Analysis
-
max time kernel
67s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
27-07-2024 06:55
Behavioral task
behavioral1
Sample
a4662540d60131271839b11d09fe2590N.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
120 seconds
General
-
Target
a4662540d60131271839b11d09fe2590N.exe
-
Size
93KB
-
MD5
a4662540d60131271839b11d09fe2590
-
SHA1
40d1201d8075c8de9cd60f759e1b93c3d09a7381
-
SHA256
8d230d52eea4722688ab2599e3a505972ca6be3b7e45f3ae6cb2966a421b2b27
-
SHA512
47254a219c543ff362f0426e6605a647b4f580268c5af0b5442cac49d90c7a80086d04825cfe461c7ac3f7b2061cfd70c2fad3847e47dc84d332c030a0264151
-
SSDEEP
1536:xvQBeOGtrYS3srx93UBWfwC6Ggnouy82F13w801ouAsG9ZoPEudJGdXRKXREmXZO:xhOmTsF93UYfwC6GIout03Fv9KdJoQGf
Malware Config
Signatures
-
Detect Blackmoon payload 61 IoCs
Processes:
resource yara_rule behavioral1/memory/2616-350-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2716-342-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2716-341-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2716-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2112-318-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1528-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3040-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/892-286-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2892-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/548-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1724-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/956-233-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1040-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/756-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1304-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1188-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2440-196-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/956-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1600-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2388-176-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2388-175-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2792-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1144-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2020-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-128-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2432-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2432-114-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2648-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2628-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2628-83-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2712-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-69-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2824-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-45-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2092-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2592-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1960-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2124-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1352-437-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2608-452-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/852-466-