Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
04-06-2024 04:57
Behavioral task
behavioral1
Sample
2fa6fa1228e96b55b3ad77a8c627b850_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
2fa6fa1228e96b55b3ad77a8c627b850_NeikiAnalytics.exe
-
Size
487KB
-
MD5
2fa6fa1228e96b55b3ad77a8c627b850
-
SHA1
08a12fcd0d22ba7f243d387029d64f1ef06b3c23
-
SHA256
ae81795b2be121ba562b640838cd646bc366d21410a73c662163a261c97dcd6d
-
SHA512
dbd23abf81e652a75972faa628745632ade5821a59eba7a71f9af1ba204651b01c292812d18c814888225b2476cb0683f4869d2323de8db91161a162ba6c2f8b
-
SSDEEP
6144:mcm7ImGddXv/VWrXD486jCpoAhlq1mEjBqLyOSlhNFF23yL:I7TcfNWj168w1VjsyvhNFF2iL
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1524-8-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4820-6-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4496-14-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/5112-24-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/464-32-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1144-40-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2264-63-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3600-125-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/384-145-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4888-176-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4888-182-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2348-191-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1152-195-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2628-206-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2628-209-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3136-213-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4776-217-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4216-246-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4820-258-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2888-270-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1328-274-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1188-282-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3056-287-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4832-328-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/864-340-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/896-387-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/8-531-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2016-642-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1008-668-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2204-679-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3144-608-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3584-565-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3152-447-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/548-446-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3848-376-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2668-344-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1608-336-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/5116-332-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2732-321-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2268-320-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1740-299-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2620-294-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2108-286-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/464-278-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4488-254-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3572-250-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