Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
28/10/2023, 19:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.5d405ae7075ba90cf2636c0a143bbf60.exe
Resource
win7-20231020-en
5 signatures
150 seconds
General
-
Target
NEAS.5d405ae7075ba90cf2636c0a143bbf60.exe
-
Size
61KB
-
MD5
5d405ae7075ba90cf2636c0a143bbf60
-
SHA1
1ff5a2772411cf0cbbc9068069892f49318e060e
-
SHA256
3819d79750d6b1280e85e163b5defae6b530b29952446bc70e54c39ae494c11e
-
SHA512
930cea2510150a7cdd7fd2a0060c1a89b89ac741e5e80f370027ee969bd8ce8d5abcd1944bda8f161415e16a502cf214457935afafec2c6ec093eb5e2ced095d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI7Zt:ymb3NkkiQ3mdBjFI7Zt
Malware Config
Signatures
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral2/memory/1156-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3632-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3252-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3792-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3860-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1832-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2016-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1892-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4964-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1836-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2096-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5028-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1800-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3600-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2148-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3364-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/728-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1864-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1864-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4356-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1140-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2448-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3036-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3680-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3236-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/868-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2292-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2292-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4268-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4268-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4068-322-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3420-328-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3020-337-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1104-347-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1376-368-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3572-366-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-373-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3632 6vv897.exe 3252 57juaaa.exe 3792 uxs8md1.exe 3860 19cq0.exe 4464 14ku9.exe 1832 jm27ffi.exe 4956 6k16w9.exe 2016 ocd9m79.exe 1168 97697.exe 1892 mjk85.exe 4544 i5o7ov3.exe 4964 h442x.exe 1596 wfo51dv.exe 1232 btlqm5k.exe 1836 iq2c92.exe 2096 778n01.exe 5028 bq8vg.exe 1800 q8425.exe 3600 2747f.exe 2148 l8n7wg1.exe 5064 dj0ov.exe 2600 3ja06.exe 2784 0fo4wom.exe 3364 t9513.exe 728 cscssu1.exe 2140 7twi20.exe 1864 u39sj.exe 1140 vg399.exe 4356 eu5wh8.exe 4576 ckc26.exe 4352 rc6mwo9.exe 260 03ucaea.exe 2972 614sj54.exe 2448 79okvau.exe 2880 f4t5f.exe 3036 l76j78i.exe 5060 kguci.exe 4652 ew58c.exe 3680 559r0.exe 3236 md78m.exe 3060 69m72g.exe 868 w6933cg.exe 2292 a1793.exe 1576 dggwmg.exe 2212 4h6ad.exe 4268 b2117.exe 3816 31xa15l.exe 4236 gi98l3.exe 4992 xgn9uck.exe 4452 qcm33u3.exe 4068 97955.exe 3420 x6uf4.exe 3020 13ege94.exe 3968 ta9371.exe 1104 micommu.exe 1712 59q58.exe 4240 sot8imk.exe 4432 153953.exe 3572 aq2cw.exe 1376 x1v16gf.exe 3972 h78i9ui.exe 1284 60x4qv.exe 3852 x3357.exe 4576 ei753g.exe -
