Analysis
-
max time kernel
148s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-04-2024 21:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4ed2b7f23bef127248382b7d67844474ea69b958780d2fa5691bdb0dfa985458.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Errors
Reason
Machine shutdown: "{\"level\":\"info\",\"time\":\"2024-04-18T21:47:58Z\",\"message\":\"Dirty snapshot: /var/lib/sandbox/hatchvm/win7-20240221-en/instance_23-dirty.qcow2\"}"
General
-
Target
4ed2b7f23bef127248382b7d67844474ea69b958780d2fa5691bdb0dfa985458.exe
-
Size
132KB
-
MD5
992a22b097ca9440a1caf427e0cae423
-
SHA1
a447376b6ed4bd8c38e45009d232abe45b7e49fd
-
SHA256
4ed2b7f23bef127248382b7d67844474ea69b958780d2fa5691bdb0dfa985458
-
SHA512
1138db3985a4efa4476bab4d9b1592ff9e24d57a04c436cc3d8c8ba72af1d85fbeafb8bd5e175dcaa622c373e5523ed5aec4a547e5fc734f28dbace14a94d875
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afoHVpx+dGorc:n3C9BRW0j/1px+dG7
Malware Config
Signatures
-
Detect Blackmoon payload 30 IoCs
Processes:
resource yara_rule behavioral1/memory/848-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1352-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1160-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/484-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2024-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1552-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1796-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1020-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2068-311-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-341-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1352-349-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-389-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-444-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-468-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-498-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2132-514-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3040-553-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/608-600-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2144-615-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 60 IoCs
Processes:
resource yara_rule behavioral1/memory/848-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1352-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1352-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2624-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2412-31-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2412-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2648-42-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2648-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2516-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2448-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2900-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2196-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2752-94-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2752-96-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1160-125-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2028-134-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/484-145-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2024-155-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2708-165-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2380-175-