Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
15-10-2023 19:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bd4165b4c2a660c44d1da67be7f0afd0_exe32.exe
Resource
win7-20230831-en
windows7-x64
5 signatures
150 seconds
General
-
Target
bd4165b4c2a660c44d1da67be7f0afd0_exe32.exe
-
Size
52KB
-
MD5
bd4165b4c2a660c44d1da67be7f0afd0
-
SHA1
38bbf2e128256e9ee86fa1b94bdfa4df2ed234a3
-
SHA256
03ab9522cd2c5741aba7d81209ab743429790d2fbca4fe6de34563656558d706
-
SHA512
d5b327304267c948923a92d3ae7f5111ab8b3bf9ad6029d960538fdf89090936a7f86b1485ed9d3b1723442a370a9b031e0dbf9ceac3b695ee5b4c02af9f1395
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI58Ck:ymb3NkkiQ3mdBjFI3k
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral2/memory/4656-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2748-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3952-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4332-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2860-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4104-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4752-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1388-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4548-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2784-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3816-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2768-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/656-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/820-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/812-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2508-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/988-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3184-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1052-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2140-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4112-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4144-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1120-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3900-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1756-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4332-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/788-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2208-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2468-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2468-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/228-311-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1984-315-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1560-319-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1560-321-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1980-332-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2748 915ij3.exe 3952 330cf5.exe 4332 gaucg1.exe 2860 8ugek7.exe 4104 wc7m77n.exe 4752 uisosa.exe 1388 5s7ak.exe 4548 aexc9.exe 2784 g7ow50.exe 4896 71735.exe 3816 p90ug.exe 1976 n56b180.exe 2768 er2ww.exe 656 8n9cj.exe 2116 gwcku.exe 3912 f39331i.exe 820 0d4nd24.exe 2464 2xn6h.exe 812 77w52.exe 2508 p72n9kf.exe 988 b756o79.exe 3184 7x1m98b.exe 3844 4e1ea5.exe 1052 h1eir.exe 2140 2722h57.exe 4944 ii5mns8.exe 3372 n0c299.exe 3676 49r2k0.exe 2968 6qq30.exe 3484 4u76c31.exe 4112 k770at.exe 4144 dd4ggoc.exe 2068 2r68f.exe 1120 8h78ml3.exe 3900 40i93d.exe 1756 q10i2qw.exe 1676 79ir3.exe 3984 9h51551.exe 4332 5585uu.exe 788 o62800o.exe 2208 08bnnt.exe 2468 3s3n5.exe 4504 uoiock.exe 4748 74cx93.exe 2888 d2oaes.exe 4652 11197gn.exe 228 uglcg.exe 1984 q29lt66.exe 1560 11wb90.exe 220 30ekmp7.exe 1980 0p50wk.exe 4744 2d36e79.exe 4372 01ag8jj.exe 5072 bj4n8j3.exe 4288 13ix7.exe 3912 5qd8x0t.exe 2228 ukgwesk.exe 2716 umps0.exe 2088 d4gp6x.exe 2160 105556.exe 808 wwnc0.exe 1616 bnfmo2.exe 4916 d5sd9.exe 1364 7q54chi.exe -
