Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
28-07-2024 00:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
03bd58e83831d9d25b02177e0fcc383e_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
150 seconds
General
-
Target
03bd58e83831d9d25b02177e0fcc383e_JaffaCakes118.exe
-
Size
103KB
-
MD5
03bd58e83831d9d25b02177e0fcc383e
-
SHA1
ba027fc61ab677572d20b028a3d99e0b68763a98
-
SHA256
50fd2f67f428bccf1370a93aace3afb670c216ef37c39de09e630947902c974b
-
SHA512
020012df443f96caa3e11819c8b73c866a4d1f7a2a8ca9183db485566f320d684375df2d2d885ab3f62f4da6a215dff72e81d98c2fc5933eeb63abdb639395a6
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2lmf6g7xifKhLdEH:ymb3NkkiQ3mdBjF+3TU20LifKhLY
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2648-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1588-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1988-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/760-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1292-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1796-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/912-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/872-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1880-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2104-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1776-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1408-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1052-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2108-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1504-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1504-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2464-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1504 2646806.exe 2152 0020002.exe 2108 824644.exe 2736 444688.exe 2648 04280.exe 2752 8880882.exe 2688 4486222.exe 1588 860084.exe 1988 04284.exe 1544 a8286.exe 1052 0422402.exe 2764 8246220.exe 2840 866026.exe 1408 844226.exe 2976 80666.exe 760 04242.exe 1776 20462.exe 2104 6466224.exe 1880 4868060.exe 1116 046862.exe 872 448202.exe 1132 08280.exe 1260 82402.exe 912 2260688.exe 2172 0406608.exe 1292 202024.exe 1828 046284.exe 1796 08404.exe 2932 40248.exe 2952 4244622.exe 1492 i640808.exe 2080 480028.exe 2680 48842.exe 1632 06026.exe 2736 88868.exe 3016 i828224.exe 2696 i864284.exe 2580 042028.exe 2688 622048.exe 2188 86448.exe 2540 00040.exe 2320 04062.exe 1500 8448866.exe 2260 2602064.exe 908 226442.exe 596 804264.exe 1032 26406.exe 1396 46880.exe 2964 22620.exe 1612 8246406.exe 2868 6046880.exe 2068 o866206.exe 1216 q60864.exe 880 844882.exe 2452 k08202.exe 3048 20268.exe 2512 40828.exe 1108 4060084.exe 320 6282600.exe 1696 2464006.exe 2440 062282.exe 1440 282066.exe 1600 62208.exe 1828 66424.exe -
resource yara_rule behavioral1/memory/2152-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1588-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1988-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/760-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1292-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/912-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/872-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1880-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2104-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1776-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1408-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1052-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1504-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-4-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8200286.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4862462.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 048040.