Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15-06-2024 04:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ff37e8a80a9d8b894b4d570cbb8d123ddd6ffda0a426773b2ebc47e6dea49a74.exe
Resource
win7-20240611-en
6 signatures
150 seconds
General
-
Target
ff37e8a80a9d8b894b4d570cbb8d123ddd6ffda0a426773b2ebc47e6dea49a74.exe
-
Size
342KB
-
MD5
0d8360cf63f17ad5034a76a1bdf94db2
-
SHA1
3e383fd7b24493a391d160d3c5895a20750729d3
-
SHA256
ff37e8a80a9d8b894b4d570cbb8d123ddd6ffda0a426773b2ebc47e6dea49a74
-
SHA512
219b32995357a00431878d6f47248f7c1a230f2b83b8e9e020652358b89624692acfac5b04328246c8e09a2eaee8ee811ae8cac2ccc458513fe9b23d14ae1416
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYAw:l7TcbWXZshJX2VGdw
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
Processes:
resource yara_rule behavioral1/memory/2304-8-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1752-11-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1968-26-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2252-35-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2712-48-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2668-45-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2784-65-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1748-74-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2524-84-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2164-101-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3020-110-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2748-119-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1640-136-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1672-145-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1528-162-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2852-172-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/548-181-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2328-206-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/668-215-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1064-233-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/944-244-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/268-259-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2288-277-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1428-280-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2188-295-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2808-333-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2384-340-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2800-354-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2764-413-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1548-414-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1932-440-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1756-466-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2096-486-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1988-494-0x00000000001B0000-0x00000000001D8000-memory.dmp family_blackmoon behavioral1/memory/2116-534-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2620-723-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2672-935-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2360-933-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2092-1089-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2036-1131-0x00000000001B0000-0x00000000001D8000-memory.dmp family_blackmoon