Analysis
-
max time kernel
161s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12/05/2024, 18:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
434fb356b44099233f93bad587424d90_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
434fb356b44099233f93bad587424d90_NeikiAnalytics.exe
-
Size
114KB
-
MD5
434fb356b44099233f93bad587424d90
-
SHA1
cd1c644873299f56590d456c1e96e61a692b2be8
-
SHA256
66d80073c3288cea285f33a2cec63f31442d6561e6202d049779e487c1e90364
-
SHA512
544d841bf7f6a684a5d61d79f127dec3fc0d1c5656285be00493b2bd44a3051461a8b418f3515e4ca7a7d0b3df3e845f056b7cab601e12324c6155dcb99e54e0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73oYUCD7R2F2UVbyy0NN:ymb3NkkiQ3mdBjFo73HUoMsAbrK
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/3248-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4032-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3248-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1284-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3872-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3872-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3000-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/792-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1056-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/888-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3280-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2452-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3916-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3880-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1388-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/884-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1844-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4440-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/968-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4340-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3676-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4032 sx02i6w.exe 1284 hc5vw.exe 3872 2414l.exe 3000 0v6n23n.exe 792 64kc3.exe 1056 176xt.exe 5084 utf8r7.exe 3096 8qb9li.exe 820 641d4th.exe 888 b94qwnp.exe 3280 f3q9700.exe 4592 s13bg.exe 2452 qi95sm.exe 3916 7n5hco.exe 3880 3g69w43.exe 1388 61t39c.exe 884 u06f0.exe 3688 5da1h.exe 5064 4286484.exe 2012 a4fla.exe 4148 5xi34.exe 1328 3s7we1.exe 1844 s1p25.exe 2344 19fr85x.exe 4440 m9g284.exe 5048 63shf.exe 968 9gq5u1.exe 4340 vnn73l.exe 2616 k19581x.exe 4940 e0891xg.exe 3676 5fm24w7.exe 2808 507w1f.exe 3480 vt5ee04.exe 4236 xp72e.exe 3012 3agek.exe 1696 3u7m0.exe 1336 5no7125.exe 5084 d35rw.exe 3136 3o96h.exe 3528 1ucsu56.exe 4504 r67l4g.exe 1060 q34gf45.exe 1824 3n6cu.exe 4592 uc1r89.exe 2156 n7j45k.exe 2628 dnshf3.exe 3172 b668n.exe 4512 am90da.exe 3264 90vaklm.exe 4584 65x3a.exe 1480 n7c3mg.exe 3688 fw853ql.exe 1532 ckx5jcg.exe 4996 24166h.exe 3616 4co2n1.exe 1488 45hf53.exe 3800 760lv.exe 5076 17x36gs.exe 1004 6ae1o3.exe 3052 6253n.exe 1444 0aws86.exe 5048 a8s1obg.exe 4348 48m0e5.exe 3972 4lolcrx.exe -
resource yara_rule behavioral2/memory/3248-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3248-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1284-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1284-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3872-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3872-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3000-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/792-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1056-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3096-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3096-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/888-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3280-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