Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 01:08
Behavioral task
behavioral1
Sample
3dec43c7be61490b7de0f0039ee57d70_NeikiAnalytics.exe
Resource
win7-20240220-en
General
-
Target
3dec43c7be61490b7de0f0039ee57d70_NeikiAnalytics.exe
-
Size
464KB
-
MD5
3dec43c7be61490b7de0f0039ee57d70
-
SHA1
3598d955d6aab03de714a078da703fdf7a1b067c
-
SHA256
1f0ee41fb65b04cd416b7e06c781a80e7194055829d284f4d80718c8264fcdac
-
SHA512
5fc7e21de1027cadcf3282b14a3d51af0a8ddc0ed6e86350a8eb3e5c0f9050b648e60533afda4804ba795d41512f518553adfc924e7eb058376638baedad2b45
-
SSDEEP
12288:J4wFHoSTeR0oQRkay+eFp3IDvSbh5nPVP+OKaf1Vq:VeR0oykayRFp3lztP+OKaf1Vq
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1652-6-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1400-9-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/452-14-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/384-24-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4344-32-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4528-31-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2984-37-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1152-46-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4488-55-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4824-61-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4176-67-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2684-73-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3944-76-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1616-85-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1768-93-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2396-81-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4588-104-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3020-114-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4852-129-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1608-136-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4888-149-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2632-162-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3236-160-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3996-169-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3472-179-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2068-189-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2084-188-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2972-199-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1324-207-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2576-220-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3140-233-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2532-237-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4784-241-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4568-254-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3596-265-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/5100-271-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4948-278-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4560-280-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1944-286-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3628-313-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1612-320-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2524-327-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3280-340-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2856-344-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3792-348-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4884-355-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4456-366-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2576-381-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4556-388-