Analysis
-
max time kernel
62s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27-07-2024 03:51
Static task
static1
Behavioral task
behavioral1
Sample
cb4d4eaac03c13cf23807ed300616f492cd130e726f9b971824da63a56b025ac.exe
Resource
win7-20240704-en
General
-
Target
cb4d4eaac03c13cf23807ed300616f492cd130e726f9b971824da63a56b025ac.exe
-
Size
343KB
-
MD5
fa0bc367e69dbd0a7e2cfe0532dbc113
-
SHA1
3fcf2f6cb76b1a4f6fb90edc5a3fcec1d1c5c56b
-
SHA256
cb4d4eaac03c13cf23807ed300616f492cd130e726f9b971824da63a56b025ac
-
SHA512
32ec6e08efdaac5f45f91459945644d9f827d9fe6107ddd3b12638faefefde245a3cc7958265fb961f41195855f77a55fd9c3c12ce48dec9be67014626181ac8
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYAs:l7TcbWXZshJX2VGds
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2724-7-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3644-6-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4448-13-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5024-31-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3104-35-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3816-42-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3168-48-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5020-54-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2572-61-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2776-67-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2244-73-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2844-78-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4228-80-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2580-86-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1388-98-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1340-109-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1184-121-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3664-119-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4508-135-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2268-141-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3060-158-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1412-169-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1604-174-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1776-181-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4764-187-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4464-189-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3248-198-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3444-206-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1216-216-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4924-223-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3168-230-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5028-234-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4396-238-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4808-243-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2432-255-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2440-254-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/636-257-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1368-264-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4092-284-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4132-293-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1192-303-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1168-310-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/916-327-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3148-331-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4292-335-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3104-363-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4568-371-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4328-390-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2540-397-