Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 07:50
Behavioral task
behavioral1
Sample
8a0ef55e78bd004717cb93c0dc2d5fb0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
8a0ef55e78bd004717cb93c0dc2d5fb0_NeikiAnalytics.exe
-
Size
89KB
-
MD5
8a0ef55e78bd004717cb93c0dc2d5fb0
-
SHA1
926735d3e9c51b8f5e0bc1f1fbd73e5f42defd32
-
SHA256
c496982ff541c076154dc230d7a34c026fd77cea00c964f73ad4e5a55b174d31
-
SHA512
62ab225d72542b8cf35b60009f206f8f54d48c6886259fda83360c995522bb5cc2f9ec87700d26307f6a7b3c128fa6124fa7c50a4a8d8971647b048a050a5730
-
SSDEEP
1536:cvQBeOGtrYS3srx93UBWfwC6Ggnouy8mVeygryFU2li0gx4EBbhnyLFW+O:chOmTsF93UYfwC6GIoutieyhC2lbgGiB
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1704-6-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4808-14-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/836-12-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4560-23-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4408-29-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1132-36-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3892-41-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2320-44-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3828-50-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1648-58-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2856-66-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4140-70-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2504-77-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/812-84-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3316-90-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2804-93-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1444-99-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3536-108-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4128-119-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2440-126-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4512-131-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3296-136-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2636-142-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3712-148-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4612-153-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3484-161-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3924-166-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4496-171-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4504-178-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/360-184-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3432-197-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/836-204-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/904-208-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2724-212-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1344-216-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2328-237-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2184-240-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3036-242-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4460-248-