Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 06:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
13ccedd2f14485d2851a68ccff464f84faa45d3b2b5cebd045e16d4dbf6b47a7_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
13ccedd2f14485d2851a68ccff464f84faa45d3b2b5cebd045e16d4dbf6b47a7_NeikiAnalytics.exe
-
Size
480KB
-
MD5
bdf8e9336f08d504a96e6a17fe3ceef0
-
SHA1
9e52db39105ce762b2a60f24939763274f547846
-
SHA256
13ccedd2f14485d2851a68ccff464f84faa45d3b2b5cebd045e16d4dbf6b47a7
-
SHA512
b947047a686ec0cbb4f84c85e27e84c9f6aff46cd0572162bed82eb26ca3dfb783326bc9b790f5a875f6140fb41eb3a3361b97966517460906fe8de4a59e171d
-
SSDEEP
12288:n3C9uDVw6326pKZ9asZqoZHz+evcn0Meh2Fezt:Su326p0aroZt0st
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/2476-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4196-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2056-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3152-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4456-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2964-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5104-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3304-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2792-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3744-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2200-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2652-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4588-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4404-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2700-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3768-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2724-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/908-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1688-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1524-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3656-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2988-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3212 jjvvd.exe 4196 lllrrrx.exe 2056 ttnnnt.exe 3152 jdjjj.exe 4456 dvvvv.exe 2964 rlfffxx.exe 5104 hthntb.exe 3304 xlllllf.exe 4956 tbttnt.exe 3744 9fxxrxr.exe 2204 nttnnb.exe 2792 rrfxxff.exe 4472 hthhtb.exe 2200 htnhhh.exe 2652 xllllll.exe 1136 pvdvp.exe 4588 nthbhb.exe 2160 vvjjv.exe 4952 xxffflr.exe 4404 hbthbn.exe 2700 jppjv.exe 3768 xxffxrl.exe 2724 pjpdp.exe 908 httnhh.exe 1688 ddvvj.exe 800 bbnnbb.exe 3832 nbhhhn.exe 4284 vjvjv.exe 1524 bbtnnh.exe 3656 9lllflf.exe 2988 jdpdj.exe 4172 nbhbbb.exe 4376 rlrllfx.exe 2344 pdjdd.exe 4920 lxxxrrl.exe 3576 tnnhbb.exe 3492 jdvpj.exe 3536 xrrlfxr.exe 2056 1nhbtt.exe 4560 fxrlxrf.exe 552 7bhbbb.exe 1576 lfflfxr.exe 2876 tthhbt.exe 396 pdpjj.exe 4024 flrllll.exe 1716 nhbbnt.exe 8 dppjj.exe 2268 rfrllxr.exe 3596 lllfxxr.exe 2168 bbhbtt.exe 4460 vpjpp.exe 1136 7pdpj.exe 1140 9xfxllf.exe 4760 vvvdd.exe 1192 jpvdp.exe 1780 fxxllfr.exe 4832 nhhtnb.exe 3748 vvjjv.exe 2724 rlrllfl.exe 2612 ntnnnt.exe 968 hhtnhn.exe 3276 pdjjd.exe 800 1llxrrx.exe 956 xxxxrrl.exe -
