Analysis
-
max time kernel
156s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
16/10/2023, 18:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.9190d1cdbd42698864fce3db51cd19c0.exe
Resource
win7-20230831-en
5 signatures
150 seconds
General
-
Target
NEAS.9190d1cdbd42698864fce3db51cd19c0.exe
-
Size
338KB
-
MD5
9190d1cdbd42698864fce3db51cd19c0
-
SHA1
aff22caa76cd45a9f99038c316bf86374cea9331
-
SHA256
e3f7d7b645d00638f392f0c35a3c751e6094bb90986b1978f939f5dd3b7029c5
-
SHA512
1646a20204ac6ee07b444cb797ddde37c896b96c6e96e594213e1d2d141c0197186d677a646051c0e934d63807801293b4304c3e06e41531168d24862b47427f
-
SSDEEP
3072:PhOm2sI93UufdC67cihfmCiiiXAsACF486jC1IjJV:Pcm7ImGddXtWrXD486jCg
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4968-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5012-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4172-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4164-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2516-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/536-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4528-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1776-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/908-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/812-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4864-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2036-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/816-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3672-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1296-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2172-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2256-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1020-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2748-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1300-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2092-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2168-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/956-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4336-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3696-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/804-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5032-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1536-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2744-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/392-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4172-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4516-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2760-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3000-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2764-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1492-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3340-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1616-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-314-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4916-325-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-356-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3020-376-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1012-381-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3548-426-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4516-429-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3332-441-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-464-