Analysis
- max time kernel
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/09/2026, 21:30
General
- Target 1ed657ac263fa359ca0c483cc6e4bbea7f905e273d2d84a4951fbbdf70299538.exe
- Size 101KB
- Sample260916-1csshszz3j
- SHA256 1ed657ac263fa359ca0c483cc6e4bbea7f905e273d2d84a4951fbbdf70299538
- MD5 4b2c19f33ba8dde74f6616cc8daed063
- SHA1 60877ac56d323c5263a428e0083d1ce20593f4b8
- SHA512 75f0f19678ba421281fda8a2e8875c709ddc1c6ccd4054c4a5871b27e948cdea1d15c2a7cb47d95919f63d66f70deb3937defa22c348fbd96eeda1350dded448
- SSDEEP 3072:0hOmTsF93UYfwC6GIoutX8KiUcPoAuv6pq:0cm4FmowdHoSHqPoJ6pq
- TLSH T15EA3F1E0255875C3E5B9D53BC1AAF968084922B3AB910EDE91E812C70F38F41EC46D7F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4304 bnhtnh.exe 5108 pdpdj.exe 1124 tnhtnb.exe 4892 9llffxl.exe 4744 lfxrrfx.exe 4716 hnnbtt.exe 4564 tnhtnh.exe 2552 nnnhtn.exe 1564 vppjp.exe 4800 lrrfxxl.exe 3768 bthbbt.exe 3820 3xxlxxr.exe 2484 xrllfrr.exe 3940 ttnnbt.exe 2356 ddvvp.exe 3188 fxrlfll.exe 4512 hhbttn.exe 3620 dvdvj.exe 2160 xrrlxxr.exe 5008 fxrlfxl.exe 3272 pjdvd.exe 452 1vvpv.exe 2676 hhbhbn.exe 2832 7djvj.exe 2280 xxrfllx.exe 2164 nntnhb.exe 1624 pjjdv.exe 2456 ntbtnn.exe 3108 pvjvv.exe 4076 1lrlffx.exe 2344 tbhbhb.exe 3380 xrrfrxl.exe 2740 bnbtnn.exe 1120 bthbbb.exe 1876 llrlxff.exe 4544 ddvpj.exe 2652 dvjjd.exe 3500 xfxlxxr.exe 2980 bbnnhh.exe 5060 9jddv.exe 4428 vvppj.exe 4836 xllfffx.exe 3528 pjvpp.exe 3736 rrrfrlx.exe 3700 dvpdv.exe 1772 pvjdp.exe 5084 fflxrlf.exe 4844 nhtnhb.exe 2692 pjvpv.exe 4184 dvppd.exe 1160 tnhthh.exe 1144 hnhthh.exe 3256 fffrrrl.exe 4120 hbhhbn.exe 4088 vppdd.exe 3664 lfxrxxr.exe 1536 lrlfxrf.exe 1888 tbnbtn.exe 4900 pjdvv.exe 508 jddvj.exe 1492 fllfxrl.exe 616 ppdvv.exe 1716 xlrxxxx.exe 3960 bntntb.exe -
resource yara_rule behavioral1/memory/4216-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x001a00000001e4b3-3.dat upx behavioral1/memory/4216-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d0000000243e7-9.dat upx behavioral1/memory/5108-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/4304-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000024519-14.dat upx behavioral1/memory/5108-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000002451a-22.dat upx behavioral1/files/0x000700000002451b-28.dat upx behavioral1/files/0x000700000002451c-33.dat upx behavioral1/memory/4744-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000002451d-40.dat upx behavioral1/memory/4716-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1124-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000002451e-45.dat upx behavioral1/memory/4564-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000002451f-51.dat upx behavioral1/memory/2552-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000024520-57.dat upx behavioral1/memory/4800-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000024521-65.dat upx behavioral1/memory/1564-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000024522-69.dat upx behavioral1/files/0x0007000000024523-75.dat upx behavioral1/files/0x0007000000024524-80.dat upx behavioral1/memory/3768-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000024525-86.dat upx behavioral1/memory/3940-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2356-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000024526-91.dat