Analysis
-
max time kernel
119s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 23:49
Static task
static1
Behavioral task
behavioral1
Sample
5bb744bb24ecae9c9d4afc3b0725a540_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5bb744bb24ecae9c9d4afc3b0725a540_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
5bb744bb24ecae9c9d4afc3b0725a540_NeikiAnalytics.exe
-
Size
336KB
-
MD5
5bb744bb24ecae9c9d4afc3b0725a540
-
SHA1
6d294ca174a7871e1209f57254d38c985a0d09b6
-
SHA256
0b12d79d944342b869e0aa50c383f8374d2105495cd445f3420e02501cdf8d30
-
SHA512
f72b1a1512814aaa5e82c234a3cfb4aef9e6fb5005aa577d3e98e6c69117f18f78f781a21252852eb27b25d8b95fb16a5999a72f574193b7347381e433ee6d57
-
SSDEEP
6144:utEZSV5q+owv7aOl3BzrUmKyIxLfYeOO9UmKyIxLiajOE:uSl+oi7aOlxzr3cOK3Taj
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Apnhggln.exeIladfn32.exeNkkmgncb.exeAphehidc.exeOlgpff32.exeIhqilnig.exeHfcjdkpg.exeIgcgnbim.exeGoldfelp.exeMopdpg32.exeFfmipmjn.exeDpaqmnap.exeEgmabg32.exeGnkoid32.exeJoblkegc.exeBmnofp32.exeOlkfmi32.exeAokckm32.exeQfikod32.exeAjcldpkd.exeOdmabj32.exePqgbah32.exeAmebjgai.exeIgmepdbc.exeAejglo32.exeDqfabdaf.exeMmndfnpl.exeEmeobj32.exeJondnnbk.exeMebnic32.exeGmpcgace.exeDgfpni32.exeJnlbgq32.exePjjkfe32.exeHijjpeha.exeIijfoh32.exeEnkdda32.exeMlgiiaij.exeNdnmialh.exeFgpock32.exeIlkpac32.exeFennoa32.exeCmfmojcb.exeLlkbcl32.exeAiimfi32.exeMccbmh32.exeKoaclfgl.exeBllcnega.exeChlgid32.exeGgdekbgb.exeMclebc32.exePmpdmfff.exeBfjkphjd.exePhhmeehg.exeIoooiack.exeLekcffem.exeGoddjc32.exeAljmbknm.exeKjihci32.exeEinebddd.exeDnhbmpkn.exeHpfoboml.exeEpeekmjk.exeLhhkapeh.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Apnhggln.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iladfn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nkkmgncb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Aphehidc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Olgpff32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ihqilnig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hfcjdkpg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Igcgnbim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Goldfelp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mopdpg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ffmipmjn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dpaqmnap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Egmabg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gnkoid32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Joblkegc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bmnofp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Olkfmi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aokckm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Qfikod32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ajcldpkd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Odmabj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pqgbah32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Amebjgai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Igmepdbc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aejglo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dqfabdaf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mmndfnpl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Emeobj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jondnnbk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mebnic32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gmpcgace.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dgfpni32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jnlbgq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pjjkfe32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hijjpeha.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iijfoh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Enkdda32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mlgiiaij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ndnmialh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fgpock32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ilkpac32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fennoa32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cmfmojcb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Llkbcl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aiimfi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mccbmh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Koaclfgl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bllcnega.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Chlgid32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ggdekbgb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mclebc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pmpdmfff.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bfjkphjd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Phhmeehg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ioooiack.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lekcffem.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Goddjc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aljmbknm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kjihci32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Einebddd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dnhbmpkn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hpfoboml.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Epeekmjk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lhhkapeh.exe -
Executes dropped EXE 64 IoCs
Processes:
