Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
27/07/2024, 03:02
Behavioral task
behavioral1
Sample
8621402331215fb2efbf8810742d3fb0N.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
120 seconds
General
-
Target
8621402331215fb2efbf8810742d3fb0N.exe
-
Size
126KB
-
MD5
8621402331215fb2efbf8810742d3fb0
-
SHA1
d39f794c951eb543a5b308b5451ffbcb53951d4a
-
SHA256
689d1b56c18954d6ccaef7aae32f931ca4c7b99fa37e396b14f3b3ab48fa9251
-
SHA512
50a53e889d37dad19e6b4ef43d7bfcd3274f64c750bfee6c4c12f7b5af7c2551b37c48bdec594b436bec658f921210588d833e5b68feab4bcb33f0b59be8de98
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutz5yLpcgDE4JgY0nU+:9cm4FmowdHoS49oU+
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2140-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2080-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1004-54-0x0000000001B80000-0x0000000001BA7000-memory.dmp family_blackmoon behavioral1/memory/2684-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2632-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2088-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1940-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1276-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2868-121-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2868-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2920-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2328-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/340-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1896-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2096-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/604-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2156-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2196-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2576-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2716-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2004-374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1100-405-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1140-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/340-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2064-457-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2204-470-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2248-521-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/864-547-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-566-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-689-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2100-759-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2816-1094-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-1404-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2080 48062.exe 2820 022026.exe 2636 44624.exe 2672 6642088.exe 1004 824084.exe 2684 62222.exe 2632 0424620.exe 2088 4284246.exe 1940 488402.exe 1276 48868.exe 2492 6668068.exe 2868 608826.exe 1220 20268.exe 2612 4482880.exe 2920 4480480.exe 2212 886268.exe 340 48242.exe 2328 8202624.exe 2340 6046846.exe 1816 0868480.exe 1896 262808.exe 2236 62228.exe 884 8206426.exe 2100 2286044.exe 2096 268624.exe 772 82846.exe 604 m8488.exe 2248 820246.exe 2156 824608.exe 2988 06260.exe 2140 8206068.exe 2196 284260.exe 1620 68066.exe 2840 40460.exe 3000 u644668.exe 2996 046240.exe 2884 288608.exe 2648 60400.exe 2780 2246020.exe 2576 0424242.exe 2120 q86024.exe 2724 82242.exe 2716 6086802.exe 2004 048844.exe 1312 684284.exe 3020 22246.exe 2936 4802406.exe 2948 466020.exe 2476 00660.exe 1100 28422.exe 2796 0466280.exe 440 666246.exe 1140 004682.exe 2052 a6240.exe 340 6848402.exe 2344 8820800.exe 2064 662668.exe 2112 04882.exe 2204 84844.exe 1896 4602402.exe 1656 k42022.exe 1756 882466.exe 1176 00422.exe 1488 6222424.exe -