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/936-410-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1716-414-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3976-421-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3404-431-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1652-467-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4292-466-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2540-531-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4112-589-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2700-596-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1804-627-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1444-654-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1692-691-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1980-849-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/60-914-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4112-1071-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
dvpdd.exexfxlrrr.exetnnntt.exexfxxlll.exebnnnnn.exejppvd.exedpdvd.exerlxxllx.exejpjvp.exe9jvpj.exenhhbbn.exedjpvv.exedvvpp.exerlfflxl.exebtbntt.exelrxrffl.exe3rxrffl.exelxrlllf.exetbhttb.exefrxffff.exenhtbht.exexlfxrxx.exevpdjp.exeflxrfxx.exerrrrfrf.exebbtttb.exeppdpj.exedddjp.exexxxllll.exerffxfxr.exelrllfxr.exentnhtn.exeddjvv.exethhhth.exeppdjp.exe5jjjd.exerxllllr.exenbhbnt.exehtbhtt.exerlfflrr.exehnbnhn.exehbbntt.exentntbn.exevvddp.exelrrrrrr.exedvjvp.exeddvvd.exe5pvdp.exeddvpv.exevjpvp.exetbntbb.exenhhtbb.exe1djdp.exe3dppj.exevdvjv.exevdpvp.exeflxxlfx.exenhbnbn.exe7bnbhh.exenttttt.exedvdvd.exehhnbnh.exe1lxxrxr.exebhnbbn.exepid process 2724 dvpdd.exe 4448 xfxlrrr.exe 3836 tnnntt.exe 5024 xfxxlll.exe 3104 bnnnnn.exe 3816 jppvd.exe 3168 dpdvd.exe 5020 rlxxllx.exe 2572 jpjvp.exe 2776 9jvpj.exe 2244 nhhbbn.exe 2844 djpvv.exe 4228 dvvpp.exe 2580 rlfflxl.exe 2880 btbntt.exe 1388 lrxrffl.exe 1340 3rxrffl.exe 1784 lxrlllf.exe 1184 tbhttb.exe 3664 frxffff.exe 3912 nhtbht.exe 3404 xlfxrxx.exe 4508 vpdjp.exe 2268 flxrfxx.exe 1168 rrrrfrf.exe 3060 bbtttb.exe 4596 ppdpj.exe 1412 dddjp.exe 1604 xxxllll.exe 1776 rffxfxr.exe 4464 lrllfxr.exe 4764 ntnhtn.exe 3716 ddjvv.exe 3248 thhhth.exe 3460 ppdjp.exe 3444 5jjjd.exe 4368 rxllllr.exe 1352 nbhbnt.exe 1216 htbhtt.exe 628 rlfflrr.exe 4924 hnbnhn.exe 3816 hbbntt.exe 3168 ntntbn.exe 5028 vvddp.exe 4396 lrrrrrr.exe 760 dvjvp.exe 4808 ddvvd.exe 3980 5pvdp.exe 2440 ddvpv.exe 2432 vjpvp.exe 636 tbntbb.exe 1368 nhhtbb.exe 2208 1djdp.exe 2880 3dppj.exe 552 vdvjv.exe 920 vdpvp.exe 3968 flxxlfx.exe 4092 nhbnbn.exe 4456 7bnbhh.exe 4132 nttttt.exe 4392 dvdvd.exe 5072 hhnbnh.exe 1192 1lxxrxr.exe 1336 bhnbbn.exe -
Processes:
resource yara_rule behavioral2/memory/2724-7-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3644-6-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4448-13-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3836-18-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5024-31-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3104-35-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3816-42-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5020-49-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3168-48-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5020-54-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2572-61-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2776-67-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2244-73-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2844-78-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4228-80-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2580-86-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1388-98-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1340-109-