Analysis
- max time kernel
150s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
31/08/2026, 10:43
Static task
static1
1 signatures
General
- Target c933c2cdb6ee59b348186eaba8664f7151d0e0c0795c64bdb52cc09c726d1ba4.exe
- Size 115KB
- Sample260831-msc54sswhy
- SHA256 c933c2cdb6ee59b348186eaba8664f7151d0e0c0795c64bdb52cc09c726d1ba4
- MD5 8dc6af6bbbe8cc2e3273b6f7cdd39421
- SHA1 1a2d4d0006acbb7e08e07db86641ad615f3390bc
- SHA512 01fcd272694f57b5885670b4cf9d26eca9088735b1e06315fd949d8af6216a6925b5a9fa185db83e7789cefc4593cdf3f196ab0616aedaacc3a9bd6cace474d9
- SSDEEP 3072:ymb3NkkiQ3mdBjFo73tvn+Yp9gFb8kSv3v1p4v:n3C9BRo7tvnJ9oLSvv1y
- TLSH T1EBC3E1F56B5C73A6C6A8D73187974958242622739D851CFE40A423CA0F3DA82FF81C7E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5188 tbttnh.exe 5340 xrrxrfx.exe 1732 ppvpd.exe 3796 7jjdv.exe 3160 rrflfrr.exe 4520 rrffrxl.exe 2748 xxrlflf.exe 2500 xfxrrxr.exe 1744 hhtnnt.exe 468 ppppp.exe 5140 nbhhbh.exe 2740 jdddd.exe 1568 7ffxrrl.exe 2128 pjvvp.exe 1724 flrrrrr.exe 60 7hhbtt.exe 5124 ntbnhh.exe 3292 bttnnn.exe 5924 vjpjd.exe 5000 tthtnb.exe 1244 7xlxllr.exe 5436 7bbtth.exe 660 pjjdv.exe 3316 btnnnn.exe 5804 jddvp.exe 5576 dpdvj.exe 1260 1frllff.exe 1224 ppvvv.exe 2780 rllrflf.exe 3648 1thhbb.exe 2396 jddjd.exe 3472 xrllflr.exe 5604 fxlffff.exe 3308 vpvvp.exe 2776 hnnnbb.exe 1948 7hhtnn.exe 5880 1jvvd.exe 2044 nbhnnt.exe 1880 tbhbbt.exe 4328 jvpjj.exe 3832 lffxxxr.exe 2392 htbbbt.exe 4888 5vvvv.exe 3512 lffflfl.exe 260 ntbbtt.exe 5840 pjpvv.exe 3356 pjpjd.exe 2600 lxxrffx.exe 888 ttnhnh.exe 5768 3pppj.exe 5028 fxxrrxx.exe 1468 ttbtnn.exe 1204 3jvdv.exe 3480 xxxxxxx.exe 2848 nhtthn.exe 2688 vdjdv.exe 3940 5fllrrl.exe 384 lfrlflf.exe 1788 hhhbtt.exe 5756 dpvpj.exe 4144 nnnttb.exe 5820 frfxrrl.exe 4256 xrxxxxx.exe 3652 nhhtnb.exe -
resource yara_rule behavioral1/memory/3172-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/5188-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/5340-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3796-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1732-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3160-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4520-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1744-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/468-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/5140-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/60-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1724-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/5124-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3292-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/5924-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/5000-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/5436-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/660-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3316-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/5804-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1224-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3648-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3472-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/5604-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3308-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/5880-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1880-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3832-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4888-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/5840-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3356-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/888-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/5768-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-300-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-304-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/5756-320-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4144-324-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3652-336-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4436-364-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4364-368-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4220-376-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/6068-396-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/5660-416-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/5980-436-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4216-484-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4820-532-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3776-592-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-616-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1416-632-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4360-673-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/644-720-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4424-784-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/5388-1056-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/5420-1380-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3136-1404-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/7096-3307-0x0000000000400000-0x0000000000429000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxfrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3172 wrote to memory of 5188 3172 c933c2cdb6ee59b348186eaba8664f7151d0e0c0795c64bdb52cc09c726d1ba4.exe 86 PID 5188 wrote to memory of 5340 5188 tbttnh.exe 87 PID 5340 wrote to memory of 1732 5340 xrrxrfx.exe 88 PID 1732 wrote to memory of 3796 1732 ppvpd.exe 89 PID 3796 wrote to memory of 3160 3796 7jjdv.exe 90 PID 3160 wrote to memory of 4520 3160 rrflfrr.exe 91 PID 4520 wrote to memory of 2748 4520 rrffrxl.exe 92 PID 2748 wrote to memory of 2500 2748 xxrlflf.exe 93 PID 2500 wrote to memory of 1744 2500 xfxrrxr.exe 94 PID 1744 wrote to memory of 468 1744 hhtnnt.exe 95 PID 468 wrote to memory of 5140 468 ppppp.exe 96 PID 5140 wrote to memory of 2740 5140 nbhhbh.exe 97 PID 2740 wrote to memory of 1568 2740 jdddd.exe 98 PID 1568 wrote to memory of 2128 1568 7ffxrrl.exe 99 PID 2128 wrote to memory of 1724 2128 pjvvp.exe 100 PID 1724 wrote to memory of 60 1724 flrrrrr.exe 101 PID 60 wrote to memory of 5124 60 7hhbtt.exe 102 PID 5124 wrote to memory of 3292 5124 ntbnhh.exe 103 PID 3292 wrote to memory of 5924 3292 bttnnn.exe 104 PID 5924 wrote to memory of 5000 5924 vjpjd.exe 105 PID 5000 wrote to memory of 1244 5000 tthtnb.exe 106 PID 1244 wrote to memory of 5436 1244 7xlxllr.exe 107 PID 5436 wrote to memory of 660 5436 7bbtth.exe 108 PID 660 wrote to memory of 3316 660 pjjdv.exe 109 PID 3316 wrote to memory of 5804 3316 btnnnn.exe 110 PID 5804 wrote to memory of 5576 5804 jddvp.exe 111 PID 5576 wrote to memory of 1260 5576 dpdvj.exe 112 PID 1260 wrote to memory of 1224 1260 1frllff.exe 113 PID 1224 wrote to memory of 2780 1224 ppvvv.exe 114 PID 2780 wrote to memory of 3648 2780 rllrflf.exe 115 PID 3648 wrote to memory of 2396 3648 1thhbb.exe 116 PID 2396 wrote to memory of 3472 2396 jddjd.exe 117 PID 3472 wrote to memory of 5604 3472 xrllflr.exe 118 PID 5604 wrote to memory of 3308 5604 fxlffff.exe 119 PID 3308 wrote to memory of 2776 3308 vpvvp.exe 120 PID 2776 wrote to memory of 1948 2776 hnnnbb.exe 121 PID 1948 wrote to memory of 5880 1948 7hhtnn.exe 122 PID 5880 wrote to memory of 2044 5880 1jvvd.exe 123 PID 2044 wrote to memory of 1880 2044 nbhnnt.exe 124 PID 1880 wrote to memory of 4328 1880 tbhbbt.exe 125 PID 4328 wrote to memory of 3832 4328 jvpjj.exe 126 PID 3832 wrote to memory of 2392 3832 lffxxxr.exe 127 PID 2392 wrote to memory of 4888 2392 htbbbt.exe 128 PID 4888 wrote to memory of 3512 4888 5vvvv.exe 129 PID 3512 wrote to memory of 260 3512 lffflfl.exe 130 PID 260 wrote to memory of 5840 260 ntbbtt.exe 131 PID 5840 wrote to memory of 3356 5840 pjpvv.exe 132 PID 3356 wrote to memory of 2600 3356 pjpjd.exe 133 PID 2600 wrote to memory of 888 2600 lxxrffx.exe 134 PID 888 wrote to memory of 5768 888 ttnhnh.exe 135 PID 5768 wrote to memory of 5028 5768 3pppj.exe 136 PID 5028 wrote to memory of 1468 5028 fxxrrxx.exe 137 PID 1468 wrote to memory of 1204 1468 ttbtnn.exe 138 PID 1204 wrote to memory of 3480 1204 3jvdv.exe 139 PID 3480 wrote to memory of 2848 3480 xxxxxxx.exe 140 PID 2848 wrote to memory of 2688 2848 nhtthn.exe 141 PID 2688 wrote to memory of 3940 2688 vdjdv.exe 142 PID 3940 wrote to memory of 384 3940 5fllrrl.exe 143 PID 384 wrote to memory of 1788 384 lfrlflf.exe 144 PID 1788 wrote to memory of 5756 1788 hhhbtt.exe 145 PID 5756 wrote to memory of 4144 5756 dpvpj.exe 146 PID 4144 wrote to memory of 5820 4144 nnnttb.exe 147 PID 5820 wrote to memory of 4256 5820 frfxrrl.exe 148 PID 4256 wrote to memory of 3652 4256 xrxxxxx.exe 149
