Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 22:47
Behavioral task
behavioral1
Sample
18855293234f53a80b04137a8f718a00_NeikiAnalytics.exe
Resource
win7-20231129-en
General
-
Target
18855293234f53a80b04137a8f718a00_NeikiAnalytics.exe
-
Size
464KB
-
MD5
18855293234f53a80b04137a8f718a00
-
SHA1
7c725e943e212d10cbdd7385cf66aa052464590b
-
SHA256
0612ff8fafb85d0bbe5d51d7d0c00328b2de525286e24862d66a52c32c081e40
-
SHA512
0bab206bf02f1518a1902add4bb7126d9c2ada5aff6fcb939ea5d76ec394e84ac7f49c064b4cc625f823c5b6f3e6ca472d5bbb0135f191a16dd0550e2ac62706
-
SSDEEP
12288:J4wFHoSTeR0oQRkay+eFp3IDvSbh5nPVP+OKaf1Vw:VeR0oykayRFp3lztP+OKaf1Vw
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4280-4-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2696-13-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4804-11-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4244-24-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2420-27-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3920-37-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4920-47-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4912-48-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4824-54-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4824-60-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4012-62-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2240-70-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2144-77-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3004-79-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2192-89-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2712-96-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4776-107-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2248-102-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1812-131-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1736-128-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2948-141-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4292-163-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2352-167-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1684-175-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3748-185-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3328-222-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3344-229-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1292-252-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2900-261-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4768-271-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1068-275-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2860-276-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3252-212-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2244-205-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3416-199-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2128-142-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1232-118-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1084-285-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4344-305-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/932-312-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4968-316-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3352-327-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1732-331-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2420-350-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4956-363-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1852-367-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1512-377-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4596-382-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3700-386-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