Analysis
-
max time kernel
120s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2024 09:00
Behavioral task
behavioral1
Sample
b1e79a7f79514e48516a1d619d74a010N.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
120 seconds
General
-
Target
b1e79a7f79514e48516a1d619d74a010N.exe
-
Size
272KB
-
MD5
b1e79a7f79514e48516a1d619d74a010
-
SHA1
cdbdcf4d32a309665d298e63137b50063d9f9dd4
-
SHA256
a8e2340c42091c8190e126fc0bd8bde2715bac7000eecb77b3a8a6866f842746
-
SHA512
a4cf18ce6a4fc695db9009612b9aa7ce786c47b463ffd05a1caf6402c410fc55a05d027c6db1ea3a1fdf0b5fb19b9fdb5aaa95d52e2efc4fcb5b4c316b88f83d
-
SSDEEP
3072:LhOmTsF93UYfwC6GIoutVwT0JOfZKldUIbvpynrSPBPOY4W5oo:Lcm4FmowdHoSVwT+aZKlumArSPBPJH
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3844-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3236-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3424-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/856-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3420-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4872-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3316-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3428-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3688-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2864-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/404-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4184-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2540-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2504-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1608-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1844-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3036-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1596-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1756-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1864-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/436-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4716-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1488-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3604-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1560-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3752-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4020-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1984-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4732-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4604-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4736-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5116-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2304-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2664-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/732-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1444-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/416-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3544-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1364-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1680-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4664-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1480-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4492-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4032-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/992-