Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
16/04/2024, 15:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f3c6cb40a2380d1e8fcc0d894adc8623_JaffaCakes118.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
f3c6cb40a2380d1e8fcc0d894adc8623_JaffaCakes118.exe
-
Size
444KB
-
MD5
f3c6cb40a2380d1e8fcc0d894adc8623
-
SHA1
cba93ba3e160c8455f6ef0c5267c8212b0d334b4
-
SHA256
c59b6aaa89857754bb4e6be79a372f15875e42a079fc6b0c90bdaceaa04c9948
-
SHA512
eefdfa0fff35901aeb144aeabe433cf0b023bb38240c38280b4cdbc9f1a81cf42c3b66296b6cee42f9329ef9b8bd6ce4d99cea276b020d5ff43864a607a14695
-
SSDEEP
6144:n3C9BRo7MlrWKo+lS0Le4xRSAoq78yoyfx93sEqkeGLo:n3C9yMo+S0L9xRnoq7H9xqYLo
Malware Config
Signatures
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral2/memory/1456-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/944-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1488-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2704-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4136-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2596-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1564-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1432-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3884-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1280-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2240-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3064-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1408-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4632-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4840-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4300-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2880-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4072-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3252-313-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3288-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4312-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2732-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3220-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1816-322-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1620-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4104-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2120-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4588-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2756-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/212-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4384-342-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3244-355-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-375-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/752-402-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1924-406-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 944 0r020c.exe 1488 qc36o1c.exe 2704 104mu.exe 4136 1q9jc04.exe 2596 k951155.exe 1564 fo9ob.exe 1432 w0u9563.exe 2904 29ce30.exe 1280 30w3o.exe 3884 1p1qg.exe 212 qj57cr7.exe 3192 735935.exe 2756 h1a6m.exe 2240 umweog.exe 3716 0f0riuq.exe 4588 55wv5ie.exe 3760 8u92i70.exe 4592 21c10uf.exe 2120 hmw72bq.exe 4412 g5g75ux.exe 4992 ww06b.exe 4104 0g3q9.exe 3064 1e7cp0.exe 4632 235179d.exe 4468 j88q2ek.exe 1408 k67599t.exe 4512 lab85oh.exe 4840 0ju2tt4.exe 4888 6kmg7ef.exe 4300 r7g427u.exe 1620 6wgag.exe 4240 lug7c.exe 2496 0oup8.exe 3220 5fhu32.exe 2880 2978l7.exe 2732 xc191.exe 1976 36ugs.exe 2828 05tt04.exe 380 2577c.exe 3300 15931.exe 4312 l259319.exe 4988 6nsiqm5.exe 4072 n9kk14s.exe 3288 hi0u7.exe 4332 7537393.exe 3656 r39111.exe 1388 8s6d1.exe 2432 39995.exe 1144 73odo.exe 3252 n8p0c.exe 2016 4rtqro.exe 1816 wgmii.exe 1612 b4qn30.exe 1908 amh4u.exe 4644 2sr2a.exe 4384 2wgj5k.exe 1568 99051.exe 4412 f56h14.exe 3244 978x7.exe 4756 rwmeu3.exe 4556 8g4cb.exe 5004 5g97c.exe 4780 be6gb.exe 1004 70odr.exe -