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1184-121-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3664-119-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4508-135-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2268-141-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3060-153-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3060-158-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1412-169-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1604-174-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1776-181-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4764-187-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4464-189-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3248-198-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3444-201-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3444-206-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1216-216-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4924-223-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3168-230-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5028-234-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4396-238-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4808-243-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2432-255-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2440-254-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/636-257-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1368-264-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4092-284-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4132-288-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4132-293-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1192-303-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1168-310-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/916-323-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/916-327-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3148-331-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4292-335-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3104-363-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4568-367-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4568-371-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4328-390-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2540-397-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/936-410-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1716-414-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3976-421-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3404-431-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1648-438-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1652-467-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4292-466-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/232-479-0x0000000000400000-0x0000000000428000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
xfxxflr.exelrlrrxf.exedjpdv.exe1jjvp.exevpdjp.exebhnttb.exetnntbb.exepjpvp.exelrflrxx.exennnnth.exetbntbb.exerlrlrfl.exejdjdj.exepdvdv.exentnbnt.exebbtttb.exelrxxlxx.exefrrlfxf.exepjvvp.exerlfflxl.exefrrfrxx.exedjvdv.exenhtttt.exeddddj.exeddvpv.exeflxxlfx.exe7bnbhh.exerxlfrxl.exetnttht.exennbbhh.exebbbnht.exexfxxlll.exejpvdd.exennnnnt.exetnbhth.exefxlflxf.exenbtntb.exexfxfllx.exetbhhhn.exejvvvv.exehhnhtn.exehbbhht.exehbhhbn.exe3xllfxx.exeflxfxxl.exefrrlfrl.exetnnntt.exexfrlflr.exebhhhth.exejpjdd.exeppvjd.exebhhhnn.exehbhhbb.exennbhhh.exepdjpd.exerxrlrlf.exehbbbtt.exevjddj.exeddddp.exentnhtn.exetbnnhh.exerxxlllr.exennbtnt.exevjpdd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrflrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxxlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfflxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrfrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xllfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxfxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrlflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrlrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpdd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cb4d4eaac03c13cf23807ed300616f492cd130e726f9b971824da63a56b025ac.exedvpdd.exexfxlrrr.exetnnntt.exexfxxlll.exebnnnnn.exejppvd.exedpdvd.exerlxxllx.exejpjvp.exe9jvpj.exenhhbbn.exedjpvv.exedvvpp.exerlfflxl.exebtbntt.exelrxrffl.exe3rxrffl.exelxrlllf.exetbhttb.exefrxffff.exenhtbht.exedescription pid process target process PID 3644 wrote to memory of 2724 3644 cb4d4eaac03c13cf23807ed300616f492cd130e726f9b971824da63a56b025ac.exe dvpdd.exe PID 3644 wrote to memory of 2724 3644 cb4d4eaac03c13cf23807ed300616f492cd130e726f9b971824da63a56b025ac.exe dvpdd.exe PID 3644 wrote to memory of 2724 3644 cb4d4eaac03c13cf23807ed300616f492cd130e726f9b971824da63a56b025ac.exe dvpdd.exe PID 2724 wrote to memory of 4448 2724 dvpdd.exe xfxlrrr.exe PID 2724 wrote to memory of 4448 2724 dvpdd.exe xfxlrrr.exe PID 2724 wrote to memory of 4448 2724 dvpdd.exe xfxlrrr.exe PID 4448 wrote to memory of 3836 4448 xfxlrrr.exe tnnntt.exe PID 4448 wrote to memory of 3836 4448 xfxlrrr.exe tnnntt.exe PID 4448 wrote to memory of 3836 4448 xfxlrrr.exe tnnntt.exe PID 3836 wrote to memory of 5024 3836 tnnntt.exe xfxxlll.exe PID 3836 wrote to memory of 5024 3836 tnnntt.exe xfxxlll.exe PID 3836 wrote to memory of 5024 3836 tnnntt.exe xfxxlll.exe PID 5024 wrote to memory of 3104 5024 xfxxlll.exe bnnnnn.exe PID 5024 wrote to memory of 3104 5024 xfxxlll.exe bnnnnn.exe PID 5024 wrote to memory of 3104 5024 xfxxlll.exe bnnnnn.exe PID 3104 wrote to memory of 3816 3104 bnnnnn.exe jppvd.exe PID 3104 wrote to memory of 3816 3104 bnnnnn.exe jppvd.exe PID 3104 wrote to memory of 3816 3104 bnnnnn.exe jppvd.exe PID 3816 wrote to memory of 3168 3816 jppvd.exe dpdvd.exe PID 3816 wrote to memory of 3168 3816 jppvd.exe dpdvd.exe PID 3816 wrote to memory of 3168 3816 jppvd.exe dpdvd.exe PID 3168 wrote to memory of 5020 3168 dpdvd.exe rlxxllx.exe PID 3168 wrote to memory of 5020 3168 dpdvd.exe rlxxllx.exe PID 3168 wrote to memory of 5020 3168 dpdvd.exe rlxxllx.exe PID 5020 wrote to memory of 2572 5020 rlxxllx.exe jpjvp.exe PID 5020 wrote to memory of 2572 5020 rlxxllx.exe jpjvp.exe PID 5020 wrote to memory of 2572 5020 rlxxllx.exe jpjvp.exe PID 2572 wrote to memory of 2776 2572 jpjvp.exe 9jvpj.exe PID 2572 wrote to memory of 2776 2572 jpjvp.exe 9jvpj.exe PID 2572 wrote to memory of 2776 2572 jpjvp.exe 9jvpj.exe PID 2776 wrote to memory of 2244 2776 9jvpj.exe nhhbbn.exe PID 2776 wrote to memory of 2244 2776 9jvpj.exe nhhbbn.exe PID 2776 wrote to memory of 2244 2776 9jvpj.exe nhhbbn.exe PID 2244 wrote to memory of 2844 2244 nhhbbn.exe djpvv.exe PID 2244 wrote to memory of 2844 2244 nhhbbn.exe djpvv.exe PID 2244 wrote to memory of 2844 2244 nhhbbn.exe djpvv.exe PID 2844 wrote to memory of 4228 2844 djpvv.exe dvvpp.exe PID 2844 wrote to memory of 4228 2844 djpvv.exe dvvpp.exe PID 2844 wrote to memory of 4228 2844 djpvv.exe dvvpp.exe PID 4228 wrote to memory of 2580 4228 dvvpp.exe rlfflxl.exe PID 4228 wrote to memory of 2580 4228 dvvpp.exe rlfflxl.exe PID 4228 wrote to memory of 2580 4228 dvvpp.exe rlfflxl.exe PID 2580 wrote to memory of 2880 2580 rlfflxl.exe 3dppj.exe PID 2580 wrote to memory of 2880 2580 rlfflxl.exe 3dppj.exe PID 2580 wrote to memory of 2880 2580 rlfflxl.exe 3dppj.exe PID 2880 wrote to memory of 1388 2880 btbntt.exe lrxrffl.exe PID 2880 wrote to memory of 1388 2880 btbntt.exe lrxrffl.exe PID 2880 wrote to memory of 1388 2880 btbntt.exe lrxrffl.exe PID 1388 wrote