resource yara_rule behavioral2/memory/2476-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4196-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2056-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2964-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5104-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3304-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2792-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3744-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2200-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2652-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4588-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4404-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2700-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3768-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2724-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/908-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1688-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1524-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2988-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2476 wrote to memory of 3212 2476 13ccedd2f14485d2851a68ccff464f84faa45d3b2b5cebd045e16d4dbf6b47a7_NeikiAnalytics.exe 82 PID 2476 wrote to memory of 3212 2476 13ccedd2f14485d2851a68ccff464f84faa45d3b2b5cebd045e16d4dbf6b47a7_NeikiAnalytics.exe 82 PID 2476 wrote to memory of 3212 2476 13ccedd2f14485d2851a68ccff464f84faa45d3b2b5cebd045e16d4dbf6b47a7_NeikiAnalytics.exe 82 PID 3212 wrote to memory of 4196 3212 jjvvd.exe 83 PID 3212 wrote to memory of 4196 3212 jjvvd.exe 83 PID 3212 wrote to memory of 4196 3212 jjvvd.exe 83 PID 4196 wrote to memory of 2056 4196 lllrrrx.exe 84 PID 4196 wrote to memory of 2056 4196 lllrrrx.exe 84 PID 4196 wrote to memory of 2056 4196 lllrrrx.exe 84 PID 2056 wrote to memory of 3152 2056 ttnnnt.exe 85 PID 2056 wrote to memory of 3152 2056 ttnnnt.exe 85 PID 2056 wrote to memory of 3152 2056 ttnnnt.exe 85 PID 3152 wrote to memory of 4456 3152 jdjjj.exe 86 PID 3152 wrote to memory of 4456 3152 jdjjj.exe 86 PID 3152 wrote to memory of 4456 3152 jdjjj.exe 86 PID 4456 wrote to memory of 2964 4456 dvvvv.exe 87 PID 4456 wrote to memory of 2964 4456 dvvvv.exe 87 PID 4456 wrote to memory of 2964 4456 dvvvv.exe 87 PID 2964 wrote to memory of 5104 2964 rlfffxx.exe 88 PID 2964 wrote to memory of 5104 2964 rlfffxx.exe 88 PID 2964 wrote to memory of 5104 2964 rlfffxx.exe 88 PID 5104 wrote to memory of 3304 5104 hthntb.exe 89 PID 5104 wrote to memory of 3304 5104 hthntb.exe 89 PID 5104 wrote to memory of 3304 5104 hthntb.exe 89 PID 3304 wrote to memory of 4956 3304 xlllllf.exe 90 PID 3304 wrote to memory of 4956 3304 xlllllf.exe 90 PID 3304 wrote to memory of 4956 3304 xlllllf.exe 90 PID 4956 wrote to memory of 3744 4956 tbttnt.exe 91 PID 4956 wrote to memory of 3744 4956 tbttnt.exe 91 PID 4956 wrote to memory of 3744 4956 tbttnt.exe 91 PID 3744 wrote to memory of 2204 3744 9fxxrxr.exe 93 PID 3744 