Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 17:50
Behavioral task
behavioral1
Sample
215b8033462d2b8a95daf04332fa42f0_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
215b8033462d2b8a95daf04332fa42f0_NeikiAnalytics.exe
-
Size
211KB
-
MD5
215b8033462d2b8a95daf04332fa42f0
-
SHA1
ec03916c19b509f68e54dadd3c6e39d5dbd1ac6d
-
SHA256
a125cf2bf2ecb0fba983a8fe18dd28ad420e45dd1fdd95d1b40b600956cb8d8e
-
SHA512
83cc7605e398a8a9e07be6cc956391b24cdb4c236c7e3d77263263c525024a96fde84258eb8f36a7ffa69a9168be533efd86ac824fcdabe53e5be78ed849b26c
-
SSDEEP
6144:Hcm4FmowdHoSrXZf8l/ubPzYNLPf4t+ly:V4wFHoSBK/ubLcfU
Malware Config
Signatures
-
Detect Blackmoon payload 61 IoCs
Processes:
resource yara_rule behavioral2/memory/452-4-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3716-6-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1088-13-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4764-23-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2208-30-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3524-36-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2032-46-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3904-59-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1096-57-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1336-51-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3568-74-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1220-96-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/212-94-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4616-115-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3372-125-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1112-145-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4480-202-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2480-221-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4496-269-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2484-280-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4016-284-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1524-306-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4196-326-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/648-371-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1172-350-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1816-322-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3000-296-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3420-295-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3928-268-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1444-257-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4528-250-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2980-237-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2768-216-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1500-212-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3720-195-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1496-413-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5012-414-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1640-182-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2804-177-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4492-169-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3600-164-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3000-152-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3068-138-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/220-132-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4900-108-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1444-87-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/32-81-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2868-442-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4960-460-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