Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 18:18
Behavioral task
behavioral1
Sample
288763a376e5d2ee4c22b599fb670a50_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
288763a376e5d2ee4c22b599fb670a50_NeikiAnalytics.exe
-
Size
464KB
-
MD5
288763a376e5d2ee4c22b599fb670a50
-
SHA1
58d40d48aa364bde7c9d8859564bda4aedaad785
-
SHA256
88099c8a7df5af0c47312285577d5c694413e8430b0aeaa54c8f50046a095dd1
-
SHA512
8d0f492d049e8c2b9349c2ba5057800fd1e05499165c5a775c58b9f365a6c1bad35f0c35e8ab19cea605540d16abf7066f9fe16eb2c7c75b9f1213f404e7fdb8
-
SSDEEP
12288:J4wFHoSTeR0oQRkay+eFp3IDvSbh5nPVP+OKaf1VP:VeR0oykayRFp3lztP+OKaf1VP
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4252-13-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3080-5-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1884-19-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2160-20-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2840-27-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3904-38-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4764-39-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/744-46-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1504-55-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4496-61-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2252-67-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3448-73-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4164-81-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4456-80-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2244-90-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3728-97-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2264-104-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4960-113-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3556-116-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2284-125-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/396-133-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3232-143-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2064-158-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1452-166-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/5036-186-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1620-190-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2128-197-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1660-201-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4660-216-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4748-223-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1632-236-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1164-243-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3656-247-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4296-248-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3128-264-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1132-287-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3396-291-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2576-304-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1556-311-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4256-318-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1452-328-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2768-335-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2788-348-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2948-358-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1816-365-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1616-367-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1540-376-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2372-416-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/5040-429-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