Analysis
- max time kernel
149s - max time network
128s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
20/05/2024, 00:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
68402ffc36a70c55422d31c6fed7ba40_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
- Target 68402ffc36a70c55422d31c6fed7ba40_NeikiAnalytics.exe
- Size 70KB
- Sample240520-afnd4aac44
- SHA256 6927d13d559f2507229bbc2fd948e527dba3024c3c7c2f6e2ae53f97f8ae5c53
- MD5 68402ffc36a70c55422d31c6fed7ba40
- SHA1 ec0fd8c655cb3ee225ea5234f8dc28e2d3269151
- SHA512 e0e2227e3c7a77abc1f1170cb1c85cca9780c91c6a4c582ec60e210b924edf651557fd7b45330a20bf0c1d7fdd74e62cbe1a1d926269950acb57b86ac6a1cfc1
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIgUVyiAnW:ymb3NkkiQ3mdBjFIgUEk
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/100-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3488-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1048-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2000-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1516-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/868-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4616-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4716-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2496-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2328-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2336-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4964-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2736-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1432-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3424-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1916-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3668-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1844-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4920-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1052-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2604-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3600-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2156-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2164-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 2000 nthttt.exe 3488 1vdjj.exe 1048 xlfrlxl.exe 1516 7bbttt.exe 868 jdpjv.exe 4608 frfrlfl.exe 4716 1pppj.exe 4616 rrrfxll.exe 2496 hntnhh.exe 2328 dvdjd.exe 4624 llfrrrf.exe 4904 nnnbtt.exe 2336 jvpjv.exe 4964 lflfxrl.exe 2736 bnttbb.exe 1432 nhthnn.exe 3424 dpvpj.exe 3232 frlllxr.exe 1916 hbttbt.exe 3668 ddvjp.exe 1844 ffxrrlf.exe 4920 tnbnht.exe 1052 pvjpd.exe 5024 rxfllrr.exe 516 ntbnhb.exe 2604 nhnhbb.exe 1276 pvdvd.exe 3124 xflrllf.exe 3600 btttnn.exe 2156 hhttbh.exe 2164 vvdjd.exe 4100 1rrrffx.exe 4984 tttnhh.exe 2576 bthbth.exe 3356 vvdvp.exe 4888 rrxrrrr.exe 1748 rlxfllr.exe 4376 hbbbtt.exe 2780 jddvp.exe 3844 xxlfxxr.exe 444 tthnbh.exe 3656 hththn.exe 5088 jjpvp.exe 4600 jdjjd.exe 1692 frfrfxr.exe 4816 ttnhhb.exe 4856 3bnhnt.exe 5060 ddvvp.exe 5000 5fxrllf.exe 1288 xxrrlff.exe 3196 tnhtnh.exe 2316 pdvpd.exe 4768 3pvpp.exe 4624 5xxlrlf.exe 4260 flxrxff.exe 1620 nhtnhn.exe 2424 9bhnnb.exe 4520 ppvdd.exe 4804 jdjdd.exe 4700 fxffffx.exe 944 rlrllll.exe 4444 btnnnn.exe 4740 thtbtb.exe 3688 dvddv.exe -