3124-227-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4196-170-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2916-169-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1480-148-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1572-131-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2668-124-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4740-107-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2428-101-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4272-84-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4080-78-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1272-69-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2652-52-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1228-50-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2632-38-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/628-798-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3940-832-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3220-851-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/5088-876-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\lfrllrr.exe family_berbew \??\c:\nhthtt.exe family_berbew \??\c:\jdjvp.exe family_berbew \??\c:\frlrlff.exe family_berbew C:\rlxrxlr.exe family_berbew \??\c:\nhhhbb.exe family_berbew \??\c:\vvddv.exe family_berbew \??\c:\lfxlrrf.exe family_berbew C:\1fxlrrf.exe family_berbew \??\c:\jjjdd.exe family_berbew \??\c:\flrfrlr.exe family_berbew \??\c:\nbhhbb.exe family_berbew C:\rxrlfxx.exe family_berbew \??\c:\lfllfxx.exe family_berbew \??\c:\7ddvp.exe family_berbew \??\c:\3pvjd.exe family_berbew \??\c:\3nthnh.exe family_berbew \??\c:\dvdvp.exe family_berbew \??\c:\hbbbtb.exe family_berbew \??\c:\dvvpj.exe family_berbew \??\c:\5flxflf.exe family_berbew C:\rxxxrlx.exe family_berbew \??\c:\vpdvj.exe family_berbew \??\c:\rflfffx.exe family_berbew \??\c:\vdvpj.exe family_berbew \??\c:\3ddvp.exe family_berbew \??\c:\flfrlfx.exe family_berbew \??\c:\1hnhbh.exe family_berbew \??\c:\pdppp.exe family_berbew \??\c:\5rllxfx.exe family_berbew \??\c:\1pjdv.exe family_berbew \??\c:\hhtbht.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
lfrllrr.exenhthtt.exejdjvp.exefrlrlff.exerlxrxlr.exenhhhbb.exevvddv.exelfxlrrf.exe1fxlrrf.exehhtbht.exejjjdd.exeflrfrlr.exenbhhbb.exe1pjdv.exerxrlfxx.exelfllfxx.exe7ddvp.exe3pvjd.exe3nthnh.exedvdvp.exe5rllxfx.exehbbbtb.exedvvpj.exe5flxflf.exepdppp.exerxxxrlx.exe1hnhbh.exevpdvj.exerflfffx.exeflfrlfx.exe3ddvp.exevdvpj.exettnnnh.exebntnbb.exepdpjj.exe5rrrlll.exetbbnhb.exe7ddvv.exexrrlfxr.exexxrrlll.exetbnbth.exevjpvv.exe9lrlxxr.exetnnnhh.exe5ddvp.exerrllrrx.exetbtnhb.exehhhbhh.exejvdvp.exe9rrxrff.exenbhbtt.exetbhbtt.exedddvp.exellllrrf.exenbnhhh.exe9jjjd.exenhnhth.exeppvvp.exefrxxrrr.exexrfxxlf.exebtbttn.exe3vppj.exevjdpp.exe9xfxllr.exepid process 1524 lfrllrr.exe 4496 nhthtt.exe 5112 jdjvp.exe 464 frlrlff.exe 2632 rlxrxlr.exe 1144 nhhhbb.exe 1228 vvddv.exe 2652 lfxlrrf.exe 2264 1fxlrrf.exe 3892 hhtbht.exe 1272 jjjdd.exe 4080 flrfrlr.exe 4272 nbhhbb.exe 2292 1pjdv.exe 2992 rxrlfxx.exe 2428 lfllfxx.exe 4740 7ddvp.exe 2080 3pvjd.exe 3168 3nthnh.exe 2668 dvdvp.exe 3600 5rllxfx.exe 1572 hbbbtb.exe 4172 dvvpj.exe 384 5flxflf.exe 1480 pdppp.exe 460 rxxxrlx.exe 1464 1hnhbh.exe 2916 vpdvj.exe 4196 rflfffx.exe 4888 flfrlfx.exe 4692 3ddvp.exe 4164 vdvpj.exe 2348 ttnnnh.exe 1152 bntnbb.exe 1996 pdpjj.exe 2972 5rrrlll.exe 2628 tbbnhb.exe 3136 7ddvv.exe 4776 xrrlfxr.exe 3924 xxrrlll.exe 1176 tbnbth.exe 3268 vjpvv.exe 3124 9lrlxxr.exe 4336 tnnnhh.exe 4972 5ddvp.exe 4976 rrllrrx.exe 4216 tbtnhb.exe 3572 hhhbhh.exe 2824 jvdvp.exe 4488 9rrxrff.exe 4820 nbhbtt.exe 2744 tbhbtt.exe 2888 dddvp.exe 1328 llllrrf.exe 464 nbnhhh.exe 1188 9jjjd.exe 2108 nhnhth.exe 3056 ppvvp.exe 2620 frxxrrr.exe 1740 xrfxxlf.exe 2184 btbttn.exe 1612 3vppj.exe 3992 vjdpp.exe 2756 9xfxllr.exe -