3724-431-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3060-452-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4920-460-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4832-475-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3904-500-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/744-507-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1144-523-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3348-579-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/5032-601-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3720-650-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1216-654-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3652-670-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2836-761-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1280-798-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3816-876-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule behavioral2/memory/3080-0-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\thnnhn.exe family_berbew behavioral2/memory/4252-7-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\ddjjd.exe family_berbew behavioral2/memory/4252-13-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/3080-5-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\5nbbhh.exe family_berbew behavioral2/memory/1884-19-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2160-20-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\rflxrrx.exe family_berbew behavioral2/memory/2840-27-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\hbtnth.exe family_berbew behavioral2/memory/3904-32-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/3904-38-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4764-39-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\1rlxfrf.exe family_berbew C:\hbnhhh.exe family_berbew behavioral2/memory/744-46-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\ttbthb.exe family_berbew C:\hhbbnt.exe family_berbew behavioral2/memory/1504-55-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4496-61-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\dddjv.exe family_berbew C:\ppjdd.exe family_berbew behavioral2/memory/2252-67-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\7btnbb.exe family_berbew behavioral2/memory/3448-73-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\1thhtt.exe family_berbew behavioral2/memory/4164-81-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\dvvdv.exe family_berbew behavioral2/memory/4456-80-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\hnbbtn.exe family_berbew behavioral2/memory/2244-90-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\nnnnhh.exe family_berbew behavioral2/memory/3728-97-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\rrlfxlf.exe family_berbew behavioral2/memory/2264-104-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\hhnthn.exe family_berbew C:\frxffxx.exe family_berbew behavioral2/memory/4960-113-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/3556-116-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\vvpjj.exe family_berbew C:\pvpdj.exe family_berbew behavioral2/memory/2284-125-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\hbhtnt.exe family_berbew behavioral2/memory/396-133-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\llfrxfr.exe family_berbew C:\ttttnn.exe family_berbew behavioral2/memory/3232-143-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\pdjjj.exe family_berbew C:\tnhhnb.exe family_berbew C:\jdvvj.exe family_berbew behavioral2/memory/2064-158-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\nbhbhb.exe family_berbew behavioral2/memory/1452-166-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\3nbnhb.exe family_berbew \??\c:\fxffrxr.exe family_berbew C:\flxxxxl.exe family_berbew C:\lxxrrrr.exe family_berbew behavioral2/memory/5036-186-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/1620-190-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2128-197-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/1660-201-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4660-216-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
