Analysis
-
max time kernel
90s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 23:45
Behavioral task
behavioral1
Sample
288763a376e5d2ee4c22b599fb670a50_NeikiAnalytics.exe
Resource
win7-20240220-en
General
-
Target
288763a376e5d2ee4c22b599fb670a50_NeikiAnalytics.exe
-
Size
464KB
-
MD5
288763a376e5d2ee4c22b599fb670a50
-
SHA1
58d40d48aa364bde7c9d8859564bda4aedaad785
-
SHA256
88099c8a7df5af0c47312285577d5c694413e8430b0aeaa54c8f50046a095dd1
-
SHA512
8d0f492d049e8c2b9349c2ba5057800fd1e05499165c5a775c58b9f365a6c1bad35f0c35e8ab19cea605540d16abf7066f9fe16eb2c7c75b9f1213f404e7fdb8
-
SSDEEP
12288:J4wFHoSTeR0oQRkay+eFp3IDvSbh5nPVP+OKaf1VP:VeR0oykayRFp3lztP+OKaf1VP
Malware Config
Signatures
-
Detect Blackmoon payload 34 IoCs
Processes:
resource yara_rule behavioral1/memory/2464-83-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1312-167-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1496-235-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2252-308-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2584-441-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2136-466-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2116-786-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2512-942-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2372-862-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2968-830-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2660-555-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2416-388-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2068-380-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2972-361-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2112-335-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1620-315-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1804-259-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/536-222-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1456-212-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2896-201-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1576-176-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2832-158-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1420-155-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/776-138-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2408-119-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2968-102-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2532-85-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2596-75-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2720-67-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2592-57-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2568-38-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/3012-28-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2096-11-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1708-0-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule \??\c:\dvjvj.exe family_berbew \??\c:\xxrfrrx.exe family_berbew behavioral1/memory/2680-48-0x0000000001C90000-0x0000000001CCA000-memory.dmp family_berbew behavioral1/memory/2464-83-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2968-93-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\7rlrlfr.exe family_berbew \??\c:\hhbthn.exe family_berbew \??\c:\bhhbtb.exe family_berbew \??\c:\bththh.exe family_berbew \??