Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
21/05/2024, 04:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d2f474ef9b410286f8a3dc2c34b20157316a8e2bf31a2940f26914a0922410c7.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
d2f474ef9b410286f8a3dc2c34b20157316a8e2bf31a2940f26914a0922410c7.exe
-
Size
72KB
-
MD5
d7a2280a20fc42b31221e24e04820a1a
-
SHA1
322539a70b809797e5c9bc3d3b5fc930d80edc6a
-
SHA256
d2f474ef9b410286f8a3dc2c34b20157316a8e2bf31a2940f26914a0922410c7
-
SHA512
c521d7caa0fce662b45b1a047fef41d6712ca9d8084b0a1e4575056325d0aacbfd9c37d422435108892726fa034cf2077a4c34ce922881d56fce7e61ceb5134a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIjaQkPcy8WTeAw4PS:ymb3NkkiQ3mdBjFIpkPcy8qs4PS
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/4436-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4436-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2828-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-23-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4992-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1140-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/888-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1708-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4840-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2612-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3684-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3096-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3336-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2004-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3308-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/780-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1760-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2664-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5028-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2740-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2148-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4644-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3672-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4416-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 29 IoCs
resource yara_rule behavioral2/memory/4436-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4436-7-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2828-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2828-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2828-17-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4992-22-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1140-28-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/888-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2012-41-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2012-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1708-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1708-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4840-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2612-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3684-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3684-79-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3096-88-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3336-94-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2004-106-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3308-111-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/780-118-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