Analysis
-
max time kernel
136s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 16:22
Behavioral task
behavioral1
Sample
1eb8f6c4ba8fe639e20c6a5c053b55c0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
1eb8f6c4ba8fe639e20c6a5c053b55c0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
1eb8f6c4ba8fe639e20c6a5c053b55c0_NeikiAnalytics.exe
-
Size
1.2MB
-
MD5
1eb8f6c4ba8fe639e20c6a5c053b55c0
-
SHA1
172c03a5249fb2dba9e47597fed565795f369c04
-
SHA256
f09f77f1410c5dee73fab39544f3671cc69795ebdd30a279b2a366a2b4e007eb
-
SHA512
3f71409f58e5904b0eaf9b1d44f075ff085187abec9baa120954cca1a830e2b1f9a206fdf065f18642e40c10f7850f3a3ca82bdd4375ff7ae3d004aaa409c014
-
SSDEEP
24576:9vKHCwPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:GDbazR0vKLXZ5Tec
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ealbcngg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Egdjfo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nlefhcnc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Elmkmo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aicmadmm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fcfohlmg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ikldqile.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jecnnk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fkhbgbkc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pebbcdkn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iianmlfn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jqbbhg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Beggec32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jdjgfomh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lbcbjlmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pkcbnanl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ahioobed.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dpphipbk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fpihnbmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ndoelpid.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nljcflbd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Elmkmo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kabobo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dcjaeamd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ghaeoe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ifahpnfl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gjifodii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Adiaommc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bacefpbg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dkblohek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Habkeacd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Agcekn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ckajqo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nenakoho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ljbipolj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ooofcg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Injlkf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Helmiiec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mfgnnhkc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fmddgg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Caccnllf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Celpqbon.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nbilhkig.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dcblgbfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gkimff32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Emgioakg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ldgnklmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jqbbhg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ajoebigm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nnnbqeib.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jffakm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fegjgkla.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cnabffeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kloqiijm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ndmeecmb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jklnggjm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ggiofa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gibkmgcj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Abkkpd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Moloidjl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kokjdb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Khielcfh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mhkfnlme.