Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/04/2024, 21:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
539162b8cb67fedd37b9a100ee4726f29e247b4508e38c7f15ecb0cf97854994.exe
Resource
win7-20240221-en
6 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
539162b8cb67fedd37b9a100ee4726f29e247b4508e38c7f15ecb0cf97854994.exe
-
Size
88KB
-
MD5
6cfc779b04fce1fdd01d26f556ce007b
-
SHA1
42cf6538f8ba94392183890f98041d23674c3caa
-
SHA256
539162b8cb67fedd37b9a100ee4726f29e247b4508e38c7f15ecb0cf97854994
-
SHA512
382ec0b9cf8623a806e54e5008d610d7dd7b87182783ac7674e62a0b5a281531b15c11f148959c50af14f4044ec799469abc2be522c937cfb59ed027fa1a98d4
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDISoFGDvPGB1haZJK:ymb3NkkiQ3mdBjFIk7+czK
Malware Config
Signatures
-
Detect Blackmoon payload 30 IoCs
resource yara_rule behavioral1/memory/2240-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2288-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2452-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2364-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/824-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1940-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1388-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1312-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1956-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1704-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1704-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1084-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-344-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-368-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-376-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-377-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-386-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2280-403-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-442-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2260-497-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1084-576-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 60 IoCs
resource yara_rule behavioral1/memory/2240-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2288-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2640-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2536-41-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2536-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2544-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2452-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2452-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2428-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2364-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/824-95-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2768-104-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1940-116-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2176-124-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2176-125-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1048-152-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2412-164-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1388-174-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1312-183-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1956-202-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1704-212-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1704-213-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2316-241-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1664-251-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1084-261-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/600-280-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2108-309-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2228-319-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2240-328-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3020-336-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2636-344-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2584-352-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