Analysis
- max time kernel
120s - max time network
16s - platform
windows7_x64 - resource
win7-20240729-en - resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system - submitted
09/01/2025, 03:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
190c20a5e61f0534f9948c4dc79f8ec82099262c580f62fda795296f25d22c1e.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
120 seconds
General
- Target 190c20a5e61f0534f9948c4dc79f8ec82099262c580f62fda795296f25d22c1e.exe
- Size 454KB
- Sample250109-eghbpazlbm
- SHA256 190c20a5e61f0534f9948c4dc79f8ec82099262c580f62fda795296f25d22c1e
- MD5 79cbda6a4f3a58d3372276cb1f59f5bf
- SHA1 fbb762f176a54f5e605d8cb0757c9fe7513ef277
- SHA512 f0dd647aa63492e6b6fdfaa8ad353acc7ae3a0a32dcc1f7608fa7728b9e60a58f453354601322a005213104564469614b3241f89f36ab87040f6a3533fe9df19
- SSDEEP 6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbem:q7Tc2NYHUrAwfMp3CDm
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Blackmoon family
- Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2652-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1456-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-151-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2404-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1084-133-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1672-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-115-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/916-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1808-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1076-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1556-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1328-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/344-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1452-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-367-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/1620-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/572-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/952-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-487-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1864-542-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-541-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/344-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/612-618-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2708-628-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-642-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1108-722-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2224-731-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 1796 llrlrlr.exe 2796 thnhht.exe 2896 dvjpd.exe 2696 flxlrxx.exe 2932 1hbbhh.exe 1808 dvdpv.exe 2688 5xrflrx.exe 1700 bbtbnt.exe 1456 pjvdj.exe 1612 5xrxlxl.exe 2432 ttntbh.exe 1672 vjvpp.exe 2032 3xlllrl.exe 1084 vpdjv.exe 3004 lxfllrx.exe 316 htthbh.exe 3040 vvjpv.exe 2404 fxffllx.exe 2112 fxxfrfx.exe 2020 thtttb.exe 2216 pvvdd.exe 916 9lrxxxf.exe 1076 hbhnbh.exe 1052 xlrxllx.exe 1556 jppvd.exe 2616 frxfrfr.exe 1328 vjvjv.exe 1680 9ththt.exe 2456 xxfrrfr.exe 2460 hhtbht.exe 344 lxfrrrx.exe 2596 hbtbth.exe 2976 ddpdv.exe 2916 bhbhnh.exe 2820 fxfxxff.exe 2252 hthtnb.exe 2552 vpvvv.exe 2852 xllxrrl.exe 2864 hhbnht.exe 2704 pvdjp.exe 2892 5fxxrxf.exe 1452 nthhnh.exe 1600 jjjdp.exe 1608 rxlfrrr.exe 2712 tnttbb.exe 2060 dvpdd.exe 1616 flrrrrx.exe 1620 xxlrffr.exe 2032 ntbtht.exe 572 jdvpv.exe 2532 rrlrlrf.exe 2908 7nbhnb.exe 1868 jjppj.exe 2264 9lfrrlf.exe 3040 xrrlxlf.exe 2096 hhbbnb.exe 2164 ddpdp.exe 1224 flxfrfx.exe 2216 5hhbnh.exe 2360 dppjj.exe 952 jvjvd.exe 1780 thbhtb.exe 2576 pvdjd.exe 832 jppdp.exe -
