Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
17-05-2024 09:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e6e8126a99cba2319972df66287a5880_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
e6e8126a99cba2319972df66287a5880_NeikiAnalytics.exe
-
Size
482KB
-
MD5
e6e8126a99cba2319972df66287a5880
-
SHA1
9b8184788b48c39caeb4677cd5e29e9ca5446d89
-
SHA256
a0f23d771be6b235c965a7fc4f63e62fe842c5ff0b72d528754f091e6a0a319e
-
SHA512
d5d194a54c4c00bac4dc25fd0628f5754692ddee7a62256b8b58948fa82d98edd8e10de0e89bfbb0a561df983351a07b839690866b7667f0a7f6a469fda8a492
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwu1b26X1wjhtSizP:q7Tc2NYHUrAwqzc9
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4156-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2076-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1928-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2040-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2496-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3472-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1452-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1716-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2296-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3300-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2624-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4560-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1996-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1416-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2492-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4808-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1252-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1812-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3708-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4664-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2052-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2076-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/836-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1356-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2316-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1788-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1692-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2832-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2232-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3244-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2280-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2664-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3612-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2160-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1884-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/864-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1168-479-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/716-556-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-614-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2240-690-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-735-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2432-787-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3132-1134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-1334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-1347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4856 303lakc.exe 2076 x2r3109.exe 1928 8ctiu.exe 2040 4xua9b2.exe 2496 184gqu.exe 3472 s6f2as.exe 3000 bfx39j.exe 1452 gnvp43g.exe 1716 4r3wk.exe 