1408-467-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3996-484-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1508-494-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3636-509-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2312-521-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1220-531-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2444-586-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1660-593-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/712-674-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2164-688-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4916-821-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3912-841-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule behavioral2/memory/452-0-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew C:\vvdvj.exe family_berbew behavioral2/memory/452-4-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3716-6-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew C:\1frrxll.exe family_berbew C:\hnnbtn.exe family_berbew behavioral2/memory/1088-13-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew C:\jjpvv.exe family_berbew behavioral2/memory/4764-23-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/2208-30-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew \??\c:\3xrxrxr.exe family_berbew C:\bbtbbh.exe family_berbew behavioral2/memory/3524-36-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew C:\bnbnhb.exe family_berbew C:\lrfrlrx.exe family_berbew behavioral2/memory/2032-46-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3904-59-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew \??\c:\tnnnnt.exe family_berbew behavioral2/memory/1096-57-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew C:\1pvpd.exe family_berbew C:\jvpjv.exe family_berbew behavioral2/memory/1336-51-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew \??\c:\xlfxxxr.exe family_berbew behavioral2/memory/3568-74-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/1444-82-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew \??\c:\9xrfxlf.exe family_berbew behavioral2/memory/1220-96-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/212-94-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4900-102-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4500-109-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4616-115-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew \??\c:\7vpvj.exe family_berbew \??\c:\lrllfxr.exe family_berbew behavioral2/memory/3372-125-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew \??\c:\tnbttb.exe family_berbew behavioral2/memory/1112-140-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/1112-145-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew \??\c:\3lrlffx.exe family_berbew \??\c:\hbnbtn.exe family_berbew \??\c:\5bhntt.exe family_berbew \??\c:\jjpjj.exe family_berbew \??\c:\lxfxlrr.exe family_berbew behavioral2/memory/4480-202-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/1784-217-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/2480-221-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4496-269-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/2484-280-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4016-284-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/1524-306-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4196-326-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4700-340-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4908-356-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/648-371-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/2992-351-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/1172-350-