Analysis
-
max time kernel
89s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/02/2024, 07:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
HEUR-Trojan.Win32.exe
Resource
win7-20240221-en
6 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
HEUR-Trojan.Win32.exe
-
Size
333KB
-
MD5
e432e0f4d564f26b9d19f8c745a9b9cd
-
SHA1
b9ff8c54841c27957a4bba9a4117acfdac01b048
-
SHA256
6ea395cebcd05aea1e77113e85fa4d778794d3e684359919869055a01064791a
-
SHA512
89492816d88acc5b43ac1d1eb12bbd043defbd9d12cc8236878422fec31902984541f9e17cdf8b152632564d53ade6d1fa2a9968e2f8e20de03cd39f1b4a3130
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp99zm+/KZBHqnuOeHzmB600TUA6Z7zupc+BA:n3C9BRo7tvnJ99T/KZEuOod00TG+BA
Malware Config
Signatures
-
Detect Blackmoon payload 31 IoCs
resource yara_rule behavioral1/memory/2148-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1232-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1108-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1132-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1684-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2020-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1756-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/596-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1076-317-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2308-357-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-373-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-389-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-413-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-421-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-422-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-500-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2068-529-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-545-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1812-598-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-638-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-639-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 56 IoCs
resource yara_rule behavioral1/memory/2148-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1232-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2056-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2576-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2456-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2536-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2536-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2492-72-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2492-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2828-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2996-103-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2524-114-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1864-123-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2708-160-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2708-162-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1108-172-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2004-181-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2248-200-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1132-211-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1684-221-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2020-231-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2264-241-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1756-251-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/596-289-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1076-317-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2052-325-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2356-333-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2564-348-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2308-357-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2464-372-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2464-373-