resource yara_rule behavioral2/memory/100-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3488-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1048-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1516-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/868-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4716-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2496-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2336-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4964-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2736-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1432-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3424-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1844-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4920-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1052-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3600-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2156-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2164-204-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 100 wrote to memory of 2000 100 68402ffc36a70c55422d31c6fed7ba40_NeikiAnalytics.exe 83 PID 100 wrote to memory of 2000 100 68402ffc36a70c55422d31c6fed7ba40_NeikiAnalytics.exe 83 PID 100 wrote to memory of 2000 100 68402ffc36a70c55422d31c6fed7ba40_NeikiAnalytics.exe 83 PID 2000 wrote to memory of 3488 2000 nthttt.exe 84 PID 2000 wrote to memory of 3488 2000 nthttt.exe 84 PID 2000 wrote to memory of 3488 2000 nthttt.exe 84 PID 3488 wrote to memory of 1048 3488 1vdjj.exe 85 PID 3488 wrote to memory of 1048 3488 1vdjj.exe 85 PID 3488 wrote to memory of 1048 3488 1vdjj.exe 85 PID 1048 wrote to memory of 1516 1048 xlfrlxl.exe 86 PID 1048 wrote to memory of 1516 1048 xlfrlxl.exe 86 PID 1048 wrote to memory of 1516 1048 xlfrlxl.exe 86 PID 1516 wrote to memory of 868 1516 7bbttt.exe 87 PID 1516 wrote to memory of 868 1516 7bbttt.exe 87 PID 1516 wrote to memory of 868 1516 7bbttt.exe 87 PID 868 wrote to memory of 4608 868 jdpjv.exe 88 PID 868 wrote to memory of 4608 868 jdpjv.exe 88 PID 868 wrote to memory of 4608 868 jdpjv.exe 88 PID 4608 wrote to memory of 4716 4608 frfrlfl.exe 89 PID 4608 wrote to memory of 4716 4608 frfrlfl.exe 89 PID 4608 wrote to memory of 4716 4608 frfrlfl.exe 89 PID 4716 wrote to memory of 4616 4716 1pppj.exe 90 PID 4716 wrote to memory of 4616 4716 1pppj.exe 90 PID 4716 wrote to memory of 4616 4716 1pppj.exe 90 PID 4616 wrote to memory of 2496 4616 rrrfxll.exe 91 PID 4616 wrote to memory of 2496 4616 rrrfxll.exe 91 PID 4616 wrote to memory of 2496 4616 rrrfxll.exe 91 PID 2496 wrote to memory of 2328 2496 hntnhh.exe 92 PID 2496 wrote to memory of 2328 2496 hntnhh.exe 92 PID 2496 wrote to memory of 2328 2496 hntnhh.exe 92 PID 2328 wrote to memory of 4624 