Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 14:55
Behavioral task
behavioral1
Sample
dc0496679542939a7fc9583d4daa8400_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
dc0496679542939a7fc9583d4daa8400_NeikiAnalytics.exe
-
Size
483KB
-
MD5
dc0496679542939a7fc9583d4daa8400
-
SHA1
e39a40b58a3be8b7fd86d0dc786ceb555554fa48
-
SHA256
d80495709bae1b9732128146ec3e5d7f90f8f6edd42c162355b28d287316a4bf
-
SHA512
0c6db140ae3302b6719176fdd784c7c7b35d34261d70eafdbd43f0f94a13512e0c6ba5324fb0130b125531c8eb696f6df732fd2cda057edd244bd9756f818cf1
-
SSDEEP
6144:mcm7ImGddXv/VWrXD486jCpoAhlq1mEjBqLyOSlhNFF2t:I7TcfNWj168w1VjsyvhNFF2t
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2680-8-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4652-5-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2396-13-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4460-23-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4948-25-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3968-32-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2932-37-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1444-50-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2864-55-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4744-67-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/60-73-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3672-78-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2724-88-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4164-96-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1852-105-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/620-113-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1092-119-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/540-126-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2440-137-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2540-143-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4308-151-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1928-162-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2784-168-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2568-183-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3024-188-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/216-195-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/5116-199-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/404-201-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4340-207-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3740-227-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3368-236-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3676-240-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3088-247-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2244-251-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/456-259-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3160-269-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3492-273-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2372-288-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1564-292-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1316-299-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1172-324-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/960-329-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/216-339-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1588-352-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4888-365-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3200-375-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