Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 21:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
38d95353709f8b18cebd1657f425eb10_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
38d95353709f8b18cebd1657f425eb10_NeikiAnalytics.exe
-
Size
119KB
-
MD5
38d95353709f8b18cebd1657f425eb10
-
SHA1
3fc9d074a3b22c3f2bffb7211fc6b78cb549923f
-
SHA256
5068c6eea3b268cdef54771b5b2049b8a49b003b07c7870861eec7d239fc01d8
-
SHA512
35bfbd2afab02816d0bbe4a348355e8fe449a8e1e33642bb711588435e6a25966b722ceb4e743f41b8dd99d4a5f53e4678e9ec519852f518d0c6e6c843727328
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDomRGApSuLAR2yPBCQ1nDFu1Q8so:ymb3NkkiQ3mdBjFomR7UsyJC+n0Gsgcl
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/116-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/652-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1356-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3988-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2016-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/868-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/628-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/212-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/400-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/736-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1184-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/696-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4924-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1476-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3644-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3232-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1664-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1484-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1832-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 652 446826.exe 1356 80268.exe 2208 5rxrrlr.exe 3988 ddjjv.exe 2016 dpjvj.exe 4280 1dvjv.exe 868 s6284.exe 4936 040426.exe 628 nnnhtn.exe 4768 frrrlll.exe 4020 4822226.exe 212 08460.exe 400 e40482.exe 736 062066.exe 1184 828864.exe 696 vjppv.exe 4924 82208.exe 1476 086282.exe 3644 0826442.exe 3680 lfrffxx.exe 3232 m6648.exe 4940 rfxfxxx.exe 1008 bhbntn.exe 2956 248222.exe 1664 0026404.exe 5100 20226.exe 3360 266628.exe 1456 ddddv.exe 1484 2464882.exe 1832 664866.exe 3396 s6466.exe 4964 jdjdv.exe 2268 44288.exe 4176 644422.exe 4476 04844.exe 3388 8460888.exe 4516 pvdvp.exe 804 pddvp.exe 652 bhtnhb.exe 2548 206666.exe 436 1ntnbh.exe 2208 ttbhnt.exe 3456 4066668.exe 3452 880402.exe 1264 46408.exe 4280 6004226.exe 1944 xrrrllf.exe 1836 86260.exe 464 a0888.exe 540 dpjjj.exe 4604 42820.exe 4572 8866000.exe 1508 422604.exe 1388 rlrlrrr.exe 4980 602266.exe 2580 xxrlllf.exe 3648 22240.exe 3536 280044.exe 696 8806626.exe 748 02888.exe 4764 dppdv.exe 2080 hhnthb.exe 3644 46888.exe 4376 26822.exe -
resource yara_rule behavioral2/memory/116-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/652-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1356-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3988-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2016-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/868-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/628-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4768-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/212-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/736-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1184-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/696-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4924-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1476-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3644-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3232-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1664-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1484-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1832-198-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 