Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 02:24
Behavioral task
behavioral1
Sample
c80cca9970613056bcfe795861817e5190f0e792593319b919a626e1406218a3.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
c80cca9970613056bcfe795861817e5190f0e792593319b919a626e1406218a3.exe
-
Size
204KB
-
MD5
d49b6025468f9de2be613ac205266e0d
-
SHA1
3c89a48f9862be9b82d160b6aa6d3329e9873629
-
SHA256
c80cca9970613056bcfe795861817e5190f0e792593319b919a626e1406218a3
-
SHA512
be63e7ebeecac1e89c4decad46e14065ab70e9302797d60e7f09fc0ead7565dad8a700cdea43adbf38796684cbe6d9bf4ee6a01cd0ead4a87e4ea1b76b78e64d
-
SSDEEP
6144:rcm4FmowdHoStBuhW246lCXb7YpdnSj6Ksan:x4wFHoSLjr0+Hsan
Malware Config
Signatures
-
Detect Blackmoon payload 52 IoCs
Processes:
resource yara_rule behavioral1/memory/1664-8-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1352-14-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2884-28-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2492-47-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2540-57-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2540-58-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2672-67-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2380-84-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/684-94-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1392-103-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2452-113-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2796-124-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1084-132-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2152-149-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2016-159-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/540-169-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1512-185-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2264-193-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1552-204-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/280-221-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2148-231-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1560-241-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1288-249-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1872-252-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2592-303-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1580-313-0x0000000077690000-0x000000007778A000-memory.dmp family_blackmoon behavioral1/memory/1692-320-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2428-328-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2536-363-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2056-393-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1692-321-0x00000000003C0000-0x00000000003F6000-memory.dmp family_blackmoon behavioral1/memory/1128-276-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/3020-426-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1068-452-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/620-472-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2848-503-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2872-511-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1708-574-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2124-581-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1484-606-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2084-638-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2536-664-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2376-672-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1776-768-0x00000000001C0000-0x00000000001F6000-memory.dmp family_blackmoon behavioral1/memory/1344-789-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2268-832-0x0000000000440000-0x0000000000476000-memory.dmp family_blackmoon behavioral1/memory/552-849-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1560-840-0x00000000002D0000-0x0000000000306000-memory.dmp family_blackmoon behavioral1/memory/1820-761-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1800-716-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1520-565-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2768-546-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral1/memory/1664-0-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/1664-8-0x0000000000400000-0x0000000000436000-memory.dmp UPX \??\c:\fjlfnr.exe UPX behavioral1/memory/1352-14-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\dttblbp.exe UPX behavioral1/memory/2884-28-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\vtplfvx.exe UPX C:\xbbnb.exe UPX behavioral1/memory/2492-47-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\dfddx.exe UPX behavioral1/memory/2540-48-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2540-57-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\rbtxb.exe UPX C:\jbbfjt.exe UPX behavioral1/memory/2672-67-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\hbhxdh.exe UPX behavioral1/memory/684-86-0x0000000000400000-0x0000000000436000-memory.dmp UPX \??\c:\ndlxfhd.exe UPX behavioral1/memory/2380-84-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/684-94-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\bxvjnvx.exe UPX behavioral1/memory/1392-103-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\nhjnjl.exe UPX behavioral1/memory/2452-113-0x0000000000400000-0x0000000000436000-memory.dmp UPX \??\c:\xtvfbb.exe UPX behavioral1/memory/2796-114-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2796-124-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\nxlvbdj.exe UPX C:\bljhrxn.exe UPX behavioral1/memory/1084-132-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\hvrttrf.exe UPX behavioral1/memory/2152-149-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\ffftnrh.exe UPX behavioral1/memory/2016-159-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/540-160-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\xjjbjt.exe UPX C:\rjdvh.exe UPX behavioral1/memory/540-169-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\fnlthb.exe UPX \??\c:\fnbpr.exe UPX behavioral1/memory/1512-185-0x0000000000400000-0x0000000000436000-memory.dmp UPX \??\c:\vvptb.exe UPX behavioral1/memory/1552-195-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/1552-204-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\xndbrlh.exe UPX C:\prdjx.exe UPX C:\vjpnrv.exe UPX behavioral1/memory/280-221-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2148-231-0x0000000000220000-0x0000000000256000-memory.dmp UPX C:\jlpddt.exe UPX behavioral1/memory/1560-241-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\dnxndxt.exe UPX behavioral1/memory/1288-249-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\pxnbdv.exe UPX behavioral1/memory/1872-252-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\rbnvh.exe UPX C:\ddtvjft.exe UPX C:\drlxp.exe UPX \??\c:\bdllfdt.exe UPX \??\c:\hrjrd.exe UPX behavioral1/memory/2592-303-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/1580-313-0x0000000077690000-0x000000007778A000-memory.dmp UPX behavioral1/memory/1692-320-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2428-328-0x0000000000400000-0x0000000000436000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