Acekjjmk.exeAnahqh32.exeBadnhbce.exeBidlgdlk.exeBigimdjh.exeChqoipkk.exeComdkipe.exeDpcjnabn.exeDiphbfdi.exeDegiggjm.exeEdnbncmb.exeFjbafi32.exeFoccjood.exeGbfiaj32.exeGnpflj32.exeGmgpbf32.exeHmjlhfof.exeHnpbjnpo.exeIpehmebh.exeIoooiack.exeIpokcdjn.exeJkkija32.exeJdcmbgkj.exeJplkmgol.exeKcmcoblm.exeKlhemhpk.exeKfpifm32.exeKdefgj32.exeLomgjb32.exeLkfddc32.exeLfpeeqig.exeMjpkqonj.exeMpmcielb.exeMfglep32.exeMacilmnk.exeMccbmh32.exeNfdkoc32.exeNhdhif32.exeNbniid32.exeNeqnqofm.exeOlkfmi32.exeOioggmmc.exeObgkpb32.exeOmqlpp32.exeOhfqmi32.exeOdmabj32.exeOmefkplm.exePilfpqaa.exePcdkif32.exePphkbj32.exePeedka32.exePpkhhjei.exePalepb32.exePanaeb32.exePldebkhj.exeQfljkp32.exeQqfkln32.exeQhmcmk32.exeAjnpecbj.exeAcfdnihk.exeAqjdgmgd.exeAobnniji.exeAijbfo32.exeBeackp32.exepid process 1776 Acekjjmk.exe 2916 Anahqh32.exe 2716 Badnhbce.exe 2672 Bidlgdlk.exe 2604 Bigimdjh.exe 2796 Chqoipkk.exe 112 Comdkipe.exe 372 Dpcjnabn.exe 2772 Diphbfdi.exe 2008 Degiggjm.exe 1976 Ednbncmb.exe 1540 Fjbafi32.exe 2628 Foccjood.exe 764 Gbfiaj32.exe 2064 Gnpflj32.exe 2960 Gmgpbf32.exe 2072 Hmjlhfof.exe 3064 Hnpbjnpo.exe 1488 Ipehmebh.exe 1180 Ioooiack.exe 2036 Ipokcdjn.exe 916 Jkkija32.exe 2748 Jdcmbgkj.exe 2128 Jplkmgol.exe 1752 Kcmcoblm.exe 2088 Klhemhpk.exe 2152 Kfpifm32.exe 2956 Kdefgj32.exe 2552 Lomgjb32.exe 2448 Lkfddc32.exe 2852 Lfpeeqig.exe 2496 Mjpkqonj.exe 2452 Mpmcielb.exe 2996 Mfglep32.exe 652 Macilmnk.exe 2696 Mccbmh32.exe 1636 Nfdkoc32.exe 1988 Nhdhif32.exe 2224 Nbniid32.exe 2592 Neqnqofm.exe 1784 Olkfmi32.exe 2428 Oioggmmc.exe 2740 Obgkpb32.exe 3000 Omqlpp32.exe 3020 Ohfqmi32.exe 1968 Odmabj32.exe 1152 Omefkplm.exe 2100 Pilfpqaa.exe 1068 Pcdkif32.exe 1508 Pphkbj32.exe 3036 Peedka32.exe 1676 Ppkhhjei.exe 1588 Palepb32.exe 2688 Panaeb32.exe 2556 Pldebkhj.exe 2612 Qfljkp32.exe 2380 Qqfkln32.exe 2344 Qhmcmk32.exe 1916 Ajnpecbj.exe 1372 Acfdnihk.exe 2652 Aqjdgmgd.exe 1992 Aobnniji.exe 2148 Aijbfo32.exe 2632 Beackp32.exe -
Loads dropped DLL 64 IoCs
Processes:
5bb744bb24ecae9c9d4afc3b0725a540_NeikiAnalytics.exeAcekjjmk.exeAnahqh32.exeBadnhbce.exeBidlgdlk.exeBigimdjh.exeChqoipkk.exeComdkipe.exeDpcjnabn.exeDiphbfdi.exeDegiggjm.exeEdnbncmb.exeFjbafi32.exeFoccjood.exeGbfiaj32.exeGnpflj32.exeGmgpbf32.exeHmjlhfof.exeHnpbjnpo.exeIpehmebh.exeIoooiack.exeIpokcdjn.exeJkkija32.exeJdcmbgkj.exeJplkmgol.exeKcmcoblm.exeKlhemhpk.exeKfpifm32.exeKdefgj32.exeLomgjb32.exeLkfddc32.exeLfpeeqig.exepid process 2300 5bb744bb24ecae9c9d4afc3b0725a540_NeikiAnalytics.exe 2300 5bb744bb24ecae9c9d4afc3b0725a540_NeikiAnalytics.exe 1776 Acekjjmk.exe 1776 Acekjjmk.exe 2916 Anahqh32.exe 2916 Anahqh32.exe 2716 Badnhbce.exe 2716 Badnhbce.exe 2672 Bidlgdlk.exe 2672 Bidlgdlk.exe 2604 Bigimdjh.exe 2604 Bigimdjh.exe 2796 Chqoipkk.exe 2796 Chqoipkk.exe 112 Comdkipe.exe 112 Comdkipe.exe 372 Dpcjnabn.exe 372 Dpcjnabn.exe 2772 Diphbfdi.exe 2772 Diphbfdi.exe 2008 Degiggjm.exe 2008 Degiggjm.exe 1976 Ednbncmb.exe 1976 Ednbncmb.exe 1540 Fjbafi32.exe 1540 Fjbafi32.exe 2628 Foccjood.exe 2628 Foccjood.exe 764 Gbfiaj32.exe 764 Gbfiaj32.exe 2064 Gnpflj32.exe 2064 Gnpflj32.exe 2960 Gmgpbf32.exe 2960 Gmgpbf32.exe 2072 Hmjlhfof.exe 2072 Hmjlhfof.exe 3064 Hnpbjnpo.exe 3064 Hnpbjnpo.exe 1488 Ipehmebh.exe 1488 Ipehmebh.exe 1180 Ioooiack.exe 1180 Ioooiack.exe 2036 Ipokcdjn.exe 2036 Ipokcdjn.exe 916 Jkkija32.exe 916 Jkkija32.exe 2748 Jdcmbgkj.exe 2748 Jdcmbgkj.exe 2128 Jplkmgol.exe 2128 Jplkmgol.exe 1752 Kcmcoblm.exe 1752 Kcmcoblm.exe 2088 Klhemhpk.exe 2088 Klhemhpk.exe 2152 Kfpifm32.exe 2152 Kfpifm32.exe 2956 Kdefgj32.exe 2956 Kdefgj32.exe 2552 Lomgjb32.exe 2552 Lomgjb32.exe 2448 Lkfddc32.exe 2448 Lkfddc32.exe 2852 Lfpeeqig.exe 2852 Lfpeeqig.exe -
Drops file in System32 directory 64 IoCs
Processes:
Aejlnmkm.exeBqmpdioa.exeLonlkcho.exeChgimh32.exePhocfd32.exeMqbbagjo.exeCpbnaj32.exeEdeclabl.exeJagpdd32.exeJnlbgq32.exePkfghh32.exeNeghdg32.exeIjphofem.exeNjhfcp32.exeHadcipbi.exeIeponofk.exeLgpfpe32.exeDapjdq32.exeLnhgim32.exeCjoilfek.exeEpnkip32.exeAphehidc.exeMjddnjdf.exeCgaaah32.exeBqijljfd.exeKajiigba.exeNqokpd32.exeOpodknco.exeEfjpkj32.exeLjbipolj.exeJnjhjj32.exeKlhemhpk.exeFennoa32.exeFeachqgb.exeGehiioaj.exeKmimcbja.exeLoaokjjg.exeColadm32.exeDbadagln.exeAcfmcc32.exeHhfmbq32.exeCkchcc32.exeNloachkf.exeKjbclamj.exeLfdbcing.exePkkblp32.exeAcekjjmk.exeAiimfi32.exeAnjojphb.exeEbfqfpop.exeDgeaoinb.exeHmmdin32.exeHhoeii32.exeCgjgol32.exeDpaqmnap.exeNpiiafpa.exeNfdkoc32.exeCbcfbege.exeOlgpff32.exeOmiand32.exeAfndjdpe.exeQnnhcknd.exeOfcqcp32.exedescription ioc process File created C:\Windows\SysWOW64\Abkeba32.dll Aejlnmkm.exe File created C:\Windows\SysWOW64\Bgghac32.exe Bqmpdioa.exe File opened for modification C:\Windows\SysWOW64\Ldkdckff.exe Lonlkcho.exe File opened for modification C:\Windows\SysWOW64\Cpbnaj32.exe Chgimh32.exe File opened for modification C:\Windows\SysWOW64\Pnllnk32.exe Phocfd32.exe File opened for modification C:\Windows\SysWOW64\Mklcadfn.exe Mqbbagjo.exe File opened for modification C:\Windows\SysWOW64\Cikbjpqd.exe Cpbnaj32.exe File created C:\Windows\SysWOW64\Edhpaa32.exe Edeclabl.exe File opened for modification C:\Windows\SysWOW64\Jjpdmi32.exe Jagpdd32.exe File created C:\Windows\SysWOW64\Gaqnfnep.dll Jnlbgq32.exe File created C:\Windows\SysWOW64\Gdnipekj.dll Pkfghh32.exe File opened for modification C:\Windows\SysWOW64\Noplmlok.exe Neghdg32.exe File opened for modification C:\Windows\SysWOW64\Iladfn32.exe Ijphofem.exe File created C:\Windows\SysWOW64\Ndqkleln.exe Njhfcp32.exe File created C:\Windows\SysWOW64\Aijpfppe.dll Hadcipbi.exe File opened for modification C:\Windows\SysWOW64\Iebldo32.exe Ieponofk.exe File created C:\Windows\SysWOW64\Mlmoilni.exe Lgpfpe32.exe File opened for modification C:\Windows\SysWOW64\Ddnfql32.exe Dapjdq32.exe File created C:\Windows\SysWOW64\Legdph32.dll Lnhgim32.exe File created C:\Windows\SysWOW64\Jmhdkakc.dll Cjoilfek.exe File opened for modification C:\Windows\SysWOW64\Eifobe32.exe Epnkip32.exe File created C:\Windows\SysWOW64\Djcnme32.dll