\c:\ppjpv.exe family_berbew behavioral1/memory/1312-167-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2896-192-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1456-203-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\1thhnt.exe family_berbew C:\1jvjd.exe family_berbew behavioral1/memory/1496-235-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\hhhnbb.exe family_berbew behavioral1/memory/1804-252-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2252-301-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2252-308-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2416-381-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2548-389-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1612-402-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2584-441-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2136-466-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2660-548-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1252-710-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1960-735-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/3012-773-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2116-786-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/596-917-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/756-949-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1708-999-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2656-1024-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/864-962-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2512-942-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2372-862-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1640-831-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2968-830-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1728-793-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1228-766-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2320-697-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1456-690-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2636-623-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2448-616-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2660-555-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2308-428-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2936-409-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2416-388-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2068-380-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2972-361-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1968-354-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2112-335-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2884-328-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1620-315-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\nhhhnh.exe family_berbew C:\xlxrrfl.exe family_berbew \??\c:\vjjdd.exe family_berbew C:\hbbhht.exe family_berbew behavioral1/memory/1804-259-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\ppvvj.exe family_berbew C:\xrlxlrl.exe family_berbew behavioral1/memory/536-222-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\vpdpj.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
tbhbbh.exedvjvj.exexxrfrrx.exehbntht.exenhbnhh.exevpjpp.exerlllxxl.exe3rxxffl.exedddjd.exe1jvvd.exe7rlrlfr.exehhbthn.exepjvvd.exexlxlrrf.exebhhbtb.exebththh.exeppjpv.exefrxlxfr.exetbnhbt.exevpdpv.exellxlxxl.exe1thhnt.exevpdpj.exe1jvjd.exexrlxlrl.exehhhnbb.exeppvvj.exexrlxrrl.exehbbhht.exevjjdd.exexlxrrfl.exenhhhnh.exeddppj.exe7rflxfl.exepppdv.exevvpvv.exexrrxlrl.exe3tnhbh.exevvppj.exexxflflf.exexfrrxxx.exebtthnb.exevjddd.exe7fllxlf.exelffrfrl.exevdvvd.exelxxllxx.exebhhtth.exepppvd.exedjvjj.exe3xrflfl.exeffxllfx.exehhbhtb.exedpjjj.exerxlxlrl.exexfxfxrf.exetnbbnn.exe9dvdp.exelfrrlxr.exefxrrfff.exethhhtb.exe5nhnbt.exedvpvj.exelxxxxxx.exepid