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1152-407-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1544-435-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1480-445-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/764-462-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2572-472-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/896-488-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1380-501-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1944-593-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3628-618-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4904-628-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1736-677-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1532-726-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3244-1132-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2144-1223-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2976-1307-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule behavioral2/memory/1652-0-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\pvvvp.exe family_berbew behavioral2/memory/1652-6-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/1400-9-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\xrfxxll.exe family_berbew C:\1tnhhn.exe family_berbew behavioral2/memory/452-14-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/384-24-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\9hnntt.exe family_berbew behavioral2/memory/4528-25-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4344-32-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4528-31-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2984-37-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\xrfflll.exe family_berbew \??\c:\hbttnn.exe family_berbew behavioral2/memory/1152-46-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\ppjpj.exe family_berbew \??\c:\1djjj.exe family_berbew C:\rrxrlff.exe family_berbew behavioral2/memory/4488-55-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\rfrrllf.exe family_berbew behavioral2/memory/4824-61-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\5tnbbn.exe family_berbew behavioral2/memory/4176-67-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\nntnbt.exe family_berbew behavioral2/memory/2684-73-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/3944-76-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\nnthbh.exe family_berbew behavioral2/memory/1616-85-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\flfxxxx.exe family_berbew behavioral2/memory/1768-93-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4588-97-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\7hnnhh.exe family_berbew C:\xxllfff.exe family_berbew behavioral2/memory/2396-81-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\rrrrffr.exe family_berbew behavioral2/memory/4588-104-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\frxrrll.exe family_berbew C:\7bbbbn.exe family_berbew behavioral2/memory/3020-114-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\tntnhb.exe family_berbew C:\lxxrlfx.exe family_berbew C:\bnhbtt.exe family_berbew behavioral2/memory/1608-132-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4852-129-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/1608-136-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\thbbtb.exe family_berbew C:\frlxrff.exe family_berbew C:\tttnnn.exe family_berbew behavioral2/memory/4888-149-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\jvvvv.exe family_berbew C:\thnnhb.exe family_berbew behavioral2/memory/2632-162-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\vvvpj.exe family_berbew behavioral2/memory/3236-160-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\pjdvd.exe family_berbew behavioral2/memory/3996-169-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\hntnbt.exe family_berbew behavioral2/memory/3472-179-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\jdpvj.exe family_berbew C:\jvdpj.exe family_berbew behavioral2/memory/2068-189-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2084-188-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2972-199-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
