Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01-11-2024 18:08
Static task
static1
Behavioral task
behavioral1
Sample
400be83843cbeecfb5056984cb704d39e0fe8721be7eab48b5cef0c2e6724666N.exe
Resource
win7-20241023-en
General
-
Target
400be83843cbeecfb5056984cb704d39e0fe8721be7eab48b5cef0c2e6724666N.exe
-
Size
455KB
-
MD5
6914a1848857524a5438d099196890a0
-
SHA1
657f13c3da848c5db678479ace772869098045fd
-
SHA256
400be83843cbeecfb5056984cb704d39e0fe8721be7eab48b5cef0c2e6724666
-
SHA512
baff3a48b023035a909c7aeb75350bdeecfb53d55d13b8ce3a5f600793eb432fbb117570f33d756bad8ca5b5768fff6e4c04628b218b2adc69c10bfe0496a577
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRG:q7Tc2NYHUrAwfMp3CDRG
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4836-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/968-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1188-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3008-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2100-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4156-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2280-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1904-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1372-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4656-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4104-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1648-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4604-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2056-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/740-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1400-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3632-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1728-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4368-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1708-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1188-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/672-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3080-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3236-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1956-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2372-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3708-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3332-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2660-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3240-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2920-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2296-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3312-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2720-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3284-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/332-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2172-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/384-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2280-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3252-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3660-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3632-476-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3240-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2696-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/740-618-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4596-691-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2372-744-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-845-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-903-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4176-1439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3196-1737-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ppjpv.exe7hbthh.exebhttnt.exelfrlrrf.exexxllfll.exe1vvdd.exehtnbnb.exerfxflrr.exehnhnbh.exetnnnnt.exehhbbnb.exeddjjp.exetnbbbh.exexxrrflx.exelrlllrx.exefrlrlrl.exe3lllxfr.exehnttbh.exennbntb.exedpvvd.exe7ttttb.exedjjjv.exeppvdd.exehbnbnt.exexlxflfl.exehnhhhn.exejjvvd.exe9ttbbn.exejppdj.exetnbttt.exebbtbbn.exerlllflx.exeppddd.exelxxxxxf.exehhnnht.exejjjvd.exerrffxll.exerrllrxl.exetbhhht.exevdppv.exe1pdjd.exefflllll.exentbhtb.exepvdvp.exefxfflrl.exettnttb.exedvppp.exepvvdd.exerrfflrx.exenbbhbh.exe7bnnnn.exedvppp.exerfxxfxl.exerrxxflr.exevdpvv.exe3xlrrxf.exettbnhn.exe7ppvj.exerrfrrrx.exebhbtbn.exenhttbb.exejvdpv.exeffrrxfl.exehtttnh.exepid process 4844 ppjpv.exe 968 7hbthh.exe 1968 bhttnt.exe 1188 lfrlrrf.exe 3008 xxllfll.exe 2100 1vvdd.exe 4940 htnbnb.exe 4156 rfxflrr.exe 2280 hnhnbh.exe 1904 tnnnnt.exe 452 hhbbnb.exe 5072 ddjjp.exe 4656 tnbbbh.exe 1372 xxrrflx.exe 4424 lrlllrx.exe 4620 frlrlrl.exe 4104 3lllxfr.exe 1648 hnttbh.exe 4604 nnbntb.exe 2056 dpvvd.exe 740 7ttttb.exe 1400 djjjv.exe 2900 ppvdd.exe 4916 hbnbnt.exe 3632 xlxflfl.exe 2920 hnhhhn.exe 4576 jjvvd.exe 3468 9ttbbn.exe 2716 jppdj.exe 4972 tnbttt.exe 1728 bbtbbn.exe 1960 rlllflx.exe 1860 ppddd.exe 4388 lxxxxxf.exe 4368 hhnnht.exe 1680 jjjvd.exe 4844 rrffxll.exe 860 rrllrxl.exe 3880 tbhhht.exe 2520 vdppv.exe 1708 1pdjd.exe 1188 fflllll.exe 672 ntbhtb.exe 3744 pvdvp.exe 1420 fxfflrl.exe 220 ttnttb.exe 3520 dvppp.exe 3080 pvvdd.exe 4268 rrfflrx.exe 4012 nbbhbh.exe 3236 7bnnnn.exe 3376 dvppp.exe 1956 rfxxfxl.exe 2624 rrxxflr.exe 5072 vdpvv.exe 2372 3xlrrxf.exe 1480 ttbnhn.exe 4980 7ppvj.exe 3932 rrfrrrx.exe 3296 bhbtbn.exe 3708 nhttbb.exe 4892 jvdpv.exe 1848 ffrrxfl.exe 3536 htttnh.exe -
Processes:
resource yara_rule behavioral2/memory/4836-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/968-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1188-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1188-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3008-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2100-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4156-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2280-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1904-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1372-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4656-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4104-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1648-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4604-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2056-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/740-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1400-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3632-