116 wrote to memory of 652 116 38d95353709f8b18cebd1657f425eb10_NeikiAnalytics.exe 82 PID 116 wrote to memory of 652 116 38d95353709f8b18cebd1657f425eb10_NeikiAnalytics.exe 82 PID 116 wrote to memory of 652 116 38d95353709f8b18cebd1657f425eb10_NeikiAnalytics.exe 82 PID 652 wrote to memory of 1356 652 446826.exe 83 PID 652 wrote to memory of 1356 652 446826.exe 83 PID 652 wrote to memory of 1356 652 446826.exe 83 PID 1356 wrote to memory of 2208 1356 80268.exe 84 PID 1356 wrote to memory of 2208 1356 80268.exe 84 PID 1356 wrote to memory of 2208 1356 80268.exe 84 PID 2208 wrote to memory of 3988 2208 5rxrrlr.exe 85 PID 2208 wrote to memory of 3988 2208 5rxrrlr.exe 85 PID 2208 wrote to memory of 3988 2208 5rxrrlr.exe 85 PID 3988 wrote to memory of 2016 3988 ddjjv.exe 86 PID 3988 wrote to memory of 2016 3988 ddjjv.exe 86 PID 3988 wrote to memory of 2016 3988 ddjjv.exe 86 PID 2016 wrote to memory of 4280 2016 dpjvj.exe 87 PID 2016 wrote to memory of 4280 2016 dpjvj.exe 87 PID 2016 wrote to memory of 4280 2016 dpjvj.exe 87 PID 4280 wrote to memory of 868 4280 1dvjv.exe 88 PID 4280 wrote to memory of 868 4280 1dvjv.exe 88 PID 4280 wrote to memory of 868 4280 1dvjv.exe 88 PID 868 wrote to memory of 4936 868 s6284.exe 89 PID 868 wrote to memory of 4936 868 s6284.exe 89 PID 868 wrote to memory of 4936 868 s6284.exe 89 PID 4936 wrote to memory of 628 4936 040426.exe 90 PID 4936 wrote to memory of 628 4936 040426.exe 90 PID 4936 wrote to memory of 628 4936 040426.exe 90 PID 628 wrote to memory of 4768 628 nnnhtn.exe 91 PID 628 wrote to memory of 4768 628 nnnhtn.exe 91 PID 628 wrote to memory of 4768 628 nnnhtn.exe 91 PID 4768 wrote to memory of 4020 4768 frrrlll.exe 92 PID 4768 wrote to memory of 4020 4768 frrrlll.exe 92 PID 4768 wrote to memory of 4020 4768 frrrlll.exe 92 PID 4020 wrote to memory of 212 4020 4822226.exe 93 PID 4020 wrote to memory of 212 4020 4822226.exe 93 PID 4020 wrote to memory of 212 4020 4822226.exe 93 PID 212 wrote to memory of 400 212 08460.exe 94 PID 212 wrote to memory of 400 212 08460.exe 94 PID 212 wrote to memory of 400 212 08460.exe 94 PID 400 wrote to memory of 736 400 e40482.exe 95 PID 400 wrote to memory of 736 400 e40482.exe 95 PID 400 wrote to memory of 736 400 e40482.exe 95 PID 736 wrote to memory of 1184 736 062066.exe 96 PID 736 wrote to memory of 1184 736 062066.exe 96 PID 736 wrote to memory of 1184 736 062066.exe 96 PID 1184 wrote to memory of 696 1184 828864.exe 97 PID 1184 wrote to memory of 696 1184 828864.exe 97 PID 1184 wrote to memory of 696 1184 828864.exe 97 PID 696 wrote to memory of 4924 696 vjppv.exe 98 PID 696 wrote to memory of 4924 696 vjppv.exe 98 PID 696 wrote to memory of 4924 696 vjppv.exe 98 PID 4924 wrote to memory of 1476 4924 82208.exe 99 PID 4924 wrote to memory of 1476 4924 82208.exe 99 PID 4924 wrote to memory of 1476 4924 82208.exe 99 PID 1476 wrote to memory of 3644 1476 086282.exe 100 PID 1476 wrote to memory of 3644 1476 086282.exe 100 PID 1476 wrote to memory of 3644 1476 086282.exe 100 PID 3644 wrote to memory of 3680 3644 0826442.exe 102 PID 3644 wrote to memory of 3680 3644 0826442.exe 102 PID 3644 wrote to memory of 3680 3644 0826442.exe 102 PID 3680 wrote to memory of 3232 3680 lfrffxx.exe 103 PID 3680 wrote to memory of 3232 3680 lfrffxx.exe 103 PID 3680 wrote to memory of 3232 3680 lfrffxx.exe 103 PID 3232 wrote to memory of 4940 3232 m6648.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\38d95353709f8b18cebd1657f425eb10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\38d95353709f8b18cebd1657f425eb10_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\446826.exec:\446826.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