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3844-335-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/1816-322-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3000-296-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3420-295-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3420-291-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/2484-276-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3708-399-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3928-268-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3928-264-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
Processes:
vvdvj.exe1frrxll.exehnnbtn.exejjpvv.exe3xrxrxr.exebbtbbh.exebnbnhb.exelrfrlrx.exehbhtbt.exetnnnnt.exe1pvpd.exejvpjv.exexlfxxxr.exethhtht.exeppdvp.exe9xrfxlf.exe7bnnnb.exetbbhtn.exe7vpvj.exe1xxxrrl.exelrllfxr.exetnbttb.exepppvj.exe3lrlffx.exexllfxrl.exehbnbtn.exe5bhntt.exedpjdv.exexfrfllx.exetnthnb.exejjpjj.exelxfxlrr.exe7ntnhh.exe7dddv.exe9pvpj.exehhnhbt.exebttbtt.exe7djvj.exexffxrrl.exehhbnhh.exennnhhb.exefrrfrlf.exetntntt.exe5bhttn.exepjppj.exevpvvv.exexxxrrrr.exe1llfflf.exenbbtnh.exejppjv.exevjvpj.exelfrlxxx.exelxrfxxl.exenbhhhh.exejvjjj.exerllfxff.exelffxrrr.exe7hnhbb.exebbhhnh.exejjpjd.exevdppj.exe3xxrlll.exerxrxfrr.exehttthh.exepid process 3716 vvdvj.exe 1088 1frrxll.exe 2992 hnnbtn.exe 4764 jjpvv.exe 2208 3xrxrxr.exe 3524 bbtbbh.exe 2032 bnbnhb.exe 1336 lrfrlrx.exe 1096 hbhtbt.exe 3904 tnnnnt.exe 1132 1pvpd.exe 3568 jvpjv.exe 32 xlfxxxr.exe 1444 thhtht.exe 212 ppdvp.exe 1220 9xrfxlf.exe 4900 7bnnnb.exe 4500 tbbhtn.exe 4616 7vpvj.exe 3372 1xxxrrl.exe 220 lrllfxr.exe 3068 tnbttb.exe 1112 pppvj.exe 3000 3lrlffx.exe 2948 xllfxrl.exe 3600 hbnbtn.exe 2956 5bhntt.exe 4492 dpjdv.exe 2804 xfrfllx.exe 1640 tnthnb.exe 2696 jjpjj.exe 3720 lxfxlrr.exe 1956 7ntnhh.exe 4480 7dddv.exe 4916 9pvpj.exe 1172 hhnhbt.exe 1500 bttbtt.exe 2768 7djvj.exe 1784 xffxrrl.exe 2480 hhbnhh.exe 4764 nnnhhb.exe 996 frrfrlf.exe 2884 tntntt.exe 2980 5bhttn.exe 3056 pjppj.exe 2312 vpvvv.exe 620 xxxrrrr.exe 4528 1llfflf.exe 2728 nbbtnh.exe 1444 jppjv.exe 4092 vjvpj.exe 2872 lfrlxxx.exe 3928 lxrfxxl.exe 4496 nbhhhh.exe 4472 jvjjj.exe 2484 rllfxff.exe 4016 lffxrrr.exe 912 7hnhbb.exe 4384 bbhhnh.exe 3420 jjpjd.exe 3000 vdppj.exe 1604 3xxrlll.exe 1524 rxrxfrr.exe 4028 httthh.exe -
Processes:
resource yara_rule behavioral2/memory/452-0-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\vvdvj.exe upx behavioral2/memory/452-4-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3716-6-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\1frrxll.exe upx C:\hnnbtn.exe upx behavioral2/memory/1088-13-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\jjpvv.exe upx behavioral2/memory/4764-23-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2208-30-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\3xrxrxr.exe upx C:\bbtbbh.exe upx behavioral2/memory/3524-36-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\bnbnhb.exe upx C:\lrfrlrx.exe upx behavioral2/memory/2032-46-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3904-59-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\tnnnnt.exe upx behavioral2/memory/1096-57-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\1pvpd.exe upx C:\jvpjv.exe upx behavioral2/memory/1336-51-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\xlfxxxr.exe upx behavioral2/memory/3568-74-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1444-82-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\9xrfxlf.exe upx behavioral2/memory/1220-96-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/212-94-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4900-102-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4500-109-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4616-115-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\7vpvj.exe upx \??