Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
157s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 04:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7ae66d6d27607ddbb8e1fa885a6b5bd0_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
7ae66d6d27607ddbb8e1fa885a6b5bd0_NeikiAnalytics.exe
-
Size
210KB
-
MD5
7ae66d6d27607ddbb8e1fa885a6b5bd0
-
SHA1
4d89a67232429ee882bbd556892c53fb38eb4bfb
-
SHA256
c4c9872760cd660d0c47330b67e908cafab8fbee9b5c83eaa2b6f9ab808119f5
-
SHA512
030f0caa8ec2b0dfb82c5a3ce2ddd713fa5c7fefb63410d4440bac0b9dbe7458367779109f85d0ec875e082cc5f964f52be6c7d2e4483b0ea810951bdcc2a18e
-
SSDEEP
1536:wvQBeOGtrYSSsrc93UBIfdC67m6AJiqQfg3Cip8iXAsG5M0h:whOm2sI93UufdC67cizfmCiiiXAd
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2468-7-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/5060-12-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/2016-20-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4196-25-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4856-30-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/1904-38-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/1912-47-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4356-50-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/212-59-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/2980-65-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4532-67-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/1124-79-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4912-80-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/2516-89-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/2208-100-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4768-106-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/3808-112-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/812-123-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/3532-129-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/1240-134-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4780-140-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4864-151-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/3192-166-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/3176-172-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/3676-188-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4076-192-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4880-193-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4376-195-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/2212-202-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4348-207-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/832-219-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4268-223-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4536-227-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4048-234-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4144-250-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/2816-259-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4956-271-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/3488-275-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/1376-277-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/2688-286-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4748-295-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4900-309-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4788-322-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/3676-348-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/2440-352-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/2244-356-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4376-360-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4348-370-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/960-377-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4424-381-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/5076-400-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4912-420-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4720-484-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/2496-500-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4424-672-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/5028-731-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/1124-826-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4368-857-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/2376-900-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/1288-965-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/1092-975-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4180-997-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4876-1007-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5060 