Analysis
-
max time kernel
152s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 02:51
Behavioral task
behavioral1
Sample
b0887eb7d791121286e6d7306a8465fc9857f3fc378f35f1dd4b4eb28dfe6228.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
b0887eb7d791121286e6d7306a8465fc9857f3fc378f35f1dd4b4eb28dfe6228.exe
-
Size
59KB
-
MD5
2252261169097b187477271dfe8c0da3
-
SHA1
8740de7edc8312be177b0df7d022aad1ac6739b2
-
SHA256
b0887eb7d791121286e6d7306a8465fc9857f3fc378f35f1dd4b4eb28dfe6228
-
SHA512
3f9e74eabc113ae58e63b1ed5ed6e16a24bbd5f35487859ad291a15fc23864a300a9236f4eabca6c903fb79a062b33333e4b2b68e1413af24434920c3f41361b
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+IJPhbMiFW:zhOmTsF93UYfwC6GIoutiTm5hIiFW
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/392-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2620-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2588-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2256-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1880-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1956-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/760-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2800-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4364-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1688-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2780-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3812-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2672-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4008-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1692-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1532-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3016-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4592-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/968-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2936-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1836-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3900-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3172-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4484-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3980-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1516-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/392-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1896-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1376-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3960-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1880-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4116-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3652-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5104-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4784-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3320-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2524-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3992-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1108-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3140-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4212-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4988-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2248-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/872-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1252-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4600-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4168-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1376-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1880-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