Analysis
-
max time kernel
153s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
01/11/2023, 09:05
Behavioral task
behavioral1
Sample
NEAS.dd787efd4ec3b7418a4a76f516b10820_JC.exe
Resource
win7-20231020-en
5 signatures
150 seconds
General
-
Target
NEAS.dd787efd4ec3b7418a4a76f516b10820_JC.exe
-
Size
389KB
-
MD5
dd787efd4ec3b7418a4a76f516b10820
-
SHA1
be9d2638bcdd9818455a6ffc3a603486843ec514
-
SHA256
313faa05bc75aa34efc6997fe5e24cc9e89b0d99e79d82d27a6e3882bc337230
-
SHA512
7cdd77f5a3e6da9a3f6eafccc7fb8c69043501fc240d7b8ca27e1dfc7886abaea11987f76e99431ddb2aa323b12719e2718f4aa1145b8e7af378000e4cc0bcf2
-
SSDEEP
6144:xcm4FmowdHoSPubszBT0pjOwdHosH84qtIC:74wFHoSPub/JvHoH4qtIC
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4796-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4540-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1764-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2924-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3004-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3680-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2792-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3352-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2608-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4564-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/996-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5012-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2484-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1416-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1184-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2020-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3816-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3292-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3208-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3172-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2140-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4160-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1960-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3796-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3552-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4924-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3972-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/788-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2856-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3832-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4344-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/384-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1680-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4604-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1844-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2844-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1836-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3488-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4940-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2004-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1348-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3964-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2036-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2672-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4100-