Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 15:20
Behavioral task
behavioral1
Sample
e166d727e89fa1c86a9d597c776a7220_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
e166d727e89fa1c86a9d597c776a7220_NeikiAnalytics.exe
-
Size
464KB
-
MD5
e166d727e89fa1c86a9d597c776a7220
-
SHA1
34e75f1872fd9cfbfaa2a7c2c5e43bbe12f22224
-
SHA256
2d8050ec94699e1c60872d18093730150647240a7ab2c97e58a9a9d314fa9f51
-
SHA512
9f312956f45aa722b7a5687ce359cf4eb303474c609aa658ca436ab9459140a0e5323c8a8ad0f47f85774696c55eeaa4122fba06b5f51c8275813dadb4900625
-
SSDEEP
12288:J4wFHoSTeR0oQRkay+eFp3IDvSbh5nPVP+OKaf1V5:VeR0oykayRFp3lztP+OKaf1V5
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1616-5-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/396-8-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/452-13-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1132-18-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3372-24-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2868-38-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4416-31-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/692-49-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1280-64-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1420-71-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2180-60-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1392-84-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1784-89-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2768-83-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/388-98-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2192-106-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1760-112-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4924-122-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4104-129-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1684-140-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2676-157-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3760-178-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4388-183-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/5080-190-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2232-203-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1588-212-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4756-216-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3984-219-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2972-239-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3708-246-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4156-256-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2180-257-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2608-270-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/5116-272-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3840-287-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1116-300-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4880-304-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4036-305-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4412-315-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3280-317-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3108-330-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2140-352-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3544-366-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4916-387-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3704-415-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4488-437-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3400-456-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/936-472-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3392-485-