Analysis
-
max time kernel
143s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 21:11
Behavioral task
behavioral1
Sample
028dd507a78a4791cbdc0018877b4480_NeikiAnalytics.exe
Resource
win7-20240220-en
General
-
Target
028dd507a78a4791cbdc0018877b4480_NeikiAnalytics.exe
-
Size
211KB
-
MD5
028dd507a78a4791cbdc0018877b4480
-
SHA1
d4f31113b3394559707aeab3852f731656c0d707
-
SHA256
727cb528e82374bdda6fb1fbd54829e9f54380b0c39468c3cbfe82f0cfc777e5
-
SHA512
5410b122c2cb1242ed84e8881abf512208e488d54064f9362cfe6b64ef975166840c06e679b73a3814da04a40b705cc0c75d3e0758e4295ae569d4657d4e788a
-
SSDEEP
6144:Hcm4FmowdHoSrXZf8l/ubPzYNLPf4t+ly:V4wFHoSBK/ubLcfo
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/5004-0-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4752-7-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4948-19-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/852-13-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4348-29-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4036-37-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3368-36-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3468-50-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5008-49-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3040-67-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2780-105-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1912-143-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3008-192-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3728-211-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2068-247-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3724-254-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1420-259-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3848-293-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3940-320-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2824-332-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2592-360-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4696-405-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3064-444-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/532-448-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3468-535-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2860-539-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4032-503-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1752-499-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3828-495-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4224-481-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3424-473-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/844-463-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1436-452-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4580-433-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2028-397-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3972-377-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4032-350-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3768-346-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1108-314-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3540-309-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4196-308-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4632-286-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4492-277-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2500-275-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4028-270-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4844-232-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3056-206-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3768-196-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4684-186-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1668-155-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