Analysis
-
max time kernel
150s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 18:38
Behavioral task
behavioral1
Sample
2cac3e4945f62ba8bf2580e940e0bab0_NeikiAnalytics.exe
Resource
win7-20231129-en
General
-
Target
2cac3e4945f62ba8bf2580e940e0bab0_NeikiAnalytics.exe
-
Size
464KB
-
MD5
2cac3e4945f62ba8bf2580e940e0bab0
-
SHA1
67eb1d11b9e08fac5e58a7d0fa974be45220f458
-
SHA256
ec03ebfc883301f6edc58dd3a42d9c4f682c9f792b4557ebf9df7cbf4cc5a482
-
SHA512
9ebd0d8875220a18b68b1a5d106d1a125e1baf46a1a6d9bfd158c86042f61fb54c7ff91dfefdeef0d61b85c5d8ec58c2b0fba8d14046aa08aea5091a05a895f6
-
SSDEEP
12288:J4wFHoSTeR0oQRkay+eFp3IDvSbh5nPVP+OKaf1Va:VeR0oykayRFp3lztP+OKaf1Va
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/312-6-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4228-10-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3936-22-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2328-14-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/5108-37-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4340-31-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4828-30-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4772-49-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/5040-61-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1672-72-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/5044-74-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1956-63-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4896-89-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3932-97-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1904-96-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3008-107-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3044-112-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/376-127-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2288-136-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4116-167-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4864-194-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2396-207-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/624-209-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/776-213-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1336-212-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2852-185-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2296-162-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4380-161-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3280-139-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3148-121-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3996-224-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2696-236-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3320-235-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/444-246-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2872-250-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4756-254-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3428-262-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/664-279-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/5076-291-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1532-310-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4972-328-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4356-335-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4380-336-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/408-341-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1188-362-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2980-363-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2056-370-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1268-377-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