Analysis
- max time kernel
151s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 01:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
14b85df8dc8cdbe59edb2d66b5b217f0_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
- Target 14b85df8dc8cdbe59edb2d66b5b217f0_NeikiAnalytics.exe
- Size 71KB
- Sample240612-bvf41axfmc
- SHA256 10591e8b8b8b97599a5c25fcd0e78935b2ece85f447bfe6eec214990aed28238
- MD5 14b85df8dc8cdbe59edb2d66b5b217f0
- SHA1 4f996b204433b3d646f5383ac0dc5d7ecd7220b1
- SHA512 39909bd7f106d8f433c53abefdab97b802e1f2e340b711a792c25ecc059d65ed0256f0ace79eaba2ace1a20ac0e724b6228dafb3141a8dc16ef88d647fb2666e
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIgUVyiAnfZ:ymb3NkkiQ3mdBjFIgUEBZ
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/4948-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4948-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/912-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3456-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2632-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/456-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/664-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1444-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1132-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1300-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3360-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3696-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3568-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3896-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1408-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4616-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/916-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1244-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4924-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1860-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/496-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2464-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 640 78a642.exe 912 j403n.exe 3456 561fvp.exe 4348 4g1e7.exe 2632 j2u10k.exe 4896 f765a.exe 456 mglaa7.exe 664 e1g8e.exe 1444 ae9avx.exe 1132 7576k3r.exe 1300 f1619t0.exe 3360 o9aj8qk.exe 3696 wb1ek0o.exe 3568 31315.exe 3896 n1v1ef5.exe 1408 fsqn4.exe 4276 8vj05.exe 4616 49575m.exe 916 efjgh3.exe 2424 f0mw53.exe 4420 rv90kgp.exe 1244 00c5qh.exe 4924 065t79.exe 972 xm9kev.exe 2556 ujv3gs.exe 4524 ko7r5e.exe 1860 n0mr6.exe 496 ku707w.exe 2248 9r22j.exe 3176 48l5hq.exe 2464 2a31nn.exe 3192 802k4.exe 4572 3ulsw86.exe 576 in5160.exe 4684 63258.exe 4288 idvh3me.exe 4580 mt9ud5g.exe 2688 36jmq5.exe 2388 09c5mmf.exe 1072 0nuj064.exe 1724 09kl1.exe 1096 0jphi3.exe 2336 5whcaab.exe 4632 v1b73v.exe 2052 ct1e5m2.exe 1444 43cr8.exe 4340 l66th2.exe 1648 jxvc1.exe 5068 8dm12.exe 3932 n94gaa9.exe 1872 97gd94.exe 4964 w4o43.exe 2276 4cqu77.exe 4480 v13li.exe 2832 vkueo.exe 4276 jg27ogj.exe 3428 r7g01.exe 3752 x74w79.exe 4620 v5h8lj.exe 2120 6g6p43.exe 4700 115um8q.exe 1768 951uw14.exe 940 k0u58.exe 2220 v34us.exe -
