Analysis
-
max time kernel
112s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29-02-2024 07:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
HEUR-Trojan.Win32.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
HEUR-Trojan.Win32.exe
-
Size
97KB
-
MD5
af137148b99c151fe89203ad957221b6
-
SHA1
98038184cb81771b878b8b4a19eac482341dca5d
-
SHA256
17a19d14feaebd3df9b7f67f0bda0caac371147ffd2dd4862bec2ae7460068ff
-
SHA512
5129db855802485f5698500e6b8e3b503fd818c5d1081e201267649a7d1b2c173ee848675aed0b0f18a5b45a21ecf3f4c485ed02dad6de380b2fe85aa2ce1ec3
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo7xCkTsIRwnoh2UzSNuhH:ymb3NkkiQ3mdBjFo7LAIRUohT2Ng
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral2/memory/1056-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2316-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2396-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2104-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1784-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2696-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1304-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4748-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2212-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2872-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/664-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1044-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1008-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1496-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3316-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3316-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2316-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4820-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1216-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4680-266-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4460-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4392-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/420-320-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3532-323-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1720-331-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1668-337-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4708-358-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1852-364-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1184-369-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2556-379-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4172-401-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4300-414-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2316-417-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 54 IoCs
resource yara_rule behavioral2/memory/1056-2-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1056-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2316-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2396-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3596-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2364-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2364-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2104-42-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1784-50-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4988-57-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2696-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1304-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4748-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2212-91-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2872-98-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/664-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1044-112-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1008-121-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1496-127-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1496-132-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3972-135-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4652-148-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