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1536-261-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4184-290-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1196-300-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3384-319-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3484-326-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3412-336-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4284-338-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3980-353-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2528-355-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/888-379-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3500-415-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1996-442-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3308-450-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4632-466-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1720-474-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2432-480-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1940-494-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3948-501-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2916-514-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4576-530-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/224-581-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3732-603-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/360-620-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/384-638-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2056-751-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
1585l.exew2ixlr.exe35r92c5.exetam3e.exe0f9nx57.exe4a570.exe537dw5.exetr5952q.exe7d53f91.exeluo85c4.exe09592kh.exe5o02tw.exeej6i0f.exeg875b0r.exel2uw95.exe600cl.exe51704.exe6vd58r.exes7kwcog.execdh4xo9.exe5i0tp8n.exe58368.exe3923s9.exeopx71.exep3aqrmw.exe8bo25f2.exexp9j59.exed0sn2.exe5o6926.exe4477m.exem0p256.exe06e58t.exeoc291r1.exepe2adb6.exe4ar57.exe9lu6gg.exef74ek.exeaw3a10.exewi7mp12.exedjqicd.exee116tp.exen1jh5.exet85pf.exev228uug.exe2ik224v.exer12ld6.exewp58l0.exe37x8n.exefpq77ge.exe0r0qi.exeb1o06i.exekuxnr.exe5s58xo.exeq7mn6.exek937h.exe619597.exe4jc5kkv.exe0hls5o1.exe40eg5.exe3a19556.exes52ph.exe46v05.exe601nlw.exen02i61.exepid process 836 1585l.exe 4808 w2ixlr.exe 4560 35r92c5.exe 4408 tam3e.exe 1132 0f9nx57.exe 3892 4a570.exe 2320 537dw5.exe 3828 tr5952q.exe 1648 7d53f91.exe 2856 luo85c4.exe 4140 09592kh.exe 2504 5o02tw.exe 812 ej6i0f.exe 3316 g875b0r.exe 2804 l2uw95.exe 1444 600cl.exe 3536 51704.exe 5096 6vd58r.exe 4128 s7kwcog.exe 2440 cdh4xo9.exe 4512 5i0tp8n.exe 3296 58368.exe 2636 3923s9.exe 3712 opx71.exe 4612 p3aqrmw.exe 3484 8bo25f2.exe 3924 xp9j59.exe 4496 d0sn2.exe 4504 5o6926.exe 360 4477m.exe 1248 m0p256.exe 3948 06e58t.exe 3432 oc291r1.exe 2332 pe2adb6.exe 836 4ar57.exe 904 9lu6gg.exe 2724 f74ek.exe 1344 aw3a10.exe 3600 wi7mp12.exe 1016 djqicd.exe 1480 e116tp.exe 4576 n1jh5.exe 1192 t85pf.exe 3224 v228uug.exe 2328 2ik224v.exe 2184 r12ld6.exe 3036 wp58l0.exe 4460 37x8n.exe 116 fpq77ge.exe 1464 0r0qi.exe 4536 b1o06i.exe 1536 kuxnr.exe 4952 5s58xo.exe 4872 q7mn6.exe 1100 k937h.exe 3864 619597.exe 4376 4jc5kkv.exe 3536 0hls5o1.exe 2120 40eg5.exe 1512 3a19556.exe 4184 s52ph.exe 4884 46v05.exe 2988 601nlw.exe 4992 n02i61.exe -
