Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
28-07-2024 00:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
041667adfcb9e1fc858368972dd64415_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
150 seconds
General
-
Target
041667adfcb9e1fc858368972dd64415_JaffaCakes118.exe
-
Size
232KB
-
MD5
041667adfcb9e1fc858368972dd64415
-
SHA1
0020a43748a3524dfe3bb27d60737b01f3ba8a54
-
SHA256
e414315b3de7900b1fa8319b5529830faf67c2909ea2795441d1ab9906fc5dbd
-
SHA512
3618ffa8ff037165ba6383a77807ba73d567cf7e3989f180883f0fcc090cb99dbb05ceca9741e36fee8d179e6b136f3353d61c086de4899b487588da9f21e267
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31QNVrAIwsX:n3C9BRo7MlrWKo+l0r5wsX
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/1904-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2104-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1880-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/588-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1908-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3020-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1732-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2132-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2972-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1368-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1156-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2096 u664864.exe 2840 84482.exe 2660 80228.exe 2800 0604660.exe 2104 20400.exe 2892 2242262.exe 2628 04204.exe 2564 6286644.exe 1880 602462.exe 588 80060.exe 2336 0044620.exe 1908 q86240.exe 2728 04682.exe 2712 0086088.exe 3020 60822.exe 1732 66842.exe 2132 4846242.exe 848 264644.exe 2488 24480.exe 2972 0004488.exe 1148 004428.exe 1368 40688.exe 2996 048688.exe 1752 888602.exe 2368 6086804.exe 584 0440246.exe 1988 48664.exe 1056 a6002.exe 1156 0040220.exe 2116 q08280.exe 1904 c602480.exe 1596 2200488.exe 2088 882264.exe 2664 g6822.exe 2816 60660.exe 2808 0062682.exe 2964 w82080.exe 2900 k22868.exe 2652 62040.exe 2512 64204.exe 2536 4480848.exe 2156 624224.exe 2424 k00482.exe 1020 60086.exe 3024 2680224.exe 1072 4828026.exe 1488 400400.exe 2604 648044.exe 1224 26842.exe 532 8626262.exe 896 002466.exe 3068 482206.exe 1872 88006.exe 2496 2606064.exe 1088 2688668.exe 2908 480280.exe 1168 62262.exe 1588 c420880.exe 1808 4822064.exe 1040 k20684.exe 1644 84422.exe 1876 8060640.exe 2452 664660.exe 2484 w82468.exe -
resource yara_rule behavioral1/memory/1904-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2104-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1880-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/588-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1908-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1732-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2132-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1368-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1156-279-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62682.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4266224.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8268620.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language o048804.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language o868002.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2646802.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2406048.