Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
30/04/2024, 23:39
Behavioral task
behavioral1
Sample
754d4bfc3aa8ae635116dc21a6968e24395663e2d8be2faf99691262b002e342.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
754d4bfc3aa8ae635116dc21a6968e24395663e2d8be2faf99691262b002e342.exe
-
Size
78KB
-
MD5
51e1e818b3bfd345189bae84325c9146
-
SHA1
f75fa626d5c649bb78df59a1ea22e68981de4c9c
-
SHA256
754d4bfc3aa8ae635116dc21a6968e24395663e2d8be2faf99691262b002e342
-
SHA512
f2c53c0516e9c9eb88150b4edc49e36edc6bc248911714a8e99a2340cc194bb686e1507596b2f1f9a6d1e858223c37beb5912092ec28b06ac857702105defaa8
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+C2HVM1p6TV1:zhOmTsF93UYfwC6GIoutiTU2HVS6D
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3508-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1864-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/116-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1332-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2496-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2808-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3892-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4180-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4848-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4792-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/852-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/860-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3056-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/820-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2240-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1060-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3592-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3272-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1480-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4540-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3376-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4636-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4008-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5076-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3632-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2344-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1488-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4924-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2544-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2784-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4580-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4940-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4900-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1356-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1028-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1608-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2704-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4788-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4572-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/852-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2892-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2228-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1116-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4756-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4184-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3568-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1960-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5100-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4588-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1740-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4828-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2808-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3456-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