Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
15/04/2024, 02:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b9fb48963b32c73b9364cd32daec47767777caf84b947466fc591422f4430f6a.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
b9fb48963b32c73b9364cd32daec47767777caf84b947466fc591422f4430f6a.exe
-
Size
139KB
-
MD5
78e8705be8c17f1ca1d8bbdca4c976e9
-
SHA1
22c53c6c9901edc845ec78c81bbc5521901db949
-
SHA256
b9fb48963b32c73b9364cd32daec47767777caf84b947466fc591422f4430f6a
-
SHA512
2936cbafa3a94b8a1481032a5af5095579d7b0340a920762a5f91f360ccbcaabbad5875732ee0d564b2adfc270374c360279f26ef14d71b5f362e14a22e7936f
-
SSDEEP
3072:ymb3NkkiQ3mdBjFomR7UsyJC+n0Gsgyek1a:n3C9BRomRph+0GsgyeYa
Malware Config
Signatures
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral2/memory/5056-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2604-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2672-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4076-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4380-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1052-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4728-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2560-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1848-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4912-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2328-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1020-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1972-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4412-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2780-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1056-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1056-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1072-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3168-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2528-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2580-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3396-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2604-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2804-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4044-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2052-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4740-270-0x0000000000470000-0x000000000047C000-memory.dmp family_blackmoon behavioral2/memory/4740-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/840-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1704-289-0x0000000002030000-0x000000000203C000-memory.dmp family_blackmoon behavioral2/memory/4596-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3840-305-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3472-314-0x00000000004B0000-0x00000000004BC000-memory.dmp family_blackmoon behavioral2/memory/3472-316-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3440-326-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4368-356-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1056-361-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 53 IoCs
resource yara_rule behavioral2/memory/5056-2-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5056-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2604-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2672-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4076-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4380-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5084-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1052-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4728-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2560-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4904-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1848-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4912-83-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2328-90-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1020-96-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1972-110-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4988-116-