Analysis
- max time kernel
150s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/09/2026, 15:32
Static task
static1
1 signatures
General
- Target 0e55147045096d841d5a3a8b070dcfbc3104317b9f78ff10bfd79ea4a13c6809.exe
- Size 64KB
- Sample260903-symvdszfmd
- SHA256 0e55147045096d841d5a3a8b070dcfbc3104317b9f78ff10bfd79ea4a13c6809
- MD5 2c10ffeb1f559cfbd91d97250c44d8d5
- SHA1 36ce4716d0c562046cf29a411f46de5739b8ba9a
- SHA512 a0dc833bd91a69f63f78b64afbdc04d6f10827dfb1efcad621c99b37b02baf596e468cb4567c561ebf3e2c3e5414569fef1df033f81b9cec16b689ff489aced2
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6Mu/ePS3Al:ymb3NkkiQ3mdBjFI46TQl
- TLSH T1FA5301FDCB60A7A5C4D9C63495EB8AD864723173ED646EE90091138B0B3A682B704C3E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2308 thhbhh.exe 3600 jjvjv.exe 5004 xrflxrl.exe 4492 btnhhh.exe 4716 lrxrrrl.exe 1664 hbbthh.exe 3900 rlfxllf.exe 1904 btnhhh.exe 2664 nhbtnn.exe 544 vvvpp.exe 3056 dvvpv.exe 2064 7lxffff.exe 1476 thbtnn.exe 3500 thhbbt.exe 4060 ddppv.exe 3860 nthntt.exe 1340 xrrfrlx.exe 5048 hnhtht.exe 4016 nbnbnt.exe 4848 vpvjp.exe 4780 xffxxff.exe 4744 nhhbbb.exe 2524 xlxxxlf.exe 3988 5bhnhn.exe 4520 jppjd.exe 4612 ttthbh.exe 4360 vdjjj.exe 1056 7rxrllf.exe 3332 pvvdj.exe 1460 pddvd.exe 868 ffllrrf.exe 4700 rxfrxlf.exe 3220 9hnnbn.exe 4068 jdpdp.exe 684 3rrlrrl.exe 4712 nhhnnt.exe 2280 xxrrlfr.exe 4200 hbhhtb.exe 3800 jvdvv.exe 2232 9rxllll.exe 1644 9nnbtn.exe 3236 dvdvv.exe 2152 dvdvp.exe 4244 1rxxxfx.exe 2476 bhhbbb.exe 4328 tntntt.exe 1216 rlfxrrl.exe 1612 thnnhn.exe 1684 rxflllr.exe 2640 jpjdv.exe 772 bthbnn.exe 4212 nnbbbn.exe 2148 flxrrlf.exe 4896 djppd.exe 4684 httnhb.exe 1132 dvjjj.exe 3436 lffxlll.exe 3444 bbhnht.exe 2160 ddjjd.exe 3980 lrfxrxx.exe 3172 bthbbb.exe 3556 thtbbh.exe 576 djppp.exe 3392 llflrxl.exe -
resource yara_rule behavioral1/memory/1732-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1732-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2308-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/5004-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3600-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4492-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4716-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1904-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3900-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/544-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3500-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1476-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3860-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1340-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/5048-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4848-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3988-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4520-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4612-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1056-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3332-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3220-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4068-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4712-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4200-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3800-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1644-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4244-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1612-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1684-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4212-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/576-333-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4988-353-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4032-357-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1972-361-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4160-369-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3928-393-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4792-409-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4508-413-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-429-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-437