Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 22:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f0a38af2d686213f4f87100088918c0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
0f0a38af2d686213f4f87100088918c0_NeikiAnalytics.exe
-
Size
306KB
-
MD5
0f0a38af2d686213f4f87100088918c0
-
SHA1
475ddfcf76c4e7a7e293a2b5dba9bc8785eb7bd0
-
SHA256
bb412a494ddbed94e628dc28ffac1c17864692b5aaf566e30bca97db9baa2db5
-
SHA512
95ec71029207b7bed053abe1173c286f0b37e8e04d68065e63114a09a5ff0e09b81cfbf47bf1548b2f09cb7ac9451529d42667eb010c9caa945884a32e0c10a6
-
SSDEEP
6144:n3C9BRo/CH26ZAmaOXicLrnRukAPXt1UP+3OgEbXeTiDSd2vV:n3C9uUnAvtd3Ogld2vV
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/2240-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1744-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2184-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4364-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/60-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/60-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1112-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/820-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1724-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/788-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2144-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4108-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/964-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2284-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3276-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3420-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1040-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2712-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4368-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4652 3e89r.exe 1744 101kt2e.exe 4768 69900o.exe 2184 sw4qs9.exe 4364 d396edr.exe 4348 9l1181c.exe 60 1s377.exe 1112 252r3.exe 820 fjr29.exe 692 17412v7.exe 1724 6ajq7c4.exe 4524 0vp3g0.exe 5108 ra3nf9.exe 788 7c7l4.exe 4544 00j7bb.exe 2144 u2ktb5.exe 4676 ce974.exe 4108 8181d.exe 964 4193g8.exe 2284 6kh3r.exe 4068 5685d.exe 3276 2mt518.exe 3752 9e4wp9.exe 3420 ekwwkx9.exe 1040 34m01.exe 2712 u9lmh.exe 3992 uw3sa.exe 2296 005oc88.exe 4368 6qtq8r.exe 1068 t35mw8t.exe 2524 5lwf6.exe 3980 72j2wq9.exe 1420 t8v9g7.exe 4468 pjmww.exe 1192 7qqxmw.exe 440 8s701xt.exe 4768 6575o.exe 1080 67pfe4.exe 3232 wh3762h.exe 3156 7ifqc.exe 4932 8vexa.exe 4220 3u9sdnu.exe 4052 v9h8x18.exe 2112 d00p71d.exe 2620 75ijq6.exe 2608 4q0525x.exe 708 20wei5c.exe 1292 d5xajk.exe 644 3g27wqq.exe 3360 n7l4h4g.exe 2888 2oc3p4g.exe 1988 i018wx.exe 2520 l707ip7.exe 4608 n2oae.exe 3176 fg217k.exe 3368 379pn4.exe 2292 10sh32.exe 1444 7eq8i5m.exe 2432 033w5i.exe 5004 8ncn20q.exe 4332 8khi77.exe 3276 90ga14.exe 4456 2dsw357.exe 2212 381gm7.exe -