process 2096 tbhbbh.exe 3012 dvjvj.exe 2568 xxrfrrx.exe 2680 hbntht.exe 2592 nhbnhh.exe 2720 vpjpp.exe 2596 rlllxxl.exe 2464 3rxxffl.exe 2532 dddjd.exe 2968 1jvvd.exe 2976 7rlrlfr.exe 2408 hhbthn.exe 1796 pjvvd.exe 1980 xlxlrrf.exe 776 bhhbtb.exe 1420 bththh.exe 2832 ppjpv.exe 1312 frxlxfr.exe 1576 tbnhbt.exe 1736 vpdpv.exe 2896 llxlxxl.exe 1456 1thhnt.exe 536 vpdpj.exe 1060 1jvjd.exe 1496 xrlxlrl.exe 1636 hhhnbb.exe 1804 ppvvj.exe 968 xrlxrrl.exe 816 hbbhht.exe 568 vjjdd.exe 2420 xlxrrfl.exe 1656 nhhhnh.exe 2252 ddppj.exe 1620 7rflxfl.exe 2100 pppdv.exe 2588 vvpvv.exe 2884 xrrxlrl.exe 2112 3tnhbh.exe 2300 vvppj.exe 2724 xxflflf.exe 1968 xfrrxxx.exe 2972 btthnb.exe 2992 vjddd.exe 2068 7fllxlf.exe 2416 lffrfrl.exe 2548 vdvvd.exe 1980 lxxllxx.exe 1612 bhhtth.exe 2936 pppvd.exe 2032 djvjj.exe 1520 3xrflfl.exe 2308 ffxllfx.exe 2584 hhbhtb.exe 1940 dpjjj.exe 2220 rxlxlrl.exe 1456 xfxfxrf.exe 2136 tnbbnn.exe 1868 9dvdp.exe 1496 lfrrlxr.exe 1972 fxrrfff.exe 2888 thhhtb.exe 1304 5nhnbt.exe 1960 dvpvj.exe 560 lxxxxxx.exe -
Processes:
resource yara_rule \??\c:\dvjvj.exe upx \??\c:\xxrfrrx.exe upx behavioral1/memory/2680-48-0x0000000001C90000-0x0000000001CCA000-memory.dmp upx behavioral1/memory/2464-83-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2968-93-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\7rlrlfr.exe upx \??\c:\hhbthn.exe upx \??\c:\bhhbtb.exe upx \??\c:\bththh.exe upx \??\c:\ppjpv.exe upx behavioral1/memory/1312-167-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2896-192-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1456-203-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\1thhnt.exe upx C:\1jvjd.exe upx behavioral1/memory/1496-235-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\hhhnbb.exe upx behavioral1/memory/1804-252-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2252-301-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2252-308-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2416-381-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2548-389-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1612-402-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2584-441-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2136-466-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2660-548-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1252-710-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1960-735-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/3012-773-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2116-786-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/596-917-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/756-949-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1708-999-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2656-1024-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/864-962-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2512-942-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2372-862-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1640-831-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2968-830-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1728-793-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1228-766-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2320-697-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1456-690-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2636-623-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2448-616-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2660-555-