to memory of 1340 1388 lrxrffl.exe 3rxrffl.exe PID 1388 wrote to memory of 1340 1388 lrxrffl.exe 3rxrffl.exe PID 1388 wrote to memory of 1340 1388 lrxrffl.exe 3rxrffl.exe PID 1340 wrote to memory of 1784 1340 3rxrffl.exe tnntbb.exe PID 1340 wrote to memory of 1784 1340 3rxrffl.exe tnntbb.exe PID 1340 wrote to memory of 1784 1340 3rxrffl.exe tnntbb.exe PID 1784 wrote to memory of 1184 1784 lxrlllf.exe rrxxflf.exe PID 1784 wrote to memory of 1184 1784 lxrlllf.exe rrxxflf.exe PID 1784 wrote to memory of 1184 1784 lxrlllf.exe rrxxflf.exe PID 1184 wrote to memory of 3664 1184 tbhttb.exe frxffff.exe PID 1184 wrote to memory of 3664 1184 tbhttb.exe frxffff.exe PID 1184 wrote to memory of 3664 1184 tbhttb.exe frxffff.exe PID 3664 wrote to memory of 3912 3664 frxffff.exe jpvdd.exe PID 3664 wrote to memory of 3912 3664 frxffff.exe jpvdd.exe PID 3664 wrote to memory of 3912 3664 frxffff.exe jpvdd.exe PID 3912 wrote to memory of 3404 3912 nhtbht.exe rxffrxx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb4d4eaac03c13cf23807ed300616f492cd130e726f9b971824da63a56b025ac.exe"C:\Users\Admin\AppData\Local\Temp\cb4d4eaac03c13cf23807ed300616f492cd130e726f9b971824da63a56b025ac.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\dvpdd.exec:\dvpdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\xfxlrrr.exec:\xfxlrrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\tnnntt.exec:\tnnntt.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\xfxxlll.exec:\xfxxlll.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\bnnnnn.exec:\bnnnnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\jppvd.exec:\jppvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\dpdvd.exec:\dpdvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\rlxxllx.exec:\rlxxllx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\jpjvp.exec:\jpjvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\9jvpj.exec:\9jvpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\nhhbbn.exec:\nhhbbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\djpvv.exec:\djpvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\dvvpp.exec:\dvvpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\rlfflxl.exec:\rlfflxl.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\btbntt.exec:\btbntt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\lrxrffl.exec:\lrxrffl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\3rxrffl.exec:\3rxrffl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\lxrlllf.exec:\lxrlllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\tbhttb.exec:\tbhttb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\frxffff.exec:\frxffff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\nhtbht.exec:\nhtbht.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
\??\c:\xlfxrxx.exec:\xlfxrxx.exe23⤵
- Executes dropped EXE
PID:3404 -
\??\c:\vpdjp.exec:\vpdjp.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4508 -
\??\c:\flxrfxx.exec:\flxrfxx.exe25⤵
- Executes dropped EXE
PID:2268 -
\??\c:\rrrrfrf.exec:\rrrrfrf.exe26⤵
- Executes dropped EXE
PID:1168 -
\??\c:\bbtttb.exec:\bbtttb.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3060 -
\??\c:\ppdpj.exec:\ppdpj.exe28⤵
- Executes dropped EXE
PID:4596 -
\??\c:\dddjp.exec:\dddjp.exe29⤵
- Executes dropped EXE
PID:1412 -
\??\c:\xxxllll.exec:\xxxllll.exe30⤵
- Executes dropped EXE
PID:1604 -
\??\c:\rffxfxr.exec:\rffxfxr.exe31⤵
- Executes dropped EXE
PID:1776 -
\??\c:\lrllfxr.exec:\lrllfxr.exe32⤵
- Executes dropped EXE
PID:4464 -
\??\c:\ntnhtn.exec:\ntnhtn.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4764 -
\??\c:\ddjvv.exec:\ddjvv.exe34⤵
- Executes dropped EXE
PID:3716 -
\??\c:\thhhth.exec:\thhhth.exe35⤵
- Executes dropped EXE
PID:3248 -
\??\c:\ppdjp.exec:\ppdjp.exe36⤵
