Analysis
-
max time kernel
154s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26/04/2024, 12:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
00bfa31ad49c7d66b65dd63499eb0df3_JaffaCakes118.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
00bfa31ad49c7d66b65dd63499eb0df3_JaffaCakes118.exe
-
Size
365KB
-
MD5
00bfa31ad49c7d66b65dd63499eb0df3
-
SHA1
096662f9df51c9467cea2f3254bc4f2caa6e623e
-
SHA256
8cbf41cc091ce0a909e4f91dc8545e99cb2caf9aa3a6376a0b88cd5bf8197943
-
SHA512
4d2609319f328593f515c301fd4f1b31104d0e715716ea49df5e38669c4c4a51e064f1445b7b9e58af9d2c3b7d51e7a00615a837d56a704f4469dd2d67012018
-
SSDEEP
3072:PhOm2sI93UufdC67cihfmCiiiXAsACF486jFX8fkYtB6J6q1K7+:Pcm7ImGddXtWrXD486jFX88Y/MK7+
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2432-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/840-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4840-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3500-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2920-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3448-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4088-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2208-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1596-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1640-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2296-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3492-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1044-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4864-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3020-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3484-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2232-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/716-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3104-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2868-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2192-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4192-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/644-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1064-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2040-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4980-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3080-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4088-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3608-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4384-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1640-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2624-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4032-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4864-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2588-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2628-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4040-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1572-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3308-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-309-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3864-322-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1928-347-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-351-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1428-365-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3300-389-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2356-397-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/864-427-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2224-443-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1720-487-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5088-494-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4296-585-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2040-598-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2404-607-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1556-635-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2008-651-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3168-807-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2500-892-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4736-942-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3696-976-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/232-1071-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3004-1214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 