Processes:
pvvvp.exexrfxxll.exe1tnhhn.exe9hnntt.exe1djjj.exeppjpj.exexrfflll.exehbttnn.exerrxrlff.exerfrrllf.exe5tnbbn.exenntnbt.exerrrrffr.exennthbh.exeflfxxxx.exe7hnnhh.exexxllfff.exefrxrrll.exe7bbbbn.exetntnhb.exelxxrlfx.exebnhbtt.exethbbtb.exefrlxrff.exetttnnn.exejvvvv.exethnnhb.exevvvpj.exepjdvd.exehntnbt.exejdpvj.exejvdpj.exejjjpd.exenbnhtt.exepvpvj.exebthnnt.exefrllxff.exebtbbbb.exelxrxxff.exehbttnt.exerxxrfff.exevjjjj.exejdvpj.exexflxrrl.exethnttn.exeppvvp.exexrffxxr.exe9pvvj.exelfxlffx.exehtnhbb.exevvjdd.exefflfxxl.exennnttt.exe5vvvp.exevpvpj.exexrxxlxr.exejjdvp.exejdjdj.exe3ffrfxf.exethbbtt.exedpjdv.exellxrrrl.exethhbtt.exebbttnn.exepid process 1400 pvvvp.exe 452 xrfxxll.exe 384 1tnhhn.exe 4528 9hnntt.exe 4344 1djjj.exe 2984 ppjpj.exe 1152 xrfflll.exe 4488 hbttnn.exe 4824 rrxrlff.exe 4176 rfrrllf.exe 2684 5tnbbn.exe 3944 nntnbt.exe 2396 rrrrffr.exe 1616 nnthbh.exe 1768 flfxxxx.exe 4588 7hnnhh.exe 2680 xxllfff.exe 3020 frxrrll.exe 644 7bbbbn.exe 1304 tntnhb.exe 4852 lxxrlfx.exe 1608 bnhbtt.exe 2004 thbbtb.exe 4888 frlxrff.exe 3620 tttnnn.exe 2632 jvvvv.exe 3236 thnnhb.exe 3996 vvvpj.exe 2664 pjdvd.exe 3472 hntnbt.exe 2084 jdpvj.exe 2068 jvdpj.exe 4380 jjjpd.exe 2972 nbnhtt.exe 1060 pvpvj.exe 1324 bthnnt.exe 4412 frllxff.exe 2584 btbbbb.exe 1052 lxrxxff.exe 2576 hbttnt.exe 2832 rxxrfff.exe 4556 vjjjj.exe 4848 jdvpj.exe 3140 xflxrrl.exe 2532 thnttn.exe 4784 ppvvp.exe 2308 xrffxxr.exe 2360 9pvvj.exe 468 lfxlffx.exe 4568 htnhbb.exe 4488 vvjdd.exe 2432 fflfxxl.exe 4652 nnnttt.exe 3596 5vvvp.exe 5100 vpvpj.exe 5104 xrxxlxr.exe 4948 jjdvp.exe 4560 jdjdj.exe 4216 3ffrfxf.exe 1944 thbbtt.exe 3764 dpjdv.exe 768 llxrrrl.exe 1272 thhbtt.exe 2464 bbttnn.exe -
Processes:
resource yara_rule behavioral2/memory/1652-0-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\pvvvp.exe upx behavioral2/memory/1652-6-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/1400-9-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\xrfxxll.exe upx C:\1tnhhn.exe upx behavioral2/memory/452-14-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/384-24-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\9hnntt.exe upx behavioral2/memory/4528-25-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4344-32-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4528-31-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2984-37-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\xrfflll.exe upx \??\c:\hbttnn.exe upx behavioral2/memory/1152-46-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\ppjpj.exe upx \??\c:\1djjj.exe upx C:\rrxrlff.exe upx behavioral2/memory/4488-55-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\rfrrllf.exe upx behavioral2/memory/4824-61-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\5tnbbn.exe upx behavioral2/memory/4176-67-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\nntnbt.exe upx behavioral2/memory/2684-73-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/3944-76-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\nnthbh.exe upx behavioral2/memory/1616-85-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\flfxxxx.exe upx