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1552-185-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2824-203-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2824-206-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1796-260-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1796-262-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1020-282-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2972-290-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2068-311-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2200-302-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2156-340-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2156-341-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1352-349-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2684-364-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2332-372-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2648-380-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2476-389-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3056-396-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/676-404-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2016-412-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2696-420-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1496-428-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3068-443-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3068-444-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1684-452-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1408-460-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2192-468-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2344-490-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2096-498-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2132-514-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2836-521-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2256-536-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2108-544-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3040-552-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3040-553-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/436-568-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1828-583-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/608-598-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/608-600-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1020-607-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2144-615-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
pxee9m.exeuvgika.exes0gg2k.exe67xq9q.exel4qu2q0.exebm187c.exe3ki73.exe113el4.exe7h97a50.exel96g7.exer8jmb9.exe4d31xw5.exe202313w.exef9m7o.exebc3ua.exex90c1.exe69wb1i.exe26a8iw.exexk7un8.exe511n68.exe256265g.exe89kg0.exeo8vic9x.exe858t56w.exe40d6cs.exee8m157.exe69p1i.exe0gwq3.exel59k5.exe41qjc.exe2os37.exeh33747k.exetwk7m4.exec73773q.exe6qi9ki3.exe3d0ot6k.exe293wp.exepe90v5m.exeo33995.exed5195j.exet1953.exei14m3.exepa34i.exe61in5.exe7v6vq3.exeh8drc.exe0kkm9.exerw527.exet50p5.exer3790.exe0nq0q.exeaf9kd.exeb70mk.exe47r16s1.exe75pr39.exeto19g.exe8c15ct.exers1g9u.exe111293i.exet83o7e.exe23bex6.exe49ko3m.exetv18c.exe4232430.exepid process 1352 pxee9m.exe 2624 uvgika.exe 2412 s0gg2k.exe 2648 67xq9q.exe 2516 l4qu2q0.exe 2448 bm187c.exe 2900 3ki73.exe 2196 113el4.exe 2752 7h97a50.exe 1512 l96g7.exe 2668 r8jmb9.exe 1160 4d31xw5.exe 2028 202313w.exe 484 