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1904 wrote to memory of 2096 1904 041667adfcb9e1fc858368972dd64415_JaffaCakes118.exe 31 PID 1904 wrote to memory of 2096 1904 041667adfcb9e1fc858368972dd64415_JaffaCakes118.exe 31 PID 1904 wrote to memory of 2096 1904 041667adfcb9e1fc858368972dd64415_JaffaCakes118.exe 31 PID 1904 wrote to memory of 2096 1904 041667adfcb9e1fc858368972dd64415_JaffaCakes118.exe 31 PID 2096 wrote to memory of 2840 2096 u664864.exe 32 PID 2096 wrote to memory of 2840 2096 u664864.exe 32 PID 2096 wrote to memory of 2840 2096 u664864.exe 32 PID 2096 wrote to memory of 2840 2096 u664864.exe 32 PID 2840 wrote to memory of 2660 2840 84482.exe 33 PID 2840 wrote to memory of 2660 2840 84482.exe 33 PID 2840 wrote to memory of 2660 2840 84482.exe 33 PID 2840 wrote to memory of 2660 2840 84482.exe 33 PID 2660 wrote to memory of 2800 2660 80228.exe 34 PID 2660 wrote to memory of 2800 2660 80228.exe 34 PID 2660 wrote to memory of 2800 2660 80228.exe 34 PID 2660 wrote to memory of 2800 2660 80228.exe 34 PID 2800 wrote to memory of 2104 2800 0604660.exe 35 PID 2800 wrote to memory of 2104 2800 0604660.exe 35 PID 2800 wrote to memory of 2104 2800 0604660.exe 35 PID 2800 wrote to memory of 2104 2800 0604660.exe 35 PID 2104 wrote to memory of 2892 2104 20400.exe 36 PID 2104 wrote to memory of 2892 2104 20400.exe 36 PID 2104 wrote to memory of 2892 2104 20400.exe 36 PID 2104 wrote to memory of 2892 2104 20400.exe 36 PID 2892 wrote to memory of 2628 2892 2242262.exe 37 PID 2892 wrote to memory of 2628 2892 2242262.exe 37 PID 2892 wrote to memory of 2628 2892 2242262.exe 37 PID 2892 wrote to memory of 2628 2892 2242262.exe 37 PID 2628 wrote to memory of 2564 2628 04204.exe 38 PID 2628 wrote to memory of 2564 2628 04204.exe 38 PID 2628 wrote to memory of 2564 2628 04204.exe 38 PID 2628 wrote to memory of 2564 2628 04204.exe 38 PID 2564 wrote to memory of 1880 2564 6286644.exe 39 PID 2564 wrote to memory of 1880 2564 6286644.exe 39 PID 2564 wrote to memory of 1880 2564 6286644.exe 39 PID 2564 wrote to memory of 1880 2564 6286644.exe 39 PID 1880 wrote to memory of 588 1880 602462.exe 40 PID 1880 wrote to memory of 588 1880 602462.exe 40 PID 1880 wrote to memory of 588 1880 602462.exe 40 PID 1880 wrote to memory of 588 1880 602462.exe 40 PID 588 wrote to memory of 2336 588 80060.exe 41 PID 588 wrote to memory of 2336 588 80060.exe 41 PID 588 wrote to memory of 2336 588 80060.exe 41 PID 588 wrote to memory of 2336 588 80060.exe 41 PID 2336 wrote to memory of 1908 2336 0044620.exe 42 PID 2336 wrote to memory of 1908 2336 0044620.exe 42 PID 2336 wrote to memory of 1908 2336 0044620.exe 42 PID 2336 wrote to memory of 1908 2336 0044620.exe 42 PID 1908 wrote to memory of 2728 1908 q86240.exe 43 PID 1908 wrote to memory of 2728 1908 q86240.exe 43 PID 1908 wrote to memory of 2728 1908 q86240.exe 43 PID 1908 wrote to memory of 2728 1908 q86240.exe 43 PID 2728 wrote to memory of 2712 2728 04682.exe 44 PID 2728 wrote to memory of 2712 2728 04682.exe 44 PID 2728 wrote to memory of 2712 2728 04682.exe 44 PID 2728 wrote to memory of 2712 2728 04682.exe 44 PID 2712 wrote to memory of 3020 2712 0086088.exe 45 PID 2712 wrote to memory of 3020 2712 0086088.exe 45 PID 2712 wrote to memory of 3020 2712 0086088.exe 45 PID 2712 wrote to memory of 3020 2712 0086088.exe 45 PID 3020 wrote to memory of 1732 3020 60822.exe 46 PID 3020 wrote to memory of 1732 3020 60822.exe 46 PID 3020 wrote to memory of 1732 3020 60822.exe 46 PID 3020 wrote to memory of 1732 3020 60822.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\041667adfcb9e1fc858368972dd64415_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\041667adfcb9e1fc858368972dd64415_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\u664864.exec:\u664864.