Analysis
-
max time kernel
120s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
27-07-2024 04:52
Behavioral task
behavioral1
Sample
93b61e568b02cf9dfc98bf093f145070N.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
120 seconds
General
-
Target
93b61e568b02cf9dfc98bf093f145070N.exe
-
Size
99KB
-
MD5
93b61e568b02cf9dfc98bf093f145070
-
SHA1
80942c4dffa97eb852ab7c007794e8bac1e6d437
-
SHA256
7cc8220dce886c23c0402608c3b0eb6f45600afaa7aa30a7353e0571357c7a10
-
SHA512
a2c69cbbf3d3cc1dc919b2ba8815d8b12ca15788e11b163194d61576fdc4cbaa2a3216d01f61d7e0d0de5c30540436c6764918694e00040304e4cf160f902eb8
-
SSDEEP
3072:khOmTsF93UYfwC6GIoutpYcvrqrE6ddWR:kcm4FmowdHoSphra/6
Malware Config
Signatures
-
Detect Blackmoon payload 50 IoCs
Processes:
resource yara_rule behavioral1/memory/612-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/612-15-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2924-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-28-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2840-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3004-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/772-66-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2536-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/632-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2388-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1484-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2496-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2304-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1764-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2404-147-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/900-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2208-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1264-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/928-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2464-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/640-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2588-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/612-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1732-329-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1732-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2760-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2116-392-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3036-406-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2064-413-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/832-445-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2484-471-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2424-478-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/700-505-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/700-504-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/952-508-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/592-519-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1564-551-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/3008-621-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2536-665-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2192-781-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2260-805-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1552-813-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1760-845-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/584-846-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1520-1142-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2164-1390-