Analysis
-
max time kernel
150s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 18:57
Behavioral task
behavioral1
Sample
277747026126aa2040686ebcbe81af50_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
277747026126aa2040686ebcbe81af50_NeikiAnalytics.exe
-
Size
226KB
-
MD5
277747026126aa2040686ebcbe81af50
-
SHA1
235969ac059178186a794d48b8003a13d7b767d2
-
SHA256
437c859ab9f84224bb98c6900dec49ba3753907499e67a611db56dc1b7c10623
-
SHA512
6838d22391a463dd509a247c257dc76095840ed609d0dd737826fceae06063084064f6d45efca3574329193f1850a007b5b202b68f8941a265692ca75e17e13a
-
SSDEEP
6144:Jcm4FmowdHoS3dGmS4Z1hraHcpOaKHpaztyzl+Si:T4wFHoS3dJS4ZzeFaKHpCcy
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2876-8-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2280-6-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3028-31-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2752-30-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/948-21-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3968-18-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4792-43-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4872-53-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2000-66-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2264-72-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2964-90-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4408-88-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2092-106-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/736-111-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4580-122-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3860-130-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4404-128-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1804-138-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1996-148-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4808-154-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/5108-163-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/320-171-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1536-180-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4636-188-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3956-197-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2036-201-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1572-206-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/540-210-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4220-217-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4112-222-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3948-224-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4508-236-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2988-247-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/100-254-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2000-261-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3132-268-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4312-272-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4200-279-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2480-285-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2480-288-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