Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 01:09
Behavioral task
behavioral1
Sample
aa18cb12907c091bdd16e0a48bb34fd2d17ebd3ee1f975bba579120e145fd3bf.exe
Resource
win7-20240215-en
windows7-x64
6 signatures
150 seconds
General
-
Target
aa18cb12907c091bdd16e0a48bb34fd2d17ebd3ee1f975bba579120e145fd3bf.exe
-
Size
75KB
-
MD5
374378cff8677cc7f896d2f6f2842a55
-
SHA1
251cc48a9a2d9a91cdcd980b8692ce063fcb3913
-
SHA256
aa18cb12907c091bdd16e0a48bb34fd2d17ebd3ee1f975bba579120e145fd3bf
-
SHA512
4dca7f001ffda7c7674aa297dcb1f82c57902fd7962f4eeb1dc0b90bb71d13e4e2bd64047e7956a5c8e5be89cce600fbd2990131e12d3d5b88e7c9525910b1f9
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8PbhnyLFWoFLAxZhMDzE8mpcw:9hOmTsF93UYfwC6GIoutz5yLpOSD8
Malware Config
Signatures
-
Detect Blackmoon payload 44 IoCs
Processes:
resource yara_rule behavioral1/memory/2328-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/500-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1964-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2572-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2472-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2788-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2476-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2880-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1148-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1580-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3056-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2192-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2612-331-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2680-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/760-363-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-365-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1584-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1872-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1340-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/708-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3036-428-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1580-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-156-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2184-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1148-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2892-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1316-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2344-458-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1548-472-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/804-492-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-685-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1596-870-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1596-875-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-981-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2556-1013-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-1039-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2336-1116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-1134-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/840-1160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-1247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral1/memory/2328-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\bbnntb.exe UPX behavioral1/memory/2328-9-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/500-11-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/500-14-0x00000000003C0000-0x00000000003E7000-memory.dmp UPX C:\vpvjv.exe UPX behavioral1/memory/1964-28-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\lfxfllr.exe UPX behavioral1/memory/2572-31-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\5hbthn.exe UPX behavioral1/memory/2724-38-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\3nbbtt.exe UPX behavioral1/memory/2724-47-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2472-56-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\5jvdj.exe UPX C:\3lfrfrr.exe UPX behavioral1/memory/2788-66-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2640-69-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\llxlxfr.exe UPX behavioral1/memory/2476-76-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\bttttb.exe UPX behavioral1/memory/2476-85-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\1ddjp.exe UPX \??\c:\pjvdj.exe UPX behavioral1/memory/2880-112-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1148-130-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\9lllxxf.exe UPX behavioral1/memory/2524-148-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\pjdpv.exe UPX \??\c:\rrxxflr.exe UPX behavioral1/memory/1580-176-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/3056-186-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\fxrxlrf.exe UPX \??\c:\nbhhnt.exe UPX \??\c:\bnhtbb.exe UPX C:\lfrrffx.exe UPX C:\rflrxrr.exe UPX \??\c:\hbthnb.exe UPX C:\5vpdv.exe UPX behavioral1/memory/2192-298-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\rrllflx.exe UPX behavioral1/memory/2192-290-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\3rfrxxr.exe UPX behavioral1/memory/2660-349-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2680-343-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/760-363-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2732-365-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/760-356-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1836-383-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1584-310-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2844-397-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2068-273-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\vvjvj.exe UPX behavioral1/memory/1872-251-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\bbtnnb.exe UPX behavioral1/memory/1340-245-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/708-228-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/3036-428-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\pjjpv.exe UPX \??\c:\ddpvd.exe UPX behavioral1/memory/680-211-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1580-168-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\jdpjj.exe UPX behavioral1/memory/2684-159-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
bbnntb.exevpvjv.exelfxfllr.exe5hbthn.exe3nbbtt.exe5jvdj.exe3lfrfrr.exellxlxfr.exebttttb.exe1ddjp.exeppvdj.exepjvdj.exerllxfrf.exe9lllxxf.exe1nnhtn.exennttbt.exepjdpv.exejdpjj.exerrxxflr.exefxrxlrf.exenbhhnt.exebnhtbb.exeddpvd.exepjjpv.exelfrrffx.exerflrxrr.exebbtnnb.exehbthnb.exevvjvj.exe5vpdv.exe3rfrxxr.exerrllflx.exenhtnhb.exe9hnhbn.exejddpp.exefxrfflr.exerrfrflf.exehhnthh.exe3nnttb.exe5hbbtt.exejjjdp.exe5jjdv.exefxrxlrr.exe7fffxrr.exe1fxrffl.exehbhbbt.exebnbhbn.exe7vjdd.exevpvvj.exejddjp.exerrffxfx.exeffrxfrx.exebbnntn.exehhbttb.exepvvjp.exevvjjj.exe1rrfrlx.exetnhhhn.exejdpvj.exepvpvp.exelllxflr.exebtnhth.exedvjdp.exe1dvdp.exepid process 500 bbnntb.exe 1964 vpvjv.exe 2572 lfxfllr.exe 2724 5hbthn.exe 