/208-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1948-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3476-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3476-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2464-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4408-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3980-378-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3808-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2300-393-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3620-432-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/632-455-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/348-468-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/216-545-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1708-574-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1868-656-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/392-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\g3o32.exe UPX behavioral2/memory/392-5-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\b3w3cb3.exe UPX behavioral2/memory/2620-9-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\160lht2.exe UPX behavioral2/memory/2588-14-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\26p82.exe UPX behavioral2/memory/2256-19-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\fs4kq9.exe UPX behavioral2/memory/1880-24-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1956-29-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\7947nls.exe UPX \??\c:\tc0al.exe UPX behavioral2/memory/760-38-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\65r6b0.exe UPX \??\c:\7gj95a.exe UPX behavioral2/memory/2800-43-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4364-48-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\750k9f.exe UPX C:\u5m49f.exe UPX behavioral2/memory/1688-56-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2780-53-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\q3o1unu.exe UPX C:\987wbi.exe UPX behavioral2/memory/3812-63-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2672-68-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\rf991.exe UPX C:\056w3.exe UPX C:\0dq64.exe UPX behavioral2/memory/4008-77-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\x3lm15g.exe UPX behavioral2/memory/1692-82-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\9tm0wb.exe UPX C:\31580m7.exe UPX C:\904j5x0.exe UPX \??\c:\82ww99.exe UPX behavioral2/memory/1532-101-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\75en024.exe UPX behavioral2/memory/3016-104-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\iu3gd93.exe UPX C:\x3ajp.exe UPX C:\24r8j.exe UPX C:\33oir.exe UPX behavioral2/memory/4592-121-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\rmk818.exe UPX behavioral2/memory/968-127-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2936-131-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\35bwhq.exe UPX behavioral2/memory/4036-133-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\lsw0j.exe UPX C:\5c5c022.exe UPX behavioral2/memory/1836-141-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\rbn79.exe UPX behavioral2/memory/3900-150-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\15o1svg.exe UPX behavioral2/memory/3172-154-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4484-159-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3980-162-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1516-165-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/392-168-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1896-171-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1376-174-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3960-177-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