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/968-489-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2620-493-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/5032-512-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3972-543-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3168-586-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1744-675-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2524-679-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4432-689-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4668-693-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1968-706-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3336-728-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/8-807-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4316-822-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4104-826-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3460-831-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule behavioral2/memory/1616-0-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\lxxrlll.exe family_berbew behavioral2/memory/1616-5-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/396-8-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\vjjdv.exe family_berbew behavioral2/memory/452-13-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/1132-18-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\vpvdj.exe family_berbew behavioral2/memory/3372-24-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\bntnhb.exe family_berbew C:\3bhhhb.exe family_berbew C:\dvpvv.exe family_berbew behavioral2/memory/2868-38-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4416-31-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\rrrlfxr.exe family_berbew C:\hnbtnh.exe family_berbew behavioral2/memory/692-49-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\dvjdd.exe family_berbew \??\c:\ffxrffx.exe family_berbew behavioral2/memory/1280-64-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\bnnnhh.exe family_berbew \??\c:\jvdvp.exe family_berbew behavioral2/memory/1420-71-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2180-60-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\nhhbnn.exe family_berbew behavioral2/memory/1392-84-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\xrxlffx.exe family_berbew behavioral2/memory/1784-89-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2768-83-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\lxrrlxx.exe family_berbew C:\nntttb.exe family_berbew C:\vvdjp.exe family_berbew behavioral2/memory/388-98-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\9xlfxrl.exe family_berbew behavioral2/memory/2192-106-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\tbhbtt.exe family_berbew behavioral2/memory/1760-112-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\9nnhhn.exe family_berbew behavioral2/memory/4924-122-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\djpjv.exe family_berbew \??\c:\xfrllfx.exe family_berbew behavioral2/memory/4104-129-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\bntnnn.exe family_berbew \??\c:\rxxxxxx.exe family_berbew \??\c:\tthtbt.exe family_berbew behavioral2/memory/4984-141-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/1684-140-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\fxfxxxx.exe family_berbew \??\c:\1btnth.exe family_berbew behavioral2/memory/2676-157-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\jvpvv.exe family_berbew \??\c:\tnhbtn.exe family_berbew behavioral2/memory/3760-173-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\fffxxlf.exe family_berbew \??\c:\tnnhtt.exe family_berbew behavioral2/memory/3760-178-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\jppjv.exe family_berbew behavioral2/memory/4388-183-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/5080-190-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2232-203-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/1588-212-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4756-216-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/3984-219-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4088-229-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
