Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 18:26
Behavioral task
behavioral1
Sample
2a3e913357b13787491af6f585e14730_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
2a3e913357b13787491af6f585e14730_NeikiAnalytics.exe
-
Size
214KB
-
MD5
2a3e913357b13787491af6f585e14730
-
SHA1
47561dfce54b352e8fbbcecdf3d58f6ad33a9e73
-
SHA256
cf0b860b7f26e20a2c66174002e7e76ec5610817abfac351f5169cc1c70e1857
-
SHA512
f360573afcfe5c02776d78deda4af793cf2c8144bd078056913c3cccb7195be3635d79f3b303c36b1a576532f10b97bdc11a368c7adad046a2d335994c502ed9
-
SSDEEP
3072:ZhOm2sI93UufdC67ciEu0P5axvqdUmdznCvs7BuRoYFBg/gXVqPfSoi0yG24ePe:Zcm7ImGddXEu0ucju6/4kf724f
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4288-1-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4464-7-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3532-13-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/5012-18-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2908-24-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4860-208-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4960-234-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4692-242-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3468-253-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/5092-255-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2884-239-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/5004-228-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/700-223-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3044-204-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1296-197-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4336-186-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/768-183-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3976-177-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2216-165-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4892-159-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2788-153-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/5076-147-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3964-136-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4324-130-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/748-124-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3628-113-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2784-102-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/5008-97-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1644-90-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2460-84-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/964-78-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3612-72-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1488-66-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2184-60-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2328-54-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3952-48-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1316-36-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/5112-30-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/116-263-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2212-277-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/884-286-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3948-302-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4988-310-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1488-333-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3444-338-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4188-341-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