resource yara_rule behavioral1/memory/2652-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/916-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-259-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/2456-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/344-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-296-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/2852-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1452-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/952-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/344-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-599-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2860-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-675-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-786-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-842-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-861-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-928-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1452-938-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-969-0x0000000000400000-0x000000000042A000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxllrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lfrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tttbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxllfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2652 wrote to memory of 1796 2652 190c20a5e61f0534f9948c4dc79f8ec82099262c580f62fda795296f25d22c1e.exe 30 PID 2652 wrote to memory of 1796 2652 190c20a5e61f0534f9948c4dc79f8ec82099262c580f62fda795296f25d22c1e.exe 30 PID 2652 wrote to memory of 1796 2652 190c20a5e61f0534f9948c4dc79f8ec82099262c580f62fda795296f25d22c1e.exe 30 PID 2652 wrote to memory of 1796 2652 190c20a5e61f0534f9948c4dc79f8ec82099262c580f62fda795296f25d22c1e.exe 30 PID 1796 wrote to memory of 2796 1796 llrlrlr.exe 31 PID 1796 wrote to memory of 2796 1796 llrlrlr.exe 31 PID 1796 wrote to memory of 2796 1796 llrlrlr.exe 31 PID 1796 wrote to memory of 2796 1796 llrlrlr.exe 31 PID 2796 wrote to memory of 2896 2796 thnhht.exe 32 PID 2796 wrote to memory of 2896 2796 thnhht.exe 32 PID 2796 wrote to memory of 2896 2796 thnhht.exe 32 PID 2796 wrote to memory of 2896 2796 thnhht.exe 32 PID 2896 wrote to memory of 2696 2896 dvjpd.exe 33 PID 2896 wrote to memory of 2696 2896 dvjpd.exe 33 PID 2896 wrote to memory of 2696 2896 dvjpd.exe 33 PID 2896 wrote to memory of 2696 2896 dvjpd.exe 33 PID 2696 wrote to memory of 2932 2696 flxlrxx.exe 34 PID 2696 wrote to memory of 2932 2696 flxlrxx.exe 34 PID 2696 wrote to memory of 2932 2696 flxlrxx.exe 34 PID 2696 wrote to memory of 2932 2696 flxlrxx.exe 34 PID 2932 wrote to memory of 1808 2932 