Analysis
-
max time kernel
102s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
27-07-2024 01:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7cd79210f58de47b883ad8115b103790N.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
120 seconds
General
-
Target
7cd79210f58de47b883ad8115b103790N.exe
-
Size
56KB
-
MD5
7cd79210f58de47b883ad8115b103790
-
SHA1
c966dcf5c2bf32989d17cbb8960a567f5c86eea5
-
SHA256
629981ba50b5aee9b61496e6aae690418e6408e01460e3303393da042f779cdf
-
SHA512
40b12aa2520098e5aec7d4616adc16bf8e85cee63add8e947b077d311adaa2d34328253bc5754924c32600c85dff2f9a2e54db12894e97b9188676a6156efd74
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFs:ymb3NkkiQ3mdBjFIFs
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral1/memory/2432-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2868-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1164-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2052-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2020-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/316-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/700-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/548-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1328-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/768-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1492-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/888-306-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bbrrh.exedrvlddt.exedrdvh.exexlnhhtd.exehdbxh.exehvvbt.exeflvrdhx.exelvfffrr.exexdvtt.exehhhdb.exebdvvd.exepvtvrfh.exehvfxpv.exefvbtfj.exebfxjnv.exehvdhx.exerfvft.exelhnbnvf.exefbdpp.exettpbl.exehbxtvr.exefrpdvj.exexpnbplh.exehvpdh.exentdfxxp.exejhntbl.exebvtxnd.exevxtrl.exephpntb.exelvpvp.exelldlfht.exetlpldjt.exeftndnv.exervbvpf.exejvxjpvr.exehtlnnx.exepxtrf.exeffbhpnn.exeblfpjj.exeddxxnd.exexdlhx.exexjlvnjd.exelvhdd.exerltbbb.exexthfh.exenxjrh.exenbxvxph.exedfdnvhp.exehtbnv.exebrtrdr.exexrtlndp.exenfdbnhd.exefnjrrh.exexfllhhv.exejpdpl.exelhtnjhh.exejlrdhj.exedtnftp.exenxhlfrj.exedlftx.exenbblpdb.exelvttlxr.exexdnjp.exetttnlf.exepid process 2196 bbrrh.exe 2868 drvlddt.exe 2776 drdvh.exe 2824 xlnhhtd.exe 2780 hdbxh.exe 2536 hvvbt.exe 2660 flvrdhx.exe 2408 lvfffrr.exe 3032 xdvtt.exe 1164 hhhdb.exe 2908 bdvvd.exe 2544 pvtvrfh.exe 2052 hvfxpv.exe 2508 fvbtfj.exe 2004 bfxjnv.exe 2020 hvdhx.exe 2192 rfvft.exe 1324 lhnbnvf.exe 1880 fbdpp.exe 316 ttpbl.exe 700 hbxtvr.exe 548 frpdvj.exe 1328 xpnbplh.exe 768 hvpdh.exe 1952 ntdfxxp.exe 1412 jhntbl.exe 1820 bvtxnd.exe 596 vxtrl.exe 1492 phpntb.exe 2160 lvpvp.exe 888 lldlfht.exe 2552 tlpldjt.exe 2892 ftndnv.exe 1620 rvbvpf.exe 2800 jvxjpvr.exe 2884 htlnnx.exe 2776 pxtrf.exe 2672 ffbhpnn.exe 2668 blfpjj.exe 2808 ddxxnd.exe 1632 xdlhx.exe 1824 xjlvnjd.exe 2096 lvhdd.exe 2504 rltbbb.exe 576 xthfh.exe 2176 nxjrh.exe 2952 nbxvxph.exe 1112 dfdnvhp.exe 1764 htbnv.exe 2136 brtrdr.exe 2512 xrtlndp.exe 2400 nfdbnhd.exe 2484 fnjrrh.exe 2056 xfllhhv.exe 2436 jpdpl.exe 2324 lhtnjhh.exe 1324 jlrdhj.exe 2428 dtnftp.exe 1284 nxhlfrj.exe 952 dlftx.exe 1548 nbblpdb.exe 1572 lvttlxr.exe 1568 xdnjp.exe 640 tttnlf.exe -