behavioral2/memory/1768-93-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4588-97-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\7hnnhh.exe upx C:\xxllfff.exe upx behavioral2/memory/2396-81-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\rrrrffr.exe upx behavioral2/memory/4588-104-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\frxrrll.exe upx C:\7bbbbn.exe upx behavioral2/memory/3020-114-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\tntnhb.exe upx C:\lxxrlfx.exe upx C:\bnhbtt.exe upx behavioral2/memory/1608-132-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4852-129-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/1608-136-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\thbbtb.exe upx C:\frlxrff.exe upx C:\tttnnn.exe upx behavioral2/memory/4888-149-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\jvvvv.exe upx C:\thnnhb.exe upx behavioral2/memory/2632-162-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\vvvpj.exe upx behavioral2/memory/3236-160-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\pjdvd.exe upx behavioral2/memory/3996-169-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\hntnbt.exe upx behavioral2/memory/3472-179-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\jdpvj.exe upx C:\jvdpj.exe upx behavioral2/memory/2068-189-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2084-188-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2972-199-0x0000000000400000-0x000000000043A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3dec43c7be61490b7de0f0039ee57d70_NeikiAnalytics.exepvvvp.exexrfxxll.exe1tnhhn.exe9hnntt.exe1djjj.exeppjpj.exexrfflll.exehbttnn.exerrxrlff.exerfrrllf.exe5tnbbn.exenntnbt.exerrrrffr.exennthbh.exeflfxxxx.exe7hnnhh.exexxllfff.exefrxrrll.exe7bbbbn.exetntnhb.exelxxrlfx.exedescription pid process target process PID 1652 wrote to memory of 1400 1652 3dec43c7be61490b7de0f0039ee57d70_NeikiAnalytics.exe pvvvp.exe PID 1652 wrote to memory of 1400 1652 3dec43c7be61490b7de0f0039ee57d70_NeikiAnalytics.exe pvvvp.exe PID 1652 wrote to memory of 1400 1652 3dec43c7be61490b7de0f0039ee57d70_NeikiAnalytics.exe pvvvp.exe PID 1400 wrote to memory of 452 1400 pvvvp.exe xrfxxll.exe PID 1400 wrote to memory of 452 1400 pvvvp.exe xrfxxll.exe PID 1400 wrote to memory of 452 1400 pvvvp.exe xrfxxll.exe PID 452 wrote to memory of 384 452 xrfxxll.exe 1tnhhn.exe PID 452 wrote to memory of 384 452 xrfxxll.exe 1tnhhn.exe PID 452 wrote to memory of 384 452 xrfxxll.exe 1tnhhn.exe PID 384 wrote to memory of 4528 384 1tnhhn.exe 9hnntt.exe PID 384 wrote to memory of 4528 384 1tnhhn.exe 9hnntt.exe PID 384 wrote to memory of 4528 384 1tnhhn.exe 9hnntt.exe PID 4528 wrote to memory of 4344 4528 9hnntt.exe 1djjj.exe PID 4528 wrote to memory of 4344 4528 9hnntt.exe 1djjj.exe PID 4528 wrote to memory of 4344 4528 9hnntt.exe 1djjj.exe PID 4344 wrote to memory of 2984 4344 1djjj.exe ppjpj.exe PID 4344 wrote to memory of 2984 4344 1djjj.exe ppjpj.exe PID 4344 wrote to memory of 2984 4344 1djjj.exe ppjpj.exe PID 2984 wrote to memory of 1152 2984 ppjpj.exe xrfflll.exe PID 2984 wrote to memory of 1152 2984 ppjpj.exe xrfflll.exe PID 2984 wrote to memory of 1152 2984 ppjpj.exe xrfflll.exe PID 1152 wrote to memory of 4488 1152 xrfflll.exe hbttnn.exe PID 1152 wrote to memory of 4488 1152 xrfflll.exe hbttnn.exe PID 1152 wrote to memory of 4488 1152 xrfflll.exe hbttnn.exe PID 4488 wrote to memory of 4824 4488 hbttnn.exe rrxrlff.exe PID 4488 wrote to memory of 4824 4488 hbttnn.exe rrxrlff.exe PID 4488 wrote to memory of 4824 4488 hbttnn.exe rrxrlff.exe PID 4824 wrote to memory of 4176 4824 rrxrlff.exe rfrrllf.exe PID 4824 wrote to memory of 4176 4824 rrxrlff.exe rfrrllf.exe PID 4824 wrote to