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8242468.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u480684.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 04446.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 486268.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 264684.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 060648.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0402024.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0668668.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2464 wrote to memory of 1504 2464 03bd58e83831d9d25b02177e0fcc383e_JaffaCakes118.exe 30 PID 2464 wrote to memory of 1504 2464 03bd58e83831d9d25b02177e0fcc383e_JaffaCakes118.exe 30 PID 2464 wrote to memory of 1504 2464 03bd58e83831d9d25b02177e0fcc383e_JaffaCakes118.exe 30 PID 2464 wrote to memory of 1504 2464 03bd58e83831d9d25b02177e0fcc383e_JaffaCakes118.exe 30 PID 1504 wrote to memory of 2152 1504 2646806.exe 31 PID 1504 wrote to memory of 2152 1504 2646806.exe 31 PID 1504 wrote to memory of 2152 1504 2646806.exe 31 PID 1504 wrote to memory of 2152 1504 2646806.exe 31 PID 2152 wrote to memory of 2108 2152 0020002.exe 32 PID 2152 wrote to memory of 2108 2152 0020002.exe 32 PID 2152 wrote to memory of 2108 2152 0020002.exe 32 PID 2152 wrote to memory of 2108 2152 0020002.exe 32 PID 2108 wrote to memory of 2736 2108 824644.exe 64 PID 2108 wrote to memory of 2736 2108 824644.exe 64 PID 2108 wrote to memory of 2736 2108 824644.exe 64 PID 2108 wrote to memory of 2736 2108 824644.exe 64 PID 2736 wrote to memory of 2648 2736 444688.exe 34 PID 2736 wrote to memory of 2648 2736 444688.exe 34 PID 2736 wrote to memory of 2648 2736 444688.exe 34 PID 2736 wrote to memory of 2648 2736 444688.exe 34 PID 2648 wrote to memory of 2752 2648 04280.exe 35 PID 2648 wrote to memory of 2752 2648 04280.exe 35 PID 2648 wrote to memory of 2752 2648 04280.exe 35 PID 2648 wrote to memory of 2752 2648 04280.exe 35 PID 2752 wrote to memory of 2688 2752 8880882.exe 36 PID 2752 wrote to memory of 2688 2752 8880882.exe 36 PID 2752 wrote to memory of 2688 2752 8880882.exe 36 PID 2752 wrote to memory of 2688 2752 8880882.exe 36 PID 2688 wrote to memory of 1588 2688 4486222.exe 37 PID 2688 wrote to memory of 1588 2688 4486222.exe 37 PID 2688 wrote to memory of 1588 2688 4486222.exe 37 PID 2688 wrote to memory of 1588 2688 4486222.exe 37 PID 1588 wrote to memory of 1988 1588 860084.exe 38 PID 1588 wrote to memory of 1988 1588 860084.exe 38 PID 1588 wrote to memory of 1988 1588 860084.exe 38 PID 1588 wrote to memory of 1988 1588 860084.exe 38 PID 1988 wrote to memory of 1544 1988 04284.exe 39 PID 1988 wrote to memory of 1544 1988 04284.exe 39 PID 1988 wrote to memory of 1544 1988 04284.exe 39 PID 1988 wrote to memory of 1544 1988 04284.exe 39 PID 1544 wrote to memory of 1052 1544 a8286.exe 40 PID 1544 wrote to memory of 1052 1544 a8286.exe 40 PID 1544 wrote to memory of 1052 1544 a8286.exe 40 PID 1544 wrote to memory of 1052 1544 a8286.exe 40 PID 1052 wrote to memory of 2764 1052 0422402.exe 41 PID 1052 wrote to memory of 2764 1052 0422402.exe 41 PID 1052 wrote to memory of 2764 1052 0422402.exe 41 PID 1052 wrote to memory of 2764 1052 0422402.exe 41 PID 2764 wrote to memory of 2840 2764 8246220.exe 42 PID 2764 wrote to memory of 2840 2764 8246220.exe 42 PID 2764 wrote to memory of 2840 2764 8246220.exe 42 PID 2764 wrote to memory of 2840 2764 8246220.exe 42 PID 2840 wrote to memory of 1408 2840 866026.exe 43 PID 2840 wrote to memory of 1408 2840 866026.exe 43 PID 2840 wrote to memory of 1408 2840 866026.exe 43 PID 2840 wrote to memory of 1408 2840 866026.exe 43 PID 1408 wrote to memory of 2976 1408 844226.exe 44 PID 1408 wrote to memory of 2976 1408 844226.exe 44 PID 1408 wrote to memory of 2976 1408 844226.exe 44 PID 1408 wrote to memory of 2976 1408 844226.exe 44 PID 2976 wrote to memory of 760 2976 80666.exe 45 PID 2976 wrote to memory of 760 2976 80666.exe 45 PID 2976 wrote to memory of 760 2976 80666.exe 45 PID 2976 wrote to memory of 760 2976 80666.