Analysis
-
max time kernel
150s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/03/2024, 09:24
Behavioral task
behavioral1
Sample
be3fa30814c5289abd88b6d3140a2481.exe
Resource
win7-20231129-en
3 signatures
150 seconds
General
-
Target
be3fa30814c5289abd88b6d3140a2481.exe
-
Size
100KB
-
MD5
be3fa30814c5289abd88b6d3140a2481
-
SHA1
73e63a7239f05bb31851de294b5b5ba3f8f7ae4d
-
SHA256
4735f54831ec05adfbea1c997d2a2abb39ea9daf8eeab6e82a49d1241d7ba1fe
-
SHA512
41b06cc2d336bb91955487ec71d2ff3f1c88396c4a5143b24b44e6b868468a19ece5d21e3d067f4059b83f73ceb93f6b483bd2085133149997bccb17e6f8fba7
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8PbhnyLFbUZJjw5Ivov1d3ZdpQm6:9hOmTsF93UYfwC6GIoutz5yLpRDN6
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4516-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2004-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2220-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2396-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1256-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4392-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4380-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4736-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3824-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4808-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2764-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4536-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2612-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1592-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1700-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1000-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3556-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4328-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4764-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4076-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/644-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4388-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/452-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/624-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2268-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2448-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3096-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4324-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2704-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2448-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4464-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4728-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3604-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2908-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2696-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4376-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1808-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/908-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4932-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1732-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1752-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3124-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5056-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/880-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3132-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4728-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2516-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/540-448-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2584-462-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4320-476-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4496-525-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2732-555-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2004-598-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4736-617-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2144-658-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1420-686-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3140-747-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/996-809-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3576-835-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2112-881-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2460-903-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4508-969-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4916-1063-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2004 