Analysis
- max time kernel
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/09/2026, 22:33
Static task
static1
1 signatures
General
- Target 25f1077386fc88a2bea615ff7ba70318d6e39af2f0309f8bfdff747e16a216fc.exe
- Size 78KB
- Sample260916-2gp3vsfa96
- SHA256 25f1077386fc88a2bea615ff7ba70318d6e39af2f0309f8bfdff747e16a216fc
- MD5 7b122a78bdb665978a054399f2779ec1
- SHA1 0b4e70d54e68d1a6c77a7d6a117876bb7a57c25b
- SHA512 20351974d2a1dafde7132aaeda8df9a0ee4597a21475f9f2f1925c0c2bbb3de794684244a57329a24d8d5847b554d5e3253b4ece696af5bdd24ef1b13a5d0382
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDosxXnGwXeJXB98ELkWx0e:ymb3NkkiQ3mdBjFosxXGPXbXko0e
- TLSH T15673E1F69B689AF6C9F0D63085D20158341A71B2DDC52CF68060178A0B7EED0E387DBE
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4212 vvppj.exe 3892 ffrrrxx.exe 2404 dpjdd.exe 4896 vjjdp.exe 1124 vvdjd.exe 1972 bhhbnn.exe 1628 pvvvv.exe 4504 pddvp.exe 2216 rfxlfxl.exe 3300 nnnbbt.exe 1312 5jpjd.exe 5116 xlfffxf.exe 3812 bthnhn.exe 3992 bhbthb.exe 3932 vpdvd.exe 4204 pdjdv.exe 1820 lfrfrff.exe 2240 hthbbb.exe 452 jpjdv.exe 2292 vjdvv.exe 4372 hnntnh.exe 1472 nntnhh.exe 3520 dpvdp.exe 2220 rrfxlfx.exe 2820 1bthbb.exe 4636 jvdvv.exe 2776 pjdpv.exe 5040 pddvj.exe 4500 fllxlxl.exe 1680 jjdvp.exe 2996 7bbtnn.exe 4008 jdvpd.exe 3176 1ffrrxr.exe 2040 1bhhnt.exe 1948 jjdvv.exe 3004 xlfxxxr.exe 1728 nhhhbb.exe 4492 nnbbhn.exe 3220 jjdjv.exe 1812 7vvpp.exe 2348 rllxxrl.exe 3944 vpjdd.exe 3108 ttnthb.exe 2676 vpjpj.exe 3716 xxrlrlx.exe 2596 jjvpj.exe 2004 7hhtbb.exe 4084 pjvpj.exe 3964 tttntt.exe 4196 jvpjv.exe 2276 xlrlrxr.exe 2504 flfxlfr.exe 4220 dpjvj.exe 1872 bbhbtn.exe 4532 jppjd.exe 4316 1xllfff.exe 3616 vvvjd.exe 3092 rflfxff.exe 1536 rfllllx.exe 776 nhbtbb.exe 2352 5hhbtn.exe 916 dppjd.exe 3036 ddvjd.exe 3464 tthbbb.exe -
resource yara_rule behavioral1/memory/4840-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4840-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4212-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2404-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4896-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3892-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4896-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4896-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1124-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1124-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1972-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4504-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3300-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1312-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3812-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3992-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/5116-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/452-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1472-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4636-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4500-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1680-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4008-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3176-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1728-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3220-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1812-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3716-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3964-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4196-283-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2276-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4220-295-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1872-299-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4316-307-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3092-315-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/916-331-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-335-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1076-347-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