/916-353-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1780-388-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/5072-413-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4640-432-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4768-436-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3508-444-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3644-490-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4276-545-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1000-564-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3676-607-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1848-636-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3444-728-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4832-755-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/5092-769-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3676-773-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4596-848-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1120-903-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1244-941-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 33 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\hbnntn.exe family_berbew \??\c:\jpjdd.exe family_berbew \??\c:\xxlxflf.exe family_berbew \??\c:\jpdvv.exe family_berbew \??\c:\llxxxxx.exe family_berbew \??\c:\ntnnhb.exe family_berbew \??\c:\bhnhbb.exe family_berbew \??\c:\9djjv.exe family_berbew \??\c:\pjjdd.exe family_berbew \??\c:\fxfxxff.exe family_berbew \??\c:\dvvvd.exe family_berbew \??\c:\vvvvv.exe family_berbew \??\c:\9ttbbn.exe family_berbew \??\c:\3pppd.exe family_berbew \??\c:\1xffxfx.exe family_berbew C:\lxlfxrl.exe family_berbew C:\5pvpp.exe family_berbew \??\c:\tbnnbt.exe family_berbew \??\c:\bhhbbh.exe family_berbew \??\c:\lffllxx.exe family_berbew \??\c:\vdjjj.exe family_berbew \??\c:\9djdv.exe family_berbew \??\c:\7bhhhn.exe family_berbew \??\c:\bbhhhh.exe family_berbew \??\c:\1fxxlll.exe family_berbew \??\c:\lffffff.exe family_berbew \??\c:\5jpjj.exe family_berbew \??\c:\nhnhnn.exe family_berbew \??\c:\1rrxrxx.exe family_berbew \??\c:\7rxfxrr.exe family_berbew \??\c:\hbbttt.exe family_berbew \??\c:\tnnnhn.exe family_berbew \??\c:\lxffflf.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
hbnntn.exejpjdd.exejpdvv.exexxlxflf.exellxxxxx.exentnnhb.exebhnhbb.exe9djjv.exepjjdd.exelxffflf.exefxfxxff.exetnnnhn.exehbbttt.exedvvvd.exevvvvv.exe7rxfxrr.exe1rrxrxx.exe9ttbbn.exenhnhnn.exe3pppd.exe5jpjj.exelffffff.exe1fxxlll.exebbhhhh.exe7bhhhn.exe9djdv.exevdjjj.exelffllxx.exe1xffxfx.exebhhbbh.exetbnnbt.exe5pvpp.exelxlfxrl.exe9ffllll.exenbbtnn.exenbhhhb.exepddvv.exe9pjjv.exeffffxff.exerllfxxx.exe3bhhht.exehbtnnt.exe5vvvp.exepjjjj.exexflrrxr.exe1lfxxff.exehbtttt.exebhnhhb.exejdddd.exexrrrlll.exefxxxxff.exebttntb.exevpdjp.exexxfxxrr.exetnnnhh.exe1pvpj.exerrxxffl.exefxfxxlx.exepjjjd.exe5jpjd.exeffrrlfx.exebntnhh.exe3bttnn.exevpvpj.exepid process 4464 hbnntn.exe 3532 jpjdd.exe 5012 jpdvv.exe 2908 xxlxflf.exe 5112 llxxxxx.exe 1316 ntnnhb.exe 3952 bhnhbb.exe 2328 9djjv.exe 2184 pjjdd.exe 1488 lxffflf.exe 3612 fxfxxff.exe 964 tnnnhn.exe 2460 hbbttt.exe 1644 dvvvd.exe 5008 vvvvv.exe 2784 7rxfxrr.exe 640 1rrxrxx.exe 3628 9ttbbn.exe 4368 nhnhnn.exe 748 3pppd.exe 4324 5jpjj.exe 3964 lffffff.exe 3832 1fxxlll.exe 5076 bbhhhh.exe 2788 7bhhhn.exe 4892 9djdv.exe 2216 vdjjj.exe 2228 lffllxx.exe 3976 1xffxfx.exe 768 bhhbbh.exe 4336 tbnnbt.exe 3132 5pvpp.exe 1296 lxlfxrl.exe 2440 9ffllll.exe 3044 nbbtnn.exe 4860 nbhhhb.exe 2384 pddvv.exe 3204 9pjjv.exe 1776 ffffxff.exe 2276 rllfxxx.exe 700 3bhhht.exe 5004 hbtnnt.exe 964 5vvvp.exe 4960 pjjjj.exe 2884 xflrrxr.exe 4692 1lfxxff.exe 1052 hbtttt.exe 2136 bhnhhb.exe 3468 jdddd.exe 5092 xrrrlll.exe 1780 fxxxxff.exe 116 bttntb.exe 5088 vpdjp.exe 2248 xxfxxrr.exe 3400 tnnnhh.exe 2212 1pvpj.exe 3520 rrxxffl.exe 1752 fxfxxlx.exe 884 pjjjd.exe 4548 5jpjd.exe 1228 ffrrlfx.exe 1996 bntnhh.exe 3948 3bttnn.exe 3088 vpvpj.exe -
