Analysis
- max time kernel
154s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
12/05/2024, 05:14
Behavioral task
behavioral1
Sample
6f4fe5060abc6aca803ae6a944a45330_NeikiAnalytics.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
- Target 6f4fe5060abc6aca803ae6a944a45330_NeikiAnalytics.exe
- Size 247KB
- Sample240512-fxfngadf49
- SHA256 4b27d5561b3e5ec30bc0557d628bdb3086f925f6787d05b5af51e40e11751252
- MD5 6f4fe5060abc6aca803ae6a944a45330
- SHA1 37071f614969b3df64439043b84f26f3daedf5b0
- SHA512 d828f88f6523b1ebfbc6fbbe9761207e1c7a447da56c1561e846efd4c2b29580733af3b1af1c0917c873ddd39a1a1707cd1742b0b42771b6fc64c9b673a65c74
- SSDEEP 3072:chOmTsF93UYfwC6GIoutieyhC2lbgGi5yLpcgDE4JBuItR8pTsgZ9WT4iaz+3:ccm4FmowdHoSi9EIBftapTs4WZazW
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2252-6-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3336-12-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1772-17-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/800-23-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1848-28-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2172-35-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1460-42-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1124-47-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4748-53-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4184-60-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4712-66-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4124-71-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1132-81-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1560-88-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2448-93-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2136-103-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4212-101-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/608-117-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2484-129-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/848-136-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2156-146-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3040-157-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4436-160-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4688-167-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3676-177-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3912-172-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4472-190-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/720-196-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1648-194-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2724-202-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/820-212-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1456-219-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/220-223-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3324-230-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3944-234-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3544-247-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4584-255-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1644-264-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1400-268-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4480-275-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/896-287-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3392-294-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2532-307-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4436-317-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3980-328-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/912-334-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4