Analysis
- max time kernel
152s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 12:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9e27b7f54c897fc90bf099edecc8ade3_JaffaCakes118.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
- Target 9e27b7f54c897fc90bf099edecc8ade3_JaffaCakes118.exe
- Size 188KB
- Sample240611-phl2dawfqb
- SHA256 65d92a4c3068bcd20da8040232b70a061367624a2347215ec1d7b3c7de7855a3
- MD5 9e27b7f54c897fc90bf099edecc8ade3
- SHA1 4bc1424a87b1224fe4ee67f68f45f9f0d4900267
- SHA512 77b94dfb16eabbd3e79f7704972f135de9dc70fc2309538b7289c0fe8cf54ed4272f7a2cf39dcb4f0abc23a43c19d669dded9ee8a70f135273454c45bf4c3961
- SSDEEP 1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqgT4+IJPkffYWoxu:PhOm2sI93UufdC67ciJTm5kfX
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4836-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3108-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3688-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3952-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3468-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2484-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2160-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/664-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1444-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4748-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3852-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2940-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1928-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2016-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1920-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3672-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/872-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3356-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2652-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4120-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1640-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4408-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3620-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4140-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2124-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3304-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2464-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/224-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2876-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3952-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3684-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2168-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/452-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2548-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5012-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2604-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2372-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4600-314-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1640-321-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2248-328-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4256-341-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4424-373-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1676-377-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/456-384-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3568-409-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3672-427-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3604-430-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4620-434-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3916-448-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-477-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4304-490-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4200-515-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2372-546-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3916-562-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1096-596-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5012-639-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4684-694-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4012-780-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3224-874-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3044-950-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 