Processes:
lxxrlll.exebntnhb.exevjjdv.exevpvdj.exe3bhhhb.exedvpvv.exerrrlfxr.exehnbtnh.exedvjdd.exeffxrffx.exebnnnhh.exejvdvp.exenhhbnn.exelxrrlxx.exexrxlffx.exenntttb.exevvdjp.exe9xlfxrl.exetbhbtt.exe9nnhhn.exedjpjv.exexfrllfx.exebntnnn.exefxfxxxx.exerxxxxxx.exetthtbt.exe1btnth.exejvpvv.exefffxxlf.exetnhbtn.exetnnhtt.exejppjv.exebttnhb.exevpvjd.exerllffxr.exerxfxrlf.exebtthnn.exe7dpdp.exerfrlffx.exe7tbtnt.exedpvpd.exepppdp.exeffrlxrl.exehttntn.exedpvpp.exelrxrffx.exefrrfxrl.exe3nhnhb.exedpvjd.exexxxrxrx.exe7hnbtt.exepjvpv.exelrxfrlr.exe3htnnt.exepjpjj.exefllrlfx.exebnnhbb.exejvjvj.exexlfxffl.exehbbtbt.exenhnhtn.exedvvjd.exefrlfrrl.exebhhhbb.exepid process 396 lxxrlll.exe 452 bntnhb.exe 1132 vjjdv.exe 3372 vpvdj.exe 4416 3bhhhb.exe 2868 dvpvv.exe 5052 rrrlfxr.exe 692 hnbtnh.exe 3388 dvjdd.exe 2180 ffxrffx.exe 1280 bnnnhh.exe 1420 jvdvp.exe 2768 nhhbnn.exe 1392 lxrrlxx.exe 1784 xrxlffx.exe 388 nntttb.exe 3764 vvdjp.exe 2192 9xlfxrl.exe 1760 tbhbtt.exe 4924 9nnhhn.exe 3020 djpjv.exe 4104 xfrllfx.exe 1684 bntnnn.exe 4984 fxfxxxx.exe 1640 rxxxxxx.exe 4920 tthtbt.exe 2676 1btnth.exe 5104 jvpvv.exe 2060 fffxxlf.exe 3760 tnhbtn.exe 4388 tnnhtt.exe 3904 jppjv.exe 5080 bttnhb.exe 3544 vpvjd.exe 3196 rllffxr.exe 3672 rxfxrlf.exe 2232 btthnn.exe 4460 7dpdp.exe 1588 rfrlffx.exe 4756 7tbtnt.exe 3984 dpvpd.exe 1832 pppdp.exe 2596 ffrlxrl.exe 4252 httntn.exe 4088 dpvpp.exe 4160 lrxrffx.exe 2972 frrfxrl.exe 3784 3nhnhb.exe 3708 dpvjd.exe 2904 xxxrxrx.exe 4700 7hnbtt.exe 4156 pjvpv.exe 2180 lrxfrlr.exe 3500 3htnnt.exe 2476 pjpjj.exe 2608 fllrlfx.exe 5116 bnnhbb.exe 2128 jvjvj.exe 4432 xlfxffl.exe 652 hbbtbt.exe 3840 nhnhtn.exe 3832 dvvjd.exe 3256 frlfrrl.exe 3552 bhhhbb.exe -
Processes:
resource yara_rule behavioral2/memory/1616-0-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\lxxrlll.exe upx behavioral2/memory/1616-5-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/396-8-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\vjjdv.exe upx behavioral2/memory/452-13-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/1132-18-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\vpvdj.exe upx behavioral2/memory/3372-24-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\bntnhb.exe upx C:\3bhhhb.exe upx C:\dvpvv.exe upx behavioral2/memory/2868-38-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4416-31-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\rrrlfxr.exe upx C:\hnbtnh.exe upx behavioral2/memory/692-49-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\dvjdd.exe upx \??\c:\ffxrffx.exe upx behavioral2/memory/1280-64-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\bnnnhh.exe upx \??\c:\jvdvp.exe upx behavioral2/memory/1420-71-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2180-60-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\nhhbnn.exe upx behavioral2/memory/1392-84-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\xrxlffx.exe upx behavioral2/memory/1784-89-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2768-83-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\lxrrlxx.exe upx C:\nntttb.exe upx C:\vvdjp.exe upx behavioral2/memory/388-98-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\9xlfxrl.exe upx behavioral2/memory/2192-106-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\tbhbtt.exe upx behavioral2/memory/1760-112-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\9nnhhn.exe upx behavioral2/memory/4924-122-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\djpjv.exe upx \??