Analysis
- max time kernel
122s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/09/2026, 17:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4c2fb3b7fd229d6abdb706b9485872bb1c3501a667c5c7a9617af91ed5867108.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
General
- Target 4c2fb3b7fd229d6abdb706b9485872bb1c3501a667c5c7a9617af91ed5867108.exe
- Size 101KB
- Sample260910-vpczyasgpb
- SHA256 4c2fb3b7fd229d6abdb706b9485872bb1c3501a667c5c7a9617af91ed5867108
- MD5 96a4f79cc3dfadc93c3f8d39c91b7cda
- SHA1 b9e36fd498efce46bcf6403b1d66762090436313
- SHA512 9009aff6b869b7f980d9c3c61c407fd1a324356f69b36d72d89abcc8731b57e8ec34cbc9f8f65bbfb77cae286cae6745113452658a3b11739e1a1262b69a4e7d
- SSDEEP 1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlNJiRXDKFjI+pZm5w:0cdpeeBSHHMHLf9RyIEQ5KXZZ
- TLSH T110A3E9B20B7DB1A7EBF0E42156A910742859A33789CA19F540F623881F39D91DEC2D7F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3896 tnnnbb.exe 3980 hnhtbt.exe 3344 vvvdd.exe 3552 jpppd.exe 3684 5rlxrlf.exe 1188 pjvjv.exe 5024 vpvpv.exe 1604 3xxrlxr.exe 376 rlfxlfx.exe 2524 7vjdv.exe 3800 bbhbbb.exe 3508 pdjjd.exe 2612 jdvpv.exe 3516 nnbtht.exe 1064 jddvv.exe 1784 xxrlllf.exe 2672 vvdvj.exe 2124 ppjdp.exe 3436 thtnnn.exe 224 ppjjp.exe 800 xxrllxx.exe 2928 xrlffxf.exe 2320 btthht.exe 2076 jdjvj.exe 3760 fxxrlff.exe 2416 fflflff.exe 4212 nhhbtn.exe 736 5vvdv.exe 1872 bbnhhb.exe 4180 rfllxrf.exe 2440 5xxxlfx.exe 3748 hbbbtn.exe 4260 jdpjd.exe 1372 3rrrrll.exe 1776 tnnhbt.exe 1840 ttnhhh.exe 4424 rrlffll.exe 4224 7bthbb.exe 4472 lffxlxr.exe 4612 hhnbnh.exe 4236 9dppd.exe 1292 xrlfrlf.exe 728 bntnnb.exe 3236 rxfrxxx.exe 3048 thbtnb.exe 1804 dpppd.exe 732 pvvdp.exe 5084 bhhhhn.exe 3816 pvjjd.exe 1836 tntnhb.exe 3912 vpppp.exe 3964 9llfxrl.exe 2424 1xfffff.exe 4440 btnnht.exe 3544 bhnbbt.exe 1376 ddddj.exe 4516 xfrxxll.exe 2872 vpjjj.exe 684 rxrfxfr.exe 1964 tntnnh.exe 1392 xlrrxrx.exe 1580 bbbbnt.exe 3732 vjjjj.exe 2576 ffxxllx.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4c2fb3b7fd229d6abdb706b9485872bb1c3501a667c5c7a9617af91ed5867108.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btthth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4076 wrote to memory of 3896 4076 4c2fb3b7fd229d6abdb706b9485872bb1c3501a667c5c7a9617af91ed5867108.exe 87 PID 3896 wrote to memory of 3980 3896 tnnnbb.exe 88 PID 3980 wrote to memory of 3344 3980 hnhtbt.exe 89 PID 3344 wrote to memory of 3552 3344 vvvdd.exe 90 PID 3552 wrote to memory of 3684 3552 jpppd.exe 91 PID 3684 wrote to memory of 1188 3684 5rlxrlf.exe 92 PID 1188 wrote to memory of 5024 1188 pjvjv.exe 93 PID 5024 wrote to memory of 1604 5024 vpvpv.exe 94 PID 1604 wrote to memory of 376 1604 3xxrlxr.exe 95 PID 376 wrote to memory of 2524 376 rlfxlfx.exe 96 PID 2524 wrote to memory of 3800 2524 7vjdv.exe 97 PID 3800 wrote to memory of 3508 3800 bbhbbb.exe 98 PID 3508 wrote to memory of 2612 3508 pdjjd.exe 99 PID 2612 wrote to memory of 3516 2612 jdvpv.exe 100 PID 3516 wrote to memory of 1064 3516 nnbtht.exe 101 PID 1064 wrote to memory of 1784 1064 jddvv.exe 102 PID 1784 wrote to memory of 2672 1784 xxrlllf.exe 103 PID 2672 wrote to memory of 2124 2672 vvdvj.exe 104 PID 2124 wrote to memory of 3436 2124 ppjdp.exe 105 PID 3436 wrote to memory of 224 3436 thtnnn.exe 106 PID 224 wrote to memory of 800 224 ppjjp.exe 107 PID 800 wrote