w29qhc.exe 2016 a3985.exe 4196 30oum.exe 4856 x975eeh.exe 1048 h6p1x13.exe 1904 761c5v.exe 1912 76mmko4.exe 4356 162lani.exe 212 125g75.exe 2980 i0q0qs8.exe 4532 w0xqu.exe 1124 7wngb63.exe 4912 9430kbp.exe 2516 f3o849.exe 2296 hh5n03.exe 2208 k5bu1u9.exe 4768 0tb66.exe 3808 ajs8i2.exe 1092 92f3d.exe 812 0sa41.exe 3532 0x5tu0s.exe 1240 ecv07n3.exe 4780 381838d.exe 4284 i9751o.exe 4864 pa21fi3.exe 672 9s6n6h.exe 4760 u77019s.exe 3192 gpgpq.exe 3176 7mb3nd.exe 3940 dueov.exe 912 17gmp.exe 3676 53r3d1.exe 4076 00ox3.exe 4880 5ri11.exe 2212 07p6e6l.exe 4660 x9out3o.exe 4348 7m31el.exe 640 9w141.exe 4424 t90fs10.exe 832 7kt1lc7.exe 4268 x190x11.exe 4536 iuk55n.exe 3344 68646.exe 4048 15t8rc.exe 4892 t5413.exe 4456 26wxt.exe 1172 4knu69.exe 2980 e2t1m1.exe 4144 im980.exe 940 90u72f.exe 2376 sbw7k.exe 2816 8d2m9.exe 3968 834ihk9.exe 1664 2pk1q.exe 4956 i668617.exe 3488 6uo479o.exe 1376 4k7u1.exe 2004 pbbr3.exe 2688 3r7foi.exe 4484 7173w5n.exe 452 rj09h3.exe 4748 42o87.exe 4904 644e79.exe 2596 n5qkd96.exe -
resource yara_rule behavioral2/memory/5060-5-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2468-7-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/5060-12-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2016-13-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2016-20-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4196-25-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4856-30-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/1904-38-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/1912-47-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4356-50-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/212-59-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2980-65-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4532-67-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/1124-79-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4912-80-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2516-89-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2208-100-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4768-106-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/3808-112-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/812-123-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/3532-129-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/1240-134-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4780-140-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4864-151-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/3192-166-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/3176-172-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/912-179-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/3676-188-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4076-192-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4880-193-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4376-195-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2212-202-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4348-207-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/832-219-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4268-223-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4536-227-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4048-234-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/940-251-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4144-250-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2816-259-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