640 1r3bepn.exe 3108 0554c.exe 1796 hte8e.exe 3688 me39c10.exe 3952 ac972t.exe 3468 07o7s.exe 2160 h7e2x0.exe 2484 f255l.exe 664 0a3effd.exe 1444 34qno06.exe 4748 l3k0n.exe 3852 4um5t4.exe 4212 f143guk.exe 2940 h7rsq7.exe 1928 r1x22f4.exe 2016 n35i0l0.exe 1920 49082r9.exe 3672 uloloo.exe 720 5q01o.exe 872 fiipi7.exe 3356 c85d5q.exe 2652 30286h0.exe 4544 k5171.exe 4120 3dm3m.exe 1640 r54m3.exe 4408 gnqb659.exe 436 343nec.exe 3620 25g97.exe 4140 03vv37.exe 2124 c7w3mm9.exe 3112 bc6b99.exe 3304 75sa3.exe 1604 9t649n.exe 2464 n17l3.exe 1280 8171e.exe 4572 d1cm3.exe 224 4ma2qk.exe 2876 35l2s5.exe 1548 723w696.exe 3232 444066.exe 3952 78ifg.exe 4692 n8xgu39.exe 3684 0d0am9k.exe 3616 9c666.exe 2168 230805b.exe 1460 35a2q7.exe 452 6wc44.exe 2548 884gr1.exe 2180 7k0a2.exe 1048 q1s92r.exe 5024 we92o.exe 3812 7cbqgb.exe 4212 ul7496.exe 5012 0i9e3d0.exe 1252 9585qr0.exe 2604 s3w145.exe 2016 k03x08.exe 2608 51p9kp2.exe 4320 o3rcm.exe 3672 9fsso4.exe 720 5n1uh0.exe 2372 4446828.exe 4876 7i755q.exe 3356 puuc0s.exe -
resource yara_rule behavioral2/memory/4836-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3108-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3108-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2160-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2484-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2160-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/664-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1444-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4748-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3852-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2940-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1928-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2016-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1920-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/872-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3356-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2652-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1640-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3620-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4140-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2124-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3304-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2464-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2876-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3684-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2168-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/452-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2548-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1048-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5012-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-298-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4600-314-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1640-321-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2248-328-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4256-341-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-373-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1676-377-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/456-384-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