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1728-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4368-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1708-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1708-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1188-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/672-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3080-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3236-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1956-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2372-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3332-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2660-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3240-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2920-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2296-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3312-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2720-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3284-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/332-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2172-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/384-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2280-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3660-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3632-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3240-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2696-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/740-618-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4596-691-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2372-744-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-845-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
dpppv.exeflrxxlr.exennhntb.exehnthnn.exelflxrrr.exe7pvpv.exellrrrxf.exevvpjj.exejdvdd.exebbhhnt.exexxrrrrr.exe7frllfx.exelffxxxx.exefxxxffx.exetbhtbn.exe9vdjd.exehthnnt.exeffrlllf.exeddvvd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrxxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frllfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrlllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
400be83843cbeecfb5056984cb704d39e0fe8721be7eab48b5cef0c2e6724666N.exeppjpv.exe7hbthh.exebhttnt.exelfrlrrf.exexxllfll.exe1vvdd.exehtnbnb.exerfxflrr.exehnhnbh.exetnnnnt.exehhbbnb.exeddjjp.exetnbbbh.exexxrrflx.exelrlllrx.exefrlrlrl.exe3lllxfr.exehnttbh.exennbntb.exedpvvd.exe7ttttb.exedescription pid process target process PID 4836 wrote to memory of 4844 4836 400be83843cbeecfb5056984cb704d39e0fe8721be7eab48b5cef0c2e6724666N.exe ppjpv.exe PID 4836 wrote to memory of 4844 4836 400be83843cbeecfb5056984cb704d39e0fe8721be7eab48b5cef0c2e6724666N.exe ppjpv.exe PID 4836 wrote to memory of 4844 4836 400be83843cbeecfb5056984cb704d39e0fe8721be7eab48b5cef0c2e6724666N.exe ppjpv.exe PID 4844 wrote to memory of 968 4844 ppjpv.exe 7hbthh.exe PID 4844 wrote to memory of 968 4844 ppjpv.exe 7hbthh.exe PID 4844 wrote to memory of 968 4844 ppjpv.exe 7hbthh.exe PID 968 wrote to memory of 1968 968 7hbthh.exe bhttnt.exe PID 968 wrote to memory of 1968 968 7hbthh.exe bhttnt.exe PID 968 wrote to memory of 1968 968 7hbthh.exe bhttnt.exe PID 1968 wrote to