g3o32.exeb3w3cb3.exe160lht2.exe26p82.exefs4kq9.exe7947nls.exetc0al.exe65r6b0.exe7gj95a.exe750k9f.exeu5m49f.exeq3o1unu.exe987wbi.exerf991.exe056w3.exe0dq64.exex3lm15g.exe9tm0wb.exe31580m7.exe904j5x0.exe82ww99.exe75en024.exeiu3gd93.exex3ajp.exe24r8j.exe33oir.exermk818.exe35bwhq.exelsw0j.exe5c5c022.exerbn79.exe15o1svg.exe53iu38.exe17bvex0.exel8v5m.exebwk70.exee06w9.exe7v3189.exe01kb5p.exen1mki.exe7ous483.exe657m20m.exedq123gg.exel459093.exe52g19.exelb593v.exe9581u1.exeko51i8v.exe310j7.exer5930kd.exef75o0f.exe4k325e1.exe1lws2.exekjm17.exe9u15a.exelk854n6.exef6515v.exes958pa9.exeoor261s.exe68oi87.exek4i69ii.exe3clc7.exee74n44.exe9he6u5.exepid process 2620 g3o32.exe 2588 b3w3cb3.exe 2256 160lht2.exe 1880 26p82.exe 1956 fs4kq9.exe 208 7947nls.exe 760 tc0al.exe 2800 65r6b0.exe 4364 7gj95a.exe 2780 750k9f.exe 1688 u5m49f.exe 3812 q3o1unu.exe 2672 987wbi.exe 3140 rf991.exe 4008 056w3.exe 1692 0dq64.exe 5028 x3lm15g.exe 2304 9tm0wb.exe 1148 31580m7.exe 1532 904j5x0.exe 3016 82ww99.exe 4988 75en024.exe 4372 iu3gd93.exe 3784 x3ajp.exe 4592 24r8j.exe 968 33oir.exe 2936 rmk818.exe 4036 35bwhq.exe 1836 lsw0j.exe 4496 5c5c022.exe 3900 rbn79.exe 3172 15o1svg.exe 5092 53iu38.exe 4484 17bvex0.exe 3980 l8v5m.exe 1516 bwk70.exe 392 e06w9.exe 1896 7v3189.exe 1376 01kb5p.exe 3960 n1mki.exe 3488 7ous483.exe 1880 657m20m.exe 4116 dq123gg.exe 4696 l459093.exe 2272 52g19.exe 3652 lb593v.exe 2424 9581u1.exe 5104 ko51i8v.exe 4784 310j7.exe 3320 r5930kd.exe 2780 f75o0f.exe 644 4k325e1.exe 2524 1lws2.exe 2932 kjm17.exe 3992 9u15a.exe 1108 lk854n6.exe 4820 f6515v.exe 3140 s958pa9.exe 3968 oor261s.exe 4212 68oi87.exe 2056 k4i69ii.exe 2028 3clc7.exe 3504 e74n44.exe 4428 9he6u5.exe -
Processes:
resource yara_rule behavioral2/memory/392-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\g3o32.exe upx behavioral2/memory/392-5-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\b3w3cb3.exe upx behavioral2/memory/2620-9-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\160lht2.exe upx behavioral2/memory/2588-14-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\26p82.exe upx behavioral2/memory/2256-19-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fs4kq9.exe upx behavioral2/memory/1880-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1956-29-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7947nls.exe upx \??\c:\tc0al.exe upx behavioral2/memory/760-38-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\65r6b0.exe upx \??\c:\7gj95a.exe upx behavioral2/memory/2800-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4364-48-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\750k9f.exe upx C:\u5m49f.exe upx behavioral2/memory/1688-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2780-53-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\q3o1unu.exe upx C:\987wbi.exe upx behavioral2/memory/3812-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2672-68-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rf991.exe upx C:\056w3.exe upx C:\0dq64.exe upx behavioral2/memory/4008-77-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\x3lm15g.exe upx behavioral2/memory/1692-82-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9tm0wb.exe upx C:\31580m7.exe upx C:\904j5x0.exe upx \??