behavioral1/memory/1484-1281-0x00000000005C0000-0x00000000005E8000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral1/memory/2304-8-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/1752-11-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/1968-26-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2252-27-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2252-35-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2712-48-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2668-45-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2784-65-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/1748-74-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2524-84-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2164-92-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2164-101-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/3020-110-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2748-119-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/1640-136-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/1672-145-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/1528-162-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2852-172-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/548-181-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2328-206-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2368-216-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/668-215-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/1064-233-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/944-244-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2288-277-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/1428-280-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2188-295-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/1072-314-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2808-333-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2384-340-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2800-354-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2584-379-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/1200-399-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2764-406-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2764-413-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/1548-414-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/1684-421-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/1756-466-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2096-479-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2096-486-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/868-501-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2116-526-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2116-534-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/1504-590-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2952-597-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2632-666-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/300-788-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2004-838-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/1592-881-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2056-908-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2772-915-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2876-948-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2540-955-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/1212-1034-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/1284-1042-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2860-1049-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/1864-1056-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2092-1089-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/1056-1096-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/1296-1115-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/880-1122-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2036-1131-0x00000000001B0000-0x00000000001D8000-memory.dmp UPX behavioral1/memory/2424-1136-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral1/memory/2464-1143-0x0000000000400000-0x0000000000428000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
