Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13-05-2024 19:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0c85ea076dcc9296f4fa953ba6674e50_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0c85ea076dcc9296f4fa953ba6674e50_NeikiAnalytics.exe
-
Size
232KB
-
MD5
0c85ea076dcc9296f4fa953ba6674e50
-
SHA1
f260eeee25c8ee1ba8824bea39aa5e934ba96f4d
-
SHA256
73520ba9871e7eb4d409d7e98a28019a12ff12b2a38b08f5608de875c040e5cc
-
SHA512
d593f587be0ef23d7e1a7477a427f1d8bbe75420b61c56cc59280d0a8c5018eac398a6d7f0de0e0136dabadce04fa60e078ba2640fa24a7bae5f41134f1e211c
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo7LAIRUohTF/SjSrbzLAuBjfwFOmoFzMvUpGqC5n+4:n3C9BRo/AIuuFSjA8uBjwI7FjpjC5+4
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/2240-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3912-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1860-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1920-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3100-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1104-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3896-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1252-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1112-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/832-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1008-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4112-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3176-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/404-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3520-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4072-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3420-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1856-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4148-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2836-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1700 895o7.exe 3912 rosbf5.exe 1860 961urc.exe 1920 l0682l0.exe 3100 w7he19u.exe 1104 fjm278x.exe 3896 3k60rx2.exe 1252 6em2s.exe 1112 veiaa.exe 832 7k5786s.exe 3632 j246r.exe 5012 7gp84b4.exe 1008 32ppe93.exe 1816 v27usw.exe 5116 xx24e0.exe 2528 22ou5.exe 4544 15339.exe 4112 fnsnxd.exe 3176 1993x.exe 404 79oj7w.exe 816 ax282.exe 3520 a28u753.exe 4072 8505l4.exe 3984 603p17.exe 3420 r50pgfj.exe 4592 8p207.exe 1856 b4u0b.exe 4148 6f058b.exe 2836 m1l8e34.exe 1516 m3of0.exe 2100 7g1wecg.exe 1780 70b105.exe 4420 895mm7.exe 2524 r69fl.exe 3164 kv61a3.exe 1340 7133b4w.exe 1416 vkw1c.exe 4172 76gwc.exe 488 81i26.exe 4444 3d31043.exe 4932 qurg4n2.exe 2732 033382n.exe 4308 smad2f8.exe 2936 f4o06o2.exe 4696 3eomo.exe 2620 8p1o1f.exe 3132 v615q91.exe 748 0l3wu61.exe 2028 6am7p.exe 4524 fd3l1k.exe 5108 j83hu4.exe 876 rs7nx7.exe 5044 io59c62.exe 2256 7j01i5u.exe 640 ppje759.exe 3780 86gak.exe 3544 i731g6h.exe 1892 lhw7e3u.exe 1372 95u94.exe 500 kt6578.exe 1484 5l0i372.exe 4480 7jqx446.exe 1232 6w8ojv.exe 3752 c0d422i.exe -
