Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/06/2024, 18:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
01f9ff4207fa3a65e36e4ea2b0f6373284a57d9e2a8e931e662ef2a730827cb7.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
01f9ff4207fa3a65e36e4ea2b0f6373284a57d9e2a8e931e662ef2a730827cb7.exe
-
Size
184KB
-
MD5
c534d14730cd3314dbd6d9093fda3117
-
SHA1
7285b7d03ef472d9021efaa7d0fce4968d041fde
-
SHA256
01f9ff4207fa3a65e36e4ea2b0f6373284a57d9e2a8e931e662ef2a730827cb7
-
SHA512
ad70de55126f768de8cba15769be869c686dba1efd63530e993bc6d81b1524f00cf9cc34e7d7aec79d07000b0b18db2d927adfe4e093f24bbb15807639f33af9
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqgT4+EMdb4SY:PhOm2sI93UufdC67ciJTWMdbHY
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4752-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3800-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2892-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3588-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1432-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3996-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3100-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1104-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2732-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/832-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2620-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1376-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2164-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/496-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/468-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1372-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4072-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4884-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4876-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3288-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1624-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1488-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1804-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3220-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1420-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2644-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/440-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4752-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2680-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2112-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2928-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/644-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4104-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/876-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3228-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1444-311-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3276-324-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4252-331-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-347-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-352-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1868-367-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2352-390-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3356-396-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4900-400-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2204-417-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3084-448-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3084-452-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-471-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2184-535-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/488-539-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4104-582-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2284-607-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3936-766-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4116-774-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2176-860-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4964-1134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-1190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/4752-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3800-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2892-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3588-22-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1432-29-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3996-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3100-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1104-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