Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
27/07/2024, 20:26
Static task
static1
Behavioral task
behavioral1
Sample
0057f5981340c395f2aadb5470fdd417_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
0057f5981340c395f2aadb5470fdd417_JaffaCakes118.exe
-
Size
71KB
-
MD5
0057f5981340c395f2aadb5470fdd417
-
SHA1
938b64cd08a98e85e84c7833ec6b6f42df24eeca
-
SHA256
52fdb89aff0058aea86edb849145f59dfd1ad6cd418f92fa6288cef8e95b1583
-
SHA512
0da1626910f368be776b26dd4bb5598b865a5a600970f58d963164c26485c8471880438183aaebf817081ea15de2df41498cce0daa75be3855a529136e988baf
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIuyldHinxpifW6WLT65W:ymb3NkkiQ3mdBjFIuyldH+keL+W
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/1948-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2344-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1724-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2260-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-90-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1988-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2968-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/316-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1124-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1692-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/924-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/328-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2520 o840842.exe 2344 046022.exe 1724 48406.exe 2260 6024668.exe 2800 c862842.exe 2740 620440.exe 2708 68482.exe 2812 8642884.exe 1988 4480228.exe 2664 g4002.exe 2360 22662.exe 2968 2828828.exe 316 624426.exe 1124 26802.exe 2888 s0486.exe 2036 460066.exe 1848 22046.exe 1248 88200.exe 3060 8280628.exe 1692 282228.exe 2308 62244.exe 2004 6220600.exe 924 664242.exe 1740 44626.exe 2248 i264808.exe 2264 8868620.exe 264 680824.exe 2420 84040.exe 328 400208.exe 1908 8082648.exe 1308 824062.exe 1572 24224.exe 2396 0428466.exe 1412 0284668.exe 2412 226804.exe 2084 604044.exe 2752 m6886.exe 2800 o884482.exe 2756 4422406.exe 2796 k40068.exe 2764 60406.exe 2616 4484646.exe 2644 0604448.exe 2864 w00280.exe 288 28284.exe 3040 28648.exe 2968 0204666.exe 1352 420084.exe 2836 40240.exe 668 6046886.exe 748 8626006.exe 2036 048064.exe 2104 06268.exe 3068 86020.exe 2100 u640242.exe 2536 602440.exe 1692 28488.exe 1892 6082682.exe 444 8060860.exe 1456 622660.exe 2496 60280.exe 1164 40040.exe 2256 6204006.exe 2156 6040282.exe -
resource yara_rule behavioral1/memory/1948-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1724-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2260-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1988-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/316-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1124-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1692-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/924-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/328-279-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 048484.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 622482.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4420082.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46600.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i246088.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6668666.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6488822.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24002.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u262064.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6286442.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u640082.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06488.