Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 14:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
afe28056f55dd4f1e11f35c480fbda80_NeikiAnalytics.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
afe28056f55dd4f1e11f35c480fbda80_NeikiAnalytics.exe
-
Size
361KB
-
MD5
afe28056f55dd4f1e11f35c480fbda80
-
SHA1
a4496308721e9b7e0b063edc1ef2ee360b6ca8a0
-
SHA256
933626561162358c827f5a4f06ce06b7a37418bf0314152aba73d055400f61d0
-
SHA512
535e636f1b11483e0942755a80c4be9b68df533ed6b0bef92c7d2bcfd695d6681cd0afcf3ffab6b4288d9f63e4de8a8ecb8f11340770e09eb72790e7838687ac
-
SSDEEP
6144:n3C9BRIG0asYFm71m8+GdkB9yMu7N+8px7g:n3C9uYA71kSMu08px7g
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/2456-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/636-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4244-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4920-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4920-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/984-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3700-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2284-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/780-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3592-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4540-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1800-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3308-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1932-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3812-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3468-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3572-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4948-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1156-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1592-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4644-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4364-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4388-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/728-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3696-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 636 5ke2iho.exe 5008 0pg111b.exe 4244 pq486.exe 4920 ksqwf.exe 984 p2n1175.exe 2216 l7c9qw7.exe 3700 6daae3.exe 1020 1nbos3v.exe 2284 1qp76.exe 2012 2138rb.exe 780 occ34v.exe 3592 185te.exe 1872 033p284.exe 4540 23w61qe.exe 1800 49473.exe 3308 jxtc6a.exe 1932 r79kq6f.exe 3812 b3a2h.exe 3468 0x5ucr.exe 3572 q94k7.exe 4948 8804e72.exe 1156 l9j9c3.exe 1592 td1s5.exe 4772 058bk87.exe 4644 39359r1.exe 3388 xlui6x.exe 4364 d5w6m.exe 4388 dg0pw8.exe 728 6550743.exe 4420 6b53va.exe 3696 7dame.exe 5104 43an4.exe 568 04b41.exe 368 i773d.exe 816 2693o.exe 3320 61qnvu.exe 3372 r490nto.exe 4028 6w735.exe 3960 f7744f.exe 2464 b2887.exe 4840 t87duaj.exe 1388 xco8ff.exe 2980 e9nud.exe 3276 r9kwu9.exe 2728 sj331jl.exe 2544 etqomtc.exe 3504 t8t4u1.exe 4860 86nek.exe 2012 1frs9.exe 2192 5g908.exe 1700 gsw8u.exe 3404 r373n1.exe 2156 2lc95.exe 3880 4381a2.exe 3348 57pw625.exe 260 33l6h.exe 4508 19na3.exe 1932 vmu74.exe 2452 iu7l5.exe 2568 m819nw2.exe 1172 01b7383.exe 2264 c6gm3.exe 4948 8o18wh.exe 2076 5l0aa.exe -