Aphehidc.exe File opened for modification C:\Windows\SysWOW64\Manljd32.exe Mjddnjdf.exe File created C:\Windows\SysWOW64\Cbffoabe.exe Cgaaah32.exe File created C:\Windows\SysWOW64\Cmbfdl32.dll Bqijljfd.exe File created C:\Windows\SysWOW64\Lkbmbl32.exe Kajiigba.exe File created C:\Windows\SysWOW64\Npdfik32.dll Nqokpd32.exe File created C:\Windows\SysWOW64\Oekmceaf.exe Opodknco.exe File created C:\Windows\SysWOW64\Oomjld32.dll Efjpkj32.exe File created C:\Windows\SysWOW64\Pdleiobf.dll Ljbipolj.exe File created C:\Windows\SysWOW64\Najgacfg.dll Jnjhjj32.exe File opened for modification C:\Windows\SysWOW64\Kfpifm32.exe Klhemhpk.exe File created C:\Windows\SysWOW64\Cillnojb.dll Fennoa32.exe File created C:\Windows\SysWOW64\Jjmfenoo.dll Feachqgb.exe File created C:\Windows\SysWOW64\Gkebafoa.exe Gehiioaj.exe File created C:\Windows\SysWOW64\Kipmhc32.exe Kmimcbja.exe File opened for modification C:\Windows\SysWOW64\Loclai32.exe Loaokjjg.exe File created C:\Windows\SysWOW64\Dlpbna32.exe Coladm32.exe File created C:\Windows\SysWOW64\Dhklna32.exe Dbadagln.exe File created C:\Windows\SysWOW64\Adpqglen.dll Acfmcc32.exe File created C:\Windows\SysWOW64\Hkejnl32.exe Hhfmbq32.exe File created C:\Windows\SysWOW64\Gegknghg.dll Ckchcc32.exe File created C:\Windows\SysWOW64\Bcdpdn32.dll Nloachkf.exe File created C:\Windows\SysWOW64\Ohlhijgh.dll Kjbclamj.exe File created C:\Windows\SysWOW64\Moeodd32.dll Lfdbcing.exe File created C:\Windows\SysWOW64\Agefobee.dll Pkkblp32.exe File created C:\Windows\SysWOW64\Qnfkge32.dll Acekjjmk.exe File opened for modification C:\Windows\SysWOW64\Anfeop32.exe Aiimfi32.exe File created C:\Windows\SysWOW64\Abldll32.dll Anjojphb.exe File created C:\Windows\SysWOW64\Aedkomok.dll Ebfqfpop.exe File created C:\Windows\SysWOW64\Mnkgen32.dll Dgeaoinb.exe File created C:\Windows\SysWOW64\Nomdjlpi.dll Ijphofem.exe File created C:\Windows\SysWOW64\Ghcmae32.dll Hmmdin32.exe File created C:\Windows\SysWOW64\Hagianlf.exe Hhoeii32.exe File created C:\Windows\SysWOW64\Caokmd32.exe Cgjgol32.exe File created C:\Windows\SysWOW64\Dlhaaogd.exe Dpaqmnap.exe File created C:\Windows\SysWOW64\Dfpnca32.dll Npiiafpa.exe File created C:\Windows\SysWOW64\Nhdhif32.exe Nfdkoc32.exe File created C:\Windows\SysWOW64\Elookl32.dll Cbcfbege.exe File opened for modification C:\Windows\SysWOW64\Ocqhcqgk.exe Olgpff32.exe File opened for modification C:\Windows\SysWOW64\Oqgjdbpi.exe Omiand32.exe File opened for modification C:\Windows\SysWOW64\Aljmbknm.exe Afndjdpe.exe File created C:\Windows\SysWOW64\Kjcbpigl.dll Qnnhcknd.exe File opened for modification C:\Windows\SysWOW64\Objaha32.exe Ofcqcp32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 608 4460 WerFault.exe Bmenijcd.exe -
Modifies registry class 64 IoCs
Processes:
Pmfmej32.exeOfcqcp32.exeGjgiidkl.exeNjeccjcd.exeObeacl32.exeOjpomh32.exeKmclmm32.exeMccbmh32.exeQgmpibam.exeNhkbmo32.exeFabmmejd.exeFhkagonc.exeFclbgj32.exeIpehmebh.exeJdcmbgkj.exeCbjlhpkb.exeDapjdq32.exeDipjkn32.exeMkdffoij.exeAljjjb32.exeGkedjo32.exeBhjpnj32.exeLcppgbjd.exeFikgda32.exePcdkif32.exeFdkmeiei.exeDgfpni32.exeEclfhgaf.exeLklgbadb.exeFiepea32.exeOomjng32.exeJcgqbq32.exeLdpbpgoh.exeMebnic32.exeDpklkgoj.exeElibpg32.exeAdjhicpo.exeGhekhd32.exeGampaipe.exeJkkija32.exeMfjkdh32.exeHijhhl32.exeJecnnk32.exeIafofkkf.exeNoojdc32.exeBmnofp32.exeCcpqjfnh.exeNfdkoc32.exeNfdfmfle.exeEcbfmm32.exePalbgn32.exeFodgkp32.exeFefcmehe.exeFlapkmlj.exeIijfoh32.exeBejfao32.exeMfmndn32.exeNnlhab32.exeHafbghhj.exePjpmdd32.exeKkgahoel.exeNbmdhfog.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idkbii32.dll" Pmfmej32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odlhoigp.dll" Ofcqcp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gjgiidkl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Njeccjcd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Obeacl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ojpomh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oljgqipg.dll" Kmclmm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnoglhlh.dll" Mccbmh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Qgmpibam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nhkbmo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Fabmmejd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fhkagonc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fclbgj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ipehmebh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iijbfecp.dll" Jdcmbgkj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Cbjlhpkb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhlmhiho.dll" Dapjdq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dipjkn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mkdffoij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikkkijnk.dll" Aljjjb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccdhdn32.dll" Gkedjo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bhjpnj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chnjdl32.dll" Lcppgbjd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fikgda32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Pcdkif32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikdngobg.dll" Fdkmeiei.