3172-374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2392-378-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3268-396-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4368-403-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4288-428-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4288-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1760-451-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2392-476-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4608-495-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2644-504-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2528-832-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/3508-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000b00000002321b-3.dat UPX behavioral2/memory/3508-5-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0008000000023242-8.dat UPX behavioral2/memory/1864-9-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023245-11.dat UPX behavioral2/memory/116-15-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1332-19-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023246-18.dat UPX behavioral2/files/0x0007000000023247-23.dat UPX behavioral2/memory/2496-24-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023248-28.dat UPX behavioral2/memory/2808-30-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023249-33.dat UPX behavioral2/memory/3892-38-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002324a-37.dat UPX behavioral2/files/0x000700000002324b-42.dat UPX behavioral2/memory/4180-43-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002324c-47.dat UPX behavioral2/memory/4848-48-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4792-50-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002324d-53.dat UPX behavioral2/memory/4792-54-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002324e-58.dat UPX behavioral2/memory/852-60-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/860-64-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002324f-63.dat UPX behavioral2/files/0x0007000000023250-68.dat UPX behavioral2/memory/3056-69-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023251-73.dat UPX behavioral2/files/0x0007000000023252-77.dat UPX behavioral2/memory/820-78-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023253-82.dat UPX behavioral2/files/0x0007000000023254-86.dat UPX behavioral2/memory/2240-87-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1060-92-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023255-91.dat UPX behavioral2/files/0x0007000000023256-96.dat UPX behavioral2/files/0x0007000000023257-100.dat UPX behavioral2/memory/3592-102-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023258-105.dat UPX behavioral2/files/0x0007000000023259-109.dat UPX behavioral2/files/0x000700000002325a-113.dat UPX behavioral2/files/0x000700000002325b-117.dat UPX behavioral2/files/0x000700000002325c-121.dat UPX behavioral2/files/0x000700000002325d-126.dat UPX behavioral2/memory/3272-125-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002325e-130.dat UPX behavioral2/memory/1480-131-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002325f-135.dat UPX behavioral2/memory/4540-136-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023260-140.dat UPX behavioral2/files/0x0007000000023261-144.dat UPX behavioral2/memory/3376-145-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4636-150-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023262-149.dat UPX behavioral2/memory/4008-154-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/5076-157-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3632-160-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2344-163-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1488-170-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4924-173-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2544-176-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2784-179-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1864 