resource yara_rule behavioral2/memory/2456-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/636-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/636-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4920-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4920-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/984-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/984-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/984-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3700-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3700-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3700-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3700-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2284-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/780-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3592-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4540-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1800-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3308-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1932-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3812-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4948-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1156-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1592-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4644-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4364-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4388-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/728-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-211-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2456 wrote to memory of 636 2456 afe28056f55dd4f1e11f35c480fbda80_NeikiAnalytics.exe 90 PID 2456 wrote to memory of 636 2456 afe28056f55dd4f1e11f35c480fbda80_NeikiAnalytics.exe 90 PID 2456 wrote to memory of 636 2456 afe28056f55dd4f1e11f35c480fbda80_NeikiAnalytics.exe 90 PID 636 wrote to memory of 5008 636 5ke2iho.exe 91 PID 636 wrote to memory of 5008 636 5ke2iho.exe 91 PID 636 wrote to memory of 5008 636 5ke2iho.exe 91 PID 5008 wrote to memory of 4244 5008 0pg111b.exe 92 PID 5008 wrote to memory of 4244 5008 0pg111b.exe 92 PID 5008 wrote to memory of 4244 5008 0pg111b.exe 92 PID 4244 wrote to memory of 4920 4244 pq486.exe 93 PID 4244 wrote to memory of 4920 4244 pq486.exe 93 PID 4244 wrote to memory of 4920 4244 pq486.exe 93 PID 4920 wrote to memory of 984 4920 ksqwf.exe 94 PID 4920 wrote to memory of 984 4920 ksqwf.exe 94 PID 4920 wrote to memory of 984 4920 ksqwf.exe 94 PID 984 wrote to memory of 2216 984 p2n1175.exe 95 PID 984 wrote to memory of 2216 984 p2n1175.exe 95 PID 984 wrote to memory of 2216 984 p2n1175.exe 95 PID 2216 wrote to memory of 3700 2216 l7c9qw7.exe 96 PID 2216 wrote to memory of 3700 2216 l7c9qw7.exe 96 PID 2216 wrote to memory of 3700 2216 l7c9qw7.exe 96 PID 3700 wrote to memory of 1020 3700 6daae3.exe 97 PID 3700 wrote to memory of 1020 3700 6daae3.exe 97 PID 3700 wrote to memory of 1020 3700 6daae3.exe 97 PID 1020 wrote to memory of 2284 1020 