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/928-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3020-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4856-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2184-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5044-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4424-364-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4420-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1164-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4708-385-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/972-398-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2400-534-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2180-542-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2928-621-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4604-630-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-664-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/32-717-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5104-882-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3304-1242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3340-1336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4540 l2mms.exe 1764 war9wo.exe 2924 738j0.exe 3352 pkf4o.exe 3004 11i2dv0.exe 2792 vbk41c.exe 2108 2vduw.exe 3680 53120l.exe 2608 mr52cp.exe 4564 hx74wp8.exe 996 l1ch975.exe 2176 g63kw9.exe 2484 3b9hg2g.exe 5012 u233337.exe 1416 7il9q1.exe 1184 8kr7x51.exe 3496 719319.exe 2020 kgqww.exe 2100 23g11.exe 3816 40bnth.exe 3292 r37a331.exe 3208 gc8me.exe 3172 01a839.exe 4160 77a3l1.exe 2140 n3600.exe 1168 bqx8bb.exe 1544 5340sc8.exe 1720 0m8h6.exe 1960 d0c32qx.exe 3392 uw78b7.exe 3796 7136sh1.exe 3552 k33c6.exe 4924 r57k3.exe 3972 c0d852.exe 788 7ax4ie5.exe 2716 fq46k.exe 4956 8arww3.exe 2856 2b4vdm8.exe 3832 t0539.exe 4348 lc19gt.exe 4344 weagso.exe 3616 kmx8wp.exe 384 930ke12.exe 1680 8i7iki.exe 2256 qa01e6.exe 4604 1l0w1u0.exe 1844 975e9km.exe 2844 9n3q7.exe 4760 e34nc.exe 1836 v0o6edx.exe 3488 4g91gj.exe 4940 og63b.exe 2004 4xeim.exe 2784 wg1r81.exe 1348 j8ti2.exe 996 xpr8x3q.exe 3964 o2hfxw.exe 2036 aamoao.exe 2672 usr02e.exe 1344 n985i.exe 1416 r3513.exe 4968 5755531.exe 2592 oim3i.exe 776 973a5.exe -
resource yara_rule behavioral2/memory/4796-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4796-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000500000001e9bf-3.dat upx behavioral2/files/0x000500000001e9bf-4.dat upx behavioral2/memory/4540-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022e3b-11.dat upx behavioral2/memory/1764-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022e3e-12.dat upx behavioral2/files/0x0007000000022e3b-10.dat upx behavioral2/files/0x0007000000022e3e-16.dat upx behavioral2/files/0x0007000000022e3e-15.dat upx behavioral2/files/0x0006000000022e42-20.dat upx behavioral2/files/0x0006000000022e42-22.dat upx behavioral2/files/0x0006000000022e44-25.dat upx behavioral2/memory/2924-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3004-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022e45-33.dat upx behavioral2/files/0x0006000000022e46-37.dat upx behavioral2/files/0x0006000000022e46-38.dat upx behavioral2/files/0x0006000000022e47-43.dat upx behavioral2/memory/3680-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022e47-42.dat upx