2548-385-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3140-403-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4756-423-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/5028-435-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1264-445-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2332-471-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1580-493-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2732-497-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1056-514-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/768-520-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4764-539-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3952-556-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4948-612-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2116-707-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2908-790-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/5040-1112-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule behavioral2/memory/312-0-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\htnnnt.exe family_berbew behavioral2/memory/312-6-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4228-10-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\pppdp.exe family_berbew \??\c:\djjjv.exe family_berbew \??\c:\xxflrxx.exe family_berbew \??\c:\hnnbtn.exe family_berbew behavioral2/memory/3936-22-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2328-14-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\vdvjv.exe family_berbew behavioral2/memory/5108-37-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4340-31-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4828-30-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\fflffrr.exe family_berbew behavioral2/memory/4772-43-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\dddjj.exe family_berbew behavioral2/memory/4772-49-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/5040-54-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\ffllrxr.exe family_berbew C:\vpvvd.exe family_berbew behavioral2/memory/5040-61-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\xfflrxf.exe family_berbew behavioral2/memory/1672-72-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\nbbbbb.exe family_berbew behavioral2/memory/5044-74-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/1956-63-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\jjddv.exe family_berbew C:\fxlrfff.exe family_berbew behavioral2/memory/4896-89-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\9pjjp.exe family_berbew C:\9bbbtb.exe family_berbew behavioral2/memory/3932-97-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/1904-96-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\7vdpp.exe family_berbew C:\vpddj.exe family_berbew behavioral2/memory/3008-107-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\3xllflf.exe family_berbew behavioral2/memory/3044-112-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\tnnntt.exe family_berbew C:\pjjpv.exe family_berbew behavioral2/memory/376-127-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\llllxff.exe family_berbew C:\dpdvd.exe family_berbew behavioral2/memory/2288-136-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\rrxffrx.exe family_berbew \??\c:\9dppv.exe family_berbew C:\xxxffxl.exe family_berbew behavioral2/memory/4116-167-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\9hhhhn.exe family_berbew \??