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dgfpni32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Eclfhgaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhjpijfl.dll" Lklgbadb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Fiepea32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Oomjng32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gadgpb32.dll" Jcgqbq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ldpbpgoh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mebnic32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dpklkgoj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Elibpg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Adjhicpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oemmkpog.dll" Ghekhd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gampaipe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Oomjng32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jkkija32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pikijafg.dll" Mfjkdh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hijhhl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jecnnk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bceclhel.dll" Iafofkkf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Noojdc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iibogmjf.dll" Bmnofp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djenbd32.dll" Ccpqjfnh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjkbonmp.dll" Nfdkoc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Feembf32.dll" Nfdfmfle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ecbfmm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfekjn32.dll" Palbgn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gedhkkno.dll" Fodgkp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Najnhfnn.dll" Fefcmehe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Flapkmlj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Iijfoh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bejfao32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mfmndn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nnlhab32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hafbghhj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Pjpmdd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kkgahoel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Kkgahoel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nbmdhfog.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5bb744bb24ecae9c9d4afc3b0725a540_NeikiAnalytics.exeAcekjjmk.exeAnahqh32.exeBadnhbce.exeBidlgdlk.exeBigimdjh.exeChqoipkk.exeComdkipe.exeDpcjnabn.exeDiphbfdi.exeDegiggjm.exeEdnbncmb.exeFjbafi32.exeFoccjood.exeGbfiaj32.exeGnpflj32.exedescription pid process target process PID 2300 wrote to memory of 1776 2300 5bb744bb24ecae9c9d4afc3b0725a540_NeikiAnalytics.exe Acekjjmk.exe PID 2300 wrote to memory of 1776 2300 5bb744bb24ecae9c9d4afc3b0725a540_NeikiAnalytics.exe Acekjjmk.exe PID 2300 wrote to memory of 1776 2300 5bb744bb24ecae9c9d4afc3b0725a540_NeikiAnalytics.exe Acekjjmk.exe PID 2300 wrote to memory of 1776 2300 5bb744bb24ecae9c9d4afc3b0725a540_NeikiAnalytics.exe Acekjjmk.exe PID 1776 wrote to memory of 2916 1776 Acekjjmk.exe Anahqh32.exe PID 1776 wrote to memory of 2916 1776 Acekjjmk.exe Anahqh32.exe PID 1776 wrote to memory of 2916 1776 Acekjjmk.exe Anahqh32.exe PID 1776 wrote to memory of 2916 1776 Acekjjmk.exe Anahqh32.exe PID 2916 wrote to memory of 2716 2916 Anahqh32.exe Badnhbce.exe PID 2916 wrote to memory of 2716 2916 Anahqh32.exe Badnhbce.exe PID 2916 wrote to memory of 2716 2916 Anahqh32.exe Badnhbce.exe PID 2916 wrote to memory of 2716 2916 Anahqh32.exe Badnhbce.exe PID 2716 wrote to memory of 2672 2716 Badnhbce.exe Bidlgdlk.exe PID 2716 wrote to memory of 2672 2716 Badnhbce.exe Bidlgdlk.exe PID 2716 wrote to memory of 2672 2716 Badnhbce.exe Bidlgdlk.exe PID 2716 wrote to memory of 2672 2716 Badnhbce.exe Bidlgdlk.exe PID 2672 wrote to memory of 2604 2672 Bidlgdlk.exe Bigimdjh.exe PID 2672 wrote to memory of 2604 2672 Bidlgdlk.exe Bigimdjh.exe PID 2672 wrote to memory of 2604 2672 Bidlgdlk.exe Bigimdjh.exe PID 2672 wrote to memory of 2604 2672 Bidlgdlk.exe Bigimdjh.exe PID 2604 wrote to memory of 2796 2604 Bigimdjh.exe Chqoipkk.exe PID 2604 wrote to memory of 2796 2604 Bigimdjh.exe Chqoipkk.exe PID 2604 wrote to memory of 2796 2604 Bigimdjh.exe Chqoipkk.exe PID 2604 wrote to memory of 2796 2604 Bigimdjh.exe Chqoipkk.exe PID 2796 wrote to memory of 112 2796 Chqoipkk.exe Comdkipe.exe PID 2796 wrote to memory of 112 2796 Chqoipkk.exe Comdkipe.exe PID 2796 wrote to memory of 112 2796 Chqoipkk.exe Comdkipe.exe PID 2796 wrote to memory of 112 2796 Chqoipkk.exe Comdkipe.exe PID 112 wrote to memory of 372 112 Comdkipe.exe Dpcjnabn.exe PID 112 wrote to memory of 372 112 Comdkipe.exe Dpcjnabn.exe PID 112 wrote to memory of 372 112 Comdkipe.exe Dpcjnabn.exe PID 112 wrote to memory of 372 112 Comdkipe.exe Dpcjnabn.exe PID 372 wrote to memory of 2772 372 Dpcjnabn.exe Diphbfdi.exe PID 372 wrote to memory of 2772 372 Dpcjnabn.exe Diphbfdi.exe PID 372 wrote to memory of 2772 372 Dpcjnabn.exe Diphbfdi.exe PID 372 wrote to memory of 2772 372 Dpcjnabn.exe Diphbfdi.exe PID 2772 wrote to memory of 2008 2772 Diphbfdi.exe Degiggjm.exe PID 2772 wrote to memory of 2008 2772 Diphbfdi.exe Degiggjm.exe PID 2772 wrote to memory of 2008 2772 Diphbfdi.exe Degiggjm.exe PID 2772 wrote to memory of 2008 2772 Diphbfdi.exe Degiggjm.exe PID 2008 wrote to memory of 1976 2008 Degiggjm.exe Ednbncmb.exe PID 2008 wrote to memory of 1976 2008 Degiggjm.exe Ednbncmb.exe PID 2008 wrote to memory of 1976 2008 Degiggjm.exe Ednbncmb.exe PID 2008 wrote to memory of 1976 2008 Degiggjm.exe Ednbncmb.exe PID 1976 wrote to memory of 1540 1976 Ednbncmb.exe Fjbafi32.exe PID 1976 wrote to memory of 1540 1976 Ednbncmb.exe Fjbafi32.exe PID 1976 wrote to memory of 1540 1976 Ednbncmb.exe Fjbafi32.exe PID 1976 wrote to memory of 1540 1976 Ednbncmb.exe Fjbafi32.exe PID 1540 wrote to memory of 2628 1540 Fjbafi32.exe Foccjood.exe PID 1540 wrote to memory of 2628 1540 Fjbafi32.exe Foccjood.exe PID 1540 wrote to memory of 2628 1540 Fjbafi32.exe Foccjood.exe PID 1540 wrote to memory of 2628 1540 Fjbafi32.exe Foccjood.exe PID 2628 wrote to memory of 764 2628 Foccjood.exe Gbfiaj32.exe PID 2628 wrote to memory of 764 2628 Foccjood.exe Gbfiaj32.exe PID 2628 wrote to memory of 764 2628 Foccjood.exe Gbfiaj32.exe PID 2628 wrote to memory of 764 2628 Foccjood.exe Gbfiaj32.exe PID 764 wrote to memory of 2064 764 Gbfiaj32.exe Gnpflj32.exe PID 764 wrote to memory of 2064 764 Gbfiaj32.exe Gnpflj32.exe PID 764 wrote to memory of 2064 764 Gbfiaj32.exe Gnpflj32.exe PID 764 wrote to memory of 2064 764 Gbfiaj32.exe Gnpflj32.exe PID 2064 wrote to memory of 2960 2064 Gnpflj32.exe Gmgpbf32.exe PID 2064 wrote to memory of 2960 2064 Gnpflj32.exe Gmgpbf32.exe PID 2064 wrote to memory of 2960 2064 Gnpflj32.exe Gmgpbf32.exe PID 2064 wrote to memory of 2960 2064 Gnpflj32.exe Gmgpbf32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bb744bb24ecae9c9d4afc3b0725a540_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5bb744bb24ecae9c9d4afc3b0725a540_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\Acekjjmk.exeC:\Windows\system32\Acekjjmk.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\Anahqh32.exeC:\Windows\system32\Anahqh32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\Badnhbce.exeC:\Windows\system32\Badnhbce.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\Bidlgdlk.exeC:\Windows\system32\Bidlgdlk.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\Bigimdjh.exeC:\Windows\system32\Bigimdjh.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\Chqoipkk.exeC:\Windows\system32\Chqoipkk.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\Comdkipe.exeC:\Windows\system32\Comdkipe.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Windows\SysWOW64\Dpcjnabn.exeC:\Windows\system32\Dpcjnabn.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Windows\SysWOW64\Diphbfdi.exeC:\Windows\system32\Diphbfdi.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\Degiggjm.exeC:\Windows\system32\Degiggjm.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\Ednbncmb.exeC:\Windows\system32\Ednbncmb.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\Fjbafi32.exeC:\Windows\system32\Fjbafi32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\Foccjood.exeC:\Windows\system32\Foccjood.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\Gbfiaj32.exeC:\Windows\system32\Gbfiaj32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\SysWOW64\Gnpflj32.exeC:\Windows\system32\Gnpflj32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\SysWOW64\Gmgpbf32.exeC:\Windows\system32\Gmgpbf32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Windows\SysWOW64\Hmjlhfof.exeC:\Windows\system32\Hmjlhfof.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Windows\SysWOW64\Hnpbjnpo.exeC:\Windows\system32\Hnpbjnpo.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Windows\SysWOW64\Ipehmebh.exeC:\Windows\system32\Ipehmebh.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1488 -
C:\Windows\SysWOW64\Ioooiack.exeC:\Windows\system32\Ioooiack.exe21⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1180 -
C:\Windows\SysWOW64\Ipokcdjn.exeC:\Windows\system32\Ipokcdjn.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Windows\SysWOW64\Jkkija32.exeC:\Windows\system32\Jkkija32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:916 -
C:\Windows\SysWOW64\Jdcmbgkj.exeC:\Windows\system32\Jdcmbgkj.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2748 -
C:\Windows\SysWOW64\Jplkmgol.exeC:\Windows\system32\Jplkmgol.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Windows\SysWOW64\Kcmcoblm.exeC:\Windows\system32\Kcmcoblm.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Windows\SysWOW64\Klhemhpk.exeC:\Windows\system32\Klhemhpk.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2088 -
C:\Windows\SysWOW64\Kfpifm32.exeC:\Windows\system32\Kfpifm32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Windows\SysWOW64\Kdefgj32.exeC:\Windows\system32\Kdefgj32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Windows\SysWOW64\Lomgjb32.exeC:\Windows\system32\Lomgjb32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Windows\SysWOW64\Lkfddc32.exeC:\Windows\system32\Lkfddc32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2448 -
C:\Windows\SysWOW64\Lfpeeqig.exeC:\Windows\system32\Lfpeeqig.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Windows\SysWOW64\Mjpkqonj.exeC:\Windows\system32\Mjpkqonj.exe33⤵
- Executes dropped EXE
PID:2496 -
C:\Windows\SysWOW64\Mpmcielb.exeC:\Windows\system32\Mpmcielb.exe34⤵
- Executes dropped EXE
PID:2452 -
C:\Windows\SysWOW64\Mfglep32.exeC:\Windows\system32\Mfglep32.exe35⤵
- Executes dropped EXE
PID:2996 -
C:\Windows\SysWOW64\Macilmnk.exeC:\Windows\system32\Macilmnk.exe36⤵
- Executes dropped EXE
PID:652 -
C:\Windows\SysWOW64\Mccbmh32.exeC:\Windows\system32\Mccbmh32.exe37⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2696 -
C:\Windows\SysWOW64\Nfdkoc32.exeC:\Windows\system32\Nfdkoc32.exe38⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1636 -
C:\Windows\SysWOW64\Nhdhif32.exeC:\Windows\system32\Nhdhif32.exe39⤵
- Executes dropped EXE
PID:1988 -
C:\Windows\SysWOW64\Nbniid32.exeC:\Windows\system32\Nbniid32.exe40⤵
- Executes dropped EXE
PID:2224 -
C:\Windows\SysWOW64\Neqnqofm.exeC:\Windows\system32\Neqnqofm.exe41⤵
- Executes dropped EXE
PID:2592 -
C:\Windows\SysWOW64\Olkfmi32.exeC:\Windows\system32\Olkfmi32.exe42⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1784 -
C:\Windows\SysWOW64\Oioggmmc.exeC:\Windows\system32\Oioggmmc.exe43⤵
- Executes dropped EXE
PID:2428 -
C:\Windows\SysWOW64\Obgkpb32.exeC:\Windows\system32\Obgkpb32.exe44⤵
- Executes dropped EXE
PID:2740 -
C:\Windows\SysWOW64\Omqlpp32.exeC:\Windows\system32\Omqlpp32.exe45⤵
- Executes dropped EXE
PID:3000 -
