Analysis
- max time kernel
150s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/09/2026, 12:30
Static task
static1
1 signatures
General
- Target 32cb7ada8c2f5fc573841f1a3247be80ba1a7d87173a9e41e28e020611e89f18.exe
- Size 93KB
- Sample260910-pppe3scj21
- SHA256 32cb7ada8c2f5fc573841f1a3247be80ba1a7d87173a9e41e28e020611e89f18
- MD5 3247aa40d089eb090b1429f5f41c5a46
- SHA1 049d7d797060d74c118fe1dc04f5210c5c343a86
- SHA512 e1ae3782a5894aa49748152d84c8cfb0a654a6f674307f7601dc07ae4968c0a66294a37fd7329029dd087058284d40450c08aae32b54da1fcf4825dc6cbb420f
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo7NANTBuQG1npsMR2CcL:ymb3NkkiQ3mdBjFo7NguQG1nug2r
- TLSH T1CB93CFF99FADF2F5E1B49E3586A19A5C0019B2B71D421CAD50B917C50F386C26B82C3F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4484 jppjj.exe 4468 dpddd.exe 64 1ttnhh.exe 4780 fxlfxxf.exe 848 bnhnhh.exe 5984 ddddd.exe 2808 fllfffx.exe 1724 lffxfxx.exe 4912 tbtnnn.exe 2956 jdppp.exe 2288 llxxlrr.exe 2860 rfrlxff.exe 3048 hhbbth.exe 1772 flxxfrl.exe 4848 nnnnnn.exe 4892 hhbttn.exe 3936 pdjdj.exe 4876 hbnntt.exe 3084 jddvv.exe 2060 ffrlffx.exe 1552 3rlffll.exe 3272 bbbntb.exe 5168 pdjdv.exe 2648 ppddj.exe 3912 jvjdd.exe 4736 xxllfrr.exe 852 ntnnnb.exe 4600 xflffff.exe 2432 nnttth.exe 6020 dppjj.exe 1996 tnnnhh.exe 5452 nbhntn.exe 3660 xffxrlr.exe 4528 bnhhth.exe 3396 djpjv.exe 4020 llrfffl.exe 3424 tnbbbh.exe 2024 5jjjj.exe 5304 rrffrll.exe 5176 lxlllrx.exe 2916 lxlfxrf.exe 4184 lxfffff.exe 1576 7thhnn.exe 5800 pdvpv.exe 2248 rlrrrrr.exe 308 bnbbnn.exe 336 5vdpd.exe 3728 lfxfrll.exe 3760 nttnnh.exe 5524 1dddd.exe 636 3lffllr.exe 3344 hnnbtt.exe 4556 vvppj.exe 1664 dvjdd.exe 1752 hhhhbb.exe 760 7nnhhh.exe 1108 7djjj.exe 1544 lfxrrll.exe 3348 bbhhhh.exe 5084 tntnnn.exe 964 pvpjd.exe 3908 jvvvv.exe 4072 xxrrffr.exe 5832 nnthnh.exe -
resource yara_rule behavioral1/memory/4500-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4484-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4484-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4484-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4468-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/64-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4780-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/848-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1724-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4912-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1772-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4848-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3936-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4892-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4876-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1552-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3084-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3272-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/5168-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3912-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4736-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4600-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/852-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/6020-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1996-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3660-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3396-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4020-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/5304-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4184-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1576-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/5800-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2248-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/5524-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4556-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-302-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/760-306-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3908-330-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3852-350-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/5244-366-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4480-383-