1108-150-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3036-132-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4408-121-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/824-114-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2500-104-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/696-93-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1624-87-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4772-85-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1772-75-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/552-73-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4848-61-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1588-594-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5068-626-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3252-633-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule behavioral2/memory/5004-0-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew C:\rrlfrlf.exe family_berbew behavioral2/memory/4752-7-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew C:\5bbthh.exe family_berbew behavioral2/memory/4948-19-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/852-13-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew \??\c:\9hnbnh.exe family_berbew behavioral2/memory/4348-24-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew \??\c:\1rfxxxl.exe family_berbew behavioral2/memory/4348-29-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4036-37-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3368-36-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/5008-43-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew \??\c:\ttnbht.exe family_berbew behavioral2/memory/4848-56-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew \??\c:\7jpjj.exe family_berbew behavioral2/memory/3468-50-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/5008-49-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew \??\c:\fxlfrrf.exe family_berbew \??\c:\tnhbbb.exe family_berbew behavioral2/memory/3040-67-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew C:\vvpdp.exe family_berbew \??\c:\1llfrrf.exe family_berbew \??\c:\hbnbtn.exe family_berbew behavioral2/memory/2780-105-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew C:\jjdvp.exe family_berbew \??\c:\5flflfr.exe family_berbew \??\c:\vdjdv.exe family_berbew behavioral2/memory/1912-143-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew \??\c:\fxlfllx.exe family_berbew C:\3vvpj.exe family_berbew behavioral2/memory/3008-192-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3728-211-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3608-221-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/2068-247-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3724-254-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/1420-259-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3848-293-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4196-304-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3940-320-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/2824-332-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/2592-360-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4696-405-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4772-416-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3300-437-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3064-444-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/532-448-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/844-459-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/1108-474-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3468-535-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/2860-539-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3468-531-