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jemkai32.exe -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/memory/2648-0-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/files/0x000b000000015a2d-5.dat family_berbew behavioral1/memory/2648-6-0x00000000002A0000-0x00000000002E1000-memory.dmp family_berbew behavioral1/files/0x0008000000015c87-18.dat family_berbew behavioral1/memory/2904-20-0x0000000000220000-0x0000000000261000-memory.dmp family_berbew behavioral1/memory/2452-26-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/files/0x0007000000015d88-40.dat family_berbew behavioral1/memory/2560-41-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/files/0x0012000000015c52-47.dat family_berbew behavioral1/memory/2640-56-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/memory/2560-53-0x0000000000220000-0x0000000000261000-memory.dmp family_berbew behavioral1/memory/2600-71-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/files/0x00050000000186a0-67.dat family_berbew behavioral1/files/0x0006000000018ae8-77.dat family_berbew behavioral1/memory/2600-78-0x0000000000220000-0x0000000000261000-memory.dmp family_berbew behavioral1/memory/2640-69-0x00000000002B0000-0x00000000002F1000-memory.dmp family_berbew behavioral1/memory/2640-68-0x00000000002B0000-0x00000000002F1000-memory.dmp family_berbew behavioral1/memory/2432-90-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/memory/2160-98-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/files/0x0006000000018b33-94.dat family_berbew behavioral1/memory/2160-106-0x00000000003B0000-0x00000000003F1000-memory.dmp family_berbew behavioral1/files/0x0006000000018b42-112.dat family_berbew behavioral1/files/0x0006000000018b6a-117.dat family_berbew behavioral1/files/0x0006000000018b96-130.dat family_berbew behavioral1/memory/2664-139-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/memory/1820-129-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/files/0x0006000000018d06-150.dat family_berbew behavioral1/memory/1776-154-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/memory/2664-152-0x0000000000220000-0x0000000000261000-memory.dmp family_berbew behavioral1/files/0x00050000000192f4-159.dat family_berbew behavioral1/memory/948-166-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/memory/1616-180-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/files/0x0005000000019377-185.dat family_berbew behavioral1/memory/1388-193-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/files/0x00050000000193b0-198.dat family_berbew behavioral1/memory/1992-205-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/memory/1992-218-0x0000000000220000-0x0000000000261000-memory.dmp family_berbew behavioral1/memory/676-219-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/files/0x000500000001946b-217.dat family_berbew behavioral1/files/0x0005000000019333-179.dat family_berbew behavioral1/memory/2712-229-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/files/0x00050000000194a4-236.dat family_berbew behavioral1/memory/1060-243-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/memory/1060-246-0x00000000003A0000-0x00000000003E1000-memory.dmp family_berbew behavioral1/memory/2712-235-0x0000000000220000-0x0000000000261000-memory.dmp family_berbew behavioral1/files/0x00040000000194d8-247.dat family_berbew behavioral1/memory/2304-261-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/memory/2120-259-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/files/0x00050000000194e8-255.dat family_berbew behavioral1/memory/2304-267-0x00000000003A0000-0x00000000003E1000-memory.dmp family_berbew behavioral1/files/0x00050000000194ee-270.dat family_berbew behavioral1/memory/1084-276-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/files/0x00050000000194f2-278.dat family_berbew behavioral1/memory/2252-283-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/memory/2252-289-0x0000000000340000-0x0000000000381000-memory.dmp family_berbew behavioral1/files/0x000500000001950c-292.dat family_berbew behavioral1/files/0x0005000000019473-228.dat family_berbew behavioral1/memory/1196-304-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/memory/2180-315-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/files/0x00050000000195a2-321.dat family_berbew behavioral1/files/0x000500000001959c-312.dat family_berbew behavioral1/files/0x00050000000195a8-343.dat family_berbew behavioral1/memory/2864-341-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/files/0x00050000000195a6-333.