Analysis
-
max time kernel
128s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 22:18
Behavioral task
behavioral1
Sample
185ea6159579e02231770a3101dab3d0_NeikiAnalytics.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
-
Target
185ea6159579e02231770a3101dab3d0_NeikiAnalytics.exe
-
Size
398KB
-
MD5
185ea6159579e02231770a3101dab3d0
-
SHA1
e657342e3f1148f83cb4c58057508eba83063775
-
SHA256
6e5fb06623261aea9c19f21886a79469e5d3e640cc83923cc664e7b0b799cfb1
-
SHA512
f85bd7041a540ce86628c3d9edcb9c910709489ce3b5c15baf0152ae463808c05256801bb009b7c37ca635443f87e24a5f91a7fe58a0f5c22d06058b6927099f
-
SSDEEP
12288:Q4wFHoSqRyddW7xJCc5TugZKS9sUvkclI0/RTf:BRyLWFMu91RlI0/RTf
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2392-7-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1916-10-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/3052-27-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2932-37-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2596-47-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2720-49-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1132-65-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2620-82-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2452-92-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/3020-102-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2796-119-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2780-136-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1212-144-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2676-154-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/3040-176-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1628-171-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1728-208-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2636-217-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/588-225-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/568-274-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2044-278-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2256-292-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1868-299-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1596-312-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1824-319-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1916-327-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2604-346-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2700-372-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/3060-379-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2472-386-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1088-587-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2332-607-0x00000000003A0000-0x00000000003D6000-memory.dmp family_blackmoon behavioral1/memory/2576-682-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2296-759-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1720-881-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1720-888-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1172-992-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1172-999-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1172-1043-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2760-1051-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/592-1065-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/memory/2392-0-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x000b0000000141a2-5.dat family_berbew behavioral1/memory/2392-7-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/1916-10-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x00090000000143ec-16.dat family_berbew behavioral1/memory/3052-18-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/3052-27-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x0008000000014539-25.dat