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2912-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4308-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2284-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3436-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2300-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4312-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2240-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4748-369-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2780-406-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/856-428-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1044-443-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/564-466-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4688-471-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4392-526-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1648-531-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4280-593-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3904-661-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1492-683-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/972-763-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
thnhbt.exedpdvd.exerlxfflf.exellrllff.exedpvpp.exexrllrxx.exehhhbtt.exexxrlllr.exethbbbb.exejdvpp.exetthhhh.exexlffllx.exepjpjj.exetnbttt.exejddvj.exexffxxfl.exe5pvpp.exexxxrrrl.exepppdd.exeppddv.exeffxxrrr.exehtbbbb.exe5rxrrxr.exe9thhnn.exepjpjd.exe3rrrrxx.exe1jpjj.exe7xxrrrr.exehnnhhb.exelxrrlff.exebttnbb.exe1vdvj.exe3htbbb.exedvddd.exelxrlxfr.exexrfllll.exedpjjj.exevjvpv.exe9xxrrll.exe7bbtnn.exejpvjd.exelxlfxll.exellfflrl.exehbbhhb.exevvjpp.exepddjj.exerlrflrl.exethnhbb.exevjvdp.exejvdvv.exeflrlrrl.exebtnnhh.exe7tbttb.exejvjdv.exelfrlfxx.exe1ntnhh.exeppdjv.exe5pvjv.exelflxlff.exehbbtnh.exehhtthh.exevpvvd.exerrfxfxr.exeflfxrrl.exepid process 3236 thnhbt.exe 3424 dpdvd.exe 856 rlxfflf.exe 3792 llrllff.exe 2444 dpvpp.exe 3420 xrllrxx.exe 2504 hhhbtt.exe 4872 xxrlllr.exe 3316 thbbbb.exe 3428 jdvpp.exe 3688 tthhhh.exe 2864 xlffllx.exe 1672 pjpjj.exe 404 tnbttt.exe 4184 jddvj.exe 2540 xffxxfl.exe 1608 5pvpp.exe 1844 xxxrrrl.exe 3036 pppdd.exe 1756 ppddv.exe 1596 ffxxrrr.exe 380 htbbbb.exe 1588 5rxrrxr.exe 1864 9thhnn.exe 2220 pjpjd.exe 4716 3rrrrxx.exe 3344 1jpjj.exe 436 7xxrrrr.exe 1488 hnnhhb.exe 3604 lxrrlff.exe 1560 bttnbb.exe 3752 1vdvj.exe 2196 3htbbb.exe 1852 dvddd.exe 4020 lxrlxfr.exe 2824 xrfllll.exe 1984 dpjjj.exe 3040 vjvpv.exe 4732 9xxrrll.exe 1080 7bbtnn.exe 3580 jpvjd.exe 2284 lxlfxll.exe 4604 llfflrl.exe 4372 hbbhhb.exe 4736 vvjpp.exe 4028 pddjj.exe 1860 rlrflrl.exe 5116 thnhbb.exe 2304 vjvdp.exe 2664 jvdvv.exe 4752 flrlrrl.exe 3380 btnnhh.exe 228 7tbttb.exe 732 jvjdv.exe 1444 lfrlfxx.exe 2980 1ntnhh.exe 1508 ppdjv.exe 2320 5pvjv.exe 2864 lflxlff.exe 2856 hbbtnh.exe 1672 hhtthh.exe 404 vpvvd.exe 4900 rrfxfxr.exe 416 flfxrrl.exe -
Processes:
resource yara_rule behavioral2/memory/3844-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3844-5-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dpdvd.exe upx behavioral2/memory/3236-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3424-12-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thnhbt.exe upx C:\rlxfflf.exe upx behavioral2/memory/856-16-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\llrllff.exe upx behavioral2/memory/3792-21-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dpvpp.exe upx C:\xrllrxx.exe upx behavioral2/memory/3420-31-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhhbtt.exe upx behavioral2/memory/2504-35-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxrlllr.exe upx C:\thbbbb.exe upx behavioral2/memory/4872-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3316-45-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jdvpp.exe upx C:\tthhhh.exe upx behavioral2/memory/3428-53-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlffllx.exe upx behavioral2/memory/3688-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2864-62-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjpjj.exe upx C:\tnbttt.exe upx behavioral2/memory/404-70-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jddvj.exe upx C:\xffxxfl.exe upx behavioral2/memory/4184-78-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5pvpp.exe upx behavioral2/memory/2540-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2504-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1608-87-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxxrrrl.exe upx C:\pppdd.exe upx behavioral2/memory/1844-92-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppddv.exe upx behavioral2/memory/3036-98-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ffxxrrr.exe upx behavioral2/memory/1596-106-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\htbbbb.exe upx C:\5rxrrxr.exe upx behavioral2/memory/1756-103-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9thhnn.exe upx \??\c:\pjpjd.exe upx C:\3rrrrxx.exe upx behavioral2/memory/1864-119-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\1jpjj.exe upx C:\7xxrrrr.exe upx behavioral2/memory/436-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4716-135-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hnnhhb.exe upx behavioral2/memory/1488-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3604-146-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lxrrlff.exe upx C:\bttnbb.exe upx C:\1vdvj.exe upx behavioral2/memory/1560-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3752-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4020-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1984-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4732-175-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
fxlrxxx.exenthbhb.exejpdvv.exejpjdv.exehbbtnn.exedvdvp.exehhbbbb.exejjppp.exevvjdj.exevvpvp.exejjjvp.exebttnbb.exevpvvv.exexrlxlrl.exefffxxfx.exebhbtnb.exerllrllf.exe1djdd.exexxrllll.exerlrffff.exettbhnb.exefrxrllf.exe3vdvd.exeththht.exexllfffx.exexffxxfl.exevvvpj.exepdvdd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1djdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ththht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvdd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b1e79a7f79514e48516a1d619d74a010N.exethnhbt.exedpdvd.exerlxfflf.exellrllff.exedpvpp.exexrllrxx.exehhhbtt.exexxrlllr.exethbbbb.exejdvpp.exetthhhh.exexlffllx.exepjpjj.exetnbttt.exejddvj.exexffxxfl.exe5pvpp.exexxxrrrl.exepppdd.exeppddv.exeffxxrrr.exedescription pid process target process PID 3844 wrote to memory of 3236 3844 b1e79a7f79514e48516a1d619d74a010N.exe thnhbt.exe PID 3844 wrote to memory of 3236 3844 b1e79a7f79514e48516a1d619d74a010N.exe