vpvdv.exe1bnnth.exe9fflffr.exehntnhn.exe7vppv.exefxffxxf.exedjvvj.exenhbbbh.exedjvvp.exefrlxfff.exebnbhnh.exe1lxxflx.exenttbnb.exe1pdpv.exe3thntb.exe3ntbbn.exexrrfxfr.exetnhbhn.exe1dvdj.exe5rfffll.exettnnbh.exejdpjp.exe1rxrxlr.exepvpvp.exe5lrllrl.exebtttnt.exerlxxlrx.exe1lxxfrf.exedpvdv.exexrlfrxl.exenhhbbn.exe9djjj.exe3llrfxl.exebbthtb.exe9jvpp.exefrxxxxf.exethtttn.exepdjdj.exefxllrll.exexxflllr.exe5thhhh.exepjddj.exexrfxxxf.exentbbhb.exehttttn.exevpvpd.exefrlllfl.exeffrrxxf.exe5bbhtb.exepjddj.exe9rfxfxl.exerfrfrfl.exehbnthn.exe3jddd.exefxfxfxl.exenhbhth.exetbtbht.exedjpvd.exerxllrfl.exe1htbhh.exebnbbbn.exe3vjjp.exerxllffl.exexrlxfff.exepid process 1752 vpvdv.exe 1968 1bnnth.exe 2252 9fflffr.exe 2668 hntnhn.exe 2712 7vppv.exe 2784 fxffxxf.exe 1748 djvvj.exe 2416 nhbbbh.exe 2524 djvvp.exe 2164 frlxfff.exe 3020 bnbhnh.exe 2748 1lxxflx.exe 1544 nttbnb.exe 1640 1pdpv.exe 1672 3thntb.exe 2336 3ntbbn.exe 1528 xrrfxfr.exe 2852 tnhbhn.exe 548 1dvdj.exe 2816 5rfffll.exe 2008 ttnnbh.exe 2328 jdpjp.exe 668 1rxrxlr.exe 2368 pvpvp.exe 1064 5lrllrl.exe 684 btttnt.exe 944 rlxxlrx.exe 268 1lxxfrf.exe 2036 dpvdv.exe 2288 xrlfrxl.exe 1428 nhhbbn.exe 2188 9djjj.exe 1500 3llrfxl.exe 2360 bbthtb.exe 1724 9jvpp.exe 1072 frxxxxf.exe 2056 thtttn.exe 2808 pdjdj.exe 2384 fxllrll.exe 2728 xxflllr.exe 2708 5thhhh.exe 2800 pjddj.exe 2796 xrfxxxf.exe 2548 ntbbhb.exe 2684 httttn.exe 2584 vpvpd.exe 2580 frlllfl.exe 3000 ffrrxxf.exe 1200 5bbhtb.exe 2764 pjddj.exe 1548 9rfxfxl.exe 1684 rfrfrfl.exe 2620 hbnthn.exe 1932 3jddd.exe 1924 fxfxfxl.exe 1380 nhbhth.exe 1796 tbtbht.exe 1284 djpvd.exe 1756 rxllrfl.exe 2696 1htbhh.exe 2096 bnbbbn.exe 1988 3vjjp.exe 2392 rxllffl.exe 868 xrlxfff.exe -
Processes:
resource yara_rule behavioral1/memory/2304-8-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1752-11-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1968-26-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2252-27-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2252-35-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2712-48-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2668-45-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2784-65-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1748-74-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2524-84-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2164-92-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2164-101-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3020-110-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2748-119-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1640-136-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1672-145-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1528-162-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2852-172-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/548-181-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2328-206-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2368-216-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/668-215-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1064-233-