family_berbew behavioral1/memory/2932-28-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x0007000000014667-38.dat family_berbew behavioral1/memory/2932-37-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/2596-47-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x00070000000146a2-45.dat family_berbew behavioral1/memory/2720-49-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x000a0000000146b8-56.dat family_berbew behavioral1/files/0x00090000000146c0-63.dat family_berbew behavioral1/memory/1132-65-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x000b000000014825-73.dat family_berbew behavioral1/memory/2620-82-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x00070000000149f5-81.dat family_berbew behavioral1/memory/2452-83-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x0007000000014abe-91.dat family_berbew behavioral1/memory/2452-92-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/3020-93-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x0007000000014af6-99.dat family_berbew behavioral1/memory/3020-102-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x0006000000014b31-110.dat family_berbew behavioral1/files/0x0006000000014b70-117.dat family_berbew behavioral1/memory/2796-119-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x0006000000014de9-127.dat family_berbew behavioral1/files/0x0006000000014ef8-133.dat family_berbew behavioral1/memory/2780-136-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/1212-144-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x0006000000015018-145.dat family_berbew behavioral1/memory/2676-154-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x00060000000155ed-152.dat family_berbew behavioral1/files/0x00060000000155f3-162.dat family_berbew behavioral1/files/0x000900000001448a-174.dat family_berbew behavioral1/memory/3040-176-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/1628-171-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x00060000000155f7-182.dat family_berbew behavioral1/files/0x0006000000015605-189.dat family_berbew behavioral1/memory/1960-191-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x0006000000015616-199.dat family_berbew behavioral1/files/0x0006000000015626-205.dat family_berbew behavioral1/memory/1728-208-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x0006000000015b6f-215.dat family_berbew behavioral1/memory/2636-217-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x0006000000015c3d-226.dat family_berbew behavioral1/memory/588-225-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x0006000000015c52-234.dat family_berbew behavioral1/files/0x0006000000015c6b-242.dat family_berbew behavioral1/files/0x0006000000015c78-249.dat family_berbew behavioral1/files/0x0006000000015c83-258.dat family_berbew behavioral1/files/0x0006000000015c9f-266.dat family_berbew behavioral1/files/0x0006000000015cb6-275.dat family_berbew behavioral1/memory/568-274-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/2044-278-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x0006000000015cce-283.dat family_berbew behavioral1/memory/2256-292-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/1868-299-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/1596-312-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/1824-320-0x0000000001C90000-0x0000000001CC6000-memory.dmp family_berbew behavioral1/memory/1824-319-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