f9m7o.exe 2024 bc3ua.exe 2708 x90c1.exe 2380 69wb1i.exe 1552 26a8iw.exe 2308 xk7un8.exe 2824 511n68.exe 1172 256265g.exe 3016 89kg0.exe 296 o8vic9x.exe 308 858t56w.exe 2284 40d6cs.exe 1796 e8m157.exe 1824 69p1i.exe 1020 0gwq3.exe 2972 l59k5.exe 2200 41qjc.exe 2068 2os37.exe 1212 h33747k.exe 2180 twk7m4.exe 2156 c73773q.exe 1352 6qi9ki3.exe 2672 3d0ot6k.exe 2684 293wp.exe 2332 pe90v5m.exe 2648 o33995.exe 2476 d5195j.exe 3056 t1953.exe 676 i14m3.exe 2016 pa34i.exe 2696 61in5.exe 1496 7v6vq3.exe 2784 h8drc.exe 3068 0kkm9.exe 1684 rw527.exe 1408 t50p5.exe 2192 r3790.exe 484 0nq0q.exe 2716 af9kd.exe 2344 b70mk.exe 2096 47r16s1.exe 628 75pr39.exe 2132 to19g.exe 2836 8c15ct.exe 2100 rs1g9u.exe 2256 111293i.exe 2108 t83o7e.exe 3040 23bex6.exe 1820 49ko3m.exe 436 tv18c.exe 952 4232430.exe -
Processes:
resource yara_rule behavioral1/memory/848-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1352-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1352-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1160-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2028-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/484-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1552-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/308-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1020-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-311-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-302-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1212-320-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-340-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-341-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1352-349-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-364-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-372-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-380-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-389-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-396-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/676-404-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-412-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-420-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1496-428-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-443-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-444-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1684-452-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1408-460-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-468-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-490-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-498-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2132-514-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-521-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-536-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-544-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-552-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-553-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/436-568-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1828-583-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/608-598-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/608-600-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1020-607-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2144-615-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4ed2b7f23bef127248382b7d67844474ea69b958780d2fa5691bdb0dfa985458.exepxee9m.exeuvgika.exes0gg2k.exe67xq9q.exel4qu2q0.exebm187c.exe3ki73.exe113el4.exe7h97a50.exel96g7.exer8jmb9.exe4d31xw5.exe202313w.exef9m7o.exebc3ua.exedescription