d473694f4ee39e12d59f07a17880735eb8f5d8bab742b54fbbbf750a46b3073c

Analysis

max time kernel
192s
max time network
197s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 03:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4fcae130e5263a31a38a4a87c6724165.exe
Size

16KB
MD5

4fcae130e5263a31a38a4a87c6724165
SHA1

43770ef2381b9433d546a97c5bf508cd1d3c3629
SHA256

d473694f4ee39e12d59f07a17880735eb8f5d8bab742b54fbbbf750a46b3073c
SHA512

20fc30fcef50242c0c57b0254a4f8aeb858d19a0235434e2358721d693c15cedc754af57fb5795dcb81d2b59120c8a570fa13776379db76ed28c91cf4edcdd43
SSDEEP

384:HS2l0iAMI4qPoQkvAcNNG8ov3kDg0H4B3/y4Hp:HD3XAL8ov3mg0HUh

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 34 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2980-0-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/2980-3-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/1948-8-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/2980-9-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/2872-10-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/1948-13-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/2872-16-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/1084-19-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/2008-22-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/1096-23-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/1732-26-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/1776-32-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/3000-35-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/2164-38-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/752-42-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/3024-58-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/1940-61-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/1728-68-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/580-72-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/2188-90-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/2560-94-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/2260-102-0x0000000000510000-0x0000000000521000-memory.dmp	upx
behavioral1/memory/2260-105-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/1568-108-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/1376-114-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/628-117-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/2816-131-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/3064-141-0x00000000003E0000-0x00000000003F1000-memory.dmp	upx
behavioral1/memory/3064-144-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/2056-152-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/2488-163-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/2940-166-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/2388-169-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/2208-186-0x0000000000400000-0x0000000000411000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 56 IoCs