280-356-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/748-391-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/552-449-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2960-456-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4936-487-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1252-509-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3356-519-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2304-526-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4752-530-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1652-552-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2300-577-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1392-721-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3380-766-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1588-888-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4672-961-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5104-1006-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3588-1045-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3112-1070-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon - Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0008000000023258-3.dat family_berbew behavioral2/files/0x000800000002325c-9.dat family_berbew behavioral2/files/0x000800000002325d-13.dat family_berbew behavioral2/files/0x000800000002325f-24.dat family_berbew behavioral2/files/0x0008000000023260-29.dat family_berbew behavioral2/files/0x0007000000023261-33.dat family_berbew behavioral2/files/0x0007000000023262-39.dat family_berbew behavioral2/files/0x0007000000023263-48.dat family_berbew behavioral2/files/0x0007000000023264-51.dat family_berbew behavioral2/files/0x0007000000023265-57.dat family_berbew behavioral2/files/0x0007000000023266-63.dat family_berbew behavioral2/files/0x0007000000023267-69.dat family_berbew behavioral2/files/0x0007000000023268-75.dat family_berbew behavioral2/files/0x000700000002326a-82.dat family_berbew behavioral2/files/0x000700000002326b-89.dat family_berbew behavioral2/files/0x000700000002326c-94.dat family_berbew behavioral2/files/0x000700000002326d-98.dat family_berbew behavioral2/files/0x000700000002326e-104.dat family_berbew behavioral2/files/0x000700000002326f-110.dat family_berbew behavioral2/files/0x0007000000023270-115.dat family_berbew behavioral2/files/0x0007000000023271-122.dat family_berbew behavioral2/files/0x0007000000023272-126.dat family_berbew behavioral2/files/0x0007000000023273-133.dat family_berbew behavioral2/files/0x0007000000023274-138.dat family_berbew behavioral2/files/0x0007000000023275-144.dat family_berbew behavioral2/files/0x0007000000023276-150.dat family_berbew behavioral2/files/0x0007000000023277-154.dat family_berbew behavioral2/files/0x0007000000023278-161.dat family_berbew behavioral2/files/0x0007000000023279-168.dat family_berbew behavioral2/files/0x000700000002327a-174.dat family_berbew behavioral2/files/0x000700000002327b-179.dat family_berbew behavioral2/files/0x000700000002327c-185.dat family_berbew - Executes dropped EXE 64 IoCs
pid Process 3336 w7t59h.exe 1772 9ds3mlm.exe 800 671v7.exe 1848 un1kr.exe 2172 ddqk5.exe 1460 693l3.exe 1124 ne2um.exe 4748 w24pi6.exe 4184 hjs5rj.exe 4712 70qe3.exe 4124 iwn1e50.exe 1612 8sdmkt.exe 1132 4f4vd0.exe 1560 0937vg.exe 2448 hr7l809.exe 4212 1t69n.exe 2136 1f04xc.exe 1808 4lg4w1.exe 608 hkswc.exe 4900 te5av.exe 2484 bo4le78.exe 3900 b03cv3.exe 848 kegj6.exe 2156 4s092.exe 4248 kw847.exe 3040 aw3chum.exe 4436 67i2757.exe 4688 8or7js.exe 3912 xl0g4.exe 3676 27o7j12.exe 3608 kc1mv2.exe 4472 c9947hr.exe 1648 r630ms2.exe 720 9061m.exe 2724 21eu9a5.exe 2968 2kn7e9.exe 3400 xm2q7.exe 820 4wn11p.exe 2896 511k69g.exe 1456 3751b.exe 220 989m3.exe 232 kthip1.exe 3324 0xk3ent.exe 3944 ul5u4.exe 4752 vdkp7.exe 740 h6fj7h.exe 3404 d485e.exe 3544 logmbc.exe 952 v7qaq.exe 4584 41v00.exe 3572 9ix1u9k.exe 1636 ux6701.exe 1644 vii5qp.exe 1400 o3j9l87.exe 3740 3h7kkcw.exe 4480 35n80t.exe 2136 11a39.exe 3236 l32316.exe 2120 xnhos.exe 896 gt3uo.exe 1164 0oc135.exe 3392 l24hbw.exe 3900 28u71i4.exe 4824 039wgs.exe -