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/944-244-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2288-277-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1428-280-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2188-295-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1072-314-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2808-333-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2384-340-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2728-341-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2800-354-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2584-379-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2584-386-0x00000000002A0000-0x00000000002C8000-memory.dmp upx behavioral1/memory/1200-399-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2764-406-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2764-413-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1548-414-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1684-421-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1756-466-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2096-479-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2096-486-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/868-501-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2116-526-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2116-534-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1504-590-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2952-597-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2732-648-0x00000000003A0000-0x00000000003C8000-memory.dmp upx behavioral1/memory/2632-666-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/300-788-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2004-838-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1592-881-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2056-908-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2772-915-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2876-948-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2540-955-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1212-1034-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1284-1042-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2860-1049-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1864-1056-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2092-1089-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1056-1096-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1296-1115-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/880-1122-0x0000000000400000-0x0000000000428000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ff37e8a80a9d8b894b4d570cbb8d123ddd6ffda0a426773b2ebc47e6dea49a74.exevpvdv.exe1bnnth.exe9fflffr.exehntnhn.exe7vppv.exefxffxxf.exedjvvj.exenhbbbh.exedjvvp.exefrlxfff.exebnbhnh.exe1lxxflx.exenttbnb.exe1pdpv.exe3thntb.exedescription pid process target process PID 2304 wrote to memory of 1752 2304 ff37e8a80a9d8b894b4d570cbb8d123ddd6ffda0a426773b2ebc47e6dea49a74.exe vpvdv.exe PID 2304 wrote to memory of 1752 2304 ff37e8a80a9d8b894b4d570cbb8d123ddd6ffda0a426773b2ebc47e6dea49a74.exe vpvdv.exe PID 2304 wrote to memory of 1752 2304 ff37e8a80a9d8b894b4d570cbb8d123ddd6ffda0a426773b2ebc47e6dea49a74.exe vpvdv.exe PID 2304 wrote to memory of 1752 2304 ff37e8a80a9d8b894b4d570cbb8d123ddd6ffda0a426773b2ebc47e6dea49a74.exe vpvdv.exe PID 1752 wrote to memory of 1968 1752 vpvdv.exe 1bnnth.exe PID 1752 wrote to memory of 1968 1752 vpvdv.exe 1bnnth.exe PID 1752 wrote to memory of 