3276-398-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4796-417-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1068-424-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1736-437-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2976-457-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3252-500-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2124-504-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2860-548-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1800-564-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1780-664-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4828-710-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/640-714-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2444-785-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1152-1137-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/540-1203-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule behavioral2/memory/4280-0-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\pdvdj.exe family_berbew behavioral2/memory/4280-4-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4804-6-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\lfrlfxx.exe family_berbew behavioral2/memory/2696-13-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4804-11-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\lrrlffx.exe family_berbew C:\ppjvj.exe family_berbew behavioral2/memory/4244-24-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2420-27-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\3pdvp.exe family_berbew C:\rrlfxxx.exe family_berbew behavioral2/memory/3920-37-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\btbbtt.exe family_berbew C:\rrlrrrl.exe family_berbew behavioral2/memory/4920-47-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4912-48-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\lfrlrlx.exe family_berbew behavioral2/memory/4824-54-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\nbbtnn.exe family_berbew behavioral2/memory/4824-60-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4012-62-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\jdpjj.exe family_berbew \??\c:\9hnbnb.exe family_berbew behavioral2/memory/2240-70-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2144-77-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\llxlxxx.exe family_berbew behavioral2/memory/3004-79-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\hhhtnh.exe family_berbew C:\dvvpj.exe family_berbew behavioral2/memory/2192-89-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\rrlxlxf.exe family_berbew behavioral2/memory/2712-96-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4776-107-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\hhtnhb.exe family_berbew behavioral2/memory/2248-102-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\btbntn.exe family_berbew \??\c:\jvppp.exe family_berbew \??\c:\frlfrxx.exe family_berbew \??\c:\ppjpj.exe family_berbew C:\frrlflf.exe family_berbew behavioral2/memory/1812-131-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\nbhbbt.exe family_berbew behavioral2/memory/1736-128-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2948-141-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\hhhbhn.exe family_berbew C:\jpvpj.exe family_berbew behavioral2/memory/4292-163-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\9lfxrll.exe family_berbew behavioral2/memory/2352-167-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\nhhhbb.exe family_berbew C:\pppjj.exe family_berbew behavioral2/memory/1684-175-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\nnthnt.exe family_berbew behavioral2/memory/3748-185-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/3328-222-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/3344-229-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/1292-252-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2900-261-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4784-239-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4768-271-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/1068-275-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2860-276-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