behavioral2/files/0x0006000000022e45-32.dat upx behavioral2/memory/2792-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022e44-27.dat upx behavioral2/memory/3352-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2608-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022e49-50.dat upx behavioral2/files/0x0006000000022e49-49.dat upx behavioral2/memory/4564-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022e4a-56.dat upx behavioral2/files/0x0006000000022e4a-55.dat upx behavioral2/files/0x0006000000022e4c-60.dat upx behavioral2/memory/4564-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022e4c-62.dat upx behavioral2/files/0x0006000000022e4d-67.dat upx behavioral2/memory/996-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022e4d-65.dat upx behavioral2/files/0x0006000000022e4e-71.dat upx behavioral2/files/0x0006000000022e4e-70.dat upx behavioral2/files/0x0006000000022e4f-76.dat upx behavioral2/memory/5012-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022e50-82.dat upx behavioral2/files/0x0006000000022e50-83.dat upx behavioral2/memory/2484-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022e4f-75.dat upx behavioral2/files/0x0006000000022e52-88.dat upx behavioral2/memory/1416-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022e53-93.dat upx behavioral2/files/0x0006000000022e54-98.dat upx behavioral2/files/0x0006000000022e53-92.dat upx behavioral2/memory/1184-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022e52-86.dat upx behavioral2/files/0x0006000000022e54-99.dat upx behavioral2/files/0x0006000000022e56-102.dat upx behavioral2/files/0x0006000000022e56-103.dat upx behavioral2/files/0x0006000000022e57-108.dat upx behavioral2/files/0x0006000000022e57-109.dat upx behavioral2/memory/2020-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3816-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022e58-113.dat upx behavioral2/files/0x0006000000022e58-114.dat upx behavioral2/memory/3292-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022e59-118.dat upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4796 wrote to memory of 4540 4796 NEAS.dd787efd4ec3b7418a4a76f516b10820_JC.exe 86 PID 4796 wrote to memory of 4540 4796 NEAS.dd787efd4ec3b7418a4a76f516b10820_JC.exe 86 PID 4796 wrote to memory of 4540 4796 NEAS.dd787efd4ec3b7418a4a76f516b10820_JC.exe 86 PID 4540 wrote to memory of 1764 4540 l2mms.exe 87 PID 4540 wrote to memory of 1764 4540 l2mms.exe 87 PID 4540 wrote to memory of 1764 4540 l2mms.exe 87 PID 1764 wrote to memory of 2924 1764 war9wo.exe 88 PID 1764 wrote to memory of 2924 1764 war9wo.exe 88 PID 1764 wrote to memory of 2924 1764 war9wo.exe 88 PID 2924 wrote to memory of 3352 2924 738j0.exe 89 PID 2924 wrote to memory of 3352 2924 738j0.exe 89 PID 2924 wrote to memory of 3352 2924 738j0.exe 89 PID 3352 wrote to memory of 3004 3352 pkf4o.exe 91 PID 3352 wrote to memory of 3004 3352 pkf4o.exe 91 PID 3352 wrote to memory of 3004 3352 pkf4o.exe 91 PID 3004 wrote to memory of 2792 3004 11i2dv0.exe 90 PID 3004 wrote to memory of 2792 3004 11i2dv0.exe 90 PID 3004 wrote to memory of 2792 3004 11i2dv0.exe 90 PID 2792 wrote to memory of 2108 2792 vbk41c.exe 92 PID 2792 wrote to memory of 2108 2792 vbk41c.exe 92 PID 2792 wrote to memory of 2108 2792 vbk41c.exe 92 PID 2108 wrote to memory of 3680 2108 