pid Process 1916 bnnntn.exe 3052 3xrxlfx.exe 2932 hhhbth.exe 2596 vvjvj.exe 2720 bhthtb.exe 1132 tttbnt.exe 2736 lfflxfr.exe 2620 3tnnbn.exe 2452 jpjdp.exe 3020 bhhtnb.exe 2272 dvdvd.exe 2796 rrlfflx.exe 2504 htthnt.exe 2780 llxlxll.exe 1212 hhnhbb.exe 2676 9pdvj.exe 2816 lfrrxxf.exe 1628 hbnthh.exe 3040 vdvvj.exe 3004 xlxfrrf.exe 1960 vvpdj.exe 1728 nbnnbb.exe 2636 pdvjp.exe 588 ffxfrxr.exe 1196 btntht.exe 2432 3vvpp.exe 2004 3jjjv.exe 976 7jpjj.exe 2968 ttnhbn.exe 568 vpdjd.exe 2044 3thbth.exe 2256 tnnntt.exe 896 nbtbhn.exe 1868 3jjpv.exe 1596 xxfrllf.exe 1824 llxrllx.exe 1916 ttthhn.exe 3060 vjvdd.exe 2284 xrflrrr.exe 2604 3hnhbb.exe 2956 vddpp.exe 2720 rrfxfrr.exe 2464 9xlfllx.exe 2700 ttthbh.exe 2520 pvppj.exe 2472 frflflx.exe 2900 7bbhtt.exe 2576 pdddv.exe 3036 vdvjj.exe 320 7lrxrff.exe 2680 hhhtnh.exe 2640 3vdpv.exe 2688 dvvpj.exe 2752 5lrlfxx.exe 2760 9hthnt.exe 2776 vpjpv.exe 2888 ddddp.exe 2816 5frxlll.exe 1636 tbhtnt.exe 2120 jdvdp.exe 2328 9pdjv.exe 1724 xrrfrxf.exe 1268 httbtt.exe 1976 1djjp.exe -
resource yara_rule behavioral1/memory/2392-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000b0000000141a2-5.dat upx behavioral1/memory/2392-7-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1916-10-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00090000000143ec-16.dat upx behavioral1/memory/3052-18-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/3052-27-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0008000000014539-25.dat upx behavioral1/memory/2932-28-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000014667-38.dat upx behavioral1/memory/2932-37-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2596-47-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00070000000146a2-45.dat upx behavioral1/memory/2720-49-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000a0000000146b8-56.dat upx behavioral1/files/0x00090000000146c0-63.dat upx behavioral1/memory/1132-65-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000b000000014825-73.dat upx behavioral1/memory/2620-82-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00070000000149f5-81.dat upx behavioral1/memory/2452-83-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000014abe-91.dat upx behavioral1/memory/2452-92-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/3020-93-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000014af6-99.dat upx behavioral1/memory/3020-102-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000014b31-110.dat upx behavioral1/files/0x0006000000014b70-117.dat upx behavioral1/memory/2796-119-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000014de9-127.dat upx behavioral1/files/0x0006000000014ef8-133.dat upx behavioral1/memory/2780-136-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1212-144-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015018-145.dat upx behavioral1/memory/2676-154-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00060000000155ed-152.dat upx behavioral1/files/0x00060000000155f3-162.dat upx behavioral1/files/0x000900000001448a-174.dat upx behavioral1/memory/3040-176-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1628-171-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00060000000155f7-182.dat upx behavioral1/files/0x0006000000015605-189.dat upx behavioral1/memory/1960-191-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015616-199.dat upx behavioral1/files/0x0006000000015626-205.dat upx behavioral1/memory/1728-208-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015b6f-215.dat upx behavioral1/memory/2636-217-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015c3d-226.dat upx behavioral1/memory/588-225-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015c52-234.dat upx behavioral1/files/0x0006000000015c6b-242.dat upx behavioral1/files/0x0006000000015c78-249.dat upx behavioral1/files/0x0006000000015c83-258.dat upx behavioral1/files/0x0006000000015c9f-266.dat upx behavioral1/files/0x0006000000015cb6-275.dat upx