1968 1752 vpvdv.exe 1bnnth.exe PID 1752 wrote to memory of 1968 1752 vpvdv.exe 1bnnth.exe PID 1968 wrote to memory of 2252 1968 1bnnth.exe 9fflffr.exe PID 1968 wrote to memory of 2252 1968 1bnnth.exe 9fflffr.exe PID 1968 wrote to memory of 2252 1968 1bnnth.exe 9fflffr.exe PID 1968 wrote to memory of 2252 1968 1bnnth.exe 9fflffr.exe PID 2252 wrote to memory of 2668 2252 9fflffr.exe hntnhn.exe PID 2252 wrote to memory of 2668 2252 9fflffr.exe hntnhn.exe PID 2252 wrote to memory of 2668 2252 9fflffr.exe hntnhn.exe PID 2252 wrote to memory of 2668 2252 9fflffr.exe hntnhn.exe PID 2668 wrote to memory of 2712 2668 hntnhn.exe 7vppv.exe PID 2668 wrote to memory of 2712 2668 hntnhn.exe 7vppv.exe PID 2668 wrote to memory of 2712 2668 hntnhn.exe 7vppv.exe PID 2668 wrote to memory of 2712 2668 hntnhn.exe 7vppv.exe PID 2712 wrote to memory of 2784 2712 7vppv.exe fxffxxf.exe PID 2712 wrote to memory of 2784 2712 7vppv.exe fxffxxf.exe PID 2712 wrote to memory of 2784 2712 7vppv.exe fxffxxf.exe PID 2712 wrote to memory of 2784 2712 7vppv.exe fxffxxf.exe PID 2784 wrote to memory of 1748 2784 fxffxxf.exe djvvj.exe PID 2784 wrote to memory of 1748 2784 fxffxxf.exe djvvj.exe PID 2784 wrote to memory of 1748 2784 fxffxxf.exe djvvj.exe PID 2784 wrote to memory of 1748 2784 fxffxxf.exe djvvj.exe PID 1748 wrote to memory of 2416 1748 djvvj.exe nhbbbh.exe PID 1748 wrote to memory of 2416 1748 djvvj.exe nhbbbh.exe PID 1748 wrote to memory of 2416 1748 djvvj.exe nhbbbh.exe PID 1748 wrote to memory of 2416 1748 djvvj.exe nhbbbh.exe PID 2416 wrote to memory of 2524 2416 nhbbbh.exe djvvp.exe PID 2416 wrote to memory of 2524 2416 nhbbbh.exe djvvp.exe PID 2416 wrote to memory of 2524 2416 nhbbbh.exe djvvp.exe PID 2416 wrote to memory of 2524 2416 nhbbbh.exe djvvp.exe PID 2524 wrote to memory of 2164 2524 djvvp.exe frlxfff.exe PID 2524 wrote to memory of 2164 2524 djvvp.exe frlxfff.exe PID 2524 wrote to memory of 2164 2524 djvvp.exe frlxfff.exe PID 2524 wrote to memory of 2164 2524 djvvp.exe frlxfff.exe PID 2164 wrote to memory of 3020 2164 frlxfff.exe bnbhnh.exe PID 2164 wrote to memory of 3020 2164 frlxfff.exe bnbhnh.exe PID 2164 wrote to memory of 3020 2164 frlxfff.exe bnbhnh.exe PID 2164 wrote to memory of 3020 2164 frlxfff.exe bnbhnh.exe PID 3020 wrote to memory of 2748 3020 bnbhnh.exe 1lxxflx.exe PID 3020 wrote to memory of 2748 3020 bnbhnh.exe 1lxxflx.exe PID 3020 wrote to memory of 2748 3020 bnbhnh.exe 1lxxflx.exe PID 3020 wrote to memory of 2748 3020 bnbhnh.exe 1lxxflx.exe PID 2748 wrote to memory of 1544 2748 1lxxflx.exe nttbnb.exe PID 2748 wrote to memory of 1544 2748 1lxxflx.exe nttbnb.exe PID 2748 wrote to memory of 1544 2748 1lxxflx.exe nttbnb.exe PID 2748 wrote to memory of 1544 2748 1lxxflx.exe nttbnb.exe PID 1544 wrote to memory of 1640 1544 nttbnb.exe 1pdpv.exe PID 1544 wrote to memory of 1640 1544 nttbnb.exe 1pdpv.exe PID 1544 wrote to memory of 1640 1544 nttbnb.exe 1pdpv.exe PID 1544 wrote to memory of 1640 1544 nttbnb.exe 1pdpv.exe PID 1640 wrote to memory of 1672 1640 1pdpv.exe 3thntb.exe PID 1640 wrote to memory of 1672 1640 1pdpv.exe 3thntb.exe PID 1640 wrote to memory of 1672 1640 1pdpv.exe 3thntb.exe PID 1640 wrote to memory of 1672 1640 1pdpv.exe 3thntb.exe PID 1672 wrote to memory of 2336 1672 3thntb.exe 3ntbbn.exe PID 1672 wrote to memory of 2336 1672 3thntb.exe 3ntbbn.exe PID 1672 wrote to memory of 2336 1672 3thntb.exe 3ntbbn.exe PID 1672 wrote to memory of 2336 1672 3thntb.exe 3ntbbn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff37e8a80a9d8b894b4d570cbb8d123ddd6ffda0a426773b2ebc47e6dea49a74.exe"C:\Users\Admin\AppData\Local\Temp\ff37e8a80a9d8b894b4d570cbb8d123ddd6ffda0a426773b2ebc47e6dea49a74.