Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
11/08/2024, 22:09
Static task
static1
Behavioral task
behavioral1
Sample
69ce4bf2edda73e81efe50cb14d6e559fd234588157bcc3937f9072298a7a41e.exe
Resource
win7-20240705-en
General
-
Target
69ce4bf2edda73e81efe50cb14d6e559fd234588157bcc3937f9072298a7a41e.exe
-
Size
95KB
-
MD5
3380cb5005b0b076fc984b1729655cca
-
SHA1
40ff49d92054eb71167d4c90d38a525b82a51fd4
-
SHA256
69ce4bf2edda73e81efe50cb14d6e559fd234588157bcc3937f9072298a7a41e
-
SHA512
5db406f61e1cce6f2ed4609dc88fbe5059f4bb15dd9b1ff5b048cb6b15257c523c2790845e1bf51ce3e0a775e68a3c24699fe5c5c42f0a8cef266cd0a097e909
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoLuePjDYlR3hnjKXIQSe9oEY+n:ymb3NkkiQ3mdBjFoLucjDilOZhoy
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/2212-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1936-40-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1936-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1524-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-50-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2568-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-69-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2344-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2024-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1056-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/644-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3008-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2084-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1976-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2304-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2544 4262880.exe 1524 2464600.exe 1936 482800.exe 2568 s2620.exe 2064 0840662.exe 2840 k04422.exe 2812 22806.exe 2744 64228.exe 2648 c268624.exe 2608 868840.exe 2732 886846.exe 2344 86884.exe 2024 08680.exe 2976 2680608.exe 1056 260882.exe 644 820066.exe 2912 26402.exe 2968 66406.exe 2036 c240268.exe 3008 680444.exe 2152 260280.exe 2328 80666.exe 1768 u080006.exe 2084 6680246.exe 900 q60062.exe 1788 08048.exe 1976 u082400.exe 2288 4004242.exe 1652 420844.exe 2520 44066.exe 2304 s8488.exe 2320 2606828.exe 2868 264062.exe 1712 000262.exe 2220 48066.exe 1936 60202.exe 2756 2682228.exe 2844 8684666.exe 2832 084406.exe 1956 q08440.exe 2788 c066844.exe 2852 c484440.exe 2860 820228.exe 2672 q42240.exe 2660 g0888.exe 676 g8020.exe 1632 2466666.exe 2960 o648444.exe 2372 202400.exe 2944 w80466.exe 2796 04004.exe 2948 m8068.exe 1704 0426884.exe 876 u824660.exe 780 608084.exe 1052 s8622.exe 868 s0888.exe 2704 6002646.exe 2328 8262446.exe 2548 042288.exe 1084 484066.exe 1320 42844.exe 1668 s2006.exe 1788 0468006.exe -
resource yara_rule behavioral1/memory/2212-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1936-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1524-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1524-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1056-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/644-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-295-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86280.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48424.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42064.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 668062.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24284.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6428406.