resource yara_rule behavioral2/memory/4948-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4948-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/912-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/912-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3456-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3456-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3456-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2632-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2632-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/456-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/664-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/664-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/664-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1444-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1132-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1132-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1300-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3360-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3568-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3896-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1408-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/916-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1244-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4924-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4524-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1860-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/496-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2464-217-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4948 wrote to memory of 640 4948 14b85df8dc8cdbe59edb2d66b5b217f0_NeikiAnalytics.exe 90 PID 4948 wrote to memory of 640 4948 14b85df8dc8cdbe59edb2d66b5b217f0_NeikiAnalytics.exe 90 PID 4948 wrote to memory of 640 4948 14b85df8dc8cdbe59edb2d66b5b217f0_NeikiAnalytics.exe 90 PID 640 wrote to memory of 912 640 78a642.exe 91 PID 640 wrote to memory of 912 640 78a642.exe 91 PID 640 wrote to memory of 912 640 78a642.exe 91 PID 912 wrote to memory of 3456 912 j403n.exe 92 PID 912 wrote to memory of 3456 912 j403n.exe 92 PID 912 wrote to memory of 3456 912 j403n.exe 92 PID 3456 wrote to memory of 4348 3456 561fvp.exe 93 PID 3456 wrote to memory of 4348 3456 561fvp.exe 93 PID 3456 wrote to memory of 4348 3456 561fvp.exe 93 PID 4348 wrote to memory of 2632 4348 4g1e7.exe 94 PID 4348 wrote to memory of 2632 4348 4g1e7.exe 94 PID 4348 wrote to memory of 2632 4348 4g1e7.exe 94 PID 2632 wrote to memory of 4896 2632 j2u10k.exe 95 PID 2632 wrote to memory of 4896 2632 j2u10k.exe 95 PID 2632 wrote to memory of 4896 2632 j2u10k.exe 95 PID 4896 wrote to memory of 456 4896 f765a.exe 96 PID 4896 wrote to memory of 456 4896 f765a.exe 96 PID 4896 wrote to memory of 456 4896 f765a.exe 96 PID 456 wrote to memory of 664 456 mglaa7.exe 97 PID 456 wrote to memory of 664 456 mglaa7.exe 97 PID 456 wrote to memory of 664 456 mglaa7.exe 97 PID 664 wrote to memory of 1444 664 e1g8e.exe 98 PID 664 wrote to memory of 1444 664 e1g8e.exe 98 PID 664 wrote to memory