1104-308-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2800-312-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2800-316-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2880-323-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4588-327-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3444-335-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2804-361-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2856-366-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1868-373-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4612-383-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1308-394-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/924-404-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4872-417-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2124-423-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3164-430-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4144-459-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4836-474-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4836-477-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1696-482-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3168-488-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4624-495-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3328-508-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/5016-543-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2752-550-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\3ttnnn.exe family_berbew C:\vpdjj.exe family_berbew \??\c:\jdppp.exe family_berbew \??\c:\lxrrffl.exe family_berbew \??\c:\3tbbhh.exe family_berbew C:\vjppp.exe family_berbew C:\dvjdj.exe family_berbew \??\c:\fxxxxff.exe family_berbew C:\jvvdd.exe family_berbew C:\tttnbb.exe family_berbew C:\1pvvd.exe family_berbew C:\jjppp.exe family_berbew \??\c:\fxlllrr.exe family_berbew C:\jpjjd.exe family_berbew \??\c:\xrllrrx.exe family_berbew \??\c:\3hnnnt.exe family_berbew C:\7vdvp.exe family_berbew C:\rlffxrr.exe family_berbew C:\hhhhtt.exe family_berbew C:\vvjpd.exe family_berbew C:\jdjjj.exe family_berbew C:\xffxxxx.exe family_berbew C:\nbbbtt.exe family_berbew \??\c:\ttbbhh.exe family_berbew \??\c:\pdjjj.exe family_berbew C:\xlxrrfl.exe family_berbew \??\c:\nnbtbb.exe family_berbew \??\c:\vjvdd.exe family_berbew \??\c:\nnnnhn.exe family_berbew C:\pjvdd.exe family_berbew C:\9fffflr.exe family_berbew C:\nhntbh.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
3ttnnn.exe3tbbhh.exevpdjj.exejdppp.exelxrrffl.exevjppp.exedvjdj.exefxxxxff.exejvvdd.exetttnbb.exe1pvvd.exejjppp.exefxlllrr.exejpjjd.exexrllrrx.exe3hnnnt.exe7vdvp.exerlffxrr.exehhhhtt.exevvjpd.exejdjjj.exexffxxxx.exenbbbtt.exettbbhh.exepdjjj.exexlxrrfl.exennbtbb.exevjvdd.exepjvdd.exennnnhn.exe9fffflr.exenhntbh.exebhnhhb.exejjddv.exerfxxrfr.exebbhhtb.exe5pvjp.exellrrrlr.exerxxrllf.exehbthbh.exevvdjj.exevvdjj.exe9xlllrx.exelllllrr.exennbbnb.exejvvpp.exevjpdv.exexflffff.exe3bhhhh.exehbtbtb.exevvdvp.exefxffrll.exettbttt.exehntnbh.exejpppp.exeffrrrxx.exehtbbhn.exe7djjd.exe7vjjp.exe9xxrrrr.exelllrrll.exebnnttt.exebbtthh.exedvjjd.exepid process 2876 3ttnnn.exe 948 