i60j3n.exe 2220 qjor1ox.exe 2396 q22f63.exe 1256 3x927.exe 4392 hi8elt.exe 4380 874jh.exe 4736 tbw82.exe 1352 f1m2anr.exe 3824 dm44d.exe 1488 9018h2.exe 4808 q62v26.exe 2764 o0453.exe 4536 m8wrb6.exe 2612 6xehns.exe 1592 r7c5f.exe 1700 ffdfok.exe 1000 3kca6h.exe 2980 t6fs6.exe 3556 3ed2n1.exe 4764 548h6f3.exe 4328 xg946h.exe 4864 0620n7l.exe 4076 ogj43ve.exe 3124 0pci37.exe 644 g8i9n9.exe 3336 qi9x0p8.exe 624 c9oe8h1.exe 3420 32874r.exe 452 5ltmx20.exe 524 8tv927x.exe 4388 5iri63.exe 3032 0op7b.exe 2448 0kb4ion.exe 2268 1q55494.exe 4836 49k3b7.exe 3096 97dg178.exe 4324 7w0a9.exe 4480 o6n30k.exe 4632 phmptj.exe 1468 6w0068.exe 1632 691tfv.exe 2704 676b44x.exe 3576 655b7t3.exe 4464 ir370.exe 2676 7br22vv.exe 4728 k3iok.exe 2008 47381.exe 2332 6f9g78.exe 3604 q8n7t.exe 2908 24869n.exe 3140 300u647.exe 2696 977g3.exe 4376 1xxob0.exe 2784 58fj0.exe 1808 02c24.exe 3852 4f6nj13.exe 1296 c4gtl.exe 3516 74tr842.exe 908 gexs20h.exe 1584 8kp6ig8.exe 4932 70oge.exe 1600 x6f6mb.exe 2304 l4wqisk.exe 1732 46039v.exe -
resource yara_rule behavioral2/memory/4516-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000200000001f656-3.dat upx behavioral2/memory/4516-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2004-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000800000002321e-9.dat upx behavioral2/files/0x0008000000023221-12.dat upx behavioral2/memory/2220-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2220-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023225-19.dat upx behavioral2/memory/2396-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1256-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023226-25.dat upx behavioral2/files/0x0007000000023227-30.dat upx behavioral2/memory/4392-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023222-35.dat upx behavioral2/memory/4380-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023228-40.dat upx behavioral2/memory/4736-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002322a-45.dat upx behavioral2/memory/3824-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002322b-52.dat upx behavioral2/files/0x000700000002322c-56.dat upx behavioral2/files/0x000700000002322d-61.dat upx behavioral2/memory/4808-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2764-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002322e-69.dat upx behavioral2/files/0x000700000002322f-72.dat upx behavioral2/memory/4536-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2612-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023230-80.dat upx behavioral2/files/0x0007000000023231-83.dat upx behavioral2/memory/1592-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1700-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023232-90.dat upx behavioral2/memory/1000-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023234-99.dat upx behavioral2/files/0x0007000000023233-96.dat upx behavioral2/memory/3556-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023235-104.dat upx behavioral2/files/0x0007000000023237-109.dat upx behavioral2/files/0x0007000000023238-115.dat upx behavioral2/memory/4328-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4764-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023239-121.dat upx behavioral2/memory/4076-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002323a-127.dat