4348-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2732-59-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/832-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2620-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1376-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2164-92-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/496-98-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/468-120-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4636-125-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1372-135-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4892-142-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2364-149-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3984-157-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4072-155-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3984-162-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4884-168-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4876-175-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3288-180-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1624-183-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1488-191-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1804-204-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3220-205-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1420-212-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1420-216-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2644-220-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/440-224-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4752-228-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2680-230-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2112-251-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2928-252-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2928-256-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/644-263-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2028-264-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4104-271-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/876-273-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4608-293-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4636-301-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3228-300-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1444-311-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3276-324-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4252-331-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3212-347-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5024-352-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1868-367-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2352-390-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3356-396-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4900-400-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2204-417-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1724-420-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3084-448-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3084-452-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4892-471-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2184-535-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/488-539-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4104-582-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2284-607-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3800 o1hnm.exe 2892 t21mm.exe 3588 pgq2509.exe 1432 3ap3v6.exe 3996 1t41eb.exe 3100 ws4dd6.exe 1104 j99k19.exe 4348 x4fm2.exe 2732 79s41lp.exe 4976 7e769.exe 832 0tborc.exe 2620 51okilg.exe 1376 0k8ox14.exe 3652 qq3p3t5.exe 2164 d7f5p5.exe 496 090dqu.exe 788 tieqh.exe 3316 fui55.exe 1648 0or0i4w.exe 468 9q25va4.exe 4636 fu03l.exe 924 op274.exe 1372 m674pv6.exe 4892 5u476w.exe 2364 c814j.exe 4072 84g9e5i.exe 3984 fm63n9.exe 4884 ig5q4.exe 4876 2i3fs0.exe 3288 6u5p4h.exe 1624 hiiae6.exe 1488 4j94w.exe 4208 64u1aa.exe 4224 n4lc62.exe 4476 vw66cu.exe 1804 1v3kw2.exe 3220 277753.exe 3800 0agvqw.exe 1420 1rucv5.exe 2644 c7sv79p.exe 440 88959g.exe 4752 q261p21.exe 2680 h5sdeio.exe 2136 8v5ps61.exe 2852 8qeum61.exe 4444 8oub6.exe 2208 7tn605.exe 2732 67g57.exe 2112 ti9mb2.exe 2928 vg50n39.exe 2104 lp1857.exe 644 2clc14i.exe 2028 e4dngb5.exe 4104 20f47.exe 876 9m6gko.exe 4692 t0789.exe 2528 7q90x3.exe 4544 66mae9.exe 3508 d8ewc.exe 4608 4s5bk.exe 468 33e4c.exe 3228 89pb91.exe 4636 wo78g.exe 924 mm711w.exe -