of 1444 664 e1g8e.exe 98 PID 1444 wrote to memory of 1132 1444 ae9avx.exe 99 PID 1444 wrote to memory of 1132 1444 ae9avx.exe 99 PID 1444 wrote to memory of 1132 1444 ae9avx.exe 99 PID 1132 wrote to memory of 1300 1132 7576k3r.exe 100 PID 1132 wrote to memory of 1300 1132 7576k3r.exe 100 PID 1132 wrote to memory of 1300 1132 7576k3r.exe 100 PID 1300 wrote to memory of 3360 1300 f1619t0.exe 101 PID 1300 wrote to memory of 3360 1300 f1619t0.exe 101 PID 1300 wrote to memory of 3360 1300 f1619t0.exe 101 PID 3360 wrote to memory of 3696 3360 o9aj8qk.exe 102 PID 3360 wrote to memory of 3696 3360 o9aj8qk.exe 102 PID 3360 wrote to memory of 3696 3360 o9aj8qk.exe 102 PID 3696 wrote to memory of 3568 3696 wb1ek0o.exe 103 PID 3696 wrote to memory of 3568 3696 wb1ek0o.exe 103 PID 3696 wrote to memory of 3568 3696 wb1ek0o.exe 103 PID 3568 wrote to memory of 3896 3568 31315.exe 104 PID 3568 wrote to memory of 3896 3568 31315.exe 104 PID 3568 wrote to memory of 3896 3568 31315.exe 104 PID 3896 wrote to memory of 1408 3896 n1v1ef5.exe 105 PID 3896 wrote to memory of 1408 3896 n1v1ef5.exe 105 PID 3896 wrote to memory of 1408 3896 n1v1ef5.exe 105 PID 1408 wrote to memory of 4276 1408 fsqn4.exe 106 PID 1408 wrote to memory of 4276 1408 fsqn4.exe 106 PID 1408 wrote to memory of 4276 1408 fsqn4.exe 106 PID 4276 wrote to memory of 4616 4276 8vj05.exe 107 PID 4276 wrote to memory of 4616 4276 8vj05.exe 107 PID 4276 wrote to memory of 4616 4276 8vj05.exe 107 PID 4616 wrote to memory of 916 4616 49575m.exe 108 PID 4616 wrote to memory of 916 4616 49575m.exe 108 PID 4616 wrote to memory of 916 4616 49575m.exe 108 PID 916 wrote to memory of 2424 916 efjgh3.exe 109 PID 916 wrote to memory of 2424 916 efjgh3.exe 109 PID 916 wrote to memory of 2424 916 efjgh3.exe 109 PID 2424 wrote to memory of 4420 2424 f0mw53.exe 110 PID 2424 wrote to memory of 4420 2424 f0mw53.exe 110 PID 2424 wrote to memory of 4420 2424 f0mw53.exe 110 PID 4420 wrote to memory of 1244 4420 rv90kgp.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\14b85df8dc8cdbe59edb2d66b5b217f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\14b85df8dc8cdbe59edb2d66b5b217f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\78a642.exec:\78a642.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\j403n.exec:\j403n.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\561fvp.exec:\561fvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\4g1e7.exec:\4g1e7.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\j2u10k.exec:\j2u10k.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\f765a.exec:\f765a.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\mglaa7.exec:\mglaa7.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
\??\c:\e1g8e.exec:\e1g8e.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\ae9avx.exec:\ae9avx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\7576k3r.exec:\7576k3r.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\f1619t0.exec:\f1619t0.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\o9aj8qk.exec:\o9aj8qk.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
