Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 14:16
Behavioral task
behavioral1
Sample
d406c0f45f7623b706c8150342941700_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
d406c0f45f7623b706c8150342941700_NeikiAnalytics.exe
-
Size
214KB
-
MD5
d406c0f45f7623b706c8150342941700
-
SHA1
c10276044e0a0a5f3f7a220f266a45185f988f7d
-
SHA256
d8a3a6f121968815cf9095c0345c76b06940d35b983431881253a4e013295fed
-
SHA512
11fa00d1abdbf5f9920c6bc6459563f2b8cf038917c44c753f35545c63ca151b3f586e1ea128b373367e48e6e7585035547f5f8e978ecc6bbb48b18aa7131d98
-
SSDEEP
3072:ZhOm2sI93UufdC67ciEu0P5axvqdUmdznCvs7BuRoYFBg/gXVqPfSoi0yG24ePay:Zcm7ImGddXEu0ucju6/4kf724s
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4776-5-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/860-14-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3912-12-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1028-25-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4996-27-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/5100-33-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2652-48-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/512-54-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/5064-58-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3980-65-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4108-71-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1376-74-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4156-84-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2180-92-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4580-86-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2704-111-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2596-119-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4968-121-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4248-132-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3076-144-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2172-156-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4192-170-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2960-173-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/448-182-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3620-190-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1536-197-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1640-201-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1780-210-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4524-214-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3176-218-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3608-222-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1240-227-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3748-233-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3368-235-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3448-239-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4668-245-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4156-275-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4580-280-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3700-285-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2736-313-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1836-320-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3764-336-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1480-340-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4992-350-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1600-363-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1780-376-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