\c:\82ww99.exe upx behavioral2/memory/1532-101-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\75en024.exe upx behavioral2/memory/3016-104-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\iu3gd93.exe upx C:\x3ajp.exe upx C:\24r8j.exe upx C:\33oir.exe upx behavioral2/memory/4592-121-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rmk818.exe upx behavioral2/memory/968-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2936-131-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\35bwhq.exe upx behavioral2/memory/4036-133-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lsw0j.exe upx C:\5c5c022.exe upx behavioral2/memory/1836-141-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rbn79.exe upx behavioral2/memory/3900-150-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\15o1svg.exe upx behavioral2/memory/3172-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4484-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3980-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1516-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/392-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1896-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1376-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3960-177-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b0887eb7d791121286e6d7306a8465fc9857f3fc378f35f1dd4b4eb28dfe6228.exeg3o32.exeb3w3cb3.exe160lht2.exe26p82.exefs4kq9.exe7947nls.exetc0al.exe65r6b0.exe7gj95a.exe750k9f.exeu5m49f.exeq3o1unu.exe987wbi.exerf991.exe056w3.exe0dq64.exex3lm15g.exe9tm0wb.exe31580m7.exe904j5x0.exe82ww99.exedescription pid process target process PID 392 wrote to memory of 2620 392 b0887eb7d791121286e6d7306a8465fc9857f3fc378f35f1dd4b4eb28dfe6228.exe g3o32.exe PID 392 wrote to memory of 2620 392 b0887eb7d791121286e6d7306a8465fc9857f3fc378f35f1dd4b4eb28dfe6228.exe g3o32.exe PID 392 wrote to memory of 2620 392 b0887eb7d791121286e6d7306a8465fc9857f3fc378f35f1dd4b4eb28dfe6228.exe g3o32.exe PID 2620 wrote to memory of 2588 2620 g3o32.exe b3w3cb3.exe PID 2620 wrote to memory of 2588 2620 g3o32.exe b3w3cb3.exe PID 2620 wrote to memory of 2588 2620 g3o32.exe b3w3cb3.exe PID 2588 wrote to memory of 2256 2588 b3w3cb3.exe 160lht2.exe PID 2588 wrote to memory of 2256 2588 b3w3cb3.exe 160lht2.exe PID 2588 wrote to memory of 2256 2588 b3w3cb3.exe 160lht2.exe PID 2256 wrote to memory of 1880 2256 160lht2.exe 26p82.exe PID 2256 wrote to memory of 1880 2256 160lht2.exe 26p82.exe PID 2256 wrote to memory of 1880 2256 160lht2.exe 26p82.exe PID 1880 wrote to memory of 1956 1880 26p82.exe fs4kq9.exe PID 1880 wrote to memory of 1956 1880 26p82.exe fs4kq9.exe PID 1880 wrote to memory of 1956 1880 26p82.exe fs4kq9.exe PID 1956 wrote to memory of 208 1956 fs4kq9.exe 7947nls.exe PID 1956 wrote to memory of 208 1956 fs4kq9.exe 7947nls.exe PID 1956 wrote to memory of 208 1956 fs4kq9.exe 7947nls.exe PID 208 wrote to memory of 760 208 7947nls.exe tc0al.exe PID 208 wrote to memory of 760 208 7947nls.exe tc0al.exe PID 208 wrote to memory of 760 208 7947nls.exe tc0al.exe PID 760 wrote to memory of 2800 760 tc0al.exe 65r6b0.exe PID 760 wrote to memory of 2800 760 tc0al.exe 65r6b0.exe PID 760 wrote to memory of 2800 760 tc0al.exe 65r6b0.exe PID 2800 wrote to memory of 4364 2800 65r6b0.exe 7gj95a.exe PID 2800 wrote to memory of 4364 2800 65r6b0.exe 7gj95a.exe PID 2800 wrote to memory of 4364 2800 65r6b0.exe 7gj95a.exe PID 4364 wrote to memory of 2780 4364 7gj95a.exe 750k9f.exe PID 4364 wrote to memory of 2780 4364 7gj95a.exe 750k9f.exe PID 4364 wrote to memory of 2780 4364 7gj95a.exe 750k9f.exe PID 2780 wrote to memory of 1688 2780 750k9f.exe u5m49f.exe PID 2780 wrote to memory of 1688 2780 750k9f.exe u5m49f.exe PID 2780 wrote to memory of 1688 2780 750k9f.exe u5m49f.exe PID 1688 wrote to memory of 3812 1688 u5m49f.exe q3o1unu.exe