Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 00:04
Behavioral task
behavioral1
Sample
3b89fa2cd7351407a954e69a19f0e590_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
3b89fa2cd7351407a954e69a19f0e590_NeikiAnalytics.exe
-
Size
191KB
-
MD5
3b89fa2cd7351407a954e69a19f0e590
-
SHA1
47916d3dede84acbe382a976910220f6fbced990
-
SHA256
1a7e5ef9f066e9e4ea3fdbec8860ce46acd7177776449d40444fec881503c678
-
SHA512
7c3f9ac4f98fab9b9cbb1df359879425c58693200f4636ba4897db554ec5c3cfffd73847733fdbb51e0746698a232bcc4775d963f316bfeeedd81bfc86f67482
-
SSDEEP
3072:FhOmTsF93UYfwC6GIoutrVCfMoh52waAyiJ8mqtbfUVKty16hDsI/tSaX:Fcm4FmowdHoS8fMoSVAHubPtyYxfPX
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2284-1-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/452-7-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1596-12-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3076-20-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3152-31-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4728-60-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/388-256-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2864-261-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2404-243-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4520-273-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/320-264-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/436-236-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4912-226-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3168-212-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1308-209-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2732-198-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/468-180-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4348-174-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3132-168-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3868-163-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4152-141-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4280-136-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2928-130-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4140-124-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/640-113-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1736-107-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1432-97-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3344-90-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3492-79-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3252-72-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2684-59-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1120-58-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4104-38-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3348-30-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1596-18-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2952-287-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2780-291-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/892-304-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1260-312-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3300-316-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2832-338-