pid	Process
2980	4fcae130e5263a31a38a4a87c6724165.exe
1948	4fcae130e5263a31a38a4a87c6724165.exe
2872	4fcae130e5263a31a38a4a87c6724165.exe
1084	4fcae130e5263a31a38a4a87c6724165.exe
2008	4fcae130e5263a31a38a4a87c6724165.exe
1732	4fcae130e5263a31a38a4a87c6724165.exe
1096	4fcae130e5263a31a38a4a87c6724165.exe
1776	4fcae130e5263a31a38a4a87c6724165.exe
3000	4fcae130e5263a31a38a4a87c6724165.exe
2164	4fcae130e5263a31a38a4a87c6724165.exe
752	4fcae130e5263a31a38a4a87c6724165.exe
832	4fcae130e5263a31a38a4a87c6724165.exe
1828	4fcae130e5263a31a38a4a87c6724165.exe
600	4fcae130e5263a31a38a4a87c6724165.exe
2072	4fcae130e5263a31a38a4a87c6724165.exe
3024	4fcae130e5263a31a38a4a87c6724165.exe
1940	4fcae130e5263a31a38a4a87c6724165.exe
2880	4fcae130e5263a31a38a4a87c6724165.exe
1728	4fcae130e5263a31a38a4a87c6724165.exe
580	4fcae130e5263a31a38a4a87c6724165.exe
532	4fcae130e5263a31a38a4a87c6724165.exe
2556	4fcae130e5263a31a38a4a87c6724165.exe
576	4fcae130e5263a31a38a4a87c6724165.exe
1144	4fcae130e5263a31a38a4a87c6724165.exe
2188	4fcae130e5263a31a38a4a87c6724165.exe
2560	4fcae130e5263a31a38a4a87c6724165.exe
1016	4fcae130e5263a31a38a4a87c6724165.exe
3008	4fcae130e5263a31a38a4a87c6724165.exe
2260	4fcae130e5263a31a38a4a87c6724165.exe
1568	4fcae130e5263a31a38a4a87c6724165.exe
1936	4fcae130e5263a31a38a4a87c6724165.exe
1376	4fcae130e5263a31a38a4a87c6724165.exe
628	4fcae130e5263a31a38a4a87c6724165.exe
1992	4fcae130e5263a31a38a4a87c6724165.exe
1880	4fcae130e5263a31a38a4a87c6724165.exe
2664	4fcae130e5263a31a38a4a87c6724165.exe
2816	4fcae130e5263a31a38a4a87c6724165.exe
1724	4fcae130e5263a31a38a4a87c6724165.exe
1904	4fcae130e5263a31a38a4a87c6724165.exe
3068	4fcae130e5263a31a38a4a87c6724165.exe
3064	4fcae130e5263a31a38a4a87c6724165.exe
520	4fcae130e5263a31a38a4a87c6724165.exe
2056	4fcae130e5263a31a38a4a87c6724165.exe
2812	4fcae130e5263a31a38a4a87c6724165.exe
2856	4fcae130e5263a31a38a4a87c6724165.exe
2488	4fcae130e5263a31a38a4a87c6724165.exe
2940	4fcae130e5263a31a38a4a87c6724165.exe
2388	4fcae130e5263a31a38a4a87c6724165.exe
1740	4fcae130e5263a31a38a4a87c6724165.exe
1268	4fcae130e5263a31a38a4a87c6724165.exe
2756	4fcae130e5263a31a38a4a87c6724165.exe
2284	4fcae130e5263a31a38a4a87c6724165.exe
2208	4fcae130e5263a31a38a4a87c6724165.exe
2252	4fcae130e5263a31a38a4a87c6724165.exe
2308	4fcae130e5263a31a38a4a87c6724165.exe
1752	4fcae130e5263a31a38a4a87c6724165.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 1948	2980	4fcae130e5263a31a38a4a87c6724165.exe	31
PID 2980 wrote to memory of 1948	2980	4fcae130e5263a31a38a4a87c6724165.exe	31
PID 2980 wrote to memory of 1948	2980	4fcae130e5263a31a38a4a87c6724165.exe	31
PID 2980 wrote to memory of 1948	2980	4fcae130e5263a31a38a4a87c6724165.exe	31
PID 1948 wrote to memory of 2872	1948	4fcae130e5263a31a38a4a87c6724165.exe	32
PID 1948 wrote to memory of 2872	1948	4fcae130e5263a31a38a4a87c6724165.exe	32
PID 1948 wrote to memory of 2872	1948	4fcae130e5263a31a38a4a87c6724165.exe	32
PID 1948 wrote to memory of 2872	1948	4fcae130e5263a31a38a4a87c6724165.exe	32
PID 2872 wrote to memory of 1084	2872	4fcae130e5263a31a38a4a87c6724165.exe	33
PID 2872 wrote to memory of 1084	2872	4fcae130e5263a31a38a4a87c6724165.exe	33
PID 2872 wrote to memory of 1084	2872	4fcae130e5263a31a38a4a87c6724165.exe	33
PID 2872 wrote to memory of 1084	2872	4fcae130e5263a31a38a4a87c6724165.exe	33
PID 1084 wrote to memory of 2008	1084	4fcae130e5263a31a38a4a87c6724165.exe	34
PID 1084 wrote to memory of 2008	1084	4fcae130e5263a31a38a4a87c6724165.exe	34
PID 1084 wrote to memory of 2008	1084	4fcae130e5263a31a38a4a87c6724165.exe	34
PID 1084 wrote to memory of 2008	1084	4fcae130e5263a31a38a4a87c6724165.exe	34
PID 2008 wrote to memory of 1732	2008	4fcae130e5263a31a38a4a87c6724165.exe	35