C:\Windows\SysWOW64\Ohfqmi32.exeC:\Windows\system32\Ohfqmi32.exe46⤵
- Executes dropped EXE
PID:3020 -
C:\Windows\SysWOW64\Odmabj32.exeC:\Windows\system32\Odmabj32.exe47⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1968 -
C:\Windows\SysWOW64\Omefkplm.exeC:\Windows\system32\Omefkplm.exe48⤵
- Executes dropped EXE
PID:1152 -
C:\Windows\SysWOW64\Pilfpqaa.exeC:\Windows\system32\Pilfpqaa.exe49⤵
- Executes dropped EXE
PID:2100 -
C:\Windows\SysWOW64\Pcdkif32.exeC:\Windows\system32\Pcdkif32.exe50⤵
- Executes dropped EXE
- Modifies registry class
PID:1068 -
C:\Windows\SysWOW64\Pphkbj32.exeC:\Windows\system32\Pphkbj32.exe51⤵
- Executes dropped EXE
PID:1508 -
C:\Windows\SysWOW64\Peedka32.exeC:\Windows\system32\Peedka32.exe52⤵
- Executes dropped EXE
PID:3036 -
C:\Windows\SysWOW64\Ppkhhjei.exeC:\Windows\system32\Ppkhhjei.exe53⤵
- Executes dropped EXE
PID:1676 -
C:\Windows\SysWOW64\Palepb32.exeC:\Windows\system32\Palepb32.exe54⤵
- Executes dropped EXE
PID:1588 -
C:\Windows\SysWOW64\Panaeb32.exeC:\Windows\system32\Panaeb32.exe55⤵
- Executes dropped EXE
PID:2688 -
C:\Windows\SysWOW64\Pldebkhj.exeC:\Windows\system32\Pldebkhj.exe56⤵
- Executes dropped EXE
PID:2556 -
C:\Windows\SysWOW64\Qfljkp32.exeC:\Windows\system32\Qfljkp32.exe57⤵
- Executes dropped EXE
PID:2612 -
C:\Windows\SysWOW64\Qqfkln32.exeC:\Windows\system32\Qqfkln32.exe58⤵
- Executes dropped EXE
PID:2380 -
C:\Windows\SysWOW64\Qhmcmk32.exeC:\Windows\system32\Qhmcmk32.exe59⤵
- Executes dropped EXE
PID:2344 -
C:\Windows\SysWOW64\Ajnpecbj.exeC:\Windows\system32\Ajnpecbj.exe60⤵
- Executes dropped EXE
PID:1916 -
C:\Windows\SysWOW64\Acfdnihk.exeC:\Windows\system32\Acfdnihk.exe61⤵
- Executes dropped EXE
PID:1372 -
C:\Windows\SysWOW64\Aqjdgmgd.exeC:\Windows\system32\Aqjdgmgd.exe62⤵
- Executes dropped EXE
PID:2652 -
C:\Windows\SysWOW64\Aobnniji.exeC:\Windows\system32\Aobnniji.exe63⤵
- Executes dropped EXE
PID:1992 -
C:\Windows\SysWOW64\Aijbfo32.exeC:\Windows\system32\Aijbfo32.exe64⤵
- Executes dropped EXE
PID:2148 -
C:\Windows\SysWOW64\Beackp32.exeC:\Windows\system32\Beackp32.exe65⤵
- Executes dropped EXE
PID:2632 -
C:\Windows\SysWOW64\Bnihdemo.exeC:\Windows\system32\Bnihdemo.exe66⤵PID:2252
-
C:\Windows\SysWOW64\Biolanld.exeC:\Windows\system32\Biolanld.exe67⤵PID:2244
-
C:\Windows\SysWOW64\Bkmhnjlh.exeC:\Windows\system32\Bkmhnjlh.exe68⤵PID:1404
-
C:\Windows\SysWOW64\Bbjmpcab.exeC:\Windows\system32\Bbjmpcab.exe69⤵PID:3056
-
C:\Windows\SysWOW64\Bgffhkoj.exeC:\Windows\system32\Bgffhkoj.exe70⤵PID:2032
-
C:\Windows\SysWOW64\Bejfao32.exeC:\Windows\system32\Bejfao32.exe71⤵
- Modifies registry class
PID:2044 -
C:\Windows\SysWOW64\Caaggpdh.exeC:\Windows\system32\Caaggpdh.exe72⤵PID:908
-
C:\Windows\SysWOW64\Cmhglq32.exeC:\Windows\system32\Cmhglq32.exe73⤵PID:1824
-
C:\Windows\SysWOW64\Cjlheehe.exeC:\Windows\system32\Cjlheehe.exe74⤵PID:1524
-
C:\Windows\SysWOW64\Ccdmnj32.exeC:\Windows\system32\Ccdmnj32.exe75⤵PID:2412
-
C:\Windows\SysWOW64\Clpabm32.exeC:\Windows\system32\Clpabm32.exe76⤵PID:2480
-
C:\Windows\SysWOW64\Cfeepelg.exeC:\Windows\system32\Cfeepelg.exe77⤵PID:2120
-
C:\Windows\SysWOW64\Cpmjhk32.exeC:\Windows\system32\Cpmjhk32.exe78⤵PID:2408
-
C:\Windows\SysWOW64\Dejbqb32.exeC:\Windows\system32\Dejbqb32.exe79⤵PID:2800
-
C:\Windows\SysWOW64\Dhiomn32.exeC:\Windows\system32\Dhiomn32.exe80⤵PID:2188
-
C:\Windows\SysWOW64\Dobgihgp.exeC:\Windows\system32\Dobgihgp.exe81⤵PID:2808
-
C:\Windows\SysWOW64\Dkigoimd.exeC:\Windows\system32\Dkigoimd.exe82⤵PID:1952
-
C:\Windows\SysWOW64\Dhmhhmlm.exeC:\Windows\system32\Dhmhhmlm.exe83⤵PID:2156
-
C:\Windows\SysWOW64\Dphmloih.exeC:\Windows\system32\Dphmloih.exe84⤵PID:1720
-
C:\Windows\SysWOW64\Dknajh32.exeC:\Windows\system32\Dknajh32.exe85⤵PID:324
-
C:\Windows\SysWOW64\Dpkibo32.exeC:\Windows\system32\Dpkibo32.exe86⤵PID:2952
-
C:\Windows\SysWOW64\Dgeaoinb.exeC:\Windows\system32\Dgeaoinb.exe87⤵
- Drops file in System32 directory
PID:2292 -
C:\Windows\SysWOW64\Edibhmml.exeC:\Windows\system32\Edibhmml.exe88⤵PID:1388
-
C:\Windows\SysWOW64\Eldglp32.exeC:\Windows\system32\Eldglp32.exe89⤵PID:2660
-
C:\Windows\SysWOW64\Elfcbo32.exeC:\Windows\system32\Elfcbo32.exe90⤵PID:3016
-
C:\Windows\SysWOW64\Eeohkeoe.exeC:\Windows\system32\Eeohkeoe.exe91⤵PID:2420
-
C:\Windows\SysWOW64\Eklqcl32.exeC:\Windows\system32\Eklqcl32.exe92⤵PID:1564
-
C:\Windows\SysWOW64\Ehpalp32.exeC:\Windows\system32\Ehpalp32.exe93⤵PID:2528
-
C:\Windows\SysWOW64\Eecafd32.exeC:\Windows\system32\Eecafd32.exe94⤵PID:2572
-
C:\Windows\SysWOW64\Fajbke32.exeC:\Windows\system32\Fajbke32.exe95⤵PID:2648
-
C:\Windows\SysWOW64\Fhdjgoha.exeC:\Windows\system32\Fhdjgoha.exe96⤵PID:816
-
C:\Windows\SysWOW64\Fpoolael.exeC:\Windows\system32\Fpoolael.exe97⤵PID:1332
-
C:\Windows\SysWOW64\Fjhcegll.exeC:\Windows\system32\Fjhcegll.exe98⤵PID:1236
-
C:\Windows\SysWOW64\Fdmhbplb.exeC:\Windows\system32\Fdmhbplb.exe99⤵PID:1600
-
C:\Windows\SysWOW64\Fjjpjgjj.exeC:\Windows\system32\Fjjpjgjj.exe100⤵PID:2288
-
C:\Windows\SysWOW64\Fcbecl32.exeC:\Windows\system32\Fcbecl32.exe101⤵PID:1176
-
C:\Windows\SysWOW64\Fqfemqod.exeC:\Windows\system32\Fqfemqod.exe102⤵PID:1648
-
C:\Windows\SysWOW64\Ghajacmo.exeC:\Windows\system32\Ghajacmo.exe103⤵PID:2124
-
C:\Windows\SysWOW64\Gfejjgli.exeC:\Windows\system32\Gfejjgli.exe104⤵PID:1080
-
C:\Windows\SysWOW64\Gmpcgace.exeC:\Windows\system32\Gmpcgace.exe105⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1788 -
C:\Windows\SysWOW64\Gkephn32.exeC:\Windows\system32\Gkephn32.exe106⤵PID:1740
-
C:\Windows\SysWOW64\Gkglnm32.exeC:\Windows\system32\Gkglnm32.exe107⤵PID:2944
-
C:\Windows\SysWOW64\Gbadjg32.exeC:\Windows\system32\Gbadjg32.exe108⤵PID:2208
-
C:\Windows\SysWOW64\Ggnmbn32.exeC:\Windows\system32\Ggnmbn32.exe109⤵PID:2892
-
C:\Windows\SysWOW64\Hmkeke32.exeC:\Windows\system32\Hmkeke32.exe110⤵PID:1704
-