3608-386-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4996-390-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4468-407-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2236-420-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2556-433-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4536-444-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2020-445-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1680-474-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/5088-488-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1560-523-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2852-544-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4048-618-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1756-683-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3076-786-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/5072-806-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3900-882-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2224-900-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4564-1190-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\nntnnn.exe family_berbew \??\c:\pjvpj.exe family_berbew \??\c:\ppvpj.exe family_berbew C:\jjddj.exe family_berbew \??\c:\xrxfxxr.exe family_berbew C:\bntnnn.exe family_berbew C:\hnttbh.exe family_berbew C:\5xxxxxx.exe family_berbew C:\5flllll.exe family_berbew C:\vpdpp.exe family_berbew C:\1xrffrl.exe family_berbew C:\ttnnnt.exe family_berbew C:\jjpjj.exe family_berbew C:\xflllll.exe family_berbew C:\9pvvv.exe family_berbew C:\vvpdd.exe family_berbew C:\nbtnnn.exe family_berbew C:\5ppjj.exe family_berbew C:\lfrlflf.exe family_berbew C:\bnbhhh.exe family_berbew C:\dvvpj.exe family_berbew C:\jjjjv.exe family_berbew \??\c:\fxrrllf.exe family_berbew \??\c:\bbnnnn.exe family_berbew C:\vpvpp.exe family_berbew \??\c:\lflfxll.exe family_berbew \??\c:\tthhtt.exe family_berbew C:\ddppd.exe family_berbew C:\3hnbnb.exe family_berbew \??\c:\xrlfxrl.exe family_berbew C:\vppdp.exe family_berbew C:\lffxllx.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
nntnnn.exepjvpj.exeppvpj.exejjddj.exexrxfxxr.exebntnnn.exehnttbh.exe5xxxxxx.exe5flllll.exevpdpp.exe1xrffrl.exettnnnt.exejjpjj.exexflllll.exe9pvvv.exevvpdd.exenbtnnn.exe5ppjj.exelfrlflf.exebnbhhh.exedvvpj.exejjjjv.exefxrrllf.exebbnnnn.exevpvpp.exelflfxll.exetthhtt.exeddppd.exexrlfxrl.exe3hnbnb.exevppdp.exelffxllx.exelrrfxrf.exehbbttn.exenttnnh.exeppjdv.exe1xxrllx.exe3xxlllf.exennhhbb.exe1jjdp.exefrxlxxr.exerfllffx.exetbbthh.exevjvpd.exe9ddjv.exe3lrfrlr.exexllfxrl.exenhbttn.exejddvv.exepddvp.exe9rxlffx.exe9hthht.exehbhbhh.exe3vpjd.exedddvp.exelxrfxlf.exenhbbtt.exenbhhbh.exerxllxxl.exexrrllrl.exebthhbh.exepjpdj.exedvdvd.exe9djvd.exepid process 860 nntnnn.exe 3912 pjvpj.exe 1028 ppvpj.exe 4996 jjddj.exe 5100 xrxfxxr.exe 4320 bntnnn.exe 2652 hnttbh.exe 512 5xxxxxx.exe 5064 5flllll.exe 3980 vpdpp.exe 4108 1xrffrl.exe 1376 ttnnnt.exe 4156 jjpjj.exe 4580 xflllll.exe 2180 9pvvv.exe 3488 vvpdd.exe 4828 nbtnnn.exe 2704 5ppjj.exe 2596 lfrlflf.exe 4968 bnbhhh.exe 4248 dvvpj.exe 2168 jjjjv.exe 3192 fxrrllf.exe 3076 bbnnnn.exe 4084 vpvpp.exe 2172 lflfxll.exe 756 tthhtt.exe 4192 ddppd.exe 2960 xrlfxrl.exe 448 3hnbnb.exe 4160 vppdp.exe 3620 lffxllx.exe 2356 lrrfxrf.exe 1536 hbbttn.exe 1640 nttnnh.exe 2784 ppjdv.exe 1780 1xxrllx.exe 4524 3xxlllf.exe 3176 nnhhbb.exe 3608 1jjdp.exe 2728 frxlxxr.exe 1240 rfllffx.exe 3748 tbbthh.exe 3368 vjvpd.exe 3448 9ddjv.exe 4668 3lrfrlr.exe 3804 xllfxrl.exe 740 nhbttn.exe 1796 jddvv.exe 1236 pddvp.exe 2988 9rxlffx.exe 5080 9hthht.exe 1672 hbhbhh.exe 4460 3vpjd.exe 2692 dddvp.exe 4156 lxrfxlf.exe 4580 nhbbtt.exe 3700 nbhhbh.exe 2056 rxllxxl.exe 3488 xrrllrl.exe 4828 bthhbh.exe 3932 pjpdj.exe 1176 dvdvd.exe 3872 9djvd.exe -