2804-367-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2804-368-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2652-376-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2652-377-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2424-385-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2424-386-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2880-394-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2280-402-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2280-403-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2784-418-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2140-433-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2036-441-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2036-442-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/796-450-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1156-458-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1532-466-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1048-474-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2260-496-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2260-497-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2964-512-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2096-527-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/296-535-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2144-543-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/328-551-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1324-559-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1664-567-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1084-576-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1504-583-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2012 45u3a.exe 2288 fq64jcb.exe 2640 5h9emf6.exe 2536 w8ki1.exe 2544 c8hr4.exe 2452 d33c3e5.exe 2428 jxw0jl2.exe 2364 62wh5x.exe 824 79q5e.exe 2768 hu3b2.exe 1940 85v479h.exe 2176 5g76q.exe 1628 4678u.exe 1624 1w7ajo.exe 1048 p3ub9s1.exe 2412 487sp8.exe 1388 492c1.exe 1312 fj4c8.exe 1136 8993ax5.exe 1956 5qfhs.exe 1704 4040x5h.exe 2908 454e9.exe 1700 9p166v.exe 2316 ri1vr1a.exe 1664 s2ac18.exe 1084 6au627.exe 2160 ps0mc3s.exe 600 3c9q9g.exe 2224 l916sq.exe 1188 1h9u6.exe 2108 xp1cq5h.exe 2228 wg4084.exe 2240 1ip79.exe 3020 fc6c5.exe 2636 esw4x.exe 2584 v7848v.exe 2432 7qowq.exe 2804 2nq80.exe 2652 g2iapi.exe 2424 506jh6.exe 2880 63igo.exe 2280 59b6r3.exe 2488 e87184.exe 2784 1an9175.exe 1716 uat50c6.exe 2140 32k277q.exe 2036 7cx78f6.exe 796 1u8968.exe 1156 imo1so.exe 1532 hck93.exe 1048 5xihbf.exe 2412 fo3lmr.exe 1096 uqra5.exe 2260 dl0sr2.exe 2812 micw10.exe 2964 3g30m.exe 2272 43sd50.exe 2096 613315.exe 296 eiikw.exe 2144 t61u7g7.exe 328 21ck11.exe 1324 54l690r.exe 1664 j6acb.exe 1084 31pk0q.exe -
resource yara_rule behavioral1/memory/2240-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2364-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/824-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1940-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1048-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1388-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1312-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1704-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1704-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1084-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/600-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-309-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-319-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-328-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-336-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-344-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-352-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-367-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-368-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-376-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-377-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-385-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