pid process target process PID 848 wrote to memory of 1352 848 4ed2b7f23bef127248382b7d67844474ea69b958780d2fa5691bdb0dfa985458.exe pxee9m.exe PID 848 wrote to memory of 1352 848 4ed2b7f23bef127248382b7d67844474ea69b958780d2fa5691bdb0dfa985458.exe pxee9m.exe PID 848 wrote to memory of 1352 848 4ed2b7f23bef127248382b7d67844474ea69b958780d2fa5691bdb0dfa985458.exe pxee9m.exe PID 848 wrote to memory of 1352 848 4ed2b7f23bef127248382b7d67844474ea69b958780d2fa5691bdb0dfa985458.exe pxee9m.exe PID 1352 wrote to memory of 2624 1352 pxee9m.exe uvgika.exe PID 1352 wrote to memory of 2624 1352 pxee9m.exe uvgika.exe PID 1352 wrote to memory of 2624 1352 pxee9m.exe uvgika.exe PID 1352 wrote to memory of 2624 1352 pxee9m.exe uvgika.exe PID 2624 wrote to memory of 2412 2624 uvgika.exe s0gg2k.exe PID 2624 wrote to memory of 2412 2624 uvgika.exe s0gg2k.exe PID 2624 wrote to memory of 2412 2624 uvgika.exe s0gg2k.exe PID 2624 wrote to memory of 2412 2624 uvgika.exe s0gg2k.exe PID 2412 wrote to memory of 2648 2412 s0gg2k.exe 67xq9q.exe PID 2412 wrote to memory of 2648 2412 s0gg2k.exe 67xq9q.exe PID 2412 wrote to memory of 2648 2412 s0gg2k.exe 67xq9q.exe PID 2412 wrote to memory of 2648 2412 s0gg2k.exe 67xq9q.exe PID 2648 wrote to memory of 2516 2648 67xq9q.exe l4qu2q0.exe PID 2648 wrote to memory of 2516 2648 67xq9q.exe l4qu2q0.exe PID 2648 wrote to memory of 2516 2648 67xq9q.exe l4qu2q0.exe PID 2648 wrote to memory of 2516 2648 67xq9q.exe l4qu2q0.exe PID 2516 wrote to memory of 2448 2516 l4qu2q0.exe bm187c.exe PID 2516 wrote to memory of 2448 2516 l4qu2q0.exe bm187c.exe PID 2516 wrote to memory of 2448 2516 l4qu2q0.exe bm187c.exe PID 2516 wrote to memory of 2448 2516 l4qu2q0.exe bm187c.exe PID 2448 wrote to memory of 2900 2448 bm187c.exe 3ki73.exe PID 2448 wrote to memory of 2900 2448 bm187c.exe 3ki73.exe PID 2448 wrote to memory of 2900 2448 bm187c.exe 3ki73.exe PID 2448 wrote to memory of 2900 2448 bm187c.exe 3ki73.exe PID 2900 wrote to memory of 2196 2900 3ki73.exe 113el4.exe PID 2900 wrote to memory of 2196 2900 3ki73.exe 113el4.exe PID 2900 wrote to memory of 2196 2900 3ki73.exe 113el4.exe PID 2900 wrote to memory of 2196 2900 3ki73.exe 113el4.exe PID 2196 wrote to memory of 2752 2196 113el4.exe 7h97a50.exe PID 2196 wrote to memory of 2752 2196 113el4.exe 7h97a50.exe PID 2196 wrote to memory of 2752 2196 113el4.exe 7h97a50.exe PID 2196 wrote to memory of 2752 2196 113el4.exe 7h97a50.exe PID 2752 wrote to memory of 1512 2752 7h97a50.exe l96g7.exe PID 2752 wrote to memory of 1512 2752 7h97a50.exe l96g7.exe PID 2752 wrote to memory of 1512 2752 7h97a50.exe l96g7.exe PID 2752 wrote to memory of 1512 2752 7h97a50.exe l96g7.exe PID 1512 wrote to memory of 2668 1512 l96g7.exe r8jmb9.exe PID 1512 wrote to memory of 2668 1512 l96g7.exe r8jmb9.exe PID 1512 wrote to memory of 2668 1512 l96g7.exe r8jmb9.exe PID 1512 wrote to memory of 2668 1512 l96g7.exe r8jmb9.exe PID 2668 wrote to memory of 1160 2668 r8jmb9.exe 4d31xw5.exe PID 2668 wrote to memory of 1160 2668 r8jmb9.exe 4d31xw5.exe PID 2668 wrote to memory of 1160 2668 r8jmb9.exe 4d31xw5.exe PID 2668 wrote to memory of 1160 2668 r8jmb9.exe 4d31xw5.exe PID 1160 