Processes:
resource yara_rule behavioral2/memory/1704-0-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\1585l.exe upx behavioral2/memory/1704-6-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\w2ixlr.exe upx behavioral2/memory/4808-14-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/836-12-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\35r92c5.exe upx C:\tam3e.exe upx behavioral2/memory/4560-23-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\0f9nx57.exe upx behavioral2/memory/4408-29-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\4a570.exe upx behavioral2/memory/1132-36-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\537dw5.exe upx behavioral2/memory/3892-41-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2320-44-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\tr5952q.exe upx behavioral2/memory/3828-50-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\7d53f91.exe upx C:\luo85c4.exe upx behavioral2/memory/1648-58-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\09592kh.exe upx behavioral2/memory/2856-66-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4140-70-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\5o02tw.exe upx C:\ej6i0f.exe upx behavioral2/memory/2504-77-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/812-79-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\g875b0r.exe upx behavioral2/memory/812-84-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\l2uw95.exe upx behavioral2/memory/3316-90-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2804-93-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\600cl.exe upx behavioral2/memory/1444-99-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\51704.exe upx C:\6vd58r.exe upx behavioral2/memory/3536-108-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\s7kwcog.exe upx C:\cdh4xo9.exe upx behavioral2/memory/4128-119-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\5i0tp8n.exe upx behavioral2/memory/2440-126-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\58368.exe upx behavioral2/memory/4512-131-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\3923s9.exe upx behavioral2/memory/3296-136-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\opx71.exe upx behavioral2/memory/2636-142-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\p3aqrmw.exe upx behavioral2/memory/3712-148-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\8bo25f2.exe upx behavioral2/memory/4612-153-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\xp9j59.exe upx behavioral2/memory/3484-161-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\d0sn2.exe upx behavioral2/memory/3924-166-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4496-171-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\5o6926.exe upx C:\4477m.exe upx