Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/01/2024, 00:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
75f56b5b74098fefc77b2dbf3bcc0d6a.exe
Resource
win7-20231129-en
0 signatures
150 seconds
General
-
Target
75f56b5b74098fefc77b2dbf3bcc0d6a.exe
-
Size
103KB
-
MD5
75f56b5b74098fefc77b2dbf3bcc0d6a
-
SHA1
39658d621003559abaf4f51e350ad9a07c0ef0db
-
SHA256
5455001773735b15428b2f7b3adf830e9cf8499a04235f35adfbafd759b043a1
-
SHA512
be377f913534493ef38bd820f31495396cfbbe63a71f816c84e2923b00893923b5470d63579eb69e91639fc360aa03bab50d5b2a873e0e6fc054c36b93cbb984
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp9FrH5VBuEBQ:n3C9BRo7tvnJ9FvgEy
Malware Config
Signatures
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral2/memory/3464-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3464-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4056-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3748-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3412-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3684-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2652-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2488-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2176-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4848-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4660-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2068-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1516-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1816-312-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4248-317-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1216-306-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2504-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2748-327-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-340-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3616-360-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-364-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3640-369-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4960-376-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1520-386-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4264-341-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1108-321-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-399-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4432-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2424-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/340-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/896-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4320-418-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1496-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3152-427-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/368-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1316-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3952-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3184-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4920-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1560-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4680-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1536-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4272-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4560-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2308-460-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4560 