Analysis
- max time kernel
155s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2024, 20:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2e633057ba6617251f11b6e3538f3660_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
- Target 2e633057ba6617251f11b6e3538f3660_NeikiAnalytics.exe
- Size 226KB
- Sample240519-yz2b3afg48
- SHA256 f4b97a429eec6fbb3a0c5324e00382b42d76b7242038857ac3dc1a6e540e05ba
- MD5 2e633057ba6617251f11b6e3538f3660
- SHA1 bb3f453cd685d00c92e86bc38ea2727d7324beee
- SHA512 be2cd052f01f629de30519d040513a9c8e5a2a3108b6107d7ff64ca4b8728d0f96e803809dab5832fe077566ec325607bbc1eb115169af992ee35cbd6adc1728
- SSDEEP 3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x47WjU:n3C9BRo7MlrWKo+lxRU
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/3192-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/404-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4356-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3404-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/212-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3892-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2904-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2132-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2072-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2756-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4872-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3288-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3672-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2996-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1492-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2592-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3948-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4604-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2408-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2572-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1568-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4320-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1820-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2400-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 4944 811wwu.exe 2824 22i91d.exe 404 i05oc39.exe 4356 p3191t.exe 3404 rliav1o.exe 212 70j3oo9.exe 3892 3clg7v.exe 2904 q6ko3.exe 760 35qer.exe 2132 m5af2.exe 2072 l841a2.exe 2756 4e5g7.exe 4872 2qm4jb.exe 3528 f9wk7c.exe 3288 hpw42.exe 3672 65clxcf.exe 2996 lscsvk.exe 1492 jl0fd0j.exe 2592 r214x.exe 3948 or595.exe 4604 7xf52am.exe 3344 ml1tsu0.exe 2408 92dd5cc.exe 2572 6wa9khl.exe 3932 r3lufa.exe 4960 7fgwk.exe 3428 909ue.exe 1568 fivw9.exe 4320 2mpqx59.exe 1820 035sd.exe 2400 j295r.exe 2512 b4aqisk.exe 4028 1sud3.exe 4856 ahtj2.exe 4908 230u6.exe 3432 tsj325.exe 216 p1aw4cf.exe 2296 k8051.exe 4184 4dlpg.exe 3028 jrkxd5.exe 4564 8as5hu5.exe 2904 9i9a99g.exe 4940 txdlthx.exe 4340 x5j081.exe 3984 0kkcx.exe 2168 3ht5ome.exe 2756 1lhfm.exe 4668 3tqjh9.exe 3720 68h0jx.exe 700 1tm2b7g.exe 1576 08etqx6.exe 4056 wgshq.exe 2384 m72h4r8.exe 2256 d6m25.exe 3636 4edfns0.exe 988 wjo8m.exe 4848 ltbu3.exe 4384 dgd4mdq.exe 400 e50nw0q.exe 4256 ef0vu0.exe 1536 5n5e9.exe 1784 711531.exe 3724 3r8m7t.exe 832 0vv1m.exe -