1364-355-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4668-407-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-427-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3728-447-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4152-515-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4380-523-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-579-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1980-595-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/748-623-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/212-651-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4144-687-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1236-691-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4904-791-0x0000000000400000-0x0000000000429000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lllrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tbtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnhh.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4840 wrote to memory of 4212 4840 25f1077386fc88a2bea615ff7ba70318d6e39af2f0309f8bfdff747e16a216fc.exe 82 PID 4212 wrote to memory of 3892 4212 vvppj.exe 83 PID 3892 wrote to memory of 2404 3892 ffrrrxx.exe 84 PID 2404 wrote to memory of 4896 2404 dpjdd.exe 85 PID 4896 wrote to memory of 1124 4896 vjjdp.exe 86 PID 1124 wrote to memory of 1972 1124 vvdjd.exe 87 PID 1972 wrote to memory of 1628 1972 bhhbnn.exe 88 PID 1628 wrote to memory of 4504 1628 pvvvv.exe 89 PID 4504 wrote to memory of 2216 4504 pddvp.exe 90 PID 2216 wrote to memory of 3300 2216 rfxlfxl.exe 91 PID 3300 wrote to memory of 1312 3300 nnnbbt.exe 92 PID 1312 wrote to memory of 5116 1312 5jpjd.exe 93 PID 5116 wrote to memory of 3812 5116 xlfffxf.exe 94 PID 3812 wrote to memory of 3992 3812 bthnhn.exe 95 PID 3992 wrote to memory of 3932 3992 bhbthb.exe 96 PID 3932 wrote to memory of 4204 3932 vpdvd.exe 97 PID 4204 wrote to memory of 1820 4204 pdjdv.exe 98 PID 1820 wrote to memory of 2240 1820 lfrfrff.exe 99 PID 2240 wrote to memory of 452 2240 hthbbb.exe 100 PID 452 wrote to memory of 2292 452 jpjdv.exe 101 PID 2292 wrote to memory of 4372 2292 vjdvv.exe 102 PID 4372 wrote to memory of 1472 4372 hnntnh.exe 103 PID 1472 wrote to memory of 3520 1472 nntnhh.exe 104 PID 3520 wrote to memory of 2220 3520 dpvdp.exe 105 PID 2220 wrote to memory of 2820 2220 rrfxlfx.exe 106 PID 2820 wrote to memory of 4636 2820 1bthbb.exe 107 PID 4636 wrote to memory of 2776 4636 jvdvv.exe 108 PID 2776 wrote to memory of 5040 2776 pjdpv.exe 109 PID 5040 wrote to memory of 4500 5040 pddvj.exe 110 PID 4500 wrote to memory of 1680 4500 fllxlxl.exe 111 PID 1680 wrote to memory of 2996 1680 jjdvp.exe 112 PID 2996 wrote to memory of 4008 2996 7bbtnn.exe 113 PID 4008 wrote to memory of 3176 4008 jdvpd.exe 114 PID 3176 wrote to memory of 2040 3176 1ffrrxr.exe 115 PID 2040 wrote to memory of 1948 2040 1bhhnt.exe 116 PID 1948 wrote to memory of 3004 1948 jjdvv.exe 117 PID 3004 wrote to memory of 1728 3004 xlfxxxr.exe 118 PID 1728 wrote to memory of 4492 1728 nhhhbb.exe 119 PID 4492 wrote to memory of 3220 4492 nnbbhn.exe 120 PID 3220 wrote to memory of 1812 3220 jjdjv.exe 121 PID 1812 wrote to memory of 2348 1812 7vvpp.exe 122 PID 2348 wrote to memory of 3944 2348 rllxxrl.exe 123 PID 3944 wrote to memory of 3108 3944 vpjdd.exe 124 PID 3108 wrote to memory of 2676 3108 ttnthb.exe 125 PID 2676 wrote to memory of 3716 2676 vpjpj.exe 126 PID 3716 wrote to memory of 2596 3716 xxrlrlx.exe 127 PID 2596 wrote to memory of 2004 2596 jjvpj.exe 128 PID 2004 wrote to memory of 4084 2004 7hhtbb.exe 129 PID 4084 wrote to memory of 3964 4084 pjvpj.exe 130 PID 3964 wrote to memory of 4196 3964 tttntt.exe 131 PID 4196 wrote to memory of 2276 4196 jvpjv.exe 132 PID 2276 wrote to memory of 2504 2276 xlrlrxr.exe 133 PID 2504 wrote to memory of 4220 2504 flfxlfr.exe 134 PID 4220 wrote to memory of 1872 4220 dpjvj.exe 135 PID 1872 wrote to memory of 4532 1872 bbhbtn.exe 136 PID 4532 wrote to memory of 4316 4532 jppjd.exe 137 PID 4316 wrote to memory of 3616 4316 1xllfff.exe 138 PID 3616 wrote to memory of 3092 3616 vvvjd.exe 139 PID 3092 wrote to memory of 1536 3092 rflfxff.exe 140 PID 1536 wrote to memory of 776 1536 rfllllx.exe 141 PID 776 wrote to memory of 2352 776 nhbtbb.exe 142 PID 2352 wrote to memory of 916 2352 5hhbtn.exe 143 PID 916 wrote to memory of 3036 916 dppjd.exe 144 PID 3036 wrote to memory of 3464 3036 ddvjd.exe 145