resource yara_rule behavioral2/memory/4752-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3800-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2892-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1432-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3996-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3100-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2732-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/832-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1376-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2164-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/496-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/468-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1372-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4072-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4884-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4876-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3288-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1624-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1488-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1804-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3220-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1420-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1420-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2644-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/440-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2680-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2112-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2928-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2928-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/644-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4104-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/876-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-301-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3228-300-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1444-311-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3276-324-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4252-331-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-347-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-352-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1868-367-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2352-390-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3356-396-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-400-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2204-417-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1724-420-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3084-448-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3084-452-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-471-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2184-535-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/488-539-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4104-582-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2284-607-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4752 wrote to memory of 3800 4752 01f9ff4207fa3a65e36e4ea2b0f6373284a57d9e2a8e931e662ef2a730827cb7.exe 90 PID 4752 wrote to memory of 3800 4752 01f9ff4207fa3a65e36e4ea2b0f6373284a57d9e2a8e931e662ef2a730827cb7.exe 90 PID 4752 wrote to memory of 3800 4752 01f9ff4207fa3a65e36e4ea2b0f6373284a57d9e2a8e931e662ef2a730827cb7.exe 90 PID 3800 wrote to memory of 2892 3800 o1hnm.exe 91 PID 3800 wrote to memory of 2892 3800 o1hnm.exe 91 PID 3800 wrote to memory of 2892 3800 o1hnm.exe 91 PID 2892 wrote to memory of 3588 2892 t21mm.exe 92 PID 2892 wrote to memory of 3588 2892 t21mm.exe 92 PID 2892 wrote to memory of 3588 2892 t21mm.exe 92 PID 3588 wrote to memory of 1432 3588 pgq2509.exe 93 PID 3588 wrote to memory of 1432 3588 pgq2509.exe 93 PID 3588 wrote to memory of 1432 3588 pgq2509.exe 93 PID 1432 wrote to memory of 3996 1432 3ap3v6.exe 94 PID 1432 wrote to memory of 3996 1432 3ap3v6.exe 94 PID 1432 wrote to memory of 3996 1432 3ap3v6.exe 94 PID 3996 wrote to memory of 3100 3996 1t41eb.exe 95 PID 3996 wrote to memory of 3100 3996 1t41eb.exe 95 PID 3996 wrote to memory of 3100 3996 1t41eb.exe 95 PID 3100 wrote to memory of 1104 3100 ws4dd6.exe 96 PID 3100 wrote to memory of 1104 3100 ws4dd6.exe 96 PID 3100 wrote to memory of 1104 3100 ws4dd6.exe 96 PID 1104 wrote to memory of 4348 1104 j99k19.exe 97 PID 1104 wrote to memory of 4348 1104 j99k19.exe 97 PID 1104 wrote to memory of 4348 1104 j99k19.exe 97 PID 4348 wrote to memory of 2732 4348 x4fm2.exe 98 PID 4348 wrote to memory of 2732 4348 x4fm2.exe 98 PID 4348 wrote to memory of 2732 4348 x4fm2.exe 98 PID 2732 wrote to memory of 4976 2732 79s41lp.exe 99 PID 2732 