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3656-473-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1612-524-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4800-526-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1296-630-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4168-636-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2100-656-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3248-790-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/524-874-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4948-1323-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/676-1477-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1828-2633-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4164 mwx8w8.exe 4172 9v6x12d.exe 5012 60oo77h.exe 3628 0tjt2.exe 536 e2g75.exe 4528 6xq8p7a.exe 2516 92aasi3.exe 3576 8ewauie.exe 1776 30vsb.exe 908 mqc8a.exe 812 n7k021.exe 2036 nk2863x.exe 4864 kw177.exe 4892 9v1c7.exe 3948 3ndi00.exe 3524 gt4m46.exe 816 asr6m.exe 3776 pp609c.exe 3672 u9q5k.exe 1296 thq6r3.exe 2172 x3791.exe 4916 5htf6n.exe 2256 d8f0j.exe 1020 7x2vq8t.exe 2092 f71u73.exe 1300 4mf67i.exe 2748 g2357jj.exe 4264 31777o.exe 2168 e2004.exe 1384 83s1q8.exe 956 2v8a54.exe 3696 2543175.exe 4336 dr8cx5.exe 4116 vp3cg.exe 804 5k41w1e.exe 4636 u3917.exe 3668 gt7ue28.exe 948 aum86c.exe 4504 no6ms1.exe 4212 m43379.exe 5032 9fw7q9.exe 4400 i61dm.exe 1248 jcr58c.exe 5008 721hw.exe 1536 i603j.exe 2148 4i0b3gh.exe 3264 luqvx1.exe 2744 gea6c9.exe 392 d4u24.exe 4220 v2uj4i.exe 4172 g37wq7.exe 4860 hw5cx.exe 3628 v68n8a.exe 4516 7lc18.exe 2584 co3597.exe 2760 seke3.exe 3480 cxesmok.exe 4368 x8xux30.exe 4420 22521.exe 4556 57cb2.exe 3892 f4g2st2.exe 3000 0b48nf.exe 2764 dk628x.exe 4208 f2380b3.exe -
resource yara_rule behavioral2/memory/4968-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5012-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4172-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4164-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/536-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/536-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1776-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/908-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/812-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2036-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/816-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1296-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1296-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2172-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2256-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1020-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4264-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2748-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1300-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2092-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2168-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/956-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4336-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/804-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5032-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1536-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2744-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/392-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4172-