1hbbhh.exe 35 PID 2932 wrote to memory of 1808 2932 1hbbhh.exe 35 PID 2932 wrote to memory of 1808 2932 1hbbhh.exe 35 PID 2932 wrote to memory of 1808 2932 1hbbhh.exe 35 PID 1808 wrote to memory of 2688 1808 dvdpv.exe 36 PID 1808 wrote to memory of 2688 1808 dvdpv.exe 36 PID 1808 wrote to memory of 2688 1808 dvdpv.exe 36 PID 1808 wrote to memory of 2688 1808 dvdpv.exe 36 PID 2688 wrote to memory of 1700 2688 5xrflrx.exe 37 PID 2688 wrote to memory of 1700 2688 5xrflrx.exe 37 PID 2688 wrote to memory of 1700 2688 5xrflrx.exe 37 PID 2688 wrote to memory of 1700 2688 5xrflrx.exe 37 PID 1700 wrote to memory of 1456 1700 bbtbnt.exe 38 PID 1700 wrote to memory of 1456 1700 bbtbnt.exe 38 PID 1700 wrote to memory of 1456 1700 bbtbnt.exe 38 PID 1700 wrote to memory of 1456 1700 bbtbnt.exe 38 PID 1456 wrote to memory of 1612 1456 pjvdj.exe 39 PID 1456 wrote to memory of 1612 1456 pjvdj.exe 39 PID 1456 wrote to memory of 1612 1456 pjvdj.exe 39 PID 1456 wrote to memory of 1612 1456 pjvdj.exe 39 PID 1612 wrote to memory of 2432 1612 5xrxlxl.exe 40 PID 1612 wrote to memory of 2432 1612 5xrxlxl.exe 40 PID 1612 wrote to memory of 2432 1612 5xrxlxl.exe 40 PID 1612 wrote to memory of 2432 1612 5xrxlxl.exe 40 PID 2432 wrote to memory of 1672 2432 ttntbh.exe 41 PID 2432 wrote to memory of 1672 2432 ttntbh.exe 41 PID 2432 wrote to memory of 1672 2432 ttntbh.exe 41 PID 2432 wrote to memory of 1672 2432 ttntbh.exe 41 PID 1672 wrote to memory of 2032 1672 vjvpp.exe 42 PID 1672 wrote to memory of 2032 1672 vjvpp.exe 42 PID 1672 wrote to memory of 2032 1672 vjvpp.exe 42 PID 1672 wrote to memory of 2032 1672 vjvpp.exe 42 PID 2032 wrote to memory of 1084 2032 3xlllrl.exe 43 PID 2032 wrote to memory of 1084 2032 3xlllrl.exe 43 PID 2032 wrote to memory of 1084 2032 3xlllrl.exe 43 PID 2032 wrote to memory of 1084 2032 3xlllrl.exe 43 PID 1084 wrote to memory of 3004 1084 vpdjv.exe 44 PID 1084 wrote to memory of 3004 1084 vpdjv.exe 44 PID 1084 wrote to memory of 3004 1084 vpdjv.exe 44 PID 1084 wrote to memory of 3004 1084 vpdjv.exe 44 PID 3004 wrote to memory of 316 3004 lxfllrx.exe 45 PID 3004 wrote to memory of 316 3004 lxfllrx.exe 45 PID 3004 wrote to memory of 316 3004 lxfllrx.exe 45 PID 3004 wrote to memory of 316 3004 lxfllrx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\190c20a5e61f0534f9948c4dc79f8ec82099262c580f62fda795296f25d22c1e.exe"C:\Users\Admin\AppData\Local\Temp\190c20a5e61f0534f9948c4dc79f8ec82099262c580f62fda795296f25d22c1e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\llrlrlr.exec:\llrlrlr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\thnhht.exec:\thnhht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\dvjpd.exec:\dvjpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\flxlrxx.exec:\flxlrxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\1hbbhh.exec:\1hbbhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\dvdpv.exec:\dvdpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\5xrflrx.exec:\5xrflrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\bbtbnt.exec:\bbtbnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\pjvdj.exec:\pjvdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\5xrxlxl.exec:\5xrxlxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\ttntbh.exec:\ttntbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\vjvpp.exec:\vjvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\3xlllrl.exec:\3xlllrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\vpdjv.exec:\vpdjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\lxfllrx.exec:\lxfllrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\htthbh.exec:\htthbh.exe17⤵