Processes:
resource yara_rule behavioral2/memory/4820-0-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1524-8-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4820-6-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/5112-18-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4496-14-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/464-26-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/5112-24-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/464-32-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1144-40-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2264-63-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3600-125-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/384-145-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4888-176-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4888-182-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2348-191-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1152-195-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2628-206-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2628-209-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3136-213-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4776-217-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4976-238-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4216-242-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4216-246-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4820-258-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2744-262-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2888-270-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1328-274-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1188-282-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3056-287-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1740-295-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4832-328-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/864-340-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3480-351-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2200-362-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/896-387-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3360-471-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2184-485-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/8-531-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/688-569-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3860-576-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2016-642-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1008-668-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3024-675-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1436-699-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3440-715-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2476-731-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2268-689-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2204-679-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4936-655-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3144-608-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2924-595-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3584-565-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2736-478-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2436-454-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3152-447-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/548-446-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1512-409-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/896-383-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3848-376-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3560-358-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2668-344-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1608-336-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/5116-332-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2732-321-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2fa6fa1228e96b55b3ad77a8c627b850_NeikiAnalytics.exelfrllrr.exenhthtt.exejdjvp.exefrlrlff.exerlxrxlr.exenhhhbb.exevvddv.exelfxlrrf.exe1fxlrrf.exehhtbht.exejjjdd.exeflrfrlr.exenbhhbb.exe1pjdv.exerxrlfxx.exelfllfxx.exe7ddvp.exe3pvjd.exe3nthnh.exedvdvp.exe5rllxfx.exedescription pid process target process PID 4820 wrote to memory of 1524 4820 2fa6fa1228e96b55b3ad77a8c627b850_NeikiAnalytics.exe lfrllrr.exe PID 4820 wrote to memory of 1524 4820 2fa6fa1228e96b55b3ad77a8c627b850_NeikiAnalytics.exe lfrllrr.exe PID 4820 wrote to memory of 1524 4820 2fa6fa1228e96b55b3ad77a8c627b850_NeikiAnalytics.exe lfrllrr.exe PID 1524 wrote to memory of 4496 1524 lfrllrr.exe nhthtt.exe PID 1524 wrote to memory of 4496 1524 lfrllrr.exe nhthtt.exe PID 1524 wrote to memory of 4496 1524 lfrllrr.exe nhthtt.exe PID 4496 wrote to memory of 5112 4496 nhthtt.exe jdjvp.exe PID 4496 wrote to memory of 5112 4496 nhthtt.exe jdjvp.exe PID 4496 wrote to memory of 5112 4496 nhthtt.exe jdjvp.exe PID 5112 wrote to memory of 464 5112 jdjvp.exe nbnhhh.exe PID 5112 wrote to memory of 464 5112 jdjvp.exe nbnhhh.exe PID 5112 wrote to memory of 464 5112 jdjvp.exe nbnhhh.exe PID 464 wrote to memory of 2632 464 frlrlff.exe tnttnn.exe PID 464 wrote to memory of 2632 464 frlrlff.exe tnttnn.exe PID 464 wrote to memory of 2632 464 frlrlff.exe tnttnn.exe PID 2632 wrote to memory of 1144 2632 rlxrxlr.exe nhhhbb.exe PID 2632 wrote to memory of 1144 2632 rlxrxlr.exe nhhhbb.exe PID 2632 wrote to memory of 1144 2632 rlxrxlr.exe nhhhbb.exe PID 1144 wrote to memory of 1228 1144 nhhhbb.exe vvddv.exe PID 1144 wrote to memory of 1228 1144 nhhhbb.exe vvddv.exe PID 1144 wrote to memory of 1228 1144 nhhhbb.exe vvddv.exe PID 1228 wrote to memory of 2652 1228 vvddv.exe lfxlrrf.exe PID 1228 wrote to memory of 2652 1228 vvddv.exe lfxlrrf.exe PID 1228 wrote to memory of 2652 1228 vvddv.exe lfxlrrf.exe PID 2652 wrote to memory of 2264 2652 lfxlrrf.exe 1fxlrrf.exe PID 2652 wrote to memory of 2264 2652 lfxlrrf.exe 1fxlrrf.exe PID 2652 wrote to memory of 2264 2652 lfxlrrf.exe 1fxlrrf.exe PID 2264 wrote to memory of 3892 2264 1fxlrrf.exe hhtbht.exe PID 2264 wrote to memory of 3892 2264 1fxlrrf.exe hhtbht.exe PID 2264 wrote to memory of 3892 2264 1fxlrrf.exe hhtbht.exe PID 3892 wrote to memory of 1272 3892 hhtbht.exe jjjdd.exe PID 3892 wrote to memory of 1272 3892 hhtbht.exe jjjdd.exe PID 3892 wrote to memory of 1272 3892 hhtbht.exe jjjdd.exe PID 1272 wrote to memory of 4080 1272 jjjdd.exe flrfrlr.exe PID 1272 wrote to memory of 4080 1272 jjjdd.exe flrfrlr.exe PID 1272 wrote to memory of 4080 1272 jjjdd.exe flrfrlr.exe PID 4080 wrote to memory of 4272 4080 flrfrlr.exe nbhhbb.exe PID 4080 wrote to memory of 4272 4080 flrfrlr.exe nbhhbb.exe