resource yara_rule behavioral1/memory/2140-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000010300-7.dat upx behavioral1/memory/2080-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2820-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0017000000018649-19.dat upx behavioral1/memory/2080-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000018654-27.dat upx behavioral1/memory/2636-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2820-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000186ed-35.dat upx behavioral1/memory/2636-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000186ef-46.dat upx behavioral1/memory/2672-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000186ff-56.dat upx behavioral1/memory/1004-55-0x0000000001B80000-0x0000000001BA7000-memory.dmp upx behavioral1/memory/2684-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2684-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000018764-66.dat upx behavioral1/files/0x0007000000019409-73.dat upx behavioral1/memory/2088-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2632-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000196e4-85.dat upx behavioral1/memory/2088-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1940-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000196e9-92.dat upx behavioral1/memory/1276-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019700-102.dat upx behavioral1/files/0x000500000001971e-108.dat upx behavioral1/memory/2868-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000198ed-122.dat upx behavioral1/memory/2868-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000198f1-129.dat upx behavioral1/memory/2612-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001994f-139.dat upx behavioral1/files/0x000500000001997b-149.dat upx behavioral1/memory/2920-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019ade-156.dat upx behavioral1/files/0x0005000000019c49-163.dat upx behavioral1/memory/2328-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/340-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c4b-175.dat upx behavioral1/files/0x0005000000019c4d-184.dat upx behavioral1/files/0x0005000000019d55-191.dat upx behavioral1/files/0x0005000000019db2-198.dat upx behavioral1/memory/1896-200-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019db4-208.dat upx behavioral1/files/0x0005000000019eb7-215.dat upx behavioral1/files/0x0005000000019f13-224.dat upx behavioral1/files/0x000500000001a033-235.dat upx behavioral1/memory/772-234-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a03b-242.dat upx behavioral1/memory/2096-232-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/604-251-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a09b-249.dat upx behavioral1/memory/2248-252-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a0a1-260.dat upx behavioral1/files/0x00350000000173ac-269.dat upx behavioral1/memory/2156-268-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a0da-277.dat upx behavioral1/files/0x000500000001a3c3-286.dat upx behavioral1/memory/1620-294-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2196-293-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2996-313-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2884-320-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language k26802.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48028.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 608020.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62222.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4420846.