Analysis
-
max time kernel
61s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27-07-2024 07:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a633495e6684992e6c4097c18edb3d60N.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
120 seconds
General
-
Target
a633495e6684992e6c4097c18edb3d60N.exe
-
Size
410KB
-
MD5
a633495e6684992e6c4097c18edb3d60
-
SHA1
0627cc9702224ecc307b0f378f3107e701e479ee
-
SHA256
148241a5861a5b580f361d8adcd2bd5d364a386604fe018cd8e9aa54700693f9
-
SHA512
30fe8d8b839df8b696b7437688f6d9233b3f03497b4f8a9a1e1e1b9ae5cb487b1c40622f01b7fbe34953de8ff26b2ab0a92cd64cffbe14d9dc7804ec6db6494f
-
SSDEEP
3072:PhOm2sI93UufdC67cihfmCiiiXAsACF486jJSp1Bwcs:Pcm7ImGddXtWrXD486jJq1Bwcs
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3296-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2840-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3452-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/264-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4540-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3944-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1532-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2956-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/740-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4948-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4068-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3276-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4208-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3884-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3540-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1928-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1936-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2212-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1008-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1400-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1356-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3404-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/636-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2232-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/224-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2752-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3748-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1944-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2956-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3816-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2416-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1856-305-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4372-309-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3928-314-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/648-327-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2768-335-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3152-350-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3764-382-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1292-408-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2292-415-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3236-431-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2664-438-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3232-442-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/372-462-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4440-466-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/736-483-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/736-487-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-506-