thnhbt.exe PID 3844 wrote to memory of 3236 3844 b1e79a7f79514e48516a1d619d74a010N.exe thnhbt.exe PID 3236 wrote to memory of 3424 3236 thnhbt.exe dpdvd.exe PID 3236 wrote to memory of 3424 3236 thnhbt.exe dpdvd.exe PID 3236 wrote to memory of 3424 3236 thnhbt.exe dpdvd.exe PID 3424 wrote to memory of 856 3424 dpdvd.exe rlxfflf.exe PID 3424 wrote to memory of 856 3424 dpdvd.exe rlxfflf.exe PID 3424 wrote to memory of 856 3424 dpdvd.exe rlxfflf.exe PID 856 wrote to memory of 3792 856 rlxfflf.exe llrllff.exe PID 856 wrote to memory of 3792 856 rlxfflf.exe llrllff.exe PID 856 wrote to memory of 3792 856 rlxfflf.exe llrllff.exe PID 3792 wrote to memory of 2444 3792 llrllff.exe dpvpp.exe PID 3792 wrote to memory of 2444 3792 llrllff.exe dpvpp.exe PID 3792 wrote to memory of 2444 3792 llrllff.exe dpvpp.exe PID 2444 wrote to memory of 3420 2444 dpvpp.exe xrllrxx.exe PID 2444 wrote to memory of 3420 2444 dpvpp.exe xrllrxx.exe PID 2444 wrote to memory of 3420 2444 dpvpp.exe xrllrxx.exe PID 3420 wrote to memory of 2504 3420 xrllrxx.exe hhhbtt.exe PID 3420 wrote to memory of 2504 3420 xrllrxx.exe hhhbtt.exe PID 3420 wrote to memory of 2504 3420 xrllrxx.exe hhhbtt.exe PID 2504 wrote to memory of 4872 2504 hhhbtt.exe xxrlllr.exe PID 2504 wrote to memory of 4872 2504 hhhbtt.exe xxrlllr.exe PID 2504 wrote to memory of 4872 2504 hhhbtt.exe xxrlllr.exe PID 4872 wrote to memory of 3316 4872 xxrlllr.exe thbbbb.exe PID 4872 wrote to memory of 3316 4872 xxrlllr.exe thbbbb.exe PID 4872 wrote to memory of 3316 4872 xxrlllr.exe thbbbb.exe PID 3316 wrote to memory of 3428 3316 thbbbb.exe jdvpp.exe PID 3316 wrote to memory of 3428 3316 thbbbb.exe jdvpp.exe PID 3316 wrote to memory of 3428 3316 thbbbb.exe jdvpp.exe PID 3428 wrote to memory of 3688 3428 jdvpp.exe tthhhh.exe PID 3428 wrote to memory of 3688 3428 jdvpp.exe tthhhh.exe PID 3428 wrote to memory of 3688 3428 jdvpp.exe tthhhh.exe PID 3688 wrote to memory of 2864 3688 tthhhh.exe xlffllx.exe PID 3688 wrote to memory of 2864 3688 tthhhh.exe xlffllx.exe PID 3688 wrote to memory of 2864 3688 tthhhh.exe xlffllx.exe PID 2864 wrote to memory of 1672 2864 xlffllx.exe pjpjj.exe PID 2864 wrote to memory of 1672 2864 xlffllx.exe pjpjj.exe PID 2864 wrote to memory of 1672 2864 xlffllx.exe pjpjj.exe PID 1672 wrote to memory of 404 1672 pjpjj.exe tnbttt.exe PID 1672 wrote to memory of 404 1672 pjpjj.exe tnbttt.exe PID 1672 wrote to memory of 404 1672 pjpjj.exe tnbttt.exe PID 404 wrote to memory of 4184 404 tnbttt.exe jddvj.exe PID 404 wrote to memory of 4184 404 tnbttt.exe jddvj.exe PID 404 wrote to memory of 4184 404 tnbttt.exe jddvj.exe PID 4184 wrote to memory of 2540 4184 jddvj.exe xffxxfl.exe PID 4184 wrote to memory of 2540 4184 jddvj.exe xffxxfl.exe PID 4184 wrote to memory of 2540 4184 jddvj.exe xffxxfl.exe PID 2540 wrote to memory of 1608 2540 xffxxfl.exe 5pvpp.exe PID 2540 wrote to memory of 1608 2540 xffxxfl.exe 5pvpp.exe PID 2540 wrote to memory of 1608 2540 xffxxfl.exe 5pvpp.exe PID 1608 wrote to memory of 1844 1608 5pvpp.exe xxxrrrl.exe PID 1608 wrote to memory of 1844 1608 5pvpp.exe xxxrrrl.exe PID 1608 wrote to memory of 1844 1608 5pvpp.exe xxxrrrl.exe PID 1844 wrote to memory of 3036 1844 xxxrrrl.exe pppdd.exe PID 1844 wrote to memory of 3036 1844 xxxrrrl.exe pppdd.exe PID 1844 wrote to memory of 3036 1844 xxxrrrl.exe pppdd.exe