4664-385-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4504-392-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/620-430-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4052-437-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1012-447-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3816-460-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3024-467-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2548-480-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1524-495-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4668-511-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4668-515-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3004-525-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2396-612-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4776-668-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1092-684-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2236-836-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4348-861-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2540-1341-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\dpdvv.exe family_berbew C:\fxxxrrl.exe family_berbew C:\hbhtth.exe family_berbew C:\pjjdv.exe family_berbew C:\bhtnbb.exe family_berbew \??\c:\1jdpp.exe family_berbew C:\thnhbt.exe family_berbew \??\c:\5lfrlff.exe family_berbew C:\bttbtn.exe family_berbew C:\bnnttn.exe family_berbew \??\c:\flfxxfx.exe family_berbew \??\c:\hntnhh.exe family_berbew \??\c:\jdddv.exe family_berbew C:\xlxrxxl.exe family_berbew C:\ddjdp.exe family_berbew \??\c:\ttttnh.exe family_berbew C:\rxxrllf.exe family_berbew \??\c:\hnnnhh.exe family_berbew C:\lxlfxfx.exe family_berbew C:\1hbbtt.exe family_berbew \??\c:\hhnhbt.exe family_berbew C:\nnhhnn.exe family_berbew C:\lrxrffx.exe family_berbew C:\llrfxrl.exe family_berbew C:\hhnhbn.exe family_berbew C:\pppdv.exe family_berbew C:\3rrlllf.exe family_berbew C:\vpjdv.exe family_berbew C:\7lfxrrl.exe family_berbew \??\c:\lrxrllx.exe family_berbew C:\djvpd.exe family_berbew C:\dddpv.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
dpdvv.exefxxxrrl.exehbhtth.exepjjdv.exebhtnbb.exe1jdpp.exethnhbt.exe5lfrlff.exebttbtn.exebnnttn.exeflfxxfx.exehntnhh.exejdddv.exexlxrxxl.exeddjdp.exettttnh.exerxxrllf.exehnnnhh.exelxlfxfx.exe1hbbtt.exehhnhbt.exennhhnn.exelrxrffx.exellrfxrl.exehhnhbn.exepppdv.exe3rrlllf.exevpjdv.exe7lfxrrl.exelrxrllx.exedjvpd.exedddpv.exenbbhhn.exe7llxrrl.exe1htnhb.exe3ddvp.exexxrlffl.exexlllffx.exebtthbt.exeppjdp.exerrrlxlf.exenbbtnn.exe7jdvj.exelrrlffx.exe9hnbbt.exejjjjd.exe9xxlxrl.exenbbtnh.exejdpjd.exepjjjd.exe1xxfrlf.exettbbnn.exedjvpp.exefxlxrlx.exenbthnt.exerrfrrff.exe1hhbnn.exebnnbnt.exejjpdv.exefrxxlxf.exe3btntt.exevjdpd.exe3xxrrrl.exenhbnbt.exepid process 2680 dpdvv.exe 2396 fxxxrrl.exe 4460 hbhtth.exe 4948 pjjdv.exe 3968 bhtnbb.exe 2932 1jdpp.exe 4952 thnhbt.exe 1444 5lfrlff.exe 2864 bttbtn.exe 688 bnnttn.exe 4744 flfxxfx.exe 60 hntnhh.exe 3672 jdddv.exe 2724 xlxrxxl.exe 4164 ddjdp.exe 1384 ttttnh.exe 1852 rxxrllf.exe 620 hnnnhh.exe 1092 lxlfxfx.exe 540 1hbbtt.exe 2384 hhnhbt.exe 2440 nnhhnn.exe 2540 lrxrffx.exe 3756 llrfxrl.exe 4308 hhnhbn.exe 4764 pppdv.exe 1928 3rrlllf.exe 2784 vpjdv.exe 1468 7lfxrrl.exe 2568 lrxrllx.exe 3024 djvpd.exe 216 dddpv.exe 5116 nbbhhn.exe 404 7llxrrl.exe 4340 1htnhb.exe 1080 3ddvp.exe 1000 xxrlffl.exe 4868 xlllffx.exe 2476 btthbt.exe 1992 ppjdp.exe 1624 rrrlxlf.exe 3740 nbbtnn.exe 4544 7jdvj.exe 3368 lrrlffx.exe 3676 9hnbbt.exe 3504 jjjjd.exe 3088 9xxlxrl.exe 2244 nbbtnh.exe 324 jdpjd.exe 2720 pjjjd.exe 456 1xxfrlf.exe 3148 ttbbnn.exe 1824 djvpp.exe 3160 fxlxrlx.exe 3492 nbthnt.exe 376 rrfrrff.exe 4644 1hhbnn.exe 4380 bnnbnt.exe 2372 jjpdv.exe 1564 frxxlxf.exe 4260 3btntt.exe 1316 vjdpd.exe 1352 3xxrrrl.exe 5052 nhbnbt.exe -