38x159t.exe 4056 l79351.exe 3748 49779.exe 3412 9vcs3.exe 4272 09emgmw.exe 1536 1p5w951.exe 2360 4175s.exe 1564 eikssu.exe 4680 6asmio.exe 1560 g2si5.exe 3108 p3gx3.exe 4920 53535.exe 3184 f94r33m.exe 3952 818ix8o.exe 1316 l0umceu.exe 368 v14919.exe 4520 50uasd.exe 1496 cv534l0.exe 896 e5wog6.exe 4988 tn71t1.exe 3684 4953c.exe 4264 wqg2q.exe 3560 9r8dsac.exe 5000 19eogqc.exe 2488 j15995.exe 2652 64cissr.exe 1104 i995179.exe 340 d5d713.exe 2424 iossukk.exe 2176 0e57751.exe 4432 63mg4m.exe 3364 fjl51g.exe 4604 8ik2sq.exe 676 0w2aik.exe 5116 0312v.exe 4848 155x7.exe 2504 19csw9.exe 4832 3373it.exe 4356 33919m.exe 4808 f37519s.exe 3692 9iqk6b.exe 1516 nwj9ob.exe 2552 WaaSMedicAgent.exe 948 7g53p3.exe 2068 v1gad53.exe 1560 g2si5.exe 4660 9camk7.exe 4064 955391a.exe 3484 3377973.exe 1216 n2rktx.exe 1816 q52qt.exe 4248 f919d7x.exe 1108 kwskf5.exe 2748 dw2f2su.exe 4372 kur6i.exe 4880 tm9cuw.exe 4264 wqg2q.exe 3176 55e4wg9.exe 3572 js1co.exe 2616 svchost.exe 3616 1391x32.exe 3640 ljok33.exe 2876 11mqvo.exe 4960 6w717or.exe -
resource yara_rule behavioral2/memory/3464-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3464-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3464-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4056-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3748-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3412-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3684-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2652-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2488-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2176-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4848-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4660-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1560-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2068-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1516-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1816-312-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1816-310-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4248-317-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1216-306-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2504-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4372-331-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2748-327-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-340-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-350-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-360-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-364-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3640-369-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4960-376-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4960-374-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1520-386-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1520-384-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4504-390-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4460-380-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4264-341-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1108-321-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-399-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4432-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2424-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/340-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/896-