Analysis
- max time kernel
142s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/09/2026, 21:30
Static task
static1
1 signatures
General
- Target 1ed2c0bd3bc7efd533f577e78b65d9b1696da7a6895f9d504524169a322eeddb.exe
- Size 202KB
- Sample260916-1chbsaee33
- SHA256 1ed2c0bd3bc7efd533f577e78b65d9b1696da7a6895f9d504524169a322eeddb
- MD5 89358e741fc56e3354889019029a8742
- SHA1 3517b1cb6c4fbd33314851ed102457d272c7b635
- SHA512 f3ac6e86f762fd064ee52ae3352d29bc5a4718d7269af6af2e693142700a009cb1fa81b83b45bfd87a5f89f1b705b468813450dae67f370f978f49a492b1085b
- SSDEEP 3072:EhOm2sI93UufdC67ciyt3ujFf7TQsq5Vag:Ecm7ImGddXyt38TU5H
- TLSH T13A14F1F11A2CB1F7D5B4F471A561A564104363F7A9861CEA22F806CD0B78A82DA83D7F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4564 jjvvp.exe 6140 llfffff.exe 1224 rxrrlrx.exe 2736 pjjpp.exe 3352 fxfffll.exe 3308 bhtttn.exe 4372 nnnbth.exe 392 dvvpj.exe 5200 fxxrlll.exe 5424 lrxxxxl.exe 1756 htntnn.exe 5292 nnbnhb.exe 3800 pjpvv.exe 4988 xxfxxrr.exe 4824 frllfff.exe 3716 btntbn.exe 5568 9jvvp.exe 1852 7vjjd.exe 5060 1rxrlff.exe 3348 xrffflr.exe 556 thnhbb.exe 6052 3pvpp.exe 2452 1ppjp.exe 4584 lfllfff.exe 5232 nnnnnn.exe 4124 9jjjd.exe 856 dpppp.exe 2328 xfxxxxx.exe 3780 hnhhbb.exe 5820 thnhbt.exe 4848 ppvpp.exe 2496 fxxrxxr.exe 548 3ffrrrr.exe 1660 nnhnht.exe 4612 pjjdv.exe 6028 vddvj.exe 5048 fxfxrff.exe 3004 bntnnn.exe 2624 tthnhb.exe 3708 vjjdv.exe 3048 ddppv.exe 1868 flrlrrf.exe 3960 thbbtt.exe 240 7ntbnn.exe 308 vpjdp.exe 1560 9ddvv.exe 5360 ffrlllf.exe 2004 3hnnhb.exe 2068 bbbtnn.exe 1208 jvjdv.exe 4044 vvvpp.exe 1152 flrllrl.exe 3228 3tttnt.exe 5672 tbhhbb.exe 3840 dpvpj.exe 1532 dddvj.exe 3664 lrfxfxl.exe 5500 1nhhnh.exe 5952 thtbbn.exe 5208 vpjdd.exe 3320 7rfflxx.exe 5788 rxxfxrr.exe 1988 nntnhh.exe 2344 pvvpj.exe -
resource yara_rule behavioral1/memory/4532-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/4564-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/4532-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/6140-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/5276-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1376-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/4184-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/5012-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/5168-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/5208-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/5824-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/5672-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1208-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/5360-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/240-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3960-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/6028-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/4612-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/548-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/4848-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/5820-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3780-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/856-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/4124-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/5232-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/4584-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/556-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3348-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/5060-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/5568-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/4988-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3800-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/5292-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/5424-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/5200-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/392-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/4372-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3308-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3352-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