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2848482.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40808.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4820220.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1948 wrote to memory of 2520 1948 0057f5981340c395f2aadb5470fdd417_JaffaCakes118.exe 30 PID 1948 wrote to memory of 2520 1948 0057f5981340c395f2aadb5470fdd417_JaffaCakes118.exe 30 PID 1948 wrote to memory of 2520 1948 0057f5981340c395f2aadb5470fdd417_JaffaCakes118.exe 30 PID 1948 wrote to memory of 2520 1948 0057f5981340c395f2aadb5470fdd417_JaffaCakes118.exe 30 PID 2520 wrote to memory of 2344 2520 o840842.exe 31 PID 2520 wrote to memory of 2344 2520 o840842.exe 31 PID 2520 wrote to memory of 2344 2520 o840842.exe 31 PID 2520 wrote to memory of 2344 2520 o840842.exe 31 PID 2344 wrote to memory of 1724 2344 046022.exe 32 PID 2344 wrote to memory of 1724 2344 046022.exe 32 PID 2344 wrote to memory of 1724 2344 046022.exe 32 PID 2344 wrote to memory of 1724 2344 046022.exe 32 PID 1724 wrote to memory of 2260 1724 48406.exe 33 PID 1724 wrote to memory of 2260 1724 48406.exe 33 PID 1724 wrote to memory of 2260 1724 48406.exe 33 PID 1724 wrote to memory of 2260 1724 48406.exe 33 PID 2260 wrote to memory of 2800 2260 6024668.exe 34 PID 2260 wrote to memory of 2800 2260 6024668.exe 34 PID 2260 wrote to memory of 2800 2260 6024668.exe 34 PID 2260 wrote to memory of 2800 2260 6024668.exe 34 PID 2800 wrote to memory of 2740 2800 c862842.exe 35 PID 2800 wrote to memory of 2740 2800 c862842.exe 35 PID 2800 wrote to memory of 2740 2800 c862842.exe 35 PID 2800 wrote to memory of 2740 2800 c862842.exe 35 PID 2740 wrote to memory of 2708 2740 620440.exe 36 PID 2740 wrote to memory of 2708 2740 620440.exe 36 PID 2740 wrote to memory of 2708 2740 620440.exe 36 PID 2740 wrote to memory of 2708 2740 620440.exe 36 PID 2708 wrote to memory of 2812 2708 68482.exe 37 PID 2708 wrote to memory of 2812 2708 68482.exe 37 PID 2708 wrote to memory of 2812 2708 68482.exe 37 PID 2708 wrote to memory of 2812 2708 68482.exe 37 PID 2812 wrote to memory of 1988 2812 8642884.exe 38 PID 2812 wrote to memory of 1988 2812 8642884.exe 38 PID 2812 wrote to memory of 1988 2812 8642884.exe 38 PID 2812 wrote to memory of 1988 2812 8642884.exe 38 PID 1988 wrote to memory of 2664 1988 4480228.exe 39 PID 1988 wrote to memory of 2664 1988 4480228.exe 39 PID 1988 wrote to memory of 2664 1988 4480228.exe 39 PID 1988 wrote to memory of 2664 1988 4480228.exe 39 PID 2664 wrote to memory of 2360 2664 g4002.exe 40 PID 2664 wrote to memory of 2360 2664 g4002.exe 40 PID 2664 wrote to memory of 2360 2664 g4002.exe 40 PID 2664 wrote to memory of 2360 2664 g4002.exe 40 PID 2360 wrote to memory of 2968 2360 22662.exe 41 PID 2360 wrote to memory of 2968 2360 22662.exe 41 PID 2360 wrote to memory of 2968 2360 22662.exe 41 PID 2360 wrote to memory of 2968 2360 22662.exe 41 PID 2968 wrote to memory of 316 2968 2828828.exe 42 PID 2968 wrote to memory of 316 2968 2828828.exe 42 PID 2968 wrote to memory of 316 2968 2828828.exe 42 PID 2968 wrote to memory of 316 2968 2828828.exe 42 PID 316 wrote to memory of 1124 316 624426.exe 43 PID 316 wrote to memory of 1124 316 624426.exe 43 PID 316 wrote to memory of 1124 316 624426.exe 43 PID 316 wrote to memory of 1124 316 624426.exe 43 PID 1124 wrote to memory of 2888 1124 26802.exe 44 PID 1124 wrote to memory of 2888 1124 26802.exe 44 PID 1124 wrote to memory of 2888 1124 26802.exe 44 PID 1124 wrote to memory of 2888 1124 26802.exe 44 PID 2888 wrote to memory of 2036 2888 s0486.exe 45 PID 2888 wrote to memory of 2036 2888 s0486.exe 45 PID 2888 wrote to memory of 2036 2888 s0486.exe 45 PID 2888 wrote to memory of 2036 2888 s0486.