c:\pddvj.exec:\pddvj.exe109⤵PID:2912
-
\??\c:\jvjpj.exec:\jvjpj.exe110⤵PID:4280
-
\??\c:\pppjv.exec:\pppjv.exe111⤵PID:2444
-
\??\c:\rlxrxrx.exec:\rlxrxrx.exe112⤵PID:1048
-
\??\c:\rfxxllf.exec:\rfxxllf.exe113⤵PID:1700
-
\??\c:\nntnhh.exec:\nntnhh.exe114⤵PID:1104
-
\??\c:\tbbtnn.exec:\tbbtnn.exe115⤵PID:4920
-
\??\c:\nhbtnn.exec:\nhbtnn.exe116⤵PID:1692
-
\??\c:\ddjdv.exec:\ddjdv.exe117⤵PID:1500
-
\??\c:\vpjpj.exec:\vpjpj.exe118⤵PID:396
-
\??\c:\vdpdp.exec:\vdpdp.exe119⤵PID:4292
-
\??\c:\frxlfxx.exec:\frxlfxx.exe120⤵PID:3048
-
\??\c:\fxrrllf.exec:\fxrrllf.exe121⤵PID:4876
-
\??\c:\hnnnhh.exec:\hnnnhh.exe122⤵PID:2352
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-