/5708-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3784-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/5304-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/4484-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/4264-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3160-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/5228-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/5876-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3776-598-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/4944-669-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-715-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-718-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-723-0x0000000000400000-0x000000000042A000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjdv.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4532 wrote to memory of 4564 4532 1ed2c0bd3bc7efd533f577e78b65d9b1696da7a6895f9d504524169a322eeddb.exe 85 PID 4564 wrote to memory of 6140 4564 jjvvp.exe 86 PID 6140 wrote to memory of 1224 6140 llfffff.exe 87 PID 1224 wrote to memory of 2736 1224 rxrrlrx.exe 88 PID 2736 wrote to memory of 3352 2736 pjjpp.exe 89 PID 3352 wrote to memory of 3308 3352 fxfffll.exe 90 PID 3308 wrote to memory of 4372 3308 bhtttn.exe 91 PID 4372 wrote to memory of 392 4372 nnnbth.exe 92 PID 392 wrote to memory of 5200 392 dvvpj.exe 93 PID 5200 wrote to memory of 5424 5200 fxxrlll.exe 94 PID 5424 wrote to memory of 1756 5424 lrxxxxl.exe 95 PID 1756 wrote to memory of 5292 1756 htntnn.exe 96 PID 5292 wrote to memory of 3800 5292 nnbnhb.exe 97 PID 3800 wrote to memory of 4988 3800 pjpvv.exe 98 PID 4988 wrote to memory of 4824 4988 xxfxxrr.exe 99 PID 4824 wrote to memory of 3716 4824 frllfff.exe 100 PID 3716 wrote to memory of 5568 3716 btntbn.exe 101 PID 5568 wrote to memory of 1852 5568 9jvvp.exe 102 PID 1852 wrote to memory of 5060 1852 7vjjd.exe 103 PID 5060 wrote to memory of 3348 5060 1rxrlff.exe 104 PID 3348 wrote to memory of 556 3348 xrffflr.exe 105 PID 556 wrote to memory of 6052 556 thnhbb.exe 106 PID 6052 wrote to memory of 2452 6052 3pvpp.exe 107 PID 2452 wrote to memory of 4584 2452 1ppjp.exe 108 PID 4584 wrote to memory of 5232 4584 lfllfff.exe 109 PID 5232 wrote to memory of 4124 5232 nnnnnn.exe 110 PID 4124 wrote to memory of 856 4124 9jjjd.exe 111 PID 856 wrote to memory of 2328 856 dpppp.exe 112 PID 2328 wrote to memory of 3780 2328 xfxxxxx.exe 113 PID 3780 wrote to memory of 5820 3780 hnhhbb.exe 114 PID 5820 wrote to memory of 4848 5820 thnhbt.exe 115 PID 4848 wrote to memory of 2496 4848 ppvpp.exe 116 PID 2496 wrote to memory of 548 2496 fxxrxxr.exe 117 PID 548 wrote to memory of 1660 548 3ffrrrr.exe 118 PID 1660 wrote to memory of 4612 1660 nnhnht.exe 119 PID 4612 wrote to memory of 6028 4612 pjjdv.exe 120 PID 6028 wrote to memory of 5048 6028 vddvj.exe 121 PID 5048 wrote to memory of 3004 5048 fxfxrff.exe 122 PID 3004 wrote to memory of 2624 3004 bntnnn.exe 123 PID 2624 wrote to memory of 3708 2624 tthnhb.exe 124 PID 3708 wrote to memory of 3048 3708 vjjdv.exe 125 PID 3048 wrote to memory of 1868 3048 ddppv.exe 126 PID 1868 wrote to memory of 3960 1868 flrlrrf.exe 127 PID 3960 wrote to memory of 240 3960 thbbtt.exe 128 PID 240 wrote to memory of 308 240 7ntbnn.exe 129 PID 308 wrote to memory of 1560 308 vpjdp.exe 130 PID 1560 wrote to memory of 5360 1560 9ddvv.exe 131 PID 5360 wrote to memory of 2004 5360 ffrlllf.exe 132 PID 2004 wrote to memory of 2068 2004 3hnnhb.exe 133 PID 2068 wrote to memory of 1208 2068 bbbtnn.exe 134 PID 1208 wrote to memory of 4044 1208 jvjdv.exe 135 PID 4044 wrote to memory of 1152 4044 vvvpp.exe 136 PID 1152 wrote to memory of 3228 1152 flrllrl.exe 137 PID 3228 wrote to memory of 5672 3228 3tttnt.exe 138 PID 5672 wrote to memory of 3840 5672 tbhhbb.exe 139 PID 3840 wrote to memory of 1532 3840 dpvpj.exe 140 PID 1532 wrote to memory of 3664 1532 dddvj.exe 141 PID 3664 wrote to memory of 5500 3664 lrfxfxl.exe 142 PID 5500 wrote to memory of 5952 5500 1nhhnh.exe 143 PID 5952 wrote to memory of 5208 5952 thtbbn.exe 144 