Processes:
pdvdj.exelfrlfxx.exelrrlffx.exeppjvj.exe3pdvp.exerrlfxxx.exebtbbtt.exerrlrrrl.exelfrlrlx.exenbbtnn.exejdpjj.exe9hnbnb.exellxlxxx.exehhhtnh.exedvvpj.exerrlxlxf.exebtbntn.exehhtnhb.exejvppp.exefrlfrxx.exeppjpj.exefrrlflf.exenbhbbt.exejvdjp.exexffxrrl.exelfxlxll.exehhhbhn.exejpvpj.exe9lfxrll.exenhhhbb.exepppjj.exennthnt.exevpppd.exellfffrf.exetbnbnh.exevvjpj.exeffrfxxx.exehhtnnh.exejdvdj.exerxxrllr.exehbnhnb.exepdpdj.exejddjp.exerxrrlrr.exebtnhbt.exe1hbtnh.exe7pjdd.exelxxrrll.exenhbtnh.exedppjd.exe1xrfxlf.exexrrfxxr.exethhnhh.exejdjdv.exerxllfxr.exexllffff.exebnhbbn.exepdddv.exefxxrxlf.exethtnnt.exevdvdp.exelxxrlff.exetbbnhb.exevjdvp.exepid process 4804 pdvdj.exe 2696 lfrlfxx.exe 4244 lrrlffx.exe 2420 ppjvj.exe 3272 3pdvp.exe 3920 rrlfxxx.exe 4920 btbbtt.exe 4912 rrlrrrl.exe 4824 lfrlrlx.exe 4012 nbbtnn.exe 2240 jdpjj.exe 2144 9hnbnb.exe 3004 llxlxxx.exe 4624 hhhtnh.exe 2192 dvvpj.exe 2712 rrlxlxf.exe 2248 btbntn.exe 4776 hhtnhb.exe 4636 jvppp.exe 1232 frlfrxx.exe 1812 ppjpj.exe 1736 frrlflf.exe 2948 nbhbbt.exe 2128 jvdjp.exe 1076 xffxrrl.exe 4108 lfxlxll.exe 4292 hhhbhn.exe 2352 jpvpj.exe 368 9lfxrll.exe 1684 nhhhbb.exe 3748 pppjj.exe 4324 nnthnt.exe 3304 vpppd.exe 4532 llfffrf.exe 2696 tbnbnh.exe 3416 vvjpj.exe 2244 ffrfxxx.exe 2396 hhtnnh.exe 1808 jdvdj.exe 3252 rxxrllr.exe 4920 hbnhnb.exe 4928 pdpdj.exe 3328 jddjp.exe 3344 rxrrlrr.exe 1776 btnhbt.exe 4012 1hbtnh.exe 944 7pjdd.exe 4784 lxxrrll.exe 3980 nhbtnh.exe 552 dppjd.exe 1292 1xrfxlf.exe 2268 xrrfxxr.exe 224 thhnhh.exe 2900 jdjdv.exe 400 rxllfxr.exe 4748 xllffff.exe 4768 bnhbbn.exe 1068 pdddv.exe 2860 fxxrxlf.exe 1244 thtnnt.exe 1084 vdvdp.exe 1812 lxxrlff.exe 3000 tbbnhb.exe 2948 vjdvp.exe -
Processes:
resource yara_rule behavioral2/memory/4280-0-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\pdvdj.exe upx behavioral2/memory/4280-4-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4804-6-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\lfrlfxx.exe upx behavioral2/memory/2696-13-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4804-11-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\lrrlffx.exe upx C:\ppjvj.exe upx behavioral2/memory/4244-24-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2420-27-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\3pdvp.exe upx C:\rrlfxxx.exe upx behavioral2/memory/3920-37-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\btbbtt.exe upx C:\rrlrrrl.exe upx behavioral2/memory/4920-47-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4912-48-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\lfrlrlx.exe upx behavioral2/memory/4824-54-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\nbbtnn.exe upx behavioral2/memory/4824-60-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4012-62-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\jdpjj.exe upx \??