Processes:
resource yara_rule behavioral2/memory/4288-1-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4464-7-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3532-13-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/5012-18-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2908-24-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4860-208-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4960-234-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4692-242-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3468-253-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/116-258-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/5092-255-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2884-239-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/5004-228-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/700-223-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3044-204-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1296-197-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4336-186-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/768-183-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3976-177-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2216-165-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4892-159-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2788-153-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/5076-147-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3964-136-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4324-130-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/748-124-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3628-113-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2784-102-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/5008-97-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1644-90-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2460-84-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/964-78-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3612-72-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1488-66-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2184-60-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2328-54-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3952-48-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1316-36-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/5112-30-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/116-263-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2212-277-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1752-282-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/884-286-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3948-302-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4988-306-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4988-310-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1488-333-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3444-338-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4188-341-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/916-353-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1780-388-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/5072-413-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4640-432-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4768-436-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3508-444-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4832-474-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3644-490-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4276-545-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1000-564-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3676-607-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1848-636-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4756-699-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3444-728-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4832-755-0x0000000000400000-0x000000000042D000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2a3e913357b13787491af6f585e14730_NeikiAnalytics.exehbnntn.exejpjdd.exejpdvv.exexxlxflf.exellxxxxx.exentnnhb.exebhnhbb.exe9djjv.exepjjdd.exelxffflf.exefxfxxff.exetnnnhn.exehbbttt.exedvvvd.exevvvvv.exe7rxfxrr.exe1rrxrxx.exe9ttbbn.exenhnhnn.exe3pppd.exe5jpjj.exedescription pid process target process PID 4288 wrote to memory of 4464 4288 2a3e913357b13787491af6f585e14730_NeikiAnalytics.exe hbnntn.exe PID 4288 wrote to memory of 4464 4288 2a3e913357b13787491af6f585e14730_NeikiAnalytics.exe hbnntn.exe PID 4288 wrote to memory of 4464 4288 2a3e913357b13787491af6f585e14730_NeikiAnalytics.exe hbnntn.exe PID 4464 wrote to memory of 3532 4464 hbnntn.exe jpjdd.exe PID 4464 wrote to memory of 3532 4464 hbnntn.exe jpjdd.exe PID 4464 wrote to memory of 3532 4464 hbnntn.exe jpjdd.exe PID 3532 wrote to memory of 5012 3532 jpjdd.exe jpdvv.exe PID 3532 wrote to memory of 5012 3532 jpjdd.exe jpdvv.exe PID 3532 wrote to memory of 5012 3532 jpjdd.exe jpdvv.exe PID 5012 wrote to memory of 2908 5012 jpdvv.exe xxlxflf.exe PID 5012 wrote to memory of 2908 5012 jpdvv.exe xxlxflf.exe PID 5012 wrote to memory of 2908 5012 jpdvv.exe xxlxflf.exe PID 2908 wrote to memory of 5112 2908 xxlxflf.exe llxxxxx.exe PID 2908 wrote to memory of 5112 2908 xxlxflf.exe llxxxxx.exe PID 2908 wrote to memory of 5112 2908 xxlxflf.exe llxxxxx.exe PID 5112 wrote to memory of 1316 5112 llxxxxx.exe ntnnhb.exe PID 5112 wrote to memory of 1316 5112 llxxxxx.exe ntnnhb.exe PID 5112 wrote to memory of 1316 5112 llxxxxx.exe ntnnhb.exe PID 1316 wrote to memory of 3952 1316 ntnnhb.exe bhnhbb.exe PID 1316 wrote to memory of 3952 1316 ntnnhb.exe bhnhbb.exe PID 1316 wrote to memory of 3952 1316 ntnnhb.exe bhnhbb.exe PID 3952 wrote to memory of 2328 3952 bhnhbb.exe 9djjv.exe PID 3952 wrote to memory of 2328 3952 bhnhbb.exe 9djjv.exe PID 3952 wrote to memory of 2328 3952 bhnhbb.exe 9djjv.exe PID 2328 wrote to memory of 2184 2328 9djjv.exe pjjdd.exe PID 2328 wrote to memory of 2184 2328 9djjv.exe pjjdd.exe PID 2328 wrote to memory of 2184 2328 9djjv.exe pjjdd.exe PID 2184 wrote to memory of 1488 2184 pjjdd.exe lxffflf.exe PID 2184 wrote to memory of 1488 2184 pjjdd.exe lxffflf.exe PID 2184 wrote to memory of 1488 2184 pjjdd.exe lxffflf.exe PID 1488 wrote to memory of 3612 1488 lxffflf.exe fxfxxff.exe PID 1488 wrote to memory of 3612 1488 lxffflf.exe fxfxxff.exe PID 1488 wrote to memory of 3612 1488 lxffflf.exe fxfxxff.exe PID 3612 wrote to memory of 964 3612 fxfxxff.exe 5vvvp.exe PID 3612 wrote to memory of 964 3612 fxfxxff.exe 5vvvp.exe PID 3612 wrote to memory of 964 3612 fxfxxff.exe 5vvvp.exe PID 964 wrote to memory of 2460 964 tnnnhn.exe hbbttt.exe PID 964 wrote to