840 nb0p7l.exe 4840 p33412o.exe 3500 15g0n.exe 2920 7dexp.exe 3448 osk69r.exe 4016 8581q1.exe 4088 qi1o5.exe 2208 kf94799.exe 1596 4f0740.exe 1640 b8ff9p5.exe 2296 g2c771.exe 3492 3l7g52k.exe 2100 lc5xq.exe 1044 x44cm.exe 4864 513o9.exe 832 9bqn0x.exe 4516 x42j985.exe 3020 gaxat.exe 3244 jd5wm.exe 4564 6iar84.exe 3484 q7h17.exe 2232 n182f9.exe 716 r8v75.exe 3104 u9556w.exe 2868 0dm314.exe 2192 239309.exe 2912 dg31hee.exe 1144 9iua3.exe 4192 243ui46.exe 5008 xj9281.exe 4388 11b1s.exe 644 x3i304.exe 1168 xagph9n.exe 668 x9gak.exe 1064 k08cvdf.exe 2680 j3m5b5.exe 2040 ifs06.exe 3380 095i33.exe 4980 52579.exe 3448 9qh3797.exe 3080 a9785ou.exe 4088 ao934rm.exe 4512 8b7463.exe 3608 04equ.exe 4384 lx25kdq.exe 1640 ug9kb.exe 940 30434.exe 1004 0fi17v.exe 2624 u0i1et.exe 4032 3jdw5.exe 3940 8r4f09h.exe 1996 5616n.exe 4864 6d5616.exe 2588 fa195i9.exe 2628 mli4r9.exe 1956 3q20cu.exe 4040 8x3aa.exe 1572 k5twu0.exe 2924 d5f141.exe 444 vk7bup.exe 5064 ffd1b.exe 3308 bomei8.exe 2232 u5u5qqw.exe 1728 j4e3o2g.exe -
resource yara_rule behavioral2/memory/2432-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/840-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3500-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4840-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3500-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4088-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2208-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1596-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1640-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2296-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3492-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1044-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3484-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2232-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/716-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3104-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2868-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2192-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4192-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/644-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1064-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2680-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3080-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4088-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3608-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4384-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1640-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1004-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2624-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2588-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2628-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1572-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3308-296-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-309-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3864-322-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1928-347-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-351-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1428-365-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3300-