\c:\xfrllfx.exe upx behavioral2/memory/4104-129-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\bntnnn.exe upx \??\c:\rxxxxxx.exe upx \??\c:\tthtbt.exe upx behavioral2/memory/4984-141-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/1684-140-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\fxfxxxx.exe upx \??\c:\1btnth.exe upx behavioral2/memory/2676-157-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\jvpvv.exe upx \??\c:\tnhbtn.exe upx behavioral2/memory/3760-173-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\fffxxlf.exe upx \??\c:\tnnhtt.exe upx behavioral2/memory/3760-178-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\jppjv.exe upx behavioral2/memory/4388-183-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/5080-190-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2232-203-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/1588-212-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4756-216-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/3984-219-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4088-229-0x0000000000400000-0x000000000043A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e166d727e89fa1c86a9d597c776a7220_NeikiAnalytics.exelxxrlll.exebntnhb.exevjjdv.exevpvdj.exe3bhhhb.exedvpvv.exerrrlfxr.exehnbtnh.exedvjdd.exeffxrffx.exebnnnhh.exejvdvp.exenhhbnn.exelxrrlxx.exexrxlffx.exenntttb.exevvdjp.exe9xlfxrl.exetbhbtt.exe9nnhhn.exedjpjv.exedescription pid process target process PID 1616 wrote to memory of 396 1616 e166d727e89fa1c86a9d597c776a7220_NeikiAnalytics.exe lxxrlll.exe PID 1616 wrote to memory of 396 1616 e166d727e89fa1c86a9d597c776a7220_NeikiAnalytics.exe lxxrlll.exe PID 1616 wrote to memory of 396 1616 e166d727e89fa1c86a9d597c776a7220_NeikiAnalytics.exe lxxrlll.exe PID 396 wrote to memory of 452 396 lxxrlll.exe bntnhb.exe PID 396 wrote to memory of 452 396 lxxrlll.exe bntnhb.exe PID 396 wrote to memory of 452 396 lxxrlll.exe bntnhb.exe PID 452 wrote to memory of 1132 452 bntnhb.exe vjjdv.exe PID 452 wrote to memory of 1132 452 bntnhb.exe vjjdv.exe PID 452 wrote to memory of 1132 452 bntnhb.exe vjjdv.exe PID 1132 wrote to memory of 3372 1132 vjjdv.exe vpvdj.exe PID 1132 wrote to memory of 3372 1132 vjjdv.exe vpvdj.exe PID 1132 wrote to memory of 3372 1132 vjjdv.exe vpvdj.exe PID 3372 wrote to memory of 4416 3372 vpvdj.exe 3bhhhb.exe PID 3372 wrote to memory of 4416 3372 vpvdj.exe 3bhhhb.exe PID 3372 wrote to memory of 4416 3372 vpvdj.exe 3bhhhb.exe PID 4416 wrote to memory of 2868 4416 3bhhhb.exe dvpvv.exe PID 4416 wrote to memory of 2868 4416 3bhhhb.exe dvpvv.exe PID 4416 wrote to memory of 2868 4416 3bhhhb.exe dvpvv.exe PID 2868 wrote to memory of 5052 2868 dvpvv.exe rrrlfxr.exe PID 2868 wrote to memory of 5052 2868 dvpvv.exe rrrlfxr.exe PID 2868 wrote to memory of 5052 2868 dvpvv.exe rrrlfxr.exe PID 5052 wrote to memory of 692 5052 rrrlfxr.exe hnbtnh.exe PID 5052 wrote to memory of 692 5052 rrrlfxr.exe hnbtnh.exe PID 5052 wrote to memory of 692 5052 rrrlfxr.exe hnbtnh.exe PID 692 wrote to memory of 3388 692 hnbtnh.exe dvjdd.exe PID 692 wrote to memory of 3388 692 hnbtnh.exe dvjdd.exe PID 692 wrote to memory of 3388 692 hnbtnh.exe dvjdd.exe PID 3388 wrote to memory of 2180 3388 dvjdd.exe ffxrffx.exe PID 3388 wrote to memory of 2180 3388 dvjdd.exe ffxrffx.exe PID 