1596 cs3qu.exe 4816 9s446g.exe 2296 28389.exe 3300 988ux.exe 3540 5dne31.exe 2624 q97k17.exe 4560 68d8wn1.exe 1996 emps9.exe 1416 atw0di.exe 4624 f16pvp6.exe 4736 c33m76.exe 4564 809wt.exe 2492 7a0nf.exe 3968 6w8478.exe 3104 9ue09o.exe 4808 4si584i.exe 2984 909d7t2.exe 1252 6wwhf.exe 1812 8fdec8.exe 3864 t0op8c.exe 5080 5n73k.exe 3708 2c6vqov.exe 4924 4a242.exe 4664 cif6pe.exe 2052 2uo11.exe 2076 vq7cu1j.exe 3360 635kkc.exe 4544 qo9qd6.exe 3672 53n6ma.exe 3448 r5oio9.exe 4524 mj257w.exe 836 3dw8dr0.exe 1356 4wlnj1.exe 1576 09iv5.exe 2316 s71ufr.exe 1584 jpjf64.exe 5016 3jdki6.exe 4816 u9k167.exe 1884 6kvt7.exe 2444 3r3ff.exe 2176 86fo27.exe 2596 a0s45.exe 4032 xr58m7.exe 1788 p5614q.exe 1692 s147frc.exe 5052 ll15x.exe 3200 3rife.exe 2832 g784735.exe 2924 114lr8.exe 688 rvnjjbn.exe 2232 w7957us.exe 5060 q7v8e.exe 4860 msqei.exe 3968 97lp417.exe 1072 3395g98.exe -
resource yara_rule behavioral2/memory/4856-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4156-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2076-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1928-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2040-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2040-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2496-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3000-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1452-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1716-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2296-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3300-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2624-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4560-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1416-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2492-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1252-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1812-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4664-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2052-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2076-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/836-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1356-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2316-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1788-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1692-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2832-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3244-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2280-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2664-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3612-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2160-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1884-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/864-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1168-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/716-556-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-614-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2240-690-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-710-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4156 wrote to memory of 4856 4156 e6e8126a99cba2319972df66287a5880_NeikiAnalytics.exe 91 PID 4156 wrote to memory of 4856 4156 e6e8126a99cba2319972df66287a5880_NeikiAnalytics.exe 91 PID 4156 wrote to memory of 4856 4156 e6e8126a99cba2319972df66287a5880_NeikiAnalytics.exe 91 PID 4856 wrote to memory of 2076 