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4320-418-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1496-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-427-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/368-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1716-431-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1316-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1316-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3184-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4920-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1560-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4680-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1536-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4272-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-460-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3464 wrote to memory of 4560 3464 75f56b5b74098fefc77b2dbf3bcc0d6a.exe 87 PID 3464 wrote to memory of 4560 3464 75f56b5b74098fefc77b2dbf3bcc0d6a.exe 87 PID 3464 wrote to memory of 4560 3464 75f56b5b74098fefc77b2dbf3bcc0d6a.exe 87 PID 4560 wrote to memory of 4056 4560 38x159t.exe 171 PID 4560 wrote to memory of 4056 4560 38x159t.exe 171 PID 4560 wrote to memory of 4056 4560 38x159t.exe 171 PID 4056 wrote to memory of 3748 4056 l79351.exe 169 PID 4056 wrote to memory of 3748 4056 l79351.exe 169 PID 4056 wrote to memory of 3748 4056 l79351.exe 169 PID 3748 wrote to memory of 3412 3748 49779.exe 88 PID 3748 wrote to memory of 3412 3748 49779.exe 88 PID 3748 wrote to memory of 3412 3748 49779.exe 88 PID 3412 wrote to memory of 4272 3412 9vcs3.exe 89 PID 3412 wrote to memory of 4272 3412 9vcs3.exe 89 PID 3412 wrote to memory of 4272 3412 9vcs3.exe 89 PID 4272 wrote to memory of 1536 4272 09emgmw.exe 167 PID 4272 wrote to memory of 1536 4272 09emgmw.exe 167 PID 4272 wrote to memory of 1536 4272 09emgmw.exe 167 PID 1536 wrote to memory of 2360 1536 1p5w951.exe 90 PID 1536 wrote to memory of 2360 1536 1p5w951.exe 90 PID 1536 wrote to memory of 2360 1536 1p5w951.exe 90 PID 2360 wrote to memory of 1564 2360 4175s.exe 91 PID 2360 wrote to memory of 1564 2360 4175s.exe 91 PID 2360 wrote to memory of 1564 2360 4175s.exe 91 PID 1564 wrote to memory of 4680 1564 eikssu.exe 166 PID 1564 wrote to memory of 4680 1564 eikssu.exe 166 PID 1564 wrote to memory of 4680 1564 eikssu.exe 166 PID 4680 wrote to memory of 1560 4680 6asmio.exe 164 PID 4680 wrote to memory of 1560 4680 6asmio.exe 164 PID 4680 wrote to memory of 1560 4680 6asmio.exe 164 PID 1560 wrote to memory of 3108 1560 g2si5.exe 208 PID 1560 wrote to memory of 3108 1560 g2si5.exe 208 PID 1560 wrote to memory of 3108 1560 g2si5.exe 208 PID 3108 wrote to memory of 4920 3108 p3gx3.exe 161 PID 3108 wrote to memory of 4920 3108 p3gx3.exe 161 PID 3108 wrote to memory of 4920 3108 p3gx3.exe 161 PID 4920 wrote to memory of 3184 4920 53535.exe 160 PID 4920 wrote to memory of 3184 4920 53535.exe 160 PID 4920 wrote to memory of 3184 4920 53535.exe 160 PID 3184 wrote to memory of 3952 3184 f94r33m.exe 157 PID 3184 wrote to memory of 3952 3184 f94r33m.exe 157 PID 3184 wrote to memory of 3952 3184 f94r33m.exe 157 PID 3952 wrote to memory of 1316 3952 818ix8o.exe 154 PID 3952 wrote to memory of 1316 3952 818ix8o.exe 154 PID 3952 wrote to memory of 1316 3952 818ix8o.exe 154 PID 1316 wrote to memory of 368 1316 l0umceu.exe 153 PID 1316 wrote to memory of 368 1316 l0umceu.exe 