memory of 1188 1968 bhttnt.exe lfrlrrf.exe PID 1968 wrote to memory of 1188 1968 bhttnt.exe lfrlrrf.exe PID 1968 wrote to memory of 1188 1968 bhttnt.exe lfrlrrf.exe PID 1188 wrote to memory of 3008 1188 lfrlrrf.exe xxllfll.exe PID 1188 wrote to memory of 3008 1188 lfrlrrf.exe xxllfll.exe PID 1188 wrote to memory of 3008 1188 lfrlrrf.exe xxllfll.exe PID 3008 wrote to memory of 2100 3008 xxllfll.exe 1vvdd.exe PID 3008 wrote to memory of 2100 3008 xxllfll.exe 1vvdd.exe PID 3008 wrote to memory of 2100 3008 xxllfll.exe 1vvdd.exe PID 2100 wrote to memory of 4940 2100 1vvdd.exe htnbnb.exe PID 2100 wrote to memory of 4940 2100 1vvdd.exe htnbnb.exe PID 2100 wrote to memory of 4940 2100 1vvdd.exe htnbnb.exe PID 4940 wrote to memory of 4156 4940 htnbnb.exe rfxflrr.exe PID 4940 wrote to memory of 4156 4940 htnbnb.exe rfxflrr.exe PID 4940 wrote to memory of 4156 4940 htnbnb.exe rfxflrr.exe PID 4156 wrote to memory of 2280 4156 rfxflrr.exe hnhnbh.exe PID 4156 wrote to memory of 2280 4156 rfxflrr.exe hnhnbh.exe PID 4156 wrote to memory of 2280 4156 rfxflrr.exe hnhnbh.exe PID 2280 wrote to memory of 1904 2280 hnhnbh.exe tnnnnt.exe PID 2280 wrote to memory of 1904 2280 hnhnbh.exe tnnnnt.exe PID 2280 wrote to memory of 1904 2280 hnhnbh.exe tnnnnt.exe PID 1904 wrote to memory of 452 1904 tnnnnt.exe hhbbnb.exe PID 1904 wrote to memory of 452 1904 tnnnnt.exe hhbbnb.exe PID 1904 wrote to memory of 452 1904 tnnnnt.exe hhbbnb.exe PID 452 wrote to memory of 5072 452 hhbbnb.exe ddjjp.exe PID 452 wrote to memory of 5072 452 hhbbnb.exe ddjjp.exe PID 452 wrote to memory of 5072 452 hhbbnb.exe ddjjp.exe PID 5072 wrote to memory of 4656 5072 ddjjp.exe tnbbbh.exe PID 5072 wrote to memory of 4656 5072 ddjjp.exe tnbbbh.exe PID 5072 wrote to memory of 4656 5072 ddjjp.exe tnbbbh.exe PID 4656 wrote to memory of 1372 4656 tnbbbh.exe xxrrflx.exe PID 4656 wrote to memory of 1372 4656 tnbbbh.exe xxrrflx.exe PID 4656 wrote to memory of 1372 4656 tnbbbh.exe xxrrflx.exe PID 1372 wrote to memory of 4424 1372 xxrrflx.exe lrlllrx.exe PID 1372 wrote to memory of 4424 1372 xxrrflx.exe lrlllrx.exe PID 1372 wrote to memory of 4424 1372 xxrrflx.exe lrlllrx.exe PID 4424 wrote to memory of 4620 4424 lrlllrx.exe frlrlrl.exe PID 4424 wrote to memory of 4620 4424 lrlllrx.exe frlrlrl.exe PID 4424 wrote to memory of 4620 4424 lrlllrx.exe frlrlrl.exe PID 4620 wrote to memory of 4104 4620 frlrlrl.exe 3lllxfr.exe PID 4620 wrote to memory of 4104 4620 frlrlrl.exe 3lllxfr.exe PID 4620 wrote to memory of 4104 4620 frlrlrl.exe 3lllxfr.exe PID 4104 wrote to memory of 1648 4104 3lllxfr.exe hnttbh.exe PID 4104 wrote to memory of 1648 4104 3lllxfr.exe hnttbh.exe PID 4104 wrote to memory of 1648 4104 3lllxfr.exe hnttbh.exe PID 1648 wrote to memory of 4604 1648 hnttbh.exe nnbntb.exe PID 1648 wrote to memory of 4604 1648 hnttbh.exe nnbntb.exe PID 1648 wrote to memory of 4604 1648 hnttbh.exe nnbntb.exe PID 4604 wrote to memory of 2056 4604 nnbntb.exe dpvvd.exe PID 4604 wrote to memory of 2056 4604 nnbntb.exe dpvvd.exe PID 4604 wrote to memory of 2056 4604 nnbntb.exe dpvvd.exe PID 2056 wrote to memory of 740 2056 dpvvd.exe 7ttttb.exe PID 2056 wrote to memory of 740 2056 dpvvd.exe 7ttttb.exe PID 2056 wrote to memory of 740 2056 dpvvd.exe 7ttttb.exe PID 