Analysis
-
max time kernel
27s -
max time network
27s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
11/05/2024, 16:17
Static task
static1
1 signatures
General
-
Target
18a96df610f6d9feb0acb5fa4170fd20_NeikiAnalytics.exe
-
Size
63KB
-
MD5
18a96df610f6d9feb0acb5fa4170fd20
-
SHA1
d3c3b224676c01e47dd869c4346dc05d073a5de3
-
SHA256
eafbc909e383a3f00522e880e0e7b49c5c84b31d64381c096fc30c22b10ef2cd
-
SHA512
36cb28f09eaac89aff637b848f2e22b3e164cfe388261bcad71eace963bc35f5ff4a771d8ab1f2397b59194cd3703f06c6b060f8cedae050693aa3af0b4044f4
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIhJm/wY:ymb3NkkiQ3mdBjFILm/
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/3504-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/4664-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1464-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/4352-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/8-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/4284-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/4028-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/560-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3276-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/700-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/4264-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3440-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3988-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/772-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3564-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/900-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1204-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2144-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1812-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/484-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3904-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1748-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/4136-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4664 5fxxxrr.exe 1464 ntbttb.exe 4352 3vddj.exe 8 5flffrr.exe 4284 xfxrrrr.exe 4028 hbbbhb.exe 2256 llfxxfx.exe 2252 tnnhhh.exe 560 pddjj.exe 3276 lfffxff.exe 700 xflrrxx.exe 4264 thhhnt.exe 3440 9bhbtt.exe 3988 pdppv.exe 4792 rxxxllf.exe 772 tbhhhn.exe 3564 vdvdd.exe 900 9pvvv.exe 1972 lffxllf.exe 5036 5ttttt.exe 1204 pvddd.exe 2144 9xfrfff.exe 1812 9nthnb.exe 4120 hhbbhh.exe 3192 vdpvd.exe 2484 rfffflf.exe 484 nbhbbb.exe 3904 pdpjd.exe 1748 lxfrrff.exe 4140 9hhbtt.exe 4136 vjpvp.exe 3612 djjpp.exe 1720 llllxfx.exe 1764 tbbhnn.exe 796 bhttnt.exe 4268 vvvvv.exe 2548 jvddj.exe 2916 rxfxffx.exe 2624 thtbbb.exe 4108 nnhbnt.exe 4732 9pjvj.exe 3504 5llfllf.exe 1068 5rrrlrl.exe 5116 nhttth.exe 1464 vvvvv.exe 1604 3jppj.exe 392 xllfxxr.exe 976 xfrrrfx.exe 4284 hnhnhh.exe 2444 vpvpv.exe 2380 fxlflrx.exe 4984 xrrrrrr.exe 3604 hnnbbh.exe 2688 jpvjp.exe 560 3ddvj.exe 4420 xxfxxxx.exe 700 bnnnbh.exe 3804 1tbbhn.exe 3716 dpvpj.exe 1372 llfxxxx.exe 3988 lffffxx.exe 240 9bbnhh.exe 4892 ttbttt.exe 964 dppvv.exe -