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4116-415-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3112-427-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1228-467-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/5400-495-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/5788-523-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1572-539-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1840-595-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/5508-603-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-640-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4704-671-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3668-737-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-771-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1184-863-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/5104-928-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1744-975-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4208-1471-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4076-1523-0x0000000000400000-0x0000000000429000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hbhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfrrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4500 wrote to memory of 4484 4500 32cb7ada8c2f5fc573841f1a3247be80ba1a7d87173a9e41e28e020611e89f18.exe 86 PID 4484 wrote to memory of 4468 4484 jppjj.exe 87 PID 4468 wrote to memory of 64 4468 dpddd.exe 88 PID 64 wrote to memory of 4780 64 1ttnhh.exe 89 PID 4780 wrote to memory of 848 4780 fxlfxxf.exe 90 PID 848 wrote to memory of 5984 848 bnhnhh.exe 91 PID 5984 wrote to memory of 2808 5984 ddddd.exe 92 PID 2808 wrote to memory of 1724 2808 fllfffx.exe 93 PID 1724 wrote to memory of 4912 1724 lffxfxx.exe 94 PID 4912 wrote to memory of 2956 4912 tbtnnn.exe 95 PID 2956 wrote to memory of 2288 2956 jdppp.exe 96 PID 2288 wrote to memory of 2860 2288 llxxlrr.exe 97 PID 2860 wrote to memory of 3048 2860 rfrlxff.exe 98 PID 3048 wrote to memory of 1772 3048 hhbbth.exe 99 PID 1772 wrote to memory of 4848 1772 flxxfrl.exe 100 PID 4848 wrote to memory of 4892 4848 nnnnnn.exe 101 PID 4892 wrote to memory of 3936 4892 hhbttn.exe 102 PID 3936 wrote to memory of 4876 3936 pdjdj.exe 103 PID 4876 wrote to memory of 3084 4876 hbnntt.exe 104 PID 3084 wrote to memory of 2060 3084 jddvv.exe 105 PID 2060 wrote to memory of 1552 2060 ffrlffx.exe 106 PID 1552 wrote to memory of 3272 1552 3rlffll.exe 107 PID 3272 wrote to memory of 5168 3272 bbbntb.exe 108 PID 5168 wrote to memory of 2648 5168 pdjdv.exe 109 PID 2648 wrote to memory of 3912 2648 ppddj.exe 110 PID 3912 wrote to memory of 4736 3912 jvjdd.exe 111 PID 4736 wrote to memory of 852 4736 xxllfrr.exe 112 PID 852 wrote to memory of 4600 852 ntnnnb.exe 113 PID 4600 wrote to memory of 2432 4600 xflffff.exe 114 PID 2432 wrote to memory of 6020 2432 nnttth.exe 115 PID 6020 wrote to memory of 1996 6020 dppjj.exe 116 PID 1996 wrote to memory of 5452 1996 tnnnhh.exe 117 PID 5452 wrote to memory of 3660 5452 nbhntn.exe 118 PID 3660 wrote to memory of 4528 3660 xffxrlr.exe 119 PID 4528 wrote to memory of 3396 4528 bnhhth.exe 120 PID 3396 wrote to memory of 4020 3396 djpjv.exe 121 PID 4020 wrote to memory of 3424 4020 llrfffl.exe 122 PID 3424 wrote to memory of 2024 3424 tnbbbh.exe 123 PID 2024 wrote to memory of 5304 2024 5jjjj.exe 124 PID 5304 wrote to memory of 5176 5304 rrffrll.exe 125 PID 5176 wrote to memory of 2916 5176 lxlllrx.exe 126 PID 2916 wrote to memory of 4184 2916 lxlfxrf.exe 127 PID 4184 wrote to memory of 1576 4184 lxfffff.exe 128 PID 1576 wrote to memory of 5800 1576 7thhnn.exe 129 PID 5800 wrote to memory of 2248 5800 pdvpv.exe 130 PID 2248 wrote to memory of 308 2248 rlrrrrr.exe 131 PID 308 wrote to memory of 336 308 bnbbnn.exe 132 PID 336 wrote to memory of 3728 336 5vdpd.exe 133 PID 3728 wrote to memory of 3760 3728 lfxfrll.exe 134 PID 3760 wrote to memory of 5524 3760 nttnnh.exe 135 PID 5524 wrote to memory of 636 5524 1dddd.exe 136 PID 636 wrote to memory of 3344 636 3lffllr.exe 137 PID 3344 wrote to memory of 4556 3344 hnnbtt.exe 138 PID 4556 wrote to memory of 1664 4556 vvppj.exe 139 PID 1664 wrote to memory of 1752 1664 dvjdd.exe 140 PID 1752 wrote to memory of 760 1752 hhhhbb.exe 141 PID 760 wrote to memory of 1108 760 7nnhhh.exe 142 PID 1108 wrote to memory of 1544 1108 7djjj.exe 143 PID 1544 wrote to memory of 3348 1544 lfxrrll.exe 144 PID 3348 wrote to memory of 5084 3348 bbhhhh.exe 145 PID 5084 wrote to memory of 964 5084 tntnnn.exe 146 PID 964 wrote to memory of 3908 964 pvpjd.exe 147 PID 3908 wrote to memory of 4072 3908 jvvvv.exe 148 PID 4072 wrote to memory of 5832 4072 xxrrffr.exe 149