upx behavioral1/files/0x0007000000024527-96.dat upx behavioral1/memory/3188-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000024528-102.dat upx behavioral1/files/0x0007000000024529-107.dat upx behavioral1/memory/2160-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000002452a-114.dat upx behavioral1/memory/3620-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000002452b-121.dat upx behavioral1/files/0x000a000000024516-124.dat upx behavioral1/memory/452-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3272-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/452-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000002452c-133.dat upx behavioral1/files/0x000700000002452d-137.dat upx behavioral1/memory/2676-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000002452e-145.dat upx behavioral1/files/0x000700000002452f-148.dat upx behavioral1/files/0x0007000000024530-153.dat upx behavioral1/files/0x0007000000024531-158.dat upx behavioral1/files/0x0007000000024532-163.dat upx behavioral1/memory/3108-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000024533-169.dat upx behavioral1/files/0x0007000000024534-174.dat upx behavioral1/files/0x0007000000024535-179.dat upx behavioral1/memory/3380-182-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1876-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2980-208-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/5060-212-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/4428-216-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3528-223-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3700-230-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/5084-237-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/4844-241-0x0000000000400000-0x0000000000427000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lfxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4216 wrote to memory of 4304 4216 1ed657ac263fa359ca0c483cc6e4bbea7f905e273d2d84a4951fbbdf70299538.exe 84 PID 4304 wrote to memory of 5108 4304 bnhtnh.exe 85 PID 5108 wrote to memory of 1124 5108 pdpdj.exe 86 PID 1124 wrote to memory of 4892 1124 tnhtnb.exe 87 PID 4892 wrote to memory of 4744 4892 9llffxl.exe 88 PID 4744 wrote to memory of 4716 4744 lfxrrfx.exe 89 PID 4716 wrote to memory of 4564 4716 hnnbtt.exe 90 PID 4564 wrote to memory of 2552 4564 tnhtnh.exe 91 PID 2552 wrote to memory of 1564 2552 nnnhtn.exe 92 PID 1564 wrote to memory of 4800 1564 vppjp.exe 93 PID 4800 wrote to memory of 3768 4800 lrrfxxl.exe 94 PID 3768 wrote to memory of 3820 3768 bthbbt.exe 95 PID 3820 wrote to memory of 2484 3820 3xxlxxr.exe 96 PID 2484 wrote to memory of 3940 2484 xrllfrr.exe 97 PID 3940 wrote to memory of 2356 3940 ttnnbt.exe 98 PID 2356 wrote to memory of 3188 2356 ddvvp.exe 99 PID 3188 wrote to memory of 4512 3188 fxrlfll.exe 100 PID 4512 wrote to memory of 3620 4512 hhbttn.exe 101 PID 3620 wrote to memory of 2160 3620 dvdvj.exe 102 PID 2160 wrote to memory of 5008 2160 xrrlxxr.exe 103 PID 5008 wrote to memory of 3272 5008 fxrlfxl.exe 104 PID 3272 wrote to memory of 452 3272 pjdvd.exe 105 PID 452 wrote to memory of 2676 452 1vvpv.exe 106 PID 2676 wrote to memory of 2832 2676 hhbhbn.exe 107 PID 2832 wrote to memory of 2280 2832 7djvj.exe 108 PID 2280 wrote to memory of 