3388 wrote to memory of 2180 3388 dvjdd.exe ffxrffx.exe PID 2180 wrote to memory of 1280 2180 ffxrffx.exe bnnnhh.exe PID 2180 wrote to memory of 1280 2180 ffxrffx.exe bnnnhh.exe PID 2180 wrote to memory of 1280 2180 ffxrffx.exe bnnnhh.exe PID 1280 wrote to memory of 1420 1280 bnnnhh.exe jvdvp.exe PID 1280 wrote to memory of 1420 1280 bnnnhh.exe jvdvp.exe PID 1280 wrote to memory of 1420 1280 bnnnhh.exe jvdvp.exe PID 1420 wrote to memory of 2768 1420 jvdvp.exe nhhbnn.exe PID 1420 wrote to memory of 2768 1420 jvdvp.exe nhhbnn.exe PID 1420 wrote to memory of 2768 1420 jvdvp.exe nhhbnn.exe PID 2768 wrote to memory of 1392 2768 nhhbnn.exe lxrrlxx.exe PID 2768 wrote to memory of 1392 2768 nhhbnn.exe lxrrlxx.exe PID 2768 wrote to memory of 1392 2768 nhhbnn.exe lxrrlxx.exe PID 1392 wrote to memory of 1784 1392 lxrrlxx.exe xrxlffx.exe PID 1392 wrote to memory of 1784 1392 lxrrlxx.exe xrxlffx.exe PID 1392 wrote to memory of 1784 1392 lxrrlxx.exe xrxlffx.exe PID 1784 wrote to memory of 388 1784 xrxlffx.exe nntttb.exe PID 1784 wrote to memory of 388 1784 xrxlffx.exe nntttb.exe PID 1784 wrote to memory of 388 1784 xrxlffx.exe nntttb.exe PID 388 wrote to memory of 3764 388 nntttb.exe vvdjp.exe PID 388 wrote to memory of 3764 388 nntttb.exe vvdjp.exe PID 388 wrote to memory of 3764 388 nntttb.exe vvdjp.exe PID 3764 wrote to memory of 2192 3764 vvdjp.exe 9xlfxrl.exe PID 3764 wrote to memory of 2192 3764 vvdjp.exe 9xlfxrl.exe PID 3764 wrote to memory of 2192 3764 vvdjp.exe 9xlfxrl.exe PID 2192 wrote to memory of 1760 2192 9xlfxrl.exe tbhbtt.exe PID 2192 wrote to memory of 1760 2192 9xlfxrl.exe tbhbtt.exe PID 2192 wrote to memory of 1760 2192 9xlfxrl.exe tbhbtt.exe PID 1760 wrote to memory of 4924 1760 tbhbtt.exe 9nnhhn.exe PID 1760 wrote to memory of 4924 1760 tbhbtt.exe 9nnhhn.exe PID 1760 wrote to memory of 4924 1760 tbhbtt.exe 9nnhhn.exe PID 4924 wrote to memory of 3020 4924 9nnhhn.exe djpjv.exe PID 4924 wrote to memory of 3020 4924 9nnhhn.exe djpjv.exe PID 4924 wrote to memory of 3020 4924 9nnhhn.exe djpjv.exe PID 3020 wrote to memory of 4104 3020 djpjv.exe xfrllfx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e166d727e89fa1c86a9d597c776a7220_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e166d727e89fa1c86a9d597c776a7220_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\lxxrlll.exec:\lxxrlll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\bntnhb.exec:\bntnhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\vjjdv.exec:\vjjdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\vpvdj.exec:\vpvdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\3bhhhb.exec:\3bhhhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\dvpvv.exec:\dvpvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\rrrlfxr.exec:\rrrlfxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\hnbtnh.exec:\hnbtnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
\??\c:\dvjdd.exec:\dvjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\ffxrffx.exec:\ffxrffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\bnnnhh.exec:\bnnnhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\jvdvp.exec:\jvdvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\nhhbnn.exec:\nhhbnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\lxrrlxx.exec:\lxrrlxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\xrxlffx.exec:\xrxlffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\nntttb.exec:\nntttb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\vvdjp.exec:\vvdjp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\9xlfxrl.exec:\9xlfxrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\tbhbtt.exec:\tbhbtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\9nnhhn.exec:\9nnhhn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\djpjv.exec:\djpjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\xfrllfx.exec:\xfrllfx.exe23⤵