225qi13.exe 116 5avqo6.exe 1332 2w5b4.exe 2496 5001j.exe 2808 nh9a77g.exe 4780 99ww4.exe 3892 d80w8k.exe 4180 q47m1.exe 4848 261h4.exe 4792 enb8n.exe 852 xk41j.exe 860 lvqum84.exe 3056 97k9uc5.exe 2456 0o05gl.exe 820 165nni.exe 3256 lio46l.exe 2240 kxg36.exe 1060 011r5n.exe 2792 5028d.exe 3592 fe82in.exe 3912 46044.exe 2628 6ge4w5u.exe 4392 475ls.exe 4308 8uxv8ev.exe 1408 du11h.exe 3272 vg7331.exe 1480 4g9n53.exe 4540 o10an1.exe 1432 f5999e.exe 3376 0q083.exe 4636 4d9761.exe 4008 83xlsk.exe 5076 xg58nw.exe 3632 30r54n.exe 2344 xe36e.exe 2556 r4389.exe 3996 c4ovjbc.exe 1488 38xias.exe 4924 0g219.exe 2544 2vmk14w.exe 2784 4thb0h.exe 4580 v179b.exe 4940 4d7rl1g.exe 4828 i445k.exe 4900 13s5lo.exe 1356 uc12u80.exe 3480 ms9l7m.exe 1028 th8ul4.exe 1608 k0t177.exe 2704 6g80d8e.exe 4788 3i43m06.exe 2820 e47126r.exe 3756 pq718.exe 4572 fn990.exe 1216 1na1s.exe 852 2xf41o.exe 2948 t4p6w.exe 2892 7w8lo.exe 3260 0nwe3t.exe 3136 a72mv.exe 1020 0m97l8.exe 2228 2fgw3.exe 3256 fkn8mh.exe 1116 j077c.exe -
resource yara_rule behavioral2/memory/3508-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b00000002321b-3.dat upx behavioral2/memory/3508-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023242-8.dat upx behavioral2/memory/1864-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023245-11.dat upx behavioral2/memory/116-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1332-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023246-18.dat upx behavioral2/files/0x0007000000023247-23.dat upx behavioral2/memory/2496-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023248-28.dat upx behavioral2/memory/2808-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023249-33.dat upx behavioral2/memory/3892-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002324a-37.dat upx behavioral2/files/0x000700000002324b-42.dat upx behavioral2/memory/4180-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002324c-47.dat upx behavioral2/memory/4848-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4792-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002324d-53.dat upx behavioral2/memory/4792-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002324e-58.dat upx behavioral2/memory/852-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/860-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002324f-63.dat upx behavioral2/files/0x0007000000023250-68.dat upx behavioral2/memory/3056-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023251-73.dat upx behavioral2/files/0x0007000000023252-77.dat upx behavioral2/memory/820-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023253-82.dat upx behavioral2/files/0x0007000000023254-86.dat upx behavioral2/memory/2240-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1060-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023255-91.dat upx behavioral2/files/0x0007000000023256-96.dat upx behavioral2/files/0x0007000000023257-100.dat upx behavioral2/memory/3592-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023258-105.dat upx behavioral2/files/0x0007000000023259-109.dat upx behavioral2/files/0x000700000002325a-113.dat upx behavioral2/files/0x000700000002325b-117.dat upx behavioral2/files/0x000700000002325c-121.dat upx behavioral2/files/0x000700000002325d-126.dat upx behavioral2/memory/3272-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002325e-130.dat upx behavioral2/memory/1480-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002325f-135.dat upx behavioral2/memory/4540-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023260-140.dat upx behavioral2/files/0x0007000000023261-144.dat