Analysis
- max time kernel
154s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 14:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d661288c0fb86287bc3f6b69aa259b90_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
- Target d661288c0fb86287bc3f6b69aa259b90_NeikiAnalytics.exe
- Size 65KB
- Sample240518-rpbv4aff87
- SHA256 5f89273e3f5e5912cba6ae307c06defc6fd68044721f1c882361e5e01e30ce82
- MD5 d661288c0fb86287bc3f6b69aa259b90
- SHA1 013ca307471f07ff562943b26a32469641ed68b2
- SHA512 1ae624fdbdbed6e753676dcdb282c23a7cd5899ad99c396af5ace9a9ffae29807c85a1e5d88f4b6d7753bc8bebdd1ca9fc07445b2282eebbdb484348f21d884a
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFdJUDbAIF:ymb3NkkiQ3mdBjFIFdJ8b3
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/2220-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2220-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4300-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2728-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/528-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4664-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3288-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1728-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1452-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4016-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1912-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2988-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3404-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1064-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4668-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3508-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4384-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 4300 969p439.exe 2728 811v9g.exe 4896 9me85b6.exe 2436 vkfho.exe 1028 92993xs.exe 1608 m7mbo7.exe 528 3j93s.exe 4792 172s41.exe 4908 1l131.exe 5084 s42d9.exe 4664 vk59f2.exe 3804 x1920x2.exe 3288 1v84g3.exe 1728 99995nb.exe 2524 9be955.exe 1452 j2710.exe 2424 j9o5u.exe 4016 a918x.exe 1912 9he026f.exe 2256 l9x7q4.exe 3688 h1vi0.exe 5064 rnrbbn.exe 4996 m0793qu.exe 2216 rd78uw1.exe 2988 2g5bx.exe 4508 xm959o.exe 3404 86t01.exe 1064 efgf49h.exe 4668 b7441w.exe 3508 c4c1v3c.exe 4384 2h2m93.exe 2616 io3198.exe 1460 437mf7e.exe 564 hilsqi.exe 2888 4md17.exe 2496 ub9ex.exe 1284 xl9dwj.exe 4064 iss3119.exe 2436 940d54x.exe 4336 a6m42.exe 3012 amh6e.exe 2820 8x37e0.exe 528 cc18kbx.exe 1056 coi3089.exe 1272 1r3c3.exe 860 fh00wu9.exe 3672 8bca6.exe 4936 0am5bl.exe 964 j5odvu7.exe 2200 513uqu.exe 3212 te1a5p.exe 1720 uo465.exe 2452 1xcs533.exe 3276 vf18409.exe 4740 r73o8j3.exe 3400 p85c1s.exe 4308 t8x009j.exe 4316 lsjk8.exe 884 07023.exe 4620 j98aw27.exe 4976 ewr0u3.exe 5064 4ilgbbi.exe 3552 5ixaw.exe 3376 wii9397.exe -