memory of 2460 964 tnnnhn.exe hbbttt.exe PID 964 wrote to memory of 2460 964 tnnnhn.exe hbbttt.exe PID 2460 wrote to memory of 1644 2460 hbbttt.exe dvvvd.exe PID 2460 wrote to memory of 1644 2460 hbbttt.exe dvvvd.exe PID 2460 wrote to memory of 1644 2460 hbbttt.exe dvvvd.exe PID 1644 wrote to memory of 5008 1644 dvvvd.exe vvvvv.exe PID 1644 wrote to memory of 5008 1644 dvvvd.exe vvvvv.exe PID 1644 wrote to memory of 5008 1644 dvvvd.exe vvvvv.exe PID 5008 wrote to memory of 2784 5008 vvvvv.exe 7rxfxrr.exe PID 5008 wrote to memory of 2784 5008 vvvvv.exe 7rxfxrr.exe PID 5008 wrote to memory of 2784 5008 vvvvv.exe 7rxfxrr.exe PID 2784 wrote to memory of 640 2784 7rxfxrr.exe 1rrxrxx.exe PID 2784 wrote to memory of 640 2784 7rxfxrr.exe 1rrxrxx.exe PID 2784 wrote to memory of 640 2784 7rxfxrr.exe 1rrxrxx.exe PID 640 wrote to memory of 3628 640 1rrxrxx.exe 9ttbbn.exe PID 640 wrote to memory of 3628 640 1rrxrxx.exe 9ttbbn.exe PID 640 wrote to memory of 3628 640 1rrxrxx.exe 9ttbbn.exe PID 3628 wrote to memory of 4368 3628 9ttbbn.exe nhnhnn.exe PID 3628 wrote to memory of 4368 3628 9ttbbn.exe nhnhnn.exe PID 3628 wrote to memory of 4368 3628 9ttbbn.exe nhnhnn.exe PID 4368 wrote to memory of 748 4368 nhnhnn.exe 3pppd.exe PID 4368 wrote to memory of 748 4368 nhnhnn.exe 3pppd.exe PID 4368 wrote to memory of 748 4368 nhnhnn.exe 3pppd.exe PID 748 wrote to memory of 4324 748 3pppd.exe 5jpjj.exe PID 748 wrote to memory of 4324 748 3pppd.exe 5jpjj.exe PID 748 wrote to memory of 4324 748 3pppd.exe 5jpjj.exe PID 4324 wrote to memory of 3964 4324 5jpjj.exe lffffff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a3e913357b13787491af6f585e14730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2a3e913357b13787491af6f585e14730_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4288 -
\??\c:\hbnntn.exec:\hbnntn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\jpjdd.exec:\jpjdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\jpdvv.exec:\jpdvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\xxlxflf.exec:\xxlxflf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\llxxxxx.exec:\llxxxxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\ntnnhb.exec:\ntnnhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\bhnhbb.exec:\bhnhbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\9djjv.exec:\9djjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\pjjdd.exec:\pjjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\lxffflf.exec:\lxffflf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\fxfxxff.exec:\fxfxxff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\tnnnhn.exec:\tnnnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\hbbttt.exec:\hbbttt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\dvvvd.exec:\dvvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\vvvvv.exec:\vvvvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\7rxfxrr.exec:\7rxfxrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\1rrxrxx.exec:\1rrxrxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\9ttbbn.exec:\9ttbbn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\nhnhnn.exec:\nhnhnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\3pppd.exec:\3pppd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\5jpjj.exec:\5jpjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\lffffff.exec:\lffffff.exe23⤵
- Executes dropped EXE
PID:3964 -
\??\c:\1fxxlll.exec:\1fxxlll.exe24⤵
- Executes dropped EXE
PID:3832 -
\??\c:\bbhhhh.exec:\bbhhhh.exe25⤵
- Executes dropped EXE
PID:5076 -
\??\c:\7bhhhn.exec:\7bhhhn.exe26⤵