upx behavioral2/memory/3376-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4636-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023262-149.dat upx behavioral2/memory/4008-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5076-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3632-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2344-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1488-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4924-173-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2544-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2784-179-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3508 wrote to memory of 1864 3508 754d4bfc3aa8ae635116dc21a6968e24395663e2d8be2faf99691262b002e342.exe 90 PID 3508 wrote to memory of 1864 3508 754d4bfc3aa8ae635116dc21a6968e24395663e2d8be2faf99691262b002e342.exe 90 PID 3508 wrote to memory of 1864 3508 754d4bfc3aa8ae635116dc21a6968e24395663e2d8be2faf99691262b002e342.exe 90 PID 1864 wrote to memory of 116 1864 225qi13.exe 91 PID 1864 wrote to memory of 116 1864 225qi13.exe 91 PID 1864 wrote to memory of 116 1864 225qi13.exe 91 PID 116 wrote to memory of 1332 116 5avqo6.exe 92 PID 116 wrote to memory of 1332 116 5avqo6.exe 92 PID 116 wrote to memory of 1332 116 5avqo6.exe 92 PID 1332 wrote to memory of 2496 1332 2w5b4.exe 93 PID 1332 wrote to memory of 2496 1332 2w5b4.exe 93 PID 1332 wrote to memory of 2496 1332 2w5b4.exe 93 PID 2496 wrote to memory of 2808 2496 5001j.exe 94 PID 2496 wrote to memory of 2808 2496 5001j.exe 94 PID 2496 wrote to memory of 2808 2496 5001j.exe 94 PID 2808 wrote to memory of 4780 2808 nh9a77g.exe 95 PID 2808 wrote to memory of 4780 2808 nh9a77g.exe 95 PID 2808 wrote to memory of 4780 2808 nh9a77g.exe 95 PID 4780 wrote to memory of 3892 4780 99ww4.exe 96 PID 4780 wrote to memory of 3892 4780 99ww4.exe 96 PID 4780 wrote to memory of 3892 4780 99ww4.exe 96 PID 3892 wrote to memory of 4180 3892 d80w8k.exe 97 PID 3892 wrote to memory of 4180 3892 d80w8k.exe 97 PID 3892 wrote to memory of 4180 3892 d80w8k.exe 97 PID 4180 wrote to memory of 4848 4180 q47m1.exe 98 PID 4180 wrote to memory of 4848 4180 q47m1.exe 98 PID 4180 wrote to memory of 4848 4180 q47m1.exe 98 PID 4848 wrote to memory of 4792 4848 261h4.exe 99 PID 4848 wrote to memory of 4792 4848 261h4.exe 99 PID 4848 wrote to memory of 4792 4848 261h4.exe 99 PID 4792 wrote to memory of 852 4792 enb8n.exe 100 PID 4792 wrote to memory of 852 4792 enb8n.exe 100 PID 4792 wrote to memory of 852 4792 enb8n.exe 100 PID 852 wrote to memory of 860 852 xk41j.exe 101 PID 852 wrote to memory of 860 852 xk41j.exe 101 PID 852 wrote to memory of 860 852 xk41j.exe 101 PID 860 wrote to memory of 3056 860 lvqum84.exe 102 PID 860 wrote to memory of 3056 860 lvqum84.exe 102 PID 860 wrote to memory of 3056 860 lvqum84.exe 102 PID 3056 wrote to memory of 2456 3056 97k9uc5.exe 103 PID 3056 wrote to memory of 2456 3056 97k9uc5.exe 103 PID 3056 wrote to memory of 2456 3056 97k9uc5.exe 103 PID 2456 wrote to memory of 820 2456 0o05gl.exe 104 PID 2456 wrote to memory of 820 2456 0o05gl.exe 104 PID 2456 wrote to memory of 820 2456 0o05gl.exe 104 PID 820 wrote to memory of 3256 820 165nni.exe 105 PID 820 wrote to memory of 3256 820 165nni.exe 105 PID 820 wrote to memory of 3256 820 165nni.exe 105 PID 3256 wrote to memory of 2240 3256 lio46l.exe 106 PID 3256 wrote to memory of 2240 3256 lio46l.exe 106 PID 3256 wrote to memory of 2240 3256 lio46l.exe 106 PID 2240 wrote to memory of 1060 2240 kxg36.exe 107 PID 2240 wrote to memory of 1060 2240 kxg36.exe 107 PID 2240 wrote to memory of 1060 2240 kxg36.exe 107 PID 1060 wrote to memory of 2792 1060 011r5n.exe 108 PID 1060 wrote to memory of 2792 1060 011r5n.exe 108 PID 1060 wrote to memory of 2792 1060 011r5n.exe 108 PID 2792 wrote to memory of 3592 2792 5028d.exe 109 PID 2792 wrote to memory of 3592 2792 5028d.exe 109 PID 2792 wrote to memory of 3592 2792 5028d.exe 109 PID 3592 wrote to memory of 3912 3592 fe82in.exe 110 PID 3592 wrote to memory of 3912 3592 fe82in.exe 110 PID 3592 wrote to memory of 3912 3592 fe82in.exe 110 PID 3912 wrote to memory of 2628 3912 46044.