3316-154-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3316-155-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1608-170-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2316-218-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4020-226-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2364-235-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4820-256-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1216-261-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4680-266-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4460-275-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4392-288-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4856-292-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3736-301-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/420-315-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/420-320-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3532-323-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1720-331-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1668-337-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/492-341-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1876-351-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4708-356-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4708-358-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1852-364-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1184-369-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2556-377-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2556-379-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4264-387-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4172-401-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4300-409-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4300-414-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2316-417-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2768-424-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2316 wmgmk31.exe 2396 181nm.exe 3596 mguag.exe 2364 3152c.exe 2104 9j22n3s.exe 1784 9055975.exe 4988 2us77q.exe 1152 c2qs19.exe 2696 914okk.exe 1304 o72x2.exe 4748 9711311.exe 2212 7or313u.exe 2872 dg5mm33.exe 664 5499791.exe 1044 h331a.exe 1008 tjk19nm.exe 1496 v0q577.exe 3972 o3i9mw.exe 2492 2qkuqq.exe 4652 9433n3.exe 3316 d12as18.exe 976 5bjneho.exe 1608 i3gn8.exe 3036 xsr16g9.exe 3636 31578l5.exe 3180 c4cu34.exe 1972 b60js0s.exe 4508 775u8up.exe 440 4i4rho.exe 1432 04903.exe 2316 f899i3.exe 4020 du54l53.exe 4584 ieemk.exe 2364 9899818.exe 1880 8in6ef.exe 1596 c9wr3cu.exe 3120 f70o9.exe 652 46cqu72.exe 4820 13tci.exe 1216 t5575.exe 4680 qw5170.exe 1724 0m79973.exe 4460 4o1usw.exe 2780 nn5m5.exe 4828 au391.exe 4392 8q9cx.exe 4856 5137577.exe 4736 vp403.exe 3736 v93ul.exe 2984 3109mkm.exe 480 x9imr.exe 420 4gisiqk.exe 3532 pa7a53m.exe 1464 95731.exe 1720 pu9qeku.exe 1668 6gx8f.exe 492 fidgsmm.exe 3836 9u904i.exe 1876 nm0q9.exe 4708 n92lx.exe 1852 h9j3d.exe 1184 gwsiau.exe 4688 0n271va.exe 2556 57575sl.exe -
resource yara_rule behavioral2/memory/1056-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1056-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2316-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2396-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3596-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1784-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2696-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1304-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4748-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2212-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2872-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/664-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1044-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1008-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1496-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1496-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3316-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3316-