- Executes dropped EXE
PID:3460 -
\??\c:\5jjjd.exec:\5jjjd.exe37⤵
- Executes dropped EXE
PID:3444 -
\??\c:\rxllllr.exec:\rxllllr.exe38⤵
- Executes dropped EXE
PID:4368 -
\??\c:\nbhbnt.exec:\nbhbnt.exe39⤵
- Executes dropped EXE
PID:1352 -
\??\c:\htbhtt.exec:\htbhtt.exe40⤵
- Executes dropped EXE
PID:1216 -
\??\c:\rlfflrr.exec:\rlfflrr.exe41⤵
- Executes dropped EXE
PID:628 -
\??\c:\hnbnhn.exec:\hnbnhn.exe42⤵
- Executes dropped EXE
PID:4924 -
\??\c:\hbbntt.exec:\hbbntt.exe43⤵
- Executes dropped EXE
PID:3816 -
\??\c:\ntntbn.exec:\ntntbn.exe44⤵
- Executes dropped EXE
PID:3168 -
\??\c:\vvddp.exec:\vvddp.exe45⤵
- Executes dropped EXE
PID:5028 -
\??\c:\lrrrrrr.exec:\lrrrrrr.exe46⤵
- Executes dropped EXE
PID:4396 -
\??\c:\dvjvp.exec:\dvjvp.exe47⤵
- Executes dropped EXE
PID:760 -
\??\c:\ddvvd.exec:\ddvvd.exe48⤵
- Executes dropped EXE
PID:4808 -
\??\c:\5pvdp.exec:\5pvdp.exe49⤵
- Executes dropped EXE
PID:3980 -
\??\c:\ddvpv.exec:\ddvpv.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2440 -
\??\c:\vjpvp.exec:\vjpvp.exe51⤵
- Executes dropped EXE
PID:2432 -
\??\c:\tbntbb.exec:\tbntbb.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:636 -
\??\c:\nhhtbb.exec:\nhhtbb.exe53⤵
- Executes dropped EXE
PID:1368 -
\??\c:\1djdp.exec:\1djdp.exe54⤵
- Executes dropped EXE
PID:2208 -
\??\c:\3dppj.exec:\3dppj.exe55⤵
- Executes dropped EXE
PID:2880 -
\??\c:\vdvjv.exec:\vdvjv.exe56⤵
- Executes dropped EXE
PID:552 -
\??\c:\vdpvp.exec:\vdpvp.exe57⤵
- Executes dropped EXE
PID:920 -
\??\c:\flxxlfx.exec:\flxxlfx.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3968 -
\??\c:\nhbnbn.exec:\nhbnbn.exe59⤵
- Executes dropped EXE
PID:4092 -
\??\c:\7bnbhh.exec:\7bnbhh.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4456 -
\??\c:\nttttt.exec:\nttttt.exe61⤵
- Executes dropped EXE
PID:4132 -
\??\c:\dvdvd.exec:\dvdvd.exe62⤵
- Executes dropped EXE
PID:4392 -
\??\c:\hhnbnh.exec:\hhnbnh.exe63⤵
- Executes dropped EXE
PID:5072 -
\??\c:\1lxxrxr.exec:\1lxxrxr.exe64⤵
- Executes dropped EXE
PID:1192 -
\??\c:\bhnbbn.exec:\bhnbbn.exe65⤵
- Executes dropped EXE
PID:1336 -
\??\c:\ffrrflf.exec:\ffrrflf.exe66⤵PID:1168
-
\??\c:\thhbnb.exec:\thhbnb.exe67⤵PID:3124
-
\??\c:\tbnnhh.exec:\tbnnhh.exe68⤵
- System Location Discovery: System Language Discovery
PID:1692 -
\??\c:\bhnttb.exec:\bhnttb.exe69⤵
- System Location Discovery: System Language Discovery
PID:1420 -
\??\c:\lrxxlxx.exec:\lrxxlxx.exe70⤵
- System Location Discovery: System Language Discovery
PID:1412 -
\??\c:\lfxffxx.exec:\lfxffxx.exe71⤵PID:916
-
\??\c:\rfxxxrl.exec:\rfxxxrl.exe72⤵PID:3148
-
\??\c:\vvvvp.exec:\vvvvp.exe73⤵PID:4292
-
\??\c:\fxxflxx.exec:\fxxflxx.exe74⤵PID:1072
-
\??\c:\thnnnn.exec:\thnnnn.exe75⤵PID:3948
-
\??\c:\llxrffl.exec:\llxrffl.exe76⤵PID:3700
-
\??\c:\nbhbhn.exec:\nbhbhn.exe77⤵PID:2744
-
\??\c:\bthhhb.exec:\bthhhb.exe78⤵PID:232
-
\??\c:\lxflrxf.exec:\lxflrxf.exe79⤵PID:4120
-
\??\c:\rlrlrfl.exec:\rlrlrfl.exe80⤵
- System Location Discovery: System Language Discovery
PID:1216 -
\??\c:\hbhhbn.exec:\hbhhbn.exe81⤵
- System Location Discovery: System Language Discovery
PID:3184 -
\??\c:\flxrrll.exec:\flxrrll.exe82⤵PID:3104
-
\??\c:\jjpvd.exec:\jjpvd.exe83⤵PID:1504
-
\??\c:\nbbhbn.exec:\nbbhbn.exe84⤵PID:4568
-
\??\c:\rfllffl.exec:\rfllffl.exe85⤵PID:4792
-
\??\c:\hhtnnb.exec:\hhtnnb.exe86⤵PID:4800
-
\??\c:\frfrfxl.exec:\frfrfxl.exe87⤵PID:1820
-
\??\c:\rxrlrlf.exec:\rxrlrlf.exe88⤵
- System Location Discovery: System Language Discovery
PID:4364 -
\??\c:\nnttbh.exec:\nnttbh.exe89⤵PID:3748
-
\??\c:\llxlxrl.exec:\llxlxrl.exe90⤵PID:4328
-
\??\c:\nhhthb.exec:\nhhthb.exe91⤵PID:1988
-
\??\c:\nhbbhn.exec:\nhbbhn.exe92⤵PID:3940
-
\??\c:\nbhhnn.exec:\nbhhnn.exe93⤵PID:2540
-
\??\c:\hbtbtn.exec:\hbtbtn.exe94⤵PID:2200
-
\??\c:\tnhtnt.exec:\tnhtnt.exe95⤵PID:2588
-