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\754d4bfc3aa8ae635116dc21a6968e24395663e2d8be2faf99691262b002e342.exe"C:\Users\Admin\AppData\Local\Temp\754d4bfc3aa8ae635116dc21a6968e24395663e2d8be2faf99691262b002e342.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\225qi13.exec:\225qi13.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\5avqo6.exec:\5avqo6.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\2w5b4.exec:\2w5b4.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\5001j.exec:\5001j.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\nh9a77g.exec:\nh9a77g.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\99ww4.exec:\99ww4.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\d80w8k.exec:\d80w8k.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\q47m1.exec:\q47m1.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\261h4.exec:\261h4.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\enb8n.exec:\enb8n.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\xk41j.exec:\xk41j.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\lvqum84.exec:\lvqum84.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\97k9uc5.exec:\97k9uc5.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\0o05gl.exec:\0o05gl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\165nni.exec:\165nni.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
\??\c:\lio46l.exec:\lio46l.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\kxg36.exec:\kxg36.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\011r5n.exec:\011r5n.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\5028d.exec:\5028d.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\fe82in.exec:\fe82in.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\46044.exec:\46044.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
\??\c:\6ge4w5u.exec:\6ge4w5u.exe23⤵
- Executes dropped EXE
PID:2628 -
\??\c:\475ls.exec:\475ls.exe24⤵
- Executes dropped EXE
PID:4392 -
\??\c:\8uxv8ev.exec:\8uxv8ev.exe25⤵
- Executes dropped EXE
PID:4308 -
\??\c:\du11h.exec:\du11h.exe26⤵
- Executes dropped EXE
PID:1408 -
\??\c:\vg7331.exec:\vg7331.exe27⤵
- Executes dropped EXE
PID:3272 -
\??\c:\4g9n53.exec:\4g9n53.exe28⤵
- Executes dropped EXE
PID:1480 -
\??\c:\o10an1.exec:\o10an1.exe29⤵
- Executes dropped EXE
PID:4540 -
\??\c:\f5999e.exec:\f5999e.exe30⤵
- Executes dropped EXE
PID:1432 -
\??\c:\0q083.exec:\0q083.exe31⤵
- Executes dropped EXE
PID:3376 -
\??\c:\4d9761.exec:\4d9761.exe32⤵
- Executes dropped EXE
PID:4636 -
\??\c:\83xlsk.exec:\83xlsk.exe33⤵
- Executes dropped EXE
PID:4008 -
\??\c:\xg58nw.exec:\xg58nw.exe34⤵
- Executes dropped EXE
PID:5076 -
\??\c:\30r54n.exec:\30r54n.exe35⤵
- Executes dropped EXE
PID:3632 -
\??\c:\xe36e.exec:\xe36e.exe36⤵
- Executes dropped EXE
PID:2344 -
\??\c:\r4389.exec:\r4389.exe37⤵
- Executes dropped EXE
PID:2556 -
\??\c:\c4ovjbc.exec:\c4ovjbc.exe38⤵
- Executes dropped EXE
PID:3996 -
\??\c:\38xias.exec:\38xias.exe39⤵
- Executes dropped EXE
PID:1488 -
\??\c:\0g219.exec:\0g219.exe40⤵
- Executes dropped EXE
PID:4924 -
\??\c:\2vmk14w.exec:\2vmk14w.exe41⤵
- Executes dropped EXE
PID:2544 -
\??\c:\4thb0h.exec:\4thb0h.exe42⤵
- Executes dropped EXE
PID:2784 -
\??\c:\v179b.exec:\v179b.exe43⤵
- Executes dropped EXE
PID:4580 -
\??\c:\4d7rl1g.exec:\4d7rl1g.exe44⤵
- Executes dropped EXE
PID:4940 -
\??\c:\i445k.exec:\i445k.exe45⤵
- Executes dropped EXE
PID:4828 -
\??\c:\13s5lo.exec:\13s5lo.exe46⤵
- Executes dropped EXE
PID:4900 -
\??\c:\uc12u80.exec:\uc12u80.exe47⤵