740 wrote to memory of 1400 740 7ttttb.exe djjjv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\400be83843cbeecfb5056984cb704d39e0fe8721be7eab48b5cef0c2e6724666N.exe"C:\Users\Admin\AppData\Local\Temp\400be83843cbeecfb5056984cb704d39e0fe8721be7eab48b5cef0c2e6724666N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\ppjpv.exec:\ppjpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\7hbthh.exec:\7hbthh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\bhttnt.exec:\bhttnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\lfrlrrf.exec:\lfrlrrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\xxllfll.exec:\xxllfll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\1vvdd.exec:\1vvdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\htnbnb.exec:\htnbnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\rfxflrr.exec:\rfxflrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\hnhnbh.exec:\hnhnbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\tnnnnt.exec:\tnnnnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\hhbbnb.exec:\hhbbnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\ddjjp.exec:\ddjjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\tnbbbh.exec:\tnbbbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\xxrrflx.exec:\xxrrflx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\lrlllrx.exec:\lrlllrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\frlrlrl.exec:\frlrlrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\3lllxfr.exec:\3lllxfr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\hnttbh.exec:\hnttbh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\nnbntb.exec:\nnbntb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\dpvvd.exec:\dpvvd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\7ttttb.exec:\7ttttb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\djjjv.exec:\djjjv.exe23⤵
- Executes dropped EXE
PID:1400 -
\??\c:\ppvdd.exec:\ppvdd.exe24⤵
- Executes dropped EXE
PID:2900 -
\??\c:\hbnbnt.exec:\hbnbnt.exe25⤵
- Executes dropped EXE
PID:4916 -
\??\c:\xlxflfl.exec:\xlxflfl.exe26⤵
- Executes dropped EXE
PID:3632 -
\??\c:\hnhhhn.exec:\hnhhhn.exe27⤵
- Executes dropped EXE
PID:2920 -
\??\c:\jjvvd.exec:\jjvvd.exe28⤵
- Executes dropped EXE
PID:4576 -
\??\c:\9ttbbn.exec:\9ttbbn.exe29⤵
- Executes dropped EXE
PID:3468 -
\??\c:\jppdj.exec:\jppdj.exe30⤵
- Executes dropped EXE
PID:2716 -
\??\c:\tnbttt.exec:\tnbttt.exe31⤵
- Executes dropped EXE
PID:4972 -
\??\c:\bbtbbn.exec:\bbtbbn.exe32⤵
- Executes dropped EXE
PID:1728 -
\??\c:\rlllflx.exec:\rlllflx.exe33⤵
- Executes dropped EXE
PID:1960 -
\??\c:\ppddd.exec:\ppddd.exe34⤵
- Executes dropped EXE
PID:1860 -
\??\c:\lxxxxxf.exec:\lxxxxxf.exe35⤵
- Executes dropped EXE
PID:4388 -
\??\c:\hhnnht.exec:\hhnnht.exe36⤵
- Executes dropped EXE
PID:4368 -
\??\c:\jjjvd.exec:\jjjvd.exe37⤵
- Executes dropped EXE
PID:1680 -
\??\c:\rrffxll.exec:\rrffxll.exe38⤵
- Executes dropped EXE
PID:4844 -
\??\c:\rrllrxl.exec:\rrllrxl.exe39⤵
- Executes dropped EXE
PID:860 -
\??\c:\tbhhht.exec:\tbhhht.exe40⤵
- Executes dropped EXE
PID:3880 -
\??\c:\vdppv.exec:\vdppv.exe41⤵
- Executes dropped EXE
PID:2520 -
\??\c:\1pdjd.exec:\1pdjd.exe42⤵
- Executes dropped EXE
PID:1708 -
\??\c:\fflllll.exec:\fflllll.exe43⤵