3tbbhh.exe 3968 vpdjj.exe 2752 jdppp.exe 3028 lxrrffl.exe 3084 vjppp.exe 4792 dvjdj.exe 4872 fxxxxff.exe 1420 jvvdd.exe 2000 tttnbb.exe 3420 1pvvd.exe 2264 jjppp.exe 4564 fxlllrr.exe 4408 jpjjd.exe 2964 xrllrrx.exe 4244 3hnnnt.exe 4804 7vdvp.exe 2092 rlffxrr.exe 736 hhhhtt.exe 4580 vvjpd.exe 4404 jdjjj.exe 3860 xffxxxx.exe 1804 nbbbtt.exe 880 ttbbhh.exe 1996 pdjjj.exe 4808 xlxrrfl.exe 3224 nnbtbb.exe 5108 vjvdd.exe 320 pjvdd.exe 1536 nnnnhn.exe 4636 9fffflr.exe 2944 nhntbh.exe 3888 bhnhhb.exe 3956 jjddv.exe 2036 rfxxrfr.exe 1572 bbhhtb.exe 540 5pvjp.exe 4364 llrrrlr.exe 4220 rxxrllf.exe 4840 hbthbh.exe 4112 vvdjj.exe 3948 vvdjj.exe 3896 9xlllrx.exe 4572 lllllrr.exe 1036 nnbbnb.exe 4508 jvvpp.exe 2008 vjpdv.exe 3440 xflffff.exe 2988 3bhhhh.exe 1428 hbtbtb.exe 100 vvdvp.exe 5008 fxffrll.exe 2000 ttbttt.exe 4916 hntnbh.exe 3132 jpppp.exe 4312 ffrrrxx.exe 3828 htbbhn.exe 4200 7djjd.exe 624 7vjjp.exe 2480 9xxrrrr.exe 4412 lllrrll.exe 4016 bnnttt.exe 2836 bbtthh.exe 2924 dvjjd.exe -
Processes:
resource yara_rule behavioral2/memory/2280-0-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\3ttnnn.exe upx behavioral2/memory/2876-8-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/2280-6-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/948-13-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\vpdjj.exe upx \??\c:\jdppp.exe upx \??\c:\lxrrffl.exe upx behavioral2/memory/3028-31-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/2752-30-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/948-21-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/3968-18-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\3tbbhh.exe upx C:\vjppp.exe upx C:\dvjdj.exe upx behavioral2/memory/4792-43-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\fxxxxff.exe upx behavioral2/memory/4872-49-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\jvvdd.exe upx behavioral2/memory/4872-53-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\tttnbb.exe upx C:\1pvvd.exe upx behavioral2/memory/2000-66-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\jjppp.exe upx behavioral2/memory/2264-72-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\fxlllrr.exe upx C:\jpjjd.exe upx \??\c:\xrllrrx.exe upx behavioral2/memory/2964-90-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\3hnnnt.exe upx behavioral2/memory/4408-88-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\7vdvp.exe upx C:\rlffxrr.exe upx behavioral2/memory/2092-106-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\hhhhtt.exe upx behavioral2/memory/736-111-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\vvjpd.exe upx C:\jdjjj.exe upx behavioral2/memory/4580-122-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/4404-123-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\xffxxxx.exe upx behavioral2/memory/3860-130-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\nbbbtt.exe upx behavioral2/memory/4404-128-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/1804-138-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\ttbbhh.exe upx \??