Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
30/05/2024, 10:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
47aee3ab4e24bbde6b5f74dd7ef75fc0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
- Target 47aee3ab4e24bbde6b5f74dd7ef75fc0_NeikiAnalytics.exe
- Size 213KB
- Sample240530-msad8aee5v
- SHA256 de9fa54b3f8276d187617425feaf31402d70890802ce97be8c5ce452892b71e5
- MD5 47aee3ab4e24bbde6b5f74dd7ef75fc0
- SHA1 67d9d3678e853b04b89eb3def6ff1898e3232ab8
- SHA512 41448c7db71f78eace239807c0009f0e9e9cc33535e99c4ef28d3ee9a693bc6cf2596e2ab9ce766a24d3cd2c4f7b2c4c9e5c20a36808d0286947d141c109b066
- SSDEEP 3072:ymb3NkkiQ3mdBjFIi/0RU6QeYQsm71vPmc51+GqekBJCvr6zJBUmABvE:n3C9BRIG0asYFm71m8+GdkB9EBs
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/3936-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1564-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4456-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1668-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5040-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/884-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3588-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3700-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3852-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2952-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2492-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4344-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1912-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3452-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1480-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1720-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/232-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3996-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1080-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5112-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2144-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1472-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3864-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 1564 fxrrrrr.exe 4456 tnhbtb.exe 1668 pvjpp.exe 884 7bhbhh.exe 5040 vvvvj.exe 3588 xrlfxxr.exe 3700 vvppp.exe 3852 rrlfllr.exe 2952 hhnhbb.exe 2492 fflllll.exe 4344 5btntb.exe 1912 dvdjd.exe 3452 rlffffr.exe 4508 bhhbbb.exe 4568 jvvpj.exe 4692 fxfffff.exe 1480 9htnnn.exe 1720 llxxrrr.exe 232 9bbttb.exe 1080 rfrrrlf.exe 3996 lxxrrrl.exe 5112 jvdvp.exe 116 7lllffx.exe 1820 thnnhh.exe 2144 pjvdj.exe 4088 1fxxrrl.exe 4440 nntthh.exe 1472 dpvdj.exe 3864 jjjjd.exe 1604 hhhhbb.exe 4064 ppdjp.exe 1572 7rxrlll.exe 956 ffflllr.exe 3692 hnnnhh.exe 4492 vpvdj.exe 4780 lfllfff.exe 1192 3lxrxxf.exe 4360 thnnnn.exe 3964 1nhhtb.exe 3696 3pvpp.exe 2612 xxxxlfl.exe 3380 5flfxxr.exe 4328 nbhtbn.exe 2848 ddvdd.exe 1216 djjdv.exe 3932 5rxxrxr.exe 2840 rrffffx.exe 2780 hhbbth.exe 3700 9hhhbh.exe 4908 7ppjd.exe 764 rxrfxxx.exe 1796 rrfrffl.exe 1032 nhnhhb.exe 2080 nhbbbb.exe 4404 1jdvp.exe 3148 1djjd.exe 3976 rrfxxxr.exe 4508 7lrlffx.exe 3768 hnnhhh.exe 4516 ddddd.exe 2580 9ddpp.exe 2648 lrlxxrr.exe 1720 hbhhbn.exe 5020 tbhbnn.exe -