memory of 4176 4824 rrxrlff.exe rfrrllf.exe PID 4176 wrote to memory of 2684 4176 rfrrllf.exe 5tnbbn.exe PID 4176 wrote to memory of 2684 4176 rfrrllf.exe 5tnbbn.exe PID 4176 wrote to memory of 2684 4176 rfrrllf.exe 5tnbbn.exe PID 2684 wrote to memory of 3944 2684 5tnbbn.exe nntnbt.exe PID 2684 wrote to memory of 3944 2684 5tnbbn.exe nntnbt.exe PID 2684 wrote to memory of 3944 2684 5tnbbn.exe nntnbt.exe PID 3944 wrote to memory of 2396 3944 nntnbt.exe rrrrffr.exe PID 3944 wrote to memory of 2396 3944 nntnbt.exe rrrrffr.exe PID 3944 wrote to memory of 2396 3944 nntnbt.exe rrrrffr.exe PID 2396 wrote to memory of 1616 2396 rrrrffr.exe nnthbh.exe PID 2396 wrote to memory of 1616 2396 rrrrffr.exe nnthbh.exe PID 2396 wrote to memory of 1616 2396 rrrrffr.exe nnthbh.exe PID 1616 wrote to memory of 1768 1616 nnthbh.exe flfxxxx.exe PID 1616 wrote to memory of 1768 1616 nnthbh.exe flfxxxx.exe PID 1616 wrote to memory of 1768 1616 nnthbh.exe flfxxxx.exe PID 1768 wrote to memory of 4588 1768 flfxxxx.exe 7hnnhh.exe PID 1768 wrote to memory of 4588 1768 flfxxxx.exe 7hnnhh.exe PID 1768 wrote to memory of 4588 1768 flfxxxx.exe 7hnnhh.exe PID 4588 wrote to memory of 2680 4588 7hnnhh.exe xxllfff.exe PID 4588 wrote to memory of 2680 4588 7hnnhh.exe xxllfff.exe PID 4588 wrote to memory of 2680 4588 7hnnhh.exe xxllfff.exe PID 2680 wrote to memory of 3020 2680 xxllfff.exe frxrrll.exe PID 2680 wrote to memory of 3020 2680 xxllfff.exe frxrrll.exe PID 2680 wrote to memory of 3020 2680 xxllfff.exe frxrrll.exe PID 3020 wrote to memory of 644 3020 frxrrll.exe 7bbbbn.exe PID 3020 wrote to memory of 644 3020 frxrrll.exe 7bbbbn.exe PID 3020 wrote to memory of 644 3020 frxrrll.exe 7bbbbn.exe PID 644 wrote to memory of 1304 644 7bbbbn.exe tntnhb.exe PID 644 wrote to memory of 1304 644 7bbbbn.exe tntnhb.exe PID 644 wrote to memory of 1304 644 7bbbbn.exe tntnhb.exe PID 1304 wrote to memory of 4852 1304 tntnhb.exe lxxrlfx.exe PID 1304 wrote to memory of 4852 1304 tntnhb.exe lxxrlfx.exe PID 1304 wrote to memory of 4852 1304 tntnhb.exe lxxrlfx.exe PID 4852 wrote to memory of 1608 4852 lxxrlfx.exe bnhbtt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3dec43c7be61490b7de0f0039ee57d70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3dec43c7be61490b7de0f0039ee57d70_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\pvvvp.exec:\pvvvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\xrfxxll.exec:\xrfxxll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\1tnhhn.exec:\1tnhhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\9hnntt.exec:\9hnntt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\1djjj.exec:\1djjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\ppjpj.exec:\ppjpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\xrfflll.exec:\xrfflll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\hbttnn.exec:\hbttnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\rrxrlff.exec:\rrxrlff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\rfrrllf.exec:\rfrrllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
\??\c:\5tnbbn.exec:\5tnbbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\nntnbt.exec:\nntnbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\rrrrffr.exec:\rrrrffr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\nnthbh.exec:\nnthbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\flfxxxx.exec:\flfxxxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\7hnnhh.exec:\7hnnhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\xxllfff.exec:\xxllfff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\frxrrll.exec:\frxrrll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\7bbbbn.exec:\7bbbbn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\tntnhb.exec:\tntnhb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\lxxrlfx.exec:\lxxrlfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\bnhbtt.exec:\bnhbtt.exe23⤵