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2584-1437-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lbdhj.exeddnxpp.exexlplp.exexpnxld.exejrlljvx.exelltdtl.exetnvxjj.exetbbbdj.exehnbxlp.exenlfjl.exepvnfd.exebxbph.exethlfnx.exenxlvdjx.exehlblhn.exevttlvtx.exehxlhbh.exefhxbvlf.exetfrfj.exepplnx.exepbjtnj.exelnhjrf.exexptdjhv.exevrnfl.exexhpvl.exebjxvjld.exebxtfljf.exedptbjhx.exedrrhjnl.exehjfvfp.exebphbx.exerntvd.exefxldfnr.exevlrdth.exetptnr.exexjpnrtv.exejvdlhvt.exetllrpx.exexrlxxph.exexhjllf.exexdldl.exerxfdx.exenndxrnj.exenrxtjf.exedxjrtbp.exefxprhnb.exerpddn.exehxhhxdn.exevlbltrx.exevvhtnr.exevjhjpll.exejfxbtnx.exerbvjpr.exerdxbhj.exepfprlxf.exeftbtlp.exexnxvdr.exednbblh.exerpxvf.exehdrfxtv.exehnxhfnh.exebpdlpx.exexfpvxn.exerjjjhx.exepid process 612 lbdhj.exe 2840 ddnxpp.exe 2800 xlplp.exe 3004 xpnxld.exe 2900 jrlljvx.exe 772 lltdtl.exe 2536 tnvxjj.exe 632 tbbbdj.exe 2388 hnbxlp.exe 1484 nlfjl.exe 2496 pvnfd.exe 2916 bxbph.exe 2304 thlfnx.exe 1764 nxlvdjx.exe 2404 hlblhn.exe 900 vttlvtx.exe 1684 hxlhbh.exe 2208 fhxbvlf.exe 1264 tfrfj.exe 928 pplnx.exe 2360 pbjtnj.exe 2464 lnhjrf.exe 1056 xptdjhv.exe 2524 vrnfl.exe 1572 xhpvl.exe 2180 bjxvjld.exe 640 bxtfljf.exe 1724 dptbjhx.exe 1936 drrhjnl.exe 528 hjfvfp.exe 1060 bphbx.exe 1492 rntvd.exe 2588 fxldfnr.exe 864 vlrdth.exe 2736 tptnr.exe 612 xjpnrtv.exe 2872 jvdlhvt.exe 1732 tllrpx.exe 2268 xrlxxph.exe 2760 xhjllf.exe 2824 xdldl.exe 2684 rxfdx.exe 2648 nndxrnj.exe 772 nrxtjf.exe 2812 dxjrtbp.exe 2392 fxprhnb.exe 2116 rpddn.exe 1344 hxhhxdn.exe 3036 vlbltrx.exe 2064 vvhtnr.exe 2820 vjhjpll.exe 2964 jfxbtnx.exe 2348 rbvjpr.exe 2136 rdxbhj.exe 832 pfprlxf.exe 2012 ftbtlp.exe 368 xnxvdr.exe 1676 dnbblh.exe 2484 rpxvf.exe 2424 hdrfxtv.exe 2216 hnxhfnh.exe 928 bpdlpx.exe 2360 xfpvxn.exe 700 rjjjhx.exe -
Processes:
resource yara_rule behavioral1/memory/2924-0-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lbdhj.exe upx behavioral1/memory/612-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2924-10-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddnxpp.exe upx behavioral1/memory/2800-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2840-30-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlplp.exe upx behavioral1/memory/2800-39-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xpnxld.exe upx C:\jrlljvx.exe upx behavioral1/memory/3004-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2900-50-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lltdtl.exe upx C:\tnvxjj.exe upx behavioral1/memory/2536-76-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tbbbdj.exe upx C:\hnbxlp.exe upx behavioral1/memory/632-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2388-94-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nlfjl.exe upx behavioral1/memory/1484-103-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/memory/2496-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1484-105-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pvnfd.exe upx behavioral1/memory/2496-114-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bxbph.exe upx C:\thlfnx.exe upx behavioral1/memory/2304-131-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nxlvdjx.exe upx C:\hlblhn.exe upx behavioral1/memory/1764-139-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vttlvtx.exe upx C:\hxlhbh.exe upx behavioral1/memory/900-158-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fhxbvlf.exe upx behavioral1/memory/2208-174-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tfrfj.exe