- Executes dropped EXE
PID:4104 -
\??\c:\bntnnn.exec:\bntnnn.exe24⤵
- Executes dropped EXE
PID:1684 -
\??\c:\fxfxxxx.exec:\fxfxxxx.exe25⤵
- Executes dropped EXE
PID:4984 -
\??\c:\rxxxxxx.exec:\rxxxxxx.exe26⤵
- Executes dropped EXE
PID:1640 -
\??\c:\tthtbt.exec:\tthtbt.exe27⤵
- Executes dropped EXE
PID:4920 -
\??\c:\1btnth.exec:\1btnth.exe28⤵
- Executes dropped EXE
PID:2676 -
\??\c:\jvpvv.exec:\jvpvv.exe29⤵
- Executes dropped EXE
PID:5104 -
\??\c:\fffxxlf.exec:\fffxxlf.exe30⤵
- Executes dropped EXE
PID:2060 -
\??\c:\tnhbtn.exec:\tnhbtn.exe31⤵
- Executes dropped EXE
PID:3760 -
\??\c:\tnnhtt.exec:\tnnhtt.exe32⤵
- Executes dropped EXE
PID:4388 -
\??\c:\jppjv.exec:\jppjv.exe33⤵
- Executes dropped EXE
PID:3904 -
\??\c:\bttnhb.exec:\bttnhb.exe34⤵
- Executes dropped EXE
PID:5080 -
\??\c:\vpvjd.exec:\vpvjd.exe35⤵
- Executes dropped EXE
PID:3544 -
\??\c:\rllffxr.exec:\rllffxr.exe36⤵
- Executes dropped EXE
PID:3196 -
\??\c:\rxfxrlf.exec:\rxfxrlf.exe37⤵
- Executes dropped EXE
PID:3672 -
\??\c:\btthnn.exec:\btthnn.exe38⤵
- Executes dropped EXE
PID:2232 -
\??\c:\7dpdp.exec:\7dpdp.exe39⤵
- Executes dropped EXE
PID:4460 -
\??\c:\rfrlffx.exec:\rfrlffx.exe40⤵
- Executes dropped EXE
PID:1588 -
\??\c:\7tbtnt.exec:\7tbtnt.exe41⤵
- Executes dropped EXE
PID:4756 -
\??\c:\dpvpd.exec:\dpvpd.exe42⤵
- Executes dropped EXE
PID:3984 -
\??\c:\pppdp.exec:\pppdp.exe43⤵
- Executes dropped EXE
PID:1832 -
\??\c:\ffrlxrl.exec:\ffrlxrl.exe44⤵
- Executes dropped EXE
PID:2596 -
\??\c:\httntn.exec:\httntn.exe45⤵
- Executes dropped EXE
PID:4252 -
\??\c:\dpvpp.exec:\dpvpp.exe46⤵
- Executes dropped EXE
PID:4088 -
\??\c:\lrxrffx.exec:\lrxrffx.exe47⤵
- Executes dropped EXE
PID:4160 -
\??\c:\frrfxrl.exec:\frrfxrl.exe48⤵
- Executes dropped EXE
PID:2972 -
\??\c:\3nhnhb.exec:\3nhnhb.exe49⤵
- Executes dropped EXE
PID:3784 -
\??\c:\dpvjd.exec:\dpvjd.exe50⤵
- Executes dropped EXE
PID:3708 -
\??\c:\xxxrxrx.exec:\xxxrxrx.exe51⤵
- Executes dropped EXE
PID:2904 -
\??\c:\7hnbtt.exec:\7hnbtt.exe52⤵
- Executes dropped EXE
PID:4700 -
\??\c:\pjvpv.exec:\pjvpv.exe53⤵
- Executes dropped EXE
PID:4156 -
\??\c:\lrxfrlr.exec:\lrxfrlr.exe54⤵
- Executes dropped EXE
PID:2180 -
\??\c:\3htnnt.exec:\3htnnt.exe55⤵
- Executes dropped EXE
PID:3500 -
\??\c:\pjpjj.exec:\pjpjj.exe56⤵
- Executes dropped EXE
PID:2476 -
\??\c:\fllrlfx.exec:\fllrlfx.exe57⤵
- Executes dropped EXE
PID:2608 -
\??\c:\bnnhbb.exec:\bnnhbb.exe58⤵
- Executes dropped EXE
PID:5116 -
\??\c:\jvjvj.exec:\jvjvj.exe59⤵
- Executes dropped EXE
PID:2128 -
\??\c:\xlfxffl.exec:\xlfxffl.exe60⤵
- Executes dropped EXE
PID:4432 -
\??\c:\hbbtbt.exec:\hbbtbt.exe61⤵
- Executes dropped EXE
PID:652 -
\??\c:\nhnhtn.exec:\nhnhtn.exe62⤵
- Executes dropped EXE
PID:3840 -
\??\c:\dvvjd.exec:\dvvjd.exe63⤵
- Executes dropped EXE
PID:3832 -
\??\c:\frlfrrl.exec:\frlfrrl.exe64⤵
- Executes dropped EXE
PID:3256 -
\??\c:\bhhhbb.exec:\bhhhbb.exe65⤵
- Executes dropped EXE
PID:3552 -
\??\c:\djpjd.exec:\djpjd.exe66⤵PID:1116
-
\??\c:\3lxrfrl.exec:\3lxrfrl.exe67⤵PID:4880
-
\??\c:\bhnthn.exec:\bhnthn.exe68⤵PID:4036
-
\??\c:\vvjpj.exec:\vvjpj.exe69⤵PID:3312
-
\??\c:\xlxfrrf.exec:\xlxfrrf.exe70⤵PID:4412
-
\??\c:\7vdpj.exec:\7vdpj.exe71⤵PID:3280
-
\??\c:\ffxrffx.exec:\ffxrffx.exe72⤵PID:1684
-
\??\c:\vdpjd.exec:\vdpjd.exe73⤵PID:5064
-
\??\c:\5fxxrrl.exec:\5fxxrrl.exe74⤵PID:3856
-
\??\c:\bnbtnh.exec:\bnbtnh.exe75⤵PID:3108
-
\??\c:\thnnht.exec:\thnnht.exe76⤵PID:4760
-
\??\c:\5jjdd.exec:\5jjdd.exe77⤵PID:1296
-
\??\c:\flxrllf.exec:\flxrllf.exe78⤵PID:3948
-
