Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 20:39
Behavioral task
behavioral1
Sample
0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781.exe
Resource
win7-20240508-en
General
-
Target
0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781.exe
-
Size
329KB
-
MD5
06b0facf85ce6ccf71cc9ea2c4b09400
-
SHA1
950a3307b8cf758a82b87906de6d0e5bbc44784b
-
SHA256
0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781
-
SHA512
ba3e548704a1ddf6653cc0d36f541ab29c31c4342db19acd9c543667972358171e1fed0afecc770d1abe2127007bf36881d5af2011bd449d0f82223a77b0e6ef
-
SSDEEP
6144:3cm7ImGddXsJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tPhY:F7Tc8JdSjylh2b77BoTMA9gX59sTsuTI
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4072-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4072-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2788-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4308-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3336-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2220-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/552-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2620-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1988-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3640-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3464-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2164-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/556-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2280-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1044-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2552-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4128-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1016-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4440-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3104-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2868-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1424-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1908-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/960-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4616-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3336-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1504-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/60-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/428-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4604-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/908-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3960-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4088-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4128-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2868-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3064-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4288-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1244-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3764-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2124-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4628-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1948-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3948-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1992-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3076-542-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3640-561-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2104-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-605-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-642-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1960-732-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1388-911-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-912-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4132-1056-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\ppjpp.exe family_berbew \??\c:\ntnhnt.exe family_berbew C:\djpvj.exe family_berbew C:\hbthnh.exe family_berbew C:\btntbh.exe family_berbew C:\jpjpv.exe family_berbew C:\fxxffff.exe family_berbew C:\hhhtht.exe family_berbew C:\fflllrl.exe family_berbew C:\dvjdd.exe family_berbew C:\ttnntt.exe family_berbew C:\xlxxrlf.exe family_berbew \??\c:\jpdjd.exe family_berbew \??\c:\lxxxxxf.exe family_berbew \??\c:\nbhhhn.exe family_berbew C:\xllrxfx.exe family_berbew C:\pjpjd.exe family_berbew C:\nbbhnn.exe family_berbew C:\jpdvv.exe family_berbew C:\fffllll.exe family_berbew C:\ppppp.exe family_berbew C:\rfrrffl.exe family_berbew \??\c:\ttnnbt.exe family_berbew \??\c:\dvdvv.exe family_berbew C:\tbbtnn.exe family_berbew \??\c:\tbtbbb.exe family_berbew C:\llxflxr.exe family_berbew C:\rlrxrrr.exe family_berbew C:\bnnhnn.exe family_berbew C:\xlllxxx.exe family_berbew C:\btbttn.exe family_berbew \??\c:\dpjvp.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
ppjpp.exentnhnt.exedjpvj.exehbthnh.exebtntbh.exejpjpv.exefxxffff.exehhhtht.exefflllrl.exedvjdd.exettnntt.exexlxxrlf.exejpdjd.exelxxxxxf.exenbhhhn.exexllrxfx.exepjpjd.exenbbhnn.exejpdvv.exefffllll.exeppppp.exerfrrffl.exettnnbt.exedvdvv.exetbbtnn.exetbtbbb.exellxflxr.exerlrxrrr.exebnnhnn.exexlllxxx.exebtbttn.exedpjvp.exellllfxx.exeppjjd.exefrxrlff.exevdjjj.exe5vdvv.exefrxxxxr.exethnhbh.exejjjdd.exefrrrlrf.exebbhttb.exedpppv.exexlfxrlf.exehhbtbt.exeppjvd.exedvdvp.exefxlfxrl.exe7tnhnn.exejjppv.exehhhhtn.exethbbtb.exexxlllrr.exerfllllr.exetbbhbh.exelfxflfl.exettbtnh.exepjjdd.exerrrlflx.exetthhbt.exeppddv.exe3ddvv.exexffrrxf.exenbtnbb.exepid process 3336 ppjpp.exe 2788 ntnhnt.exe 4308 djpvj.exe 4792 hbthnh.exe 2220 btntbh.exe 552 jpjpv.exe 2620 fxxffff.exe 1988 hhhtht.exe 3640 fflllrl.exe 3464 dvjdd.exe 2164 ttnntt.exe 4776 xlxxrlf.exe 1624 jpdjd.exe 5000 lxxxxxf.exe 1604 nbhhhn.exe 556 xllrxfx.exe 2468 pjpjd.exe 844 nbbhnn.exe 2280 jpdvv.exe 1044 fffllll.exe 2976 ppppp.exe 2552 rfrrffl.exe 4128 ttnnbt.exe 920 dvdvv.exe 1016 tbbtnn.exe 4440 tbtbbb.exe 884 llxflxr.exe 3104 rlrxrrr.exe 4572 bnnhnn.exe 2868 xlllxxx.exe 4988 btbttn.exe 4468 dpjvp.exe 1424 llllfxx.exe 1908 ppjjd.exe 4092 frxrlff.exe 4452 vdjjj.exe 5036 5vdvv.exe 960 frxxxxr.exe 4616 thnhbh.exe 3188 jjjdd.exe 4612 frrrlrf.exe 3024 bbhttb.exe 3336 dpppv.exe 1504 xlfxrlf.exe 1856 hhbtbt.exe 4548 ppjvd.exe 4792 dvdvp.exe 60 fxlfxrl.exe 1004 7tnhnn.exe 4356 jjppv.exe 4428 hhhhtn.exe 2440 thbbtb.exe 516 xxlllrr.exe 4980 rfllllr.exe 2164 tbbhbh.exe 3240 lfxflfl.exe 428 ttbtnh.exe 1624 pjjdd.exe 4604 rrrlflx.exe 908 tthhbt.exe 3208 ppddv.exe 3468 3ddvv.exe 844 xffrrxf.exe 4728 nbtnbb.exe -
Processes:
resource yara_rule behavioral2/memory/4072-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4072-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2788-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4308-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3336-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2220-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/552-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2620-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1988-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3640-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3464-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2164-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1604-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/556-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2468-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2280-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1044-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2552-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4128-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1016-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4440-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3104-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1424-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1908-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/960-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4616-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3336-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/60-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4428-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/516-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/428-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4604-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/908-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3960-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4088-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4128-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3064-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4288-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1244-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3764-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2124-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4628-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2788-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1960-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1948-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3948-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1992-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3064-502-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781.exeppjpp.exentnhnt.exedjpvj.exehbthnh.exebtntbh.exejpjpv.exefxxffff.exehhhtht.exefflllrl.exedvjdd.exettnntt.exexlxxrlf.exejpdjd.exelxxxxxf.exenbhhhn.exexllrxfx.exepjpjd.exenbbhnn.exejpdvv.exefffllll.exeppppp.exedescription pid process target process PID 4072 wrote to memory of 3336 4072 0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781.exe ppjpp.exe PID 4072 wrote to memory of 3336 4072 0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781.exe ppjpp.exe PID 4072 wrote to memory of 3336 4072 0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781.exe ppjpp.exe PID 3336 wrote to memory of 2788 3336 ppjpp.exe ntnhnt.exe PID 3336 wrote to memory of 2788 3336 ppjpp.exe ntnhnt.exe PID 3336 wrote to memory of 2788 3336 ppjpp.exe ntnhnt.exe PID 2788 wrote to memory of 4308 2788 ntnhnt.exe djpvj.exe PID 2788 wrote to memory of 4308 2788 ntnhnt.exe djpvj.exe PID 2788 wrote to memory of 4308 2788 ntnhnt.exe djpvj.exe PID 4308 wrote to memory of 4792 4308 djpvj.exe hbthnh.exe PID 4308 wrote to memory of 4792 4308 djpvj.exe hbthnh.exe PID 4308 wrote to memory of 4792 4308 djpvj.exe hbthnh.exe PID 4792 wrote to memory of 2220 4792 hbthnh.exe btntbh.exe PID 4792 wrote to memory of 2220 4792 hbthnh.exe btntbh.exe PID 4792 wrote to memory of 2220 4792 hbthnh.exe btntbh.exe PID 2220 wrote to memory of 552 2220 btntbh.exe jpjpv.exe PID 2220 wrote to memory of 552 2220 btntbh.exe jpjpv.exe PID 2220 wrote to memory of 552 2220 btntbh.exe jpjpv.exe PID 552 wrote to memory of 2620 552 jpjpv.exe fxxffff.exe PID 552 wrote to memory of 2620 552 jpjpv.exe fxxffff.exe PID 552 wrote to memory of 2620 552 jpjpv.exe fxxffff.exe PID 2620 wrote to memory of 1988 2620 fxxffff.exe hhhtht.exe PID 2620 wrote to memory of 1988 2620 fxxffff.exe hhhtht.exe PID 2620 wrote to memory of 1988 2620 fxxffff.exe hhhtht.exe PID 1988 wrote to memory of 3640 1988 hhhtht.exe fflllrl.exe PID 1988 wrote to memory of 3640 1988 hhhtht.exe fflllrl.exe PID 1988 wrote to memory of 3640 1988 hhhtht.exe fflllrl.exe PID 3640 wrote to memory of 3464 3640 fflllrl.exe dvjdd.exe PID 3640 wrote to memory of 3464 3640 fflllrl.exe dvjdd.exe PID 3640 wrote to memory of 3464 3640 fflllrl.exe dvjdd.exe PID 3464 wrote to memory of 2164 3464 dvjdd.exe ttnntt.exe PID 3464 wrote to memory of 2164 3464 dvjdd.exe ttnntt.exe PID 3464 wrote to memory of 2164 3464 dvjdd.exe ttnntt.exe PID 2164 wrote to memory of 4776 2164 ttnntt.exe xlxxrlf.exe PID 2164 wrote to memory of 4776 2164 ttnntt.exe xlxxrlf.exe PID 2164 wrote to memory of 4776 2164 ttnntt.exe xlxxrlf.exe PID 4776 wrote to memory of 1624 4776 xlxxrlf.exe jpdjd.exe PID 4776 wrote to memory of 1624 4776 xlxxrlf.exe jpdjd.exe PID 4776 wrote to memory of 1624 4776 xlxxrlf.exe jpdjd.exe PID 1624 wrote to memory of 5000 1624 jpdjd.exe lxxxxxf.exe PID 1624 wrote to memory of 5000 1624 jpdjd.exe lxxxxxf.exe PID 1624 wrote to memory of 5000 1624 jpdjd.exe lxxxxxf.exe PID 5000 wrote to memory of 1604 5000 lxxxxxf.exe nbhhhn.exe PID 5000 wrote to memory of 1604 5000 lxxxxxf.exe nbhhhn.exe PID 5000 wrote to memory of 1604 5000 lxxxxxf.exe nbhhhn.exe PID 1604 wrote to memory of 556 1604 nbhhhn.exe xllrxfx.exe PID 1604 wrote to memory of 556 1604 nbhhhn.exe xllrxfx.exe PID 1604 wrote to memory of 556 1604 nbhhhn.exe xllrxfx.exe PID 556 wrote to memory of 2468 556 xllrxfx.exe pjpjd.exe PID 556 wrote to memory of 2468 556 xllrxfx.exe pjpjd.exe PID 556 wrote to memory of 2468 556 xllrxfx.exe pjpjd.exe PID 2468 wrote to memory of 844 2468 pjpjd.exe nbbhnn.exe PID 2468 wrote to memory of 844 2468 pjpjd.exe nbbhnn.exe PID 2468 wrote to memory of 844 2468 pjpjd.exe nbbhnn.exe PID 844 wrote to memory of 2280 844 nbbhnn.exe jpdvv.exe PID 844 wrote to memory