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2316-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4820-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1216-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4680-266-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4460-275-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4392-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3736-301-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/420-315-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/420-320-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3532-323-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1720-331-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1668-337-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/492-341-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1876-351-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4708-356-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4708-358-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1852-364-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1184-369-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2556-377-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2556-379-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4264-387-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4172-401-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4300-409-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4300-414-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2316-417-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-424-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1056 wrote to memory of 2316 1056 HEUR-Trojan.Win32.exe 86 PID 1056 wrote to memory of 2316 1056 HEUR-Trojan.Win32.exe 86 PID 1056 wrote to memory of 2316 1056 HEUR-Trojan.Win32.exe 86 PID 2316 wrote to memory of 2396 2316 wmgmk31.exe 87 PID 2316 wrote to memory of 2396 2316 wmgmk31.exe 87 PID 2316 wrote to memory of 2396 2316 wmgmk31.exe 87 PID 2396 wrote to memory of 3596 2396 181nm.exe 88 PID 2396 wrote to memory of 3596 2396 181nm.exe 88 PID 2396 wrote to memory of 3596 2396 181nm.exe 88 PID 3596 wrote to memory of 2364 3596 mguag.exe 89 PID 3596 wrote to memory of 2364 3596 mguag.exe 89 PID 3596 wrote to memory of 2364 3596 mguag.exe 89 PID 2364 wrote to memory of 2104 2364 3152c.exe 90 PID 2364 wrote to memory of 2104 2364 3152c.exe 90 PID 2364 wrote to memory of 2104 2364 3152c.exe 90 PID 2104 wrote to memory of 1784 2104 9j22n3s.exe 91 PID 2104 wrote to memory of 1784 2104 9j22n3s.exe 91 PID 2104 wrote to memory of 1784 2104 9j22n3s.exe 91 PID 1784 wrote to memory of 4988 1784 9055975.exe 92 PID 1784 wrote to memory of 4988 1784 9055975.exe 92 PID 1784 wrote to memory of 4988 1784 9055975.exe 92 PID 4988 wrote to memory of 1152 4988 2us77q.exe 93 PID 4988 wrote to memory of 1152 4988 2us77q.exe 93 PID 4988 wrote to memory of 1152 4988 2us77q.exe 93 PID 1152 wrote to memory of 2696 1152 c2qs19.exe 94 PID 1152 wrote to memory of 2696 1152 c2qs19.exe 94 PID 1152 wrote to memory of 2696 1152 c2qs19.exe 94 PID 2696 wrote to memory of 1304 2696 914okk.exe 95 PID 2696 wrote to memory of 1304 2696 914okk.exe 95 PID 2696 wrote to memory of 1304 2696 914okk.exe 95 PID 1304 wrote to memory of 4748 1304 o72x2.exe 97 PID 1304 wrote to memory of 4748 1304 o72x2.exe 97 PID 1304 wrote to memory of 4748 1304 o72x2.exe 97 PID 4748 wrote to memory of 2212 4748 9711311.exe 98 PID 4748 wrote to memory of 2212 4748 9711311.exe 98 PID 4748 wrote to memory of 2212 4748 9711311.exe 98 PID 2212 wrote to memory of 2872 2212 7or313u.exe 99 PID 2212 wrote to memory of 2872 2212 7or313u.exe 99 PID 2212 wrote to memory of 2872 2212 7or313u.exe 99 PID 2872 wrote to memory of 664 2872 dg5mm33.exe 100 PID 2872 wrote to memory of 664 2872 dg5mm33.exe 100 PID 2872 wrote to memory of 664 2872 dg5mm33.exe 100 PID 664 wrote to memory of 1044 664 5499791.exe 102 PID 664 wrote to memory of 1044 664 5499791.exe 102 PID 664 wrote to memory of 1044 664 5499791.exe 102 PID 1044 wrote to memory of 1008 1044 h331a.exe 