- Executes dropped EXE
PID:316 -
\??\c:\vvjpv.exec:\vvjpv.exe18⤵
- Executes dropped EXE
PID:3040 -
\??\c:\fxffllx.exec:\fxffllx.exe19⤵
- Executes dropped EXE
PID:2404 -
\??\c:\fxxfrfx.exec:\fxxfrfx.exe20⤵
- Executes dropped EXE
PID:2112 -
\??\c:\thtttb.exec:\thtttb.exe21⤵
- Executes dropped EXE
PID:2020 -
\??\c:\pvvdd.exec:\pvvdd.exe22⤵
- Executes dropped EXE
PID:2216 -
\??\c:\9lrxxxf.exec:\9lrxxxf.exe23⤵
- Executes dropped EXE
PID:916 -
\??\c:\hbhnbh.exec:\hbhnbh.exe24⤵
- Executes dropped EXE
PID:1076 -
\??\c:\xlrxllx.exec:\xlrxllx.exe25⤵
- Executes dropped EXE
PID:1052 -
\??\c:\jppvd.exec:\jppvd.exe26⤵
- Executes dropped EXE
PID:1556 -
\??\c:\frxfrfr.exec:\frxfrfr.exe27⤵
- Executes dropped EXE
PID:2616 -
\??\c:\vjvjv.exec:\vjvjv.exe28⤵
- Executes dropped EXE
PID:1328 -
\??\c:\9ththt.exec:\9ththt.exe29⤵
- Executes dropped EXE
PID:1680 -
\??\c:\xxfrrfr.exec:\xxfrrfr.exe30⤵
- Executes dropped EXE
PID:2456 -
\??\c:\hhtbht.exec:\hhtbht.exe31⤵
- Executes dropped EXE
PID:2460 -
\??\c:\lxfrrrx.exec:\lxfrrrx.exe32⤵
- Executes dropped EXE
PID:344 -
\??\c:\hbtbth.exec:\hbtbth.exe33⤵
- Executes dropped EXE
PID:2596 -
\??\c:\ddpdv.exec:\ddpdv.exe34⤵
- Executes dropped EXE
PID:2976 -
\??\c:\bhbhnh.exec:\bhbhnh.exe35⤵
- Executes dropped EXE
PID:2916 -
\??\c:\fxfxxff.exec:\fxfxxff.exe36⤵
- Executes dropped EXE
PID:2820 -
\??\c:\hthtnb.exec:\hthtnb.exe37⤵
- Executes dropped EXE
PID:2252 -
\??\c:\vpvvv.exec:\vpvvv.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2552 -
\??\c:\xllxrrl.exec:\xllxrrl.exe39⤵
- Executes dropped EXE
PID:2852 -
\??\c:\hhbnht.exec:\hhbnht.exe40⤵
- Executes dropped EXE
PID:2864 -
\??\c:\pvdjp.exec:\pvdjp.exe41⤵
- Executes dropped EXE
PID:2704 -
\??\c:\5fxxrxf.exec:\5fxxrxf.exe42⤵
- Executes dropped EXE
PID:2892 -
\??\c:\nthhnh.exec:\nthhnh.exe43⤵
- Executes dropped EXE
PID:1452 -
\??\c:\jjjdp.exec:\jjjdp.exe44⤵
- Executes dropped EXE
PID:1600 -
\??\c:\rxlfrrr.exec:\rxlfrrr.exe45⤵
- Executes dropped EXE
PID:1608 -
\??\c:\tnttbb.exec:\tnttbb.exe46⤵
- Executes dropped EXE
PID:2712 -
\??\c:\dvpdd.exec:\dvpdd.exe47⤵
- Executes dropped EXE
PID:2060 -
\??\c:\flrrrrx.exec:\flrrrrx.exe48⤵
- Executes dropped EXE
PID:1616 -
\??\c:\xxlrffr.exec:\xxlrffr.exe49⤵
- Executes dropped EXE
PID:1620 -
\??\c:\ntbtht.exec:\ntbtht.exe50⤵
- Executes dropped EXE
PID:2032 -
\??\c:\jdvpv.exec:\jdvpv.exe51⤵
- Executes dropped EXE
PID:572 -
\??\c:\rrlrlrf.exec:\rrlrlrf.exe52⤵
- Executes dropped EXE
PID:2532 -
\??\c:\7nbhnb.exec:\7nbhnb.exe53⤵
- Executes dropped EXE
PID:2908 -
\??\c:\jjppj.exec:\jjppj.exe54⤵
- Executes dropped EXE
PID:1868 -
\??\c:\9lfrrlf.exec:\9lfrrlf.exe55⤵
- Executes dropped EXE
PID:2264 -
\??\c:\xrrlxlf.exec:\xrrlxlf.exe56⤵
- Executes dropped EXE
PID:3040 -