PID 5208 wrote to memory of 3320 5208 vpjdd.exe 145 PID 3320 wrote to memory of 5788 3320 7rfflxx.exe 146 PID 5788 wrote to memory of 1988 5788 rxxfxrr.exe 147 PID 1988 wrote to memory of 2344 1988 nntnhh.exe 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ed2c0bd3bc7efd533f577e78b65d9b1696da7a6895f9d504524169a322eeddb.exe"C:\Users\Admin\AppData\Local\Temp\1ed2c0bd3bc7efd533f577e78b65d9b1696da7a6895f9d504524169a322eeddb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\jjvvp.exec:\jjvvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\llfffff.exec:\llfffff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6140 -
\??\c:\rxrrlrx.exec:\rxrrlrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\pjjpp.exec:\pjjpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\fxfffll.exec:\fxfffll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
\??\c:\bhtttn.exec:\bhtttn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\nnnbth.exec:\nnnbth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\dvvpj.exec:\dvvpj.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\fxxrlll.exec:\fxxrlll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5200 -
\??\c:\lrxxxxl.exec:\lrxxxxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5424 -
\??\c:\htntnn.exec:\htntnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\nnbnhb.exec:\nnbnhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5292 -
\??\c:\pjpvv.exec:\pjpvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
\??\c:\xxfxxrr.exec:\xxfxxrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\frllfff.exec:\frllfff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\btntbn.exec:\btntbn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\9jvvp.exec:\9jvvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5568 -
\??\c:\7vjjd.exec:\7vjjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\1rxrlff.exec:\1rxrlff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\xrffflr.exec:\xrffflr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\thnhbb.exec:\thnhbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\3pvpp.exec:\3pvpp.exe23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6052 -
\??\c:\1ppjp.exec:\1ppjp.exe24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\lfllfff.exec:\lfllfff.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\nnnnnn.exec:\nnnnnn.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5232 -
\??\c:\9jjjd.exec:\9jjjd.exe27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\dpppp.exec:\dpppp.exe28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\xfxxxxx.exec:\xfxxxxx.exe29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\hnhhbb.exec:\hnhhbb.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3780 -
\??\c:\thnhbt.exec:\thnhbt.exe31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5820 -
\??\c:\ppvpp.exec:\ppvpp.exe32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\fxxrxxr.exec:\fxxrxxr.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\3ffrrrr.exec:\3ffrrrr.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\nnhnht.exec:\nnhnht.exe35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\pjjdv.exec:\pjjdv.exe36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\vddvj.exec:\vddvj.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
\??\c:\fxfxrff.exec:\fxfxrff.exe38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\bntnnn.exec:\bntnnn.exe39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\tthnhb.exec:\tthnhb.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\vjjdv.exec:\vjjdv.exe41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\ddppv.exec:\ddppv.exe42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\flrlrrf.exec:\flrlrrf.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\thbbtt.exec:\thbbtt.exe44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\7ntbnn.exec:\7ntbnn.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
\??\c:\vpjdp.exec:\vpjdp.exe46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:308 -