\c:\vvvdd.exe family_berbew behavioral2/memory/4864-194-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2396-207-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/624-209-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/776-213-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/1336-212-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2852-185-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\tbtttb.exe family_berbew \??\c:\tbttbb.exe family_berbew behavioral2/memory/2296-162-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4380-161-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\ppvvv.exe family_berbew \??\c:\lfllrxf.exe family_berbew behavioral2/memory/3280-139-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
Processes:
htnnnt.exepppdp.exedjjjv.exexxflrxx.exehnnbtn.exevdvjv.exefflffrr.exedddjj.exeffllrxr.exevpvvd.exexfflrxf.exenbbbbb.exejjddv.exefxlrfff.exe9pjjp.exe9bbbtb.exe7vdpp.exevpddj.exe3xllflf.exetnnntt.exepjjpv.exellllxff.exedpdvd.exerrxffrx.exelfllrxf.exeppvvv.exe9dppv.exexxxffxl.exe9hhhhn.exetbttbb.exetbtttb.exevvvdd.exerlxxxxx.exellxxxfx.exe3bbbhh.exejdddp.exerxxfrxx.exenhtbth.exedjvdj.exevvdjp.exelrrxxfx.exebhhhhn.exepvjdv.exe1rlrxfr.exebtnhth.exeddpjd.exexllfrff.exebhhbtn.exejdpvv.exelfrrxxx.exettbbbb.exejdpjj.exelfrflrx.exe1xfffll.exettnbbh.exevdppj.exerlxxlrf.exerlxxffr.exe1bhhbh.exevpjjd.exerrrxxfl.exebbtbth.exejjjjv.exelxlrxrl.exepid process 4228 htnnnt.exe 2328 pppdp.exe 3936 djjjv.exe 4828 xxflrxx.exe 4340 hnnbtn.exe 5108 vdvjv.exe 4772 fflffrr.exe 2640 dddjj.exe 5040 ffllrxr.exe 1956 vpvvd.exe 1672 xfflrxf.exe 5044 nbbbbb.exe 4308 jjddv.exe 4896 fxlrfff.exe 3932 9pjjp.exe 1904 9bbbtb.exe 3008 7vdpp.exe 3044 vpddj.exe 3148 3xllflf.exe 376 tnnntt.exe 1716 pjjpv.exe 2288 llllxff.exe 3280 dpdvd.exe 4496 rrxffrx.exe 4380 lfllrxf.exe 4032 ppvvv.exe 2296 9dppv.exe 4116 xxxffxl.exe 1844 9hhhhn.exe 2852 tbttbb.exe 4464 tbtttb.exe 4864 vvvdd.exe 2360 rlxxxxx.exe 1188 llxxxfx.exe 2292 3bbbhh.exe 2396 jdddp.exe 1336 rxxfrxx.exe 624 nhtbth.exe 776 djvdj.exe 2068 vvdjp.exe 3996 lrrxxfx.exe 4448 bhhhhn.exe 1180 pvjdv.exe 3320 1rlrxfr.exe 2696 btnhth.exe 4596 ddpjd.exe 444 xllfrff.exe 2872 bhhbtn.exe 4756 jdpvv.exe 972 lfrrxxx.exe 1312 ttbbbb.exe 3428 jdpjj.exe 4540 lfrflrx.exe 5040 1xfffll.exe 4984 ttnbbh.exe 664 vdppj.exe 3832 rlxxlrf.exe 5044 rlxxffr.exe 396 1bhhbh.exe 5076 vpjjd.exe 4068 rrrxxfl.exe 3932 bbtbth.exe 1904 jjjjv.exe 2876 lxlrxrl.exe -
Processes:
resource yara_rule behavioral2/memory/312-0-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\htnnnt.exe upx behavioral2/memory/312-6-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4228-10-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\pppdp.exe upx \??\c:\djjjv.exe upx \??\c:\xxflrxx.exe upx \??\c:\hnnbtn.exe upx behavioral2/memory/3936-22-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2328-14-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\vdvjv.exe upx behavioral2/memory/5108-37-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4340-31-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4828-30-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\fflffrr.exe upx behavioral2/memory/4772-43-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\dddjj.exe upx behavioral2/memory/4772-49-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/5040-54-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\ffllrxr.exe upx C:\vpvvd.exe upx behavioral2/memory/5040-61-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\xfflrxf.exe upx behavioral2/memory/1672-72-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\nbbbbb.exe upx behavioral2/memory/5044-74-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/1956-63-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\jjddv.exe upx C:\fxlrfff.exe upx behavioral2/memory/4896-89-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\9pjjp.exe