- Executes dropped EXE
PID:1356 -
\??\c:\ms9l7m.exec:\ms9l7m.exe48⤵
- Executes dropped EXE
PID:3480 -
\??\c:\th8ul4.exec:\th8ul4.exe49⤵
- Executes dropped EXE
PID:1028 -
\??\c:\k0t177.exec:\k0t177.exe50⤵
- Executes dropped EXE
PID:1608 -
\??\c:\6g80d8e.exec:\6g80d8e.exe51⤵
- Executes dropped EXE
PID:2704 -
\??\c:\3i43m06.exec:\3i43m06.exe52⤵
- Executes dropped EXE
PID:4788 -
\??\c:\e47126r.exec:\e47126r.exe53⤵
- Executes dropped EXE
PID:2820 -
\??\c:\pq718.exec:\pq718.exe54⤵
- Executes dropped EXE
PID:3756 -
\??\c:\fn990.exec:\fn990.exe55⤵
- Executes dropped EXE
PID:4572 -
\??\c:\1na1s.exec:\1na1s.exe56⤵
- Executes dropped EXE
PID:1216 -
\??\c:\2xf41o.exec:\2xf41o.exe57⤵
- Executes dropped EXE
PID:852 -
\??\c:\t4p6w.exec:\t4p6w.exe58⤵
- Executes dropped EXE
PID:2948 -
\??\c:\7w8lo.exec:\7w8lo.exe59⤵
- Executes dropped EXE
PID:2892 -
\??\c:\0nwe3t.exec:\0nwe3t.exe60⤵
- Executes dropped EXE
PID:3260 -
\??\c:\a72mv.exec:\a72mv.exe61⤵
- Executes dropped EXE
PID:3136 -
\??\c:\0m97l8.exec:\0m97l8.exe62⤵
- Executes dropped EXE
PID:1020 -
\??\c:\2fgw3.exec:\2fgw3.exe63⤵
- Executes dropped EXE
PID:2228 -
\??\c:\fkn8mh.exec:\fkn8mh.exe64⤵
- Executes dropped EXE
PID:3256 -
\??\c:\j077c.exec:\j077c.exe65⤵
- Executes dropped EXE
PID:1116 -
\??\c:\g4806.exec:\g4806.exe66⤵PID:768
-
\??\c:\h1fftv.exec:\h1fftv.exe67⤵PID:2056
-
\??\c:\svs60q2.exec:\svs60q2.exe68⤵PID:112
-
\??\c:\m56qw9.exec:\m56qw9.exe69⤵PID:3644
-
\??\c:\6f45s.exec:\6f45s.exe70⤵PID:2424
-
\??\c:\ou7neet.exec:\ou7neet.exe71⤵PID:3456
-
\??\c:\qp5t2g3.exec:\qp5t2g3.exe72⤵PID:3172
-
\??\c:\g339of.exec:\g339of.exe73⤵PID:1388
-
\??\c:\0ndq2.exec:\0ndq2.exe74⤵PID:524
-
\??\c:\s1ehv.exec:\s1ehv.exe75⤵PID:900
-
\??\c:\82lx69.exec:\82lx69.exe76⤵PID:4836
-
\??\c:\1433x56.exec:\1433x56.exe77⤵PID:4888
-
\??\c:\lro19.exec:\lro19.exe78⤵PID:4756
-
\??\c:\dho1o52.exec:\dho1o52.exe79⤵PID:4184
-
\??\c:\0ig0qf.exec:\0ig0qf.exe80⤵PID:3568
-
\??\c:\o6g8tt3.exec:\o6g8tt3.exe81⤵PID:1960
-
\??\c:\46av59.exec:\46av59.exe82⤵PID:5100
-
\??\c:\i73a1ww.exec:\i73a1ww.exe83⤵PID:4800
-
\??\c:\8eecraq.exec:\8eecraq.exe84⤵PID:1444
-
\??\c:\txooak.exec:\txooak.exe85⤵PID:4008
-
\??\c:\hma1g.exec:\hma1g.exe86⤵PID:2400
-
\??\c:\99rlg.exec:\99rlg.exe87⤵PID:2308
-
\??\c:\7b58tq.exec:\7b58tq.exe88⤵PID:4588
-
\??\c:\5m011k.exec:\5m011k.exe89⤵PID:224
-
\??\c:\ne33tg.exec:\ne33tg.exe90⤵PID:4304
-
\??\c:\t7983m.exec:\t7983m.exe91⤵PID:4324
-
\??\c:\6953dv6.exec:\6953dv6.exe92⤵PID:1740
-
\??\c:\snqc2.exec:\snqc2.exe93⤵PID:4384
-
\??\c:\3530s70.exec:\3530s70.exe94⤵PID:636
-
\??\c:\38p692.exec:\38p692.exe95⤵PID:2784
-
\??\c:\w2i0i6r.exec:\w2i0i6r.exe96⤵PID:4112
-
\??\c:\pvv52.exec:\pvv52.exe97⤵PID:3656
-
\??\c:\mi119.exec:\mi119.exe98⤵PID:2528
-
\??\c:\4131b.exec:\4131b.exe99⤵PID:4828
-
\??\c:\36447.exec:\36447.exe100⤵PID:2808
-
\??\c:\nfge3.exec:\nfge3.exe101⤵PID:3904
-
\??\c:\79c3an.exec:\79c3an.exe102⤵PID:4336
-
\??\c:\gmog3.exec:\gmog3.exe103⤵PID:528
-
\??\c:\rx953.exec:\rx953.exe104⤵PID:2704
-
\??\c:\x4229e9.exec:\x4229e9.exe105⤵PID:4788
-
\??\c:\ov05b.exec:\ov05b.exe106⤵PID:2820
-
\??\c:\9h22a8k.exec:\9h22a8k.exe107⤵PID:3824
-
\??\c:\1saw79q.exec:\1saw79q.exe108⤵PID:4908
-
\??\c:\206660.exec:\206660.exe109⤵PID:1624
-
\??\c:\056we0.exec:\056we0.exe110⤵PID:432
-
\??\c:\s8ss22.exec:\s8ss22.exe111⤵PID:776
-
\??\c:\ap2j4.exec:\ap2j4.exe112⤵PID:3056
-
\??\c:\ooaeisq.exec:\ooaeisq.exe113⤵PID:4936
-
\??\c:\8h0fe.exec:\8h0fe.exe114⤵PID:4120
-
\??\c:\tir68.exec:\tir68.exe115⤵PID:1152
-
\??\c:\841da2t.exec:\841da2t.exe116⤵PID:3288
-
\??\c:\u4c9a1.exec:\u4c9a1.exe117⤵PID:1968
-
\??\c:\9vme8.exec:\9vme8.exe118⤵PID:2788
-
\??\c:\v77f7.exec:\v77f7.exe119⤵PID:3888
-
\??\c:\kw8flx.exec:\kw8flx.exe120⤵PID:3968
-
\??\c:\o0xr1.exec:\o0xr1.exe121⤵PID:2056
-
\??\c:\4n9051f.exec:\4n9051f.exe122⤵PID:4496
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-