PID 3036 wrote to memory of 1756 3036 pppdd.exe ppddv.exe PID 3036 wrote to memory of 1756 3036 pppdd.exe ppddv.exe PID 3036 wrote to memory of 1756 3036 pppdd.exe ppddv.exe PID 1756 wrote to memory of 1596 1756 ppddv.exe ffxxrrr.exe PID 1756 wrote to memory of 1596 1756 ppddv.exe ffxxrrr.exe PID 1756 wrote to memory of 1596 1756 ppddv.exe ffxxrrr.exe PID 1596 wrote to memory of 380 1596 ffxxrrr.exe htbbbb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1e79a7f79514e48516a1d619d74a010N.exe"C:\Users\Admin\AppData\Local\Temp\b1e79a7f79514e48516a1d619d74a010N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\thnhbt.exec:\thnhbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\dpdvd.exec:\dpdvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\rlxfflf.exec:\rlxfflf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\llrllff.exec:\llrllff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
\??\c:\dpvpp.exec:\dpvpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\xrllrxx.exec:\xrllrxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
\??\c:\hhhbtt.exec:\hhhbtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\xxrlllr.exec:\xxrlllr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\thbbbb.exec:\thbbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\jdvpp.exec:\jdvpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\tthhhh.exec:\tthhhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\xlffllx.exec:\xlffllx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\pjpjj.exec:\pjpjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\tnbttt.exec:\tnbttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\jddvj.exec:\jddvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\xffxxfl.exec:\xffxxfl.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\5pvpp.exec:\5pvpp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\xxxrrrl.exec:\xxxrrrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\pppdd.exec:\pppdd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\ppddv.exec:\ppddv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\ffxxrrr.exec:\ffxxrrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\htbbbb.exec:\htbbbb.exe23⤵
- Executes dropped EXE
PID:380 -
\??\c:\5rxrrxr.exec:\5rxrrxr.exe24⤵
- Executes dropped EXE
PID:1588 -
\??\c:\9thhnn.exec:\9thhnn.exe25⤵
- Executes dropped EXE
PID:1864 -
\??\c:\pjpjd.exec:\pjpjd.exe26⤵
- Executes dropped EXE
PID:2220 -
\??\c:\3rrrrxx.exec:\3rrrrxx.exe27⤵
- Executes dropped EXE
PID:4716 -
\??\c:\1jpjj.exec:\1jpjj.exe28⤵
- Executes dropped EXE
PID:3344 -
\??\c:\7xxrrrr.exec:\7xxrrrr.exe29⤵
- Executes dropped EXE
PID:436 -
\??\c:\hnnhhb.exec:\hnnhhb.exe30⤵
- Executes dropped EXE
PID:1488 -
\??\c:\lxrrlff.exec:\lxrrlff.exe31⤵
- Executes dropped EXE
PID:3604 -
\??\c:\bttnbb.exec:\bttnbb.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1560 -
\??\c:\1vdvj.exec:\1vdvj.exe33⤵
- Executes dropped EXE
PID:3752 -
\??\c:\3htbbb.exec:\3htbbb.exe34⤵
- Executes dropped EXE
PID:2196 -
\??\c:\dvddd.exec:\dvddd.exe35⤵
- Executes dropped EXE
PID:1852 -
\??\c:\lxrlxfr.exec:\lxrlxfr.exe36⤵
- Executes dropped EXE
PID:4020 -
\??\c:\xrfllll.exec:\xrfllll.exe37⤵
- Executes dropped EXE
PID:2824 -
\??\c:\dpjjj.exec:\dpjjj.exe38⤵
- Executes dropped EXE
PID:1984 -
\??\c:\vjvpv.exec:\vjvpv.exe39⤵
- Executes dropped EXE
PID:3040 -