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2476-510-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/964-562-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1224-588-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-589-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/736-611-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2332-625-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1044-690-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2304-696-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1632-843-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1152-913-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
dpdjj.exefxlfxll.exerlrrxff.exelrxrflr.exeffrrrxf.exebhbbnb.exefflrrlx.exe9flrxll.exehntttt.exe3flrfxf.exepjjjv.exepjjpj.exenntthn.exefxxflrf.exevjdjj.exerxffrfr.exebhhhhh.exebtbnth.exebnnhbt.exeppddd.exexxlfxff.exethtnnt.exebnhnbh.exe7lffrfl.exexfrxfll.exe1nbnbb.exejjppd.exexflflxf.exeffrrxxf.exexfrllrl.exepdjvp.exe9jpvv.exejpdpd.exehhhnhb.exejvjpp.exennhhnn.exetnbhbh.exefxrxffl.exerfffxfl.exe7vdpp.exejddpj.exexfxffff.exehbnttn.exerrfrrxf.exeflffxll.exefrlxfrl.exelxfxrlr.exeddpdp.exepvpdj.exebhttbn.exerllrrrf.exeffrfrff.exerxflfxl.exe1vvvd.exejpdpp.exeflfffff.exejjdjj.exetnhtbn.exe3vddp.exejdpvj.exehbbhbt.exehttnnn.exebtttht.exebhnnbt.exepid process 2840 dpdjj.exe 264 fxlfxll.exe 3452 rlrrxff.exe 4540 lrxrflr.exe 3944 ffrrrxf.exe 1532 bhbbnb.exe 2956 fflrrlx.exe 740 9flrxll.exe 4948 hntttt.exe 4068 3flrfxf.exe 4208 pjjjv.exe 3884 pjjpj.exe 3276 nntthn.exe 3972 fxxflrf.exe 1928 vjdjj.exe 3540 rxffrfr.exe 2212 bhhhhh.exe 1936 btbnth.exe 1008 bnnhbt.exe 1400 ppddd.exe 5116 xxlfxff.exe 1356 thtnnt.exe 2364 bnhnbh.exe 3760 7lffrfl.exe 3404 xfrxfll.exe 636 1nbnbb.exe 4004 jjppd.exe 4128 xflflxf.exe 3664 ffrrxxf.exe 4772 xfrllrl.exe 1268 pdjvp.exe 2620 9jpvv.exe 2232 jpdpd.exe 4440 hhhnhb.exe 4084 jvjpp.exe 372 nnhhnn.exe 224 tnbhbh.exe 2752 fxrxffl.exe 3748 rfffxfl.exe 4480 7vdpp.exe 1944 jddpj.exe 3496 xfxffff.exe 3136 hbnttn.exe 3272 rrfrrxf.exe 2956 flffxll.exe 736 frlxfrl.exe 1632 lxfxrlr.exe 2336 ddpdp.exe 3816 pvpdj.exe 2416 bhttbn.exe 4212 rllrrrf.exe 4936 ffrfrff.exe 4444 rxflfxl.exe 4828 1vvvd.exe 888 jpdpp.exe 2684 flfffff.exe 2980 jjdjj.exe 2120 tnhtbn.exe 4644 3vddp.exe 1732 jdpvj.exe 1620 hbbhbt.exe 4812 httnnn.exe 640 btttht.exe 1372 bhnnbt.exe -
Processes:
resource yara_rule behavioral2/memory/3296-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2840-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/264-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3452-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/264-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4540-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3944-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1532-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/740-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4948-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4068-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3276-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4208-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3884-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3540-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1928-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1936-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2212-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1008-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1400-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