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1640-355-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2696-369-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1380-405-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4568-407-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3328-442-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3468-465-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2152-473-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1524-498-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3340-506-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/812-522-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2244-550-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4040-554-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4768-567-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4012-569-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/320-594-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4480-601-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1068-618-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4948-627-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1092-692-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/452-710-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1192-746-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2232-892-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3540-1201-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule \??\c:\vvpdv.exe family_berbew C:\rflxxff.exe family_berbew C:\btnhbt.exe family_berbew \??\c:\dvdvv.exe family_berbew \??\c:\xxxxxrx.exe family_berbew \??\c:\rlflrrx.exe family_berbew C:\jjdvp.exe family_berbew C:\xxxrrxr.exe family_berbew \??\c:\nnbthn.exe family_berbew C:\djvvj.exe family_berbew \??\c:\xxxffxf.exe family_berbew \??\c:\bhbhhh.exe family_berbew \??\c:\pdppv.exe family_berbew \??\c:\pppjp.exe family_berbew \??\c:\hbtbbb.exe family_berbew \??\c:\3tbhhn.exe family_berbew \??\c:\xlxfflr.exe family_berbew \??\c:\jpdvd.exe family_berbew \??\c:\7bhntn.exe family_berbew \??\c:\btbbbh.exe family_berbew \??\c:\frrrlxr.exe family_berbew \??\c:\5vppp.exe family_berbew \??\c:\bnntnt.exe family_berbew \??\c:\bbhbht.exe family_berbew \??\c:\lllxrxx.exe family_berbew \??\c:\jpdvp.exe family_berbew \??\c:\djppv.exe family_berbew \??\c:\rxlrxll.exe family_berbew \??\c:\nthnnb.exe family_berbew \??\c:\rxllrxl.exe family_berbew \??\c:\vvddd.exe family_berbew \??\c:\tbnhbt.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
vvpdv.exerflxxff.exebtnhbt.exedvdvv.exexxxxxrx.exerlflrrx.exetbnhbt.exejjdvp.exevvddd.exexxxrrxr.exerxllrxl.exennbthn.exenthnnb.exedjvvj.exexxxffxf.exerxlrxll.exebhbhhh.exedjppv.exejpdvp.exelllxrxx.exebbhbht.exebnntnt.exe5vppp.exepdppv.exefrrrlxr.exebtbbbh.exe7bhntn.exepppjp.exejpdvd.exexlxfflr.exe3tbhhn.exehbtbbb.exepvddd.exejvjpp.exeflfxxxx.exehhhhnt.exehhtbtb.exeppdvv.exedjvvj.exerfrxxff.exexffllrr.exe1hnttt.exe5tnbtb.exe7dpdv.exe3ddjd.exexfffffl.exexrxxxxx.exehnbhnt.exevvdvj.exevdpvv.exe7rrlffx.exethnnnn.exehnbbbh.exevdjdv.exerxxfllr.exelxlffll.exehhnhbb.exevvddd.exepvjdj.exehbntht.exetthbbb.exevdjvd.exelrxffxx.exebnbbbh.exepid process 452 