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/852-465-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2492-473-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2400-487-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1620-520-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1620-519-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1692-533-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1880-554-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2412-550-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1848-582-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1848-585-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-668-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1140-715-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1572-727-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2404-737-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2344-752-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/948-762-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2472-769-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
htbtbb.exevppdp.exehbbtht.exefrlxfrf.exe1nbbnt.exepdjjp.exeffxrflf.exevdppp.exeflflfxr.exehnthtn.exexrlrfxx.exevdvvv.exethtnbn.exepvddd.exe7vddp.exenbhtbb.exe1ddpv.exexxfrrrr.exebbbttb.exelxflrxr.exejvjpd.exetbbhbn.exebbtnnn.exedjjdj.exerrxxflr.exe3ttttt.exeddpjp.exe5xrffff.exetnnbnt.exevdvpj.exellxrrfx.exebhttbh.exevvdvv.exexrfxxfr.exehtnntn.exebnbbtn.exeflxrxrx.exehnbhht.exejvjjv.exehnthhb.exevpdvj.exenhntht.exelrllxfl.exehhnttb.exefllxxrr.exe9jvpj.exebhbttn.exentttbb.exelxrflxr.exepjpdv.exexrxlllr.exe1ddjj.exehbntbh.exe1jpjp.exehbhtht.exelllfrll.exehnhttn.exerxfxxrx.exevdvpj.exerxfflxx.exelfllllr.exe3dvpj.exerlxxxrx.exeppvvd.exepid process 1960 htbtbb.exe 2592 vppdp.exe 2092 hbbtht.exe 2824 frlxfrf.exe 2656 1nbbnt.exe 2712 pdjjp.exe 2840 ffxrflf.exe 2628 vdppp.exe 2648 flflfxr.exe 2516 hnthtn.exe 2916 xrlrfxx.exe 2432 vdvvv.exe 2480 thtnbn.exe 2020 pvddd.exe 2440 7vddp.exe 1144 nbhtbb.exe 2792 1ddpv.exe 2388 xxfrrrr.exe 1600 bbbttb.exe 956 lxflrxr.exe 2152 jvjpd.exe 1304 tbbhbn.exe 756 bbtnnn.exe 1040 djjdj.exe 1724 rrxxflr.exe 548 3ttttt.exe 2892 ddpjp.exe 336 5xrffff.exe 2948 tnnbnt.exe 892 vdvpj.exe 2956 llxrrfx.exe 1848 bhttbh.exe 3040 vvdvv.exe 1528 xrfxxfr.exe 2112 htnntn.exe 2784 bnbbtn.exe 3032 flxrxrx.exe 2716 hnbhht.exe 2616 jvjjv.exe 2748 hnthhb.exe 2776 vpdvj.exe 2536 nhntht.exe 2684 lrllxfl.exe 2772 hhnttb.exe 2436 fllxxrr.exe 2632 9jvpj.exe 1588 bhbttn.exe 1128 ntttbb.exe 1188 lxrflxr.exe 1932 pjpdv.exe 1872 xrxlllr.exe 1352 1ddjj.exe 1836 hbntbh.exe 2608 1jpjp.exe 1716 hbhtht.exe 852 lllfrll.exe 2492 hnhttn.exe 2164 rxfxxrx.exe 2400 vdvpj.exe 1320 rxfflxx.exe 836 lfllllr.exe 1952 3dvpj.exe 916 rlxxxrx.exe 1620 ppvvd.exe -
Processes:
resource yara_rule behavioral1/memory/2716-335-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2784-323-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1528-315-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3040-308-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bhttbh.exe upx \??\c:\llxrrfx.exe upx \??\c:\vdvpj.exe upx \??\c:\tnnbnt.exe upx behavioral1/memory/2892-262-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\5xrffff.exe upx behavioral1/memory/548-258-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ddpjp.exe upx \??\c:\3ttttt.exe upx \??\c:\rrxxflr.exe upx behavioral1/memory/1724-234-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1040-225-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\djjdj.exe upx behavioral1/memory/756-223-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bbtnnn.exe upx behavioral1/memory/756-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1304-212-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1188-410-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tbbhbn.exe upx \??\c:\jvjpd.exe upx behavioral1/memory/956-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1600-187-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lxflrxr.exe upx \??\c:\bbbttb.exe upx \??\c:\xxfrrrr.exe upx behavioral1/memory/2792-160-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\1ddpv.exe upx behavioral1/memory/1144-158-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nbhtbb.exe upx \??\c:\7vddp.exe upx behavioral1/memory/2480-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2020-131-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pvddd.exe upx behavioral1/memory/2480-127-0x0000000000220000-0x0000000000247000-memory.dmp upx \??\c:\thtnbn.exe upx behavioral1/memory/2432-120-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vdvvv.exe upx \??\c:\xrlrfxx.exe upx \??\c:\hnthtn.exe upx \??\c:\flflfxr.exe upx behavioral1/memory/2648-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2628-87-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vdppp.exe upx behavioral1/memory/2712-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2840-73-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ffxrflf.exe upx behavioral1/memory/1932-418-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pdjjp.exe upx behavioral1/memory/2824-48-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\1nbbnt.exe upx behavioral1/memory/2824-45-0x0000000000220000-0x0000000000247000-memory.dmp upx \??\c:\frlxfrf.exe upx behavioral1/memory/2092-37-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hbbtht.exe upx behavioral1/memory/2092-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2592-27-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vppdp.exe upx behavioral1/memory/1960-17-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\htbtbb.exe upx behavioral1/memory/1960-9-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
pvvdd.exehntbnh.exejdjpv.exe5tnntn.exedpjpj.exepdppp.exe3thtth.exefrlrxxl.exe3tbtbt.exe1nbbnt.exebhbttn.exennhnhn.exennnthn.exerrrflrf.exejppjj.exe7nttbb.exerrxlxlx.exepvpjv.exexxlrxfr.exevvvjd.exejpvpd.exepvddd.exehbhtht.exerrrlxfl.exenbnttb.exerrfxxrx.exetbbhbh.exebhnthn.exevppvv.exe5vjvp.exe3vdjp.exe7bhttt.exebhnntn.exetthbhh.exehnhttn.exerrxffxx.exedvjpd.exefflxxlf.exethhhtb.exe3rxxrfr.exelfxxflf.exennntbn.exerxxrfrl.exenhttth.exenthhnn.exepvjjv.exefxxxffr.exethbhhh.exenbthtb.exetthbtt.exerfxffrf.exexrxlxfr.exellxxxfr.exehhhhbn.