3568-409-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3604-424-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-427-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3604-430-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4620-434-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-438-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3916-448-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2008-455-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-477-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4304-490-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4200-515-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-546-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4836 wrote to memory of 640 4836 9e27b7f54c897fc90bf099edecc8ade3_JaffaCakes118.exe 90 PID 4836 wrote to memory of 640 4836 9e27b7f54c897fc90bf099edecc8ade3_JaffaCakes118.exe 90 PID 4836 wrote to memory of 640 4836 9e27b7f54c897fc90bf099edecc8ade3_JaffaCakes118.exe 90 PID 640 wrote to memory of 3108 640 1r3bepn.exe 91 PID 640 wrote to memory of 3108 640 1r3bepn.exe 91 PID 640 wrote to memory of 3108 640 1r3bepn.exe 91 PID 3108 wrote to memory of 1796 3108 0554c.exe 92 PID 3108 wrote to memory of 1796 3108 0554c.exe 92 PID 3108 wrote to memory of 1796 3108 0554c.exe 92 PID 1796 wrote to memory of 3688 1796 hte8e.exe 93 PID 1796 wrote to memory of 3688 1796 hte8e.exe 93 PID 1796 wrote to memory of 3688 1796 hte8e.exe 93 PID 3688 wrote to memory of 3952 3688 me39c10.exe 94 PID 3688 wrote to memory of 3952 3688 me39c10.exe 94 PID 3688 wrote to memory of 3952 3688 me39c10.exe 94 PID 3952 wrote to memory of 3468 3952 ac972t.exe 95 PID 3952 wrote to memory of 3468 3952 ac972t.exe 95 PID 3952 wrote to memory of 3468 3952 ac972t.exe 95 PID 3468 wrote to memory of 2160 3468 07o7s.exe 96 PID 3468 wrote to memory of 2160 3468 07o7s.exe 96 PID 3468 wrote to memory of 2160 3468 07o7s.exe 96 PID 2160 wrote to memory of 2484 2160 h7e2x0.exe 97 PID 2160 wrote to memory of 2484 2160 h7e2x0.exe 97 PID 2160 wrote to memory of 2484 2160 h7e2x0.exe 97 PID 2484 wrote to memory of 664 2484 f255l.exe 98 PID 2484 wrote to memory of 664 2484 f255l.exe 98 PID 2484 wrote to memory of 664 2484 f255l.exe 98 PID 664 wrote to memory of 1444 664 0a3effd.exe 99 PID 664 wrote to memory of 1444 664 0a3effd.exe 99 PID 664 wrote to memory of 1444 664 0a3effd.exe 99 PID 1444 wrote to memory of 4748 1444 34qno06.exe 100 PID 1444 wrote to memory of 4748 1444 34qno06.exe 100 PID 1444 wrote to memory of 4748 1444 34qno06.exe 100 PID 4748 wrote to memory of 3852 4748 l3k0n.exe 101 PID 4748 wrote to memory of 3852 4748 l3k0n.exe 101 PID 4748 wrote to memory of 3852 4748 l3k0n.exe 101 PID 3852 wrote to memory of 4212 3852 4um5t4.exe 102 PID 3852 wrote to memory of 4212 3852 4um5t4.exe 102 PID 3852 wrote to memory of 4212 3852 4um5t4.exe 102 PID 4212 wrote to memory of 2940 4212 f143guk.exe 103 PID 4212 wrote to memory of 2940 4212 f143guk.exe 103 PID 4212 wrote to memory of 2940 4212 f143guk.exe 103 PID 2940 wrote to memory of 1928 2940 h7rsq7.exe 104 PID 2940 wrote to memory of 1928 2940 h7rsq7.exe 104 PID 2940 wrote to memory of 1928 2940 h7rsq7.exe 104 PID 1928 wrote to memory of 2016 1928 r1x22f4.exe 105 PID 1928 wrote to memory of 2016 1928 r1x22f4.exe 105 PID 1928 wrote to memory of 2016 1928 r1x22f4.exe 105 PID 2016 wrote to memory of 1920 2016 n35i0l0.exe 106 PID 2016 wrote to memory of 1920 2016 n35i0l0.exe 106 PID 2016 wrote to memory of 1920 2016 n35i0l0.exe 106 PID 1920 wrote to memory of 3672 1920 49082r9.exe 107 PID 1920 wrote to memory of 3672 1920 49082r9.exe 107 PID 1920 wrote to memory of 3672 1920 49082r9.exe 107 PID 3672 wrote to memory of 720 3672 uloloo.exe 108 PID 3672 wrote to memory of 720 3672 uloloo.exe 108 PID 3672 wrote to memory of 720 3672 uloloo.exe 108 PID 720 wrote to memory of 872 720 5q01o.exe 109 PID 720 wrote to memory of 872 720 5q01o.exe 109 PID 720 wrote to memory of 872 720 5q01o.exe 109 PID 872 wrote to memory of 3356 872 fiipi7.exe 110 PID 872 wrote to memory of 3356 872 fiipi7.exe 110 PID 872 wrote to memory of 3356 872 fiipi7.exe 110 PID 3356 wrote to memory of 2652 3356 c85d5q.