\??\c:\lflfrlf.exec:\lflfrlf.exe79⤵PID:2412
-
\??\c:\btthbh.exec:\btthbh.exe80⤵PID:3120
-
\??\c:\3dvpp.exec:\3dvpp.exe81⤵PID:2140
-
\??\c:\vpdvd.exec:\vpdvd.exe82⤵PID:1740
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe83⤵PID:2892
-
\??\c:\5bnhhh.exec:\5bnhhh.exe84⤵PID:3164
-
\??\c:\pvdpp.exec:\pvdpp.exe85⤵PID:5080
-
\??\c:\5jjdv.exec:\5jjdv.exe86⤵PID:3544
-
\??\c:\xffxlfl.exec:\xffxlfl.exe87⤵PID:1268
-
\??\c:\1ntnnn.exec:\1ntnnn.exe88⤵PID:4456
-
\??\c:\djjvj.exec:\djjvj.exe89⤵PID:4228
-
\??\c:\dvddv.exec:\dvddv.exe90⤵PID:2080
-
\??\c:\ffxrlfx.exec:\ffxrlfx.exe91⤵PID:4260
-
\??\c:\bbbhbt.exec:\bbbhbt.exe92⤵PID:4916
-
\??\c:\pjppv.exec:\pjppv.exe93⤵PID:1832
-
\??\c:\llxllfr.exec:\llxllfr.exe94⤵PID:3372
-
\??\c:\xfllxrx.exec:\xfllxrx.exe95⤵PID:4596
-
\??\c:\thnntt.exec:\thnntt.exe96⤵PID:4248
-
\??\c:\3jdpv.exec:\3jdpv.exe97⤵PID:1496
-
\??\c:\pdjjj.exec:\pdjjj.exe98⤵PID:4076
-
\??\c:\xfrlfff.exec:\xfrlfff.exe99⤵PID:3428
-
\??\c:\nbhhbb.exec:\nbhhbb.exe100⤵PID:4024
-
\??\c:\hntnhb.exec:\hntnhb.exe101⤵PID:3704
-
\??\c:\1vvpj.exec:\1vvpj.exe102⤵PID:908
-
\??\c:\lflflfx.exec:\lflflfx.exe103⤵PID:2056
-
\??\c:\tnnntt.exec:\tnnntt.exe104⤵PID:3500
-
\??\c:\pvdpj.exec:\pvdpj.exe105⤵PID:2476
-
\??\c:\1vjdp.exec:\1vjdp.exe106⤵PID:3640
-
\??\c:\fllfrlf.exec:\fllfrlf.exe107⤵PID:4904
-
\??\c:\bnbbbb.exec:\bnbbbb.exe108⤵PID:1784
-
\??\c:\3pppp.exec:\3pppp.exe109⤵PID:4488
-
\??\c:\lxxrlll.exec:\lxxrlll.exe110⤵PID:2812
-
\??\c:\9xfxfll.exec:\9xfxfll.exe111⤵PID:4524
-
\??\c:\bnhbtt.exec:\bnhbtt.exe112⤵PID:336
-
\??\c:\jjjjv.exec:\jjjjv.exe113⤵PID:1968
-
\??\c:\lfrlffx.exec:\lfrlffx.exe114⤵PID:3400
-
\??\c:\nhnhbn.exec:\nhnhbn.exe115⤵PID:1756
-
\??\c:\jpjdp.exec:\jpjdp.exe116⤵PID:1856
-
\??\c:\llxxrrl.exec:\llxxrrl.exe117⤵PID:1660
-
\??\c:\ttttnh.exec:\ttttnh.exe118⤵PID:1388
-
\??\c:\ttbtnt.exec:\ttbtnt.exe119⤵PID:1844
-
\??\c:\vpjjd.exec:\vpjjd.exe120⤵PID:936
-
\??\c:\ffxlxrx.exec:\ffxlxrx.exe121⤵PID:1516
-
\??\c:\3tbnht.exec:\3tbnht.exe122⤵PID:5084
-
\??\c:\hbbtnn.exec:\hbbtnn.exe123⤵PID:3392
-
\??\c:\vpvjj.exec:\vpvjj.exe124⤵PID:968
-
\??\c:\llrrlrr.exec:\llrrlrr.exe125⤵PID:1804
-
\??\c:\ffrrllx.exec:\ffrrllx.exe126⤵PID:2620
-
\??\c:\bthnnn.exec:\bthnnn.exe127⤵PID:4820
-
\??\c:\ppvvp.exec:\ppvvp.exe128⤵PID:2356
-
\??\c:\lrfxrxx.exec:\lrfxrxx.exe129⤵PID:3672
-
\??\c:\btttnn.exec:\btttnn.exe130⤵PID:1956
-
\??\c:\5pjdv.exec:\5pjdv.exe131⤵PID:5032
-
\??\c:\ddjjv.exec:\ddjjv.exe132⤵PID:3464
-
\??\c:\7frlfff.exec:\7frlfff.exe133⤵PID:2452
-
\??\c:\bhtbth.exec:\bhtbth.exe134⤵PID:1548
-
\??\c:\hbnbtt.exec:\hbnbtt.exe135⤵PID:4240
-
\??\c:\jpvpj.exec:\jpvpj.exe136⤵PID:1832
-
\??\c:\lfllflf.exec:\lfllflf.exe137⤵PID:404
-
\??\c:\htnnnh.exec:\htnnnh.exe138⤵PID:4160
-
\??\c:\jddpd.exec:\jddpd.exe139⤵PID:1764
-
\??\c:\jdjdp.exec:\jdjdp.exe140⤵PID:5052
-
\??\c:\rfrlxxr.exec:\rfrlxxr.exe141⤵PID:2112
-
\??\c:\bbhnbt.exec:\bbhnbt.exe142⤵PID:3972
-
\??\c:\bthbnn.exec:\bthbnn.exe143⤵PID:2068
-
\??\c:\dvpjd.exec:\dvpjd.exe144⤵PID:3232
-
\??\c:\9xfxxxr.exec:\9xfxxxr.exe145⤵PID:1644
-
\??\c:\btnhhh.exec:\btnhhh.exe146⤵PID:5048
-
\??\c:\bntnbb.exec:\bntnbb.exe147⤵PID:4124
-
\??\c:\pjvpj.exec:\pjvpj.exe148⤵PID:8
-
\??\c:\rffxrlf.exec:\rffxrlf.exe149⤵PID:3640
-
\??\c:\hthbbt.exec:\hthbbt.exe150⤵PID:4824
-
\??\c:\hbnntt.exec:\hbnntt.exe151⤵PID:2192
-
\??\c:\dvjvp.exec:\dvjvp.exe152⤵PID:2848
-
\??\c:\1rfxxxr.exec:\1rfxxxr.exe153⤵PID:2204
-
\??\c:\rlfxrrf.exec:\rlfxrrf.exe154⤵PID:1944
-
\??\c:\1hnnhb.exec:\1hnnhb.exe155⤵PID:3168
-
\??\c:\jdpdv.exec:\jdpdv.exe156⤵PID:1912
-
\??\c:\rfxlfxl.exec:\rfxlfxl.exe157⤵PID:1664
-
\??\c:\fxxxlfl.exec:\fxxxlfl.exe158⤵PID:2336
-
\??\c:\tnnhtt.exec:\tnnhtt.exe159⤵PID:4108
-
\??\c:\7vpjv.exec:\7vpjv.exe160⤵PID:3720
-