Processes:
resource yara_rule behavioral2/memory/2680-8-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4652-5-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2396-13-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4460-23-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4948-25-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3968-32-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2932-37-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4952-43-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1444-50-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2864-55-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/688-61-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4744-67-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/60-73-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3672-78-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2724-88-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4164-91-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4164-96-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1852-105-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/620-109-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/620-113-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1092-119-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/540-126-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2440-137-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2540-143-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4308-151-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1928-162-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2784-168-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2568-178-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2568-183-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3024-188-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/216-191-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/216-195-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/5116-199-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/404-201-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4340-207-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3740-227-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3368-236-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3676-240-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3088-247-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2244-251-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/456-259-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3160-269-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3492-273-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2372-288-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1564-292-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1316-299-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1172-324-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/960-329-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4300-332-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/216-339-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1588-352-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4888-365-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3200-375-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4664-385-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4504-392-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1892-411-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1704-415-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3684-419-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3620-423-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/620-430-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4052-437-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1012-447-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3816-460-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3024-467-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
dc0496679542939a7fc9583d4daa8400_NeikiAnalytics.exedpdvv.exefxxxrrl.exehbhtth.exepjjdv.exebhtnbb.exe1jdpp.exethnhbt.exe5lfrlff.exebttbtn.exebnnttn.exeflfxxfx.exehntnhh.exejdddv.exexlxrxxl.exeddjdp.exettttnh.exerxxrllf.exehnnnhh.exelxlfxfx.exe1hbbtt.exehhnhbt.exedescription pid process target process PID 4652 wrote to memory of 2680 4652 dc0496679542939a7fc9583d4daa8400_NeikiAnalytics.exe dpdvv.exe PID 4652 wrote to memory of 2680 4652 dc0496679542939a7fc9583d4daa8400_NeikiAnalytics.exe dpdvv.exe PID 4652 wrote to memory of 2680 4652 dc0496679542939a7fc9583d4daa8400_NeikiAnalytics.exe dpdvv.exe PID 2680 wrote to memory of 2396 2680 dpdvv.exe fxxxrrl.exe PID 2680 wrote to memory of 2396 2680 dpdvv.exe fxxxrrl.exe PID 2680 wrote to memory of 2396 2680 dpdvv.exe fxxxrrl.exe PID 2396 wrote to memory of 4460 2396 fxxxrrl.exe hbhtth.exe PID 2396 wrote to memory of 4460 2396 fxxxrrl.exe hbhtth.exe PID 2396 wrote to memory of 4460 2396 fxxxrrl.exe hbhtth.exe PID 4460 wrote to memory of 4948 4460 hbhtth.exe pjjdv.exe PID 4460 wrote to memory of 4948 4460 hbhtth.exe pjjdv.exe PID 4460 wrote to memory of 4948 4460 hbhtth.exe pjjdv.exe PID 4948 wrote to memory of 3968 4948 pjjdv.exe bhtnbb.exe PID 4948 wrote to memory of 3968 4948 pjjdv.exe bhtnbb.exe PID 4948 wrote to memory of 3968 4948 pjjdv.exe bhtnbb.exe PID 3968 wrote to memory of 2932 3968 bhtnbb.exe 1jdpp.exe PID 3968 wrote to memory of 2932 3968 bhtnbb.exe 1jdpp.exe PID 3968 wrote to memory of 2932 3968 bhtnbb.exe 1jdpp.exe PID 2932 wrote to memory of 4952 2932 1jdpp.exe thnhbt.exe PID 2932 wrote to memory of 4952 2932 1jdpp.exe thnhbt.exe PID 2932 wrote to memory of 4952 2932 1jdpp.exe thnhbt.exe PID 4952 wrote to memory of 1444 4952 thnhbt.exe 5lfrlff.exe PID 4952 wrote to memory of 1444 4952 thnhbt.exe 5lfrlff.exe PID 4952 wrote to memory of 1444 4952 thnhbt.exe 5lfrlff.exe PID 1444 wrote to memory of 2864 1444 5lfrlff.exe bttbtn.exe PID 1444 wrote to memory of 2864 1444 5lfrlff.exe bttbtn.exe PID 1444 wrote to memory of 2864 1444 5lfrlff.exe bttbtn.exe PID 2864 wrote to memory of 688 2864 bttbtn.exe bnnttn.exe PID 2864 wrote to memory of 688 2864 bttbtn.exe bnnttn.exe PID 2864 wrote to memory of 688 2864 bttbtn.exe bnnttn.exe PID 688 wrote to memory of 4744 688 bnnttn.exe flfxxfx.exe PID 688 wrote to memory of 4744 688 bnnttn.exe flfxxfx.exe PID 688 wrote to memory of 4744 688 bnnttn.exe flfxxfx.exe PID 4744 wrote to memory of 60 4744 flfxxfx.exe hntnhh.exe PID 4744 wrote to memory of 60 4744 flfxxfx.exe hntnhh.exe PID 4744 wrote to memory of 60 4744 flfxxfx.exe hntnhh.exe PID 60 wrote to memory of 3672 60 hntnhh.exe jdddv.exe PID 60 wrote to memory of 3672 60 hntnhh.exe jdddv.exe PID 60 wrote to memory of 3672 60 hntnhh.exe jdddv.exe PID 3672 wrote to memory of 2724 3672 