Processes:
resource yara_rule behavioral1/memory/2432-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1164-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/316-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/700-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/548-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1328-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/768-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1492-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/888-306-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
ltlxf.exevrnrddj.exerjjhnb.exejvdvdvl.exerbndbth.exetxdvhp.exeltxrtvl.exexxdfr.exexpfrf.exenltdn.exevhbnph.exextxrpbr.exebvbxbfp.exejvtpttr.exefrpdvj.exeddrlv.exentpvb.exetttnlf.exenvltf.exerhrblh.exehhbhh.exedpnphnx.exetbtvrxx.exelrpdn.exelpfll.exerflrtp.exeflpbtxh.exejxnpnrh.exetrrtfxp.exejptnn.exelldlfht.exerljxnd.exepbddv.exedjhhdpr.exebfjfnnt.exeprhhltd.exevdxrxh.exepfvlltp.exerldvfbf.exenrdpl.exehnfpp.exerpfxb.exejpbppx.exevtlpdt.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltlxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrnrddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjjhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvdvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbndbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txdvhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltxrtvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxdfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nltdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhbnph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtxrpbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvbxbfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvtpttr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frpdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddrlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntpvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvltf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhrblh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpnphnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtvrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrpdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflrtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flpbtxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxnpnrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trrtfxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jptnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lldlfht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rljxnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djhhdpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfjfnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prhhltd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdxrxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfvlltp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rldvfbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrdpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnfpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpfxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpbppx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtlpdt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7cd79210f58de47b883ad8115b103790N.exebbrrh.exedrvlddt.exedrdvh.exexlnhhtd.exehdbxh.exehvvbt.exeflvrdhx.exelvfffrr.exexdvtt.exehhhdb.exebdvvd.exepvtvrfh.exehvfxpv.exefvbtfj.exebfxjnv.exedescription pid process target process PID 2432 wrote to memory of 2196 2432 7cd79210f58de47b883ad8115b103790N.exe bbrrh.exe PID 2432 wrote to memory of 2196 2432 7cd79210f58de47b883ad8115b103790N.exe bbrrh.exe PID 2432 wrote to memory of 2196 2432 7cd79210f58de47b883ad8115b103790N.exe bbrrh.exe PID 2432 wrote to memory of 2196 2432 7cd79210f58de47b883ad8115b103790N.exe bbrrh.exe PID 2196 wrote to memory of 2868 2196 bbrrh.exe drvlddt.exe PID 2196 wrote to memory of 2868 2196 bbrrh.exe drvlddt.exe PID 2196 wrote to memory of 2868 2196 bbrrh.exe drvlddt.exe PID 2196 wrote to memory of 2868 2196 bbrrh.exe drvlddt.exe PID 2868 wrote to memory of 2776 2868 drvlddt.exe drdvh.exe PID 2868 wrote to memory of 2776 2868 drvlddt.exe drdvh.exe PID 2868 wrote to memory of 2776 2868 drvlddt.exe drdvh.exe PID 2868 wrote to memory of 2776 2868 drvlddt.exe drdvh.exe PID 2776 wrote to memory of 2824 2776 drdvh.exe xlnhhtd.exe PID 2776 wrote to memory of 2824 2776 drdvh.exe xlnhhtd.exe PID 2776 wrote to memory of 2824 2776 drdvh.exe xlnhhtd.exe PID 2776 wrote to memory of 2824 2776 drdvh.exe xlnhhtd.exe PID 2824 wrote to memory of 2780 2824 xlnhhtd.exe hdbxh.exe PID 2824 wrote to memory of 2780 2824 xlnhhtd.exe hdbxh.exe PID 2824 wrote to memory of 2780 2824 xlnhhtd.exe hdbxh.exe PID 2824 wrote to memory of 2780 2824 xlnhhtd.exe hdbxh.exe PID 2780 wrote to memory of 2536 2780 hdbxh.exe hvvbt.exe PID 2780 wrote to memory of 2536 2780 hdbxh.exe hvvbt.exe PID 2780 wrote to memory of 2536 2780 hdbxh.exe hvvbt.exe PID 2780 wrote to memory of 2536 2780 hdbxh.exe hvvbt.exe PID 2536 wrote to memory of 2660 2536 hvvbt.exe flvrdhx.exe PID 2536 wrote to memory of 2660 2536 hvvbt.exe flvrdhx.exe PID 2536 wrote to memory of 2660 2536 hvvbt.exe flvrdhx.exe PID 2536 wrote to memory of 2660 2536 hvvbt.exe flvrdhx.exe PID 2660 wrote to memory of 2408 2660 flvrdhx.exe lvfffrr.exe PID 2660 wrote to memory of 2408 2660 flvrdhx.exe lvfffrr.exe PID 2660 wrote to memory of 2408 2660 flvrdhx.exe lvfffrr.exe PID 2660 wrote to memory of 2408 2660 flvrdhx.exe lvfffrr.exe PID 2408 wrote to memory of 3032 2408 lvfffrr.exe xdvtt.exe PID 2408 wrote to memory of 3032 2408 lvfffrr.exe xdvtt.exe PID 2408 wrote to memory