\c:\pdjjj.exe upx behavioral2/memory/1996-148-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\xlxrrfl.exe upx behavioral2/memory/4808-154-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\nnbtbb.exe upx \??\c:\vjvdd.exe upx behavioral2/memory/5108-163-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/320-171-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\nnnnhn.exe upx C:\pjvdd.exe upx behavioral2/memory/1536-180-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\9fffflr.exe upx behavioral2/memory/4636-188-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\nhntbh.exe upx behavioral2/memory/3956-197-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/2036-198-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/1572-202-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/2036-201-0x0000000000400000-0x0000000000435000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
277747026126aa2040686ebcbe81af50_NeikiAnalytics.exe3ttnnn.exe3tbbhh.exevpdjj.exejdppp.exelxrrffl.exevjppp.exedvjdj.exefxxxxff.exejvvdd.exetttnbb.exe1pvvd.exejjppp.exefxlllrr.exejpjjd.exexrllrrx.exe3hnnnt.exe7vdvp.exerlffxrr.exehhhhtt.exevvjpd.exejdjjj.exedescription pid process target process PID 2280 wrote to memory of 2876 2280 277747026126aa2040686ebcbe81af50_NeikiAnalytics.exe 3ttnnn.exe PID 2280 wrote to memory of 2876 2280 277747026126aa2040686ebcbe81af50_NeikiAnalytics.exe 3ttnnn.exe PID 2280 wrote to memory of 2876 2280 277747026126aa2040686ebcbe81af50_NeikiAnalytics.exe 3ttnnn.exe PID 2876 wrote to memory of 948 2876 3ttnnn.exe 3tbbhh.exe PID 2876 wrote to memory of 948 2876 3ttnnn.exe 3tbbhh.exe PID 2876 wrote to memory of 948 2876 3ttnnn.exe 3tbbhh.exe PID 948 wrote to memory of 3968 948 3tbbhh.exe vpdjj.exe PID 948 wrote to memory of 3968 948 3tbbhh.exe vpdjj.exe PID 948 wrote to memory of 3968 948 3tbbhh.exe vpdjj.exe PID 3968 wrote to memory of 2752 3968 vpdjj.exe jdppp.exe PID 3968 wrote to memory of 2752 3968 vpdjj.exe jdppp.exe PID 3968 wrote to memory of 2752 3968 vpdjj.exe jdppp.exe PID 2752 wrote to memory of 3028 2752 jdppp.exe lxrrffl.exe PID 2752 wrote to memory of 3028 2752 jdppp.exe lxrrffl.exe PID 2752 wrote to memory of 3028 2752 jdppp.exe lxrrffl.exe PID 3028 wrote to memory of 3084 3028 lxrrffl.exe vjppp.exe PID 3028 wrote to memory of 3084 3028 lxrrffl.exe vjppp.exe PID 3028 wrote to memory of 3084 3028 lxrrffl.exe vjppp.exe PID 3084 wrote to memory of 4792 3084 vjppp.exe dvjdj.exe PID 3084 wrote to memory of 4792 3084 vjppp.exe dvjdj.exe PID 3084 wrote to memory of 4792 3084 vjppp.exe dvjdj.exe PID 4792 wrote to memory of 4872 4792 dvjdj.exe fxxxxff.exe PID 4792 wrote to memory of 4872 4792 dvjdj.exe fxxxxff.exe PID 4792 wrote to memory of 4872 4792 dvjdj.exe fxxxxff.exe PID 4872 wrote to memory of 1420 4872 fxxxxff.exe jvvdd.exe PID 4872 wrote to memory of 1420 4872 fxxxxff.exe jvvdd.exe PID 4872 wrote to memory of 1420 4872 fxxxxff.exe jvvdd.exe PID 1420 wrote to memory of 2000 1420 jvvdd.exe tttnbb.exe PID 1420 wrote to memory of 2000 1420 jvvdd.exe tttnbb.exe PID 1420 wrote to memory of 2000 1420 jvvdd.exe tttnbb.exe PID 2000 wrote to memory of 3420 2000 tttnbb.exe 1pvvd.exe PID 2000 wrote to memory of 3420 2000 tttnbb.exe 1pvvd.exe PID 2000 wrote to