1356-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3404-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/636-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2232-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2752-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3748-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1944-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3496-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3816-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3816-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4212-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2416-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1732-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-298-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1372-296-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1856-305-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4372-309-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3928-314-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/648-327-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-335-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3456-342-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-350-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1328-363-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3764-382-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1292-408-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2292-415-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-431-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2664-438-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3232-442-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4916-452-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/372-462-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4440-466-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-479-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/736-483-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/736-487-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
nbtthh.exerfxrllf.exedjdvp.exerlfrfrl.exejvvdj.exedvpvj.exehbbhnh.exerllfrfx.exexlrfffx.exefxffxlf.exedvpjj.exellllfrr.exedjjvv.exe1nbnbb.exebhbtbb.exeppvvp.exexxrfxfl.exehhhnhb.exelfxfrfx.exejdpvp.exexrllrll.exetbbhbt.exenhhhhh.exefllllrf.exe3vddp.exepdddd.exedvddd.exelffrlfr.exexrrrrlx.exeppvjp.exevjdjj.exerfflxlf.exepvpvv.exevvpjp.exeddjpv.exevdddd.exelffrrrr.exevddpd.exerrrrfrr.exe9rflrff.exeppvpd.exepdjvj.exejjddp.exevdjjv.exebnhbtn.exeffrrrxf.exenntthn.exerlffrxr.exejppvv.exejjvvj.exexlrxffr.exepvdvp.exejddvp.exexflrffr.exepvjpp.exeddddj.exedpvvv.exepvppv.exedvdpp.exerlllxfr.exeddpvd.exedjjjv.exefrxrlrr.exebnnnhn.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llllfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nbnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrfxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllllrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfflxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrrfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rflrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnnhn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a633495e6684992e6c4097c18edb3d60N.exedpdjj.exefxlfxll.exerlrrxff.exelrxrflr.exeffrrrxf.exebhbbnb.exefflrrlx.exe9flrxll.exehntttt.exe3flrfxf.exepjjjv.exepjjpj.exenntthn.exefxxflrf.exevjdjj.exerxffrfr.exebhhhhh.exebtbnth.exebnnhbt.exeppddd.exexxlfxff.exedescription pid process target process PID 3296 wrote to memory