jdddv.exe xlxrxxl.exe PID 3672 wrote to memory of 2724 3672 jdddv.exe xlxrxxl.exe PID 3672 wrote to memory of 2724 3672 jdddv.exe xlxrxxl.exe PID 2724 wrote to memory of 4164 2724 xlxrxxl.exe ddjdp.exe PID 2724 wrote to memory of 4164 2724 xlxrxxl.exe ddjdp.exe PID 2724 wrote to memory of 4164 2724 xlxrxxl.exe ddjdp.exe PID 4164 wrote to memory of 1384 4164 ddjdp.exe ttttnh.exe PID 4164 wrote to memory of 1384 4164 ddjdp.exe ttttnh.exe PID 4164 wrote to memory of 1384 4164 ddjdp.exe ttttnh.exe PID 1384 wrote to memory of 1852 1384 ttttnh.exe rxxrllf.exe PID 1384 wrote to memory of 1852 1384 ttttnh.exe rxxrllf.exe PID 1384 wrote to memory of 1852 1384 ttttnh.exe rxxrllf.exe PID 1852 wrote to memory of 620 1852 rxxrllf.exe hnnnhh.exe PID 1852 wrote to memory of 620 1852 rxxrllf.exe hnnnhh.exe PID 1852 wrote to memory of 620 1852 rxxrllf.exe hnnnhh.exe PID 620 wrote to memory of 1092 620 hnnnhh.exe lxlfxfx.exe PID 620 wrote to memory of 1092 620 hnnnhh.exe lxlfxfx.exe PID 620 wrote to memory of 1092 620 hnnnhh.exe lxlfxfx.exe PID 1092 wrote to memory of 540 1092 lxlfxfx.exe 1hbbtt.exe PID 1092 wrote to memory of 540 1092 lxlfxfx.exe 1hbbtt.exe PID 1092 wrote to memory of 540 1092 lxlfxfx.exe 1hbbtt.exe PID 540 wrote to memory of 2384 540 1hbbtt.exe hhnhbt.exe PID 540 wrote to memory of 2384 540 1hbbtt.exe hhnhbt.exe PID 540 wrote to memory of 2384 540 1hbbtt.exe hhnhbt.exe PID 2384 wrote to memory of 2440 2384 hhnhbt.exe nnhhnn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc0496679542939a7fc9583d4daa8400_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\dc0496679542939a7fc9583d4daa8400_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\dpdvv.exec:\dpdvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\fxxxrrl.exec:\fxxxrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\hbhtth.exec:\hbhtth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\pjjdv.exec:\pjjdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\bhtnbb.exec:\bhtnbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\1jdpp.exec:\1jdpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\thnhbt.exec:\thnhbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\5lfrlff.exec:\5lfrlff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\bttbtn.exec:\bttbtn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\bnnttn.exec:\bnnttn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
\??\c:\flfxxfx.exec:\flfxxfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\hntnhh.exec:\hntnhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\jdddv.exec:\jdddv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\xlxrxxl.exec:\xlxrxxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\ddjdp.exec:\ddjdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
\??\c:\ttttnh.exec:\ttttnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\rxxrllf.exec:\rxxrllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\hnnnhh.exec:\hnnnhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
\??\c:\lxlfxfx.exec:\lxlfxfx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\1hbbtt.exec:\1hbbtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\hhnhbt.exec:\hhnhbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\nnhhnn.exec:\nnhhnn.exe23⤵
- Executes dropped EXE
PID:2440 -
\??\c:\lrxrffx.exec:\lrxrffx.exe24⤵
- Executes dropped EXE
PID:2540 -
\??\c:\llrfxrl.exec:\llrfxrl.exe25⤵
- Executes dropped EXE
PID:3756 -
\??\c:\hhnhbn.exec:\hhnhbn.exe26⤵
- Executes dropped EXE
PID:4308 -
\??\c:\pppdv.exec:\pppdv.exe27⤵