- Executes dropped EXE
PID:2788 -
\??\c:\9djdv.exec:\9djdv.exe27⤵
- Executes dropped EXE
PID:4892 -
\??\c:\vdjjj.exec:\vdjjj.exe28⤵
- Executes dropped EXE
PID:2216 -
\??\c:\lffllxx.exec:\lffllxx.exe29⤵
- Executes dropped EXE
PID:2228 -
\??\c:\1xffxfx.exec:\1xffxfx.exe30⤵
- Executes dropped EXE
PID:3976 -
\??\c:\bhhbbh.exec:\bhhbbh.exe31⤵
- Executes dropped EXE
PID:768 -
\??\c:\tbnnbt.exec:\tbnnbt.exe32⤵
- Executes dropped EXE
PID:4336 -
\??\c:\5pvpp.exec:\5pvpp.exe33⤵
- Executes dropped EXE
PID:3132 -
\??\c:\jdddv.exec:\jdddv.exe34⤵PID:3096
-
\??\c:\lxlfxrl.exec:\lxlfxrl.exe35⤵
- Executes dropped EXE
PID:1296 -
\??\c:\9ffllll.exec:\9ffllll.exe36⤵
- Executes dropped EXE
PID:2440 -
\??\c:\nbbtnn.exec:\nbbtnn.exe37⤵
- Executes dropped EXE
PID:3044 -
\??\c:\nbhhhb.exec:\nbhhhb.exe38⤵
- Executes dropped EXE
PID:4860 -
\??\c:\pddvv.exec:\pddvv.exe39⤵
- Executes dropped EXE
PID:2384 -
\??\c:\9pjjv.exec:\9pjjv.exe40⤵
- Executes dropped EXE
PID:3204 -
\??\c:\ffffxff.exec:\ffffxff.exe41⤵
- Executes dropped EXE
PID:1776 -
\??\c:\rllfxxx.exec:\rllfxxx.exe42⤵
- Executes dropped EXE
PID:2276 -
\??\c:\3bhhht.exec:\3bhhht.exe43⤵
- Executes dropped EXE
PID:700 -
\??\c:\hbtnnt.exec:\hbtnnt.exe44⤵
- Executes dropped EXE
PID:5004 -
\??\c:\5vvvp.exec:\5vvvp.exe45⤵
- Executes dropped EXE
PID:964 -
\??\c:\pjjjj.exec:\pjjjj.exe46⤵
- Executes dropped EXE
PID:4960 -
\??\c:\xflrrxr.exec:\xflrrxr.exe47⤵
- Executes dropped EXE
PID:2884 -
\??\c:\1lfxxff.exec:\1lfxxff.exe48⤵
- Executes dropped EXE
PID:4692 -
\??\c:\hbtttt.exec:\hbtttt.exe49⤵
- Executes dropped EXE
PID:1052 -
\??\c:\bhnhhb.exec:\bhnhhb.exe50⤵
- Executes dropped EXE
PID:2136 -
\??\c:\jdddd.exec:\jdddd.exe51⤵
- Executes dropped EXE
PID:3468 -
\??\c:\xrrrlll.exec:\xrrrlll.exe52⤵
- Executes dropped EXE
PID:5092 -
\??\c:\fxxxxff.exec:\fxxxxff.exe53⤵
- Executes dropped EXE
PID:1780 -
\??\c:\bttntb.exec:\bttntb.exe54⤵
- Executes dropped EXE
PID:116 -
\??\c:\vpdjp.exec:\vpdjp.exe55⤵
- Executes dropped EXE
PID:5088 -
\??\c:\xxfxxrr.exec:\xxfxxrr.exe56⤵
- Executes dropped EXE
PID:2248 -
\??\c:\tnnnhh.exec:\tnnnhh.exe57⤵
- Executes dropped EXE
PID:3400 -
\??\c:\1pvpj.exec:\1pvpj.exe58⤵
- Executes dropped EXE
PID:2212 -
\??\c:\rrxxffl.exec:\rrxxffl.exe59⤵
- Executes dropped EXE
PID:3520 -
\??\c:\fxfxxlx.exec:\fxfxxlx.exe60⤵
- Executes dropped EXE
PID:1752 -
\??\c:\pjjjd.exec:\pjjjd.exe61⤵
- Executes dropped EXE
PID:884 -
\??\c:\5jpjd.exec:\5jpjd.exe62⤵
- Executes dropped EXE
PID:4548 -
\??\c:\ffrrlfx.exec:\ffrrlfx.exe63⤵
- Executes dropped EXE
PID:1228 -
\??\c:\bntnhh.exec:\bntnhh.exe64⤵
- Executes dropped EXE
PID:1996 -
\??\c:\3bttnn.exec:\3bttnn.exe65⤵
- Executes dropped EXE
PID:3948 -
\??\c:\vpvpj.exec:\vpvpj.exe66⤵
- Executes dropped EXE
PID:3088 -
\??\c:\ffllrrx.exec:\ffllrrx.exe67⤵PID:4988
-
\??\c:\fxrllrl.exec:\fxrllrl.exe68⤵PID:3124
-
\??\c:\9tbbtn.exec:\9tbbtn.exe69⤵PID:1492
-
\??\c:\bbbttt.exec:\bbbttt.exe70⤵PID:4432
-
\??\c:\dvvpj.exec:\dvvpj.exe71⤵PID:4260
-
\??\c:\vjjdp.exec:\vjjdp.exe72⤵PID:4724
-
\??\c:\7flfrrr.exec:\7flfrrr.exe73⤵PID:2276
-
\??\c:\tthhnn.exec:\tthhnn.exe74⤵PID:3264
-
\??\c:\hhnhbb.exec:\hhnhbb.exe75⤵PID:1488
-
\??\c:\5pvpj.exec:\5pvpj.exe76⤵PID:3444
-
\??\c:\1pvpv.exec:\1pvpv.exe77⤵PID:4188
-
\??\c:\rrlllxr.exec:\rrlllxr.exe78⤵PID:2320
-
\??\c:\xlrlflx.exec:\xlrlflx.exe79⤵PID:5068
-
\??\c:\thnhhn.exec:\thnhhn.exe80⤵PID:916
-
\??\c:\ttbthh.exec:\ttbthh.exe81⤵PID:1164
-
\??\c:\dpppj.exec:\dpppj.exe82⤵PID:3376
-
\??\c:\5jjdp.exec:\5jjdp.exe83⤵PID:4832
-
\??\c:\lfllflr.exec:\lfllflr.exe84⤵PID:5008
-