PID 1688 wrote to memory of 3812 1688 u5m49f.exe q3o1unu.exe PID 1688 wrote to memory of 3812 1688 u5m49f.exe q3o1unu.exe PID 3812 wrote to memory of 2672 3812 q3o1unu.exe 987wbi.exe PID 3812 wrote to memory of 2672 3812 q3o1unu.exe 987wbi.exe PID 3812 wrote to memory of 2672 3812 q3o1unu.exe 987wbi.exe PID 2672 wrote to memory of 3140 2672 987wbi.exe rf991.exe PID 2672 wrote to memory of 3140 2672 987wbi.exe rf991.exe PID 2672 wrote to memory of 3140 2672 987wbi.exe rf991.exe PID 3140 wrote to memory of 4008 3140 rf991.exe 056w3.exe PID 3140 wrote to memory of 4008 3140 rf991.exe 056w3.exe PID 3140 wrote to memory of 4008 3140 rf991.exe 056w3.exe PID 4008 wrote to memory of 1692 4008 056w3.exe 0dq64.exe PID 4008 wrote to memory of 1692 4008 056w3.exe 0dq64.exe PID 4008 wrote to memory of 1692 4008 056w3.exe 0dq64.exe PID 1692 wrote to memory of 5028 1692 0dq64.exe x3lm15g.exe PID 1692 wrote to memory of 5028 1692 0dq64.exe x3lm15g.exe PID 1692 wrote to memory of 5028 1692 0dq64.exe x3lm15g.exe PID 5028 wrote to memory of 2304 5028 x3lm15g.exe 9tm0wb.exe PID 5028 wrote to memory of 2304 5028 x3lm15g.exe 9tm0wb.exe PID 5028 wrote to memory of 2304 5028 x3lm15g.exe 9tm0wb.exe PID 2304 wrote to memory of 1148 2304 9tm0wb.exe 31580m7.exe PID 2304 wrote to memory of 1148 2304 9tm0wb.exe 31580m7.exe PID 2304 wrote to memory of 1148 2304 9tm0wb.exe 31580m7.exe PID 1148 wrote to memory of 1532 1148 31580m7.exe 904j5x0.exe PID 1148 wrote to memory of 1532 1148 31580m7.exe 904j5x0.exe PID 1148 wrote to memory of 1532 1148 31580m7.exe 904j5x0.exe PID 1532 wrote to memory of 3016 1532 904j5x0.exe 82ww99.exe PID 1532 wrote to memory of 3016 1532 904j5x0.exe 82ww99.exe PID 1532 wrote to memory of 3016 1532 904j5x0.exe 82ww99.exe PID 3016 wrote to memory of 4988 3016 82ww99.exe 75en024.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0887eb7d791121286e6d7306a8465fc9857f3fc378f35f1dd4b4eb28dfe6228.exe"C:\Users\Admin\AppData\Local\Temp\b0887eb7d791121286e6d7306a8465fc9857f3fc378f35f1dd4b4eb28dfe6228.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\g3o32.exec:\g3o32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\b3w3cb3.exec:\b3w3cb3.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\160lht2.exec:\160lht2.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\26p82.exec:\26p82.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\fs4kq9.exec:\fs4kq9.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\7947nls.exec:\7947nls.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\tc0al.exec:\tc0al.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\65r6b0.exec:\65r6b0.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\7gj95a.exec:\7gj95a.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\750k9f.exec:\750k9f.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\u5m49f.exec:\u5m49f.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\q3o1unu.exec:\q3o1unu.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\987wbi.exec:\987wbi.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\rf991.exec:\rf991.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\056w3.exec:\056w3.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\0dq64.exec:\0dq64.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\x3lm15g.exec:\x3lm15g.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\9tm0wb.exec:\9tm0wb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\31580m7.exec:\31580m7.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\904j5x0.exec:\904j5x0.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\82ww99.exec:\82ww99.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\75en024.exec:\75en024.exe23⤵
