Analysis
-
max time kernel
154s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 01:28
Behavioral task
behavioral1
Sample
6d2258b03719a02e4562743503b8a070_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
6d2258b03719a02e4562743503b8a070_NeikiAnalytics.exe
-
Size
80KB
-
MD5
6d2258b03719a02e4562743503b8a070
-
SHA1
c10fd52056cb1ebac0627c9cf48c183d5696fd20
-
SHA256
22d2ff7d6a95ca9b505da69bd702bfa1557722bd593ae241f099e97e2a824d17
-
SHA512
097fda74c3bb5b49a646abf33427cab400e770f4de6d14dfb57ffdf2cf03c55ecc60d6fe511e12e7f22349c1819b49b7beb769e3ec9afa364d84d8ed4cb221b3
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+C2HVM1p6T7s:zhOmTsF93UYfwC6GIoutiTU2HVS63s
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4548-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1844-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3552-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4004-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1660-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/456-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4580-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2312-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/488-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2964-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1148-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2516-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1400-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1544-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1500-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3632-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1648-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4304-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4344-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1536-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3564-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2728-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3440-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4916-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3396-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2096-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/368-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/320-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4440-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4188-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1932-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4504-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/656-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1548-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2192-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4516-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2020-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3696-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3744-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4044-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3480-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5032-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/852-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5068-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2308-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/572-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3736-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1344-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1804-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4376-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2952-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/548-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3800-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4392-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3724-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2376-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4104-388-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4004-394-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1092-452-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4604-471-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2448-594-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3708-697-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1108-706-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
95t513.exeq91d755.exeabh0i.exetqil1m6.exeek1th3.exed59ci4.exehc3bq.exex1g9wn.exelmg1ws.exef81h3.exedkcf7.execm3mu.exeb4vr91.exe7670371.exevn44j7n.exex6s78.exe930235.exe5uo1d.exe6p1gn1.exetqux3.exeq57bm6s.exeom2gs7.exev786x.exe1729e.exe7l19lf.exe5wbke.exencr57i.exen577x8.exejadva03.exe04s720.exeve7k1k.exe89957.exeeo6jg.exe3n34l97.exei48svdh.exe1q937e5.exemke662.exenudq95.exe8uu3a.exe53317.exe5c789b9.exet59w2f.exea81wk0.exe4l73cs.exeg67c238.exek1772.exe67e6x9.exeg6o3c97.exejmpp2w.exe8gs65jj.exetw4ee.exexj3oo.exe1fmw0e7.exei8q8euf.exe12cfc.exej1m57bt.exer82u7io.exe8t73bw.exet6x2qq.exebl2g60.exej72cl3.exe4i3aj.exe7659e.exek9p741r.exepid process 4548 95t513.exe 3552 q91d755.exe 4004 abh0i.exe 1660 tqil1m6.exe 456 ek1th3.exe 4580 d59ci4.exe 2312 hc3bq.exe 1652 x1g9wn.exe 488 lmg1ws.exe 2480 f81h3.exe 2964 dkcf7.exe 1148 cm3mu.exe 2516 b4vr91.exe 1400 7670371.exe 1544 vn44j7n.exe 1724 x6s78.exe 1500 930235.exe 3632 5uo1d.exe 1648 6p1gn1.exe 4304 tqux3.exe 2324 q57bm6s.exe 4344 om2gs7.exe 1536 v786x.exe 3564 1729e.exe 2728 7l19lf.exe 3440 5wbke.exe 4916 ncr57i.exe 3156 n577x8.exe 3396 jadva03.exe 2672 04s720.exe 2096 ve7k1k.exe 368 89957.exe 5084 eo6jg.exe 320 3n34l97.exe 4440 i48svdh.exe 4188 1q937e5.exe 1932 mke662.exe 2144 nudq95.exe 4504 8uu3a.exe 656 53317.exe 1548 5c789b9.exe 2192 t59w2f.exe 2168 a81wk0.exe 3452 4l73cs.exe 4516 g67c238.exe 2020 k1772.exe 3696 67e6x9.exe 4392 g6o3c97.exe 1392 jmpp2w.exe 3744 8gs65jj.exe 4044 tw4ee.exe 2964 xj3oo.exe 1004 1fmw0e7.exe 2940 i8q8euf.exe 2492 12cfc.exe 3480 j1m57bt.exe 5032 r82u7io.exe 2888 8t73bw.exe 852 t6x2qq.exe 4808 bl2g60.exe 5068 j72cl3.exe 2308 4i3aj.exe 232 7659e.exe 3672 k9p741r.exe -