389-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2356-397-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/864-427-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-443-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1720-487-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5088-494-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2624-525-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4296-585-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-598-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2404-607-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1556-635-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2008-651-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-714-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2432 wrote to memory of 840 2432 00bfa31ad49c7d66b65dd63499eb0df3_JaffaCakes118.exe 91 PID 2432 wrote to memory of 840 2432 00bfa31ad49c7d66b65dd63499eb0df3_JaffaCakes118.exe 91 PID 2432 wrote to memory of 840 2432 00bfa31ad49c7d66b65dd63499eb0df3_JaffaCakes118.exe 91 PID 840 wrote to memory of 4840 840 nb0p7l.exe 92 PID 840 wrote to memory of 4840 840 nb0p7l.exe 92 PID 840 wrote to memory of 4840 840 nb0p7l.exe 92 PID 4840 wrote to memory of 3500 4840 p33412o.exe 93 PID 4840 wrote to memory of 3500 4840 p33412o.exe 93 PID 4840 wrote to memory of 3500 4840 p33412o.exe 93 PID 3500 wrote to memory of 2920 3500 15g0n.exe 94 PID 3500 wrote to memory of 2920 3500 15g0n.exe 94 PID 3500 wrote to memory of 2920 3500 15g0n.exe 94 PID 2920 wrote to memory of 3448 2920 7dexp.exe 95 PID 2920 wrote to memory of 3448 2920 7dexp.exe 95 PID 2920 wrote to memory of 3448 2920 7dexp.exe 95 PID 3448 wrote to memory of 4016 3448 osk69r.exe 96 PID 3448 wrote to memory of 4016 3448 osk69r.exe 96 PID 3448 wrote to memory of 4016 3448 osk69r.exe 96 PID 4016 wrote to memory of 4088 4016 8581q1.exe 97 PID 4016 wrote to memory of 4088 4016 8581q1.exe 97 PID 4016 wrote to memory of 4088 4016 8581q1.exe 97 PID 4088 wrote to memory of 2208 4088 qi1o5.exe 98 PID 4088 wrote to memory of 2208 4088 qi1o5.exe 98 PID 4088 wrote to memory of 2208 4088 qi1o5.exe 98 PID 2208 wrote to memory of 1596 2208 kf94799.exe 99 PID 2208 wrote to memory of 1596 2208 kf94799.exe 99 PID 2208 wrote to memory of 1596 2208 kf94799.exe 99 PID 1596 wrote to memory of 1640 1596 4f0740.exe 100 PID 1596 wrote to memory of 1640 1596 4f0740.exe 100 PID 1596 wrote to memory of 1640 1596 4f0740.exe 100 PID 1640 wrote to memory of 2296 1640 b8ff9p5.exe 101 PID 1640 wrote to memory of 2296 1640 b8ff9p5.exe 101 PID 1640 wrote to memory of 2296 1640 b8ff9p5.exe 101 PID 2296 wrote to memory of 3492 2296 g2c771.exe 102 PID 2296 wrote to memory of 3492 2296 g2c771.exe 102 PID 2296 wrote to memory of 3492 2296 g2c771.exe 102 PID 3492 wrote to memory of 2100 3492 3l7g52k.exe 103 PID 3492 wrote to memory of 2100 3492 3l7g52k.exe 103 PID 3492 wrote to memory of 2100 3492 3l7g52k.exe 103 PID 2100 wrote to memory of 1044 2100 lc5xq.exe 104 PID 2100 wrote to memory of 1044 2100 lc5xq.exe 104 PID 2100 wrote to memory of 1044 2100 lc5xq.exe 104 PID 1044 wrote to memory of 4864 1044 x44cm.exe 105 PID 1044 wrote to memory of 4864 1044 x44cm.exe 105 PID 1044 wrote to memory of 4864 1044 x44cm.exe 105 PID 4864 wrote to memory of 832 4864 513o9.exe 106 PID 4864 wrote to memory of 832 4864 513o9.exe 106 PID 4864 wrote to memory of 832 4864 513o9.exe 106 PID 832 wrote to memory of 4516 832 9bqn0x.exe 107 PID 832 wrote to memory of 4516 832 9bqn0x.exe 107 PID 832 wrote to memory of 4516 832 9bqn0x.exe 107 PID 4516 wrote to memory of 3020 4516 x42j985.exe 108 PID 4516 wrote to memory of 3020 4516 x42j985.exe 108 PID 4516 wrote to memory of 3020 4516 x42j985.exe 108 PID 3020 wrote to memory of 3244 3020 gaxat.exe 109 PID 3020 wrote to memory of 3244 3020 gaxat.exe 109 PID 3020 wrote to memory of 3244 3020 gaxat.exe 109 PID 3244 wrote to memory of 4564 3244 jd5wm.exe 110 PID 3244 wrote to memory of 4564 3244 jd5wm.exe 110 PID 3244 wrote to memory of 4564 3244 jd5wm.exe 110 PID 4564 wrote to memory of 3484 4564 6iar84.exe 111 PID 4564 wrote to memory of 3484 4564 6iar84.exe 111 PID 4564 wrote to memory of 3484 4564 6iar84.exe 111 PID 3484 wrote to memory of 2232 3484 q7h17.