2vduw.exe 93 PID 2108 wrote to memory of 3680 2108 2vduw.exe 93 PID 2108 wrote to memory of 3680 2108 2vduw.exe 93 PID 3680 wrote to memory of 2608 3680 53120l.exe 94 PID 3680 wrote to memory of 2608 3680 53120l.exe 94 PID 3680 wrote to memory of 2608 3680 53120l.exe 94 PID 2608 wrote to memory of 4564 2608 mr52cp.exe 95 PID 2608 wrote to memory of 4564 2608 mr52cp.exe 95 PID 2608 wrote to memory of 4564 2608 mr52cp.exe 95 PID 4564 wrote to memory of 996 4564 hx74wp8.exe 96 PID 4564 wrote to memory of 996 4564 hx74wp8.exe 96 PID 4564 wrote to memory of 996 4564 hx74wp8.exe 96 PID 996 wrote to memory of 2176 996 l1ch975.exe 97 PID 996 wrote to memory of 2176 996 l1ch975.exe 97 PID 996 wrote to memory of 2176 996 l1ch975.exe 97 PID 2176 wrote to memory of 2484 2176 g63kw9.exe 98 PID 2176 wrote to memory of 2484 2176 g63kw9.exe 98 PID 2176 wrote to memory of 2484 2176 g63kw9.exe 98 PID 2484 wrote to memory of 5012 2484 3b9hg2g.exe 99 PID 2484 wrote to memory of 5012 2484 3b9hg2g.exe 99 PID 2484 wrote to memory of 5012 2484 3b9hg2g.exe 99 PID 5012 wrote to memory of 1416 5012 u233337.exe 101 PID 5012 wrote to memory of 1416 5012 u233337.exe 101 PID 5012 wrote to memory of 1416 5012 u233337.exe 101 PID 1416 wrote to memory of 1184 1416 7il9q1.exe 104 PID 1416 wrote to memory of 1184 1416 7il9q1.exe 104 PID 1416 wrote to memory of 1184 1416 7il9q1.exe 104 PID 1184 wrote to memory of 3496 1184 8kr7x51.exe 103 PID 1184 wrote to memory of 3496 1184 8kr7x51.exe 103 PID 1184 wrote to memory of 3496 1184 8kr7x51.exe 103 PID 3496 wrote to memory of 2020 3496 719319.exe 102 PID 3496 wrote to memory of 2020 3496 719319.exe 102 PID 3496 wrote to memory of 2020 3496 719319.exe 102 PID 2020 wrote to memory of 2100 2020 kgqww.exe 105 PID 2020 wrote to memory of 2100 2020 kgqww.exe 105 PID 2020 wrote to memory of 2100 2020 kgqww.exe 105 PID 2100 wrote to memory of 3816 2100 23g11.exe 106 PID 2100 wrote to memory of 3816 2100 23g11.exe 106 PID 2100 wrote to memory of 3816 2100 23g11.exe 106 PID 3816 wrote to memory of 3292 3816 40bnth.exe 107 PID 3816 wrote to memory of 3292 3816 40bnth.exe 107 PID 3816 wrote to memory of 3292 3816 40bnth.exe 107 PID 3292 wrote to memory of 3208 3292 r37a331.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.dd787efd4ec3b7418a4a76f516b10820_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.dd787efd4ec3b7418a4a76f516b10820_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\l2mms.exec:\l2mms.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\war9wo.exec:\war9wo.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\738j0.exec:\738j0.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\pkf4o.exec:\pkf4o.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
\??\c:\11i2dv0.exec:\11i2dv0.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004
-
-
-
-
-
-
\??\c:\vbk41c.exec:\vbk41c.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\2vduw.exec:\2vduw.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\53120l.exec:\53120l.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