Processes:
resource yara_rule behavioral2/memory/1844-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\95t513.exe upx C:\q91d755.exe upx behavioral2/memory/4548-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1844-10-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\abh0i.exe upx behavioral2/memory/3552-14-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tqil1m6.exe upx behavioral2/memory/4004-19-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ek1th3.exe upx behavioral2/memory/1660-24-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\d59ci4.exe upx behavioral2/memory/456-29-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hc3bq.exe upx behavioral2/memory/2312-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4580-34-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\x1g9wn.exe upx behavioral2/memory/2312-41-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lmg1ws.exe upx C:\f81h3.exe upx behavioral2/memory/488-49-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dkcf7.exe upx C:\cm3mu.exe upx behavioral2/memory/2964-58-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\b4vr91.exe upx behavioral2/memory/1148-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2516-68-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7670371.exe upx C:\vn44j7n.exe upx behavioral2/memory/1400-73-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\x6s78.exe upx behavioral2/memory/1544-78-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\930235.exe upx C:\5uo1d.exe upx behavioral2/memory/1500-87-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\6p1gn1.exe upx behavioral2/memory/3632-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1648-94-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tqux3.exe upx C:\q57bm6s.exe upx behavioral2/memory/4304-102-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\om2gs7.exe upx C:\v786x.exe upx behavioral2/memory/4344-111-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1729e.exe upx behavioral2/memory/1536-116-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7l19lf.exe upx behavioral2/memory/3564-121-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5wbke.exe upx behavioral2/memory/2728-127-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ncr57i.exe upx behavioral2/memory/3440-131-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\n577x8.exe upx behavioral2/memory/4916-136-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jadva03.exe upx C:\04s720.exe upx behavioral2/memory/3396-145-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ve7k1k.exe upx C:\89957.exe upx behavioral2/memory/2096-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/368-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/320-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4440-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4188-167-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6d2258b03719a02e4562743503b8a070_NeikiAnalytics.exe95t513.exeq91d755.exeabh0i.exetqil1m6.exeek1th3.exed59ci4.exehc3bq.exex1g9wn.exelmg1ws.exef81h3.exedkcf7.execm3mu.exeb4vr91.exe7670371.exevn44j7n.exex6s78.exe930235.exe5uo1d.exe6p1gn1.exetqux3.exeq57bm6s.exedescription