behavioral2/memory/4504-178-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\m0p256.exe upx behavioral2/memory/360-184-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\06e58t.exe upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8a0ef55e78bd004717cb93c0dc2d5fb0_NeikiAnalytics.exe1585l.exew2ixlr.exe35r92c5.exetam3e.exe0f9nx57.exe4a570.exe537dw5.exetr5952q.exe7d53f91.exeluo85c4.exe09592kh.exe5o02tw.exeej6i0f.exeg875b0r.exel2uw95.exe600cl.exe51704.exe6vd58r.exes7kwcog.execdh4xo9.exe5i0tp8n.exedescription pid process target process PID 1704 wrote to memory of 836 1704 8a0ef55e78bd004717cb93c0dc2d5fb0_NeikiAnalytics.exe 1585l.exe PID 1704 wrote to memory of 836 1704 8a0ef55e78bd004717cb93c0dc2d5fb0_NeikiAnalytics.exe 1585l.exe PID 1704 wrote to memory of 836 1704 8a0ef55e78bd004717cb93c0dc2d5fb0_NeikiAnalytics.exe 1585l.exe PID 836 wrote to memory of 4808 836 1585l.exe w2ixlr.exe PID 836 wrote to memory of 4808 836 1585l.exe w2ixlr.exe PID 836 wrote to memory of 4808 836 1585l.exe w2ixlr.exe PID 4808 wrote to memory of 4560 4808 w2ixlr.exe 35r92c5.exe PID 4808 wrote to memory of 4560 4808 w2ixlr.exe 35r92c5.exe PID 4808 wrote to memory of 4560 4808 w2ixlr.exe 35r92c5.exe PID 4560 wrote to memory of 4408 4560 35r92c5.exe tam3e.exe PID 4560 wrote to memory of 4408 4560 35r92c5.exe tam3e.exe PID 4560 wrote to memory of 4408 4560 35r92c5.exe tam3e.exe PID 4408 wrote to memory of 1132 4408 tam3e.exe 0f9nx57.exe PID 4408 wrote to memory of 1132 4408 tam3e.exe 0f9nx57.exe PID 4408 wrote to memory of 1132 4408 tam3e.exe 0f9nx57.exe PID 1132 wrote to memory of 3892 1132 0f9nx57.exe 4a570.exe PID 1132 wrote to memory of 3892 1132 0f9nx57.exe 4a570.exe PID 1132 wrote to memory of 3892 1132 0f9nx57.exe 4a570.exe PID 3892 wrote to memory of 2320 3892 4a570.exe 537dw5.exe PID 3892 wrote to memory of 2320 3892 4a570.exe 537dw5.exe PID 3892 wrote to memory of 2320 3892 4a570.exe 537dw5.exe PID 2320 wrote to memory of 3828 2320 537dw5.exe tr5952q.exe PID 2320 wrote to memory of 3828 2320 537dw5.exe tr5952q.exe PID 2320 wrote to memory of 3828 2320 537dw5.exe tr5952q.exe PID 3828 wrote to memory of 1648 3828 tr5952q.exe 7d53f91.exe PID 3828 wrote to memory of 1648 3828 tr5952q.exe 7d53f91.exe PID 3828 wrote to memory of 1648 3828 tr5952q.exe 7d53f91.exe PID 1648 wrote to memory of 2856 1648 7d53f91.exe luo85c4.exe PID 1648 wrote to memory of 2856 1648 7d53f91.exe luo85c4.exe PID 1648 wrote to memory of 2856 1648 7d53f91.exe luo85c4.exe PID 2856 wrote to memory of 4140 2856 luo85c4.exe 09592kh.exe PID 2856 wrote to memory of 4140 2856 luo85c4.exe 09592kh.exe PID 2856 wrote to memory of 4140 2856 luo85c4.exe 09592kh.exe PID 4140 wrote to memory of 2504 4140 09592kh.exe 5o02tw.exe PID 4140 wrote to memory of 2504 4140 09592kh.exe 5o02tw.exe PID 4140 wrote to memory of 2504 4140 09592kh.exe 5o02tw.exe PID 2504 wrote to memory of 812 2504 5o02tw.exe ej6i0f.exe PID 2504 wrote to memory of 812 2504 5o02tw.exe ej6i0f.exe PID 2504 wrote to memory of 812 2504 5o02tw.exe ej6i0f.exe PID 812 wrote to memory of 3316 812 