of 2280 844 nbbhnn.exe jpdvv.exe PID 844 wrote to memory of 2280 844 nbbhnn.exe jpdvv.exe PID 2280 wrote to memory of 1044 2280 jpdvv.exe fffllll.exe PID 2280 wrote to memory of 1044 2280 jpdvv.exe fffllll.exe PID 2280 wrote to memory of 1044 2280 jpdvv.exe fffllll.exe PID 1044 wrote to memory of 2976 1044 fffllll.exe ppppp.exe PID 1044 wrote to memory of 2976 1044 fffllll.exe ppppp.exe PID 1044 wrote to memory of 2976 1044 fffllll.exe ppppp.exe PID 2976 wrote to memory of 2552 2976 ppppp.exe rfrrffl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781.exe"C:\Users\Admin\AppData\Local\Temp\0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4072 -
\??\c:\ppjpp.exec:\ppjpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
\??\c:\ntnhnt.exec:\ntnhnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\djpvj.exec:\djpvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\hbthnh.exec:\hbthnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\btntbh.exec:\btntbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\jpjpv.exec:\jpjpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\fxxffff.exec:\fxxffff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\hhhtht.exec:\hhhtht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\fflllrl.exec:\fflllrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\dvjdd.exec:\dvjdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
\??\c:\ttnntt.exec:\ttnntt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\xlxxrlf.exec:\xlxxrlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\jpdjd.exec:\jpdjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\lxxxxxf.exec:\lxxxxxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\nbhhhn.exec:\nbhhhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\xllrxfx.exec:\xllrxfx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\pjpjd.exec:\pjpjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\nbbhnn.exec:\nbbhnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\jpdvv.exec:\jpdvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\fffllll.exec:\fffllll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\ppppp.exec:\ppppp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\rfrrffl.exec:\rfrrffl.exe23⤵
- Executes dropped EXE
PID:2552 -
\??\c:\ttnnbt.exec:\ttnnbt.exe24⤵
- Executes dropped EXE
PID:4128 -
\??\c:\dvdvv.exec:\dvdvv.exe25⤵
- Executes dropped EXE
PID:920 -
\??\c:\tbbtnn.exec:\tbbtnn.exe26⤵
- Executes dropped EXE
PID:1016 -
\??\c:\tbtbbb.exec:\tbtbbb.exe27⤵
- Executes dropped EXE
PID:4440 -
\??\c:\llxflxr.exec:\llxflxr.exe28⤵
- Executes dropped EXE
PID:884 -
\??\c:\rlrxrrr.exec:\rlrxrrr.exe29⤵
- Executes dropped EXE
PID:3104 -
\??\c:\bnnhnn.exec:\bnnhnn.exe30⤵
- Executes dropped EXE
PID:4572 -
\??\c:\xlllxxx.exec:\xlllxxx.exe31⤵
- Executes dropped EXE
PID:2868 -
\??\c:\btbttn.exec:\btbttn.exe32⤵
- Executes dropped EXE
PID:4988 -
\??\c:\dpjvp.exec:\dpjvp.exe33⤵
- Executes dropped EXE
PID:4468 -
\??\c:\llllfxx.exec:\llllfxx.exe34⤵
- Executes dropped EXE
PID:1424 -
\??\c:\ppjjd.exec:\ppjjd.exe35⤵
- Executes dropped EXE
PID:1908 -
\??\c:\frxrlff.exec:\frxrlff.exe36⤵
- Executes dropped EXE
PID:4092 -
\??\c:\vdjjj.exec:\vdjjj.exe37⤵
- Executes dropped EXE
PID:4452 -
\??\c:\5vdvv.exec:\5vdvv.exe38⤵