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2308-428-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2936-409-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2416-388-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2068-380-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2972-361-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1968-354-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2112-335-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2884-328-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1620-315-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\nhhhnh.exe upx C:\xlxrrfl.exe upx \??\c:\vjjdd.exe upx C:\hbbhht.exe upx behavioral1/memory/1804-259-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\ppvvj.exe upx behavioral1/memory/1060-230-0x0000000000220000-0x000000000025A000-memory.dmp upx C:\xrlxlrl.exe upx behavioral1/memory/536-222-0x0000000000400000-0x000000000043A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
288763a376e5d2ee4c22b599fb670a50_NeikiAnalytics.exetbhbbh.exedvjvj.exexxrfrrx.exehbntht.exenhbnhh.exevpjpp.exerlllxxl.exe3rxxffl.exedddjd.exe1jvvd.exe7rlrlfr.exehhbthn.exepjvvd.exexlxlrrf.exebhhbtb.exedescription pid process target process PID 1708 wrote to memory of 2096 1708 288763a376e5d2ee4c22b599fb670a50_NeikiAnalytics.exe tbhbbh.exe PID 1708 wrote to memory of 2096 1708 288763a376e5d2ee4c22b599fb670a50_NeikiAnalytics.exe tbhbbh.exe PID 1708 wrote to memory of 2096 1708 288763a376e5d2ee4c22b599fb670a50_NeikiAnalytics.exe tbhbbh.exe PID 1708 wrote to memory of 2096 1708 288763a376e5d2ee4c22b599fb670a50_NeikiAnalytics.exe tbhbbh.exe PID 2096 wrote to memory of 3012 2096 tbhbbh.exe dvjvj.exe PID 2096 wrote to memory of 3012 2096 tbhbbh.exe dvjvj.exe PID 2096 wrote to memory of 3012 2096 tbhbbh.exe dvjvj.exe PID 2096 wrote to memory of 3012 2096 tbhbbh.exe dvjvj.exe PID 3012 wrote to memory of 2568 3012 dvjvj.exe xxrfrrx.exe PID 3012 wrote to memory of 2568 3012 dvjvj.exe xxrfrrx.exe PID 3012 wrote to memory of 2568 3012 dvjvj.exe xxrfrrx.exe PID 3012 wrote to memory of 2568 3012 dvjvj.exe xxrfrrx.exe PID 2568 wrote to memory of 2680 2568 xxrfrrx.exe hbntht.exe PID 2568 wrote to memory of 2680 2568 xxrfrrx.exe hbntht.exe PID 2568 wrote to memory of 2680 2568 xxrfrrx.exe hbntht.exe PID 2568 wrote to memory of 2680 2568 xxrfrrx.exe hbntht.exe PID 2680 wrote to memory of 2592 2680 hbntht.exe nhbnhh.exe PID 2680 wrote to memory of 2592 2680 hbntht.exe nhbnhh.exe PID 2680 wrote to memory of 2592 2680 hbntht.exe nhbnhh.exe PID 2680 wrote to memory of 2592 2680 hbntht.exe nhbnhh.exe PID 2592 wrote to memory of 2720 2592 nhbnhh.exe vpjpp.exe PID 2592 wrote to memory of 2720 2592 nhbnhh.exe vpjpp.exe PID 2592 wrote to memory of 2720 2592 nhbnhh.exe vpjpp.exe PID 2592 wrote to memory of 2720 2592 nhbnhh.exe vpjpp.exe PID 2720 wrote to memory of 2596 2720 vpjpp.exe rlllxxl.exe PID 2720 wrote to memory of 2596 2720 vpjpp.exe rlllxxl.exe PID 2720 wrote to memory of 2596 2720 vpjpp.exe rlllxxl.exe PID 2720 wrote to memory of 2596 2720 vpjpp.exe rlllxxl.exe PID 2596 wrote to memory of 2464 2596 rlllxxl.exe nbhhbn.exe PID 2596 wrote to memory of 2464 2596 rlllxxl.exe nbhhbn.exe PID 2596 wrote to memory of 2464 2596 rlllxxl.exe nbhhbn.exe PID 2596 wrote to memory of 2464 2596 rlllxxl.exe nbhhbn.exe PID 2464 wrote to memory of 2532 2464 3rxxffl.exe dddjd.exe PID 2464 wrote to memory of 2532 2464 3rxxffl.exe dddjd.exe PID 2464 wrote to memory of 2532 2464 3rxxffl.exe dddjd.exe PID 2464 wrote to memory of 2532 2464 3rxxffl.exe dddjd.exe