pid process target process PID 1844 wrote to memory of 4548 1844 6d2258b03719a02e4562743503b8a070_NeikiAnalytics.exe 95t513.exe PID 1844 wrote to memory of 4548 1844 6d2258b03719a02e4562743503b8a070_NeikiAnalytics.exe 95t513.exe PID 1844 wrote to memory of 4548 1844 6d2258b03719a02e4562743503b8a070_NeikiAnalytics.exe 95t513.exe PID 4548 wrote to memory of 3552 4548 95t513.exe q91d755.exe PID 4548 wrote to memory of 3552 4548 95t513.exe q91d755.exe PID 4548 wrote to memory of 3552 4548 95t513.exe q91d755.exe PID 3552 wrote to memory of 4004 3552 q91d755.exe abh0i.exe PID 3552 wrote to memory of 4004 3552 q91d755.exe abh0i.exe PID 3552 wrote to memory of 4004 3552 q91d755.exe abh0i.exe PID 4004 wrote to memory of 1660 4004 abh0i.exe tqil1m6.exe PID 4004 wrote to memory of 1660 4004 abh0i.exe tqil1m6.exe PID 4004 wrote to memory of 1660 4004 abh0i.exe tqil1m6.exe PID 1660 wrote to memory of 456 1660 tqil1m6.exe ek1th3.exe PID 1660 wrote to memory of 456 1660 tqil1m6.exe ek1th3.exe PID 1660 wrote to memory of 456 1660 tqil1m6.exe ek1th3.exe PID 456 wrote to memory of 4580 456 ek1th3.exe d59ci4.exe PID 456 wrote to memory of 4580 456 ek1th3.exe d59ci4.exe PID 456 wrote to memory of 4580 456 ek1th3.exe d59ci4.exe PID 4580 wrote to memory of 2312 4580 d59ci4.exe hc3bq.exe PID 4580 wrote to memory of 2312 4580 d59ci4.exe hc3bq.exe PID 4580 wrote to memory of 2312 4580 d59ci4.exe hc3bq.exe PID 2312 wrote to memory of 1652 2312 hc3bq.exe x1g9wn.exe PID 2312 wrote to memory of 1652 2312 hc3bq.exe x1g9wn.exe PID 2312 wrote to memory of 1652 2312 hc3bq.exe x1g9wn.exe PID 1652 wrote to memory of 488 1652 x1g9wn.exe lmg1ws.exe PID 1652 wrote to memory of 488 1652 x1g9wn.exe lmg1ws.exe PID 1652 wrote to memory of 488 1652 x1g9wn.exe lmg1ws.exe PID 488 wrote to memory of 2480 488 lmg1ws.exe f81h3.exe PID 488 wrote to memory of 2480 488 lmg1ws.exe f81h3.exe PID 488 wrote to memory of 2480 488 lmg1ws.exe f81h3.exe PID 2480 wrote to memory of 2964 2480 f81h3.exe dkcf7.exe PID 2480 wrote to memory of 2964 2480 f81h3.exe dkcf7.exe PID 2480 wrote to memory of 2964 2480 f81h3.exe dkcf7.exe PID 2964 wrote to memory of 1148 2964 dkcf7.exe cm3mu.exe PID 2964 wrote to memory of 1148 2964 dkcf7.exe cm3mu.exe PID 2964 wrote to memory of 1148 2964 dkcf7.exe cm3mu.exe PID 1148 wrote to memory of 2516 1148 cm3mu.exe b4vr91.exe PID 1148 wrote to memory of 2516 1148 cm3mu.exe b4vr91.exe PID 1148 wrote to memory of 2516 1148 cm3mu.exe b4vr91.exe PID 2516 wrote to memory of 1400 2516 b4vr91.exe 7670371.exe PID 2516 wrote to memory of 1400 2516 b4vr91.exe 7670371.exe PID 2516 wrote to memory of 1400 2516 b4vr91.exe 7670371.exe PID 1400 wrote to memory of 1544 1400 7670371.exe vn44j7n.exe PID 1400 wrote to memory of 