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26428.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48868.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42802.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2140 wrote to memory of 2080 2140 8621402331215fb2efbf8810742d3fb0N.exe 30 PID 2140 wrote to memory of 2080 2140 8621402331215fb2efbf8810742d3fb0N.exe 30 PID 2140 wrote to memory of 2080 2140 8621402331215fb2efbf8810742d3fb0N.exe 30 PID 2140 wrote to memory of 2080 2140 8621402331215fb2efbf8810742d3fb0N.exe 30 PID 2080 wrote to memory of 2820 2080 48062.exe 31 PID 2080 wrote to memory of 2820 2080 48062.exe 31 PID 2080 wrote to memory of 2820 2080 48062.exe 31 PID 2080 wrote to memory of 2820 2080 48062.exe 31 PID 2820 wrote to memory of 2636 2820 022026.exe 32 PID 2820 wrote to memory of 2636 2820 022026.exe 32 PID 2820 wrote to memory of 2636 2820 022026.exe 32 PID 2820 wrote to memory of 2636 2820 022026.exe 32 PID 2636 wrote to memory of 2672 2636 44624.exe 33 PID 2636 wrote to memory of 2672 2636 44624.exe 33 PID 2636 wrote to memory of 2672 2636 44624.exe 33 PID 2636 wrote to memory of 2672 2636 44624.exe 33 PID 2672 wrote to memory of 1004 2672 6642088.exe 34 PID 2672 wrote to memory of 1004 2672 6642088.exe 34 PID 2672 wrote to memory of 1004 2672 6642088.exe 34 PID 2672 wrote to memory of 1004 2672 6642088.exe 34 PID 1004 wrote to memory of 2684 1004 824084.exe 35 PID 1004 wrote to memory of 2684 1004 824084.exe 35 PID 1004 wrote to memory of 2684 1004 824084.exe 35 PID 1004 wrote to memory of 2684 1004 824084.exe 35 PID 2684 wrote to memory of 2632 2684 62222.exe 36 PID 2684 wrote to memory of 2632 2684 62222.exe 36 PID 2684 wrote to memory of 2632 2684 62222.exe 36 PID 2684 wrote to memory of 2632 2684 62222.exe 36 PID 2632 wrote to memory of 2088 2632 0424620.exe 37 PID 2632 wrote to memory of 2088 2632 0424620.exe 37 PID 2632 wrote to memory of 2088 2632 0424620.exe 37 PID 2632 wrote to memory of 2088 2632 0424620.exe 37 PID 2088 wrote to memory of 1940 2088 4284246.exe 38 PID 2088 wrote to memory of 1940 2088 4284246.exe 38 PID 2088 wrote to memory of 1940 2088 4284246.exe 38 PID 2088 wrote to memory of 1940 2088 4284246.exe 38 PID 1940 wrote to memory of 1276 1940 488402.exe 39 PID 1940 wrote to memory of 1276 1940 488402.exe 39 PID 1940 wrote to memory of 1276 1940 488402.exe 39 PID 1940 wrote to memory of 1276 1940 488402.exe 39 PID 1276 wrote to memory of 2492 1276 48868.exe 40 PID 1276 wrote to memory of 2492 1276 48868.exe 40 PID 1276 wrote to memory of 2492 1276 48868.exe 40 PID 1276 wrote to memory of 2492 1276 48868.exe 40 PID 2492 wrote to memory of 2868 2492 6668068.exe 41 PID 2492 wrote to memory of 2868 2492 6668068.exe 41 PID 2492 wrote to memory of 2868 2492 6668068.exe 41 PID 2492 wrote to memory of 2868 2492 6668068.exe 41 PID 2868 wrote to memory of 1220 2868 608826.exe 42 PID 2868 wrote to memory of 1220 2868 608826.exe 42 PID 2868 wrote to memory of 1220 2868 608826.exe 42 PID 2868 wrote to memory of 1220 2868 608826.exe 42 PID 1220 wrote to memory of 2612 1220 20268.exe 43 PID 1220 wrote to memory of 2612 1220 20268.exe 43 PID 1220 wrote to memory of 2612 1220 20268.exe 43 PID 1220 wrote to memory of 2612 1220 20268.exe 43 PID 2612 wrote to memory of 2920 2612 4482880.exe 44 PID 2612 wrote to memory of 2920 2612 4482880.exe 44 PID 2612 wrote to memory of 2920 2612 4482880.exe 44 PID 2612 wrote to memory of 2920 2612 4482880.exe 44 PID 2920 wrote to memory of 2212 2920 4480480.exe 45 PID 2920 wrote to memory of 2212 2920 4480480.exe 45 PID 2920 wrote to memory of 2212 2920 4480480.exe 45 PID 2920 wrote to memory of 2212 2920 4480480.