- Executes dropped EXE
PID:1188 -
\??\c:\ntbhtb.exec:\ntbhtb.exe44⤵
- Executes dropped EXE
PID:672 -
\??\c:\pvdvp.exec:\pvdvp.exe45⤵
- Executes dropped EXE
PID:3744 -
\??\c:\fxfflrl.exec:\fxfflrl.exe46⤵
- Executes dropped EXE
PID:1420 -
\??\c:\ttnttb.exec:\ttnttb.exe47⤵
- Executes dropped EXE
PID:220 -
\??\c:\dvppp.exec:\dvppp.exe48⤵
- Executes dropped EXE
PID:3520 -
\??\c:\pvvdd.exec:\pvvdd.exe49⤵
- Executes dropped EXE
PID:3080 -
\??\c:\rrfflrx.exec:\rrfflrx.exe50⤵
- Executes dropped EXE
PID:4268 -
\??\c:\nbbhbh.exec:\nbbhbh.exe51⤵
- Executes dropped EXE
PID:4012 -
\??\c:\7bnnnn.exec:\7bnnnn.exe52⤵
- Executes dropped EXE
PID:3236 -
\??\c:\dvppp.exec:\dvppp.exe53⤵
- Executes dropped EXE
PID:3376 -
\??\c:\rfxxfxl.exec:\rfxxfxl.exe54⤵
- Executes dropped EXE
PID:1956 -
\??\c:\rrxxflr.exec:\rrxxflr.exe55⤵
- Executes dropped EXE
PID:2624 -
\??\c:\vdpvv.exec:\vdpvv.exe56⤵
- Executes dropped EXE
PID:5072 -
\??\c:\3xlrrxf.exec:\3xlrrxf.exe57⤵
- Executes dropped EXE
PID:2372 -
\??\c:\ttbnhn.exec:\ttbnhn.exe58⤵
- Executes dropped EXE
PID:1480 -
\??\c:\7ppvj.exec:\7ppvj.exe59⤵
- Executes dropped EXE
PID:4980 -
\??\c:\rrfrrrx.exec:\rrfrrrx.exe60⤵
- Executes dropped EXE
PID:3932 -
\??\c:\bhbtbn.exec:\bhbtbn.exe61⤵
- Executes dropped EXE
PID:3296 -
\??\c:\nhttbb.exec:\nhttbb.exe62⤵
- Executes dropped EXE
PID:3708 -
\??\c:\jvdpv.exec:\jvdpv.exe63⤵
- Executes dropped EXE
PID:4892 -
\??\c:\ffrrxfl.exec:\ffrrxfl.exe64⤵
- Executes dropped EXE
PID:1848 -
\??\c:\htttnh.exec:\htttnh.exe65⤵
- Executes dropped EXE
PID:3536 -
\??\c:\dpvvd.exec:\dpvvd.exe66⤵PID:4324
-
\??\c:\fflrxfl.exec:\fflrxfl.exe67⤵PID:4948
-
\??\c:\5tnbnb.exec:\5tnbnb.exe68⤵PID:740
-
\??\c:\djvvp.exec:\djvvp.exe69⤵PID:3332
-
\??\c:\1dppd.exec:\1dppd.exe70⤵PID:2868
-
\??\c:\fxfxxrr.exec:\fxfxxrr.exe71⤵PID:1300
-
\??\c:\vdppp.exec:\vdppp.exe72⤵PID:2660
-
\??\c:\1dpjv.exec:\1dpjv.exe73⤵PID:3240
-
\??\c:\rrlrxfl.exec:\rrlrxfl.exe74⤵PID:2888
-
\??\c:\hbttbh.exec:\hbttbh.exe75⤵PID:2920
-
\??\c:\vjjjd.exec:\vjjjd.exe76⤵PID:2296
-
\??\c:\xflrrxf.exec:\xflrrxf.exe77⤵PID:2696
-
\??\c:\nnhntb.exec:\nnhntb.exe78⤵PID:3312
-
\??\c:\9tbbhn.exec:\9tbbhn.exe79⤵PID:2704
-
\??\c:\jdppv.exec:\jdppv.exe80⤵PID:1020
-
\??\c:\lfxffff.exec:\lfxffff.exe81⤵PID:928
-
\??\c:\bhntth.exec:\bhntth.exe82⤵PID:3876
-
\??\c:\hhbtht.exec:\hhbtht.exe83⤵PID:2720
-
\??\c:\5jppv.exec:\5jppv.exe84⤵PID:4608
-
\??\c:\9rlxflr.exec:\9rlxflr.exe85⤵PID:1452
-
\??\c:\xlflrxf.exec:\xlflrxf.exe86⤵PID:3284
-
\??\c:\1djvv.exec:\1djvv.exe87⤵PID:332
-
\??\c:\flxrffr.exec:\flxrffr.exe88⤵PID:4688
-
\??\c:\hnbhnt.exec:\hnbhnt.exe89⤵PID:3948
-
\??\c:\jvvdd.exec:\jvvdd.exe90⤵PID:2520
-
\??\c:\jvvdv.exec:\jvvdv.exe91⤵PID:2620
-
\??\c:\flrlflr.exec:\flrlflr.exe92⤵PID:4968
-
\??\c:\hhtttb.exec:\hhtttb.exe93⤵PID:2100
-
\??\c:\3ddjv.exec:\3ddjv.exe94⤵PID:4848
-
\??\c:\fffffxf.exec:\fffffxf.exe95⤵PID:2172
-
\??\c:\nnhbnt.exec:\nnhbnt.exe96⤵PID:5016
-
\??\c:\pvjjp.exec:\pvjjp.exe97⤵PID:384
-
\??\c:\xfrxflr.exec:\xfrxflr.exe98⤵PID:2280
-
\??\c:\bthhhn.exec:\bthhhn.exe99⤵PID:4312
-
\??\c:\7ppjj.exec:\7ppjj.exe100⤵PID:1720
-
\??\c:\llxrxxx.exec:\llxrxxx.exe101⤵PID:488
-
\??\c:\ffxfxll.exec:\ffxfxll.exe102⤵PID:2564
-
\??\c:\9nbbbh.exec:\9nbbbh.exe103⤵PID:1732
-
\??\c:\vpdjd.exec:\vpdjd.exe104⤵PID:2784
-