behavioral1/memory/568-274-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2044-278-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015cce-283.dat upx behavioral1/memory/2256-292-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1868-299-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1596-312-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1824-320-0x0000000001C90000-0x0000000001CC6000-memory.dmp upx behavioral1/memory/1824-319-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2392 wrote to memory of 1916 2392 185ea6159579e02231770a3101dab3d0_NeikiAnalytics.exe 28 PID 2392 wrote to memory of 1916 2392 185ea6159579e02231770a3101dab3d0_NeikiAnalytics.exe 28 PID 2392 wrote to memory of 1916 2392 185ea6159579e02231770a3101dab3d0_NeikiAnalytics.exe 28 PID 2392 wrote to memory of 1916 2392 185ea6159579e02231770a3101dab3d0_NeikiAnalytics.exe 28 PID 1916 wrote to memory of 3052 1916 bnnntn.exe 29 PID 1916 wrote to memory of 3052 1916 bnnntn.exe 29 PID 1916 wrote to memory of 3052 1916 bnnntn.exe 29 PID 1916 wrote to memory of 3052 1916 bnnntn.exe 29 PID 3052 wrote to memory of 2932 3052 3xrxlfx.exe 30 PID 3052 wrote to memory of 2932 3052 3xrxlfx.exe 30 PID 3052 wrote to memory of 2932 3052 3xrxlfx.exe 30 PID 3052 wrote to memory of 2932 3052 3xrxlfx.exe 30 PID 2932 wrote to memory of 2596 2932 hhhbth.exe 31 PID 2932 wrote to memory of 2596 2932 hhhbth.exe 31 PID 2932 wrote to memory of 2596 2932 hhhbth.exe 31 PID 2932 wrote to memory of 2596 2932 hhhbth.exe 31 PID 2596 wrote to memory of 2720 2596 vvjvj.exe 32 PID 2596 wrote to memory of 2720 2596 vvjvj.exe 32 PID 2596 wrote to memory of 2720 2596 vvjvj.exe 32 PID 2596 wrote to memory of 2720 2596 vvjvj.exe 32 PID 2720 wrote to memory of 1132 2720 bhthtb.exe 33 PID 2720 wrote to memory of 1132 2720 bhthtb.exe 33 PID 2720 wrote to memory of 1132 2720 bhthtb.exe 33 PID 2720 wrote to memory of 1132 2720 bhthtb.exe 33 PID 1132 wrote to memory of 2736 1132 tttbnt.exe 34 PID 1132 wrote to memory of 2736 1132 tttbnt.exe 34 PID 1132 wrote to memory of 2736 1132 tttbnt.exe 34 PID 1132 wrote to memory of 2736 1132 tttbnt.exe 34 PID 2736 wrote to memory of 2620 2736 lfflxfr.exe 35 PID 2736 wrote to memory of 2620 2736 lfflxfr.exe 35 PID 2736 wrote to memory of 2620 2736 lfflxfr.exe 35 PID 2736 wrote to memory of 2620 2736 lfflxfr.exe 35 PID 2620 wrote to memory of 2452 2620 3tnnbn.exe 36 PID 2620 wrote to memory of 2452 2620 3tnnbn.exe 36 PID 2620 wrote to memory of 2452 2620 3tnnbn.exe 36 PID 2620 wrote to memory of 2452 2620 3tnnbn.exe 36 PID 2452 wrote to memory of 3020 2452 jpjdp.exe 37 PID 2452 wrote to memory of 3020 2452 jpjdp.exe 37 PID 2452 wrote to memory of 3020 2452 jpjdp.exe 37 PID 2452 wrote to memory of 3020 2452 jpjdp.exe 37 PID 3020 wrote to memory of 2272 3020 bhhtnb.exe 38 PID 3020 wrote to memory of 2272 3020 bhhtnb.exe 38 PID 3020 wrote to memory of 2272 3020 bhhtnb.exe 38 PID 3020 wrote to memory of 2272 3020 bhhtnb.exe 38 PID 2272 wrote to memory of 2796 2272 dvdvd.exe 39 PID 2272 wrote to memory of 2796 2272 dvdvd.exe 39 PID 2272 wrote to memory of 2796 2272 dvdvd.exe 39 PID 2272 wrote to memory of 2796 2272 dvdvd.exe 39 PID 2796 wrote to memory of 2504 2796 rrlfflx.exe 40 PID 2796 wrote to memory of 2504 2796 rrlfflx.exe 40 PID 2796 wrote to memory of 2504 2796 rrlfflx.exe 40 PID 2796 wrote to memory of 2504 2796 rrlfflx.exe 40 PID 2504 wrote to memory of 2780 2504 htthnt.exe 41 PID 2504 wrote to memory of 2780 2504 htthnt.exe 41 PID 2504 wrote to memory of 2780 2504 htthnt.exe 41 PID 2504 wrote to memory of 2780 2504 htthnt.exe 41 PID 2780 wrote to memory of 1212 2780 llxlxll.exe 42 PID 2780 wrote to memory of 1212 2780 llxlxll.exe 42 PID 2780 wrote to memory of 1212 2780 llxlxll.exe 42 PID 