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\vpvdv.exec:\vpvdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1bnnth.exec:\1bnnth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9fflffr.exec:\9fflffr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hntnhn.exec:\hntnhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7vppv.exec:\7vppv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxffxxf.exec:\fxffxxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\djvvj.exec:\djvvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhbbbh.exec:\nhbbbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\djvvp.exec:\djvvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frlxfff.exec:\frlxfff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnbhnh.exec:\bnbhnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1lxxflx.exec:\1lxxflx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nttbnb.exec:\nttbnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1pdpv.exec:\1pdpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3thntb.exec:\3thntb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3ntbbn.exec:\3ntbbn.exe17⤵
- Executes dropped EXE
-
\??\c:\xrrfxfr.exec:\xrrfxfr.exe18⤵
- Executes dropped EXE
-
\??\c:\tnhbhn.exec:\tnhbhn.exe19⤵
- Executes dropped EXE
-
\??\c:\1dvdj.exec:\1dvdj.exe20⤵
- Executes dropped EXE
-
\??\c:\5rfffll.exec:\5rfffll.exe21⤵
- Executes dropped EXE
-
\??\c:\ttnnbh.exec:\ttnnbh.exe22⤵
- Executes dropped EXE
-
\??\c:\jdpjp.exec:\jdpjp.exe23⤵
- Executes dropped EXE
-
\??\c:\1rxrxlr.exec:\1rxrxlr.exe24⤵
- Executes dropped EXE
-
\??\c:\pvpvp.exec:\pvpvp.exe25⤵
- Executes dropped EXE
-
\??\c:\5lrllrl.exec:\5lrllrl.exe26⤵
- Executes dropped EXE
-
\??\c:\btttnt.exec:\btttnt.exe27⤵
- Executes dropped EXE
-
\??\c:\rlxxlrx.exec:\rlxxlrx.exe28⤵
- Executes dropped EXE
-
\??\c:\1lxxfrf.exec:\1lxxfrf.exe29⤵
- Executes dropped EXE
-
\??\c:\dpvdv.exec:\dpvdv.exe30⤵
- Executes dropped EXE
-
\??\c:\xrlfrxl.exec:\xrlfrxl.exe31⤵
- Executes dropped EXE
-
\??\c:\nhhbbn.exec:\nhhbbn.exe32⤵
- Executes dropped EXE
-
\??\c:\9djjj.exec:\9djjj.exe33⤵
- Executes dropped EXE
-
\??\c:\3llrfxl.exec:\3llrfxl.exe34⤵
- Executes dropped EXE
-
\??\c:\bbthtb.exec:\bbthtb.exe35⤵
- Executes dropped EXE
-
\??\c:\9jvpp.exec:\9jvpp.exe36⤵
- Executes dropped EXE
-
\??\c:\frxxxxf.exec:\frxxxxf.exe37⤵
- Executes dropped EXE
-
\??\c:\thtttn.exec:\thtttn.exe38⤵
- Executes dropped EXE
-
\??\c:\pdjdj.exec:\pdjdj.exe39⤵
- Executes dropped EXE
-
\??\c:\fxllrll.exec:\fxllrll.exe40⤵
- Executes dropped EXE
-
\??\c:\xxflllr.exec:\xxflllr.exe41⤵
- Executes dropped EXE
-
\??\c:\5thhhh.exec:\5thhhh.exe42⤵
- Executes dropped EXE
-
\??\c:\pjddj.exec:\pjddj.exe43⤵
- Executes dropped EXE
-
\??\c:\xrfxxxf.exec:\xrfxxxf.exe44⤵
- Executes dropped EXE
-
\??\c:\ntbbhb.exec:\ntbbhb.exe45⤵
- Executes dropped EXE
-
\??\c:\httttn.exec:\httttn.exe46⤵
- Executes dropped EXE
-
\??\c:\vpvpd.exec:\vpvpd.exe47⤵
- Executes dropped EXE
-
\??\c:\frlllfl.exec:\frlllfl.exe48⤵
- Executes dropped EXE
-
\??\c:\ffrrxxf.exec:\ffrrxxf.exe49⤵
- Executes dropped EXE
-
\??\c:\5bbhtb.exec:\5bbhtb.exe50⤵
- Executes dropped EXE
-
\??\c:\pjddj.exec:\pjddj.exe51⤵
- Executes dropped EXE
-
\??\c:\9rfxfxl.exec:\9rfxfxl.exe52⤵
- Executes dropped EXE
-
\??\c:\rfrfrfl.exec:\rfrfrfl.exe53⤵
- Executes dropped EXE
-
\??\c:\hbnthn.exec:\hbnthn.exe54⤵
- Executes dropped EXE
-
\??\c:\3jddd.exec:\3jddd.exe55⤵
- Executes dropped EXE