-386-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-394-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-402-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-403-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-418-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-433-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-441-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-442-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/796-450-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1156-458-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1532-466-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1048-474-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2260-496-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2260-497-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-512-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-527-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/296-535-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2144-543-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/328-551-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1324-559-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-567-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1084-576-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1504-583-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2012 2240 539162b8cb67fedd37b9a100ee4726f29e247b4508e38c7f15ecb0cf97854994.exe 28 PID 2240 wrote to memory of 2012 2240 539162b8cb67fedd37b9a100ee4726f29e247b4508e38c7f15ecb0cf97854994.exe 28 PID 2240 wrote to memory of 2012 2240 539162b8cb67fedd37b9a100ee4726f29e247b4508e38c7f15ecb0cf97854994.exe 28 PID 2240 wrote to memory of 2012 2240 539162b8cb67fedd37b9a100ee4726f29e247b4508e38c7f15ecb0cf97854994.exe 28 PID 2012 wrote to memory of 2288 2012 45u3a.exe 29 PID 2012 wrote to memory of 2288 2012 45u3a.exe 29 PID 2012 wrote to memory of 2288 2012 45u3a.exe 29 PID 2012 wrote to memory of 2288 2012 45u3a.exe 29 PID 2288 wrote to memory of 2640 2288 fq64jcb.exe 30 PID 2288 wrote to memory of 2640 2288 fq64jcb.exe 30 PID 2288 wrote to memory of 2640 2288 fq64jcb.exe 30 PID 2288 wrote to memory of 2640 2288 fq64jcb.exe 30 PID 2640 wrote to memory of 2536 2640 5h9emf6.exe 31 PID 2640 wrote to memory of 2536 2640 5h9emf6.exe 31 PID 2640 wrote to memory of 2536 2640 5h9emf6.exe 31 PID 2640 wrote to memory of 2536 2640 5h9emf6.exe 31 PID 2536 wrote to memory of 2544 2536 w8ki1.exe 32 PID 2536 wrote to memory of 2544 2536 w8ki1.exe 32 PID 2536 wrote to memory of 2544 2536 w8ki1.exe 32 PID 2536 wrote to memory of 2544 2536 w8ki1.exe 32 PID 2544 wrote to memory of 2452 2544 c8hr4.exe 33 PID 2544 wrote to memory of 2452 2544 c8hr4.exe 33 PID 2544 wrote to memory of 2452 2544 c8hr4.exe 33 PID 2544 wrote to memory of 2452 2544 c8hr4.exe 33 PID 2452 wrote to memory of 2428 2452 d33c3e5.exe 34 PID 2452 wrote to memory of 2428 2452 d33c3e5.exe 34 PID 2452 wrote to memory of 2428 2452 d33c3e5.exe 34 PID 2452 wrote to memory of 2428 2452 d33c3e5.exe 34 PID 2428 wrote to memory of 2364 2428 jxw0jl2.exe 35 PID 2428 wrote to memory of 2364 2428 jxw0jl2.exe 35 PID 2428 wrote to memory of 2364 2428 jxw0jl2.exe 35 PID 2428 wrote to memory of 2364 2428 jxw0jl2.exe 35 PID 2364 wrote to memory of 824 2364 62wh5x.exe 36 PID 2364 wrote to memory of 824 2364 62wh5x.exe 36 PID 2364 wrote to memory of 824 2364 62wh5x.exe 36 PID 2364 wrote to memory of 824 2364 62wh5x.exe 36 PID 824 wrote to memory of 2768 824 79q5e.exe 37 PID 824 wrote to memory of 2768 824 79q5e.exe 37 PID 824 wrote to memory of 2768 824 79q5e.exe 37 PID 824 wrote to memory of 2768 824 79q5e.exe 37 PID 2768 wrote to memory of 1940 2768 hu3b2.exe 38 PID 2768 wrote to memory of 1940 2768 hu3b2.exe 38 PID 2768 wrote to memory of 1940 2768 hu3b2.exe 38 PID 2768 wrote to memory of 1940 2768 hu3b2.exe 38 PID 1940 wrote to memory of 2176 1940 85v479h.exe 39 PID 1940 wrote to memory of 2176 1940 85v479h.exe 39 PID 1940 wrote to memory of 2176 1940 85v479h.exe 39 PID 1940 wrote to memory of 2176 