\??\c:\flxlfxr.exec:\flxlfxr.exe161⤵PID:5040
-
\??\c:\bnbttt.exec:\bnbttt.exe162⤵PID:5104
-
\??\c:\tbtntb.exec:\tbtntb.exe163⤵PID:936
-
\??\c:\vvjdv.exec:\vvjdv.exe164⤵PID:1992
-
\??\c:\1lrfxxr.exec:\1lrfxxr.exe165⤵PID:532
-
\??\c:\fxffffl.exec:\fxffffl.exe166⤵PID:2140
-
\??\c:\tttnnn.exec:\tttnnn.exe167⤵PID:3368
-
\??\c:\pdjdp.exec:\pdjdp.exe168⤵PID:2620
-
\??\c:\rlrlrlr.exec:\rlrlrlr.exe169⤵PID:3748
-
\??\c:\xflfxxx.exec:\xflfxxx.exe170⤵PID:4472
-
\??\c:\nhbtnn.exec:\nhbtnn.exe171⤵PID:4460
-
\??\c:\9vvpj.exec:\9vvpj.exe172⤵PID:2860
-
\??\c:\pvdvp.exec:\pvdvp.exe173⤵PID:1600
-
\??\c:\frrlfxr.exec:\frrlfxr.exe174⤵PID:3440
-
\??\c:\rfflffx.exec:\rfflffx.exe175⤵PID:1528
-
\??\c:\hntnhn.exec:\hntnhn.exe176⤵PID:2316
-
\??\c:\vpvpj.exec:\vpvpj.exe177⤵PID:1860
-
\??\c:\pjpjp.exec:\pjpjp.exe178⤵PID:3048
-
\??\c:\rxfrrll.exec:\rxfrrll.exe179⤵PID:2696
-
\??\c:\hnttnn.exec:\hnttnn.exe180⤵PID:3708
-
\??\c:\jpjpj.exec:\jpjpj.exe181⤵PID:1808
-
\??\c:\lfrlfff.exec:\lfrlfff.exe182⤵PID:3388
-
\??\c:\httnhh.exec:\httnhh.exe183⤵PID:4024
-
\??\c:\vvjvv.exec:\vvjvv.exe184⤵PID:1744
-
\??\c:\rlfxrlf.exec:\rlfxrlf.exe185⤵PID:2524
-
\??\c:\xxxrllf.exec:\xxxrllf.exe186⤵PID:1644
-
\??\c:\nttbtt.exec:\nttbtt.exe187⤵PID:5048
-
\??\c:\pjvpv.exec:\pjvpv.exe188⤵PID:4432
-
\??\c:\rfxlllr.exec:\rfxlllr.exe189⤵PID:4668
-
\??\c:\jddpd.exec:\jddpd.exe190⤵PID:3292
-
\??\c:\rrxlfxr.exec:\rrxlfxr.exe191⤵PID:3692
-
\??\c:\rlffxxr.exec:\rlffxxr.exe192⤵PID:4436
-
\??\c:\1ttnnn.exec:\1ttnnn.exe193⤵PID:4880
-
\??\c:\7vvpj.exec:\7vvpj.exe194⤵PID:1968
-
\??\c:\vjppp.exec:\vjppp.exe195⤵PID:5024
-
\??\c:\1xrlflf.exec:\1xrlflf.exe196⤵PID:1856
-
\??\c:\bbbhhn.exec:\bbbhhn.exe197⤵PID:1660
-
\??\c:\7nnhbb.exec:\7nnhbb.exe198⤵PID:4108
-
\??\c:\jjpdj.exec:\jjpdj.exe199⤵PID:3720
-
\??\c:\xllfxxx.exec:\xllfxxx.exe200⤵PID:3336
-
\??\c:\llxxxrx.exec:\llxxxrx.exe201⤵PID:2544
-
\??\c:\ttthnn.exec:\ttthnn.exe202⤵PID:5084
-
\??\c:\dvvpp.exec:\dvvpp.exe203⤵PID:2844
-
\??\c:\rrxrflf.exec:\rrxrflf.exe204⤵PID:3120
-
\??\c:\frxrlrl.exec:\frxrlrl.exe205⤵PID:732
-
\??\c:\tnbbtb.exec:\tnbbtb.exe206⤵PID:392
-
\??\c:\pjjjd.exec:\pjjjd.exe207⤵PID:3672
-
\??\c:\5djpp.exec:\5djpp.exe208⤵PID:1616
-
\??\c:\rrxrlxr.exec:\rrxrlxr.exe209⤵PID:1956
-
\??\c:\hhnnnh.exec:\hhnnnh.exe210⤵PID:2860
-
\??\c:\jdvvv.exec:\jdvvv.exe211⤵PID:4040
-
\??\c:\jdvdv.exec:\jdvdv.exe212⤵PID:3468
-
\??\c:\lxxrllf.exec:\lxxrllf.exe213⤵PID:1528
-
\??\c:\hbnhbb.exec:\hbnhbb.exe214⤵PID:2316
-
\??\c:\pjpjp.exec:\pjpjp.exe215⤵PID:1860
-
\??\c:\pjvpp.exec:\pjvpp.exe216⤵PID:4248
-
\??\c:\llxrrxx.exec:\llxrrxx.exe217⤵PID:3784
-
\??\c:\htbnhb.exec:\htbnhb.exe218⤵PID:3428
-
\??\c:\7vjdd.exec:\7vjdd.exe219⤵PID:3288
-
\??\c:\pjvdd.exec:\pjvdd.exe220⤵PID:3972
-
\??\c:\rfrlxxx.exec:\rfrlxxx.exe221⤵PID:1072
-
\??\c:\nnnbth.exec:\nnnbth.exe222⤵PID:5100
-
\??\c:\pjppp.exec:\pjppp.exe223⤵PID:2768
-
\??\c:\xrxxffl.exec:\xrxxffl.exe224⤵PID:4716
-
\??\c:\ffrlfxr.exec:\ffrlfxr.exe225⤵PID:4376
-
\??\c:\hnnnhb.exec:\hnnnhb.exe226⤵PID:8
-
\??\c:\vpvpp.exec:\vpvpp.exe227⤵PID:4632
-
\??\c:\jdddv.exec:\jdddv.exe228⤵PID:3256
-
\??\c:\1xlxrrl.exec:\1xlxrrl.exe229⤵PID:2848
-
\??\c:\nnbbtt.exec:\nnbbtt.exe230⤵PID:4316
-
\??\c:\pvpjd.exec:\pvpjd.exe231⤵PID:1048
-
\??\c:\dvvdd.exec:\dvvdd.exe232⤵PID:4104
-
\??\c:\rxfrlfx.exec:\rxfrlfx.exe233⤵PID:3460
-
\??\c:\tnnnnn.exec:\tnnnnn.exe234⤵PID:4732
-
\??\c:\vvvvp.exec:\vvvvp.exe235⤵PID:4756
-
\??\c:\rxxrffx.exec:\rxxrffx.exe236⤵PID:1844
-
\??\c:\btbnnh.exec:\btbnnh.exe237⤵PID:4580
-
\??\c:\tthnhb.exec:\tthnhb.exe238⤵PID:5116
-
\??\c:\1dpjp.exec:\1dpjp.exe239⤵PID:880
-
\??\c:\rfxxrrl.exec:\rfxxrrl.exe240⤵PID:1516
-
\??\c:\5ntnnn.exec:\5ntnnn.exe241⤵PID:3948
-
\??\c:\vddvp.exec:\vddvp.exe242⤵PID:3392