resource yara_rule behavioral1/memory/3504-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4664-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1464-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4352-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/8-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4284-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4028-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/560-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3276-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/700-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4264-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3440-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3988-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/772-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3564-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/900-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1204-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2144-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1812-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/484-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3904-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1748-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4136-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3504 wrote to memory of 4664 3504 18a96df610f6d9feb0acb5fa4170fd20_NeikiAnalytics.exe 79 PID 3504 wrote to memory of 4664 3504 18a96df610f6d9feb0acb5fa4170fd20_NeikiAnalytics.exe 79 PID 3504 wrote to memory of 4664 3504 18a96df610f6d9feb0acb5fa4170fd20_NeikiAnalytics.exe 79 PID 4664 wrote to memory of 1464 4664 5fxxxrr.exe 80 PID 4664 wrote to memory of 1464 4664 5fxxxrr.exe 80 PID 4664 wrote to memory of 1464 4664 5fxxxrr.exe 80 PID 1464 wrote to memory of 4352 1464 ntbttb.exe 81 PID 1464 wrote to memory of 4352 1464 ntbttb.exe 81 PID 1464 wrote to memory of 4352 1464 ntbttb.exe 81 PID 4352 wrote to memory of 8 4352 3vddj.exe 82 PID 4352 wrote to memory of 8 4352 3vddj.exe 82 PID 4352 wrote to memory of 8 4352 3vddj.exe 82 PID 8 wrote to memory of 4284 8 5flffrr.exe 83 PID 8 wrote to memory of 4284 8 5flffrr.exe 83 PID 8 wrote to memory of 4284 8 5flffrr.exe 83 PID 4284 wrote to memory of 4028 4284 xfxrrrr.exe 84 PID 4284 wrote to memory of 4028 4284 xfxrrrr.exe 84 PID 4284 wrote to memory of 4028 4284 xfxrrrr.exe 84 PID 4028 wrote to memory of 2256 4028 hbbbhb.exe 85 PID 4028 wrote to memory of 2256 4028 hbbbhb.exe 85 PID 4028 wrote to memory of 2256 4028 hbbbhb.exe 85 PID 2256 wrote to memory of 2252 2256 llfxxfx.exe 86 PID 2256 wrote to memory of 2252 2256 llfxxfx.exe 86 PID 2256 wrote to memory of 2252 2256 llfxxfx.exe 86 PID 2252 wrote to memory of 560 2252 tnnhhh.exe 87 PID 2252 wrote to memory of 560 2252 tnnhhh.exe 87 PID 2252 wrote to memory of 560 2252 tnnhhh.exe 87 PID 560 wrote to memory of 3276 560 pddjj.exe 88 PID 560 wrote to memory of 3276 560 pddjj.exe 88 PID 560 wrote to memory of 3276 