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4032-503-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/1752-499-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3828-495-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4512-488-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4224-481-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3424-473-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/844-463-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/1436-452-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4580-433-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3696-426-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/2056-409-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4696-401-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
Processes:
rrlfrlf.exe9hnbnh.exe5bbthh.exevpdvj.exe1rfxxxl.exe9xllrrx.exettnbht.exepvvvp.exe7jpjj.exefxlfrrf.exetnhbbb.exevvpdp.exe3vdpj.exe1llfrrf.exerlrffxf.exehbnbtn.exevdvpj.exejjdvp.exe5flflfr.exennhbbt.exevdjdv.exejppdp.exelxflrxf.exelflxrlf.exehtnbnh.exe7jvjp.exeppdpd.exefxlfllx.exe5bbnnh.exe3vvpj.exepvdpv.exe3xxrrrr.exelrlfxxr.exe9ttnhh.exevpvpp.exepdvpp.exerlxrlfx.exexlrllfx.exe5httbb.exepjppp.exevdjjp.exeflrlffl.exebhhhhb.exehhhhbb.exeppjpd.exejvdvp.exerflfxxr.exeflffxxr.exehbntht.exenntnnn.exevvdvv.exe5ddpv.exelrxrffx.exexffxlfr.exehbtbnh.exevvvpd.exeppdvd.exeflxxxxx.exe7ffrfxr.exe1tbtnn.exepjdpd.exedvvpv.exe1xlxfxx.exexrlfrlx.exepid process 4752 rrlfrlf.exe 852 9hnbnh.exe 4948 5bbthh.exe 4348 vpdvj.exe 3368 1rfxxxl.exe 4036 9xllrrx.exe 5008 ttnbht.exe 3468 pvvvp.exe 4848 7jpjj.exe 3040 fxlfrrf.exe 552 tnhbbb.exe 1772 vvpdp.exe 4772 3vdpj.exe 1624 1llfrrf.exe 696 rlrffxf.exe 2500 hbnbtn.exe 2780 vdvpj.exe 824 jjdvp.exe 4408 5flflfr.exe 1336 nnhbbt.exe 1712 vdjdv.exe 3036 jppdp.exe 1912 lxflrxf.exe 3460 lflxrlf.exe 1108 htnbnh.exe 1668 7jvjp.exe 2344 ppdpd.exe 4500 fxlfllx.exe 4572 5bbnnh.exe 2700 3vvpj.exe 4684 pvdpv.exe 2776 3xxrrrr.exe 3008 lrlfxxr.exe 3768 9ttnhh.exe 4868 vpvpp.exe 4832 pdvpp.exe 3056 rlxrlfx.exe 3728 xlrllfx.exe 4284 5httbb.exe 3644 pjppp.exe 4592 vdjjp.exe 3608 flrlffl.exe 1304 bhhhhb.exe 1984 hhhhbb.exe 4844 ppjpd.exe 4828 jvdvp.exe 5096 rflfxxr.exe 1280 flffxxr.exe 2068 hbntht.exe 3672 nntnnn.exe 3724 vvdvv.exe 1772 5ddpv.exe 1420 lrxrffx.exe 5044 xffxlfr.exe 2356 hbtbnh.exe 4028 vvvpd.exe 2500 ppdvd.exe 4492 flxxxxx.exe 2388 7ffrfxr.exe 4872 1tbtnn.exe 4632 pjdpd.exe 3848 dvvpv.exe 4012 1xlxfxx.exe 4132 xrlfrlx.exe -
Processes:
resource yara_rule behavioral2/memory/5004-0-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\rrlfrlf.exe upx behavioral2/memory/4752-7-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\5bbthh.exe upx behavioral2/memory/4948-19-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/852-13-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\9hnbnh.exe upx behavioral2/memory/4348-24-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\1rfxxxl.exe upx behavioral2/memory/4348-29-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4036-37-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3368-36-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/5008-43-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\ttnbht.exe upx behavioral2/memory/4848-56-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\7jpjj.exe upx behavioral2/memory/3468-50-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/5008-49-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\fxlfrrf.exe upx \??\c:\tnhbbb.exe upx behavioral2/memory/3040-67-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\vvpdp.exe upx \??\c:\1llfrrf.exe upx \??\c:\hbnbtn.exe upx behavioral2/memory/2780-105-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\jjdvp.exe upx \??\c:\5flflfr.exe upx \??