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 2904 Ggfnopfg.exe 2452 Hipmmg32.exe 2560 Hhhgcc32.exe 2640 Iigpli32.exe 2600 Jjdofm32.exe 2432 Kfkpknkq.exe 2160 Kokjdb32.exe 572 Lqejbiim.exe 1820 Lmljgj32.exe 2664 Mejlalji.exe 1776 Nenakoho.exe 948 Omefkplm.exe 1616 Pciddedl.exe 1388 Qnebjc32.exe 1992 Qngopb32.exe 676 Aihfap32.exe 2712 Bejfao32.exe 1060 Ccpcckck.exe 2120 Cillkbac.exe 2304 Clmdmm32.exe 1084 Clbnhmjo.exe 2252 Difnaqih.exe 596 Doecog32.exe 1196 Ddfebnoo.exe 2180 Epmfgo32.exe 1524 Ecnoijbd.exe 2864 Eklqcl32.exe 3016 Eddeladm.exe 2628 Fkbgckgd.exe 2964 Fjhcegll.exe 2676 Ffodjh32.exe 2380 Gmmfaa32.exe 2776 Gfejjgli.exe 2376 Goplilpf.exe 836 Gcbabpcf.exe 2680 Iedfqeka.exe 1648 Ihdpbq32.exe 2296 Jmdepg32.exe 2900 Jkhejkcq.exe 1080 Jpgjgboe.exe 1488 Khghgchk.exe 1928 Khielcfh.exe 2272 Kaajei32.exe 1068 Khkbbc32.exe 2936 Kjahej32.exe 2088 Llbqfe32.exe 1252 Lfkeokjp.exe 980 Lbcbjlmb.exe 1108 Mkqqnq32.exe 1644 Mjfnomde.exe 1892 Mjhjdm32.exe 1984 Mfokinhf.exe 1168 Nfdddm32.exe 1884 Nbjeinje.exe 3000 Nlcibc32.exe 2912 Nlefhcnc.exe 2364 Ohncbdbd.exe 2356 Oippjl32.exe 2848 Odedge32.exe 2784 Olpilg32.exe 2140 Oemgplgo.exe 1288 Pofkha32.exe 1920 Pohhna32.exe 2684 Pdgmlhha.exe -
Loads dropped DLL 64 IoCs
pid Process 2648 1eb8f6c4ba8fe639e20c6a5c053b55c0_NeikiAnalytics.exe 2648 1eb8f6c4ba8fe639e20c6a5c053b55c0_NeikiAnalytics.exe 2904 Ggfnopfg.exe 2904 Ggfnopfg.exe 2452 Hipmmg32.exe 2452 Hipmmg32.exe 2560 Hhhgcc32.exe 2560 Hhhgcc32.exe 2640 Iigpli32.exe 2640 Iigpli32.exe 2600 Jjdofm32.exe 2600 Jjdofm32.exe 2432 Kfkpknkq.exe 2432 Kfkpknkq.exe 2160 Kokjdb32.exe 2160 Kokjdb32.exe 572 Lqejbiim.exe 572 Lqejbiim.exe 1820 Lmljgj32.exe 1820 Lmljgj32.exe 2664 Mejlalji.exe 2664 Mejlalji.exe 1776 Nenakoho.exe 1776 Nenakoho.exe 948 Omefkplm.exe 948 Omefkplm.exe 1616 Pciddedl.exe 1616 Pciddedl.exe 1388 Qnebjc32.exe 1388 Qnebjc32.exe 1992 Qngopb32.exe 1992 Qngopb32.exe 676 Aihfap32.exe 676 Aihfap32.exe 2712 Bejfao32.exe 2712 Bejfao32.exe 1060 Ccpcckck.exe 1060 Ccpcckck.exe 2120 Cillkbac.exe 2120 Cillkbac.exe 2304 Clmdmm32.exe 2304 Clmdmm32.exe 1084 Clbnhmjo.exe 1084 Clbnhmjo.exe 2252 Difnaqih.exe 2252 Difnaqih.exe 596 Doecog32.exe 596 Doecog32.exe 1196 Ddfebnoo.exe 1196 Ddfebnoo.exe 2180 Epmfgo32.exe 2180 Epmfgo32.exe 1524 Ecnoijbd.exe 1524 Ecnoijbd.exe 2864 Eklqcl32.exe 2864 Eklqcl32.exe 3016 Eddeladm.exe 3016 Eddeladm.exe 2628 Fkbgckgd.exe 2628 Fkbgckgd.exe 2964 Fjhcegll.exe 2964 Fjhcegll.exe 2676 Ffodjh32.exe 2676 Ffodjh32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Icblnd32.dll Nbjeinje.exe File opened for modification C:\Windows\SysWOW64\Hgeelf32.exe Hgciff32.exe File opened for modification C:\Windows\SysWOW64\Oikapk32.exe Npppaejj.exe File created C:\Windows\SysWOW64\Lkhalo32.exe Lenioenj.exe File created C:\Windows\SysWOW64\Inceepmo.dll Abiqcm32.exe File created C:\Windows\SysWOW64\Hlhfem32.dll Fplknh32.exe File created C:\Windows\SysWOW64\Heolqjho.dll Ggdcbi32.exe File opened for modification C:\Windows\SysWOW64\Fhkagonc.exe Fldabn32.exe File opened for modification C:\Windows\SysWOW64\Ghgjflof.exe Gnofng32.exe File opened for modification C:\Windows\SysWOW64\Difnaqih.exe Clbnhmjo.exe File opened for modification C:\Windows\SysWOW64\Njnokdaq.exe Macjgadf.exe File created C:\Windows\SysWOW64\Qnpeijla.exe Qckalamk.exe File created C:\Windows\SysWOW64\Niadmlcg.dll Mjgclcjh.exe File opened for modification C:\Windows\SysWOW64\Nfdddm32.exe Mfokinhf.exe File opened for modification C:\Windows\SysWOW64\Pbdipa32.exe Pkhdnh32.exe File opened for modification C:\Windows\SysWOW64\Nmkpnd32.exe Nljcflbd.exe File opened for modification C:\Windows\SysWOW64\Qnagbc32.exe Qicoleno.exe File created C:\Windows\SysWOW64\Ahedjb32.exe Aaklmhak.exe File created C:\Windows\SysWOW64\Gdcdgpcj.dll Adblnnbk.exe File created C:\Windows\SysWOW64\Gfmmanif.exe Fplknh32.exe File opened for modification C:\Windows\SysWOW64\Jkhejkcq.exe Jmdepg32.exe File opened for modification C:\Windows\SysWOW64\Kaajei32.exe Khielcfh.exe File opened for modification C:\Windows\SysWOW64\Cmfmojcb.exe Bgghac32.exe File created C:\Windows\SysWOW64\Mmmloaog.dll Phgannal.exe File created C:\Windows\SysWOW64\Dmiihjak.exe Ddqeodjj.exe File opened for modification C:\Windows\SysWOW64\Gghloe32.exe Gccjpb32.exe File created C:\Windows\SysWOW64\Nfdddm32.exe Mfokinhf.exe File created C:\Windows\SysWOW64\Ndlbmk32.exe