560 pddjj.exe 88 PID 3276 wrote to memory of 700 3276 lfffxff.exe 89 PID 3276 wrote to memory of 700 3276 lfffxff.exe 89 PID 3276 wrote to memory of 700 3276 lfffxff.exe 89 PID 700 wrote to memory of 4264 700 xflrrxx.exe 90 PID 700 wrote to memory of 4264 700 xflrrxx.exe 90 PID 700 wrote to memory of 4264 700 xflrrxx.exe 90 PID 4264 wrote to memory of 3440 4264 thhhnt.exe 91 PID 4264 wrote to memory of 3440 4264 thhhnt.exe 91 PID 4264 wrote to memory of 3440 4264 thhhnt.exe 91 PID 3440 wrote to memory of 3988 3440 9bhbtt.exe 92 PID 3440 wrote to memory of 3988 3440 9bhbtt.exe 92 PID 3440 wrote to memory of 3988 3440 9bhbtt.exe 92 PID 3988 wrote to memory of 4792 3988 pdppv.exe 94 PID 3988 wrote to memory of 4792 3988 pdppv.exe 94 PID 3988 wrote to memory of 4792 3988 pdppv.exe 94 PID 4792 wrote to memory of 772 4792 rxxxllf.exe 95 PID 4792 wrote to memory of 772 4792 rxxxllf.exe 95 PID 4792 wrote to memory of 772 4792 rxxxllf.exe 95 PID 772 wrote to memory of 3564 772 tbhhhn.exe 96 PID 772 wrote to memory of 3564 772 tbhhhn.exe 96 PID 772 wrote to memory of 3564 772 tbhhhn.exe 96 PID 3564 wrote to memory of 900 3564 vdvdd.exe 97 PID 3564 wrote to memory of 900 3564 vdvdd.exe 97 PID 3564 wrote to memory of 900 3564 vdvdd.exe 97 PID 900 wrote to memory of 1972 900 9pvvv.exe 98 PID 900 wrote to memory of 1972 900 9pvvv.exe 98 PID 900 wrote to memory of 1972 900 9pvvv.exe 98 PID 1972 wrote to memory of 5036 1972 lffxllf.exe 99 PID 1972 wrote to memory of 5036 1972 lffxllf.exe 99 PID 1972 wrote to memory of 5036 1972 lffxllf.exe 99 PID 5036 wrote to memory of 1204 5036 5ttttt.exe 100 PID 5036 wrote to memory of 1204 5036 5ttttt.exe 100 PID 5036 wrote to memory of 1204 5036 5ttttt.exe 100 PID 1204 wrote to memory of 2144 1204 pvddd.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\18a96df610f6d9feb0acb5fa4170fd20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18a96df610f6d9feb0acb5fa4170fd20_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\5fxxxrr.exec:\5fxxxrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\ntbttb.exec:\ntbttb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\3vddj.exec:\3vddj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
\??\c:\5flffrr.exec:\5flffrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\xfxrrrr.exec:\xfxrrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\hbbbhb.exec:\hbbbhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\llfxxfx.exec:\llfxxfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\tnnhhh.exec:\tnnhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\pddjj.exec:\pddjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
\??\c:\lfffxff.exec:\lfffxff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
\??\c:\xflrrxx.exec:\xflrrxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
\??\c:\thhhnt.exec:\thhhnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