wrote to memory of 4976 2732 79s41lp.exe 99 PID 2732 wrote to memory of 4976 2732 79s41lp.exe 99 PID 4976 wrote to memory of 832 4976 7e769.exe 100 PID 4976 wrote to memory of 832 4976 7e769.exe 100 PID 4976 wrote to memory of 832 4976 7e769.exe 100 PID 832 wrote to memory of 2620 832 0tborc.exe 101 PID 832 wrote to memory of 2620 832 0tborc.exe 101 PID 832 wrote to memory of 2620 832 0tborc.exe 101 PID 2620 wrote to memory of 1376 2620 51okilg.exe 102 PID 2620 wrote to memory of 1376 2620 51okilg.exe 102 PID 2620 wrote to memory of 1376 2620 51okilg.exe 102 PID 1376 wrote to memory of 3652 1376 0k8ox14.exe 103 PID 1376 wrote to memory of 3652 1376 0k8ox14.exe 103 PID 1376 wrote to memory of 3652 1376 0k8ox14.exe 103 PID 3652 wrote to memory of 2164 3652 qq3p3t5.exe 104 PID 3652 wrote to memory of 2164 3652 qq3p3t5.exe 104 PID 3652 wrote to memory of 2164 3652 qq3p3t5.exe 104 PID 2164 wrote to memory of 496 2164 d7f5p5.exe 105 PID 2164 wrote to memory of 496 2164 d7f5p5.exe 105 PID 2164 wrote to memory of 496 2164 d7f5p5.exe 105 PID 496 wrote to memory of 788 496 090dqu.exe 106 PID 496 wrote to memory of 788 496 090dqu.exe 106 PID 496 wrote to memory of 788 496 090dqu.exe 106 PID 788 wrote to memory of 3316 788 tieqh.exe 107 PID 788 wrote to memory of 3316 788 tieqh.exe 107 PID 788 wrote to memory of 3316 788 tieqh.exe 107 PID 3316 wrote to memory of 1648 3316 fui55.exe 108 PID 3316 wrote to memory of 1648 3316 fui55.exe 108 PID 3316 wrote to memory of 1648 3316 fui55.exe 108 PID 1648 wrote to memory of 468 1648 0or0i4w.exe 109 PID 1648 wrote to memory of 468 1648 0or0i4w.exe 109 PID 1648 wrote to memory of 468 1648 0or0i4w.exe 109 PID 468 wrote to memory of 4636 468 9q25va4.exe 110 PID 468 wrote to memory of 4636 468 9q25va4.exe 110 PID 468 wrote to memory of 4636 468 9q25va4.exe 110 PID 4636 wrote to memory of 924 4636 fu03l.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\01f9ff4207fa3a65e36e4ea2b0f6373284a57d9e2a8e931e662ef2a730827cb7.exe"C:\Users\Admin\AppData\Local\Temp\01f9ff4207fa3a65e36e4ea2b0f6373284a57d9e2a8e931e662ef2a730827cb7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\o1hnm.exec:\o1hnm.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
\??\c:\t21mm.exec:\t21mm.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\pgq2509.exec:\pgq2509.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\3ap3v6.exec:\3ap3v6.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\1t41eb.exec:\1t41eb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\ws4dd6.exec:\ws4dd6.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\j99k19.exec:\j99k19.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\x4fm2.exec:\x4fm2.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\79s41lp.exec:\79s41lp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\7e769.exec:\7e769.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\0tborc.exec:\0tborc.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\51okilg.exec:\51okilg.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\0k8ox14.exec:\0k8ox14.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\qq3p3t5.exec:\qq3p3t5.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\d7f5p5.exec:\d7f5p5.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\090dqu.exec:\090dqu.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:496 -
\??\c:\tieqh.exec:\tieqh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:788 -
\??\c:\fui55.exec:\fui55.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\0or0i4w.exec:\0or0i4w.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\9q25va4.exec:\9q25va4.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\fu03l.exec:\fu03l.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\op274.exec:\op274.exe23⤵
- Executes dropped EXE
PID:924 -
\??\c:\m674pv6.exec:\m674pv6.exe24⤵
- Executes dropped EXE
PID:1372 -
\??\c:\5u476w.exec:\5u476w.exe25⤵
- Executes dropped EXE
PID:4892 -
\??\c:\c814j.exec:\c814j.exe26⤵
- Executes dropped EXE
PID:2364 -
\??\c:\84g9e5i.exec:\84g9e5i.exe27⤵
- Executes dropped EXE
PID:4072 -
\??\c:\fm63n9.exec:\fm63n9.exe28⤵
- Executes dropped EXE
PID:3984 -
\??\c:\ig5q4.exec:\ig5q4.exe29⤵
- Executes dropped EXE
PID:4884 -
\??\c:\2i3fs0.exec:\2i3fs0.exe30⤵
- Executes dropped EXE
PID:4876 -
\??\c:\6u5p4h.exec:\6u5p4h.exe31⤵
- Executes dropped EXE
PID:3288 -
\??\c:\hiiae6.exec:\hiiae6.exe32⤵
- Executes dropped EXE
PID:1624 -
\??\c:\4j94w.exec:\4j94w.exe33⤵
- Executes dropped EXE
PID:1488 -
\??\c:\64u1aa.exec:\64u1aa.exe34⤵
- Executes dropped EXE
PID:4208 -
\??\c:\n4lc62.exec:\n4lc62.exe35⤵
- Executes dropped EXE
PID:4224 -
\??\c:\vw66cu.exec:\vw66cu.exe36⤵