upx C:\pplnx.exe upx behavioral1/memory/1264-183-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pbjtnj.exe upx behavioral1/memory/928-192-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lnhjrf.exe upx behavioral1/memory/2464-210-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xptdjhv.exe upx C:\vrnfl.exe upx C:\xhpvl.exe upx behavioral1/memory/2524-227-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bjxvjld.exe upx C:\bxtfljf.exe upx behavioral1/memory/640-252-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dptbjhx.exe upx C:\drrhjnl.exe upx behavioral1/memory/528-270-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hjfvfp.exe upx C:\bphbx.exe upx C:\rntvd.exe upx behavioral1/memory/1492-287-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2588-301-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/612-320-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1732-334-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2760-347-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/772-366-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2812-379-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
bnlfplr.exefhdjhp.exetfrfj.exevtlpxr.exedplltfl.exebtxvvbh.exernfvhp.exehjjbx.exefdtpjf.exedjdhth.exenndxrnj.exexdxtb.exehlrfvrr.exeftlhrp.exefptdr.exefjdfvr.exevvhtnr.exedndrdx.exepffdrj.exedxbvn.exeppnndfv.exepfbrll.exefppvnlv.exetfrhp.exervxdvpn.exernxrpf.exevbpbll.exetpdnp.exexxhxjlb.exednnxxf.exenhhppr.exethbbnlp.exeprtnj.exejxplppl.exetnnnjtd.exethlxdv.exednnxvd.exelhjphnp.exettnpf.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnlfplr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhdjhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfrfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtlpxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dplltfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btxvvbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnfvhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjjbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdtpjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nndxrnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdxtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlrfvrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftlhrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fptdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjdfvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvhtnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dndrdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pffdrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxbvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppnndfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfbrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fppvnlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfrhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvxdvpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnxrpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbpbll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpdnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxhxjlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnnxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhppr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbbnlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prtnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxplppl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnjtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thlxdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnnxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhjphnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