\c:\lrllfxr.exe upx behavioral2/memory/3372-125-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\tnbttb.exe upx behavioral2/memory/1112-140-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1112-145-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\3lrlffx.exe upx \??\c:\hbnbtn.exe upx \??\c:\5bhntt.exe upx \??\c:\jjpjj.exe upx \??\c:\lxfxlrr.exe upx behavioral2/memory/4480-202-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1784-217-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2480-221-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4496-269-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2484-280-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4016-284-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1524-306-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4196-326-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4700-340-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4908-356-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/648-371-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2992-351-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1172-350-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3844-335-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1816-322-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3000-296-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3420-295-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3420-291-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2484-276-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3708-399-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3928-268-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3928-264-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
215b8033462d2b8a95daf04332fa42f0_NeikiAnalytics.exevvdvj.exe1frrxll.exehnnbtn.exejjpvv.exe3xrxrxr.exebbtbbh.exebnbnhb.exelrfrlrx.exehbhtbt.exetnnnnt.exe1pvpd.exejvpjv.exexlfxxxr.exethhtht.exeppdvp.exe9xrfxlf.exe7bnnnb.exetbbhtn.exe7vpvj.exe1xxxrrl.exelrllfxr.exedescription pid process target process PID 452 wrote to memory of 3716 452 215b8033462d2b8a95daf04332fa42f0_NeikiAnalytics.exe vvdvj.exe PID 452 wrote to memory of 3716 452 215b8033462d2b8a95daf04332fa42f0_NeikiAnalytics.exe vvdvj.exe PID 452 wrote to memory of 3716 452 215b8033462d2b8a95daf04332fa42f0_NeikiAnalytics.exe vvdvj.exe PID 3716 wrote to memory of 1088 3716 vvdvj.exe 1frrxll.exe PID 3716 wrote to memory of 1088 3716 vvdvj.exe 1frrxll.exe PID 3716 wrote to memory of 1088 3716 vvdvj.exe 1frrxll.exe PID 1088 wrote to memory of 2992 1088 1frrxll.exe hnnbtn.exe PID 1088 wrote to memory of 2992 1088 1frrxll.exe hnnbtn.exe PID 1088 wrote to memory of 2992 1088 1frrxll.exe hnnbtn.exe PID 2992 wrote to memory of 4764 2992 hnnbtn.exe jjpvv.exe PID 2992 wrote to memory of 4764 2992 hnnbtn.exe jjpvv.exe PID 2992 wrote to memory of 4764 2992 hnnbtn.exe jjpvv.exe PID 4764 wrote to memory of 2208 4764 jjpvv.exe 3xrxrxr.exe PID 4764 wrote to memory of 2208 4764 jjpvv.exe 3xrxrxr.exe PID 4764 wrote to memory of 2208 4764 jjpvv.exe 3xrxrxr.exe PID 2208 wrote to memory of 3524 2208 3xrxrxr.exe bbtbbh.exe PID 2208 wrote to memory of 3524 2208 3xrxrxr.exe bbtbbh.exe PID 2208 wrote to memory of 3524 2208 3xrxrxr.exe bbtbbh.exe PID 3524 wrote to memory of 2032 3524 bbtbbh.exe bnbnhb.exe PID 3524 wrote to memory of 2032 3524 bbtbbh.exe bnbnhb.exe PID 3524 wrote to memory of 2032 3524 bbtbbh.exe bnbnhb.exe PID 2032 wrote to memory of 1336 2032 bnbnhb.exe lrfrlrx.exe PID 2032 wrote to memory of 1336 2032 bnbnhb.exe lrfrlrx.exe PID 2032 wrote to memory of 1336 2032 bnbnhb.exe lrfrlrx.exe PID 1336 wrote to memory