resource yara_rule behavioral2/memory/2240-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1744-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1744-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1744-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1744-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4768-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4768-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2184-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4364-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4364-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4364-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4364-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/60-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/60-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1112-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1112-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/820-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1724-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4524-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/788-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2144-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4108-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/964-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2284-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3276-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3420-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1040-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2712-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2240 wrote to memory of 4652 2240 0f0a38af2d686213f4f87100088918c0_NeikiAnalytics.exe 90 PID 2240 wrote to memory of 4652 2240 0f0a38af2d686213f4f87100088918c0_NeikiAnalytics.exe 90 PID 2240 wrote to memory of 4652 2240 0f0a38af2d686213f4f87100088918c0_NeikiAnalytics.exe 90 PID 4652 wrote to memory of 1744 4652 3e89r.exe 91 PID 4652 wrote to memory of 1744 4652 3e89r.exe 91 PID 4652 wrote to memory of 1744 4652 3e89r.exe 91 PID 1744 wrote to memory of 4768 1744 101kt2e.exe 92 PID 1744 wrote to memory of 4768 1744 101kt2e.exe 92 PID 1744 wrote to memory of 4768 1744 101kt2e.exe 92 PID 4768 wrote to memory of 2184 4768 69900o.exe 93 PID 4768 wrote to memory of 2184 4768 69900o.exe 93 PID 4768 wrote to memory of 2184 4768 69900o.exe 93 PID 2184 wrote to memory of 4364 2184 sw4qs9.exe 94 PID 2184 wrote to memory of 4364 2184 sw4qs9.exe 94 PID 2184 wrote to memory of 4364 2184 sw4qs9.exe 94 PID 4364 wrote to memory of 4348 4364 d396edr.exe 95 PID 4364 wrote to memory of 4348 4364 d396edr.exe 95 PID 4364 wrote to memory of 4348 4364 d396edr.exe 95 PID 4348 wrote to memory of 60 4348 9l1181c.exe 96 PID 4348 wrote to memory of 60 4348 9l1181c.exe 96 PID 4348 wrote to memory of 60 4348 9l1181c.exe 96 PID 60 wrote to memory of 1112 60 1s377.exe 97 PID 60 wrote to memory of 1112 60 1s377.exe 97 PID 60 wrote to memory of 1112 60 1s377.exe 97 PID 1112 wrote to memory of 820 1112 252r3.exe 98 PID 1112 wrote to memory of 820 1112 252r3.exe 98 PID 1112 wrote to memory of 820 1112 252r3.exe 98 PID 820 wrote to memory of 692 820 fjr29.exe 99 PID 820 wrote to memory of 692 820 fjr29.exe 99 PID 