93b61e568b02cf9dfc98bf093f145070N.exelbdhj.exeddnxpp.exexlplp.exexpnxld.exejrlljvx.exelltdtl.exetnvxjj.exetbbbdj.exehnbxlp.exenlfjl.exepvnfd.exebxbph.exethlfnx.exenxlvdjx.exehlblhn.exedescription pid process target process PID 2924 wrote to memory of 612 2924 93b61e568b02cf9dfc98bf093f145070N.exe lbdhj.exe PID 2924 wrote to memory of 612 2924 93b61e568b02cf9dfc98bf093f145070N.exe lbdhj.exe PID 2924 wrote to memory of 612 2924 93b61e568b02cf9dfc98bf093f145070N.exe lbdhj.exe PID 2924 wrote to memory of 612 2924 93b61e568b02cf9dfc98bf093f145070N.exe lbdhj.exe PID 612 wrote to memory of 2840 612 lbdhj.exe ddnxpp.exe PID 612 wrote to memory of 2840 612 lbdhj.exe ddnxpp.exe PID 612 wrote to memory of 2840 612 lbdhj.exe ddnxpp.exe PID 612 wrote to memory of 2840 612 lbdhj.exe ddnxpp.exe PID 2840 wrote to memory of 2800 2840 ddnxpp.exe xlplp.exe PID 2840 wrote to memory of 2800 2840 ddnxpp.exe xlplp.exe PID 2840 wrote to memory of 2800 2840 ddnxpp.exe xlplp.exe PID 2840 wrote to memory of 2800 2840 ddnxpp.exe xlplp.exe PID 2800 wrote to memory of 3004 2800 xlplp.exe xpnxld.exe PID 2800 wrote to memory of 3004 2800 xlplp.exe xpnxld.exe PID 2800 wrote to memory of 3004 2800 xlplp.exe xpnxld.exe PID 2800 wrote to memory of 3004 2800 xlplp.exe xpnxld.exe PID 3004 wrote to memory of 2900 3004 xpnxld.exe jrlljvx.exe PID 3004 wrote to memory of 2900 3004 xpnxld.exe jrlljvx.exe PID 3004 wrote to memory of 2900 3004 xpnxld.exe jrlljvx.exe PID 3004 wrote to memory of 2900 3004 xpnxld.exe jrlljvx.exe PID 2900 wrote to memory of 772 2900 jrlljvx.exe lltdtl.exe PID 2900 wrote to memory of 772 2900 jrlljvx.exe lltdtl.exe PID 2900 wrote to memory of 772 2900 jrlljvx.exe lltdtl.exe PID 2900 wrote to memory of 772 2900 jrlljvx.exe lltdtl.exe PID 772 wrote to memory of 2536 772 lltdtl.exe tnvxjj.exe PID 772 wrote to memory of 2536 772 lltdtl.exe tnvxjj.exe PID 772 wrote to memory of 2536 772 lltdtl.exe tnvxjj.exe PID 772 wrote to memory of 2536 772 lltdtl.exe tnvxjj.exe PID 2536 wrote to memory of 632 2536 tnvxjj.exe tbbbdj.exe PID 2536 wrote to memory of 632 2536 tnvxjj.exe tbbbdj.exe PID 2536 wrote to memory of 632 2536 tnvxjj.exe tbbbdj.exe PID 2536 wrote to memory of 632 2536 tnvxjj.exe tbbbdj.exe PID 632 wrote to memory of 2388 632 tbbbdj.exe hnbxlp.exe PID 632 wrote to memory of 2388 632 tbbbdj.exe hnbxlp.exe PID 632 wrote to memory of 2388 632 tbbbdj.exe hnbxlp.exe PID 632 wrote to memory of 2388 632 tbbbdj.exe hnbxlp.exe PID 2388 wrote to memory of 1484 2388 hnbxlp.exe nlfjl.exe PID 2388 wrote to memory of 1484 2388 hnbxlp.exe nlfjl.exe PID 2388 wrote to memory of 1484 2388 hnbxlp.exe nlfjl.exe PID 2388 wrote to memory of 1484 2388 hnbxlp.exe nlfjl.exe PID 1484 wrote to memory of 2496 1484 nlfjl.exe pvnfd.exe PID 1484 wrote to memory of 2496 1484 nlfjl.exe pvnfd.exe PID 1484 wrote to memory of 2496 1484 nlfjl.exe pvnfd.exe PID 1484 wrote to memory of 2496 1484 nlfjl.exe pvnfd.exe PID 2496 wrote to memory of 2916 2496 pvnfd.exe bxbph.exe PID 2496 wrote to memory of 2916 2496 pvnfd.exe bxbph.exe PID 2496 wrote to memory of 2916 2496 pvnfd.exe bxbph.exe PID 2496 wrote to memory of 2916 2496 pvnfd.exe bxbph.exe PID 2916 wrote to memory of 2304 2916 bxbph.exe thlfnx.exe PID 2916 wrote to memory of 2304 2916 bxbph.exe