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4516-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2760-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3000-275-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2764-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1492-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3340-295-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1616-304-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-314-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4916-325-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2664-328-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2852-348-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-356-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-376-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1012-381-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4164-412-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3548-426-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4516-429-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3332-441-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-464-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-468-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-473-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1612-524-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4800-526-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1296-630-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4968 wrote to memory of 4164 4968 NEAS.9190d1cdbd42698864fce3db51cd19c0.exe 82 PID 4968 wrote to memory of 4164 4968 NEAS.9190d1cdbd42698864fce3db51cd19c0.exe 82 PID 4968 wrote to memory of 4164 4968 NEAS.9190d1cdbd42698864fce3db51cd19c0.exe 82 PID 4164 wrote to memory of 4172 4164 mwx8w8.exe 83 PID 4164 wrote to memory of 4172 4164 mwx8w8.exe 83 PID 4164 wrote to memory of 4172 4164 mwx8w8.exe 83 PID 4172 wrote to memory of 5012 4172 9v6x12d.exe 85 PID 4172 wrote to memory of 5012 4172 9v6x12d.exe 85 PID 4172 wrote to memory of 5012 4172 9v6x12d.exe 85 PID 5012 wrote to memory of 3628 5012 60oo77h.exe 84 PID 5012 wrote to memory of 3628 5012 60oo77h.exe 84 PID 5012 wrote to memory of 3628 5012 60oo77h.exe 84 PID 3628 wrote to memory of 536 3628 0tjt2.exe 86 PID 3628 wrote to memory of 536 3628 0tjt2.exe 86 PID 3628 wrote to memory of 536 3628 0tjt2.exe 86 PID 536 wrote to memory of 4528 536 e2g75.exe 87 PID 536 wrote to memory of 4528 536 e2g75.exe 87 PID 536 wrote to memory of 4528 536 e2g75.exe 87 PID 4528 wrote to memory of 2516 4528 6xq8p7a.exe 91 PID 4528 wrote to memory of 2516 4528 6xq8p7a.exe 91 PID 4528 wrote to memory of 2516 4528 6xq8p7a.exe 91 PID 2516 wrote to memory of 3576 2516 92aasi3.exe 88 PID 2516 wrote to memory of 3576 2516 92aasi3.exe 88 PID 2516 wrote to memory of 3576 2516 92aasi3.exe 88 PID 3576 wrote to memory of 1776 3576 8ewauie.exe 89 PID 3576 wrote to memory of 1776 3576 8ewauie.exe 89 PID 3576 wrote to memory of 1776 3576 8ewauie.exe 89 PID 1776 wrote to memory of 908 1776 30vsb.exe 92 PID 1776 wrote to memory of 908 1776 30vsb.exe 92 PID 1776 wrote to memory of 908 1776 30vsb.exe 92 PID 908 wrote to memory of 812 908 mqc8a.exe 93 PID 908 wrote to memory of 812 908 mqc8a.exe 93 PID 908 wrote to memory of 812 908 mqc8a.exe 93 PID 812 wrote to memory of 2036 812 n7k021.exe 94 PID 812 wrote to memory of 2036 812 n7k021.exe 94 PID 812 wrote to memory of 2036 812 n7k021.exe 94 PID 2036 wrote to memory of 