upx C:\9bbbtb.exe upx behavioral2/memory/3932-97-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/1904-96-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\7vdpp.exe upx C:\vpddj.exe upx behavioral2/memory/3008-107-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\3xllflf.exe upx behavioral2/memory/3044-112-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\tnnntt.exe upx C:\pjjpv.exe upx behavioral2/memory/376-127-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\llllxff.exe upx C:\dpdvd.exe upx behavioral2/memory/2288-136-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\rrxffrx.exe upx \??\c:\9dppv.exe upx C:\xxxffxl.exe upx behavioral2/memory/4116-167-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\9hhhhn.exe upx \??\c:\vvvdd.exe upx behavioral2/memory/4864-194-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2396-207-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/624-209-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/776-213-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/1336-212-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2852-185-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\tbtttb.exe upx \??\c:\tbttbb.exe upx behavioral2/memory/2296-162-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4380-161-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\ppvvv.exe upx \??\c:\lfllrxf.exe upx behavioral2/memory/3280-139-0x0000000000400000-0x000000000043A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2cac3e4945f62ba8bf2580e940e0bab0_NeikiAnalytics.exehtnnnt.exepppdp.exedjjjv.exexxflrxx.exehnnbtn.exevdvjv.exefflffrr.exedddjj.exeffllrxr.exevpvvd.exexfflrxf.exenbbbbb.exejjddv.exefxlrfff.exe9pjjp.exe9bbbtb.exe7vdpp.exevpddj.exe3xllflf.exetnnntt.exepjjpv.exedescription pid process target process PID 312 wrote to memory of 4228 312 2cac3e4945f62ba8bf2580e940e0bab0_NeikiAnalytics.exe htnnnt.exe PID 312 wrote to memory of 4228 312 2cac3e4945f62ba8bf2580e940e0bab0_NeikiAnalytics.exe htnnnt.exe PID 312 wrote to memory of 4228 312 2cac3e4945f62ba8bf2580e940e0bab0_NeikiAnalytics.exe htnnnt.exe PID 4228 wrote to memory of 2328 4228 htnnnt.exe pppdp.exe PID 4228 wrote to memory of 2328 4228 htnnnt.exe pppdp.exe PID 4228 wrote to memory of 2328 4228 htnnnt.exe pppdp.exe PID 2328 wrote to memory of 3936 2328 pppdp.exe djjjv.exe PID 2328 wrote to memory of 3936 2328 pppdp.exe djjjv.exe PID 2328 wrote to memory of 3936 2328 pppdp.exe djjjv.exe PID 3936 wrote to memory of 4828 3936 djjjv.exe xxflrxx.exe PID 3936 wrote to memory of 4828 3936 djjjv.exe xxflrxx.exe PID 3936 wrote to memory of 4828 3936 djjjv.exe xxflrxx.exe PID 4828 wrote to memory of 4340 4828 xxflrxx.exe hnnbtn.exe PID 4828 wrote to memory of 4340 4828 xxflrxx.exe hnnbtn.exe PID 4828 wrote to memory of 4340 4828 xxflrxx.exe hnnbtn.exe PID 4340 wrote to memory of 5108 4340 hnnbtn.exe vdvjv.exe PID 4340 wrote to memory of 5108 4340 hnnbtn.exe vdvjv.exe PID 4340 wrote to memory of 5108 4340 hnnbtn.exe vdvjv.exe PID 5108 wrote to memory of 4772 5108 vdvjv.exe fflffrr.exe PID 5108 wrote to memory of 4772 5108 vdvjv.exe fflffrr.exe PID 5108 wrote to memory of 4772 5108 vdvjv.exe fflffrr.exe PID 4772 wrote to memory of 2640 4772 fflffrr.exe dddjj.exe PID 4772 wrote to memory of 2640 4772 fflffrr.exe dddjj.exe PID 4772 wrote to memory of 2640 4772 fflffrr.exe dddjj.exe PID 2640 wrote to memory of 5040 2640 dddjj.exe ffllrxr.exe PID 2640 wrote to memory of 5040 2640 dddjj.exe ffllrxr.exe PID 2640 wrote to memory of 5040 2640 dddjj.exe ffllrxr.exe PID 5040 wrote to memory of 1956 5040 ffllrxr.exe vpvvd.exe PID 5040 wrote to memory of 1956 5040 ffllrxr.exe