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e27b7f54c897fc90bf099edecc8ade3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9e27b7f54c897fc90bf099edecc8ade3_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\1r3bepn.exec:\1r3bepn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\0554c.exec:\0554c.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\hte8e.exec:\hte8e.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\me39c10.exec:\me39c10.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\ac972t.exec:\ac972t.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\07o7s.exec:\07o7s.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\h7e2x0.exec:\h7e2x0.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\f255l.exec:\f255l.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\0a3effd.exec:\0a3effd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\34qno06.exec:\34qno06.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\l3k0n.exec:\l3k0n.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\4um5t4.exec:\4um5t4.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\f143guk.exec:\f143guk.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\h7rsq7.exec:\h7rsq7.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\r1x22f4.exec:\r1x22f4.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\n35i0l0.exec:\n35i0l0.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\49082r9.exec:\49082r9.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\uloloo.exec:\uloloo.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\5q01o.exec:\5q01o.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
\??\c:\fiipi7.exec:\fiipi7.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\c85d5q.exec:\c85d5q.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\30286h0.exec:\30286h0.exe23⤵
- Executes dropped EXE
PID:2652 -
\??\c:\k5171.exec:\k5171.exe24⤵
- Executes dropped EXE
PID:4544 -
\??\c:\3dm3m.exec:\3dm3m.exe25⤵
- Executes dropped EXE
PID:4120 -
\??\c:\r54m3.exec:\r54m3.exe26⤵
- Executes dropped EXE
PID:1640 -
\??\c:\gnqb659.exec:\gnqb659.exe27⤵
- Executes dropped EXE
PID:4408 -
\??\c:\343nec.exec:\343nec.exe28⤵
- Executes dropped EXE
PID:436 -
\??\c:\25g97.exec:\25g97.exe29⤵
- Executes dropped EXE
PID:3620 -
\??\c:\03vv37.exec:\03vv37.exe30⤵
- Executes dropped EXE
PID:4140 -
\??\c:\c7w3mm9.exec:\c7w3mm9.exe31⤵
- Executes dropped EXE
PID:2124 -
\??\c:\bc6b99.exec:\bc6b99.exe32⤵
- Executes dropped EXE
PID:3112 -
\??\c:\75sa3.exec:\75sa3.exe33⤵
- Executes dropped EXE
PID:3304 -
\??\c:\9t649n.exec:\9t649n.exe34⤵
- Executes dropped EXE
PID:1604 -
\??\c:\n17l3.exec:\n17l3.exe35⤵
- Executes dropped EXE
PID:2464 -
\??\c:\8171e.exec:\8171e.exe36⤵
- Executes dropped EXE
PID:1280 -
\??\c:\d1cm3.exec:\d1cm3.exe37⤵
- Executes dropped EXE
PID:4572 -
\??\c:\4ma2qk.exec:\4ma2qk.exe38⤵
- Executes dropped EXE
PID:224 -
\??\c:\35l2s5.exec:\35l2s5.exe39⤵
- Executes dropped EXE
PID:2876 -
\??\c:\723w696.exec:\723w696.exe40⤵
- Executes dropped EXE
PID:1548 -
\??\c:\444066.exec:\444066.exe41⤵
- Executes dropped EXE
PID:3232 -
\??\c:\78ifg.exec:\78ifg.exe42⤵
- Executes dropped EXE
PID:3952 -
\??\c:\n8xgu39.exec:\n8xgu39.exe43⤵
- Executes dropped EXE
PID:4692 -
\??\c:\0d0am9k.exec:\0d0am9k.exe44⤵
- Executes dropped EXE
PID:3684 -
\??\c:\9c666.exec:\9c666.exe45⤵
- Executes dropped EXE
PID:3616 -
\??\c:\230805b.exec:\230805b.exe46⤵
- Executes dropped EXE
PID:2168 -
\??\c:\35a2q7.exec:\35a2q7.exe47⤵
- Executes dropped EXE