memory of 3420 2000 tttnbb.exe 1pvvd.exe PID 3420 wrote to memory of 2264 3420 1pvvd.exe jjppp.exe PID 3420 wrote to memory of 2264 3420 1pvvd.exe jjppp.exe PID 3420 wrote to memory of 2264 3420 1pvvd.exe jjppp.exe PID 2264 wrote to memory of 4564 2264 jjppp.exe fxlllrr.exe PID 2264 wrote to memory of 4564 2264 jjppp.exe fxlllrr.exe PID 2264 wrote to memory of 4564 2264 jjppp.exe fxlllrr.exe PID 4564 wrote to memory of 4408 4564 fxlllrr.exe jpjjd.exe PID 4564 wrote to memory of 4408 4564 fxlllrr.exe jpjjd.exe PID 4564 wrote to memory of 4408 4564 fxlllrr.exe jpjjd.exe PID 4408 wrote to memory of 2964 4408 jpjjd.exe xrllrrx.exe PID 4408 wrote to memory of 2964 4408 jpjjd.exe xrllrrx.exe PID 4408 wrote to memory of 2964 4408 jpjjd.exe xrllrrx.exe PID 2964 wrote to memory of 4244 2964 xrllrrx.exe 3hnnnt.exe PID 2964 wrote to memory of 4244 2964 xrllrrx.exe 3hnnnt.exe PID 2964 wrote to memory of 4244 2964 xrllrrx.exe 3hnnnt.exe PID 4244 wrote to memory of 4804 4244 3hnnnt.exe 7vdvp.exe PID 4244 wrote to memory of 4804 4244 3hnnnt.exe 7vdvp.exe PID 4244 wrote to memory of 4804 4244 3hnnnt.exe 7vdvp.exe PID 4804 wrote to memory of 2092 4804 7vdvp.exe rlffxrr.exe PID 4804 wrote to memory of 2092 4804 7vdvp.exe rlffxrr.exe PID 4804 wrote to memory of 2092 4804 7vdvp.exe rlffxrr.exe PID 2092 wrote to memory of 736 2092 rlffxrr.exe hhhhtt.exe PID 2092 wrote to memory of 736 2092 rlffxrr.exe hhhhtt.exe PID 2092 wrote to memory of 736 2092 rlffxrr.exe hhhhtt.exe PID 736 wrote to memory of 4580 736 hhhhtt.exe vvjpd.exe PID 736 wrote to memory of 4580 736 hhhhtt.exe vvjpd.exe PID 736 wrote to memory of 4580 736 hhhhtt.exe vvjpd.exe PID 4580 wrote to memory of 4404 4580 vvjpd.exe jdjjj.exe PID 4580 wrote to memory of 4404 4580 vvjpd.exe jdjjj.exe PID 4580 wrote to memory of 4404 4580 vvjpd.exe jdjjj.exe PID 4404 wrote to memory of 3860 4404 jdjjj.exe xffxxxx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\277747026126aa2040686ebcbe81af50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\277747026126aa2040686ebcbe81af50_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\3ttnnn.exec:\3ttnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3tbbhh.exec:\3tbbhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpdjj.exec:\vpdjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdppp.exec:\jdppp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxrrffl.exec:\lxrrffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjppp.exec:\vjppp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvjdj.exec:\dvjdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxxxxff.exec:\fxxxxff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvvdd.exec:\jvvdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tttnbb.exec:\tttnbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1pvvd.exec:\1pvvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjppp.exec:\jjppp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxlllrr.exec:\fxlllrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpjjd.exec:\jpjjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrllrrx.exec:\xrllrrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3hnnnt.exec:\3hnnnt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7vdvp.exec:\7vdvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlffxrr.exec:\rlffxrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhhhtt.exec:\hhhhtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvjpd.exec:\vvjpd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdjjj.exec:\jdjjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xffxxxx.exec:\xffxxxx.exe23⤵