wrote to memory of 2028 1160 4d31xw5.exe 202313w.exe PID 1160 wrote to memory of 2028 1160 4d31xw5.exe 202313w.exe PID 1160 wrote to memory of 2028 1160 4d31xw5.exe 202313w.exe PID 1160 wrote to memory of 2028 1160 4d31xw5.exe 202313w.exe PID 2028 wrote to memory of 484 2028 202313w.exe f9m7o.exe PID 2028 wrote to memory of 484 2028 202313w.exe f9m7o.exe PID 2028 wrote to memory of 484 2028 202313w.exe f9m7o.exe PID 2028 wrote to memory of 484 2028 202313w.exe f9m7o.exe PID 484 wrote to memory of 2024 484 f9m7o.exe bc3ua.exe PID 484 wrote to memory of 2024 484 f9m7o.exe bc3ua.exe PID 484 wrote to memory of 2024 484 f9m7o.exe bc3ua.exe PID 484 wrote to memory of 2024 484 f9m7o.exe bc3ua.exe PID 2024 wrote to memory of 2708 2024 bc3ua.exe x90c1.exe PID 2024 wrote to memory of 2708 2024 bc3ua.exe x90c1.exe PID 2024 wrote to memory of 2708 2024 bc3ua.exe x90c1.exe PID 2024 wrote to memory of 2708 2024 bc3ua.exe x90c1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ed2b7f23bef127248382b7d67844474ea69b958780d2fa5691bdb0dfa985458.exe"C:\Users\Admin\AppData\Local\Temp\4ed2b7f23bef127248382b7d67844474ea69b958780d2fa5691bdb0dfa985458.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\pxee9m.exec:\pxee9m.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\uvgika.exec:\uvgika.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\s0gg2k.exec:\s0gg2k.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\67xq9q.exec:\67xq9q.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\l4qu2q0.exec:\l4qu2q0.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\bm187c.exec:\bm187c.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\3ki73.exec:\3ki73.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\113el4.exec:\113el4.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\7h97a50.exec:\7h97a50.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\l96g7.exec:\l96g7.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\r8jmb9.exec:\r8jmb9.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\4d31xw5.exec:\4d31xw5.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\202313w.exec:\202313w.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\f9m7o.exec:\f9m7o.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\bc3ua.exec:\bc3ua.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\x90c1.exec:\x90c1.exe17⤵
- Executes dropped EXE
PID:2708 -
\??\c:\69wb1i.exec:\69wb1i.exe18⤵
- Executes dropped EXE
PID:2380 -
\??\c:\26a8iw.exec:\26a8iw.exe19⤵
- Executes dropped EXE
PID:1552 -
\??\c:\xk7un8.exec:\xk7un8.exe20⤵
- Executes dropped EXE
PID:2308 -
\??\c:\511n68.exec:\511n68.exe21⤵
- Executes dropped EXE
PID:2824 -
\??\c:\256265g.exec:\256265g.exe22⤵
- Executes dropped EXE
PID:1172 -
\??\c:\89kg0.exec:\89kg0.exe23⤵
- Executes dropped EXE
PID:3016 -
\??\c:\o8vic9x.exec:\o8vic9x.exe24⤵
- Executes dropped EXE
PID:296 -
\??\c:\858t56w.exec:\858t56w.exe25⤵
- Executes dropped EXE
PID:308 -
\??\c:\40d6cs.exec:\40d6cs.exe26⤵
- Executes dropped EXE
PID:2284 -
\??\c:\e8m157.exec:\e8m157.exe27⤵
- Executes dropped EXE
PID:1796 -
\??\c:\69p1i.exec:\69p1i.exe28⤵
- Executes dropped EXE
PID:1824 -
\??\c:\0gwq3.exec:\0gwq3.exe29⤵
- Executes dropped EXE
PID:1020 -
\??\c:\l59k5.exec:\l59k5.exe30⤵
- Executes dropped EXE
PID:2972 -
\??\c:\41qjc.exec:\41qjc.exe31⤵
- Executes dropped EXE
PID:2200 -
\??\c:\2os37.exec:\2os37.exe32⤵
- Executes dropped EXE
PID:2068 -