of 3032 2408 lvfffrr.exe xdvtt.exe PID 2408 wrote to memory of 3032 2408 lvfffrr.exe xdvtt.exe PID 3032 wrote to memory of 1164 3032 xdvtt.exe hhhdb.exe PID 3032 wrote to memory of 1164 3032 xdvtt.exe hhhdb.exe PID 3032 wrote to memory of 1164 3032 xdvtt.exe hhhdb.exe PID 3032 wrote to memory of 1164 3032 xdvtt.exe hhhdb.exe PID 1164 wrote to memory of 2908 1164 hhhdb.exe bdvvd.exe PID 1164 wrote to memory of 2908 1164 hhhdb.exe bdvvd.exe PID 1164 wrote to memory of 2908 1164 hhhdb.exe bdvvd.exe PID 1164 wrote to memory of 2908 1164 hhhdb.exe bdvvd.exe PID 2908 wrote to memory of 2544 2908 bdvvd.exe pvtvrfh.exe PID 2908 wrote to memory of 2544 2908 bdvvd.exe pvtvrfh.exe PID 2908 wrote to memory of 2544 2908 bdvvd.exe pvtvrfh.exe PID 2908 wrote to memory of 2544 2908 bdvvd.exe pvtvrfh.exe PID 2544 wrote to memory of 2052 2544 pvtvrfh.exe hvfxpv.exe PID 2544 wrote to memory of 2052 2544 pvtvrfh.exe hvfxpv.exe PID 2544 wrote to memory of 2052 2544 pvtvrfh.exe hvfxpv.exe PID 2544 wrote to memory of 2052 2544 pvtvrfh.exe hvfxpv.exe PID 2052 wrote to memory of 2508 2052 hvfxpv.exe fvbtfj.exe PID 2052 wrote to memory of 2508 2052 hvfxpv.exe fvbtfj.exe PID 2052 wrote to memory of 2508 2052 hvfxpv.exe fvbtfj.exe PID 2052 wrote to memory of 2508 2052 hvfxpv.exe fvbtfj.exe PID 2508 wrote to memory of 2004 2508 fvbtfj.exe bfxjnv.exe PID 2508 wrote to memory of 2004 2508 fvbtfj.exe bfxjnv.exe PID 2508 wrote to memory of 2004 2508 fvbtfj.exe bfxjnv.exe PID 2508 wrote to memory of 2004 2508 fvbtfj.exe bfxjnv.exe PID 2004 wrote to memory of 2020 2004 bfxjnv.exe hvdhx.exe PID 2004 wrote to memory of 2020 2004 bfxjnv.exe hvdhx.exe PID 2004 wrote to memory of 2020 2004 bfxjnv.exe hvdhx.exe PID 2004 wrote to memory of 2020 2004 bfxjnv.exe hvdhx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7cd79210f58de47b883ad8115b103790N.exe"C:\Users\Admin\AppData\Local\Temp\7cd79210f58de47b883ad8115b103790N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\bbrrh.exec:\bbrrh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\drvlddt.exec:\drvlddt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\drdvh.exec:\drdvh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\xlnhhtd.exec:\xlnhhtd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\hdbxh.exec:\hdbxh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\hvvbt.exec:\hvvbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\flvrdhx.exec:\flvrdhx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\lvfffrr.exec:\lvfffrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\xdvtt.exec:\xdvtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\hhhdb.exec:\hhhdb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\bdvvd.exec:\bdvvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\pvtvrfh.exec:\pvtvrfh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\hvfxpv.exec:\hvfxpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\fvbtfj.exec:\fvbtfj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\bfxjnv.exec:\bfxjnv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\hvdhx.exec:\hvdhx.exe17⤵
