Analysis
- max time kernel
144s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/09/2026, 12:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7e732c1282abb19e47c021965f10328298ed75e1329b96a8c3adb2892c76b63c.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
General
- Target 7e732c1282abb19e47c021965f10328298ed75e1329b96a8c3adb2892c76b63c.exe
- Size 85KB
- Sample260916-pps39svs2n
- SHA256 7e732c1282abb19e47c021965f10328298ed75e1329b96a8c3adb2892c76b63c
- MD5 326ce26f8c26055175151ba26ea4911a
- SHA1 91aa533663ff90792c0dddc114497eba1c65102c
- SHA512 1a5dc1dc6ffa80cbb9a39d2d59c29124b5244cd549d5d9a9fabc01839b07fb1ca958e57d819d69c5526db3eff0141fd542f2db9d47b5eaa1ddf25d5f01dd6157
- SSDEEP 1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlNJiRXDKFjI+pZX:0cdpeeBSHHMHLf9RyIEQ5KXZX
- TLSH T152837DB21B7DB1A7EBB0E43146A91074245AA237D8CA19F541F623881F3DD919EC2C7F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3116 rxlrxlf.exe 4952 bnbthb.exe 2580 vdvpp.exe 540 lllllrr.exe 1804 htbbbt.exe 3296 vdvvj.exe 2824 hhnhbb.exe 4540 jpjvj.exe 3752 vjjdv.exe 5036 lfrrllr.exe 2596 nbbtnn.exe 1056 bbthtn.exe 3880 pjdvp.exe 2896 xfxfrrl.exe 864 hbnhhb.exe 4416 nbttnn.exe 628 jjpvv.exe 4656 pdvjj.exe 2060 dpvvv.exe 1408 lllfxfr.exe 892 frfrxlx.exe 1512 ddpjp.exe 2728 rxxllxx.exe 4632 tntnnn.exe 4912 nhtntn.exe 2420 lflfflf.exe 2764 tnnhbt.exe 1140 llflfxx.exe 3180 dvjdp.exe 4844 djppj.exe 980 lxfxfff.exe 4840 tnhbhh.exe 3416 xfllllf.exe 2736 nnttnt.exe 2708 jjdvv.exe 2616 rlfrllx.exe 2712 rllllrr.exe 2512 jjdjp.exe 4296 rrxrrxr.exe 3812 rrrrllr.exe 4908 httnhh.exe 4108 vvppp.exe 2336 7flfxxr.exe 4544 rrrrxff.exe 4140 dvddv.exe 4600 1bbnhb.exe 764 hnbbnn.exe 2780 vppdv.exe 4396 9djdp.exe 4984 rfrfxrl.exe 2088 rflfxrr.exe 312 bthbtt.exe 3364 nhttnn.exe 4532 5lrlffx.exe 5084 nhnhhh.exe 508 ddddj.exe 636 tnbtbt.exe 4312 dvvpd.exe 2604 pjjdp.exe 3964 xxrfxll.exe 2188 ppddv.exe 1796 jddvd.exe 4744 btttbn.exe 2176 vvppd.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5djdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 612 wrote to memory of 3116 612 7e732c1282abb19e47c021965f10328298ed75e1329b96a8c3adb2892c76b63c.exe 82 PID 3116 wrote to memory of 4952 3116 rxlrxlf.exe 83 PID 4952 wrote to memory of 2580 4952 bnbthb.exe 84 PID 2580 wrote to memory of 540 2580 vdvpp.exe 85 PID 540 wrote to memory of 1804 540 lllllrr.exe 86 PID 1804 wrote to memory of 3296 1804 htbbbt.exe 87 PID 3296 wrote to memory of 2824 3296 vdvvj.exe 88 PID 2824 wrote to memory of 4540 2824 hhnhbb.exe 89 PID 4540 wrote to memory of 3752 4540 jpjvj.exe 90 PID 3752 wrote to memory of 5036 3752 vjjdv.exe 91 PID 5036 wrote to memory of 2596 5036 lfrrllr.exe 92 PID 2596 wrote to memory of 1056 2596 nbbtnn.exe 93 PID 1056 wrote to memory of 3880 1056 bbthtn.exe 94 PID 3880 wrote to memory of 2896 3880 pjdvp.exe 95 PID 2896 wrote to memory of 864 2896 xfxfrrl.exe 96 PID 864 wrote to memory of 4416 864 hbnhhb.exe 97 PID 4416 wrote to memory of 628 4416 nbttnn.exe 98 PID 628 wrote to memory of 4656 628 jjpvv.exe 99 PID 4656 wrote to memory of 2060 4656 pdvjj.exe 100 PID 2060 wrote to memory of 1408 2060 dpvvv.exe 101 PID 1408 wrote to memory of 892 1408 lllfxfr.exe 102 PID 892 wrote to memory of 1512 892 frfrxlx.exe 103 PID 1512 wrote to memory of 2728 1512 ddpjp.exe 104 PID 