153 PID 1316 wrote to memory of 368 1316 l0umceu.exe 153 PID 368 wrote to memory of 4520 368 v14919.exe 151 PID 368 wrote to memory of 4520 368 v14919.exe 151 PID 368 wrote to memory of 4520 368 v14919.exe 151 PID 4520 wrote to memory of 1496 4520 50uasd.exe 149 PID 4520 wrote to memory of 1496 4520 50uasd.exe 149 PID 4520 wrote to memory of 1496 4520 50uasd.exe 149 PID 1496 wrote to memory of 896 1496 cv534l0.exe 148 PID 1496 wrote to memory of 896 1496 cv534l0.exe 148 PID 1496 wrote to memory of 896 1496 cv534l0.exe 148 PID 896 wrote to memory of 4988 896 e5wog6.exe 146 PID 896 wrote to memory of 4988 896 e5wog6.exe 146 PID 896 wrote to memory of 4988 896 e5wog6.exe 146 PID 4988 wrote to memory of 3684 4988 tn71t1.exe 144 PID 4988 wrote to memory of 3684 4988 tn71t1.exe 144 PID 4988 wrote to memory of 3684 4988 tn71t1.exe 144 PID 3684 wrote to memory of 4264 3684 4953c.exe 143
Processes
-
C:\Users\Admin\AppData\Local\Temp\75f56b5b74098fefc77b2dbf3bcc0d6a.exe"C:\Users\Admin\AppData\Local\Temp\75f56b5b74098fefc77b2dbf3bcc0d6a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3464 -
\??\c:\38x159t.exec:\38x159t.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\l79351.exec:\l79351.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056
-
-
-
\??\c:\9vcs3.exec:\9vcs3.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\09emgmw.exec:\09emgmw.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\1p5w951.exec:\1p5w951.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536
-
-
-
\??\c:\4175s.exec:\4175s.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\eikssu.exec:\eikssu.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\6asmio.exec:\6asmio.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680
-
-
-
\??\c:\64cissr.exec:\64cissr.exe1⤵
- Executes dropped EXE
PID:2652 -
\??\c:\i995179.exec:\i995179.exe2⤵
- Executes dropped EXE
PID:1104
-
-
\??\c:\0w2aik.exec:\0w2aik.exe1⤵
- Executes dropped EXE
PID:676 -
\??\c:\dwqwks.exec:\dwqwks.exe2⤵PID:5116
-
-
\??\c:\6327933.exec:\6327933.exe1⤵PID:4832
-
\??\c:\33919m.exec:\33919m.exe2⤵
- Executes dropped EXE
PID:4356 -
\??\c:\f37519s.exec:\f37519s.exe3⤵
- Executes dropped EXE
PID:4808
-
-
-
\??\c:\u0d8r7.exec:\u0d8r7.exe2⤵PID:2648
-
\??\c:\4mx9571.exec:\4mx9571.exe3⤵PID:3152
-
\??\c:\r6t59.exec:\r6t59.exe4⤵PID:1660
-
\??\c:\gw711.exec:\gw711.exe5⤵PID:856
-
\??\c:\2r36q.exec:\2r36q.exe6⤵PID:960
-
\??\c:\5al5kft.exec:\5al5kft.exe7⤵PID:2264
-
\??\c:\4e0t3at.exec:\4e0t3at.exe8⤵PID:2996
-
-
-
-
-
-
-
-
\??\c:\9iqk6b.exec:\9iqk6b.exe1⤵
- Executes dropped EXE
PID:3692 -
\??\c:\nwj9ob.exec:\nwj9ob.exe2⤵
- Executes dropped EXE
PID:1516
-
-
\??\c:\7g53p3.exec:\7g53p3.exe1⤵
- Executes dropped EXE
PID:948 -
\??\c:\v1gad53.exec:\v1gad53.exe2⤵
- Executes dropped EXE
PID:2068
-
-
\??\c:\2qsoe8.exec:\2qsoe8.exe1⤵PID:2552
-
\??\c:\lowk6.exec:\lowk6.exe1⤵PID:4660
-
\??\c:\955391a.exec:\955391a.exe2⤵
- Executes dropped EXE
PID:4064 -
\??\c:\3377973.exec:\3377973.exe3⤵
- Executes dropped EXE
PID:3484 -
\??\c:\v6gwa57.exec:\v6gwa57.exe4⤵PID:1216
-
-
-
-
\??\c:\e8cit.exec:\e8cit.exe1⤵PID:1560
-
\??\c:\0ud14q.exec:\0ud14q.exe2⤵PID:3108
-
-
\??\c:\f919d7x.exec:\f919d7x.exe1⤵
- Executes dropped EXE
PID:4248 -
\??\c:\kwskf5.exec:\kwskf5.exe2⤵
- Executes dropped EXE
PID:1108 -
\??\c:\dw2f2su.exec:\dw2f2su.exe3⤵
- Executes dropped EXE
PID:2748
-
-
-
\??\c:\q52qt.exec:\q52qt.exe1⤵
- Executes dropped EXE
PID:1816
-