resource yara_rule behavioral2/memory/3936-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1564-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1668-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/884-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/884-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5040-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/884-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/884-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3700-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3852-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2952-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2492-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1912-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3452-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4568-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1480-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1720-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/232-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3996-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1080-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2144-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1472-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3864-193-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3936 wrote to memory of 1564 3936 47aee3ab4e24bbde6b5f74dd7ef75fc0_NeikiAnalytics.exe 82 PID 3936 wrote to memory of 1564 3936 47aee3ab4e24bbde6b5f74dd7ef75fc0_NeikiAnalytics.exe 82 PID 3936 wrote to memory of 1564 3936 47aee3ab4e24bbde6b5f74dd7ef75fc0_NeikiAnalytics.exe 82 PID 1564 wrote to memory of 4456 1564 fxrrrrr.exe 83 PID 1564 wrote to memory of 4456 1564 fxrrrrr.exe 83 PID 1564 wrote to memory of 4456 1564 fxrrrrr.exe 83 PID 4456 wrote to memory of 1668 4456 tnhbtb.exe 84 PID 4456 wrote to memory of 1668 4456 tnhbtb.exe 84 PID 4456 wrote to memory of 1668 4456 tnhbtb.exe 84 PID 1668 wrote to memory of 884 1668 pvjpp.exe 85 PID 1668 wrote to memory of 884 1668 pvjpp.exe 85 PID 1668 wrote to memory of 884 1668 pvjpp.exe 85 PID 884 wrote to memory of 5040 884 7bhbhh.exe 86 PID 884 wrote to memory of 5040 884 7bhbhh.exe 86 PID 884 wrote to memory of 5040 884 7bhbhh.exe 86 PID 5040 wrote to memory of 3588 5040 vvvvj.exe 87 PID 5040 wrote to memory of 3588 5040 vvvvj.exe 87 PID 5040 wrote to memory of 3588 5040 vvvvj.exe 87 PID 3588 wrote to memory of 3700 3588 xrlfxxr.exe 88 PID 3588 wrote to memory of 3700 3588 xrlfxxr.exe 88 PID 3588 wrote to memory of 3700 3588 xrlfxxr.exe 88 PID 3700 wrote to memory of 3852 3700 vvppp.exe 89 PID 3700 wrote to memory of 3852 3700 vvppp.exe 89 PID 3700 wrote to memory of 3852 3700 vvppp.exe 89 PID 3852 wrote to memory of 2952 3852 rrlfllr.exe 90 PID 3852 wrote to memory of 2952 3852 rrlfllr.exe 90 PID 3852 wrote to memory of 2952 3852 rrlfllr.exe 90 PID 2952 wrote to memory of 2492 2952 hhnhbb.exe 91 PID 2952 wrote to