thlfnx.exe PID 2916 wrote to memory of 2304 2916 bxbph.exe thlfnx.exe PID 2916 wrote to memory of 2304 2916 bxbph.exe thlfnx.exe PID 2304 wrote to memory of 1764 2304 thlfnx.exe nxlvdjx.exe PID 2304 wrote to memory of 1764 2304 thlfnx.exe nxlvdjx.exe PID 2304 wrote to memory of 1764 2304 thlfnx.exe nxlvdjx.exe PID 2304 wrote to memory of 1764 2304 thlfnx.exe nxlvdjx.exe PID 1764 wrote to memory of 2404 1764 nxlvdjx.exe hlblhn.exe PID 1764 wrote to memory of 2404 1764 nxlvdjx.exe hlblhn.exe PID 1764 wrote to memory of 2404 1764 nxlvdjx.exe hlblhn.exe PID 1764 wrote to memory of 2404 1764 nxlvdjx.exe hlblhn.exe PID 2404 wrote to memory of 900 2404 hlblhn.exe vttlvtx.exe PID 2404 wrote to memory of 900 2404 hlblhn.exe vttlvtx.exe PID 2404 wrote to memory of 900 2404 hlblhn.exe vttlvtx.exe PID 2404 wrote to memory of 900 2404 hlblhn.exe vttlvtx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\93b61e568b02cf9dfc98bf093f145070N.exe"C:\Users\Admin\AppData\Local\Temp\93b61e568b02cf9dfc98bf093f145070N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\lbdhj.exec:\lbdhj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:612 -
\??\c:\ddnxpp.exec:\ddnxpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\xlplp.exec:\xlplp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\xpnxld.exec:\xpnxld.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\jrlljvx.exec:\jrlljvx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\lltdtl.exec:\lltdtl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\tnvxjj.exec:\tnvxjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\tbbbdj.exec:\tbbbdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\hnbxlp.exec:\hnbxlp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\nlfjl.exec:\nlfjl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\pvnfd.exec:\pvnfd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\bxbph.exec:\bxbph.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\thlfnx.exec:\thlfnx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\nxlvdjx.exec:\nxlvdjx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\hlblhn.exec:\hlblhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\vttlvtx.exec:\vttlvtx.exe17⤵
- Executes dropped EXE
PID:900 -
\??\c:\hxlhbh.exec:\hxlhbh.exe18⤵
- Executes dropped EXE
PID:1684 -
\??\c:\fhxbvlf.exec:\fhxbvlf.exe19⤵
- Executes dropped EXE
PID:2208 -
\??\c:\tfrfj.exec:\tfrfj.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1264 -
\??\c:\pplnx.exec:\pplnx.exe21⤵
- Executes dropped EXE
PID:928 -
\??\c:\pbjtnj.exec:\pbjtnj.exe22⤵
- Executes dropped EXE
PID:2360 -
\??\c:\lnhjrf.exec:\lnhjrf.exe23⤵
- Executes dropped EXE
PID:2464 -
\??\c:\xptdjhv.exec:\xptdjhv.exe24⤵
- Executes dropped EXE
PID:1056 -
\??\c:\vrnfl.exec:\vrnfl.exe25⤵
- Executes dropped EXE
PID:2524 -
\??\c:\xhpvl.exec:\xhpvl.exe26⤵
- Executes dropped EXE
PID:1572 -
\??\c:\bjxvjld.exec:\bjxvjld.exe27⤵
- Executes dropped EXE
PID:2180 -
\??\c:\bxtfljf.exec:\bxtfljf.exe28⤵
- Executes dropped EXE
PID:640 -
\??\c:\dptbjhx.exec:\dptbjhx.exe29⤵
- Executes dropped EXE
PID:1724 -
\??\c:\drrhjnl.exec:\drrhjnl.exe30⤵
- Executes dropped EXE
PID:1936 -
\??\c:\hjfvfp.exec:\hjfvfp.exe31⤵
- Executes dropped EXE
PID:528 -
\??\c:\bphbx.exec:\bphbx.exe32⤵
- Executes dropped EXE
PID:1060 -
\??\c:\rntvd.exec:\rntvd.exe33⤵
- Executes dropped EXE
PID:1492 -
\??\c:\fxldfnr.exec:\fxldfnr.exe34⤵
- Executes dropped EXE
PID:2588 -
\??\c:\vlrdth.exec:\vlrdth.exe35⤵
- Executes dropped EXE
PID:864 -
\??\c:\tptnr.exec:\tptnr.exe36⤵