vpvvd.exe PID 5040 wrote to memory of 1956 5040 ffllrxr.exe vpvvd.exe PID 1956 wrote to memory of 1672 1956 vpvvd.exe xfflrxf.exe PID 1956 wrote to memory of 1672 1956 vpvvd.exe xfflrxf.exe PID 1956 wrote to memory of 1672 1956 vpvvd.exe xfflrxf.exe PID 1672 wrote to memory of 5044 1672 xfflrxf.exe nbbbbb.exe PID 1672 wrote to memory of 5044 1672 xfflrxf.exe nbbbbb.exe PID 1672 wrote to memory of 5044 1672 xfflrxf.exe nbbbbb.exe PID 5044 wrote to memory of 4308 5044 nbbbbb.exe jjddv.exe PID 5044 wrote to memory of 4308 5044 nbbbbb.exe jjddv.exe PID 5044 wrote to memory of 4308 5044 nbbbbb.exe jjddv.exe PID 4308 wrote to memory of 4896 4308 jjddv.exe fxlrfff.exe PID 4308 wrote to memory of 4896 4308 jjddv.exe fxlrfff.exe PID 4308 wrote to memory of 4896 4308 jjddv.exe fxlrfff.exe PID 4896 wrote to memory of 3932 4896 fxlrfff.exe 9pjjp.exe PID 4896 wrote to memory of 3932 4896 fxlrfff.exe 9pjjp.exe PID 4896 wrote to memory of 3932 4896 fxlrfff.exe 9pjjp.exe PID 3932 wrote to memory of 1904 3932 9pjjp.exe 9bbbtb.exe PID 3932 wrote to memory of 1904 3932 9pjjp.exe 9bbbtb.exe PID 3932 wrote to memory of 1904 3932 9pjjp.exe 9bbbtb.exe PID 1904 wrote to memory of 3008 1904 9bbbtb.exe 7vdpp.exe PID 1904 wrote to memory of 3008 1904 9bbbtb.exe 7vdpp.exe PID 1904 wrote to memory of 3008 1904 9bbbtb.exe 7vdpp.exe PID 3008 wrote to memory of 3044 3008 7vdpp.exe vpddj.exe PID 3008 wrote to memory of 3044 3008 7vdpp.exe vpddj.exe PID 3008 wrote to memory of 3044 3008 7vdpp.exe vpddj.exe PID 3044 wrote to memory of 3148 3044 vpddj.exe 3xllflf.exe PID 3044 wrote to memory of 3148 3044 vpddj.exe 3xllflf.exe PID 3044 wrote to memory of 3148 3044 vpddj.exe 3xllflf.exe PID 3148 wrote to memory of 376 3148 3xllflf.exe tnnntt.exe PID 3148 wrote to memory of 376 3148 3xllflf.exe tnnntt.exe PID 3148 wrote to memory of 376 3148 3xllflf.exe tnnntt.exe PID 376 wrote to memory of 1716 376 tnnntt.exe pjjpv.exe PID 376 wrote to memory of 1716 376 tnnntt.exe pjjpv.exe PID 376 wrote to memory of 1716 376 tnnntt.exe pjjpv.exe PID 1716 wrote to memory of 2288 1716 pjjpv.exe llllxff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cac3e4945f62ba8bf2580e940e0bab0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2cac3e4945f62ba8bf2580e940e0bab0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:312 -
\??\c:\htnnnt.exec:\htnnnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\pppdp.exec:\pppdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\djjjv.exec:\djjjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\xxflrxx.exec:\xxflrxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\hnnbtn.exec:\hnnbtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\vdvjv.exec:\vdvjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\fflffrr.exec:\fflffrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\dddjj.exec:\dddjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\ffllrxr.exec:\ffllrxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\vpvvd.exec:\vpvvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\xfflrxf.exec:\xfflrxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\nbbbbb.exec:\nbbbbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\jjddv.exec:\jjddv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\fxlrfff.exec:\fxlrfff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\9pjjp.exec:\9pjjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\9bbbtb.exec:\9bbbtb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\7vdpp.exec:\7vdpp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\vpddj.exec:\vpddj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\3xllflf.exec:\3xllflf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\tnnntt.exec:\tnnntt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\pjjpv.exec:\pjjpv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\llllxff.exec:\llllxff.exe23⤵