wrote to memory of 2204 3744 9fxxrxr.exe 93 PID 3744 wrote to memory of 2204 3744 9fxxrxr.exe 93 PID 2204 wrote to memory of 2792 2204 nttnnb.exe 94 PID 2204 wrote to memory of 2792 2204 nttnnb.exe 94 PID 2204 wrote to memory of 2792 2204 nttnnb.exe 94 PID 2792 wrote to memory of 4472 2792 rrfxxff.exe 95 PID 2792 wrote to memory of 4472 2792 rrfxxff.exe 95 PID 2792 wrote to memory of 4472 2792 rrfxxff.exe 95 PID 4472 wrote to memory of 2200 4472 hthhtb.exe 97 PID 4472 wrote to memory of 2200 4472 hthhtb.exe 97 PID 4472 wrote to memory of 2200 4472 hthhtb.exe 97 PID 2200 wrote to memory of 2652 2200 htnhhh.exe 98 PID 2200 wrote to memory of 2652 2200 htnhhh.exe 98 PID 2200 wrote to memory of 2652 2200 htnhhh.exe 98 PID 2652 wrote to memory of 1136 2652 xllllll.exe 99 PID 2652 wrote to memory of 1136 2652 xllllll.exe 99 PID 2652 wrote to memory of 1136 2652 xllllll.exe 99 PID 1136 wrote to memory of 4588 1136 pvdvp.exe 101 PID 1136 wrote to memory of 4588 1136 pvdvp.exe 101 PID 1136 wrote to memory of 4588 1136 pvdvp.exe 101 PID 4588 wrote to memory of 2160 4588 nthbhb.exe 102 PID 4588 wrote to memory of 2160 4588 nthbhb.exe 102 PID 4588 wrote to memory of 2160 4588 nthbhb.exe 102 PID 2160 wrote to memory of 4952 2160 vvjjv.exe 103 PID 2160 wrote to memory of 4952 2160 vvjjv.exe 103 PID 2160 wrote to memory of 4952 2160 vvjjv.exe 103 PID 4952 wrote to memory of 4404 4952 xxffflr.exe 104 PID 4952 wrote to memory of 4404 4952 xxffflr.exe 104 PID 4952 wrote to memory of 4404 4952 xxffflr.exe 104 PID 4404 wrote to memory of 2700 4404 hbthbn.exe 105 PID 4404 wrote to memory of 2700 4404 hbthbn.exe 105 PID 4404 wrote to memory of 2700 4404 hbthbn.exe 105 PID 2700 wrote to memory of 3768 2700 jppjv.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\13ccedd2f14485d2851a68ccff464f84faa45d3b2b5cebd045e16d4dbf6b47a7_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\13ccedd2f14485d2851a68ccff464f84faa45d3b2b5cebd045e16d4dbf6b47a7_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\jjvvd.exec:\jjvvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\lllrrrx.exec:\lllrrrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
\??\c:\ttnnnt.exec:\ttnnnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\jdjjj.exec:\jdjjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\dvvvv.exec:\dvvvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\rlfffxx.exec:\rlfffxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\hthntb.exec:\hthntb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\xlllllf.exec:\xlllllf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\tbttnt.exec:\tbttnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\9fxxrxr.exec:\9fxxrxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\nttnnb.exec:\nttnnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\rrfxxff.exec:\rrfxxff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\hthhtb.exec:\hthhtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\htnhhh.exec:\htnhhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