resource yara_rule behavioral2/memory/2220-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2220-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4300-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4300-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4300-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4300-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2728-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2728-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2728-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2728-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2436-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1028-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1028-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/528-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4664-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3288-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1728-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1452-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4016-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1912-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2988-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3404-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1064-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4668-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3508-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4384-216-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2220 wrote to memory of 4300 2220 d661288c0fb86287bc3f6b69aa259b90_NeikiAnalytics.exe 92 PID 2220 wrote to memory of 4300 2220 d661288c0fb86287bc3f6b69aa259b90_NeikiAnalytics.exe 92 PID 2220 wrote to memory of 4300 2220 d661288c0fb86287bc3f6b69aa259b90_NeikiAnalytics.exe 92 PID 4300 wrote to memory of 2728 4300 969p439.exe 93 PID 4300 wrote to memory of 2728 4300 969p439.exe 93 PID 4300 wrote to memory of 2728 4300 969p439.exe 93 PID 2728 wrote to memory of 4896 2728 811v9g.exe 94 PID 2728 wrote to memory of 4896 2728 811v9g.exe 94 PID 2728 wrote to memory of 4896 2728 811v9g.exe 94 PID 4896 wrote to memory of 2436 4896 9me85b6.exe 95 PID 4896 wrote to memory of 2436 4896 9me85b6.exe 95 PID 4896 wrote to memory of 2436 4896 9me85b6.exe 95 PID 2436 wrote to memory of 1028 2436 vkfho.exe 96 PID 2436 wrote to memory of 1028 2436 vkfho.exe 96 PID 2436 wrote to memory of 1028 2436 vkfho.exe 96 PID 1028 wrote to memory of 1608 1028 92993xs.exe 97 PID 1028 wrote to memory of 1608 1028 92993xs.exe 97 PID 1028 wrote to memory of 1608 1028 92993xs.exe 97 PID 1608 wrote to memory of 528 1608 m7mbo7.exe 98 PID 1608 wrote to memory of 528 1608 m7mbo7.exe 98 PID 1608 wrote to memory of 528 1608 m7mbo7.exe 98 PID 528 wrote to memory of 4792 528 3j93s.exe 99 PID 528 wrote to memory of 4792 528 3j93s.exe 99 PID 528 wrote to memory of 4792 528 3j93s.exe 99 PID 4792 wrote to memory of 4908 4792 172s41.exe 100 PID 4792 wrote to memory of 4908 4792 172s41.exe 100 PID 4792 wrote to memory of 4908 4792 172s41.exe 100 PID 4908 wrote to memory of 5084 4908 1l131.exe 101 PID 4908 wrote to memory of 5084 4908 1l131.exe 101 PID 4908 wrote to memory of 5084 4908 1l131.exe 101 PID 5084 wrote to memory