fjlfnr.exedttblbp.exevtplfvx.exexbbnb.exedfddx.exerbtxb.exejbbfjt.exehbhxdh.exendlxfhd.exebxvjnvx.exenhjnjl.exextvfbb.exenxlvbdj.exebljhrxn.exehvrttrf.exeffftnrh.exexjjbjt.exerjdvh.exefnlthb.exefnbpr.exevvptb.exexndbrlh.exeprdjx.exevjpnrv.exejlpddt.exednxndxt.exepxnbdv.exerbnvh.exeddtvjft.exedrlxp.exebdllfdt.exehrjrd.exebvndff.exefpbdd.exevlrbn.exetnbtf.exethxvxth.exefnvbbb.exenhvhtdj.exevnfbl.exenvrbjnt.exertbtn.exedjppbb.exedjhrn.exettpvdbt.exedfdjfnr.exethphpjb.exelthltpv.exehlnrprr.exelbtxd.exebbfhh.exepnxbrd.exejhndrt.exexjvlb.exejfrflr.exejhltxhf.exedlhdjrd.exepptxppn.exejnjltx.exelrfbv.exejtffp.exebjxhpp.exerdnlhl.exehjdrjv.exepid process 1352 fjlfnr.exe 2884 dttblbp.exe 2560 vtplfvx.exe 2492 xbbnb.exe 2540 dfddx.exe 2672 rbtxb.exe 2400 jbbfjt.exe 2380 hbhxdh.exe 684 ndlxfhd.exe 1392 bxvjnvx.exe 2452 nhjnjl.exe 2796 xtvfbb.exe 1084 nxlvbdj.exe 1080 bljhrxn.exe 2152 hvrttrf.exe 2016 ffftnrh.exe 540 xjjbjt.exe 1744 rjdvh.exe 1512 fnlthb.exe 2264 fnbpr.exe 1552 vvptb.exe 2860 xndbrlh.exe 280 prdjx.exe 2148 vjpnrv.exe 1560 jlpddt.exe 1288 dnxndxt.exe 1872 pxnbdv.exe 1964 rbnvh.exe 1128 ddtvjft.exe 2760 drlxp.exe 2748 bdllfdt.exe 2592 hrjrd.exe 3068 bvndff.exe 1580 fpbdd.exe 2428 vlrbn.exe 1956 tnbtf.exe 2552 thxvxth.exe 2712 fnvbbb.exe 2572 nhvhtdj.exe 2492 vnfbl.exe 2536 nvrbjnt.exe 2376 rtbtn.exe 2520 djppbb.exe 2360 djhrn.exe 2056 ttpvdbt.exe 2392 dfdjfnr.exe 1124 thphpjb.exe 2640 lthltpv.exe 2668 hlnrprr.exe 3020 lbtxd.exe 2796 bbfhh.exe 1228 pnxbrd.exe 1196 jhndrt.exe 1068 xjvlb.exe 1968 jfrflr.exe 2016 jhltxhf.exe 620 dlhdjrd.exe 1680 pptxppn.exe 2444 jnjltx.exe 1204 lrfbv.exe 324 jtffp.exe 2848 bjxhpp.exe 2872 rdnlhl.exe 2844 hjdrjv.exe -
Processes:
resource yara_rule behavioral1/memory/1664-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1664-8-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\fjlfnr.exe upx behavioral1/memory/1352-14-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\dttblbp.exe upx behavioral1/memory/1664-7-0x00000000002C0000-0x00000000002F6000-memory.dmp upx behavioral1/memory/2884-28-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\vtplfvx.exe upx C:\xbbnb.exe upx behavioral1/memory/2492-47-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\dfddx.exe upx behavioral1/memory/2540-48-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2540-57-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\rbtxb.exe upx C:\jbbfjt.exe upx behavioral1/memory/2672-67-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\hbhxdh.exe upx behavioral1/memory/684-86-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\ndlxfhd.exe upx behavioral1/memory/2380-84-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/684-94-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\bxvjnvx.exe upx behavioral1/memory/1392-103-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\nhjnjl.exe upx behavioral1/memory/2452-113-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\xtvfbb.exe upx behavioral1/memory/2796-114-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2796-124-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\nxlvbdj.exe upx C:\bljhrxn.exe upx behavioral1/memory/1084-132-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\hvrttrf.exe upx behavioral1/memory/2152-149-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\ffftnrh.exe upx behavioral1/memory/2016-159-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/540-160-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\xjjbjt.exe upx C:\rjdvh.exe upx behavioral1/memory/540-169-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\fnlthb.exe upx \??