resource yara_rule behavioral2/memory/2252-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0008000000023258-3.dat upx behavioral2/memory/2252-6-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000800000002325c-9.dat upx behavioral2/memory/3336-12-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000800000002325d-13.dat upx behavioral2/memory/1772-17-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/800-18-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/800-23-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000800000002325f-24.dat upx behavioral2/files/0x0008000000023260-29.dat upx behavioral2/memory/1848-28-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023261-33.dat upx behavioral2/memory/2172-35-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023262-39.dat upx behavioral2/memory/1460-42-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1124-47-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023263-48.dat upx behavioral2/files/0x0007000000023264-51.dat upx behavioral2/memory/4748-53-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023265-57.dat upx behavioral2/memory/4184-60-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023266-63.dat upx behavioral2/memory/4712-66-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023267-69.dat upx behavioral2/memory/4124-71-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023268-75.dat upx behavioral2/memory/1132-81-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002326a-82.dat upx behavioral2/files/0x000700000002326b-89.dat upx behavioral2/memory/1560-88-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002326c-94.dat upx behavioral2/memory/2448-93-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002326d-98.dat upx behavioral2/memory/2136-103-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4212-101-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002326e-104.dat upx behavioral2/files/0x000700000002326f-110.dat upx behavioral2/files/0x0007000000023270-115.dat upx behavioral2/memory/608-117-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023271-122.dat upx behavioral2/files/0x0007000000023272-126.dat upx behavioral2/memory/2484-129-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023273-133.dat upx behavioral2/memory/848-136-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023274-138.dat upx behavioral2/memory/2156-146-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023275-144.dat upx behavioral2/files/0x0007000000023276-150.dat upx behavioral2/files/0x0007000000023277-154.dat upx behavioral2/memory/3040-157-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023278-161.dat upx behavioral2/memory/4436-160-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023279-168.dat upx behavioral2/memory/4688-167-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002327a-174.dat upx behavioral2/memory/3676-177-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3912-172-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002327b-179.dat upx behavioral2/files/0x000700000002327c-185.dat upx