2728 wrote to memory of 4632 2728 rxxllxx.exe 105 PID 4632 wrote to memory of 4912 4632 tntnnn.exe 106 PID 4912 wrote to memory of 2420 4912 nhtntn.exe 107 PID 2420 wrote to memory of 2764 2420 lflfflf.exe 108 PID 2764 wrote to memory of 1140 2764 tnnhbt.exe 109 PID 1140 wrote to memory of 3180 1140 llflfxx.exe 110 PID 3180 wrote to memory of 4844 3180 dvjdp.exe 111 PID 4844 wrote to memory of 980 4844 djppj.exe 112 PID 980 wrote to memory of 4840 980 lxfxfff.exe 113 PID 4840 wrote to memory of 3416 4840 tnhbhh.exe 114 PID 3416 wrote to memory of 2736 3416 xfllllf.exe 115 PID 2736 wrote to memory of 2708 2736 nnttnt.exe 116 PID 2708 wrote to memory of 2616 2708 jjdvv.exe 117 PID 2616 wrote to memory of 2712 2616 rlfrllx.exe 118 PID 2712 wrote to memory of 2512 2712 rllllrr.exe 119 PID 2512 wrote to memory of 4296 2512 jjdjp.exe 120 PID 4296 wrote to memory of 3812 4296 rrxrrxr.exe 121 PID 3812 wrote to memory of 4908 3812 rrrrllr.exe 122 PID 4908 wrote to memory of 4108 4908 httnhh.exe 123 PID 4108 wrote to memory of 2336 4108 vvppp.exe 124 PID 2336 wrote to memory of 4544 2336 7flfxxr.exe 125 PID 4544 wrote to memory of 4140 4544 rrrrxff.exe 126 PID 4140 wrote to memory of 4600 4140 dvddv.exe 127 PID 4600 wrote to memory of 764 4600 1bbnhb.exe 128 PID 764 wrote to memory of 2780 764 hnbbnn.exe 129 PID 2780 wrote to memory of 4396 2780 vppdv.exe 130 PID 4396 wrote to memory of 4984 4396 9djdp.exe 131 PID 4984 wrote to memory of 2088 4984 rfrfxrl.exe 132 PID 2088 wrote to memory of 312 2088 rflfxrr.exe 133 PID 312 wrote to memory of 3364 312 bthbtt.exe 134 PID 3364 wrote to memory of 4532 3364 nhttnn.exe 135 PID 4532 wrote to memory of 5084 4532 5lrlffx.exe 136 PID 5084 wrote to memory of 508 5084 nhnhhh.exe 137 PID 508 wrote to memory of 636 508 ddddj.exe 138 PID 636 wrote to memory of 4312 636 tnbtbt.exe 139 PID 4312 wrote to memory of 2604 4312 dvvpd.exe 140 PID 2604 wrote to memory of 3964 2604 pjjdp.exe 141 PID 3964 wrote to memory of 2188 3964 xxrfxll.exe 142 PID 2188 wrote to memory of 1796 2188 ppddv.exe 143 PID 1796 wrote to memory of 4744 1796 jddvd.exe 144 PID 4744 wrote to memory of 2176 4744 btttbn.exe 145
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e732c1282abb19e47c021965f10328298ed75e1329b96a8c3adb2892c76b63c.exe"C:\Users\Admin\AppData\Local\Temp\7e732c1282abb19e47c021965f10328298ed75e1329b96a8c3adb2892c76b63c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:612 -
\??\c:\rxlrxlf.exec:\rxlrxlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\bnbthb.exec:\bnbthb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\vdvpp.exec:\vdvpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\lllllrr.exec:\lllllrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\htbbbt.exec:\htbbbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\vdvvj.exec:\vdvvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