\c:\9hnbnb.exe upx behavioral2/memory/2240-70-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2144-77-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\llxlxxx.exe upx behavioral2/memory/3004-79-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\hhhtnh.exe upx C:\dvvpj.exe upx behavioral2/memory/2192-89-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\rrlxlxf.exe upx behavioral2/memory/2712-96-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4776-107-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\hhtnhb.exe upx behavioral2/memory/2248-102-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\btbntn.exe upx \??\c:\jvppp.exe upx \??\c:\frlfrxx.exe upx \??\c:\ppjpj.exe upx C:\frrlflf.exe upx behavioral2/memory/1812-131-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\nbhbbt.exe upx behavioral2/memory/1736-128-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2948-141-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\hhhbhn.exe upx C:\jpvpj.exe upx behavioral2/memory/4292-163-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\9lfxrll.exe upx behavioral2/memory/2352-167-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\nhhhbb.exe upx C:\pppjj.exe upx behavioral2/memory/1684-175-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\nnthnt.exe upx behavioral2/memory/3748-185-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/3328-222-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/3344-229-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/1292-252-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2900-261-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4784-239-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4768-271-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/1068-275-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2860-276-0x0000000000400000-0x000000000043A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
18855293234f53a80b04137a8f718a00_NeikiAnalytics.exepdvdj.exelfrlfxx.exelrrlffx.exeppjvj.exe3pdvp.exerrlfxxx.exebtbbtt.exerrlrrrl.exelfrlrlx.exenbbtnn.exejdpjj.exe9hnbnb.exellxlxxx.exehhhtnh.exedvvpj.exerrlxlxf.exebtbntn.exehhtnhb.exejvppp.exefrlfrxx.exeppjpj.exedescription pid process target process PID 4280 wrote to memory of 4804 4280 18855293234f53a80b04137a8f718a00_NeikiAnalytics.exe pdvdj.exe PID 4280 wrote to memory of 4804 4280 18855293234f53a80b04137a8f718a00_NeikiAnalytics.exe pdvdj.exe PID 4280 wrote to memory of 4804 4280 18855293234f53a80b04137a8f718a00_NeikiAnalytics.exe pdvdj.exe PID 4804 wrote to memory of 2696 4804 pdvdj.exe tbnbnh.exe PID 4804 wrote to memory of 2696 4804 pdvdj.exe tbnbnh.exe PID 4804 wrote to memory of 2696 4804 pdvdj.exe tbnbnh.exe PID 2696 wrote to memory of 4244 2696 lfrlfxx.exe lrrlffx.exe PID 2696 wrote to memory of 4244 2696 lfrlfxx.exe lrrlffx.exe PID 2696 wrote to memory of 4244 2696 lfrlfxx.exe lrrlffx.exe PID 4244 wrote to memory of 2420 4244 lrrlffx.exe ppjvj.exe PID 4244 wrote to memory of 2420 4244 lrrlffx.exe ppjvj.exe PID 4244 wrote to memory of 2420 4244 lrrlffx.exe ppjvj.exe PID 2420 wrote to memory of 3272 2420 ppjvj.exe 3pdvp.exe PID 2420 wrote to memory of 3272 2420 ppjvj.exe 3pdvp.exe PID 2420 wrote to memory of 3272 2420 ppjvj.exe 3pdvp.exe PID 3272 wrote to memory of 3920 3272 3pdvp.exe rrlfxxx.exe PID 3272 wrote to memory of 3920 3272 3pdvp.exe rrlfxxx.exe PID 3272 wrote to memory of 3920 3272 3pdvp.exe rrlfxxx.exe PID 3920 wrote to memory of 4920 3920 rrlfxxx.exe hbnhnb.exe PID 3920 wrote to memory of 4920 3920 rrlfxxx.exe hbnhnb.exe PID 3920 wrote to memory of 4920 3920 rrlfxxx.exe hbnhnb.exe PID 4920 wrote to memory of 4912 4920 btbbtt.exe rrlrrrl.exe PID 4920 wrote to memory of 4912 4920 btbbtt.exe rrlrrrl.exe PID 4920 wrote to memory of 4912 4920 btbbtt.exe rrlrrrl.exe PID 4912 wrote to memory of 4824 4912 rrlrrrl.exe lfrlrlx.exe PID 4912 wrote to memory of 4824 4912 rrlrrrl.exe lfrlrlx.exe PID 4912 wrote to memory of 4824 4912 rrlrrrl.exe lfrlrlx.exe PID 4824 wrote to memory of 