Analysis
- max time kernel
29s - max time network
105s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
07/06/2024, 16:37
Behavioral task
behavioral1
Sample
6cccd44206b5bfa722c275c32542b890_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
- Target 6cccd44206b5bfa722c275c32542b890_NeikiAnalytics.exe
- Size 138KB
- Sample240607-t45g3acb64
- SHA256 d28156ab5ea69561abd89d32a422f7fbf3d8cbf3d00a87c960c5f7c85dc282cd
- MD5 6cccd44206b5bfa722c275c32542b890
- SHA1 45b0dbb9b089a3464237c79b0861453a8e1d0f94
- SHA512 6c30d5aa90be71dbc9131894b24823aa767965d9664fa6c87bafad3ce6c2eb52afa0e94b93ac4bc6ce48e5aa773ecb1c9bcab5596e124b88c2e12feb8ba4f8be
- SSDEEP 3072:khOmTsF93UYfwC6GIoutpYcvrqrE66kropO6BfDKPeGrR0:kcm4FmowdHoSphraHcpOaKHC
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3728-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4404-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5080-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1352-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/404-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1852-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1904-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4296-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2668-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3952-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3952-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4640-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3492-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4432-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4664-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1868-393-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1684-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1848-447-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1712-454-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4684-735-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/716-811-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/512-836-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3720-895-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3716-869-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1120-840-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4360-688-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4976-658-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4532-632-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1724-590-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2388-587-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2232-567-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4784-522-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3792-506-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2264-436-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2916-426-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/396-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3624-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3216-350-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3412-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3220-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1340-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3992-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2408-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2672-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4524-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/60-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1876-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/448-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4204-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2868-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3012-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4644-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1168-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4060-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3112-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3328-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4172-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4068-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4956-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3872-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4988-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5088-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/60-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/776-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 