2164 2280 xxrfllx.exe 109 PID 2164 wrote to memory of 1624 2164 nntnhb.exe 110 PID 1624 wrote to memory of 2456 1624 pjjdv.exe 111 PID 2456 wrote to memory of 3108 2456 ntbtnn.exe 112 PID 3108 wrote to memory of 4076 3108 pvjvv.exe 113 PID 4076 wrote to memory of 2344 4076 1lrlffx.exe 114 PID 2344 wrote to memory of 3380 2344 tbhbhb.exe 115 PID 3380 wrote to memory of 2740 3380 xrrfrxl.exe 116 PID 2740 wrote to memory of 1120 2740 bnbtnn.exe 117 PID 1120 wrote to memory of 1876 1120 bthbbb.exe 118 PID 1876 wrote to memory of 4544 1876 llrlxff.exe 119 PID 4544 wrote to memory of 2652 4544 ddvpj.exe 120 PID 2652 wrote to memory of 3500 2652 dvjjd.exe 121 PID 3500 wrote to memory of 2980 3500 xfxlxxr.exe 122 PID 2980 wrote to memory of 5060 2980 bbnnhh.exe 123 PID 5060 wrote to memory of 4428 5060 9jddv.exe 124 PID 4428 wrote to memory of 4836 4428 vvppj.exe 125 PID 4836 wrote to memory of 3528 4836 xllfffx.exe 126 PID 3528 wrote to memory of 3736 3528 pjvpp.exe 127 PID 3736 wrote to memory of 3700 3736 rrrfrlx.exe 128 PID 3700 wrote to memory of 1772 3700 dvpdv.exe 129 PID 1772 wrote to memory of 5084 1772 pvjdp.exe 130 PID 5084 wrote to memory of 4844 5084 fflxrlf.exe 131 PID 4844 wrote to memory of 2692 4844 nhtnhb.exe 132 PID 2692 wrote to memory of 4184 2692 pjvpv.exe 133 PID 4184 wrote to memory of 1160 4184 dvppd.exe 134 PID 1160 wrote to memory of 1144 1160 tnhthh.exe 135 PID 1144 wrote to memory of 3256 1144 hnhthh.exe 136 PID 3256 wrote to memory of 4120 3256 fffrrrl.exe 137 PID 4120 wrote to memory of 4088 4120 hbhhbn.exe 138 PID 4088 wrote to memory of 3664 4088 vppdd.exe 139 PID 3664 wrote to memory of 1536 3664 lfxrxxr.exe 140 PID 1536 wrote to memory of 1888 1536 lrlfxrf.exe 141 PID 1888 wrote to memory of 4900 1888 tbnbtn.exe 142 PID 4900 wrote to memory of 508 4900 pjdvv.exe 143 PID 508 wrote to memory of 1492 508 jddvj.exe 144 PID 1492 wrote to memory of 616 1492 fllfxrl.exe 145 PID 616 wrote to memory of 1716 616 ppdvv.exe 146 PID 1716 wrote to memory of 3960 1716 xlrxxxx.exe 147
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ed657ac263fa359ca0c483cc6e4bbea7f905e273d2d84a4951fbbdf70299538.exe"C:\Users\Admin\AppData\Local\Temp\1ed657ac263fa359ca0c483cc6e4bbea7f905e273d2d84a4951fbbdf70299538.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\bnhtnh.exec:\bnhtnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
\??\c:\pdpdj.exec:\pdpdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\tnhtnb.exec:\tnhtnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
\??\c:\9llffxl.exec:\9llffxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\lfxrrfx.exec:\lfxrrfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\hnnbtt.exec:\hnnbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\tnhtnh.exec:\tnhtnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\nnnhtn.exec:\nnnhtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\vppjp.exec:\vppjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\lrrfxxl.exec:\lrrfxxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\bthbbt.exec:\bthbbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
\??\c:\3xxlxxr.exec:\3xxlxxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