1940 85v479h.exe 39 PID 2176 wrote to memory of 1628 2176 5g76q.exe 40 PID 2176 wrote to memory of 1628 2176 5g76q.exe 40 PID 2176 wrote to memory of 1628 2176 5g76q.exe 40 PID 2176 wrote to memory of 1628 2176 5g76q.exe 40 PID 1628 wrote to memory of 1624 1628 4678u.exe 41 PID 1628 wrote to memory of 1624 1628 4678u.exe 41 PID 1628 wrote to memory of 1624 1628 4678u.exe 41 PID 1628 wrote to memory of 1624 1628 4678u.exe 41 PID 1624 wrote to memory of 1048 1624 1w7ajo.exe 42 PID 1624 wrote to memory of 1048 1624 1w7ajo.exe 42 PID 1624 wrote to memory of 1048 1624 1w7ajo.exe 42 PID 1624 wrote to memory of 1048 1624 1w7ajo.exe 42 PID 1048 wrote to memory of 2412 1048 p3ub9s1.exe 43 PID 1048 wrote to memory of 2412 1048 p3ub9s1.exe 43 PID 1048 wrote to memory of 2412 1048 p3ub9s1.exe 43 PID 1048 wrote to memory of 2412 1048 p3ub9s1.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\539162b8cb67fedd37b9a100ee4726f29e247b4508e38c7f15ecb0cf97854994.exe"C:\Users\Admin\AppData\Local\Temp\539162b8cb67fedd37b9a100ee4726f29e247b4508e38c7f15ecb0cf97854994.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\45u3a.exec:\45u3a.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\fq64jcb.exec:\fq64jcb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\5h9emf6.exec:\5h9emf6.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\w8ki1.exec:\w8ki1.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\c8hr4.exec:\c8hr4.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\d33c3e5.exec:\d33c3e5.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\jxw0jl2.exec:\jxw0jl2.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\62wh5x.exec:\62wh5x.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\79q5e.exec:\79q5e.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\hu3b2.exec:\hu3b2.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\85v479h.exec:\85v479h.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\5g76q.exec:\5g76q.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\4678u.exec:\4678u.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\1w7ajo.exec:\1w7ajo.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\p3ub9s1.exec:\p3ub9s1.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\487sp8.exec:\487sp8.exe17⤵
- Executes dropped EXE
PID:2412 -
\??\c:\492c1.exec:\492c1.exe18⤵
- Executes dropped EXE
PID:1388 -
\??\c:\fj4c8.exec:\fj4c8.exe19⤵
- Executes dropped EXE
PID:1312 -
\??\c:\8993ax5.exec:\8993ax5.exe20⤵
- Executes dropped EXE
PID:1136 -
\??\c:\5qfhs.exec:\5qfhs.exe21⤵
- Executes dropped EXE
PID:1956 -
\??\c:\4040x5h.exec:\4040x5h.exe22⤵
- Executes dropped EXE
PID:1704 -
\??\c:\454e9.exec:\454e9.exe23⤵
- Executes dropped EXE
PID:2908 -
\??\c:\9p166v.exec:\9p166v.exe24⤵
- Executes dropped EXE
PID:1700 -
\??\c:\ri1vr1a.exec:\ri1vr1a.exe25⤵
- Executes dropped EXE
PID:2316 -
\??\c:\s2ac18.exec:\s2ac18.exe26⤵
- Executes dropped EXE
PID:1664 -
\??\c:\6au627.exec:\6au627.exe27⤵
- Executes dropped EXE
PID:1084 -
\??\c:\ps0mc3s.exec:\ps0mc3s.exe28⤵
- Executes dropped EXE
PID:2160 -
\??\c:\3c9q9g.exec:\3c9q9g.exe29⤵
- Executes dropped EXE
PID:600 -
\??\c:\l916sq.exec:\l916sq.exe30⤵
- Executes dropped EXE
PID:2224 -
\??\c:\1h9u6.exec:\1h9u6.exe31⤵
- Executes dropped EXE
PID:1188 -
\??\c:\xp1cq5h.exec:\xp1cq5h.exe32⤵
- Executes dropped EXE
PID:2108 -
\??\c:\wg4084.exec:\wg4084.exe33⤵
- Executes dropped EXE
PID:2228 -
\??\c:\1ip79.exec:\1ip79.exe34⤵
- Executes dropped EXE
PID:2240 -
\??\c:\fc6c5.exec:\fc6c5.exe35⤵
- Executes dropped EXE
PID:3020 -
\??\c:\esw4x.exec:\esw4x.exe36⤵
- Executes dropped EXE
PID:2636 -
\??\c:\v7848v.exec:\v7848v.exe37⤵
- Executes dropped EXE
PID:2584 -
\??\c:\7qowq.exec:\7qowq.exe38⤵
- Executes dropped EXE
PID:2432 -
\??\c:\2nq80.exec:\2nq80.exe39⤵
- Executes dropped EXE
PID:2804 -
\??\c:\g2iapi.exec:\g2iapi.exe40⤵
- Executes dropped EXE
PID:2652 -
\??\c:\506jh6.exec:\506jh6.exe41⤵
- Executes dropped EXE
PID:2424 -
\??\c:\63igo.exec:\63igo.exe42⤵
- Executes dropped EXE
PID:2880 -
\??\c:\59b6r3.exec:\59b6r3.exe43⤵
- Executes dropped EXE
PID:2280 -
\??\c:\e87184.exec:\e87184.exe44⤵