\xllllll.exec:\xllllll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\pvdvp.exec:\pvdvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\nthbhb.exec:\nthbhb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\vvjjv.exec:\vvjjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\xxffflr.exec:\xxffflr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\hbthbn.exec:\hbthbn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\jppjv.exec:\jppjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\xxffxrl.exec:\xxffxrl.exe23⤵
- Executes dropped EXE
PID:3768 -
\??\c:\pjpdp.exec:\pjpdp.exe24⤵
- Executes dropped EXE
PID:2724 -
\??\c:\httnhh.exec:\httnhh.exe25⤵
- Executes dropped EXE
PID:908 -
\??\c:\ddvvj.exec:\ddvvj.exe26⤵
- Executes dropped EXE
PID:1688 -
\??\c:\bbnnbb.exec:\bbnnbb.exe27⤵
- Executes dropped EXE
PID:800 -
\??\c:\nbhhhn.exec:\nbhhhn.exe28⤵
- Executes dropped EXE
PID:3832 -
\??\c:\vjvjv.exec:\vjvjv.exe29⤵
- Executes dropped EXE
PID:4284 -
\??\c:\bbtnnh.exec:\bbtnnh.exe30⤵
- Executes dropped EXE
PID:1524 -
\??\c:\9lllflf.exec:\9lllflf.exe31⤵
- Executes dropped EXE
PID:3656 -
\??\c:\jdpdj.exec:\jdpdj.exe32⤵
- Executes dropped EXE
PID:2988 -
\??\c:\nbhbbb.exec:\nbhbbb.exe33⤵
- Executes dropped EXE
PID:4172 -
\??\c:\rlrllfx.exec:\rlrllfx.exe34⤵
- Executes dropped EXE
PID:4376 -
\??\c:\pdjdd.exec:\pdjdd.exe35⤵
- Executes dropped EXE
PID:2344 -
\??\c:\lxxxrrl.exec:\lxxxrrl.exe36⤵
- Executes dropped EXE
PID:4920 -
\??\c:\tnnhbb.exec:\tnnhbb.exe37⤵
- Executes dropped EXE
PID:3576 -
\??\c:\jdvpj.exec:\jdvpj.exe38⤵
- Executes dropped EXE
PID:3492 -
\??\c:\xrrlfxr.exec:\xrrlfxr.exe39⤵
- Executes dropped EXE
PID:3536 -
\??\c:\1nhbtt.exec:\1nhbtt.exe40⤵
- Executes dropped EXE
PID:2056 -
\??\c:\fxrlxrf.exec:\fxrlxrf.exe41⤵
- Executes dropped EXE
PID:4560 -
\??\c:\7bhbbb.exec:\7bhbbb.exe42⤵
- Executes dropped EXE
PID:552 -
\??\c:\lfflfxr.exec:\lfflfxr.exe43⤵
- Executes dropped EXE
PID:1576 -
\??\c:\tthhbt.exec:\tthhbt.exe44⤵
- Executes dropped EXE
PID:2876 -
\??\c:\pdpjj.exec:\pdpjj.exe45⤵
- Executes dropped EXE
PID:396 -
\??\c:\flrllll.exec:\flrllll.exe46⤵
- Executes dropped EXE
PID:4024 -
\??\c:\nhbbnt.exec:\nhbbnt.exe47⤵
- Executes dropped EXE
PID:1716 -
\??\c:\dppjj.exec:\dppjj.exe48⤵
- Executes dropped EXE
PID:8 -
\??\c:\rfrllxr.exec:\rfrllxr.exe49⤵
- Executes dropped EXE
PID:2268 -
\??\c:\lllfxxr.exec:\lllfxxr.exe50⤵
- Executes dropped EXE
PID:3596 -
\??\c:\bbhbtt.exec:\bbhbtt.exe51⤵
- Executes dropped EXE
PID:2168 -
\??\c:\vpjpp.exec:\vpjpp.exe52⤵
- Executes dropped EXE
PID:4460 -
\??\c:\7pdpj.exec:\7pdpj.exe53⤵
- Executes dropped EXE
PID:1136 -
\??\c:\9xfxllf.exec:\9xfxllf.exe54⤵
- Executes dropped EXE
PID:1140 -
\??\c:\vvvdd.exec:\vvvdd.exe55⤵
- Executes dropped EXE
PID:4760 -
\??\c:\jpvdp.exec:\jpvdp.exe56⤵
- Executes dropped EXE
PID:1192 -
\??\c:\fxxllfr.exec:\fxxllfr.exe57⤵
- Executes dropped EXE
PID:1780 -
\??\c:\nhhtnb.exec:\nhhtnb.exe58⤵
- Executes dropped EXE
PID:4832 -
\??\c:\vvjjv.exec:\vvjjv.exe59⤵
- Executes dropped EXE