\??\c:\xrllfrr.exec:\xrllfrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\ttnnbt.exec:\ttnnbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\ddvvp.exec:\ddvvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\fxrlfll.exec:\fxrlfll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
\??\c:\hhbttn.exec:\hhbttn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\dvdvj.exec:\dvdvj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\xrrlxxr.exec:\xrrlxxr.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\fxrlfxl.exec:\fxrlfxl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\pjdvd.exec:\pjdvd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\1vvpv.exec:\1vvpv.exe23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\hhbhbn.exec:\hhbhbn.exe24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\7djvj.exec:\7djvj.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\xxrfllx.exec:\xxrfllx.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\nntnhb.exec:\nntnhb.exe27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\pjjdv.exec:\pjjdv.exe28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\ntbtnn.exec:\ntbtnn.exe29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\pvjvv.exec:\pvjvv.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\1lrlffx.exec:\1lrlffx.exe31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\tbhbhb.exec:\tbhbhb.exe32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\xrrfrxl.exec:\xrrfrxl.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\bnbtnn.exec:\bnbtnn.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\bthbbb.exec:\bthbbb.exe35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\llrlxff.exec:\llrlxff.exe36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\ddvpj.exec:\ddvpj.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\dvjjd.exec:\dvjjd.exe38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\xfxlxxr.exec:\xfxlxxr.exe39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\bbnnhh.exec:\bbnnhh.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\9jddv.exec:\9jddv.exe41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\vvppj.exec:\vvppj.exe42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\xllfffx.exec:\xllfffx.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\pjvpp.exec:\pjvpp.exe44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\rrrfrlx.exec:\rrrfrlx.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
\??\c:\dvpdv.exec:\dvpdv.exe46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\pvjdp.exec:\pvjdp.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\fflxrlf.exec:\fflxrlf.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\nhtnhb.exec:\nhtnhb.exe49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\pjvpv.exec:\pjvpv.exe50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\dvppd.exec:\dvppd.exe51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\tnhthh.exec:\tnhthh.exe52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\hnhthh.exec:\hnhthh.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\fffrrrl.exec:\fffrrrl.exe54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\hbhhbn.exec:\hbhhbn.exe55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\vppdd.exec:\vppdd.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\lfxrxxr.exec:\lfxrxxr.exe57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\lrlfxrf.exec:\lrlfxrf.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\tbnbtn.exec:\tbnbtn.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\pjdvv.exec:\pjdvv.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\jddvj.exec:\jddvj.exe61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:508 -
