Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
27/05/2024, 14:55
Behavioral task
behavioral1
Sample
fc0abb8d5f0ca4a79e5fdf3e244ae2f0_NeikiAnalytics.exe
Resource
win7-20240419-en
6 signatures
150 seconds
General
- Target fc0abb8d5f0ca4a79e5fdf3e244ae2f0_NeikiAnalytics.exe
- Size 338KB
- Sample240527-salmeshc44
- SHA256 446a4c3e66060482bed2f056c181a68733451b8f6e5be908054d33f7e62ccf20
- MD5 fc0abb8d5f0ca4a79e5fdf3e244ae2f0
- SHA1 84d3cbe440fba5d67f7cf6c074126130fa6bf9a4
- SHA512 01b6cadfe4e55a1fd9dc24e98a6cdd5305df46f6a70dbdd8b72dfa6dae77759185f1b78b1b8fa9f214e2605efd69816f13e91853e6e9a0614fe712cf71d2c56b
- SSDEEP 6144:Kcm4FmowdHoSKAszBd+aQz0192lTk1ycUkpCnAUo0Leu2tZGnOiQ3jiDQIZbdVnR:U4wFHoSK1zBjA892lY196AUo0LX2tZqD
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4864-8-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1884-6-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3388-16-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4592-18-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4452-29-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/380-30-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4232-65-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5024-83-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3976-89-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2172-98-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5080-126-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2412-174-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/876-199-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4316-203-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4564-213-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/380-241-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3172-258-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2764-262-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4512-297-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1848-307-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2880-332-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4332-344-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1136-351-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1736-356-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4728-369-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1920-325-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/936-324-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1488-287-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/920-263-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1504-228-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4448-217-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/880-207-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4908-179-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4188-167-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4332-161-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2840-155-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/936-142-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4008-136-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5104-124-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1380-118-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1128-96-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3972-72-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1400-71-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3172-58-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4764-52-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/828-41-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2212-382-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