\??\c:\mr52cp.exec:\mr52cp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\hx74wp8.exec:\hx74wp8.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\l1ch975.exec:\l1ch975.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\g63kw9.exec:\g63kw9.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\3b9hg2g.exec:\3b9hg2g.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\u233337.exec:\u233337.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\7il9q1.exec:\7il9q1.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\8kr7x51.exec:\8kr7x51.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184
-
-
-
-
-
-
-
-
-
-
-
\??\c:\kgqww.exec:\kgqww.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\23g11.exec:\23g11.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\40bnth.exec:\40bnth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\r37a331.exec:\r37a331.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\gc8me.exec:\gc8me.exe5⤵
- Executes dropped EXE
PID:3208 -
\??\c:\01a839.exec:\01a839.exe6⤵
- Executes dropped EXE
PID:3172 -
\??\c:\77a3l1.exec:\77a3l1.exe7⤵
- Executes dropped EXE
PID:4160 -
\??\c:\n3600.exec:\n3600.exe8⤵
- Executes dropped EXE
PID:2140 -
\??\c:\bqx8bb.exec:\bqx8bb.exe9⤵
- Executes dropped EXE
PID:1168 -
\??\c:\5340sc8.exec:\5340sc8.exe10⤵
- Executes dropped EXE
PID:1544 -
\??\c:\0m8h6.exec:\0m8h6.exe11⤵
- Executes dropped EXE
PID:1720 -
\??\c:\d0c32qx.exec:\d0c32qx.exe12⤵
- Executes dropped EXE
PID:1960 -
\??\c:\uw78b7.exec:\uw78b7.exe13⤵
- Executes dropped EXE
PID:3392 -
\??\c:\7136sh1.exec:\7136sh1.exe14⤵
- Executes dropped EXE
PID:3796 -
\??\c:\k33c6.exec:\k33c6.exe15⤵
- Executes dropped EXE
PID:3552 -
\??\c:\r57k3.exec:\r57k3.exe16⤵
- Executes dropped EXE
PID:4924 -
\??\c:\c0d852.exec:\c0d852.exe17⤵
- Executes dropped EXE
PID:3972 -
\??\c:\7ax4ie5.exec:\7ax4ie5.exe18⤵
- Executes dropped EXE
PID:788 -
\??\c:\fq46k.exec:\fq46k.exe19⤵
- Executes dropped EXE
PID:2716 -
\??\c:\8arww3.exec:\8arww3.exe20⤵
- Executes dropped EXE
PID:4956 -
\??\c:\2b4vdm8.exec:\2b4vdm8.exe21⤵
- Executes dropped EXE
PID:2856 -
\??\c:\t0539.exec:\t0539.exe22⤵
- Executes dropped EXE
PID:3832 -
\??\c:\lc19gt.exec:\lc19gt.exe23⤵
- Executes dropped EXE
PID:4348 -
\??\c:\weagso.exec:\weagso.exe24⤵
- Executes dropped EXE
PID:4344 -
\??\c:\kmx8wp.exec:\kmx8wp.exe25⤵
- Executes dropped EXE
PID:3616 -
\??\c:\930ke12.exec:\930ke12.exe26⤵
- Executes dropped EXE
PID:384 -
\??\c:\8i7iki.exec:\8i7iki.exe27⤵
- Executes dropped EXE
PID:1680 -
\??\c:\qa01e6.exec:\qa01e6.exe28⤵
- Executes dropped EXE
PID:2256 -
\??\c:\1l0w1u0.exec:\1l0w1u0.exe29⤵
- Executes dropped EXE
PID:4604 -
\??\c:\975e9km.exec:\975e9km.exe30⤵
- Executes dropped EXE
PID:1844 -
\??\c:\9n3q7.exec:\9n3q7.exe31⤵
- Executes dropped EXE
PID:2844 -
\??\c:\e34nc.exec:\e34nc.exe32⤵
- Executes dropped EXE
PID:4760 -
\??\c:\v0o6edx.exec:\v0o6edx.exe33⤵
- Executes dropped EXE
PID:1836 -
\??\c:\4g91gj.exec:\4g91gj.exe34⤵
- Executes dropped EXE
PID:3488 -
\??\c:\og63b.exec:\og63b.exe35⤵
- Executes dropped EXE
PID:4940 -
\??\c:\4xeim.exec:\4xeim.exe36⤵
- Executes dropped EXE
PID:2004 -
\??\c:\wg1r81.exec:\wg1r81.exe37⤵
- Executes dropped EXE
PID:2784 -
\??\c:\ca5pa.exec:\ca5pa.exe38⤵PID:1348
-
\??\c:\xpr8x3q.exec:\xpr8x3q.exe39⤵
- Executes dropped EXE
PID:996 -
\??\c:\o2hfxw.exec:\o2hfxw.exe40⤵
- Executes dropped EXE
PID:3964 -
\??\c:\aamoao.exec:\aamoao.exe41⤵
- Executes dropped EXE
PID:2036 -
\??\c:\gs54q7.exec:\gs54q7.exe42⤵PID:2672
-
\??\c:\n985i.exec:\n985i.exe43⤵
- Executes dropped EXE
PID:1344 -
\??\c:\oo5u1i.exec:\oo5u1i.exe44⤵PID:1416