-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4800-445-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-453-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3296-461-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-469-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4756-485-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/5040-529-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3084-567-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3576-586-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4604-607-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-627-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/5104-637-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/212-673-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/896-743-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4740-1045-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/436-1338-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4892-1406-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1760-1562-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/6556-2586-0x0000000000400000-0x0000000000429000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffffrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3flfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rrxfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfffrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1732 wrote to memory of 2308 1732 0e55147045096d841d5a3a8b070dcfbc3104317b9f78ff10bfd79ea4a13c6809.exe 87 PID 2308 wrote to memory of 3600 2308 thhbhh.exe 88 PID 3600 wrote to memory of 5004 3600 jjvjv.exe 89 PID 5004 wrote to memory of 4492 5004 xrflxrl.exe 90 PID 4492 wrote to memory of 4716 4492 btnhhh.exe 91 PID 4716 wrote to memory of 1664 4716 lrxrrrl.exe 92 PID 1664 wrote to memory of 3900 1664 hbbthh.exe 93 PID 3900 wrote to memory of 1904 3900 rlfxllf.exe 94 PID 1904 wrote to memory of 2664 1904 btnhhh.exe 95 PID 2664 wrote to memory of 544 2664 nhbtnn.exe 96 PID 544 wrote to memory of 3056 544 vvvpp.exe 97 PID 3056 wrote to memory of 2064 3056 dvvpv.exe 98 PID 2064 wrote to memory of 1476 2064 7lxffff.exe 99 PID 1476 wrote to memory of 3500 1476 thbtnn.exe 100 PID 3500 wrote to memory of 4060 3500 thhbbt.exe 101 PID 4060 wrote to memory of 3860 4060 ddppv.exe 102 PID 3860 wrote to memory of 1340 3860 nthntt.exe 103 PID 1340 wrote to memory of 5048 1340 xrrfrlx.exe 104 PID 5048 wrote to memory of 4016 5048 hnhtht.exe 105 PID 4016 wrote to memory of 4848 4016 nbnbnt.exe 106 PID 4848 wrote to memory of 4780 4848 vpvjp.exe 107 PID 4780 wrote to memory of 4744 4780 xffxxff.exe 108 PID 4744 wrote to memory of 2524 4744 nhhbbb.exe 109 PID 2524 wrote to memory of 3988 2524 xlxxxlf.exe 110 PID 3988 wrote to memory of 4520 3988 5bhnhn.exe 111 PID 4520 wrote to memory of 4612 4520 jppjd.exe 112 PID 4612 wrote to memory of 4360 4612 ttthbh.exe 113 PID 4360 wrote to memory of 1056 4360 vdjjj.exe 114 PID 1056 wrote to memory of 3332 1056 7rxrllf.exe 115 PID 3332 wrote to memory of 1460 3332 pvvdj.exe 116 PID 1460 wrote to memory of 868 1460 pddvd.exe 117 PID 868 wrote to memory of 4700 868 ffllrrf.exe 118 PID 4700 wrote to memory of 3220 4700 rxfrxlf.exe 119 PID 3220 wrote to memory of 4068 3220 9hnnbn.exe 120 PID 4068 wrote to memory of 684 4068 jdpdp.exe 121 PID 684 wrote to memory of 4712 684 3rrlrrl.exe 122 PID 4712 wrote to memory of 2280 4712 nhhnnt.exe 123 PID 2280 wrote to memory of 4200 2280 xxrrlfr.exe 124 PID 4200 wrote to memory of 3800 4200 hbhhtb.exe 125 PID 3800 wrote to memory of 2232 3800 jvdvv.exe 126 PID 2232 wrote to memory of 1644 2232 9rxllll.exe 127 PID 1644 wrote to memory of 3236 1644 9nnbtn.exe 128 PID 3236 wrote to memory of 2152 3236 dvdvv.exe 129 PID 2152 wrote to memory of 4244 2152 dvdvp.exe 130 PID 4244 wrote to memory of 2476 4244 1rxxxfx.exe 131 PID 2476 wrote to memory of 4328 2476 bhhbbb.exe 132 PID 4328 wrote to memory of 1216 4328 tntntt.exe 133 PID 1216 wrote to memory of 1612 1216 rlfxrrl.exe 134 PID 1612 wrote to memory of 1684 1612 thnnhn.exe 135 PID 1684 wrote to memory of 2640 1684 rxflllr.exe 136 PID 2640 wrote to memory of 772 2640 jpjdv.exe 137 PID 772 wrote to memory