PID 4080 wrote to memory of 4272 4080 flrfrlr.exe nbhhbb.exe PID 4272 wrote to memory of 2292 4272 nbhhbb.exe 1pjdv.exe PID 4272 wrote to memory of 2292 4272 nbhhbb.exe 1pjdv.exe PID 4272 wrote to memory of 2292 4272 nbhhbb.exe 1pjdv.exe PID 2292 wrote to memory of 2992 2292 1pjdv.exe rxrlfxx.exe PID 2292 wrote to memory of 2992 2292 1pjdv.exe rxrlfxx.exe PID 2292 wrote to memory of 2992 2292 1pjdv.exe rxrlfxx.exe PID 2992 wrote to memory of 2428 2992 rxrlfxx.exe lfllfxx.exe PID 2992 wrote to memory of 2428 2992 rxrlfxx.exe lfllfxx.exe PID 2992 wrote to memory of 2428 2992 rxrlfxx.exe lfllfxx.exe PID 2428 wrote to memory of 4740 2428 lfllfxx.exe 7ddvp.exe PID 2428 wrote to memory of 4740 2428 lfllfxx.exe 7ddvp.exe PID 2428 wrote to memory of 4740 2428 lfllfxx.exe 7ddvp.exe PID 4740 wrote to memory of 2080 4740 7ddvp.exe 3pvjd.exe PID 4740 wrote to memory of 2080 4740 7ddvp.exe 3pvjd.exe PID 4740 wrote to memory of 2080 4740 7ddvp.exe 3pvjd.exe PID 2080 wrote to memory of 3168 2080 3pvjd.exe 3nthnh.exe PID 2080 wrote to memory of 3168 2080 3pvjd.exe 3nthnh.exe PID 2080 wrote to memory of 3168 2080 3pvjd.exe 3nthnh.exe PID 3168 wrote to memory of 2668 3168 3nthnh.exe dvdvp.exe PID 3168 wrote to memory of 2668 3168 3nthnh.exe dvdvp.exe PID 3168 wrote to memory of 2668 3168 3nthnh.exe dvdvp.exe PID 2668 wrote to memory of 3600 2668 dvdvp.exe 5rllxfx.exe PID 2668 wrote to memory of 3600 2668 dvdvp.exe 5rllxfx.exe PID 2668 wrote to memory of 3600 2668 dvdvp.exe 5rllxfx.exe PID 3600 wrote to memory of 1572 3600 5rllxfx.exe hbbbtb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2fa6fa1228e96b55b3ad77a8c627b850_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2fa6fa1228e96b55b3ad77a8c627b850_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\lfrllrr.exec:\lfrllrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\nhthtt.exec:\nhthtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\jdjvp.exec:\jdjvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\frlrlff.exec:\frlrlff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\rlxrxlr.exec:\rlxrxlr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\nhhhbb.exec:\nhhhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\vvddv.exec:\vvddv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\lfxlrrf.exec:\lfxlrrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\1fxlrrf.exec:\1fxlrrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\hhtbht.exec:\hhtbht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\jjjdd.exec:\jjjdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\flrfrlr.exec:\flrfrlr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\nbhhbb.exec:\nbhhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\1pjdv.exec:\1pjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\rxrlfxx.exec:\rxrlfxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\lfllfxx.exec:\lfllfxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\7ddvp.exec:\7ddvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
\??\c:\3pvjd.exec:\3pvjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\3nthnh.exec:\3nthnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\dvdvp.exec:\dvdvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\5rllxfx.exec:\5rllxfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\hbbbtb.exec:\hbbbtb.exe23⤵
- Executes dropped EXE
PID:1572 -
\??\c:\dvvpj.exec:\dvvpj.exe24⤵
- Executes dropped EXE
PID:4172 -
\??\c:\5flxflf.exec:\5flxflf.exe25⤵
- Executes dropped EXE
PID:384 -
\??\c:\pdppp.exec:\pdppp.exe26⤵