4856 303lakc.exe 92 PID 4856 wrote to memory of 2076 4856 303lakc.exe 92 PID 4856 wrote to memory of 2076 4856 303lakc.exe 92 PID 2076 wrote to memory of 1928 2076 x2r3109.exe 93 PID 2076 wrote to memory of 1928 2076 x2r3109.exe 93 PID 2076 wrote to memory of 1928 2076 x2r3109.exe 93 PID 1928 wrote to memory of 2040 1928 8ctiu.exe 94 PID 1928 wrote to memory of 2040 1928 8ctiu.exe 94 PID 1928 wrote to memory of 2040 1928 8ctiu.exe 94 PID 2040 wrote to memory of 2496 2040 4xua9b2.exe 95 PID 2040 wrote to memory of 2496 2040 4xua9b2.exe 95 PID 2040 wrote to memory of 2496 2040 4xua9b2.exe 95 PID 2496 wrote to memory of 3472 2496 184gqu.exe 96 PID 2496 wrote to memory of 3472 2496 184gqu.exe 96 PID 2496 wrote to memory of 3472 2496 184gqu.exe 96 PID 3472 wrote to memory of 3000 3472 s6f2as.exe 97 PID 3472 wrote to memory of 3000 3472 s6f2as.exe 97 PID 3472 wrote to memory of 3000 3472 s6f2as.exe 97 PID 3000 wrote to memory of 1452 3000 bfx39j.exe 98 PID 3000 wrote to memory of 1452 3000 bfx39j.exe 98 PID 3000 wrote to memory of 1452 3000 bfx39j.exe 98 PID 1452 wrote to memory of 1716 1452 gnvp43g.exe 99 PID 1452 wrote to memory of 1716 1452 gnvp43g.exe 99 PID 1452 wrote to memory of 1716 1452 gnvp43g.exe 99 PID 1716 wrote to memory of 1596 1716 4r3wk.exe 100 PID 1716 wrote to memory of 1596 1716 4r3wk.exe 100 PID 1716 wrote to memory of 1596 1716 4r3wk.exe 100 PID 1596 wrote to memory of 4816 1596 cs3qu.exe 101 PID 1596 wrote to memory of 4816 1596 cs3qu.exe 101 PID 1596 wrote to memory of 4816 1596 cs3qu.exe 101 PID 4816 wrote to memory of 2296 4816 9s446g.exe 102 PID 4816 wrote to memory of 2296 4816 9s446g.exe 102 PID 4816 wrote to memory of 2296 4816 9s446g.exe 102 PID 2296 wrote to memory of 3300 2296 28389.exe 103 PID 2296 wrote to memory of 3300 2296 28389.exe 103 PID 2296 wrote to memory of 3300 2296 28389.exe 103 PID 3300 wrote to memory of 3540 3300 988ux.exe 104 PID 3300 wrote to memory of 3540 3300 988ux.exe 104 PID 3300 wrote to memory of 3540 3300 988ux.exe 104 PID 3540 wrote to memory of 2624 3540 5dne31.exe 105 PID 3540 wrote to memory of 2624 3540 5dne31.exe 105 PID 3540 wrote to memory of 2624 3540 5dne31.exe 105 PID 2624 wrote to memory of 4560 2624 q97k17.exe 106 PID 2624 wrote to memory of 4560 2624 q97k17.exe 106 PID 2624 wrote to memory of 4560 2624 q97k17.exe 106 PID 4560 wrote to memory of 1996 4560 68d8wn1.exe 107 PID 4560 wrote to memory of 1996 4560 68d8wn1.exe 107 PID 4560 wrote to memory of 1996 4560 68d8wn1.exe 107 PID 1996 wrote to memory of 1416 1996 emps9.exe 108 PID 1996 wrote to memory of 1416 1996 emps9.exe 108 PID 1996 wrote to memory of 1416 1996 emps9.exe 108 PID 1416 wrote to memory of 4624 1416 atw0di.exe 109 PID 1416 wrote to memory of 4624 1416 atw0di.exe 109 PID 1416 wrote to memory of 4624 1416 atw0di.exe 109 PID 4624 wrote to memory of 4736 4624 f16pvp6.exe 110 PID 4624 wrote to memory of 4736 4624 f16pvp6.exe 110 PID 4624 wrote to memory of 4736 4624 f16pvp6.exe 110 PID 4736 wrote to memory of 4564 4736 c33m76.exe 111 PID 4736 wrote to memory of 4564 4736 c33m76.exe 111 PID 4736 wrote to memory of 4564 4736 c33m76.exe 111 PID 4564 wrote to memory of 2492 4564 809wt.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6e8126a99cba2319972df66287a5880_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e6e8126a99cba2319972df66287a5880_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\303lakc.exec:\303lakc.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\x2r3109.exec:\x2r3109.