\c:\fnbpr.exe upx behavioral1/memory/1512-185-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\vvptb.exe upx behavioral1/memory/1552-195-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1552-204-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\xndbrlh.exe upx C:\prdjx.exe upx C:\vjpnrv.exe upx behavioral1/memory/280-221-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2148-231-0x0000000000220000-0x0000000000256000-memory.dmp upx C:\jlpddt.exe upx behavioral1/memory/1560-241-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\dnxndxt.exe upx behavioral1/memory/1288-249-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\pxnbdv.exe upx behavioral1/memory/1872-252-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\rbnvh.exe upx C:\ddtvjft.exe upx C:\drlxp.exe upx \??\c:\bdllfdt.exe upx \??\c:\hrjrd.exe upx behavioral1/memory/2592-303-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1580-313-0x0000000077690000-0x000000007778A000-memory.dmp upx behavioral1/memory/1692-320-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c80cca9970613056bcfe795861817e5190f0e792593319b919a626e1406218a3.exefjlfnr.exedttblbp.exevtplfvx.exexbbnb.exedfddx.exerbtxb.exejbbfjt.exehbhxdh.exendlxfhd.exebxvjnvx.exenhjnjl.exextvfbb.exenxlvbdj.exebljhrxn.exehvrttrf.exedescription pid process target process PID 1664 wrote to memory of 1352 1664 c80cca9970613056bcfe795861817e5190f0e792593319b919a626e1406218a3.exe fjlfnr.exe PID 1664 wrote to memory of 1352 1664 c80cca9970613056bcfe795861817e5190f0e792593319b919a626e1406218a3.exe fjlfnr.exe PID 1664 wrote to memory of 1352 1664 c80cca9970613056bcfe795861817e5190f0e792593319b919a626e1406218a3.exe fjlfnr.exe PID 1664 wrote to memory of 1352 1664 c80cca9970613056bcfe795861817e5190f0e792593319b919a626e1406218a3.exe fjlfnr.exe PID 1352 wrote to memory of 2884 1352 fjlfnr.exe dttblbp.exe PID 1352 wrote to memory of 2884 1352 fjlfnr.exe dttblbp.exe PID 1352 wrote to memory of 2884 1352 fjlfnr.exe dttblbp.exe PID 1352 wrote to memory of 2884 1352 fjlfnr.exe dttblbp.exe PID 2884 wrote to memory of 2560 2884 dttblbp.exe vtplfvx.exe PID 2884 wrote to memory of 2560 2884 dttblbp.exe vtplfvx.exe PID 2884 wrote to memory of 2560 2884 dttblbp.exe vtplfvx.exe PID 2884 wrote to memory of 2560 2884 dttblbp.exe vtplfvx.exe PID 2560 wrote to memory of 2492 2560 vtplfvx.exe xbbnb.exe PID 2560 wrote to memory of 2492 2560 vtplfvx.exe xbbnb.exe PID 2560 wrote to memory of 2492 2560 vtplfvx.exe xbbnb.exe PID 2560 wrote to memory of 2492 2560 vtplfvx.exe xbbnb.exe PID 2492 wrote to memory of 2540 2492 xbbnb.exe dfddx.exe PID 2492 wrote to memory of 2540 2492 xbbnb.exe dfddx.exe PID 2492 wrote to memory of 2540 2492 xbbnb.exe dfddx.exe PID 2492 wrote to memory of 2540 2492 xbbnb.exe dfddx.exe PID 2540 wrote to memory of 2672 2540 dfddx.exe rbtxb.exe PID 2540 wrote to memory of 2672 2540 dfddx.exe rbtxb.exe PID 2540 wrote to memory of 2672 2540 dfddx.exe rbtxb.exe PID 2540 wrote to memory of 2672 2540 dfddx.exe rbtxb.exe PID 2672 wrote to memory of 2400 2672 rbtxb.exe jbbfjt.exe PID 2672 wrote to memory of 2400 2672 rbtxb.exe jbbfjt.exe PID 2672 wrote to memory of 2400 2672 rbtxb.exe jbbfjt.exe PID 2672 wrote to memory of 2400 2672 rbtxb.exe jbbfjt.exe PID 2400 wrote to memory of 2380 2400 jbbfjt.exe hbhxdh.exe PID 2400 wrote to memory of 2380 2400 jbbfjt.exe hbhxdh.exe PID 2400 wrote to memory of 2380 2400 jbbfjt.exe hbhxdh.exe PID 2400 wrote to memory of 2380 2400 jbbfjt.exe hbhxdh.exe PID 2380 wrote to memory of 684 2380 hbhxdh.exe ndlxfhd.exe PID 2380 wrote to memory of 684 2380 hbhxdh.exe ndlxfhd.exe PID 2380 wrote to memory of 684 2380 hbhxdh.exe