- Executes dropped EXE
PID:4476 -
\??\c:\1v3kw2.exec:\1v3kw2.exe37⤵
- Executes dropped EXE
PID:1804 -
\??\c:\277753.exec:\277753.exe38⤵
- Executes dropped EXE
PID:3220 -
\??\c:\0agvqw.exec:\0agvqw.exe39⤵
- Executes dropped EXE
PID:3800 -
\??\c:\1rucv5.exec:\1rucv5.exe40⤵
- Executes dropped EXE
PID:1420 -
\??\c:\c7sv79p.exec:\c7sv79p.exe41⤵
- Executes dropped EXE
PID:2644 -
\??\c:\88959g.exec:\88959g.exe42⤵
- Executes dropped EXE
PID:440 -
\??\c:\q261p21.exec:\q261p21.exe43⤵
- Executes dropped EXE
PID:4752 -
\??\c:\h5sdeio.exec:\h5sdeio.exe44⤵
- Executes dropped EXE
PID:2680 -
\??\c:\8v5ps61.exec:\8v5ps61.exe45⤵
- Executes dropped EXE
PID:2136 -
\??\c:\8qeum61.exec:\8qeum61.exe46⤵
- Executes dropped EXE
PID:2852 -
\??\c:\8oub6.exec:\8oub6.exe47⤵
- Executes dropped EXE
PID:4444 -
\??\c:\7tn605.exec:\7tn605.exe48⤵
- Executes dropped EXE
PID:2208 -
\??\c:\67g57.exec:\67g57.exe49⤵
- Executes dropped EXE
PID:2732 -
\??\c:\ti9mb2.exec:\ti9mb2.exe50⤵
- Executes dropped EXE
PID:2112 -
\??\c:\vg50n39.exec:\vg50n39.exe51⤵
- Executes dropped EXE
PID:2928 -
\??\c:\lp1857.exec:\lp1857.exe52⤵
- Executes dropped EXE
PID:2104 -
\??\c:\2clc14i.exec:\2clc14i.exe53⤵
- Executes dropped EXE
PID:644 -
\??\c:\e4dngb5.exec:\e4dngb5.exe54⤵
- Executes dropped EXE
PID:2028 -
\??\c:\20f47.exec:\20f47.exe55⤵
- Executes dropped EXE
PID:4104 -
\??\c:\9m6gko.exec:\9m6gko.exe56⤵
- Executes dropped EXE
PID:876 -
\??\c:\t0789.exec:\t0789.exe57⤵
- Executes dropped EXE
PID:4692 -
\??\c:\7q90x3.exec:\7q90x3.exe58⤵
- Executes dropped EXE
PID:2528 -
\??\c:\66mae9.exec:\66mae9.exe59⤵
- Executes dropped EXE
PID:4544 -
\??\c:\d8ewc.exec:\d8ewc.exe60⤵
- Executes dropped EXE
PID:3508 -
\??\c:\4s5bk.exec:\4s5bk.exe61⤵
- Executes dropped EXE
PID:4608 -
\??\c:\33e4c.exec:\33e4c.exe62⤵
- Executes dropped EXE
PID:468 -
\??\c:\89pb91.exec:\89pb91.exe63⤵
- Executes dropped EXE
PID:3228 -
\??\c:\wo78g.exec:\wo78g.exe64⤵
- Executes dropped EXE
PID:4636 -
\??\c:\mm711w.exec:\mm711w.exe65⤵
- Executes dropped EXE
PID:924 -
\??\c:\96003n5.exec:\96003n5.exe66⤵PID:1444
-
\??\c:\73g775k.exec:\73g775k.exe67⤵PID:5080
-
\??\c:\56sk87x.exec:\56sk87x.exe68⤵PID:4892
-
\??\c:\581q6.exec:\581q6.exe69⤵PID:4332
-
\??\c:\p85ddcl.exec:\p85ddcl.exe70⤵PID:3276
-
\??\c:\2qjb4l.exec:\2qjb4l.exe71⤵PID:1752
-
\??\c:\7970of7.exec:\7970of7.exe72⤵PID:4252
-
\??\c:\96tu9la.exec:\96tu9la.exe73⤵PID:3420
-
\??\c:\u6i5177.exec:\u6i5177.exe74⤵PID:4884
-
\??\c:\ds75a5.exec:\ds75a5.exe75⤵PID:2360
-
\??\c:\2wp7w.exec:\2wp7w.exe76⤵PID:1916
-
\??\c:\0b7u5.exec:\0b7u5.exe77⤵PID:3212
-
\??\c:\367cu39.exec:\367cu39.exe78⤵PID:1624
-
\??\c:\xi4v7tw.exec:\xi4v7tw.exe79⤵PID:5024
-
\??\c:\if463.exec:\if463.exe80⤵PID:628
-
\??\c:\93pt4f.exec:\93pt4f.exe81⤵PID:2416
-
\??\c:\1r086a.exec:\1r086a.exe82⤵PID:1980
-
\??\c:\3b075w.exec:\3b075w.exe83⤵PID:1868
-
\??\c:\bwd579.exec:\bwd579.exe84⤵PID:3912
-
\??\c:\541cugd.exec:\541cugd.exe85⤵PID:1860
-
\??\c:\b7ol63.exec:\b7ol63.exe86⤵PID:3564
-
\??\c:\0n7ij.exec:\0n7ij.exe87⤵PID:3504
-
\??\c:\74m271c.exec:\74m271c.exe88⤵PID:440
-
\??\c:\4bku1.exec:\4bku1.exe89⤵PID:1080
-
\??\c:\dc7ic7.exec:\dc7ic7.exe90⤵PID:416
-
\??\c:\5dbxaei.exec:\5dbxaei.exe91⤵PID:2352
-
\??\c:\x90cs.exec:\x90cs.exe92⤵PID:3356
-
\??\c:\e1287.exec:\e1287.exe93⤵PID:4900
-
\??\c:\4i6l7r.exec:\4i6l7r.exe94⤵PID:2696
-
\??\c:\4m4kwi2.exec:\4m4kwi2.exe95⤵PID:2732
-
\??\c:\gq8k7.exec:\gq8k7.exe96⤵PID:832
-
\??\c:\070r755.exec:\070r755.exe97⤵PID:3852
-
\??\c:\0m79q.exec:\0m79q.exe98⤵PID:1984
-
\??\c:\4p357.exec:\4p357.exe99⤵PID:2204
-
\??\c:\6e34se.exec:\6e34se.exe100⤵PID:1724
-
\??\c:\512g9h6.exec:\512g9h6.exe101⤵PID:3772
-
\??\c:\ljv5kn3.exec:\ljv5kn3.exe102⤵PID:2840
-
\??\c:\d70b96c.exec:\d70b96c.exe103⤵PID:5112
-
\??\c:\5w3f0ow.exec:\5w3f0ow.exe104⤵PID:1988
-
\??\c:\q0dc4.exec:\q0dc4.exe105⤵PID:3780
-
\??\c:\u68tq.exec:\u68tq.exe106⤵PID:4736
-
\??\c:\150l74.exec:\150l74.exe107⤵PID:5012
-
\??\c:\7tu633.exec:\7tu633.exe108⤵PID:4968
-
\??\c:\242g2c5.exec:\242g2c5.exe109⤵PID:3084
-
\??\c:\pagko.exec:\pagko.exe110⤵PID:4060
-
\??\c:\qsc8aa.exec:\qsc8aa.exe111⤵PID:3224
-
\??\c:\3p56oi6.exec:\3p56oi6.exe112⤵PID:4684
-
\??\c:\5ul5729.exec:\5ul5729.exe113⤵PID:1484
-
\??\c:\6b8144p.exec:\6b8144p.exe114⤵PID:5004
-
\??\c:\ixs8k.exec:\ixs8k.exe115⤵PID:4892
-
\??\c:\97e46jf.exec:\97e46jf.exe116⤵PID:4560
-
\??\c:\hs3c353.exec:\hs3c353.exe117⤵PID:3276
-
\??\c:\dpebr.exec:\dpebr.exe118⤵PID:452
-
\??\c:\18s0cu5.exec:\18s0cu5.exe119⤵PID:4980
-
\??\c:\1kt4q9s.exec:\1kt4q9s.exe120⤵PID:564
-
\??\c:\975a8.exec:\975a8.exe121⤵PID:4064
-
\??\c:\h759fia.exec:\h759fia.exe122⤵PID:4388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-