Processes:
thnnhn.exeddjjd.exe5nbbhh.exerflxrrx.exehbtnth.exe1rlxfrf.exehbnhhh.exettbthb.exehhbbnt.exedddjv.exeppjdd.exe7btnbb.exe1thhtt.exedvvdv.exehnbbtn.exennnnhh.exerrlfxlf.exehhnthn.exefrxffxx.exevvpjj.exepvpdj.exehbhtnt.exellfrxfr.exettttnn.exepdjjj.exetnhhnb.exejdvvj.exenbhbhb.exe3nbnhb.exefxffrxr.exeflxxxxl.exelxxrrrr.exefxrrrrr.exeppppj.exexrfrlxr.exenbnnnn.exevvjdv.exerrlrxlx.exeddpjd.exe9vpdd.exebthbtt.exe3xlllrr.exelfrlllf.exe7pppj.exexlffxff.exetnbtbb.exedvvpp.exerlxrfrx.exehhhbbt.exevdpjp.exefxffxxl.exehbtntt.exe3vdvv.exelxlffff.exenntttt.exennhtth.exe9lrrlll.exerfxfxxf.exebbbnht.exe1pjdd.exerlfrlrf.exetnhbtn.exe1jpjd.exeflfflxl.exepid process 4252 thnnhn.exe 1884 ddjjd.exe 2160 5nbbhh.exe 2840 rflxrrx.exe 3904 hbtnth.exe 4764 1rlxfrf.exe 744 hbnhhh.exe 1504 ttbthb.exe 4496 hhbbnt.exe 2252 dddjv.exe 3448 ppjdd.exe 4456 7btnbb.exe 4164 1thhtt.exe 2244 dvvdv.exe 1356 hnbbtn.exe 3728 nnnnhh.exe 2264 rrlfxlf.exe 4960 hhnthn.exe 3556 frxffxx.exe 2284 vvpjj.exe 3652 pvpdj.exe 396 hbhtnt.exe 1736 llfrxfr.exe 3232 ttttnn.exe 688 pdjjj.exe 2064 tnhhnb.exe 2588 jdvvj.exe 1452 nbhbhb.exe 1036 3nbnhb.exe 5092 fxffrxr.exe 5036 flxxxxl.exe 1620 lxxrrrr.exe 3676 fxrrrrr.exe 2128 ppppj.exe 1660 xrfrlxr.exe 4432 nbnnnn.exe 3300 vvjdv.exe 3236 rrlrxlx.exe 4904 ddpjd.exe 4660 9vpdd.exe 2056 bthbtt.exe 1064 3xlllrr.exe 4748 lfrlllf.exe 8 7pppj.exe 4092 xlffxff.exe 1632 tnbtbb.exe 2376 dvvpp.exe 1164 rlxrfrx.exe 3656 hhhbbt.exe 4296 vdpjp.exe 3488 fxffxxl.exe 1144 hbtntt.exe 4080 3vdvv.exe 3128 lxlffff.exe 884 nntttt.exe 3112 nnhtth.exe 4164 9lrrlll.exe 3908 rfxfxxf.exe 2136 bbbnht.exe 1852 1pjdd.exe 1132 rlfrlrf.exe 3396 tnhbtn.exe 4960 1jpjd.exe 4540 flfflxl.exe -
Processes:
resource yara_rule behavioral2/memory/3080-0-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\thnnhn.exe upx behavioral2/memory/4252-7-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\ddjjd.exe upx behavioral2/memory/4252-13-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/3080-5-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\5nbbhh.exe upx behavioral2/memory/1884-19-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2160-20-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\rflxrrx.exe upx behavioral2/memory/2840-27-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\hbtnth.exe upx behavioral2/memory/3904-32-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/3904-38-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4764-39-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\1rlxfrf.exe upx C:\hbnhhh.exe upx behavioral2/memory/744-46-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\ttbthb.exe upx C:\hhbbnt.exe upx behavioral2/memory/1504-55-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4496-61-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\dddjv.exe upx C:\ppjdd.exe upx behavioral2/memory/2252-67-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\7btnbb.exe upx behavioral2/memory/3448-73-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\1thhtt.exe upx behavioral2/memory/4164-81-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\dvvdv.exe upx