behavioral2/memory/4472-190-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/720-196-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1648-194-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2724-202-0x0000000000400000-0x0000000000436000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2252 wrote to memory of 3336 2252 6f4fe5060abc6aca803ae6a944a45330_NeikiAnalytics.exe 91 PID 2252 wrote to memory of 3336 2252 6f4fe5060abc6aca803ae6a944a45330_NeikiAnalytics.exe 91 PID 2252 wrote to memory of 3336 2252 6f4fe5060abc6aca803ae6a944a45330_NeikiAnalytics.exe 91 PID 3336 wrote to memory of 1772 3336 w7t59h.exe 92 PID 3336 wrote to memory of 1772 3336 w7t59h.exe 92 PID 3336 wrote to memory of 1772 3336 w7t59h.exe 92 PID 1772 wrote to memory of 800 1772 9ds3mlm.exe 93 PID 1772 wrote to memory of 800 1772 9ds3mlm.exe 93 PID 1772 wrote to memory of 800 1772 9ds3mlm.exe 93 PID 800 wrote to memory of 1848 800 671v7.exe 94 PID 800 wrote to memory of 1848 800 671v7.exe 94 PID 800 wrote to memory of 1848 800 671v7.exe 94 PID 1848 wrote to memory of 2172 1848 un1kr.exe 95 PID 1848 wrote to memory of 2172 1848 un1kr.exe 95 PID 1848 wrote to memory of 2172 1848 un1kr.exe 95 PID 2172 wrote to memory of 1460 2172 ddqk5.exe 96 PID 2172 wrote to memory of 1460 2172 ddqk5.exe 96 PID 2172 wrote to memory of 1460 2172 ddqk5.exe 96 PID 1460 wrote to memory of 1124 1460 693l3.exe 97 PID 1460 wrote to memory of 1124 1460 693l3.exe 97 PID 1460 wrote to memory of 1124 1460 693l3.exe 97 PID 1124 wrote to memory of 4748 1124 ne2um.exe 98 PID 1124 wrote to memory of 4748 1124 ne2um.exe 98 PID 1124 wrote to memory of 4748 1124 ne2um.exe 98 PID 4748 wrote to memory of 4184 4748 w24pi6.exe 99 PID 4748 wrote to memory of 4184 4748 w24pi6.exe 99 PID 4748 wrote to memory of 4184 4748 w24pi6.exe 99 PID 4184 wrote to memory of 4712 4184 hjs5rj.exe 100 PID 4184 wrote to memory of 4712 4184 hjs5rj.exe 100 PID 4184 wrote to memory of 4712 4184 hjs5rj.exe 100 PID 4712 wrote to memory of 4124 4712 70qe3.exe 101 PID 4712 wrote to memory of 4124 4712 70qe3.exe 101 PID 4712 wrote to memory of 4124 4712 70qe3.exe 101 PID 4124 wrote to memory of 1612 4124 iwn1e50.exe 102 PID 4124 wrote to memory of 1612 4124 iwn1e50.exe 102 PID 4124 wrote to memory of 1612 4124 iwn1e50.exe 102 PID 1612 wrote to memory of 1132 1612 8sdmkt.exe 103 PID 1612 wrote to memory of 1132 1612 8sdmkt.exe 103 PID 1612 wrote to memory of 1132 1612 8sdmkt.exe 103 PID 1132 wrote to memory of 1560 1132 4f4vd0.exe 104 PID 1132 wrote to memory of 1560 1132 4f4vd0.exe 104 PID 1132 wrote to memory of 1560 1132 4f4vd0.exe 104 PID 1560 wrote to memory of 2448 1560 0937vg.exe 105 PID 1560 wrote to memory of 2448 1560 0937vg.exe 105 PID 1560 wrote to memory of 2448 1560 0937vg.exe 105 PID 2448 wrote to memory of 4212 2448 hr7l809.exe 106 PID 2448 wrote to memory of 4212 2448 hr7l809.exe 106 PID 2448 wrote to memory of 4212 2448 hr7l809.exe 106 PID 4212 wrote to memory of 2136 4212 1t69n.exe 107 PID 4212 wrote to memory of 2136 4212 1t69n.exe 107 PID 4212 wrote to memory of 2136 4212 1t69n.exe 107 PID 2136 wrote to memory of 1808 2136 1f04xc.exe 108 PID 2136 wrote to memory of 1808 2136 1f04xc.exe 108 PID 2136 wrote to memory of 1808 2136 1f04xc.exe 108 PID 1808 wrote to memory of 608 1808 4lg4w1.exe 109 PID 1808 wrote to memory of 608 1808 4lg4w1.exe 109 PID 1808 wrote to memory of 608 1808 4lg4w1.exe 109 PID 608 wrote to memory of 4900 608 hkswc.exe 110 PID 608 wrote to memory of 4900 608 hkswc.exe 110 PID 608 wrote to memory of 4900 608 hkswc.exe 110 PID 4900 wrote to memory of 2484 4900 te5av.exe 111 PID 4900 wrote to memory of 2484 4900 te5av.exe 111 PID 4900 wrote to memory of 2484 4900 te5av.exe 111 PID 2484 wrote to memory of 3900 2484 bo4le78.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f4fe5060abc6aca803ae6a944a45330_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6f4fe5060abc6aca803ae6a944a45330_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\w7t59h.exec:\w7t59h.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