- Executes dropped EXE
PID:2288 -
\??\c:\dpdvd.exec:\dpdvd.exe24⤵
- Executes dropped EXE
PID:3280 -
\??\c:\rrxffrx.exec:\rrxffrx.exe25⤵
- Executes dropped EXE
PID:4496 -
\??\c:\lfllrxf.exec:\lfllrxf.exe26⤵
- Executes dropped EXE
PID:4380 -
\??\c:\ppvvv.exec:\ppvvv.exe27⤵
- Executes dropped EXE
PID:4032 -
\??\c:\9dppv.exec:\9dppv.exe28⤵
- Executes dropped EXE
PID:2296 -
\??\c:\xxxffxl.exec:\xxxffxl.exe29⤵
- Executes dropped EXE
PID:4116 -
\??\c:\9hhhhn.exec:\9hhhhn.exe30⤵
- Executes dropped EXE
PID:1844 -
\??\c:\tbttbb.exec:\tbttbb.exe31⤵
- Executes dropped EXE
PID:2852 -
\??\c:\tbtttb.exec:\tbtttb.exe32⤵
- Executes dropped EXE
PID:4464 -
\??\c:\vvvdd.exec:\vvvdd.exe33⤵
- Executes dropped EXE
PID:4864 -
\??\c:\rlxxxxx.exec:\rlxxxxx.exe34⤵
- Executes dropped EXE
PID:2360 -
\??\c:\llxxxfx.exec:\llxxxfx.exe35⤵
- Executes dropped EXE
PID:1188 -
\??\c:\3bbbhh.exec:\3bbbhh.exe36⤵
- Executes dropped EXE
PID:2292 -
\??\c:\jdddp.exec:\jdddp.exe37⤵
- Executes dropped EXE
PID:2396 -
\??\c:\rxxfrxx.exec:\rxxfrxx.exe38⤵
- Executes dropped EXE
PID:1336 -
\??\c:\nhtbth.exec:\nhtbth.exe39⤵
- Executes dropped EXE
PID:624 -
\??\c:\djvdj.exec:\djvdj.exe40⤵
- Executes dropped EXE
PID:776 -
\??\c:\vvdjp.exec:\vvdjp.exe41⤵
- Executes dropped EXE
PID:2068 -
\??\c:\lrrxxfx.exec:\lrrxxfx.exe42⤵
- Executes dropped EXE
PID:3996 -
\??\c:\bhhhhn.exec:\bhhhhn.exe43⤵
- Executes dropped EXE
PID:4448 -
\??\c:\pvjdv.exec:\pvjdv.exe44⤵
- Executes dropped EXE
PID:1180 -
\??\c:\1rlrxfr.exec:\1rlrxfr.exe45⤵
- Executes dropped EXE
PID:3320 -
\??\c:\btnhth.exec:\btnhth.exe46⤵
- Executes dropped EXE
PID:2696 -
\??\c:\ddpjd.exec:\ddpjd.exe47⤵
- Executes dropped EXE
PID:4596 -
\??\c:\xllfrff.exec:\xllfrff.exe48⤵
- Executes dropped EXE
PID:444 -
\??\c:\bhhbtn.exec:\bhhbtn.exe49⤵
- Executes dropped EXE
PID:2872 -
\??\c:\jdpvv.exec:\jdpvv.exe50⤵
- Executes dropped EXE
PID:4756 -
\??\c:\lfrrxxx.exec:\lfrrxxx.exe51⤵
- Executes dropped EXE
PID:972 -
\??\c:\ttbbbb.exec:\ttbbbb.exe52⤵
- Executes dropped EXE
PID:1312 -
\??\c:\jdpjj.exec:\jdpjj.exe53⤵
- Executes dropped EXE
PID:3428 -
\??\c:\lfrflrx.exec:\lfrflrx.exe54⤵
- Executes dropped EXE
PID:4540 -
\??\c:\1xfffll.exec:\1xfffll.exe55⤵
- Executes dropped EXE
PID:5040 -
\??\c:\ttnbbh.exec:\ttnbbh.exe56⤵
- Executes dropped EXE
PID:4984 -
\??\c:\vdppj.exec:\vdppj.exe57⤵
- Executes dropped EXE
PID:664 -
\??\c:\rlxxlrf.exec:\rlxxlrf.exe58⤵
- Executes dropped EXE
PID:3832 -
\??\c:\rlxxffr.exec:\rlxxffr.exe59⤵
- Executes dropped EXE
PID:5044 -
\??\c:\1bhhbh.exec:\1bhhbh.exe60⤵
- Executes dropped EXE
PID:396 -
\??\c:\vpjjd.exec:\vpjjd.exe61⤵
- Executes dropped EXE
PID:5076 -
\??\c:\rrrxxfl.exec:\rrrxxfl.exe62⤵
- Executes dropped EXE
PID:4068 -
\??\c:\bbtbth.exec:\bbtbth.exe63⤵
- Executes dropped EXE
PID:3932 -
\??\c:\jjjjv.exec:\jjjjv.exe64⤵
- Executes dropped EXE
PID:1904 -
\??\c:\lxlrxrl.exec:\lxlrxrl.exe65⤵
- Executes dropped EXE
PID:2876 -
\??\c:\tnthtt.exec:\tnthtt.exe66⤵PID:4516
-
\??\c:\dpjjj.exec:\dpjjj.exe67⤵PID:1532
-
\??\c:\vjjvj.exec:\vjjvj.exe68⤵PID:3148
-
\??\c:\lfrxrxx.exec:\lfrxrxx.exe69⤵PID:3016
-
\??\c:\9tnntb.exec:\9tnntb.exe70⤵PID:2636
-
\??\c:\7dppp.exec:\7dppp.exe71⤵PID:4844
-
\??\c:\djddd.exec:\djddd.exe72⤵PID:4972
-
\??\c:\flfxxrr.exec:\flfxxrr.exe73⤵PID:4920
-
\??\c:\bhbttb.exec:\bhbttb.exe74⤵PID:4356
-
\??\c:\ffxlffl.exec:\ffxlffl.exe75⤵PID:4380
-
\??\c:\ppddj.exec:\ppddj.exe76⤵PID:408
-
\??\c:\1lrrrxx.exec:\1lrrrxx.exe77⤵PID:2600
-
\??\c:\9lfflrl.exec:\9lfflrl.exe78⤵PID:2660
-
