Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
68s -
max time network
86s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
21/10/2023, 21:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.64a67642b53992e313acdbb766993bf0.exe
Resource
win7-20231020-en
5 signatures
150 seconds
General
-
Target
NEAS.64a67642b53992e313acdbb766993bf0.exe
-
Size
190KB
-
MD5
64a67642b53992e313acdbb766993bf0
-
SHA1
11f3ae363267667d6b5d3a7bef925e786be51119
-
SHA256
dc09efb07aa062c09ff0d576bfd434ea630445235a0a84b79a0d3a905646c632
-
SHA512
5ff6a528dda3914154ba2f0a6cfe7c59cd1cfa0826cf3d8789282032c5d75181c37d8e78b42bd992dbed0ea2ae96c68b1197e96194e7d72052838a227b14e00d
-
SSDEEP
1536:1vQBeOGtrYSSsrc93UBIfdC67m6AJiqpfg3Cn/uiX:1hOm2sI93UufdC67ciifmCnmiX
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2348-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4124-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1872-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4768-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3152-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/860-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3432-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3620-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3720-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1880-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1556-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3896-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3052-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4036-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4328-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3940-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4148-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1252-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1228-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1312-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2980-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4188-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4612-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3420-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2500-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1864-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3688-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/948-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3408-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4116-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4140-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3152-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/860-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1808-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2404-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3720-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1016-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3896-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4328-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2088-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1600-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1732-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3860-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1716-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/408-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2152-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2156-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4648-561-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-687-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1820-709-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3448-780-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2872-799-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-895-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/948-1977-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4124 