- Executes dropped EXE
PID:4988 -
\??\c:\iu3gd93.exec:\iu3gd93.exe24⤵
- Executes dropped EXE
PID:4372 -
\??\c:\x3ajp.exec:\x3ajp.exe25⤵
- Executes dropped EXE
PID:3784 -
\??\c:\24r8j.exec:\24r8j.exe26⤵
- Executes dropped EXE
PID:4592 -
\??\c:\33oir.exec:\33oir.exe27⤵
- Executes dropped EXE
PID:968 -
\??\c:\rmk818.exec:\rmk818.exe28⤵
- Executes dropped EXE
PID:2936 -
\??\c:\35bwhq.exec:\35bwhq.exe29⤵
- Executes dropped EXE
PID:4036 -
\??\c:\lsw0j.exec:\lsw0j.exe30⤵
- Executes dropped EXE
PID:1836 -
\??\c:\5c5c022.exec:\5c5c022.exe31⤵
- Executes dropped EXE
PID:4496 -
\??\c:\rbn79.exec:\rbn79.exe32⤵
- Executes dropped EXE
PID:3900 -
\??\c:\15o1svg.exec:\15o1svg.exe33⤵
- Executes dropped EXE
PID:3172 -
\??\c:\53iu38.exec:\53iu38.exe34⤵
- Executes dropped EXE
PID:5092 -
\??\c:\17bvex0.exec:\17bvex0.exe35⤵
- Executes dropped EXE
PID:4484 -
\??\c:\l8v5m.exec:\l8v5m.exe36⤵
- Executes dropped EXE
PID:3980 -
\??\c:\bwk70.exec:\bwk70.exe37⤵
- Executes dropped EXE
PID:1516 -
\??\c:\e06w9.exec:\e06w9.exe38⤵
- Executes dropped EXE
PID:392 -
\??\c:\7v3189.exec:\7v3189.exe39⤵
- Executes dropped EXE
PID:1896 -
\??\c:\01kb5p.exec:\01kb5p.exe40⤵
- Executes dropped EXE
PID:1376 -
\??\c:\n1mki.exec:\n1mki.exe41⤵
- Executes dropped EXE
PID:3960 -
\??\c:\7ous483.exec:\7ous483.exe42⤵
- Executes dropped EXE
PID:3488 -
\??\c:\657m20m.exec:\657m20m.exe43⤵
- Executes dropped EXE
PID:1880 -
\??\c:\dq123gg.exec:\dq123gg.exe44⤵
- Executes dropped EXE
PID:4116 -
\??\c:\l459093.exec:\l459093.exe45⤵
- Executes dropped EXE
PID:4696 -
\??\c:\52g19.exec:\52g19.exe46⤵
- Executes dropped EXE
PID:2272 -
\??\c:\lb593v.exec:\lb593v.exe47⤵
- Executes dropped EXE
PID:3652 -
\??\c:\9581u1.exec:\9581u1.exe48⤵
- Executes dropped EXE
PID:2424 -
\??\c:\ko51i8v.exec:\ko51i8v.exe49⤵
- Executes dropped EXE
PID:5104 -
\??\c:\310j7.exec:\310j7.exe50⤵
- Executes dropped EXE
PID:4784 -
\??\c:\r5930kd.exec:\r5930kd.exe51⤵
- Executes dropped EXE
PID:3320 -
\??\c:\f75o0f.exec:\f75o0f.exe52⤵
- Executes dropped EXE
PID:2780 -
\??\c:\4k325e1.exec:\4k325e1.exe53⤵
- Executes dropped EXE
PID:644 -
\??\c:\1lws2.exec:\1lws2.exe54⤵
- Executes dropped EXE
PID:2524 -
\??\c:\kjm17.exec:\kjm17.exe55⤵
- Executes dropped EXE
PID:2932 -
\??\c:\9u15a.exec:\9u15a.exe56⤵
- Executes dropped EXE
PID:3992 -
\??\c:\lk854n6.exec:\lk854n6.exe57⤵
- Executes dropped EXE
PID:1108 -
\??\c:\f6515v.exec:\f6515v.exe58⤵
- Executes dropped EXE
PID:4820 -
\??\c:\s958pa9.exec:\s958pa9.exe59⤵
- Executes dropped EXE
PID:3140 -
\??\c:\oor261s.exec:\oor261s.exe60⤵
- Executes dropped EXE
PID:3968 -
\??\c:\68oi87.exec:\68oi87.exe61⤵
- Executes dropped EXE
PID:4212 -
\??\c:\k4i69ii.exec:\k4i69ii.exe62⤵
- Executes dropped EXE
PID:2056 -
\??\c:\3clc7.exec:\3clc7.exe63⤵
- Executes dropped EXE
PID:2028 -
\??\c:\e74n44.exec:\e74n44.exe64⤵
- Executes dropped EXE
PID:3504 -
\??\c:\9he6u5.exec:\9he6u5.exe65⤵
- Executes dropped EXE
PID:4428 -
\??\c:\ua2300.exec:\ua2300.exe66⤵PID:3884
-
\??\c:\3449n0u.exec:\3449n0u.exe67⤵PID:1860
-
\??\c:\0k61usa.exec:\0k61usa.exe68⤵PID:4908
-
\??\c:\t3h5x.exec:\t3h5x.exe69⤵PID:4988
-
\??\c:\4v33xox.exec:\4v33xox.exe70⤵PID:1696
-
\??\c:\x9b86.exec:\x9b86.exe71⤵PID:4568
-
\??\c:\78wkxr.exec:\78wkxr.exe72⤵PID:2428
-
\??\c:\0baqf.exec:\0baqf.exe73⤵PID:4060
-
\??\c:\54713md.exec:\54713md.exe74⤵PID:1176
-
\??\c:\761a1.exec:\761a1.exe75⤵PID:2248
-
\??\c:\8600664.exec:\8600664.exe76⤵PID:4036
-
\??\c:\c4423.exec:\c4423.exe77⤵PID:1904
-
\??\c:\oooa5.exec:\oooa5.exe78⤵PID:872
-
\??\c:\ls5il88.exec:\ls5il88.exe79⤵PID:1252
-
\??\c:\w4m0wb3.exec:\w4m0wb3.exe80⤵PID:4080
-