upx behavioral2/files/0x000700000002323b-131.dat upx behavioral2/memory/644-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002323c-138.dat upx behavioral2/files/0x000700000002323d-141.dat upx behavioral2/files/0x000700000002323f-154.dat upx behavioral2/files/0x0007000000023241-159.dat upx behavioral2/files/0x0007000000023241-160.dat upx behavioral2/files/0x0007000000023242-163.dat upx behavioral2/memory/4388-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/452-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023243-171.dat upx behavioral2/files/0x000700000002323e-149.dat upx behavioral2/memory/624-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2268-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2448-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3096-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3096-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4324-192-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4516 wrote to memory of 2004 4516 be3fa30814c5289abd88b6d3140a2481.exe 88 PID 4516 wrote to memory of 2004 4516 be3fa30814c5289abd88b6d3140a2481.exe 88 PID 4516 wrote to memory of 2004 4516 be3fa30814c5289abd88b6d3140a2481.exe 88 PID 2004 wrote to memory of 2220 2004 i60j3n.exe 89 PID 2004 wrote to memory of 2220 2004 i60j3n.exe 89 PID 2004 wrote to memory of 2220 2004 i60j3n.exe 89 PID 2220 wrote to memory of 2396 2220 qjor1ox.exe 90 PID 2220 wrote to memory of 2396 2220 qjor1ox.exe 90 PID 2220 wrote to memory of 2396 2220 qjor1ox.exe 90 PID 2396 wrote to memory of 1256 2396 q22f63.exe 91 PID 2396 wrote to memory of 1256 2396 q22f63.exe 91 PID 2396 wrote to memory of 1256 2396 q22f63.exe 91 PID 1256 wrote to memory of 4392 1256 3x927.exe 92 PID 1256 wrote to memory of 4392 1256 3x927.exe 92 PID 1256 wrote to memory of 4392 1256 3x927.exe 92 PID 4392 wrote to memory of 4380 4392 hi8elt.exe 93 PID 4392 wrote to memory of 4380 4392 hi8elt.exe 93 PID 4392 wrote to memory of 4380 4392 hi8elt.exe 93 PID 4380 wrote to memory of 4736 4380 874jh.exe 94 PID 4380 wrote to memory of 4736 4380 874jh.exe 94 PID 4380 wrote to memory of 4736 4380 874jh.exe 94 PID 4736 wrote to memory of 1352 4736 tbw82.exe 95 PID 4736 wrote to memory of 1352 4736 tbw82.exe 95 PID 4736 wrote to memory of 1352 4736 tbw82.exe 95 PID 1352 wrote to memory of 3824 1352 f1m2anr.exe 96 PID 1352 wrote to memory of 3824 1352 f1m2anr.exe 96 PID 1352 wrote to memory of 3824 1352 f1m2anr.exe 96 PID 3824 wrote to memory of 1488 3824 dm44d.exe 97 PID 3824 wrote to memory of 1488 3824 dm44d.exe 97 PID 3824 wrote to memory of 1488 3824 dm44d.exe 97 PID 1488 wrote to memory of 4808 1488 9018h2.exe 98 PID 1488 wrote to memory of 4808 1488 9018h2.exe 98 PID 1488 wrote to memory of 4808 1488 9018h2.exe 98 PID 4808 wrote to memory of 2764 4808 q62v26.exe 99 PID 4808 wrote to memory of 2764 4808 q62v26.exe 99 PID 4808 wrote to memory of 2764 4808 q62v26.exe 99 PID 2764 wrote to memory of 4536 2764 o0453.exe 100 PID 2764 wrote to memory of 4536 2764 o0453.exe 100 PID 2764 wrote to memory of 4536 2764 o0453.exe 100 PID 4536 wrote to memory of 2612 4536 m8wrb6.exe 101 PID 4536 wrote to memory of 2612 4536 m8wrb6.exe 101 PID 4536 wrote to memory of 2612 4536 m8wrb6.exe 101 PID 2612 wrote to memory of 1592 2612 6xehns.exe 102 PID 2612 wrote to memory of 1592 2612 6xehns.exe 102 PID 2612 wrote to memory of 1592 2612 6xehns.exe 102 PID 1592 wrote to memory of 1700 1592 r7c5f.exe 103 PID 1592 wrote to memory of 1700 1592 r7c5f.exe 103 PID 1592 wrote to memory of 1700 1592 r7c5f.exe 103 PID 1700 wrote to memory of 1000 1700 ffdfok.exe 104 PID 1700 wrote to memory of 1000 1700 ffdfok.exe 104 PID 1700 wrote to memory of 1000 1700 ffdfok.exe 104 PID 1000 wrote to memory of 2980 1000 3kca6h.exe 105 PID 1000 wrote to memory of 2980 1000 3kca6h.exe 105 PID 1000 wrote to memory of 2980 1000 3kca6h.exe 105 PID 2980 wrote to memory of 3556 2980 t6fs6.exe 106 PID 2980 wrote to memory of 3556 2980 t6fs6.exe 106 PID 2980 wrote to memory of 3556 2980 t6fs6.exe 106 PID 3556 wrote to memory of 4764 3556 3ed2n1.exe 107 PID 3556 wrote to memory of 4764 3556 3ed2n1.exe 107 PID 3556 wrote to memory of 4764 3556 3ed2n1.exe 107 PID 4764 wrote to memory of 4328 4764 548h6f3.exe 108 PID 4764 wrote to memory of 4328 4764 548h6f3.exe 108 PID 4764 wrote to memory of 4328 4764 548h6f3.exe 108 PID 4328 wrote to memory of 4864 4328 xg946h.