q78mak5.exe 1872 8h8n8wv.exe 4768 9gm2u31.exe 3152 a9895g.exe 860 6m43k6.exe 3432 4e1mwus.exe 3620 hils5m.exe 3720 3a8e6.exe 3540 tlddldp.exe 2288 j0dh1.exe 1556 npwm7.exe 1880 35vdqe4.exe 4456 1wt036.exe 3896 8j4k53.exe 3052 28l271.exe 4036 867xg6.exe 4328 7643b.exe 3940 tq1chv.exe 4148 8tw9k.exe 3116 25k1l6.exe 1252 m5xkh.exe 1228 n381o0v.exe 1312 j4swf5.exe 2992 w74lu.exe 2980 d3kxll.exe 4188 72am7b.exe 4612 l47jv.exe 2208 ve7r4i7.exe 980 rjhb69.exe 1792 qcuab6i.exe 5084 xrfm1d.exe 2828 2mnj72o.exe 3420 8j401.exe 3384 j847x4u.exe 3920 ljc8ti0.exe 2500 phxdht.exe 4968 314pgje.exe 4208 92ig1.exe 2736 d634kn3.exe 1864 r04o7.exe 3688 329r691.exe 1484 6384x.exe 3312 ms346o6.exe 2528 onsko.exe 3984 9211r5.exe 948 xpxtl.exe 4728 000l06.exe 3408 97a0kv8.exe 5108 4n0fw.exe 1812 b13i44.exe 2120 vdj7cc.exe 4116 wq3533.exe 4444 94dv2.exe 4124 f2ho4j.exe 2948 v193k.exe 4140 q0akiae.exe 4172 od581.exe 4976 v42phx0.exe 3152 tl8a585.exe 1316 j81hix.exe 860 u9a32q.exe 3692 536g21.exe 1808 b13vnl.exe 2404 80qku9.exe -
resource yara_rule behavioral2/memory/2348-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4124-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1872-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4768-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3152-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/860-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/860-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3432-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3620-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3720-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1880-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1556-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3896-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3052-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4036-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3940-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4148-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1252-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1228-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1312-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2980-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4188-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4612-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1792-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3420-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2500-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1864-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2528-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/948-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3408-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4116-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4140-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3152-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/860-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1808-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1616-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2404-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3720-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1016-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3896-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2088-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1600-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1732-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3860-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1716-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1592-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2152-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2156-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4648-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-687-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1820-709-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2348 