of 1096 1336 lrfrlrx.exe hbhtbt.exe PID 1336 wrote to memory of 1096 1336 lrfrlrx.exe hbhtbt.exe PID 1336 wrote to memory of 1096 1336 lrfrlrx.exe hbhtbt.exe PID 1096 wrote to memory of 3904 1096 hbhtbt.exe tnnnnt.exe PID 1096 wrote to memory of 3904 1096 hbhtbt.exe tnnnnt.exe PID 1096 wrote to memory of 3904 1096 hbhtbt.exe tnnnnt.exe PID 3904 wrote to memory of 1132 3904 tnnnnt.exe 1pvpd.exe PID 3904 wrote to memory of 1132 3904 tnnnnt.exe 1pvpd.exe PID 3904 wrote to memory of 1132 3904 tnnnnt.exe 1pvpd.exe PID 1132 wrote to memory of 3568 1132 1pvpd.exe jvpjv.exe PID 1132 wrote to memory of 3568 1132 1pvpd.exe jvpjv.exe PID 1132 wrote to memory of 3568 1132 1pvpd.exe jvpjv.exe PID 3568 wrote to memory of 32 3568 jvpjv.exe xlfxxxr.exe PID 3568 wrote to memory of 32 3568 jvpjv.exe xlfxxxr.exe PID 3568 wrote to memory of 32 3568 jvpjv.exe xlfxxxr.exe PID 32 wrote to memory of 1444 32 xlfxxxr.exe thhtht.exe PID 32 wrote to memory of 1444 32 xlfxxxr.exe thhtht.exe PID 32 wrote to memory of 1444 32 xlfxxxr.exe thhtht.exe PID 1444 wrote to memory of 212 1444 thhtht.exe ppdvp.exe PID 1444 wrote to memory of 212 1444 thhtht.exe ppdvp.exe PID 1444 wrote to memory of 212 1444 thhtht.exe ppdvp.exe PID 212 wrote to memory of 1220 212 ppdvp.exe 9xrfxlf.exe PID 212 wrote to memory of 1220 212 ppdvp.exe 9xrfxlf.exe PID 212 wrote to memory of 1220 212 ppdvp.exe 9xrfxlf.exe PID 1220 wrote to memory of 4900 1220 9xrfxlf.exe 7bnnnb.exe PID 1220 wrote to memory of 4900 1220 9xrfxlf.exe 7bnnnb.exe PID 1220 wrote to memory of 4900 1220 9xrfxlf.exe 7bnnnb.exe PID 4900 wrote to memory of 4500 4900 7bnnnb.exe tbbhtn.exe PID 4900 wrote to memory of 4500 4900 7bnnnb.exe tbbhtn.exe PID 4900 wrote to memory of 4500 4900 7bnnnb.exe tbbhtn.exe PID 4500 wrote to memory of 4616 4500 tbbhtn.exe 7vpvj.exe PID 4500 wrote to memory of 4616 4500 tbbhtn.exe 7vpvj.exe PID 4500 wrote to memory of 4616 4500 tbbhtn.exe 7vpvj.exe PID 4616 wrote to memory of 3372 4616 7vpvj.exe 1xxxrrl.exe PID 4616 wrote to memory of 3372 4616 7vpvj.exe 1xxxrrl.exe PID 4616 wrote to memory of 3372 4616 7vpvj.exe 1xxxrrl.exe PID 3372 wrote to memory of 220 3372 1xxxrrl.exe lrllfxr.exe PID 3372 wrote to memory of 220 3372 1xxxrrl.exe lrllfxr.exe PID 3372 wrote to memory of 220 3372 1xxxrrl.exe lrllfxr.exe PID 220 wrote to memory of 3068 220 lrllfxr.exe 3tnbbt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\215b8033462d2b8a95daf04332fa42f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\215b8033462d2b8a95daf04332fa42f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\vvdvj.exec:\vvdvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\1frrxll.exec:\1frrxll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\hnnbtn.exec:\hnnbtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\jjpvv.exec:\jjpvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\3xrxrxr.exec:\3xrxrxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\bbtbbh.exec:\bbtbbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\bnbnhb.exec:\bnbnhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\lrfrlrx.exec:\lrfrlrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\hbhtbt.exec:\hbhtbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\tnnnnt.exec:\tnnnnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\1pvpd.exec:\1pvpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\jvpjv.exec:\jvpjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
\??\c:\xlfxxxr.exec:\xlfxxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:32 -
