da8e6103e836aee7b8d59d08f95c6507a16477664137c520ff928715d5f4a04c

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27-01-2024 07:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79afbe3577e6a76a0c7357e1f2ac467e.exe
Size

24KB
MD5

79afbe3577e6a76a0c7357e1f2ac467e
SHA1

fa2da1d323e19ce0816e87148e43aa248931cb01
SHA256

da8e6103e836aee7b8d59d08f95c6507a16477664137c520ff928715d5f4a04c
SHA512

329ece39b28dc524958a863259f8f4e041b2e3f4cebfad7b18f060fe2360098b6db9a1e5105ca3a7f312f6f348d8d28e6469acc8fba5c13fa4d848cf446caed4
SSDEEP

192:HKrWAstBvJnEdCGeNdvsSJ0dRSrQXF8IWFmZBdZDqeFgIVBw+yny9viQhEyyYeBI:fBB8MbdRNmlIeNRMyyRBL+rhdo

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 1388	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	28
PID 2956 wrote to memory of 1388	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	28
PID 2956 wrote to memory of 1388	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	28
PID 2956 wrote to memory of 1388	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	28
PID 2956 wrote to memory of 2240	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	30
PID 2956 wrote to memory of 2240	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	30
PID 2956 wrote to memory of 2240	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	30
PID 2956 wrote to memory of 2240	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	30
PID 2956 wrote to memory of 2316	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	32
PID 2956 wrote to memory of 2316	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	32
PID 2956 wrote to memory of 2316	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	32
PID 2956 wrote to memory of 2316	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	32
PID 2956 wrote to memory of 2616	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	34
PID 2956 wrote to memory of 2616	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	34
PID 2956 wrote to memory of 2616	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	34
PID 2956 wrote to memory of 2616	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	34
PID 2956 wrote to memory of 2684	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	36
PID 2956 wrote to memory of 2684	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	36
PID 2956 wrote to memory of 2684	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	36
PID 2956 wrote to memory of 2684	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	36
PID 2956 wrote to memory of 2696	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	38
PID 2956 wrote to memory of 2696	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	38
PID 2956 wrote to memory of 2696	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	38
PID 2956 wrote to memory of 2696	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	38
PID 2956 wrote to memory of 2624	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	40
PID 2956 wrote to memory of 2624	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	40
PID 2956 wrote to memory of 2624	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	40
PID 2956 wrote to memory of 2624	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	40
PID 2956 wrote to memory of 2716	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	42
PID 2956 wrote to memory of 2716	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	42
PID 2956 wrote to memory of 2716	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	42
PID 2956 wrote to memory of 2716	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	42
PID 2956 wrote to memory of 2640	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	44
PID 2956 wrote to memory of 2640	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	44
PID 2956 wrote to memory of 2640	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	44
PID 2956 wrote to memory of 2640	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	44
PID 2956 wrote to memory of 2816	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	46
PID 2956 wrote to memory of 2816	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	46
PID 2956 wrote to memory of 2816	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	46
PID 2956 wrote to memory of 2816	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	46
PID 2956 wrote to memory of 2608	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	48
PID 2956 wrote to memory of 2608	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	48
PID 2956 wrote to memory of 2608	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	48
PID 2956 wrote to memory of 2608	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	48
PID 2956 wrote to memory of 2524	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	50
PID 2956 wrote to memory of 2524	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	50
PID 2956 wrote to memory of 2524	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	50
PID 2956 wrote to memory of 2524	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	50
PID 2956 wrote to memory of 2480	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	52
PID 2956 wrote to memory of 2480	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	52
PID 2956 wrote to memory of 2480	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	52
PID 2956 wrote to memory of 2480	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	52
PID 2956 wrote to memory of 2544	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	54
PID 2956 wrote to memory of 2544	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	54
PID 2956 wrote to memory of 2544	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	54
PID 2956 wrote to memory of 2544	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	54
PID 2956 wrote to memory of 2784	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	56
PID 2956 wrote to memory of 2784	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	56
PID 2956 wrote to memory of 2784	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	56
PID 2956 wrote to memory of 2784	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	56
PID 2956 wrote to memory of 1720	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	58
PID 2956 wrote to memory of 1720	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	58
PID 2956 wrote to memory of 1720	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	58
PID 2956 wrote to memory of 1720	2956	79afbe3577e6a76a0c7357e1f2ac467e.exe	58

C:\Users\Admin\AppData\Local\Temp\79afbe3577e6a76a0c7357e1f2ac467e.exe
"C:\Users\Admin\AppData\Local\Temp\79afbe3577e6a76a0c7357e1f2ac467e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1388
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2240
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2316
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2616
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2684
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2696
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2624
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2716
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2640
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2816
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2608
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2524
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2480
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2544
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2784
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1720
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2976
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1612
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2864
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2960
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1608
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1284
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1664
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2772
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2732
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2936
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2856
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1552
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1556
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1460
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2364
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2320
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2024
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2900
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2808
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2908
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:588
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2912
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1340
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:576
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:860
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2096
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1444
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1696
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1324
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2052
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1904
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1588
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1644
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2996
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1224
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1076
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2888
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2224
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2340
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2948
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2112
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1108
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:888
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2080
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1632
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:840
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:3036
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2344
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2628
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2692
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2632
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2148
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2588
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2664
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1972
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1840
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2652
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2468
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2528
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:960
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2964
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2308
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2016
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2820
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2508
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:768
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1748
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1744
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1288
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2392
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1832
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1856
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2832
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:776
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1572
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1476
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1196
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2364
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1704
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2024
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:784
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2892
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1340
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:240
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:112
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2096
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:904
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1696
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:792
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2188
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1904
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2000
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1644
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1668
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1184
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1076
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2928
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2224
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:952
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2948
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2112
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1784
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:888
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2252
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1724
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:840
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:3036
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1876
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2628
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2700
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2632
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2148
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2744
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2664
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2660
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2708
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1780
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2584
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2592
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2972
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2104
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2980
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2068
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1652
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2776
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1752
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1320
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2520
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2772
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2572
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2936
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2856
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1552
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1548
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1460
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2300
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2180
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1456
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2844
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:780
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1496
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1900
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1056
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1592
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1988
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1792
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2176
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1212
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1820
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1156
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1452
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2280
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:912
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:3032
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2236
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1776
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:624
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2712
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:380
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1128
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2084
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1624
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1636
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2448
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2036
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1632
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1908
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2684
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2696
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2476
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2880
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2780
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2196
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:3004
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2388
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1840
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2272
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1124
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2652
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2756
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2544
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2768
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1720
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1760
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2788
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2864
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2828
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2960
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1880
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1664
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1984
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2812
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2824
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2840
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2984
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1540
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1992
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2040
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2568
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1312
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2320
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1960
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:708
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:572
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1500
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:852
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2620
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1160
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:856
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1696
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2064
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2164
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1904
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1164
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1644
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2996
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:3032
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2236
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1176
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:624
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2340
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2192
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2920
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1188
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2872
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2352
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1388
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2436
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2356
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2616
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2688
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2884
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2896
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:3052
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2640
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2168
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1916
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1480
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2748
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1964
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2644
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:640
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1504
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2492
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:960
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2968
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1760
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1740
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2864
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1836
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2960
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1880
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1736
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1984
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2384
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2824
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2840
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2728
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1540
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1868
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2040
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2568
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2116
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2320
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1068
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:708
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2900
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1500
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:852
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:712
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1160
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2372
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:984
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:1696
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2064
- C:\Windows\SysWOW64\Route.exe
  Route.exe
  2⤵
  PID:2188

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads