Analysis
-
max time kernel
143s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
11-05-2024 11:13
Static task
static1
Behavioral task
behavioral1
Sample
af70779eb3763a618b7c0d4bf830eb30_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
af70779eb3763a618b7c0d4bf830eb30_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
af70779eb3763a618b7c0d4bf830eb30_NeikiAnalytics.exe
-
Size
163KB
-
MD5
af70779eb3763a618b7c0d4bf830eb30
-
SHA1
d87281eb6225cfa895ae5008513ee04bf7a8afde
-
SHA256
68a929b7fc19a4f9dd4a4a88efb201539403ccd6657e193092087291076e8820
-
SHA512
c34ddb0eec333a8b1f87ff5597cd4fa824f329a945111ae3e9c4811688501d689b3cb78148251f80942313d5f798246092543a050a7c8b6f97083129f0a4e91e
-
SSDEEP
1536:PsVrSu7YCAMfM2ZE5W1mE680lProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:9YM2ZE5xj80ltOrWKDBr+yJb
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Ebedndfa.exeHhejnc32.exeIlcoce32.exeNoogpfjh.exeJfcnngnd.exeEgglkp32.exeHhbdee32.exeDbafjlaa.exeCnaocmmi.exeGjdhbc32.exePjfpafmb.exeCobbhfhg.exeIgkdgk32.exeFcpfedki.exeIbckfa32.exeGmbfggdo.exeKfkpknkq.exeKpadhg32.exeFpcqaf32.exeGljnej32.exeOlbchn32.exeIbkkjp32.exeCaidaeak.exeJabdql32.exeJqdipqbp.exeHabfipdj.exeDdfcje32.exeJliohkak.exeAjjfkh32.exePqkmjh32.exeDlgldibq.exeEkelld32.exeEhoocgeb.exeNpojdpef.exeIhpdoh32.exeCojhejbh.exeIegjqk32.exeKljabgnh.exeFqglggcp.exeJlckbh32.exeAmkpegnj.exeBiamilfj.exeMlcbenjb.exeBpqain32.exeDpegcq32.exeOmfkke32.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ebedndfa.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hhejnc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ilcoce32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Noogpfjh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jfcnngnd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Egglkp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hhbdee32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dbafjlaa.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cnaocmmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gjdhbc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pjfpafmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cobbhfhg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Igkdgk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fcpfedki.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ibckfa32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gmbfggdo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kfkpknkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kpadhg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fpcqaf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gljnej32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ibckfa32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Olbchn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ibkkjp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Caidaeak.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jabdql32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jqdipqbp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Habfipdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ddfcje32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jliohkak.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ajjfkh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pqkmjh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dlgldibq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ekelld32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ehoocgeb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Npojdpef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ihpdoh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cojhejbh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iegjqk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kljabgnh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fqglggcp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jlckbh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Amkpegnj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Biamilfj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mlcbenjb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bpqain32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dpegcq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Omfkke32.exe -
Executes dropped EXE 64 IoCs
Processes:
Qaefjm32.exeQagcpljo.exeAjphib32.exeAplpai32.exeAffhncfc.exeAdjigg32.exeAfiecb32.exeAbpfhcje.exeAiinen32.exeAoffmd32.exeAljgfioc.exeBlmdlhmp.exeBbflib32.exeBnpmipql.exeBghabf32.exeBkfjhd32.exeBnefdp32.exeCjlgiqbk.exeCljcelan.exeCgpgce32.exeCphlljge.exeCpjiajeb.exeComimg32.exeClaifkkf.exeCopfbfjj.exeCkffgg32.exeCobbhfhg.exeDkhcmgnl.exeDngoibmo.exeDdagfm32.exeDjnpnc32.exeDcfdgiid.exeDkmmhf32.exeDchali32.exeDfgmhd32.exeDjbiicon.exeEmcbkn32.exeEflgccbp.exeEkholjqg.exeEbbgid32.exeEpfhbign.exeEbedndfa.exeEeempocb.exeEjbfhfaj.exeFckjalhj.exeFaokjpfd.exeFcmgfkeg.exeFjgoce32.exeFdoclk32.exeFhkpmjln.exeFilldb32.exeFacdeo32.exeFfpmnf32.exeFlmefm32.exeFbgmbg32.exeFmlapp32.exeGpknlk32.exeGfefiemq.exeGegfdb32.exeGlaoalkh.exeGbkgnfbd.exeGangic32.exeGhhofmql.exeGobgcg32.exepid process 1948 Qaefjm32.exe 2684 Qagcpljo.exe 2644 Ajphib32.exe 2624 Aplpai32.exe 2788 Affhncfc.exe 2608 Adjigg32.exe 2560 Afiecb32.exe 2232 Abpfhcje.exe 2840 Aiinen32.exe 2892 Aoffmd32.exe 568 Aljgfioc.exe 1552 Blmdlhmp.exe 620 Bbflib32.exe 3012 Bnpmipql.exe 2676 Bghabf32.exe 768 Bkfjhd32.exe 584 Bnefdp32.exe 2464 Cjlgiqbk.exe 2356 Cljcelan.exe 1732 Cgpgce32.exe 1388 Cphlljge.exe 288 Cpjiajeb.exe 2296 Comimg32.exe 812 Claifkkf.exe 1972 Copfbfjj.exe 1696 Ckffgg32.exe 2256 Cobbhfhg.exe 2216 Dkhcmgnl.exe 2252 Dngoibmo.exe 2732 Ddagfm32.exe 2648 Djnpnc32.exe 2856 Dcfdgiid.exe 2660 Dkmmhf32.exe 2492 Dchali32.exe 2092 Dfgmhd32.exe 2868 Djbiicon.exe 2912 Emcbkn32.exe 744 Eflgccbp.exe 1252 Ekholjqg.exe 3004 Ebbgid32.exe 820 Epfhbign.exe 1248 Ebedndfa.exe 2116 Eeempocb.exe 1156 Ejbfhfaj.exe 2248 Fckjalhj.exe 748 Faokjpfd.exe 2380 Fcmgfkeg.exe 1060 Fjgoce32.exe 2432 Fdoclk32.exe 1644 Fhkpmjln.exe 992 Filldb32.exe 2452 Facdeo32.exe 1944 Ffpmnf32.exe 2920 Flmefm32.exe 2368 Fbgmbg32.exe 2712 Fmlapp32.exe 2784 Gpknlk32.exe 2808 Gfefiemq.exe 1668 Gegfdb32.exe 3028 Glaoalkh.exe 2832 Gbkgnfbd.exe 2836 Gangic32.exe 2908 Ghhofmql.exe 1780 Gobgcg32.exe -
Loads dropped DLL 64 IoCs
Processes:
af70779eb3763a618b7c0d4bf830eb30_NeikiAnalytics.exeQaefjm32.exeQagcpljo.exeAjphib32.exeAplpai32.exeAffhncfc.exeAdjigg32.exeAfiecb32.exeAbpfhcje.exeAiinen32.exeAoffmd32.exeAljgfioc.exeBlmdlhmp.exeBbflib32.exeBnpmipql.exeBghabf32.exeBkfjhd32.exeBnefdp32.exeCjlgiqbk.exeCljcelan.exeCgpgce32.exeCphlljge.exeCpjiajeb.exeComimg32.exeClaifkkf.exeCopfbfjj.exeCkffgg32.exeCobbhfhg.exeDkhcmgnl.exeDngoibmo.exeDdagfm32.exeDjnpnc32.exepid process 2384 af70779eb3763a618b7c0d4bf830eb30_NeikiAnalytics.exe 2384 af70779eb3763a618b7c0d4bf830eb30_NeikiAnalytics.exe 1948 Qaefjm32.exe 1948 Qaefjm32.exe 2684 Qagcpljo.exe 2684 Qagcpljo.exe 2644 Ajphib32.exe 2644 Ajphib32.exe 2624 Aplpai32.exe 2624 Aplpai32.exe 2788 Affhncfc.exe 2788 Affhncfc.exe 2608 Adjigg32.exe 2608 Adjigg32.exe 2560 Afiecb32.exe 2560 Afiecb32.exe 2232 Abpfhcje.exe 2232 Abpfhcje.exe 2840 Aiinen32.exe 2840 Aiinen32.exe 2892 Aoffmd32.exe 2892 Aoffmd32.exe 568 Aljgfioc.exe 568 Aljgfioc.exe 1552 Blmdlhmp.exe 1552 Blmdlhmp.exe 620 Bbflib32.exe 620 Bbflib32.exe 3012 Bnpmipql.exe 3012 Bnpmipql.exe 2676 Bghabf32.exe 2676 Bghabf32.exe 768 Bkfjhd32.exe 768 Bkfjhd32.exe 584 Bnefdp32.exe 584 Bnefdp32.exe 2464 Cjlgiqbk.exe 2464 Cjlgiqbk.exe 2356 Cljcelan.exe 2356 Cljcelan.exe 1732 Cgpgce32.exe 1732 Cgpgce32.exe 1388 Cphlljge.exe 1388 Cphlljge.exe 288 Cpjiajeb.exe 288 Cpjiajeb.exe 2296 Comimg32.exe 2296 Comimg32.exe 812 Claifkkf.exe 812 Claifkkf.exe 1972 Copfbfjj.exe 1972 Copfbfjj.exe 1696 Ckffgg32.exe 1696 Ckffgg32.exe 2256 Cobbhfhg.exe 2256 Cobbhfhg.exe 2216 Dkhcmgnl.exe 2216 Dkhcmgnl.exe 2252 Dngoibmo.exe 2252 Dngoibmo.exe 2732 Ddagfm32.exe 2732 Ddagfm32.exe 2648 Djnpnc32.exe 2648 Djnpnc32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Meccii32.exeNondgn32.exePefijfii.exeQjnmlk32.exePbkbgjcc.exeFjjnan32.exeOdbeilbg.exeOlbchn32.exeChbjffad.exePmjqcc32.exeEgglkp32.exeQpecfc32.exeGdniqh32.exeFkbdkb32.exeLbqabkql.exeHapicp32.exeKklikejc.exeLfhfab32.exeKifpdelo.exeLdidkbpb.exePmdjdh32.exeMkmhaj32.exeNkegeg32.exeFbbofjnh.exeFmmkcoap.exeJmbiipml.exeAaheie32.exeLnjafd32.exeMakjho32.exeGbfiaj32.exeKkijmm32.exeDhkiid32.exeBjmbqhif.exeJglgpdcc.exeJgfcja32.exePjadmnic.exeGicdnj32.exeImoilo32.exeOmdneebf.exeHpbbdfik.exeGnbjlpom.exeHddlof32.exeOcgbji32.exeGfefiemq.exeOklkmnbp.exedescription ioc process File created C:\Windows\SysWOW64\Jddnncch.dll Meccii32.exe File created C:\Windows\SysWOW64\Namqci32.exe Nondgn32.exe File opened for modification C:\Windows\SysWOW64\Pkpagq32.exe Pefijfii.exe File opened for modification C:\Windows\SysWOW64\Aaheie32.exe Qjnmlk32.exe File created C:\Windows\SysWOW64\Mihmog32.dll File opened for modification C:\Windows\SysWOW64\Piekcd32.exe Pbkbgjcc.exe File created C:\Windows\SysWOW64\Ebodmn32.dll Fjjnan32.exe File created C:\Windows\SysWOW64\Ohnaik32.exe Odbeilbg.exe File created C:\Windows\SysWOW64\Ammmql32.dll Olbchn32.exe File created C:\Windows\SysWOW64\Fllmhajo.dll File created C:\Windows\SysWOW64\Khghgchk.exe File opened for modification C:\Windows\SysWOW64\Bfdenafn.exe File opened for modification C:\Windows\SysWOW64\Cjdfmo32.exe Chbjffad.exe File opened for modification C:\Windows\SysWOW64\Pdaheq32.exe Pmjqcc32.exe File created C:\Windows\SysWOW64\Hphmnfda.dll Egglkp32.exe File opened for modification C:\Windows\SysWOW64\Lclicpkm.exe File opened for modification C:\Windows\SysWOW64\Qbcpbo32.exe Qpecfc32.exe File created C:\Windows\SysWOW64\Gfmemc32.exe Gdniqh32.exe File created C:\Windows\SysWOW64\Ppegoheg.dll Fkbdkb32.exe File created C:\Windows\SysWOW64\Dfocegkg.dll File created C:\Windows\SysWOW64\Jampjian.exe File created C:\Windows\SysWOW64\Leonofpp.exe Lbqabkql.exe File created C:\Windows\SysWOW64\Idnmhkin.dll Hapicp32.exe File created C:\Windows\SysWOW64\Ojklfdgh.dll Kklikejc.exe File created C:\Windows\SysWOW64\Lmbonmll.exe Lfhfab32.exe File created C:\Windows\SysWOW64\Hefhqhka.dll File created C:\Windows\SysWOW64\Klpdaf32.exe File created C:\Windows\SysWOW64\Lpphap32.exe Kifpdelo.exe File created C:\Windows\SysWOW64\Mhdplq32.exe Ldidkbpb.exe File created C:\Windows\SysWOW64\Ppbfpd32.exe Pmdjdh32.exe File created C:\Windows\SysWOW64\Mghohc32.dll Chbjffad.exe File opened for modification C:\Windows\SysWOW64\Mmldme32.exe Mkmhaj32.exe File created C:\Windows\SysWOW64\Kfkcgima.dll Nkegeg32.exe File opened for modification C:\Windows\SysWOW64\Fdpkbf32.exe Fbbofjnh.exe File created C:\Windows\SysWOW64\Ohcdhi32.exe File created C:\Windows\SysWOW64\Gedbdlbb.exe Fmmkcoap.exe File created C:\Windows\SysWOW64\Ghbaee32.dll Jmbiipml.exe File created C:\Windows\SysWOW64\Emfmdo32.dll Aaheie32.exe File created C:\Windows\SysWOW64\Ledibnco.exe Lnjafd32.exe File created C:\Windows\SysWOW64\Nfknbfkf.dll Makjho32.exe File opened for modification C:\Windows\SysWOW64\Gqiimfam.exe Gbfiaj32.exe File opened for modification C:\Windows\SysWOW64\Mqpflg32.exe File opened for modification C:\Windows\SysWOW64\Kngfih32.exe Kkijmm32.exe File created C:\Windows\SysWOW64\Dlfejcoe.exe Dhkiid32.exe File created C:\Windows\SysWOW64\Cjknmf32.dll Bjmbqhif.exe File created C:\Windows\SysWOW64\Oeehln32.exe File created C:\Windows\SysWOW64\Jehlkhig.exe File created C:\Windows\SysWOW64\Komjgdhc.dll File created C:\Windows\SysWOW64\Ppdjkg32.dll Jglgpdcc.exe File opened for modification C:\Windows\SysWOW64\Jnpkflne.exe Jgfcja32.exe File created C:\Windows\SysWOW64\Odchbe32.exe File created C:\Windows\SysWOW64\Pnlqnl32.exe Pjadmnic.exe File created C:\Windows\SysWOW64\Gpnmjd32.exe Gicdnj32.exe File created C:\Windows\SysWOW64\Klmbbhod.dll Imoilo32.exe File created C:\Windows\SysWOW64\Ocnfbo32.exe Omdneebf.exe File created C:\Windows\SysWOW64\Dnpciaef.exe File created C:\Windows\SysWOW64\Egfokakc.dll File created C:\Windows\SysWOW64\Hflkaq32.exe Hpbbdfik.exe File created C:\Windows\SysWOW64\Gbnflo32.exe Gnbjlpom.exe File created C:\Windows\SysWOW64\Hnjplo32.exe Hddlof32.exe File opened for modification C:\Windows\SysWOW64\Okojkf32.exe Ocgbji32.exe File created C:\Windows\SysWOW64\Goknhdma.dll File created C:\Windows\SysWOW64\Gegfdb32.exe Gfefiemq.exe File opened for modification C:\Windows\SysWOW64\Olmhdf32.exe Oklkmnbp.exe -
Program crash 1 IoCs
Processes:
pid pid_target process target process 5420 5056 -
Modifies registry class 64 IoCs
Processes:
Gfefiemq.exeCpnojioo.exeDaejhjkj.exePjcckf32.exeDgjfek32.exeJniefm32.exeEbbgid32.exeLdllgiek.exeDccagcgk.exeNenobfak.exeOegbheiq.exePfdabino.exeIhdmihpn.exeKglcogeo.exeEbedndfa.exePdaoog32.exeCnobnmpl.exeOdoloalf.exeBghabf32.exeKmmcjehm.exeMhbped32.exeEmnndlod.exeFjongcbl.exeLobgoh32.exeNkeelohh.exeLfbpag32.exeGfobbc32.exePkfceo32.exePohfehdi.exeHicodd32.exeOfhick32.exeDfamcogo.exeGakcimgf.exeFmegncpp.exeDcfdgiid.exeHlngpjlj.exeDojddmec.exeHpocfncj.exeJgidao32.exePmjqcc32.exeCheido32.exeHahjpbad.exeLcagpl32.exeFcpfedki.exeLmcijcbe.exeDkqbaecc.exeIapebchh.exeIlknfn32.exeEqgnokip.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gfefiemq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hadfjo32.dll" Cpnojioo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lihcil32.dll" Daejhjkj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pjcckf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aickhe32.dll" Dgjfek32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jniefm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ebbgid32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ldllgiek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iidgma32.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dccagcgk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nenobfak.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oegbheiq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjmoilnn.dll" Pfdabino.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pimkgkgm.dll" Ihdmihpn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kglcogeo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lonkjenl.dll" Ebedndfa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pdaoog32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cnobnmpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Odoloalf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bghabf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kmmcjehm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cfiini32.dll" Mhbped32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Emnndlod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iieipa32.dll" Fjongcbl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gogllpah.dll" Lobgoh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nkeelohh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lfbpag32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cehkbgdf.dll" Gfobbc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pkfceo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pohfehdi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpefpo32.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hicodd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ofhick32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dfamcogo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epfbghho.dll" Gakcimgf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fmegncpp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dcfdgiid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcodhoaf.dll" Hlngpjlj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bodgdaah.dll" Dojddmec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hpocfncj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmpknpme.dll" Jgidao32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pmjqcc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njifbl32.dll" Cheido32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qffhlolm.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hahjpbad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alecllfh.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lcagpl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oiklkjgo.dll" Fcpfedki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lmcijcbe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dkqbaecc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Iapebchh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdnaob32.dll" Ilknfn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdacap32.dll" Eqgnokip.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
af70779eb3763a618b7c0d4bf830eb30_NeikiAnalytics.exeQaefjm32.exeQagcpljo.exeAjphib32.exeAplpai32.exeAffhncfc.exeAdjigg32.exeAfiecb32.exeAbpfhcje.exeAiinen32.exeAoffmd32.exeAljgfioc.exeBlmdlhmp.exeBbflib32.exeBnpmipql.exeBghabf32.exedescription pid process target process PID 2384 wrote to memory of 1948 2384 af70779eb3763a618b7c0d4bf830eb30_NeikiAnalytics.exe Qaefjm32.exe PID 2384 wrote to memory of 1948 2384 af70779eb3763a618b7c0d4bf830eb30_NeikiAnalytics.exe Qaefjm32.exe PID 2384 wrote to memory of 1948 2384 af70779eb3763a618b7c0d4bf830eb30_NeikiAnalytics.exe Qaefjm32.exe PID 2384 wrote to memory of 1948 2384 af70779eb3763a618b7c0d4bf830eb30_NeikiAnalytics.exe Qaefjm32.exe PID 1948 wrote to memory of 2684 1948 Qaefjm32.exe Qagcpljo.exe PID 1948 wrote to memory of 2684 1948 Qaefjm32.exe Qagcpljo.exe PID 1948 wrote to memory of 2684 1948 Qaefjm32.exe Qagcpljo.exe PID 1948 wrote to memory of 2684 1948 Qaefjm32.exe Qagcpljo.exe PID 2684 wrote to memory of 2644 2684 Qagcpljo.exe Ajphib32.exe PID 2684 wrote to memory of 2644 2684 Qagcpljo.exe Ajphib32.exe PID 2684 wrote to memory of 2644 2684 Qagcpljo.exe Ajphib32.exe PID 2684 wrote to memory of 2644 2684 Qagcpljo.exe Ajphib32.exe PID 2644 wrote to memory of 2624 2644 Ajphib32.exe Aplpai32.exe PID 2644 wrote to memory of 2624 2644 Ajphib32.exe Aplpai32.exe PID 2644 wrote to memory of 2624 2644 Ajphib32.exe Aplpai32.exe PID 2644 wrote to memory of 2624 2644 Ajphib32.exe Aplpai32.exe PID 2624 wrote to memory of 2788 2624 Aplpai32.exe Affhncfc.exe PID 2624 wrote to memory of 2788 2624 Aplpai32.exe Affhncfc.exe PID 2624 wrote to memory of 2788 2624 Aplpai32.exe Affhncfc.exe PID 2624 wrote to memory of 2788 2624 Aplpai32.exe Affhncfc.exe PID 2788 wrote to memory of 2608 2788 Affhncfc.exe Adjigg32.exe PID 2788 wrote to memory of 2608 2788 Affhncfc.exe Adjigg32.exe PID 2788 wrote to memory of 2608 2788 Affhncfc.exe Adjigg32.exe PID 2788 wrote to memory of 2608 2788 Affhncfc.exe Adjigg32.exe PID 2608 wrote to memory of 2560 2608 Adjigg32.exe Afiecb32.exe PID 2608 wrote to memory of 2560 2608 Adjigg32.exe Afiecb32.exe PID 2608 wrote to memory of 2560 2608 Adjigg32.exe Afiecb32.exe PID 2608 wrote to memory of 2560 2608 Adjigg32.exe Afiecb32.exe PID 2560 wrote to memory of 2232 2560 Afiecb32.exe Abpfhcje.exe PID 2560 wrote to memory of 2232 2560 Afiecb32.exe Abpfhcje.exe PID 2560 wrote to memory of 2232 2560 Afiecb32.exe Abpfhcje.exe PID 2560 wrote to memory of 2232 2560 Afiecb32.exe Abpfhcje.exe PID 2232 wrote to memory of 2840 2232 Abpfhcje.exe Aiinen32.exe PID 2232 wrote to memory of 2840 2232 Abpfhcje.exe Aiinen32.exe PID 2232 wrote to memory of 2840 2232 Abpfhcje.exe Aiinen32.exe PID 2232 wrote to memory of 2840 2232 Abpfhcje.exe Aiinen32.exe PID 2840 wrote to memory of 2892 2840 Aiinen32.exe Aoffmd32.exe PID 2840 wrote to memory of 2892 2840 Aiinen32.exe Aoffmd32.exe PID 2840 wrote to memory of 2892 2840 Aiinen32.exe Aoffmd32.exe PID 2840 wrote to memory of 2892 2840 Aiinen32.exe Aoffmd32.exe PID 2892 wrote to memory of 568 2892 Aoffmd32.exe Aljgfioc.exe PID 2892 wrote to memory of 568 2892 Aoffmd32.exe Aljgfioc.exe PID 2892 wrote to memory of 568 2892 Aoffmd32.exe Aljgfioc.exe PID 2892 wrote to memory of 568 2892 Aoffmd32.exe Aljgfioc.exe PID 568 wrote to memory of 1552 568 Aljgfioc.exe Blmdlhmp.exe PID 568 wrote to memory of 1552 568 Aljgfioc.exe Blmdlhmp.exe PID 568 wrote to memory of 1552 568 Aljgfioc.exe Blmdlhmp.exe PID 568 wrote to memory of 1552 568 Aljgfioc.exe Blmdlhmp.exe PID 1552 wrote to memory of 620 1552 Blmdlhmp.exe Bbflib32.exe PID 1552 wrote to memory of 620 1552 Blmdlhmp.exe Bbflib32.exe PID 1552 wrote to memory of 620 1552 Blmdlhmp.exe Bbflib32.exe PID 1552 wrote to memory of 620 1552 Blmdlhmp.exe Bbflib32.exe PID 620 wrote to memory of 3012 620 Bbflib32.exe Bnpmipql.exe PID 620 wrote to memory of 3012 620 Bbflib32.exe Bnpmipql.exe PID 620 wrote to memory of 3012 620 Bbflib32.exe Bnpmipql.exe PID 620 wrote to memory of 3012 620 Bbflib32.exe Bnpmipql.exe PID 3012 wrote to memory of 2676 3012 Bnpmipql.exe Bghabf32.exe PID 3012 wrote to memory of 2676 3012 Bnpmipql.exe Bghabf32.exe PID 3012 wrote to memory of 2676 3012 Bnpmipql.exe Bghabf32.exe PID 3012 wrote to memory of 2676 3012 Bnpmipql.exe Bghabf32.exe PID 2676 wrote to memory of 768 2676 Bghabf32.exe Bkfjhd32.exe PID 2676 wrote to memory of 768 2676 Bghabf32.exe Bkfjhd32.exe PID 2676 wrote to memory of 768 2676 Bghabf32.exe Bkfjhd32.exe PID 2676 wrote to memory of 768 2676 Bghabf32.exe Bkfjhd32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\af70779eb3763a618b7c0d4bf830eb30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\af70779eb3763a618b7c0d4bf830eb30_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\Qaefjm32.exeC:\Windows\system32\Qaefjm32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\Qagcpljo.exeC:\Windows\system32\Qagcpljo.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\Ajphib32.exeC:\Windows\system32\Ajphib32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\Aplpai32.exeC:\Windows\system32\Aplpai32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\Affhncfc.exeC:\Windows\system32\Affhncfc.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\Adjigg32.exeC:\Windows\system32\Adjigg32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\Afiecb32.exeC:\Windows\system32\Afiecb32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\Abpfhcje.exeC:\Windows\system32\Abpfhcje.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\Aiinen32.exeC:\Windows\system32\Aiinen32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\Aoffmd32.exeC:\Windows\system32\Aoffmd32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\Aljgfioc.exeC:\Windows\system32\Aljgfioc.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Windows\SysWOW64\Blmdlhmp.exeC:\Windows\system32\Blmdlhmp.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\Bbflib32.exeC:\Windows\system32\Bbflib32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SysWOW64\Bnpmipql.exeC:\Windows\system32\Bnpmipql.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\Bghabf32.exeC:\Windows\system32\Bghabf32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\Bkfjhd32.exeC:\Windows\system32\Bkfjhd32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:768 -
C:\Windows\SysWOW64\Bnefdp32.exeC:\Windows\system32\Bnefdp32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:584 -
C:\Windows\SysWOW64\Cjlgiqbk.exeC:\Windows\system32\Cjlgiqbk.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Windows\SysWOW64\Cljcelan.exeC:\Windows\system32\Cljcelan.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Windows\SysWOW64\Cgpgce32.exeC:\Windows\system32\Cgpgce32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Windows\SysWOW64\Cphlljge.exeC:\Windows\system32\Cphlljge.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1388 -
C:\Windows\SysWOW64\Cpjiajeb.exeC:\Windows\system32\Cpjiajeb.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:288 -
C:\Windows\SysWOW64\Comimg32.exeC:\Windows\system32\Comimg32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Windows\SysWOW64\Claifkkf.exeC:\Windows\system32\Claifkkf.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:812 -
C:\Windows\SysWOW64\Copfbfjj.exeC:\Windows\system32\Copfbfjj.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Windows\SysWOW64\Ckffgg32.exeC:\Windows\system32\Ckffgg32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Windows\SysWOW64\Cobbhfhg.exeC:\Windows\system32\Cobbhfhg.exe28⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Windows\SysWOW64\Dkhcmgnl.exeC:\Windows\system32\Dkhcmgnl.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Windows\SysWOW64\Dngoibmo.exeC:\Windows\system32\Dngoibmo.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Windows\SysWOW64\Ddagfm32.exeC:\Windows\system32\Ddagfm32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Windows\SysWOW64\Djnpnc32.exeC:\Windows\system32\Djnpnc32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2648 -
C:\Windows\SysWOW64\Dcfdgiid.exeC:\Windows\system32\Dcfdgiid.exe33⤵
- Executes dropped EXE
- Modifies registry class
PID:2856 -
C:\Windows\SysWOW64\Dkmmhf32.exeC:\Windows\system32\Dkmmhf32.exe34⤵
- Executes dropped EXE
PID:2660 -
C:\Windows\SysWOW64\Dchali32.exeC:\Windows\system32\Dchali32.exe35⤵
- Executes dropped EXE
PID:2492 -
C:\Windows\SysWOW64\Dfgmhd32.exeC:\Windows\system32\Dfgmhd32.exe36⤵
- Executes dropped EXE
PID:2092 -
C:\Windows\SysWOW64\Djbiicon.exeC:\Windows\system32\Djbiicon.exe37⤵
- Executes dropped EXE
PID:2868 -
C:\Windows\SysWOW64\Emcbkn32.exeC:\Windows\system32\Emcbkn32.exe38⤵
- Executes dropped EXE
PID:2912 -
C:\Windows\SysWOW64\Eflgccbp.exeC:\Windows\system32\Eflgccbp.exe39⤵
- Executes dropped EXE
PID:744 -
C:\Windows\SysWOW64\Ekholjqg.exeC:\Windows\system32\Ekholjqg.exe40⤵
- Executes dropped EXE
PID:1252 -
C:\Windows\SysWOW64\Ebbgid32.exeC:\Windows\system32\Ebbgid32.exe41⤵
- Executes dropped EXE
- Modifies registry class
PID:3004 -
C:\Windows\SysWOW64\Epfhbign.exeC:\Windows\system32\Epfhbign.exe42⤵
- Executes dropped EXE
PID:820 -
C:\Windows\SysWOW64\Ebedndfa.exeC:\Windows\system32\Ebedndfa.exe43⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:1248 -
C:\Windows\SysWOW64\Eeempocb.exeC:\Windows\system32\Eeempocb.exe44⤵
- Executes dropped EXE
PID:2116 -
C:\Windows\SysWOW64\Ejbfhfaj.exeC:\Windows\system32\Ejbfhfaj.exe45⤵
- Executes dropped EXE
PID:1156 -
C:\Windows\SysWOW64\Fckjalhj.exeC:\Windows\system32\Fckjalhj.exe46⤵
- Executes dropped EXE
PID:2248 -
C:\Windows\SysWOW64\Faokjpfd.exeC:\Windows\system32\Faokjpfd.exe47⤵
- Executes dropped EXE
PID:748 -
C:\Windows\SysWOW64\Fcmgfkeg.exeC:\Windows\system32\Fcmgfkeg.exe48⤵
- Executes dropped EXE
PID:2380 -
C:\Windows\SysWOW64\Fjgoce32.exeC:\Windows\system32\Fjgoce32.exe49⤵
- Executes dropped EXE
PID:1060 -
C:\Windows\SysWOW64\Fdoclk32.exeC:\Windows\system32\Fdoclk32.exe50⤵
- Executes dropped EXE
PID:2432 -
C:\Windows\SysWOW64\Fhkpmjln.exeC:\Windows\system32\Fhkpmjln.exe51⤵
- Executes dropped EXE
PID:1644 -
C:\Windows\SysWOW64\Filldb32.exeC:\Windows\system32\Filldb32.exe52⤵
- Executes dropped EXE
PID:992 -
C:\Windows\SysWOW64\Facdeo32.exeC:\Windows\system32\Facdeo32.exe53⤵
- Executes dropped EXE
PID:2452 -
C:\Windows\SysWOW64\Ffpmnf32.exeC:\Windows\system32\Ffpmnf32.exe54⤵
- Executes dropped EXE
PID:1944 -
C:\Windows\SysWOW64\Fioija32.exeC:\Windows\system32\Fioija32.exe55⤵PID:1704
-
C:\Windows\SysWOW64\Flmefm32.exeC:\Windows\system32\Flmefm32.exe56⤵
- Executes dropped EXE
PID:2920 -
C:\Windows\SysWOW64\Fbgmbg32.exeC:\Windows\system32\Fbgmbg32.exe57⤵
- Executes dropped EXE
PID:2368 -
C:\Windows\SysWOW64\Fmlapp32.exeC:\Windows\system32\Fmlapp32.exe58⤵
- Executes dropped EXE
PID:2712 -
C:\Windows\SysWOW64\Gpknlk32.exeC:\Windows\system32\Gpknlk32.exe59⤵
- Executes dropped EXE
PID:2784 -
C:\Windows\SysWOW64\Gfefiemq.exeC:\Windows\system32\Gfefiemq.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2808 -
C:\Windows\SysWOW64\Gegfdb32.exeC:\Windows\system32\Gegfdb32.exe61⤵
- Executes dropped EXE
PID:1668 -
C:\Windows\SysWOW64\Glaoalkh.exeC:\Windows\system32\Glaoalkh.exe62⤵
- Executes dropped EXE
PID:3028 -
C:\Windows\SysWOW64\Gbkgnfbd.exeC:\Windows\system32\Gbkgnfbd.exe63⤵
- Executes dropped EXE
PID:2832 -
C:\Windows\SysWOW64\Gangic32.exeC:\Windows\system32\Gangic32.exe64⤵
- Executes dropped EXE
PID:2836 -
C:\Windows\SysWOW64\Ghhofmql.exeC:\Windows\system32\Ghhofmql.exe65⤵
- Executes dropped EXE
PID:2908 -
C:\Windows\SysWOW64\Gobgcg32.exeC:\Windows\system32\Gobgcg32.exe66⤵
- Executes dropped EXE
PID:1780 -
C:\Windows\SysWOW64\Gbnccfpb.exeC:\Windows\system32\Gbnccfpb.exe67⤵PID:2768
-
C:\Windows\SysWOW64\Gelppaof.exeC:\Windows\system32\Gelppaof.exe68⤵PID:3060
-
C:\Windows\SysWOW64\Gkihhhnm.exeC:\Windows\system32\Gkihhhnm.exe69⤵PID:1296
-
C:\Windows\SysWOW64\Gmgdddmq.exeC:\Windows\system32\Gmgdddmq.exe70⤵PID:332
-
C:\Windows\SysWOW64\Geolea32.exeC:\Windows\system32\Geolea32.exe71⤵PID:628
-
C:\Windows\SysWOW64\Gkkemh32.exeC:\Windows\system32\Gkkemh32.exe72⤵PID:1088
-
C:\Windows\SysWOW64\Gaemjbcg.exeC:\Windows\system32\Gaemjbcg.exe73⤵PID:1868
-
C:\Windows\SysWOW64\Hgbebiao.exeC:\Windows\system32\Hgbebiao.exe74⤵PID:1556
-
C:\Windows\SysWOW64\Hiqbndpb.exeC:\Windows\system32\Hiqbndpb.exe75⤵PID:2980
-
C:\Windows\SysWOW64\Hahjpbad.exeC:\Windows\system32\Hahjpbad.exe76⤵
- Modifies registry class
PID:2144 -
C:\Windows\SysWOW64\Hdfflm32.exeC:\Windows\system32\Hdfflm32.exe77⤵PID:1592
-
C:\Windows\SysWOW64\Hicodd32.exeC:\Windows\system32\Hicodd32.exe78⤵
- Modifies registry class
PID:2640 -
C:\Windows\SysWOW64\Hpmgqnfl.exeC:\Windows\system32\Hpmgqnfl.exe79⤵PID:2800
-
C:\Windows\SysWOW64\Hggomh32.exeC:\Windows\system32\Hggomh32.exe80⤵PID:2524
-
C:\Windows\SysWOW64\Hiekid32.exeC:\Windows\system32\Hiekid32.exe81⤵PID:2860
-
C:\Windows\SysWOW64\Hpocfncj.exeC:\Windows\system32\Hpocfncj.exe82⤵
- Modifies registry class
PID:2596 -
C:\Windows\SysWOW64\Hobcak32.exeC:\Windows\system32\Hobcak32.exe83⤵PID:1792
-
C:\Windows\SysWOW64\Hhjhkq32.exeC:\Windows\system32\Hhjhkq32.exe84⤵PID:2308
-
C:\Windows\SysWOW64\Hlfdkoin.exeC:\Windows\system32\Hlfdkoin.exe85⤵PID:2828
-
C:\Windows\SysWOW64\Hodpgjha.exeC:\Windows\system32\Hodpgjha.exe86⤵PID:664
-
C:\Windows\SysWOW64\Hcplhi32.exeC:\Windows\system32\Hcplhi32.exe87⤵PID:1160
-
C:\Windows\SysWOW64\Henidd32.exeC:\Windows\system32\Henidd32.exe88⤵PID:1364
-
C:\Windows\SysWOW64\Hhmepp32.exeC:\Windows\system32\Hhmepp32.exe89⤵PID:1288
-
C:\Windows\SysWOW64\Hkkalk32.exeC:\Windows\system32\Hkkalk32.exe90⤵PID:2456
-
C:\Windows\SysWOW64\Iaeiieeb.exeC:\Windows\system32\Iaeiieeb.exe91⤵PID:1968
-
C:\Windows\SysWOW64\Ieqeidnl.exeC:\Windows\system32\Ieqeidnl.exe92⤵PID:2428
-
C:\Windows\SysWOW64\Idceea32.exeC:\Windows\system32\Idceea32.exe93⤵PID:2708
-
C:\Windows\SysWOW64\Ilknfn32.exeC:\Windows\system32\Ilknfn32.exe94⤵
- Modifies registry class
PID:2680 -
C:\Windows\SysWOW64\Inljnfkg.exeC:\Windows\system32\Inljnfkg.exe95⤵PID:2544
-
C:\Windows\SysWOW64\Idfbkq32.exeC:\Windows\system32\Idfbkq32.exe96⤵PID:2584
-
C:\Windows\SysWOW64\Ihankokm.exeC:\Windows\system32\Ihankokm.exe97⤵PID:496
-
C:\Windows\SysWOW64\Iokfhi32.exeC:\Windows\system32\Iokfhi32.exe98⤵PID:3044
-
C:\Windows\SysWOW64\Iajcde32.exeC:\Windows\system32\Iajcde32.exe99⤵PID:2592
-
C:\Windows\SysWOW64\Iggkllpe.exeC:\Windows\system32\Iggkllpe.exe100⤵PID:1392
-
C:\Windows\SysWOW64\Inqcif32.exeC:\Windows\system32\Inqcif32.exe101⤵PID:2960
-
C:\Windows\SysWOW64\Iqopea32.exeC:\Windows\system32\Iqopea32.exe102⤵PID:408
-
C:\Windows\SysWOW64\Icmlam32.exeC:\Windows\system32\Icmlam32.exe103⤵PID:1068
-
C:\Windows\SysWOW64\Incpoe32.exeC:\Windows\system32\Incpoe32.exe104⤵PID:316
-
C:\Windows\SysWOW64\Imfqjbli.exeC:\Windows\system32\Imfqjbli.exe105⤵PID:2328
-
C:\Windows\SysWOW64\Idmhkpml.exeC:\Windows\system32\Idmhkpml.exe106⤵PID:1700
-
C:\Windows\SysWOW64\Igkdgk32.exeC:\Windows\system32\Igkdgk32.exe107⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1684 -
C:\Windows\SysWOW64\Ifnechbj.exeC:\Windows\system32\Ifnechbj.exe108⤵PID:2156
-
C:\Windows\SysWOW64\Jqdipqbp.exeC:\Windows\system32\Jqdipqbp.exe109⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2628 -
C:\Windows\SysWOW64\Jcbellac.exeC:\Windows\system32\Jcbellac.exe110⤵PID:2224
-
C:\Windows\SysWOW64\Jiondcpk.exeC:\Windows\system32\Jiondcpk.exe111⤵PID:1652
-
C:\Windows\SysWOW64\Joifam32.exeC:\Windows\system32\Joifam32.exe112⤵PID:2536
-
C:\Windows\SysWOW64\Jfcnngnd.exeC:\Windows\system32\Jfcnngnd.exe113⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2864 -
C:\Windows\SysWOW64\Jmmfkafa.exeC:\Windows\system32\Jmmfkafa.exe114⤵PID:3000
-
C:\Windows\SysWOW64\Jcgogk32.exeC:\Windows\system32\Jcgogk32.exe115⤵PID:1748
-
C:\Windows\SysWOW64\Jbjochdi.exeC:\Windows\system32\Jbjochdi.exe116⤵PID:1064
-
C:\Windows\SysWOW64\Jicgpb32.exeC:\Windows\system32\Jicgpb32.exe117⤵PID:3068
-
C:\Windows\SysWOW64\Jmocpado.exeC:\Windows\system32\Jmocpado.exe118⤵PID:1800
-
C:\Windows\SysWOW64\Jbllihbf.exeC:\Windows\system32\Jbllihbf.exe119⤵PID:308
-
C:\Windows\SysWOW64\Jgidao32.exeC:\Windows\system32\Jgidao32.exe120⤵
- Modifies registry class
PID:468 -
C:\Windows\SysWOW64\Joplbl32.exeC:\Windows\system32\Joplbl32.exe121⤵PID:604
-
C:\Windows\SysWOW64\Jbnhng32.exeC:\Windows\system32\Jbnhng32.exe122⤵PID:1976
-
C:\Windows\SysWOW64\Kemejc32.exeC:\Windows\system32\Kemejc32.exe123⤵PID:1528
-
C:\Windows\SysWOW64\Kgkafo32.exeC:\Windows\system32\Kgkafo32.exe124⤵PID:2392
-
C:\Windows\SysWOW64\Kneicieh.exeC:\Windows\system32\Kneicieh.exe125⤵PID:2964
-
C:\Windows\SysWOW64\Kbqecg32.exeC:\Windows\system32\Kbqecg32.exe126⤵PID:1932
-
C:\Windows\SysWOW64\Kcbakpdo.exeC:\Windows\system32\Kcbakpdo.exe127⤵PID:2528
-
C:\Windows\SysWOW64\Kkijmm32.exeC:\Windows\system32\Kkijmm32.exe128⤵
- Drops file in System32 directory
PID:2200 -
C:\Windows\SysWOW64\Kngfih32.exeC:\Windows\system32\Kngfih32.exe129⤵PID:3024
-
C:\Windows\SysWOW64\Kafbec32.exeC:\Windows\system32\Kafbec32.exe130⤵PID:2100
-
C:\Windows\SysWOW64\Kgpjanje.exeC:\Windows\system32\Kgpjanje.exe131⤵PID:2824
-
C:\Windows\SysWOW64\Kfbkmk32.exeC:\Windows\system32\Kfbkmk32.exe132⤵PID:2532
-
C:\Windows\SysWOW64\Kmmcjehm.exeC:\Windows\system32\Kmmcjehm.exe133⤵
- Modifies registry class
PID:708 -
C:\Windows\SysWOW64\Kpkofpgq.exeC:\Windows\system32\Kpkofpgq.exe134⤵PID:2008
-
C:\Windows\SysWOW64\Kfegbj32.exeC:\Windows\system32\Kfegbj32.exe135⤵PID:1376
-
C:\Windows\SysWOW64\Kiccofna.exeC:\Windows\system32\Kiccofna.exe136⤵PID:1760
-
C:\Windows\SysWOW64\Kaklpcoc.exeC:\Windows\system32\Kaklpcoc.exe137⤵PID:264
-
C:\Windows\SysWOW64\Kcihlong.exeC:\Windows\system32\Kcihlong.exe138⤵PID:968
-
C:\Windows\SysWOW64\Kfgdhjmk.exeC:\Windows\system32\Kfgdhjmk.exe139⤵PID:608
-
C:\Windows\SysWOW64\Kifpdelo.exeC:\Windows\system32\Kifpdelo.exe140⤵
- Drops file in System32 directory
PID:2744 -
C:\Windows\SysWOW64\Lpphap32.exeC:\Windows\system32\Lpphap32.exe141⤵PID:2496
-
C:\Windows\SysWOW64\Lckdanld.exeC:\Windows\system32\Lckdanld.exe142⤵PID:2508
-
C:\Windows\SysWOW64\Lemaif32.exeC:\Windows\system32\Lemaif32.exe143⤵PID:2764
-
C:\Windows\SysWOW64\Lmcijcbe.exeC:\Windows\system32\Lmcijcbe.exe144⤵
- Modifies registry class
PID:2212 -
C:\Windows\SysWOW64\Lpbefoai.exeC:\Windows\system32\Lpbefoai.exe145⤵PID:2772
-
C:\Windows\SysWOW64\Lbqabkql.exeC:\Windows\system32\Lbqabkql.exe146⤵
- Drops file in System32 directory
PID:2172 -
C:\Windows\SysWOW64\Leonofpp.exeC:\Windows\system32\Leonofpp.exe147⤵PID:2088
-
C:\Windows\SysWOW64\Lhmjkaoc.exeC:\Windows\system32\Lhmjkaoc.exe148⤵PID:904
-
C:\Windows\SysWOW64\Logbhl32.exeC:\Windows\system32\Logbhl32.exe149⤵PID:2344
-
C:\Windows\SysWOW64\Lbcnhjnj.exeC:\Windows\system32\Lbcnhjnj.exe150⤵PID:2580
-
C:\Windows\SysWOW64\Leajdfnm.exeC:\Windows\system32\Leajdfnm.exe151⤵PID:2316
-
C:\Windows\SysWOW64\Lhpfqama.exeC:\Windows\system32\Lhpfqama.exe152⤵PID:2632
-
C:\Windows\SysWOW64\Lkncmmle.exeC:\Windows\system32\Lkncmmle.exe153⤵PID:2552
-
C:\Windows\SysWOW64\Lahkigca.exeC:\Windows\system32\Lahkigca.exe154⤵PID:2468
-
C:\Windows\SysWOW64\Ldfgebbe.exeC:\Windows\system32\Ldfgebbe.exe155⤵PID:1448
-
C:\Windows\SysWOW64\Llnofpcg.exeC:\Windows\system32\Llnofpcg.exe156⤵PID:1488
-
C:\Windows\SysWOW64\Lollckbk.exeC:\Windows\system32\Lollckbk.exe157⤵PID:948
-
C:\Windows\SysWOW64\Lmolnh32.exeC:\Windows\system32\Lmolnh32.exe158⤵PID:1076
-
C:\Windows\SysWOW64\Ldidkbpb.exeC:\Windows\system32\Ldidkbpb.exe159⤵
- Drops file in System32 directory
PID:2152 -
C:\Windows\SysWOW64\Mhdplq32.exeC:\Windows\system32\Mhdplq32.exe160⤵PID:2636
-
C:\Windows\SysWOW64\Monhhk32.exeC:\Windows\system32\Monhhk32.exe161⤵PID:2720
-
C:\Windows\SysWOW64\Mamddf32.exeC:\Windows\system32\Mamddf32.exe162⤵PID:2752
-
C:\Windows\SysWOW64\Mdkqqa32.exeC:\Windows\system32\Mdkqqa32.exe163⤵PID:1300
-
C:\Windows\SysWOW64\Mhgmapfi.exeC:\Windows\system32\Mhgmapfi.exe164⤵PID:1692
-
C:\Windows\SysWOW64\Mihiih32.exeC:\Windows\system32\Mihiih32.exe165⤵PID:2160
-
C:\Windows\SysWOW64\Mmceigep.exeC:\Windows\system32\Mmceigep.exe166⤵PID:2448
-
C:\Windows\SysWOW64\Mdmmfa32.exeC:\Windows\system32\Mdmmfa32.exe167⤵PID:2124
-
C:\Windows\SysWOW64\Mbpnanch.exeC:\Windows\system32\Mbpnanch.exe168⤵PID:2880
-
C:\Windows\SysWOW64\Mkgfckcj.exeC:\Windows\system32\Mkgfckcj.exe169⤵PID:1608
-
C:\Windows\SysWOW64\Mijfnh32.exeC:\Windows\system32\Mijfnh32.exe170⤵PID:696
-
C:\Windows\SysWOW64\Mpdnkb32.exeC:\Windows\system32\Mpdnkb32.exe171⤵PID:2072
-
C:\Windows\SysWOW64\Mcbjgn32.exeC:\Windows\system32\Mcbjgn32.exe172⤵PID:1228
-
C:\Windows\SysWOW64\Mimbdhhb.exeC:\Windows\system32\Mimbdhhb.exe173⤵PID:2600
-
C:\Windows\SysWOW64\Mmhodf32.exeC:\Windows\system32\Mmhodf32.exe174⤵PID:2040
-
C:\Windows\SysWOW64\Mpfkqb32.exeC:\Windows\system32\Mpfkqb32.exe175⤵PID:3052
-
C:\Windows\SysWOW64\Moiklogi.exeC:\Windows\system32\Moiklogi.exe176⤵PID:2104
-
C:\Windows\SysWOW64\Meccii32.exeC:\Windows\system32\Meccii32.exe177⤵
- Drops file in System32 directory
PID:2928 -
C:\Windows\SysWOW64\Mhbped32.exeC:\Windows\system32\Mhbped32.exe178⤵
- Modifies registry class
PID:2888 -
C:\Windows\SysWOW64\Mpigfa32.exeC:\Windows\system32\Mpigfa32.exe179⤵PID:1112
-
C:\Windows\SysWOW64\Nolhan32.exeC:\Windows\system32\Nolhan32.exe180⤵PID:2128