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2212 wrote to memory of 2544 2212 69ce4bf2edda73e81efe50cb14d6e559fd234588157bcc3937f9072298a7a41e.exe 30 PID 2212 wrote to memory of 2544 2212 69ce4bf2edda73e81efe50cb14d6e559fd234588157bcc3937f9072298a7a41e.exe 30 PID 2212 wrote to memory of 2544 2212 69ce4bf2edda73e81efe50cb14d6e559fd234588157bcc3937f9072298a7a41e.exe 30 PID 2212 wrote to memory of 2544 2212 69ce4bf2edda73e81efe50cb14d6e559fd234588157bcc3937f9072298a7a41e.exe 30 PID 2544 wrote to memory of 1524 2544 4262880.exe 31 PID 2544 wrote to memory of 1524 2544 4262880.exe 31 PID 2544 wrote to memory of 1524 2544 4262880.exe 31 PID 2544 wrote to memory of 1524 2544 4262880.exe 31 PID 1524 wrote to memory of 1936 1524 2464600.exe 32 PID 1524 wrote to memory of 1936 1524 2464600.exe 32 PID 1524 wrote to memory of 1936 1524 2464600.exe 32 PID 1524 wrote to memory of 1936 1524 2464600.exe 32 PID 1936 wrote to memory of 2568 1936 482800.exe 33 PID 1936 wrote to memory of 2568 1936 482800.exe 33 PID 1936 wrote to memory of 2568 1936 482800.exe 33 PID 1936 wrote to memory of 2568 1936 482800.exe 33 PID 2568 wrote to memory of 2064 2568 s2620.exe 34 PID 2568 wrote to memory of 2064 2568 s2620.exe 34 PID 2568 wrote to memory of 2064 2568 s2620.exe 34 PID 2568 wrote to memory of 2064 2568 s2620.exe 34 PID 2064 wrote to memory of 2840 2064 0840662.exe 35 PID 2064 wrote to memory of 2840 2064 0840662.exe 35 PID 2064 wrote to memory of 2840 2064 0840662.exe 35 PID 2064 wrote to memory of 2840 2064 0840662.exe 35 PID 2840 wrote to memory of 2812 2840 k04422.exe 36 PID 2840 wrote to memory of 2812 2840 k04422.exe 36 PID 2840 wrote to memory of 2812 2840 k04422.exe 36 PID 2840 wrote to memory of 2812 2840 k04422.exe 36 PID 2812 wrote to memory of 2744 2812 22806.exe 37 PID 2812 wrote to memory of 2744 2812 22806.exe 37 PID 2812 wrote to memory of 2744 2812 22806.exe 37 PID 2812 wrote to memory of 2744 2812 22806.exe 37 PID 2744 wrote to memory of 2648 2744 64228.exe 38 PID 2744 wrote to memory of 2648 2744 64228.exe 38 PID 2744 wrote to memory of 2648 2744 64228.exe 38 PID 2744 wrote to memory of 2648 2744 64228.exe 38 PID 2648 wrote to memory of 2608 2648 c268624.exe 39 PID 2648 wrote to memory of 2608 2648 c268624.exe 39 PID 2648 wrote to memory of 2608 2648 c268624.exe 39 PID 2648 wrote to memory of 2608 2648 c268624.exe 39 PID 2608 wrote to memory of 2732 2608 868840.exe 40 PID 2608 wrote to memory of 2732 2608 868840.exe 40 PID 2608 wrote to memory of 2732 2608 868840.exe 40 PID 2608 wrote to memory of 2732 2608 868840.exe 40 PID 2732 wrote to memory of 2344 2732 886846.exe 41 PID 2732 wrote to memory of 2344 2732 886846.exe 41 PID 2732 wrote to memory of 2344 2732 886846.exe 41 PID 2732 wrote to memory of 2344 2732 886846.exe 41 PID 2344 wrote to memory of 2024 2344 86884.exe 42 PID 2344 wrote to memory of 2024 2344 86884.exe 42 PID 2344 wrote to memory of 2024 2344 86884.exe 42 PID 2344 wrote to memory of 2024 2344 86884.exe 42 PID 2024 wrote to memory of 2976 2024 08680.exe 43 PID 2024 wrote to memory of 2976 2024 08680.exe 43 PID 2024 wrote to memory of 2976 2024 08680.exe 43 PID 2024 wrote to memory of 2976 2024 08680.exe 43 PID 2976 wrote to memory of 1056 2976 2680608.exe 44 PID 2976 wrote to memory of 1056 2976 2680608.exe 44 PID 2976 wrote to memory of 1056 2976 2680608.exe 44 PID 2976 wrote to memory of 1056 2976 2680608.exe 44 PID 1056 wrote to memory of 644 1056 260882.exe 45 PID 1056 wrote to memory of 644 1056 260882.exe 45 PID 1056 wrote to memory of 644 1056 260882.exe 45 PID 1056 wrote to memory of 644 1056 260882.