\??\c:\hhnhbb.exec:\hhnhbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\jpjvj.exec:\jpjvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\vjjdv.exec:\vjjdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\lfrrllr.exec:\lfrrllr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\nbbtnn.exec:\nbbtnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\bbthtn.exec:\bbthtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\pjdvp.exec:\pjdvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\xfxfrrl.exec:\xfxfrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\hbnhhb.exec:\hbnhhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\nbttnn.exec:\nbttnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\jjpvv.exec:\jjpvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\pdvjj.exec:\pdvjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\dpvvv.exec:\dpvvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\lllfxfr.exec:\lllfxfr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\frfrxlx.exec:\frfrxlx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
\??\c:\ddpjp.exec:\ddpjp.exe23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\rxxllxx.exec:\rxxllxx.exe24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\tntnnn.exec:\tntnnn.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\nhtntn.exec:\nhtntn.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\lflfflf.exec:\lflfflf.exe27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\tnnhbt.exec:\tnnhbt.exe28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\llflfxx.exec:\llflfxx.exe29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
\??\c:\dvjdp.exec:\dvjdp.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
\??\c:\djppj.exec:\djppj.exe31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\lxfxfff.exec:\lxfxfff.exe32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\tnhbhh.exec:\tnhbhh.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\xfllllf.exec:\xfllllf.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
\??\c:\nnttnt.exec:\nnttnt.exe35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\jjdvv.exec:\jjdvv.exe36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\rlfrllx.exec:\rlfrllx.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\rllllrr.exec:\rllllrr.exe38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\jjdjp.exec:\jjdjp.exe39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\rrxrrxr.exec:\rrxrrxr.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\rrrrllr.exec:\rrrrllr.exe41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\httnhh.exec:\httnhh.exe42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\vvppp.exec:\vvppp.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
\??\c:\7flfxxr.exec:\7flfxxr.exe44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\rrrrxff.exec:\rrrrxff.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\dvddv.exec:\dvddv.exe46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\1bbnhb.exec:\1bbnhb.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\hnbbnn.exec:\hnbbnn.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\vppdv.exec:\vppdv.exe49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\9djdp.exec:\9djdp.exe50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\rfrfxrl.exec:\rfrfxrl.exe51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\rflfxrr.exec:\rflfxrr.exe52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\bthbtt.exec:\bthbtt.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312 -
\??\c:\nhttnn.exec:\nhttnn.exe54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