PID 2532 wrote to memory of 2968 2532 dddjd.exe 1jvvd.exe PID 2532 wrote to memory of 2968 2532 dddjd.exe 1jvvd.exe PID 2532 wrote to memory of 2968 2532 dddjd.exe 1jvvd.exe PID 2532 wrote to memory of 2968 2532 dddjd.exe 1jvvd.exe PID 2968 wrote to memory of 2976 2968 1jvvd.exe 7rlrlfr.exe PID 2968 wrote to memory of 2976 2968 1jvvd.exe 7rlrlfr.exe PID 2968 wrote to memory of 2976 2968 1jvvd.exe 7rlrlfr.exe PID 2968 wrote to memory of 2976 2968 1jvvd.exe 7rlrlfr.exe PID 2976 wrote to memory of 2408 2976 7rlrlfr.exe hhbthn.exe PID 2976 wrote to memory of 2408 2976 7rlrlfr.exe hhbthn.exe PID 2976 wrote to memory of 2408 2976 7rlrlfr.exe hhbthn.exe PID 2976 wrote to memory of 2408 2976 7rlrlfr.exe hhbthn.exe PID 2408 wrote to memory of 1796 2408 hhbthn.exe pjvvd.exe PID 2408 wrote to memory of 1796 2408 hhbthn.exe pjvvd.exe PID 2408 wrote to memory of 1796 2408 hhbthn.exe pjvvd.exe PID 2408 wrote to memory of 1796 2408 hhbthn.exe pjvvd.exe PID 1796 wrote to memory of 1980 1796 pjvvd.exe xlxlrrf.exe PID 1796 wrote to memory of 1980 1796 pjvvd.exe xlxlrrf.exe PID 1796 wrote to memory of 1980 1796 pjvvd.exe xlxlrrf.exe PID 1796 wrote to memory of 1980 1796 pjvvd.exe xlxlrrf.exe PID 1980 wrote to memory of 776 1980 xlxlrrf.exe bhhbtb.exe PID 1980 wrote to memory of 776 1980 xlxlrrf.exe bhhbtb.exe PID 1980 wrote to memory of 776 1980 xlxlrrf.exe bhhbtb.exe PID 1980 wrote to memory of 776 1980 xlxlrrf.exe bhhbtb.exe PID 776 wrote to memory of 1420 776 bhhbtb.exe bththh.exe PID 776 wrote to memory of 1420 776 bhhbtb.exe bththh.exe PID 776 wrote to memory of 1420 776 bhhbtb.exe bththh.exe PID 776 wrote to memory of 1420 776 bhhbtb.exe bththh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\288763a376e5d2ee4c22b599fb670a50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\288763a376e5d2ee4c22b599fb670a50_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\tbhbbh.exec:\tbhbbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\dvjvj.exec:\dvjvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\xxrfrrx.exec:\xxrfrrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\hbntht.exec:\hbntht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\nhbnhh.exec:\nhbnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\vpjpp.exec:\vpjpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\rlllxxl.exec:\rlllxxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\3rxxffl.exec:\3rxxffl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\dddjd.exec:\dddjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\1jvvd.exec:\1jvvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\7rlrlfr.exec:\7rlrlfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\hhbthn.exec:\hhbthn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\pjvvd.exec:\pjvvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\xlxlrrf.exec:\xlxlrrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\bhhbtb.exec:\bhhbtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\bththh.exec:\bththh.exe17⤵
- Executes dropped EXE
PID:1420 -
\??\c:\ppjpv.exec:\ppjpv.exe18⤵
- Executes dropped EXE
PID:2832 -
\??\c:\frxlxfr.exec:\frxlxfr.exe19⤵
- Executes dropped EXE
PID:1312 -
\??\c:\tbnhbt.exec:\tbnhbt.exe20⤵
- Executes dropped EXE
PID:1576 -
\??\c:\vpdpv.exec:\vpdpv.exe21⤵
- Executes dropped EXE
PID:1736 -
\??\c:\llxlxxl.exec:\llxlxxl.exe22⤵
- Executes dropped EXE
PID:2896 -
\??\c:\1thhnt.exec:\1thhnt.exe23⤵
- Executes dropped EXE
PID:1456 -
\??\c:\vpdpj.exec:\vpdpj.exe24⤵
- Executes dropped EXE
PID:536 -
\??\c:\1jvjd.exec:\1jvjd.exe25⤵
- Executes dropped EXE