2472 3nbbtt.exe 2788 5jvdj.exe 2640 3lfrfrr.exe 2476 llxlxfr.exe 1316 bttttb.exe 1956 1ddjp.exe 2880 ppvdj.exe 2892 pjvdj.exe 1148 rllxfrf.exe 2348 9lllxxf.exe 2184 1nnhtn.exe 2524 nnttbt.exe 2684 pjdpv.exe 1580 jdpjj.exe 1548 rrxxflr.exe 3056 fxrxlrf.exe 1232 nbhhnt.exe 2948 bnhtbb.exe 680 ddpvd.exe 708 pjjpv.exe 1092 lfrrffx.exe 1340 rflrxrr.exe 1872 bbtnnb.exe 1648 hbthnb.exe 1264 vvjvj.exe 2068 5vpdv.exe 2980 3rfrxxr.exe 2192 rrllflx.exe 844 nhtnhb.exe 1584 9hnhbn.exe 1032 jddpp.exe 1724 fxrfflr.exe 2312 rrfrflf.exe 2612 hhnthh.exe 2932 3nnttb.exe 2680 5hbbtt.exe 2660 jjjdp.exe 760 5jjdv.exe 2732 fxrxlrr.exe 2508 7fffxrr.exe 3024 1fxrffl.exe 1836 hbhbbt.exe 2484 bnbhbn.exe 2844 7vjdd.exe 3004 vpvvj.exe 2696 jddjp.exe 2648 rrffxfx.exe 1764 ffrxfrx.exe 3036 bbnntn.exe 3012 hhbttb.exe 2832 pvvjp.exe 2792 vvjjj.exe 2000 1rrfrlx.exe 2344 tnhhhn.exe 1548 jdpvj.exe 2296 pvpvp.exe 1232 lllxflr.exe 540 btnhth.exe 804 dvjdp.exe 680 1dvdp.exe -
Processes:
resource yara_rule behavioral1/memory/2328-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bbnntb.exe upx behavioral1/memory/2328-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/500-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/500-14-0x00000000003C0000-0x00000000003E7000-memory.dmp upx C:\vpvjv.exe upx behavioral1/memory/1964-28-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lfxfllr.exe upx behavioral1/memory/2572-31-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5hbthn.exe upx behavioral1/memory/2724-38-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3nbbtt.exe upx behavioral1/memory/2724-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2472-56-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5jvdj.exe upx C:\3lfrfrr.exe upx behavioral1/memory/2788-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2640-69-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\llxlxfr.exe upx behavioral1/memory/2476-76-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bttttb.exe upx behavioral1/memory/2476-85-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\1ddjp.exe upx \??\c:\pjvdj.exe upx behavioral1/memory/2880-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1148-130-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9lllxxf.exe upx behavioral1/memory/2524-148-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pjdpv.exe upx \??\c:\rrxxflr.exe upx behavioral1/memory/1580-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3056-186-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\fxrxlrf.exe upx \??\c:\nbhhnt.exe upx \??\c:\bnhtbb.exe upx C:\lfrrffx.exe upx C:\rflrxrr.exe upx \??\c:\hbthnb.exe upx C:\5vpdv.exe upx behavioral1/memory/2192-298-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rrllflx.exe upx behavioral1/memory/2192-290-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3rfrxxr.exe upx behavioral1/memory/2660-349-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2680-343-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/760-363-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2732-365-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/760-356-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1836-383-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1584-310-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2844-397-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2068-273-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vvjvj.exe upx behavioral1/memory/1872-251-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bbtnnb.exe upx behavioral1/memory/1340-245-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/708-228-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/708-227-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/3036-428-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pjjpv.exe upx \??