- Executes dropped EXE
PID:1480 -
\??\c:\rxxxrlx.exec:\rxxxrlx.exe27⤵
- Executes dropped EXE
PID:460 -
\??\c:\1hnhbh.exec:\1hnhbh.exe28⤵
- Executes dropped EXE
PID:1464 -
\??\c:\vpdvj.exec:\vpdvj.exe29⤵
- Executes dropped EXE
PID:2916 -
\??\c:\rflfffx.exec:\rflfffx.exe30⤵
- Executes dropped EXE
PID:4196 -
\??\c:\flfrlfx.exec:\flfrlfx.exe31⤵
- Executes dropped EXE
PID:4888 -
\??\c:\3ddvp.exec:\3ddvp.exe32⤵
- Executes dropped EXE
PID:4692 -
\??\c:\vdvpj.exec:\vdvpj.exe33⤵
- Executes dropped EXE
PID:4164 -
\??\c:\ttnnnh.exec:\ttnnnh.exe34⤵
- Executes dropped EXE
PID:2348 -
\??\c:\bntnbb.exec:\bntnbb.exe35⤵
- Executes dropped EXE
PID:1152 -
\??\c:\pdpjj.exec:\pdpjj.exe36⤵
- Executes dropped EXE
PID:1996 -
\??\c:\5rrrlll.exec:\5rrrlll.exe37⤵
- Executes dropped EXE
PID:2972 -
\??\c:\tbbnhb.exec:\tbbnhb.exe38⤵
- Executes dropped EXE
PID:2628 -
\??\c:\7ddvv.exec:\7ddvv.exe39⤵
- Executes dropped EXE
PID:3136 -
\??\c:\xrrlfxr.exec:\xrrlfxr.exe40⤵
- Executes dropped EXE
PID:4776 -
\??\c:\xxrrlll.exec:\xxrrlll.exe41⤵
- Executes dropped EXE
PID:3924 -
\??\c:\tbnbth.exec:\tbnbth.exe42⤵
- Executes dropped EXE
PID:1176 -
\??\c:\vjpvv.exec:\vjpvv.exe43⤵
- Executes dropped EXE
PID:3268 -
\??\c:\9lrlxxr.exec:\9lrlxxr.exe44⤵
- Executes dropped EXE
PID:3124 -
\??\c:\tnnnhh.exec:\tnnnhh.exe45⤵
- Executes dropped EXE
PID:4336 -
\??\c:\5ddvp.exec:\5ddvp.exe46⤵
- Executes dropped EXE
PID:4972 -
\??\c:\rrllrrx.exec:\rrllrrx.exe47⤵
- Executes dropped EXE
PID:4976 -
\??\c:\tbtnhb.exec:\tbtnhb.exe48⤵
- Executes dropped EXE
PID:4216 -
\??\c:\hhhbhh.exec:\hhhbhh.exe49⤵
- Executes dropped EXE
PID:3572 -
\??\c:\jvdvp.exec:\jvdvp.exe50⤵
- Executes dropped EXE
PID:2824 -
\??\c:\9rrxrff.exec:\9rrxrff.exe51⤵
- Executes dropped EXE
PID:4488 -
\??\c:\nbhbtt.exec:\nbhbtt.exe52⤵
- Executes dropped EXE
PID:4820 -
\??\c:\tbhbtt.exec:\tbhbtt.exe53⤵
- Executes dropped EXE
PID:2744 -
\??\c:\dddvp.exec:\dddvp.exe54⤵
- Executes dropped EXE
PID:2888 -
\??\c:\llllrrf.exec:\llllrrf.exe55⤵
- Executes dropped EXE
PID:1328 -
\??\c:\nbnhhh.exec:\nbnhhh.exe56⤵
- Executes dropped EXE
PID:464 -
\??\c:\9jjjd.exec:\9jjjd.exe57⤵
- Executes dropped EXE
PID:1188 -
\??\c:\nhnhth.exec:\nhnhth.exe58⤵
- Executes dropped EXE
PID:2108 -
\??\c:\ppvvp.exec:\ppvvp.exe59⤵
- Executes dropped EXE
PID:3056 -
\??\c:\frxxrrr.exec:\frxxrrr.exe60⤵
- Executes dropped EXE
PID:2620 -
\??\c:\xrfxxlf.exec:\xrfxxlf.exe61⤵
- Executes dropped EXE
PID:1740 -
\??\c:\btbttn.exec:\btbttn.exe62⤵
- Executes dropped EXE
PID:2184 -
\??\c:\3vppj.exec:\3vppj.exe63⤵
- Executes dropped EXE
PID:1612 -
\??\c:\vjdpp.exec:\vjdpp.exe64⤵
- Executes dropped EXE
PID:3992 -
\??\c:\9xfxllr.exec:\9xfxllr.exe65⤵
- Executes dropped EXE
PID:2756 -
\??\c:\nbhbtb.exec:\nbhbtb.exe66⤵PID:2092
-
\??\c:\ddpjd.exec:\ddpjd.exe67⤵PID:2268
-
\??\c:\djpjd.exec:\djpjd.exe68⤵PID:2732
-
\??\c:\9rxrlll.exec:\9rxrlll.exe69⤵PID:4832
-
\??\c:\xlffffx.exec:\xlffffx.exe70⤵PID:5116
-
\??\c:\bnbhhn.exec:\bnbhhn.exe71⤵PID:1436
-
\??\c:\9vvjd.exec:\9vvjd.exe72⤵PID:1608
-
\??\c:\pjpvp.exec:\pjpvp.exe73⤵PID:864
-
\??\c:\9rxrllf.exec:\9rxrllf.exe74⤵PID:2668
-
\??\c:\tnbtbb.exec:\tnbtbb.exe75⤵PID:4652
-
\??\c:\nhbttt.exec:\nhbttt.exe76⤵PID:3480
-
\??\c:\jdppv.exec:\jdppv.exe77⤵PID:5032
-
\??\c:\1rfrlfx.exec:\1rfrlfx.exe78⤵PID:3560
-
\??\c:\frxxxxx.exec:\frxxxxx.exe79⤵PID:2200
-
\??\c:\hbhbhh.exec:\hbhbhh.exe80⤵PID:4768
-
\??\c:\1bhnhn.exec:\1bhnhn.exe81⤵PID:4712
-
\??\c:\9jjdv.exec:\9jjdv.exe82⤵PID:3848
-
\??\c:\xxxrrlf.exec:\xxxrrlf.exe83⤵PID:3716
-
\??\c:\lllffff.exec:\lllffff.exe84⤵PID:1212