PID:3748 -
\??\c:\rlrllfl.exec:\rlrllfl.exe60⤵
- Executes dropped EXE
PID:2724 -
\??\c:\ntnnnt.exec:\ntnnnt.exe61⤵
- Executes dropped EXE
PID:2612 -
\??\c:\hhtnhn.exec:\hhtnhn.exe62⤵
- Executes dropped EXE
PID:968 -
\??\c:\pdjjd.exec:\pdjjd.exe63⤵
- Executes dropped EXE
PID:3276 -
\??\c:\1llxrrx.exec:\1llxrrx.exe64⤵
- Executes dropped EXE
PID:800 -
\??\c:\xxxxrrl.exec:\xxxxrrl.exe65⤵
- Executes dropped EXE
PID:956 -
\??\c:\5nhhhn.exec:\5nhhhn.exe66⤵PID:3592
-
\??\c:\1jjdv.exec:\1jjdv.exe67⤵PID:2828
-
\??\c:\thhttt.exec:\thhttt.exe68⤵PID:1504
-
\??\c:\ntbtnn.exec:\ntbtnn.exe69⤵PID:4564
-
\??\c:\jpdjv.exec:\jpdjv.exe70⤵PID:4380
-
\??\c:\lfffxxx.exec:\lfffxxx.exe71⤵PID:2492
-
\??\c:\tbnbnb.exec:\tbnbnb.exe72⤵PID:4640
-
\??\c:\hbhbbh.exec:\hbhbbh.exe73⤵PID:436
-
\??\c:\rfrrrrr.exec:\rfrrrrr.exe74⤵PID:1300
-
\??\c:\ffxxllx.exec:\ffxxllx.exe75⤵PID:4204
-
\??\c:\1btnnt.exec:\1btnnt.exe76⤵PID:1836
-
\??\c:\lfxlxfx.exec:\lfxlxfx.exe77⤵PID:2388
-
\??\c:\tbhhbb.exec:\tbhhbb.exe78⤵PID:4596
-
\??\c:\lfrxxlf.exec:\lfrxxlf.exe79⤵PID:1992
-
\??\c:\5nnhnn.exec:\5nnhnn.exe80⤵PID:2180
-
\??\c:\jdddj.exec:\jdddj.exe81⤵PID:2932
-
\??\c:\xrrfffr.exec:\xrrfffr.exe82⤵PID:1184
-
\??\c:\bbbhbt.exec:\bbbhbt.exe83⤵PID:3580
-
\??\c:\pvdvp.exec:\pvdvp.exe84⤵PID:3344
-
\??\c:\fxrrrll.exec:\fxrrrll.exe85⤵PID:1028
-
\??\c:\thhhtt.exec:\thhhtt.exe86⤵PID:4776
-
\??\c:\djvdj.exec:\djvdj.exe87⤵PID:2268
-
\??\c:\rrlrrlr.exec:\rrlrrlr.exe88⤵PID:1532
-
\??\c:\vdjjd.exec:\vdjjd.exe89⤵PID:2032
-
\??\c:\pvjjd.exec:\pvjjd.exe90⤵PID:2036
-
\??\c:\xxxrlfx.exec:\xxxrlfx.exe91⤵PID:1136
-
\??\c:\tttttb.exec:\tttttb.exe92⤵PID:1140
-
\??\c:\jdpjj.exec:\jdpjj.exe93⤵PID:868
-
\??\c:\lrlfrff.exec:\lrlfrff.exe94⤵PID:3020
-
\??\c:\lxlllrr.exec:\lxlllrr.exe95⤵PID:1780
-
\??\c:\7ntttb.exec:\7ntttb.exe96⤵PID:1960
-
\??\c:\jdvvp.exec:\jdvvp.exe97⤵PID:5108
-
\??\c:\7xrlfff.exec:\7xrlfff.exe98⤵PID:2288
-
\??\c:\frlfrrf.exec:\frlfrrf.exe99⤵PID:4124
-
\??\c:\hbhbtb.exec:\hbhbtb.exe100⤵PID:3424
-
\??\c:\vpjvj.exec:\vpjvj.exe101⤵PID:1176
-
\??\c:\lxrrlff.exec:\lxrrlff.exe102⤵PID:3832
-
\??\c:\ntbttt.exec:\ntbttt.exe103⤵PID:3236
-
\??\c:\jppvj.exec:\jppvj.exe104⤵PID:656
-
\??\c:\xxrxlfx.exec:\xxrxlfx.exe105⤵PID:4668
-
\??\c:\rlflfff.exec:\rlflfff.exe106⤵PID:1524
-
\??\c:\jjjjd.exec:\jjjjd.exe107⤵PID:2436
-
\??\c:\dddvp.exec:\dddvp.exe108⤵PID:876
-
\??\c:\fxfxxff.exec:\fxfxxff.exe109⤵PID:1916
-
\??\c:\9ppjj.exec:\9ppjj.exe110⤵PID:4352
-
\??\c:\lrlxlxl.exec:\lrlxlxl.exe111⤵PID:1236
-
\??\c:\3nnttn.exec:\3nnttn.exe112⤵PID:4896
-
\??\c:\9ddjv.exec:\9ddjv.exe113⤵PID:3784
-
\??\c:\5fxxrrl.exec:\5fxxrrl.exe114⤵PID:4204
-
\??\c:\nbbtnh.exec:\nbbtnh.exe115⤵PID:3152
-
\??\c:\jvjpj.exec:\jvjpj.exe116⤵PID:3724
-
\??\c:\xrfxrfx.exec:\xrfxrfx.exe117⤵PID:2088
-
\??\c:\ffxfffx.exec:\ffxfffx.exe118⤵PID:1592
-
\??\c:\ttbbbb.exec:\ttbbbb.exe119⤵PID:1552
-
\??\c:\vpdvv.exec:\vpdvv.exe120⤵PID:1036
-
\??\c:\hhtbbh.exec:\hhtbbh.exe121⤵PID:4024
-
\??\c:\btnhbb.exec:\btnhbb.exe122⤵PID:684
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-