Processes:
resource yara_rule behavioral2/memory/4776-5-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1028-18-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/860-14-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3912-12-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1028-25-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4996-27-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/5100-33-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2652-48-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/512-54-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/5064-55-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/5064-58-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3980-65-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4108-71-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1376-74-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4156-79-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4156-84-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2180-92-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4580-86-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2704-111-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2596-119-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4968-121-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4248-132-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3192-138-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3076-144-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2172-156-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4192-170-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2960-173-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/448-182-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3620-190-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1536-197-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1640-201-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1780-210-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4524-214-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3176-218-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3608-222-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1240-227-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3748-233-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3368-235-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3448-239-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4668-245-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2692-270-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4156-275-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4580-280-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3700-285-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2736-313-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1836-320-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3764-336-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1480-340-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4992-350-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1600-363-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1780-376-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3608-386-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4996-390-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4468-407-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/452-413-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2236-420-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2556-433-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4640-434-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4536-444-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2020-445-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1276-464-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1680-474-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/5088-488-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4708-494-0x0000000000400000-0x000000000042D000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d406c0f45f7623b706c8150342941700_NeikiAnalytics.exenntnnn.exepjvpj.exeppvpj.exejjddj.exexrxfxxr.exebntnnn.exehnttbh.exe5xxxxxx.exe5flllll.exevpdpp.exe1xrffrl.exettnnnt.exejjpjj.exexflllll.exe9pvvv.exevvpdd.exenbtnnn.exe5ppjj.exelfrlflf.exebnbhhh.exedvvpj.exedescription pid process target process PID 4776 wrote to memory of 860 4776 d406c0f45f7623b706c8150342941700_NeikiAnalytics.exe nntnnn.exe PID 4776 wrote to memory of 860 4776 d406c0f45f7623b706c8150342941700_NeikiAnalytics.exe nntnnn.exe PID 4776 wrote to memory of 860 4776 d406c0f45f7623b706c8150342941700_NeikiAnalytics.exe nntnnn.exe PID 860 wrote to memory of 3912 860 nntnnn.exe pjvpj.exe PID 860 wrote to memory of 3912 860 nntnnn.exe pjvpj.exe PID 860 wrote to memory of 3912 860 nntnnn.exe pjvpj.exe PID 3912 wrote to memory of 1028 3912 pjvpj.exe ppvpj.exe PID 3912 wrote to memory of 1028 3912 pjvpj.exe ppvpj.exe PID 3912 wrote to memory of 1028 3912 pjvpj.exe ppvpj.exe PID 1028 wrote to memory of 4996 1028 ppvpj.exe jjddj.exe PID 1028 wrote to memory of 4996 1028 ppvpj.exe jjddj.exe PID 1028 wrote to memory of 4996 1028 ppvpj.exe jjddj.exe PID 4996 wrote to memory of 5100 4996 jjddj.exe xrxfxxr.exe PID 4996 wrote to memory of 5100 4996 jjddj.exe xrxfxxr.exe PID 4996 wrote to memory of 5100 4996 jjddj.exe xrxfxxr.exe PID 5100 wrote to memory of 4320 5100 xrxfxxr.exe bntnnn.exe PID 5100 wrote to memory of 4320 5100 xrxfxxr.exe bntnnn.exe PID 5100 wrote to memory of 4320 5100 xrxfxxr.exe bntnnn.exe PID 4320 wrote to memory of 2652 4320 bntnnn.exe hnttbh.exe PID 4320 wrote to memory of 2652 4320 bntnnn.exe hnttbh.exe PID 4320 wrote to memory of 2652 4320 bntnnn.exe hnttbh.exe PID 2652 wrote to memory of 512 2652 hnttbh.exe 5xxxxxx.exe PID 2652 wrote to memory of 512 2652 hnttbh.exe 5xxxxxx.exe PID 2652 wrote to memory of 512 2652 hnttbh.exe 5xxxxxx.exe PID 512 wrote to memory of 5064 512 5xxxxxx.exe 5flllll.exe PID 512 wrote to memory of 5064 512 5xxxxxx.exe 5flllll.exe PID 512 wrote to memory of 5064 512 5xxxxxx.exe 5flllll.exe PID 5064 wrote to memory of 3980 5064 5flllll.exe vpdpp.exe PID 5064 wrote to memory of 3980 5064 5flllll.exe vpdpp.exe PID 5064 wrote to memory of 3980 5064 5flllll.exe vpdpp.exe PID 3980 wrote to memory of 4108 3980 vpdpp.exe 1xrffrl.exe PID 3980 wrote to memory of 4108 3980 vpdpp.exe 1xrffrl.exe PID 3980 wrote to memory of 4108 3980 vpdpp.exe 1xrffrl.exe PID 4108 wrote to memory of 1376 4108 1xrffrl.exe ttnnnt.exe PID 4108 wrote to memory of 1376 4108 1xrffrl.exe ttnnnt.exe PID 4108 wrote to memory of 1376 4108 1xrffrl.exe ttnnnt.exe PID 1376 wrote to memory of 4156 1376 ttnnnt.exe jjpjj.exe PID 1376 wrote to memory of 4156 1376 ttnnnt.exe jjpjj.exe PID 1376 wrote to memory of 4156 1376 ttnnnt.exe jjpjj.exe PID 