- Executes dropped EXE
PID:2020 -
\??\c:\rfvft.exec:\rfvft.exe18⤵
- Executes dropped EXE
PID:2192 -
\??\c:\lhnbnvf.exec:\lhnbnvf.exe19⤵
- Executes dropped EXE
PID:1324 -
\??\c:\fbdpp.exec:\fbdpp.exe20⤵
- Executes dropped EXE
PID:1880 -
\??\c:\ttpbl.exec:\ttpbl.exe21⤵
- Executes dropped EXE
PID:316 -
\??\c:\hbxtvr.exec:\hbxtvr.exe22⤵
- Executes dropped EXE
PID:700 -
\??\c:\frpdvj.exec:\frpdvj.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:548 -
\??\c:\xpnbplh.exec:\xpnbplh.exe24⤵
- Executes dropped EXE
PID:1328 -
\??\c:\hvpdh.exec:\hvpdh.exe25⤵
- Executes dropped EXE
PID:768 -
\??\c:\ntdfxxp.exec:\ntdfxxp.exe26⤵
- Executes dropped EXE
PID:1952 -
\??\c:\jhntbl.exec:\jhntbl.exe27⤵
- Executes dropped EXE
PID:1412 -
\??\c:\bvtxnd.exec:\bvtxnd.exe28⤵
- Executes dropped EXE
PID:1820 -
\??\c:\vxtrl.exec:\vxtrl.exe29⤵
- Executes dropped EXE
PID:596 -
\??\c:\phpntb.exec:\phpntb.exe30⤵
- Executes dropped EXE
PID:1492 -
\??\c:\lvpvp.exec:\lvpvp.exe31⤵
- Executes dropped EXE
PID:2160 -
\??\c:\lldlfht.exec:\lldlfht.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:888 -
\??\c:\tlpldjt.exec:\tlpldjt.exe33⤵
- Executes dropped EXE
PID:2552 -
\??\c:\jlpxlbf.exec:\jlpxlbf.exe34⤵PID:2736
-
\??\c:\ftndnv.exec:\ftndnv.exe35⤵
- Executes dropped EXE
PID:2892 -
\??\c:\rvbvpf.exec:\rvbvpf.exe36⤵
- Executes dropped EXE
PID:1620 -
\??\c:\jvxjpvr.exec:\jvxjpvr.exe37⤵
- Executes dropped EXE
PID:2800 -
\??\c:\htlnnx.exec:\htlnnx.exe38⤵
- Executes dropped EXE
PID:2884 -
\??\c:\pxtrf.exec:\pxtrf.exe39⤵
- Executes dropped EXE
PID:2776 -
\??\c:\ffbhpnn.exec:\ffbhpnn.exe40⤵
- Executes dropped EXE
PID:2672 -
\??\c:\blfpjj.exec:\blfpjj.exe41⤵
- Executes dropped EXE
PID:2668 -
\??\c:\ddxxnd.exec:\ddxxnd.exe42⤵
- Executes dropped EXE
PID:2808 -
\??\c:\xdlhx.exec:\xdlhx.exe43⤵
- Executes dropped EXE
PID:1632 -
\??\c:\xjlvnjd.exec:\xjlvnjd.exe44⤵
- Executes dropped EXE
PID:1824 -
\??\c:\lvhdd.exec:\lvhdd.exe45⤵
- Executes dropped EXE
PID:2096 -
\??\c:\rltbbb.exec:\rltbbb.exe46⤵
- Executes dropped EXE
PID:2504 -
\??\c:\xthfh.exec:\xthfh.exe47⤵
- Executes dropped EXE
PID:576 -
\??\c:\nxjrh.exec:\nxjrh.exe48⤵
- Executes dropped EXE
PID:2176 -
\??\c:\nbxvxph.exec:\nbxvxph.exe49⤵
- Executes dropped EXE
PID:2952 -
\??\c:\dfdnvhp.exec:\dfdnvhp.exe50⤵
- Executes dropped EXE
PID:1112 -
\??\c:\htbnv.exec:\htbnv.exe51⤵
- Executes dropped EXE
PID:1764 -
\??\c:\brtrdr.exec:\brtrdr.exe52⤵
- Executes dropped EXE
PID:2136 -
\??\c:\xrtlndp.exec:\xrtlndp.exe53⤵
- Executes dropped EXE
PID:2512 -
\??\c:\nfdbnhd.exec:\nfdbnhd.exe54⤵
- Executes dropped EXE
PID:2400 -
\??\c:\fnjrrh.exec:\fnjrrh.exe55⤵
- Executes dropped EXE
PID:2484 -
\??\c:\xfllhhv.exec:\xfllhhv.exe56⤵
- Executes dropped EXE
PID:2056 -
\??\c:\jpdpl.exec:\jpdpl.exe57⤵
- Executes dropped EXE
PID:2436 -
\??\c:\lhtnjhh.exec:\lhtnjhh.exe58⤵