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3thtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxlxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrlxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bhttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflxxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxxrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnntbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbthtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxffrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxlxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhhbn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a4662540d60131271839b11d09fe2590N.exehtbtbb.exevppdp.exehbbtht.exefrlxfrf.exe1nbbnt.exepdjjp.exeffxrflf.exevdppp.exeflflfxr.exehnthtn.exexrlrfxx.exevdvvv.exethtnbn.exepvddd.exe7vddp.exedescription pid process target process PID 2124 wrote to memory of 1960 2124 a4662540d60131271839b11d09fe2590N.exe htbtbb.exe PID 2124 wrote to memory of 1960 2124 a4662540d60131271839b11d09fe2590N.exe htbtbb.exe PID 2124 wrote to memory of 1960 2124 a4662540d60131271839b11d09fe2590N.exe htbtbb.exe PID 2124 wrote to memory of 1960 2124 a4662540d60131271839b11d09fe2590N.exe htbtbb.exe PID 1960 wrote to memory of 2592 1960 htbtbb.exe vppdp.exe PID 1960 wrote to memory of 2592 1960 htbtbb.exe vppdp.exe PID 1960 wrote to memory of 2592 1960 htbtbb.exe vppdp.exe PID 1960 wrote to memory of 2592 1960 htbtbb.exe vppdp.exe PID 2592 wrote to memory of 2092 2592 vppdp.exe hbbtht.exe PID 2592 wrote to memory of 2092 2592 vppdp.exe hbbtht.exe PID 2592 wrote to memory of 2092 2592 vppdp.exe hbbtht.exe PID 2592 wrote to memory of 2092 2592 vppdp.exe hbbtht.exe PID 2092 wrote to memory of 2824 2092 hbbtht.exe frlxfrf.exe PID 2092 wrote to memory of 2824 2092 hbbtht.exe frlxfrf.exe PID 2092 wrote to memory of 2824 2092 hbbtht.exe frlxfrf.exe PID 2092 wrote to memory of 2824 2092 hbbtht.exe frlxfrf.exe PID 2824 wrote to memory of 2656 2824 frlxfrf.exe 1nbbnt.exe PID 2824 wrote to memory of 2656 2824 frlxfrf.exe 1nbbnt.exe PID 2824 wrote to memory of 2656 2824 frlxfrf.exe 1nbbnt.exe PID 2824 wrote to memory of 2656 2824 frlxfrf.exe 1nbbnt.exe PID 2656 wrote to memory of 2712 2656 1nbbnt.exe pdjjp.exe PID 2656 wrote to memory of 2712 2656 1nbbnt.exe pdjjp.exe PID 2656 wrote to memory of 2712 2656 1nbbnt.exe pdjjp.exe PID 2656 wrote to memory of 2712 2656 1nbbnt.exe pdjjp.exe PID 2712 wrote to memory of 2840 2712 pdjjp.exe ffxrflf.exe PID 2712 wrote to memory of 2840 2712 pdjjp.exe ffxrflf.exe PID 2712 wrote to memory of 2840 2712 pdjjp.exe ffxrflf.exe PID 2712 wrote to memory of 2840 2712 pdjjp.exe ffxrflf.exe PID 2840 wrote to memory of 2628 2840 ffxrflf.exe vdppp.exe PID 2840 wrote to memory of 2628 2840 ffxrflf.exe vdppp.exe PID 2840 wrote to memory of 2628 2840 ffxrflf.exe vdppp.exe PID 2840 wrote to memory of 2628 2840 ffxrflf.exe vdppp.exe PID 2628 wrote to memory of 2648 2628 vdppp.exe flflfxr.exe PID 2628 wrote to memory of 2648 2628 vdppp.exe flflfxr.exe PID 2628 wrote to memory of 2648 2628 vdppp.exe flflfxr.exe PID 2628 wrote to memory of 2648 2628 vdppp.exe flflfxr.exe PID 2648 wrote to memory of 2516 2648 flflfxr.exe hnthtn.exe PID 2648 wrote to memory of 2516 2648 flflfxr.exe hnthtn.exe PID 2648 wrote to memory of 2516 2648 flflfxr.exe hnthtn.exe PID 2648 wrote to memory of 2516 2648 flflfxr.exe hnthtn.exe PID 2516 wrote to memory of 2916 