103 PID 1044 wrote to memory of 1008 1044 h331a.exe 103 PID 1044 wrote to memory of 1008 1044 h331a.exe 103 PID 1008 wrote to memory of 1496 1008 tjk19nm.exe 104 PID 1008 wrote to memory of 1496 1008 tjk19nm.exe 104 PID 1008 wrote to memory of 1496 1008 tjk19nm.exe 104 PID 1496 wrote to memory of 3972 1496 v0q577.exe 105 PID 1496 wrote to memory of 3972 1496 v0q577.exe 105 PID 1496 wrote to memory of 3972 1496 v0q577.exe 105 PID 3972 wrote to memory of 2492 3972 o3i9mw.exe 106 PID 3972 wrote to memory of 2492 3972 o3i9mw.exe 106 PID 3972 wrote to memory of 2492 3972 o3i9mw.exe 106 PID 2492 wrote to memory of 4652 2492 2qkuqq.exe 107 PID 2492 wrote to memory of 4652 2492 2qkuqq.exe 107 PID 2492 wrote to memory of 4652 2492 2qkuqq.exe 107 PID 4652 wrote to memory of 3316 4652 9433n3.exe 108 PID 4652 wrote to memory of 3316 4652 9433n3.exe 108 PID 4652 wrote to memory of 3316 4652 9433n3.exe 108 PID 3316 wrote to memory of 976 3316 d12as18.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.exe"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\wmgmk31.exec:\wmgmk31.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\181nm.exec:\181nm.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\mguag.exec:\mguag.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\3152c.exec:\3152c.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\9j22n3s.exec:\9j22n3s.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\9055975.exec:\9055975.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\2us77q.exec:\2us77q.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\c2qs19.exec:\c2qs19.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\914okk.exec:\914okk.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\o72x2.exec:\o72x2.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\9711311.exec:\9711311.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\7or313u.exec:\7or313u.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\dg5mm33.exec:\dg5mm33.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\5499791.exec:\5499791.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\h331a.exec:\h331a.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\tjk19nm.exec:\tjk19nm.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\v0q577.exec:\v0q577.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\o3i9mw.exec:\o3i9mw.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\2qkuqq.exec:\2qkuqq.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\9433n3.exec:\9433n3.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\d12as18.exec:\d12as18.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\5bjneho.exec:\5bjneho.exe23⤵
- Executes dropped EXE
PID:976 -
\??\c:\i3gn8.exec:\i3gn8.exe24⤵
- Executes dropped EXE
PID:1608 -
\??\c:\xsr16g9.exec:\xsr16g9.exe25⤵
- Executes dropped EXE
PID:3036 -
\??\c:\31578l5.exec:\31578l5.exe26⤵
- Executes dropped EXE
PID:3636 -
\??\c:\c4cu34.exec:\c4cu34.exe27⤵
- Executes dropped EXE
PID:3180 -
\??\c:\b60js0s.exec:\b60js0s.exe28⤵
- Executes dropped EXE
PID:1972 -
\??\c:\775u8up.exec:\775u8up.exe29⤵
- Executes dropped EXE
PID:4508 -
\??\c:\4i4rho.exec:\4i4rho.exe30⤵
- Executes dropped EXE
PID:440 -
\??\c:\04903.exec:\04903.exe31⤵
- Executes dropped EXE
PID:1432 -
\??\c:\f899i3.exec:\f899i3.exe32⤵
- Executes dropped EXE
PID:2316 -
\??\c:\du54l53.exec:\du54l53.exe33⤵
- Executes dropped EXE
PID:4020 -
\??\c:\ieemk.exec:\ieemk.exe34⤵
- Executes dropped EXE
PID:4584 -
\??\c:\9899818.exec:\9899818.exe35⤵
- Executes dropped EXE
PID:2364 -
\??\c:\8in6ef.exec:\8in6ef.exe36⤵
- Executes dropped EXE
PID:1880 -
\??\c:\c9wr3cu.exec:\c9wr3cu.exe37⤵
- Executes dropped EXE
PID:1596 -
\??\c:\f70o9.exec:\f70o9.exe38⤵
- Executes dropped EXE
PID:3120 -
\??\c:\46cqu72.exec:\46cqu72.exe39⤵
- Executes dropped EXE
PID:652 -
\??\c:\13tci.exec:\13tci.exe40⤵
- Executes dropped EXE
PID:4820 -
\??\c:\t5575.exec:\t5575.exe41⤵
- Executes dropped EXE
PID:1216 -
\??\c:\qw5170.exec:\qw5170.exe42⤵
- Executes dropped EXE
PID:4680 -
\??\c:\0m79973.exec:\0m79973.exe43⤵
- Executes dropped EXE
PID:1724 -