Processes
-
C:\Users\Admin\AppData\Local\Temp\25f1077386fc88a2bea615ff7ba70318d6e39af2f0309f8bfdff747e16a216fc.exe"C:\Users\Admin\AppData\Local\Temp\25f1077386fc88a2bea615ff7ba70318d6e39af2f0309f8bfdff747e16a216fc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\vvppj.exec:\vvppj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\ffrrrxx.exec:\ffrrrxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\dpjdd.exec:\dpjdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\vjjdp.exec:\vjjdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\vvdjd.exec:\vvdjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
\??\c:\bhhbnn.exec:\bhhbnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\pvvvv.exec:\pvvvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\pddvp.exec:\pddvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\rfxlfxl.exec:\rfxlfxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\nnnbbt.exec:\nnnbbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
\??\c:\5jpjd.exec:\5jpjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\xlfffxf.exec:\xlfffxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\bthnhn.exec:\bthnhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\bhbthb.exec:\bhbthb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\vpdvd.exec:\vpdvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\pdjdv.exec:\pdjdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
\??\c:\lfrfrff.exec:\lfrfrff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\hthbbb.exec:\hthbbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\jpjdv.exec:\jpjdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\vjdvv.exec:\vjdvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\hnntnh.exec:\hnntnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\nntnhh.exec:\nntnhh.exe23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\dpvdp.exec:\dpvdp.exe24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\rrfxlfx.exec:\rrfxlfx.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\1bthbb.exec:\1bthbb.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\jvdvv.exec:\jvdvv.exe27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\pjdpv.exec:\pjdpv.exe28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\pddvj.exec:\pddvj.exe29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\fllxlxl.exec:\fllxlxl.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\jjdvp.exec:\jjdvp.exe31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\7bbtnn.exec:\7bbtnn.exe32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\jdvpd.exec:\jdvpd.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\1ffrrxr.exec:\1ffrrxr.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\1bhhnt.exec:\1bhhnt.exe35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\jjdvv.exec:\jjdvv.exe36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\xlfxxxr.exec:\xlfxxxr.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\nhhhbb.exec:\nhhhbb.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\nnbbhn.exec:\nnbbhn.exe39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\jjdjv.exec:\jjdjv.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\7vvpp.exec:\7vvpp.exe41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\rllxxrl.exec:\rllxxrl.exe42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\vpjdd.exec:\vpjdd.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\ttnthb.exec:\ttnthb.exe44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\vpjpj.exec:\vpjpj.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\xxrlrlx.exec:\xxrlrlx.exe46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\jjvpj.exec:\jjvpj.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\7hhtbb.exec:\7hhtbb.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\pjvpj.exec:\pjvpj.exe49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\tttntt.exec:\tttntt.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\jvpjv.exec:\jvpjv.exe51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