vvpdv.exe 1596 rflxxff.exe 3076 btnhbt.exe 3348 dvdvv.exe 3152 xxxxxrx.exe 4104 rlflrrx.exe 3872 tbnhbt.exe 1120 jjdvp.exe 2684 vvddd.exe 4728 xxxrrxr.exe 3252 rxllrxl.exe 3492 nnbthn.exe 2104 nthnnb.exe 3344 djvvj.exe 1432 xxxffxf.exe 1848 rxlrxll.exe 1736 bhbhhh.exe 640 djppv.exe 1260 jpdvp.exe 4140 lllxrxx.exe 2928 bbhbht.exe 4280 bnntnt.exe 4152 5vppp.exe 4376 pdppv.exe 2116 frrrlxr.exe 4852 btbbbh.exe 3868 7bhntn.exe 3132 pppjp.exe 4348 jpdvd.exe 468 xlxfflr.exe 1044 3tbhhn.exe 3984 hbtbbb.exe 2948 pvddd.exe 1604 jvjpp.exe 2732 flfxxxx.exe 4004 hhhhnt.exe 448 hhtbtb.exe 1308 ppdvv.exe 3168 djvvj.exe 3572 rfrxxff.exe 3308 xffllrr.exe 3576 1hnttt.exe 4912 5tnbtb.exe 3888 7dpdv.exe 1616 3ddjd.exe 436 xfffffl.exe 3544 xrxxxxx.exe 2404 hnbhnt.exe 4524 vvdvj.exe 3312 vdpvv.exe 2312 7rrlffx.exe 388 thnnnn.exe 2864 hnbbbh.exe 3004 vdjdv.exe 636 rxxfllr.exe 320 lxlffll.exe 4520 hhnhbb.exe 3040 vvddd.exe 3152 pvjdj.exe 4572 hbntht.exe 2952 tthbbb.exe 2780 vdjvd.exe 3256 lrxffxx.exe 2232 bnbbbh.exe -
Processes:
resource yara_rule behavioral2/memory/2284-1-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\vvpdv.exe upx behavioral2/memory/452-7-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\rflxxff.exe upx behavioral2/memory/1596-12-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\btnhbt.exe upx behavioral2/memory/3076-20-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\dvdvv.exe upx \??\c:\xxxxxrx.exe upx behavioral2/memory/3152-31-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\rlflrrx.exe upx C:\jjdvp.exe upx C:\xxxrrxr.exe upx behavioral2/memory/4728-60-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\nnbthn.exe upx C:\djvvj.exe upx \??\c:\xxxffxf.exe upx \??\c:\bhbhhh.exe upx \??\c:\pdppv.exe upx \??\c:\pppjp.exe upx behavioral2/memory/388-256-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2864-261-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2404-243-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4520-270-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4520-273-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/320-264-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/436-236-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4912-226-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3168-212-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1308-209-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2732-198-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\hbtbbb.exe upx behavioral2/memory/468-180-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\3tbhhn.exe upx behavioral2/memory/4348-174-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\xlxfflr.exe upx behavioral2/memory/3132-168-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\jpdvd.exe upx behavioral2/memory/3868-163-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\7bhntn.exe upx \??\c:\btbbbh.exe upx \??\c:\frrrlxr.exe upx behavioral2/memory/4152-141-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4280-136-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\5vppp.exe upx behavioral2/memory/2928-130-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\bnntnt.exe upx behavioral2/memory/4140-124-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\bbhbht.exe upx \??