\??\c:\h33747k.exec:\h33747k.exe33⤵
- Executes dropped EXE
PID:1212 -
\??\c:\twk7m4.exec:\twk7m4.exe34⤵
- Executes dropped EXE
PID:2180 -
\??\c:\q615jt.exec:\q615jt.exe35⤵PID:1632
-
\??\c:\c73773q.exec:\c73773q.exe36⤵
- Executes dropped EXE
PID:2156 -
\??\c:\6qi9ki3.exec:\6qi9ki3.exe37⤵
- Executes dropped EXE
PID:1352 -
\??\c:\3d0ot6k.exec:\3d0ot6k.exe38⤵
- Executes dropped EXE
PID:2672 -
\??\c:\293wp.exec:\293wp.exe39⤵
- Executes dropped EXE
PID:2684 -
\??\c:\pe90v5m.exec:\pe90v5m.exe40⤵
- Executes dropped EXE
PID:2332 -
\??\c:\o33995.exec:\o33995.exe41⤵
- Executes dropped EXE
PID:2648 -
\??\c:\d5195j.exec:\d5195j.exe42⤵
- Executes dropped EXE
PID:2476 -
\??\c:\t1953.exec:\t1953.exe43⤵
- Executes dropped EXE
PID:3056 -
\??\c:\i14m3.exec:\i14m3.exe44⤵
- Executes dropped EXE
PID:676 -
\??\c:\pa34i.exec:\pa34i.exe45⤵
- Executes dropped EXE
PID:2016 -
\??\c:\61in5.exec:\61in5.exe46⤵
- Executes dropped EXE
PID:2696 -
\??\c:\7v6vq3.exec:\7v6vq3.exe47⤵
- Executes dropped EXE
PID:1496 -
\??\c:\h8drc.exec:\h8drc.exe48⤵
- Executes dropped EXE
PID:2784 -
\??\c:\0kkm9.exec:\0kkm9.exe49⤵
- Executes dropped EXE
PID:3068 -
\??\c:\rw527.exec:\rw527.exe50⤵
- Executes dropped EXE
PID:1684 -
\??\c:\t50p5.exec:\t50p5.exe51⤵
- Executes dropped EXE
PID:1408 -
\??\c:\r3790.exec:\r3790.exe52⤵
- Executes dropped EXE
PID:2192 -
\??\c:\0nq0q.exec:\0nq0q.exe53⤵
- Executes dropped EXE
PID:484 -
\??\c:\af9kd.exec:\af9kd.exe54⤵
- Executes dropped EXE
PID:2716 -
\??\c:\b70mk.exec:\b70mk.exe55⤵
- Executes dropped EXE
PID:2344 -
\??\c:\47r16s1.exec:\47r16s1.exe56⤵
- Executes dropped EXE
PID:2096 -
\??\c:\75pr39.exec:\75pr39.exe57⤵
- Executes dropped EXE
PID:628 -
\??\c:\to19g.exec:\to19g.exe58⤵
- Executes dropped EXE
PID:2132 -
\??\c:\8c15ct.exec:\8c15ct.exe59⤵
- Executes dropped EXE
PID:2836 -
\??\c:\rs1g9u.exec:\rs1g9u.exe60⤵
- Executes dropped EXE
PID:2100 -
\??\c:\111293i.exec:\111293i.exe61⤵
- Executes dropped EXE
PID:2256 -
\??\c:\t83o7e.exec:\t83o7e.exe62⤵
- Executes dropped EXE
PID:2108 -
\??\c:\23bex6.exec:\23bex6.exe63⤵
- Executes dropped EXE
PID:3040 -
\??\c:\49ko3m.exec:\49ko3m.exe64⤵
- Executes dropped EXE
PID:1820 -
\??\c:\tv18c.exec:\tv18c.exe65⤵
- Executes dropped EXE
PID:436 -
\??\c:\4232430.exec:\4232430.exe66⤵
- Executes dropped EXE
PID:952 -
\??\c:\4943ga.exec:\4943ga.exe67⤵PID:1828
-
\??\c:\6ag17i.exec:\6ag17i.exe68⤵PID:2188
-
\??\c:\03ec4c.exec:\03ec4c.exe69⤵PID:608
-
\??\c:\dk508.exec:\dk508.exe70⤵PID:1020
-
\??\c:\j8t1j.exec:\j8t1j.exe71⤵PID:2144
-
\??\c:\9stp33.exec:\9stp33.exe72⤵PID:548
-
\??\c:\jwuu7.exec:\jwuu7.exe73⤵PID:1536
-
\??\c:\hf3s9m9.exec:\hf3s9m9.exe74⤵PID:1760
-
\??\c:\83gkku.exec:\83gkku.exe75⤵PID:1600
-
\??\c:\i54j9w.exec:\i54j9w.exe76⤵PID:2508
-
\??\c:\479m5.exec:\479m5.exe77⤵PID:2620
-
\??\c:\11d35k9.exec:\11d35k9.exe78⤵PID:2496
-
\??\c:\w9wb41.exec:\w9wb41.exe79⤵PID:2520
-
\??\c:\2arhaw.exec:\2arhaw.exe80⤵PID:2440
-
\??\c:\892p5f9.exec:\892p5f9.exe81⤵PID:2688
-
\??\c:\vgcequ3.exec:\vgcequ3.exe82⤵PID:2332
-
\??\c:\85twp3t.exec:\85twp3t.exe83⤵PID:2524
-
\??\c:\vma3sx.exec:\vma3sx.exe84⤵PID:2336
-
\??\c:\3r1tj08.exec:\3r1tj08.exe85⤵PID:776
-
\??\c:\pq11wb.exec:\pq11wb.exe86⤵PID:688
-
\??\c:\tl0e2uq.exec:\tl0e2uq.exe87⤵PID:2196
-
\??\c:\1i9wfs.exec:\1i9wfs.exe88⤵PID:2768
-
\??\c:\j5dn8r.exec:\j5dn8r.exe89⤵PID:2724
-
\??\c:\54v2d.exec:\54v2d.exe90⤵PID:2472
-
\??\c:\4wl97.exec:\4wl97.exe91⤵PID:2268
-