\??\c:\tm9cuw.exec:\tm9cuw.exe1⤵
- Executes dropped EXE
PID:4880 -
\??\c:\7739b0m.exec:\7739b0m.exe2⤵PID:4264
-
\??\c:\55e4wg9.exec:\55e4wg9.exe3⤵
- Executes dropped EXE
PID:3176
-
-
\??\c:\mkhkx37.exec:\mkhkx37.exe3⤵PID:3560
-
-
-
\??\c:\git36.exec:\git36.exe1⤵PID:4372
-
\??\c:\1391x32.exec:\1391x32.exe1⤵
- Executes dropped EXE
PID:3616 -
\??\c:\ljok33.exec:\ljok33.exe2⤵
- Executes dropped EXE
PID:3640 -
\??\c:\11mqvo.exec:\11mqvo.exe3⤵
- Executes dropped EXE
PID:2876 -
\??\c:\6w717or.exec:\6w717or.exe4⤵
- Executes dropped EXE
PID:4960 -
\??\c:\k1wmg.exec:\k1wmg.exe5⤵PID:4460
-
\??\c:\t73g51.exec:\t73g51.exe6⤵PID:1520
-
\??\c:\56n92.exec:\56n92.exe7⤵PID:4504
-
\??\c:\o495d.exec:\o495d.exe8⤵PID:4564
-
\??\c:\33111e.exec:\33111e.exe9⤵PID:4404
-
\??\c:\4ww17.exec:\4ww17.exe10⤵PID:3404
-
\??\c:\7jb5ea.exec:\7jb5ea.exe11⤵PID:2100
-
\??\c:\6e963ai.exec:\6e963ai.exe12⤵PID:1184
-
\??\c:\x0ebs.exec:\x0ebs.exe13⤵PID:4320
-
\??\c:\66ie3.exec:\66ie3.exe14⤵PID:3384
-
\??\c:\0gkqo.exec:\0gkqo.exe15⤵PID:3152
-
\??\c:\s92eua.exec:\s92eua.exe16⤵PID:1716
-
\??\c:\bob719.exec:\bob719.exe17⤵PID:2880
-
\??\c:\cet9o.exec:\cet9o.exe18⤵PID:960
-
\??\c:\8b95r5i.exec:\8b95r5i.exe19⤵PID:4968
-
\??\c:\l539m3.exec:\l539m3.exe20⤵PID:1192
-
\??\c:\agx6ef.exec:\agx6ef.exe21⤵PID:3108
-
\??\c:\638uwc.exec:\638uwc.exe22⤵PID:4660
-
\??\c:\f1kcois.exec:\f1kcois.exe23⤵PID:2308
-
\??\c:\t50w91.exec:\t50w91.exe24⤵PID:3064
-
\??\c:\n2rktx.exec:\n2rktx.exe25⤵
- Executes dropped EXE
PID:1216 -
\??\c:\0v31751.exec:\0v31751.exe26⤵PID:220
-
\??\c:\12k0v09.exec:\12k0v09.exe27⤵PID:2920
-
\??\c:\sub2i55.exec:\sub2i55.exe28⤵PID:4620
-
\??\c:\p77193.exec:\p77193.exe29⤵PID:3224
-
\??\c:\3438m9.exec:\3438m9.exe30⤵PID:2584
-
\??\c:\n377r11.exec:\n377r11.exe31⤵PID:2676
-
\??\c:\q809hln.exec:\q809hln.exe32⤵PID:1780
-
\??\c:\o8c749.exec:\o8c749.exe33⤵PID:2256
-
\??\c:\wmiuo.exec:\wmiuo.exe34⤵PID:5016
-
\??\c:\hwg68.exec:\hwg68.exe35⤵PID:2132
-
\??\c:\a52qf3.exec:\a52qf3.exe36⤵PID:2952
-
\??\c:\s3p092.exec:\s3p092.exe37⤵PID:4716
-
\??\c:\ocwcu.exec:\ocwcu.exe38⤵PID:3268
-
\??\c:\h599x.exec:\h599x.exe39⤵PID:2240
-
\??\c:\f0ix3a.exec:\f0ix3a.exe40⤵PID:212
-
\??\c:\43fb63.exec:\43fb63.exe41⤵PID:4824
-
\??\c:\710o59.exec:\710o59.exe42⤵PID:4864
-
\??\c:\iossukk.exec:\iossukk.exe43⤵
- Executes dropped EXE
PID:2424 -
\??\c:\t5ir1.exec:\t5ir1.exe44⤵PID:4524
-
\??\c:\r5752.exec:\r5752.exe45⤵PID:4688
-
\??\c:\0312v.exec:\0312v.exe46⤵
- Executes dropped EXE
PID:5116 -
\??\c:\j6713b.exec:\j6713b.exe47⤵PID:1668
-
\??\c:\279939.exec:\279939.exe48⤵PID:3552
-
\??\c:\kgg1ggs.exec:\kgg1ggs.exe49⤵PID:1184
-
\??\c:\3373it.exec:\3373it.exe50⤵
- Executes dropped EXE
PID:4832
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\d1993t.exec:\d1993t.exe1⤵PID:2616
-
\??\c:\js1co.exec:\js1co.exe1⤵
- Executes dropped EXE
PID:3572
-
\??\c:\19csw9.exec:\19csw9.exe1⤵
- Executes dropped EXE
PID:2504
-
\??\c:\155x7.exec:\155x7.exe1⤵
- Executes dropped EXE
PID:4848
-
\??\c:\8ik2sq.exec:\8ik2sq.exe1⤵
- Executes dropped EXE
PID:4604
-
\??\c:\fjl51g.exec:\fjl51g.exe1⤵
- Executes dropped EXE
PID:3364
-
\??\c:\63mg4m.exec:\63mg4m.exe1⤵
- Executes dropped EXE
PID:4432
-
\??\c:\0e57751.exec:\0e57751.exe1⤵
- Executes dropped EXE
PID:2176
-
\??\c:\915sp9.exec:\915sp9.exe1⤵PID:2424
-
\??\c:\d5d713.exec:\d5d713.exe1⤵
- Executes dropped EXE
PID:340
-
\??\c:\j15995.exec:\j15995.exe1⤵
- Executes dropped EXE
PID:2488
-
\??\c:\19eogqc.exec:\19eogqc.exe1⤵