resource yara_rule behavioral2/memory/2240-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1700-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1700-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1700-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3912-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1860-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1920-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3100-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3896-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1252-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1252-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1112-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/832-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1008-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4112-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3176-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/404-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3520-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4072-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3420-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1856-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4148-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2836-194-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2240 wrote to memory of 1700 2240 0c85ea076dcc9296f4fa953ba6674e50_NeikiAnalytics.exe 90 PID 2240 wrote to memory of 1700 2240 0c85ea076dcc9296f4fa953ba6674e50_NeikiAnalytics.exe 90 PID 2240 wrote to memory of 1700 2240 0c85ea076dcc9296f4fa953ba6674e50_NeikiAnalytics.exe 90 PID 1700 wrote to memory of 3912 1700 895o7.exe 91 PID 1700 wrote to memory of 3912 1700 895o7.exe 91 PID 1700 wrote to memory of 3912 1700 895o7.exe 91 PID 3912 wrote to memory of 1860 3912 rosbf5.exe 92 PID 3912 wrote to memory of 1860 3912 rosbf5.exe 92 PID 3912 wrote to memory of 1860 3912 rosbf5.exe 92 PID 1860 wrote to memory of 1920 1860 961urc.exe 93 PID 1860 wrote to memory of 1920 1860 961urc.exe 93 PID 1860 wrote to memory of 1920 1860 961urc.exe 93 PID 1920 wrote to memory of 3100 1920 l0682l0.exe 94 PID 1920 wrote to memory of 3100 1920 l0682l0.exe 94 PID 1920 wrote to memory of 3100 1920 l0682l0.exe 94 PID 3100 wrote to memory of 1104 3100 w7he19u.exe 95 PID 3100 wrote to memory of 1104 3100 w7he19u.exe 95 PID 3100 wrote to memory of 1104 3100 w7he19u.exe 95 PID 1104 wrote to memory of 3896 1104 fjm278x.exe 96 PID 1104 wrote to memory of 3896 1104 fjm278x.exe 96 PID 1104 wrote to memory of 3896 1104 fjm278x.exe 96 PID 3896 wrote to memory of 1252 3896 3k60rx2.exe 97 PID 3896 wrote to memory of 1252 3896 3k60rx2.exe 97 PID 3896 wrote to memory of 1252 3896 3k60rx2.exe 97 PID 1252 wrote to memory of 1112 1252 6em2s.exe 98 PID 1252 wrote to memory of 1112 1252 6em2s.exe 98 PID 1252 wrote to memory of 1112 1252 6em2s.exe 98 PID 1112 wrote to memory of 832 1112 veiaa.exe 99 PID 1112 wrote to memory of 832 1112 veiaa.exe 99 PID 1112 wrote to memory of 832 1112 veiaa.exe 99 PID 832 wrote to memory of 