to memory of 2928 800 xxrllxx.exe 108 PID 2928 wrote to memory of 2320 2928 xrlffxf.exe 109 PID 2320 wrote to memory of 2076 2320 btthht.exe 110 PID 2076 wrote to memory of 3760 2076 jdjvj.exe 111 PID 3760 wrote to memory of 2416 3760 fxxrlff.exe 112 PID 2416 wrote to memory of 4212 2416 fflflff.exe 113 PID 4212 wrote to memory of 736 4212 nhhbtn.exe 114 PID 736 wrote to memory of 1872 736 5vvdv.exe 115 PID 1872 wrote to memory of 4180 1872 bbnhhb.exe 116 PID 4180 wrote to memory of 2440 4180 rfllxrf.exe 117 PID 2440 wrote to memory of 3748 2440 5xxxlfx.exe 118 PID 3748 wrote to memory of 4260 3748 hbbbtn.exe 119 PID 4260 wrote to memory of 1372 4260 jdpjd.exe 120 PID 1372 wrote to memory of 1776 1372 3rrrrll.exe 121 PID 1776 wrote to memory of 1840 1776 tnnhbt.exe 122 PID 1840 wrote to memory of 4424 1840 ttnhhh.exe 123 PID 4424 wrote to memory of 4224 4424 rrlffll.exe 124 PID 4224 wrote to memory of 4472 4224 7bthbb.exe 125 PID 4472 wrote to memory of 4612 4472 lffxlxr.exe 126 PID 4612 wrote to memory of 4236 4612 hhnbnh.exe 127 PID 4236 wrote to memory of 1292 4236 9dppd.exe 128 PID 1292 wrote to memory of 728 1292 xrlfrlf.exe 129 PID 728 wrote to memory of 3236 728 bntnnb.exe 130 PID 3236 wrote to memory of 3048 3236 rxfrxxx.exe 131 PID 3048 wrote to memory of 1804 3048 thbtnb.exe 132 PID 1804 wrote to memory of 732 1804 dpppd.exe 133 PID 732 wrote to memory of 5084 732 pvvdp.exe 134 PID 5084 wrote to memory of 3816 5084 bhhhhn.exe 135 PID 3816 wrote to memory of 1836 3816 pvjjd.exe 136 PID 1836 wrote to memory of 3912 1836 tntnhb.exe 137 PID 3912 wrote to memory of 3964 3912 vpppp.exe 138 PID 3964 wrote to memory of 2424 3964 9llfxrl.exe 139 PID 2424 wrote to memory of 4440 2424 1xfffff.exe 140 PID 4440 wrote to memory of 3544 4440 btnnht.exe 141 PID 3544 wrote to memory of 1376 3544 bhnbbt.exe 142 PID 1376 wrote to memory of 4516 1376 ddddj.exe 143 PID 4516 wrote to memory of 2872 4516 xfrxxll.exe 144 PID 2872 wrote to memory of 684 2872 vpjjj.exe 145 PID 684 wrote to memory of 1964 684 rxrfxfr.exe 146 PID 1964 wrote to memory of 1392 1964 tntnnh.exe 147 PID 1392 wrote to memory of 1580 1392 xlrrxrx.exe 148 PID 1580 wrote to memory of 3732 1580 bbbbnt.exe 149 PID 3732 wrote to memory of 2576 3732 vjjjj.exe 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c2fb3b7fd229d6abdb706b9485872bb1c3501a667c5c7a9617af91ed5867108.exe"C:\Users\Admin\AppData\Local\Temp\4c2fb3b7fd229d6abdb706b9485872bb1c3501a667c5c7a9617af91ed5867108.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\tnnnbb.exec:\tnnnbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\hnhtbt.exec:\hnhtbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\vvvdd.exec:\vvvdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
\??\c:\jpppd.exec:\jpppd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\5rlxrlf.exec:\5rlxrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\pjvjv.exec:\pjvjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\vpvpv.exec:\vpvpv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\3xxrlxr.exec:\3xxrlxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\rlfxlfx.exec:\rlfxlfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\7vjdv.exec:\7vjdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\bbhbbb.exec:\bbhbbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