1760-124-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2664-136-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5028-142-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2740-154-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2148-160-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4644-166-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3672-178-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4416-196-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2828 3fd0p8n.exe 4992 ab1odt5.exe 1140 ek7e35.exe 888 6j7d9.exe 2012 2s3op.exe 1768 1jacf.exe 1708 qfoia.exe 4840 84e52.exe 2612 1411133.exe 3684 v49oo.exe 3096 0s14ix.exe 3336 kefa5s.exe 5052 foaj3g.exe 2004 ao5i6.exe 3308 400th48.exe 780 nv4f3.exe 1760 79o9im6.exe 1636 xp14i.exe 2664 mm4pn55.exe 5028 611c1m3.exe 2680 q950q.exe 2740 c0qwwlk.exe 2148 5083b4i.exe 4644 q8ss8a.exe 3088 pp9f6.exe 3672 i61gjm.exe 4260 j192r.exe 1460 2b2171c.exe 4416 1prs2.exe 3356 287xuoc.exe 2392 4aboi82.exe 4820 17j0bv.exe 3768 nqwu17.exe 2836 0s717.exe 2972 7fv1ci.exe 2744 9hcc5.exe 1140 eqn5u47.exe 2964 lxfto.exe 3968 492qi8.exe 4364 m3862.exe 3956 a2a5h3.exe 4984 3u5m159.exe 2484 lj0e42.exe 4840 8r47t9.exe 2520 11l5biq.exe 3516 r0skpk.exe 460 e1udm5f.exe 3680 hnq79kh.exe 3336 22nffu.exe 2276 ft37s.exe 4568 d1l779o.exe 3484 v3b5l1w.exe 4908 vc8i7.exe 3536 4sb6e76.exe 1576 3e2jq.exe 3076 56291nw.exe 4500 be081ko.exe 664 w9193ov.exe 4372 gei4i.exe 2804 11g7i.exe 2740 o8u6f80.exe 3272 icxogm.exe 4256 2m8io.exe 3300 7dgjke.exe -
resource yara_rule behavioral2/memory/4436-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4436-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2828-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2828-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2828-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1140-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/888-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1708-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1708-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4840-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2612-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3684-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3684-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3096-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3336-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2004-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3308-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/780-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1760-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2664-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5028-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2740-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4644-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4416-196-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4436 wrote to memory of 2828 4436 d2f474ef9b410286f8a3dc2c34b20157316a8e2bf31a2940f26914a0922410c7.exe 91 PID 4436 wrote to memory of 2828 4436 d2f474ef9b410286f8a3dc2c34b20157316a8e2bf31a2940f26914a0922410c7.exe 91 PID 4436 wrote to memory of 2828 4436 d2f474ef9b410286f8a3dc2c34b20157316a8e2bf31a2940f26914a0922410c7.exe 91 PID 2828 wrote to memory of 4992 2828 3fd0p8n.exe 92 PID 2828 wrote to memory of 4992 2828 3fd0p8n.exe 92 PID 2828 wrote to memory of 4992 2828 