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\0057f5981340c395f2aadb5470fdd417_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0057f5981340c395f2aadb5470fdd417_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\o840842.exec:\o840842.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\046022.exec:\046022.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\48406.exec:\48406.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\6024668.exec:\6024668.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\c862842.exec:\c862842.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\620440.exec:\620440.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\68482.exec:\68482.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\8642884.exec:\8642884.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\4480228.exec:\4480228.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\g4002.exec:\g4002.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\22662.exec:\22662.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\2828828.exec:\2828828.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\624426.exec:\624426.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\26802.exec:\26802.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
\??\c:\s0486.exec:\s0486.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\460066.exec:\460066.exe17⤵
- Executes dropped EXE
PID:2036 -
\??\c:\22046.exec:\22046.exe18⤵
- Executes dropped EXE
PID:1848 -
\??\c:\88200.exec:\88200.exe19⤵
- Executes dropped EXE
PID:1248 -
\??\c:\8280628.exec:\8280628.exe20⤵
- Executes dropped EXE
PID:3060 -
\??\c:\282228.exec:\282228.exe21⤵
- Executes dropped EXE
PID:1692 -
\??\c:\62244.exec:\62244.exe22⤵
- Executes dropped EXE
PID:2308 -
\??\c:\6220600.exec:\6220600.exe23⤵
- Executes dropped EXE
PID:2004 -
\??\c:\664242.exec:\664242.exe24⤵
- Executes dropped EXE
PID:924 -
\??\c:\44626.exec:\44626.exe25⤵
- Executes dropped EXE
PID:1740 -
\??\c:\i264808.exec:\i264808.exe26⤵
- Executes dropped EXE
PID:2248 -
\??\c:\8868620.exec:\8868620.exe27⤵
- Executes dropped EXE
PID:2264 -
\??\c:\680824.exec:\680824.exe28⤵
- Executes dropped EXE
PID:264 -
\??\c:\84040.exec:\84040.exe29⤵
- Executes dropped EXE
PID:2420 -
\??\c:\400208.exec:\400208.exe30⤵
- Executes dropped EXE
PID:328 -
\??\c:\8082648.exec:\8082648.exe31⤵
- Executes dropped EXE
PID:1908 -
\??\c:\824062.exec:\824062.exe32⤵
- Executes dropped EXE
PID:1308 -
\??\c:\24224.exec:\24224.exe33⤵
- Executes dropped EXE
PID:1572 -
\??\c:\0428466.exec:\0428466.exe34⤵
- Executes dropped EXE
PID:2396 -
\??\c:\0284668.exec:\0284668.exe35⤵
- Executes dropped EXE
PID:1412 -
\??\c:\226804.exec:\226804.exe36⤵
- Executes dropped EXE
PID:2412 -
\??\c:\604044.exec:\604044.exe37⤵
- Executes dropped EXE
PID:2084 -
\??\c:\m6886.exec:\m6886.exe38⤵
- Executes dropped EXE
PID:2752 -
\??\c:\o884482.exec:\o884482.exe39⤵
- Executes dropped EXE
PID:2800 -
\??\c:\4422406.exec:\4422406.exe40⤵
- Executes dropped EXE
PID:2756 -
\??\c:\k40068.exec:\k40068.exe41⤵
- Executes dropped EXE
PID:2796 -
\??\c:\60406.exec:\60406.exe42⤵
- Executes dropped EXE
PID:2764 -
\??\c:\4484646.exec:\4484646.exe43⤵
- Executes dropped EXE
PID:2616 -
\??\c:\0604448.exec:\0604448.exe44⤵
- Executes dropped EXE
PID:2644 -
\??\c:\w00280.exec:\w00280.exe45⤵
- Executes dropped EXE
PID:2864 -
\??\c:\28284.exec:\28284.exe46⤵
- Executes dropped EXE
PID:288 -
\??\c:\28648.exec:\28648.exe47⤵
- Executes dropped EXE
PID:3040 -
\??\c:\0204666.exec:\0204666.exe48⤵
- Executes dropped EXE
PID:2968 -
\??\c:\420084.exec:\420084.exe49⤵
- Executes dropped EXE
PID:1352 -
\??\c:\40240.exec:\40240.exe50⤵
- Executes dropped EXE
