Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
02/09/2024, 06:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6ea8b37bcc1773f9f6a997e74e8f59c0N.exe
Resource
win7-20240704-en
5 signatures
120 seconds
General
-
Target
6ea8b37bcc1773f9f6a997e74e8f59c0N.exe
-
Size
49KB
-
MD5
6ea8b37bcc1773f9f6a997e74e8f59c0
-
SHA1
3e55fd32f6d35ae46d39d89f3d3d744ac6cc7af1
-
SHA256
6883d281ef6305f9355e5abfd25100c446b7048656066eb14608db4f5cdf9efa
-
SHA512
1f6334da18553eeb4b2afce045cb42d92d67cbbf7b476aed3b3f36617edb7adc4459fa05fec981c45d438dbce3c80edf0d91d5e2fad7999b9b17425732ec3951
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvq:0cdpeeBSHHMHLf9RyIh
Malware Config
Signatures
-
Detect Blackmoon payload 56 IoCs
resource yara_rule behavioral1/memory/2752-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2160-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2292-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1712-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2012-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1560-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2012-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1992-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/448-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1592-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1752-232-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/3056-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-309-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1556-317-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1916-316-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-328-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2980-357-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-389-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-396-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/824-452-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1852-460-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-468-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1036-469-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2288-482-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1704-488-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/1744-533-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1744-532-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-639-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/824-719-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/956-750-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/268-793-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/2896-828-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2400-841-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2932-848-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2620-867-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1264-916-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2880-943-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/552-988-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/552-986-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/3020-995-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1032-1069-0x0000000000430000-0x0000000000459000-memory.dmp