\??\c:\vpjdv.exec:\vpjdv.exe105⤵PID:1372
-
\??\c:\llffxfx.exec:\llffxfx.exe106⤵PID:3252
-
\??\c:\3htbbb.exec:\3htbbb.exe107⤵PID:2216
-
\??\c:\vjdvv.exec:\vjdvv.exe108⤵PID:2328
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe109⤵PID:4104
-
\??\c:\nthhhb.exec:\nthhhb.exe110⤵PID:3660
-
\??\c:\tthhnt.exec:\tthhnt.exe111⤵PID:3916
-
\??\c:\vjvjp.exec:\vjvjp.exe112⤵PID:2420
-
\??\c:\xflllxl.exec:\xflllxl.exe113⤵PID:3460
-
\??\c:\3bhhbn.exec:\3bhhbn.exe114⤵PID:4948
-
\??\c:\dddjp.exec:\dddjp.exe115⤵PID:1644
-
\??\c:\djjjp.exec:\djjjp.exe116⤵PID:1400
-
\??\c:\lfxflrf.exec:\lfxflrf.exe117⤵PID:4756
-
\??\c:\3ntntb.exec:\3ntntb.exe118⤵PID:3644
-
\??\c:\pvddd.exec:\pvddd.exe119⤵PID:3632
-
\??\c:\flfllrr.exec:\flfllrr.exe120⤵PID:3240
-
\??\c:\nntttb.exec:\nntttb.exe121⤵PID:2888
-
\??\c:\vpvvv.exec:\vpvvv.exe122⤵PID:4668
-
\??\c:\vdjjj.exec:\vdjjj.exe123⤵PID:1184
-
\??\c:\5flfflr.exec:\5flfflr.exe124⤵PID:2696
-
\??\c:\nnnntb.exec:\nnnntb.exe125⤵PID:716
-
\??\c:\dvpvj.exec:\dvpvj.exe126⤵PID:1488
-
\??\c:\jjjvd.exec:\jjjvd.exe127⤵PID:1896
-
\??\c:\fxxxffx.exec:\fxxxffx.exe128⤵
- System Location Discovery: System Language Discovery
PID:2064 -
\??\c:\hbbhnh.exec:\hbbhnh.exe129⤵PID:4528
-
\??\c:\jjvvv.exec:\jjvvv.exe130⤵PID:4828
-
\??\c:\pjdpj.exec:\pjdpj.exe131⤵PID:4540
-
\??\c:\lxlllll.exec:\lxlllll.exe132⤵PID:1452
-
\??\c:\5bbbtb.exec:\5bbbtb.exe133⤵PID:4344
-
\??\c:\ppvpj.exec:\ppvpj.exe134⤵PID:2424
-
\??\c:\frlfrxx.exec:\frlfrxx.exe135⤵PID:4840
-
\??\c:\llxfffl.exec:\llxfffl.exe136⤵PID:3196
-
\??\c:\ttnttn.exec:\ttnttn.exe137⤵PID:5052
-
\??\c:\jjvdv.exec:\jjvdv.exe138⤵PID:3456
-
\??\c:\lfflrxf.exec:\lfflrxf.exe139⤵PID:2476
-
\??\c:\7nhnbh.exec:\7nhnbh.exe140⤵PID:3260
-
\??\c:\ttbhbh.exec:\ttbhbh.exe141⤵PID:1420
-
\??\c:\jpvpp.exec:\jpvpp.exe142⤵PID:4148
-
\??\c:\xlxflxl.exec:\xlxflxl.exe143⤵PID:600
-
\??\c:\bhbbtb.exec:\bhbbtb.exe144⤵PID:2128
-
\??\c:\vdddd.exec:\vdddd.exe145⤵PID:4444
-
\??\c:\fxlrrxf.exec:\fxlrrxf.exe146⤵PID:1320
-
\??\c:\rlllllx.exec:\rlllllx.exe147⤵PID:980
-
\??\c:\thhhhn.exec:\thhhhn.exe148⤵PID:1416
-
\??\c:\pjvdj.exec:\pjvdj.exe149⤵PID:452
-
\??\c:\fxxfflr.exec:\fxxfflr.exe150⤵PID:3336
-
\??\c:\llfffrx.exec:\llfffrx.exe151⤵PID:1620
-
\??\c:\hbnnnt.exec:\hbnnnt.exe152⤵PID:2372
-
\??\c:\jdjjd.exec:\jdjjd.exe153⤵PID:1480
-
\??\c:\xrlllrr.exec:\xrlllrr.exe154⤵PID:4632
-
\??\c:\frlrrxx.exec:\frlrrxx.exe155⤵PID:988
-
\??\c:\nntbbh.exec:\nntbbh.exe156⤵PID:1572
-
\??\c:\djppp.exec:\djppp.exe157⤵PID:4580
-
\??\c:\fxlfrfl.exec:\fxlfrfl.exe158⤵PID:3708
-
\??\c:\bbttbh.exec:\bbttbh.exe159⤵PID:1532
-
\??\c:\bthhnt.exec:\bthhnt.exe160⤵PID:4104
-
\??\c:\jdvdd.exec:\jdvdd.exe161⤵
- System Location Discovery: System Language Discovery
PID:3308 -
\??\c:\rrllrxf.exec:\rrllrxf.exe162⤵PID:4604
-
\??\c:\3thnhn.exec:\3thnhn.exe163⤵PID:1556
-
\??\c:\jdpvd.exec:\jdpvd.exe164⤵PID:3856
-
\??\c:\dpjjj.exec:\dpjjj.exe165⤵PID:740
-
\??\c:\bbbbtb.exec:\bbbbtb.exe166⤵PID:1644
-
\??\c:\vvjjp.exec:\vvjjp.exe167⤵PID:2868
-
\??\c:\lrxfxff.exec:\lrxfxff.exe168⤵PID:4916
-
\??\c:\rxrxfll.exec:\rxrxfll.exe169⤵PID:3464
-
\??\c:\hbnhnt.exec:\hbnhnt.exe170⤵PID:3632
-
\??\c:\pvddj.exec:\pvddj.exe171⤵PID:2920
-
\??\c:\ddvvd.exec:\ddvvd.exe172⤵PID:2888
-
\??\c:\rrllllr.exec:\rrllllr.exe173⤵PID:380
-
