Analysis
-
max time kernel
153s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/11/2022, 04:25
Behavioral task
behavioral1
Sample
2204f69c21a2879a979596a2df59a6dd283cde2b40cbf5051547329f0cfed407.exe
Resource
win7-20220812-en
5 signatures
150 seconds
General
-
Target
2204f69c21a2879a979596a2df59a6dd283cde2b40cbf5051547329f0cfed407.exe
-
Size
51KB
-
MD5
39c3acec9ffa8fac3d57b0e7880f2c20
-
SHA1
2aa16281a1508708d3ebcacf67ce42da5d4fe83e
-
SHA256
2204f69c21a2879a979596a2df59a6dd283cde2b40cbf5051547329f0cfed407
-
SHA512
ec71aadebcd4e06c5b89b4b6ebb46feb516d395d678a57058d67b11114465a450df036026c7d852092aa91f6ad8972790f3142dc4a2fd48058f758b2f96710ca
-
SSDEEP
1536:0vQBeOGtrYS3srx93UBWfwC6Ggnouy8CUYj7rc1:0hOmTsF93UYfwC6GIoutXIc1
Malware Config
Signatures
-
Detect Blackmoon payload 61 IoCs
resource yara_rule behavioral2/memory/3744-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2580-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1380-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3152-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2888-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4820-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3100-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1116-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3396-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4520-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2848-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/220-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/752-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2224-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4284-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4504-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/832-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3432-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2100-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4832-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4972-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4028-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3624-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2724-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4336-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4624-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4868-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5020-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2912-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1588-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3892-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1060-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/528-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2012-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1836-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1432-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/736-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3460-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3988-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/744-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4584-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1428-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1652-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3224-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3304-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3236-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/220-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4016-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4616-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4592-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3220-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/68-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1200-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5020-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2604-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3556-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4720-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4584-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2412-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2788-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1584-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2580 