2452-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3916-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3880-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1388-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/884-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1844-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4440-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/968-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4340-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3676-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3248 wrote to memory of 4032 3248 434fb356b44099233f93bad587424d90_NeikiAnalytics.exe 90 PID 3248 wrote to memory of 4032 3248 434fb356b44099233f93bad587424d90_NeikiAnalytics.exe 90 PID 3248 wrote to memory of 4032 3248 434fb356b44099233f93bad587424d90_NeikiAnalytics.exe 90 PID 4032 wrote to memory of 1284 4032 sx02i6w.exe 91 PID 4032 wrote to memory of 1284 4032 sx02i6w.exe 91 PID 4032 wrote to memory of 1284 4032 sx02i6w.exe 91 PID 1284 wrote to memory of 3872 1284 hc5vw.exe 92 PID 1284 wrote to memory of 3872 1284 hc5vw.exe 92 PID 1284 wrote to memory of 3872 1284 hc5vw.exe 92 PID 3872 wrote to memory of 3000 3872 2414l.exe 93 PID 3872 wrote to memory of 3000 3872 2414l.exe 93 PID 3872 wrote to memory of 3000 3872 2414l.exe 93 PID 3000 wrote to memory of 792 3000 0v6n23n.exe 94 PID 3000 wrote to memory of 792 3000 0v6n23n.exe 94 PID 3000 wrote to memory of 792 3000 0v6n23n.exe 94 PID 792 wrote to memory of 1056 792 64kc3.exe 95 PID 792 wrote to memory of 1056 792 64kc3.exe 95 PID 792 wrote to memory of 1056 792 64kc3.exe 95 PID 1056 wrote to memory of 5084 1056 176xt.exe 96 PID 1056 wrote to memory of 5084 1056 176xt.exe 96 PID 1056 wrote to memory of 5084 1056 176xt.exe 96 PID 5084 wrote to memory of 3096 5084 utf8r7.exe 97 PID 5084 wrote to memory of 3096 5084 utf8r7.exe 97 PID 5084 wrote to memory of 3096 5084 utf8r7.exe 97 PID 3096 wrote to memory of 820 3096 8qb9li.exe 98 PID 3096 wrote to memory of 820 3096 8qb9li.exe 98 PID 3096 wrote to memory of 820 3096 8qb9li.exe 98 PID 820 wrote to memory of 888 820 641d4th.exe 99 PID 820 wrote to memory of 888 820 641d4th.exe 99 PID 820 wrote to memory of 888 820 641d4th.exe 99 PID 888 wrote to memory of 3280 888 b94qwnp.exe 100 PID 888 wrote to memory of 3280 888 b94qwnp.exe 100 PID 888 wrote to memory of 3280 888 b94qwnp.exe 100 PID 3280 wrote to memory of 4592 3280 f3q9700.exe 101 PID 3280 wrote to memory of 4592 3280 f3q9700.exe 101 PID 3280 wrote to memory of 4592 3280 f3q9700.exe 101 PID 4592 wrote to memory of 2452 4592 s13bg.exe 102 PID 4592 wrote to memory of 2452 4592 s13bg.exe 102 PID 4592 wrote to memory of 2452 4592 s13bg.exe 102 PID 2452 wrote to memory of 3916 2452 qi95sm.exe 103 PID 2452 wrote to memory of 3916 2452 qi95sm.exe 103 PID 2452 wrote to memory of 3916 2452 qi95sm.exe 103 PID 3916 wrote to memory of 3880 3916 7n5hco.exe 104 PID 3916 wrote to memory of 3880 3916 7n5hco.exe 104 PID 3916 wrote to memory of 3880 3916 7n5hco.exe 104 PID 3880 wrote to memory of 1388 3880 3g69w43.exe 105 PID 3880 wrote to memory of 1388 3880 3g69w43.exe 105 PID 3880 wrote to memory of 1388 3880 3g69w43.exe 105 PID 1388 wrote to memory of 884 1388 61t39c.exe 106 PID 1388 wrote to memory of 884 1388 61t39c.exe 106 PID 1388 wrote to memory of 884 1388 61t39c.exe 106 PID 884 wrote to memory of 3688 884 u06f0.exe 107 PID 884 wrote to memory of 3688 884 u06f0.exe 107 PID 884 wrote to memory of 3688 884 u06f0.exe 107 PID 3688 wrote to memory of 5064 3688 5da1h.exe 108 PID 3688 wrote to memory of 5064 3688 5da1h.exe 108 PID 3688 wrote to memory of 5064 3688 5da1h.exe 108 PID 5064 wrote to memory of 2012 5064 4286484.exe 109 PID 5064 wrote to memory of 2012 5064 4286484.exe 109 PID 5064 wrote to memory of 2012 5064 4286484.exe 109 PID 2012 wrote to memory of 4148 2012 a4fla.exe 110 PID 2012 wrote to memory of 4148 2012 a4fla.exe 110 PID 2012 wrote to memory of 4148 2012 a4fla.exe 110 PID 4148 wrote to memory of 1328 4148 5xi34.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\434fb356b44099233f93bad587424d90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\434fb356b44099233f93bad587424d90_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3248 -