\??\c:\thbhbh.exec:\thbhbh.exe96⤵PID:936
-
\??\c:\1tnhbh.exec:\1tnhbh.exe97⤵PID:2852
-
\??\c:\hhhhbt.exec:\hhhhbt.exe98⤵PID:1716
-
\??\c:\rffllfl.exec:\rffllfl.exe99⤵PID:3976
-
\??\c:\lrrxlff.exec:\lrrxlff.exe100⤵PID:4496
-
\??\c:\xllfffx.exec:\xllfffx.exe101⤵PID:2300
-
\??\c:\rxffrxx.exec:\rxffrxx.exe102⤵PID:3404
-
\??\c:\vdddp.exec:\vdddp.exe103⤵PID:3544
-
\??\c:\frrfrxx.exec:\frrfrxx.exe104⤵
- System Location Discovery: System Language Discovery
PID:2268 -
\??\c:\rxlfrxl.exec:\rxlfrxl.exe105⤵
- System Location Discovery: System Language Discovery
PID:1648 -
\??\c:\ntnbhb.exec:\ntnbhb.exe106⤵PID:4772
-
\??\c:\thhnbh.exec:\thhnbh.exe107⤵PID:2560
-
\??\c:\nbhbhh.exec:\nbhbhh.exe108⤵PID:4612
-
\??\c:\bttttn.exec:\bttttn.exe109⤵PID:2896
-
\??\c:\lxlfxxx.exec:\lxlfxxx.exe110⤵PID:3152
-
\??\c:\vdjvj.exec:\vdjvj.exe111⤵PID:916
-
\??\c:\3bntnt.exec:\3bntnt.exe112⤵PID:1384
-
\??\c:\dpvpp.exec:\dpvpp.exe113⤵PID:4292
-
\??\c:\nntttb.exec:\nntttb.exe114⤵PID:1652
-
\??\c:\lrfxfxf.exec:\lrfxfxf.exe115⤵PID:3948
-
\??\c:\jjvpd.exec:\jjvpd.exe116⤵PID:3580
-
\??\c:\fxrflxr.exec:\fxrflxr.exe117⤵PID:2744
-
\??\c:\jjddj.exec:\jjddj.exe118⤵PID:232
-
\??\c:\bnnhth.exec:\bnnhth.exe119⤵PID:4952
-
\??\c:\rrrrrfl.exec:\rrrrrfl.exe120⤵PID:3508
-
\??\c:\pjvdd.exec:\pjvdd.exe121⤵PID:1740
-
\??\c:\bbnnhh.exec:\bbnnhh.exe122⤵PID:4476
-
\??\c:\fxlrxfl.exec:\fxlrxfl.exe123⤵PID:1504
-
\??\c:\fxrrllr.exec:\fxrrllr.exe124⤵PID:3244
-
\??\c:\rxrxfrl.exec:\rxrxfrl.exe125⤵PID:2944
-
\??\c:\rrrrlxf.exec:\rrrrlxf.exe126⤵PID:4800
-
\??\c:\bnhnhh.exec:\bnhnhh.exe127⤵PID:1820
-
\??\c:\xxxrlxf.exec:\xxxrlxf.exe128⤵PID:4364
-
\??\c:\vjvvv.exec:\vjvvv.exe129⤵PID:784
-
\??\c:\jppvp.exec:\jppvp.exe130⤵PID:4248
-
\??\c:\vpvdp.exec:\vpvdp.exe131⤵PID:2868
-
\??\c:\pjpdp.exec:\pjpdp.exe132⤵PID:868
-
\??\c:\llrrrxf.exec:\llrrrxf.exe133⤵PID:2540
-
\??\c:\pdjvd.exec:\pdjvd.exe134⤵PID:2100
-
\??\c:\tnntbb.exec:\tnntbb.exe135⤵
- System Location Discovery: System Language Discovery
PID:1784 -
\??\c:\httbhh.exec:\httbhh.exe136⤵PID:4732
-
\??\c:\rrxxflf.exec:\rrxxflf.exe137⤵PID:1184
-
\??\c:\dpddj.exec:\dpddj.exe138⤵PID:2044
-
\??\c:\tbtbhn.exec:\tbtbhn.exe139⤵PID:3112
-
\??\c:\djvdv.exec:\djvdv.exe140⤵
- System Location Discovery: System Language Discovery
PID:1744 -
\??\c:\nhhtbt.exec:\nhhtbt.exe141⤵PID:1912
-
\??\c:\fffxffl.exec:\fffxffl.exe142⤵PID:4940
-
\??\c:\lxlrlfl.exec:\lxlrlfl.exe143⤵PID:4832
-
\??\c:\5dppj.exec:\5dppj.exe144⤵PID:1336
-
\??\c:\7nbtbt.exec:\7nbtbt.exe145⤵PID:4180
-
\??\c:\ffxfrlx.exec:\ffxfrlx.exe146⤵PID:3540
-
\??\c:\rlxrrrl.exec:\rlxrrrl.exe147⤵PID:5032
-
\??\c:\rlfllrl.exec:\rlfllrl.exe148⤵PID:1420
-
\??\c:\dddvp.exec:\dddvp.exe149⤵PID:1956
-
\??\c:\bbtntb.exec:\bbtntb.exe150⤵PID:1568
-
\??\c:\tbbbbh.exec:\tbbbbh.exe151⤵PID:4312
-
\??\c:\rxxlrff.exec:\rxxlrff.exe152⤵PID:4112
-
\??\c:\fxllffr.exec:\fxllffr.exe153⤵PID:3176
-
\??\c:\ppvjd.exec:\ppvjd.exe154⤵
- System Location Discovery: System Language Discovery
PID:2700 -
\??\c:\bhhhnn.exec:\bhhhnn.exe155⤵
- System Location Discovery: System Language Discovery
PID:3700 -
\??\c:\tbbhbh.exec:\tbbhbh.exe156⤵PID:3208
-
\??\c:\7xlfrrl.exec:\7xlfrrl.exe157⤵PID:1616
-
\??\c:\vdpjv.exec:\vdpjv.exe158⤵PID:1868
-
\??\c:\hnbtnt.exec:\hnbtnt.exe159⤵PID:396
-
\??\c:\xrllfrr.exec:\xrllfrr.exe160⤵PID:3104
-
\??\c:\dpdjj.exec:\dpdjj.exe161⤵PID:4344
-
\??\c:\djpdd.exec:\djpdd.exe162⤵PID:1388
-
\??\c:\hbbbtt.exec:\hbbbtt.exe163⤵
- System Location Discovery: System Language Discovery
PID:3128 -
\??\c:\vpjpd.exec:\vpjpd.exe164⤵PID:4792
-
\??\c:\ppjjv.exec:\ppjjv.exe165⤵PID:1804
-
\??\c:\tbhttb.exec:\tbhttb.exe166⤵PID:4800
-
\??\c:\lrxxlrx.exec:\lrxxlrx.exe167⤵PID:1040
-
\??\c:\bbtnhb.exec:\bbtnhb.exe168⤵PID:4328
-
\??\c:\9rlffll.exec:\9rlffll.exe169⤵PID:2900
-
\??\c:\bbhhnn.exec:\bbhhnn.exe170⤵PID:2868