4012 4824 lfrlrlx.exe 1hbtnh.exe PID 4824 wrote to memory of 4012 4824 lfrlrlx.exe 1hbtnh.exe PID 4824 wrote to memory of 4012 4824 lfrlrlx.exe 1hbtnh.exe PID 4012 wrote to memory of 2240 4012 nbbtnn.exe jdpjj.exe PID 4012 wrote to memory of 2240 4012 nbbtnn.exe jdpjj.exe PID 4012 wrote to memory of 2240 4012 nbbtnn.exe jdpjj.exe PID 2240 wrote to memory of 2144 2240 jdpjj.exe 9hnbnb.exe PID 2240 wrote to memory of 2144 2240 jdpjj.exe 9hnbnb.exe PID 2240 wrote to memory of 2144 2240 jdpjj.exe 9hnbnb.exe PID 2144 wrote to memory of 3004 2144 9hnbnb.exe llxlxxx.exe PID 2144 wrote to memory of 3004 2144 9hnbnb.exe llxlxxx.exe PID 2144 wrote to memory of 3004 2144 9hnbnb.exe llxlxxx.exe PID 3004 wrote to memory of 4624 3004 llxlxxx.exe hhhtnh.exe PID 3004 wrote to memory of 4624 3004 llxlxxx.exe hhhtnh.exe PID 3004 wrote to memory of 4624 3004 llxlxxx.exe hhhtnh.exe PID 4624 wrote to memory of 2192 4624 hhhtnh.exe dvvpj.exe PID 4624 wrote to memory of 2192 4624 hhhtnh.exe dvvpj.exe PID 4624 wrote to memory of 2192 4624 hhhtnh.exe dvvpj.exe PID 2192 wrote to memory of 2712 2192 dvvpj.exe rrlxlxf.exe PID 2192 wrote to memory of 2712 2192 dvvpj.exe rrlxlxf.exe PID 2192 wrote to memory of 2712 2192 dvvpj.exe rrlxlxf.exe PID 2712 wrote to memory of 2248 2712 rrlxlxf.exe btbntn.exe PID 2712 wrote to memory of 2248 2712 rrlxlxf.exe btbntn.exe PID 2712 wrote to memory of 2248 2712 rrlxlxf.exe btbntn.exe PID 2248 wrote to memory of 4776 2248 btbntn.exe hhtnhb.exe PID 2248 wrote to memory of 4776 2248 btbntn.exe hhtnhb.exe PID 2248 wrote to memory of 4776 2248 btbntn.exe hhtnhb.exe PID 4776 wrote to memory of 4636 4776 hhtnhb.exe jvppp.exe PID 4776 wrote to memory of 4636 4776 hhtnhb.exe jvppp.exe PID 4776 wrote to memory of 4636 4776 hhtnhb.exe jvppp.exe PID 4636 wrote to memory of 1232 4636 jvppp.exe frlfrxx.exe PID 4636 wrote to memory of 1232 4636 jvppp.exe frlfrxx.exe PID 4636 wrote to memory of 1232 4636 jvppp.exe frlfrxx.exe PID 1232 wrote to memory of 1812 1232 frlfrxx.exe lxxrlff.exe PID 1232 wrote to memory of 1812 1232 frlfrxx.exe lxxrlff.exe PID 1232 wrote to memory of 1812 1232 frlfrxx.exe lxxrlff.exe PID 1812 wrote to memory of 1736 1812 ppjpj.exe frrlflf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\18855293234f53a80b04137a8f718a00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18855293234f53a80b04137a8f718a00_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\pdvdj.exec:\pdvdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\lfrlfxx.exec:\lfrlfxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\lrrlffx.exec:\lrrlffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
\??\c:\ppjvj.exec:\ppjvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\3pdvp.exec:\3pdvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\rrlfxxx.exec:\rrlfxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\btbbtt.exec:\btbbtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\rrlrrrl.exec:\rrlrrrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\lfrlrlx.exec:\lfrlrlx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\nbbtnn.exec:\nbbtnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\jdpjj.exec:\jdpjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\9hnbnb.exec:\9hnbnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\llxlxxx.exec:\llxlxxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\hhhtnh.exec:\hhhtnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\dvvpj.exec:\dvvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\rrlxlxf.exec:\rrlxlxf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\btbntn.exec:\btbntn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\hhtnhb.exec:\hhtnhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\jvppp.exec:\jvppp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\frlfrxx.exec:\frlfrxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\ppjpj.exec:\ppjpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\frrlflf.exec:\frrlflf.exe23⤵