ndlxfhd.exe PID 2380 wrote to memory of 684 2380 hbhxdh.exe ndlxfhd.exe PID 684 wrote to memory of 1392 684 ndlxfhd.exe bxvjnvx.exe PID 684 wrote to memory of 1392 684 ndlxfhd.exe bxvjnvx.exe PID 684 wrote to memory of 1392 684 ndlxfhd.exe bxvjnvx.exe PID 684 wrote to memory of 1392 684 ndlxfhd.exe bxvjnvx.exe PID 1392 wrote to memory of 2452 1392 bxvjnvx.exe nhjnjl.exe PID 1392 wrote to memory of 2452 1392 bxvjnvx.exe nhjnjl.exe PID 1392 wrote to memory of 2452 1392 bxvjnvx.exe nhjnjl.exe PID 1392 wrote to memory of 2452 1392 bxvjnvx.exe nhjnjl.exe PID 2452 wrote to memory of 2796 2452 nhjnjl.exe xtvfbb.exe PID 2452 wrote to memory of 2796 2452 nhjnjl.exe xtvfbb.exe PID 2452 wrote to memory of 2796 2452 nhjnjl.exe xtvfbb.exe PID 2452 wrote to memory of 2796 2452 nhjnjl.exe xtvfbb.exe PID 2796 wrote to memory of 1084 2796 xtvfbb.exe nxlvbdj.exe PID 2796 wrote to memory of 1084 2796 xtvfbb.exe nxlvbdj.exe PID 2796 wrote to memory of 1084 2796 xtvfbb.exe nxlvbdj.exe PID 2796 wrote to memory of 1084 2796 xtvfbb.exe nxlvbdj.exe PID 1084 wrote to memory of 1080 1084 nxlvbdj.exe bljhrxn.exe PID 1084 wrote to memory of 1080 1084 nxlvbdj.exe bljhrxn.exe PID 1084 wrote to memory of 1080 1084 nxlvbdj.exe bljhrxn.exe PID 1084 wrote to memory of 1080 1084 nxlvbdj.exe bljhrxn.exe PID 1080 wrote to memory of 2152 1080 bljhrxn.exe hvrttrf.exe PID 1080 wrote to memory of 2152 1080 bljhrxn.exe hvrttrf.exe PID 1080 wrote to memory of 2152 1080 bljhrxn.exe hvrttrf.exe PID 1080 wrote to memory of 2152 1080 bljhrxn.exe hvrttrf.exe PID 2152 wrote to memory of 2016 2152 hvrttrf.exe ffftnrh.exe PID 2152 wrote to memory of 2016 2152 hvrttrf.exe ffftnrh.exe PID 2152 wrote to memory of 2016 2152 hvrttrf.exe ffftnrh.exe PID 2152 wrote to memory of 2016 2152 hvrttrf.exe ffftnrh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c80cca9970613056bcfe795861817e5190f0e792593319b919a626e1406218a3.exe"C:\Users\Admin\AppData\Local\Temp\c80cca9970613056bcfe795861817e5190f0e792593319b919a626e1406218a3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\fjlfnr.exec:\fjlfnr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\dttblbp.exec:\dttblbp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\vtplfvx.exec:\vtplfvx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\xbbnb.exec:\xbbnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\dfddx.exec:\dfddx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\rbtxb.exec:\rbtxb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\jbbfjt.exec:\jbbfjt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\hbhxdh.exec:\hbhxdh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\ndlxfhd.exec:\ndlxfhd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\bxvjnvx.exec:\bxvjnvx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\nhjnjl.exec:\nhjnjl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\xtvfbb.exec:\xtvfbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\nxlvbdj.exec:\nxlvbdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\bljhrxn.exec:\bljhrxn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\hvrttrf.exec:\hvrttrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\ffftnrh.exec:\ffftnrh.exe17⤵
- Executes dropped EXE
PID:2016 -
\??\c:\xjjbjt.exec:\xjjbjt.exe18⤵
- Executes dropped EXE
PID:540 -
\??\c:\rjdvh.exec:\rjdvh.exe19⤵
- Executes dropped EXE
PID:1744 -
\??\c:\fnlthb.exec:\fnlthb.exe20⤵
- Executes dropped EXE
PID:1512 -
\??\c:\fnbpr.exec:\fnbpr.exe21⤵
- Executes dropped EXE
PID:2264 -
\??\c:\vvptb.exec:\vvptb.exe22⤵
- Executes dropped EXE
PID:1552 -
\??\c:\xndbrlh.exec:\xndbrlh.exe23⤵
- Executes dropped EXE