-
\??\c:\bnnhbt.exec:\bnnhbt.exe85⤵PID:896
-
\??\c:\dvddv.exec:\dvddv.exe86⤵PID:688
-
\??\c:\vppjv.exec:\vppjv.exe87⤵PID:4504
-
\??\c:\3xfrrxr.exec:\3xfrrxr.exe88⤵PID:2912
-
\??\c:\httnnh.exec:\httnnh.exe89⤵PID:1632
-
\??\c:\hbbtnn.exec:\hbbtnn.exe90⤵PID:1980
-
\??\c:\3vjdv.exec:\3vjdv.exe91⤵PID:1944
-
\??\c:\lxlfxrl.exec:\lxlfxrl.exe92⤵PID:380
-
\??\c:\9xxxrll.exec:\9xxxrll.exe93⤵PID:1512
-
\??\c:\9nhbbb.exec:\9nhbbb.exe94⤵PID:4812
-
\??\c:\1vdvv.exec:\1vdvv.exe95⤵PID:2628
-
\??\c:\jdvvp.exec:\jdvvp.exe96⤵PID:3136
-
\??\c:\llfxrll.exec:\llfxrll.exe97⤵PID:3880
-
\??\c:\tnbttt.exec:\tnbttt.exe98⤵PID:1796
-
\??\c:\bhnnnn.exec:\bhnnnn.exe99⤵PID:1496
-
\??\c:\vpdvj.exec:\vpdvj.exe100⤵PID:1312
-
\??\c:\7pddv.exec:\7pddv.exe101⤵PID:3268
-
\??\c:\rxlflll.exec:\rxlflll.exe102⤵PID:5000
-
\??\c:\tnnthn.exec:\tnnthn.exe103⤵PID:4324
-
\??\c:\hbhbtt.exec:\hbhbtt.exe104⤵PID:548
-
\??\c:\ddjdj.exec:\ddjdj.exe105⤵PID:3152
-
\??\c:\fxfffff.exec:\fxfffff.exe106⤵PID:684
-
\??\c:\lfxxfll.exec:\lfxxfll.exe107⤵PID:2436
-
\??\c:\hthtnn.exec:\hthtnn.exe108⤵PID:5092
-
\??\c:\3nbttt.exec:\3nbttt.exe109⤵PID:364
-
\??\c:\pjdvv.exec:\pjdvv.exe110⤵PID:2956
-
\??\c:\xxlrlll.exec:\xxlrlll.exe111⤵PID:4472
-
\??\c:\xflxrrr.exec:\xflxrrr.exe112⤵PID:3360
-
\??\c:\3bbbtb.exec:\3bbbtb.exe113⤵PID:540
-
\??\c:\dddvv.exec:\dddvv.exe114⤵PID:2736
-
\??\c:\ddddv.exec:\ddddv.exe115⤵PID:4408
-
\??\c:\fxfxrfx.exec:\fxfxrfx.exe116⤵PID:2184
-
\??\c:\thnhtn.exec:\thnhtn.exe117⤵PID:1612
-
\??\c:\3dddp.exec:\3dddp.exe118⤵PID:3024
-
\??\c:\pjjdj.exec:\pjjdj.exe119⤵PID:3088
-
\??\c:\fxrllfx.exec:\fxrllfx.exe120⤵PID:1032
-
\??\c:\xffxrlf.exec:\xffxrlf.exe121⤵PID:1500
-
\??\c:\bnnhbt.exec:\bnnhbt.exe122⤵PID:2268
-
\??\c:\nhnhhh.exec:\nhnhhh.exe123⤵PID:2292
-
\??\c:\vpvpd.exec:\vpvpd.exe124⤵PID:2428
-
\??\c:\rrrllfx.exec:\rrrllfx.exe125⤵PID:868
-
\??\c:\xlflflx.exec:\xlflflx.exe126⤵PID:3868
-
\??\c:\nhtnhh.exec:\nhtnhh.exe127⤵PID:2616
-
\??\c:\1vvvd.exec:\1vvvd.exe128⤵PID:4300
-
\??\c:\jpvvp.exec:\jpvvp.exe129⤵PID:864
-
\??\c:\xrxrlff.exec:\xrxrlff.exe130⤵PID:3440
-
\??\c:\htbtbb.exec:\htbtbb.exe131⤵PID:8
-
\??\c:\bttnhb.exec:\bttnhb.exe132⤵PID:1572
-
\??\c:\9vdvj.exec:\9vdvj.exe133⤵PID:4248
-
\??\c:\frxrlfx.exec:\frxrlfx.exe134⤵PID:3388
-
\??\c:\lxlffxr.exec:\lxlffxr.exe135⤵PID:2476
-
\??\c:\nhnhbt.exec:\nhnhbt.exe136⤵PID:2200
-
\??\c:\jvdvp.exec:\jvdvp.exe137⤵PID:4768
-
\??\c:\ddjjd.exec:\ddjjd.exe138⤵PID:1464
-
\??\c:\rxxrlfx.exec:\rxxrlfx.exe139⤵PID:3812
-
\??\c:\lffxxxr.exec:\lffxxxr.exe140⤵PID:5072
-
\??\c:\tbhbnn.exec:\tbhbnn.exe141⤵PID:3584
-
\??\c:\jjjdd.exec:\jjjdd.exe142⤵PID:4460
-
\??\c:\pvjdv.exec:\pvjdv.exe143⤵PID:688
-
\??\c:\rllfxxr.exec:\rllfxxr.exe144⤵PID:2044
-
\??\c:\dvjvp.exec:\dvjvp.exe145⤵PID:3860
-
\??\c:\jdjdd.exec:\jdjdd.exe146⤵PID:2296
-
\??\c:\lfrlrxf.exec:\lfrlrxf.exe147⤵PID:3092
-
\??\c:\hhhhbb.exec:\hhhhbb.exe148⤵PID:2308
-
\??\c:\ntbtnb.exec:\ntbtnb.exe149⤵PID:4448
-
\??\c:\pjvpj.exec:\pjvpj.exe150⤵PID:5096
-
\??\c:\rflffxx.exec:\rflffxx.exe151⤵PID:2924
-
\??\c:\rflllxf.exec:\rflllxf.exe152⤵PID:3160
-
\??\c:\bttttt.exec:\bttttt.exe153⤵PID:1808
-
\??\c:\dvjjd.exec:\dvjjd.exe154⤵PID:3144
-
\??\c:\ppjdv.exec:\ppjdv.exe155⤵PID:3688
-
\??\c:\rrflffx.exec:\rrflffx.exe156⤵PID:3412
-
\??\c:\llrlrlr.exec:\llrlrlr.exe157⤵PID:2000
-
\??\c:\3btbtt.exec:\3btbtt.exe158⤵PID:2464
-
\??\c:\vvdvd.exec:\vvdvd.exe159⤵PID:3320
-
\??\c:\vjpdd.exec:\vjpdd.exe160⤵PID:4336
-
\??\c:\7xxrlfx.exec:\7xxrlfx.exe161⤵PID:4836
-
\??\c:\thhbbb.exec:\thhbbb.exe162⤵PID:4280
-
\??\c:\hbbbtn.exec:\hbbbtn.exe163⤵PID:4284
