Analysis
- max time kernel
113s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/09/2026, 16:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4662c8520169440df49d165477cdbc136aae7b775765be91b1f2f53500c5fcf1.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
General
- Target 4662c8520169440df49d165477cdbc136aae7b775765be91b1f2f53500c5fcf1.exe
- Size 127KB
- Sample260910-tjtj3asbrf
- SHA256 4662c8520169440df49d165477cdbc136aae7b775765be91b1f2f53500c5fcf1
- MD5 1c383f710d48ea6931bba2f077566215
- SHA1 09b918446112dd56433dd53a2e9250447d52dc90
- SHA512 ed532cb76bbbb7846c981648e81b61918b62450bd8b453f9e0faa7af69a5c5b91651ac97d410ab702f42a2e6c493a657ed1394b7fccac02451a682309856d3b7
- SSDEEP 1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5bx7DUQeDac7AkT7C:0cdpeeBSHHMHLf9Rybx7DYec7FC
- TLSH T1CED3E8B21F7DB1B7DBB0E42146AA5074184AA22799CA19F540F613881F3AD81DEC2D7F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1236 nnhthb.exe 4860 pvdpd.exe 4136 nhnhth.exe 1772 djdpv.exe 2384 vpjdp.exe 4776 9flxrlr.exe 4476 fxrrfxr.exe 4684 rlfxrll.exe 864 pddpd.exe 4768 3ppjd.exe 1324 nhnbtn.exe 2348 dpjjv.exe 2084 rlxxrfx.exe 1060 jjjdd.exe 3300 vjpjv.exe 2904 bbbhbt.exe 2220 nhnhbb.exe 4580 hbthbt.exe 2036 pddpj.exe 2824 fllxrlx.exe 748 hbhnnn.exe 4288 vvdvv.exe 3188 lffrlfx.exe 1360 1nnhth.exe 3428 ntthhb.exe 3244 htnhth.exe 2612 rrlflfr.exe 4992 3lxlfxr.exe 2688 thttnh.exe 2460 dvdpj.exe 3536 rllflfl.exe 5064 rrrlffr.exe 1332 vvvpj.exe 2224 xrrlfxr.exe 2444 vvvvj.exe 4140 xrfrxrf.exe 3900 xlrffxx.exe 1960 btthnh.exe 3336 dvdpd.exe 5060 nhnttb.exe 4556 fxlfxlx.exe 4228 lxlffxr.exe 4300 hhnhbb.exe 3324 dddvj.exe 4428 xllfxrx.exe 1280 5ttnbb.exe 2548 ddvpp.exe 4636 lrfrlrl.exe 5092 nhhtnh.exe 4424 vjjvp.exe 2540 xllxrlx.exe 4044 nhnbnh.exe 4704 bbbnbt.exe 3784 9lllffx.exe 4588 btbthh.exe 4324 tntnhb.exe 3128 fffrrlf.exe 4236 htnhbt.exe 4608 jjpjv.exe 5068 3nhbtb.exe 1532 jdjdv.exe 1484 jddvv.exe 2088 rxlflrx.exe 4872 btttnb.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xlxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ffxrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jvvj.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1132 wrote to memory of 1236 1132 4662c8520169440df49d165477cdbc136aae7b775765be91b1f2f53500c5fcf1.exe 85 PID 1236 wrote to memory of 4860 1236 nnhthb.exe 86 PID 4860 wrote to memory of 4136 4860 pvdpd.exe 87 PID 4136 wrote to memory of 1772 4136 nhnhth.exe 88 PID 1772 wrote to memory of 2384 1772 djdpv.exe 89 PID 2384 wrote to memory of 4776 2384 vpjdp.exe 90 PID 4776 wrote to memory of 4476 4776 9flxrlr.exe 91 PID 4476 wrote to memory of 4684 4476 fxrrfxr.exe 92 PID 4684 wrote to memory of 864 4684 rlfxrll.exe 93 PID 864 wrote to memory of 4768 864 pddpd.exe 94 PID 4768 wrote to memory of 1324 4768 3ppjd.exe 95 PID 1324 wrote to memory of 2348 1324 nhnbtn.exe 96 PID 2348 wrote to memory of 2084 2348 dpjjv.exe 97 PID 2084 wrote to memory of 1060 2084 rlxxrfx.exe 98 PID 1060 wrote to memory of 3300 1060 jjjdd.exe 99 PID 3300 wrote to memory of 2904 3300 vjpjv.exe 100 PID 2904 wrote to memory of 2220 2904 bbbhbt.exe 101 PID 2220 wrote to memory of 4580 2220 nhnhbb.exe 102 PID 4580 wrote to memory of 2036 4580 hbthbt.exe 103 PID 2036 wrote to memory of 2824 2036 pddpj.exe 104 PID 2824 wrote to memory of 748 2824 fllxrlx.exe 105 PID 748 wrote