820 wrote to memory of 692 820 fjr29.exe 99 PID 692 wrote to memory of 1724 692 17412v7.exe 100 PID 692 wrote to memory of 1724 692 17412v7.exe 100 PID 692 wrote to memory of 1724 692 17412v7.exe 100 PID 1724 wrote to memory of 4524 1724 6ajq7c4.exe 101 PID 1724 wrote to memory of 4524 1724 6ajq7c4.exe 101 PID 1724 wrote to memory of 4524 1724 6ajq7c4.exe 101 PID 4524 wrote to memory of 5108 4524 0vp3g0.exe 102 PID 4524 wrote to memory of 5108 4524 0vp3g0.exe 102 PID 4524 wrote to memory of 5108 4524 0vp3g0.exe 102 PID 5108 wrote to memory of 788 5108 ra3nf9.exe 103 PID 5108 wrote to memory of 788 5108 ra3nf9.exe 103 PID 5108 wrote to memory of 788 5108 ra3nf9.exe 103 PID 788 wrote to memory of 4544 788 7c7l4.exe 104 PID 788 wrote to memory of 4544 788 7c7l4.exe 104 PID 788 wrote to memory of 4544 788 7c7l4.exe 104 PID 4544 wrote to memory of 2144 4544 00j7bb.exe 105 PID 4544 wrote to memory of 2144 4544 00j7bb.exe 105 PID 4544 wrote to memory of 2144 4544 00j7bb.exe 105 PID 2144 wrote to memory of 4676 2144 u2ktb5.exe 106 PID 2144 wrote to memory of 4676 2144 u2ktb5.exe 106 PID 2144 wrote to memory of 4676 2144 u2ktb5.exe 106 PID 4676 wrote to memory of 4108 4676 ce974.exe 107 PID 4676 wrote to memory of 4108 4676 ce974.exe 107 PID 4676 wrote to memory of 4108 4676 ce974.exe 107 PID 4108 wrote to memory of 964 4108 8181d.exe 108 PID 4108 wrote to memory of 964 4108 8181d.exe 108 PID 4108 wrote to memory of 964 4108 8181d.exe 108 PID 964 wrote to memory of 2284 964 4193g8.exe 109 PID 964 wrote to memory of 2284 964 4193g8.exe 109 PID 964 wrote to memory of 2284 964 4193g8.exe 109 PID 2284 wrote to memory of 4068 2284 6kh3r.exe 110 PID 2284 wrote to memory of 4068 2284 6kh3r.exe 110 PID 2284 wrote to memory of 4068 2284 6kh3r.exe 110 PID 4068 wrote to memory of 3276 4068 5685d.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f0a38af2d686213f4f87100088918c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0f0a38af2d686213f4f87100088918c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\3e89r.exec:\3e89r.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\101kt2e.exec:\101kt2e.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\69900o.exec:\69900o.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\sw4qs9.exec:\sw4qs9.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\d396edr.exec:\d396edr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\9l1181c.exec:\9l1181c.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\1s377.exec:\1s377.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\252r3.exec:\252r3.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\fjr29.exec:\fjr29.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
\??\c:\17412v7.exec:\17412v7.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
\??\c:\6ajq7c4.exec:\6ajq7c4.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\0vp3g0.exec:\0vp3g0.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\ra3nf9.exec:\ra3nf9.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\7c7l4.exec:\7c7l4.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:788 -