\??\c:\nnttbb.exec:\nnttbb.exe85⤵PID:2488
-
\??\c:\bnbttt.exec:\bnbttt.exe86⤵PID:2136
-
\??\c:\pjppd.exec:\pjppd.exe87⤵PID:1280
-
\??\c:\5dpjp.exec:\5dpjp.exe88⤵PID:1868
-
\??\c:\flrxlff.exec:\flrxlff.exe89⤵PID:5092
-
\??\c:\5ffxrrl.exec:\5ffxrrl.exe90⤵PID:3676
-
\??\c:\pjpjd.exec:\pjpjd.exe91⤵PID:1780
-
\??\c:\rfrrlll.exec:\rfrrlll.exe92⤵PID:3812
-
\??\c:\bbntnb.exec:\bbntnb.exe93⤵PID:3112
-
\??\c:\hbbtbt.exec:\hbbtbt.exe94⤵PID:2788
-
\??\c:\5vpjj.exec:\5vpjj.exe95⤵PID:3292
-
\??\c:\3xfxlll.exec:\3xfxlll.exe96⤵PID:4428
-
\??\c:\rrfxllf.exec:\rrfxllf.exe97⤵PID:3488
-
\??\c:\hbnhnn.exec:\hbnhnn.exe98⤵PID:2808
-
\??\c:\7bbtbb.exec:\7bbtbb.exe99⤵PID:3412
-
\??\c:\dpvvj.exec:\dpvvj.exe100⤵PID:5072
-
\??\c:\ttthhb.exec:\ttthhb.exe101⤵PID:1296
-
\??\c:\nhhbbb.exec:\nhhbbb.exe102⤵PID:3668
-
\??\c:\jjddd.exec:\jjddd.exe103⤵PID:3532
-
\??\c:\rrrxrrr.exec:\rrrxrrr.exe104⤵PID:3124
-
\??\c:\xfxxxxf.exec:\xfxxxxf.exe105⤵PID:4640
-
\??\c:\3bhtnt.exec:\3bhtnt.exe106⤵PID:4768
-
\??\c:\5tbtbb.exec:\5tbtbb.exe107⤵PID:4260
-
\??\c:\1vpjd.exec:\1vpjd.exe108⤵PID:2176
-
\??\c:\7vpjp.exec:\7vpjp.exe109⤵PID:3508
-
\??\c:\frxxrrl.exec:\frxxrrl.exe110⤵PID:3940
-
\??\c:\rlllllf.exec:\rlllllf.exe111⤵PID:1488
-
\??\c:\nthbbb.exec:\nthbbb.exe112⤵PID:4300
-
\??\c:\jdvpp.exec:\jdvpp.exe113⤵PID:2124
-
\??\c:\vpjjd.exec:\vpjjd.exe114⤵PID:4960
-
\??\c:\9xrlllf.exec:\9xrlllf.exe115⤵PID:1692
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe116⤵PID:916
-
\??\c:\htbttt.exec:\htbttt.exe117⤵PID:1164
-
\??\c:\1hhbtt.exec:\1hhbtt.exe118⤵PID:3988
-
\??\c:\dvvpj.exec:\dvvpj.exe119⤵PID:4832
-
\??\c:\xrrrlll.exec:\xrrrlll.exe120⤵PID:640
-
\??\c:\htbnhh.exec:\htbnhh.exe121⤵PID:2488
-
\??\c:\thnhhh.exec:\thnhhh.exe122⤵PID:1984
-
\??\c:\jpvpj.exec:\jpvpj.exe123⤵PID:3644
-
\??\c:\rlffxxr.exec:\rlffxxr.exe124⤵PID:3460
-
\??\c:\nbhhhh.exec:\nbhhhh.exe125⤵PID:5092
-
\??\c:\bbtntt.exec:\bbtntt.exe126⤵PID:3676
-
\??\c:\djjjj.exec:\djjjj.exe127⤵PID:1648
-
\??\c:\lfxrrrx.exec:\lfxrrrx.exe128⤵PID:4980
-
\??\c:\1fffllr.exec:\1fffllr.exe129⤵PID:3064
-
\??\c:\hnnnhb.exec:\hnnnhb.exe130⤵PID:656
-
\??\c:\dpvpp.exec:\dpvpp.exe131⤵PID:1484
-
\??\c:\rxfxxrr.exec:\rxfxxrr.exe132⤵PID:3196
-
\??\c:\tbbttb.exec:\tbbttb.exe133⤵PID:3096
-
\??\c:\9nnhbb.exec:\9nnhbb.exe134⤵PID:1228
-
\??\c:\pjddv.exec:\pjddv.exe135⤵PID:3936
-
\??\c:\jdddd.exec:\jdddd.exe136⤵PID:884
-
\??\c:\vpvvp.exec:\vpvvp.exe137⤵PID:4988
-
\??\c:\rlrllrr.exec:\rlrllrr.exe138⤵PID:2384
-
\??\c:\btnnhh.exec:\btnnhh.exe139⤵PID:1492
-
\??\c:\tnnhhb.exec:\tnnhhb.exe140⤵PID:1372
-
\??\c:\vjjjj.exec:\vjjjj.exe141⤵PID:4276
-
\??\c:\9xllllr.exec:\9xllllr.exe142⤵PID:2184
-
\??\c:\nhnhhh.exec:\nhnhhh.exe143⤵PID:2952
-
\??\c:\ttttbb.exec:\ttttbb.exe144⤵PID:3296
-
\??\c:\ddddd.exec:\ddddd.exe145⤵PID:3612
-
\??\c:\pdpvj.exec:\pdpvj.exe146⤵PID:964
-
\??\c:\ffxrllf.exec:\ffxrllf.exe147⤵PID:1000
-
\??\c:\htbbth.exec:\htbbth.exe148⤵PID:864
-
\??\c:\5hhhtb.exec:\5hhhtb.exe149⤵PID:2124
-
\??\c:\pvjjv.exec:\pvjjv.exe150⤵PID:4960
-
\??\c:\jddvp.exec:\jddvp.exe151⤵PID:3932
-
\??\c:\rrxxfxl.exec:\rrxxfxl.exe152⤵PID:1272
-
\??\c:\btnhhn.exec:\btnhhn.exe153⤵PID:5052
-
\??\c:\nnttnb.exec:\nnttnb.exe154⤵PID:5040
-
\??\c:\dpvpj.exec:\dpvpj.exe155⤵PID:3396
-
\??\c:\lfrlxll.exec:\lfrlxll.exe156⤵PID:2968
-
\??\c:\jjpjd.exec:\jjpjd.exe157⤵PID:2632
-
\??\c:\9bbnnb.exec:\9bbnnb.exe158⤵PID:3964
-
\??\c:\tnbbbb.exec:\tnbbbb.exe159⤵PID:3460
-
\??\c:\dpjdv.exec:\dpjdv.exe160⤵PID:5092
-
\??\c:\7rxrrrl.exec:\7rxrrrl.exe161⤵PID:3676
-
\??\c:\nnttnh.exec:\nnttnh.exe162⤵PID:4556
-
\??\c:\ddjjj.exec:\ddjjj.exe163⤵PID:3400
-