\??\c:\9bhbtt.exec:\9bhbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\pdppv.exec:\pdppv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\rxxxllf.exec:\rxxxllf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\tbhhhn.exec:\tbhhhn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\vdvdd.exec:\vdvdd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
\??\c:\9pvvv.exec:\9pvvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
\??\c:\lffxllf.exec:\lffxllf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\5ttttt.exec:\5ttttt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\pvddd.exec:\pvddd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\9xfrfff.exec:\9xfrfff.exe23⤵
- Executes dropped EXE
PID:2144 -
\??\c:\9nthnb.exec:\9nthnb.exe24⤵
- Executes dropped EXE
PID:1812 -
\??\c:\hhbbhh.exec:\hhbbhh.exe25⤵
- Executes dropped EXE
PID:4120 -
\??\c:\vdpvd.exec:\vdpvd.exe26⤵
- Executes dropped EXE
PID:3192 -
\??\c:\rfffflf.exec:\rfffflf.exe27⤵
- Executes dropped EXE
PID:2484 -
\??\c:\nbhbbb.exec:\nbhbbb.exe28⤵
- Executes dropped EXE
PID:484 -
\??\c:\pdpjd.exec:\pdpjd.exe29⤵
- Executes dropped EXE
PID:3904 -
\??\c:\lxfrrff.exec:\lxfrrff.exe30⤵
- Executes dropped EXE
PID:1748 -
\??\c:\9hhbtt.exec:\9hhbtt.exe31⤵
- Executes dropped EXE
PID:4140 -
\??\c:\vjpvp.exec:\vjpvp.exe32⤵
- Executes dropped EXE
PID:4136 -
\??\c:\djjpp.exec:\djjpp.exe33⤵
- Executes dropped EXE
PID:3612 -
\??\c:\llllxfx.exec:\llllxfx.exe34⤵
- Executes dropped EXE
PID:1720 -
\??\c:\tbbhnn.exec:\tbbhnn.exe35⤵
- Executes dropped EXE
PID:1764 -
\??\c:\bhttnt.exec:\bhttnt.exe36⤵
- Executes dropped EXE
PID:796 -
\??\c:\vvvvv.exec:\vvvvv.exe37⤵
- Executes dropped EXE
PID:4268 -
\??\c:\jvddj.exec:\jvddj.exe38⤵
- Executes dropped EXE
PID:2548 -
\??\c:\rxfxffx.exec:\rxfxffx.exe39⤵
- Executes dropped EXE
PID:2916 -
\??\c:\thtbbb.exec:\thtbbb.exe40⤵
- Executes dropped EXE
PID:2624 -
\??\c:\nnhbnt.exec:\nnhbnt.exe41⤵
- Executes dropped EXE
PID:4108 -
\??\c:\9pjvj.exec:\9pjvj.exe42⤵
- Executes dropped EXE
PID:4732 -
\??\c:\5llfllf.exec:\5llfllf.exe43⤵
- Executes dropped EXE
PID:3504 -
\??\c:\5rrrlrl.exec:\5rrrlrl.exe44⤵
- Executes dropped EXE
PID:1068 -
\??\c:\nhttth.exec:\nhttth.exe45⤵
- Executes dropped EXE
PID:5116 -
\??\c:\vvvvv.exec:\vvvvv.exe46⤵
- Executes dropped EXE
PID:1464 -
\??\c:\3jppj.exec:\3jppj.exe47⤵
- Executes dropped EXE
PID:1604 -
\??\c:\xllfxxr.exec:\xllfxxr.exe48⤵
- Executes dropped EXE
PID:392 -
\??\c:\xfrrrfx.exec:\xfrrrfx.exe49⤵
- Executes dropped EXE
PID:976 -
\??\c:\hnhnhh.exec:\hnhnhh.exe50⤵
- Executes dropped EXE
PID:4284 -
\??\c:\vpvpv.exec:\vpvpv.exe51⤵
- Executes dropped EXE
PID:2444 -
\??\c:\fxlflrx.exec:\fxlflrx.exe52⤵
- Executes dropped EXE
PID:2380 -
\??\c:\xrrrrrr.exec:\xrrrrrr.exe53⤵
- Executes dropped EXE
PID:4984 -
\??\c:\hnnbbh.exec:\hnnbbh.exe54⤵
- Executes dropped EXE
PID:3604 -
\??\c:\jpvjp.exec:\jpvjp.exe55⤵
- Executes dropped EXE
PID:2688 -
\??\c:\3ddvj.exec:\3ddvj.exe56⤵
- Executes dropped EXE
PID:560 -
\??\c:\xxfxxxx.exec:\xxfxxxx.exe57⤵
- Executes dropped EXE
PID:4420 -
\??\c:\bnnnbh.exec:\bnnnbh.exe58⤵
- Executes dropped EXE
PID:700 -
\??\c:\1tbbhn.exec:\1tbbhn.exe59⤵