3fd0p8n.exe 92 PID 4992 wrote to memory of 1140 4992 ab1odt5.exe 93 PID 4992 wrote to memory of 1140 4992 ab1odt5.exe 93 PID 4992 wrote to memory of 1140 4992 ab1odt5.exe 93 PID 1140 wrote to memory of 888 1140 ek7e35.exe 94 PID 1140 wrote to memory of 888 1140 ek7e35.exe 94 PID 1140 wrote to memory of 888 1140 ek7e35.exe 94 PID 888 wrote to memory of 2012 888 6j7d9.exe 95 PID 888 wrote to memory of 2012 888 6j7d9.exe 95 PID 888 wrote to memory of 2012 888 6j7d9.exe 95 PID 2012 wrote to memory of 1768 2012 2s3op.exe 96 PID 2012 wrote to memory of 1768 2012 2s3op.exe 96 PID 2012 wrote to memory of 1768 2012 2s3op.exe 96 PID 1768 wrote to memory of 1708 1768 1jacf.exe 97 PID 1768 wrote to memory of 1708 1768 1jacf.exe 97 PID 1768 wrote to memory of 1708 1768 1jacf.exe 97 PID 1708 wrote to memory of 4840 1708 qfoia.exe 98 PID 1708 wrote to memory of 4840 1708 qfoia.exe 98 PID 1708 wrote to memory of 4840 1708 qfoia.exe 98 PID 4840 wrote to memory of 2612 4840 84e52.exe 99 PID 4840 wrote to memory of 2612 4840 84e52.exe 99 PID 4840 wrote to memory of 2612 4840 84e52.exe 99 PID 2612 wrote to memory of 3684 2612 1411133.exe 100 PID 2612 wrote to memory of 3684 2612 1411133.exe 100 PID 2612 wrote to memory of 3684 2612 1411133.exe 100 PID 3684 wrote to memory of 3096 3684 v49oo.exe 101 PID 3684 wrote to memory of 3096 3684 v49oo.exe 101 PID 3684 wrote to memory of 3096 3684 v49oo.exe 101 PID 3096 wrote to memory of 3336 3096 0s14ix.exe 102 PID 3096 wrote to memory of 3336 3096 0s14ix.exe 102 PID 3096 wrote to memory of 3336 3096 0s14ix.exe 102 PID 3336 wrote to memory of 5052 3336 kefa5s.exe 103 PID 3336 wrote to memory of 5052 3336 kefa5s.exe 103 PID 3336 wrote to memory of 5052 3336 kefa5s.exe 103 PID 5052 wrote to memory of 2004 5052 foaj3g.exe 104 PID 5052 wrote to memory of 2004 5052 foaj3g.exe 104 PID 5052 wrote to memory of 2004 5052 foaj3g.exe 104 PID 2004 wrote to memory of 3308 2004 ao5i6.exe 105 PID 2004 wrote to memory of 3308 2004 ao5i6.exe 105 PID 2004 wrote to memory of 3308 2004 ao5i6.exe 105 PID 3308 wrote to memory of 780 3308 400th48.exe 106 PID 3308 wrote to memory of 780 3308 400th48.exe 106 PID 3308 wrote to memory of 780 3308 400th48.exe 106 PID 780 wrote to memory of 1760 780 nv4f3.exe 107 PID 780 wrote to memory of 1760 780 nv4f3.exe 107 PID 780 wrote to memory of 1760 780 nv4f3.exe 107 PID 1760 wrote to memory of 1636 1760 79o9im6.exe 108 PID 1760 wrote to memory of 1636 1760 79o9im6.exe 108 PID 1760 wrote to memory of 1636 1760 79o9im6.exe 108 PID 1636 wrote to memory of 2664 1636 xp14i.exe 109 PID 1636 wrote to memory of 2664 1636 xp14i.exe 109 PID 1636 wrote to memory of 2664 1636 xp14i.exe 109 PID 2664 wrote to memory of 5028 2664 mm4pn55.exe 110 PID 2664 wrote to memory of 5028 2664 mm4pn55.exe 110 PID 2664 wrote to memory of 5028 2664 mm4pn55.exe 110 PID 5028 wrote to memory of 2680 5028 611c1m3.exe 111 PID 5028 wrote to memory of 2680 5028 611c1m3.exe 111 PID 5028 wrote to memory of 2680 5028 611c1m3.exe 111 PID 2680 wrote to memory of 2740 2680 q950q.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2f474ef9b410286f8a3dc2c34b20157316a8e2bf31a2940f26914a0922410c7.exe"C:\Users\Admin\AppData\Local\Temp\d2f474ef9b410286f8a3dc2c34b20157316a8e2bf31a2940f26914a0922410c7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\3fd0p8n.exec:\3fd0p8n.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\ab1odt5.exec:\ab1odt5.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\ek7e35.exec:\ek7e35.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