\c:\lllxrxx.exe upx behavioral2/memory/640-113-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\jpdvp.exe upx behavioral2/memory/1736-107-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\djppv.exe upx behavioral2/memory/1432-97-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\rxlrxll.exe upx behavioral2/memory/3344-90-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4572-280-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3492-79-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\nthnnb.exe upx behavioral2/memory/3252-72-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\rxllrxl.exe upx behavioral2/memory/2684-59-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1120-58-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3b89fa2cd7351407a954e69a19f0e590_NeikiAnalytics.exevvpdv.exerflxxff.exebtnhbt.exedvdvv.exexxxxxrx.exerlflrrx.exetbnhbt.exejjdvp.exevvddd.exexxxrrxr.exerxllrxl.exennbthn.exenthnnb.exedjvvj.exexxxffxf.exerxlrxll.exebhbhhh.exedjppv.exejpdvp.exelllxrxx.exebbhbht.exedescription pid process target process PID 2284 wrote to memory of 452 2284 3b89fa2cd7351407a954e69a19f0e590_NeikiAnalytics.exe vvpdv.exe PID 2284 wrote to memory of 452 2284 3b89fa2cd7351407a954e69a19f0e590_NeikiAnalytics.exe vvpdv.exe PID 2284 wrote to memory of 452 2284 3b89fa2cd7351407a954e69a19f0e590_NeikiAnalytics.exe vvpdv.exe PID 452 wrote to memory of 1596 452 vvpdv.exe rflxxff.exe PID 452 wrote to memory of 1596 452 vvpdv.exe rflxxff.exe PID 452 wrote to memory of 1596 452 vvpdv.exe rflxxff.exe PID 1596 wrote to memory of 3076 1596 rflxxff.exe btnhbt.exe PID 1596 wrote to memory of 3076 1596 rflxxff.exe btnhbt.exe PID 1596 wrote to memory of 3076 1596 rflxxff.exe btnhbt.exe PID 3076 wrote to memory of 3348 3076 btnhbt.exe dvdvv.exe PID 3076 wrote to memory of 3348 3076 btnhbt.exe dvdvv.exe PID 3076 wrote to memory of 3348 3076 btnhbt.exe dvdvv.exe PID 3348 wrote to memory of 3152 3348 dvdvv.exe xxxxxrx.exe PID 3348 wrote to memory of 3152 3348 dvdvv.exe xxxxxrx.exe PID 3348 wrote to memory of 3152 3348 dvdvv.exe xxxxxrx.exe PID 3152 wrote to memory of 4104 3152 xxxxxrx.exe rlflrrx.exe PID 3152 wrote to memory of 4104 3152 xxxxxrx.exe rlflrrx.exe PID 3152 wrote to memory of 4104 3152 xxxxxrx.exe rlflrrx.exe PID 4104 wrote to memory of 3872 4104 rlflrrx.exe tbnhbt.exe PID 4104 wrote to memory of 3872 4104 rlflrrx.exe tbnhbt.exe PID 4104 wrote to memory of 3872 4104 rlflrrx.exe tbnhbt.exe PID 3872 wrote to memory of 1120 3872 tbnhbt.exe jjdvp.exe PID 3872 wrote to memory of 1120 3872 tbnhbt.exe jjdvp.exe PID 3872 wrote to memory of 1120 3872 tbnhbt.exe jjdvp.exe PID 1120 wrote to memory of 2684 1120 jjdvp.exe vvddd.exe PID 1120 wrote to memory of 2684 1120 jjdvp.exe vvddd.exe PID 1120 wrote to memory of 2684 1120 jjdvp.exe vvddd.exe PID 2684 wrote to memory of 4728 2684 vvddd.exe xxxrrxr.exe PID 2684 wrote to memory of 4728 2684 vvddd.exe xxxrrxr.exe PID 2684 wrote to memory of 4728 2684 vvddd.exe xxxrrxr.exe PID 4728 wrote to memory of 3252 4728 xxxrrxr.exe rxllrxl.exe PID 4728 wrote to memory of 