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4988-118-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4412-126-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4412-124-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2780-132-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2780-134-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/408-140-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1056-147-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1056-149-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1072-157-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4860-169-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3168-177-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4860-171-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2528-198-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3720-204-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4484-219-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2580-227-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3396-233-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3396-236-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2604-241-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2604-239-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2804-248-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4044-259-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4044-260-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2052-265-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4740-272-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/840-285-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4596-298-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4596-301-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3840-305-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3232-309-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3472-316-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3440-326-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/956-329-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1780-350-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4368-356-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1056-361-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2604 6b754a.exe 2672 2ah3b11.exe 4076 ug92cq2.exe 4380 0kiwqw.exe 5084 97nb0ma.exe 1052 sqd5v7g.exe 4728 8o15571.exe 2560 11puwv.exe 4904 mr10sd.exe 1848 nr5q3.exe 4912 t8995.exe 2328 5tq3mq.exe 1020 67551.exe 1708 4ql17or.exe 1972 lbajd.exe 4988 qt51g50.exe 4412 9915531.exe 2780 gu753g3.exe 408 5hh24.exe 1056 8a8l915.exe 1072 3rvq6rb.exe 1312 a91kg13.exe 4860 x8u39.exe 3168 b4ro6.exe 1192 m72jaq.exe 512 oubkl.exe 2528 37kkf.exe 3720 391159.exe 4620 xbf7tn.exe 4484 4dq8ase.exe 2580 8a72sh.exe 3396 v0s70.exe 2604 94qoh3t.exe 2804 uuco375.exe 416 155919j.exe 3288 xn563kq.exe 4044 513559.exe 2052 s0q9279.exe 4740 1g39735.exe 2916 55o5e.exe 2180 bu175.exe 840 x5573c.exe 1704 rvi61.exe 648 7725f55.exe 4596 8cmg4d5.exe 3840 d5752j9.exe 3232 tj8o5nq.exe 3472 1u705d1.exe 2828 bfoscm.exe 3440 923i9o.exe 956 v1o8qm4.exe 1976 81ege.exe 2544 s5757.exe 1880 m9sf30.exe 1140 cc109.exe 1780 12fwr2.exe 4368 25ud10.exe 1056 7u56n0a.exe 5080 fb7174a.exe 1496 f169337.exe 4860 9uiaq6.exe 4616 p4w397.exe 3168 7v4cce.exe 4316 xlqm450.exe -
resource yara_rule behavioral2/memory/5056-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2672-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4076-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4380-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1052-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4728-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2560-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1848-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1020-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4412-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4412-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2780-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2780-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