\??\c:\9ds3mlm.exec:\9ds3mlm.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\671v7.exec:\671v7.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
\??\c:\un1kr.exec:\un1kr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\ddqk5.exec:\ddqk5.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\693l3.exec:\693l3.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\ne2um.exec:\ne2um.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
\??\c:\w24pi6.exec:\w24pi6.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\hjs5rj.exec:\hjs5rj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\70qe3.exec:\70qe3.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\iwn1e50.exec:\iwn1e50.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\8sdmkt.exec:\8sdmkt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\4f4vd0.exec:\4f4vd0.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\0937vg.exec:\0937vg.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\hr7l809.exec:\hr7l809.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\1t69n.exec:\1t69n.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\1f04xc.exec:\1f04xc.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\4lg4w1.exec:\4lg4w1.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\hkswc.exec:\hkswc.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:608 -
\??\c:\te5av.exec:\te5av.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\bo4le78.exec:\bo4le78.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\b03cv3.exec:\b03cv3.exe23⤵
- Executes dropped EXE
PID:3900 -
\??\c:\kegj6.exec:\kegj6.exe24⤵
- Executes dropped EXE
PID:848 -
\??\c:\4s092.exec:\4s092.exe25⤵
- Executes dropped EXE
PID:2156 -
\??\c:\kw847.exec:\kw847.exe26⤵
- Executes dropped EXE
PID:4248 -
\??\c:\aw3chum.exec:\aw3chum.exe27⤵
- Executes dropped EXE
PID:3040 -
\??\c:\67i2757.exec:\67i2757.exe28⤵
- Executes dropped EXE
PID:4436 -
\??\c:\8or7js.exec:\8or7js.exe29⤵
- Executes dropped EXE
PID:4688 -
\??\c:\xl0g4.exec:\xl0g4.exe30⤵
- Executes dropped EXE
PID:3912 -
\??\c:\27o7j12.exec:\27o7j12.exe31⤵
- Executes dropped EXE
PID:3676 -
\??\c:\kc1mv2.exec:\kc1mv2.exe32⤵
- Executes dropped EXE
PID:3608 -
\??\c:\c9947hr.exec:\c9947hr.exe33⤵
- Executes dropped EXE
PID:4472 -
\??\c:\r630ms2.exec:\r630ms2.exe34⤵
- Executes dropped EXE
PID:1648 -
\??\c:\9061m.exec:\9061m.exe35⤵
- Executes dropped EXE
PID:720 -
\??\c:\21eu9a5.exec:\21eu9a5.exe36⤵
- Executes dropped EXE
PID:2724 -
\??\c:\2kn7e9.exec:\2kn7e9.exe37⤵
- Executes dropped EXE
PID:2968 -
\??\c:\xm2q7.exec:\xm2q7.exe38⤵
- Executes dropped EXE
PID:3400 -
\??\c:\4wn11p.exec:\4wn11p.exe39⤵
- Executes dropped EXE
PID:820 -
\??\c:\511k69g.exec:\511k69g.exe40⤵
- Executes dropped EXE
PID:2896 -
\??\c:\3751b.exec:\3751b.exe41⤵
- Executes dropped EXE
PID:1456 -
\??\c:\989m3.exec:\989m3.exe42⤵
- Executes dropped EXE
PID:220 -
\??\c:\kthip1.exec:\kthip1.exe43⤵
- Executes dropped EXE
PID:232 -
\??\c:\0xk3ent.exec:\0xk3ent.exe44⤵
- Executes dropped EXE
PID:3324 -
\??\c:\ul5u4.exec:\ul5u4.exe45⤵
- Executes dropped EXE
PID:3944 -
\??\c:\vdkp7.exec:\vdkp7.exe46⤵
- Executes dropped EXE
PID:4752 -
\??\c:\h6fj7h.exec:\h6fj7h.exe47⤵
- Executes dropped EXE
PID:740 -
\??\c:\d485e.exec:\d485e.exe48⤵
- Executes dropped EXE
PID:3404 -
\??\c:\logmbc.exec:\logmbc.exe49⤵
- Executes dropped EXE
PID:3544 -
\??\c:\v7qaq.exec:\v7qaq.exe50⤵