\??\c:\9d57t.exec:\9d57t.exe81⤵PID:2756
-
\??\c:\3q9h48.exec:\3q9h48.exe82⤵PID:4600
-
\??\c:\4sf7m.exec:\4sf7m.exe83⤵PID:4168
-
\??\c:\g9w9i.exec:\g9w9i.exe84⤵PID:4484
-
\??\c:\h0c3872.exec:\h0c3872.exe85⤵PID:4872
-
\??\c:\4jgetc3.exec:\4jgetc3.exe86⤵PID:632
-
\??\c:\93hh697.exec:\93hh697.exe87⤵PID:3808
-
\??\c:\179n9i2.exec:\179n9i2.exe88⤵PID:1376
-
\??\c:\fk8pa3x.exec:\fk8pa3x.exe89⤵PID:3960
-
\??\c:\1m5xx3v.exec:\1m5xx3v.exe90⤵PID:2300
-
\??\c:\r6us46.exec:\r6us46.exe91⤵PID:1880
-
\??\c:\632h11.exec:\632h11.exe92⤵PID:348
-
\??\c:\377p74w.exec:\377p74w.exe93⤵PID:208
-
\??\c:\m659l2a.exec:\m659l2a.exe94⤵PID:4304
-
\??\c:\757te4b.exec:\757te4b.exe95⤵PID:1392
-
\??\c:\2o4i3m.exec:\2o4i3m.exe96⤵PID:4816
-
\??\c:\0936pa.exec:\0936pa.exe97⤵PID:1280
-
\??\c:\5f874c7.exec:\5f874c7.exe98⤵PID:1948
-
\??\c:\h6c506.exec:\h6c506.exe99⤵PID:3320
-
\??\c:\oo3s8io.exec:\oo3s8io.exe100⤵PID:3476
-
\??\c:\0nbi8.exec:\0nbi8.exe101⤵PID:644
-
\??\c:\543ck.exec:\543ck.exe102⤵PID:776
-
\??\c:\99ox8m4.exec:\99ox8m4.exe103⤵PID:3720
-
\??\c:\9ag5t9.exec:\9ag5t9.exe104⤵PID:2824
-
\??\c:\42fx8w0.exec:\42fx8w0.exe105⤵PID:1180
-
\??\c:\53kq57.exec:\53kq57.exe106⤵PID:3976
-
\??\c:\m1ixo7j.exec:\m1ixo7j.exe107⤵PID:1572
-
\??\c:\eoum7x.exec:\eoum7x.exe108⤵PID:4736
-
\??\c:\kk9410.exec:\kk9410.exe109⤵PID:2464
-
\??\c:\33977d.exec:\33977d.exe110⤵PID:5028
-
\??\c:\a67wid.exec:\a67wid.exe111⤵PID:4428
-
\??\c:\wb9nflv.exec:\wb9nflv.exe112⤵PID:996
-
\??\c:\tl7sa.exec:\tl7sa.exe113⤵PID:3668
-
\??\c:\uw605.exec:\uw605.exe114⤵PID:1696
-
\??\c:\t8qo8h3.exec:\t8qo8h3.exe115⤵PID:2280
-
\??\c:\72w1ep7.exec:\72w1ep7.exe116⤵PID:4072
-
\??\c:\99jn1.exec:\99jn1.exe117⤵PID:1064
-
\??\c:\m8u44v.exec:\m8u44v.exe118⤵PID:4472
-
\??\c:\eo77m.exec:\eo77m.exe119⤵PID:2192
-
\??\c:\3v64v.exec:\3v64v.exe120⤵PID:4408
-
\??\c:\80684.exec:\80684.exe121⤵PID:4496
-
\??\c:\ek66q1.exec:\ek66q1.exe122⤵PID:1672
-
\??\c:\7t644s.exec:\7t644s.exe123⤵PID:3900
-
\??\c:\6uv372.exec:\6uv372.exe124⤵PID:5092
-
\??\c:\59qwt.exec:\59qwt.exe125⤵PID:4556
-
\??\c:\6qu98.exec:\6qu98.exe126⤵PID:3928
-
\??\c:\71dmm4.exec:\71dmm4.exe127⤵PID:4916
-
\??\c:\9sgbx.exec:\9sgbx.exe128⤵PID:3980
-
\??\c:\ms4ti.exec:\ms4ti.exe129⤵PID:4380
-
\??\c:\4cm3s38.exec:\4cm3s38.exe130⤵PID:4440
-
\??\c:\1d50t.exec:\1d50t.exe131⤵PID:3808
-
\??\c:\63lfla4.exec:\63lfla4.exe132⤵PID:1376
-
\??\c:\s85xm51.exec:\s85xm51.exe133⤵PID:3960
-
\??\c:\jo5gde.exec:\jo5gde.exe134⤵PID:2300
-
\??\c:\lp977j7.exec:\lp977j7.exe135⤵PID:1880
-
\??\c:\463hd.exec:\463hd.exe136⤵PID:804
-
\??\c:\q5l7vs.exec:\q5l7vs.exe137⤵PID:1172
-
\??\c:\595kfo.exec:\595kfo.exe138⤵PID:2908
-
\??\c:\hw71f9.exec:\hw71f9.exe139⤵PID:1268
-
\??\c:\2l74q96.exec:\2l74q96.exe140⤵PID:1764
-
\??\c:\3ec33s6.exec:\3ec33s6.exe141⤵PID:3320
-
\??\c:\mwla3.exec:\mwla3.exe142⤵PID:3812
-
\??\c:\f7wc9.exec:\f7wc9.exe143⤵PID:4048
-
\??\c:\44am32.exec:\44am32.exe144⤵PID:700
-
\??\c:\cn629.exec:\cn629.exe145⤵PID:2824
-
\??\c:\29ad50.exec:\29ad50.exe146⤵PID:4820
-
\??\c:\bae1ku9.exec:\bae1ku9.exe147⤵PID:3976
-
\??\c:\704ss57.exec:\704ss57.exe148⤵PID:4824
-
\??\c:\6a1551.exec:\6a1551.exe149⤵PID:2056
-
\??\c:\80f9p.exec:\80f9p.exe150⤵PID:3836
-
\??\c:\ocm4jm.exec:\ocm4jm.exe151⤵PID:4020
-
\??\c:\g30tnw.exec:\g30tnw.exe152⤵PID:1860
-
\??\c:\13561i.exec:\13561i.exe153⤵PID:3620
-
\??\c:\xg2029.exec:\xg2029.exe154⤵PID:2516
-
\??\c:\34965.exec:\34965.exe155⤵PID:4612
-
\??\c:\65768vt.exec:\65768vt.exe156⤵PID:1524
-
\??\c:\vp3vv.exec:\vp3vv.exe157⤵PID:3516
-
\??\c:\8ltf0h.exec:\8ltf0h.exe158⤵PID:4032
-
\??\c:\8qo8g.exec:\8qo8g.exe159⤵PID:4548
-
\??\c:\85bc2.exec:\85bc2.exe160⤵PID:3816
-
\??\c:\11nqi5.exec:\11nqi5.exe161⤵PID:1884
-