- Executes dropped EXE
PID:1736 -
\??\c:\nbhbbt.exec:\nbhbbt.exe24⤵
- Executes dropped EXE
PID:2948 -
\??\c:\jvdjp.exec:\jvdjp.exe25⤵
- Executes dropped EXE
PID:2128 -
\??\c:\xffxrrl.exec:\xffxrrl.exe26⤵
- Executes dropped EXE
PID:1076 -
\??\c:\lfxlxll.exec:\lfxlxll.exe27⤵
- Executes dropped EXE
PID:4108 -
\??\c:\hhhbhn.exec:\hhhbhn.exe28⤵
- Executes dropped EXE
PID:4292 -
\??\c:\jpvpj.exec:\jpvpj.exe29⤵
- Executes dropped EXE
PID:2352 -
\??\c:\9lfxrll.exec:\9lfxrll.exe30⤵
- Executes dropped EXE
PID:368 -
\??\c:\nhhhbb.exec:\nhhhbb.exe31⤵
- Executes dropped EXE
PID:1684 -
\??\c:\pppjj.exec:\pppjj.exe32⤵
- Executes dropped EXE
PID:3748 -
\??\c:\nnthnt.exec:\nnthnt.exe33⤵
- Executes dropped EXE
PID:4324 -
\??\c:\vpppd.exec:\vpppd.exe34⤵
- Executes dropped EXE
PID:3304 -
\??\c:\llfffrf.exec:\llfffrf.exe35⤵
- Executes dropped EXE
PID:4532 -
\??\c:\tbnbnh.exec:\tbnbnh.exe36⤵
- Executes dropped EXE
PID:2696 -
\??\c:\vvjpj.exec:\vvjpj.exe37⤵
- Executes dropped EXE
PID:3416 -
\??\c:\ffrfxxx.exec:\ffrfxxx.exe38⤵
- Executes dropped EXE
PID:2244 -
\??\c:\hhtnnh.exec:\hhtnnh.exe39⤵
- Executes dropped EXE
PID:2396 -
\??\c:\jdvdj.exec:\jdvdj.exe40⤵
- Executes dropped EXE
PID:1808 -
\??\c:\rxxrllr.exec:\rxxrllr.exe41⤵
- Executes dropped EXE
PID:3252 -
\??\c:\hbnhnb.exec:\hbnhnb.exe42⤵
- Executes dropped EXE
PID:4920 -
\??\c:\pdpdj.exec:\pdpdj.exe43⤵
- Executes dropped EXE
PID:4928 -
\??\c:\jddjp.exec:\jddjp.exe44⤵
- Executes dropped EXE
PID:3328 -
\??\c:\rxrrlrr.exec:\rxrrlrr.exe45⤵
- Executes dropped EXE
PID:3344 -
\??\c:\btnhbt.exec:\btnhbt.exe46⤵
- Executes dropped EXE
PID:1776 -
\??\c:\1hbtnh.exec:\1hbtnh.exe47⤵
- Executes dropped EXE
PID:4012 -
\??\c:\7pjdd.exec:\7pjdd.exe48⤵
- Executes dropped EXE
PID:944 -
\??\c:\lxxrrll.exec:\lxxrrll.exe49⤵
- Executes dropped EXE
PID:4784 -
\??\c:\nhbtnh.exec:\nhbtnh.exe50⤵
- Executes dropped EXE
PID:3980 -
\??\c:\dppjd.exec:\dppjd.exe51⤵
- Executes dropped EXE
PID:552 -
\??\c:\1xrfxlf.exec:\1xrfxlf.exe52⤵
- Executes dropped EXE
PID:1292 -
\??\c:\xrrfxxr.exec:\xrrfxxr.exe53⤵
- Executes dropped EXE
PID:2268 -
\??\c:\thhnhh.exec:\thhnhh.exe54⤵
- Executes dropped EXE
PID:224 -
\??\c:\jdjdv.exec:\jdjdv.exe55⤵
- Executes dropped EXE
PID:2900 -
\??\c:\rxllfxr.exec:\rxllfxr.exe56⤵
- Executes dropped EXE
PID:400 -
\??\c:\xllffff.exec:\xllffff.exe57⤵
- Executes dropped EXE
PID:4748 -
\??\c:\bnhbbn.exec:\bnhbbn.exe58⤵
- Executes dropped EXE
PID:4768 -
\??\c:\pdddv.exec:\pdddv.exe59⤵
- Executes dropped EXE
PID:1068 -
\??\c:\fxxrxlf.exec:\fxxrxlf.exe60⤵
- Executes dropped EXE
PID:2860 -
\??\c:\thtnnt.exec:\thtnnt.exe61⤵
- Executes dropped EXE
PID:1244 -
\??\c:\vdvdp.exec:\vdvdp.exe62⤵
- Executes dropped EXE
PID:1084 -
\??\c:\lxxrlff.exec:\lxxrlff.exe63⤵
- Executes dropped EXE
PID:1812 -
\??\c:\tbbnhb.exec:\tbbnhb.exe64⤵
- Executes dropped EXE
PID:3000 -
\??\c:\vjdvp.exec:\vjdvp.exe65⤵
- Executes dropped EXE
PID:2948 -
\??\c:\lxxrrxx.exec:\lxxrrxx.exe66⤵PID:2472
-
\??\c:\rxllfxf.exec:\rxllfxf.exe67⤵PID:1488
-
\??\c:\ttthhb.exec:\ttthhb.exe68⤵PID:4344
-
\??\c:\vpjdj.exec:\vpjdj.exe69⤵PID:4296
-
\??\c:\lrlrxfl.exec:\lrlrxfl.exe70⤵PID:932
-
\??\c:\nntbbh.exec:\nntbbh.exe71⤵PID:4968
-
\??\c:\ppdpd.exec:\ppdpd.exe72⤵PID:2944
-
\??\c:\llxlffx.exec:\llxlffx.exe73⤵PID:4248
-
\??\c:\ttbtnn.exec:\ttbtnn.exe74⤵PID:3352
-
\??\c:\djpjd.exec:\djpjd.exe75⤵PID:1328
-
\??\c:\vvvpd.exec:\vvvpd.exe76⤵PID:1732
-
\??\c:\xrllfff.exec:\xrllfff.exe77⤵PID:4020
-