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\69ce4bf2edda73e81efe50cb14d6e559fd234588157bcc3937f9072298a7a41e.exe"C:\Users\Admin\AppData\Local\Temp\69ce4bf2edda73e81efe50cb14d6e559fd234588157bcc3937f9072298a7a41e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\4262880.exec:\4262880.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\2464600.exec:\2464600.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\482800.exec:\482800.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\s2620.exec:\s2620.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\0840662.exec:\0840662.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\k04422.exec:\k04422.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\22806.exec:\22806.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\64228.exec:\64228.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\c268624.exec:\c268624.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\868840.exec:\868840.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\886846.exec:\886846.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\86884.exec:\86884.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\08680.exec:\08680.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\2680608.exec:\2680608.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\260882.exec:\260882.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\820066.exec:\820066.exe17⤵
- Executes dropped EXE
PID:644 -
\??\c:\26402.exec:\26402.exe18⤵
- Executes dropped EXE
PID:2912 -
\??\c:\66406.exec:\66406.exe19⤵
- Executes dropped EXE
PID:2968 -
\??\c:\c240268.exec:\c240268.exe20⤵
- Executes dropped EXE
PID:2036 -
\??\c:\680444.exec:\680444.exe21⤵
- Executes dropped EXE
PID:3008 -
\??\c:\260280.exec:\260280.exe22⤵
- Executes dropped EXE
PID:2152 -
\??\c:\80666.exec:\80666.exe23⤵
- Executes dropped EXE
PID:2328 -
\??\c:\u080006.exec:\u080006.exe24⤵
- Executes dropped EXE
PID:1768 -
\??\c:\6680246.exec:\6680246.exe25⤵
- Executes dropped EXE
PID:2084 -
\??\c:\q60062.exec:\q60062.exe26⤵
- Executes dropped EXE
PID:900 -
\??\c:\08048.exec:\08048.exe27⤵
- Executes dropped EXE
PID:1788 -
\??\c:\u082400.exec:\u082400.exe28⤵
- Executes dropped EXE
PID:1976 -
\??\c:\4004242.exec:\4004242.exe29⤵
- Executes dropped EXE
PID:2288 -
\??\c:\420844.exec:\420844.exe30⤵
- Executes dropped EXE
PID:1652 -
\??\c:\44066.exec:\44066.exe31⤵
- Executes dropped EXE
PID:2520 -
\??\c:\s8488.exec:\s8488.exe32⤵
- Executes dropped EXE
PID:2304 -
\??\c:\2606828.exec:\2606828.exe33⤵
- Executes dropped EXE
PID:2320 -
\??\c:\264062.exec:\264062.exe34⤵
- Executes dropped EXE
PID:2868 -
\??\c:\000262.exec:\000262.exe35⤵
- Executes dropped EXE
PID:1712 -
\??\c:\48066.exec:\48066.exe36⤵
- Executes dropped EXE
PID:2220 -
\??\c:\60202.exec:\60202.exe37⤵
- Executes dropped EXE
PID:1936 -
\??\c:\2682228.exec:\2682228.exe38⤵
- Executes dropped EXE
PID:2756 -
\??\c:\8684666.exec:\8684666.exe39⤵
- Executes dropped EXE
PID:2844 -
\??\c:\084406.exec:\084406.exe40⤵
- Executes dropped EXE
PID:2832 -
\??\c:\q08440.exec:\q08440.exe41⤵
- Executes dropped EXE
PID:1956 -
\??\c:\c066844.exec:\c066844.exe42⤵
- Executes dropped EXE
PID:2788 -
\??\c:\c484440.exec:\c484440.exe43⤵
- Executes dropped EXE
PID:2852 -
\??\c:\820228.exec:\820228.exe44⤵
- Executes dropped EXE
PID:2860 -
\??\c:\q42240.exec:\q42240.exe45⤵
- Executes dropped EXE
PID:2672 -
\??\c:\g0888.exec:\g0888.exe46⤵
- Executes dropped EXE
PID:2660 -
\??\c:\g8020.exec:\g8020.exe47⤵
- Executes dropped EXE
PID:676 -
\??\c:\2466666.exec:\2466666.exe48⤵
- Executes dropped EXE
PID:1632 -
\??\c:\o648444.exec:\o648444.exe49⤵
- Executes dropped EXE
PID:2960 -
\??\c:\202400.exec:\202400.exe50⤵
- Executes dropped EXE
PID:2372 -
\??\c:\w80466.exec:\w80466.exe51⤵