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\84482.exec:\84482.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\80228.exec:\80228.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\0604660.exec:\0604660.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\20400.exec:\20400.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\2242262.exec:\2242262.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\04204.exec:\04204.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\6286644.exec:\6286644.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\602462.exec:\602462.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\80060.exec:\80060.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:588 -
\??\c:\0044620.exec:\0044620.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\q86240.exec:\q86240.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\04682.exec:\04682.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\0086088.exec:\0086088.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\60822.exec:\60822.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\66842.exec:\66842.exe17⤵
- Executes dropped EXE
PID:1732 -
\??\c:\4846242.exec:\4846242.exe18⤵
- Executes dropped EXE
PID:2132 -
\??\c:\264644.exec:\264644.exe19⤵
- Executes dropped EXE
PID:848 -
\??\c:\24480.exec:\24480.exe20⤵
- Executes dropped EXE
PID:2488 -
\??\c:\0004488.exec:\0004488.exe21⤵
- Executes dropped EXE
PID:2972 -
\??\c:\004428.exec:\004428.exe22⤵
- Executes dropped EXE
PID:1148 -
\??\c:\40688.exec:\40688.exe23⤵
- Executes dropped EXE
PID:1368 -
\??\c:\048688.exec:\048688.exe24⤵
- Executes dropped EXE
PID:2996 -
\??\c:\888602.exec:\888602.exe25⤵
- Executes dropped EXE
PID:1752 -
\??\c:\6086804.exec:\6086804.exe26⤵
- Executes dropped EXE
PID:2368 -
\??\c:\0440246.exec:\0440246.exe27⤵
- Executes dropped EXE
PID:584 -
\??\c:\48664.exec:\48664.exe28⤵
- Executes dropped EXE
PID:1988 -
\??\c:\a6002.exec:\a6002.exe29⤵
- Executes dropped EXE
PID:1056 -
\??\c:\0040220.exec:\0040220.exe30⤵
- Executes dropped EXE
PID:1156 -
\??\c:\q08280.exec:\q08280.exe31⤵
- Executes dropped EXE
PID:2116 -
\??\c:\c602480.exec:\c602480.exe32⤵
- Executes dropped EXE
PID:1904 -
\??\c:\2200488.exec:\2200488.exe33⤵
- Executes dropped EXE
PID:1596 -
\??\c:\882264.exec:\882264.exe34⤵
- Executes dropped EXE
PID:2088 -
\??\c:\g6822.exec:\g6822.exe35⤵
- Executes dropped EXE
PID:2664 -
\??\c:\60660.exec:\60660.exe36⤵
- Executes dropped EXE
PID:2816 -
\??\c:\0062682.exec:\0062682.exe37⤵
- Executes dropped EXE
PID:2808 -
\??\c:\w82080.exec:\w82080.exe38⤵
- Executes dropped EXE
PID:2964 -
\??\c:\k22868.exec:\k22868.exe39⤵
- Executes dropped EXE
PID:2900 -
\??\c:\62040.exec:\62040.exe40⤵
- Executes dropped EXE
PID:2652 -
\??\c:\64204.exec:\64204.exe41⤵
- Executes dropped EXE
PID:2512 -
\??\c:\4480848.exec:\4480848.exe42⤵
- Executes dropped EXE
PID:2536 -
\??\c:\624224.exec:\624224.exe43⤵
- Executes dropped EXE
PID:2156 -
\??\c:\k00482.exec:\k00482.exe44⤵
- Executes dropped EXE
PID:2424 -
\??\c:\60086.exec:\60086.exe45⤵
- Executes dropped EXE
PID:1020 -
\??\c:\2680224.exec:\2680224.exe46⤵
- Executes dropped EXE
PID:3024 -
\??\c:\4828026.exec:\4828026.exe47⤵
- Executes dropped EXE
PID:1072 -
\??\c:\400400.exec:\400400.exe48⤵
- Executes dropped EXE
PID:1488 -
\??\c:\648044.exec:\648044.exe49⤵
- Executes dropped EXE
PID:2604 -
\??\c:\26842.exec:\26842.exe50⤵
- Executes dropped EXE
PID:1224 -
\??\c:\8626262.exec:\8626262.exe51⤵
- Executes dropped EXE
PID:532 -
\??\c:\002466.exec:\002466.exe52⤵