2780 wrote to memory of 1212 2780 llxlxll.exe 42 PID 1212 wrote to memory of 2676 1212 hhnhbb.exe 43 PID 1212 wrote to memory of 2676 1212 hhnhbb.exe 43 PID 1212 wrote to memory of 2676 1212 hhnhbb.exe 43 PID 1212 wrote to memory of 2676 1212 hhnhbb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\185ea6159579e02231770a3101dab3d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\185ea6159579e02231770a3101dab3d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\bnnntn.exec:\bnnntn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\3xrxlfx.exec:\3xrxlfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\hhhbth.exec:\hhhbth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\vvjvj.exec:\vvjvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\bhthtb.exec:\bhthtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\tttbnt.exec:\tttbnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\lfflxfr.exec:\lfflxfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\3tnnbn.exec:\3tnnbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\jpjdp.exec:\jpjdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\bhhtnb.exec:\bhhtnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\dvdvd.exec:\dvdvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\rrlfflx.exec:\rrlfflx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\htthnt.exec:\htthnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\llxlxll.exec:\llxlxll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\hhnhbb.exec:\hhnhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\9pdvj.exec:\9pdvj.exe17⤵
- Executes dropped EXE
PID:2676 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe18⤵
- Executes dropped EXE
PID:2816 -
\??\c:\hbnthh.exec:\hbnthh.exe19⤵
- Executes dropped EXE
PID:1628 -
\??\c:\vdvvj.exec:\vdvvj.exe20⤵
- Executes dropped EXE
PID:3040 -
\??\c:\xlxfrrf.exec:\xlxfrrf.exe21⤵
- Executes dropped EXE
PID:3004 -
\??\c:\vvpdj.exec:\vvpdj.exe22⤵
- Executes dropped EXE
PID:1960 -
\??\c:\nbnnbb.exec:\nbnnbb.exe23⤵
- Executes dropped EXE
PID:1728 -
\??\c:\pdvjp.exec:\pdvjp.exe24⤵
- Executes dropped EXE
PID:2636 -
\??\c:\ffxfrxr.exec:\ffxfrxr.exe25⤵
- Executes dropped EXE
PID:588 -
\??\c:\btntht.exec:\btntht.exe26⤵
- Executes dropped EXE
PID:1196 -
\??\c:\3vvpp.exec:\3vvpp.exe27⤵
- Executes dropped EXE
PID:2432 -
\??\c:\3jjjv.exec:\3jjjv.exe28⤵
- Executes dropped EXE
PID:2004 -
\??\c:\7jpjj.exec:\7jpjj.exe29⤵
- Executes dropped EXE
PID:976 -
\??\c:\ttnhbn.exec:\ttnhbn.exe30⤵
- Executes dropped EXE
PID:2968 -
\??\c:\vpdjd.exec:\vpdjd.exe31⤵
- Executes dropped EXE
PID:568 -
\??\c:\3thbth.exec:\3thbth.exe32⤵
- Executes dropped EXE
PID:2044 -
\??\c:\tnnntt.exec:\tnnntt.exe33⤵
- Executes dropped EXE
PID:2256 -
\??\c:\nbtbhn.exec:\nbtbhn.exe34⤵
- Executes dropped EXE
PID:896 -
\??\c:\3jjpv.exec:\3jjpv.exe35⤵
- Executes dropped EXE
PID:1868 -
\??\c:\xxfrllf.exec:\xxfrllf.exe36⤵
- Executes dropped EXE
PID:1596 -
\??\c:\llxrllx.exec:\llxrllx.exe37⤵
- Executes dropped EXE
PID:1824 -
\??\c:\ttthhn.exec:\ttthhn.exe38⤵
- Executes dropped EXE
PID:1916 -
\??\c:\vjvdd.exec:\vjvdd.exe39⤵
- Executes dropped EXE
PID:3060 -
\??\c:\xrflrrr.exec:\xrflrrr.exe40⤵
- Executes dropped EXE
PID:2284 -
\??\c:\3hnhbb.exec:\3hnhbb.exe41⤵
- Executes dropped EXE
PID:2604 -
\??\c:\vddpp.exec:\vddpp.exe42⤵
- Executes dropped EXE
PID:2956 -
\??\c:\rrfxfrr.exec:\rrfxfrr.exe43⤵
- Executes dropped EXE
PID:2720 -
\??\c:\9xlfllx.exec:\9xlfllx.exe44⤵
- Executes dropped EXE
PID:2464 -
\??\c:\ttthbh.exec:\ttthbh.exe45⤵
- Executes dropped EXE
PID:2700 -
\??\c:\pvppj.exec:\pvppj.exe46⤵
- Executes dropped EXE
PID:2520 -
\??\c:\frflflx.exec:\frflflx.exe47⤵
- Executes dropped EXE
PID:2472 -
\??\c:\7bbhtt.exec:\7bbhtt.exe48⤵
- Executes dropped EXE