4956-271-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/3488-275-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/1376-277-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2688-286-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4748-295-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4900-309-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4788-322-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/3676-348-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2440-352-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2244-356-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4376-360-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4348-370-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/960-377-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4424-381-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/5076-400-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4912-420-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4720-484-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2496-500-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4424-672-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/1748-694-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/5028-731-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4180-738-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/1124-826-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4368-857-0x0000000000400000-0x000000000042C000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2468 wrote to memory of 5060 2468 7ae66d6d27607ddbb8e1fa885a6b5bd0_NeikiAnalytics.exe 91 PID 2468 wrote to memory of 5060 2468 7ae66d6d27607ddbb8e1fa885a6b5bd0_NeikiAnalytics.exe 91 PID 2468 wrote to memory of 5060 2468 7ae66d6d27607ddbb8e1fa885a6b5bd0_NeikiAnalytics.exe 91 PID 5060 wrote to memory of 2016 5060 w29qhc.exe 92 PID 5060 wrote to memory of 2016 5060 w29qhc.exe 92 PID 5060 wrote to memory of 2016 5060 w29qhc.exe 92 PID 2016 wrote to memory of 4196 2016 a3985.exe 93 PID 2016 wrote to memory of 4196 2016 a3985.exe 93 PID 2016 wrote to memory of 4196 2016 a3985.exe 93 PID 4196 wrote to memory of 4856 4196 30oum.exe 94 PID 4196 wrote to memory of 4856 4196 30oum.exe 94 PID 4196 wrote to memory of 4856 4196 30oum.exe 94 PID 4856 wrote to memory of 1048 4856 x975eeh.exe 95 PID 4856 wrote to memory of 1048 4856 x975eeh.exe 95 PID 4856 wrote to memory of 1048 4856 x975eeh.exe 95 PID 1048 wrote to memory of 1904 1048 h6p1x13.exe 96 PID 1048 wrote to memory of 1904 1048 h6p1x13.exe 96 PID 1048 wrote to memory of 1904 1048 h6p1x13.exe 96 PID 1904 wrote to memory of 1912 1904 761c5v.exe 97 PID 1904 wrote to memory of 1912 1904 761c5v.exe 97 PID 1904 wrote to memory of 1912 1904 761c5v.exe 97 PID 1912 wrote to memory of 4356 1912 76mmko4.exe 98 PID 1912 wrote to memory of 4356 1912 76mmko4.exe 98 PID 1912 wrote to memory of 4356 1912 76mmko4.exe 98 PID 4356 wrote to memory of 212 4356 162lani.exe 99 PID 4356 wrote to memory of 212 4356 162lani.exe 99 PID 4356 wrote to memory of 212 4356 162lani.exe 99 PID 212 wrote to memory of 2980 212 125g75.exe 100 PID 212 wrote to memory of 2980 212 125g75.exe 100 PID 212 wrote to memory of 2980 212 125g75.exe 100 PID 2980 wrote to memory of 4532 2980 i0q0qs8.exe 101 PID 2980 wrote to memory of 4532 2980 i0q0qs8.exe 101 PID 2980 wrote to memory of 4532 2980 i0q0qs8.exe 101 PID 4532 wrote to memory of 1124 4532 w0xqu.exe 102 PID 4532 wrote to memory of 1124 4532 w0xqu.exe 102 PID 4532 wrote to memory of 1124 4532 w0xqu.exe 102 PID 1124 wrote to memory of 4912 1124 7wngb63.exe 103 PID 1124 wrote to memory of 4912 1124 7wngb63.exe 103 PID 1124 wrote to memory of 4912 1124 7wngb63.exe 103 PID 4912 wrote to memory of 2516 4912 9430kbp.exe 104 PID 4912 wrote to memory of 2516 4912 9430kbp.exe 104 PID 4912 wrote to memory of 2516 4912 9430kbp.exe 104 PID 2516 wrote to memory of 2296 2516 f3o849.exe 105 PID 2516 wrote to memory of 2296 2516 f3o849.exe 105 PID 2516 wrote to memory of 2296 2516 f3o849.exe 105 PID 2296 wrote to memory of 2208 2296 hh5n03.exe 106 PID 2296 wrote to memory