\c:\vdjdv.exe upx behavioral2/memory/1912-143-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\fxlfllx.exe upx C:\3vvpj.exe upx behavioral2/memory/3008-192-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3728-211-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3608-221-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2068-247-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3724-254-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1420-259-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3848-293-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4196-304-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3940-320-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2824-332-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2592-360-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4696-405-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4772-416-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3300-437-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3064-444-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/532-448-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/844-459-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1108-474-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3468-535-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2860-539-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3468-531-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4032-503-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1752-499-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3828-495-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4512-488-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4224-481-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3424-473-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/844-463-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1436-452-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4580-433-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3696-426-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2056-409-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4696-401-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
028dd507a78a4791cbdc0018877b4480_NeikiAnalytics.exerrlfrlf.exe9hnbnh.exe5bbthh.exevpdvj.exe1rfxxxl.exe9xllrrx.exettnbht.exepvvvp.exe7jpjj.exefxlfrrf.exetnhbbb.exevvpdp.exe3vdpj.exe1llfrrf.exerlrffxf.exehbnbtn.exevdvpj.exejjdvp.exe5flflfr.exennhbbt.exevdjdv.exedescription pid process target process PID 5004 wrote to memory of 4752 5004 028dd507a78a4791cbdc0018877b4480_NeikiAnalytics.exe rrlfrlf.exe PID 5004 wrote to memory of 4752 5004 028dd507a78a4791cbdc0018877b4480_NeikiAnalytics.exe rrlfrlf.exe PID 5004 wrote to memory of 4752 5004 028dd507a78a4791cbdc0018877b4480_NeikiAnalytics.exe rrlfrlf.exe PID 4752 wrote to memory of 852 4752 rrlfrlf.exe 9hnbnh.exe PID 4752 wrote to memory of 852 4752 rrlfrlf.exe 9hnbnh.exe PID 4752 wrote to memory of 852 4752 rrlfrlf.exe 9hnbnh.exe PID 852 wrote to memory of 4948 852 9hnbnh.exe 5bbthh.exe PID 852 wrote to memory of 4948 852 9hnbnh.exe 5bbthh.exe PID 852 wrote to memory of 4948 852 9hnbnh.exe 5bbthh.exe PID 4948 wrote to memory of 4348 4948 5bbthh.exe vpdvj.exe PID 4948 wrote to memory of 4348 4948 5bbthh.exe vpdvj.exe PID 4948 wrote to memory of 4348 4948 5bbthh.exe vpdvj.exe PID 4348 wrote to memory of 3368 4348 vpdvj.exe 1rfxxxl.exe PID 4348 wrote to memory of 3368 4348 vpdvj.exe 1rfxxxl.exe PID 4348 wrote to memory of 3368 4348 vpdvj.exe 1rfxxxl.exe PID 3368 wrote to memory of 4036 3368 1rfxxxl.exe 9xllrrx.exe PID 3368 wrote to memory of 4036 3368 1rfxxxl.exe 9xllrrx.exe PID 3368 wrote to memory of 4036 3368 1rfxxxl.exe 9xllrrx.exe PID 4036 wrote to memory of 5008 4036 9xllrrx.exe ttnbht.exe PID 4036 wrote to memory of 5008 4036 9xllrrx.exe ttnbht.exe PID 