behavioral2/memory/4456-80-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\hnbbtn.exe upx behavioral2/memory/2244-90-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\nnnnhh.exe upx behavioral2/memory/3728-97-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\rrlfxlf.exe upx behavioral2/memory/2264-104-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\hhnthn.exe upx C:\frxffxx.exe upx behavioral2/memory/4960-113-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/3556-116-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\vvpjj.exe upx C:\pvpdj.exe upx behavioral2/memory/2284-125-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\hbhtnt.exe upx behavioral2/memory/396-133-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\llfrxfr.exe upx C:\ttttnn.exe upx behavioral2/memory/3232-143-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\pdjjj.exe upx C:\tnhhnb.exe upx C:\jdvvj.exe upx behavioral2/memory/2064-158-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\nbhbhb.exe upx behavioral2/memory/1452-166-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\3nbnhb.exe upx \??\c:\fxffrxr.exe upx C:\flxxxxl.exe upx C:\lxxrrrr.exe upx behavioral2/memory/5036-186-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/1620-190-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2128-197-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/1660-201-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4660-216-0x0000000000400000-0x000000000043A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
288763a376e5d2ee4c22b599fb670a50_NeikiAnalytics.exethnnhn.exeddjjd.exe5nbbhh.exerflxrrx.exehbtnth.exe1rlxfrf.exehbnhhh.exettbthb.exehhbbnt.exedddjv.exeppjdd.exe7btnbb.exe1thhtt.exedvvdv.exehnbbtn.exennnnhh.exerrlfxlf.exehhnthn.exefrxffxx.exevvpjj.exepvpdj.exedescription pid process target process PID 3080 wrote to memory of 4252 3080 288763a376e5d2ee4c22b599fb670a50_NeikiAnalytics.exe thnnhn.exe PID 3080 wrote to memory of 4252 3080 288763a376e5d2ee4c22b599fb670a50_NeikiAnalytics.exe thnnhn.exe PID 3080 wrote to memory of 4252 3080 288763a376e5d2ee4c22b599fb670a50_NeikiAnalytics.exe thnnhn.exe PID 4252 wrote to memory of 1884 4252 thnnhn.exe ddjjd.exe PID 4252 wrote to memory of 1884 4252 thnnhn.exe ddjjd.exe PID 4252 wrote to memory of 1884 4252 thnnhn.exe ddjjd.exe PID 1884 wrote to memory of 2160 1884 ddjjd.exe 5nbbhh.exe PID 1884 wrote to memory of 2160 1884 ddjjd.exe 5nbbhh.exe PID 1884 wrote to memory of 2160 1884 ddjjd.exe 5nbbhh.exe PID 2160 wrote to memory of 2840 2160 5nbbhh.exe rflxrrx.exe PID 2160 wrote to memory of 2840 2160 5nbbhh.exe rflxrrx.exe PID 2160 wrote to memory of 2840 2160 5nbbhh.exe rflxrrx.exe PID 2840 wrote to memory of 3904 2840 rflxrrx.exe hbtnth.exe PID 2840 wrote to memory of 3904 2840 rflxrrx.exe hbtnth.exe PID 2840 wrote to memory of 3904 2840 rflxrrx.exe hbtnth.exe PID 3904 wrote to memory of 4764 3904 hbtnth.exe 1rlxfrf.exe PID 3904 wrote to memory of 4764 3904 hbtnth.exe 1rlxfrf.exe PID 3904 wrote to memory of 4764 3904 hbtnth.exe 1rlxfrf.exe PID 4764 wrote to memory of 744 4764 1rlxfrf.exe hbnhhh.exe PID 4764 wrote to memory of 744 4764 1rlxfrf.exe hbnhhh.exe PID 4764 wrote to memory of 744 4764 1rlxfrf.exe hbnhhh.exe PID 744 wrote to memory of 1504 744 hbnhhh.exe ttbthb.exe PID 744 wrote to memory of 1504 744 hbnhhh.exe ttbthb.exe PID 744 wrote to memory of 1504 744 hbnhhh.exe ttbthb.exe PID 1504 wrote to memory of 4496 1504 ttbthb.exe hhbbnt.exe PID 1504 wrote to memory of 4496 1504 ttbthb.exe hhbbnt.exe PID 1504 wrote to memory of 4496 1504 ttbthb.exe hhbbnt.exe PID 4496 wrote to memory of 2252 4496 hhbbnt.exe dddjv.exe PID 4496 wrote to memory of 2252 4496 hhbbnt.exe dddjv.exe PID 4496 