family_blackmoon behavioral1/memory/1920-1359-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2628-1373-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2768-1392-0x00000000003B0000-0x00000000003D9000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2752 lfrfflf.exe 2756 ttthbb.exe 2432 ppjvd.exe 2908 3vpvd.exe 2664 6640224.exe 2680 3dddp.exe 2160 m0468.exe 2892 tbttbb.exe 2992 5nttbn.exe 2484 tnhhbn.exe 2192 rlxlffl.exe 2292 7dvdj.exe 1712 pvdjp.exe 2672 rrrfrfx.exe 1560 224400.exe 2012 lrxrrlr.exe 2200 42008.exe 3036 04846.exe 2268 q28404.exe 1992 a6062.exe 1592 hbnttn.exe 448 1hnbbh.exe 2232 c826884.exe 1360 u644624.exe 1752 08024.exe 804 hnhhth.exe 3056 268804.exe 852 202448.exe 3048 48062.exe 2228 5lrlrfl.exe 2460 2628066.exe 2752 42440.exe 2760 6008868.exe 2928 608024.exe 1916 pjppj.exe 1556 a8008.exe 2580 82440.exe 2624 w80028.exe 1940 nhtbhh.exe 2608 60806.exe 2324 046200.exe 2980 hbhhnn.exe 2124 664084.exe 2848 8688040.exe 2484 480624.exe 2592 vjpjp.exe 2192 82666.exe 1708 8684662.exe 1364 8284484.exe 632 264626.exe 1700 xxffffl.exe 768 26826.exe 320 2088040.exe 112 262228.exe 2200 42826.exe 824 m2002.exe 1852 6088440.exe 2788 7lxlxxl.exe 1036 0800266.exe 2288 htnnnh.exe 1704 hhhbbb.exe 1864 1ntnhh.exe 832 dvjjj.exe 1752 nbhbbb.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 484024.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u802462.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 08440.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrflxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 264404.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0080802.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language m4660.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06002.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 428404.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a8400.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44806.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrfxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2708 wrote to memory of 2752 2708 6ea8b37bcc1773f9f6a997e74e8f59c0N.exe 31 PID 2708 wrote to memory of 2752 2708 6ea8b37bcc1773f9f6a997e74e8f59c0N.exe 31 PID 2708 wrote to memory of 2752 2708 6ea8b37bcc1773f9f6a997e74e8f59c0N.exe 31 PID 2708 wrote to memory of 2752 2708 6ea8b37bcc1773f9f6a997e74e8f59c0N.exe 31 PID 2752 wrote to memory of 2756 2752 lfrfflf.exe 32 PID 2752 wrote to memory of 2756 2752 lfrfflf.exe 32 PID 2752 wrote to memory of 2756 2752 lfrfflf.exe 32 PID 2752 wrote to memory of 2756 2752 lfrfflf.exe 32 PID 2756 wrote to memory of 2432 2756 ttthbb.exe 33 PID 2756 wrote to memory of 2432 2756 ttthbb.exe 33 PID 2756 wrote to memory of 2432 2756 ttthbb.exe 33 PID 2756 wrote to memory of 2432 2756 ttthbb.exe 33 PID 2432 wrote to memory of 2908 2432 ppjvd.exe 34 PID 2432 wrote to memory of 2908 2432 ppjvd.exe 34 PID 2432 wrote to memory of 2908 2432 ppjvd.exe 34 PID 2432 wrote to memory of 2908 2432 ppjvd.exe 34 PID 2908 wrote to memory of 2664 2908 3vpvd.exe 35 PID 2908 wrote to memory of 2664 2908 3vpvd.exe 35 PID 2908 wrote to memory of 2664 2908 3vpvd.exe 35 PID 