wrote to memory of 4124 2348 NEAS.64a67642b53992e313acdbb766993bf0.exe 83 PID 2348 wrote to memory of 4124 2348 NEAS.64a67642b53992e313acdbb766993bf0.exe 83 PID 2348 wrote to memory of 4124 2348 NEAS.64a67642b53992e313acdbb766993bf0.exe 83 PID 4124 wrote to memory of 1872 4124 q78mak5.exe 84 PID 4124 wrote to memory of 1872 4124 q78mak5.exe 84 PID 4124 wrote to memory of 1872 4124 q78mak5.exe 84 PID 1872 wrote to memory of 4768 1872 8h8n8wv.exe 85 PID 1872 wrote to memory of 4768 1872 8h8n8wv.exe 85 PID 1872 wrote to memory of 4768 1872 8h8n8wv.exe 85 PID 4768 wrote to memory of 3152 4768 9gm2u31.exe 86 PID 4768 wrote to memory of 3152 4768 9gm2u31.exe 86 PID 4768 wrote to memory of 3152 4768 9gm2u31.exe 86 PID 3152 wrote to memory of 860 3152 a9895g.exe 87 PID 3152 wrote to memory of 860 3152 a9895g.exe 87 PID 3152 wrote to memory of 860 3152 a9895g.exe 87 PID 860 wrote to memory of 3432 860 6m43k6.exe 88 PID 860 wrote to memory of 3432 860 6m43k6.exe 88 PID 860 wrote to memory of 3432 860 6m43k6.exe 88 PID 3432 wrote to memory of 3620 3432 4e1mwus.exe 89 PID 3432 wrote to memory of 3620 3432 4e1mwus.exe 89 PID 3432 wrote to memory of 3620 3432 4e1mwus.exe 89 PID 3620 wrote to memory of 3720 3620 hils5m.exe 90 PID 3620 wrote to memory of 3720 3620 hils5m.exe 90 PID 3620 wrote to memory of 3720 3620 hils5m.exe 90 PID 3720 wrote to memory of 3540 3720 3a8e6.exe 91 PID 3720 wrote to memory of 3540 3720 3a8e6.exe 91 PID 3720 wrote to memory of 3540 3720 3a8e6.exe 91 PID 3540 wrote to memory of 2288 3540 tlddldp.exe 92 PID 3540 wrote to memory of 2288 3540 tlddldp.exe 92 PID 3540 wrote to memory of 2288 3540 tlddldp.exe 92 PID 2288 wrote to memory of 1556 2288 j0dh1.exe 93 PID 2288 wrote to memory of 1556 2288 j0dh1.exe 93 PID 2288 wrote to memory of 1556 2288 j0dh1.exe 93 PID 1556 wrote to memory of 1880 1556 npwm7.exe 94 PID 1556 wrote to memory of 1880 1556 npwm7.exe 94 PID 1556 wrote to memory of 1880 1556 npwm7.exe 94 PID 1880 wrote to memory of 4456 1880 35vdqe4.exe 95 PID 1880 wrote to memory of 4456 1880 35vdqe4.exe 95 PID 1880 wrote to memory of 4456 1880 35vdqe4.exe 95 PID 4456 wrote to memory of 3896 4456 1wt036.exe 96 PID 4456 wrote to memory of 3896 4456 1wt036.exe 96 PID 4456 wrote to memory of 3896 4456 1wt036.exe 96 PID 3896 wrote to memory of 3052 3896 8j4k53.exe 97 PID 3896 wrote to memory of 3052 3896 8j4k53.exe 97 PID 3896 wrote to memory of 3052 3896 8j4k53.exe 97 PID 3052 wrote to memory of 4036 3052 28l271.exe 98 PID 3052 wrote to memory of 4036 3052 28l271.exe 98 PID 3052 wrote to memory of 4036 3052 28l271.exe 98 PID 4036 wrote to memory of 4328 4036 867xg6.exe 99 PID 4036 wrote to memory of 4328 4036 867xg6.exe 99 PID 4036 wrote to memory of 4328 4036 867xg6.exe 99 PID 4328 wrote to memory of 3940 4328 7643b.exe 100 PID 4328 wrote to memory of 3940 4328 7643b.exe 100 PID 4328 wrote to memory of 3940 4328 7643b.exe 100 PID 3940 wrote to memory of 4148 3940 tq1chv.exe 101 PID 3940 wrote to memory of 4148 3940 tq1chv.exe 101 PID 3940 wrote to memory of 4148 3940 tq1chv.exe 101 PID 4148 wrote to memory of 3116 4148 8tw9k.exe 102 PID 4148 wrote to memory of 3116 4148 8tw9k.exe 102 PID 4148 wrote to memory of 3116 4148 8tw9k.exe 102 PID 3116 wrote to memory of 1252 3116 25k1l6.exe 103 PID 3116 wrote to memory of 1252 3116 25k1l6.exe 103 PID 3116 wrote to memory of 1252 3116 25k1l6.exe 103 PID 1252 wrote to memory of 1228 1252 m5xkh.