\??\c:\5lrlffx.exec:\5lrlffx.exe55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\nhnhhh.exec:\nhnhhh.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\ddddj.exec:\ddddj.exe57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:508 -
\??\c:\tnbtbt.exec:\tnbtbt.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\dvvpd.exec:\dvvpd.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\pjjdp.exec:\pjjdp.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\xxrfxll.exec:\xxrfxll.exe61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\ppddv.exec:\ppddv.exe62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\jddvd.exec:\jddvd.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\btttbn.exec:\btttbn.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\vvppd.exec:\vvppd.exe65⤵
- Executes dropped EXE
PID:2176 -
\??\c:\lrfrxlx.exec:\lrfrxlx.exe66⤵PID:2260
-
\??\c:\nthbnn.exec:\nthbnn.exe67⤵PID:3032
-
\??\c:\9ffxrxr.exec:\9ffxrxr.exe68⤵PID:3868
-
\??\c:\9hhntt.exec:\9hhntt.exe69⤵PID:2808
-
\??\c:\llllffx.exec:\llllffx.exe70⤵PID:4244
-
\??\c:\bnbbhh.exec:\bnbbhh.exe71⤵PID:1264
-
\??\c:\jpdpj.exec:\jpdpj.exe72⤵PID:3336
-
\??\c:\rxlrfxx.exec:\rxlrfxx.exe73⤵PID:4940
-
\??\c:\5nhnbb.exec:\5nhnbb.exe74⤵PID:5044
-
\??\c:\1pvpj.exec:\1pvpj.exe75⤵PID:1640
-
\??\c:\7llfxfx.exec:\7llfxfx.exe76⤵PID:1164
-
\??\c:\jpvpv.exec:\jpvpv.exe77⤵PID:4696
-
\??\c:\htnthn.exec:\htnthn.exe78⤵PID:3884
-
\??\c:\nbbttb.exec:\nbbttb.exe79⤵PID:4796
-
\??\c:\jjpjd.exec:\jjpjd.exe80⤵PID:3988
-
\??\c:\tnhhbb.exec:\tnhhbb.exe81⤵PID:4788
-
\??\c:\vdvpd.exec:\vdvpd.exe82⤵PID:4000
-
\??\c:\7llrllf.exec:\7llrllf.exe83⤵PID:4348
-
\??\c:\pppjd.exec:\pppjd.exe84⤵PID:544
-
\??\c:\fxfxxxf.exec:\fxfxxxf.exe85⤵PID:640
-
\??\c:\vpdvj.exec:\vpdvj.exe86⤵PID:4496
-
\??\c:\ntbtth.exec:\ntbtth.exe87⤵PID:1020
-
\??\c:\rfxrrlf.exec:\rfxrrlf.exe88⤵PID:4616
-
\??\c:\pdpvd.exec:\pdpvd.exe89⤵PID:4672
-
\??\c:\xfrrrrr.exec:\xfrrrrr.exe90⤵PID:5016
-
\??\c:\tbttht.exec:\tbttht.exe91⤵PID:2388
-
\??\c:\vddpd.exec:\vddpd.exe92⤵PID:4344
-
\??\c:\thhhhh.exec:\thhhhh.exe93⤵PID:1644
-
\??\c:\nnnnnn.exec:\nnnnnn.exe94⤵PID:624
-
\??\c:\tbbttb.exec:\tbbttb.exe95⤵PID:4556
-
\??\c:\dpvpv.exec:\dpvpv.exe96⤵PID:3340
-
\??\c:\ddvjd.exec:\ddvjd.exe97⤵PID:1192
-
\??\c:\xxxxrrr.exec:\xxxxrrr.exe98⤵PID:3428
-
\??\c:\hthhhh.exec:\hthhhh.exe99⤵PID:2080
-
\??\c:\bhhbtn.exec:\bhhbtn.exe100⤵PID:2900
-
\??\c:\dvdvp.exec:\dvdvp.exe101⤵PID:4716
-
\??\c:\bnhhbb.exec:\bnhhbb.exe102⤵PID:2492
-
\??\c:\tbtnbt.exec:\tbtnbt.exe103⤵PID:1716
-
\??\c:\ppjjj.exec:\ppjjj.exe104⤵PID:4580
-
\??\c:\ppvpd.exec:\ppvpd.exe105⤵PID:3436
-
\??\c:\hnbhbn.exec:\hnbhbn.exe106⤵PID:2848
-
\??\c:\dddvj.exec:\dddvj.exe107⤵PID:2480
-
\??\c:\fllfxxl.exec:\fllfxxl.exe108⤵PID:3996
-
\??\c:\lflfxrr.exec:\lflfxrr.exe109⤵PID:1468
-
\??\c:\ntbntt.exec:\ntbntt.exe110⤵PID:932
-
\??\c:\xxrlllr.exec:\xxrlllr.exe111⤵PID:4240
-
\??\c:\pppjv.exec:\pppjv.exe112⤵PID:3524
-
\??\c:\tthbtb.exec:\tthbtb.exe113⤵PID:64
-
\??\c:\ddddd.exec:\ddddd.exe114⤵PID:2672
-
\??\c:\bbhbtt.exec:\bbhbtt.exe115⤵PID:3864
-
\??\c:\jvjvj.exec:\jvjvj.exe116⤵PID:4536
-
\??\c:\pddvj.exec:\pddvj.exe117⤵PID:1088
-
\??\c:\nnbtbb.exec:\nnbtbb.exe118⤵PID:2500
-
\??\c:\jjddp.exec:\jjddp.exe119⤵PID:1212
-
\??\c:\dpdpj.exec:\dpdpj.exe120⤵PID:2428
-
\??\c:\ddvpd.exec:\ddvpd.exe121⤵PID:1768
-
\??\c:\rffflrf.exec:\rffflrf.exe122⤵PID:1412
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-