ej6i0f.exe g875b0r.exe PID 812 wrote to memory of 3316 812 ej6i0f.exe g875b0r.exe PID 812 wrote to memory of 3316 812 ej6i0f.exe g875b0r.exe PID 3316 wrote to memory of 2804 3316 g875b0r.exe l2uw95.exe PID 3316 wrote to memory of 2804 3316 g875b0r.exe l2uw95.exe PID 3316 wrote to memory of 2804 3316 g875b0r.exe l2uw95.exe PID 2804 wrote to memory of 1444 2804 l2uw95.exe 600cl.exe PID 2804 wrote to memory of 1444 2804 l2uw95.exe 600cl.exe PID 2804 wrote to memory of 1444 2804 l2uw95.exe 600cl.exe PID 1444 wrote to memory of 3536 1444 600cl.exe 51704.exe PID 1444 wrote to memory of 3536 1444 600cl.exe 51704.exe PID 1444 wrote to memory of 3536 1444 600cl.exe 51704.exe PID 3536 wrote to memory of 5096 3536 51704.exe 6vd58r.exe PID 3536 wrote to memory of 5096 3536 51704.exe 6vd58r.exe PID 3536 wrote to memory of 5096 3536 51704.exe 6vd58r.exe PID 5096 wrote to memory of 4128 5096 6vd58r.exe s7kwcog.exe PID 5096 wrote to memory of 4128 5096 6vd58r.exe s7kwcog.exe PID 5096 wrote to memory of 4128 5096 6vd58r.exe s7kwcog.exe PID 4128 wrote to memory of 2440 4128 s7kwcog.exe cdh4xo9.exe PID 4128 wrote to memory of 2440 4128 s7kwcog.exe cdh4xo9.exe PID 4128 wrote to memory of 2440 4128 s7kwcog.exe cdh4xo9.exe PID 2440 wrote to memory of 4512 2440 cdh4xo9.exe 5i0tp8n.exe PID 2440 wrote to memory of 4512 2440 cdh4xo9.exe 5i0tp8n.exe PID 2440 wrote to memory of 4512 2440 cdh4xo9.exe 5i0tp8n.exe PID 4512 wrote to memory of 3296 4512 5i0tp8n.exe 58368.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a0ef55e78bd004717cb93c0dc2d5fb0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8a0ef55e78bd004717cb93c0dc2d5fb0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\1585l.exec:\1585l.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\w2ixlr.exec:\w2ixlr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\35r92c5.exec:\35r92c5.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tam3e.exec:\tam3e.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\0f9nx57.exec:\0f9nx57.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\4a570.exec:\4a570.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\537dw5.exec:\537dw5.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tr5952q.exec:\tr5952q.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7d53f91.exec:\7d53f91.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\luo85c4.exec:\luo85c4.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\09592kh.exec:\09592kh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5o02tw.exec:\5o02tw.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ej6i0f.exec:\ej6i0f.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\g875b0r.exec:\g875b0r.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\l2uw95.exec:\l2uw95.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\600cl.exec:\600cl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\51704.exec:\51704.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\6vd58r.exec:\6vd58r.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\s7kwcog.exec:\s7kwcog.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\cdh4xo9.exec:\cdh4xo9.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5i0tp8n.exec:\5i0tp8n.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\58368.exec:\58368.exe23⤵