\??\c:\80268.exec:\80268.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\5rxrrlr.exec:\5rxrrlr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\ddjjv.exec:\ddjjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\dpjvj.exec:\dpjvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\1dvjv.exec:\1dvjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\s6284.exec:\s6284.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\040426.exec:\040426.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\nnnhtn.exec:\nnnhtn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\frrrlll.exec:\frrrlll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\4822226.exec:\4822226.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\08460.exec:\08460.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\e40482.exec:\e40482.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\062066.exec:\062066.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
\??\c:\828864.exec:\828864.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\vjppv.exec:\vjppv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\82208.exec:\82208.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\086282.exec:\086282.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\0826442.exec:\0826442.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\lfrffxx.exec:\lfrffxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
\??\c:\m6648.exec:\m6648.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\rfxfxxx.exec:\rfxfxxx.exe23⤵
- Executes dropped EXE
PID:4940 -
\??\c:\bhbntn.exec:\bhbntn.exe24⤵
- Executes dropped EXE
PID:1008 -
\??\c:\248222.exec:\248222.exe25⤵
- Executes dropped EXE
PID:2956 -
\??\c:\0026404.exec:\0026404.exe26⤵
- Executes dropped EXE
PID:1664 -
\??\c:\20226.exec:\20226.exe27⤵
- Executes dropped EXE
PID:5100 -
\??\c:\266628.exec:\266628.exe28⤵
- Executes dropped EXE
PID:3360 -
\??\c:\ddddv.exec:\ddddv.exe29⤵
- Executes dropped EXE
PID:1456 -
\??\c:\2464882.exec:\2464882.exe30⤵
- Executes dropped EXE
PID:1484 -
\??\c:\664866.exec:\664866.exe31⤵
- Executes dropped EXE
PID:1832 -
\??\c:\s6466.exec:\s6466.exe32⤵
- Executes dropped EXE
PID:3396 -
\??\c:\jdjdv.exec:\jdjdv.exe33⤵
- Executes dropped EXE
PID:4964 -
\??\c:\44288.exec:\44288.exe34⤵
- Executes dropped EXE
PID:2268 -
\??\c:\644422.exec:\644422.exe35⤵
- Executes dropped EXE
PID:4176 -
\??\c:\04844.exec:\04844.exe36⤵
- Executes dropped EXE
PID:4476 -
\??\c:\8460888.exec:\8460888.exe37⤵
- Executes dropped EXE
PID:3388 -
\??\c:\pvdvp.exec:\pvdvp.exe38⤵
- Executes dropped EXE
PID:4516 -
\??\c:\pddvp.exec:\pddvp.exe39⤵
- Executes dropped EXE
PID:804 -
\??\c:\bhtnhb.exec:\bhtnhb.exe40⤵
- Executes dropped EXE
PID:652 -
\??\c:\206666.exec:\206666.exe41⤵
- Executes dropped EXE
PID:2548 -
\??\c:\1ntnbh.exec:\1ntnbh.exe42⤵
- Executes dropped EXE
PID:436 -
\??\c:\ttbhnt.exec:\ttbhnt.exe43⤵
- Executes dropped EXE
PID:2208 -
\??\c:\4066668.exec:\4066668.exe44⤵
- Executes dropped EXE
PID:3456 -
\??\c:\880402.exec:\880402.exe45⤵
- Executes dropped EXE
PID:3452 -
\??\c:\46408.exec:\46408.exe46⤵
- Executes dropped EXE
PID:1264 -
\??\c:\6004226.exec:\6004226.exe47⤵
- Executes dropped EXE
PID:4280 -
\??\c:\xrrrllf.exec:\xrrrllf.exe48⤵
- Executes dropped EXE
PID:1944 -
\??\c:\86260.exec:\86260.exe49⤵
- Executes dropped EXE
PID:1836 -
\??\c:\a0888.exec:\a0888.exe50⤵