3248-386-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1832-405-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4528-410-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/800-431-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1968-435-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1128-461-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1764-467-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2880-505-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2456-527-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2520-570-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3832-574-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3492-656-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1908-675-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2908-677-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3524-689-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2704-890-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1908-972-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon - Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x000800000002342a-3.dat family_berbew behavioral2/files/0x000800000002342d-10.dat family_berbew behavioral2/files/0x0007000000023432-13.dat family_berbew behavioral2/files/0x0007000000023433-22.dat family_berbew behavioral2/files/0x0007000000023434-28.dat family_berbew behavioral2/files/0x0007000000023435-33.dat family_berbew behavioral2/files/0x0007000000023436-38.dat family_berbew behavioral2/files/0x0007000000023437-46.dat family_berbew behavioral2/files/0x0007000000023438-53.dat family_berbew behavioral2/files/0x0007000000023439-59.dat family_berbew behavioral2/files/0x000700000002343a-63.dat family_berbew behavioral2/files/0x000700000002343b-69.dat family_berbew behavioral2/files/0x000700000002343d-81.dat family_berbew behavioral2/files/0x0007000000023441-105.dat family_berbew behavioral2/files/0x0007000000023442-112.dat family_berbew behavioral2/files/0x0007000000023444-122.dat family_berbew behavioral2/files/0x0007000000023445-130.dat family_berbew behavioral2/files/0x0007000000023446-137.dat family_berbew behavioral2/files/0x0007000000023447-143.dat family_berbew behavioral2/files/0x0003000000021ebc-152.dat family_berbew behavioral2/files/0x000a000000023390-166.dat family_berbew behavioral2/files/0x0007000000023449-184.dat family_berbew behavioral2/files/0x000700000002344a-189.dat family_berbew behavioral2/files/0x000a000000023392-178.dat family_berbew behavioral2/files/0x000800000002342e-171.dat family_berbew behavioral2/files/0x0003000000021e1b-160.dat family_berbew behavioral2/files/0x0007000000023448-147.dat family_berbew behavioral2/files/0x0007000000023443-119.dat family_berbew behavioral2/files/0x0007000000023440-102.dat family_berbew behavioral2/files/0x000700000002343f-94.dat family_berbew behavioral2/files/0x000700000002343e-90.dat family_berbew behavioral2/files/0x000700000002343c-77.dat family_berbew - Executes dropped EXE 64 IoCs
pid Process 4864 tbbthh.exe 3388 dvpdd.exe 4592 9rrrrxx.exe 4452 tnhtbt.exe 380 ddjpd.exe 828 vpvvj.exe 4968 fxxrlff.exe 4764 bthhhh.exe 3172 vvpvv.exe 4232 3ppdp.exe 1400 3llfllr.exe 3972 hbtntn.exe 5024 jpvjd.exe 3976 rflxlfr.exe 2172 9flfxxr.exe 1128 9nnhhh.exe 4280 1jppj.exe 1888 frxrrrr.exe 1380 hhtnnh.exe 5080 bhbhtn.exe 5104 7vpjd.exe 4008 9frlxxr.exe 936 ffxfxff.exe 3004 tnhbtn.exe 2840 djvjj.exe 3924 frrxrrx.exe 4332 9ttnbb.exe 4188 pvvpj.exe 2412 5rxrlrr.exe 4908 lrrfxrf.exe 1828 hhttnh.exe 4816 vpvpj.exe 1656 rxlfxrl.exe 876 htnbnh.exe 4316 pjjpp.exe 880 7ddpd.exe 4564 fxlfxxf.exe 4448 jjvvv.exe 3208 xllxlxr.exe 5116 rrrrrrr.exe 1504 nnbttt.exe 5044 vjdvp.exe 4528 1jjjv.exe 4392 ffffllr.exe 380 bthbhh.exe 856 5hnhnn.exe 4508 9vdpj.exe 2768 vjjdd.exe 3936 rfffxxx.exe 3172 hhhthh.exe 2764 nnhbnn.exe 920 jdjdv.exe 1844 jdjdv.exe 1400 xrrxffl.exe 2704 fxllffr.exe 1464 thhbtb.exe 640 7hnhtn.exe 3536 jvdvv.exe 3976 jvvvp.exe 1488 9rxrxrx.exe 2920 btttnn.exe 4512 btthnt.exe 4280 1jdvp.exe 4928 vjvvv.exe -