PID:2860 -
\??\c:\prdjx.exec:\prdjx.exe24⤵
- Executes dropped EXE
PID:280 -
\??\c:\vjpnrv.exec:\vjpnrv.exe25⤵
- Executes dropped EXE
PID:2148 -
\??\c:\jlpddt.exec:\jlpddt.exe26⤵
- Executes dropped EXE
PID:1560 -
\??\c:\dnxndxt.exec:\dnxndxt.exe27⤵
- Executes dropped EXE
PID:1288 -
\??\c:\pxnbdv.exec:\pxnbdv.exe28⤵
- Executes dropped EXE
PID:1872 -
\??\c:\rbnvh.exec:\rbnvh.exe29⤵
- Executes dropped EXE
PID:1964 -
\??\c:\ddtvjft.exec:\ddtvjft.exe30⤵
- Executes dropped EXE
PID:1128 -
\??\c:\drlxp.exec:\drlxp.exe31⤵
- Executes dropped EXE
PID:2760 -
\??\c:\bdllfdt.exec:\bdllfdt.exe32⤵
- Executes dropped EXE
PID:2748 -
\??\c:\hrjrd.exec:\hrjrd.exe33⤵
- Executes dropped EXE
PID:2592 -
\??\c:\bvndff.exec:\bvndff.exe34⤵
- Executes dropped EXE
PID:3068 -
\??\c:\fpbdd.exec:\fpbdd.exe35⤵
- Executes dropped EXE
PID:1580 -
\??\c:\frdxd.exec:\frdxd.exe36⤵PID:1692
-
\??\c:\vlrbn.exec:\vlrbn.exe37⤵
- Executes dropped EXE
PID:2428 -
\??\c:\tnbtf.exec:\tnbtf.exe38⤵
- Executes dropped EXE
PID:1956 -
\??\c:\thxvxth.exec:\thxvxth.exe39⤵
- Executes dropped EXE
PID:2552 -
\??\c:\fnvbbb.exec:\fnvbbb.exe40⤵
- Executes dropped EXE
PID:2712 -
\??\c:\nhvhtdj.exec:\nhvhtdj.exe41⤵
- Executes dropped EXE
PID:2572 -
\??\c:\vnfbl.exec:\vnfbl.exe42⤵
- Executes dropped EXE
PID:2492 -
\??\c:\nvrbjnt.exec:\nvrbjnt.exe43⤵
- Executes dropped EXE
PID:2536 -
\??\c:\rtbtn.exec:\rtbtn.exe44⤵
- Executes dropped EXE
PID:2376 -
\??\c:\djppbb.exec:\djppbb.exe45⤵
- Executes dropped EXE
PID:2520 -
\??\c:\djhrn.exec:\djhrn.exe46⤵
- Executes dropped EXE
PID:2360 -
\??\c:\ttpvdbt.exec:\ttpvdbt.exe47⤵
- Executes dropped EXE
PID:2056 -
\??\c:\dfdjfnr.exec:\dfdjfnr.exe48⤵
- Executes dropped EXE
PID:2392 -
\??\c:\thphpjb.exec:\thphpjb.exe49⤵
- Executes dropped EXE
PID:1124 -
\??\c:\lthltpv.exec:\lthltpv.exe50⤵
- Executes dropped EXE
PID:2640 -
\??\c:\hlnrprr.exec:\hlnrprr.exe51⤵
- Executes dropped EXE
PID:2668 -
\??\c:\lbtxd.exec:\lbtxd.exe52⤵
- Executes dropped EXE
PID:3020 -
\??\c:\bbfhh.exec:\bbfhh.exe53⤵
- Executes dropped EXE
PID:2796 -
\??\c:\pnxbrd.exec:\pnxbrd.exe54⤵
- Executes dropped EXE
PID:1228 -
\??\c:\jhndrt.exec:\jhndrt.exe55⤵
- Executes dropped EXE
PID:1196 -
\??\c:\xjvlb.exec:\xjvlb.exe56⤵
- Executes dropped EXE
PID:1068 -
\??\c:\jfrflr.exec:\jfrflr.exe57⤵
- Executes dropped EXE
PID:1968 -
\??\c:\jhltxhf.exec:\jhltxhf.exe58⤵
- Executes dropped EXE
PID:2016 -
\??\c:\dlhdjrd.exec:\dlhdjrd.exe59⤵
- Executes dropped EXE
PID:620 -
\??\c:\pptxppn.exec:\pptxppn.exe60⤵
- Executes dropped EXE
PID:1680 -
\??\c:\jnjltx.exec:\jnjltx.exe61⤵
- Executes dropped EXE
PID:2444 -
\??\c:\lrfbv.exec:\lrfbv.exe62⤵
- Executes dropped EXE
PID:1204 -
\??\c:\jtffp.exec:\jtffp.exe63⤵
- Executes dropped EXE
PID:324 -
\??\c:\bjxhpp.exec:\bjxhpp.exe64⤵
- Executes dropped EXE
PID:2848 -
\??\c:\rdnlhl.exec:\rdnlhl.exe65⤵
- Executes dropped EXE
PID:2872 -
\??\c:\hjdrjv.exec:\hjdrjv.exe66⤵
- Executes dropped EXE
PID:2844 -
\??\c:\dbfnt.exec:\dbfnt.exe67⤵PID:1144
-
\??\c:\lxfvp.exec:\lxfvp.exe68⤵PID:696
-
\??\c:\vhltlv.exec:\vhltlv.exe69⤵PID:1548
-
\??\c:\hvdrrbv.exec:\hvdrrbv.exe70⤵PID:2768
-
\??\c:\drbfp.exec:\drbfp.exe71⤵PID:2908
-
\??\c:\xdjhhl.exec:\xdjhhl.exe72⤵PID:2996
-
\??\c:\rftbtjn.exec:\rftbtjn.exe73⤵PID:1520
-
\??\c:\fnfbr.exec:\fnfbr.exe74⤵PID:1708
-
\??\c:\pdjxf.exec:\pdjxf.exe75⤵PID:2124
-
\??\c:\ndrpdht.exec:\ndrpdht.exe76⤵PID:2296
-
\??\c:\xplxhlv.exec:\xplxhlv.exe77⤵PID:2592
-
\??\c:\jbjpdj.exec:\jbjpdj.exe78⤵PID:2716
-
\??\c:\dtpdhll.exec:\dtpdhll.exe79⤵PID:1484
-
\??\c:\hjprt.exec:\hjprt.exe80⤵PID:2224
-
\??\c:\pfnnfh.exec:\pfnnfh.exe81⤵PID:2532
-
\??\c:\rhljfn.exec:\rhljfn.exe82⤵PID:2856