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2476-381-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2444-389-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1928-397-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2716-412-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2716-413-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2944-421-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2944-422-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2740-437-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2780-452-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1712-460-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/432-468-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2832-476-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2036-500-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2336-521-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2068-529-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2808-537-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/396-553-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/332-568-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1812-597-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1812-598-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1716-606-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1764-614-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1336-622-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2372-638-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2372-639-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1232 3po1ud.exe 2056 2bq3o00.exe 2576 li15ed.exe 2436 0s75s3.exe 2456 lnams14.exe 2536 72h4iv.exe 2492 olnp0vp.exe 2072 ker3d7.exe 2828 3b9q5q.exe 2996 0wd80.exe 2524 x9m90w.exe 1864 4g7k7.exe 2800 vwf5f96.exe 2000 tj5xm.exe 476 9b38u.exe 2708 70763.exe 1108 i6ro53.exe 2004 6e530nd.exe 1760 cq66l.exe 2248 l0g84.exe 1132 egk91.exe 1684 4unae5.exe 2020 nhms5.exe 2264 5pnm768.exe 1756 dcoe52s.exe 1808 vmue9sa.exe 1816 gvewe7.exe 1708 o2j25ef.exe 596 5c7av.exe 1940 n9174.exe 2920 86i5c.exe 1076 kwsj6.exe 2052 29kj6x5.exe 2356 5pxre.exe 1956 4hxe4k4.exe 2564 47bw4.exe 2308 bmr595f.exe 1664 xjcp1u1.exe 2464 f01p98.exe 2476 wtq17mg.exe 2444 wuaoq8t.exe 1928 9h3949t.exe 1944 lukscm8.exe 2716 f2xw8j2.exe 2944 61fma.exe 3024 241h852.exe 2740 2c97kk.exe 2744 75w8t85.exe 2780 xem65c.exe 1712 938rs.exe 432 mg441r.exe 2832 b17d0xj.exe 1500 t4lb1.exe 488 w9lift8.exe 2036 72182.exe 2252 495j53.exe 2136 23914a.exe 2336 no113.exe 2068 5hp3sb.exe 2808 1v5651.exe 1464 937k8s5.exe 396 40qg9c9.exe 1548 12pfk1c.exe 332 6116v.exe -
resource yara_rule behavioral1/memory/2148-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1232-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1864-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1108-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2004-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2248-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1132-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1684-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1756-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1808-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/596-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1076-317-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-325-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-333-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-348-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2308-357-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-372-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-373-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-381-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-389-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1928-397-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-412-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