-
\??\c:\htbbht.exec:\htbbht.exe171⤵PID:2872
-
\??\c:\dvjdj.exec:\dvjdj.exe172⤵PID:1444
-
\??\c:\rxrllrx.exec:\rxrllrx.exe173⤵PID:3232
-
\??\c:\vjpdd.exec:\vjpdd.exe174⤵
- System Location Discovery: System Language Discovery
PID:1756 -
\??\c:\nnbthb.exec:\nnbthb.exe175⤵PID:1188
-
\??\c:\dvjjd.exec:\dvjjd.exe176⤵PID:1716
-
\??\c:\rxxflxx.exec:\rxxflxx.exe177⤵PID:3976
-
\??\c:\lrxlfff.exec:\lrxlfff.exe178⤵PID:764
-
\??\c:\jpvdd.exec:\jpvdd.exe179⤵
- System Location Discovery: System Language Discovery
PID:3912 -
\??\c:\nbbbnb.exec:\nbbbnb.exe180⤵PID:1192
-
\??\c:\xfffrlf.exec:\xfffrlf.exe181⤵PID:3544
-
\??\c:\bhtthb.exec:\bhtthb.exe182⤵PID:4832
-
\??\c:\nbtntb.exec:\nbtntb.exe183⤵
- System Location Discovery: System Language Discovery
PID:3764 -
\??\c:\5rxrrlx.exec:\5rxrrlx.exe184⤵PID:1692
-
\??\c:\xfxfllx.exec:\xfxfllx.exe185⤵
- System Location Discovery: System Language Discovery
PID:744 -
\??\c:\rxxlxrr.exec:\rxxlxrr.exe186⤵PID:1604
-
\??\c:\xxflllf.exec:\xxflllf.exe187⤵PID:3844
-
\??\c:\htnnnt.exec:\htnnnt.exe188⤵PID:1728
-
\??\c:\xflfxff.exec:\xflfxff.exe189⤵PID:4304
-
\??\c:\thnnth.exec:\thnnth.exe190⤵PID:3468
-
\??\c:\hbtntt.exec:\hbtntt.exe191⤵PID:3460
-
\??\c:\hbntbn.exec:\hbntbn.exe192⤵PID:5104
-
\??\c:\3xllfxx.exec:\3xllfxx.exe193⤵
- System Location Discovery: System Language Discovery
PID:3040 -
\??\c:\xrflxxr.exec:\xrflxxr.exe194⤵PID:312
-
\??\c:\fxlfffx.exec:\fxlfffx.exe195⤵PID:1012
-
\??\c:\1jddp.exec:\1jddp.exe196⤵PID:3800
-
\??\c:\thbtbt.exec:\thbtbt.exe197⤵PID:1980
-
\??\c:\nhtnnh.exec:\nhtnnh.exe198⤵PID:4932
-
\??\c:\lrxffff.exec:\lrxffff.exe199⤵PID:3788
-
\??\c:\vvdpj.exec:\vvdpj.exe200⤵PID:1480
-
\??\c:\pjpdj.exec:\pjpdj.exe201⤵PID:4792
-
\??\c:\jpjjj.exec:\jpjjj.exe202⤵PID:4980
-
\??\c:\vjddj.exec:\vjddj.exe203⤵
- System Location Discovery: System Language Discovery
PID:4800 -
\??\c:\nnnnnt.exec:\nnnnnt.exe204⤵
- System Location Discovery: System Language Discovery
PID:4364 -
\??\c:\hnnhnn.exec:\hnnhnn.exe205⤵PID:4724
-
\??\c:\djdjv.exec:\djdjv.exe206⤵PID:1368
-
\??\c:\jdjdj.exec:\jdjdj.exe207⤵PID:3996
-
\??\c:\rflrfxl.exec:\rflrfxl.exe208⤵PID:3768
-
\??\c:\xrfrrrf.exec:\xrfrrrf.exe209⤵PID:376
-
\??\c:\rlrffrx.exec:\rlrffrx.exe210⤵PID:1576
-
\??\c:\ttnbbn.exec:\ttnbbn.exe211⤵PID:3664
-
\??\c:\thhtnh.exec:\thhtnh.exe212⤵PID:2356
-
\??\c:\hhbbth.exec:\hhbbth.exe213⤵PID:2576
-
\??\c:\nnttnt.exec:\nnttnt.exe214⤵PID:1924
-
\??\c:\ttnhtt.exec:\ttnhtt.exe215⤵PID:3404
-
\??\c:\flxrffr.exec:\flxrffr.exe216⤵PID:1052
-
\??\c:\rxxlllr.exec:\rxxlllr.exe217⤵
- System Location Discovery: System Language Discovery
PID:4824 -
\??\c:\bhbhbn.exec:\bhbhbn.exe218⤵PID:3696
-
\??\c:\5hbtht.exec:\5hbtht.exe219⤵PID:4832
-
\??\c:\ddddp.exec:\ddddp.exe220⤵
- System Location Discovery: System Language Discovery
PID:4612 -
\??\c:\jvppj.exec:\jvppj.exe221⤵PID:5032
-
\??\c:\rrxrllf.exec:\rrxrllf.exe222⤵PID:4916
-
\??\c:\jpvvv.exec:\jpvvv.exe223⤵PID:3148
-
\??\c:\thtbhn.exec:\thtbhn.exe224⤵PID:4112
-
\??\c:\7rlrxfx.exec:\7rlrxfx.exe225⤵PID:4764
-
\??\c:\hhhhhn.exec:\hhhhhn.exe226⤵PID:692
-
\??\c:\rxrflrr.exec:\rxrflrr.exe227⤵PID:1240
-
\??\c:\djvjp.exec:\djvjp.exe228⤵PID:3460
-
\??\c:\bhttbh.exec:\bhttbh.exe229⤵PID:4120
-
\??\c:\1hnntn.exec:\1hnntn.exe230⤵PID:1772
-
\??\c:\ffrrrfx.exec:\ffrrrfx.exe231⤵PID:312
-
\??\c:\fxlxlrl.exec:\fxlxlrl.exe232⤵PID:2496
-
\??\c:\pdjvj.exec:\pdjvj.exe233⤵PID:3516
-
\??\c:\ppdjv.exec:\ppdjv.exe234⤵PID:1980
-
\??\c:\7jpdp.exec:\7jpdp.exe235⤵PID:3816
-
\??\c:\jdpvp.exec:\jdpvp.exe236⤵PID:3788
-
\??\c:\pdjpp.exec:\pdjpp.exe237⤵PID:2664
-
\??\c:\nhtnnt.exec:\nhtnnt.exe238⤵PID:4792
-
\??\c:\hnhhht.exec:\hnhhht.exe239⤵PID:1200
-
\??\c:\dpppv.exec:\dpppv.exe240⤵PID:4688
-
\??\c:\hnhnth.exec:\hnhnth.exe241⤵PID:5068
-
\??\c:\lxxlxxr.exec:\lxxlxxr.exe242⤵PID:2564