of 2208 2296 hh5n03.exe 106 PID 2296 wrote to memory of 2208 2296 hh5n03.exe 106 PID 2208 wrote to memory of 4768 2208 k5bu1u9.exe 107 PID 2208 wrote to memory of 4768 2208 k5bu1u9.exe 107 PID 2208 wrote to memory of 4768 2208 k5bu1u9.exe 107 PID 4768 wrote to memory of 3808 4768 0tb66.exe 108 PID 4768 wrote to memory of 3808 4768 0tb66.exe 108 PID 4768 wrote to memory of 3808 4768 0tb66.exe 108 PID 3808 wrote to memory of 1092 3808 ajs8i2.exe 109 PID 3808 wrote to memory of 1092 3808 ajs8i2.exe 109 PID 3808 wrote to memory of 1092 3808 ajs8i2.exe 109 PID 1092 wrote to memory of 812 1092 92f3d.exe 110 PID 1092 wrote to memory of 812 1092 92f3d.exe 110 PID 1092 wrote to memory of 812 1092 92f3d.exe 110 PID 812 wrote to memory of 3532 812 0sa41.exe 111 PID 812 wrote to memory of 3532 812 0sa41.exe 111 PID 812 wrote to memory of 3532 812 0sa41.exe 111 PID 3532 wrote to memory of 1240 3532 0x5tu0s.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ae66d6d27607ddbb8e1fa885a6b5bd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7ae66d6d27607ddbb8e1fa885a6b5bd0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\w29qhc.exec:\w29qhc.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\a3985.exec:\a3985.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\30oum.exec:\30oum.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
\??\c:\x975eeh.exec:\x975eeh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\h6p1x13.exec:\h6p1x13.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\761c5v.exec:\761c5v.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\76mmko4.exec:\76mmko4.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\162lani.exec:\162lani.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\125g75.exec:\125g75.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\i0q0qs8.exec:\i0q0qs8.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\w0xqu.exec:\w0xqu.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\7wngb63.exec:\7wngb63.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
\??\c:\9430kbp.exec:\9430kbp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\f3o849.exec:\f3o849.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\hh5n03.exec:\hh5n03.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\k5bu1u9.exec:\k5bu1u9.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\0tb66.exec:\0tb66.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\ajs8i2.exec:\ajs8i2.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\92f3d.exec:\92f3d.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\0sa41.exec:\0sa41.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\0x5tu0s.exec:\0x5tu0s.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\ecv07n3.exec:\ecv07n3.exe23⤵
- Executes dropped EXE
PID:1240 -
\??\c:\381838d.exec:\381838d.exe24⤵
- Executes dropped EXE
PID:4780 -
\??\c:\i9751o.exec:\i9751o.exe25⤵
- Executes dropped EXE
PID:4284 -
\??\c:\pa21fi3.exec:\pa21fi3.exe26⤵
- Executes dropped EXE
PID:4864 -
\??\c:\9s6n6h.exec:\9s6n6h.exe27⤵
- Executes dropped EXE
PID:672 -
\??\c:\u77019s.exec:\u77019s.exe28⤵
- Executes dropped EXE
PID:4760 -
\??\c:\gpgpq.exec:\gpgpq.exe29⤵
- Executes dropped EXE
PID:3192 -
\??\c:\7mb3nd.exec:\7mb3nd.exe30⤵
- Executes dropped EXE
PID:3176 -
\??\c:\dueov.exec:\dueov.exe31⤵
- Executes dropped EXE
PID:3940 -
\??\c:\17gmp.exec:\17gmp.exe32⤵
- Executes dropped EXE
PID:912 -
\??\c:\53r3d1.exec:\53r3d1.exe33⤵
- Executes dropped EXE
PID:3676 -
\??\c:\00ox3.exec:\00ox3.exe34⤵
- Executes dropped EXE
PID:4076 -
\??\c:\5ri11.exec:\5ri11.exe35⤵
- Executes dropped EXE
PID:4880 -
\??\c:\69q00.exec:\69q00.exe36⤵PID:4376
-
\??\c:\07p6e6l.exec:\07p6e6l.exe37⤵
- Executes dropped EXE
PID:2212 -
\??\c:\x9out3o.exec:\x9out3o.exe38⤵
- Executes dropped EXE
PID:4660 -
\??\c:\7m31el.exec:\7m31el.exe39⤵
- Executes dropped EXE
PID:4348 -
\??\c:\9w141.exec:\9w141.exe40⤵
- Executes dropped EXE
PID:640 -
\??\c:\t90fs10.exec:\t90fs10.exe41⤵
- Executes dropped EXE
PID:4424 -
\??\c:\7kt1lc7.exec:\7kt1lc7.exe42⤵
- Executes dropped EXE
PID:832 -
\??\c:\x190x11.exec:\x190x11.exe43⤵
- Executes dropped EXE
PID:4268 -