2908 wrote to memory of 2664 2908 3vpvd.exe 35 PID 2664 wrote to memory of 2680 2664 6640224.exe 36 PID 2664 wrote to memory of 2680 2664 6640224.exe 36 PID 2664 wrote to memory of 2680 2664 6640224.exe 36 PID 2664 wrote to memory of 2680 2664 6640224.exe 36 PID 2680 wrote to memory of 2160 2680 3dddp.exe 37 PID 2680 wrote to memory of 2160 2680 3dddp.exe 37 PID 2680 wrote to memory of 2160 2680 3dddp.exe 37 PID 2680 wrote to memory of 2160 2680 3dddp.exe 37 PID 2160 wrote to memory of 2892 2160 m0468.exe 38 PID 2160 wrote to memory of 2892 2160 m0468.exe 38 PID 2160 wrote to memory of 2892 2160 m0468.exe 38 PID 2160 wrote to memory of 2892 2160 m0468.exe 38 PID 2892 wrote to memory of 2992 2892 tbttbb.exe 39 PID 2892 wrote to memory of 2992 2892 tbttbb.exe 39 PID 2892 wrote to memory of 2992 2892 tbttbb.exe 39 PID 2892 wrote to memory of 2992 2892 tbttbb.exe 39 PID 2992 wrote to memory of 2484 2992 5nttbn.exe 40 PID 2992 wrote to memory of 2484 2992 5nttbn.exe 40 PID 2992 wrote to memory of 2484 2992 5nttbn.exe 40 PID 2992 wrote to memory of 2484 2992 5nttbn.exe 40 PID 2484 wrote to memory of 2192 2484 tnhhbn.exe 41 PID 2484 wrote to memory of 2192 2484 tnhhbn.exe 41 PID 2484 wrote to memory of 2192 2484 tnhhbn.exe 41 PID 2484 wrote to memory of 2192 2484 tnhhbn.exe 41 PID 2192 wrote to memory of 2292 2192 rlxlffl.exe 42 PID 2192 wrote to memory of 2292 2192 rlxlffl.exe 42 PID 2192 wrote to memory of 2292 2192 rlxlffl.exe 42 PID 2192 wrote to memory of 2292 2192 rlxlffl.exe 42 PID 2292 wrote to memory of 1712 2292 7dvdj.exe 43 PID 2292 wrote to memory of 1712 2292 7dvdj.exe 43 PID 2292 wrote to memory of 1712 2292 7dvdj.exe 43 PID 2292 wrote to memory of 1712 2292 7dvdj.exe 43 PID 1712 wrote to memory of 2672 1712 pvdjp.exe 44 PID 1712 wrote to memory of 2672 1712 pvdjp.exe 44 PID 1712 wrote to memory of 2672 1712 pvdjp.exe 44 PID 1712 wrote to memory of 2672 1712 pvdjp.exe 44 PID 2672 wrote to memory of 1560 2672 rrrfrfx.exe 45 PID 2672 wrote to memory of 1560 2672 rrrfrfx.exe 45 PID 2672 wrote to memory of 1560 2672 rrrfrfx.exe 45 PID 2672 wrote to memory of 1560 2672 rrrfrfx.exe 45 PID 1560 wrote to memory of 2012 1560 224400.exe 46 PID 1560 wrote to memory of 2012 1560 224400.exe 46 PID 1560 wrote to memory of 2012 1560 224400.exe 46 PID 1560 wrote to memory of 2012 1560 224400.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ea8b37bcc1773f9f6a997e74e8f59c0N.exe"C:\Users\Admin\AppData\Local\Temp\6ea8b37bcc1773f9f6a997e74e8f59c0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\lfrfflf.exec:\lfrfflf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\ttthbb.exec:\ttthbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\ppjvd.exec:\ppjvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\3vpvd.exec:\3vpvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\6640224.exec:\6640224.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\3dddp.exec:\3dddp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\m0468.exec:\m0468.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\tbttbb.exec:\tbttbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\5nttbn.exec:\5nttbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\tnhhbn.exec:\tnhhbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\rlxlffl.exec:\rlxlffl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\7dvdj.exec:\7dvdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\pvdjp.exec:\pvdjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\rrrfrfx.exec:\rrrfrfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\224400.exec:\224400.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\lrxrrlr.exec:\lrxrrlr.exe17⤵