3252 4728 xxxrrxr.exe rxllrxl.exe PID 4728 wrote to memory of 3252 4728 xxxrrxr.exe rxllrxl.exe PID 3252 wrote to memory of 3492 3252 rxllrxl.exe nnbthn.exe PID 3252 wrote to memory of 3492 3252 rxllrxl.exe nnbthn.exe PID 3252 wrote to memory of 3492 3252 rxllrxl.exe nnbthn.exe PID 3492 wrote to memory of 2104 3492 nnbthn.exe nthnnb.exe PID 3492 wrote to memory of 2104 3492 nnbthn.exe nthnnb.exe PID 3492 wrote to memory of 2104 3492 nnbthn.exe nthnnb.exe PID 2104 wrote to memory of 3344 2104 nthnnb.exe djvvj.exe PID 2104 wrote to memory of 3344 2104 nthnnb.exe djvvj.exe PID 2104 wrote to memory of 3344 2104 nthnnb.exe djvvj.exe PID 3344 wrote to memory of 1432 3344 djvvj.exe xxxffxf.exe PID 3344 wrote to memory of 1432 3344 djvvj.exe xxxffxf.exe PID 3344 wrote to memory of 1432 3344 djvvj.exe xxxffxf.exe PID 1432 wrote to memory of 1848 1432 xxxffxf.exe rxlrxll.exe PID 1432 wrote to memory of 1848 1432 xxxffxf.exe rxlrxll.exe PID 1432 wrote to memory of 1848 1432 xxxffxf.exe rxlrxll.exe PID 1848 wrote to memory of 1736 1848 rxlrxll.exe bhbhhh.exe PID 1848 wrote to memory of 1736 1848 rxlrxll.exe bhbhhh.exe PID 1848 wrote to memory of 1736 1848 rxlrxll.exe bhbhhh.exe PID 1736 wrote to memory of 640 1736 bhbhhh.exe djppv.exe PID 1736 wrote to memory of 640 1736 bhbhhh.exe djppv.exe PID 1736 wrote to memory of 640 1736 bhbhhh.exe djppv.exe PID 640 wrote to memory of 1260 640 djppv.exe dddvp.exe PID 640 wrote to memory of 1260 640 djppv.exe dddvp.exe PID 640 wrote to memory of 1260 640 djppv.exe dddvp.exe PID 1260 wrote to memory of 4140 1260 jpdvp.exe lllxrxx.exe PID 1260 wrote to memory of 4140 1260 jpdvp.exe lllxrxx.exe PID 1260 wrote to memory of 4140 1260 jpdvp.exe lllxrxx.exe PID 4140 wrote to memory of 2928 4140 lllxrxx.exe bbhbht.exe PID 4140 wrote to memory of 2928 4140 lllxrxx.exe bbhbht.exe PID 4140 wrote to memory of 2928 4140 lllxrxx.exe bbhbht.exe PID 2928 wrote to memory of 4280 2928 bbhbht.exe bnntnt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b89fa2cd7351407a954e69a19f0e590_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3b89fa2cd7351407a954e69a19f0e590_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\vvpdv.exec:\vvpdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rflxxff.exec:\rflxxff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btnhbt.exec:\btnhbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvdvv.exec:\dvdvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxxxxrx.exec:\xxxxxrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlflrrx.exec:\rlflrrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tbnhbt.exec:\tbnhbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjdvp.exec:\jjdvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvddd.exec:\vvddd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxxrrxr.exec:\xxxrrxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rxllrxl.exec:\rxllrxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnbthn.exec:\nnbthn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nthnnb.exec:\nthnnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\djvvj.exec:\djvvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxxffxf.exec:\xxxffxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rxlrxll.exec:\rxlrxll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhbhhh.exec:\bhbhhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\djppv.exec:\djppv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpdvp.exec:\jpdvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lllxrxx.exec:\lllxrxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbhbht.exec:\bbhbht.