-413-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-421-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-422-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-437-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-452-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1712-460-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/432-468-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-476-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-500-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-521-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-529-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-537-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/396-553-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/332-568-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1812-597-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1812-598-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-606-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1764-614-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1336-622-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-630-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-638-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-639-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2148 wrote to memory of 1232 2148 HEUR-Trojan.Win32.exe 28 PID 2148 wrote to memory of 1232 2148 HEUR-Trojan.Win32.exe 28 PID 2148 wrote to memory of 1232 2148 HEUR-Trojan.Win32.exe 28 PID 2148 wrote to memory of 1232 2148 HEUR-Trojan.Win32.exe 28 PID 1232 wrote to memory of 2056 1232 3po1ud.exe 29 PID 1232 wrote to memory of 2056 1232 3po1ud.exe 29 PID 1232 wrote to memory of 2056 1232 3po1ud.exe 29 PID 1232 wrote to memory of 2056 1232 3po1ud.exe 29 PID 2056 wrote to memory of 2576 2056 2bq3o00.exe 30 PID 2056 wrote to memory of 2576 2056 2bq3o00.exe 30 PID 2056 wrote to memory of 2576 2056 2bq3o00.exe 30 PID 2056 wrote to memory of 2576 2056 2bq3o00.exe 30 PID 2576 wrote to memory of 2436 2576 li15ed.exe 31 PID 2576 wrote to memory of 2436 2576 li15ed.exe 31 PID 2576 wrote to memory of 2436 2576 li15ed.exe 31 PID 2576 wrote to memory of 2436 2576 li15ed.exe 31 PID 2436 wrote to memory of 2456 2436 0s75s3.exe 32 PID 2436 wrote to memory of 2456 2436 0s75s3.exe 32 PID 2436 wrote to memory of 2456 2436 0s75s3.exe 32 PID 2436 wrote to memory of 2456 2436 0s75s3.exe 32 PID 2456 wrote to memory of 2536 2456 lnams14.exe 33 PID 2456 wrote to memory of 2536 2456 lnams14.exe 33 PID 2456 wrote to memory of 2536 2456 lnams14.exe 33 PID 2456 wrote to memory of 2536 2456 lnams14.exe 33 PID 2536 wrote to memory of 2492 2536 72h4iv.exe 34 PID 2536 wrote to memory of 2492 2536 72h4iv.exe 34 PID 2536 wrote to memory of 2492 2536 72h4iv.exe 34 PID 2536 wrote to memory of 2492 2536 72h4iv.exe 34 PID 2492 wrote to memory of 2072 2492 olnp0vp.exe 35 PID 2492 wrote to memory of 2072 2492 olnp0vp.exe 35 PID 2492 wrote to memory of 2072 2492 olnp0vp.exe 35 PID 2492 wrote to memory of 2072 2492 olnp0vp.exe 35 PID 2072 wrote to memory of 2828 2072 ker3d7.exe 36 PID 2072 wrote to memory of 2828 2072 ker3d7.exe 36 PID 2072 wrote to memory of 2828 2072 ker3d7.exe 36 PID 2072 wrote to memory of 2828 2072 ker3d7.exe 36 PID 2828 wrote to memory of 2996 2828 3b9q5q.exe 37 PID 2828 wrote to memory of 2996 2828 3b9q5q.exe 37 PID 2828 wrote to memory of 2996 2828 3b9q5q.exe 37 PID 2828 wrote to memory of 2996 2828 3b9q5q.exe 37 PID 2996 wrote to memory of 2524 2996 0wd80.exe 38 PID 2996 wrote to memory of 2524 2996 0wd80.exe 38 PID 2996 wrote to memory of 2524 2996 0wd80.exe 38 PID 2996 wrote to memory of 2524 2996 0wd80.exe 38 PID 2524 wrote to memory of 1864 2524 x9m90w.exe 39 PID 2524 wrote to memory of 1864 2524 x9m90w.exe 39 PID 2524 wrote to memory of 1864 2524 x9m90w.exe 39 PID 2524 wrote to memory of 1864 2524 x9m90w.exe 39 PID 1864 wrote to memory of 2800 1864 4g7k7.exe 40 PID 1864 wrote to