wrote to memory of 2252 4496 hhbbnt.exe dddjv.exe PID 2252 wrote to memory of 3448 2252 dddjv.exe ppjdd.exe PID 2252 wrote to memory of 3448 2252 dddjv.exe ppjdd.exe PID 2252 wrote to memory of 3448 2252 dddjv.exe ppjdd.exe PID 3448 wrote to memory of 4456 3448 ppjdd.exe 7btnbb.exe PID 3448 wrote to memory of 4456 3448 ppjdd.exe 7btnbb.exe PID 3448 wrote to memory of 4456 3448 ppjdd.exe 7btnbb.exe PID 4456 wrote to memory of 4164 4456 7btnbb.exe 1thhtt.exe PID 4456 wrote to memory of 4164 4456 7btnbb.exe 1thhtt.exe PID 4456 wrote to memory of 4164 4456 7btnbb.exe 1thhtt.exe PID 4164 wrote to memory of 2244 4164 1thhtt.exe dvvdv.exe PID 4164 wrote to memory of 2244 4164 1thhtt.exe dvvdv.exe PID 4164 wrote to memory of 2244 4164 1thhtt.exe dvvdv.exe PID 2244 wrote to memory of 1356 2244 dvvdv.exe hnbbtn.exe PID 2244 wrote to memory of 1356 2244 dvvdv.exe hnbbtn.exe PID 2244 wrote to memory of 1356 2244 dvvdv.exe hnbbtn.exe PID 1356 wrote to memory of 3728 1356 hnbbtn.exe nnnnhh.exe PID 1356 wrote to memory of 3728 1356 hnbbtn.exe nnnnhh.exe PID 1356 wrote to memory of 3728 1356 hnbbtn.exe nnnnhh.exe PID 3728 wrote to memory of 2264 3728 nnnnhh.exe rrlfxlf.exe PID 3728 wrote to memory of 2264 3728 nnnnhh.exe rrlfxlf.exe PID 3728 wrote to memory of 2264 3728 nnnnhh.exe rrlfxlf.exe PID 2264 wrote to memory of 4960 2264 rrlfxlf.exe hhnthn.exe PID 2264 wrote to memory of 4960 2264 rrlfxlf.exe hhnthn.exe PID 2264 wrote to memory of 4960 2264 rrlfxlf.exe hhnthn.exe PID 4960 wrote to memory of 3556 4960 hhnthn.exe frxffxx.exe PID 4960 wrote to memory of 3556 4960 hhnthn.exe frxffxx.exe PID 4960 wrote to memory of 3556 4960 hhnthn.exe frxffxx.exe PID 3556 wrote to memory of 2284 3556 frxffxx.exe vvpjj.exe PID 3556 wrote to memory of 2284 3556 frxffxx.exe vvpjj.exe PID 3556 wrote to memory of 2284 3556 frxffxx.exe vvpjj.exe PID 2284 wrote to memory of 3652 2284 vvpjj.exe pvpdj.exe PID 2284 wrote to memory of 3652 2284 vvpjj.exe pvpdj.exe PID 2284 wrote to memory of 3652 2284 vvpjj.exe pvpdj.exe PID 3652 wrote to memory of 396 3652 pvpdj.exe hbhtnt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\288763a376e5d2ee4c22b599fb670a50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\288763a376e5d2ee4c22b599fb670a50_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\thnnhn.exec:\thnnhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\ddjjd.exec:\ddjjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\5nbbhh.exec:\5nbbhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\rflxrrx.exec:\rflxrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\hbtnth.exec:\hbtnth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\1rlxfrf.exec:\1rlxfrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\hbnhhh.exec:\hbnhhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\ttbthb.exec:\ttbthb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\hhbbnt.exec:\hhbbnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\dddjv.exec:\dddjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\ppjdd.exec:\ppjdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\7btnbb.exec:\7btnbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\1thhtt.exec:\1thhtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
\??\c:\dvvdv.exec:\dvvdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\hnbbtn.exec:\hnbbtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\nnnnhh.exec:\nnnnhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\rrlfxlf.exec:\rrlfxlf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\hhnthn.exec:\hhnthn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\frxffxx.exec:\frxffxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\vvpjj.exec:\vvpjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\pvpdj.exec:\pvpdj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\hbhtnt.exec:\hbhtnt.exe23⤵