\??\c:\6j7d9.exec:\6j7d9.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\2s3op.exec:\2s3op.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\1jacf.exec:\1jacf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\qfoia.exec:\qfoia.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\84e52.exec:\84e52.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\1411133.exec:\1411133.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\v49oo.exec:\v49oo.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\0s14ix.exec:\0s14ix.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\kefa5s.exec:\kefa5s.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
\??\c:\foaj3g.exec:\foaj3g.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\ao5i6.exec:\ao5i6.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\400th48.exec:\400th48.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\nv4f3.exec:\nv4f3.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
\??\c:\79o9im6.exec:\79o9im6.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\xp14i.exec:\xp14i.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\mm4pn55.exec:\mm4pn55.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\611c1m3.exec:\611c1m3.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\q950q.exec:\q950q.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\c0qwwlk.exec:\c0qwwlk.exe23⤵
- Executes dropped EXE
PID:2740 -
\??\c:\5083b4i.exec:\5083b4i.exe24⤵
- Executes dropped EXE
PID:2148 -
\??\c:\q8ss8a.exec:\q8ss8a.exe25⤵
- Executes dropped EXE
PID:4644 -
\??\c:\pp9f6.exec:\pp9f6.exe26⤵
- Executes dropped EXE
PID:3088 -
\??\c:\i61gjm.exec:\i61gjm.exe27⤵
- Executes dropped EXE
PID:3672 -
\??\c:\j192r.exec:\j192r.exe28⤵
- Executes dropped EXE
PID:4260 -
\??\c:\2b2171c.exec:\2b2171c.exe29⤵
- Executes dropped EXE
PID:1460 -
\??\c:\1prs2.exec:\1prs2.exe30⤵
- Executes dropped EXE
PID:4416 -
\??\c:\287xuoc.exec:\287xuoc.exe31⤵
- Executes dropped EXE
PID:3356 -
\??\c:\4aboi82.exec:\4aboi82.exe32⤵
- Executes dropped EXE
PID:2392 -
\??\c:\17j0bv.exec:\17j0bv.exe33⤵
- Executes dropped EXE
PID:4820 -
\??\c:\nqwu17.exec:\nqwu17.exe34⤵
- Executes dropped EXE
PID:3768 -
\??\c:\0s717.exec:\0s717.exe35⤵
- Executes dropped EXE
PID:2836 -
\??\c:\7fv1ci.exec:\7fv1ci.exe36⤵
- Executes dropped EXE
PID:2972 -
\??\c:\9hcc5.exec:\9hcc5.exe37⤵
- Executes dropped EXE
PID:2744 -
\??\c:\eqn5u47.exec:\eqn5u47.exe38⤵
- Executes dropped EXE
PID:1140 -
\??\c:\lxfto.exec:\lxfto.exe39⤵
- Executes dropped EXE
PID:2964 -
\??\c:\492qi8.exec:\492qi8.exe40⤵
- Executes dropped EXE
PID:3968 -
\??\c:\m3862.exec:\m3862.exe41⤵
- Executes dropped EXE
PID:4364 -
\??\c:\a2a5h3.exec:\a2a5h3.exe42⤵
- Executes dropped EXE
PID:3956 -
\??\c:\3u5m159.exec:\3u5m159.exe43⤵
- Executes dropped EXE
PID:4984 -
\??\c:\lj0e42.exec:\lj0e42.exe44⤵
- Executes dropped EXE
PID:2484 -
\??\c:\8r47t9.exec:\8r47t9.exe45⤵
- Executes dropped EXE
PID:4840 -
\??\c:\11l5biq.exec:\11l5biq.exe46⤵
- Executes dropped EXE
PID:2520 -
\??\c:\r0skpk.exec:\r0skpk.exe47⤵
- Executes dropped EXE
PID:3516 -
\??\c:\e1udm5f.exec:\e1udm5f.exe48⤵
- Executes dropped EXE
PID:460 -
\??\c:\hnq79kh.exec:\hnq79kh.exe49⤵
- Executes dropped EXE
PID:3680 -
\??\c:\22nffu.exec:\22nffu.exe50⤵
- Executes dropped EXE
PID:3336 -
\??\c:\ft37s.exec:\ft37s.exe51⤵
- Executes dropped EXE
PID:2276 -
\??\c:\d1l779o.exec:\d1l779o.exe52⤵
- Executes dropped EXE