of 4212 772 bthbnn.exe 138 PID 4212 wrote to memory of 2148 4212 nnbbbn.exe 139 PID 2148 wrote to memory of 4896 2148 flxrrlf.exe 140 PID 4896 wrote to memory of 4684 4896 djppd.exe 141 PID 4684 wrote to memory of 1132 4684 httnhb.exe 142 PID 1132 wrote to memory of 3436 1132 dvjjj.exe 143 PID 3436 wrote to memory of 3444 3436 lffxlll.exe 144 PID 3444 wrote to memory of 2160 3444 bbhnht.exe 145 PID 2160 wrote to memory of 3980 2160 ddjjd.exe 146 PID 3980 wrote to memory of 3172 3980 lrfxrxx.exe 147 PID 3172 wrote to memory of 3556 3172 bthbbb.exe 148 PID 3556 wrote to memory of 576 3556 thtbbh.exe 149 PID 576 wrote to memory of 3392 576 djppp.exe 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e55147045096d841d5a3a8b070dcfbc3104317b9f78ff10bfd79ea4a13c6809.exe"C:\Users\Admin\AppData\Local\Temp\0e55147045096d841d5a3a8b070dcfbc3104317b9f78ff10bfd79ea4a13c6809.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\thhbhh.exec:\thhbhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\jjvjv.exec:\jjvjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\xrflxrl.exec:\xrflxrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\btnhhh.exec:\btnhhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\lrxrrrl.exec:\lrxrrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\hbbthh.exec:\hbbthh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\rlfxllf.exec:\rlfxllf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\btnhhh.exec:\btnhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\nhbtnn.exec:\nhbtnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\vvvpp.exec:\vvvpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\dvvpv.exec:\dvvpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\7lxffff.exec:\7lxffff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\thbtnn.exec:\thbtnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\thhbbt.exec:\thhbbt.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\ddppv.exec:\ddppv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\nthntt.exec:\nthntt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
\??\c:\xrrfrlx.exec:\xrrfrlx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\hnhtht.exec:\hnhtht.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\nbnbnt.exec:\nbnbnt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\vpvjp.exec:\vpvjp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\xffxxff.exec:\xffxxff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\nhhbbb.exec:\nhhbbb.exe23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\xlxxxlf.exec:\xlxxxlf.exe24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\5bhnhn.exec:\5bhnhn.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\jppjd.exec:\jppjd.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\ttthbh.exec:\ttthbh.exe27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\vdjjj.exec:\vdjjj.exe28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\7rxrllf.exec:\7rxrllf.exe29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\pvvdj.exec:\pvvdj.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
\??\c:\pddvd.exec:\pddvd.exe31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\ffllrrf.exec:\ffllrrf.exe32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\rxfrxlf.exec:\rxfrxlf.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\9hnnbn.exec:\9hnnbn.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\jdpdp.exec:\jdpdp.exe35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\3rrlrrl.exec:\3rrlrrl.exe36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\nhhnnt.exec:\nhhnnt.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\xxrrlfr.exec:\xxrrlfr.exe38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\hbhhtb.exec:\hbhhtb.exe39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
\??\c:\jvdvv.exec:\jvdvv.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3800 -
\??\c:\9rxllll.exec:\9rxllll.exe41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\9nnbtn.exec:\9nnbtn.exe42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\dvdvv.exec:\dvdvv.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\dvdvp.exec:\dvdvp.exe44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\1rxxxfx.exec:\1rxxxfx.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