\??\c:\5nnnnt.exec:\5nnnnt.exe79⤵PID:4464
-
\??\c:\jvddd.exec:\jvddd.exe80⤵PID:3384
-
\??\c:\fxrlxfl.exec:\fxrlxfl.exe81⤵PID:5060
-
\??\c:\btttbb.exec:\btttbb.exe82⤵PID:1188
-
\??\c:\5jdjj.exec:\5jdjj.exe83⤵PID:2980
-
\??\c:\vddvp.exec:\vddvp.exe84⤵PID:2056
-
\??\c:\hhbbnt.exec:\hhbbnt.exe85⤵PID:2244
-
\??\c:\vjpjv.exec:\vjpjv.exe86⤵PID:1268
-
\??\c:\xxlllrr.exec:\xxlllrr.exe87⤵PID:1304
-
\??\c:\nhbbbn.exec:\nhbbbn.exe88⤵PID:1416
-
\??\c:\pvddv.exec:\pvddv.exe89⤵PID:2548
-
\??\c:\jpvvp.exec:\jpvvp.exe90⤵PID:1780
-
\??\c:\frxffff.exec:\frxffff.exe91⤵PID:4000
-
\??\c:\1bhnnt.exec:\1bhnnt.exe92⤵PID:1300
-
\??\c:\lxrrxxf.exec:\lxrrxxf.exe93⤵PID:668
-
\??\c:\9ntnhn.exec:\9ntnhn.exe94⤵PID:3140
-
\??\c:\pvjjd.exec:\pvjjd.exe95⤵PID:2480
-
\??\c:\rlxxrxl.exec:\rlxxrxl.exe96⤵PID:4524
-
\??\c:\ffrrrrr.exec:\ffrrrrr.exe97⤵PID:2172
-
\??\c:\9nnhhh.exec:\9nnhhh.exe98⤵PID:5104
-
\??\c:\vjvvv.exec:\vjvvv.exe99⤵PID:3952
-
\??\c:\rrxrxlf.exec:\rrxrxlf.exe100⤵PID:2872
-
\??\c:\xxlxfll.exec:\xxlxfll.exe101⤵PID:4756
-
\??\c:\hhhttn.exec:\hhhttn.exe102⤵PID:4772
-
\??\c:\dpvdv.exec:\dpvdv.exe103⤵PID:2412
-
\??\c:\rllllrr.exec:\rllllrr.exe104⤵PID:5028
-
\??\c:\5lrrrll.exec:\5lrrrll.exe105⤵PID:3800
-
\??\c:\bbbbtb.exec:\bbbbtb.exe106⤵PID:1956
-
\??\c:\vdjpd.exec:\vdjpd.exe107⤵PID:1264
-
\??\c:\xrrrffx.exec:\xrrrffx.exe108⤵PID:4968
-
\??\c:\hnbbtb.exec:\hnbbtb.exe109⤵PID:1648
-
\??\c:\jdjjj.exec:\jdjjj.exe110⤵PID:2960
-
\??\c:\jjddv.exec:\jjddv.exe111⤵PID:4752
-
\??\c:\7lrxxff.exec:\7lrxxff.exe112⤵PID:460
-
\??\c:\btnttt.exec:\btnttt.exe113⤵PID:1164
-
\??\c:\3hnnnn.exec:\3hnnnn.exe114⤵PID:3148
-
\??\c:\vvjjj.exec:\vvjjj.exe115⤵PID:2332
-
\??\c:\lfrrrrl.exec:\lfrrrrl.exe116⤵PID:760
-
\??\c:\nhnntb.exec:\nhnntb.exe117⤵PID:4972
-
\??\c:\jdppj.exec:\jdppj.exe118⤵PID:3468
-
\??\c:\lxrrrlr.exec:\lxrrrlr.exe119⤵PID:5024
-
\??\c:\hbnttb.exec:\hbnttb.exe120⤵PID:1860
-
\??\c:\vvdvp.exec:\vvdvp.exe121⤵PID:3180
-
\??\c:\xrrrxff.exec:\xrrrxff.exe122⤵PID:2600
-
\??\c:\nnnnnt.exec:\nnnnnt.exe123⤵PID:1580
-
\??\c:\5hnntb.exec:\5hnntb.exe124⤵PID:2732
-
\??\c:\pdddj.exec:\pdddj.exe125⤵PID:2016
-
\??\c:\rllllll.exec:\rllllll.exe126⤵PID:2484
-
\??\c:\hbbbht.exec:\hbbbht.exe127⤵PID:1388
-
\??\c:\hnbhht.exec:\hnbhht.exe128⤵PID:3788
-
\??\c:\pdvvv.exec:\pdvvv.exe129⤵PID:1056
-
\??\c:\rlxrxll.exec:\rlxrxll.exe130⤵PID:768
-
\??\c:\nttbhb.exec:\nttbhb.exe131⤵PID:3460
-
\??\c:\vddjj.exec:\vddjj.exe132⤵PID:2908
-
\??\c:\dvdjv.exec:\dvdjv.exe133⤵PID:1460
-
\??\c:\nhtntt.exec:\nhtntt.exe134⤵PID:2068
-
\??\c:\djddp.exec:\djddp.exe135⤵PID:1876
-
\??\c:\dvjjp.exec:\dvjjp.exe136⤵PID:1300
-
\??\c:\flxfxff.exec:\flxfxff.exe137⤵PID:4764
-
\??\c:\tntttt.exec:\tntttt.exe138⤵PID:4452
-
\??\c:\jjddv.exec:\jjddv.exe139⤵PID:4816
-
\??\c:\lrlflll.exec:\lrlflll.exe140⤵PID:4524
-
\??\c:\nbnnnn.exec:\nbnnnn.exe141⤵PID:4760
-
\??\c:\fllrrxf.exec:\fllrrxf.exe142⤵PID:3952
-
\??\c:\tttttb.exec:\tttttb.exe143⤵PID:1552
-
\??\c:\hnthht.exec:\hnthht.exe144⤵PID:1312
-
\??\c:\1jvvp.exec:\1jvvp.exe145⤵PID:2728
-
\??\c:\nhhbbh.exec:\nhhbbh.exe146⤵PID:3648
-
\??\c:\3dppv.exec:\3dppv.exe147⤵PID:4964
-
\??\c:\pdppv.exec:\pdppv.exe148⤵PID:2000
-
\??\c:\lrxxxxx.exec:\lrxxxxx.exe149⤵PID:2116
-
\??\c:\nbtttn.exec:\nbtttn.exe150⤵PID:4480
-
\??\c:\bbbhhn.exec:\bbbhhn.exe151⤵PID:1648
-
\??\c:\djvdd.exec:\djvdd.exe152⤵PID:4384
-
\??\c:\fxlfrrx.exec:\fxlfrrx.exe153⤵PID:4752
-
\??\c:\xlxlfff.exec:\xlxlfff.exe154⤵PID:672
-
\??\c:\bhbhtn.exec:\bhbhtn.exe155⤵PID:2188
-
\??\c:\jdjdd.exec:\jdjdd.exe156⤵PID:3148
-
\??\c:\lllrflr.exec:\lllrflr.exe157⤵PID:3116
-
\??\c:\tthhhb.exec:\tthhhb.exe158⤵PID:1660
-
\??\c:\nnnnnn.exec:\nnnnnn.exe159⤵PID:4948
-
\??\c:\pjvjj.exec:\pjvjj.exe160⤵PID:4980
-