resource yara_rule behavioral2/memory/4656-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2748-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4332-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2860-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2860-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4104-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4104-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1388-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4548-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2784-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2784-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3816-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/656-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/656-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/820-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/820-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/812-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2508-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2508-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/988-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3184-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3184-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3844-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1052-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2140-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4112-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4144-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4144-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1120-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3900-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3900-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1756-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4332-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4332-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/788-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2208-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2208-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2468-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2468-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4504-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-301-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-303-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/228-307-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/228-311-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1984-315-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1984-313-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1560-319-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1560-321-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-325-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1980-330-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1980-332-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4656 wrote to memory of 2748 4656 bd4165b4c2a660c44d1da67be7f0afd0_exe32.exe 82 PID 4656 wrote to memory of 2748 4656 bd4165b4c2a660c44d1da67be7f0afd0_exe32.exe 82 PID 4656 wrote to memory of 2748 4656 bd4165b4c2a660c44d1da67be7f0afd0_exe32.exe 82 PID 2748 wrote to memory of 3952 2748 915ij3.exe 83 PID 2748 wrote to memory of 3952 2748 915ij3.exe 83 PID 2748 wrote to memory of 3952 2748 915ij3.exe 83 PID 3952 wrote to memory of 4332 3952 330cf5.exe 84 PID 3952 wrote to memory of 4332 3952 330cf5.exe 84 PID 3952 wrote to memory of 4332 3952 330cf5.exe 84 PID 4332 wrote to memory of 2860 4332 gaucg1.exe 85 PID 4332 wrote to memory of 2860 4332 gaucg1.exe 85 PID 4332 wrote to memory of 2860 4332 gaucg1.exe 85 PID 2860 wrote to memory of 4104 2860 8ugek7.exe 86 PID 2860 wrote to memory of 4104 2860 8ugek7.exe 86 PID 2860 wrote to memory of 4104 2860 8ugek7.exe 86 PID 4104 wrote to memory of 4752 4104 wc7m77n.exe 87 PID 4104 wrote to memory of 4752 4104 wc7m77n.exe 87 PID 4104 wrote to memory of 4752 4104 wc7m77n.exe 87 PID 4752 wrote to memory of 1388 4752 uisosa.exe 88 PID 4752 wrote to memory of 1388 4752 uisosa.exe 88 PID 4752 wrote to memory of 1388 4752 uisosa.exe 88 PID 1388 wrote to memory of 4548 1388 5s7ak.exe 90 PID 1388 wrote to memory of 4548 1388 5s7ak.exe 90 PID 1388 wrote to memory of 4548 1388 5s7ak.exe 90 PID 4548 wrote to memory of 2784 4548 aexc9.exe 91 PID 4548 wrote to memory of 2784 4548 aexc9.exe 91 PID 4548 wrote to memory of 2784 4548 aexc9.exe 91 PID 2784 wrote to memory of 4896 2784 g7ow50.exe 92 PID 2784 wrote to memory of 4896 2784 g7ow50.exe 92 PID 2784 wrote to memory of 4896 2784 g7ow50.exe 92 PID 4896 wrote to memory of 3816 4896 71735.exe 93 PID 4896 wrote to memory of 3816 4896 71735.exe 93 PID 4896 wrote to memory of 3816 4896 71735.exe 93 PID 3816 wrote to memory of 1976 3816 p90ug.exe 94 PID 3816 wrote to memory of 1976 3816 p90ug.exe 94 PID 3816 wrote to memory of 1976 3816 p90ug.exe 94 PID 1976 wrote to memory of 2768 1976 n56b180.exe 95 PID 1976 wrote to memory of 2768 1976 n56b180.exe 95 PID 1976 wrote to memory of 2768 1976 n56b180.exe 95 PID 2768 wrote to memory of 656 2768 er2ww.exe 96 PID 2768 wrote to memory of 656 2768 er2ww.exe 96 PID 2768 wrote to memory of 656 2768 er2ww.exe 96 PID 656 wrote to memory of 2116 656 8n9cj.exe 97 PID 656 wrote to memory of 2116 656 8n9cj.exe 97 PID 656 wrote to memory of 2116 656 8n9cj.exe 97 PID 2116 wrote to memory of 3912 2116 gwcku.exe 98 PID 2116 wrote to memory of 3912 2116 gwcku.exe 98 PID 2116 wrote to memory of 3912 2116 gwcku.exe 98 PID 3912 wrote to memory of 820 3912 f39331i.exe 99 PID 3912 wrote to memory of 820 3912 f39331i.exe 99 PID 3912 wrote to memory of 820 3912 f39331i.exe 99 PID 820 wrote to memory of 2464 820 0d4nd24.exe 100 PID 820 wrote to memory of 2464 820 0d4nd24.exe 100 PID 820 wrote to memory of 2464 820 0d4nd24.exe 100 PID 2464 wrote to memory of 812 2464 2xn6h.exe 101 PID 2464 wrote to memory of 812 2464 2xn6h.exe 101 PID 2464 wrote to memory of 812 2464 2xn6h.exe 101 PID 812 wrote to memory of 2508 812 77w52.exe 102 PID 812 wrote to memory of 2508 812 77w52.exe 102 PID 812 wrote to memory of 2508 812 77w52.exe 102 PID 2508 wrote to memory of 988 2508 p72n9kf.exe 103 PID 2508 wrote to memory of 988 2508 p72n9kf.exe 103 PID 2508 wrote to memory of 988 2508 p72n9kf.exe 103 PID 988 wrote to memory of 3184 988 b756o79.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd4165b4c2a660c44d1da67be7f0afd0_exe32.exe"C:\Users\Admin\AppData\Local\Temp\bd4165b4c2a660c44d1da67be7f0afd0_exe32.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\915ij3.exec:\915ij3.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\330cf5.exec:\330cf5.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\gaucg1.exec:\gaucg1.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