4156 wrote to memory of 4580 4156 jjpjj.exe xflllll.exe PID 4156 wrote to memory of 4580 4156 jjpjj.exe xflllll.exe PID 4156 wrote to memory of 4580 4156 jjpjj.exe xflllll.exe PID 4580 wrote to memory of 2180 4580 xflllll.exe 9pvvv.exe PID 4580 wrote to memory of 2180 4580 xflllll.exe 9pvvv.exe PID 4580 wrote to memory of 2180 4580 xflllll.exe 9pvvv.exe PID 2180 wrote to memory of 3488 2180 9pvvv.exe vvpdd.exe PID 2180 wrote to memory of 3488 2180 9pvvv.exe vvpdd.exe PID 2180 wrote to memory of 3488 2180 9pvvv.exe vvpdd.exe PID 3488 wrote to memory of 4828 3488 vvpdd.exe nbtnnn.exe PID 3488 wrote to memory of 4828 3488 vvpdd.exe nbtnnn.exe PID 3488 wrote to memory of 4828 3488 vvpdd.exe nbtnnn.exe PID 4828 wrote to memory of 2704 4828 nbtnnn.exe 5ppjj.exe PID 4828 wrote to memory of 2704 4828 nbtnnn.exe 5ppjj.exe PID 4828 wrote to memory of 2704 4828 nbtnnn.exe 5ppjj.exe PID 2704 wrote to memory of 2596 2704 5ppjj.exe lfrlflf.exe PID 2704 wrote to memory of 2596 2704 5ppjj.exe lfrlflf.exe PID 2704 wrote to memory of 2596 2704 5ppjj.exe lfrlflf.exe PID 2596 wrote to memory of 4968 2596 lfrlflf.exe bnbhhh.exe PID 2596 wrote to memory of 4968 2596 lfrlflf.exe bnbhhh.exe PID 2596 wrote to memory of 4968 2596 lfrlflf.exe bnbhhh.exe PID 4968 wrote to memory of 4248 4968 bnbhhh.exe dvvpj.exe PID 4968 wrote to memory of 4248 4968 bnbhhh.exe dvvpj.exe PID 4968 wrote to memory of 4248 4968 bnbhhh.exe dvvpj.exe PID 4248 wrote to memory of 2168 4248 dvvpj.exe jjjjv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d406c0f45f7623b706c8150342941700_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d406c0f45f7623b706c8150342941700_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\nntnnn.exec:\nntnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\pjvpj.exec:\pjvpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
\??\c:\ppvpj.exec:\ppvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\jjddj.exec:\jjddj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\xrxfxxr.exec:\xrxfxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\bntnnn.exec:\bntnnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\hnttbh.exec:\hnttbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\5xxxxxx.exec:\5xxxxxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
\??\c:\5flllll.exec:\5flllll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\vpdpp.exec:\vpdpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\1xrffrl.exec:\1xrffrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
\??\c:\ttnnnt.exec:\ttnnnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\jjpjj.exec:\jjpjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\xflllll.exec:\xflllll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\9pvvv.exec:\9pvvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\vvpdd.exec:\vvpdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\nbtnnn.exec:\nbtnnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\5ppjj.exec:\5ppjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\lfrlflf.exec:\lfrlflf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\bnbhhh.exec:\bnbhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\dvvpj.exec:\dvvpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\jjjjv.exec:\jjjjv.exe23⤵
- Executes dropped EXE
PID:2168 -
\??\c:\fxrrllf.exec:\fxrrllf.exe24⤵
- Executes dropped EXE
PID:3192 -
\??\c:\bbnnnn.exec:\bbnnnn.exe25⤵
- Executes dropped EXE
PID:3076 -
\??\c:\vpvpp.exec:\vpvpp.exe26⤵
- Executes dropped EXE
PID:4084 -
\??\c:\lflfxll.exec:\lflfxll.exe27⤵