PID:1060 -
\??\c:\xrlxlrl.exec:\xrlxlrl.exe26⤵
- Executes dropped EXE
PID:1496 -
\??\c:\hhhnbb.exec:\hhhnbb.exe27⤵
- Executes dropped EXE
PID:1636 -
\??\c:\ppvvj.exec:\ppvvj.exe28⤵
- Executes dropped EXE
PID:1804 -
\??\c:\xrlxrrl.exec:\xrlxrrl.exe29⤵
- Executes dropped EXE
PID:968 -
\??\c:\hbbhht.exec:\hbbhht.exe30⤵
- Executes dropped EXE
PID:816 -
\??\c:\vjjdd.exec:\vjjdd.exe31⤵
- Executes dropped EXE
PID:568 -
\??\c:\xlxrrfl.exec:\xlxrrfl.exe32⤵
- Executes dropped EXE
PID:2420 -
\??\c:\nhhhnh.exec:\nhhhnh.exe33⤵
- Executes dropped EXE
PID:1656 -
\??\c:\ddppj.exec:\ddppj.exe34⤵
- Executes dropped EXE
PID:2252 -
\??\c:\7rflxfl.exec:\7rflxfl.exe35⤵
- Executes dropped EXE
PID:1620 -
\??\c:\pppdv.exec:\pppdv.exe36⤵
- Executes dropped EXE
PID:2100 -
\??\c:\vvpvv.exec:\vvpvv.exe37⤵
- Executes dropped EXE
PID:2588 -
\??\c:\xrrxlrl.exec:\xrrxlrl.exe38⤵
- Executes dropped EXE
PID:2884 -
\??\c:\3tnhbh.exec:\3tnhbh.exe39⤵
- Executes dropped EXE
PID:2112 -
\??\c:\vvppj.exec:\vvppj.exe40⤵
- Executes dropped EXE
PID:2300 -
\??\c:\xxflflf.exec:\xxflflf.exe41⤵
- Executes dropped EXE
PID:2724 -
\??\c:\xfrrxxx.exec:\xfrrxxx.exe42⤵
- Executes dropped EXE
PID:1968 -
\??\c:\btthnb.exec:\btthnb.exe43⤵
- Executes dropped EXE
PID:2972 -
\??\c:\vjddd.exec:\vjddd.exe44⤵
- Executes dropped EXE
PID:2992 -
\??\c:\7fllxlf.exec:\7fllxlf.exe45⤵
- Executes dropped EXE
PID:2068 -
\??\c:\lffrfrl.exec:\lffrfrl.exe46⤵
- Executes dropped EXE
PID:2416 -
\??\c:\vdvvd.exec:\vdvvd.exe47⤵
- Executes dropped EXE
PID:2548 -
\??\c:\lxxllxx.exec:\lxxllxx.exe48⤵
- Executes dropped EXE
PID:1980 -
\??\c:\bhhtth.exec:\bhhtth.exe49⤵
- Executes dropped EXE
PID:1612 -
\??\c:\pppvd.exec:\pppvd.exe50⤵
- Executes dropped EXE
PID:2936 -
\??\c:\djvjj.exec:\djvjj.exe51⤵
- Executes dropped EXE
PID:2032 -
\??\c:\3xrflfl.exec:\3xrflfl.exe52⤵
- Executes dropped EXE
PID:1520 -
\??\c:\ffxllfx.exec:\ffxllfx.exe53⤵
- Executes dropped EXE
PID:2308 -
\??\c:\hhbhtb.exec:\hhbhtb.exe54⤵
- Executes dropped EXE
PID:2584 -
\??\c:\dpjjj.exec:\dpjjj.exe55⤵
- Executes dropped EXE
PID:1940 -
\??\c:\rxlxlrl.exec:\rxlxlrl.exe56⤵
- Executes dropped EXE
PID:2220 -
\??\c:\xfxfxrf.exec:\xfxfxrf.exe57⤵
- Executes dropped EXE
PID:1456 -
\??\c:\tnbbnn.exec:\tnbbnn.exe58⤵
- Executes dropped EXE
PID:2136 -
\??\c:\9dvdp.exec:\9dvdp.exe59⤵
- Executes dropped EXE
PID:1868 -
\??\c:\lfrrlxr.exec:\lfrrlxr.exe60⤵
- Executes dropped EXE
PID:1496 -
\??\c:\fxrrfff.exec:\fxrrfff.exe61⤵
- Executes dropped EXE
PID:1972 -
\??\c:\thhhtb.exec:\thhhtb.exe62⤵
- Executes dropped EXE
PID:2888 -
\??\c:\5nhnbt.exec:\5nhnbt.exe63⤵
- Executes dropped EXE
PID:1304 -
\??\c:\dvpvj.exec:\dvpvj.exe64⤵
- Executes dropped EXE
PID:1960 -
\??\c:\lxxxxxx.exec:\lxxxxxx.exe65⤵
- Executes dropped EXE
PID:560 -
\??\c:\3flxlrx.exec:\3flxlrx.exe66⤵PID:568
-
\??\c:\3tntbh.exec:\3tntbh.exe67⤵PID:628
-
\??\c:\dvvvp.exec:\dvvvp.exe68⤵PID:2356
-
\??\c:\vpvjp.exec:\vpvjp.exe69⤵PID:1624
-
\??\c:\xxxfrrl.exec:\xxxfrrl.exe70⤵PID:2252
-
\??\c:\bbtbnn.exec:\bbtbnn.exe71⤵PID:1620
-
\??\c:\ppvvv.exec:\ppvvv.exe72⤵PID:2656
-
\??\c:\9djvj.exec:\9djvj.exe73⤵PID:2660
-
\??\c:\lflffll.exec:\lflffll.exe74⤵PID:2728
-
\??\c:\nhhbbh.exec:\nhhbbh.exe75⤵PID:2876
-
\??\c:\bhthth.exec:\bhthth.exe76⤵PID:2948
-
\??\c:\vdvjd.exec:\vdvjd.exe77⤵PID:1892
-
\??\c:\rlfrxfr.exec:\rlfrxfr.exe78⤵PID:2956
-
\??\c:\lxxlllr.exec:\lxxlllr.exe79⤵PID:1640
-
\??\c:\bhtntb.exec:\bhtntb.exe80⤵PID:3016
-
\??\c:\pjjjd.exec:\pjjjd.exe81⤵PID:2060
-
\??\c:\pdjjd.exec:\pdjjd.exe82⤵PID:2068
-
\??\c:\lxfflrx.exec:\lxfflrx.exe83⤵PID:1744
-