4036 wrote to memory of 5008 4036 9xllrrx.exe ttnbht.exe PID 5008 wrote to memory of 3468 5008 ttnbht.exe pvvvp.exe PID 5008 wrote to memory of 3468 5008 ttnbht.exe pvvvp.exe PID 5008 wrote to memory of 3468 5008 ttnbht.exe pvvvp.exe PID 3468 wrote to memory of 4848 3468 pvvvp.exe 7jpjj.exe PID 3468 wrote to memory of 4848 3468 pvvvp.exe 7jpjj.exe PID 3468 wrote to memory of 4848 3468 pvvvp.exe 7jpjj.exe PID 4848 wrote to memory of 3040 4848 7jpjj.exe fxlfrrf.exe PID 4848 wrote to memory of 3040 4848 7jpjj.exe fxlfrrf.exe PID 4848 wrote to memory of 3040 4848 7jpjj.exe fxlfrrf.exe PID 3040 wrote to memory of 552 3040 fxlfrrf.exe tnhbbb.exe PID 3040 wrote to memory of 552 3040 fxlfrrf.exe tnhbbb.exe PID 3040 wrote to memory of 552 3040 fxlfrrf.exe tnhbbb.exe PID 552 wrote to memory of 1772 552 tnhbbb.exe vvpdp.exe PID 552 wrote to memory of 1772 552 tnhbbb.exe vvpdp.exe PID 552 wrote to memory of 1772 552 tnhbbb.exe vvpdp.exe PID 1772 wrote to memory of 4772 1772 vvpdp.exe 3vdpj.exe PID 1772 wrote to memory of 4772 1772 vvpdp.exe 3vdpj.exe PID 1772 wrote to memory of 4772 1772 vvpdp.exe 3vdpj.exe PID 4772 wrote to memory of 1624 4772 3vdpj.exe 1llfrrf.exe PID 4772 wrote to memory of 1624 4772 3vdpj.exe 1llfrrf.exe PID 4772 wrote to memory of 1624 4772 3vdpj.exe 1llfrrf.exe PID 1624 wrote to memory of 696 1624 1llfrrf.exe rlrffxf.exe PID 1624 wrote to memory of 696 1624 1llfrrf.exe rlrffxf.exe PID 1624 wrote to memory of 696 1624 1llfrrf.exe rlrffxf.exe PID 696 wrote to memory of 2500 696 rlrffxf.exe ppdvd.exe PID 696 wrote to memory of 2500 696 rlrffxf.exe ppdvd.exe PID 696 wrote to memory of 2500 696 rlrffxf.exe ppdvd.exe PID 2500 wrote to memory of 2780 2500 hbnbtn.exe vdvpj.exe PID 2500 wrote to memory of 2780 2500 hbnbtn.exe vdvpj.exe PID 2500 wrote to memory of 2780 2500 hbnbtn.exe vdvpj.exe PID 2780 wrote to memory of 824 2780 vdvpj.exe jjdvp.exe PID 2780 wrote to memory of 824 2780 vdvpj.exe jjdvp.exe PID 2780 wrote to memory of 824 2780 vdvpj.exe jjdvp.exe PID 824 wrote to memory of 4408 824 jjdvp.exe 5flflfr.exe PID 824 wrote to memory of 4408 824 jjdvp.exe 5flflfr.exe PID 824 wrote to memory of 4408 824 jjdvp.exe 5flflfr.exe PID 4408 wrote to memory of 1336 4408 5flflfr.exe nnhbbt.exe PID 4408 wrote to memory of 1336 4408 5flflfr.exe nnhbbt.exe PID 4408 wrote to memory of 1336 4408 5flflfr.exe nnhbbt.exe PID 1336 wrote to memory of 1712 1336 nnhbbt.exe vdjdv.exe PID 1336 wrote to memory of 1712 1336 nnhbbt.exe vdjdv.exe PID 1336 wrote to memory of 1712 1336 nnhbbt.exe vdjdv.exe PID 1712 wrote to memory of 3036 1712 vdjdv.exe jppdp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\028dd507a78a4791cbdc0018877b4480_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\028dd507a78a4791cbdc0018877b4480_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\rrlfrlf.exec:\rrlfrlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\9hnbnh.exec:\9hnbnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\5bbthh.exec:\5bbthh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\vpdvj.exec:\vpdvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\1rfxxxl.exec:\1rfxxxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\9xllrrx.exec:\9xllrrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\ttnbht.exec:\ttnbht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\pvvvp.exec:\pvvvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\7jpjj.exec:\7jpjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\fxlfrrf.exec:\fxlfrrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\tnhbbb.exec:\tnhbbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\vvpdp.exec:\vvpdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\3vdpj.exec:\3vdpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\1llfrrf.exec:\1llfrrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\rlrffxf.exec:\rlrffxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\hbnbtn.exec:\hbnbtn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\vdvpj.exec:\vdvpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\jjdvp.exec:\jjdvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\5flflfr.exec:\5flflfr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\nnhbbt.exec:\nnhbbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\vdjdv.exec:\vdjdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\jppdp.exec:\jppdp.exe23⤵