\??\c:\8ugek7.exec:\8ugek7.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\wc7m77n.exec:\wc7m77n.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\uisosa.exec:\uisosa.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\5s7ak.exec:\5s7ak.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\aexc9.exec:\aexc9.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\g7ow50.exec:\g7ow50.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\71735.exec:\71735.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\p90ug.exec:\p90ug.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\n56b180.exec:\n56b180.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\er2ww.exec:\er2ww.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\8n9cj.exec:\8n9cj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:656 -
\??\c:\gwcku.exec:\gwcku.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\f39331i.exec:\f39331i.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
\??\c:\0d4nd24.exec:\0d4nd24.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
\??\c:\2xn6h.exec:\2xn6h.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\77w52.exec:\77w52.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\p72n9kf.exec:\p72n9kf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\b756o79.exec:\b756o79.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
\??\c:\7x1m98b.exec:\7x1m98b.exe23⤵
- Executes dropped EXE
PID:3184 -
\??\c:\4e1ea5.exec:\4e1ea5.exe24⤵
- Executes dropped EXE
PID:3844 -
\??\c:\h1eir.exec:\h1eir.exe25⤵
- Executes dropped EXE
PID:1052 -
\??\c:\2722h57.exec:\2722h57.exe26⤵
- Executes dropped EXE
PID:2140 -
\??\c:\ii5mns8.exec:\ii5mns8.exe27⤵
- Executes dropped EXE
PID:4944 -
\??\c:\n0c299.exec:\n0c299.exe28⤵
- Executes dropped EXE
PID:3372 -
\??\c:\49r2k0.exec:\49r2k0.exe29⤵
- Executes dropped EXE
PID:3676 -
\??\c:\6qq30.exec:\6qq30.exe30⤵
- Executes dropped EXE
PID:2968 -
\??\c:\4u76c31.exec:\4u76c31.exe31⤵
- Executes dropped EXE
PID:3484 -
\??\c:\k770at.exec:\k770at.exe32⤵
- Executes dropped EXE
PID:4112 -
\??\c:\dd4ggoc.exec:\dd4ggoc.exe33⤵
- Executes dropped EXE
PID:4144 -
\??\c:\2r68f.exec:\2r68f.exe34⤵
- Executes dropped EXE
PID:2068 -
\??\c:\8h78ml3.exec:\8h78ml3.exe35⤵
- Executes dropped EXE
PID:1120 -
\??\c:\40i93d.exec:\40i93d.exe36⤵
- Executes dropped EXE
PID:3900 -
\??\c:\q10i2qw.exec:\q10i2qw.exe37⤵
- Executes dropped EXE
PID:1756 -
\??\c:\79ir3.exec:\79ir3.exe38⤵
- Executes dropped EXE
PID:1676 -
\??\c:\9h51551.exec:\9h51551.exe39⤵
- Executes dropped EXE
PID:3984 -
\??\c:\5585uu.exec:\5585uu.exe40⤵
- Executes dropped EXE
PID:4332 -
\??\c:\o62800o.exec:\o62800o.exe41⤵
- Executes dropped EXE
PID:788 -
\??\c:\08bnnt.exec:\08bnnt.exe42⤵
- Executes dropped EXE
PID:2208 -
\??\c:\3s3n5.exec:\3s3n5.exe43⤵
- Executes dropped EXE
PID:2468 -
\??\c:\uoiock.exec:\uoiock.exe44⤵
- Executes dropped EXE
PID:4504 -
\??\c:\74cx93.exec:\74cx93.exe45⤵
- Executes dropped EXE
PID:4748 -
\??\c:\d2oaes.exec:\d2oaes.exe46⤵
- Executes dropped EXE
PID:2888 -
\??\c:\11197gn.exec:\11197gn.exe47⤵
- Executes dropped EXE
PID:4652 -
\??\c:\uglcg.exec:\uglcg.exe48⤵
- Executes dropped EXE
PID:228 -
\??\c:\q29lt66.exec:\q29lt66.exe49⤵
- Executes dropped EXE
PID:1984 -
\??\c:\11wb90.exec:\11wb90.exe50⤵
- Executes dropped EXE
PID:1560 -
\??\c:\30ekmp7.exec:\30ekmp7.exe51⤵
- Executes dropped EXE
PID:220 -
\??\c:\0p50wk.exec:\0p50wk.exe52⤵