- Executes dropped EXE
PID:2736 -
\??\c:\xjpnrtv.exec:\xjpnrtv.exe37⤵
- Executes dropped EXE
PID:612 -
\??\c:\jvdlhvt.exec:\jvdlhvt.exe38⤵
- Executes dropped EXE
PID:2872 -
\??\c:\tllrpx.exec:\tllrpx.exe39⤵
- Executes dropped EXE
PID:1732 -
\??\c:\xrlxxph.exec:\xrlxxph.exe40⤵
- Executes dropped EXE
PID:2268 -
\??\c:\xhjllf.exec:\xhjllf.exe41⤵
- Executes dropped EXE
PID:2760 -
\??\c:\xdldl.exec:\xdldl.exe42⤵
- Executes dropped EXE
PID:2824 -
\??\c:\rxfdx.exec:\rxfdx.exe43⤵
- Executes dropped EXE
PID:2684 -
\??\c:\nndxrnj.exec:\nndxrnj.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2648 -
\??\c:\nrxtjf.exec:\nrxtjf.exe45⤵
- Executes dropped EXE
PID:772 -
\??\c:\dxjrtbp.exec:\dxjrtbp.exe46⤵
- Executes dropped EXE
PID:2812 -
\??\c:\fxprhnb.exec:\fxprhnb.exe47⤵
- Executes dropped EXE
PID:2392 -
\??\c:\rpddn.exec:\rpddn.exe48⤵
- Executes dropped EXE
PID:2116 -
\??\c:\hxhhxdn.exec:\hxhhxdn.exe49⤵
- Executes dropped EXE
PID:1344 -
\??\c:\vlbltrx.exec:\vlbltrx.exe50⤵
- Executes dropped EXE
PID:3036 -
\??\c:\vvhtnr.exec:\vvhtnr.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2064 -
\??\c:\vjhjpll.exec:\vjhjpll.exe52⤵
- Executes dropped EXE
PID:2820 -
\??\c:\jfxbtnx.exec:\jfxbtnx.exe53⤵
- Executes dropped EXE
PID:2964 -
\??\c:\rbvjpr.exec:\rbvjpr.exe54⤵
- Executes dropped EXE
PID:2348 -
\??\c:\rdxbhj.exec:\rdxbhj.exe55⤵
- Executes dropped EXE
PID:2136 -
\??\c:\pfprlxf.exec:\pfprlxf.exe56⤵
- Executes dropped EXE
PID:832 -
\??\c:\ftbtlp.exec:\ftbtlp.exe57⤵
- Executes dropped EXE
PID:2012 -
\??\c:\xnxvdr.exec:\xnxvdr.exe58⤵
- Executes dropped EXE
PID:368 -
\??\c:\dnbblh.exec:\dnbblh.exe59⤵
- Executes dropped EXE
PID:1676 -
\??\c:\rpxvf.exec:\rpxvf.exe60⤵
- Executes dropped EXE
PID:2484 -
\??\c:\hdrfxtv.exec:\hdrfxtv.exe61⤵
- Executes dropped EXE
PID:2424 -
\??\c:\hnxhfnh.exec:\hnxhfnh.exe62⤵
- Executes dropped EXE
PID:2216 -
\??\c:\bpdlpx.exec:\bpdlpx.exe63⤵
- Executes dropped EXE
PID:928 -
\??\c:\xfpvxn.exec:\xfpvxn.exe64⤵
- Executes dropped EXE
PID:2360 -
\??\c:\rjjjhx.exec:\rjjjhx.exe65⤵
- Executes dropped EXE
PID:700 -
\??\c:\pvdvdpp.exec:\pvdvdpp.exe66⤵PID:952
-
\??\c:\thxrdrl.exec:\thxrdrl.exe67⤵PID:592
-
\??\c:\fhfpfpn.exec:\fhfpfpn.exe68⤵PID:1548
-
\??\c:\jhpdbh.exec:\jhpdbh.exe69⤵PID:1572
-
\??\c:\hrffp.exec:\hrffp.exe70⤵PID:1232
-
\??\c:\pxlft.exec:\pxlft.exe71⤵PID:2340
-
\??\c:\xxhxjlb.exec:\xxhxjlb.exe72⤵
- System Location Discovery: System Language Discovery
PID:1564 -
\??\c:\jltpjl.exec:\jltpjl.exe73⤵PID:1888
-
\??\c:\xjlfjr.exec:\xjlfjr.exe74⤵PID:1976
-
\??\c:\lxpldpn.exec:\lxpldpn.exe75⤵PID:1756
-
\??\c:\bbpxr.exec:\bbpxr.exe76⤵PID:580
-
\??\c:\dpjpr.exec:\dpjpr.exe77⤵PID:3068
-
\??\c:\rptvlv.exec:\rptvlv.exe78⤵PID:1492
-
\??\c:\nfbjd.exec:\nfbjd.exe79⤵PID:2552
-
\??\c:\vhbbf.exec:\vhbbf.exe80⤵PID:2320
-
\??\c:\nprxff.exec:\nprxff.exe81⤵PID:2332
-
\??\c:\dvpvht.exec:\dvpvht.exe82⤵PID:2852
-
\??\c:\pnftltx.exec:\pnftltx.exe83⤵PID:2748
-
\??\c:\frvrfbt.exec:\frvrfbt.exe84⤵PID:3008
-
\??\c:\lblrl.exec:\lblrl.exe85⤵PID:2336
-
\??\c:\jvfljt.exec:\jvfljt.exe86⤵PID:588
-
\??\c:\hjtvr.exec:\hjtvr.exe87⤵PID:2744
-
\??\c:\nfhrf.exec:\nfhrf.exe88⤵PID:2816
-
\??\c:\vhxtfxl.exec:\vhxtfxl.exe89⤵PID:2664
-
\??\c:\hlpndb.exec:\hlpndb.exe90⤵PID:1632
-
\??\c:\pnxxh.exec:\pnxxh.exe91⤵PID:2536
-
\??\c:\txxhlh.exec:\txxhlh.exe92⤵PID:2080
-
\??\c:\lxxpbr.exec:\lxxpbr.exe93⤵PID:2432
-
\??\c:\lxnphvd.exec:\lxnphvd.exe94⤵PID:3032
-
\??\c:\jltxtp.exec:\jltxtp.exe95⤵PID:2176
-
\??\c:\lppph.exec:\lppph.exe96⤵PID:3036
-
\??\c:\rvtfj.exec:\rvtfj.exe97⤵PID:2492