\??\c:\wb1ek0o.exec:\wb1ek0o.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\31315.exec:\31315.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
\??\c:\n1v1ef5.exec:\n1v1ef5.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\fsqn4.exec:\fsqn4.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\8vj05.exec:\8vj05.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\49575m.exec:\49575m.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\efjgh3.exec:\efjgh3.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
\??\c:\f0mw53.exec:\f0mw53.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\rv90kgp.exec:\rv90kgp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\00c5qh.exec:\00c5qh.exe23⤵
- Executes dropped EXE
PID:1244 -
\??\c:\065t79.exec:\065t79.exe24⤵
- Executes dropped EXE
PID:4924 -
\??\c:\xm9kev.exec:\xm9kev.exe25⤵
- Executes dropped EXE
PID:972 -
\??\c:\ujv3gs.exec:\ujv3gs.exe26⤵
- Executes dropped EXE
PID:2556 -
\??\c:\ko7r5e.exec:\ko7r5e.exe27⤵
- Executes dropped EXE
PID:4524 -
\??\c:\n0mr6.exec:\n0mr6.exe28⤵
- Executes dropped EXE
PID:1860 -
\??\c:\ku707w.exec:\ku707w.exe29⤵
- Executes dropped EXE
PID:496 -
\??\c:\9r22j.exec:\9r22j.exe30⤵
- Executes dropped EXE
PID:2248 -
\??\c:\48l5hq.exec:\48l5hq.exe31⤵
- Executes dropped EXE
PID:3176 -
\??\c:\2a31nn.exec:\2a31nn.exe32⤵
- Executes dropped EXE
PID:2464 -
\??\c:\802k4.exec:\802k4.exe33⤵
- Executes dropped EXE
PID:3192 -
\??\c:\3ulsw86.exec:\3ulsw86.exe34⤵
- Executes dropped EXE
PID:4572 -
\??\c:\in5160.exec:\in5160.exe35⤵
- Executes dropped EXE
PID:576 -
\??\c:\63258.exec:\63258.exe36⤵
- Executes dropped EXE
PID:4684 -
\??\c:\idvh3me.exec:\idvh3me.exe37⤵
- Executes dropped EXE
PID:4288 -
\??\c:\mt9ud5g.exec:\mt9ud5g.exe38⤵
- Executes dropped EXE
PID:4580 -
\??\c:\36jmq5.exec:\36jmq5.exe39⤵
- Executes dropped EXE
PID:2688 -
\??\c:\09c5mmf.exec:\09c5mmf.exe40⤵
- Executes dropped EXE
PID:2388 -
\??\c:\0nuj064.exec:\0nuj064.exe41⤵
- Executes dropped EXE
PID:1072 -
\??\c:\09kl1.exec:\09kl1.exe42⤵
- Executes dropped EXE
PID:1724 -
\??\c:\0jphi3.exec:\0jphi3.exe43⤵
- Executes dropped EXE
PID:1096 -
\??\c:\5whcaab.exec:\5whcaab.exe44⤵
- Executes dropped EXE
PID:2336 -
\??\c:\v1b73v.exec:\v1b73v.exe45⤵
- Executes dropped EXE
PID:4632 -
\??\c:\ct1e5m2.exec:\ct1e5m2.exe46⤵
- Executes dropped EXE
PID:2052 -
\??\c:\43cr8.exec:\43cr8.exe47⤵
- Executes dropped EXE
PID:1444 -
\??\c:\l66th2.exec:\l66th2.exe48⤵
- Executes dropped EXE
PID:4340 -
\??\c:\jxvc1.exec:\jxvc1.exe49⤵
- Executes dropped EXE
PID:1648 -
\??\c:\8dm12.exec:\8dm12.exe50⤵
- Executes dropped EXE
PID:5068 -
\??\c:\n94gaa9.exec:\n94gaa9.exe51⤵
- Executes dropped EXE
PID:3932 -
\??\c:\97gd94.exec:\97gd94.exe52⤵
- Executes dropped EXE
PID:1872 -
\??\c:\w4o43.exec:\w4o43.exe53⤵
- Executes dropped EXE
PID:4964 -
\??\c:\4cqu77.exec:\4cqu77.exe54⤵
- Executes dropped EXE
PID:2276 -
\??\c:\v13li.exec:\v13li.exe55⤵
- Executes dropped EXE
PID:4480 -
\??\c:\vkueo.exec:\vkueo.exe56⤵
- Executes dropped EXE
PID:2832 -
\??\c:\jg27ogj.exec:\jg27ogj.exe57⤵
- Executes dropped EXE
PID:4276 -
\??\c:\r7g01.exec:\r7g01.exe58⤵