\??\c:\iuk55n.exec:\iuk55n.exe44⤵
- Executes dropped EXE
PID:4536 -
\??\c:\68646.exec:\68646.exe45⤵
- Executes dropped EXE
PID:3344 -
\??\c:\15t8rc.exec:\15t8rc.exe46⤵
- Executes dropped EXE
PID:4048 -
\??\c:\t5413.exec:\t5413.exe47⤵
- Executes dropped EXE
PID:4892 -
\??\c:\26wxt.exec:\26wxt.exe48⤵
- Executes dropped EXE
PID:4456 -
\??\c:\4knu69.exec:\4knu69.exe49⤵
- Executes dropped EXE
PID:1172 -
\??\c:\e2t1m1.exec:\e2t1m1.exe50⤵
- Executes dropped EXE
PID:2980 -
\??\c:\im980.exec:\im980.exe51⤵
- Executes dropped EXE
PID:4144 -
\??\c:\90u72f.exec:\90u72f.exe52⤵
- Executes dropped EXE
PID:940 -
\??\c:\sbw7k.exec:\sbw7k.exe53⤵
- Executes dropped EXE
PID:2376 -
\??\c:\8d2m9.exec:\8d2m9.exe54⤵
- Executes dropped EXE
PID:2816 -
\??\c:\834ihk9.exec:\834ihk9.exe55⤵
- Executes dropped EXE
PID:3968 -
\??\c:\2pk1q.exec:\2pk1q.exe56⤵
- Executes dropped EXE
PID:1664 -
\??\c:\i668617.exec:\i668617.exe57⤵
- Executes dropped EXE
PID:4956 -
\??\c:\6uo479o.exec:\6uo479o.exe58⤵
- Executes dropped EXE
PID:3488 -
\??\c:\4k7u1.exec:\4k7u1.exe59⤵
- Executes dropped EXE
PID:1376 -
\??\c:\pbbr3.exec:\pbbr3.exe60⤵
- Executes dropped EXE
PID:2004 -
\??\c:\3r7foi.exec:\3r7foi.exe61⤵
- Executes dropped EXE
PID:2688 -
\??\c:\7173w5n.exec:\7173w5n.exe62⤵
- Executes dropped EXE
PID:4484 -
\??\c:\rj09h3.exec:\rj09h3.exe63⤵
- Executes dropped EXE
PID:452 -
\??\c:\42o87.exec:\42o87.exe64⤵
- Executes dropped EXE
PID:4748 -
\??\c:\644e79.exec:\644e79.exe65⤵
- Executes dropped EXE
PID:4904 -
\??\c:\n5qkd96.exec:\n5qkd96.exe66⤵
- Executes dropped EXE
PID:2596 -
\??\c:\j2thc7.exec:\j2thc7.exe67⤵PID:4360
-
\??\c:\4bnipkc.exec:\4bnipkc.exe68⤵PID:4900
-
\??\c:\uhrx3.exec:\uhrx3.exe69⤵PID:4784
-
\??\c:\869w93.exec:\869w93.exe70⤵PID:4940
-
\??\c:\271u6.exec:\271u6.exe71⤵PID:1132
-
\??\c:\6fc79n.exec:\6fc79n.exe72⤵PID:4788
-
\??\c:\036e3p.exec:\036e3p.exe73⤵PID:3144
-
\??\c:\8f0xl.exec:\8f0xl.exe74⤵PID:3396
-
\??\c:\w5am90.exec:\w5am90.exe75⤵PID:1120
-
\??\c:\e5k279g.exec:\e5k279g.exe76⤵PID:3176
-
\??\c:\636l41i.exec:\636l41i.exe77⤵PID:3824
-
\??\c:\6ha8k.exec:\6ha8k.exe78⤵PID:4404
-
\??\c:\i5u0d.exec:\i5u0d.exe79⤵PID:4012
-
\??\c:\276p117.exec:\276p117.exe80⤵PID:3676
-
\??\c:\5355w1.exec:\5355w1.exe81⤵PID:2440
-
\??\c:\9n220r.exec:\9n220r.exe82⤵PID:2244
-
\??\c:\sqw6261.exec:\sqw6261.exe83⤵PID:4376
-
\??\c:\vt2646.exec:\vt2646.exe84⤵PID:2212
-
\??\c:\gn853.exec:\gn853.exe85⤵PID:4660
-
\??\c:\3sa857.exec:\3sa857.exe86⤵PID:4348
-
\??\c:\k27h79k.exec:\k27h79k.exe87⤵PID:2976
-
\??\c:\w01791.exec:\w01791.exe88⤵PID:960
-
\??\c:\ok7d0hd.exec:\ok7d0hd.exe89⤵PID:4424
-
\??\c:\2huv1ee.exec:\2huv1ee.exe90⤵PID:1028
-
\??\c:\aj9jrg.exec:\aj9jrg.exe91⤵PID:3040
-
\??\c:\qw41nk.exec:\qw41nk.exe92⤵PID:3616
-
\??\c:\4agug1.exec:\4agug1.exe93⤵PID:3344
-
\??\c:\wu37s.exec:\wu37s.exe94⤵PID:4160
-
\??\c:\a54015.exec:\a54015.exe95⤵PID:5076
-
\??\c:\j0mm1iu.exec:\j0mm1iu.exe96⤵PID:2108
-
\??\c:\v9181m8.exec:\v9181m8.exe97⤵PID:1164
-
\??\c:\5g5d94m.exec:\5g5d94m.exe98⤵PID:1180
-
\??\c:\vs7ci95.exec:\vs7ci95.exe99⤵PID:3092
-
\??\c:\2jgnr.exec:\2jgnr.exe100⤵PID:2908
-
\??\c:\72g2l2.exec:\72g2l2.exe101⤵PID:4912
-
\??\c:\6b5p73.exec:\6b5p73.exe102⤵PID:3992
-
\??\c:\4q7ef4.exec:\4q7ef4.exe103⤵PID:2744
-
\??\c:\f2u8ni0.exec:\f2u8ni0.exe104⤵PID:4492
-
\??\c:\9wdw768.exec:\9wdw768.exe105⤵PID:4644
-
\??\c:\tu2t854.exec:\tu2t854.exe106⤵PID:4768
-
\??\c:\0829r.exec:\0829r.exe107⤵PID:2400
-
\??\c:\23un294.exec:\23un294.exe108⤵PID:3200
-
\??\c:\qw2nqo4.exec:\qw2nqo4.exe109⤵PID:2984
-
\??\c:\uskmeg4.exec:\uskmeg4.exe110⤵PID:3380
-
\??\c:\390f17.exec:\390f17.exe111⤵PID:4132
-
\??\c:\db7w33f.exec:\db7w33f.exe112⤵PID:3532
-
\??\c:\h1107.exec:\h1107.exe113⤵PID:4904
-
\??\c:\dor2h.exec:\dor2h.exe114⤵PID:2596
-
\??\c:\49k1a92.exec:\49k1a92.exe115⤵PID:4360
-
\??\c:\o68gkdb.exec:\o68gkdb.exe116⤵PID:4776
-
\??\c:\11c42.exec:\11c42.exe117⤵PID:4784
-
\??\c:\0c197i.exec:\0c197i.exe118⤵PID:1768
-
\??\c:\vj1dwq.exec:\vj1dwq.exe119⤵PID:392
-
\??\c:\9m05w.exec:\9m05w.exe120⤵PID:4760
-
\??\c:\a430q59.exec:\a430q59.exe121⤵PID:2988
-
\??\c:\5ocw0.exec:\5ocw0.exe122⤵PID:4720
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-