resource yara_rule behavioral2/memory/1884-0-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000800000002342a-3.dat upx behavioral2/memory/4864-8-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1884-6-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000800000002342d-10.dat upx behavioral2/files/0x0007000000023432-13.dat upx behavioral2/memory/3388-16-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4592-18-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023433-22.dat upx behavioral2/memory/4452-29-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023434-28.dat upx behavioral2/memory/380-30-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023435-33.dat upx behavioral2/files/0x0007000000023436-38.dat upx behavioral2/memory/4764-47-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023437-46.dat upx behavioral2/files/0x0007000000023438-53.dat upx behavioral2/files/0x0007000000023439-59.dat upx behavioral2/files/0x000700000002343a-63.dat upx behavioral2/memory/4232-65-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000700000002343b-69.dat upx behavioral2/files/0x000700000002343d-81.dat upx behavioral2/memory/5024-83-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3976-89-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2172-98-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023441-105.dat upx behavioral2/files/0x0007000000023442-112.dat upx behavioral2/files/0x0007000000023444-122.dat upx behavioral2/memory/5080-126-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023445-130.dat upx behavioral2/files/0x0007000000023446-137.dat upx behavioral2/files/0x0007000000023447-143.dat upx behavioral2/files/0x0003000000021ebc-152.dat upx behavioral2/files/0x000a000000023390-166.dat upx behavioral2/memory/2412-174-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023449-184.dat upx behavioral2/files/0x000700000002344a-189.dat upx behavioral2/memory/4816-190-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/876-199-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4316-203-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4564-208-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4564-213-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1504-224-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/380-241-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3172-258-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2764-262-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4512-297-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1848-307-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1576-333-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2880-332-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4332-344-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1736-352-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1136-351-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1736-356-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4728-369-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4332-340-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1920-325-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/936-324-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3024-314-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1488-287-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2704-271-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/920-263-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3172-254-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1504-228-0x0000000000400000-0x0000000000428000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1884 