\??\c:\frllrxr.exec:\frllrxr.exe161⤵PID:4380
-
\??\c:\nhnntb.exec:\nhnntb.exe162⤵PID:4264
-
\??\c:\jdddj.exec:\jdddj.exe163⤵PID:3580
-
\??\c:\ffxxlrx.exec:\ffxxlrx.exe164⤵PID:2320
-
\??\c:\flfflrx.exec:\flfflrx.exe165⤵PID:3332
-
\??\c:\9tnnnh.exec:\9tnnnh.exe166⤵PID:3576
-
\??\c:\vpddj.exec:\vpddj.exe167⤵PID:2912
-
\??\c:\xxfxllx.exec:\xxfxllx.exe168⤵PID:1812
-
\??\c:\xxxxllr.exec:\xxxxllr.exe169⤵PID:5060
-
\??\c:\hnnnnt.exec:\hnnnnt.exe170⤵PID:5100
-
\??\c:\vpjjj.exec:\vpjjj.exe171⤵PID:896
-
\??\c:\xrxxxff.exec:\xrxxxff.exe172⤵PID:3564
-
\??\c:\1flrxff.exec:\1flrxff.exe173⤵PID:1168
-
\??\c:\hhhhhh.exec:\hhhhhh.exe174⤵PID:1416
-
\??\c:\9jjpj.exec:\9jjpj.exe175⤵PID:4240
-
\??\c:\dvjjp.exec:\dvjjp.exe176⤵PID:4448
-
\??\c:\xfxffxl.exec:\xfxffxl.exe177⤵PID:1300
-
\??\c:\bbnnnt.exec:\bbnnnt.exe178⤵PID:4764
-
\??\c:\jjvpp.exec:\jjvpp.exe179⤵PID:4452
-
\??\c:\3vddv.exec:\3vddv.exe180⤵PID:444
-
\??\c:\1xrrrrr.exec:\1xrrrrr.exe181⤵PID:4524
-
\??\c:\ttbtnb.exec:\ttbtnb.exe182⤵PID:4760
-
\??\c:\vjpjp.exec:\vjpjp.exe183⤵PID:2976
-
\??\c:\jvppd.exec:\jvppd.exe184⤵PID:1620
-
\??\c:\xflrrrr.exec:\xflrrrr.exe185⤵PID:2196
-
\??\c:\ttbbhh.exec:\ttbbhh.exe186⤵PID:2728
-
\??\c:\9pvvv.exec:\9pvvv.exe187⤵PID:1672
-
\??\c:\vvppp.exec:\vvppp.exe188⤵PID:5032
-
\??\c:\xrfxxfx.exec:\xrfxxfx.exe189⤵PID:2116
-
\??\c:\hbntbb.exec:\hbntbb.exe190⤵PID:2960
-
\??\c:\tnbbbt.exec:\tnbbbt.exe191⤵PID:1648
-
\??\c:\dvddj.exec:\dvddj.exe192⤵PID:460
-
\??\c:\lflxrrr.exec:\lflxrrr.exe193⤵PID:1008
-
\??\c:\xlrrlfr.exec:\xlrrlfr.exe194⤵PID:672
-
\??\c:\btnnhh.exec:\btnnhh.exe195⤵PID:2332
-
\??\c:\1pdpp.exec:\1pdpp.exe196⤵PID:3148
-
\??\c:\djppp.exec:\djppp.exe197⤵PID:4332
-
\??\c:\xfrlxfl.exec:\xfrlxfl.exe198⤵PID:1660
-
\??\c:\ttbbhh.exec:\ttbbhh.exe199⤵PID:4948
-
\??\c:\1thhhn.exec:\1thhhn.exe200⤵PID:4136
-
\??\c:\vdppp.exec:\vdppp.exe201⤵PID:1860
-
\??\c:\fffffll.exec:\fffffll.exe202⤵PID:2324
-
\??\c:\7lrrrxf.exec:\7lrrrxf.exe203⤵PID:4612
-
\??\c:\hbbbtt.exec:\hbbbtt.exe204⤵PID:1664
-
\??\c:\pjvdp.exec:\pjvdp.exe205⤵PID:2732
-
\??\c:\jpppp.exec:\jpppp.exe206⤵PID:4512
-
\??\c:\bntttt.exec:\bntttt.exe207⤵PID:4748
-
\??\c:\9vjjj.exec:\9vjjj.exe208⤵PID:1976
-
\??\c:\dvddv.exec:\dvddv.exe209⤵PID:3788
-
\??\c:\fxrrffr.exec:\fxrrffr.exe210⤵PID:3428
-
\??\c:\1xffxff.exec:\1xffxff.exe211⤵PID:4940
-
\??\c:\hbhhnt.exec:\hbhhnt.exe212⤵PID:4608
-
\??\c:\pdjjj.exec:\pdjjj.exe213⤵PID:2280
-
\??\c:\5ffllll.exec:\5ffllll.exe214⤵PID:1920
-
\??\c:\bbhhbh.exec:\bbhhbh.exe215⤵PID:2908
-
\??\c:\pppjp.exec:\pppjp.exe216⤵PID:4960
-
\??\c:\flffxff.exec:\flffxff.exe217⤵PID:4000
-
\??\c:\rrxllrr.exec:\rrxllrr.exe218⤵PID:4372
-
\??\c:\bbnbbt.exec:\bbnbbt.exe219⤵PID:1180
-
\??\c:\pppdd.exec:\pppdd.exe220⤵PID:1248
-
\??\c:\rlllllf.exec:\rlllllf.exe221⤵PID:4420
-
\??\c:\xlxxxfx.exec:\xlxxxfx.exe222⤵PID:2856
-
\??\c:\bhnthn.exec:\bhnthn.exe223⤵PID:5104
-
\??\c:\jjvvv.exec:\jjvvv.exe224⤵PID:1144
-
\??\c:\vjvvv.exec:\vjvvv.exe225⤵PID:3952
-
\??\c:\rxlrfrf.exec:\rxlrfrf.exe226⤵PID:2252
-
\??\c:\9hnttt.exec:\9hnttt.exe227⤵PID:2640
-
\??\c:\dddpd.exec:\dddpd.exe228⤵PID:3964
-
\??\c:\5rllrxl.exec:\5rllrxl.exe229⤵PID:1692
-
\??\c:\9ttttb.exec:\9ttttb.exe230⤵PID:3856
-
\??\c:\ppvvv.exec:\ppvvv.exe231⤵PID:5044
-
\??\c:\jpddd.exec:\jpddd.exe232⤵PID:3928
-
\??\c:\lfrrxfx.exec:\lfrrxfx.exe233⤵PID:2116
-
\??\c:\hhtnht.exec:\hhtnht.exe234⤵PID:3904
-
\??\c:\jpjvv.exec:\jpjvv.exe235⤵PID:4788
-
\??\c:\pvdjj.exec:\pvdjj.exe236⤵PID:2036
-
\??\c:\fxlllrr.exec:\fxlllrr.exe237⤵PID:2652
-
\??\c:\thntnt.exec:\thntnt.exe238⤵PID:464
-
\??\c:\jdjjj.exec:\jdjjj.exe239⤵PID:3496
-
\??\c:\ppjjp.exec:\ppjjp.exe240⤵PID:3524
-
\??\c:\lfflrrr.exec:\lfflrrr.exe241⤵PID:4356
-
\??\c:\hbntbh.exec:\hbntbh.exe242⤵PID:2268