\??\c:\thhtht.exec:\thhtht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\ppdvp.exec:\ppdvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\9xrfxlf.exec:\9xrfxlf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\7bnnnb.exec:\7bnnnb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\tbbhtn.exec:\tbbhtn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\7vpvj.exec:\7vpvj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\1xxxrrl.exec:\1xxxrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\lrllfxr.exec:\lrllfxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\tnbttb.exec:\tnbttb.exe23⤵
- Executes dropped EXE
PID:3068 -
\??\c:\pppvj.exec:\pppvj.exe24⤵
- Executes dropped EXE
PID:1112 -
\??\c:\3lrlffx.exec:\3lrlffx.exe25⤵
- Executes dropped EXE
PID:3000 -
\??\c:\xllfxrl.exec:\xllfxrl.exe26⤵
- Executes dropped EXE
PID:2948 -
\??\c:\hbnbtn.exec:\hbnbtn.exe27⤵
- Executes dropped EXE
PID:3600 -
\??\c:\5bhntt.exec:\5bhntt.exe28⤵
- Executes dropped EXE
PID:2956 -
\??\c:\dpjdv.exec:\dpjdv.exe29⤵
- Executes dropped EXE
PID:4492 -
\??\c:\xfrfllx.exec:\xfrfllx.exe30⤵
- Executes dropped EXE
PID:2804 -
\??\c:\tnthnb.exec:\tnthnb.exe31⤵
- Executes dropped EXE
PID:1640 -
\??\c:\jjpjj.exec:\jjpjj.exe32⤵
- Executes dropped EXE
PID:2696 -
\??\c:\lxfxlrr.exec:\lxfxlrr.exe33⤵
- Executes dropped EXE
PID:3720 -
\??\c:\7ntnhh.exec:\7ntnhh.exe34⤵
- Executes dropped EXE
PID:1956 -
\??\c:\7dddv.exec:\7dddv.exe35⤵
- Executes dropped EXE
PID:4480 -
\??\c:\9pvpj.exec:\9pvpj.exe36⤵
- Executes dropped EXE
PID:4916 -
\??\c:\hhnhbt.exec:\hhnhbt.exe37⤵
- Executes dropped EXE
PID:1172 -
\??\c:\bttbtt.exec:\bttbtt.exe38⤵
- Executes dropped EXE
PID:1500 -
\??\c:\7djvj.exec:\7djvj.exe39⤵
- Executes dropped EXE
PID:2768 -
\??\c:\xffxrrl.exec:\xffxrrl.exe40⤵
- Executes dropped EXE
PID:1784 -
\??\c:\hhbnhh.exec:\hhbnhh.exe41⤵
- Executes dropped EXE
PID:2480 -
\??\c:\nnnhhb.exec:\nnnhhb.exe42⤵
- Executes dropped EXE
PID:4764 -
\??\c:\frrfrlf.exec:\frrfrlf.exe43⤵
- Executes dropped EXE
PID:996 -
\??\c:\tntntt.exec:\tntntt.exe44⤵
- Executes dropped EXE
PID:2884 -
\??\c:\5bhttn.exec:\5bhttn.exe45⤵
- Executes dropped EXE
PID:2980 -
\??\c:\pjppj.exec:\pjppj.exe46⤵
- Executes dropped EXE
PID:3056 -
\??\c:\vpvvv.exec:\vpvvv.exe47⤵
- Executes dropped EXE
PID:2312 -
\??\c:\xxxrrrr.exec:\xxxrrrr.exe48⤵
- Executes dropped EXE
PID:620 -
\??\c:\1llfflf.exec:\1llfflf.exe49⤵
- Executes dropped EXE
PID:4528 -
\??\c:\nbbtnh.exec:\nbbtnh.exe50⤵
- Executes dropped EXE
PID:2728 -
\??\c:\jppjv.exec:\jppjv.exe51⤵
- Executes dropped EXE
PID:1444 -
\??\c:\vjvpj.exec:\vjvpj.exe52⤵
- Executes dropped EXE
PID:4092 -
\??\c:\lfrlxxx.exec:\lfrlxxx.exe53⤵
- Executes dropped EXE
PID:2872 -
\??\c:\lxrfxxl.exec:\lxrfxxl.exe54⤵
- Executes dropped EXE
PID:3928 -
\??\c:\nbhhhh.exec:\nbhhhh.exe55⤵
- Executes dropped EXE
PID:4496 -
\??\c:\jvjjj.exec:\jvjjj.exe56⤵
- Executes dropped EXE
PID:4472 -
\??\c:\rllfxff.exec:\rllfxff.exe57⤵
- Executes dropped EXE
PID:2484 -
\??\c:\lffxrrr.exec:\lffxrrr.exe58⤵
- Executes dropped EXE
PID:4016 -
\??\c:\7hnhbb.exec:\7hnhbb.exe59⤵
- Executes dropped EXE
PID:912 -
\??\c:\bbhhnh.exec:\bbhhnh.exe60⤵
- Executes dropped EXE
PID:4384 -
\??\c:\jjpjd.exec:\jjpjd.exe61⤵
- Executes dropped EXE
PID:3420 -
\??\c:\vdppj.exec:\vdppj.exe62⤵
- Executes dropped EXE
PID:3000 -
\??\c:\3xxrlll.exec:\3xxrlll.exe63⤵
- Executes dropped EXE
PID:1604 -
\??\c:\rxrxfrr.exec:\rxrxfrr.exe64⤵
- Executes dropped EXE
PID:1524 -
\??\c:\httthh.exec:\httthh.exe65⤵
- Executes dropped EXE
PID:4028 -
\??\c:\vpdpd.exec:\vpdpd.exe66⤵PID:1256
-
\??\c:\frrlffx.exec:\frrlffx.exe67⤵PID:1528
-
\??\c:\5xfxxff.exec:\5xfxxff.exe68⤵PID:2804
-
\??\c:\thnnnt.exec:\thnnnt.exe69⤵PID:1816
-
\??\c:\bnnnhb.exec:\bnnnhb.exe70⤵PID:3276
-
\??\c:\vjvpj.exec:\vjvpj.exe71⤵PID:4196
-
\??\c:\7pjdp.exec:\7pjdp.exe72⤵PID:3628
-
\??\c:\rxxxxxx.exec:\rxxxxxx.exe73⤵PID:4404
-
\??\c:\3tnnht.exec:\3tnnht.exe74⤵PID:3844
-
\??\c:\thhbtn.exec:\thhbtn.exe75⤵PID:4700
-