1544 1400 7670371.exe vn44j7n.exe PID 1400 wrote to memory of 1544 1400 7670371.exe vn44j7n.exe PID 1544 wrote to memory of 1724 1544 vn44j7n.exe x6s78.exe PID 1544 wrote to memory of 1724 1544 vn44j7n.exe x6s78.exe PID 1544 wrote to memory of 1724 1544 vn44j7n.exe x6s78.exe PID 1724 wrote to memory of 1500 1724 x6s78.exe 930235.exe PID 1724 wrote to memory of 1500 1724 x6s78.exe 930235.exe PID 1724 wrote to memory of 1500 1724 x6s78.exe 930235.exe PID 1500 wrote to memory of 3632 1500 930235.exe 5uo1d.exe PID 1500 wrote to memory of 3632 1500 930235.exe 5uo1d.exe PID 1500 wrote to memory of 3632 1500 930235.exe 5uo1d.exe PID 3632 wrote to memory of 1648 3632 5uo1d.exe 6p1gn1.exe PID 3632 wrote to memory of 1648 3632 5uo1d.exe 6p1gn1.exe PID 3632 wrote to memory of 1648 3632 5uo1d.exe 6p1gn1.exe PID 1648 wrote to memory of 4304 1648 6p1gn1.exe tqux3.exe PID 1648 wrote to memory of 4304 1648 6p1gn1.exe tqux3.exe PID 1648 wrote to memory of 4304 1648 6p1gn1.exe tqux3.exe PID 4304 wrote to memory of 2324 4304 tqux3.exe q57bm6s.exe PID 4304 wrote to memory of 2324 4304 tqux3.exe q57bm6s.exe PID 4304 wrote to memory of 2324 4304 tqux3.exe q57bm6s.exe PID 2324 wrote to memory of 4344 2324 q57bm6s.exe om2gs7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d2258b03719a02e4562743503b8a070_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6d2258b03719a02e4562743503b8a070_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\95t513.exec:\95t513.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\q91d755.exec:\q91d755.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\abh0i.exec:\abh0i.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tqil1m6.exec:\tqil1m6.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ek1th3.exec:\ek1th3.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\d59ci4.exec:\d59ci4.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hc3bq.exec:\hc3bq.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\x1g9wn.exec:\x1g9wn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lmg1ws.exec:\lmg1ws.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\f81h3.exec:\f81h3.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dkcf7.exec:\dkcf7.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\cm3mu.exec:\cm3mu.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\b4vr91.exec:\b4vr91.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7670371.exec:\7670371.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vn44j7n.exec:\vn44j7n.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\x6s78.exec:\x6s78.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\930235.exec:\930235.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5uo1d.exec:\5uo1d.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\6p1gn1.exec:\6p1gn1.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tqux3.exec:\tqux3.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\q57bm6s.exec:\q57bm6s.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\om2gs7.exec:\om2gs7.exe23⤵