\??\c:\hhbbnb.exec:\hhbbnb.exe57⤵
- Executes dropped EXE
PID:2096 -
\??\c:\ddpdp.exec:\ddpdp.exe58⤵
- Executes dropped EXE
PID:2164 -
\??\c:\flxfrfx.exec:\flxfrfx.exe59⤵
- Executes dropped EXE
PID:1224 -
\??\c:\5hhbnh.exec:\5hhbnh.exe60⤵
- Executes dropped EXE
PID:2216 -
\??\c:\dppjj.exec:\dppjj.exe61⤵
- Executes dropped EXE
PID:2360 -
\??\c:\jvjvd.exec:\jvjvd.exe62⤵
- Executes dropped EXE
PID:952 -
\??\c:\thbhtb.exec:\thbhtb.exe63⤵
- Executes dropped EXE
PID:1780 -
\??\c:\pvdjd.exec:\pvdjd.exe64⤵
- Executes dropped EXE
PID:2576 -
\??\c:\jppdp.exec:\jppdp.exe65⤵
- Executes dropped EXE
PID:832 -
\??\c:\rxlxlrf.exec:\rxlxlrf.exe66⤵PID:1632
-
\??\c:\1tbnth.exec:\1tbnth.exe67⤵PID:1052
-
\??\c:\jpddp.exec:\jpddp.exe68⤵PID:1556
-
\??\c:\rfxxrff.exec:\rfxxrff.exe69⤵PID:2208
-
\??\c:\1xrfxxr.exec:\1xrfxxr.exe70⤵PID:1652
-
\??\c:\tntnnh.exec:\tntnnh.exe71⤵PID:1864
-
\??\c:\jvjdd.exec:\jvjdd.exe72⤵PID:2572
-
\??\c:\ffflxlx.exec:\ffflxlx.exe73⤵PID:2152
-
\??\c:\bbhhbn.exec:\bbhhbn.exe74⤵PID:2524
-
\??\c:\3vpvj.exec:\3vpvj.exe75⤵PID:344
-
\??\c:\vvvjd.exec:\vvvjd.exe76⤵PID:900
-
\??\c:\xxlrflx.exec:\xxlrflx.exe77⤵PID:2644
-
\??\c:\5btthn.exec:\5btthn.exe78⤵PID:2976
-
\??\c:\ddppv.exec:\ddppv.exe79⤵PID:612
-
\??\c:\rxfrflf.exec:\rxfrflf.exe80⤵PID:3060
-
\??\c:\tttbbb.exec:\tttbbb.exe81⤵PID:2452
-
\??\c:\vddvp.exec:\vddvp.exe82⤵PID:2828
-
\??\c:\vpjjv.exec:\vpjjv.exe83⤵PID:2860
-
\??\c:\bhtbnt.exec:\bhtbnt.exe84⤵PID:2708
-
\??\c:\nnbhnt.exec:\nnbhnt.exe85⤵PID:2872
-
\??\c:\ppdpp.exec:\ppdpp.exe86⤵PID:1348
-
\??\c:\9xflrll.exec:\9xflrll.exe87⤵PID:1344
-
\??\c:\rrfrflf.exec:\rrfrflf.exe88⤵PID:2192
-
\??\c:\btbhnb.exec:\btbhnb.exe89⤵PID:1160
-
\??\c:\pvjpv.exec:\pvjpv.exe90⤵PID:2012
-
\??\c:\lfxlxll.exec:\lfxlxll.exe91⤵PID:1996
-
\??\c:\hhntbh.exec:\hhntbh.exe92⤵PID:2804
-
\??\c:\pvppv.exec:\pvppv.exe93⤵PID:2676
-
\??\c:\djdjd.exec:\djdjd.exe94⤵PID:2956
-
\??\c:\lrffxfr.exec:\lrffxfr.exe95⤵PID:1724
-
\??\c:\5tttbn.exec:\5tttbn.exe96⤵
- System Location Discovery: System Language Discovery
PID:2052 -
\??\c:\5pjjv.exec:\5pjjv.exe97⤵PID:1108
-
\??\c:\lllrlrf.exec:\lllrlrf.exe98⤵PID:2384
-
\??\c:\rxlrlrf.exec:\rxlrlrf.exe99⤵PID:2224
-
\??\c:\tbhhbh.exec:\tbhhbh.exe100⤵PID:2024
-
\??\c:\3vjvj.exec:\3vjvj.exe101⤵PID:2148
-
\??\c:\5lfrflf.exec:\5lfrflf.exe102⤵PID:2144
-
\??\c:\fflrxlr.exec:\fflrxlr.exe103⤵PID:2760
-
\??\c:\1hhtbt.exec:\1hhtbt.exe104⤵PID:3036
-
\??\c:\jjdpv.exec:\jjdpv.exe105⤵PID:2568
-
\??\c:\rrllfrf.exec:\rrllfrf.exe106⤵PID:680
-
\??\c:\hbthnb.exec:\hbthnb.exe107⤵PID:1076
-
\??\c:\djpvd.exec:\djpvd.exe108⤵PID:1632
-
\??\c:\xfffrlr.exec:\xfffrlr.exe109⤵PID:1712
-
\??\c:\xfxxxfl.exec:\xfxxxfl.exe110⤵PID:1556
-
\??\c:\bbbnbn.exec:\bbbnbn.exe111⤵PID:1788
-
\??\c:\jvjjp.exec:\jvjjp.exe112⤵PID:632
-
\??\c:\lflrffl.exec:\lflrffl.exe113⤵PID:568
-
\??\c:\tnhhnn.exec:\tnhhnn.exe114⤵PID:1056
-
\??\c:\ttnhht.exec:\ttnhht.exe115⤵PID:2460
-
\??\c:\vpdvv.exec:\vpdvv.exe116⤵PID:2524
-
\??\c:\fxxrrfr.exec:\fxxrrfr.exe117⤵PID:344
-
\??\c:\thhhnh.exec:\thhhnh.exe118⤵PID:900
-
\??\c:\jjvdj.exec:\jjvdj.exe119⤵PID:2212
-
\??\c:\ddpvj.exec:\ddpvj.exe120⤵PID:2976
-
\??\c:\9xxxlrx.exec:\9xxxlrx.exe121⤵PID:2928
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-