\??\c:\00j7bb.exec:\00j7bb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\u2ktb5.exec:\u2ktb5.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\ce974.exec:\ce974.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\8181d.exec:\8181d.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
\??\c:\4193g8.exec:\4193g8.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\6kh3r.exec:\6kh3r.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\5685d.exec:\5685d.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\2mt518.exec:\2mt518.exe23⤵
- Executes dropped EXE
PID:3276 -
\??\c:\9e4wp9.exec:\9e4wp9.exe24⤵
- Executes dropped EXE
PID:3752 -
\??\c:\ekwwkx9.exec:\ekwwkx9.exe25⤵
- Executes dropped EXE
PID:3420 -
\??\c:\34m01.exec:\34m01.exe26⤵
- Executes dropped EXE
PID:1040 -
\??\c:\u9lmh.exec:\u9lmh.exe27⤵
- Executes dropped EXE
PID:2712 -
\??\c:\uw3sa.exec:\uw3sa.exe28⤵
- Executes dropped EXE
PID:3992 -
\??\c:\005oc88.exec:\005oc88.exe29⤵
- Executes dropped EXE
PID:2296 -
\??\c:\6qtq8r.exec:\6qtq8r.exe30⤵
- Executes dropped EXE
PID:4368 -
\??\c:\t35mw8t.exec:\t35mw8t.exe31⤵
- Executes dropped EXE
PID:1068 -
\??\c:\5lwf6.exec:\5lwf6.exe32⤵
- Executes dropped EXE
PID:2524 -
\??\c:\72j2wq9.exec:\72j2wq9.exe33⤵
- Executes dropped EXE
PID:3980 -
\??\c:\t8v9g7.exec:\t8v9g7.exe34⤵
- Executes dropped EXE
PID:1420 -
\??\c:\pjmww.exec:\pjmww.exe35⤵
- Executes dropped EXE
PID:4468 -
\??\c:\7qqxmw.exec:\7qqxmw.exe36⤵
- Executes dropped EXE
PID:1192 -
\??\c:\8s701xt.exec:\8s701xt.exe37⤵
- Executes dropped EXE
PID:440 -
\??\c:\6575o.exec:\6575o.exe38⤵
- Executes dropped EXE
PID:4768 -
\??\c:\67pfe4.exec:\67pfe4.exe39⤵
- Executes dropped EXE
PID:1080 -
\??\c:\wh3762h.exec:\wh3762h.exe40⤵
- Executes dropped EXE
PID:3232 -
\??\c:\7ifqc.exec:\7ifqc.exe41⤵
- Executes dropped EXE
PID:3156 -
\??\c:\8vexa.exec:\8vexa.exe42⤵
- Executes dropped EXE
PID:4932 -
\??\c:\3u9sdnu.exec:\3u9sdnu.exe43⤵
- Executes dropped EXE
PID:4220 -
\??\c:\v9h8x18.exec:\v9h8x18.exe44⤵
- Executes dropped EXE
PID:4052 -
\??\c:\d00p71d.exec:\d00p71d.exe45⤵
- Executes dropped EXE
PID:2112 -
\??\c:\75ijq6.exec:\75ijq6.exe46⤵
- Executes dropped EXE
PID:2620 -
\??\c:\4q0525x.exec:\4q0525x.exe47⤵
- Executes dropped EXE
PID:2608 -
\??\c:\20wei5c.exec:\20wei5c.exe48⤵
- Executes dropped EXE
PID:708 -
\??\c:\d5xajk.exec:\d5xajk.exe49⤵
- Executes dropped EXE
PID:1292 -
\??\c:\3g27wqq.exec:\3g27wqq.exe50⤵
- Executes dropped EXE
PID:644 -
\??\c:\n7l4h4g.exec:\n7l4h4g.exe51⤵
- Executes dropped EXE
PID:3360 -
\??\c:\2oc3p4g.exec:\2oc3p4g.exe52⤵
- Executes dropped EXE
PID:2888 -
\??\c:\i018wx.exec:\i018wx.exe53⤵
- Executes dropped EXE
PID:1988 -
\??\c:\l707ip7.exec:\l707ip7.exe54⤵
- Executes dropped EXE
PID:2520 -
\??\c:\n2oae.exec:\n2oae.exe55⤵
- Executes dropped EXE
PID:4608 -
\??\c:\fg217k.exec:\fg217k.exe56⤵
- Executes dropped EXE
PID:3176 -
\??\c:\379pn4.exec:\379pn4.exe57⤵
- Executes dropped EXE
PID:3368 -
\??\c:\10sh32.exec:\10sh32.exe58⤵
- Executes dropped EXE
PID:2292 -
\??\c:\7eq8i5m.exec:\7eq8i5m.exe59⤵