2516 hnthtn.exe xrlrfxx.exe PID 2516 wrote to memory of 2916 2516 hnthtn.exe xrlrfxx.exe PID 2516 wrote to memory of 2916 2516 hnthtn.exe xrlrfxx.exe PID 2516 wrote to memory of 2916 2516 hnthtn.exe xrlrfxx.exe PID 2916 wrote to memory of 2432 2916 xrlrfxx.exe vdvvv.exe PID 2916 wrote to memory of 2432 2916 xrlrfxx.exe vdvvv.exe PID 2916 wrote to memory of 2432 2916 xrlrfxx.exe vdvvv.exe PID 2916 wrote to memory of 2432 2916 xrlrfxx.exe vdvvv.exe PID 2432 wrote to memory of 2480 2432 vdvvv.exe thtnbn.exe PID 2432 wrote to memory of 2480 2432 vdvvv.exe thtnbn.exe PID 2432 wrote to memory of 2480 2432 vdvvv.exe thtnbn.exe PID 2432 wrote to memory of 2480 2432 vdvvv.exe thtnbn.exe PID 2480 wrote to memory of 2020 2480 thtnbn.exe pvddd.exe PID 2480 wrote to memory of 2020 2480 thtnbn.exe pvddd.exe PID 2480 wrote to memory of 2020 2480 thtnbn.exe pvddd.exe PID 2480 wrote to memory of 2020 2480 thtnbn.exe pvddd.exe PID 2020 wrote to memory of 2440 2020 pvddd.exe 7vddp.exe PID 2020 wrote to memory of 2440 2020 pvddd.exe 7vddp.exe PID 2020 wrote to memory of 2440 2020 pvddd.exe 7vddp.exe PID 2020 wrote to memory of 2440 2020 pvddd.exe 7vddp.exe PID 2440 wrote to memory of 1144 2440 7vddp.exe nbhtbb.exe PID 2440 wrote to memory of 1144 2440 7vddp.exe nbhtbb.exe PID 2440 wrote to memory of 1144 2440 7vddp.exe nbhtbb.exe PID 2440 wrote to memory of 1144 2440 7vddp.exe nbhtbb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4662540d60131271839b11d09fe2590N.exe"C:\Users\Admin\AppData\Local\Temp\a4662540d60131271839b11d09fe2590N.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\htbtbb.exec:\htbtbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vppdp.exec:\vppdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbbtht.exec:\hbbtht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frlxfrf.exec:\frlxfrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1nbbnt.exec:\1nbbnt.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\pdjjp.exec:\pdjjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffxrflf.exec:\ffxrflf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdppp.exec:\vdppp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\flflfxr.exec:\flflfxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hnthtn.exec:\hnthtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrlrfxx.exec:\xrlrfxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdvvv.exec:\vdvvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thtnbn.exec:\thtnbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvddd.exec:\pvddd.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\7vddp.exec:\7vddp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbhtbb.exec:\nbhtbb.exe17⤵
- Executes dropped EXE
-
\??\c:\1ddpv.exec:\1ddpv.exe18⤵
- Executes dropped EXE
-
\??\c:\xxfrrrr.exec:\xxfrrrr.exe19⤵
- Executes dropped EXE
-
\??\c:\bbbttb.exec:\bbbttb.exe20⤵
- Executes dropped EXE
-
\??\c:\lxflrxr.exec:\lxflrxr.exe21⤵
- Executes dropped EXE
-
\??\c:\jvjpd.exec:\jvjpd.exe22⤵
- Executes dropped EXE
-
\??\c:\tbbhbn.exec:\tbbhbn.exe23⤵
- Executes dropped EXE
-
\??\c:\bbtnnn.exec:\bbtnnn.exe24⤵
- Executes dropped EXE
-
\??\c:\djjdj.exec:\djjdj.exe25⤵
- Executes dropped EXE
-
\??\c:\rrxxflr.exec:\rrxxflr.exe26⤵