4864 2036 nk2863x.exe 95 PID 2036 wrote to memory of 4864 2036 nk2863x.exe 95 PID 2036 wrote to memory of 4864 2036 nk2863x.exe 95 PID 4864 wrote to memory of 4892 4864 kw177.exe 96 PID 4864 wrote to memory of 4892 4864 kw177.exe 96 PID 4864 wrote to memory of 4892 4864 kw177.exe 96 PID 4892 wrote to memory of 3948 4892 9v1c7.exe 97 PID 4892 wrote to memory of 3948 4892 9v1c7.exe 97 PID 4892 wrote to memory of 3948 4892 9v1c7.exe 97 PID 3948 wrote to memory of 3524 3948 3ndi00.exe 98 PID 3948 wrote to memory of 3524 3948 3ndi00.exe 98 PID 3948 wrote to memory of 3524 3948 3ndi00.exe 98 PID 3524 wrote to memory of 816 3524 gt4m46.exe 99 PID 3524 wrote to memory of 816 3524 gt4m46.exe 99 PID 3524 wrote to memory of 816 3524 gt4m46.exe 99 PID 816 wrote to memory of 3776 816 asr6m.exe 100 PID 816 wrote to memory of 3776 816 asr6m.exe 100 PID 816 wrote to memory of 3776 816 asr6m.exe 100 PID 3776 wrote to memory of 3672 3776 pp609c.exe 101 PID 3776 wrote to memory of 3672 3776 pp609c.exe 101 PID 3776 wrote to memory of 3672 3776 pp609c.exe 101 PID 3672 wrote to memory of 1296 3672 u9q5k.exe 102 PID 3672 wrote to memory of 1296 3672 u9q5k.exe 102 PID 3672 wrote to memory of 1296 3672 u9q5k.exe 102 PID 1296 wrote to memory of 2172 1296 thq6r3.exe 103 PID 1296 wrote to memory of 2172 1296 thq6r3.exe 103 PID 1296 wrote to memory of 2172 1296 thq6r3.exe 103 PID 2172 wrote to memory of 4916 2172 x3791.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.9190d1cdbd42698864fce3db51cd19c0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.9190d1cdbd42698864fce3db51cd19c0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\mwx8w8.exec:\mwx8w8.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
\??\c:\9v6x12d.exec:\9v6x12d.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\60oo77h.exec:\60oo77h.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012
-
-
-
-
\??\c:\0tjt2.exec:\0tjt2.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\e2g75.exec:\e2g75.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\6xq8p7a.exec:\6xq8p7a.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\92aasi3.exec:\92aasi3.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516
-
-
-
-
\??\c:\8ewauie.exec:\8ewauie.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\30vsb.exec:\30vsb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\mqc8a.exec:\mqc8a.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
\??\c:\n7k021.exec:\n7k021.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\nk2863x.exec:\nk2863x.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\kw177.exec:\kw177.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\9v1c7.exec:\9v1c7.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\3ndi00.exec:\3ndi00.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\gt4m46.exec:\gt4m46.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\asr6m.exec:\asr6m.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
\??\c:\pp609c.exec:\pp609c.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\u9q5k.exec:\u9q5k.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\thq6r3.exec:\thq6r3.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\x3791.exec:\x3791.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\5htf6n.exec:\5htf6n.exe15⤵
- Executes dropped EXE
PID:4916 -
\??\c:\d8f0j.exec:\d8f0j.exe16⤵
- Executes dropped EXE
PID:2256 -
\??\c:\7x2vq8t.exec:\7x2vq8t.exe17⤵
- Executes dropped EXE
PID:1020 -