\??\c:\m6s14wl.exec:\m6s14wl.exe92⤵PID:1604
-
\??\c:\4p16m.exec:\4p16m.exe93⤵PID:772
-
\??\c:\do70p9.exec:\do70p9.exe94⤵PID:1676
-
\??\c:\51379t1.exec:\51379t1.exe95⤵PID:1896
-
\??\c:\pe9ooa.exec:\pe9ooa.exe96⤵PID:1912
-
\??\c:\i99i2a5.exec:\i99i2a5.exe97⤵PID:1640
-
\??\c:\ksew7.exec:\ksew7.exe98⤵PID:2380
-
\??\c:\8bis6to.exec:\8bis6to.exe99⤵PID:2312
-
\??\c:\l52kc.exec:\l52kc.exe100⤵PID:836
-
\??\c:\m72w9.exec:\m72w9.exe101⤵PID:2732
-
\??\c:\9ul78qx.exec:\9ul78qx.exe102⤵PID:2836
-
\??\c:\tl090.exec:\tl090.exe103⤵PID:1924
-
\??\c:\030mx.exec:\030mx.exe104⤵PID:1200
-
\??\c:\3gessc3.exec:\3gessc3.exe105⤵PID:1832
-
\??\c:\109i9a.exec:\109i9a.exe106⤵PID:1560
-
\??\c:\66u54.exec:\66u54.exe107⤵PID:1952
-
\??\c:\r79hb.exec:\r79hb.exe108⤵PID:436
-
\??\c:\54h6l.exec:\54h6l.exe109⤵PID:952
-
\??\c:\ia57od4.exec:\ia57od4.exe110⤵PID:1824
-
\??\c:\doicqoi.exec:\doicqoi.exe111⤵PID:2188
-
\??\c:\20cm76v.exec:\20cm76v.exe112⤵PID:2376
-
\??\c:\d719g75.exec:\d719g75.exe113⤵PID:1884
-
\??\c:\5s31407.exec:\5s31407.exe114⤵PID:708
-
\??\c:\7917i1.exec:\7917i1.exe115⤵PID:548
-
\??\c:\x18iou.exec:\x18iou.exe116⤵PID:1620
-
\??\c:\5i5512.exec:\5i5512.exe117⤵PID:1760
-
\??\c:\016g09.exec:\016g09.exe118⤵PID:2956
-
\??\c:\fdmp3.exec:\fdmp3.exe119⤵PID:2032
-
\??\c:\1o4w0.exec:\1o4w0.exe120⤵PID:1964
-
\??\c:\086r4.exec:\086r4.exe121⤵PID:2652
-
\??\c:\j7k38j7.exec:\j7k38j7.exe122⤵PID:2520
-
\??\c:\8ds0tbw.exec:\8ds0tbw.exe123⤵PID:2576
-
\??\c:\61tq9e.exec:\61tq9e.exe124⤵PID:2400
-
\??\c:\bg34v.exec:\bg34v.exe125⤵PID:2920
-
\??\c:\7j0g1.exec:\7j0g1.exe126⤵PID:2468
-
\??\c:\k74lai.exec:\k74lai.exe127⤵PID:1348
-
\??\c:\43ma2u.exec:\43ma2u.exe128⤵PID:2584
-
\??\c:\n73w15.exec:\n73w15.exe129⤵PID:1356
-
\??\c:\j7c9x3o.exec:\j7c9x3o.exe130⤵PID:2772
-
\??\c:\q3c1w.exec:\q3c1w.exe131⤵PID:2776
-
\??\c:\i4eggc.exec:\i4eggc.exe132⤵PID:2884
-
\??\c:\9htx2it.exec:\9htx2it.exe133⤵PID:2724
-
\??\c:\05s577.exec:\05s577.exe134⤵PID:1668
-
\??\c:\2eskf.exec:\2eskf.exe135⤵PID:1680
-
\??\c:\eo471n.exec:\eo471n.exe136⤵PID:388
-
\??\c:\m9859m.exec:\m9859m.exe137⤵PID:1956
-
\??\c:\1582v3.exec:\1582v3.exe138⤵PID:1896
-
\??\c:\8ml1q7.exec:\8ml1q7.exe139⤵PID:1912
-
\??\c:\xkq13.exec:\xkq13.exe140⤵PID:1656
-
\??\c:\0fxc52.exec:\0fxc52.exe141⤵PID:1652
-
\??\c:\2skp13h.exec:\2skp13h.exe142⤵PID:556
-
\??\c:\t738l9.exec:\t738l9.exe143⤵PID:2312
-
\??\c:\6m507g5.exec:\6m507g5.exe144⤵PID:2272
-
\??\c:\01t0j73.exec:\01t0j73.exe145⤵PID:2128
-
\??\c:\21936i.exec:\21936i.exe146⤵PID:636
-
\??\c:\12r4ej6.exec:\12r4ej6.exe147⤵PID:2000
-
\??\c:\4359519.exec:\4359519.exe148⤵PID:1928
-
\??\c:\05wps.exec:\05wps.exe149⤵PID:1576
-
\??\c:\7wkt4me.exec:\7wkt4me.exe150⤵PID:1276
-
\??\c:\0997op.exec:\0997op.exe151⤵PID:1916
-
\??\c:\9336g9.exec:\9336g9.exe152⤵PID:536
-
\??\c:\h1d7t95.exec:\h1d7t95.exe153⤵PID:2488
-
\??\c:\u8w38e7.exec:\u8w38e7.exe154⤵PID:1824
-
\??\c:\67s9i.exec:\67s9i.exe155⤵PID:2872
-
\??\c:\nk73e.exec:\nk73e.exe156⤵PID:1520
-
\??\c:\k5kh9j.exec:\k5kh9j.exe157⤵PID:1884
-
\??\c:\23wf0.exec:\23wf0.exe158⤵PID:708
-
\??\c:\05qs3.exec:\05qs3.exe159⤵PID:1212
-
\??\c:\2qx1m.exec:\2qx1m.exe160⤵PID:2592
-
\??\c:\65wp2ii.exec:\65wp2ii.exe161⤵PID:2976
-
\??\c:\hl53955.exec:\hl53955.exe162⤵PID:1764
-
\??\c:\5o3j9m1.exec:\5o3j9m1.exe163⤵PID:2552
-
\??\c:\3ql96m8.exec:\3ql96m8.exe164⤵PID:2644
-
\??\c:\q5j3m.exec:\q5j3m.exe165⤵PID:2496
-
\??\c:\85on2ap.exec:\85on2ap.exe166⤵PID:2436
-
\??\c:\0lj7k.exec:\0lj7k.exe167⤵PID:2424