- Executes dropped EXE
PID:4764 -
\??\c:\3rrlllf.exec:\3rrlllf.exe28⤵
- Executes dropped EXE
PID:1928 -
\??\c:\vpjdv.exec:\vpjdv.exe29⤵
- Executes dropped EXE
PID:2784 -
\??\c:\7lfxrrl.exec:\7lfxrrl.exe30⤵
- Executes dropped EXE
PID:1468 -
\??\c:\lrxrllx.exec:\lrxrllx.exe31⤵
- Executes dropped EXE
PID:2568 -
\??\c:\djvpd.exec:\djvpd.exe32⤵
- Executes dropped EXE
PID:3024 -
\??\c:\dddpv.exec:\dddpv.exe33⤵
- Executes dropped EXE
PID:216 -
\??\c:\nbbhhn.exec:\nbbhhn.exe34⤵
- Executes dropped EXE
PID:5116 -
\??\c:\7llxrrl.exec:\7llxrrl.exe35⤵
- Executes dropped EXE
PID:404 -
\??\c:\1htnhb.exec:\1htnhb.exe36⤵
- Executes dropped EXE
PID:4340 -
\??\c:\3ddvp.exec:\3ddvp.exe37⤵
- Executes dropped EXE
PID:1080 -
\??\c:\xxrlffl.exec:\xxrlffl.exe38⤵
- Executes dropped EXE
PID:1000 -
\??\c:\xlllffx.exec:\xlllffx.exe39⤵
- Executes dropped EXE
PID:4868 -
\??\c:\btthbt.exec:\btthbt.exe40⤵
- Executes dropped EXE
PID:2476 -
\??\c:\ppjdp.exec:\ppjdp.exe41⤵
- Executes dropped EXE
PID:1992 -
\??\c:\rrrlxlf.exec:\rrrlxlf.exe42⤵
- Executes dropped EXE
PID:1624 -
\??\c:\nbbtnn.exec:\nbbtnn.exe43⤵
- Executes dropped EXE
PID:3740 -
\??\c:\7jdvj.exec:\7jdvj.exe44⤵
- Executes dropped EXE
PID:4544 -
\??\c:\lrrlffx.exec:\lrrlffx.exe45⤵
- Executes dropped EXE
PID:3368 -
\??\c:\9hnbbt.exec:\9hnbbt.exe46⤵
- Executes dropped EXE
PID:3676 -
\??\c:\jjjjd.exec:\jjjjd.exe47⤵
- Executes dropped EXE
PID:3504 -
\??\c:\9xxlxrl.exec:\9xxlxrl.exe48⤵
- Executes dropped EXE
PID:3088 -
\??\c:\nbbtnh.exec:\nbbtnh.exe49⤵
- Executes dropped EXE
PID:2244 -
\??\c:\jdpjd.exec:\jdpjd.exe50⤵
- Executes dropped EXE
PID:324 -
\??\c:\pjjjd.exec:\pjjjd.exe51⤵
- Executes dropped EXE
PID:2720 -
\??\c:\1xxfrlf.exec:\1xxfrlf.exe52⤵
- Executes dropped EXE
PID:456 -
\??\c:\ttbbnn.exec:\ttbbnn.exe53⤵
- Executes dropped EXE
PID:3148 -
\??\c:\djvpp.exec:\djvpp.exe54⤵
- Executes dropped EXE
PID:1824 -
\??\c:\fxlxrlx.exec:\fxlxrlx.exe55⤵
- Executes dropped EXE
PID:3160 -
\??\c:\nbthnt.exec:\nbthnt.exe56⤵
- Executes dropped EXE
PID:3492 -
\??\c:\rrfrrff.exec:\rrfrrff.exe57⤵
- Executes dropped EXE
PID:376 -
\??\c:\1hhbnn.exec:\1hhbnn.exe58⤵
- Executes dropped EXE
PID:4644 -
\??\c:\bnnbnt.exec:\bnnbnt.exe59⤵
- Executes dropped EXE
PID:4380 -
\??\c:\jjpdv.exec:\jjpdv.exe60⤵
- Executes dropped EXE
PID:2372 -
\??\c:\frxxlxf.exec:\frxxlxf.exe61⤵
- Executes dropped EXE
PID:1564 -
\??\c:\3btntt.exec:\3btntt.exe62⤵
- Executes dropped EXE
PID:4260 -
\??\c:\vjdpd.exec:\vjdpd.exe63⤵
- Executes dropped EXE
PID:1316 -
\??\c:\3xxrrrl.exec:\3xxrrrl.exe64⤵
- Executes dropped EXE
PID:1352 -
\??\c:\nhbnbt.exec:\nhbnbt.exe65⤵
- Executes dropped EXE
PID:5052 -
\??\c:\xlxrllr.exec:\xlxrllr.exe66⤵PID:3440
-
\??\c:\nhbtnh.exec:\nhbtnh.exe67⤵PID:1012
-
\??\c:\vppvp.exec:\vppvp.exe68⤵PID:3532
-
\??\c:\5rfxrrf.exec:\5rfxrrf.exe69⤵PID:4972
-
\??\c:\rlflxlf.exec:\rlflxlf.exe70⤵PID:4384
-
\??\c:\thnhhb.exec:\thnhhb.exe71⤵PID:64
-
\??\c:\jpvpj.exec:\jpvpj.exe72⤵PID:1172
-
\??\c:\3vpvv.exec:\3vpvv.exe73⤵PID:960
-
\??\c:\fflfxxr.exec:\fflfxxr.exe74⤵PID:4300
-
\??\c:\ttbttb.exec:\ttbttb.exe75⤵PID:216
-
\??\c:\3jjdp.exec:\3jjdp.exe76⤵PID:4216
-
\??\c:\1xlxfxx.exec:\1xlxfxx.exe77⤵PID:4336
-
\??\c:\httnhh.exec:\httnhh.exe78⤵PID:1808
-
\??\c:\ttnhhb.exec:\ttnhhb.exe79⤵PID:1588
-
\??\c:\5vpjd.exec:\5vpjd.exe80⤵PID:996
-
\??\c:\fxrlffx.exec:\fxrlffx.exe81⤵PID:3596
-
\??\c:\nbhnhb.exec:\nbhnhb.exe82⤵PID:1052
-
\??\c:\jpdvp.exec:\jpdvp.exe83⤵PID:4888
-
\??\c:\xxxfxxr.exec:\xxxfxxr.exe84⤵PID:812
-
\??\c:\xlxfxfx.exec:\xlxfxfx.exe85⤵PID:808
-
\??\c:\bhbbhn.exec:\bhbbhn.exe86⤵PID:3200