- Executes dropped EXE
PID:3036 -
\??\c:\lxflrxf.exec:\lxflrxf.exe24⤵
- Executes dropped EXE
PID:1912 -
\??\c:\lflxrlf.exec:\lflxrlf.exe25⤵
- Executes dropped EXE
PID:3460 -
\??\c:\htnbnh.exec:\htnbnh.exe26⤵
- Executes dropped EXE
PID:1108 -
\??\c:\7jvjp.exec:\7jvjp.exe27⤵
- Executes dropped EXE
PID:1668 -
\??\c:\ppdpd.exec:\ppdpd.exe28⤵
- Executes dropped EXE
PID:2344 -
\??\c:\fxlfllx.exec:\fxlfllx.exe29⤵
- Executes dropped EXE
PID:4500 -
\??\c:\5bbnnh.exec:\5bbnnh.exe30⤵
- Executes dropped EXE
PID:4572 -
\??\c:\3vvpj.exec:\3vvpj.exe31⤵
- Executes dropped EXE
PID:2700 -
\??\c:\pvdpv.exec:\pvdpv.exe32⤵
- Executes dropped EXE
PID:4684 -
\??\c:\3xxrrrr.exec:\3xxrrrr.exe33⤵
- Executes dropped EXE
PID:2776 -
\??\c:\lrlfxxr.exec:\lrlfxxr.exe34⤵
- Executes dropped EXE
PID:3008 -
\??\c:\9ttnhh.exec:\9ttnhh.exe35⤵
- Executes dropped EXE
PID:3768 -
\??\c:\vpvpp.exec:\vpvpp.exe36⤵
- Executes dropped EXE
PID:4868 -
\??\c:\pdvpp.exec:\pdvpp.exe37⤵
- Executes dropped EXE
PID:4832 -
\??\c:\rlxrlfx.exec:\rlxrlfx.exe38⤵
- Executes dropped EXE
PID:3056 -
\??\c:\xlrllfx.exec:\xlrllfx.exe39⤵
- Executes dropped EXE
PID:3728 -
\??\c:\5httbb.exec:\5httbb.exe40⤵
- Executes dropped EXE
PID:4284 -
\??\c:\pjppp.exec:\pjppp.exe41⤵
- Executes dropped EXE
PID:3644 -
\??\c:\vdjjp.exec:\vdjjp.exe42⤵
- Executes dropped EXE
PID:4592 -
\??\c:\flrlffl.exec:\flrlffl.exe43⤵
- Executes dropped EXE
PID:3608 -
\??\c:\bhhhhb.exec:\bhhhhb.exe44⤵
- Executes dropped EXE
PID:1304 -
\??\c:\hhhhbb.exec:\hhhhbb.exe45⤵
- Executes dropped EXE
PID:1984 -
\??\c:\ppjpd.exec:\ppjpd.exe46⤵
- Executes dropped EXE
PID:4844 -
\??\c:\jvdvp.exec:\jvdvp.exe47⤵
- Executes dropped EXE
PID:4828 -
\??\c:\rflfxxr.exec:\rflfxxr.exe48⤵
- Executes dropped EXE
PID:5096 -
\??\c:\flffxxr.exec:\flffxxr.exe49⤵
- Executes dropped EXE
PID:1280 -
\??\c:\hbntht.exec:\hbntht.exe50⤵
- Executes dropped EXE
PID:2068 -
\??\c:\nntnnn.exec:\nntnnn.exe51⤵
- Executes dropped EXE
PID:3672 -
\??\c:\vvdvv.exec:\vvdvv.exe52⤵
- Executes dropped EXE
PID:3724 -
\??\c:\5ddpv.exec:\5ddpv.exe53⤵
- Executes dropped EXE
PID:1772 -
\??\c:\lrxrffx.exec:\lrxrffx.exe54⤵
- Executes dropped EXE
PID:1420 -
\??\c:\xffxlfr.exec:\xffxlfr.exe55⤵
- Executes dropped EXE
PID:5044 -
\??\c:\hbtbnh.exec:\hbtbnh.exe56⤵
- Executes dropped EXE
PID:2356 -
\??\c:\vvvpd.exec:\vvvpd.exe57⤵
- Executes dropped EXE
PID:4028 -
\??\c:\ppdvd.exec:\ppdvd.exe58⤵
- Executes dropped EXE
PID:2500 -
\??\c:\flxxxxx.exec:\flxxxxx.exe59⤵
- Executes dropped EXE
PID:4492 -
\??\c:\7ffrfxr.exec:\7ffrfxr.exe60⤵
- Executes dropped EXE
PID:2388 -
\??\c:\1tbtnn.exec:\1tbtnn.exe61⤵
- Executes dropped EXE
PID:4872 -
\??\c:\pjdpd.exec:\pjdpd.exe62⤵
- Executes dropped EXE
PID:4632 -
\??\c:\dvvpv.exec:\dvvpv.exe63⤵
- Executes dropped EXE
PID:3848 -
\??\c:\1xlxfxx.exec:\1xlxfxx.exe64⤵
- Executes dropped EXE
PID:4012 -
\??\c:\xrlfrlx.exec:\xrlfrlx.exe65⤵
- Executes dropped EXE
PID:4132 -
\??\c:\5httnn.exec:\5httnn.exe66⤵PID:1620
-
\??\c:\vjjvd.exec:\vjjvd.exe67⤵PID:4196
-
\??\c:\9vdvp.exec:\9vdvp.exe68⤵PID:3540
-
\??\c:\ffxlxlx.exec:\ffxlxlx.exe69⤵PID:1108
-
\??\c:\fxfxlxr.exec:\fxfxlxr.exe70⤵PID:3356
-
\??\c:\3ntnhb.exec:\3ntnhb.exe71⤵PID:3940
-
\??\c:\vvjdv.exec:\vvjdv.exe72⤵PID:3408
-
\??\c:\pvvvp.exec:\pvvvp.exe73⤵PID:2332