resource yara_rule behavioral2/memory/3192-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/404-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3404-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/212-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3892-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2904-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2132-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2756-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4872-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3288-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2996-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1492-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2592-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3948-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2408-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2572-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1568-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4320-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1820-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2400-205-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3192 wrote to memory of 4944 3192 2e633057ba6617251f11b6e3538f3660_NeikiAnalytics.exe 92 PID 3192 wrote to memory of 4944 3192 2e633057ba6617251f11b6e3538f3660_NeikiAnalytics.exe 92 PID 3192 wrote to memory of 4944 3192 2e633057ba6617251f11b6e3538f3660_NeikiAnalytics.exe 92 PID 4944 wrote to memory of 2824 4944 811wwu.exe 93 PID 4944 wrote to memory of 2824 4944 811wwu.exe 93 PID 4944 wrote to memory of 2824 4944 811wwu.exe 93 PID 2824 wrote to memory of 404 2824 22i91d.exe 94 PID 2824 wrote to memory of 404 2824 22i91d.exe 94 PID 2824 wrote to memory of 404 2824 22i91d.exe 94 PID 404 wrote to memory of 4356 404 i05oc39.exe 95 PID 404 wrote to memory of 4356 404 i05oc39.exe 95 PID 404 wrote to memory of 4356 404 i05oc39.exe 95 PID 4356 wrote to memory of 3404 4356 p3191t.exe 96 PID 4356 wrote to memory of 3404 4356 p3191t.exe 96 PID 4356 wrote to memory of 3404 4356 p3191t.exe 96 PID 3404 wrote to memory of 212 3404 rliav1o.exe 97 PID 3404 wrote to memory of 212 3404 rliav1o.exe 97 PID 3404 wrote to memory of 212 3404 rliav1o.exe 97 PID 212 wrote to memory of 3892 212 70j3oo9.exe 98 PID 212 wrote to memory of 3892 212 70j3oo9.exe 98 PID 212 wrote to memory of 3892 212 70j3oo9.exe 98 PID 3892 wrote to memory of 2904 3892 3clg7v.exe 99 PID 3892 wrote to memory of 2904 3892 3clg7v.exe 99 PID 3892 wrote to memory of 2904 3892 3clg7v.exe 99 PID 2904 wrote to memory of 760 2904 q6ko3.exe 100 PID 2904 wrote to memory of 760 2904 q6ko3.exe 100 PID 2904 wrote to memory of 760 2904 q6ko3.exe 100 PID 760 wrote to memory of 2132 760 35qer.exe 101 PID 760 wrote to memory of 2132 760 35qer.exe 101 PID 760 wrote to memory of 2132 760 35qer.exe 