memory of 2492 2952 hhnhbb.exe 91 PID 2952 wrote to memory of 2492 2952 hhnhbb.exe 91 PID 2492 wrote to memory of 4344 2492 fflllll.exe 92 PID 2492 wrote to memory of 4344 2492 fflllll.exe 92 PID 2492 wrote to memory of 4344 2492 fflllll.exe 92 PID 4344 wrote to memory of 1912 4344 5btntb.exe 93 PID 4344 wrote to memory of 1912 4344 5btntb.exe 93 PID 4344 wrote to memory of 1912 4344 5btntb.exe 93 PID 1912 wrote to memory of 3452 1912 dvdjd.exe 94 PID 1912 wrote to memory of 3452 1912 dvdjd.exe 94 PID 1912 wrote to memory of 3452 1912 dvdjd.exe 94 PID 3452 wrote to memory of 4508 3452 rlffffr.exe 96 PID 3452 wrote to memory of 4508 3452 rlffffr.exe 96 PID 3452 wrote to memory of 4508 3452 rlffffr.exe 96 PID 4508 wrote to memory of 4568 4508 bhhbbb.exe 97 PID 4508 wrote to memory of 4568 4508 bhhbbb.exe 97 PID 4508 wrote to memory of 4568 4508 bhhbbb.exe 97 PID 4568 wrote to memory of 4692 4568 jvvpj.exe 98 PID 4568 wrote to memory of 4692 4568 jvvpj.exe 98 PID 4568 wrote to memory of 4692 4568 jvvpj.exe 98 PID 4692 wrote to memory of 1480 4692 fxfffff.exe 99 PID 4692 wrote to memory of 1480 4692 fxfffff.exe 99 PID 4692 wrote to memory of 1480 4692 fxfffff.exe 99 PID 1480 wrote to memory of 1720 1480 9htnnn.exe 100 PID 1480 wrote to memory of 1720 1480 9htnnn.exe 100 PID 1480 wrote to memory of 1720 1480 9htnnn.exe 100 PID 1720 wrote to memory of 232 1720 llxxrrr.exe 102 PID 1720 wrote to memory of 232 1720 llxxrrr.exe 102 PID 1720 wrote to memory of 232 1720 llxxrrr.exe 102 PID 232 wrote to memory of 1080 232 9bbttb.exe 103 PID 232 wrote to memory of 1080 232 9bbttb.exe 103 PID 232 wrote to memory of 1080 232 9bbttb.exe 103 PID 1080 wrote to memory of 3996 1080 rfrrrlf.exe 104 PID 1080 wrote to memory of 3996 1080 rfrrrlf.exe 104 PID 1080 wrote to memory of 3996 1080 rfrrrlf.exe 104 PID 3996 wrote to memory of 5112 3996 lxxrrrl.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\47aee3ab4e24bbde6b5f74dd7ef75fc0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\47aee3ab4e24bbde6b5f74dd7ef75fc0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\fxrrrrr.exec:\fxrrrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\tnhbtb.exec:\tnhbtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\pvjpp.exec:\pvjpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\7bhbhh.exec:\7bhbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\vvvvj.exec:\vvvvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\xrlfxxr.exec:\xrlfxxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\vvppp.exec:\vvppp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\rrlfllr.exec:\rrlfllr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\hhnhbb.exec:\hhnhbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\fflllll.exec:\fflllll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\5btntb.exec:\5btntb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\dvdjd.exec:\dvdjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\rlffffr.exec:\rlffffr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\bhhbbb.exec:\bhhbbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\jvvpj.exec:\jvvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\fxfffff.exec:\fxfffff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\9htnnn.exec:\9htnnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\llxxrrr.exec:\llxxrrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\9bbttb.exec:\9bbttb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\rfrrrlf.exec:\rfrrrlf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\lxxrrrl.exec:\lxxrrrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\jvdvp.exec:\jvdvp.exe23⤵
- Executes dropped EXE
PID:5112 -
\??\c:\7lllffx.exec:\7lllffx.exe24⤵
- Executes dropped EXE
PID:116 -
\??\c:\thnnhh.exec:\thnnhh.exe25⤵
- Executes dropped EXE
PID:1820 -
\??\c:\pjvdj.exec:\pjvdj.exe26⤵
- Executes dropped EXE
PID:2144 -
\??\c:\1fxxrrl.exec:\1fxxrrl.exe27⤵
- Executes dropped EXE
PID:4088 -
\??\c:\nntthh.exec:\nntthh.exe28⤵
- Executes dropped EXE
PID:4440 -
\??\c:\dpvdj.exec:\dpvdj.exe29⤵
- Executes dropped EXE
PID:1472 -
\??\c:\jjjjd.exec:\jjjjd.exe30⤵
- Executes dropped EXE
PID:3864 -
\??\c:\hhhhbb.exec:\hhhhbb.exe31⤵
- Executes dropped EXE
PID:1604 -
\??\c:\ppdjp.exec:\ppdjp.exe32⤵
- Executes dropped EXE
PID:4064 -
\??\c:\7rxrlll.exec:\7rxrlll.exe33⤵
- Executes dropped EXE
PID:1572 -
\??\c:\ffflllr.exec:\ffflllr.exe34⤵
- Executes dropped EXE
PID:956 -
\??\c:\hnnnhh.exec:\hnnnhh.exe35⤵
- Executes dropped EXE
PID:3692 -
\??\c:\vpvdj.exec:\vpvdj.exe36⤵
- Executes dropped EXE
PID:4492 -
\??\c:\lfllfff.exec:\lfllfff.exe37⤵
- Executes dropped EXE
PID:4780 -
\??\c:\3lxrxxf.exec:\3lxrxxf.exe38⤵
- Executes dropped EXE
PID:1192 -
\??\c:\thnnnn.exec:\thnnnn.exe39⤵
- Executes dropped EXE
PID:4360 -
\??\c:\1nhhtb.exec:\1nhhtb.exe40⤵
- Executes dropped EXE
PID:3964 -
\??\c:\3pvpp.exec:\3pvpp.exe41⤵
- Executes dropped EXE
PID:3696 -
\??\c:\xxxxlfl.exec:\xxxxlfl.exe42⤵
- Executes dropped EXE
PID:2612 -
\??\c:\5flfxxr.exec:\5flfxxr.exe43⤵
- Executes dropped EXE
PID:3380 -
\??\c:\nbhtbn.exec:\nbhtbn.exe44⤵
- Executes dropped EXE
PID:4328 -
\??\c:\ddvdd.exec:\ddvdd.exe45⤵
- Executes dropped EXE
PID:2848 -
\??\c:\djjdv.exec:\djjdv.exe46⤵
- Executes dropped EXE
PID:1216 -
\??\c:\5rxxrxr.exec:\5rxxrxr.exe47⤵
- Executes dropped EXE
PID:3932 -
\??\c:\rrffffx.exec:\rrffffx.exe48⤵
- Executes dropped EXE
PID:2840 -
\??\c:\hhbbth.exec:\hhbbth.exe49⤵
- Executes dropped EXE
PID:2780 -
\??\c:\9hhhbh.exec:\9hhhbh.exe50⤵
- Executes dropped EXE
PID:3700 -
\??\c:\7ppjd.exec:\7ppjd.exe51⤵
- Executes dropped EXE
PID:4908 -
\??\c:\rxrfxxx.exec:\rxrfxxx.exe52⤵
- Executes dropped EXE
PID:764 -
\??\c:\rrfrffl.exec:\rrfrffl.exe53⤵
- Executes dropped EXE
PID:1796 -
\??\c:\nhnhhb.exec:\nhnhhb.exe54⤵
- Executes dropped EXE
PID:1032 -
\??\c:\nhbbbb.exec:\nhbbbb.exe55⤵
- Executes dropped EXE
PID:2080 -
\??\c:\1jdvp.exec:\1jdvp.exe56⤵
- Executes dropped EXE
PID:4404 -
\??\c:\1djjd.exec:\1djjd.exe57⤵
- Executes dropped EXE
PID:3148 -
\??\c:\rrfxxxr.exec:\rrfxxxr.exe58⤵
- Executes dropped EXE
PID:3976 -
\??\c:\7lrlffx.exec:\7lrlffx.exe59⤵