\??\c:\hnhhtb.exec:\hnhhtb.exe174⤵PID:2672
-
\??\c:\thnnbt.exec:\thnnbt.exe175⤵PID:2716
-
\??\c:\vjpvd.exec:\vjpvd.exe176⤵PID:4376
-
\??\c:\fxrxlll.exec:\fxrxlll.exe177⤵PID:4516
-
\??\c:\hnttbb.exec:\hnttbb.exe178⤵PID:1488
-
\??\c:\djjdd.exec:\djjdd.exe179⤵PID:1960
-
\??\c:\djpdd.exec:\djpdd.exe180⤵PID:2064
-
\??\c:\rxrrxrf.exec:\rxrrxrf.exe181⤵PID:2872
-
\??\c:\bnnnbn.exec:\bnnnbn.exe182⤵PID:4368
-
\??\c:\vpddd.exec:\vpddd.exe183⤵PID:216
-
\??\c:\rxxxfll.exec:\rxxxfll.exe184⤵PID:1524
-
\??\c:\nthbhh.exec:\nthbhh.exe185⤵PID:2252
-
\??\c:\djvpp.exec:\djvpp.exe186⤵PID:2424
-
\??\c:\vdppv.exec:\vdppv.exe187⤵PID:3192
-
\??\c:\xlxfrfr.exec:\xlxfrfr.exe188⤵PID:3196
-
\??\c:\tbtthn.exec:\tbtthn.exe189⤵PID:4596
-
\??\c:\pvdpv.exec:\pvdpv.exe190⤵PID:4280
-
\??\c:\flxxxfl.exec:\flxxxfl.exe191⤵PID:4808
-
\??\c:\xxllrxx.exec:\xxllrxx.exe192⤵PID:4428
-
\??\c:\tbhbhn.exec:\tbhbhn.exe193⤵PID:1420
-
\??\c:\jdpjj.exec:\jdpjj.exe194⤵PID:5016
-
\??\c:\llfllrr.exec:\llfllrr.exe195⤵PID:384
-
\??\c:\ntbhnt.exec:\ntbhnt.exe196⤵PID:4404
-
\??\c:\bbhhnt.exec:\bbhhnt.exe197⤵PID:1204
-
\??\c:\5vpjv.exec:\5vpjv.exe198⤵PID:572
-
\??\c:\lrlrflf.exec:\lrlrflf.exe199⤵PID:4256
-
\??\c:\nthbhh.exec:\nthbhh.exe200⤵PID:4988
-
\??\c:\djppp.exec:\djppp.exe201⤵PID:980
-
\??\c:\jpddj.exec:\jpddj.exe202⤵PID:1416
-
\??\c:\btbbbn.exec:\btbbbn.exe203⤵PID:452
-
\??\c:\djvvv.exec:\djvvv.exe204⤵PID:4372
-
\??\c:\jpvjd.exec:\jpvjd.exe205⤵PID:1620
-
\??\c:\flrrxfl.exec:\flrrxfl.exe206⤵PID:2372
-
\??\c:\tbbbbh.exec:\tbbbbh.exe207⤵PID:1372
-
\??\c:\vvppp.exec:\vvppp.exe208⤵PID:3896
-
\??\c:\xlxflrx.exec:\xlxflrx.exe209⤵PID:2560
-
\??\c:\fxfffll.exec:\fxfffll.exe210⤵PID:1648
-
\??\c:\tnbhhn.exec:\tnbhhn.exe211⤵PID:4468
-
\??\c:\7pvpv.exec:\7pvpv.exe212⤵
- System Location Discovery: System Language Discovery
PID:4892 -
\??\c:\lxlrrxr.exec:\lxlrrxr.exe213⤵PID:3536
-
\??\c:\5tbntb.exec:\5tbntb.exe214⤵PID:956
-
\??\c:\jpddp.exec:\jpddp.exe215⤵PID:2896
-
\??\c:\3vdvv.exec:\3vdvv.exe216⤵PID:2592
-
\??\c:\7llrlxx.exec:\7llrlxx.exe217⤵PID:4356
-
\??\c:\hnnhhn.exec:\hnnhhn.exe218⤵PID:1344
-
\??\c:\tthhhh.exec:\tthhhh.exe219⤵PID:3136
-
\??\c:\jpvdd.exec:\jpvdd.exe220⤵PID:4756
-
\??\c:\llffxfx.exec:\llffxfx.exe221⤵PID:3088
-
\??\c:\hbnhhn.exec:\hbnhhn.exe222⤵PID:3416
-
\??\c:\pvjjj.exec:\pvjjj.exe223⤵PID:3208
-
\??\c:\frfrrrr.exec:\frfrrrr.exe224⤵PID:1280
-
\??\c:\ntnnbt.exec:\ntnnbt.exe225⤵PID:1036
-
\??\c:\bbhhnt.exec:\bbhhnt.exe226⤵
- System Location Discovery: System Language Discovery
PID:3024 -
\??\c:\jpvvd.exec:\jpvvd.exe227⤵PID:3108
-
\??\c:\xxrrrrr.exec:\xxrrrrr.exe228⤵
- System Location Discovery: System Language Discovery
PID:1236 -
\??\c:\bbbbbh.exec:\bbbbbh.exe229⤵PID:728
-
\??\c:\pdppv.exec:\pdppv.exe230⤵PID:716
-
\??\c:\rlffrfl.exec:\rlffrfl.exe231⤵PID:928
-
\??\c:\hnbttb.exec:\hnbttb.exe232⤵PID:1896
-
\??\c:\pjvvd.exec:\pjvvd.exe233⤵PID:2720
-
\??\c:\xfrrrxx.exec:\xfrrrxx.exe234⤵PID:2064
-
\??\c:\bbhnnt.exec:\bbhnnt.exe235⤵PID:4540
-
\??\c:\pdpjj.exec:\pdpjj.exe236⤵PID:4368
-
\??\c:\vvdjj.exec:\vvdjj.exe237⤵PID:1380
-
\??\c:\7ffffrr.exec:\7ffffrr.exe238⤵PID:1524
-
\??\c:\tnnhnn.exec:\tnnhnn.exe239⤵PID:3948
-
\??\c:\vjddp.exec:\vjddp.exe240⤵PID:2424
-
\??\c:\rxlxrlf.exec:\rxlxrlf.exe241⤵PID:4160
-
\??\c:\dpdvp.exec:\dpdvp.exe242⤵PID:2940