2328 dvdjd.exe 93 PID 2328 wrote to memory of 4624 2328 dvdjd.exe 93 PID 2328 wrote to memory of 4624 2328 dvdjd.exe 93 PID 4624 wrote to memory of 4904 4624 llfrrrf.exe 94 PID 4624 wrote to memory of 4904 4624 llfrrrf.exe 94 PID 4624 wrote to memory of 4904 4624 llfrrrf.exe 94 PID 4904 wrote to memory of 2336 4904 nnnbtt.exe 96 PID 4904 wrote to memory of 2336 4904 nnnbtt.exe 96 PID 4904 wrote to memory of 2336 4904 nnnbtt.exe 96 PID 2336 wrote to memory of 4964 2336 jvpjv.exe 97 PID 2336 wrote to memory of 4964 2336 jvpjv.exe 97 PID 2336 wrote to memory of 4964 2336 jvpjv.exe 97 PID 4964 wrote to memory of 2736 4964 lflfxrl.exe 98 PID 4964 wrote to memory of 2736 4964 lflfxrl.exe 98 PID 4964 wrote to memory of 2736 4964 lflfxrl.exe 98 PID 2736 wrote to memory of 1432 2736 bnttbb.exe 99 PID 2736 wrote to memory of 1432 2736 bnttbb.exe 99 PID 2736 wrote to memory of 1432 2736 bnttbb.exe 99 PID 1432 wrote to memory of 3424 1432 nhthnn.exe 100 PID 1432 wrote to memory of 3424 1432 nhthnn.exe 100 PID 1432 wrote to memory of 3424 1432 nhthnn.exe 100 PID 3424 wrote to memory of 3232 3424 dpvpj.exe 101 PID 3424 wrote to memory of 3232 3424 dpvpj.exe 101 PID 3424 wrote to memory of 3232 3424 dpvpj.exe 101 PID 3232 wrote to memory of 1916 3232 frlllxr.exe 102 PID 3232 wrote to memory of 1916 3232 frlllxr.exe 102 PID 3232 wrote to memory of 1916 3232 frlllxr.exe 102 PID 1916 wrote to memory of 3668 1916 hbttbt.exe 103 PID 1916 wrote to memory of 3668 1916 hbttbt.exe 103 PID 1916 wrote to memory of 3668 1916 hbttbt.exe 103 PID 3668 wrote to memory of 1844 3668 ddvjp.exe 104 PID 3668 wrote to memory of 1844 3668 ddvjp.exe 104 PID 3668 wrote to memory of 1844 3668 ddvjp.exe 104 PID 1844 wrote to memory of 4920 1844 ffxrrlf.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\68402ffc36a70c55422d31c6fed7ba40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\68402ffc36a70c55422d31c6fed7ba40_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:100 -
\??\c:\nthttt.exec:\nthttt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\1vdjj.exec:\1vdjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\xlfrlxl.exec:\xlfrlxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\7bbttt.exec:\7bbttt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\jdpjv.exec:\jdpjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\frfrlfl.exec:\frfrlfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\1pppj.exec:\1pppj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\rrrfxll.exec:\rrrfxll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\hntnhh.exec:\hntnhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\dvdjd.exec:\dvdjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\llfrrrf.exec:\llfrrrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\nnnbtt.exec:\nnnbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\jvpjv.exec:\jvpjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\lflfxrl.exec:\lflfxrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\bnttbb.exec:\bnttbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\nhthnn.exec:\nhthnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\dpvpj.exec:\dpvpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\frlllxr.exec:\frlllxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\hbttbt.exec:\hbttbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\ddvjp.exec:\ddvjp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\ffxrrlf.exec:\ffxrrlf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\tnbnht.exec:\tnbnht.exe23⤵
- Executes dropped EXE
PID:4920 -
\??\c:\pvjpd.exec:\pvjpd.exe24⤵
- Executes dropped EXE
PID:1052 -
\??\c:\rxfllrr.exec:\rxfllrr.exe25⤵
- Executes dropped EXE
PID:5024 -
\??\c:\ntbnhb.exec:\ntbnhb.exe26⤵
- Executes dropped EXE
PID:516 -
\??\c:\nhnhbb.exec:\nhnhbb.exe27⤵
- Executes dropped EXE
PID:2604 -
\??\c:\pvdvd.exec:\pvdvd.exe28⤵
- Executes dropped EXE
PID:1276 -
\??\c:\xflrllf.exec:\xflrllf.exe29⤵
- Executes dropped EXE
PID:3124 -
\??\c:\btttnn.exec:\btttnn.exe30⤵
- Executes dropped EXE
PID:3600 -
\??\c:\hhttbh.exec:\hhttbh.exe31⤵
- Executes dropped EXE
PID:2156 -
\??\c:\vvdjd.exec:\vvdjd.exe32⤵
- Executes dropped EXE
PID:2164 -
\??\c:\1rrrffx.exec:\1rrrffx.exe33⤵
- Executes dropped EXE
PID:4100 -
\??\c:\tttnhh.exec:\tttnhh.exe34⤵
- Executes dropped EXE
PID:4984 -
\??\c:\bthbth.exec:\bthbth.exe35⤵
- Executes dropped EXE
PID:2576 -
\??\c:\vvdvp.exec:\vvdvp.exe36⤵
- Executes dropped EXE
PID:3356 -
\??\c:\rrxrrrr.exec:\rrxrrrr.exe37⤵
- Executes dropped EXE
PID:4888 -
\??\c:\rlxfllr.exec:\rlxfllr.exe38⤵
- Executes dropped EXE
PID:1748 -
\??\c:\hbbbtt.exec:\hbbbtt.exe39⤵
- Executes dropped EXE
PID:4376 -
\??\c:\jddvp.exec:\jddvp.exe40⤵
- Executes dropped EXE
PID:2780 -
\??\c:\xxlfxxr.exec:\xxlfxxr.exe41⤵
- Executes dropped EXE
PID:3844 -
\??\c:\tthnbh.exec:\tthnbh.exe42⤵
- Executes dropped EXE
PID:444 -
\??\c:\hththn.exec:\hththn.exe43⤵
- Executes dropped EXE
PID:3656 -
\??\c:\jjpvp.exec:\jjpvp.exe44⤵
- Executes dropped EXE
PID:5088 -
\??\c:\jdjjd.exec:\jdjjd.exe45⤵
- Executes dropped EXE
PID:4600 -
\??\c:\frfrfxr.exec:\frfrfxr.exe46⤵
- Executes dropped EXE
PID:1692 -
\??\c:\ttnhhb.exec:\ttnhhb.exe47⤵
- Executes dropped EXE
PID:4816 -
\??\c:\3bnhnt.exec:\3bnhnt.exe48⤵
- Executes dropped EXE
PID:4856 -
\??\c:\ddvvp.exec:\ddvvp.exe49⤵
- Executes dropped EXE
PID:5060 -
\??\c:\5fxrllf.exec:\5fxrllf.exe50⤵
- Executes dropped EXE
PID:5000 -
\??\c:\xxrrlff.exec:\xxrrlff.exe51⤵
- Executes dropped EXE
PID:1288 -
\??\c:\tnhtnh.exec:\tnhtnh.exe52⤵
- Executes dropped EXE
PID:3196 -
\??\c:\pdvpd.exec:\pdvpd.exe53⤵
- Executes dropped EXE
PID:2316 -
\??\c:\3pvpp.exec:\3pvpp.exe54⤵
- Executes dropped EXE
PID:4768 -
\??\c:\5xxlrlf.exec:\5xxlrlf.exe55⤵
- Executes dropped EXE
PID:4624 -
\??\c:\flxrxff.exec:\flxrxff.exe56⤵
- Executes dropped EXE
PID:4260 -
\??\c:\nhtnhn.exec:\nhtnhn.exe57⤵
- Executes dropped EXE
PID:1620 -
\??\c:\9bhnnb.exec:\9bhnnb.exe58⤵
- Executes dropped EXE
PID:2424 -
\??\c:\ppvdd.exec:\ppvdd.exe59⤵
- Executes dropped EXE