resource yara_rule behavioral2/memory/1156-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1156-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3632-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3252-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3792-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3792-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3860-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1832-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1832-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2016-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1168-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1892-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4964-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1836-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1836-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2096-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5028-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5028-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1800-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1800-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3600-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3364-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/728-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/728-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2140-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1864-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1864-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1140-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4352-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2448-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3680-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3680-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/868-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/868-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2292-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2292-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4268-298-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4268-296-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4236-306-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-311-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4452-317-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4068-322-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3420-328-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-332-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-337-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-342-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-347-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4240-353-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-361-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1376-368-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-366-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1156 wrote to memory of 3632 1156 NEAS.5d405ae7075ba90cf2636c0a143bbf60.exe 88 PID 1156 wrote to memory of 3632 1156 NEAS.5d405ae7075ba90cf2636c0a143bbf60.exe 88 PID 1156 wrote to memory of 3632 1156 NEAS.5d405ae7075ba90cf2636c0a143bbf60.exe 88 PID 3632 wrote to memory of 3252 3632 6vv897.exe 90 PID 3632 wrote to memory of 3252 3632 6vv897.exe 90 PID 3632 wrote to memory of 3252 3632 6vv897.exe 90 PID 3252 wrote to memory of 3792 3252 57juaaa.exe 91 PID 3252 wrote to memory of 3792 3252 57juaaa.exe 91 PID 3252 wrote to memory of 3792 3252 57juaaa.exe 91 PID 3792 wrote to memory of 3860 3792 uxs8md1.exe 92 PID 3792 wrote to memory of 3860 3792 uxs8md1.exe 92 PID 3792 wrote to memory of 3860 3792 uxs8md1.exe 92 PID 3860 wrote to memory of 4464 3860 19cq0.exe 93 PID 3860 wrote to memory of 4464 3860 19cq0.exe 93 PID 3860 wrote to memory of 4464 3860 19cq0.exe 93 PID 4464 wrote to memory of 1832 4464 14ku9.exe 94 PID 4464 wrote to memory of 1832 4464 14ku9.exe 94 PID 4464 wrote to memory of 1832 4464 14ku9.exe 94 PID 1832 wrote to memory of 4956 1832 jm27ffi.exe 95 PID 1832 wrote to memory of 4956 1832 jm27ffi.exe 95 PID 1832 wrote to memory of 4956 1832 jm27ffi.exe 95 PID 4956 wrote to memory of 2016 4956 6k16w9.exe 96 PID 4956 wrote to memory of 2016 4956 6k16w9.exe 96 PID 4956 wrote to memory of 2016 4956 6k16w9.exe 96 PID 2016 wrote to memory of 1168 2016 ocd9m79.exe 97 PID 2016 wrote to memory of 1168 2016 ocd9m79.exe 97 PID 2016 wrote to memory of 1168 2016 ocd9m79.exe 97 PID 1168 wrote to memory of 1892 1168 97697.exe 98 PID 1168 wrote to memory of 1892 1168 97697.exe 98 PID 1168 wrote to memory of 1892 1168 97697.exe 98 PID 1892 wrote to memory of 4544 1892 mjk85.exe 99 PID 1892 wrote to memory of 4544 1892 mjk85.exe 99 PID 1892 wrote to memory of 4544 1892 mjk85.exe 99 PID 4544 wrote to memory of 4964 4544 i5o7ov3.exe 100 PID 4544 wrote to memory of 4964 4544 i5o7ov3.exe 100 PID 4544 wrote to memory of 4964 4544 i5o7ov3.exe 100 PID 4964 wrote to memory of 1596 4964 h442x.exe 101 PID 4964 wrote to memory of 1596 4964 h442x.exe 101 PID 4964 wrote to memory of 1596 4964 h442x.exe 101 PID 1596 wrote to memory of 1232 1596 wfo51dv.exe 102 PID 1596 wrote to memory of 1232 1596 wfo51dv.exe 102 PID 1596 wrote to memory of 1232 1596 wfo51dv.exe 102 PID 1232 wrote to memory of 1836 1232 btlqm5k.exe 103 PID 1232 wrote to memory of 1836 1232 btlqm5k.exe 103 PID 1232 wrote to memory of 1836 1232 btlqm5k.exe 103 PID 1836 wrote to memory of 2096 1836 iq2c92.exe 104 PID 1836 wrote to memory of 2096 1836 iq2c92.exe 104 PID 1836 wrote to memory of 2096 1836 iq2c92.exe 104 PID 2096 wrote to memory of 5028 2096 778n01.exe 105 PID 2096 wrote to memory of 5028 2096 778n01.exe 105 PID 2096 wrote to memory of 5028 2096 778n01.exe 105 PID 5028 wrote to memory of 1800 5028 bq8vg.exe 106 PID 5028 wrote to memory of 1800 5028 bq8vg.exe 106 PID 5028 wrote to memory of 1800 5028 bq8vg.exe 106 PID 1800 wrote to memory of 3600 1800 q8425.exe 107 PID 1800 wrote to memory of 3600 1800 q8425.exe 107 PID 1800 wrote to memory of 3600 1800 q8425.exe 107 PID 3600 wrote to memory of 2148 3600 2747f.exe 108 PID 3600 wrote to memory of 2148 3600 2747f.exe 108 PID 3600 wrote to memory of 2148 3600 2747f.exe 108 PID 2148 wrote to memory of 5064 2148 l8n7wg1.exe 109 PID 2148 wrote to memory of 5064 2148 l8n7wg1.exe 109 PID 2148 wrote to memory of 5064 2148 l8n7wg1.exe 109 PID 5064 wrote to memory of 2600 5064 dj0ov.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.5d405ae7075ba90cf2636c0a143bbf60.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.5d405ae7075ba90cf2636c0a143bbf60.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\6vv897.exec:\6vv897.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\57juaaa.exec:\57juaaa.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\uxs8md1.exec:\uxs8md1.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