- Executes dropped EXE
-
\??\c:\3923s9.exec:\3923s9.exe24⤵
- Executes dropped EXE
-
\??\c:\opx71.exec:\opx71.exe25⤵
- Executes dropped EXE
-
\??\c:\p3aqrmw.exec:\p3aqrmw.exe26⤵
- Executes dropped EXE
-
\??\c:\8bo25f2.exec:\8bo25f2.exe27⤵
- Executes dropped EXE
-
\??\c:\xp9j59.exec:\xp9j59.exe28⤵
- Executes dropped EXE
-
\??\c:\d0sn2.exec:\d0sn2.exe29⤵
- Executes dropped EXE
-
\??\c:\5o6926.exec:\5o6926.exe30⤵
- Executes dropped EXE
-
\??\c:\4477m.exec:\4477m.exe31⤵
- Executes dropped EXE
-
\??\c:\m0p256.exec:\m0p256.exe32⤵
- Executes dropped EXE
-
\??\c:\06e58t.exec:\06e58t.exe33⤵
- Executes dropped EXE
-
\??\c:\oc291r1.exec:\oc291r1.exe34⤵
- Executes dropped EXE
-
\??\c:\pe2adb6.exec:\pe2adb6.exe35⤵
- Executes dropped EXE
-
\??\c:\4ar57.exec:\4ar57.exe36⤵
- Executes dropped EXE
-
\??\c:\9lu6gg.exec:\9lu6gg.exe37⤵
- Executes dropped EXE
-
\??\c:\f74ek.exec:\f74ek.exe38⤵
- Executes dropped EXE
-
\??\c:\aw3a10.exec:\aw3a10.exe39⤵
- Executes dropped EXE
-
\??\c:\wi7mp12.exec:\wi7mp12.exe40⤵
- Executes dropped EXE
-
\??\c:\djqicd.exec:\djqicd.exe41⤵
- Executes dropped EXE
-
\??\c:\e116tp.exec:\e116tp.exe42⤵
- Executes dropped EXE
-
\??\c:\n1jh5.exec:\n1jh5.exe43⤵
- Executes dropped EXE
-
\??\c:\t85pf.exec:\t85pf.exe44⤵
- Executes dropped EXE
-
\??\c:\v228uug.exec:\v228uug.exe45⤵
- Executes dropped EXE
-
\??\c:\2ik224v.exec:\2ik224v.exe46⤵
- Executes dropped EXE
-
\??\c:\r12ld6.exec:\r12ld6.exe47⤵
- Executes dropped EXE
-
\??\c:\wp58l0.exec:\wp58l0.exe48⤵
- Executes dropped EXE
-
\??\c:\37x8n.exec:\37x8n.exe49⤵
- Executes dropped EXE
-
\??\c:\fpq77ge.exec:\fpq77ge.exe50⤵
- Executes dropped EXE
-
\??\c:\0r0qi.exec:\0r0qi.exe51⤵
- Executes dropped EXE
-
\??\c:\b1o06i.exec:\b1o06i.exe52⤵
- Executes dropped EXE
-
\??\c:\kuxnr.exec:\kuxnr.exe53⤵
- Executes dropped EXE
-
\??\c:\5s58xo.exec:\5s58xo.exe54⤵
- Executes dropped EXE
-
\??\c:\q7mn6.exec:\q7mn6.exe55⤵
- Executes dropped EXE
-
\??\c:\k937h.exec:\k937h.exe56⤵
- Executes dropped EXE
-
\??\c:\619597.exec:\619597.exe57⤵
- Executes dropped EXE
-
\??\c:\4jc5kkv.exec:\4jc5kkv.exe58⤵
- Executes dropped EXE
-
\??\c:\0hls5o1.exec:\0hls5o1.exe59⤵
- Executes dropped EXE
-
\??\c:\40eg5.exec:\40eg5.exe60⤵
- Executes dropped EXE
-
\??\c:\3a19556.exec:\3a19556.exe61⤵
- Executes dropped EXE
-
\??\c:\s52ph.exec:\s52ph.exe62⤵
- Executes dropped EXE
-
\??\c:\46v05.exec:\46v05.exe63⤵
- Executes dropped EXE
-
\??\c:\601nlw.exec:\601nlw.exe64⤵
- Executes dropped EXE
-
\??\c:\n02i61.exec:\n02i61.exe65⤵
- Executes dropped EXE
-
\??\c:\g6sae1o.exec:\g6sae1o.exe66⤵
-
\??\c:\a7bovv4.exec:\a7bovv4.exe67⤵
-
\??\c:\ia491.exec:\ia491.exe68⤵
-
\??\c:\9cmq9.exec:\9cmq9.exe69⤵
-
\??\c:\kr02q9.exec:\kr02q9.exe70⤵
-
\??\c:\25v44.exec:\25v44.exe71⤵
-
\??\c:\9513i.exec:\9513i.exe72⤵
-
\??\c:\876nk1.exec:\876nk1.exe73⤵
-
\??\c:\wm4kx.exec:\wm4kx.exe74⤵
-
\??\c:\644xm2.exec:\644xm2.exe75⤵