- Executes dropped EXE
PID:396 -
\??\c:\llfrxfr.exec:\llfrxfr.exe24⤵
- Executes dropped EXE
PID:1736 -
\??\c:\ttttnn.exec:\ttttnn.exe25⤵
- Executes dropped EXE
PID:3232 -
\??\c:\pdjjj.exec:\pdjjj.exe26⤵
- Executes dropped EXE
PID:688 -
\??\c:\tnhhnb.exec:\tnhhnb.exe27⤵
- Executes dropped EXE
PID:2064 -
\??\c:\jdvvj.exec:\jdvvj.exe28⤵
- Executes dropped EXE
PID:2588 -
\??\c:\nbhbhb.exec:\nbhbhb.exe29⤵
- Executes dropped EXE
PID:1452 -
\??\c:\3nbnhb.exec:\3nbnhb.exe30⤵
- Executes dropped EXE
PID:1036 -
\??\c:\fxffrxr.exec:\fxffrxr.exe31⤵
- Executes dropped EXE
PID:5092 -
\??\c:\flxxxxl.exec:\flxxxxl.exe32⤵
- Executes dropped EXE
PID:5036 -
\??\c:\lxxrrrr.exec:\lxxrrrr.exe33⤵
- Executes dropped EXE
PID:1620 -
\??\c:\fxrrrrr.exec:\fxrrrrr.exe34⤵
- Executes dropped EXE
PID:3676 -
\??\c:\ppppj.exec:\ppppj.exe35⤵
- Executes dropped EXE
PID:2128 -
\??\c:\xrfrlxr.exec:\xrfrlxr.exe36⤵
- Executes dropped EXE
PID:1660 -
\??\c:\nbnnnn.exec:\nbnnnn.exe37⤵
- Executes dropped EXE
PID:4432 -
\??\c:\vvjdv.exec:\vvjdv.exe38⤵
- Executes dropped EXE
PID:3300 -
\??\c:\rrlrxlx.exec:\rrlrxlx.exe39⤵
- Executes dropped EXE
PID:3236 -
\??\c:\ddpjd.exec:\ddpjd.exe40⤵
- Executes dropped EXE
PID:4904 -
\??\c:\9vpdd.exec:\9vpdd.exe41⤵
- Executes dropped EXE
PID:4660 -
\??\c:\bthbtt.exec:\bthbtt.exe42⤵
- Executes dropped EXE
PID:2056 -
\??\c:\3xlllrr.exec:\3xlllrr.exe43⤵
- Executes dropped EXE
PID:1064 -
\??\c:\lfrlllf.exec:\lfrlllf.exe44⤵
- Executes dropped EXE
PID:4748 -
\??\c:\7pppj.exec:\7pppj.exe45⤵
- Executes dropped EXE
PID:8 -
\??\c:\xlffxff.exec:\xlffxff.exe46⤵
- Executes dropped EXE
PID:4092 -
\??\c:\tnbtbb.exec:\tnbtbb.exe47⤵
- Executes dropped EXE
PID:1632 -
\??\c:\dvvpp.exec:\dvvpp.exe48⤵
- Executes dropped EXE
PID:2376 -
\??\c:\rlxrfrx.exec:\rlxrfrx.exe49⤵
- Executes dropped EXE
PID:1164 -
\??\c:\hhhbbt.exec:\hhhbbt.exe50⤵
- Executes dropped EXE
PID:3656 -
\??\c:\vdpjp.exec:\vdpjp.exe51⤵
- Executes dropped EXE
PID:4296 -
\??\c:\fxffxxl.exec:\fxffxxl.exe52⤵
- Executes dropped EXE
PID:3488 -
\??\c:\hbtntt.exec:\hbtntt.exe53⤵
- Executes dropped EXE
PID:1144 -
\??\c:\3vdvv.exec:\3vdvv.exe54⤵
- Executes dropped EXE
PID:4080 -
\??\c:\lxlffff.exec:\lxlffff.exe55⤵
- Executes dropped EXE
PID:3128 -
\??\c:\nntttt.exec:\nntttt.exe56⤵
- Executes dropped EXE
PID:884 -
\??\c:\nnhtth.exec:\nnhtth.exe57⤵
- Executes dropped EXE
PID:3112 -
\??\c:\9lrrlll.exec:\9lrrlll.exe58⤵
- Executes dropped EXE
PID:4164 -
\??\c:\rfxfxxf.exec:\rfxfxxf.exe59⤵
- Executes dropped EXE
PID:3908 -
\??\c:\bbbnht.exec:\bbbnht.exe60⤵
- Executes dropped EXE
PID:2136 -
\??\c:\1pjdd.exec:\1pjdd.exe61⤵
- Executes dropped EXE
PID:1852 -
\??\c:\rlfrlrf.exec:\rlfrlrf.exe62⤵
- Executes dropped EXE
PID:1132 -
\??\c:\tnhbtn.exec:\tnhbtn.exe63⤵
- Executes dropped EXE
PID:3396 -
\??\c:\1jpjd.exec:\1jpjd.exe64⤵
- Executes dropped EXE
PID:4960 -
\??\c:\flfflxl.exec:\flfflxl.exe65⤵
- Executes dropped EXE
PID:4540 -
\??\c:\pjdvd.exec:\pjdvd.exe66⤵PID:2792
-
\??\c:\nnhbht.exec:\nnhbht.exe67⤵PID:2576
-
\??\c:\lfxfxff.exec:\lfxfxff.exe68⤵PID:3652
-
\??\c:\vjdjd.exec:\vjdjd.exe69⤵PID:1556
-
\??\c:\flfrlxl.exec:\flfrlxl.exe70⤵PID:4100
-
\??\c:\nbtbhb.exec:\nbtbhb.exe71⤵PID:4256
-
\??\c:\ddvvv.exec:\ddvvv.exe72⤵PID:3000
-
\??\c:\hnttnn.exec:\hnttnn.exe73⤵PID:3040
-
\??\c:\vppjp.exec:\vppjp.exe74⤵PID:4144
-
\??\c:\vdvdv.exec:\vdvdv.exe75⤵PID:1452
-
\??\c:\1rrrlfr.exec:\1rrrlfr.exe76⤵PID:2768
-
\??\c:\jdjdj.exec:\jdjdj.exe77⤵PID:784
-
\??\c:\lffxllf.exec:\lffxllf.exe78⤵PID:4832
-
\??\c:\llffxxr.exec:\llffxxr.exe79⤵PID:2560
-