- Executes dropped EXE
PID:1608 -
\??\c:\thbbtb.exec:\thbbtb.exe24⤵
- Executes dropped EXE
PID:2004 -
\??\c:\frlxrff.exec:\frlxrff.exe25⤵
- Executes dropped EXE
PID:4888 -
\??\c:\tttnnn.exec:\tttnnn.exe26⤵
- Executes dropped EXE
PID:3620 -
\??\c:\jvvvv.exec:\jvvvv.exe27⤵
- Executes dropped EXE
PID:2632 -
\??\c:\thnnhb.exec:\thnnhb.exe28⤵
- Executes dropped EXE
PID:3236 -
\??\c:\vvvpj.exec:\vvvpj.exe29⤵
- Executes dropped EXE
PID:3996 -
\??\c:\pjdvd.exec:\pjdvd.exe30⤵
- Executes dropped EXE
PID:2664 -
\??\c:\hntnbt.exec:\hntnbt.exe31⤵
- Executes dropped EXE
PID:3472 -
\??\c:\jdpvj.exec:\jdpvj.exe32⤵
- Executes dropped EXE
PID:2084 -
\??\c:\jvdpj.exec:\jvdpj.exe33⤵
- Executes dropped EXE
PID:2068 -
\??\c:\jjjpd.exec:\jjjpd.exe34⤵
- Executes dropped EXE
PID:4380 -
\??\c:\nbnhtt.exec:\nbnhtt.exe35⤵
- Executes dropped EXE
PID:2972 -
\??\c:\pvpvj.exec:\pvpvj.exe36⤵
- Executes dropped EXE
PID:1060 -
\??\c:\bthnnt.exec:\bthnnt.exe37⤵
- Executes dropped EXE
PID:1324 -
\??\c:\frllxff.exec:\frllxff.exe38⤵
- Executes dropped EXE
PID:4412 -
\??\c:\btbbbb.exec:\btbbbb.exe39⤵
- Executes dropped EXE
PID:2584 -
\??\c:\lxrxxff.exec:\lxrxxff.exe40⤵
- Executes dropped EXE
PID:1052 -
\??\c:\hbttnt.exec:\hbttnt.exe41⤵
- Executes dropped EXE
PID:2576 -
\??\c:\rxxrfff.exec:\rxxrfff.exe42⤵
- Executes dropped EXE
PID:2832 -
\??\c:\vjjjj.exec:\vjjjj.exe43⤵
- Executes dropped EXE
PID:4556 -
\??\c:\jdvpj.exec:\jdvpj.exe44⤵
- Executes dropped EXE
PID:4848 -
\??\c:\xflxrrl.exec:\xflxrrl.exe45⤵
- Executes dropped EXE
PID:3140 -
\??\c:\thnttn.exec:\thnttn.exe46⤵
- Executes dropped EXE
PID:2532 -
\??\c:\ppvvp.exec:\ppvvp.exe47⤵
- Executes dropped EXE
PID:4784 -
\??\c:\xrffxxr.exec:\xrffxxr.exe48⤵
- Executes dropped EXE
PID:2308 -
\??\c:\9pvvj.exec:\9pvvj.exe49⤵
- Executes dropped EXE
PID:2360 -
\??\c:\lfxlffx.exec:\lfxlffx.exe50⤵
- Executes dropped EXE
PID:468 -
\??\c:\htnhbb.exec:\htnhbb.exe51⤵
- Executes dropped EXE
PID:4568 -
\??\c:\vvjdd.exec:\vvjdd.exe52⤵
- Executes dropped EXE
PID:4488 -
\??\c:\fflfxxl.exec:\fflfxxl.exe53⤵
- Executes dropped EXE
PID:2432 -
\??\c:\nnnttt.exec:\nnnttt.exe54⤵
- Executes dropped EXE
PID:4652 -
\??\c:\5vvvp.exec:\5vvvp.exe55⤵
- Executes dropped EXE
PID:3596 -
\??\c:\vpvpj.exec:\vpvpj.exe56⤵
- Executes dropped EXE
PID:5100 -
\??\c:\xrxxlxr.exec:\xrxxlxr.exe57⤵
- Executes dropped EXE
PID:5104 -
\??\c:\jjdvp.exec:\jjdvp.exe58⤵
- Executes dropped EXE
PID:4948 -
\??\c:\jdjdj.exec:\jdjdj.exe59⤵
- Executes dropped EXE
PID:4560 -
\??\c:\3ffrfxf.exec:\3ffrfxf.exe60⤵
- Executes dropped EXE
PID:4216 -
\??\c:\thbbtt.exec:\thbbtt.exe61⤵
- Executes dropped EXE
PID:1944 -
\??\c:\dpjdv.exec:\dpjdv.exe62⤵
- Executes dropped EXE
PID:3764 -
\??\c:\llxrrrl.exec:\llxrrrl.exe63⤵
- Executes dropped EXE
PID:768 -
\??\c:\thhbtt.exec:\thhbtt.exe64⤵
- Executes dropped EXE
PID:1272 -
\??\c:\bbttnn.exec:\bbttnn.exe65⤵
- Executes dropped EXE
PID:2464 -
\??\c:\pjppj.exec:\pjppj.exe66⤵PID:4192
-
\??\c:\llxfllx.exec:\llxfllx.exe67⤵PID:1680
-
\??\c:\bnhttt.exec:\bnhttt.exe68⤵PID:3628
-
\??\c:\pjpjj.exec:\pjpjj.exe69⤵PID:3624
-
\??\c:\bbtttt.exec:\bbtttt.exe70⤵PID:2952
-
\??\c:\dvppj.exec:\dvppj.exe71⤵PID:1612
-
\??\c:\xlxrlfx.exec:\xlxrlfx.exe72⤵PID:4048
-
\??\c:\btbbtt.exec:\btbbtt.exe73⤵PID:2524
-
\??\c:\djddj.exec:\djddj.exe74⤵PID:2956
-
\??\c:\djjjd.exec:\djjjd.exe75⤵PID:1380
-
\??\c:\rfxxlxl.exec:\rfxxlxl.exe76⤵PID:3280
-
\??\c:\hnttnn.exec:\hnttnn.exe77⤵PID:2856
-
\??\c:\ppdpd.exec:\ppdpd.exe78⤵PID:3792
-