101 PID 2132 wrote to memory of 2072 2132 m5af2.exe 102 PID 2132 wrote to memory of 2072 2132 m5af2.exe 102 PID 2132 wrote to memory of 2072 2132 m5af2.exe 102 PID 2072 wrote to memory of 2756 2072 l841a2.exe 103 PID 2072 wrote to memory of 2756 2072 l841a2.exe 103 PID 2072 wrote to memory of 2756 2072 l841a2.exe 103 PID 2756 wrote to memory of 4872 2756 4e5g7.exe 104 PID 2756 wrote to memory of 4872 2756 4e5g7.exe 104 PID 2756 wrote to memory of 4872 2756 4e5g7.exe 104 PID 4872 wrote to memory of 3528 4872 2qm4jb.exe 105 PID 4872 wrote to memory of 3528 4872 2qm4jb.exe 105 PID 4872 wrote to memory of 3528 4872 2qm4jb.exe 105 PID 3528 wrote to memory of 3288 3528 f9wk7c.exe 106 PID 3528 wrote to memory of 3288 3528 f9wk7c.exe 106 PID 3528 wrote to memory of 3288 3528 f9wk7c.exe 106 PID 3288 wrote to memory of 3672 3288 hpw42.exe 107 PID 3288 wrote to memory of 3672 3288 hpw42.exe 107 PID 3288 wrote to memory of 3672 3288 hpw42.exe 107 PID 3672 wrote to memory of 2996 3672 65clxcf.exe 108 PID 3672 wrote to memory of 2996 3672 65clxcf.exe 108 PID 3672 wrote to memory of 2996 3672 65clxcf.exe 108 PID 2996 wrote to memory of 1492 2996 lscsvk.exe 109 PID 2996 wrote to memory of 1492 2996 lscsvk.exe 109 PID 2996 wrote to memory of 1492 2996 lscsvk.exe 109 PID 1492 wrote to memory of 2592 1492 jl0fd0j.exe 110 PID 1492 wrote to memory of 2592 1492 jl0fd0j.exe 110 PID 1492 wrote to memory of 2592 1492 jl0fd0j.exe 110 PID 2592 wrote to memory of 3948 2592 r214x.exe 111 PID 2592 wrote to memory of 3948 2592 r214x.exe 111 PID 2592 wrote to memory of 3948 2592 r214x.exe 111 PID 3948 wrote to memory of 4604 3948 or595.exe 112 PID 3948 wrote to memory of 4604 3948 or595.exe 112 PID 3948 wrote to memory of 4604 3948 or595.exe 112 PID 4604 wrote to memory of 3344 4604 7xf52am.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e633057ba6617251f11b6e3538f3660_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2e633057ba6617251f11b6e3538f3660_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\811wwu.exec:\811wwu.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\22i91d.exec:\22i91d.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\i05oc39.exec:\i05oc39.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\p3191t.exec:\p3191t.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\rliav1o.exec:\rliav1o.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
\??\c:\70j3oo9.exec:\70j3oo9.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\3clg7v.exec:\3clg7v.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\q6ko3.exec:\q6ko3.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\35qer.exec:\35qer.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\m5af2.exec:\m5af2.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\l841a2.exec:\l841a2.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\4e5g7.exec:\4e5g7.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\2qm4jb.exec:\2qm4jb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\f9wk7c.exec:\f9wk7c.