\??\c:\pdjjd.exec:\pdjjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\jdvpv.exec:\jdvpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\nnbtht.exec:\nnbtht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\jddvv.exec:\jddvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\xxrlllf.exec:\xxrlllf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\vvdvj.exec:\vvdvj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\ppjdp.exec:\ppjdp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\thtnnn.exec:\thtnnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
\??\c:\ppjjp.exec:\ppjjp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\xxrllxx.exec:\xxrllxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
\??\c:\xrlffxf.exec:\xrlffxf.exe23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\btthht.exec:\btthht.exe24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\jdjvj.exec:\jdjvj.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\fxxrlff.exec:\fxxrlff.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\fflflff.exec:\fflflff.exe27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\nhhbtn.exec:\nhhbtn.exe28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\5vvdv.exec:\5vvdv.exe29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
\??\c:\bbnhhb.exec:\bbnhhb.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\rfllxrf.exec:\rfllxrf.exe31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\5xxxlfx.exec:\5xxxlfx.exe32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\hbbbtn.exec:\hbbbtn.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\jdpjd.exec:\jdpjd.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\3rrrrll.exec:\3rrrrll.exe35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\tnnhbt.exec:\tnnhbt.exe36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\ttnhhh.exec:\ttnhhh.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\rrlffll.exec:\rrlffll.exe38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\7bthbb.exec:\7bthbb.exe39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\lffxlxr.exec:\lffxlxr.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\hhnbnh.exec:\hhnbnh.exe41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\9dppd.exec:\9dppd.exe42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
\??\c:\xrlfrlf.exec:\xrlfrlf.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\bntnnb.exec:\bntnnb.exe44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:728 -
\??\c:\rxfrxxx.exec:\rxfrxxx.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\thbtnb.exec:\thbtnb.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\dpppd.exec:\dpppd.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\pvvdp.exec:\pvvdp.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
\??\c:\bhhhhn.exec:\bhhhhn.exe49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\pvjjd.exec:\pvjjd.exe50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\tntnhb.exec:\tntnhb.exe51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\vpppp.exec:\vpppp.exe52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
\??\c:\9llfxrl.exec:\9llfxrl.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\1xfffff.exec:\1xfffff.exe54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\btnnht.exec:\btnnht.exe55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\bhnbbt.exec:\bhnbbt.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