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\00bfa31ad49c7d66b65dd63499eb0df3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\00bfa31ad49c7d66b65dd63499eb0df3_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\nb0p7l.exec:\nb0p7l.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\p33412o.exec:\p33412o.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\15g0n.exec:\15g0n.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\7dexp.exec:\7dexp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\osk69r.exec:\osk69r.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\8581q1.exec:\8581q1.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\qi1o5.exec:\qi1o5.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\kf94799.exec:\kf94799.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\4f0740.exec:\4f0740.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\b8ff9p5.exec:\b8ff9p5.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\g2c771.exec:\g2c771.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\3l7g52k.exec:\3l7g52k.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\lc5xq.exec:\lc5xq.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\x44cm.exec:\x44cm.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\513o9.exec:\513o9.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\9bqn0x.exec:\9bqn0x.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\x42j985.exec:\x42j985.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\gaxat.exec:\gaxat.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\jd5wm.exec:\jd5wm.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\6iar84.exec:\6iar84.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\q7h17.exec:\q7h17.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\n182f9.exec:\n182f9.exe23⤵
- Executes dropped EXE
PID:2232 -
\??\c:\r8v75.exec:\r8v75.exe24⤵
- Executes dropped EXE
PID:716 -
\??\c:\u9556w.exec:\u9556w.exe25⤵
- Executes dropped EXE
PID:3104 -
\??\c:\0dm314.exec:\0dm314.exe26⤵
- Executes dropped EXE
PID:2868 -
\??\c:\239309.exec:\239309.exe27⤵
- Executes dropped EXE
PID:2192 -
\??\c:\dg31hee.exec:\dg31hee.exe28⤵
- Executes dropped EXE
PID:2912 -
\??\c:\9iua3.exec:\9iua3.exe29⤵
- Executes dropped EXE
PID:1144 -
\??\c:\243ui46.exec:\243ui46.exe30⤵
- Executes dropped EXE
PID:4192 -
\??\c:\xj9281.exec:\xj9281.exe31⤵
- Executes dropped EXE
PID:5008 -
\??\c:\11b1s.exec:\11b1s.exe32⤵
- Executes dropped EXE
PID:4388 -
\??\c:\x3i304.exec:\x3i304.exe33⤵
- Executes dropped EXE
PID:644 -
\??\c:\xagph9n.exec:\xagph9n.exe34⤵
- Executes dropped EXE
PID:1168 -
\??\c:\x9gak.exec:\x9gak.exe35⤵
- Executes dropped EXE
PID:668 -
\??\c:\k08cvdf.exec:\k08cvdf.exe36⤵
- Executes dropped EXE
PID:1064 -
\??\c:\j3m5b5.exec:\j3m5b5.exe37⤵
- Executes dropped EXE
PID:2680 -
\??\c:\ifs06.exec:\ifs06.exe38⤵
- Executes dropped EXE
PID:2040 -
\??\c:\095i33.exec:\095i33.exe39⤵
- Executes dropped EXE
PID:3380 -
\??\c:\52579.exec:\52579.exe40⤵
- Executes dropped EXE
PID:4980 -
\??\c:\9qh3797.exec:\9qh3797.exe41⤵
- Executes dropped EXE
PID:3448 -
\??\c:\a9785ou.exec:\a9785ou.exe42⤵
- Executes dropped EXE
PID:3080 -
\??\c:\ao934rm.exec:\ao934rm.exe43⤵
- Executes dropped EXE
PID:4088 -
\??\c:\8b7463.exec:\8b7463.exe44⤵
- Executes dropped EXE
PID:4512 -
\??\c:\04equ.exec:\04equ.exe45⤵
- Executes dropped EXE
PID:3608 -
\??\c:\lx25kdq.exec:\lx25kdq.exe46⤵
- Executes dropped EXE
PID:4384 -
\??\c:\ug9kb.exec:\ug9kb.exe47⤵