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnntnt.exec:\bnntnt.exe23⤵
- Executes dropped EXE
-
\??\c:\5vppp.exec:\5vppp.exe24⤵
- Executes dropped EXE
-
\??\c:\pdppv.exec:\pdppv.exe25⤵
- Executes dropped EXE
-
\??\c:\frrrlxr.exec:\frrrlxr.exe26⤵
- Executes dropped EXE
-
\??\c:\btbbbh.exec:\btbbbh.exe27⤵
- Executes dropped EXE
-
\??\c:\7bhntn.exec:\7bhntn.exe28⤵
- Executes dropped EXE
-
\??\c:\pppjp.exec:\pppjp.exe29⤵
- Executes dropped EXE
-
\??\c:\jpdvd.exec:\jpdvd.exe30⤵
- Executes dropped EXE
-
\??\c:\xlxfflr.exec:\xlxfflr.exe31⤵
- Executes dropped EXE
-
\??\c:\3tbhhn.exec:\3tbhhn.exe32⤵
- Executes dropped EXE
-
\??\c:\hbtbbb.exec:\hbtbbb.exe33⤵
- Executes dropped EXE
-
\??\c:\pvddd.exec:\pvddd.exe34⤵
- Executes dropped EXE
-
\??\c:\jvjpp.exec:\jvjpp.exe35⤵
- Executes dropped EXE
-
\??\c:\flfxxxx.exec:\flfxxxx.exe36⤵
- Executes dropped EXE
-
\??\c:\hhhhnt.exec:\hhhhnt.exe37⤵
- Executes dropped EXE
-
\??\c:\hhtbtb.exec:\hhtbtb.exe38⤵
- Executes dropped EXE
-
\??\c:\ppdvv.exec:\ppdvv.exe39⤵
- Executes dropped EXE
-
\??\c:\djvvj.exec:\djvvj.exe40⤵
- Executes dropped EXE
-
\??\c:\rfrxxff.exec:\rfrxxff.exe41⤵
- Executes dropped EXE
-
\??\c:\xffllrr.exec:\xffllrr.exe42⤵
- Executes dropped EXE
-
\??\c:\1hnttt.exec:\1hnttt.exe43⤵
- Executes dropped EXE
-
\??\c:\5tnbtb.exec:\5tnbtb.exe44⤵
- Executes dropped EXE
-
\??\c:\7dpdv.exec:\7dpdv.exe45⤵
- Executes dropped EXE
-
\??\c:\3ddjd.exec:\3ddjd.exe46⤵
- Executes dropped EXE
-
\??\c:\xfffffl.exec:\xfffffl.exe47⤵
- Executes dropped EXE
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe48⤵
- Executes dropped EXE
-
\??\c:\hnbhnt.exec:\hnbhnt.exe49⤵
- Executes dropped EXE
-
\??\c:\vvdvj.exec:\vvdvj.exe50⤵
- Executes dropped EXE
-
\??\c:\vdpvv.exec:\vdpvv.exe51⤵
- Executes dropped EXE
-
\??\c:\7rrlffx.exec:\7rrlffx.exe52⤵
- Executes dropped EXE
-
\??\c:\thnnnn.exec:\thnnnn.exe53⤵
- Executes dropped EXE
-
\??\c:\hnbbbh.exec:\hnbbbh.exe54⤵
- Executes dropped EXE
-
\??\c:\vdjdv.exec:\vdjdv.exe55⤵
- Executes dropped EXE
-
\??\c:\rxxfllr.exec:\rxxfllr.exe56⤵
- Executes dropped EXE
-
\??\c:\lxlffll.exec:\lxlffll.exe57⤵
- Executes dropped EXE
-
\??\c:\hhnhbb.exec:\hhnhbb.exe58⤵
- Executes dropped EXE
-
\??\c:\vvddd.exec:\vvddd.exe59⤵
- Executes dropped EXE
-
\??\c:\pvjdj.exec:\pvjdj.exe60⤵
- Executes dropped EXE
-
\??\c:\hbntht.exec:\hbntht.exe61⤵
- Executes dropped EXE
-
\??\c:\tthbbb.exec:\tthbbb.exe62⤵
- Executes dropped EXE
-
\??\c:\vdjvd.exec:\vdjvd.exe63⤵
- Executes dropped EXE
-
\??\c:\lrxffxx.exec:\lrxffxx.exe64⤵
- Executes dropped EXE
-
\??\c:\bnbbbh.exec:\bnbbbh.exe65⤵
- Executes dropped EXE
-
\??\c:\vdppp.exec:\vdppp.exe66⤵
-
\??\c:\rrxxfll.exec:\rrxxfll.exe67⤵
-
\??\c:\tbttnn.exec:\tbttnn.exe68⤵
-
\??\c:\dddvp.exec:\dddvp.exe69⤵
-