\??\c:\9ddvv.exec:\9ddvv.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\ffrlllf.exec:\ffrlllf.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5360 -
\??\c:\3hnnhb.exec:\3hnnhb.exe49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\bbbtnn.exec:\bbbtnn.exe50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\jvjdv.exec:\jvjdv.exe51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\vvvpp.exec:\vvvpp.exe52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\flrllrl.exec:\flrllrl.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\3tttnt.exec:\3tttnt.exe54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\tbhhbb.exec:\tbhhbb.exe55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5672 -
\??\c:\dpvpj.exec:\dpvpj.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\dddvj.exec:\dddvj.exe57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\lrfxfxl.exec:\lrfxfxl.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\1nhhnh.exec:\1nhhnh.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5500 -
\??\c:\thtbbn.exec:\thtbbn.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
\??\c:\vpjdd.exec:\vpjdd.exe61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5208 -
\??\c:\7rfflxx.exec:\7rfflxx.exe62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\rxxfxrr.exec:\rxxfxrr.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5788 -
\??\c:\nntnhh.exec:\nntnhh.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\pvvpj.exec:\pvvpj.exe65⤵
- Executes dropped EXE
PID:2344 -
\??\c:\djvpj.exec:\djvpj.exe66⤵PID:5404
-
\??\c:\frxfxxr.exec:\frxfxxr.exe67⤵PID:3492
-
\??\c:\rlrlffx.exec:\rlrlffx.exe68⤵PID:3516
-
\??\c:\bbhhht.exec:\bbhhht.exe69⤵PID:4812
-
\??\c:\jvvpj.exec:\jvvpj.exe70⤵PID:5168
-
\??\c:\vvppj.exec:\vvppj.exe71⤵PID:5012
-
\??\c:\xxfrxlf.exec:\xxfrxlf.exe72⤵PID:1032
-
\??\c:\htbthb.exec:\htbthb.exe73⤵PID:620
-
\??\c:\jdjjd.exec:\jdjjd.exe74⤵PID:4184
-
\??\c:\ppddv.exec:\ppddv.exe75⤵PID:3764
-
\??\c:\fffrxrf.exec:\fffrxrf.exe76⤵PID:1392
-
\??\c:\fxrlxxx.exec:\fxrlxxx.exe77⤵PID:2828
-
\??\c:\nnbbtb.exec:\nnbbtb.exe78⤵PID:1376
-
\??\c:\9pjdj.exec:\9pjdj.exe79⤵PID:2236
-
\??\c:\pjdvv.exec:\pjdvv.exe80⤵PID:5276
-
\??\c:\3xxrfrl.exec:\3xxrfrl.exe81⤵PID:1320
-
\??\c:\lffxxxx.exec:\lffxxxx.exe82⤵PID:5908
-
\??\c:\1bnnnn.exec:\1bnnnn.exe83⤵PID:6136
-
\??\c:\1hhbbb.exec:\1hhbbb.exe84⤵PID:5824
-
\??\c:\jpjdd.exec:\jpjdd.exe85⤵PID:4384
-
\??\c:\xxrxxff.exec:\xxrxxff.exe86⤵PID:5212
-
\??\c:\bttttt.exec:\bttttt.exe87⤵PID:4272
-
\??\c:\9pvpj.exec:\9pvpj.exe88⤵PID:5128
-
\??\c:\ppdvv.exec:\ppdvv.exe89⤵PID:5708
-
\??\c:\rllfxxx.exec:\rllfxxx.exe90⤵PID:3328
-
\??\c:\bttttn.exec:\bttttn.exe91⤵PID:3784
-
\??\c:\thhnht.exec:\thhnht.exe92⤵PID:3496
-
\??\c:\jjjjd.exec:\jjjjd.exe93⤵PID:5592
-
\??\c:\rfrllfl.exec:\rfrllfl.exe94⤵PID:4724
-
\??\c:\nnbhhn.exec:\nnbhhn.exe95⤵PID:736
-
\??\c:\dvjjj.exec:\dvjjj.exe96⤵PID:5304
-
\??\c:\lxlfxxr.exec:\lxlfxxr.exe97⤵PID:4484
-
\??\c:\tnnhhh.exec:\tnnhhh.exe98⤵PID:4264
-
\??\c:\vjjdv.exec:\vjjdv.exe99⤵PID:3156
-
\??\c:\fllxxrr.exec:\fllxxrr.exe100⤵PID:5688
-
\??\c:\bnhnnb.exec:\bnhnnb.exe101⤵
- System Location Discovery: System Language Discovery
PID:4592 -
\??\c:\3vvvp.exec:\3vvvp.exe102⤵PID:4440
-
\??\c:\xrffrrr.exec:\xrffrrr.exe103⤵PID:4420
-
\??\c:\xrxxfrl.exec:\xrxxfrl.exe104⤵PID:1180
-
\??\c:\ntbthh.exec:\ntbthh.exe105⤵PID:3688
-
\??\c:\ppjdp.exec:\ppjdp.exe106⤵PID:5272
-
\??\c:\lfllxlf.exec:\lfllxlf.exe107⤵PID:3068
-
\??\c:\nbtnnt.exec:\nbtnnt.exe108⤵PID:1956
-
\??\c:\9ttnhn.exec:\9ttnhn.exe109⤵PID:5744
-
\??\c:\lflfxxr.exec:\lflfxxr.exe110⤵PID:3948
-
\??\c:\3rxxrxr.exec:\3rxxrxr.exe111⤵PID:2052
-
\??\c:\hnhnnn.exec:\hnhnnn.exe112⤵PID:3912
-
\??\c:\htnnhh.exec:\htnnhh.exe113⤵PID:1176
-
\??\c:\ppvvp.exec:\ppvvp.exe114⤵PID:4976
-
\??\c:\jvddp.exec:\jvddp.exe115⤵PID:1820
-
\??\c:\lfxxlrr.exec:\lfxxlrr.exe116⤵PID:5064
-
\??\c:\tthhhn.exec:\tthhhn.exe117⤵PID:1204
-
\??\c:\5ntbhh.exec:\5ntbhh.exe118⤵PID:2600
-
\??\c:\vdppj.exec:\vdppj.exe119⤵PID:1816
-
\??\c:\fllfrrx.exec:\fllfrrx.exe120⤵PID:5580
-
\??\c:\3rrlfll.exec:\3rrlfll.exe121⤵PID:5372
-
\??\c:\1nhtnt.exec:\1nhtnt.exe122⤵PID:2800
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-