C:\Windows\SysWOW64\Hfcjdkpg.exeC:\Windows\system32\Hfcjdkpg.exe111⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2968 -
C:\Windows\SysWOW64\Hgbfnngi.exeC:\Windows\system32\Hgbfnngi.exe112⤵PID:2360
-
C:\Windows\SysWOW64\Hakkgc32.exeC:\Windows\system32\Hakkgc32.exe113⤵PID:3052
-
C:\Windows\SysWOW64\Hldlga32.exeC:\Windows\system32\Hldlga32.exe114⤵PID:1956
-
C:\Windows\SysWOW64\Hihlqeib.exeC:\Windows\system32\Hihlqeib.exe115⤵PID:2816
-
C:\Windows\SysWOW64\Ieomef32.exeC:\Windows\system32\Ieomef32.exe116⤵PID:1604
-
C:\Windows\SysWOW64\Ihniaa32.exeC:\Windows\system32\Ihniaa32.exe117⤵PID:1100
-
C:\Windows\SysWOW64\Iafnjg32.exeC:\Windows\system32\Iafnjg32.exe118⤵PID:2272
-
C:\Windows\SysWOW64\Injndk32.exeC:\Windows\system32\Injndk32.exe119⤵PID:1120
-
C:\Windows\SysWOW64\Ijqoilii.exeC:\Windows\system32\Ijqoilii.exe120⤵PID:1680
-
C:\Windows\SysWOW64\Idicbbpi.exeC:\Windows\system32\Idicbbpi.exe121⤵PID:2040
-
C:\Windows\SysWOW64\Ioohokoo.exeC:\Windows\system32\Ioohokoo.exe122⤵PID:1608
-
C:\Windows\SysWOW64\Ihglhp32.exeC:\Windows\system32\Ihglhp32.exe123⤵PID:2872
-
C:\Windows\SysWOW64\Iihiphln.exeC:\Windows\system32\Iihiphln.exe124⤵PID:1936
-
C:\Windows\SysWOW64\Jpbalb32.exeC:\Windows\system32\Jpbalb32.exe125⤵PID:2352
-
C:\Windows\SysWOW64\Jlphbbbg.exeC:\Windows\system32\Jlphbbbg.exe126⤵PID:2404
-
C:\Windows\SysWOW64\Jondnnbk.exeC:\Windows\system32\Jondnnbk.exe127⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1116 -
C:\Windows\SysWOW64\Klbdgb32.exeC:\Windows\system32\Klbdgb32.exe128⤵PID:1192
-
C:\Windows\SysWOW64\Kdnild32.exeC:\Windows\system32\Kdnild32.exe129⤵PID:1460
-
C:\Windows\SysWOW64\Kkgahoel.exeC:\Windows\system32\Kkgahoel.exe130⤵
- Modifies registry class
PID:1728 -
C:\Windows\SysWOW64\Kadfkhkf.exeC:\Windows\system32\Kadfkhkf.exe131⤵PID:2940
-
C:\Windows\SysWOW64\Kgqocoin.exeC:\Windows\system32\Kgqocoin.exe132⤵PID:2732
-
C:\Windows\SysWOW64\Kffldlne.exeC:\Windows\system32\Kffldlne.exe133⤵PID:876
-
C:\Windows\SysWOW64\Lcjlnpmo.exeC:\Windows\system32\Lcjlnpmo.exe134⤵PID:2056
-
C:\Windows\SysWOW64\Loqmba32.exeC:\Windows\system32\Loqmba32.exe135⤵PID:1308
-
C:\Windows\SysWOW64\Lkgngb32.exeC:\Windows\system32\Lkgngb32.exe136⤵PID:2232
-
C:\Windows\SysWOW64\Ldpbpgoh.exeC:\Windows\system32\Ldpbpgoh.exe137⤵
- Modifies registry class
PID:2532 -
C:\Windows\SysWOW64\Lnhgim32.exeC:\Windows\system32\Lnhgim32.exe138⤵
- Drops file in System32 directory
PID:1172 -
C:\Windows\SysWOW64\Lklgbadb.exeC:\Windows\system32\Lklgbadb.exe139⤵
- Modifies registry class
PID:2468 -
C:\Windows\SysWOW64\Lddlkg32.exeC:\Windows\system32\Lddlkg32.exe140⤵PID:636
-
C:\Windows\SysWOW64\Mcjhmcok.exeC:\Windows\system32\Mcjhmcok.exe141⤵PID:2308
-
C:\Windows\SysWOW64\Mclebc32.exeC:\Windows\system32\Mclebc32.exe142⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1920 -
C:\Windows\SysWOW64\Mfmndn32.exeC:\Windows\system32\Mfmndn32.exe143⤵
- Modifies registry class
PID:780 -
C:\Windows\SysWOW64\Mqbbagjo.exeC:\Windows\system32\Mqbbagjo.exe144⤵
- Drops file in System32 directory
PID:2972 -
C:\Windows\SysWOW64\Mklcadfn.exeC:\Windows\system32\Mklcadfn.exe145⤵PID:676
-
C:\Windows\SysWOW64\Nfahomfd.exeC:\Windows\system32\Nfahomfd.exe146⤵PID:1832
-
C:\Windows\SysWOW64\Nnmlcp32.exeC:\Windows\system32\Nnmlcp32.exe147⤵PID:1548
-
C:\Windows\SysWOW64\Nefdpjkl.exeC:\Windows\system32\Nefdpjkl.exe148⤵PID:2348
-
C:\Windows\SysWOW64\Nhgnaehm.exeC:\Windows\system32\Nhgnaehm.exe149⤵PID:2564
-
C:\Windows\SysWOW64\Nbmaon32.exeC:\Windows\system32\Nbmaon32.exe150⤵PID:2500
-
C:\Windows\SysWOW64\Njhfcp32.exeC:\Windows\system32\Njhfcp32.exe151⤵
- Drops file in System32 directory
PID:2848 -
C:\Windows\SysWOW64\Ndqkleln.exeC:\Windows\system32\Ndqkleln.exe152⤵PID:1328
-
C:\Windows\SysWOW64\Omioekbo.exeC:\Windows\system32\Omioekbo.exe153⤵PID:1904
-
C:\Windows\SysWOW64\Ofadnq32.exeC:\Windows\system32\Ofadnq32.exe154⤵PID:1104
-
C:\Windows\SysWOW64\Oaghki32.exeC:\Windows\system32\Oaghki32.exe155⤵PID:524
-
C:\Windows\SysWOW64\Ofcqcp32.exeC:\Windows\system32\Ofcqcp32.exe156⤵
- Drops file in System32 directory
- Modifies registry class
PID:1712 -
C:\Windows\SysWOW64\Objaha32.exeC:\Windows\system32\Objaha32.exe157⤵PID:3004
-
C:\Windows\SysWOW64\Olbfagca.exeC:\Windows\system32\Olbfagca.exe158⤵PID:1572
-
C:\Windows\SysWOW64\Ohiffh32.exeC:\Windows\system32\Ohiffh32.exe159⤵PID:880
-
C:\Windows\SysWOW64\Oabkom32.exeC:\Windows\system32\Oabkom32.exe160⤵PID:2460
-
C:\Windows\SysWOW64\Pofkha32.exeC:\Windows\system32\Pofkha32.exe161⤵PID:2684
-
C:\Windows\SysWOW64\Phnpagdp.exeC:\Windows\system32\Phnpagdp.exe162⤵PID:2828
-
C:\Windows\SysWOW64\Pdeqfhjd.exeC:\Windows\system32\Pdeqfhjd.exe163⤵PID:1688
-
C:\Windows\SysWOW64\Pmmeon32.exeC:\Windows\system32\Pmmeon32.exe164⤵PID:576
-
C:\Windows\SysWOW64\Pidfdofi.exeC:\Windows\system32\Pidfdofi.exe165⤵PID:3060
-
C:\Windows\SysWOW64\Pdjjag32.exeC:\Windows\system32\Pdjjag32.exe166⤵PID:984
-
C:\Windows\SysWOW64\Pnbojmmp.exeC:\Windows\system32\Pnbojmmp.exe167⤵PID:2984
-
C:\Windows\SysWOW64\Qndkpmkm.exeC:\Windows\system32\Qndkpmkm.exe168⤵PID:1624
-
C:\Windows\SysWOW64\Qgmpibam.exeC:\Windows\system32\Qgmpibam.exe169⤵
- Modifies registry class
PID:2396 -
C:\Windows\SysWOW64\Aohdmdoh.exeC:\Windows\system32\Aohdmdoh.exe170⤵PID:2836
-
C:\Windows\SysWOW64\Acfmcc32.exeC:\Windows\system32\Acfmcc32.exe171⤵
- Drops file in System32 directory
PID:1140 -
C:\Windows\SysWOW64\Akabgebj.exeC:\Windows\system32\Akabgebj.exe172⤵PID:1316
-
C:\Windows\SysWOW64\Alqnah32.exeC:\Windows\system32\Alqnah32.exe173⤵PID:1716
-
C:\Windows\SysWOW64\Abmgjo32.exeC:\Windows\system32\Abmgjo32.exe174⤵PID:2708
-
C:\Windows\SysWOW64\Aqbdkk32.exeC:\Windows\system32\Aqbdkk32.exe175⤵PID:2456
-
C:\Windows\SysWOW64\Bnfddp32.exeC:\Windows\system32\Bnfddp32.exe176⤵PID:2584
-