\c:\ddpvd.exe upx behavioral1/memory/680-211-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1580-168-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jdpjj.exe upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
aa18cb12907c091bdd16e0a48bb34fd2d17ebd3ee1f975bba579120e145fd3bf.exebbnntb.exevpvjv.exelfxfllr.exe5hbthn.exe3nbbtt.exe5jvdj.exe3lfrfrr.exellxlxfr.exebttttb.exe1ddjp.exeppvdj.exepjvdj.exerllxfrf.exe9lllxxf.exe1nnhtn.exedescription pid process target process PID 2328 wrote to memory of 500 2328 aa18cb12907c091bdd16e0a48bb34fd2d17ebd3ee1f975bba579120e145fd3bf.exe bbnntb.exe PID 2328 wrote to memory of 500 2328 aa18cb12907c091bdd16e0a48bb34fd2d17ebd3ee1f975bba579120e145fd3bf.exe bbnntb.exe PID 2328 wrote to memory of 500 2328 aa18cb12907c091bdd16e0a48bb34fd2d17ebd3ee1f975bba579120e145fd3bf.exe bbnntb.exe PID 2328 wrote to memory of 500 2328 aa18cb12907c091bdd16e0a48bb34fd2d17ebd3ee1f975bba579120e145fd3bf.exe bbnntb.exe PID 500 wrote to memory of 1964 500 bbnntb.exe vpvjv.exe PID 500 wrote to memory of 1964 500 bbnntb.exe vpvjv.exe PID 500 wrote to memory of 1964 500 bbnntb.exe vpvjv.exe PID 500 wrote to memory of 1964 500 bbnntb.exe vpvjv.exe PID 1964 wrote to memory of 2572 1964 vpvjv.exe lfxfllr.exe PID 1964 wrote to memory of 2572 1964 vpvjv.exe lfxfllr.exe PID 1964 wrote to memory of 2572 1964 vpvjv.exe lfxfllr.exe PID 1964 wrote to memory of 2572 1964 vpvjv.exe lfxfllr.exe PID 2572 wrote to memory of 2724 2572 lfxfllr.exe 5hbthn.exe PID 2572 wrote to memory of 2724 2572 lfxfllr.exe 5hbthn.exe PID 2572 wrote to memory of 2724 2572 lfxfllr.exe 5hbthn.exe PID 2572 wrote to memory of 2724 2572 lfxfllr.exe 5hbthn.exe PID 2724 wrote to memory of 2472 2724 5hbthn.exe 3nbbtt.exe PID 2724 wrote to memory of 2472 2724 5hbthn.exe 3nbbtt.exe PID 2724 wrote to memory of 2472 2724 5hbthn.exe 3nbbtt.exe PID 2724 wrote to memory of 2472 2724 5hbthn.exe 3nbbtt.exe PID 2472 wrote to memory of 2788 2472 3nbbtt.exe 5jvdj.exe PID 2472 wrote to memory of 2788 2472 3nbbtt.exe 5jvdj.exe PID 2472 wrote to memory of 2788 2472 3nbbtt.exe 5jvdj.exe PID 2472 wrote to memory of 2788 2472 3nbbtt.exe 5jvdj.exe PID 2788 wrote to memory of 2640 2788 5jvdj.exe 3lfrfrr.exe PID 2788 wrote to memory of 2640 2788 5jvdj.exe 3lfrfrr.exe PID 2788 wrote to memory of 2640 2788 5jvdj.exe 3lfrfrr.exe PID 2788 wrote to memory of 2640 2788 5jvdj.exe 3lfrfrr.exe PID 2640 wrote to memory of 2476 2640 3lfrfrr.exe llxlxfr.exe PID 2640 wrote to memory of 2476 2640 3lfrfrr.exe llxlxfr.exe PID 2640 wrote to memory of 2476 2640 3lfrfrr.exe llxlxfr.exe PID 2640 wrote to memory of 2476 2640 3lfrfrr.exe llxlxfr.exe PID 2476 wrote to memory of 1316 2476 llxlxfr.exe bttttb.exe PID 2476 wrote to memory of 1316 2476 llxlxfr.exe bttttb.exe PID 2476 wrote to memory of 1316 2476 llxlxfr.exe bttttb.exe PID 2476 wrote to memory of 1316 2476 llxlxfr.exe bttttb.exe PID 1316 wrote to memory of 1956 1316 bttttb.exe 1ddjp.exe PID 1316 wrote to memory of 1956 1316 bttttb.exe 1ddjp.exe PID 1316 wrote to memory of 1956 1316 bttttb.exe 1ddjp.exe PID 1316 wrote to memory of 1956 1316 bttttb.exe 1ddjp.exe PID 1956 wrote to memory of 2880 1956 1ddjp.exe