of 4664 5084 s42d9.exe 102 PID 5084 wrote to memory of 4664 5084 s42d9.exe 102 PID 5084 wrote to memory of 4664 5084 s42d9.exe 102 PID 4664 wrote to memory of 3804 4664 vk59f2.exe 103 PID 4664 wrote to memory of 3804 4664 vk59f2.exe 103 PID 4664 wrote to memory of 3804 4664 vk59f2.exe 103 PID 3804 wrote to memory of 3288 3804 x1920x2.exe 104 PID 3804 wrote to memory of 3288 3804 x1920x2.exe 104 PID 3804 wrote to memory of 3288 3804 x1920x2.exe 104 PID 3288 wrote to memory of 1728 3288 1v84g3.exe 105 PID 3288 wrote to memory of 1728 3288 1v84g3.exe 105 PID 3288 wrote to memory of 1728 3288 1v84g3.exe 105 PID 1728 wrote to memory of 2524 1728 99995nb.exe 106 PID 1728 wrote to memory of 2524 1728 99995nb.exe 106 PID 1728 wrote to memory of 2524 1728 99995nb.exe 106 PID 2524 wrote to memory of 1452 2524 9be955.exe 107 PID 2524 wrote to memory of 1452 2524 9be955.exe 107 PID 2524 wrote to memory of 1452 2524 9be955.exe 107 PID 1452 wrote to memory of 2424 1452 j2710.exe 108 PID 1452 wrote to memory of 2424 1452 j2710.exe 108 PID 1452 wrote to memory of 2424 1452 j2710.exe 108 PID 2424 wrote to memory of 4016 2424 j9o5u.exe 109 PID 2424 wrote to memory of 4016 2424 j9o5u.exe 109 PID 2424 wrote to memory of 4016 2424 j9o5u.exe 109 PID 4016 wrote to memory of 1912 4016 a918x.exe 110 PID 4016 wrote to memory of 1912 4016 a918x.exe 110 PID 4016 wrote to memory of 1912 4016 a918x.exe 110 PID 1912 wrote to memory of 2256 1912 9he026f.exe 111 PID 1912 wrote to memory of 2256 1912 9he026f.exe 111 PID 1912 wrote to memory of 2256 1912 9he026f.exe 111 PID 2256 wrote to memory of 3688 2256 l9x7q4.exe 112 PID 2256 wrote to memory of 3688 2256 l9x7q4.exe 112 PID 2256 wrote to memory of 3688 2256 l9x7q4.exe 112 PID 3688 wrote to memory of 5064 3688 h1vi0.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\d661288c0fb86287bc3f6b69aa259b90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d661288c0fb86287bc3f6b69aa259b90_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\969p439.exec:\969p439.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\811v9g.exec:\811v9g.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\9me85b6.exec:\9me85b6.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\vkfho.exec:\vkfho.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\92993xs.exec:\92993xs.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\m7mbo7.exec:\m7mbo7.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\3j93s.exec:\3j93s.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
\??\c:\172s41.exec:\172s41.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\1l131.exec:\1l131.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\s42d9.exec:\s42d9.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\vk59f2.exec:\vk59f2.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\x1920x2.exec:\x1920x2.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