1892 frxffff.exe 4488 lxfffxf.exe 4568 jjjdp.exe 776 lrlfffx.exe 60 llfxffx.exe 4404 tthhhh.exe 5088 lfrllrx.exe 5080 1nbthh.exe 1524 jvvpd.exe 4988 ffxlrxx.exe 3872 ntttnn.exe 1352 vpvdj.exe 4956 xfffxfr.exe 4068 bbnbtn.exe 2408 jvpjd.exe 1844 9lxrrll.exe 2596 bntnnh.exe 4172 jvdpd.exe 680 fxrlffl.exe 2064 hhbttt.exe 3328 pjdpj.exe 3112 jvdjj.exe 4060 nhbhht.exe 4872 ttntbh.exe 1168 pvjvv.exe 4644 tbbbht.exe 5104 9nnnhb.exe 4920 pjjvp.exe 404 llxxllx.exe 1852 nbnhhh.exe 3012 pjjpj.exe 2728 1xflxxf.exe 2868 tnthnn.exe 4512 jjjpp.exe 1904 llxxxrx.exe 4204 thhbbt.exe 2444 pdpdj.exe 448 fllxfxf.exe 4296 1tthbt.exe 1868 bhnhbb.exe 932 9ppjd.exe 2668 llxlfxl.exe 1876 hbbhtn.exe 2460 dvdpd.exe 3716 fffrfrf.exe 60 bhbtnh.exe 4524 pjdvj.exe 2940 flfxfrr.exe 4980 tbbnhn.exe 2628 nnnnbh.exe 3952 jjjdv.exe 4504 ffrrlxr.exe 4640 rrflrrr.exe 2068 pvjjp.exe 3964 xflrxll.exe 4244 btbbhb.exe 2228 vvvjv.exe 2672 3xrxrlf.exe 2408 bbtnnt.exe 3492 nttnnh.exe 2420 vvpjj.exe 4432 llxrllr.exe 2312 tbhnnb.exe 680 htbtnh.exe -
resource yara_rule behavioral2/memory/3728-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023414-6.dat upx behavioral2/memory/4488-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4568-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023425-31.dat upx behavioral2/files/0x0007000000023426-37.dat upx behavioral2/memory/4404-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5080-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023429-55.dat upx behavioral2/files/0x000700000002342a-58.dat upx behavioral2/files/0x000700000002342b-66.dat upx behavioral2/memory/1352-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1352-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023431-99.dat upx behavioral2/files/0x0007000000023432-106.dat upx behavioral2/files/0x0007000000023433-112.dat upx behavioral2/files/0x0007000000023434-116.dat upx behavioral2/files/0x0007000000023437-134.dat upx behavioral2/files/0x000800000002341f-139.dat upx behavioral2/files/0x0007000000023438-145.dat upx behavioral2/memory/4644-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343b-162.dat upx behavioral2/files/0x000700000002343c-169.dat upx behavioral2/memory/404-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1852-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023388-187.dat upx behavioral2/memory/1904-201-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4296-218-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2668-228-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3952-257-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3952-261-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4640-267-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3492-291-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4432-298-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1872-308-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4664-373-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4556-385-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1868-393-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1684-401-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1848-447-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1712-454-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3268-474-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1940-487-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4684-735-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/716-811