-
\??\c:\7dvijg.exec:\7dvijg.exe168⤵PID:2292
-
\??\c:\vkb82.exec:\vkb82.exe169⤵PID:2448
-
\??\c:\3w51q5.exec:\3w51q5.exe170⤵PID:2904
-
\??\c:\re34r3.exec:\re34r3.exe171⤵PID:1192
-
\??\c:\7w3ecu5.exec:\7w3ecu5.exe172⤵PID:2584
-
\??\c:\5d3o93o.exec:\5d3o93o.exe173⤵PID:2744
-
\??\c:\rl2d3.exec:\rl2d3.exe174⤵PID:1512
-
\??\c:\c3m7wn.exec:\c3m7wn.exe175⤵PID:2500
-
\??\c:\l52o16.exec:\l52o16.exe176⤵PID:2472
-
\??\c:\dka8lh4.exec:\dka8lh4.exe177⤵PID:2268
-
\??\c:\gnnb8.exec:\gnnb8.exe178⤵PID:2812
-
\??\c:\6jsh5u9.exec:\6jsh5u9.exe179⤵PID:772
-
\??\c:\rc88896.exec:\rc88896.exe180⤵PID:2024
-
\??\c:\k3eu3.exec:\k3eu3.exe181⤵PID:1580
-
\??\c:\2g70aim.exec:\2g70aim.exe182⤵PID:2580
-
\??\c:\tq35xf.exec:\tq35xf.exe183⤵PID:2252
-
\??\c:\ta9a39u.exec:\ta9a39u.exe184⤵PID:2380
-
\??\c:\8kg1h4.exec:\8kg1h4.exe185⤵PID:2132
-
\??\c:\fbakou.exec:\fbakou.exe186⤵PID:1116
-
\??\c:\7gx7o22.exec:\7gx7o22.exe187⤵PID:2748
-
\??\c:\6xp00uj.exec:\6xp00uj.exe188⤵PID:2256
-
\??\c:\730w7q.exec:\730w7q.exe189⤵PID:2108
-
\??\c:\7ql7av.exec:\7ql7av.exe190⤵PID:296
-
\??\c:\58w4t6.exec:\58w4t6.exe191⤵PID:1832
-
\??\c:\4m0c4.exec:\4m0c4.exe192⤵PID:1328
-
\??\c:\l58f4.exec:\l58f4.exe193⤵PID:976
-
\??\c:\45csm0.exec:\45csm0.exe194⤵PID:904
-
\??\c:\27su9q.exec:\27su9q.exe195⤵PID:2164
-
\??\c:\2u1e12.exec:\2u1e12.exe196⤵PID:2932
-
\??\c:\672pt.exec:\672pt.exe197⤵PID:2924
-
\??\c:\k851175.exec:\k851175.exe198⤵PID:2840
-
\??\c:\31bvku5.exec:\31bvku5.exe199⤵PID:2692
-
\??\c:\x0m522.exec:\x0m522.exe200⤵PID:2220
-
\??\c:\k8an56i.exec:\k8an56i.exe201⤵PID:2960
-
\??\c:\83g7mr.exec:\83g7mr.exe202⤵PID:708
-
\??\c:\i4139.exec:\i4139.exe203⤵PID:2180
-
\??\c:\o27qhoe.exec:\o27qhoe.exe204⤵PID:1620
-
\??\c:\21555.exec:\21555.exe205⤵PID:1976
-
\??\c:\3t5923q.exec:\3t5923q.exe206⤵PID:2808
-
\??\c:\f1w66d4.exec:\f1w66d4.exe207⤵PID:2984
-
\??\c:\83h70o.exec:\83h70o.exe208⤵PID:2620
-
\??\c:\92d58b.exec:\92d58b.exe209⤵PID:2496
-
\??\c:\vscc07.exec:\vscc07.exe210⤵PID:2788
-
\??\c:\ne526.exec:\ne526.exe211⤵PID:2424
-
\??\c:\1x12p3.exec:\1x12p3.exe212⤵PID:2888
-
\??\c:\6eama.exec:\6eama.exe213⤵PID:1184
-
\??\c:\lmago.exec:\lmago.exe214⤵PID:2336
-
\??\c:\9f8ip5l.exec:\9f8ip5l.exe215⤵PID:688
-
\??\c:\jw59kj0.exec:\jw59kj0.exe216⤵PID:1496
-
\??\c:\275k1nl.exec:\275k1nl.exe217⤵PID:2792
-
\??\c:\vasr0.exec:\vasr0.exe218⤵PID:1120
-
\??\c:\hjjbl9u.exec:\hjjbl9u.exe219⤵PID:1092
-
\??\c:\fxe526.exec:\fxe526.exe220⤵PID:1264
-
\??\c:\2fuc7u.exec:\2fuc7u.exe221⤵PID:696
-
\??\c:\pskantq.exec:\pskantq.exe222⤵PID:1904
-
\??\c:\rt52x.exec:\rt52x.exe223⤵PID:2708
-
\??\c:\tmv79au.exec:\tmv79au.exe224⤵PID:2716
-
\??\c:\4737mk.exec:\4737mk.exe225⤵PID:1568
-
\??\c:\csc3u4c.exec:\csc3u4c.exe226⤵PID:628
-
\??\c:\li4nif3.exec:\li4nif3.exe227⤵PID:2096
-
\??\c:\1571v8.exec:\1571v8.exe228⤵PID:2304
-
\??\c:\b37335.exec:\b37335.exe229⤵PID:2312
-
\??\c:\006tm.exec:\006tm.exe230⤵PID:3020
-
\??\c:\ds107.exec:\ds107.exe231⤵PID:2128
-
\??\c:\k08k7.exec:\k08k7.exe232⤵PID:2112
-
\??\c:\1e0p5c.exec:\1e0p5c.exe233⤵PID:2636
-
\??\c:\vom7w.exec:\vom7w.exe234⤵PID:296
-
\??\c:\84a81.exec:\84a81.exe235⤵PID:1560
-
\??\c:\o2kk0.exec:\o2kk0.exe236⤵PID:2284
-
\??\c:\ld23l9.exec:\ld23l9.exe237⤵PID:1916
-
\??\c:\kce9go.exec:\kce9go.exe238⤵PID:904
-
\??\c:\7e15ko3.exec:\7e15ko3.exe239⤵PID:2488
-
\??\c:\192co3i.exec:\192co3i.exe240⤵PID:2932
-
\??\c:\80ir6.exec:\80ir6.exe241⤵PID:2924
-
\??\c:\u9199am.exec:\u9199am.exe242⤵PID:1996