Processes
-
C:\Users\Admin\AppData\Local\Temp\c933c2cdb6ee59b348186eaba8664f7151d0e0c0795c64bdb52cc09c726d1ba4.exe"C:\Users\Admin\AppData\Local\Temp\c933c2cdb6ee59b348186eaba8664f7151d0e0c0795c64bdb52cc09c726d1ba4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\tbttnh.exec:\tbttnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5188 -
\??\c:\xrrxrfx.exec:\xrrxrfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5340 -
\??\c:\ppvpd.exec:\ppvpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\7jjdv.exec:\7jjdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
\??\c:\rrflfrr.exec:\rrflfrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\rrffrxl.exec:\rrffrxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\xxrlflf.exec:\xxrlflf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\xfxrrxr.exec:\xfxrrxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\hhtnnt.exec:\hhtnnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\ppppp.exec:\ppppp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\nbhhbh.exec:\nbhhbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5140 -
\??\c:\jdddd.exec:\jdddd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\7ffxrrl.exec:\7ffxrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\pjvvp.exec:\pjvvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\flrrrrr.exec:\flrrrrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\7hhbtt.exec:\7hhbtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\ntbnhh.exec:\ntbnhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5124 -
\??\c:\bttnnn.exec:\bttnnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\vjpjd.exec:\vjpjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
\??\c:\tthtnb.exec:\tthtnb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\7xlxllr.exec:\7xlxllr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\7bbtth.exec:\7bbtth.exe23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5436 -
\??\c:\pjjdv.exec:\pjjdv.exe24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
\??\c:\btnnnn.exec:\btnnnn.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\jddvp.exec:\jddvp.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5804 -
\??\c:\dpdvj.exec:\dpdvj.exe27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5576 -
\??\c:\1frllff.exec:\1frllff.exe28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\ppvvv.exec:\ppvvv.exe29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\rllrflf.exec:\rllrflf.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\1thhbb.exec:\1thhbb.exe31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
\??\c:\jddjd.exec:\jddjd.exe32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\xrllflr.exec:\xrllflr.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\fxlffff.exec:\fxlffff.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5604 -
\??\c:\vpvvp.exec:\vpvvp.exe35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\hnnnbb.exec:\hnnnbb.exe36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\7hhtnn.exec:\7hhtnn.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\1jvvd.exec:\1jvvd.exe38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5880 -
\??\c:\nbhnnt.exec:\nbhnnt.exe39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\tbhbbt.exec:\tbhbbt.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\jvpjj.exec:\jvpjj.exe41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\lffxxxr.exec:\lffxxxr.exe42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
\??\c:\htbbbt.exec:\htbbbt.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\5vvvv.exec:\5vvvv.exe44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\lffflfl.exec:\lffflfl.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\ntbbtt.exec:\ntbbtt.exe46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:260 -