of 2840 3296 a633495e6684992e6c4097c18edb3d60N.exe dpdjj.exe PID 3296 wrote to memory of 2840 3296 a633495e6684992e6c4097c18edb3d60N.exe dpdjj.exe PID 3296 wrote to memory of 2840 3296 a633495e6684992e6c4097c18edb3d60N.exe dpdjj.exe PID 2840 wrote to memory of 264 2840 dpdjj.exe fxlfxll.exe PID 2840 wrote to memory of 264 2840 dpdjj.exe fxlfxll.exe PID 2840 wrote to memory of 264 2840 dpdjj.exe fxlfxll.exe PID 264 wrote to memory of 3452 264 fxlfxll.exe rlrrxff.exe PID 264 wrote to memory of 3452 264 fxlfxll.exe rlrrxff.exe PID 264 wrote to memory of 3452 264 fxlfxll.exe rlrrxff.exe PID 3452 wrote to memory of 4540 3452 rlrrxff.exe lrxrflr.exe PID 3452 wrote to memory of 4540 3452 rlrrxff.exe lrxrflr.exe PID 3452 wrote to memory of 4540 3452 rlrrxff.exe lrxrflr.exe PID 4540 wrote to memory of 3944 4540 lrxrflr.exe ffrrrxf.exe PID 4540 wrote to memory of 3944 4540 lrxrflr.exe ffrrrxf.exe PID 4540 wrote to memory of 3944 4540 lrxrflr.exe ffrrrxf.exe PID 3944 wrote to memory of 1532 3944 ffrrrxf.exe bhbbnb.exe PID 3944 wrote to memory of 1532 3944 ffrrrxf.exe bhbbnb.exe PID 3944 wrote to memory of 1532 3944 ffrrrxf.exe bhbbnb.exe PID 1532 wrote to memory of 2956 1532 bhbbnb.exe fflrrlx.exe PID 1532 wrote to memory of 2956 1532 bhbbnb.exe fflrrlx.exe PID 1532 wrote to memory of 2956 1532 bhbbnb.exe fflrrlx.exe PID 2956 wrote to memory of 740 2956 fflrrlx.exe 9flrxll.exe PID 2956 wrote to memory of 740 2956 fflrrlx.exe 9flrxll.exe PID 2956 wrote to memory of 740 2956 fflrrlx.exe 9flrxll.exe PID 740 wrote to memory of 4948 740 9flrxll.exe hntttt.exe PID 740 wrote to memory of 4948 740 9flrxll.exe hntttt.exe PID 740 wrote to memory of 4948 740 9flrxll.exe hntttt.exe PID 4948 wrote to memory of 4068 4948 hntttt.exe 3flrfxf.exe PID 4948 wrote to memory of 4068 4948 hntttt.exe 3flrfxf.exe PID 4948 wrote to memory of 4068 4948 hntttt.exe 3flrfxf.exe PID 4068 wrote to memory of 4208 4068 3flrfxf.exe pjjjv.exe PID 4068 wrote to memory of 4208 4068 3flrfxf.exe pjjjv.exe PID 4068 wrote to memory of 4208 4068 3flrfxf.exe pjjjv.exe PID 4208 wrote to memory of 3884 4208 pjjjv.exe pjjpj.exe PID 4208 wrote to memory of 3884 4208 pjjjv.exe pjjpj.exe PID 4208 wrote to memory of 3884 4208 pjjjv.exe pjjpj.exe PID 3884 wrote to memory of 3276 3884 pjjpj.exe nntthn.exe PID 3884 wrote to memory of 3276 3884 pjjpj.exe nntthn.exe PID 3884 wrote to memory of 3276 3884 pjjpj.exe nntthn.exe PID 3276 wrote to memory of 3972 3276 nntthn.exe fxxflrf.exe PID 3276 wrote to memory of 3972 3276 nntthn.exe fxxflrf.exe PID 3276 wrote to memory of 3972 3276 nntthn.exe fxxflrf.exe PID 3972 wrote to memory of 1928 3972 fxxflrf.exe vjdjj.exe PID 3972 wrote to memory of 1928 3972 fxxflrf.exe vjdjj.exe PID 3972 wrote to memory of 1928 3972 fxxflrf.exe vjdjj.exe PID 1928 wrote to memory of 3540 1928 vjdjj.exe rxffrfr.exe PID 1928 wrote to memory of 3540 1928 vjdjj.exe rxffrfr.exe PID 1928 wrote to memory of 3540 1928 vjdjj.exe rxffrfr.exe PID 3540 wrote to memory of 2212 3540 rxffrfr.exe bhhhhh.exe PID 3540 wrote to memory of 2212 3540 rxffrfr.exe bhhhhh.exe PID 3540 wrote to memory of 2212 3540 rxffrfr.exe bhhhhh.exe PID 2212 wrote to memory of 1936 2212 bhhhhh.exe btbnth.exe PID 2212 wrote to memory of 1936 2212 bhhhhh.exe btbnth.exe PID 2212 wrote to memory of 1936 2212 bhhhhh.exe btbnth.exe PID 1936 wrote to memory of 1008 1936 btbnth.exe bnnhbt.exe PID 1936 wrote to memory of 1008 1936 btbnth.exe bnnhbt.exe PID 1936 wrote to memory of 1008 1936 btbnth.exe bnnhbt.exe PID 1008 wrote to memory of 1400 1008 bnnhbt.exe ppddd.exe PID 1008 wrote to memory of 1400 1008 bnnhbt.exe ppddd.exe PID 1008 wrote to memory of 1400 1008 bnnhbt.exe ppddd.exe PID 1400 wrote to memory of 5116 1400 ppddd.exe xxlfxff.exe PID 1400 wrote to memory of 5116 1400 ppddd.exe xxlfxff.exe PID 1400 wrote to memory of 5116 1400 ppddd.exe xxlfxff.exe PID 5116 wrote to memory of 1356 5116 xxlfxff.exe thtnnt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a633495e6684992e6c4097c18edb3d60N.exe"C:\Users\Admin\AppData\Local\Temp\a633495e6684992e6c4097c18edb3d60N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3296 -
\??\c:\dpdjj.exec:\dpdjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\fxlfxll.exec:\fxlfxll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\rlrrxff.exec:\rlrrxff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\lrxrflr.exec:\lrxrflr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\ffrrrxf.exec:\ffrrrxf.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\bhbbnb.exec:\bhbbnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\fflrrlx.exec:\fflrrlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\9flrxll.exec:\9flrxll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\hntttt.exec:\hntttt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\3flrfxf.exec:\3flrfxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\pjjjv.exec:\pjjjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\pjjpj.exec:\pjjpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
\??\c:\nntthn.exec:\nntthn.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3276 -
\??\c:\fxxflrf.exec:\fxxflrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\vjdjj.exec:\vjdjj.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\rxffrfr.exec:\rxffrfr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\bhhhhh.exec:\bhhhhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\btbnth.exec:\btbnth.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\bnnhbt.exec:\bnnhbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\ppddd.exec:\ppddd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\xxlfxff.exec:\xxlfxff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\thtnnt.exec:\thtnnt.exe23⤵
- Executes dropped EXE
PID:1356 -
\??\c:\bnhnbh.exec:\bnhnbh.exe24⤵
- Executes dropped EXE
PID:2364 -
\??\c:\7lffrfl.exec:\7lffrfl.exe25⤵
- Executes dropped EXE
PID:3760 -
\??\c:\xfrxfll.exec:\xfrxfll.exe26⤵
- Executes dropped EXE
PID:3404 -
\??\c:\1nbnbb.exec:\1nbnbb.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:636 -
\??\c:\jjppd.exec:\jjppd.exe28⤵
- Executes dropped EXE
PID:4004 -
\??\c:\xflflxf.exec:\xflflxf.exe29⤵
- Executes dropped EXE
PID:4128 -
\??\c:\ffrrxxf.exec:\ffrrxxf.exe30⤵
- Executes dropped EXE
PID:3664 -
\??\c:\xfrllrl.exec:\xfrllrl.exe31⤵
- Executes dropped EXE
PID:4772 -
\??\c:\pdjvp.exec:\pdjvp.exe32⤵
- Executes dropped EXE
PID:1268 -
\??\c:\9jpvv.exec:\9jpvv.exe33⤵
- Executes dropped EXE
PID:2620 -
\??\c:\jpdpd.exec:\jpdpd.exe34⤵
- Executes dropped EXE
PID:2232 -
\??\c:\hhhnhb.exec:\hhhnhb.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4440 -
\??\c:\jvjpp.exec:\jvjpp.exe36⤵
- Executes dropped EXE
PID:4084 -
\??\c:\nnhhnn.exec:\nnhhnn.exe37⤵
- Executes dropped EXE
PID:372 -
\??\c:\tnbhbh.exec:\tnbhbh.exe38⤵
- Executes dropped EXE
PID:224 -
\??\c:\fxrxffl.exec:\fxrxffl.exe39⤵
- Executes dropped EXE
PID:2752 -
\??\c:\rfffxfl.exec:\rfffxfl.exe40⤵
- Executes dropped EXE
PID:3748 -
\??\c:\7vdpp.exec:\7vdpp.exe41⤵
- Executes dropped EXE
PID:4480 -
\??\c:\jddpj.exec:\jddpj.exe42⤵
- Executes dropped EXE
PID:1944 -
\??\c:\xfxffff.exec:\xfxffff.exe43⤵