- Executes dropped EXE
-
\??\c:\v786x.exec:\v786x.exe24⤵
- Executes dropped EXE
-
\??\c:\1729e.exec:\1729e.exe25⤵
- Executes dropped EXE
-
\??\c:\7l19lf.exec:\7l19lf.exe26⤵
- Executes dropped EXE
-
\??\c:\5wbke.exec:\5wbke.exe27⤵
- Executes dropped EXE
-
\??\c:\ncr57i.exec:\ncr57i.exe28⤵
- Executes dropped EXE
-
\??\c:\n577x8.exec:\n577x8.exe29⤵
- Executes dropped EXE
-
\??\c:\jadva03.exec:\jadva03.exe30⤵
- Executes dropped EXE
-
\??\c:\04s720.exec:\04s720.exe31⤵
- Executes dropped EXE
-
\??\c:\ve7k1k.exec:\ve7k1k.exe32⤵
- Executes dropped EXE
-
\??\c:\89957.exec:\89957.exe33⤵
- Executes dropped EXE
-
\??\c:\eo6jg.exec:\eo6jg.exe34⤵
- Executes dropped EXE
-
\??\c:\3n34l97.exec:\3n34l97.exe35⤵
- Executes dropped EXE
-
\??\c:\i48svdh.exec:\i48svdh.exe36⤵
- Executes dropped EXE
-
\??\c:\1q937e5.exec:\1q937e5.exe37⤵
- Executes dropped EXE
-
\??\c:\mke662.exec:\mke662.exe38⤵
- Executes dropped EXE
-
\??\c:\nudq95.exec:\nudq95.exe39⤵
- Executes dropped EXE
-
\??\c:\8uu3a.exec:\8uu3a.exe40⤵
- Executes dropped EXE
-
\??\c:\53317.exec:\53317.exe41⤵
- Executes dropped EXE
-
\??\c:\5c789b9.exec:\5c789b9.exe42⤵
- Executes dropped EXE
-
\??\c:\t59w2f.exec:\t59w2f.exe43⤵
- Executes dropped EXE
-
\??\c:\a81wk0.exec:\a81wk0.exe44⤵
- Executes dropped EXE
-
\??\c:\4l73cs.exec:\4l73cs.exe45⤵
- Executes dropped EXE
-
\??\c:\g67c238.exec:\g67c238.exe46⤵
- Executes dropped EXE
-
\??\c:\k1772.exec:\k1772.exe47⤵
- Executes dropped EXE
-
\??\c:\67e6x9.exec:\67e6x9.exe48⤵
- Executes dropped EXE
-
\??\c:\g6o3c97.exec:\g6o3c97.exe49⤵
- Executes dropped EXE
-
\??\c:\jmpp2w.exec:\jmpp2w.exe50⤵
- Executes dropped EXE
-
\??\c:\8gs65jj.exec:\8gs65jj.exe51⤵
- Executes dropped EXE
-
\??\c:\tw4ee.exec:\tw4ee.exe52⤵
- Executes dropped EXE
-
\??\c:\xj3oo.exec:\xj3oo.exe53⤵
- Executes dropped EXE
-
\??\c:\1fmw0e7.exec:\1fmw0e7.exe54⤵
- Executes dropped EXE
-
\??\c:\i8q8euf.exec:\i8q8euf.exe55⤵
- Executes dropped EXE
-
\??\c:\12cfc.exec:\12cfc.exe56⤵
- Executes dropped EXE
-
\??\c:\j1m57bt.exec:\j1m57bt.exe57⤵
- Executes dropped EXE
-
\??\c:\r82u7io.exec:\r82u7io.exe58⤵
- Executes dropped EXE
-
\??\c:\8t73bw.exec:\8t73bw.exe59⤵
- Executes dropped EXE
-
\??\c:\t6x2qq.exec:\t6x2qq.exe60⤵
- Executes dropped EXE
-
\??\c:\bl2g60.exec:\bl2g60.exe61⤵
- Executes dropped EXE
-
\??\c:\j72cl3.exec:\j72cl3.exe62⤵
- Executes dropped EXE
-
\??\c:\4i3aj.exec:\4i3aj.exe63⤵
- Executes dropped EXE
-
\??\c:\7659e.exec:\7659e.exe64⤵
- Executes dropped EXE
-
\??\c:\k9p741r.exec:\k9p741r.exe65⤵
- Executes dropped EXE
-
\??\c:\7975g9q.exec:\7975g9q.exe66⤵
-
\??\c:\9nec1.exec:\9nec1.exe67⤵
-
\??\c:\jfrq1lw.exec:\jfrq1lw.exe68⤵
-
\??\c:\07j2t7w.exec:\07j2t7w.exe69⤵
-
\??\c:\6uo1wtn.exec:\6uo1wtn.exe70⤵
-
\??\c:\3f7lv62.exec:\3f7lv62.exe71⤵
-
\??\c:\kqo5d9.exec:\kqo5d9.exe72⤵
-
\??\c:\qwi5ri0.exec:\qwi5ri0.exe73⤵
-
\??\c:\bteho.exec:\bteho.exe74⤵
-
\??\c:\0ve1094.exec:\0ve1094.exe75⤵
-
\??\c:\jw708ov.exec:\jw708ov.exe76⤵
-
\??\c:\mh70sr.exec:\mh70sr.exe77⤵
-
\??\c:\j7fjv.exec:\j7fjv.exe78⤵
-