-
\??\c:\vptdh.exec:\vptdh.exe83⤵PID:2608
-
\??\c:\dpphphh.exec:\dpphphh.exe84⤵PID:2508
-
\??\c:\tnvvntv.exec:\tnvvntv.exe85⤵PID:2084
-
\??\c:\jplrlr.exec:\jplrlr.exe86⤵PID:2384
-
\??\c:\xvtdtnd.exec:\xvtdtnd.exe87⤵PID:2540
-
\??\c:\nxlxt.exec:\nxlxt.exe88⤵PID:2536
-
\??\c:\xhtljp.exec:\xhtljp.exe89⤵PID:2376
-
\??\c:\xbpbj.exec:\xbpbj.exe90⤵PID:2352
-
\??\c:\lvpptj.exec:\lvpptj.exe91⤵PID:564
-
\??\c:\fxhbpvp.exec:\fxhbpvp.exe92⤵PID:960
-
\??\c:\xlnbtjp.exec:\xlnbtjp.exe93⤵PID:2392
-
\??\c:\dtftjd.exec:\dtftjd.exe94⤵PID:2676
-
\??\c:\ldlhvhj.exec:\ldlhvhj.exe95⤵PID:2640
-
\??\c:\rppjbx.exec:\rppjbx.exe96⤵PID:1800
-
\??\c:\vxdlf.exec:\vxdlf.exe97⤵PID:1796
-
\??\c:\nrdrfxt.exec:\nrdrfxt.exe98⤵PID:2308
-
\??\c:\fvnnnh.exec:\fvnnnh.exe99⤵PID:752
-
\??\c:\rhtjrjl.exec:\rhtjrjl.exe100⤵PID:2008
-
\??\c:\vjfxdxf.exec:\vjfxdxf.exe101⤵PID:1080
-
\??\c:\vltjbtp.exec:\vltjbtp.exe102⤵PID:1072
-
\??\c:\rlphvp.exec:\rlphvp.exe103⤵PID:1820
-
\??\c:\vvjnld.exec:\vvjnld.exe104⤵PID:1776
-
\??\c:\dpdvp.exec:\dpdvp.exe105⤵PID:916
-
\??\c:\hbhltfn.exec:\hbhltfn.exe106⤵PID:1680
-
\??\c:\vltprdr.exec:\vltprdr.exe107⤵PID:1344
-
\??\c:\fhbdhdf.exec:\fhbdhdf.exe108⤵PID:1732
-
\??\c:\jbttnn.exec:\jbttnn.exe109⤵PID:1728
-
\??\c:\rxjhpv.exec:\rxjhpv.exe110⤵PID:372
-
\??\c:\vljbnf.exec:\vljbnf.exe111⤵PID:2896
-
\??\c:\vjjdxnr.exec:\vjjdxnr.exe112⤵PID:668
-
\??\c:\jfptbtj.exec:\jfptbtj.exe113⤵PID:644
-
\??\c:\nrnjtlr.exec:\nrnjtlr.exe114⤵PID:2268
-
\??\c:\htnrdh.exec:\htnrdh.exe115⤵PID:1560
-
\??\c:\hpxnp.exec:\hpxnp.exe116⤵PID:888
-
\??\c:\fllxn.exec:\fllxn.exe117⤵PID:552
-
\??\c:\fthld.exec:\fthld.exe118⤵PID:1536
-
\??\c:\lbjtrpj.exec:\lbjtrpj.exe119⤵PID:2416
-
\??\c:\rxtpf.exec:\rxtpf.exe120⤵PID:1708
-
\??\c:\hljnf.exec:\hljnf.exe121⤵PID:1972
-
\??\c:\dxlfd.exec:\dxlfd.exe122⤵PID:3000
-
\??\c:\tdltlt.exec:\tdltlt.exe123⤵PID:1588
-
\??\c:\xptlff.exec:\xptlff.exe124⤵PID:3068
-
\??\c:\jtbprv.exec:\jtbprv.exe125⤵PID:900
-
\??\c:\tdxpv.exec:\tdxpv.exe126⤵PID:2440
-
\??\c:\rnffv.exec:\rnffv.exe127⤵PID:2788
-
\??\c:\jvddhj.exec:\jvddhj.exe128⤵PID:2584
-
\??\c:\xltfl.exec:\xltfl.exe129⤵PID:2760
-
\??\c:\lbdtrj.exec:\lbdtrj.exe130⤵PID:2356
-
\??\c:\tlfxblv.exec:\tlfxblv.exe131⤵PID:2624
-
\??\c:\hnhnxh.exec:\hnhnxh.exe132⤵PID:1212
-
\??\c:\bxvlvrd.exec:\bxvlvrd.exe133⤵PID:2828
-
\??\c:\xpttjr.exec:\xpttjr.exe134⤵PID:2344
-
\??\c:\dhltfx.exec:\dhltfx.exe135⤵PID:2200
-
\??\c:\lfrxbt.exec:\lfrxbt.exe136⤵PID:2364
-
\??\c:\hfpvvv.exec:\hfpvvv.exe137⤵PID:564
-
\??\c:\dxvfpdn.exec:\dxvfpdn.exe138⤵PID:2604
-
\??\c:\fddfd.exec:\fddfd.exe139⤵PID:2388
-
\??\c:\frvlhfj.exec:\frvlhfj.exe140⤵PID:2692
-
\??\c:\xllxj.exec:\xllxj.exe141⤵PID:2128
-
\??\c:\dnfrjhd.exec:\dnfrjhd.exe142⤵PID:1672
-
\??\c:\hlvvr.exec:\hlvvr.exe143⤵PID:2040
-
\??\c:\phtlbtt.exec:\phtlbtt.exe144⤵PID:1304
-
\??\c:\jpptnd.exec:\jpptnd.exe145⤵PID:2032
-
\??\c:\thtrdj.exec:\thtrdj.exe146⤵PID:1196
-
\??\c:\jbttj.exec:\jbttj.exe147⤵PID:1068
-
\??\c:\xfrxnjj.exec:\xfrxnjj.exe148⤵PID:1824
-
\??\c:\thxxftr.exec:\thxxftr.exe149⤵PID:816
-
\??\c:\rprpt.exec:\rprpt.exe150⤵PID:1744
-
\??\c:\hhtlh.exec:\hhtlh.exe151⤵PID:936
-
\??\c:\pjpfd.exec:\pjpfd.exe152⤵PID:3004
-
\??\c:\pvvtxth.exec:\pvvtxth.exe153⤵PID:324
-
\??\c:\tfvfbvj.exec:\tfvfbvj.exe154⤵PID:2864
-
\??\c:\rnphhb.exec:\rnphhb.exe155⤵PID:2928
-
\??\c:\ntxprth.exec:\ntxprth.exe156⤵PID:2064
-
\??\c:\tddlhvx.exec:\tddlhvx.exe157⤵PID:3008
-
\??\c:\jnlnl.exec:\jnlnl.exe158⤵PID:340
-
\??\c:\jnhllbj.exec:\jnhllbj.exe159⤵PID:1780
-
\??\c:\bhnjjpv.exec:\bhnjjpv.exe160⤵PID:2248
-
\??\c:\lrppxbj.exec:\lrppxbj.exe161⤵PID:320
-
\??\c:\bhlbd.exec:\bhlbd.exe162⤵PID:2740
-