- Executes dropped EXE
PID:1640 -
\??\c:\30434.exec:\30434.exe48⤵
- Executes dropped EXE
PID:940 -
\??\c:\0fi17v.exec:\0fi17v.exe49⤵
- Executes dropped EXE
PID:1004 -
\??\c:\u0i1et.exec:\u0i1et.exe50⤵
- Executes dropped EXE
PID:2624 -
\??\c:\3jdw5.exec:\3jdw5.exe51⤵
- Executes dropped EXE
PID:4032 -
\??\c:\8r4f09h.exec:\8r4f09h.exe52⤵
- Executes dropped EXE
PID:3940 -
\??\c:\5616n.exec:\5616n.exe53⤵
- Executes dropped EXE
PID:1996 -
\??\c:\6d5616.exec:\6d5616.exe54⤵
- Executes dropped EXE
PID:4864 -
\??\c:\fa195i9.exec:\fa195i9.exe55⤵
- Executes dropped EXE
PID:2588 -
\??\c:\mli4r9.exec:\mli4r9.exe56⤵
- Executes dropped EXE
PID:2628 -
\??\c:\3q20cu.exec:\3q20cu.exe57⤵
- Executes dropped EXE
PID:1956 -
\??\c:\8x3aa.exec:\8x3aa.exe58⤵
- Executes dropped EXE
PID:4040 -
\??\c:\k5twu0.exec:\k5twu0.exe59⤵
- Executes dropped EXE
PID:1572 -
\??\c:\d5f141.exec:\d5f141.exe60⤵
- Executes dropped EXE
PID:2924 -
\??\c:\vk7bup.exec:\vk7bup.exe61⤵
- Executes dropped EXE
PID:444 -
\??\c:\ffd1b.exec:\ffd1b.exe62⤵
- Executes dropped EXE
PID:5064 -
\??\c:\bomei8.exec:\bomei8.exe63⤵
- Executes dropped EXE
PID:3308 -
\??\c:\u5u5qqw.exec:\u5u5qqw.exe64⤵
- Executes dropped EXE
PID:2232 -
\??\c:\j4e3o2g.exec:\j4e3o2g.exe65⤵
- Executes dropped EXE
PID:1728 -
\??\c:\e39qf84.exec:\e39qf84.exe66⤵PID:5080
-
\??\c:\50l17.exec:\50l17.exe67⤵PID:4688
-
\??\c:\1iimk4.exec:\1iimk4.exe68⤵PID:3316
-
\??\c:\6qk1t.exec:\6qk1t.exe69⤵PID:3084
-
\??\c:\703ct.exec:\703ct.exe70⤵PID:3148
-
\??\c:\73506.exec:\73506.exe71⤵PID:3864
-
\??\c:\ne5d8i.exec:\ne5d8i.exe72⤵PID:3696
-
\??\c:\199s4.exec:\199s4.exe73⤵PID:452
-
\??\c:\o7ffg.exec:\o7ffg.exe74⤵PID:4744
-
\??\c:\quv77.exec:\quv77.exe75⤵PID:3424
-
\??\c:\6iakiaq.exec:\6iakiaq.exe76⤵PID:1360
-
\??\c:\vhi1g9.exec:\vhi1g9.exe77⤵PID:4300
-
\??\c:\a8w380k.exec:\a8w380k.exe78⤵PID:5076
-
\??\c:\fa23693.exec:\fa23693.exe79⤵PID:1928
-
\??\c:\u2t590.exec:\u2t590.exe80⤵PID:2012
-
\??\c:\st7u353.exec:\st7u353.exe81⤵PID:3500
-
\??\c:\cee555m.exec:\cee555m.exe82⤵PID:2404
-
\??\c:\qq3h6t.exec:\qq3h6t.exe83⤵PID:3472
-
\??\c:\wh3b7.exec:\wh3b7.exe84⤵PID:1356
-
\??\c:\55107k.exec:\55107k.exe85⤵PID:1428
-
\??\c:\rq578r.exec:\rq578r.exe86⤵PID:1452
-
\??\c:\unqu1c.exec:\unqu1c.exe87⤵PID:3660
-
\??\c:\fvjbnv.exec:\fvjbnv.exe88⤵PID:4536
-
\??\c:\835xs.exec:\835xs.exe89⤵PID:5016
-
\??\c:\x58m6e.exec:\x58m6e.exe90⤵PID:2928
-
\??\c:\xr3f9aa.exec:\xr3f9aa.exe91⤵PID:1884
-
\??\c:\onopve.exec:\onopve.exe92⤵PID:3300
-
\??\c:\rg55n.exec:\rg55n.exe93⤵PID:1764
-
\??\c:\v6157.exec:\v6157.exe94⤵PID:2356
-
\??\c:\0lv9ge.exec:\0lv9ge.exe95⤵PID:4044
-
\??\c:\i9691.exec:\i9691.exe96⤵PID:4440
-
\??\c:\0779735.exec:\0779735.exe97⤵PID:2552
-
\??\c:\vs5qxk1.exec:\vs5qxk1.exe98⤵PID:4252
-
\??\c:\e30xc8.exec:\e30xc8.exe99⤵PID:832
-
\??\c:\r0u4ek.exec:\r0u4ek.exe100⤵PID:3676
-
\??\c:\97d8v0.exec:\97d8v0.exe101⤵PID:3544
-
\??\c:\it5o30.exec:\it5o30.exe102⤵PID:4784
-
\??\c:\o8ieoug.exec:\o8ieoug.exe103⤵PID:4632
-
\??\c:\ab15t6.exec:\ab15t6.exe104⤵PID:864
-
\??\c:\smwt8f5.exec:\smwt8f5.exe105⤵PID:888
-
\??\c:\6e2i5n1.exec:\6e2i5n1.exe106⤵PID:4012
-
\??\c:\9t6t36.exec:\9t6t36.exe107⤵PID:4684
-
\??\c:\n499l.exec:\n499l.exe108⤵PID:3308
-
\??\c:\28go9bw.exec:\28go9bw.exe109⤵PID:2224
-
\??\c:\k1i29.exec:\k1i29.exe110⤵PID:1728
-
\??\c:\od3leph.exec:\od3leph.exe111⤵PID:2280
-
\??\c:\lvb3bs.exec:\lvb3bs.exe112⤵PID:4988
-
\??\c:\4m45250.exec:\4m45250.exe113⤵PID:4712
-
\??\c:\e7n8i0.exec:\e7n8i0.exe114⤵PID:2244
-
\??\c:\8hpwb.exec:\8hpwb.exe115⤵PID:4192
-
\??\c:\5v94g0.exec:\5v94g0.exe116⤵PID:2664
-
\??\c:\qf534.exec:\qf534.exe117⤵PID:232
-
\??\c:\bo2npx.exec:\bo2npx.exe118⤵PID:4856
-
\??\c:\32b73h.exec:\32b73h.exe119⤵PID:644
-
\??\c:\v7rm517.exec:\v7rm517.exe120⤵PID:840
-
\??\c:\92g9w2.exec:\92g9w2.exe121⤵PID:1064
-
\??\c:\80ns6of.exec:\80ns6of.exe122⤵PID:2500
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-