to memory of 4288 748 hbhnnn.exe 106 PID 4288 wrote to memory of 3188 4288 vvdvv.exe 107 PID 3188 wrote to memory of 1360 3188 lffrlfx.exe 108 PID 1360 wrote to memory of 3428 1360 1nnhth.exe 109 PID 3428 wrote to memory of 3244 3428 ntthhb.exe 110 PID 3244 wrote to memory of 2612 3244 htnhth.exe 111 PID 2612 wrote to memory of 4992 2612 rrlflfr.exe 112 PID 4992 wrote to memory of 2688 4992 3lxlfxr.exe 113 PID 2688 wrote to memory of 2460 2688 thttnh.exe 114 PID 2460 wrote to memory of 3536 2460 dvdpj.exe 115 PID 3536 wrote to memory of 5064 3536 rllflfl.exe 116 PID 5064 wrote to memory of 1332 5064 rrrlffr.exe 117 PID 1332 wrote to memory of 2224 1332 vvvpj.exe 118 PID 2224 wrote to memory of 2444 2224 xrrlfxr.exe 119 PID 2444 wrote to memory of 4140 2444 vvvvj.exe 120 PID 4140 wrote to memory of 3900 4140 xrfrxrf.exe 121 PID 3900 wrote to memory of 1960 3900 xlrffxx.exe 122 PID 1960 wrote to memory of 3336 1960 btthnh.exe 123 PID 3336 wrote to memory of 5060 3336 dvdpd.exe 124 PID 5060 wrote to memory of 4556 5060 nhnttb.exe 125 PID 4556 wrote to memory of 4228 4556 fxlfxlx.exe 126 PID 4228 wrote to memory of 4300 4228 lxlffxr.exe 127 PID 4300 wrote to memory of 3324 4300 hhnhbb.exe 128 PID 3324 wrote to memory of 4428 3324 dddvj.exe 129 PID 4428 wrote to memory of 1280 4428 xllfxrx.exe 130 PID 1280 wrote to memory of 2548 1280 5ttnbb.exe 131 PID 2548 wrote to memory of 4636 2548 ddvpp.exe 132 PID 4636 wrote to memory of 5092 4636 lrfrlrl.exe 133 PID 5092 wrote to memory of 4424 5092 nhhtnh.exe 134 PID 4424 wrote to memory of 2540 4424 vjjvp.exe 135 PID 2540 wrote to memory of 4044 2540 xllxrlx.exe 136 PID 4044 wrote to memory of 4704 4044 nhnbnh.exe 137 PID 4704 wrote to memory of 3784 4704 bbbnbt.exe 138 PID 3784 wrote to memory of 4588 3784 9lllffx.exe 139 PID 4588 wrote to memory of 4324 4588 btbthh.exe 140 PID 4324 wrote to memory of 3128 4324 tntnhb.exe 141 PID 3128 wrote to memory of 4236 3128 fffrrlf.exe 142 PID 4236 wrote to memory of 4608 4236 htnhbt.exe 143 PID 4608 wrote to memory of 5068 4608 jjpjv.exe 144 PID 5068 wrote to memory of 1532 5068 3nhbtb.exe 145 PID 1532 wrote to memory of 1484 1532 jdjdv.exe 146 PID 1484 wrote to memory of 2088 1484 jddvv.exe 147 PID 2088 wrote to memory of 4872 2088 rxlflrx.exe 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\4662c8520169440df49d165477cdbc136aae7b775765be91b1f2f53500c5fcf1.exe"C:\Users\Admin\AppData\Local\Temp\4662c8520169440df49d165477cdbc136aae7b775765be91b1f2f53500c5fcf1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\nnhthb.exec:\nnhthb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\pvdpd.exec:\pvdpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\nhnhth.exec:\nhnhth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\djdpv.exec:\djdpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\vpjdp.exec:\vpjdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\9flxrlr.exec:\9flxrlr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\fxrrfxr.exec:\fxrrfxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\rlfxrll.exec:\rlfxrll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\pddpd.exec:\pddpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\3ppjd.exec:\3ppjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\nhnbtn.exec:\nhnbtn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\dpjjv.exec:\dpjjv.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\rlxxrfx.exec:\rlxxrfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\jjjdd.exec:\jjjdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\vjpjv.exec:\vjpjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