-
\??\c:\4lh3o.exec:\4lh3o.exe76⤵
-
\??\c:\5mr608.exec:\5mr608.exe77⤵
-
\??\c:\7rsmq.exec:\7rsmq.exe78⤵
-
\??\c:\3u52v.exec:\3u52v.exe79⤵
-
\??\c:\85ad5.exec:\85ad5.exe80⤵
-
\??\c:\19wx54.exec:\19wx54.exe81⤵
-
\??\c:\43155.exec:\43155.exe82⤵
-
\??\c:\7591e.exec:\7591e.exe83⤵
-
\??\c:\a97a65.exec:\a97a65.exe84⤵
-
\??\c:\97q946.exec:\97q946.exe85⤵
-
\??\c:\2we606.exec:\2we606.exe86⤵
-
\??\c:\3urjjb7.exec:\3urjjb7.exe87⤵
-
\??\c:\q795e.exec:\q795e.exe88⤵
-
\??\c:\xm9gg.exec:\xm9gg.exe89⤵
-
\??\c:\r59r5os.exec:\r59r5os.exe90⤵
-
\??\c:\53p0f.exec:\53p0f.exe91⤵
-
\??\c:\nru41.exec:\nru41.exe92⤵
-
\??\c:\7a1eica.exec:\7a1eica.exe93⤵
-
\??\c:\028882.exec:\028882.exe94⤵
-
\??\c:\2206408.exec:\2206408.exe95⤵
-
\??\c:\a38r4.exec:\a38r4.exe96⤵
-
\??\c:\09j5tkk.exec:\09j5tkk.exe97⤵
-
\??\c:\9e8w1r.exec:\9e8w1r.exe98⤵
-
\??\c:\q9oeh81.exec:\q9oeh81.exe99⤵
-
\??\c:\6v27o.exec:\6v27o.exe100⤵
-
\??\c:\95f3m.exec:\95f3m.exe101⤵
-
\??\c:\0l9xc9.exec:\0l9xc9.exe102⤵
-
\??\c:\c8womkm.exec:\c8womkm.exe103⤵
-
\??\c:\97ujk.exec:\97ujk.exe104⤵
-
\??\c:\6fi797.exec:\6fi797.exe105⤵
-
\??\c:\59ou80.exec:\59ou80.exe106⤵
-
\??\c:\0t8ol5.exec:\0t8ol5.exe107⤵
-
\??\c:\q7mq3.exec:\q7mq3.exe108⤵
-
\??\c:\3h7c1w.exec:\3h7c1w.exe109⤵
-
\??\c:\4661ww2.exec:\4661ww2.exe110⤵
-
\??\c:\cgp2wn.exec:\cgp2wn.exe111⤵
-
\??\c:\9tt32.exec:\9tt32.exe112⤵
-
\??\c:\mgm68h.exec:\mgm68h.exe113⤵
-
\??\c:\138e6r5.exec:\138e6r5.exe114⤵
-
\??\c:\8o7awk.exec:\8o7awk.exe115⤵
-
\??\c:\x336xl8.exec:\x336xl8.exe116⤵
-
\??\c:\il0l89.exec:\il0l89.exe117⤵
-
\??\c:\rdq5f.exec:\rdq5f.exe118⤵
-
\??\c:\h5vn8u.exec:\h5vn8u.exe119⤵
-
\??\c:\e8s53.exec:\e8s53.exe120⤵
-
\??\c:\06640.exec:\06640.exe121⤵
-
\??\c:\1m6b1.exec:\1m6b1.exe122⤵
-
\??\c:\65avs8.exec:\65avs8.exe123⤵
-
\??\c:\477q2.exec:\477q2.exe124⤵
-
\??\c:\x2u80.exec:\x2u80.exe125⤵
-
\??\c:\06368nl.exec:\06368nl.exe126⤵
-
\??\c:\r190dd.exec:\r190dd.exe127⤵
-
\??\c:\6mge54.exec:\6mge54.exe128⤵
-
\??\c:\h72911.exec:\h72911.exe129⤵
-
\??\c:\2796119.exec:\2796119.exe130⤵
-
\??\c:\e5n5pj1.exec:\e5n5pj1.exe131⤵
-
\??\c:\a5dmke.exec:\a5dmke.exe132⤵
-
\??\c:\7v7k5.exec:\7v7k5.exe133⤵
-
\??\c:\8lma330.exec:\8lma330.exe134⤵
-
\??\c:\u56898g.exec:\u56898g.exe135⤵
-
\??\c:\5j37b.exec:\5j37b.exe136⤵
-
\??\c:\32fp5.exec:\32fp5.exe137⤵
-
\??\c:\pb8b6g.exec:\pb8b6g.exe138⤵
-
\??\c:\j846ui.exec:\j846ui.exe139⤵
-
\??\c:\80476.exec:\80476.exe140⤵
-
\??\c:\1024da.exec:\1024da.exe141⤵
-
\??\c:\l55oii.exec:\l55oii.exe142⤵
-
\??\c:\lmfd97.exec:\lmfd97.exe143⤵
-
\??\c:\060646.exec:\060646.exe144⤵
-
\??\c:\p91idqr.exec:\p91idqr.exe145⤵
-
\??\c:\x2n71.exec:\x2n71.exe146⤵
-
\??\c:\gw9d1i.exec:\gw9d1i.exe147⤵
-
\??\c:\w527aq.exec:\w527aq.exe148⤵
-
\??\c:\8956l9h.exec:\8956l9h.exe149⤵
-
\??\c:\482264.exec:\482264.exe150⤵
-
\??\c:\h22vm7.exec:\h22vm7.exe151⤵
-
\??\c:\p03205.exec:\p03205.exe152⤵
-
\??\c:\p30g31.exec:\p30g31.exe153⤵
-
\??\c:\l8b56v.exec:\l8b56v.exe154⤵
-
\??\c:\316g28.exec:\316g28.exe155⤵
-
\??\c:\63u9itq.exec:\63u9itq.exe156⤵
-
\??\c:\19avq.exec:\19avq.exe157⤵
-
\??\c:\ku43s.exec:\ku43s.exe158⤵
-