\??\c:\xxrfflf.exec:\xxrfflf.exe79⤵PID:2944
-
\??\c:\thbnnb.exec:\thbnnb.exe80⤵PID:4884
-
\??\c:\dpjdd.exec:\dpjdd.exe81⤵PID:3492
-
\??\c:\rfrrffx.exec:\rfrrffx.exe82⤵PID:208
-
\??\c:\7flfxxx.exec:\7flfxxx.exe83⤵PID:1060
-
\??\c:\btnhbb.exec:\btnhbb.exe84⤵PID:4456
-
\??\c:\ppdpv.exec:\ppdpv.exe85⤵PID:4412
-
\??\c:\xxffxxx.exec:\xxffxxx.exe86⤵PID:668
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe87⤵PID:1052
-
\??\c:\hthhbh.exec:\hthhbh.exe88⤵PID:2576
-
\??\c:\dddvd.exec:\dddvd.exe89⤵PID:2304
-
\??\c:\flfxrrr.exec:\flfxrrr.exe90⤵PID:4556
-
\??\c:\thhbhh.exec:\thhbhh.exe91⤵PID:4848
-
\??\c:\pjjdv.exec:\pjjdv.exe92⤵PID:4544
-
\??\c:\xrlfxxf.exec:\xrlfxxf.exe93⤵PID:3632
-
\??\c:\tttnnh.exec:\tttnnh.exe94⤵PID:4604
-
\??\c:\jvvpj.exec:\jvvpj.exe95⤵PID:2532
-
\??\c:\jdjdv.exec:\jdjdv.exe96⤵PID:1152
-
\??\c:\llffllf.exec:\llffllf.exe97⤵PID:1700
-
\??\c:\nnnnbn.exec:\nnnnbn.exe98⤵PID:376
-
\??\c:\jpvdp.exec:\jpvdp.exe99⤵PID:3048
-
\??\c:\xxxxrrr.exec:\xxxxrrr.exe100⤵PID:5052
-
\??\c:\nttnhh.exec:\nttnhh.exe101⤵PID:2540
-
\??\c:\jjppj.exec:\jjppj.exe102⤵PID:2644
-
\??\c:\rfffflf.exec:\rfffflf.exe103⤵PID:2408
-
\??\c:\tbbbtn.exec:\tbbbtn.exe104⤵PID:4188
-
\??\c:\bthhbb.exec:\bthhbb.exe105⤵PID:1544
-
\??\c:\vjvvv.exec:\vjvvv.exe106⤵PID:3332
-
\??\c:\nbhbhh.exec:\nbhbhh.exe107⤵PID:4776
-
\??\c:\ppdvd.exec:\ppdvd.exe108⤵PID:1480
-
\??\c:\fffxxxr.exec:\fffxxxr.exe109⤵PID:1432
-
\??\c:\7nhhhh.exec:\7nhhhh.exe110⤵PID:1376
-
\??\c:\jvjjj.exec:\jvjjj.exe111⤵PID:1832
-
\??\c:\3rrrflf.exec:\3rrrflf.exe112⤵PID:4068
-
\??\c:\tnhbnb.exec:\tnhbnb.exe113⤵PID:4136
-
\??\c:\pjvpj.exec:\pjvpj.exe114⤵PID:764
-
\??\c:\3llfflf.exec:\3llfflf.exe115⤵PID:1644
-
\??\c:\hthbtb.exec:\hthbtb.exe116⤵PID:2572
-
\??\c:\ppjpj.exec:\ppjpj.exe117⤵PID:2004
-
\??\c:\llxrrrx.exec:\llxrrrx.exe118⤵PID:4868
-
\??\c:\bbhbnt.exec:\bbhbnt.exe119⤵PID:3624
-
\??\c:\vjdjd.exec:\vjdjd.exe120⤵PID:2952
-
\??\c:\xlrlffx.exec:\xlrlffx.exe121⤵PID:896
-
\??\c:\bbhbhh.exec:\bbhbhh.exe122⤵PID:960
-
\??\c:\djpjj.exec:\djpjj.exe123⤵PID:1792
-
\??\c:\fllxrrl.exec:\fllxrrl.exe124⤵PID:2956
-
\??\c:\fxxxxff.exec:\fxxxxff.exe125⤵PID:1380
-
\??\c:\ppvvd.exec:\ppvvd.exe126⤵PID:400
-
\??\c:\jjjdv.exec:\jjjdv.exe127⤵PID:2084
-
\??\c:\lxxrllf.exec:\lxxrllf.exe128⤵PID:1620
-
\??\c:\nhhbtt.exec:\nhhbtt.exe129⤵PID:2528
-
\??\c:\7jppd.exec:\7jppd.exe130⤵PID:4396
-
\??\c:\9xrrrrr.exec:\9xrrrrr.exe131⤵PID:4412
-
\??\c:\jvdvp.exec:\jvdvp.exe132⤵PID:2720
-
\??\c:\3ppjd.exec:\3ppjd.exe133⤵PID:3840
-
\??\c:\flfffff.exec:\flfffff.exe134⤵PID:384
-
\??\c:\nbthbn.exec:\nbthbn.exe135⤵PID:4124
-
\??\c:\lxffxxx.exec:\lxffxxx.exe136⤵PID:1736
-
\??\c:\3nnbbh.exec:\3nnbbh.exe137⤵PID:4388
-
\??\c:\djjjv.exec:\djjjv.exe138⤵PID:4860
-
\??\c:\flxxxxf.exec:\flxxxxf.exe139⤵PID:544
-
\??\c:\thtnnb.exec:\thtnnb.exe140⤵PID:5028
-
\??\c:\hntnnn.exec:\hntnnn.exe141⤵PID:2188
-
\??\c:\vpppp.exec:\vpppp.exe142⤵PID:3300
-
\??\c:\rlxxflr.exec:\rlxxflr.exe143⤵PID:1700
-
\??\c:\nthhnt.exec:\nthhnt.exe144⤵PID:376
-
\??\c:\vpjvp.exec:\vpjvp.exe145⤵PID:2628
-
\??\c:\xlrrlll.exec:\xlrrlll.exe146⤵PID:5052
-
\??\c:\tnbhnt.exec:\tnbhnt.exe147⤵PID:2016
-
\??\c:\ddvvv.exec:\ddvvv.exe148⤵PID:3464
-
\??\c:\hthbtt.exec:\hthbtt.exe149⤵PID:2420
-
\??\c:\pjjjj.exec:\pjjjj.exe150⤵PID:4188
-
\??\c:\llrrffl.exec:\llrrffl.exe151⤵PID:1544
-
\??\c:\ntbttn.exec:\ntbttn.exe152⤵PID:3332
-
\??\c:\jjvpp.exec:\jjvpp.exe153⤵PID:2288
-
\??\c:\lxrlflx.exec:\lxrlflx.exe154⤵PID:1452
-
\??\c:\nnbhbh.exec:\nnbhbh.exe155⤵PID:3020
-
\??\c:\dvvvv.exec:\dvvvv.exe156⤵PID:1944
-
\??\c:\xrlrllx.exec:\xrlrllx.exe157⤵PID:1832
-
\??\c:\nnbbth.exec:\nnbbth.exe158⤵PID:1428
-
\??\c:\ppjpv.exec:\ppjpv.exe159⤵PID:4136
-
\??\c:\jjdvp.exec:\jjdvp.exe160⤵PID:784
-