-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/512-836-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3720-895-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3716-869-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1728-844-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1120-840-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3036-804-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3536-770-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4344-757-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2328-695-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4360-688-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1120-684-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1964-671-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4976-658-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4424-651-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4532-632-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4372-625-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3768-603-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1724-590-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2388-587-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3728 wrote to memory of 1892 3728 6cccd44206b5bfa722c275c32542b890_NeikiAnalytics.exe 82 PID 3728 wrote to memory of 1892 3728 6cccd44206b5bfa722c275c32542b890_NeikiAnalytics.exe 82 PID 3728 wrote to memory of 1892 3728 6cccd44206b5bfa722c275c32542b890_NeikiAnalytics.exe 82 PID 1892 wrote to memory of 4488 1892 frxffff.exe 83 PID 1892 wrote to memory of 4488 1892 frxffff.exe 83 PID 1892 wrote to memory of 4488 1892 frxffff.exe 83 PID 4488 wrote to memory of 4568 4488 lxfffxf.exe 84 PID 4488 wrote to memory of 4568 4488 lxfffxf.exe 84 PID 4488 wrote to memory of 4568 4488 lxfffxf.exe 84 PID 4568 wrote to memory of 776 4568 jjjdp.exe 85 PID 4568 wrote to memory of 776 4568 jjjdp.exe 85 PID 4568 wrote to memory of 776 4568 jjjdp.exe 85 PID 776 wrote to memory of 60 776 lrlfffx.exe 86 PID 776 wrote to memory of 60 776 lrlfffx.exe 86 PID 776 wrote to memory of 60 776 lrlfffx.exe 86 PID 60 wrote to memory of 4404 60 llfxffx.exe 87 PID 60 wrote to memory of 4404 60 llfxffx.exe 87 PID 60 wrote to memory of 4404 60 llfxffx.exe 87 PID 4404 wrote to memory of 5088 4404 tthhhh.exe 88 PID 4404 wrote to memory of 5088 4404 tthhhh.exe 88 PID 4404 wrote to memory of 5088 4404 tthhhh.exe 88 PID 5088 wrote to memory of 5080 5088 lfrllrx.exe 90 PID 5088 wrote to memory of 5080 5088 lfrllrx.exe 90 PID 5088 wrote to memory of 5080 5088 lfrllrx.exe 90 PID 5080 wrote to memory of 1524 5080 1nbthh.exe 91 PID 5080 wrote to memory of 1524 5080 1nbthh.exe 91 PID 5080 wrote to memory of 1524 5080 1nbthh.exe 91 PID 1524 wrote to memory of 4988 1524 jvvpd.exe 92 PID 1524 wrote to memory of 4988 1524 jvvpd.exe 92 PID 1524 wrote to memory of 4988 1524 jvvpd.exe 92 PID 4988 wrote to memory of 3872 4988 ffxlrxx.exe 94 PID 4988 wrote to memory of 3872 4988 ffxlrxx.exe 94 PID 4988 wrote to memory of 3872 4988 ffxlrxx.exe 94 PID 3872 wrote to memory of 1352 3872 ntttnn.exe 95 PID 3872 wrote to memory of 1352 3872 ntttnn.exe 95 PID 3872 wrote to memory of 1352 3872 ntttnn.exe 95 PID 1352 wrote to memory of 4956 1352 vpvdj.exe 96 PID 1352 wrote to memory of 4956 1352 vpvdj.exe 96 PID 1352 wrote to memory of 4956 1352 vpvdj.exe 96 PID 4956 wrote to memory of 4068 4956 xfffxfr.exe 98 PID 4956 wrote to memory of 4068 4956 xfffxfr.exe 98 PID 4956 wrote to memory of 4068 4956 xfffxfr.exe 98 PID 4068 wrote to memory of 2408 4068 bbnbtn.exe 490 PID 4068 wrote to memory of 2408 4068 bbnbtn.exe 490 PID 4068 wrote to memory of 2408 4068 bbnbtn.exe 490 PID 2408 wrote to memory of 1844 2408 jvpjd.exe 101 PID 2408 wrote to memory of 1844 2408 jvpjd.exe 101 PID 2408 wrote to memory of 1844 2408 jvpjd.exe 101 PID 1844 wrote to memory of 2596 1844 9lxrrll.exe 102 PID 1844 wrote to memory of 2596 1844 9lxrrll.exe 102 PID 1844 wrote to memory of 2596 1844 9lxrrll.exe 102 PID 2596 wrote to memory