PID:4568 -
\??\c:\v3b5l1w.exec:\v3b5l1w.exe53⤵
- Executes dropped EXE
PID:3484 -
\??\c:\vc8i7.exec:\vc8i7.exe54⤵
- Executes dropped EXE
PID:4908 -
\??\c:\4sb6e76.exec:\4sb6e76.exe55⤵
- Executes dropped EXE
PID:3536 -
\??\c:\3e2jq.exec:\3e2jq.exe56⤵
- Executes dropped EXE
PID:1576 -
\??\c:\56291nw.exec:\56291nw.exe57⤵
- Executes dropped EXE
PID:3076 -
\??\c:\be081ko.exec:\be081ko.exe58⤵
- Executes dropped EXE
PID:4500 -
\??\c:\w9193ov.exec:\w9193ov.exe59⤵
- Executes dropped EXE
PID:664 -
\??\c:\gei4i.exec:\gei4i.exe60⤵
- Executes dropped EXE
PID:4372 -
\??\c:\11g7i.exec:\11g7i.exe61⤵
- Executes dropped EXE
PID:2804 -
\??\c:\o8u6f80.exec:\o8u6f80.exe62⤵
- Executes dropped EXE
PID:2740 -
\??\c:\icxogm.exec:\icxogm.exe63⤵
- Executes dropped EXE
PID:3272 -
\??\c:\2m8io.exec:\2m8io.exe64⤵
- Executes dropped EXE
PID:4256 -
\??\c:\7dgjke.exec:\7dgjke.exe65⤵
- Executes dropped EXE
PID:3300 -
\??\c:\ov64c.exec:\ov64c.exe66⤵PID:2240
-
\??\c:\a4g05.exec:\a4g05.exe67⤵PID:4860
-
\??\c:\nv739tn.exec:\nv739tn.exe68⤵PID:3900
-
\??\c:\ml8eoa.exec:\ml8eoa.exe69⤵PID:524
-
\??\c:\1s26u.exec:\1s26u.exe70⤵PID:4524
-
\??\c:\870da.exec:\870da.exe71⤵PID:1432
-
\??\c:\p7t1ere.exec:\p7t1ere.exe72⤵PID:4592
-
\??\c:\xima17.exec:\xima17.exe73⤵PID:2848
-
\??\c:\w565ri9.exec:\w565ri9.exe74⤵PID:4436
-
\??\c:\41al1w1.exec:\41al1w1.exe75⤵PID:4588
-
\??\c:\w45k84n.exec:\w45k84n.exe76⤵PID:2828
-
\??\c:\l8f27q.exec:\l8f27q.exe77⤵PID:3104
-
\??\c:\0ktus.exec:\0ktus.exe78⤵PID:1884
-
\??\c:\j91a4.exec:\j91a4.exe79⤵PID:844
-
\??\c:\13xoj.exec:\13xoj.exe80⤵PID:1388
-
\??\c:\9st8419.exec:\9st8419.exe81⤵PID:4552
-
\??\c:\61odkka.exec:\61odkka.exe82⤵PID:1768
-
\??\c:\3gm29.exec:\3gm29.exe83⤵PID:2020
-
\??\c:\sp571.exec:\sp571.exe84⤵PID:1708
-
\??\c:\j3o4h9.exec:\j3o4h9.exe85⤵PID:2960
-
\??\c:\sqq18.exec:\sqq18.exe86⤵PID:2124
-
\??\c:\6rsg5.exec:\6rsg5.exe87⤵PID:4036
-
\??\c:\wwcg39.exec:\wwcg39.exe88⤵PID:3684
-
\??\c:\te7kn.exec:\te7kn.exe89⤵PID:3096
-
\??\c:\1n6iv.exec:\1n6iv.exe90⤵PID:620
-
\??\c:\rx8l4.exec:\rx8l4.exe91⤵PID:4852
-
\??\c:\39roj.exec:\39roj.exe92⤵PID:3524
-
\??\c:\8f3513.exec:\8f3513.exe93⤵PID:1172
-
\??\c:\1026rvt.exec:\1026rvt.exe94⤵PID:3668
-
\??\c:\t418m.exec:\t418m.exe95⤵PID:4176
-
\??\c:\7l595x.exec:\7l595x.exe96⤵PID:1624
-
\??\c:\nqcse.exec:\nqcse.exe97⤵PID:3964
-
\??\c:\xrs83l.exec:\xrs83l.exe98⤵PID:2040
-
\??\c:\0gfa1.exec:\0gfa1.exe99⤵PID:2176
-
\??\c:\axsmw.exec:\axsmw.exe100⤵PID:3592
-
\??\c:\i9o5s.exec:\i9o5s.exe101⤵PID:5104
-
\??\c:\swnt0b.exec:\swnt0b.exe102⤵PID:4052
-
\??\c:\18bbx.exec:\18bbx.exe103⤵PID:3004
-
\??\c:\rf5099.exec:\rf5099.exe104⤵PID:1736
-
\??\c:\uqqdec.exec:\uqqdec.exe105⤵PID:3088
-
\??\c:\dnbx7vs.exec:\dnbx7vs.exe106⤵PID:1972
-
\??\c:\581ek2.exec:\581ek2.exe107⤵PID:2240
-
\??\c:\x8enq.exec:\x8enq.exe108⤵PID:4860
-
\??\c:\x7905.exec:\x7905.exe109⤵PID:4360
-
\??\c:\5ga90e4.exec:\5ga90e4.exe110⤵PID:4320
-
\??\c:\g3mf8i.exec:\g3mf8i.exe111⤵PID:4316
-
\??\c:\4rsp6t4.exec:\4rsp6t4.exe112⤵PID:1432
-
\??\c:\mh1p5.exec:\mh1p5.exe113⤵PID:1396
-
\??\c:\i5aa12.exec:\i5aa12.exe114⤵PID:1756
-
\??\c:\10efhf.exec:\10efhf.exe115⤵PID:1208
-
\??\c:\9l223m.exec:\9l223m.exe116⤵PID:4992
-
\??\c:\i7517.exec:\i7517.exe117⤵PID:732
-
\??\c:\agw8d.exec:\agw8d.exe118⤵PID:4216
-
\??\c:\ufm69l3.exec:\ufm69l3.exe119⤵PID:844
-
\??\c:\fjdh1x.exec:\fjdh1x.exe120⤵PID:2964
-
\??\c:\c56u7.exec:\c56u7.exe121⤵PID:2012
-
\??\c:\qe51cls.exec:\qe51cls.exe122⤵PID:632
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-