- Executes dropped EXE
PID:896 -
\??\c:\482206.exec:\482206.exe53⤵
- Executes dropped EXE
PID:3068 -
\??\c:\88006.exec:\88006.exe54⤵
- Executes dropped EXE
PID:1872 -
\??\c:\2606064.exec:\2606064.exe55⤵
- Executes dropped EXE
PID:2496 -
\??\c:\2688668.exec:\2688668.exe56⤵
- Executes dropped EXE
PID:1088 -
\??\c:\480280.exec:\480280.exe57⤵
- Executes dropped EXE
PID:2908 -
\??\c:\62262.exec:\62262.exe58⤵
- Executes dropped EXE
PID:1168 -
\??\c:\c420880.exec:\c420880.exe59⤵
- Executes dropped EXE
PID:1588 -
\??\c:\4822064.exec:\4822064.exe60⤵
- Executes dropped EXE
PID:1808 -
\??\c:\k20684.exec:\k20684.exe61⤵
- Executes dropped EXE
PID:1040 -
\??\c:\84422.exec:\84422.exe62⤵
- Executes dropped EXE
PID:1644 -
\??\c:\8060640.exec:\8060640.exe63⤵
- Executes dropped EXE
PID:1876 -
\??\c:\664660.exec:\664660.exe64⤵
- Executes dropped EXE
PID:2452 -
\??\c:\w82468.exec:\w82468.exe65⤵
- Executes dropped EXE
PID:2484 -
\??\c:\82682.exec:\82682.exe66⤵PID:1676
-
\??\c:\m6080.exec:\m6080.exe67⤵PID:2932
-
\??\c:\2662064.exec:\2662064.exe68⤵PID:888
-
\??\c:\e08864.exec:\e08864.exe69⤵PID:1156
-
\??\c:\626004.exec:\626004.exe70⤵PID:2268
-
\??\c:\06866.exec:\06866.exe71⤵PID:1656
-
\??\c:\04842.exec:\04842.exe72⤵PID:2340
-
\??\c:\u802868.exec:\u802868.exe73⤵PID:1948
-
\??\c:\e46660.exec:\e46660.exe74⤵PID:2088
-
\??\c:\648486.exec:\648486.exe75⤵PID:2672
-
\??\c:\66080.exec:\66080.exe76⤵PID:2788
-
\??\c:\2886288.exec:\2886288.exe77⤵PID:2832
-
\??\c:\200004.exec:\200004.exe78⤵PID:2540
-
\??\c:\g2686.exec:\g2686.exe79⤵PID:2684
-
\??\c:\g8288.exec:\g8288.exe80⤵PID:2528
-
\??\c:\0464242.exec:\0464242.exe81⤵PID:3044
-
\??\c:\820680.exec:\820680.exe82⤵PID:2580
-
\??\c:\228008.exec:\228008.exe83⤵PID:1880
-
\??\c:\02222.exec:\02222.exe84⤵PID:2692
-
\??\c:\i626288.exec:\i626288.exe85⤵PID:776
-
\??\c:\400404.exec:\400404.exe86⤵PID:980
-
\??\c:\206264.exec:\206264.exe87⤵PID:784
-
\??\c:\88680.exec:\88680.exe88⤵PID:2848
-
\??\c:\o048804.exec:\o048804.exe89⤵
- System Location Discovery: System Language Discovery
PID:1736 -
\??\c:\400866.exec:\400866.exe90⤵PID:1224
-
\??\c:\40004.exec:\40004.exe91⤵PID:2184
-
\??\c:\m2286.exec:\m2286.exe92⤵PID:1160
-
\??\c:\8624806.exec:\8624806.exe93⤵PID:1580
-
\??\c:\o046808.exec:\o046808.exe94⤵PID:2092
-
\??\c:\886246.exec:\886246.exe95⤵PID:1228
-
\??\c:\60686.exec:\60686.exe96⤵PID:1088
-
\??\c:\26084.exec:\26084.exe97⤵PID:1512
-
\??\c:\4442424.exec:\4442424.exe98⤵PID:1168
-
\??\c:\882024.exec:\882024.exe99⤵PID:600
-
\??\c:\442400.exec:\442400.exe100⤵PID:900
-
\??\c:\62828.exec:\62828.exe101⤵PID:296
-
\??\c:\m8826.exec:\m8826.exe102⤵PID:2480
-
\??\c:\4404208.exec:\4404208.exe103⤵PID:1484
-
\??\c:\826868.exec:\826868.exe104⤵PID:584
-
\??\c:\w08024.exec:\w08024.exe105⤵PID:2456
-
\??\c:\44204.exec:\44204.exe106⤵PID:1248
-
\??\c:\22026.exec:\22026.exe107⤵PID:1936
-
\??\c:\4426604.exec:\4426604.exe108⤵PID:2172
-
\??\c:\046846.exec:\046846.exe109⤵PID:1156
-
\??\c:\824042.exec:\824042.exe110⤵PID:1608
-
\??\c:\04806.exec:\04806.exe111⤵PID:1660
-
\??\c:\26402.exec:\26402.exe112⤵PID:2072
-
\??\c:\6040280.exec:\6040280.exe113⤵PID:2796
-
\??\c:\4660666.exec:\4660666.exe114⤵PID:2088
-
\??\c:\k44466.exec:\k44466.exe115⤵PID:2644
-
\??\c:\m6406.exec:\m6406.exe116⤵PID:2144
-
\??\c:\22068.exec:\22068.exe117⤵PID:2804
-
\??\c:\4886260.exec:\4886260.exe118⤵PID:2884
-
\??\c:\4262062.exec:\4262062.exe119⤵PID:2628
-
\??\c:\486640.exec:\486640.exe120⤵PID:2568
-
\??\c:\86468.exec:\86468.exe121⤵PID:3056
-
\??\c:\82440.exec:\82440.exe122⤵PID:1476
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-