\??\c:\fllfxrl.exec:\fllfxrl.exe62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\ppdvv.exec:\ppdvv.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
\??\c:\xlrxxxx.exec:\xlrxxxx.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\bntntb.exec:\bntntb.exe65⤵
- Executes dropped EXE
PID:3960 -
\??\c:\hhbthb.exec:\hhbthb.exe66⤵PID:800
-
\??\c:\pjpjv.exec:\pjpjv.exe67⤵PID:1056
-
\??\c:\lfxlfrl.exec:\lfxlfrl.exe68⤵PID:4812
-
\??\c:\fllfrlf.exec:\fllfrlf.exe69⤵PID:2472
-
\??\c:\7nbnbh.exec:\7nbnbh.exe70⤵PID:4856
-
\??\c:\dvjdd.exec:\dvjdd.exe71⤵PID:2240
-
\??\c:\pvpdv.exec:\pvpdv.exe72⤵PID:3344
-
\??\c:\rxrlffl.exec:\rxrlffl.exe73⤵PID:1636
-
\??\c:\thhbnh.exec:\thhbnh.exe74⤵PID:2628
-
\??\c:\pvdvp.exec:\pvdvp.exe75⤵PID:4412
-
\??\c:\bbhbbt.exec:\bbhbbt.exe76⤵PID:860
-
\??\c:\tnbtnt.exec:\tnbtnt.exe77⤵PID:3900
-
\??\c:\rlrrlfl.exec:\rlrrlfl.exe78⤵PID:1520
-
\??\c:\hhtntb.exec:\hhtntb.exe79⤵
- System Location Discovery: System Language Discovery
PID:2400 -
\??\c:\vdjjp.exec:\vdjjp.exe80⤵PID:4100
-
\??\c:\fxrfxxr.exec:\fxrfxxr.exe81⤵PID:5024
-
\??\c:\vpvpj.exec:\vpvpj.exe82⤵PID:4868
-
\??\c:\lfxfxfr.exec:\lfxfxfr.exe83⤵PID:3932
-
\??\c:\nhtnbt.exec:\nhtnbt.exe84⤵PID:2184
-
\??\c:\vvpjd.exec:\vvpjd.exe85⤵PID:4420
-
\??\c:\lrfrfrf.exec:\lrfrfrf.exe86⤵PID:4136
-
\??\c:\3ntbbh.exec:\3ntbbh.exe87⤵PID:2648
-
\??\c:\jvpjd.exec:\jvpjd.exe88⤵PID:380
-
\??\c:\xfrlflr.exec:\xfrlflr.exe89⤵PID:3096
-
\??\c:\nnnhbn.exec:\nnnhbn.exe90⤵PID:3264
-
\??\c:\vddvd.exec:\vddvd.exe91⤵PID:3808
-
\??\c:\xxfxfxr.exec:\xxfxfxr.exe92⤵PID:2808
-
\??\c:\7htnbt.exec:\7htnbt.exe93⤵PID:4252
-
\??\c:\lflfxxr.exec:\lflfxxr.exe94⤵PID:2896
-
\??\c:\bbbnhb.exec:\bbbnhb.exe95⤵PID:2004
-
\??\c:\vvdvj.exec:\vvdvj.exe96⤵PID:2924
-
\??\c:\rrrfrlx.exec:\rrrfrlx.exe97⤵PID:3520
-
\??\c:\thttht.exec:\thttht.exe98⤵PID:2168
-
\??\c:\ttntht.exec:\ttntht.exe99⤵PID:4808
-
\??\c:\pjdvp.exec:\pjdvp.exe100⤵PID:5044
-
\??\c:\jpjdv.exec:\jpjdv.exe101⤵PID:3616
-
\??\c:\xffxrlf.exec:\xffxrlf.exe102⤵PID:3992
-
\??\c:\nhbtnh.exec:\nhbtnh.exe103⤵PID:2236
-
\??\c:\frfxrlf.exec:\frfxrlf.exe104⤵PID:892
-
\??\c:\fxxlffx.exec:\fxxlffx.exe105⤵PID:3280
-
\??\c:\ffrrfxr.exec:\ffrrfxr.exe106⤵PID:2432
-
\??\c:\nhbtnb.exec:\nhbtnb.exe107⤵PID:4448
-
\??\c:\djddp.exec:\djddp.exe108⤵PID:4992
-
\??\c:\lrrfxrf.exec:\lrrfxrf.exe109⤵PID:2076
-
\??\c:\9hbthn.exec:\9hbthn.exe110⤵PID:4528
-
\??\c:\tthbnn.exec:\tthbnn.exe111⤵PID:4548
-
\??\c:\rrxfxrr.exec:\rrxfxrr.exe112⤵PID:1600
-
\??\c:\hnnttn.exec:\hnnttn.exe113⤵PID:1820
-
\??\c:\llfxlfx.exec:\llfxlfx.exe114⤵PID:4768
-
\??\c:\thbtbt.exec:\thbtbt.exe115⤵PID:4132
-
\??\c:\rflflfr.exec:\rflflfr.exe116⤵PID:868
-
\??\c:\vdvpj.exec:\vdvpj.exe117⤵PID:4176
-
\??\c:\fllfxrl.exec:\fllfxrl.exe118⤵
- System Location Discovery: System Language Discovery
PID:3704 -
\??\c:\lffxrrr.exec:\lffxrrr.exe119⤵PID:4692
-
\??\c:\bthbhh.exec:\bthbhh.exe120⤵PID:2688
-
\??\c:\dpdvj.exec:\dpdvj.exe121⤵PID:3332
-
\??\c:\pjjdj.exec:\pjjdj.exe122⤵PID:4148
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-