- Executes dropped EXE
PID:1444 -
\??\c:\033w5i.exec:\033w5i.exe60⤵
- Executes dropped EXE
PID:2432 -
\??\c:\8ncn20q.exec:\8ncn20q.exe61⤵
- Executes dropped EXE
PID:5004 -
\??\c:\8khi77.exec:\8khi77.exe62⤵
- Executes dropped EXE
PID:4332 -
\??\c:\90ga14.exec:\90ga14.exe63⤵
- Executes dropped EXE
PID:3276 -
\??\c:\2dsw357.exec:\2dsw357.exe64⤵
- Executes dropped EXE
PID:4456 -
\??\c:\381gm7.exec:\381gm7.exe65⤵
- Executes dropped EXE
PID:2212 -
\??\c:\lf9x9.exec:\lf9x9.exe66⤵PID:4208
-
\??\c:\2vfgkq1.exec:\2vfgkq1.exe67⤵PID:1924
-
\??\c:\1f7pjt.exec:\1f7pjt.exe68⤵PID:1760
-
\??\c:\2os48c.exec:\2os48c.exe69⤵PID:3292
-
\??\c:\96o6nm.exec:\96o6nm.exe70⤵PID:628
-
\??\c:\2jpcm.exec:\2jpcm.exe71⤵PID:2200
-
\??\c:\0qhlc78.exec:\0qhlc78.exe72⤵PID:3096
-
\??\c:\b850n.exec:\b850n.exe73⤵PID:1528
-
\??\c:\utk93c8.exec:\utk93c8.exe74⤵PID:4160
-
\??\c:\w11g27p.exec:\w11g27p.exe75⤵PID:2128
-
\??\c:\e6ml44.exec:\e6ml44.exe76⤵PID:4236
-
\??\c:\1xe2ou2.exec:\1xe2ou2.exe77⤵PID:2644
-
\??\c:\ip11rw5.exec:\ip11rw5.exe78⤵PID:1340
-
\??\c:\98a6wt4.exec:\98a6wt4.exe79⤵PID:2376
-
\??\c:\5gv2agt.exec:\5gv2agt.exe80⤵PID:4744
-
\??\c:\88ee3en.exec:\88ee3en.exe81⤵PID:416
-
\??\c:\s0k179t.exec:\s0k179t.exe82⤵PID:4492
-
\??\c:\02779k.exec:\02779k.exe83⤵PID:4016
-
\??\c:\len7e7o.exec:\len7e7o.exe84⤵PID:1656
-
\??\c:\4e392.exec:\4e392.exe85⤵PID:3852
-
\??\c:\bic80am.exec:\bic80am.exe86⤵PID:1984
-
\??\c:\12119a.exec:\12119a.exe87⤵PID:820
-
\??\c:\5m1rf12.exec:\5m1rf12.exe88⤵PID:2176
-
\??\c:\bke0i.exec:\bke0i.exe89⤵PID:2460
-
\??\c:\031d7.exec:\031d7.exe90⤵PID:4524
-
\??\c:\7s0era.exec:\7s0era.exe91⤵PID:3772
-
\??\c:\7754h3.exec:\7754h3.exe92⤵PID:640
-
\??\c:\0k723x.exec:\0k723x.exe93⤵PID:748
-
\??\c:\ji1jlv5.exec:\ji1jlv5.exe94⤵PID:4604
-
\??\c:\3r0qe2r.exec:\3r0qe2r.exe95⤵PID:924
-
\??\c:\criql.exec:\criql.exe96⤵PID:3656
-
\??\c:\727579.exec:\727579.exe97⤵PID:2292
-
\??\c:\591796u.exec:\591796u.exe98⤵PID:2108
-
\??\c:\k1g49.exec:\k1g49.exe99⤵PID:5004
-
\??\c:\29i73kb.exec:\29i73kb.exe100⤵PID:1300
-
\??\c:\1olm7.exec:\1olm7.exe101⤵PID:2480
-
\??\c:\21h9410.exec:\21h9410.exe102⤵PID:4400
-
\??\c:\u2neu1.exec:\u2neu1.exe103⤵PID:3288
-
\??\c:\7qnum.exec:\7qnum.exe104⤵PID:4940
-
\??\c:\x2a2p15.exec:\x2a2p15.exe105⤵PID:2836
-
\??\c:\775la.exec:\775la.exe106⤵PID:4476
-
\??\c:\um134.exec:\um134.exe107⤵PID:3712
-
\??\c:\445o0.exec:\445o0.exe108⤵PID:3968
-
\??\c:\387809.exec:\387809.exe109⤵PID:1780
-
\??\c:\o0m3oo.exec:\o0m3oo.exe110⤵PID:2892
-
\??\c:\9ebim.exec:\9ebim.exe111⤵PID:3564
-
\??\c:\m2brd8.exec:\m2brd8.exe112⤵PID:552
-
\??\c:\jocjqe.exec:\jocjqe.exe113⤵PID:1132
-
\??\c:\36v0il.exec:\36v0il.exe114⤵PID:4960
-
\??\c:\1k2rh2.exec:\1k2rh2.exe115⤵PID:440
-
\??\c:\1lcav.exec:\1lcav.exe116⤵PID:4444
-
\??\c:\js6kb1.exec:\js6kb1.exe117⤵PID:1688
-
\??\c:\9s9k557.exec:\9s9k557.exe118⤵PID:1252
-
\??\c:\58u39.exec:\58u39.exe119⤵PID:1184
-
\??\c:\j22s9o.exec:\j22s9o.exe120⤵PID:4220
-
\??\c:\51658ws.exec:\51658ws.exe121⤵PID:3312
-
\??\c:\vtda11v.exec:\vtda11v.exe122⤵PID:1196
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-