\??\c:\1hthnh.exec:\1hthnh.exe84⤵PID:2448
-
\??\c:\3bnttt.exec:\3bnttt.exe85⤵PID:2636
-
\??\c:\1jdjv.exec:\1jdjv.exe86⤵PID:2520
-
\??\c:\ddvpd.exec:\ddvpd.exe87⤵PID:2788
-
\??\c:\rlrfxfl.exec:\rlrfxfl.exe88⤵PID:1568
-
\??\c:\tnhnth.exec:\tnhnth.exe89⤵PID:1460
-
\??\c:\nhhthb.exec:\nhhthb.exe90⤵PID:824
-
\??\c:\ddddd.exec:\ddddd.exe91⤵PID:1576
-
\??\c:\7jpdd.exec:\7jpdd.exe92⤵PID:2052
-
\??\c:\xrrllrr.exec:\xrrllrr.exe93⤵PID:2904
-
\??\c:\thhhtt.exec:\thhhtt.exe94⤵PID:268
-
\??\c:\jjjpp.exec:\jjjpp.exe95⤵PID:1076
-
\??\c:\ppjpd.exec:\ppjpd.exe96⤵PID:1456
-
\??\c:\rxxrfrr.exec:\rxxrfrr.exe97⤵PID:2320
-
\??\c:\5bthth.exec:\5bthth.exe98⤵PID:620
-
\??\c:\btbbbh.exec:\btbbbh.exe99⤵PID:1252
-
\??\c:\vppvj.exec:\vppvj.exe100⤵PID:748
-
\??\c:\lrlxflx.exec:\lrlxflx.exe101⤵PID:312
-
\??\c:\lllxlxr.exec:\lllxlxr.exe102⤵PID:828
-
\??\c:\bbnthh.exec:\bbnthh.exe103⤵PID:1960
-
\??\c:\hbbhbh.exec:\hbbhbh.exe104⤵PID:452
-
\??\c:\pjdpj.exec:\pjdpj.exe105⤵PID:568
-
\??\c:\rlflffl.exec:\rlflffl.exe106⤵PID:1656
-
\??\c:\rlfrffx.exec:\rlfrffx.exe107⤵PID:1516
-
\??\c:\bhtbnn.exec:\bhtbnn.exe108⤵PID:1228
-
\??\c:\ppjdd.exec:\ppjdd.exe109⤵PID:3012
-
\??\c:\dvvpd.exec:\dvvpd.exe110⤵PID:2116
-
\??\c:\xxfrffx.exec:\xxfrffx.exe111⤵PID:2880
-
\??\c:\nhhbht.exec:\nhhbht.exe112⤵PID:1728
-
\??\c:\jpvvj.exec:\jpvvj.exe113⤵PID:2516
-
\??\c:\pdvjp.exec:\pdvjp.exe114⤵PID:2480
-
\??\c:\rlrfffx.exec:\rlrfffx.exe115⤵PID:2724
-
\??\c:\9nhnnb.exec:\9nhnnb.exe116⤵PID:2596
-
\??\c:\hbthtb.exec:\hbthtb.exe117⤵PID:2968
-
\??\c:\vvvdv.exec:\vvvdv.exe118⤵PID:1640
-
\??\c:\fffrfrx.exec:\fffrfrx.exe119⤵PID:2408
-
\??\c:\fxflxff.exec:\fxflxff.exe120⤵PID:2128
-
\??\c:\7hhtth.exec:\7hhtth.exe121⤵PID:2772
-
\??\c:\jjddv.exec:\jjddv.exe122⤵PID:1344
-
\??\c:\xlrfxll.exec:\xlrfxll.exe123⤵PID:2372
-
\??\c:\3llxflx.exec:\3llxflx.exe124⤵PID:2620
-
\??\c:\btbhnb.exec:\btbhnb.exe125⤵PID:2864
-
\??\c:\nhbthh.exec:\nhbthh.exe126⤵PID:1548
-
\??\c:\5pjpv.exec:\5pjpv.exe127⤵PID:1288
-
\??\c:\frrxflx.exec:\frrxflx.exe128⤵PID:1460
-
\??\c:\9lfflll.exec:\9lfflll.exe129⤵PID:1736
-
\??\c:\tnnnbh.exec:\tnnnbh.exe130⤵PID:2444
-
\??\c:\bbntbt.exec:\bbntbt.exe131⤵PID:2508
-
\??\c:\vppjd.exec:\vppjd.exe132⤵PID:596
-
\??\c:\1xxrlxx.exec:\1xxrlxx.exe133⤵PID:536
-
\??\c:\xrrfrxr.exec:\xrrfrxr.exe134⤵PID:1060
-
\??\c:\7tnbht.exec:\7tnbht.exe135⤵PID:588
-
\??\c:\hbhtnh.exec:\hbhtnh.exe136⤵PID:2512
-
\??\c:\pvdjd.exec:\pvdjd.exe137⤵PID:756
-
\??\c:\fxxrlrl.exec:\fxxrlrl.exe138⤵PID:1956
-
\??\c:\rlffrxr.exec:\rlffrxr.exe139⤵PID:864
-
\??\c:\nhhthn.exec:\nhhthn.exe140⤵PID:968
-
\??\c:\vjvjp.exec:\vjvjp.exe141⤵PID:2200
-
\??\c:\5vdvd.exec:\5vdvd.exe142⤵PID:1860
-
\??\c:\xfxxrrl.exec:\xfxxrrl.exe143⤵PID:2560
-
\??\c:\lrrlflx.exec:\lrrlflx.exe144⤵PID:2016
-
\??\c:\hhhnnt.exec:\hhhnnt.exe145⤵PID:1708
-
\??\c:\jjjdp.exec:\jjjdp.exe146⤵PID:1624
-
\??\c:\jjppv.exec:\jjppv.exe147⤵PID:3056
-
\??\c:\xrlrlxr.exec:\xrlrlxr.exe148⤵PID:1620
-
\??\c:\fxlxrrf.exec:\fxlxrrf.exe149⤵PID:2656
-
\??\c:\nbhtnh.exec:\nbhtnh.exe150⤵PID:2660
-
\??\c:\1hbbht.exec:\1hbbht.exe151⤵PID:2720
-
\??\c:\3djpj.exec:\3djpj.exe152⤵PID:2576
-
\??\c:\xfxfrxl.exec:\xfxfrxl.exe153⤵PID:2516
-
\??\c:\hbntbh.exec:\hbntbh.exe154⤵PID:1832
-
\??\c:\pppvj.exec:\pppvj.exe155⤵PID:1968
-
\??\c:\llfxfll.exec:\llfxfll.exe156⤵PID:2956
-
\??\c:\nththh.exec:\nththh.exe157⤵PID:1820
-
\??\c:\dvvjj.exec:\dvvjj.exe158⤵PID:2248
-
\??\c:\1xlfrlr.exec:\1xlfrlr.exe159⤵PID:2436
-
\??\c:\3frrrfl.exec:\3frrrfl.exe160⤵PID:1296
-
\??\c:\bnhntt.exec:\bnhntt.exe161⤵PID:3016
-
\??\c:\djpjp.exec:\djpjp.exe162⤵PID:1700
-
\??\c:\vvppd.exec:\vvppd.exe163⤵PID:2636