Ncfmjc32.exe File opened for modification C:\Windows\SysWOW64\Pcqebd32.exe Pdkhag32.exe File created C:\Windows\SysWOW64\Pmkfqind.exe Pgnnhbpm.exe File opened for modification C:\Windows\SysWOW64\Pdcgeejf.exe Pdajpf32.exe File created C:\Windows\SysWOW64\Cmapna32.exe Conpdm32.exe File created C:\Windows\SysWOW64\Dkpnji32.dll Cmapna32.exe File created C:\Windows\SysWOW64\Hhmhcigh.exe Gcppkbia.exe File created C:\Windows\SysWOW64\Cillkbac.exe Ccpcckck.exe File created C:\Windows\SysWOW64\Gigqol32.dll Llbqfe32.exe File created C:\Windows\SysWOW64\Iladfn32.exe Icdcllpc.exe File opened for modification C:\Windows\SysWOW64\Gnicoh32.exe Ghmnmo32.exe File opened for modification C:\Windows\SysWOW64\Niijdq32.exe Mbobgfnf.exe File created C:\Windows\SysWOW64\Dcmomb32.dll Pnfkheap.exe File opened for modification C:\Windows\SysWOW64\Mdhnnl32.exe Mbgela32.exe File created C:\Windows\SysWOW64\Gfbaeb32.dll Ppogok32.exe File opened for modification C:\Windows\SysWOW64\Aficjnpm.exe Apgagg32.exe File created C:\Windows\SysWOW64\Ndfnecgp.exe Njpihk32.exe File opened for modification C:\Windows\SysWOW64\Cofofolh.exe Cdqkifmb.exe File opened for modification C:\Windows\SysWOW64\Mbpibm32.exe Mfihml32.exe File created C:\Windows\SysWOW64\Dcpkli32.dll Ahoamplo.exe File created C:\Windows\SysWOW64\Dfbqgldn.exe Dmjlof32.exe File created C:\Windows\SysWOW64\Moiihmhq.dll Macjgadf.exe File opened for modification C:\Windows\SysWOW64\Gkimff32.exe Fnelmb32.exe File created C:\Windows\SysWOW64\Dhdfmbjc.exe Cbjnqh32.exe File created C:\Windows\SysWOW64\Idhcadad.dll Hlecmkel.exe File opened for modification C:\Windows\SysWOW64\Nhfdqb32.exe Nbilhkig.exe File created C:\Windows\SysWOW64\Lkoafg32.dll Fmacpj32.exe File created C:\Windows\SysWOW64\Cdcgccok.dll Jehpna32.exe File created C:\Windows\SysWOW64\Jfckkecc.dll Oighcd32.exe File created C:\Windows\SysWOW64\Bomlppdb.exe Bnlphh32.exe File created C:\Windows\SysWOW64\Fldabn32.exe Fcfohlmg.exe File created C:\Windows\SysWOW64\Lageje32.dll Ggeiooea.exe File opened for modification C:\Windows\SysWOW64\Indnnfdn.exe Hnbaif32.exe File created C:\Windows\SysWOW64\Ppddpd32.exe Ojglhm32.exe File created C:\Windows\SysWOW64\Iedfqeka.exe Gcbabpcf.exe File created C:\Windows\SysWOW64\Fgfbnp32.dll Ghgjflof.exe File opened for modification C:\Windows\SysWOW64\Jlhjijpe.exe Jhfepfme.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2288 2256 WerFault.exe 756 -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnbbcale.dll" Gmhkin32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jfieigio.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lifcib32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejnjabpb.dll" Ckomqopi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kqmnadlk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Qnagbc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831} 1eb8f6c4ba8fe639e20c6a5c053b55c0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Noohlkpc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffdiiopj.dll" Flqkjo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Flkmokoa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhocnhce.dll" Ofefqf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gblaal32.dll" Ppgdjqna.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jmggcmgg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jjkkbjln.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kbkdpnil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fldabn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mbpibm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mikelp32.dll" Abbjbnoq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Eioaillo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogomoj32.dll" Bomlppdb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jcleiclo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlokpi32.dll" Gfjcgc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dilapopb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Algllb32.dll" Hhmhcigh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Iklfia32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jjijkmbi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hajdniep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbbnekdd.dll" Qdlggg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Akpkmo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbejnl32.dll" Fdpgph32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lidgcclp