- Executes dropped EXE
PID:464 -
\??\c:\dpjjj.exec:\dpjjj.exe51⤵
- Executes dropped EXE
PID:540 -
\??\c:\42820.exec:\42820.exe52⤵
- Executes dropped EXE
PID:4604 -
\??\c:\8866000.exec:\8866000.exe53⤵
- Executes dropped EXE
PID:4572 -
\??\c:\422604.exec:\422604.exe54⤵
- Executes dropped EXE
PID:1508 -
\??\c:\rlrlrrr.exec:\rlrlrrr.exe55⤵
- Executes dropped EXE
PID:1388 -
\??\c:\602266.exec:\602266.exe56⤵
- Executes dropped EXE
PID:4980 -
\??\c:\xxrlllf.exec:\xxrlllf.exe57⤵
- Executes dropped EXE
PID:2580 -
\??\c:\22240.exec:\22240.exe58⤵
- Executes dropped EXE
PID:3648 -
\??\c:\280044.exec:\280044.exe59⤵
- Executes dropped EXE
PID:3536 -
\??\c:\8806626.exec:\8806626.exe60⤵
- Executes dropped EXE
PID:696 -
\??\c:\02888.exec:\02888.exe61⤵
- Executes dropped EXE
PID:748 -
\??\c:\dppdv.exec:\dppdv.exe62⤵
- Executes dropped EXE
PID:4764 -
\??\c:\hhnthb.exec:\hhnthb.exe63⤵
- Executes dropped EXE
PID:2080 -
\??\c:\46888.exec:\46888.exe64⤵
- Executes dropped EXE
PID:3644 -
\??\c:\26822.exec:\26822.exe65⤵
- Executes dropped EXE
PID:4376 -
\??\c:\4060448.exec:\4060448.exe66⤵PID:4052
-
\??\c:\pppjd.exec:\pppjd.exe67⤵PID:4940
-
\??\c:\1bbthh.exec:\1bbthh.exe68⤵PID:1008
-
\??\c:\268282.exec:\268282.exe69⤵PID:2184
-
\??\c:\hbhhtt.exec:\hbhhtt.exe70⤵PID:4236
-
\??\c:\xflfxrr.exec:\xflfxrr.exe71⤵PID:3792
-
\??\c:\xfffxfx.exec:\xfffxfx.exe72⤵PID:3048
-
\??\c:\hbtntt.exec:\hbtntt.exe73⤵PID:1624
-
\??\c:\m2000.exec:\m2000.exe74⤵PID:2816
-
\??\c:\0282600.exec:\0282600.exe75⤵PID:1320
-
\??\c:\u800004.exec:\u800004.exe76⤵PID:1752
-
\??\c:\hbthth.exec:\hbthth.exe77⤵PID:4456
-
\??\c:\628822.exec:\628822.exe78⤵PID:4964
-
\??\c:\4624204.exec:\4624204.exe79⤵PID:4480
-
\??\c:\882266.exec:\882266.exe80⤵PID:3520
-
\??\c:\hbthbb.exec:\hbthbb.exe81⤵PID:4656
-
\??\c:\jjpjj.exec:\jjpjj.exe82⤵PID:4476
-
\??\c:\u026444.exec:\u026444.exe83⤵PID:1100
-
\??\c:\2666000.exec:\2666000.exe84⤵PID:624
-
\??\c:\hbtnhb.exec:\hbtnhb.exe85⤵PID:3640
-
\??\c:\40266.exec:\40266.exe86⤵PID:4452
-
\??\c:\bntnhh.exec:\bntnhh.exe87⤵PID:2548
-
\??\c:\ffrflfl.exec:\ffrflfl.exe88⤵PID:404
-
\??\c:\8442420.exec:\8442420.exe89⤵PID:3236
-
\??\c:\xrxfrlx.exec:\xrxfrlx.exe90⤵PID:3292
-
\??\c:\hbtttn.exec:\hbtttn.exe91⤵PID:412
-
\??\c:\0626060.exec:\0626060.exe92⤵PID:1556
-
\??\c:\rfflffl.exec:\rfflffl.exe93⤵PID:868
-
\??\c:\0422884.exec:\0422884.exe94⤵PID:1372
-
\??\c:\a6888.exec:\a6888.exe95⤵PID:3332
-
\??\c:\3lrrrff.exec:\3lrrrff.exe96⤵PID:5036
-
\??\c:\400660.exec:\400660.exe97⤵PID:540
-
\??\c:\fflfxxx.exec:\fflfxxx.exe98⤵PID:4044
-
\??\c:\48444.exec:\48444.exe99⤵PID:4020
-
\??\c:\llxrfff.exec:\llxrfff.exe100⤵PID:400
-
\??\c:\086286.exec:\086286.exe101⤵PID:3976
-
\??\c:\4064448.exec:\4064448.exe102⤵PID:4292
-
\??\c:\jdvjp.exec:\jdvjp.exe103⤵PID:4112
-
\??\c:\fxfffxx.exec:\fxfffxx.exe104⤵PID:4468
-
\??\c:\jvppj.exec:\jvppj.exe105⤵PID:1644
-
\??\c:\8262820.exec:\8262820.exe106⤵PID:1632
-
\??\c:\ntttnn.exec:\ntttnn.exe107⤵PID:1988
-
\??\c:\464822.exec:\464822.exe108⤵PID:1136
-
\??\c:\nhbtnn.exec:\nhbtnn.exe109⤵PID:4848
-
\??\c:\lrxrlll.exec:\lrxrlll.exe110⤵PID:3232
-
\??\c:\llrrrrx.exec:\llrrrrx.exe111⤵PID:4040
-
\??\c:\thttnh.exec:\thttnh.exe112⤵PID:1324
-
\??\c:\828640.exec:\828640.exe113⤵PID:5000
-
\??\c:\26826.exec:\26826.exe114⤵PID:1008
-
\??\c:\vvpdj.exec:\vvpdj.exe115⤵PID:4948
-
\??\c:\o082600.exec:\o082600.exe116⤵PID:4864
-
\??\c:\042884.exec:\042884.exe117⤵PID:3044
-
\??\c:\m0604.exec:\m0604.exe118⤵PID:640
-
\??\c:\ffxrllf.exec:\ffxrllf.exe119⤵PID:4548
-
\??\c:\82244.exec:\82244.exe120⤵PID:3836
-
\??\c:\bttnbb.exec:\bttnbb.exe121⤵PID:4644
-
\??\c:\0044444.exec:\0044444.exe122⤵PID:4320
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-