\??\c:\bbnhbh.exec:\bbnhbh.exe78⤵PID:1864
-
\??\c:\pjpdv.exec:\pjpdv.exe79⤵PID:3820
-
\??\c:\flfxlll.exec:\flfxlll.exe80⤵PID:4844
-
\??\c:\rllrrrf.exec:\rllrrrf.exe81⤵PID:2420
-
\??\c:\3nhhnt.exec:\3nhhnt.exe82⤵PID:4884
-
\??\c:\jpdvv.exec:\jpdvv.exe83⤵PID:3736
-
\??\c:\rfrlffr.exec:\rfrlffr.exe84⤵PID:4864
-
\??\c:\hbnntt.exec:\hbnntt.exe85⤵PID:4956
-
\??\c:\nnhhbt.exec:\nnhhbt.exe86⤵PID:1592
-
\??\c:\1tbhbn.exec:\1tbhbn.exe87⤵PID:1852
-
\??\c:\vjdvj.exec:\vjdvj.exe88⤵PID:836
-
\??\c:\rllxrlf.exec:\rllxrlf.exe89⤵PID:1512
-
\??\c:\fxxrllf.exec:\fxxrllf.exe90⤵PID:4596
-
\??\c:\hhnbtn.exec:\hhnbtn.exe91⤵PID:1400
-
\??\c:\pvdvd.exec:\pvdvd.exe92⤵PID:3700
-
\??\c:\fxfrllf.exec:\fxfrllf.exe93⤵PID:4840
-
\??\c:\bttnht.exec:\bttnht.exe94⤵PID:3468
-
\??\c:\jvppd.exec:\jvppd.exe95⤵PID:3276
-
\??\c:\pdjvp.exec:\pdjvp.exe96⤵PID:3236
-
\??\c:\lfllrrl.exec:\lfllrrl.exe97⤵PID:3208
-
\??\c:\thnhtn.exec:\thnhtn.exe98⤵PID:3868
-
\??\c:\nbbtnh.exec:\nbbtnh.exe99⤵PID:2900
-
\??\c:\rffrffr.exec:\rffrffr.exe100⤵PID:4796
-
\??\c:\bntnnn.exec:\bntnnn.exe101⤵PID:2140
-
\??\c:\vppdv.exec:\vppdv.exe102⤵PID:1068
-
\??\c:\rrlxrxl.exec:\rrlxrxl.exe103⤵PID:3036
-
\??\c:\thhhnn.exec:\thhhnn.exe104⤵PID:1244
-
\??\c:\jddvp.exec:\jddvp.exe105⤵PID:2376
-
\??\c:\ppvpj.exec:\ppvpj.exe106⤵PID:1736
-
\??\c:\xflffxx.exec:\xflffxx.exe107⤵PID:804
-
\??\c:\1nnnhn.exec:\1nnnhn.exe108⤵PID:212
-
\??\c:\pjdpd.exec:\pjdpd.exe109⤵PID:2152
-
\??\c:\fxllrrx.exec:\fxllrrx.exe110⤵PID:1536
-
\??\c:\lfxxffx.exec:\lfxxffx.exe111⤵PID:4628
-
\??\c:\ppppp.exec:\ppppp.exe112⤵PID:2976
-
\??\c:\xrlrxll.exec:\xrlrxll.exe113⤵PID:368
-
\??\c:\ppppj.exec:\ppppj.exe114⤵PID:316
-
\??\c:\9ddvp.exec:\9ddvp.exe115⤵PID:3032
-
\??\c:\ffxxxxr.exec:\ffxxxxr.exe116⤵PID:4324
-
\??\c:\hbnhhb.exec:\hbnhhb.exe117⤵PID:1328
-
\??\c:\djppj.exec:\djppj.exe118⤵PID:4952
-
\??\c:\fffxxrr.exec:\fffxxrr.exe119⤵PID:2368
-
\??\c:\1ttnhn.exec:\1ttnhn.exe120⤵PID:2668
-
\??\c:\tbnbbb.exec:\tbnbbb.exe121⤵PID:4168
-
\??\c:\pvjdp.exec:\pvjdp.exe122⤵PID:2784
-
\??\c:\dpvpj.exec:\dpvpj.exe123⤵PID:3784
-
\??\c:\xflfxxr.exec:\xflfxxr.exe124⤵PID:1280
-
\??\c:\bntnnn.exec:\bntnnn.exe125⤵PID:5052
-
\??\c:\vjvpj.exec:\vjvpj.exe126⤵PID:3252
-
\??\c:\lxxlrff.exec:\lxxlrff.exe127⤵PID:2124
-
\??\c:\nbhtnh.exec:\nbhtnh.exe128⤵PID:3488
-
\??\c:\nhnhhh.exec:\nhnhhh.exe129⤵PID:4332
-
\??\c:\djvpj.exec:\djvpj.exe130⤵PID:1852
-
\??\c:\fxffrrf.exec:\fxffrrf.exe131⤵PID:3180
-
\??\c:\bntbht.exec:\bntbht.exe132⤵PID:4012
-
\??\c:\jddvj.exec:\jddvj.exe133⤵PID:2144
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe134⤵PID:4840
-
\??\c:\hhtbtb.exec:\hhtbtb.exe135⤵PID:2288
-
\??\c:\nbbntb.exec:\nbbntb.exe136⤵PID:3172
-
\??\c:\3pvpj.exec:\3pvpj.exe137⤵PID:404
-
\??\c:\lrxxrff.exec:\lrxxrff.exe138⤵PID:4776
-
\??\c:\bhbthh.exec:\bhbthh.exe139⤵PID:116
-
\??\c:\btttnn.exec:\btttnn.exe140⤵PID:1780
-
\??\c:\vjdvv.exec:\vjdvv.exe141⤵PID:2860
-
\??\c:\vpjjj.exec:\vpjjj.exe142⤵PID:2532
-
\??\c:\9xxrfxr.exec:\9xxrfxr.exe143⤵PID:4604
-
\??\c:\bthbtn.exec:\bthbtn.exe144⤵PID:3232
-
\??\c:\jdjjp.exec:\jdjjp.exe145⤵PID:3012
-
\??\c:\lllfxxl.exec:\lllfxxl.exe146⤵PID:1800
-
\??\c:\hhtbhh.exec:\hhtbhh.exe147⤵PID:448
-
\??\c:\ddppp.exec:\ddppp.exe148⤵PID:1552
-
\??\c:\xfrxflr.exec:\xfrxflr.exe149⤵PID:2664
-
\??\c:\bnbhnh.exec:\bnbhnh.exe150⤵PID:1604
-
\??\c:\1dvvp.exec:\1dvvp.exe151⤵PID:4692
-
\??\c:\jjppp.exec:\jjppp.exe152⤵PID:3144
-
\??\c:\lrffxfx.exec:\lrffxfx.exe153⤵PID:4828
-
\??\c:\dvdpj.exec:\dvdpj.exe154⤵PID:3748
-
\??\c:\jjjjd.exec:\jjjjd.exe155⤵PID:1972
-
\??\c:\xrxrxxf.exec:\xrxrxxf.exe156⤵PID:4532
-
\??\c:\5bbhbh.exec:\5bbhbh.exe157⤵PID:2316
-
\??\c:\7dvpp.exec:\7dvpp.exe158⤵PID:4244
-
\??\c:\dvvpv.exec:\dvvpv.exe159⤵PID:3416
-
\??\c:\3rxxrxx.exec:\3rxxrxx.exe160⤵PID:5000
-