- Executes dropped EXE
PID:3496 -
\??\c:\hbnttn.exec:\hbnttn.exe44⤵
- Executes dropped EXE
PID:3136 -
\??\c:\rrfrrxf.exec:\rrfrrxf.exe45⤵
- Executes dropped EXE
PID:3272 -
\??\c:\flffxll.exec:\flffxll.exe46⤵
- Executes dropped EXE
PID:2956 -
\??\c:\frlxfrl.exec:\frlxfrl.exe47⤵
- Executes dropped EXE
PID:736 -
\??\c:\lxfxrlr.exec:\lxfxrlr.exe48⤵
- Executes dropped EXE
PID:1632 -
\??\c:\ddpdp.exec:\ddpdp.exe49⤵
- Executes dropped EXE
PID:2336 -
\??\c:\pvpdj.exec:\pvpdj.exe50⤵
- Executes dropped EXE
PID:3816 -
\??\c:\bhttbn.exec:\bhttbn.exe51⤵
- Executes dropped EXE
PID:2416 -
\??\c:\rllrrrf.exec:\rllrrrf.exe52⤵
- Executes dropped EXE
PID:4212 -
\??\c:\ffrfrff.exec:\ffrfrff.exe53⤵
- Executes dropped EXE
PID:4936 -
\??\c:\rxflfxl.exec:\rxflfxl.exe54⤵
- Executes dropped EXE
PID:4444 -
\??\c:\1vvvd.exec:\1vvvd.exe55⤵
- Executes dropped EXE
PID:4828 -
\??\c:\jpdpp.exec:\jpdpp.exe56⤵
- Executes dropped EXE
PID:888 -
\??\c:\flfffff.exec:\flfffff.exe57⤵
- Executes dropped EXE
PID:2684 -
\??\c:\jjdjj.exec:\jjdjj.exe58⤵
- Executes dropped EXE
PID:2980 -
\??\c:\tnhtbn.exec:\tnhtbn.exe59⤵
- Executes dropped EXE
PID:2120 -
\??\c:\3vddp.exec:\3vddp.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4644 -
\??\c:\jdpvj.exec:\jdpvj.exe61⤵
- Executes dropped EXE
PID:1732 -
\??\c:\hbbhbt.exec:\hbbhbt.exe62⤵
- Executes dropped EXE
PID:1620 -
\??\c:\httnnn.exec:\httnnn.exe63⤵
- Executes dropped EXE
PID:4812 -
\??\c:\btttht.exec:\btttht.exe64⤵
- Executes dropped EXE
PID:640 -
\??\c:\bhnnbt.exec:\bhnnbt.exe65⤵
- Executes dropped EXE
PID:1372 -
\??\c:\xxxrrll.exec:\xxxrrll.exe66⤵PID:1856
-
\??\c:\rffflff.exec:\rffflff.exe67⤵PID:4372
-
\??\c:\xfrrrxf.exec:\xfrrrxf.exe68⤵PID:3928
-
\??\c:\dddpj.exec:\dddpj.exe69⤵PID:4676
-
\??\c:\bbhnbh.exec:\bbhnbh.exe70⤵PID:3664
-
\??\c:\nnttbb.exec:\nnttbb.exe71⤵PID:1348
-
\??\c:\xrrllrr.exec:\xrrllrr.exe72⤵PID:648
-
\??\c:\pdvdv.exec:\pdvdv.exe73⤵PID:112
-
\??\c:\dpjdp.exec:\dpjdp.exe74⤵PID:4360
-
\??\c:\ddjpv.exec:\ddjpv.exe75⤵
- System Location Discovery: System Language Discovery
PID:2768 -
\??\c:\hbnhnh.exec:\hbnhnh.exe76⤵PID:3040
-
\??\c:\hnhtbn.exec:\hnhtbn.exe77⤵PID:4440
-
\??\c:\tttbbn.exec:\tttbbn.exe78⤵PID:3456
-
\??\c:\9pjpp.exec:\9pjpp.exe79⤵PID:3152
-
\??\c:\xrllrrx.exec:\xrllrrx.exe80⤵PID:3452
-
\??\c:\xrxrrfr.exec:\xrxrrfr.exe81⤵PID:1624
-
\??\c:\hnnthn.exec:\hnnthn.exe82⤵PID:1868
-
\??\c:\tnbhhn.exec:\tnbhhn.exe83⤵PID:772
-
\??\c:\3httbh.exec:\3httbh.exe84⤵PID:1328
-
\??\c:\flrfrrl.exec:\flrfrrl.exe85⤵PID:1244
-
\??\c:\dddvp.exec:\dddvp.exe86⤵PID:1012
-
\??\c:\hhthhh.exec:\hhthhh.exe87⤵PID:4796
-
\??\c:\nthhnn.exec:\nthhnn.exe88⤵PID:1284
-
\??\c:\xfllrrf.exec:\xfllrrf.exe89⤵PID:3764
-
\??\c:\vpdpv.exec:\vpdpv.exe90⤵PID:3116
-
\??\c:\jppvv.exec:\jppvv.exe91⤵
- System Location Discovery: System Language Discovery
PID:1048 -
\??\c:\hnnntn.exec:\hnnntn.exe92⤵PID:4804
-
\??\c:\nhttbh.exec:\nhttbh.exe93⤵PID:3972
-
\??\c:\jjppd.exec:\jjppd.exe94⤵PID:1928
-
\??\c:\hhtbhn.exec:\hhtbhn.exe95⤵PID:3956
-
\??\c:\rrxxrrl.exec:\rrxxrrl.exe96⤵PID:2716
-
\??\c:\xrxxfrl.exec:\xrxxfrl.exe97⤵PID:1292
-
\??\c:\xfxfrfr.exec:\xfxfrfr.exe98⤵PID:5088
-
\??\c:\ppvpd.exec:\ppvpd.exe99⤵
- System Location Discovery: System Language Discovery
PID:2292 -
\??\c:\vdddd.exec:\vdddd.exe100⤵
- System Location Discovery: System Language Discovery
PID:1084 -
\??\c:\tbhhhn.exec:\tbhhhn.exe101⤵PID:1036
-
\??\c:\hntbtb.exec:\hntbtb.exe102⤵PID:4464
-
\??\c:\bbbttt.exec:\bbbttt.exe103⤵PID:208
-
\??\c:\hbnhhn.exec:\hbnhhn.exe104⤵PID:3236
-
\??\c:\rfrfllr.exec:\rfrfllr.exe105⤵PID:2912
-
\??\c:\djjjv.exec:\djjjv.exe106⤵