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mclgklel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ndmeecmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oqlecd32.dll" Oemgplgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejdphkml.dll" Mkgeehnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Pigklmqc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Injlkf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibnoen32.dll" Bjgdfg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ndfnecgp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcpabfbj.dll" Oikapk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbnbckhg.dll" Aficjnpm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdmaefik.dll" Amgjnepn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Macjgadf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ncfmjc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ebghkjjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Imaapa32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mkfclo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hkjkle32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Cmdaeo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjipeebb.dll" Ninjjf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nbgakd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgbioq32.dll" Mjhjdm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lbcbjlmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chlojnpb.dll" Kmqmod32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kmqmod32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Flkmokoa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkloip32.dll" Jklnggjm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ahoamplo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klilah32.dll" Mccaodgj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ahmcbk32.dll" Qkcbpn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkablj32.dll" Kphpdhdh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ehiiop32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obkefk32.dll" Difnaqih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Imfeip32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2648 wrote to memory of 2904 2648 1eb8f6c4ba8fe639e20c6a5c053b55c0_NeikiAnalytics.exe 28 PID 2648 wrote to memory of 2904 2648 1eb8f6c4ba8fe639e20c6a5c053b55c0_NeikiAnalytics.exe 28 PID 2648 wrote to memory of 2904 2648 1eb8f6c4ba8fe639e20c6a5c053b55c0_NeikiAnalytics.exe 28 PID 2648 wrote to memory of 2904 2648 1eb8f6c4ba8fe639e20c6a5c053b55c0_NeikiAnalytics.exe 28 PID 2904 wrote to memory of 2452 2904 Ggfnopfg.exe 29 PID 2904 wrote to memory of 2452 2904 Ggfnopfg.exe 29 PID 2904 wrote to memory of 2452 2904 Ggfnopfg.exe 29 PID 2904 wrote to memory of 2452 2904 Ggfnopfg.exe 29 PID 2452 wrote to memory of 2560 2452 Hipmmg32.exe 30 PID 2452 wrote to memory of 2560 2452 Hipmmg32.exe 30 PID 2452 wrote to memory of 2560 2452 Hipmmg32.exe 30 PID 2452 wrote to memory of 2560 2452 Hipmmg32.exe 30 PID 2560 wrote to memory of 2640 2560 Hhhgcc32.exe 31 PID 2560 wrote to memory of 2640 2560 Hhhgcc32.exe 31 PID 2560 wrote to memory of 2640 2560 Hhhgcc32.exe 31 PID 2560 wrote to memory of 2640 2560 Hhhgcc32.exe 31 PID 2640 wrote to memory of 2600 2640 Iigpli32.exe 32 PID 2640 wrote to memory of 2600 2640 Iigpli32.exe 32 PID 2640 wrote to memory of 2600 2640 Iigpli32.exe 32 PID 2640 wrote to memory of 2600 2640 Iigpli32.exe 32 PID 2600 wrote to memory of 2432 2600 Jjdofm32.exe 33 PID 2600 wrote to memory of 2432 2600 Jjdofm32.exe 33 PID 2600 wrote to memory of 2432 2600 Jjdofm32.exe 33 PID 2600 wrote to memory of 2432 2600 Jjdofm32.exe 33 PID 2432 wrote to memory of 2160 2432 Kfkpknkq.exe 34 PID 2432 wrote to memory of 2160 2432 Kfkpknkq.exe 34 PID 2432 wrote to memory of 2160 2432 Kfkpknkq.exe 34 PID 2432 wrote to memory of 2160 2432 Kfkpknkq.exe 34 PID 2160 wrote to memory of 572 2160 Kokjdb32.exe 35 PID 2160 wrote to memory of 572 2160 Kokjdb32.exe 35 PID 2160 wrote to memory of 572 2160 Kokjdb32.exe 35 PID 2160 wrote to memory of 572 2160 Kokjdb32.exe 35 PID 572 wrote to memory of 1820 572 Lqejbiim.exe 36 PID 572 wrote to memory of 1820 572 Lqejbiim.exe 36 PID 572 wrote to memory of 1820 572 Lqejbiim.exe 36 PID 572 wrote to memory of 1820 572 Lqejbiim.exe 36 PID 1820 wrote to memory of 2664 1820 Lmljgj32.exe 37 PID 1820 wrote to memory of 2664 1820 Lmljgj32.exe 37 PID 1820 wrote to memory of 2664 1820 Lmljgj32.exe 37 PID 1820 wrote