-
\??\c:\dpdpj.exec:\dpdpj.exe87⤵PID:2956
-
\??\c:\fffxrxr.exec:\fffxrxr.exe88⤵PID:5004
-
\??\c:\thnhhh.exec:\thnhhh.exe89⤵PID:4664
-
\??\c:\nbhbhb.exec:\nbhbhb.exe90⤵PID:4656
-
\??\c:\vpvvv.exec:\vpvvv.exe91⤵PID:4504
-
\??\c:\lxlrrlr.exec:\lxlrrlr.exe92⤵PID:688
-
\??\c:\7hbtnn.exec:\7hbtnn.exe93⤵PID:1224
-
\??\c:\jpjjv.exec:\jpjjv.exe94⤵PID:456
-
\??\c:\1pdvv.exec:\1pdvv.exe95⤵PID:2340
-
\??\c:\llrlfxr.exec:\llrlfxr.exe96⤵PID:3564
-
\??\c:\nttnhh.exec:\nttnhh.exe97⤵PID:4776
-
\??\c:\vvdpj.exec:\vvdpj.exe98⤵PID:1892
-
\??\c:\rxfxrlf.exec:\rxfxrlf.exe99⤵PID:1704
-
\??\c:\thttnt.exec:\thttnt.exe100⤵PID:3684
-
\??\c:\ttnhbb.exec:\ttnhbb.exe101⤵PID:3620
-
\??\c:\9ddpj.exec:\9ddpj.exe102⤵PID:620
-
\??\c:\fllxrlf.exec:\fllxrlf.exe103⤵PID:4260
-
\??\c:\ntbtnh.exec:\ntbtnh.exe104⤵PID:4052
-
\??\c:\ddpjp.exec:\ddpjp.exe105⤵PID:1276
-
\??\c:\fxrxlfl.exec:\fxrxlfl.exe106⤵PID:3440
-
\??\c:\xflfxrr.exec:\xflfxrr.exe107⤵PID:1012
-
\??\c:\hnttbb.exec:\hnttbb.exe108⤵PID:1932
-
\??\c:\dvvpd.exec:\dvvpd.exe109⤵PID:5072
-
\??\c:\1xrlxxr.exec:\1xrlxxr.exe110⤵PID:3156
-
\??\c:\hnbhhn.exec:\hnbhhn.exe111⤵PID:4268
-
\??\c:\ddddv.exec:\ddddv.exe112⤵PID:3816
-
\??\c:\vpddv.exec:\vpddv.exe113⤵PID:3024
-
\??\c:\btbtnb.exec:\btbtnb.exe114⤵PID:4540
-
\??\c:\jvppj.exec:\jvppj.exe115⤵PID:5116
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe116⤵PID:4320
-
\??\c:\bttnnn.exec:\bttnnn.exe117⤵PID:2548
-
\??\c:\ntntnh.exec:\ntntnh.exe118⤵PID:2396
-
\??\c:\pvdvp.exec:\pvdvp.exe119⤵PID:4460
-
\??\c:\rxrxlfl.exec:\rxrxlfl.exe120⤵PID:1284
-
\??\c:\hnthbn.exec:\hnthbn.exe121⤵PID:4888
-
\??\c:\ddjdv.exec:\ddjdv.exe122⤵PID:1524
-
\??\c:\vppjj.exec:\vppjj.exe123⤵PID:2968
-
\??\c:\xflfxxl.exec:\xflfxxl.exe124⤵PID:4676
-
\??\c:\ttnbbn.exec:\ttnbbn.exe125⤵PID:2956
-
\??\c:\ppvpd.exec:\ppvpd.exe126⤵PID:5004
-
\??\c:\frrlxlf.exec:\frrlxlf.exe127⤵PID:4668
-
\??\c:\hhtthn.exec:\hhtthn.exe128⤵PID:3696
-
\??\c:\3ntnhh.exec:\3ntnhh.exe129⤵PID:5068
-
\??\c:\7vjdv.exec:\7vjdv.exe130⤵PID:3392
-
\??\c:\lflrlrr.exec:\lflrlrr.exe131⤵PID:3004
-
\??\c:\tttnbt.exec:\tttnbt.exe132⤵PID:3672
-
\??\c:\9tnbnn.exec:\9tnbnn.exe133⤵PID:2196
-
\??\c:\dpppj.exec:\dpppj.exe134⤵PID:3904
-
\??\c:\fxrlxrl.exec:\fxrlxrl.exe135⤵PID:4776
-
\??\c:\9hhhbt.exec:\9hhhbt.exe136⤵PID:700
-
\??\c:\dpppj.exec:\dpppj.exe137⤵PID:4580
-
\??\c:\jjppj.exec:\jjppj.exe138⤵PID:4660
-
\??\c:\xrrfrrl.exec:\xrrfrrl.exe139⤵PID:3700
-
\??\c:\bbhhhh.exec:\bbhhhh.exe140⤵PID:1092
-
\??\c:\pvjvv.exec:\pvjvv.exe141⤵PID:4056
-
\??\c:\jppjd.exec:\jppjd.exe142⤵PID:5052
-
\??\c:\lxrlxxr.exec:\lxrlxxr.exe143⤵PID:1912
-
\??\c:\bbttnn.exec:\bbttnn.exe144⤵PID:4452
-
\??\c:\vpjjj.exec:\vpjjj.exe145⤵PID:4076
-
\??\c:\rffxxrr.exec:\rffxxrr.exe146⤵PID:3532
-
\??\c:\fffxxrr.exec:\fffxxrr.exe147⤵PID:2156
-
\??\c:\3bhbtt.exec:\3bhbtt.exe148⤵PID:860
-
\??\c:\vvvvv.exec:\vvvvv.exe149⤵PID:3156
-
\??\c:\xrfxfxf.exec:\xrfxfxf.exe150⤵PID:4268
-
\??\c:\xxlfllx.exec:\xxlfllx.exe151⤵PID:2836
-
\??\c:\bthbtt.exec:\bthbtt.exe152⤵PID:3172
-
\??\c:\pvdvp.exec:\pvdvp.exe153⤵PID:1336
-
\??\c:\pjdjp.exec:\pjdjp.exe154⤵PID:4320
-
\??\c:\nhnhbb.exec:\nhnhbb.exe155⤵PID:4884
-
\??\c:\vpppj.exec:\vpppj.exe156⤵PID:2228
-
\??\c:\vjpjp.exec:\vjpjp.exe157⤵PID:3992
-
\??\c:\7lxrlxr.exec:\7lxrlxr.exe158⤵PID:2396
-
\??\c:\9hhbtt.exec:\9hhbtt.exe159⤵PID:4244
-
\??\c:\dvppv.exec:\dvppv.exe160⤵PID:3740
-
\??\c:\djvpj.exec:\djvpj.exe161⤵PID:4544
-
\??\c:\fxfxrll.exec:\fxfxrll.exe162⤵PID:2932
-
\??\c:\nhnnnn.exec:\nhnnnn.exe163⤵PID:4636
-
\??\c:\vpdvp.exec:\vpdvp.exe164⤵PID:4952