-
\??\c:\ddvpp.exec:\ddvpp.exe164⤵PID:4820
-
\??\c:\3ddvp.exec:\3ddvp.exe165⤵PID:2016
-
\??\c:\xxfxxrl.exec:\xxfxxrl.exe166⤵PID:1236
-
\??\c:\bhnnhh.exec:\bhnnhh.exe167⤵PID:1524
-
\??\c:\tnttnn.exec:\tnttnn.exe168⤵PID:2632
-
\??\c:\pppdv.exec:\pppdv.exe169⤵PID:5056
-
\??\c:\7xxlffx.exec:\7xxlffx.exe170⤵PID:4936
-
\??\c:\3xfxrxr.exec:\3xfxrxr.exe171⤵PID:1228
-
\??\c:\bnnhbt.exec:\bnnhbt.exe172⤵PID:3228
-
\??\c:\btnnht.exec:\btnnht.exe173⤵PID:1488
-
\??\c:\ddvpv.exec:\ddvpv.exe174⤵PID:1008
-
\??\c:\llxxflr.exec:\llxxflr.exe175⤵PID:1612
-
\??\c:\7rfxxxf.exec:\7rfxxxf.exe176⤵PID:3024
-
\??\c:\nhhhnn.exec:\nhhhnn.exe177⤵PID:2204
-
\??\c:\nnthbt.exec:\nnthbt.exe178⤵PID:4272
-
\??\c:\jddvv.exec:\jddvv.exe179⤵PID:2884
-
\??\c:\5xfrllf.exec:\5xfrllf.exe180⤵PID:2268
-
\??\c:\xllxrlf.exec:\xllxrlf.exe181⤵PID:2292
-
\??\c:\thbbnn.exec:\thbbnn.exe182⤵PID:2428
-
\??\c:\7bbttt.exec:\7bbttt.exe183⤵PID:1436
-
\??\c:\djddv.exec:\djddv.exe184⤵PID:3868
-
\??\c:\3jvpj.exec:\3jvpj.exe185⤵PID:4072
-
\??\c:\rrlfxrr.exec:\rrlfxrr.exe186⤵PID:3536
-
\??\c:\nnhhbb.exec:\nnhhbb.exe187⤵PID:596
-
\??\c:\7bbnth.exec:\7bbnth.exe188⤵PID:3440
-
\??\c:\dvjvp.exec:\dvjvp.exe189⤵PID:8
-
\??\c:\fxllfff.exec:\fxllfff.exe190⤵PID:1572
-
\??\c:\xllfxrf.exec:\xllfxrf.exe191⤵PID:4248
-
\??\c:\1ntntn.exec:\1ntntn.exe192⤵PID:2104
-
\??\c:\ppvpp.exec:\ppvpp.exe193⤵PID:2476
-
\??\c:\dpvjd.exec:\dpvjd.exe194⤵PID:704
-
\??\c:\1xxxrrr.exec:\1xxxrrr.exe195⤵PID:4712
-
\??\c:\rfrfrfl.exec:\rfrfrfl.exe196⤵PID:4884
-
\??\c:\btbnhh.exec:\btbnhh.exe197⤵PID:1284
-
\??\c:\jdddp.exec:\jdddp.exe198⤵PID:3448
-
\??\c:\xrfxlxr.exec:\xrfxlxr.exe199⤵PID:3096
-
\??\c:\bbnhtt.exec:\bbnhtt.exe200⤵PID:4460
-
\??\c:\3xrllff.exec:\3xrllff.exe201⤵PID:4504
-
\??\c:\tbbthb.exec:\tbbthb.exe202⤵PID:4708
-
\??\c:\9vvvj.exec:\9vvvj.exe203⤵PID:3860
-
\??\c:\frxxrfr.exec:\frxxrfr.exe204⤵PID:3840
-
\??\c:\hnbnnb.exec:\hnbnnb.exe205⤵PID:3108
-
\??\c:\nbtbnh.exec:\nbtbnh.exe206⤵PID:4840
-
\??\c:\bhhnbh.exec:\bhhnbh.exe207⤵PID:5096
-
\??\c:\pjjdp.exec:\pjjdp.exe208⤵PID:1664
-
\??\c:\rlrrxrl.exec:\rlrrxrl.exe209⤵PID:4236
-
\??\c:\nbhhhn.exec:\nbhhhn.exe210⤵PID:1808
-
\??\c:\jdppd.exec:\jdppd.exe211⤵PID:4932
-
\??\c:\rflfxxr.exec:\rflfxxr.exe212⤵PID:3688
-
\??\c:\pdddd.exec:\pdddd.exe213⤵PID:3412
-
\??\c:\frrrlfx.exec:\frrrlfx.exe214⤵PID:628
-
\??\c:\vppjj.exec:\vppjj.exe215⤵PID:5000
-
\??\c:\bbttbb.exec:\bbttbb.exe216⤵PID:972
-
\??\c:\rllfxxf.exec:\rllfxxf.exe217⤵PID:4336
-
\??\c:\nhtntn.exec:\nhtntn.exe218⤵PID:3028
-
\??\c:\vvjdd.exec:\vvjdd.exe219⤵PID:3492
-
\??\c:\1rlfxxr.exec:\1rlfxxr.exe220⤵PID:1176
-
\??\c:\rffxxrr.exec:\rffxxrr.exe221⤵PID:4316
-
\??\c:\djppj.exec:\djppj.exe222⤵PID:5092
-
\??\c:\7vddd.exec:\7vddd.exe223⤵PID:2956
-
\??\c:\rrlfffr.exec:\rrlfffr.exe224⤵PID:2968
-
\??\c:\ntnbbb.exec:\ntnbbb.exe225⤵PID:3940
-
\??\c:\ntbtnn.exec:\ntbtnn.exe226⤵PID:540
-
\??\c:\ppdpj.exec:\ppdpj.exe227⤵PID:2264
-
\??\c:\5ttnbb.exec:\5ttnbb.exe228⤵PID:1228
-
\??\c:\1xfxxff.exec:\1xfxxff.exe229⤵PID:3540
-
\??\c:\nnnnnn.exec:\nnnnnn.exe230⤵PID:3656
-
\??\c:\7vpjj.exec:\7vpjj.exe231⤵PID:3220
-
\??\c:\xlxrrlf.exec:\xlxrrlf.exe232⤵PID:4468
-
\??\c:\3pvjd.exec:\3pvjd.exe233⤵PID:4080
-
\??\c:\rrrlxxf.exec:\rrrlxxf.exe234⤵PID:3996
-
\??\c:\pjvjp.exec:\pjvjp.exe235⤵PID:4272
-
\??\c:\pjvpp.exec:\pjvpp.exe236⤵PID:4740
-
\??\c:\hbhbbb.exec:\hbhbbb.exe237⤵PID:976
-
\??\c:\jdppv.exec:\jdppv.exe238⤵PID:3844
-
\??\c:\jvjdd.exec:\jvjdd.exe239⤵PID:3248
-
\??\c:\vdjdv.exec:\vdjdv.exe240⤵PID:5088
-
\??\c:\xxfxrrl.exec:\xxfxrrl.exe241⤵PID:3232
-