PID 2008 wrote to memory of 1732	2008	4fcae130e5263a31a38a4a87c6724165.exe	35
PID 2008 wrote to memory of 1732	2008	4fcae130e5263a31a38a4a87c6724165.exe	35
PID 2008 wrote to memory of 1732	2008	4fcae130e5263a31a38a4a87c6724165.exe	35
PID 1732 wrote to memory of 1096	1732	4fcae130e5263a31a38a4a87c6724165.exe	36
PID 1732 wrote to memory of 1096	1732	4fcae130e5263a31a38a4a87c6724165.exe	36
PID 1732 wrote to memory of 1096	1732	4fcae130e5263a31a38a4a87c6724165.exe	36
PID 1732 wrote to memory of 1096	1732	4fcae130e5263a31a38a4a87c6724165.exe	36
PID 1096 wrote to memory of 1776	1096	4fcae130e5263a31a38a4a87c6724165.exe	37
PID 1096 wrote to memory of 1776	1096	4fcae130e5263a31a38a4a87c6724165.exe	37
PID 1096 wrote to memory of 1776	1096	4fcae130e5263a31a38a4a87c6724165.exe	37
PID 1096 wrote to memory of 1776	1096	4fcae130e5263a31a38a4a87c6724165.exe	37
PID 1776 wrote to memory of 3000	1776	4fcae130e5263a31a38a4a87c6724165.exe	38
PID 1776 wrote to memory of 3000	1776	4fcae130e5263a31a38a4a87c6724165.exe	38
PID 1776 wrote to memory of 3000	1776	4fcae130e5263a31a38a4a87c6724165.exe	38
PID 1776 wrote to memory of 3000	1776	4fcae130e5263a31a38a4a87c6724165.exe	38
PID 3000 wrote to memory of 2164	3000	4fcae130e5263a31a38a4a87c6724165.exe	39
PID 3000 wrote to memory of 2164	3000	4fcae130e5263a31a38a4a87c6724165.exe	39
PID 3000 wrote to memory of 2164	3000	4fcae130e5263a31a38a4a87c6724165.exe	39
PID 3000 wrote to memory of 2164	3000	4fcae130e5263a31a38a4a87c6724165.exe	39
PID 2164 wrote to memory of 752	2164	4fcae130e5263a31a38a4a87c6724165.exe	40
PID 2164 wrote to memory of 752	2164	4fcae130e5263a31a38a4a87c6724165.exe	40
PID 2164 wrote to memory of 752	2164	4fcae130e5263a31a38a4a87c6724165.exe	40
PID 2164 wrote to memory of 752	2164	4fcae130e5263a31a38a4a87c6724165.exe	40
PID 752 wrote to memory of 832	752	4fcae130e5263a31a38a4a87c6724165.exe	41
PID 752 wrote to memory of 832	752	4fcae130e5263a31a38a4a87c6724165.exe	41
PID 752 wrote to memory of 832	752	4fcae130e5263a31a38a4a87c6724165.exe	41
PID 752 wrote to memory of 832	752	4fcae130e5263a31a38a4a87c6724165.exe	41
PID 832 wrote to memory of 1828	832	4fcae130e5263a31a38a4a87c6724165.exe	42
PID 832 wrote to memory of 1828	832	4fcae130e5263a31a38a4a87c6724165.exe	42
PID 832 wrote to memory of 1828	832	4fcae130e5263a31a38a4a87c6724165.exe	42
PID 832 wrote to memory of 1828	832	4fcae130e5263a31a38a4a87c6724165.exe	42
PID 1828 wrote to memory of 600	1828	4fcae130e5263a31a38a4a87c6724165.exe	43
PID 1828 wrote to memory of 600	1828	4fcae130e5263a31a38a4a87c6724165.exe	43
PID 1828 wrote to memory of 600	1828	4fcae130e5263a31a38a4a87c6724165.exe	43
PID 1828 wrote to memory of 600	1828	4fcae130e5263a31a38a4a87c6724165.exe	43
PID 600 wrote to memory of 2072	600	4fcae130e5263a31a38a4a87c6724165.exe	44
PID 600 wrote to memory of 2072	600	4fcae130e5263a31a38a4a87c6724165.exe	44
PID 600 wrote to memory of 2072	600	4fcae130e5263a31a38a4a87c6724165.exe	44
PID 600 wrote to memory of 2072	600	4fcae130e5263a31a38a4a87c6724165.exe	44
PID 2072 wrote to memory of 3024	2072	4fcae130e5263a31a38a4a87c6724165.exe	45
PID 2072 wrote to memory of 3024	2072	4fcae130e5263a31a38a4a87c6724165.exe	45
PID 2072 wrote to memory of 3024	2072	4fcae130e5263a31a38a4a87c6724165.exe	45
PID 2072 wrote to memory of 3024	2072	4fcae130e5263a31a38a4a87c6724165.exe	45
PID 3024 wrote to memory of 1940	3024	4fcae130e5263a31a38a4a87c6724165.exe	47
PID 3024 wrote to memory of 1940	3024	4fcae130e5263a31a38a4a87c6724165.exe	47
PID 3024 wrote to memory of 1940	3024	4fcae130e5263a31a38a4a87c6724165.exe	47
PID 3024 wrote to memory of 1940	3024	4fcae130e5263a31a38a4a87c6724165.exe	47