\??\c:\sx02i6w.exec:\sx02i6w.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\hc5vw.exec:\hc5vw.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\2414l.exec:\2414l.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\0v6n23n.exec:\0v6n23n.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\64kc3.exec:\64kc3.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\176xt.exec:\176xt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\utf8r7.exec:\utf8r7.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\8qb9li.exec:\8qb9li.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\641d4th.exec:\641d4th.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
\??\c:\b94qwnp.exec:\b94qwnp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\f3q9700.exec:\f3q9700.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\s13bg.exec:\s13bg.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\qi95sm.exec:\qi95sm.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\7n5hco.exec:\7n5hco.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\3g69w43.exec:\3g69w43.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\61t39c.exec:\61t39c.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\u06f0.exec:\u06f0.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\5da1h.exec:\5da1h.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\4286484.exec:\4286484.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\a4fla.exec:\a4fla.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\5xi34.exec:\5xi34.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\3s7we1.exec:\3s7we1.exe23⤵
- Executes dropped EXE
PID:1328 -
\??\c:\s1p25.exec:\s1p25.exe24⤵
- Executes dropped EXE
PID:1844 -
\??\c:\19fr85x.exec:\19fr85x.exe25⤵
- Executes dropped EXE
PID:2344 -
\??\c:\m9g284.exec:\m9g284.exe26⤵
- Executes dropped EXE
PID:4440 -
\??\c:\63shf.exec:\63shf.exe27⤵
- Executes dropped EXE
PID:5048 -
\??\c:\9gq5u1.exec:\9gq5u1.exe28⤵
- Executes dropped EXE
PID:968 -
\??\c:\vnn73l.exec:\vnn73l.exe29⤵
- Executes dropped EXE
PID:4340 -
\??\c:\k19581x.exec:\k19581x.exe30⤵
- Executes dropped EXE
PID:2616 -
\??\c:\e0891xg.exec:\e0891xg.exe31⤵
- Executes dropped EXE
PID:4940 -
\??\c:\5fm24w7.exec:\5fm24w7.exe32⤵
- Executes dropped EXE
PID:3676 -
\??\c:\507w1f.exec:\507w1f.exe33⤵
- Executes dropped EXE
PID:2808 -
\??\c:\vt5ee04.exec:\vt5ee04.exe34⤵
- Executes dropped EXE
PID:3480 -
\??\c:\xp72e.exec:\xp72e.exe35⤵
- Executes dropped EXE
PID:4236 -
\??\c:\3agek.exec:\3agek.exe36⤵
- Executes dropped EXE
PID:3012 -
\??\c:\3u7m0.exec:\3u7m0.exe37⤵
- Executes dropped EXE
PID:1696 -
\??\c:\5no7125.exec:\5no7125.exe38⤵
- Executes dropped EXE
PID:1336 -
\??\c:\d35rw.exec:\d35rw.exe39⤵
- Executes dropped EXE
PID:5084 -
\??\c:\3o96h.exec:\3o96h.exe40⤵
- Executes dropped EXE
PID:3136 -
\??\c:\1ucsu56.exec:\1ucsu56.exe41⤵
- Executes dropped EXE
PID:3528 -
\??\c:\r67l4g.exec:\r67l4g.exe42⤵
- Executes dropped EXE
PID:4504 -
\??\c:\q34gf45.exec:\q34gf45.exe43⤵
- Executes dropped EXE
PID:1060 -
\??\c:\3n6cu.exec:\3n6cu.exe44⤵
- Executes dropped EXE
PID:1824 -
\??\c:\uc1r89.exec:\uc1r89.exe45⤵
- Executes dropped EXE
PID:4592 -
\??\c:\n7j45k.exec:\n7j45k.exe46⤵
- Executes dropped EXE
PID:2156 -
\??\c:\dnshf3.exec:\dnshf3.exe47⤵
- Executes dropped EXE
PID:2628 -
\??\c:\b668n.exec:\b668n.exe48⤵