- Executes dropped EXE
PID:1980 -
\??\c:\2d36e79.exec:\2d36e79.exe53⤵
- Executes dropped EXE
PID:4744 -
\??\c:\01ag8jj.exec:\01ag8jj.exe54⤵
- Executes dropped EXE
PID:4372 -
\??\c:\bj4n8j3.exec:\bj4n8j3.exe55⤵
- Executes dropped EXE
PID:5072 -
\??\c:\13ix7.exec:\13ix7.exe56⤵
- Executes dropped EXE
PID:4288 -
\??\c:\5qd8x0t.exec:\5qd8x0t.exe57⤵
- Executes dropped EXE
PID:3912 -
\??\c:\ukgwesk.exec:\ukgwesk.exe58⤵
- Executes dropped EXE
PID:2228 -
\??\c:\umps0.exec:\umps0.exe59⤵
- Executes dropped EXE
PID:2716 -
\??\c:\d4gp6x.exec:\d4gp6x.exe60⤵
- Executes dropped EXE
PID:2088 -
\??\c:\105556.exec:\105556.exe61⤵
- Executes dropped EXE
PID:2160 -
\??\c:\wwnc0.exec:\wwnc0.exe62⤵
- Executes dropped EXE
PID:808 -
\??\c:\bnfmo2.exec:\bnfmo2.exe63⤵
- Executes dropped EXE
PID:1616 -
\??\c:\d5sd9.exec:\d5sd9.exe64⤵
- Executes dropped EXE
PID:4916 -
\??\c:\7q54chi.exec:\7q54chi.exe65⤵
- Executes dropped EXE
PID:1364 -
\??\c:\4ip6x.exec:\4ip6x.exe66⤵PID:1020
-
\??\c:\3bhdme.exec:\3bhdme.exe67⤵PID:3000
-
\??\c:\n1s11.exec:\n1s11.exe68⤵PID:3916
-
\??\c:\6r7ip2a.exec:\6r7ip2a.exe69⤵PID:2416
-
\??\c:\f7912e.exec:\f7912e.exe70⤵PID:3276
-
\??\c:\94q17g.exec:\94q17g.exe71⤵PID:1808
-
\??\c:\s2e793.exec:\s2e793.exe72⤵PID:3360
-
\??\c:\5o10ca.exec:\5o10ca.exe73⤵PID:4028
-
\??\c:\n7c52.exec:\n7c52.exe74⤵PID:1360
-
\??\c:\rp543.exec:\rp543.exe75⤵PID:3348
-
\??\c:\n991sf.exec:\n991sf.exe76⤵PID:1900
-
\??\c:\ugi981b.exec:\ugi981b.exe77⤵PID:4196
-
\??\c:\15351.exec:\15351.exe78⤵PID:2812
-
\??\c:\4w73119.exec:\4w73119.exe79⤵PID:1392
-
\??\c:\kug70.exec:\kug70.exe80⤵PID:4620
-
\??\c:\450s56.exec:\450s56.exe81⤵PID:5112
-
\??\c:\0373r7k.exec:\0373r7k.exe82⤵PID:3356
-
\??\c:\r52t0a.exec:\r52t0a.exe83⤵PID:4104
-
\??\c:\x5e59ev.exec:\x5e59ev.exe84⤵PID:4540
-
\??\c:\mm79k31.exec:\mm79k31.exe85⤵PID:2320
-
\??\c:\0gf9e.exec:\0gf9e.exe86⤵PID:1388
-
\??\c:\08mq1.exec:\08mq1.exe87⤵PID:4380
-
\??\c:\t922pf6.exec:\t922pf6.exe88⤵PID:2784
-
\??\c:\ucm8wx7.exec:\ucm8wx7.exe89⤵PID:4896
-
\??\c:\0pf1ir1.exec:\0pf1ir1.exe90⤵PID:3496
-
\??\c:\87q3a.exec:\87q3a.exe91⤵PID:3508
-
\??\c:\2q9993.exec:\2q9993.exe92⤵PID:4676
-
\??\c:\h95c1.exec:\h95c1.exe93⤵PID:2768
-
\??\c:\83sx3.exec:\83sx3.exe94⤵PID:3344
-
\??\c:\n9537k.exec:\n9537k.exe95⤵PID:4496
-
\??\c:\k4e3851.exec:\k4e3851.exe96⤵PID:3892
-
\??\c:\56p6da7.exec:\56p6da7.exe97⤵PID:3672
-
\??\c:\kvo45.exec:\kvo45.exe98⤵PID:1800
-
\??\c:\6wsws35.exec:\6wsws35.exe99⤵PID:4152
-
\??\c:\2n7hv48.exec:\2n7hv48.exe100⤵PID:1824
-
\??\c:\b70ml9.exec:\b70ml9.exe101⤵PID:2716
-
\??\c:\jj3ut4p.exec:\jj3ut4p.exe102⤵PID:2508
-
\??\c:\2b18g1e.exec:\2b18g1e.exe103⤵PID:2160
-
\??\c:\1f1usgk.exec:\1f1usgk.exe104⤵PID:4564
-
\??\c:\378iv0a.exec:\378iv0a.exe105⤵PID:1616
-
\??\c:\al25x7.exec:\al25x7.exe106⤵PID:4616
-
\??\c:\1vjh25w.exec:\1vjh25w.exe107⤵PID:1592
-
\??\c:\mi7a9.exec:\mi7a9.exe108⤵PID:2404
-
\??\c:\3vnris.exec:\3vnris.exe109⤵PID:3068
-
\??\c:\r96g10.exec:\r96g10.exe110⤵PID:1788
-
\??\c:\qxewix0.exec:\qxewix0.exe111⤵PID:5084
-
\??\c:\8kiqq74.exec:\8kiqq74.exe112⤵PID:4280
-
\??\c:\4kb3g.exec:\4kb3g.exe113⤵PID:3760
-
\??\c:\ox8rv.exec:\ox8rv.exe114⤵PID:3716
-
\??\c:\h4v785p.exec:\h4v785p.exe115⤵PID:4320
-
\??\c:\xau30.exec:\xau30.exe116⤵PID:4580
-
\??\c:\xdbl08k.exec:\xdbl08k.exe117⤵PID:3348
-
\??\c:\jm489n.exec:\jm489n.exe118⤵PID:4124
-
\??\c:\7jhd071.exec:\7jhd071.exe119⤵PID:3952
-
\??\c:\l9311.exec:\l9311.exe120⤵PID:4040
-
\??\c:\u21f8r.exec:\u21f8r.exe121⤵PID:3876
-
\??\c:\374k1.exec:\374k1.exe122⤵PID:2156
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-