PID:2900 -
\??\c:\pdddv.exec:\pdddv.exe49⤵
- Executes dropped EXE
PID:2576 -
\??\c:\vdvjj.exec:\vdvjj.exe50⤵
- Executes dropped EXE
PID:3036 -
\??\c:\7lrxrff.exec:\7lrxrff.exe51⤵
- Executes dropped EXE
PID:320 -
\??\c:\hhhtnh.exec:\hhhtnh.exe52⤵
- Executes dropped EXE
PID:2680 -
\??\c:\3vdpv.exec:\3vdpv.exe53⤵
- Executes dropped EXE
PID:2640 -
\??\c:\dvvpj.exec:\dvvpj.exe54⤵
- Executes dropped EXE
PID:2688 -
\??\c:\5lrlfxx.exec:\5lrlfxx.exe55⤵
- Executes dropped EXE
PID:2752 -
\??\c:\9hthnt.exec:\9hthnt.exe56⤵
- Executes dropped EXE
PID:2760 -
\??\c:\vpjpv.exec:\vpjpv.exe57⤵
- Executes dropped EXE
PID:2776 -
\??\c:\ddddp.exec:\ddddp.exe58⤵
- Executes dropped EXE
PID:2888 -
\??\c:\5frxlll.exec:\5frxlll.exe59⤵
- Executes dropped EXE
PID:2816 -
\??\c:\tbhtnt.exec:\tbhtnt.exe60⤵
- Executes dropped EXE
PID:1636 -
\??\c:\jdvdp.exec:\jdvdp.exe61⤵
- Executes dropped EXE
PID:2120 -
\??\c:\9pdjv.exec:\9pdjv.exe62⤵
- Executes dropped EXE
PID:2328 -
\??\c:\xrrfrxf.exec:\xrrfrxf.exe63⤵
- Executes dropped EXE
PID:1724 -
\??\c:\httbtt.exec:\httbtt.exe64⤵
- Executes dropped EXE
PID:1268 -
\??\c:\1djjp.exec:\1djjp.exe65⤵
- Executes dropped EXE
PID:1976 -
\??\c:\vppvd.exec:\vppvd.exe66⤵PID:688
-
\??\c:\xfxxfrf.exec:\xfxxfrf.exe67⤵PID:2636
-
\??\c:\5tthnt.exec:\5tthnt.exe68⤵PID:1904
-
\??\c:\3pddp.exec:\3pddp.exe69⤵PID:1240
-
\??\c:\3rrllfx.exec:\3rrllfx.exe70⤵PID:1796
-
\??\c:\hbttbh.exec:\hbttbh.exe71⤵PID:764
-
\??\c:\thtbbh.exec:\thtbbh.exe72⤵PID:1324
-
\??\c:\dppdj.exec:\dppdj.exe73⤵PID:1616
-
\??\c:\7frrxxf.exec:\7frrxxf.exe74⤵PID:1064
-
\??\c:\nhbnbb.exec:\nhbnbb.exe75⤵PID:2976
-
\??\c:\djpdv.exec:\djpdv.exe76⤵PID:2332
-
\??\c:\pvdvv.exec:\pvdvv.exe77⤵PID:2160
-
\??\c:\lfrlxxf.exec:\lfrlxxf.exe78⤵PID:2380
-
\??\c:\7thbht.exec:\7thbht.exe79⤵PID:1776
-
\??\c:\vdpdj.exec:\vdpdj.exe80⤵PID:1088
-
\??\c:\jpjdd.exec:\jpjdd.exe81⤵PID:1604
-
\??\c:\7rlxrrx.exec:\7rlxrrx.exe82⤵PID:1568
-
\??\c:\nbtbbb.exec:\nbtbbb.exe83⤵PID:2960
-
\??\c:\ppjjj.exec:\ppjjj.exe84⤵PID:3000
-
\??\c:\jjpdp.exec:\jjpdp.exe85⤵PID:2668
-
\??\c:\lfxfflx.exec:\lfxfflx.exe86⤵PID:2560
-
\??\c:\tbhttb.exec:\tbhttb.exe87⤵PID:2656
-
\??\c:\nnbthn.exec:\nnbthn.exe88⤵PID:2596
-
\??\c:\5ppvd.exec:\5ppvd.exe89⤵PID:2580
-
\??\c:\fxrffll.exec:\fxrffll.exe90⤵PID:2484
-
\??\c:\ttnbth.exec:\ttnbth.exe91⤵PID:2740
-
\??\c:\hnhnbh.exec:\hnhnbh.exe92⤵PID:2592
-
\??\c:\3dpvp.exec:\3dpvp.exe93⤵PID:2516
-
\??\c:\lrlfxfx.exec:\lrlfxfx.exe94⤵PID:2532
-
\??\c:\llflxfx.exec:\llflxfx.exe95⤵PID:2900
-
\??\c:\bbbthn.exec:\bbbthn.exe96⤵PID:2576
-
\??\c:\1vdpd.exec:\1vdpd.exe97⤵PID:2876
-
\??\c:\xrflrxl.exec:\xrflrxl.exe98⤵PID:320
-
\??\c:\flrfrfx.exec:\flrfrfx.exe99⤵PID:2680
-
\??\c:\tbbhnt.exec:\tbbhnt.exe100⤵PID:2856
-
\??\c:\jdvvd.exec:\jdvvd.exe101⤵PID:1764
-
\??\c:\xrfrxll.exec:\xrfrxll.exe102⤵PID:2852
-
\??\c:\xxxrflx.exec:\xxxrflx.exe103⤵PID:2684
-
\??\c:\thbttb.exec:\thbttb.exe104⤵PID:1592
-
\??\c:\1pdvd.exec:\1pdvd.exe105⤵PID:2828
-
\??\c:\dvdvj.exec:\dvdvj.exe106⤵PID:2816
-
\??\c:\xfxflrx.exec:\xfxflrx.exe107⤵PID:2296
-
\??\c:\nntnbn.exec:\nntnbn.exe108⤵PID:2104
-
\??\c:\bhhtnt.exec:\bhhtnt.exe109⤵PID:1752
-
\??\c:\pdjdp.exec:\pdjdp.exe110⤵PID:540
-
\??\c:\lrrffrr.exec:\lrrffrr.exe111⤵PID:2116
-
\??\c:\xxxfxrl.exec:\xxxfxrl.exe112⤵PID:1168
-
\??\c:\nhbbhh.exec:\nhbbhh.exe113⤵PID:1004
-
\??\c:\vvvjd.exec:\vvvjd.exe114⤵PID:1504
-
\??\c:\lfllxfx.exec:\lfllxfx.exe115⤵PID:2060
-
\??\c:\3rxllff.exec:\3rxllff.exe116⤵PID:1712
-
\??\c:\htbnbh.exec:\htbnbh.exe117⤵PID:1684
-
\??\c:\jppdj.exec:\jppdj.exe118⤵PID:616
-
\??\c:\jjpvp.exec:\jjpvp.exe119⤵PID:1912
-
\??\c:\ttnhhb.exec:\ttnhhb.exe120⤵PID:2312
-
\??\c:\pjddv.exec:\pjddv.exe121⤵PID:276
-
\??\c:\3rlfffr.exec:\3rlfffr.exe122⤵PID:108
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-