\??\c:\dfvrxh.exec:\dfvrxh.exe163⤵PID:1520
-
\??\c:\ndhtfx.exec:\ndhtfx.exe164⤵PID:920
-
\??\c:\fjtdvl.exec:\fjtdvl.exe165⤵PID:2748
-
\??\c:\xvfxxp.exec:\xvfxxp.exe166⤵PID:2316
-
\??\c:\vlptdf.exec:\vlptdf.exe167⤵PID:1664
-
\??\c:\rpthpp.exec:\rpthpp.exe168⤵PID:2028
-
\??\c:\xxrxj.exec:\xxrxj.exe169⤵PID:1076
-
\??\c:\lpvjvx.exec:\lpvjvx.exe170⤵PID:1692
-
\??\c:\nfvvtb.exec:\nfvvtb.exe171⤵PID:2628
-
\??\c:\njjbjjd.exec:\njjbjjd.exe172⤵PID:2852
-
\??\c:\rvrxnrt.exec:\rvrxnrt.exe173⤵PID:1956
-
\??\c:\tvvhv.exec:\tvvhv.exe174⤵PID:2556
-
\??\c:\hjvrn.exec:\hjvrn.exe175⤵PID:2484
-
\??\c:\pjvhxbf.exec:\pjvhxbf.exe176⤵PID:2476
-
\??\c:\ttdbnxj.exec:\ttdbnxj.exe177⤵PID:2876
-
\??\c:\vpjldf.exec:\vpjldf.exe178⤵PID:2384
-
\??\c:\tnlfhfl.exec:\tnlfhfl.exe179⤵PID:2616
-
\??\c:\bvphllv.exec:\bvphllv.exe180⤵PID:2540
-
\??\c:\lflnvvx.exec:\lflnvvx.exe181⤵PID:2424
-
\??\c:\fnjdtf.exec:\fnjdtf.exe182⤵PID:2620
-
\??\c:\ftfftnp.exec:\ftfftnp.exe183⤵PID:572
-
\??\c:\lnbbjdd.exec:\lnbbjdd.exe184⤵PID:1508
-
\??\c:\bxtlhnv.exec:\bxtlhnv.exe185⤵PID:756
-
\??\c:\lnbhlnj.exec:\lnbhlnj.exe186⤵PID:2588
-
\??\c:\rjpjdnd.exec:\rjpjdnd.exe187⤵PID:488
-
\??\c:\ljlrdx.exec:\ljlrdx.exe188⤵PID:536
-
\??\c:\xrpjhfn.exec:\xrpjhfn.exe189⤵PID:2520
-
\??\c:\xpfbnvx.exec:\xpfbnvx.exe190⤵PID:2320
-
\??\c:\xbvjf.exec:\xbvjf.exe191⤵PID:2308
-
\??\c:\ljxvbxp.exec:\ljxvbxp.exe192⤵PID:1228
-
\??\c:\xjxxl.exec:\xjxxl.exe193⤵PID:2172
-
\??\c:\bjdvpxl.exec:\bjdvpxl.exe194⤵PID:1424
-
\??\c:\lxdrdnp.exec:\lxdrdnp.exe195⤵PID:1196
-
\??\c:\pdljjvh.exec:\pdljjvh.exe196⤵PID:1748
-
\??\c:\rpndjxj.exec:\rpndjxj.exe197⤵PID:848
-
\??\c:\ppjpvh.exec:\ppjpvh.exe198⤵PID:1752
-
\??\c:\txnrnhl.exec:\txnrnhl.exe199⤵PID:1744
-
\??\c:\jxvdnjx.exec:\jxvdnjx.exe200⤵PID:1344
-
\??\c:\bxjnt.exec:\bxjnt.exe201⤵PID:2892
-
\??\c:\lxjvfb.exec:\lxjvfb.exe202⤵PID:1676
-
\??\c:\blhxrdx.exec:\blhxrdx.exe203⤵PID:2860
-
\??\c:\nnblt.exec:\nnblt.exe204⤵PID:2848
-
\??\c:\flxvd.exec:\flxvd.exe205⤵PID:1836
-
\??\c:\hptfxpp.exec:\hptfxpp.exe206⤵PID:668
-
\??\c:\xxhtlv.exec:\xxhtlv.exe207⤵PID:1144
-
\??\c:\nfxlbb.exec:\nfxlbb.exe208⤵PID:964
-
\??\c:\tvtft.exec:\tvtft.exe209⤵PID:1548
-
\??\c:\vvddlph.exec:\vvddlph.exe210⤵PID:1324
-
\??\c:\thnvt.exec:\thnvt.exe211⤵PID:1792
-
\??\c:\lhhttn.exec:\lhhttn.exe212⤵PID:2740
-
\??\c:\phpvjlr.exec:\phpvjlr.exe213⤵PID:1980
-
\??\c:\fpdxl.exec:\fpdxl.exe214⤵PID:864
-
\??\c:\xjrttbh.exec:\xjrttbh.exe215⤵PID:2044
-
\??\c:\dnbphn.exec:\dnbphn.exe216⤵PID:1624
-
\??\c:\bbrfff.exec:\bbrfff.exe217⤵PID:1580
-
\??\c:\trrvhjr.exec:\trrvhjr.exe218⤵PID:1740
-
\??\c:\jxptntn.exec:\jxptntn.exe219⤵PID:1588
-
\??\c:\jxxtd.exec:\jxxtd.exe220⤵PID:2808
-
\??\c:\trnjxjb.exec:\trnjxjb.exe221⤵PID:1988
-
\??\c:\bjhxbd.exec:\bjhxbd.exe222⤵PID:2428
-
\??\c:\rpbvpdb.exec:\rpbvpdb.exe223⤵PID:2496
-
\??\c:\pjxxbx.exec:\pjxxbx.exe224⤵PID:3024
-
\??\c:\jjdbrf.exec:\jjdbrf.exe225⤵PID:2708
-
\??\c:\dvfdft.exec:\dvfdft.exe226⤵PID:2704
-
\??\c:\dhhfr.exec:\dhhfr.exe227⤵PID:2876
-
\??\c:\dvxfbbv.exec:\dvxfbbv.exe228⤵PID:2384
-
\??\c:\fxtbr.exec:\fxtbr.exe229⤵PID:2400
-
\??\c:\pxjlv.exec:\pxjlv.exe230⤵PID:2540
-
\??\c:\fhhvpl.exec:\fhhvpl.exe231⤵PID:1476
-
\??\c:\lfpfx.exec:\lfpfx.exe232⤵PID:832
-
\??\c:\tbnnvt.exec:\tbnnvt.exe233⤵PID:1852
-
\??\c:\xxthp.exec:\xxthp.exe234⤵PID:2396
-
\??\c:\nhjvrhp.exec:\nhjvrhp.exe235⤵PID:2676
-
\??\c:\lpvxxt.exec:\lpvxxt.exe236⤵PID:3028
-
\??\c:\jpfttn.exec:\jpfttn.exe237⤵PID:2764
-
\??\c:\brdvxn.exec:\brdvxn.exe238⤵PID:536
-
\??\c:\ppttp.exec:\ppttp.exe239⤵PID:2520
-
\??\c:\jpndjf.exec:\jpndjf.exe240⤵PID:2320
-
\??\c:\bnhjnvl.exec:\bnhjnvl.exe241⤵PID:2796
-
\??\c:\dpvtr.exec:\dpvtr.exe242⤵PID:1228