PID:1460 -
\??\c:\6wc44.exec:\6wc44.exe48⤵
- Executes dropped EXE
PID:452 -
\??\c:\884gr1.exec:\884gr1.exe49⤵
- Executes dropped EXE
PID:2548 -
\??\c:\7k0a2.exec:\7k0a2.exe50⤵
- Executes dropped EXE
PID:2180 -
\??\c:\q1s92r.exec:\q1s92r.exe51⤵
- Executes dropped EXE
PID:1048 -
\??\c:\we92o.exec:\we92o.exe52⤵
- Executes dropped EXE
PID:5024 -
\??\c:\7cbqgb.exec:\7cbqgb.exe53⤵
- Executes dropped EXE
PID:3812 -
\??\c:\ul7496.exec:\ul7496.exe54⤵
- Executes dropped EXE
PID:4212 -
\??\c:\0i9e3d0.exec:\0i9e3d0.exe55⤵
- Executes dropped EXE
PID:5012 -
\??\c:\9585qr0.exec:\9585qr0.exe56⤵
- Executes dropped EXE
PID:1252 -
\??\c:\s3w145.exec:\s3w145.exe57⤵
- Executes dropped EXE
PID:2604 -
\??\c:\k03x08.exec:\k03x08.exe58⤵
- Executes dropped EXE
PID:2016 -
\??\c:\51p9kp2.exec:\51p9kp2.exe59⤵
- Executes dropped EXE
PID:2608 -
\??\c:\o3rcm.exec:\o3rcm.exe60⤵
- Executes dropped EXE
PID:4320 -
\??\c:\9fsso4.exec:\9fsso4.exe61⤵
- Executes dropped EXE
PID:3672 -
\??\c:\5n1uh0.exec:\5n1uh0.exe62⤵
- Executes dropped EXE
PID:720 -
\??\c:\4446828.exec:\4446828.exe63⤵
- Executes dropped EXE
PID:2372 -
\??\c:\7i755q.exec:\7i755q.exe64⤵
- Executes dropped EXE
PID:4876 -
\??\c:\puuc0s.exec:\puuc0s.exe65⤵
- Executes dropped EXE
PID:3356 -
\??\c:\m7515.exec:\m7515.exe66⤵PID:836
-
\??\c:\g0cfa.exec:\g0cfa.exe67⤵PID:2204
-
\??\c:\62sp18n.exec:\62sp18n.exe68⤵PID:4600
-
\??\c:\6wemq4.exec:\6wemq4.exe69⤵PID:4528
-
\??\c:\j6rrnv.exec:\j6rrnv.exe70⤵PID:1640
-
\??\c:\p221e90.exec:\p221e90.exe71⤵PID:2708
-
\??\c:\22008.exec:\22008.exe72⤵PID:2248
-
\??\c:\c7l3h4.exec:\c7l3h4.exe73⤵PID:1844
-
\??\c:\63o14k.exec:\63o14k.exe74⤵PID:2172
-
\??\c:\48oxm4.exec:\48oxm4.exe75⤵PID:1212
-
\??\c:\48v7gnf.exec:\48v7gnf.exe76⤵PID:4256
-
\??\c:\b46h1b.exec:\b46h1b.exe77⤵PID:1856
-
\??\c:\9j2fw.exec:\9j2fw.exe78⤵PID:2352
-
\??\c:\vl5o250.exec:\vl5o250.exe79⤵PID:4328
-
\??\c:\txipoc.exec:\txipoc.exe80⤵PID:4252
-
\??\c:\1xlu7.exec:\1xlu7.exe81⤵PID:4836
-
\??\c:\12mc01x.exec:\12mc01x.exe82⤵PID:4492
-
\??\c:\74vs7c.exec:\74vs7c.exe83⤵PID:2856
-
\??\c:\x60850e.exec:\x60850e.exe84⤵PID:576
-
\??\c:\wcs7rud.exec:\wcs7rud.exe85⤵PID:3396
-
\??\c:\63t5ag.exec:\63t5ag.exe86⤵PID:4128
-
\??\c:\egw01.exec:\egw01.exe87⤵PID:4424
-
\??\c:\05pgm.exec:\05pgm.exe88⤵PID:1676
-
\??\c:\mbael5.exec:\mbael5.exe89⤵PID:4516
-
\??\c:\17f658j.exec:\17f658j.exe90⤵PID:456
-
\??\c:\t04b0g.exec:\t04b0g.exe91⤵PID:3616
-
\??\c:\om1roo.exec:\om1roo.exe92⤵PID:2952
-
\??\c:\j71c145.exec:\j71c145.exe93⤵PID:1460
-
\??\c:\d75018.exec:\d75018.exe94⤵PID:1444
-
\??\c:\s4wwf.exec:\s4wwf.exe95⤵PID:2548
-
\??\c:\u69m8.exec:\u69m8.exe96⤵PID:5068
-
\??\c:\38w62h.exec:\38w62h.exe97⤵PID:4820
-
\??\c:\8613177.exec:\8613177.exe98⤵PID:3568
-
\??\c:\g5pjk.exec:\g5pjk.exe99⤵PID:1928
-
\??\c:\e6w8rl.exec:\e6w8rl.exe100⤵PID:1712
-
\??\c:\2d9qq8o.exec:\2d9qq8o.exe101⤵PID:2608
-
\??\c:\7i66b.exec:\7i66b.exe102⤵PID:4616
-
\??\c:\9u7mj.exec:\9u7mj.exe103⤵PID:3672
-
\??\c:\w85r3gn.exec:\w85r3gn.exe104⤵PID:3604
-
\??\c:\ptwov.exec:\ptwov.exe105⤵PID:4620
-
\??\c:\h44pt9.exec:\h44pt9.exe106⤵PID:836
-
\??\c:\4rb84j.exec:\4rb84j.exe107⤵PID:4120
-
\??\c:\00eaj.exec:\00eaj.exe108⤵PID:4528
-
\??\c:\i3sgk7.exec:\i3sgk7.exe109⤵PID:3916
-
\??\c:\7k8rw.exec:\7k8rw.exe110⤵PID:3708
-
\??\c:\79f538v.exec:\79f538v.exe111⤵PID:1844
-
\??\c:\125ji95.exec:\125ji95.exe112⤵PID:2008
-
\??\c:\a71ul5.exec:\a71ul5.exe113⤵PID:2468
-
\??\c:\b9uo751.exec:\b9uo751.exe114⤵PID:2732
-
\??\c:\4bom1t3.exec:\4bom1t3.exe115⤵PID:3556
-
\??\c:\53779.exec:\53779.exe116⤵PID:4780
-
\??\c:\9xp48.exec:\9xp48.exe117⤵PID:1520
-
\??\c:\s158c09.exec:\s158c09.exe118⤵PID:3192
-
\??\c:\899ev.exec:\899ev.exe119⤵PID:3156
-
\??\c:\q3997.exec:\q3997.exe120⤵PID:2856
-
\??\c:\6kmko.exec:\6kmko.exe121⤵PID:576
-
\??\c:\t98nf5w.exec:\t98nf5w.exe122⤵PID:4304
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-