\??\c:\xfllrfl.exec:\xfllrfl.exe70⤵
-
\??\c:\xxffxfx.exec:\xxffxfx.exe71⤵
-
\??\c:\hbhnnb.exec:\hbhnnb.exe72⤵
-
\??\c:\jjdvj.exec:\jjdvj.exe73⤵
-
\??\c:\5frxlxl.exec:\5frxlxl.exe74⤵
-
\??\c:\xxfflrx.exec:\xxfflrx.exe75⤵
-
\??\c:\tbnhhn.exec:\tbnhhn.exe76⤵
-
\??\c:\5pvvv.exec:\5pvvv.exe77⤵
-
\??\c:\5hnhhn.exec:\5hnhhn.exe78⤵
-
\??\c:\hbhhhh.exec:\hbhhhh.exe79⤵
-
\??\c:\jjvdp.exec:\jjvdp.exe80⤵
-
\??\c:\lfllllr.exec:\lfllllr.exe81⤵
-
\??\c:\lfllxlr.exec:\lfllxlr.exe82⤵
-
\??\c:\bthttb.exec:\bthttb.exe83⤵
-
\??\c:\pvpvj.exec:\pvpvj.exe84⤵
-
\??\c:\3vjjp.exec:\3vjjp.exe85⤵
-
\??\c:\1rfffll.exec:\1rfffll.exe86⤵
-
\??\c:\lrlllrx.exec:\lrlllrx.exe87⤵
-
\??\c:\ttbbbn.exec:\ttbbbn.exe88⤵
-
\??\c:\jdppp.exec:\jdppp.exe89⤵
-
\??\c:\lfllllr.exec:\lfllllr.exe90⤵
-
\??\c:\5lxffll.exec:\5lxffll.exe91⤵
-
\??\c:\bbhthh.exec:\bbhthh.exe92⤵
-
\??\c:\5djjd.exec:\5djjd.exe93⤵
-
\??\c:\xrfffff.exec:\xrfffff.exe94⤵
-
\??\c:\1nbnnt.exec:\1nbnnt.exe95⤵
-
\??\c:\ddppv.exec:\ddppv.exe96⤵
-
\??\c:\rxrxxfl.exec:\rxrxxfl.exe97⤵
-
\??\c:\bthbbh.exec:\bthbbh.exe98⤵
-
\??\c:\bbtnnn.exec:\bbtnnn.exe99⤵
-
\??\c:\3pvvd.exec:\3pvvd.exe100⤵
-
\??\c:\llllxll.exec:\llllxll.exe101⤵
-
\??\c:\rxxffrx.exec:\rxxffrx.exe102⤵
-
\??\c:\tnttbb.exec:\tnttbb.exe103⤵
-
\??\c:\hhbbbh.exec:\hhbbbh.exe104⤵
-
\??\c:\pdjvj.exec:\pdjvj.exe105⤵
-
\??\c:\5frrlrx.exec:\5frrlrx.exe106⤵
-
\??\c:\xxrrflf.exec:\xxrrflf.exe107⤵
-
\??\c:\1ttttb.exec:\1ttttb.exe108⤵
-
\??\c:\htnnnt.exec:\htnnnt.exe109⤵
-
\??\c:\dpvvd.exec:\dpvvd.exe110⤵
-
\??\c:\llxrffr.exec:\llxrffr.exe111⤵
-
\??\c:\nbbbnt.exec:\nbbbnt.exe112⤵
-
\??\c:\hbhttb.exec:\hbhttb.exe113⤵
-
\??\c:\dpjjd.exec:\dpjjd.exe114⤵
-
\??\c:\lfllxxx.exec:\lfllxxx.exe115⤵
-
\??\c:\hbhhnh.exec:\hbhhnh.exe116⤵
-
\??\c:\tbbnhn.exec:\tbbnhn.exe117⤵
-
\??\c:\dvjdj.exec:\dvjdj.exe118⤵
-
\??\c:\rrlllfx.exec:\rrlllfx.exe119⤵
-
\??\c:\nbnthb.exec:\nbnthb.exe120⤵
-
\??\c:\jppvd.exec:\jppvd.exe121⤵
-
\??\c:\7pppj.exec:\7pppj.exe122⤵
-
\??\c:\rrrllrf.exec:\rrrllrf.exe123⤵
-
\??\c:\thtnhb.exec:\thtnhb.exe124⤵
-
\??\c:\ppjpd.exec:\ppjpd.exe125⤵
-
\??\c:\pvjjv.exec:\pvjjv.exe126⤵
-
\??\c:\llrrrxr.exec:\llrrrxr.exe127⤵
-
\??\c:\hnhbth.exec:\hnhbth.exe128⤵
-
\??\c:\hbbhhn.exec:\hbbhhn.exe129⤵
-
\??\c:\jjvdp.exec:\jjvdp.exe130⤵
-
\??\c:\dpvdd.exec:\dpvdd.exe131⤵
-
\??\c:\fxfllrx.exec:\fxfllrx.exe132⤵
-
\??\c:\tnbhhb.exec:\tnbhhb.exe133⤵
-
\??\c:\nnbbnb.exec:\nnbbnb.exe134⤵
-
\??\c:\pppvj.exec:\pppvj.exe135⤵
-
\??\c:\rflllrr.exec:\rflllrr.exe136⤵
-
\??\c:\rlxxlfr.exec:\rlxxlfr.exe137⤵
-
\??\c:\nntttb.exec:\nntttb.exe138⤵
-
\??\c:\jdppp.exec:\jdppp.exe139⤵
-
\??\c:\dvjdd.exec:\dvjdd.exe140⤵
-
\??\c:\lfrrrrr.exec:\lfrrrrr.exe141⤵
-
\??\c:\hthhnh.exec:\hthhnh.exe142⤵
-
\??\c:\1vvvj.exec:\1vvvj.exe143⤵
-
\??\c:\lflflrx.exec:\lflflrx.exe144⤵
-
\??\c:\9nttnt.exec:\9nttnt.exe145⤵
-
\??\c:\ppjjj.exec:\ppjjj.exe146⤵
-
\??\c:\jdppp.exec:\jdppp.exe147⤵
-
\??\c:\nhtnhb.exec:\nhtnhb.exe148⤵
-
\??\c:\7pvvd.exec:\7pvvd.exe149⤵
-
\??\c:\ppdjv.exec:\ppdjv.exe150⤵
-
\??\c:\frffxfx.exec:\frffxfx.exe151⤵
-
\??\c:\nhtttb.exec:\nhtttb.exe152⤵
-
\??\c:\nbbhbt.exec:\nbbhbt.exe153⤵
-
\??\c:\jjjpj.exec:\jjjpj.exe154⤵
-
\??\c:\flrrrrr.exec:\flrrrrr.exe155⤵
-
\??\c:\rffrfxl.exec:\rffrfxl.exe156⤵