ppvdj.exe PID 1956 wrote to memory of 2880 1956 1ddjp.exe ppvdj.exe PID 1956 wrote to memory of 2880 1956 1ddjp.exe ppvdj.exe PID 1956 wrote to memory of 2880 1956 1ddjp.exe ppvdj.exe PID 2880 wrote to memory of 2892 2880 ppvdj.exe pjvdj.exe PID 2880 wrote to memory of 2892 2880 ppvdj.exe pjvdj.exe PID 2880 wrote to memory of 2892 2880 ppvdj.exe pjvdj.exe PID 2880 wrote to memory of 2892 2880 ppvdj.exe pjvdj.exe PID 2892 wrote to memory of 1148 2892 pjvdj.exe rllxfrf.exe PID 2892 wrote to memory of 1148 2892 pjvdj.exe rllxfrf.exe PID 2892 wrote to memory of 1148 2892 pjvdj.exe rllxfrf.exe PID 2892 wrote to memory of 1148 2892 pjvdj.exe rllxfrf.exe PID 1148 wrote to memory of 2348 1148 rllxfrf.exe 9lllxxf.exe PID 1148 wrote to memory of 2348 1148 rllxfrf.exe 9lllxxf.exe PID 1148 wrote to memory of 2348 1148 rllxfrf.exe 9lllxxf.exe PID 1148 wrote to memory of 2348 1148 rllxfrf.exe 9lllxxf.exe PID 2348 wrote to memory of 2184 2348 9lllxxf.exe 1nnhtn.exe PID 2348 wrote to memory of 2184 2348 9lllxxf.exe 1nnhtn.exe PID 2348 wrote to memory of 2184 2348 9lllxxf.exe 1nnhtn.exe PID 2348 wrote to memory of 2184 2348 9lllxxf.exe 1nnhtn.exe PID 2184 wrote to memory of 2524 2184 1nnhtn.exe nnttbt.exe PID 2184 wrote to memory of 2524 2184 1nnhtn.exe nnttbt.exe PID 2184 wrote to memory of 2524 2184 1nnhtn.exe nnttbt.exe PID 2184 wrote to memory of 2524 2184 1nnhtn.exe nnttbt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa18cb12907c091bdd16e0a48bb34fd2d17ebd3ee1f975bba579120e145fd3bf.exe"C:\Users\Admin\AppData\Local\Temp\aa18cb12907c091bdd16e0a48bb34fd2d17ebd3ee1f975bba579120e145fd3bf.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\bbnntb.exec:\bbnntb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:500 -
\??\c:\vpvjv.exec:\vpvjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\lfxfllr.exec:\lfxfllr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\5hbthn.exec:\5hbthn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\3nbbtt.exec:\3nbbtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\5jvdj.exec:\5jvdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\3lfrfrr.exec:\3lfrfrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\llxlxfr.exec:\llxlxfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\bttttb.exec:\bttttb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\1ddjp.exec:\1ddjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\ppvdj.exec:\ppvdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\pjvdj.exec:\pjvdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\rllxfrf.exec:\rllxfrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\9lllxxf.exec:\9lllxxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\1nnhtn.exec:\1nnhtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\nnttbt.exec:\nnttbt.exe17⤵
- Executes dropped EXE
PID:2524 -
\??\c:\pjdpv.exec:\pjdpv.exe18⤵
- Executes dropped EXE
PID:2684 -
\??\c:\jdpjj.exec:\jdpjj.exe19⤵
- Executes dropped EXE
PID:1580 -
\??\c:\rrxxflr.exec:\rrxxflr.exe20⤵
- Executes dropped EXE
PID:1548 -
\??\c:\fxrxlrf.exec:\fxrxlrf.exe21⤵
- Executes dropped EXE
PID:3056 -
\??\c:\nbhhnt.exec:\nbhhnt.exe22⤵
- Executes dropped EXE
PID:1232 -
\??\c:\bnhtbb.exec:\bnhtbb.exe23⤵
- Executes dropped EXE
PID:2948 -
\??\c:\ddpvd.exec:\ddpvd.exe24⤵
- Executes dropped EXE
PID:680 -
\??\c:\pjjpv.exec:\pjjpv.exe25⤵
- Executes dropped EXE
PID:708 -
\??\c:\lfrrffx.exec:\lfrrffx.exe26⤵
- Executes dropped EXE
PID:1092 -
\??\c:\rflrxrr.exec:\rflrxrr.exe27⤵
- Executes dropped EXE
PID:1340 -