1nbos3v.exe 98 PID 1020 wrote to memory of 2284 1020 1nbos3v.exe 98 PID 1020 wrote to memory of 2284 1020 1nbos3v.exe 98 PID 2284 wrote to memory of 2012 2284 1qp76.exe 99 PID 2284 wrote to memory of 2012 2284 1qp76.exe 99 PID 2284 wrote to memory of 2012 2284 1qp76.exe 99 PID 2012 wrote to memory of 780 2012 2138rb.exe 100 PID 2012 wrote to memory of 780 2012 2138rb.exe 100 PID 2012 wrote to memory of 780 2012 2138rb.exe 100 PID 780 wrote to memory of 3592 780 occ34v.exe 101 PID 780 wrote to memory of 3592 780 occ34v.exe 101 PID 780 wrote to memory of 3592 780 occ34v.exe 101 PID 3592 wrote to memory of 1872 3592 185te.exe 102 PID 3592 wrote to memory of 1872 3592 185te.exe 102 PID 3592 wrote to memory of 1872 3592 185te.exe 102 PID 1872 wrote to memory of 4540 1872 033p284.exe 103 PID 1872 wrote to memory of 4540 1872 033p284.exe 103 PID 1872 wrote to memory of 4540 1872 033p284.exe 103 PID 4540 wrote to memory of 1800 4540 23w61qe.exe 104 PID 4540 wrote to memory of 1800 4540 23w61qe.exe 104 PID 4540 wrote to memory of 1800 4540 23w61qe.exe 104 PID 1800 wrote to memory of 3308 1800 49473.exe 105 PID 1800 wrote to memory of 3308 1800 49473.exe 105 PID 1800 wrote to memory of 3308 1800 49473.exe 105 PID 3308 wrote to memory of 1932 3308 jxtc6a.exe 106 PID 3308 wrote to memory of 1932 3308 jxtc6a.exe 106 PID 3308 wrote to memory of 1932 3308 jxtc6a.exe 106 PID 1932 wrote to memory of 3812 1932 r79kq6f.exe 107 PID 1932 wrote to memory of 3812 1932 r79kq6f.exe 107 PID 1932 wrote to memory of 3812 1932 r79kq6f.exe 107 PID 3812 wrote to memory of 3468 3812 b3a2h.exe 108 PID 3812 wrote to memory of 3468 3812 b3a2h.exe 108 PID 3812 wrote to memory of 3468 3812 b3a2h.exe 108 PID 3468 wrote to memory of 3572 3468 0x5ucr.exe 109 PID 3468 wrote to memory of 3572 3468 0x5ucr.exe 109 PID 3468 wrote to memory of 3572 3468 0x5ucr.exe 109 PID 3572 wrote to memory of 4948 3572 q94k7.exe 110 PID 3572 wrote to memory of 4948 3572 q94k7.exe 110 PID 3572 wrote to memory of 4948 3572 q94k7.exe 110 PID 4948 wrote to memory of 1156 4948 8804e72.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\afe28056f55dd4f1e11f35c480fbda80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\afe28056f55dd4f1e11f35c480fbda80_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\5ke2iho.exec:\5ke2iho.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\0pg111b.exec:\0pg111b.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\pq486.exec:\pq486.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
\??\c:\ksqwf.exec:\ksqwf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\p2n1175.exec:\p2n1175.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
\??\c:\l7c9qw7.exec:\l7c9qw7.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\6daae3.exec:\6daae3.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\1nbos3v.exec:\1nbos3v.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\1qp76.exec:\1qp76.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\2138rb.exec:\2138rb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\occ34v.exec:\occ34v.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