\??\c:\h5837v.exec:\h5837v.exe162⤵PID:2484
-
\??\c:\kqn3o.exec:\kqn3o.exe163⤵PID:1404
-
\??\c:\64uav0.exec:\64uav0.exe164⤵PID:632
-
\??\c:\h97pig.exec:\h97pig.exe165⤵PID:2024
-
\??\c:\ech5246.exec:\ech5246.exe166⤵PID:3748
-
\??\c:\94boadq.exec:\94boadq.exe167⤵PID:1384
-
\??\c:\dsvd802.exec:\dsvd802.exe168⤵PID:1376
-
\??\c:\v187a5.exec:\v187a5.exe169⤵PID:3960
-
\??\c:\ho3f6.exec:\ho3f6.exe170⤵PID:348
-
\??\c:\731sg.exec:\731sg.exe171⤵PID:3644
-
\??\c:\1617441.exec:\1617441.exe172⤵PID:448
-
\??\c:\8ucip2.exec:\8ucip2.exe173⤵PID:1172
-
\??\c:\95325v.exec:\95325v.exe174⤵PID:4364
-
\??\c:\2xc4r.exec:\2xc4r.exe175⤵PID:804
-
\??\c:\8d501.exec:\8d501.exe176⤵PID:1888
-
\??\c:\8qboa.exec:\8qboa.exe177⤵PID:4740
-
\??\c:\s4vq1n6.exec:\s4vq1n6.exe178⤵PID:1612
-
\??\c:\vkt7g94.exec:\vkt7g94.exe179⤵PID:644
-
\??\c:\5s8bnt.exec:\5s8bnt.exe180⤵PID:4048
-
\??\c:\s0tti.exec:\s0tti.exe181⤵PID:3720
-
\??\c:\142a8g8.exec:\142a8g8.exe182⤵PID:4808
-
\??\c:\2497271.exec:\2497271.exe183⤵PID:4368
-
\??\c:\204k2o1.exec:\204k2o1.exe184⤵PID:3528
-
\??\c:\1937t1.exec:\1937t1.exe185⤵PID:4736
-
\??\c:\8uou9.exec:\8uou9.exe186⤵PID:1536
-
\??\c:\7sp9kw.exec:\7sp9kw.exe187⤵PID:3016
-
\??\c:\629n9.exec:\629n9.exe188⤵PID:4428
-
\??\c:\e0m62.exec:\e0m62.exe189⤵PID:1548
-
\??\c:\c19g28.exec:\c19g28.exe190⤵PID:4328
-
\??\c:\nhnni.exec:\nhnni.exe191⤵PID:2280
-
\??\c:\cetei2.exec:\cetei2.exe192⤵PID:1860
-
\??\c:\tcxgeu.exec:\tcxgeu.exe193⤵PID:4612
-
\??\c:\0988ja9.exec:\0988ja9.exe194⤵PID:1020
-
\??\c:\rg9pw51.exec:\rg9pw51.exe195⤵PID:3308
-
\??\c:\868sp.exec:\868sp.exe196⤵PID:1836
-
\??\c:\84r1a.exec:\84r1a.exe197⤵PID:4760
-
\??\c:\xki00.exec:\xki00.exe198⤵PID:4712
-
\??\c:\4m4i3.exec:\4m4i3.exe199⤵PID:4548
-
\??\c:\41m7d.exec:\41m7d.exe200⤵PID:3928
-
\??\c:\0wqs6.exec:\0wqs6.exe201⤵PID:4032
-
\??\c:\w017p51.exec:\w017p51.exe202⤵PID:4484
-
\??\c:\daww90.exec:\daww90.exe203⤵PID:1404
-
\??\c:\72guv1.exec:\72guv1.exe204⤵PID:3868
-
\??\c:\md8cb.exec:\md8cb.exe205⤵PID:2024
-
\??\c:\t7r84ir.exec:\t7r84ir.exe206⤵PID:3748
-
\??\c:\f65936v.exec:\f65936v.exe207⤵PID:3488
-
\??\c:\rrg5ko.exec:\rrg5ko.exe208⤵PID:216
-
\??\c:\kg6i7.exec:\kg6i7.exe209⤵PID:468
-
\??\c:\26828m5.exec:\26828m5.exe210⤵PID:1368
-
\??\c:\ca71s.exec:\ca71s.exe211⤵PID:3644
-
\??\c:\5c3ma1n.exec:\5c3ma1n.exe212⤵PID:448
-
\??\c:\si454ks.exec:\si454ks.exe213⤵PID:1172
-
\??\c:\0b83jv.exec:\0b83jv.exe214⤵PID:1764
-
\??\c:\m4nbnos.exec:\m4nbnos.exe215⤵PID:4940
-
\??\c:\564i11.exec:\564i11.exe216⤵PID:1888
-
\??\c:\6sv8mj.exec:\6sv8mj.exe217⤵PID:4740
-
\??\c:\0bnqek1.exec:\0bnqek1.exe218⤵PID:1612
-
\??\c:\33h3a.exec:\33h3a.exe219⤵PID:4292
-
\??\c:\n4a38.exec:\n4a38.exe220⤵PID:3732
-
\??\c:\835av.exec:\835av.exe221⤵PID:1180
-
\??\c:\4608022.exec:\4608022.exe222⤵PID:1708
-
\??\c:\4i3jd73.exec:\4i3jd73.exe223⤵PID:3228
-
\??\c:\hlski1.exec:\hlski1.exe224⤵PID:4668
-
\??\c:\j2vw4.exec:\j2vw4.exe225⤵PID:2168
-
\??\c:\u9as599.exec:\u9as599.exe226⤵PID:1624
-
\??\c:\ou490.exec:\ou490.exe227⤵PID:3244
-
\??\c:\tqqe2i.exec:\tqqe2i.exe228⤵PID:3612
-
\??\c:\6f4g7b.exec:\6f4g7b.exe229⤵PID:3564
-
\??\c:\3117t28.exec:\3117t28.exe230⤵PID:2092
-
\??\c:\j0515.exec:\j0515.exe231⤵PID:4136
-
\??\c:\s9amj.exec:\s9amj.exe232⤵PID:4944
-
\??\c:\t2u7s.exec:\t2u7s.exe233⤵PID:5100
-
\??\c:\32c2ifx.exec:\32c2ifx.exe234⤵PID:3996
-
\??\c:\ib4kqo.exec:\ib4kqo.exe235⤵PID:1904
-
\??\c:\7qgxp.exec:\7qgxp.exe236⤵PID:5000
-
\??\c:\3293aa.exec:\3293aa.exe237⤵PID:3172
-
\??\c:\66280.exec:\66280.exe238⤵PID:4516
-
\??\c:\tktcj.exec:\tktcj.exe239⤵PID:4656
-
\??\c:\pev52.exec:\pev52.exe240⤵PID:2980
-
\??\c:\36e88m.exec:\36e88m.exe241⤵PID:1136
-
\??\c:\m16b9.exec:\m16b9.exe242⤵PID:2588