- Executes dropped EXE
PID:2172 -
\??\c:\tthhtt.exec:\tthhtt.exe28⤵
- Executes dropped EXE
PID:756 -
\??\c:\ddppd.exec:\ddppd.exe29⤵
- Executes dropped EXE
PID:4192 -
\??\c:\xrlfxrl.exec:\xrlfxrl.exe30⤵
- Executes dropped EXE
PID:2960 -
\??\c:\3hnbnb.exec:\3hnbnb.exe31⤵
- Executes dropped EXE
PID:448 -
\??\c:\vppdp.exec:\vppdp.exe32⤵
- Executes dropped EXE
PID:4160 -
\??\c:\lffxllx.exec:\lffxllx.exe33⤵
- Executes dropped EXE
PID:3620 -
\??\c:\lrrfxrf.exec:\lrrfxrf.exe34⤵
- Executes dropped EXE
PID:2356 -
\??\c:\hbbttn.exec:\hbbttn.exe35⤵
- Executes dropped EXE
PID:1536 -
\??\c:\nttnnh.exec:\nttnnh.exe36⤵
- Executes dropped EXE
PID:1640 -
\??\c:\ppjdv.exec:\ppjdv.exe37⤵
- Executes dropped EXE
PID:2784 -
\??\c:\1xxrllx.exec:\1xxrllx.exe38⤵
- Executes dropped EXE
PID:1780 -
\??\c:\3xxlllf.exec:\3xxlllf.exe39⤵
- Executes dropped EXE
PID:4524 -
\??\c:\nnhhbb.exec:\nnhhbb.exe40⤵
- Executes dropped EXE
PID:3176 -
\??\c:\1jjdp.exec:\1jjdp.exe41⤵
- Executes dropped EXE
PID:3608 -
\??\c:\frxlxxr.exec:\frxlxxr.exe42⤵
- Executes dropped EXE
PID:2728 -
\??\c:\rfllffx.exec:\rfllffx.exe43⤵
- Executes dropped EXE
PID:1240 -
\??\c:\tbbthh.exec:\tbbthh.exe44⤵
- Executes dropped EXE
PID:3748 -
\??\c:\vjvpd.exec:\vjvpd.exe45⤵
- Executes dropped EXE
PID:3368 -
\??\c:\9ddjv.exec:\9ddjv.exe46⤵
- Executes dropped EXE
PID:3448 -
\??\c:\3lrfrlr.exec:\3lrfrlr.exe47⤵
- Executes dropped EXE
PID:4668 -
\??\c:\xllfxrl.exec:\xllfxrl.exe48⤵
- Executes dropped EXE
PID:3804 -
\??\c:\nhbttn.exec:\nhbttn.exe49⤵
- Executes dropped EXE
PID:740 -
\??\c:\jddvv.exec:\jddvv.exe50⤵
- Executes dropped EXE
PID:1796 -
\??\c:\pddvp.exec:\pddvp.exe51⤵
- Executes dropped EXE
PID:1236 -
\??\c:\9rxlffx.exec:\9rxlffx.exe52⤵
- Executes dropped EXE
PID:2988 -
\??\c:\9hthht.exec:\9hthht.exe53⤵
- Executes dropped EXE
PID:5080 -
\??\c:\hbhbhh.exec:\hbhbhh.exe54⤵
- Executes dropped EXE
PID:1672 -
\??\c:\3vpjd.exec:\3vpjd.exe55⤵
- Executes dropped EXE
PID:4460 -
\??\c:\dddvp.exec:\dddvp.exe56⤵
- Executes dropped EXE
PID:2692 -
\??\c:\lxrfxlf.exec:\lxrfxlf.exe57⤵
- Executes dropped EXE
PID:4156 -
\??\c:\nhbbtt.exec:\nhbbtt.exe58⤵
- Executes dropped EXE
PID:4580 -
\??\c:\nbhhbh.exec:\nbhhbh.exe59⤵
- Executes dropped EXE
PID:3700 -
\??\c:\rxllxxl.exec:\rxllxxl.exe60⤵
- Executes dropped EXE
PID:2056 -
\??\c:\xrrllrl.exec:\xrrllrl.exe61⤵
- Executes dropped EXE
PID:3488 -
\??\c:\bthhbh.exec:\bthhbh.exe62⤵
- Executes dropped EXE
PID:4828 -
\??\c:\pjpdj.exec:\pjpdj.exe63⤵
- Executes dropped EXE
PID:3932 -
\??\c:\dvdvd.exec:\dvdvd.exe64⤵
- Executes dropped EXE
PID:1176 -
\??\c:\9djvd.exec:\9djvd.exe65⤵
- Executes dropped EXE
PID:3872 -
\??\c:\nhhtbb.exec:\nhhtbb.exe66⤵PID:2700
-
\??\c:\vppdp.exec:\vppdp.exe67⤵PID:2832
-
\??\c:\pppdp.exec:\pppdp.exe68⤵PID:2736
-
\??\c:\frxrlrr.exec:\frxrlrr.exe69⤵PID:4248
-
\??\c:\nnnnhb.exec:\nnnnhb.exe70⤵PID:1836
-
\??\c:\1ntthb.exec:\1ntthb.exe71⤵PID:1628
-
\??\c:\pdvjv.exec:\pdvjv.exe72⤵PID:2996
-
\??\c:\fxxrfxr.exec:\fxxrfxr.exe73⤵PID:5016
-
\??\c:\rffxrlf.exec:\rffxrlf.exe74⤵PID:4048
-
\??\c:\3hnhnt.exec:\3hnhnt.exe75⤵PID:3764
-
\??\c:\ppjjd.exec:\ppjjd.exe76⤵PID:1480
-
\??\c:\pjvpd.exec:\pjvpd.exe77⤵PID:3720
-
\??\c:\7llfxxx.exec:\7llfxxx.exe78⤵PID:4192
-
\??\c:\nhnhtn.exec:\nhnhtn.exe79⤵PID:4992
-
\??\c:\ttbnnh.exec:\ttbnnh.exe80⤵PID:4688
-
\??\c:\9vvpd.exec:\9vvpd.exe81⤵PID:3104
-
\??\c:\7fxlxrf.exec:\7fxlxrf.exe82⤵PID:2280
-
\??\c:\5hnhhh.exec:\5hnhhh.exe83⤵PID:1600
-
\??\c:\tbthbt.exec:\tbthbt.exe84⤵PID:640
-
\??\c:\djvvd.exec:\djvvd.exe85⤵PID:1640
-