\??\c:\185te.exec:\185te.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\033p284.exec:\033p284.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\23w61qe.exec:\23w61qe.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\49473.exec:\49473.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\jxtc6a.exec:\jxtc6a.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\r79kq6f.exec:\r79kq6f.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\b3a2h.exec:\b3a2h.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\0x5ucr.exec:\0x5ucr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\q94k7.exec:\q94k7.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\8804e72.exec:\8804e72.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\l9j9c3.exec:\l9j9c3.exe23⤵
- Executes dropped EXE
PID:1156 -
\??\c:\td1s5.exec:\td1s5.exe24⤵
- Executes dropped EXE
PID:1592 -
\??\c:\058bk87.exec:\058bk87.exe25⤵
- Executes dropped EXE
PID:4772 -
\??\c:\39359r1.exec:\39359r1.exe26⤵
- Executes dropped EXE
PID:4644 -
\??\c:\xlui6x.exec:\xlui6x.exe27⤵
- Executes dropped EXE
PID:3388 -
\??\c:\d5w6m.exec:\d5w6m.exe28⤵
- Executes dropped EXE
PID:4364 -
\??\c:\dg0pw8.exec:\dg0pw8.exe29⤵
- Executes dropped EXE
PID:4388 -
\??\c:\6550743.exec:\6550743.exe30⤵
- Executes dropped EXE
PID:728 -
\??\c:\6b53va.exec:\6b53va.exe31⤵
- Executes dropped EXE
PID:4420 -
\??\c:\7dame.exec:\7dame.exe32⤵
- Executes dropped EXE
PID:3696 -
\??\c:\43an4.exec:\43an4.exe33⤵
- Executes dropped EXE
PID:5104 -
\??\c:\04b41.exec:\04b41.exe34⤵
- Executes dropped EXE
PID:568 -
\??\c:\i773d.exec:\i773d.exe35⤵
- Executes dropped EXE
PID:368 -
\??\c:\2693o.exec:\2693o.exe36⤵
- Executes dropped EXE
PID:816 -
\??\c:\61qnvu.exec:\61qnvu.exe37⤵
- Executes dropped EXE
PID:3320 -
\??\c:\r490nto.exec:\r490nto.exe38⤵
- Executes dropped EXE
PID:3372 -
\??\c:\6w735.exec:\6w735.exe39⤵
- Executes dropped EXE
PID:4028 -
\??\c:\f7744f.exec:\f7744f.exe40⤵
- Executes dropped EXE
PID:3960 -
\??\c:\b2887.exec:\b2887.exe41⤵
- Executes dropped EXE
PID:2464 -
\??\c:\t87duaj.exec:\t87duaj.exe42⤵
- Executes dropped EXE
PID:4840 -
\??\c:\xco8ff.exec:\xco8ff.exe43⤵
- Executes dropped EXE
PID:1388 -
\??\c:\e9nud.exec:\e9nud.exe44⤵
- Executes dropped EXE
PID:2980 -
\??\c:\r9kwu9.exec:\r9kwu9.exe45⤵
- Executes dropped EXE
PID:3276 -
\??\c:\sj331jl.exec:\sj331jl.exe46⤵
- Executes dropped EXE
PID:2728 -
\??\c:\etqomtc.exec:\etqomtc.exe47⤵
- Executes dropped EXE
PID:2544 -
\??\c:\t8t4u1.exec:\t8t4u1.exe48⤵
- Executes dropped EXE
PID:3504 -
\??\c:\86nek.exec:\86nek.exe49⤵
- Executes dropped EXE
PID:4860 -
\??\c:\1frs9.exec:\1frs9.exe50⤵
- Executes dropped EXE
PID:2012 -
\??\c:\5g908.exec:\5g908.exe51⤵
- Executes dropped EXE
PID:2192 -
\??\c:\gsw8u.exec:\gsw8u.exe52⤵
- Executes dropped EXE
PID:1700 -
\??\c:\r373n1.exec:\r373n1.exe53⤵
- Executes dropped EXE
PID:3404 -
\??\c:\2lc95.exec:\2lc95.exe54⤵
- Executes dropped EXE
PID:2156 -
\??\c:\4381a2.exec:\4381a2.exe55⤵
- Executes dropped EXE
PID:3880 -
\??\c:\57pw625.exec:\57pw625.exe56⤵
- Executes dropped EXE
PID:3348 -
\??\c:\33l6h.exec:\33l6h.exe57⤵
- Executes dropped EXE
PID:260 -