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\hpw42.exec:\hpw42.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\65clxcf.exec:\65clxcf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\lscsvk.exec:\lscsvk.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\jl0fd0j.exec:\jl0fd0j.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\r214x.exec:\r214x.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\or595.exec:\or595.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\7xf52am.exec:\7xf52am.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\ml1tsu0.exec:\ml1tsu0.exe23⤵
- Executes dropped EXE
PID:3344 -
\??\c:\92dd5cc.exec:\92dd5cc.exe24⤵
- Executes dropped EXE
PID:2408 -
\??\c:\6wa9khl.exec:\6wa9khl.exe25⤵
- Executes dropped EXE
PID:2572 -
\??\c:\r3lufa.exec:\r3lufa.exe26⤵
- Executes dropped EXE
PID:3932 -
\??\c:\7fgwk.exec:\7fgwk.exe27⤵
- Executes dropped EXE
PID:4960 -
\??\c:\909ue.exec:\909ue.exe28⤵
- Executes dropped EXE
PID:3428 -
\??\c:\fivw9.exec:\fivw9.exe29⤵
- Executes dropped EXE
PID:1568 -
\??\c:\2mpqx59.exec:\2mpqx59.exe30⤵
- Executes dropped EXE
PID:4320 -
\??\c:\035sd.exec:\035sd.exe31⤵
- Executes dropped EXE
PID:1820 -
\??\c:\j295r.exec:\j295r.exe32⤵
- Executes dropped EXE
PID:2400 -
\??\c:\b4aqisk.exec:\b4aqisk.exe33⤵
- Executes dropped EXE
PID:2512 -
\??\c:\1sud3.exec:\1sud3.exe34⤵
- Executes dropped EXE
PID:4028 -
\??\c:\ahtj2.exec:\ahtj2.exe35⤵
- Executes dropped EXE
PID:4856 -
\??\c:\230u6.exec:\230u6.exe36⤵
- Executes dropped EXE
PID:4908 -
\??\c:\tsj325.exec:\tsj325.exe37⤵
- Executes dropped EXE
PID:3432 -
\??\c:\p1aw4cf.exec:\p1aw4cf.exe38⤵
- Executes dropped EXE
PID:216 -
\??\c:\k8051.exec:\k8051.exe39⤵
- Executes dropped EXE
PID:2296 -
\??\c:\4dlpg.exec:\4dlpg.exe40⤵
- Executes dropped EXE
PID:4184 -
\??\c:\jrkxd5.exec:\jrkxd5.exe41⤵
- Executes dropped EXE
PID:3028 -
\??\c:\8as5hu5.exec:\8as5hu5.exe42⤵
- Executes dropped EXE
PID:4564 -
\??\c:\9i9a99g.exec:\9i9a99g.exe43⤵
- Executes dropped EXE
PID:2904 -
\??\c:\txdlthx.exec:\txdlthx.exe44⤵
- Executes dropped EXE
PID:4940 -
\??\c:\x5j081.exec:\x5j081.exe45⤵
- Executes dropped EXE
PID:4340 -
\??\c:\0kkcx.exec:\0kkcx.exe46⤵
- Executes dropped EXE
PID:3984 -
\??\c:\3ht5ome.exec:\3ht5ome.exe47⤵
- Executes dropped EXE
PID:2168 -
\??\c:\1lhfm.exec:\1lhfm.exe48⤵
- Executes dropped EXE
PID:2756 -
\??\c:\3tqjh9.exec:\3tqjh9.exe49⤵
- Executes dropped EXE
PID:4668 -
\??\c:\68h0jx.exec:\68h0jx.exe50⤵
- Executes dropped EXE
PID:3720 -
\??\c:\1tm2b7g.exec:\1tm2b7g.exe51⤵
- Executes dropped EXE
PID:700 -
\??\c:\08etqx6.exec:\08etqx6.exe52⤵
- Executes dropped EXE
PID:1576 -
\??\c:\wgshq.exec:\wgshq.exe53⤵
- Executes dropped EXE
PID:4056 -
\??\c:\m72h4r8.exec:\m72h4r8.exe54⤵
- Executes dropped EXE
PID:2384 -
\??\c:\d6m25.exec:\d6m25.exe55⤵
- Executes dropped EXE
PID:2256 -
\??\c:\4edfns0.exec:\4edfns0.exe56⤵
- Executes dropped EXE
PID:3636 -
\??\c:\wjo8m.exec:\wjo8m.exe57⤵
- Executes dropped EXE
PID:988 -
\??\c:\ltbu3.exec:\ltbu3.exe58⤵
- Executes dropped EXE
PID:4848 -
\??\c:\dgd4mdq.exec:\dgd4mdq.exe59⤵