wrote to memory of 4864 1884 fc0abb8d5f0ca4a79e5fdf3e244ae2f0_NeikiAnalytics.exe 82 PID 1884 wrote to memory of 4864 1884 fc0abb8d5f0ca4a79e5fdf3e244ae2f0_NeikiAnalytics.exe 82 PID 1884 wrote to memory of 4864 1884 fc0abb8d5f0ca4a79e5fdf3e244ae2f0_NeikiAnalytics.exe 82 PID 4864 wrote to memory of 3388 4864 tbbthh.exe 83 PID 4864 wrote to memory of 3388 4864 tbbthh.exe 83 PID 4864 wrote to memory of 3388 4864 tbbthh.exe 83 PID 3388 wrote to memory of 4592 3388 dvpdd.exe 84 PID 3388 wrote to memory of 4592 3388 dvpdd.exe 84 PID 3388 wrote to memory of 4592 3388 dvpdd.exe 84 PID 4592 wrote to memory of 4452 4592 9rrrrxx.exe 85 PID 4592 wrote to memory of 4452 4592 9rrrrxx.exe 85 PID 4592 wrote to memory of 4452 4592 9rrrrxx.exe 85 PID 4452 wrote to memory of 380 4452 tnhtbt.exe 86 PID 4452 wrote to memory of 380 4452 tnhtbt.exe 86 PID 4452 wrote to memory of 380 4452 tnhtbt.exe 86 PID 380 wrote to memory of 828 380 ddjpd.exe 88 PID 380 wrote to memory of 828 380 ddjpd.exe 88 PID 380 wrote to memory of 828 380 ddjpd.exe 88 PID 828 wrote to memory of 4968 828 vpvvj.exe 89 PID 828 wrote to memory of 4968 828 vpvvj.exe 89 PID 828 wrote to memory of 4968 828 vpvvj.exe 89 PID 4968 wrote to memory of 4764 4968 fxxrlff.exe 90 PID 4968 wrote to memory of 4764 4968 fxxrlff.exe 90 PID 4968 wrote to memory of 4764 4968 fxxrlff.exe 90 PID 4764 wrote to memory of 3172 4764 bthhhh.exe 92 PID 4764 wrote to memory of 3172 4764 bthhhh.exe 92 PID 4764 wrote to memory of 3172 4764 bthhhh.exe 92 PID 3172 wrote to memory of 4232 3172 vvpvv.exe 93 PID 3172 wrote to memory of 4232 3172 vvpvv.exe 93 PID 3172 wrote to memory of 4232 3172 vvpvv.exe 93 PID 4232 wrote to memory of 1400 4232 3ppdp.exe 94 PID 4232 wrote to memory of 1400 4232 3ppdp.exe 94 PID 4232 wrote to memory of 1400 4232 3ppdp.exe 94 PID 1400 wrote to memory of 3972 1400 3llfllr.exe 96 PID 1400 wrote to memory of 3972 1400 3llfllr.exe 96 PID 1400 wrote to memory of 3972 1400 3llfllr.exe 96 PID 3972 wrote to memory of 5024 3972 hbtntn.exe 97 PID 3972 wrote to memory of 5024 3972 hbtntn.exe 97 PID 3972 wrote to memory of 5024 3972 hbtntn.exe 97 PID 5024 wrote to memory of 3976 5024 jpvjd.exe 98 PID 5024 wrote to memory of 3976 5024 jpvjd.exe 98 PID 5024 wrote to memory of 3976 5024 jpvjd.exe 98 PID 3976 wrote to memory of 2172 3976 rflxlfr.exe 99 PID 3976 wrote to memory of 2172 3976 rflxlfr.exe 99 PID 3976 wrote to memory of 2172 3976 rflxlfr.exe 99 PID 2172 wrote to memory of 1128 2172 9flfxxr.exe 100 PID 2172 wrote to memory of 1128 2172 9flfxxr.exe 100 PID 2172 wrote to memory of 1128 2172 9flfxxr.exe 100 PID 1128 wrote to memory of 4280 1128 9nnhhh.exe 101 PID 1128 wrote to memory of 4280 1128 9nnhhh.exe 101 PID 1128 wrote to memory of 4280 1128 9nnhhh.exe 101 PID 4280 wrote to memory of 1888 4280 1jppj.exe 102 PID 4280 wrote to memory of 1888 4280 1jppj.exe 102 PID 4280 wrote to memory of 1888 4280 1jppj.exe 102 PID 1888 wrote to memory of 1380 1888 frxrrrr.exe 103 PID 1888 wrote to memory of 1380 1888 frxrrrr.exe 103 PID 1888 wrote to memory of 1380 1888 frxrrrr.exe 103 PID 1380 wrote to memory of 5080 1380 hhtnnh.exe 104 PID 1380 wrote to memory of 5080 1380 hhtnnh.exe 104 PID 1380 wrote to memory of 5080 1380 hhtnnh.exe 104 PID 5080 wrote to memory of 5104 5080 bhbhtn.exe 105 PID 5080 wrote to memory of 5104 5080 bhbhtn.exe 105 PID 5080 wrote to memory of 5104 5080 bhbhtn.exe 105 PID 5104 wrote to memory of 4008 5104 7vpjd.