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\8ctiu.exec:\8ctiu.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\4xua9b2.exec:\4xua9b2.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\184gqu.exec:\184gqu.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\s6f2as.exec:\s6f2as.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\bfx39j.exec:\bfx39j.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\gnvp43g.exec:\gnvp43g.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\4r3wk.exec:\4r3wk.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\cs3qu.exec:\cs3qu.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\9s446g.exec:\9s446g.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\28389.exec:\28389.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\988ux.exec:\988ux.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
\??\c:\5dne31.exec:\5dne31.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\q97k17.exec:\q97k17.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\68d8wn1.exec:\68d8wn1.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\emps9.exec:\emps9.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\atw0di.exec:\atw0di.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\f16pvp6.exec:\f16pvp6.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\c33m76.exec:\c33m76.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\809wt.exec:\809wt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\7a0nf.exec:\7a0nf.exe23⤵
- Executes dropped EXE
PID:2492 -
\??\c:\6w8478.exec:\6w8478.exe24⤵
- Executes dropped EXE
PID:3968 -
\??\c:\9ue09o.exec:\9ue09o.exe25⤵
- Executes dropped EXE
PID:3104 -
\??\c:\4si584i.exec:\4si584i.exe26⤵
- Executes dropped EXE
PID:4808 -
\??\c:\909d7t2.exec:\909d7t2.exe27⤵
- Executes dropped EXE
PID:2984 -
\??\c:\6wwhf.exec:\6wwhf.exe28⤵
- Executes dropped EXE
PID:1252 -
\??\c:\8fdec8.exec:\8fdec8.exe29⤵
- Executes dropped EXE
PID:1812 -
\??\c:\t0op8c.exec:\t0op8c.exe30⤵
- Executes dropped EXE
PID:3864 -
\??\c:\5n73k.exec:\5n73k.exe31⤵
- Executes dropped EXE
PID:5080 -
\??\c:\2c6vqov.exec:\2c6vqov.exe32⤵
- Executes dropped EXE
PID:3708 -
\??\c:\4a242.exec:\4a242.exe33⤵
- Executes dropped EXE
PID:4924 -
\??\c:\cif6pe.exec:\cif6pe.exe34⤵
- Executes dropped EXE
PID:4664 -
\??\c:\2uo11.exec:\2uo11.exe35⤵
- Executes dropped EXE
PID:2052 -
\??\c:\vq7cu1j.exec:\vq7cu1j.exe36⤵
- Executes dropped EXE
PID:2076 -
\??\c:\635kkc.exec:\635kkc.exe37⤵
- Executes dropped EXE
PID:3360 -
\??\c:\qo9qd6.exec:\qo9qd6.exe38⤵
- Executes dropped EXE
PID:4544 -
\??\c:\53n6ma.exec:\53n6ma.exe39⤵
- Executes dropped EXE
PID:3672 -
\??\c:\r5oio9.exec:\r5oio9.exe40⤵
- Executes dropped EXE
PID:3448 -
\??\c:\mj257w.exec:\mj257w.exe41⤵
- Executes dropped EXE
PID:4524 -
\??\c:\3dw8dr0.exec:\3dw8dr0.exe42⤵
- Executes dropped EXE
PID:836 -
\??\c:\4wlnj1.exec:\4wlnj1.exe43⤵
- Executes dropped EXE
PID:1356 -
\??\c:\09iv5.exec:\09iv5.exe44⤵
- Executes dropped EXE
PID:1576 -
\??\c:\s71ufr.exec:\s71ufr.exe45⤵
- Executes dropped EXE
PID:2316 -
\??\c:\jpjf64.exec:\jpjf64.exe46⤵
- Executes dropped EXE
PID:1584 -
\??\c:\3jdki6.exec:\3jdki6.exe47⤵
- Executes dropped EXE
PID:5016 -
\??\c:\u9k167.exec:\u9k167.exe48⤵
- Executes dropped EXE
PID:4816 -
\??\c:\6kvt7.exec:\6kvt7.exe49⤵
- Executes dropped EXE
PID:1884 -
\??\c:\3r3ff.exec:\3r3ff.exe50⤵
- Executes dropped EXE
PID:2444 -
\??\c:\86fo27.exec:\86fo27.exe51⤵
- Executes dropped EXE
PID:2176 -
\??\c:\a0s45.exec:\a0s45.exe52⤵
- Executes dropped EXE
PID:2596 -