-
\??\c:\nnbttb.exec:\nnbttb.exe157⤵
-
\??\c:\dvjjj.exec:\dvjjj.exe158⤵
-
\??\c:\lrflrrr.exec:\lrflrrr.exe159⤵
-
\??\c:\htttnn.exec:\htttnn.exe160⤵
-
\??\c:\httttt.exec:\httttt.exe161⤵
-
\??\c:\7vjdd.exec:\7vjdd.exe162⤵
-
\??\c:\dpvpd.exec:\dpvpd.exe163⤵
-
\??\c:\rxffxll.exec:\rxffxll.exe164⤵
-
\??\c:\lxrfxfx.exec:\lxrfxfx.exe165⤵
-
\??\c:\hhtbnh.exec:\hhtbnh.exe166⤵
-
\??\c:\bthhhn.exec:\bthhhn.exe167⤵
-
\??\c:\pjdjj.exec:\pjdjj.exe168⤵
-
\??\c:\fflrrlr.exec:\fflrrlr.exe169⤵
-
\??\c:\7lxrrrr.exec:\7lxrrrr.exe170⤵
-
\??\c:\hntttb.exec:\hntttb.exe171⤵
-
\??\c:\nbhhhh.exec:\nbhhhh.exe172⤵
-
\??\c:\djddj.exec:\djddj.exe173⤵
-
\??\c:\rlxfrxx.exec:\rlxfrxx.exe174⤵
-
\??\c:\7frrrxx.exec:\7frrrxx.exe175⤵
-
\??\c:\hbbbbh.exec:\hbbbbh.exe176⤵
-
\??\c:\htntbh.exec:\htntbh.exe177⤵
-
\??\c:\jvjjj.exec:\jvjjj.exe178⤵
-
\??\c:\ppvvv.exec:\ppvvv.exe179⤵
-
\??\c:\rfxrrrr.exec:\rfxrrrr.exe180⤵
-
\??\c:\xrxxfll.exec:\xrxxfll.exe181⤵
-
\??\c:\hhbbth.exec:\hhbbth.exe182⤵
-
\??\c:\hnbbhh.exec:\hnbbhh.exe183⤵
-
\??\c:\pdjdd.exec:\pdjdd.exe184⤵
-
\??\c:\jjjjj.exec:\jjjjj.exe185⤵
-
\??\c:\ffllrrx.exec:\ffllrrx.exe186⤵
-
\??\c:\rxlllrl.exec:\rxlllrl.exe187⤵
-
\??\c:\bnnttb.exec:\bnnttb.exe188⤵
-
\??\c:\ttbbbh.exec:\ttbbbh.exe189⤵
-
\??\c:\ddjjj.exec:\ddjjj.exe190⤵
-
\??\c:\jvdpv.exec:\jvdpv.exe191⤵
-
\??\c:\lfxxlfr.exec:\lfxxlfr.exe192⤵
-
\??\c:\rlrrrrx.exec:\rlrrrrx.exe193⤵
-
\??\c:\bhtnbn.exec:\bhtnbn.exe194⤵
-
\??\c:\ddjjp.exec:\ddjjp.exe195⤵
-
\??\c:\vvjpd.exec:\vvjpd.exe196⤵
-
\??\c:\fffffff.exec:\fffffff.exe197⤵
-
\??\c:\fxfxxxf.exec:\fxfxxxf.exe198⤵
-
\??\c:\nttnnh.exec:\nttnnh.exe199⤵
-
\??\c:\nnttnn.exec:\nnttnn.exe200⤵
-
\??\c:\jppdv.exec:\jppdv.exe201⤵
-
\??\c:\9xxrxxx.exec:\9xxrxxx.exe202⤵
-
\??\c:\1xfflrx.exec:\1xfflrx.exe203⤵
-
\??\c:\ttnthb.exec:\ttnthb.exe204⤵
-
\??\c:\7ttbbh.exec:\7ttbbh.exe205⤵
-
\??\c:\ddppd.exec:\ddppd.exe206⤵
-
\??\c:\xlxxfrx.exec:\xlxxfrx.exe207⤵
-
\??\c:\tbnttb.exec:\tbnttb.exe208⤵
-
\??\c:\dpvdd.exec:\dpvdd.exe209⤵
-
\??\c:\7jdjj.exec:\7jdjj.exe210⤵
-
\??\c:\xxrllfl.exec:\xxrllfl.exe211⤵
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe212⤵
-
\??\c:\bbnnbn.exec:\bbnnbn.exe213⤵
-
\??\c:\1dddv.exec:\1dddv.exe214⤵
-
\??\c:\jddjj.exec:\jddjj.exe215⤵
-
\??\c:\lrxfllx.exec:\lrxfllx.exe216⤵
-
\??\c:\nnbnth.exec:\nnbnth.exe217⤵
-
\??\c:\hhnhtn.exec:\hhnhtn.exe218⤵
-
\??\c:\jdvvp.exec:\jdvvp.exe219⤵
-
\??\c:\fxxfxxl.exec:\fxxfxxl.exe220⤵
-
\??\c:\bbtbhh.exec:\bbtbhh.exe221⤵
-
\??\c:\jvdjd.exec:\jvdjd.exe222⤵
-
\??\c:\vvddj.exec:\vvddj.exe223⤵
-
\??\c:\lrxxlrf.exec:\lrxxlrf.exe224⤵
-
\??\c:\1vdvv.exec:\1vdvv.exe225⤵
-
\??\c:\rlxrffr.exec:\rlxrffr.exe226⤵
-
\??\c:\9bnnnt.exec:\9bnnnt.exe227⤵
-
\??\c:\dpjvv.exec:\dpjvv.exe228⤵
-
\??\c:\hbttbb.exec:\hbttbb.exe229⤵
-
\??\c:\ddjdp.exec:\ddjdp.exe230⤵
-
\??\c:\vjpjj.exec:\vjpjj.exe231⤵
-
\??\c:\9xxfxrl.exec:\9xxfxrl.exe232⤵
-
\??\c:\nnhnht.exec:\nnhnht.exe233⤵
-
\??\c:\pjpvd.exec:\pjpvd.exe234⤵
-
\??\c:\lrrlffx.exec:\lrrlffx.exe235⤵
-
\??\c:\nnnntb.exec:\nnnntb.exe236⤵
-
\??\c:\httnnt.exec:\httnnt.exe237⤵
-
\??\c:\vdpvv.exec:\vdpvv.exe238⤵
-
\??\c:\rlxrrrr.exec:\rlxrrrr.exe239⤵
-
\??\c:\3rxffxx.exec:\3rxffxx.exe240⤵
-
\??\c:\nbbbhn.exec:\nbbbhn.exe241⤵