\??\c:\19cq0.exec:\19cq0.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
\??\c:\14ku9.exec:\14ku9.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\jm27ffi.exec:\jm27ffi.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\6k16w9.exec:\6k16w9.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\ocd9m79.exec:\ocd9m79.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\97697.exec:\97697.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\mjk85.exec:\mjk85.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\i5o7ov3.exec:\i5o7ov3.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\h442x.exec:\h442x.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\wfo51dv.exec:\wfo51dv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\btlqm5k.exec:\btlqm5k.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\iq2c92.exec:\iq2c92.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\778n01.exec:\778n01.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\bq8vg.exec:\bq8vg.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\q8425.exec:\q8425.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\2747f.exec:\2747f.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\l8n7wg1.exec:\l8n7wg1.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\dj0ov.exec:\dj0ov.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\3ja06.exec:\3ja06.exe23⤵
- Executes dropped EXE
PID:2600 -
\??\c:\0fo4wom.exec:\0fo4wom.exe24⤵
- Executes dropped EXE
PID:2784 -
\??\c:\t9513.exec:\t9513.exe25⤵
- Executes dropped EXE
PID:3364 -
\??\c:\cscssu1.exec:\cscssu1.exe26⤵
- Executes dropped EXE
PID:728 -
\??\c:\7twi20.exec:\7twi20.exe27⤵
- Executes dropped EXE
PID:2140 -
\??\c:\u39sj.exec:\u39sj.exe28⤵
- Executes dropped EXE
PID:1864 -
\??\c:\vg399.exec:\vg399.exe29⤵
- Executes dropped EXE
PID:1140 -
\??\c:\eu5wh8.exec:\eu5wh8.exe30⤵
- Executes dropped EXE
PID:4356 -
\??\c:\ckc26.exec:\ckc26.exe31⤵
- Executes dropped EXE
PID:4576 -
\??\c:\rc6mwo9.exec:\rc6mwo9.exe32⤵
- Executes dropped EXE
PID:4352 -
\??\c:\03ucaea.exec:\03ucaea.exe33⤵
- Executes dropped EXE
PID:260 -
\??\c:\614sj54.exec:\614sj54.exe34⤵
- Executes dropped EXE
PID:2972 -
\??\c:\79okvau.exec:\79okvau.exe35⤵
- Executes dropped EXE
PID:2448 -
\??\c:\f4t5f.exec:\f4t5f.exe36⤵
- Executes dropped EXE
PID:2880 -
\??\c:\l76j78i.exec:\l76j78i.exe37⤵
- Executes dropped EXE
PID:3036 -
\??\c:\kguci.exec:\kguci.exe38⤵
- Executes dropped EXE
PID:5060 -
\??\c:\ew58c.exec:\ew58c.exe39⤵
- Executes dropped EXE
PID:4652 -
\??\c:\559r0.exec:\559r0.exe40⤵
- Executes dropped EXE
PID:3680 -
\??\c:\md78m.exec:\md78m.exe41⤵
- Executes dropped EXE
PID:3236 -
\??\c:\69m72g.exec:\69m72g.exe42⤵
- Executes dropped EXE
PID:3060 -
\??\c:\w6933cg.exec:\w6933cg.exe43⤵
- Executes dropped EXE
PID:868 -
\??\c:\a1793.exec:\a1793.exe44⤵
- Executes dropped EXE
PID:2292 -
\??\c:\dggwmg.exec:\dggwmg.exe45⤵
- Executes dropped EXE
PID:1576 -
\??\c:\4h6ad.exec:\4h6ad.exe46⤵
- Executes dropped EXE
PID:2212 -
\??\c:\b2117.exec:\b2117.exe47⤵
- Executes dropped EXE
PID:4268 -
\??\c:\31xa15l.exec:\31xa15l.exe48⤵
- Executes dropped EXE
PID:3816 -
\??\c:\gi98l3.exec:\gi98l3.exe49⤵
- Executes dropped EXE
PID:4236 -
\??\c:\xgn9uck.exec:\xgn9uck.exe50⤵
- Executes dropped EXE
PID:4992 -
\??\c:\qcm33u3.exec:\qcm33u3.exe51⤵
- Executes dropped EXE