\??\c:\frrfrrl.exec:\frrfrrl.exe86⤵PID:2784
-
\??\c:\fflrrlf.exec:\fflrrlf.exe87⤵PID:1780
-
\??\c:\tbhbtt.exec:\tbhbtt.exe88⤵PID:860
-
\??\c:\ppdvv.exec:\ppdvv.exe89⤵PID:4508
-
\??\c:\xlffxfr.exec:\xlffxfr.exe90⤵PID:3608
-
\??\c:\3ffrlfx.exec:\3ffrlfx.exe91⤵PID:1560
-
\??\c:\1tthhh.exec:\1tthhh.exe92⤵PID:4996
-
\??\c:\tntbbb.exec:\tntbbb.exe93⤵PID:4220
-
\??\c:\pvpdp.exec:\pvpdp.exe94⤵PID:5108
-
\??\c:\dvjdp.exec:\dvjdp.exe95⤵PID:3692
-
\??\c:\xrrlxrl.exec:\xrrlxrl.exe96⤵PID:5040
-
\??\c:\rrfxfxf.exec:\rrfxfxf.exe97⤵PID:4468
-
\??\c:\nhhbnn.exec:\nhhbnn.exe98⤵PID:3208
-
\??\c:\nbbtth.exec:\nbbtth.exe99⤵PID:452
-
\??\c:\5vvpd.exec:\5vvpd.exe100⤵PID:4124
-
\??\c:\jjjvj.exec:\jjjvj.exe101⤵PID:2236
-
\??\c:\rfxrllr.exec:\rfxrllr.exe102⤵PID:1044
-
\??\c:\lllfxrf.exec:\lllfxrf.exe103⤵PID:2368
-
\??\c:\hbnntt.exec:\hbnntt.exe104⤵PID:2556
-
\??\c:\hbnhbb.exec:\hbnhbb.exe105⤵PID:4640
-
\??\c:\dpdvj.exec:\dpdvj.exe106⤵PID:3700
-
\??\c:\xflflrl.exec:\xflflrl.exe107⤵PID:4536
-
\??\c:\rxfxlfx.exec:\rxfxlfx.exe108⤵PID:2020
-
\??\c:\htbtbb.exec:\htbtbb.exe109⤵PID:4828
-
\??\c:\tnnhtt.exec:\tnnhtt.exe110⤵PID:3932
-
\??\c:\jddvj.exec:\jddvj.exe111⤵PID:2760
-
\??\c:\jvpjv.exec:\jvpjv.exe112⤵PID:4644
-
\??\c:\fxfxxlx.exec:\fxfxxlx.exe113⤵PID:1316
-
\??\c:\3xrffxl.exec:\3xrffxl.exe114⤵PID:1276
-
\??\c:\1vdvd.exec:\1vdvd.exe115⤵PID:2736
-
\??\c:\ppvjv.exec:\ppvjv.exe116⤵PID:1680
-
\??\c:\5lxrxxx.exec:\5lxrxxx.exe117⤵PID:2496
-
\??\c:\ttbttt.exec:\ttbttt.exe118⤵PID:2996
-
\??\c:\hhnntt.exec:\hhnntt.exe119⤵PID:4672
-
\??\c:\jpvvv.exec:\jpvvv.exe120⤵PID:592
-
\??\c:\vppdv.exec:\vppdv.exe121⤵PID:5088
-
\??\c:\lrrrlll.exec:\lrrrlll.exe122⤵PID:5092
-
\??\c:\rfxrxxl.exec:\rfxrxxl.exe123⤵PID:4708
-
\??\c:\nnnhbh.exec:\nnnhbh.exe124⤵PID:4484
-
\??\c:\djdvj.exec:\djdvj.exe125⤵PID:4688
-
\??\c:\ppddv.exec:\ppddv.exe126⤵PID:220
-
\??\c:\xxlfrxl.exec:\xxlfrxl.exe127⤵PID:1600
-
\??\c:\xfffllr.exec:\xfffllr.exe128⤵PID:3568
-
\??\c:\htnhbh.exec:\htnhbh.exe129⤵PID:4872
-
\??\c:\vppvp.exec:\vppvp.exe130⤵PID:432
-
\??\c:\dpvdv.exec:\dpvdv.exe131⤵PID:4564
-
\??\c:\lxllfff.exec:\lxllfff.exe132⤵PID:1560
-
\??\c:\tnnntt.exec:\tnnntt.exe133⤵PID:4520
-
\??\c:\bhhhhh.exec:\bhhhhh.exe134⤵PID:4320
-
\??\c:\vvjjd.exec:\vvjjd.exe135⤵PID:1472
-
\??\c:\vvdvv.exec:\vvdvv.exe136⤵PID:5072
-
\??\c:\9rlrrff.exec:\9rlrrff.exe137⤵PID:2852
-
\??\c:\9rxrlrl.exec:\9rxrlrl.exe138⤵PID:1960
-
\??\c:\vdjdd.exec:\vdjdd.exe139⤵PID:864
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe140⤵PID:2468
-
\??\c:\rrrrlll.exec:\rrrrlll.exe141⤵PID:4124
-
\??\c:\9hhnhn.exec:\9hhnhn.exe142⤵PID:4184
-
\??\c:\7thhtb.exec:\7thhtb.exe143⤵PID:1044
-
\??\c:\vvvdv.exec:\vvvdv.exe144⤵PID:2368
-
\??\c:\rlffffr.exec:\rlffffr.exe145⤵PID:4580
-
\??\c:\rxxffff.exec:\rxxffff.exe146⤵PID:3100
-
\??\c:\hbtbbh.exec:\hbtbbh.exe147⤵PID:3048
-
\??\c:\ddvjd.exec:\ddvjd.exe148⤵PID:3248
-
\??\c:\djvpj.exec:\djvpj.exe149⤵PID:4808
-
\??\c:\fffffff.exec:\fffffff.exe150⤵PID:1080
-
\??\c:\tntnnt.exec:\tntnnt.exe151⤵PID:540
-
\??\c:\tbbttt.exec:\tbbttt.exe152⤵PID:3872
-
\??\c:\pvdjj.exec:\pvdjj.exe153⤵PID:2700
-
\??\c:\7xrrrxx.exec:\7xrrrxx.exe154⤵PID:1316
-
\??\c:\vvvvp.exec:\vvvvp.exe155⤵PID:3904
-
\??\c:\pvddv.exec:\pvddv.exe156⤵PID:3848
-
\??\c:\1hhttt.exec:\1hhttt.exe157⤵PID:4940
-
\??\c:\djvjd.exec:\djvjd.exe158⤵PID:2860
-
\??\c:\dvjdj.exec:\dvjdj.exe159⤵PID:4364
-
\??\c:\tntttt.exec:\tntttt.exe160⤵PID:3556
-
\??\c:\nhhhhh.exec:\nhhhhh.exe161⤵PID:4048
-
\??\c:\ppppj.exec:\ppppj.exe162⤵PID:3500
-
\??\c:\3lrlrrr.exec:\3lrlrrr.exe163⤵PID:2004
-
\??\c:\rrxxxff.exec:\rrxxxff.exe164⤵PID:2560