- Executes dropped EXE
PID:2012 -
\??\c:\42008.exec:\42008.exe18⤵
- Executes dropped EXE
PID:2200 -
\??\c:\04846.exec:\04846.exe19⤵
- Executes dropped EXE
PID:3036 -
\??\c:\q28404.exec:\q28404.exe20⤵
- Executes dropped EXE
PID:2268 -
\??\c:\a6062.exec:\a6062.exe21⤵
- Executes dropped EXE
PID:1992 -
\??\c:\hbnttn.exec:\hbnttn.exe22⤵
- Executes dropped EXE
PID:1592 -
\??\c:\1hnbbh.exec:\1hnbbh.exe23⤵
- Executes dropped EXE
PID:448 -
\??\c:\c826884.exec:\c826884.exe24⤵
- Executes dropped EXE
PID:2232 -
\??\c:\u644624.exec:\u644624.exe25⤵
- Executes dropped EXE
PID:1360 -
\??\c:\08024.exec:\08024.exe26⤵
- Executes dropped EXE
PID:1752 -
\??\c:\hnhhth.exec:\hnhhth.exe27⤵
- Executes dropped EXE
PID:804 -
\??\c:\268804.exec:\268804.exe28⤵
- Executes dropped EXE
PID:3056 -
\??\c:\202448.exec:\202448.exe29⤵
- Executes dropped EXE
PID:852 -
\??\c:\48062.exec:\48062.exe30⤵
- Executes dropped EXE
PID:3048 -
\??\c:\5lrlrfl.exec:\5lrlrfl.exe31⤵
- Executes dropped EXE
PID:2228 -
\??\c:\2628066.exec:\2628066.exe32⤵
- Executes dropped EXE
PID:2460 -
\??\c:\42440.exec:\42440.exe33⤵
- Executes dropped EXE
PID:2752 -
\??\c:\6008868.exec:\6008868.exe34⤵
- Executes dropped EXE
PID:2760 -
\??\c:\608024.exec:\608024.exe35⤵
- Executes dropped EXE
PID:2928 -
\??\c:\pjppj.exec:\pjppj.exe36⤵
- Executes dropped EXE
PID:1916 -
\??\c:\a8008.exec:\a8008.exe37⤵
- Executes dropped EXE
PID:1556 -
\??\c:\82440.exec:\82440.exe38⤵
- Executes dropped EXE
PID:2580 -
\??\c:\w80028.exec:\w80028.exe39⤵
- Executes dropped EXE
PID:2624 -
\??\c:\nhtbhh.exec:\nhtbhh.exe40⤵
- Executes dropped EXE
PID:1940 -
\??\c:\60806.exec:\60806.exe41⤵
- Executes dropped EXE
PID:2608 -
\??\c:\046200.exec:\046200.exe42⤵
- Executes dropped EXE
PID:2324 -
\??\c:\hbhhnn.exec:\hbhhnn.exe43⤵
- Executes dropped EXE
PID:2980 -
\??\c:\664084.exec:\664084.exe44⤵
- Executes dropped EXE
PID:2124 -
\??\c:\8688040.exec:\8688040.exe45⤵
- Executes dropped EXE
PID:2848 -
\??\c:\480624.exec:\480624.exe46⤵
- Executes dropped EXE
PID:2484 -
\??\c:\vjpjp.exec:\vjpjp.exe47⤵
- Executes dropped EXE
PID:2592 -
\??\c:\82666.exec:\82666.exe48⤵
- Executes dropped EXE
PID:2192 -
\??\c:\8684662.exec:\8684662.exe49⤵
- Executes dropped EXE
PID:1708 -
\??\c:\8284484.exec:\8284484.exe50⤵
- Executes dropped EXE
PID:1364 -
\??\c:\264626.exec:\264626.exe51⤵
- Executes dropped EXE
PID:632 -
\??\c:\xxffffl.exec:\xxffffl.exe52⤵
- Executes dropped EXE
PID:1700 -
\??\c:\26826.exec:\26826.exe53⤵
- Executes dropped EXE
PID:768 -
\??\c:\2088040.exec:\2088040.exe54⤵
- Executes dropped EXE
PID:320 -
\??\c:\262228.exec:\262228.exe55⤵
- Executes dropped EXE
PID:112 -
\??\c:\42826.exec:\42826.exe56⤵
- Executes dropped EXE
PID:2200 -
\??\c:\m2002.exec:\m2002.exe57⤵
- Executes dropped EXE