C:\Windows\SysWOW64\Bkjdndjo.exeC:\Windows\system32\Bkjdndjo.exe177⤵PID:940
-
C:\Windows\SysWOW64\Bqgmfkhg.exeC:\Windows\system32\Bqgmfkhg.exe178⤵PID:1088
-
C:\Windows\SysWOW64\Bqijljfd.exeC:\Windows\system32\Bqijljfd.exe179⤵
- Drops file in System32 directory
PID:1944 -
C:\Windows\SysWOW64\Cileqlmg.exeC:\Windows\system32\Cileqlmg.exe180⤵PID:2784
-
C:\Windows\SysWOW64\Cnimiblo.exeC:\Windows\system32\Cnimiblo.exe181⤵PID:1468
-
C:\Windows\SysWOW64\Cgaaah32.exeC:\Windows\system32\Cgaaah32.exe182⤵
- Drops file in System32 directory
PID:2220 -
C:\Windows\SysWOW64\Cbffoabe.exeC:\Windows\system32\Cbffoabe.exe183⤵PID:1484
-
C:\Windows\SysWOW64\Cnmfdb32.exeC:\Windows\system32\Cnmfdb32.exe184⤵PID:1124
-
C:\Windows\SysWOW64\Cgfkmgnj.exeC:\Windows\system32\Cgfkmgnj.exe185⤵PID:708
-
C:\Windows\SysWOW64\Dnpciaef.exeC:\Windows\system32\Dnpciaef.exe186⤵PID:2812
-
C:\Windows\SysWOW64\Diidjpbe.exeC:\Windows\system32\Diidjpbe.exe187⤵PID:2608
-
C:\Windows\SysWOW64\Dpcmgi32.exeC:\Windows\system32\Dpcmgi32.exe188⤵PID:1796
-
C:\Windows\SysWOW64\Dilapopb.exeC:\Windows\system32\Dilapopb.exe189⤵PID:2596
-
C:\Windows\SysWOW64\Ddaemh32.exeC:\Windows\system32\Ddaemh32.exe190⤵PID:3096
-
C:\Windows\SysWOW64\Dfpaic32.exeC:\Windows\system32\Dfpaic32.exe191⤵PID:3136
-
C:\Windows\SysWOW64\Dmijfmfi.exeC:\Windows\system32\Dmijfmfi.exe192⤵PID:3176
-
C:\Windows\SysWOW64\Dipjkn32.exeC:\Windows\system32\Dipjkn32.exe193⤵
- Modifies registry class
PID:3216 -
C:\Windows\SysWOW64\Dbiocd32.exeC:\Windows\system32\Dbiocd32.exe194⤵PID:3256
-
C:\Windows\SysWOW64\Eibgpnjk.exeC:\Windows\system32\Eibgpnjk.exe195⤵PID:3296
-
C:\Windows\SysWOW64\Ebklic32.exeC:\Windows\system32\Ebklic32.exe196⤵PID:3336
-
C:\Windows\SysWOW64\Elcpbigl.exeC:\Windows\system32\Elcpbigl.exe197⤵PID:3376
-
C:\Windows\SysWOW64\Emdmjamj.exeC:\Windows\system32\Emdmjamj.exe198⤵PID:3416
-
C:\Windows\SysWOW64\Egmabg32.exeC:\Windows\system32\Egmabg32.exe199⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3456 -
C:\Windows\SysWOW64\Epeekmjk.exeC:\Windows\system32\Epeekmjk.exe200⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3496 -
C:\Windows\SysWOW64\Ekkjheja.exeC:\Windows\system32\Ekkjheja.exe201⤵PID:3536
-
C:\Windows\SysWOW64\Emifeqid.exeC:\Windows\system32\Emifeqid.exe202⤵PID:3576
-
C:\Windows\SysWOW64\Ekmfne32.exeC:\Windows\system32\Ekmfne32.exe203⤵PID:3616
-
C:\Windows\SysWOW64\Flocfmnl.exeC:\Windows\system32\Flocfmnl.exe204⤵PID:3656
-
C:\Windows\SysWOW64\Flapkmlj.exeC:\Windows\system32\Flapkmlj.exe205⤵
- Modifies registry class
PID:3700 -
C:\Windows\SysWOW64\Fiepea32.exeC:\Windows\system32\Fiepea32.exe206⤵
- Modifies registry class
PID:3740 -
C:\Windows\SysWOW64\Foahmh32.exeC:\Windows\system32\Foahmh32.exe207⤵PID:3780
-
C:\Windows\SysWOW64\Figmjq32.exeC:\Windows\system32\Figmjq32.exe208⤵PID:3820
-
C:\Windows\SysWOW64\Fennoa32.exeC:\Windows\system32\Fennoa32.exe209⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:3860 -
C:\Windows\SysWOW64\Fkkfgi32.exeC:\Windows\system32\Fkkfgi32.exe210⤵PID:3900
-
C:\Windows\SysWOW64\Gnkoid32.exeC:\Windows\system32\Gnkoid32.exe211⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3940 -
C:\Windows\SysWOW64\Ggdcbi32.exeC:\Windows\system32\Ggdcbi32.exe212⤵PID:3980
-
C:\Windows\SysWOW64\Gckdgjeb.exeC:\Windows\system32\Gckdgjeb.exe213⤵PID:4020
-
C:\Windows\SysWOW64\Gcmamj32.exeC:\Windows\system32\Gcmamj32.exe214⤵PID:4060
-
C:\Windows\SysWOW64\Gjgiidkl.exeC:\Windows\system32\Gjgiidkl.exe215⤵
- Modifies registry class
PID:1828 -
C:\Windows\SysWOW64\Gconbj32.exeC:\Windows\system32\Gconbj32.exe216⤵PID:3116
-
C:\Windows\SysWOW64\Hofngkga.exeC:\Windows\system32\Hofngkga.exe217⤵PID:3164
-
C:\Windows\SysWOW64\Hfpfdeon.exeC:\Windows\system32\Hfpfdeon.exe218⤵PID:3208
-
C:\Windows\SysWOW64\Hohkmj32.exeC:\Windows\system32\Hohkmj32.exe219⤵PID:3228
-
C:\Windows\SysWOW64\Hkolakkb.exeC:\Windows\system32\Hkolakkb.exe220⤵PID:3268
-
C:\Windows\SysWOW64\Hgflflqg.exeC:\Windows\system32\Hgflflqg.exe221⤵PID:3384
-
C:\Windows\SysWOW64\Hnpdcf32.exeC:\Windows\system32\Hnpdcf32.exe222⤵PID:3424
-
C:\Windows\SysWOW64\Hgkfal32.exeC:\Windows\system32\Hgkfal32.exe223⤵PID:3472
-
C:\Windows\SysWOW64\Ijkocg32.exeC:\Windows\system32\Ijkocg32.exe224⤵PID:3520
-
C:\Windows\SysWOW64\Igoomk32.exeC:\Windows\system32\Igoomk32.exe225⤵PID:3568
-
C:\Windows\SysWOW64\Imlhebfc.exeC:\Windows\system32\Imlhebfc.exe226⤵PID:3588
-
C:\Windows\SysWOW64\Ijphofem.exeC:\Windows\system32\Ijphofem.exe227⤵
- Drops file in System32 directory
PID:3672 -
C:\Windows\SysWOW64\Iladfn32.exeC:\Windows\system32\Iladfn32.exe228⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3716 -
C:\Windows\SysWOW64\Iieepbje.exeC:\Windows\system32\Iieepbje.exe229⤵PID:3764
-
C:\Windows\SysWOW64\Jbnjhh32.exeC:\Windows\system32\Jbnjhh32.exe230⤵PID:3812
-
C:\Windows\SysWOW64\Jndjmifj.exeC:\Windows\system32\Jndjmifj.exe231⤵PID:3868
-
C:\Windows\SysWOW64\Jlhkgm32.exeC:\Windows\system32\Jlhkgm32.exe232⤵PID:3912
-
C:\Windows\SysWOW64\Jhoklnkg.exeC:\Windows\system32\Jhoklnkg.exe233⤵PID:3964
-
C:\Windows\SysWOW64\Jagpdd32.exeC:\Windows\system32\Jagpdd32.exe234⤵
- Drops file in System32 directory
PID:4016 -
C:\Windows\SysWOW64\Jjpdmi32.exeC:\Windows\system32\Jjpdmi32.exe235⤵PID:4080
-
C:\Windows\SysWOW64\Jpmmfp32.exeC:\Windows\system32\Jpmmfp32.exe236⤵PID:4084
-
C:\Windows\SysWOW64\Kmqmod32.exeC:\Windows\system32\Kmqmod32.exe237⤵PID:3144
-
C:\Windows\SysWOW64\Kfibhjlj.exeC:\Windows\system32\Kfibhjlj.exe238⤵PID:3212
-
C:\Windows\SysWOW64\Kbpbmkan.exeC:\Windows\system32\Kbpbmkan.exe239⤵PID:3280
-
C:\Windows\SysWOW64\Kijkje32.exeC:\Windows\system32\Kijkje32.exe240⤵PID:3288
-
C:\Windows\SysWOW64\Koipglep.exeC:\Windows\system32\Koipglep.exe241⤵PID:3400
-
C:\Windows\SysWOW64\Kajiigba.exeC:\Windows\system32\Kajiigba.exe242⤵
- Drops file in System32 directory
PID:3444