- Executes dropped EXE
-
\??\c:\nbbbtt.exec:\nbbbtt.exe24⤵
- Executes dropped EXE
-
\??\c:\ttbbhh.exec:\ttbbhh.exe25⤵
- Executes dropped EXE
-
\??\c:\pdjjj.exec:\pdjjj.exe26⤵
- Executes dropped EXE
-
\??\c:\xlxrrfl.exec:\xlxrrfl.exe27⤵
- Executes dropped EXE
-
\??\c:\nnbtbb.exec:\nnbtbb.exe28⤵
- Executes dropped EXE
-
\??\c:\vjvdd.exec:\vjvdd.exe29⤵
- Executes dropped EXE
-
\??\c:\pjvdd.exec:\pjvdd.exe30⤵
- Executes dropped EXE
-
\??\c:\nnnnhn.exec:\nnnnhn.exe31⤵
- Executes dropped EXE
-
\??\c:\9fffflr.exec:\9fffflr.exe32⤵
- Executes dropped EXE
-
\??\c:\nhntbh.exec:\nhntbh.exe33⤵
- Executes dropped EXE
-
\??\c:\bhnhhb.exec:\bhnhhb.exe34⤵
- Executes dropped EXE
-
\??\c:\jjddv.exec:\jjddv.exe35⤵
- Executes dropped EXE
-
\??\c:\rfxxrfr.exec:\rfxxrfr.exe36⤵
- Executes dropped EXE
-
\??\c:\bbhhtb.exec:\bbhhtb.exe37⤵
- Executes dropped EXE
-
\??\c:\5pvjp.exec:\5pvjp.exe38⤵
- Executes dropped EXE
-
\??\c:\llrrrlr.exec:\llrrrlr.exe39⤵
- Executes dropped EXE
-
\??\c:\rxxrllf.exec:\rxxrllf.exe40⤵
- Executes dropped EXE
-
\??\c:\hbthbh.exec:\hbthbh.exe41⤵
- Executes dropped EXE
-
\??\c:\vvdjj.exec:\vvdjj.exe42⤵
- Executes dropped EXE
-
\??\c:\vvdjj.exec:\vvdjj.exe43⤵
- Executes dropped EXE
-
\??\c:\9xlllrx.exec:\9xlllrx.exe44⤵
- Executes dropped EXE
-
\??\c:\lllllrr.exec:\lllllrr.exe45⤵
- Executes dropped EXE
-
\??\c:\nnbbnb.exec:\nnbbnb.exe46⤵
- Executes dropped EXE
-
\??\c:\jvvpp.exec:\jvvpp.exe47⤵
- Executes dropped EXE
-
\??\c:\vjpdv.exec:\vjpdv.exe48⤵
- Executes dropped EXE
-
\??\c:\xflffff.exec:\xflffff.exe49⤵
- Executes dropped EXE
-
\??\c:\3bhhhh.exec:\3bhhhh.exe50⤵
- Executes dropped EXE
-
\??\c:\hbtbtb.exec:\hbtbtb.exe51⤵
- Executes dropped EXE
-
\??\c:\vvdvp.exec:\vvdvp.exe52⤵
- Executes dropped EXE
-
\??\c:\fxffrll.exec:\fxffrll.exe53⤵
- Executes dropped EXE
-
\??\c:\ttbttt.exec:\ttbttt.exe54⤵
- Executes dropped EXE
-
\??\c:\hntnbh.exec:\hntnbh.exe55⤵
- Executes dropped EXE
-
\??\c:\jpppp.exec:\jpppp.exe56⤵
- Executes dropped EXE
-
\??\c:\ffrrrxx.exec:\ffrrrxx.exe57⤵
- Executes dropped EXE
-
\??\c:\htbbhn.exec:\htbbhn.exe58⤵
- Executes dropped EXE
-
\??\c:\7djjd.exec:\7djjd.exe59⤵
- Executes dropped EXE
-
\??\c:\7vjjp.exec:\7vjjp.exe60⤵
- Executes dropped EXE
-
\??\c:\9xxrrrr.exec:\9xxrrrr.exe61⤵
- Executes dropped EXE
-
\??\c:\lllrrll.exec:\lllrrll.exe62⤵
- Executes dropped EXE
-
\??\c:\bnnttt.exec:\bnnttt.exe63⤵
- Executes dropped EXE
-
\??\c:\bbtthh.exec:\bbtthh.exe64⤵
- Executes dropped EXE
-
\??\c:\dvjjd.exec:\dvjjd.exe65⤵
- Executes dropped EXE
-
\??\c:\fxxrffx.exec:\fxxrffx.exe66⤵
-
\??\c:\rxxrlfx.exec:\rxxrlfx.exe67⤵
-
\??\c:\bbbtnh.exec:\bbbtnh.exe68⤵
-
\??\c:\djvvd.exec:\djvvd.exe69⤵
-
\??\c:\llllxrl.exec:\llllxrl.exe70⤵
-
\??\c:\3fxflrr.exec:\3fxflrr.exe71⤵