resource yara_rule behavioral2/memory/1456-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1456-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/944-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1488-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2704-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4136-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2596-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1564-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1432-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3884-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1280-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2240-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2240-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3064-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1408-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4632-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4840-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4300-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2496-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2880-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2828-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4072-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3252-311-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2016-317-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3252-313-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3288-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4312-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2732-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3220-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1816-322-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1620-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1620-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4632-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4104-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2120-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4588-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2756-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/212-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4384-340-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4384-342-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1568-346-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3244-355-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-369-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-374-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-375-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/752-400-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/752-402-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-406-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2752-411-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-421-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1456 wrote to memory of 944 1456 f3c6cb40a2380d1e8fcc0d894adc8623_JaffaCakes118.exe 83 PID 1456 wrote to memory of 944 1456 f3c6cb40a2380d1e8fcc0d894adc8623_JaffaCakes118.exe 83 PID 1456 wrote to memory of 944 1456 f3c6cb40a2380d1e8fcc0d894adc8623_JaffaCakes118.exe 83 PID 944 wrote to memory of 1488 944 0r020c.exe 84 PID 944 wrote to memory of 1488 944 0r020c.exe 84 PID 944 wrote to memory of 1488 944 0r020c.exe 84 PID 1488 wrote to memory of 2704 1488 qc36o1c.exe 85 PID 1488 wrote to memory of 2704 1488 qc36o1c.exe 85 PID 1488 wrote to memory of 2704 1488 qc36o1c.exe 85 PID 2704 wrote to memory of 4136 2704 104mu.exe 86 PID 2704 wrote to memory of 4136 2704 104mu.exe 86 PID 2704 wrote to memory of 4136 2704 104mu.exe 86 PID 4136 wrote to memory of 2596 4136 1q9jc04.exe 87 PID 4136 wrote to memory of 2596 4136 1q9jc04.exe 87 PID 4136 wrote to memory of 2596 4136 1q9jc04.exe 87 PID 2596 wrote to memory of 1564 2596 k951155.exe 88 PID 2596 wrote to memory of 1564 2596 k951155.exe 88 PID 2596 wrote to memory of 1564 2596 k951155.exe 88 PID 1564 wrote to memory of 1432 1564 fo9ob.exe 90 PID 1564 wrote to memory of 1432 1564 fo9ob.exe 90 PID 1564 wrote to memory of 1432 1564 fo9ob.exe 90 PID 1432 wrote to memory of 2904 1432 w0u9563.exe 91 PID 1432 wrote to memory of 2904 1432 w0u9563.exe 91 PID 1432 wrote to memory of 2904 1432 w0u9563.exe 91 PID 2904 wrote to memory of 1280 2904 29ce30.exe 92 PID 2904 wrote to memory of 1280 2904 29ce30.exe 92 PID 2904 wrote to memory of 1280 2904 29ce30.exe 92 PID 1280 wrote to memory of 3884 1280 30w3o.exe 93 PID 1280 wrote to memory of 3884 1280 30w3o.exe 93 PID 1280 wrote to memory of 3884 1280 30w3o.exe 93 PID 3884 wrote to memory of 212 3884 1p1qg.exe 94 PID 3884 wrote to memory of 212 3884 1p1qg.exe 94 PID 3884 wrote to memory of 212 3884 1p1qg.exe 94 PID 212 wrote to memory of 3192 212 qj57cr7.exe 95 PID 212 wrote to memory of 3192 212 qj57cr7.exe 95 PID 212 wrote to memory of 3192 212 qj57cr7.exe 95 PID 3192 wrote to memory of 2756 3192 735935.exe 97 PID 3192 wrote to memory of 2756 3192 735935.exe 97 PID 3192 wrote to memory of 2756 3192 735935.exe 97 PID 2756 wrote to memory of 2240 2756 h1a6m.exe 98 PID 2756 wrote to memory of 2240 2756 h1a6m.exe 98 PID 2756 wrote to memory of 2240 2756 h1a6m.exe 98 PID 2240 wrote to memory of 3716 2240 umweog.exe 99 PID 2240 wrote to memory of 3716 2240 umweog.exe 99 PID 2240 wrote to memory of 3716 2240 umweog.exe 99 PID 3716 wrote to memory of 4588 3716 0f0riuq.exe 100 PID 3716 wrote to memory of 4588 3716 0f0riuq.exe 100 PID 3716 wrote to memory of 4588 3716 0f0riuq.exe 100 PID 4588 wrote to memory of 3760 4588 55wv5ie.exe 101 PID 4588 wrote to memory of 3760 4588 55wv5ie.exe 101 PID 4588 wrote to memory of 3760 4588 55wv5ie.exe 101 PID 3760 wrote to memory of 4592 3760 8u92i70.exe 102 PID 3760 wrote to memory of 4592 3760 8u92i70.exe 102 PID 3760 wrote to memory of 4592 3760 8u92i70.exe 102 PID 4592 wrote to memory of 2120 4592 21c10uf.exe 103 PID 4592 wrote to memory of 2120 4592 21c10uf.exe 103 PID 4592 wrote to memory of 2120 4592 21c10uf.exe 103 PID 2120 wrote to memory of 4412 2120 hmw72bq.exe 143 PID 2120 wrote to memory of 4412 2120 hmw72bq.exe 143 PID 2120 wrote to memory of 4412 2120 hmw72bq.exe 143 PID 4412 wrote to memory of 4992 4412 g5g75ux.exe 105 PID 4412 wrote to memory of 4992 4412 g5g75ux.exe 105 PID 4412 wrote to memory of 4992 4412 g5g75ux.exe 105 PID 4992 wrote to memory of 4104 4992 ww06b.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3c6cb40a2380d1e8fcc0d894adc8623_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f3c6cb40a2380d1e8fcc0d894adc8623_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\0r020c.exec:\0r020c.