-
\??\c:\lfxxxlx.exec:\lfxxxlx.exe74⤵PID:2824
-
\??\c:\rlxrrrl.exec:\rlxrrrl.exe75⤵PID:3140
-
\??\c:\nthtnn.exec:\nthtnn.exe76⤵PID:1644
-
\??\c:\bntnht.exec:\bntnht.exe77⤵PID:1752
-
\??\c:\vppjv.exec:\vppjv.exe78⤵PID:3768
-
\??\c:\ddpvj.exec:\ddpvj.exe79⤵PID:5068
-
\??\c:\xrrfrxr.exec:\xrrfrxr.exe80⤵PID:4032
-
\??\c:\7xfxrlx.exec:\7xfxrlx.exe81⤵PID:1340
-
\??\c:\bhhhbt.exec:\bhhhbt.exe82⤵PID:3976
-
\??\c:\nnnhtb.exec:\nnnhtb.exe83⤵PID:2592
-
\??\c:\vpdvp.exec:\vpdvp.exe84⤵PID:3740
-
\??\c:\jjdvp.exec:\jjdvp.exe85⤵PID:3504
-
\??\c:\djjdp.exec:\djjdp.exe86⤵PID:4616
-
\??\c:\7flxfxx.exec:\7flxfxx.exe87⤵PID:3972
-
\??\c:\lxllffx.exec:\lxllffx.exe88⤵PID:4332
-
\??\c:\5nthhb.exec:\5nthhb.exe89⤵PID:4612
-
\??\c:\tnnbbt.exec:\tnnbbt.exe90⤵PID:2444
-
\??\c:\ppjvp.exec:\ppjvp.exe91⤵PID:4800
-
\??\c:\pjjdp.exec:\pjjdp.exe92⤵PID:4828
-
\??\c:\rlxrrrx.exec:\rlxrrrx.exe93⤵PID:5096
-
\??\c:\flxrflf.exec:\flxrflf.exe94⤵PID:2028
-
\??\c:\nnbttt.exec:\nnbttt.exe95⤵PID:4696
-
\??\c:\7jjvp.exec:\7jjvp.exe96⤵PID:636
-
\??\c:\jvdpp.exec:\jvdpp.exe97⤵PID:2056
-
\??\c:\lflfxrr.exec:\lflfxrr.exe98⤵PID:4776
-
\??\c:\rfxrllf.exec:\rfxrllf.exe99⤵PID:4772
-
\??\c:\bbbbbh.exec:\bbbbbh.exe100⤵PID:4840
-
\??\c:\jddpj.exec:\jddpj.exe101⤵PID:696
-
\??\c:\dvpdd.exec:\dvpdd.exe102⤵PID:3696
-
\??\c:\rxrrlfx.exec:\rxrrlfx.exe103⤵PID:2616
-
\??\c:\frrrlrf.exec:\frrrlrf.exe104⤵PID:4580
-
\??\c:\5bthbt.exec:\5bthbt.exe105⤵PID:3300
-
\??\c:\hnnhbb.exec:\hnnhbb.exe106⤵PID:3064
-
\??\c:\ppjjp.exec:\ppjjp.exe107⤵PID:532
-
\??\c:\vjdjp.exec:\vjdjp.exe108⤵PID:3012
-
\??\c:\xffxffx.exec:\xffxffx.exe109⤵PID:1436
-
\??\c:\xlrxrlf.exec:\xlrxrlf.exe110⤵PID:3112
-
\??\c:\hbhbbh.exec:\hbhbbh.exe111⤵PID:844
-
\??\c:\tthhnh.exec:\tthhnh.exe112⤵PID:1440
-
\??\c:\jjdvp.exec:\jjdvp.exe113⤵PID:4420
-
\??\c:\5vpjd.exec:\5vpjd.exe114⤵PID:3424
-
\??\c:\frlfllf.exec:\frlfllf.exe115⤵PID:1108
-
\??\c:\rlxxrfr.exec:\rlxxrfr.exe116⤵PID:4500
-
\??\c:\7tnbtn.exec:\7tnbtn.exe117⤵PID:4224
-
\??\c:\nttnnn.exec:\nttnnn.exe118⤵PID:1344
-
\??\c:\jdddv.exec:\jdddv.exe119⤵PID:4512
-
\??\c:\xlrfllf.exec:\xlrfllf.exe120⤵PID:3828
-
\??\c:\xrxxxlr.exec:\xrxxxlr.exe121⤵PID:1752
-
\??\c:\hhbtnn.exec:\hhbtnn.exe122⤵PID:4956
-
\??\c:\btbbbt.exec:\btbbbt.exe123⤵PID:4032
-
\??\c:\jdvjv.exec:\jdvjv.exe124⤵PID:1892
-
\??\c:\3jppp.exec:\3jppp.exe125⤵PID:3764
-
\??\c:\xfrxrfr.exec:\xfrxrfr.exe126⤵PID:4188
-
\??\c:\rlrlfxl.exec:\rlrlfxl.exe127⤵PID:4592
-
\??\c:\1tbtnh.exec:\1tbtnh.exe128⤵PID:2044
-
\??\c:\7bnbbn.exec:\7bnbbn.exe129⤵PID:4332
-
\??\c:\jdppv.exec:\jdppv.exe130⤵PID:4844
-
\??\c:\vvjdp.exec:\vvjdp.exe131⤵PID:1824
-
\??\c:\rrlfrrl.exec:\rrlfrrl.exe132⤵PID:3468
-
\??\c:\llflfll.exec:\llflfll.exe133⤵PID:5096
-
\??\c:\bbbbth.exec:\bbbbth.exe134⤵PID:2860
-
\??\c:\3hnhtn.exec:\3hnhtn.exe135⤵PID:3516
-
\??\c:\vdjpp.exec:\vdjpp.exe136⤵PID:972
-
\??\c:\pvdvp.exec:\pvdvp.exe137⤵PID:2056
-
\??\c:\lfrfxll.exec:\lfrfxll.exe138⤵PID:660
-
\??\c:\5rrlrrx.exec:\5rrlrrx.exe139⤵PID:4576
-
\??\c:\9xfxrxr.exec:\9xfxrxr.exe140⤵PID:4840
-
\??\c:\tbttbb.exec:\tbttbb.exe141⤵PID:3688
-
\??\c:\7nhbtn.exec:\7nhbtn.exe142⤵PID:4144
-
\??\c:\ddvpp.exec:\ddvpp.exe143⤵PID:2780
-
\??\c:\9vpdj.exec:\9vpdj.exe144⤵PID:428
-
\??\c:\xxlfxrl.exec:\xxlfxrl.exe145⤵PID:4408
-
\??\c:\3frlfxr.exec:\3frlfxr.exe146⤵PID:5056
-
\??\c:\dpdvj.exec:\dpdvj.exe147⤵PID:752
-
\??\c:\ddpdv.exec:\ddpdv.exe148⤵PID:1932
-
\??\c:\rrfflrx.exec:\rrfflrx.exe149⤵PID:2572
-
\??\c:\bnthbn.exec:\bnthbn.exe150⤵PID:1436
-
\??\c:\tbtthb.exec:\tbtthb.exe151⤵PID:1588
-
\??\c:\fxxxxrr.exec:\fxxxxrr.exe152⤵PID:464
-
\??\c:\9hhbnn.exec:\9hhbnn.exe153⤵PID:1668
-
\??\c:\pvjvp.exec:\pvjvp.exe154⤵PID:5020
-
\??\c:\vddvj.exec:\vddvj.exe155⤵PID:4396
-
\??\c:\9hhthb.exec:\9hhthb.exe156⤵PID:2312
-
\??\c:\bbbbtt.exec:\bbbbtt.exe157⤵PID:4588
-
\??\c:\hnbttt.exec:\hnbttt.exe158⤵PID:4984