-
\??\c:\3hbttb.exec:\3hbttb.exe72⤵
-
\??\c:\1dvvj.exec:\1dvvj.exe73⤵
-
\??\c:\5frxrfx.exec:\5frxrfx.exe74⤵
-
\??\c:\5xxrlrl.exec:\5xxrlrl.exe75⤵
-
\??\c:\nnnnhh.exec:\nnnnhh.exe76⤵
-
\??\c:\jjvpj.exec:\jjvpj.exe77⤵
-
\??\c:\7ffxrlx.exec:\7ffxrlx.exe78⤵
-
\??\c:\rxffxxx.exec:\rxffxxx.exe79⤵
-
\??\c:\7tbbbh.exec:\7tbbbh.exe80⤵
-
\??\c:\dvppj.exec:\dvppj.exe81⤵
-
\??\c:\fffxxxf.exec:\fffxxxf.exe82⤵
-
\??\c:\btbbbb.exec:\btbbbb.exe83⤵
-
\??\c:\7bbthb.exec:\7bbthb.exe84⤵
-
\??\c:\jddvj.exec:\jddvj.exe85⤵
-
\??\c:\xflfrrr.exec:\xflfrrr.exe86⤵
-
\??\c:\lrfffff.exec:\lrfffff.exe87⤵
-
\??\c:\ttttnh.exec:\ttttnh.exe88⤵
-
\??\c:\frxfrrl.exec:\frxfrrl.exe89⤵
-
\??\c:\lflffff.exec:\lflffff.exe90⤵
-
\??\c:\tbnnhh.exec:\tbnnhh.exe91⤵
-
\??\c:\ddjjj.exec:\ddjjj.exe92⤵
-
\??\c:\1jpjv.exec:\1jpjv.exe93⤵
-
\??\c:\llfxllf.exec:\llfxllf.exe94⤵
-
\??\c:\rfrfrrr.exec:\rfrfrrr.exe95⤵
-
\??\c:\btbttn.exec:\btbttn.exe96⤵
-
\??\c:\ppvpj.exec:\ppvpj.exe97⤵
-
\??\c:\dvvvp.exec:\dvvvp.exe98⤵
-
\??\c:\7hhtnn.exec:\7hhtnn.exe99⤵
-
\??\c:\nhtnnn.exec:\nhtnnn.exe100⤵
-
\??\c:\3jdpj.exec:\3jdpj.exe101⤵
-
\??\c:\xrfxrrr.exec:\xrfxrrr.exe102⤵
-
\??\c:\xrrxrrr.exec:\xrrxrrr.exe103⤵
-
\??\c:\bhtnnn.exec:\bhtnnn.exe104⤵
-
\??\c:\vvvpd.exec:\vvvpd.exe105⤵
-
\??\c:\djddd.exec:\djddd.exe106⤵
-
\??\c:\9ffxxrr.exec:\9ffxxrr.exe107⤵
-
\??\c:\xrlrrrl.exec:\xrlrrrl.exe108⤵
-
\??\c:\3hnhtt.exec:\3hnhtt.exe109⤵
-
\??\c:\vjpjd.exec:\vjpjd.exe110⤵
-
\??\c:\vddvd.exec:\vddvd.exe111⤵
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe112⤵
-
\??\c:\hnttnb.exec:\hnttnb.exe113⤵
-
\??\c:\nhthbt.exec:\nhthbt.exe114⤵
-
\??\c:\dvpjj.exec:\dvpjj.exe115⤵
-
\??\c:\rxrxlfl.exec:\rxrxlfl.exe116⤵
-
\??\c:\rlfffff.exec:\rlfffff.exe117⤵
-
\??\c:\7nhhhb.exec:\7nhhhb.exe118⤵
-
\??\c:\htbtbb.exec:\htbtbb.exe119⤵
-
\??\c:\ppvpv.exec:\ppvpv.exe120⤵
-
\??\c:\rlfxffx.exec:\rlfxffx.exe121⤵
-
\??\c:\rlllflf.exec:\rlllflf.exe122⤵
-
\??\c:\5tttnh.exec:\5tttnh.exe123⤵
-
\??\c:\5dvpj.exec:\5dvpj.exe124⤵
-
\??\c:\3xfxrll.exec:\3xfxrll.exe125⤵
-
\??\c:\lfxrrrl.exec:\lfxrrrl.exe126⤵
-
\??\c:\bnhttb.exec:\bnhttb.exe127⤵
-
\??\c:\vpjjd.exec:\vpjjd.exe128⤵
-
\??\c:\jdjdj.exec:\jdjdj.exe129⤵
-
\??\c:\rffxrrl.exec:\rffxrrl.exe130⤵
-
\??\c:\frffrxl.exec:\frffrxl.exe131⤵
-
\??\c:\bhhhnn.exec:\bhhhnn.exe132⤵
-
\??\c:\5ddvp.exec:\5ddvp.exe133⤵
-
\??\c:\pppjd.exec:\pppjd.exe134⤵
-
\??\c:\rxxxxxx.exec:\rxxxxxx.exe135⤵
-
\??\c:\3rxxxxx.exec:\3rxxxxx.exe136⤵
-
\??\c:\nbtttt.exec:\nbtttt.exe137⤵
-
\??\c:\dvjvp.exec:\dvjvp.exe138⤵
-
\??\c:\jdjdv.exec:\jdjdv.exe139⤵
-
\??\c:\nhhbnn.exec:\nhhbnn.exe140⤵
-
\??\c:\7jdvp.exec:\7jdvp.exe141⤵
-
\??\c:\rrrffrl.exec:\rrrffrl.exe142⤵
-
\??\c:\xrlflxf.exec:\xrlflxf.exe143⤵
-
\??\c:\tnnhtn.exec:\tnnhtn.exe144⤵
-
\??\c:\pdddd.exec:\pdddd.exe145⤵
-
\??\c:\pdjvp.exec:\pdjvp.exe146⤵
-
\??\c:\lffxrxr.exec:\lffxrxr.exe147⤵
-
\??\c:\xxxxrrr.exec:\xxxxrrr.exe148⤵
-
\??\c:\nhhbtn.exec:\nhhbtn.exe149⤵
-
\??\c:\ddddd.exec:\ddddd.exe150⤵
-
\??\c:\pjdvp.exec:\pjdvp.exe151⤵
-
\??\c:\lxfxllr.exec:\lxfxllr.exe152⤵
-
\??\c:\fffffrr.exec:\fffffrr.exe153⤵
-
\??\c:\nhbbbb.exec:\nhbbbb.exe154⤵
-
\??\c:\7djjd.exec:\7djjd.exe155⤵
-
\??\c:\9vvvp.exec:\9vvvp.exe156⤵