- Executes dropped EXE
-
\??\c:\3ttttt.exec:\3ttttt.exe27⤵
- Executes dropped EXE
-
\??\c:\ddpjp.exec:\ddpjp.exe28⤵
- Executes dropped EXE
-
\??\c:\5xrffff.exec:\5xrffff.exe29⤵
- Executes dropped EXE
-
\??\c:\tnnbnt.exec:\tnnbnt.exe30⤵
- Executes dropped EXE
-
\??\c:\vdvpj.exec:\vdvpj.exe31⤵
- Executes dropped EXE
-
\??\c:\llxrrfx.exec:\llxrrfx.exe32⤵
- Executes dropped EXE
-
\??\c:\bhttbh.exec:\bhttbh.exe33⤵
- Executes dropped EXE
-
\??\c:\vvdvv.exec:\vvdvv.exe34⤵
- Executes dropped EXE
-
\??\c:\xrfxxfr.exec:\xrfxxfr.exe35⤵
- Executes dropped EXE
-
\??\c:\htnntn.exec:\htnntn.exe36⤵
- Executes dropped EXE
-
\??\c:\bnbbtn.exec:\bnbbtn.exe37⤵
- Executes dropped EXE
-
\??\c:\flxrxrx.exec:\flxrxrx.exe38⤵
- Executes dropped EXE
-
\??\c:\hnbhht.exec:\hnbhht.exe39⤵
- Executes dropped EXE
-
\??\c:\jvjjv.exec:\jvjjv.exe40⤵
- Executes dropped EXE
-
\??\c:\hnthhb.exec:\hnthhb.exe41⤵
- Executes dropped EXE
-
\??\c:\vpdvj.exec:\vpdvj.exe42⤵
- Executes dropped EXE
-
\??\c:\nhntht.exec:\nhntht.exe43⤵
- Executes dropped EXE
-
\??\c:\lrllxfl.exec:\lrllxfl.exe44⤵
- Executes dropped EXE
-
\??\c:\hhnttb.exec:\hhnttb.exe45⤵
- Executes dropped EXE
-
\??\c:\fllxxrr.exec:\fllxxrr.exe46⤵
- Executes dropped EXE
-
\??\c:\9jvpj.exec:\9jvpj.exe47⤵
- Executes dropped EXE
-
\??\c:\bhbttn.exec:\bhbttn.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
\??\c:\ntttbb.exec:\ntttbb.exe49⤵
- Executes dropped EXE
-
\??\c:\lxrflxr.exec:\lxrflxr.exe50⤵
- Executes dropped EXE
-
\??\c:\pjpdv.exec:\pjpdv.exe51⤵
- Executes dropped EXE
-
\??\c:\xrxlllr.exec:\xrxlllr.exe52⤵
- Executes dropped EXE
-
\??\c:\1ddjj.exec:\1ddjj.exe53⤵
- Executes dropped EXE
-
\??\c:\hbntbh.exec:\hbntbh.exe54⤵
- Executes dropped EXE
-
\??\c:\1jpjp.exec:\1jpjp.exe55⤵
- Executes dropped EXE
-
\??\c:\hbhtht.exec:\hbhtht.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
\??\c:\lllfrll.exec:\lllfrll.exe57⤵
- Executes dropped EXE
-
\??\c:\hnhttn.exec:\hnhttn.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
\??\c:\rxfxxrx.exec:\rxfxxrx.exe59⤵
- Executes dropped EXE
-
\??\c:\vdvpj.exec:\vdvpj.exe60⤵
- Executes dropped EXE
-
\??\c:\rxfflxx.exec:\rxfflxx.exe61⤵
- Executes dropped EXE
-
\??\c:\lfllllr.exec:\lfllllr.exe62⤵
- Executes dropped EXE
-
\??\c:\3dvpj.exec:\3dvpj.exe63⤵
- Executes dropped EXE
-
\??\c:\rlxxxrx.exec:\rlxxxrx.exe64⤵
- Executes dropped EXE
-
\??\c:\ppvvd.exec:\ppvvd.exe65⤵
- Executes dropped EXE
-
\??\c:\frfxxrl.exec:\frfxxrl.exe66⤵
-
\??\c:\3nbnhh.exec:\3nbnhh.exe67⤵
-
\??\c:\nnttbh.exec:\nnttbh.exe68⤵
-
\??\c:\vddjp.exec:\vddjp.exe69⤵
-
\??\c:\jddvd.exec:\jddvd.exe70⤵
-
\??\c:\lrrfxrl.exec:\lrrfxrl.exe71⤵
-
\??\c:\vdddd.exec:\vdddd.exe72⤵
-
\??\c:\pjvdp.exec:\pjvdp.exe73⤵
-
\??\c:\btbbnn.exec:\btbbnn.exe74⤵
-
\??\c:\dddpp.exec:\dddpp.exe75⤵
-
\??\c:\hbthhh.exec:\hbthhh.exe76⤵
-
\??\c:\9vddd.exec:\9vddd.exe77⤵
-
\??\c:\xfxlfrf.exec:\xfxlfrf.exe78⤵
-
\??\c:\bbthhh.exec:\bbthhh.exe79⤵
-
\??\c:\rflrlff.exec:\rflrlff.exe80⤵
-
\??\c:\bbnbbb.exec:\bbnbbb.exe81⤵
-
\??\c:\rlxrxxx.exec:\rlxrxxx.exe82⤵
-
\??\c:\pvvvd.exec:\pvvvd.exe83⤵
-
\??\c:\flfffrl.exec:\flfffrl.exe84⤵
-
\??\c:\vpdjv.exec:\vpdjv.exe85⤵
-
\??\c:\tnbbnn.exec:\tnbbnn.exe86⤵
-
\??\c:\jpvdv.exec:\jpvdv.exe87⤵
-
\??\c:\nhbhth.exec:\nhbhth.exe88⤵
-
\??\c:\lrrrrrl.exec:\lrrrrrl.exe89⤵