- Executes dropped EXE
PID:2944 -
\??\c:\04004.exec:\04004.exe52⤵
- Executes dropped EXE
PID:2796 -
\??\c:\m8068.exec:\m8068.exe53⤵
- Executes dropped EXE
PID:2948 -
\??\c:\0426884.exec:\0426884.exe54⤵
- Executes dropped EXE
PID:1704 -
\??\c:\u824660.exec:\u824660.exe55⤵
- Executes dropped EXE
PID:876 -
\??\c:\608084.exec:\608084.exe56⤵
- Executes dropped EXE
PID:780 -
\??\c:\s8622.exec:\s8622.exe57⤵
- Executes dropped EXE
PID:1052 -
\??\c:\s0888.exec:\s0888.exe58⤵
- Executes dropped EXE
PID:868 -
\??\c:\6002646.exec:\6002646.exe59⤵
- Executes dropped EXE
PID:2704 -
\??\c:\8262446.exec:\8262446.exe60⤵
- Executes dropped EXE
PID:2328 -
\??\c:\042288.exec:\042288.exe61⤵
- Executes dropped EXE
PID:2548 -
\??\c:\484066.exec:\484066.exe62⤵
- Executes dropped EXE
PID:1084 -
\??\c:\42844.exec:\42844.exe63⤵
- Executes dropped EXE
PID:1320 -
\??\c:\s2006.exec:\s2006.exe64⤵
- Executes dropped EXE
PID:1668 -
\??\c:\0468006.exec:\0468006.exe65⤵
- Executes dropped EXE
PID:1788 -
\??\c:\u646284.exec:\u646284.exe66⤵PID:1728
-
\??\c:\042466.exec:\042466.exe67⤵PID:1340
-
\??\c:\q82806.exec:\q82806.exe68⤵PID:880
-
\??\c:\a8628.exec:\a8628.exe69⤵PID:1484
-
\??\c:\64084.exec:\64084.exe70⤵PID:2536
-
\??\c:\8684228.exec:\8684228.exe71⤵PID:2312
-
\??\c:\8284446.exec:\8284446.exe72⤵PID:1776
-
\??\c:\684840.exec:\684840.exe73⤵PID:1600
-
\??\c:\e26688.exec:\e26688.exe74⤵PID:2240
-
\??\c:\64206.exec:\64206.exe75⤵PID:2444
-
\??\c:\26402.exec:\26402.exe76⤵PID:2220
-
\??\c:\02840.exec:\02840.exe77⤵PID:2196
-
\??\c:\i082262.exec:\i082262.exe78⤵PID:2204
-
\??\c:\6800484.exec:\6800484.exe79⤵PID:2928
-
\??\c:\046800.exec:\046800.exe80⤵PID:2816
-
\??\c:\046640.exec:\046640.exe81⤵PID:2964
-
\??\c:\82462.exec:\82462.exe82⤵PID:2776
-
\??\c:\08662.exec:\08662.exe83⤵PID:2628
-
\??\c:\4288446.exec:\4288446.exe84⤵PID:2612
-
\??\c:\6466228.exec:\6466228.exe85⤵PID:2156
-
\??\c:\806688.exec:\806688.exe86⤵PID:1780
-
\??\c:\824840.exec:\824840.exe87⤵PID:2708
-
\??\c:\w48846.exec:\w48846.exe88⤵PID:276
-
\??\c:\86402.exec:\86402.exe89⤵PID:2516
-
\??\c:\20284.exec:\20284.exe90⤵PID:1724
-
\??\c:\2220060.exec:\2220060.exe91⤵PID:2892
-
\??\c:\4866284.exec:\4866284.exe92⤵PID:2040
-
\??\c:\0868248.exec:\0868248.exe93⤵PID:1904
-
\??\c:\808886.exec:\808886.exe94⤵PID:2388
-
\??\c:\402404.exec:\402404.exe95⤵PID:3040
-
\??\c:\64224.exec:\64224.exe96⤵PID:2144
-
\??\c:\26840.exec:\26840.exe97⤵PID:1720
-
\??\c:\m8662.exec:\m8662.exe98⤵PID:112
-
\??\c:\2004484.exec:\2004484.exe99⤵PID:1620
-
\??\c:\4828480.exec:\4828480.exe100⤵PID:3032
-
\??\c:\868028.exec:\868028.exe101⤵PID:3056
-
\??\c:\226886.exec:\226886.exe102⤵PID:2696
-
\??\c:\08400.exec:\08400.exe103⤵PID:2080
-
\??\c:\4004204.exec:\4004204.exe104⤵PID:1668
-
\??\c:\8622046.exec:\8622046.exe105⤵PID:2308
-
\??\c:\8028228.exec:\8028228.exe106⤵PID:1240
-
\??\c:\488426.exec:\488426.exe107⤵PID:1928
-
\??\c:\k84460.exec:\k84460.exe108⤵PID:2212
-
\??\c:\a8284.exec:\a8284.exe109⤵PID:2552
-
\??\c:\4200040.exec:\4200040.exe110⤵PID:2536
-
\??\c:\4282846.exec:\4282846.exe111⤵PID:2392
-
\??\c:\0428406.exec:\0428406.exe112⤵PID:3000
-
\??\c:\206844.exec:\206844.exe113⤵PID:1920
-
\??\c:\080062.exec:\080062.exe114⤵PID:2428
-
\??\c:\64246.exec:\64246.exe115⤵PID:588
-
\??\c:\s2062.exec:\s2062.exe116⤵PID:2836
-
\??\c:\0860284.exec:\0860284.exe117⤵PID:2768
-
\??\c:\864026.exec:\864026.exe118⤵PID:2820
-
\??\c:\k42428.exec:\k42428.exe119⤵PID:2728
-
\??\c:\m4880.exec:\m4880.exe120⤵PID:2980
-
\??\c:\a6884.exec:\a6884.exe121⤵PID:2656
-
\??\c:\o844446.exec:\o844446.exe122⤵PID:2640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-