8i193.exe 1380 178l51.exe 3152 65wjs.exe 2888 563hc.exe 4820 2e6ip9.exe 4740 8w50q.exe 3100 67b1so.exe 1116 j5o5ska.exe 3176 st3p1.exe 1868 6okaws.exe 3396 99htsq.exe 2848 85c7q.exe 4520 63ab1o.exe 220 w1s157.exe 2224 a5m5n08.exe 752 31937el.exe 4284 5p6cb.exe 4504 81957i.exe 832 asko94a.exe 3432 6v9w9.exe 2100 8u9m2a.exe 404 ps27rdr.exe 4832 k2o16gd.exe 4972 8g65na5.exe 4028 hg378.exe 3624 1e9eg.exe 2724 r59r6w.exe 1804 av94h02.exe 1400 u2c78.exe 4336 e822j8h.exe 2312 35lt6nt.exe 2948 ui12l.exe 4624 j8u769.exe 4868 53s97.exe 1480 5cau2as.exe 4236 1ox4h9.exe 1852 njrfic.exe 5020 7592f.exe 5052 23c37d.exe 2912 1622731.exe 1588 391711p.exe 2604 o32m7u.exe 3892 ew3of58.exe 888 5c46o6.exe 2916 4205v3.exe 1092 9t6m9.exe 3940 0c1tw.exe 1952 kot07.exe 1060 691040r.exe 2424 a9i74.exe 1728 0r8mdo2.exe 528 95krq6.exe 2012 6931d.exe 1836 hajcb.exe 1432 cp559t.exe 1760 c9753.exe 736 cw78e1.exe 1416 8995kk9.exe 3440 n2cb67.exe 3460 4l2062.exe 3988 h8a40.exe 744 2d1r5kl.exe 3168 pe124.exe 3552 gc9wct7.exe -
resource yara_rule behavioral2/memory/3744-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0002000000021b42-134.dat upx behavioral2/files/0x0002000000021b42-135.dat upx behavioral2/memory/3744-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2580-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000022e03-139.dat upx behavioral2/files/0x000b000000022e03-140.dat upx behavioral2/files/0x0007000000022e0c-142.dat upx behavioral2/files/0x0007000000022e0c-143.dat upx behavioral2/memory/1380-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022e0d-146.dat upx behavioral2/files/0x0007000000022e0d-147.dat upx behavioral2/memory/3152-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022e11-151.dat upx behavioral2/files/0x0006000000022e11-150.dat upx behavioral2/memory/2888-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4820-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022e12-156.dat upx behavioral2/files/0x0006000000022e12-155.dat upx behavioral2/files/0x0006000000022e13-159.dat upx behavioral2/files/0x0006000000022e13-158.dat upx behavioral2/files/0x0006000000022e14-163.dat upx behavioral2/memory/3100-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022e15-165.dat upx behavioral2/files/0x0006000000022e14-161.dat upx behavioral2/files/0x0006000000022e15-166.dat upx behavioral2/memory/1116-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022e16-169.dat upx behavioral2/files/0x0006000000022e16-170.dat upx behavioral2/files/0x0006000000022e17-172.dat upx behavioral2/files/0x0006000000022e17-173.dat upx behavioral2/memory/3396-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022e18-178.dat upx behavioral2/memory/3396-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022e18-176.dat upx behavioral2/files/0x0006000000022e1a-185.dat upx behavioral2/files/0x0006000000022e1a-184.dat upx behavioral2/memory/4520-186-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022e19-182.dat upx behavioral2/memory/2848-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022e19-180.dat upx behavioral2/memory/220-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022e1b-190.dat upx behavioral2/files/0x0006000000022e1b-189.dat upx behavioral2/files/0x0006000000022e1c-192.dat upx behavioral2/files/0x0006000000022e1c-194.dat upx behavioral2/files/0x0006000000022e1e-197.dat upx