- Executes dropped EXE
PID:4508 -
\??\c:\hnnhhh.exec:\hnnhhh.exe60⤵
- Executes dropped EXE
PID:3768 -
\??\c:\ddddd.exec:\ddddd.exe61⤵
- Executes dropped EXE
PID:4516 -
\??\c:\9ddpp.exec:\9ddpp.exe62⤵
- Executes dropped EXE
PID:2580 -
\??\c:\lrlxxrr.exec:\lrlxxrr.exe63⤵
- Executes dropped EXE
PID:2648 -
\??\c:\hbhhbn.exec:\hbhhbn.exe64⤵
- Executes dropped EXE
PID:1720 -
\??\c:\tbhbnn.exec:\tbhbnn.exe65⤵
- Executes dropped EXE
PID:5020 -
\??\c:\djpjv.exec:\djpjv.exe66⤵PID:2788
-
\??\c:\rrxxxxx.exec:\rrxxxxx.exe67⤵PID:880
-
\??\c:\fxxfxll.exec:\fxxfxll.exe68⤵PID:4752
-
\??\c:\nbbbbb.exec:\nbbbbb.exe69⤵PID:496
-
\??\c:\ppjjd.exec:\ppjjd.exe70⤵PID:4048
-
\??\c:\rrflrrx.exec:\rrflrrx.exe71⤵PID:784
-
\??\c:\7hbbhh.exec:\7hbbhh.exe72⤵PID:2068
-
\??\c:\tnbhnt.exec:\tnbhnt.exe73⤵PID:2992
-
\??\c:\ddvvp.exec:\ddvvp.exe74⤵PID:4388
-
\??\c:\7fffllr.exec:\7fffllr.exe75⤵PID:3512
-
\??\c:\htnnhn.exec:\htnnhn.exe76⤵PID:3556
-
\??\c:\pdpjd.exec:\pdpjd.exe77⤵PID:4104
-
\??\c:\pddvv.exec:\pddvv.exe78⤵PID:2812
-
\??\c:\llrfxfr.exec:\llrfxfr.exe79⤵PID:4056
-
\??\c:\bnhnnt.exec:\bnhnnt.exe80⤵PID:4976
-
\??\c:\bbhttt.exec:\bbhttt.exe81⤵PID:3368
-
\??\c:\vjppv.exec:\vjppv.exe82⤵PID:3464
-
\??\c:\ppvvv.exec:\ppvvv.exe83⤵PID:3692
-
\??\c:\rllfffl.exec:\rllfffl.exe84⤵PID:4492
-
\??\c:\tnhhhn.exec:\tnhhhn.exe85⤵PID:4780
-
\??\c:\btnhhn.exec:\btnhhn.exe86⤵PID:980
-
\??\c:\9dvjj.exec:\9dvjj.exe87⤵PID:4072
-
\??\c:\7jppp.exec:\7jppp.exe88⤵PID:1208
-
\??\c:\rrxxxfx.exec:\rrxxxfx.exe89⤵PID:3576
-
\??\c:\xxlrrrx.exec:\xxlrrrx.exe90⤵PID:4420
-
\??\c:\bthttb.exec:\bthttb.exe91⤵PID:1668
-
\??\c:\jvddv.exec:\jvddv.exe92⤵PID:4580
-
\??\c:\jjvdd.exec:\jjvdd.exe93⤵PID:2856
-
\??\c:\flrrrxf.exec:\flrrrxf.exe94⤵PID:4280
-
\??\c:\nhnhhh.exec:\nhnhhh.exe95⤵PID:3588
-
\??\c:\btnntt.exec:\btnntt.exe96⤵PID:5060
-
\??\c:\vvdvv.exec:\vvdvv.exe97⤵PID:1104
-
\??\c:\1pppj.exec:\1pppj.exe98⤵PID:2948
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe99⤵PID:4960
-
\??\c:\hhnnnn.exec:\hhnnnn.exe100⤵PID:2960
-
\??\c:\bhbbbb.exec:\bhbbbb.exe101⤵PID:1692
-
\??\c:\jjddv.exec:\jjddv.exe102⤵PID:1032
-
\??\c:\xrrrlrr.exec:\xrrrlrr.exe103⤵PID:3020
-
\??\c:\1hhnnt.exec:\1hhnnt.exe104⤵PID:464
-
\??\c:\jvjjd.exec:\jvjjd.exe105⤵PID:3148
-
\??\c:\llrllrr.exec:\llrllrr.exe106⤵PID:3976
-
\??\c:\ffrrrxf.exec:\ffrrrxf.exe107⤵PID:4472
-
\??\c:\hnhhtb.exec:\hnhhtb.exe108⤵PID:3768
-
\??\c:\tnttnt.exec:\tnttnt.exe109⤵PID:3660
-
\??\c:\dvppv.exec:\dvppv.exe110⤵PID:712
-
\??\c:\pddpp.exec:\pddpp.exe111⤵PID:2648
-
\??\c:\rrxxrll.exec:\rrxxrll.exe112⤵PID:3900
-
\??\c:\lffflrf.exec:\lffflrf.exe113⤵PID:1080
-
\??\c:\hbhhhn.exec:\hbhhhn.exe114⤵PID:4268
-
\??\c:\jjddd.exec:\jjddd.exe115⤵PID:3128
-
\??\c:\vpvvp.exec:\vpvvp.exe116⤵PID:4048
-
\??\c:\xfxxlrf.exec:\xfxxlrf.exe117⤵PID:1820
-
\??\c:\tbhhnn.exec:\tbhhnn.exe118⤵PID:3580
-
\??\c:\bhtbbb.exec:\bhtbbb.exe119⤵PID:3956
-
\??\c:\vvjjd.exec:\vvjjd.exe120⤵PID:2660
-
\??\c:\fxlllrr.exec:\fxlllrr.exe121⤵PID:3340
-
\??\c:\rxfflrr.exec:\rxfflrr.exe122⤵PID:3248
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-