\??\c:\f71u73.exec:\f71u73.exe18⤵
- Executes dropped EXE
PID:2092 -
\??\c:\4mf67i.exec:\4mf67i.exe19⤵
- Executes dropped EXE
PID:1300 -
\??\c:\g2357jj.exec:\g2357jj.exe20⤵
- Executes dropped EXE
PID:2748 -
\??\c:\31777o.exec:\31777o.exe21⤵
- Executes dropped EXE
PID:4264
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\83s1q8.exec:\83s1q8.exe1⤵
- Executes dropped EXE
PID:1384 -
\??\c:\2v8a54.exec:\2v8a54.exe2⤵
- Executes dropped EXE
PID:956 -
\??\c:\2543175.exec:\2543175.exe3⤵
- Executes dropped EXE
PID:3696 -
\??\c:\dr8cx5.exec:\dr8cx5.exe4⤵
- Executes dropped EXE
PID:4336 -
\??\c:\vp3cg.exec:\vp3cg.exe5⤵
- Executes dropped EXE
PID:4116 -
\??\c:\5k41w1e.exec:\5k41w1e.exe6⤵
- Executes dropped EXE
PID:804 -
\??\c:\u3917.exec:\u3917.exe7⤵
- Executes dropped EXE
PID:4636 -
\??\c:\gt7ue28.exec:\gt7ue28.exe8⤵
- Executes dropped EXE
PID:3668 -
\??\c:\aum86c.exec:\aum86c.exe9⤵
- Executes dropped EXE
PID:948 -
\??\c:\no6ms1.exec:\no6ms1.exe10⤵
- Executes dropped EXE
PID:4504 -
\??\c:\m43379.exec:\m43379.exe11⤵
- Executes dropped EXE
PID:4212 -
\??\c:\9fw7q9.exec:\9fw7q9.exe12⤵
- Executes dropped EXE
PID:5032 -
\??\c:\i61dm.exec:\i61dm.exe13⤵
- Executes dropped EXE
PID:4400 -
\??\c:\jcr58c.exec:\jcr58c.exe14⤵
- Executes dropped EXE
PID:1248 -
\??\c:\721hw.exec:\721hw.exe15⤵
- Executes dropped EXE
PID:5008 -
\??\c:\i603j.exec:\i603j.exe16⤵
- Executes dropped EXE
PID:1536 -
\??\c:\4i0b3gh.exec:\4i0b3gh.exe17⤵
- Executes dropped EXE
PID:2148 -
\??\c:\luqvx1.exec:\luqvx1.exe18⤵
- Executes dropped EXE
PID:3264 -
\??\c:\gea6c9.exec:\gea6c9.exe19⤵
- Executes dropped EXE
PID:2744 -
\??\c:\3nvfr2.exec:\3nvfr2.exe20⤵PID:4468
-
\??\c:\d4u24.exec:\d4u24.exe21⤵
- Executes dropped EXE
PID:392 -
\??\c:\v2uj4i.exec:\v2uj4i.exe22⤵
- Executes dropped EXE
PID:4220 -
\??\c:\g37wq7.exec:\g37wq7.exe23⤵
- Executes dropped EXE
PID:4172 -
\??\c:\hw5cx.exec:\hw5cx.exe24⤵
- Executes dropped EXE
PID:4860 -
\??\c:\v68n8a.exec:\v68n8a.exe25⤵
- Executes dropped EXE
PID:3628 -
\??\c:\7lc18.exec:\7lc18.exe26⤵
- Executes dropped EXE
PID:4516 -
\??\c:\co3597.exec:\co3597.exe27⤵
- Executes dropped EXE
PID:2584 -
\??\c:\seke3.exec:\seke3.exe28⤵
- Executes dropped EXE
PID:2760 -
\??\c:\cxesmok.exec:\cxesmok.exe29⤵
- Executes dropped EXE
PID:3480 -
\??\c:\x8xux30.exec:\x8xux30.exe30⤵
- Executes dropped EXE
PID:4368 -
\??\c:\22521.exec:\22521.exe31⤵
- Executes dropped EXE
PID:4420 -
\??\c:\57cb2.exec:\57cb2.exe32⤵
- Executes dropped EXE
PID:4556 -
\??\c:\f4g2st2.exec:\f4g2st2.exe33⤵
- Executes dropped EXE
PID:3892 -
\??\c:\0b48nf.exec:\0b48nf.exe34⤵
- Executes dropped EXE
PID:3000 -
\??\c:\dk628x.exec:\dk628x.exe35⤵
- Executes dropped EXE
PID:2764 -
\??\c:\f2380b3.exec:\f2380b3.exe36⤵
- Executes dropped EXE
PID:4208 -
\??\c:\5dt9x.exec:\5dt9x.exe37⤵PID:1516
-
\??\c:\t95cm.exec:\t95cm.exe38⤵PID:1492
-
\??\c:\8mfne.exec:\8mfne.exe39⤵PID:4864
-
\??\c:\9fd07.exec:\9fd07.exe40⤵PID:3340
-
\??\c:\oac727.exec:\oac727.exe41⤵PID:3744
-
\??\c:\ekne5rc.exec:\ekne5rc.exe42⤵PID:1616
-
\??\c:\642w4.exec:\642w4.exe43⤵PID:4936
-
\??\c:\2a9uc8.exec:\2a9uc8.exe44⤵PID:2604
-
\??\c:\ec2108.exec:\ec2108.exe45⤵PID:4952
-
\??\c:\63x281.exec:\63x281.exe46⤵PID:3476
-
\??\c:\0d633.exec:\0d633.exe47⤵PID:4568
-
\??\c:\13a6ew.exec:\13a6ew.exe48⤵PID:684
-
\??\c:\13u7c.exec:\13u7c.exe49⤵PID:4916
-
\??\c:\g6ra3w.exec:\g6ra3w.exe50⤵PID:2664
-
\??\c:\9g9l33.exec:\9g9l33.exe51⤵PID:3240
-
\??\c:\035mwm.exec:\035mwm.exe52⤵PID:4612
-
\??\c:\5mxjl.exec:\5mxjl.exe53⤵PID:644