- System Location Discovery: System Language Discovery
PID:2664 -
\??\c:\7ddpv.exec:\7ddpv.exe107⤵PID:3232
-
\??\c:\jvddp.exec:\jvddp.exe108⤵PID:4592
-
\??\c:\xxfxxfl.exec:\xxfxxfl.exe109⤵PID:4676
-
\??\c:\tbnhbt.exec:\tbnhbt.exe110⤵PID:4772
-
\??\c:\llxlffr.exec:\llxlffr.exe111⤵PID:4916
-
\??\c:\dpdjj.exec:\dpdjj.exe112⤵PID:2692
-
\??\c:\vvdjp.exec:\vvdjp.exe113⤵PID:372
-
\??\c:\xlrlrfr.exec:\xlrlrfr.exe114⤵PID:4440
-
\??\c:\xllrrlr.exec:\xllrrlr.exe115⤵PID:732
-
\??\c:\tbbbtb.exec:\tbbbtb.exe116⤵PID:5084
-
\??\c:\nbtthh.exec:\nbtthh.exe117⤵
- System Location Discovery: System Language Discovery
PID:1340 -
\??\c:\lfrlxxl.exec:\lfrlxxl.exe118⤵PID:3136
-
\??\c:\vpvpv.exec:\vpvpv.exe119⤵PID:3920
-
\??\c:\jvvvp.exec:\jvvvp.exe120⤵PID:736
-
\??\c:\pdpvd.exec:\pdpvd.exe121⤵PID:1052
-
\??\c:\hbhbnb.exec:\hbhbnb.exe122⤵PID:2336
-
\??\c:\lffrrrr.exec:\lffrrrr.exe123⤵
- System Location Discovery: System Language Discovery
PID:3384 -
\??\c:\xlrfllf.exec:\xlrfllf.exe124⤵PID:2416
-
\??\c:\dddjd.exec:\dddjd.exe125⤵PID:4212
-
\??\c:\vjjjd.exec:\vjjjd.exe126⤵PID:4936
-
\??\c:\tbbbnh.exec:\tbbbnh.exe127⤵PID:4996
-
\??\c:\fxxfrrr.exec:\fxxfrrr.exe128⤵PID:2476
-
\??\c:\xllffff.exec:\xllffff.exe129⤵PID:2396
-
\??\c:\xxllxxl.exec:\xxllxxl.exe130⤵PID:2148
-
\??\c:\ddpjp.exec:\ddpjp.exe131⤵PID:3612
-
\??\c:\nttbhh.exec:\nttbhh.exe132⤵PID:1876
-
\??\c:\htbntb.exec:\htbntb.exe133⤵PID:2320
-
\??\c:\pvppd.exec:\pvppd.exe134⤵PID:3548
-
\??\c:\hhtbnb.exec:\hhtbnb.exe135⤵PID:3500
-
\??\c:\pdjvj.exec:\pdjvj.exe136⤵
- System Location Discovery: System Language Discovery
PID:4724 -
\??\c:\lflfrfx.exec:\lflfrfx.exe137⤵PID:4464
-
\??\c:\ppjvj.exec:\ppjvj.exe138⤵PID:4120
-
\??\c:\jdjvp.exec:\jdjvp.exe139⤵PID:3236
-
\??\c:\bbtbtt.exec:\bbtbtt.exe140⤵PID:3140
-
\??\c:\xflrffr.exec:\xflrffr.exe141⤵
- System Location Discovery: System Language Discovery
PID:536 -
\??\c:\jdpjj.exec:\jdpjj.exe142⤵PID:1148
-
\??\c:\lffrfrl.exec:\lffrfrl.exe143⤵PID:1848
-
\??\c:\bhnbht.exec:\bhnbht.exe144⤵PID:964
-
\??\c:\btbbtb.exec:\btbbtb.exe145⤵PID:4104
-
\??\c:\ntbhbn.exec:\ntbhbn.exe146⤵PID:404
-
\??\c:\xrxlllr.exec:\xrxlllr.exe147⤵PID:3432
-
\??\c:\httnnn.exec:\httnnn.exe148⤵PID:3664
-
\??\c:\lrrlffx.exec:\lrrlffx.exe149⤵PID:4356
-
\??\c:\rxflrlx.exec:\rxflrlx.exe150⤵PID:5112
-
\??\c:\nhtnbt.exec:\nhtnbt.exe151⤵PID:648
-
\??\c:\hbbhnh.exec:\hbbhnh.exe152⤵
- System Location Discovery: System Language Discovery
PID:1224 -
\??\c:\bbbnht.exec:\bbbnht.exe153⤵PID:3212
-
\??\c:\lxfrlxr.exec:\lxfrlxr.exe154⤵PID:5016
-
\??\c:\jjddp.exec:\jjddp.exe155⤵
- System Location Discovery: System Language Discovery
PID:1744 -
\??\c:\xxrfrrf.exec:\xxrfrrf.exe156⤵PID:3032
-
\??\c:\pjjdp.exec:\pjjdp.exe157⤵PID:3484
-
\??\c:\hhhbbn.exec:\hhhbbn.exe158⤵PID:2916
-
\??\c:\jvpjp.exec:\jvpjp.exe159⤵PID:5108
-
\??\c:\lllrllf.exec:\lllrllf.exe160⤵PID:736
-
\??\c:\rllfrfx.exec:\rllfrfx.exe161⤵
- System Location Discovery: System Language Discovery
PID:1284 -
\??\c:\jppjv.exec:\jppjv.exe162⤵PID:4432
-
\??\c:\3tnhhh.exec:\3tnhhh.exe163⤵PID:2332
-
\??\c:\dddvp.exec:\dddvp.exe164⤵PID:3524
-
\??\c:\hnbbtt.exec:\hnbbtt.exe165⤵PID:2472
-
\??\c:\pdddd.exec:\pdddd.exe166⤵
- System Location Discovery: System Language Discovery
PID:3096 -
\??\c:\xlfxffx.exec:\xlfxffx.exe167⤵PID:388
-
\??\c:\rrxrffx.exec:\rrxrffx.exe168⤵PID:4240
-
\??\c:\lrllfff.exec:\lrllfff.exe169⤵PID:2316
-
\??\c:\xlrfffx.exec:\xlrfffx.exe170⤵
- System Location Discovery: System Language Discovery
PID:2396 -
\??\c:\djjvj.exec:\djjvj.exe171⤵PID:828
-
\??\c:\ppdjp.exec:\ppdjp.exe172⤵PID:1400
-