C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
"C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
  C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
    C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
      C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1084
    - - C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2008
      - C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        7⤵
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        8⤵
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        9⤵
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        10⤵
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        11⤵
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        12⤵
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        13⤵
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        14⤵
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:600
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        15⤵
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        16⤵
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        17⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        18⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        19⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        20⤵
        Suspicious use of SetWindowsHookEx
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        21⤵
        Suspicious use of SetWindowsHookEx
        
        PID:532
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        22⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        23⤵
        Suspicious use of SetWindowsHookEx
        
        PID:576
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        24⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        25⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        26⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        27⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        28⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        29⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        30⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        31⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        32⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        33⤵
        Suspicious use of SetWindowsHookEx
        
        PID:628
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        34⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        35⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        36⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        37⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        38⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        39⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        40⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        41⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        42⤵
        Suspicious use of SetWindowsHookEx
        
        PID:520
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        43⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        44⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        45⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        46⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        47⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        48⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        49⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        50⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        51⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        52⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        53⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        54⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        55⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        
        C:\Users\Admin\AppData\Local\Temp\4fcae130e5263a31a38a4a87c6724165.exe
        56⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/520-145-0x00000000003E0000-0x00000000003F1000-memory.dmp

Filesize
68KB

Download
memory/532-73-0x0000000000420000-0x0000000000431000-memory.dmp

Filesize
68KB

Download
memory/576-81-0x0000000002610000-0x0000000002621000-memory.dmp

Filesize
68KB

Download
memory/580-72-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/580-69-0x00000000006E0000-0x00000000006F1000-memory.dmp

Filesize
68KB

Download
memory/628-117-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/752-42-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/752-39-0x00000000003A0000-0x00000000003B1000-memory.dmp

Filesize
68KB

Download
memory/832-43-0x0000000002D20000-0x0000000002D31000-memory.dmp

Filesize
68KB

Download
memory/1016-95-0x00000000003E0000-0x00000000003F1000-memory.dmp

Filesize
68KB

Download
memory/1084-19-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1096-23-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1376-114-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1568-108-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1728-68-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1732-26-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1740-170-0x0000000001DD0000-0x0000000001DE1000-memory.dmp

Filesize
68KB

Download
memory/1776-32-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1880-122-0x00000000003E0000-0x00000000003F1000-memory.dmp

Filesize
68KB

Download
memory/1940-61-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1948-13-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1948-8-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1992-118-0x0000000000580000-0x0000000000591000-memory.dmp

Filesize
68KB

Download
memory/2008-22-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2056-149-0x0000000002FF0000-0x0000000003001000-memory.dmp

Filesize
68KB

Download
memory/2056-152-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2164-38-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2188-90-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2208-186-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2252-187-0x00000000004B0000-0x00000000004C1000-memory.dmp

Filesize
68KB

Download
memory/2260-102-0x0000000000510000-0x0000000000521000-memory.dmp

Filesize
68KB

Download
memory/2260-105-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2284-180-0x00000000004B0000-0x00000000004C1000-memory.dmp

Filesize
68KB

Download
memory/2388-169-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2488-163-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2556-77-0x00000000003E0000-0x00000000003F1000-memory.dmp

Filesize
68KB

Download
memory/2560-91-0x00000000003D0000-0x00000000003E1000-memory.dmp

Filesize
68KB

Download
memory/2560-94-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2812-153-0x0000000000360000-0x0000000000371000-memory.dmp

Filesize
68KB

Download
memory/2816-131-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2856-157-0x0000000001DE0000-0x0000000001DF1000-memory.dmp

Filesize
68KB

Download
memory/2872-16-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2872-10-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2880-62-0x00000000023A0000-0x00000000023B1000-memory.dmp

Filesize
68KB

Download
memory/2940-166-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2980-5-0x0000000001C20000-0x0000000001C31000-memory.dmp

Filesize
68KB

Download
memory/2980-9-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2980-3-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2980-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3000-35-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3024-58-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3064-144-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3064-141-0x00000000003E0000-0x00000000003F1000-memory.dmp

Filesize
68KB

Download