-
\??\c:\fxfxfxl.exec:\fxfxfxl.exe56⤵
- Executes dropped EXE
-
\??\c:\nhbhth.exec:\nhbhth.exe57⤵
- Executes dropped EXE
-
\??\c:\tbtbht.exec:\tbtbht.exe58⤵
- Executes dropped EXE
-
\??\c:\djpvd.exec:\djpvd.exe59⤵
- Executes dropped EXE
-
\??\c:\rxllrfl.exec:\rxllrfl.exe60⤵
- Executes dropped EXE
-
\??\c:\1htbhh.exec:\1htbhh.exe61⤵
- Executes dropped EXE
-
\??\c:\bnbbbn.exec:\bnbbbn.exe62⤵
- Executes dropped EXE
-
\??\c:\3vjjp.exec:\3vjjp.exe63⤵
- Executes dropped EXE
-
\??\c:\rxllffl.exec:\rxllffl.exe64⤵
- Executes dropped EXE
-
\??\c:\xrlxfff.exec:\xrlxfff.exe65⤵
- Executes dropped EXE
-
\??\c:\ttnhhb.exec:\ttnhhb.exe66⤵
-
\??\c:\pjvvj.exec:\pjvvj.exe67⤵
-
\??\c:\lxlllfl.exec:\lxlllfl.exe68⤵
-
\??\c:\rlrrrrf.exec:\rlrrrrf.exe69⤵
-
\??\c:\bntbht.exec:\bntbht.exe70⤵
-
\??\c:\vjdjv.exec:\vjdjv.exe71⤵
-
\??\c:\xrxflxf.exec:\xrxflxf.exe72⤵
-
\??\c:\7fxrlrf.exec:\7fxrlrf.exe73⤵
-
\??\c:\7tnbbh.exec:\7tnbbh.exe74⤵
-
\??\c:\pdpvp.exec:\pdpvp.exe75⤵
-
\??\c:\jvjvv.exec:\jvjvv.exe76⤵
-
\??\c:\3rffrxf.exec:\3rffrxf.exe77⤵
-
\??\c:\thbbhh.exec:\thbbhh.exe78⤵
-
\??\c:\nbhbbh.exec:\nbhbbh.exe79⤵
-
\??\c:\5djdv.exec:\5djdv.exe80⤵
-
\??\c:\rlrrxfl.exec:\rlrrxfl.exe81⤵
-
\??\c:\fxfflff.exec:\fxfflff.exe82⤵
-
\??\c:\hhnnth.exec:\hhnnth.exe83⤵
-
\??\c:\pjppp.exec:\pjppp.exe84⤵
-
\??\c:\dpdpd.exec:\dpdpd.exe85⤵
-
\??\c:\7fflrxf.exec:\7fflrxf.exe86⤵
-
\??\c:\bhnnnt.exec:\bhnnnt.exe87⤵
-
\??\c:\5bttbh.exec:\5bttbh.exe88⤵
-
\??\c:\pvppv.exec:\pvppv.exe89⤵
-
\??\c:\1lxxxlr.exec:\1lxxxlr.exe90⤵
-
\??\c:\5tnbtt.exec:\5tnbtt.exe91⤵
-
\??\c:\dvppd.exec:\dvppd.exe92⤵
-
\??\c:\pjpvp.exec:\pjpvp.exe93⤵
-
\??\c:\fxlxfrf.exec:\fxlxfrf.exe94⤵
-
\??\c:\frxrrxl.exec:\frxrrxl.exe95⤵
-
\??\c:\hhhtbh.exec:\hhhtbh.exe96⤵
-
\??\c:\vpvdp.exec:\vpvdp.exe97⤵
-
\??\c:\ffxfllf.exec:\ffxfllf.exe98⤵
-
\??\c:\1flfrrr.exec:\1flfrrr.exe99⤵
-
\??\c:\7nbbnt.exec:\7nbbnt.exe100⤵
-
\??\c:\hbbhtt.exec:\hbbhtt.exe101⤵
-
\??\c:\ppdpd.exec:\ppdpd.exe102⤵
-
\??\c:\lfxrrlr.exec:\lfxrrlr.exe103⤵
-
\??\c:\7rrxflx.exec:\7rrxflx.exe104⤵
-
\??\c:\ttnhbn.exec:\ttnhbn.exe105⤵
-
\??\c:\3bhhnt.exec:\3bhhnt.exe106⤵
-
\??\c:\dvvdj.exec:\dvvdj.exe107⤵
-
\??\c:\xxffllx.exec:\xxffllx.exe108⤵
-
\??\c:\lxlfxll.exec:\lxlfxll.exe109⤵
-
\??\c:\tntthh.exec:\tntthh.exe110⤵
-
\??\c:\thtnnt.exec:\thtnnt.exe111⤵
-
\??\c:\dvjpd.exec:\dvjpd.exe112⤵
-
\??\c:\xlrrrxl.exec:\xlrrrxl.exe113⤵
-
\??\c:\bthnbb.exec:\bthnbb.exe114⤵
-
\??\c:\9bthtt.exec:\9bthtt.exe115⤵
-
\??\c:\dpdjv.exec:\dpdjv.exe116⤵
-
\??\c:\5ffrrrx.exec:\5ffrrrx.exe117⤵
-
\??\c:\xxxlxxf.exec:\xxxlxxf.exe118⤵
-
\??\c:\bnbbhh.exec:\bnbbhh.exe119⤵
-
\??\c:\vvpvd.exec:\vvpvd.exe120⤵
-
\??\c:\1pddj.exec:\1pddj.exe121⤵
-
\??\c:\3xllrrf.exec:\3xllrrf.exe122⤵
-
\??\c:\nhtbhh.exec:\nhtbhh.exe123⤵
-
\??\c:\tnnhnt.exec:\tnnhnt.exe124⤵
-
\??\c:\3dvdj.exec:\3dvdj.exe125⤵
-
\??\c:\lflflfl.exec:\lflflfl.exe126⤵
-
\??\c:\9nnntt.exec:\9nnntt.exe127⤵
-
\??\c:\vpddv.exec:\vpddv.exe128⤵
-
\??\c:\1vjpp.exec:\1vjpp.exe129⤵
-
\??\c:\nthhnt.exec:\nthhnt.exe130⤵
-
\??\c:\3jjdd.exec:\3jjdd.exe131⤵
-
\??\c:\vvdjj.exec:\vvdjj.exe132⤵
-
\??\c:\lfrrfxx.exec:\lfrrfxx.exe133⤵
-
\??\c:\9bbntb.exec:\9bbntb.exe134⤵
-
\??\c:\btbhhn.exec:\btbhhn.exe135⤵
-
\??\c:\ddppv.exec:\ddppv.exe136⤵
-
\??\c:\lfrrxfl.exec:\lfrrxfl.exe137⤵
-
\??\c:\lfxlxlr.exec:\lfxlxlr.exe138⤵
-
\??\c:\tbnntt.exec:\tbnntt.exe139⤵
-
\??\c:\ppdpd.exec:\ppdpd.exe140⤵
-
\??\c:\pjpvv.exec:\pjpvv.exe141⤵
-
\??\c:\1rlrxfr.exec:\1rlrxfr.exe142⤵
-
\??\c:\thttbh.exec:\thttbh.exe143⤵
-
\??\c:\5thhbh.exec:\5thhbh.exe144⤵
-
\??\c:\pjvvd.exec:\pjvvd.exe145⤵
-