-
\??\c:\1flfrll.exec:\1flfrll.exe164⤵PID:2804
-
\??\c:\3lrrxxx.exec:\3lrrxxx.exe165⤵PID:1612
-
\??\c:\1ttnhh.exec:\1ttnhh.exe166⤵PID:1356
-
\??\c:\hhbnbn.exec:\hhbnbn.exe167⤵PID:1748
-
\??\c:\pjddd.exec:\pjddd.exe168⤵PID:1520
-
\??\c:\pvvpd.exec:\pvvpd.exe169⤵PID:1460
-
\??\c:\rrlrxfr.exec:\rrlrxfr.exe170⤵PID:2900
-
\??\c:\5nnbth.exec:\5nnbth.exe171⤵PID:2080
-
\??\c:\bnbbhh.exec:\bnbbhh.exe172⤵PID:708
-
\??\c:\jdvdp.exec:\jdvdp.exe173⤵PID:2896
-
\??\c:\llfxlxl.exec:\llfxlxl.exe174⤵PID:584
-
\??\c:\7lrfflx.exec:\7lrfflx.exe175⤵PID:1040
-
\??\c:\tthbtn.exec:\tthbtn.exe176⤵PID:2120
-
\??\c:\thttbb.exec:\thttbb.exe177⤵PID:620
-
\??\c:\jjdpd.exec:\jjdpd.exe178⤵PID:1972
-
\??\c:\fxrlrxr.exec:\fxrlrxr.exe179⤵PID:1064
-
\??\c:\hnnthn.exec:\hnnthn.exe180⤵PID:2672
-
\??\c:\3bbnbb.exec:\3bbnbb.exe181⤵PID:2184
-
\??\c:\pdjvd.exec:\pdjvd.exe182⤵PID:2192
-
\??\c:\7dvjp.exec:\7dvjp.exe183⤵PID:1680
-
\??\c:\rrxlxlf.exec:\rrxlxlf.exe184⤵PID:1860
-
\??\c:\bnhtbb.exec:\bnhtbb.exe185⤵PID:568
-
\??\c:\vdvjd.exec:\vdvjd.exe186⤵PID:2040
-
\??\c:\3vjjp.exec:\3vjjp.exe187⤵PID:2600
-
\??\c:\rllflrf.exec:\rllflrf.exe188⤵PID:2552
-
\??\c:\9ffrlrx.exec:\9ffrlrx.exe189⤵PID:3056
-
\??\c:\bhhtnt.exec:\bhhtnt.exe190⤵PID:2760
-
\??\c:\dvjvj.exec:\dvjvj.exe191⤵PID:2656
-
\??\c:\pjjpd.exec:\pjjpd.exe192⤵PID:2660
-
\??\c:\lffrrxf.exec:\lffrrxf.exe193⤵PID:2500
-
\??\c:\fxflxfr.exec:\fxflxfr.exe194⤵PID:1728
-
\??\c:\nbhhbn.exec:\nbhhbn.exe195⤵PID:2464
-
\??\c:\9vjvj.exec:\9vjvj.exe196⤵PID:1704
-
\??\c:\jddpj.exec:\jddpj.exe197⤵PID:2580
-
\??\c:\lxfrrll.exec:\lxfrrll.exe198⤵PID:2312
-
\??\c:\nttbbn.exec:\nttbbn.exe199⤵PID:2992
-
\??\c:\hbthbn.exec:\hbthbn.exe200⤵PID:2256
-
\??\c:\jppdd.exec:\jppdd.exe201⤵PID:2060
-
\??\c:\fxrfxfx.exec:\fxrfxfx.exe202⤵PID:2840
-
\??\c:\fflllxr.exec:\fflllxr.exe203⤵PID:2752
-
\??\c:\ttnbtb.exec:\ttnbtb.exe204⤵PID:2736
-
\??\c:\hhbnhb.exec:\hhbnhb.exe205⤵PID:2348
-
\??\c:\dppjv.exec:\dppjv.exe206⤵PID:2520
-
\??\c:\fxflrxr.exec:\fxflrxr.exe207⤵PID:2340
-
\??\c:\3bnthh.exec:\3bnthh.exe208⤵PID:2756
-
\??\c:\5tnntb.exec:\5tnntb.exe209⤵PID:640
-
\??\c:\vvpjp.exec:\vvpjp.exe210⤵PID:1740
-
\??\c:\pppdj.exec:\pppdj.exe211⤵PID:2308
-
\??\c:\rrfffxl.exec:\rrfffxl.exe212⤵PID:1732
-
\??\c:\nhbbnn.exec:\nhbbnn.exe213⤵PID:2844
-
\??\c:\hbttnh.exec:\hbttnh.exe214⤵PID:2780
-
\??\c:\djjvj.exec:\djjvj.exe215⤵PID:268
-
\??\c:\vppdv.exec:\vppdv.exe216⤵PID:336
-
\??\c:\xrxlxrf.exec:\xrxlxrf.exe217⤵PID:596
-
\??\c:\nhbhth.exec:\nhbhth.exe218⤵PID:1896
-
\??\c:\bntbbb.exec:\bntbbb.exe219⤵PID:1528
-
\??\c:\pjjvj.exec:\pjjvj.exe220⤵PID:1828
-
\??\c:\lfrllll.exec:\lfrllll.exe221⤵PID:2952
-
\??\c:\3fffrrx.exec:\3fffrrx.exe222⤵PID:1496
-
\??\c:\7htnbb.exec:\7htnbb.exe223⤵PID:1868
-
\??\c:\tnhntt.exec:\tnhntt.exe224⤵PID:312
-
\??\c:\3ddjj.exec:\3ddjj.exe225⤵PID:1876
-
\??\c:\5pvpv.exec:\5pvpv.exe226⤵PID:2364
-
\??\c:\frlrxxl.exec:\frlrxxl.exe227⤵PID:1524
-
\??\c:\bhhtbh.exec:\bhhtbh.exe228⤵PID:1944
-
\??\c:\bnbtnh.exec:\bnbtnh.exe229⤵PID:1588
-
\??\c:\vpjpd.exec:\vpjpd.exe230⤵PID:2640
-
\??\c:\9llfrfr.exec:\9llfrfr.exe231⤵PID:2688
-
\??\c:\rlfrrfr.exec:\rlfrrfr.exe232⤵PID:2252
-
\??\c:\bttnbh.exec:\bttnbh.exe233⤵PID:2700
-
\??\c:\hbbhtn.exec:\hbbhtn.exe234⤵PID:2692
-
\??\c:\pvddj.exec:\pvddj.exe235⤵PID:2112
-
\??\c:\1jdjv.exec:\1jdjv.exe236⤵PID:1268
-
\??\c:\lxxrffr.exec:\lxxrffr.exe237⤵PID:2632
-
\??\c:\lllrlrl.exec:\lllrlrl.exe238⤵PID:2176
-
\??\c:\nhnnbh.exec:\nhnnbh.exe239⤵PID:2524
-
\??\c:\nbhhhb.exec:\nbhhhb.exe240⤵PID:2404
-
\??\c:\pjddj.exec:\pjddj.exe241⤵PID:2972
-
\??\c:\rrlfrxl.exec:\rrlfrxl.exe242⤵PID:2976