\??\c:\9xxrrll.exec:\9xxrrll.exe40⤵
- Executes dropped EXE
PID:4732 -
\??\c:\7bbtnn.exec:\7bbtnn.exe41⤵
- Executes dropped EXE
PID:1080 -
\??\c:\jpvjd.exec:\jpvjd.exe42⤵
- Executes dropped EXE
PID:3580 -
\??\c:\lxlfxll.exec:\lxlfxll.exe43⤵
- Executes dropped EXE
PID:2284 -
\??\c:\llfflrl.exec:\llfflrl.exe44⤵
- Executes dropped EXE
PID:4604 -
\??\c:\hbbhhb.exec:\hbbhhb.exe45⤵
- Executes dropped EXE
PID:4372 -
\??\c:\vvjpp.exec:\vvjpp.exe46⤵
- Executes dropped EXE
PID:4736 -
\??\c:\pddjj.exec:\pddjj.exe47⤵
- Executes dropped EXE
PID:4028 -
\??\c:\rlrflrl.exec:\rlrflrl.exe48⤵
- Executes dropped EXE
PID:1860 -
\??\c:\thnhbb.exec:\thnhbb.exe49⤵
- Executes dropped EXE
PID:5116 -
\??\c:\vjvdp.exec:\vjvdp.exe50⤵
- Executes dropped EXE
PID:2304 -
\??\c:\jvdvv.exec:\jvdvv.exe51⤵
- Executes dropped EXE
PID:2664 -
\??\c:\flrlrrl.exec:\flrlrrl.exe52⤵
- Executes dropped EXE
PID:4752 -
\??\c:\btnnhh.exec:\btnnhh.exe53⤵
- Executes dropped EXE
PID:3380 -
\??\c:\7tbttb.exec:\7tbttb.exe54⤵
- Executes dropped EXE
PID:228 -
\??\c:\jvjdv.exec:\jvjdv.exe55⤵
- Executes dropped EXE
PID:732 -
\??\c:\lfrlfxx.exec:\lfrlfxx.exe56⤵
- Executes dropped EXE
PID:1444 -
\??\c:\1ntnhh.exec:\1ntnhh.exe57⤵
- Executes dropped EXE
PID:2980 -
\??\c:\ppdjv.exec:\ppdjv.exe58⤵
- Executes dropped EXE
PID:1508 -
\??\c:\5pvjv.exec:\5pvjv.exe59⤵
- Executes dropped EXE
PID:2320 -
\??\c:\lflxlff.exec:\lflxlff.exe60⤵
- Executes dropped EXE
PID:2864 -
\??\c:\hbbtnh.exec:\hbbtnh.exe61⤵
- Executes dropped EXE
PID:2856 -
\??\c:\hhtthh.exec:\hhtthh.exe62⤵
- Executes dropped EXE
PID:1672 -
\??\c:\vpvvd.exec:\vpvvd.exe63⤵
- Executes dropped EXE
PID:404 -
\??\c:\rrfxfxr.exec:\rrfxfxr.exe64⤵
- Executes dropped EXE
PID:4900 -
\??\c:\flfxrrl.exec:\flfxrrl.exe65⤵
- Executes dropped EXE
PID:416 -
\??\c:\nthbtn.exec:\nthbtn.exe66⤵PID:4404
-
\??\c:\jjvpv.exec:\jjvpv.exe67⤵PID:3544
-
\??\c:\xrxllxf.exec:\xrxllxf.exe68⤵PID:564
-
\??\c:\nbbtbb.exec:\nbbtbb.exe69⤵PID:2348
-
\??\c:\9ppjd.exec:\9ppjd.exe70⤵PID:8
-
\??\c:\rllxrfx.exec:\rllxrfx.exe71⤵PID:1364
-
\??\c:\nnnnhh.exec:\nnnnhh.exe72⤵PID:3292
-
\??\c:\nhhbtt.exec:\nhhbtt.exe73⤵PID:3748
-
\??\c:\jjpvd.exec:\jjpvd.exe74⤵PID:2588
-
\??\c:\lxlfffx.exec:\lxlfffx.exe75⤵PID:380
-
\??\c:\xlrlrxr.exec:\xlrlrxr.exe76⤵PID:1680
-
\??\c:\5hhbbb.exec:\5hhbbb.exe77⤵PID:4660
-
\??\c:\dpvpp.exec:\dpvpp.exe78⤵PID:1476
-
\??\c:\lfrlffx.exec:\lfrlffx.exe79⤵PID:4664
-
\??\c:\7xfxffl.exec:\7xfxffl.exe80⤵PID:1480
-
\??\c:\bbtnhh.exec:\bbtnhh.exe81⤵PID:1828
-
\??\c:\vvpjd.exec:\vvpjd.exe82⤵PID:1492
-
\??\c:\9llrlxr.exec:\9llrlxr.exe83⤵PID:4492
-
\??\c:\rffrllr.exec:\rffrllr.exe84⤵PID:1996
-
\??\c:\bthbhb.exec:\bthbhb.exe85⤵PID:4056
-
\??\c:\pjdjp.exec:\pjdjp.exe86⤵PID:4188
-
\??\c:\jdjpj.exec:\jdjpj.exe87⤵PID:2832
-
\??\c:\lflffff.exec:\lflffff.exe88⤵PID:3588
-
\??\c:\rfrrrrl.exec:\rfrrrrl.exe89⤵PID:4700
-
\??\c:\nntnbb.exec:\nntnbb.exe90⤵PID:3364
-
\??\c:\nthbtt.exec:\nthbtt.exe91⤵PID:4032
-
\??\c:\9jddv.exec:\9jddv.exe92⤵PID:4532
-
\??\c:\jjjdd.exec:\jjjdd.exe93⤵PID:4284
-
\??\c:\llfrlfx.exec:\llfrlfx.exe94⤵PID:992
-
\??\c:\9htnnn.exec:\9htnnn.exe95⤵PID:2912
-
\??\c:\vvjdv.exec:\vvjdv.exe96⤵PID:3376
-
\??\c:\vpjdj.exec:\vpjdj.exe97⤵PID:4448
-
\??\c:\9lxllxl.exec:\9lxllxl.exe98⤵PID:552
-
\??\c:\hhnnhh.exec:\hhnnhh.exe99⤵PID:4308
-
\??\c:\htbttt.exec:\htbttt.exe100⤵PID:2284
-
\??\c:\vvdvj.exec:\vvdvj.exe101⤵PID:3744