Processes
-
C:\Users\Admin\AppData\Local\Temp\32cb7ada8c2f5fc573841f1a3247be80ba1a7d87173a9e41e28e020611e89f18.exe"C:\Users\Admin\AppData\Local\Temp\32cb7ada8c2f5fc573841f1a3247be80ba1a7d87173a9e41e28e020611e89f18.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\jppjj.exec:\jppjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\dpddd.exec:\dpddd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\1ttnhh.exec:\1ttnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\fxlfxxf.exec:\fxlfxxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\bnhnhh.exec:\bnhnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\ddddd.exec:\ddddd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5984 -
\??\c:\fllfffx.exec:\fllfffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\lffxfxx.exec:\lffxfxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\tbtnnn.exec:\tbtnnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\jdppp.exec:\jdppp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\llxxlrr.exec:\llxxlrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\rfrlxff.exec:\rfrlxff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\hhbbth.exec:\hhbbth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\flxxfrl.exec:\flxxfrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\nnnnnn.exec:\nnnnnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\hhbttn.exec:\hhbttn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\pdjdj.exec:\pdjdj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\hbnntt.exec:\hbnntt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\jddvv.exec:\jddvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\ffrlffx.exec:\ffrlffx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\3rlffll.exec:\3rlffll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\bbbntb.exec:\bbbntb.exe23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\pdjdv.exec:\pdjdv.exe24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5168 -
\??\c:\ppddj.exec:\ppddj.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\jvjdd.exec:\jvjdd.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
\??\c:\xxllfrr.exec:\xxllfrr.exe27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\ntnnnb.exec:\ntnnnb.exe28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\xflffff.exec:\xflffff.exe29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\nnttth.exec:\nnttth.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\dppjj.exec:\dppjj.exe31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6020 -
\??\c:\tnnnhh.exec:\tnnnhh.exe32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\nbhntn.exec:\nbhntn.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5452 -
\??\c:\xffxrlr.exec:\xffxrlr.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\bnhhth.exec:\bnhhth.exe35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\djpjv.exec:\djpjv.exe36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
\??\c:\llrfffl.exec:\llrfffl.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\tnbbbh.exec:\tnbbbh.exe38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\5jjjj.exec:\5jjjj.exe39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\rrffrll.exec:\rrffrll.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5304 -
\??\c:\lxlllrx.exec:\lxlllrx.exe41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5176 -
\??\c:\lxlfxrf.exec:\lxlfxrf.exe42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\lxfffff.exec:\lxfffff.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\7thhnn.exec:\7thhnn.exe44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\pdvpv.exec:\pdvpv.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5800 -