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\03bd58e83831d9d25b02177e0fcc383e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\03bd58e83831d9d25b02177e0fcc383e_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\2646806.exec:\2646806.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\0020002.exec:\0020002.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\824644.exec:\824644.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\444688.exec:\444688.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\04280.exec:\04280.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\8880882.exec:\8880882.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\4486222.exec:\4486222.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\860084.exec:\860084.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\04284.exec:\04284.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\a8286.exec:\a8286.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\0422402.exec:\0422402.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\8246220.exec:\8246220.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\866026.exec:\866026.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\844226.exec:\844226.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\80666.exec:\80666.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\04242.exec:\04242.exe17⤵
- Executes dropped EXE
PID:760 -
\??\c:\20462.exec:\20462.exe18⤵
- Executes dropped EXE
PID:1776 -
\??\c:\6466224.exec:\6466224.exe19⤵
- Executes dropped EXE
PID:2104 -
\??\c:\4868060.exec:\4868060.exe20⤵
- Executes dropped EXE
PID:1880 -
\??\c:\046862.exec:\046862.exe21⤵
- Executes dropped EXE
PID:1116 -
\??\c:\448202.exec:\448202.exe22⤵
- Executes dropped EXE
PID:872 -
\??\c:\08280.exec:\08280.exe23⤵
- Executes dropped EXE
PID:1132 -
\??\c:\82402.exec:\82402.exe24⤵
- Executes dropped EXE
PID:1260 -
\??\c:\2260688.exec:\2260688.exe25⤵
- Executes dropped EXE
PID:912 -
\??\c:\0406608.exec:\0406608.exe26⤵
- Executes dropped EXE
PID:2172 -
\??\c:\202024.exec:\202024.exe27⤵
- Executes dropped EXE
PID:1292 -
\??\c:\046284.exec:\046284.exe28⤵
- Executes dropped EXE
PID:1828 -
\??\c:\08404.exec:\08404.exe29⤵
- Executes dropped EXE
PID:1796 -
\??\c:\40248.exec:\40248.exe30⤵
- Executes dropped EXE
PID:2932 -
\??\c:\4244622.exec:\4244622.exe31⤵
- Executes dropped EXE
PID:2952 -
\??\c:\i640808.exec:\i640808.exe32⤵
- Executes dropped EXE
PID:1492 -
\??\c:\480028.exec:\480028.exe33⤵
- Executes dropped EXE
PID:2080 -
\??\c:\48842.exec:\48842.exe34⤵
- Executes dropped EXE
PID:2680 -
\??\c:\06026.exec:\06026.exe35⤵
- Executes dropped EXE
PID:1632 -
\??\c:\88868.exec:\88868.exe36⤵
- Executes dropped EXE
PID:2736 -
\??\c:\i828224.exec:\i828224.exe37⤵
- Executes dropped EXE
PID:3016 -
\??\c:\i864284.exec:\i864284.exe38⤵
- Executes dropped EXE
PID:2696 -
\??\c:\042028.exec:\042028.exe39⤵
- Executes dropped EXE
PID:2580 -
\??\c:\622048.exec:\622048.exe40⤵
- Executes dropped EXE
PID:2688 -
\??\c:\86448.exec:\86448.exe41⤵
- Executes dropped EXE
PID:2188 -
\??\c:\00040.exec:\00040.exe42⤵
- Executes dropped EXE
PID:2540 -
\??\c:\04062.exec:\04062.exe43⤵
- Executes dropped EXE
PID:2320 -
\??\c:\8448866.exec:\8448866.exe44⤵
- Executes dropped EXE
PID:1500 -
\??\c:\2602064.exec:\2602064.exe45⤵
- Executes dropped EXE
PID:2260 -
\??\c:\226442.exec:\226442.exe46⤵
- Executes dropped EXE
PID:908 -
\??\c:\804264.exec:\804264.exe47⤵
- Executes dropped EXE
PID:596 -
\??\c:\26406.exec:\26406.exe48⤵
- Executes dropped EXE