PID:4452 -
\??\c:\97955.exec:\97955.exe52⤵
- Executes dropped EXE
PID:4068 -
\??\c:\x6uf4.exec:\x6uf4.exe53⤵
- Executes dropped EXE
PID:3420 -
\??\c:\13ege94.exec:\13ege94.exe54⤵
- Executes dropped EXE
PID:3020 -
\??\c:\ta9371.exec:\ta9371.exe55⤵
- Executes dropped EXE
PID:3968 -
\??\c:\micommu.exec:\micommu.exe56⤵
- Executes dropped EXE
PID:1104 -
\??\c:\59q58.exec:\59q58.exe57⤵
- Executes dropped EXE
PID:1712 -
\??\c:\sot8imk.exec:\sot8imk.exe58⤵
- Executes dropped EXE
PID:4240 -
\??\c:\153953.exec:\153953.exe59⤵
- Executes dropped EXE
PID:4432 -
\??\c:\aq2cw.exec:\aq2cw.exe60⤵
- Executes dropped EXE
PID:3572 -
\??\c:\x1v16gf.exec:\x1v16gf.exe61⤵
- Executes dropped EXE
PID:1376 -
\??\c:\h78i9ui.exec:\h78i9ui.exe62⤵
- Executes dropped EXE
PID:3972 -
\??\c:\60x4qv.exec:\60x4qv.exe63⤵
- Executes dropped EXE
PID:1284 -
\??\c:\x3357.exec:\x3357.exe64⤵
- Executes dropped EXE
PID:3852 -
\??\c:\ei753g.exec:\ei753g.exe65⤵
- Executes dropped EXE
PID:4576 -
\??\c:\fn979.exec:\fn979.exe66⤵PID:4192
-
\??\c:\q98o125.exec:\q98o125.exe67⤵PID:932
-
\??\c:\qmul7.exec:\qmul7.exe68⤵PID:2880
-
\??\c:\3074n0.exec:\3074n0.exe69⤵PID:4016
-
\??\c:\0k94f9.exec:\0k94f9.exe70⤵PID:4932
-
\??\c:\lw997.exec:\lw997.exe71⤵PID:4840
-
\??\c:\j9ow9g.exec:\j9ow9g.exe72⤵PID:1324
-
\??\c:\g8qba9k.exec:\g8qba9k.exe73⤵PID:3256
-
\??\c:\11377.exec:\11377.exe74⤵PID:1892
-
\??\c:\19973.exec:\19973.exe75⤵PID:3332
-
\??\c:\ka4i1qp.exec:\ka4i1qp.exe76⤵PID:3128
-
\??\c:\1ucg303.exec:\1ucg303.exe77⤵PID:3564
-
\??\c:\7536s7.exec:\7536s7.exe78⤵PID:1668
-
\??\c:\gd34j33.exec:\gd34j33.exe79⤵PID:4236
-
\??\c:\655795.exec:\655795.exe80⤵PID:1976
-
\??\c:\xd1s5.exec:\xd1s5.exe81⤵PID:2040
-
\??\c:\8ogae.exec:\8ogae.exe82⤵PID:1696
-
\??\c:\770sp7e.exec:\770sp7e.exe83⤵PID:4748
-
\??\c:\d3917.exec:\d3917.exe84⤵PID:2232
-
\??\c:\2aw7sg.exec:\2aw7sg.exe85⤵PID:4636
-
\??\c:\wmj12.exec:\wmj12.exe86⤵PID:5044
-
\??\c:\256a37.exec:\256a37.exe87⤵PID:3352
-
\??\c:\ccqa117.exec:\ccqa117.exe88⤵PID:2896
-
\??\c:\kf6l975.exec:\kf6l975.exe89⤵PID:4400
-
\??\c:\t715555.exec:\t715555.exe90⤵PID:2156
-
\??\c:\9ki1c.exec:\9ki1c.exe91⤵PID:2488
-
\??\c:\36w59iu.exec:\36w59iu.exe92⤵PID:3436
-
\??\c:\932h8q.exec:\932h8q.exe93⤵PID:2112
-
\??\c:\i77m7eq.exec:\i77m7eq.exe94⤵PID:4660
-
\??\c:\95csi.exec:\95csi.exe95⤵PID:2448
-
\??\c:\31ur32t.exec:\31ur32t.exe96⤵PID:2880
-
\??\c:\54e35.exec:\54e35.exe97⤵PID:4652
-
\??\c:\h5aa77.exec:\h5aa77.exe98⤵PID:2152
-
\??\c:\bu99539.exec:\bu99539.exe99⤵PID:4812
-
\??\c:\km90it5.exec:\km90it5.exe100⤵PID:1588
-
\??\c:\fc9tj16.exec:\fc9tj16.exe101⤵PID:4036
-
\??\c:\l24h7.exec:\l24h7.exe102⤵PID:4964
-
\??\c:\313j3.exec:\313j3.exe103⤵PID:1228
-
\??\c:\8r5oj.exec:\8r5oj.exe104⤵PID:4824
-
\??\c:\91519e.exec:\91519e.exe105⤵PID:572
-
\??\c:\lj17i.exec:\lj17i.exe106⤵PID:4236
-
\??\c:\ac78q.exec:\ac78q.exe107⤵PID:1268
-
\??\c:\5ch3cr.exec:\5ch3cr.exe108⤵PID:3484
-
\??\c:\u76a9.exec:\u76a9.exe109⤵PID:968
-
\??\c:\kamos.exec:\kamos.exe110⤵PID:4148
-
\??\c:\8okgi.exec:\8okgi.exe111⤵PID:656
-
\??\c:\8b19151.exec:\8b19151.exe112⤵PID:3352
-
\??\c:\q1397.exec:\q1397.exe113⤵PID:2896
-
\??\c:\sj3s9ah.exec:\sj3s9ah.exe114⤵PID:4400
-
\??\c:\l4wam.exec:\l4wam.exe115⤵PID:5072
-
\??\c:\2ep7gg.exec:\2ep7gg.exe116⤵PID:2204
-
\??\c:\97ieqkk.exec:\97ieqkk.exe117⤵PID:2304
-
\??\c:\hp597.exec:\hp597.exe118⤵PID:3920
-
\??\c:\71mj12.exec:\71mj12.exe119⤵PID:2448
-
\??\c:\716m58i.exec:\716m58i.exe120⤵PID:1512
-
\??\c:\aj39g.exec:\aj39g.exe121⤵PID:2984
-
\??\c:\2eamaa.exec:\2eamaa.exe122⤵PID:1168
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-