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\8621402331215fb2efbf8810742d3fb0N.exe"C:\Users\Admin\AppData\Local\Temp\8621402331215fb2efbf8810742d3fb0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\48062.exec:\48062.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\022026.exec:\022026.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\44624.exec:\44624.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\6642088.exec:\6642088.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\824084.exec:\824084.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\62222.exec:\62222.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\0424620.exec:\0424620.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\4284246.exec:\4284246.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\488402.exec:\488402.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\48868.exec:\48868.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\6668068.exec:\6668068.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\608826.exec:\608826.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\20268.exec:\20268.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\4482880.exec:\4482880.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\4480480.exec:\4480480.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\886268.exec:\886268.exe17⤵
- Executes dropped EXE
PID:2212 -
\??\c:\48242.exec:\48242.exe18⤵
- Executes dropped EXE
PID:340 -
\??\c:\8202624.exec:\8202624.exe19⤵
- Executes dropped EXE
PID:2328 -
\??\c:\6046846.exec:\6046846.exe20⤵
- Executes dropped EXE
PID:2340 -
\??\c:\0868480.exec:\0868480.exe21⤵
- Executes dropped EXE
PID:1816 -
\??\c:\262808.exec:\262808.exe22⤵
- Executes dropped EXE
PID:1896 -
\??\c:\62228.exec:\62228.exe23⤵
- Executes dropped EXE
PID:2236 -
\??\c:\8206426.exec:\8206426.exe24⤵
- Executes dropped EXE
PID:884 -
\??\c:\2286044.exec:\2286044.exe25⤵
- Executes dropped EXE
PID:2100 -
\??\c:\268624.exec:\268624.exe26⤵
- Executes dropped EXE
PID:2096 -
\??\c:\82846.exec:\82846.exe27⤵
- Executes dropped EXE
PID:772 -
\??\c:\m8488.exec:\m8488.exe28⤵
- Executes dropped EXE
PID:604 -
\??\c:\820246.exec:\820246.exe29⤵
- Executes dropped EXE
PID:2248 -
\??\c:\824608.exec:\824608.exe30⤵
- Executes dropped EXE
PID:2156 -
\??\c:\06260.exec:\06260.exe31⤵
- Executes dropped EXE
PID:2988 -
\??\c:\8206068.exec:\8206068.exe32⤵
- Executes dropped EXE
PID:2140 -
\??\c:\284260.exec:\284260.exe33⤵
- Executes dropped EXE
PID:2196 -
\??\c:\68066.exec:\68066.exe34⤵
- Executes dropped EXE
PID:1620 -
\??\c:\40460.exec:\40460.exe35⤵
- Executes dropped EXE
PID:2840 -
\??\c:\u644668.exec:\u644668.exe36⤵
- Executes dropped EXE
PID:3000 -
\??\c:\046240.exec:\046240.exe37⤵
- Executes dropped EXE
PID:2996 -
\??\c:\288608.exec:\288608.exe38⤵
- Executes dropped EXE
PID:2884 -
\??\c:\60400.exec:\60400.exe39⤵
- Executes dropped EXE
PID:2648 -
\??\c:\2246020.exec:\2246020.exe40⤵
- Executes dropped EXE
PID:2780 -
\??\c:\0424242.exec:\0424242.exe41⤵
- Executes dropped EXE
PID:2576 -
\??\c:\q86024.exec:\q86024.exe42⤵
- Executes dropped EXE
PID:2120 -
\??\c:\82242.exec:\82242.exe43⤵
- Executes dropped EXE
PID:2724 -
\??\c:\6086802.exec:\6086802.exe44⤵
- Executes dropped EXE
PID:2716 -
\??\c:\048844.exec:\048844.exe45⤵
- Executes dropped EXE
PID:2004 -
\??\c:\684284.exec:\684284.exe46⤵
- Executes dropped EXE
PID:1312 -
\??\c:\22246.exec:\22246.exe47⤵
- Executes dropped EXE
PID:3020 -
\??\c:\4802406.exec:\4802406.exe48⤵
- Executes dropped EXE
PID:2936 -
\??\c:\466020.exec:\466020.exe49⤵
- Executes dropped EXE
PID:2948 -
\??\c:\00660.exec:\00660.exe50⤵