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\be3fa30814c5289abd88b6d3140a2481.exe"C:\Users\Admin\AppData\Local\Temp\be3fa30814c5289abd88b6d3140a2481.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\i60j3n.exec:\i60j3n.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\qjor1ox.exec:\qjor1ox.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\q22f63.exec:\q22f63.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\3x927.exec:\3x927.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\hi8elt.exec:\hi8elt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
\??\c:\874jh.exec:\874jh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\tbw82.exec:\tbw82.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\f1m2anr.exec:\f1m2anr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\dm44d.exec:\dm44d.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
\??\c:\9018h2.exec:\9018h2.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\q62v26.exec:\q62v26.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\o0453.exec:\o0453.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\m8wrb6.exec:\m8wrb6.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\6xehns.exec:\6xehns.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\r7c5f.exec:\r7c5f.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\ffdfok.exec:\ffdfok.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\3kca6h.exec:\3kca6h.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
\??\c:\t6fs6.exec:\t6fs6.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\3ed2n1.exec:\3ed2n1.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\548h6f3.exec:\548h6f3.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\xg946h.exec:\xg946h.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\0620n7l.exec:\0620n7l.exe23⤵
- Executes dropped EXE
PID:4864 -
\??\c:\ogj43ve.exec:\ogj43ve.exe24⤵
- Executes dropped EXE
PID:4076 -
\??\c:\0pci37.exec:\0pci37.exe25⤵
- Executes dropped EXE
PID:3124 -
\??\c:\g8i9n9.exec:\g8i9n9.exe26⤵
- Executes dropped EXE
PID:644 -
\??\c:\qi9x0p8.exec:\qi9x0p8.exe27⤵
- Executes dropped EXE
PID:3336 -
\??\c:\c9oe8h1.exec:\c9oe8h1.exe28⤵
- Executes dropped EXE
PID:624 -
\??\c:\32874r.exec:\32874r.exe29⤵
- Executes dropped EXE
PID:3420 -
\??\c:\5ltmx20.exec:\5ltmx20.exe30⤵
- Executes dropped EXE
PID:452 -
\??\c:\8tv927x.exec:\8tv927x.exe31⤵
- Executes dropped EXE
PID:524 -
\??\c:\5iri63.exec:\5iri63.exe32⤵
- Executes dropped EXE
PID:4388 -
\??\c:\0op7b.exec:\0op7b.exe33⤵
- Executes dropped EXE
PID:3032 -
\??\c:\0kb4ion.exec:\0kb4ion.exe34⤵
- Executes dropped EXE
PID:2448 -
\??\c:\1q55494.exec:\1q55494.exe35⤵
- Executes dropped EXE
PID:2268 -
\??\c:\49k3b7.exec:\49k3b7.exe36⤵
- Executes dropped EXE
PID:4836 -
\??\c:\97dg178.exec:\97dg178.exe37⤵
- Executes dropped EXE
PID:3096 -
\??\c:\7w0a9.exec:\7w0a9.exe38⤵
- Executes dropped EXE
PID:4324 -
\??\c:\o6n30k.exec:\o6n30k.exe39⤵
- Executes dropped EXE
PID:4480 -
\??\c:\phmptj.exec:\phmptj.exe40⤵
- Executes dropped EXE
PID:4632 -
\??\c:\6w0068.exec:\6w0068.exe41⤵
- Executes dropped EXE
PID:1468 -
\??\c:\691tfv.exec:\691tfv.exe42⤵
- Executes dropped EXE
PID:1632 -
\??\c:\676b44x.exec:\676b44x.exe43⤵
- Executes dropped EXE
PID:2704 -
\??\c:\655b7t3.exec:\655b7t3.exe44⤵
- Executes dropped EXE
PID:3576 -
\??\c:\ir370.exec:\ir370.exe45⤵
- Executes dropped EXE
PID:4464 -
\??\c:\7br22vv.exec:\7br22vv.exe46⤵
- Executes dropped EXE