-
\??\c:\9bhhhb.exec:\9bhhhb.exe165⤵PID:1408
-
\??\c:\bbbbhh.exec:\bbbbhh.exe166⤵PID:3840
-
\??\c:\dvpvv.exec:\dvpvv.exe167⤵PID:3052
-
\??\c:\vpvpj.exec:\vpvpj.exe168⤵PID:2648
-
\??\c:\rlrllrl.exec:\rlrllrl.exe169⤵PID:2504
-
\??\c:\xrffffl.exec:\xrffffl.exe170⤵PID:3924
-
\??\c:\3bnthh.exec:\3bnthh.exe171⤵PID:3876
-
\??\c:\nhnnhh.exec:\nhnnhh.exe172⤵PID:920
-
\??\c:\pvddv.exec:\pvddv.exe173⤵PID:2728
-
\??\c:\1lflrxr.exec:\1lflrxr.exe174⤵PID:468
-
\??\c:\lllxrxl.exec:\lllxrxl.exe175⤵PID:392
-
\??\c:\5thbnn.exec:\5thbnn.exe176⤵PID:4668
-
\??\c:\9hhbbb.exec:\9hhbbb.exe177⤵PID:3804
-
\??\c:\vpdvv.exec:\vpdvv.exe178⤵PID:1812
-
\??\c:\9dvjv.exec:\9dvjv.exe179⤵PID:1996
-
\??\c:\lfxrllf.exec:\lfxrllf.exe180⤵PID:3340
-
\??\c:\1rxlffx.exec:\1rxlffx.exe181⤵PID:1960
-
\??\c:\thhtnt.exec:\thhtnt.exe182⤵PID:864
-
\??\c:\bnbbtb.exec:\bnbbtb.exe183⤵PID:1756
-
\??\c:\5jpdd.exec:\5jpdd.exe184⤵PID:4420
-
\??\c:\pdpjd.exec:\pdpjd.exe185⤵PID:2928
-
\??\c:\fxlxrll.exec:\fxlxrll.exe186⤵PID:4004
-
\??\c:\rlfxrlf.exec:\rlfxrlf.exe187⤵PID:2872
-
\??\c:\tbnnnn.exec:\tbnnnn.exe188⤵PID:2456
-
\??\c:\7dvvj.exec:\7dvvj.exe189⤵PID:684
-
\??\c:\5djjv.exec:\5djjv.exe190⤵PID:536
-
\??\c:\fflfrrr.exec:\fflfrrr.exe191⤵PID:2724
-
\??\c:\1xlllrx.exec:\1xlllrx.exe192⤵PID:4984
-
\??\c:\tntnhh.exec:\tntnhh.exe193⤵PID:3572
-
\??\c:\jjvpp.exec:\jjvpp.exe194⤵PID:3628
-
\??\c:\pjvvp.exec:\pjvvp.exe195⤵PID:4312
-
\??\c:\3vvpp.exec:\3vvpp.exe196⤵PID:4856
-
\??\c:\rlrlllf.exec:\rlrlllf.exe197⤵PID:2736
-
\??\c:\xlrfxxr.exec:\xlrfxxr.exe198⤵PID:1972
-
\??\c:\nhhbtt.exec:\nhhbtt.exe199⤵PID:2964
-
\??\c:\bnthbb.exec:\bnthbb.exe200⤵PID:2996
-
\??\c:\jjjvp.exec:\jjjvp.exe201⤵PID:4672
-
\??\c:\3jpjj.exec:\3jpjj.exe202⤵PID:4892
-
\??\c:\lfxrllx.exec:\lfxrllx.exe203⤵PID:5088
-
\??\c:\3xlfxrr.exec:\3xlfxrr.exe204⤵PID:5092
-
\??\c:\tnnhtt.exec:\tnnhtt.exe205⤵PID:4488
-
\??\c:\nhbttt.exec:\nhbttt.exe206⤵PID:4484
-
\??\c:\vpvjp.exec:\vpvjp.exe207⤵PID:3620
-
\??\c:\ddjdp.exec:\ddjdp.exe208⤵PID:2224
-
\??\c:\xxlxrlf.exec:\xxlxrlf.exe209⤵PID:1600
-
\??\c:\fflfxrl.exec:\fflfxrl.exe210⤵PID:4400
-
\??\c:\5hnnhh.exec:\5hnnhh.exe211⤵PID:1780
-
\??\c:\hbhbtn.exec:\hbhbtn.exe212⤵PID:432
-
\??\c:\vvvpj.exec:\vvvpj.exe213⤵PID:3916
-
\??\c:\jjpdv.exec:\jjpdv.exe214⤵PID:2256
-
\??\c:\rllfxll.exec:\rllfxll.exe215⤵PID:3076
-
\??\c:\frlrllf.exec:\frlrllf.exe216⤵PID:3944
-
\??\c:\hhhtbb.exec:\hhhtbb.exe217⤵PID:2992
-
\??\c:\pjdvp.exec:\pjdvp.exe218⤵PID:2816
-
\??\c:\1pvpd.exec:\1pvpd.exe219⤵PID:3376
-
\??\c:\1rlxlxr.exec:\1rlxlxr.exe220⤵PID:1568
-
\??\c:\xrrlffx.exec:\xrrlffx.exe221⤵PID:5072
-
\??\c:\ttbtnb.exec:\ttbtnb.exe222⤵PID:2016
-
\??\c:\hhhhbt.exec:\hhhhbt.exe223⤵PID:3208
-
\??\c:\5vdvj.exec:\5vdvj.exe224⤵PID:452
-
\??\c:\1jdvj.exec:\1jdvj.exe225⤵PID:4052
-
\??\c:\5flfrlf.exec:\5flfrlf.exe226⤵PID:4124
-
\??\c:\rrlxxrl.exec:\rrlxxrl.exe227⤵PID:3388
-
\??\c:\tnnhbt.exec:\tnnhbt.exe228⤵PID:3644
-
\??\c:\7hnnbh.exec:\7hnnbh.exe229⤵PID:3796
-
\??\c:\pjdpj.exec:\pjdpj.exe230⤵PID:1700
-
\??\c:\djpjd.exec:\djpjd.exe231⤵PID:3700
-
\??\c:\xrlxllr.exec:\xrlxllr.exe232⤵PID:3356
-
\??\c:\xlrrlff.exec:\xlrrlff.exe233⤵PID:2704
-
\??\c:\nbhhhh.exec:\nbhhhh.exe234⤵PID:4808
-
\??\c:\hnnhht.exec:\hnnhht.exe235⤵PID:2596
-
\??\c:\dvdvj.exec:\dvdvj.exe236⤵PID:1672
-
\??\c:\ddvvp.exec:\ddvvp.exe237⤵PID:4984
-
\??\c:\frxrrrr.exec:\frxrrrr.exe238⤵PID:3572
-
\??\c:\3tbbtn.exec:\3tbbtn.exe239⤵PID:3628
-
\??\c:\nhhbnn.exec:\nhhbnn.exe240⤵PID:4312
-
\??\c:\vddpj.exec:\vddpj.exe241⤵PID:4676
-
\??\c:\3rrflff.exec:\3rrflff.exe242⤵PID:4364