-
\??\c:\dvpjp.exec:\dvpjp.exe102⤵PID:4372
-
\??\c:\fxlfxfx.exec:\fxlfxfx.exe103⤵PID:4736
-
\??\c:\lxrllll.exec:\lxrllll.exe104⤵PID:3424
-
\??\c:\nhnttt.exec:\nhnttt.exe105⤵PID:3792
-
\??\c:\vjjdv.exec:\vjjdv.exe106⤵PID:3960
-
\??\c:\djppv.exec:\djppv.exe107⤵PID:3872
-
\??\c:\lxxxrrr.exec:\lxxxrrr.exe108⤵PID:3436
-
\??\c:\lrrrrrx.exec:\lrrrrrx.exe109⤵PID:2300
-
\??\c:\hbhbbb.exec:\hbhbbb.exe110⤵PID:2800
-
\??\c:\hbnhtb.exec:\hbnhtb.exe111⤵PID:2684
-
\??\c:\jvvpp.exec:\jvvpp.exe112⤵PID:920
-
\??\c:\lfrlrrx.exec:\lfrlrrx.exe113⤵PID:4844
-
\??\c:\fxlfllr.exec:\fxlfllr.exe114⤵PID:4316
-
\??\c:\htbbbb.exec:\htbbbb.exe115⤵PID:3560
-
\??\c:\pjdvd.exec:\pjdvd.exe116⤵PID:4312
-
\??\c:\dpppv.exec:\dpppv.exe117⤵PID:2120
-
\??\c:\frrxrfr.exec:\frrxrfr.exe118⤵PID:404
-
\??\c:\nttnht.exec:\nttnht.exe119⤵PID:2240
-
\??\c:\tnhbnt.exec:\tnhbnt.exe120⤵PID:2540
-
\??\c:\jvdjj.exec:\jvdjj.exe121⤵PID:5064
-
\??\c:\lrxxlfx.exec:\lrxxlfx.exe122⤵PID:3296
-
\??\c:\fflrxfl.exec:\fflrxfl.exe123⤵PID:3768
-
\??\c:\btbtbb.exec:\btbtbb.exe124⤵PID:4748
-
\??\c:\tttttt.exec:\tttttt.exe125⤵PID:2264
-
\??\c:\jjddv.exec:\jjddv.exe126⤵PID:804
-
\??\c:\frlfrrr.exec:\frlfrrr.exe127⤵PID:864
-
\??\c:\nbbbhh.exec:\nbbbhh.exe128⤵PID:4484
-
\??\c:\3nnnnt.exec:\3nnnnt.exe129⤵PID:4664
-
\??\c:\1pjdv.exec:\1pjdv.exe130⤵PID:3368
-
\??\c:\vdpjv.exec:\vdpjv.exe131⤵PID:1828
-
\??\c:\fxlllll.exec:\fxlllll.exe132⤵PID:1488
-
\??\c:\7rffxxl.exec:\7rffxxl.exe133⤵PID:4492
-
\??\c:\7hnhhh.exec:\7hnhhh.exe134⤵PID:4708
-
\??\c:\ntbttt.exec:\ntbttt.exe135⤵PID:4056
-
\??\c:\3vdvd.exec:\3vdvd.exe136⤵
- System Location Discovery: System Language Discovery
PID:4188 -
\??\c:\fxxrlll.exec:\fxxrlll.exe137⤵PID:4920
-
\??\c:\ffrrxxl.exec:\ffrrxxl.exe138⤵PID:3588
-
\??\c:\ttnhhh.exec:\ttnhhh.exe139⤵PID:4700
-
\??\c:\pvdvp.exec:\pvdvp.exe140⤵PID:3364
-
\??\c:\vpdvp.exec:\vpdvp.exe141⤵PID:2780
-
\??\c:\frxrfff.exec:\frxrfff.exe142⤵PID:4532
-
\??\c:\frrrrxx.exec:\frrrrxx.exe143⤵PID:1984
-
\??\c:\3pvpd.exec:\3pvpd.exe144⤵PID:4732
-
\??\c:\pdvdv.exec:\pdvdv.exe145⤵PID:4264
-
\??\c:\lfxxllx.exec:\lfxxllx.exe146⤵PID:2496
-
\??\c:\thnhhh.exec:\thnhhh.exe147⤵PID:4428
-
\??\c:\1hhbtt.exec:\1hhbtt.exe148⤵PID:3236
-
\??\c:\jvdvv.exec:\jvdvv.exe149⤵PID:1788
-
\??\c:\3rxrrll.exec:\3rxrrll.exe150⤵PID:520
-
\??\c:\1rrlffx.exec:\1rrlffx.exe151⤵PID:856
-
\??\c:\bnbttt.exec:\bnbttt.exe152⤵PID:1132
-
\??\c:\ppjjj.exec:\ppjjj.exe153⤵PID:2444
-
\??\c:\rlxlrlr.exec:\rlxlrlr.exe154⤵PID:2304
-
\??\c:\rxxffll.exec:\rxxffll.exe155⤵PID:1800
-
\??\c:\hbnnhh.exec:\hbnnhh.exe156⤵PID:4916
-
\??\c:\xxrlffx.exec:\xxrlffx.exe157⤵PID:4924
-
\??\c:\bnbnnn.exec:\bnbnnn.exe158⤵PID:1044
-
\??\c:\dpvpj.exec:\dpvpj.exe159⤵PID:2684
-
\??\c:\djvpj.exec:\djvpj.exe160⤵PID:920
-
\??\c:\hbbttt.exec:\hbbttt.exe161⤵PID:4844
-
\??\c:\dpjdv.exec:\dpjdv.exe162⤵PID:4316
-
\??\c:\vvpjd.exec:\vvpjd.exe163⤵PID:3560
-
\??\c:\9rrlllf.exec:\9rrlllf.exe164⤵PID:4312
-
\??\c:\hbhhhh.exec:\hbhhhh.exe165⤵PID:2120
-
\??\c:\tbhnhh.exec:\tbhnhh.exe166⤵PID:404
-
\??\c:\vjdvp.exec:\vjdvp.exe167⤵PID:3500
-
\??\c:\5rffxll.exec:\5rffxll.exe168⤵PID:3544
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe169⤵PID:564
-
\??\c:\hntbtb.exec:\hntbtb.exe170⤵PID:4576
-
\??\c:\jpvvv.exec:\jpvvv.exe171⤵PID:4688
-
\??\c:\pdppd.exec:\pdppd.exe172⤵PID:4748
-
\??\c:\7lrllrl.exec:\7lrllrl.exe173⤵PID:1584