1056-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1056-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1072-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3168-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2528-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3720-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2580-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3396-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3396-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2804-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2052-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4740-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/840-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4596-298-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4596-301-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3840-305-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3232-309-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3472-316-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3440-326-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/956-329-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1780-350-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-356-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1056-361-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5056 wrote to memory of 2604 5056 b9fb48963b32c73b9364cd32daec47767777caf84b947466fc591422f4430f6a.exe 86 PID 5056 wrote to memory of 2604 5056 b9fb48963b32c73b9364cd32daec47767777caf84b947466fc591422f4430f6a.exe 86 PID 5056 wrote to memory of 2604 5056 b9fb48963b32c73b9364cd32daec47767777caf84b947466fc591422f4430f6a.exe 86 PID 2604 wrote to memory of 2672 2604 6b754a.exe 87 PID 2604 wrote to memory of 2672 2604 6b754a.exe 87 PID 2604 wrote to memory of 2672 2604 6b754a.exe 87 PID 2672 wrote to memory of 4076 2672 2ah3b11.exe 88 PID 2672 wrote to memory of 4076 2672 2ah3b11.exe 88 PID 2672 wrote to memory of 4076 2672 2ah3b11.exe 88 PID 4076 wrote to memory of 4380 4076 ug92cq2.exe 89 PID 4076 wrote to memory of 4380 4076 ug92cq2.exe 89 PID 4076 wrote to memory of 4380 4076 ug92cq2.exe 89 PID 4380 wrote to memory of 5084 4380 0kiwqw.exe 90 PID 4380 wrote to memory of 5084 4380 0kiwqw.exe 90 PID 4380 wrote to memory of 5084 4380 0kiwqw.exe 90 PID 5084 wrote to memory of 1052 5084 97nb0ma.exe 92 PID 5084 wrote to memory of 1052 5084 97nb0ma.exe 92 PID 5084 wrote to memory of 1052 5084 97nb0ma.exe 92 PID 1052 wrote to memory of 4728 1052 sqd5v7g.exe 93 PID 1052 wrote to memory of 4728 1052 sqd5v7g.exe 93 PID 1052 wrote to memory of 4728 1052 sqd5v7g.exe 93 PID 4728 wrote to memory of 2560 4728 8o15571.exe 94 PID 4728 wrote to memory of 2560 4728 8o15571.exe 94 PID 4728 wrote to memory of 2560 4728 8o15571.exe 94 PID 2560 wrote to memory of 4904 2560 11puwv.exe 95 PID 2560 wrote to memory of 4904 2560 11puwv.exe 95 PID 2560 wrote to memory of 4904 2560 11puwv.exe 95 PID 4904 wrote to memory of 1848 4904 mr10sd.exe 96 PID 4904 wrote to memory of 1848 4904 mr10sd.exe 96 PID 4904 wrote to memory of 1848 4904 mr10sd.exe 96 PID 1848 wrote to memory of 4912 1848 nr5q3.exe 97 PID 1848 wrote to memory of 4912 1848 nr5q3.exe 97 PID 1848 wrote to memory of 4912 1848 nr5q3.exe 97 PID 4912 wrote to memory of 2328 4912 t8995.exe 98 PID 4912 wrote to memory of 2328 4912 t8995.exe 98 PID 4912 wrote to memory of 2328 4912 t8995.exe 98 PID 2328 wrote to memory of 1020 2328 5tq3mq.exe 99 PID 2328 wrote to memory of 1020 2328 5tq3mq.exe 99 PID 2328 wrote to memory of 1020 2328 5tq3mq.exe 99 PID 1020 wrote to memory of 1708 1020 67551.exe 100 PID 1020 wrote to memory of 1708 1020 67551.exe 100 PID 1020 wrote to memory of 1708 1020 67551.exe 100 PID 1708 wrote to memory of 1972 1708 4ql17or.exe 101 PID 1708 wrote to memory of 1972 1708 4ql17or.exe 101 PID 1708 wrote to memory of 1972 1708 4ql17or.exe 101 PID 1972 wrote to memory of 4988 1972 lbajd.exe 102 PID 1972 wrote to memory of 4988 1972 lbajd.exe 102 PID 1972 wrote to memory of 4988 1972 lbajd.exe 102 PID 4988 wrote to