\??\c:\nbtbhn.exec:\nbtbhn.exe173⤵PID:1776
-
\??\c:\rlrlfrr.exec:\rlrlfrr.exe174⤵PID:3084
-
\??\c:\fxffxxl.exec:\fxffxxl.exe175⤵PID:1492
-
\??\c:\nbbtnn.exec:\nbbtnn.exe176⤵PID:4724
-
\??\c:\ntbhhh.exec:\ntbhhh.exe177⤵PID:208
-
\??\c:\flxflrf.exec:\flxflrf.exe178⤵PID:2608
-
\??\c:\pvdpv.exec:\pvdpv.exe179⤵PID:1016
-
\??\c:\flfllxf.exec:\flfllxf.exe180⤵PID:2880
-
\??\c:\pdppd.exec:\pdppd.exe181⤵PID:4376
-
\??\c:\tbnnbb.exec:\tbnnbb.exe182⤵PID:2256
-
\??\c:\1fllffr.exec:\1fllffr.exe183⤵PID:4416
-
\??\c:\5rxxrrl.exec:\5rxxrrl.exe184⤵PID:3980
-
\??\c:\pppjv.exec:\pppjv.exe185⤵PID:1044
-
\??\c:\vdjjv.exec:\vdjjv.exe186⤵
- System Location Discovery: System Language Discovery
PID:2304 -
\??\c:\hbhbhn.exec:\hbhbhn.exe187⤵PID:4524
-
\??\c:\fxlfrlf.exec:\fxlfrlf.exe188⤵PID:404
-
\??\c:\rfflxlf.exec:\rfflxlf.exe189⤵
- System Location Discovery: System Language Discovery
PID:4344 -
\??\c:\rfxrllf.exec:\rfxrllf.exe190⤵
- System Location Discovery: System Language Discovery
PID:4772 -
\??\c:\dpvvv.exec:\dpvvv.exe191⤵
- System Location Discovery: System Language Discovery
PID:4360 -
\??\c:\nbbhbh.exec:\nbbhbh.exe192⤵PID:4668
-
\??\c:\jjppp.exec:\jjppp.exe193⤵PID:4628
-
\??\c:\bnhtbb.exec:\bnhtbb.exe194⤵PID:1944
-
\??\c:\7lrrxfl.exec:\7lrrxfl.exe195⤵PID:3212
-
\??\c:\vjppv.exec:\vjppv.exe196⤵PID:5084
-
\??\c:\pjvpp.exec:\pjvpp.exe197⤵PID:1340
-
\??\c:\hnnttt.exec:\hnnttt.exe198⤵PID:1556
-
\??\c:\ddjjd.exec:\ddjjd.exe199⤵PID:1468
-
\??\c:\bttttb.exec:\bttttb.exe200⤵PID:1112
-
\??\c:\vvjvd.exec:\vvjvd.exe201⤵PID:3460
-
\??\c:\thtttb.exec:\thtttb.exe202⤵PID:2536
-
\??\c:\fxffxlf.exec:\fxffxlf.exe203⤵
- System Location Discovery: System Language Discovery
PID:1284 -
\??\c:\bthtth.exec:\bthtth.exe204⤵PID:2104
-
\??\c:\fflfffx.exec:\fflfffx.exe205⤵PID:4408
-
\??\c:\lrfxrrf.exec:\lrfxrrf.exe206⤵PID:948
-
\??\c:\dvpdj.exec:\dvpdj.exe207⤵PID:4912
-
\??\c:\nntnnn.exec:\nntnnn.exe208⤵PID:1156
-
\??\c:\vjdpv.exec:\vjdpv.exe209⤵PID:2716
-
\??\c:\hnhnbb.exec:\hnhnbb.exe210⤵PID:2980
-
\??\c:\pjpjp.exec:\pjpjp.exe211⤵PID:1876
-
\??\c:\btbbhh.exec:\btbbhh.exe212⤵PID:2320
-
\??\c:\jjvvj.exec:\jjvvj.exe213⤵
- System Location Discovery: System Language Discovery
PID:3548 -
\??\c:\bnthnt.exec:\bnthnt.exe214⤵PID:640
-
\??\c:\nbnbbb.exec:\nbnbbb.exe215⤵PID:748
-
\??\c:\ffrlxxl.exec:\ffrlxxl.exe216⤵PID:2900
-
\??\c:\9jddd.exec:\9jddd.exe217⤵PID:1680
-
\??\c:\vvjvv.exec:\vvjvv.exe218⤵PID:2256
-
\??\c:\7thnth.exec:\7thnth.exe219⤵PID:4808
-
\??\c:\jjppj.exec:\jjppj.exe220⤵PID:2912
-
\??\c:\pdjpj.exec:\pdjpj.exe221⤵PID:1692
-
\??\c:\lfxrxlx.exec:\lfxrxlx.exe222⤵PID:5060
-
\??\c:\nbnhnn.exec:\nbnhnn.exe223⤵PID:3664
-
\??\c:\pvppv.exec:\pvppv.exe224⤵
- System Location Discovery: System Language Discovery
PID:4468 -
\??\c:\nbhhnn.exec:\nbhhnn.exe225⤵PID:4504
-
\??\c:\lxxxffl.exec:\lxxxffl.exe226⤵PID:648
-
\??\c:\jjjvj.exec:\jjjvj.exe227⤵PID:1224
-
\??\c:\btntnt.exec:\btntnt.exe228⤵PID:3452
-
\??\c:\xrrrllx.exec:\xrrrllx.exe229⤵PID:3496
-
\??\c:\pvpvv.exec:\pvpvv.exe230⤵PID:1532
-
\??\c:\tnnnbh.exec:\tnnnbh.exe231⤵PID:3272
-
\??\c:\ddvdp.exec:\ddvdp.exe232⤵PID:3308
-
\??\c:\dvpjj.exec:\dvpjj.exe233⤵
- System Location Discovery: System Language Discovery
PID:1632 -
\??\c:\ppvdd.exec:\ppvdd.exe234⤵PID:3128
-
\??\c:\bbtbnb.exec:\bbtbnb.exe235⤵PID:736
-
\??\c:\vdvjd.exec:\vdvjd.exe236⤵PID:2536
-
\??\c:\pvdpp.exec:\pvdpp.exe237⤵PID:2336
-
\??\c:\ttbtnn.exec:\ttbtnn.exe238⤵PID:4604
-
\??\c:\jjdvp.exec:\jjdvp.exe239⤵PID:4212
-
\??\c:\tnnbht.exec:\tnnbht.exe240⤵PID:1232
-
\??\c:\djvjd.exec:\djvjd.exe241⤵PID:1928
-
\??\c:\djjpj.exec:\djjpj.exe242⤵PID:1548