- Executes dropped EXE
PID:3172 -
\??\c:\am90da.exec:\am90da.exe49⤵
- Executes dropped EXE
PID:4512 -
\??\c:\90vaklm.exec:\90vaklm.exe50⤵
- Executes dropped EXE
PID:3264 -
\??\c:\65x3a.exec:\65x3a.exe51⤵
- Executes dropped EXE
PID:4584 -
\??\c:\n7c3mg.exec:\n7c3mg.exe52⤵
- Executes dropped EXE
PID:1480 -
\??\c:\fw853ql.exec:\fw853ql.exe53⤵
- Executes dropped EXE
PID:3688 -
\??\c:\ckx5jcg.exec:\ckx5jcg.exe54⤵
- Executes dropped EXE
PID:1532 -
\??\c:\24166h.exec:\24166h.exe55⤵
- Executes dropped EXE
PID:4996 -
\??\c:\4co2n1.exec:\4co2n1.exe56⤵
- Executes dropped EXE
PID:3616 -
\??\c:\45hf53.exec:\45hf53.exe57⤵
- Executes dropped EXE
PID:1488 -
\??\c:\760lv.exec:\760lv.exe58⤵
- Executes dropped EXE
PID:3800 -
\??\c:\17x36gs.exec:\17x36gs.exe59⤵
- Executes dropped EXE
PID:5076 -
\??\c:\6ae1o3.exec:\6ae1o3.exe60⤵
- Executes dropped EXE
PID:1004 -
\??\c:\6253n.exec:\6253n.exe61⤵
- Executes dropped EXE
PID:3052 -
\??\c:\0aws86.exec:\0aws86.exe62⤵
- Executes dropped EXE
PID:1444 -
\??\c:\a8s1obg.exec:\a8s1obg.exe63⤵
- Executes dropped EXE
PID:5048 -
\??\c:\48m0e5.exec:\48m0e5.exe64⤵
- Executes dropped EXE
PID:4348 -
\??\c:\4lolcrx.exec:\4lolcrx.exe65⤵
- Executes dropped EXE
PID:3972 -
\??\c:\fpav5.exec:\fpav5.exe66⤵PID:116
-
\??\c:\0dgpwk.exec:\0dgpwk.exe67⤵PID:5092
-
\??\c:\888m8.exec:\888m8.exe68⤵PID:1224
-
\??\c:\a47kx.exec:\a47kx.exe69⤵PID:4288
-
\??\c:\0x5i96.exec:\0x5i96.exe70⤵PID:3984
-
\??\c:\03hvq.exec:\03hvq.exe71⤵PID:1608
-
\??\c:\7dpsw.exec:\7dpsw.exe72⤵PID:528
-
\??\c:\hrr70k.exec:\hrr70k.exe73⤵PID:4020
-
\??\c:\u3oa8m2.exec:\u3oa8m2.exe74⤵PID:2116
-
\??\c:\80h38.exec:\80h38.exe75⤵PID:2548
-
\??\c:\342tq9.exec:\342tq9.exe76⤵PID:2868
-
\??\c:\rxgcj.exec:\rxgcj.exe77⤵PID:4680
-
\??\c:\634a5tf.exec:\634a5tf.exe78⤵PID:2492
-
\??\c:\l93q5.exec:\l93q5.exe79⤵PID:3256
-
\??\c:\dvhivvb.exec:\dvhivvb.exe80⤵PID:888
-
\??\c:\h3351mg.exec:\h3351mg.exe81⤵PID:1720
-
\??\c:\3867s7v.exec:\3867s7v.exe82⤵PID:2056
-
\??\c:\2tw01o.exec:\2tw01o.exe83⤵PID:112
-
\??\c:\m4c8k.exec:\m4c8k.exe84⤵PID:2424
-
\??\c:\qimw1.exec:\qimw1.exe85⤵PID:4772
-
\??\c:\0mo24.exec:\0mo24.exe86⤵PID:3400
-
\??\c:\lo972.exec:\lo972.exe87⤵PID:2284
-
\??\c:\0kcs4f8.exec:\0kcs4f8.exe88⤵PID:4620
-
\??\c:\9cj7a7.exec:\9cj7a7.exe89⤵PID:1596
-
\??\c:\7svg20v.exec:\7svg20v.exe90⤵PID:4184
-
\??\c:\111crd4.exec:\111crd4.exe91⤵PID:4540
-
\??\c:\8iii02g.exec:\8iii02g.exe92⤵PID:640
-
\??\c:\350ssq8.exec:\350ssq8.exe93⤵PID:4148
-
\??\c:\0rfa3w.exec:\0rfa3w.exe94⤵PID:3524
-
\??\c:\gacc9.exec:\gacc9.exe95⤵PID:4320
-
\??\c:\0ssw17f.exec:\0ssw17f.exe96⤵PID:4848
-
\??\c:\x3to27.exec:\x3to27.exe97⤵PID:5004
-
\??\c:\1tob6j.exec:\1tob6j.exe98⤵PID:2308
-
\??\c:\xs8v92f.exec:\xs8v92f.exe99⤵PID:3132
-
\??\c:\1bwx9x6.exec:\1bwx9x6.exe100⤵PID:3812
-
\??\c:\hkg71k2.exec:\hkg71k2.exe101⤵PID:2784
-
\??\c:\secm2q3.exec:\secm2q3.exe102⤵PID:2724
-
\??\c:\103ie.exec:\103ie.exe103⤵PID:2888
-
\??\c:\o3g18.exec:\o3g18.exe104⤵PID:2616
-
\??\c:\r8keux.exec:\r8keux.exe105⤵PID:4804
-
\??\c:\79i9e7x.exec:\79i9e7x.exe106⤵PID:1356
-
\??\c:\kw1l75.exec:\kw1l75.exe107⤵PID:4432
-
\??\c:\s574a.exec:\s574a.exe108⤵PID:1464
-
\??\c:\90c7kq6.exec:\90c7kq6.exe109⤵PID:3284
-
\??\c:\84h75e.exec:\84h75e.exe110⤵PID:3012
-
\??\c:\695q1.exec:\695q1.exe111⤵PID:3676
-
\??\c:\0j19e.exec:\0j19e.exe112⤵PID:776
-
\??\c:\b106878.exec:\b106878.exe113⤵PID:1392
-
\??\c:\8n15g.exec:\8n15g.exe114⤵PID:820
-
\??\c:\7tu7m.exec:\7tu7m.exe115⤵PID:656
-
\??\c:\13mg433.exec:\13mg433.exe116⤵PID:2792
-
\??\c:\b7j90.exec:\b7j90.exe117⤵PID:2324
-
\??\c:\of950.exec:\of950.exe118⤵PID:3380
-
\??\c:\ud6s8s0.exec:\ud6s8s0.exe119⤵PID:3328
-
\??\c:\159kq9.exec:\159kq9.exe120⤵PID:384
-
\??\c:\4p4kb.exec:\4p4kb.exe121⤵PID:2704
-
\??\c:\217sgn7.exec:\217sgn7.exe122⤵PID:488
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-