of 4172 2596 bntnnh.exe 103 PID 2596 wrote to memory of 4172 2596 bntnnh.exe 103 PID 2596 wrote to memory of 4172 2596 bntnnh.exe 103 PID 4172 wrote to memory of 680 4172 jvdpd.exe 104 PID 4172 wrote to memory of 680 4172 jvdpd.exe 104 PID 4172 wrote to memory of 680 4172 jvdpd.exe 104 PID 680 wrote to memory of 2064 680 fxrlffl.exe 105 PID 680 wrote to memory of 2064 680 fxrlffl.exe 105 PID 680 wrote to memory of 2064 680 fxrlffl.exe 105 PID 2064 wrote to memory of 3328 2064 hhbttt.exe 106 PID 2064 wrote to memory of 3328 2064 hhbttt.exe 106 PID 2064 wrote to memory of 3328 2064 hhbttt.exe 106 PID 3328 wrote to memory of 3112 3328 pjdpj.exe 107
Processes
-
C:\Windows\System32\cjmmco.exe"C:\Windows\System32\cjmmco.exe"1⤵PID:4292
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe1⤵PID:4504
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\6cccd44206b5bfa722c275c32542b890_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6cccd44206b5bfa722c275c32542b890_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\frxffff.exec:\frxffff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\lxfffxf.exec:\lxfffxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\jjjdp.exec:\jjjdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\lrlfffx.exec:\lrlfffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\llfxffx.exec:\llfxffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\tthhhh.exec:\tthhhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\lfrllrx.exec:\lfrllrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\1nbthh.exec:\1nbthh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\jvvpd.exec:\jvvpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\ffxlrxx.exec:\ffxlrxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\ntttnn.exec:\ntttnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\vpvdj.exec:\vpvdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\xfffxfr.exec:\xfffxfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\bbnbtn.exec:\bbnbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\jvpjd.exec:\jvpjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\9lxrrll.exec:\9lxrrll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\bntnnh.exec:\bntnnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\jvdpd.exec:\jvdpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\fxrlffl.exec:\fxrlffl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
\??\c:\hhbttt.exec:\hhbttt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\pjdpj.exec:\pjdpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\jvdjj.exec:\jvdjj.exe23⤵
- Executes dropped EXE
PID:3112 -
\??\c:\nhbhht.exec:\nhbhht.exe24⤵
- Executes dropped EXE
PID:4060 -
\??\c:\ttntbh.exec:\ttntbh.exe25⤵
- Executes dropped EXE
PID:4872 -
\??\c:\pvjvv.exec:\pvjvv.exe26⤵
- Executes dropped EXE
PID:1168 -
\??\c:\tbbbht.exec:\tbbbht.exe27⤵
- Executes dropped EXE
PID:4644 -
\??\c:\9nnnhb.exec:\9nnnhb.exe28⤵
- Executes dropped EXE
PID:5104 -
\??\c:\pjjvp.exec:\pjjvp.exe29⤵
- Executes dropped EXE
PID:4920 -
\??\c:\llxxllx.exec:\llxxllx.exe30⤵
- Executes dropped EXE
PID:404 -
\??\c:\nbnhhh.exec:\nbnhhh.exe31⤵
- Executes dropped EXE
PID:1852 -
\??\c:\pjjpj.exec:\pjjpj.exe32⤵
- Executes dropped EXE
PID:3012 -
\??\c:\1xflxxf.exec:\1xflxxf.exe33⤵
- Executes dropped EXE
PID:2728 -
\??\c:\tnthnn.exec:\tnthnn.exe34⤵
- Executes dropped EXE
PID:2868 -
\??\c:\jjjpp.exec:\jjjpp.exe35⤵
- Executes dropped EXE
PID:4512 -
\??\c:\llxxxrx.exec:\llxxxrx.exe36⤵
- Executes dropped EXE
PID:1904 -
\??\c:\thhbbt.exec:\thhbbt.exe37⤵
- Executes dropped EXE
PID:4204 -
\??\c:\pdpdj.exec:\pdpdj.exe38⤵
- Executes dropped EXE
PID:2444 -
\??\c:\fllxfxf.exec:\fllxfxf.exe39⤵
- Executes dropped EXE
PID:448 -
\??\c:\1tthbt.exec:\1tthbt.exe40⤵
- Executes dropped EXE
PID:4296 -
\??\c:\bhnhbb.exec:\bhnhbb.exe41⤵
- Executes dropped EXE
PID:1868 -
\??\c:\9ppjd.exec:\9ppjd.exe42⤵
- Executes dropped EXE
PID:932 -
\??\c:\llxlfxl.exec:\llxlfxl.exe43⤵
- Executes dropped EXE
PID:2668 -
\??\c:\hbbhtn.exec:\hbbhtn.exe44⤵