\??\c:\rlrrrrr.exec:\rlrrrrr.exe46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\bnbbnn.exec:\bnbbnn.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:308 -
\??\c:\5vdpd.exec:\5vdpd.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:336 -
\??\c:\lfxfrll.exec:\lfxfrll.exe49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\nttnnh.exec:\nttnnh.exe50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\1dddd.exec:\1dddd.exe51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5524 -
\??\c:\3lffllr.exec:\3lffllr.exe52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\hnnbtt.exec:\hnnbtt.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
\??\c:\vvppj.exec:\vvppj.exe54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\dvjdd.exec:\dvjdd.exe55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\hhhhbb.exec:\hhhhbb.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\7nnhhh.exec:\7nnhhh.exe57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\7djjj.exec:\7djjj.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\lfxrrll.exec:\lfxrrll.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\bbhhhh.exec:\bbhhhh.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\tntnnn.exec:\tntnnn.exe61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\pvpjd.exec:\pvpjd.exe62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\jvvvv.exec:\jvvvv.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
\??\c:\xxrrffr.exec:\xxrrffr.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
\??\c:\nnthnh.exec:\nnthnh.exe65⤵
- Executes dropped EXE
PID:5832 -
\??\c:\vvvpp.exec:\vvvpp.exe66⤵PID:5940
-
\??\c:\fxxfffl.exec:\fxxfffl.exe67⤵PID:5276
-
\??\c:\httnnn.exec:\httnnn.exe68⤵PID:3852
-
\??\c:\nnntht.exec:\nnntht.exe69⤵PID:3480
-
\??\c:\xlrlfrr.exec:\xlrlfrr.exe70⤵PID:3252
-
\??\c:\5nhhbh.exec:\5nhhbh.exe71⤵PID:4192
-
\??\c:\vvvvp.exec:\vvvvp.exe72⤵PID:5244
-
\??\c:\xfrrlrl.exec:\xfrrlrl.exe73⤵PID:1064
-
\??\c:\5hntnh.exec:\5hntnh.exe74⤵PID:4908
-
\??\c:\pjjdv.exec:\pjjdv.exe75⤵PID:6008
-
\??\c:\3dpjd.exec:\3dpjd.exe76⤵PID:4400
-
\??\c:\rrxrffr.exec:\rrxrffr.exe77⤵PID:4480
-
\??\c:\rlxxrxx.exec:\rlxxrxx.exe78⤵
- System Location Discovery: System Language Discovery
PID:4520 -
\??\c:\vdddv.exec:\vdddv.exe79⤵PID:4492
-
\??\c:\lxrfxxx.exec:\lxrfxxx.exe80⤵PID:4472
-
\??\c:\nhnnnn.exec:\nhnnnn.exe81⤵PID:4824
-
\??\c:\9thnnt.exec:\9thnnt.exe82⤵PID:5944
-
\??\c:\jjpdv.exec:\jjpdv.exe83⤵PID:5316
-
\??\c:\lffxxfx.exec:\lffxxfx.exe84⤵PID:4152
-
\??\c:\5hnhbb.exec:\5hnhbb.exe85⤵PID:4116
-
\??\c:\jdvpd.exec:\jdvpd.exe86⤵PID:376
-
\??\c:\vpppv.exec:\vpppv.exe87⤵PID:5404
-
\??\c:\9lrlxff.exec:\9lrlxff.exe88⤵PID:3112
-
\??\c:\hnnhht.exec:\hnnhht.exe89⤵
- System Location Discovery: System Language Discovery
PID:4808 -
\??\c:\1vjjj.exec:\1vjjj.exe90⤵PID:6004
-
\??\c:\xxlrfxl.exec:\xxlrfxl.exe91⤵PID:3456
-
\??\c:\hbbhtt.exec:\hbbhtt.exe92⤵PID:3488
-
\??\c:\7hhnhb.exec:\7hhnhb.exe93⤵PID:380
-
\??\c:\pppjj.exec:\pppjj.exe94⤵PID:1644
-
\??\c:\frllfll.exec:\frllfll.exe95⤵PID:2840
-
\??\c:\flrlfff.exec:\flrlfff.exe96⤵PID:2844
-
\??\c:\9bbbbb.exec:\9bbbbb.exe97⤵PID:1668
-
\??\c:\1bbbtb.exec:\1bbbtb.exe98⤵PID:1228
-
\??\c:\vdddv.exec:\vdddv.exe99⤵PID:4664
-
\??\c:\fllllxx.exec:\fllllxx.exe100⤵PID:3096
-
\??\c:\xfllflr.exec:\xfllflr.exe101⤵PID:5448
-
\??\c:\bbthhh.exec:\bbthhh.exe102⤵PID:4108
-
\??\c:\5jppj.exec:\5jppj.exe103⤵PID:4788
-
\??\c:\lxrrffr.exec:\lxrrffr.exe104⤵PID:1704
-
\??\c:\nbnhhb.exec:\nbnhhb.exe105⤵PID:5400
-
\??\c:\ppddp.exec:\ppddp.exe106⤵PID:1216
-
\??\c:\flrrlll.exec:\flrrlll.exe107⤵PID:2212
-
\??\c:\xxxrllx.exec:\xxxrllx.exe108⤵PID:5408
-
\??\c:\1nnnnt.exec:\1nnnnt.exe109⤵PID:4424
-
\??\c:\3xffxxx.exec:\3xffxxx.exe110⤵PID:1200
-
\??\c:\llxrllr.exec:\llxrllr.exe111⤵PID:2104
-
\??\c:\1bhtth.exec:\1bhtth.exe112⤵PID:5788
-
\??\c:\tttbbb.exec:\tttbbb.exe113⤵PID:4980
-
\??\c:\vdpjd.exec:\vdpjd.exe114⤵PID:5332
-
\??\c:\vvvpp.exec:\vvvpp.exe115⤵PID:4828
-
\??\c:\llfxffl.exec:\llfxffl.exe116⤵PID:1572
-
\??\c:\bhhtbn.exec:\bhhtbn.exe117⤵PID:1244
-
\??\c:\lrlrlff.exec:\lrlrlff.exe118⤵PID:5228
-
\??\c:\rrllrxf.exec:\rrllrxf.exe119⤵PID:1568
-
\??\c:\hhhhhh.exec:\hhhhhh.exe120⤵PID:1308
-
\??\c:\5pdvp.exec:\5pdvp.exe121⤵PID:4176
-
\??\c:\lrfxxlf.exec:\lrfxxlf.exe122⤵PID:2560
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-