memory of 4412 4988 qt51g50.exe 103 PID 4988 wrote to memory of 4412 4988 qt51g50.exe 103 PID 4988 wrote to memory of 4412 4988 qt51g50.exe 103 PID 4412 wrote to memory of 2780 4412 9915531.exe 105 PID 4412 wrote to memory of 2780 4412 9915531.exe 105 PID 4412 wrote to memory of 2780 4412 9915531.exe 105 PID 2780 wrote to memory of 408 2780 gu753g3.exe 106 PID 2780 wrote to memory of 408 2780 gu753g3.exe 106 PID 2780 wrote to memory of 408 2780 gu753g3.exe 106 PID 408 wrote to memory of 1056 408 5hh24.exe 107 PID 408 wrote to memory of 1056 408 5hh24.exe 107 PID 408 wrote to memory of 1056 408 5hh24.exe 107 PID 1056 wrote to memory of 1072 1056 8a8l915.exe 108 PID 1056 wrote to memory of 1072 1056 8a8l915.exe 108 PID 1056 wrote to memory of 1072 1056 8a8l915.exe 108 PID 1072 wrote to memory of 1312 1072 3rvq6rb.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9fb48963b32c73b9364cd32daec47767777caf84b947466fc591422f4430f6a.exe"C:\Users\Admin\AppData\Local\Temp\b9fb48963b32c73b9364cd32daec47767777caf84b947466fc591422f4430f6a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\6b754a.exec:\6b754a.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\2ah3b11.exec:\2ah3b11.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\ug92cq2.exec:\ug92cq2.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\0kiwqw.exec:\0kiwqw.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\97nb0ma.exec:\97nb0ma.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\sqd5v7g.exec:\sqd5v7g.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\8o15571.exec:\8o15571.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\11puwv.exec:\11puwv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\mr10sd.exec:\mr10sd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\nr5q3.exec:\nr5q3.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\t8995.exec:\t8995.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\5tq3mq.exec:\5tq3mq.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\67551.exec:\67551.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\4ql17or.exec:\4ql17or.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\lbajd.exec:\lbajd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\qt51g50.exec:\qt51g50.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\9915531.exec:\9915531.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
\??\c:\gu753g3.exec:\gu753g3.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\5hh24.exec:\5hh24.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\8a8l915.exec:\8a8l915.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\3rvq6rb.exec:\3rvq6rb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\a91kg13.exec:\a91kg13.exe23⤵
- Executes dropped EXE
PID:1312 -
\??\c:\x8u39.exec:\x8u39.exe24⤵
- Executes dropped EXE
PID:4860 -
\??\c:\b4ro6.exec:\b4ro6.exe25⤵
- Executes dropped EXE
PID:3168 -
\??\c:\m72jaq.exec:\m72jaq.exe26⤵
- Executes dropped EXE
PID:1192 -
\??\c:\oubkl.exec:\oubkl.exe27⤵
- Executes dropped EXE
PID:512 -
\??\c:\37kkf.exec:\37kkf.exe28⤵
- Executes dropped EXE
PID:2528 -
\??\c:\391159.exec:\391159.exe29⤵
- Executes dropped EXE
PID:3720 -
\??\c:\xbf7tn.exec:\xbf7tn.exe30⤵
- Executes dropped EXE
PID:4620 -
\??\c:\4dq8ase.exec:\4dq8ase.exe31⤵
- Executes dropped EXE
PID:4484 -
\??\c:\8a72sh.exec:\8a72sh.exe32⤵
- Executes dropped EXE
PID:2580 -
\??\c:\v0s70.exec:\v0s70.exe33⤵
- Executes dropped EXE
PID:3396 -
\??\c:\94qoh3t.exec:\94qoh3t.exe34⤵
- Executes dropped EXE
PID:2604 -
\??\c:\uuco375.exec:\uuco375.exe35⤵
- Executes dropped EXE
PID:2804 -
\??\c:\155919j.exec:\155919j.exe36⤵
- Executes dropped EXE
PID:416 -
\??\c:\xn563kq.exec:\xn563kq.exe37⤵
- Executes dropped EXE
PID:3288 -
\??\c:\513559.exec:\513559.exe38⤵
- Executes dropped EXE
PID:4044 -
\??\c:\s0q9279.exec:\s0q9279.exe39⤵
- Executes dropped EXE
PID:2052 -
\??\c:\1g39735.exec:\1g39735.exe40⤵
- Executes dropped EXE
PID:4740 -
\??\c:\55o5e.exec:\55o5e.exe41⤵
- Executes dropped EXE
PID:2916 -
\??\c:\bu175.exec:\bu175.exe42⤵
- Executes dropped EXE
PID:2180 -
\??\c:\x5573c.exec:\x5573c.exe43⤵
- Executes dropped EXE
PID:840 -