-
\??\c:\lffxxxx.exec:\lffxxxx.exe165⤵PID:2552
-
\??\c:\hhbbnn.exec:\hhbbnn.exe166⤵PID:4680
-
\??\c:\5httbb.exec:\5httbb.exe167⤵PID:3548
-
\??\c:\ppvpj.exec:\ppvpj.exe168⤵PID:2244
-
\??\c:\9rrxrff.exec:\9rrxrff.exe169⤵PID:4028
-
\??\c:\bttnhh.exec:\bttnhh.exe170⤵PID:688
-
\??\c:\1djdv.exec:\1djdv.exe171⤵PID:5080
-
\??\c:\flrfrlf.exec:\flrfrlf.exe172⤵PID:3944
-
\??\c:\5ttnhh.exec:\5ttnhh.exe173⤵PID:2340
-
\??\c:\bbbhbt.exec:\bbbhbt.exe174⤵PID:3672
-
\??\c:\dvjdv.exec:\dvjdv.exe175⤵PID:2196
-
\??\c:\fxlxxrx.exec:\fxlxxrx.exe176⤵PID:3904
-
\??\c:\tnnbbt.exec:\tnnbbt.exe177⤵PID:4776
-
\??\c:\vjjpp.exec:\vjjpp.exe178⤵PID:1704
-
\??\c:\rlrrrll.exec:\rlrrrll.exe179⤵PID:1724
-
\??\c:\nbnnhn.exec:\nbnnhn.exe180⤵PID:1388
-
\??\c:\thtntt.exec:\thtntt.exe181⤵PID:4960
-
\??\c:\ppjjv.exec:\ppjjv.exe182⤵PID:1092
-
\??\c:\xxlxxrx.exec:\xxlxxrx.exe183⤵PID:4056
-
\??\c:\nnnhbb.exec:\nnnhbb.exe184⤵PID:772
-
\??\c:\1nhhbt.exec:\1nhhbt.exe185⤵PID:4136
-
\??\c:\vjppj.exec:\vjppj.exe186⤵PID:2536
-
\??\c:\fxfxrxr.exec:\fxfxrxr.exe187⤵PID:1260
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe188⤵PID:1476
-
\??\c:\tbttnb.exec:\tbttnb.exe189⤵PID:3624
-
\??\c:\dppdd.exec:\dppdd.exe190⤵PID:1012
-
\??\c:\5llxrrl.exec:\5llxrrl.exe191⤵PID:2320
-
\??\c:\5btnhh.exec:\5btnhh.exe192⤵PID:3428
-
\??\c:\jppjj.exec:\jppjj.exe193⤵PID:2024
-
\??\c:\3vdpv.exec:\3vdpv.exe194⤵PID:1944
-
\??\c:\rxxxrrr.exec:\rxxxrrr.exe195⤵PID:1696
-
\??\c:\3tbtnn.exec:\3tbtnn.exe196⤵PID:4300
-
\??\c:\vvjdv.exec:\vvjdv.exe197⤵PID:4820
-
\??\c:\7rrffxr.exec:\7rrffxr.exe198⤵PID:2388
-
\??\c:\nhtnhb.exec:\nhtnhb.exe199⤵PID:1336
-
\??\c:\hbbbtt.exec:\hbbbtt.exe200⤵PID:1568
-
\??\c:\pdpjj.exec:\pdpjj.exe201⤵PID:768
-
\??\c:\pddvp.exec:\pddvp.exe202⤵PID:4868
-
\??\c:\rxxrfff.exec:\rxxrfff.exe203⤵PID:696
-
\??\c:\btthbt.exec:\btthbt.exe204⤵PID:4460
-
\??\c:\ddjpp.exec:\ddjpp.exe205⤵PID:4604
-
\??\c:\vppjd.exec:\vppjd.exe206⤵PID:4888
-
\??\c:\1bbtnn.exec:\1bbtnn.exe207⤵PID:1292
-
\??\c:\tnthnn.exec:\tnthnn.exe208⤵PID:3524
-
\??\c:\jdpjp.exec:\jdpjp.exe209⤵PID:3112
-
\??\c:\xlxllfl.exec:\xlxllfl.exe210⤵PID:3516
-
\??\c:\hbttnh.exec:\hbttnh.exe211⤵PID:2052
-
\??\c:\nhtntt.exec:\nhtntt.exe212⤵PID:1636
-
\??\c:\pdpjj.exec:\pdpjj.exe213⤵PID:1176
-
\??\c:\7xlfrlf.exec:\7xlfrlf.exe214⤵PID:4504
-
\??\c:\btbbhb.exec:\btbbhb.exe215⤵PID:3044
-
\??\c:\tnnhbt.exec:\tnnhbt.exe216⤵PID:3412
-
\??\c:\vppdv.exec:\vppdv.exe217⤵PID:1224
-
\??\c:\fllrlrl.exec:\fllrlrl.exe218⤵PID:1804
-
\??\c:\nbnhhh.exec:\nbnhhh.exe219⤵PID:3460
-
\??\c:\pdvvp.exec:\pdvvp.exe220⤵PID:4644
-
\??\c:\dpvvp.exec:\dpvvp.exe221⤵PID:4832
-
\??\c:\xrfxfff.exec:\xrfxfff.exe222⤵PID:1892
-
\??\c:\btbbbb.exec:\btbbbb.exe223⤵PID:1852
-
\??\c:\9pjjv.exec:\9pjjv.exe224⤵PID:2544
-
\??\c:\lxxxlff.exec:\lxxxlff.exe225⤵PID:4660
-
\??\c:\lfrflff.exec:\lfrflff.exe226⤵PID:1720
-
\??\c:\thnnnn.exec:\thnnnn.exe227⤵PID:4272
-
\??\c:\dvvvp.exec:\dvvvp.exe228⤵PID:1092
-
\??\c:\vjjdv.exec:\vjjdv.exe229⤵PID:4056
-
\??\c:\rxfxffx.exec:\rxfxffx.exe230⤵PID:2236
-
\??\c:\nhnhbb.exec:\nhnhbb.exe231⤵PID:920
-
\??\c:\vvjdd.exec:\vvjdd.exe232⤵PID:1444
-
\??\c:\xfrxxxr.exec:\xfrxxxr.exe233⤵PID:4452
-
\??\c:\bbttnn.exec:\bbttnn.exe234⤵PID:3208
-
\??\c:\nnthhb.exec:\nnthhb.exe235⤵PID:4620
-
\??\c:\dppjj.exec:\dppjj.exe236⤵PID:4384
-
\??\c:\3ffxlfx.exec:\3ffxlfx.exe237⤵PID:2484
-
\??\c:\bttnbb.exec:\bttnbb.exe238⤵PID:5088
-
\??\c:\jdjjv.exec:\jdjjv.exe239⤵PID:4348
-
\??\c:\7pvdd.exec:\7pvdd.exe240⤵PID:3124
-
\??\c:\7lrllrr.exec:\7lrllrr.exe241⤵PID:4512
-
\??\c:\nhtnnn.exec:\nhtnnn.exe242⤵PID:540