\??\c:\bbtnnb.exec:\bbtnnb.exe28⤵
- Executes dropped EXE
PID:1872 -
\??\c:\hbthnb.exec:\hbthnb.exe29⤵
- Executes dropped EXE
PID:1648 -
\??\c:\vvjvj.exec:\vvjvj.exe30⤵
- Executes dropped EXE
PID:1264 -
\??\c:\5vpdv.exec:\5vpdv.exe31⤵
- Executes dropped EXE
PID:2068 -
\??\c:\3rfrxxr.exec:\3rfrxxr.exe32⤵
- Executes dropped EXE
PID:2980 -
\??\c:\rrllflx.exec:\rrllflx.exe33⤵
- Executes dropped EXE
PID:2192 -
\??\c:\nhtnhb.exec:\nhtnhb.exe34⤵
- Executes dropped EXE
PID:844 -
\??\c:\9hnhbn.exec:\9hnhbn.exe35⤵
- Executes dropped EXE
PID:1584 -
\??\c:\jddpp.exec:\jddpp.exe36⤵
- Executes dropped EXE
PID:1032 -
\??\c:\fxrfflr.exec:\fxrfflr.exe37⤵
- Executes dropped EXE
PID:1724 -
\??\c:\rrfrflf.exec:\rrfrflf.exe38⤵
- Executes dropped EXE
PID:2312 -
\??\c:\hhnthh.exec:\hhnthh.exe39⤵
- Executes dropped EXE
PID:2612 -
\??\c:\3nnttb.exec:\3nnttb.exe40⤵
- Executes dropped EXE
PID:2932 -
\??\c:\5hbbtt.exec:\5hbbtt.exe41⤵
- Executes dropped EXE
PID:2680 -
\??\c:\jjjdp.exec:\jjjdp.exe42⤵
- Executes dropped EXE
PID:2660 -
\??\c:\5jjdv.exec:\5jjdv.exe43⤵
- Executes dropped EXE
PID:760 -
\??\c:\fxrxlrr.exec:\fxrxlrr.exe44⤵
- Executes dropped EXE
PID:2732 -
\??\c:\7fffxrr.exec:\7fffxrr.exe45⤵
- Executes dropped EXE
PID:2508 -
\??\c:\1fxrffl.exec:\1fxrffl.exe46⤵
- Executes dropped EXE
PID:3024 -
\??\c:\hbhbbt.exec:\hbhbbt.exe47⤵
- Executes dropped EXE
PID:1836 -
\??\c:\bnbhbn.exec:\bnbhbn.exe48⤵
- Executes dropped EXE
PID:2484 -
\??\c:\7vjdd.exec:\7vjdd.exe49⤵
- Executes dropped EXE
PID:2844 -
\??\c:\vpvvj.exec:\vpvvj.exe50⤵
- Executes dropped EXE
PID:3004 -
\??\c:\jddjp.exec:\jddjp.exe51⤵
- Executes dropped EXE
PID:2696 -
\??\c:\rrffxfx.exec:\rrffxfx.exe52⤵
- Executes dropped EXE
PID:2648 -
\??\c:\ffrxfrx.exec:\ffrxfrx.exe53⤵
- Executes dropped EXE
PID:1764 -
\??\c:\bbnntn.exec:\bbnntn.exe54⤵
- Executes dropped EXE
PID:3036 -
\??\c:\hhbttb.exec:\hhbttb.exe55⤵
- Executes dropped EXE
PID:3012 -
\??\c:\pvvjp.exec:\pvvjp.exe56⤵
- Executes dropped EXE
PID:2832 -
\??\c:\vvjjj.exec:\vvjjj.exe57⤵
- Executes dropped EXE
PID:2792 -
\??\c:\1rrfrlx.exec:\1rrfrlx.exe58⤵
- Executes dropped EXE
PID:2000 -
\??\c:\tnhhhn.exec:\tnhhhn.exe59⤵
- Executes dropped EXE
PID:2344 -
\??\c:\jdpvj.exec:\jdpvj.exe60⤵
- Executes dropped EXE
PID:1548 -
\??\c:\pvpvp.exec:\pvpvp.exe61⤵
- Executes dropped EXE
PID:2296 -
\??\c:\lllxflr.exec:\lllxflr.exe62⤵
- Executes dropped EXE
PID:1232 -
\??\c:\btnhth.exec:\btnhth.exe63⤵
- Executes dropped EXE
PID:540 -
\??\c:\dvjdp.exec:\dvjdp.exe64⤵
- Executes dropped EXE
PID:804 -
\??\c:\1dvdp.exec:\1dvdp.exe65⤵
- Executes dropped EXE
PID:680 -
\??\c:\7tnbtb.exec:\7tnbtb.exe66⤵PID:1800
-
\??\c:\7ppdv.exec:\7ppdv.exe67⤵PID:1260
-
\??\c:\djvjj.exec:\djvjj.exe68⤵PID:1008
-
\??\c:\llxfrxf.exec:\llxfrxf.exe69⤵PID:2920
-
\??\c:\hhtbhn.exec:\hhtbhn.exe70⤵PID:936
-
\??\c:\3dvpv.exec:\3dvpv.exe71⤵PID:908
-
\??\c:\fffrlxr.exec:\fffrlxr.exe72⤵PID:584
-
\??\c:\tthtbn.exec:\tthtbn.exe73⤵PID:1980
-
\??\c:\djppj.exec:\djppj.exe74⤵PID:2068
-
\??\c:\pjvvd.exec:\pjvvd.exe75⤵PID:2032
-
\??\c:\rlxfrxl.exec:\rlxfrxl.exe76⤵PID:632
-
\??\c:\xrfflrf.exec:\xrfflrf.exe77⤵PID:2180
-
\??\c:\7nhtbt.exec:\7nhtbt.exe78⤵PID:1596
-
\??\c:\hbthht.exec:\hbthht.exe79⤵PID:2420
-
\??\c:\jvdvp.exec:\jvdvp.exe80⤵PID:2236
-
\??\c:\pjvdv.exec:\pjvdv.exe81⤵PID:1032
-
\??\c:\rlllfff.exec:\rlllfff.exe82⤵PID:1724
-
\??\c:\lfrxxxf.exec:\lfrxxxf.exe83⤵PID:2084
-
\??\c:\1hhhhb.exec:\1hhhhb.exe84⤵PID:2620
-
\??\c:\vjvdd.exec:\vjvdd.exe85⤵PID:2756
-
\??\c:\dvvpp.exec:\dvvpp.exe86⤵PID:2720
-