-
\??\c:\5755531.exec:\5755531.exe45⤵
- Executes dropped EXE
PID:4968 -
\??\c:\4f1mss.exec:\4f1mss.exe46⤵PID:2592
-
\??\c:\973a5.exec:\973a5.exe47⤵
- Executes dropped EXE
PID:776 -
\??\c:\p6f7g.exec:\p6f7g.exe48⤵PID:3000
-
\??\c:\8ib7mo.exec:\8ib7mo.exe49⤵PID:2932
-
\??\c:\n2e9uk.exec:\n2e9uk.exe50⤵PID:4964
-
\??\c:\8gb79af.exec:\8gb79af.exe51⤵PID:3172
-
\??\c:\115g7.exec:\115g7.exe52⤵PID:2820
-
\??\c:\5p533.exec:\5p533.exe53⤵PID:4100
-
\??\c:\ra1ae.exec:\ra1ae.exe54⤵PID:3020
-
\??\c:\5ee9coo.exec:\5ee9coo.exe55⤵PID:928
-
\??\c:\0to98.exec:\0to98.exe56⤵PID:2748
-
\??\c:\94q54l7.exec:\94q54l7.exe57⤵PID:4856
-
\??\c:\t6x975.exec:\t6x975.exe58⤵PID:456
-
\??\c:\d5c99.exec:\d5c99.exe59⤵PID:4908
-
\??\c:\0x73s9.exec:\0x73s9.exe60⤵PID:2128
-
\??\c:\716737b.exec:\716737b.exe61⤵PID:3892
-
\??\c:\wgi377.exec:\wgi377.exe62⤵PID:2184
-
\??\c:\23w6juu.exec:\23w6juu.exe63⤵PID:884
-
\??\c:\2609hws.exec:\2609hws.exe64⤵PID:484
-
\??\c:\h61p3q9.exec:\h61p3q9.exe65⤵PID:1120
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\719319.exec:\719319.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496
-
\??\c:\cjwx85.exec:\cjwx85.exe1⤵PID:2812
-
\??\c:\xi1o4m.exec:\xi1o4m.exe2⤵PID:4824
-
\??\c:\iju915.exec:\iju915.exe3⤵PID:1288
-
\??\c:\0x1196.exec:\0x1196.exe4⤵PID:2856
-
\??\c:\7h17k.exec:\7h17k.exe5⤵PID:1664
-
\??\c:\u0aea2.exec:\u0aea2.exe6⤵PID:4344
-
\??\c:\smawi6.exec:\smawi6.exe7⤵PID:5044
-
\??\c:\s32cq63.exec:\s32cq63.exe8⤵PID:4424
-
\??\c:\eom1gf0.exec:\eom1gf0.exe9⤵PID:4420
-
\??\c:\wggswu.exec:\wggswu.exe10⤵PID:436
-
\??\c:\1t1ur9.exec:\1t1ur9.exe11⤵PID:5004
-
\??\c:\gus16s9.exec:\gus16s9.exe12⤵PID:4012
-
\??\c:\23357.exec:\23357.exe13⤵PID:5104
-
\??\c:\799u518.exec:\799u518.exe14⤵PID:4708
-
\??\c:\2g5m777.exec:\2g5m777.exe15⤵PID:1164
-
\??\c:\xt9su91.exec:\xt9su91.exe16⤵PID:2168
-
\??\c:\j8ti2.exec:\j8ti2.exe17⤵
- Executes dropped EXE
PID:1348 -
\??\c:\v16f1ks.exec:\v16f1ks.exe18⤵PID:4648
-
\??\c:\masmo.exec:\masmo.exe19⤵PID:972
-
\??\c:\usr02e.exec:\usr02e.exe20⤵
- Executes dropped EXE
PID:2672 -
\??\c:\976nc6o.exec:\976nc6o.exe21⤵PID:1184
-
\??\c:\r3513.exec:\r3513.exe22⤵
- Executes dropped EXE
PID:1416 -
\??\c:\23wio.exec:\23wio.exe23⤵PID:2020
-
\??\c:\oim3i.exec:\oim3i.exe24⤵
- Executes dropped EXE
PID:2592 -
\??\c:\x0j5ct.exec:\x0j5ct.exe25⤵PID:3292
-
\??\c:\1u7919.exec:\1u7919.exe26⤵PID:3008
-
\??\c:\14swv.exec:\14swv.exe27⤵PID:2932
-
\??\c:\j3182oa.exec:\j3182oa.exe28⤵PID:3468
-
\??\c:\0ga99kv.exec:\0ga99kv.exe29⤵PID:2544
-
\??\c:\954wj.exec:\954wj.exe30⤵PID:4160
-
\??\c:\b5qroww.exec:\b5qroww.exe31⤵PID:1524
-
\??\c:\8v111c.exec:\8v111c.exe32⤵PID:3828
-
\??\c:\l23n17.exec:\l23n17.exe33⤵PID:1168
-
\??\c:\153795.exec:\153795.exe34⤵PID:2780
-
\??\c:\11n3d1.exec:\11n3d1.exe35⤵PID:4136
-
\??\c:\1v4tx.exec:\1v4tx.exe36⤵PID:1316
-
\??\c:\bktrv8.exec:\bktrv8.exe37⤵PID:1596
-
\??\c:\776x73.exec:\776x73.exe38⤵PID:1520
-
\??\c:\aqh5u.exec:\aqh5u.exe39⤵PID:2088
-
\??\c:\o0xq5.exec:\o0xq5.exe40⤵PID:2184
-
\??\c:\kbc35.exec:\kbc35.exe41⤵PID:3032
-
\??\c:\2dpq4.exec:\2dpq4.exe42⤵PID:4740
-
\??\c:\6rn3kk.exec:\6rn3kk.exe43⤵PID:1088
-
\??\c:\4kd070r.exec:\4kd070r.exe44⤵PID:1656
-
\??\c:\94a0m.exec:\94a0m.exe45⤵PID:2520
-
\??\c:\bo4f64.exec:\bo4f64.exe46⤵PID:4948
-
\??\c:\tuau6.exec:\tuau6.exe47⤵PID:2796
-
\??\c:\5932euu.exec:\5932euu.exe48⤵PID:4796
-