PID:2676 -
\??\c:\k3iok.exec:\k3iok.exe47⤵
- Executes dropped EXE
PID:4728 -
\??\c:\47381.exec:\47381.exe48⤵
- Executes dropped EXE
PID:2008 -
\??\c:\6f9g78.exec:\6f9g78.exe49⤵
- Executes dropped EXE
PID:2332 -
\??\c:\q8n7t.exec:\q8n7t.exe50⤵
- Executes dropped EXE
PID:3604 -
\??\c:\24869n.exec:\24869n.exe51⤵
- Executes dropped EXE
PID:2908 -
\??\c:\300u647.exec:\300u647.exe52⤵
- Executes dropped EXE
PID:3140 -
\??\c:\977g3.exec:\977g3.exe53⤵
- Executes dropped EXE
PID:2696 -
\??\c:\1xxob0.exec:\1xxob0.exe54⤵
- Executes dropped EXE
PID:4376 -
\??\c:\58fj0.exec:\58fj0.exe55⤵
- Executes dropped EXE
PID:2784 -
\??\c:\02c24.exec:\02c24.exe56⤵
- Executes dropped EXE
PID:1808 -
\??\c:\4f6nj13.exec:\4f6nj13.exe57⤵
- Executes dropped EXE
PID:3852 -
\??\c:\c4gtl.exec:\c4gtl.exe58⤵
- Executes dropped EXE
PID:1296 -
\??\c:\74tr842.exec:\74tr842.exe59⤵
- Executes dropped EXE
PID:3516 -
\??\c:\gexs20h.exec:\gexs20h.exe60⤵
- Executes dropped EXE
PID:908 -
\??\c:\8kp6ig8.exec:\8kp6ig8.exe61⤵
- Executes dropped EXE
PID:1584 -
\??\c:\70oge.exec:\70oge.exe62⤵
- Executes dropped EXE
PID:4932 -
\??\c:\x6f6mb.exec:\x6f6mb.exe63⤵
- Executes dropped EXE
PID:1600 -
\??\c:\l4wqisk.exec:\l4wqisk.exe64⤵
- Executes dropped EXE
PID:2304 -
\??\c:\46039v.exec:\46039v.exe65⤵
- Executes dropped EXE
PID:1732 -
\??\c:\2331f.exec:\2331f.exe66⤵PID:2032
-
\??\c:\f8j1exd.exec:\f8j1exd.exe67⤵PID:2480
-
\??\c:\786so1p.exec:\786so1p.exe68⤵PID:1752
-
\??\c:\q0pd0.exec:\q0pd0.exe69⤵PID:3124
-
\??\c:\ox3n207.exec:\ox3n207.exe70⤵PID:4740
-
\??\c:\3202l4t.exec:\3202l4t.exe71⤵PID:2936
-
\??\c:\35wo66.exec:\35wo66.exe72⤵PID:1340
-
\??\c:\we0jpb4.exec:\we0jpb4.exe73⤵PID:3504
-
\??\c:\kih99d5.exec:\kih99d5.exe74⤵PID:1860
-
\??\c:\vo9e0c.exec:\vo9e0c.exe75⤵PID:876
-
\??\c:\no4iwf.exec:\no4iwf.exe76⤵PID:5004
-
\??\c:\u4uegsn.exec:\u4uegsn.exe77⤵PID:1156
-
\??\c:\0443xj9.exec:\0443xj9.exe78⤵PID:4388
-
\??\c:\l47krn.exec:\l47krn.exe79⤵PID:4296
-
\??\c:\9mth3c.exec:\9mth3c.exe80⤵PID:4676
-
\??\c:\45afwn.exec:\45afwn.exe81⤵PID:880
-
\??\c:\w1w4wd.exec:\w1w4wd.exe82⤵PID:3764
-
\??\c:\u059d9.exec:\u059d9.exe83⤵PID:5056
-
\??\c:\jpv67l6.exec:\jpv67l6.exe84⤵PID:4320
-
\??\c:\m621v2e.exec:\m621v2e.exe85⤵PID:1368
-
\??\c:\u92k2.exec:\u92k2.exe86⤵PID:2108
-
\??\c:\s83t0.exec:\s83t0.exe87⤵PID:2220
-
\??\c:\ogme628.exec:\ogme628.exe88⤵PID:1196
-
\??\c:\ujxsegh.exec:\ujxsegh.exe89⤵PID:4028
-
\??\c:\ai6dv6f.exec:\ai6dv6f.exe90⤵PID:3132
-
\??\c:\8pq6e.exec:\8pq6e.exe91⤵PID:1108
-
\??\c:\q867vd.exec:\q867vd.exe92⤵PID:2676
-
\??\c:\0762i.exec:\0762i.exe93⤵PID:4728
-
\??\c:\k6dj2.exec:\k6dj2.exe94⤵PID:4692
-
\??\c:\kfhss2.exec:\kfhss2.exe95⤵PID:3824
-
\??\c:\9v90p75.exec:\9v90p75.exe96⤵PID:2476
-
\??\c:\m285vip.exec:\m285vip.exe97⤵PID:4332
-
\??\c:\sgu8c8.exec:\sgu8c8.exe98⤵PID:3140
-
\??\c:\h7ntcw.exec:\h7ntcw.exe99⤵PID:2516
-
\??\c:\934x6.exec:\934x6.exe100⤵PID:1748
-
\??\c:\36hcdc8.exec:\36hcdc8.exe101⤵PID:3488
-
\??\c:\7m82b8x.exec:\7m82b8x.exe102⤵PID:4896
-
\??\c:\as2jsf8.exec:\as2jsf8.exe103⤵PID:3976
-
\??\c:\pr77d.exec:\pr77d.exe104⤵PID:3108
-
\??\c:\b856h48.exec:\b856h48.exe105⤵PID:4168
-
\??\c:\2u0t45.exec:\2u0t45.exe106⤵PID:2572
-
\??\c:\8eveuln.exec:\8eveuln.exe107⤵PID:2144
-
\??\c:\q52d88.exec:\q52d88.exe108⤵PID:4984
-
\??\c:\1bv2ovr.exec:\1bv2ovr.exe109⤵PID:3728
-
\??\c:\455b3q.exec:\455b3q.exe110⤵PID:1720
-
\??\c:\i8gf8.exec:\i8gf8.exe111⤵PID:2480
-
\??\c:\qnwk6fd.exec:\qnwk6fd.exe112⤵PID:1464
-
\??\c:\v6028f3.exec:\v6028f3.exe113⤵PID:4824
-
\??\c:\006pju.exec:\006pju.exe114⤵PID:4396
-
\??\c:\6rvjh82.exec:\6rvjh82.exe115⤵PID:540
-
\??\c:\c04710.exec:\c04710.exe116⤵PID:3424
-
\??\c:\8x46n.exec:\8x46n.exe117⤵PID:3924
-
\??\c:\jp76t.exec:\jp76t.exe118⤵PID:1860
-
\??\c:\7l97jd.exec:\7l97jd.exe119⤵PID:2584
-
\??\c:\cul1lt0.exec:\cul1lt0.exe120⤵PID:3552
-
\??\c:\ga4lbd.exec:\ga4lbd.exe121⤵PID:1896
-
\??\c:\vn4x2.exec:\vn4x2.exe122⤵PID:4676
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-