\??\c:\rlllrrf.exec:\rlllrrf.exe87⤵PID:2800
-
\??\c:\rlrlfxr.exec:\rlrlfxr.exe88⤵PID:2788
-
\??\c:\tttbbb.exec:\tttbbb.exe89⤵PID:2532
-
\??\c:\tbhbbt.exec:\tbhbbt.exe90⤵PID:2928
-
\??\c:\9djvj.exec:\9djvj.exe91⤵PID:2100
-
\??\c:\ddvvd.exec:\ddvvd.exe92⤵PID:1316
-
\??\c:\5dvjv.exec:\5dvjv.exe93⤵PID:2796
-
\??\c:\llffflr.exec:\llffflr.exe94⤵PID:2908
-
\??\c:\xrxflrf.exec:\xrxflrf.exe95⤵PID:2820
-
\??\c:\hbttht.exec:\hbttht.exe96⤵PID:3004
-
\??\c:\nnhttt.exec:\nnhttt.exe97⤵PID:1108
-
\??\c:\7jvvv.exec:\7jvvv.exe98⤵PID:2648
-
\??\c:\7dpdp.exec:\7dpdp.exe99⤵PID:1764
-
\??\c:\xrffxfl.exec:\xrffxfl.exe100⤵PID:2452
-
\??\c:\lfxxlrx.exec:\lfxxlrx.exe101⤵PID:1616
-
\??\c:\1tnbth.exec:\1tnbth.exe102⤵PID:2824
-
\??\c:\nhthnt.exec:\nhthnt.exe103⤵PID:2792
-
\??\c:\vjpvd.exec:\vjpvd.exe104⤵PID:2000
-
\??\c:\ppddp.exec:\ppddp.exe105⤵PID:2952
-
\??\c:\rfllfll.exec:\rfllfll.exe106⤵PID:2812
-
\??\c:\rfrllfx.exec:\rfrllfx.exe107⤵PID:1320
-
\??\c:\xlxrrrx.exec:\xlxrrrx.exe108⤵PID:1232
-
\??\c:\btbhhn.exec:\btbhhn.exe109⤵PID:484
-
\??\c:\1hbtbn.exec:\1hbtbn.exe110⤵PID:2160
-
\??\c:\jdvvd.exec:\jdvvd.exe111⤵PID:708
-
\??\c:\5vjpp.exec:\5vjpp.exe112⤵PID:1092
-
\??\c:\xxfxxll.exec:\xxfxxll.exe113⤵PID:2024
-
\??\c:\rfxlllf.exec:\rfxlllf.exe114⤵PID:348
-
\??\c:\frffffl.exec:\frffffl.exe115⤵PID:1872
-
\??\c:\tntnbt.exec:\tntnbt.exe116⤵PID:936
-
\??\c:\bththh.exec:\bththh.exe117⤵PID:1648
-
\??\c:\5pddj.exec:\5pddj.exe118⤵PID:1152
-
\??\c:\5jvvd.exec:\5jvvd.exe119⤵PID:1636
-
\??\c:\1flrlff.exec:\1flrlff.exe120⤵PID:1752
-
\??\c:\5rfflll.exec:\5rfflll.exe121⤵PID:2032
-
\??\c:\bhnnnn.exec:\bhnnnn.exe122⤵PID:2124
-
\??\c:\1nbhhb.exec:\1nbhhb.exe123⤵PID:1852
-
\??\c:\jdpvj.exec:\jdpvj.exe124⤵PID:1596
-
\??\c:\jdddd.exec:\jdddd.exe125⤵PID:1564
-
\??\c:\xlrfffr.exec:\xlrfffr.exe126⤵PID:1952
-
\??\c:\xlrrrlf.exec:\xlrrrlf.exe127⤵PID:2616
-
\??\c:\rlrxfxf.exec:\rlrxfxf.exe128⤵PID:1028
-
\??\c:\hbntht.exec:\hbntht.exe129⤵PID:2156
-
\??\c:\btbtbb.exec:\btbtbb.exe130⤵PID:2664
-
\??\c:\pdddv.exec:\pdddv.exe131⤵PID:2808
-
\??\c:\vpvdj.exec:\vpvdj.exe132⤵PID:2512
-
\??\c:\xlflrrx.exec:\xlflrrx.exe133⤵PID:2800
-
\??\c:\rlrffrx.exec:\rlrffrx.exe134⤵PID:2732
-
\??\c:\9nbntn.exec:\9nbntn.exe135⤵PID:2504
-
\??\c:\htthhh.exec:\htthhh.exe136⤵PID:2624
-
\??\c:\3thbbb.exec:\3thbbb.exe137⤵PID:2516
-
\??\c:\dvdjd.exec:\dvdjd.exe138⤵PID:1316
-
\??\c:\xfxrllf.exec:\xfxrllf.exe139⤵PID:2796
-
\??\c:\xlrrxfl.exec:\xlrrxfl.exe140⤵PID:2536
-
\??\c:\3bthtb.exec:\3bthtb.exe141⤵PID:2820
-
\??\c:\5bhntn.exec:\5bhntn.exe142⤵PID:2848
-
\??\c:\jvvjj.exec:\jvvjj.exe143⤵PID:1440
-
\??\c:\7ddvv.exec:\7ddvv.exe144⤵PID:700
-
\??\c:\vjvvv.exec:\vjvvv.exe145⤵PID:2776
-
\??\c:\xlxxrlr.exec:\xlxxrlr.exe146⤵PID:2556
-
\??\c:\5lxffff.exec:\5lxffff.exe147⤵PID:1616
-
\??\c:\7hhbnb.exec:\7hhbnb.exe148⤵PID:2824
-
\??\c:\7ntbbb.exec:\7ntbbb.exe149⤵PID:2792
-
\??\c:\3ddvp.exec:\3ddvp.exe150⤵PID:1720
-
\??\c:\dvdvd.exec:\dvdvd.exe151⤵PID:1608
-
\??\c:\lxlffll.exec:\lxlffll.exe152⤵PID:2152
-
\??\c:\3rrlrll.exec:\3rrlrll.exe153⤵PID:2948
-
\??\c:\ntbtth.exec:\ntbtth.exe154⤵PID:1376
-
\??\c:\jjjvp.exec:\jjjvp.exe155⤵PID:2984
-
\??\c:\dvdjp.exec:\dvdjp.exe156⤵PID:1864
-
\??\c:\lxxlfxx.exec:\lxxlfxx.exe157⤵PID:960
-
\??\c:\frrlfxf.exec:\frrlfxf.exe158⤵PID:1644
-
\??\c:\thhbhn.exec:\thhbhn.exe159⤵PID:1652
-
\??\c:\3bhhbt.exec:\3bhhbt.exe160⤵PID:568
-
\??\c:\7jdpv.exec:\7jdpv.exe161⤵PID:2228
-
\??\c:\vjvvp.exec:\vjvvp.exe162⤵PID:1404
-
\??\c:\rflxxrr.exec:\rflxxrr.exe163⤵PID:2336
-
\??\c:\rfrrxrl.exec:\rfrrxrl.exe164⤵PID:2944
-