-
\??\c:\nnhhtn.exec:\nnhhtn.exe90⤵
-
\??\c:\vvdvd.exec:\vvdvd.exe91⤵
-
\??\c:\bbnnbt.exec:\bbnnbt.exe92⤵
-
\??\c:\pjjpv.exec:\pjjpv.exe93⤵
-
\??\c:\llxxxfr.exec:\llxxxfr.exe94⤵
- System Location Discovery: System Language Discovery
-
\??\c:\pjvjv.exec:\pjvjv.exe95⤵
-
\??\c:\nnnhbn.exec:\nnnhbn.exe96⤵
-
\??\c:\vdjjj.exec:\vdjjj.exe97⤵
-
\??\c:\5bnbbb.exec:\5bnbbb.exe98⤵
-
\??\c:\rxfflrx.exec:\rxfflrx.exe99⤵
-
\??\c:\nhhbtt.exec:\nhhbtt.exe100⤵
-
\??\c:\dpjpj.exec:\dpjpj.exe101⤵
- System Location Discovery: System Language Discovery
-
\??\c:\bnbnht.exec:\bnbnht.exe102⤵
-
\??\c:\frlrxfx.exec:\frlrxfx.exe103⤵
-
\??\c:\bbbbtt.exec:\bbbbtt.exe104⤵
-
\??\c:\xrrxfxf.exec:\xrrxfxf.exe105⤵
-
\??\c:\ppjpp.exec:\ppjpp.exe106⤵
-
\??\c:\ffllllr.exec:\ffllllr.exe107⤵
-
\??\c:\pjddd.exec:\pjddd.exe108⤵
-
\??\c:\rrrlxfl.exec:\rrrlxfl.exe109⤵
- System Location Discovery: System Language Discovery
-
\??\c:\vdpjv.exec:\vdpjv.exe110⤵
-
\??\c:\lxrflff.exec:\lxrflff.exe111⤵
-
\??\c:\nbthbb.exec:\nbthbb.exe112⤵
-
\??\c:\frrlxrl.exec:\frrlxrl.exe113⤵
-
\??\c:\bhbhbh.exec:\bhbhbh.exe114⤵
-
\??\c:\vpvvv.exec:\vpvvv.exe115⤵
-
\??\c:\lrrlrrr.exec:\lrrlrrr.exe116⤵
-
\??\c:\bthnnh.exec:\bthnnh.exe117⤵
-
\??\c:\pppdj.exec:\pppdj.exe118⤵
-
\??\c:\hnbthb.exec:\hnbthb.exe119⤵
-
\??\c:\djdjp.exec:\djdjp.exe120⤵
-
\??\c:\rxlxrrx.exec:\rxlxrrx.exe121⤵
-
\??\c:\jdvjp.exec:\jdvjp.exe122⤵
-
\??\c:\tnthnh.exec:\tnthnh.exe123⤵
-
\??\c:\5vjvp.exec:\5vjvp.exe124⤵
- System Location Discovery: System Language Discovery
-
\??\c:\xlrrrlx.exec:\xlrrrlx.exe125⤵
-
\??\c:\jpvvj.exec:\jpvvj.exe126⤵
-
\??\c:\xxxxxfr.exec:\xxxxxfr.exe127⤵
-
\??\c:\3hnnbb.exec:\3hnnbb.exe128⤵
-
\??\c:\xlfrxrf.exec:\xlfrxrf.exe129⤵
-
\??\c:\djdvj.exec:\djdvj.exe130⤵
-
\??\c:\lxlrfrl.exec:\lxlrfrl.exe131⤵
-
\??\c:\nnttbb.exec:\nnttbb.exe132⤵
-
\??\c:\jdpdd.exec:\jdpdd.exe133⤵
-
\??\c:\lrfrrlf.exec:\lrfrrlf.exe134⤵
-
\??\c:\tbbhbh.exec:\tbbhbh.exe135⤵
- System Location Discovery: System Language Discovery
-
\??\c:\dvvpj.exec:\dvvpj.exe136⤵
-
\??\c:\llrfrrf.exec:\llrfrrf.exe137⤵
-
\??\c:\btntht.exec:\btntht.exe138⤵
-
\??\c:\vdddj.exec:\vdddj.exe139⤵
-
\??\c:\lrfflrr.exec:\lrfflrr.exe140⤵
-
\??\c:\bbbbth.exec:\bbbbth.exe141⤵
-
\??\c:\pvvdd.exec:\pvvdd.exe142⤵
- System Location Discovery: System Language Discovery
-
\??\c:\nbbhhh.exec:\nbbhhh.exe143⤵
-
\??\c:\htthhb.exec:\htthhb.exe144⤵
-
\??\c:\jjvjd.exec:\jjvjd.exe145⤵
-
\??\c:\lxrrxfl.exec:\lxrrxfl.exe146⤵
-
\??\c:\bhtnhh.exec:\bhtnhh.exe147⤵
-
\??\c:\frrfrlx.exec:\frrfrlx.exe148⤵
-
\??\c:\hbttbh.exec:\hbttbh.exe149⤵
-
\??\c:\7xfrllx.exec:\7xfrllx.exe150⤵
-
\??\c:\hhbbbt.exec:\hhbbbt.exe151⤵
-
\??\c:\7ppvp.exec:\7ppvp.exe152⤵
-
\??\c:\nhhhht.exec:\nhhhht.exe153⤵
-
\??\c:\nnhnhn.exec:\nnhnhn.exe154⤵
- System Location Discovery: System Language Discovery
-
\??\c:\jpdvd.exec:\jpdvd.exe155⤵
-
\??\c:\xlxrxrr.exec:\xlxrxrr.exe156⤵
-
\??\c:\rrxffxx.exec:\rrxffxx.exe157⤵
- System Location Discovery: System Language Discovery
-
\??\c:\llxrlrl.exec:\llxrlrl.exe158⤵
-
\??\c:\hbnnnh.exec:\hbnnnh.exe159⤵
-
\??\c:\pvjjv.exec:\pvjjv.exe160⤵
- System Location Discovery: System Language Discovery
-
\??\c:\hntbnh.exec:\hntbnh.exe161⤵
- System Location Discovery: System Language Discovery
-