3632 832 7k5786s.exe 100 PID 832 wrote to memory of 3632 832 7k5786s.exe 100 PID 832 wrote to memory of 3632 832 7k5786s.exe 100 PID 3632 wrote to memory of 5012 3632 j246r.exe 101 PID 3632 wrote to memory of 5012 3632 j246r.exe 101 PID 3632 wrote to memory of 5012 3632 j246r.exe 101 PID 5012 wrote to memory of 1008 5012 7gp84b4.exe 102 PID 5012 wrote to memory of 1008 5012 7gp84b4.exe 102 PID 5012 wrote to memory of 1008 5012 7gp84b4.exe 102 PID 1008 wrote to memory of 1816 1008 32ppe93.exe 103 PID 1008 wrote to memory of 1816 1008 32ppe93.exe 103 PID 1008 wrote to memory of 1816 1008 32ppe93.exe 103 PID 1816 wrote to memory of 5116 1816 v27usw.exe 104 PID 1816 wrote to memory of 5116 1816 v27usw.exe 104 PID 1816 wrote to memory of 5116 1816 v27usw.exe 104 PID 5116 wrote to memory of 2528 5116 xx24e0.exe 105 PID 5116 wrote to memory of 2528 5116 xx24e0.exe 105 PID 5116 wrote to memory of 2528 5116 xx24e0.exe 105 PID 2528 wrote to memory of 4544 2528 22ou5.exe 106 PID 2528 wrote to memory of 4544 2528 22ou5.exe 106 PID 2528 wrote to memory of 4544 2528 22ou5.exe 106 PID 4544 wrote to memory of 4112 4544 15339.exe 107 PID 4544 wrote to memory of 4112 4544 15339.exe 107 PID 4544 wrote to memory of 4112 4544 15339.exe 107 PID 4112 wrote to memory of 3176 4112 fnsnxd.exe 108 PID 4112 wrote to memory of 3176 4112 fnsnxd.exe 108 PID 4112 wrote to memory of 3176 4112 fnsnxd.exe 108 PID 3176 wrote to memory of 404 3176 1993x.exe 109 PID 3176 wrote to memory of 404 3176 1993x.exe 109 PID 3176 wrote to memory of 404 3176 1993x.exe 109 PID 404 wrote to memory of 816 404 79oj7w.exe 110 PID 404 wrote to memory of 816 404 79oj7w.exe 110 PID 404 wrote to memory of 816 404 79oj7w.exe 110 PID 816 wrote to memory of 3520 816 ax282.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c85ea076dcc9296f4fa953ba6674e50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0c85ea076dcc9296f4fa953ba6674e50_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\895o7.exec:\895o7.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\rosbf5.exec:\rosbf5.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
\??\c:\961urc.exec:\961urc.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\l0682l0.exec:\l0682l0.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\w7he19u.exec:\w7he19u.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\fjm278x.exec:\fjm278x.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\3k60rx2.exec:\3k60rx2.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\6em2s.exec:\6em2s.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\veiaa.exec:\veiaa.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\7k5786s.exec:\7k5786s.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\j246r.exec:\j246r.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\7gp84b4.exec:\7gp84b4.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\32ppe93.exec:\32ppe93.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\v27usw.exec:\v27usw.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\xx24e0.exec:\xx24e0.