\??\c:\1f8tkr.exec:\1f8tkr.exe79⤵
-
\??\c:\r9e37w4.exec:\r9e37w4.exe80⤵
-
\??\c:\778hc2i.exec:\778hc2i.exe81⤵
-
\??\c:\6p47fx.exec:\6p47fx.exe82⤵
-
\??\c:\5948o.exec:\5948o.exe83⤵
-
\??\c:\809n43q.exec:\809n43q.exe84⤵
-
\??\c:\7916oe8.exec:\7916oe8.exe85⤵
-
\??\c:\4qf439.exec:\4qf439.exe86⤵
-
\??\c:\74icsk5.exec:\74icsk5.exe87⤵
-
\??\c:\kx291i.exec:\kx291i.exe88⤵
-
\??\c:\126ne.exec:\126ne.exe89⤵
-
\??\c:\ra959.exec:\ra959.exe90⤵
-
\??\c:\ja3je.exec:\ja3je.exe91⤵
-
\??\c:\fuo50d2.exec:\fuo50d2.exe92⤵
-
\??\c:\s0oi6m1.exec:\s0oi6m1.exe93⤵
-
\??\c:\wlrgwq.exec:\wlrgwq.exe94⤵
-
\??\c:\kffjk.exec:\kffjk.exe95⤵
-
\??\c:\g33rr.exec:\g33rr.exe96⤵
-
\??\c:\0721gak.exec:\0721gak.exe97⤵
-
\??\c:\c793c7.exec:\c793c7.exe98⤵
-
\??\c:\8v55ds.exec:\8v55ds.exe99⤵
-
\??\c:\4dae5.exec:\4dae5.exe100⤵
-
\??\c:\86t87b7.exec:\86t87b7.exe101⤵
-
\??\c:\1t537e.exec:\1t537e.exe102⤵
-
\??\c:\591c64.exec:\591c64.exe103⤵
-
\??\c:\ebq6bo.exec:\ebq6bo.exe104⤵
-
\??\c:\qg5p19n.exec:\qg5p19n.exe105⤵
-
\??\c:\cx7sn.exec:\cx7sn.exe106⤵
-
\??\c:\sm664.exec:\sm664.exe107⤵
-
\??\c:\x7caf.exec:\x7caf.exe108⤵
-
\??\c:\753i9d9.exec:\753i9d9.exe109⤵
-
\??\c:\2wrrs.exec:\2wrrs.exe110⤵
-
\??\c:\8ig7qt4.exec:\8ig7qt4.exe111⤵
-
\??\c:\anri2m.exec:\anri2m.exe112⤵
-
\??\c:\edxjcd.exec:\edxjcd.exe113⤵
-
\??\c:\w9jb9if.exec:\w9jb9if.exe114⤵
-
\??\c:\1q94i6.exec:\1q94i6.exe115⤵
-
\??\c:\5umoxp1.exec:\5umoxp1.exe116⤵
-
\??\c:\1o917d.exec:\1o917d.exe117⤵
-
\??\c:\2a6lc9u.exec:\2a6lc9u.exe118⤵
-
\??\c:\ghf259.exec:\ghf259.exe119⤵
-
\??\c:\vbbnjjf.exec:\vbbnjjf.exe120⤵
-
\??\c:\xuigj.exec:\xuigj.exe121⤵
-
\??\c:\0k233.exec:\0k233.exe122⤵
-
\??\c:\8aax8x.exec:\8aax8x.exe123⤵
-
\??\c:\e5mk279.exec:\e5mk279.exe124⤵
-
\??\c:\rcf0u.exec:\rcf0u.exe125⤵
-
\??\c:\px865.exec:\px865.exe126⤵
-
\??\c:\mhfou.exec:\mhfou.exe127⤵
-
\??\c:\8e7xo11.exec:\8e7xo11.exe128⤵
-
\??\c:\0325co0.exec:\0325co0.exe129⤵
-
\??\c:\m0w64.exec:\m0w64.exe130⤵
-
\??\c:\8w0q6h5.exec:\8w0q6h5.exe131⤵
-
\??\c:\0bh64f.exec:\0bh64f.exe132⤵
-
\??\c:\2xlr9.exec:\2xlr9.exe133⤵
-
\??\c:\h5aq4.exec:\h5aq4.exe134⤵
-
\??\c:\55326.exec:\55326.exe135⤵
-
\??\c:\d2nvt8w.exec:\d2nvt8w.exe136⤵
-
\??\c:\9rpgti6.exec:\9rpgti6.exe137⤵
-
\??\c:\sm1we.exec:\sm1we.exe138⤵
-
\??\c:\632p91.exec:\632p91.exe139⤵
-
\??\c:\r987n1n.exec:\r987n1n.exe140⤵
-
\??\c:\04pi58.exec:\04pi58.exe141⤵
-
\??\c:\os7p3l3.exec:\os7p3l3.exe142⤵
-
\??\c:\3349q9.exec:\3349q9.exe143⤵
-
\??\c:\0l7cci.exec:\0l7cci.exe144⤵
-
\??\c:\nnfnn.exec:\nnfnn.exe145⤵
-
\??\c:\25dg4gp.exec:\25dg4gp.exe146⤵
-
\??\c:\1w4v7e.exec:\1w4v7e.exe147⤵
-
\??\c:\i0679u.exec:\i0679u.exe148⤵
-
\??\c:\506rs.exec:\506rs.exe149⤵
-
\??\c:\3g0813k.exec:\3g0813k.exe150⤵
-
\??\c:\2p85307.exec:\2p85307.exe151⤵
-
\??\c:\3a9vx.exec:\3a9vx.exe152⤵
-
\??\c:\1e2u9c.exec:\1e2u9c.exe153⤵
-
\??\c:\unjg465.exec:\unjg465.exe154⤵
-
\??\c:\im628.exec:\im628.exe155⤵
-
\??\c:\0cb736.exec:\0cb736.exe156⤵
-
\??\c:\7svh7.exec:\7svh7.exe157⤵
-
\??\c:\01llh.exec:\01llh.exe158⤵
-
\??\c:\e171wh.exec:\e171wh.exe159⤵
-
\??\c:\n256u.exec:\n256u.exe160⤵