-
\??\c:\dthlvvf.exec:\dthlvvf.exe98⤵PID:2916
-
\??\c:\pvjdfpn.exec:\pvjdfpn.exe99⤵PID:2304
-
\??\c:\hnnft.exec:\hnnft.exe100⤵PID:1996
-
\??\c:\vbvlx.exec:\vbvlx.exe101⤵PID:2416
-
\??\c:\jbtdbpb.exec:\jbtdbpb.exe102⤵PID:2404
-
\??\c:\rhfhjj.exec:\rhfhjj.exe103⤵PID:2132
-
\??\c:\ppblph.exec:\ppblph.exe104⤵PID:2036
-
\??\c:\hdrddhp.exec:\hdrddhp.exe105⤵PID:2192
-
\??\c:\ddjjjtx.exec:\ddjjjtx.exe106⤵PID:2324
-
\??\c:\tlpvl.exec:\tlpvl.exe107⤵PID:2456
-
\??\c:\thrtdbt.exec:\thrtdbt.exe108⤵PID:2224
-
\??\c:\fftvh.exec:\fftvh.exe109⤵PID:2828
-
\??\c:\xdxtb.exec:\xdxtb.exe110⤵
- System Location Discovery: System Language Discovery
PID:2032 -
\??\c:\tjbptr.exec:\tjbptr.exe111⤵PID:1068
-
\??\c:\dlnpbn.exec:\dlnpbn.exe112⤵PID:1528
-
\??\c:\hldfv.exec:\hldfv.exe113⤵PID:2260
-
\??\c:\fxhvl.exec:\fxhvl.exe114⤵PID:1552
-
\??\c:\fxbnxv.exec:\fxbnxv.exe115⤵PID:1436
-
\??\c:\lpbtttb.exec:\lpbtttb.exe116⤵PID:1232
-
\??\c:\bxxjl.exec:\bxxjl.exe117⤵PID:2340
-
\??\c:\bpfjd.exec:\bpfjd.exe118⤵PID:1724
-
\??\c:\jjlhppl.exec:\jjlhppl.exe119⤵PID:1760
-
\??\c:\ndbfnfx.exec:\ndbfnfx.exe120⤵PID:584
-
\??\c:\jddhllr.exec:\jddhllr.exe121⤵PID:2160
-
\??\c:\fllpxh.exec:\fllpxh.exe122⤵PID:2724
-
\??\c:\pbptjpd.exec:\pbptjpd.exe123⤵PID:2124
-
\??\c:\vjdbx.exec:\vjdbx.exe124⤵PID:1052
-
\??\c:\hrlfb.exec:\hrlfb.exe125⤵PID:2844
-
\??\c:\npfjr.exec:\npfjr.exe126⤵PID:2868
-
\??\c:\rtvtt.exec:\rtvtt.exe127⤵PID:2332
-
\??\c:\hdtfjh.exec:\hdtfjh.exe128⤵PID:2796
-
\??\c:\dhppr.exec:\dhppr.exe129⤵PID:2880
-
\??\c:\nthrhpx.exec:\nthrhpx.exe130⤵PID:2268
-
\??\c:\nhnfjj.exec:\nhnfjj.exe131⤵PID:2760
-
\??\c:\htbxdj.exec:\htbxdj.exe132⤵PID:776
-
\??\c:\fpbbfr.exec:\fpbbfr.exe133⤵PID:2684
-
\??\c:\xdxvjvh.exec:\xdxvjvh.exe134⤵PID:2816
-
\??\c:\dnhrr.exec:\dnhrr.exe135⤵PID:976
-
\??\c:\jnhffh.exec:\jnhffh.exe136⤵PID:1824
-
\??\c:\llvddjn.exec:\llvddjn.exe137⤵PID:868
-
\??\c:\jnhxttr.exec:\jnhxttr.exe138⤵PID:1020
-
\??\c:\vfjttp.exec:\vfjttp.exe139⤵PID:980
-
\??\c:\dxxdl.exec:\dxxdl.exe140⤵PID:1636
-
\??\c:\hbnjp.exec:\hbnjp.exe141⤵PID:1740
-
\??\c:\xltlhr.exec:\xltlhr.exe142⤵PID:2496
-
\??\c:\frxlx.exec:\frxlx.exe143⤵PID:1112
-
\??\c:\lhlpvnj.exec:\lhlpvnj.exe144⤵PID:2704
-
\??\c:\jvbbhb.exec:\jvbbhb.exe145⤵PID:2912
-
\??\c:\fppvnlv.exec:\fppvnlv.exe146⤵
- System Location Discovery: System Language Discovery
PID:2400 -
\??\c:\dpvpvx.exec:\dpvpvx.exe147⤵PID:2416
-
\??\c:\xxxtb.exec:\xxxtb.exe148⤵PID:1500
-
\??\c:\tdrntp.exec:\tdrntp.exe149⤵PID:1712
-
\??\c:\dxhttv.exec:\dxhttv.exe150⤵PID:900
-
\??\c:\bbhnj.exec:\bbhnj.exe151⤵PID:2264
-
\??\c:\thflth.exec:\thflth.exe152⤵PID:2488
-
\??\c:\bfdfpd.exec:\bfdfpd.exe153⤵PID:2220
-
\??\c:\frvbxll.exec:\frvbxll.exe154⤵PID:108
-
\??\c:\fhhtdbh.exec:\fhhtdbh.exe155⤵PID:2976
-
\??\c:\bbjpdlb.exec:\bbjpdlb.exe156⤵PID:472
-
\??\c:\ttbxph.exec:\ttbxph.exe157⤵PID:1056
-
\??\c:\phttj.exec:\phttj.exe158⤵PID:1328
-
\??\c:\hrxxttx.exec:\hrxxttx.exe159⤵PID:2088
-
\??\c:\xdrxvjr.exec:\xdrxvjr.exe160⤵PID:1556
-
\??\c:\xjvnj.exec:\xjvnj.exe161⤵PID:2164
-
\??\c:\dpnrtt.exec:\dpnrtt.exe162⤵PID:640
-
\??\c:\jxxxd.exec:\jxxxd.exe163⤵PID:1840
-
\??\c:\ndhlx.exec:\ndhlx.exe164⤵PID:1640
-
\??\c:\njfhp.exec:\njfhp.exe165⤵PID:2532
-
\??\c:\lddnjb.exec:\lddnjb.exe166⤵PID:2396
-
\??\c:\tlbnndn.exec:\tlbnndn.exe167⤵PID:596
-
\??\c:\pxnnl.exec:\pxnnl.exe168⤵PID:1520
-
\??\c:\fhffxvp.exec:\fhffxvp.exe169⤵PID:2728
-
\??\c:\pfbpbl.exec:\pfbpbl.exe170⤵PID:2928
-
\??\c:\phpttp.exec:\phpttp.exe171⤵PID:864
-
\??\c:\hfrpv.exec:\hfrpv.exe172⤵PID:2832
-