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.64a67642b53992e313acdbb766993bf0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.64a67642b53992e313acdbb766993bf0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\q78mak5.exec:\q78mak5.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\8h8n8wv.exec:\8h8n8wv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\9gm2u31.exec:\9gm2u31.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\a9895g.exec:\a9895g.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\6m43k6.exec:\6m43k6.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\4e1mwus.exec:\4e1mwus.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\hils5m.exec:\hils5m.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\3a8e6.exec:\3a8e6.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\tlddldp.exec:\tlddldp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\j0dh1.exec:\j0dh1.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\npwm7.exec:\npwm7.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\35vdqe4.exec:\35vdqe4.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\1wt036.exec:\1wt036.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\8j4k53.exec:\8j4k53.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\28l271.exec:\28l271.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\867xg6.exec:\867xg6.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\7643b.exec:\7643b.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\tq1chv.exec:\tq1chv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\8tw9k.exec:\8tw9k.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\25k1l6.exec:\25k1l6.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\m5xkh.exec:\m5xkh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\n381o0v.exec:\n381o0v.exe23⤵
- Executes dropped EXE
PID:1228 -
\??\c:\j4swf5.exec:\j4swf5.exe24⤵
- Executes dropped EXE
PID:1312 -
\??\c:\w74lu.exec:\w74lu.exe25⤵
- Executes dropped EXE
PID:2992 -
\??\c:\d3kxll.exec:\d3kxll.exe26⤵
- Executes dropped EXE
PID:2980 -
\??\c:\72am7b.exec:\72am7b.exe27⤵
- Executes dropped EXE
PID:4188 -
\??\c:\l47jv.exec:\l47jv.exe28⤵
- Executes dropped EXE
PID:4612 -
\??\c:\ve7r4i7.exec:\ve7r4i7.exe29⤵
- Executes dropped EXE
PID:2208 -
\??\c:\rjhb69.exec:\rjhb69.exe30⤵
- Executes dropped EXE
PID:980 -
\??\c:\qcuab6i.exec:\qcuab6i.exe31⤵
- Executes dropped EXE
PID:1792 -
\??\c:\xrfm1d.exec:\xrfm1d.exe32⤵
- Executes dropped EXE
PID:5084 -
\??\c:\2mnj72o.exec:\2mnj72o.exe33⤵
- Executes dropped EXE
PID:2828 -
\??\c:\8j401.exec:\8j401.exe34⤵
- Executes dropped EXE
PID:3420 -
\??\c:\j847x4u.exec:\j847x4u.exe35⤵
- Executes dropped EXE
PID:3384 -
\??\c:\ljc8ti0.exec:\ljc8ti0.exe36⤵
- Executes dropped EXE
PID:3920 -
\??\c:\phxdht.exec:\phxdht.exe37⤵
- Executes dropped EXE
PID:2500 -
\??\c:\314pgje.exec:\314pgje.exe38⤵
- Executes dropped EXE
PID:4968 -
\??\c:\92ig1.exec:\92ig1.exe39⤵
- Executes dropped EXE
PID:4208 -
\??\c:\d634kn3.exec:\d634kn3.exe40⤵
- Executes dropped EXE
PID:2736 -
\??\c:\r04o7.exec:\r04o7.exe41⤵
- Executes dropped EXE
PID:1864 -
\??\c:\329r691.exec:\329r691.exe42⤵
- Executes dropped EXE
PID:3688 -
\??\c:\6384x.exec:\6384x.exe43⤵
- Executes dropped EXE
PID:1484 -
\??\c:\ms346o6.exec:\ms346o6.exe44⤵
- Executes dropped EXE
PID:3312 -
\??\c:\onsko.exec:\onsko.exe45⤵
- Executes dropped EXE
PID:2528 -
\??\c:\9211r5.exec:\9211r5.exe46⤵
- Executes dropped EXE
PID:3984 -
\??\c:\xpxtl.exec:\xpxtl.exe47⤵
- Executes dropped EXE
PID:948 -
\??\c:\000l06.exec:\000l06.exe48⤵
- Executes dropped EXE