\??\c:\ppjpv.exec:\ppjpv.exe146⤵
-
\??\c:\1xxxxxr.exec:\1xxxxxr.exe147⤵
-
\??\c:\3hnttt.exec:\3hnttt.exe148⤵
-
\??\c:\tntthb.exec:\tntthb.exe149⤵
-
\??\c:\7pdvj.exec:\7pdvj.exe150⤵
-
\??\c:\fxffffr.exec:\fxffffr.exe151⤵
-
\??\c:\7nbttt.exec:\7nbttt.exe152⤵
-
\??\c:\1jppd.exec:\1jppd.exe153⤵
-
\??\c:\vvpvv.exec:\vvpvv.exe154⤵
-
\??\c:\3llfffx.exec:\3llfffx.exe155⤵
-
\??\c:\bbnhnb.exec:\bbnhnb.exe156⤵
-
\??\c:\7tnthn.exec:\7tnthn.exe157⤵
-
\??\c:\djvpd.exec:\djvpd.exe158⤵
-
\??\c:\rffxxfr.exec:\rffxxfr.exe159⤵
-
\??\c:\rlxflrx.exec:\rlxflrx.exe160⤵
-
\??\c:\9thhbb.exec:\9thhbb.exe161⤵
-
\??\c:\pdvdj.exec:\pdvdj.exe162⤵
-
\??\c:\dvjjp.exec:\dvjjp.exe163⤵
-
\??\c:\lflrxfr.exec:\lflrxfr.exe164⤵
-
\??\c:\hhbnbb.exec:\hhbnbb.exe165⤵
-
\??\c:\dpvvj.exec:\dpvvj.exe166⤵
-
\??\c:\1rffllr.exec:\1rffllr.exe167⤵
-
\??\c:\xlxxllr.exec:\xlxxllr.exe168⤵
-
\??\c:\1htntt.exec:\1htntt.exe169⤵
-
\??\c:\3thnbh.exec:\3thnbh.exe170⤵
-
\??\c:\ddpvd.exec:\ddpvd.exe171⤵
-
\??\c:\9xrfxll.exec:\9xrfxll.exe172⤵
-
\??\c:\rxllxfl.exec:\rxllxfl.exe173⤵
-
\??\c:\bbhnnn.exec:\bbhnnn.exe174⤵
-
\??\c:\vvjpd.exec:\vvjpd.exe175⤵
-
\??\c:\dppdj.exec:\dppdj.exe176⤵
-
\??\c:\3rffffl.exec:\3rffffl.exe177⤵
-
\??\c:\tthntb.exec:\tthntb.exe178⤵
-
\??\c:\tnhhtb.exec:\tnhhtb.exe179⤵
-
\??\c:\pjppp.exec:\pjppp.exe180⤵
-
\??\c:\rfxfrrx.exec:\rfxfrrx.exe181⤵
-
\??\c:\xrxlxfl.exec:\xrxlxfl.exe182⤵
-
\??\c:\hbnntb.exec:\hbnntb.exe183⤵
-
\??\c:\nhnnnn.exec:\nhnnnn.exe184⤵
-
\??\c:\5vjjp.exec:\5vjjp.exe185⤵
-
\??\c:\9rflxlx.exec:\9rflxlx.exe186⤵
-
\??\c:\rlrxrrf.exec:\rlrxrrf.exe187⤵
-
\??\c:\ttbhtt.exec:\ttbhtt.exe188⤵
-
\??\c:\jjdpv.exec:\jjdpv.exe189⤵
-
\??\c:\pvppp.exec:\pvppp.exe190⤵
-
\??\c:\xxfrxfr.exec:\xxfrxfr.exe191⤵
-
\??\c:\3llrrrf.exec:\3llrrrf.exe192⤵
-
\??\c:\hnhntb.exec:\hnhntb.exe193⤵
-
\??\c:\7hbtbh.exec:\7hbtbh.exe194⤵
-
\??\c:\jdpvj.exec:\jdpvj.exe195⤵
-
\??\c:\rrlxlrx.exec:\rrlxlrx.exe196⤵
-
\??\c:\3xxflrl.exec:\3xxflrl.exe197⤵
-
\??\c:\tnbhnt.exec:\tnbhnt.exe198⤵
-
\??\c:\vpdjp.exec:\vpdjp.exe199⤵
-
\??\c:\ppvvd.exec:\ppvvd.exe200⤵
-
\??\c:\fxllrrx.exec:\fxllrrx.exe201⤵
-
\??\c:\5xllrxf.exec:\5xllrxf.exe202⤵
-
\??\c:\bbbnbh.exec:\bbbnbh.exe203⤵
-
\??\c:\jppdp.exec:\jppdp.exe204⤵
-
\??\c:\vvpdj.exec:\vvpdj.exe205⤵
-
\??\c:\flfrxfr.exec:\flfrxfr.exe206⤵
-
\??\c:\hhtbnn.exec:\hhtbnn.exe207⤵
-
\??\c:\btnbnn.exec:\btnbnn.exe208⤵
-
\??\c:\vdjdj.exec:\vdjdj.exe209⤵
-
\??\c:\fxffflr.exec:\fxffflr.exe210⤵
-
\??\c:\fflxlxl.exec:\fflxlxl.exe211⤵
-
\??\c:\btnbnb.exec:\btnbnb.exe212⤵
-
\??\c:\vdjdd.exec:\vdjdd.exe213⤵
-
\??\c:\vjdjp.exec:\vjdjp.exe214⤵
-
\??\c:\9frllrx.exec:\9frllrx.exe215⤵
-
\??\c:\hhtnhh.exec:\hhtnhh.exe216⤵
-
\??\c:\5tnnbh.exec:\5tnnbh.exe217⤵
-
\??\c:\pjddj.exec:\pjddj.exe218⤵
-
\??\c:\9vpjv.exec:\9vpjv.exe219⤵
-
\??\c:\rrrxlrx.exec:\rrrxlrx.exe220⤵
-
\??\c:\nhbbhh.exec:\nhbbhh.exe221⤵
-
\??\c:\tbbbth.exec:\tbbbth.exe222⤵
-
\??\c:\3dpdj.exec:\3dpdj.exe223⤵
-
\??\c:\ddjdv.exec:\ddjdv.exe224⤵
-
\??\c:\9xflxlx.exec:\9xflxlx.exe225⤵
-
\??\c:\tnbthh.exec:\tnbthh.exe226⤵
-
\??\c:\nbnhhh.exec:\nbnhhh.exe227⤵
-
\??\c:\pdddj.exec:\pdddj.exe228⤵
-
\??\c:\3rlrflr.exec:\3rlrflr.exe229⤵
-
\??\c:\lfrxxlr.exec:\lfrxxlr.exe230⤵
-
\??\c:\hhtbtb.exec:\hhtbtb.exe231⤵
-
\??\c:\pvppp.exec:\pvppp.exe232⤵
-
\??\c:\rlffrlr.exec:\rlffrlr.exe233⤵
-
\??\c:\lxlflfl.exec:\lxlflfl.exe234⤵
-
\??\c:\bbtbtt.exec:\bbtbtt.exe235⤵
-
\??\c:\nhbhtt.exec:\nhbhtt.exe236⤵
-
\??\c:\vpddd.exec:\vpddd.exe237⤵
-
\??\c:\fxfflfl.exec:\fxfflfl.exe238⤵
-
\??\c:\tnnthn.exec:\tnnthn.exe239⤵
-
\??\c:\9thbhh.exec:\9thbhh.exe240⤵
-
\??\c:\jjvvp.exec:\jjvvp.exe241⤵