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\22ou5.exec:\22ou5.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\15339.exec:\15339.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\fnsnxd.exec:\fnsnxd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\1993x.exec:\1993x.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\79oj7w.exec:\79oj7w.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\ax282.exec:\ax282.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
\??\c:\a28u753.exec:\a28u753.exe23⤵
- Executes dropped EXE
PID:3520 -
\??\c:\8505l4.exec:\8505l4.exe24⤵
- Executes dropped EXE
PID:4072 -
\??\c:\603p17.exec:\603p17.exe25⤵
- Executes dropped EXE
PID:3984 -
\??\c:\r50pgfj.exec:\r50pgfj.exe26⤵
- Executes dropped EXE
PID:3420 -
\??\c:\8p207.exec:\8p207.exe27⤵
- Executes dropped EXE
PID:4592 -
\??\c:\b4u0b.exec:\b4u0b.exe28⤵
- Executes dropped EXE
PID:1856 -
\??\c:\6f058b.exec:\6f058b.exe29⤵
- Executes dropped EXE
PID:4148 -
\??\c:\m1l8e34.exec:\m1l8e34.exe30⤵
- Executes dropped EXE
PID:2836 -
\??\c:\m3of0.exec:\m3of0.exe31⤵
- Executes dropped EXE
PID:1516 -
\??\c:\7g1wecg.exec:\7g1wecg.exe32⤵
- Executes dropped EXE
PID:2100 -
\??\c:\70b105.exec:\70b105.exe33⤵
- Executes dropped EXE
PID:1780 -
\??\c:\895mm7.exec:\895mm7.exe34⤵
- Executes dropped EXE
PID:4420 -
\??\c:\r69fl.exec:\r69fl.exe35⤵
- Executes dropped EXE
PID:2524 -
\??\c:\kv61a3.exec:\kv61a3.exe36⤵
- Executes dropped EXE
PID:3164 -
\??\c:\7133b4w.exec:\7133b4w.exe37⤵
- Executes dropped EXE
PID:1340 -
\??\c:\vkw1c.exec:\vkw1c.exe38⤵
- Executes dropped EXE
PID:1416 -
\??\c:\76gwc.exec:\76gwc.exe39⤵
- Executes dropped EXE
PID:4172 -
\??\c:\81i26.exec:\81i26.exe40⤵
- Executes dropped EXE
PID:488 -
\??\c:\3d31043.exec:\3d31043.exe41⤵
- Executes dropped EXE
PID:4444 -
\??\c:\qurg4n2.exec:\qurg4n2.exe42⤵
- Executes dropped EXE
PID:4932 -
\??\c:\033382n.exec:\033382n.exe43⤵
- Executes dropped EXE
PID:2732 -
\??\c:\smad2f8.exec:\smad2f8.exe44⤵
- Executes dropped EXE
PID:4308 -
\??\c:\f4o06o2.exec:\f4o06o2.exe45⤵
- Executes dropped EXE
PID:2936 -
\??\c:\3eomo.exec:\3eomo.exe46⤵
- Executes dropped EXE
PID:4696 -
\??\c:\8p1o1f.exec:\8p1o1f.exe47⤵
- Executes dropped EXE
PID:2620 -
\??\c:\v615q91.exec:\v615q91.exe48⤵
- Executes dropped EXE
PID:3132 -
\??\c:\0l3wu61.exec:\0l3wu61.exe49⤵
- Executes dropped EXE
PID:748 -
\??\c:\6am7p.exec:\6am7p.exe50⤵
- Executes dropped EXE
PID:2028 -
\??\c:\fd3l1k.exec:\fd3l1k.exe51⤵
- Executes dropped EXE
PID:4524 -
\??\c:\j83hu4.exec:\j83hu4.exe52⤵
- Executes dropped EXE
PID:5108 -
\??\c:\rs7nx7.exec:\rs7nx7.exe53⤵
- Executes dropped EXE
PID:876 -
\??\c:\io59c62.exec:\io59c62.exe54⤵
- Executes dropped EXE
PID:5044 -
\??\c:\7j01i5u.exec:\7j01i5u.exe55⤵
- Executes dropped EXE
PID:2256 -
\??\c:\ppje759.exec:\ppje759.exe56⤵
- Executes dropped EXE
PID:640 -
\??\c:\86gak.exec:\86gak.exe57⤵
- Executes dropped EXE
PID:3780 -
\??\c:\i731g6h.exec:\i731g6h.exe58⤵
- Executes dropped EXE
PID:3544 -
\??\c:\lhw7e3u.exec:\lhw7e3u.exe59⤵