-
\??\c:\ppvpd.exec:\ppvpd.exe159⤵PID:2172
-
\??\c:\ttttnt.exec:\ttttnt.exe160⤵PID:3204
-
\??\c:\jvjjv.exec:\jvjjv.exe161⤵PID:1644
-
\??\c:\9llfxxr.exec:\9llfxxr.exe162⤵PID:5068
-
\??\c:\bbthhh.exec:\bbthhh.exe163⤵PID:2392
-
\??\c:\htttnt.exec:\htttnt.exe164⤵PID:3252
-
\??\c:\pdjdv.exec:\pdjdv.exe165⤵PID:220
-
\??\c:\dvddj.exec:\dvddj.exe166⤵PID:2212
-
\??\c:\9xfxrfr.exec:\9xfxrfr.exe167⤵PID:1060
-
\??\c:\httttt.exec:\httttt.exe168⤵PID:4924
-
\??\c:\ddppv.exec:\ddppv.exe169⤵PID:4328
-
\??\c:\7vjpd.exec:\7vjpd.exe170⤵PID:3368
-
\??\c:\xxllfxx.exec:\xxllfxx.exe171⤵PID:3868
-
\??\c:\3ntbbh.exec:\3ntbbh.exe172⤵PID:2816
-
\??\c:\bbhhbn.exec:\bbhhbn.exe173⤵PID:1600
-
\??\c:\jjjdd.exec:\jjjdd.exe174⤵PID:4524
-
\??\c:\djpjj.exec:\djpjj.exe175⤵PID:4696
-
\??\c:\rrxxxrl.exec:\rrxxxrl.exe176⤵PID:636
-
\??\c:\tttnnt.exec:\tttnnt.exe177⤵PID:1872
-
\??\c:\dvpjj.exec:\dvpjj.exe178⤵PID:3732
-
\??\c:\ppvpj.exec:\ppvpj.exe179⤵PID:660
-
\??\c:\llrlxxf.exec:\llrlxxf.exe180⤵PID:4576
-
\??\c:\lflxxxx.exec:\lflxxxx.exe181⤵PID:4564
-
\??\c:\nnttnn.exec:\nnttnn.exe182⤵PID:3688
-
\??\c:\htnhhn.exec:\htnhhn.exe183⤵PID:2500
-
\??\c:\1pvvv.exec:\1pvvv.exe184⤵PID:1112
-
\??\c:\3rrlffx.exec:\3rrlffx.exe185⤵PID:2740
-
\??\c:\rfrxfll.exec:\rfrxfll.exe186⤵PID:1052
-
\??\c:\tnnhbb.exec:\tnnhbb.exe187⤵PID:1336
-
\??\c:\5hnhbb.exec:\5hnhbb.exe188⤵PID:1204
-
\??\c:\ppjjd.exec:\ppjjd.exe189⤵PID:1244
-
\??\c:\frxllrl.exec:\frxllrl.exe190⤵PID:1828
-
\??\c:\3flfxxr.exec:\3flfxxr.exe191⤵PID:3280
-
\??\c:\5bnntt.exec:\5bnntt.exe192⤵PID:1440
-
\??\c:\vjpjj.exec:\vjpjj.exe193⤵PID:3296
-
\??\c:\jpjjv.exec:\jpjjv.exe194⤵PID:5064
-
\??\c:\ffrxrll.exec:\ffrxrll.exe195⤵PID:3024
-
\??\c:\tthbbt.exec:\tthbbt.exe196⤵PID:4572
-
\??\c:\1nhbtb.exec:\1nhbtb.exe197⤵PID:4100
-
\??\c:\pjpjd.exec:\pjpjd.exe198⤵PID:4984
-
\??\c:\dvvjd.exec:\dvvjd.exe199⤵PID:1344
-
\??\c:\9xfrllx.exec:\9xfrllx.exe200⤵PID:4048
-
\??\c:\tbbnbt.exec:\tbbnbt.exe201⤵PID:1736
-
\??\c:\pjvvv.exec:\pjvvv.exe202⤵PID:5068
-
\??\c:\xrllxfr.exec:\xrllxfr.exe203⤵PID:4868
-
\??\c:\bnnbbn.exec:\bnnbbn.exe204⤵PID:3288
-
\??\c:\vjjdv.exec:\vjjdv.exe205⤵PID:2144
-
\??\c:\dddjj.exec:\dddjj.exe206⤵PID:8
-
\??\c:\1frfxrf.exec:\1frfxrf.exe207⤵PID:1448
-
\??\c:\frrfrlf.exec:\frrfrlf.exe208⤵PID:3136
-
\??\c:\hbbthh.exec:\hbbthh.exe209⤵PID:5104
-
\??\c:\ntnbth.exec:\ntnbth.exe210⤵PID:2352
-
\??\c:\7pjvd.exec:\7pjvd.exe211⤵PID:3000
-
\??\c:\5llxlfr.exec:\5llxlfr.exe212⤵PID:4848
-
\??\c:\frrfrlx.exec:\frrfrlx.exe213⤵PID:3720
-
\??\c:\5hbntn.exec:\5hbntn.exe214⤵PID:3724
-
\??\c:\htthtn.exec:\htthtn.exe215⤵PID:4768
-
\??\c:\jdjvp.exec:\jdjvp.exe216⤵PID:3516
-
\??\c:\jjvjv.exec:\jjvjv.exe217⤵PID:1420
-
\??\c:\fflxfxl.exec:\fflxfxl.exe218⤵PID:2360
-
\??\c:\7ffxlff.exec:\7ffxlff.exe219⤵PID:5032
-
\??\c:\7xflxfr.exec:\7xflxfr.exe220⤵PID:1208
-
\??\c:\3tbnnh.exec:\3tbnnh.exe221⤵PID:1784
-
\??\c:\jvdvj.exec:\jvdvj.exe222⤵PID:3756
-
\??\c:\jdpjv.exec:\jdpjv.exe223⤵PID:1224
-
\??\c:\fxllfxr.exec:\fxllfxr.exe224⤵PID:5056
-
\??\c:\fxfxfxf.exec:\fxfxfxf.exe225⤵PID:752
-
\??\c:\hhhbhh.exec:\hhhbhh.exe226⤵PID:4132
-
\??\c:\vpppd.exec:\vpppd.exe227⤵PID:3112
-
\??\c:\dppjd.exec:\dppjd.exe228⤵PID:844
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe229⤵PID:5036
-
\??\c:\hnnhbn.exec:\hnnhbn.exe230⤵PID:3540
-
\??\c:\hbbnbn.exec:\hbbnbn.exe231⤵PID:5020
-
\??\c:\thbbhb.exec:\thbbhb.exe232⤵PID:4236
-
\??\c:\vvpvj.exec:\vvpvj.exe233⤵PID:4500
-
\??\c:\jvdpj.exec:\jvdpj.exe234⤵PID:2332
-
\??\c:\lffxlfr.exec:\lffxlfr.exe235⤵PID:4224
-
\??\c:\9rrlxlx.exec:\9rrlxlx.exe236⤵PID:2088
-
\??\c:\bbbtnh.exec:\bbbtnh.exe237⤵PID:3928
-
\??\c:\9nbbnb.exec:\9nbbnb.exe238⤵PID:4996
-
\??\c:\pppjd.exec:\pppjd.exe239⤵PID:1512
-
\??\c:\jpdpj.exec:\jpdpj.exe240⤵PID:3360
-
\??\c:\5fxllfr.exec:\5fxllfr.exe241⤵PID:4300
-
\??\c:\tnhbtn.exec:\tnhbtn.exe242⤵PID:3764