\??\c:\lfrrlll.exec:\lfrrlll.exe161⤵PID:1656
-
\??\c:\bbtbhn.exec:\bbtbhn.exe162⤵PID:2812
-
\??\c:\jdddd.exec:\jdddd.exe163⤵PID:3628
-
\??\c:\vjpjj.exec:\vjpjj.exe164⤵PID:2816
-
\??\c:\hhnnhn.exec:\hhnnhn.exe165⤵PID:1708
-
\??\c:\ttbttt.exec:\ttbttt.exe166⤵PID:4952
-
\??\c:\ppvpj.exec:\ppvpj.exe167⤵PID:4904
-
\??\c:\xxlffxl.exec:\xxlffxl.exe168⤵PID:3008
-
\??\c:\bhbtnn.exec:\bhbtnn.exe169⤵PID:748
-
\??\c:\vpvvv.exec:\vpvvv.exe170⤵PID:3576
-
\??\c:\flllllr.exec:\flllllr.exe171⤵PID:4508
-
\??\c:\nbhhhh.exec:\nbhhhh.exe172⤵PID:2856
-
\??\c:\pdpjd.exec:\pdpjd.exe173⤵PID:2964
-
\??\c:\xlxrrrr.exec:\xlxrrrr.exe174⤵PID:4580
-
\??\c:\7rlfrxl.exec:\7rlfrxl.exe175⤵PID:1324
-
\??\c:\htbnnn.exec:\htbnnn.exe176⤵PID:2584
-
\??\c:\dpdvp.exec:\dpdvp.exe177⤵PID:3908
-
\??\c:\fxffxfx.exec:\fxffxfx.exe178⤵PID:1328
-
\??\c:\xlrrllr.exec:\xlrrllr.exe179⤵PID:2832
-
\??\c:\dpjdv.exec:\dpjdv.exe180⤵PID:464
-
\??\c:\vjvpp.exec:\vjvpp.exe181⤵PID:4528
-
\??\c:\hbnhbb.exec:\hbnhbb.exe182⤵PID:4344
-
\??\c:\dvjjd.exec:\dvjjd.exe183⤵PID:1736
-
\??\c:\djpjp.exec:\djpjp.exe184⤵PID:4548
-
\??\c:\1xxrrxx.exec:\1xxrrxx.exe185⤵PID:2000
-
\??\c:\httttt.exec:\httttt.exe186⤵PID:204
-
\??\c:\lrfrlff.exec:\lrfrlff.exe187⤵PID:4964
-
\??\c:\rfxrxfl.exec:\rfxrxfl.exe188⤵PID:1972
-
\??\c:\bntttt.exec:\bntttt.exe189⤵PID:4664
-
\??\c:\vjdvp.exec:\vjdvp.exe190⤵PID:3372
-
\??\c:\nbtnnb.exec:\nbtnnb.exe191⤵PID:376
-
\??\c:\bbbbhb.exec:\bbbbhb.exe192⤵PID:2628
-
\??\c:\lrrrlll.exec:\lrrrlll.exe193⤵PID:5052
-
\??\c:\htnnnb.exec:\htnnnb.exe194⤵PID:2408
-
\??\c:\djvdd.exec:\djvdd.exe195⤵PID:3464
-
\??\c:\lfrrxrl.exec:\lfrrxrl.exe196⤵PID:2420
-
\??\c:\bbthbt.exec:\bbthbt.exe197⤵PID:4188
-
\??\c:\ddvvp.exec:\ddvvp.exe198⤵PID:4776
-
\??\c:\rlxrlfl.exec:\rlxrlfl.exe199⤵PID:1532
-
\??\c:\hbhnth.exec:\hbhnth.exe200⤵PID:4628
-
\??\c:\1jpjj.exec:\1jpjj.exe201⤵PID:4032
-
\??\c:\lxffxxf.exec:\lxffxxf.exe202⤵PID:1832
-
\??\c:\ddppv.exec:\ddppv.exe203⤵PID:4764
-
\??\c:\rxllrrl.exec:\rxllrrl.exe204⤵PID:4192
-
\??\c:\thnhbt.exec:\thnhbt.exe205⤵PID:1200
-
\??\c:\pvdvv.exec:\pvdvv.exe206⤵PID:2660
-
\??\c:\xxxxffx.exec:\xxxxffx.exe207⤵PID:5080
-
\??\c:\tttnhh.exec:\tttnhh.exe208⤵PID:4868
-
\??\c:\bbbttn.exec:\bbbttn.exe209⤵PID:3624
-
\??\c:\ddppv.exec:\ddppv.exe210⤵PID:3264
-
\??\c:\rlrlfrr.exec:\rlrlfrr.exe211⤵PID:4368
-
\??\c:\pvdjd.exec:\pvdjd.exe212⤵PID:2108
-
\??\c:\3frlrrr.exec:\3frlrrr.exe213⤵PID:3240
-
\??\c:\bbttnh.exec:\bbttnh.exe214⤵PID:2956
-
\??\c:\pdppd.exec:\pdppd.exe215⤵PID:3812
-
\??\c:\frffxxx.exec:\frffxxx.exe216⤵PID:3880
-
\??\c:\tnbtnh.exec:\tnbtnh.exe217⤵PID:3472
-
\??\c:\pdjpp.exec:\pdjpp.exe218⤵PID:2068
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe219⤵PID:2964
-
\??\c:\1ntnnh.exec:\1ntnnh.exe220⤵PID:1400
-
\??\c:\jvvvv.exec:\jvvvv.exe221⤵PID:2144
-
\??\c:\ppddj.exec:\ppddj.exe222⤵PID:4748
-
\??\c:\bthhtt.exec:\bthhtt.exe223⤵PID:3152
-
\??\c:\bnbbbb.exec:\bnbbbb.exe224⤵PID:2720
-
\??\c:\vvvpp.exec:\vvvpp.exe225⤵PID:3840
-
\??\c:\xxffffl.exec:\xxffffl.exe226⤵PID:1932
-
\??\c:\bnbnnh.exec:\bnbnnh.exe227⤵PID:1100
-
\??\c:\pjdvp.exec:\pjdvp.exe228⤵PID:2732
-
\??\c:\1rxrlrr.exec:\1rxrlrr.exe229⤵PID:1132
-
\??\c:\bnbbbh.exec:\bnbbbh.exe230⤵PID:4900
-
\??\c:\jdddd.exec:\jdddd.exe231⤵PID:4908
-
\??\c:\lrlxrxx.exec:\lrlxrxx.exe232⤵PID:3988
-
\??\c:\bbnntt.exec:\bbnntt.exe233⤵PID:4964
-
\??\c:\djvpp.exec:\djvpp.exe234⤵PID:1972
-
\??\c:\llxlxlr.exec:\llxlxlr.exe235⤵PID:4664
-
\??\c:\hbtbhn.exec:\hbtbhn.exe236⤵PID:4832
-
\??\c:\ppddj.exec:\ppddj.exe237⤵PID:2644
-
\??\c:\pdjjv.exec:\pdjjv.exe238⤵PID:5008
-
\??\c:\1bnbhh.exec:\1bnbhh.exe239⤵PID:5092
-
\??\c:\jvjjd.exec:\jvjjd.exe240⤵PID:2408
-
\??\c:\frrxlfr.exec:\frrxlfr.exe241⤵PID:3244
-
\??\c:\htbbnn.exec:\htbbnn.exe242⤵PID:1544