\??\c:\bnbbbh.exec:\bnbbbh.exe165⤵PID:2552
-
\??\c:\tnbntn.exec:\tnbntn.exe166⤵PID:892
-
\??\c:\dvddd.exec:\dvddd.exe167⤵PID:696
-
\??\c:\vpvvp.exec:\vpvvp.exe168⤵PID:1972
-
\??\c:\1lxxlfl.exec:\1lxxlfl.exe169⤵PID:1584
-
\??\c:\fxfxffl.exec:\fxfxffl.exe170⤵PID:840
-
\??\c:\nbhbbt.exec:\nbhbbt.exe171⤵PID:2912
-
\??\c:\htbbhn.exec:\htbbhn.exe172⤵PID:1724
-
\??\c:\9pdvv.exec:\9pdvv.exe173⤵PID:2172
-
\??\c:\9dpvj.exec:\9dpvj.exe174⤵PID:1028
-
\??\c:\1xffxxf.exec:\1xffxxf.exe175⤵PID:2932
-
\??\c:\1lfrxxr.exec:\1lfrxxr.exe176⤵PID:1392
-
\??\c:\nbhtbb.exec:\nbhtbb.exe177⤵PID:2660
-
\??\c:\hhtnbn.exec:\hhtnbn.exe178⤵PID:1284
-
\??\c:\7pddj.exec:\7pddj.exe179⤵PID:2788
-
\??\c:\ddjdj.exec:\ddjdj.exe180⤵PID:2520
-
\??\c:\rfrxrxl.exec:\rfrxrxl.exe181⤵PID:3024
-
\??\c:\rlxfflr.exec:\rlxfflr.exe182⤵PID:1828
-
\??\c:\ttbhnt.exec:\ttbhnt.exe183⤵PID:2880
-
\??\c:\3tttnn.exec:\3tttnn.exe184⤵PID:2860
-
\??\c:\5jpjd.exec:\5jpjd.exe185⤵PID:2636
-
\??\c:\pdpvp.exec:\pdpvp.exe186⤵PID:820
-
\??\c:\xrllrll.exec:\xrllrll.exe187⤵PID:3044
-
\??\c:\xrflfll.exec:\xrflfll.exe188⤵PID:1296
-
\??\c:\tntbtt.exec:\tntbtt.exe189⤵PID:2440
-
\??\c:\5nbnhn.exec:\5nbnhn.exe190⤵PID:2524
-
\??\c:\vppdp.exec:\vppdp.exe191⤵PID:1572
-
\??\c:\vpddp.exec:\vpddp.exe192⤵PID:1768
-
\??\c:\fxllfxf.exec:\fxllfxf.exe193⤵PID:1716
-
\??\c:\9xllllr.exec:\9xllllr.exe194⤵PID:1688
-
\??\c:\hnnhnn.exec:\hnnhnn.exe195⤵PID:3048
-
\??\c:\bhhbtn.exec:\bhhbtn.exe196⤵PID:2296
-
\??\c:\pdvpp.exec:\pdvpp.exe197⤵PID:1608
-
\??\c:\9vvvj.exec:\9vvvj.exe198⤵PID:2152
-
\??\c:\5ffxxrf.exec:\5ffxxrf.exe199⤵PID:336
-
\??\c:\lxrxxlx.exec:\lxrxxlx.exe200⤵PID:588
-
\??\c:\9hthnh.exec:\9hthnh.exe201⤵PID:848
-
\??\c:\bbbtbb.exec:\bbbtbb.exe202⤵PID:1876
-
\??\c:\dpvjj.exec:\dpvjj.exe203⤵PID:1260
-
\??\c:\5djpd.exec:\5djpd.exe204⤵PID:920
-
\??\c:\jvdjd.exec:\jvdjd.exe205⤵PID:2920
-
\??\c:\3xxrxxl.exec:\3xxrxxl.exe206⤵PID:2024
-
\??\c:\rlxrrrr.exec:\rlxrrrr.exe207⤵PID:2412
-
\??\c:\nbbhnb.exec:\nbbhnb.exe208⤵PID:2964
-
\??\c:\nhtntt.exec:\nhtntt.exe209⤵PID:1484
-
\??\c:\rrlrxxx.exec:\rrlrxxx.exe210⤵PID:1980
-
\??\c:\rflrrll.exec:\rflrrll.exe211⤵PID:2372
-
\??\c:\hhbnth.exec:\hhbnth.exe212⤵PID:2976
-
\??\c:\bntntn.exec:\bntntn.exe213⤵PID:632
-
\??\c:\9jjpp.exec:\9jjpp.exe214⤵PID:2992
-
\??\c:\lrfrrll.exec:\lrfrrll.exe215⤵PID:2692
-
\??\c:\xrflrxl.exec:\xrflrxl.exe216⤵PID:1584
-
\??\c:\9btbnn.exec:\9btbnn.exe217⤵PID:2608
-
\??\c:\btnthn.exec:\btnthn.exe218⤵PID:1748
-
\??\c:\pdvvv.exec:\pdvvv.exe219⤵PID:2572
-
\??\c:\dvdvv.exec:\dvdvv.exe220⤵PID:2084
-
\??\c:\ffflrrl.exec:\ffflrrl.exe221⤵PID:2756
-
\??\c:\llxxfff.exec:\llxxfff.exe222⤵PID:2932
-
\??\c:\xxflffl.exec:\xxflffl.exe223⤵PID:2580
-
\??\c:\bbnhbh.exec:\bbnhbh.exe224⤵PID:2660
-
\??\c:\1ddpp.exec:\1ddpp.exe225⤵PID:2744
-
\??\c:\9jpvp.exec:\9jpvp.exe226⤵PID:1920
-
\??\c:\dvpdj.exec:\dvpdj.exe227⤵PID:2520
-
\??\c:\xxrlflr.exec:\xxrlflr.exe228⤵PID:2468
-
\??\c:\7lfrfff.exec:\7lfrfff.exe229⤵PID:2828
-
\??\c:\btbnhn.exec:\btbnhn.exe230⤵PID:2544
-
\??\c:\bnhnbh.exec:\bnhnbh.exe231⤵PID:1836
-
\??\c:\jdjdj.exec:\jdjdj.exe232⤵PID:2696
-
\??\c:\jpjjp.exec:\jpjjp.exe233⤵PID:2008
-
\??\c:\rlxfflx.exec:\rlxfflx.exe234⤵PID:816
-
\??\c:\ffxfrxf.exec:\ffxfrxf.exe235⤵PID:2764
-
\??\c:\lfrxlrx.exec:\lfrxlrx.exe236⤵PID:1764
-
\??\c:\hthttt.exec:\hthttt.exe237⤵PID:2184
-
\??\c:\thttbh.exec:\thttbh.exe238⤵PID:3052
-
\??\c:\pjddj.exec:\pjddj.exe239⤵PID:2832
-
\??\c:\ddpdj.exec:\ddpdj.exe240⤵PID:2824
-
\??\c:\dpddj.exec:\dpddj.exe241⤵PID:1916
-
\??\c:\3xxlrff.exec:\3xxlrff.exe242⤵PID:2644