- Executes dropped EXE
PID:4384 -
\??\c:\e50nw0q.exec:\e50nw0q.exe60⤵
- Executes dropped EXE
PID:400 -
\??\c:\ef0vu0.exec:\ef0vu0.exe61⤵
- Executes dropped EXE
PID:4256 -
\??\c:\5n5e9.exec:\5n5e9.exe62⤵
- Executes dropped EXE
PID:1536 -
\??\c:\711531.exec:\711531.exe63⤵
- Executes dropped EXE
PID:1784 -
\??\c:\3r8m7t.exec:\3r8m7t.exe64⤵
- Executes dropped EXE
PID:3724 -
\??\c:\0vv1m.exec:\0vv1m.exe65⤵
- Executes dropped EXE
PID:832 -
\??\c:\il945.exec:\il945.exe66⤵PID:3968
-
\??\c:\734ov.exec:\734ov.exe67⤵PID:4496
-
\??\c:\07v3251.exec:\07v3251.exe68⤵PID:3544
-
\??\c:\095556w.exec:\095556w.exe69⤵PID:4400
-
\??\c:\886mak.exec:\886mak.exe70⤵PID:4320
-
\??\c:\615de5.exec:\615de5.exe71⤵PID:2216
-
\??\c:\gp3h7j.exec:\gp3h7j.exe72⤵PID:1384
-
\??\c:\99m9595.exec:\99m9595.exe73⤵PID:3436
-
\??\c:\n9qaw16.exec:\n9qaw16.exe74⤵PID:4992
-
\??\c:\58qnxd9.exec:\58qnxd9.exe75⤵PID:2416
-
\??\c:\82slpk.exec:\82slpk.exe76⤵PID:4984
-
\??\c:\g9a7w0w.exec:\g9a7w0w.exe77⤵PID:2364
-
\??\c:\1q4w0.exec:\1q4w0.exe78⤵PID:3432
-
\??\c:\0cfs36t.exec:\0cfs36t.exe79⤵PID:3404
-
\??\c:\v17c41.exec:\v17c41.exe80⤵PID:1176
-
\??\c:\g8c3v8.exec:\g8c3v8.exe81⤵PID:432
-
\??\c:\92dioai.exec:\92dioai.exe82⤵PID:2240
-
\??\c:\1719195.exec:\1719195.exe83⤵PID:1680
-
\??\c:\58w9q.exec:\58w9q.exe84⤵PID:3780
-
\??\c:\pc45i5.exec:\pc45i5.exe85⤵PID:2884
-
\??\c:\wp09775.exec:\wp09775.exe86⤵PID:2072
-
\??\c:\nu478u.exec:\nu478u.exe87⤵PID:3356
-
\??\c:\w81fc0l.exec:\w81fc0l.exe88⤵PID:4416
-
\??\c:\92xw33o.exec:\92xw33o.exe89⤵PID:2244
-
\??\c:\sxum1.exec:\sxum1.exe90⤵PID:2124
-
\??\c:\086jh.exec:\086jh.exe91⤵PID:3368
-
\??\c:\3aqk82.exec:\3aqk82.exe92⤵PID:2140
-
\??\c:\j3gd1.exec:\j3gd1.exe93⤵PID:3460
-
\??\c:\o4nii.exec:\o4nii.exe94⤵PID:5028
-
\??\c:\nbwq95.exec:\nbwq95.exe95⤵PID:792
-
\??\c:\sma5c7.exec:\sma5c7.exe96⤵PID:3636
-
\??\c:\a52bh9.exec:\a52bh9.exe97⤵PID:4432
-
\??\c:\6ucs3j5.exec:\6ucs3j5.exe98⤵PID:5060
-
\??\c:\i689f.exec:\i689f.exe99⤵PID:3344
-
\??\c:\epsia0i.exec:\epsia0i.exe100⤵PID:1104
-
\??\c:\s96rj1.exec:\s96rj1.exe101⤵PID:4556
-
\??\c:\b67vv.exec:\b67vv.exe102⤵PID:1228
-
\??\c:\f5ewoa.exec:\f5ewoa.exe103⤵PID:3324
-
\??\c:\6a9w2e.exec:\6a9w2e.exe104⤵PID:3724
-
\??\c:\jg5d54i.exec:\jg5d54i.exe105⤵PID:5084
-
\??\c:\8939w.exec:\8939w.exe106⤵PID:3968
-
\??\c:\03u31.exec:\03u31.exe107⤵PID:2016
-
\??\c:\f707q.exec:\f707q.exe108⤵PID:3544
-
\??\c:\61qa62.exec:\61qa62.exe109⤵PID:1828
-
\??\c:\a5m1e1.exec:\a5m1e1.exe110⤵PID:4112
-
\??\c:\4xb54bq.exec:\4xb54bq.exe111⤵PID:2216
-
\??\c:\30g69.exec:\30g69.exe112⤵PID:4016
-
\??\c:\0ij8e6.exec:\0ij8e6.exe113⤵PID:3436
-
\??\c:\161221.exec:\161221.exe114⤵PID:884
-
\??\c:\d7p8r.exec:\d7p8r.exe115⤵PID:3224
-
\??\c:\2qq765.exec:\2qq765.exe116⤵PID:2724
-
\??\c:\rle12.exec:\rle12.exe117⤵PID:220
-
\??\c:\95485on.exec:\95485on.exe118⤵PID:2448
-
\??\c:\u57l0s.exec:\u57l0s.exe119⤵PID:4420
-
\??\c:\eu7o2ee.exec:\eu7o2ee.exe120⤵PID:3556
-
\??\c:\7259en.exec:\7259en.exe121⤵PID:2068
-
\??\c:\k5r94.exec:\k5r94.exe122⤵PID:3028
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-