\??\c:\ddddj.exec:\ddddj.exe57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\xfrxxll.exec:\xfrxxll.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\vpjjj.exec:\vpjjj.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\rxrfxfr.exec:\rxrfxfr.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\tntnnh.exec:\tntnnh.exe61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\xlrrxrx.exec:\xlrrxrx.exe62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\bbbbnt.exec:\bbbbnt.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\vjjjj.exec:\vjjjj.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\ffxxllx.exec:\ffxxllx.exe65⤵
- Executes dropped EXE
PID:2576 -
\??\c:\hbtnhb.exec:\hbtnhb.exe66⤵PID:2224
-
\??\c:\rrrllfx.exec:\rrrllfx.exe67⤵PID:2160
-
\??\c:\nnbbnn.exec:\nnbbnn.exe68⤵PID:2960
-
\??\c:\djppj.exec:\djppj.exe69⤵PID:3384
-
\??\c:\3vjpv.exec:\3vjpv.exe70⤵PID:4184
-
\??\c:\lrfxrrl.exec:\lrfxrrl.exe71⤵PID:4340
-
\??\c:\tnnhtb.exec:\tnnhtb.exe72⤵PID:3428
-
\??\c:\vvjpd.exec:\vvjpd.exe73⤵PID:2448
-
\??\c:\vdvvp.exec:\vdvvp.exe74⤵PID:864
-
\??\c:\hhhhbb.exec:\hhhhbb.exe75⤵PID:5064
-
\??\c:\5vpjd.exec:\5vpjd.exe76⤵PID:828
-
\??\c:\vpppd.exec:\vpppd.exe77⤵PID:1380
-
\??\c:\frlxffx.exec:\frlxffx.exe78⤵PID:1100
-
\??\c:\hnhtht.exec:\hnhtht.exe79⤵PID:856
-
\??\c:\3thbtn.exec:\3thbtn.exe80⤵PID:1684
-
\??\c:\lfrllxx.exec:\lfrllxx.exe81⤵PID:2032
-
\??\c:\tttttt.exec:\tttttt.exe82⤵PID:2920
-
\??\c:\pjpjv.exec:\pjpjv.exe83⤵PID:3780
-
\??\c:\5rxxrxr.exec:\5rxxrxr.exe84⤵PID:4868
-
\??\c:\ddvvd.exec:\ddvvd.exe85⤵PID:408
-
\??\c:\7xlllfr.exec:\7xlllfr.exe86⤵PID:4088
-
\??\c:\tnttnb.exec:\tnttnb.exe87⤵PID:1136
-
\??\c:\1ddvj.exec:\1ddvj.exe88⤵PID:1976
-
\??\c:\7lrflfr.exec:\7lrflfr.exe89⤵PID:4652
-
\??\c:\xfxfxlf.exec:\xfxfxlf.exe90⤵PID:868
-
\??\c:\nntnhh.exec:\nntnhh.exe91⤵PID:912
-
\??\c:\5ffflff.exec:\5ffflff.exe92⤵PID:1264
-
\??\c:\rffxrlr.exec:\rffxrlr.exe93⤵PID:2572
-
\??\c:\nhbbhh.exec:\nhbbhh.exe94⤵PID:4592
-
\??\c:\vddjp.exec:\vddjp.exe95⤵PID:3916
-
\??\c:\hnnbtn.exec:\hnnbtn.exe96⤵PID:3604
-
\??\c:\ntbnbt.exec:\ntbnbt.exe97⤵PID:2392
-
\??\c:\rrfrlxl.exec:\rrfrlxl.exe98⤵PID:4980
-
\??\c:\tnbthn.exec:\tnbthn.exe99⤵PID:1384
-
\??\c:\fflxxrr.exec:\fflxxrr.exe100⤵PID:3480
-
\??\c:\5tnhtn.exec:\5tnhtn.exe101⤵PID:2428
-
\??\c:\ttnbtn.exec:\ttnbtn.exe102⤵PID:2216
-
\??\c:\rfrlllf.exec:\rfrlllf.exe103⤵PID:4132
-
\??\c:\thtbhn.exec:\thtbhn.exe104⤵PID:3412
-
\??\c:\fffxrrr.exec:\fffxrrr.exe105⤵PID:3696
-
\??\c:\tbhbnh.exec:\tbhbnh.exe106⤵PID:3316
-
\??\c:\vjpvd.exec:\vjpvd.exe107⤵PID:4908
-
\??\c:\vpvvp.exec:\vpvvp.exe108⤵PID:1692
-
\??\c:\rrrlxxr.exec:\rrrlxxr.exe109⤵PID:3300
-
\??\c:\bhtbtt.exec:\bhtbtt.exe110⤵PID:3040
-
\??\c:\djdpj.exec:\djdpj.exe111⤵PID:3572
-
\??\c:\bbnbbn.exec:\bbnbbn.exe112⤵PID:4684
-
\??\c:\rrfxrrl.exec:\rrfxrrl.exe113⤵PID:3660
-
\??\c:\hbhhbt.exec:\hbhhbt.exe114⤵PID:2248
-
\??\c:\jdjvv.exec:\jdjvv.exe115⤵PID:5088
-
\??\c:\bbbthb.exec:\bbbthb.exe116⤵PID:3328
-
\??\c:\pdpjv.exec:\pdpjv.exe117⤵PID:1824
-
\??\c:\bbttnh.exec:\bbttnh.exe118⤵PID:1356
-
\??\c:\vdvpv.exec:\vdvpv.exe119⤵PID:4128
-
\??\c:\hbnhhb.exec:\hbnhhb.exe120⤵PID:2876
-
\??\c:\9ddvp.exec:\9ddvp.exe121⤵PID:2848
-
\??\c:\pjdpj.exec:\pjdpj.exe122⤵PID:1108
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-