\??\c:\4o1usw.exec:\4o1usw.exe44⤵
- Executes dropped EXE
PID:4460 -
\??\c:\nn5m5.exec:\nn5m5.exe45⤵
- Executes dropped EXE
PID:2780 -
\??\c:\au391.exec:\au391.exe46⤵
- Executes dropped EXE
PID:4828 -
\??\c:\8q9cx.exec:\8q9cx.exe47⤵
- Executes dropped EXE
PID:4392 -
\??\c:\5137577.exec:\5137577.exe48⤵
- Executes dropped EXE
PID:4856 -
\??\c:\vp403.exec:\vp403.exe49⤵
- Executes dropped EXE
PID:4736 -
\??\c:\v93ul.exec:\v93ul.exe50⤵
- Executes dropped EXE
PID:3736 -
\??\c:\3109mkm.exec:\3109mkm.exe51⤵
- Executes dropped EXE
PID:2984 -
\??\c:\x9imr.exec:\x9imr.exe52⤵
- Executes dropped EXE
PID:480 -
\??\c:\4gisiqk.exec:\4gisiqk.exe53⤵
- Executes dropped EXE
PID:420 -
\??\c:\pa7a53m.exec:\pa7a53m.exe54⤵
- Executes dropped EXE
PID:3532 -
\??\c:\95731.exec:\95731.exe55⤵
- Executes dropped EXE
PID:1464 -
\??\c:\pu9qeku.exec:\pu9qeku.exe56⤵
- Executes dropped EXE
PID:1720 -
\??\c:\6gx8f.exec:\6gx8f.exe57⤵
- Executes dropped EXE
PID:1668 -
\??\c:\fidgsmm.exec:\fidgsmm.exe58⤵
- Executes dropped EXE
PID:492 -
\??\c:\9u904i.exec:\9u904i.exe59⤵
- Executes dropped EXE
PID:3836 -
\??\c:\nm0q9.exec:\nm0q9.exe60⤵
- Executes dropped EXE
PID:1876 -
\??\c:\n92lx.exec:\n92lx.exe61⤵
- Executes dropped EXE
PID:4708 -
\??\c:\h9j3d.exec:\h9j3d.exe62⤵
- Executes dropped EXE
PID:1852 -
\??\c:\gwsiau.exec:\gwsiau.exe63⤵
- Executes dropped EXE
PID:1184 -
\??\c:\0n271va.exec:\0n271va.exe64⤵
- Executes dropped EXE
PID:4688 -
\??\c:\57575sl.exec:\57575sl.exe65⤵
- Executes dropped EXE
PID:2556 -
\??\c:\05gl2.exec:\05gl2.exe66⤵PID:4384
-
\??\c:\a9k9ve.exec:\a9k9ve.exe67⤵PID:4264
-
\??\c:\6kl2m.exec:\6kl2m.exe68⤵PID:5048
-
\??\c:\p8rkb.exec:\p8rkb.exe69⤵PID:2148
-
\??\c:\8q51m.exec:\8q51m.exe70⤵PID:4172
-
\??\c:\n1ih5.exec:\n1ih5.exe71⤵PID:2292
-
\??\c:\ndcait.exec:\ndcait.exe72⤵PID:4300
-
\??\c:\49v549.exec:\49v549.exe73⤵PID:2316
-
\??\c:\7l53593.exec:\7l53593.exe74⤵PID:3716
-
\??\c:\79317.exec:\79317.exe75⤵PID:2768
-
\??\c:\6wr797s.exec:\6wr797s.exe76⤵PID:1488
-
\??\c:\0n32s.exec:\0n32s.exe77⤵PID:1300
-
\??\c:\l4g4iv.exec:\l4g4iv.exe78⤵PID:1784
-
\??\c:\mdkgu.exec:\mdkgu.exe79⤵PID:4984
-
\??\c:\txupsgg.exec:\txupsgg.exe80⤵PID:396
-
\??\c:\4hei12f.exec:\4hei12f.exe81⤵PID:1152
-
\??\c:\8p39u.exec:\8p39u.exe82⤵PID:5032
-
\??\c:\dw4o5.exec:\dw4o5.exe83⤵PID:2460
-
\??\c:\tasl7.exec:\tasl7.exe84⤵PID:1724
-
\??\c:\6cb915.exec:\6cb915.exe85⤵PID:3712
-
\??\c:\an3ah0.exec:\an3ah0.exe86⤵PID:428
-
\??\c:\4hx0196.exec:\4hx0196.exe87⤵PID:3620
-
\??\c:\on28p1.exec:\on28p1.exe88⤵PID:1312
-
\??\c:\ewb55e.exec:\ewb55e.exe89⤵PID:4376
-
\??\c:\2000x.exec:\2000x.exe90⤵PID:1044
-
\??\c:\ii7cih.exec:\ii7cih.exe91⤵PID:3736
-
\??\c:\6l8351.exec:\6l8351.exe92⤵PID:756
-
\??\c:\p676t45.exec:\p676t45.exe93⤵PID:628
-
\??\c:\93cuk.exec:\93cuk.exe94⤵PID:540
-
\??\c:\0k3951.exec:\0k3951.exe95⤵PID:556
-
\??\c:\49ge1j.exec:\49ge1j.exe96⤵PID:2564
-
\??\c:\si90f97.exec:\si90f97.exe97⤵PID:2492
-
\??\c:\591o9l.exec:\591o9l.exe98⤵PID:3244
-
\??\c:\r8qt1it.exec:\r8qt1it.exe99⤵PID:836
-
\??\c:\smauu.exec:\smauu.exe100⤵PID:2000
-
\??\c:\o73i9.exec:\o73i9.exe101⤵PID:2452
-
\??\c:\4t6p95.exec:\4t6p95.exe102⤵PID:1876
-
\??\c:\4at33.exec:\4at33.exe103⤵PID:1168
-
\??\c:\91kg3.exec:\91kg3.exe104⤵PID:1852
-
\??\c:\31e7sl.exec:\31e7sl.exe105⤵PID:392
-
\??\c:\0dm2dwx.exec:\0dm2dwx.exe106⤵PID:4008
-
\??\c:\rfja6.exec:\rfja6.exe107⤵PID:2312
-
\??\c:\717qg3m.exec:\717qg3m.exe108⤵PID:2360
-
\??\c:\t65pe.exec:\t65pe.exe109⤵PID:1544
-
\??\c:\4oh3ure.exec:\4oh3ure.exe110⤵PID:5048
-
\??\c:\4686v9l.exec:\4686v9l.exe111⤵PID:2148
-
\??\c:\7seimeg.exec:\7seimeg.exe112⤵PID:1468
-
\??\c:\8p5et85.exec:\8p5et85.exe113⤵PID:3776
-
\??\c:\q2l046.exec:\q2l046.exe114⤵PID:4980
-
\??\c:\20magu.exec:\20magu.exe115⤵PID:5088
-
\??\c:\7432p2.exec:\7432p2.exe116⤵PID:448
-
\??\c:\f120kg.exec:\f120kg.exe117⤵PID:2104
-
\??\c:\9cb7s2q.exec:\9cb7s2q.exe118⤵PID:2844
-
\??\c:\5na2882.exec:\5na2882.exe119⤵PID:2916
-
\??\c:\92qe1i.exec:\92qe1i.exe120⤵PID:2876
-
\??\c:\n4u539.exec:\n4u539.exe121⤵PID:652
-
\??\c:\a05a1.exec:\a05a1.exe122⤵PID:3044
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-