\??\c:\3vdjp.exec:\3vdjp.exe162⤵
- System Location Discovery: System Language Discovery
-
\??\c:\3rxxrfr.exec:\3rxxrfr.exe163⤵
- System Location Discovery: System Language Discovery
-
\??\c:\tbhttt.exec:\tbhttt.exe164⤵
-
\??\c:\3xlrxxx.exec:\3xlrxxx.exe165⤵
-
\??\c:\bhhtbt.exec:\bhhtbt.exe166⤵
-
\??\c:\llrlrrx.exec:\llrlrrx.exe167⤵
-
\??\c:\pdvdj.exec:\pdvdj.exe168⤵
-
\??\c:\rfxxllr.exec:\rfxxllr.exe169⤵
-
\??\c:\pppjv.exec:\pppjv.exe170⤵
-
\??\c:\xxxffxl.exec:\xxxffxl.exe171⤵
-
\??\c:\vjjjd.exec:\vjjjd.exe172⤵
-
\??\c:\flrfrxl.exec:\flrfrxl.exe173⤵
-
\??\c:\tnhnbn.exec:\tnhnbn.exe174⤵
-
\??\c:\fflfxfx.exec:\fflfxfx.exe175⤵
-
\??\c:\7nhbnb.exec:\7nhbnb.exe176⤵
-
\??\c:\nnnbnb.exec:\nnnbnb.exe177⤵
-
\??\c:\tnhtbh.exec:\tnhtbh.exe178⤵
-
\??\c:\frlrlfr.exec:\frlrlfr.exe179⤵
-
\??\c:\nhntnt.exec:\nhntnt.exe180⤵
-
\??\c:\vddvp.exec:\vddvp.exe181⤵
-
\??\c:\jvddj.exec:\jvddj.exe182⤵
-
\??\c:\rlxflrr.exec:\rlxflrr.exe183⤵
-
\??\c:\7bhttt.exec:\7bhttt.exe184⤵
- System Location Discovery: System Language Discovery
-
\??\c:\rfrfxrx.exec:\rfrfxrx.exe185⤵
-
\??\c:\tnhhnt.exec:\tnhhnt.exe186⤵
-
\??\c:\pvdjj.exec:\pvdjj.exe187⤵
-
\??\c:\btntnt.exec:\btntnt.exe188⤵
-
\??\c:\djppd.exec:\djppd.exe189⤵
-
\??\c:\rxrllrx.exec:\rxrllrx.exe190⤵
-
\??\c:\hhnntt.exec:\hhnntt.exe191⤵
-
\??\c:\djvdj.exec:\djvdj.exe192⤵
-
\??\c:\flrfrll.exec:\flrfrll.exe193⤵
-
\??\c:\bhbtnn.exec:\bhbtnn.exe194⤵
-
\??\c:\djdpp.exec:\djdpp.exe195⤵
-
\??\c:\vddvj.exec:\vddvj.exe196⤵
-
\??\c:\9hhnhn.exec:\9hhnhn.exe197⤵
-
\??\c:\xfllrff.exec:\xfllrff.exe198⤵
-
\??\c:\ntbnbt.exec:\ntbnbt.exe199⤵
-
\??\c:\xfrfllr.exec:\xfrfllr.exe200⤵
-
\??\c:\pjvpd.exec:\pjvpd.exe201⤵
-
\??\c:\lfllxxr.exec:\lfllxxr.exe202⤵
-
\??\c:\pdpdj.exec:\pdpdj.exe203⤵
-
\??\c:\rflxxrx.exec:\rflxxrx.exe204⤵
-
\??\c:\djpjd.exec:\djpjd.exe205⤵
-
\??\c:\xrxfffl.exec:\xrxfffl.exe206⤵
-
\??\c:\7hbbbb.exec:\7hbbbb.exe207⤵
-
\??\c:\dvjpd.exec:\dvjpd.exe208⤵
- System Location Discovery: System Language Discovery
-
\??\c:\flfrffr.exec:\flfrffr.exe209⤵
-
\??\c:\dvdpp.exec:\dvdpp.exe210⤵
-
\??\c:\xrfflxf.exec:\xrfflxf.exe211⤵
-
\??\c:\llfllxl.exec:\llfllxl.exe212⤵
-
\??\c:\vjpjd.exec:\vjpjd.exe213⤵
-
\??\c:\fflxxlf.exec:\fflxxlf.exe214⤵
- System Location Discovery: System Language Discovery
-
\??\c:\hthbnh.exec:\hthbnh.exe215⤵
-
\??\c:\pdjdd.exec:\pdjdd.exe216⤵
-
\??\c:\flxflll.exec:\flxflll.exe217⤵
-
\??\c:\hnnhtn.exec:\hnnhtn.exe218⤵
-
\??\c:\dddpd.exec:\dddpd.exe219⤵
-
\??\c:\lfxxrrl.exec:\lfxxrrl.exe220⤵
-
\??\c:\hhbbtt.exec:\hhbbtt.exe221⤵
-
\??\c:\ppvjd.exec:\ppvjd.exe222⤵
-
\??\c:\lfrrlrx.exec:\lfrrlrx.exe223⤵
-
\??\c:\nnhbhn.exec:\nnhbhn.exe224⤵
-
\??\c:\djddd.exec:\djddd.exe225⤵
-
\??\c:\lfxxxrf.exec:\lfxxxrf.exe226⤵
-
\??\c:\tnnhnh.exec:\tnnhnh.exe227⤵
-
\??\c:\pdvvj.exec:\pdvvj.exe228⤵
-
\??\c:\thtbht.exec:\thtbht.exe229⤵
-
\??\c:\rxrxrfl.exec:\rxrxrfl.exe230⤵
-
\??\c:\hhtbbh.exec:\hhtbbh.exe231⤵
-
\??\c:\jjpvd.exec:\jjpvd.exe232⤵
-
\??\c:\djppv.exec:\djppv.exe233⤵
-
\??\c:\lrllllr.exec:\lrllllr.exe234⤵
-
\??\c:\nttnnn.exec:\nttnnn.exe235⤵
-
\??\c:\jpvjp.exec:\jpvjp.exe236⤵
-
\??\c:\lrfxfxx.exec:\lrfxfxx.exe237⤵
-
\??\c:\jjvjd.exec:\jjvjd.exe238⤵
-
\??\c:\djvdp.exec:\djvdp.exe239⤵
-
\??\c:\9pddp.exec:\9pddp.exe240⤵
-
\??\c:\flrrxrr.exec:\flrrxrr.exe241⤵