\??\c:\xlrlrxr.exec:\xlrlrxr.exe52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\flfxlfr.exec:\flfxlfr.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\dpjvj.exec:\dpjvj.exe54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\bbhbtn.exec:\bbhbtn.exe55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\jppjd.exec:\jppjd.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\1xllfff.exec:\1xllfff.exe57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\vvvjd.exec:\vvvjd.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\rflfxff.exec:\rflfxff.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\rfllllx.exec:\rfllllx.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\nhbtbb.exec:\nhbtbb.exe61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\5hhbtn.exec:\5hhbtn.exe62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\dppjd.exec:\dppjd.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
\??\c:\ddvjd.exec:\ddvjd.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\tthbbb.exec:\tthbbb.exe65⤵
- Executes dropped EXE
PID:3464 -
\??\c:\rxxxxff.exec:\rxxxxff.exe66⤵PID:4980
-
\??\c:\bttnnb.exec:\bttnnb.exe67⤵PID:1076
-
\??\c:\7vppj.exec:\7vppj.exe68⤵PID:732
-
\??\c:\lrflllf.exec:\lrflllf.exe69⤵PID:1364
-
\??\c:\tnhhhh.exec:\tnhhhh.exe70⤵PID:488
-
\??\c:\vvdvd.exec:\vvdvd.exe71⤵PID:4104
-
\??\c:\rlrllrf.exec:\rlrllrf.exe72⤵PID:2780
-
\??\c:\thhbnh.exec:\thhbnh.exe73⤵PID:3936
-
\??\c:\pdddv.exec:\pdddv.exe74⤵PID:1664
-
\??\c:\3rlffff.exec:\3rlffff.exe75⤵PID:2904
-
\??\c:\tnnnhh.exec:\tnnnhh.exe76⤵PID:3928
-
\??\c:\9llfrrx.exec:\9llfrrx.exe77⤵PID:3900
-
\??\c:\tthbbh.exec:\tthbbh.exe78⤵PID:1976
-
\??\c:\vppjj.exec:\vppjj.exe79⤵
- System Location Discovery: System Language Discovery
PID:2000 -
\??\c:\fllfflr.exec:\fllfflr.exe80⤵PID:3484
-
\??\c:\nbbbbb.exec:\nbbbbb.exe81⤵PID:4420
-
\??\c:\pdvpv.exec:\pdvpv.exe82⤵PID:4668
-
\??\c:\xrrlxxr.exec:\xrrlxxr.exe83⤵PID:1772
-
\??\c:\5jjdv.exec:\5jjdv.exe84⤵PID:1896
-
\??\c:\xxfxxll.exec:\xxfxxll.exe85⤵PID:3452
-
\??\c:\5hhbtt.exec:\5hhbtt.exe86⤵PID:4284
-
\??\c:\jvvpj.exec:\jvvpj.exe87⤵PID:2684
-
\??\c:\3lrfrfl.exec:\3lrfrfl.exe88⤵PID:644
-
\??\c:\pdpvd.exec:\pdpvd.exe89⤵PID:3304
-
\??\c:\jvvpj.exec:\jvvpj.exe90⤵PID:5012
-
\??\c:\lffxflf.exec:\lffxflf.exe91⤵PID:1776
-
\??\c:\nhtnnn.exec:\nhtnnn.exe92⤵PID:3728
-
\??\c:\vjjjv.exec:\vjjjv.exe93⤵PID:1264
-
\??\c:\pjjdp.exec:\pjjdp.exe94⤵PID:5024
-
\??\c:\lrrlxrl.exec:\lrrlxrl.exe95⤵PID:4716
-
\??\c:\9jppj.exec:\9jppj.exe96⤵PID:4664
-
\??\c:\xxrrflx.exec:\xxrrflx.exe97⤵PID:3612
-
\??\c:\xllfxxl.exec:\xllfxxl.exe98⤵PID:876
-
\??\c:\tnbnnh.exec:\tnbnnh.exe99⤵PID:1016
-
\??\c:\xxfxrff.exec:\xxfxrff.exe100⤵PID:3508
-
\??\c:\nhbtbt.exec:\nhbtbt.exe101⤵PID:2960
-
\??\c:\dddvj.exec:\dddvj.exe102⤵PID:2648
-
\??\c:\3xfrxlx.exec:\3xfrxlx.exe103⤵PID:1884
-
\??\c:\bbbbbh.exec:\bbbbbh.exe104⤵
- System Location Discovery: System Language Discovery
PID:4272 -
\??\c:\3dppj.exec:\3dppj.exe105⤵PID:3352
-
\??\c:\xxlfllf.exec:\xxlfllf.exe106⤵PID:4292
-
\??\c:\dvvpj.exec:\dvvpj.exe107⤵PID:2620
-
\??\c:\xllrlxr.exec:\xllrlxr.exe108⤵PID:4856
-
\??\c:\btttnh.exec:\btttnh.exe109⤵PID:4152
-
\??\c:\frrlflx.exec:\frrlflx.exe110⤵PID:3740
-
\??\c:\nhbthb.exec:\nhbthb.exe111⤵PID:4380
-
\??\c:\vdvpj.exec:\vdvpj.exe112⤵PID:1120
-
\??\c:\bthtnn.exec:\bthtnn.exe113⤵PID:656
-
\??\c:\pjvpj.exec:\pjvpj.exe114⤵PID:752
-
\??\c:\fxxxllf.exec:\fxxxllf.exe115⤵PID:2796
-
\??\c:\fxflffr.exec:\fxflffr.exe116⤵PID:4184
-
\??\c:\1pdvv.exec:\1pdvv.exe117⤵PID:2800
-
\??\c:\xlrrlrl.exec:\xlrrlrl.exe118⤵PID:3440
-
\??\c:\htttnn.exec:\htttnn.exe119⤵PID:1064
-
\??\c:\vpppj.exec:\vpppj.exe120⤵PID:4300
-
\??\c:\fxrxflf.exec:\fxrxflf.exe121⤵PID:4940
-
\??\c:\xrlfxrl.exec:\xrlfxrl.exe122⤵PID:1596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-