behavioral2/memory/752-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022e1e-196.dat upx behavioral2/memory/2224-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4284-199-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022e1f-201.dat upx behavioral2/files/0x0006000000022e1f-202.dat upx behavioral2/files/0x0006000000022e20-206.dat upx behavioral2/memory/4504-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022e20-204.dat upx behavioral2/files/0x0006000000022e21-208.dat upx behavioral2/files/0x0006000000022e21-210.dat upx behavioral2/memory/832-209-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022e22-214.dat upx behavioral2/memory/3432-213-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022e22-212.dat upx behavioral2/memory/2100-218-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022e23-217.dat upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3744 wrote to memory of 2580 3744 2204f69c21a2879a979596a2df59a6dd283cde2b40cbf5051547329f0cfed407.exe 81 PID 3744 wrote to memory of 2580 3744 2204f69c21a2879a979596a2df59a6dd283cde2b40cbf5051547329f0cfed407.exe 81 PID 3744 wrote to memory of 2580 3744 2204f69c21a2879a979596a2df59a6dd283cde2b40cbf5051547329f0cfed407.exe 81 PID 2580 wrote to memory of 1380 2580 8i193.exe 83 PID 2580 wrote to memory of 1380 2580 8i193.exe 83 PID 2580 wrote to memory of 1380 2580 8i193.exe 83 PID 1380 wrote to memory of 3152 1380 178l51.exe 84 PID 1380 wrote to memory of 3152 1380 178l51.exe 84 PID 1380 wrote to memory of 3152 1380 178l51.exe 84 PID 3152 wrote to memory of 2888 3152 65wjs.exe 85 PID 3152 wrote to memory of 2888 3152 65wjs.exe 85 PID 3152 wrote to memory of 2888 3152 65wjs.exe 85 PID 2888 wrote to memory of 4820 2888 563hc.exe 87 PID 2888 wrote to memory of 4820 2888 563hc.exe 87 PID 2888 wrote to memory of 4820 2888 563hc.exe 87 PID 4820 wrote to memory of 4740 4820 2e6ip9.exe 88 PID 4820 wrote to memory of 4740 4820 2e6ip9.exe 88 PID 4820 wrote to memory of 4740 4820 2e6ip9.exe 88 PID 4740 wrote to memory of 3100 4740 8w50q.exe 89 PID 4740 wrote to memory of 3100 4740 8w50q.exe 89 PID 4740 wrote to memory of 3100 4740 8w50q.exe 89 PID 3100 wrote to memory of 1116 3100 67b1so.exe 90 PID 3100 wrote to memory of 1116 3100 67b1so.exe 90 PID 3100 wrote to memory of 1116 3100 67b1so.exe 90 PID 1116 wrote to memory of 3176 1116 j5o5ska.exe 91 PID 1116 wrote to memory of 3176 1116 j5o5ska.exe 91 PID 1116 wrote to memory of 3176 1116 j5o5ska.exe 91 PID 3176 wrote to memory of 1868 3176 st3p1.exe 92 PID 3176 wrote to memory of 1868 3176 st3p1.exe 92 PID 3176 wrote to memory of 1868 3176 st3p1.exe 92 PID 1868 wrote to memory of 3396 1868 6okaws.exe 93 PID 1868 wrote to memory of 3396 1868 6okaws.exe 93 PID 1868 wrote to memory of 3396 1868 6okaws.exe 93 PID 3396 wrote to memory of 2848 3396 99htsq.exe 94 PID 3396 wrote to memory of 2848 3396 99htsq.exe 94 PID 3396 wrote to memory of 2848 3396 99htsq.exe 94 PID 2848 wrote to memory of 4520 2848 85c7q.exe 95 PID 2848 wrote to memory of 4520 2848 85c7q.exe 95 PID 2848 wrote to memory of 4520 2848 85c7q.exe 95 PID 4520 wrote to memory of 220 4520 63ab1o.exe 96 PID 4520 wrote to memory of 220 4520 63ab1o.exe 96 PID 4520 wrote to memory of 220 4520 63ab1o.exe 96 PID 220 wrote to memory of 2224 220 w1s157.exe 97 PID 220 wrote to memory of 2224 220 w1s157.exe 97 PID 220 wrote to memory of 2224 220 w1s157.exe 97 PID 2224 wrote to memory of 752 2224 a5m5n08.exe 98 PID 2224 wrote to memory of 752 2224 a5m5n08.exe 98 PID 2224 wrote to memory of 752 2224 a5m5n08.exe 98 PID 752 wrote to memory of 4284 752 31937el.exe 99 PID 752 wrote to memory of 4284 752 31937el.exe 99 PID 752 wrote to memory of 4284 752 31937el.exe 99 PID 4284 wrote to memory of 4504 4284 5p6cb.exe 100 PID 4284 wrote to memory of 4504 4284 5p6cb.exe 100 PID 4284 wrote to memory of 4504 4284 5p6cb.exe 100 PID 4504 wrote to memory of 832 4504 81957i.exe 101 PID 4504 wrote to memory of 832 4504 81957i.exe 101 PID 4504 wrote to memory of 832 4504 81957i.exe 101 PID 832 wrote to memory of 3432 832 asko94a.exe 102 PID 832 wrote to memory of 3432 832 asko94a.exe 102 PID 832 wrote to memory of 3432 832 asko94a.exe 102 PID 3432 wrote to memory of 2100 3432 6v9w9.exe 103 PID 3432 wrote to memory of 2100 3432 6v9w9.exe 103 PID 3432 wrote to memory of 2100 3432 6v9w9.exe 103 PID 2100 wrote to memory of 404 2100 8u9m2a.