\??\c:\1v84g3.exec:\1v84g3.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\99995nb.exec:\99995nb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\9be955.exec:\9be955.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\j2710.exec:\j2710.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\j9o5u.exec:\j9o5u.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\a918x.exec:\a918x.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\9he026f.exec:\9he026f.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\l9x7q4.exec:\l9x7q4.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\h1vi0.exec:\h1vi0.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\rnrbbn.exec:\rnrbbn.exe23⤵
- Executes dropped EXE
PID:5064 -
\??\c:\m0793qu.exec:\m0793qu.exe24⤵
- Executes dropped EXE
PID:4996 -
\??\c:\rd78uw1.exec:\rd78uw1.exe25⤵
- Executes dropped EXE
PID:2216 -
\??\c:\2g5bx.exec:\2g5bx.exe26⤵
- Executes dropped EXE
PID:2988 -
\??\c:\xm959o.exec:\xm959o.exe27⤵
- Executes dropped EXE
PID:4508 -
\??\c:\86t01.exec:\86t01.exe28⤵
- Executes dropped EXE
PID:3404 -
\??\c:\efgf49h.exec:\efgf49h.exe29⤵
- Executes dropped EXE
PID:1064 -
\??\c:\b7441w.exec:\b7441w.exe30⤵
- Executes dropped EXE
PID:4668 -
\??\c:\c4c1v3c.exec:\c4c1v3c.exe31⤵
- Executes dropped EXE
PID:3508 -
\??\c:\2h2m93.exec:\2h2m93.exe32⤵
- Executes dropped EXE
PID:4384 -
\??\c:\io3198.exec:\io3198.exe33⤵
- Executes dropped EXE
PID:2616 -
\??\c:\437mf7e.exec:\437mf7e.exe34⤵
- Executes dropped EXE
PID:1460 -
\??\c:\hilsqi.exec:\hilsqi.exe35⤵
- Executes dropped EXE
PID:564 -
\??\c:\4md17.exec:\4md17.exe36⤵
- Executes dropped EXE
PID:2888 -
\??\c:\ub9ex.exec:\ub9ex.exe37⤵
- Executes dropped EXE
PID:2496 -
\??\c:\xl9dwj.exec:\xl9dwj.exe38⤵
- Executes dropped EXE
PID:1284 -
\??\c:\iss3119.exec:\iss3119.exe39⤵
- Executes dropped EXE
PID:4064 -
\??\c:\940d54x.exec:\940d54x.exe40⤵
- Executes dropped EXE
PID:2436 -
\??\c:\a6m42.exec:\a6m42.exe41⤵
- Executes dropped EXE
PID:4336 -
\??\c:\amh6e.exec:\amh6e.exe42⤵
- Executes dropped EXE
PID:3012 -
\??\c:\8x37e0.exec:\8x37e0.exe43⤵
- Executes dropped EXE
PID:2820 -
\??\c:\cc18kbx.exec:\cc18kbx.exe44⤵
- Executes dropped EXE
PID:528 -
\??\c:\coi3089.exec:\coi3089.exe45⤵
- Executes dropped EXE
PID:1056 -
\??\c:\1r3c3.exec:\1r3c3.exe46⤵
- Executes dropped EXE
PID:1272 -
\??\c:\fh00wu9.exec:\fh00wu9.exe47⤵
- Executes dropped EXE
PID:860 -
\??\c:\8bca6.exec:\8bca6.exe48⤵
- Executes dropped EXE
PID:3672 -
\??\c:\0am5bl.exec:\0am5bl.exe49⤵
- Executes dropped EXE
PID:4936 -
\??\c:\j5odvu7.exec:\j5odvu7.exe50⤵
- Executes dropped EXE
PID:964 -
\??\c:\513uqu.exec:\513uqu.exe51⤵
- Executes dropped EXE
PID:2200 -
\??\c:\te1a5p.exec:\te1a5p.exe52⤵
- Executes dropped EXE
PID:3212 -
\??\c:\uo465.exec:\uo465.exe53⤵
- Executes dropped EXE
PID:1720 -
\??\c:\1xcs533.exec:\1xcs533.exe54⤵
- Executes dropped EXE
PID:2452 -
\??\c:\vf18409.exec:\vf18409.exe55⤵
- Executes dropped EXE
PID:3276 -
\??\c:\r73o8j3.exec:\r73o8j3.exe56⤵
- Executes dropped EXE
PID:4740 -
\??\c:\p85c1s.exec:\p85c1s.exe57⤵
- Executes dropped EXE
PID:3400 -
\??\c:\t8x009j.exec:\t8x009j.exe58⤵
- Executes dropped EXE
PID:4308 -
\??\c:\lsjk8.exec:\lsjk8.exe59⤵