memory of 2800 1864 4g7k7.exe 40 PID 1864 wrote to memory of 2800 1864 4g7k7.exe 40 PID 1864 wrote to memory of 2800 1864 4g7k7.exe 40 PID 2800 wrote to memory of 2000 2800 vwf5f96.exe 41 PID 2800 wrote to memory of 2000 2800 vwf5f96.exe 41 PID 2800 wrote to memory of 2000 2800 vwf5f96.exe 41 PID 2800 wrote to memory of 2000 2800 vwf5f96.exe 41 PID 2000 wrote to memory of 476 2000 tj5xm.exe 42 PID 2000 wrote to memory of 476 2000 tj5xm.exe 42 PID 2000 wrote to memory of 476 2000 tj5xm.exe 42 PID 2000 wrote to memory of 476 2000 tj5xm.exe 42 PID 476 wrote to memory of 2708 476 9b38u.exe 43 PID 476 wrote to memory of 2708 476 9b38u.exe 43 PID 476 wrote to memory of 2708 476 9b38u.exe 43 PID 476 wrote to memory of 2708 476 9b38u.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.exe"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\3po1ud.exec:\3po1ud.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\2bq3o00.exec:\2bq3o00.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\li15ed.exec:\li15ed.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\0s75s3.exec:\0s75s3.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\lnams14.exec:\lnams14.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\72h4iv.exec:\72h4iv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\olnp0vp.exec:\olnp0vp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\ker3d7.exec:\ker3d7.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\3b9q5q.exec:\3b9q5q.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\0wd80.exec:\0wd80.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\x9m90w.exec:\x9m90w.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\4g7k7.exec:\4g7k7.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\vwf5f96.exec:\vwf5f96.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\tj5xm.exec:\tj5xm.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\9b38u.exec:\9b38u.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:476 -
\??\c:\70763.exec:\70763.exe17⤵
- Executes dropped EXE
PID:2708 -
\??\c:\i6ro53.exec:\i6ro53.exe18⤵
- Executes dropped EXE
PID:1108 -
\??\c:\6e530nd.exec:\6e530nd.exe19⤵
- Executes dropped EXE
PID:2004 -
\??\c:\cq66l.exec:\cq66l.exe20⤵
- Executes dropped EXE
PID:1760 -
\??\c:\l0g84.exec:\l0g84.exe21⤵
- Executes dropped EXE
PID:2248 -
\??\c:\egk91.exec:\egk91.exe22⤵
- Executes dropped EXE
PID:1132 -
\??\c:\4unae5.exec:\4unae5.exe23⤵
- Executes dropped EXE
PID:1684 -
\??\c:\nhms5.exec:\nhms5.exe24⤵
- Executes dropped EXE
PID:2020 -
\??\c:\5pnm768.exec:\5pnm768.exe25⤵
- Executes dropped EXE
PID:2264 -
\??\c:\dcoe52s.exec:\dcoe52s.exe26⤵
- Executes dropped EXE
PID:1756 -
\??\c:\vmue9sa.exec:\vmue9sa.exe27⤵
- Executes dropped EXE
PID:1808 -
\??\c:\gvewe7.exec:\gvewe7.exe28⤵
- Executes dropped EXE
PID:1816 -
\??\c:\o2j25ef.exec:\o2j25ef.exe29⤵
- Executes dropped EXE
PID:1708 -
\??\c:\5c7av.exec:\5c7av.exe30⤵
- Executes dropped EXE
PID:596 -
\??\c:\n9174.exec:\n9174.exe31⤵
- Executes dropped EXE
PID:1940 -
\??\c:\86i5c.exec:\86i5c.exe32⤵
- Executes dropped EXE
PID:2920 -
\??\c:\kwsj6.exec:\kwsj6.exe33⤵
- Executes dropped EXE
PID:1076 -
\??\c:\29kj6x5.exec:\29kj6x5.exe34⤵
- Executes dropped EXE
PID:2052 -
\??\c:\5pxre.exec:\5pxre.exe35⤵
- Executes dropped EXE
PID:2356 -
\??\c:\4hxe4k4.exec:\4hxe4k4.exe36⤵
- Executes dropped EXE
PID:1956 -
\??\c:\47bw4.exec:\47bw4.exe37⤵
- Executes dropped EXE
PID:2564 -
\??\c:\bmr595f.exec:\bmr595f.exe38⤵
- Executes dropped EXE
PID:2308 -
\??\c:\xjcp1u1.exec:\xjcp1u1.exe39⤵
- Executes dropped EXE
PID:1664 -
\??\c:\f01p98.exec:\f01p98.exe40⤵
- Executes dropped EXE
PID:2464 -
\??\c:\wtq17mg.exec:\wtq17mg.exe41⤵
- Executes dropped EXE
PID:2476 -
\??\c:\wuaoq8t.exec:\wuaoq8t.exe42⤵
- Executes dropped EXE
PID:2444 -
\??\c:\9h3949t.exec:\9h3949t.exe43⤵
- Executes dropped EXE
PID:1928 -
\??\c:\lukscm8.exec:\lukscm8.exe44⤵
- Executes dropped EXE
PID:1944 -
\??\c:\f2xw8j2.exec:\f2xw8j2.exe45⤵
- Executes dropped EXE
PID:2716 -