\??\c:\hbbtnn.exec:\hbbtnn.exe80⤵PID:2788
-
\??\c:\5xxrrrl.exec:\5xxrrrl.exe81⤵PID:4576
-
\??\c:\thhhbb.exec:\thhhbb.exe82⤵PID:2128
-
\??\c:\pvpdv.exec:\pvpdv.exe83⤵PID:2948
-
\??\c:\lllxllx.exec:\lllxllx.exe84⤵PID:4432
-
\??\c:\fxrlrll.exec:\fxrlrll.exe85⤵PID:1816
-
\??\c:\9nhbbb.exec:\9nhbbb.exe86⤵PID:1616
-
\??\c:\jppdj.exec:\jppdj.exe87⤵PID:3184
-
\??\c:\1xrlffx.exec:\1xrlffx.exe88⤵PID:1540
-
\??\c:\5hhbtt.exec:\5hhbtt.exe89⤵PID:2848
-
\??\c:\pjjdd.exec:\pjjdd.exe90⤵PID:4944
-
\??\c:\lrrfxxl.exec:\lrrfxxl.exe91⤵PID:4792
-
\??\c:\bnnbnt.exec:\bnnbnt.exe92⤵PID:1868
-
\??\c:\vjjvd.exec:\vjjvd.exe93⤵PID:4764
-
\??\c:\lffrfrx.exec:\lffrfrx.exe94⤵PID:2012
-
\??\c:\btthbt.exec:\btthbt.exe95⤵PID:2252
-
\??\c:\ppddd.exec:\ppddd.exe96⤵PID:1464
-
\??\c:\3fxfrfr.exec:\3fxfrfr.exe97⤵PID:4664
-
\??\c:\9fllffx.exec:\9fllffx.exe98⤵PID:212
-
\??\c:\tntnnn.exec:\tntnnn.exe99⤵PID:1492
-
\??\c:\pdpjd.exec:\pdpjd.exe100⤵PID:3516
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe101⤵PID:2372
-
\??\c:\nhhbnb.exec:\nhhbnb.exe102⤵PID:3720
-
\??\c:\jvdvp.exec:\jvdvp.exe103⤵PID:1952
-
\??\c:\rrllfxx.exec:\rrllfxx.exe104⤵PID:3816
-
\??\c:\tthhtt.exec:\tthhtt.exe105⤵PID:5040
-
\??\c:\7jdpj.exec:\7jdpj.exe106⤵PID:3724
-
\??\c:\jddvp.exec:\jddvp.exe107⤵PID:5052
-
\??\c:\thbhnb.exec:\thbhnb.exe108⤵PID:880
-
\??\c:\xxrrlfx.exec:\xxrrlfx.exe109⤵PID:2952
-
\??\c:\bntnbt.exec:\bntnbt.exe110⤵PID:3232
-
\??\c:\pjjdv.exec:\pjjdv.exe111⤵PID:2496
-
\??\c:\lflxrfx.exec:\lflxrfx.exe112⤵PID:3060
-
\??\c:\tnnhhn.exec:\tnnhhn.exe113⤵PID:4956
-
\??\c:\btthbb.exec:\btthbb.exe114⤵PID:3256
-
\??\c:\xxxrllf.exec:\xxxrllf.exe115⤵PID:4920
-
\??\c:\fffxxfx.exec:\fffxxfx.exe116⤵PID:1508
-
\??\c:\bthhnh.exec:\bthhnh.exe117⤵PID:2768
-
\??\c:\llffllx.exec:\llffllx.exe118⤵PID:4204
-
\??\c:\llfxrrf.exec:\llfxrrf.exe119⤵PID:4832
-
\??\c:\nhtnnn.exec:\nhtnnn.exe120⤵PID:4560
-
\??\c:\flxrllx.exec:\flxrllx.exe121⤵PID:4576
-
\??\c:\hbhbhb.exec:\hbhbhb.exe122⤵PID:2128
-
\??\c:\nntttt.exec:\nntttt.exe123⤵PID:4244
-
\??\c:\vjjpd.exec:\vjjpd.exe124⤵PID:3236
-
\??\c:\5frrlrr.exec:\5frrlrr.exe125⤵PID:1816
-
\??\c:\hbtntt.exec:\hbtntt.exe126⤵PID:876
-
\??\c:\7hnnnn.exec:\7hnnnn.exe127⤵PID:2056
-
\??\c:\ddjjd.exec:\ddjjd.exe128⤵PID:3904
-
\??\c:\xrlffxr.exec:\xrlffxr.exe129⤵PID:4276
-
\??\c:\tbhhbt.exec:\tbhhbt.exe130⤵PID:744
-
\??\c:\jjvpp.exec:\jjvpp.exe131⤵PID:3116
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe132⤵PID:3572
-
\??\c:\ffxlffx.exec:\ffxlffx.exe133⤵PID:2252
-
\??\c:\hntnhb.exec:\hntnhb.exe134⤵PID:1144
-
\??\c:\jvddv.exec:\jvddv.exe135⤵PID:4664
-
\??\c:\fxrlffr.exec:\fxrlffr.exe136⤵PID:552
-
\??\c:\rxllffx.exec:\rxllffx.exe137⤵PID:4568
-
\??\c:\btnnnn.exec:\btnnnn.exe138⤵PID:2136
-
\??\c:\jvjdd.exec:\jvjdd.exe139⤵PID:2264
-
\??\c:\rxlflfx.exec:\rxlflfx.exe140⤵PID:4912
-
\??\c:\ntbtnt.exec:\ntbtnt.exe141⤵PID:3204
-
\??\c:\tnbttt.exec:\tnbttt.exe142⤵PID:2752
-
\??\c:\djvvp.exec:\djvvp.exe143⤵PID:3556
-
\??\c:\1frrlrl.exec:\1frrlrl.exe144⤵PID:1352
-
\??\c:\1pvpp.exec:\1pvpp.exe145⤵PID:4988
-
\??\c:\vppjd.exec:\vppjd.exe146⤵PID:4872
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe147⤵PID:4376
-
\??\c:\bnnhtt.exec:\bnnhtt.exe148⤵PID:4100
-
\??\c:\pjvdj.exec:\pjvdj.exe149⤵PID:4716
-
\??\c:\rlxrrrl.exec:\rlxrrrl.exe150⤵PID:4924
-
\??\c:\bnhbhn.exec:\bnhbhn.exe151⤵PID:1280
-
\??\c:\ppppp.exec:\ppppp.exe152⤵PID:1176
-
\??\c:\djpvp.exec:\djpvp.exe153⤵PID:3348
-
\??\c:\flxrfrl.exec:\flxrfrl.exe154⤵PID:2768
-
\??\c:\tbhthh.exec:\tbhthh.exe155⤵PID:4980
-
\??\c:\vvvpj.exec:\vvvpj.exe156⤵PID:3676
-
\??\c:\lffxrfr.exec:\lffxrfr.exe157⤵PID:4424
-
\??\c:\hbhbnh.exec:\hbhbnh.exe158⤵PID:4480
-
\??\c:\pdddv.exec:\pdddv.exe159⤵PID:5032
-
\??\c:\3rrlfxr.exec:\3rrlfxr.exe160⤵PID:3300