-
\??\c:\3fxrrrr.exec:\3fxrrrr.exe157⤵
-
\??\c:\9flllrr.exec:\9flllrr.exe158⤵
-
\??\c:\5nhbbb.exec:\5nhbbb.exe159⤵
-
\??\c:\bnhbbh.exec:\bnhbbh.exe160⤵
-
\??\c:\pjpjj.exec:\pjpjj.exe161⤵
-
\??\c:\lxxlfxr.exec:\lxxlfxr.exe162⤵
-
\??\c:\fxfxrrx.exec:\fxfxrrx.exe163⤵
-
\??\c:\bthhbh.exec:\bthhbh.exe164⤵
-
\??\c:\7vpjd.exec:\7vpjd.exe165⤵
-
\??\c:\lrxxxlr.exec:\lrxxxlr.exe166⤵
-
\??\c:\fxxrfrl.exec:\fxxrfrl.exe167⤵
-
\??\c:\hbttnn.exec:\hbttnn.exe168⤵
-
\??\c:\ppvvp.exec:\ppvvp.exe169⤵
-
\??\c:\ffrxlxr.exec:\ffrxlxr.exe170⤵
-
\??\c:\hnthtb.exec:\hnthtb.exe171⤵
-
\??\c:\jvdjd.exec:\jvdjd.exe172⤵
-
\??\c:\httnnn.exec:\httnnn.exe173⤵
-
\??\c:\bnnhnh.exec:\bnnhnh.exe174⤵
-
\??\c:\pvdvd.exec:\pvdvd.exe175⤵
-
\??\c:\flrlxxx.exec:\flrlxxx.exe176⤵
-
\??\c:\bhhbtt.exec:\bhhbtt.exe177⤵
-
\??\c:\vpjdv.exec:\vpjdv.exe178⤵
-
\??\c:\rllrxxf.exec:\rllrxxf.exe179⤵
-
\??\c:\fxxxrrf.exec:\fxxxrrf.exe180⤵
-
\??\c:\llxlrfl.exec:\llxlrfl.exe181⤵
-
\??\c:\rfxxfrl.exec:\rfxxfrl.exe182⤵
-
\??\c:\jpddd.exec:\jpddd.exe183⤵
-
\??\c:\nthbbb.exec:\nthbbb.exe184⤵
-
\??\c:\pppjj.exec:\pppjj.exe185⤵
-
\??\c:\5djvp.exec:\5djvp.exe186⤵
-
\??\c:\dpddd.exec:\dpddd.exe187⤵
-
\??\c:\xlrrxxf.exec:\xlrrxxf.exe188⤵
-
\??\c:\lfrrrxx.exec:\lfrrrxx.exe189⤵
-
\??\c:\hhbhnh.exec:\hhbhnh.exe190⤵
-
\??\c:\djvvv.exec:\djvvv.exe191⤵
-
\??\c:\vjvdd.exec:\vjvdd.exe192⤵
-
\??\c:\ffrrflr.exec:\ffrrflr.exe193⤵
-
\??\c:\tnttnt.exec:\tnttnt.exe194⤵
-
\??\c:\nhnhbh.exec:\nhnhbh.exe195⤵
-
\??\c:\jjvvp.exec:\jjvvp.exe196⤵
-
\??\c:\ffxxffl.exec:\ffxxffl.exe197⤵
-
\??\c:\xrxxlxl.exec:\xrxxlxl.exe198⤵
-
\??\c:\9hhhnt.exec:\9hhhnt.exe199⤵
-
\??\c:\bthhhn.exec:\bthhhn.exe200⤵
-
\??\c:\jdpjv.exec:\jdpjv.exe201⤵
-
\??\c:\5djpp.exec:\5djpp.exe202⤵
-
\??\c:\lfxxrxx.exec:\lfxxrxx.exe203⤵
-
\??\c:\xxffflx.exec:\xxffflx.exe204⤵
-
\??\c:\1hnnnn.exec:\1hnnnn.exe205⤵
-
\??\c:\jjjjj.exec:\jjjjj.exe206⤵
-
\??\c:\5vpvv.exec:\5vpvv.exe207⤵
-
\??\c:\5rxxrrr.exec:\5rxxrrr.exe208⤵
-
\??\c:\1fllfff.exec:\1fllfff.exe209⤵
-
\??\c:\hbhhhh.exec:\hbhhhh.exe210⤵
-
\??\c:\btnnbb.exec:\btnnbb.exe211⤵
-
\??\c:\pvvpp.exec:\pvvpp.exe212⤵
-
\??\c:\lrxxxll.exec:\lrxxxll.exe213⤵
-
\??\c:\frfxxxr.exec:\frfxxxr.exe214⤵
-
\??\c:\nntbth.exec:\nntbth.exe215⤵
-
\??\c:\5hntnn.exec:\5hntnn.exe216⤵
-
\??\c:\jvvvv.exec:\jvvvv.exe217⤵
-
\??\c:\7xrrfll.exec:\7xrrfll.exe218⤵
-
\??\c:\lfrrrxx.exec:\lfrrrxx.exe219⤵
-
\??\c:\3tthnb.exec:\3tthnb.exe220⤵
-
\??\c:\tthhtb.exec:\tthhtb.exe221⤵
-
\??\c:\jpdjd.exec:\jpdjd.exe222⤵
-
\??\c:\lrxxffx.exec:\lrxxffx.exe223⤵
-
\??\c:\rlrrrll.exec:\rlrrrll.exe224⤵
-
\??\c:\btnhnt.exec:\btnhnt.exe225⤵
-
\??\c:\vpvvp.exec:\vpvvp.exe226⤵
-
\??\c:\vdvdd.exec:\vdvdd.exe227⤵
-
\??\c:\lllfrrf.exec:\lllfrrf.exe228⤵
-
\??\c:\fflllrr.exec:\fflllrr.exe229⤵
-
\??\c:\bthhbn.exec:\bthhbn.exe230⤵
-
\??\c:\djvdd.exec:\djvdd.exe231⤵
-
\??\c:\7dddp.exec:\7dddp.exe232⤵
-
\??\c:\rlllllf.exec:\rlllllf.exe233⤵
-
\??\c:\hnbbbb.exec:\hnbbbb.exe234⤵
-
\??\c:\hnhhbh.exec:\hnhhbh.exe235⤵
-
\??\c:\vvdvp.exec:\vvdvp.exe236⤵
-
\??\c:\1pdpv.exec:\1pdpv.exe237⤵
-
\??\c:\9rlllrf.exec:\9rlllrf.exe238⤵
-
\??\c:\lrxxxff.exec:\lrxxxff.exe239⤵
-
\??\c:\hbnnnt.exec:\hbnnnt.exe240⤵
-
\??\c:\1jppv.exec:\1jppv.exe241⤵