to memory of 2664 1820 Lmljgj32.exe 37 PID 2664 wrote to memory of 1776 2664 Mejlalji.exe 38 PID 2664 wrote to memory of 1776 2664 Mejlalji.exe 38 PID 2664 wrote to memory of 1776 2664 Mejlalji.exe 38 PID 2664 wrote to memory of 1776 2664 Mejlalji.exe 38 PID 1776 wrote to memory of 948 1776 Nenakoho.exe 39 PID 1776 wrote to memory of 948 1776 Nenakoho.exe 39 PID 1776 wrote to memory of 948 1776 Nenakoho.exe 39 PID 1776 wrote to memory of 948 1776 Nenakoho.exe 39 PID 948 wrote to memory of 1616 948 Omefkplm.exe 40 PID 948 wrote to memory of 1616 948 Omefkplm.exe 40 PID 948 wrote to memory of 1616 948 Omefkplm.exe 40 PID 948 wrote to memory of 1616 948 Omefkplm.exe 40 PID 1616 wrote to memory of 1388 1616 Pciddedl.exe 41 PID 1616 wrote to memory of 1388 1616 Pciddedl.exe 41 PID 1616 wrote to memory of 1388 1616 Pciddedl.exe 41 PID 1616 wrote to memory of 1388 1616 Pciddedl.exe 41 PID 1388 wrote to memory of 1992 1388 Qnebjc32.exe 42 PID 1388 wrote to memory of 1992 1388 Qnebjc32.exe 42 PID 1388 wrote to memory of 1992 1388 Qnebjc32.exe 42 PID 1388 wrote to memory of 1992 1388 Qnebjc32.exe 42 PID 1992 wrote to memory of 676 1992 Qngopb32.exe 43 PID 1992 wrote to memory of 676 1992 Qngopb32.exe 43 PID 1992 wrote to memory of 676 1992 Qngopb32.exe 43 PID 1992 wrote to memory of 676 1992 Qngopb32.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\1eb8f6c4ba8fe639e20c6a5c053b55c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1eb8f6c4ba8fe639e20c6a5c053b55c0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\Ggfnopfg.exeC:\Windows\system32\Ggfnopfg.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\Hipmmg32.exeC:\Windows\system32\Hipmmg32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\Hhhgcc32.exeC:\Windows\system32\Hhhgcc32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\Iigpli32.exeC:\Windows\system32\Iigpli32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\Jjdofm32.exeC:\Windows\system32\Jjdofm32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\Kfkpknkq.exeC:\Windows\system32\Kfkpknkq.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\Kokjdb32.exeC:\Windows\system32\Kokjdb32.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\Lqejbiim.exeC:\Windows\system32\Lqejbiim.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\SysWOW64\Lmljgj32.exeC:\Windows\system32\Lmljgj32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\Mejlalji.exeC:\Windows\system32\Mejlalji.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\Nenakoho.exeC:\Windows\system32\Nenakoho.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\Omefkplm.exeC:\Windows\system32\Omefkplm.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\Pciddedl.exeC:\Windows\system32\Pciddedl.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\Qnebjc32.exeC:\Windows\system32\Qnebjc32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\Qngopb32.exeC:\Windows\system32\Qngopb32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\Aihfap32.exeC:\Windows\system32\Aihfap32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:676 -
C:\Windows\SysWOW64\Bejfao32.exeC:\Windows\system32\Bejfao32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Windows\SysWOW64\Ccpcckck.exeC:\Windows\system32\Ccpcckck.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1060 -
C:\Windows\SysWOW64\Cillkbac.exeC:\Windows\system32\Cillkbac.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Windows\SysWOW64\Clmdmm32.exeC:\Windows\system32\Clmdmm32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Windows\SysWOW64\Clbnhmjo.exeC:\Windows\system32\Clbnhmjo.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1084 -
C:\Windows\SysWOW64\Difnaqih.exeC:\Windows\system32\Difnaqih.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2252 -
C:\Windows\SysWOW64\Doecog32.exeC:\Windows\system32\Doecog32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:596 -
C:\Windows\SysWOW64\Ddfebnoo.exeC:\Windows\system32\Ddfebnoo.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1196 -
C:\Windows\SysWOW64\Epmfgo32.exeC:\Windows\system32\Epmfgo32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Windows\SysWOW64\Ecnoijbd.exeC:\Windows\system32\Ecnoijbd.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Windows\SysWOW64\Eklqcl32.exeC:\Windows\system32\Eklqcl32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Windows\SysWOW64\Eddeladm.exeC:\Windows\system32\Eddeladm.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Windows\SysWOW64\Fkbgckgd.exeC:\Windows\system32\Fkbgckgd.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2628 -