-
\??\c:\pddjj.exec:\pddjj.exe161⤵PID:4776
-
\??\c:\dpddv.exec:\dpddv.exe162⤵PID:4660
-
\??\c:\xxfxrrx.exec:\xxfxrrx.exe163⤵PID:5080
-
\??\c:\nhnhbb.exec:\nhnhbb.exe164⤵PID:4996
-
\??\c:\pjdjj.exec:\pjdjj.exe165⤵PID:3736
-
\??\c:\xxffllr.exec:\xxffllr.exe166⤵PID:2748
-
\??\c:\rrfffff.exec:\rrfffff.exe167⤵PID:4276
-
\??\c:\bbbtnh.exec:\bbbtnh.exe168⤵PID:660
-
\??\c:\jpdvj.exec:\jpdvj.exe169⤵PID:3464
-
\??\c:\lxlrrrl.exec:\lxlrrrl.exe170⤵PID:2252
-
\??\c:\ntbtbt.exec:\ntbtbt.exe171⤵PID:1144
-
\??\c:\vpvpv.exec:\vpvpv.exe172⤵PID:212
-
\??\c:\hhnnht.exec:\hhnnht.exe173⤵PID:1492
-
\??\c:\vdjvv.exec:\vdjvv.exe174⤵PID:2372
-
\??\c:\vvddv.exec:\vvddv.exe175⤵PID:3720
-
\??\c:\tnhttn.exec:\tnhttn.exe176⤵PID:1216
-
\??\c:\vvjjp.exec:\vvjjp.exe177⤵PID:3476
-
\??\c:\fflffrx.exec:\fflffrx.exe178⤵PID:5084
-
\??\c:\btnnbb.exec:\btnnbb.exe179⤵PID:3556
-
\??\c:\pdjjd.exec:\pdjjd.exe180⤵PID:2208
-
\??\c:\rrrlxrf.exec:\rrrlxrf.exe181⤵PID:2576
-
\??\c:\nntnhb.exec:\nntnhb.exe182⤵PID:3652
-
\??\c:\5pjdj.exec:\5pjdj.exe183⤵PID:1160
-
\??\c:\fxxffxr.exec:\fxxffxr.exe184⤵PID:3168
-
\??\c:\nthbbh.exec:\nthbbh.exe185⤵PID:3000
-
\??\c:\vjvdd.exec:\vjvdd.exe186⤵PID:3040
-
\??\c:\lfxrrrl.exec:\lfxrrrl.exe187⤵PID:2856
-
\??\c:\bbhhtt.exec:\bbhhtt.exe188⤵PID:1036
-
\??\c:\pdpvv.exec:\pdpvv.exe189⤵PID:784
-
\??\c:\vpjjp.exec:\vpjjp.exe190⤵PID:2328
-
\??\c:\xrfrllf.exec:\xrfrllf.exe191⤵PID:2768
-
\??\c:\thnnnh.exec:\thnnnh.exe192⤵PID:2560
-
\??\c:\7pdvj.exec:\7pdvj.exe193⤵PID:3676
-
\??\c:\rflfrrr.exec:\rflfrrr.exe194⤵PID:4984
-
\??\c:\rfrxrrr.exec:\rfrxrrr.exe195⤵PID:2128
-
\??\c:\hnhbtt.exec:\hnhbtt.exe196⤵PID:1560
-
\??\c:\dvpjd.exec:\dvpjd.exe197⤵PID:932
-
\??\c:\3rfxxxr.exec:\3rfxxxr.exe198⤵PID:876
-
\??\c:\tntttt.exec:\tntttt.exe199⤵PID:1080
-
\??\c:\dpdvd.exec:\dpdvd.exe200⤵PID:1460
-
\??\c:\rrxxflf.exec:\rrxxflf.exe201⤵PID:1692
-
\??\c:\bnnhtt.exec:\bnnhtt.exe202⤵PID:4792
-
\??\c:\jjjdv.exec:\jjjdv.exe203⤵PID:2376
-
\??\c:\3dppv.exec:\3dppv.exe204⤵PID:2012
-
\??\c:\lffxfff.exec:\lffxfff.exe205⤵PID:4452
-
\??\c:\1bnnnt.exec:\1bnnnt.exe206⤵PID:4064
-
\??\c:\pddvv.exec:\pddvv.exe207⤵PID:1564
-
\??\c:\xxfrflx.exec:\xxfrflx.exe208⤵PID:4796
-
\??\c:\9frllll.exec:\9frllll.exe209⤵PID:5024
-
\??\c:\bhnnnt.exec:\bhnnnt.exe210⤵PID:3588
-
\??\c:\jvppp.exec:\jvppp.exe211⤵PID:3140
-
\??\c:\fxxxxff.exec:\fxxxxff.exe212⤵PID:2836
-
\??\c:\hhhhnt.exec:\hhhhnt.exe213⤵PID:3492
-
\??\c:\3pdvd.exec:\3pdvd.exe214⤵PID:2752
-
\??\c:\lfxxfll.exec:\lfxxfll.exe215⤵PID:3984
-
\??\c:\htbhbb.exec:\htbhbb.exe216⤵PID:4880
-
\??\c:\1vvdd.exec:\1vvdd.exe217⤵PID:5052
-
\??\c:\fxrfxlf.exec:\fxrfxlf.exe218⤵PID:4988
-
\??\c:\3tbtnt.exec:\3tbtnt.exe219⤵PID:2952
-
\??\c:\jvjdd.exec:\jvjdd.exe220⤵PID:4620
-
\??\c:\ppdvp.exec:\ppdvp.exe221⤵PID:3060
-
\??\c:\llxrlfx.exec:\llxrlfx.exe222⤵PID:4924
-
\??\c:\bthbtt.exec:\bthbtt.exe223⤵PID:1280
-
\??\c:\vvvpp.exec:\vvvpp.exe224⤵PID:1176
-
\??\c:\rlxrrfx.exec:\rlxrrfx.exe225⤵PID:3348
-
\??\c:\ttttnn.exec:\ttttnn.exe226⤵PID:2788
-
\??\c:\nttnhb.exec:\nttnhb.exe227⤵PID:1420
-
\??\c:\7xlfrrr.exec:\7xlfrrr.exe228⤵PID:1960
-
\??\c:\thbttb.exec:\thbttb.exe229⤵PID:4204
-
\??\c:\jjvvp.exec:\jjvvp.exe230⤵PID:4536
-
\??\c:\rrrrfff.exec:\rrrrfff.exe231⤵PID:4424
-
\??\c:\5hthht.exec:\5hthht.exe232⤵PID:4252
-
\??\c:\7bbbnn.exec:\7bbbnn.exe233⤵PID:3248
-
\??\c:\1jvpp.exec:\1jvpp.exe234⤵PID:4220
-
\??\c:\lllrfrf.exec:\lllrfrf.exe235⤵PID:1136
-
\??\c:\tntnnn.exec:\tntnnn.exe236⤵PID:4148
-
\??\c:\jdpvp.exec:\jdpvp.exe237⤵PID:1956
-
\??\c:\3xfrxlr.exec:\3xfrxlr.exe238⤵PID:3300
-
\??\c:\1hhbbb.exec:\1hhbbb.exe239⤵PID:3736
-
\??\c:\jvdjj.exec:\jvdjj.exe240⤵PID:2748
-
\??\c:\xrrlllf.exec:\xrrlllf.exe241⤵PID:2384
-
\??\c:\tttnbb.exec:\tttnbb.exe242⤵PID:2376