\??\c:\vvvpv.exec:\vvvpv.exe76⤵PID:4756
-
\??\c:\rlffrlf.exec:\rlffrlf.exe77⤵PID:1172
-
\??\c:\7xxlffx.exec:\7xxlffx.exe78⤵PID:2992
-
\??\c:\nttntb.exec:\nttntb.exe79⤵PID:4908
-
\??\c:\9bbtbb.exec:\9bbtbb.exe80⤵PID:1420
-
\??\c:\jdjjp.exec:\jdjjp.exe81⤵PID:4080
-
\??\c:\xxfxrfx.exec:\xxfxrfx.exe82⤵PID:2608
-
\??\c:\5thnnb.exec:\5thnnb.exe83⤵PID:648
-
\??\c:\1bhbhh.exec:\1bhbhh.exe84⤵PID:4608
-
\??\c:\pjjdv.exec:\pjjdv.exe85⤵PID:2112
-
\??\c:\xrfxxrx.exec:\xrfxxrx.exe86⤵PID:2464
-
\??\c:\7tbttt.exec:\7tbttt.exe87⤵PID:4396
-
\??\c:\httbnb.exec:\httbnb.exe88⤵PID:4824
-
\??\c:\jdvpj.exec:\jdvpj.exe89⤵PID:5040
-
\??\c:\vvpdj.exec:\vvpdj.exe90⤵PID:4184
-
\??\c:\lrfrrlx.exec:\lrfrrlx.exe91⤵PID:620
-
\??\c:\tnhhht.exec:\tnhhht.exe92⤵PID:1648
-
\??\c:\7btnhb.exec:\7btnhb.exe93⤵PID:3708
-
\??\c:\jpppj.exec:\jpppj.exe94⤵PID:392
-
\??\c:\rxrlfff.exec:\rxrlfff.exe95⤵PID:3008
-
\??\c:\flxllfr.exec:\flxllfr.exe96⤵PID:1496
-
\??\c:\5ttnnn.exec:\5ttnnn.exe97⤵PID:5012
-
\??\c:\jddvd.exec:\jddvd.exe98⤵PID:2692
-
\??\c:\vpdvd.exec:\vpdvd.exe99⤵PID:5028
-
\??\c:\fxlflfl.exec:\fxlflfl.exe100⤵PID:1080
-
\??\c:\3tnbbt.exec:\3tnbbt.exe101⤵PID:3068
-
\??\c:\7btttt.exec:\7btttt.exe102⤵PID:1344
-
\??\c:\pjddd.exec:\pjddd.exe103⤵PID:4076
-
\??\c:\3lrrxfr.exec:\3lrrxfr.exe104⤵PID:3496
-
\??\c:\3llllff.exec:\3llllff.exe105⤵PID:2868
-
\??\c:\nhnbtt.exec:\nhnbtt.exe106⤵PID:1200
-
\??\c:\vjvjd.exec:\vjvjd.exe107⤵PID:3672
-
\??\c:\ffrxrrx.exec:\ffrxrrx.exe108⤵PID:3608
-
\??\c:\9rffxxx.exec:\9rffxxx.exe109⤵PID:3004
-
\??\c:\nhnhhn.exec:\nhnhhn.exe110⤵PID:4960
-
\??\c:\hbbtnn.exec:\hbbtnn.exe111⤵PID:3276
-
\??\c:\dpdvp.exec:\dpdvp.exe112⤵PID:1408
-
\??\c:\ppjjd.exec:\ppjjd.exe113⤵PID:3120
-
\??\c:\dvvjj.exec:\dvvjj.exe114⤵PID:2516
-
\??\c:\llrrxrx.exec:\llrrxrx.exe115⤵PID:4916
-
\??\c:\flxxffx.exec:\flxxffx.exe116⤵PID:4700
-
\??\c:\7dvpv.exec:\7dvpv.exe117⤵PID:4788
-
\??\c:\rrrxlrr.exec:\rrrxlrr.exe118⤵PID:3996
-
\??\c:\lfllrrf.exec:\lfllrrf.exe119⤵PID:4976
-
\??\c:\htthbh.exec:\htthbh.exe120⤵PID:1508
-
\??\c:\dddvp.exec:\dddvp.exe121⤵PID:540
-
\??\c:\vdjvj.exec:\vdjvj.exe122⤵PID:3116
-
\??\c:\rxflffl.exec:\rxflffl.exe123⤵PID:1456
-
\??\c:\lfllffx.exec:\lfllffx.exe124⤵PID:1668
-
\??\c:\3bbtnn.exec:\3bbtnn.exe125⤵PID:3636
-
\??\c:\vdjvp.exec:\vdjvp.exe126⤵PID:2684
-
\??\c:\jjjdp.exec:\jjjdp.exe127⤵PID:2396
-
\??\c:\5xrlfxf.exec:\5xrlfxf.exe128⤵PID:2312
-
\??\c:\hnnhhh.exec:\hnnhhh.exe129⤵PID:2904
-
\??\c:\nttnbt.exec:\nttnbt.exe130⤵PID:3724
-
\??\c:\3jjvj.exec:\3jjvj.exe131⤵PID:1220
-
\??\c:\dpjvv.exec:\dpjvv.exe132⤵PID:392
-
\??\c:\rrxrxfr.exec:\rrxrxfr.exe133⤵PID:1364
-
\??\c:\lxfxrll.exec:\lxfxrll.exe134⤵PID:2212
-
\??\c:\thntht.exec:\thntht.exe135⤵PID:1112
-
\??\c:\nhbnht.exec:\nhbnht.exe136⤵PID:4384
-
\??\c:\jvjdp.exec:\jvjdp.exe137⤵PID:4032
-
\??\c:\jdpjd.exec:\jdpjd.exe138⤵PID:4820
-
\??\c:\xxrlfrl.exec:\xxrlfrl.exe139⤵PID:3600
-
\??\c:\xfffrxl.exec:\xfffrxl.exe140⤵PID:816
-
\??\c:\9nnbtn.exec:\9nnbtn.exe141⤵PID:1528
-
\??\c:\hbnhnh.exec:\hbnhnh.exe142⤵PID:4212
-
\??\c:\pdjdp.exec:\pdjdp.exe143⤵PID:4084
-
\??\c:\pjpjj.exec:\pjpjj.exe144⤵PID:400
-
\??\c:\xlxrxxx.exec:\xlxrxxx.exe145⤵PID:4504
-
\??\c:\fllfxrf.exec:\fllfxrf.exe146⤵PID:3628
-
\??\c:\xrxrlfx.exec:\xrxrlfx.exe147⤵PID:1408
-
\??\c:\bbbhtb.exec:\bbbhtb.exe148⤵PID:4884
-
\??\c:\nhbttt.exec:\nhbttt.exe149⤵PID:2444
-
\??\c:\pdjvv.exec:\pdjvv.exe150⤵PID:1660
-
\??\c:\lxxfrrl.exec:\lxxfrrl.exe151⤵PID:384
-
\??\c:\5llrfxr.exec:\5llrfxr.exe152⤵PID:2160
-
\??\c:\9rrlffx.exec:\9rrlffx.exe153⤵PID:2280
-
\??\c:\1tthnh.exec:\1tthnh.exe154⤵PID:336
-
\??\c:\1ntnht.exec:\1ntnht.exe155⤵PID:3236
-
\??\c:\9pvvj.exec:\9pvvj.exe156⤵PID:2612
-
\??\c:\rxxlxrl.exec:\rxxlxrl.exe157⤵PID:4764
-
\??\c:\tbnhbh.exec:\tbnhbh.exe158⤵PID:3524
-
\??\c:\9nnhbt.exec:\9nnhbt.exe159⤵PID:5100