- Executes dropped EXE
PID:5036 -
\??\c:\frxxxxr.exec:\frxxxxr.exe39⤵
- Executes dropped EXE
PID:960 -
\??\c:\thnhbh.exec:\thnhbh.exe40⤵
- Executes dropped EXE
PID:4616 -
\??\c:\jjjdd.exec:\jjjdd.exe41⤵
- Executes dropped EXE
PID:3188 -
\??\c:\frrrlrf.exec:\frrrlrf.exe42⤵
- Executes dropped EXE
PID:4612 -
\??\c:\bbhttb.exec:\bbhttb.exe43⤵
- Executes dropped EXE
PID:3024 -
\??\c:\dpppv.exec:\dpppv.exe44⤵
- Executes dropped EXE
PID:3336 -
\??\c:\xlfxrlf.exec:\xlfxrlf.exe45⤵
- Executes dropped EXE
PID:1504 -
\??\c:\hhbtbt.exec:\hhbtbt.exe46⤵
- Executes dropped EXE
PID:1856 -
\??\c:\ppjvd.exec:\ppjvd.exe47⤵
- Executes dropped EXE
PID:4548 -
\??\c:\dvdvp.exec:\dvdvp.exe48⤵
- Executes dropped EXE
PID:4792 -
\??\c:\fxlfxrl.exec:\fxlfxrl.exe49⤵
- Executes dropped EXE
PID:60 -
\??\c:\7tnhnn.exec:\7tnhnn.exe50⤵
- Executes dropped EXE
PID:1004 -
\??\c:\jjppv.exec:\jjppv.exe51⤵
- Executes dropped EXE
PID:4356 -
\??\c:\hhhhtn.exec:\hhhhtn.exe52⤵
- Executes dropped EXE
PID:4428 -
\??\c:\thbbtb.exec:\thbbtb.exe53⤵
- Executes dropped EXE
PID:2440 -
\??\c:\xxlllrr.exec:\xxlllrr.exe54⤵
- Executes dropped EXE
PID:516 -
\??\c:\rfllllr.exec:\rfllllr.exe55⤵
- Executes dropped EXE
PID:4980 -
\??\c:\tbbhbh.exec:\tbbhbh.exe56⤵
- Executes dropped EXE
PID:2164 -
\??\c:\lfxflfl.exec:\lfxflfl.exe57⤵
- Executes dropped EXE
PID:3240 -
\??\c:\ttbtnh.exec:\ttbtnh.exe58⤵
- Executes dropped EXE
PID:428 -
\??\c:\pjjdd.exec:\pjjdd.exe59⤵
- Executes dropped EXE
PID:1624 -
\??\c:\rrrlflx.exec:\rrrlflx.exe60⤵
- Executes dropped EXE
PID:4604 -
\??\c:\tthhbt.exec:\tthhbt.exe61⤵
- Executes dropped EXE
PID:908 -
\??\c:\ppddv.exec:\ppddv.exe62⤵
- Executes dropped EXE
PID:3208 -
\??\c:\3ddvv.exec:\3ddvv.exe63⤵
- Executes dropped EXE
PID:3468 -
\??\c:\xffrrxf.exec:\xffrrxf.exe64⤵
- Executes dropped EXE
PID:844 -
\??\c:\nbtnbb.exec:\nbtnbb.exe65⤵
- Executes dropped EXE
PID:4728 -
\??\c:\dvddp.exec:\dvddp.exe66⤵PID:4760
-
\??\c:\llfxlll.exec:\llfxlll.exe67⤵PID:3960
-
\??\c:\bhnnnn.exec:\bhnnnn.exe68⤵PID:4088
-
\??\c:\pvdvd.exec:\pvdvd.exe69⤵PID:2464
-
\??\c:\frxxrxr.exec:\frxxrxr.exe70⤵PID:4128
-
\??\c:\tnbbth.exec:\tnbbth.exe71⤵PID:3268
-
\??\c:\hhbnnh.exec:\hhbnnh.exe72⤵PID:1540
-
\??\c:\jjppv.exec:\jjppv.exe73⤵PID:3988
-
\??\c:\3xxxrrl.exec:\3xxxrrl.exe74⤵PID:4436
-
\??\c:\tnnbnb.exec:\tnnbnb.exe75⤵PID:884
-
\??\c:\tnhtnn.exec:\tnhtnn.exe76⤵PID:3104
-
\??\c:\vvjdd.exec:\vvjdd.exe77⤵PID:1488
-
\??\c:\5rlfxrl.exec:\5rlfxrl.exe78⤵PID:2388
-
\??\c:\tnntnn.exec:\tnntnn.exe79⤵PID:2868
-
\??\c:\ntnnhb.exec:\ntnnhb.exe80⤵PID:3880
-
\??\c:\dpdvv.exec:\dpdvv.exe81⤵PID:3064
-
\??\c:\lflflfx.exec:\lflflfx.exe82⤵PID:4408
-
\??\c:\hnhbbn.exec:\hnhbbn.exe83⤵PID:412
-
\??\c:\vvvpj.exec:\vvvpj.exe84⤵PID:4288
-
\??\c:\djpdp.exec:\djpdp.exe85⤵PID:1244
-
\??\c:\9xxrlff.exec:\9xxrlff.exe86⤵PID:3764
-
\??\c:\nhnnhh.exec:\nhnnhh.exe87⤵PID:960
-
\??\c:\dpvpd.exec:\dpvpd.exe88⤵PID:4616
-
\??\c:\pdjdd.exec:\pdjdd.exe89⤵PID:4480
-
\??\c:\7ffrfxl.exec:\7ffrfxl.exe90⤵PID:4940
-
\??\c:\9nnbbb.exec:\9nnbbb.exe91⤵PID:2124
-
\??\c:\jpdvd.exec:\jpdvd.exe92⤵PID:4628
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe93⤵PID:2788
-
\??\c:\xrrxrfx.exec:\xrrxrfx.exe94⤵PID:3996
-
\??\c:\nnnhbb.exec:\nnnhbb.exe95⤵PID:3324
-
\??\c:\dvdvd.exec:\dvdvd.exe96⤵PID:4660
-