\??\c:\61fma.exec:\61fma.exe46⤵
- Executes dropped EXE
PID:2944 -
\??\c:\241h852.exec:\241h852.exe47⤵
- Executes dropped EXE
PID:3024 -
\??\c:\2c97kk.exec:\2c97kk.exe48⤵
- Executes dropped EXE
PID:2740 -
\??\c:\75w8t85.exec:\75w8t85.exe49⤵
- Executes dropped EXE
PID:2744 -
\??\c:\xem65c.exec:\xem65c.exe50⤵
- Executes dropped EXE
PID:2780 -
\??\c:\938rs.exec:\938rs.exe51⤵
- Executes dropped EXE
PID:1712 -
\??\c:\mg441r.exec:\mg441r.exe52⤵
- Executes dropped EXE
PID:432 -
\??\c:\b17d0xj.exec:\b17d0xj.exe53⤵
- Executes dropped EXE
PID:2832 -
\??\c:\t4lb1.exec:\t4lb1.exe54⤵
- Executes dropped EXE
PID:1500 -
\??\c:\w9lift8.exec:\w9lift8.exe55⤵
- Executes dropped EXE
PID:488 -
\??\c:\72182.exec:\72182.exe56⤵
- Executes dropped EXE
PID:2036 -
\??\c:\495j53.exec:\495j53.exe57⤵
- Executes dropped EXE
PID:2252 -
\??\c:\23914a.exec:\23914a.exe58⤵
- Executes dropped EXE
PID:2136 -
\??\c:\no113.exec:\no113.exe59⤵
- Executes dropped EXE
PID:2336 -
\??\c:\5hp3sb.exec:\5hp3sb.exe60⤵
- Executes dropped EXE
PID:2068 -
\??\c:\1v5651.exec:\1v5651.exe61⤵
- Executes dropped EXE
PID:2808 -
\??\c:\937k8s5.exec:\937k8s5.exe62⤵
- Executes dropped EXE
PID:1464 -
\??\c:\40qg9c9.exec:\40qg9c9.exe63⤵
- Executes dropped EXE
PID:396 -
\??\c:\12pfk1c.exec:\12pfk1c.exe64⤵
- Executes dropped EXE
PID:1548 -
\??\c:\6116v.exec:\6116v.exe65⤵
- Executes dropped EXE
PID:332 -
\??\c:\2115ft.exec:\2115ft.exe66⤵PID:2900
-
\??\c:\f32g9d.exec:\f32g9d.exe67⤵PID:2380
-
\??\c:\0n8agk2.exec:\0n8agk2.exe68⤵PID:1416
-
\??\c:\071731.exec:\071731.exe69⤵PID:1812
-
\??\c:\49e719m.exec:\49e719m.exe70⤵PID:1716
-
\??\c:\w282ow.exec:\w282ow.exe71⤵PID:1764
-
\??\c:\38nqp.exec:\38nqp.exe72⤵PID:1336
-
\??\c:\0q840.exec:\0q840.exe73⤵PID:2044
-
\??\c:\051347t.exec:\051347t.exe74⤵PID:2372
-
\??\c:\200a82h.exec:\200a82h.exe75⤵PID:1604
-
\??\c:\m16o9.exec:\m16o9.exe76⤵PID:2052
-
\??\c:\215n57d.exec:\215n57d.exe77⤵PID:2356
-
\??\c:\05377m1.exec:\05377m1.exe78⤵PID:2640
-
\??\c:\vggmcs.exec:\vggmcs.exe79⤵PID:2876
-
\??\c:\6cg6trb.exec:\6cg6trb.exe80⤵PID:2872
-
\??\c:\15igo.exec:\15igo.exe81⤵PID:2304
-
\??\c:\7osgf6o.exec:\7osgf6o.exe82⤵PID:2428
-
\??\c:\v4457hj.exec:\v4457hj.exe83⤵PID:2448
-
\??\c:\ij8krw2.exec:\ij8krw2.exe84⤵PID:2976
-
\??\c:\0cui5c9.exec:\0cui5c9.exe85⤵PID:2412
-
\??\c:\is177.exec:\is177.exe86⤵PID:744
-
\??\c:\s40p4.exec:\s40p4.exe87⤵PID:2964
-
\??\c:\3skh2q5.exec:\3skh2q5.exe88⤵PID:3008
-
\??\c:\p3u9i.exec:\p3u9i.exe89⤵PID:2092
-
\??\c:\ngr8qs.exec:\ngr8qs.exe90⤵PID:1920
-
\??\c:\a1ms5m1.exec:\a1ms5m1.exe91⤵PID:2604
-
\??\c:\69395.exec:\69395.exe92⤵PID:2772
-
\??\c:\lu2awh.exec:\lu2awh.exe93⤵PID:2180
-
\??\c:\b115s.exec:\b115s.exe94⤵PID:2700
-
\??\c:\fa905.exec:\fa905.exe95⤵PID:1328
-
\??\c:\qmlh5.exec:\qmlh5.exe96⤵PID:2768
-
\??\c:\9s5tj0k.exec:\9s5tj0k.exe97⤵PID:1624
-
\??\c:\c2pm3.exec:\c2pm3.exe98⤵PID:1876
-
\??\c:\q34p49.exec:\q34p49.exe99⤵PID:1888
-
\??\c:\66v011.exec:\66v011.exe100⤵PID:1744
-
\??\c:\9r2xh.exec:\9r2xh.exe101⤵PID:2248
-
\??\c:\014m12.exec:\014m12.exe102⤵PID:1892
-
\??\c:\d7959.exec:\d7959.exe103⤵PID:1804
-
\??\c:\23icqoc.exec:\23icqoc.exe104⤵PID:2332
-
\??\c:\voos155.exec:\voos155.exe105⤵PID:2276
-
\??\c:\xswck9.exec:\xswck9.exe106⤵PID:2264
-
\??\c:\h3pdl5.exec:\h3pdl5.exe107⤵PID:832
-
\??\c:\nl9o5w.exec:\nl9o5w.exe108⤵PID:1632
-
\??\c:\4iem5s.exec:\4iem5s.exe109⤵PID:760
-
\??\c:\5kf9n1.exec:\5kf9n1.exe110⤵PID:1356
-
\??\c:\317q1.exec:\317q1.exe111⤵PID:564
-
\??\c:\22577.exec:\22577.exe112⤵PID:3040
-
\??\c:\7b64v.exec:\7b64v.exe113⤵PID:596
-
\??\c:\70t4da.exec:\70t4da.exe114⤵PID:1940
-
\??\c:\dphxk.exec:\dphxk.exe115⤵PID:976
-
\??\c:\659o3k.exec:\659o3k.exe116⤵PID:2236
-
\??\c:\v951w.exec:\v951w.exe117⤵PID:1872
-
\??\c:\06l70b2.exec:\06l70b2.exe118⤵PID:1604
-
\??\c:\0vxi68.exec:\0vxi68.exe119⤵PID:2148
-
\??\c:\7l9a7.exec:\7l9a7.exe120⤵PID:2356
-
\??\c:\0m5q59.exec:\0m5q59.exe121⤵PID:2548
-
\??\c:\1cv5ac.exec:\1cv5ac.exe122⤵PID:2516
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-