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\qc36o1c.exec:\qc36o1c.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\104mu.exec:\104mu.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\1q9jc04.exec:\1q9jc04.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\k951155.exec:\k951155.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\fo9ob.exec:\fo9ob.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\w0u9563.exec:\w0u9563.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\29ce30.exec:\29ce30.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\30w3o.exec:\30w3o.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\1p1qg.exec:\1p1qg.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
\??\c:\qj57cr7.exec:\qj57cr7.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\735935.exec:\735935.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\h1a6m.exec:\h1a6m.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\umweog.exec:\umweog.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\0f0riuq.exec:\0f0riuq.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\55wv5ie.exec:\55wv5ie.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\8u92i70.exec:\8u92i70.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\21c10uf.exec:\21c10uf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\hmw72bq.exec:\hmw72bq.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\g5g75ux.exec:\g5g75ux.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
\??\c:\ww06b.exec:\ww06b.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\0g3q9.exec:\0g3q9.exe23⤵
- Executes dropped EXE
PID:4104 -
\??\c:\1e7cp0.exec:\1e7cp0.exe24⤵
- Executes dropped EXE
PID:3064 -
\??\c:\235179d.exec:\235179d.exe25⤵
- Executes dropped EXE
PID:4632 -
\??\c:\j88q2ek.exec:\j88q2ek.exe26⤵
- Executes dropped EXE
PID:4468 -
\??\c:\k67599t.exec:\k67599t.exe27⤵
- Executes dropped EXE
PID:1408 -
\??\c:\lab85oh.exec:\lab85oh.exe28⤵
- Executes dropped EXE
PID:4512 -
\??\c:\0ju2tt4.exec:\0ju2tt4.exe29⤵
- Executes dropped EXE
PID:4840 -
\??\c:\6kmg7ef.exec:\6kmg7ef.exe30⤵
- Executes dropped EXE
PID:4888 -
\??\c:\r7g427u.exec:\r7g427u.exe31⤵
- Executes dropped EXE
PID:4300 -
\??\c:\6wgag.exec:\6wgag.exe32⤵
- Executes dropped EXE
PID:1620 -
\??\c:\lug7c.exec:\lug7c.exe33⤵
- Executes dropped EXE
PID:4240 -
\??\c:\0oup8.exec:\0oup8.exe34⤵
- Executes dropped EXE
PID:2496 -
\??\c:\5fhu32.exec:\5fhu32.exe35⤵
- Executes dropped EXE
PID:3220 -
\??\c:\2978l7.exec:\2978l7.exe36⤵
- Executes dropped EXE
PID:2880 -
\??\c:\xc191.exec:\xc191.exe37⤵
- Executes dropped EXE
PID:2732 -
\??\c:\36ugs.exec:\36ugs.exe38⤵
- Executes dropped EXE
PID:1976 -
\??\c:\75e7a.exec:\75e7a.exe39⤵PID:2576
-
\??\c:\05tt04.exec:\05tt04.exe40⤵
- Executes dropped EXE
PID:2828 -
\??\c:\2577c.exec:\2577c.exe41⤵
- Executes dropped EXE
PID:380 -
\??\c:\15931.exec:\15931.exe42⤵
- Executes dropped EXE
PID:3300 -
\??\c:\l259319.exec:\l259319.exe43⤵
- Executes dropped EXE
PID:4312 -
\??\c:\6nsiqm5.exec:\6nsiqm5.exe44⤵
- Executes dropped EXE
PID:4988 -
\??\c:\n9kk14s.exec:\n9kk14s.exe45⤵
- Executes dropped EXE
PID:4072 -
\??\c:\hi0u7.exec:\hi0u7.exe46⤵
- Executes dropped EXE
PID:3288 -
\??\c:\7537393.exec:\7537393.exe47⤵
- Executes dropped EXE
PID:4332 -
\??\c:\r39111.exec:\r39111.exe48⤵
- Executes dropped EXE
PID:3656 -
\??\c:\8s6d1.exec:\8s6d1.exe49⤵
- Executes dropped EXE
PID:1388 -
\??\c:\39995.exec:\39995.exe50⤵
- Executes dropped EXE
PID:2432 -
\??\c:\73odo.exec:\73odo.exe51⤵
- Executes dropped EXE
PID:1144 -
\??\c:\n8p0c.exec:\n8p0c.exe52⤵