- Executes dropped EXE
PID:2324 -
\??\c:\jlrdhj.exec:\jlrdhj.exe59⤵
- Executes dropped EXE
PID:1324 -
\??\c:\dtnftp.exec:\dtnftp.exe60⤵
- Executes dropped EXE
PID:2428 -
\??\c:\nxhlfrj.exec:\nxhlfrj.exe61⤵
- Executes dropped EXE
PID:1284 -
\??\c:\dlftx.exec:\dlftx.exe62⤵
- Executes dropped EXE
PID:952 -
\??\c:\nbblpdb.exec:\nbblpdb.exe63⤵
- Executes dropped EXE
PID:1548 -
\??\c:\lvttlxr.exec:\lvttlxr.exe64⤵
- Executes dropped EXE
PID:1572 -
\??\c:\xdnjp.exec:\xdnjp.exe65⤵
- Executes dropped EXE
PID:1568 -
\??\c:\tttnlf.exec:\tttnlf.exe66⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:640 -
\??\c:\ldrpx.exec:\ldrpx.exe67⤵PID:2568
-
\??\c:\xbtpfll.exec:\xbtpfll.exe68⤵PID:3000
-
\??\c:\xtjdtln.exec:\xtjdtln.exe69⤵PID:2532
-
\??\c:\jxnpnrh.exec:\jxnpnrh.exe70⤵
- System Location Discovery: System Language Discovery
PID:2396 -
\??\c:\rnhxvt.exec:\rnhxvt.exe71⤵PID:1504
-
\??\c:\tnhvv.exec:\tnhvv.exe72⤵PID:656
-
\??\c:\nxxfnj.exec:\nxxfnj.exe73⤵PID:2620
-
\??\c:\vdnrfxd.exec:\vdnrfxd.exe74⤵PID:2548
-
\??\c:\dlbfphd.exec:\dlbfphd.exe75⤵PID:1536
-
\??\c:\fptbdfp.exec:\fptbdfp.exe76⤵PID:2252
-
\??\c:\lhvtdtr.exec:\lhvtdtr.exe77⤵PID:2796
-
\??\c:\dllhld.exec:\dllhld.exe78⤵PID:2892
-
\??\c:\trbrj.exec:\trbrj.exe79⤵PID:2872
-
\??\c:\trdxddv.exec:\trdxddv.exe80⤵PID:3004
-
\??\c:\hbjpldj.exec:\hbjpldj.exe81⤵PID:2760
-
\??\c:\bjdfrl.exec:\bjdfrl.exe82⤵PID:2824
-
\??\c:\bbxrnf.exec:\bbxrnf.exe83⤵PID:2700
-
\??\c:\djhhdpr.exec:\djhhdpr.exe84⤵
- System Location Discovery: System Language Discovery
PID:2716 -
\??\c:\xvjptlv.exec:\xvjptlv.exe85⤵PID:876
-
\??\c:\jnhdh.exec:\jnhdh.exe86⤵PID:2604
-
\??\c:\rhpjrrd.exec:\rhpjrrd.exe87⤵PID:1344
-
\??\c:\hhvrht.exec:\hhvrht.exe88⤵PID:2276
-
\??\c:\rrpvf.exec:\rrpvf.exe89⤵PID:2704
-
\??\c:\ljnrrnv.exec:\ljnrrnv.exe90⤵PID:1752
-
\??\c:\tffnj.exec:\tffnj.exe91⤵PID:2956
-
\??\c:\lbhhnnb.exec:\lbhhnnb.exe92⤵PID:2820
-
\??\c:\vnplnvp.exec:\vnplnvp.exe93⤵PID:1580
-
\??\c:\jnbtbrp.exec:\jnbtbrp.exe94⤵PID:2416
-
\??\c:\btxfjtx.exec:\btxfjtx.exe95⤵PID:1468
-
\??\c:\jrfrbp.exec:\jrfrbp.exe96⤵PID:1684
-
\??\c:\fxtrr.exec:\fxtrr.exe97⤵PID:2024
-
\??\c:\rrjhx.exec:\rrjhx.exe98⤵PID:2036
-
\??\c:\ljjntx.exec:\ljjntx.exe99⤵PID:2480
-
\??\c:\nfdhl.exec:\nfdhl.exe100⤵PID:2456
-
\??\c:\fxpvhtr.exec:\fxpvhtr.exe101⤵PID:2360
-
\??\c:\nvhfdx.exec:\nvhfdx.exe102⤵PID:2232
-
\??\c:\vblljlv.exec:\vblljlv.exe103⤵PID:2032
-
\??\c:\blbnlr.exec:\blbnlr.exe104⤵PID:2372
-
\??\c:\nfbnv.exec:\nfbnv.exe105⤵PID:1884
-
\??\c:\blrfhfr.exec:\blrfhfr.exe106⤵PID:2616
-
\??\c:\jnpjd.exec:\jnpjd.exe107⤵PID:1552
-
\??\c:\jlrjvl.exec:\jlrjvl.exe108⤵PID:844
-
\??\c:\jrlxf.exec:\jrlxf.exe109⤵PID:1564
-
\??\c:\pbdxjrb.exec:\pbdxjrb.exe110⤵PID:1724
-
\??\c:\lxdbdd.exec:\lxdbdd.exe111⤵PID:1844
-
\??\c:\jpbppx.exec:\jpbppx.exe112⤵
- System Location Discovery: System Language Discovery
PID:436 -
\??\c:\bvjlh.exec:\bvjlh.exe113⤵PID:1704
-
\??\c:\fdjxthf.exec:\fdjxthf.exe114⤵PID:584
-
\??\c:\pfrjdvf.exec:\pfrjdvf.exe115⤵PID:932