\??\c:\jjjjd.exec:\jjjjd.exe97⤵PID:60
-
\??\c:\flfxrrl.exec:\flfxrrl.exe98⤵PID:2620
-
\??\c:\bbnnnt.exec:\bbnnnt.exe99⤵PID:2704
-
\??\c:\htbbbb.exec:\htbbbb.exe100⤵PID:2440
-
\??\c:\dvdvd.exec:\dvdvd.exe101⤵PID:5028
-
\??\c:\rrlfffx.exec:\rrlfffx.exe102⤵PID:4776
-
\??\c:\rlxxxrr.exec:\rlxxxrr.exe103⤵PID:1032
-
\??\c:\ntnhbb.exec:\ntnhbb.exe104⤵PID:3236
-
\??\c:\hbnbnn.exec:\hbnbnn.exe105⤵PID:4604
-
\??\c:\9vppj.exec:\9vppj.exe106⤵PID:972
-
\??\c:\xrxrlfx.exec:\xrxrlfx.exe107⤵PID:3648
-
\??\c:\ffllxxx.exec:\ffllxxx.exe108⤵PID:968
-
\??\c:\1hthht.exec:\1hthht.exe109⤵PID:4640
-
\??\c:\xxrrrll.exec:\xxrrrll.exe110⤵PID:1960
-
\??\c:\fxfffff.exec:\fxfffff.exe111⤵PID:4900
-
\??\c:\ppjjv.exec:\ppjjv.exe112⤵PID:4876
-
\??\c:\xrfxxxx.exec:\xrfxxxx.exe113⤵PID:4556
-
\??\c:\tnhntb.exec:\tnhntb.exe114⤵PID:2428
-
\??\c:\dvdvj.exec:\dvdvj.exe115⤵PID:996
-
\??\c:\xllffff.exec:\xllffff.exe116⤵PID:1444
-
\??\c:\bttbtt.exec:\bttbtt.exe117⤵PID:2012
-
\??\c:\fllflxl.exec:\fllflxl.exe118⤵PID:464
-
\??\c:\hthbht.exec:\hthbht.exe119⤵PID:1800
-
\??\c:\jdpjp.exec:\jdpjp.exe120⤵PID:2800
-
\??\c:\ffxrxfx.exec:\ffxrxfx.exe121⤵PID:4572
-
\??\c:\rrlfllx.exec:\rrlfllx.exe122⤵PID:4852
-
\??\c:\vdppd.exec:\vdppd.exe123⤵PID:1948
-
\??\c:\fxxxrrl.exec:\fxxxrrl.exe124⤵PID:3948
-
\??\c:\tntntn.exec:\tntntn.exe125⤵PID:1992
-
\??\c:\vvjjj.exec:\vvjjj.exe126⤵PID:3064
-
\??\c:\fxrlrlr.exec:\fxrlrlr.exe127⤵PID:4496
-
\??\c:\nnnbnt.exec:\nnnbnt.exe128⤵PID:864
-
\??\c:\dppvv.exec:\dppvv.exe129⤵PID:4288
-
\??\c:\llfxrrr.exec:\llfxrrr.exe130⤵PID:1244
-
\??\c:\nhhbhn.exec:\nhhbhn.exe131⤵PID:3764
-
\??\c:\1hhhbn.exec:\1hhhbn.exe132⤵PID:4368
-
\??\c:\djddv.exec:\djddv.exe133⤵PID:1872
-
\??\c:\flxlrlf.exec:\flxlrlf.exe134⤵PID:3620
-
\??\c:\lxlxxlf.exec:\lxlxxlf.exe135⤵PID:5032
-
\??\c:\hbbtbt.exec:\hbbtbt.exe136⤵PID:4188
-
\??\c:\jdpvd.exec:\jdpvd.exe137⤵PID:4628
-
\??\c:\xfrlxff.exec:\xfrlxff.exe138⤵PID:3076
-
\??\c:\thnhbb.exec:\thnhbb.exe139⤵PID:1896
-
\??\c:\vjdvd.exec:\vjdvd.exe140⤵PID:3324
-
\??\c:\lrrllfl.exec:\lrrllfl.exe141⤵PID:2376
-
\??\c:\nhnhth.exec:\nhnhth.exe142⤵PID:4448
-
\??\c:\pvpvp.exec:\pvpvp.exe143⤵PID:1784
-
\??\c:\xlfxlfx.exec:\xlfxlfx.exe144⤵PID:3640
-
\??\c:\rxrlrxr.exec:\rxrlrxr.exe145⤵PID:2104
-
\??\c:\nhhhhh.exec:\nhhhhh.exe146⤵PID:1456
-
\??\c:\jdpdd.exec:\jdpdd.exe147⤵PID:5016
-
\??\c:\ntnnnn.exec:\ntnnnn.exe148⤵PID:1604
-
\??\c:\ntbttt.exec:\ntbttt.exe149⤵PID:3344
-
\??\c:\pvjjv.exec:\pvjjv.exe150⤵PID:2044
-
\??\c:\rllfffr.exec:\rllfffr.exe151⤵PID:972
-
\??\c:\rlfffxx.exec:\rlfffxx.exe152⤵PID:5012
-
\??\c:\pjdvd.exec:\pjdvd.exe153⤵PID:4728
-
\??\c:\pjjdv.exec:\pjjdv.exe154⤵PID:700
-
\??\c:\frlllll.exec:\frlllll.exe155⤵PID:1960
-
\??\c:\ttnnnn.exec:\ttnnnn.exe156⤵PID:4212
-
\??\c:\dpdvv.exec:\dpdvv.exe157⤵PID:3164
-
\??\c:\lxxffrr.exec:\lxxffrr.exe158⤵PID:4968
-
\??\c:\nhbbtb.exec:\nhbbtb.exe159⤵PID:1852
-
\??\c:\dpddp.exec:\dpddp.exe160⤵PID:2000
-
\??\c:\lxxrrll.exec:\lxxrrll.exe161⤵PID:1772
-
\??\c:\hthhbh.exec:\hthhbh.exe162⤵PID:4436
-
\??\c:\9btbtb.exec:\9btbtb.exe163⤵PID:884
-
\??\c:\1dvpj.exec:\1dvpj.exe164⤵PID:508
-
\??\c:\rflrlrr.exec:\rflrlrr.exe165⤵PID:3652
-
\??\c:\hhthhh.exec:\hhthhh.exe166⤵PID:3348
-
\??\c:\dpvvd.exec:\dpvvd.exe167⤵PID:944
-
\??\c:\jvdvp.exec:\jvdvp.exe168⤵PID:4444
-
\??\c:\lxxrlff.exec:\lxxrlff.exe169⤵PID:1380