-
\??\c:\x89q7.exec:\x89q7.exe54⤵PID:4684
-
\??\c:\o51g4us.exec:\o51g4us.exe55⤵PID:1612
-
\??\c:\936b157.exec:\936b157.exe56⤵PID:2852
-
\??\c:\4f439sw.exec:\4f439sw.exe57⤵PID:4532
-
\??\c:\v747bi.exec:\v747bi.exe58⤵PID:4036
-
\??\c:\we5ux6.exec:\we5ux6.exe59⤵PID:3712
-
\??\c:\89jwp4.exec:\89jwp4.exe60⤵PID:4132
-
\??\c:\se803.exec:\se803.exe61⤵PID:2152
-
\??\c:\k83f53x.exec:\k83f53x.exe62⤵PID:1864
-
\??\c:\11kirw.exec:\11kirw.exe63⤵PID:1096
-
\??\c:\47iqi6s.exec:\47iqi6s.exe64⤵PID:3020
-
\??\c:\t3e1u3.exec:\t3e1u3.exe65⤵PID:1012
-
\??\c:\1tws3e1.exec:\1tws3e1.exe66⤵PID:5068
-
\??\c:\gnx98.exec:\gnx98.exe67⤵PID:408
-
\??\c:\60sk92.exec:\60sk92.exe68⤵PID:4400
-
\??\c:\sc1e942.exec:\sc1e942.exe69⤵PID:1248
-
\??\c:\82el1oi.exec:\82el1oi.exe70⤵PID:2580
-
\??\c:\4v9od0.exec:\4v9od0.exe71⤵PID:4852
-
\??\c:\7ks7i.exec:\7ks7i.exe72⤵PID:4156
-
\??\c:\f8lxe.exec:\f8lxe.exe73⤵PID:3992
-
\??\c:\qq9wt45.exec:\qq9wt45.exe74⤵PID:524
-
\??\c:\6j5ul1.exec:\6j5ul1.exe75⤵PID:1592
-
\??\c:\i0xsr.exec:\i0xsr.exe76⤵PID:4164
-
\??\c:\3n0m1.exec:\3n0m1.exe77⤵PID:3756
-
\??\c:\21137.exec:\21137.exe78⤵PID:2984
-
\??\c:\7f9gk.exec:\7f9gk.exe79⤵PID:448
-
\??\c:\cc3fn.exec:\cc3fn.exe80⤵PID:3548
-
\??\c:\w4oak.exec:\w4oak.exe81⤵PID:4516
-
\??\c:\9u0m301.exec:\9u0m301.exe82⤵PID:3332
-
\??\c:\n56w8q.exec:\n56w8q.exe83⤵PID:3288
-
\??\c:\59999o.exec:\59999o.exe84⤵PID:5020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\e2004.exec:\e2004.exe1⤵
- Executes dropped EXE
PID:2168
-
\??\c:\336p11.exec:\336p11.exe1⤵PID:100
-
\??\c:\l3sjj9.exec:\l3sjj9.exe2⤵PID:3396
-
\??\c:\23mm23.exec:\23mm23.exe3⤵PID:1908
-
\??\c:\7a2o3.exec:\7a2o3.exe4⤵PID:1344
-
\??\c:\99cgc9.exec:\99cgc9.exe5⤵PID:3892
-
\??\c:\xq4804.exec:\xq4804.exe6⤵PID:3504
-
\??\c:\ob41t.exec:\ob41t.exe7⤵PID:4308
-
\??\c:\uq065hv.exec:\uq065hv.exe8⤵PID:1040
-
\??\c:\rka1i5a.exec:\rka1i5a.exe9⤵PID:3656
-
\??\c:\59r9428.exec:\59r9428.exe10⤵PID:4824
-
\??\c:\ct28t.exec:\ct28t.exe11⤵PID:4436
-
\??\c:\i38fm14.exec:\i38fm14.exe12⤵PID:552
-
\??\c:\03a3c.exec:\03a3c.exe13⤵PID:1616
-
\??\c:\fa7q20.exec:\fa7q20.exe14⤵PID:3676
-
\??\c:\30qi7k.exec:\30qi7k.exe15⤵PID:3216
-
\??\c:\058hmu.exec:\058hmu.exe16⤵PID:2696
-
\??\c:\cr2op.exec:\cr2op.exe17⤵PID:884
-
\??\c:\tc3sb.exec:\tc3sb.exe18⤵PID:676
-
\??\c:\s0h3a9.exec:\s0h3a9.exe19⤵PID:1572
-
\??\c:\0es3uj.exec:\0es3uj.exe20⤵PID:2256
-
\??\c:\226641.exec:\226641.exe21⤵PID:5080
-
\??\c:\708o0.exec:\708o0.exe22⤵PID:3324
-
\??\c:\43q523.exec:\43q523.exe23⤵PID:3276
-
\??\c:\25365.exec:\25365.exe24⤵PID:2020
-
\??\c:\iliek11.exec:\iliek11.exe25⤵PID:2508
-
\??\c:\guma7eh.exec:\guma7eh.exe26⤵PID:1612
-
\??\c:\x2sg7wv.exec:\x2sg7wv.exe27⤵PID:4800
-
\??\c:\fnb2v41.exec:\fnb2v41.exe28⤵PID:3220
-
\??\c:\q8je8.exec:\q8je8.exe29⤵PID:4132
-
\??\c:\radu83.exec:\radu83.exe30⤵PID:948
-
\??\c:\e1q0p.exec:\e1q0p.exe31⤵PID:4572
-
\??\c:\b285lg0.exec:\b285lg0.exe32⤵PID:2376
-
\??\c:\8l457ag.exec:\8l457ag.exe33⤵PID:2792
-
\??\c:\p59773.exec:\p59773.exe34⤵PID:4400
-
\??\c:\0f1kggg.exec:\0f1kggg.exe35⤵PID:4712
-
\??\c:\sm2c2k.exec:\sm2c2k.exe36⤵PID:4852
-
\??\c:\52e76u5.exec:\52e76u5.exe37⤵PID:524
-
\??\c:\9csaik.exec:\9csaik.exe38⤵PID:2964
-
\??\c:\eco9ioa.exec:\eco9ioa.exe39⤵PID:1244
-
\??\c:\n34k9u.exec:\n34k9u.exe40⤵PID:3756
-
\??\c:\11w55.exec:\11w55.exe41⤵PID:4976
-
\??\c:\k74i50.exec:\k74i50.exe42⤵PID:4356
-
\??\c:\6t0v2o.exec:\6t0v2o.exe43⤵PID:448
-
\??\c:\4i95ab.exec:\4i95ab.exe44⤵PID:4732
-
\??\c:\b0liu0.exec:\b0liu0.exe45⤵PID:2516