\??\c:\bbbhbt.exec:\bbbhbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\nhnhbb.exec:\nhnhbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\hbthbt.exec:\hbthbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\pddpj.exec:\pddpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\fllxrlx.exec:\fllxrlx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\hbhnnn.exec:\hbhnnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\vvdvv.exec:\vvdvv.exe23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
\??\c:\lffrlfx.exec:\lffrlfx.exe24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
\??\c:\1nnhth.exec:\1nnhth.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\ntthhb.exec:\ntthhb.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\htnhth.exec:\htnhth.exe27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\rrlflfr.exec:\rrlflfr.exe28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\3lxlfxr.exec:\3lxlfxr.exe29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\thttnh.exec:\thttnh.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\dvdpj.exec:\dvdpj.exe31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\rllflfl.exec:\rllflfl.exe32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\rrrlffr.exec:\rrrlffr.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\vvvpj.exec:\vvvpj.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\xrrlfxr.exec:\xrrlfxr.exe35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\vvvvj.exec:\vvvvj.exe36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\xrfrxrf.exec:\xrfrxrf.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\xlrffxx.exec:\xlrffxx.exe38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\btthnh.exec:\btthnh.exe39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\dvdpd.exec:\dvdpd.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
\??\c:\nhnttb.exec:\nhnttb.exe41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\fxlfxlx.exec:\fxlfxlx.exe42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\lxlffxr.exec:\lxlffxr.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\hhnhbb.exec:\hhnhbb.exe44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\dddvj.exec:\dddvj.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
\??\c:\xllfxrx.exec:\xllfxrx.exe46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\5ttnbb.exec:\5ttnbb.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\ddvpp.exec:\ddvpp.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\lrfrlrl.exec:\lrfrlrl.exe49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\nhhtnh.exec:\nhhtnh.exe50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\vjjvp.exec:\vjjvp.exe51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\xllxrlx.exec:\xllxrlx.exe52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\nhnbnh.exec:\nhnbnh.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\bbbnbt.exec:\bbbnbt.exe54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
\??\c:\9lllffx.exec:\9lllffx.exe55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