- Executes dropped EXE
PID:2488 -
\??\c:\1an9175.exec:\1an9175.exe45⤵
- Executes dropped EXE
PID:2784 -
\??\c:\uat50c6.exec:\uat50c6.exe46⤵
- Executes dropped EXE
PID:1716 -
\??\c:\32k277q.exec:\32k277q.exe47⤵
- Executes dropped EXE
PID:2140 -
\??\c:\7cx78f6.exec:\7cx78f6.exe48⤵
- Executes dropped EXE
PID:2036 -
\??\c:\1u8968.exec:\1u8968.exe49⤵
- Executes dropped EXE
PID:796 -
\??\c:\imo1so.exec:\imo1so.exe50⤵
- Executes dropped EXE
PID:1156 -
\??\c:\hck93.exec:\hck93.exe51⤵
- Executes dropped EXE
PID:1532 -
\??\c:\5xihbf.exec:\5xihbf.exe52⤵
- Executes dropped EXE
PID:1048 -
\??\c:\fo3lmr.exec:\fo3lmr.exe53⤵
- Executes dropped EXE
PID:2412 -
\??\c:\uqra5.exec:\uqra5.exe54⤵
- Executes dropped EXE
PID:1096 -
\??\c:\dl0sr2.exec:\dl0sr2.exe55⤵
- Executes dropped EXE
PID:2260 -
\??\c:\micw10.exec:\micw10.exe56⤵
- Executes dropped EXE
PID:2812 -
\??\c:\3g30m.exec:\3g30m.exe57⤵
- Executes dropped EXE
PID:2964 -
\??\c:\43sd50.exec:\43sd50.exe58⤵
- Executes dropped EXE
PID:2272 -
\??\c:\613315.exec:\613315.exe59⤵
- Executes dropped EXE
PID:2096 -
\??\c:\eiikw.exec:\eiikw.exe60⤵
- Executes dropped EXE
PID:296 -
\??\c:\t61u7g7.exec:\t61u7g7.exe61⤵
- Executes dropped EXE
PID:2144 -
\??\c:\21ck11.exec:\21ck11.exe62⤵
- Executes dropped EXE
PID:328 -
\??\c:\54l690r.exec:\54l690r.exe63⤵
- Executes dropped EXE
PID:1324 -
\??\c:\j6acb.exec:\j6acb.exe64⤵
- Executes dropped EXE
PID:1664 -
\??\c:\31pk0q.exec:\31pk0q.exe65⤵
- Executes dropped EXE
PID:1084 -
\??\c:\1c14i.exec:\1c14i.exe66⤵PID:1504
-
\??\c:\imxvv76.exec:\imxvv76.exe67⤵PID:2944
-
\??\c:\8j714s7.exec:\8j714s7.exe68⤵PID:2848
-
\??\c:\m8ih0w.exec:\m8ih0w.exe69⤵PID:1760
-
\??\c:\bmf8tu4.exec:\bmf8tu4.exe70⤵PID:2856
-
\??\c:\0grkv.exec:\0grkv.exe71⤵PID:1692
-
\??\c:\15smh.exec:\15smh.exe72⤵PID:1600
-
\??\c:\w96k7o.exec:\w96k7o.exe73⤵PID:2520
-
\??\c:\s57373.exec:\s57373.exe74⤵PID:2956
-
\??\c:\77x17r.exec:\77x17r.exe75⤵PID:2636
-
\??\c:\80jt6.exec:\80jt6.exe76⤵PID:2572
-
\??\c:\jv28f.exec:\jv28f.exe77⤵PID:2528
-
\??\c:\9p3i0.exec:\9p3i0.exe78⤵PID:2536
-
\??\c:\0200o24.exec:\0200o24.exe79⤵PID:2652
-
\??\c:\u44wm8r.exec:\u44wm8r.exe80⤵PID:2884
-
\??\c:\9517ml.exec:\9517ml.exe81⤵PID:2040
-
\??\c:\93mccoc.exec:\93mccoc.exe82⤵PID:2364
-
\??\c:\q1xx2q.exec:\q1xx2q.exe83⤵PID:824
-
\??\c:\5qesw.exec:\5qesw.exe84⤵PID:748
-
\??\c:\i999l3r.exec:\i999l3r.exe85⤵PID:2872
-
\??\c:\n5dllvu.exec:\n5dllvu.exe86⤵PID:1992
-
\??\c:\1v9qf.exec:\1v9qf.exe87⤵PID:268
-
\??\c:\319m79.exec:\319m79.exe88⤵PID:1168
-
\??\c:\t5l497x.exec:\t5l497x.exe89⤵PID:584
-
\??\c:\6s69ri.exec:\6s69ri.exe90⤵PID:1624
-
\??\c:\h92gm.exec:\h92gm.exe91⤵PID:1460
-
\??\c:\699eid6.exec:\699eid6.exe92⤵PID:2464
-
\??\c:\33uv58g.exec:\33uv58g.exe93⤵PID:848
-
\??\c:\a0i25ux.exec:\a0i25ux.exe94⤵PID:2068
-
\??\c:\u6q7c.exec:\u6q7c.exe95⤵PID:2072
-
\??\c:\5bb73.exec:\5bb73.exe96⤵PID:3044
-
\??\c:\3m9bai.exec:\3m9bai.exe97⤵PID:3052
-
\??\c:\u55bf6.exec:\u55bf6.exe98⤵PID:2972
-
\??\c:\ec7ka2u.exec:\ec7ka2u.exe99⤵PID:628
-
\??\c:\n51qip.exec:\n51qip.exe100⤵PID:1452
-
\??\c:\v2ve354.exec:\v2ve354.exe101⤵PID:1764
-
\??\c:\4688kp.exec:\4688kp.exe102⤵PID:1104
-
\??\c:\ft9qx1.exec:\ft9qx1.exe103⤵PID:344
-
\??\c:\x7t1up.exec:\x7t1up.exe104⤵PID:1076
-
\??\c:\3r73ih.exec:\3r73ih.exe105⤵PID:2092
-
\??\c:\hms9ki9.exec:\hms9ki9.exe106⤵PID:2988
-
\??\c:\8kig46.exec:\8kig46.exe107⤵PID:1112
-
\??\c:\ggtuw.exec:\ggtuw.exe108⤵PID:2924
-
\??\c:\3u7q9.exec:\3u7q9.exe109⤵PID:1200
-
\??\c:\tc51ux9.exec:\tc51ux9.exe110⤵PID:2212
-
\??\c:\e1q4fvo.exec:\e1q4fvo.exe111⤵PID:1580
-
\??\c:\5e71qg.exec:\5e71qg.exe112⤵PID:2056
-
\??\c:\hsh3gn1.exec:\hsh3gn1.exe113⤵PID:2228
-
\??\c:\dw7wg.exec:\dw7wg.exe114⤵PID:2816
-
\??\c:\ukaqioc.exec:\ukaqioc.exe115⤵PID:2304
-
\??\c:\6qmq126.exec:\6qmq126.exe116⤵PID:2552
-
\??\c:\wt2k6h.exec:\wt2k6h.exe117⤵PID:2248
-
\??\c:\1i36iv.exec:\1i36iv.exe118⤵PID:2596
-
\??\c:\9710x.exec:\9710x.exe119⤵PID:2468
-
\??\c:\b2f189r.exec:\b2f189r.exe120⤵PID:2476
-
\??\c:\a37777c.exec:\a37777c.exe121⤵PID:2404
-
\??\c:\456bq.exec:\456bq.exe122⤵PID:2892
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-