-
\??\c:\btthhh.exec:\btthhh.exe174⤵PID:804
-
\??\c:\7bbtnn.exec:\7bbtnn.exe175⤵PID:864
-
\??\c:\1djdd.exec:\1djdd.exe176⤵
- System Location Discovery: System Language Discovery
PID:4484 -
\??\c:\rxxxxxx.exec:\rxxxxxx.exe177⤵PID:4664
-
\??\c:\rxlrrrr.exec:\rxlrrrr.exe178⤵PID:1496
-
\??\c:\9nhbbb.exec:\9nhbbb.exe179⤵PID:1828
-
\??\c:\3bbbhn.exec:\3bbbhn.exe180⤵PID:4520
-
\??\c:\dpvvp.exec:\dpvvp.exe181⤵PID:4492
-
\??\c:\5xfffll.exec:\5xfffll.exe182⤵PID:1988
-
\??\c:\rxlrxfl.exec:\rxlrxfl.exe183⤵PID:4056
-
\??\c:\bbntbb.exec:\bbntbb.exe184⤵PID:4144
-
\??\c:\dvdvv.exec:\dvdvv.exe185⤵PID:2620
-
\??\c:\lfrlxrx.exec:\lfrlxrx.exe186⤵PID:2992
-
\??\c:\hhttnn.exec:\hhttnn.exe187⤵PID:1460
-
\??\c:\btnnhh.exec:\btnnhh.exe188⤵PID:4032
-
\??\c:\vdjjv.exec:\vdjjv.exe189⤵PID:4460
-
\??\c:\rllxxxx.exec:\rllxxxx.exe190⤵PID:2824
-
\??\c:\bbnbhh.exec:\bbnbhh.exe191⤵PID:5036
-
\??\c:\hhhnnn.exec:\hhhnnn.exe192⤵PID:4732
-
\??\c:\vjpdd.exec:\vjpdd.exe193⤵PID:4448
-
\??\c:\xxrllll.exec:\xxrllll.exe194⤵
- System Location Discovery: System Language Discovery
PID:2496 -
\??\c:\1thtbb.exec:\1thtbb.exe195⤵PID:4592
-
\??\c:\ntnhtt.exec:\ntnhtt.exe196⤵PID:5104
-
\??\c:\1ppvd.exec:\1ppvd.exe197⤵PID:5040
-
\??\c:\fxlllll.exec:\fxlllll.exe198⤵PID:4392
-
\??\c:\ffffxxx.exec:\ffffxxx.exe199⤵PID:3424
-
\??\c:\thnnhh.exec:\thnnhh.exe200⤵PID:1648
-
\??\c:\vjddj.exec:\vjddj.exe201⤵PID:3420
-
\??\c:\pvpjd.exec:\pvpjd.exe202⤵PID:4752
-
\??\c:\lxxxxxx.exec:\lxxxxxx.exe203⤵PID:4104
-
\??\c:\tnhtth.exec:\tnhtth.exe204⤵PID:3380
-
\??\c:\nthbhb.exec:\nthbhb.exe205⤵
- System Location Discovery: System Language Discovery
PID:3576 -
\??\c:\djpjv.exec:\djpjv.exe206⤵PID:4004
-
\??\c:\lflxfxx.exec:\lflxfxx.exe207⤵PID:4420
-
\??\c:\hhnnbb.exec:\hhnnbb.exe208⤵PID:1784
-
\??\c:\5ttttn.exec:\5ttttn.exe209⤵PID:4760
-
\??\c:\dvddv.exec:\dvddv.exe210⤵PID:2784
-
\??\c:\rlllxrf.exec:\rlllxrf.exe211⤵PID:1564
-
\??\c:\7lxrlxx.exec:\7lxrlxx.exe212⤵PID:2260
-
\??\c:\hnhhhh.exec:\hnhhhh.exe213⤵PID:2540
-
\??\c:\vvdpp.exec:\vvdpp.exe214⤵PID:1424
-
\??\c:\pdppp.exec:\pdppp.exe215⤵PID:3296
-
\??\c:\llflffr.exec:\llflffr.exe216⤵PID:460
-
\??\c:\1htnhn.exec:\1htnhn.exe217⤵PID:380
-
\??\c:\hhnbbh.exec:\hhnbbh.exe218⤵PID:1676
-
\??\c:\dpdpj.exec:\dpdpj.exe219⤵PID:900
-
\??\c:\1vjdj.exec:\1vjdj.exe220⤵PID:4240
-
\??\c:\xflrllf.exec:\xflrllf.exe221⤵PID:332
-
\??\c:\htbbbb.exec:\htbbbb.exe222⤵PID:3464
-
\??\c:\nthhhh.exec:\nthhhh.exe223⤵PID:3368
-
\??\c:\vjpjj.exec:\vjpjj.exe224⤵PID:2672
-
\??\c:\jdvpp.exec:\jdvpp.exe225⤵PID:1496
-
\??\c:\lrllffx.exec:\lrllffx.exe226⤵PID:3440
-
\??\c:\flfrfrf.exec:\flfrfrf.exe227⤵PID:4708
-
\??\c:\5nbbtt.exec:\5nbbtt.exe228⤵PID:2736
-
\??\c:\jvvpp.exec:\jvvpp.exe229⤵PID:4280
-
\??\c:\jdpjd.exec:\jdpjd.exe230⤵PID:2796
-
\??\c:\lxfffff.exec:\lxfffff.exe231⤵PID:3996
-
\??\c:\tntbbb.exec:\tntbbb.exe232⤵PID:1852
-
\??\c:\5tttnn.exec:\5tttnn.exe233⤵PID:3868
-
\??\c:\jpvvj.exec:\jpvvj.exe234⤵PID:4444
-
\??\c:\jddvd.exec:\jddvd.exe235⤵PID:1164
-
\??\c:\rfxlfxx.exec:\rfxlfxx.exe236⤵PID:1924
-
\??\c:\ttthth.exec:\ttthth.exe237⤵PID:1252
-
\??\c:\5bbthh.exec:\5bbthh.exe238⤵PID:2224
-
\??\c:\lfrlrrr.exec:\lfrlrrr.exe239⤵PID:2512
-
\??\c:\bhtntt.exec:\bhtntt.exe240⤵PID:3312
-
\??\c:\jpdvv.exec:\jpdvv.exe241⤵
- System Location Discovery: System Language Discovery
PID:4132 -
\??\c:\3xffxxx.exec:\3xffxxx.exe242⤵PID:4092