\??\c:\654qt63.exec:\654qt63.exe159⤵
-
\??\c:\3w2160.exec:\3w2160.exe160⤵
-
\??\c:\2rc0g.exec:\2rc0g.exe161⤵
-
\??\c:\b1l773.exec:\b1l773.exe162⤵
-
\??\c:\ok6b8c.exec:\ok6b8c.exe163⤵
-
\??\c:\3mixx8t.exec:\3mixx8t.exe164⤵
-
\??\c:\sv727t2.exec:\sv727t2.exe165⤵
-
\??\c:\g4ou7.exec:\g4ou7.exe166⤵
-
\??\c:\s1f52.exec:\s1f52.exe167⤵
-
\??\c:\vsrmq53.exec:\vsrmq53.exe168⤵
-
\??\c:\tt5eia.exec:\tt5eia.exe169⤵
-
\??\c:\253c21.exec:\253c21.exe170⤵
-
\??\c:\9u131.exec:\9u131.exe171⤵
-
\??\c:\t6ak5a.exec:\t6ak5a.exe172⤵
-
\??\c:\s77aee.exec:\s77aee.exe173⤵
-
\??\c:\556q1.exec:\556q1.exe174⤵
-
\??\c:\2r2ox8.exec:\2r2ox8.exe175⤵
-
\??\c:\79ss93.exec:\79ss93.exe176⤵
-
\??\c:\f3ns51.exec:\f3ns51.exe177⤵
-
\??\c:\ajcnjjn.exec:\ajcnjjn.exe178⤵
-
\??\c:\92av97.exec:\92av97.exe179⤵
-
\??\c:\ump755.exec:\ump755.exe180⤵
-
\??\c:\a23751r.exec:\a23751r.exe181⤵
-
\??\c:\4577o.exec:\4577o.exe182⤵
-
\??\c:\544m7.exec:\544m7.exe183⤵
-
\??\c:\0woa4aq.exec:\0woa4aq.exe184⤵
-
\??\c:\iccg4s.exec:\iccg4s.exe185⤵
-
\??\c:\209m9l.exec:\209m9l.exe186⤵
-
\??\c:\i41v138.exec:\i41v138.exe187⤵
-
\??\c:\7aw884i.exec:\7aw884i.exe188⤵
-
\??\c:\x7s3802.exec:\x7s3802.exe189⤵
-
\??\c:\562gw.exec:\562gw.exe190⤵
-
\??\c:\7bg6u.exec:\7bg6u.exe191⤵
-
\??\c:\0tpt26.exec:\0tpt26.exe192⤵
-
\??\c:\cwl6p57.exec:\cwl6p57.exe193⤵
-
\??\c:\66ent.exec:\66ent.exe194⤵
-
\??\c:\fo861.exec:\fo861.exe195⤵
-
\??\c:\18ntixi.exec:\18ntixi.exe196⤵
-
\??\c:\5p1291w.exec:\5p1291w.exe197⤵
-
\??\c:\53amk5.exec:\53amk5.exe198⤵
-
\??\c:\2s8w1.exec:\2s8w1.exe199⤵
-
\??\c:\3n1w7i.exec:\3n1w7i.exe200⤵
-
\??\c:\3buld5t.exec:\3buld5t.exe201⤵
-
\??\c:\7s1iul.exec:\7s1iul.exe202⤵
-
\??\c:\bepbrhx.exec:\bepbrhx.exe203⤵
-
\??\c:\0owpf.exec:\0owpf.exe204⤵
-
\??\c:\l242ru.exec:\l242ru.exe205⤵
-
\??\c:\5w4nw0.exec:\5w4nw0.exe206⤵
-
\??\c:\6qw3fwb.exec:\6qw3fwb.exe207⤵
-
\??\c:\e6tktt5.exec:\e6tktt5.exe208⤵
-
\??\c:\33o4gs.exec:\33o4gs.exe209⤵
-
\??\c:\2hiup7.exec:\2hiup7.exe210⤵
-
\??\c:\xrris.exec:\xrris.exe211⤵
-
\??\c:\52h5ig.exec:\52h5ig.exe212⤵
-
\??\c:\t3nu05m.exec:\t3nu05m.exe213⤵
-
\??\c:\9sk6w.exec:\9sk6w.exe214⤵
-
\??\c:\81xv5.exec:\81xv5.exe215⤵
-
\??\c:\3636s.exec:\3636s.exe216⤵
-
\??\c:\k75kt.exec:\k75kt.exe217⤵
-
\??\c:\jm1oxgq.exec:\jm1oxgq.exe218⤵
-
\??\c:\4t3tec5.exec:\4t3tec5.exe219⤵
-
\??\c:\vecpwc.exec:\vecpwc.exe220⤵
-
\??\c:\xa99p.exec:\xa99p.exe221⤵
-
\??\c:\25cx985.exec:\25cx985.exe222⤵
-
\??\c:\4084024.exec:\4084024.exe223⤵
-
\??\c:\d2am26.exec:\d2am26.exe224⤵
-
\??\c:\lj9o81.exec:\lj9o81.exe225⤵
-
\??\c:\8da4t.exec:\8da4t.exe226⤵
-
\??\c:\4413th.exec:\4413th.exe227⤵
-
\??\c:\8e00f.exec:\8e00f.exe228⤵
-
\??\c:\2ur43o.exec:\2ur43o.exe229⤵
-
\??\c:\153875t.exec:\153875t.exe230⤵
-
\??\c:\85021.exec:\85021.exe231⤵
-
\??\c:\a62ir6.exec:\a62ir6.exe232⤵
-
\??\c:\q9jabh.exec:\q9jabh.exe233⤵
-
\??\c:\fc1w3.exec:\fc1w3.exe234⤵
-
\??\c:\8x38543.exec:\8x38543.exe235⤵
-
\??\c:\60400.exec:\60400.exe236⤵
-
\??\c:\11k64.exec:\11k64.exe237⤵
-
\??\c:\64c351v.exec:\64c351v.exe238⤵
-
\??\c:\pnh996.exec:\pnh996.exe239⤵
-
\??\c:\64930.exec:\64930.exe240⤵
-
\??\c:\90xf3.exec:\90xf3.exe241⤵