\??\c:\btbthh.exec:\btbthh.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\tntnhb.exec:\tntnhb.exe57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\fffrrlf.exec:\fffrrlf.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\htnhbt.exec:\htnhbt.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
\??\c:\jjpjv.exec:\jjpjv.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\3nhbtb.exec:\3nhbtb.exe61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\jdjdv.exec:\jdjdv.exe62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\jddvv.exec:\jddvv.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\rxlflrx.exec:\rxlflrx.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\btttnb.exec:\btttnb.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4872 -
\??\c:\vvjdp.exec:\vvjdp.exe66⤵PID:696
-
\??\c:\llrrfxx.exec:\llrrfxx.exe67⤵PID:4640
-
\??\c:\rlfxllf.exec:\rlfxllf.exe68⤵PID:4720
-
\??\c:\3hhhbt.exec:\3hhhbt.exe69⤵PID:2860
-
\??\c:\hbbbtn.exec:\hbbbtn.exe70⤵PID:2136
-
\??\c:\pjpjj.exec:\pjpjj.exe71⤵PID:4760
-
\??\c:\flxlfxl.exec:\flxlfxl.exe72⤵PID:1976
-
\??\c:\lxxrllf.exec:\lxxrllf.exe73⤵PID:5116
-
\??\c:\ddpjp.exec:\ddpjp.exe74⤵PID:1968
-
\??\c:\thbnbt.exec:\thbnbt.exe75⤵PID:1612
-
\??\c:\nbthbn.exec:\nbthbn.exe76⤵PID:5016
-
\??\c:\pjdpj.exec:\pjdpj.exe77⤵PID:4472
-
\??\c:\ddddp.exec:\ddddp.exe78⤵PID:3716
-
\??\c:\rfxxlxl.exec:\rfxxlxl.exe79⤵PID:3884
-
\??\c:\dvpjd.exec:\dvpjd.exe80⤵PID:360
-
\??\c:\vpdvd.exec:\vpdvd.exe81⤵PID:3080
-
\??\c:\7frfxrf.exec:\7frfxrf.exe82⤵PID:4264
-
\??\c:\rlrlxrx.exec:\rlrlxrx.exe83⤵PID:2980
-
\??\c:\dddpj.exec:\dddpj.exe84⤵PID:4120
-
\??\c:\lffrxrr.exec:\lffrxrr.exe85⤵PID:4712
-
\??\c:\rllffxr.exec:\rllffxr.exe86⤵PID:1884
-
\??\c:\nnnttn.exec:\nnnttn.exe87⤵PID:1644
-
\??\c:\ddddj.exec:\ddddj.exe88⤵PID:1776
-
\??\c:\pjpdp.exec:\pjpdp.exe89⤵PID:3640
-
\??\c:\lrrllfx.exec:\lrrllfx.exe90⤵PID:3028
-
\??\c:\nbnbbt.exec:\nbnbbt.exe91⤵PID:2828
-
\??\c:\jjjvp.exec:\jjjvp.exe92⤵PID:3948
-
\??\c:\3dpjv.exec:\3dpjv.exe93⤵PID:4572
-
\??\c:\lrrlfrl.exec:\lrrlfrl.exe94⤵PID:4292
-
\??\c:\dpdpd.exec:\dpdpd.exe95⤵PID:4876
-
\??\c:\xrrfxrl.exec:\xrrfxrl.exe96⤵PID:2232
-
\??\c:\nbbnhb.exec:\nbbnhb.exe97⤵PID:3776
-
\??\c:\hbbnbt.exec:\hbbnbt.exe98⤵PID:3248
-
\??\c:\xrlxlxr.exec:\xrlxlxr.exe99⤵PID:1660
-
\??\c:\vjppp.exec:\vjppp.exe100⤵PID:3648
-
\??\c:\vjvvd.exec:\vjvvd.exe101⤵PID:2108
-
\??\c:\xllxflf.exec:\xllxflf.exe102⤵PID:1732
-
\??\c:\rrlxrxl.exec:\rrlxrxl.exe103⤵PID:3516
-
\??\c:\nhnhhb.exec:\nhnhhb.exe104⤵PID:4504
-
\??\c:\ddvpd.exec:\ddvpd.exe105⤵PID:1468
-
\??\c:\dpvjv.exec:\dpvjv.exe106⤵PID:4728
-
\??\c:\rfrfxrr.exec:\rfrfxrr.exe107⤵PID:4116
-
\??\c:\hbhbhh.exec:\hbhbhh.exe108⤵PID:3432
-
\??\c:\dppjd.exec:\dppjd.exe109⤵PID:2792
-
\??\c:\xrlfxlx.exec:\xrlfxlx.exe110⤵PID:908
-
\??\c:\bbhbnn.exec:\bbhbnn.exe111⤵PID:2676
-
\??\c:\ppdvj.exec:\ppdvj.exe112⤵PID:2636
-
\??\c:\nnthhb.exec:\nnthhb.exe113⤵PID:4736
-
\??\c:\dvjdv.exec:\dvjdv.exe114⤵PID:1032
-
\??\c:\xfffxxr.exec:\xfffxxr.exe115⤵PID:3400
-
\??\c:\bhhtnh.exec:\bhhtnh.exe116⤵PID:4376
-
\??\c:\ppvpd.exec:\ppvpd.exe117⤵PID:4912
-
\??\c:\vjvjd.exec:\vjvjd.exe118⤵PID:3228
-
\??\c:\llrxfrf.exec:\llrxfrf.exe119⤵PID:4204
-
\??\c:\vjdpj.exec:\vjdpj.exe120⤵PID:1544
-
\??\c:\vddvj.exec:\vddvj.exe121⤵PID:4396
-
\??\c:\ffflxlr.exec:\ffflxlr.exe122⤵PID:3240
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-