\??\c:\19na3.exec:\19na3.exe58⤵
- Executes dropped EXE
PID:4508 -
\??\c:\vmu74.exec:\vmu74.exe59⤵
- Executes dropped EXE
PID:1932 -
\??\c:\iu7l5.exec:\iu7l5.exe60⤵
- Executes dropped EXE
PID:2452 -
\??\c:\m819nw2.exec:\m819nw2.exe61⤵
- Executes dropped EXE
PID:2568 -
\??\c:\01b7383.exec:\01b7383.exe62⤵
- Executes dropped EXE
PID:1172 -
\??\c:\c6gm3.exec:\c6gm3.exe63⤵
- Executes dropped EXE
PID:2264 -
\??\c:\8o18wh.exec:\8o18wh.exe64⤵
- Executes dropped EXE
PID:4948 -
\??\c:\5l0aa.exec:\5l0aa.exe65⤵
- Executes dropped EXE
PID:2076 -
\??\c:\p5wtec.exec:\p5wtec.exe66⤵PID:4892
-
\??\c:\11htw1.exec:\11htw1.exe67⤵PID:4588
-
\??\c:\vk5o5e3.exec:\vk5o5e3.exe68⤵PID:3164
-
\??\c:\90k5k.exec:\90k5k.exe69⤵PID:4644
-
\??\c:\h855tj1.exec:\h855tj1.exe70⤵PID:3616
-
\??\c:\8n7mp3.exec:\8n7mp3.exe71⤵PID:4136
-
\??\c:\563u79.exec:\563u79.exe72⤵PID:920
-
\??\c:\765uu.exec:\765uu.exe73⤵PID:1176
-
\??\c:\f7129da.exec:\f7129da.exe74⤵PID:4372
-
\??\c:\45s210.exec:\45s210.exe75⤵PID:5036
-
\??\c:\x006e.exec:\x006e.exe76⤵PID:1184
-
\??\c:\7q5ofl.exec:\7q5ofl.exe77⤵PID:4216
-
\??\c:\937x9nc.exec:\937x9nc.exe78⤵PID:4464
-
\??\c:\u8qht8.exec:\u8qht8.exe79⤵PID:4132
-
\??\c:\6e8t1.exec:\6e8t1.exe80⤵PID:916
-
\??\c:\49ip5i5.exec:\49ip5i5.exe81⤵PID:2784
-
\??\c:\p6jkl.exec:\p6jkl.exe82⤵PID:2032
-
\??\c:\w913d.exec:\w913d.exe83⤵PID:1188
-
\??\c:\plnk1r.exec:\plnk1r.exe84⤵PID:3084
-
\??\c:\62f94sp.exec:\62f94sp.exe85⤵PID:3780
-
\??\c:\o714m.exec:\o714m.exe86⤵PID:3652
-
\??\c:\a91d3a0.exec:\a91d3a0.exe87⤵PID:1972
-
\??\c:\sm5l7v.exec:\sm5l7v.exe88⤵PID:3700
-
\??\c:\gwel062.exec:\gwel062.exe89⤵PID:1828
-
\??\c:\hw35x67.exec:\hw35x67.exe90⤵PID:1600
-
\??\c:\741lus5.exec:\741lus5.exe91⤵PID:3000
-
\??\c:\8gs35f.exec:\8gs35f.exe92⤵PID:3480
-
\??\c:\pmd5d.exec:\pmd5d.exe93⤵PID:3440
-
\??\c:\10mm6b.exec:\10mm6b.exe94⤵PID:780
-
\??\c:\7qp81t.exec:\7qp81t.exe95⤵PID:2808
-
\??\c:\rf9t3wh.exec:\rf9t3wh.exe96⤵PID:4708
-
\??\c:\b2lja5.exec:\b2lja5.exe97⤵PID:1872
-
\??\c:\xh870d.exec:\xh870d.exe98⤵PID:2892
-
\??\c:\i8xfgq.exec:\i8xfgq.exe99⤵PID:4188
-
\??\c:\m64hh.exec:\m64hh.exe100⤵PID:2972
-
\??\c:\60qb4t.exec:\60qb4t.exe101⤵PID:3664
-
\??\c:\bopp9.exec:\bopp9.exe102⤵PID:3632
-
\??\c:\885tm3q.exec:\885tm3q.exe103⤵PID:3284
-
\??\c:\3b0bt.exec:\3b0bt.exe104⤵PID:3468
-
\??\c:\b2eqh.exec:\b2eqh.exe105⤵PID:4332
-
\??\c:\tnt9t3.exec:\tnt9t3.exe106⤵PID:2948
-
\??\c:\wkbho9r.exec:\wkbho9r.exe107⤵PID:2204
-
\??\c:\3693591.exec:\3693591.exe108⤵PID:976
-
\??\c:\3kj99.exec:\3kj99.exe109⤵PID:1224
-
\??\c:\8sg9sm.exec:\8sg9sm.exe110⤵PID:3520
-
\??\c:\rc24x.exec:\rc24x.exe111⤵PID:3392
-
\??\c:\1n11p8.exec:\1n11p8.exe112⤵PID:3956
-
\??\c:\q2v1h35.exec:\q2v1h35.exe113⤵PID:2780
-
\??\c:\av3k519.exec:\av3k519.exe114⤵PID:3388
-
\??\c:\w0du6.exec:\w0du6.exe115⤵PID:5032
-
\??\c:\l5g5q.exec:\l5g5q.exe116⤵PID:2140
-
\??\c:\gg5d5.exec:\gg5d5.exe117⤵PID:4348
-
\??\c:\p7f7a.exec:\p7f7a.exe118⤵PID:1860
-
\??\c:\fis92.exec:\fis92.exe119⤵PID:2308
-
\??\c:\118li.exec:\118li.exe120⤵PID:2904
-
\??\c:\9w34av.exec:\9w34av.exe121⤵PID:2060
-
\??\c:\j4d60s7.exec:\j4d60s7.exe122⤵PID:4764
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-