PID:824 -
\??\c:\6088440.exec:\6088440.exe58⤵
- Executes dropped EXE
PID:1852 -
\??\c:\7lxlxxl.exec:\7lxlxxl.exe59⤵
- Executes dropped EXE
PID:2788 -
\??\c:\0800266.exec:\0800266.exe60⤵
- Executes dropped EXE
PID:1036 -
\??\c:\htnnnh.exec:\htnnnh.exe61⤵
- Executes dropped EXE
PID:2288 -
\??\c:\hhhbbb.exec:\hhhbbb.exe62⤵
- Executes dropped EXE
PID:1704 -
\??\c:\1ntnhh.exec:\1ntnhh.exe63⤵
- Executes dropped EXE
PID:1864 -
\??\c:\dvjjj.exec:\dvjjj.exe64⤵
- Executes dropped EXE
PID:832 -
\??\c:\nbhbbb.exec:\nbhbbb.exe65⤵
- Executes dropped EXE
PID:1752 -
\??\c:\4848400.exec:\4848400.exe66⤵PID:1636
-
\??\c:\o862888.exec:\o862888.exe67⤵PID:2004
-
\??\c:\jpddj.exec:\jpddj.exe68⤵PID:1308
-
\??\c:\dppdv.exec:\dppdv.exe69⤵PID:1744
-
\??\c:\9vjjj.exec:\9vjjj.exe70⤵PID:984
-
\??\c:\vjpvp.exec:\vjpvp.exe71⤵PID:1828
-
\??\c:\bbhbnn.exec:\bbhbnn.exe72⤵PID:2748
-
\??\c:\m4660.exec:\m4660.exe73⤵
- System Location Discovery: System Language Discovery
PID:2896 -
\??\c:\0620024.exec:\0620024.exe74⤵PID:1920
-
\??\c:\4648866.exec:\4648866.exe75⤵PID:2400
-
\??\c:\4844440.exec:\4844440.exe76⤵PID:2812
-
\??\c:\rrrxxxf.exec:\rrrxxxf.exe77⤵PID:2768
-
\??\c:\86822.exec:\86822.exe78⤵PID:2632
-
\??\c:\868444.exec:\868444.exe79⤵PID:2436
-
\??\c:\46262.exec:\46262.exe80⤵PID:2620
-
\??\c:\e86660.exec:\e86660.exe81⤵PID:2224
-
\??\c:\jvvvj.exec:\jvvvj.exe82⤵PID:2252
-
\??\c:\2640888.exec:\2640888.exe83⤵PID:2036
-
\??\c:\5ntttt.exec:\5ntttt.exe84⤵PID:2964
-
\??\c:\u206262.exec:\u206262.exe85⤵PID:2980
-
\??\c:\xxfxllr.exec:\xxfxllr.exe86⤵PID:1928
-
\??\c:\xlxlrlr.exec:\xlxlrlr.exe87⤵PID:3068
-
\??\c:\84468.exec:\84468.exe88⤵PID:1612
-
\??\c:\a4844.exec:\a4844.exe89⤵PID:2496
-
\??\c:\k68828.exec:\k68828.exe90⤵PID:2292
-
\??\c:\60006.exec:\60006.exe91⤵PID:1412
-
\??\c:\1nhbhb.exec:\1nhbhb.exe92⤵PID:1712
-
\??\c:\660282.exec:\660282.exe93⤵PID:2864
-
\??\c:\vpddj.exec:\vpddj.exe94⤵PID:1980
-
\??\c:\k64622.exec:\k64622.exe95⤵PID:768
-
\??\c:\bthbhn.exec:\bthbhn.exe96⤵PID:668
-
\??\c:\8628444.exec:\8628444.exe97⤵PID:2212
-
\??\c:\ppvdj.exec:\ppvdj.exe98⤵PID:3028
-
\??\c:\lffllfl.exec:\lffllfl.exe99⤵PID:824
-
\??\c:\6406200.exec:\6406200.exe100⤵PID:2316
-
\??\c:\w48244.exec:\w48244.exe101⤵PID:2520
-
\??\c:\a6448.exec:\a6448.exe102⤵PID:1232
-
\??\c:\8040808.exec:\8040808.exe103⤵PID:1960
-
\??\c:\jdvpd.exec:\jdvpd.exe104⤵PID:2376
-
\??\c:\nhtbhh.exec:\nhtbhh.exe105⤵PID:956
-
\??\c:\1vdpj.exec:\1vdpj.exe106⤵PID:1664
-
\??\c:\42800.exec:\42800.exe107⤵PID:2732
-
\??\c:\6060268.exec:\6060268.exe108⤵PID:1544
-
\??\c:\6462266.exec:\6462266.exe109⤵PID:804
-
\??\c:\268422.exec:\268422.exe110⤵PID:2688
-
\??\c:\a0624.exec:\a0624.exe111⤵PID:268
-
\??\c:\048282.exec:\048282.exe112⤵PID:992
-
\??\c:\26422.exec:\26422.exe113⤵PID:1780
-
\??\c:\btnnbn.exec:\btnnbn.exe114⤵PID:2072
-
\??\c:\nntbtt.exec:\nntbtt.exe115⤵PID:1680
-
\??\c:\k84822.exec:\k84822.exe116⤵PID:2896
-
\??\c:\7vddv.exec:\7vddv.exe117⤵PID:2720
-
\??\c:\ddjpv.exec:\ddjpv.exe118⤵PID:2400
-
\??\c:\i242228.exec:\i242228.exe119⤵PID:2932
-
\??\c:\e68644.exec:\e68644.exe120⤵PID:2768
-
\??\c:\48606.exec:\48606.exe121⤵PID:2776
-
\??\c:\q68888.exec:\q68888.exe122⤵PID:2580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-