PID:1032 -
\??\c:\46880.exec:\46880.exe49⤵
- Executes dropped EXE
PID:1396 -
\??\c:\22620.exec:\22620.exe50⤵
- Executes dropped EXE
PID:2964 -
\??\c:\8246406.exec:\8246406.exe51⤵
- Executes dropped EXE
PID:1612 -
\??\c:\6046880.exec:\6046880.exe52⤵
- Executes dropped EXE
PID:2868 -
\??\c:\o866206.exec:\o866206.exe53⤵
- Executes dropped EXE
PID:2068 -
\??\c:\q60864.exec:\q60864.exe54⤵
- Executes dropped EXE
PID:1216 -
\??\c:\844882.exec:\844882.exe55⤵
- Executes dropped EXE
PID:880 -
\??\c:\k08202.exec:\k08202.exe56⤵
- Executes dropped EXE
PID:2452 -
\??\c:\20268.exec:\20268.exe57⤵
- Executes dropped EXE
PID:3048 -
\??\c:\40828.exec:\40828.exe58⤵
- Executes dropped EXE
PID:2512 -
\??\c:\4060084.exec:\4060084.exe59⤵
- Executes dropped EXE
PID:1108 -
\??\c:\6282600.exec:\6282600.exe60⤵
- Executes dropped EXE
PID:320 -
\??\c:\2464006.exec:\2464006.exe61⤵
- Executes dropped EXE
PID:1696 -
\??\c:\062282.exec:\062282.exe62⤵
- Executes dropped EXE
PID:2440 -
\??\c:\282066.exec:\282066.exe63⤵
- Executes dropped EXE
PID:1440 -
\??\c:\62208.exec:\62208.exe64⤵
- Executes dropped EXE
PID:1600 -
\??\c:\66424.exec:\66424.exe65⤵
- Executes dropped EXE
PID:1828 -
\??\c:\g8408.exec:\g8408.exe66⤵PID:2880
-
\??\c:\i622266.exec:\i622266.exe67⤵PID:2928
-
\??\c:\8862806.exec:\8862806.exe68⤵PID:2332
-
\??\c:\406886.exec:\406886.exe69⤵PID:2960
-
\??\c:\s0480.exec:\s0480.exe70⤵PID:2632
-
\??\c:\48424.exec:\48424.exe71⤵PID:2228
-
\??\c:\8264280.exec:\8264280.exe72⤵PID:2108
-
\??\c:\008684.exec:\008684.exe73⤵PID:1628
-
\??\c:\000482.exec:\000482.exe74⤵PID:2784
-
\??\c:\o620088.exec:\o620088.exe75⤵PID:2656
-
\??\c:\u084662.exec:\u084662.exe76⤵PID:1548
-
\??\c:\660640.exec:\660640.exe77⤵PID:2572
-
\??\c:\44082.exec:\44082.exe78⤵PID:2596
-
\??\c:\4024866.exec:\4024866.exe79⤵PID:2672
-
\??\c:\8206442.exec:\8206442.exe80⤵PID:500
-
\??\c:\02400.exec:\02400.exe81⤵PID:1476
-
\??\c:\2264868.exec:\2264868.exe82⤵PID:2848
-
\??\c:\2408044.exec:\2408044.exe83⤵PID:2528
-
\??\c:\448226.exec:\448226.exe84⤵PID:2748
-
\??\c:\22200.exec:\22200.exe85⤵PID:2816
-
\??\c:\6224804.exec:\6224804.exe86⤵PID:968
-
\??\c:\860460.exec:\860460.exe87⤵PID:2876
-
\??\c:\24084.exec:\24084.exe88⤵PID:3012
-
\??\c:\42820.exec:\42820.exe89⤵PID:276
-
\??\c:\2440284.exec:\2440284.exe90⤵PID:1328
-
\??\c:\6266844.exec:\6266844.exe91⤵PID:2404
-
\??\c:\k08428.exec:\k08428.exe92⤵PID:2012
-
\??\c:\68446.exec:\68446.exe93⤵PID:992
-
\??\c:\0008404.exec:\0008404.exe94⤵PID:1216
-
\??\c:\e08400.exec:\e08400.exe95⤵PID:1876
-
\??\c:\62088.exec:\62088.exe96⤵PID:2492
-
\??\c:\6064062.exec:\6064062.exe97⤵PID:1112
-
\??\c:\4800628.exec:\4800628.exe98⤵PID:1668
-
\??\c:\262422.exec:\262422.exe99⤵PID:2432
-
\??\c:\64080.exec:\64080.exe100⤵PID:320
-
\??\c:\0646824.exec:\0646824.exe101⤵PID:636
-
\??\c:\6282240.exec:\6282240.exe102⤵PID:1888
-
\??\c:\2084246.exec:\2084246.exe103⤵PID:1000
-
\??\c:\u006468.exec:\u006468.exe104⤵PID:2268
-
\??\c:\002066.exec:\002066.exe105⤵PID:1796
-
\??\c:\484640.exec:\484640.exe106⤵PID:2464
-
\??\c:\88288.exec:\88288.exe107⤵PID:2348
-
\??\c:\06866.exec:\06866.exe108⤵PID:1528
-
\??\c:\u440286.exec:\u440286.exe109⤵PID:1972
-
\??\c:\486462.exec:\486462.exe110⤵PID:2632
-
\??\c:\046680.exec:\046680.exe111⤵PID:2896
-
\??\c:\26402.exec:\26402.exe112⤵PID:1632
-
\??\c:\82620.exec:\82620.exe113⤵PID:1208
-
\??\c:\4866846.exec:\4866846.exe114⤵PID:2552
-
\??\c:\0486624.exec:\0486624.exe115⤵PID:616
-
\??\c:\408408.exec:\408408.exe116⤵PID:2588
-
\??\c:\04668.exec:\04668.exe117⤵PID:3004
-
\??\c:\m4440.exec:\m4440.exe118⤵PID:2472
-
\??\c:\62446.exec:\62446.exe119⤵PID:2052
-
\??\c:\2202846.exec:\2202846.exe120⤵PID:2908
-
\??\c:\o282862.exec:\o282862.exe121⤵PID:2592
-
\??\c:\820644.exec:\820644.exe122⤵PID:1844
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-