\??\c:\pjpvv.exec:\pjpvv.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5840 -
\??\c:\pjpjd.exec:\pjpjd.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\lxxrffx.exec:\lxxrffx.exe49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\ttnhnh.exec:\ttnhnh.exe50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\3pppj.exec:\3pppj.exe51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5768 -
\??\c:\fxxrrxx.exec:\fxxrrxx.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\ttbtnn.exec:\ttbtnn.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\3jvdv.exec:\3jvdv.exe54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\xxxxxxx.exec:\xxxxxxx.exe55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\nhtthn.exec:\nhtthn.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\vdjdv.exec:\vdjdv.exe57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\5fllrrl.exec:\5fllrrl.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\lfrlflf.exec:\lfrlflf.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\hhhbtt.exec:\hhhbtt.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\dpvpj.exec:\dpvpj.exe61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5756 -
\??\c:\nnnttb.exec:\nnnttb.exe62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
\??\c:\frfxrrl.exec:\frfxrrl.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5820 -
\??\c:\xrxxxxx.exec:\xrxxxxx.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
\??\c:\nhhtnb.exec:\nhhtnb.exe65⤵
- Executes dropped EXE
PID:3652 -
\??\c:\jjvpj.exec:\jjvpj.exe66⤵PID:4284
-
\??\c:\hhhbtn.exec:\hhhbtn.exe67⤵PID:4164
-
\??\c:\7ffxxrl.exec:\7ffxxrl.exe68⤵PID:5920
-
\??\c:\hbbbbt.exec:\hbbbbt.exe69⤵PID:2332
-
\??\c:\hhttbh.exec:\hhttbh.exe70⤵PID:5480
-
\??\c:\ddddd.exec:\ddddd.exe71⤵PID:4448
-
\??\c:\7ddjj.exec:\7ddjj.exe72⤵PID:4436
-
\??\c:\xxllrxf.exec:\xxllrxf.exe73⤵PID:4364
-
\??\c:\bbttbh.exec:\bbttbh.exe74⤵PID:1720
-
\??\c:\bthhnt.exec:\bthhnt.exe75⤵PID:4220
-
\??\c:\jjdvp.exec:\jjdvp.exe76⤵PID:3980
-
\??\c:\rxfxxxr.exec:\rxfxxxr.exe77⤵PID:3808
-
\??\c:\rxlfxrl.exec:\rxlfxrl.exe78⤵PID:5508
-
\??\c:\nhhhnn.exec:\nhhhnn.exe79⤵PID:5672
-
\??\c:\bbhbbt.exec:\bbhbbt.exe80⤵PID:6068
-
\??\c:\jdpvv.exec:\jdpvv.exe81⤵PID:2964
-
\??\c:\rxfrllx.exec:\rxfrllx.exe82⤵PID:1380
-
\??\c:\fxrlxrx.exec:\fxrlxrx.exe83⤵PID:2112
-
\??\c:\tbtnnh.exec:\tbtnnh.exe84⤵PID:3392
-
\??\c:\ddvpj.exec:\ddvpj.exe85⤵PID:5660
-
\??\c:\llrllfx.exec:\llrllfx.exe86⤵PID:3788
-
\??\c:\vvpjd.exec:\vvpjd.exe87⤵PID:2108
-
\??\c:\tnhnbn.exec:\tnhnbn.exe88⤵PID:4568
-
\??\c:\nbnbtt.exec:\nbnbtt.exe89⤵PID:1920
-
\??\c:\vvvdv.exec:\vvvdv.exe90⤵PID:5980
-
\??\c:\vppvv.exec:\vppvv.exe91⤵PID:1696
-
\??\c:\ntbnbn.exec:\ntbnbn.exe92⤵PID:2036
-
\??\c:\ffxrrrl.exec:\ffxrrrl.exe93⤵PID:5364
-
\??\c:\bttnbb.exec:\bttnbb.exe94⤵PID:5544
-
\??\c:\jppvj.exec:\jppvj.exe95⤵PID:5460
-
\??\c:\rlllfxx.exec:\rlllfxx.exe96⤵PID:5424
-
\??\c:\ppdvp.exec:\ppdvp.exe97⤵PID:1572
-
\??\c:\flxrllf.exec:\flxrllf.exe98⤵PID:4612
-
\??\c:\hhbbbh.exec:\hhbbbh.exe99⤵PID:1064
-
\??\c:\ffxxrxx.exec:\ffxxrxx.exe100⤵PID:1844
-
\??\c:\ttbbbh.exec:\ttbbbh.exe101⤵PID:1496
-
\??\c:\ddpdp.exec:\ddpdp.exe102⤵PID:4216
-
\??\c:\fxrrrff.exec:\fxrrrff.exe103⤵PID:5448
-
\??\c:\9nhhhb.exec:\9nhhhb.exe104⤵PID:776
-
\??\c:\xlxxrxx.exec:\xlxxrxx.exe105⤵PID:5632
-
\??\c:\djdpp.exec:\djdpp.exe106⤵PID:5288
-
\??\c:\3frrxfx.exec:\3frrxfx.exe107⤵
- System Location Discovery: System Language Discovery
PID:5052 -
\??\c:\rlfxffl.exec:\rlfxffl.exe108⤵PID:5876
-
\??\c:\hbhbbt.exec:\hbhbbt.exe109⤵PID:5872
-
\??\c:\5fxrrrr.exec:\5fxrrrr.exe110⤵PID:5316
-
\??\c:\jvvpj.exec:\jvvpj.exe111⤵PID:5204
-
\??\c:\jjvpj.exec:\jjvpj.exe112⤵PID:1016
-
\??\c:\xrxxllf.exec:\xrxxllf.exe113⤵PID:2804
-
\??\c:\1jjjd.exec:\1jjjd.exe114⤵PID:4820
-
\??\c:\frfxllf.exec:\frfxllf.exe115⤵PID:4072
-
\??\c:\ntbbbb.exec:\ntbbbb.exe116⤵PID:3712
-
\??\c:\pdjpv.exec:\pdjpv.exe117⤵PID:4908
-
\??\c:\9rrxrrr.exec:\9rrxrrr.exe118⤵PID:5500
-
\??\c:\llxxfll.exec:\llxxfll.exe119⤵PID:2524
-
\??\c:\nhbttn.exec:\nhbttn.exe120⤵PID:5992
-
\??\c:\jjdvp.exec:\jjdvp.exe121⤵PID:1168
-
\??\c:\1fllfll.exec:\1fllfll.exe122⤵PID:2484
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-