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc0abb8d5f0ca4a79e5fdf3e244ae2f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\fc0abb8d5f0ca4a79e5fdf3e244ae2f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\tbbthh.exec:\tbbthh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\dvpdd.exec:\dvpdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\9rrrrxx.exec:\9rrrrxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\tnhtbt.exec:\tnhtbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
\??\c:\ddjpd.exec:\ddjpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\vpvvj.exec:\vpvvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
\??\c:\fxxrlff.exec:\fxxrlff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\bthhhh.exec:\bthhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\vvpvv.exec:\vvpvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\3ppdp.exec:\3ppdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\3llfllr.exec:\3llfllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\hbtntn.exec:\hbtntn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\jpvjd.exec:\jpvjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\rflxlfr.exec:\rflxlfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\9flfxxr.exec:\9flfxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\9nnhhh.exec:\9nnhhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\1jppj.exec:\1jppj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\frxrrrr.exec:\frxrrrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\hhtnnh.exec:\hhtnnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\bhbhtn.exec:\bhbhtn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\7vpjd.exec:\7vpjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\9frlxxr.exec:\9frlxxr.exe23⤵
- Executes dropped EXE
PID:4008 -
\??\c:\ffxfxff.exec:\ffxfxff.exe24⤵
- Executes dropped EXE
PID:936 -
\??\c:\tnhbtn.exec:\tnhbtn.exe25⤵
- Executes dropped EXE
PID:3004 -
\??\c:\djvjj.exec:\djvjj.exe26⤵
- Executes dropped EXE
PID:2840 -
\??\c:\frrxrrx.exec:\frrxrrx.exe27⤵
- Executes dropped EXE
PID:3924 -
\??\c:\9ttnbb.exec:\9ttnbb.exe28⤵
- Executes dropped EXE
PID:4332 -
\??\c:\pvvpj.exec:\pvvpj.exe29⤵
- Executes dropped EXE
PID:4188 -
\??\c:\5rxrlrr.exec:\5rxrlrr.exe30⤵
- Executes dropped EXE
PID:2412 -
\??\c:\lrrfxrf.exec:\lrrfxrf.exe31⤵
- Executes dropped EXE
PID:4908 -
\??\c:\hhttnh.exec:\hhttnh.exe32⤵
- Executes dropped EXE
PID:1828 -
\??\c:\vpvpj.exec:\vpvpj.exe33⤵
- Executes dropped EXE
PID:4816 -
\??\c:\rxlfxrl.exec:\rxlfxrl.exe34⤵
- Executes dropped EXE
PID:1656 -
\??\c:\htnbnh.exec:\htnbnh.exe35⤵
- Executes dropped EXE
PID:876 -
\??\c:\pjjpp.exec:\pjjpp.exe36⤵
- Executes dropped EXE
PID:4316 -
\??\c:\7ddpd.exec:\7ddpd.exe37⤵
- Executes dropped EXE
PID:880 -
\??\c:\fxlfxxf.exec:\fxlfxxf.exe38⤵
- Executes dropped EXE
PID:4564 -
\??\c:\jjvvv.exec:\jjvvv.exe39⤵
- Executes dropped EXE
PID:4448 -
\??\c:\xllxlxr.exec:\xllxlxr.exe40⤵
- Executes dropped EXE
PID:3208 -
\??\c:\rrrrrrr.exec:\rrrrrrr.exe41⤵
- Executes dropped EXE
PID:5116 -
\??\c:\nnbttt.exec:\nnbttt.exe42⤵
- Executes dropped EXE
PID:1504 -
\??\c:\vjdvp.exec:\vjdvp.exe43⤵
- Executes dropped EXE
PID:5044 -
\??\c:\1jjjv.exec:\1jjjv.exe44⤵
- Executes dropped EXE
PID:4528 -
\??\c:\ffffllr.exec:\ffffllr.exe45⤵
- Executes dropped EXE
PID:4392 -
\??\c:\bthbhh.exec:\bthbhh.exe46⤵
- Executes dropped EXE
PID:380 -
\??\c:\5hnhnn.exec:\5hnhnn.exe47⤵
- Executes dropped EXE
PID:856 -
\??\c:\9vdpj.exec:\9vdpj.exe48⤵
- Executes dropped EXE
PID:4508 -
\??\c:\vjjdd.exec:\vjjdd.exe49⤵
- Executes dropped EXE
PID:2768 -