\??\c:\bhhbbb.exec:\bhhbbb.exe46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\tntntt.exec:\tntntt.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\rlfxrrl.exec:\rlfxrrl.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\thnnhn.exec:\thnnhn.exe49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\rxflllr.exec:\rxflllr.exe50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\jpjdv.exec:\jpjdv.exe51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\bthbnn.exec:\bthbnn.exe52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\nnbbbn.exec:\nnbbbn.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\flxrrlf.exec:\flxrrlf.exe54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\djppd.exec:\djppd.exe55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\httnhb.exec:\httnhb.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\dvjjj.exec:\dvjjj.exe57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\lffxlll.exec:\lffxlll.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
\??\c:\bbhnht.exec:\bbhnht.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\ddjjd.exec:\ddjjd.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\lrfxrxx.exec:\lrfxrxx.exe61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\bthbbb.exec:\bthbbb.exe62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\thtbbh.exec:\thtbbh.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\djppp.exec:\djppp.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\llflrxl.exec:\llflrxl.exe65⤵
- Executes dropped EXE
PID:3392 -
\??\c:\1nbbtb.exec:\1nbbtb.exe66⤵PID:4908
-
\??\c:\1fllrxx.exec:\1fllrxx.exe67⤵PID:3876
-
\??\c:\nhbhtt.exec:\nhbhtt.exe68⤵PID:2400
-
\??\c:\pvdpj.exec:\pvdpj.exe69⤵PID:4988
-
\??\c:\1ppjd.exec:\1ppjd.exe70⤵PID:4032
-
\??\c:\3rxfllr.exec:\3rxfllr.exe71⤵PID:1972
-
\??\c:\dpvvv.exec:\dpvvv.exe72⤵PID:4180
-
\??\c:\pdpvd.exec:\pdpvd.exe73⤵PID:4160
-
\??\c:\tnnnnn.exec:\tnnnnn.exe74⤵PID:4812
-
\??\c:\nbbnhb.exec:\nbbnhb.exe75⤵PID:4276
-
\??\c:\jjpdv.exec:\jjpdv.exe76⤵PID:1608
-
\??\c:\rlxrllx.exec:\rlxrllx.exe77⤵PID:1492
-
\??\c:\llrrfff.exec:\llrrfff.exe78⤵PID:3136
-
\??\c:\vjjjp.exec:\vjjjp.exe79⤵PID:3928
-
\??\c:\xllfxrr.exec:\xllfxrr.exe80⤵PID:1988
-
\??\c:\tntbbh.exec:\tntbbh.exe81⤵PID:4296
-
\??\c:\dvppj.exec:\dvppj.exe82⤵PID:4120
-
\??\c:\jpvvp.exec:\jpvvp.exe83⤵PID:4792
-
\??\c:\lffxrxr.exec:\lffxrxr.exe84⤵PID:4508
-
\??\c:\lxxxfrf.exec:\lxxxfrf.exe85⤵PID:3868
-
\??\c:\nhnhnn.exec:\nhnhnn.exe86⤵PID:1848
-
\??\c:\3djjv.exec:\3djjv.exe87⤵PID:3732
-
\??\c:\jdvdd.exec:\jdvdd.exe88⤵PID:1672
-
\??\c:\lxfxxrl.exec:\lxfxxrl.exe89⤵PID:1752
-
\??\c:\hnttnn.exec:\hnttnn.exe90⤵PID:2264
-
\??\c:\1xlxrxr.exec:\1xlxrxr.exe91⤵PID:2416
-
\??\c:\bttbtn.exec:\bttbtn.exe92⤵PID:4800
-
\??\c:\pjjjj.exec:\pjjjj.exe93⤵PID:784
-
\??\c:\rlrxxfr.exec:\rlrxxfr.exe94⤵PID:2840
-
\??\c:\5frrllr.exec:\5frrllr.exe95⤵PID:2100
-
\??\c:\ddjjj.exec:\ddjjj.exe96⤵PID:3296
-
\??\c:\pjddp.exec:\pjddp.exe97⤵PID:2716
-
\??\c:\lfxlflf.exec:\lfxlflf.exe98⤵PID:1708
-
\??\c:\thnbbb.exec:\thnbbb.exe99⤵PID:4808
-
\??\c:\nhtnbb.exec:\nhtnbb.exe100⤵PID:1064
-
\??\c:\7rxrflf.exec:\7rxrflf.exe101⤵PID:1264
-
\??\c:\fxxxxxx.exec:\fxxxxxx.exe102⤵PID:4756
-
\??\c:\nbhbnn.exec:\nbhbnn.exe103⤵PID:3684
-
\??\c:\vpddj.exec:\vpddj.exe104⤵PID:4036
-
\??\c:\xfrrrrx.exec:\xfrrrrx.exe105⤵PID:2604
-
\??\c:\btthht.exec:\btthht.exe106⤵PID:2636
-
\??\c:\xffrfxx.exec:\xffrfxx.exe107⤵PID:3648
-
\??\c:\hnnnbh.exec:\hnnnbh.exe108⤵PID:1756
-
\??\c:\flrllxl.exec:\flrllxl.exe109⤵PID:4784
-
\??\c:\jpjjj.exec:\jpjjj.exe110⤵PID:1836
-
\??\c:\xxlfrrl.exec:\xxlfrrl.exe111⤵PID:4864
-
\??\c:\nttbbh.exec:\nttbbh.exe112⤵PID:2088
-
\??\c:\nbbtnt.exec:\nbbtnt.exe113⤵PID:5040
-
\??\c:\pjjdp.exec:\pjjdp.exe114⤵PID:3524
-
\??\c:\nhhbtn.exec:\nhhbtn.exe115⤵PID:2060
-
\??\c:\tntnhn.exec:\tntnhn.exe116⤵PID:2292
-
\??\c:\frfrllf.exec:\frfrllf.exe117⤵PID:4376
-
\??\c:\flfrxlr.exec:\flfrxlr.exe118⤵PID:2532
-
\??\c:\thtnhb.exec:\thtnhb.exe119⤵PID:2240
-
\??\c:\jvvpv.exec:\jvvpv.exe120⤵PID:1212
-
\??\c:\pjddv.exec:\pjddv.exe121⤵PID:4432
-
\??\c:\xrxrllf.exec:\xrxrllf.exe122⤵PID:3084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-