\??\c:\rvi61.exec:\rvi61.exe44⤵
- Executes dropped EXE
PID:1704 -
\??\c:\7725f55.exec:\7725f55.exe45⤵
- Executes dropped EXE
PID:648 -
\??\c:\8cmg4d5.exec:\8cmg4d5.exe46⤵
- Executes dropped EXE
PID:4596 -
\??\c:\d5752j9.exec:\d5752j9.exe47⤵
- Executes dropped EXE
PID:3840 -
\??\c:\tj8o5nq.exec:\tj8o5nq.exe48⤵
- Executes dropped EXE
PID:3232 -
\??\c:\1u705d1.exec:\1u705d1.exe49⤵
- Executes dropped EXE
PID:3472 -
\??\c:\bfoscm.exec:\bfoscm.exe50⤵
- Executes dropped EXE
PID:2828 -
\??\c:\923i9o.exec:\923i9o.exe51⤵
- Executes dropped EXE
PID:3440 -
\??\c:\v1o8qm4.exec:\v1o8qm4.exe52⤵
- Executes dropped EXE
PID:956 -
\??\c:\81ege.exec:\81ege.exe53⤵
- Executes dropped EXE
PID:1976 -
\??\c:\s5757.exec:\s5757.exe54⤵
- Executes dropped EXE
PID:2544 -
\??\c:\m9sf30.exec:\m9sf30.exe55⤵
- Executes dropped EXE
PID:1880 -
\??\c:\cc109.exec:\cc109.exe56⤵
- Executes dropped EXE
PID:1140 -
\??\c:\12fwr2.exec:\12fwr2.exe57⤵
- Executes dropped EXE
PID:1780 -
\??\c:\25ud10.exec:\25ud10.exe58⤵
- Executes dropped EXE
PID:4368 -
\??\c:\7u56n0a.exec:\7u56n0a.exe59⤵
- Executes dropped EXE
PID:1056 -
\??\c:\fb7174a.exec:\fb7174a.exe60⤵
- Executes dropped EXE
PID:5080 -
\??\c:\f169337.exec:\f169337.exe61⤵
- Executes dropped EXE
PID:1496 -
\??\c:\9uiaq6.exec:\9uiaq6.exe62⤵
- Executes dropped EXE
PID:4860 -
\??\c:\p4w397.exec:\p4w397.exe63⤵
- Executes dropped EXE
PID:4616 -
\??\c:\7v4cce.exec:\7v4cce.exe64⤵
- Executes dropped EXE
PID:3168 -
\??\c:\xlqm450.exec:\xlqm450.exe65⤵
- Executes dropped EXE
PID:4316 -
\??\c:\x9335s.exec:\x9335s.exe66⤵PID:3340
-
\??\c:\9n76r9.exec:\9n76r9.exe67⤵PID:1672
-
\??\c:\352ur.exec:\352ur.exe68⤵PID:3760
-
\??\c:\dw55n9.exec:\dw55n9.exe69⤵PID:3792
-
\??\c:\cod7a.exec:\cod7a.exe70⤵PID:1444
-
\??\c:\7svami2.exec:\7svami2.exe71⤵PID:856
-
\??\c:\tse2ok.exec:\tse2ok.exe72⤵PID:4488
-
\??\c:\csaeu97.exec:\csaeu97.exe73⤵PID:4084
-
\??\c:\579379m.exec:\579379m.exe74⤵PID:3396
-
\??\c:\d958mn.exec:\d958mn.exe75⤵PID:2988
-
\??\c:\3tmi78.exec:\3tmi78.exe76⤵PID:376
-
\??\c:\lil70.exec:\lil70.exe77⤵PID:1028
-
\??\c:\eub97o.exec:\eub97o.exe78⤵PID:2448
-
\??\c:\65aog.exec:\65aog.exe79⤵PID:3428
-
\??\c:\e983578.exec:\e983578.exe80⤵PID:4972
-
\??\c:\s2g2gb1.exec:\s2g2gb1.exe81⤵PID:4900
-
\??\c:\av8sv4.exec:\av8sv4.exe82⤵PID:4956
-
\??\c:\fmun5.exec:\fmun5.exe83⤵PID:2560
-
\??\c:\07317.exec:\07317.exe84⤵PID:840
-
\??\c:\9bj55n0.exec:\9bj55n0.exe85⤵PID:2540
-
\??\c:\d5saw.exec:\d5saw.exe86⤵PID:1848
-
\??\c:\13sd4ik.exec:\13sd4ik.exe87⤵PID:2280
-
\??\c:\0u799.exec:\0u799.exe88⤵PID:2348
-
\??\c:\53q33uo.exec:\53q33uo.exe89⤵PID:1476
-
\??\c:\7977kw.exec:\7977kw.exe90⤵PID:4676
-
\??\c:\4coi687.exec:\4coi687.exe91⤵PID:3536
-
\??\c:\q8kdh20.exec:\q8kdh20.exe92⤵PID:1844
-
\??\c:\h550wri.exec:\h550wri.exe93⤵PID:4512
-
\??\c:\2ui99c.exec:\2ui99c.exe94⤵PID:3368
-
\??\c:\99115.exec:\99115.exe95⤵PID:3532
-
\??\c:\4mx6or.exec:\4mx6or.exe96⤵PID:1136
-
\??\c:\v3mkm.exec:\v3mkm.exe97⤵PID:1536
-
\??\c:\4i3qq.exec:\4i3qq.exe98⤵PID:3364
-
\??\c:\tu9tn.exec:\tu9tn.exe99⤵PID:1840
-
\??\c:\g4955.exec:\g4955.exe100⤵PID:4248
-
\??\c:\99wuw.exec:\99wuw.exe101⤵PID:1076
-
\??\c:\5x393.exec:\5x393.exe102⤵PID:3308
-
\??\c:\1wwu33.exec:\1wwu33.exe103⤵PID:5048
-
\??\c:\578uo.exec:\578uo.exe104⤵PID:60
-
\??\c:\9i6j6.exec:\9i6j6.exe105⤵PID:1620
-
\??\c:\772smw7.exec:\772smw7.exe106⤵PID:1628
-
\??\c:\j4c34w7.exec:\j4c34w7.exe107⤵PID:4064
-
\??\c:\5954j71.exec:\5954j71.exe108⤵PID:3204
-
\??\c:\et70s.exec:\et70s.exe109⤵PID:464
-
\??\c:\jwpw64.exec:\jwpw64.exe110⤵PID:4620
-
\??\c:\v996j6u.exec:\v996j6u.exe111⤵PID:2260
-
\??\c:\11v9w72.exec:\11v9w72.exe112⤵PID:5056
-
\??\c:\v5it1.exec:\v5it1.exe113⤵PID:960
-
\??\c:\1140p6.exec:\1140p6.exe114⤵PID:780
-
\??\c:\x3822a.exec:\x3822a.exe115⤵PID:3940
-
\??\c:\vv96ii.exec:\vv96ii.exe116⤵PID:2672
-
\??\c:\290xhx.exec:\290xhx.exe117⤵PID:2204
-
\??\c:\99k349.exec:\99k349.exe118⤵PID:1400
-
\??\c:\778n76k.exec:\778n76k.exe119⤵PID:4088
-
\??\c:\73agsm.exec:\73agsm.exe120⤵PID:1624
-
\??\c:\u4ba26.exec:\u4ba26.exe121⤵PID:3664
-
\??\c:\td72i.exec:\td72i.exe122⤵PID:2932
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-