\??\c:\3djjj.exec:\3djjj.exe164⤵PID:3520
-
\??\c:\llrlllf.exec:\llrlllf.exe165⤵PID:2808
-
\??\c:\9lrlffx.exec:\9lrlffx.exe166⤵PID:4600
-
\??\c:\nhnntt.exec:\nhnntt.exe167⤵PID:1296
-
\??\c:\tntnhb.exec:\tntnhb.exe168⤵PID:3532
-
\??\c:\vjpjd.exec:\vjpjd.exe169⤵PID:3652
-
\??\c:\lllffff.exec:\lllffff.exe170⤵PID:4724
-
\??\c:\3ffxxff.exec:\3ffxxff.exe171⤵PID:1848
-
\??\c:\xrrlffx.exec:\xrrlffx.exe172⤵PID:2276
-
\??\c:\bhhhhb.exec:\bhhhhb.exe173⤵PID:3508
-
\??\c:\1dvvp.exec:\1dvvp.exe174⤵PID:4128
-
\??\c:\pjvpj.exec:\pjvpj.exe175⤵PID:2332
-
\??\c:\ffrrrlx.exec:\ffrrrlx.exe176⤵PID:1000
-
\??\c:\tthnhh.exec:\tthnhh.exe177⤵PID:864
-
\??\c:\tnhhhh.exec:\tnhhhh.exe178⤵PID:1924
-
\??\c:\3lfxrrl.exec:\3lfxrrl.exe179⤵PID:916
-
\??\c:\7rlffff.exec:\7rlffff.exe180⤵PID:388
-
\??\c:\httnnh.exec:\httnnh.exe181⤵PID:3988
-
\??\c:\vpdvp.exec:\vpdvp.exe182⤵PID:3628
-
\??\c:\rfrfxlf.exec:\rfrfxlf.exe183⤵PID:2348
-
\??\c:\5nnhbh.exec:\5nnhbh.exe184⤵PID:3396
-
\??\c:\tnnttt.exec:\tnnttt.exe185⤵PID:396
-
\??\c:\3pdpp.exec:\3pdpp.exe186⤵PID:4628
-
\??\c:\5xffxfl.exec:\5xffxfl.exe187⤵PID:220
-
\??\c:\xxxrllf.exec:\xxxrllf.exe188⤵PID:5076
-
\??\c:\3vdvv.exec:\3vdvv.exe189⤵PID:4436
-
\??\c:\dvppj.exec:\dvppj.exe190⤵PID:4328
-
\??\c:\ttbbtb.exec:\ttbbtb.exe191⤵PID:3888
-
\??\c:\1pvpp.exec:\1pvpp.exe192⤵PID:4756
-
\??\c:\9rrfxll.exec:\9rrfxll.exe193⤵PID:3864
-
\??\c:\ttthbn.exec:\ttthbn.exe194⤵PID:4568
-
\??\c:\9ppjv.exec:\9ppjv.exe195⤵PID:4640
-
\??\c:\xllffff.exec:\xllffff.exe196⤵PID:4076
-
\??\c:\thtnnt.exec:\thtnnt.exe197⤵PID:4576
-
\??\c:\pdddj.exec:\pdddj.exe198⤵PID:4724
-
\??\c:\7fxxrxr.exec:\7fxxrxr.exe199⤵PID:1996
-
\??\c:\hbbhhb.exec:\hbbhhb.exe200⤵PID:3296
-
\??\c:\5ppdv.exec:\5ppdv.exe201⤵PID:3444
-
\??\c:\jdvjd.exec:\jdvjd.exe202⤵PID:4188
-
\??\c:\1xfrllf.exec:\1xfrllf.exe203⤵PID:2320
-
\??\c:\9hhhbt.exec:\9hhhbt.exe204⤵PID:4896
-
\??\c:\dvdjj.exec:\dvdjj.exe205⤵PID:3920
-
\??\c:\jjvvp.exec:\jjvvp.exe206⤵PID:3152
-
\??\c:\fffllrl.exec:\fffllrl.exe207⤵PID:988
-
\??\c:\7nttnn.exec:\7nttnn.exe208⤵PID:388
-
\??\c:\btbtnn.exec:\btbtnn.exe209⤵PID:4832
-
\??\c:\jppjp.exec:\jppjp.exe210⤵PID:1328
-
\??\c:\fxrrrrr.exec:\fxrrrrr.exe211⤵PID:2588
-
\??\c:\bttnht.exec:\bttnht.exe212⤵PID:2796
-
\??\c:\5htnnt.exec:\5htnnt.exe213⤵PID:5092
-
\??\c:\5vppj.exec:\5vppj.exe214⤵PID:3676
-
\??\c:\xxrlxxr.exec:\xxrlxxr.exe215⤵PID:3292
-
\??\c:\9bhbnn.exec:\9bhbnn.exe216⤵PID:2032
-
\??\c:\nhnhtt.exec:\nhnhtt.exe217⤵PID:4548
-
\??\c:\9jdvj.exec:\9jdvj.exe218⤵PID:3224
-
\??\c:\rrrrlfx.exec:\rrrrlfx.exe219⤵PID:4464
-
\??\c:\frrrrrr.exec:\frrrrrr.exe220⤵PID:2384
-
\??\c:\hbtbhh.exec:\hbtbhh.exe221⤵PID:4640
-
\??\c:\ppddp.exec:\ppddp.exe222⤵PID:4076
-
\??\c:\lllffff.exec:\lllffff.exe223⤵PID:3264
-
\??\c:\xrxxrxr.exec:\xrxxrxr.exe224⤵PID:4724
-
\??\c:\hhnnhh.exec:\hhnnhh.exe225⤵PID:2276
-
\??\c:\1jjdd.exec:\1jjdd.exe226⤵PID:5004
-
\??\c:\jdvvp.exec:\jdvvp.exe227⤵PID:3444
-
\??\c:\xllffff.exec:\xllffff.exe228⤵PID:4188
-
\??\c:\bbtntt.exec:\bbtntt.exe229⤵PID:3928
-
\??\c:\hbbbtb.exec:\hbbbtb.exe230⤵PID:4288
-
\??\c:\pppdd.exec:\pppdd.exe231⤵PID:4940
-
\??\c:\rfrlrlr.exec:\rfrlrlr.exe232⤵PID:1052
-
\??\c:\fxrrrff.exec:\fxrrrff.exe233⤵PID:3988
-
\??\c:\9hbtnn.exec:\9hbtnn.exe234⤵PID:4620
-
\??\c:\hbntnt.exec:\hbntnt.exe235⤵PID:1984
-
\??\c:\jpvpj.exec:\jpvpj.exe236⤵PID:396
-
\??\c:\lfxxxfl.exec:\lfxxxfl.exe237⤵PID:2588
-
\??\c:\nthbth.exec:\nthbth.exe238⤵PID:4596
-
\??\c:\bthntn.exec:\bthntn.exe239⤵PID:5092
-
\??\c:\pdjjd.exec:\pdjjd.exe240⤵PID:4512
-
\??\c:\lffrlfr.exec:\lffrlfr.exe241⤵PID:3292
-
\??\c:\rlrlxlf.exec:\rlrlxlf.exe242⤵PID:3096