\??\c:\xr58m7.exec:\xr58m7.exe53⤵
- Executes dropped EXE
PID:4032 -
\??\c:\p5614q.exec:\p5614q.exe54⤵
- Executes dropped EXE
PID:1788 -
\??\c:\s147frc.exec:\s147frc.exe55⤵
- Executes dropped EXE
PID:1692 -
\??\c:\ll15x.exec:\ll15x.exe56⤵
- Executes dropped EXE
PID:5052 -
\??\c:\3rife.exec:\3rife.exe57⤵
- Executes dropped EXE
PID:3200 -
\??\c:\g784735.exec:\g784735.exe58⤵
- Executes dropped EXE
PID:2832 -
\??\c:\114lr8.exec:\114lr8.exe59⤵
- Executes dropped EXE
PID:2924 -
\??\c:\rvnjjbn.exec:\rvnjjbn.exe60⤵
- Executes dropped EXE
PID:688 -
\??\c:\w7957us.exec:\w7957us.exe61⤵
- Executes dropped EXE
PID:2232 -
\??\c:\q7v8e.exec:\q7v8e.exe62⤵
- Executes dropped EXE
PID:5060 -
\??\c:\msqei.exec:\msqei.exe63⤵
- Executes dropped EXE
PID:4860 -
\??\c:\97lp417.exec:\97lp417.exe64⤵
- Executes dropped EXE
PID:3968 -
\??\c:\3395g98.exec:\3395g98.exe65⤵
- Executes dropped EXE
PID:1072 -
\??\c:\g81h4.exec:\g81h4.exe66⤵PID:3316
-
\??\c:\tsjtc7g.exec:\tsjtc7g.exe67⤵PID:3244
-
\??\c:\7skcx.exec:\7skcx.exe68⤵PID:2280
-
\??\c:\seh9h.exec:\seh9h.exe69⤵PID:2320
-
\??\c:\nk972dd.exec:\nk972dd.exe70⤵PID:3148
-
\??\c:\w50ri.exec:\w50ri.exe71⤵PID:4400
-
\??\c:\1ti8i1.exec:\1ti8i1.exe72⤵PID:2904
-
\??\c:\c1m67tv.exec:\c1m67tv.exe73⤵PID:2664
-
\??\c:\2412556.exec:\2412556.exe74⤵PID:2260
-
\??\c:\aq9579v.exec:\aq9579v.exe75⤵PID:3708
-
\??\c:\09o9mwk.exec:\09o9mwk.exe76⤵PID:4156
-
\??\c:\p9bg03.exec:\p9bg03.exe77⤵PID:232
-
\??\c:\hfcsk5u.exec:\hfcsk5u.exe78⤵PID:3832
-
\??\c:\g17g1.exec:\g17g1.exe79⤵PID:2052
-
\??\c:\132m4pj.exec:\132m4pj.exe80⤵PID:2500
-
\??\c:\4l4oi0d.exec:\4l4oi0d.exe81⤵PID:4580
-
\??\c:\08n5ur.exec:\08n5ur.exe82⤵PID:3868
-
\??\c:\qq9tfl.exec:\qq9tfl.exe83⤵PID:3672
-
\??\c:\clfmw2.exec:\clfmw2.exe84⤵PID:4016
-
\??\c:\88q75d.exec:\88q75d.exe85⤵PID:3532
-
\??\c:\r7g9129.exec:\r7g9129.exe86⤵PID:3660
-
\??\c:\s36p6d2.exec:\s36p6d2.exe87⤵PID:3612
-
\??\c:\1dw8o1q.exec:\1dw8o1q.exe88⤵PID:2160
-
\??\c:\4789p3.exec:\4789p3.exe89⤵PID:3772
-
\??\c:\8st7bld.exec:\8st7bld.exe90⤵PID:2228
-
\??\c:\cim1d0x.exec:\cim1d0x.exe91⤵PID:940
-
\??\c:\5bc3j27.exec:\5bc3j27.exe92⤵PID:4816
-
\??\c:\hlfr1wq.exec:\hlfr1wq.exe93⤵PID:1884
-
\??\c:\5d352.exec:\5d352.exe94⤵PID:2356
-
\??\c:\gq5uuj.exec:\gq5uuj.exe95⤵PID:2332
-
\??\c:\9ab1q.exec:\9ab1q.exe96⤵PID:2624
-
\??\c:\u0ng2x4.exec:\u0ng2x4.exe97⤵PID:4236
-
\??\c:\rjs7e.exec:\rjs7e.exe98⤵PID:832
-
\??\c:\1fkts.exec:\1fkts.exe99⤵PID:4444
-
\??\c:\pieh51.exec:\pieh51.exe100⤵PID:5052
-
\??\c:\w166oq.exec:\w166oq.exe101⤵PID:3020
-
\??\c:\6bu977k.exec:\6bu977k.exe102⤵PID:3524
-
\??\c:\4n3u57g.exec:\4n3u57g.exe103⤵PID:456
-
\??\c:\x9f06ow.exec:\x9f06ow.exe104⤵PID:864
-
\??\c:\wntlv5p.exec:\wntlv5p.exe105⤵PID:4996
-
\??\c:\78dnshv.exec:\78dnshv.exe106⤵PID:4796
-
\??\c:\4nv3wq.exec:\4nv3wq.exe107⤵PID:4940
-
\??\c:\8p56v40.exec:\8p56v40.exe108⤵PID:3996
-
\??\c:\35rfs.exec:\35rfs.exe109⤵PID:5044
-
\??\c:\dkm5n.exec:\dkm5n.exe110⤵PID:1144
-
\??\c:\5c4d67.exec:\5c4d67.exe111⤵PID:4876
-
\??\c:\g39pwt.exec:\g39pwt.exe112⤵PID:1880
-
\??\c:\80cj39.exec:\80cj39.exe113⤵PID:2024
-
\??\c:\1g7a6dt.exec:\1g7a6dt.exe114⤵PID:1812
-
\??\c:\39w7wnk.exec:\39w7wnk.exe115⤵PID:4396
-
\??\c:\71d296.exec:\71d296.exe116⤵PID:4452
-
\??\c:\5923166.exec:\5923166.exe117⤵PID:2916
-
\??\c:\dfp53.exec:\dfp53.exe118⤵PID:1168
-
\??\c:\3u12k7.exec:\3u12k7.exe119⤵PID:760
-
\??\c:\6159l4.exec:\6159l4.exe120⤵PID:4916
-
\??\c:\d61o4m1.exec:\d61o4m1.exe121⤵PID:3168
-
\??\c:\345el1a.exec:\345el1a.exe122⤵PID:404
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-