C:\Windows\SysWOW64\Fjhcegll.exeC:\Windows\system32\Fjhcegll.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Windows\SysWOW64\Ffodjh32.exeC:\Windows\system32\Ffodjh32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Windows\SysWOW64\Gmmfaa32.exeC:\Windows\system32\Gmmfaa32.exe33⤵
- Executes dropped EXE
PID:2380 -
C:\Windows\SysWOW64\Gfejjgli.exeC:\Windows\system32\Gfejjgli.exe34⤵
- Executes dropped EXE
PID:2776 -
C:\Windows\SysWOW64\Goplilpf.exeC:\Windows\system32\Goplilpf.exe35⤵
- Executes dropped EXE
PID:2376 -
C:\Windows\SysWOW64\Gcbabpcf.exeC:\Windows\system32\Gcbabpcf.exe36⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:836 -
C:\Windows\SysWOW64\Iedfqeka.exeC:\Windows\system32\Iedfqeka.exe37⤵
- Executes dropped EXE
PID:2680 -
C:\Windows\SysWOW64\Ihdpbq32.exeC:\Windows\system32\Ihdpbq32.exe38⤵
- Executes dropped EXE
PID:1648 -
C:\Windows\SysWOW64\Jmdepg32.exeC:\Windows\system32\Jmdepg32.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2296 -
C:\Windows\SysWOW64\Jkhejkcq.exeC:\Windows\system32\Jkhejkcq.exe40⤵
- Executes dropped EXE
PID:2900 -
C:\Windows\SysWOW64\Jpgjgboe.exeC:\Windows\system32\Jpgjgboe.exe41⤵
- Executes dropped EXE
PID:1080 -
C:\Windows\SysWOW64\Khghgchk.exeC:\Windows\system32\Khghgchk.exe42⤵
- Executes dropped EXE
PID:1488 -
C:\Windows\SysWOW64\Khielcfh.exeC:\Windows\system32\Khielcfh.exe43⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1928 -
C:\Windows\SysWOW64\Kaajei32.exeC:\Windows\system32\Kaajei32.exe44⤵
- Executes dropped EXE
PID:2272 -
C:\Windows\SysWOW64\Khkbbc32.exeC:\Windows\system32\Khkbbc32.exe45⤵
- Executes dropped EXE
PID:1068 -
C:\Windows\SysWOW64\Kjahej32.exeC:\Windows\system32\Kjahej32.exe46⤵
- Executes dropped EXE
PID:2936 -
C:\Windows\SysWOW64\Llbqfe32.exeC:\Windows\system32\Llbqfe32.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2088 -
C:\Windows\SysWOW64\Lfkeokjp.exeC:\Windows\system32\Lfkeokjp.exe48⤵
- Executes dropped EXE
PID:1252 -
C:\Windows\SysWOW64\Lbcbjlmb.exeC:\Windows\system32\Lbcbjlmb.exe49⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:980 -
C:\Windows\SysWOW64\Mkqqnq32.exeC:\Windows\system32\Mkqqnq32.exe50⤵
- Executes dropped EXE
PID:1108 -
C:\Windows\SysWOW64\Mjfnomde.exeC:\Windows\system32\Mjfnomde.exe51⤵
- Executes dropped EXE
PID:1644 -
C:\Windows\SysWOW64\Mjhjdm32.exeC:\Windows\system32\Mjhjdm32.exe52⤵
- Executes dropped EXE
- Modifies registry class
PID:1892 -
C:\Windows\SysWOW64\Mfokinhf.exeC:\Windows\system32\Mfokinhf.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1984 -
C:\Windows\SysWOW64\Nfdddm32.exeC:\Windows\system32\Nfdddm32.exe54⤵
- Executes dropped EXE
PID:1168 -
C:\Windows\SysWOW64\Nbjeinje.exeC:\Windows\system32\Nbjeinje.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1884 -
C:\Windows\SysWOW64\Nlcibc32.exeC:\Windows\system32\Nlcibc32.exe56⤵
- Executes dropped EXE
PID:3000 -
C:\Windows\SysWOW64\Nlefhcnc.exeC:\Windows\system32\Nlefhcnc.exe57⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2912 -
C:\Windows\SysWOW64\Ohncbdbd.exeC:\Windows\system32\Ohncbdbd.exe58⤵
- Executes dropped EXE
PID:2364 -
C:\Windows\SysWOW64\Oippjl32.exeC:\Windows\system32\Oippjl32.exe59⤵
- Executes dropped EXE
PID:2356 -
C:\Windows\SysWOW64\Odedge32.exeC:\Windows\system32\Odedge32.exe60⤵
- Executes dropped EXE
PID:2848 -
C:\Windows\SysWOW64\Olpilg32.exeC:\Windows\system32\Olpilg32.exe61⤵
- Executes dropped EXE
PID:2784 -
C:\Windows\SysWOW64\Oemgplgo.exeC:\Windows\system32\Oemgplgo.exe62⤵
- Executes dropped EXE
- Modifies registry class
PID:2140 -
C:\Windows\SysWOW64\Pofkha32.exeC:\Windows\system32\Pofkha32.exe63⤵
- Executes dropped EXE
PID:1288 -
C:\Windows\SysWOW64\Pohhna32.exeC:\Windows\system32\Pohhna32.exe64⤵
- Executes dropped EXE
PID:1920 -
C:\Windows\SysWOW64\Pdgmlhha.exeC:\Windows\system32\Pdgmlhha.exe65⤵
- Executes dropped EXE
PID:2684 -
C:\Windows\SysWOW64\Pkcbnanl.exeC:\Windows\system32\Pkcbnanl.exe66⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2232 -
C:\Windows\SysWOW64\Qdlggg32.exeC:\Windows\system32\Qdlggg32.exe67⤵
- Modifies registry class
PID:1604 -
C:\Windows\SysWOW64\Qlgkki32.exeC:\Windows\system32\Qlgkki32.exe68⤵PID:1544
-
C:\Windows\SysWOW64\Apgagg32.exeC:\Windows\system32\Apgagg32.exe69⤵
- Drops file in System32 directory
PID:1424 -
C:\Windows\SysWOW64\Aficjnpm.exeC:\Windows\system32\Aficjnpm.exe70⤵
- Modifies registry class
PID:1528 -
C:\Windows\SysWOW64\Ckjamgmk.exeC:\Windows\system32\Ckjamgmk.exe71⤵PID:840