PID:4520 -
\??\c:\jdjdd.exec:\jdjdd.exe60⤵
- Executes dropped EXE
PID:4804 -
\??\c:\fxffffx.exec:\fxffffx.exe61⤵
- Executes dropped EXE
PID:4700 -
\??\c:\rlrllll.exec:\rlrllll.exe62⤵
- Executes dropped EXE
PID:944 -
\??\c:\btnnnn.exec:\btnnnn.exe63⤵
- Executes dropped EXE
PID:4444 -
\??\c:\thtbtb.exec:\thtbtb.exe64⤵
- Executes dropped EXE
PID:4740 -
\??\c:\dvddv.exec:\dvddv.exe65⤵
- Executes dropped EXE
PID:3688 -
\??\c:\jjvpp.exec:\jjvpp.exe66⤵PID:3668
-
\??\c:\xrfflrl.exec:\xrfflrl.exe67⤵PID:1844
-
\??\c:\hhtntb.exec:\hhtntb.exe68⤵PID:396
-
\??\c:\nhhhhb.exec:\nhhhhb.exe69⤵PID:1588
-
\??\c:\dvvjd.exec:\dvvjd.exe70⤵PID:4868
-
\??\c:\rllflxr.exec:\rllflxr.exe71⤵PID:2208
-
\??\c:\thhbhn.exec:\thhbhn.exe72⤵PID:392
-
\??\c:\1nhhhh.exec:\1nhhhh.exe73⤵PID:3880
-
\??\c:\vdddj.exec:\vdddj.exe74⤵PID:640
-
\??\c:\rxrflfl.exec:\rxrflfl.exe75⤵PID:904
-
\??\c:\xfxrlxx.exec:\xfxrlxx.exe76⤵PID:3164
-
\??\c:\btbtnb.exec:\btbtnb.exe77⤵PID:1884
-
\??\c:\tttthn.exec:\tttthn.exe78⤵PID:2360
-
\??\c:\ppvjp.exec:\ppvjp.exe79⤵PID:3512
-
\??\c:\jppjp.exec:\jppjp.exe80⤵PID:4036
-
\??\c:\1frrrrr.exec:\1frrrrr.exe81⤵PID:4100
-
\??\c:\bnbhtn.exec:\bnbhtn.exe82⤵PID:4272
-
\??\c:\nnntnn.exec:\nnntnn.exe83⤵PID:2984
-
\??\c:\jpvpj.exec:\jpvpj.exe84⤵PID:3184
-
\??\c:\dpdvp.exec:\dpdvp.exe85⤵PID:4888
-
\??\c:\rfrffxx.exec:\rfrffxx.exe86⤵PID:4508
-
\??\c:\bntthh.exec:\bntthh.exe87⤵PID:4308
-
\??\c:\tntttt.exec:\tntttt.exe88⤵PID:4976
-
\??\c:\pjjjd.exec:\pjjjd.exe89⤵PID:5016
-
\??\c:\pjjvj.exec:\pjjvj.exe90⤵PID:3844
-
\??\c:\lfrrxlx.exec:\lfrrxlx.exe91⤵PID:212
-
\??\c:\llfrlxr.exec:\llfrlxr.exe92⤵PID:2484
-
\??\c:\ththnh.exec:\ththnh.exe93⤵PID:1516
-
\??\c:\nntnth.exec:\nntnth.exe94⤵PID:4480
-
\??\c:\pjppp.exec:\pjppp.exe95⤵PID:4812
-
\??\c:\lrfxxff.exec:\lrfxxff.exe96⤵PID:2032
-
\??\c:\9flllrx.exec:\9flllrx.exe97⤵PID:5060
-
\??\c:\hnhhnh.exec:\hnhhnh.exe98⤵PID:4192
-
\??\c:\jjpdd.exec:\jjpdd.exe99⤵PID:2024
-
\??\c:\xxlllll.exec:\xxlllll.exe100⤵PID:4244
-
\??\c:\htbtnn.exec:\htbtnn.exe101⤵PID:2328
-
\??\c:\3jpjp.exec:\3jpjp.exe102⤵PID:4904
-
\??\c:\5rfxxxf.exec:\5rfxxxf.exe103⤵PID:2636
-
\??\c:\rlrxrxl.exec:\rlrxrxl.exe104⤵PID:1872
-
\??\c:\bhntnb.exec:\bhntnb.exe105⤵PID:3004
-
\??\c:\jdjvp.exec:\jdjvp.exe106⤵PID:4188
-
\??\c:\9ddvp.exec:\9ddvp.exe107⤵PID:3984
-
\??\c:\xrllrfx.exec:\xrllrfx.exe108⤵PID:3436
-
\??\c:\hbhbbh.exec:\hbhbbh.exe109⤵PID:4552
-
\??\c:\9hnnbb.exec:\9hnnbb.exe110⤵PID:3336
-
\??\c:\vvjpj.exec:\vvjpj.exe111⤵PID:4744
-
\??\c:\fffxxxx.exec:\fffxxxx.exe112⤵PID:1308
-
\??\c:\9dddd.exec:\9dddd.exe113⤵PID:1636
-
\??\c:\xxxrlll.exec:\xxxrlll.exe114⤵PID:3080
-
\??\c:\xxxxrrl.exec:\xxxxrrl.exe115⤵PID:1056
-
\??\c:\htbbbt.exec:\htbbbt.exe116⤵PID:2960
-
\??\c:\lffxxrr.exec:\lffxxrr.exe117⤵PID:4868
-
\??\c:\tntttt.exec:\tntttt.exe118⤵PID:2308
-
\??\c:\hbhbtn.exec:\hbhbtn.exe119⤵PID:3000
-
\??\c:\jpjpp.exec:\jpjpp.exe120⤵PID:1276
-
\??\c:\jjjjv.exec:\jjjjv.exe121⤵PID:3492
-
\??\c:\lrfxllx.exec:\lrfxllx.exe122⤵PID:2260
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-