- Executes dropped EXE
PID:3804 -
\??\c:\dpvpj.exec:\dpvpj.exe60⤵
- Executes dropped EXE
PID:3716 -
\??\c:\llfxxxx.exec:\llfxxxx.exe61⤵
- Executes dropped EXE
PID:1372 -
\??\c:\lffffxx.exec:\lffffxx.exe62⤵
- Executes dropped EXE
PID:3988 -
\??\c:\9bbnhh.exec:\9bbnhh.exe63⤵
- Executes dropped EXE
PID:240 -
\??\c:\ttbttt.exec:\ttbttt.exe64⤵
- Executes dropped EXE
PID:4892 -
\??\c:\dppvv.exec:\dppvv.exe65⤵
- Executes dropped EXE
PID:964 -
\??\c:\9frxrfl.exec:\9frxrfl.exe66⤵PID:4540
-
\??\c:\3lffffx.exec:\3lffffx.exe67⤵PID:3312
-
\??\c:\tthbtb.exec:\tthbtb.exe68⤵PID:900
-
\??\c:\nbttbb.exec:\nbttbb.exe69⤵PID:908
-
\??\c:\vpvdp.exec:\vpvdp.exe70⤵PID:2344
-
\??\c:\1xlfxxx.exec:\1xlfxxx.exe71⤵PID:492
-
\??\c:\xflllll.exec:\xflllll.exe72⤵PID:4120
-
\??\c:\hnbntn.exec:\hnbntn.exe73⤵PID:3020
-
\??\c:\vvjpp.exec:\vvjpp.exe74⤵PID:1220
-
\??\c:\hhtbnn.exec:\hhtbnn.exe75⤵PID:1584
-
\??\c:\pjddd.exec:\pjddd.exe76⤵PID:776
-
\??\c:\vdpjd.exec:\vdpjd.exe77⤵PID:2968
-
\??\c:\xffffff.exec:\xffffff.exe78⤵PID:2500
-
\??\c:\fxfxfff.exec:\fxfxfff.exe79⤵PID:2780
-
\??\c:\3hnttt.exec:\3hnttt.exe80⤵PID:4112
-
\??\c:\nbbhbb.exec:\nbbhbb.exe81⤵PID:2036
-
\??\c:\vdjpj.exec:\vdjpj.exe82⤵PID:3980
-
\??\c:\ppvdd.exec:\ppvdd.exe83⤵PID:4780
-
\??\c:\5jvpj.exec:\5jvpj.exe84⤵PID:2800
-
\??\c:\btbbnn.exec:\btbbnn.exe85⤵PID:2940
-
\??\c:\3nnhbb.exec:\3nnhbb.exe86⤵PID:5052
-
\??\c:\9jjjj.exec:\9jjjj.exe87⤵PID:4756
-
\??\c:\fxlrfxl.exec:\fxlrfxl.exe88⤵PID:4740
-
\??\c:\lxxxlfx.exec:\lxxxlfx.exe89⤵PID:1932
-
\??\c:\thnnnb.exec:\thnnnb.exe90⤵PID:1264
-
\??\c:\5hnhbh.exec:\5hnhbh.exe91⤵PID:3972
-
\??\c:\dvvdd.exec:\dvvdd.exe92⤵PID:1832
-
\??\c:\jpvvv.exec:\jpvvv.exe93⤵PID:3724
-
\??\c:\3xxxxfx.exec:\3xxxxfx.exe94⤵PID:1604
-
\??\c:\9xfxrfl.exec:\9xfxrfl.exe95⤵PID:2616
-
\??\c:\ttbhhn.exec:\ttbhhn.exe96⤵PID:976
-
\??\c:\ttnhhh.exec:\ttnhhh.exe97⤵PID:2164
-
\??\c:\3dddv.exec:\3dddv.exe98⤵PID:1632
-
\??\c:\3lfxllf.exec:\3lfxllf.exe99⤵PID:4924
-
\??\c:\7rfffrl.exec:\7rfffrl.exe100⤵PID:4984
-
\??\c:\3hbbnh.exec:\3hbbnh.exe101⤵PID:2360
-
\??\c:\bbbtbb.exec:\bbbtbb.exe102⤵PID:3556
-
\??\c:\7bhnbh.exec:\7bhnbh.exe103⤵PID:3276
-
\??\c:\9jppp.exec:\9jppp.exe104⤵PID:2108
-
\??\c:\djddp.exec:\djddp.exe105⤵PID:4244
-
\??\c:\xxffrxx.exec:\xxffrxx.exe106⤵PID:3440
-
\??\c:\xxrrrrr.exec:\xxrrrrr.exe107⤵PID:2796
-
\??\c:\thhnbt.exec:\thhnbt.exe108⤵PID:4440
-
\??\c:\pvjdv.exec:\pvjdv.exe109⤵PID:3144
-
\??\c:\jjjpp.exec:\jjjpp.exe110⤵PID:4932
-
\??\c:\9llxrlx.exec:\9llxrlx.exe111⤵PID:3564
-
\??\c:\hbbbtt.exec:\hbbbtt.exe112⤵PID:1800
-
\??\c:\vpvvd.exec:\vpvvd.exe113⤵PID:3028
-
\??\c:\5jjjp.exec:\5jjjp.exe114⤵PID:2292
-
\??\c:\rrffrlf.exec:\rrffrlf.exe115⤵PID:2892
-
\??\c:\ffxrfff.exec:\ffxrfff.exe116⤵PID:780
-
\??\c:\nhnnnn.exec:\nhnnnn.exe117⤵PID:4048
-
\??\c:\hbhhnb.exec:\hbhhnb.exe118⤵PID:1004
-
\??\c:\vddpj.exec:\vddpj.exe119⤵PID:3192
-
\??\c:\flfxrll.exec:\flfxrll.exe120⤵PID:3124
-
\??\c:\frxxxxf.exec:\frxxxxf.exe121⤵PID:1220
-
\??\c:\llxrlrl.exec:\llxrlrl.exe122⤵PID:4156
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-