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2204f69c21a2879a979596a2df59a6dd283cde2b40cbf5051547329f0cfed407.exe"C:\Users\Admin\AppData\Local\Temp\2204f69c21a2879a979596a2df59a6dd283cde2b40cbf5051547329f0cfed407.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\8i193.exec:\8i193.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\178l51.exec:\178l51.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\65wjs.exec:\65wjs.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\563hc.exec:\563hc.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\2e6ip9.exec:\2e6ip9.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\8w50q.exec:\8w50q.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
\??\c:\67b1so.exec:\67b1so.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\j5o5ska.exec:\j5o5ska.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\st3p1.exec:\st3p1.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\6okaws.exec:\6okaws.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\99htsq.exec:\99htsq.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
\??\c:\85c7q.exec:\85c7q.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\63ab1o.exec:\63ab1o.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\w1s157.exec:\w1s157.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\a5m5n08.exec:\a5m5n08.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\31937el.exec:\31937el.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\5p6cb.exec:\5p6cb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\81957i.exec:\81957i.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\asko94a.exec:\asko94a.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\6v9w9.exec:\6v9w9.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\8u9m2a.exec:\8u9m2a.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\ps27rdr.exec:\ps27rdr.exe23⤵
- Executes dropped EXE
PID:404 -
\??\c:\k2o16gd.exec:\k2o16gd.exe24⤵
- Executes dropped EXE
PID:4832 -
\??\c:\8g65na5.exec:\8g65na5.exe25⤵
- Executes dropped EXE
PID:4972 -
\??\c:\hg378.exec:\hg378.exe26⤵
- Executes dropped EXE
PID:4028 -
\??\c:\1e9eg.exec:\1e9eg.exe27⤵
- Executes dropped EXE
PID:3624 -
\??\c:\r59r6w.exec:\r59r6w.exe28⤵
- Executes dropped EXE
PID:2724 -
\??\c:\av94h02.exec:\av94h02.exe29⤵
- Executes dropped EXE
PID:1804 -
\??\c:\u2c78.exec:\u2c78.exe30⤵
- Executes dropped EXE
PID:1400 -
\??\c:\e822j8h.exec:\e822j8h.exe31⤵
- Executes dropped EXE
PID:4336 -
\??\c:\35lt6nt.exec:\35lt6nt.exe32⤵
- Executes dropped EXE
PID:2312 -
\??\c:\ui12l.exec:\ui12l.exe33⤵
- Executes dropped EXE
PID:2948 -
\??\c:\j8u769.exec:\j8u769.exe34⤵
- Executes dropped EXE
PID:4624 -
\??\c:\53s97.exec:\53s97.exe35⤵
- Executes dropped EXE
PID:4868 -
\??\c:\5cau2as.exec:\5cau2as.exe36⤵
- Executes dropped EXE
PID:1480 -
\??\c:\1ox4h9.exec:\1ox4h9.exe37⤵
- Executes dropped EXE
PID:4236 -
\??\c:\njrfic.exec:\njrfic.exe38⤵
- Executes dropped EXE
PID:1852 -
\??\c:\7592f.exec:\7592f.exe39⤵
- Executes dropped EXE
PID:5020 -
\??\c:\23c37d.exec:\23c37d.exe40⤵
- Executes dropped EXE
PID:5052 -
\??\c:\1622731.exec:\1622731.exe41⤵
- Executes dropped EXE
PID:2912 -
\??\c:\391711p.exec:\391711p.exe42⤵
- Executes dropped EXE
PID:1588 -
\??\c:\o32m7u.exec:\o32m7u.exe43⤵
- Executes dropped EXE
PID:2604 -
\??\c:\ew3of58.exec:\ew3of58.exe44⤵
- Executes dropped EXE
PID:3892 -
\??\c:\5c46o6.exec:\5c46o6.exe45⤵
- Executes dropped EXE
PID:888 -
\??\c:\4205v3.exec:\4205v3.exe46⤵
- Executes dropped EXE