-
\??\c:\jbtxn.exec:\jbtxn.exe116⤵PID:2560
-
\??\c:\hnjpx.exec:\hnjpx.exe117⤵PID:2552
-
\??\c:\xbnfdx.exec:\xbnfdx.exe118⤵PID:2736
-
\??\c:\hbldd.exec:\hbldd.exe119⤵PID:2252
-
\??\c:\lhhnh.exec:\lhhnh.exe120⤵PID:2796
-
\??\c:\lnbbpjt.exec:\lnbbpjt.exe121⤵PID:588
-
\??\c:\pdpdlb.exec:\pdpdlb.exe122⤵PID:2680
-
\??\c:\fvfdbl.exec:\fvfdbl.exe123⤵PID:2756
-
\??\c:\phjvhv.exec:\phjvhv.exe124⤵PID:2932
-
\??\c:\xpphb.exec:\xpphb.exe125⤵PID:2824
-
\??\c:\pjfdx.exec:\pjfdx.exe126⤵PID:2808
-
\??\c:\vbxrvb.exec:\vbxrvb.exe127⤵PID:2764
-
\??\c:\dvnrx.exec:\dvnrx.exe128⤵PID:2740
-
\??\c:\pvnxjt.exec:\pvnxjt.exe129⤵PID:2860
-
\??\c:\ntlfx.exec:\ntlfx.exe130⤵PID:2064
-
\??\c:\prpjlp.exec:\prpjlp.exe131⤵PID:3032
-
\??\c:\vfnpr.exec:\vfnpr.exe132⤵PID:2916
-
\??\c:\lvdtbpn.exec:\lvdtbpn.exe133⤵PID:2128
-
\??\c:\ltfhhd.exec:\ltfhhd.exe134⤵PID:1216
-
\??\c:\xjpxbj.exec:\xjpxbj.exe135⤵PID:3016
-
\??\c:\trpht.exec:\trpht.exe136⤵PID:2136
-
\??\c:\fjbblvd.exec:\fjbblvd.exe137⤵PID:944
-
\??\c:\djpjnn.exec:\djpjnn.exe138⤵PID:2508
-
\??\c:\hrvrhf.exec:\hrvrhf.exe139⤵PID:2200
-
\??\c:\pdrnnhh.exec:\pdrnnhh.exe140⤵PID:2068
-
\??\c:\rxdjjj.exec:\rxdjjj.exe141⤵PID:928
-
\??\c:\fnxnxxr.exec:\fnxnxxr.exe142⤵PID:2216
-
\??\c:\rvfbhfb.exec:\rvfbhfb.exe143⤵PID:276
-
\??\c:\ppdjr.exec:\ppdjr.exe144⤵PID:2428
-
\??\c:\nbrjrxh.exec:\nbrjrxh.exe145⤵PID:2260
-
\??\c:\rrjfvf.exec:\rrjfvf.exe146⤵PID:2032
-
\??\c:\pdxbxb.exec:\pdxbxb.exe147⤵PID:2184
-
\??\c:\pxfjdv.exec:\pxfjdv.exe148⤵PID:2180
-
\??\c:\bdvvh.exec:\bdvvh.exe149⤵PID:1568
-
\??\c:\pddhrdp.exec:\pddhrdp.exe150⤵PID:1244
-
\??\c:\dvhtv.exec:\dvhtv.exe151⤵PID:2568
-
\??\c:\pjxjb.exec:\pjxjb.exe152⤵PID:3000
-
\??\c:\xfrhb.exec:\xfrhb.exe153⤵PID:1756
-
\??\c:\xdnxnjh.exec:\xdnxnjh.exe154⤵PID:1404
-
\??\c:\tbxbxn.exec:\tbxbxn.exe155⤵PID:1760
-
\??\c:\brfbf.exec:\brfbf.exe156⤵PID:1516
-
\??\c:\xlnhfn.exec:\xlnhfn.exe157⤵PID:584
-
\??\c:\bbppr.exec:\bbppr.exe158⤵PID:2548
-
\??\c:\htbnvf.exec:\htbnvf.exe159⤵PID:1536
-
\??\c:\ppdbxf.exec:\ppdbxf.exe160⤵PID:2784
-
\??\c:\nldpdb.exec:\nldpdb.exe161⤵PID:2896
-
\??\c:\nvltf.exec:\nvltf.exe162⤵
- System Location Discovery: System Language Discovery
PID:2748 -
\??\c:\rjpnxr.exec:\rjpnxr.exe163⤵PID:2800
-
\??\c:\pblpntp.exec:\pblpntp.exe164⤵PID:2960
-
\??\c:\jvphv.exec:\jvphv.exe165⤵PID:2776
-
\??\c:\tnvlxdx.exec:\tnvlxdx.exe166⤵PID:2644
-
\??\c:\tvhltjt.exec:\tvhltjt.exe167⤵PID:840
-
\??\c:\fvvbn.exec:\fvvbn.exe168⤵PID:676
-
\??\c:\tbtjhj.exec:\tbtjhj.exe169⤵PID:2380
-
\??\c:\trdbv.exec:\trdbv.exe170⤵PID:2764
-
\??\c:\hvxrhnd.exec:\hvxrhnd.exe171⤵PID:2968
-
\??\c:\hhdtf.exec:\hhdtf.exe172⤵PID:2732
-
\??\c:\lxpjrx.exec:\lxpjrx.exe173⤵PID:2912
-
\??\c:\hbnbvp.exec:\hbnbvp.exe174⤵PID:2936
-
\??\c:\nlhhtj.exec:\nlhhtj.exe175⤵PID:1728
-
\??\c:\txnhnvv.exec:\txnhnvv.exe176⤵PID:2908
-
\??\c:\pfbll.exec:\pfbll.exe177⤵PID:2052
-
\??\c:\hdxpbrj.exec:\hdxpbrj.exe178⤵PID:2404
-
\??\c:\tdjnp.exec:\tdjnp.exe179⤵PID:1676
-
\??\c:\dbndvp.exec:\dbndvp.exe180⤵PID:944