PID:4728 -
\??\c:\97a0kv8.exec:\97a0kv8.exe49⤵
- Executes dropped EXE
PID:3408 -
\??\c:\4n0fw.exec:\4n0fw.exe50⤵
- Executes dropped EXE
PID:5108 -
\??\c:\b13i44.exec:\b13i44.exe51⤵
- Executes dropped EXE
PID:1812 -
\??\c:\vdj7cc.exec:\vdj7cc.exe52⤵
- Executes dropped EXE
PID:2120 -
\??\c:\wq3533.exec:\wq3533.exe53⤵
- Executes dropped EXE
PID:4116 -
\??\c:\94dv2.exec:\94dv2.exe54⤵
- Executes dropped EXE
PID:4444 -
\??\c:\f2ho4j.exec:\f2ho4j.exe55⤵
- Executes dropped EXE
PID:4124 -
\??\c:\v193k.exec:\v193k.exe56⤵
- Executes dropped EXE
PID:2948 -
\??\c:\q0akiae.exec:\q0akiae.exe57⤵
- Executes dropped EXE
PID:4140 -
\??\c:\od581.exec:\od581.exe58⤵
- Executes dropped EXE
PID:4172 -
\??\c:\v42phx0.exec:\v42phx0.exe59⤵
- Executes dropped EXE
PID:4976 -
\??\c:\tl8a585.exec:\tl8a585.exe60⤵
- Executes dropped EXE
PID:3152 -
\??\c:\j81hix.exec:\j81hix.exe61⤵
- Executes dropped EXE
PID:1316 -
\??\c:\u9a32q.exec:\u9a32q.exe62⤵
- Executes dropped EXE
PID:860 -
\??\c:\536g21.exec:\536g21.exe63⤵
- Executes dropped EXE
PID:3692 -
\??\c:\b13vnl.exec:\b13vnl.exe64⤵
- Executes dropped EXE
PID:1808 -
\??\c:\80qku9.exec:\80qku9.exe65⤵
- Executes dropped EXE
PID:2404 -
\??\c:\q7191mp.exec:\q7191mp.exe66⤵PID:1616
-
\??\c:\cgvw7p.exec:\cgvw7p.exe67⤵PID:3720
-
\??\c:\u2nf86.exec:\u2nf86.exe68⤵PID:4112
-
\??\c:\h905w3.exec:\h905w3.exe69⤵PID:1016
-
\??\c:\3d8h5.exec:\3d8h5.exe70⤵PID:3160
-
\??\c:\mjv771.exec:\mjv771.exe71⤵PID:3320
-
\??\c:\58xp6.exec:\58xp6.exe72⤵PID:3304
-
\??\c:\dug7k.exec:\dug7k.exe73⤵PID:1388
-
\??\c:\f20c8.exec:\f20c8.exe74⤵PID:3896
-
\??\c:\7q465f.exec:\7q465f.exe75⤵PID:496
-
\??\c:\p419t.exec:\p419t.exe76⤵PID:2008
-
\??\c:\69u36c.exec:\69u36c.exe77⤵PID:4628
-
\??\c:\815r4.exec:\815r4.exe78⤵PID:4328
-
\??\c:\26h1c.exec:\26h1c.exe79⤵PID:5012
-
\??\c:\090w33p.exec:\090w33p.exe80⤵PID:3764
-
\??\c:\eq4u6s.exec:\eq4u6s.exe81⤵PID:2088
-
\??\c:\1mvm5p.exec:\1mvm5p.exe82⤵PID:3116
-
\??\c:\hw3dod7.exec:\hw3dod7.exe83⤵PID:3132
-
\??\c:\5x3u9.exec:\5x3u9.exe84⤵PID:1600
-
\??\c:\il73gs.exec:\il73gs.exe85⤵PID:1732
-
\??\c:\cw93rj0.exec:\cw93rj0.exe86⤵PID:3944
-
\??\c:\4951523.exec:\4951523.exe87⤵PID:4068
-
\??\c:\2p72st.exec:\2p72st.exe88⤵PID:1708
-
\??\c:\8hk7e.exec:\8hk7e.exe89⤵PID:4188
-
\??\c:\ebk41.exec:\ebk41.exe90⤵PID:2184
-
\??\c:\9j2n0.exec:\9j2n0.exe91⤵PID:1256
-
\??\c:\7tk99g8.exec:\7tk99g8.exe92⤵PID:3860
-
\??\c:\aqq9a.exec:\aqq9a.exe93⤵PID:1040
-
\??\c:\j8o5h6.exec:\j8o5h6.exe94⤵PID:2016
-
\??\c:\5ph9x.exec:\5ph9x.exe95⤵PID:1716
-
\??\c:\4jemo5.exec:\4jemo5.exe96⤵PID:408
-
\??\c:\1mpe6c.exec:\1mpe6c.exe97⤵PID:1672
-
\??\c:\v2m98el.exec:\v2m98el.exe98⤵PID:3176
-
\??\c:\n8fs2e.exec:\n8fs2e.exe99⤵PID:1520
-
\??\c:\e8u0r2e.exec:\e8u0r2e.exe100⤵PID:4284
-
\??\c:\d7jxh5.exec:\d7jxh5.exe101⤵PID:2168
-
\??\c:\21s3r.exec:\21s3r.exe102⤵PID:3844
-
\??\c:\x7r3v96.exec:\x7r3v96.exe103⤵PID:4460
-
\??\c:\jwwrb.exec:\jwwrb.exe104⤵PID:3180
-
\??\c:\978xb.exec:\978xb.exe105⤵PID:3688
-
\??\c:\8sqae87.exec:\8sqae87.exe106⤵PID:1484
-
\??\c:\mk3343.exec:\mk3343.exe107⤵PID:3312
-
\??\c:\59o9k7.exec:\59o9k7.exe108⤵PID:2528
-
\??\c:\c11lj.exec:\c11lj.exe109⤵PID:1088
-
\??\c:\wr373.exec:\wr373.exe110⤵PID:948
-
\??\c:\lpphdh.exec:\lpphdh.exe111⤵PID:1516
-
\??\c:\62b3p0.exec:\62b3p0.exe112⤵PID:3236
-
\??\c:\k43x9me.exec:\k43x9me.exe113⤵PID:2832
-
\??\c:\5f45t.exec:\5f45t.exe114⤵PID:4116
-
\??\c:\92c1f8.exec:\92c1f8.exe115⤵PID:116
-
\??\c:\409ke7u.exec:\409ke7u.exe116⤵PID:1592
-
\??\c:\h127sod.exec:\h127sod.exe117⤵PID:4640
-
\??\c:\tclvt.exec:\tclvt.exe118⤵PID:3128
-
\??\c:\cmmba.exec:\cmmba.exe119⤵PID:3656
-
\??\c:\6h137.exec:\6h137.exe120⤵PID:3152
-
\??\c:\b9bx1.exec:\b9bx1.exe121⤵PID:4592
-
\??\c:\5akc4.exec:\5akc4.exe122⤵PID:2764
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-