PID:2916 -
\??\c:\9t6m9.exec:\9t6m9.exe47⤵
- Executes dropped EXE
PID:1092 -
\??\c:\0c1tw.exec:\0c1tw.exe48⤵
- Executes dropped EXE
PID:3940 -
\??\c:\kot07.exec:\kot07.exe49⤵
- Executes dropped EXE
PID:1952 -
\??\c:\691040r.exec:\691040r.exe50⤵
- Executes dropped EXE
PID:1060 -
\??\c:\a9i74.exec:\a9i74.exe51⤵
- Executes dropped EXE
PID:2424 -
\??\c:\0r8mdo2.exec:\0r8mdo2.exe52⤵
- Executes dropped EXE
PID:1728 -
\??\c:\95krq6.exec:\95krq6.exe53⤵
- Executes dropped EXE
PID:528 -
\??\c:\6931d.exec:\6931d.exe54⤵
- Executes dropped EXE
PID:2012 -
\??\c:\hajcb.exec:\hajcb.exe55⤵
- Executes dropped EXE
PID:1836 -
\??\c:\cp559t.exec:\cp559t.exe56⤵
- Executes dropped EXE
PID:1432 -
\??\c:\c9753.exec:\c9753.exe57⤵
- Executes dropped EXE
PID:1760 -
\??\c:\cw78e1.exec:\cw78e1.exe58⤵
- Executes dropped EXE
PID:736 -
\??\c:\8995kk9.exec:\8995kk9.exe59⤵
- Executes dropped EXE
PID:1416 -
\??\c:\n2cb67.exec:\n2cb67.exe60⤵
- Executes dropped EXE
PID:3440 -
\??\c:\4l2062.exec:\4l2062.exe61⤵
- Executes dropped EXE
PID:3460 -
\??\c:\h8a40.exec:\h8a40.exe62⤵
- Executes dropped EXE
PID:3988 -
\??\c:\2d1r5kl.exec:\2d1r5kl.exe63⤵
- Executes dropped EXE
PID:744 -
\??\c:\pe124.exec:\pe124.exe64⤵
- Executes dropped EXE
PID:3168 -
\??\c:\gc9wct7.exec:\gc9wct7.exe65⤵
- Executes dropped EXE
PID:3552 -
\??\c:\gdg5pw.exec:\gdg5pw.exe66⤵PID:4044
-
\??\c:\x92m1.exec:\x92m1.exe67⤵PID:5084
-
\??\c:\r48d7.exec:\r48d7.exe68⤵PID:4584
-
\??\c:\hp88g1.exec:\hp88g1.exe69⤵PID:1428
-
\??\c:\nb66s9.exec:\nb66s9.exe70⤵PID:4152
-
\??\c:\qd71357.exec:\qd71357.exe71⤵PID:3596
-
\??\c:\h5r54t.exec:\h5r54t.exe72⤵PID:5032
-
\??\c:\sm70330.exec:\sm70330.exe73⤵PID:4516
-
\??\c:\em17359.exec:\em17359.exe74⤵PID:1652
-
\??\c:\46b3tgv.exec:\46b3tgv.exe75⤵PID:1068
-
\??\c:\774tp4.exec:\774tp4.exe76⤵PID:4880
-
\??\c:\f99k9uh.exec:\f99k9uh.exe77⤵PID:2888
-
\??\c:\439f42.exec:\439f42.exe78⤵PID:660
-
\??\c:\u35e991.exec:\u35e991.exe79⤵PID:1208
-
\??\c:\f3i75p.exec:\f3i75p.exe80⤵PID:4820
-
\??\c:\i99ci.exec:\i99ci.exe81⤵PID:5004
-
\??\c:\94x48nf.exec:\94x48nf.exe82⤵PID:4220
-
\??\c:\14b4cr.exec:\14b4cr.exe83⤵PID:5040
-
\??\c:\086l8d.exec:\086l8d.exe84⤵PID:3224
-
\??\c:\w3f64.exec:\w3f64.exe85⤵PID:1984
-
\??\c:\n47ok.exec:\n47ok.exe86⤵PID:3212
-
\??\c:\x9iaew.exec:\x9iaew.exe87⤵PID:3304
-
\??\c:\6d3khu.exec:\6d3khu.exe88⤵PID:4204
-
\??\c:\4n0sa.exec:\4n0sa.exe89⤵PID:720
-
\??\c:\1t0e30.exec:\1t0e30.exe90⤵PID:3236
-
\??\c:\h4rnwa6.exec:\h4rnwa6.exe91⤵PID:4188
-
\??\c:\ippi1p.exec:\ippi1p.exe92⤵PID:112
-
\??\c:\u47jxv.exec:\u47jxv.exe93⤵PID:2228
-
\??\c:\55c33.exec:\55c33.exe94⤵PID:220
-
\??\c:\qqt8s.exec:\qqt8s.exe95⤵PID:3360
-
\??\c:\8kj6l.exec:\8kj6l.exe96⤵PID:4332
-
\??\c:\5uqggug.exec:\5uqggug.exe97⤵PID:4436
-
\??\c:\5p9nos.exec:\5p9nos.exe98⤵PID:4728
-
\??\c:\0wn7q.exec:\0wn7q.exe99⤵PID:4524
-
\??\c:\eu930a9.exec:\eu930a9.exe100⤵PID:832
-
\??\c:\29a1q5.exec:\29a1q5.exe101⤵PID:4016
-
\??\c:\64rbsaq.exec:\64rbsaq.exe102⤵PID:3484
-
\??\c:\j18tdok.exec:\j18tdok.exe103⤵PID:404
-
\??\c:\2swi9.exec:\2swi9.exe104⤵PID:4992
-
\??\c:\x2mggi.exec:\x2mggi.exe105⤵PID:4972
-
\??\c:\3dwbr.exec:\3dwbr.exe106⤵PID:2836
-
\??\c:\7pb2g.exec:\7pb2g.exe107⤵PID:4616
-
\??\c:\8b1exg.exec:\8b1exg.exe108⤵PID:4592
-
\??\c:\7f4533.exec:\7f4533.exe109⤵PID:4736
-
\??\c:\xdii1.exec:\xdii1.exe110⤵PID:3220
-
\??\c:\114u19.exec:\114u19.exe111⤵PID:3976
-
\??\c:\r0a19gx.exec:\r0a19gx.exe112⤵PID:2116
-
\??\c:\921d312.exec:\921d312.exe113⤵PID:1548
-
\??\c:\sh78h5k.exec:\sh78h5k.exe114⤵PID:1112
-
\??\c:\w2gs0.exec:\w2gs0.exe115⤵PID:4772
-
\??\c:\pgd7u1.exec:\pgd7u1.exe116⤵PID:3780
-
\??\c:\aw4mr1.exec:\aw4mr1.exe117⤵PID:4196
-
\??\c:\u1qnq.exec:\u1qnq.exe118⤵PID:1964
-
\??\c:\l7s743r.exec:\l7s743r.exe119⤵PID:2236
-
\??\c:\49108.exec:\49108.exe120⤵PID:68
-
\??\c:\p8cs42l.exec:\p8cs42l.exe121⤵PID:4848
-
\??\c:\6qs5cc.exec:\6qs5cc.exe122⤵PID:4868
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-