- Executes dropped EXE
PID:1876 -
\??\c:\dvdpd.exec:\dvdpd.exe45⤵
- Executes dropped EXE
PID:2460 -
\??\c:\fffrfrf.exec:\fffrfrf.exe46⤵
- Executes dropped EXE
PID:3716 -
\??\c:\bhbtnh.exec:\bhbtnh.exe47⤵
- Executes dropped EXE
PID:60 -
\??\c:\pjdvj.exec:\pjdvj.exe48⤵
- Executes dropped EXE
PID:4524 -
\??\c:\flfxfrr.exec:\flfxfrr.exe49⤵
- Executes dropped EXE
PID:2940 -
\??\c:\tbbnhn.exec:\tbbnhn.exe50⤵
- Executes dropped EXE
PID:4980 -
\??\c:\nnnnbh.exec:\nnnnbh.exe51⤵
- Executes dropped EXE
PID:2628 -
\??\c:\jjjdv.exec:\jjjdv.exe52⤵
- Executes dropped EXE
PID:3952 -
\??\c:\ffrrlxr.exec:\ffrrlxr.exe53⤵
- Executes dropped EXE
PID:4504 -
\??\c:\rrflrrr.exec:\rrflrrr.exe54⤵
- Executes dropped EXE
PID:4640 -
\??\c:\pvjjp.exec:\pvjjp.exe55⤵
- Executes dropped EXE
PID:2068 -
\??\c:\xflrxll.exec:\xflrxll.exe56⤵
- Executes dropped EXE
PID:3964 -
\??\c:\btbbhb.exec:\btbbhb.exe57⤵
- Executes dropped EXE
PID:4244 -
\??\c:\vvvjv.exec:\vvvjv.exe58⤵
- Executes dropped EXE
PID:2228 -
\??\c:\3xrxrlf.exec:\3xrxrlf.exe59⤵
- Executes dropped EXE
PID:2672 -
\??\c:\bbtnnt.exec:\bbtnnt.exe60⤵
- Executes dropped EXE
PID:2408 -
\??\c:\nttnnh.exec:\nttnnh.exe61⤵
- Executes dropped EXE
PID:3492 -
\??\c:\vvpjj.exec:\vvpjj.exe62⤵
- Executes dropped EXE
PID:2420 -
\??\c:\llxrllr.exec:\llxrllr.exe63⤵
- Executes dropped EXE
PID:4432 -
\??\c:\tbhnnb.exec:\tbhnnb.exe64⤵
- Executes dropped EXE
PID:2312 -
\??\c:\htbtnh.exec:\htbtnh.exe65⤵
- Executes dropped EXE
PID:680 -
\??\c:\pjjpp.exec:\pjjpp.exe66⤵PID:3484
-
\??\c:\llrrlrr.exec:\llrrlrr.exe67⤵PID:1872
-
\??\c:\rfffrrf.exec:\rfffrrf.exe68⤵PID:3992
-
\??\c:\9nnnnb.exec:\9nnnnb.exe69⤵PID:1108
-
\??\c:\jdvvp.exec:\jdvvp.exe70⤵PID:388
-
\??\c:\pddvp.exec:\pddvp.exe71⤵PID:4480
-
\??\c:\lfllrrf.exec:\lfllrrf.exe72⤵PID:1340
-
\??\c:\bhnhbt.exec:\bhnhbt.exe73⤵PID:2004
-
\??\c:\tntnnt.exec:\tntnnt.exe74⤵PID:3220
-
\??\c:\dpjpd.exec:\dpjpd.exe75⤵PID:3412
-
\??\c:\9jjdp.exec:\9jjdp.exe76⤵PID:5104
-
\??\c:\rlrrlll.exec:\rlrrlll.exe77⤵PID:4920
-
\??\c:\ntbhtt.exec:\ntbhtt.exe78⤵PID:3216
-
\??\c:\btbnbn.exec:\btbnbn.exe79⤵PID:1116
-
\??\c:\1ppjd.exec:\1ppjd.exe80⤵PID:848
-
\??\c:\xxflllr.exec:\xxflllr.exe81⤵PID:2532
-
\??\c:\ffxxrfr.exec:\ffxxrfr.exe82⤵PID:4588
-
\??\c:\hbnhbb.exec:\hbnhbb.exe83⤵PID:724
-
\??\c:\bhbhtt.exec:\bhbhtt.exe84⤵PID:2608
-
\??\c:\jddvv.exec:\jddvv.exe85⤵PID:4664
-
\??\c:\pppjp.exec:\pppjp.exe86⤵PID:1248
-
\??\c:\xfrxxxr.exec:\xfrxxxr.exe87⤵PID:2444
-
\??\c:\xxfxffr.exec:\xxfxffr.exe88⤵PID:3624
-
\??\c:\tnnnnn.exec:\tnnnnn.exe89⤵PID:4556
-
\??\c:\hhnbtt.exec:\hhnbtt.exe90⤵PID:1868
-
\??\c:\dpvpd.exec:\dpvpd.exe91⤵PID:396
-
\??\c:\jdjdp.exec:\jdjdp.exe92⤵PID:1684
-
\??\c:\rlffllf.exec:\rlffllf.exe93⤵PID:2888
-
\??\c:\bhnhnb.exec:\bhnhnb.exe94⤵PID:2460
-
\??\c:\ntnttn.exec:\ntnttn.exe95⤵PID:3244
-
\??\c:\jjdvj.exec:\jjdvj.exe96⤵PID:3044
-
\??\c:\vppjv.exec:\vppjv.exe97⤵PID:3908
-
\??\c:\bthhbh.exec:\bthhbh.exe98⤵PID:4524
-
\??\c:\pjddd.exec:\pjddd.exe99⤵PID:1724
-
\??\c:\xlrlfrl.exec:\xlrlfrl.exe100⤵PID:2512
-
\??\c:\lflfllr.exec:\lflfllr.exe101⤵PID:2916
-
\??\c:\rlfxrll.exec:\rlfxrll.exe102⤵PID:2644
-
\??\c:\nhnhhb.exec:\nhnhhb.exe103⤵PID:2264
-
\??\c:\jjvvv.exec:\jjvvv.exe104⤵PID:1012
-
\??\c:\pjvjd.exec:\pjvjd.exe105⤵PID:4616
-
\??\c:\3rfxxlf.exec:\3rfxxlf.exe106⤵PID:1848
-
\??\c:\xflxxrl.exec:\xflxxrl.exe107⤵PID:4956
-
\??\c:\nhtnhh.exec:\nhtnhh.exe108⤵PID:1712
-
\??\c:\dvvpp.exec:\dvvpp.exe109⤵PID:2112
-
\??\c:\vdjvd.exec:\vdjvd.exe110⤵PID:4536
-
\??\c:\rxrllff.exec:\rxrllff.exe111⤵PID:736
-
\??\c:\ffrxxlr.exec:\ffrxxlr.exe112⤵PID:2844
-
\??\c:\nntbnn.exec:\nntbnn.exe113⤵PID:5048
-
\??\c:\thttbh.exec:\thttbh.exe114⤵PID:3284
-
\??\c:\9jppj.exec:\9jppj.exe115⤵PID:3268
-
\??\c:\1vjdd.exec:\1vjdd.exe116⤵PID:5044
-
\??\c:\rxrrllr.exec:\rxrrllr.exe117⤵PID:1348
-
\??\c:\lfrrxll.exec:\lfrrxll.exe118⤵PID:3112
-
\??\c:\bthbhh.exec:\bthbhh.exe119⤵PID:1940
-
\??\c:\nthbtt.exec:\nthbtt.exe120⤵PID:4580
-
\??\c:\pvddd.exec:\pvddd.exe121⤵PID:1108
-
\??\c:\pjpjj.exec:\pjpjj.exe122⤵PID:1592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-