- Executes dropped EXE
PID:1892 -
\??\c:\95u94.exec:\95u94.exe60⤵
- Executes dropped EXE
PID:1372 -
\??\c:\kt6578.exec:\kt6578.exe61⤵
- Executes dropped EXE
PID:500 -
\??\c:\5l0i372.exec:\5l0i372.exe62⤵
- Executes dropped EXE
PID:1484 -
\??\c:\7jqx446.exec:\7jqx446.exe63⤵
- Executes dropped EXE
PID:4480 -
\??\c:\6w8ojv.exec:\6w8ojv.exe64⤵
- Executes dropped EXE
PID:1232 -
\??\c:\c0d422i.exec:\c0d422i.exe65⤵
- Executes dropped EXE
PID:3752 -
\??\c:\mj51w5.exec:\mj51w5.exe66⤵PID:4876
-
\??\c:\5m26aa7.exec:\5m26aa7.exe67⤵PID:2380
-
\??\c:\b7633.exec:\b7633.exe68⤵PID:4952
-
\??\c:\p5ixg.exec:\p5ixg.exe69⤵PID:2296
-
\??\c:\ac3i5.exec:\ac3i5.exe70⤵PID:3292
-
\??\c:\bfvnl.exec:\bfvnl.exe71⤵PID:2384
-
\??\c:\9l7ma9.exec:\9l7ma9.exe72⤵PID:4296
-
\??\c:\q80p5d7.exec:\q80p5d7.exe73⤵PID:564
-
\??\c:\05t97r.exec:\05t97r.exe74⤵PID:4264
-
\??\c:\4lj379q.exec:\4lj379q.exe75⤵PID:1700
-
\??\c:\s89836.exec:\s89836.exe76⤵PID:3588
-
\??\c:\82302o6.exec:\82302o6.exe77⤵PID:1432
-
\??\c:\j24860.exec:\j24860.exe78⤵PID:440
-
\??\c:\37ur2.exec:\37ur2.exe79⤵PID:5032
-
\??\c:\e8uf6ph.exec:\e8uf6ph.exe80⤵PID:2680
-
\??\c:\09618.exec:\09618.exe81⤵PID:2136
-
\??\c:\4uf038.exec:\4uf038.exe82⤵PID:2352
-
\??\c:\981ew.exec:\981ew.exe83⤵PID:1104
-
\??\c:\xmbc1.exec:\xmbc1.exe84⤵PID:4692
-
\??\c:\lom95.exec:\lom95.exe85⤵PID:3868
-
\??\c:\id7h5s.exec:\id7h5s.exe86⤵PID:3968
-
\??\c:\36k31.exec:\36k31.exe87⤵PID:4052
-
\??\c:\3noaq.exec:\3noaq.exe88⤵PID:3540
-
\??\c:\i22hwo.exec:\i22hwo.exe89⤵PID:1860
-
\??\c:\83rd1.exec:\83rd1.exe90⤵PID:4704
-
\??\c:\oow936g.exec:\oow936g.exe91⤵PID:1724
-
\??\c:\45j6n.exec:\45j6n.exe92⤵PID:2004
-
\??\c:\jjq92.exec:\jjq92.exe93⤵PID:2312
-
\??\c:\066u793.exec:\066u793.exe94⤵PID:4104
-
\??\c:\52pf73b.exec:\52pf73b.exe95⤵PID:5108
-
\??\c:\1601m.exec:\1601m.exe96⤵PID:2888
-
\??\c:\71q37or.exec:\71q37or.exe97⤵PID:2528
-
\??\c:\40kk19c.exec:\40kk19c.exe98⤵PID:1988
-
\??\c:\658pe47.exec:\658pe47.exe99⤵PID:640
-
\??\c:\l757asp.exec:\l757asp.exe100⤵PID:3780
-
\??\c:\qh60t.exec:\qh60t.exe101⤵PID:3544
-
\??\c:\0i5h79.exec:\0i5h79.exe102⤵PID:1892
-
\??\c:\x66lm3.exec:\x66lm3.exe103⤵PID:4892
-
\??\c:\ul583.exec:\ul583.exe104⤵PID:3740
-
\??\c:\u13k9q.exec:\u13k9q.exe105⤵PID:4856
-
\??\c:\3g5s4gt.exec:\3g5s4gt.exe106⤵PID:4884
-
\??\c:\37jt99.exec:\37jt99.exe107⤵PID:1232
-
\??\c:\95ncm.exec:\95ncm.exe108⤵PID:4124
-
\??\c:\277155k.exec:\277155k.exe109⤵PID:2172
-
\??\c:\8k8w1o.exec:\8k8w1o.exe110⤵PID:4360
-
\??\c:\s9jd37.exec:\s9jd37.exe111⤵PID:4356
-
\??\c:\813be.exec:\813be.exe112⤵PID:1516
-
\??\c:\w72kkh.exec:\w72kkh.exe113⤵PID:3636
-
\??\c:\6464i.exec:\6464i.exe114⤵PID:2240
-
\??\c:\7q316.exec:\7q316.exe115⤵PID:1744
-
\??\c:\9d4q8.exec:\9d4q8.exe116⤵PID:2480
-
\??\c:\agvqr1.exec:\agvqr1.exe117⤵PID:1780
-
\??\c:\bh1757.exec:\bh1757.exe118⤵PID:2644
-
\??\c:\0k7t7.exec:\0k7t7.exe119⤵PID:1192
-
\??\c:\8m89r0.exec:\8m89r0.exe120⤵PID:3264
-
\??\c:\rgiq75f.exec:\rgiq75f.exe121⤵PID:2376
-
\??\c:\fas782n.exec:\fas782n.exe122⤵PID:3100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-