- Executes dropped EXE
PID:2476 -
\??\c:\28422.exec:\28422.exe51⤵
- Executes dropped EXE
PID:1100 -
\??\c:\0466280.exec:\0466280.exe52⤵
- Executes dropped EXE
PID:2796 -
\??\c:\666246.exec:\666246.exe53⤵
- Executes dropped EXE
PID:440 -
\??\c:\004682.exec:\004682.exe54⤵
- Executes dropped EXE
PID:1140 -
\??\c:\a6240.exec:\a6240.exe55⤵
- Executes dropped EXE
PID:2052 -
\??\c:\6848402.exec:\6848402.exe56⤵
- Executes dropped EXE
PID:340 -
\??\c:\8820800.exec:\8820800.exe57⤵
- Executes dropped EXE
PID:2344 -
\??\c:\662668.exec:\662668.exe58⤵
- Executes dropped EXE
PID:2064 -
\??\c:\04882.exec:\04882.exe59⤵
- Executes dropped EXE
PID:2112 -
\??\c:\84844.exec:\84844.exe60⤵
- Executes dropped EXE
PID:2204 -
\??\c:\4602402.exec:\4602402.exe61⤵
- Executes dropped EXE
PID:1896 -
\??\c:\k42022.exec:\k42022.exe62⤵
- Executes dropped EXE
PID:1656 -
\??\c:\882466.exec:\882466.exe63⤵
- Executes dropped EXE
PID:1756 -
\??\c:\00422.exec:\00422.exe64⤵
- Executes dropped EXE
PID:1176 -
\??\c:\6222424.exec:\6222424.exe65⤵
- Executes dropped EXE
PID:1488 -
\??\c:\k62442.exec:\k62442.exe66⤵PID:1672
-
\??\c:\400464.exec:\400464.exe67⤵PID:3048
-
\??\c:\26486.exec:\26486.exe68⤵PID:2068
-
\??\c:\c248822.exec:\c248822.exe69⤵PID:2248
-
\??\c:\6462444.exec:\6462444.exe70⤵PID:1200
-
\??\c:\666406.exec:\666406.exe71⤵PID:2152
-
\??\c:\84864.exec:\84864.exe72⤵PID:864
-
\??\c:\00200.exec:\00200.exe73⤵PID:1072
-
\??\c:\6264422.exec:\6264422.exe74⤵PID:2452
-
\??\c:\848208.exec:\848208.exe75⤵PID:2816
-
\??\c:\82620.exec:\82620.exe76⤵PID:3012
-
\??\c:\0402840.exec:\0402840.exe77⤵PID:2820
-
\??\c:\8246880.exec:\8246880.exe78⤵PID:2628
-
\??\c:\028620.exec:\028620.exe79⤵PID:2008
-
\??\c:\64808.exec:\64808.exe80⤵PID:2672
-
\??\c:\24428.exec:\24428.exe81⤵PID:2760
-
\??\c:\0828060.exec:\0828060.exe82⤵PID:2528
-
\??\c:\466248.exec:\466248.exe83⤵PID:2680
-
\??\c:\820086.exec:\820086.exe84⤵PID:2084
-
\??\c:\g2408.exec:\g2408.exe85⤵PID:2480
-
\??\c:\4006402.exec:\4006402.exe86⤵PID:1080
-
\??\c:\4420820.exec:\4420820.exe87⤵PID:1956
-
\??\c:\626006.exec:\626006.exe88⤵PID:1684
-
\??\c:\482866.exec:\482866.exe89⤵PID:1312
-
\??\c:\86886.exec:\86886.exe90⤵PID:2496
-
\??\c:\o640246.exec:\o640246.exe91⤵PID:2936
-
\??\c:\8608848.exec:\8608848.exe92⤵PID:2736
-
\??\c:\848042.exec:\848042.exe93⤵PID:2612
-
\??\c:\82246.exec:\82246.exe94⤵PID:2940
-
\??\c:\66080.exec:\66080.exe95⤵PID:2796
-
\??\c:\8488620.exec:\8488620.exe96⤵PID:2212
-
\??\c:\8288624.exec:\8288624.exe97⤵PID:764
-
\??\c:\608020.exec:\608020.exe98⤵
- System Location Discovery: System Language Discovery
PID:1048 -
\??\c:\266888.exec:\266888.exe99⤵PID:2076
-
\??\c:\82264.exec:\82264.exe100⤵PID:1240
-
\??\c:\4846606.exec:\4846606.exe101⤵PID:2128
-
\??\c:\8040464.exec:\8040464.exe102⤵PID:2356
-
\??\c:\004082.exec:\004082.exe103⤵PID:792
-
\??\c:\g6686.exec:\g6686.exe104⤵PID:336
-
\??\c:\s8488.exec:\s8488.exe105⤵PID:2460
-
\??\c:\6084244.exec:\6084244.exe106⤵PID:2100
-
\??\c:\248486.exec:\248486.exe107⤵PID:1124
-
\??\c:\680464.exec:\680464.exe108⤵PID:772
-
\??\c:\02284.exec:\02284.exe109⤵PID:1672
-
\??\c:\8824802.exec:\8824802.exe110⤵PID:1948
-
\??\c:\w42846.exec:\w42846.exe111⤵PID:2068
-
\??\c:\04262.exec:\04262.exe112⤵PID:1492
-
\??\c:\42668.exec:\42668.exe113⤵PID:1780
-
\??\c:\6222266.exec:\6222266.exe114⤵PID:2152
-
\??\c:\066486.exec:\066486.exe115⤵PID:2284
-
\??\c:\006686.exec:\006686.exe116⤵PID:1608
-
\??\c:\80006.exec:\80006.exe117⤵PID:2360
-
\??\c:\00868.exec:\00868.exe118⤵PID:1620
-
\??\c:\4864620.exec:\4864620.exe119⤵PID:2616
-
\??\c:\804806.exec:\804806.exe120⤵PID:2784
-
\??\c:\00488.exec:\00488.exe121⤵PID:2848
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-