-
\??\c:\nhnbnb.exec:\nhnbnb.exe170⤵PID:4404
-
\??\c:\djpvv.exec:\djpvv.exe171⤵PID:3064
-
\??\c:\vvvdv.exec:\vvvdv.exe172⤵PID:1388
-
\??\c:\ffflrrl.exec:\ffflrrl.exe173⤵PID:4288
-
\??\c:\vvpjp.exec:\vvpjp.exe174⤵PID:3568
-
\??\c:\ffflxff.exec:\ffflxff.exe175⤵PID:4384
-
\??\c:\hhttnh.exec:\hhttnh.exe176⤵PID:2496
-
\??\c:\ttthhh.exec:\ttthhh.exe177⤵PID:3272
-
\??\c:\jdvvd.exec:\jdvvd.exe178⤵PID:3636
-
\??\c:\xxllfll.exec:\xxllfll.exe179⤵PID:2892
-
\??\c:\nnttbh.exec:\nnttbh.exe180⤵PID:4628
-
\??\c:\vvvvp.exec:\vvvvp.exe181⤵PID:1996
-
\??\c:\frxffxl.exec:\frxffxl.exe182⤵PID:4864
-
\??\c:\htnntt.exec:\htnntt.exe183⤵PID:956
-
\??\c:\bbnhnt.exec:\bbnhnt.exe184⤵PID:4132
-
\??\c:\pjvjj.exec:\pjvjj.exe185⤵PID:4568
-
\??\c:\xlfxxfx.exec:\xlfxxfx.exe186⤵PID:1784
-
\??\c:\xlllrrx.exec:\xlllrrx.exe187⤵PID:2164
-
\??\c:\hhnnht.exec:\hhnnht.exe188⤵PID:904
-
\??\c:\jvpvj.exec:\jvpvj.exe189⤵PID:3660
-
\??\c:\rxfxrxx.exec:\rxfxrxx.exe190⤵PID:1032
-
\??\c:\lrlfllx.exec:\lrlfllx.exe191⤵PID:544
-
\??\c:\tbnnnh.exec:\tbnnnh.exe192⤵PID:828
-
\??\c:\ppddd.exec:\ppddd.exe193⤵PID:3208
-
\??\c:\frxlrfl.exec:\frxlrfl.exe194⤵PID:3980
-
\??\c:\ntbbtt.exec:\ntbbtt.exe195⤵PID:968
-
\??\c:\bbntnt.exec:\bbntnt.exe196⤵PID:1044
-
\??\c:\ppppj.exec:\ppppj.exe197⤵PID:3200
-
\??\c:\frrrflf.exec:\frrrflf.exe198⤵PID:1960
-
\??\c:\rlxfllr.exec:\rlxfllr.exe199⤵PID:3784
-
\??\c:\thntbh.exec:\thntbh.exe200⤵PID:2428
-
\??\c:\pvvvj.exec:\pvvvj.exe201⤵PID:1016
-
\??\c:\frlrlff.exec:\frlrlff.exe202⤵PID:1444
-
\??\c:\bbhhhb.exec:\bbhhhb.exe203⤵PID:4440
-
\??\c:\dpvjv.exec:\dpvjv.exe204⤵PID:5088
-
\??\c:\jjdjv.exec:\jjdjv.exe205⤵PID:4892
-
\??\c:\fxllrfx.exec:\fxllrfx.exe206⤵PID:3104
-
\??\c:\1nnbtt.exec:\1nnbtt.exe207⤵PID:2176
-
\??\c:\pvvpp.exec:\pvvpp.exe208⤵PID:2568
-
\??\c:\xrlllll.exec:\xrlllll.exe209⤵PID:4852
-
\??\c:\bbbbbh.exec:\bbbbbh.exe210⤵PID:4076
-
\??\c:\ddppv.exec:\ddppv.exe211⤵PID:3948
-
\??\c:\pvjdp.exec:\pvjdp.exe212⤵PID:1380
-
\??\c:\ttbbhh.exec:\ttbbhh.exe213⤵PID:412
-
\??\c:\jppjd.exec:\jppjd.exe214⤵PID:4452
-
\??\c:\dpvpp.exec:\dpvpp.exe215⤵PID:3704
-
\??\c:\flxflxl.exec:\flxflxl.exe216⤵PID:4884
-
\??\c:\nbtbnt.exec:\nbtbnt.exe217⤵PID:2296
-
\??\c:\pppjj.exec:\pppjj.exe218⤵PID:4388
-
\??\c:\fxflfxx.exec:\fxflfxx.exe219⤵PID:4880
-
\??\c:\3nnbbh.exec:\3nnbbh.exe220⤵PID:2444
-
\??\c:\bbtnbh.exec:\bbtnbh.exe221⤵PID:3636
-
\??\c:\vjpdv.exec:\vjpdv.exe222⤵PID:1220
-
\??\c:\fxfflfx.exec:\fxfflfx.exe223⤵PID:4900
-
\??\c:\hbntnb.exec:\hbntnb.exe224⤵PID:2220
-
\??\c:\djjdv.exec:\djjdv.exe225⤵PID:4660
-
\??\c:\xxxfxxf.exec:\xxxfxxf.exe226⤵PID:4428
-
\??\c:\tnhbtb.exec:\tnhbtb.exe227⤵PID:4720
-
\??\c:\vvvvp.exec:\vvvvp.exe228⤵PID:756
-
\??\c:\rxfrfxx.exec:\rxfrfxx.exe229⤵PID:5080
-
\??\c:\thntbn.exec:\thntbn.exe230⤵PID:2104
-
\??\c:\vjvvv.exec:\vjvvv.exe231⤵PID:1728
-
\??\c:\rrxrxrx.exec:\rrxrxrx.exe232⤵PID:3660
-
\??\c:\flfxxrx.exec:\flfxxrx.exe233⤵PID:5020
-
\??\c:\hbbhhn.exec:\hbbhhn.exe234⤵PID:4984
-
\??\c:\jvdpv.exec:\jvdpv.exe235⤵PID:2468
-
\??\c:\lfxxflr.exec:\lfxxflr.exe236⤵PID:2028
-
\??\c:\rrxxxff.exec:\rrxxxff.exe237⤵PID:2916
-
\??\c:\hnnnnb.exec:\hnnnnb.exe238⤵PID:4728
-
\??\c:\ppdjv.exec:\ppdjv.exe239⤵PID:700
-
\??\c:\rrfllrx.exec:\rrfllrx.exe240⤵PID:4724
-
\??\c:\nhbbnb.exec:\nhbbnb.exe241⤵PID:3164
-