\??\c:\rfffxxx.exec:\rfffxxx.exe50⤵
- Executes dropped EXE
PID:3936 -
\??\c:\hhhthh.exec:\hhhthh.exe51⤵
- Executes dropped EXE
PID:3172 -
\??\c:\nnhbnn.exec:\nnhbnn.exe52⤵
- Executes dropped EXE
PID:2764 -
\??\c:\jdjdv.exec:\jdjdv.exe53⤵
- Executes dropped EXE
PID:920 -
\??\c:\jdjdv.exec:\jdjdv.exe54⤵
- Executes dropped EXE
PID:1844 -
\??\c:\xrrxffl.exec:\xrrxffl.exe55⤵
- Executes dropped EXE
PID:1400 -
\??\c:\fxllffr.exec:\fxllffr.exe56⤵
- Executes dropped EXE
PID:2704 -
\??\c:\thhbtb.exec:\thhbtb.exe57⤵
- Executes dropped EXE
PID:1464 -
\??\c:\7hnhtn.exec:\7hnhtn.exe58⤵
- Executes dropped EXE
PID:640 -
\??\c:\jvdvv.exec:\jvdvv.exe59⤵
- Executes dropped EXE
PID:3536 -
\??\c:\jvvvp.exec:\jvvvp.exe60⤵
- Executes dropped EXE
PID:3976 -
\??\c:\9rxrxrx.exec:\9rxrxrx.exe61⤵
- Executes dropped EXE
PID:1488 -
\??\c:\btttnn.exec:\btttnn.exe62⤵
- Executes dropped EXE
PID:2920 -
\??\c:\btthnt.exec:\btthnt.exe63⤵
- Executes dropped EXE
PID:4512 -
\??\c:\1jdvp.exec:\1jdvp.exe64⤵
- Executes dropped EXE
PID:4280 -
\??\c:\vjvvv.exec:\vjvvv.exe65⤵
- Executes dropped EXE
PID:4928 -
\??\c:\frrllll.exec:\frrllll.exe66⤵PID:1848
-
\??\c:\3btnhn.exec:\3btnhn.exe67⤵PID:3504
-
\??\c:\btnbtb.exec:\btnbtb.exe68⤵PID:752
-
\??\c:\jvjdv.exec:\jvjdv.exe69⤵PID:3024
-
\??\c:\dddpd.exec:\dddpd.exe70⤵PID:4008
-
\??\c:\lflxrlr.exec:\lflxrlr.exe71⤵PID:936
-
\??\c:\fffrlxl.exec:\fffrlxl.exe72⤵PID:1920
-
\??\c:\hntnnn.exec:\hntnnn.exe73⤵PID:2880
-
\??\c:\tbhbbb.exec:\tbhbbb.exe74⤵PID:1576
-
\??\c:\7vvpj.exec:\7vvpj.exe75⤵PID:2856
-
\??\c:\lffrlfr.exec:\lffrlfr.exe76⤵PID:4332
-
\??\c:\lrxxlfr.exec:\lrxxlfr.exe77⤵PID:4188
-
\??\c:\7hnntb.exec:\7hnntb.exe78⤵PID:1136
-
\??\c:\3nnbtt.exec:\3nnbtt.exe79⤵PID:1736
-
\??\c:\djpjd.exec:\djpjd.exe80⤵PID:3116
-
\??\c:\pvdvd.exec:\pvdvd.exe81⤵PID:4400
-
\??\c:\lflxxrx.exec:\lflxxrx.exe82⤵PID:3932
-
\??\c:\7flxlfr.exec:\7flxlfr.exe83⤵PID:4728
-
\??\c:\tbhbtb.exec:\tbhbtb.exe84⤵PID:2688
-
\??\c:\dpvpj.exec:\dpvpj.exe85⤵PID:4304
-
\??\c:\ddvpp.exec:\ddvpp.exe86⤵PID:2596
-
\??\c:\xrfxxrr.exec:\xrfxxrr.exe87⤵PID:2212
-
\??\c:\btbnhh.exec:\btbnhh.exe88⤵PID:3248
-
\??\c:\3pddd.exec:\3pddd.exe89⤵PID:3204
-
\??\c:\1lllflr.exec:\1lllflr.exe90⤵PID:4412
-
\??\c:\bthbtn.exec:\bthbtn.exe91⤵PID:4864
-
\??\c:\dvvvp.exec:\dvvvp.exe92⤵PID:3208
-
\??\c:\xrfxffl.exec:\xrfxffl.exe93⤵PID:4736
-
\??\c:\hhtntt.exec:\hhtntt.exe94⤵PID:1832
-
\??\c:\hbnnhh.exec:\hbnnhh.exe95⤵PID:5044
-
\??\c:\vjpdj.exec:\vjpdj.exe96⤵PID:4528
-
\??\c:\lrlffxx.exec:\lrlffxx.exe97⤵PID:3152
-
\??\c:\5hnhbb.exec:\5hnhbb.exe98⤵PID:4916
-
\??\c:\ntnhhb.exec:\ntnhhb.exe99⤵PID:4432
-
\??\c:\vjpjp.exec:\vjpjp.exe100⤵PID:1164
-
\??\c:\rrlfxxr.exec:\rrlfxxr.exe101⤵PID:2028
-
\??\c:\thhhbb.exec:\thhhbb.exe102⤵PID:800
-
\??\c:\jvdvv.exec:\jvdvv.exe103⤵PID:3052
-
\??\c:\rllfxff.exec:\rllfxff.exe104⤵PID:1968
-
\??\c:\rxrlffr.exec:\rxrlffr.exe105⤵PID:3220
-
\??\c:\hbnnhb.exec:\hbnnhb.exe106⤵PID:3080
-
\??\c:\7jvpp.exec:\7jvpp.exe107⤵PID:3928
-
\??\c:\xxxffll.exec:\xxxffll.exe108⤵PID:5024
-
\??\c:\1xlfllf.exec:\1xlfllf.exe109⤵PID:1552
-
\??\c:\thnhht.exec:\thnhht.exe110⤵PID:2832
-
\??\c:\7jjpj.exec:\7jjpj.exe111⤵PID:2172
-
\??\c:\9rrlffx.exec:\9rrlffx.exe112⤵PID:1128
-
\??\c:\7nnhnh.exec:\7nnhnh.exe113⤵PID:1764
-
\??\c:\jvvvp.exec:\jvvvp.exe114⤵PID:1192
-
\??\c:\rxxrfrl.exec:\rxxrfrl.exe115⤵PID:1888
-
\??\c:\bnnhhb.exec:\bnnhhb.exe116⤵PID:3324
-
\??\c:\dvdvj.exec:\dvdvj.exe117⤵PID:2092
-
\??\c:\jjjvp.exec:\jjjvp.exe118⤵PID:4160
-
\??\c:\3lrlllf.exec:\3lrlllf.exe119⤵PID:1356
-
\??\c:\5tbtnt.exec:\5tbtnt.exe120⤵PID:3676
-
\??\c:\jpvvv.exec:\jpvvv.exe121⤵PID:3648
-
\??\c:\xxfxrxr.exec:\xxfxrxr.exe122⤵PID:4868
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-