\??\c:\rnvng27.exec:\rnvng27.exe49⤵PID:1140
-
\??\c:\wkec4s.exec:\wkec4s.exe50⤵PID:384
-
\??\c:\0p90s.exec:\0p90s.exe51⤵PID:3184
-
\??\c:\275j83j.exec:\275j83j.exe52⤵PID:3860
-
\??\c:\t715319.exec:\t715319.exe53⤵PID:2016
-
\??\c:\5t96a.exec:\5t96a.exe54⤵PID:1912
-
\??\c:\nsl1f.exec:\nsl1f.exe55⤵PID:1284
-
\??\c:\475sb.exec:\475sb.exe56⤵PID:1612
-
\??\c:\le74k3.exec:\le74k3.exe57⤵PID:3928
-
\??\c:\ms791.exec:\ms791.exe58⤵PID:996
-
\??\c:\0uf7x7.exec:\0uf7x7.exe59⤵PID:1348
-
\??\c:\v97s9q.exec:\v97s9q.exe60⤵PID:4648
-
\??\c:\aekmi34.exec:\aekmi34.exe61⤵PID:972
-
\??\c:\war2wo1.exec:\war2wo1.exe62⤵PID:3028
-
\??\c:\6a251n.exec:\6a251n.exe63⤵PID:1760
-
\??\c:\02ghj8q.exec:\02ghj8q.exe64⤵PID:2400
-
\??\c:\ecuccq.exec:\ecuccq.exe65⤵PID:4112
-
\??\c:\d3379k.exec:\d3379k.exe66⤵PID:2180
-
\??\c:\re4c41.exec:\re4c41.exe67⤵PID:2268
-
\??\c:\75715.exec:\75715.exe68⤵PID:3540
-
\??\c:\139393.exec:\139393.exe69⤵PID:3172
-
\??\c:\9aawoqg.exec:\9aawoqg.exe70⤵PID:4484
-
\??\c:\35373.exec:\35373.exe71⤵PID:4336
-
\??\c:\0m1810.exec:\0m1810.exe72⤵PID:4100
-
\??\c:\v218a0.exec:\v218a0.exe73⤵PID:4436
-
\??\c:\750uow.exec:\750uow.exe74⤵PID:4408
-
\??\c:\ekv90.exec:\ekv90.exe75⤵PID:2748
-
\??\c:\0o4mmg9.exec:\0o4mmg9.exe76⤵PID:1544
-
\??\c:\ri6j5.exec:\ri6j5.exe77⤵PID:1924
-
\??\c:\pgt56.exec:\pgt56.exe78⤵PID:3840
-
\??\c:\g062apc.exec:\g062apc.exe79⤵PID:3464
-
\??\c:\5u9xm.exec:\5u9xm.exe80⤵PID:3552
-
\??\c:\7512e.exec:\7512e.exe81⤵PID:2084
-
\??\c:\8b4h1.exec:\8b4h1.exe82⤵PID:4816
-
\??\c:\ekggj.exec:\ekggj.exe83⤵PID:32
-
\??\c:\uv9357.exec:\uv9357.exe84⤵PID:2812
-
\??\c:\09m42g.exec:\09m42g.exe85⤵PID:4768
-
\??\c:\7577i1.exec:\7577i1.exe86⤵PID:2032
-
\??\c:\u451371.exec:\u451371.exe87⤵PID:1392
-
\??\c:\m603rh.exec:\m603rh.exe88⤵PID:3572
-
\??\c:\1imd4.exec:\1imd4.exe89⤵PID:4928
-
\??\c:\03k39u7.exec:\03k39u7.exe90⤵PID:4072
-
\??\c:\j01sb9.exec:\j01sb9.exe91⤵PID:2328
-
\??\c:\vw35ax.exec:\vw35ax.exe92⤵PID:2928
-
\??\c:\3x10p51.exec:\3x10p51.exe93⤵PID:1488
-
\??\c:\85cr8m.exec:\85cr8m.exe94⤵PID:2924
-
\??\c:\mi3w8q.exec:\mi3w8q.exe95⤵PID:4604
-
\??\c:\xggs59.exec:\xggs59.exe96⤵PID:2016
-
\??\c:\77al7.exec:\77al7.exe97⤵PID:2608
-
\??\c:\8re40a.exec:\8re40a.exe98⤵PID:4564
-
\??\c:\w6790.exec:\w6790.exe99⤵PID:1612
-
\??\c:\beacmkk.exec:\beacmkk.exe100⤵PID:4460
-
\??\c:\1saguc7.exec:\1saguc7.exe101⤵PID:3996
-
\??\c:\c1c173.exec:\c1c173.exe102⤵PID:400
-
\??\c:\i5659.exec:\i5659.exe103⤵PID:4648
-
\??\c:\d66r8c.exec:\d66r8c.exe104⤵PID:972
-
\??\c:\8559935.exec:\8559935.exe105⤵PID:4552
-
\??\c:\dd7ndr.exec:\dd7ndr.exe106⤵PID:1760
-
\??\c:\09iemi.exec:\09iemi.exe107⤵PID:2592
-
\??\c:\g15wh8c.exec:\g15wh8c.exe108⤵PID:560
-
\??\c:\2172d.exec:\2172d.exe109⤵PID:4140
-
\??\c:\274711.exec:\274711.exe110⤵PID:1472
-
\??\c:\332mx3.exec:\332mx3.exe111⤵PID:3060
-
\??\c:\40ngq.exec:\40ngq.exe112⤵PID:4896
-
\??\c:\77v8v.exec:\77v8v.exe113⤵PID:3792
-
\??\c:\898l5.exec:\898l5.exe114⤵PID:4216
-
\??\c:\g056p4l.exec:\g056p4l.exe115⤵PID:4404
-
\??\c:\423jp.exec:\423jp.exe116⤵PID:2332
-
\??\c:\ow0e6.exec:\ow0e6.exe117⤵PID:4228
-
\??\c:\7pg58.exec:\7pg58.exe118⤵PID:1924
-
\??\c:\l0115.exec:\l0115.exe119⤵PID:3840
-
\??\c:\suoeum5.exec:\suoeum5.exe120⤵PID:3464
-
\??\c:\rkt83.exec:\rkt83.exe121⤵PID:3932
-
\??\c:\cg9im5.exec:\cg9im5.exe122⤵PID:2084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-