\??\c:\5ttthh.exec:\5ttthh.exe161⤵PID:740
-
\??\c:\ddvdj.exec:\ddvdj.exe162⤵PID:4336
-
\??\c:\fffffxx.exec:\fffffxx.exe163⤵PID:3108
-
\??\c:\xlfxrlf.exec:\xlfxrlf.exe164⤵PID:5012
-
\??\c:\bbtnbn.exec:\bbtnbn.exe165⤵PID:3676
-
\??\c:\jvdpj.exec:\jvdpj.exe166⤵PID:4352
-
\??\c:\pvvjv.exec:\pvvjv.exe167⤵PID:668
-
\??\c:\lxxxrrl.exec:\lxxxrrl.exe168⤵PID:4592
-
\??\c:\bntnhb.exec:\bntnhb.exe169⤵PID:4444
-
\??\c:\pjjjd.exec:\pjjjd.exe170⤵PID:4028
-
\??\c:\jdpjp.exec:\jdpjp.exe171⤵PID:2292
-
\??\c:\3rrlfll.exec:\3rrlfll.exe172⤵PID:3320
-
\??\c:\btnhhh.exec:\btnhhh.exe173⤵PID:3732
-
\??\c:\hnhnhh.exec:\hnhnhh.exe174⤵PID:2288
-
\??\c:\pdvvp.exec:\pdvvp.exe175⤵PID:3172
-
\??\c:\rxrxrxx.exec:\rxrxrxx.exe176⤵PID:4528
-
\??\c:\rllfffx.exec:\rllfffx.exe177⤵PID:4492
-
\??\c:\3bhnnn.exec:\3bhnnn.exe178⤵PID:4508
-
\??\c:\dpvpj.exec:\dpvpj.exe179⤵PID:1780
-
\??\c:\3lxrlfx.exec:\3lxrlfx.exe180⤵PID:3492
-
\??\c:\lflfxrl.exec:\lflfxrl.exe181⤵PID:3060
-
\??\c:\bnbtnh.exec:\bnbtnh.exe182⤵PID:2460
-
\??\c:\9dddp.exec:\9dddp.exe183⤵PID:3256
-
\??\c:\rrxrrlr.exec:\rrxrrlr.exe184⤵PID:4588
-
\??\c:\xrlfxrl.exec:\xrlfxrl.exe185⤵PID:3012
-
\??\c:\nbtnhh.exec:\nbtnhh.exe186⤵PID:1800
-
\??\c:\ddjvp.exec:\ddjvp.exe187⤵PID:1536
-
\??\c:\xllfxrf.exec:\xllfxrf.exe188⤵PID:5096
-
\??\c:\fxxfflx.exec:\fxxfflx.exe189⤵PID:2976
-
\??\c:\bttnbb.exec:\bttnbb.exe190⤵PID:1796
-
\??\c:\5djdv.exec:\5djdv.exe191⤵PID:316
-
\??\c:\rfxrffx.exec:\rfxrffx.exe192⤵PID:1136
-
\??\c:\nhbnnt.exec:\nhbnnt.exe193⤵PID:4828
-
\??\c:\vdpdv.exec:\vdpdv.exe194⤵PID:640
-
\??\c:\rlffxxr.exec:\rlffxxr.exe195⤵PID:1972
-
\??\c:\hbnnht.exec:\hbnnht.exe196⤵PID:1328
-
\??\c:\dpdvp.exec:\dpdvp.exe197⤵PID:4024
-
\??\c:\ffrxlrf.exec:\ffrxlrf.exe198⤵PID:2672
-
\??\c:\ntbttt.exec:\ntbttt.exe199⤵PID:3416
-
\??\c:\bnnnnb.exec:\bnnnnb.exe200⤵PID:5000
-
\??\c:\1jvpv.exec:\1jvpv.exe201⤵PID:2396
-
\??\c:\frlfxfx.exec:\frlfxfx.exe202⤵PID:4872
-
\??\c:\hnbbnb.exec:\hnbbnb.exe203⤵PID:3692
-
\??\c:\pjvpj.exec:\pjvpj.exe204⤵PID:2228
-
\??\c:\lfflfff.exec:\lfflfff.exe205⤵PID:392
-
\??\c:\5xrfrlf.exec:\5xrfrlf.exe206⤵PID:3488
-
\??\c:\1nnhht.exec:\1nnhht.exe207⤵PID:1852
-
\??\c:\vpjdj.exec:\vpjdj.exe208⤵PID:1028
-
\??\c:\3rlfxff.exec:\3rlfxff.exe209⤵PID:3196
-
\??\c:\7tnhtt.exec:\7tnhtt.exe210⤵PID:4752
-
\??\c:\7hbhtn.exec:\7hbhtn.exe211⤵PID:4836
-
\??\c:\vjvvp.exec:\vjvvp.exe212⤵PID:3468
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe213⤵PID:2712
-
\??\c:\nnnbtt.exec:\nnnbtt.exe214⤵PID:1168
-
\??\c:\tnnhhh.exec:\tnnhhh.exe215⤵PID:3948
-
\??\c:\pjvjd.exec:\pjvjd.exe216⤵PID:404
-
\??\c:\1lfxrrl.exec:\1lfxrrl.exe217⤵PID:2444
-
\??\c:\bthbhb.exec:\bthbhb.exe218⤵PID:4536
-
\??\c:\jdvvv.exec:\jdvvv.exe219⤵PID:2860
-
\??\c:\pjdjj.exec:\pjdjj.exe220⤵PID:3944
-
\??\c:\rxffxxf.exec:\rxffxxf.exe221⤵PID:4060
-
\??\c:\tttnhb.exec:\tttnhb.exe222⤵PID:4108
-
\??\c:\vpdvd.exec:\vpdvd.exe223⤵PID:1644
-
\??\c:\dpjdv.exec:\dpjdv.exe224⤵PID:4540
-
\??\c:\rfllffx.exec:\rfllffx.exe225⤵PID:4320
-
\??\c:\tnnhnh.exec:\tnnhnh.exe226⤵PID:5096
-
\??\c:\vdjjd.exec:\vdjjd.exe227⤵PID:3900
-
\??\c:\jpjdp.exec:\jpjdp.exe228⤵PID:3032
-
\??\c:\lxfxxxr.exec:\lxfxxxr.exe229⤵PID:4324
-
\??\c:\xflfxxr.exec:\xflfxxr.exe230⤵PID:2760
-
\??\c:\nhbbtt.exec:\nhbbtt.exe231⤵PID:3748
-
\??\c:\9jjdd.exec:\9jjdd.exe232⤵PID:2896
-
\??\c:\rflfxrl.exec:\rflfxrl.exe233⤵PID:1864
-
\??\c:\nhhbbh.exec:\nhhbbh.exe234⤵PID:1328
-
\??\c:\thtbtt.exec:\thtbtt.exe235⤵PID:4900
-
\??\c:\ddjdd.exec:\ddjdd.exe236⤵PID:740
-
\??\c:\lrxxxrl.exec:\lrxxxrl.exe237⤵PID:5092
-
\??\c:\btnnhh.exec:\btnnhh.exe238⤵PID:1320
-
\??\c:\vvpvp.exec:\vvpvp.exe239⤵PID:5012
-
\??\c:\dppjd.exec:\dppjd.exe240⤵PID:4956
-
\??\c:\xfrrrrl.exec:\xfrrrrl.exe241⤵PID:860
-
\??\c:\7hntnb.exec:\7hntnb.exe242⤵PID:3204