- Executes dropped EXE
PID:5000
-
\??\c:\wqg2q.exec:\wqg2q.exe1⤵
- Executes dropped EXE
PID:4264
-
\??\c:\4953c.exec:\4953c.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684
-
\??\c:\tn71t1.exec:\tn71t1.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988
-
\??\c:\e5wog6.exec:\e5wog6.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896
-
\??\c:\cv534l0.exec:\cv534l0.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496
-
\??\c:\50uasd.exec:\50uasd.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520
-
\??\c:\v14919.exec:\v14919.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368
-
\??\c:\l0umceu.exec:\l0umceu.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 86166d50578e838223078bad7895df83 F/Yx5q6bs0ivyHpRWKCrOA.0.1.0.0.01⤵
- Executes dropped EXE
PID:2552
-
\??\c:\818ix8o.exec:\818ix8o.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952
-
\??\c:\f94r33m.exec:\f94r33m.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184
-
\??\c:\53535.exec:\53535.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920
-
\??\c:\g2si5.exec:\g2si5.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560
-
\??\c:\49779.exec:\49779.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Executes dropped EXE
PID:2616
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵PID:4460
-
\??\c:\p3gx3.exec:\p3gx3.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\9camk7.exec:\9camk7.exe2⤵
- Executes dropped EXE
PID:4660 -
\??\c:\6isqqs.exec:\6isqqs.exe3⤵PID:2224
-
\??\c:\fg4a71.exec:\fg4a71.exe4⤵PID:1432
-
\??\c:\83d8aw.exec:\83d8aw.exe5⤵PID:3064
-
\??\c:\m5kigg.exec:\m5kigg.exe6⤵PID:1360
-
\??\c:\23af2.exec:\23af2.exe7⤵PID:2280
-
\??\c:\tm5uua.exec:\tm5uua.exe8⤵PID:3864
-
\??\c:\930eb1.exec:\930eb1.exe9⤵PID:4436
-
\??\c:\sm979.exec:\sm979.exe10⤵PID:3016
-
\??\c:\42sesew.exec:\42sesew.exe11⤵PID:1148
-
\??\c:\7h1535f.exec:\7h1535f.exe12⤵PID:2868
-
\??\c:\8of30.exec:\8of30.exe13⤵PID:4692
-
\??\c:\kur6i.exec:\kur6i.exe14⤵
- Executes dropped EXE
PID:4372 -
\??\c:\9r8dsac.exec:\9r8dsac.exe15⤵
- Executes dropped EXE
PID:3560 -
\??\c:\6gmk15.exec:\6gmk15.exe16⤵PID:4052
-
\??\c:\n533h0o.exec:\n533h0o.exe17⤵PID:2952
-
\??\c:\4o5993.exec:\4o5993.exe18⤵PID:3140
-
\??\c:\qap75.exec:\qap75.exe19⤵PID:3268
-
\??\c:\547m3.exec:\547m3.exe20⤵PID:2240
-
\??\c:\x99559h.exec:\x99559h.exe21⤵PID:212
-
\??\c:\w33193.exec:\w33193.exe22⤵PID:2232
-
\??\c:\bik34c.exec:\bik34c.exe23⤵PID:4432
-
\??\c:\0i3v0.exec:\0i3v0.exe24⤵PID:2540
-
\??\c:\1354qaw.exec:\1354qaw.exe25⤵PID:1420
-
\??\c:\v130u.exec:\v130u.exe26⤵PID:5112
-
\??\c:\uuesch.exec:\uuesch.exe27⤵PID:3556
-
\??\c:\r777ua1.exec:\r777ua1.exe28⤵PID:4812
-
\??\c:\8g6c3.exec:\8g6c3.exe29⤵PID:4356
-
\??\c:\a8pp83.exec:\a8pp83.exe30⤵PID:2360
-
\??\c:\ir8401.exec:\ir8401.exe31⤵PID:368
-
\??\c:\0r97r.exec:\0r97r.exe32⤵PID:3756
-
\??\c:\f5657.exec:\f5657.exe33⤵PID:3432
-
\??\c:\76am15.exec:\76am15.exe34⤵PID:4568
-
\??\c:\22eeuuu.exec:\22eeuuu.exe35⤵PID:2520
-
\??\c:\73573bq.exec:\73573bq.exe36⤵PID:1560
-
\??\c:\lw4mspk.exec:\lw4mspk.exe37⤵PID:3992
-
\??\c:\2osoekw.exec:\2osoekw.exe38⤵PID:552
-
\??\c:\w90ot8.exec:\w90ot8.exe39⤵PID:2128
-
\??\c:\t5e0vcd.exec:\t5e0vcd.exe40⤵PID:1992
-
\??\c:\33e515.exec:\33e515.exe41⤵PID:1392
-
\??\c:\f735f.exec:\f735f.exe42⤵PID:2780
-
\??\c:\33oh5.exec:\33oh5.exe43⤵PID:4412
-
\??\c:\m47vr.exec:\m47vr.exe44⤵PID:3208
-
\??\c:\u593k1.exec:\u593k1.exe45⤵PID:628
-
\??\c:\mc3379.exec:\mc3379.exe46⤵PID:2280