-
C:\Windows\SysWOW64\Cnkjnb32.exeC:\Windows\system32\Cnkjnb32.exe72⤵PID:3024
-
C:\Windows\SysWOW64\Cmpgpond.exeC:\Windows\system32\Cmpgpond.exe73⤵PID:1584
-
C:\Windows\SysWOW64\Cfhkhd32.exeC:\Windows\system32\Cfhkhd32.exe74⤵PID:2832
-
C:\Windows\SysWOW64\Danpemej.exeC:\Windows\system32\Danpemej.exe75⤵PID:2104
-
C:\Windows\SysWOW64\Dilapopb.exeC:\Windows\system32\Dilapopb.exe76⤵
- Modifies registry class
PID:2488 -
C:\Windows\SysWOW64\Dpjbgh32.exeC:\Windows\system32\Dpjbgh32.exe77⤵PID:2968
-
C:\Windows\SysWOW64\Elacliin.exeC:\Windows\system32\Elacliin.exe78⤵PID:1432
-
C:\Windows\SysWOW64\Eaphjp32.exeC:\Windows\system32\Eaphjp32.exe79⤵PID:1076
-
C:\Windows\SysWOW64\Emgioakg.exeC:\Windows\system32\Emgioakg.exe80⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1556 -
C:\Windows\SysWOW64\Ekkjheja.exeC:\Windows\system32\Ekkjheja.exe81⤵PID:588
-
C:\Windows\SysWOW64\Ecfnmh32.exeC:\Windows\system32\Ecfnmh32.exe82⤵PID:1276
-
C:\Windows\SysWOW64\Fpjofl32.exeC:\Windows\system32\Fpjofl32.exe83⤵PID:804
-
C:\Windows\SysWOW64\Feggob32.exeC:\Windows\system32\Feggob32.exe84⤵PID:2096
-
C:\Windows\SysWOW64\Foolgh32.exeC:\Windows\system32\Foolgh32.exe85⤵PID:2888
-
C:\Windows\SysWOW64\Fkhibino.exeC:\Windows\system32\Fkhibino.exe86⤵PID:944
-
C:\Windows\SysWOW64\Fnibcd32.exeC:\Windows\system32\Fnibcd32.exe87⤵PID:1456
-
C:\Windows\SysWOW64\Ggdcbi32.exeC:\Windows\system32\Ggdcbi32.exe88⤵
- Drops file in System32 directory
PID:1468 -
C:\Windows\SysWOW64\Gdhdkn32.exeC:\Windows\system32\Gdhdkn32.exe89⤵PID:1744
-
C:\Windows\SysWOW64\Gjifodii.exeC:\Windows\system32\Gjifodii.exe90⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1720 -
C:\Windows\SysWOW64\Hcdgmimg.exeC:\Windows\system32\Hcdgmimg.exe91⤵PID:872
-
C:\Windows\SysWOW64\Hmlkfo32.exeC:\Windows\system32\Hmlkfo32.exe92⤵PID:1696
-
C:\Windows\SysWOW64\Hfepod32.exeC:\Windows\system32\Hfepod32.exe93⤵PID:2996
-
C:\Windows\SysWOW64\Hkahgk32.exeC:\Windows\system32\Hkahgk32.exe94⤵PID:2624
-
C:\Windows\SysWOW64\Hnbaif32.exeC:\Windows\system32\Hnbaif32.exe95⤵
- Drops file in System32 directory
PID:2416 -
C:\Windows\SysWOW64\Indnnfdn.exeC:\Windows\system32\Indnnfdn.exe96⤵PID:2392
-
C:\Windows\SysWOW64\Ingkdeak.exeC:\Windows\system32\Ingkdeak.exe97⤵PID:2816
-
C:\Windows\SysWOW64\Icdcllpc.exeC:\Windows\system32\Icdcllpc.exe98⤵
- Drops file in System32 directory
PID:2980 -
C:\Windows\SysWOW64\Iladfn32.exeC:\Windows\system32\Iladfn32.exe99⤵PID:1668
-
C:\Windows\SysWOW64\Imaapa32.exeC:\Windows\system32\Imaapa32.exe100⤵
- Modifies registry class
PID:524 -
C:\Windows\SysWOW64\Jfieigio.exeC:\Windows\system32\Jfieigio.exe101⤵
- Modifies registry class
PID:2224 -
C:\Windows\SysWOW64\Jjkkbjln.exeC:\Windows\system32\Jjkkbjln.exe102⤵
- Modifies registry class
PID:1944 -
C:\Windows\SysWOW64\Jaecod32.exeC:\Windows\system32\Jaecod32.exe103⤵PID:1096
-
C:\Windows\SysWOW64\Jjnhhjjk.exeC:\Windows\system32\Jjnhhjjk.exe104⤵PID:1684
-
C:\Windows\SysWOW64\Jfgebjnm.exeC:\Windows\system32\Jfgebjnm.exe105⤵PID:1164
-
C:\Windows\SysWOW64\Kmqmod32.exeC:\Windows\system32\Kmqmod32.exe106⤵
- Modifies registry class
PID:2196 -
C:\Windows\SysWOW64\Kmcjedcg.exeC:\Windows\system32\Kmcjedcg.exe107⤵PID:2584
-
C:\Windows\SysWOW64\Kofcbl32.exeC:\Windows\system32\Kofcbl32.exe108⤵PID:2548
-
C:\Windows\SysWOW64\Mloiec32.exeC:\Windows\system32\Mloiec32.exe109⤵PID:2632
-
C:\Windows\SysWOW64\Mfgnnhkc.exeC:\Windows\system32\Mfgnnhkc.exe110⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1620 -
C:\Windows\SysWOW64\Mkfclo32.exeC:\Windows\system32\Mkfclo32.exe111⤵
- Modifies registry class
PID:2636 -
C:\Windows\SysWOW64\Mneohj32.exeC:\Windows\system32\Mneohj32.exe112⤵PID:268
-
C:\Windows\SysWOW64\Mhjcec32.exeC:\Windows\system32\Mhjcec32.exe113⤵PID:2004
-
C:\Windows\SysWOW64\Mdadjd32.exeC:\Windows\system32\Mdadjd32.exe114⤵PID:1796
-
C:\Windows\SysWOW64\Njpihk32.exeC:\Windows\system32\Njpihk32.exe115⤵
- Drops file in System32 directory
PID:288 -
C:\Windows\SysWOW64\Ndfnecgp.exeC:\Windows\system32\Ndfnecgp.exe116⤵
- Modifies registry class
PID:700 -
C:\Windows\SysWOW64\Nfgjml32.exeC:\Windows\system32\Nfgjml32.exe117⤵PID:2016
-
C:\Windows\SysWOW64\Nlilqbgp.exeC:\Windows\system32\Nlilqbgp.exe118⤵PID:2840
-
C:\Windows\SysWOW64\Oeaqig32.exeC:\Windows\system32\Oeaqig32.exe119⤵PID:2372
-
C:\Windows\SysWOW64\Opialpld.exeC:\Windows\system32\Opialpld.exe120⤵PID:2620
-
C:\Windows\SysWOW64\Oefjdgjk.exeC:\Windows\system32\Oefjdgjk.exe121⤵PID:2116
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-