-
\??\c:\nnddrfp.exec:\nnddrfp.exe181⤵PID:2264
-
\??\c:\nddfr.exec:\nddfr.exe182⤵PID:2192
-
\??\c:\tlrfl.exec:\tlrfl.exe183⤵PID:108
-
\??\c:\rjhlhhp.exec:\rjhlhhp.exe184⤵PID:2828
-
\??\c:\xhpxn.exec:\xhpxn.exe185⤵PID:560
-
\??\c:\jdllbn.exec:\jdllbn.exe186⤵PID:2156
-
\??\c:\dhppxt.exec:\dhppxt.exe187⤵PID:940
-
\??\c:\bflhjn.exec:\bflhjn.exe188⤵PID:2600
-
\??\c:\rtdpb.exec:\rtdpb.exe189⤵PID:3060
-
\??\c:\prhhltd.exec:\prhhltd.exe190⤵
- System Location Discovery: System Language Discovery
PID:1108 -
\??\c:\dlrhn.exec:\dlrhn.exe191⤵PID:1716
-
\??\c:\vpvbpvv.exec:\vpvbpvv.exe192⤵PID:2340
-
\??\c:\vhxlf.exec:\vhxlf.exe193⤵PID:1496
-
\??\c:\dpxbb.exec:\dpxbb.exe194⤵PID:920
-
\??\c:\bfjjhff.exec:\bfjjhff.exe195⤵PID:620
-
\??\c:\fjfrpx.exec:\fjfrpx.exe196⤵PID:2996
-
\??\c:\pphjvl.exec:\pphjvl.exe197⤵PID:1692
-
\??\c:\nvrpf.exec:\nvrpf.exe198⤵PID:2160
-
\??\c:\tvlvv.exec:\tvlvv.exe199⤵PID:708
-
\??\c:\hlhhn.exec:\hlhhn.exe200⤵PID:2320
-
\??\c:\xjtlt.exec:\xjtlt.exe201⤵PID:888
-
\??\c:\ndpdll.exec:\ndpdll.exe202⤵PID:1624
-
\??\c:\plddvtr.exec:\plddvtr.exe203⤵PID:1732
-
\??\c:\rtlrh.exec:\rtlrh.exe204⤵PID:2880
-
\??\c:\nvxnxp.exec:\nvxnxp.exe205⤵PID:2336
-
\??\c:\rbrvp.exec:\rbrvp.exe206⤵PID:2888
-
\??\c:\rhfhxxl.exec:\rhfhxxl.exe207⤵PID:2864
-
\??\c:\fblfxh.exec:\fblfxh.exe208⤵PID:2856
-
\??\c:\fhftf.exec:\fhftf.exe209⤵PID:2188
-
\??\c:\phrdvd.exec:\phrdvd.exe210⤵PID:2808
-
\??\c:\vtjntld.exec:\vtjntld.exe211⤵PID:2660
-
\??\c:\rdbhhtv.exec:\rdbhhtv.exe212⤵PID:1824
-
\??\c:\dldbh.exec:\dldbh.exe213⤵PID:976
-
\??\c:\ltvxpv.exec:\ltvxpv.exe214⤵PID:2712
-
\??\c:\hxrpbn.exec:\hxrpbn.exe215⤵PID:1636
-
\??\c:\tpptvn.exec:\tpptvn.exe216⤵PID:2952
-
\??\c:\nttjlx.exec:\nttjlx.exe217⤵PID:1708
-
\??\c:\xhhhhd.exec:\xhhhhd.exe218⤵PID:1216
-
\??\c:\tjbth.exec:\tjbth.exe219⤵PID:900
-
\??\c:\lhrxvr.exec:\lhrxvr.exe220⤵PID:2008
-
\??\c:\rpxlnft.exec:\rpxlnft.exe221⤵PID:948
-
\??\c:\fxtlx.exec:\fxtlx.exe222⤵PID:2440
-
\??\c:\xrdnjdd.exec:\xrdnjdd.exe223⤵PID:2212
-
\??\c:\hfllfp.exec:\hfllfp.exe224⤵PID:1264
-
\??\c:\jptfh.exec:\jptfh.exe225⤵PID:2288
-
\??\c:\hhdrj.exec:\hhdrj.exe226⤵PID:2216
-
\??\c:\jnvdlpf.exec:\jnvdlpf.exe227⤵PID:1800
-
\??\c:\lddvlt.exec:\lddvlt.exe228⤵PID:1248
-
\??\c:\djjtpf.exec:\djjtpf.exe229⤵PID:3056
-
\??\c:\lxnnx.exec:\lxnnx.exe230⤵PID:2372
-
\??\c:\fvnvb.exec:\fvnvb.exe231⤵PID:1884
-
\??\c:\vhbnph.exec:\vhbnph.exe232⤵
- System Location Discovery: System Language Discovery
PID:1232 -
\??\c:\vdftv.exec:\vdftv.exe233⤵PID:1720
-
\??\c:\xjphbl.exec:\xjphbl.exe234⤵PID:1976
-
\??\c:\dxphnlf.exec:\dxphnlf.exe235⤵PID:2376
-
\??\c:\vpfnxtr.exec:\vpfnxtr.exe236⤵PID:1496
-
\??\c:\dpnphnx.exec:\dpnphnx.exe237⤵
- System Location Discovery: System Language Discovery
PID:596 -
\??\c:\tjrpr.exec:\tjrpr.exe238⤵PID:1492
-
\??\c:\xfbfbfj.exec:\xfbfbfj.exe239⤵PID:1504
-
\??\c:\thrfht.exec:\thrfht.exe240⤵PID:2728
-
\??\c:\nttbp.exec:\nttbp.exe241⤵PID:2432
-
\??\c:\vjljrph.exec:\vjljrph.exe242⤵PID:2328