- Executes dropped EXE
PID:4316 -
\??\c:\07023.exec:\07023.exe60⤵
- Executes dropped EXE
PID:884 -
\??\c:\j98aw27.exec:\j98aw27.exe61⤵
- Executes dropped EXE
PID:4620 -
\??\c:\ewr0u3.exec:\ewr0u3.exe62⤵
- Executes dropped EXE
PID:4976 -
\??\c:\4ilgbbi.exec:\4ilgbbi.exe63⤵
- Executes dropped EXE
PID:5064 -
\??\c:\5ixaw.exec:\5ixaw.exe64⤵
- Executes dropped EXE
PID:3552 -
\??\c:\wii9397.exec:\wii9397.exe65⤵
- Executes dropped EXE
PID:3376 -
\??\c:\ajohji1.exec:\ajohji1.exe66⤵PID:2308
-
\??\c:\8iv5paq.exec:\8iv5paq.exe67⤵PID:3732
-
\??\c:\v9lp60.exec:\v9lp60.exe68⤵PID:3632
-
\??\c:\eikog.exec:\eikog.exe69⤵PID:3996
-
\??\c:\pquen2.exec:\pquen2.exe70⤵PID:1064
-
\??\c:\17v78b.exec:\17v78b.exe71⤵PID:4800
-
\??\c:\qxm0d5e.exec:\qxm0d5e.exe72⤵PID:1516
-
\??\c:\6ktf6.exec:\6ktf6.exe73⤵PID:4232
-
\??\c:\lr43g.exec:\lr43g.exe74⤵PID:3908
-
\??\c:\473x3m.exec:\473x3m.exe75⤵PID:1864
-
\??\c:\bxgeca.exec:\bxgeca.exe76⤵PID:1600
-
\??\c:\0996v.exec:\0996v.exe77⤵PID:3116
-
\??\c:\b80a5.exec:\b80a5.exe78⤵PID:2728
-
\??\c:\9sq79.exec:\9sq79.exe79⤵PID:4212
-
\??\c:\9x7v91a.exec:\9x7v91a.exe80⤵PID:4288
-
\??\c:\1e8fi03.exec:\1e8fi03.exe81⤵PID:4964
-
\??\c:\7xum7n.exec:\7xum7n.exe82⤵PID:4432
-
\??\c:\86dn6.exec:\86dn6.exe83⤵PID:4848
-
\??\c:\ho1sg5.exec:\ho1sg5.exe84⤵PID:4180
-
\??\c:\q60xs5v.exec:\q60xs5v.exe85⤵PID:2696
-
\??\c:\78cr7p.exec:\78cr7p.exe86⤵PID:3756
-
\??\c:\2274ov.exec:\2274ov.exe87⤵PID:1216
-
\??\c:\2v6v6.exec:\2v6v6.exe88⤵PID:4908
-
\??\c:\mklfa0.exec:\mklfa0.exe89⤵PID:844
-
\??\c:\w1ur7i7.exec:\w1ur7i7.exe90⤵PID:764
-
\??\c:\f8ekfa1.exec:\f8ekfa1.exe91⤵PID:4120
-
\??\c:\mrua1.exec:\mrua1.exe92⤵PID:4504
-
\??\c:\4365f.exec:\4365f.exe93⤵PID:2240
-
\??\c:\pf79t.exec:\pf79t.exe94⤵PID:2364
-
\??\c:\0456c9.exec:\0456c9.exe95⤵PID:112
-
\??\c:\37qq4.exec:\37qq4.exe96⤵PID:3968
-
\??\c:\ek3rul.exec:\ek3rul.exe97⤵PID:2596
-
\??\c:\usj1qq.exec:\usj1qq.exe98⤵PID:4392
-
\??\c:\q338mv.exec:\q338mv.exe99⤵PID:2392
-
\??\c:\387nojk.exec:\387nojk.exe100⤵PID:1676
-
\??\c:\1d7qt.exec:\1d7qt.exe101⤵PID:4584
-
\??\c:\bsno7.exec:\bsno7.exe102⤵PID:5016
-
\??\c:\43t3r.exec:\43t3r.exe103⤵PID:4756
-
\??\c:\ho7dsw.exec:\ho7dsw.exe104⤵PID:4540
-
\??\c:\vam8tk.exec:\vam8tk.exe105⤵PID:1840
-
\??\c:\8nbr1.exec:\8nbr1.exe106⤵PID:3568
-
\??\c:\qrx7ia6.exec:\qrx7ia6.exe107⤵PID:4928
-
\??\c:\jvjjv.exec:\jvjjv.exe108⤵PID:3376
-
\??\c:\09v340i.exec:\09v340i.exe109⤵PID:3956
-
\??\c:\j7p71ht.exec:\j7p71ht.exe110⤵PID:3404
-
\??\c:\b96ms9.exec:\b96ms9.exe111⤵PID:456
-
\??\c:\73k69c.exec:\73k69c.exe112⤵PID:3996
-
\??\c:\f7w4m.exec:\f7w4m.exe113⤵PID:4668
-
\??\c:\18lmbo.exec:\18lmbo.exe114⤵PID:2792
-
\??\c:\p86jf81.exec:\p86jf81.exe115⤵PID:2616
-
\??\c:\o0549.exec:\o0549.exe116⤵PID:116
-
\??\c:\w23r3k.exec:\w23r3k.exe117⤵PID:1332
-
\??\c:\697ntl.exec:\697ntl.exe118⤵PID:4984
-
\??\c:\49973o.exec:\49973o.exe119⤵PID:4896
-
\??\c:\029v99.exec:\029v99.exe120⤵PID:2496
-
\??\c:\o8amm.exec:\o8amm.exe121⤵PID:4780
-
\??\c:\9dbtp3.exec:\9dbtp3.exe122⤵PID:1212
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-