PID:2836 -
\??\c:\6046886.exec:\6046886.exe51⤵
- Executes dropped EXE
PID:668 -
\??\c:\8626006.exec:\8626006.exe52⤵
- Executes dropped EXE
PID:748 -
\??\c:\048064.exec:\048064.exe53⤵
- Executes dropped EXE
PID:2036 -
\??\c:\06268.exec:\06268.exe54⤵
- Executes dropped EXE
PID:2104 -
\??\c:\86020.exec:\86020.exe55⤵
- Executes dropped EXE
PID:3068 -
\??\c:\u640242.exec:\u640242.exe56⤵
- Executes dropped EXE
PID:2100 -
\??\c:\602440.exec:\602440.exe57⤵
- Executes dropped EXE
PID:2536 -
\??\c:\28488.exec:\28488.exe58⤵
- Executes dropped EXE
PID:1692 -
\??\c:\6082682.exec:\6082682.exe59⤵
- Executes dropped EXE
PID:1892 -
\??\c:\8060860.exec:\8060860.exe60⤵
- Executes dropped EXE
PID:444 -
\??\c:\622660.exec:\622660.exe61⤵
- Executes dropped EXE
PID:1456 -
\??\c:\60280.exec:\60280.exe62⤵
- Executes dropped EXE
PID:2496 -
\??\c:\40040.exec:\40040.exe63⤵
- Executes dropped EXE
PID:1164 -
\??\c:\6204006.exec:\6204006.exe64⤵
- Executes dropped EXE
PID:2256 -
\??\c:\6040282.exec:\6040282.exe65⤵
- Executes dropped EXE
PID:2156 -
\??\c:\466666.exec:\466666.exe66⤵PID:804
-
\??\c:\028804.exec:\028804.exe67⤵PID:2500
-
\??\c:\066026.exec:\066026.exe68⤵PID:880
-
\??\c:\g4446.exec:\g4446.exe69⤵PID:328
-
\??\c:\86808.exec:\86808.exe70⤵PID:1916
-
\??\c:\2062246.exec:\2062246.exe71⤵PID:2520
-
\??\c:\2804600.exec:\2804600.exe72⤵PID:1932
-
\??\c:\666486.exec:\666486.exe73⤵PID:2368
-
\??\c:\480244.exec:\480244.exe74⤵PID:2960
-
\??\c:\406066.exec:\406066.exe75⤵PID:1652
-
\??\c:\44606.exec:\44606.exe76⤵PID:2696
-
\??\c:\80666.exec:\80666.exe77⤵PID:2868
-
\??\c:\8420468.exec:\8420468.exe78⤵PID:2820
-
\??\c:\8244280.exec:\8244280.exe79⤵PID:2740
-
\??\c:\6244062.exec:\6244062.exe80⤵PID:2876
-
\??\c:\244460.exec:\244460.exe81⤵PID:2760
-
\??\c:\446404.exec:\446404.exe82⤵PID:2604
-
\??\c:\60842.exec:\60842.exe83⤵PID:1988
-
\??\c:\62286.exec:\62286.exe84⤵PID:2664
-
\??\c:\0866068.exec:\0866068.exe85⤵PID:532
-
\??\c:\0064482.exec:\0064482.exe86⤵PID:1192
-
\??\c:\4802666.exec:\4802666.exe87⤵PID:744
-
\??\c:\466064.exec:\466064.exe88⤵PID:2652
-
\??\c:\08068.exec:\08068.exe89⤵PID:1124
-
\??\c:\6600224.exec:\6600224.exe90⤵PID:1072
-
\??\c:\0604822.exec:\0604822.exe91⤵PID:1604
-
\??\c:\406486.exec:\406486.exe92⤵PID:2040
-
\??\c:\004842.exec:\004842.exe93⤵PID:2236
-
\??\c:\004280.exec:\004280.exe94⤵PID:1940
-
\??\c:\a2244.exec:\a2244.exe95⤵PID:1928
-
\??\c:\28460.exec:\28460.exe96⤵PID:588
-
\??\c:\2886688.exec:\2886688.exe97⤵PID:1532
-
\??\c:\4044448.exec:\4044448.exe98⤵PID:1404
-
\??\c:\8084488.exec:\8084488.exe99⤵PID:1396
-
\??\c:\642428.exec:\642428.exe100⤵PID:1088
-
\??\c:\w44286.exec:\w44286.exe101⤵PID:940
-
\??\c:\800066.exec:\800066.exe102⤵PID:2072
-
\??\c:\40002.exec:\40002.exe103⤵PID:3016
-
\??\c:\84044.exec:\84044.exe104⤵PID:3028
-
\??\c:\0084006.exec:\0084006.exe105⤵PID:2280
-
\??\c:\660646.exec:\660646.exe106⤵PID:796
-
\??\c:\260640.exec:\260640.exe107⤵PID:1664
-
\??\c:\260240.exec:\260240.exe108⤵PID:2444
-
\??\c:\00422.exec:\00422.exe109⤵PID:2312
-
\??\c:\6848482.exec:\6848482.exe110⤵PID:2560
-
\??\c:\624064.exec:\624064.exe111⤵PID:2516
-
\??\c:\642400.exec:\642400.exe112⤵PID:1640
-
\??\c:\68222.exec:\68222.exe113⤵PID:1944
-
\??\c:\28860.exec:\28860.exe114⤵PID:2684
-
\??\c:\6006048.exec:\6006048.exe115⤵PID:1724
-
\??\c:\o484224.exec:\o484224.exe116⤵PID:2744
-
\??\c:\844868.exec:\844868.exe117⤵PID:2600
-
\??\c:\k66004.exec:\k66004.exe118⤵PID:2804
-
\??\c:\04842.exec:\04842.exe119⤵PID:2436
-
\??\c:\6462806.exec:\6462806.exe120⤵PID:2756
-
\??\c:\622482.exec:\622482.exe121⤵
- System Location Discovery: System Language Discovery
PID:2640 -
\??\c:\288620.exec:\288620.exe122⤵PID:2624
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-