-
\??\c:\halu8.exec:\halu8.exe46⤵PID:1776
-
\??\c:\h01pb.exec:\h01pb.exe47⤵PID:3092
-
\??\c:\49mqu.exec:\49mqu.exe48⤵PID:3368
-
\??\c:\7b4ok6.exec:\7b4ok6.exe49⤵PID:1344
-
\??\c:\02l79.exec:\02l79.exe50⤵PID:2716
-
\??\c:\r7u1519.exec:\r7u1519.exe51⤵PID:4716
-
\??\c:\s59ds3.exec:\s59ds3.exe52⤵PID:540
-
\??\c:\lm1ud.exec:\lm1ud.exe53⤵PID:1404
-
\??\c:\8prv8r4.exec:\8prv8r4.exe54⤵PID:3656
-
\??\c:\kcmwcwe.exec:\kcmwcwe.exe55⤵PID:4216
-
\??\c:\7x0r7.exec:\7x0r7.exe56⤵PID:3744
-
\??\c:\gc17mv.exec:\gc17mv.exe57⤵PID:4008
-
\??\c:\h2f05rf.exec:\h2f05rf.exe58⤵PID:1616
-
\??\c:\0aeemw.exec:\0aeemw.exe59⤵PID:4952
-
\??\c:\1vak3jk.exec:\1vak3jk.exe60⤵PID:3248
-
\??\c:\2fd32.exec:\2fd32.exe61⤵PID:1296
-
\??\c:\r32wr8.exec:\r32wr8.exe62⤵PID:4168
-
\??\c:\5f137.exec:\5f137.exe63⤵PID:2520
-
\??\c:\2sf12.exec:\2sf12.exe64⤵PID:4616
-
\??\c:\9sml0.exec:\9sml0.exe65⤵PID:5080
-
\??\c:\679uaui.exec:\679uaui.exe66⤵PID:1832
-
\??\c:\dscuov.exec:\dscuov.exe67⤵PID:4332
-
\??\c:\retdxd.exec:\retdxd.exe68⤵PID:2100
-
\??\c:\nmo2km2.exec:\nmo2km2.exe69⤵PID:2084
-
\??\c:\48tw9.exec:\48tw9.exe70⤵PID:3016
-
\??\c:\bpup0f0.exec:\bpup0f0.exe71⤵PID:4972
-
\??\c:\57281.exec:\57281.exe72⤵PID:3520
-
\??\c:\0i7if7.exec:\0i7if7.exe73⤵PID:4536
-
\??\c:\o137919.exec:\o137919.exe74⤵PID:4116
-
\??\c:\0v73x.exec:\0v73x.exe75⤵PID:4812
-
\??\c:\t06m9.exec:\t06m9.exe76⤵PID:2800
-
\??\c:\i5s36i.exec:\i5s36i.exe77⤵PID:3836
-
\??\c:\ke36r.exec:\ke36r.exe78⤵PID:948
-
\??\c:\p3s7od5.exec:\p3s7od5.exe79⤵PID:4108
-
\??\c:\45j39l.exec:\45j39l.exe80⤵PID:2572
-
\??\c:\j32to.exec:\j32to.exe81⤵PID:2812
-
\??\c:\6255311.exec:\6255311.exe82⤵PID:4968
-
\??\c:\93csc.exec:\93csc.exe83⤵PID:2088
-
\??\c:\tss39.exec:\tss39.exe84⤵PID:3172
-
\??\c:\0xe08dp.exec:\0xe08dp.exe85⤵PID:1592
-
\??\c:\hi5q6r0.exec:\hi5q6r0.exe86⤵PID:4164
-
\??\c:\5g473b.exec:\5g473b.exe87⤵PID:628
-
\??\c:\8x58k13.exec:\8x58k13.exe88⤵PID:3628
-
\??\c:\g36540.exec:\g36540.exe89⤵PID:1060
-
\??\c:\8l771.exec:\8l771.exe90⤵PID:3584
-
\??\c:\uqn2g.exec:\uqn2g.exe91⤵PID:2584
-
\??\c:\02ntt.exec:\02ntt.exe92⤵PID:4368
-
\??\c:\mn8p0d.exec:\mn8p0d.exe93⤵PID:3396
-
\??\c:\ae1eck.exec:\ae1eck.exe94⤵PID:4772
-
\??\c:\osgul2u.exec:\osgul2u.exe95⤵PID:4956
-
\??\c:\v1115.exec:\v1115.exe96⤵PID:1344
-
\??\c:\tw54w39.exec:\tw54w39.exe97⤵PID:2760
-
\??\c:\2x0cd.exec:\2x0cd.exe98⤵PID:2036
-
\??\c:\66iix8.exec:\66iix8.exe99⤵PID:2716
-
\??\c:\j4k0v4b.exec:\j4k0v4b.exe100⤵PID:4372
-
\??\c:\967i43.exec:\967i43.exe101⤵PID:540
-
\??\c:\499b6.exec:\499b6.exe102⤵PID:4464
-
\??\c:\mt4vm.exec:\mt4vm.exe103⤵PID:3824
-
\??\c:\2ox0f6.exec:\2ox0f6.exe104⤵PID:1580
-
\??\c:\50do5.exec:\50do5.exe105⤵PID:1404
-
\??\c:\kgj30.exec:\kgj30.exe106⤵PID:3656
-
\??\c:\r8kk4a0.exec:\r8kk4a0.exe107⤵PID:4288
-
\??\c:\t0hlb.exec:\t0hlb.exe108⤵PID:4140
-
\??\c:\j5h9a1.exec:\j5h9a1.exe109⤵PID:3076
-
\??\c:\15u1f.exec:\15u1f.exe110⤵PID:1772
-
\??\c:\4d2p4n.exec:\4d2p4n.exe111⤵PID:2696
-
\??\c:\s53na8.exec:\s53na8.exe112⤵PID:3960
-
\??\c:\4f4i11.exec:\4f4i11.exe113⤵PID:3248
-
\??\c:\vg1xr.exec:\vg1xr.exe114⤵PID:2996
-
\??\c:\d99w49k.exec:\d99w49k.exe115⤵PID:4796
-
\??\c:\r6xp4j0.exec:\r6xp4j0.exe116⤵PID:4612
-
\??\c:\vb2akbj.exec:\vb2akbj.exe117⤵PID:1928
-
\??\c:\x05s5.exec:\x05s5.exe118⤵PID:4012
-
\??\c:\dq58i.exec:\dq58i.exe119⤵PID:3436
-
\??\c:\j760lu.exec:\j760lu.exe120⤵PID:2852
-
\??\c:\wwl666.exec:\wwl666.exe121⤵PID:752
-
\??\c:\015m7.exec:\015m7.exe122⤵PID:4632
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-