- Executes dropped EXE
PID:952 -
\??\c:\41v00.exec:\41v00.exe51⤵
- Executes dropped EXE
PID:4584 -
\??\c:\9ix1u9k.exec:\9ix1u9k.exe52⤵
- Executes dropped EXE
PID:3572 -
\??\c:\ux6701.exec:\ux6701.exe53⤵
- Executes dropped EXE
PID:1636 -
\??\c:\vii5qp.exec:\vii5qp.exe54⤵
- Executes dropped EXE
PID:1644 -
\??\c:\o3j9l87.exec:\o3j9l87.exe55⤵
- Executes dropped EXE
PID:1400 -
\??\c:\3h7kkcw.exec:\3h7kkcw.exe56⤵
- Executes dropped EXE
PID:3740 -
\??\c:\35n80t.exec:\35n80t.exe57⤵
- Executes dropped EXE
PID:4480 -
\??\c:\11a39.exec:\11a39.exe58⤵
- Executes dropped EXE
PID:2136 -
\??\c:\l32316.exec:\l32316.exe59⤵
- Executes dropped EXE
PID:3236 -
\??\c:\xnhos.exec:\xnhos.exe60⤵
- Executes dropped EXE
PID:2120 -
\??\c:\gt3uo.exec:\gt3uo.exe61⤵
- Executes dropped EXE
PID:896 -
\??\c:\0oc135.exec:\0oc135.exe62⤵
- Executes dropped EXE
PID:1164 -
\??\c:\l24hbw.exec:\l24hbw.exe63⤵
- Executes dropped EXE
PID:3392 -
\??\c:\28u71i4.exec:\28u71i4.exe64⤵
- Executes dropped EXE
PID:3900 -
\??\c:\039wgs.exec:\039wgs.exe65⤵
- Executes dropped EXE
PID:4824 -
\??\c:\d466d25.exec:\d466d25.exe66⤵PID:5068
-
\??\c:\u86im03.exec:\u86im03.exe67⤵PID:2532
-
\??\c:\g91t37k.exec:\g91t37k.exe68⤵PID:1408
-
\??\c:\3dk8bk0.exec:\3dk8bk0.exe69⤵PID:3096
-
\??\c:\9jl50.exec:\9jl50.exe70⤵PID:4436
-
\??\c:\699wlu9.exec:\699wlu9.exe71⤵PID:1948
-
\??\c:\ps9e9.exec:\ps9e9.exe72⤵PID:2960
-
\??\c:\wgg6th0.exec:\wgg6th0.exe73⤵PID:4572
-
\??\c:\26656.exec:\26656.exe74⤵PID:3980
-
\??\c:\51t38c.exec:\51t38c.exe75⤵PID:912
-
\??\c:\bn995.exec:\bn995.exe76⤵PID:3608
-
\??\c:\9l2t3.exec:\9l2t3.exe77⤵PID:1592
-
\??\c:\cru678a.exec:\cru678a.exe78⤵PID:2772
-
\??\c:\51cs4m7.exec:\51cs4m7.exe79⤵PID:2440
-
\??\c:\532usme.exec:\532usme.exe80⤵PID:4476
-
\??\c:\23rx08j.exec:\23rx08j.exe81⤵PID:4120
-
\??\c:\w631v.exec:\w631v.exe82⤵PID:4280
-
\??\c:\9tln2hu.exec:\9tln2hu.exe83⤵PID:4008
-
\??\c:\pixn03.exec:\pixn03.exe84⤵PID:8
-
\??\c:\pn7u8.exec:\pn7u8.exe85⤵PID:2592
-
\??\c:\bnk3595.exec:\bnk3595.exe86⤵PID:3512
-
\??\c:\ix61s.exec:\ix61s.exe87⤵PID:220
-
\??\c:\1qnw73v.exec:\1qnw73v.exe88⤵PID:232
-
\??\c:\kn7u3j.exec:\kn7u3j.exe89⤵PID:824
-
\??\c:\00141u.exec:\00141u.exe90⤵PID:4748
-
\??\c:\osm781.exec:\osm781.exe91⤵PID:1576
-
\??\c:\3e5i96.exec:\3e5i96.exe92⤵PID:376
-
\??\c:\747am7w.exec:\747am7w.exe93⤵PID:748
-
\??\c:\nbu50.exec:\nbu50.exe94⤵PID:1812
-
\??\c:\7sp23.exec:\7sp23.exe95⤵PID:2128
-
\??\c:\ud1c1vb.exec:\ud1c1vb.exe96⤵PID:1560
-
\??\c:\6k0c80.exec:\6k0c80.exe97⤵PID:1104
-
\??\c:\2p93j03.exec:\2p93j03.exe98⤵PID:2304
-
\??\c:\0v9s5k.exec:\0v9s5k.exe99⤵PID:4156
-
\??\c:\7n90mka.exec:\7n90mka.exe100⤵PID:4524
-
\??\c:\7t7mdn.exec:\7t7mdn.exe101⤵PID:4924
-
\??\c:\clpn8.exec:\clpn8.exe102⤵PID:1824
-
\??\c:\k1q57s.exec:\k1q57s.exe103⤵PID:4396
-
\??\c:\l17gq25.exec:\l17gq25.exe104⤵PID:4700
-
\??\c:\j389l1.exec:\j389l1.exe105⤵PID:2416
-
\??\c:\ui23dx.exec:\ui23dx.exe106⤵PID:5024
-
\??\c:\n1gm4.exec:\n1gm4.exe107⤵PID:4808
-
\??\c:\9ns32.exec:\9ns32.exe108⤵PID:3864
-
\??\c:\vsp314.exec:\vsp314.exe109⤵PID:3476
-
\??\c:\b7627a.exec:\b7627a.exe110⤵PID:4248
-
\??\c:\8335l.exec:\8335l.exe111⤵PID:2372
-
\??\c:\bmsvwrj.exec:\bmsvwrj.exe112⤵PID:552
-
\??\c:\e5x3177.exec:\e5x3177.exe113⤵PID:1964
-
\??\c:\q99584.exec:\q99584.exe114⤵PID:2960
-
\??\c:\18cumv2.exec:\18cumv2.exe115⤵PID:4848
-
\??\c:\14w6c75.exec:\14w6c75.exe116⤵PID:4464
-
\??\c:\1b9dex.exec:\1b9dex.exe117⤵PID:3204
-
\??\c:\3gtij.exec:\3gtij.exe118⤵PID:4020
-
\??\c:\jvfvx.exec:\jvfvx.exe119⤵PID:720
-
\??\c:\rp4dgh.exec:\rp4dgh.exe120⤵PID:4484
-
\??\c:\gp78g.exec:\gp78g.exe121⤵PID:528
-
\??\c:\5m1erc.exec:\5m1erc.exe122⤵PID:1848
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-