- Executes dropped EXE
PID:3428 -
\??\c:\x74w79.exec:\x74w79.exe59⤵
- Executes dropped EXE
PID:3752 -
\??\c:\v5h8lj.exec:\v5h8lj.exe60⤵
- Executes dropped EXE
PID:4620 -
\??\c:\6g6p43.exec:\6g6p43.exe61⤵
- Executes dropped EXE
PID:2120 -
\??\c:\115um8q.exec:\115um8q.exe62⤵
- Executes dropped EXE
PID:4700 -
\??\c:\951uw14.exec:\951uw14.exe63⤵
- Executes dropped EXE
PID:1768 -
\??\c:\k0u58.exec:\k0u58.exe64⤵
- Executes dropped EXE
PID:940 -
\??\c:\v34us.exec:\v34us.exe65⤵
- Executes dropped EXE
PID:2220 -
\??\c:\8xl3sv.exec:\8xl3sv.exe66⤵PID:4036
-
\??\c:\4fa2e67.exec:\4fa2e67.exe67⤵PID:4228
-
\??\c:\906b6o6.exec:\906b6o6.exe68⤵PID:5016
-
\??\c:\607iaq.exec:\607iaq.exe69⤵PID:1860
-
\??\c:\efdxi.exec:\efdxi.exe70⤵PID:496
-
\??\c:\gk83qrs.exec:\gk83qrs.exe71⤵PID:4992
-
\??\c:\94w8dhc.exec:\94w8dhc.exe72⤵PID:4424
-
\??\c:\7u8igj.exec:\7u8igj.exe73⤵PID:4256
-
\??\c:\3o4873f.exec:\3o4873f.exe74⤵PID:2464
-
\??\c:\oa5es6u.exec:\oa5es6u.exe75⤵PID:676
-
\??\c:\o8943.exec:\o8943.exe76⤵PID:3580
-
\??\c:\qm2hdb.exec:\qm2hdb.exe77⤵PID:2144
-
\??\c:\x79we3.exec:\x79we3.exe78⤵PID:5116
-
\??\c:\kf5nw54.exec:\kf5nw54.exe79⤵PID:1548
-
\??\c:\3hxkh6.exec:\3hxkh6.exe80⤵PID:3468
-
\??\c:\o310fm.exec:\o310fm.exe81⤵PID:5052
-
\??\c:\k91m7f.exec:\k91m7f.exe82⤵PID:2484
-
\??\c:\bvnbn.exec:\bvnbn.exe83⤵PID:1072
-
\??\c:\e804qe.exec:\e804qe.exe84⤵PID:400
-
\??\c:\9o29c5.exec:\9o29c5.exe85⤵PID:4552
-
\??\c:\pu8o0.exec:\pu8o0.exe86⤵PID:3956
-
\??\c:\anb221.exec:\anb221.exe87⤵PID:4748
-
\??\c:\k0cfm3u.exec:\k0cfm3u.exe88⤵PID:3588
-
\??\c:\sg1eb4.exec:\sg1eb4.exe89⤵PID:4596
-
\??\c:\3x5uad1.exec:\3x5uad1.exe90⤵PID:3308
-
\??\c:\9ra5m.exec:\9ra5m.exe91⤵PID:776
-
\??\c:\jvffffn.exec:\jvffffn.exe92⤵PID:2940
-
\??\c:\29kw1c.exec:\29kw1c.exe93⤵PID:3972
-
\??\c:\1isqu1.exec:\1isqu1.exe94⤵PID:3104
-
\??\c:\bhl79.exec:\bhl79.exe95⤵PID:4964
-
\??\c:\h901uov.exec:\h901uov.exe96⤵PID:2920
-
\??\c:\g5r4137.exec:\g5r4137.exe97⤵PID:2432
-
\??\c:\q51sq3.exec:\q51sq3.exe98⤵PID:2832
-
\??\c:\wc3lga.exec:\wc3lga.exe99⤵PID:3604
-
\??\c:\2071ek.exec:\2071ek.exe100⤵PID:3428
-
\??\c:\vrrrj.exec:\vrrrj.exe101⤵PID:3752
-
\??\c:\r121le.exec:\r121le.exe102⤵PID:3668
-
\??\c:\vjfjbff.exec:\vjfjbff.exe103⤵PID:3700
-
\??\c:\8j9v587.exec:\8j9v587.exe104⤵PID:1768
-
\??\c:\p94a3.exec:\p94a3.exe105⤵PID:4184
-
\??\c:\28a36a.exec:\28a36a.exe106⤵PID:4312
-
\??\c:\68k009.exec:\68k009.exe107⤵PID:4524
-
\??\c:\784io.exec:\784io.exe108⤵PID:4228
-
\??\c:\eil397.exec:\eil397.exe109⤵PID:436
-
\??\c:\478w8.exec:\478w8.exe110⤵PID:1860
-
\??\c:\6ds91.exec:\6ds91.exe111⤵PID:3620
-
\??\c:\0ae1g.exec:\0ae1g.exe112⤵PID:3292
-
\??\c:\j8il9.exec:\j8il9.exe113⤵PID:3204
-
\??\c:\66p1u1.exec:\66p1u1.exe114⤵PID:224
-
\??\c:\0c82i.exec:\0c82i.exe115⤵PID:5008
-
\??\c:\g8urird.exec:\g8urird.exe116⤵PID:2964
-
\??\c:\vuxaee.exec:\vuxaee.exe117⤵PID:3396
-
\??\c:\19qtl.exec:\19qtl.exe118⤵PID:1176
-
\??\c:\2d97b.exec:\2d97b.exe119⤵PID:4836
-
\??\c:\4p8w44k.exec:\4p8w44k.exe120⤵PID:4128
-
\??\c:\96q7x.exec:\96q7x.exe121⤵PID:3260
-
\??\c:\969l53.exec:\969l53.exe122⤵PID:4112
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-