-
\??\c:\7hnhbb.exec:\7hnhbb.exe160⤵PID:2188
-
\??\c:\vvvjj.exec:\vvvjj.exe161⤵PID:5036
-
\??\c:\ddjdj.exec:\ddjdj.exe162⤵PID:2908
-
\??\c:\llflxrr.exec:\llflxrr.exe163⤵PID:4464
-
\??\c:\xlrrrrl.exec:\xlrrrrl.exe164⤵PID:1192
-
\??\c:\hnhtnn.exec:\hnhtnn.exe165⤵PID:4528
-
\??\c:\hbhhhh.exec:\hbhhhh.exe166⤵PID:2728
-
\??\c:\vdpjj.exec:\vdpjj.exe167⤵PID:2084
-
\??\c:\3dvpp.exec:\3dvpp.exe168⤵PID:4372
-
\??\c:\7rfxllf.exec:\7rfxllf.exe169⤵PID:2468
-
\??\c:\fxrfrlx.exec:\fxrfrlx.exe170⤵PID:1752
-
\??\c:\nbbbtt.exec:\nbbbtt.exe171⤵PID:4016
-
\??\c:\nbtnhb.exec:\nbtnhb.exe172⤵PID:1312
-
\??\c:\dpjdd.exec:\dpjdd.exe173⤵PID:3348
-
\??\c:\djpjd.exec:\djpjd.exe174⤵PID:2636
-
\??\c:\fxrxxxr.exec:\fxrxxxr.exe175⤵PID:2956
-
\??\c:\1lrllfr.exec:\1lrllfr.exe176⤵PID:712
-
\??\c:\tnbtbb.exec:\tnbtbb.exe177⤵PID:220
-
\??\c:\bhhbnt.exec:\bhhbnt.exe178⤵PID:3672
-
\??\c:\7btnbh.exec:\7btnbh.exe179⤵PID:2164
-
\??\c:\vjjjv.exec:\vjjjv.exe180⤵PID:1816
-
\??\c:\xxlxlxl.exec:\xxlxlxl.exe181⤵PID:2644
-
\??\c:\xxllfxl.exec:\xxllfxl.exe182⤵PID:2700
-
\??\c:\nnhntb.exec:\nnhntb.exe183⤵PID:4804
-
\??\c:\jvvpd.exec:\jvvpd.exe184⤵PID:2032
-
\??\c:\jvjvd.exec:\jvjvd.exe185⤵PID:2292
-
\??\c:\xlrlfxr.exec:\xlrlfxr.exe186⤵PID:1700
-
\??\c:\9rxrllf.exec:\9rxrllf.exe187⤵PID:1428
-
\??\c:\tthntt.exec:\tthntt.exe188⤵PID:448
-
\??\c:\bnbbtb.exec:\bnbbtb.exe189⤵PID:2736
-
\??\c:\jjdvj.exec:\jjdvj.exe190⤵PID:2248
-
\??\c:\9djdp.exec:\9djdp.exe191⤵PID:4112
-
\??\c:\9rlfrlf.exec:\9rlfrlf.exe192⤵PID:4684
-
\??\c:\3xlfxrl.exec:\3xlfxrl.exe193⤵PID:2244
-
\??\c:\bbbntb.exec:\bbbntb.exe194⤵PID:1880
-
\??\c:\tntthn.exec:\tntthn.exe195⤵PID:5032
-
\??\c:\jddvv.exec:\jddvv.exe196⤵PID:2608
-
\??\c:\dvvjj.exec:\dvvjj.exe197⤵PID:1096
-
\??\c:\1rlxrrl.exec:\1rlxrrl.exe198⤵PID:1684
-
\??\c:\rflflff.exec:\rflflff.exe199⤵PID:676
-
\??\c:\hbhbtt.exec:\hbhbtt.exe200⤵PID:4912
-
\??\c:\htnhbb.exec:\htnhbb.exe201⤵PID:4008
-
\??\c:\tnbnhb.exec:\tnbnhb.exe202⤵PID:1192
-
\??\c:\vddpj.exec:\vddpj.exe203⤵PID:4332
-
\??\c:\jdjvd.exec:\jdjvd.exe204⤵PID:1152
-
\??\c:\rrfxffl.exec:\rrfxffl.exe205⤵PID:4472
-
\??\c:\1rrlxrl.exec:\1rrlxrl.exe206⤵PID:2212
-
\??\c:\3bbthh.exec:\3bbthh.exe207⤵PID:1808
-
\??\c:\bhhhbb.exec:\bhhhbb.exe208⤵PID:2916
-
\??\c:\3bthtn.exec:\3bthtn.exe209⤵PID:4580
-
\??\c:\3vpjp.exec:\3vpjp.exe210⤵PID:4028
-
\??\c:\dvdvp.exec:\dvdvp.exe211⤵PID:2944
-
\??\c:\1llfxxr.exec:\1llfxxr.exe212⤵PID:1200
-
\??\c:\flfxllf.exec:\flfxllf.exe213⤵PID:1884
-
\??\c:\tbbttt.exec:\tbbttt.exe214⤵PID:1528
-
\??\c:\9bnhbt.exec:\9bnhbt.exe215⤵PID:4688
-
\??\c:\jjvpv.exec:\jjvpv.exe216⤵PID:2164
-
\??\c:\ddpjd.exec:\ddpjd.exe217⤵PID:1816
-
\??\c:\fxlfrlf.exec:\fxlfrlf.exe218⤵PID:2644
-
\??\c:\fllxrlf.exec:\fllxrlf.exe219⤵PID:4056
-
\??\c:\bnbtnh.exec:\bnbtnh.exe220⤵PID:740
-
\??\c:\hhthbn.exec:\hhthbn.exe221⤵PID:4456
-
\??\c:\1nnbtn.exec:\1nnbtn.exe222⤵PID:4916
-
\??\c:\jvdpd.exec:\jvdpd.exe223⤵PID:3120
-
\??\c:\rfrffxx.exec:\rfrffxx.exe224⤵PID:3984
-
\??\c:\rllxrlx.exec:\rllxrlx.exe225⤵PID:1452
-
\??\c:\lfxrlfx.exec:\lfxrlfx.exe226⤵PID:2068
-
\??\c:\9ttnbn.exec:\9ttnbn.exe227⤵PID:1420
-
\??\c:\ntntht.exec:\ntntht.exe228⤵PID:3912
-
\??\c:\jdpjd.exec:\jdpjd.exe229⤵PID:648
-
\??\c:\ddppd.exec:\ddppd.exe230⤵PID:1668
-
\??\c:\rllfrrl.exec:\rllfrrl.exe231⤵PID:4952
-
\??\c:\lfffrrf.exec:\lfffrrf.exe232⤵PID:2232
-
\??\c:\htnbnn.exec:\htnbnn.exe233⤵PID:4912
-
\??\c:\3hhbtt.exec:\3hhbtt.exe234⤵PID:3100
-
\??\c:\pdvjv.exec:\pdvjv.exe235⤵PID:1648
-
\??\c:\3jjdv.exec:\3jjdv.exe236⤵PID:4900
-
\??\c:\rxrfrfl.exec:\rxrfrfl.exe237⤵PID:2468
-
\??\c:\9ffxxxx.exec:\9ffxxxx.exe238⤵PID:3068
-
\??\c:\lrlxffl.exec:\lrlxffl.exe239⤵PID:2760
-
\??\c:\httnbb.exec:\httnbb.exe240⤵PID:4904
-
\??\c:\1btnhb.exec:\1btnhb.exe241⤵PID:2220
-
\??\c:\vjvpp.exec:\vjvpp.exe242⤵PID:808