Analysis
- max time kernel
135s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
30/06/2026, 04:38
General
- Target 2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe
- Size 2.4MB
- Sample260630-e9jp8aex3s
- SHA256 9170d780b408f83d9fd7354078e2d827c5efdfbd426d1324c25951db13cdd93b
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Drops file in System32 directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\@AE5AFC.tmp.exe"C:\Users\Admin\AppData\Local\Temp\@AE5AFC.tmp.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe"C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat" "7⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe"C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe" /i 67888⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "9⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Admin\kb50145.exe"C:\Users\Admin\AppData\Roaming\Admin\kb50145.exe"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\injector_s.exe"C:\Users\Admin\AppData\Roaming\injector_s.exe"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\a0x.bat" "C:\Users\Admin\AppData\Roaming\Admin\kb50145.exe" "C:\Users\Admin\AppData\Local\Temp\a0x.bat""11⤵
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE13⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE54⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE55⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE56⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE57⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE58⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE59⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE60⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE61⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE62⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE63⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE64⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE65⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE66⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE67⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE68⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE69⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE70⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE71⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE72⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE73⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE74⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE75⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE76⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE77⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE78⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE79⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE80⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE81⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE82⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE83⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE84⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE85⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE86⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE87⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE88⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE89⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE90⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE91⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE92⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE93⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE94⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE95⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE96⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE97⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE98⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE99⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE100⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE101⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE102⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE103⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE104⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE105⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE106⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE107⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE108⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE109⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE110⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE111⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE112⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE113⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE114⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE115⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE116⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE117⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE118⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE119⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE120⤵
-
C:\Windows\SysWOW64\23BF8A\E54BB7.EXEC:\Windows\system32\23BF8A\E54BB7.EXE121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-