-
\??\c:\awoogw.exec:\awoogw.exe47⤵PID:896
-
\??\c:\l5731.exec:\l5731.exe48⤵PID:1696
-
\??\c:\7uqg1g.exec:\7uqg1g.exe49⤵PID:2584
-
\??\c:\ko75335.exec:\ko75335.exe50⤵PID:2676
-
\??\c:\6mweic.exec:\6mweic.exe51⤵PID:4652
-
\??\c:\j77559.exec:\j77559.exe52⤵PID:4692
-
\??\c:\91qggw.exec:\91qggw.exe53⤵PID:4372
-
\??\c:\x8157.exec:\x8157.exe54⤵PID:3524
-
\??\c:\8cq1qb1.exec:\8cq1qb1.exe55⤵PID:2488
-
\??\c:\1317551.exec:\1317551.exe56⤵PID:4156
-
\??\c:\l5gwa.exec:\l5gwa.exe57⤵PID:1852
-
\??\c:\116eaa.exec:\116eaa.exe58⤵PID:2652
-
\??\c:\6m3at.exec:\6m3at.exe59⤵PID:5068
-
\??\c:\usl379.exec:\usl379.exe60⤵PID:4960
-
\??\c:\qun38af.exec:\qun38af.exe61⤵PID:3688
-
\??\c:\61ii31h.exec:\61ii31h.exe62⤵PID:4560
-
\??\c:\4f2931.exec:\4f2931.exe63⤵PID:4564
-
\??\c:\kg41vs.exec:\kg41vs.exe64⤵PID:2100
-
\??\c:\x34ek.exec:\x34ek.exe65⤵PID:4532
-
\??\c:\45773.exec:\45773.exe66⤵PID:1580
-
\??\c:\7nisv.exec:\7nisv.exe67⤵PID:3856
-
\??\c:\x55777.exec:\x55777.exe68⤵PID:368
-
\??\c:\foka80.exec:\foka80.exe69⤵PID:3756
-
\??\c:\i5d57.exec:\i5d57.exe70⤵PID:3432
-
\??\c:\9wi2w9.exec:\9wi2w9.exe71⤵PID:960
-
\??\c:\8ai74.exec:\8ai74.exe72⤵PID:1192
-
\??\c:\3r5n95.exec:\3r5n95.exe73⤵PID:3712
-
\??\c:\d79159.exec:\d79159.exe74⤵PID:3992
-
\??\c:\4mr9375.exec:\4mr9375.exe75⤵PID:1792
-
\??\c:\599k791.exec:\599k791.exe76⤵PID:3532
-
\??\c:\8f0ol.exec:\8f0ol.exe77⤵PID:5012
-
\??\c:\4b355.exec:\4b355.exe78⤵PID:2224
-
\??\c:\nm38d2.exec:\nm38d2.exe79⤵PID:1592
-
\??\c:\68iwmu.exec:\68iwmu.exe80⤵PID:3316
-
\??\c:\pf8o9pl.exec:\pf8o9pl.exe81⤵PID:484
-
\??\c:\1owwa.exec:\1owwa.exe82⤵PID:4940
-
\??\c:\33xqgu2.exec:\33xqgu2.exe83⤵PID:5100
-
\??\c:\2eaosi.exec:\2eaosi.exe84⤵PID:2900
-
\??\c:\7j9u370.exec:\7j9u370.exe85⤵PID:3656
-
\??\c:\5n9c253.exec:\5n9c253.exe86⤵PID:3016
-
\??\c:\uieqs28.exec:\uieqs28.exe87⤵PID:1148
-
\??\c:\h711597.exec:\h711597.exe88⤵PID:2584
-
\??\c:\x393v.exec:\x393v.exe89⤵PID:748
-
\??\c:\ikikk.exec:\ikikk.exe90⤵PID:2060
-
\??\c:\cuecag4.exec:\cuecag4.exe91⤵PID:4312
-
\??\c:\aceui3.exec:\aceui3.exe92⤵PID:3100
-
\??\c:\x9736n.exec:\x9736n.exe93⤵PID:800
-
\??\c:\usic2.exec:\usic2.exe94⤵PID:5000
-
\??\c:\mt94gs3.exec:\mt94gs3.exe95⤵PID:3044
-
\??\c:\8aime5.exec:\8aime5.exe96⤵PID:4440
-
\??\c:\3590irm.exec:\3590irm.exe97⤵PID:8
-
\??\c:\6e8m4r.exec:\6e8m4r.exe98⤵PID:4824
-
\??\c:\ctdb138.exec:\ctdb138.exe99⤵PID:804
-
\??\c:\jf19ea.exec:\jf19ea.exe100⤵PID:4972
-
\??\c:\6sm4u.exec:\6sm4u.exe101⤵PID:4236
-
\??\c:\w3230o.exec:\w3230o.exe102⤵PID:2708
-
\??\c:\iwnq511.exec:\iwnq511.exe103⤵PID:4532
-
\??\c:\5q7ep9s.exec:\5q7ep9s.exe104⤵PID:4780
-
\??\c:\quo0ix3.exec:\quo0ix3.exe105⤵PID:3740
-
\??\c:\55553.exec:\55553.exe106⤵PID:5052
-
\??\c:\3377x.exec:\3377x.exe107⤵PID:4868
-
\??\c:\2t93h.exec:\2t93h.exe108⤵PID:3148
-
\??\c:\039551.exec:\039551.exe109⤵PID:868
-
\??\c:\nhbtoa.exec:\nhbtoa.exe110⤵PID:4572
-
\??\c:\aaago.exec:\aaago.exe111⤵PID:5060
-
\??\c:\92l75.exec:\92l75.exe112⤵PID:4668
-
\??\c:\2399n5.exec:\2399n5.exe113⤵PID:3472
-
\??\c:\2i95599.exec:\2i95599.exe114⤵PID:3952
-
\??\c:\4ws78f.exec:\4ws78f.exe115⤵PID:2308
-
\??\c:\pmuqu.exec:\pmuqu.exe116⤵PID:4416
-
\??\c:\iew0v9.exec:\iew0v9.exe117⤵PID:4032
-
\??\c:\2skau4.exec:\2skau4.exe118⤵PID:1856
-
\??\c:\87833.exec:\87833.exe119⤵PID:1528
-
\??\c:\b3999.exec:\b3999.exe120⤵PID:3808
-
\??\c:\p951x.exec:\p951x.exe121⤵PID:3568
-
\??\c:\hi70ih7.exec:\hi70ih7.exe122⤵PID:896
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-