- Executes dropped EXE
PID:3252 -
\??\c:\4rtqro.exec:\4rtqro.exe53⤵
- Executes dropped EXE
PID:2016 -
\??\c:\wgmii.exec:\wgmii.exe54⤵
- Executes dropped EXE
PID:1816 -
\??\c:\b4qn30.exec:\b4qn30.exe55⤵
- Executes dropped EXE
PID:1612 -
\??\c:\amh4u.exec:\amh4u.exe56⤵
- Executes dropped EXE
PID:1908 -
\??\c:\2sr2a.exec:\2sr2a.exe57⤵
- Executes dropped EXE
PID:4644 -
\??\c:\2wgj5k.exec:\2wgj5k.exe58⤵
- Executes dropped EXE
PID:4384 -
\??\c:\99051.exec:\99051.exe59⤵
- Executes dropped EXE
PID:1568 -
\??\c:\f56h14.exec:\f56h14.exe60⤵
- Executes dropped EXE
PID:4412 -
\??\c:\978x7.exec:\978x7.exe61⤵
- Executes dropped EXE
PID:3244 -
\??\c:\rwmeu3.exec:\rwmeu3.exe62⤵
- Executes dropped EXE
PID:4756 -
\??\c:\8g4cb.exec:\8g4cb.exe63⤵
- Executes dropped EXE
PID:4556 -
\??\c:\5g97c.exec:\5g97c.exe64⤵
- Executes dropped EXE
PID:5004 -
\??\c:\be6gb.exec:\be6gb.exe65⤵
- Executes dropped EXE
PID:4780 -
\??\c:\70odr.exec:\70odr.exe66⤵
- Executes dropped EXE
PID:1004 -
\??\c:\c2a53.exec:\c2a53.exe67⤵PID:3768
-
\??\c:\f4sd7.exec:\f4sd7.exe68⤵PID:4700
-
\??\c:\46gwr59.exec:\46gwr59.exe69⤵PID:2184
-
\??\c:\0v39mp.exec:\0v39mp.exe70⤵PID:2548
-
\??\c:\v7af12p.exec:\v7af12p.exe71⤵PID:752
-
\??\c:\7mn3w.exec:\7mn3w.exe72⤵PID:1924
-
\??\c:\mk3n339.exec:\mk3n339.exe73⤵PID:2752
-
\??\c:\kw7309.exec:\kw7309.exe74⤵PID:4300
-
\??\c:\97293.exec:\97293.exe75⤵PID:3588
-
\??\c:\199135.exec:\199135.exe76⤵PID:4872
-
\??\c:\gs54u.exec:\gs54u.exe77⤵PID:944
-
\??\c:\95jdq.exec:\95jdq.exe78⤵PID:1424
-
\??\c:\0xtf9g.exec:\0xtf9g.exe79⤵PID:4508
-
\??\c:\u0799ua.exec:\u0799ua.exe80⤵PID:864
-
\??\c:\18gomi1.exec:\18gomi1.exe81⤵PID:5028
-
\??\c:\fbcgc.exec:\fbcgc.exe82⤵PID:2948
-
\??\c:\47k7gt.exec:\47k7gt.exe83⤵PID:2576
-
\??\c:\4ko50.exec:\4ko50.exe84⤵PID:4004
-
\??\c:\70202.exec:\70202.exe85⤵PID:4572
-
\??\c:\t3x5wme.exec:\t3x5wme.exe86⤵PID:1548
-
\??\c:\blju40.exec:\blju40.exe87⤵PID:1544
-
\??\c:\2um7m.exec:\2um7m.exe88⤵PID:2904
-
\??\c:\po2sl6s.exec:\po2sl6s.exe89⤵PID:1196
-
\??\c:\3u3f5.exec:\3u3f5.exe90⤵PID:4804
-
\??\c:\cob18.exec:\cob18.exe91⤵PID:3764
-
\??\c:\130e69e.exec:\130e69e.exe92⤵PID:4916
-
\??\c:\8gl1sm.exec:\8gl1sm.exe93⤵PID:2316
-
\??\c:\4makq.exec:\4makq.exe94⤵PID:3828
-
\??\c:\11if7.exec:\11if7.exe95⤵PID:3252
-
\??\c:\ex96ed.exec:\ex96ed.exe96⤵PID:4796
-
\??\c:\5917j03.exec:\5917j03.exe97⤵PID:5080
-
\??\c:\p9e79.exec:\p9e79.exe98⤵PID:3368
-
\??\c:\4er703.exec:\4er703.exe99⤵PID:2084
-
\??\c:\2e571.exec:\2e571.exe100⤵PID:3572
-
\??\c:\636koi8.exec:\636koi8.exe101⤵PID:4384
-
\??\c:\636e4u1.exec:\636e4u1.exe102⤵PID:4208
-
\??\c:\52wg87t.exec:\52wg87t.exe103⤵PID:3328
-
\??\c:\p9835.exec:\p9835.exe104⤵PID:4296
-
\??\c:\71wd9i.exec:\71wd9i.exe105⤵PID:1928
-
\??\c:\h36w2ma.exec:\h36w2ma.exe106⤵PID:4412
-
\??\c:\ob7j8o.exec:\ob7j8o.exe107⤵PID:3472
-
\??\c:\0w70q.exec:\0w70q.exe108⤵PID:3128
-
\??\c:\pl1eup.exec:\pl1eup.exe109⤵PID:3064
-
\??\c:\3w6um5.exec:\3w6um5.exe110⤵PID:3980
-
\??\c:\93eoi.exec:\93eoi.exe111⤵PID:4632
-
\??\c:\e3cesx.exec:\e3cesx.exe112⤵PID:924
-
\??\c:\r7sv5.exec:\r7sv5.exe113⤵PID:2064
-
\??\c:\374f9o.exec:\374f9o.exe114⤵PID:4496
-
\??\c:\439dr9.exec:\439dr9.exe115⤵PID:2184
-
\??\c:\f4fh4.exec:\f4fh4.exe116⤵PID:3984
-
\??\c:\lv607gn.exec:\lv607gn.exe117⤵PID:4304
-
\??\c:\b4kd52o.exec:\b4kd52o.exe118⤵PID:4692
-
\??\c:\l3gu6i3.exec:\l3gu6i3.exe119⤵PID:4036
-
\??\c:\odlfx.exec:\odlfx.exe120⤵PID:1468
-
\??\c:\6c93ix.exec:\6c93ix.exe121⤵PID:4484
-
\??\c:\53u99am.exec:\53u99am.exe122⤵PID:4396
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-