\??\c:\tdhbtjx.exec:\tdhbtjx.exe173⤵PID:2296
-
\??\c:\nxjdnbx.exec:\nxjdnbx.exe174⤵PID:2852
-
\??\c:\fpjjfbl.exec:\fpjjfbl.exe175⤵PID:2776
-
\??\c:\nvltn.exec:\nvltn.exe176⤵PID:2800
-
\??\c:\rdltx.exec:\rdltx.exe177⤵PID:2336
-
\??\c:\nnvrxv.exec:\nnvrxv.exe178⤵PID:588
-
\??\c:\rhjtfrt.exec:\rhjtfrt.exe179⤵PID:2744
-
\??\c:\ntpfn.exec:\ntpfn.exe180⤵PID:2900
-
\??\c:\dplltfl.exec:\dplltfl.exe181⤵
- System Location Discovery: System Language Discovery
PID:2664 -
\??\c:\bxxbt.exec:\bxxbt.exe182⤵PID:1632
-
\??\c:\jrlpfhj.exec:\jrlpfhj.exe183⤵PID:1664
-
\??\c:\prvtv.exec:\prvtv.exe184⤵PID:2392
-
\??\c:\blbbf.exec:\blbbf.exe185⤵PID:3024
-
\??\c:\njxfxnx.exec:\njxfxnx.exe186⤵PID:2732
-
\??\c:\hlrfvrr.exec:\hlrfvrr.exe187⤵
- System Location Discovery: System Language Discovery
PID:1752 -
\??\c:\lvhpxfh.exec:\lvhpxfh.exe188⤵PID:2908
-
\??\c:\bxljn.exec:\bxljn.exe189⤵PID:2820
-
\??\c:\rjnnpt.exec:\rjnnpt.exe190⤵PID:2964
-
\??\c:\npxbd.exec:\npxbd.exe191⤵PID:1216
-
\??\c:\btfvj.exec:\btfvj.exe192⤵PID:1876
-
\??\c:\jxtjn.exec:\jxtjn.exe193⤵PID:1996
-
\??\c:\xhpbnxf.exec:\xhpbnxf.exe194⤵PID:2012
-
\??\c:\pjtdxx.exec:\pjtdxx.exe195⤵PID:2148
-
\??\c:\htbvlhj.exec:\htbvlhj.exe196⤵PID:2212
-
\??\c:\thpvrx.exec:\thpvrx.exe197⤵PID:2208
-
\??\c:\htxrlv.exec:\htxrlv.exe198⤵PID:2204
-
\??\c:\xhxvj.exec:\xhxvj.exe199⤵PID:2428
-
\??\c:\vbpbll.exec:\vbpbll.exe200⤵
- System Location Discovery: System Language Discovery
PID:2244 -
\??\c:\htlfxj.exec:\htlfxj.exe201⤵PID:560
-
\??\c:\lhjphnp.exec:\lhjphnp.exe202⤵
- System Location Discovery: System Language Discovery
PID:2464 -
\??\c:\bnhfdb.exec:\bnhfdb.exe203⤵PID:1808
-
\??\c:\hllhllv.exec:\hllhllv.exe204⤵PID:288
-
\??\c:\pnhbdlb.exec:\pnhbdlb.exe205⤵PID:3052
-
\??\c:\prpvdr.exec:\prpvdr.exe206⤵PID:956
-
\??\c:\fnvjljh.exec:\fnvjljh.exe207⤵PID:2568
-
\??\c:\fvrfdpn.exec:\fvrfdpn.exe208⤵PID:2164
-
\??\c:\dtlxfbt.exec:\dtlxfbt.exe209⤵PID:640
-
\??\c:\xpffdf.exec:\xpffdf.exe210⤵PID:2316
-
\??\c:\hjphjvr.exec:\hjphjvr.exe211⤵PID:1888
-
\??\c:\tnnvf.exec:\tnnvf.exe212⤵PID:1976
-
\??\c:\xxxpvbv.exec:\xxxpvbv.exe213⤵PID:1692
-
\??\c:\fdtpjf.exec:\fdtpjf.exe214⤵
- System Location Discovery: System Language Discovery
PID:2344 -
\??\c:\ddlhft.exec:\ddlhft.exe215⤵PID:2584
-
\??\c:\jbnhtvr.exec:\jbnhtvr.exe216⤵PID:1052
-
\??\c:\nbjjdv.exec:\nbjjdv.exe217⤵PID:2844
-
\??\c:\prrvdn.exec:\prrvdn.exe218⤵PID:2788
-
\??\c:\xxndpfn.exec:\xxndpfn.exe219⤵PID:612
-
\??\c:\xrlldnh.exec:\xrlldnh.exe220⤵PID:2840
-
\??\c:\xfpdtjf.exec:\xfpdtjf.exe221⤵PID:1732
-
\??\c:\hvvjdth.exec:\hvvjdth.exe222⤵PID:2800
-
\??\c:\tjhnjv.exec:\tjhnjv.exe223⤵PID:2336
-
\??\c:\xnxhxp.exec:\xnxhxp.exe224⤵PID:2824
-
\??\c:\bndpvbb.exec:\bndpvbb.exe225⤵PID:2808
-
\??\c:\pffdrj.exec:\pffdrj.exe226⤵
- System Location Discovery: System Language Discovery
PID:2720 -
\??\c:\pvrxd.exec:\pvrxd.exe227⤵PID:2656
-
\??\c:\rfnlb.exec:\rfnlb.exe228⤵PID:840
-
\??\c:\brtxvrd.exec:\brtxvrd.exe229⤵PID:2536
-
\??\c:\btflpp.exec:\btflpp.exe230⤵PID:576
-
\??\c:\rphjd.exec:\rphjd.exe231⤵PID:2080
-
\??\c:\pbndjr.exec:\pbndjr.exe232⤵PID:2432
-
\??\c:\tfxvpt.exec:\tfxvpt.exe233⤵PID:3032
-
\??\c:\pvxvrnr.exec:\pvxvrnr.exe234⤵PID:2176
-
\??\c:\pphxnhd.exec:\pphxnhd.exe235⤵PID:2544
-
\??\c:\lpllvpd.exec:\lpllvpd.exe236⤵PID:2964
-
\??\c:\llrflrp.exec:\llrflrp.exe237⤵PID:1216
-
\??\c:\xdbnnlf.exec:\xdbnnlf.exe238⤵PID:1876
-
\??\c:\lxnhxtd.exec:\lxnhxtd.exe239⤵PID:2988
-
\??\c:\thrnnp.exec:\thrnnp.exe240⤵PID:2020
-
\??\c:\phdthtp.exec:\phdthtp.exe241⤵PID:368
-
\??\c:\xrpbnv.exec:\xrpbnv.exe242⤵PID:1684