-
C:\Windows\SysWOW64\Nialog32.exeC:\Windows\system32\Nialog32.exe181⤵PID:1536
-
C:\Windows\SysWOW64\Nlphkb32.exeC:\Windows\system32\Nlphkb32.exe182⤵PID:1984
-
C:\Windows\SysWOW64\Nondgn32.exeC:\Windows\system32\Nondgn32.exe183⤵
- Drops file in System32 directory
PID:2992 -
C:\Windows\SysWOW64\Namqci32.exeC:\Windows\system32\Namqci32.exe184⤵PID:2692
-
C:\Windows\SysWOW64\Ndkmpe32.exeC:\Windows\system32\Ndkmpe32.exe185⤵PID:2652
-
C:\Windows\SysWOW64\Nhfipcid.exeC:\Windows\system32\Nhfipcid.exe186⤵PID:1676
-
C:\Windows\SysWOW64\Nkeelohh.exeC:\Windows\system32\Nkeelohh.exe187⤵
- Modifies registry class
PID:2948 -
C:\Windows\SysWOW64\Naoniipe.exeC:\Windows\system32\Naoniipe.exe188⤵PID:2872
-
C:\Windows\SysWOW64\Ndmjedoi.exeC:\Windows\system32\Ndmjedoi.exe189⤵PID:1568
-
C:\Windows\SysWOW64\Nglfapnl.exeC:\Windows\system32\Nglfapnl.exe190⤵PID:1120
-
C:\Windows\SysWOW64\Nocnbmoo.exeC:\Windows\system32\Nocnbmoo.exe191⤵PID:3032
-
C:\Windows\SysWOW64\Naajoinb.exeC:\Windows\system32\Naajoinb.exe192⤵PID:3036
-
C:\Windows\SysWOW64\Ndpfkdmf.exeC:\Windows\system32\Ndpfkdmf.exe193⤵PID:3096
-
C:\Windows\SysWOW64\Nhkbkc32.exeC:\Windows\system32\Nhkbkc32.exe194⤵PID:3136
-
C:\Windows\SysWOW64\Njlockkm.exeC:\Windows\system32\Njlockkm.exe195⤵PID:3176
-
C:\Windows\SysWOW64\Nnhkcj32.exeC:\Windows\system32\Nnhkcj32.exe196⤵PID:3216
-
C:\Windows\SysWOW64\Nceclqan.exeC:\Windows\system32\Nceclqan.exe197⤵PID:3256
-
C:\Windows\SysWOW64\Oklkmnbp.exeC:\Windows\system32\Oklkmnbp.exe198⤵
- Drops file in System32 directory
PID:3296 -
C:\Windows\SysWOW64\Olmhdf32.exeC:\Windows\system32\Olmhdf32.exe199⤵PID:3336
-
C:\Windows\SysWOW64\Oqideepg.exeC:\Windows\system32\Oqideepg.exe200⤵PID:3376
-
C:\Windows\SysWOW64\Ogblbo32.exeC:\Windows\system32\Ogblbo32.exe201⤵PID:3416
-
C:\Windows\SysWOW64\Ofelmloo.exeC:\Windows\system32\Ofelmloo.exe202⤵PID:3456
-
C:\Windows\SysWOW64\Onmdoioa.exeC:\Windows\system32\Onmdoioa.exe203⤵PID:3496
-
C:\Windows\SysWOW64\Oqkqkdne.exeC:\Windows\system32\Oqkqkdne.exe204⤵PID:3536
-
C:\Windows\SysWOW64\Ofhick32.exeC:\Windows\system32\Ofhick32.exe205⤵
- Modifies registry class
PID:3576 -
C:\Windows\SysWOW64\Ohfeog32.exeC:\Windows\system32\Ohfeog32.exe206⤵PID:3616
-
C:\Windows\SysWOW64\Oqmmpd32.exeC:\Windows\system32\Oqmmpd32.exe207⤵PID:3656
-
C:\Windows\SysWOW64\Oclilp32.exeC:\Windows\system32\Oclilp32.exe208⤵PID:3696
-
C:\Windows\SysWOW64\Obojhlbq.exeC:\Windows\system32\Obojhlbq.exe209⤵PID:3736
-
C:\Windows\SysWOW64\Ojfaijcc.exeC:\Windows\system32\Ojfaijcc.exe210⤵PID:3776
-
C:\Windows\SysWOW64\Ohibdf32.exeC:\Windows\system32\Ohibdf32.exe211⤵PID:3816
-
C:\Windows\SysWOW64\Omdneebf.exeC:\Windows\system32\Omdneebf.exe212⤵
- Drops file in System32 directory
PID:3856 -
C:\Windows\SysWOW64\Ocnfbo32.exeC:\Windows\system32\Ocnfbo32.exe213⤵PID:3896
-
C:\Windows\SysWOW64\Odobjg32.exeC:\Windows\system32\Odobjg32.exe214⤵PID:3936
-
C:\Windows\SysWOW64\Omfkke32.exeC:\Windows\system32\Omfkke32.exe215⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3976 -
C:\Windows\SysWOW64\Okikfagn.exeC:\Windows\system32\Okikfagn.exe216⤵PID:4016
-
C:\Windows\SysWOW64\Obcccl32.exeC:\Windows\system32\Obcccl32.exe217⤵PID:4056
-
C:\Windows\SysWOW64\Pdaoog32.exeC:\Windows\system32\Pdaoog32.exe218⤵
- Modifies registry class
PID:1924 -
C:\Windows\SysWOW64\Pgplkb32.exeC:\Windows\system32\Pgplkb32.exe219⤵PID:3104
-
C:\Windows\SysWOW64\Pklhlael.exeC:\Windows\system32\Pklhlael.exe220⤵PID:3156
-
C:\Windows\SysWOW64\Pbfpik32.exeC:\Windows\system32\Pbfpik32.exe221⤵PID:3204
-
C:\Windows\SysWOW64\Pqhpdhcc.exeC:\Windows\system32\Pqhpdhcc.exe222⤵PID:3248
-
C:\Windows\SysWOW64\Pgbhabjp.exeC:\Windows\system32\Pgbhabjp.exe223⤵PID:3304
-
C:\Windows\SysWOW64\Pjadmnic.exeC:\Windows\system32\Pjadmnic.exe224⤵
- Drops file in System32 directory
PID:3356 -
C:\Windows\SysWOW64\Pnlqnl32.exeC:\Windows\system32\Pnlqnl32.exe225⤵PID:3400
-
C:\Windows\SysWOW64\Pqkmjh32.exeC:\Windows\system32\Pqkmjh32.exe226⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3448 -
C:\Windows\SysWOW64\Pefijfii.exeC:\Windows\system32\Pefijfii.exe227⤵
- Drops file in System32 directory
PID:3508 -
C:\Windows\SysWOW64\Pkpagq32.exeC:\Windows\system32\Pkpagq32.exe228⤵PID:3560
-
C:\Windows\SysWOW64\Pmanoifd.exeC:\Windows\system32\Pmanoifd.exe229⤵PID:3608
-
C:\Windows\SysWOW64\Pamiog32.exeC:\Windows\system32\Pamiog32.exe230⤵PID:3652
-
C:\Windows\SysWOW64\Pggbla32.exeC:\Windows\system32\Pggbla32.exe231⤵PID:3712
-
C:\Windows\SysWOW64\Pjenhm32.exeC:\Windows\system32\Pjenhm32.exe232⤵PID:3760
-
C:\Windows\SysWOW64\Pmdjdh32.exeC:\Windows\system32\Pmdjdh32.exe233⤵
- Drops file in System32 directory
PID:3804 -
C:\Windows\SysWOW64\Ppbfpd32.exeC:\Windows\system32\Ppbfpd32.exe234⤵PID:3788
-
C:\Windows\SysWOW64\Pgioaa32.exeC:\Windows\system32\Pgioaa32.exe235⤵PID:3908
-
C:\Windows\SysWOW64\Pjhknm32.exeC:\Windows\system32\Pjhknm32.exe236⤵PID:3948
-
C:\Windows\SysWOW64\Qabcjgkh.exeC:\Windows\system32\Qabcjgkh.exe237⤵PID:4008
-
C:\Windows\SysWOW64\Qpecfc32.exeC:\Windows\system32\Qpecfc32.exe238⤵
- Drops file in System32 directory
PID:4044 -
C:\Windows\SysWOW64\Qbcpbo32.exeC:\Windows\system32\Qbcpbo32.exe239⤵PID:2188
-
C:\Windows\SysWOW64\Qjjgclai.exeC:\Windows\system32\Qjjgclai.exe240⤵PID:3116
-
C:\Windows\SysWOW64\Qmicohqm.exeC:\Windows\system32\Qmicohqm.exe241⤵PID:3184
-
C:\Windows\SysWOW64\Qlkdkd32.exeC:\Windows\system32\Qlkdkd32.exe242⤵PID:3236