-
\??\c:\4p537.exec:\4p537.exe161⤵
-
\??\c:\q97s1.exec:\q97s1.exe162⤵
-
\??\c:\949u0.exec:\949u0.exe163⤵
-
\??\c:\a3wbhi3.exec:\a3wbhi3.exe164⤵
-
\??\c:\wa6383.exec:\wa6383.exe165⤵
-
\??\c:\h034w6.exec:\h034w6.exe166⤵
-
\??\c:\rkwq983.exec:\rkwq983.exe167⤵
-
\??\c:\0kou4g.exec:\0kou4g.exe168⤵
-
\??\c:\512e71.exec:\512e71.exe169⤵
-
\??\c:\6or15a.exec:\6or15a.exe170⤵
-
\??\c:\x6hw3cu.exec:\x6hw3cu.exe171⤵
-
\??\c:\b2xs7i.exec:\b2xs7i.exe172⤵
-
\??\c:\ric5g.exec:\ric5g.exe173⤵
-
\??\c:\g99lf9.exec:\g99lf9.exe174⤵
-
\??\c:\47g1av.exec:\47g1av.exe175⤵
-
\??\c:\bu7f3.exec:\bu7f3.exe176⤵
-
\??\c:\tcd6g6.exec:\tcd6g6.exe177⤵
-
\??\c:\497e3u9.exec:\497e3u9.exe178⤵
-
\??\c:\0p931.exec:\0p931.exe179⤵
-
\??\c:\1473odj.exec:\1473odj.exe180⤵
-
\??\c:\65g7qq1.exec:\65g7qq1.exe181⤵
-
\??\c:\0k39rsp.exec:\0k39rsp.exe182⤵
-
\??\c:\6xu6p.exec:\6xu6p.exe183⤵
-
\??\c:\q65n5.exec:\q65n5.exe184⤵
-
\??\c:\rccm3.exec:\rccm3.exe185⤵
-
\??\c:\69q1uf.exec:\69q1uf.exe186⤵
-
\??\c:\da211i7.exec:\da211i7.exe187⤵
-
\??\c:\91mq87.exec:\91mq87.exe188⤵
-
\??\c:\30b0s.exec:\30b0s.exe189⤵
-
\??\c:\rqeqmu4.exec:\rqeqmu4.exe190⤵
-
\??\c:\74uxv17.exec:\74uxv17.exe191⤵
-
\??\c:\06ixm.exec:\06ixm.exe192⤵
-
\??\c:\q9ge1u3.exec:\q9ge1u3.exe193⤵
-
\??\c:\q9fi1l.exec:\q9fi1l.exe194⤵
-
\??\c:\5k49j.exec:\5k49j.exe195⤵
-
\??\c:\g55ja.exec:\g55ja.exe196⤵
-
\??\c:\08r531.exec:\08r531.exe197⤵
-
\??\c:\29o31.exec:\29o31.exe198⤵
-
\??\c:\f202v9c.exec:\f202v9c.exe199⤵
-
\??\c:\2nwql.exec:\2nwql.exe200⤵
-
\??\c:\87h2whb.exec:\87h2whb.exe201⤵
-
\??\c:\qw8u5.exec:\qw8u5.exe202⤵
-
\??\c:\72t9n.exec:\72t9n.exe203⤵
-
\??\c:\49cl4.exec:\49cl4.exe204⤵
-
\??\c:\6jd71d.exec:\6jd71d.exe205⤵
-
\??\c:\p3w5l9v.exec:\p3w5l9v.exe206⤵
-
\??\c:\gv96q58.exec:\gv96q58.exe207⤵
-
\??\c:\j35r3.exec:\j35r3.exe208⤵
-
\??\c:\ffrnfnf.exec:\ffrnfnf.exe209⤵
-
\??\c:\hq5r07d.exec:\hq5r07d.exe210⤵
-
\??\c:\b0873.exec:\b0873.exe211⤵
-
\??\c:\k9u8l34.exec:\k9u8l34.exe212⤵
-
\??\c:\qw43los.exec:\qw43los.exe213⤵
-
\??\c:\4r7sq.exec:\4r7sq.exe214⤵
-
\??\c:\309157k.exec:\309157k.exe215⤵
-
\??\c:\83m3t.exec:\83m3t.exe216⤵
-
\??\c:\87d15.exec:\87d15.exe217⤵
-
\??\c:\eo50c3.exec:\eo50c3.exe218⤵
-
\??\c:\e2q53.exec:\e2q53.exe219⤵
-
\??\c:\5ba35j9.exec:\5ba35j9.exe220⤵
-
\??\c:\fv3686p.exec:\fv3686p.exe221⤵
-
\??\c:\c9pnt45.exec:\c9pnt45.exe222⤵
-
\??\c:\ue970.exec:\ue970.exe223⤵
-
\??\c:\jv789.exec:\jv789.exe224⤵
-
\??\c:\vv858.exec:\vv858.exe225⤵
-
\??\c:\9vam890.exec:\9vam890.exe226⤵
-
\??\c:\js80tt.exec:\js80tt.exe227⤵
-
\??\c:\983u3jj.exec:\983u3jj.exe228⤵
-
\??\c:\498s2w.exec:\498s2w.exe229⤵
-
\??\c:\3w71p5.exec:\3w71p5.exe230⤵
-
\??\c:\9707q7.exec:\9707q7.exe231⤵
-
\??\c:\503p973.exec:\503p973.exe232⤵
-
\??\c:\1r968.exec:\1r968.exe233⤵
-
\??\c:\o3g2g.exec:\o3g2g.exe234⤵
-
\??\c:\5406n.exec:\5406n.exe235⤵
-
\??\c:\d3qti10.exec:\d3qti10.exe236⤵
-
\??\c:\j32iuuf.exec:\j32iuuf.exe237⤵
-
\??\c:\268tt91.exec:\268tt91.exe238⤵
-
\??\c:\5h6im2m.exec:\5h6im2m.exe239⤵
-
\??\c:\enx0s5r.exec:\enx0s5r.exe240⤵
-
\??\c:\rfjvbv.exec:\rfjvbv.exe241⤵